diff --git a/.githooks/pre-commit b/.githooks/pre-commit
index d22600a2e3..1f2d1325c8 100755
--- a/.githooks/pre-commit
+++ b/.githooks/pre-commit
@@ -3,4 +3,7 @@ set -euo pipefail
 
 # Resolve via git toplevel so the hook works from any cwd (e.g., when
 # git invokes hooks from within a non-root subdirectory).
-"$(git rev-parse --show-toplevel)/scripts/check-local-path-leaks.sh" --cached
+repo_root="$(git rev-parse --show-toplevel)"
+
+"$repo_root/scripts/check-local-path-leaks.sh" --cached
+"$repo_root/scripts/check-go-lint.sh" --cached
diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 0000000000..9643fcfc09
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,6 @@
+# These five trusted-tool checkouts use job.workflow_sha, which the runner
+# provides but actionlint 1.7.12 does not yet include in its job context model.
+paths:
+  .github/workflows/trusted-linux-ci.yml:
+    ignore:
+      - '^property "workflow_sha" is not defined in object type \{check_run_id: number; container: \{id: string; network: string\}; services: \{string => \{id: string; network: string; ports: \{string => string\}\}\}; status: string\}$'
diff --git a/.github/actions/ci-tools/go-checks.mk b/.github/actions/ci-tools/go-checks.mk
index fb73582174..2660c736e2 100644
--- a/.github/actions/ci-tools/go-checks.mk
+++ b/.github/actions/ci-tools/go-checks.mk
@@ -3,7 +3,7 @@
 # tests, each job on its own runner.
 # LINT_BASE_REF, LINT_BASE_MODE, CONTRACT_BASE_REF, and TEST_GOFLAGS come from
 # the workflow.
-.PHONY: lint contracts tests
+.PHONY: lint contracts tests test-dependencies
 
 # Router recovery must hold over the whole tree, including inherited lines.
 lint:
@@ -17,14 +17,28 @@ contracts:
 	$(MAKE) -j1 -f Makefile verify-settings-bindings verify-playback-fixtures verify-route-inventory
 	$(MAKE) -j1 -f Makefile verify-migration-ledger verify-apiv2-openapi CONTRACT_GO_TESTS=0
 	git fetch --no-tags origin "+refs/heads/$${CONTRACT_BASE_REF}:refs/remotes/origin/$${CONTRACT_BASE_REF}"
+	$(MAKE) -j1 -f Makefile verify-v1-route-freeze BASE_REF="origin/$${CONTRACT_BASE_REF}"
 	$(MAKE) -j1 -f Makefile verify-apiv2-contract CONTRACT_GO_TESTS=0 BASE_REF="origin/$${CONTRACT_BASE_REF}"
 
 # Go's test cache cannot see files a test's child process reads, so these
 # packages always rerun; the grep fails when a new test starts go, git, or node
 # outside them or the packages whose subprocess inputs are immutable.
-UNCACHED := cmd/prairie internal/jellycompat internal/pluginhost internal/plugins
+UNCACHED := cmd/prairie internal/jellycompat internal/pluginhost internal/plugins scripts/ci/sizeratchet scripts/ci/migrationcheck
+# subprocess-manifest: scripts/ci/subprocess-tests.json
+# deferred: no recorded occurrence; retain UNCACHED and the subprocess guard.
 IMMUTABLE := internal/contractledger internal/contractspec internal/debugserver
-tests:
+test-dependencies:
+	@variants="$$(go list -deps -test -f '{{.ImportPath}}|{{.ForTest}}' ./internal/auth/ ./internal/api/handlers/)" || exit $$?; \
+	[ -n "$$variants" ] || { echo "::error::test dependency metadata is empty"; exit 1; }; \
+	printf '%s\n' "$$variants" | awk -F '|' '\
+	  $$2 != "" { split($$1, name, " "); \
+	    if ((name[1] == "github.com/prairie-server/prairie-server/internal/api/handlers" || \
+	         name[1] == "github.com/prairie-server/prairie-server/internal/apiv2") && name[1] != $$2) { \
+	      print "::error::lower-layer external test recompiles " $$0; bad=1 \
+	    } \
+	  } END { exit bad }'
+
+tests: test-dependencies
 	GOFLAGS="$${TEST_GOFLAGS}" $(MAKE) -f Makefile test-go
 	@want="$$(printf '%s\n' $(UNCACHED) $(IMMUTABLE) | sort -u)"; \
 	got="$$(git grep -l -E '(exec\.Command(Context)?\(([^,]+, )?"(go|git|node)"|LookPath\("(go|git|node)"\))' -- '*_test.go' | sed 's@/[^/]*$$@@' | sort -u)"; \
diff --git a/.github/actions/ci-tools/select-jobs.py b/.github/actions/ci-tools/select-jobs.py
index 165e274acf..e299d7405b 100644
--- a/.github/actions/ci-tools/select-jobs.py
+++ b/.github/actions/ci-tools/select-jobs.py
@@ -14,6 +14,12 @@
 # Run on every event regardless of what the diff touched.
 ALWAYS_JOBS = ("repo-checks",)
 SHA = re.compile(r"[0-9a-fA-F]{40}\Z")
+# These are embedded by contracts/api/v2 and consumed by the Go ledger,
+# scenario and compatibility gates. Web generation consumes openapi/fixtures.
+GO_ONLY_CONTRACTS = frozenset("contracts/api/v2/" + name for name in (
+    "migration.json", "migration.schema.json", "offline-routes.txt",
+    "breaking-approvals.json", "breaking-approvals.schema.json",
+))
 
 
 def all_jobs(reason):
@@ -29,6 +35,16 @@ def classify(paths):
         if (not parts or path.startswith("/") or ".." in parts
                 or any(ord(char) < 32 for char in path)):
             return all_jobs("unrecognized path")
+        if (path == ".github/evidence.yml"
+                or (path.startswith(".github/ISSUE_TEMPLATE/") and path.endswith((".yml", ".yaml", ".md")))
+                or (path.endswith(".md") and path.startswith((".github/", "scripts/", "cmd/")))):
+            continue
+        if (path in GO_ONLY_CONTRACTS
+                or path in {"scripts/ci/db-pins.txt", "scripts/ci/db-contracts.txt"}
+                or (path.startswith("internal/apiv2/") and path.endswith(".go"))
+                or (path.startswith("cmd/") and not path.startswith("cmd/settingsgen/"))):
+            go = True
+            continue
         # These feed both generated Go artifacts and their Web bindings, or
         # change how validation runs. Keep the entire gate for them.
         # Schemas under docs include executable fixtures whose tests glob all
@@ -90,7 +106,9 @@ def plan(event_name, event):
         # count a rename once, so a larger local count is still complete.
         if len(paths) < count:
             return all_jobs("incomplete changed-file count")
-        return classify(paths)
+        result = classify(paths)
+        result["paths"] = paths
+        return result
     except (KeyError, TypeError, ValueError, UnicodeError, OSError, subprocess.CalledProcessError):
         return all_jobs("PR comparison unavailable")
 
@@ -120,10 +138,20 @@ def main():
     if len(sys.argv) != 2 or sys.argv[1] not in {"plan", "check"}:
         raise SystemExit("expected plan or check")
     if sys.argv[1] == "check":
-        errors = check_results(json.loads(os.environ["CI_JOB_RESULTS"]))
+        needs = json.loads(os.environ["CI_JOB_RESULTS"])
+        errors = check_results(needs)
         if errors:
+            cancelled_jobs = sorted(job for job, outcome in needs.items()
+                                    if outcome.get("result") == "cancelled")
+            if cancelled_jobs:
+                print("Cancelled CI jobs: " + ", ".join(cancelled_jobs))
             for error in errors:
                 print("::error::" + error)
+            # A distinct nonzero status preserves cancellation evidence without
+            # turning an unexpectedly cancelled required child into success.
+            if cancelled_jobs and all(error.endswith(" ended with cancelled")
+                                      for error in errors):
+                return 2
             return 1
         print("Every selected CI job passed.")
         return 0
diff --git a/.github/actions/ci-tools/test_select_jobs.py b/.github/actions/ci-tools/test_select_jobs.py
index 51bab2a55f..097f2262eb 100644
--- a/.github/actions/ci-tools/test_select_jobs.py
+++ b/.github/actions/ci-tools/test_select_jobs.py
@@ -8,6 +8,7 @@
 import json
 import os
 from pathlib import Path
+import shutil
 import subprocess
 import sys
 import tempfile
@@ -119,6 +120,18 @@ def test_understood_inputs_choose_only_required_groups(self):
             ("pkg/client/client.go", True, False),
             ("example.go", True, False),
             ("docs/example.go", True, False),
+            ("internal/apiv2/registry.go", True, False),
+            ("internal/apiv2/registry_test.go", True, False),
+            ("cmd/prairie/main.go", True, False),
+            ("scripts/ci/db-pins.txt", True, False),
+            ("scripts/ci/db-contracts.txt", True, False),
+            ("contracts/api/v2/migration.json", True, False),
+            ("contracts/api/v2/migration.schema.json", True, False),
+            ("contracts/api/v2/offline-routes.txt", True, False),
+            ("contracts/api/v2/breaking-approvals.json", True, False),
+            (".github/actions/README.md", False, False),
+            (".github/evidence.yml", False, False),
+            (".github/ISSUE_TEMPLATE/bug-report.yml", False, False),
         ]
         for number, (path, go, web) in enumerate(cases):
             with self.subTest(path=path):
@@ -133,13 +146,11 @@ def test_understood_inputs_choose_only_required_groups(self):
     def test_shared_generation_and_validation_inputs_require_both_groups(self):
         cases = [
             ".github/workflows/ci.yml",
-            ".github/actions/README.md",
             "scripts/check-local-path-leaks.sh",
             "contracts/api/v2/openapi.json",
             "contracts/api/v2/README.md",
             "contracts/settings/v1/conformance.json",
             "tools/generate.py",
-            "internal/apiv2/registry.go",
             "internal/apiv2/docsui/LICENSE",
             "internal/settingscontract/contract.go",
             "cmd/settingsgen/main.go",
@@ -164,6 +175,11 @@ def test_shared_generation_and_validation_inputs_require_both_groups(self):
                 self.repo.commit()
                 self.assert_groups(self.repo.plan(), True, True)
 
+    def test_plan_reports_triggering_paths(self):
+        self.repo.write("internal/apiv2/registry.go")
+        self.repo.commit()
+        self.assertEqual(self.repo.plan().get("paths"), ["internal/apiv2/registry.go"])
+
     def test_markdown_inside_schema_inputs_is_not_skipped_as_documentation(self):
         for path in (
             "docs/design/schemas/README.md",
@@ -517,6 +533,153 @@ def test_check_cli_returns_failure_and_identifies_the_failed_job(self):
                 if failed:
                     self.assertIn("::error::go-integration ended with failure", run.stdout)
 
+    def test_check_cli_distinguishes_cancelled_children_from_failures(self):
+        needs = self.results()
+        needs["go-test"]["result"] = "cancelled"
+        run = subprocess.run(
+            [sys.executable, str(SCRIPT), "check"], capture_output=True, text=True,
+            env=dict(os.environ, CI_JOB_RESULTS=json.dumps(needs)),
+        )
+        self.assertEqual(run.returncode, 2, run.stdout + run.stderr)
+        self.assertIn("Cancelled CI jobs: go-test", run.stdout)
+        self.assertNotIn("Every selected CI job passed", run.stdout)
+        needs["web"]["result"] = "failure"
+        run = subprocess.run(
+            [sys.executable, str(SCRIPT), "check"], capture_output=True, text=True,
+            env=dict(os.environ, CI_JOB_RESULTS=json.dumps(needs)),
+        )
+        self.assertEqual(run.returncode, 1, run.stdout + run.stderr)
+        self.assertIn("web ended with failure", run.stdout)
+
+
+class WorkflowGateTests(unittest.TestCase):
+    root = SCRIPT.parents[3]
+
+    def pin_script(self):
+        workflow = (self.root / ".github/workflows/trusted-linux-ci.yml").read_text()
+        marker = "      - name: Check action SHA pins\n"
+        self.assertIn(marker, workflow, "Repository checks must enforce immutable actions")
+        step = workflow.split(marker, 1)[1].split("      - ", 1)[0]
+        script = step.split("        run: |\n", 1)[1]
+        return "\n".join(line[10:] for line in script.splitlines() if line.strip())
+
+    def test_pin_gate_rejects_nested_mutable_and_malformed_references(self):
+        script = self.pin_script()
+        with tempfile.TemporaryDirectory() as directory:
+            repo = Repository(Path(directory) / "repo")
+            for reference in ("actions/cache@v4", "owner/repo/workflow.yml@main",
+                              "actions/checkout@" + "a" * 39,
+                              "actions/checkout@" + "z" * 40):
+                with self.subTest(reference=reference):
+                    repo.write(".github/actions/nested/action.yml", "steps:\n  - uses: " + reference + "\n")
+                    repo.commit()
+                    run = subprocess.run(["bash", "-c", script], cwd=repo.path,
+                                         capture_output=True, text=True)
+                    self.assertNotEqual(run.returncode, 0, run.stdout + run.stderr)
+                    self.assertIn(reference, run.stdout + run.stderr)
+
+    def check_pin_fixture(self, step, expected):
+        workflow = ("name: pins\non: push\npermissions: {}\njobs:\n  test:\n"
+                    "    runs-on: ubuntu-24.04\n    steps:\n"
+                    "      - uses: actions/checkout@" + "a" * 40 + "\n"
+                    "      " + step + "\n")
+        if shutil.which("actionlint"):
+            valid = subprocess.run(["actionlint", "-oneline", "-"], input=workflow,
+                                   cwd=self.root, capture_output=True, text=True)
+            self.assertEqual(valid.returncode, 0, valid.stdout + valid.stderr)
+        with tempfile.TemporaryDirectory() as directory:
+            repo = Repository(Path(directory) / "repo")
+            repo.write(".github/workflows/test.yml", workflow)
+            repo.commit()
+            run = subprocess.run(["bash", "-c", self.pin_script()], cwd=repo.path,
+                                 capture_output=True, text=True)
+            self.assertEqual(run.returncode, expected,
+                             f"{step}: gate returned {run.returncode}, want {expected}\n"
+                             + run.stdout + run.stderr)
+
+    def test_pin_gate_rejects_flow_mapping(self):
+        self.check_pin_fixture("- { uses: actions/checkout@v4 }", 1)
+
+    def test_pin_gate_rejects_quoted_key(self):
+        self.check_pin_fixture('- "uses": actions/checkout@v4', 1)
+
+    def test_pin_gate_accepts_flow_mapping_without_uses(self):
+        self.check_pin_fixture("- run: echo ok\n        env: { A: b }", 0)
+
+    def test_pin_gate_accepts_pinned_block_mapping(self):
+        self.check_pin_fixture("- uses: actions/checkout@" + "b" * 40, 0)
+
+    def check_workflow_pin_fixture(self, reference, expected):
+        workflow = ("name: pins\non: push\npermissions: {}\njobs:\n  test:\n"
+                    "    uses: " + reference + "\n")
+        if shutil.which("actionlint"):
+            valid = subprocess.run(["actionlint", "-oneline", "-"], input=workflow,
+                                   cwd=self.root, capture_output=True, text=True)
+            self.assertEqual(valid.returncode, 0, valid.stdout + valid.stderr)
+        with tempfile.TemporaryDirectory() as directory:
+            repo = Repository(Path(directory) / "repo")
+            repo.write(".github/workflows/test.yml", workflow)
+            repo.commit()
+            run = subprocess.run(["bash", "-c", self.pin_script()], cwd=repo.path,
+                                 capture_output=True, text=True)
+            self.assertEqual(run.returncode, expected,
+                             f"{reference}: gate returned {run.returncode}, want {expected}\n"
+                             + run.stdout + run.stderr)
+
+    def test_pin_gate_accepts_same_repository_workflows_at_main(self):
+        for filename in ("trusted-linux-ci.yml", "another-workflow.yaml"):
+            with self.subTest(filename=filename):
+                self.check_workflow_pin_fixture(
+                    "Prairie-Server/prairie-server/.github/workflows/" + filename + "@main", 0)
+
+    def test_pin_gate_rejects_other_repository_workflows_at_main(self):
+        for repository in ("another-owner/prairie-server", "Prairie-Server/another-repo"):
+            with self.subTest(repository=repository):
+                self.check_workflow_pin_fixture(
+                    repository + "/.github/workflows/trusted-linux-ci.yml@main", 1)
+
+    def test_pin_gate_rejects_same_repository_workflows_at_other_refs(self):
+        for ref in ("feature", "v1.0.0"):
+            with self.subTest(ref=ref):
+                self.check_workflow_pin_fixture(
+                    "Prairie-Server/prairie-server/.github/workflows/trusted-linux-ci.yml@" + ref, 1)
+
+    def test_pin_gate_accepts_immutable_and_local_references(self):
+        script = self.pin_script()
+        with tempfile.TemporaryDirectory() as directory:
+            repo = Repository(Path(directory) / "repo")
+            repo.write(".github/workflows/test.yml", "steps:\n  - uses: actions/checkout@" + "a" * 40 + " # reviewed release\n  - uses: ./.github/actions/setup-go\n")
+            repo.write(".github/actions/nested/action.yml", "steps:\n  - uses: ./.github/actions/local\n")
+            repo.commit()
+            run = subprocess.run(["bash", "-c", script], cwd=repo.path,
+                                 capture_output=True, text=True)
+            self.assertEqual(run.returncode, 0, run.stdout + run.stderr)
+            run = subprocess.run(["bash", "-c", script], cwd=directory,
+                                 capture_output=True, text=True)
+            self.assertNotEqual(run.returncode, 0, "A missing Git input must fail")
+
+    def test_full_tree_tool_targets_exist(self):
+        run = subprocess.run(["make", "-n", "verify-actionlint", "verify-shellcheck"],
+                             cwd=self.root, capture_output=True, text=True)
+        self.assertEqual(run.returncode, 0, run.stdout + run.stderr)
+        self.assertIn("1.7.12", run.stdout)
+        self.assertIn("0.11.0", run.stdout)
+
+    def test_workflow_and_shell_tools_reject_seeded_defects(self):
+        missing = [tool for tool in ("actionlint", "shellcheck") if not shutil.which(tool)]
+        if missing:
+            self.skipTest("required tools not on PATH: " + ", ".join(missing))
+        workflow = "name: test\non: push\njobs:\n  test:\n    runs-on: ubuntu-24.04\n    steps:\n      - run: echo ok\n"
+        for contents, expected in ((workflow, 0), (workflow.replace("echo ok", "echo ${{ unknown.value }}"), 1)):
+            run = subprocess.run(["actionlint", "-oneline", "-"], input=contents,
+                                 cwd=self.root, capture_output=True, text=True)
+            self.assertEqual(run.returncode, expected, run.stdout + run.stderr)
+        for contents, expected in (("#!/bin/bash\nprintf '%s\\n' \"$1\"\n", 0),
+                                   ("#!/bin/bash\nprintf '%s\\n' $1\n", 1)):
+            run = subprocess.run(["shellcheck", "-s", "bash", "-"], input=contents,
+                                 cwd=self.root, capture_output=True, text=True)
+            self.assertEqual(run.returncode, expected, run.stdout + run.stderr)
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/.github/actions/save-go-cache/action.yml b/.github/actions/save-go-cache/action.yml
index 5c839ec86b..2eb01bfa98 100644
--- a/.github/actions/save-go-cache/action.yml
+++ b/.github/actions/save-go-cache/action.yml
@@ -23,16 +23,18 @@ inputs:
 runs:
   using: composite
   steps:
+    # if: !cancelled() && inputs.job-status != 'cancelled'
+    # Declined for compiled-cache saving: failed main runs keep the success-only policy.
     - name: Prune unused Go build cache entries
-      if: success() && inputs.job-status == 'success' && runner.environment == 'github-hosted' && github.ref_name == github.event.repository.default_branch && github.event_name != 'pull_request'
+      if: success() && inputs.job-status == 'success' && runner.environment == 'github-hosted' && github.ref_name == github.event.repository.default_branch && github.event_name != 'pull_request' && github.event_name != 'schedule'
       shell: bash
       run: |
         cache_dir="$(go env GOCACHE)"
         find "$cache_dir" -mindepth 2 -maxdepth 2 \( -name '*-a' -o -name '*-d' \) ! -newermt '@0' -exec rm -rf -- {} +
 
     - name: Save the Go build cache
-      if: success() && inputs.job-status == 'success' && runner.environment == 'github-hosted' && github.ref_name == github.event.repository.default_branch && github.event_name != 'pull_request'
-      uses: actions/cache/save@v4
+      if: success() && inputs.job-status == 'success' && runner.environment == 'github-hosted' && github.ref_name == github.event.repository.default_branch && github.event_name != 'pull_request' && github.event_name != 'schedule'
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.cache/go-build
         key: ${{ inputs.cache-key }}
@@ -46,7 +48,7 @@ runs:
 
     - name: Save the shared Go module cache
       if: ${{ !cancelled() && inputs.job-status != 'cancelled' && runner.environment == 'github-hosted' && github.ref_name == github.event.repository.default_branch && github.event_name != 'pull_request' && inputs.module-cache-key != '' && inputs.module-cache-hit != 'true' }}
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/go/pkg/mod
         key: ${{ inputs.module-cache-key }}
diff --git a/.github/actions/setup-go/action.yml b/.github/actions/setup-go/action.yml
index 9f91acc0ef..2ab73e72d4 100644
--- a/.github/actions/setup-go/action.yml
+++ b/.github/actions/setup-go/action.yml
@@ -1,6 +1,6 @@
 name: Set up Go for this repository
 description: >-
-  Installs the latest available Go 1.26 toolchain, a shared module cache, a
+  Installs the latest Go 1.26 patch, a shared module cache, a
   per-commit build cache, and the stub frontend bundle that cmd/prairie embeds,
   then waits for the libvips install the job started before checkout.
 
@@ -28,23 +28,13 @@ outputs:
 runs:
   using: composite
   steps:
-    - name: Restore the shared Go module cache
-      if: runner.environment == 'github-hosted'
-      id: modules
-      uses: actions/cache/restore@v4
-      with:
-        path: ~/go/pkg/mod
-        key: go-mod-${{ runner.os }}-${{ hashFiles('**/go.mod') }}-${{ hashFiles('**/go.sum') }}
-        restore-keys: |
-          go-mod-${{ runner.os }}-
-
     # setup-go's own cache is keyed on go.mod and written only on a
     # miss, so between dependency bumps every run restored a build cache
     # from weeks ago and recompiled the tree. The cache below is keyed on the
     # commit and restored by prefix, so each run starts from the newest
     # cache any earlier run saved.
     - name: Set up Go
-      uses: actions/setup-go@v6
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
         go-version: '<1.28'
         # The runner image pins an older patch release; govulncheck needs the
@@ -57,6 +47,16 @@ runs:
       shell: bash
       run: echo "version=$(go env GOVERSION)" >> "$GITHUB_OUTPUT"
 
+    - name: Restore the shared Go module cache
+      if: runner.environment == 'github-hosted'
+      id: modules
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      with:
+        path: ~/go/pkg/mod
+        key: go-mod-${{ runner.os }}-${{ steps.go.outputs.version }}-${{ hashFiles('**/go.mod') }}-${{ hashFiles('**/go.sum') }}
+        restore-keys: |
+          go-mod-${{ runner.os }}-${{ steps.go.outputs.version }}-
+
     # The restore below unpacks the build cache while libvips installs in the
     # background. On tmpfs, those writes and the job's compile output stay off
     # the disk the install writes to. The path, and so the cache key, is unchanged.
@@ -70,7 +70,7 @@ runs:
     - name: Restore the Go build cache
       if: runner.environment == 'github-hosted'
       id: cache
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.cache/go-build
         key: go-${{ inputs.cache-name }}-${{ runner.os }}-${{ steps.go.outputs.version }}-${{ hashFiles('go.sum') }}-${{ github.sha }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a7864fe10e..fb9ed96536 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -154,9 +154,14 @@ jobs:
           CI_GO_LINT_FULL: ${{ github.event_name == 'pull_request' && '0' || '1' }}
           CI_GO_LINT_NEW_FROM_MERGE_BASE: ${{ github.event_name == 'pull_request' && format('origin/{0}', github.base_ref) || '' }}
           CI_GO_LINT_NEW_FROM_REV: ${{ github.event_name != 'pull_request' && 'HEAD~1' || '' }}
+          # Upstream sync PRs gate only lines new to both main and the merged
+          # Silo commit; upstream's own backlog was gated (per changed line)
+          # upstream. Every other PR keeps the merge-base gate.
+          CI_GO_LINT_SYNC: ${{ github.event_name == 'pull_request' && startsWith(github.head_ref, 'sync/upstream') && '1' || '0' }}
+          CI_GO_LINT_SYNC_HEAD: ${{ github.event.pull_request.head.sha }}
         run: |
           set -euo pipefail
-          chmod +x scripts/ci-go-lint.sh scripts/ci-go-lint-packages.sh
+          chmod +x scripts/ci-go-lint.sh scripts/ci-go-lint-packages.sh scripts/ci-go-lint-sync-patch.sh
           if [[ "${{ github.event_name }}" == "pull_request" ]]; then
             ./scripts/ci-go-lint.sh "origin/${PR_BASE_REF}"
           else
diff --git a/.golangci-router-recovery.yml b/.golangci-router-recovery.yml
new file mode 100644
index 0000000000..65a507b023
--- /dev/null
+++ b/.golangci-router-recovery.yml
@@ -0,0 +1,32 @@
+version: "2"
+
+run:
+  timeout: 15m
+  allow-serial-runners: true
+  tests: false
+  modules-download-mode: readonly
+
+linters:
+  default: none
+  enable:
+    - gocritic
+  settings:
+    gocritic:
+      disable-all: true
+      enabled-checks:
+        - ruleguard
+      settings:
+        ruleguard:
+          rules: '${base-path}/internal/routeinventory/lintrules/*.go'
+          failOn: all
+  exclusions:
+    rules:
+      - path: _test\.go
+        linters:
+          - gocritic
+        text: "^ruleguard: route inventory:"
+
+issues:
+  max-issues-per-linter: 0
+  max-same-issues: 0
+  uniq-by-line: false
diff --git a/.golangci.yml b/.golangci.yml
index 052950bc40..ea24767ac0 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -8,6 +8,7 @@ run:
   # core, so queueing concurrent runs (several agents, several worktrees)
   # beats running them side by side. Never pass --allow-parallel-runners.
   allow-serial-runners: true
+  modules-download-mode: readonly
 
 formatters:
   enable:
@@ -15,15 +16,13 @@ formatters:
     - goimports
 
   settings:
-    # Many files still group Prairie imports with third-party ones. CI lints
-    # changed lines only, so such a file is flagged when a change edits an
-    # import line that goimports would regroup; `golangci-lint fmt <file>`
-    # regroups the whole file.
+    # Format files as touched.
     goimports:
       local-prefixes:
         - github.com/prairie-server/prairie-server
 
 linters:
+  default: none
   enable:
     - bodyclose
     - errcheck
@@ -38,6 +37,73 @@ linters:
     - unconvert
     - unused
     - wastedassign
+    - noctx
+    - nilnesserr
+    - durationcheck
+    - makezero
+    - asasalint
+    - gocheckcompilerdirectives
+    - nosprintfhostport
+    - usetesting
+    - rowserrcheck
+    - sqlclosecheck
+    - errchkjson
+    - exhaustive
+    - revive
+    - fatcontext
+    - forcetypeassert
+    - containedctx
+    - gosec
+    - bidichk
+    - nolintlint
+    - perfsprint
+    - predeclared
+    - iface
+    - interfacebloat
+    - errname
+    - recvcheck
+    - forbidigo
+    - gocritic
+    - funlen
+    - gocyclo
+    - nestif
+    - asciicheck
+    - exptostd
+    - gochecksumtype
+    - gomoddirectives
+    - iotamixing
+    - zerologlint
+    - reassign
+    - goprintffuncname
+    - mirror
+
+  # Unenrolled checks retain their selection reason. Failed scans are unmeasured.
+  # - prealloc # 222 findings; disabled pending review.
+  # - gocognit # Declined: funlen, gocyclo, and nestif own function limits.
+  # - mnd # Declined: broad style cleanup.
+  # - dupl # Declined: broad style cleanup.
+  # - wrapcheck # Declined: broad style cleanup.
+  # - contextcheck # not measured; needs a prototype for detached Background cancellation.
+  # - canonicalheader # 41 findings; disabled pending review.
+  # - nilnil # 879 findings; TEST nil/value contracts require review.
+  # - thelper # 195 findings; disabled pending review.
+  # - unparam # 227 findings; TEST public parameters require consumer review.
+  # - usestdlibvars # 244 findings; disabled pending review.
+  # - dupword # 43 findings; disabled pending review.
+  # - nakedret # 12 findings; disabled pending review.
+  # - intrange # 278 findings; disabled pending review.
+  # - modernize # 1405 findings; disabled pending review.
+  # - varnamelen # 7302 findings; disabled pending review.
+  # - tagliatelle # 1046 findings; disabled pending review.
+  # - copyloopvar # 83 findings; disabled pending review.
+  # - musttag # 108 findings; disabled pending review.
+  # - dogsled # 40 findings; disabled pending review.
+  # - embeddedstructfieldcheck # 765 findings; TEST mutex/embedding contracts require review.
+  # - whitespace # 57 findings; disabled pending review.
+  # - spancheck # Declined for six tracing sites.
+  # - err113 # Declined: error-style cleanup.
+  # - lll # Declined: line wrapping.
+  # - fieldalignment # Declined: struct reordering.
 
   exclusions:
     # Anchored regexes, not directory names: `paths` matches anywhere in the
@@ -49,6 +115,16 @@ linters:
       - ^web/
       - ^migrations/
     rules:
+      - path: _test\.go$
+        linters:
+          - noctx
+          - gosec
+          - forcetypeassert
+          - errchkjson
+      # Sleeps in production are not test synchronization.
+      - path-except: _test\.go$
+        linters:
+          - forbidigo
       # Tests may freely repeat fixture strings / leave cleanup errors unchecked.
       - path: _test\.go
         linters:
@@ -62,34 +138,220 @@ linters:
         text: "^ruleguard: route inventory:"
 
   settings:
-    # gocritic is enabled for exactly one check: the ruleguard rules under
-    # internal/routeinventory/lintrules/, defense in depth for the legacy
-    # native route inventory (docs/architecture/api-contract.md, "Legacy
-    # native route inventory"). The guarantee itself is structural — every
-    # listener entry function returns a sealed handler the generator checks —
-    # and these rules report the attempt early: a type assertion, type switch
-    # or generic instantiation whose type registers routes by its method set
-    # (alias, defined type, embedding or structural interface included), and
-    # reflect.Value.MethodByName, outside tests. ruleguard was chosen over
-    # forbidigo because forbidigo visits only identifier and selector nodes
-    # and cannot tell an assertion from a parameter type. Keep the check list
-    # to ruleguard: widening it enrolls the whole tree in gocritic's style set.
-    #
-    # gocritic is deliberately absent from linters.enable above and runs only
-    # through make lint-router-recovery (--enable-only gocritic), full-tree,
-    # which CI gates on. A changed-lines pass would find nothing that step
-    # does not, and it is the costliest linter here: gocritic rebuilds the
-    # ruleguard engine for every package, and each rebuild type-checks chi
-    # and net/http from source — about two seconds of fixed cost per package,
-    # nearly half the analysis time of a cold run over ./... .
+    funlen:
+      lines: 100
+      statements: -1
+    gocyclo:
+      min-complexity: 30
+    nestif:
+      min-complexity: 4
+
     gocritic:
       disable-all: true
       enabled-checks:
-        - ruleguard
-      settings:
-        ruleguard:
-          rules: '${base-path}/internal/routeinventory/lintrules/*.go'
-          failOn: all
+        - argOrder
+        # - assignOp # 21 findings; disabled.
+        - badCall
+        - badCond
+        - caseOrder
+        - codegenComment
+        - defaultCaseOrder
+        # - deprecatedComment # 1 findings; disabled.
+        - dupArg
+        - dupBranchBody
+        - dupCase
+        - dupSubExpr
+        - elseif
+        - exitAfterDefer
+        - flagDeref
+        - flagName
+        # - mapKey # 14 findings, all whitespace-trimming test inputs; disabled.
+        - newDeref
+        - offBy1
+        - regexpMust
+        - sloppyLen
+        - sloppyTypeAssert
+        - switchTrue
+        - typeSwitchVar
+        - underef
+        # - unlambda # 4 findings; disabled.
+        - unslice
+        - valSwap
+        - wrapperFunc
+        - badLock
+        - badRegexp
+        - badSyncOnceFunc
+        - deferInLoop
+        - externalErrorReassign
+        - sortSlice
+        - truncateCmp
+        - uncheckedInlineErr
+        # - weakCond # 10 findings, all regexp index results, which are full length when non-nil; disabled.
+        - badSorting
+        - dynamicFmtString
+        - evalOrder
+        - returnAfterHttpError
+        - sqlQuery
+        # - emptyFallthrough # 1 findings; disabled.
+        # - rangeValCopy # 1200 findings; disabled.
+        # - hugeParam # Declined: broad performance cleanup.
+        - rangeExprCopy
+        # - appendCombine # 17 findings; disabled.
+        - indexAlloc
+        # - preferStringWriter # 1 findings; disabled.
+        - preferFprint
+        - preferWriteByte
+        - sliceClear
+        # - stringXbytes # 28 findings; disabled.
+        # - boolExprSimplify # 1 findings; disabled.
+        # - builtinShadow # 123 findings; disabled.
+        - dupImport
+        # - emptyStringTest # 15 findings; disabled.
+        # - equalFold # 12 findings; disabled.
+        # - filepathJoin # 15 findings; disabled.
+        # - httpNoBody # 1114 findings; disabled.
+        # - importShadow # 97 findings; disabled.
+        # - nestingReduce # 19 findings; disabled.
+        - nilValReturn
+        - redundantSprint
+        - regexpPattern
+        # - sloppyReassign # 120 findings; disabled.
+        # - sprintfQuotedString # 16 findings; disabled.
+        # - stringConcatSimplify # 5 findings; disabled.
+        - timeExprSimplify
+        - unnecessaryBlock
+        - unnecessaryDefer
+
+    # gocritic.settings.hugeParam: declined broad performance cleanup.
+    # gocritic:
+    #   settings:
+    #     hugeParam:
+    #       sizeThreshold: 256
+    # nilnil: 879 findings; TEST remains inactive.
+    # nilnil:
+    #   detect-opposite: true
+    # nakedret: 12 findings; inactive.
+    # nakedret:
+    #   max-func-lines: 10
+
+    gomoddirectives:
+      # Allow local replace directives.
+      replace-local: true
+
+    # tagliatelle: 1046 findings; inactive.
+    # tagliatelle:
+    #   case:
+    #     rules:
+    #       json: snake
+    #       yaml: kebab
+    # varnamelen: 7302 findings; inactive.
+    # varnamelen:
+    #   min-name-length: 3
+    #   max-distance: 10
+    #   check-receiver: false
+    #   check-return: false
+    #   check-type-param: false
+    #   ignore-type-assert-ok: true
+    #   ignore-map-index-ok: true
+    #   ignore-chan-recv-ok: true
+    #   ignore-names: [err, fd, db, tx, mu, rl, wg]
+    #   ignore-decls:
+    #     - t testing.T
+    #     - b testing.B
+    #     - i int
+    #     - T any
+    #     - wg sync.WaitGroup
+    #     - w http.ResponseWriter
+    #     - r *http.Request
+    # copyloopvar: 83 findings; inactive.
+    # copyloopvar:
+    #   check-alias: true
+    # embeddedstructfieldcheck: 765 findings; TEST remains inactive.
+    # embeddedstructfieldcheck:
+    #   forbid-mutex: true
+
+    govet:
+      enable:
+        - nilness
+        - unusedwrite
+        - reflectvaluecompare
+        - sortslice
+        - deepequalerrors
+      # enable-all: true # Unmeasured; retain the repository analyzer set.
+      # disable: [fieldalignment] # Declined: struct reordering work.
+
+    rowserrcheck:
+      packages:
+        - github.com/jackc/pgx/v5
+
+    errchkjson:
+      check-error-free-encoding: true
+
+    exhaustive:
+      explicit-exhaustive-switch: true
+      explicit-exhaustive-map: true
+      default-signifies-exhaustive: false
+      # default-signifies-exhaustive: true # A default does not prove enum coverage.
+      # explicit-exhaustive-switch: false # Default-on exhaustiveness declined.
+
+    revive:
+      enable-default-rules: false
+      rules:
+        - name: unconditional-recursion
+        - name: datarace
+        - name: waitgroup-by-value
+        - name: range-val-address
+        - name: defer
+        - name: time-equal
+        - name: atomic
+        - name: identical-branches
+        - name: identical-ifelseif-branches
+        # - name: identical-switch-branches # 56 findings; disabled.
+        - name: identical-switch-conditions
+        # - name: var-naming # Declined naming work.
+        # - name: exported # Declined naming/documentation work.
+        # - name: package-comments # Declined naming/documentation work.
+        # - name: receiver-naming # Declined naming work.
+        # - name: confusing-naming # Declined naming work.
+        # - name: time-naming # Declined naming work.
+      # enable-all-rules: true # Select only measured zero-finding unnamed rules.
+
+    fatcontext:
+      check-struct-pointers: true
+
+    gosec:
+      excludes:
+        - G104 # errcheck owns unchecked errors.
+      # G201/G202 value-versus-identifier ruleguard: not measured; needs a prototype.
+      # severity: medium # Retain default security coverage.
+      # confidence: medium # Retain default security coverage.
+
+    nolintlint:
+      require-explanation: true
+      require-specific: true
+
+    forbidigo:
+      forbid:
+        - pattern: '^time\.Sleep$'
+          msg: Wait on observable state; timing tests require a reasoned nolint.
+      analyze-types: true
+      exclude-godoc-examples: false
+
+    perfsprint:
+      int-conversion: true
+      err-error: true
+      errorf: true
+      sprintf1: true
+
+    iface:
+      enable: [identical, unused, opaque]
+
+    interfacebloat:
+      max: 20
+      # max: 10 # The agreed interface limit is 20.
+
+    recvcheck:
+      disable-builtin: false
 
     sloglint:
       context: "scope"
@@ -211,3 +473,75 @@ linters:
         # Upstream prose and the "dialogue" marker vocabulary (a wire value).
         - catalogued
         - dialogue
+
+issues:
+  max-issues-per-linter: 0
+  max-same-issues: 0
+  uniq-by-line: false
+
+# Unenrolled settings: unmeasured unless a decline or replacement is stated above.
+#     staticcheck:
+#       # All checks except these style checks and quickfix suggestions.
+#       checks:
+#         # package comment, initialism naming, receiver names, doc-comment form
+#         - all
+#         - -ST1000
+#         - -ST1003
+#         - -ST1016
+#         - -ST1020
+#         - -ST1021
+#         - -ST1022
+#         # Disable quickfix checks
+#         - -QF*
+#     gocognit:
+#       # Maximum cognitive complexity
+#       min-complexity: 30
+#     mnd:
+#       # Magic Number Detector settings
+#       checks:
+#         - argument
+#         - case
+#         - condition
+#         - operation
+#         - return
+#         - assign
+#       # Common constants that are acceptable
+#       ignored-numbers:
+#         - '0'
+#         - '1'
+#         - '2'
+#         - '10'
+#         - '100'
+#         - '1024'       # buffer sizes, byte units
+#         - '0o755'      # file modes
+#         - '0o644'
+#       # Functions where magic numbers are acceptable
+#       ignored-functions:
+#         - 'os.MkdirAll'
+#         - 'os.OpenFile'
+#         - 'os.WriteFile'
+#       # Ignore magic numbers in test files
+#       ignored-files:
+#         - '.*_test\.go'
+#     dupl:
+#       # Minimum token sequence for duplication detection
+#       threshold: 100
+#     wrapcheck:
+#       # No exempt packages, signatures, or interfaces.
+#       ignore-package-globs: []
+#       ignore-sigs: []
+#       ignore-interface-regexps: []
+# staticcheck.checks: repository defaults remain active; the alternate all/-ST*/-QF* selection is unmeasured.
+# sloglint.attr-only: true # Declined: retain the repository mixed-call policy.
+# sloglint.context: all # Declined: retain scope-aware context requirements.
+# sloglint.key-naming-case: kebab # Declined: retain snake_case log keys.
+# formatters:
+#   enable: [gci, gofumpt] # Declined companion formatting; retain gofmt/goimports.
+#   settings:
+#     gci:
+#       custom-order: true
+#     gofumpt:
+#       extra:
+#         group-params: true
+#         clothe-returns: true
+#         balance-calls: true
diff --git a/.shellcheckrc b/.shellcheckrc
new file mode 100644
index 0000000000..cd51d47534
--- /dev/null
+++ b/.shellcheckrc
@@ -0,0 +1,2 @@
+# Infer the dialect from each tracked file's shebang; inspect every severity.
+# SC2029 is suppressed only at on_host's intentional caller-expansion site.
diff --git a/AGENTS.md b/AGENTS.md
index 80105cd7f3..e70eb62aaa 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -167,7 +167,7 @@ changed-line findings as CI while analyzing only the packages the branch touched
 `./...` saturates every core for minutes, and parallel agents make that worse. Never pass
 `--allow-parallel-runners`; concurrent runs queue behind one another on purpose.
 
-Go stays `gofmt`/`goimports` clean; the frontend follows `web/.prettierrc`.
+Format Go files as touched with `gofmt`/`goimports`; the frontend follows `web/.prettierrc`.
 
 ## Development environment
 
diff --git a/DEVELOPMENT.md b/DEVELOPMENT.md
index 17b7c35259..f0d39c4ed5 100644
--- a/DEVELOPMENT.md
+++ b/DEVELOPMENT.md
@@ -82,6 +82,11 @@ that can hold millions of rows. Keep locks on existing tables short:
   before creating a new index: a copy left by an interrupted run is invalid, and
   `CREATE INDEX CONCURRENTLY IF NOT EXISTS` would keep it, so the planner would
   never use the index.
+- When a migration replaces one index with another, a retry must not drop the
+  replacement: goose records the version only after the last statement, so a
+  run that already dropped the old index can run again. Use a Go migration
+  that builds through `ensureIndexConcurrently` in `internal/database`, which
+  drops only an invalid copy (`internal/database/push_attempt_key_migration.go`).
 - Add foreign keys and `CHECK` constraints to existing tables as `NOT VALID`,
   and run `VALIDATE CONSTRAINT` only after that commits: in a later migration,
   or as a separate statement in a `NO TRANSACTION` file. Inside one
diff --git a/Dockerfile b/Dockerfile
index f6a9659715..7ceb643b22 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -24,6 +24,7 @@ FROM scratch AS frontend_dist
 COPY --from=frontend /app/web/dist/. /
 
 # Stage 2: Build Go binary
+# The floating 1.26 tag is deliberate so images get Go patch releases without a manual bump.
 FROM golang:1.26 AS build
 ENV CGO_ENABLED=1
 ENV GOPROXY=https://proxy.golang.org,direct
diff --git a/Makefile b/Makefile
index 8d859fe48e..1face48419 100644
--- a/Makefile
+++ b/Makefile
@@ -59,12 +59,35 @@ lint:
 	golangci-lint run
 	cd web && pnpm run lint
 
-# Lint the Go packages this branch touched, on the lines it changed. Same
-# findings as CI's changed-lines step at a fraction of the cost of ./... .
+# Lint changed lines in the Go packages this branch touched.
 # BASE_REF=origin/<pr-base> when not main.
 lint-changed:
 	BASE_REF=$(BASE_REF) scripts/lint-changed.sh
 
+.PHONY: verify-actionlint verify-shellcheck
+verify-actionlint:
+	@test "$$(actionlint -version | head -n 1)" = 1.7.12 || { echo 'actionlint 1.7.12 is required' >&2; exit 1; }
+	actionlint
+
+verify-shellcheck:
+	@test "$$(shellcheck --version | sed -n 's/^version: //p')" = 0.11.0 || { echo 'ShellCheck 0.11.0 is required' >&2; exit 1; }
+	@python3 -c 'import pathlib, re, subprocess; paths = subprocess.check_output(["git", "ls-files", "-z"]).decode().split("\0"); files = [p for p in paths if p and pathlib.Path(p).is_file() and (pathlib.Path(p).suffix in (".sh", ".bash", ".ksh") or re.match(rb"^#!.*\b(?:sh|bash|dash|ksh)\b", pathlib.Path(p).open("rb").readline()))]; assert files, "no tracked shell inputs"; subprocess.run(["shellcheck", "--", *files], check=True)'
+
+# hadolint: not measured; adoption needs a pinned binary, a seeded-defect trial, and reviewed findings and cost.
+# Makefile shell lint: not measured; recipe expansion needs a prototype that preserves Make's shell context.
+
+.PHONY: verify-size-ratchet verify-bidi
+verify-size-ratchet:
+	@base=$$(git merge-base "$(BASE_REF)" HEAD) && \
+		go run ./scripts/ci/sizeratchet -base "$$base"
+
+# grep status 1 means no controls; unsupported PCRE and other errors refuse.
+verify-bidi:
+	@status=0; git grep -I -nP '[\x{061c}\x{200e}\x{200f}\x{202a}-\x{202e}\x{2066}-\x{2069}]' -- . || status=$$?; \
+		if [ "$$status" -eq 1 ]; then exit 0; fi; \
+		if [ "$$status" -eq 0 ]; then echo 'Bidi controls are not permitted in tracked text' >&2; exit 1; fi; \
+		exit "$$status"
+
 # Frontend test files that fail on main today. This list is shrink-only: delete
 # an entry along with its fix, and never extend it to land a change. The Go
 # suite has no equivalent — a Go test that cannot pass yet carries a t.Skip and
@@ -81,8 +104,10 @@ embed-stub:
 # Run the Go and frontend test suites.
 test: test-go test-web
 
+# The queryattr concurrency tests prove nothing without the race detector.
 test-go: embed-stub
 	go test ./...
+	go test -race -count=1 ./internal/database/queryattr/
 
 # Run the DB-backed query-budget pins listed in $(DB_PINS), then the database
 # contracts, against the migrated, disposable database named by
@@ -178,7 +203,7 @@ verify-settings-bindings-all: verify-settings-bindings verify-settings-bindings-
 # this would let the contract and the implementation drift apart in silence.
 PLAYBACK_FIXTURE_DIR := internal/playback/testdata/protocol_v3
 PLAYBACK_SCHEMA_FIXTURE_DIR := docs/design/schemas/playback-v3/v3/fixtures/valid
-PLAYBACK_WIRE_FIXTURES := start_request.json replan_request.json decision_response.json native-decision_response.json capability_response.json error_response.json route_event.json
+PLAYBACK_WIRE_FIXTURES := start_request.json replan_request.json decision_response.json native-decision_response.json hls-subtitle-rendition-decision_response.json capability_response.json error_response.json route_event.json
 
 playback-fixtures:
 	go run ./cmd/playbackfixtures -out $(PLAYBACK_FIXTURE_DIR)
@@ -214,13 +239,15 @@ verify-route-inventory:
 	@go run ./cmd/route-inventory -check $(ROUTE_INVENTORY) \
 		|| { echo "::error::$(ROUTE_INVENTORY) is stale or a route is unaccounted for; run make route-inventory"; exit 1; }
 
-# Run the route inventory's router-recovery lint rule over the whole tree, not
-# only changed lines. It is the one gocritic check the repo enables (see
-# .golangci.yml), and the tree passes it today, so this can gate CI while the
-# rest of `make lint` cannot.
+.PHONY: verify-v1-route-freeze
+verify-v1-route-freeze:
+	@base=$$(git merge-base "$(BASE_REF)" HEAD) && \
+		python3 -c 'import json, subprocess, sys; path="contracts/api/v2/route-inventory.json"; project=lambda doc: sorted((r["method"], r["path"]) for r in doc["routes"] if r["namespace"] == "api_v1"); before=json.loads(subprocess.check_output(["git", "show", sys.argv[1]+":"+path])); after=json.load(open(path)); sys.exit("v1 routes changed; the bridge contract is frozen" if project(before) != project(after) else 0)' "$$base"
+
+# Run only the route inventory's router-recovery rule over the whole tree.
 # Tests are excluded from this rule, so do not analyze their package variants.
 lint-router-recovery:
-	golangci-lint run --tests=false --enable-only gocritic --max-same-issues=0 --max-issues-per-linter=0 ./...
+	golangci-lint run --config .golangci-router-recovery.yml --tests=false --max-same-issues=0 --max-issues-per-linter=0 --uniq-by-line=false ./...
 MIGRATION_LEDGER := contracts/api/v2/migration.json
 
 # CI gives test-go ownership of these Go assertions and passes 0 to avoid
@@ -424,6 +451,16 @@ migrate-create:
 migrate-validate:
 	$(GOOSE) -dir $(GOOSE_DIR) validate
 
+.PHONY: verify-migrations verify-prometheus-rules
+verify-migrations: migrate-validate
+	@base=$$(git merge-base "$(BASE_REF)" HEAD) && \
+		go run ./scripts/ci/migrationcheck -base "$$base"
+
+# Use the same Prometheus release locally and in CI.
+PROMTOOL ?= docker run --rm --pull=never --entrypoint promtool -v "$(CURDIR)/deploy/observability:/rules:ro" -w /rules prom/prometheus:v3.5.0
+verify-prometheus-rules:
+	$(PROMTOOL) test rules prairie.rules.test.yml
+
 # Show Goose migration status through Prairie's bootstrapping runner.
 migrate-status:
 	go run ./cmd/prairie/ --env "$(ENV_FILE)" --migrate-status
diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
index 31738bf64e..0f8a8efdce 100644
--- a/THIRD_PARTY_NOTICES.md
+++ b/THIRD_PARTY_NOTICES.md
@@ -17,3 +17,22 @@ license, and source/provenance metadata beside the installed assets.
 poster artwork. The artwork is intended to use generic original scenes and
 avoid copyrighted movie/show posters, recognizable actors, franchise
 characters, provider logos, and readable in-image third-party branding.
+
+## FFmpeg audio decoders (WebAssembly)
+
+`web/src/player/engine/wasm/prairie-audio-decoders.wasm` and its JavaScript glue
+are compiled from FFmpeg (https://ffmpeg.org/), licensed under the GNU Lesser
+General Public License, version 2.1 or later. The build enables only the
+AC-3, E-AC-3, DTS, TrueHD and MLP decoders from `libavcodec` and `libavutil`,
+with no GPL components. The FFmpeg release tag and configure options are in
+`web/wasm/audio-decoders/build.sh`, the exact upstream commit is recorded in
+`web/src/player/engine/wasm/prairie-audio-decoders.ffmpeg-revision`, and
+`web/wasm/audio-decoders/bridge.c` is the only code linked against it. The
+corresponding FFmpeg source is available from the FFmpeg project at that tag,
+and the build script reproduces the binary from it.
+
+## Mediabunny
+
+The web player's browser decode engine depends on Mediabunny
+(https://github.com/Vanilagy/mediabunny), licensed under the Mozilla Public
+License 2.0, through the `mediabunny` npm package.
diff --git a/cmd/playbackfixtures/hls_subtitle_rendition.go b/cmd/playbackfixtures/hls_subtitle_rendition.go
new file mode 100644
index 0000000000..4f88eb8098
--- /dev/null
+++ b/cmd/playbackfixtures/hls_subtitle_rendition.go
@@ -0,0 +1,42 @@
+package main
+
+import (
+	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/playback"
+)
+
+// goldenHLSSubtitleRenditionDecisionResponse is a /api/v2 transcode whose
+// embedded SubRip track is carried as the HLS stream's subtitle rendition.
+func goldenHLSSubtitleRenditionDecisionResponse() playback.DecisionResponseV3 {
+	file := conformanceFallbackFile()
+	file.SubtitleTracks = []models.SubtitleTrack{
+		{Index: 3, Language: languageEnglish, Codec: "subrip", Title: titleEnglish},
+	}
+	request := goldenStartRequest()
+	request.ClientFeatures = append(request.ClientFeatures, playback.FeatureHLSSubtitleRenditionsV3)
+	request.QualityPreference = playback.QualityRung720pMediumV3
+	request.SubtitleTrackIndex = new(0)
+	request.SubtitleTrackID = playback.TrackIDV3(file.ID, "subtitle", 0)
+	request.ClientPlaybackContext.Deliveries[playback.DeliveryClassHLSV3] = playback.DeliveryCapabilityV3{
+		Enabled:                true,
+		SupportedOnDevice:      true,
+		Containers:             []string{"hls"},
+		VideoCodecs:            []string{codecH264},
+		AudioDecodeCodecs:      []string{codecAAC},
+		AudioPassthroughCodecs: []string{},
+		Subtitles:              playback.DeliverySubtitleCapabilitiesV3{SidecarText: true},
+		Features:               []string{},
+		AuthHeaderRefresh:      true,
+		ValidatedClaims:        []string{},
+		Transformations:        []playback.TransformationV3{},
+	}
+	response := goldenDecisionForSourceWith(file, request, nil, func(input *playback.PlannerInputV3) {
+		input.SubtitleRenditionExecutable = func() bool { return true }
+	})
+	if plan := response.PlaybackPlan; plan.Delivery != playback.DeliveryTranscodeHLSV3 || plan.Subtitle.HLSRendition == nil {
+		failf("golden subtitle rendition plan is %s without a rendition", plan.Delivery)
+	}
+	response.PlaybackPlan.Stream.URL = "/playback/transcode/" + goldenSessionID + "/master.m3u8"
+	response.ServerFeatures = playback.NativeServerFeaturesV3()
+	return response
+}
diff --git a/cmd/playbackfixtures/main.go b/cmd/playbackfixtures/main.go
index 8d83182ce7..247822a76b 100644
--- a/cmd/playbackfixtures/main.go
+++ b/cmd/playbackfixtures/main.go
@@ -57,6 +57,7 @@ const (
 	audioLayout71     = "7.1"
 	filmFrameRate     = "24000/1001"
 	languageEnglish   = "eng"
+	titleEnglish      = "English"
 	videoRangeSDR     = "SDR"
 	categoryMidSeek   = "mid_seek_replan"
 )
@@ -65,16 +66,17 @@ func main() {
 	out := flag.String("out", "", "directory to write fixtures into (required)")
 	flag.Parse()
 	if *out == "" {
-		fail("usage: playbackfixtures -out <dir>")
+		failf("usage: playbackfixtures -out <dir>")
 	}
 	if err := os.MkdirAll(*out, 0o755); err != nil {
-		fail("create %s: %v", *out, err)
+		failf("create %s: %v", *out, err)
 	}
 
 	write(*out, "start_request.json", goldenStartRequest())
 	write(*out, "replan_request.json", goldenReplanRequest())
 	write(*out, "decision_response.json", goldenDecisionResponse())
 	write(*out, "native-decision_response.json", goldenNativeDecisionResponse())
+	write(*out, "hls-subtitle-rendition-decision_response.json", goldenHLSSubtitleRenditionDecisionResponse())
 	write(*out, "capability_response.json", goldenCapabilityResponse())
 	write(*out, "error_response.json", goldenErrorResponse())
 	write(*out, "route_event.json", goldenRouteEvent())
@@ -90,16 +92,16 @@ func goldenErrorResponse() playback.ErrorResponseV3 {
 func write(dir, name string, value any) {
 	body, err := json.MarshalIndent(value, "", "  ")
 	if err != nil {
-		fail("marshal %s: %v", name, err)
+		failf("marshal %s: %v", name, err)
 	}
 	body = append(body, '\n')
 	path := filepath.Join(dir, name)
 	if err := os.WriteFile(path, body, 0o644); err != nil { //nolint:gosec // generated fixture
-		fail("write %s: %v", path, err)
+		failf("write %s: %v", path, err)
 	}
 }
 
-func fail(format string, args ...any) {
+func failf(format string, args ...any) {
 	fmt.Fprintf(os.Stderr, format+"\n", args...)
 	os.Exit(1)
 }
@@ -193,7 +195,7 @@ func goldenReplanRequest() playback.ReplanRequestV3 {
 	audioIndex := 0
 	decision := goldenDecisionResponse()
 	if decision.PlaybackPlan == nil {
-		fail("golden decision has no plan")
+		failf("golden decision has no plan")
 	}
 	plan := decision.PlaybackPlan
 	return playback.ReplanRequestV3{
@@ -231,7 +233,7 @@ func goldenMediaFile() *models.MediaFile {
 	return &models.MediaFile{
 		ID: goldenMediaFileID,
 		ExternalSubtitles: []models.ExternalSubtitle{
-			{Path: "/library/movie.en.srt", Language: languageEnglish, Format: "srt", Title: "English"},
+			{Path: "/library/movie.en.srt", Language: languageEnglish, Format: "srt", Title: titleEnglish},
 		},
 		SubtitleTracks: []models.SubtitleTrack{
 			{Index: 0, Language: languageEnglish, Codec: "ass", Title: "English (Signs)", Forced: true},
@@ -309,11 +311,15 @@ func goldenNativeDecisionResponse() playback.DecisionResponseV3 {
 }
 
 func goldenDecisionForSource(file *models.MediaFile, request playback.StartRequestV3, additional []playback.SubtitleInventoryEntryV3) playback.DecisionResponseV3 {
+	return goldenDecisionForSourceWith(file, request, additional, nil)
+}
+
+func goldenDecisionForSourceWith(file *models.MediaFile, request playback.StartRequestV3, additional []playback.SubtitleInventoryEntryV3, configure func(*playback.PlannerInputV3)) playback.DecisionResponseV3 {
 	now, err := time.Parse(time.RFC3339, "2029-12-31T23:55:00Z")
 	if err != nil {
-		fail("parse golden planner time: %v", err)
+		failf("parse golden planner time: %v", err)
 	}
-	result := playback.PlanPlaybackV3(playback.PlannerInputV3{
+	input := playback.PlannerInputV3{
 		Request:             request,
 		RequestedFile:       file,
 		EffectiveFile:       file,
@@ -322,9 +328,13 @@ func goldenDecisionForSource(file *models.MediaFile, request playback.StartReque
 		Registry:            conformanceRegistry(),
 		Now:                 now,
 		AdditionalSubtitles: additional,
-	})
+	}
+	if configure != nil {
+		configure(&input)
+	}
+	result := playback.PlanPlaybackV3(input)
 	if result.Plan == nil {
-		fail("golden planner returned terminal: %#v", result.Terminal)
+		failf("golden planner returned terminal: %#v", result.Terminal)
 	}
 	plan := *result.Plan
 	// These values belong to session/transport setup, which runs after the
@@ -370,7 +380,7 @@ func goldenCapabilityResponse() playback.CapabilityResponseV3 {
 func goldenRouteEvent() playback.RouteEventV3 {
 	decision := goldenDecisionResponse()
 	if decision.PlaybackPlan == nil {
-		fail("golden decision has no plan")
+		failf("golden decision has no plan")
 	}
 	plan := decision.PlaybackPlan
 	return playback.RouteEventV3{
@@ -728,7 +738,7 @@ func goldenConformanceMatrix() playback.ConformanceMatrixV3 {
 	planner = append(planner, makePlannerScenario("embedded_ass_authored_render", "subtitle_matrix", assRequest, assFile, nil, settings, registry))
 
 	dvdFile := conformanceVideoFile()
-	dvdFile.SubtitleTracks = []models.SubtitleTrack{{Index: 4, Language: languageEnglish, Codec: "dvd_subtitle", Title: "English"}}
+	dvdFile.SubtitleTracks = []models.SubtitleTrack{{Index: 4, Language: languageEnglish, Codec: "dvd_subtitle", Title: titleEnglish}}
 	dvdRequest := conformanceStartRequest()
 	dvdRequest.PlaybackAttemptID = "attempt-dvd-burn-in"
 	dvdIndex := 0
@@ -744,7 +754,7 @@ func goldenConformanceMatrix() playback.ConformanceMatrixV3 {
 	decision := goldenDecisionResponse()
 	plan := decision.PlaybackPlan
 	if plan == nil {
-		fail("golden decision has no plan")
+		failf("golden decision has no plan")
 	}
 	trackIndex := 1
 	trackChange := goldenReplanRequest()
@@ -797,7 +807,7 @@ func goldenConformanceMatrix() playback.ConformanceMatrixV3 {
 	outputA := playback.PlanAttemptKeyV3(*plan, "output-a", nil)
 	outputB := playback.PlanAttemptKeyV3(*plan, "output-b", nil)
 	if outputA == outputB {
-		fail("output context must change the opaque plan attempt key")
+		failf("output context must change the opaque plan attempt key")
 	}
 	recovery := goldenReplanRequest()
 	recovery.ReplanRequestID = "replan-failure-matrix-0001"
diff --git a/cmd/prairie/main.go b/cmd/prairie/main.go
index 0c16c8aa7b..26fb558ee0 100644
--- a/cmd/prairie/main.go
+++ b/cmd/prairie/main.go
@@ -30,6 +30,7 @@ import (
 	"github.com/google/uuid"
 	"github.com/hashicorp/go-hclog"
 	"github.com/jackc/pgx/v5/pgxpool"
+	"github.com/prometheus/client_golang/prometheus"
 	"github.com/redis/go-redis/v9"
 
 	pluginv1 "github.com/prairie-server/prairie-plugin-sdk/pkg/pluginproto/prairie/plugin/v1"
@@ -51,6 +52,7 @@ import (
 	"github.com/prairie-server/prairie-server/internal/blobgc"
 	"github.com/prairie-server/prairie-server/internal/blobstore"
 	"github.com/prairie-server/prairie-server/internal/branding"
+	"github.com/prairie-server/prairie-server/internal/buildinfo"
 	"github.com/prairie-server/prairie-server/internal/cache"
 	"github.com/prairie-server/prairie-server/internal/catalog"
 	"github.com/prairie-server/prairie-server/internal/catalogseed"
@@ -60,6 +62,7 @@ import (
 	"github.com/prairie-server/prairie-server/internal/dashmetrics"
 	"github.com/prairie-server/prairie-server/internal/database"
 	"github.com/prairie-server/prairie-server/internal/database/pglock"
+	"github.com/prairie-server/prairie-server/internal/database/queryattr"
 	"github.com/prairie-server/prairie-server/internal/diagnostics"
 	"github.com/prairie-server/prairie-server/internal/downloads"
 	"github.com/prairie-server/prairie-server/internal/ebooks"
@@ -71,6 +74,7 @@ import (
 	"github.com/prairie-server/prairie-server/internal/imageutil"
 	"github.com/prairie-server/prairie-server/internal/intromarkers"
 	"github.com/prairie-server/prairie-server/internal/jellycompat"
+	"github.com/prairie-server/prairie-server/internal/lantls"
 	"github.com/prairie-server/prairie-server/internal/libraryingest"
 	"github.com/prairie-server/prairie-server/internal/librarymonitor"
 	"github.com/prairie-server/prairie-server/internal/literaryworks"
@@ -775,7 +779,14 @@ func main() {
 	// package-level global.
 	dataCipher, err := secret.New(bc.SecretKey)
 	if err != nil {
-		log.Fatalf("secret cipher: %v", err)
+		log.Fatalf("secret cipher: %v", err) //nolint:gocritic // exiting closes the debug listener with the process
+	}
+	// The API listener also answers TLS on its own port, with a key derived
+	// from SECRET_KEY, so signed-in clients can use the server's local-network
+	// address over a channel they authenticate by pin (internal/lantls).
+	lanTLS, err := lantls.New(bc.SecretKey)
+	if err != nil {
+		log.Fatalf("local network TLS: %v", err)
 	}
 
 	apiKeyHashKey, err := secret.DeriveAPIKeyHashKey(bc.SecretKey)
@@ -794,26 +805,11 @@ func main() {
 
 	if *migrateStatus {
 		migCtx, migCancel := database.MigrationContext(ctx)
-		statuses, statusErr := database.MigrationStatuses(migCtx, pool, migrations.FS, "sql")
+		statusErr := database.PrintMigrationStatus(migCtx, pool, migrations.FS, "sql", os.Stdout)
 		migCancel()
 		if statusErr != nil {
 			log.Fatalf("failed to read migration status: %v", statusErr)
 		}
-
-		fmt.Printf("%-8s %8s %-25s %s\n", "STATE", "VERSION", "APPLIED_AT", "MIGRATION")
-		for _, status := range statuses {
-			appliedAt := "-"
-			if !status.AppliedAt.IsZero() {
-				appliedAt = status.AppliedAt.UTC().Format(time.RFC3339)
-			}
-			source := status.Source
-			if source != "" {
-				source = filepath.Base(source)
-			} else {
-				source = "-"
-			}
-			fmt.Printf("%-8s %8d %-25s %s\n", status.State, status.Version, appliedAt, source)
-		}
 		return
 	}
 
@@ -834,10 +830,7 @@ func main() {
 
 	if *migrateOnly {
 		migCtx, migCancel := database.MigrationContext(ctx)
-		migErr := database.RunMigrations(migCtx, pool, migrations.FS, "sql")
-		if migErr == nil {
-			migErr = ensureAuditDetailIndexes(migCtx, pool)
-		}
+		migErr := database.MigrateOnly(migCtx, pool, migrations.FS, "sql")
 		migCancel()
 		if migErr != nil {
 			log.Fatalf("failed to run migrations: %v", migErr)
@@ -855,10 +848,7 @@ func main() {
 	isPrimaryNode := bc.Mode == postgresTuneModeIntegrated || bc.Mode == "api" || bc.Mode == ""
 	if isPrimaryNode {
 		migCtx, migCancel := database.MigrationContext(ctx)
-		migErr := database.RunMigrations(migCtx, pool, migrations.FS, "sql")
-		if migErr == nil {
-			migErr = ensureAuditDetailIndexes(migCtx, pool)
-		}
+		migErr := database.MigrateOnly(migCtx, pool, migrations.FS, "sql")
 		if migErr != nil {
 			migCancel()
 			log.Fatalf("failed to run migrations: %v", migErr)
@@ -1026,7 +1016,16 @@ func main() {
 
 	mode := cfg.Server.Mode
 	maybeApplyPostgresTuning(ctx, pool, cfg.Database.MaxConnections, mode)
-	slog.Info("silo starting", "mode", mode, "listen", cfg.Server.Listen, "log_level", cfg.Server.LogLevel, "node_id", nodeID)
+	queryAttribution := "off"
+	if queryattr.Initialize() {
+		queryAttribution = "on"
+	}
+	queryRun := uuid.NewString()
+	if isPrimaryNode && queryattr.Enabled() {
+		queryattr.RegisterMetrics(prometheus.DefaultRegisterer)
+	}
+	slog.Info("prairie starting", "mode", mode, "listen", cfg.Server.Listen, "log_level", cfg.Server.LogLevel, "node_id", nodeID,
+		"query_attribution", queryAttribution, "query_run", queryRun)
 
 	appCtx, appCancel := context.WithCancel(ctx)
 	defer appCancel()
@@ -1098,6 +1097,10 @@ func main() {
 	// rows to other nodes' live tails, and the event bus closes last.
 	defer logStreamHub.Close()
 	defer stopOperationalLog()
+	if queryattr.Enabled() {
+		stopQuerySummary := startLogDrain(func(ctx context.Context) { queryattr.RunSummary(ctx, queryRun, buildinfo.Current().Display) })
+		defer stopQuerySummary()
+	}
 
 	// Proxy and transcode modes run with DB + Redis for hot-reload.
 	if mode == "proxy" || mode == "transcode" {
@@ -1307,6 +1310,8 @@ func main() {
 	// OnServerSettingUpdated closure, which only runs on admin requests after
 	// startup completes.
 	var ipResolver *clientip.Resolver
+	// Assigned below when recommendations start; nil (a no-op) otherwise.
+	var settingsRecWorker *recommendations.Worker
 	var shutdownWork []<-chan struct{}
 	registerShutdownWork := func(done <-chan struct{}) {
 		shutdownWork = append(shutdownWork, done)
@@ -1363,6 +1368,11 @@ func main() {
 					slog.WarnContext(context.Background(), "clientip config reload failed", "component", "app", "error", loadErr)
 				}
 			}
+			// Cached recommendation rows of profiles with a rating ceiling
+			// are built under the unrated-content decision.
+			if key == config.AccessUnratedContentSettingKey {
+				settingsRecWorker.NotifyUnratedContentChanged(context.Background(), config.UnratedContentCacheTTL+time.Second)
+			}
 			// Nudge the hot-reload watcher so same-process settings changes
 			// apply immediately even without Redis (the event bus is a no-op
 			// then, leaving only the 60s poll).
@@ -1642,6 +1652,7 @@ func main() {
 	// revoke, status pushes) and all three listeners (token validation).
 	networkAccess := netaccess.NewBroker()
 	deps.NetworkAccess = networkAccess
+	deps.LocalTLSPin = lanTLS.Pin()
 	if deps.DB != nil {
 		pluginCacheDir := resolvePluginCacheDir()
 		repositoryStore := plugins.NewRepositoryStore(deps.DB)
@@ -2019,15 +2030,15 @@ func main() {
 		}
 		if deps.Blobs.Assets != nil {
 			imageResolver.SetArtworkResolver(deps.ArtworkResolver)
-			// Local storage publishes with an atomic rename, so the catalog
-			// can trust the manifest as written. Only external delivery (a
-			// public or token-authenticated read endpoint in front of S3)
-			// can lag behind a write and needs the verified-keys lookup.
-			if deps.ArtworkDelivery.External {
-				imageResolver.SetArtworkAvailabilityReader(metadata.NewArtworkDeliveryStore(
-					deps.DB, deps.ArtworkDelivery.Scope, true,
-				))
-			}
+			// Every backend reads the publication manifest, because a key the
+			// catalog holds can name a rung its revision predates: after a
+			// ladder change, existing artwork lacks the new widest rung until
+			// the ladder backfill regenerates it. Only external delivery (a
+			// public or token-authenticated read endpoint in front of S3) can
+			// also lag behind a write, so only it runs the verifier.
+			imageResolver.SetArtworkAvailabilityReader(metadata.NewArtworkDeliveryStore(
+				deps.DB, deps.ArtworkDelivery.Scope, deps.ArtworkDelivery.External,
+			))
 		}
 		deps.ImageResolver = imageResolver
 		deps.PluginImageResolver = imageResolver
@@ -2086,6 +2097,11 @@ func main() {
 			personRepo,
 			deps.FileRepo, skippedRootRepo, staleIDRepo, rootClaimRepo,
 		)
+		// Catalog merges and splits mark stale the recommendations of the
+		// profiles whose user state they moved.
+		if cfg.Recommendations.Enabled && deps.DB != nil {
+			metadataService.SetRecommendationStaler(recommendations.NewRepo(deps.DB))
+		}
 		// Drop the resolved-chain cache whenever a plugin is installed, enabled,
 		// disabled, updated, or uninstalled. The installation-enabled check is
 		// served from the plugins service's in-memory cache (invalidated on the
@@ -2186,6 +2202,9 @@ func main() {
 				avifBackfillProcessor.SetRetiredVariantSweeper(metadata.NewRetiredVariantCleaner(deps.DB, pngCleaner))
 			}
 			metadataService.SetLocalArtworkCopier(metadataImageCacheProcessor)
+			// The admin image picker previews and applies the same local files,
+			// under the same confinement.
+			metadataService.SetLibraryRootResolver(deps.FolderRepo)
 			metadataService.SetAutoCacheImages(cfg.Metadata.CacheImages)
 			metadataImageCacheProcessor.SetEnabled(cfg.Metadata.CacheImages)
 			avifBackfillProcessor.SetEnabled(cfg.Metadata.CacheImages)
@@ -2584,7 +2603,7 @@ func main() {
 			WithMatcher(historyimport.NewMatcher(historyRepo)).
 			WithWatchState(watchstate.NewService(userStoreProvider).WithStableIdentityResolver(historyIdentity)).
 			WithUserStoreProvider(userStoreProvider).
-			WithRatingStore(catalog.NewRatingsRepo(deps.DB), recommendations.NewRepo(deps.DB)).
+			WithRatingStore(catalog.NewRatingsRepo(deps.DB)).
 			WithDroppedStore(notifications.TrackDroppedSeries(catalog.NewDroppedSeriesRepo(deps.DB), notificationSystem))
 		backgroundInit = append(backgroundInit, func(ctx context.Context) {
 			if compatTerminalRecoveryReady != nil {
@@ -2767,7 +2786,19 @@ func main() {
 			catalog.NewPersonRepository(deps.DB),
 			userStoreProvider,
 			cfg.Recommendations,
-		).WithUnratedContentPolicy(unratedContent)
+		).WithUnratedContentPolicy(unratedContent).
+			WithUserStoreOutsidePostgres(cfg.UserDB.Backend == "sqlite")
+		if userStoreProvider != nil {
+			// Cached rows are built under the scope the API resolves for the
+			// profile's own requests, so reads do not filter them down.
+			recUserRepo := auth.NewUserRepository(deps.DB)
+			if policySystem != nil {
+				recEngine.WithScopeResolver(policy.NewViewerResolver(recUserRepo, userStoreProvider, nil, policySystem.PDP(), accessGroupStore).WithUnratedContentPolicy(unratedContent))
+			} else {
+				// Legacy resolver: proxy/test wiring without a policy system. Production integrated/api modes always take the policy path. Removed with the legacy cleanup phase.
+				recEngine.WithScopeResolver(access.NewResolver(recUserRepo, userStoreProvider, nil, accessGroupStore).WithUnratedContentPolicy(unratedContent))
+			}
+		}
 		deps.Recommender = recEngine
 		deps.CatalogSearchVectorizer = recEngine
 
@@ -2783,7 +2814,31 @@ func main() {
 		if err != nil {
 			slog.Error("failed to create recommendation worker", "error", err)
 		} else {
+			recWorker.WithJobHistory(taskrepository.NewPgExecutionRepository(deps.DB)).
+				WithPolicyCheck(policySystem.Current).
+				WithSavedConfig(func(ctx context.Context) (config.RecommendationsConfig, error) {
+					saved, err := settingsRepo.GetAll(ctx)
+					if err != nil {
+						return config.RecommendationsConfig{}, err
+					}
+					savedCfg, err := config.LoadFromDB(saved)
+					if err != nil {
+						return config.RecommendationsConfig{}, err
+					}
+					return savedCfg.Recommendations, nil
+				})
 			deps.RecWorker = recWorker
+			settingsRecWorker = recWorker
+			// Watch-provider syncs rebuild a profile's recommendations once
+			// per run that imported something.
+			if watchProviderService != nil {
+				watchProviderService.WithSignalsChangedNotifier(recWorker)
+			}
+			// A scope policy can change every profile's scope, and cached
+			// rows are built under it. The first node to load a new policy
+			// generation marks every profile stale; refreshes wait until
+			// their node has loaded it (WithPolicyCheck above).
+			policySystem.OnChangeApplied(recWorker.NotifyPolicyChanged)
 		}
 	}
 
@@ -2931,6 +2986,7 @@ func main() {
 	var collectionSyncScheduler *catalog.CollectionSyncScheduler
 	var userCollectionScheduler *usercollections.Scheduler
 	var trendingRefresher *sections.TrendingRefresher
+	var seasonalListRefresher *sections.SeasonalListRefresher
 	if needsWorkers && deps.DB != nil {
 		collectionRepo := catalog.NewLibraryCollectionRepository(deps.DB)
 		collItemRepo := catalog.NewItemRepository(deps.DB)
@@ -2942,16 +2998,17 @@ func main() {
 
 		// The trending refresher reuses the section repo (to find used source/
 		// window combos beyond the calendar's fixed feed), a snapshot repo, an
-		// item repo (external-ID matching), and the TMDB fetcher. The Trakt fetcher needs settingsRepo and is
-		// propagated onto deps.TrendingRefresher later in router.go.
+		// item repo (external-ID matching), and the TMDB fetcher.
+		sectionDemand := sections.NewSectionDemandLister(sectionRepo, auth.NewUserRepository(deps.DB), userStoreProvider)
 		trendingRefresher = sections.NewTrendingRefresher(
-			sections.NewTrendingDemandLister(sectionRepo, auth.NewUserRepository(deps.DB), userStoreProvider),
+			sectionDemand,
 			sections.NewTrendingSnapshotRepository(pool),
 			catalog.NewItemRepository(deps.DB),
 			collectionService.TMDBCollections,
-			collectionService.TraktCollections,
 		)
 		deps.TrendingRefresher = trendingRefresher
+		seasonalListRefresher = sections.NewSeasonalListRefresher(sectionDemand, sections.NewSeasonalListRepository(pool))
+		deps.SeasonalListRefresher = seasonalListRefresher
 
 		if deps.UserStoreProvider != nil {
 			// Imports fill their item limit with titles their owner profile
@@ -2971,8 +3028,6 @@ func main() {
 			// here; the router gives it its generator.
 			deps.PersonalCollectionCollages = catalog.NewPersonalCollectionCollages(deps.DB, nil)
 			userSync.Collages = deps.PersonalCollectionCollages
-			// Trakt fetchers are wired in router.go (they need settingsRepo);
-			// router.go propagates them onto userSync once configured.
 			userCollectionScheduler = usercollections.NewScheduler(deps.DB, userSync, slog.Default())
 			deps.UserCollectionSync = userSync
 			deps.UserCollectionScheduler = userCollectionScheduler
@@ -3144,6 +3199,9 @@ func main() {
 			}
 		}
 		catalogSearchIndexer := catalog.NewCatalogSearchIndexerFromSettings(deps.DB, settingsRepo, catalogSearchStartupSettings)
+		if recEngine != nil {
+			catalogSearchIndexer.WithSemanticModelProvider(recEngine)
+		}
 		taskMgr.Register(tasks.NewSyncCatalogSearchIndexTask(catalogSearchIndexer))
 		taskMgr.Register(tasks.NewRebuildCatalogSearchIndexTask(catalogSearchIndexer))
 		maintenanceSteps = append(maintenanceSteps, tasks.NewCatalogSearchEventRetentionTask(catalog.NewSearchIndexEventRepository(deps.DB)))
@@ -3304,6 +3362,19 @@ func main() {
 			)
 			taskMgr.Register(cacheImagesTask)
 			taskMgr.Register(tasks.NewBackfillMetadataImagesTask(metadataImageCacheProcessor))
+			if releaser := metadata.NewStoredArtworkReleaser(deps.DB); releaser != nil {
+				taskMgr.Register(tasks.NewReleaseStoredArtworkTask(releaser))
+				// Turning caching off releases stored artwork now, not at the
+				// next daily pass.
+				configWatcher.OnChange(func(previous, updated *config.Config) {
+					if previous == nil || !previous.Metadata.CacheImages || updated.Metadata.CacheImages {
+						return
+					}
+					if _, err := taskMgr.StartTask(tasks.ReleaseStoredArtworkTaskKey); err != nil {
+						slog.Debug("metadata: stored artwork release not started", "error", err)
+					}
+				})
+			}
 		}
 		if avifBackfillProcessor != nil {
 			avifBackfillProcessor.SetPlaybackActivityCheck(artworkShouldYield)
@@ -3354,6 +3425,9 @@ func main() {
 		if trendingRefresher != nil {
 			taskMgr.Register(tasks.NewRefreshTrendingDiscoverTask(trendingRefresher))
 		}
+		if seasonalListRefresher != nil {
+			taskMgr.Register(tasks.NewRefreshSeasonalListsTask(seasonalListRefresher))
+		}
 		taskMgr.Register(tasks.NewRefreshAnimeIDsTask(animeids.NewRefresher(deps.DB)))
 		if userCollectionScheduler != nil {
 			taskMgr.Register(tasks.NewSyncUserCollectionsTask(userCollectionScheduler))
@@ -3428,7 +3502,11 @@ func main() {
 		reconcileEpisodeRepo := catalog.NewEpisodeRepository(deps.DB)
 		historyResolver := watchstate.NewStableIdentityResolver(nil, reconcileEpisodeRepo, reconcileProviderIDRepo)
 		historyReconciler := watchstate.NewHistoryReconciler(deps.DB, historyResolver)
-		taskMgr.Register(tasks.NewRepairProviderIDIntegrityTask(metadata.NewProviderIDIntegrityRepairer(deps.DB), historyReconciler))
+		providerIDRepairer := metadata.NewProviderIDIntegrityRepairer(deps.DB)
+		if recWorker != nil {
+			providerIDRepairer.WithRecommendationStaler(recommendations.NewRepo(deps.DB))
+		}
+		taskMgr.Register(tasks.NewRepairProviderIDIntegrityTask(providerIDRepairer, historyReconciler))
 		taskMgr.Register(tasks.NewReconcileWatchHistoryTask(historyReconciler))
 		taskMgr.Register(tasks.NewSyncPodcastFeedsTask(podcastfeed.New(), podcastfeed.NewDBStore(deps.DB)))
 		if liveTVSvc != nil {
@@ -3677,7 +3755,8 @@ func main() {
 		}
 		adminJobRunner = adminjob.NewRunner(
 			adminjob.NewRepository(deps.DB),
-			catalogseed.NewService(deps.DB, catalog.NewPersonRepository(deps.DB), recommendations.NewRepo(deps.DB)),
+			catalogseed.NewService(deps.DB, catalog.NewPersonRepository(deps.DB), recommendations.NewRepo(deps.DB)).
+				WithEmbeddingModel(cfg.Recommendations.EmbeddingModel),
 			artifactStore,
 			itemRefreshExecutor,
 			libraryRefreshExecutor,
@@ -3698,11 +3777,13 @@ func main() {
 			recWorker.Start()
 			defer recWorker.Stop()
 
-			// Check if this is first run (no embeddings yet).
-			embCount, _ := recommendations.NewRepo(deps.DB).EmbeddingCount(appCtx)
-			if embCount == 0 {
-				slog.Info("first run detected, triggering initial embedding")
-				recWorker.RunEmbeddingsNow()
+			// Resume a first or interrupted backfill now rather than at the
+			// next catch-up tick.
+			if needed, err := recEngine.NeedsEmbedding(appCtx); err != nil {
+				slog.WarnContext(appCtx, "checking for items that need embeddings failed", "component", "recommendations", "error", err)
+			} else if needed {
+				slog.InfoContext(appCtx, "items need embeddings; starting the embedding catch-up", "component", "recommendations")
+				recWorker.EmbedMissingNow()
 			}
 		}
 
@@ -3737,6 +3818,7 @@ func main() {
 			JWTSecret:            cfg.Auth.JWTSecret,
 			RecWorker:            recWorker,
 			FrontendFS:           deps.FrontendFS,
+			ArtworkStore:         deps.Blobs.Assets,
 			// Hand remote-transcode recipes to the shared recipe store so a dedicated
 			// transcode node that restarts can rebuild a jellycompat session.
 			RecipeNodeStore:  noderecipe.NewStore(apiRedisClient, 0),
@@ -3827,6 +3909,23 @@ func main() {
 			compatDeps.SubtitleRepo = subtitles.NewPgRepository(deps.DB, deps.SecretCipher)
 			compatDeps.LiveTV = liveTVSvc
 
+			// /Movies/Recommendations reads the cached rows the native API
+			// reads. With recommendations disabled it has no reader and
+			// answers an empty list, so rows cached before are not served.
+			if cfg.Recommendations.Enabled {
+				var compatRecRefresh recommendations.ReadRefreshRequester
+				if recWorker != nil {
+					compatRecRefresh = recWorker
+				}
+				compatDeps.RecommendationReader = recommendations.NewReader(recommendations.NewRepo(deps.DB), catalog.NewRatingsRepo(deps.DB), compatRecRefresh, userStoreProvider).
+					WithUserStoreOutsidePostgres(cfg.UserDB.Backend == "sqlite")
+			}
+			// /Items/{id}/Similar ranks by embeddings when recommendations
+			// are enabled, and by genre otherwise.
+			if recEngine != nil {
+				compatDeps.Recommender = recEngine
+			}
+
 			// Construct auth service for jellycompat login.
 			userRepo := auth.NewUserRepository(deps.DB)
 			compatDeps.APIKeyValidator = auth.NewAPIKeyRepository(deps.DB, apiKeyHashKey)
@@ -3942,7 +4041,7 @@ func main() {
 	} else {
 		go func() {
 			slog.Info("HTTP server listening", "addr", cfg.Server.Listen)
-			if serveErr := srv.Serve(apiListener); serveErr != nil && serveErr != http.ErrServerClosed {
+			if serveErr := srv.Serve(lantls.NewListener(apiListener, lanTLS.Config(), 0)); serveErr != nil && serveErr != http.ErrServerClosed {
 				errCh <- fmt.Errorf("HTTP server error: %w", serveErr)
 			}
 		}()
@@ -4588,6 +4687,14 @@ func replaceWatchSyncPluginProviders(
 		if installation == nil || installation.IsBuiltin() {
 			continue
 		}
+		if watchsync.RetiredPlugin(installation.PluginID) {
+			slog.WarnContext(ctx, "skip retired watch sync plugin; Prairie no longer supports its provider",
+				"component", "app",
+				"installation_id", installation.ID,
+				"plugin_id", installation.PluginID,
+			)
+			continue
+		}
 		prairieManaged, err := service.InstalledFromPrairieRepository(ctx, installation)
 		if err != nil {
 			// Registering a first-party plugin under a per-installation key
@@ -5107,8 +5214,3 @@ func artworkBackendName(deps api.Dependencies) string {
 func chapterThumbnailStoreReady(deps api.Dependencies) bool {
 	return deps.Blobs.Assets != nil
 }
-
-func ensureAuditDetailIndexes(ctx context.Context, pool *pgxpool.Pool) error {
-	return partman.NewManager(pool, "activity_log", partman.Weekly, 2).EnsureIndexes(ctx,
-		"activity_log_action_time_idx", "activity_log_target_time_idx")
-}
diff --git a/cmd/prairie/main_test.go b/cmd/prairie/main_test.go
index 0d665eb140..45fdb79949 100644
--- a/cmd/prairie/main_test.go
+++ b/cmd/prairie/main_test.go
@@ -632,10 +632,10 @@ func (f *fakeWatchSyncMigrationStore) HasConnections(context.Context, string) (b
 	return true, nil
 }
 
-func traktPluginCapabilities(t *testing.T) []*plugins.Capability {
+func watchSyncPluginCapabilities(t *testing.T, id, displayName string) []*plugins.Capability {
 	t.Helper()
 	records, err := plugins.CapabilityRecordsFromManifest(&pluginv1.PluginManifest{Capabilities: []*pluginv1.CapabilityDescriptor{{
-		Type: "watch_sync_provider.v1", Id: "trakt", DisplayName: "Trakt",
+		Type: "watch_sync_provider.v1", Id: id, DisplayName: displayName,
 		WatchSyncProvider: &pluginv1.WatchSyncProviderDescriptor{
 			AuthMethods:   []pluginv1.WatchSyncAuthMethod{pluginv1.WatchSyncAuthMethod_WATCH_SYNC_AUTH_METHOD_DEVICE_CODE},
 			ExportWatched: true,
@@ -657,13 +657,13 @@ func traktPluginCapabilities(t *testing.T) []*plugins.Capability {
 func TestReloadWatchSyncPluginProvidersKeepsOneFirstPartyInstallation(t *testing.T) {
 	store := firstPartyWatchSyncStore{
 		installations: []*plugins.Installation{
-			{ID: 9, PluginID: "prairie.watchprovider.trakt", Enabled: true, Kind: plugins.KindPlugin},
-			{ID: 7, PluginID: "prairie.watchprovider.trakt", Enabled: true, Kind: plugins.KindPlugin},
+			{ID: 9, PluginID: "prairie.watchprovider.simkl", Enabled: true, Kind: plugins.KindPlugin},
+			{ID: 7, PluginID: "prairie.watchprovider.simkl", Enabled: true, Kind: plugins.KindPlugin},
 		},
-		capabilities: traktPluginCapabilities(t),
+		capabilities: watchSyncPluginCapabilities(t, "simkl", "Simkl"),
 	}
 	registry := watchsync.NewRegistry()
-	migration := &fakeWatchSyncMigrationStore{settings: map[string]string{"watchsync.trakt.client_id": "id"}}
+	migration := &fakeWatchSyncMigrationStore{settings: map[string]string{"watchsync.simkl.client_id": "id"}}
 	service := &fakeWatchSyncPluginService{}
 	if err := reloadWatchSyncPluginProviders(context.Background(), registry, store, service, nil, migration); err != nil {
 		t.Fatal(err)
@@ -672,28 +672,49 @@ func TestReloadWatchSyncPluginProvidersKeepsOneFirstPartyInstallation(t *testing
 		t.Fatalf("cache invalidations = %d, want one before reloading providers", service.cacheInvalidations)
 	}
 	summaries := registry.List()
-	if len(summaries) != 1 || summaries[0].Key != "trakt" {
-		t.Fatalf("registered providers = %#v, want only trakt", summaries)
+	if len(summaries) != 1 || summaries[0].Key != "simkl" {
+		t.Fatalf("registered providers = %#v, want only simkl", summaries)
 	}
 	if !slices.Equal(service.seeded, []int{7}) {
 		t.Fatalf("seeded installations = %v, want the older one", service.seeded)
 	}
-	if migration.settings["watchsync.plugin_migration.trakt"] == "" {
+	if migration.settings["watchsync.plugin_migration.simkl"] == "" {
 		t.Fatal("migration was not recorded")
 	}
 }
 
+// A retired plugin left installed registers no provider, under its old key or
+// any other, and records no migration.
+func TestReloadWatchSyncPluginProvidersSkipsRetiredPlugin(t *testing.T) {
+	store := firstPartyWatchSyncStore{
+		installations: []*plugins.Installation{{ID: 7, PluginID: "prairie.watchprovider.trakt", Enabled: true, Kind: plugins.KindPlugin}},
+		capabilities:  watchSyncPluginCapabilities(t, "trakt", "Trakt"),
+	}
+	registry := watchsync.NewRegistry()
+	migration := &fakeWatchSyncMigrationStore{settings: map[string]string{}}
+	service := &fakeWatchSyncPluginService{}
+	if err := reloadWatchSyncPluginProviders(context.Background(), registry, store, service, nil, migration); err != nil {
+		t.Fatal(err)
+	}
+	if summaries := registry.List(); len(summaries) != 0 {
+		t.Fatalf("registered providers = %#v, want none", summaries)
+	}
+	if len(service.seeded) != 0 || len(migration.settings) != 0 {
+		t.Fatalf("seeded = %v, settings = %v; want nothing", service.seeded, migration.settings)
+	}
+}
+
 // Seeding saves plugin config, and the save fires the lifecycle hook that
 // reloads again. The nested reload must not wait on the outer one.
 func TestReloadWatchSyncPluginProvidersSeedsOutsideTheReloadLock(t *testing.T) {
 	store := firstPartyWatchSyncStore{
-		installations: []*plugins.Installation{{ID: 7, PluginID: "prairie.watchprovider.trakt", Enabled: true, Kind: plugins.KindPlugin}},
-		capabilities:  traktPluginCapabilities(t),
+		installations: []*plugins.Installation{{ID: 7, PluginID: "prairie.watchprovider.simkl", Enabled: true, Kind: plugins.KindPlugin}},
+		capabilities:  watchSyncPluginCapabilities(t, "simkl", "Simkl"),
 	}
 	registry := watchsync.NewRegistry()
 	migration := &fakeWatchSyncMigrationStore{settings: map[string]string{
-		"watchsync.trakt.client_id":     "id",
-		"watchsync.trakt.client_secret": "secret",
+		"watchsync.simkl.client_id":     "id",
+		"watchsync.simkl.client_secret": "secret",
 	}}
 	service := &fakeWatchSyncPluginService{}
 	nested := make(chan error, 1)
diff --git a/cmd/settingsgen/main.go b/cmd/settingsgen/main.go
index ae6013d50a..0a45821c73 100644
--- a/cmd/settingsgen/main.go
+++ b/cmd/settingsgen/main.go
@@ -33,7 +33,7 @@ func main() {
 
 	contract, err := settingscontract.Load()
 	if err != nil {
-		fail("loading contract: %v", err)
+		failf("loading contract: %v", err)
 	}
 
 	var body []byte
@@ -48,10 +48,10 @@ func main() {
 	case "swift":
 		body, err = generateSwift(contract)
 	default:
-		fail("unknown -lang %q: want go, ts, kotlin or swift", *lang)
+		failf("unknown -lang %q: want go, ts, kotlin or swift", *lang)
 	}
 	if err != nil {
-		fail("generating %s: %v", *lang, err)
+		failf("generating %s: %v", *lang, err)
 	}
 
 	if *out == "" {
@@ -59,11 +59,11 @@ func main() {
 		return
 	}
 	if err := os.WriteFile(*out, body, 0o644); err != nil { //nolint:gosec // generated source
-		fail("writing %s: %v", *out, err)
+		failf("writing %s: %v", *out, err)
 	}
 }
 
-func fail(format string, args ...any) {
+func failf(format string, args ...any) {
 	fmt.Fprintf(os.Stderr, "settingsgen: "+format+"\n", args...)
 	os.Exit(1)
 }
@@ -245,7 +245,8 @@ func generateTypeScript(contract *settingscontract.Manifest) ([]byte, error) {
 	out.WriteString("  platforms?: readonly string[];\n")
 	out.WriteString("  suggestedOptions?: SettingOptionSetId;\n")
 	out.WriteString("  unsetLabel?: string;\n")
-	out.WriteString("  values?: readonly { value: unknown; label: string; introducedIn: number }[];\n")
+	out.WriteString("  /** A deprecated member stays a valid stored value but is no longer offered. */\n")
+	out.WriteString("  values?: readonly { value: unknown; label: string; introducedIn: number; deprecated?: boolean }[];\n")
 	out.WriteString("  /** Present on enums whose members are ranked, so a ceiling or floor has a direction. */\n")
 	out.WriteString("  ordered?: boolean;\n")
 	out.WriteString("  minimum?: number;\n")
@@ -303,8 +304,12 @@ func generateTypeScript(contract *settingscontract.Manifest) ([]byte, error) {
 				if err != nil {
 					return nil, err
 				}
-				fmt.Fprintf(&out, "      { value: %s, label: %s, introducedIn: %d },\n",
-					encoded, jsString(member.Label), memberRevision(def, member))
+				deprecated := ""
+				if member.Deprecated {
+					deprecated = ", deprecated: true"
+				}
+				fmt.Fprintf(&out, "      { value: %s, label: %s, introducedIn: %d%s },\n",
+					encoded, jsString(member.Label), memberRevision(def, member), deprecated)
 			}
 			out.WriteString("    ],\n")
 		}
diff --git a/contracts/api/v2/embed.go b/contracts/api/v2/embed.go
index e04f207aea..14c5466e02 100644
--- a/contracts/api/v2/embed.go
+++ b/contracts/api/v2/embed.go
@@ -8,10 +8,7 @@
 // and validation live in the packages above.
 package apiv2
 
-import (
-	"embed"
-	_ "embed"
-)
+import "embed"
 
 // FS holds route-inventory.json, migration.json, migration.schema.json,
 // offline-routes.txt, the breaking-change approvals with their schema, and
diff --git a/contracts/api/v2/fixtures/admin_access_group_create.json b/contracts/api/v2/fixtures/admin_access_group_create.json
index 91c871cba3..f10a2964c0 100644
--- a/contracts/api/v2/fixtures/admin_access_group_create.json
+++ b/contracts/api/v2/fixtures/admin_access_group_create.json
@@ -12,6 +12,7 @@
   "max_transcodes": 0,
   "max_remote_stream_bitrate_kbps": 0,
   "max_local_stream_bitrate_kbps": 0,
+  "max_profiles": 5,
   "allowed_permissions": null,
   "requests_allowed": false,
   "is_default": false,
diff --git a/contracts/api/v2/fixtures/admin_access_group_get.json b/contracts/api/v2/fixtures/admin_access_group_get.json
index 91c871cba3..f10a2964c0 100644
--- a/contracts/api/v2/fixtures/admin_access_group_get.json
+++ b/contracts/api/v2/fixtures/admin_access_group_get.json
@@ -12,6 +12,7 @@
   "max_transcodes": 0,
   "max_remote_stream_bitrate_kbps": 0,
   "max_local_stream_bitrate_kbps": 0,
+  "max_profiles": 5,
   "allowed_permissions": null,
   "requests_allowed": false,
   "is_default": false,
diff --git a/contracts/api/v2/fixtures/admin_access_group_list.json b/contracts/api/v2/fixtures/admin_access_group_list.json
index f792883503..992c397bba 100644
--- a/contracts/api/v2/fixtures/admin_access_group_list.json
+++ b/contracts/api/v2/fixtures/admin_access_group_list.json
@@ -14,6 +14,7 @@
       "max_transcodes": 0,
       "max_remote_stream_bitrate_kbps": 0,
       "max_local_stream_bitrate_kbps": 0,
+      "max_profiles": 5,
       "allowed_permissions": null,
       "requests_allowed": false,
       "is_default": false,
diff --git a/contracts/api/v2/fixtures/admin_access_group_update.json b/contracts/api/v2/fixtures/admin_access_group_update.json
index 91c871cba3..f10a2964c0 100644
--- a/contracts/api/v2/fixtures/admin_access_group_update.json
+++ b/contracts/api/v2/fixtures/admin_access_group_update.json
@@ -12,6 +12,7 @@
   "max_transcodes": 0,
   "max_remote_stream_bitrate_kbps": 0,
   "max_local_stream_bitrate_kbps": 0,
+  "max_profiles": 5,
   "allowed_permissions": null,
   "requests_allowed": false,
   "is_default": false,
diff --git a/contracts/api/v2/fixtures/admin_account_capabilities.json b/contracts/api/v2/fixtures/admin_account_capabilities.json
index b9ace12057..565d692148 100644
--- a/contracts/api/v2/fixtures/admin_account_capabilities.json
+++ b/contracts/api/v2/fixtures/admin_account_capabilities.json
@@ -1,5 +1,5 @@
 {
-  "revision": "756d6d9a7e0546dde4bb44fe196522008b61748576d7923c93e7ed0d1c124c6d",
+  "revision": "c537fe27b1bb7a978c5584e48aa7f4503db9c74bbd825ce421b75ac378bb5f9c",
   "state": "available",
   "allowed": true,
   "available": true,
@@ -7,6 +7,7 @@
   "default_profile": true,
   "exact_identity_filter": true,
   "access_groups": true,
+  "profile_limits": true,
   "password_reset_link": true,
   "password_reset_email": true,
   "ownership_transfer": true,
diff --git a/contracts/api/v2/fixtures/admin_account_delete_break_glass_required.json b/contracts/api/v2/fixtures/admin_account_delete_break_glass_required.json
index 0df0280d19..ff870bb403 100644
--- a/contracts/api/v2/fixtures/admin_account_delete_break_glass_required.json
+++ b/contracts/api/v2/fixtures/admin_account_delete_break_glass_required.json
@@ -3,5 +3,5 @@
   "title": "Break-glass account required",
   "status": 409,
   "detail": "Local password sign-in is off, and this is the last break-glass admin that can still sign in with a password",
-  "instance": "urn:silo:request:0000000000000000000002d0"
+  "instance": "urn:silo:request:0000000000000000000002d1"
 }
diff --git a/contracts/api/v2/fixtures/admin_account_get.json b/contracts/api/v2/fixtures/admin_account_get.json
index f4027099d9..c3750cf1d2 100644
--- a/contracts/api/v2/fixtures/admin_account_get.json
+++ b/contracts/api/v2/fixtures/admin_account_get.json
@@ -13,7 +13,7 @@
   "max_local_stream_bitrate_kbps": null,
   "transcode_allowed": null,
   "audio_transcode_allowed": null,
-  "max_profiles": 5,
+  "max_profiles": null,
   "download_allowed": null,
   "download_transcode_allowed": null,
   "requests_allowed": null,
@@ -29,6 +29,7 @@
     "max_transcodes": 0,
     "max_remote_stream_bitrate_kbps": 0,
     "max_local_stream_bitrate_kbps": 0,
+    "max_profiles": 5,
     "transcode_allowed": false,
     "audio_transcode_allowed": false,
     "download_allowed": false,
diff --git a/contracts/api/v2/fixtures/admin_account_profile_sections_not_found.json b/contracts/api/v2/fixtures/admin_account_profile_sections_not_found.json
index a78991288c..bceb836f39 100644
--- a/contracts/api/v2/fixtures/admin_account_profile_sections_not_found.json
+++ b/contracts/api/v2/fixtures/admin_account_profile_sections_not_found.json
@@ -3,5 +3,5 @@
   "title": "Not found",
   "status": 404,
   "detail": "Profile not found",
-  "instance": "urn:silo:request:00000000000000000000021d"
+  "instance": "urn:silo:request:00000000000000000000021e"
 }
diff --git a/contracts/api/v2/fixtures/admin_apple_push_test_notification.json b/contracts/api/v2/fixtures/admin_apple_push_test_notification.json
new file mode 100644
index 0000000000..5b01ec24ca
--- /dev/null
+++ b/contracts/api/v2/fixtures/admin_apple_push_test_notification.json
@@ -0,0 +1,8 @@
+{
+  "attempt_id": "attempt-1",
+  "push_device_id": "device-1",
+  "server_device_id": "target-device",
+  "delivery_id": "delivery-1",
+  "outcome": "delivered",
+  "upstream_status": 200
+}
diff --git a/contracts/api/v2/fixtures/admin_catalog_import_committed.json b/contracts/api/v2/fixtures/admin_catalog_import_committed.json
index 0d570e0300..305aecb20b 100644
--- a/contracts/api/v2/fixtures/admin_catalog_import_committed.json
+++ b/contracts/api/v2/fixtures/admin_catalog_import_committed.json
@@ -12,5 +12,6 @@
   "links_created": 0,
   "credits_replaced": 0,
   "embeddings_imported": 0,
+  "embeddings_skipped": 0,
   "skipped": 0
 }
diff --git a/contracts/api/v2/fixtures/admin_download_revoke_mixed.json b/contracts/api/v2/fixtures/admin_download_revoke_mixed.json
index e5d38f046c..dd30c92fc4 100644
--- a/contracts/api/v2/fixtures/admin_download_revoke_mixed.json
+++ b/contracts/api/v2/fixtures/admin_download_revoke_mixed.json
@@ -3,5 +3,5 @@
   "title": "Validation failed",
   "status": 422,
   "detail": "Send download ids or one device, not both.",
-  "instance": "urn:silo:request:0000000000000000000002f2"
+  "instance": "urn:silo:request:0000000000000000000002f3"
 }
diff --git a/contracts/api/v2/fixtures/admin_download_storage_delete_invalid_id.json b/contracts/api/v2/fixtures/admin_download_storage_delete_invalid_id.json
index 7231e8a0c6..9cb50fdf7a 100644
--- a/contracts/api/v2/fixtures/admin_download_storage_delete_invalid_id.json
+++ b/contracts/api/v2/fixtures/admin_download_storage_delete_invalid_id.json
@@ -3,5 +3,5 @@
   "title": "Validation failed",
   "status": 422,
   "detail": "Invalid prepared file id.",
-  "instance": "urn:silo:request:0000000000000000000002eb"
+  "instance": "urn:silo:request:0000000000000000000002ec"
 }
diff --git a/contracts/api/v2/fixtures/admin_item_markers_redetect_unknown_kind.json b/contracts/api/v2/fixtures/admin_item_markers_redetect_unknown_kind.json
index 9e3d77228b..305690267c 100644
--- a/contracts/api/v2/fixtures/admin_item_markers_redetect_unknown_kind.json
+++ b/contracts/api/v2/fixtures/admin_item_markers_redetect_unknown_kind.json
@@ -3,7 +3,7 @@
   "title": "Validation failed",
   "status": 422,
   "detail": "The request did not pass validation; see errors.",
-  "instance": "urn:silo:request:000000000000000000000247",
+  "instance": "urn:silo:request:000000000000000000000248",
   "errors": [
     {
       "location": "body.kind",
diff --git a/contracts/api/v2/fixtures/admin_login_session_forbidden.json b/contracts/api/v2/fixtures/admin_login_session_forbidden.json
index 7e95ea3ac7..a8abf9841c 100644
--- a/contracts/api/v2/fixtures/admin_login_session_forbidden.json
+++ b/contracts/api/v2/fixtures/admin_login_session_forbidden.json
@@ -3,5 +3,5 @@
   "title": "Permission denied",
   "status": 403,
   "detail": "Admin access required",
-  "instance": "urn:silo:request:0000000000000000000002e6"
+  "instance": "urn:silo:request:0000000000000000000002e7"
 }
diff --git a/contracts/api/v2/fixtures/admin_network_access_status_not_found.json b/contracts/api/v2/fixtures/admin_network_access_status_not_found.json
index be5fe326c3..6e626a00a7 100644
--- a/contracts/api/v2/fixtures/admin_network_access_status_not_found.json
+++ b/contracts/api/v2/fixtures/admin_network_access_status_not_found.json
@@ -3,5 +3,5 @@
   "title": "Not found",
   "status": 404,
   "detail": "Network access provider not found.",
-  "instance": "urn:silo:request:00000000000000000000028f"
+  "instance": "urn:silo:request:000000000000000000000290"
 }
diff --git a/contracts/api/v2/fixtures/admin_network_access_unknown_host.json b/contracts/api/v2/fixtures/admin_network_access_unknown_host.json
index 8ec3c04e7a..f6fc1ea8d3 100644
--- a/contracts/api/v2/fixtures/admin_network_access_unknown_host.json
+++ b/contracts/api/v2/fixtures/admin_network_access_unknown_host.json
@@ -3,7 +3,7 @@
   "title": "Validation failed",
   "status": 422,
   "detail": "The request did not pass validation; see errors.",
-  "instance": "urn:silo:request:000000000000000000000292",
+  "instance": "urn:silo:request:000000000000000000000293",
   "errors": [
     {
       "location": "body.hosts",
diff --git a/contracts/api/v2/fixtures/admin_recommendations_embeddings_reset.json b/contracts/api/v2/fixtures/admin_recommendations_embeddings_reset.json
new file mode 100644
index 0000000000..1511aedda8
--- /dev/null
+++ b/contracts/api/v2/fixtures/admin_recommendations_embeddings_reset.json
@@ -0,0 +1,6 @@
+{
+  "embeddings": 120,
+  "taste_profiles": 3,
+  "taste_clusters": 9,
+  "cached_rows": 41
+}
diff --git a/contracts/api/v2/fixtures/admin_recommendations_status.json b/contracts/api/v2/fixtures/admin_recommendations_status.json
index 73baa22df2..1741641a6b 100644
--- a/contracts/api/v2/fixtures/admin_recommendations_status.json
+++ b/contracts/api/v2/fixtures/admin_recommendations_status.json
@@ -2,7 +2,25 @@
   "embeddings": {
     "running": true,
     "count": 3,
-    "total": 10
+    "total": 10,
+    "last_run": {
+      "status": "failed",
+      "started_at": "2026-10-03T03:00:00.000Z",
+      "completed_at": "2026-10-03T03:01:30.000Z",
+      "error": "embed batch: POST https://[REDACTED]@embed.example/v1/embeddings: api_key=[REDACTED] rejected",
+      "result": {
+        "embedded": 0
+      }
+    },
+    "last_partial_run": {
+      "status": "completed",
+      "started_at": "2026-10-03T03:15:00.000Z",
+      "completed_at": "2026-10-03T03:16:00.000Z",
+      "result": {
+        "embedded": 2,
+        "missing_only": true
+      }
+    }
   },
   "taste_profiles": {
     "running": false,
@@ -14,6 +32,34 @@
   },
   "recommendations": {
     "running": false,
-    "count": 5
-  }
+    "count": 5,
+    "last_run": {
+      "status": "completed",
+      "started_at": "2026-10-03T05:00:00.000Z",
+      "completed_at": "2026-10-03T05:01:00.000Z",
+      "result": {
+        "build_errors": 0,
+        "cached_rows": 14,
+        "processed": 2,
+        "profiles": 2
+      }
+    }
+  },
+  "lock_conflict": "",
+  "stale_sweep": {
+    "pending": 7,
+    "last_run": {
+      "status": "completed",
+      "started_at": "2026-10-03T06:00:00.000Z",
+      "completed_at": "2026-10-03T06:00:20.000Z",
+      "result": {
+        "deferred": 0,
+        "failed": 1,
+        "queued": 0,
+        "refreshed": 2,
+        "stale": 3
+      }
+    }
+  },
+  "cache_refreshed_at": "2026-10-03T05:01:00.000Z"
 }
diff --git a/contracts/api/v2/fixtures/admin_subtitle_metadata_precondition_required.json b/contracts/api/v2/fixtures/admin_subtitle_metadata_precondition_required.json
index fb6d7d9436..6a2b87fbd1 100644
--- a/contracts/api/v2/fixtures/admin_subtitle_metadata_precondition_required.json
+++ b/contracts/api/v2/fixtures/admin_subtitle_metadata_precondition_required.json
@@ -3,5 +3,5 @@
   "title": "Precondition required",
   "status": 428,
   "detail": "This operation requires the If-Match header field carrying the resource's current ETag.",
-  "instance": "urn:silo:request:000000000000000000000265"
+  "instance": "urn:silo:request:000000000000000000000266"
 }
diff --git a/contracts/api/v2/fixtures/admin_user_policy_defaults.json b/contracts/api/v2/fixtures/admin_user_policy_defaults.json
index c0bae30f15..2fbe1973cb 100644
--- a/contracts/api/v2/fixtures/admin_user_policy_defaults.json
+++ b/contracts/api/v2/fixtures/admin_user_policy_defaults.json
@@ -6,6 +6,7 @@
     "max_transcodes": 0,
     "max_remote_stream_bitrate_kbps": 0,
     "max_local_stream_bitrate_kbps": 0,
+    "max_profiles": 5,
     "transcode_allowed": true,
     "audio_transcode_allowed": true,
     "download_allowed": true,
@@ -19,6 +20,7 @@
     "max_transcodes": 0,
     "max_remote_stream_bitrate_kbps": 0,
     "max_local_stream_bitrate_kbps": 0,
+    "max_profiles": 5,
     "transcode_allowed": true,
     "audio_transcode_allowed": true,
     "download_allowed": true,
diff --git a/contracts/api/v2/fixtures/android_push_registration_ok.json b/contracts/api/v2/fixtures/android_push_registration_ok.json
new file mode 100644
index 0000000000..218eb6438c
--- /dev/null
+++ b/contracts/api/v2/fixtures/android_push_registration_ok.json
@@ -0,0 +1,7 @@
+{
+  "generation": "3",
+  "registration_id": "registration",
+  "server_device_id": "server-device",
+  "push_mode": "private_push",
+  "server_id": "3f2a9d5e-6b1c-4c7e-9a0d-2f4b8c1e7a35"
+}
diff --git a/contracts/api/v2/fixtures/apple_push_registration_capability.json b/contracts/api/v2/fixtures/apple_push_registration_capability.json
index a2a492118d..ce86ca8451 100644
--- a/contracts/api/v2/fixtures/apple_push_registration_capability.json
+++ b/contracts/api/v2/fixtures/apple_push_registration_capability.json
@@ -1,6 +1,6 @@
 {
-  "revision": "4bc701e05299627e8b05db8a01da13a810e2fc870e80d43066bf735ddf1e014a",
-  "state": "not_configured",
+  "revision": "021627e60916f147b6bb80e8512f738e97b7c22cb1f30e20d5eed6abf506305a",
+  "state": "available",
   "allowed": false,
-  "registration_available": false
+  "registration_available": true
 }
diff --git a/contracts/api/v2/fixtures/apple_push_registration_ok.json b/contracts/api/v2/fixtures/apple_push_registration_ok.json
new file mode 100644
index 0000000000..b71553eeb8
--- /dev/null
+++ b/contracts/api/v2/fixtures/apple_push_registration_ok.json
@@ -0,0 +1,11 @@
+{
+  "generation": "3",
+  "id": "registration",
+  "server_device_id": "server-device",
+  "push_mode": "private_push",
+  "enabled": true,
+  "removed": false,
+  "display_token": "synthetic-display",
+  "display_token_expires_at": "2026-02-01T03:04:05.678Z",
+  "server_id": "3f2a9d5e-6b1c-4c7e-9a0d-2f4b8c1e7a35"
+}
diff --git a/contracts/api/v2/fixtures/approve_device_login_api_key_forbidden.json b/contracts/api/v2/fixtures/approve_device_login_api_key_forbidden.json
index 4f1e6d8b5b..255b6a565a 100644
--- a/contracts/api/v2/fixtures/approve_device_login_api_key_forbidden.json
+++ b/contracts/api/v2/fixtures/approve_device_login_api_key_forbidden.json
@@ -3,5 +3,5 @@
   "title": "Permission denied",
   "status": 403,
   "detail": "Approving or denying a device needs a signed-in session; API keys and impersonation sessions cannot.",
-  "instance": "urn:silo:request:0000000000000000000002cc"
+  "instance": "urn:silo:request:0000000000000000000002cd"
 }
diff --git a/contracts/api/v2/fixtures/cancel_admin_download_preparations_invalid_id.json b/contracts/api/v2/fixtures/cancel_admin_download_preparations_invalid_id.json
index f7a6994de4..0c66f5bcd9 100644
--- a/contracts/api/v2/fixtures/cancel_admin_download_preparations_invalid_id.json
+++ b/contracts/api/v2/fixtures/cancel_admin_download_preparations_invalid_id.json
@@ -3,5 +3,5 @@
   "title": "Validation failed",
   "status": 422,
   "detail": "Invalid preparation job id.",
-  "instance": "urn:silo:request:0000000000000000000002d7"
+  "instance": "urn:silo:request:0000000000000000000002d8"
 }
diff --git a/contracts/api/v2/fixtures/cancel_device_login_not_found.json b/contracts/api/v2/fixtures/cancel_device_login_not_found.json
index df5d7b8c70..604f04a54e 100644
--- a/contracts/api/v2/fixtures/cancel_device_login_not_found.json
+++ b/contracts/api/v2/fixtures/cancel_device_login_not_found.json
@@ -3,5 +3,5 @@
   "title": "Not found",
   "status": 404,
   "detail": "Device login request not found",
-  "instance": "urn:silo:request:0000000000000000000002b5"
+  "instance": "urn:silo:request:0000000000000000000002b6"
 }
diff --git a/contracts/api/v2/fixtures/clear_resume_position_not_found.json b/contracts/api/v2/fixtures/clear_resume_position_not_found.json
new file mode 100644
index 0000000000..6a69cbb148
--- /dev/null
+++ b/contracts/api/v2/fixtures/clear_resume_position_not_found.json
@@ -0,0 +1,7 @@
+{
+  "type": "https://siloserver.org/docs/api/v2/problems/not_found",
+  "title": "Not found",
+  "status": 404,
+  "detail": "Item not found",
+  "instance": "urn:silo:request:0000000000000000000002fb"
+}
diff --git a/contracts/api/v2/fixtures/clear_resume_position_not_leaf.json b/contracts/api/v2/fixtures/clear_resume_position_not_leaf.json
new file mode 100644
index 0000000000..da720d2206
--- /dev/null
+++ b/contracts/api/v2/fixtures/clear_resume_position_not_leaf.json
@@ -0,0 +1,14 @@
+{
+  "type": "https://siloserver.org/docs/api/v2/problems/validation_failed",
+  "title": "Validation failed",
+  "status": 422,
+  "detail": "The request did not pass validation; see errors.",
+  "instance": "urn:silo:request:0000000000000000000002fa",
+  "errors": [
+    {
+      "location": "path.media_item_id",
+      "code": "invalid",
+      "detail": "Only a movie or an episode has a resume position"
+    }
+  ]
+}
diff --git a/contracts/api/v2/fixtures/collection_order_foreign_id.json b/contracts/api/v2/fixtures/collection_order_foreign_id.json
index e2c3737616..6dbfedc1ab 100644
--- a/contracts/api/v2/fixtures/collection_order_foreign_id.json
+++ b/contracts/api/v2/fixtures/collection_order_foreign_id.json
@@ -3,7 +3,7 @@
   "title": "Validation failed",
   "status": 422,
   "detail": "The request did not pass validation; see errors.",
-  "instance": "urn:silo:request:0000000000000000000002d8",
+  "instance": "urn:silo:request:0000000000000000000002d9",
   "errors": [
     {
       "location": "body.ordered_ids",
diff --git a/contracts/api/v2/fixtures/complete_account_identity_link_invalid_grant.json b/contracts/api/v2/fixtures/complete_account_identity_link_invalid_grant.json
index d0454f55b4..7ee4f6ab7b 100644
--- a/contracts/api/v2/fixtures/complete_account_identity_link_invalid_grant.json
+++ b/contracts/api/v2/fixtures/complete_account_identity_link_invalid_grant.json
@@ -3,5 +3,5 @@
   "title": "Invalid grant",
   "status": 400,
   "detail": "The code_verifier does not fit this link code.",
-  "instance": "urn:silo:request:0000000000000000000002c7"
+  "instance": "urn:silo:request:0000000000000000000002c8"
 }
diff --git a/contracts/api/v2/fixtures/complete_oauth_login_invalid_grant.json b/contracts/api/v2/fixtures/complete_oauth_login_invalid_grant.json
index e154533212..8fe8c7b6d6 100644
--- a/contracts/api/v2/fixtures/complete_oauth_login_invalid_grant.json
+++ b/contracts/api/v2/fixtures/complete_oauth_login_invalid_grant.json
@@ -3,5 +3,5 @@
   "title": "Invalid grant",
   "status": 400,
   "detail": "The code_verifier does not fit this completion code.",
-  "instance": "urn:silo:request:0000000000000000000002c1"
+  "instance": "urn:silo:request:0000000000000000000002c2"
 }
diff --git a/contracts/api/v2/fixtures/create_account_identity_link_ticket_wrong_password.json b/contracts/api/v2/fixtures/create_account_identity_link_ticket_wrong_password.json
index 50949a7c1b..03ab88117d 100644
--- a/contracts/api/v2/fixtures/create_account_identity_link_ticket_wrong_password.json
+++ b/contracts/api/v2/fixtures/create_account_identity_link_ticket_wrong_password.json
@@ -3,7 +3,7 @@
   "title": "Validation failed",
   "status": 422,
   "detail": "The request did not pass validation; see errors.",
-  "instance": "urn:silo:request:0000000000000000000002c3",
+  "instance": "urn:silo:request:0000000000000000000002c4",
   "errors": [
     {
       "location": "body.password",
diff --git a/contracts/api/v2/fixtures/create_admin_user_identity_linked_elsewhere.json b/contracts/api/v2/fixtures/create_admin_user_identity_linked_elsewhere.json
index 7367183acb..efcd51ed79 100644
--- a/contracts/api/v2/fixtures/create_admin_user_identity_linked_elsewhere.json
+++ b/contracts/api/v2/fixtures/create_admin_user_identity_linked_elsewhere.json
@@ -3,5 +3,5 @@
   "title": "Identity linked elsewhere",
   "status": 409,
   "detail": "This identity is already linked to another account",
-  "instance": "urn:silo:request:0000000000000000000002bc"
+  "instance": "urn:silo:request:0000000000000000000002bd"
 }
diff --git a/contracts/api/v2/fixtures/delete_account_identity_last_sign_in_method.json b/contracts/api/v2/fixtures/delete_account_identity_last_sign_in_method.json
index f31f1f0ebc..ee15f9a315 100644
--- a/contracts/api/v2/fixtures/delete_account_identity_last_sign_in_method.json
+++ b/contracts/api/v2/fixtures/delete_account_identity_last_sign_in_method.json
@@ -3,5 +3,5 @@
   "title": "Last sign-in method",
   "status": 409,
   "detail": "The account has no other way to sign in; ask an administrator to set a password for it first",
-  "instance": "urn:silo:request:0000000000000000000002b8"
+  "instance": "urn:silo:request:0000000000000000000002b9"
 }
diff --git a/contracts/api/v2/fixtures/ebook_annotation_delete_missing_guard.json b/contracts/api/v2/fixtures/ebook_annotation_delete_missing_guard.json
index b111039754..36fb11c712 100644
--- a/contracts/api/v2/fixtures/ebook_annotation_delete_missing_guard.json
+++ b/contracts/api/v2/fixtures/ebook_annotation_delete_missing_guard.json
@@ -3,5 +3,5 @@
   "title": "Precondition required",
   "status": 428,
   "detail": "This operation requires the If-Match header field carrying the resource's current ETag.",
-  "instance": "urn:silo:request:000000000000000000000234"
+  "instance": "urn:silo:request:000000000000000000000235"
 }
diff --git a/contracts/api/v2/fixtures/ebook_annotation_patch_missing_guard.json b/contracts/api/v2/fixtures/ebook_annotation_patch_missing_guard.json
index 7ee45276b4..b111039754 100644
--- a/contracts/api/v2/fixtures/ebook_annotation_patch_missing_guard.json
+++ b/contracts/api/v2/fixtures/ebook_annotation_patch_missing_guard.json
@@ -3,5 +3,5 @@
   "title": "Precondition required",
   "status": 428,
   "detail": "This operation requires the If-Match header field carrying the resource's current ETag.",
-  "instance": "urn:silo:request:000000000000000000000233"
+  "instance": "urn:silo:request:000000000000000000000234"
 }
diff --git a/contracts/api/v2/fixtures/ebook_config_missing_guard.json b/contracts/api/v2/fixtures/ebook_config_missing_guard.json
index a4699eca3f..cb12562065 100644
--- a/contracts/api/v2/fixtures/ebook_config_missing_guard.json
+++ b/contracts/api/v2/fixtures/ebook_config_missing_guard.json
@@ -3,5 +3,5 @@
   "title": "Precondition required",
   "status": 428,
   "detail": "This operation requires the If-Match header field carrying the resource's current ETag.",
-  "instance": "urn:silo:request:00000000000000000000022f"
+  "instance": "urn:silo:request:000000000000000000000230"
 }
diff --git a/contracts/api/v2/fixtures/ebook_progress_missing_event_time.json b/contracts/api/v2/fixtures/ebook_progress_missing_event_time.json
index 7e8e4c360e..d8cb502de7 100644
--- a/contracts/api/v2/fixtures/ebook_progress_missing_event_time.json
+++ b/contracts/api/v2/fixtures/ebook_progress_missing_event_time.json
@@ -3,7 +3,7 @@
   "title": "Validation failed",
   "status": 422,
   "detail": "The request did not pass validation; see errors.",
-  "instance": "urn:silo:request:00000000000000000000022d",
+  "instance": "urn:silo:request:00000000000000000000022e",
   "errors": [
     {
       "location": "body.updated_at",
diff --git a/contracts/api/v2/fixtures/get_catalog_item_ok.json b/contracts/api/v2/fixtures/get_catalog_item_ok.json
index 091f25ac1b..bd8722c443 100644
--- a/contracts/api/v2/fixtures/get_catalog_item_ok.json
+++ b/contracts/api/v2/fixtures/get_catalog_item_ok.json
@@ -25,7 +25,8 @@
   "user_state": {
     "played": true,
     "is_favorite": true,
-    "in_watchlist": false
+    "in_watchlist": false,
+    "not_interested": false
   },
   "work_formats": [
     {
diff --git a/contracts/api/v2/fixtures/get_discover_ok.json b/contracts/api/v2/fixtures/get_discover_ok.json
index 7d6906e3e8..83f886634e 100644
--- a/contracts/api/v2/fixtures/get_discover_ok.json
+++ b/contracts/api/v2/fixtures/get_discover_ok.json
@@ -31,7 +31,8 @@
           "user_state": {
             "played": false,
             "is_favorite": false,
-            "in_watchlist": true
+            "in_watchlist": true,
+            "not_interested": false
           }
         }
       ]
diff --git a/contracts/api/v2/fixtures/get_for_you_main_ok.json b/contracts/api/v2/fixtures/get_for_you_main_ok.json
index d82d883b42..e4f3146560 100644
--- a/contracts/api/v2/fixtures/get_for_you_main_ok.json
+++ b/contracts/api/v2/fixtures/get_for_you_main_ok.json
@@ -29,7 +29,8 @@
       "user_state": {
         "played": false,
         "is_favorite": false,
-        "in_watchlist": true
+        "in_watchlist": true,
+        "not_interested": false
       }
     }
   ]
diff --git a/contracts/api/v2/fixtures/get_home_layout_include_items_out_of_range.json b/contracts/api/v2/fixtures/get_home_layout_include_items_out_of_range.json
index 793ecc20a6..ca0e9a9325 100644
--- a/contracts/api/v2/fixtures/get_home_layout_include_items_out_of_range.json
+++ b/contracts/api/v2/fixtures/get_home_layout_include_items_out_of_range.json
@@ -3,7 +3,7 @@
   "title": "Validation failed",
   "status": 422,
   "detail": "The request did not pass validation; see errors.",
-  "instance": "urn:silo:request:0000000000000000000002f6",
+  "instance": "urn:silo:request:0000000000000000000002f7",
   "errors": [
     {
       "location": "query.include_items",
diff --git a/contracts/api/v2/fixtures/get_home_layout_with_items_ok.json b/contracts/api/v2/fixtures/get_home_layout_with_items_ok.json
index e1583af6ee..6bd2744627 100644
--- a/contracts/api/v2/fixtures/get_home_layout_with_items_ok.json
+++ b/contracts/api/v2/fixtures/get_home_layout_with_items_ok.json
@@ -55,7 +55,8 @@
           "user_state": {
             "played": false,
             "is_favorite": false,
-            "in_watchlist": true
+            "in_watchlist": true,
+            "not_interested": false
           }
         }
       ]
diff --git a/contracts/api/v2/fixtures/get_home_section_items_ok.json b/contracts/api/v2/fixtures/get_home_section_items_ok.json
index cce9d8c8b4..34c9d90d79 100644
--- a/contracts/api/v2/fixtures/get_home_section_items_ok.json
+++ b/contracts/api/v2/fixtures/get_home_section_items_ok.json
@@ -33,7 +33,8 @@
       "user_state": {
         "played": false,
         "is_favorite": false,
-        "in_watchlist": true
+        "in_watchlist": true,
+        "not_interested": false
       }
     }
   ]
diff --git a/contracts/api/v2/fixtures/get_image_capabilities_ok.json b/contracts/api/v2/fixtures/get_image_capabilities_ok.json
index 15d10b9252..189b60b778 100644
--- a/contracts/api/v2/fixtures/get_image_capabilities_ok.json
+++ b/contracts/api/v2/fixtures/get_image_capabilities_ok.json
@@ -1,11 +1,18 @@
 {
-  "revision": "0ebdd7fa6c49a596cc6371358390a174e111965b73e938af57b825b2b2200118",
+  "revision": "9b056d77a083a4cdd2737681cfece78887272a600ab70debf5a4ececc3dc845c",
   "state": "available",
   "allowed": true,
   "episode_still_provenance": true,
   "extended_item_artwork": true,
   "season_list_artwork_param": "include_artwork",
   "param": "image_size",
+  "slot_width_params": {
+    "backdrop": "backdrop_width",
+    "logo": "logo_width",
+    "photo": "photo_width",
+    "poster": "poster_width",
+    "still": "still_width"
+  },
   "sizes": [
     "small",
     "medium",
@@ -16,7 +23,7 @@
     "backdrop": {
       "small": 300,
       "medium": 1920,
-      "large": 1920
+      "large": 2560
     },
     "banner": {
       "small": 500,
@@ -59,7 +66,7 @@
       "large": 1280
     }
   },
-  "original_max_width_px": 1920,
+  "original_max_width_px": 3840,
   "storage_backend": "local",
   "delivery": "server"
 }
diff --git a/contracts/api/v2/fixtures/get_library_capabilities_ok.json b/contracts/api/v2/fixtures/get_library_capabilities_ok.json
index da27a3afdd..d75c5392f3 100644
--- a/contracts/api/v2/fixtures/get_library_capabilities_ok.json
+++ b/contracts/api/v2/fixtures/get_library_capabilities_ok.json
@@ -1,8 +1,9 @@
 {
-  "revision": "acb6061b6ed685ee85933c4187157c9cf4380cd0e099b671dcee7690ef3e7e74",
+  "revision": "6fcbb994aa4a8925a3276d419d1a8d73147ac1dee0abfad0fb8c18a1f42accba",
   "state": "available",
   "allowed": true,
   "realtime_monitoring": true,
   "trickplay": true,
-  "trickplay_supported": false
+  "trickplay_supported": false,
+  "ignore_unmatched": true
 }
diff --git a/contracts/api/v2/fixtures/get_library_section_items_ok.json b/contracts/api/v2/fixtures/get_library_section_items_ok.json
index cce9d8c8b4..34c9d90d79 100644
--- a/contracts/api/v2/fixtures/get_library_section_items_ok.json
+++ b/contracts/api/v2/fixtures/get_library_section_items_ok.json
@@ -33,7 +33,8 @@
       "user_state": {
         "played": false,
         "is_favorite": false,
-        "in_watchlist": true
+        "in_watchlist": true,
+        "not_interested": false
       }
     }
   ]
diff --git a/contracts/api/v2/fixtures/get_not_interested_capability_ok.json b/contracts/api/v2/fixtures/get_not_interested_capability_ok.json
new file mode 100644
index 0000000000..d4af0ff21b
--- /dev/null
+++ b/contracts/api/v2/fixtures/get_not_interested_capability_ok.json
@@ -0,0 +1,5 @@
+{
+  "revision": "b0b4875beb0989c8313675f36e32d8cc5f1ff9b616797eab4cdfbb495288f0b3",
+  "state": "available",
+  "allowed": true
+}
diff --git a/contracts/api/v2/fixtures/get_not_interested_not_found.json b/contracts/api/v2/fixtures/get_not_interested_not_found.json
new file mode 100644
index 0000000000..a9b9d26669
--- /dev/null
+++ b/contracts/api/v2/fixtures/get_not_interested_not_found.json
@@ -0,0 +1,7 @@
+{
+  "type": "https://siloserver.org/docs/api/v2/problems/not_found",
+  "title": "Not found",
+  "status": 404,
+  "detail": "The profile has not marked the item Not interested.",
+  "instance": "urn:silo:request:000000000000000000000306"
+}
diff --git a/contracts/api/v2/fixtures/get_not_interested_ok.json b/contracts/api/v2/fixtures/get_not_interested_ok.json
new file mode 100644
index 0000000000..adf15d746e
--- /dev/null
+++ b/contracts/api/v2/fixtures/get_not_interested_ok.json
@@ -0,0 +1,4 @@
+{
+  "item_id": "movie:c",
+  "marked_at": "2026-01-02T03:04:05.000Z"
+}
diff --git a/contracts/api/v2/fixtures/get_progress_capabilities_ok.json b/contracts/api/v2/fixtures/get_progress_capabilities_ok.json
new file mode 100644
index 0000000000..47332472a4
--- /dev/null
+++ b/contracts/api/v2/fixtures/get_progress_capabilities_ok.json
@@ -0,0 +1,6 @@
+{
+  "revision": "49220410b1e429a5668743a5a4b0a0dff17504393d81f2255cd5a66e5adfa8a0",
+  "state": "available",
+  "allowed": true,
+  "clear_resume_position": true
+}
diff --git a/contracts/api/v2/fixtures/get_ratings_capability_authentication_required.json b/contracts/api/v2/fixtures/get_ratings_capability_authentication_required.json
index 85fc227efd..7ad2a928c3 100644
--- a/contracts/api/v2/fixtures/get_ratings_capability_authentication_required.json
+++ b/contracts/api/v2/fixtures/get_ratings_capability_authentication_required.json
@@ -3,5 +3,5 @@
   "title": "Authentication required",
   "status": 401,
   "detail": "Authentication is required.",
-  "instance": "urn:silo:request:0000000000000000000002ab"
+  "instance": "urn:silo:request:0000000000000000000002ac"
 }
diff --git a/contracts/api/v2/fixtures/get_recommendation_section_ok.json b/contracts/api/v2/fixtures/get_recommendation_section_ok.json
index 86e6f66e8a..a93d6d3b86 100644
--- a/contracts/api/v2/fixtures/get_recommendation_section_ok.json
+++ b/contracts/api/v2/fixtures/get_recommendation_section_ok.json
@@ -29,7 +29,8 @@
       "user_state": {
         "played": false,
         "is_favorite": false,
-        "in_watchlist": true
+        "in_watchlist": true,
+        "not_interested": false
       }
     }
   ]
diff --git a/contracts/api/v2/fixtures/get_settings_contract_capabilities_ok.json b/contracts/api/v2/fixtures/get_settings_contract_capabilities_ok.json
index 70691fde45..707cd8b0f1 100644
--- a/contracts/api/v2/fixtures/get_settings_contract_capabilities_ok.json
+++ b/contracts/api/v2/fixtures/get_settings_contract_capabilities_ok.json
@@ -1,5 +1,5 @@
 {
-  "revision": "36e767e32d6613323df470594b9c91068ed062132912c3af462965668b2d31a4",
+  "revision": "221d308c596c46d40c4dfa9f5bdc0777e4cb0fb54c0c49685059d709f9eb56ae",
   "state": "available",
   "allowed": true,
   "api_version": 1,
@@ -16,5 +16,6 @@
   ],
   "supports_batched_effective": true,
   "supports_idempotent_writes": true,
-  "supports_atomic_shortcuts": true
+  "supports_atomic_shortcuts": true,
+  "supports_device_rename": true
 }
diff --git a/contracts/api/v2/fixtures/get_watch_state_ok.json b/contracts/api/v2/fixtures/get_watch_state_ok.json
index e29539f8a4..f949a81639 100644
--- a/contracts/api/v2/fixtures/get_watch_state_ok.json
+++ b/contracts/api/v2/fixtures/get_watch_state_ok.json
@@ -95,5 +95,9 @@
     "played": false,
     "last_file_id": "3"
   },
-  "effective_subtitle_language": "eng"
+  "effective_subtitle_language": "eng",
+  "poster_url": "/api/images/poster/heat.jpg?size=medium",
+  "poster_thumbhash": "poster-hash",
+  "backdrop_url": "/api/images/backdrop/heat.jpg?size=medium",
+  "backdrop_thumbhash": "backdrop-hash"
 }
diff --git a/contracts/api/v2/fixtures/get_watch_tonight_ok.json b/contracts/api/v2/fixtures/get_watch_tonight_ok.json
index 50510ffcd5..e873617e9b 100644
--- a/contracts/api/v2/fixtures/get_watch_tonight_ok.json
+++ b/contracts/api/v2/fixtures/get_watch_tonight_ok.json
@@ -25,7 +25,8 @@
       "user_state": {
         "played": false,
         "is_favorite": false,
-        "in_watchlist": true
+        "in_watchlist": true,
+        "not_interested": false
       },
       "watch_tonight_source": "next_up"
     }
diff --git a/contracts/api/v2/fixtures/get_watch_trickplay_not_found.json b/contracts/api/v2/fixtures/get_watch_trickplay_not_found.json
index 2f3613f07a..382e89bb61 100644
--- a/contracts/api/v2/fixtures/get_watch_trickplay_not_found.json
+++ b/contracts/api/v2/fixtures/get_watch_trickplay_not_found.json
@@ -3,5 +3,5 @@
   "title": "Not found",
   "status": 404,
   "detail": "The item has no such file.",
-  "instance": "urn:silo:request:0000000000000000000002ae"
+  "instance": "urn:silo:request:0000000000000000000002af"
 }
diff --git a/contracts/api/v2/fixtures/ignore_unmatched_item_not_found.json b/contracts/api/v2/fixtures/ignore_unmatched_item_not_found.json
new file mode 100644
index 0000000000..a1635f590e
--- /dev/null
+++ b/contracts/api/v2/fixtures/ignore_unmatched_item_not_found.json
@@ -0,0 +1,7 @@
+{
+  "type": "https://siloserver.org/docs/api/v2/problems/not_found",
+  "title": "Not found",
+  "status": 404,
+  "detail": "Item not found",
+  "instance": "urn:silo:request:000000000000000000000302"
+}
diff --git a/contracts/api/v2/fixtures/index.json b/contracts/api/v2/fixtures/index.json
index 89ed6a2aef..8315216b12 100644
--- a/contracts/api/v2/fixtures/index.json
+++ b/contracts/api/v2/fixtures/index.json
@@ -867,6 +867,27 @@
       "schema": "#/components/schemas/AdminNotificationPushTestResult",
       "body_file": "admin_apple_push_test.json"
     },
+    {
+      "name": "admin_apple_push_test_notification",
+      "operation_id": "testAdminApplePushNotification",
+      "scenario": "The test push carries the profile's newest notification and names it, so the device shows that notification's real text.",
+      "request": {
+        "method": "POST",
+        "path": "/api/v2/admin/notifications/push/apple/test",
+        "headers": {
+          "Authorization": "Bearer tok-admin"
+        },
+        "body": "{\"profile_id\":\"notified-profile\",\"server_device_id\":\"target-device\"}"
+      },
+      "expected_status": 200,
+      "response_headers": {
+        "Cache-Control": "no-store",
+        "Content-Type": "application/json"
+      },
+      "response_media_type": "application/json",
+      "schema": "#/components/schemas/AdminNotificationPushTestResult",
+      "body_file": "admin_apple_push_test_notification.json"
+    },
     {
       "name": "admin_catalog_export_link",
       "operation_id": "publishCatalogExportJob",
@@ -3219,6 +3240,25 @@
       "schema": "#/components/schemas/AdminRecommendationStarted",
       "body_file": "admin_recommendations_embeddings.json"
     },
+    {
+      "name": "admin_recommendations_embeddings_reset",
+      "operation_id": "resetAdminRecommendationEmbeddings",
+      "scenario": "A reset reports what it deleted; global rows are kept.",
+      "request": {
+        "method": "POST",
+        "path": "/api/v2/admin/recommendations/embeddings/reset",
+        "headers": {
+          "Authorization": "Bearer tok-admin"
+        }
+      },
+      "expected_status": 200,
+      "response_headers": {
+        "Content-Type": "application/json"
+      },
+      "response_media_type": "application/json",
+      "schema": "#/components/schemas/AdminRecommendationEmbeddingsReset",
+      "body_file": "admin_recommendations_embeddings_reset.json"
+    },
     {
       "name": "admin_recommendations_recommendations",
       "operation_id": "triggerAdminRecommendationRefresh",
@@ -3241,7 +3281,7 @@
     {
       "name": "admin_recommendations_status",
       "operation_id": "getAdminRecommendationsStatus",
-      "scenario": "Persisted counts and process-local running flags have distinct meanings.",
+      "scenario": "Persisted counts, last runs from any server and process-local running flags have distinct meanings.",
       "request": {
         "method": "GET",
         "path": "/api/v2/admin/recommendations/status",
@@ -3873,10 +3913,34 @@
       "schema": "#/components/schemas/AdminUserPolicyDefaults",
       "body_file": "admin_user_policy_defaults.json"
     },
+    {
+      "name": "android_push_registration_ok",
+      "operation_id": "registerPushDevice",
+      "scenario": "An Android installation registers for private push; the receipt names the server so the app can route that server's pushes by server and profile.",
+      "request": {
+        "method": "POST",
+        "path": "/api/v2/notifications/push/devices",
+        "headers": {
+          "Authorization": "Bearer tok-events",
+          "X-Profile-Id": "p-owner",
+          "X-Push-Generation": "3",
+          "X-Push-Installation-Key": "a2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2s"
+        },
+        "body": "{\"device_id\":\"install\",\"platform\":\"android\",\"token\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"push_mode\":\"private_push\"}"
+      },
+      "expected_status": 200,
+      "response_headers": {
+        "Cache-Control": "no-store",
+        "Content-Type": "application/json"
+      },
+      "response_media_type": "application/json",
+      "schema": "#/components/schemas/AndroidPushRegistrationReceipt",
+      "body_file": "android_push_registration_ok.json"
+    },
     {
       "name": "apple_push_registration_capability",
       "operation_id": "getApplePushRegistrationCapabilities",
-      "scenario": "Local ordered Apple registration is unavailable when the service is absent; this does not describe provider delivery.",
+      "scenario": "Local ordered Apple registration and current-login validation are configured; this does not describe provider delivery.",
       "request": {
         "method": "GET",
         "path": "/api/v2/devices/push/apple/capabilities",
@@ -3894,6 +3958,30 @@
       "schema": "#/components/schemas/ApplePushRegistrationCapability",
       "body_file": "apple_push_registration_capability.json"
     },
+    {
+      "name": "apple_push_registration_ok",
+      "operation_id": "registerApplePushDevice",
+      "scenario": "An iPhone registers for private push and receives a display credential; the receipt names the server so the app can key that credential by server and profile.",
+      "request": {
+        "method": "POST",
+        "path": "/api/v2/devices/push/apple",
+        "headers": {
+          "Authorization": "Bearer tok-events",
+          "X-Profile-Id": "p-owner",
+          "X-Push-Generation": "3",
+          "X-Push-Installation-Key": "a2tra2tra2tra2tra2tra2tra2tra2tra2tra2tra2s"
+        },
+        "body": "{\"device_id\":\"install\",\"apns_token\":\"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\"apns_environment\":\"production\",\"apns_topic\":\"org.prairieserver.prairie\",\"push_mode\":\"private_push\"}"
+      },
+      "expected_status": 200,
+      "response_headers": {
+        "Cache-Control": "no-store",
+        "Content-Type": "application/json"
+      },
+      "response_media_type": "application/json",
+      "schema": "#/components/schemas/ApplePushRegistrationReceipt",
+      "body_file": "apple_push_registration_ok.json"
+    },
     {
       "name": "approve_device_handoff_ok",
       "operation_id": "approveDeviceHandoff",
@@ -4383,6 +4471,68 @@
       "schema": "#/components/schemas/FileMarkers",
       "body_file": "clear_file_marker_segment_ok.json"
     },
+    {
+      "name": "clear_resume_position_not_found",
+      "operation_id": "clearResumePosition",
+      "scenario": "An item outside the viewer's catalog has no resume position to clear.",
+      "request": {
+        "method": "DELETE",
+        "path": "/api/v2/progress/movie:missing/position",
+        "headers": {
+          "Authorization": "Bearer tok-member",
+          "X-Profile-Id": "p-owner"
+        }
+      },
+      "expected_status": 404,
+      "response_headers": {
+        "Cache-Control": "no-store",
+        "Content-Type": "application/problem+json"
+      },
+      "response_media_type": "application/problem+json",
+      "schema": "#/components/schemas/Problem",
+      "body_file": "clear_resume_position_not_found.json"
+    },
+    {
+      "name": "clear_resume_position_not_leaf",
+      "operation_id": "clearResumePosition",
+      "scenario": "A season or series has no single resume position: a validation failure naming the path parameter.",
+      "request": {
+        "method": "DELETE",
+        "path": "/api/v2/progress/series:heat/position",
+        "headers": {
+          "Authorization": "Bearer tok-member",
+          "X-Profile-Id": "p-owner"
+        }
+      },
+      "expected_status": 422,
+      "response_headers": {
+        "Cache-Control": "no-store",
+        "Content-Type": "application/problem+json"
+      },
+      "response_media_type": "application/problem+json",
+      "schema": "#/components/schemas/Problem",
+      "body_file": "clear_resume_position_not_leaf.json"
+    },
+    {
+      "name": "clear_resume_position_ok",
+      "operation_id": "clearResumePosition",
+      "scenario": "Clearing a movie's resume position: 204 with no body; its watched state and history stay.",
+      "request": {
+        "method": "DELETE",
+        "path": "/api/v2/progress/movie:heat-1995/position",
+        "headers": {
+          "Authorization": "Bearer tok-member",
+          "X-Profile-Id": "p-owner"
+        }
+      },
+      "expected_status": 204,
+      "response_headers": {
+        "Cache-Control": "no-store"
+      },
+      "response_media_type": null,
+      "schema": null,
+      "body_file": null
+    },
     {
       "name": "collection_group_unsupported",
       "operation_id": "updateCollectionGroup",
@@ -7617,6 +7767,70 @@
       "schema": "#/components/schemas/MetadataMatchQueueDetail",
       "body_file": "get_metadata_match_queue_ok.json"
     },
+    {
+      "name": "get_not_interested_capability_ok",
+      "operation_id": "getNotInterestedCapability",
+      "scenario": "Profiles on this server can mark movies and series Not interested.",
+      "request": {
+        "method": "GET",
+        "path": "/api/v2/capabilities/not-interested",
+        "headers": {
+          "Authorization": "Bearer tok-member",
+          "X-Profile-Id": "p-owner"
+        }
+      },
+      "expected_status": 200,
+      "response_headers": {
+        "Cache-Control": "private, no-cache",
+        "Content-Type": "application/json",
+        "ETag": "\"996fd28cc2dbccbf14bdf4956a1a604fa0d47ccabb65c1d747db33b60edf0d41\""
+      },
+      "response_media_type": "application/json",
+      "schema": "#/components/schemas/NotInterestedCapability",
+      "body_file": "get_not_interested_capability_ok.json"
+    },
+    {
+      "name": "get_not_interested_not_found",
+      "operation_id": "getNotInterested",
+      "scenario": "The profile has not marked the title.",
+      "request": {
+        "method": "GET",
+        "path": "/api/v2/not-interested/movie:nope",
+        "headers": {
+          "Authorization": "Bearer tok-member",
+          "X-Profile-Id": "p-owner"
+        }
+      },
+      "expected_status": 404,
+      "response_headers": {
+        "Cache-Control": "no-store",
+        "Content-Type": "application/problem+json"
+      },
+      "response_media_type": "application/problem+json",
+      "schema": "#/components/schemas/Problem",
+      "body_file": "get_not_interested_not_found.json"
+    },
+    {
+      "name": "get_not_interested_ok",
+      "operation_id": "getNotInterested",
+      "scenario": "The profile marked the title Not interested: the mark with when it was made.",
+      "request": {
+        "method": "GET",
+        "path": "/api/v2/not-interested/movie:c",
+        "headers": {
+          "Authorization": "Bearer tok-member",
+          "X-Profile-Id": "p-owner"
+        }
+      },
+      "expected_status": 200,
+      "response_headers": {
+        "Cache-Control": "no-store",
+        "Content-Type": "application/json"
+      },
+      "response_media_type": "application/json",
+      "schema": "#/components/schemas/NotInterestedEntry",
+      "body_file": "get_not_interested_ok.json"
+    },
     {
       "name": "get_oauth_handshake_capabilities_ok",
       "operation_id": "getOAuthHandshakeCapabilities",
@@ -7829,6 +8043,28 @@
       "schema": "#/components/schemas/ProfileSectionSettingCollection",
       "body_file": "get_profile_section_settings_ok.json"
     },
+    {
+      "name": "get_progress_capabilities_ok",
+      "operation_id": "getProgressCapabilities",
+      "scenario": "The progress capability document: clearResumePosition is served.",
+      "request": {
+        "method": "GET",
+        "path": "/api/v2/progress/capabilities",
+        "headers": {
+          "Authorization": "Bearer tok-member",
+          "X-Profile-Id": "p-owner"
+        }
+      },
+      "expected_status": 200,
+      "response_headers": {
+        "Cache-Control": "private, no-cache",
+        "Content-Type": "application/json",
+        "ETag": "\"2ff6c702f87c15b4122063ead741b7271dbbbc461a5a54a97379df4b16633a18\""
+      },
+      "response_media_type": "application/json",
+      "schema": "#/components/schemas/ProgressCapabilities",
+      "body_file": "get_progress_capabilities_ok.json"
+    },
     {
       "name": "get_provider_logout_api_key_empty",
       "operation_id": "getProviderLogout",
@@ -8679,6 +8915,45 @@
       "schema": null,
       "body_file": null
     },
+    {
+      "name": "ignore_unmatched_item_not_found",
+      "operation_id": "ignoreUnmatchedItem",
+      "scenario": "Ignoring an item the catalog does not hold.",
+      "request": {
+        "method": "PUT",
+        "path": "/api/v2/libraries/unmatched-items/movie:missing/ignore",
+        "headers": {
+          "Authorization": "Bearer tok-admin"
+        }
+      },
+      "expected_status": 404,
+      "response_headers": {
+        "Cache-Control": "no-store",
+        "Content-Type": "application/problem+json"
+      },
+      "response_media_type": "application/problem+json",
+      "schema": "#/components/schemas/Problem",
+      "body_file": "ignore_unmatched_item_not_found.json"
+    },
+    {
+      "name": "ignore_unmatched_item_ok",
+      "operation_id": "ignoreUnmatchedItem",
+      "scenario": "An admin marks an item as intentionally unmatched; ignoring an ignored item again is a no-op. Success answers 204 with no body.",
+      "request": {
+        "method": "PUT",
+        "path": "/api/v2/libraries/unmatched-items/movie:d/ignore",
+        "headers": {
+          "Authorization": "Bearer tok-admin"
+        }
+      },
+      "expected_status": 204,
+      "response_headers": {
+        "Cache-Control": "no-store"
+      },
+      "response_media_type": null,
+      "schema": null,
+      "body_file": null
+    },
     {
       "name": "invitation_accepted",
       "operation_id": "acceptInvitation",
@@ -9848,6 +10123,26 @@
       "schema": "#/components/schemas/Problem",
       "body_file": "list_household_sessions_verification_required.json"
     },
+    {
+      "name": "list_ignored_unmatched_items_ok",
+      "operation_id": "listUnmatchedItems",
+      "scenario": "The items an admin marked as intentionally unmatched, each with when it was ignored.",
+      "request": {
+        "method": "GET",
+        "path": "/api/v2/libraries/unmatched-items?ignored=true",
+        "headers": {
+          "Authorization": "Bearer tok-admin"
+        }
+      },
+      "expected_status": 200,
+      "response_headers": {
+        "Cache-Control": "no-store",
+        "Content-Type": "application/json"
+      },
+      "response_media_type": "application/json",
+      "schema": "#/components/schemas/UnmatchedItemCollection",
+      "body_file": "list_ignored_unmatched_items_ok.json"
+    },
     {
       "name": "list_libraries_ok",
       "operation_id": "listLibraries",
@@ -10091,6 +10386,27 @@
       "schema": "#/components/schemas/MediaRequestCollection",
       "body_file": "list_my_requests_ok.json"
     },
+    {
+      "name": "list_not_interested_ok",
+      "operation_id": "listNotInterested",
+      "scenario": "The first page of the titles a profile marked Not interested as catalog cards, newest mark first, with an opaque cursor for the next page.",
+      "request": {
+        "method": "GET",
+        "path": "/api/v2/not-interested?limit=1",
+        "headers": {
+          "Authorization": "Bearer tok-member",
+          "X-Profile-Id": "p-owner"
+        }
+      },
+      "expected_status": 200,
+      "response_headers": {
+        "Cache-Control": "no-store",
+        "Content-Type": "application/json"
+      },
+      "response_media_type": "application/json",
+      "schema": "#/components/schemas/NotInterestedCollection",
+      "body_file": "list_not_interested_ok.json"
+    },
     {
       "name": "list_people_limit_out_of_range",
       "operation_id": "listPeople",
@@ -10559,6 +10875,27 @@
       "schema": "#/components/schemas/EpisodeCollection",
       "body_file": "list_season_episodes_ok.json"
     },
+    {
+      "name": "list_seasonal_themes_ok",
+      "operation_id": "listSeasonalThemes",
+      "scenario": "The holidays a Seasonal Picks row can follow in calendar order, each with its curated vibes; a holiday that moves or recurs weekly has no start and end, and a weekly one cannot take a row's own dates.",
+      "request": {
+        "method": "GET",
+        "path": "/api/v2/sections/seasonal-themes",
+        "headers": {
+          "Authorization": "Bearer tok-member",
+          "X-Profile-Id": "p-owner"
+        }
+      },
+      "expected_status": 200,
+      "response_headers": {
+        "Cache-Control": "no-store",
+        "Content-Type": "application/json"
+      },
+      "response_media_type": "application/json",
+      "schema": "#/components/schemas/SeasonalThemeCatalog",
+      "body_file": "list_seasonal_themes_ok.json"
+    },
     {
       "name": "list_section_recipe_candidates_account_scoped",
       "operation_id": "listSectionRecipeCandidates",
@@ -11380,6 +11717,48 @@
       "schema": "#/components/schemas/Problem",
       "body_file": "logout_permission_denied.json"
     },
+    {
+      "name": "mark_not_interested_episode_rejected",
+      "operation_id": "markNotInterested",
+      "scenario": "An episode cannot be marked; the series can.",
+      "request": {
+        "method": "PUT",
+        "path": "/api/v2/not-interested/episode:x",
+        "headers": {
+          "Authorization": "Bearer tok-member",
+          "X-Profile-Id": "p-owner"
+        }
+      },
+      "expected_status": 422,
+      "response_headers": {
+        "Cache-Control": "no-store",
+        "Content-Type": "application/problem+json"
+      },
+      "response_media_type": "application/problem+json",
+      "schema": "#/components/schemas/Problem",
+      "body_file": "mark_not_interested_episode_rejected.json"
+    },
+    {
+      "name": "mark_not_interested_not_found",
+      "operation_id": "markNotInterested",
+      "scenario": "A title the viewer may not see cannot be marked.",
+      "request": {
+        "method": "PUT",
+        "path": "/api/v2/not-interested/movie:hidden",
+        "headers": {
+          "Authorization": "Bearer tok-member",
+          "X-Profile-Id": "p-owner"
+        }
+      },
+      "expected_status": 404,
+      "response_headers": {
+        "Cache-Control": "no-store",
+        "Content-Type": "application/problem+json"
+      },
+      "response_media_type": "application/problem+json",
+      "schema": "#/components/schemas/Problem",
+      "body_file": "mark_not_interested_not_found.json"
+    },
     {
       "name": "mark_watched_not_found",
       "operation_id": "markWatched",
@@ -11729,6 +12108,27 @@
       "schema": "#/components/schemas/NotificationCountOutputBody",
       "body_file": "notification_get_notification_unread_count.json"
     },
+    {
+      "name": "notification_list_notification_series",
+      "operation_id": "listNotificationSeries",
+      "scenario": "Series that can notify the acting profile, with one the viewer may not see omitted.",
+      "request": {
+        "method": "GET",
+        "path": "/api/v2/notifications/series",
+        "headers": {
+          "Authorization": "Bearer tok-member",
+          "X-Profile-Id": "p-owner"
+        }
+      },
+      "expected_status": 200,
+      "response_headers": {
+        "Cache-Control": "no-store",
+        "Content-Type": "application/json"
+      },
+      "response_media_type": "application/json",
+      "schema": "#/components/schemas/NotificationSeriesCollection",
+      "body_file": "notification_list_notification_series.json"
+    },
     {
       "name": "notification_list_notifications",
       "operation_id": "listNotifications",
@@ -11791,6 +12191,47 @@
       "schema": null,
       "body_file": null
     },
+    {
+      "name": "notification_mute_notification_series",
+      "operation_id": "muteNotificationSeries",
+      "scenario": "The acting profile mutes one series: no new-episode notification for it on any channel until it unmutes. Repeating the call changes nothing.",
+      "request": {
+        "method": "PUT",
+        "path": "/api/v2/notifications/series/series:bear/mute",
+        "headers": {
+          "Authorization": "Bearer tok-member",
+          "X-Profile-Id": "p-owner"
+        }
+      },
+      "expected_status": 204,
+      "response_headers": {
+        "Cache-Control": "no-store"
+      },
+      "response_media_type": null,
+      "schema": null,
+      "body_file": null
+    },
+    {
+      "name": "notification_mute_notification_series_not_found",
+      "operation_id": "muteNotificationSeries",
+      "scenario": "A series the viewer may not see cannot be muted.",
+      "request": {
+        "method": "PUT",
+        "path": "/api/v2/notifications/series/series:hidden/mute",
+        "headers": {
+          "Authorization": "Bearer tok-member",
+          "X-Profile-Id": "p-owner"
+        }
+      },
+      "expected_status": 404,
+      "response_headers": {
+        "Cache-Control": "no-store",
+        "Content-Type": "application/problem+json"
+      },
+      "response_media_type": "application/problem+json",
+      "schema": "#/components/schemas/Problem",
+      "body_file": "notification_mute_notification_series_not_found.json"
+    },
     {
       "name": "notification_relay_clear",
       "operation_id": "clearAdminNotificationRelay",
@@ -11913,6 +12354,26 @@
       "schema": "#/components/schemas/NotificationSyncOutputBody",
       "body_file": "notification_sync_notifications.json"
     },
+    {
+      "name": "notification_unmute_notification_series",
+      "operation_id": "unmuteNotificationSeries",
+      "scenario": "The acting profile unmutes a series; it notifies again from the next new episode. Unmuting a series that is not muted changes nothing.",
+      "request": {
+        "method": "DELETE",
+        "path": "/api/v2/notifications/series/series:wire/mute",
+        "headers": {
+          "Authorization": "Bearer tok-member",
+          "X-Profile-Id": "p-owner"
+        }
+      },
+      "expected_status": 204,
+      "response_headers": {
+        "Cache-Control": "no-store"
+      },
+      "response_media_type": null,
+      "schema": null,
+      "body_file": null
+    },
     {
       "name": "notification_update_notification_preferences",
       "operation_id": "updateNotificationPreferences",
@@ -13451,7 +13912,7 @@
     {
       "name": "server_connections_ok",
       "operation_id": "getServerConnections",
-      "scenario": "A signed-in client reads the addresses the deployment offers: the public URL, a connected provider with its overlay origin, and an installed provider whose plugin is not running.",
+      "scenario": "A signed-in client reads the addresses the deployment offers: the public URL, a connected provider with its overlay origin, and an installed provider whose plugin is not running, and the local route: the pin of the key the API listener presents over TLS and the admin-set local address.",
       "request": {
         "method": "GET",
         "path": "/api/v2/system/connections",
@@ -13463,7 +13924,7 @@
       "response_headers": {
         "Cache-Control": "private, no-cache",
         "Content-Type": "application/json",
-        "ETag": "\"251d40c6578ba4f568f974b66faed17c5fd6ea82251fdc08ebc30e12c2be477f\""
+        "ETag": "\"477940d56c15a378ad29473fb403139b11e5e9d18bbbaf9a50c9a060b9843095\""
       },
       "response_media_type": "application/json",
       "schema": "#/components/schemas/ServerConnectionsDocument",
@@ -14408,6 +14869,25 @@
       "schema": "#/components/schemas/Problem",
       "body_file": "undismiss_home_item_unknown_surface.json"
     },
+    {
+      "name": "unignore_unmatched_item_ok",
+      "operation_id": "unignoreUnmatchedItem",
+      "scenario": "Clearing the mark of an item that is not ignored leaves it as is. Success answers 204 with no body.",
+      "request": {
+        "method": "DELETE",
+        "path": "/api/v2/libraries/unmatched-items/movie:b/ignore",
+        "headers": {
+          "Authorization": "Bearer tok-admin"
+        }
+      },
+      "expected_status": 204,
+      "response_headers": {
+        "Cache-Control": "no-store"
+      },
+      "response_media_type": null,
+      "schema": null,
+      "body_file": null
+    },
     {
       "name": "unknown_query_parameter",
       "operation_id": "getSystemInfo",
@@ -14425,6 +14905,27 @@
       "schema": "#/components/schemas/Problem",
       "body_file": "unknown_query_parameter.json"
     },
+    {
+      "name": "unmark_not_interested_locked_profile",
+      "operation_id": "unmarkNotInterested",
+      "scenario": "A PIN-locked profile without X-Profile-Token.",
+      "request": {
+        "method": "DELETE",
+        "path": "/api/v2/not-interested/movie:c",
+        "headers": {
+          "Authorization": "Bearer tok-member",
+          "X-Profile-Id": "p-locked"
+        }
+      },
+      "expected_status": 403,
+      "response_headers": {
+        "Cache-Control": "no-store",
+        "Content-Type": "application/problem+json"
+      },
+      "response_media_type": "application/problem+json",
+      "schema": "#/components/schemas/Problem",
+      "body_file": "unmark_not_interested_locked_profile.json"
+    },
     {
       "name": "unmark_watched_not_found",
       "operation_id": "unmarkWatched",
diff --git a/contracts/api/v2/fixtures/link_account_identity_with_credentials_directory_refused.json b/contracts/api/v2/fixtures/link_account_identity_with_credentials_directory_refused.json
index 49e013b85c..65fb2e4b78 100644
--- a/contracts/api/v2/fixtures/link_account_identity_with_credentials_directory_refused.json
+++ b/contracts/api/v2/fixtures/link_account_identity_with_credentials_directory_refused.json
@@ -3,7 +3,7 @@
   "title": "Validation failed",
   "status": 422,
   "detail": "The request did not pass validation; see errors.",
-  "instance": "urn:silo:request:0000000000000000000002cb",
+  "instance": "urn:silo:request:0000000000000000000002cc",
   "errors": [
     {
       "location": "body.directory_password",
diff --git a/contracts/api/v2/fixtures/list_admin_users_exact_identity.json b/contracts/api/v2/fixtures/list_admin_users_exact_identity.json
index 5b4a7785f3..20d5f3b5b6 100644
--- a/contracts/api/v2/fixtures/list_admin_users_exact_identity.json
+++ b/contracts/api/v2/fixtures/list_admin_users_exact_identity.json
@@ -15,7 +15,7 @@
       "max_local_stream_bitrate_kbps": null,
       "transcode_allowed": null,
       "audio_transcode_allowed": null,
-      "max_profiles": 5,
+      "max_profiles": null,
       "download_allowed": true,
       "download_transcode_allowed": null,
       "requests_allowed": null,
@@ -33,6 +33,7 @@
         "max_transcodes": 0,
         "max_remote_stream_bitrate_kbps": 0,
         "max_local_stream_bitrate_kbps": 0,
+        "max_profiles": 5,
         "transcode_allowed": true,
         "audio_transcode_allowed": false,
         "download_allowed": false,
diff --git a/contracts/api/v2/fixtures/list_admin_users_ok.json b/contracts/api/v2/fixtures/list_admin_users_ok.json
index a6187eadfb..331cf0d81a 100644
--- a/contracts/api/v2/fixtures/list_admin_users_ok.json
+++ b/contracts/api/v2/fixtures/list_admin_users_ok.json
@@ -15,7 +15,7 @@
       "max_local_stream_bitrate_kbps": null,
       "transcode_allowed": null,
       "audio_transcode_allowed": null,
-      "max_profiles": 5,
+      "max_profiles": null,
       "download_allowed": true,
       "download_transcode_allowed": null,
       "requests_allowed": null,
@@ -33,6 +33,7 @@
         "max_transcodes": 0,
         "max_remote_stream_bitrate_kbps": 0,
         "max_local_stream_bitrate_kbps": 0,
+        "max_profiles": 5,
         "transcode_allowed": true,
         "audio_transcode_allowed": false,
         "download_allowed": false,
diff --git a/contracts/api/v2/fixtures/list_because_watched_ok.json b/contracts/api/v2/fixtures/list_because_watched_ok.json
index bcb704df29..0479aa7446 100644
--- a/contracts/api/v2/fixtures/list_because_watched_ok.json
+++ b/contracts/api/v2/fixtures/list_because_watched_ok.json
@@ -25,7 +25,8 @@
       "user_state": {
         "played": false,
         "is_favorite": false,
-        "in_watchlist": true
+        "in_watchlist": true,
+        "not_interested": false
       }
     }
   ]
diff --git a/contracts/api/v2/fixtures/list_catalog_item_episodes_ok.json b/contracts/api/v2/fixtures/list_catalog_item_episodes_ok.json
index 979ae69632..e1aac3a958 100644
--- a/contracts/api/v2/fixtures/list_catalog_item_episodes_ok.json
+++ b/contracts/api/v2/fixtures/list_catalog_item_episodes_ok.json
@@ -7,6 +7,20 @@
       "title": "Good News About Hell",
       "air_date": "2022-02-18",
       "runtime": 57,
+      "ratings": [
+        {
+          "source": "imdb",
+          "name": "IMDb",
+          "score": 87,
+          "display": "8.7"
+        },
+        {
+          "source": "tmdb",
+          "name": "TMDB",
+          "score": 82.5,
+          "display": "8.3"
+        }
+      ],
       "user_data": {
         "watched_count": 1,
         "unplayed_count": 0,
diff --git a/contracts/api/v2/fixtures/list_devices_ok.json b/contracts/api/v2/fixtures/list_devices_ok.json
index 4e25f18694..165268f1f7 100644
--- a/contracts/api/v2/fixtures/list_devices_ok.json
+++ b/contracts/api/v2/fixtures/list_devices_ok.json
@@ -2,7 +2,8 @@
   "items": [
     {
       "device_id": "d-1",
-      "device_name": "",
+      "device_name": "Apple TV",
+      "custom_name": "Living Room",
       "device_platform": "",
       "last_seen_at": "2026-01-02T03:04:05.123Z",
       "profile_id": "p-owner",
diff --git a/contracts/api/v2/fixtures/list_for_you_rows_ok.json b/contracts/api/v2/fixtures/list_for_you_rows_ok.json
index 7d6906e3e8..83f886634e 100644
--- a/contracts/api/v2/fixtures/list_for_you_rows_ok.json
+++ b/contracts/api/v2/fixtures/list_for_you_rows_ok.json
@@ -31,7 +31,8 @@
           "user_state": {
             "played": false,
             "is_favorite": false,
-            "in_watchlist": true
+            "in_watchlist": true,
+            "not_interested": false
           }
         }
       ]
diff --git a/contracts/api/v2/fixtures/list_home_sections_ok.json b/contracts/api/v2/fixtures/list_home_sections_ok.json
index 7de0b9cdcc..7ea40e39e9 100644
--- a/contracts/api/v2/fixtures/list_home_sections_ok.json
+++ b/contracts/api/v2/fixtures/list_home_sections_ok.json
@@ -35,7 +35,8 @@
           "user_state": {
             "played": false,
             "is_favorite": false,
-            "in_watchlist": true
+            "in_watchlist": true,
+            "not_interested": false
           }
         }
       ]
diff --git a/contracts/api/v2/fixtures/list_ignored_unmatched_items_ok.json b/contracts/api/v2/fixtures/list_ignored_unmatched_items_ok.json
new file mode 100644
index 0000000000..f8d926f9c3
--- /dev/null
+++ b/contracts/api/v2/fixtures/list_ignored_unmatched_items_ok.json
@@ -0,0 +1,18 @@
+{
+  "items": [
+    {
+      "content_id": "movie:d",
+      "title": "Delta",
+      "year": 2004,
+      "content_type": "movie",
+      "library_id": "1",
+      "library_name": "Movies",
+      "status": "unmatched",
+      "ignored_at": "2026-01-02T03:04:05.678Z"
+    }
+  ],
+  "page": {
+    "has_more": false
+  },
+  "total": 1
+}
diff --git a/contracts/api/v2/fixtures/list_library_sections_ok.json b/contracts/api/v2/fixtures/list_library_sections_ok.json
index 7de0b9cdcc..7ea40e39e9 100644
--- a/contracts/api/v2/fixtures/list_library_sections_ok.json
+++ b/contracts/api/v2/fixtures/list_library_sections_ok.json
@@ -35,7 +35,8 @@
           "user_state": {
             "played": false,
             "is_favorite": false,
-            "in_watchlist": true
+            "in_watchlist": true,
+            "not_interested": false
           }
         }
       ]
diff --git a/contracts/api/v2/fixtures/list_not_interested_ok.json b/contracts/api/v2/fixtures/list_not_interested_ok.json
new file mode 100644
index 0000000000..479e6fc04b
--- /dev/null
+++ b/contracts/api/v2/fixtures/list_not_interested_ok.json
@@ -0,0 +1,16 @@
+{
+  "items": [
+    {
+      "content_id": "movie:c",
+      "type": "movie",
+      "title": "Title movie:c",
+      "genres": [],
+      "keywords": [],
+      "status": "matched"
+    }
+  ],
+  "page": {
+    "next_cursor": "eyJ2IjoxLCJwIjp7ImEiOiIyMDI2LTAxLTAyVDAzOjA0OjA1WiIsIm0iOiJtb3ZpZTpjIn19.HPnfe2YAgiWJ6PnMl3t2asgqsLYYE4kIyWR17iWodjA",
+    "has_more": true
+  }
+}
diff --git a/contracts/api/v2/fixtures/list_popular_ok.json b/contracts/api/v2/fixtures/list_popular_ok.json
index bcb704df29..0479aa7446 100644
--- a/contracts/api/v2/fixtures/list_popular_ok.json
+++ b/contracts/api/v2/fixtures/list_popular_ok.json
@@ -25,7 +25,8 @@
       "user_state": {
         "played": false,
         "is_favorite": false,
-        "in_watchlist": true
+        "in_watchlist": true,
+        "not_interested": false
       }
     }
   ]
diff --git a/contracts/api/v2/fixtures/list_recently_added_ok.json b/contracts/api/v2/fixtures/list_recently_added_ok.json
index bcb704df29..0479aa7446 100644
--- a/contracts/api/v2/fixtures/list_recently_added_ok.json
+++ b/contracts/api/v2/fixtures/list_recently_added_ok.json
@@ -25,7 +25,8 @@
       "user_state": {
         "played": false,
         "is_favorite": false,
-        "in_watchlist": true
+        "in_watchlist": true,
+        "not_interested": false
       }
     }
   ]
diff --git a/contracts/api/v2/fixtures/list_season_episodes_ok.json b/contracts/api/v2/fixtures/list_season_episodes_ok.json
index 979ae69632..e1aac3a958 100644
--- a/contracts/api/v2/fixtures/list_season_episodes_ok.json
+++ b/contracts/api/v2/fixtures/list_season_episodes_ok.json
@@ -7,6 +7,20 @@
       "title": "Good News About Hell",
       "air_date": "2022-02-18",
       "runtime": 57,
+      "ratings": [
+        {
+          "source": "imdb",
+          "name": "IMDb",
+          "score": 87,
+          "display": "8.7"
+        },
+        {
+          "source": "tmdb",
+          "name": "TMDB",
+          "score": 82.5,
+          "display": "8.3"
+        }
+      ],
       "user_data": {
         "watched_count": 1,
         "unplayed_count": 0,
diff --git a/contracts/api/v2/fixtures/list_seasonal_themes_ok.json b/contracts/api/v2/fixtures/list_seasonal_themes_ok.json
new file mode 100644
index 0000000000..efafaab587
--- /dev/null
+++ b/contracts/api/v2/fixtures/list_seasonal_themes_ok.json
@@ -0,0 +1,316 @@
+{
+  "themes": [
+    {
+      "key": "valentines",
+      "name": "Valentine's Day",
+      "when": "Feb 7–14",
+      "start": "02-07",
+      "end": "02-14",
+      "dates_editable": true,
+      "vibes": [
+        {
+          "key": "romcoms",
+          "name": "Rom-coms",
+          "title": "Valentine's Rom-Coms",
+          "description": "The best-reviewed romantic comedies.",
+          "list_url": "https://lists.example.test/lists/hdlists/romantic-comedies-rotten-tomatoes-top-rated"
+        },
+        {
+          "key": "favorites",
+          "name": "Valentine's favorites",
+          "title": "Valentine's Favorites",
+          "description": "Popular date-night picks.",
+          "list_url": "https://lists.example.test/lists/linvo/valentines-day-popular-movies"
+        },
+        {
+          "key": "romantic_dramas",
+          "name": "Romantic dramas",
+          "title": "Romantic Dramas",
+          "description": "Sweeping love stories with a few tears.",
+          "list_url": "https://lists.example.test/lists/themtsil/romantic-dramas"
+        },
+        {
+          "key": "love_stories",
+          "name": "Classic love stories",
+          "title": "Classic Love Stories",
+          "description": "Casablanca, Titanic and the other all-time romances.",
+          "list_url": "https://lists.example.test/lists/tob-t/love-story"
+        }
+      ]
+    },
+    {
+      "key": "st_patricks",
+      "name": "St. Patrick's Day",
+      "when": "Mar 15–17",
+      "start": "03-15",
+      "end": "03-17",
+      "dates_editable": true,
+      "vibes": [
+        {
+          "key": "irish_film",
+          "name": "Irish film",
+          "title": "Irish Film",
+          "description": "Films from and about Ireland.",
+          "list_url": "https://lists.example.test/lists/irljidel/irish-interest-movies"
+        },
+        {
+          "key": "irish_tv",
+          "name": "Irish TV",
+          "title": "Irish TV",
+          "description": "Series from and about Ireland.",
+          "list_url": "https://lists.example.test/lists/irljidel/irish-interest-tv-shows"
+        }
+      ]
+    },
+    {
+      "key": "easter",
+      "name": "Easter",
+      "when": "Palm Sunday to Easter Monday",
+      "dates_editable": true,
+      "vibes": [
+        {
+          "key": "family",
+          "name": "Easter movies",
+          "title": "Easter Movies",
+          "description": "Springtime family favorites and Easter classics.",
+          "list_url": "https://lists.example.test/lists/bsm-venger/easter-movies-e78nzwjk7k"
+        },
+        {
+          "key": "faith",
+          "name": "Faith and Easter stories",
+          "title": "Easter Stories",
+          "description": "Biblical epics and stories of faith.",
+          "list_url": "https://lists.example.test/lists/bluejack92/easter-by-antares"
+        }
+      ]
+    },
+    {
+      "key": "summer_blockbuster",
+      "name": "Summer",
+      "when": "June to August",
+      "start": "06-01",
+      "end": "08-31",
+      "dates_editable": true,
+      "vibes": [
+        {
+          "key": "blockbusters",
+          "name": "Blockbusters",
+          "title": "Summer Blockbusters",
+          "description": "The biggest box-office hits.",
+          "list_url": "https://lists.example.test/lists/drovur/box-office-giants"
+        },
+        {
+          "key": "classic_summer",
+          "name": "Classic summer movies",
+          "title": "Classic Summer Movies",
+          "description": "Summer releases that defined the season, from Jaws to Independence Day.",
+          "list_url": "https://lists.example.test/lists/heavymgs/summer-movies"
+        },
+        {
+          "key": "nostalgia",
+          "name": "Summer nostalgia",
+          "title": "Summer Nostalgia",
+          "description": "Long days, summer camp and coming of age.",
+          "list_url": "https://lists.example.test/lists/reachingout/summer-movies"
+        }
+      ]
+    },
+    {
+      "key": "halloween",
+      "name": "Halloween",
+      "when": "October",
+      "start": "10-01",
+      "end": "10-31",
+      "dates_editable": true,
+      "vibes": [
+        {
+          "key": "favorites",
+          "name": "Halloween favorites",
+          "title": "Halloween Favorites",
+          "description": "The best-loved Halloween movies, spooky and scary.",
+          "list_url": "https://lists.example.test/lists/hdlists/halloween-movies-the-best-of-all-time"
+        },
+        {
+          "key": "family",
+          "name": "Family Halloween",
+          "title": "Family Halloween",
+          "description": "Spooky fun for all ages.",
+          "list_url": "https://lists.example.test/lists/purple_smurf/halloween-family2"
+        },
+        {
+          "key": "horror",
+          "name": "Halloween horror",
+          "title": "Halloween Horror",
+          "description": "Slashers, hauntings and horror classics.",
+          "list_url": "https://lists.example.test/lists/swansongfunds/horror-halloween"
+        },
+        {
+          "key": "animated",
+          "name": "Animated Halloween",
+          "title": "Animated Halloween",
+          "description": "Animated spooky favorites.",
+          "list_url": "https://lists.example.test/lists/swansongfunds/halloween-animation"
+        },
+        {
+          "key": "tv",
+          "name": "Halloween TV",
+          "title": "Halloween TV",
+          "description": "Spooky series to binge.",
+          "list_url": "https://lists.example.test/lists/rootednode/halloween-tv"
+        }
+      ]
+    },
+    {
+      "key": "thanksgiving",
+      "name": "Thanksgiving",
+      "when": "Nov 22–30",
+      "start": "11-22",
+      "end": "11-30",
+      "dates_editable": true,
+      "vibes": [
+        {
+          "key": "favorites",
+          "name": "Thanksgiving movies",
+          "title": "Thanksgiving Movies",
+          "description": "Films set around the Thanksgiving table.",
+          "list_url": "https://lists.example.test/lists/bluejack92/thanksgiving-by-antares"
+        },
+        {
+          "key": "feel_good",
+          "name": "Feel-good favorites",
+          "title": "Feel-Good Favorites",
+          "description": "Heartwarming picks for the long weekend.",
+          "list_url": "https://lists.example.test/lists/netthier/thanksgiving-movies"
+        }
+      ]
+    },
+    {
+      "key": "christmas",
+      "name": "Christmas",
+      "when": "December",
+      "start": "12-01",
+      "end": "12-31",
+      "dates_editable": true,
+      "vibes": [
+        {
+          "key": "favorites",
+          "name": "Christmas favorites",
+          "title": "Christmas Favorites",
+          "description": "The most-watched Christmas movies.",
+          "list_url": "https://lists.example.test/lists/jbeasley74/christmas-movies"
+        },
+        {
+          "key": "family",
+          "name": "Family Christmas",
+          "title": "Family Christmas",
+          "description": "Christmas movies for the whole family.",
+          "list_url": "https://lists.example.test/lists/paperarmour/christmas-kids-movies"
+        },
+        {
+          "key": "classics",
+          "name": "Christmas classics",
+          "title": "Christmas Classics",
+          "description": "Golden-age holiday films.",
+          "list_url": "https://lists.example.test/lists/momanch/oldies-christmas-classics"
+        },
+        {
+          "key": "romcoms",
+          "name": "Christmas rom-coms",
+          "title": "Christmas Rom-Coms",
+          "description": "Romantic comedies set at Christmas.",
+          "list_url": "https://lists.example.test/lists/momanch/christmas-romantic-comedies"
+        },
+        {
+          "key": "comedies",
+          "name": "Christmas comedies",
+          "title": "Christmas Comedies",
+          "description": "Holiday laughs.",
+          "list_url": "https://lists.example.test/lists/momanch/christmas-movie-comedies"
+        },
+        {
+          "key": "hallmark",
+          "name": "Hallmark Christmas",
+          "title": "Hallmark Christmas",
+          "description": "Hallmark's original Christmas movies.",
+          "list_url": "https://lists.example.test/lists/vectrexgamer/hallmark-original-christmas-movies"
+        }
+      ]
+    },
+    {
+      "key": "new_year",
+      "name": "New Year's",
+      "when": "Dec 26–Jan 1",
+      "start": "12-26",
+      "end": "01-01",
+      "dates_editable": true,
+      "vibes": [
+        {
+          "key": "favorites",
+          "name": "New Year's movies",
+          "title": "New Year's Movies",
+          "description": "Films that ring in the new year.",
+          "list_url": "https://lists.example.test/lists/netthier/new-year-movies"
+        }
+      ]
+    },
+    {
+      "key": "saturday_morning",
+      "name": "Saturday Morning",
+      "when": "Saturdays before 1pm",
+      "dates_editable": false,
+      "vibes": [
+        {
+          "key": "cartoons",
+          "name": "Saturday morning cartoons",
+          "title": "Saturday Morning Cartoons",
+          "description": "Classic weekend cartoons.",
+          "list_url": "https://lists.example.test/lists/arnx1922/saturday-morning-cartoons-b75bnxjjej"
+        },
+        {
+          "key": "nineties",
+          "name": "90s cartoons",
+          "title": "90s Saturday Mornings",
+          "description": "The cartoons of the 1990s.",
+          "list_url": "https://lists.example.test/lists/smackdaddy17/saturday-morning-cartoons"
+        },
+        {
+          "key": "modern",
+          "name": "Modern cartoons",
+          "title": "Saturday Morning Favorites",
+          "description": "Animated series from Batman to Gravity Falls.",
+          "list_url": "https://lists.example.test/lists/savini-andrew-gmail-com/saturday-morning-all-time"
+        }
+      ]
+    },
+    {
+      "key": "family_movie_night",
+      "name": "Family Movie Night",
+      "when": "Friday and Saturday evenings",
+      "dates_editable": false,
+      "vibes": [
+        {
+          "key": "new",
+          "name": "New and popular",
+          "title": "Family Movie Night",
+          "description": "Recent family hits.",
+          "list_url": "https://lists.example.test/lists/josh_bergeron/sunday-night-family-movies"
+        },
+        {
+          "key": "favorites",
+          "name": "Family favorites",
+          "title": "Family Favorites",
+          "description": "Family films from The Goonies to Coco.",
+          "list_url": "https://lists.example.test/lists/jaredmecham/top-family-movies-1980"
+        },
+        {
+          "key": "live_action",
+          "name": "Live-action family",
+          "title": "Family Movie Night",
+          "description": "Family films without the animation.",
+          "list_url": "https://lists.example.test/lists/paperarmour/family-movies-animation-excluded"
+        }
+      ]
+    }
+  ],
+  "max_custom_holidays": 12
+}
diff --git a/contracts/api/v2/fixtures/list_series_seasons_invalid_artwork.json b/contracts/api/v2/fixtures/list_series_seasons_invalid_artwork.json
index 61ef775d01..e109c0f6dd 100644
--- a/contracts/api/v2/fixtures/list_series_seasons_invalid_artwork.json
+++ b/contracts/api/v2/fixtures/list_series_seasons_invalid_artwork.json
@@ -3,7 +3,7 @@
   "title": "Validation failed",
   "status": 422,
   "detail": "The request did not pass validation; see errors.",
-  "instance": "urn:silo:request:000000000000000000000284",
+  "instance": "urn:silo:request:000000000000000000000285",
   "errors": [
     {
       "location": "query.include_artwork",
diff --git a/contracts/api/v2/fixtures/list_similar_ok.json b/contracts/api/v2/fixtures/list_similar_ok.json
index bcb704df29..0479aa7446 100644
--- a/contracts/api/v2/fixtures/list_similar_ok.json
+++ b/contracts/api/v2/fixtures/list_similar_ok.json
@@ -25,7 +25,8 @@
       "user_state": {
         "played": false,
         "is_favorite": false,
-        "in_watchlist": true
+        "in_watchlist": true,
+        "not_interested": false
       }
     }
   ]
diff --git a/contracts/api/v2/fixtures/list_similar_users_liked_ok.json b/contracts/api/v2/fixtures/list_similar_users_liked_ok.json
index bcb704df29..0479aa7446 100644
--- a/contracts/api/v2/fixtures/list_similar_users_liked_ok.json
+++ b/contracts/api/v2/fixtures/list_similar_users_liked_ok.json
@@ -25,7 +25,8 @@
       "user_state": {
         "played": false,
         "is_favorite": false,
-        "in_watchlist": true
+        "in_watchlist": true,
+        "not_interested": false
       }
     }
   ]
diff --git a/contracts/api/v2/fixtures/list_taste_seed_items_ok.json b/contracts/api/v2/fixtures/list_taste_seed_items_ok.json
index bdc7435f00..f4617025c5 100644
--- a/contracts/api/v2/fixtures/list_taste_seed_items_ok.json
+++ b/contracts/api/v2/fixtures/list_taste_seed_items_ok.json
@@ -25,7 +25,8 @@
       "user_state": {
         "played": false,
         "is_favorite": false,
-        "in_watchlist": true
+        "in_watchlist": true,
+        "not_interested": false
       }
     }
   ],
diff --git a/contracts/api/v2/fixtures/list_watch_tonight_cards_ok.json b/contracts/api/v2/fixtures/list_watch_tonight_cards_ok.json
index fde37f9e77..c03b8b4b86 100644
--- a/contracts/api/v2/fixtures/list_watch_tonight_cards_ok.json
+++ b/contracts/api/v2/fixtures/list_watch_tonight_cards_ok.json
@@ -25,7 +25,8 @@
       "user_state": {
         "played": false,
         "is_favorite": false,
-        "in_watchlist": true
+        "in_watchlist": true,
+        "not_interested": false
       },
       "watch_tonight_source": "recommendation",
       "cast": [
diff --git a/contracts/api/v2/fixtures/login_account_required.json b/contracts/api/v2/fixtures/login_account_required.json
index 3c325ae1ee..9c6a1a5ea1 100644
--- a/contracts/api/v2/fixtures/login_account_required.json
+++ b/contracts/api/v2/fixtures/login_account_required.json
@@ -3,5 +3,5 @@
   "title": "Account required",
   "status": 403,
   "detail": "The sign-in provider admitted this person, but the server has no account for them; an administrator has to add one.",
-  "instance": "urn:silo:request:0000000000000000000002cf"
+  "instance": "urn:silo:request:0000000000000000000002d0"
 }
diff --git a/contracts/api/v2/fixtures/login_provider_null.json b/contracts/api/v2/fixtures/login_provider_null.json
index a3c920f2ad..517bc4a5cf 100644
--- a/contracts/api/v2/fixtures/login_provider_null.json
+++ b/contracts/api/v2/fixtures/login_provider_null.json
@@ -3,7 +3,7 @@
   "title": "Validation failed",
   "status": 422,
   "detail": "The request did not pass validation; see errors.",
-  "instance": "urn:silo:request:00000000000000000000028a",
+  "instance": "urn:silo:request:00000000000000000000028b",
   "errors": [
     {
       "location": "body.provider",
diff --git a/contracts/api/v2/fixtures/mark_not_interested_episode_rejected.json b/contracts/api/v2/fixtures/mark_not_interested_episode_rejected.json
new file mode 100644
index 0000000000..53d69606a8
--- /dev/null
+++ b/contracts/api/v2/fixtures/mark_not_interested_episode_rejected.json
@@ -0,0 +1,7 @@
+{
+  "type": "https://siloserver.org/docs/api/v2/problems/validation_failed",
+  "title": "Validation failed",
+  "status": 422,
+  "detail": "Only a movie or series can be marked Not interested",
+  "instance": "urn:silo:request:000000000000000000000307"
+}
diff --git a/contracts/api/v2/fixtures/mark_not_interested_not_found.json b/contracts/api/v2/fixtures/mark_not_interested_not_found.json
new file mode 100644
index 0000000000..9a3cda3123
--- /dev/null
+++ b/contracts/api/v2/fixtures/mark_not_interested_not_found.json
@@ -0,0 +1,7 @@
+{
+  "type": "https://siloserver.org/docs/api/v2/problems/not_found",
+  "title": "Not found",
+  "status": 404,
+  "detail": "Item not found",
+  "instance": "urn:silo:request:000000000000000000000308"
+}
diff --git a/contracts/api/v2/fixtures/notification_get_notification_capabilities.json b/contracts/api/v2/fixtures/notification_get_notification_capabilities.json
index db6c55a66c..1c5e9d7b7f 100644
--- a/contracts/api/v2/fixtures/notification_get_notification_capabilities.json
+++ b/contracts/api/v2/fixtures/notification_get_notification_capabilities.json
@@ -1,5 +1,5 @@
 {
-  "revision": "b1406770e1cc06c7d72140247c907cd0796f12062ab858eda4d37a02de47c1a1",
+  "revision": "302a85c2ba6b66ff6c3326888ce8a646db429680e8060081bd639c7c70101ced",
   "state": "available",
   "allowed": true,
   "in_app": {
@@ -36,5 +36,9 @@
     "available": false,
     "modes": [],
     "digest_hour": 0
+  },
+  "series": {
+    "available": true,
+    "mute": true
   }
 }
diff --git a/contracts/api/v2/fixtures/notification_list_notification_series.json b/contracts/api/v2/fixtures/notification_list_notification_series.json
new file mode 100644
index 0000000000..2c3bdf5c79
--- /dev/null
+++ b/contracts/api/v2/fixtures/notification_list_notification_series.json
@@ -0,0 +1,107 @@
+{
+  "items": [
+    {
+      "item": {
+        "content_id": "series:andor",
+        "type": "series",
+        "title": "Title series:andor",
+        "genres": [],
+        "keywords": [],
+        "status": "matched"
+      },
+      "reasons": {
+        "favorite": false,
+        "watchlist": false,
+        "continue_watching": false,
+        "next_up": true
+      },
+      "active_reasons": {
+        "favorite": false,
+        "watchlist": false,
+        "continue_watching": false,
+        "next_up": true
+      },
+      "notifies": true,
+      "muted": false,
+      "next_up_after": {
+        "season_number": 2,
+        "episode_number": 8
+      }
+    },
+    {
+      "item": {
+        "content_id": "series:bear",
+        "type": "series",
+        "title": "Title series:bear",
+        "genres": [],
+        "keywords": [],
+        "status": "matched"
+      },
+      "reasons": {
+        "favorite": true,
+        "watchlist": false,
+        "continue_watching": true,
+        "next_up": false
+      },
+      "active_reasons": {
+        "favorite": true,
+        "watchlist": false,
+        "continue_watching": true,
+        "next_up": false
+      },
+      "notifies": true,
+      "muted": false
+    },
+    {
+      "item": {
+        "content_id": "series:slow-horses",
+        "type": "series",
+        "title": "Title series:slow-horses",
+        "genres": [],
+        "keywords": [],
+        "status": "matched"
+      },
+      "reasons": {
+        "favorite": false,
+        "watchlist": true,
+        "continue_watching": false,
+        "next_up": false
+      },
+      "active_reasons": {
+        "favorite": false,
+        "watchlist": false,
+        "continue_watching": false,
+        "next_up": false
+      },
+      "notifies": false,
+      "muted": false
+    },
+    {
+      "item": {
+        "content_id": "series:wire",
+        "type": "series",
+        "title": "Title series:wire",
+        "genres": [],
+        "keywords": [],
+        "status": "matched"
+      },
+      "reasons": {
+        "favorite": true,
+        "watchlist": false,
+        "continue_watching": false,
+        "next_up": false
+      },
+      "active_reasons": {
+        "favorite": true,
+        "watchlist": false,
+        "continue_watching": false,
+        "next_up": false
+      },
+      "notifies": false,
+      "muted": true
+    }
+  ],
+  "page": {
+    "has_more": false
+  }
+}
diff --git a/contracts/api/v2/fixtures/notification_mute_notification_series_not_found.json b/contracts/api/v2/fixtures/notification_mute_notification_series_not_found.json
new file mode 100644
index 0000000000..00b31098ca
--- /dev/null
+++ b/contracts/api/v2/fixtures/notification_mute_notification_series_not_found.json
@@ -0,0 +1,7 @@
+{
+  "type": "https://siloserver.org/docs/api/v2/problems/not_found",
+  "title": "Not found",
+  "status": 404,
+  "detail": "Series not found.",
+  "instance": "urn:silo:request:00000000000000000000030d"
+}
diff --git a/contracts/api/v2/fixtures/playback_installation_changed.json b/contracts/api/v2/fixtures/playback_installation_changed.json
index 77cc2ac31f..057dee261a 100644
--- a/contracts/api/v2/fixtures/playback_installation_changed.json
+++ b/contracts/api/v2/fixtures/playback_installation_changed.json
@@ -3,5 +3,5 @@
   "title": "Playback installation changed",
   "status": 409,
   "detail": "Playback installation changed; refresh capabilities",
-  "instance": "urn:silo:request:00000000000000000000027e"
+  "instance": "urn:silo:request:00000000000000000000027f"
 }
diff --git a/contracts/api/v2/fixtures/playback_invalid_protocol.json b/contracts/api/v2/fixtures/playback_invalid_protocol.json
index 5827502baf..48529a40e1 100644
--- a/contracts/api/v2/fixtures/playback_invalid_protocol.json
+++ b/contracts/api/v2/fixtures/playback_invalid_protocol.json
@@ -3,7 +3,7 @@
   "title": "Validation failed",
   "status": 422,
   "detail": "The request did not pass validation; see errors.",
-  "instance": "urn:silo:request:00000000000000000000027f",
+  "instance": "urn:silo:request:000000000000000000000280",
   "errors": [
     {
       "location": "body",
diff --git a/contracts/api/v2/fixtures/playback_progress_conflict.json b/contracts/api/v2/fixtures/playback_progress_conflict.json
index bba69d291f..31180ce894 100644
--- a/contracts/api/v2/fixtures/playback_progress_conflict.json
+++ b/contracts/api/v2/fixtures/playback_progress_conflict.json
@@ -3,5 +3,5 @@
   "title": "Playback progress conflict",
   "status": 409,
   "detail": "The sequence already has different progress",
-  "instance": "urn:silo:request:00000000000000000000027d"
+  "instance": "urn:silo:request:00000000000000000000027e"
 }
diff --git a/contracts/api/v2/fixtures/playback_replan_reanchored.json b/contracts/api/v2/fixtures/playback_replan_reanchored.json
index beea15a658..e3a31b1415 100644
--- a/contracts/api/v2/fixtures/playback_replan_reanchored.json
+++ b/contracts/api/v2/fixtures/playback_replan_reanchored.json
@@ -146,15 +146,7 @@
     "transformations": [],
     "applied_quirks": [],
     "runtime_corrections": [],
-    "available_qualities": [
-      {
-        "label": "original",
-        "display_name": "Original",
-        "height": 1080,
-        "bitrate_kbps": 8000,
-        "preserves_source": true
-      }
-    ],
+    "available_qualities": [],
     "degradation_warnings": [],
     "decision_reason": "validated_original_playback",
     "requested_media_file_id": "42",
diff --git a/contracts/api/v2/fixtures/playback_start_opaque_ids.json b/contracts/api/v2/fixtures/playback_start_opaque_ids.json
index beea15a658..e3a31b1415 100644
--- a/contracts/api/v2/fixtures/playback_start_opaque_ids.json
+++ b/contracts/api/v2/fixtures/playback_start_opaque_ids.json
@@ -146,15 +146,7 @@
     "transformations": [],
     "applied_quirks": [],
     "runtime_corrections": [],
-    "available_qualities": [
-      {
-        "label": "original",
-        "display_name": "Original",
-        "height": 1080,
-        "bitrate_kbps": 8000,
-        "preserves_source": true
-      }
-    ],
+    "available_qualities": [],
     "degradation_warnings": [],
     "decision_reason": "validated_original_playback",
     "requested_media_file_id": "42",
diff --git a/contracts/api/v2/fixtures/refresh_session_provider_unavailable.json b/contracts/api/v2/fixtures/refresh_session_provider_unavailable.json
index d93338a5af..e5a41aec38 100644
--- a/contracts/api/v2/fixtures/refresh_session_provider_unavailable.json
+++ b/contracts/api/v2/fixtures/refresh_session_provider_unavailable.json
@@ -3,5 +3,5 @@
   "title": "Provider unavailable",
   "status": 503,
   "detail": "The sign-in provider could not confirm the account. Try again later; the session stays valid.",
-  "instance": "urn:silo:request:0000000000000000000002c9"
+  "instance": "urn:silo:request:0000000000000000000002ca"
 }
diff --git a/contracts/api/v2/fixtures/regenerate_admin_item_trickplay_disabled.json b/contracts/api/v2/fixtures/regenerate_admin_item_trickplay_disabled.json
index ae3d149d4c..5adccfc74c 100644
--- a/contracts/api/v2/fixtures/regenerate_admin_item_trickplay_disabled.json
+++ b/contracts/api/v2/fixtures/regenerate_admin_item_trickplay_disabled.json
@@ -3,5 +3,5 @@
   "title": "Capability disabled",
   "status": 409,
   "detail": "Seek-bar previews are turned off for this item's library.",
-  "instance": "urn:silo:request:0000000000000000000002b1"
+  "instance": "urn:silo:request:0000000000000000000002b2"
 }
diff --git a/contracts/api/v2/fixtures/server_connections_ok.json b/contracts/api/v2/fixtures/server_connections_ok.json
index dbb21bb184..f09b722140 100644
--- a/contracts/api/v2/fixtures/server_connections_ok.json
+++ b/contracts/api/v2/fixtures/server_connections_ok.json
@@ -1,5 +1,5 @@
 {
-  "revision": "82278f19ff5dc619091bee7b0efe5f375a0b25ec07002a424a5d15efbdc66900",
+  "revision": "70a5e9f04966172f3401c59c9e389d3b05227e84a511077a349f92fb2765be94",
   "state": "available",
   "allowed": true,
   "server_id": "3f2a9d5e-6b1c-4c7e-9a0d-2f4b8c1e7a35",
@@ -24,5 +24,9 @@
       "display_name": "Stub Overlay",
       "state": "connected"
     }
-  ]
+  ],
+  "local_route": {
+    "spki_sha256": "n4bQgYhMfWWaL+qgxVrQFaO/TxsrC4Is0V1sFbDwCgg=",
+    "url": "http://prairie.lan.example.test:8080"
+  }
 }
diff --git a/contracts/api/v2/fixtures/sign_in_with_network_identity_off_overlay.json b/contracts/api/v2/fixtures/sign_in_with_network_identity_off_overlay.json
index a881c30a64..31c160dc98 100644
--- a/contracts/api/v2/fixtures/sign_in_with_network_identity_off_overlay.json
+++ b/contracts/api/v2/fixtures/sign_in_with_network_identity_off_overlay.json
@@ -3,5 +3,5 @@
   "title": "Network identity required",
   "status": 403,
   "detail": "Open this server through the provider's network address to sign in this way",
-  "instance": "urn:silo:request:0000000000000000000002d2"
+  "instance": "urn:silo:request:0000000000000000000002d3"
 }
diff --git a/contracts/api/v2/fixtures/start_account_identity_link_unknown_ticket.json b/contracts/api/v2/fixtures/start_account_identity_link_unknown_ticket.json
index b197300e8d..b2aff8c2a4 100644
--- a/contracts/api/v2/fixtures/start_account_identity_link_unknown_ticket.json
+++ b/contracts/api/v2/fixtures/start_account_identity_link_unknown_ticket.json
@@ -3,5 +3,5 @@
   "title": "Not found",
   "status": 404,
   "detail": "The link ticket is unknown, used or expired.",
-  "instance": "urn:silo:request:0000000000000000000002c5"
+  "instance": "urn:silo:request:0000000000000000000002c6"
 }
diff --git a/contracts/api/v2/fixtures/start_device_login_temporary_null.json b/contracts/api/v2/fixtures/start_device_login_temporary_null.json
index 9e0591b402..7f44ef1ec7 100644
--- a/contracts/api/v2/fixtures/start_device_login_temporary_null.json
+++ b/contracts/api/v2/fixtures/start_device_login_temporary_null.json
@@ -3,7 +3,7 @@
   "title": "Validation failed",
   "status": 422,
   "detail": "The request did not pass validation; see errors.",
-  "instance": "urn:silo:request:00000000000000000000028b",
+  "instance": "urn:silo:request:00000000000000000000028c",
   "errors": [
     {
       "location": "body.temporary",
diff --git a/contracts/api/v2/fixtures/theme_songs_playback_not_acceptable.json b/contracts/api/v2/fixtures/theme_songs_playback_not_acceptable.json
index 5eecc7a519..9bcf734ed5 100644
--- a/contracts/api/v2/fixtures/theme_songs_playback_not_acceptable.json
+++ b/contracts/api/v2/fixtures/theme_songs_playback_not_acceptable.json
@@ -3,5 +3,5 @@
   "title": "Not acceptable",
   "status": 406,
   "detail": "The client decodes neither this theme's format nor its AAC conversion.",
-  "instance": "urn:silo:request:000000000000000000000298"
+  "instance": "urn:silo:request:000000000000000000000299"
 }
diff --git a/contracts/api/v2/fixtures/theme_songs_playback_unauthorized.json b/contracts/api/v2/fixtures/theme_songs_playback_unauthorized.json
index 72f32f4bea..090a8f67ee 100644
--- a/contracts/api/v2/fixtures/theme_songs_playback_unauthorized.json
+++ b/contracts/api/v2/fixtures/theme_songs_playback_unauthorized.json
@@ -3,5 +3,5 @@
   "title": "Authentication required",
   "status": 401,
   "detail": "Authentication is required.",
-  "instance": "urn:silo:request:000000000000000000000299"
+  "instance": "urn:silo:request:00000000000000000000029a"
 }
diff --git a/contracts/api/v2/fixtures/token_refresh_required.json b/contracts/api/v2/fixtures/token_refresh_required.json
index a812957ddb..d321e40366 100644
--- a/contracts/api/v2/fixtures/token_refresh_required.json
+++ b/contracts/api/v2/fixtures/token_refresh_required.json
@@ -3,5 +3,5 @@
   "title": "Token refresh required",
   "status": 401,
   "detail": "The account's role changed; refresh the session and retry the request.",
-  "instance": "urn:silo:request:0000000000000000000002ac"
+  "instance": "urn:silo:request:0000000000000000000002ad"
 }
diff --git a/contracts/api/v2/fixtures/unmark_not_interested_locked_profile.json b/contracts/api/v2/fixtures/unmark_not_interested_locked_profile.json
new file mode 100644
index 0000000000..29a6c390be
--- /dev/null
+++ b/contracts/api/v2/fixtures/unmark_not_interested_locked_profile.json
@@ -0,0 +1,7 @@
+{
+  "type": "https://siloserver.org/docs/api/v2/problems/profile_verification_required",
+  "title": "Profile verification required",
+  "status": 403,
+  "detail": "The declared profile is locked; verify it and retry with X-Profile-Token.",
+  "instance": "urn:silo:request:000000000000000000000309"
+}
diff --git a/contracts/api/v2/migration.json b/contracts/api/v2/migration.json
index 8f3982829e..5e9d1e205c 100644
--- a/contracts/api/v2/migration.json
+++ b/contracts/api/v2/migration.json
@@ -4051,19 +4051,17 @@
       "section": "admin-collections",
       "release_flow": "other_admin",
       "tier": 2,
-      "disposition": "ported",
-      "disposition_rule": "default_ported",
-      "disposition_rationale": "No exclusion, removal, or ratified redesign applies; port to v2 in its section PR.",
-      "owner": null,
+      "disposition": "removed",
+      "disposition_rule": "v1_scope_removals_table",
+      "disposition_rationale": "Listed in docs/architecture/v1-scope.md removals (\"Trakt on every v1 route\"); still registered on the bridge surface, answering 410 unsupported_source, retired by the tombstone. No successor: Prairie no longer supports Trakt.",
+      "owner": "Quick104",
       "review_state": "ratified",
       "v2": {
-        "method": "POST",
-        "path": "/api/v2/admin/collections/import/trakt",
-        "operation_id": "importAdminTrakt"
+        "method": null,
+        "path": null,
+        "operation_id": null
       },
-      "notes": "Administrator collection v2 operation uses shared services and typed string IDs. Bundled web consumes v2; legacy routes remain available. No existing Apple or Android administrator collection consumer was found. Jellyfin has no administrator editing surface.",
-      "retry_safety": "non_retryable",
-      "retry_safety_note": "No durable request identity is provided. Delayed replay can repeat side effects or overwrite a later action; clients must not retry automatically."
+      "notes": "Section admin-collections. The v2 importAdminTrakt operation was removed before the v2 lock when Prairie dropped Trakt support; it had refused every request with 410 unsupported_source since Trakt collection creation was turned off. No bundled web, native or Jellyfin consumer calls it. The frozen v1 route keeps answering 410 unsupported_source until the /api/v1 tombstone retires it. Removal ratified 2026-10-16 (owner decision, Quick104)."
     },
     {
       "listener": "api",
@@ -22756,20 +22754,18 @@
       ],
       "section": "personal-collections",
       "release_flow": "browse_search",
-      "tier": 1,
-      "disposition": "ported",
-      "disposition_rule": "default_ported",
-      "disposition_rationale": "No exclusion, removal, or ratified redesign applies; port to v2 in its section PR.",
-      "owner": null,
+      "tier": 2,
+      "disposition": "removed",
+      "disposition_rule": "v1_scope_removals_table",
+      "disposition_rationale": "Listed in docs/architecture/v1-scope.md removals (\"Trakt on every v1 route\"); still registered on the bridge surface, answering 410 unsupported_source, retired by the tombstone. No successor: Prairie no longer supports Trakt.",
+      "owner": "Quick104",
       "review_state": "ratified",
       "v2": {
-        "method": "POST",
-        "path": "/api/v2/collections/import/trakt",
-        "operation_id": "importTraktCollection"
+        "method": null,
+        "path": null,
+        "operation_id": null
       },
-      "notes": "Personal collection v2 operation uses the shared profile-scoped service. Storage capabilities distinguish unsupported SQLite imports, groups, artwork and reorder. Native Apple and Android adoption remains follow-up; bundled web consumes v2.",
-      "retry_safety": "non_retryable",
-      "retry_safety_note": "No durable request identity or mutation generation is implemented. Delayed replay can repeat side effects or overwrite a later action; clients must not retry automatically."
+      "notes": "Section personal-collections. The v2 importTraktCollection operation was removed before the v2 lock when Prairie dropped Trakt support; it had refused every request with 410 unsupported_source since Trakt collection creation was turned off. No bundled web, native or Jellyfin consumer calls it. The frozen v1 route keeps answering 410 unsupported_source until the /api/v1 tombstone retires it. Removal ratified 2026-10-16 (owner decision, Quick104)."
     },
     {
       "listener": "api",
@@ -26658,8 +26654,8 @@
         "operation_id": "deleteFavorite"
       },
       "notes": "Section personal-lists (profile_scoped). Not demo-restricted: v1's demo guard only blocks its listed routes, so this write passes in demo mode and v2 matches. Media kind resolved from the handler: no request body (request kind none) and a bodiless 204 answer; the inventory's unknown/json is heuristic. Naturally idempotent remove: 204 whether or not the entry existed, with no access check so a profile can drop an item that left its scope. Conditionally registered: authMiddleware != nil; personalDataHandler != nil && itemsHandler != nil. v2 registers the operation unconditionally and reports capability state instead.",
-      "retry_safety": "non_retryable",
-      "retry_safety_note": "DEFECT: the shared v1/v2 seam dispatches watch-provider list events and recommendation refresh even when membership did not change. Automatic retries remain disabled until the personal-lists section dispatches only for changed rows through a durable claim."
+      "retry_safety": "natural_idempotent",
+      "retry_safety_note": "Provider list, recommendation refresh and user-state events fire only when the write changed the row, detached from the request, so a retry repeats none. A crash between write and events loses them: scheduled export resends a missed add; a missed remove waits on a scheduled-sync fix."
     },
     {
       "listener": "api",
@@ -26798,8 +26794,8 @@
         "operation_id": "addFavorite"
       },
       "notes": "Section personal-lists (profile_scoped). Not demo-restricted: v1's demo guard only blocks its listed routes, so this write passes in demo mode and v2 matches. Media kind resolved from the handler: no request body (request kind none) and a bodiless 204 answer; the inventory's unknown/json is heuristic. Naturally idempotent add: a repeated PUT converges on the item being a favorite. An item the viewer may not see is 404. Conditionally registered: authMiddleware != nil; personalDataHandler != nil && itemsHandler != nil. v2 registers the operation unconditionally and reports capability state instead.",
-      "retry_safety": "non_retryable",
-      "retry_safety_note": "DEFECT: the shared v1/v2 seam dispatches watch-provider list events and recommendation refresh even when membership did not change. Automatic retries remain disabled until the personal-lists section dispatches only for changed rows through a durable claim."
+      "retry_safety": "natural_idempotent",
+      "retry_safety_note": "Provider list, recommendation refresh and user-state events fire only when the write changed the row, detached from the request, so a retry repeats none. A crash between write and events loses them: scheduled export resends a missed add; a missed remove waits on a scheduled-sync fix."
     },
     {
       "listener": "api",
@@ -43278,18 +43274,18 @@
       ],
       "section": "settings-branding",
       "release_flow": "browse_search",
-      "tier": 1,
-      "disposition": "ported",
-      "disposition_rule": "default_ported",
-      "disposition_rationale": "No exclusion, removal, or ratified redesign applies; port to v2 in its section PR.",
-      "owner": null,
+      "tier": 2,
+      "disposition": "removed",
+      "disposition_rule": "v1_scope_removals_table",
+      "disposition_rationale": "Listed in docs/architecture/v1-scope.md removals (\"The admin theme overrides route\"); still registered on the bridge surface, retired by the tombstone. No successor: the web client applies only the branding accent color, with no admin token, font or CSS overrides.",
+      "owner": "Quick104",
       "review_state": "ratified",
       "v2": {
-        "method": "GET",
-        "path": "/api/v2/theme/admin-css",
-        "operation_id": "getThemeOverrides"
+        "method": null,
+        "path": null,
+        "operation_id": null
       },
-      "notes": "Implemented public branding discovery/overrides and image GET/HEAD on reviewed raw foundation. Asset URLs target v2, exact content-version requests cache immutably, stale versions return404, unversioned reads revalidate. Security headers and conditional tags preserved. Bundled web uses v2 discovery/overrides. Capability GET /api/v2/theme/capabilities. Frozen v1 transport unchanged. Independently reviewed and accepted with coordinated Apple and Android public branding consumers; no native CSS caller."
+      "notes": "Section settings-branding. The v2 getThemeOverrides operation and the overrides_available capability field were removed before the v2 lock when the admin token and font overrides and custom CSS were removed from the web client; the accent color stays on getBranding and the web client applies it from there. The bundled web client no longer reads the overrides; no native or Jellyfin consumer exists. The frozen v1 route keeps reporting the stored ui.admin_theme_vars and ui.admin_custom_css values until the /api/v1 tombstone retires it. Removal ratified 2026-10-13 (owner decision, Quick104)."
     },
     {
       "listener": "api",
@@ -45445,8 +45441,8 @@
         "operation_id": "deleteWatchlistEntry"
       },
       "notes": "Section personal-lists (profile_scoped). Not demo-restricted: v1's demo guard only blocks its listed routes, so this write passes in demo mode and v2 matches. Media kind resolved from the handler: no request body (request kind none) and a bodiless 204 answer; the inventory's unknown/json is heuristic. Naturally idempotent remove: 204 whether or not the entry existed, with no access check so a profile can drop an item that left its scope. Conditionally registered: authMiddleware != nil; personalDataHandler != nil && itemsHandler != nil. v2 registers the operation unconditionally and reports capability state instead.",
-      "retry_safety": "non_retryable",
-      "retry_safety_note": "DEFECT: the shared v1/v2 seam dispatches watch-provider list events and recommendation refresh even when membership did not change. Automatic retries remain disabled until the personal-lists section dispatches only for changed rows through a durable claim."
+      "retry_safety": "natural_idempotent",
+      "retry_safety_note": "Provider list, recommendation refresh and user-state events fire only when the write changed the row, detached from the request, so a retry repeats none. A crash between write and events loses them: scheduled export resends a missed add; a missed remove waits on a scheduled-sync fix."
     },
     {
       "listener": "api",
@@ -45585,8 +45581,8 @@
         "operation_id": "addToWatchlist"
       },
       "notes": "Section personal-lists (profile_scoped). Not demo-restricted: v1's demo guard only blocks its listed routes, so this write passes in demo mode and v2 matches. Media kind resolved from the handler: no request body (request kind none) and a bodiless 204 answer; the inventory's unknown/json is heuristic. Naturally idempotent add: a repeated PUT converges on the item being on the watchlist. An item the viewer may not see is 404. Conditionally registered: authMiddleware != nil; personalDataHandler != nil && itemsHandler != nil. v2 registers the operation unconditionally and reports capability state instead.",
-      "retry_safety": "non_retryable",
-      "retry_safety_note": "DEFECT: the shared v1/v2 seam dispatches watch-provider list events and recommendation refresh even when membership did not change. Automatic retries remain disabled until the personal-lists section dispatches only for changed rows through a durable claim."
+      "retry_safety": "natural_idempotent",
+      "retry_safety_note": "Provider list, recommendation refresh and user-state events fire only when the write changed the row, detached from the request, so a retry repeats none. A crash between write and events loses them: scheduled export resends a missed add; a missed remove waits on a scheduled-sync fix."
     },
     {
       "listener": "api",
diff --git a/contracts/api/v2/openapi.json b/contracts/api/v2/openapi.json
index 70fbc7f18f..c6969e1663 100644
--- a/contracts/api/v2/openapi.json
+++ b/contracts/api/v2/openapi.json
@@ -864,6 +864,12 @@
           "max_playback_quality": {
             "type": "string"
           },
+          "max_profiles": {
+            "description": "Household profiles each member account may have, unless the account overrides it",
+            "format": "int64",
+            "minimum": 1,
+            "type": "integer"
+          },
           "max_remote_stream_bitrate_kbps": {
             "description": "Remote per-stream bitrate ceiling in kbps; 0 means unlimited",
             "format": "int64",
@@ -909,6 +915,7 @@
           "max_transcodes",
           "max_remote_stream_bitrate_kbps",
           "max_local_stream_bitrate_kbps",
+          "max_profiles",
           "allowed_permissions",
           "requests_allowed",
           "is_default",
@@ -966,6 +973,12 @@
           "max_playback_quality": {
             "type": "string"
           },
+          "max_profiles": {
+            "description": "Household profiles each member account may have; 5 when a new group omits it",
+            "format": "int64",
+            "minimum": 1,
+            "type": "integer"
+          },
           "max_remote_stream_bitrate_kbps": {
             "format": "int64",
             "minimum": 0,
@@ -1059,6 +1072,12 @@
           "max_playback_quality": {
             "type": "string"
           },
+          "max_profiles": {
+            "description": "Household profiles each member account may have, unless the account overrides it",
+            "format": "int64",
+            "minimum": 1,
+            "type": "integer"
+          },
           "max_remote_stream_bitrate_kbps": {
             "description": "Remote per-stream bitrate ceiling in kbps; 0 means unlimited",
             "format": "int64",
@@ -1109,6 +1128,7 @@
           "max_transcodes",
           "max_remote_stream_bitrate_kbps",
           "max_local_stream_bitrate_kbps",
+          "max_profiles",
           "allowed_permissions",
           "requests_allowed",
           "is_default",
@@ -1167,6 +1187,10 @@
             "description": "Whether getAdminUserPolicyDefaults reports the policy an admin or a regular account with no access group uses for fields it does not override",
             "type": "boolean"
           },
+          "profile_limits": {
+            "description": "Whether access groups and account policy overrides take max_profiles, the household profile limit; null on an account inherits its group's limit",
+            "type": "boolean"
+          },
           "profile_sections": {
             "description": "Whether listAdminUserProfileSectionOverrides, getAdminUserProfileSectionSettings, replaceAdminUserProfileSectionOverrides and resetAdminUserProfileSectionOverrides can read and change one profile's page layout",
             "type": "boolean"
@@ -1200,6 +1224,7 @@
           "default_profile",
           "exact_identity_filter",
           "access_groups",
+          "profile_limits",
           "password_reset_link",
           "password_reset_email",
           "ownership_transfer",
@@ -1289,9 +1314,13 @@
             ]
           },
           "max_profiles": {
+            "description": "Household profile limit override; null inherits the access group's limit",
             "format": "int64",
             "minimum": 1,
-            "type": "integer"
+            "type": [
+              "integer",
+              "null"
+            ]
           },
           "max_remote_stream_bitrate_kbps": {
             "format": "int64",
@@ -1517,9 +1546,13 @@
             ]
           },
           "max_profiles": {
+            "description": "Household profile limit override; null inherits the access group's limit",
             "format": "int64",
             "minimum": 1,
-            "type": "integer"
+            "type": [
+              "integer",
+              "null"
+            ]
           },
           "max_remote_stream_bitrate_kbps": {
             "format": "int64",
@@ -4348,6 +4381,9 @@
           "downloads_stats": {
             "type": "boolean"
           },
+          "egress_totals": {
+            "type": "boolean"
+          },
           "health": {
             "type": "boolean"
           },
@@ -4393,6 +4429,7 @@
           "log_level_list",
           "watch_providers",
           "downloads_stats",
+          "egress_totals",
           "revision",
           "state",
           "allowed"
@@ -4661,6 +4698,14 @@
       "AdminDashboardTimeseries": {
         "additionalProperties": false,
         "properties": {
+          "download_egress_bytes": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "egress_bytes": {
+            "format": "int64",
+            "type": "integer"
+          },
           "from": {
             "description": "RFC 3339 instant in UTC with millisecond precision",
             "format": "date-time",
@@ -4701,6 +4746,8 @@
           "from",
           "to",
           "oldest_sample_at",
+          "egress_bytes",
+          "download_egress_bytes",
           "points"
         ],
         "type": "object"
@@ -10803,6 +10850,14 @@
             "minLength": 1,
             "type": "string"
           },
+          "delivery_id": {
+            "description": "The target profile's newest notification, which the test push carried so the device shows its real text; absent when the profile has no notification and the device can show only generic text.",
+            "examples": [
+              "1"
+            ],
+            "minLength": 1,
+            "type": "string"
+          },
           "failure_message": {
             "type": "string"
           },
@@ -12139,6 +12194,10 @@
             ],
             "type": "string"
           },
+          "request_router": {
+            "$ref": "#/components/schemas/AdminPluginRequestRouter",
+            "description": "On a request_router.v1 capability: which request server fields its plugin can do without. Omitted for other capability types"
+          },
           "sign_in_mode": {
             "description": "How an auth_provider.v1 capability signs people in: oauth (a provider button and browser handshake, such as OIDC), credentials (a username and password form, such as LDAP) or network (a network access plugin, such as Tailscale, that signs in the owner of the device a request came from; one network binding may be on beside the one oauth or credentials binding). Omitted for other capability types",
             "enum": [
@@ -12958,6 +13017,24 @@
         },
         "type": "object"
       },
+      "AdminPluginRequestRouter": {
+        "additionalProperties": false,
+        "properties": {
+          "api_key_optional": {
+            "description": "The plugin works without an API key: a request server for it can be saved and tested without one, and gets requests without one",
+            "type": "boolean"
+          },
+          "base_url_optional": {
+            "description": "The plugin works without a base URL: a request server for it can be saved and tested without one",
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "api_key_optional",
+          "base_url_optional"
+        ],
+        "type": "object"
+      },
       "AdminPluginRuntime": {
         "additionalProperties": false,
         "properties": {
@@ -12989,7 +13066,7 @@
             "type": "integer"
           },
           "state": {
-            "description": "Process state; backoff and failed occur only for resident plugins",
+            "description": "Process state; starting and backoff occur only for resident plugins, failed also marks a non-resident plugin whose last launch failed",
             "enum": [
               "stopped",
               "starting",
@@ -14017,6 +14094,80 @@
         ],
         "type": "object"
       },
+      "AdminRecommendationEmbeddingsReset": {
+        "additionalProperties": false,
+        "properties": {
+          "cached_rows": {
+            "description": "Per-profile cached recommendation rows deleted. Global rows are kept.",
+            "format": "int64",
+            "type": "integer"
+          },
+          "embeddings": {
+            "description": "Item embeddings deleted.",
+            "format": "int64",
+            "type": "integer"
+          },
+          "taste_clusters": {
+            "description": "Taste clusters deleted.",
+            "format": "int64",
+            "type": "integer"
+          },
+          "taste_profiles": {
+            "description": "Taste profiles whose vectors were cleared. Each is rebuilt once the embedding job stores its titles' vectors again.",
+            "format": "int64",
+            "type": "integer"
+          }
+        },
+        "required": [
+          "embeddings",
+          "taste_profiles",
+          "taste_clusters",
+          "cached_rows"
+        ],
+        "type": "object"
+      },
+      "AdminRecommendationJobRun": {
+        "additionalProperties": false,
+        "properties": {
+          "completed_at": {
+            "description": "RFC 3339 instant in UTC with millisecond precision",
+            "format": "date-time",
+            "pattern": "^(?:[1-9][0-9]{3}|0[1-9][0-9]{2}|00[1-9][0-9]|000[2-9])-",
+            "patternDescription": "a non-zero RFC 3339 instant",
+            "type": "string"
+          },
+          "error": {
+            "description": "Why the run failed, with credentials masked. Present only when status is failed.",
+            "type": "string"
+          },
+          "result": {
+            "additionalProperties": {},
+            "description": "Counts the run reported. Keys differ by job and may grow.",
+            "type": "object"
+          },
+          "started_at": {
+            "description": "RFC 3339 instant in UTC with millisecond precision",
+            "format": "date-time",
+            "pattern": "^(?:[1-9][0-9]{3}|0[1-9][0-9]{2}|00[1-9][0-9]|000[2-9])-",
+            "patternDescription": "a non-zero RFC 3339 instant",
+            "type": "string"
+          },
+          "status": {
+            "description": "completed also covers runs that finished with partial failures; result counts them.",
+            "enum": [
+              "completed",
+              "failed"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "status",
+          "started_at",
+          "completed_at"
+        ],
+        "type": "object"
+      },
       "AdminRecommendationJobStatus": {
         "additionalProperties": false,
         "properties": {
@@ -14024,6 +14175,14 @@
             "format": "int64",
             "type": "integer"
           },
+          "last_partial_run": {
+            "$ref": "#/components/schemas/AdminRecommendationJobRun",
+            "description": "The newest finished partial run on any server: the embedding catch-up pass for embeddings, the startup global-row build for recommendations. Absent for other jobs and until one finishes."
+          },
+          "last_run": {
+            "$ref": "#/components/schemas/AdminRecommendationJobRun",
+            "description": "The newest finished full run of this job on any server: scheduled or triggered. Absent until one finishes."
+          },
           "running": {
             "type": "boolean"
           },
@@ -14038,6 +14197,24 @@
         ],
         "type": "object"
       },
+      "AdminRecommendationStaleSweep": {
+        "additionalProperties": false,
+        "properties": {
+          "last_run": {
+            "$ref": "#/components/schemas/AdminRecommendationJobRun",
+            "description": "The newest sweep on any server that rebuilt or failed at least one profile. Absent until one does."
+          },
+          "pending": {
+            "description": "Profiles whose recommendations wait for a rebuild. The sweep rebuilds up to 50 every 5 minutes; a profile whose rebuild fails stays pending.",
+            "format": "int64",
+            "type": "integer"
+          }
+        },
+        "required": [
+          "pending"
+        ],
+        "type": "object"
+      },
       "AdminRecommendationStarted": {
         "additionalProperties": false,
         "properties": {
@@ -14057,15 +14234,30 @@
       "AdminRecommendationsStatus": {
         "additionalProperties": false,
         "properties": {
+          "cache_refreshed_at": {
+            "description": "When the newest cached recommendation row was written, by the cache job or a profile refresh. It is not job health: profile refreshes keep it recent while the cache job fails; read recommendations.last_run for that. Absent when nothing is cached.",
+            "format": "date-time",
+            "pattern": "^(?:[1-9][0-9]{3}|0[1-9][0-9]{2}|00[1-9][0-9]|000[2-9])-",
+            "patternDescription": "a non-zero RFC 3339 instant",
+            "type": "string"
+          },
           "cowatch": {
             "$ref": "#/components/schemas/AdminRecommendationJobStatus"
           },
           "embeddings": {
             "$ref": "#/components/schemas/AdminRecommendationJobStatus"
           },
+          "lock_conflict": {
+            "description": "Why the stored embedding lock rejects the embedding settings this server runs with; empty when it does not.",
+            "type": "string"
+          },
           "recommendations": {
             "$ref": "#/components/schemas/AdminRecommendationJobStatus"
           },
+          "stale_sweep": {
+            "$ref": "#/components/schemas/AdminRecommendationStaleSweep",
+            "description": "The stale profile sweep, which rebuilds profiles after their signals or access change."
+          },
           "taste_profiles": {
             "$ref": "#/components/schemas/AdminRecommendationJobStatus"
           }
@@ -14074,7 +14266,9 @@
           "embeddings",
           "taste_profiles",
           "cowatch",
-          "recommendations"
+          "recommendations",
+          "lock_conflict",
+          "stale_sweep"
         ],
         "type": "object"
       },
@@ -18804,79 +18998,21 @@
         ],
         "type": "object"
       },
-      "AdminTraktImport": {
+      "AdminTranslateLibraryInputBody": {
         "additionalProperties": false,
         "properties": {
-          "description": {
-            "type": "string"
-          },
-          "featured": {
-            "type": "boolean"
-          },
-          "library_id": {
-            "description": "Opaque identifier",
-            "examples": [
-              "1"
-            ],
-            "minLength": 1,
-            "type": "string"
-          },
-          "library_ids": {
-            "items": {
-              "description": "Opaque identifier",
-              "examples": [
-                "1"
-              ],
-              "minLength": 1,
-              "type": "string"
-            },
-            "maxItems": 1000,
-            "type": "array"
-          },
-          "limit": {
-            "format": "int64",
-            "type": "integer"
-          },
-          "list_url": {
-            "type": "string"
-          },
-          "management_key": {
-            "type": "string"
-          },
-          "management_mode": {
-            "type": "string"
-          },
-          "management_source": {
-            "type": "string"
-          },
-          "media_type": {
-            "type": "string"
-          },
-          "poster_url": {
-            "type": "string"
-          },
-          "preset": {
-            "type": "string"
-          },
-          "profile_id": {
-            "description": "Opaque identifier",
+          "target_language": {
+            "description": "BCP 47 tag of the language to fill in",
             "examples": [
-              "1"
+              "de"
             ],
-            "minLength": 1,
-            "type": "string"
-          },
-          "sort_config": {},
-          "sync_schedule": {
-            "type": "string"
-          },
-          "title": {
+            "maxLength": 16,
             "minLength": 1,
             "type": "string"
           }
         },
         "required": [
-          "title"
+          "target_language"
         ],
         "type": "object"
       },
@@ -18884,6 +19020,7 @@
         "additionalProperties": false,
         "properties": {
           "force": {
+            "description": "Also replace text an earlier AI translation wrote. Provider and manual text is never replaced.",
             "type": "boolean"
           },
           "include_children": {
@@ -19276,12 +19413,16 @@
             ]
           },
           "max_profiles": {
-            "description": "Household profile limit",
+            "description": "Household profile limit override; null inherits the access group's limit",
             "examples": [
               5
             ],
             "format": "int64",
-            "type": "integer"
+            "minimum": 1,
+            "type": [
+              "integer",
+              "null"
+            ]
           },
           "max_remote_stream_bitrate_kbps": {
             "description": "Remote per-stream bitrate override in kbps; null inherits, 0 means unlimited",
@@ -20326,6 +20467,13 @@
             ],
             "minLength": 1,
             "type": "string"
+          },
+          "server_id": {
+            "description": "This deployment's identity, the server_id getServerIdentity reports. Key this registration's push credentials by it and the registering profile: pushes name both. Absent when unavailable.",
+            "examples": [
+              "3f2a9d5e-6b1c-4c7e-9a0d-2f4b8c1e7a35"
+            ],
+            "type": "string"
           }
         },
         "required": [
@@ -20458,6 +20606,13 @@
             ],
             "minLength": 1,
             "type": "string"
+          },
+          "server_id": {
+            "description": "This deployment's identity, the server_id getServerIdentity reports. Key this registration's push credentials by it and the registering profile: pushes name both. Absent when unavailable.",
+            "examples": [
+              "3f2a9d5e-6b1c-4c7e-9a0d-2f4b8c1e7a35"
+            ],
+            "type": "string"
           }
         },
         "required": [
@@ -21250,9 +21405,6 @@
           "branding_available": {
             "type": "boolean"
           },
-          "overrides_available": {
-            "type": "boolean"
-          },
           "revision": {
             "description": "Opaque revision of this document",
             "type": "string"
@@ -21273,7 +21425,6 @@
         },
         "required": [
           "branding_available",
-          "overrides_available",
           "storage_available",
           "revision",
           "state"
@@ -21971,6 +22122,17 @@
             "description": "Presigned, short-lived",
             "type": "string"
           },
+          "machine_translated_fields": {
+            "description": "Localized fields whose text was machine-translated by AI rather than supplied by a metadata provider or a person; absent when none were. Set only on item details, the cards built from them (shuffles, the Watch Together picker), and Home and library section cards. A card shows no tagline, so a card's overview label depends on overview alone.",
+            "items": {
+              "enum": [
+                "overview",
+                "tagline"
+              ],
+              "type": "string"
+            },
+            "type": "array"
+          },
           "manga_chapter_count": {
             "format": "int64",
             "type": "integer"
@@ -21998,6 +22160,10 @@
           "overview": {
             "type": "string"
           },
+          "pending_translation_language": {
+            "description": "The language this profile reads here when the descriptions this item's page shows are not available in it yet. That is the profile's metadata language after its per-language exceptions, or, when it sets none, the library's for a library's rows or a detail opened in that library. It is pending for the item's own overview, or for a season its overview or any of its episodes' overviews. Echo it to translateCatalogItemDescription to translate on view. Set only on item details, the cards built from them (shuffles, the Watch Together picker), and Home and library section cards; other listings never carry it, so its absence there says nothing about the language.",
+            "type": "string"
+          },
           "play_content_id": {
             "description": "The item to play when the card is a series or season; absent when the item plays itself",
             "type": "string"
@@ -22386,6 +22552,17 @@
             "description": "Presigned, short-lived",
             "type": "string"
           },
+          "machine_translated_fields": {
+            "description": "Localized fields whose text was machine-translated by AI rather than supplied by a metadata provider or a person; absent when none were. Set only on item details, the cards built from them (shuffles, the Watch Together picker), and Home and library section cards. A card shows no tagline, so a card's overview label depends on overview alone.",
+            "items": {
+              "enum": [
+                "overview",
+                "tagline"
+              ],
+              "type": "string"
+            },
+            "type": "array"
+          },
           "manga": {
             "$ref": "#/components/schemas/MangaDetailExtension"
           },
@@ -22420,7 +22597,7 @@
             "type": "string"
           },
           "pending_translation_language": {
-            "description": "A translation of the overview is queued for this language",
+            "description": "The language this profile reads here when the descriptions this item's page shows are not available in it yet. That is the profile's metadata language after its per-language exceptions, or, when it sets none, the library's for a library's rows or a detail opened in that library. It is pending for the item's own overview, or for a season its overview or any of its episodes' overviews. Echo it to translateCatalogItemDescription to translate on view. Set only on item details, the cards built from them (shuffles, the Watch Together picker), and Home and library section cards; other listings never carry it, so its absence there says nothing about the language.",
             "type": "string"
           },
           "play_content_id": {
@@ -22826,6 +23003,13 @@
             ],
             "type": "boolean"
           },
+          "not_interested": {
+            "description": "The profile marked the movie or series Not interested: recommendations leave it out and rank similar titles lower",
+            "examples": [
+              false
+            ],
+            "type": "boolean"
+          },
           "played": {
             "examples": [
               false
@@ -22836,7 +23020,8 @@
         "required": [
           "played",
           "is_favorite",
-          "in_watchlist"
+          "in_watchlist",
+          "not_interested"
         ],
         "type": "object"
       },
@@ -25722,9 +25907,6 @@
           },
           "tmdb_list": {
             "$ref": "#/components/schemas/TMDBListSpec"
-          },
-          "trakt": {
-            "$ref": "#/components/schemas/TraktSpec"
           }
         },
         "required": [
@@ -26980,10 +27162,18 @@
             "minimum": 0,
             "type": "integer"
           },
+          "custom_name": {
+            "description": "Name the profile gave the device; show it in place of device_name. Absent when none was given",
+            "examples": [
+              "Living Room"
+            ],
+            "type": "string"
+          },
           "device_id": {
             "type": "string"
           },
           "device_name": {
+            "description": "Name the device reports for itself",
             "type": "string"
           },
           "device_platform": {
@@ -27043,6 +27233,24 @@
         ],
         "type": "object"
       },
+      "DeviceUpdate": {
+        "additionalProperties": false,
+        "properties": {
+          "custom_name": {
+            "description": "Name to show for the device in place of the name it reports. Control characters and bidirectional overrides are removed and runs of spaces collapse; a name with no visible character is rejected. null removes it. The reported device_name is kept",
+            "examples": [
+              "Living Room"
+            ],
+            "maxLength": 120,
+            "minLength": 1,
+            "type": [
+              "string",
+              "null"
+            ]
+          }
+        },
+        "type": "object"
+      },
       "DiagnosticsCapabilities": {
         "additionalProperties": false,
         "properties": {
@@ -28912,6 +29120,15 @@
             ],
             "type": "string"
           },
+          "max_profiles": {
+            "description": "Household profile limit",
+            "examples": [
+              5
+            ],
+            "format": "int64",
+            "minimum": 1,
+            "type": "integer"
+          },
           "max_remote_stream_bitrate_kbps": {
             "description": "Remote per-stream bitrate limit in kbps; 0 means unlimited",
             "examples": [
@@ -28973,6 +29190,7 @@
           "max_transcodes",
           "max_remote_stream_bitrate_kbps",
           "max_local_stream_bitrate_kbps",
+          "max_profiles",
           "transcode_allowed",
           "audio_transcode_allowed",
           "download_allowed",
@@ -29525,12 +29743,33 @@
           "imdb_id": {
             "type": "string"
           },
+          "machine_translated_fields": {
+            "description": "Localized fields whose text was machine-translated by AI; absent when none were",
+            "items": {
+              "enum": [
+                "overview"
+              ],
+              "type": "string"
+            },
+            "type": "array"
+          },
           "overlay_summary": {
             "$ref": "#/components/schemas/CatalogItemOverlay"
           },
           "overview": {
             "type": "string"
           },
+          "pending_translation_language": {
+            "description": "The language this profile reads here (its metadata language, or the library's when it sets none) when the episode's description is not available in it yet; translating the episode's season fills it",
+            "type": "string"
+          },
+          "ratings": {
+            "description": "The episode's IMDb and TMDB ratings, in the shape a title page's ratings use. Absent when the episode has no rating.",
+            "items": {
+              "$ref": "#/components/schemas/CatalogRating"
+            },
+            "type": "array"
+          },
           "runtime": {
             "description": "Minutes",
             "format": "int64",
@@ -30334,6 +30573,30 @@
         ],
         "type": "object"
       },
+      "HLSSubtitleRenditionV3": {
+        "additionalProperties": false,
+        "properties": {
+          "format": {
+            "type": "string"
+          },
+          "group_id": {
+            "type": "string"
+          },
+          "mime_type": {
+            "type": "string"
+          },
+          "name": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "group_id",
+          "name",
+          "format",
+          "mime_type"
+        ],
+        "type": "object"
+      },
       "HistoryCard": {
         "additionalProperties": false,
         "properties": {
@@ -30428,6 +30691,17 @@
             "description": "Presigned, short-lived",
             "type": "string"
           },
+          "machine_translated_fields": {
+            "description": "Localized fields whose text was machine-translated by AI rather than supplied by a metadata provider or a person; absent when none were. Set only on item details, the cards built from them (shuffles, the Watch Together picker), and Home and library section cards. A card shows no tagline, so a card's overview label depends on overview alone.",
+            "items": {
+              "enum": [
+                "overview",
+                "tagline"
+              ],
+              "type": "string"
+            },
+            "type": "array"
+          },
           "manga_chapter_count": {
             "format": "int64",
             "type": "integer"
@@ -30455,6 +30729,10 @@
           "overview": {
             "type": "string"
           },
+          "pending_translation_language": {
+            "description": "The language this profile reads here when the descriptions this item's page shows are not available in it yet. That is the profile's metadata language after its per-language exceptions, or, when it sets none, the library's for a library's rows or a detail opened in that library. It is pending for the item's own overview, or for a season its overview or any of its episodes' overviews. Echo it to translateCatalogItemDescription to translate on view. Set only on item details, the cards built from them (shuffles, the Watch Together picker), and Home and library section cards; other listings never carry it, so its absence there says nothing about the language.",
+            "type": "string"
+          },
           "play_content_id": {
             "description": "The item to play when the card is a series or season; absent when the item plays itself",
             "type": "string"
@@ -31346,6 +31624,13 @@
             },
             "type": "array"
           },
+          "slot_width_params": {
+            "additionalProperties": {
+              "type": "string"
+            },
+            "description": "Per-slot width query parameters, keyed by slot: poster (poster_url), backdrop (backdrop_url, backdrop_urls), logo (logo_url), still (an episode's still_url), photo (cast and crew photo_url). Each takes the width in device pixels the client draws that field at and overrides param for it; the server returns the narrowest cached size at least that wide, else the original. Accepted wherever param is",
+            "type": "object"
+          },
           "state": {
             "description": "Support and configuration state, not health",
             "enum": [
@@ -31375,6 +31660,7 @@
           "extended_item_artwork",
           "season_list_artwork_param",
           "param",
+          "slot_width_params",
           "sizes",
           "widths",
           "original_max_width_px",
@@ -31453,6 +31739,10 @@
             "format": "int64",
             "type": "integer"
           },
+          "embeddings_skipped": {
+            "format": "int64",
+            "type": "integer"
+          },
           "episodes_created": {
             "format": "int64",
             "type": "integer"
@@ -31522,6 +31812,7 @@
           "links_created",
           "credits_replaced",
           "embeddings_imported",
+          "embeddings_skipped",
           "skipped"
         ],
         "type": "object"
@@ -32025,6 +32316,13 @@
             "description": "Whether the current principal may use the capability",
             "type": "boolean"
           },
+          "ignore_unmatched": {
+            "description": "This build supports marking unmatched items as intentionally unmatched with ignoreUnmatchedItem, and listing them with listUnmatchedItems' ignored filter",
+            "examples": [
+              true
+            ],
+            "type": "boolean"
+          },
           "realtime_monitoring": {
             "description": "This build supports real-time library monitoring and its status read",
             "examples": [
@@ -32065,6 +32363,7 @@
           "realtime_monitoring",
           "trickplay",
           "trickplay_supported",
+          "ignore_unmatched",
           "revision",
           "state",
           "allowed"
@@ -35490,7 +35789,7 @@
             "type": "boolean"
           },
           "on_view": {
-            "description": "Viewer-triggered translation mode: off, button (the detail page offers the action), or auto (the server queues it on view)",
+            "description": "Viewer-triggered translation mode: off, button (the detail page offers the action), or auto (the client requests the translation itself when it shows an item whose pending_translation_language is set)",
             "examples": [
               "button"
             ],
@@ -35778,6 +36077,7 @@
             "type": "integer"
           },
           "force": {
+            "description": "The job also replaces earlier AI text; provider and manual text is never replaced",
             "type": "boolean"
           },
           "id": {
@@ -35810,7 +36110,7 @@
             "type": "string"
           },
           "target_kind": {
-            "description": "item, season, or episode",
+            "description": "item, season, episode, or library (a prewarm, whose fields_done and fields_total count items)",
             "type": "string"
           },
           "target_language": {
@@ -36239,6 +36539,83 @@
         ],
         "type": "object"
       },
+      "NotInterestedCapability": {
+        "additionalProperties": false,
+        "properties": {
+          "allowed": {
+            "description": "Whether the current principal may use the capability",
+            "type": "boolean"
+          },
+          "revision": {
+            "description": "Opaque revision of this document",
+            "type": "string"
+          },
+          "state": {
+            "description": "Support and configuration state, not health",
+            "enum": [
+              "available",
+              "disabled",
+              "not_configured",
+              "unsupported"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "revision",
+          "state",
+          "allowed"
+        ],
+        "type": "object"
+      },
+      "NotInterestedCollection": {
+        "additionalProperties": false,
+        "properties": {
+          "items": {
+            "description": "The page's items; empty, never null",
+            "items": {
+              "$ref": "#/components/schemas/CatalogItem"
+            },
+            "type": "array"
+          },
+          "page": {
+            "$ref": "#/components/schemas/PageInfo",
+            "description": "Cursor state; absent for bounded unpaginated collections"
+          }
+        },
+        "required": [
+          "items"
+        ],
+        "type": "object"
+      },
+      "NotInterestedEntry": {
+        "additionalProperties": false,
+        "properties": {
+          "item_id": {
+            "description": "The movie or series",
+            "examples": [
+              "movie:heat-1995"
+            ],
+            "minLength": 1,
+            "type": "string"
+          },
+          "marked_at": {
+            "description": "When the profile marked it",
+            "examples": [
+              "2026-01-02T03:04:05.000Z"
+            ],
+            "format": "date-time",
+            "pattern": "^(?:[1-9][0-9]{3}|0[1-9][0-9]{2}|00[1-9][0-9]|000[2-9])-",
+            "patternDescription": "a non-zero RFC 3339 instant",
+            "type": "string"
+          }
+        },
+        "required": [
+          "item_id",
+          "marked_at"
+        ],
+        "type": "object"
+      },
       "NotificationAccountChannelCapability": {
         "additionalProperties": false,
         "properties": {
@@ -36289,6 +36666,9 @@
             "description": "Opaque revision of this document",
             "type": "string"
           },
+          "series": {
+            "$ref": "#/components/schemas/NotificationSeriesCapability"
+          },
           "state": {
             "description": "Support and configuration state, not health",
             "enum": [
@@ -36314,6 +36694,7 @@
           "webhooks",
           "email",
           "discord",
+          "series",
           "revision",
           "state",
           "allowed"
@@ -36569,6 +36950,30 @@
         ],
         "type": "object"
       },
+      "NotificationEpisodeRef": {
+        "additionalProperties": false,
+        "properties": {
+          "episode_number": {
+            "examples": [
+              9
+            ],
+            "format": "int64",
+            "type": "integer"
+          },
+          "season_number": {
+            "examples": [
+              2
+            ],
+            "format": "int64",
+            "type": "integer"
+          }
+        },
+        "required": [
+          "season_number",
+          "episode_number"
+        ],
+        "type": "object"
+      },
       "NotificationInAppCapability": {
         "additionalProperties": false,
         "properties": {
@@ -36650,7 +37055,10 @@
             ]
           },
           "reason_flags": {
-            "description": "A JSON value whose shape is the setting's value_schema in the settings contract."
+            "additionalProperties": true,
+            "description": "Event-specific reason data. Its keys depend on the notification type; clients ignore keys they do not recognize.",
+            "type": "object",
+            "x-silo-extension-bag": "notification-reason-flags"
           },
           "season_number": {
             "format": "int64",
@@ -36892,6 +37300,109 @@
         ],
         "type": "object"
       },
+      "NotificationSeries": {
+        "additionalProperties": false,
+        "properties": {
+          "active_reasons": {
+            "$ref": "#/components/schemas/NotificationSeriesReasons",
+            "description": "The reasons the profile's notification preferences let notify; all false when they silence the series"
+          },
+          "item": {
+            "$ref": "#/components/schemas/CatalogItem",
+            "description": "The series as a catalog card"
+          },
+          "muted": {
+            "description": "The profile muted the series: it gets no new-episode notification for it, whatever the reasons, until it unmutes. active_reasons still names the reasons that would notify once unmuted.",
+            "type": "boolean"
+          },
+          "next_up_after": {
+            "$ref": "#/components/schemas/NotificationEpisodeRef",
+            "description": "With an active Next Up reason, the last episode the profile finished: on that reason alone, only a new episode after it notifies"
+          },
+          "notifies": {
+            "description": "True when at least one reason is active and the profile has not muted the series",
+            "type": "boolean"
+          },
+          "reasons": {
+            "$ref": "#/components/schemas/NotificationSeriesReasons",
+            "description": "The profile's relationships to the series"
+          }
+        },
+        "required": [
+          "item",
+          "reasons",
+          "active_reasons",
+          "notifies",
+          "muted"
+        ],
+        "type": "object"
+      },
+      "NotificationSeriesCapability": {
+        "additionalProperties": false,
+        "properties": {
+          "available": {
+            "description": "GET /notifications/series lists the series whose new episodes can notify the profile",
+            "type": "boolean"
+          },
+          "mute": {
+            "description": "PUT and DELETE /notifications/series/{series_id}/mute mute and unmute one series, and list entries carry muted",
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "available",
+          "mute"
+        ],
+        "type": "object"
+      },
+      "NotificationSeriesCollection": {
+        "additionalProperties": false,
+        "properties": {
+          "items": {
+            "description": "The page's items; empty, never null",
+            "items": {
+              "$ref": "#/components/schemas/NotificationSeries"
+            },
+            "type": "array"
+          },
+          "page": {
+            "$ref": "#/components/schemas/PageInfo",
+            "description": "Cursor state; absent for bounded unpaginated collections"
+          }
+        },
+        "required": [
+          "items"
+        ],
+        "type": "object"
+      },
+      "NotificationSeriesReasons": {
+        "additionalProperties": false,
+        "properties": {
+          "continue_watching": {
+            "description": "The profile is partway through the series",
+            "type": "boolean"
+          },
+          "favorite": {
+            "description": "The series is one of the profile's favorites",
+            "type": "boolean"
+          },
+          "next_up": {
+            "description": "The profile finished an episode and waits for the next",
+            "type": "boolean"
+          },
+          "watchlist": {
+            "description": "The series is on the profile's watchlist",
+            "type": "boolean"
+          }
+        },
+        "required": [
+          "favorite",
+          "watchlist",
+          "continue_watching",
+          "next_up"
+        ],
+        "type": "object"
+      },
       "NotificationServerChannel": {
         "additionalProperties": false,
         "properties": {
@@ -38426,7 +38937,7 @@
         "additionalProperties": false,
         "properties": {
           "collection_type": {
-            "description": "manual, smart, or an import source (mdblist, tmdb, trakt)",
+            "description": "manual, smart, or an import source (mdblist, tmdb)",
             "examples": [
               "manual"
             ],
@@ -39227,6 +39738,7 @@
             "type": "array"
           },
           "available_qualities": {
+            "description": "Fixed quality rungs a quality_change replan may request, in menu order. The source is not listed: quality_preference auto returns to it. Empty when no rung applies.",
             "items": {
               "$ref": "#/components/schemas/AvailableQualityV3"
             },
@@ -39466,6 +39978,7 @@
             "type": "integer"
           },
           "bandwidth_estimate_kbps": {
+            "description": "Measured throughput to this server, such as a bandwidth probe result. auto sends a source whose bitrate fits 80% of it as-is and lowers only one that does not. Omit it rather than send a guess.",
             "format": "int64",
             "type": "integer"
           },
@@ -39505,6 +40018,8 @@
             "type": "array"
           },
           "metered": {
+            "deprecated": true,
+            "description": "Deprecated; ignored. A client on a metered link sends its cellular quality as quality_preference and bandwidth_cap_kbps instead.",
             "type": "boolean"
           },
           "operation": {
@@ -39543,6 +40058,7 @@
             "type": "integer"
           },
           "quality_preference": {
+            "description": "auto (the default), a resolution such as 1080p, or a rung label from available_qualities. auto plays the source unless the device cannot, a measured bandwidth_estimate_kbps cannot carry it, or it is above bandwidth_cap_kbps. original is a deprecated alias of auto.",
             "type": "string"
           },
           "replan_request_id": {
@@ -39567,7 +40083,6 @@
           "attempt_count",
           "quality_preference",
           "position_seconds",
-          "metered",
           "selected_tracks",
           "client_capabilities",
           "client_playback_context"
@@ -40403,6 +40918,7 @@
             "type": "integer"
           },
           "bandwidth_estimate_kbps": {
+            "description": "Measured throughput to this server, such as a bandwidth probe result. auto sends a source whose bitrate fits 80% of it as-is and lowers only one that does not. Omit it rather than send a guess.",
             "format": "int64",
             "type": "integer"
           },
@@ -40435,6 +40951,8 @@
             "type": "string"
           },
           "metered": {
+            "deprecated": true,
+            "description": "Deprecated; ignored. A client on a metered link sends its cellular quality as quality_preference and bandwidth_cap_kbps instead.",
             "type": "boolean"
           },
           "playback_attempt_id": {
@@ -40460,6 +40978,7 @@
             "type": "integer"
           },
           "quality_preference": {
+            "description": "auto (the default), a resolution such as 1080p, or a rung label from available_qualities. auto plays the source unless the device cannot, a measured bandwidth_estimate_kbps cannot carry it, or it is above bandwidth_cap_kbps. original is a deprecated alias of auto.",
             "type": "string"
           },
           "start_position": {
@@ -40486,7 +41005,6 @@
           "playback_attempt_id",
           "quality_preference",
           "subtitle_fidelity_preference",
-          "metered",
           "client_capabilities",
           "client_playback_context"
         ],
@@ -41175,6 +41693,15 @@
             ],
             "type": "string"
           },
+          "max_profiles": {
+            "description": "Household profile limit",
+            "examples": [
+              5
+            ],
+            "format": "int64",
+            "minimum": 1,
+            "type": "integer"
+          },
           "max_remote_stream_bitrate_kbps": {
             "description": "Remote per-stream bitrate limit in kbps; 0 means unlimited",
             "examples": [
@@ -41220,6 +41747,7 @@
           "max_transcodes",
           "max_remote_stream_bitrate_kbps",
           "max_local_stream_bitrate_kbps",
+          "max_profiles",
           "transcode_allowed",
           "audio_transcode_allowed",
           "download_allowed",
@@ -41496,7 +42024,7 @@
             "type": "string"
           },
           "quality_preference": {
-            "description": "Free-form until the vocabulary is ratified (#135). Canonical values today: auto, original, 720p, 1080p, 2160p, 4k; empty when unset",
+            "description": "Free-form until the vocabulary is ratified (#135). Canonical values today: auto, 720p, 1080p, 2160p, 4k; original is a deprecated alias of auto; empty when unset",
             "examples": [
               "auto"
             ],
@@ -41754,7 +42282,7 @@
             "type": "string"
           },
           "quality_preference": {
-            "description": "Free-form until the vocabulary is ratified (#135); v1 never validated it. Canonical values today: auto, original, 720p, 1080p, 2160p, 4k",
+            "description": "Free-form until the vocabulary is ratified (#135); v1 never validated it. Canonical values today: auto, 720p, 1080p, 2160p, 4k; original is a deprecated alias of auto",
             "examples": [
               "auto"
             ],
@@ -42089,7 +42617,7 @@
             ]
           },
           "quality_preference": {
-            "description": "Free-form until the vocabulary is ratified (#135); v1 never validated it. Canonical values today: auto, original, 720p, 1080p, 2160p, 4k",
+            "description": "Free-form until the vocabulary is ratified (#135); v1 never validated it. Canonical values today: auto, 720p, 1080p, 2160p, 4k; original is a deprecated alias of auto",
             "examples": [
               "auto"
             ],
@@ -42238,6 +42766,43 @@
         ],
         "type": "object"
       },
+      "ProgressCapabilities": {
+        "additionalProperties": false,
+        "properties": {
+          "allowed": {
+            "description": "Whether the current principal may use the capability",
+            "type": "boolean"
+          },
+          "clear_resume_position": {
+            "description": "Whether clearResumePosition is served: it clears a movie or episode's resume position and keeps its watched state and watch history",
+            "examples": [
+              true
+            ],
+            "type": "boolean"
+          },
+          "revision": {
+            "description": "Opaque revision of this document",
+            "type": "string"
+          },
+          "state": {
+            "description": "Support and configuration state, not health",
+            "enum": [
+              "available",
+              "disabled",
+              "not_configured",
+              "unsupported"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "clear_resume_position",
+          "revision",
+          "state",
+          "allowed"
+        ],
+        "type": "object"
+      },
       "ProgressCollection": {
         "additionalProperties": false,
         "properties": {
@@ -44331,6 +44896,16 @@
           "is_specials": {
             "type": "boolean"
           },
+          "machine_translated_fields": {
+            "description": "Localized fields whose text was machine-translated by AI; absent when none were",
+            "items": {
+              "enum": [
+                "overview"
+              ],
+              "type": "string"
+            },
+            "type": "array"
+          },
           "overview": {
             "type": "string"
           },
@@ -44387,6 +44962,135 @@
         ],
         "type": "object"
       },
+      "SeasonalTheme": {
+        "additionalProperties": false,
+        "properties": {
+          "dates_editable": {
+            "description": "Whether a row may set its own yearly window for this holiday in theme_dates. False for weekly themes.",
+            "type": "boolean"
+          },
+          "end": {
+            "description": "Last day of the default window, MM-DD, inclusive; before start when the window wraps across New Year",
+            "examples": [
+              "10-31"
+            ],
+            "type": "string"
+          },
+          "key": {
+            "description": "Stored in the row's enabled_themes config; stable",
+            "examples": [
+              "halloween"
+            ],
+            "type": "string"
+          },
+          "name": {
+            "examples": [
+              "Halloween"
+            ],
+            "type": "string"
+          },
+          "start": {
+            "description": "First day of the default window, MM-DD. Absent when the holiday moves (Easter) or recurs weekly.",
+            "examples": [
+              "10-01"
+            ],
+            "type": "string"
+          },
+          "vibes": {
+            "description": "The first vibe is the default; never empty",
+            "items": {
+              "$ref": "#/components/schemas/SeasonalVibe"
+            },
+            "type": "array"
+          },
+          "when": {
+            "description": "When the holiday is in season by default, for display",
+            "examples": [
+              "October"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "key",
+          "name",
+          "when",
+          "dates_editable",
+          "vibes"
+        ],
+        "type": "object"
+      },
+      "SeasonalThemeCatalog": {
+        "additionalProperties": false,
+        "properties": {
+          "max_custom_holidays": {
+            "description": "The most custom holidays one row may define",
+            "examples": [
+              12
+            ],
+            "format": "int64",
+            "type": "integer"
+          },
+          "themes": {
+            "description": "In calendar order, for display: dated holidays by their usual start, then the weekly ones",
+            "items": {
+              "$ref": "#/components/schemas/SeasonalTheme"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "themes",
+          "max_custom_holidays"
+        ],
+        "type": "object"
+      },
+      "SeasonalVibe": {
+        "additionalProperties": false,
+        "properties": {
+          "description": {
+            "examples": [
+              "Spooky fun for all ages."
+            ],
+            "type": "string"
+          },
+          "key": {
+            "description": "Stored in the row's vibes config; stable",
+            "examples": [
+              "family"
+            ],
+            "type": "string"
+          },
+          "list_url": {
+            "description": "The MDBList list behind the vibe",
+            "examples": [
+              "https://mdblist.com/lists/purple_smurf/halloween-family2"
+            ],
+            "type": "string"
+          },
+          "name": {
+            "examples": [
+              "Family Halloween"
+            ],
+            "type": "string"
+          },
+          "title": {
+            "description": "The row's title while this vibe is in season, unless the row sets its own",
+            "examples": [
+              "Family Halloween"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "key",
+          "name",
+          "title",
+          "description",
+          "list_url"
+        ],
+        "type": "object"
+      },
       "Section": {
         "additionalProperties": false,
         "properties": {
@@ -45103,6 +45807,10 @@
             },
             "type": "array"
           },
+          "local_route": {
+            "$ref": "#/components/schemas/ServerLocalRoute",
+            "description": "How to reach the API server directly on the local network; absent on a server whose API port does not answer TLS."
+          },
           "revision": {
             "description": "Opaque revision of this document",
             "type": "string"
@@ -45212,6 +45920,29 @@
         ],
         "type": "object"
       },
+      "ServerLocalRoute": {
+        "additionalProperties": false,
+        "properties": {
+          "spki_sha256": {
+            "description": "Base64 SHA-256 of the SubjectPublicKeyInfo of the certificate the API listener presents over TLS on its own port. A client accepts a local-network address only when TLS there presents this key, and learns it only over an address it already trusts. Derived from SECRET_KEY, so it changes when that key is rotated.",
+            "examples": [
+              "n4bQgYhMfWWaL+qgxVrQFaO/TxsrC4Is0V1sFbDwCgg="
+            ],
+            "type": "string"
+          },
+          "url": {
+            "description": "server.local_url: scheme://host[:port] of the API server on the local network, when an admin set one. Clients connect with https on the same host and port, whatever the scheme says, and require the pinned key. Absent when unset; clients may still find local addresses through LAN discovery.",
+            "examples": [
+              "http://192.168.1.20:8080"
+            ],
+            "type": "string"
+          }
+        },
+        "required": [
+          "spki_sha256"
+        ],
+        "type": "object"
+      },
       "SettingConstraint": {
         "additionalProperties": false,
         "properties": {
@@ -45578,6 +46309,13 @@
             ],
             "type": "boolean"
           },
+          "supports_device_rename": {
+            "description": "Whether updateDevice can give a device a custom name, which listDevices returns as custom_name",
+            "examples": [
+              true
+            ],
+            "type": "boolean"
+          },
           "supports_idempotent_writes": {
             "description": "Whether repeating a value write converges on the same state",
             "examples": [
@@ -45596,6 +46334,7 @@
           "supports_batched_effective",
           "supports_idempotent_writes",
           "supports_atomic_shortcuts",
+          "supports_device_rename",
           "revision",
           "state",
           "allowed"
@@ -46658,6 +47397,9 @@
           "embedded": {
             "$ref": "#/components/schemas/EmbeddedSubtitleV3"
           },
+          "hls_rendition": {
+            "$ref": "#/components/schemas/HLSSubtitleRenditionV3"
+          },
           "inventory": {
             "items": {
               "$ref": "#/components/schemas/SubtitleInventoryItemV3"
@@ -48106,22 +48848,6 @@
         ],
         "type": "object"
       },
-      "ThemeOverrides": {
-        "additionalProperties": false,
-        "properties": {
-          "raw_css": {
-            "type": "string"
-          },
-          "vars": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "vars",
-          "raw_css"
-        ],
-        "type": "object"
-      },
       "ThemePlayback": {
         "additionalProperties": false,
         "properties": {
@@ -48467,114 +49193,6 @@
         ],
         "type": "object"
       },
-      "TraktCollectionImport": {
-        "additionalProperties": false,
-        "properties": {
-          "description": {
-            "examples": [
-              ""
-            ],
-            "type": "string"
-          },
-          "display_query_definition": {
-            "description": "Display filter fragment"
-          },
-          "is_shared": {
-            "description": "Show the collection to every profile on the login; defaults to false",
-            "examples": [
-              false
-            ],
-            "type": "boolean"
-          },
-          "library_ids": {
-            "description": "Libraries the sync matches against, limited to the libraries the collection's owner can access; every library the owner can access when omitted",
-            "examples": [
-              [
-                "1"
-              ]
-            ],
-            "items": {
-              "description": "Opaque identifier",
-              "examples": [
-                "1"
-              ],
-              "minLength": 1,
-              "type": "string"
-            },
-            "type": "array"
-          },
-          "limit": {
-            "description": "Cap on synced items; the server's own maximum applies when omitted",
-            "examples": [
-              50
-            ],
-            "format": "int64",
-            "minimum": 1,
-            "type": "integer"
-          },
-          "media_type": {
-            "description": "movie or show; the preset's default when omitted",
-            "examples": [
-              "movie"
-            ],
-            "type": "string"
-          },
-          "poster_url": {
-            "description": "A bundled template poster path or an image URL",
-            "examples": [
-              ""
-            ],
-            "type": "string"
-          },
-          "preset": {
-            "description": "A Trakt preset name",
-            "examples": [
-              "trending"
-            ],
-            "minLength": 1,
-            "type": "string"
-          },
-          "sort_config": {
-            "description": "Default sort document"
-          },
-          "sync_schedule": {
-            "description": "Sync cadence name; the server default when omitted",
-            "examples": [
-              "daily"
-            ],
-            "type": "string"
-          },
-          "title": {
-            "description": "The new collection's name; trimmed",
-            "examples": [
-              "Trending movies"
-            ],
-            "minLength": 1,
-            "type": "string"
-          }
-        },
-        "required": [
-          "preset",
-          "title"
-        ],
-        "type": "object"
-      },
-      "TraktSpec": {
-        "additionalProperties": false,
-        "properties": {
-          "media_type": {
-            "type": "string"
-          },
-          "preset": {
-            "type": "string"
-          }
-        },
-        "required": [
-          "preset",
-          "media_type"
-        ],
-        "type": "object"
-      },
       "TransformationV3": {
         "additionalProperties": false,
         "properties": {
@@ -48606,7 +49224,7 @@
         "additionalProperties": false,
         "properties": {
           "target_language": {
-            "description": "BCP 47 tag of the wanted language, as the detail document's pending_translation_language reported it",
+            "description": "BCP 47 tag of the wanted language, exactly as this profile's detail document reported it in pending_translation_language. Any other language, or a target with nothing left to translate, is refused with 422 at body.target_language.",
             "examples": [
               "de"
             ],
@@ -48635,6 +49253,13 @@
             ],
             "type": "string"
           },
+          "ignored_at": {
+            "description": "When an admin marked the item as intentionally unmatched; absent unless it is ignored",
+            "format": "date-time",
+            "pattern": "^(?:[1-9][0-9]{3}|0[1-9][0-9]{2}|00[1-9][0-9]|000[2-9])-",
+            "patternDescription": "a non-zero RFC 3339 instant",
+            "type": "string"
+          },
           "library_id": {
             "description": "\"0\" when the item is in no library",
             "examples": [
@@ -49288,6 +49913,13 @@
       "WatchDetail": {
         "additionalProperties": false,
         "properties": {
+          "backdrop_thumbhash": {
+            "type": "string"
+          },
+          "backdrop_url": {
+            "description": "The item's backdrop, an episode's series backdrop, or an extra's parent backdrop, sized by image_size",
+            "type": "string"
+          },
           "content_id": {
             "examples": [
               "movie:heat-1995"
@@ -49341,6 +49973,13 @@
             },
             "type": "array"
           },
+          "poster_thumbhash": {
+            "type": "string"
+          },
+          "poster_url": {
+            "description": "The item's poster, an episode's still, or an extra's parent poster, sized by image_size; for system media controls",
+            "type": "string"
+          },
           "preview": {
             "$ref": "#/components/schemas/WatchMarker"
           },
@@ -51464,6 +52103,17 @@
             "description": "Presigned, short-lived",
             "type": "string"
           },
+          "machine_translated_fields": {
+            "description": "Localized fields whose text was machine-translated by AI rather than supplied by a metadata provider or a person; absent when none were. Set only on item details, the cards built from them (shuffles, the Watch Together picker), and Home and library section cards. A card shows no tagline, so a card's overview label depends on overview alone.",
+            "items": {
+              "enum": [
+                "overview",
+                "tagline"
+              ],
+              "type": "string"
+            },
+            "type": "array"
+          },
           "manga_chapter_count": {
             "format": "int64",
             "type": "integer"
@@ -51491,6 +52141,10 @@
           "overview": {
             "type": "string"
           },
+          "pending_translation_language": {
+            "description": "The language this profile reads here when the descriptions this item's page shows are not available in it yet. That is the profile's metadata language after its per-language exceptions, or, when it sets none, the library's for a library's rows or a detail opened in that library. It is pending for the item's own overview, or for a season its overview or any of its episodes' overviews. Echo it to translateCatalogItemDescription to translate on view. Set only on item details, the cards built from them (shuffles, the Watch Together picker), and Home and library section cards; other listings never carry it, so its absence there says nothing about the language.",
+            "type": "string"
+          },
           "play_content_id": {
             "description": "The item to play when the card is a series or season; absent when the item plays itself",
             "type": "string"
@@ -51808,6 +52462,17 @@
             "description": "Presigned, short-lived",
             "type": "string"
           },
+          "machine_translated_fields": {
+            "description": "Localized fields whose text was machine-translated by AI rather than supplied by a metadata provider or a person; absent when none were. Set only on item details, the cards built from them (shuffles, the Watch Together picker), and Home and library section cards. A card shows no tagline, so a card's overview label depends on overview alone.",
+            "items": {
+              "enum": [
+                "overview",
+                "tagline"
+              ],
+              "type": "string"
+            },
+            "type": "array"
+          },
           "manga_chapter_count": {
             "format": "int64",
             "type": "integer"
@@ -51835,6 +52500,10 @@
           "overview": {
             "type": "string"
           },
+          "pending_translation_language": {
+            "description": "The language this profile reads here when the descriptions this item's page shows are not available in it yet. That is the profile's metadata language after its per-language exceptions, or, when it sets none, the library's for a library's rows or a detail opened in that library. It is pending for the item's own overview, or for a season its overview or any of its episodes' overviews. Echo it to translateCatalogItemDescription to translate on view. Set only on item details, the cards built from them (shuffles, the Watch Together picker), and Home and library section cards; other listings never carry it, so its absence there says nothing about the language.",
+            "type": "string"
+          },
           "play_content_id": {
             "description": "The item to play when the card is a series or season; absent when the item plays itself",
             "type": "string"
@@ -65602,10 +66271,203 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/collections/import/trakt": {
-      "post": {
-        "operationId": "importAdminTrakt",
+    "/api/v2/admin/collections/order": {
+      "get": {
+        "operationId": "getAdminCollectionOrder",
+        "parameters": [
+          {
+            "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
+            "in": "header",
+            "name": "X-Profile-Id",
+            "schema": {
+              "examples": [
+                "1"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked",
+            "in": "header",
+            "name": "X-Profile-Token",
+            "schema": {
+              "examples": [
+                "pvt_5f3a9c1e7b2d4e8fa0c6"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Opaque identifier",
+            "explode": false,
+            "in": "query",
+            "name": "library_id",
+            "required": true,
+            "schema": {
+              "description": "Opaque identifier",
+              "examples": [
+                "1"
+              ],
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "description": "Opaque identifier",
+            "explode": false,
+            "in": "query",
+            "name": "group_id",
+            "schema": {
+              "description": "Opaque identifier",
+              "examples": [
+                "1"
+              ],
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AdminCollectionOrder"
+                }
+              }
+            },
+            "description": "OK",
+            "headers": {
+              "ETag": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "406": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Acceptable"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "429": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Too Many Requests"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "summary": "Read complete manual ordering for one library and group.",
+        "tags": [
+          "admin-collections"
+        ],
+        "x-silo-class": "acting_admin",
+        "x-silo-service-backed": true
+      },
+      "put": {
+        "operationId": "reorderAdminCollections",
         "parameters": [
+          {
+            "description": "The resource's current ETag, or \"*\" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag.",
+            "in": "header",
+            "name": "If-Match",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Optional second precondition, evaluated after If-Match succeeds: \"*\" or any tag matching the current representation is 412 precondition_failed with the current ETag.",
+            "in": "header",
+            "name": "If-None-Match",
+            "schema": {
+              "type": "string"
+            }
+          },
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
             "in": "header",
@@ -65633,24 +66495,25 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/AdminTraktImport"
+                "$ref": "#/components/schemas/AdminCollectionOrderBody"
               }
             }
           },
           "required": true
         },
         "responses": {
-          "201": {
+          "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AdminCollectionImportResult"
+                  "$ref": "#/components/schemas/AdminCollectionOrder"
                 }
               }
             },
-            "description": "Created",
+            "description": "OK",
             "headers": {
-              "Location": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
                 "schema": {
                   "type": "string"
                 }
@@ -65717,6 +66580,24 @@
             },
             "description": "Request Timeout"
           },
+          "412": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Precondition Failed",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
           "413": {
             "content": {
               "application/problem+json": {
@@ -65747,6 +66628,16 @@
             },
             "description": "Unprocessable Entity"
           },
+          "428": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Precondition Required"
+          },
           "429": {
             "content": {
               "application/problem+json": {
@@ -65783,19 +66674,20 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Import a Trakt collection.",
+        "summary": "Replace collection order within a library group.",
         "tags": [
           "admin-collections"
         ],
         "x-silo-class": "acting_admin",
         "x-silo-demo-restricted": true,
+        "x-silo-guarded": true,
         "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/collections/order": {
-      "get": {
-        "operationId": "getAdminCollectionOrder",
+    "/api/v2/admin/collections/preview": {
+      "post": {
+        "operationId": "previewAdminCollection",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -65818,54 +66710,28 @@
               ],
               "type": "string"
             }
-          },
-          {
-            "description": "Opaque identifier",
-            "explode": false,
-            "in": "query",
-            "name": "library_id",
-            "required": true,
-            "schema": {
-              "description": "Opaque identifier",
-              "examples": [
-                "1"
-              ],
-              "minLength": 1,
-              "type": "string"
-            }
-          },
-          {
-            "description": "Opaque identifier",
-            "explode": false,
-            "in": "query",
-            "name": "group_id",
-            "schema": {
-              "description": "Opaque identifier",
-              "examples": [
-                "1"
-              ],
-              "minLength": 1,
-              "type": "string"
-            }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/PersonalCollectionPreviewInputBody"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AdminCollectionOrder"
+                  "$ref": "#/components/schemas/AdminCollectionPreviewOutputBody"
                 }
               }
             },
-            "description": "OK",
-            "headers": {
-              "ETag": {
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -65917,6 +66783,36 @@
             },
             "description": "Not Acceptable"
           },
+          "408": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Timeout"
+          },
+          "413": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -65963,33 +66859,20 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Read complete manual ordering for one library and group.",
+        "summary": "Preview an administrator smart collection query.",
         "tags": [
           "admin-collections"
         ],
         "x-silo-class": "acting_admin",
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "natural_idempotent",
         "x-silo-service-backed": true
-      },
-      "put": {
-        "operationId": "reorderAdminCollections",
+      }
+    },
+    "/api/v2/admin/collections/template-bundles": {
+      "get": {
+        "operationId": "listAdminCollectionTemplateBundles",
         "parameters": [
-          {
-            "description": "The resource's current ETag, or \"*\" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag.",
-            "in": "header",
-            "name": "If-Match",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "description": "Optional second precondition, evaluated after If-Match succeeds: \"*\" or any tag matching the current representation is 412 precondition_failed with the current ETag.",
-            "in": "header",
-            "name": "If-None-Match",
-            "schema": {
-              "type": "string"
-            }
-          },
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
             "in": "header",
@@ -66013,34 +66896,16 @@
             }
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/AdminCollectionOrderBody"
-              }
-            }
-          },
-          "required": true
-        },
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AdminCollectionOrder"
+                  "$ref": "#/components/schemas/BundleCatalog"
                 }
               }
             },
-            "description": "OK",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -66092,54 +66957,6 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
-          "412": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Precondition Failed",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
-          },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unsupported Media Type"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -66150,16 +66967,6 @@
             },
             "description": "Unprocessable Entity"
           },
-          "428": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Precondition Required"
-          },
           "429": {
             "content": {
               "application/problem+json": {
@@ -66196,20 +67003,17 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Replace collection order within a library group.",
+        "summary": "List collection template bundles, each with a summary of its templates.",
         "tags": [
           "admin-collections"
         ],
         "x-silo-class": "acting_admin",
-        "x-silo-demo-restricted": true,
-        "x-silo-guarded": true,
-        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/collections/preview": {
+    "/api/v2/admin/collections/template-bundles/{bundle_id}/apply": {
       "post": {
-        "operationId": "previewAdminCollection",
+        "operationId": "applyAdminCollectionTemplateBundle",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -66232,13 +67036,21 @@
               ],
               "type": "string"
             }
+          },
+          {
+            "in": "path",
+            "name": "bundle_id",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
           }
         ],
         "requestBody": {
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/PersonalCollectionPreviewInputBody"
+                "$ref": "#/components/schemas/AdminTemplateApply"
               }
             }
           },
@@ -66249,7 +67061,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AdminCollectionPreviewOutputBody"
+                  "$ref": "#/components/schemas/AdminTemplateResult"
                 }
               }
             },
@@ -66381,19 +67193,19 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Preview an administrator smart collection query.",
+        "summary": "Preview or synchronously apply a template bundle, preserving featured-section behavior.",
         "tags": [
           "admin-collections"
         ],
         "x-silo-class": "acting_admin",
         "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "natural_idempotent",
+        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/collections/template-bundles": {
-      "get": {
-        "operationId": "listAdminCollectionTemplateBundles",
+    "/api/v2/admin/collections/template-bundles/{bundle_id}/apply-job": {
+      "post": {
+        "operationId": "startAdminCollectionTemplateBundleJob",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -66416,18 +67228,49 @@
               ],
               "type": "string"
             }
+          },
+          {
+            "in": "path",
+            "name": "bundle_id",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/AdminTemplateApply"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
-          "200": {
+          "202": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/BundleCatalog"
+                  "$ref": "#/components/schemas/AdminJob"
                 }
               }
             },
-            "description": "OK"
+            "description": "Accepted",
+            "headers": {
+              "Location": {
+                "schema": {
+                  "description": "URI of the queued job",
+                  "type": "string"
+                }
+              },
+              "Retry-After": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
           },
           "400": {
             "content": {
@@ -66479,6 +67322,36 @@
             },
             "description": "Not Acceptable"
           },
+          "408": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Timeout"
+          },
+          "413": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -66525,17 +67398,19 @@
             "bearerAuth": []
           }
         ],
-        "summary": "List collection template bundles, each with a summary of its templates.",
+        "summary": "Queue durable template application; poll its collection-job Location.",
         "tags": [
           "admin-collections"
         ],
         "x-silo-class": "acting_admin",
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/collections/template-bundles/{bundle_id}/apply": {
-      "post": {
-        "operationId": "applyAdminCollectionTemplateBundle",
+    "/api/v2/admin/collections/templates": {
+      "get": {
+        "operationId": "listAdminCollectionTemplates",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -66558,32 +67433,14 @@
               ],
               "type": "string"
             }
-          },
-          {
-            "in": "path",
-            "name": "bundle_id",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/AdminTemplateApply"
-              }
-            }
-          },
-          "required": true
-        },
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AdminTemplateResult"
+                  "$ref": "#/components/schemas/CollectionTemplateCatalog"
                 }
               }
             },
@@ -66639,36 +67496,6 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unsupported Media Type"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -66715,20 +67542,35 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Preview or synchronously apply a template bundle, preserving featured-section behavior.",
+        "summary": "List the collection templates with an mdblist, tmdb or tmdb_list source.",
         "tags": [
           "admin-collections"
         ],
         "x-silo-class": "acting_admin",
-        "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/collections/template-bundles/{bundle_id}/apply-job": {
-      "post": {
-        "operationId": "startAdminCollectionTemplateBundleJob",
+    "/api/v2/admin/collections/{id}": {
+      "delete": {
+        "operationId": "deleteAdminCollection",
         "parameters": [
+          {
+            "description": "The resource's current ETag, or \"*\" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag.",
+            "in": "header",
+            "name": "If-Match",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Optional second precondition, evaluated after If-Match succeeds: \"*\" or any tag matching the current representation is 412 precondition_failed with the current ETag.",
+            "in": "header",
+            "name": "If-None-Match",
+            "schema": {
+              "type": "string"
+            }
+          },
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
             "in": "header",
@@ -66752,47 +67594,23 @@
             }
           },
           {
+            "description": "Opaque identifier",
             "in": "path",
-            "name": "bundle_id",
+            "name": "id",
             "required": true,
             "schema": {
+              "description": "Opaque identifier",
+              "examples": [
+                "1"
+              ],
+              "minLength": 1,
               "type": "string"
             }
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/AdminTemplateApply"
-              }
-            }
-          },
-          "required": true
-        },
         "responses": {
-          "202": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/AdminJob"
-                }
-              }
-            },
-            "description": "Accepted",
-            "headers": {
-              "Location": {
-                "schema": {
-                  "description": "URI of the queued job",
-                  "type": "string"
-                }
-              },
-              "Retry-After": {
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
+          "204": {
+            "description": "No Content"
           },
           "400": {
             "content": {
@@ -66844,7 +67662,7 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
+          "412": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -66852,19 +67670,17 @@
                 }
               }
             },
-            "description": "Request Timeout"
-          },
-          "413": {
-            "content": {
-              "application/problem+json": {
+            "description": "Precondition Failed",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
                 "schema": {
-                  "$ref": "#/components/schemas/Problem"
+                  "type": "string"
                 }
               }
-            },
-            "description": "Request Entity Too Large"
+            }
           },
-          "415": {
+          "422": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -66872,9 +67688,9 @@
                 }
               }
             },
-            "description": "Unsupported Media Type"
+            "description": "Unprocessable Entity"
           },
-          "422": {
+          "428": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -66882,7 +67698,7 @@
                 }
               }
             },
-            "description": "Unprocessable Entity"
+            "description": "Precondition Required"
           },
           "429": {
             "content": {
@@ -66920,19 +67736,18 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Queue durable template application; poll its collection-job Location.",
+        "summary": "Delete an unused collection using its observed validator.",
         "tags": [
           "admin-collections"
         ],
         "x-silo-class": "acting_admin",
         "x-silo-demo-restricted": true,
+        "x-silo-guarded": true,
         "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
-      }
-    },
-    "/api/v2/admin/collections/templates": {
+      },
       "get": {
-        "operationId": "listAdminCollectionTemplates",
+        "operationId": "getAdminCollection",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -66955,6 +67770,34 @@
               ],
               "type": "string"
             }
+          },
+          {
+            "description": "Opaque identifier",
+            "in": "path",
+            "name": "id",
+            "required": true,
+            "schema": {
+              "description": "Opaque identifier",
+              "examples": [
+                "1"
+              ],
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "in": "header",
+            "name": "If-Match",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "in": "header",
+            "name": "If-None-Match",
+            "schema": {
+              "type": "string"
+            }
           }
         ],
         "responses": {
@@ -66962,11 +67805,18 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/CollectionTemplateCatalog"
+                  "$ref": "#/components/schemas/AdminCollection"
                 }
               }
             },
-            "description": "OK"
+            "description": "OK",
+            "headers": {
+              "ETag": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
           },
           "400": {
             "content": {
@@ -67064,17 +67914,15 @@
             "bearerAuth": []
           }
         ],
-        "summary": "List the collection templates with an mdblist, tmdb or tmdb_list source.",
+        "summary": "Read the canonical editor and strong validator.",
         "tags": [
           "admin-collections"
         ],
         "x-silo-class": "acting_admin",
         "x-silo-service-backed": true
-      }
-    },
-    "/api/v2/admin/collections/{id}": {
-      "delete": {
-        "operationId": "deleteAdminCollection",
+      },
+      "patch": {
+        "operationId": "updateAdminCollection",
         "parameters": [
           {
             "description": "The resource's current ETag, or \"*\" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag.",
@@ -67130,9 +67978,34 @@
             }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/AdminCollectionUpdate"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
-          "204": {
-            "description": "No Content"
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AdminCollection"
+                }
+              }
+            },
+            "description": "OK",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
           },
           "400": {
             "content": {
@@ -67184,6 +68057,16 @@
             },
             "description": "Not Acceptable"
           },
+          "408": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Timeout"
+          },
           "412": {
             "content": {
               "application/problem+json": {
@@ -67202,6 +68085,26 @@
               }
             }
           },
+          "413": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -67258,7 +68161,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Delete an unused collection using its observed validator.",
+        "summary": "Update a library collection using its observed validator.",
         "tags": [
           "admin-collections"
         ],
@@ -67267,9 +68170,11 @@
         "x-silo-guarded": true,
         "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
-      },
-      "get": {
-        "operationId": "getAdminCollection",
+      }
+    },
+    "/api/v2/admin/collections/{id}/backdrop": {
+      "put": {
+        "operationId": "uploadAdminCollectionBackdrop",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -67306,22 +68211,26 @@
               "minLength": 1,
               "type": "string"
             }
-          },
-          {
-            "in": "header",
-            "name": "If-Match",
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "in": "header",
-            "name": "If-None-Match",
-            "schema": {
-              "type": "string"
-            }
           }
         ],
+        "requestBody": {
+          "content": {
+            "multipart/form-data": {
+              "encoding": {
+                "image": {
+                  "contentType": "image/jpeg,image/png,image/webp"
+                },
+                "source_url": {
+                  "contentType": "text/plain"
+                }
+              },
+              "schema": {
+                "$ref": "#/components/schemas/AdminCollectionBackdropForm"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
           "200": {
             "content": {
@@ -67390,6 +68299,36 @@
             },
             "description": "Not Acceptable"
           },
+          "408": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Timeout"
+          },
+          "413": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -67436,33 +68375,20 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Read the canonical editor and strong validator.",
+        "summary": "Upload bounded backdrop artwork or download its source after definition save.",
         "tags": [
           "admin-collections"
         ],
         "x-silo-class": "acting_admin",
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
-      },
-      "patch": {
-        "operationId": "updateAdminCollection",
+      }
+    },
+    "/api/v2/admin/collections/{id}/image": {
+      "delete": {
+        "operationId": "deleteAdminCollectionImage",
         "parameters": [
-          {
-            "description": "The resource's current ETag, or \"*\" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag.",
-            "in": "header",
-            "name": "If-Match",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "description": "Optional second precondition, evaluated after If-Match succeeds: \"*\" or any tag matching the current representation is 412 precondition_failed with the current ETag.",
-            "in": "header",
-            "name": "If-None-Match",
-            "schema": {
-              "type": "string"
-            }
-          },
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
             "in": "header",
@@ -67498,36 +68424,24 @@
               "minLength": 1,
               "type": "string"
             }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "type",
+            "required": true,
+            "schema": {
+              "enum": [
+                "poster",
+                "backdrop"
+              ],
+              "type": "string"
+            }
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/AdminCollectionUpdate"
-              }
-            }
-          },
-          "required": true
-        },
         "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/AdminCollection"
-                }
-              }
-            },
-            "description": "OK",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
+          "204": {
+            "description": "No Content"
           },
           "400": {
             "content": {
@@ -67579,54 +68493,6 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
-          "412": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Precondition Failed",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
-          },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unsupported Media Type"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -67637,16 +68503,6 @@
             },
             "description": "Unprocessable Entity"
           },
-          "428": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Precondition Required"
-          },
           "429": {
             "content": {
               "application/problem+json": {
@@ -67683,20 +68539,19 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Update a library collection using its observed validator.",
+        "summary": "Clear poster or backdrop artwork.",
         "tags": [
           "admin-collections"
         ],
         "x-silo-class": "acting_admin",
         "x-silo-demo-restricted": true,
-        "x-silo-guarded": true,
         "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/collections/{id}/backdrop": {
-      "put": {
-        "operationId": "uploadAdminCollectionBackdrop",
+    "/api/v2/admin/collections/{id}/items": {
+      "get": {
+        "operationId": "getAdminCollectionItems",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -67733,43 +68588,43 @@
               "minLength": 1,
               "type": "string"
             }
-          }
-        ],
-        "requestBody": {
-          "content": {
-            "multipart/form-data": {
-              "encoding": {
-                "image": {
-                  "contentType": "image/jpeg,image/png,image/webp"
-                },
-                "source_url": {
-                  "contentType": "text/plain"
-                }
-              },
-              "schema": {
-                "$ref": "#/components/schemas/AdminCollectionBackdropForm"
-              }
+          },
+          {
+            "description": "Page size; default 50, maximum 200",
+            "explode": false,
+            "in": "query",
+            "name": "limit",
+            "schema": {
+              "default": 50,
+              "description": "Page size; default 50, maximum 200",
+              "examples": [
+                50
+              ],
+              "format": "int64",
+              "maximum": 200,
+              "minimum": 1,
+              "type": "integer"
             }
           },
-          "required": true
-        },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "cursor",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AdminCollection"
+                  "$ref": "#/components/schemas/CollectionAdminCollectionMember"
                 }
               }
             },
-            "description": "OK",
-            "headers": {
-              "ETag": {
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -67821,36 +68676,6 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unsupported Media Type"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -67897,19 +68722,17 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Upload bounded backdrop artwork or download its source after definition save.",
+        "summary": "Page manual membership with durable signed continuation.",
         "tags": [
           "admin-collections"
         ],
         "x-silo-class": "acting_admin",
-        "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/collections/{id}/image": {
-      "delete": {
-        "operationId": "deleteAdminCollectionImage",
+    "/api/v2/admin/collections/{id}/items/order": {
+      "get": {
+        "operationId": "getAdminCollectionItemsOrder",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -67948,22 +68771,37 @@
             }
           },
           {
-            "explode": false,
-            "in": "query",
-            "name": "type",
-            "required": true,
+            "in": "header",
+            "name": "If-Match",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "in": "header",
+            "name": "If-None-Match",
             "schema": {
-              "enum": [
-                "poster",
-                "backdrop"
-              ],
               "type": "string"
             }
           }
         ],
         "responses": {
-          "204": {
-            "description": "No Content"
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AdminCollectionOrder"
+                }
+              }
+            },
+            "description": "OK",
+            "headers": {
+              "ETag": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
           },
           "400": {
             "content": {
@@ -68061,20 +68899,33 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Clear poster or backdrop artwork.",
+        "summary": "Read at most 200 manual memberships. A partial window cannot be reordered.",
         "tags": [
           "admin-collections"
         ],
         "x-silo-class": "acting_admin",
-        "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
-      }
-    },
-    "/api/v2/admin/collections/{id}/items": {
-      "get": {
-        "operationId": "getAdminCollectionItems",
+      },
+      "put": {
+        "operationId": "reorderAdminCollectionItems",
         "parameters": [
+          {
+            "description": "The resource's current ETag, or \"*\" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag.",
+            "in": "header",
+            "name": "If-Match",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Optional second precondition, evaluated after If-Match succeeds: \"*\" or any tag matching the current representation is 412 precondition_failed with the current ETag.",
+            "in": "header",
+            "name": "If-None-Match",
+            "schema": {
+              "type": "string"
+            }
+          },
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
             "in": "header",
@@ -68110,43 +68961,36 @@
               "minLength": 1,
               "type": "string"
             }
-          },
-          {
-            "description": "Page size; default 50, maximum 200",
-            "explode": false,
-            "in": "query",
-            "name": "limit",
-            "schema": {
-              "default": 50,
-              "description": "Page size; default 50, maximum 200",
-              "examples": [
-                50
-              ],
-              "format": "int64",
-              "maximum": 200,
-              "minimum": 1,
-              "type": "integer"
-            }
-          },
-          {
-            "explode": false,
-            "in": "query",
-            "name": "cursor",
-            "schema": {
-              "type": "string"
-            }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/AdminCollectionIDsOrder"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/CollectionAdminCollectionMember"
+                  "$ref": "#/components/schemas/AdminCollectionOrder"
                 }
               }
             },
-            "description": "OK"
+            "description": "OK",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
           },
           "400": {
             "content": {
@@ -68198,6 +69042,54 @@
             },
             "description": "Not Acceptable"
           },
+          "408": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Timeout"
+          },
+          "412": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Precondition Failed",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "413": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -68208,6 +69100,16 @@
             },
             "description": "Unprocessable Entity"
           },
+          "428": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Precondition Required"
+          },
           "429": {
             "content": {
               "application/problem+json": {
@@ -68244,17 +69146,20 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Page manual membership with durable signed continuation.",
+        "summary": "Replace the complete manual membership order.",
         "tags": [
           "admin-collections"
         ],
         "x-silo-class": "acting_admin",
+        "x-silo-demo-restricted": true,
+        "x-silo-guarded": true,
+        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/collections/{id}/items/order": {
-      "get": {
-        "operationId": "getAdminCollectionItemsOrder",
+    "/api/v2/admin/collections/{id}/items/{item_id}": {
+      "delete": {
+        "operationId": "removeAdminCollectionItem",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -68293,37 +69198,23 @@
             }
           },
           {
-            "in": "header",
-            "name": "If-Match",
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "in": "header",
-            "name": "If-None-Match",
+            "description": "Opaque identifier",
+            "in": "path",
+            "name": "item_id",
+            "required": true,
             "schema": {
+              "description": "Opaque identifier",
+              "examples": [
+                "1"
+              ],
+              "minLength": 1,
               "type": "string"
             }
           }
         ],
         "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/AdminCollectionOrder"
-                }
-              }
-            },
-            "description": "OK",
-            "headers": {
-              "ETag": {
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
+          "204": {
+            "description": "No Content"
           },
           "400": {
             "content": {
@@ -68421,33 +69312,18 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Read at most 200 manual memberships. A partial window cannot be reordered.",
+        "summary": "Remove a manual membership.",
         "tags": [
           "admin-collections"
         ],
         "x-silo-class": "acting_admin",
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       },
       "put": {
-        "operationId": "reorderAdminCollectionItems",
+        "operationId": "addAdminCollectionItem",
         "parameters": [
-          {
-            "description": "The resource's current ETag, or \"*\" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag.",
-            "in": "header",
-            "name": "If-Match",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "description": "Optional second precondition, evaluated after If-Match succeeds: \"*\" or any tag matching the current representation is 412 precondition_failed with the current ETag.",
-            "in": "header",
-            "name": "If-None-Match",
-            "schema": {
-              "type": "string"
-            }
-          },
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
             "in": "header",
@@ -68483,36 +69359,35 @@
               "minLength": 1,
               "type": "string"
             }
+          },
+          {
+            "description": "Opaque identifier",
+            "in": "path",
+            "name": "item_id",
+            "required": true,
+            "schema": {
+              "description": "Opaque identifier",
+              "examples": [
+                "1"
+              ],
+              "minLength": 1,
+              "type": "string"
+            }
           }
         ],
         "requestBody": {
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/AdminCollectionIDsOrder"
+                "$ref": "#/components/schemas/AdminCollectionMemberInputBody"
               }
             }
           },
           "required": true
         },
         "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/AdminCollectionOrder"
-                }
-              }
-            },
-            "description": "OK",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
+          "204": {
+            "description": "No Content"
           },
           "400": {
             "content": {
@@ -68574,24 +69449,6 @@
             },
             "description": "Request Timeout"
           },
-          "412": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Precondition Failed",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
-          },
           "413": {
             "content": {
               "application/problem+json": {
@@ -68622,16 +69479,6 @@
             },
             "description": "Unprocessable Entity"
           },
-          "428": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Precondition Required"
-          },
           "429": {
             "content": {
               "application/problem+json": {
@@ -68668,20 +69515,19 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Replace the complete manual membership order.",
+        "summary": "Add a catalog item if absent; existing positions are preserved.",
         "tags": [
           "admin-collections"
         ],
         "x-silo-class": "acting_admin",
         "x-silo-demo-restricted": true,
-        "x-silo-guarded": true,
         "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/collections/{id}/items/{item_id}": {
-      "delete": {
-        "operationId": "removeAdminCollectionItem",
+    "/api/v2/admin/collections/{id}/poster": {
+      "put": {
+        "operationId": "uploadAdminCollectionPoster",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -68718,25 +69564,43 @@
               "minLength": 1,
               "type": "string"
             }
-          },
-          {
-            "description": "Opaque identifier",
-            "in": "path",
-            "name": "item_id",
-            "required": true,
-            "schema": {
-              "description": "Opaque identifier",
-              "examples": [
-                "1"
-              ],
-              "minLength": 1,
-              "type": "string"
-            }
           }
         ],
+        "requestBody": {
+          "content": {
+            "multipart/form-data": {
+              "encoding": {
+                "image": {
+                  "contentType": "image/jpeg,image/png,image/webp"
+                },
+                "source_url": {
+                  "contentType": "text/plain"
+                }
+              },
+              "schema": {
+                "$ref": "#/components/schemas/AdminCollectionArtworkForm"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
-          "204": {
-            "description": "No Content"
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AdminCollection"
+                }
+              }
+            },
+            "description": "OK",
+            "headers": {
+              "ETag": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
           },
           "400": {
             "content": {
@@ -68788,6 +69652,36 @@
             },
             "description": "Not Acceptable"
           },
+          "408": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Timeout"
+          },
+          "413": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -68834,7 +69728,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Remove a manual membership.",
+        "summary": "Upload bounded poster artwork or download its source after definition save.",
         "tags": [
           "admin-collections"
         ],
@@ -68842,9 +69736,11 @@
         "x-silo-demo-restricted": true,
         "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
-      },
-      "put": {
-        "operationId": "addAdminCollectionItem",
+      }
+    },
+    "/api/v2/admin/collections/{id}/sections": {
+      "get": {
+        "operationId": "listAdminCollectionSections",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -68883,33 +69779,30 @@
             }
           },
           {
-            "description": "Opaque identifier",
-            "in": "path",
-            "name": "item_id",
-            "required": true,
+            "in": "header",
+            "name": "If-Match",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "in": "header",
+            "name": "If-None-Match",
             "schema": {
-              "description": "Opaque identifier",
-              "examples": [
-                "1"
-              ],
-              "minLength": 1,
               "type": "string"
             }
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/AdminCollectionMemberInputBody"
-              }
-            }
-          },
-          "required": true
-        },
         "responses": {
-          "204": {
-            "description": "No Content"
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CollectionAdminCollectionSection"
+                }
+              }
+            },
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -68961,36 +69854,6 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unsupported Media Type"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -69037,19 +69900,17 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Add a catalog item if absent; existing positions are preserved.",
+        "summary": "List the administrator Home and library page rows that show a collection. Rows profiles added themselves are not listed.",
         "tags": [
           "admin-collections"
         ],
         "x-silo-class": "acting_admin",
-        "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/collections/{id}/poster": {
-      "put": {
-        "operationId": "uploadAdminCollectionPoster",
+    "/api/v2/admin/collections/{id}/sync": {
+      "post": {
+        "operationId": "syncAdminCollection",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -69086,43 +69947,32 @@
               "minLength": 1,
               "type": "string"
             }
-          }
-        ],
-        "requestBody": {
-          "content": {
-            "multipart/form-data": {
-              "encoding": {
-                "image": {
-                  "contentType": "image/jpeg,image/png,image/webp"
-                },
-                "source_url": {
-                  "contentType": "text/plain"
-                }
-              },
-              "schema": {
-                "$ref": "#/components/schemas/AdminCollectionArtworkForm"
-              }
+          },
+          {
+            "in": "header",
+            "name": "If-Match",
+            "schema": {
+              "type": "string"
             }
           },
-          "required": true
-        },
+          {
+            "in": "header",
+            "name": "If-None-Match",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AdminCollection"
+                  "$ref": "#/components/schemas/AdminCollectionSyncRun"
                 }
               }
             },
-            "description": "OK",
-            "headers": {
-              "ETag": {
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -69174,36 +70024,6 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unsupported Media Type"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -69250,7 +70070,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Upload bounded poster artwork or download its source after definition save.",
+        "summary": "Synchronize an imported collection once. Automatic retry is unsafe.",
         "tags": [
           "admin-collections"
         ],
@@ -69260,10 +70080,18 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/collections/{id}/sections": {
+    "/api/v2/admin/dashboard/capabilities": {
       "get": {
-        "operationId": "listAdminCollectionSections",
+        "operationId": "getAdminDashboardCapabilities",
         "parameters": [
+          {
+            "description": "Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed.",
+            "in": "header",
+            "name": "If-Match",
+            "schema": {
+              "type": "string"
+            }
+          },
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
             "in": "header",
@@ -69286,27 +70114,6 @@
               "type": "string"
             }
           },
-          {
-            "description": "Opaque identifier",
-            "in": "path",
-            "name": "id",
-            "required": true,
-            "schema": {
-              "description": "Opaque identifier",
-              "examples": [
-                "1"
-              ],
-              "minLength": 1,
-              "type": "string"
-            }
-          },
-          {
-            "in": "header",
-            "name": "If-Match",
-            "schema": {
-              "type": "string"
-            }
-          },
           {
             "in": "header",
             "name": "If-None-Match",
@@ -69320,11 +70127,35 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/CollectionAdminCollectionSection"
+                  "$ref": "#/components/schemas/AdminDashboardCapabilities"
                 }
               }
             },
-            "description": "OK"
+            "description": "OK",
+            "headers": {
+              "Cache-Control": {
+                "schema": {
+                  "type": "string"
+                }
+              },
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "304": {
+            "description": "The representation named by If-None-Match is current; no body.",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
           },
           "400": {
             "content": {
@@ -69376,6 +70207,24 @@
             },
             "description": "Not Acceptable"
           },
+          "412": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Precondition Failed",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -69422,17 +70271,17 @@
             "bearerAuth": []
           }
         ],
-        "summary": "List the administrator Home and library page rows that show a collection. Rows profiles added themselves are not listed.",
+        "summary": "Discover dashboard features supported by v2 in this build. Support does not promise dependency readiness; layout storage is not yet available on v2.",
         "tags": [
-          "admin-collections"
+          "admin-observability"
         ],
         "x-silo-class": "acting_admin",
-        "x-silo-service-backed": true
+        "x-silo-conditional": true
       }
     },
-    "/api/v2/admin/collections/{id}/sync": {
-      "post": {
-        "operationId": "syncAdminCollection",
+    "/api/v2/admin/dashboard/layout": {
+      "delete": {
+        "operationId": "resetAdminDashboardLayout",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -69455,46 +70304,11 @@
               ],
               "type": "string"
             }
-          },
-          {
-            "description": "Opaque identifier",
-            "in": "path",
-            "name": "id",
-            "required": true,
-            "schema": {
-              "description": "Opaque identifier",
-              "examples": [
-                "1"
-              ],
-              "minLength": 1,
-              "type": "string"
-            }
-          },
-          {
-            "in": "header",
-            "name": "If-Match",
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "in": "header",
-            "name": "If-None-Match",
-            "schema": {
-              "type": "string"
-            }
           }
         ],
         "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/AdminCollectionSyncRun"
-                }
-              }
-            },
-            "description": "OK"
+          "204": {
+            "description": "No Content"
           },
           "400": {
             "content": {
@@ -69592,19 +70406,17 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Synchronize an imported collection once. Automatic retry is unsafe.",
+        "summary": "Delete this administrator account's stored layout. Already absent is success; no revision or durable receipt. Clients must not automatically replay across another layout write.",
         "tags": [
-          "admin-collections"
+          "admin-observability"
         ],
         "x-silo-class": "acting_admin",
         "x-silo-demo-restricted": true,
         "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
-      }
-    },
-    "/api/v2/admin/dashboard/capabilities": {
+      },
       "get": {
-        "operationId": "getAdminDashboardCapabilities",
+        "operationId": "getAdminDashboardLayout",
         "parameters": [
           {
             "description": "Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed.",
@@ -69649,17 +70461,12 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AdminDashboardCapabilities"
+                  "$ref": "#/components/schemas/AdminDashboardLayout"
                 }
               }
             },
             "description": "OK",
             "headers": {
-              "Cache-Control": {
-                "schema": {
-                  "type": "string"
-                }
-              },
               "ETag": {
                 "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
                 "schema": {
@@ -69793,18 +70600,34 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Discover dashboard features supported by v2 in this build. Support does not promise dependency readiness; layout storage is not yet available on v2.",
+        "summary": "Read this administrator account's stored layout. Null means retain the local/default arrangement. The validator includes the stored generation, including resets, and is required by layout saves.",
         "tags": [
           "admin-observability"
         ],
         "x-silo-class": "acting_admin",
-        "x-silo-conditional": true
-      }
-    },
-    "/api/v2/admin/dashboard/layout": {
-      "delete": {
-        "operationId": "resetAdminDashboardLayout",
+        "x-silo-conditional": true,
+        "x-silo-service-backed": true
+      },
+      "put": {
+        "operationId": "saveAdminDashboardLayout",
         "parameters": [
+          {
+            "description": "The resource's current ETag, or \"*\" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag.",
+            "in": "header",
+            "name": "If-Match",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Optional second precondition, evaluated after If-Match succeeds: \"*\" or any tag matching the current representation is 412 precondition_failed with the current ETag.",
+            "in": "header",
+            "name": "If-None-Match",
+            "schema": {
+              "type": "string"
+            }
+          },
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
             "in": "header",
@@ -69828,9 +70651,27 @@
             }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/AdminDashboardLayoutSaveBody"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
           "204": {
-            "description": "No Content"
+            "description": "No Content",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
           },
           "400": {
             "content": {
@@ -69882,6 +70723,54 @@
             },
             "description": "Not Acceptable"
           },
+          "408": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Timeout"
+          },
+          "412": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Precondition Failed",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "413": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -69892,6 +70781,16 @@
             },
             "description": "Unprocessable Entity"
           },
+          "428": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Precondition Required"
+          },
           "429": {
             "content": {
               "application/problem+json": {
@@ -69928,26 +70827,21 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Delete this administrator account's stored layout. Already absent is success; no revision or durable receipt. Clients must not automatically replay across another layout write.",
+        "summary": "Store this administrator account's client-owned layout object. Requires the original read validator; successful ETag acknowledges this committed write. No automatic replay.",
         "tags": [
           "admin-observability"
         ],
         "x-silo-class": "acting_admin",
         "x-silo-demo-restricted": true,
+        "x-silo-guarded": true,
         "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
-      },
+      }
+    },
+    "/api/v2/admin/devices": {
       "get": {
-        "operationId": "getAdminDashboardLayout",
+        "operationId": "listAdminDevices",
         "parameters": [
-          {
-            "description": "Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed.",
-            "in": "header",
-            "name": "If-Match",
-            "schema": {
-              "type": "string"
-            }
-          },
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
             "in": "header",
@@ -69971,9 +70865,28 @@
             }
           },
           {
-            "in": "header",
-            "name": "If-None-Match",
+            "description": "Page size; default 50, maximum 200",
+            "explode": false,
+            "in": "query",
+            "name": "limit",
             "schema": {
+              "default": 50,
+              "description": "Page size; default 50, maximum 200",
+              "examples": [
+                50
+              ],
+              "format": "int64",
+              "maximum": 200,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "cursor",
+            "schema": {
+              "maxLength": 8192,
               "type": "string"
             }
           }
@@ -69983,30 +70896,11 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AdminDashboardLayout"
+                  "$ref": "#/components/schemas/CollectionAdminDeviceMetadata"
                 }
               }
             },
-            "description": "OK",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
-          },
-          "304": {
-            "description": "The representation named by If-None-Match is current; no body.",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -70058,24 +70952,6 @@
             },
             "description": "Not Acceptable"
           },
-          "412": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Precondition Failed",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -70122,30 +70998,22 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Read this administrator account's stored layout. Null means retain the local/default arrangement. The validator includes the stored generation, including resets, and is required by layout saves.",
+        "summary": "Read device registration and settings metadata across account stores.",
         "tags": [
-          "admin-observability"
+          "admin"
         ],
         "x-silo-class": "acting_admin",
-        "x-silo-conditional": true,
         "x-silo-service-backed": true
-      },
-      "put": {
-        "operationId": "saveAdminDashboardLayout",
+      }
+    },
+    "/api/v2/admin/devices/capabilities": {
+      "get": {
+        "operationId": "getAdminDeviceCapabilities",
         "parameters": [
           {
-            "description": "The resource's current ETag, or \"*\" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag.",
+            "description": "Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed.",
             "in": "header",
             "name": "If-Match",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "description": "Optional second precondition, evaluated after If-Match succeeds: \"*\" or any tag matching the current representation is 412 precondition_failed with the current ETag.",
-            "in": "header",
-            "name": "If-None-Match",
             "schema": {
               "type": "string"
             }
@@ -70171,21 +71039,41 @@
               ],
               "type": "string"
             }
+          },
+          {
+            "in": "header",
+            "name": "If-None-Match",
+            "schema": {
+              "type": "string"
+            }
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/AdminDashboardLayoutSaveBody"
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AdminDeviceCapabilitiesOutputBody"
+                }
+              }
+            },
+            "description": "OK",
+            "headers": {
+              "Cache-Control": {
+                "schema": {
+                  "type": "string"
+                }
+              },
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
               }
             }
           },
-          "required": true
-        },
-        "responses": {
-          "204": {
-            "description": "No Content",
+          "304": {
+            "description": "The representation named by If-None-Match is current; no body.",
             "headers": {
               "ETag": {
                 "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
@@ -70245,16 +71133,6 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
           "412": {
             "content": {
               "application/problem+json": {
@@ -70273,26 +71151,6 @@
               }
             }
           },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unsupported Media Type"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -70303,16 +71161,6 @@
             },
             "description": "Unprocessable Entity"
           },
-          "428": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Precondition Required"
-          },
           "429": {
             "content": {
               "application/problem+json": {
@@ -70349,20 +71197,18 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Store this administrator account's client-owned layout object. Requires the original read validator; successful ETag acknowledges this committed write. No automatic replay.",
+        "summary": "Read device registration and settings metadata across account stores.",
         "tags": [
-          "admin-observability"
+          "admin"
         ],
         "x-silo-class": "acting_admin",
-        "x-silo-demo-restricted": true,
-        "x-silo-guarded": true,
-        "x-silo-retry-safety": "non_retryable",
+        "x-silo-conditional": true,
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/devices": {
+    "/api/v2/admin/devices/{user_id}/{device_id}": {
       "get": {
-        "operationId": "listAdminDevices",
+        "operationId": "getAdminDevice",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -70387,28 +71233,26 @@
             }
           },
           {
-            "description": "Page size; default 50, maximum 200",
-            "explode": false,
-            "in": "query",
-            "name": "limit",
+            "description": "Opaque identifier",
+            "in": "path",
+            "name": "user_id",
+            "required": true,
             "schema": {
-              "default": 50,
-              "description": "Page size; default 50, maximum 200",
+              "description": "Opaque identifier",
               "examples": [
-                50
+                "1"
               ],
-              "format": "int64",
-              "maximum": 200,
-              "minimum": 1,
-              "type": "integer"
+              "minLength": 1,
+              "type": "string"
             }
           },
           {
-            "explode": false,
-            "in": "query",
-            "name": "cursor",
+            "in": "path",
+            "name": "device_id",
+            "required": true,
             "schema": {
-              "maxLength": 8192,
+              "maxLength": 256,
+              "minLength": 1,
               "type": "string"
             }
           }
@@ -70418,7 +71262,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/CollectionAdminDeviceMetadata"
+                  "$ref": "#/components/schemas/AdminDeviceDetail"
                 }
               }
             },
@@ -70528,18 +71372,10 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/devices/capabilities": {
+    "/api/v2/admin/diagnostics/reports": {
       "get": {
-        "operationId": "getAdminDeviceCapabilities",
+        "operationId": "listAdminDiagnosticReports",
         "parameters": [
-          {
-            "description": "Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed.",
-            "in": "header",
-            "name": "If-Match",
-            "schema": {
-              "type": "string"
-            }
-          },
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
             "in": "header",
@@ -70563,9 +71399,82 @@
             }
           },
           {
-            "in": "header",
-            "name": "If-None-Match",
+            "description": "Page size; default 50, maximum 200",
+            "explode": false,
+            "in": "query",
+            "name": "limit",
+            "schema": {
+              "default": 50,
+              "description": "Page size; default 50, maximum 200",
+              "examples": [
+                50
+              ],
+              "format": "int64",
+              "maximum": 200,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "cursor",
+            "schema": {
+              "maxLength": 8192,
+              "type": "string"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "user_id",
+            "schema": {
+              "pattern": "^[1-9][0-9]*$",
+              "type": "string"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "platform",
+            "schema": {
+              "maxLength": 64,
+              "type": "string"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "report_type",
+            "schema": {
+              "maxLength": 64,
+              "type": "string"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "from",
+            "schema": {
+              "format": "date-time",
+              "type": "string"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "to",
+            "schema": {
+              "format": "date-time",
+              "type": "string"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "short_id",
             "schema": {
+              "maxLength": 64,
               "type": "string"
             }
           }
@@ -70575,35 +71484,11 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AdminDeviceCapabilitiesOutputBody"
+                  "$ref": "#/components/schemas/CollectionAdminDiagnosticSummary"
                 }
               }
             },
-            "description": "OK",
-            "headers": {
-              "Cache-Control": {
-                "schema": {
-                  "type": "string"
-                }
-              },
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
-          },
-          "304": {
-            "description": "The representation named by If-None-Match is current; no body.",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -70655,24 +71540,6 @@
             },
             "description": "Not Acceptable"
           },
-          "412": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Precondition Failed",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -70719,18 +71586,17 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Read device registration and settings metadata across account stores.",
+        "summary": "Page diagnostic report summaries without loading their manifests.",
         "tags": [
-          "admin"
+          "admin-observability"
         ],
         "x-silo-class": "acting_admin",
-        "x-silo-conditional": true,
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/devices/{user_id}/{device_id}": {
-      "get": {
-        "operationId": "getAdminDevice",
+    "/api/v2/admin/diagnostics/reports/{id}": {
+      "delete": {
+        "operationId": "deleteAdminDiagnosticReport",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -70755,40 +71621,19 @@
             }
           },
           {
-            "description": "Opaque identifier",
             "in": "path",
-            "name": "user_id",
-            "required": true,
-            "schema": {
-              "description": "Opaque identifier",
-              "examples": [
-                "1"
-              ],
-              "minLength": 1,
-              "type": "string"
-            }
-          },
-          {
-            "in": "path",
-            "name": "device_id",
+            "name": "id",
             "required": true,
             "schema": {
-              "maxLength": 256,
+              "maxLength": 128,
               "minLength": 1,
               "type": "string"
             }
           }
         ],
         "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/AdminDeviceDetail"
-                }
-              }
-            },
-            "description": "OK"
+          "204": {
+            "description": "No Content"
           },
           "400": {
             "content": {
@@ -70886,17 +71731,17 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Read device registration and settings metadata across account stores.",
+        "summary": "Delete report metadata synchronously, with best-effort stored bundle cleanup. An already absent report is success.",
         "tags": [
-          "admin"
+          "admin-observability"
         ],
         "x-silo-class": "acting_admin",
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "natural_idempotent",
         "x-silo-service-backed": true
-      }
-    },
-    "/api/v2/admin/diagnostics/reports": {
+      },
       "get": {
-        "operationId": "listAdminDiagnosticReports",
+        "operationId": "getAdminDiagnosticReport",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -70921,82 +71766,12 @@
             }
           },
           {
-            "description": "Page size; default 50, maximum 200",
-            "explode": false,
-            "in": "query",
-            "name": "limit",
-            "schema": {
-              "default": 50,
-              "description": "Page size; default 50, maximum 200",
-              "examples": [
-                50
-              ],
-              "format": "int64",
-              "maximum": 200,
-              "minimum": 1,
-              "type": "integer"
-            }
-          },
-          {
-            "explode": false,
-            "in": "query",
-            "name": "cursor",
-            "schema": {
-              "maxLength": 8192,
-              "type": "string"
-            }
-          },
-          {
-            "explode": false,
-            "in": "query",
-            "name": "user_id",
-            "schema": {
-              "pattern": "^[1-9][0-9]*$",
-              "type": "string"
-            }
-          },
-          {
-            "explode": false,
-            "in": "query",
-            "name": "platform",
-            "schema": {
-              "maxLength": 64,
-              "type": "string"
-            }
-          },
-          {
-            "explode": false,
-            "in": "query",
-            "name": "report_type",
-            "schema": {
-              "maxLength": 64,
-              "type": "string"
-            }
-          },
-          {
-            "explode": false,
-            "in": "query",
-            "name": "from",
-            "schema": {
-              "format": "date-time",
-              "type": "string"
-            }
-          },
-          {
-            "explode": false,
-            "in": "query",
-            "name": "to",
-            "schema": {
-              "format": "date-time",
-              "type": "string"
-            }
-          },
-          {
-            "explode": false,
-            "in": "query",
-            "name": "short_id",
+            "in": "path",
+            "name": "id",
+            "required": true,
             "schema": {
-              "maxLength": 64,
+              "maxLength": 128,
+              "minLength": 1,
               "type": "string"
             }
           }
@@ -71006,7 +71781,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/CollectionAdminDiagnosticSummary"
+                  "$ref": "#/components/schemas/AdminDiagnosticDetail"
                 }
               }
             },
@@ -71108,7 +71883,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Page diagnostic report summaries without loading their manifests.",
+        "summary": "Read diagnostic report metadata and its original manifest.",
         "tags": [
           "admin-observability"
         ],
@@ -71116,10 +71891,20 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/diagnostics/reports/{id}": {
-      "delete": {
-        "operationId": "deleteAdminDiagnosticReport",
+    "/api/v2/admin/diagnostics/reports/{id}/download": {
+      "get": {
+        "operationId": "downloadAdminDiagnosticReport",
         "parameters": [
+          {
+            "in": "path",
+            "name": "id",
+            "required": true,
+            "schema": {
+              "maxLength": 128,
+              "minLength": 1,
+              "type": "string"
+            }
+          },
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
             "in": "header",
@@ -71141,21 +71926,37 @@
               ],
               "type": "string"
             }
-          },
-          {
-            "in": "path",
-            "name": "id",
-            "required": true,
-            "schema": {
-              "maxLength": 128,
-              "minLength": 1,
-              "type": "string"
-            }
           }
         ],
         "responses": {
-          "204": {
-            "description": "No Content"
+          "200": {
+            "content": {
+              "application/gzip": {
+                "schema": {
+                  "contentMediaType": "application/octet-stream",
+                  "format": "binary",
+                  "type": "string"
+                }
+              }
+            },
+            "description": "Complete gzip-compressed diagnostic bundle",
+            "headers": {
+              "Accept-Ranges": {
+                "schema": {
+                  "type": "string"
+                }
+              },
+              "Content-Disposition": {
+                "schema": {
+                  "type": "string"
+                }
+              },
+              "Content-Length": {
+                "schema": {
+                  "type": "integer"
+                }
+              }
+            }
           },
           "400": {
             "content": {
@@ -71197,7 +71998,7 @@
             },
             "description": "Not Found"
           },
-          "406": {
+          "409": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -71205,7 +72006,7 @@
                 }
               }
             },
-            "description": "Not Acceptable"
+            "description": "Conflict"
           },
           "422": {
             "content": {
@@ -71253,17 +72054,19 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Delete report metadata synchronously, with best-effort stored bundle cleanup. An already absent report is success.",
+        "summary": "Stream a ready diagnostic bundle through the API host. Range requests receive the complete bundle; no presigned URL is returned.",
         "tags": [
           "admin-observability"
         ],
         "x-silo-class": "acting_admin",
-        "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "natural_idempotent",
+        "x-silo-raw-protocol": "diagnostic-bundle",
+        "x-silo-raw-reason": "The existing administrator consumer downloads a gzip archive; bytes must not pass through JSON encoding or response buffering.",
         "x-silo-service-backed": true
-      },
+      }
+    },
+    "/api/v2/admin/downloads/devices": {
       "get": {
-        "operationId": "getAdminDiagnosticReport",
+        "operationId": "listAdminDownloadDevices",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -71288,12 +72091,73 @@
             }
           },
           {
-            "in": "path",
-            "name": "id",
-            "required": true,
+            "description": "Page size; default 50, maximum 200",
+            "explode": false,
+            "in": "query",
+            "name": "limit",
             "schema": {
-              "maxLength": 128,
-              "minLength": 1,
+              "default": 50,
+              "description": "Page size; default 50, maximum 200",
+              "examples": [
+                50
+              ],
+              "format": "int64",
+              "maximum": 200,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "cursor",
+            "schema": {
+              "maxLength": 8192,
+              "type": "string"
+            }
+          },
+          {
+            "description": "Account, profile or device name",
+            "explode": false,
+            "in": "query",
+            "name": "q",
+            "schema": {
+              "description": "Account, profile or device name",
+              "maxLength": 200,
+              "type": "string"
+            }
+          },
+          {
+            "description": "Only devices not seen within stale_device_days",
+            "explode": false,
+            "in": "query",
+            "name": "stale",
+            "schema": {
+              "description": "Only devices not seen within stale_device_days",
+              "type": "boolean"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "platform",
+            "schema": {
+              "maxLength": 64,
+              "type": "string"
+            }
+          },
+          {
+            "description": "last_seen: longest unseen first. size: most bytes on the device first.",
+            "explode": false,
+            "in": "query",
+            "name": "sort",
+            "schema": {
+              "default": "last_seen",
+              "description": "last_seen: longest unseen first. size: most bytes on the device first.",
+              "enum": [
+                "last_seen",
+                "size"
+              ],
               "type": "string"
             }
           }
@@ -71303,7 +72167,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AdminDiagnosticDetail"
+                  "$ref": "#/components/schemas/CollectionAdminDownloadDevice"
                 }
               }
             },
@@ -71405,28 +72269,18 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Read diagnostic report metadata and its original manifest.",
+        "summary": "List every device that holds managed downloads, across accounts.",
         "tags": [
-          "admin-observability"
+          "admin"
         ],
         "x-silo-class": "acting_admin",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/diagnostics/reports/{id}/download": {
+    "/api/v2/admin/downloads/entries": {
       "get": {
-        "operationId": "downloadAdminDiagnosticReport",
+        "operationId": "listAdminDownloadEntries",
         "parameters": [
-          {
-            "in": "path",
-            "name": "id",
-            "required": true,
-            "schema": {
-              "maxLength": 128,
-              "minLength": 1,
-              "type": "string"
-            }
-          },
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
             "in": "header",
@@ -71448,37 +72302,81 @@
               ],
               "type": "string"
             }
+          },
+          {
+            "description": "Page size; default 50, maximum 200",
+            "explode": false,
+            "in": "query",
+            "name": "limit",
+            "schema": {
+              "default": 50,
+              "description": "Page size; default 50, maximum 200",
+              "examples": [
+                50
+              ],
+              "format": "int64",
+              "maximum": 200,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "cursor",
+            "schema": {
+              "maxLength": 8192,
+              "type": "string"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "user_id",
+            "schema": {
+              "maxLength": 10,
+              "pattern": "^([1-9][0-9]*)?$",
+              "type": "string"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "profile_id",
+            "schema": {
+              "maxLength": 1024,
+              "type": "string"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "device_id",
+            "schema": {
+              "maxLength": 128,
+              "type": "string"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "status",
+            "schema": {
+              "maxLength": 32,
+              "type": "string"
+            }
           }
         ],
         "responses": {
           "200": {
             "content": {
-              "application/gzip": {
+              "application/json": {
                 "schema": {
-                  "contentMediaType": "application/octet-stream",
-                  "format": "binary",
-                  "type": "string"
+                  "$ref": "#/components/schemas/CollectionAdminDownloadEntry"
                 }
               }
             },
-            "description": "Complete gzip-compressed diagnostic bundle",
-            "headers": {
-              "Accept-Ranges": {
-                "schema": {
-                  "type": "string"
-                }
-              },
-              "Content-Disposition": {
-                "schema": {
-                  "type": "string"
-                }
-              },
-              "Content-Length": {
-                "schema": {
-                  "type": "integer"
-                }
-              }
-            }
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -71520,7 +72418,7 @@
             },
             "description": "Not Found"
           },
-          "409": {
+          "406": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -71528,7 +72426,7 @@
                 }
               }
             },
-            "description": "Conflict"
+            "description": "Not Acceptable"
           },
           "422": {
             "content": {
@@ -71576,19 +72474,17 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Stream a ready diagnostic bundle through the API host. Range requests receive the complete bundle; no presigned URL is returned.",
+        "summary": "List managed device downloads across accounts, newest first, optionally for one account, profile, device or status.",
         "tags": [
-          "admin-observability"
+          "admin"
         ],
         "x-silo-class": "acting_admin",
-        "x-silo-raw-protocol": "diagnostic-bundle",
-        "x-silo-raw-reason": "The existing administrator consumer downloads a gzip archive; bytes must not pass through JSON encoding or response buffering.",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/downloads/devices": {
+    "/api/v2/admin/downloads/preparations": {
       "get": {
-        "operationId": "listAdminDownloadDevices",
+        "operationId": "listAdminDownloadPreparations",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -71613,75 +72509,18 @@
             }
           },
           {
-            "description": "Page size; default 50, maximum 200",
+            "description": "Maximum items; counts always cover every listed job",
             "explode": false,
             "in": "query",
             "name": "limit",
             "schema": {
-              "default": 50,
-              "description": "Page size; default 50, maximum 200",
-              "examples": [
-                50
-              ],
+              "default": 200,
+              "description": "Maximum items; counts always cover every listed job",
               "format": "int64",
-              "maximum": 200,
+              "maximum": 500,
               "minimum": 1,
               "type": "integer"
             }
-          },
-          {
-            "explode": false,
-            "in": "query",
-            "name": "cursor",
-            "schema": {
-              "maxLength": 8192,
-              "type": "string"
-            }
-          },
-          {
-            "description": "Account, profile or device name",
-            "explode": false,
-            "in": "query",
-            "name": "q",
-            "schema": {
-              "description": "Account, profile or device name",
-              "maxLength": 200,
-              "type": "string"
-            }
-          },
-          {
-            "description": "Only devices not seen within stale_device_days",
-            "explode": false,
-            "in": "query",
-            "name": "stale",
-            "schema": {
-              "description": "Only devices not seen within stale_device_days",
-              "type": "boolean"
-            }
-          },
-          {
-            "explode": false,
-            "in": "query",
-            "name": "platform",
-            "schema": {
-              "maxLength": 64,
-              "type": "string"
-            }
-          },
-          {
-            "description": "last_seen: longest unseen first. size: most bytes on the device first.",
-            "explode": false,
-            "in": "query",
-            "name": "sort",
-            "schema": {
-              "default": "last_seen",
-              "description": "last_seen: longest unseen first. size: most bytes on the device first.",
-              "enum": [
-                "last_seen",
-                "size"
-              ],
-              "type": "string"
-            }
           }
         ],
         "responses": {
@@ -71689,7 +72528,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/CollectionAdminDownloadDevice"
+                  "$ref": "#/components/schemas/AdminDownloadPreparationsOutputBody"
                 }
               }
             },
@@ -71791,7 +72630,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "List every device that holds managed downloads, across accounts.",
+        "summary": "Read the offline-download preparation queue: running, queued and retrying jobs with live progress, and failures from the last 24 hours.",
         "tags": [
           "admin"
         ],
@@ -71799,9 +72638,9 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/downloads/entries": {
-      "get": {
-        "operationId": "listAdminDownloadEntries",
+    "/api/v2/admin/downloads/preparations/cancel": {
+      "post": {
+        "operationId": "cancelAdminDownloadPreparations",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -71824,77 +72663,24 @@
               ],
               "type": "string"
             }
-          },
-          {
-            "description": "Page size; default 50, maximum 200",
-            "explode": false,
-            "in": "query",
-            "name": "limit",
-            "schema": {
-              "default": 50,
-              "description": "Page size; default 50, maximum 200",
-              "examples": [
-                50
-              ],
-              "format": "int64",
-              "maximum": 200,
-              "minimum": 1,
-              "type": "integer"
-            }
-          },
-          {
-            "explode": false,
-            "in": "query",
-            "name": "cursor",
-            "schema": {
-              "maxLength": 8192,
-              "type": "string"
-            }
-          },
-          {
-            "explode": false,
-            "in": "query",
-            "name": "user_id",
-            "schema": {
-              "maxLength": 10,
-              "pattern": "^([1-9][0-9]*)?$",
-              "type": "string"
-            }
-          },
-          {
-            "explode": false,
-            "in": "query",
-            "name": "profile_id",
-            "schema": {
-              "maxLength": 1024,
-              "type": "string"
-            }
-          },
-          {
-            "explode": false,
-            "in": "query",
-            "name": "device_id",
-            "schema": {
-              "maxLength": 128,
-              "type": "string"
-            }
-          },
-          {
-            "explode": false,
-            "in": "query",
-            "name": "status",
-            "schema": {
-              "maxLength": 32,
-              "type": "string"
-            }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/AdminDownloadPreparationActionInputBody"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/CollectionAdminDownloadEntry"
+                  "$ref": "#/components/schemas/AdminDownloadPreparationActionOutputBody"
                 }
               }
             },
@@ -71950,6 +72736,36 @@
             },
             "description": "Not Acceptable"
           },
+          "408": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Timeout"
+          },
+          "413": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -71996,18 +72812,28 @@
             "bearerAuth": []
           }
         ],
-        "summary": "List managed device downloads across accounts, newest first, optionally for one account, profile, device or status.",
+        "summary": "Cancel offline-download preparation jobs, including failed ones. A running encode stops, the job is removed, and every download still waiting on it fails with the message 'Canceled by an administrator'. A job that already finished preparing is not affected.",
         "tags": [
           "admin"
         ],
         "x-silo-class": "acting_admin",
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "natural_idempotent",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/downloads/preparations": {
+    "/api/v2/admin/downloads/preparations/capabilities": {
       "get": {
-        "operationId": "listAdminDownloadPreparations",
+        "operationId": "getAdminDownloadPreparationCapabilities",
         "parameters": [
+          {
+            "description": "Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed.",
+            "in": "header",
+            "name": "If-Match",
+            "schema": {
+              "type": "string"
+            }
+          },
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
             "in": "header",
@@ -72031,17 +72857,10 @@
             }
           },
           {
-            "description": "Maximum items; counts always cover every listed job",
-            "explode": false,
-            "in": "query",
-            "name": "limit",
+            "in": "header",
+            "name": "If-None-Match",
             "schema": {
-              "default": 200,
-              "description": "Maximum items; counts always cover every listed job",
-              "format": "int64",
-              "maximum": 500,
-              "minimum": 1,
-              "type": "integer"
+              "type": "string"
             }
           }
         ],
@@ -72050,11 +72869,35 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AdminDownloadPreparationsOutputBody"
+                  "$ref": "#/components/schemas/AdminDownloadPreparationCapabilitiesOutputBody"
                 }
               }
             },
-            "description": "OK"
+            "description": "OK",
+            "headers": {
+              "Cache-Control": {
+                "schema": {
+                  "type": "string"
+                }
+              },
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "304": {
+            "description": "The representation named by If-None-Match is current; no body.",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
           },
           "400": {
             "content": {
@@ -72106,6 +72949,24 @@
             },
             "description": "Not Acceptable"
           },
+          "412": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Precondition Failed",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -72152,17 +73013,18 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Read the offline-download preparation queue: running, queued and retrying jobs with live progress, and failures from the last 24 hours.",
+        "summary": "Discover the admin view of offline-download preparation.",
         "tags": [
           "admin"
         ],
         "x-silo-class": "acting_admin",
+        "x-silo-conditional": true,
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/downloads/preparations/cancel": {
+    "/api/v2/admin/downloads/preparations/pause": {
       "post": {
-        "operationId": "cancelAdminDownloadPreparations",
+        "operationId": "pauseAdminDownloadPreparations",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -72334,7 +73196,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Cancel offline-download preparation jobs, including failed ones. A running encode stops, the job is removed, and every download still waiting on it fails with the message 'Canceled by an administrator'. A job that already finished preparing is not affected.",
+        "summary": "Pause offline-download preparation jobs. A paused job keeps its place in the queue and no worker claims it until it is resumed. A running encode stops and restarts from the beginning when resumed; the stopped attempt does not count against the job. Waiting downloads stay preparing.",
         "tags": [
           "admin"
         ],
@@ -72344,18 +73206,10 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/downloads/preparations/capabilities": {
-      "get": {
-        "operationId": "getAdminDownloadPreparationCapabilities",
+    "/api/v2/admin/downloads/preparations/resume": {
+      "post": {
+        "operationId": "resumeAdminDownloadPreparations",
         "parameters": [
-          {
-            "description": "Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed.",
-            "in": "header",
-            "name": "If-Match",
-            "schema": {
-              "type": "string"
-            }
-          },
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
             "in": "header",
@@ -72377,49 +73231,28 @@
               ],
               "type": "string"
             }
-          },
-          {
-            "in": "header",
-            "name": "If-None-Match",
-            "schema": {
-              "type": "string"
-            }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/AdminDownloadPreparationActionInputBody"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AdminDownloadPreparationCapabilitiesOutputBody"
+                  "$ref": "#/components/schemas/AdminDownloadPreparationActionOutputBody"
                 }
               }
             },
-            "description": "OK",
-            "headers": {
-              "Cache-Control": {
-                "schema": {
-                  "type": "string"
-                }
-              },
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
-          },
-          "304": {
-            "description": "The representation named by If-None-Match is current; no body.",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -72471,7 +73304,7 @@
             },
             "description": "Not Acceptable"
           },
-          "412": {
+          "408": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -72479,15 +73312,27 @@
                 }
               }
             },
-            "description": "Precondition Failed",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+            "description": "Request Timeout"
+          },
+          "413": {
+            "content": {
+              "application/problem+json": {
                 "schema": {
-                  "type": "string"
+                  "$ref": "#/components/schemas/Problem"
                 }
               }
-            }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
           },
           "422": {
             "content": {
@@ -72535,18 +73380,19 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Discover the admin view of offline-download preparation.",
+        "summary": "Resume paused offline-download preparation jobs. Each job returns to the queue at its original position, or waits out a pending retry backoff.",
         "tags": [
           "admin"
         ],
         "x-silo-class": "acting_admin",
-        "x-silo-conditional": true,
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "natural_idempotent",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/downloads/preparations/pause": {
+    "/api/v2/admin/downloads/revoke": {
       "post": {
-        "operationId": "pauseAdminDownloadPreparations",
+        "operationId": "revokeAdminDownloads",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -72575,7 +73421,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/AdminDownloadPreparationActionInputBody"
+                "$ref": "#/components/schemas/AdminDownloadRevokeInputBody"
               }
             }
           },
@@ -72586,7 +73432,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AdminDownloadPreparationActionOutputBody"
+                  "$ref": "#/components/schemas/AdminDownloadRevokeOutputBody"
                 }
               }
             },
@@ -72718,7 +73564,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Pause offline-download preparation jobs. A paused job keeps its place in the queue and no worker claims it until it is resumed. A running encode stops and restarts from the beginning when resumed; the stopped attempt does not count against the job. Waiting downloads stay preparing.",
+        "summary": "Revoke device downloads. The Prairie app deletes each copy the next time the device syncs and confirms by deleting the download. The server stops serving the file at once. A revoked episode is excluded from its series monitor; a preparation only revoked downloads waited on is canceled.",
         "tags": [
           "admin"
         ],
@@ -72728,9 +73574,9 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/downloads/preparations/resume": {
-      "post": {
-        "operationId": "resumeAdminDownloadPreparations",
+    "/api/v2/admin/downloads/storage": {
+      "get": {
+        "operationId": "getAdminDownloadStorage",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -72755,22 +73601,12 @@
             }
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/AdminDownloadPreparationActionInputBody"
-              }
-            }
-          },
-          "required": true
-        },
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AdminDownloadPreparationActionOutputBody"
+                  "$ref": "#/components/schemas/AdminDownloadStorage"
                 }
               }
             },
@@ -72826,36 +73662,6 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unsupported Media Type"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -72902,20 +73708,26 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Resume paused offline-download preparation jobs. Each job returns to the queue at its original position, or waits out a pending retry backoff.",
+        "summary": "Read prepared-download storage at the server and every transcode node: what is on disk, what Prairie's records say, budgets, and files nothing accounts for.",
         "tags": [
           "admin"
         ],
         "x-silo-class": "acting_admin",
-        "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "natural_idempotent",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/downloads/revoke": {
-      "post": {
-        "operationId": "revokeAdminDownloads",
+    "/api/v2/admin/downloads/storage/capabilities": {
+      "get": {
+        "operationId": "getAdminDownloadStorageCapabilities",
         "parameters": [
+          {
+            "description": "Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed.",
+            "in": "header",
+            "name": "If-Match",
+            "schema": {
+              "type": "string"
+            }
+          },
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
             "in": "header",
@@ -72937,28 +73749,49 @@
               ],
               "type": "string"
             }
+          },
+          {
+            "in": "header",
+            "name": "If-None-Match",
+            "schema": {
+              "type": "string"
+            }
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/AdminDownloadRevokeInputBody"
-              }
-            }
-          },
-          "required": true
-        },
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AdminDownloadRevokeOutputBody"
+                  "$ref": "#/components/schemas/AdminDownloadStorageCapabilitiesOutputBody"
                 }
               }
             },
-            "description": "OK"
+            "description": "OK",
+            "headers": {
+              "Cache-Control": {
+                "schema": {
+                  "type": "string"
+                }
+              },
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "304": {
+            "description": "The representation named by If-None-Match is current; no body.",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
           },
           "400": {
             "content": {
@@ -73010,17 +73843,7 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
-          "413": {
+          "412": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -73028,17 +73851,15 @@
                 }
               }
             },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
+            "description": "Precondition Failed",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
                 "schema": {
-                  "$ref": "#/components/schemas/Problem"
+                  "type": "string"
                 }
               }
-            },
-            "description": "Unsupported Media Type"
+            }
           },
           "422": {
             "content": {
@@ -73086,19 +73907,18 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Revoke device downloads. The Prairie app deletes each copy the next time the device syncs and confirms by deleting the download. The server stops serving the file at once. A revoked episode is excluded from its series monitor; a preparation only revoked downloads waited on is canceled.",
+        "summary": "Discover the admin view of prepared-download storage.",
         "tags": [
           "admin"
         ],
         "x-silo-class": "acting_admin",
-        "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "natural_idempotent",
+        "x-silo-conditional": true,
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/downloads/storage": {
+    "/api/v2/admin/downloads/storage/events": {
       "get": {
-        "operationId": "getAdminDownloadStorage",
+        "operationId": "listAdminDownloadStorageEvents",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -73121,6 +73941,66 @@
               ],
               "type": "string"
             }
+          },
+          {
+            "description": "Page size; default 50, maximum 200",
+            "explode": false,
+            "in": "query",
+            "name": "limit",
+            "schema": {
+              "default": 50,
+              "description": "Page size; default 50, maximum 200",
+              "examples": [
+                50
+              ],
+              "format": "int64",
+              "maximum": 200,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "cursor",
+            "schema": {
+              "maxLength": 8192,
+              "type": "string"
+            }
+          },
+          {
+            "description": "Only this reason",
+            "explode": false,
+            "in": "query",
+            "name": "reason",
+            "schema": {
+              "description": "Only this reason",
+              "maxLength": 32,
+              "type": "string"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "location",
+            "schema": {
+              "maxLength": 32,
+              "pattern": "^(server|device|node:[1-9][0-9]*)?$",
+              "type": "string"
+            }
+          },
+          {
+            "description": "Only the last N days; 0 for all kept history (90 days)",
+            "explode": false,
+            "in": "query",
+            "name": "days",
+            "schema": {
+              "description": "Only the last N days; 0 for all kept history (90 days)",
+              "format": "int64",
+              "maximum": 90,
+              "minimum": 0,
+              "type": "integer"
+            }
           }
         ],
         "responses": {
@@ -73128,409 +74008,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AdminDownloadStorage"
-                }
-              }
-            },
-            "description": "OK"
-          },
-          "400": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Bad Request"
-          },
-          "401": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unauthorized"
-          },
-          "403": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Forbidden"
-          },
-          "404": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Not Found"
-          },
-          "406": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Not Acceptable"
-          },
-          "422": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unprocessable Entity"
-          },
-          "429": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Too Many Requests"
-          },
-          "500": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Internal Server Error"
-          },
-          "503": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Service Unavailable"
-          }
-        },
-        "security": [
-          {
-            "bearerAuth": []
-          }
-        ],
-        "summary": "Read prepared-download storage at the server and every transcode node: what is on disk, what Prairie's records say, budgets, and files nothing accounts for.",
-        "tags": [
-          "admin"
-        ],
-        "x-silo-class": "acting_admin",
-        "x-silo-service-backed": true
-      }
-    },
-    "/api/v2/admin/downloads/storage/capabilities": {
-      "get": {
-        "operationId": "getAdminDownloadStorageCapabilities",
-        "parameters": [
-          {
-            "description": "Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed.",
-            "in": "header",
-            "name": "If-Match",
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
-            "in": "header",
-            "name": "X-Profile-Id",
-            "schema": {
-              "examples": [
-                "1"
-              ],
-              "type": "string"
-            }
-          },
-          {
-            "description": "Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked",
-            "in": "header",
-            "name": "X-Profile-Token",
-            "schema": {
-              "examples": [
-                "pvt_5f3a9c1e7b2d4e8fa0c6"
-              ],
-              "type": "string"
-            }
-          },
-          {
-            "in": "header",
-            "name": "If-None-Match",
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/AdminDownloadStorageCapabilitiesOutputBody"
-                }
-              }
-            },
-            "description": "OK",
-            "headers": {
-              "Cache-Control": {
-                "schema": {
-                  "type": "string"
-                }
-              },
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
-          },
-          "304": {
-            "description": "The representation named by If-None-Match is current; no body.",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
-          },
-          "400": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Bad Request"
-          },
-          "401": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unauthorized"
-          },
-          "403": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Forbidden"
-          },
-          "404": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Not Found"
-          },
-          "406": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Not Acceptable"
-          },
-          "412": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Precondition Failed",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
-          },
-          "422": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unprocessable Entity"
-          },
-          "429": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Too Many Requests"
-          },
-          "500": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Internal Server Error"
-          },
-          "503": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Service Unavailable"
-          }
-        },
-        "security": [
-          {
-            "bearerAuth": []
-          }
-        ],
-        "summary": "Discover the admin view of prepared-download storage.",
-        "tags": [
-          "admin"
-        ],
-        "x-silo-class": "acting_admin",
-        "x-silo-conditional": true,
-        "x-silo-service-backed": true
-      }
-    },
-    "/api/v2/admin/downloads/storage/events": {
-      "get": {
-        "operationId": "listAdminDownloadStorageEvents",
-        "parameters": [
-          {
-            "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
-            "in": "header",
-            "name": "X-Profile-Id",
-            "schema": {
-              "examples": [
-                "1"
-              ],
-              "type": "string"
-            }
-          },
-          {
-            "description": "Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked",
-            "in": "header",
-            "name": "X-Profile-Token",
-            "schema": {
-              "examples": [
-                "pvt_5f3a9c1e7b2d4e8fa0c6"
-              ],
-              "type": "string"
-            }
-          },
-          {
-            "description": "Page size; default 50, maximum 200",
-            "explode": false,
-            "in": "query",
-            "name": "limit",
-            "schema": {
-              "default": 50,
-              "description": "Page size; default 50, maximum 200",
-              "examples": [
-                50
-              ],
-              "format": "int64",
-              "maximum": 200,
-              "minimum": 1,
-              "type": "integer"
-            }
-          },
-          {
-            "explode": false,
-            "in": "query",
-            "name": "cursor",
-            "schema": {
-              "maxLength": 8192,
-              "type": "string"
-            }
-          },
-          {
-            "description": "Only this reason",
-            "explode": false,
-            "in": "query",
-            "name": "reason",
-            "schema": {
-              "description": "Only this reason",
-              "maxLength": 32,
-              "type": "string"
-            }
-          },
-          {
-            "explode": false,
-            "in": "query",
-            "name": "location",
-            "schema": {
-              "maxLength": 32,
-              "pattern": "^(server|device|node:[1-9][0-9]*)?$",
-              "type": "string"
-            }
-          },
-          {
-            "description": "Only the last N days; 0 for all kept history (90 days)",
-            "explode": false,
-            "in": "query",
-            "name": "days",
-            "schema": {
-              "description": "Only the last N days; 0 for all kept history (90 days)",
-              "format": "int64",
-              "maximum": 90,
-              "minimum": 0,
-              "type": "integer"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/CollectionAdminDownloadStorageEvent"
+                  "$ref": "#/components/schemas/CollectionAdminDownloadStorageEvent"
                 }
               }
             },
@@ -85961,7 +86439,7 @@
                 }
               }
             },
-            "description": "The job was already canceled."
+            "description": "The job is canceled: it was already canceled, or it was a queued image cache cleanup that this request canceled at once."
           },
           "202": {
             "content": {
@@ -86868,9 +87346,9 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/literary-works/items/{content_id}/candidates": {
-      "get": {
-        "operationId": "listAdminLiteraryCandidates",
+    "/api/v2/admin/libraries/{library_id}/metadata-translation": {
+      "post": {
+        "operationId": "translateLibraryMetadata",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -86895,38 +87373,47 @@
             }
           },
           {
+            "description": "The library",
             "in": "path",
-            "name": "content_id",
+            "name": "library_id",
             "required": true,
             "schema": {
-              "maxLength": 512,
+              "description": "The library",
+              "examples": [
+                "1"
+              ],
               "minLength": 1,
               "type": "string"
             }
-          },
-          {
-            "explode": false,
-            "in": "query",
-            "name": "limit",
-            "schema": {
-              "default": 20,
-              "format": "int64",
-              "maximum": 100,
-              "minimum": 1,
-              "type": "integer"
-            }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/AdminTranslateLibraryInputBody"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
-          "200": {
+          "202": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AdminLiteraryCandidates"
+                  "$ref": "#/components/schemas/MetadataTranslationJob"
                 }
               }
             },
-            "description": "OK"
+            "description": "Accepted",
+            "headers": {
+              "Location": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
           },
           "400": {
             "content": {
@@ -86978,6 +87465,36 @@
             },
             "description": "Not Acceptable"
           },
+          "408": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Timeout"
+          },
+          "413": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -87024,17 +87541,19 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Read bounded ranked literary match candidates.",
+        "summary": "Prewarm a library: persist or reuse an active job that translates the missing descriptions of every item in the library, with their seasons and episodes, into a language. Existing provider, manual and AI text is kept. Progress counts items.",
         "tags": [
           "admin-catalog"
         ],
         "x-silo-class": "acting_admin",
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/literary-works/link": {
-      "post": {
-        "operationId": "linkAdminLiteraryItems",
+    "/api/v2/admin/libraries/{library_id}/metadata-translation/jobs": {
+      "get": {
+        "operationId": "listLibraryMetadataTranslationJobs",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -87057,24 +87576,28 @@
               ],
               "type": "string"
             }
+          },
+          {
+            "description": "The library",
+            "in": "path",
+            "name": "library_id",
+            "required": true,
+            "schema": {
+              "description": "The library",
+              "examples": [
+                "1"
+              ],
+              "minLength": 1,
+              "type": "string"
+            }
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/AdminLiteraryLinkInputBody"
-              }
-            }
-          },
-          "required": true
-        },
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AdminLiteraryLink"
+                  "$ref": "#/components/schemas/AdminMetadataTranslationJobs"
                 }
               }
             },
@@ -87130,36 +87653,6 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unsupported Media Type"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -87206,19 +87699,17 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Link literary editions using the existing catalog service.",
+        "summary": "Read the latest 50 prewarm jobs of a library.",
         "tags": [
           "admin-catalog"
         ],
         "x-silo-class": "acting_admin",
-        "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/literary-works/matches/confirm": {
+    "/api/v2/admin/libraries/{library_id}/metadata-translation/jobs/{job_id}/cancel": {
       "post": {
-        "operationId": "confirmAdminLiteraryMatch",
+        "operationId": "cancelLibraryMetadataTranslation",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -87241,28 +87732,39 @@
               ],
               "type": "string"
             }
-          }
-        ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/AdminLiteraryDecisionInputBody"
-              }
+          },
+          {
+            "description": "The library",
+            "in": "path",
+            "name": "library_id",
+            "required": true,
+            "schema": {
+              "description": "The library",
+              "examples": [
+                "1"
+              ],
+              "minLength": 1,
+              "type": "string"
             }
           },
-          "required": true
-        },
+          {
+            "description": "Opaque identifier",
+            "in": "path",
+            "name": "job_id",
+            "required": true,
+            "schema": {
+              "description": "Opaque identifier",
+              "examples": [
+                "1"
+              ],
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
         "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/AdminLiteraryDecision"
-                }
-              }
-            },
-            "description": "OK"
+          "204": {
+            "description": "No Content"
           },
           "400": {
             "content": {
@@ -87314,36 +87816,6 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unsupported Media Type"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -87390,7 +87862,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Link editions then record an administrator match decision.",
+        "summary": "Request cancellation only for a prewarm job of the library.",
         "tags": [
           "admin-catalog"
         ],
@@ -87400,9 +87872,9 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/literary-works/matches/ignore": {
-      "post": {
-        "operationId": "ignoreAdminLiteraryMatch",
+    "/api/v2/admin/literary-works/items/{content_id}/candidates": {
+      "get": {
+        "operationId": "listAdminLiteraryCandidates",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -87425,24 +87897,36 @@
               ],
               "type": "string"
             }
-          }
-        ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/AdminLiteraryDecisionInputBody"
-              }
+          },
+          {
+            "in": "path",
+            "name": "content_id",
+            "required": true,
+            "schema": {
+              "maxLength": 512,
+              "minLength": 1,
+              "type": "string"
             }
           },
-          "required": true
-        },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "limit",
+            "schema": {
+              "default": 20,
+              "format": "int64",
+              "maximum": 100,
+              "minimum": 1,
+              "type": "integer"
+            }
+          }
+        ],
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AdminLiteraryDecision"
+                  "$ref": "#/components/schemas/AdminLiteraryCandidates"
                 }
               }
             },
@@ -87498,36 +87982,6 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unsupported Media Type"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -87574,19 +88028,17 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Record an administrator decision to ignore a literary match.",
+        "summary": "Read bounded ranked literary match candidates.",
         "tags": [
           "admin-catalog"
         ],
         "x-silo-class": "acting_admin",
-        "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/literary-works/{work_id}/items/{content_id}": {
-      "delete": {
-        "operationId": "unlinkAdminLiteraryItem",
+    "/api/v2/admin/literary-works/link": {
+      "post": {
+        "operationId": "linkAdminLiteraryItems",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -87609,31 +88061,28 @@
               ],
               "type": "string"
             }
-          },
-          {
-            "in": "path",
-            "name": "work_id",
-            "required": true,
-            "schema": {
-              "maxLength": 512,
-              "minLength": 1,
-              "type": "string"
-            }
-          },
-          {
-            "in": "path",
-            "name": "content_id",
-            "required": true,
-            "schema": {
-              "maxLength": 512,
-              "minLength": 1,
-              "type": "string"
-            }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/AdminLiteraryLinkInputBody"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
-          "204": {
-            "description": "No Content"
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AdminLiteraryLink"
+                }
+              }
+            },
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -87685,6 +88134,36 @@
             },
             "description": "Not Acceptable"
           },
+          "408": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Timeout"
+          },
+          "413": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -87731,7 +88210,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Remove an edition from a literary work.",
+        "summary": "Link literary editions using the existing catalog service.",
         "tags": [
           "admin-catalog"
         ],
@@ -87741,9 +88220,9 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/livetv/channels/{channel_id}": {
-      "patch": {
-        "operationId": "updateAdminLiveTVChannel",
+    "/api/v2/admin/literary-works/matches/confirm": {
+      "post": {
+        "operationId": "confirmAdminLiteraryMatch",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -87766,27 +88245,13 @@
               ],
               "type": "string"
             }
-          },
-          {
-            "description": "Opaque identifier",
-            "in": "path",
-            "name": "channel_id",
-            "required": true,
-            "schema": {
-              "description": "Opaque identifier",
-              "examples": [
-                "1"
-              ],
-              "minLength": 1,
-              "type": "string"
-            }
           }
         ],
         "requestBody": {
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/LiveTVChannelUpdate"
+                "$ref": "#/components/schemas/AdminLiteraryDecisionInputBody"
               }
             }
           },
@@ -87797,7 +88262,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/LiveTVChannel"
+                  "$ref": "#/components/schemas/AdminLiteraryDecision"
                 }
               }
             },
@@ -87863,16 +88328,6 @@
             },
             "description": "Request Timeout"
           },
-          "409": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Conflict"
-          },
           "413": {
             "content": {
               "application/problem+json": {
@@ -87923,16 +88378,6 @@
             },
             "description": "Internal Server Error"
           },
-          "501": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Not Implemented"
-          },
           "503": {
             "content": {
               "application/problem+json": {
@@ -87949,19 +88394,19 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Enable or disable a channel, override its number, or map it to a guide station. Omitted members are unchanged.",
+        "summary": "Link editions then record an administrator match decision.",
         "tags": [
-          "admin-livetv"
+          "admin-catalog"
         ],
         "x-silo-class": "acting_admin",
         "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "natural_idempotent",
+        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/livetv/guide-sources": {
-      "get": {
-        "operationId": "listAdminLiveTVGuideSources",
+    "/api/v2/admin/literary-works/matches/ignore": {
+      "post": {
+        "operationId": "ignoreAdminLiteraryMatch",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -87986,12 +88431,22 @@
             }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/AdminLiteraryDecisionInputBody"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/CollectionLiveTVGuideSource"
+                  "$ref": "#/components/schemas/AdminLiteraryDecision"
                 }
               }
             },
@@ -88047,7 +88502,7 @@
             },
             "description": "Not Acceptable"
           },
-          "409": {
+          "408": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -88055,7 +88510,27 @@
                 }
               }
             },
-            "description": "Conflict"
+            "description": "Request Timeout"
+          },
+          "413": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
           },
           "422": {
             "content": {
@@ -88103,15 +88578,19 @@
             "bearerAuth": []
           }
         ],
-        "summary": "List guide data sources in priority order; secrets are redacted.",
+        "summary": "Record an administrator decision to ignore a literary match.",
         "tags": [
-          "admin-livetv"
+          "admin-catalog"
         ],
         "x-silo-class": "acting_admin",
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
-      },
-      "post": {
-        "operationId": "createAdminLiveTVGuideSource",
+      }
+    },
+    "/api/v2/admin/literary-works/{work_id}/items/{content_id}": {
+      "delete": {
+        "operationId": "unlinkAdminLiteraryItem",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -88134,28 +88613,31 @@
               ],
               "type": "string"
             }
-          }
-        ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/LiveTVGuideSourceBody"
-              }
+          },
+          {
+            "in": "path",
+            "name": "work_id",
+            "required": true,
+            "schema": {
+              "maxLength": 512,
+              "minLength": 1,
+              "type": "string"
             }
           },
-          "required": true
-        },
+          {
+            "in": "path",
+            "name": "content_id",
+            "required": true,
+            "schema": {
+              "maxLength": 512,
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
         "responses": {
-          "201": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/LiveTVGuideSource"
-                }
-              }
-            },
-            "description": "Created"
+          "204": {
+            "description": "No Content"
           },
           "400": {
             "content": {
@@ -88207,46 +88689,6 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
-          "409": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Conflict"
-          },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unsupported Media Type"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -88277,16 +88719,6 @@
             },
             "description": "Internal Server Error"
           },
-          "501": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Not Implemented"
-          },
           "503": {
             "content": {
               "application/problem+json": {
@@ -88303,9 +88735,9 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Add a guide data source (Schedules Direct or Gracenote XML sync). At most three may be enabled. Never retried automatically.",
+        "summary": "Remove an edition from a literary work.",
         "tags": [
-          "admin-livetv"
+          "admin-catalog"
         ],
         "x-silo-class": "acting_admin",
         "x-silo-demo-restricted": true,
@@ -88313,9 +88745,9 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/livetv/guide-sources/{source_id}": {
-      "delete": {
-        "operationId": "deleteAdminLiveTVGuideSource",
+    "/api/v2/admin/livetv/channels/{channel_id}": {
+      "patch": {
+        "operationId": "updateAdminLiveTVChannel",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -88342,7 +88774,7 @@
           {
             "description": "Opaque identifier",
             "in": "path",
-            "name": "source_id",
+            "name": "channel_id",
             "required": true,
             "schema": {
               "description": "Opaque identifier",
@@ -88354,9 +88786,26 @@
             }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/LiveTVChannelUpdate"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
-          "204": {
-            "description": "No Content"
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/LiveTVChannel"
+                }
+              }
+            },
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -88408,6 +88857,16 @@
             },
             "description": "Not Acceptable"
           },
+          "408": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Timeout"
+          },
           "409": {
             "content": {
               "application/problem+json": {
@@ -88418,6 +88877,26 @@
             },
             "description": "Conflict"
           },
+          "413": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -88474,7 +88953,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Remove a guide source.",
+        "summary": "Enable or disable a channel, override its number, or map it to a guide station. Omitted members are unchanged.",
         "tags": [
           "admin-livetv"
         ],
@@ -88482,9 +88961,11 @@
         "x-silo-demo-restricted": true,
         "x-silo-retry-safety": "natural_idempotent",
         "x-silo-service-backed": true
-      },
-      "patch": {
-        "operationId": "updateAdminLiveTVGuideSource",
+      }
+    },
+    "/api/v2/admin/livetv/guide-sources": {
+      "get": {
+        "operationId": "listAdminLiveTVGuideSources",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -88507,38 +88988,14 @@
               ],
               "type": "string"
             }
-          },
-          {
-            "description": "Opaque identifier",
-            "in": "path",
-            "name": "source_id",
-            "required": true,
-            "schema": {
-              "description": "Opaque identifier",
-              "examples": [
-                "1"
-              ],
-              "minLength": 1,
-              "type": "string"
-            }
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/LiveTVGuideSourceUpdate"
-              }
-            }
-          },
-          "required": true
-        },
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/LiveTVGuideSource"
+                  "$ref": "#/components/schemas/CollectionLiveTVGuideSource"
                 }
               }
             },
@@ -88594,16 +89051,6 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
           "409": {
             "content": {
               "application/problem+json": {
@@ -88614,26 +89061,6 @@
             },
             "description": "Conflict"
           },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unsupported Media Type"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -88664,16 +89091,6 @@
             },
             "description": "Internal Server Error"
           },
-          "501": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Not Implemented"
-          },
           "503": {
             "content": {
               "application/problem+json": {
@@ -88690,19 +89107,15 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Update a guide source. Omitted members are unchanged; config replaces the whole map.",
+        "summary": "List guide data sources in priority order; secrets are redacted.",
         "tags": [
           "admin-livetv"
         ],
         "x-silo-class": "acting_admin",
-        "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "natural_idempotent",
         "x-silo-service-backed": true
-      }
-    },
-    "/api/v2/admin/livetv/guide-sources/{source_id}/sync": {
+      },
       "post": {
-        "operationId": "syncAdminLiveTVGuideSource",
+        "operationId": "createAdminLiveTVGuideSource",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -88725,24 +89138,20 @@
               ],
               "type": "string"
             }
-          },
-          {
-            "description": "Opaque identifier",
-            "in": "path",
-            "name": "source_id",
-            "required": true,
-            "schema": {
-              "description": "Opaque identifier",
-              "examples": [
-                "1"
-              ],
-              "minLength": 1,
-              "type": "string"
-            }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/LiveTVGuideSourceBody"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
-          "200": {
+          "201": {
             "content": {
               "application/json": {
                 "schema": {
@@ -88750,7 +89159,7 @@
                 }
               }
             },
-            "description": "OK"
+            "description": "Created"
           },
           "400": {
             "content": {
@@ -88802,6 +89211,16 @@
             },
             "description": "Not Acceptable"
           },
+          "408": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Timeout"
+          },
           "409": {
             "content": {
               "application/problem+json": {
@@ -88812,6 +89231,26 @@
             },
             "description": "Conflict"
           },
+          "413": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -88868,19 +89307,19 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Sync a guide source now and return it with its refreshed sync state.",
+        "summary": "Add a guide data source (Schedules Direct or Gracenote XML sync). At most three may be enabled. Never retried automatically.",
         "tags": [
           "admin-livetv"
         ],
         "x-silo-class": "acting_admin",
         "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "natural_idempotent",
+        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/livetv/schedules-direct/lineups": {
-      "post": {
-        "operationId": "lookupAdminLiveTVSchedulesDirectLineups",
+    "/api/v2/admin/livetv/guide-sources/{source_id}": {
+      "delete": {
+        "operationId": "deleteAdminLiveTVGuideSource",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -88903,13 +89342,196 @@
               ],
               "type": "string"
             }
+          },
+          {
+            "description": "Opaque identifier",
+            "in": "path",
+            "name": "source_id",
+            "required": true,
+            "schema": {
+              "description": "Opaque identifier",
+              "examples": [
+                "1"
+              ],
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No Content"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "406": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Acceptable"
+          },
+          "409": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "429": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Too Many Requests"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "501": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Implemented"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "summary": "Remove a guide source.",
+        "tags": [
+          "admin-livetv"
+        ],
+        "x-silo-class": "acting_admin",
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "natural_idempotent",
+        "x-silo-service-backed": true
+      },
+      "patch": {
+        "operationId": "updateAdminLiveTVGuideSource",
+        "parameters": [
+          {
+            "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
+            "in": "header",
+            "name": "X-Profile-Id",
+            "schema": {
+              "examples": [
+                "1"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked",
+            "in": "header",
+            "name": "X-Profile-Token",
+            "schema": {
+              "examples": [
+                "pvt_5f3a9c1e7b2d4e8fa0c6"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Opaque identifier",
+            "in": "path",
+            "name": "source_id",
+            "required": true,
+            "schema": {
+              "description": "Opaque identifier",
+              "examples": [
+                "1"
+              ],
+              "minLength": 1,
+              "type": "string"
+            }
           }
         ],
         "requestBody": {
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/LiveTVSchedulesDirectLineupsBody"
+                "$ref": "#/components/schemas/LiveTVGuideSourceUpdate"
               }
             }
           },
@@ -88920,7 +89542,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/CollectionLiveTVLineup"
+                  "$ref": "#/components/schemas/LiveTVGuideSource"
                 }
               }
             },
@@ -89072,7 +89694,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Look up the Schedules Direct lineups available at a postal code with the given account. Nothing is saved.",
+        "summary": "Update a guide source. Omitted members are unchanged; config replaces the whole map.",
         "tags": [
           "admin-livetv"
         ],
@@ -89082,9 +89704,9 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/livetv/tuners": {
-      "get": {
-        "operationId": "listAdminLiveTVTuners",
+    "/api/v2/admin/livetv/guide-sources/{source_id}/sync": {
+      "post": {
+        "operationId": "syncAdminLiveTVGuideSource",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -89107,6 +89729,20 @@
               ],
               "type": "string"
             }
+          },
+          {
+            "description": "Opaque identifier",
+            "in": "path",
+            "name": "source_id",
+            "required": true,
+            "schema": {
+              "description": "Opaque identifier",
+              "examples": [
+                "1"
+              ],
+              "minLength": 1,
+              "type": "string"
+            }
           }
         ],
         "responses": {
@@ -89114,7 +89750,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/CollectionLiveTVTuner"
+                  "$ref": "#/components/schemas/LiveTVGuideSource"
                 }
               }
             },
@@ -89210,6 +89846,16 @@
             },
             "description": "Internal Server Error"
           },
+          "501": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Implemented"
+          },
           "503": {
             "content": {
               "application/problem+json": {
@@ -89226,15 +89872,19 @@
             "bearerAuth": []
           }
         ],
-        "summary": "List configured Live TV tuners.",
+        "summary": "Sync a guide source now and return it with its refreshed sync state.",
         "tags": [
           "admin-livetv"
         ],
         "x-silo-class": "acting_admin",
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "natural_idempotent",
         "x-silo-service-backed": true
-      },
+      }
+    },
+    "/api/v2/admin/livetv/schedules-direct/lineups": {
       "post": {
-        "operationId": "addAdminLiveTVTuner",
+        "operationId": "lookupAdminLiveTVSchedulesDirectLineups",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -89263,22 +89913,22 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/LiveTVTunerBody"
+                "$ref": "#/components/schemas/LiveTVSchedulesDirectLineupsBody"
               }
             }
           },
           "required": true
         },
         "responses": {
-          "201": {
+          "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/LiveTVTuner"
+                  "$ref": "#/components/schemas/CollectionLiveTVLineup"
                 }
               }
             },
-            "description": "Created"
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -89426,19 +90076,169 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Add an HDHomeRun-compatible tuner by address and scan its lineup. Adding a tuner that is already configured returns it.",
+        "summary": "Look up the Schedules Direct lineups available at a postal code with the given account. Nothing is saved.",
         "tags": [
           "admin-livetv"
         ],
         "x-silo-class": "acting_admin",
         "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "unique_constraint",
+        "x-silo-retry-safety": "natural_idempotent",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/livetv/tuners/discover": {
-      "post": {
-        "operationId": "discoverAdminLiveTVTuners",
+    "/api/v2/admin/livetv/tuners": {
+      "get": {
+        "operationId": "listAdminLiveTVTuners",
+        "parameters": [
+          {
+            "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
+            "in": "header",
+            "name": "X-Profile-Id",
+            "schema": {
+              "examples": [
+                "1"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked",
+            "in": "header",
+            "name": "X-Profile-Token",
+            "schema": {
+              "examples": [
+                "pvt_5f3a9c1e7b2d4e8fa0c6"
+              ],
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CollectionLiveTVTuner"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "406": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Acceptable"
+          },
+          "409": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "429": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Too Many Requests"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "summary": "List configured Live TV tuners.",
+        "tags": [
+          "admin-livetv"
+        ],
+        "x-silo-class": "acting_admin",
+        "x-silo-service-backed": true
+      },
+      "post": {
+        "operationId": "addAdminLiveTVTuner",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -89467,22 +90267,22 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/LiveTVTunerDiscoveryBody",
-                "description": "Absent runs UDP discovery with the default window"
+                "$ref": "#/components/schemas/LiveTVTunerBody"
               }
             }
-          }
+          },
+          "required": true
         },
         "responses": {
-          "200": {
+          "201": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/LiveTVTunerDiscovery"
+                  "$ref": "#/components/schemas/LiveTVTuner"
                 }
               }
             },
-            "description": "OK"
+            "description": "Created"
           },
           "400": {
             "content": {
@@ -89630,19 +90430,19 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Discover tuners on the network (HDHomeRun UDP broadcast and URL probes) without saving them.",
+        "summary": "Add an HDHomeRun-compatible tuner by address and scan its lineup. Adding a tuner that is already configured returns it.",
         "tags": [
           "admin-livetv"
         ],
         "x-silo-class": "acting_admin",
         "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "natural_idempotent",
+        "x-silo-retry-safety": "unique_constraint",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/livetv/tuners/{tuner_id}": {
-      "delete": {
-        "operationId": "deleteAdminLiveTVTuner",
+    "/api/v2/admin/livetv/tuners/discover": {
+      "post": {
+        "operationId": "discoverAdminLiveTVTuners",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -89665,25 +90465,28 @@
               ],
               "type": "string"
             }
-          },
-          {
-            "description": "Opaque identifier",
-            "in": "path",
-            "name": "tuner_id",
-            "required": true,
-            "schema": {
-              "description": "Opaque identifier",
-              "examples": [
-                "1"
-              ],
-              "minLength": 1,
-              "type": "string"
-            }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/LiveTVTunerDiscoveryBody",
+                "description": "Absent runs UDP discovery with the default window"
+              }
+            }
+          }
+        },
         "responses": {
-          "204": {
-            "description": "No Content"
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/LiveTVTunerDiscovery"
+                }
+              }
+            },
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -89735,6 +90538,16 @@
             },
             "description": "Not Acceptable"
           },
+          "408": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Timeout"
+          },
           "409": {
             "content": {
               "application/problem+json": {
@@ -89745,6 +90558,26 @@
             },
             "description": "Conflict"
           },
+          "413": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -89801,7 +90634,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Remove a tuner and its channels.",
+        "summary": "Discover tuners on the network (HDHomeRun UDP broadcast and URL probes) without saving them.",
         "tags": [
           "admin-livetv"
         ],
@@ -89811,9 +90644,9 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/livetv/tuners/{tuner_id}/scan": {
-      "post": {
-        "operationId": "scanAdminLiveTVTuner",
+    "/api/v2/admin/livetv/tuners/{tuner_id}": {
+      "delete": {
+        "operationId": "deleteAdminLiveTVTuner",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -89853,15 +90686,8 @@
           }
         ],
         "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/LiveTVTuner"
-                }
-              }
-            },
-            "description": "OK"
+          "204": {
+            "description": "No Content"
           },
           "400": {
             "content": {
@@ -89979,7 +90805,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Rescan a tuner's channel lineup now and return the refreshed tuner.",
+        "summary": "Remove a tuner and its channels.",
         "tags": [
           "admin-livetv"
         ],
@@ -89989,9 +90815,187 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/livetv/xml-sync/lineups": {
+    "/api/v2/admin/livetv/tuners/{tuner_id}/scan": {
       "post": {
-        "operationId": "lookupAdminLiveTVXMLSyncLineups",
+        "operationId": "scanAdminLiveTVTuner",
+        "parameters": [
+          {
+            "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
+            "in": "header",
+            "name": "X-Profile-Id",
+            "schema": {
+              "examples": [
+                "1"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked",
+            "in": "header",
+            "name": "X-Profile-Token",
+            "schema": {
+              "examples": [
+                "pvt_5f3a9c1e7b2d4e8fa0c6"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Opaque identifier",
+            "in": "path",
+            "name": "tuner_id",
+            "required": true,
+            "schema": {
+              "description": "Opaque identifier",
+              "examples": [
+                "1"
+              ],
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/LiveTVTuner"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "406": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Acceptable"
+          },
+          "409": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "429": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Too Many Requests"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "501": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Implemented"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "summary": "Rescan a tuner's channel lineup now and return the refreshed tuner.",
+        "tags": [
+          "admin-livetv"
+        ],
+        "x-silo-class": "acting_admin",
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "natural_idempotent",
+        "x-silo-service-backed": true
+      }
+    },
+    "/api/v2/admin/livetv/xml-sync/lineups": {
+      "post": {
+        "operationId": "lookupAdminLiveTVXMLSyncLineups",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -95546,7 +96550,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Dispatch one test push notification and report its current delivery outcome.",
+        "summary": "Dispatch one test push carrying the target profile's newest notification and report its current delivery outcome.",
         "tags": [
           "admin"
         ],
@@ -95730,7 +96734,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Dispatch one test push notification and report its current delivery outcome.",
+        "summary": "Dispatch one test push carrying the target profile's newest notification and report its current delivery outcome.",
         "tags": [
           "admin"
         ],
@@ -105866,9 +106870,10 @@
         "x-silo-conditional": true
       }
     },
-    "/api/v2/admin/recommendations/status": {
-      "get": {
-        "operationId": "getAdminRecommendationsStatus",
+    "/api/v2/admin/recommendations/embeddings/reset": {
+      "post": {
+        "description": "Recovers a server whose embedding lock pins a model it can no longer use, or switches embedding models. It refuses with 409 while the embedding, taste profile or recommendation job, or a stale profile sweep, runs on any server, while a catalog import with embeddings runs, and while saved embedding settings wait for a server restart. Run the embedding job afterwards to build the new embedding space.",
+        "operationId": "resetAdminRecommendationEmbeddings",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -105898,7 +106903,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AdminRecommendationsStatus"
+                  "$ref": "#/components/schemas/AdminRecommendationEmbeddingsReset"
                 }
               }
             },
@@ -105954,6 +106959,16 @@
             },
             "description": "Not Acceptable"
           },
+          "409": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -106000,17 +107015,19 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Read persisted counts and this process's running flags.",
+        "summary": "Delete the embedding lock, every item embedding, taste clusters and per-profile cached rows, and clear taste profile vectors, in one transaction.",
         "tags": [
           "admin-recommendations"
         ],
         "x-silo-class": "acting_admin",
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/recommendations/trigger/cowatch": {
-      "post": {
-        "operationId": "triggerAdminRecommendationCowatch",
+    "/api/v2/admin/recommendations/status": {
+      "get": {
+        "operationId": "getAdminRecommendationsStatus",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -106040,7 +107057,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AdminRecommendationStarted"
+                  "$ref": "#/components/schemas/AdminRecommendationsStatus"
                 }
               }
             },
@@ -106142,19 +107159,17 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Start process-local recommendation work without a durable job receipt.",
+        "summary": "Read persisted counts, each job's last run, the embedding lock conflict and this process's running flags.",
         "tags": [
           "admin-recommendations"
         ],
         "x-silo-class": "acting_admin",
-        "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/recommendations/trigger/embeddings": {
+    "/api/v2/admin/recommendations/trigger/cowatch": {
       "post": {
-        "operationId": "triggerAdminRecommendationEmbeddings",
+        "operationId": "triggerAdminRecommendationCowatch",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -106296,9 +107311,9 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/recommendations/trigger/recommendations": {
+    "/api/v2/admin/recommendations/trigger/embeddings": {
       "post": {
-        "operationId": "triggerAdminRecommendationRefresh",
+        "operationId": "triggerAdminRecommendationEmbeddings",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -106440,9 +107455,9 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/recommendations/trigger/taste-profiles": {
+    "/api/v2/admin/recommendations/trigger/recommendations": {
       "post": {
-        "operationId": "triggerAdminRecommendationTasteProfiles",
+        "operationId": "triggerAdminRecommendationRefresh",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -106584,9 +107599,9 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/admin/request-groups/{group_id}/limit": {
-      "get": {
-        "operationId": "getAdminRequestGroupLimit",
+    "/api/v2/admin/recommendations/trigger/taste-profiles": {
+      "post": {
+        "operationId": "triggerAdminRecommendationTasteProfiles",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -106609,21 +107624,6 @@
               ],
               "type": "string"
             }
-          },
-          {
-            "description": "The access group",
-            "in": "path",
-            "name": "group_id",
-            "required": true,
-            "schema": {
-              "description": "The access group",
-              "examples": [
-                "2"
-              ],
-              "minLength": 1,
-              "pattern": "^[1-9][0-9]*$",
-              "type": "string"
-            }
           }
         ],
         "responses": {
@@ -106631,18 +107631,11 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AdminRequestGroupLimit"
+                  "$ref": "#/components/schemas/AdminRecommendationStarted"
                 }
               }
             },
-            "description": "OK",
-            "headers": {
-              "ETag": {
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -106740,33 +107733,199 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Get an access group's request approval and limit.",
+        "summary": "Start process-local recommendation work without a durable job receipt.",
         "tags": [
-          "admin"
+          "admin-recommendations"
         ],
         "x-silo-class": "acting_admin",
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
-      },
-      "put": {
-        "operationId": "updateAdminRequestGroupLimit",
+      }
+    },
+    "/api/v2/admin/request-groups/{group_id}/limit": {
+      "get": {
+        "operationId": "getAdminRequestGroupLimit",
         "parameters": [
-          {
-            "description": "The resource's current ETag, or \"*\" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag.",
-            "in": "header",
-            "name": "If-Match",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "description": "Optional second precondition, evaluated after If-Match succeeds: \"*\" or any tag matching the current representation is 412 precondition_failed with the current ETag.",
-            "in": "header",
-            "name": "If-None-Match",
-            "schema": {
-              "type": "string"
-            }
-          },
+          {
+            "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
+            "in": "header",
+            "name": "X-Profile-Id",
+            "schema": {
+              "examples": [
+                "1"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked",
+            "in": "header",
+            "name": "X-Profile-Token",
+            "schema": {
+              "examples": [
+                "pvt_5f3a9c1e7b2d4e8fa0c6"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "The access group",
+            "in": "path",
+            "name": "group_id",
+            "required": true,
+            "schema": {
+              "description": "The access group",
+              "examples": [
+                "2"
+              ],
+              "minLength": 1,
+              "pattern": "^[1-9][0-9]*$",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AdminRequestGroupLimit"
+                }
+              }
+            },
+            "description": "OK",
+            "headers": {
+              "ETag": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "406": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Acceptable"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "429": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Too Many Requests"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "summary": "Get an access group's request approval and limit.",
+        "tags": [
+          "admin"
+        ],
+        "x-silo-class": "acting_admin",
+        "x-silo-service-backed": true
+      },
+      "put": {
+        "operationId": "updateAdminRequestGroupLimit",
+        "parameters": [
+          {
+            "description": "The resource's current ETag, or \"*\" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag.",
+            "in": "header",
+            "name": "If-Match",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Optional second precondition, evaluated after If-Match succeeds: \"*\" or any tag matching the current representation is 412 precondition_failed with the current ETag.",
+            "in": "header",
+            "name": "If-None-Match",
+            "schema": {
+              "type": "string"
+            }
+          },
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
             "in": "header",
@@ -136469,9 +137628,9 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/capabilities/password-reset": {
+    "/api/v2/capabilities/not-interested": {
       "get": {
-        "operationId": "getPasswordResetCapability",
+        "operationId": "getNotInterestedCapability",
         "parameters": [
           {
             "description": "Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed.",
@@ -136481,6 +137640,29 @@
               "type": "string"
             }
           },
+          {
+            "description": "The household profile acting for this request; it must belong to the authenticated account.",
+            "in": "header",
+            "name": "X-Profile-Id",
+            "required": true,
+            "schema": {
+              "examples": [
+                "1"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked",
+            "in": "header",
+            "name": "X-Profile-Token",
+            "schema": {
+              "examples": [
+                "pvt_5f3a9c1e7b2d4e8fa0c6"
+              ],
+              "type": "string"
+            }
+          },
           {
             "in": "header",
             "name": "If-None-Match",
@@ -136494,7 +137676,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/PasswordResetCapability"
+                  "$ref": "#/components/schemas/NotInterestedCapability"
                 }
               }
             },
@@ -136534,6 +137716,36 @@
             },
             "description": "Bad Request"
           },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
           "406": {
             "content": {
               "application/problem+json": {
@@ -136572,6 +137784,16 @@
             },
             "description": "Unprocessable Entity"
           },
+          "429": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Too Many Requests"
+          },
           "500": {
             "content": {
               "application/problem+json": {
@@ -136593,18 +137815,23 @@
             "description": "Service Unavailable"
           }
         },
-        "summary": "Discover whether the sign-in page may offer self-service password reset.",
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "summary": "Whether the acting profile can mark movies and series Not interested.",
         "tags": [
-          "auth"
+          "not-interested"
         ],
-        "x-silo-class": "public",
+        "x-silo-class": "profile_scoped",
         "x-silo-conditional": true,
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/capabilities/ratings": {
+    "/api/v2/capabilities/password-reset": {
       "get": {
-        "operationId": "getRatingsCapability",
+        "operationId": "getPasswordResetCapability",
         "parameters": [
           {
             "description": "Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed.",
@@ -136614,29 +137841,6 @@
               "type": "string"
             }
           },
-          {
-            "description": "The household profile acting for this request; it must belong to the authenticated account.",
-            "in": "header",
-            "name": "X-Profile-Id",
-            "required": true,
-            "schema": {
-              "examples": [
-                "1"
-              ],
-              "type": "string"
-            }
-          },
-          {
-            "description": "Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked",
-            "in": "header",
-            "name": "X-Profile-Token",
-            "schema": {
-              "examples": [
-                "pvt_5f3a9c1e7b2d4e8fa0c6"
-              ],
-              "type": "string"
-            }
-          },
           {
             "in": "header",
             "name": "If-None-Match",
@@ -136650,7 +137854,163 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/RatingsCapability"
+                  "$ref": "#/components/schemas/PasswordResetCapability"
+                }
+              }
+            },
+            "description": "OK",
+            "headers": {
+              "Cache-Control": {
+                "schema": {
+                  "type": "string"
+                }
+              },
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "304": {
+            "description": "The representation named by If-None-Match is current; no body.",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "406": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Acceptable"
+          },
+          "412": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Precondition Failed",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "summary": "Discover whether the sign-in page may offer self-service password reset.",
+        "tags": [
+          "auth"
+        ],
+        "x-silo-class": "public",
+        "x-silo-conditional": true,
+        "x-silo-service-backed": true
+      }
+    },
+    "/api/v2/capabilities/ratings": {
+      "get": {
+        "operationId": "getRatingsCapability",
+        "parameters": [
+          {
+            "description": "Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed.",
+            "in": "header",
+            "name": "If-Match",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "The household profile acting for this request; it must belong to the authenticated account.",
+            "in": "header",
+            "name": "X-Profile-Id",
+            "required": true,
+            "schema": {
+              "examples": [
+                "1"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked",
+            "in": "header",
+            "name": "X-Profile-Token",
+            "schema": {
+              "examples": [
+                "pvt_5f3a9c1e7b2d4e8fa0c6"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "in": "header",
+            "name": "If-None-Match",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/RatingsCapability"
                 }
               }
             },
@@ -137271,21 +138631,104 @@
             }
           },
           {
-            "description": "Artwork variant to presign",
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
             "explode": false,
             "in": "query",
             "name": "image_size",
             "schema": {
-              "description": "Artwork variant to presign",
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
               "enum": [
                 "small",
                 "medium",
                 "large",
                 "original"
               ],
+              "examples": [
+                "medium"
+              ],
               "type": "string"
             }
           },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
           {
             "description": "Page size; default 50, maximum 200",
             "explode": false,
@@ -137560,19 +139003,104 @@
             }
           },
           {
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
             "explode": false,
             "in": "query",
             "name": "image_size",
             "schema": {
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
               "enum": [
                 "small",
                 "medium",
                 "large",
                 "original"
               ],
+              "examples": [
+                "medium"
+              ],
               "type": "string"
             }
           },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
           {
             "description": "Page size; default 50, maximum 200",
             "explode": false,
@@ -138356,19 +139884,104 @@
             }
           },
           {
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
             "explode": false,
             "in": "query",
             "name": "image_size",
             "schema": {
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
               "enum": [
                 "small",
                 "medium",
                 "large",
                 "original"
               ],
+              "examples": [
+                "medium"
+              ],
               "type": "string"
             }
           },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
           {
             "description": "The library the item is being viewed in; picks its presentation when the item is in several",
             "explode": false,
@@ -138554,19 +140167,104 @@
             }
           },
           {
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
             "explode": false,
             "in": "query",
             "name": "image_size",
             "schema": {
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
               "enum": [
                 "small",
                 "medium",
                 "large",
                 "original"
               ],
+              "examples": [
+                "medium"
+              ],
               "type": "string"
             }
           },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
           {
             "description": "The library the item is being viewed in; picks its presentation when the item is in several",
             "explode": false,
@@ -138752,19 +140450,104 @@
             }
           },
           {
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
             "explode": false,
             "in": "query",
             "name": "image_size",
             "schema": {
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
               "enum": [
                 "small",
                 "medium",
                 "large",
                 "original"
               ],
+              "examples": [
+                "medium"
+              ],
               "type": "string"
             }
           },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
           {
             "description": "The library the item is being viewed in; picks its presentation when the item is in several",
             "explode": false,
@@ -140064,7 +141847,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Queue a translation of the item's descriptions into the language the detail document reported missing; answers 202 with the job.",
+        "summary": "Queue a translation of the descriptions a page shows into the language its detail document reported missing: a movie's or series' own overview and tagline, a season's overview and its episodes' overviews, or one episode. Answers 202 with the job.",
         "tags": [
           "catalog"
         ],
@@ -140127,19 +141910,104 @@
             }
           },
           {
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
             "explode": false,
             "in": "query",
             "name": "image_size",
             "schema": {
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
               "enum": [
                 "small",
                 "medium",
                 "large",
                 "original"
               ],
+              "examples": [
+                "medium"
+              ],
               "type": "string"
             }
           },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
           {
             "description": "The library the item is being viewed in; picks its presentation when the item is in several",
             "explode": false,
@@ -141010,18 +142878,103 @@
             }
           },
           {
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
             "explode": false,
             "in": "query",
             "name": "image_size",
             "schema": {
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
               "enum": [
                 "small",
                 "medium",
                 "large",
                 "original"
               ],
+              "examples": [
+                "medium"
+              ],
               "type": "string"
             }
+          },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
           }
         ],
         "requestBody": {
@@ -141422,19 +143375,104 @@
             }
           },
           {
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
             "explode": false,
             "in": "query",
             "name": "image_size",
             "schema": {
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
               "enum": [
                 "small",
                 "medium",
                 "large",
                 "original"
               ],
+              "examples": [
+                "medium"
+              ],
               "type": "string"
             }
           },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
           {
             "description": "The library the series is being viewed in",
             "explode": false,
@@ -141617,19 +143655,104 @@
             }
           },
           {
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
             "explode": false,
             "in": "query",
             "name": "image_size",
             "schema": {
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
               "enum": [
                 "small",
                 "medium",
                 "large",
                 "original"
               ],
+              "examples": [
+                "medium"
+              ],
               "type": "string"
             }
           },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
           {
             "description": "The library the series is being viewed in",
             "explode": false,
@@ -141816,19 +143939,104 @@
             }
           },
           {
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
             "explode": false,
             "in": "query",
             "name": "image_size",
             "schema": {
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
               "enum": [
                 "small",
                 "medium",
                 "large",
                 "original"
               ],
+              "examples": [
+                "medium"
+              ],
               "type": "string"
             }
           },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
           {
             "description": "The library the series is being viewed in",
             "explode": false,
@@ -145033,9 +147241,9 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/collections/import/trakt": {
-      "post": {
-        "operationId": "importTraktCollection",
+    "/api/v2/collections/order": {
+      "get": {
+        "operationId": "getCollectionOrder",
         "parameters": [
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
@@ -145059,32 +147267,31 @@
               ],
               "type": "string"
             }
+          },
+          {
+            "description": "Omit: personal collection groups are no longer supported, and any value is a validation failure",
+            "explode": false,
+            "in": "query",
+            "name": "group_id",
+            "schema": {
+              "description": "Omit: personal collection groups are no longer supported, and any value is a validation failure",
+              "type": "string"
+            }
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/TraktCollectionImport"
-              }
-            }
-          },
-          "required": true
-        },
         "responses": {
-          "201": {
+          "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/CollectionImportResult"
+                  "$ref": "#/components/schemas/CollectionOrder"
                 }
               }
             },
-            "description": "Created",
+            "description": "OK",
             "headers": {
-              "Location": {
+              "ETag": {
                 "schema": {
-                  "description": "The created collection's resource path",
                   "type": "string"
                 }
               }
@@ -145140,36 +147347,6 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unsupported Media Type"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -145216,20 +147393,33 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Import a Trakt preset as a synced collection. Creates the collection and runs its first sync. Not idempotent: a retry after a lost response creates a second collection.",
+        "summary": "Read the canonical collection editor state and its strong validator.",
         "tags": [
           "collections"
         ],
         "x-silo-class": "profile_scoped",
-        "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
-      }
-    },
-    "/api/v2/collections/order": {
-      "get": {
-        "operationId": "getCollectionOrder",
+      },
+      "put": {
+        "operationId": "reorderCollections",
         "parameters": [
+          {
+            "description": "The resource's current ETag, or \"*\" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag.",
+            "in": "header",
+            "name": "If-Match",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Optional second precondition, evaluated after If-Match succeeds: \"*\" or any tag matching the current representation is 412 precondition_failed with the current ETag.",
+            "in": "header",
+            "name": "If-None-Match",
+            "schema": {
+              "type": "string"
+            }
+          },
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
             "in": "header",
@@ -145252,18 +147442,18 @@
               ],
               "type": "string"
             }
-          },
-          {
-            "description": "Omit: personal collection groups are no longer supported, and any value is a validation failure",
-            "explode": false,
-            "in": "query",
-            "name": "group_id",
-            "schema": {
-              "description": "Omit: personal collection groups are no longer supported, and any value is a validation failure",
-              "type": "string"
-            }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CollectionOrder"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
           "200": {
             "content": {
@@ -145276,6 +147466,7 @@
             "description": "OK",
             "headers": {
               "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
                 "schema": {
                   "type": "string"
                 }
@@ -145332,6 +147523,54 @@
             },
             "description": "Not Acceptable"
           },
+          "408": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Timeout"
+          },
+          "412": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Precondition Failed",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "413": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -145342,6 +147581,16 @@
             },
             "description": "Unprocessable Entity"
           },
+          "428": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Precondition Required"
+          },
           "429": {
             "content": {
               "application/problem+json": {
@@ -145378,33 +147627,21 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Read the canonical collection editor state and its strong validator.",
+        "summary": "Replace the order of the acting profile's own collections. Retries are not safe after an intervening mutation.",
         "tags": [
           "collections"
         ],
         "x-silo-class": "profile_scoped",
+        "x-silo-demo-restricted": true,
+        "x-silo-guarded": true,
+        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
-      },
-      "put": {
-        "operationId": "reorderCollections",
+      }
+    },
+    "/api/v2/collections/preview": {
+      "post": {
+        "operationId": "previewCollection",
         "parameters": [
-          {
-            "description": "The resource's current ETag, or \"*\" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag.",
-            "in": "header",
-            "name": "If-Match",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "description": "Optional second precondition, evaluated after If-Match succeeds: \"*\" or any tag matching the current representation is 412 precondition_failed with the current ETag.",
-            "in": "header",
-            "name": "If-None-Match",
-            "schema": {
-              "type": "string"
-            }
-          },
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
             "in": "header",
@@ -145433,7 +147670,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/CollectionOrder"
+                "$ref": "#/components/schemas/PersonalCollectionPreviewInputBody"
               }
             }
           },
@@ -145444,19 +147681,11 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/CollectionOrder"
+                  "$ref": "#/components/schemas/PersonalCollectionPreviewOutputBody"
                 }
               }
             },
-            "description": "OK",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -145518,24 +147747,6 @@
             },
             "description": "Request Timeout"
           },
-          "412": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Precondition Failed",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
-          },
           "413": {
             "content": {
               "application/problem+json": {
@@ -145566,16 +147777,6 @@
             },
             "description": "Unprocessable Entity"
           },
-          "428": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Precondition Required"
-          },
           "429": {
             "content": {
               "application/problem+json": {
@@ -145612,20 +147813,19 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Replace the order of the acting profile's own collections. Retries are not safe after an intervening mutation.",
+        "summary": "Preview a smart query within the acting profile's access.",
         "tags": [
           "collections"
         ],
         "x-silo-class": "profile_scoped",
         "x-silo-demo-restricted": true,
-        "x-silo-guarded": true,
-        "x-silo-retry-safety": "non_retryable",
+        "x-silo-retry-safety": "natural_idempotent",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/collections/preview": {
-      "post": {
-        "operationId": "previewCollection",
+    "/api/v2/collections/server": {
+      "get": {
+        "operationId": "listServerCollections",
         "parameters": [
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
@@ -145651,22 +147851,12 @@
             }
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/PersonalCollectionPreviewInputBody"
-              }
-            }
-          },
-          "required": true
-        },
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/PersonalCollectionPreviewOutputBody"
+                  "$ref": "#/components/schemas/ServerCollectionsOutputBody"
                 }
               }
             },
@@ -145722,36 +147912,6 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unsupported Media Type"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -145798,19 +147958,17 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Preview a smart query within the acting profile's access.",
+        "summary": "List visible server collections grouped by library.",
         "tags": [
           "collections"
         ],
         "x-silo-class": "profile_scoped",
-        "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "natural_idempotent",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/collections/server": {
-      "get": {
-        "operationId": "listServerCollections",
+    "/api/v2/collections/sort-preference": {
+      "delete": {
+        "operationId": "clearCollectionSortPreference",
         "parameters": [
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
@@ -145834,18 +147992,40 @@
               ],
               "type": "string"
             }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "collection_kind",
+            "required": true,
+            "schema": {
+              "enum": [
+                "library",
+                "user",
+                "watchlist",
+                "favorites"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Opaque identifier",
+            "explode": false,
+            "in": "query",
+            "name": "collection_id",
+            "schema": {
+              "description": "Opaque identifier",
+              "examples": [
+                "1"
+              ],
+              "minLength": 1,
+              "type": "string"
+            }
           }
         ],
         "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ServerCollectionsOutputBody"
-                }
-              }
-            },
-            "description": "OK"
+          "204": {
+            "description": "No Content"
           },
           "400": {
             "content": {
@@ -145943,17 +148123,17 @@
             "bearerAuth": []
           }
         ],
-        "summary": "List visible server collections grouped by library.",
+        "summary": "Clear the acting profile's collection sort preference.",
         "tags": [
           "collections"
         ],
         "x-silo-class": "profile_scoped",
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
-      }
-    },
-    "/api/v2/collections/sort-preference": {
-      "delete": {
-        "operationId": "clearCollectionSortPreference",
+      },
+      "put": {
+        "operationId": "setCollectionSortPreference",
         "parameters": [
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
@@ -145977,40 +148157,28 @@
               ],
               "type": "string"
             }
-          },
-          {
-            "explode": false,
-            "in": "query",
-            "name": "collection_kind",
-            "required": true,
-            "schema": {
-              "enum": [
-                "library",
-                "user",
-                "watchlist",
-                "favorites"
-              ],
-              "type": "string"
-            }
-          },
-          {
-            "description": "Opaque identifier",
-            "explode": false,
-            "in": "query",
-            "name": "collection_id",
-            "schema": {
-              "description": "Opaque identifier",
-              "examples": [
-                "1"
-              ],
-              "minLength": 1,
-              "type": "string"
-            }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CollectionSortPreference"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
-          "204": {
-            "description": "No Content"
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CollectionSortPreference"
+                }
+              }
+            },
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -146062,6 +148230,36 @@
             },
             "description": "Not Acceptable"
           },
+          "408": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Timeout"
+          },
+          "413": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -146108,7 +148306,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Clear the acting profile's collection sort preference.",
+        "summary": "Save the acting profile's collection sort preference.",
         "tags": [
           "collections"
         ],
@@ -146116,9 +148314,11 @@
         "x-silo-demo-restricted": true,
         "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
-      },
-      "put": {
-        "operationId": "setCollectionSortPreference",
+      }
+    },
+    "/api/v2/collections/templates": {
+      "get": {
+        "operationId": "listCollectionTemplates",
         "parameters": [
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
@@ -146144,22 +148344,12 @@
             }
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/CollectionSortPreference"
-              }
-            }
-          },
-          "required": true
-        },
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/CollectionSortPreference"
+                  "$ref": "#/components/schemas/CollectionTemplateCatalog"
                 }
               }
             },
@@ -146215,36 +148405,6 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unsupported Media Type"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -146291,20 +148451,35 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Save the acting profile's collection sort preference.",
+        "summary": "List supported collection import templates.",
         "tags": [
           "collections"
         ],
         "x-silo-class": "profile_scoped",
-        "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/collections/templates": {
-      "get": {
-        "operationId": "listCollectionTemplates",
+    "/api/v2/collections/{id}": {
+      "delete": {
+        "operationId": "deleteCollection",
         "parameters": [
+          {
+            "description": "The resource's current ETag, or \"*\" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag.",
+            "in": "header",
+            "name": "If-Match",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Optional second precondition, evaluated after If-Match succeeds: \"*\" or any tag matching the current representation is 412 precondition_failed with the current ETag.",
+            "in": "header",
+            "name": "If-None-Match",
+            "schema": {
+              "type": "string"
+            }
+          },
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
             "in": "header",
@@ -146327,18 +148502,25 @@
               ],
               "type": "string"
             }
+          },
+          {
+            "description": "Opaque identifier",
+            "in": "path",
+            "name": "id",
+            "required": true,
+            "schema": {
+              "description": "Opaque identifier",
+              "examples": [
+                "1"
+              ],
+              "minLength": 1,
+              "type": "string"
+            }
           }
         ],
         "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/CollectionTemplateCatalog"
-                }
-              }
-            },
-            "description": "OK"
+          "204": {
+            "description": "No Content"
           },
           "400": {
             "content": {
@@ -146390,6 +148572,24 @@
             },
             "description": "Not Acceptable"
           },
+          "412": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Precondition Failed",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -146400,6 +148600,16 @@
             },
             "description": "Unprocessable Entity"
           },
+          "428": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Precondition Required"
+          },
           "429": {
             "content": {
               "application/problem+json": {
@@ -146436,55 +148646,53 @@
             "bearerAuth": []
           }
         ],
-        "summary": "List supported collection import templates.",
+        "summary": "Delete the creator's collection.",
         "tags": [
           "collections"
         ],
         "x-silo-class": "profile_scoped",
+        "x-silo-demo-restricted": true,
+        "x-silo-guarded": true,
+        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
-      }
-    },
-    "/api/v2/collections/{id}": {
-      "delete": {
-        "operationId": "deleteCollection",
+      },
+      "get": {
+        "operationId": "getCollection",
         "parameters": [
           {
-            "description": "The resource's current ETag, or \"*\" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag.",
+            "description": "The household profile acting for this request; it must belong to the authenticated account.",
             "in": "header",
-            "name": "If-Match",
+            "name": "X-Profile-Id",
             "required": true,
             "schema": {
+              "examples": [
+                "1"
+              ],
               "type": "string"
             }
           },
           {
-            "description": "Optional second precondition, evaluated after If-Match succeeds: \"*\" or any tag matching the current representation is 412 precondition_failed with the current ETag.",
+            "description": "Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked",
             "in": "header",
-            "name": "If-None-Match",
+            "name": "X-Profile-Token",
             "schema": {
+              "examples": [
+                "pvt_5f3a9c1e7b2d4e8fa0c6"
+              ],
               "type": "string"
             }
           },
           {
-            "description": "The household profile acting for this request; it must belong to the authenticated account.",
             "in": "header",
-            "name": "X-Profile-Id",
-            "required": true,
+            "name": "If-Match",
             "schema": {
-              "examples": [
-                "1"
-              ],
               "type": "string"
             }
           },
           {
-            "description": "Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked",
             "in": "header",
-            "name": "X-Profile-Token",
+            "name": "If-None-Match",
             "schema": {
-              "examples": [
-                "pvt_5f3a9c1e7b2d4e8fa0c6"
-              ],
               "type": "string"
             }
           },
@@ -146504,215 +148712,22 @@
           }
         ],
         "responses": {
-          "204": {
-            "description": "No Content"
-          },
-          "400": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Bad Request"
-          },
-          "401": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unauthorized"
-          },
-          "403": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Forbidden"
-          },
-          "404": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Not Found"
-          },
-          "406": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Not Acceptable"
-          },
-          "412": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Precondition Failed",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
-          },
-          "422": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unprocessable Entity"
-          },
-          "428": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Precondition Required"
-          },
-          "429": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Too Many Requests"
-          },
-          "500": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Internal Server Error"
-          },
-          "503": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Service Unavailable"
-          }
-        },
-        "security": [
-          {
-            "bearerAuth": []
-          }
-        ],
-        "summary": "Delete the creator's collection.",
-        "tags": [
-          "collections"
-        ],
-        "x-silo-class": "profile_scoped",
-        "x-silo-demo-restricted": true,
-        "x-silo-guarded": true,
-        "x-silo-retry-safety": "non_retryable",
-        "x-silo-service-backed": true
-      },
-      "get": {
-        "operationId": "getCollection",
-        "parameters": [
-          {
-            "description": "The household profile acting for this request; it must belong to the authenticated account.",
-            "in": "header",
-            "name": "X-Profile-Id",
-            "required": true,
-            "schema": {
-              "examples": [
-                "1"
-              ],
-              "type": "string"
-            }
-          },
-          {
-            "description": "Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked",
-            "in": "header",
-            "name": "X-Profile-Token",
-            "schema": {
-              "examples": [
-                "pvt_5f3a9c1e7b2d4e8fa0c6"
-              ],
-              "type": "string"
-            }
-          },
-          {
-            "in": "header",
-            "name": "If-Match",
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "in": "header",
-            "name": "If-None-Match",
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "description": "Opaque identifier",
-            "in": "path",
-            "name": "id",
-            "required": true,
-            "schema": {
-              "description": "Opaque identifier",
-              "examples": [
-                "1"
-              ],
-              "minLength": 1,
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/PersonalCollection"
-                }
-              }
-            },
-            "description": "OK",
-            "headers": {
-              "ETag": {
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/PersonalCollection"
+                }
+              }
+            },
+            "description": "OK",
+            "headers": {
+              "ETag": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
           },
           "400": {
             "content": {
@@ -149476,11 +151491,9 @@
         "x-silo-class": "profile_scoped",
         "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
-      }
-    },
-    "/api/v2/devices/{device_id}/settings": {
-      "delete": {
-        "operationId": "clearDeviceSettings",
+      },
+      "patch": {
+        "operationId": "updateDevice",
         "parameters": [
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
@@ -149528,11 +151541,227 @@
               "minLength": 1,
               "type": "string"
             }
+          },
+          {
+            "in": "header",
+            "name": "X-Prairie-Device-Id",
+            "schema": {
+              "maxLength": 128,
+              "type": "string"
+            }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/DeviceUpdate"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
-          "204": {
-            "description": "No Content"
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/DeviceSettings"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "406": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Acceptable"
+          },
+          "408": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Timeout"
+          },
+          "413": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "429": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Too Many Requests"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "summary": "Update a device's entry for the acting profile, or another household profile, and return it; omitted members are unchanged. Settings and login sessions are untouched.",
+        "tags": [
+          "devices"
+        ],
+        "x-silo-class": "profile_scoped",
+        "x-silo-retry-safety": "natural_idempotent",
+        "x-silo-service-backed": true
+      }
+    },
+    "/api/v2/devices/{device_id}/settings": {
+      "delete": {
+        "operationId": "clearDeviceSettings",
+        "parameters": [
+          {
+            "description": "The household profile acting for this request; it must belong to the authenticated account.",
+            "in": "header",
+            "name": "X-Profile-Id",
+            "required": true,
+            "schema": {
+              "examples": [
+                "1"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked",
+            "in": "header",
+            "name": "X-Profile-Token",
+            "schema": {
+              "examples": [
+                "pvt_5f3a9c1e7b2d4e8fa0c6"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "in": "path",
+            "name": "device_id",
+            "required": true,
+            "schema": {
+              "maxLength": 128,
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "description": "Another profile on the account; requires household management authority",
+            "explode": false,
+            "in": "query",
+            "name": "profile_id",
+            "schema": {
+              "description": "Another profile on the account; requires household management authority",
+              "examples": [
+                "1"
+              ],
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No Content"
           },
           "400": {
             "content": {
@@ -161274,12 +163503,12 @@
             }
           },
           {
-            "description": "Artwork variant to presign; absent picks each surface's default",
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
             "explode": false,
             "in": "query",
             "name": "image_size",
             "schema": {
-              "description": "Artwork variant to presign; absent picks each surface's default",
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
               "enum": [
                 "small",
                 "medium",
@@ -161292,6 +163521,86 @@
               "type": "string"
             }
           },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
           {
             "description": "Page size; default 50, maximum 200",
             "explode": false,
@@ -161580,12 +163889,12 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Remove the item from the acting profile's favorites; an absent entry succeeds, but automatic retries can repeat provider and refresh effects.",
+        "summary": "Remove the item from the acting profile's favorites. An absent entry succeeds and changes nothing, so a retry repeats no change or notification; it cannot resend notifications an interrupted earlier call never sent.",
         "tags": [
           "favorites"
         ],
         "x-silo-class": "profile_scoped",
-        "x-silo-retry-safety": "non_retryable",
+        "x-silo-retry-safety": "natural_idempotent",
         "x-silo-service-backed": true
       },
       "get": {
@@ -161884,12 +164193,12 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Add the item to the acting profile's favorites. Automatic retries are unsafe because provider and refresh effects are not change-gated.",
+        "summary": "Add the item to the acting profile's favorites. Adding an item already there succeeds and changes nothing, so a retry repeats no change or notification; it cannot resend notifications an interrupted earlier call never sent.",
         "tags": [
           "favorites"
         ],
         "x-silo-class": "profile_scoped",
-        "x-silo-retry-safety": "non_retryable",
+        "x-silo-retry-safety": "natural_idempotent",
         "x-silo-service-backed": true
       }
     },
@@ -161921,12 +164230,12 @@
             }
           },
           {
-            "description": "Artwork variant to presign; absent picks each surface's default",
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
             "explode": false,
             "in": "query",
             "name": "image_size",
             "schema": {
-              "description": "Artwork variant to presign; absent picks each surface's default",
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
               "enum": [
                 "small",
                 "medium",
@@ -161939,6 +164248,86 @@
               "type": "string"
             }
           },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
           {
             "description": "Page size; default 50, maximum 200",
             "explode": false,
@@ -164290,12 +166679,12 @@
             }
           },
           {
-            "description": "Artwork variant to presign for included_sections, as on getHomeSectionItems; absent picks each surface's default",
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
             "explode": false,
             "in": "query",
             "name": "image_size",
             "schema": {
-              "description": "Artwork variant to presign for included_sections, as on getHomeSectionItems; absent picks each surface's default",
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
               "enum": [
                 "small",
                 "medium",
@@ -164307,6 +166696,86 @@
               ],
               "type": "string"
             }
+          },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
           }
         ],
         "responses": {
@@ -164452,12 +166921,12 @@
             }
           },
           {
-            "description": "Artwork variant to presign; absent picks each surface's default",
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
             "explode": false,
             "in": "query",
             "name": "image_size",
             "schema": {
-              "description": "Artwork variant to presign; absent picks each surface's default",
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
               "enum": [
                 "small",
                 "medium",
@@ -164469,6 +166938,86 @@
               ],
               "type": "string"
             }
+          },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
           }
         ],
         "responses": {
@@ -164628,12 +167177,12 @@
             }
           },
           {
-            "description": "Artwork variant to presign; absent picks each surface's default",
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
             "explode": false,
             "in": "query",
             "name": "image_size",
             "schema": {
-              "description": "Artwork variant to presign; absent picks each surface's default",
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
               "enum": [
                 "small",
                 "medium",
@@ -164645,6 +167194,86 @@
               ],
               "type": "string"
             }
+          },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
           }
         ],
         "responses": {
@@ -167714,6 +170343,17 @@
               "type": "string"
             }
           },
+          {
+            "description": "List the items an admin marked as intentionally unmatched instead of the ones awaiting a match",
+            "explode": false,
+            "in": "query",
+            "name": "ignored",
+            "schema": {
+              "default": false,
+              "description": "List the items an admin marked as intentionally unmatched instead of the ones awaiting a match",
+              "type": "boolean"
+            }
+          },
           {
             "description": "Opaque cursor from page.next_cursor",
             "explode": false,
@@ -167835,7 +170475,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Page the catalog items awaiting a metadata match, in title order.",
+        "summary": "Page the catalog items awaiting a metadata match, in title order. Items an admin marked as intentionally unmatched are left out unless ignored is set, which lists only those.",
         "tags": [
           "libraries"
         ],
@@ -167843,9 +170483,9 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/libraries/{id}": {
+    "/api/v2/libraries/unmatched-items/{content_id}/ignore": {
       "delete": {
-        "operationId": "deleteLibrary",
+        "operationId": "unignoreUnmatchedItem",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -167870,14 +170510,14 @@
             }
           },
           {
-            "description": "The library",
+            "description": "The catalog item",
             "in": "path",
-            "name": "id",
+            "name": "content_id",
             "required": true,
             "schema": {
-              "description": "The library",
+              "description": "The catalog item",
               "examples": [
-                "1"
+                "local-ad5847acdd9590cc9d353da12446"
               ],
               "minLength": 1,
               "type": "string"
@@ -167885,28 +170525,8 @@
           }
         ],
         "responses": {
-          "202": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/AdminJob"
-                }
-              }
-            },
-            "description": "Accepted",
-            "headers": {
-              "Location": {
-                "schema": {
-                  "description": "URI of the queued job",
-                  "type": "string"
-                }
-              },
-              "Retry-After": {
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
+          "204": {
+            "description": "No Content"
           },
           "400": {
             "content": {
@@ -167958,16 +170578,6 @@
             },
             "description": "Not Acceptable"
           },
-          "409": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Conflict"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -168014,7 +170624,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Disable a library and queue the job that deletes it and its items; answers 202 with the job.",
+        "summary": "Clear an item's intentionally-unmatched mark so it returns to the unmatched list and automatic matching tries it again; an unmarked item is left as is.",
         "tags": [
           "libraries"
         ],
@@ -168023,8 +170633,8 @@
         "x-silo-retry-safety": "natural_idempotent",
         "x-silo-service-backed": true
       },
-      "patch": {
-        "operationId": "updateLibrary",
+      "put": {
+        "operationId": "ignoreUnmatchedItem",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -168049,40 +170659,23 @@
             }
           },
           {
-            "description": "The library to update",
+            "description": "The catalog item",
             "in": "path",
-            "name": "id",
+            "name": "content_id",
             "required": true,
             "schema": {
-              "description": "The library to update",
+              "description": "The catalog item",
               "examples": [
-                "1"
+                "local-ad5847acdd9590cc9d353da12446"
               ],
               "minLength": 1,
               "type": "string"
             }
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/LibraryUpdate"
-              }
-            }
-          },
-          "required": true
-        },
         "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Library"
-                }
-              }
-            },
-            "description": "OK"
+          "204": {
+            "description": "No Content"
           },
           "400": {
             "content": {
@@ -168134,16 +170727,6 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
           "409": {
             "content": {
               "application/problem+json": {
@@ -168154,26 +170737,6 @@
             },
             "description": "Conflict"
           },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unsupported Media Type"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -168220,19 +170783,19 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Update a library; omitted members are unchanged. A changed path set queues a rescan and a changed language a quick metadata refresh.",
+        "summary": "Mark an unmatched, pending or ambiguous movie or series as intentionally unmatched: it leaves the unmatched list and the matcher queues and automatic matching leaves it alone, while it stays playable with its local metadata. Match Item still works and clears the mark. Books cannot be ignored.",
         "tags": [
           "libraries"
         ],
         "x-silo-class": "acting_admin",
         "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "non_retryable",
+        "x-silo-retry-safety": "natural_idempotent",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/libraries/{id}/check-mount": {
-      "post": {
-        "operationId": "checkLibraryMount",
+    "/api/v2/libraries/{id}": {
+      "delete": {
+        "operationId": "deleteLibrary",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -168272,15 +170835,28 @@
           }
         ],
         "responses": {
-          "200": {
+          "202": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/LibraryMountCheck"
+                  "$ref": "#/components/schemas/AdminJob"
                 }
               }
             },
-            "description": "OK"
+            "description": "Accepted",
+            "headers": {
+              "Location": {
+                "schema": {
+                  "description": "URI of the queued job",
+                  "type": "string"
+                }
+              },
+              "Retry-After": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
           },
           "400": {
             "content": {
@@ -168332,6 +170908,16 @@
             },
             "description": "Not Acceptable"
           },
+          "409": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -168378,7 +170964,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Probe every root of a library; a healthy result clears an outstanding empty-root or dead-root warning.",
+        "summary": "Disable a library and queue the job that deletes it and its items; answers 202 with the job.",
         "tags": [
           "libraries"
         ],
@@ -168386,11 +170972,9 @@
         "x-silo-demo-restricted": true,
         "x-silo-retry-safety": "natural_idempotent",
         "x-silo-service-backed": true
-      }
-    },
-    "/api/v2/libraries/{id}/confirm-empty-root-cleanup": {
-      "post": {
-        "operationId": "confirmEmptyRootCleanup",
+      },
+      "patch": {
+        "operationId": "updateLibrary",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -168415,12 +170999,12 @@
             }
           },
           {
-            "description": "The library",
+            "description": "The library to update",
             "in": "path",
             "name": "id",
             "required": true,
             "schema": {
-              "description": "The library",
+              "description": "The library to update",
               "examples": [
                 "1"
               ],
@@ -168429,12 +171013,22 @@
             }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/LibraryUpdate"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/EmptyRootCleanup"
+                  "$ref": "#/components/schemas/Library"
                 }
               }
             },
@@ -168490,6 +171084,46 @@
             },
             "description": "Not Acceptable"
           },
+          "408": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Timeout"
+          },
+          "409": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
+          "413": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -168536,7 +171170,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Arm the library's next scan to clean up an empty root once instead of treating it as a lost mount.",
+        "summary": "Update a library; omitted members are unchanged. A changed path set queues a rescan and a changed language a quick metadata refresh.",
         "tags": [
           "libraries"
         ],
@@ -168546,9 +171180,9 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/libraries/{id}/metadata-match-queue": {
-      "get": {
-        "operationId": "getMetadataMatchQueue",
+    "/api/v2/libraries/{id}/check-mount": {
+      "post": {
+        "operationId": "checkLibraryMount",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -168573,48 +171207,18 @@
             }
           },
           {
-            "description": "Library identifier",
+            "description": "The library",
             "in": "path",
             "name": "id",
             "required": true,
             "schema": {
-              "description": "Library identifier",
+              "description": "The library",
               "examples": [
                 "1"
               ],
               "minLength": 1,
               "type": "string"
             }
-          },
-          {
-            "description": "Rows per list; default 10, maximum 50",
-            "explode": false,
-            "in": "query",
-            "name": "limit",
-            "schema": {
-              "default": 10,
-              "description": "Rows per list; default 10, maximum 50",
-              "examples": [
-                10
-              ],
-              "format": "int64",
-              "maximum": 50,
-              "minimum": 1,
-              "type": "integer"
-            }
-          },
-          {
-            "description": "Opaque cursor from the previous page",
-            "explode": false,
-            "in": "query",
-            "name": "cursor",
-            "schema": {
-              "description": "Opaque cursor from the previous page",
-              "examples": [
-                ""
-              ],
-              "type": "string"
-            }
           }
         ],
         "responses": {
@@ -168622,7 +171226,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/MetadataMatchQueueDetail"
+                  "$ref": "#/components/schemas/LibraryMountCheck"
                 }
               }
             },
@@ -168724,17 +171328,19 @@
             "bearerAuth": []
           }
         ],
-        "summary": "One library's matcher backlog counts with a page of its queued movies, series roots and raw files.",
+        "summary": "Probe every root of a library; a healthy result clears an outstanding empty-root or dead-root warning.",
         "tags": [
           "libraries"
         ],
         "x-silo-class": "acting_admin",
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "natural_idempotent",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/libraries/{id}/metadata-match-queue/cancel": {
+    "/api/v2/libraries/{id}/confirm-empty-root-cleanup": {
       "post": {
-        "operationId": "cancelMetadataMatchQueue",
+        "operationId": "confirmEmptyRootCleanup",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -168778,7 +171384,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/MetadataMatchQueueAction"
+                  "$ref": "#/components/schemas/EmptyRootCleanup"
                 }
               }
             },
@@ -168880,7 +171486,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Drop every queued matcher entry of the library and suppress its raw backlog; answers what was canceled.",
+        "summary": "Arm the library's next scan to clean up an empty root once instead of treating it as a lost mount.",
         "tags": [
           "libraries"
         ],
@@ -168890,9 +171496,9 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/libraries/{id}/metadata-match-queue/retry": {
-      "post": {
-        "operationId": "retryMetadataMatchQueue",
+    "/api/v2/libraries/{id}/metadata-match-queue": {
+      "get": {
+        "operationId": "getMetadataMatchQueue",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -168917,18 +171523,48 @@
             }
           },
           {
-            "description": "The library",
+            "description": "Library identifier",
             "in": "path",
             "name": "id",
             "required": true,
             "schema": {
-              "description": "The library",
+              "description": "Library identifier",
               "examples": [
                 "1"
               ],
               "minLength": 1,
               "type": "string"
             }
+          },
+          {
+            "description": "Rows per list; default 10, maximum 50",
+            "explode": false,
+            "in": "query",
+            "name": "limit",
+            "schema": {
+              "default": 10,
+              "description": "Rows per list; default 10, maximum 50",
+              "examples": [
+                10
+              ],
+              "format": "int64",
+              "maximum": 50,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Opaque cursor from the previous page",
+            "explode": false,
+            "in": "query",
+            "name": "cursor",
+            "schema": {
+              "description": "Opaque cursor from the previous page",
+              "examples": [
+                ""
+              ],
+              "type": "string"
+            }
           }
         ],
         "responses": {
@@ -168936,7 +171572,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/MetadataMatchQueueAction"
+                  "$ref": "#/components/schemas/MetadataMatchQueueDetail"
                 }
               }
             },
@@ -169038,19 +171674,17 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Re-sync and immediately retry every queued matcher entry of the library; answers the counts afterwards.",
+        "summary": "One library's matcher backlog counts with a page of its queued movies, series roots and raw files.",
         "tags": [
           "libraries"
         ],
         "x-silo-class": "acting_admin",
-        "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/libraries/{id}/poster": {
-      "delete": {
-        "operationId": "deleteLibraryPoster",
+    "/api/v2/libraries/{id}/metadata-match-queue/cancel": {
+      "post": {
+        "operationId": "cancelMetadataMatchQueue",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -169090,8 +171724,15 @@
           }
         ],
         "responses": {
-          "204": {
-            "description": "No Content"
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/MetadataMatchQueueAction"
+                }
+              }
+            },
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -169189,7 +171830,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Remove the library's poster; a library without one is left as is.",
+        "summary": "Drop every queued matcher entry of the library and suppress its raw backlog; answers what was canceled.",
         "tags": [
           "libraries"
         ],
@@ -169197,9 +171838,11 @@
         "x-silo-demo-restricted": true,
         "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
-      },
-      "put": {
-        "operationId": "uploadLibraryPoster",
+      }
+    },
+    "/api/v2/libraries/{id}/metadata-match-queue/retry": {
+      "post": {
+        "operationId": "retryMetadataMatchQueue",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -169224,12 +171867,12 @@
             }
           },
           {
-            "description": "Library identifier",
+            "description": "The library",
             "in": "path",
             "name": "id",
             "required": true,
             "schema": {
-              "description": "Library identifier",
+              "description": "The library",
               "examples": [
                 "1"
               ],
@@ -169238,27 +171881,12 @@
             }
           }
         ],
-        "requestBody": {
-          "content": {
-            "multipart/form-data": {
-              "encoding": {
-                "poster": {
-                  "contentType": "image/jpeg,image/png,image/webp"
-                }
-              },
-              "schema": {
-                "$ref": "#/components/schemas/LibraryPosterForm"
-              }
-            }
-          },
-          "required": true
-        },
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/Library"
+                  "$ref": "#/components/schemas/MetadataMatchQueueAction"
                 }
               }
             },
@@ -169314,36 +171942,6 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unsupported Media Type"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -169390,7 +171988,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Store a poster for the library from a multipart upload (JPEG, PNG or WebP, at most 10 MiB) and answer the library with its new poster URL.",
+        "summary": "Re-sync and immediately retry every queued matcher entry of the library; answers the counts afterwards.",
         "tags": [
           "libraries"
         ],
@@ -169400,9 +171998,9 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/libraries/{id}/providers": {
-      "get": {
-        "operationId": "getLibraryProviders",
+    "/api/v2/libraries/{id}/poster": {
+      "delete": {
+        "operationId": "deleteLibraryPoster",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -169442,15 +172040,8 @@
           }
         ],
         "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/LibraryProviders"
-                }
-              }
-            },
-            "description": "OK"
+          "204": {
+            "description": "No Content"
           },
           "400": {
             "content": {
@@ -169548,15 +172139,17 @@
             "bearerAuth": []
           }
         ],
-        "summary": "The library's metadata provider chain, per content level. Legacy unlevelled rows (content_level '') that an upgraded database keeps are not exposed; setLibraryProviders preserves them.",
+        "summary": "Remove the library's poster; a library without one is left as is.",
         "tags": [
           "libraries"
         ],
         "x-silo-class": "acting_admin",
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       },
       "put": {
-        "operationId": "setLibraryProviders",
+        "operationId": "uploadLibraryPoster",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -169597,17 +172190,29 @@
         ],
         "requestBody": {
           "content": {
-            "application/json": {
+            "multipart/form-data": {
+              "encoding": {
+                "poster": {
+                  "contentType": "image/jpeg,image/png,image/webp"
+                }
+              },
               "schema": {
-                "$ref": "#/components/schemas/LibraryProvidersSet"
+                "$ref": "#/components/schemas/LibraryPosterForm"
               }
             }
           },
           "required": true
         },
         "responses": {
-          "204": {
-            "description": "No Content"
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Library"
+                }
+              }
+            },
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -169735,7 +172340,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Replace the library's whole provider chain and wake the matcher. Legacy unlevelled rows (content_level '') are kept as they are; a level not listed ends up with no providers. The local metadata entry is stored first in its level whatever priority it is sent with.",
+        "summary": "Store a poster for the library from a multipart upload (JPEG, PNG or WebP, at most 10 MiB) and answer the library with its new poster URL.",
         "tags": [
           "libraries"
         ],
@@ -169745,9 +172350,9 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/libraries/{id}/refresh-metadata": {
-      "post": {
-        "operationId": "refreshLibraryMetadata",
+    "/api/v2/libraries/{id}/providers": {
+      "get": {
+        "operationId": "getLibraryProviders",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -169772,12 +172377,12 @@
             }
           },
           {
-            "description": "Library identifier",
+            "description": "The library",
             "in": "path",
             "name": "id",
             "required": true,
             "schema": {
-              "description": "Library identifier",
+              "description": "The library",
               "examples": [
                 "1"
               ],
@@ -169786,39 +172391,16 @@
             }
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/LibraryRefresh",
-                "description": "Absent picks a quick refresh"
-              }
-            }
-          }
-        },
         "responses": {
-          "202": {
+          "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/AdminJob"
+                  "$ref": "#/components/schemas/LibraryProviders"
                 }
               }
             },
-            "description": "Accepted",
-            "headers": {
-              "Location": {
-                "schema": {
-                  "description": "URI of the queued job",
-                  "type": "string"
-                }
-              },
-              "Retry-After": {
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -169870,46 +172452,6 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
-          "409": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Conflict"
-          },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unsupported Media Type"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -169956,30 +172498,18 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Queue a metadata refresh of the library's items; answers 202 with the job.",
+        "summary": "The library's metadata provider chain, per content level. Legacy unlevelled rows (content_level '') that an upgraded database keeps are not exposed; setLibraryProviders preserves them.",
         "tags": [
           "libraries"
         ],
         "x-silo-class": "acting_admin",
-        "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "coalescing",
         "x-silo-service-backed": true
-      }
-    },
-    "/api/v2/library-jobs/{job_id}": {
-      "get": {
-        "operationId": "getLibraryJob",
+      },
+      "put": {
+        "operationId": "setLibraryProviders",
         "parameters": [
           {
-            "description": "Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed.",
-            "in": "header",
-            "name": "If-Match",
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "description": "Optional. When present, it must name a profile of the authenticated account.",
+            "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
             "in": "header",
             "name": "X-Profile-Id",
             "schema": {
@@ -170001,60 +172531,33 @@
             }
           },
           {
+            "description": "Library identifier",
             "in": "path",
-            "name": "job_id",
+            "name": "id",
             "required": true,
             "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "in": "header",
-            "name": "If-None-Match",
-            "schema": {
+              "description": "Library identifier",
+              "examples": [
+                "1"
+              ],
+              "minLength": 1,
               "type": "string"
             }
           }
         ],
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/AdminJob"
-                }
-              }
-            },
-            "description": "OK",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              },
-              "Location": {
-                "schema": {
-                  "type": "string"
-                }
-              },
-              "Retry-After": {
-                "schema": {
-                  "type": "string"
-                }
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/LibraryProvidersSet"
               }
             }
           },
-          "304": {
-            "description": "The representation named by If-None-Match is current; no body.",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
+          "required": true
+        },
+        "responses": {
+          "204": {
+            "description": "No Content"
           },
           "400": {
             "content": {
@@ -170106,7 +172609,7 @@
             },
             "description": "Not Acceptable"
           },
-          "412": {
+          "408": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -170114,15 +172617,27 @@
                 }
               }
             },
-            "description": "Precondition Failed",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+            "description": "Request Timeout"
+          },
+          "413": {
+            "content": {
+              "application/problem+json": {
                 "schema": {
-                  "type": "string"
+                  "$ref": "#/components/schemas/Problem"
                 }
               }
-            }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
           },
           "422": {
             "content": {
@@ -170170,18 +172685,19 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Poll accepted library work. Terminal jobs remain available for at least 24 hours.",
+        "summary": "Replace the library's whole provider chain and wake the matcher. Legacy unlevelled rows (content_level '') are kept as they are; a level not listed ends up with no providers. The local metadata entry is stored first in its level whatever priority it is sent with.",
         "tags": [
           "libraries"
         ],
-        "x-silo-class": "profile_scoped",
-        "x-silo-conditional": true,
+        "x-silo-class": "acting_admin",
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/library-jobs/{job_id}/cancel": {
+    "/api/v2/libraries/{id}/refresh-metadata": {
       "post": {
-        "operationId": "cancelLibraryJob",
+        "operationId": "refreshLibraryMetadata",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -170206,37 +172722,31 @@
             }
           },
           {
+            "description": "Library identifier",
             "in": "path",
-            "name": "job_id",
+            "name": "id",
             "required": true,
             "schema": {
+              "description": "Library identifier",
+              "examples": [
+                "1"
+              ],
+              "minLength": 1,
               "type": "string"
             }
           }
         ],
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/AdminJob"
-                }
-              }
-            },
-            "description": "The job was already canceled.",
-            "headers": {
-              "ETag": {
-                "schema": {
-                  "type": "string"
-                }
-              },
-              "Location": {
-                "schema": {
-                  "type": "string"
-                }
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/LibraryRefresh",
+                "description": "Absent picks a quick refresh"
               }
             }
-          },
+          }
+        },
+        "responses": {
           "202": {
             "content": {
               "application/json": {
@@ -170247,13 +172757,9 @@
             },
             "description": "Accepted",
             "headers": {
-              "ETag": {
-                "schema": {
-                  "type": "string"
-                }
-              },
               "Location": {
                 "schema": {
+                  "description": "URI of the queued job",
                   "type": "string"
                 }
               },
@@ -170314,6 +172820,16 @@
             },
             "description": "Not Acceptable"
           },
+          "408": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Timeout"
+          },
           "409": {
             "content": {
               "application/problem+json": {
@@ -170324,6 +172840,26 @@
             },
             "description": "Conflict"
           },
+          "413": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -170370,7 +172906,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Request best-effort cancellation of metadata refresh. Completed metadata changes remain. Deletion cannot be canceled.",
+        "summary": "Queue a metadata refresh of the library's items; answers 202 with the job.",
         "tags": [
           "libraries"
         ],
@@ -170380,15 +172916,22 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/library-playback-prefs": {
+    "/api/v2/library-jobs/{job_id}": {
       "get": {
-        "operationId": "listLibraryPlaybackPreferences",
+        "operationId": "getLibraryJob",
         "parameters": [
           {
-            "description": "The household profile acting for this request; it must belong to the authenticated account.",
+            "description": "Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed.",
+            "in": "header",
+            "name": "If-Match",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "Optional. When present, it must name a profile of the authenticated account.",
             "in": "header",
             "name": "X-Profile-Id",
-            "required": true,
             "schema": {
               "examples": [
                 "1"
@@ -170406,6 +172949,21 @@
               ],
               "type": "string"
             }
+          },
+          {
+            "in": "path",
+            "name": "job_id",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "in": "header",
+            "name": "If-None-Match",
+            "schema": {
+              "type": "string"
+            }
           }
         ],
         "responses": {
@@ -170413,11 +172971,40 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/LibraryPlaybackPreferenceCollection"
+                  "$ref": "#/components/schemas/AdminJob"
                 }
               }
             },
-            "description": "OK"
+            "description": "OK",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              },
+              "Location": {
+                "schema": {
+                  "type": "string"
+                }
+              },
+              "Retry-After": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "304": {
+            "description": "The representation named by If-None-Match is current; no body.",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
           },
           "400": {
             "content": {
@@ -170469,6 +173056,24 @@
             },
             "description": "Not Acceptable"
           },
+          "412": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Precondition Failed",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -170515,23 +173120,23 @@
             "bearerAuth": []
           }
         ],
-        "summary": "List the acting profile's per-library playback overrides.",
+        "summary": "Poll accepted library work. Terminal jobs remain available for at least 24 hours.",
         "tags": [
-          "preferences"
+          "libraries"
         ],
         "x-silo-class": "profile_scoped",
+        "x-silo-conditional": true,
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/library-playback-prefs/{library_id}": {
-      "delete": {
-        "operationId": "deleteLibraryPlaybackPreference",
+    "/api/v2/library-jobs/{job_id}/cancel": {
+      "post": {
+        "operationId": "cancelLibraryJob",
         "parameters": [
           {
-            "description": "The household profile acting for this request; it must belong to the authenticated account.",
+            "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
             "in": "header",
             "name": "X-Profile-Id",
-            "required": true,
             "schema": {
               "examples": [
                 "1"
@@ -170551,23 +173156,63 @@
             }
           },
           {
-            "description": "The library",
             "in": "path",
-            "name": "library_id",
+            "name": "job_id",
             "required": true,
             "schema": {
-              "description": "The library",
-              "examples": [
-                "1"
-              ],
-              "minLength": 1,
               "type": "string"
             }
           }
         ],
         "responses": {
-          "204": {
-            "description": "No Content"
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AdminJob"
+                }
+              }
+            },
+            "description": "The job was already canceled.",
+            "headers": {
+              "ETag": {
+                "schema": {
+                  "type": "string"
+                }
+              },
+              "Location": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "202": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AdminJob"
+                }
+              }
+            },
+            "description": "Accepted",
+            "headers": {
+              "ETag": {
+                "schema": {
+                  "type": "string"
+                }
+              },
+              "Location": {
+                "schema": {
+                  "type": "string"
+                }
+              },
+              "Retry-After": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
           },
           "400": {
             "content": {
@@ -170619,6 +173264,16 @@
             },
             "description": "Not Acceptable"
           },
+          "409": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -170665,17 +173320,19 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Remove the acting profile's playback overrides for a library.",
+        "summary": "Request best-effort cancellation of metadata refresh. Completed metadata changes remain. Deletion cannot be canceled.",
         "tags": [
-          "preferences"
+          "libraries"
         ],
-        "x-silo-class": "profile_scoped",
+        "x-silo-class": "acting_admin",
         "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "natural_idempotent",
+        "x-silo-retry-safety": "coalescing",
         "x-silo-service-backed": true
-      },
-      "patch": {
-        "operationId": "updateLibraryPlaybackPreference",
+      }
+    },
+    "/api/v2/library-playback-prefs": {
+      "get": {
+        "operationId": "listLibraryPlaybackPreferences",
         "parameters": [
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
@@ -170699,35 +173356,18 @@
               ],
               "type": "string"
             }
-          },
-          {
-            "description": "The library",
-            "in": "path",
-            "name": "library_id",
-            "required": true,
-            "schema": {
-              "description": "The library",
-              "examples": [
-                "1"
-              ],
-              "minLength": 1,
-              "type": "string"
-            }
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/LibraryPlaybackPreferenceUpdate"
-              }
-            }
-          },
-          "required": true
-        },
         "responses": {
-          "204": {
-            "description": "No Content"
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/LibraryPlaybackPreferenceCollection"
+                }
+              }
+            },
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -170779,36 +173419,6 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unsupported Media Type"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -170855,19 +173465,17 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Change the acting profile's playback overrides for a library: omitted members are unchanged, null clears one.",
+        "summary": "List the acting profile's per-library playback overrides.",
         "tags": [
           "preferences"
         ],
         "x-silo-class": "profile_scoped",
-        "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "natural_idempotent",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/library/{id}/collections": {
-      "get": {
-        "operationId": "getLibraryCollections",
+    "/api/v2/library-playback-prefs/{library_id}": {
+      "delete": {
+        "operationId": "deleteLibraryPlaybackPreference",
         "parameters": [
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
@@ -170893,12 +173501,12 @@
             }
           },
           {
-            "description": "Library identifier",
+            "description": "The library",
             "in": "path",
-            "name": "id",
+            "name": "library_id",
             "required": true,
             "schema": {
-              "description": "Library identifier",
+              "description": "The library",
               "examples": [
                 "1"
               ],
@@ -170908,15 +173516,8 @@
           }
         ],
         "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/LibraryCollectionTab"
-                }
-              }
-            },
-            "description": "OK"
+          "204": {
+            "description": "No Content"
           },
           "400": {
             "content": {
@@ -171014,17 +173615,17 @@
             "bearerAuth": []
           }
         ],
-        "summary": "The library's Collections tab: curated collections, their groups, and the viewer's opted-in personal collections.",
+        "summary": "Remove the acting profile's playback overrides for a library.",
         "tags": [
-          "libraries"
+          "preferences"
         ],
         "x-silo-class": "profile_scoped",
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "natural_idempotent",
         "x-silo-service-backed": true
-      }
-    },
-    "/api/v2/library/{id}/collections/{collection_id}/items": {
-      "get": {
-        "operationId": "getLibraryCollectionItems",
+      },
+      "patch": {
+        "operationId": "updateLibraryPlaybackPreference",
         "parameters": [
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
@@ -171050,55 +173651,208 @@
             }
           },
           {
-            "description": "Opaque identifier",
+            "description": "The library",
             "in": "path",
-            "name": "id",
+            "name": "library_id",
             "required": true,
             "schema": {
-              "description": "Opaque identifier",
+              "description": "The library",
               "examples": [
                 "1"
               ],
               "minLength": 1,
               "type": "string"
             }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/LibraryPlaybackPreferenceUpdate"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "204": {
+            "description": "No Content"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "406": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Acceptable"
+          },
+          "408": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Timeout"
+          },
+          "413": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "429": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Too Many Requests"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Internal Server Error"
           },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "security": [
           {
-            "description": "Opaque identifier",
-            "in": "path",
-            "name": "collection_id",
+            "bearerAuth": []
+          }
+        ],
+        "summary": "Change the acting profile's playback overrides for a library: omitted members are unchanged, null clears one.",
+        "tags": [
+          "preferences"
+        ],
+        "x-silo-class": "profile_scoped",
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "natural_idempotent",
+        "x-silo-service-backed": true
+      }
+    },
+    "/api/v2/library/{id}/collections": {
+      "get": {
+        "operationId": "getLibraryCollections",
+        "parameters": [
+          {
+            "description": "The household profile acting for this request; it must belong to the authenticated account.",
+            "in": "header",
+            "name": "X-Profile-Id",
             "required": true,
             "schema": {
-              "description": "Opaque identifier",
               "examples": [
                 "1"
               ],
-              "minLength": 1,
               "type": "string"
             }
           },
           {
-            "description": "Page size; default 50, maximum 200",
-            "explode": false,
-            "in": "query",
-            "name": "limit",
+            "description": "Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked",
+            "in": "header",
+            "name": "X-Profile-Token",
             "schema": {
-              "default": 50,
-              "description": "Page size; default 50, maximum 200",
               "examples": [
-                50
+                "pvt_5f3a9c1e7b2d4e8fa0c6"
               ],
-              "format": "int64",
-              "maximum": 200,
-              "minimum": 1,
-              "type": "integer"
+              "type": "string"
             }
           },
           {
-            "explode": false,
-            "in": "query",
-            "name": "cursor",
+            "description": "Library identifier",
+            "in": "path",
+            "name": "id",
+            "required": true,
             "schema": {
+              "description": "Library identifier",
+              "examples": [
+                "1"
+              ],
+              "minLength": 1,
               "type": "string"
             }
           }
@@ -171108,7 +173862,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/CatalogItemCollection"
+                  "$ref": "#/components/schemas/LibraryCollectionTab"
                 }
               }
             },
@@ -171210,7 +173964,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Page visible library collection items in stable order. Restart after a collection change.",
+        "summary": "The library's Collections tab: curated collections, their groups, and the viewer's opted-in personal collections.",
         "tags": [
           "libraries"
         ],
@@ -171218,9 +173972,9 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/library/{id}/layout": {
+    "/api/v2/library/{id}/collections/{collection_id}/items": {
       "get": {
-        "operationId": "getLibraryLayout",
+        "operationId": "getLibraryCollectionItems",
         "parameters": [
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
@@ -171246,18 +174000,57 @@
             }
           },
           {
-            "description": "Library identifier",
+            "description": "Opaque identifier",
             "in": "path",
             "name": "id",
             "required": true,
             "schema": {
-              "description": "Library identifier",
+              "description": "Opaque identifier",
+              "examples": [
+                "1"
+              ],
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "description": "Opaque identifier",
+            "in": "path",
+            "name": "collection_id",
+            "required": true,
+            "schema": {
+              "description": "Opaque identifier",
               "examples": [
                 "1"
               ],
               "minLength": 1,
               "type": "string"
             }
+          },
+          {
+            "description": "Page size; default 50, maximum 200",
+            "explode": false,
+            "in": "query",
+            "name": "limit",
+            "schema": {
+              "default": 50,
+              "description": "Page size; default 50, maximum 200",
+              "examples": [
+                50
+              ],
+              "format": "int64",
+              "maximum": 200,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "cursor",
+            "schema": {
+              "type": "string"
+            }
           }
         ],
         "responses": {
@@ -171265,7 +174058,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SectionLayout"
+                  "$ref": "#/components/schemas/CatalogItemCollection"
                 }
               }
             },
@@ -171367,7 +174160,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "The library's section layout for the acting profile, without items.",
+        "summary": "Page visible library collection items in stable order. Restart after a collection change.",
         "tags": [
           "libraries"
         ],
@@ -171375,9 +174168,9 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/library/{id}/sections": {
+    "/api/v2/library/{id}/layout": {
       "get": {
-        "operationId": "listLibrarySections",
+        "operationId": "getLibraryLayout",
         "parameters": [
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
@@ -171415,25 +174208,6 @@
               "minLength": 1,
               "type": "string"
             }
-          },
-          {
-            "description": "Artwork variant to presign; absent picks each surface's default",
-            "explode": false,
-            "in": "query",
-            "name": "image_size",
-            "schema": {
-              "description": "Artwork variant to presign; absent picks each surface's default",
-              "enum": [
-                "small",
-                "medium",
-                "large",
-                "original"
-              ],
-              "examples": [
-                "medium"
-              ],
-              "type": "string"
-            }
           }
         ],
         "responses": {
@@ -171441,7 +174215,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SectionCollection"
+                  "$ref": "#/components/schemas/SectionLayout"
                 }
               }
             },
@@ -171543,7 +174317,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "The library's sections with their cards, as the acting profile sees them.",
+        "summary": "The library's section layout for the acting profile, without items.",
         "tags": [
           "libraries"
         ],
@@ -171551,9 +174325,9 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/library/{id}/sections/{section_id}/items": {
+    "/api/v2/library/{id}/sections": {
       "get": {
-        "operationId": "getLibrarySectionItems",
+        "operationId": "listLibrarySections",
         "parameters": [
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
@@ -171593,26 +174367,12 @@
             }
           },
           {
-            "description": "Section identifier from the layout",
-            "in": "path",
-            "name": "section_id",
-            "required": true,
-            "schema": {
-              "description": "Section identifier from the layout",
-              "examples": [
-                "recently_added"
-              ],
-              "minLength": 1,
-              "type": "string"
-            }
-          },
-          {
-            "description": "Artwork variant to presign; absent picks each surface's default",
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
             "explode": false,
             "in": "query",
             "name": "image_size",
             "schema": {
-              "description": "Artwork variant to presign; absent picks each surface's default",
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
               "enum": [
                 "small",
                 "medium",
@@ -171624,6 +174384,86 @@
               ],
               "type": "string"
             }
+          },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
           }
         ],
         "responses": {
@@ -171631,7 +174471,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/Section"
+                  "$ref": "#/components/schemas/SectionCollection"
                 }
               }
             },
@@ -171733,7 +174573,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "One section of the library with its cards.",
+        "summary": "The library's sections with their cards, as the acting profile sees them.",
         "tags": [
           "libraries"
         ],
@@ -171741,9 +174581,9 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/library/{id}/user-collections": {
+    "/api/v2/library/{id}/sections/{section_id}/items": {
       "get": {
-        "operationId": "listLibraryUserCollections",
+        "operationId": "getLibrarySectionItems",
         "parameters": [
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
@@ -171781,6 +174621,119 @@
               "minLength": 1,
               "type": "string"
             }
+          },
+          {
+            "description": "Section identifier from the layout",
+            "in": "path",
+            "name": "section_id",
+            "required": true,
+            "schema": {
+              "description": "Section identifier from the layout",
+              "examples": [
+                "recently_added"
+              ],
+              "minLength": 1,
+              "type": "string"
+            }
+          },
+          {
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
+            "explode": false,
+            "in": "query",
+            "name": "image_size",
+            "schema": {
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
+              "enum": [
+                "small",
+                "medium",
+                "large",
+                "original"
+              ],
+              "examples": [
+                "medium"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
           }
         ],
         "responses": {
@@ -171788,7 +174741,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/UserCollectionCollection"
+                  "$ref": "#/components/schemas/Section"
                 }
               }
             },
@@ -171890,7 +174843,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "The viewer's own personal collections opted into this library's tab.",
+        "summary": "One section of the library with its cards.",
         "tags": [
           "libraries"
         ],
@@ -171898,14 +174851,15 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/livetv/channels": {
+    "/api/v2/library/{id}/user-collections": {
       "get": {
-        "operationId": "listLiveTVChannels",
+        "operationId": "listLibraryUserCollections",
         "parameters": [
           {
-            "description": "Optional while no profile on the authenticated account is PIN-protected or access-restricted (content-rating, advisory-age or library limits). Otherwise it is required: a request without it, or with an empty value, is refused with 422 validation_failed at header.x-profile-id; API keys are exempt. When present, it must name a profile of the authenticated account.",
+            "description": "The household profile acting for this request; it must belong to the authenticated account.",
             "in": "header",
             "name": "X-Profile-Id",
+            "required": true,
             "schema": {
               "examples": [
                 "1"
@@ -171925,13 +174879,16 @@
             }
           },
           {
-            "description": "Only channels of this tuner",
-            "explode": false,
-            "in": "query",
-            "name": "tuner_id",
+            "description": "Library identifier",
+            "in": "path",
+            "name": "id",
+            "required": true,
             "schema": {
-              "description": "Only channels of this tuner",
-              "maxLength": 256,
+              "description": "Library identifier",
+              "examples": [
+                "1"
+              ],
+              "minLength": 1,
               "type": "string"
             }
           }
@@ -171941,7 +174898,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/CollectionLiveTVChannel"
+                  "$ref": "#/components/schemas/UserCollectionCollection"
                 }
               }
             },
@@ -171997,16 +174954,6 @@
             },
             "description": "Not Acceptable"
           },
-          "409": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Conflict"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -172053,23 +175000,22 @@
             "bearerAuth": []
           }
         ],
-        "summary": "List Live TV channels across every tuner, or one tuner's.",
+        "summary": "The viewer's own personal collections opted into this library's tab.",
         "tags": [
-          "livetv"
+          "libraries"
         ],
         "x-silo-class": "profile_scoped",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/livetv/channels/{channel_id}/sessions": {
-      "post": {
-        "operationId": "startLiveTVSession",
+    "/api/v2/livetv/channels": {
+      "get": {
+        "operationId": "listLiveTVChannels",
         "parameters": [
           {
-            "description": "The household profile acting for this request; it must belong to the authenticated account.",
+            "description": "Optional while no profile on the authenticated account is PIN-protected or access-restricted (content-rating, advisory-age or library limits). Otherwise it is required: a request without it, or with an empty value, is refused with 422 validation_failed at header.x-profile-id; API keys are exempt. When present, it must name a profile of the authenticated account.",
             "in": "header",
             "name": "X-Profile-Id",
-            "required": true,
             "schema": {
               "examples": [
                 "1"
@@ -172089,40 +175035,27 @@
             }
           },
           {
-            "description": "Opaque identifier",
-            "in": "path",
-            "name": "channel_id",
-            "required": true,
+            "description": "Only channels of this tuner",
+            "explode": false,
+            "in": "query",
+            "name": "tuner_id",
             "schema": {
-              "description": "Opaque identifier",
-              "examples": [
-                "1"
-              ],
-              "minLength": 1,
+              "description": "Only channels of this tuner",
+              "maxLength": 256,
               "type": "string"
             }
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/LiveTVSessionStartBody",
-                "description": "Absent copies the broadcast streams"
-              }
-            }
-          }
-        },
         "responses": {
-          "201": {
+          "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/LiveTVSession"
+                  "$ref": "#/components/schemas/CollectionLiveTVChannel"
                 }
               }
             },
-            "description": "Created"
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -172174,16 +175107,6 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
           "409": {
             "content": {
               "application/problem+json": {
@@ -172194,26 +175117,6 @@
             },
             "description": "Conflict"
           },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unsupported Media Type"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -172260,24 +175163,23 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Claim a tuner and start watching a channel. The reply carries an opaque play URL and the transport to play it with.",
+        "summary": "List Live TV channels across every tuner, or one tuner's.",
         "tags": [
           "livetv"
         ],
         "x-silo-class": "profile_scoped",
-        "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/livetv/guide": {
-      "get": {
-        "operationId": "getLiveTVGuide",
+    "/api/v2/livetv/channels/{channel_id}/sessions": {
+      "post": {
+        "operationId": "startLiveTVSession",
         "parameters": [
           {
-            "description": "Optional while no profile on the authenticated account is PIN-protected or access-restricted (content-rating, advisory-age or library limits). Otherwise it is required: a request without it, or with an empty value, is refused with 422 validation_failed at header.x-profile-id; API keys are exempt. When present, it must name a profile of the authenticated account.",
+            "description": "The household profile acting for this request; it must belong to the authenticated account.",
             "in": "header",
             "name": "X-Profile-Id",
+            "required": true,
             "schema": {
               "examples": [
                 "1"
@@ -172297,52 +175199,40 @@
             }
           },
           {
-            "description": "Restrict to these channels, repeated (channel_id=a\u0026channel_id=b); absent lists every channel",
-            "explode": true,
-            "in": "query",
+            "description": "Opaque identifier",
+            "in": "path",
             "name": "channel_id",
+            "required": true,
             "schema": {
-              "description": "Restrict to these channels, repeated (channel_id=a\u0026channel_id=b); absent lists every channel",
-              "items": {
-                "type": "string"
-              },
-              "maxItems": 500,
-              "type": "array"
-            }
-          },
-          {
-            "description": "Window start; default now",
-            "explode": false,
-            "in": "query",
-            "name": "start",
-            "schema": {
-              "description": "Window start; default now",
-              "format": "date-time",
-              "type": "string"
-            }
-          },
-          {
-            "description": "Window end; default start plus 12 hours, at most 7 days after start",
-            "explode": false,
-            "in": "query",
-            "name": "end",
-            "schema": {
-              "description": "Window end; default start plus 12 hours, at most 7 days after start",
-              "format": "date-time",
+              "description": "Opaque identifier",
+              "examples": [
+                "1"
+              ],
+              "minLength": 1,
               "type": "string"
             }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/LiveTVSessionStartBody",
+                "description": "Absent copies the broadcast streams"
+              }
+            }
+          }
+        },
         "responses": {
-          "200": {
+          "201": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/LiveTVGuide"
+                  "$ref": "#/components/schemas/LiveTVSession"
                 }
               }
             },
-            "description": "OK"
+            "description": "Created"
           },
           "400": {
             "content": {
@@ -172394,6 +175284,16 @@
             },
             "description": "Not Acceptable"
           },
+          "408": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Timeout"
+          },
           "409": {
             "content": {
               "application/problem+json": {
@@ -172404,6 +175304,26 @@
             },
             "description": "Conflict"
           },
+          "413": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -172450,17 +175370,19 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Read the programme guide for a time window, optionally for chosen channels.",
+        "summary": "Claim a tuner and start watching a channel. The reply carries an opaque play URL and the transport to play it with.",
         "tags": [
           "livetv"
         ],
         "x-silo-class": "profile_scoped",
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/livetv/programs/{program_id}": {
+    "/api/v2/livetv/guide": {
       "get": {
-        "operationId": "getLiveTVProgram",
+        "operationId": "getLiveTVGuide",
         "parameters": [
           {
             "description": "Optional while no profile on the authenticated account is PIN-protected or access-restricted (content-rating, advisory-age or library limits). Otherwise it is required: a request without it, or with an empty value, is refused with 422 validation_failed at header.x-profile-id; API keys are exempt. When present, it must name a profile of the authenticated account.",
@@ -172485,16 +175407,38 @@
             }
           },
           {
-            "description": "Opaque identifier",
-            "in": "path",
-            "name": "program_id",
-            "required": true,
+            "description": "Restrict to these channels, repeated (channel_id=a\u0026channel_id=b); absent lists every channel",
+            "explode": true,
+            "in": "query",
+            "name": "channel_id",
             "schema": {
-              "description": "Opaque identifier",
-              "examples": [
-                "1"
-              ],
-              "minLength": 1,
+              "description": "Restrict to these channels, repeated (channel_id=a\u0026channel_id=b); absent lists every channel",
+              "items": {
+                "type": "string"
+              },
+              "maxItems": 500,
+              "type": "array"
+            }
+          },
+          {
+            "description": "Window start; default now",
+            "explode": false,
+            "in": "query",
+            "name": "start",
+            "schema": {
+              "description": "Window start; default now",
+              "format": "date-time",
+              "type": "string"
+            }
+          },
+          {
+            "description": "Window end; default start plus 12 hours, at most 7 days after start",
+            "explode": false,
+            "in": "query",
+            "name": "end",
+            "schema": {
+              "description": "Window end; default start plus 12 hours, at most 7 days after start",
+              "format": "date-time",
               "type": "string"
             }
           }
@@ -172504,7 +175448,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/LiveTVProgram"
+                  "$ref": "#/components/schemas/LiveTVGuide"
                 }
               }
             },
@@ -172616,7 +175560,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Read one guide programme.",
+        "summary": "Read the programme guide for a time window, optionally for chosen channels.",
         "tags": [
           "livetv"
         ],
@@ -172624,9 +175568,9 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/livetv/recordings": {
+    "/api/v2/livetv/programs/{program_id}": {
       "get": {
-        "operationId": "listLiveTVRecordings",
+        "operationId": "getLiveTVProgram",
         "parameters": [
           {
             "description": "Optional while no profile on the authenticated account is PIN-protected or access-restricted (content-rating, advisory-age or library limits). Otherwise it is required: a request without it, or with an empty value, is refused with 422 validation_failed at header.x-profile-id; API keys are exempt. When present, it must name a profile of the authenticated account.",
@@ -172651,19 +175595,16 @@
             }
           },
           {
-            "description": "Only recordings in this state",
-            "explode": false,
-            "in": "query",
-            "name": "status",
+            "description": "Opaque identifier",
+            "in": "path",
+            "name": "program_id",
+            "required": true,
             "schema": {
-              "description": "Only recordings in this state",
-              "enum": [
-                "scheduled",
-                "recording",
-                "completed",
-                "failed",
-                "cancelled"
+              "description": "Opaque identifier",
+              "examples": [
+                "1"
               ],
+              "minLength": 1,
               "type": "string"
             }
           }
@@ -172673,7 +175614,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/CollectionLiveTVRecording"
+                  "$ref": "#/components/schemas/LiveTVProgram"
                 }
               }
             },
@@ -172785,21 +175726,22 @@
             "bearerAuth": []
           }
         ],
-        "summary": "List this profile's DVR recordings; administrators see every recording.",
+        "summary": "Read one guide programme.",
         "tags": [
           "livetv"
         ],
         "x-silo-class": "profile_scoped",
         "x-silo-service-backed": true
-      },
-      "post": {
-        "operationId": "scheduleLiveTVRecording",
+      }
+    },
+    "/api/v2/livetv/recordings": {
+      "get": {
+        "operationId": "listLiveTVRecordings",
         "parameters": [
           {
-            "description": "The household profile acting for this request; it must belong to the authenticated account.",
+            "description": "Optional while no profile on the authenticated account is PIN-protected or access-restricted (content-rating, advisory-age or library limits). Otherwise it is required: a request without it, or with an empty value, is refused with 422 validation_failed at header.x-profile-id; API keys are exempt. When present, it must name a profile of the authenticated account.",
             "in": "header",
             "name": "X-Profile-Id",
-            "required": true,
             "schema": {
               "examples": [
                 "1"
@@ -172817,28 +175759,35 @@
               ],
               "type": "string"
             }
+          },
+          {
+            "description": "Only recordings in this state",
+            "explode": false,
+            "in": "query",
+            "name": "status",
+            "schema": {
+              "description": "Only recordings in this state",
+              "enum": [
+                "scheduled",
+                "recording",
+                "completed",
+                "failed",
+                "cancelled"
+              ],
+              "type": "string"
+            }
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/LiveTVRecordingBody"
-              }
-            }
-          },
-          "required": true
-        },
         "responses": {
-          "201": {
+          "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/LiveTVRecording"
+                  "$ref": "#/components/schemas/CollectionLiveTVRecording"
                 }
               }
             },
-            "description": "Created"
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -172890,16 +175839,6 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
           "409": {
             "content": {
               "application/problem+json": {
@@ -172910,26 +175849,6 @@
             },
             "description": "Conflict"
           },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unsupported Media Type"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -172976,19 +175895,15 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Schedule a DVR recording for this profile. Never retried automatically.",
+        "summary": "List this profile's DVR recordings; administrators see every recording.",
         "tags": [
           "livetv"
         ],
         "x-silo-class": "profile_scoped",
-        "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
-      }
-    },
-    "/api/v2/livetv/recordings/{recording_id}": {
-      "delete": {
-        "operationId": "cancelLiveTVRecording",
+      },
+      "post": {
+        "operationId": "scheduleLiveTVRecording",
         "parameters": [
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
@@ -173012,24 +175927,20 @@
               ],
               "type": "string"
             }
-          },
-          {
-            "description": "Opaque identifier",
-            "in": "path",
-            "name": "recording_id",
-            "required": true,
-            "schema": {
-              "description": "Opaque identifier",
-              "examples": [
-                "1"
-              ],
-              "minLength": 1,
-              "type": "string"
-            }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/LiveTVRecordingBody"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
-          "200": {
+          "201": {
             "content": {
               "application/json": {
                 "schema": {
@@ -173037,7 +175948,7 @@
                 }
               }
             },
-            "description": "OK"
+            "description": "Created"
           },
           "400": {
             "content": {
@@ -173089,6 +176000,16 @@
             },
             "description": "Not Acceptable"
           },
+          "408": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Timeout"
+          },
           "409": {
             "content": {
               "application/problem+json": {
@@ -173099,6 +176020,26 @@
             },
             "description": "Conflict"
           },
+          "413": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -173145,24 +176086,25 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Cancel a recording this profile owns; administrators may cancel any.",
+        "summary": "Schedule a DVR recording for this profile. Never retried automatically.",
         "tags": [
           "livetv"
         ],
         "x-silo-class": "profile_scoped",
         "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "natural_idempotent",
+        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/livetv/series-rules": {
-      "get": {
-        "operationId": "listLiveTVSeriesRules",
+    "/api/v2/livetv/recordings/{recording_id}": {
+      "delete": {
+        "operationId": "cancelLiveTVRecording",
         "parameters": [
           {
-            "description": "Optional while no profile on the authenticated account is PIN-protected or access-restricted (content-rating, advisory-age or library limits). Otherwise it is required: a request without it, or with an empty value, is refused with 422 validation_failed at header.x-profile-id; API keys are exempt. When present, it must name a profile of the authenticated account.",
+            "description": "The household profile acting for this request; it must belong to the authenticated account.",
             "in": "header",
             "name": "X-Profile-Id",
+            "required": true,
             "schema": {
               "examples": [
                 "1"
@@ -173180,6 +176122,20 @@
               ],
               "type": "string"
             }
+          },
+          {
+            "description": "Opaque identifier",
+            "in": "path",
+            "name": "recording_id",
+            "required": true,
+            "schema": {
+              "description": "Opaque identifier",
+              "examples": [
+                "1"
+              ],
+              "minLength": 1,
+              "type": "string"
+            }
           }
         ],
         "responses": {
@@ -173187,7 +176143,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/CollectionLiveTVSeriesRule"
+                  "$ref": "#/components/schemas/LiveTVRecording"
                 }
               }
             },
@@ -173299,21 +176255,24 @@
             "bearerAuth": []
           }
         ],
-        "summary": "List this profile's series recording rules; administrators see every rule.",
+        "summary": "Cancel a recording this profile owns; administrators may cancel any.",
         "tags": [
           "livetv"
         ],
         "x-silo-class": "profile_scoped",
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "natural_idempotent",
         "x-silo-service-backed": true
-      },
-      "post": {
-        "operationId": "createLiveTVSeriesRule",
+      }
+    },
+    "/api/v2/livetv/series-rules": {
+      "get": {
+        "operationId": "listLiveTVSeriesRules",
         "parameters": [
           {
-            "description": "The household profile acting for this request; it must belong to the authenticated account.",
+            "description": "Optional while no profile on the authenticated account is PIN-protected or access-restricted (content-rating, advisory-age or library limits). Otherwise it is required: a request without it, or with an empty value, is refused with 422 validation_failed at header.x-profile-id; API keys are exempt. When present, it must name a profile of the authenticated account.",
             "in": "header",
             "name": "X-Profile-Id",
-            "required": true,
             "schema": {
               "examples": [
                 "1"
@@ -173333,26 +176292,16 @@
             }
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/LiveTVSeriesRuleBody"
-              }
-            }
-          },
-          "required": true
-        },
         "responses": {
-          "201": {
+          "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/LiveTVSeriesRule"
+                  "$ref": "#/components/schemas/CollectionLiveTVSeriesRule"
                 }
               }
             },
-            "description": "Created"
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -173404,16 +176353,6 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
           "409": {
             "content": {
               "application/problem+json": {
@@ -173424,26 +176363,6 @@
             },
             "description": "Conflict"
           },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unsupported Media Type"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -173490,19 +176409,15 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Create a series recording rule for this profile. Never retried automatically.",
+        "summary": "List this profile's series recording rules; administrators see every rule.",
         "tags": [
           "livetv"
         ],
         "x-silo-class": "profile_scoped",
-        "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
-      }
-    },
-    "/api/v2/livetv/series-rules/{rule_id}": {
-      "delete": {
-        "operationId": "deleteLiveTVSeriesRule",
+      },
+      "post": {
+        "operationId": "createLiveTVSeriesRule",
         "parameters": [
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
@@ -173526,25 +176441,28 @@
               ],
               "type": "string"
             }
-          },
-          {
-            "description": "Opaque identifier",
-            "in": "path",
-            "name": "rule_id",
-            "required": true,
-            "schema": {
-              "description": "Opaque identifier",
-              "examples": [
-                "1"
-              ],
-              "minLength": 1,
-              "type": "string"
-            }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/LiveTVSeriesRuleBody"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
-          "204": {
-            "description": "No Content"
+          "201": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/LiveTVSeriesRule"
+                }
+              }
+            },
+            "description": "Created"
           },
           "400": {
             "content": {
@@ -173596,6 +176514,16 @@
             },
             "description": "Not Acceptable"
           },
+          "408": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Timeout"
+          },
           "409": {
             "content": {
               "application/problem+json": {
@@ -173606,6 +176534,26 @@
             },
             "description": "Conflict"
           },
+          "413": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -173652,19 +176600,19 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Delete a series recording rule this profile owns; administrators may delete any.",
+        "summary": "Create a series recording rule for this profile. Never retried automatically.",
         "tags": [
           "livetv"
         ],
         "x-silo-class": "profile_scoped",
         "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "natural_idempotent",
+        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/livetv/sessions/{session_id}": {
+    "/api/v2/livetv/series-rules/{rule_id}": {
       "delete": {
-        "operationId": "stopLiveTVSession",
+        "operationId": "deleteLiveTVSeriesRule",
         "parameters": [
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
@@ -173692,7 +176640,7 @@
           {
             "description": "Opaque identifier",
             "in": "path",
-            "name": "session_id",
+            "name": "rule_id",
             "required": true,
             "schema": {
               "description": "Opaque identifier",
@@ -173814,7 +176762,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Release a session and its tuner. Administrators may release any session.",
+        "summary": "Delete a series recording rule this profile owns; administrators may delete any.",
         "tags": [
           "livetv"
         ],
@@ -173824,9 +176772,9 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/livetv/sessions/{session_id}/heartbeat": {
-      "post": {
-        "operationId": "heartbeatLiveTVSession",
+    "/api/v2/livetv/sessions/{session_id}": {
+      "delete": {
+        "operationId": "stopLiveTVSession",
         "parameters": [
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
@@ -173976,7 +176924,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Keep an open session's tuner claimed while the player is open, including while paused.",
+        "summary": "Release a session and its tuner. Administrators may release any session.",
         "tags": [
           "livetv"
         ],
@@ -173986,14 +176934,15 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/markers/files/{file_id}": {
-      "get": {
-        "operationId": "getFileMarkers",
+    "/api/v2/livetv/sessions/{session_id}/heartbeat": {
+      "post": {
+        "operationId": "heartbeatLiveTVSession",
         "parameters": [
           {
-            "description": "Optional while no profile on the authenticated account is PIN-protected or access-restricted (content-rating, advisory-age or library limits). Otherwise it is required: a request without it, or with an empty value, is refused with 422 validation_failed at header.x-profile-id; API keys are exempt. When present, it must name a profile of the authenticated account.",
+            "description": "The household profile acting for this request; it must belong to the authenticated account.",
             "in": "header",
             "name": "X-Profile-Id",
+            "required": true,
             "schema": {
               "examples": [
                 "1"
@@ -174015,7 +176964,7 @@
           {
             "description": "Opaque identifier",
             "in": "path",
-            "name": "file_id",
+            "name": "session_id",
             "required": true,
             "schema": {
               "description": "Opaque identifier",
@@ -174028,15 +176977,176 @@
           }
         ],
         "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/FileMarkers"
-                }
-              }
-            },
-            "description": "OK"
+          "204": {
+            "description": "No Content"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "406": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Acceptable"
+          },
+          "409": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "429": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Too Many Requests"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "summary": "Keep an open session's tuner claimed while the player is open, including while paused.",
+        "tags": [
+          "livetv"
+        ],
+        "x-silo-class": "profile_scoped",
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "natural_idempotent",
+        "x-silo-service-backed": true
+      }
+    },
+    "/api/v2/markers/files/{file_id}": {
+      "get": {
+        "operationId": "getFileMarkers",
+        "parameters": [
+          {
+            "description": "Optional while no profile on the authenticated account is PIN-protected or access-restricted (content-rating, advisory-age or library limits). Otherwise it is required: a request without it, or with an empty value, is refused with 422 validation_failed at header.x-profile-id; API keys are exempt. When present, it must name a profile of the authenticated account.",
+            "in": "header",
+            "name": "X-Profile-Id",
+            "schema": {
+              "examples": [
+                "1"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked",
+            "in": "header",
+            "name": "X-Profile-Token",
+            "schema": {
+              "examples": [
+                "pvt_5f3a9c1e7b2d4e8fa0c6"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Opaque identifier",
+            "in": "path",
+            "name": "file_id",
+            "required": true,
+            "schema": {
+              "description": "Opaque identifier",
+              "examples": [
+                "1"
+              ],
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/FileMarkers"
+                }
+              }
+            },
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -175041,9 +178151,9 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/notifications": {
+    "/api/v2/not-interested": {
       "get": {
-        "operationId": "listNotifications",
+        "operationId": "listNotInterested",
         "parameters": [
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
@@ -175068,6 +178178,105 @@
               "type": "string"
             }
           },
+          {
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
+            "explode": false,
+            "in": "query",
+            "name": "image_size",
+            "schema": {
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
+              "enum": [
+                "small",
+                "medium",
+                "large",
+                "original"
+              ],
+              "examples": [
+                "medium"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
           {
             "description": "Page size; default 50, maximum 200",
             "explode": false,
@@ -175086,22 +178295,14 @@
             }
           },
           {
+            "description": "Opaque cursor from page.next_cursor",
             "explode": false,
             "in": "query",
             "name": "cursor",
             "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "explode": false,
-            "in": "query",
-            "name": "status",
-            "schema": {
-              "default": "all",
-              "enum": [
-                "all",
-                "unread"
+              "description": "Opaque cursor from page.next_cursor",
+              "examples": [
+                "eyJvIjo1MH0"
               ],
               "type": "string"
             }
@@ -175112,7 +178313,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/NotificationListOutputBody"
+                  "$ref": "#/components/schemas/NotInterestedCollection"
                 }
               }
             },
@@ -175214,26 +178415,18 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Manage the acting profile's notification inbox.",
+        "summary": "List the movies and series the acting profile marked Not interested as catalog cards, newest mark first; items the viewer may not see are omitted.",
         "tags": [
-          "notifications"
+          "not-interested"
         ],
         "x-silo-class": "profile_scoped",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/notifications/capabilities": {
-      "get": {
-        "operationId": "getNotificationCapabilities",
+    "/api/v2/not-interested/{item_id}": {
+      "delete": {
+        "operationId": "unmarkNotInterested",
         "parameters": [
-          {
-            "description": "Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed.",
-            "in": "header",
-            "name": "If-Match",
-            "schema": {
-              "type": "string"
-            }
-          },
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
             "in": "header",
@@ -175258,47 +178451,23 @@
             }
           },
           {
-            "in": "header",
-            "name": "If-None-Match",
+            "description": "Catalog item identifier of a movie or series",
+            "in": "path",
+            "name": "item_id",
+            "required": true,
             "schema": {
+              "description": "Catalog item identifier of a movie or series",
+              "examples": [
+                "movie:heat-1995"
+              ],
+              "minLength": 1,
               "type": "string"
             }
           }
         ],
         "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/NotificationCapabilities"
-                }
-              }
-            },
-            "description": "OK",
-            "headers": {
-              "Cache-Control": {
-                "schema": {
-                  "type": "string"
-                }
-              },
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
-          },
-          "304": {
-            "description": "The representation named by If-None-Match is current; no body.",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
+          "204": {
+            "description": "No Content"
           },
           "400": {
             "content": {
@@ -175350,24 +178519,6 @@
             },
             "description": "Not Acceptable"
           },
-          "412": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Precondition Failed",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -175414,23 +178565,22 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Manage the acting profile's notification inbox.",
+        "summary": "Clear the acting profile's Not interested mark on the item. An absent mark succeeds and changes nothing.",
         "tags": [
-          "notifications"
+          "not-interested"
         ],
         "x-silo-class": "profile_scoped",
-        "x-silo-conditional": true,
+        "x-silo-retry-safety": "natural_idempotent",
         "x-silo-service-backed": true
-      }
-    },
-    "/api/v2/notifications/discord-link": {
-      "delete": {
-        "operationId": "unlinkNotificationDiscord",
+      },
+      "get": {
+        "operationId": "getNotInterested",
         "parameters": [
           {
-            "description": "Optional. When present, it must name a profile of the authenticated account.",
+            "description": "The household profile acting for this request; it must belong to the authenticated account.",
             "in": "header",
             "name": "X-Profile-Id",
+            "required": true,
             "schema": {
               "examples": [
                 "1"
@@ -175448,11 +178598,32 @@
               ],
               "type": "string"
             }
+          },
+          {
+            "description": "Catalog item identifier of a movie or series",
+            "in": "path",
+            "name": "item_id",
+            "required": true,
+            "schema": {
+              "description": "Catalog item identifier of a movie or series",
+              "examples": [
+                "movie:heat-1995"
+              ],
+              "minLength": 1,
+              "type": "string"
+            }
           }
         ],
         "responses": {
-          "204": {
-            "description": "No Content"
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NotInterestedEntry"
+                }
+              }
+            },
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -175550,24 +178721,21 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Unlink the account's current Discord identity and turn delivery off. Send once; replay can unlink a later connection.",
+        "summary": "Answer whether the acting profile marked the item Not interested: the mark, or 404 when it did not (or the viewer may not see the item).",
         "tags": [
-          "notifications"
+          "not-interested"
         ],
         "x-silo-class": "profile_scoped",
-        "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
-      }
-    },
-    "/api/v2/notifications/discord-preferences": {
-      "get": {
-        "operationId": "getNotificationDiscordPreferences",
+      },
+      "put": {
+        "operationId": "markNotInterested",
         "parameters": [
           {
-            "description": "Optional. When present, it must name a profile of the authenticated account.",
+            "description": "The household profile acting for this request; it must belong to the authenticated account.",
             "in": "header",
             "name": "X-Profile-Id",
+            "required": true,
             "schema": {
               "examples": [
                 "1"
@@ -175585,18 +178753,25 @@
               ],
               "type": "string"
             }
+          },
+          {
+            "description": "Catalog item identifier of a movie or series",
+            "in": "path",
+            "name": "item_id",
+            "required": true,
+            "schema": {
+              "description": "Catalog item identifier of a movie or series",
+              "examples": [
+                "movie:heat-1995"
+              ],
+              "minLength": 1,
+              "type": "string"
+            }
           }
         ],
         "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/NotificationDiscordPreferences"
-                }
-              }
-            },
-            "description": "OK"
+          "204": {
+            "description": "No Content"
           },
           "400": {
             "content": {
@@ -175694,20 +178869,24 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Read the login account's Discord notification preferences.",
+        "summary": "Mark a movie or series Not interested for the acting profile: its recommendation and discovery rows leave it out and rank similar titles lower, after a rebuild that starts within seconds. Library browsing, search, item detail, playback, favorites and the watchlist are unchanged. Episodes and seasons are refused with 422; mark the series. Marking a marked title succeeds and changes nothing.",
         "tags": [
-          "notifications"
+          "not-interested"
         ],
         "x-silo-class": "profile_scoped",
+        "x-silo-retry-safety": "natural_idempotent",
         "x-silo-service-backed": true
-      },
-      "put": {
-        "operationId": "updateNotificationDiscordPreferences",
+      }
+    },
+    "/api/v2/notifications": {
+      "get": {
+        "operationId": "listNotifications",
         "parameters": [
           {
-            "description": "Optional. When present, it must name a profile of the authenticated account.",
+            "description": "The household profile acting for this request; it must belong to the authenticated account.",
             "in": "header",
             "name": "X-Profile-Id",
+            "required": true,
             "schema": {
               "examples": [
                 "1"
@@ -175725,24 +178904,52 @@
               ],
               "type": "string"
             }
-          }
-        ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/NotificationChannelModeInputBody"
-              }
+          },
+          {
+            "description": "Page size; default 50, maximum 200",
+            "explode": false,
+            "in": "query",
+            "name": "limit",
+            "schema": {
+              "default": 50,
+              "description": "Page size; default 50, maximum 200",
+              "examples": [
+                50
+              ],
+              "format": "int64",
+              "maximum": 200,
+              "minimum": 1,
+              "type": "integer"
             }
           },
-          "required": true
-        },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "cursor",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "status",
+            "schema": {
+              "default": "all",
+              "enum": [
+                "all",
+                "unread"
+              ],
+              "type": "string"
+            }
+          }
+        ],
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/NotificationDiscordPreferences"
+                  "$ref": "#/components/schemas/NotificationListOutputBody"
                 }
               }
             },
@@ -175798,36 +179005,6 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unsupported Media Type"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -175874,89 +179051,31 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Set the login account's Discord delivery mode.",
+        "summary": "Manage the acting profile's notification inbox.",
         "tags": [
           "notifications"
         ],
         "x-silo-class": "profile_scoped",
-        "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/notifications/discord/link/callback": {
+    "/api/v2/notifications/capabilities": {
       "get": {
-        "operationId": "completeNotificationDiscordLink",
+        "operationId": "getNotificationCapabilities",
         "parameters": [
           {
-            "in": "query",
-            "name": "state",
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "in": "query",
-            "name": "code",
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "in": "query",
-            "name": "error",
+            "description": "Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed.",
+            "in": "header",
+            "name": "If-Match",
             "schema": {
               "type": "string"
             }
-          }
-        ],
-        "responses": {
-          "302": {
-            "content": {
-              "text/html": {
-                "schema": {
-                  "type": "string"
-                }
-              }
-            },
-            "description": "Consent outcome redirect to notification settings",
-            "headers": {
-              "Location": {
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
           },
-          "503": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Service Unavailable"
-          }
-        },
-        "summary": "Consume Discord OAuth state and redirect to notification settings.",
-        "tags": [
-          "notifications"
-        ],
-        "x-silo-class": "public",
-        "x-silo-raw-protocol": "redirect",
-        "x-silo-raw-reason": "Discord redirects browsers without Prairie login headers; the stored one-time state authenticates the account-link callback.",
-        "x-silo-service-backed": true
-      }
-    },
-    "/api/v2/notifications/discord/link/init": {
-      "post": {
-        "operationId": "beginNotificationDiscordLink",
-        "parameters": [
           {
-            "description": "Optional. When present, it must name a profile of the authenticated account.",
+            "description": "The household profile acting for this request; it must belong to the authenticated account.",
             "in": "header",
             "name": "X-Profile-Id",
+            "required": true,
             "schema": {
               "examples": [
                 "1"
@@ -175974,6 +179093,13 @@
               ],
               "type": "string"
             }
+          },
+          {
+            "in": "header",
+            "name": "If-None-Match",
+            "schema": {
+              "type": "string"
+            }
           }
         ],
         "responses": {
@@ -175981,11 +179107,35 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/NotificationDiscordLink"
+                  "$ref": "#/components/schemas/NotificationCapabilities"
                 }
               }
             },
-            "description": "OK"
+            "description": "OK",
+            "headers": {
+              "Cache-Control": {
+                "schema": {
+                  "type": "string"
+                }
+              },
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "304": {
+            "description": "The representation named by If-None-Match is current; no body.",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
           },
           "400": {
             "content": {
@@ -176037,6 +179187,24 @@
             },
             "description": "Not Acceptable"
           },
+          "412": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Precondition Failed",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -176083,7 +179251,143 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Begin one account-bound Discord consent flow.",
+        "summary": "Manage the acting profile's notification inbox.",
+        "tags": [
+          "notifications"
+        ],
+        "x-silo-class": "profile_scoped",
+        "x-silo-conditional": true,
+        "x-silo-service-backed": true
+      }
+    },
+    "/api/v2/notifications/discord-link": {
+      "delete": {
+        "operationId": "unlinkNotificationDiscord",
+        "parameters": [
+          {
+            "description": "Optional. When present, it must name a profile of the authenticated account.",
+            "in": "header",
+            "name": "X-Profile-Id",
+            "schema": {
+              "examples": [
+                "1"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked",
+            "in": "header",
+            "name": "X-Profile-Token",
+            "schema": {
+              "examples": [
+                "pvt_5f3a9c1e7b2d4e8fa0c6"
+              ],
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No Content"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "406": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Acceptable"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "429": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Too Many Requests"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "summary": "Unlink the account's current Discord identity and turn delivery off. Send once; replay can unlink a later connection.",
         "tags": [
           "notifications"
         ],
@@ -176093,15 +179397,14 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/notifications/email-preferences": {
+    "/api/v2/notifications/discord-preferences": {
       "get": {
-        "operationId": "getNotificationEmailPreferences",
+        "operationId": "getNotificationDiscordPreferences",
         "parameters": [
           {
-            "description": "The household profile acting for this request; it must belong to the authenticated account.",
+            "description": "Optional. When present, it must name a profile of the authenticated account.",
             "in": "header",
             "name": "X-Profile-Id",
-            "required": true,
             "schema": {
               "examples": [
                 "1"
@@ -176126,7 +179429,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/NotificationEmailPreferences"
+                  "$ref": "#/components/schemas/NotificationDiscordPreferences"
                 }
               }
             },
@@ -176228,7 +179531,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Read the acting profile's email notification preferences.",
+        "summary": "Read the login account's Discord notification preferences.",
         "tags": [
           "notifications"
         ],
@@ -176236,13 +179539,12 @@
         "x-silo-service-backed": true
       },
       "put": {
-        "operationId": "updateNotificationEmailPreferences",
+        "operationId": "updateNotificationDiscordPreferences",
         "parameters": [
           {
-            "description": "The household profile acting for this request; it must belong to the authenticated account.",
+            "description": "Optional. When present, it must name a profile of the authenticated account.",
             "in": "header",
             "name": "X-Profile-Id",
-            "required": true,
             "schema": {
               "examples": [
                 "1"
@@ -176277,7 +179579,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/NotificationEmailPreferences"
+                  "$ref": "#/components/schemas/NotificationDiscordPreferences"
                 }
               }
             },
@@ -176409,7 +179711,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Set the acting profile's email delivery mode.",
+        "summary": "Set the login account's Discord delivery mode.",
         "tags": [
           "notifications"
         ],
@@ -176419,15 +179721,79 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/notifications/email-preferences/address": {
-      "delete": {
-        "operationId": "clearNotificationEmailAddress",
+    "/api/v2/notifications/discord/link/callback": {
+      "get": {
+        "operationId": "completeNotificationDiscordLink",
         "parameters": [
           {
-            "description": "The household profile acting for this request; it must belong to the authenticated account.",
+            "in": "query",
+            "name": "state",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "in": "query",
+            "name": "code",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "in": "query",
+            "name": "error",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "302": {
+            "content": {
+              "text/html": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            },
+            "description": "Consent outcome redirect to notification settings",
+            "headers": {
+              "Location": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "summary": "Consume Discord OAuth state and redirect to notification settings.",
+        "tags": [
+          "notifications"
+        ],
+        "x-silo-class": "public",
+        "x-silo-raw-protocol": "redirect",
+        "x-silo-raw-reason": "Discord redirects browsers without Prairie login headers; the stored one-time state authenticates the account-link callback.",
+        "x-silo-service-backed": true
+      }
+    },
+    "/api/v2/notifications/discord/link/init": {
+      "post": {
+        "operationId": "beginNotificationDiscordLink",
+        "parameters": [
+          {
+            "description": "Optional. When present, it must name a profile of the authenticated account.",
             "in": "header",
             "name": "X-Profile-Id",
-            "required": true,
             "schema": {
               "examples": [
                 "1"
@@ -176452,7 +179818,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/NotificationEmailPreferences"
+                  "$ref": "#/components/schemas/NotificationDiscordLink"
                 }
               }
             },
@@ -176554,7 +179920,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Clear the profile's verified and pending notification address and turn email delivery off. Send once; replay may clear a newer address.",
+        "summary": "Begin one account-bound Discord consent flow.",
         "tags": [
           "notifications"
         ],
@@ -176562,9 +179928,480 @@
         "x-silo-demo-restricted": true,
         "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
-      },
-      "put": {
-        "operationId": "requestNotificationEmailVerification",
+      }
+    },
+    "/api/v2/notifications/email-preferences": {
+      "get": {
+        "operationId": "getNotificationEmailPreferences",
+        "parameters": [
+          {
+            "description": "The household profile acting for this request; it must belong to the authenticated account.",
+            "in": "header",
+            "name": "X-Profile-Id",
+            "required": true,
+            "schema": {
+              "examples": [
+                "1"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked",
+            "in": "header",
+            "name": "X-Profile-Token",
+            "schema": {
+              "examples": [
+                "pvt_5f3a9c1e7b2d4e8fa0c6"
+              ],
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NotificationEmailPreferences"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "406": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Acceptable"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "429": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Too Many Requests"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "summary": "Read the acting profile's email notification preferences.",
+        "tags": [
+          "notifications"
+        ],
+        "x-silo-class": "profile_scoped",
+        "x-silo-service-backed": true
+      },
+      "put": {
+        "operationId": "updateNotificationEmailPreferences",
+        "parameters": [
+          {
+            "description": "The household profile acting for this request; it must belong to the authenticated account.",
+            "in": "header",
+            "name": "X-Profile-Id",
+            "required": true,
+            "schema": {
+              "examples": [
+                "1"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked",
+            "in": "header",
+            "name": "X-Profile-Token",
+            "schema": {
+              "examples": [
+                "pvt_5f3a9c1e7b2d4e8fa0c6"
+              ],
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/NotificationChannelModeInputBody"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NotificationEmailPreferences"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "406": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Acceptable"
+          },
+          "408": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Timeout"
+          },
+          "413": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "429": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Too Many Requests"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "summary": "Set the acting profile's email delivery mode.",
+        "tags": [
+          "notifications"
+        ],
+        "x-silo-class": "profile_scoped",
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "non_retryable",
+        "x-silo-service-backed": true
+      }
+    },
+    "/api/v2/notifications/email-preferences/address": {
+      "delete": {
+        "operationId": "clearNotificationEmailAddress",
+        "parameters": [
+          {
+            "description": "The household profile acting for this request; it must belong to the authenticated account.",
+            "in": "header",
+            "name": "X-Profile-Id",
+            "required": true,
+            "schema": {
+              "examples": [
+                "1"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked",
+            "in": "header",
+            "name": "X-Profile-Token",
+            "schema": {
+              "examples": [
+                "pvt_5f3a9c1e7b2d4e8fa0c6"
+              ],
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NotificationEmailPreferences"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "406": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Acceptable"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "429": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Too Many Requests"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "summary": "Clear the profile's verified and pending notification address and turn email delivery off. Send once; replay may clear a newer address.",
+        "tags": [
+          "notifications"
+        ],
+        "x-silo-class": "profile_scoped",
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "non_retryable",
+        "x-silo-service-backed": true
+      },
+      "put": {
+        "operationId": "requestNotificationEmailVerification",
         "parameters": [
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
@@ -177658,24 +181495,407 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Manage the acting profile's notification inbox.",
+        "summary": "Manage the acting profile's notification inbox.",
+        "tags": [
+          "notifications"
+        ],
+        "x-silo-class": "profile_scoped",
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "natural_idempotent",
+        "x-silo-service-backed": true
+      }
+    },
+    "/api/v2/notifications/push/apple/display/{delivery_id}": {
+      "get": {
+        "operationId": "getNotificationApplePushDisplay",
+        "parameters": [
+          {
+            "description": "Required for access tokens and API keys. Display tokens bind the profile from their claims and ignore this header; a display token is accepted only by this operation.",
+            "in": "header",
+            "name": "X-Profile-Id",
+            "schema": {
+              "examples": [
+                "1"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked",
+            "in": "header",
+            "name": "X-Profile-Token",
+            "schema": {
+              "examples": [
+                "pvt_5f3a9c1e7b2d4e8fa0c6"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Opaque identifier",
+            "in": "path",
+            "name": "delivery_id",
+            "required": true,
+            "schema": {
+              "description": "Opaque identifier",
+              "examples": [
+                "1"
+              ],
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NotificationPushDisplay"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "406": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Acceptable"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "429": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Too Many Requests"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "summary": "Read compact display metadata for an Apple push notification.",
+        "tags": [
+          "notifications"
+        ],
+        "x-silo-class": "profile_scoped",
+        "x-silo-service-backed": true
+      }
+    },
+    "/api/v2/notifications/push/devices": {
+      "post": {
+        "operationId": "registerPushDevice",
+        "parameters": [
+          {
+            "description": "The household profile acting for this request; it must belong to the authenticated account.",
+            "in": "header",
+            "name": "X-Profile-Id",
+            "required": true,
+            "schema": {
+              "examples": [
+                "1"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked",
+            "in": "header",
+            "name": "X-Profile-Token",
+            "schema": {
+              "examples": [
+                "pvt_5f3a9c1e7b2d4e8fa0c6"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Secret 32-byte base64url installation credential. Persist privately; never rotate on retry or account switch.",
+            "in": "header",
+            "name": "X-Push-Installation-Key",
+            "required": true,
+            "schema": {
+              "description": "Secret 32-byte base64url installation credential. Persist privately; never rotate on retry or account switch.",
+              "maxLength": 43,
+              "minLength": 43,
+              "type": "string"
+            }
+          },
+          {
+            "description": "Positive decimal int64, persisted and incremented for each new installation intent across account/profile switches. Reuse exactly after uncertainty.",
+            "in": "header",
+            "name": "X-Push-Generation",
+            "required": true,
+            "schema": {
+              "description": "Positive decimal int64, persisted and incremented for each new installation intent across account/profile switches. Reuse exactly after uncertainty.",
+              "maxLength": 19,
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/AndroidPushRegistrationBody"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AndroidPushRegistrationReceipt"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "406": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Acceptable"
+          },
+          "408": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Timeout"
+          },
+          "409": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
+          "413": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "429": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Too Many Requests"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "summary": "Apply one ordered Android installation registration intent. Replay only the exact persisted generation, credential and payload; never advance a generation to retry uncertainty.",
         "tags": [
           "notifications"
         ],
         "x-silo-class": "profile_scoped",
         "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "natural_idempotent",
+        "x-silo-retry-safety": "domain_identity",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/notifications/push/apple/display/{delivery_id}": {
+    "/api/v2/notifications/push/devices/capabilities": {
       "get": {
-        "operationId": "getNotificationApplePushDisplay",
+        "operationId": "getPushRegistrationCapabilities",
         "parameters": [
           {
-            "description": "Required for access tokens and API keys. Display tokens bind the profile from their claims and ignore this header; a display token is accepted only by this operation.",
+            "description": "Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed.",
+            "in": "header",
+            "name": "If-Match",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "The household profile acting for this request; it must belong to the authenticated account.",
             "in": "header",
             "name": "X-Profile-Id",
+            "required": true,
             "schema": {
               "examples": [
                 "1"
@@ -177695,16 +181915,9 @@
             }
           },
           {
-            "description": "Opaque identifier",
-            "in": "path",
-            "name": "delivery_id",
-            "required": true,
+            "in": "header",
+            "name": "If-None-Match",
             "schema": {
-              "description": "Opaque identifier",
-              "examples": [
-                "1"
-              ],
-              "minLength": 1,
               "type": "string"
             }
           }
@@ -177714,11 +181927,35 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/NotificationPushDisplay"
+                  "$ref": "#/components/schemas/AndroidPushRegistrationCapability"
                 }
               }
             },
-            "description": "OK"
+            "description": "OK",
+            "headers": {
+              "Cache-Control": {
+                "schema": {
+                  "type": "string"
+                }
+              },
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "304": {
+            "description": "The representation named by If-None-Match is current; no body.",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
           },
           "400": {
             "content": {
@@ -177770,6 +182007,24 @@
             },
             "description": "Not Acceptable"
           },
+          "412": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Precondition Failed",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -177816,17 +182071,18 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Read compact display metadata for an Apple push notification.",
+        "summary": "Describe ordered registration support separately from push delivery availability.",
         "tags": [
           "notifications"
         ],
         "x-silo-class": "profile_scoped",
+        "x-silo-conditional": true,
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/notifications/push/devices": {
-      "post": {
-        "operationId": "registerPushDevice",
+    "/api/v2/notifications/push/devices/{device_id}": {
+      "delete": {
+        "operationId": "unregisterPushDevice",
         "parameters": [
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
@@ -177873,28 +182129,19 @@
               "maxLength": 19,
               "type": "string"
             }
+          },
+          {
+            "in": "path",
+            "name": "device_id",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/AndroidPushRegistrationBody"
-              }
-            }
-          },
-          "required": true
-        },
         "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/AndroidPushRegistrationReceipt"
-                }
-              }
-            },
-            "description": "OK"
+          "204": {
+            "description": "No Content"
           },
           "400": {
             "content": {
@@ -177946,16 +182193,6 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
           "409": {
             "content": {
               "application/problem+json": {
@@ -177966,26 +182203,6 @@
             },
             "description": "Conflict"
           },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unsupported Media Type"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -178032,7 +182249,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Apply one ordered Android installation registration intent. Replay only the exact persisted generation, credential and payload; never advance a generation to retry uncertainty.",
+        "summary": "Apply an ordered removal for the installation's current account/profile. Tombstones prevent stale registration replay.",
         "tags": [
           "notifications"
         ],
@@ -178042,18 +182259,10 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/notifications/push/devices/capabilities": {
-      "get": {
-        "operationId": "getPushRegistrationCapabilities",
+    "/api/v2/notifications/read-all": {
+      "post": {
+        "operationId": "markNotificationsRead",
         "parameters": [
-          {
-            "description": "Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed.",
-            "in": "header",
-            "name": "If-Match",
-            "schema": {
-              "type": "string"
-            }
-          },
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
             "in": "header",
@@ -178076,49 +182285,21 @@
               ],
               "type": "string"
             }
-          },
-          {
-            "in": "header",
-            "name": "If-None-Match",
-            "schema": {
-              "type": "string"
-            }
           }
         ],
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/AndroidPushRegistrationCapability"
-                }
-              }
-            },
-            "description": "OK",
-            "headers": {
-              "Cache-Control": {
-                "schema": {
-                  "type": "string"
-                }
-              },
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/NotificationReadAllInputBody"
               }
             }
           },
-          "304": {
-            "description": "The representation named by If-None-Match is current; no body.",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
+          "required": true
+        },
+        "responses": {
+          "204": {
+            "description": "No Content"
           },
           "400": {
             "content": {
@@ -178170,7 +182351,7 @@
             },
             "description": "Not Acceptable"
           },
-          "412": {
+          "408": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -178178,15 +182359,27 @@
                 }
               }
             },
-            "description": "Precondition Failed",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+            "description": "Request Timeout"
+          },
+          "413": {
+            "content": {
+              "application/problem+json": {
                 "schema": {
-                  "type": "string"
+                  "$ref": "#/components/schemas/Problem"
                 }
               }
-            }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
           },
           "422": {
             "content": {
@@ -178234,18 +182427,20 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Describe ordered registration support separately from push delivery availability.",
+        "summary": "Manage the acting profile's notification inbox.",
         "tags": [
           "notifications"
         ],
         "x-silo-class": "profile_scoped",
-        "x-silo-conditional": true,
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "natural_idempotent",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/notifications/push/devices/{device_id}": {
-      "delete": {
-        "operationId": "unregisterPushDevice",
+    "/api/v2/notifications/series": {
+      "get": {
+        "description": "Every series the profile favorited, put on its watchlist, is partway through, or waits on a next episode of, and every series it muted, filtered and sorted as asked (by title by default). Each carries its reasons, which of them the profile's notification preferences let notify, and whether the profile muted it. Series the viewer may not see are omitted.",
+        "operationId": "listNotificationSeries",
         "parameters": [
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
@@ -178271,40 +182466,212 @@
             }
           },
           {
-            "description": "Secret 32-byte base64url installation credential. Persist privately; never rotate on retry or account switch.",
-            "in": "header",
-            "name": "X-Push-Installation-Key",
-            "required": true,
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
+            "explode": false,
+            "in": "query",
+            "name": "image_size",
             "schema": {
-              "description": "Secret 32-byte base64url installation credential. Persist privately; never rotate on retry or account switch.",
-              "maxLength": 43,
-              "minLength": 43,
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
+              "enum": [
+                "small",
+                "medium",
+                "large",
+                "original"
+              ],
+              "examples": [
+                "medium"
+              ],
               "type": "string"
             }
           },
           {
-            "description": "Positive decimal int64, persisted and incremented for each new installation intent across account/profile switches. Reuse exactly after uncertainty.",
-            "in": "header",
-            "name": "X-Push-Generation",
-            "required": true,
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
             "schema": {
-              "description": "Positive decimal int64, persisted and incremented for each new installation intent across account/profile switches. Reuse exactly after uncertainty.",
-              "maxLength": 19,
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Page size; default 50, maximum 200",
+            "explode": false,
+            "in": "query",
+            "name": "limit",
+            "schema": {
+              "default": 50,
+              "description": "Page size; default 50, maximum 200",
+              "examples": [
+                50
+              ],
+              "format": "int64",
+              "maximum": 200,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Opaque cursor from page.next_cursor",
+            "explode": false,
+            "in": "query",
+            "name": "cursor",
+            "schema": {
+              "description": "Opaque cursor from page.next_cursor",
+              "examples": [
+                "eyJ0IjoiYmVhciJ9"
+              ],
               "type": "string"
             }
           },
           {
-            "in": "path",
-            "name": "device_id",
-            "required": true,
+            "description": "active keeps the series that notify; inactive keeps the ones that do not, because the profile's preferences silence every reason or the profile muted the series",
+            "explode": false,
+            "in": "query",
+            "name": "status",
+            "schema": {
+              "default": "all",
+              "description": "active keeps the series that notify; inactive keeps the ones that do not, because the profile's preferences silence every reason or the profile muted the series",
+              "enum": [
+                "all",
+                "active",
+                "inactive"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Keeps the series with this reason, whether or not the preferences let it notify; absent keeps every reason",
+            "explode": false,
+            "in": "query",
+            "name": "reason",
+            "schema": {
+              "description": "Keeps the series with this reason, whether or not the preferences let it notify; absent keeps every reason",
+              "enum": [
+                "favorite",
+                "watchlist",
+                "continue_watching",
+                "next_up"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Keeps the series whose title or sort title contains this text, case-insensitively",
+            "explode": false,
+            "in": "query",
+            "name": "q",
+            "schema": {
+              "description": "Keeps the series whose title or sort title contains this text, case-insensitively",
+              "examples": [
+                "bear"
+              ],
+              "maxLength": 200,
+              "type": "string"
+            }
+          },
+          {
+            "description": "One field, descending with a leading '-'. added_at is when the series joined the catalog; latest_episode_added when it last gained an episode. A series without a year or an episode sorts last either way; ties order by title.",
+            "explode": false,
+            "in": "query",
+            "name": "sort",
             "schema": {
+              "default": "title",
+              "description": "One field, descending with a leading '-'. added_at is when the series joined the catalog; latest_episode_added when it last gained an episode. A series without a year or an episode sorts last either way; ties order by title.",
+              "enum": [
+                "title",
+                "-title",
+                "year",
+                "-year",
+                "added_at",
+                "-added_at",
+                "latest_episode_added",
+                "-latest_episode_added"
+              ],
               "type": "string"
             }
           }
         ],
         "responses": {
-          "204": {
-            "description": "No Content"
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/NotificationSeriesCollection"
+                }
+              }
+            },
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -178356,16 +182723,6 @@
             },
             "description": "Not Acceptable"
           },
-          "409": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Conflict"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -178412,19 +182769,18 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Apply an ordered removal for the installation's current account/profile. Tombstones prevent stale registration replay.",
+        "summary": "List the series whose new episodes can notify the acting profile.",
         "tags": [
           "notifications"
         ],
         "x-silo-class": "profile_scoped",
-        "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "domain_identity",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/notifications/read-all": {
-      "post": {
-        "operationId": "markNotificationsRead",
+    "/api/v2/notifications/series/{series_id}/mute": {
+      "delete": {
+        "description": "The series notifies the acting profile again for its active reasons. The mute applies when notification delivery evaluates a new episode, normally within a minute of it arriving: an episode evaluated while the series was muted is not announced later, and one still waiting to be evaluated when the profile unmutes is announced. Unmuting a series that is not muted succeeds and changes nothing. No access check runs, so a profile can lift a mute on a series it can no longer see.",
+        "operationId": "unmuteNotificationSeries",
         "parameters": [
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
@@ -178448,18 +182804,22 @@
               ],
               "type": "string"
             }
+          },
+          {
+            "description": "Catalog item identifier of the series",
+            "in": "path",
+            "name": "series_id",
+            "required": true,
+            "schema": {
+              "description": "Catalog item identifier of the series",
+              "examples": [
+                "series-tvdb-81189"
+              ],
+              "minLength": 1,
+              "type": "string"
+            }
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/NotificationReadAllInputBody"
-              }
-            }
-          },
-          "required": true
-        },
         "responses": {
           "204": {
             "description": "No Content"
@@ -178514,7 +182874,7 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
+          "422": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -178522,9 +182882,9 @@
                 }
               }
             },
-            "description": "Request Timeout"
+            "description": "Unprocessable Entity"
           },
-          "413": {
+          "429": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -178532,9 +182892,9 @@
                 }
               }
             },
-            "description": "Request Entity Too Large"
+            "description": "Too Many Requests"
           },
-          "415": {
+          "500": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -178542,7 +182902,128 @@
                 }
               }
             },
-            "description": "Unsupported Media Type"
+            "description": "Internal Server Error"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "summary": "Unmute new-episode notifications for one series.",
+        "tags": [
+          "notifications"
+        ],
+        "x-silo-class": "profile_scoped",
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "natural_idempotent",
+        "x-silo-service-backed": true
+      },
+      "put": {
+        "description": "The acting profile gets no new-episode notification for the series on any channel, whatever its reasons, until it unmutes. Favorites, the watchlist, Home, and watch history are unchanged, and other profiles are unaffected. Muting a series already muted succeeds and changes nothing. A series the viewer may not see, or an item that is not a series, is 404.",
+        "operationId": "muteNotificationSeries",
+        "parameters": [
+          {
+            "description": "The household profile acting for this request; it must belong to the authenticated account.",
+            "in": "header",
+            "name": "X-Profile-Id",
+            "required": true,
+            "schema": {
+              "examples": [
+                "1"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked",
+            "in": "header",
+            "name": "X-Profile-Token",
+            "schema": {
+              "examples": [
+                "pvt_5f3a9c1e7b2d4e8fa0c6"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Catalog item identifier of the series",
+            "in": "path",
+            "name": "series_id",
+            "required": true,
+            "schema": {
+              "description": "Catalog item identifier of the series",
+              "examples": [
+                "series-tvdb-81189"
+              ],
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No Content"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "406": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Acceptable"
           },
           "422": {
             "content": {
@@ -178590,7 +183071,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Manage the acting profile's notification inbox.",
+        "summary": "Mute new-episode notifications for one series.",
         "tags": [
           "notifications"
         ],
@@ -182272,6 +186753,124 @@
         "x-silo-service-backed": true
       }
     },
+    "/api/v2/playback/bandwidth-probe": {
+      "get": {
+        "operationId": "getPlaybackBandwidthProbe",
+        "parameters": [
+          {
+            "description": "Number of bytes to send. A client may close the connection early once it has timed enough of the transfer.",
+            "in": "query",
+            "name": "size",
+            "schema": {
+              "default": 1000000,
+              "format": "int64",
+              "maximum": 100000000,
+              "minimum": 1,
+              "type": "integer"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/octet-stream": {
+                "schema": {
+                  "contentMediaType": "application/octet-stream",
+                  "format": "binary",
+                  "type": "string"
+                }
+              }
+            },
+            "description": "Random bytes",
+            "headers": {
+              "Cache-Control": {
+                "schema": {
+                  "type": "string"
+                }
+              },
+              "Content-Length": {
+                "schema": {
+                  "format": "int64",
+                  "type": "integer"
+                }
+              }
+            }
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "429": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Too Many Requests"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "summary": "Download random bytes to measure throughput to this server. Clients time the transfer and send the result as bandwidth_estimate_kbps; the bytes count as transfer egress, not playback. A server runs at most 32 probes at once; an account may run two of them and draw up to 400 MB per 10 minutes. Beyond any limit the request gets 429 with Retry-After.",
+        "tags": [
+          "playback"
+        ],
+        "x-silo-class": "authenticated",
+        "x-silo-raw-protocol": "bandwidth-probe",
+        "x-silo-raw-reason": "A throughput measurement needs an unbuffered, uncompressible byte stream the client can time and abandon mid-transfer."
+      }
+    },
     "/api/v2/playback/capabilities": {
       "get": {
         "operationId": "getPlaybackCapabilities",
@@ -183813,6 +188412,18 @@
               "type": "string"
             }
           },
+          {
+            "description": "Set by the multivariant playlist of a plan with subtitle.hls_rendition: video selects the media playlist, subtitles the WebVTT subtitle playlist. Absent, such a plan's manifest is the multivariant playlist.",
+            "in": "query",
+            "name": "prairie_rendition",
+            "schema": {
+              "enum": [
+                "video",
+                "subtitles"
+              ],
+              "type": "string"
+            }
+          },
           {
             "description": "Optional. When present, it must name a profile of the authenticated account.",
             "in": "header",
@@ -184015,6 +188626,7 @@
             }
           },
           {
+            "description": "Segment name from the media playlist. sub_NNNNN.vtt names a WebVTT subtitle rendition segment, answered from the cues already produced; one the transcode does not reach in time is an empty WebVTT document.",
             "in": "path",
             "name": "name",
             "required": true,
@@ -184105,6 +188717,13 @@
                   "type": "string"
                 }
               },
+              "text/vtt": {
+                "schema": {
+                  "contentMediaType": "application/octet-stream",
+                  "format": "binary",
+                  "type": "string"
+                }
+              },
               "video/mp2t": {
                 "schema": {
                   "contentMediaType": "application/octet-stream",
@@ -184166,6 +188785,13 @@
                   "type": "string"
                 }
               },
+              "text/vtt": {
+                "schema": {
+                  "contentMediaType": "application/octet-stream",
+                  "format": "binary",
+                  "type": "string"
+                }
+              },
               "video/mp2t": {
                 "schema": {
                   "contentMediaType": "application/octet-stream",
@@ -185558,24 +190184,368 @@
             },
             "description": "Not Acceptable"
           },
-          "412": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Precondition Failed",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
-          },
+          "412": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Precondition Failed",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "429": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Too Many Requests"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "summary": "Discover policy availability and runtime health.",
+        "tags": [
+          "policy"
+        ],
+        "x-silo-class": "profile_scoped",
+        "x-silo-conditional": true,
+        "x-silo-service-backed": true
+      }
+    },
+    "/api/v2/profile/sections": {
+      "delete": {
+        "operationId": "resetProfileSectionOverrides",
+        "parameters": [
+          {
+            "description": "The household profile acting for this request; it must belong to the authenticated account.",
+            "in": "header",
+            "name": "X-Profile-Id",
+            "required": true,
+            "schema": {
+              "examples": [
+                "1"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked",
+            "in": "header",
+            "name": "X-Profile-Token",
+            "schema": {
+              "examples": [
+                "pvt_5f3a9c1e7b2d4e8fa0c6"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "The page the overrides apply to",
+            "explode": false,
+            "in": "query",
+            "name": "scope",
+            "schema": {
+              "default": "home",
+              "description": "The page the overrides apply to",
+              "enum": [
+                "home",
+                "library"
+              ],
+              "examples": [
+                "home"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "The library; required when scope is library and refused otherwise",
+            "explode": false,
+            "in": "query",
+            "name": "library_id",
+            "schema": {
+              "description": "The library; required when scope is library and refused otherwise",
+              "examples": [
+                "1"
+              ],
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "204": {
+            "description": "No Content"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "406": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Acceptable"
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "429": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Too Many Requests"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "summary": "Delete the acting profile's section overrides for one page, restoring the admin layout.",
+        "tags": [
+          "profile_sections"
+        ],
+        "x-silo-class": "profile_scoped",
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "non_retryable",
+        "x-silo-service-backed": true
+      },
+      "get": {
+        "operationId": "listProfileSectionOverrides",
+        "parameters": [
+          {
+            "description": "The household profile acting for this request; it must belong to the authenticated account.",
+            "in": "header",
+            "name": "X-Profile-Id",
+            "required": true,
+            "schema": {
+              "examples": [
+                "1"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked",
+            "in": "header",
+            "name": "X-Profile-Token",
+            "schema": {
+              "examples": [
+                "pvt_5f3a9c1e7b2d4e8fa0c6"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "The page the overrides apply to",
+            "explode": false,
+            "in": "query",
+            "name": "scope",
+            "schema": {
+              "default": "home",
+              "description": "The page the overrides apply to",
+              "enum": [
+                "home",
+                "library"
+              ],
+              "examples": [
+                "home"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "The library; required when scope is library and refused otherwise",
+            "explode": false,
+            "in": "query",
+            "name": "library_id",
+            "schema": {
+              "description": "The library; required when scope is library and refused otherwise",
+              "examples": [
+                "1"
+              ],
+              "minLength": 1,
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/SectionOverrideCollection"
+                }
+              }
+            },
+            "description": "OK"
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "406": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Acceptable"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -185622,18 +190592,15 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Discover policy availability and runtime health.",
+        "summary": "List the acting profile's saved section overrides for one page.",
         "tags": [
-          "policy"
+          "profile_sections"
         ],
         "x-silo-class": "profile_scoped",
-        "x-silo-conditional": true,
         "x-silo-service-backed": true
-      }
-    },
-    "/api/v2/profile/sections": {
-      "delete": {
-        "operationId": "resetProfileSectionOverrides",
+      },
+      "put": {
+        "operationId": "replaceProfileSectionOverrides",
         "parameters": [
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
@@ -185691,6 +190658,16 @@
             }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SectionOverrideSet"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
           "204": {
             "description": "No Content"
@@ -185745,6 +190722,36 @@
             },
             "description": "Not Acceptable"
           },
+          "408": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Timeout"
+          },
+          "413": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -185791,7 +190798,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Delete the acting profile's section overrides for one page, restoring the admin layout.",
+        "summary": "Replace the acting profile's section overrides for one page.",
         "tags": [
           "profile_sections"
         ],
@@ -185799,9 +190806,11 @@
         "x-silo-demo-restricted": true,
         "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
-      },
+      }
+    },
+    "/api/v2/profile/sections/flags": {
       "get": {
-        "operationId": "listProfileSectionOverrides",
+        "operationId": "getProfileSectionFlags",
         "parameters": [
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
@@ -185825,38 +190834,6 @@
               ],
               "type": "string"
             }
-          },
-          {
-            "description": "The page the overrides apply to",
-            "explode": false,
-            "in": "query",
-            "name": "scope",
-            "schema": {
-              "default": "home",
-              "description": "The page the overrides apply to",
-              "enum": [
-                "home",
-                "library"
-              ],
-              "examples": [
-                "home"
-              ],
-              "type": "string"
-            }
-          },
-          {
-            "description": "The library; required when scope is library and refused otherwise",
-            "explode": false,
-            "in": "query",
-            "name": "library_id",
-            "schema": {
-              "description": "The library; required when scope is library and refused otherwise",
-              "examples": [
-                "1"
-              ],
-              "minLength": 1,
-              "type": "string"
-            }
           }
         ],
         "responses": {
@@ -185864,7 +190841,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SectionOverrideCollection"
+                  "$ref": "#/components/schemas/ProfileSectionFlags"
                 }
               }
             },
@@ -185966,15 +190943,16 @@
             "bearerAuth": []
           }
         ],
-        "summary": "List the acting profile's saved section overrides for one page.",
+        "summary": "Get what this server lets profiles do to their pages.",
         "tags": [
           "profile_sections"
         ],
-        "x-silo-class": "profile_scoped",
-        "x-silo-service-backed": true
-      },
-      "put": {
-        "operationId": "replaceProfileSectionOverrides",
+        "x-silo-class": "profile_scoped"
+      }
+    },
+    "/api/v2/profile/sections/settings": {
+      "get": {
+        "operationId": "getProfileSectionSettings",
         "parameters": [
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
@@ -186032,19 +191010,16 @@
             }
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/SectionOverrideSet"
-              }
-            }
-          },
-          "required": true
-        },
         "responses": {
-          "204": {
-            "description": "No Content"
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProfileSectionSettingCollection"
+                }
+              }
+            },
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -186096,36 +191071,6 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unsupported Media Type"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -186172,25 +191117,22 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Replace the acting profile's section overrides for one page.",
+        "summary": "Get one page's sections as the acting profile sees them, with its overrides applied.",
         "tags": [
           "profile_sections"
         ],
         "x-silo-class": "profile_scoped",
-        "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/profile/sections/flags": {
+    "/api/v2/profiles": {
       "get": {
-        "operationId": "getProfileSectionFlags",
+        "operationId": "listProfiles",
         "parameters": [
           {
-            "description": "The household profile acting for this request; it must belong to the authenticated account.",
+            "description": "Optional. When present, it must name a profile of the authenticated account.",
             "in": "header",
             "name": "X-Profile-Id",
-            "required": true,
             "schema": {
               "examples": [
                 "1"
@@ -186215,7 +191157,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ProfileSectionFlags"
+                  "$ref": "#/components/schemas/ProfileCollection"
                 }
               }
             },
@@ -186317,22 +191259,20 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Get what this server lets profiles do to their pages.",
+        "summary": "List the household profiles on the signed-in account.",
         "tags": [
-          "profile_sections"
+          "profiles"
         ],
-        "x-silo-class": "profile_scoped"
-      }
-    },
-    "/api/v2/profile/sections/settings": {
-      "get": {
-        "operationId": "getProfileSectionSettings",
+        "x-silo-class": "profile_scoped",
+        "x-silo-service-backed": true
+      },
+      "post": {
+        "operationId": "createProfile",
         "parameters": [
           {
-            "description": "The household profile acting for this request; it must belong to the authenticated account.",
+            "description": "Optional. When present, it must name a profile of the authenticated account.",
             "in": "header",
             "name": "X-Profile-Id",
-            "required": true,
             "schema": {
               "examples": [
                 "1"
@@ -186350,50 +191290,36 @@
               ],
               "type": "string"
             }
-          },
-          {
-            "description": "The page the overrides apply to",
-            "explode": false,
-            "in": "query",
-            "name": "scope",
-            "schema": {
-              "default": "home",
-              "description": "The page the overrides apply to",
-              "enum": [
-                "home",
-                "library"
-              ],
-              "examples": [
-                "home"
-              ],
-              "type": "string"
-            }
-          },
-          {
-            "description": "The library; required when scope is library and refused otherwise",
-            "explode": false,
-            "in": "query",
-            "name": "library_id",
-            "schema": {
-              "description": "The library; required when scope is library and refused otherwise",
-              "examples": [
-                "1"
-              ],
-              "minLength": 1,
-              "type": "string"
-            }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ProfileCreate"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
-          "200": {
+          "201": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ProfileSectionSettingCollection"
+                  "$ref": "#/components/schemas/Profile"
                 }
               }
             },
-            "description": "OK"
+            "description": "Created",
+            "headers": {
+              "Location": {
+                "schema": {
+                  "description": "The created profile's resource path",
+                  "type": "string"
+                }
+              }
+            }
           },
           "400": {
             "content": {
@@ -186445,6 +191371,46 @@
             },
             "description": "Not Acceptable"
           },
+          "408": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Timeout"
+          },
+          "409": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
+          "413": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -186491,17 +191457,19 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Get one page's sections as the acting profile sees them, with its overrides applied.",
+        "summary": "Create a household profile.",
         "tags": [
-          "profile_sections"
+          "profiles"
         ],
         "x-silo-class": "profile_scoped",
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/profiles": {
+    "/api/v2/profiles/household/sessions": {
       "get": {
-        "operationId": "listProfiles",
+        "operationId": "listHouseholdSessions",
         "parameters": [
           {
             "description": "Optional. When present, it must name a profile of the authenticated account.",
@@ -186531,7 +191499,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ProfileCollection"
+                  "$ref": "#/components/schemas/PlaybackSessionCollection"
                 }
               }
             },
@@ -186633,15 +191601,17 @@
             "bearerAuth": []
           }
         ],
-        "summary": "List the household profiles on the signed-in account.",
+        "summary": "List the live playback sessions on the signed-in account, for a household manager.",
         "tags": [
           "profiles"
         ],
         "x-silo-class": "profile_scoped",
         "x-silo-service-backed": true
-      },
-      "post": {
-        "operationId": "createProfile",
+      }
+    },
+    "/api/v2/profiles/{id}": {
+      "delete": {
+        "operationId": "deleteProfile",
         "parameters": [
           {
             "description": "Optional. When present, it must name a profile of the authenticated account.",
@@ -186664,36 +191634,25 @@
               ],
               "type": "string"
             }
+          },
+          {
+            "description": "The profile",
+            "in": "path",
+            "name": "id",
+            "required": true,
+            "schema": {
+              "description": "The profile",
+              "examples": [
+                "1"
+              ],
+              "minLength": 1,
+              "type": "string"
+            }
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/ProfileCreate"
-              }
-            }
-          },
-          "required": true
-        },
         "responses": {
-          "201": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Profile"
-                }
-              }
-            },
-            "description": "Created",
-            "headers": {
-              "Location": {
-                "schema": {
-                  "description": "The created profile's resource path",
-                  "type": "string"
-                }
-              }
-            }
+          "204": {
+            "description": "No Content"
           },
           "400": {
             "content": {
@@ -186745,16 +191704,6 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
           "409": {
             "content": {
               "application/problem+json": {
@@ -186765,26 +191714,6 @@
             },
             "description": "Conflict"
           },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unsupported Media Type"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -186831,7 +191760,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Create a household profile.",
+        "summary": "Delete a household profile; the primary profile cannot be deleted.",
         "tags": [
           "profiles"
         ],
@@ -186839,11 +191768,9 @@
         "x-silo-demo-restricted": true,
         "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
-      }
-    },
-    "/api/v2/profiles/household/sessions": {
-      "get": {
-        "operationId": "listHouseholdSessions",
+      },
+      "patch": {
+        "operationId": "updateProfile",
         "parameters": [
           {
             "description": "Optional. When present, it must name a profile of the authenticated account.",
@@ -186866,14 +191793,38 @@
               ],
               "type": "string"
             }
+          },
+          {
+            "description": "The profile to update",
+            "in": "path",
+            "name": "id",
+            "required": true,
+            "schema": {
+              "description": "The profile to update",
+              "examples": [
+                "1"
+              ],
+              "minLength": 1,
+              "type": "string"
+            }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ProfileUpdate"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/PlaybackSessionCollection"
+                  "$ref": "#/components/schemas/Profile"
                 }
               }
             },
@@ -186929,6 +191880,46 @@
             },
             "description": "Not Acceptable"
           },
+          "408": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Timeout"
+          },
+          "409": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
+          "413": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -186975,17 +191966,19 @@
             "bearerAuth": []
           }
         ],
-        "summary": "List the live playback sessions on the signed-in account, for a household manager.",
+        "summary": "Update a household profile; omitted members are unchanged.",
         "tags": [
           "profiles"
         ],
         "x-silo-class": "profile_scoped",
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/profiles/{id}": {
+    "/api/v2/profiles/{id}/avatar": {
       "delete": {
-        "operationId": "deleteProfile",
+        "operationId": "deleteProfileAvatar",
         "parameters": [
           {
             "description": "Optional. When present, it must name a profile of the authenticated account.",
@@ -187078,16 +192071,6 @@
             },
             "description": "Not Acceptable"
           },
-          "409": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Conflict"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -187134,7 +192117,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Delete a household profile; the primary profile cannot be deleted.",
+        "summary": "Remove a profile's uploaded avatar; a preset avatar is left as is.",
         "tags": [
           "profiles"
         ],
@@ -187143,8 +192126,8 @@
         "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       },
-      "patch": {
-        "operationId": "updateProfile",
+      "put": {
+        "operationId": "uploadProfileAvatar",
         "parameters": [
           {
             "description": "Optional. When present, it must name a profile of the authenticated account.",
@@ -187169,12 +192152,12 @@
             }
           },
           {
-            "description": "The profile to update",
+            "description": "The profile",
             "in": "path",
             "name": "id",
             "required": true,
             "schema": {
-              "description": "The profile to update",
+              "description": "The profile",
               "examples": [
                 "1"
               ],
@@ -187185,9 +192168,14 @@
         ],
         "requestBody": {
           "content": {
-            "application/json": {
+            "multipart/form-data": {
+              "encoding": {
+                "avatar": {
+                  "contentType": "image/jpeg,image/png,image/webp"
+                }
+              },
               "schema": {
-                "$ref": "#/components/schemas/ProfileUpdate"
+                "$ref": "#/components/schemas/ProfileAvatarForm"
               }
             }
           },
@@ -187264,16 +192252,6 @@
             },
             "description": "Request Timeout"
           },
-          "409": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Conflict"
-          },
           "413": {
             "content": {
               "application/problem+json": {
@@ -187340,7 +192318,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Update a household profile; omitted members are unchanged.",
+        "summary": "Replace a profile's avatar with an uploaded image (multipart form, part `avatar`: JPEG, PNG or WebP, at most 10 MiB; the whole request, framing included, at most 11 MiB).",
         "tags": [
           "profiles"
         ],
@@ -187350,9 +192328,10 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/profiles/{id}/avatar": {
-      "delete": {
-        "operationId": "deleteProfileAvatar",
+    "/api/v2/profiles/{id}/verify-pin": {
+      "post": {
+        "description": "Wrong PINs are counted per profile, Jellyfin password#PIN sign-ins included. Redis shares the count across server nodes; without Redis, each process counts its own attempts. Up to five attempts are allowed; the fifth wrong one locks the profile for five minutes, during which every check, even with the right PIN, is refused with 429 rate_limited and a Retry-After header giving the seconds left. A correct PIN while not locked clears the count, and an unlocked count expires five minutes after its first attempt. Each check affects the count and must not be automatically retried.",
+        "operationId": "verifyProfilePIN",
         "parameters": [
           {
             "description": "Optional. When present, it must name a profile of the authenticated account.",
@@ -187377,12 +192356,12 @@
             }
           },
           {
-            "description": "The profile",
+            "description": "The profile whose PIN is checked",
             "in": "path",
             "name": "id",
             "required": true,
             "schema": {
-              "description": "The profile",
+              "description": "The profile whose PIN is checked",
               "examples": [
                 "1"
               ],
@@ -187391,9 +192370,26 @@
             }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ProfilePINCheck"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
-          "204": {
-            "description": "No Content"
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ProfileVerification"
+                }
+              }
+            },
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -187445,6 +192441,36 @@
             },
             "description": "Not Acceptable"
           },
+          "408": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Timeout"
+          },
+          "413": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -187491,22 +192517,24 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Remove a profile's uploaded avatar; a preset avatar is left as is.",
+        "summary": "Check a profile's PIN; a match issues the X-Profile-Token that unlocks the profile for this login session.",
         "tags": [
           "profiles"
         ],
         "x-silo-class": "profile_scoped",
-        "x-silo-demo-restricted": true,
         "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
-      },
-      "put": {
-        "operationId": "uploadProfileAvatar",
+      }
+    },
+    "/api/v2/progress": {
+      "get": {
+        "operationId": "listProgress",
         "parameters": [
           {
-            "description": "Optional. When present, it must name a profile of the authenticated account.",
+            "description": "The household profile acting for this request; it must belong to the authenticated account.",
             "in": "header",
             "name": "X-Profile-Id",
+            "required": true,
             "schema": {
               "examples": [
                 "1"
@@ -187526,41 +192554,73 @@
             }
           },
           {
-            "description": "The profile",
-            "in": "path",
-            "name": "id",
-            "required": true,
+            "description": "Only entries in this state; absent lists every entry",
+            "explode": false,
+            "in": "query",
+            "name": "status",
             "schema": {
-              "description": "The profile",
+              "description": "Only entries in this state; absent lists every entry",
+              "enum": [
+                "in_progress",
+                "completed"
+              ],
+              "examples": [
+                "in_progress"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Only entries whose item is in this library",
+            "explode": false,
+            "in": "query",
+            "name": "library_id",
+            "schema": {
+              "description": "Only entries whose item is in this library",
               "examples": [
                 "1"
               ],
               "minLength": 1,
               "type": "string"
             }
-          }
-        ],
-        "requestBody": {
-          "content": {
-            "multipart/form-data": {
-              "encoding": {
-                "avatar": {
-                  "contentType": "image/jpeg,image/png,image/webp"
-                }
-              },
-              "schema": {
-                "$ref": "#/components/schemas/ProfileAvatarForm"
-              }
+          },
+          {
+            "description": "Page size; default 50, maximum 200",
+            "explode": false,
+            "in": "query",
+            "name": "limit",
+            "schema": {
+              "default": 50,
+              "description": "Page size; default 50, maximum 200",
+              "examples": [
+                50
+              ],
+              "format": "int64",
+              "maximum": 200,
+              "minimum": 1,
+              "type": "integer"
             }
           },
-          "required": true
-        },
+          {
+            "description": "Opaque cursor from page.next_cursor",
+            "explode": false,
+            "in": "query",
+            "name": "cursor",
+            "schema": {
+              "description": "Opaque cursor from page.next_cursor",
+              "examples": [
+                "eyJvZmZzZXQiOjUwfQ"
+              ],
+              "type": "string"
+            }
+          }
+        ],
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/Profile"
+                  "$ref": "#/components/schemas/ProgressCollection"
                 }
               }
             },
@@ -187616,36 +192676,6 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
-          "413": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unsupported Media Type"
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -187692,25 +192722,31 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Replace a profile's avatar with an uploaded image (multipart form, part `avatar`: JPEG, PNG or WebP, at most 10 MiB; the whole request, framing included, at most 11 MiB).",
+        "summary": "List the acting profile's watch progress, newest change first.",
         "tags": [
-          "profiles"
+          "progress"
         ],
         "x-silo-class": "profile_scoped",
-        "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/profiles/{id}/verify-pin": {
-      "post": {
-        "description": "Wrong PINs are counted per profile, Jellyfin password#PIN sign-ins included. Redis shares the count across server nodes; without Redis, each process counts its own attempts. Up to five attempts are allowed; the fifth wrong one locks the profile for five minutes, during which every check, even with the right PIN, is refused with 429 rate_limited and a Retry-After header giving the seconds left. A correct PIN while not locked clears the count, and an unlocked count expires five minutes after its first attempt. Each check affects the count and must not be automatically retried.",
-        "operationId": "verifyProfilePIN",
+    "/api/v2/progress/capabilities": {
+      "get": {
+        "operationId": "getProgressCapabilities",
         "parameters": [
           {
-            "description": "Optional. When present, it must name a profile of the authenticated account.",
+            "description": "Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed.",
+            "in": "header",
+            "name": "If-Match",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "description": "The household profile acting for this request; it must belong to the authenticated account.",
             "in": "header",
             "name": "X-Profile-Id",
+            "required": true,
             "schema": {
               "examples": [
                 "1"
@@ -187730,40 +192766,47 @@
             }
           },
           {
-            "description": "The profile whose PIN is checked",
-            "in": "path",
-            "name": "id",
-            "required": true,
+            "in": "header",
+            "name": "If-None-Match",
             "schema": {
-              "description": "The profile whose PIN is checked",
-              "examples": [
-                "1"
-              ],
-              "minLength": 1,
               "type": "string"
             }
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/ProfilePINCheck"
-              }
-            }
-          },
-          "required": true
-        },
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ProfileVerification"
+                  "$ref": "#/components/schemas/ProgressCapabilities"
                 }
               }
             },
-            "description": "OK"
+            "description": "OK",
+            "headers": {
+              "Cache-Control": {
+                "schema": {
+                  "type": "string"
+                }
+              },
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "304": {
+            "description": "The representation named by If-None-Match is current; no body.",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
           },
           "400": {
             "content": {
@@ -187815,17 +192858,7 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
-          "413": {
+          "412": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -187833,17 +192866,15 @@
                 }
               }
             },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
+            "description": "Precondition Failed",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
                 "schema": {
-                  "$ref": "#/components/schemas/Problem"
+                  "type": "string"
                 }
               }
-            },
-            "description": "Unsupported Media Type"
+            }
           },
           "422": {
             "content": {
@@ -187891,18 +192922,18 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Check a profile's PIN; a match issues the X-Profile-Token that unlocks the profile for this login session.",
+        "summary": "The watch progress features this server supports, such as clearing a resume position.",
         "tags": [
-          "profiles"
+          "progress"
         ],
         "x-silo-class": "profile_scoped",
-        "x-silo-retry-safety": "non_retryable",
+        "x-silo-conditional": true,
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/progress": {
-      "get": {
-        "operationId": "listProgress",
+    "/api/v2/progress/{media_item_id}/position": {
+      "delete": {
+        "operationId": "clearResumePosition",
         "parameters": [
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
@@ -187928,77 +192959,23 @@
             }
           },
           {
-            "description": "Only entries in this state; absent lists every entry",
-            "explode": false,
-            "in": "query",
-            "name": "status",
-            "schema": {
-              "description": "Only entries in this state; absent lists every entry",
-              "enum": [
-                "in_progress",
-                "completed"
-              ],
-              "examples": [
-                "in_progress"
-              ],
-              "type": "string"
-            }
-          },
-          {
-            "description": "Only entries whose item is in this library",
-            "explode": false,
-            "in": "query",
-            "name": "library_id",
+            "description": "A movie or episode",
+            "in": "path",
+            "name": "media_item_id",
+            "required": true,
             "schema": {
-              "description": "Only entries whose item is in this library",
+              "description": "A movie or episode",
               "examples": [
-                "1"
+                "movie-8f2c1a"
               ],
               "minLength": 1,
               "type": "string"
             }
-          },
-          {
-            "description": "Page size; default 50, maximum 200",
-            "explode": false,
-            "in": "query",
-            "name": "limit",
-            "schema": {
-              "default": 50,
-              "description": "Page size; default 50, maximum 200",
-              "examples": [
-                50
-              ],
-              "format": "int64",
-              "maximum": 200,
-              "minimum": 1,
-              "type": "integer"
-            }
-          },
-          {
-            "description": "Opaque cursor from page.next_cursor",
-            "explode": false,
-            "in": "query",
-            "name": "cursor",
-            "schema": {
-              "description": "Opaque cursor from page.next_cursor",
-              "examples": [
-                "eyJvZmZzZXQiOjUwfQ"
-              ],
-              "type": "string"
-            }
           }
         ],
         "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ProgressCollection"
-                }
-              }
-            },
-            "description": "OK"
+          "204": {
+            "description": "No Content"
           },
           "400": {
             "content": {
@@ -188096,11 +193073,12 @@
             "bearerAuth": []
           }
         ],
-        "summary": "List the acting profile's watch progress, newest change first.",
+        "summary": "Clear the acting profile's resume position on a movie or episode, keeping its watched state and watch history. An item without a resume position is a no-op.",
         "tags": [
           "progress"
         ],
         "x-silo-class": "profile_scoped",
+        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
@@ -188829,6 +193807,105 @@
               "minimum": 1,
               "type": "integer"
             }
+          },
+          {
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
+            "explode": false,
+            "in": "query",
+            "name": "image_size",
+            "schema": {
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
+              "enum": [
+                "small",
+                "medium",
+                "large",
+                "original"
+              ],
+              "examples": [
+                "medium"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
           }
         ],
         "responses": {
@@ -188938,7 +194015,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Cards recommended because the acting profile watched the item, minus what it has watched or rated low.",
+        "summary": "Cards recommended because the acting profile watched the item, minus what it has watched or rated.",
         "tags": [
           "recommendations"
         ],
@@ -188972,6 +194049,105 @@
               ],
               "type": "string"
             }
+          },
+          {
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
+            "explode": false,
+            "in": "query",
+            "name": "image_size",
+            "schema": {
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
+              "enum": [
+                "small",
+                "medium",
+                "large",
+                "original"
+              ],
+              "examples": [
+                "medium"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
           }
         ],
         "responses": {
@@ -189132,6 +194308,105 @@
               "minimum": 1,
               "type": "integer"
             }
+          },
+          {
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
+            "explode": false,
+            "in": "query",
+            "name": "image_size",
+            "schema": {
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
+              "enum": [
+                "small",
+                "medium",
+                "large",
+                "original"
+              ],
+              "examples": [
+                "medium"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
           }
         ],
         "responses": {
@@ -189292,6 +194567,105 @@
               "minimum": 1,
               "type": "integer"
             }
+          },
+          {
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
+            "explode": false,
+            "in": "query",
+            "name": "image_size",
+            "schema": {
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
+              "enum": [
+                "small",
+                "medium",
+                "large",
+                "original"
+              ],
+              "examples": [
+                "medium"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
           }
         ],
         "responses": {
@@ -189468,6 +194842,105 @@
               "minimum": 1,
               "type": "integer"
             }
+          },
+          {
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
+            "explode": false,
+            "in": "query",
+            "name": "image_size",
+            "schema": {
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
+              "enum": [
+                "small",
+                "medium",
+                "large",
+                "original"
+              ],
+              "examples": [
+                "medium"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
           }
         ],
         "responses": {
@@ -189577,7 +195050,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "The server's most played items over the window, minus what the acting profile has watched.",
+        "summary": "The server's most played items over the window, minus what the acting profile has watched or marked Not interested.",
         "tags": [
           "recommendations"
         ],
@@ -189644,6 +195117,105 @@
               "minimum": 1,
               "type": "integer"
             }
+          },
+          {
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
+            "explode": false,
+            "in": "query",
+            "name": "image_size",
+            "schema": {
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
+              "enum": [
+                "small",
+                "medium",
+                "large",
+                "original"
+              ],
+              "examples": [
+                "medium"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
           }
         ],
         "responses": {
@@ -189753,7 +195325,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Items added over the window, minus what the acting profile has watched.",
+        "summary": "Items added over the window, minus what the acting profile has watched or marked Not interested.",
         "tags": [
           "recommendations"
         ],
@@ -189839,6 +195411,105 @@
               "minimum": 1,
               "type": "integer"
             }
+          },
+          {
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
+            "explode": false,
+            "in": "query",
+            "name": "image_size",
+            "schema": {
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
+              "enum": [
+                "small",
+                "medium",
+                "large",
+                "original"
+              ],
+              "examples": [
+                "medium"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
           }
         ],
         "responses": {
@@ -189999,6 +195670,105 @@
               "minimum": 1,
               "type": "integer"
             }
+          },
+          {
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
+            "explode": false,
+            "in": "query",
+            "name": "image_size",
+            "schema": {
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
+              "enum": [
+                "small",
+                "medium",
+                "large",
+                "original"
+              ],
+              "examples": [
+                "medium"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
           }
         ],
         "responses": {
@@ -190173,6 +195943,105 @@
               "minimum": 1,
               "type": "integer"
             }
+          },
+          {
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
+            "explode": false,
+            "in": "query",
+            "name": "image_size",
+            "schema": {
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
+              "enum": [
+                "small",
+                "medium",
+                "large",
+                "original"
+              ],
+              "examples": [
+                "medium"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
           }
         ],
         "responses": {
@@ -190282,7 +196151,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Cards similar to the item by content; not personalised beyond the acting profile's access.",
+        "summary": "Cards similar to the item by content; personalised only by the acting profile's access and by leaving out the titles it marked Not interested.",
         "tags": [
           "recommendations"
         ],
@@ -190674,6 +196543,105 @@
               ],
               "type": "string"
             }
+          },
+          {
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
+            "explode": false,
+            "in": "query",
+            "name": "image_size",
+            "schema": {
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
+              "enum": [
+                "small",
+                "medium",
+                "large",
+                "original"
+              ],
+              "examples": [
+                "medium"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
           }
         ],
         "responses": {
@@ -190834,6 +196802,105 @@
               "minimum": 1,
               "type": "integer"
             }
+          },
+          {
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
+            "explode": false,
+            "in": "query",
+            "name": "image_size",
+            "schema": {
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
+              "enum": [
+                "small",
+                "medium",
+                "large",
+                "original"
+              ],
+              "examples": [
+                "medium"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
           }
         ],
         "responses": {
@@ -191050,6 +197117,105 @@
               "minimum": 1,
               "type": "integer"
             }
+          },
+          {
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
+            "explode": false,
+            "in": "query",
+            "name": "image_size",
+            "schema": {
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
+              "enum": [
+                "small",
+                "medium",
+                "large",
+                "original"
+              ],
+              "examples": [
+                "medium"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
           }
         ],
         "responses": {
@@ -193779,9 +199945,219 @@
             }
           },
           {
-            "in": "header",
-            "name": "If-None-Match",
+            "in": "header",
+            "name": "If-None-Match",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/FeatureStatus"
+                }
+              }
+            },
+            "description": "OK",
+            "headers": {
+              "Cache-Control": {
+                "schema": {
+                  "type": "string"
+                }
+              },
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "304": {
+            "description": "The representation named by If-None-Match is current; no body.",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "400": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Bad Request"
+          },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
+          "403": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Forbidden"
+          },
+          "404": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Found"
+          },
+          "406": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Not Acceptable"
+          },
+          "409": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Conflict"
+          },
+          "412": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Precondition Failed",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "422": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unprocessable Entity"
+          },
+          "429": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Too Many Requests"
+          },
+          "500": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Internal Server Error"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Service Unavailable"
+          }
+        },
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "summary": "Get request capabilities for the current viewer.",
+        "tags": [
+          "requests"
+        ],
+        "x-silo-class": "profile_scoped",
+        "x-silo-conditional": true,
+        "x-silo-service-backed": true
+      }
+    },
+    "/api/v2/requests/{id}": {
+      "get": {
+        "operationId": "getRequest",
+        "parameters": [
+          {
+            "description": "The household profile acting for this request; it must belong to the authenticated account.",
+            "in": "header",
+            "name": "X-Profile-Id",
+            "required": true,
+            "schema": {
+              "examples": [
+                "1"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked",
+            "in": "header",
+            "name": "X-Profile-Token",
+            "schema": {
+              "examples": [
+                "pvt_5f3a9c1e7b2d4e8fa0c6"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "The request",
+            "in": "path",
+            "name": "id",
+            "required": true,
             "schema": {
+              "description": "The request",
+              "examples": [
+                "1834729"
+              ],
+              "minLength": 1,
               "type": "string"
             }
           }
@@ -193791,35 +200167,11 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/FeatureStatus"
+                  "$ref": "#/components/schemas/MediaRequest"
                 }
               }
             },
-            "description": "OK",
-            "headers": {
-              "Cache-Control": {
-                "schema": {
-                  "type": "string"
-                }
-              },
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
-          },
-          "304": {
-            "description": "The representation named by If-None-Match is current; no body.",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -193881,24 +200233,6 @@
             },
             "description": "Conflict"
           },
-          "412": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Precondition Failed",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -193945,18 +200279,17 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Get request capabilities for the current viewer.",
+        "summary": "Get one of the account's media requests.",
         "tags": [
           "requests"
         ],
         "x-silo-class": "profile_scoped",
-        "x-silo-conditional": true,
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/requests/{id}": {
-      "get": {
-        "operationId": "getRequest",
+    "/api/v2/requests/{id}/cancel": {
+      "post": {
+        "operationId": "cancelRequest",
         "parameters": [
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
@@ -193982,20 +200315,30 @@
             }
           },
           {
-            "description": "The request",
+            "description": "Opaque identifier",
             "in": "path",
             "name": "id",
             "required": true,
             "schema": {
-              "description": "The request",
+              "description": "Opaque identifier",
               "examples": [
-                "1834729"
+                "1"
               ],
               "minLength": 1,
               "type": "string"
             }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/RequestCancelInputBody"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
           "200": {
             "content": {
@@ -194057,6 +200400,16 @@
             },
             "description": "Not Acceptable"
           },
+          "408": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Timeout"
+          },
           "409": {
             "content": {
               "application/problem+json": {
@@ -194067,6 +200420,26 @@
             },
             "description": "Conflict"
           },
+          "413": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -194113,23 +200486,24 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Get one of the account's media requests.",
+        "summary": "Cancel an accessible request.",
         "tags": [
           "requests"
         ],
         "x-silo-class": "profile_scoped",
+        "x-silo-demo-restricted": true,
+        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/requests/{id}/cancel": {
+    "/api/v2/scan": {
       "post": {
-        "operationId": "cancelRequest",
+        "operationId": "startLibraryScan",
         "parameters": [
           {
-            "description": "The household profile acting for this request; it must belong to the authenticated account.",
+            "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
             "in": "header",
             "name": "X-Profile-Id",
-            "required": true,
             "schema": {
               "examples": [
                 "1"
@@ -194147,42 +200521,28 @@
               ],
               "type": "string"
             }
-          },
-          {
-            "description": "Opaque identifier",
-            "in": "path",
-            "name": "id",
-            "required": true,
-            "schema": {
-              "description": "Opaque identifier",
-              "examples": [
-                "1"
-              ],
-              "minLength": 1,
-              "type": "string"
-            }
           }
         ],
         "requestBody": {
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/RequestCancelInputBody"
+                "$ref": "#/components/schemas/ScanStartInputBody"
               }
             }
           },
           "required": true
         },
         "responses": {
-          "200": {
+          "202": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/MediaRequest"
+                  "$ref": "#/components/schemas/ScanStartOutputBody"
                 }
               }
             },
-            "description": "OK"
+            "description": "Accepted"
           },
           "400": {
             "content": {
@@ -194320,19 +200680,19 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Cancel an accessible request.",
+        "summary": "Resolve and dispatch a library, subtree or file scan through the configured execution path.",
         "tags": [
-          "requests"
+          "scan"
         ],
-        "x-silo-class": "profile_scoped",
+        "x-silo-class": "acting_admin",
         "x-silo-demo-restricted": true,
         "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/scan": {
+    "/api/v2/scan/cancel": {
       "post": {
-        "operationId": "startLibraryScan",
+        "operationId": "cancelLibraryScans",
         "parameters": [
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
@@ -194361,22 +200721,22 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/ScanStartInputBody"
+                "$ref": "#/components/schemas/ScanCancelInputBody"
               }
             }
           },
           "required": true
         },
         "responses": {
-          "202": {
+          "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ScanStartOutputBody"
+                  "$ref": "#/components/schemas/ScanCancelOutputBody"
                 }
               }
             },
-            "description": "Accepted"
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -194438,16 +200798,6 @@
             },
             "description": "Request Timeout"
           },
-          "409": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Conflict"
-          },
           "413": {
             "content": {
               "application/problem+json": {
@@ -194514,7 +200864,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Resolve and dispatch a library, subtree or file scan through the configured execution path.",
+        "summary": "Cancel the library's currently queued and local scans.",
         "tags": [
           "scan"
         ],
@@ -194524,10 +200874,18 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/scan/cancel": {
-      "post": {
-        "operationId": "cancelLibraryScans",
+    "/api/v2/scan/capabilities": {
+      "get": {
+        "operationId": "getScanCapabilities",
         "parameters": [
+          {
+            "description": "Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed.",
+            "in": "header",
+            "name": "If-Match",
+            "schema": {
+              "type": "string"
+            }
+          },
           {
             "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
             "in": "header",
@@ -194549,28 +200907,49 @@
               ],
               "type": "string"
             }
+          },
+          {
+            "in": "header",
+            "name": "If-None-Match",
+            "schema": {
+              "type": "string"
+            }
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/ScanCancelInputBody"
-              }
-            }
-          },
-          "required": true
-        },
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ScanCancelOutputBody"
+                  "$ref": "#/components/schemas/Capability"
                 }
               }
             },
-            "description": "OK"
+            "description": "OK",
+            "headers": {
+              "Cache-Control": {
+                "schema": {
+                  "type": "string"
+                }
+              },
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "304": {
+            "description": "The representation named by If-None-Match is current; no body.",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
           },
           "400": {
             "content": {
@@ -194622,17 +201001,7 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
-          "413": {
+          "412": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -194640,17 +201009,15 @@
                 }
               }
             },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
+            "description": "Precondition Failed",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
                 "schema": {
-                  "$ref": "#/components/schemas/Problem"
+                  "type": "string"
                 }
               }
-            },
-            "description": "Unsupported Media Type"
+            }
           },
           "422": {
             "content": {
@@ -194698,30 +201065,21 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Cancel the library's currently queued and local scans.",
+        "summary": "Discover scan-control availability.",
         "tags": [
           "scan"
         ],
         "x-silo-class": "acting_admin",
-        "x-silo-demo-restricted": true,
-        "x-silo-retry-safety": "non_retryable",
+        "x-silo-conditional": true,
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/scan/capabilities": {
+    "/api/v2/sections/recipes": {
       "get": {
-        "operationId": "getScanCapabilities",
+        "operationId": "listSectionRecipes",
         "parameters": [
           {
-            "description": "Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed.",
-            "in": "header",
-            "name": "If-Match",
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "description": "Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted.",
+            "description": "Optional. When present, it must name a profile of the authenticated account.",
             "in": "header",
             "name": "X-Profile-Id",
             "schema": {
@@ -194741,13 +201099,6 @@
               ],
               "type": "string"
             }
-          },
-          {
-            "in": "header",
-            "name": "If-None-Match",
-            "schema": {
-              "type": "string"
-            }
           }
         ],
         "responses": {
@@ -194755,35 +201106,11 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/Capability"
+                  "$ref": "#/components/schemas/RecipeCatalog"
                 }
               }
             },
-            "description": "OK",
-            "headers": {
-              "Cache-Control": {
-                "schema": {
-                  "type": "string"
-                }
-              },
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
-          },
-          "304": {
-            "description": "The representation named by If-None-Match is current; no body.",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
+            "description": "OK"
           },
           "400": {
             "content": {
@@ -194835,24 +201162,6 @@
             },
             "description": "Not Acceptable"
           },
-          "412": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Precondition Failed",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
-          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -194899,18 +201208,17 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Discover scan-control availability.",
+        "summary": "The section recipe gallery: every visible recipe with its presets, grouped by category.",
         "tags": [
-          "scan"
+          "home"
         ],
-        "x-silo-class": "acting_admin",
-        "x-silo-conditional": true,
+        "x-silo-class": "profile_scoped",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/sections/recipes": {
+    "/api/v2/sections/recipes/{type}/candidates": {
       "get": {
-        "operationId": "listSectionRecipes",
+        "operationId": "listSectionRecipeCandidates",
         "parameters": [
           {
             "description": "Optional. When present, it must name a profile of the authenticated account.",
@@ -194933,6 +201241,20 @@
               ],
               "type": "string"
             }
+          },
+          {
+            "description": "Recipe type from the catalog",
+            "in": "path",
+            "name": "type",
+            "required": true,
+            "schema": {
+              "description": "Recipe type from the catalog",
+              "examples": [
+                "custom_filter"
+              ],
+              "minLength": 1,
+              "type": "string"
+            }
           }
         ],
         "responses": {
@@ -194940,7 +201262,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/RecipeCatalog"
+                  "$ref": "#/components/schemas/RecipeCandidateCollection"
                 }
               }
             },
@@ -195042,7 +201364,7 @@
             "bearerAuth": []
           }
         ],
-        "summary": "The section recipe gallery: every visible recipe with its presets, grouped by category.",
+        "summary": "The values a parameterized recipe offers for its parameter.",
         "tags": [
           "home"
         ],
@@ -195050,9 +201372,9 @@
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/sections/recipes/{type}/candidates": {
+    "/api/v2/sections/seasonal-themes": {
       "get": {
-        "operationId": "listSectionRecipeCandidates",
+        "operationId": "listSeasonalThemes",
         "parameters": [
           {
             "description": "Optional. When present, it must name a profile of the authenticated account.",
@@ -195075,20 +201397,6 @@
               ],
               "type": "string"
             }
-          },
-          {
-            "description": "Recipe type from the catalog",
-            "in": "path",
-            "name": "type",
-            "required": true,
-            "schema": {
-              "description": "Recipe type from the catalog",
-              "examples": [
-                "custom_filter"
-              ],
-              "minLength": 1,
-              "type": "string"
-            }
           }
         ],
         "responses": {
@@ -195096,7 +201404,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/RecipeCandidateCollection"
+                  "$ref": "#/components/schemas/SeasonalThemeCatalog"
                 }
               }
             },
@@ -195198,12 +201506,11 @@
             "bearerAuth": []
           }
         ],
-        "summary": "The values a parameterized recipe offers for its parameter.",
+        "summary": "The holidays a Seasonal Picks row can follow, with the curated vibes each offers.",
         "tags": [
           "home"
         ],
-        "x-silo-class": "profile_scoped",
-        "x-silo-service-backed": true
+        "x-silo-class": "profile_scoped"
       }
     },
     "/api/v2/settings/contract": {
@@ -198762,20 +205069,103 @@
             }
           },
           {
-            "description": "Artwork variant to presign on the item cards",
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
             "explode": false,
             "in": "query",
             "name": "image_size",
             "schema": {
-              "description": "Artwork variant to presign on the item cards",
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
               "enum": [
                 "small",
                 "medium",
                 "large",
                 "original"
               ],
+              "examples": [
+                "medium"
+              ],
               "type": "string"
             }
+          },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
           }
         ],
         "requestBody": {
@@ -199335,20 +205725,103 @@
             }
           },
           {
-            "description": "Artwork variant to presign on the item cards",
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
             "explode": false,
             "in": "query",
             "name": "image_size",
             "schema": {
-              "description": "Artwork variant to presign on the item cards",
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
               "enum": [
                 "small",
                 "medium",
                 "large",
                 "original"
               ],
+              "examples": [
+                "medium"
+              ],
               "type": "string"
             }
+          },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
           }
         ],
         "responses": {
@@ -199514,20 +205987,103 @@
             }
           },
           {
-            "description": "Artwork variant to presign on the item cards",
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
             "explode": false,
             "in": "query",
             "name": "image_size",
             "schema": {
-              "description": "Artwork variant to presign on the item cards",
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
               "enum": [
                 "small",
                 "medium",
                 "large",
                 "original"
               ],
+              "examples": [
+                "medium"
+              ],
               "type": "string"
             }
+          },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
           }
         ],
         "requestBody": {
@@ -199734,20 +206290,103 @@
             }
           },
           {
-            "description": "Artwork variant to presign on the item cards",
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
             "explode": false,
             "in": "query",
             "name": "image_size",
             "schema": {
-              "description": "Artwork variant to presign on the item cards",
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
               "enum": [
                 "small",
                 "medium",
                 "large",
                 "original"
               ],
+              "examples": [
+                "medium"
+              ],
               "type": "string"
             }
+          },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
           }
         ],
         "requestBody": {
@@ -206259,227 +212898,27 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Apply a batch of progress writes for the acting profile and answer one result per item; supply updated_at on each item to preserve event ordering.",
-        "tags": [
-          "progress"
-        ],
-        "x-silo-class": "profile_scoped",
-        "x-silo-retry-safety": "non_retryable",
-        "x-silo-service-backed": true
-      }
-    },
-    "/api/v2/sync/progress/capabilities": {
-      "get": {
-        "operationId": "getProgressBootstrapCapabilities",
-        "parameters": [
-          {
-            "description": "Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed.",
-            "in": "header",
-            "name": "If-Match",
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "description": "The household profile acting for this request; it must belong to the authenticated account.",
-            "in": "header",
-            "name": "X-Profile-Id",
-            "required": true,
-            "schema": {
-              "examples": [
-                "1"
-              ],
-              "type": "string"
-            }
-          },
-          {
-            "description": "Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked",
-            "in": "header",
-            "name": "X-Profile-Token",
-            "schema": {
-              "examples": [
-                "pvt_5f3a9c1e7b2d4e8fa0c6"
-              ],
-              "type": "string"
-            }
-          },
-          {
-            "in": "header",
-            "name": "Authorization",
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "in": "header",
-            "name": "If-None-Match",
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/ProgressBootstrapCapabilities"
-                }
-              }
-            },
-            "description": "OK",
-            "headers": {
-              "Cache-Control": {
-                "schema": {
-                  "type": "string"
-                }
-              },
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
-          },
-          "304": {
-            "description": "The representation named by If-None-Match is current; no body.",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
-          },
-          "400": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Bad Request"
-          },
-          "401": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unauthorized"
-          },
-          "403": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Forbidden"
-          },
-          "404": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Not Found"
-          },
-          "406": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Not Acceptable"
-          },
-          "412": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Precondition Failed",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
-          },
-          "422": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Unprocessable Entity"
-          },
-          "429": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Too Many Requests"
-          },
-          "500": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Internal Server Error"
-          },
-          "503": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Service Unavailable"
-          }
-        },
-        "security": [
-          {
-            "bearerAuth": []
-          }
-        ],
-        "summary": "Discover full-replacement progress bootstrap support for this profile.",
+        "summary": "Apply a batch of progress writes for the acting profile and answer one result per item; supply updated_at on each item to preserve event ordering.",
         "tags": [
           "progress"
         ],
         "x-silo-class": "profile_scoped",
-        "x-silo-conditional": true,
+        "x-silo-retry-safety": "non_retryable",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/sync/progress/snapshots": {
-      "post": {
-        "operationId": "createProgressBootstrapSnapshot",
+    "/api/v2/sync/progress/capabilities": {
+      "get": {
+        "operationId": "getProgressBootstrapCapabilities",
         "parameters": [
+          {
+            "description": "Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed.",
+            "in": "header",
+            "name": "If-Match",
+            "schema": {
+              "type": "string"
+            }
+          },
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
             "in": "header",
@@ -206509,35 +212948,44 @@
             "schema": {
               "type": "string"
             }
+          },
+          {
+            "in": "header",
+            "name": "If-None-Match",
+            "schema": {
+              "type": "string"
+            }
           }
         ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/ProgressSnapshotCreateInputBody"
-              }
-            }
-          },
-          "required": true
-        },
         "responses": {
-          "201": {
+          "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ProgressSnapshot"
+                  "$ref": "#/components/schemas/ProgressBootstrapCapabilities"
                 }
               }
             },
-            "description": "Created",
+            "description": "OK",
             "headers": {
               "Cache-Control": {
                 "schema": {
                   "type": "string"
                 }
               },
-              "Location": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "304": {
+            "description": "The representation named by If-None-Match is current; no body.",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
                 "schema": {
                   "type": "string"
                 }
@@ -206594,27 +213042,7 @@
             },
             "description": "Not Acceptable"
           },
-          "408": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Request Timeout"
-          },
-          "409": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Conflict"
-          },
-          "413": {
+          "412": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -206622,17 +213050,15 @@
                 }
               }
             },
-            "description": "Request Entity Too Large"
-          },
-          "415": {
-            "content": {
-              "application/problem+json": {
+            "description": "Precondition Failed",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
                 "schema": {
-                  "$ref": "#/components/schemas/Problem"
+                  "type": "string"
                 }
               }
-            },
-            "description": "Unsupported Media Type"
+            }
           },
           "422": {
             "content": {
@@ -206680,18 +213106,18 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Capture an immutable full-replacement snapshot. Reuse request_id only for the same admission intent within the 24-hour metadata retention horizon.",
+        "summary": "Discover full-replacement progress bootstrap support for this profile.",
         "tags": [
           "progress"
         ],
         "x-silo-class": "profile_scoped",
-        "x-silo-retry-safety": "domain_identity",
+        "x-silo-conditional": true,
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/sync/progress/snapshots/{snapshot_id}": {
-      "get": {
-        "operationId": "getProgressBootstrapSnapshot",
+    "/api/v2/sync/progress/snapshots": {
+      "post": {
+        "operationId": "createProgressBootstrapSnapshot",
         "parameters": [
           {
             "description": "The household profile acting for this request; it must belong to the authenticated account.",
@@ -206722,29 +213148,20 @@
             "schema": {
               "type": "string"
             }
-          },
-          {
-            "in": "path",
-            "name": "snapshot_id",
-            "required": true,
-            "schema": {
-              "format": "uuid",
-              "type": "string"
-            }
-          },
-          {
-            "explode": false,
-            "in": "query",
-            "name": "cursor",
-            "required": true,
-            "schema": {
-              "maxLength": 8192,
-              "type": "string"
-            }
           }
         ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ProgressSnapshotCreateInputBody"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
-          "200": {
+          "201": {
             "content": {
               "application/json": {
                 "schema": {
@@ -206752,7 +213169,7 @@
                 }
               }
             },
-            "description": "OK",
+            "description": "Created",
             "headers": {
               "Cache-Control": {
                 "schema": {
@@ -206816,6 +213233,16 @@
             },
             "description": "Not Acceptable"
           },
+          "408": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Timeout"
+          },
           "409": {
             "content": {
               "application/problem+json": {
@@ -206826,6 +213253,26 @@
             },
             "description": "Conflict"
           },
+          "413": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Request Entity Too Large"
+          },
+          "415": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unsupported Media Type"
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -206872,30 +213319,65 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Read the next immutable snapshot page using its signed continuation.",
+        "summary": "Capture an immutable full-replacement snapshot. Reuse request_id only for the same admission intent within the 24-hour metadata retention horizon.",
         "tags": [
           "progress"
         ],
         "x-silo-class": "profile_scoped",
+        "x-silo-retry-safety": "domain_identity",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/system/connections": {
+    "/api/v2/sync/progress/snapshots/{snapshot_id}": {
       "get": {
-        "operationId": "getServerConnections",
+        "operationId": "getProgressBootstrapSnapshot",
         "parameters": [
           {
-            "description": "Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed.",
+            "description": "The household profile acting for this request; it must belong to the authenticated account.",
             "in": "header",
-            "name": "If-Match",
+            "name": "X-Profile-Id",
+            "required": true,
+            "schema": {
+              "examples": [
+                "1"
+              ],
+              "type": "string"
+            }
+          },
+          {
+            "description": "Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked",
+            "in": "header",
+            "name": "X-Profile-Token",
             "schema": {
+              "examples": [
+                "pvt_5f3a9c1e7b2d4e8fa0c6"
+              ],
               "type": "string"
             }
           },
           {
             "in": "header",
-            "name": "If-None-Match",
+            "name": "Authorization",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "in": "path",
+            "name": "snapshot_id",
+            "required": true,
+            "schema": {
+              "format": "uuid",
+              "type": "string"
+            }
+          },
+          {
+            "explode": false,
+            "in": "query",
+            "name": "cursor",
+            "required": true,
             "schema": {
+              "maxLength": 8192,
               "type": "string"
             }
           }
@@ -206905,7 +213387,7 @@
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ServerConnectionsDocument"
+                  "$ref": "#/components/schemas/ProgressSnapshot"
                 }
               }
             },
@@ -206916,19 +213398,7 @@
                   "type": "string"
                 }
               },
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
-                "schema": {
-                  "type": "string"
-                }
-              }
-            }
-          },
-          "304": {
-            "description": "The representation named by If-None-Match is current; no body.",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+              "Location": {
                 "schema": {
                   "type": "string"
                 }
@@ -206955,7 +213425,7 @@
             },
             "description": "Unauthorized"
           },
-          "406": {
+          "403": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -206963,9 +213433,9 @@
                 }
               }
             },
-            "description": "Not Acceptable"
+            "description": "Forbidden"
           },
-          "412": {
+          "404": {
             "content": {
               "application/problem+json": {
                 "schema": {
@@ -206973,15 +213443,27 @@
                 }
               }
             },
-            "description": "Precondition Failed",
-            "headers": {
-              "ETag": {
-                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+            "description": "Not Found"
+          },
+          "406": {
+            "content": {
+              "application/problem+json": {
                 "schema": {
-                  "type": "string"
+                  "$ref": "#/components/schemas/Problem"
                 }
               }
-            }
+            },
+            "description": "Not Acceptable"
+          },
+          "409": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Conflict"
           },
           "422": {
             "content": {
@@ -207029,24 +213511,40 @@
             "bearerAuth": []
           }
         ],
-        "summary": "List the addresses this deployment offers to clients: the configured public URL and each installed network access provider with its overlay origin when connected on the API host. available whenever the server identity is readable; a missing public URL is an absent endpoint, never a manufactured one. Node backend addresses, enrollment URLs and admin status are not included.",
+        "summary": "Read the next immutable snapshot page using its signed continuation.",
         "tags": [
-          "system"
+          "progress"
         ],
-        "x-silo-class": "authenticated",
-        "x-silo-conditional": true,
+        "x-silo-class": "profile_scoped",
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/system/identity": {
+    "/api/v2/system/connections": {
       "get": {
-        "operationId": "getServerIdentity",
+        "operationId": "getServerConnections",
+        "parameters": [
+          {
+            "description": "Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed.",
+            "in": "header",
+            "name": "If-Match",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "in": "header",
+            "name": "If-None-Match",
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ServerIdentity"
+                  "$ref": "#/components/schemas/ServerConnectionsDocument"
                 }
               }
             },
@@ -207056,6 +213554,23 @@
                 "schema": {
                   "type": "string"
                 }
+              },
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "304": {
+            "description": "The representation named by If-None-Match is current; no body.",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
               }
             }
           },
@@ -207069,6 +213584,16 @@
             },
             "description": "Bad Request"
           },
+          "401": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Unauthorized"
+          },
           "406": {
             "content": {
               "application/problem+json": {
@@ -207079,6 +213604,24 @@
             },
             "description": "Not Acceptable"
           },
+          "412": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Precondition Failed",
+            "headers": {
+              "ETag": {
+                "description": "The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read.",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
           "422": {
             "content": {
               "application/problem+json": {
@@ -207089,6 +213632,16 @@
             },
             "description": "Unprocessable Entity"
           },
+          "429": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Too Many Requests"
+          },
           "500": {
             "content": {
               "application/problem+json": {
@@ -207110,23 +213663,29 @@
             "description": "Service Unavailable"
           }
         },
-        "summary": "Read the deployment's stable server identity before login, so a client can tell whether two addresses lead to the same server. Self-asserted: pairing and credentials still go through device-login approval.",
+        "security": [
+          {
+            "bearerAuth": []
+          }
+        ],
+        "summary": "List the addresses this deployment offers to clients: the configured public URL and each installed network access provider with its overlay origin when connected on the API host. available whenever the server identity is readable; a missing public URL is an absent endpoint, never a manufactured one. Node backend addresses, enrollment URLs and admin status are not included.",
         "tags": [
           "system"
         ],
-        "x-silo-class": "public",
+        "x-silo-class": "authenticated",
+        "x-silo-conditional": true,
         "x-silo-service-backed": true
       }
     },
-    "/api/v2/system/info": {
+    "/api/v2/system/identity": {
       "get": {
-        "operationId": "getSystemInfo",
+        "operationId": "getServerIdentity",
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SystemInfo"
+                  "$ref": "#/components/schemas/ServerIdentity"
                 }
               }
             },
@@ -207178,28 +213737,46 @@
               }
             },
             "description": "Internal Server Error"
+          },
+          "503": {
+            "content": {
+              "application/problem+json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Problem"
+                }
+              }
+            },
+            "description": "Service Unavailable"
           }
         },
-        "summary": "Get server and contract identity for discovery before login.",
+        "summary": "Read the deployment's stable server identity before login, so a client can tell whether two addresses lead to the same server. Self-asserted: pairing and credentials still go through device-login approval.",
         "tags": [
           "system"
         ],
-        "x-silo-class": "public"
+        "x-silo-class": "public",
+        "x-silo-service-backed": true
       }
     },
-    "/api/v2/system/setup": {
+    "/api/v2/system/info": {
       "get": {
-        "operationId": "getSetupStatus",
+        "operationId": "getSystemInfo",
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/SetupStatus"
+                  "$ref": "#/components/schemas/SystemInfo"
                 }
               }
             },
-            "description": "OK"
+            "description": "OK",
+            "headers": {
+              "Cache-Control": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
           },
           "400": {
             "content": {
@@ -207240,35 +213817,24 @@
               }
             },
             "description": "Internal Server Error"
-          },
-          "503": {
-            "content": {
-              "application/problem+json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Problem"
-                }
-              }
-            },
-            "description": "Service Unavailable"
           }
         },
-        "summary": "Report whether the server still needs its first administrator.",
+        "summary": "Get server and contract identity for discovery before login.",
         "tags": [
           "system"
         ],
-        "x-silo-class": "public",
-        "x-silo-service-backed": true
+        "x-silo-class": "public"
       }
     },
-    "/api/v2/theme/admin-css": {
+    "/api/v2/system/setup": {
       "get": {
-        "operationId": "getThemeOverrides",
+        "operationId": "getSetupStatus",
         "responses": {
           "200": {
             "content": {
               "application/json": {
                 "schema": {
-                  "$ref": "#/components/schemas/ThemeOverrides"
+                  "$ref": "#/components/schemas/SetupStatus"
                 }
               }
             },
@@ -207325,9 +213891,9 @@
             "description": "Service Unavailable"
           }
         },
-        "summary": "Read public pre-login theme overrides.",
+        "summary": "Report whether the server still needs its first administrator.",
         "tags": [
-          "branding"
+          "system"
         ],
         "x-silo-class": "public",
         "x-silo-service-backed": true
@@ -213805,12 +220371,12 @@
             }
           },
           {
-            "description": "Artwork variant to presign; absent picks each surface's default",
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
             "explode": false,
             "in": "query",
             "name": "image_size",
             "schema": {
-              "description": "Artwork variant to presign; absent picks each surface's default",
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
               "enum": [
                 "small",
                 "medium",
@@ -213822,6 +220388,86 @@
               ],
               "type": "string"
             }
+          },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
           }
         ],
         "responses": {
@@ -214451,12 +221097,12 @@
             }
           },
           {
-            "description": "Artwork variant to presign; absent picks each surface's default",
+            "description": "Artwork size for every image in the response; absent picks each surface's default",
             "explode": false,
             "in": "query",
             "name": "image_size",
             "schema": {
-              "description": "Artwork variant to presign; absent picks each surface's default",
+              "description": "Artwork size for every image in the response; absent picks each surface's default",
               "enum": [
                 "small",
                 "medium",
@@ -214469,6 +221115,86 @@
               "type": "string"
             }
           },
+          {
+            "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+            "explode": false,
+            "in": "query",
+            "name": "poster_width",
+            "schema": {
+              "description": "Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original",
+              "examples": [
+                352
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+            "explode": false,
+            "in": "query",
+            "name": "backdrop_width",
+            "schema": {
+              "description": "Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops",
+              "examples": [
+                2688
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+            "explode": false,
+            "in": "query",
+            "name": "logo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws logo_url at. Overrides image_size for logos",
+              "examples": [
+                1760
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+            "explode": false,
+            "in": "query",
+            "name": "still_width",
+            "schema": {
+              "description": "Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills",
+              "examples": [
+                720
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
+          {
+            "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+            "explode": false,
+            "in": "query",
+            "name": "photo_width",
+            "schema": {
+              "description": "Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots",
+              "examples": [
+                400
+              ],
+              "format": "int64",
+              "maximum": 7680,
+              "minimum": 1,
+              "type": "integer"
+            }
+          },
           {
             "description": "Page size; default 50, maximum 200",
             "explode": false,
@@ -215305,12 +222031,12 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Remove the item from the acting profile's watchlist; an absent entry succeeds, but automatic retries can repeat provider and refresh effects.",
+        "summary": "Remove the item from the acting profile's watchlist. An absent entry succeeds and changes nothing, so a retry repeats no change or notification; it cannot resend notifications an interrupted earlier call never sent.",
         "tags": [
           "watchlist"
         ],
         "x-silo-class": "profile_scoped",
-        "x-silo-retry-safety": "non_retryable",
+        "x-silo-retry-safety": "natural_idempotent",
         "x-silo-service-backed": true
       },
       "get": {
@@ -215609,12 +222335,12 @@
             "bearerAuth": []
           }
         ],
-        "summary": "Add the item to the acting profile's watchlist. Automatic retries are unsafe because provider and refresh effects are not change-gated.",
+        "summary": "Add the item to the acting profile's watchlist. Adding an item already there succeeds and changes nothing, so a retry repeats no change or notification; it cannot resend notifications an interrupted earlier call never sent.",
         "tags": [
           "watchlist"
         ],
         "x-silo-class": "profile_scoped",
-        "x-silo-retry-safety": "non_retryable",
+        "x-silo-retry-safety": "natural_idempotent",
         "x-silo-service-backed": true
       }
     },
@@ -224126,6 +230852,10 @@
           "filled": {
             "format": "int64",
             "type": "integer"
+          },
+          "refined": {
+            "format": "int64",
+            "type": "integer"
           }
         },
         "required": [
@@ -224265,6 +230995,9 @@
         "properties": {
           "allow_software": {
             "type": "boolean"
+          },
+          "source": {
+            "type": "string"
           }
         },
         "type": "object"
@@ -225258,6 +231991,9 @@
           "input_path": {
             "type": "string"
           },
+          "keyframe_playlist": {
+            "type": "boolean"
+          },
           "require_ready": {
             "type": "boolean"
           },
@@ -225303,6 +232039,9 @@
           "subtitle_codec": {
             "type": "string"
           },
+          "subtitle_rendition": {
+            "type": "boolean"
+          },
           "subtitle_track_index": {
             "format": "int64",
             "type": "integer"
@@ -225394,6 +232133,9 @@
           "hw_accel": {
             "type": "string"
           },
+          "keyframe_playlist": {
+            "type": "boolean"
+          },
           "session_id": {
             "type": "string"
           },
@@ -225403,6 +232145,9 @@
           "status": {
             "type": "string"
           },
+          "subtitle_rendition": {
+            "type": "boolean"
+          },
           "throttle_seconds": {
             "format": "int64",
             "type": "integer"
diff --git a/contracts/settings/v1/conformance.json b/contracts/settings/v1/conformance.json
index 0729c73154..3f84f5a25d 100644
--- a/contracts/settings/v1/conformance.json
+++ b/contracts/settings/v1/conformance.json
@@ -1,6 +1,6 @@
 {
   "fixture_version": 1,
-  "manifest_revision": 17,
+  "manifest_revision": 20,
   "description": "Cross-platform conformance cases for settings resolution. Every case runs against the shipped manifest in this directory: definitions are referenced by key, never restated, so an expectation can only be satisfied by resolving the real contract. Each platform's resolver (Go in internal/settingsresolve, TypeScript in web/src/lib/settingsResolve.ts, Kotlin and Swift in the client repos) runs every case through a hand-written runner; a runner must fail on any fixture field it does not know, because schema drift in the fixture itself is drift. A case's constraint_bindings attach a constraint to a copy of a real definition so constraint semantics stay testable even while no shipped definition carries that constraint kind. In expected entries, constrained:true requires stored_value and constraint_kind to be present, and stored_value may be null to mean the authored value was JSON null.",
   "cases": [
     {
@@ -1087,6 +1087,25 @@
         {"key": "ui.title_art", "scope": "profile_device", "profile_id": "p1", "device_id": "phone", "value": false}
       ],
       "expected": [{"key": "ui.title_art", "value": true, "source": "profile"}]
+    },
+    {
+      "name": "subtitle_sync_follows_profile",
+      "description": "From revision 19 player.subtitle_sync_ms is also a profile value: a device with no offset of its own uses the profile's.",
+      "keys": ["player.subtitle_sync_ms"],
+      "context": {"profile_id": "p1", "device_id": "another-device"},
+      "stored": [{"key": "player.subtitle_sync_ms", "scope": "profile", "profile_id": "p1", "value": -750}],
+      "expected": [{"key": "player.subtitle_sync_ms", "value": -750, "source": "profile"}]
+    },
+    {
+      "name": "subtitle_sync_device_wins",
+      "description": "A device's own player.subtitle_sync_ms still wins over the profile offset on that device.",
+      "keys": ["player.subtitle_sync_ms"],
+      "context": {"profile_id": "p1", "device_id": "d1"},
+      "stored": [
+        {"key": "player.subtitle_sync_ms", "scope": "profile", "profile_id": "p1", "value": -750},
+        {"key": "player.subtitle_sync_ms", "scope": "profile_device", "profile_id": "p1", "device_id": "d1", "value": 250}
+      ],
+      "expected": [{"key": "player.subtitle_sync_ms", "value": 250, "source": "profile_device"}]
     }
   ]
 }
diff --git a/contracts/settings/v1/manifest.json b/contracts/settings/v1/manifest.json
index e7936136cf..6e4c9fea0d 100644
--- a/contracts/settings/v1/manifest.json
+++ b/contracts/settings/v1/manifest.json
@@ -1,6 +1,6 @@
 {
   "api_version": 1,
-  "revision": 17,
+  "revision": 20,
   "option_sets": {
     "playback_audio_languages": {
       "type": "language_tag",
@@ -476,7 +476,7 @@
           { "value": "720p", "label": "720p" },
           { "value": "1080p", "label": "1080p" },
           { "value": "2160p", "label": "2160p / 4K" },
-          { "value": "original", "label": "Original quality" }
+          { "value": "original", "label": "Original quality", "deprecated": true }
         ]
       },
       "default_value": "auto",
@@ -488,7 +488,7 @@
       "label": "Preferred quality",
       "description": "Pick the quality Prairie should prefer.",
       "recommended_control": "select",
-      "notes": "The resolution axis. Members are exactly the vocabulary the server already speaks: NormalizeQualityV3 in internal/playback/protocol_v3.go accepts auto, 480p, 720p, 1080p, 2160p and original and normalizes anything else to auto with a degradation warning. Transcode ladder rungs (328p, 720p-high, 1080p-8 and friends) are deliberately absent — they were never a third dimension, only a bitrate spelled into the resolution string. web/src/player/hooks/useTranscodeQuality.ts already decomposes them, defining 1080p-high as {resolution: 1080p, bitrate: 10000} and sending the two to the server separately, so the compound form never reached the wire. playback.max_bitrate_kbps is now that second axis, and clients compose the two into whatever presets they want to show. Members are listed ascending so the ceiling constraint has a defined direction; \"auto\" sorts lowest because it never exceeds a cap, and \"original\" highest because it is the uncapped source. Enforcing the ceiling needs internal/access/quality.go to learn both sentinels: qualityRank ranks neither today, so auto and original both tie at 0 with unset and a cap would let original through. Migrates user_profiles.quality_preference as the profile fallback. The legacy column is NOT NULL DEFAULT '1080p', and that default was the effective playback cap, so existing profiles receive explicit 1080p and 6000 kbps rows; newly created profiles use the contract's auto/null defaults. The account/profile max_playback_quality columns stay in internal/policy and are NOT settings."
+      "notes": "The resolution axis. Members are exactly the vocabulary the server already speaks: NormalizeQualityV3 in internal/playback/protocol_v3.go accepts auto, 480p, 720p, 1080p, 2160p and original and normalizes anything else to auto with a degradation warning. Transcode ladder rungs (328p, 720p-high, 1080p-8 and friends) are deliberately absent — they were never a third dimension, only a bitrate spelled into the resolution string. web/src/player/hooks/useTranscodeQuality.ts already decomposes them, defining 1080p-high as {resolution: 1080p, bitrate: 10000} and sending the two to the server separately, so the compound form never reached the wire. playback.max_bitrate_kbps is now that second axis, and clients compose the two into whatever presets they want to show. Members are listed ascending so the ceiling constraint has a defined direction; \"auto\" sorts lowest because it never exceeds a cap, and \"original\" highest because it is the uncapped source. Enforcing the ceiling needs internal/access/quality.go to learn both sentinels: qualityRank ranks neither today, so auto and original both tie at 0 with unset and a cap would let original through. Migrates user_profiles.quality_preference as the profile fallback. The legacy column is NOT NULL DEFAULT '1080p', and that default was the effective playback cap, so existing profiles receive explicit 1080p and 6000 kbps rows; newly created profiles use the contract's auto/null defaults. The account/profile max_playback_quality columns stay in internal/policy and are NOT settings. Revision 20 deprecates \"original\": Auto with no bitrate cap already plays the source whenever the device can, so the separate choice only confused people. The value stays valid so older clients can still write it, the planner treats it as auto, a migration rewrote stored values to auto, and clients no longer offer it."
     },
     {
       "key": "playback.max_bitrate_kbps",
@@ -510,6 +510,56 @@
       "recommended_control": "select",
       "notes": "The bitrate axis, orthogonal to playback.preferred_quality. Splitting them is what the clients were already doing: the in-player switcher sends resolution and bitrate as separate fields, and downloads (DownloadQuality in silo-android) dropped resolution entirely and kept only a bitrate ladder. Two values rather than one compound enum means a client can offer \"1080p High\" without the server having to agree on what \"High\" means — retuning a preset is a client release, not a contract break, and it stays additive under the widening rule. null is uncapped, which is why this is nullable rather than defaulting to a large number: absent and \"as much as you like\" are the same statement, and a numeric sentinel would have to be widened every time hardware improves. The bounds are deliberately loose — 100 kbps is below any watchable stream and 200 Mbps is above any remux — because this caps a preference, not a policy; entitlement limits live in internal/policy. Migration decomposes the legacy compound values: 1080p-high becomes (1080p, 10000), 720p-medium becomes (720p, 3000), 420p becomes (480p, 720), following the bitrates in web/src/player/hooks/useTranscodeQuality.ts, so no stored preference is lost to the rejects table."
     },
+    {
+      "key": "playback.cellular_preferred_quality",
+      "introduced_in": 20,
+      "persistence": "remote",
+      "allowed_scopes": ["profile", "profile_device"],
+      "resolution_order": ["profile_device", "profile", "default"],
+      "value_schema": {
+        "type": "enum",
+        "ordered": true,
+        "values": [
+          { "value": "auto", "label": "Auto" },
+          { "value": "480p", "label": "480p" },
+          { "value": "720p", "label": "720p" },
+          { "value": "1080p", "label": "1080p" },
+          { "value": "2160p", "label": "2160p / 4K" }
+        ]
+      },
+      "default_value": "720p",
+      "constrained_by": {
+        "policy_input": "max_playback_quality",
+        "constraint": "ceiling"
+      },
+      "platforms": ["ios", "android", "web"],
+      "category": "playback",
+      "label": "Cellular quality",
+      "description": "The resolution to play at on mobile data or another metered connection.",
+      "recommended_control": "select",
+      "notes": "The resolution axis that replaces playback.preferred_quality while the device is on mobile data or a connection the OS marks metered or expensive (a phone hotspot, Android metered Wi-Fi, iOS Low Data Mode). Clients detect the connection and send this pair as quality_preference and bandwidth_cap_kbps; the web app does so when the browser reports Data Saver or a cellular connection; the server never sees which network the device is on, which is why metered on the playback request is ignored. When the connection changes mid-playback the client replans with the other pair. Clients show the pair as one preset list, since bitrate is what matters on a data plan. The members match playback.preferred_quality without the deprecated original."
+    },
+    {
+      "key": "playback.cellular_max_bitrate_kbps",
+      "introduced_in": 20,
+      "persistence": "remote",
+      "allowed_scopes": ["profile", "profile_device"],
+      "resolution_order": ["profile_device", "profile", "default"],
+      "value_schema": {
+        "type": "integer",
+        "nullable": true,
+        "minimum": 100,
+        "maximum": 200000
+      },
+      "default_value": 2000,
+      "unit": "kbps",
+      "platforms": ["ios", "android", "web"],
+      "category": "playback",
+      "label": "Cellular maximum bitrate",
+      "description": "Cap how much data playback may use on mobile data or another metered connection.",
+      "recommended_control": "select",
+      "notes": "The bitrate axis paired with playback.cellular_preferred_quality, with the same bounds and null-is-uncapped meaning as playback.max_bitrate_kbps. The 2000 kbps default matches the 720p preset the clients already offer."
+    },
     {
       "key": "playback.auto_skip_intro",
       "introduced_in": 1,
@@ -796,16 +846,17 @@
       "key": "player.subtitle_sync_ms",
       "introduced_in": 1,
       "persistence": "remote",
-      "allowed_scopes": ["profile_device"],
-      "resolution_order": ["profile_device", "default"],
+      "allowed_scopes": [{ "scope": "profile", "introduced_in": 19 }, "profile_device"],
+      "resolution_order": ["profile_device", "profile", "default"],
       "value_schema": { "type": "integer", "minimum": -10000, "maximum": 10000 },
       "default_value": 0,
       "unit": "milliseconds",
-      "platforms": ["ios", "tvos", "macos", "android", "android_tv"],
+      "platforms": ["web", "ios", "tvos", "macos", "android", "android_tv"],
       "category": "player",
       "label": "Subtitle sync offset",
-      "description": "Shift subtitles earlier or later on this device.",
-      "recommended_control": "slider"
+      "description": "Shift subtitles earlier or later for this profile. A device can keep its own offset.",
+      "recommended_control": "slider",
+      "notes": "Revision 19 adds the profile scope, so the offset follows the profile to every device like the other subtitle display settings, and adds the web client. A device value still wins on that device. Clients write the profile scope only when the server reports manifest revision 19 or later; older servers reject it."
     },
     {
       "key": "player.video_gravity",
@@ -1233,6 +1284,20 @@
       "recommended_control": "select",
       "notes": "Registered from the legacy unprefixed key next_up_mode. The server reads it directly when assembling home sections, so it cannot be client-local; that read moves to the canonical resolver at cutover. The legacy value was untyped and absent meant combined, which is why combined is the default rather than a third \"unset\" member."
     },
+    {
+      "key": "ui.next_up_new_releases_first",
+      "introduced_in": 18,
+      "persistence": "remote",
+      "allowed_scopes": ["profile"],
+      "resolution_order": ["profile", "default"],
+      "value_schema": { "type": "boolean" },
+      "default_value": false,
+      "category": "navigation",
+      "label": "Show new episodes first",
+      "description": "Move a show you've caught up on to the front of Continue Watching and Next Up when a new episode or season arrives.",
+      "recommended_control": "switch",
+      "notes": "The server applies it when ordering next-up rows (Home Continue Watching, the separate Next Up row, and Jellyfin /Shows/NextUp), so it cannot be client-local. An episode counts as new when the availability detector recorded it as a release: it arrived after its library's first full scan and its file is new (episode_availability.released_at). Profile scope so the order follows the viewer across devices; default false keeps the last-watched order a profile has always had."
+    },
     {
       "key": "nav.primary_menu",
       "introduced_in": 5,
diff --git a/deploy/observability/prometheus.yml b/deploy/observability/prometheus.yml
index 7c3abcb67f..fed80d8713 100644
--- a/deploy/observability/prometheus.yml
+++ b/deploy/observability/prometheus.yml
@@ -1,4 +1,11 @@
 # Replace targets with private main/worker listener addresses. Never add the debug port.
+# The main server answers /metrics with 404 on its application port; it serves
+# metrics only on the separate PRAIRIE_METRICS_LISTEN listener. Bind that listener to
+# a private address Prometheus can reach (for example PRAIRIE_METRICS_LISTEN=0.0.0.0:9091
+# on an internal network). 127.0.0.1 inside the Prairie container is not reachable
+# from a separate Prometheus container.
+# Proxy and transcode nodes serve /metrics on their application listener;
+# PRAIRIE_METRICS_LISTEN has no effect on them.
 global:
   scrape_interval: 15s
   evaluation_interval: 15s
@@ -10,7 +17,7 @@ scrape_configs:
     scrape_timeout: 10s
     sample_limit: 20000
     static_configs:
-      - targets: [silo-api:8080]
+      - targets: [prairie-api:9091]
         labels:
           cluster: example
           process_role: api
diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml
index 45e4d10235..9fc7da8b09 100644
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@@ -127,6 +127,7 @@ services:
       - prairie-dev-artwork:/var/lib/prairie/artwork
       - prairie-dev-compat:/var/lib/prairie/compat
       - prairie-dev-transcode:/tmp/silo-transcode
+      - prairie-dev-download-artifacts:/tmp/silo-download-artifacts
       - ${MEDIA_ROOT:-/tmp/prairie-dev-media}:${MEDIA_CONTAINER_ROOT:-/mnt/media}:ro
     depends_on:
       postgres:
@@ -173,6 +174,7 @@ services:
 volumes:
   prairie-dev-air-tmp:
   prairie-dev-compat:
+  prairie-dev-download-artifacts:
   prairie-dev-go-build:
   prairie-dev-go-mod:
   prairie-dev-plugins:
diff --git a/docker-compose.yml b/docker-compose.yml
index cbf11c0c6b..0cd367ef62 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -87,6 +87,14 @@ services:
       - ${PRAIRIE_DATA_ROOT:-/opt/prairie}/artwork:/var/lib/prairie/artwork
       - ${PRAIRIE_DATA_ROOT:-/opt/prairie}/compat:/var/lib/prairie/compat
       - ${PRAIRIE_DATA_ROOT:-/opt/prairie}/transcode:/tmp/silo-transcode
+      # Prepared downloads. With "Prepared file directory" (download.artifact_dir)
+      # blank, Prairie keeps them beside the transcode directory, not inside it, so
+      # they need their own mount to survive image updates. This path assumes the
+      # default playback.transcode_dir; with another one, mount the
+      # silo-download-artifacts directory beside it instead. No storage
+      # budget applies until one is set ("Default storage budget per location",
+      # download.artifact_max_bytes, in Settings > Downloads).
+      - ${PRAIRIE_DATA_ROOT:-/opt/prairie}/download-artifacts:/tmp/silo-download-artifacts
       - ${PRAIRIE_DATA_ROOT:-/opt/prairie}/catalog-seeds:/catalog-seeds:ro
       - ${PRAIRIE_DATA_ROOT:-/opt/prairie}/audiobook-covers:/var/lib/prairie/audiobook-covers
       # Only load-bearing when the Docker host is itself an LXC container, where
diff --git a/docs/admin-api.md b/docs/admin-api.md
index ee32f94612..8053fea8d2 100644
--- a/docs/admin-api.md
+++ b/docs/admin-api.md
@@ -264,7 +264,7 @@ configuration, last health result, and last stored hardware inventory. See
 | `drain_state` | string | What the node reported on its last health check: `none`, `draining` (after a drain request or SIGTERM, while it finishes its work) or `drained` (nothing left; safe to stop). `none` for a proxy, a node that predates draining, and a node that did not answer. |
 | `active_jobs`, `egress_kbps` | int | Last health-reported load. `egress_kbps` is a rolling average and is currently non-zero for proxy nodes only. |
 | `group` | string \| null | Co-location group. A group is only eligible while every enabled member is healthy. |
-| `max_jobs`, `max_bandwidth_kbps` | int \| null | Capacity caps. `null` means unlimited. |
+| `max_jobs`, `max_bandwidth_kbps` | int \| null | Capacity caps. `null` means unlimited. `max_jobs` limits streams and file downloads on a proxy and transcodes on a transcode node. `max_bandwidth_kbps` limits a proxy's egress, and a proxy with it set takes no file downloads, because a download's rate is unknown and cannot be reserved; it is stored for a transcode node but not enforced, because a transcode node's output leaves through a proxy or the API server. |
 | `last_health_check` | RFC3339 string \| null | When the node was last checked. |
 | `created_at` | RFC3339 string | When the node was registered. |
 | `capabilities` | object | The node's last stored capability report — the same body `GET /hw-capabilities` returns on the node. Omitted until one has been stored. |
@@ -418,7 +418,7 @@ Each entry in `disks`:
 
 | Field | Type | Meaning |
 |---|---|---|
-| `path` | string | Where the mount is. Absent from a node's `last_stats`: the node reports it on its own bearer-authed `/status`, and the API host reports its own on `GET /admin/system/resources`, but a node's `/health` takes no credential and withholds it. Use `role`. |
+| `path` | string | Where the mount is. Absent from a node's `last_stats`: the node reports it on its own `/status`, which needs a [signed request](architecture/worker-http-protocol.md#authentication), and the API host reports its own on `GET /admin/system/resources`, but a node's `/health` takes no credential and withholds it. Use `role`. |
 | `role` | string | What the mount is for: `scratch`, or `library-N` positionally per media root. Assigned when the sample is built, so it names the same mount on `/health`, `/status`, `/admin/system/resources` and the `streamapp_node_disk_*` series, and it stays with the mount even when a probe cannot measure it. |
 | `used_gb`, `total_gb` | float | Capacity in GiB. `used_gb` counts filesystem-reserved blocks, as `df` does. `total_gb` is the capacity usable by the node process — used plus still-available — so it reads lower than the device's nameplate size on a volume that reserves blocks for root, and `used_gb`/`total_gb` is the ratio `df` prints as Use%. |
 | `stale` | bool | The numbers are real but carried over from an earlier pass because the current probe has not returned — the normal reading for a network mount whose server went away. Omitted when false. |
@@ -763,7 +763,7 @@ this route can legitimately outlive the API listener's ordinary 120-second
 as a hung request. This re-probes only — it does not reload configuration or tear
 anything down.
 
-Under the hood this is a bearer-authenticated `POST
+Under the hood this is a [signed](architecture/worker-http-protocol.md#authentication) `POST
 /admin/reprobe-capabilities` on the node's own listener, which both transcode
 nodes and proxy nodes serve. That route is internal to the cluster and is not
 part of any client contract.
@@ -1041,6 +1041,7 @@ client tells "this deployment is older than my build" from "the request failed".
 | `log_level_list` | `GET /admin/logs/app` accepts a multi-level filter. |
 | `watch_providers` | `GET /admin/stats` carries the per-provider `watch_providers` array. |
 | `downloads_stats` | `GET /admin/stats/downloads` serves the offline-download aggregate, and timeseries points carry the additive `download_egress_kbps` split. |
+| `egress_totals` | `GET /admin/stats/timeseries` carries the window's additive `egress_bytes` and `download_egress_bytes` totals. |
 
 ```json
 {
@@ -1051,7 +1052,8 @@ client tells "this deployment is older than my build" from "the request failed".
   "health": true,
   "log_level_list": true,
   "watch_providers": true,
-  "downloads_stats": true
+  "downloads_stats": true,
+  "egress_totals": true
 }
 ```
 
@@ -1079,7 +1081,7 @@ Each entry:
 
 | Field | Type | Meaning |
 |---|---|---|
-| `provider` | string | Provider key: `trakt`, `simkl`, or `mdblist` for the first-party plugins, otherwise `plugin:<installation id>:<capability id>`. |
+| `provider` | string | Provider key: `simkl` or `mdblist` for the first-party plugins, otherwise `plugin:<installation id>:<capability id>`. |
 | `display_name` | string | Human name from the registry, or the key when the provider is not registered. |
 | `registered` | bool | False when the provider only exists in stored rows. |
 | `scrobbling` | bool | The provider declares the scrobble-playback capability. |
@@ -1125,8 +1127,8 @@ Each entry:
       "scrobbles_24h": 0
     },
     {
-      "provider": "trakt",
-      "display_name": "Trakt",
+      "provider": "simkl",
+      "display_name": "Simkl",
       "registered": true,
       "scrobbling": true,
       "exporting": true,
@@ -1186,6 +1188,12 @@ an average: these charts are read to answer "how bad did it get", and a mean
 would erase exactly that. Stream counts and egress are maxed independently, so
 a bucket's columns may come from different minutes within it.
 
+`egress_bytes` and `download_egress_bytes` are the data served over the whole
+window, integrated from every sampled minute rather than from `points` — summing
+the peak-per-bucket points would count a one-minute spike as if it lasted the
+whole bucket. Unsampled minutes contribute nothing and node egress is a rolling
+average, so treat the totals as a close estimate, not byte-exact accounting.
+
 Each minute holds up to two kinds of row. The `shared` row is the cluster-wide
 snapshot: stream counts by play method, plus the egress reported by enabled,
 healthy stream nodes. Every replica tries to write it and the first one to land
@@ -1228,6 +1236,8 @@ fresh install renders "collecting data" instead of an empty chart.
   "from": "2026-08-25T12:00:00Z",
   "to": "2026-08-26T12:00:00Z",
   "oldest_sample_at": "2026-08-24T09:31:00Z",
+  "egress_bytes": 412500000000,
+  "download_egress_bytes": 37800000000,
   "points": [
     {
       "t": "2026-08-26T11:55:00Z",
@@ -2171,8 +2181,10 @@ prospective combined values. Single-key validation preserves the existing paired
 setting repair behavior. Empty values retain the established clear/default rules.
 
 Both writes are nonretryable. Enabling diagnostics can probe storage before the
-transaction, and runtime notifications after commit are not durable command
-receipts. A lost response does not establish whether the update committed. The
+transaction, a change to the Redis connection connects to Redis before it (see
+[Saving the Redis connection](admin-settings-api.md#saving-the-redis-connection)),
+and runtime notifications after commit are not durable command receipts. A
+lost response does not establish whether the update committed. The
 web captures the displayed validator, copied values and acting profile before an
 offline pause, does not refresh/replay a failed mutation, and keeps dirty edits on
 the original baseline across background reads and 412 responses. Changing acting
@@ -2211,12 +2223,12 @@ invalidates the exact compatibility status scope only for the active authority.
 
 ### Dashboard capability discovery in v2
 
-`GET /api/v2/admin/dashboard/capabilities` returns the eight dashboard support
+`GET /api/v2/admin/dashboard/capabilities` returns the nine dashboard support
 flags to an acting administrator. These describe the v2 surface in the API build;
 they do not promise that a database or other runtime dependency is healthy.
 
-`timeseries`, `playback_activity`, `top_activity`, `health`, `watch_providers` and
-`downloads_stats` are true for the existing v2 dashboard operations.
+`timeseries`, `playback_activity`, `top_activity`, `health`, `watch_providers`,
+`downloads_stats` and `egress_totals` are true for the existing v2 dashboard operations.
 `server_layouts` remains false while the v2 layout lifecycle is unavailable.
 `log_level_list` is true for the accepted multi-level application-log reader. Clients
 must not infer v2 support from the bridge's independently retained capabilities.
@@ -2258,7 +2270,8 @@ the handshake is served on this process, the protocol (`prairie.admin-logs.v2`)
 selections (`app`, `audit`). `POST /api/v2/admin/logs/ws-ticket` (`createAdminLogsSocketTicket`)
 delegates the acting administrator's current access-token login session for one connection.
 API keys and credentials without a bounded expiry cannot mint; a login whose effective role is
-not administrator (a secondary profile on an administrator account) is refused with 403. The
+not administrator (a secondary profile on an administrator account, or a profile-less session
+on a household with a PIN-protected or access-limited profile) is refused with 403. The
 ticket is opaque, single-use, expires within 30 seconds and binds the account, login session,
 role, profile proof and resolved access scope. The response carries `ticket`, `expires_in`,
 `max_connection_seconds` (300) and `protocol`, is not cached, and minting is naturally
@@ -2276,7 +2289,8 @@ proof and administrator role are validated again before 101.
 
 The connection ends at the earlier of five minutes or access-token expiry, and the handler
 rechecks session, account, profile and administrator role every 15 seconds with a two-second
-bound; a failed check or a demotion closes the socket. Reconnect with a newly minted credential;
+bound; a failed check or a demotion closes the socket, including once the household of a
+profile-less session gains a PIN-protected or access-limited profile. Reconnect with a newly minted credential;
 this is bounded revocation detection, not instantaneous. Without Redis the ticket is
 process-local and requires affinity to the minting node.
 
@@ -2760,7 +2774,9 @@ started from. Otherwise it skips the
 write without an error, leaves `last_run_at` and `last_error` as they were (so the next
 cycle polls the new upstream without waiting for the interval), records its starting
 marker as the event's `marker_after` with a note that the marker was not stored, and
-the next poll starts from the reset marker.
+the next poll starts from the reset marker. A poll that fails after such a reset
+likewise leaves `last_error` and `last_run_at` as the reset left them; its error is
+recorded only on the poll's event, with a note that it was not stored on the source.
 
 Configuration keys/values, connection and label are normalized as in the bridge.
 Webhook mode is restricted to the built-in identity, with auto/sonarr/radarr provider
@@ -3034,7 +3050,12 @@ by `id`. Both listeners share one projection: global configuration values contai
 public fields the manifest declares and list configured secret names in
 `configured_secrets`; a configuration whose schema is missing from the manifest is projected
 empty. The reserved built-in host row is excluded and a projection that contains it is an
-internal error. Timestamps are RFC 3339 UTC milliseconds.
+internal error. Timestamps are RFC 3339 UTC milliseconds. In every plugin view that lists
+capabilities (installations, catalog entries, and the install, upload and update responses), a
+`request_router.v1` capability carries `request_router`, whose `api_key_optional` and
+`base_url_optional` say which request server fields its plugin can do without; both are false
+when the plugin declares neither. For an installation they come from the capability stored at
+install or update, which is what routing reads.
 
 Both reads require an acting administrator and answer 503 when the
 plugin service or stores are not wired. The web plugins page and admin sidebar read these
@@ -3080,7 +3101,8 @@ version in place.
 
 `POST /api/v2/admin/plugins/installations/{id}/restart` stops the installation's process
 and, for a resident plugin, starts it again with a fresh failure budget; a non-resident plugin
-is only stopped and launches on its next use. A disabled installation is 409. Success is 200
+is only stopped, its recorded start failure is cleared, and it launches on its next use. A
+disabled installation is 409. Success is 200
 with the installation, whose `runtime` reports the outcome, including a launch that failed.
 Repeating the request converges on one running process, so it is naturally idempotent.
 
@@ -3090,7 +3112,9 @@ exponential backoff from 1 s to 60 s, and is parked as `failed` after ten consec
 failures until restarted or reconfigured), `state` (`stopped`, `starting`, `running`,
 `backoff`, `failed`), `restart_count`, `last_error`, `last_started_at` and `next_restart_at`.
 Plugins declaring `network_access_provider.v1` are resident; every other plugin starts on
-first use and reports only `running` or `stopped`.
+first use and reports `running`, `stopped`, or `failed` when its last launch on the answering
+server failed, with `last_error` saying why. A later successful launch, an administrator
+restart, an update or a configuration change clears that failure.
 
 `DELETE /api/v2/admin/plugins/installations/{id}` stops the plugin, deletes the row
 (configuration, bindings and archives cascade) and removes its files; on a failed row delete
@@ -3152,6 +3176,8 @@ automatically. A revision precondition (`If-Match`) is a follow-up, not part of
 `POST /api/v2/admin/plugins/installations/{id}/config/test` probes one prospective entry:
 the server starts a temporary plugin instance with the merged configuration, runs the
 plugin's connection check under a 20 s timeout, and stops the instance. Nothing is stored.
+A metadata provider is checked with a movie search; a marker provider is asked for its
+account statistics, which need the staged credentials.
 A completed failed check, including a plugin without connection-check support, is a 200
 result with `success` false and the message; only transport or store failures are problems.
 The probe launches a process and may call a billed provider, so it is non-retryable: the
diff --git a/docs/admin-catalog-api.md b/docs/admin-catalog-api.md
index 218ea47fcc..27a115f423 100644
--- a/docs/admin-catalog-api.md
+++ b/docs/admin-catalog-api.md
@@ -67,7 +67,13 @@ field errors that explain the affected source roots.
 
 Direct import runs the existing catalog transaction and returns its committed
 counts. If a response is lost, callers must inspect the catalog before deciding
-whether to submit again. The web explicitly offers background execution or
+whether to submit again.
+
+Import keeps a bundle's embeddings only when they come from this installation's
+embedding model: the model in the recommendations embedding lock, or the
+configured embedding model when nothing is locked yet. `embeddings_skipped`
+counts the others; the embedding backfill embeds those items with the local
+model. Import never writes the embedding lock. The web explicitly offers background execution or
 "Import and wait"; it does not fall back between them after an error. All transfer
 mutations disable automatic mutation and authentication retries.
 
@@ -178,12 +184,19 @@ is checked by the same permission middleware used by the frozen v1 routes.
 | `POST /api/v2/admin/items/{id}/metadata-translation/jobs/{job_id}/cancel` | Empty `204` after a cancellation request |
 
 Enqueue accepts `target_language`, optional `include_children`, and optional
-`force`. Children default to included for item targets; season and episode
-targets never include children. The requesting account is recorded by the
-service. A matching active job can be reused; otherwise the service persists
-and dispatches a job. `Location` identifies the item's recent-job listing.
-Success does not mean translation has completed. The existing metadata AI
-capability endpoint describes whether the translation provider is configured.
+`force`. A job fills only fields with no localized text; `force` also replaces
+text an earlier AI translation wrote. Provider and manual text is never
+replaced, and the repository enforces the same rule on every AI write.
+Children default to included for item targets; season and episode targets
+never include children, and neither do movies. The requesting account is
+recorded by the service. When a pending or running job for the same target
+and language already covers the request (it includes children whenever the
+request does, and is forced whenever the request is), the service returns that
+job, so its `include_children` and `force` can differ from the request;
+otherwise the service persists and dispatches a job. `Location` identifies the
+item's recent-job listing. Success does not mean translation has completed.
+The existing metadata AI capability endpoint describes whether the translation
+provider is configured.
 
 Job IDs use opaque strings and timestamps use UTC millisecond instants. The web
 polls while jobs are pending or running. Cancellation checks that the job belongs
@@ -195,6 +208,36 @@ Enqueue and cancellation have no durable request replay receipt. The web enqueue
 mutation disables both mutation retries and authentication replay. No existing
 web cancel control, native administrator caller, or Jellyfin equivalent exists.
 
+### Library prewarm
+
+A server administrator can fill a whole library's missing translations ahead
+of browsing. These routes require the acting-administrator role, not the
+per-item curation permission.
+
+| Endpoint | Result |
+| --- | --- |
+| `POST /api/v2/admin/libraries/{library_id}/metadata-translation` | `202` with the canonical translation job |
+| `GET /api/v2/admin/libraries/{library_id}/metadata-translation/jobs` | `jobs`: the newest 50 prewarm jobs of the library |
+| `POST /api/v2/admin/libraries/{library_id}/metadata-translation/jobs/{job_id}/cancel` | Empty `204` after a cancellation request |
+
+Enqueue accepts only `target_language`. The job's `target_kind` is `library`
+and its `content_id` is `library:{library_id}`. It walks the library's items that still
+miss an overview, tagline, season overview, or episode overview in that
+language, in title order, and translates each item with its seasons and
+episodes. Items already in that language are skipped. A prewarm never forces:
+provider, manual, and earlier AI text is kept. `fields_done` and `fields_total`
+count items, and `progress_message` names the current one.
+
+One prewarm translates one item at a time on a slot of the shared AI job
+bound, and gives the slot back between items so queued on-view and subtitle
+jobs run in the meantime. An item that fails is skipped and named in the
+server log; three failures in a row stop the job, since then the provider
+itself is failing. Translated items stay. Re-running after a failure, a cancellation, or a
+restart resumes with whatever is still missing. An active prewarm for the same
+library and language is reused. Enqueue and list answer `404` for an unknown
+library; cancel finds the job by `library:{library_id}` alone, so a job of a
+library deleted while it ran can still be stopped.
+
 ## Item metadata edits and refresh
 
 `POST /api/v2/admin/items/{id}/refresh-metadata` accepts `mode: "quick"` (the
@@ -485,8 +528,10 @@ array. No current web, native or Jellyfin consumer needs migration for this rout
 
 `GET /api/v2/admin/items/{id}/images` requires acting-admin access and returns
 `items`, `page`, `current`, and optional `provider_errors`. Pages default to 50
-choices and accept `limit` 1–200. Choice metadata determines a stable order;
-continuation binds the content ID, authority, limit and complete choice digest.
+choices and accept `limit` 1–200. On movie and series lists, local sidecar
+choices come first, in discovery order. Provider choices follow by rating,
+highest first; choice metadata breaks ties, so the order is stable.
+Continuation binds the content ID, authority, limit and complete choice digest.
 Expiring display URLs are excluded from that digest. A provider choice change
 returns `invalid_cursor` and requires reloading. Each page fetches and resolves
 the provider list again; pagination bounds response size, not provider work or
@@ -494,11 +539,30 @@ memory, and stores no server-side snapshot. Provider failures expose generic
 messages. The web drains all pages under one captured authority and refuses
 repeated or invalid continuation rather than publishing a partial list.
 
+For a movie or series the list also offers its local sidecar artwork (the
+`poster.jpg`, `fanart.jpg` and similar files a refresh would use), found by
+Prairie's own sidecar discovery whether or not the library's metadata chain uses
+the NFO provider. A `file://` URL from any other provider is not offered. These
+choices have `provider_id` `local`, a `file://` `original_url`, and a small
+WebP preview as a `data:` URI in `url`. A file that cannot be read under the
+library-root, symlink and size checks is left out, and `provider_errors`
+reports the failure under `local`. Banner, thumb, clear art and disc art
+sidecars, and image URLs an NFO names, are not offered. When the library's
+provider chain cannot be resolved, the movie or series list still returns `200`
+with its local choices and reports the failure under `chain` in
+`provider_errors`; other lists return `500`. Frozen v1 lists provider choices
+only. See
+[Local NFO metadata](architecture/local-nfo-metadata.md#admin-image-picker).
+
 `POST /api/v2/admin/items/{id}/images/apply` accepts `original_url`, `type`, and
 optional `provider_id`. An HTTP(S) `original_url` may name a public or
 local-network address; link-local, cloud metadata and other blocked addresses
 are refused (see
-[Outbound address guard](architecture/outbound-address-guard.md#artwork-downloads)).
+[Outbound address guard](architecture/outbound-address-guard.md#artwork-downloads)). A `file://`
+`original_url` is accepted for a movie or series only when the item's sidecar
+discovery offers that file for that image type; anything else returns a `422`
+validation problem. A failure to read or cache an offered file returns `500`.
+Frozen v1 does not accept local files.
 It preserves target validation before remote work,
 episode-to-still coercion, parent/season/episode cache identity, immutable upload,
 transactional catalog publication and orphan-GC scheduling after publication
diff --git a/docs/admin-recommendations-api.md b/docs/admin-recommendations-api.md
index 81ce7dc846..442698ccea 100644
--- a/docs/admin-recommendations-api.md
+++ b/docs/admin-recommendations-api.md
@@ -1,16 +1,19 @@
 # Recommendation administration API
 
-Recommendation administration uses acting-administrator authorization. All five
+Recommendation administration uses acting-administrator authorization. All six
 routes remain registered when the recommendation worker is absent and return
 `503` until it is available. The frozen v1 handlers remain unchanged.
 
 | Endpoint | Result |
 | --- | --- |
-| `GET /api/v2/admin/recommendations/status` | Counts and running flags for four job kinds |
+| `GET /api/v2/admin/recommendations/status` | Counts, last runs, running flags, lock conflict and cache refresh time |
 | `POST /api/v2/admin/recommendations/trigger/embeddings` | `200` with `status: "started"` |
 | `POST /api/v2/admin/recommendations/trigger/taste-profiles` | `200` with `status: "started"` |
 | `POST /api/v2/admin/recommendations/trigger/cowatch` | `200` with `status: "started"` |
 | `POST /api/v2/admin/recommendations/trigger/recommendations` | `200` with `status: "started"` |
+| `POST /api/v2/admin/recommendations/embeddings/reset` | `200` with the number of rows deleted |
+
+## Status
 
 Status contains `embeddings`, `taste_profiles`, `cowatch`, and `recommendations`.
 Each has a `running` boolean and integer `count`; embeddings includes `total`
@@ -18,17 +21,88 @@ when nonzero. Counts come from persisted catalog/recommendation data. Running
 flags describe the responding process and are sampled separately from counts.
 They do not form a consistent cluster-wide snapshot.
 
-Trigger success means the existing worker claimed its process-local running flag
-and launched background work. It does not mean that work completed or that a
-job was persisted. There is no job ID, Location header, durable acceptance,
-cluster-wide exclusion, or automatic recovery promise. A duplicate trigger while
-the same kind is running in that process returns `409`. Another process may
-start the same kind independently; a restart loses the local running flag.
-
-All four triggers are non-retryable. The web disables both TanStack mutation
-retries and authentication refresh/replay for these actions, including after
-`401`. After an uncertain result, inspect status before deciding whether to
-trigger again. The status query continues to poll every five seconds.
+Each job also carries `last_run`, the newest finished full run (scheduled or
+triggered) recorded by any server, once one exists: `status` (`completed` or `failed`), `started_at`,
+`completed_at`, `error` on a failed run, and `result`, the counts the run
+reported. A run that finished with partial failures is `completed` and counts
+them in `result`; its keys differ by job and may grow. The error is the job's
+own message with credential assignments and URL user info masked. Runs that a
+busy job skipped are not recorded. `embeddings` and `recommendations` can also
+carry `last_partial_run`, in the same shape: the newest embedding catch-up
+pass, or the newest startup build of the global rows. Partial runs are
+recorded apart, so one that runs after a failed full run does not hide it.
+
+`stale_sweep` reports the sweep that rebuilds profiles after their signals or
+access change: `pending` counts the profiles waiting for a rebuild, and
+`last_run`, in the job run shape, is the newest sweep on any server that
+rebuilt or failed at least one profile. A profile whose rebuild keeps failing
+stays pending and shows as `failed` in each sweep's `result`.
+
+`lock_conflict` is empty unless the stored embedding lock rejects the
+embedding base URL or model this server runs with, or records a vector size
+Prairie cannot store. It is then a sentence for the administrator that never
+quotes a base URL. Embedding settings take effect after a restart, so a saved
+but not yet applied change does not show here; the embedding connection check
+reports it instead. `cache_refreshed_at` is when the newest cached
+recommendation row was written, by the cache job or a profile refresh; it is
+absent when nothing is cached. Profile refreshes keep it recent even while the
+cache job fails, so it does not show job health; `recommendations.last_run`
+does.
+
+## Triggers
+
+The embeddings kind also covers the catch-up pass, which every 15 minutes
+embeds items that have no embedding or one from another model: while it runs,
+an embeddings trigger answers `409`. Catch-up runs are reported as the
+embeddings `last_partial_run`, marked `missing_only: true` in `result`.
+Catch-up runs that found nothing to do are not recorded; failed ones are, so a
+lock conflict shows as a failed partial run every 15 minutes until it is
+resolved.
+
+Trigger success means the responding process claimed its running flag and the
+job kind's cluster-wide lock, then launched background work. It does not mean
+that work completed. There is no job ID, Location header, durable acceptance, or
+automatic recovery promise. A trigger returns `409` while the same kind is
+running in that process or on another server; the problem detail says which.
+Failing to take the lock returns `500`. Scheduled runs take the same lock, so
+each kind runs on one server at a time. A restart loses the local running flag
+and releases any lock the process held.
+
+## Embeddings reset
+
+The reset deletes the embedding lock, every item embedding, every taste
+cluster and every profile's cached rows, and clears every taste profile's
+vector, in one transaction. It answers with the counts (`embeddings`,
+`taste_clusters` and `cached_rows` deleted, `taste_profiles` cleared). Taste
+profile rows keep their signal counts, so they are rebuilt once the
+embedding job stores their titles' vectors again. It is the recovery path
+for a server whose lock pins a model it can no longer use, and the way to
+switch embedding models. Global rows (popular, recently added, top rated,
+genre samplers) and co-watch pairs do not use embeddings and stay.
+
+The reset runs synchronously while holding the embeddings, taste profile and
+recommendation jobs' claims and the stale profile sweep's lock, so none of
+them runs beside it on any server. It returns `409` while any of them is
+running and `500` when the transaction fails, which leaves every row in place.
+A profile refresh that was already running when the reset committed can still
+write one taste profile from the old embeddings; the profile's next refresh
+after re-embedding replaces it.
+
+Every item that lost its embedding gets a catalog search index update, so the
+next index syncs replace its stored vector with none. Semantic search stays
+off until the new model covers enough of the catalog again. The embedding
+catch-up pass starts re-embedding the catalog within 15 minutes, or run the embedding job
+after the reset; the next embedding writes a new lock for the configured model.
+
+## Clients
+
+The four triggers and the reset are non-retryable. The web disables both
+TanStack mutation retries and authentication refresh/replay for these actions,
+including after `401`. After an uncertain result, inspect status before
+deciding whether to trigger again. The status query continues to poll every
+five seconds. The web asks for confirmation before a reset and disables it
+while the embeddings, taste profile or recommendation job runs on the
+responding process.
 
 These existing administration flows have no Apple or Android callers and no
 Jellyfin compatibility equivalent. Viewer recommendation endpoints are separate.
diff --git a/docs/admin-settings-api.md b/docs/admin-settings-api.md
index b174d0a613..6133303fed 100644
--- a/docs/admin-settings-api.md
+++ b/docs/admin-settings-api.md
@@ -30,7 +30,10 @@ compatibility does not expose these administrator settings contracts.
 check against the submitted `values` and `dirty_keys`, merged with stored settings.
 Supported kinds are `s3_public`, `s3_operational`, `s3_private`, `redis`,
 `recommendations_embedding`, `ai_chat`, `ai_transcription`, `meilisearch`, and
-`mdblist`. Existing endpoint-change protection for stored AI credentials applies.
+`mdblist`. Stored AI and embedding credentials are sent only to the base URL
+they were saved for (same scheme, host and port): a draft that points
+`ai_chat`, `ai_transcription` or `recommendations_embedding` elsewhere is
+checked with the credential it submits in `values` and `dirty_keys`, or none.
 Provider failures return `success: false` with a generic message that excludes
 provider error bodies and credentials. Invalid kinds/configuration return `422`.
 
@@ -223,6 +226,35 @@ single-server URL and for a Sentinel URL. A change needs a restart.
   database. That includes a cleared URL, so a URL emptied and typed again keeps
   the number; a save that leaves no URL stores no number.
 
+### Saving the Redis connection
+
+A server that cannot connect to the Redis its stored settings name stops at its
+next start, and a stored value can then no longer be corrected in the admin UI.
+So a write that changes that connection first runs the check that
+`POST /api/v2/admin/settings/check/redis` runs, and stores nothing when it
+fails. The check connects, sends a `PING` and subscribes to the event bus
+channels on the database number, which a starting server needs. It gives up
+after 10 seconds, even for a URL that turns the socket timeouts off.
+
+- The connection changes when the write leaves a different `redis.url`, or a
+  different database number in use, than the stored settings. Both
+  writes and both API versions apply the check. A write that leaves the
+  connection as it is, clears `redis.url`, or runs in a process started with
+  `REDIS_URL` connects to nothing.
+- Connecting selects the database number, so a number the Redis server does
+  not have (16 or more on a Redis with the default 16 databases) fails the
+  same way an unreachable host does. So does a Redis user whose ACL does not
+  grant the channels (the pattern `&prairie:*`).
+- A failed connection answers a `422` validation problem on `/api/v2` and
+  `400 invalid_settings` on `/api/v1`. The detail says whether Redis refused
+  the connection, refused the channels, or could not be reached, or that
+  `redis.url` is not a URL the Redis clients can read (a bare `host:port` an
+  older build saved). It does not quote the client error, which can name hosts
+  and addresses; the server logs that error with credentials masked.
+- The connection is made before the settings transaction. If another write
+  changes the stored Redis settings in the meantime, the write is refused the
+  same way and can be sent again.
+
 ### HEVC encoding
 
 `playback.allow_hevc_encoding` is a boolean setting, default `false`. When
diff --git a/docs/admin-tasks-api.md b/docs/admin-tasks-api.md
index f895a3660e..c3dc351954 100644
--- a/docs/admin-tasks-api.md
+++ b/docs/admin-tasks-api.md
@@ -130,11 +130,19 @@ documents for this job type.
 
 The existing `POST /api/v2/library-jobs/{job_id}/cancel` contract remains intact.
 `POST /api/v2/admin/jobs/{id}/cancel` (`cancelAdminJob`) requests cancellation
-for storage-transition jobs. Library refresh cancellation uses its separate
-library-job endpoint above. Cancellation retains completed effects and verified
-storage-copy checkpoints. An accepted cancellation returns `202`; an already
-canceled job returns `200`; a succeeded or failed job returns
-`409 job_not_cancelable`. A queued storage-transition cancellation also releases
-its staged target so a later transition can choose a different destination. The
-administrator task section does not add a generic durable scheduler or change
+for storage-transition and image cache cleanup jobs. Library refresh
+cancellation uses its separate library-job endpoint above. Cancellation retains
+completed effects and verified storage-copy checkpoints. An accepted
+cancellation returns `202`; an already canceled job returns `200`; a succeeded
+or failed job returns `409 job_not_cancelable`. A queued storage-transition
+cancellation also releases its staged target so a later transition can choose a
+different destination. A queued image cache cleanup, including one waiting
+between slices, is canceled at once and returns `200`. A running cleanup stops
+at the prefix it is deleting, so the cancel can take partial effect: cached
+images already deleted stay deleted and any not yet deleted remain in storage.
+The canceled job reports the totals it reached in `library_result`:
+`deleted_prefixes` counts fully deleted prefixes and `deleted_s3_objects` counts
+every deleted object, including any from the prefix the cancel interrupted. A
+cleanup canceled before it deleted anything reports zeros. The administrator
+task section does not add a generic durable scheduler or change
 the retention and dispatch guarantees of existing job owners.
diff --git a/docs/admin-users-api.md b/docs/admin-users-api.md
index 1ae352e20b..81c1427a13 100644
--- a/docs/admin-users-api.md
+++ b/docs/admin-users-api.md
@@ -72,6 +72,21 @@ value; `0` explicitly allows unlimited bitrate. Both access-group fields
 default to `0`. Values are nonnegative integers in kbps. A policy edit changes
 new playback sessions, not streams already playing.
 
+`max_profiles` is the household profile limit and is a nullable account override
+as well. `null` inherits the access group's `max_profiles`, and a value of at least
+1 replaces it. An administrator or an account outside every group inherits 5, and
+an access group created without a value gets 5. `effective_policy.max_profiles` is
+the limit that profile creation enforces: an account at its limit gets
+`409 profile_limit_reached`, and profiles it already has above a lowered limit are
+kept. The bridge v1 body has no inherit state for this field, so its
+`max_profiles` reports the limit that applies. A v1 update stores an override,
+except that sending back the inherited limit an account reported leaves it
+inheriting, and an explicit `null` clears an override back to inherit, as with
+the other policy fields. The group's own limit is v2-only: the v1
+access-group body carries no `max_profiles`, so a group limit is set and read
+through the v2 access-group operations. `GET /api/v2/admin/users/capabilities` reports `profile_limits: true`
+when access groups and account overrides take `max_profiles`.
+
 `POST /api/v2/admin/users` returns 201 with `{ "id": "..." }` and `Location`.
 Default-profile creation, when requested, uses the existing transactional
 provisioner. Unsupported transactional profile storage fails before account
@@ -104,6 +119,21 @@ clients show where a default comes from without keeping their own copy. The
 values come from the server build. Account capabilities advertise
 `policy_defaults`. Existing `admin:users` keys may use this read.
 
+## Library lists
+
+An account's or access group's `library_ids` is `null` for every library and an
+array for exactly the listed ones, so `[]` allows none. Create and update return
+`422 validation_failed` at `body.library_ids` when the array names a library that
+does not exist; a guarded update checks its precondition first. Whichever API
+writes these lists, and the [invitation](invitations-api.md) lists too, the
+database keeps only libraries that exist, and a write racing a library delete
+waits for it as it would behind a foreign key.
+
+Deleting a library removes its ID from every account, access group and
+invitation in the same transaction. A list left with no IDs stays `[]` and never
+widens to `null`. The edited accounts and groups get new revisions, so an editor
+holding the old ETag gets 412 instead of writing the deleted library back.
+
 ## Passwords
 
 Account editor and list rows carry `password_login` and `password_change_required`.
diff --git a/docs/architecture/admin-settings-ux.md b/docs/architecture/admin-settings-ux.md
index 04a8153ee4..d83028c9ed 100644
--- a/docs/architecture/admin-settings-ux.md
+++ b/docs/architecture/admin-settings-ux.md
@@ -1,61 +1,130 @@
 # Admin settings UX
 
 Admin settings are organized by admin intent ("I want subtitles to download
-automatically"), not by subsystem. `/admin/settings` is the **Overview**:
-server health across the top and one live card per settings group. Fourteen
-standalone pages hang off it: General, Storage & Database, Appearance,
-Security & Access, Library & Metadata, Playback, Downloads, Requests,
-Subtitles & Metadata, Watch Providers, AI Services, Notifications,
-Compatibility, and Network Access. The
-global admin sidebar has one Settings destination; the Overview owns the
-settings information architecture. Old `?tab=` URLs and retired page ids from
-earlier layouts (including `integrations`, now split into Subtitles & Metadata,
-Watch Providers, and AI Services) redirect to the page that absorbed them
-rather than 404ing.
-`⌘K` (`AdminSectionCommandDialog`) is mounted in `AdminLayout` so search works
-from every admin page, not just the Dashboard.
+automatically"), not by subsystem, and they live in the admin sidebar beside
+the tools they configure. There is no separate settings area: the sidebar is
+one tree of sections and topics (`ADMIN_NAV_SECTIONS`,
+`web/src/lib/adminNavigation.ts`), and every admin page, tool or settings,
+appears in it exactly once.
+
+- **Monitor**: Dashboard, Activity, Logs (Server Log, Client Diagnostics,
+  Settings)
+- **Manage**: Libraries (Libraries, Collections, Home Sections, Subtitle
+  Files, Settings), Autoscan (Activity, Sources, Settings), Requests (Queue,
+  Settings), Users (Users, Access Groups, Devices, History Import), Playback
+  (History, Skip Markers, Nodes, Settings), Downloads (Prepared Files,
+  Settings)
+- **Configure**: Server (General, Appearance, Storage, Search, Network
+  Access, Scheduled Tasks, Maintenance), Sign-in & Security (Sign-in,
+  Security, API Keys, Policy), Integrations (Plugins, Providers, Email,
+  Notifications, AI Services, Recommendations, Compatibility)
+
+A topic that holds both tools and settings lists its own settings page last,
+as plain "Settings"; the topic already says whose. A topic's heading only
+opens and closes it (`SideNavTopic`); the topic holding the current page opens
+by itself, and the rest stay as the admin left them (`useAdminNavTopics`).
+
+Settings pages keep their own routes, `/admin/settings/:page`, and
+`ADMIN_SETTINGS_NAV` (`web/src/lib/adminSettingsSearch.ts`) remains their
+registry: id, label, description, and search index. The bare
+`/admin/settings` opens the first page. Old `?tab=` URLs and retired page ids
+from earlier layouts redirect to the page that absorbed them rather than
+404ing (`LEGACY_ADMIN_SETTINGS_PAGE_ALIASES`). `⌘K`
+(`AdminSectionCommandDialog`) is mounted in `AdminLayout`, and the search
+field at the top of the desktop admin sidebar opens it; it lists the
+sidebar's pages with each topic as its own group, so "Settings" always reads
+under its topic, and it finds every indexed setting.
+
+A setting lives on the page whose name covers it. Public signups and
+self-service password reset only work with Prairie passwords, so they sit with
+password sign-in on Sign-in. Logging holds every log setting, the server log
+and the activity log retention alike. General holds what the whole server runs
+on: its name and address, the trusted proxies beside the public URL (as the
+setup wizard presents them), the database pool, and Redis. Storage holds where
+files go, including whether provider artwork is copied there. Its bucket
+sections show for S3 and Automatic. Local disk keeps avatars, diagnostics, and
+catalog artifacts in the local path, so it hides both, keeping private storage
+only while a private bucket is saved, since that bucket then holds them.
+Picking S3 stages the backend so the buckets can be filled in, and Save opens
+any transition review the move needs. Search has its own page
+because the engine serves every library and client, not one library's
+metadata. Skip markers are a playback feature, so their detection settings
+are on Playback › Settings and the marker history is Playback › Skip Markers;
+subtitle sync stays on Libraries › Settings. Autoscan's polling defaults and
+saved server connections are its own Settings page; they are not `server_settings` rows, so that page keeps its
+own draft but saves through the same `SaveBar` and unsaved-changes prompt,
+while the switch that turns Autoscan on and Run now stay on Sources beside the
+sources they act on. The mail server has its own Email page, because invitations and
+password resets need it as much as notifications do. Node routing (which
+machine runs a remux or transcode and which serves the stream) is a section of
+the Nodes page with its own save bar, because it only means anything once
+nodes exist; its presets are the visible control and the five routes are the
+Advanced tier.
+
+What needs the admin (storage nobody configured, a restart a saved setting is
+waiting on, mail that cannot send) is derived by `useSettingsAttention`
+(`web/src/hooks/admin/useSettingsHealth.ts`) and listed once, as a "Needs
+attention" notice on the Dashboard, each item linking to the page that fixes
+it. The sidebar adds a dot only for what is broken (`warn`), on the page and on
+its topic while that is closed; setup the admin has not done yet stays on the
+Dashboard, so a server that deliberately runs without mail does not carry a
+dot forever. A healthy item is never shown. Hovering or focusing a settings
+page in the sidebar prefetches its code and values, so a click lands on a
+filled form rather than a skeleton.
+
+## User settings
+
+Personal settings (`/settings`) keep their own sidebar, because the app
+sidebar is for browsing. On desktop, opening settings swaps the app sidebar
+for the settings sidebar (`SettingsSidebar`, `web/src/components/settings/`)
+at the same width, so there is never a second navigation column. It holds a
+back link to the last page the app showed outside settings
+(`useSettingsReturnPath`), the current profile, search, and every page in its
+groups. The root redirects to the first page on desktop; on a phone it is the
+grouped list (`SettingsIndexList`). Crossing in or out is the one navigation
+that changes what the column holds, so its contents slide in from the side the
+reader is heading toward (`useSidebarSwap`), and the profile menu loads the
+settings code when it opens.
 
 ## Visual system
 
 One page is on screen at a time, and each thing on screen carries one signal.
-The admin settings detail view deliberately mirrors the user settings page
-(`SettingsLayout`): one `surface-panel-lg` shell with a `SideNavItem` rail on
-the left and the page content on the right, so the two settings surfaces read
-as the same product. The Overview stays the category directory: it explains
-each group's scope, and every category has its own `/admin/settings/:page`
-route. The rail (`SettingsPageRail`, rendered by the settings shell) lists
-every settings page with the open one marked; an All settings link above the
-shell leads back to the directory. The rail is desktop-only — on smaller
-screens the Overview is the directory, exactly as on the user side. The
-Overview shows a health tile only for a tile in `warn` or `off`. The
-**Setup & health** section explains that it holds recommendations and
-configuration problems; an empty checklist reads "No action needed" and
-names the conditions that will appear there. Below it is one card per
-settings group. Each card explains the group's scope and names the sections
-inside it. Live state stays in the health area instead of reducing a
-multi-provider group to one misleading summary.
-
-A category page opens with `SettingsPageHeader`: the title, and page actions
-if it has any. No breadcrumb, no lede, no status strip. Below it, settings
-are hairline-ruled rows inside `FieldGroup`s — thin wrappers over the shared
-`SettingsGroup` panel the user settings pages use — one panel per group,
-never per field. The Advanced tier stays inline as one disclosure row per
-group. A row can carry its `server_settings` key as a mono caption under the
-label (`SettingField`'s `settingKey`) so an admin can match the UI to the
-API and environment overrides, and a violet dot marks unsaved edits on the
-row and on the group heading (`dirty`, driven from `form.isDirty`). A
+
+Every admin page and every settings page, user or admin, opens with the
+shared `PageHeader` (`web/src/components/page/`): one title size at one
+position, a one-sentence subtitle, and page actions at the right. An admin
+settings page's subtitle is its description from the settings index, which
+`AdminSettingsLayout` provides to `SettingsPageHeader`. No breadcrumb and no
+status strip. Every admin page and every user settings page sits in one
+frame, `PageFrame`, which centers once the window is wider than it; pages
+carry no `page-shell` box of their own, so the title sits at the same place
+on every page. There are two widths inside the frame: settings pages cap their `PageColumn` at a
+reading width from its left edge, while tables and dashboards fill it. A section's title and
+description move into a left column only on a desktop-width window with room
+beside the sidebar, so resizing switches each section once. Below the header, settings are
+hairline-ruled rows inside `FieldGroup`s — thin wrappers over the shared
+`SettingsGroup` section the user settings pages use — one section per group,
+never per field. Sections are not cards: they sit on the page, divided by a
+hairline, and once the column is wide enough a section's title and
+description move into a left column beside its rows. Lists inside a section
+(providers, delivery channels) are rows too, not tiles. The Advanced tier
+stays inline as one disclosure row per group. Rows do not show their
+`server_settings` keys; the label and search identify a setting. A violet
+dot marks unsaved edits on the row and on the group heading (`dirty`,
+driven from `form.isDirty`). A
 description under a field label is the exception, not the rule: one short
 sentence, and only when the label alone is ambiguous. Units live beside the
 control (`SettingField`'s `unit`), not in the label. When every field in a
 group needs a restart, the group says so once (`FieldGroup restartAll`) and
-the fields inside drop their chips. Provider credentials are `ProviderTile`s
-that expand in place to Test before saving; their border is neutral in every
-state and the state is a dot plus a word in the header. Provider setup lives on
-a provider page (Subtitles & Metadata, Watch Providers), not on the page that
-owns the feature: Library & Metadata decides *whether* Silo looks for intro and
+the fields inside drop their chips. Provider credentials are `ProviderTile` rows
+that expand in place to Test before saving; the state is a dot plus a word
+beside the provider's button. Provider setup lives on
+the Providers page, not on the page that owns the
+feature: Playback decides *whether* Prairie looks for intro and
 credits markers, while *which provider answers, in what order, and on what
-terms* is a tile beside the subtitle and metadata providers, with a cross-link
-each way. A tile only reads "Connected" when the provider could actually serve
+terms* is a row beside the subtitle and list providers, with a cross-link
+each way. Watch providers (Simkl, MDBList) open the Providers page, since each
+profile connects its own account to them. A provider only reads "Connected" when the provider could actually serve
 a request — its configuration saved and the provider switched on — so an
 installed plugin whose API key was never entered reads "Needs setup". Request
 servers (Sonarr, Radarr) are the exception to the provider-page rule: they are
@@ -80,7 +149,11 @@ dismiss it.
 Every admin setting is one of:
 
 - **Essential** — shown by default, no disclosure needed. Target at most ~8
-  essential controls per page above the fold. A setting is Essential only if a
+  essential controls per page above the fold. Placement on transcode nodes
+  ("Generate … on", "Where to analyze audio") is Essential only while a
+  transcode node exists; otherwise it is Advanced, and a disclosure opens by
+  itself when a node-only choice has no node to run on, so its warning is
+  never folded away. A setting is Essential only if a
   household admin on a single-node install would plausibly need it without
   being told to look for it (on/off toggles for a whole feature, the handful
   of values that make the feature usable at all).
@@ -109,25 +182,28 @@ Reuse these instead of adding a bespoke variant per page:
   and `useSettingsForm` (`web/src/hooks/`) — the one save model. Every page
   batches edits and commits them through one `SaveBar` with Discard; provider
   credentials are the only exception, and only because they need
-  Test-before-commit, which is `ProviderTile` rather than a bespoke card per
+  Test-before-commit, which is `ProviderTile` rather than a bespoke row per
   provider.
 - `UnsavedChangesGuard` (`web/src/components/`) plus `useReportUnsavedChanges`
   (`web/src/hooks/useUnsavedChanges.ts`) — the one unsaved-edits prompt. A form
-  only reports that it is dirty; the settings shell mounts the guard once and
-  blocks router navigation (rail, back link, admin sidebar, browser back) with
-  a confirmation. `useSettingsForm` keeps a `beforeunload` listener for tab
+  only reports that it is dirty; the settings layout mounts the guard once and
+  blocks router navigation (the admin sidebar, browser back) with a
+  confirmation. `useSettingsForm` keeps a `beforeunload` listener for tab
   close and reload, which the router never sees. Blocking is `useBlocker`,
   which is why `App.tsx` mounts a data router (`createBrowserRouter` +
   `RouterProvider`) — a page must never grow its own prompt, its own blocker,
   or its own draft store.
-- `SettingsPageHeader` (`web/src/components/settings/`) — the one way a
-  section names itself. Live state belongs on the Overview, not repeated as a
-  strip on every page.
-- `SettingsPageRail` (`web/src/components/settings/`) — the one sibling nav,
-  rendered once by the settings shell from `ADMIN_SETTINGS_NAV` using the
-  shared `SideNavSection`/`SideNavItem` primitives. Pages never render their
-  own nav or add entries directly to the rail.
-- `SettingsGroup` (`web/src/components/settings/`) — the one settings panel,
+- `PageHeader`, `PageFrame`, and `PageColumn` (`web/src/components/page/`) —
+  the one page title, the one centered frame, and the one content column for
+  admin and settings pages;
+  `SettingsPageHeader` is the admin settings pages' way into it. Server health belongs in the Dashboard's attention
+  notice, not repeated as a strip on every page.
+- `SideNavSection`/`SideNavItem`/`SideNavTopic`/`SideNavSubItem`
+  (`web/src/components/SideNav.tsx`) — the admin sidebar's building blocks.
+  Pages never render their own nav; a new settings page is an entry in
+  `ADMIN_SETTINGS_NAV`, its component in `AdminSettingsLayout`, and its place
+  in `ADMIN_NAV_SECTIONS`.
+- `SettingsGroup` (`web/src/components/settings/`) — the one settings section,
   shared with the user settings pages; admin pages reach it through the
   `FieldGroup` wrapper, which layers on the restart-all line, the
   unsaved-edits dot, and the restart context.
diff --git a/docs/architecture/api-contract.md b/docs/architecture/api-contract.md
index ec56c06129..556f12b505 100644
--- a/docs/architecture/api-contract.md
+++ b/docs/architecture/api-contract.md
@@ -500,9 +500,9 @@ The foundation is `internal/apiv2`. These facts about it are not derivable from
   `Idempotency-Key` header under any other strategy: the strategy, its required header, and
   the durable replay store land together with the first operation the inventory proves
   needs them, and the field is never advertised unimplemented. Inventory answer: all 225
-  tier-1 ported mutation rows (219 distinct operations) are classified (97
+  tier-1 ported mutation rows (219 distinct operations) are classified (101
   `natural_idempotent`, 24 `unique_constraint`, 12 `domain_identity`, 9 `coalescing`, 3
-  `durable_dispatch`, 74 `non_retryable`, 0 `idempotency_key`, counted per distinct
+  `durable_dispatch`, 70 `non_retryable`, 0 `idempotency_key`, counted per distinct
   operation) and no residual group justifies a shared generic-key implementation. The `non_retryable` rows are a
   one-shot display or a secret shown once (invite-code top-up, admin session message,
   webhook rotate-secret, webhook test), a destructive command whose retry can hit state the
@@ -539,7 +539,7 @@ The foundation is `internal/apiv2`. These facts about it are not derivable from
   `non_retryable` until their durable identity and cleanup defects are fixed. Library creation,
   settings updates, stale-ID rematch, provider-chain replacement, and taste seeding also remain
   `non_retryable`: their current seams cannot resume dispatch after saving state, or
-  repeat unclaimed provider work. Their ledger notes retain the required durable repair. Forty-three rows (42 distinct operations)
+  repeat unclaimed provider work. Their ledger notes retain the required durable repair. Thirty-nine rows (38 distinct operations)
   carry a `DEFECT` note where v1 gates on
   process-local state, fires an external effect inline, lacks the dedup or ordering its
   identity implies, or re-runs a side effect a retry should not repeat (task run, collection
@@ -547,8 +547,8 @@ The foundation is `internal/apiv2`. These facts about it are not derivable from
   invite-code redemption during signup, playback route events,
   watch-together selection and promotion, metadata-match-queue retry, playback session
   progress, download status, ebook reader progress, and onboarding progress,
-  whose last-write-wins update lets a delayed retry rewind a newer report, favorites,
-  watchlist, and rating add and remove, the taste seed, subtitle download and upload,
+  whose last-write-wins update lets a delayed retry rewind a newer report, rating add
+  and remove, the taste seed, subtitle download and upload,
   whose unique key resolves a retry but whose losing insert deletes the winner's S3
   object, transcode start, which replaces a live session under the same id, and media
   request creation, whose partial unique index stops covering a request once it reaches a
@@ -1387,10 +1387,17 @@ paged with `limit` plus an opaque cursor whose cards are the shared `CatalogItem
 `{item_id, rating, rated_at}` entries instead), a membership read that answers the entry
 (`{item_id, added_at}`, or `{item_id, rating, rated_at}`) or `404`, a bodiless `PUT` add
 (ratings take `{rating}`) answering `204`, and a `DELETE` answering `204` whether or not
-the entry existed. All six mutations are `non_retryable`: the shared seams dispatch provider
-list and rating events and recommendation refresh without change gating, and rating updates
-replace `rated_at` even when unchanged. Their ledger `DEFECT` notes retain the durable-dispatch work
-required before clients can retry automatically. The mutations are not demo-restricted: v1's demo
+the entry existed. The four favorites and watchlist mutations are `natural_idempotent`: each
+store add and remove reports whether it inserted or deleted the row, and the shared v1/v2 seam
+sends the provider list event, the recommendation refresh, and the user-state event only for a
+change, so a repeated add or remove answers `204` and notifies nobody. The notices run detached
+from the request, so a client that disconnects after the write does not cancel them, but they
+are not durable: a crash between the write and the notices loses them, and a retry, which
+changes no row, does not resend them. The scheduled provider export resends an add the provider
+missed; a missed removal has no scheduled repair yet. The two rating mutations remain
+`non_retryable`: the rating seam dispatches provider rating events and recommendation refresh
+without change gating, and rating updates replace `rated_at` even when unchanged. Their ledger
+`DEFECT` notes retain the durable-dispatch work required before clients can retry automatically. The mutations are not demo-restricted: v1's demo
 guard only blocks its listed routes, so these writes pass in demo mode and v2 matches. The three
 lists page by keyset, not offset: the cursor is the (`added_at`, `item_id`) — for ratings
 (`rated_at`, `item_id`) — of the last entry emitted, and the next page resumes strictly after it
@@ -1609,6 +1616,14 @@ retry after an intervening unmark can create another watch; a durable client wat
 is still needed. History removal and unmark choose a fresh cutoff, so a delayed retry can
 hide an intervening watch. Sync accepts an omitted `updated_at`, so a delayed replay can
 overwrite newer progress; every item needs a stable event time before automatic retries are safe.
+Two v2-only operations extend the section without ledger rows: `clearResumePosition`
+(`DELETE /api/v2/progress/{media_item_id}/position`, tag `progress`) clears a movie or episode's
+resume position while keeping its watched state and history, answers `204` (also when there is
+nothing to clear), `422` at `path.media_item_id` for a season, series or ebook and `404` for a
+kind `markWatched` does not handle, and is
+`non_retryable` because a delayed retry would also clear a position recorded in between;
+`getProgressCapabilities` (`GET /api/v2/progress/capabilities`) advertises it as
+`clear_resume_position`. Semantics are in [the progress API](../progress-api.md#clearing-a-resume-position).
 
 **Section catalog-recommendations, stage A (Phase 4).** Seven profile-scoped reads under the
 `recommendations` tag: `listBecauseWatched`, `getDiscover`, `getForYouMain`, `listForYouRows`,
@@ -2323,15 +2338,18 @@ for limits), without volatile metadata. Integration reads include persisted publ
 configuration and check status, all covered by the row revision, and a credential
 presence flag. API credentials are write-only. A blank update preserves the saved
 credential and retains the existing requirement to re-enter it when changing the
-base URL. Plugin validation happens before the storage transaction; an intervening
-edit still fails the final comparison instead of overwriting it. A failed plugin
+base URL, which applies only when a credential is saved; clearing the base URL
+counts as changing it. Plugin validation happens before the storage
+transaction; an intervening edit still fails the final comparison instead of overwriting it. A failed plugin
 validation uses structured v2 problem errors for the web's inline field messages.
 
 A v2 integration's `base_url` is normalized before option loading and before
 create or update: `http://` is assumed when no scheme is given and a trailing
 slash is dropped, so the saved address is the one the options probe used. An
 address with credentials, a query or a fragment, or another scheme, is a
-`validation_failed` problem on `body.base_url`. When `POST
+`validation_failed` problem on `body.base_url`. An options request that leaves
+`base_url` out tests the saved address; one that sends it blank tests a router
+that declares `base_url_optional` without an address. When `POST
 /admin/request-integrations/{id}/options` fails, the host answers with its own
 sentences and never echoes the plugin's upstream text. What the admin must fix
 is a `validation_failed` problem on `body.base_url` (wrong address, missing URL
@@ -2373,10 +2391,26 @@ forget requests, return `404`; successful commands return `204`. Both commands a
 non-retryable because a later retry can remove settings written in the meantime.
 Neither operation revokes login sessions or changes push registrations.
 
+`PATCH /api/v2/devices/{device_id}` (`updateDevice`) updates the same registry entry,
+with the same `profile_id` authorization and `404` for a missing device. Its one
+member, `custom_name`, names the device for that profile: a string sets it, `null`
+removes it, and omission leaves it unchanged. The server removes control characters
+and bidirectional overrides, collapses spaces, and rejects a name with no visible
+character (`422`). Registration never writes the custom name, so it survives the
+device being seen again, and the reported `device_name` is kept. `listDevices`
+returns `custom_name` only when one is set; clients show it in place of
+`device_name`. The operation answers `200` with the entry as `listDevices` renders it
+and is naturally idempotent. A name
+belongs to one profile's entry, so a device two profiles use is named separately for
+each. `supports_device_rename` on `getSettingsContractCapabilities` tells a client
+the operation exists. Administrator device reads and download device views still
+show the reported name.
+
 The web device-settings screen uses these operations. The Apple and Android native
 clients have no callers for this settings-device lifecycle; Apple's push registration
 belongs to the separate notification contract. Jellyfin has no corresponding
-settings-device operation.
+settings-device operation; jellycompat does not serve Jellyfin's device list or its
+custom device names.
 
 ### Administrator collections v2
 
diff --git a/docs/architecture/blob-storage.md b/docs/architecture/blob-storage.md
index dc4f0b67e5..e793352f4b 100644
--- a/docs/architecture/blob-storage.md
+++ b/docs/architecture/blob-storage.md
@@ -442,13 +442,17 @@ timestamps are truncated to a quarter of the token TTL instead, which leaves
 each URL valid for at least three quarters of it. Other presigned and token
 URLs are issued fresh on every resolve, and public URLs never change.
 
+Every backend consults the publication manifest for a rung a ladder change
+added: existing revisions lack the new widest rung until the ladder backfill
+regenerates them, so a request for it gets a smaller rung the revision
+published, and artwork without a manifest is limited to its type's medium rung.
 Local storage publishes each object with an atomic rename, and direct S3 reads
-see an object as soon as its upload returns, so catalog responses resolve the
-manifest key they hold and a missing object answers 404 and enqueues repair.
-Only external delivery (a public or token-authenticated read endpoint in front
-of S3) can lag behind a write. That configuration alone runs the
-`verify_artwork_delivery` task and consults the verified-keys manifest when
-choosing which variant to advertise.
+see an object as soon as its upload returns, so on those backends every other
+key resolves as held, without a lookup, and a published key that is
+nevertheless missing answers 404 and enqueues repair. Only external delivery (a
+public or token-authenticated read endpoint in front of S3) can lag behind a
+write. That configuration alone runs the `verify_artwork_delivery` task, and it
+consults the verified-keys manifest for every key.
 
 A verdict is scoped to the delivery configuration and is current only until
 the revision is published again. Publication records exact keys only after
diff --git a/docs/architecture/collection-editor.md b/docs/architecture/collection-editor.md
index e1174576ce..dbad78372f 100644
--- a/docs/architecture/collection-editor.md
+++ b/docs/architecture/collection-editor.md
@@ -152,16 +152,14 @@ list follows counts once, as the list.
 - **What can change depends on the source.** A server MDBList or TMDB list changes its link; a
   server TMDB chart changes its chart or moves to a TMDB list; a franchise list changes its TMDB
   collection ID. A profile changes its MDBList or TMDB list link; a chart it follows stays as it was
-  made. Discover lists (from Starter packs) and legacy Trakt lists show their source read-only.
+  made. Discover lists (from Starter packs) show their source read-only.
 - **What a server save sends.** The PATCH carries every field and rebuilds the source whole
   (`source_url` and `source_config`), as the server stores it: a changed MDBList link loses its
   `?query`, `#fragment` and trailing slash, and a TMDB list link becomes its canonical
   `https://www.themoviedb.org/list/{id}`. A Discover list and a franchise list with no ID yet send
-  no source unless max titles changed, and then send their stored config with the new limit; every
-  Trakt list sends no source, so the server keeps the stored one. A new chart unticks libraries that
-  can't hold its titles, as on create, because the server doesn't check library kinds on update. A Trakt list's
-  libraries and max titles are locked, and a stopped Trakt schedule can't be turned on, because
-  the server refuses those changes. A save never sends `featured`.
+  no source unless max titles changed, and then send their stored config with the new limit. A new
+  chart unticks libraries that can't hold its titles, as on create, because the server doesn't
+  check library kinds on update. A save never sends `featured`.
 - **What a personal save sends.** Name, sharing, libraries, the Collections tab switch and Show
   only always go; description, order, the link (`source_url`), max titles (`max_items`, `0` for the
   whole list) and the schedule go only when they changed.
diff --git a/docs/architecture/collection-templates.md b/docs/architecture/collection-templates.md
index f6b8a352c5..203a90f041 100644
--- a/docs/architecture/collection-templates.md
+++ b/docs/architecture/collection-templates.md
@@ -114,8 +114,6 @@ templates only, never bundles. The rules the web keeps:
   `validateTMDBFranchiseConfig` (`internal/catalog/library_collection_service.go`) fails its sync
   until a real ID is set. `Template.NeedsSetup` reports this case: bundle apply creates the
   collection without a first sync, and the `/api/v2` bundle list marks its summary `needs_setup`.
-- `trakt`: the validator still accepts it, but the server rejects new Trakt collections with
-  `unsupported_source`. Don't add Trakt templates.
 
 ## Templates in the Synced list step
 
diff --git a/docs/architecture/deterministic-content-id.md b/docs/architecture/deterministic-content-id.md
index fac2c35ab1..4015ec0c12 100644
--- a/docs/architecture/deterministic-content-id.md
+++ b/docs/architecture/deterministic-content-id.md
@@ -203,6 +203,30 @@ catalog-driven column enumeration so the two stay in lockstep;
 `ON UPDATE CASCADE` only fires when a `content_id` actually changes (at this
 promotion and at a corrected-match re-anchor), so there is no steady-state cost.
 
+### Merging onto the owner of a provider ID
+
+A match can merge an item into another item that already holds one of its
+provider IDs (`findExistingByProviderIDs`): a provisional item at its match, a
+new item's dedup, and a provider-ID unique conflict at persist all do, and a
+scanned file links to the matched item that holds one of its folder's tagged
+IDs. Sharing an ID is not enough. The two items must also agree on the first ID
+both carry, in the order the item type's content ID anchors
+(`identityProviderIDsContradict`, `contentid.AnchorPrecedence`): TMDB, IMDb,
+then TVDB for a movie; TVDB, TMDB, then IMDb for a series. Provider cross-ID
+mappings are community-edited and sometimes list one TVDB or IMDb ID on two
+neighboring titles, and merging on such an ID folded a folder tagged
+`[tmdb-125249]` into `movie-tmdb-43506` (issue #2263).
+
+When the items disagree and the item that already holds the shared ID is
+matched, it keeps the ID, and the other item is persisted without it
+(`recoverProviderIDConflict` logs `left a provider ID with the other title that
+holds it`). A holder that is not yet matched gives up its provider IDs instead,
+as for any provisional owner. When the tag lookup refuses an item, the file
+links to the matched item at the tags' own content ID if there is one, and
+gets a new provisional item otherwise. The anchoring ID decides first, so a movie whose TVDB mapping
+changed since it first matched still merges on its TMDB ID, and a series whose
+TMDB mapping changed still merges on its TVDB ID.
+
 ### Re-anchor on a corrected match
 
 An item matched to the wrong title sits on that title's id, for example
diff --git a/docs/architecture/discovery-row-ranking.md b/docs/architecture/discovery-row-ranking.md
index a102a9da6f..53fca30417 100644
--- a/docs/architecture/discovery-row-ranking.md
+++ b/docs/architecture/discovery-row-ranking.md
@@ -56,7 +56,7 @@ section's libraries with the viewer's allowed libraries and applies the access
 filter's content allow-list and name prefix (`catalog.AppendContentScope`).
 
 Rows that sort by rating without requiring a vote count (format showcases,
-anniversaries, seasonal keyword picks) use `catalog.RatedOrder`: the weighted
+anniversaries) use `catalog.RatedOrder`: the weighted
 rating first, then titles with no known count by `rating_tmdb` and then
 `rating_imdb`, so a perfect score from a few votes never leads them either.
 The default Top Rated library rows are rule rows and keep the sort their
diff --git a/docs/architecture/download-storage.md b/docs/architecture/download-storage.md
index fd3bd47887..492ea932db 100644
--- a/docs/architecture/download-storage.md
+++ b/docs/architecture/download-storage.md
@@ -32,7 +32,13 @@ request cannot both win: once the touch commits, the file was used too recently
 expire, and a request that loses gets `prepared_file_expired`.
 
 A missing file found by recovery, or a node requeue, expires the row instead of
-deleting it, and only in-flight rows are reset to `preparing`. An expired row is not a
+deleting it, and only in-flight rows are reset to `preparing`. The reset keeps the
+revision, so a device that fetched the whole file before it can still report
+`completed`. That report applies to the `preparing` row, and when no in-flight
+download is left and the job is still waiting in the queue, the job returns to
+`expired` in the same transaction. A job a worker already claimed finishes into the
+cache: an expired row keeps its id and output path, so stopping a live encode could
+race a later prepare-again. An expired row is not a
 preparation: the admin preparation list, queue positions, and cancel skip it. Neither
 the failed sweep nor a revoke's cancel of abandoned preparations deletes a row that a
 live download refers to, in flight or finished, because finished downloads read its
@@ -46,6 +52,16 @@ transcode node (`node:<id>`). Each has a budget: the node's
 `download.artifact_max_bytes`. A node can also set `download_artifact_dir_override`;
 the node applies it at its next restart.
 
+With `download.artifact_dir` blank, the API server's directory is
+`silo-download-artifacts` beside `playback.transcode_dir` (`/tmp/silo-download-artifacts`
+by default), never inside it: the orphaned-transcode sweep deletes unknown
+subdirectories of the transcode directory. A node with no directory set uses
+`download-artifacts` inside its own transcode directory. Because the server's default
+sits outside the transcode mount, the default `docker-compose.yml` mounts it
+separately under `PRAIRIE_DATA_ROOT`; without that mount the files live in the
+container layer and every container recreation sends them through missing-file
+recovery.
+
 Maintenance runs every five minutes on one replica at a time, under the session
 advisory lock `pg_try_advisory_lock(0x5110d1, 1)`. The lock is held on a dedicated
 session outside the pool, so the pass's own queries work even with
diff --git a/docs/architecture/dropped-shows.md b/docs/architecture/dropped-shows.md
index 69b5200c21..da5124a411 100644
--- a/docs/architecture/dropped-shows.md
+++ b/docs/architecture/dropped-shows.md
@@ -2,7 +2,7 @@
 
 A profile can drop a series to take it off its Next Up and Continue Watching rows
 without touching its watch history. Drops sync both ways with watch providers that
-support them: Trakt, Simkl, and watch-sync plugins that advertise `sync_dropped`.
+support them: Simkl and watch-sync plugins that advertise `sync_dropped`.
 
 ## Local drops
 
@@ -10,7 +10,8 @@ support them: Trakt, Simkl, and watch-sync plugins that advertise `sync_dropped`
 dropped. A drop is **active** while no episode of the series has watch progress, or a
 history-hide stamp (mark unwatched, remove from history), newer than `dropped_at`. So
 watching any episode again undrops the series, whichever path recorded the watch, and no
-writer needs to know about drops. Imported history keeps its original watch time, so
+writer needs to know about drops. Clearing an episode's resume position is a progress write
+too, so like mark unwatched it ends the drop. Imported history keeps its original watch time, so
 re-importing old plays never undrops a series. An inactive row means the same as no row;
 watch sync removes it.
 
@@ -66,11 +67,11 @@ A tombstone whose key names neither changes nothing: that is usually the provide
 echoing an undrop whose agreement Prairie already forgot. Local imports are compare-and-set on the row the run read, so a
 concurrent dismissal or undo wins.
 
-Provider reads can lag or omit Silo's writes. Trakt serves its GET responses from a cache
-for up to an hour, and its dropped list leaves out drops that apps make, so a drop Silo
-sends is usually never confirmed by a read. Such a drop stays agreed and is not sent
-again; resending it would drop the show again each time the user undropped it on Trakt,
-which Silo cannot see. An undrop of a drop a read had confirmed keeps its agreed row
+Provider reads can lag or omit Prairie's writes. A provider may serve reads from a cache,
+or leave drops that apps make out of its dropped list, so a drop Prairie sends may never be
+confirmed by a read. Such a drop stays agreed and is not sent again; resending it would
+drop the show again each time the user undropped it on the provider, which Prairie cannot
+see. An undrop of a drop a read had confirmed keeps its agreed row
 until a read shows the show is gone, so a stale read resends the undrop instead of
 importing the old drop back; an undrop of a drop no read confirmed forgets the row at
 once. Both writes are idempotent.
@@ -85,10 +86,6 @@ undrop a show that is watched.
 
 ## Providers
 
-- Trakt: `GET /users/hidden/dropped` (every page, verified by a second read), and
-  `POST /users/hidden/dropped` and `/users/hidden/dropped/remove`. Trakt's older hidden
-  sections (`progress_watched`, `calendar`) are not drops and are not read. Trakt
-  undrops a show itself when the user watches it.
 - Simkl: `GET /sync/all-items/{shows,anime}/dropped`, skipped while the lists' `all`
   activity stamps are unchanged. Dropping moves a show to the `dropped` list with
   `POST /sync/add-to-list`; undropping moves it to `watching`. Simkl records no drop
diff --git a/docs/architecture/external-watchlist.md b/docs/architecture/external-watchlist.md
index 5c58efbbab..4894d3b4e6 100644
--- a/docs/architecture/external-watchlist.md
+++ b/docs/architecture/external-watchlist.md
@@ -157,7 +157,7 @@ catalog merges them. For each title with exactly one visible copy:
    run `Effects.WatchlistPromoted`, implemented by
    `handlers.PersonalDataHandler`: the provider export event
    (`dispatchLocalListEvent`), the recommendations refresh
-   (`triggerProfileRefresh`) and a realtime `user_state.changed` event with
+   (`notifySignalsChanged`) and a realtime `user_state.changed` event with
    `change: "watchlist"`. These are the effects of a manual add.
 
 The library add in step 3 uses a second pool connection while the promotion's
@@ -296,7 +296,9 @@ kept. Promotion on library reads does not depend on that gate.
   one a re-add put back, is on the watchlist and keeps its request. An absent
   entry succeeds with 204.
 
-Both mutations are `non_retryable`, as the library watchlist mutations are.
+Both mutations are `non_retryable`: an add can create or follow a request and a removal can
+cancel a watchlist-made request. The library watchlist mutations they reuse are
+`natural_idempotent`, because they notify only for a changed row.
 Discovery results and the title detail carry `in_watchlist`, hydrated with two
 reads per page: title entries by TMDB ID, and the library watchlist by
 `library_content_id`. `GET /api/v2/requests/status` advertises
@@ -339,7 +341,7 @@ least 15.
 
 ## Not built
 
-Watch-provider (Trakt, Simkl, MDBList) and Plex imports still drop rows the
+Watch-provider (Simkl, MDBList) and Plex imports still drop rows the
 library doesn't have, and export only library items. Carrying unowned titles
 through them needs its own design; imports would never auto-request. A profile
 that cannot request, or has opted out, gets no arrival notification: only the
diff --git a/docs/architecture/history-import-execution.md b/docs/architecture/history-import-execution.md
index 725f34bb5d..80ba5a0780 100644
--- a/docs/architecture/history-import-execution.md
+++ b/docs/architecture/history-import-execution.md
@@ -88,7 +88,10 @@ Silo progress. Favorite-only records add the favorite without creating progress.
 
 Source servers are user-supplied, so what an import reads from one is bounded
 (`internal/historyimport/upstream_limits.go`): each successful response is decoded only up
-to 16 MiB, and each paged listing stops at 5,000 pages, 500,000 items, or 512 MiB in total.
+to 16 MiB and 250,000 JSON values, and each paged listing stops at 5,000 pages, 500,000
+items, or 512 MiB in total. One budget also covers the whole run, across every listing,
+Plex section, ID lookup, and metadata sweep: 2 GiB read and an estimated 256 MiB of kept
+items. Lookups by ID keep only the items they asked for, one per ID.
 Going over a limit fails the run with its own message. That includes lists whose other
 failures only add a warning (resume positions, favorites, the watchlist, Plex sections, and
 metadata lookups), so an import never completes without a list the source sent.
diff --git a/docs/architecture/intro-detection.md b/docs/architecture/intro-detection.md
index e27fab6e72..fff9a506fb 100644
--- a/docs/architecture/intro-detection.md
+++ b/docs/architecture/intro-detection.md
@@ -59,6 +59,17 @@ Chromaprint points summarize a window that starts at the point's timestamp,
 so raw matches start and end early. Fixed leads measured against authored
 intro chapters move both boundaries back.
 
+Every ffmpeg attempt that detection makes (fingerprints, tail passes, and
+silence detection) has a deadline of two minutes plus the running time of
+the media it reads, so a ten-minute opening gets twelve minutes. Storage
+that can play a file reads it at least as fast as it plays, so a run still
+going at its deadline has almost always stalled; a host busy enough to
+starve background decoding can also reach it. ffmpeg is killed and the run
+fails as a `timeout`, which is not permanent: a fingerprint counts as a
+failed extraction and leaves its group partial, a tail pass is stored
+`failed` with backoff, and the other files carry on. A tail pass whose
+hardware attempt times out tries software on a deadline of its own.
+
 ## Confidence
 
 Chromaprint confidence is the rate at which markers of the same kind covered
@@ -251,8 +262,9 @@ These rules were validated on frame-checked episodes and movies from several
 series; every start they placed early was checked against frames and cut no
 story.
 
-Automatic contribution to online providers stays intro-only; detected credits
-are contributed only on request.
+Automatic contribution to online providers shares detected credits as it does
+intros, when they meet the provider's minimum confidence. At the default 0.95,
+that is chapter credits and season-agreed audio credits that video moved.
 
 Credits versions and caches:
 
diff --git a/docs/architecture/local-nfo-metadata.md b/docs/architecture/local-nfo-metadata.md
index a1f99739ba..9943a302b6 100644
--- a/docs/architecture/local-nfo-metadata.md
+++ b/docs/architecture/local-nfo-metadata.md
@@ -309,7 +309,8 @@ Sidecar images are discovered by the provider's `GetImages`
 always receive the normal presigned `poster_url`/`backdrop_url`/`logo_url`
 (and, on `/api/v2` movie and series detail, `banner_url`, `thumb_url`,
 `clearart_url`, `disc_url` and `backdrop_urls`); library files are never served
-directly, and API nodes never need filesystem access to libraries.
+directly. The admin image picker (below) is the only API path that reads
+sidecar files.
 
 Discovery lists each folder once per request and matches names ignoring case,
 so `Poster.JPG` and `Folder.jpg` count on case-sensitive filesystems; an entry
@@ -401,7 +402,11 @@ Caching and refresh:
   processor confines each read to the owning library's `media_folders` roots:
   a lexical check on the logical path, then a symlink-resolving re-check (both
   path and roots are resolved, so a legitimately symlinked root stays valid
-  while an intermediate directory symlink escaping a root is rejected). When
+  while an intermediate directory symlink escaping a root is rejected). Each
+  library root is opened as an `os.Root` before the path is resolved, and the
+  file is opened through the handle that is the same directory as the resolved
+  root, so a root or folder swapped for a symlink after that point cannot lead
+  the open out of the library. When
   the re-check or the read fails, the processor probes, through
   `internal/rootcheck`, the nearest folder that exists at or above the file's
   folder, searching no higher than the library root: unless it lists entries
@@ -433,14 +438,17 @@ Caching and refresh:
   that offers no artwork at all leaves the slot, local source included, as it
   is. Locked artwork gets no stand-in, and neither does an image URL an NFO
   names: its slot stays empty until the image cache has downloaded it.
-- `metadata.cache_images` governs remote artwork only. With it off, local art
-  files are still selected, copied, and served: the drain claims local jobs
-  only (through the partial index `metadata_image_cache_jobs_local_due_idx`, so
-  remote jobs left queued are not read), a manual refresh waits for local jobs
-  only, and the provider-artwork backfill stays off. An image URL an NFO names
-  is a download, never served directly, so with caching off it is not selected
-  (`localSourceUsable`) and the slot takes provider artwork, as it does for
-  person photos.
+- With `metadata.cache_images` off, clients load artwork straight from the
+  providers, so no local artwork is used (`localArtworkUsable`): refreshes,
+  targeted season and episode refreshes, scan re-applies, and person photos
+  drop local candidates, items keep no extra backdrops, and the image cache
+  claims, copies, and downloads nothing. NFO text still applies. A refresh
+  also stops keeping stored copies: `preserveCachedArtwork` lets a provider
+  path replace one unless the artwork is locked, and an unlocked item's stored
+  poster, backdrop, and logo count as empty for `applyBestImages`, so even a
+  fill-empty refresh takes an unrated provider image. Artwork stored before the
+  setting went off is released by `StoredArtworkReleaser` (see
+  [settings-api.md](../settings-api.md)).
 
 Precedence: local artwork beats remote providers wherever the NFO provider
 sits in the chain.
@@ -515,8 +523,8 @@ reference is a path relative to the NFO or an http(s) URL:
   sidecar file: `isLocalImageSourcePath` counts it, it waits in
   `*_source_path` until the image cache downloads it through its
   public-address guard, it is never served to clients or fetched by
-  jellycompat's image proxy, and it is not used while
-  `metadata.cache_images` is off. Like a sidecar, it is re-copied by a
+  jellycompat's image proxy, and, like all local artwork, it is not used
+  while `metadata.cache_images` is off. Like a sidecar, it is re-copied by a
   refresh or the ladder backfill, not by the provider-artwork sweeps. Its
   copy is attributed to the `nfo` provider and keyed like a provider's
   (`nfo/{contentType}/{contentID}/{imageType}/...`); only `file://` copies
@@ -544,8 +552,45 @@ still waiting for its copy, stays. It queues a person image-cache job whose `ser
 title, so the processor confines a local read to that title's library roots;
 a title's interactive artwork refresh leaves those person jobs out of its
 scope. A person refresh keeps a cached NFO photo over a provider's. Like other
-local artwork, a sidecar photo is copied whatever `metadata.cache_images` says;
-a photo URL an NFO names is used only while the setting is on.
+local artwork, NFO photos are used only while `metadata.cache_images` is on;
+photos already copied stay (the stored-artwork release leaves people alone).
+
+### Admin image picker
+
+`GET /api/v2/admin/items/{id}/images` also offers a movie's or series' local
+sidecar artwork. The built-in sidecar discovery runs with the item's media files
+and sidecar directories, so it finds the same files a refresh would, and it runs
+whether or not the library's metadata chain uses the NFO provider: choosing an
+image is an explicit admin action. Local choices come only from that discovery;
+a `file://` URL returned by any provider in the chain is dropped, so a provider
+cannot get another library file offered as this item's artwork. Only sidecar
+files (including files an NFO names by relative path) for the slots an admin can
+apply (poster, backdrop, logo) are offered: an image URL an NFO names has no file
+to read here, and banner, thumb, clear art and disc art cannot be applied. Each
+local choice has the provider ID `local`, keeps its fingerprinted `file://`
+source as `original_url`, and shows a 300-pixel-wide WebP preview as an inline
+`data:` URI (the web client authenticates with a bearer token, so an `<img>`
+cannot fetch an authenticated preview route). Local choices lead the list, ahead
+of every provider's, in discovery order, so each slot's first local choice is
+the sidecar file a refresh uses when it takes local artwork. The preview is read under the same
+root confinement, symlink and size checks as the processor; a file that fails
+them is left out of the list, and the list's `provider_errors` reports it under
+`local`. Only the movie and series list does this: any other list treats a
+provider's `file://` URL as an ordinary provider choice and never reads it.
+
+`POST .../images/apply` with a `file://` `original_url` caches the file only
+when the item's sidecar discovery offers that exact source for that image type,
+so a file replaced since the list (a new fingerprint) must be picked again. It
+reads the file under the same checks, stores it under the same `local/...` key
+the processor would use, and publishes the fingerprinted source with the images
+lock like any other choice. Seasons, episodes and frozen v1 keep provider-only
+choices. The server answering the admin API reads the file, so it needs the
+library mounted, like a server that copies local artwork; on a server without
+the mount discovery finds nothing and local choices are not offered.
+
+The reads open each library root as an `os.Root`, which needs read (list)
+permission on the root directory, not only search permission. The scanner lists
+the roots, so a server that scans a library already has it.
 
 ## Series depth and mixed libraries
 
@@ -681,8 +726,8 @@ refresh (`internal/metadata/local_sidecar.go`, `local_reapply.go`).
 
 ## Known limitations
 
-- The admin image picker does not surface local art (automatic chain path
-  only).
+- The admin image picker offers local art for movies and series only, not
+  for seasons or episodes.
 - Seasons have no banner, thumb or extra backdrops (`seasonNN-fanart`,
   `seasonNN-banner`, `seasonNN-landscape` and their season-folder forms are not
   read).
diff --git a/docs/architecture/media-naming.md b/docs/architecture/media-naming.md
index 0785ee7cee..6994b2afa7 100644
--- a/docs/architecture/media-naming.md
+++ b/docs/architecture/media-naming.md
@@ -46,6 +46,39 @@ one show). Deeper folders, and names that start with the show title, keep the UK
 (`La Série 2/La Série 2 S01E03.mkv`) keeps the label as part of the title. `TestSeasonDirectoryWordLabelsAtTheLibraryTop`
 and `TestWordSeasonLabelsKeepShowContext` hold these cases.
 
+### Extras folders in a series library
+
+The scanner's extras classifier (`internal/scanner/extras.go`) decides whether a folder named
+like an extras folder (`other`, `Trailers`, `Featurettes`, `Extras`, ...) holds extras or
+content. It is an extras folder only when its owner, the first ancestor not named like one,
+holds media directly or belongs to a title: a file up to three levels below the owner
+(`Season 01/Disc 1/episode.mkv`), outside the owner's own extras folders, resolves to the owner,
+to a show folder above it, or to a folder inside it with the owner's own title and year (a
+version folder such as `Alien (1979)/1080p/`, or a wrapper such as `Show/Show/`). A category
+folder such as `Kids/` holds shows that resolve to their own folders under other titles, so
+`Kids/Shorts/` and `Documentaries/Interviews/` stay content and keep their own series; so does a
+franchise folder such as `Doctor Who/` holding `Doctor Who (2005)/`. A folder named like an
+extras folder that holds episodes in season folders (`Kids/Shorts/Season 01/Shorts S01E01.mkv`)
+is a show of its own wherever it sits. A full scan, a subtree scan of the extras folder, and a
+single-file event apply the same test; the last two read the filesystem. A show folder with no
+episodes yet owns nothing, so its `trailers/` stays a series of its own until the show has an
+episode in the library; a later scan then turns it into an extra.
+
+An episode code makes a file in an extras folder an episode only under the show's own `Extras/`
+folder (`Show/Extras/Show S00E01.mkv` is a special). Anywhere else (`other/`,
+`Trailers/1080p/`, `Season 01/Extras/`, `Extras/Behind The Scenes/`) it is part of an extra's
+name, so a deleted scene numbered `S01E05` never becomes a second version of the real episode.
+An extra binds to its owner's item and never founds a series; while the owner has no item yet
+(a show's first scan), the scan defers it to the next one.
+
+`deriveSeriesRoot` puts a `Specials/` or `Extras/` folder inside a season folder (`Season 01`,
+`S01`, or a bare `Season` folder) with that season's show. A bare number or a
+`Specials`/`Extras` label above it (`Drama/1883/Specials/`, `Extras/Specials/`) is the show's
+title, not a season, and so is a folder the file's own title names (`Drama/Season 2/Specials/Season
+2 S00E01.mkv`) or a season word with more title after it (`Series 7 Documentary/`).
+`TestSeriesExtrasFoldersBelongToTheirShow`, `TestMixedLibraryVersionFolderOwnsExtras`, and
+`TestSpecialsInsideASeasonFolderJoinTheShow` hold these cases.
+
 ## Episode numbers
 
 - `parseEpisodeNumber` (`internal/naming/episode.go`) returns 0 for a digit run longer than
diff --git a/docs/architecture/media-requests.md b/docs/architecture/media-requests.md
index 2979d7d948..341c6ec619 100644
--- a/docs/architecture/media-requests.md
+++ b/docs/architecture/media-requests.md
@@ -97,7 +97,8 @@ records the route that sent it. A server a route sends to cannot be deleted
 until the route stops using it, so deleting a server never silently reroutes
 titles, and it cannot be switched to the type the route's media type cannot use
 (Sonarr for movies, Radarr for series) or stop taking that media type. A chosen
-server that is disabled, not set up (no installation, no key), of the wrong type
+server that is disabled, not set up (no installation, or no key when its plugin
+needs one; see [Without a router](#without-a-router)), of the wrong type
 or not taking the media type anyway is an admin-fixable
 problem: when nothing has been
 sent yet, the submission retries with backoff; a later tier that fails that way
@@ -391,6 +392,28 @@ installation) is a setup problem instead: the submission retries with backoff
 and records the reason in `last_error`, so fixing the connection lets the
 request through.
 
+A connection needs an API key unless its plugin declares
+`request_router.api_key_optional` in its manifest. The host reads the
+declaration from the capability metadata stored when the plugin was installed
+or updated, without launching the plugin, and only for a connection without a
+key. Such a connection is routed, status-checked and probed like any other,
+with an empty key. A connection whose declaration cannot be read is skipped
+like one without a key; when no other connection can take the request, the
+submission retries with the read error. The v2 plugin installation view
+carries the same stored declaration, with `request_router.base_url_optional`,
+so the admin form saves a server without a key or URL only when routing will
+use it; the host itself never requires a URL. A saved key still has to be
+typed again when the server's URL changes to another address; a server saved
+without a key has none to protect, so its URL can change without one. The save
+checks this again under the row lock, so a key saved, or an address changed,
+by another admin in the meantime is never paired with a different address. A
+connection test of a saved server that leaves the URL out tests its saved
+address. A blank URL in a test stands for the saved address too, unless the
+plugin declares `base_url_optional`; then it is tested blank, so an admin can
+clear it. A save validates and stores the URL it is given, blank included.
+Clearing it counts as changing the address: a saved key has to be typed again,
+and the test goes without it.
+
 The library also completes requests that never reached a router: a `pending`
 request whose title appears needs no approval any more, and a `failed` request
 whose title appears is complete, unless it failed after delivering one quality,
diff --git a/docs/architecture/media-sampling.md b/docs/architecture/media-sampling.md
index a1924f5491..1c18241024 100644
--- a/docs/architecture/media-sampling.md
+++ b/docs/architecture/media-sampling.md
@@ -97,7 +97,8 @@ statistics. Rules:
   one keyframe interval earlier. Frame timestamps follow the list, not the
   input, so a frame without the tag is dropped. A keyframe that serves
   several sample times is decoded once for each; when one sample decodes a
-  second keyframe, the first is kept.
+  second keyframe, the first is kept. Sheets lists over Matroska start their
+  entries at keyframes instead (see [Keyframe entries](#keyframe-entries)).
 - Sample times are finite, non-negative, strictly increasing, and at most
   10,000 per request. `Samples` takes no audio output.
 - `Samples.ReadThrough` reads the sampled span as the one keyframes-only
@@ -152,8 +153,8 @@ is held as PCM. Subtitle sync is its consumer.
 
 `POST /media-samples/run` on the transcode-node listener runs one `Request`
 with the node's ffmpeg and returns its `Result` as JSON
-(`mediasample.RemoteClient` is the caller). The node requires its bearer
-secret and an input path it is allowed to read, accepts software attempts
+(`mediasample.RemoteClient` is the caller). The node requires a
+[signed request](worker-http-protocol.md#authentication) and an input path it is allowed to read, accepts software attempts
 only, and answers a failed run with `422` and a `RemoteFailure` whose reason is
 the run's `Classify` cause. `RemoteError.Infrastructure` tells a caller
 whether running the request elsewhere may succeed: an unreachable node, a 5xx,
@@ -173,23 +174,30 @@ An attempt with `Hardware` set decodes the request's video on the runner's
 `HardwareResolver` (`hwresolver.go`), which caches the resolved backend per
 configured pair until the playback probe cache is invalidated, and asks again
 after `HardwareRetryInterval` when `auto` resolved to no hardware; credits
-detection uses one. Only QSV, VAAPI, and VideoToolbox decode
-here (`SupportsHardwareDecode`); NVENC does not. A hardware attempt needs a
-video output (`Images` or `Stats`). Audio in the same run always decodes in
-software.
+detection uses one. QSV, VAAPI, and VideoToolbox decode
+every video output (`SupportsHardwareDecode`); NVENC decodes only `Sheets`
+(`SupportsHardwareSheets`), on CUDA, so the stats chains cached intro
+fingerprints come from and the chapter-thumbnail images stay as they were. A
+hardware attempt needs a video output (`Images`, `Stats`, or `Sheets`); one
+whose output its accelerator does not decode fails as `unsupported` without
+starting ffmpeg. Audio in the same run always decodes in software.
 
 - QSV and VAAPI decode into VAAPI surfaces on a render device. QSV
   initializes its VAAPI parent device the way playback does
   (`tonemap.QSVInitDeviceArgs`) and decodes through it.
+- NVENC decodes into CUDA surfaces on the CUDA device `HWDevice` names (an
+  index, or the default when empty), declared as the filters' device too:
+  `-init_hw_device cuda=cu[:N] -filter_hw_device cu -hwaccel cuda
+  -hwaccel_output_format cuda`.
 - VideoToolbox decodes `Images` into system-memory frames, so software
   filters apply to them directly. `Stats` asks for VideoToolbox surfaces
   (`-hwaccel_output_format videotoolbox_vld`) and downloads them, because
   only surfaces prove the decode ran on hardware: given a stream VideoToolbox
   cannot decode, such as VP8, plain `-hwaccel videotoolbox` quietly decodes
   in software, while the download of a software frame fails the attempt.
-- Each hardware attempt reserves one render device through
-  `playback.AcquireHWDevice`, falling back to `playback.PickRenderDevice`,
-  before its timeout starts, and releases it when the attempt ends, before
+- Each hardware attempt reserves one device through
+  `playback.AcquireHWDevice`, falling back to `playback.PickRenderDevice` for
+  QSV and VAAPI, before its timeout starts, and releases it when the attempt ends, before
   the next attempt. A multi-device `Runner.HWDevice` list therefore resolves
   to one device per attempt. A hardware attempt that cannot be built, such as
   VAAPI without a render device, fails as `unsupported` without starting
@@ -198,6 +206,10 @@ software.
   the hardware one. A failed run takes its reason from its last attempt, so
   once the software attempt has run, a hardware failure costs only time and
   cannot mark an artifact unusable.
+- A GPU that cannot decode the stream makes ffmpeg log "Failed setup for
+  format …" or "doesn't support hardware accelerated …" and fall back to
+  software frames, which the GPU chain refuses; the attempt's cause is
+  `unsupported`.
 
 `Stats` on VAAPI surfaces (VAAPI and QSV) scales the whole picture on the
 GPU and converts it to 8-bit NV12 there before the download, since a 10-bit
@@ -297,21 +309,54 @@ metadata=mode=add:key=sample:value=-1,metadata@sheets=print
 
 `Sheets.UseInputAspect` derives the height from the input header instead,
 including a 90-degree display matrix, and returns the actual cell height in
-`Result.SheetTileHeight`. This reuses the sampling probe; a `ReadThrough`
-request also probes when this option is set. Callers publishing manifests
+`Result.SheetTileHeight`. This reuses the sampling probe, which every
+`Sheets` request runs, `ReadThrough` included. Callers publishing manifests
 must use the returned height and reject chunks whose geometry differs.
 
-- HDR sources are scaled before they are tone mapped, so the software
-  tone-map chain of [Images](#images) only handles thumbnail-sized frames,
-  followed by `scale=out_range=full:out_color_matrix=bt601`. VAAPI and QSV
-  tone map on the GPU first (`tonemap_vaapi` needs the source's HDR
-  metadata), scale with `scale_vaapi`, and download.
+- GPU surfaces (VAAPI, QSV, CUDA) are scaled on the GPU to four tiles' size,
+  or the frame's own size if smaller, downloaded as NV12 (P010 for a source
+  tone mapped below), and area-scaled to the tile in software:
+
+  ```text
+  scale_vaapi=w=min(iw\,4W):h=min(ih\,4H):format=nv12,hwdownload,format=nv12,scale=W:H:flags=area:out_range=full:…
+  scale_cuda=w=min(iw\,4W):h=min(ih\,4H):interp_algo=bilinear:format=nv12,hwdownload,format=nv12,scale=W:H:flags=area:out_range=full:…
+  ```
+
+  The GPU scalers sample a few source pixels per output pixel, so scaling a
+  4K frame straight to a 300-pixel tile aliases: SSIM 0.94 against the
+  software area scale on four 4K frames, where the two-step scale gives 0.999
+  and downloads a fraction of the frame.
+- HDR sources are tone mapped in software after scaling, so the tone map
+  only handles thumbnail-sized frames, followed by
+  `scale=out_range=full:out_color_matrix=bt601`.
+- `ToneMap.Source` names the base signal `tonemap.ResolveSource` classified
+  the input as. With it, every attempt converts with the chain playback
+  converts that signal with in software (`tonemap.SoftwareFilter`) on a
+  filter the binary lists: `tonemapx`, else `tonemap`'s Hable curve, which
+  cannot apply a Dolby Vision RPU. GPU attempts decode and scale as above,
+  download 10-bit P010 (`format=p010`, `hwdownload,format=p010le`), and take
+  the same software chain, so every decoder gives the same colors. The GPU
+  tone mappers do not: on an Intel Arc, `tonemap_vaapi` crushed PQ midtones
+  and turned HLG teal and inverted, AMD's refuses HDR, and neither applies an
+  RPU. A frame keeps its Dolby Vision RPU through the GPU scale and the
+  download (SSIM 0.986 against the software render, 0.85 without the RPU).
+  An attempt the binary has no filter for, such as a Dolby Vision base
+  (Profile 5, compatibility id 0) without `tonemapx`, or one that does not
+  allow software tone mapping, fails as `unsupported` before ffmpeg starts,
+  so it makes no sheets rather than green and magenta ones. A base that is
+  already SDR only changes gamut. Without `Source` the [Images](#images)
+  chains apply, as best effort for sources whose catalog facts cannot be
+  classified; CUDA has none of those, so its attempt is `unsupported`. Images
+  take no `Source`.
 - `metadata=print` logs a frame only when it carries metadata, so
   `metadata=mode=add` gives every frame a `sample` entry of -1 unless its
   packet was tagged. The log then counts every frame on stdout, and the Nth
-  raw frame is the frame logged as `frame:N`. A counter that skips or
-  restarts, frames without log lines, log lines without frames, or bytes
-  after the last whole frame fail the attempt as `output`.
+  raw frame is the frame logged as `frame:N`. A filter graph reinit, which a
+  hardware decoder that renews its surfaces causes mid-list, restarts the
+  counter at zero after the old graph passed on every frame it logged; the
+  frames still line up, and the count goes on. A counter that skips or
+  restarts anywhere else, frames without log lines, log lines without frames,
+  or bytes after the last whole frame fail the attempt as `output`.
 - `-fps_mode passthrough` is required: a list's timestamps jump back at every
   entry, and rawvideo would otherwise pick a constant frame rate and drop or
   duplicate frames. Windows bound their duration with an input `-t`, since an
@@ -329,42 +374,196 @@ must use the returned height and reject chunks whose geometry differs.
   half a second recovered all of them at no measurable cost. Stats keep the
   40 ms span their cached analyses were computed with. A window gives each
   sample the last frame at or before its time.
+- Sheets decode keyframes as the probed video codec needs. Interlaced MPEG-2
+  often codes a keyframe as an I field paired with a P field, which the
+  decoder reports as a P frame and `nokey` discards: a DVD-sourced episode
+  decoded 2 of 80 samples. MPEG-2 therefore decodes with
+  `-skip_frame:v noref`. The MPEG-1/2 decoder honors only `noref` and
+  `nokey` (`nointra` acts as `noref`), so this decodes every I and P
+  picture, about two and a half times the work of `nokey`. A list still
+  keeps each sample's first frame, its keyframe; a window gives each sample
+  the last I or P picture at or before its time. MPEG-1 has no field
+  pictures and keeps `nokey`.
+- MPEG-4 Part 2 (`mpeg4`, `msmpeg4*`) adds `-flags:v +low_delay`. Its
+  decoder otherwise holds each picture back for B-frames that a
+  keyframes-only read never sends, and releases it when the next keyframe
+  arrives; in AVI, whose packets carry no PTS, the frame then takes that
+  keyframe's time, and every cell showed the keyframe a GOP before its own.
+  Keyframes-only and reference-only reads decode no B-frames, so low delay
+  changes no picture. The repeat repair keeps its own `noref`.
 - A window also copies the same input's video packets to a `framecrc`
   timing file in a private temporary directory, separate from stderr and
   removed when the attempt ends. Their presentation times and durations
   bound the final keyframe's coverage without decoding extra frames or
   reading the file again. Samples beyond that observed extent remain missing, so
   premature EOF cannot turn every trailing cell into a decoded preview.
+- A packet without a PTS counts by its DTS only when the decoder runs in
+  low delay (MPEG-4 Part 2, above). A DTS never runs ahead of its PTS, so
+  the extent can only shrink, by the reorder delay. Without a PTS the decoder
+  stamps each frame with the DTS of the packet that released it, which is
+  the frame's own only when the decoder releases each keyframe as it
+  arrives. A reordering decoder does not: H.264 with B-frames in AVI
+  releases each keyframe two GOPs late in a keyframes-only read, and low
+  delay does not change that. Such windows fail with no usable packet timing
+  rather than publish every cell at an earlier keyframe.
 - A cell without a frame shows the previous cell's frame, and cells before
   the first frame show the first, so the grid never shifts. A run that had
   to fill more than 10 % of its cells (and more than one) fails as `empty`,
   which sends a hardware attempt on to software.
-- A list run that fails as `empty` after the HEVC decoder logged "Duplicate
-  POC in a sequence" is read again, in the same attempt, as the
-  keyframes-only window that other containers use. One decoder serves every
-  list entry and nothing resets it between them, so an HEVC CRA keyframe
-  (open GOP) after a jump takes a picture order count derived from the
-  previous sample's. When that count matches a picture still in the
-  decoder's buffer, the decoder drops the keyframe ("Duplicate POC in a
-  sequence", then "Skipping invalid undecodable NALU: 21"), and such a file
-  can lose nearly every sample on every run. A window decodes keyframes in
-  order and keeps the counts consistent, at the cost of reading the whole
-  span. A list that is empty without that message, such as a truncated or
-  damaged file's, still fails without the extra read: damaged pictures log
-  only "Skipping invalid undecodable NALU", and a window would give their
-  samples the last good keyframe instead of failing.
+- A list run that fails as `empty` after the decoder logged a dropped
+  keyframe is read again, in the same attempt, as a window. Two messages
+  mark a dropped keyframe. One decoder serves every list entry and nothing
+  resets it between them, so an HEVC CRA keyframe (open GOP) after a jump
+  takes a picture order count derived from the previous sample's. When that
+  count matches a picture still in the decoder's buffer, the decoder drops
+  the keyframe ("Duplicate POC in a sequence", then "Skipping invalid
+  undecodable NALU: 21"). An H.264 keyframe whose reference marking names
+  pictures a keyframes-only read skipped is discarded too ("illegal short
+  term buffer state"). Either way such a file can lose nearly every sample
+  on every run. An HEVC list goes to the keyframes-only window that other
+  containers use, which decodes keyframes in order and keeps the counts
+  consistent, at the cost of reading the whole span. An H.264 list that
+  logged its message goes straight to the reference-picture window below,
+  since a keyframes-only window discards the same keyframes. A list that is
+  empty without either message, such as a truncated or damaged file's,
+  still fails without the extra read: damaged pictures log only "Skipping
+  invalid undecodable NALU", and a window would give their samples the last
+  good keyframe instead of failing.
 - Skipped pictures do not advance the decoder's count, so keyframes a whole
-  count cycle apart (256 pictures with the common 8-bit count) collide in the
-  window too. A window that logs "Duplicate POC in a sequence" after a list
-  fallback fails as `empty` rather than give later samples the last keyframe
-  it kept; such files fail as they did without the fallback. If the window
-  fails for any reason, the attempt reports the window's failure, whose
-  reason and log describe the latest read, and its error names the list
-  run's.
-- A sheet is JPEG-encoded in-process (`image/jpeg`, `Quality`) as soon as
-  frames land two sheets further on, so at most three sheets are held.
-  `Result.Sheets` holds them in order and `Result.SheetFrames` counts the
-  decoded and filled cells.
+  count cycle apart (256 pictures with the common 8-bit count) collide in a
+  keyframes-only window too, and H.264 windows discard keyframes as lists
+  do. A window that logged a dropped keyframe finds, for each sample that
+  holds a frame, the last keyframe packet at or before it in the timing
+  file; a sample whose own keyframe was not decoded shows an earlier one and
+  counts as filled. Such a window may fill up to 15 % of its cells instead
+  of 10 %, since the file is whole and a preview a keyframe early is still
+  usable; a list keeps 10 %, so too many drops still send it to the window.
+  A window that fills more, or that logged a drop and has a keyframe packet
+  without a time, which leaves the stale samples unknown, is read once more
+  with `-skip_frame:v noref` and `select=key` ahead of the sheets chain:
+  the decoder sees every reference picture, so its state stays whole, and
+  the chain still gets only the keyframes. That read costs several
+  keyframes-only reads and runs only for files that fail without it. If the
+  window fails for any reason, the attempt reports the window's failure,
+  whose reason and log describe the latest read, and after a list fallback
+  its error names the list run's.
+- Sheets are JPEG-encoded in-process (`image/jpeg`, `Quality`) once the run
+  and its repairs are done, since a repair may replace any cell. A run holds
+  its tiles until then, so a request whose sheets exceed 64 million tile
+  pixels is invalid; callers chunk longer files. `Result.Sheets` holds them
+  in order and `Result.SheetFrames` counts the decoded, filled, and
+  repaired (`Refined`) cells.
+
+### Keyframe entries
+
+A sample-time entry makes the concat demuxer seek to the keyframe before the
+sample and read every packet of every stream, video and all audio tracks,
+from there up to the sample; the decoder skips them. With keyframes several
+seconds apart that is most of the file: 32 GB of a 43 GB 4K HEVC remux for
+645 cells. A Sheets list over a Matroska input therefore starts each entry
+at the sample's keyframe and reads only it and the entry's span
+(`keyframes.go`):
+
+- `Runner.Run` reads the keyframes once, before any attempt and its timeout,
+  from the file's Cues with `keyframes.ReadMatroska`: the index the
+  demuxer's seek uses, plus its spot check of a few clusters' block headers,
+  in-process and without decoding. The read runs in a goroutine, and the run
+  stops waiting after 10 seconds or when its context ends, which also stops
+  the read at its next call; a read blocked on stalled storage is left
+  behind. At most 4 reads are in flight in a process, blocked ones
+  included, which also bounds the memory parsing Cues takes (a few times
+  their size), and a run that finds none free skips the read. A file that is not
+  Matroska, has no Cues, whose Cues leave out keyframes, or whose read is
+  skipped or stopped gets sample-time entries.
+- An entry starts at the last keyframe at or before the sample's inpoint
+  (sample time plus container start, in the microseconds the list is
+  written in), rounded up to the microsecond so the seek never lands on the
+  keyframe before it. On ffmpeg-muxed files with B-frames and with container
+  starts of 3.21 and 11.4 s, this matched where ffprobe's
+  `-read_intervals` seek, which makes the same seek call, landed for every
+  sample. Samples before the first keyframe keep sample-time entries.
+- A sample whose keyframe is the previous sample's gets no entry: it would
+  only decode the frame the previous cell shows, and the HEVC decoder drops
+  a keyframe sent twice in a row as a duplicate picture order count. Once
+  the list is read, such a sample shows the previous cell's frame and its
+  source time, so the repair below finds it repeating that cell and decodes
+  its own moment. A distinct keyframe keeps its entry even when it lies
+  inside the previous entry's span.
+- Every frame of a keyframe entry lies at or after its inpoint, so its time
+  places it back in the input exactly. A sample-time entry decodes the
+  keyframe from before its inpoint, where ffmpeg rewrites the time to keep
+  the list's timestamps monotonic; with samples sharing a 40-second GOP,
+  that hid a repeat from the repair and left a cell showing the scene before.
+- An open-GOP keyframe after a jump takes a picture order count derived
+  from the last picture whose header the decoder parsed, skipped pictures
+  included. Keyframe entries leave longer gaps between parsed pictures, and
+  across a gap of more than half the count's cycle (128 frames with x265's
+  default 8-bit count) the derived counts run backwards: the decoder passes
+  on keyframes out of list order with rewritten times, or drops them as
+  duplicates. As soon as a frame comes from an earlier entry than the frame
+  before it, or the decoder logs a dropped keyframe ("Duplicate POC in a
+  sequence", or H.264's "illegal short term buffer state"), the attempt
+  stops ffmpeg and reads the samples from their own times, exactly as a
+  file without Cues. An abandoned read is never published: if the
+  attempt's time ran out meanwhile, it fails as `timeout`. A drop in the
+  abandoned read does not count toward the window fallbacks above.
+  Closed-GOP keyframes start their counts afresh and keep their keyframe
+  entries.
+- MP4 and every other container keep sample-time entries: an MP4 entry that
+  starts exactly at its keyframe's time often seeks past it (45 of 80
+  samples of one H.264 episode decoded nothing). Stats lists and repairs
+  keep sample-time entries too.
+
+Over Matroska test encodes (x264 and x265 at default settings and with
+scene cuts off at 5, 10, 20, and 40-second GOPs, open- and closed-GOP HEVC,
+samples every 5 and 10 seconds) keyframe entries never placed more wrong
+cells than sample-time entries, and fewer where samples share long GOPs.
+Open-GOP HEVC with an 8-bit count falls back once its listed keyframes lie
+more than about 5 seconds apart, which covers x265's default 10-second GOP at
+either interval; it then reads what it did before, plus the few entries read
+before the fallback.
+
+### Repairs
+
+A list gives each sample the keyframe at or before its time, placed back in
+the input from its frame time: `pts + start - k*span + inpoint - container
+start` for list entry `k`, where `start` is the list input's start time from
+its header, by which ffmpeg shifted every frame, and `inpoint` is where the
+entry starts in the container. Two kinds of cell come out worse than the
+input allows, and the attempt reads their samples again in a second list,
+after the first run and before the sheets are encoded (`sheet_repair.go`):
+
+- Missing cells decoded no frame. The demuxer could not seek to a keyframe
+  before the sample, as in a container that flags no keyframes (VC-1 in
+  Matroska, whose I-frames only the decoder recognizes, lost a third of its
+  samples to half-second entries), or the HEVC decoder dropped the keyframe
+  as a duplicate picture order count. The repair lists them again,
+  keyframes only (with the codec's options above), each entry lasting until the next sample (the shortest gap
+  between the run's samples): the decoder starts afresh and finds the
+  keyframe before the sample, or failing that the first one after it.
+- Repeated cells show the same moment as the cell before: their frames lie
+  within a tenth of the time between the two samples, because no keyframe
+  lies between them (a GOP longer than the interval, including every sample
+  a keyframe list left out), or because an open-GOP keyframe brought a
+  leading picture just before it that one sample kept.
+  The repair lists them again with `-skip_frame:v noref`, decoding every
+  reference frame from the keyframe on, and keeps the last frame at or before
+  each sample's time.
+
+Each repaired sample keeps its nearest frame: the last at or before its
+time, else the first after it. A repair that ffmpeg finishes must line up
+with its log like any run; one cut short keeps the frames it placed, which
+were written and logged in order, and leaves the rest. Both repairs share one
+time box, 30 seconds plus a quarter second a sample of the run, within the
+attempt's timeout: on a 4K HEVC clip with a keyframe every 25 seconds and
+samples every 10, software repaired 12 of 31 cells in 26 seconds, CUDA in 4.
+Missing cells are repaired first, then the repeated cells, recomputed so a
+recovered cell that shows its neighbor's keyframe is decoded at its own time
+too. A list that decoded nothing is repaired as well, since a container
+without keyframe flags can miss every short entry. A repair never fails the
+run, except that the caller canceling ends it as `canceled`; the sparse check then counts what the run and its repairs
+decoded, so a list whose repairs recover its missing samples no longer needs
+the window fallback above.
 
 ## Argument stability
 
diff --git a/docs/architecture/network-access.md b/docs/architecture/network-access.md
index d87708fef5..9d8b7eabd8 100644
--- a/docs/architecture/network-access.md
+++ b/docs/architecture/network-access.md
@@ -182,11 +182,12 @@ to them.
   (`Service.FollowLifecycleChanges`), so a missed publish costs at most one
   minute. A caller that cancels an accepted restart stops waiting while the
   supervisor continues the restart and records the result.
-- The API reaches proxies over their backend URL with the node bearer:
+- The API reaches proxies over their backend URL with
+  [signed worker requests](worker-http-protocol.md#authentication):
   `GET /network-access/status`, `POST /network-access/{provider}/connect`
   and `.../disconnect` on the proxy listener, ten seconds each, in parallel,
   like force-reload. Those routes carry `auth_url` and error text because
-  they take the bearer; the public `/health` report carries only state,
+  they require a signed request; the public `/health` report carries only state,
   origin and hostname. The proxy listener also runs `netaccess.Middleware`,
   so its own provider's stamped requests are validated there too.
 - The proxy's `/health` `network_access` block is what the API stores on the
diff --git a/docs/architecture/notifications.md b/docs/architecture/notifications.md
index 7ca102fb4a..681b6e2c54 100644
--- a/docs/architecture/notifications.md
+++ b/docs/architecture/notifications.md
@@ -24,6 +24,16 @@ before it became available is therefore recorded without a release event. The ad
 file in the library for flat items. The window leaves room for new episodes
 whose metadata lands a few days after the file.
 
+The detector also stores that decision on the availability row: an episode's
+`episode_availability.released_at` is set when it was recorded as a release
+(seeded library, inside the window), even while release events are turned off,
+and stays empty for back catalog and late matches. A profile that turns on
+`ui.next_up_new_releases_first` (off by default) gets Next Up ranked by the
+later of when it finished a series' previous episode and the `released_at` of
+the next episode (earliest availability row in the libraries the viewer can
+reach), so a caught-up series moves to the front when a new episode or season
+arrives. Changing what counts as a release changes that order too.
+
 Event kinds:
 
 - `episode` — carries series/episode identity and fans out to interested
@@ -89,6 +99,27 @@ release event's episode key:
   for the daily interest rebuild. A release fanned out in that window is
   judged on the stale interest. Evaluating Home removals at fanout time would
   close the gap.
+- A series the profile muted is a hard gate too. `ListActiveBySeries`, the
+  query that loads a release's candidate recipients, anti-joins
+  `profile_series_notification_mutes`, so a muting profile is never a
+  candidate: no delivery row is created and no channel sees the event. The
+  check costs one index probe per candidate inside that query, and it runs
+  again when fanout re-reads the candidates under the inbox locks. A mute
+  committed after that second read is like a preference change made just
+  after the delivery. Muting writes no interest row: the mute lives in its own
+  table keyed by account, profile, and series, because interest rows are
+  recomputed per library and pruned once their reasons go, and a mute lasts
+  until the profile unmutes. The account is part of the key because profile
+  IDs, such as the legacy `default`, repeat across accounts. A muted
+  profile's notification cursor does not move. The mute is read when fanout
+  evaluates a release, not when the episode arrives: unmuting does not
+  announce episodes fanout already evaluated during the mute, since their
+  release events are processed, but an event still inside the settle delay at
+  unmute is fanned out to the profile. No suppression state is kept per
+  release; the window is the settle delay plus one claim pass, and it applies
+  symmetrically to a mute made just after a release. A mute follows its series through a
+  catalog merge or split like other per-profile series state, and profile
+  deletion removes it.
 - Profile-level notification preferences are a hard gate: a reason disabled
   in preferences can never match, so no delivery row is created and no
   channel — including webhooks — ever sees the event. Per-webhook reason
@@ -110,11 +141,31 @@ release event's episode key:
   when access changes later.
 
 Multiple matching reasons produce one delivery with merged reason flags.
-Deliveries are deduplicated per `(profile, release event)` and, for
-`episode.available`, per `(profile, episode)` across libraries, so
+Deliveries are deduplicated per `(account, profile, release event)` and, for
+`episode.available`, per `(account, profile, episode)` across libraries, so
 dual-quality library setups notify at most once. Reprocessing an event is
 idempotent.
 
+A profile ID is unique only within its account: every account from before
+profiles has a profile named `default`. Interest rows, preferences, mutes,
+the delivery dedupe keys, and every inbox read, count, and mark-read are
+therefore keyed by account and profile, and profile deletion removes those
+for the deleted profile's account only. The email channel reads a profile's
+deliveries on the account that owns its email settings. Still keyed by
+profile ID alone: the inbox clock (`notification_inbox_clocks`), which only
+orders inserts, so two accounts' same-ID profiles share it and serialize
+their inserts without changing either inbox's order; and the email settings,
+push devices, web push subscriptions, and webhooks.
+
+The notified-series list (`GET /api/v2/notifications/series`) shows a profile
+the same index fanout evaluates, plus the series it muted. `ActiveReasons` is
+the event-independent half of these rules, shared by fanout and the list, so
+the two cannot disagree about which reasons a preference silences; a muted
+series keeps its active reasons on the list but does not notify. The list filters series through the
+catalog's card access check rather than fanout's per-library one, and it leaves
+out the per-episode checks (Next Up's expected episode and the
+already-notified cursor), which depend on the episode that arrives.
+
 ## Release-event retention
 
 Release events and inbox deliveries have independent lifetimes. Pruning an old
diff --git a/docs/architecture/observability.md b/docs/architecture/observability.md
index b35c3a7418..076687e22c 100644
--- a/docs/architecture/observability.md
+++ b/docs/architecture/observability.md
@@ -360,7 +360,8 @@ application listener; the API process serves it only on `PRAIRIE_METRICS_LISTEN`
   `mount="library-1"`), never by path, so an unauthenticated scrape cannot
   enumerate media locations. A node's unauthenticated `/api/v1/health` withholds paths
   on the same terms. Paths appear only in the admin resources response and a
-  node's bearer-authenticated `/status`.
+  node's `/status`, which needs a
+  [signed request](worker-http-protocol.md#authentication).
 - **Probing is bounded.** Each process's sampler checks at most eight mounts:
   the transcode scratch directory first, then library roots in order. The
   process logs how many go unsampled. The cap is per process, not per host, so
@@ -510,6 +511,63 @@ that ended. Their difference includes queued, exporting and dropped spans, so
 it is not an instantaneous drop count. Inspect it after a drain and monitor
 collector/backend self-metrics. There is no OTel MeterProvider.
 
+## Query attribution
+
+Attribution is opt-in during the initial soak. `PRAIRIE_QUERY_ATTRIBUTION_ENABLED` defaults to `false`, read once at startup.
+The `prairie starting` line records `query_attribution` (`on`/`off`) and a `query_run` UUID.
+Off adds no `db_*` request fields, events, summaries, metrics or span attributes.
+
+SQL enters only the shape function inside `queryattr`; the normalized text is hashed and discarded; no log, span, or metric carries SQL text, table or column names, argument values, or error text.
+
+A site is the first Prairie function and line outside `internal/database` and its subpackages; `main` qualifies.
+Names omit module and `internal/` prefixes; no eligible frame in 32 frames gives `unknown`.
+Shapes are 16 lowercase hex digits from FNV-64a of `go-sqllexer` normalized text. Each site holds eight shapes,
+then a ninth `other` row for further shapes or normalization errors. Fixed `batch` and `copy` shapes count toward eight.
+
+The `api request`, `apiv2 request` and `jellycompat request` lines add, in order, `db_queries`, `db_query_ns`,
+`db_acquire_wait_ns`, `db_slowest_site`, `db_slowest_shape`, `db_slowest_ns`, `db_top_site`, `db_top_shape`, `db_top_count`.
+Times are nanoseconds; summed operation time is not wall time. One traced query (`Query`, `QueryRow`, `Exec`), batch
+or copy counts as one operation, regardless of statement count. `Query` ends at `Rows.Close`, including row processing;
+a no-row `QueryRow` is a success. Acquires add only wait time. Rankings use (site, shape) pairs; ties choose the smaller pair.
+A request with no operation and no acquire wait adds none of these fields; an acquire-only request gives four `none`
+strings and zero operation numbers. The first `LogAttrs` closes and caches the snapshot;
+later completions count only in site totals. `queryattr.Detach` hides the request, preserving cancellation, deadlines
+and other values. It applies at `workmetrics.Start`, sections trending refresh, both asynchronous subtitle-sync launches,
+and metadata auto-translation. Shared cache and singleflight fills keep the waiting request's attribution.
+A request line can include background work that overlaps it before the line is written.
+
+The Info event `slow or large database query` holds `site`, `shape`, `ns`, `statements`, `args`, `max_array` (`-1` if
+unavailable), allowlisted `outcome`, and `request` (whether it entered an open snapshot). `cause` is `slow`, `large`
+or `slow,large`. The node-wide limiter drops excess events; the next allowed event reports their count in `suppressed`.
+Log-drain inserts use `queryattr.Quiet`: they count in totals and metrics, emit no events and add no suppression count.
+
+Every enabled mode emits the Info `database query summary` each interval and once on shutdown, before the operational
+log drains and the pool closes. It holds window deltas (`queries`, `query_ns`, `errors`, `events_suppressed`), `interval_ns`,
+and up to ten (site, shape) rows each in `top_time` and `top_count`; rows hold `site`, `shape`, `calls`, `ns`, `errors`.
+`run` maps to a node only through the private startup line's `query_run`; `build` is the current build display.
+Enabled full nodes register `prairie_postgres_queries_total` and `prairie_postgres_query_seconds_total`, labeled only by `site`
+(at most two series per site); proxy and transcode nodes do not. Recording query, batch and copy dependency spans add
+`prairie.db.site` and `prairie.db.shape`.
+
+Memory is bounded by compiled pgx call lines (about 2,847 static sites), nine rows and two metric children per site,
+a 4,096-entry cache of site pointers and SQL hashes, and one PC-cache entry per walked PC in the binary.
+A request map holds one entry per touched row until the snapshot. Nothing retains SQL, arguments or errors.
+All defaults and caps are provisional:
+
+| Setting | Default |
+|---|---|
+| Slow operation | > 100 ms |
+| Arguments or array elements | > 1,000 |
+| Batch statements | > 100 |
+| Event limiter | 1 per second, burst 10 |
+| Summary interval and each top list | 15 minutes; 10 rows |
+| Shapes per site | 8 plus `other` |
+| Shape cache and stack buffer | 4,096 entries; 32 frames |
+
+Window cuts are approximate: concurrent completions can land in either window. Late work is absent from a closed
+request line; work begun before `Detach` keeps its request. Batch statements share one envelope time and outcome.
+Empty batches, copy setup failures and pgx `Exec` early returns after a failed deallocate are uncounted.
+
 ## Client experience and plugin coordination
 
 Server response bytes and first playable segments do not establish first frame
diff --git a/docs/architecture/outbound-address-guard.md b/docs/architecture/outbound-address-guard.md
index 6504553a60..7ce496a11a 100644
--- a/docs/architecture/outbound-address-guard.md
+++ b/docs/architecture/outbound-address-guard.md
@@ -1,8 +1,8 @@
 # Outbound address guard
 
 Some features make Prairie send HTTP requests to an address a user typed or a
-third party supplied: history import, webhook sync, notification webhooks, and
-collection posters set from a URL.
+third party supplied: history import, webhook sync, notification webhooks,
+collection posters set from a URL, and artwork URLs from metadata providers.
 The server sits on a network the user may not: a household LAN, or a cluster
 with its database, cache, transcode nodes, and a cloud metadata endpoint. An
 unchecked address lets anyone who can sign in probe that network from the
@@ -95,8 +95,10 @@ it. See [Notifications](notifications.md#trust-model-and-ssrf-guard).
 ## Artwork downloads
 
 Artwork Prairie downloads on its own (metadata refresh, image-cache jobs, person
-images) comes from Public addresses only (`imagecache`). An image an admin
-applies through `POST /api/v2/admin/items/{id}/images/apply` (and its v1
+images) comes from Public addresses only (`imagecache`). Provider artwork URLs
+are untrusted, so these downloads use the netguard transport too, checked on
+every dial and redirect; the cache keeps no address list of its own. An image
+an admin applies through `POST /api/v2/admin/items/{id}/images/apply` (and its v1
 counterpart) is trusted with the local network, like the import sources an
 admin configures. That covers a URL the admin typed and one picked from the
 provider list, since the server cannot tell them apart. The handler marks the
@@ -105,6 +107,30 @@ transport, which still refuses Blocked addresses on every dial and redirect.
 Only acting admins reach that route, so this does not widen what any other
 account can make the server request.
 
+## Serving catalog artwork
+
+Catalog artwork is not always in Prairie's own storage. A provider URL stays on
+the item until its image-cache job succeeds, and stays for good when caching
+fails, so an address the cache refused can still be served. Three places fetch
+catalog artwork themselves instead of handing the URL to the client: the
+jellycompat image proxy (Infuse, and requests with a proxy tag), offline
+download artwork, and collection collages. Each uses a netguard transport, and
+`artworkurl.FetchContext` decides the trust per URL:
+
+- A direct URL to the artwork store is trusted with the local network, where
+  S3-compatible storage often runs. It must match the scheme, host, and path
+  prefix (bucket and key prefix, or the read endpoint's path) of the URLs the
+  store's `DirectURL` issues, with no dot segments in its path.
+- Any other URL is Public only. A refused proxy request answers 502 and a
+  refused download asset reports the asset not found, so clients don't retry
+  it; neither returns anything from the refused address.
+
+Local artwork storage serves signed `/api/` routes on this server, which the
+proxy redirects to and downloads read from the store, so neither goes over
+HTTP. A provider URL under the artwork store's own prefix is trusted like a
+store URL. Trust carries across redirects, as for every netguard request, so
+the store is relied on not to redirect into the local network.
+
 ## Collection artwork
 
 Collection artwork downloads use the netguard transport with no fallback
@@ -121,9 +147,8 @@ client (`newCollectionImageClient` in `internal/api/handlers`):
   operations) are trusted with the local network, like an image an admin
   applies to an item. Only acting admins reach those routes.
 - **Collages.** A collage fetches its titles' posters as the server resolved
-  them, usually from its own artwork storage, which may be on the local
-  network. No request supplies those URLs, so the fetch is trusted with the
-  local network.
+  them. Those are artwork store URLs or uncached provider URLs, trusted as
+  described in [Serving catalog artwork](#serving-catalog-artwork).
 
 Blocked addresses stay refused in all three cases, on every dial and redirect.
 
@@ -135,3 +160,9 @@ answer, as it could from its own machine. In a container with bridge
 networking the server cannot see the host's public address, so a request to
 it is not recognized as the server's own. Run the container behind a firewall
 that also applies to traffic from the container if that matters.
+
+A resolver that answers public names with addresses netguard classes as
+Private makes those hosts unreachable for untrusted requests, provider artwork
+downloads included. Two setups do this: proxy routers in fake-IP DNS mode,
+which answer from `198.18.0.0/15`, and DNS64 on an IPv6-only network, which
+answers IPv4-only hosts with `64:ff9b::/96` addresses.
diff --git a/docs/architecture/playback-protocol-v3.md b/docs/architecture/playback-protocol-v3.md
index f00c3b8042..1f1883f7c8 100644
--- a/docs/architecture/playback-protocol-v3.md
+++ b/docs/architecture/playback-protocol-v3.md
@@ -98,7 +98,8 @@ the document is always the full one:
 {
   "enabled": true,
   "protocol_versions": [3],
-  "features": ["playback_plan_v3", "neutral_playback_v3_contract_v1", "embedded_subtitles_v1", "layout_aware_passthrough", "playback_route_diagnostics",
+  "features": ["playback_plan_v3", "server_remote_stream_bitrate_policy_v1", "server_local_stream_bitrate_policy_v1",
+               "neutral_playback_v3_contract_v1", "embedded_subtitles_v1", "layout_aware_passthrough", "playback_route_diagnostics",
                "device_quirks_v1", "seek_reanchor_v1", "output_change_v1", "output_display_evidence_v1", "direct_stream_resume_v1",
                "header_authenticated_media_v1", "authorized_media_origins_v1", "software_video_decode_v1",
                "plan_invalidated_v1", "plan_source_duration_v1"],
@@ -107,7 +108,7 @@ the document is always the full one:
 }
 ```
 
-The fifteen feature strings above are the full set this server version advertises on `/api/v1`. `/api/v2` advertises them plus `subrip_sidecar_v1`:
+The seventeen feature strings above are the full set this server version advertises on `/api/v1`. `/api/v2` advertises them plus `subrip_sidecar_v1`, `marker_thumbnails_v1`, and `hls_subtitle_renditions_v1`:
 
 | Feature | What it promises |
 | --- | --- |
@@ -127,6 +128,7 @@ The fifteen feature strings above are the full set this server version advertise
 | `plan_invalidated_v1` | The client can be told mid-session that the plan it is playing was withdrawn, over the realtime `plan_invalidated` command, and replans off it. A session that did not negotiate it is stopped instead (§6.1) |
 | `plan_source_duration_v1` | `source.duration_seconds` is populated when known, so its absence means *unknown* rather than *unsupported* (§5) |
 | `subrip_sidecar_v1` | `/api/v2` only. An opted-in client that parses SubRip itself receives external and downloaded SRT tracks as the original `.srt` file instead of the WebVTT conversion (§8) |
+| `hls_subtitle_renditions_v1` | `/api/v2` only. An opted-in client receives a `server_transcode_hls` plan's embedded text subtitle as a WebVTT `SUBTITLES` rendition of the plan's HLS stream (`subtitle.hls_rendition`) instead of a sidecar artifact (§8) |
 
 `plan_source_duration_v1` is the reason feature detection is a list and not a version
 number: without it, a client cannot tell a server that never sends the runtime
@@ -637,7 +639,10 @@ path does not inherit evidence from a different playback engine.
 `original_http` never receives normalized-remux evidence. An HDR10 claim can
 carry `hdr10_max_width`, `hdr10_max_height`, `hdr10_max_frame_rate`, and
 `hdr10_max_bitrate_kbps`; these ceilings keep a successful format probe from
-admitting an untested stream class.
+admitting an untested stream class. When the viewer turns on the web player's
+browser decode engine, `original_http` instead carries
+`client_managed_dynamic_range_v1` (when its WebGPU presenter works) and the engine tone-maps the
+original itself; see [web-decode-engine.md](web-decode-engine.md).
 
 ---
 
@@ -661,6 +666,18 @@ the server to remux the file. Without the claim, the historical default-track
 gate remains. A claiming client that cannot honor the identity reports a typed
 playback failure so the bounded replan ladder can choose a packaged route.
 
+A `server_remux_progressive` stream is forward-only: it has no byte ranges, and
+a request for it always starts at the plan's position. The server closes it
+after it makes no write progress for the stream stall window (see
+[streaming write deadlines](streaming-write-deadline.md)), which a paused
+client causes once its buffer is full. A client cannot resume such a stream
+where it stopped and has to open a new one at that position. The web player
+does this with a `seek_reanchor` replan (§6) when playback resumes after a
+minute idle, and falls back to its reconnect (§6.2) when the replan is refused.
+It does not do this in a watch-together room, whose transport the room
+controls; a room member who pauses past the stall window is not recovered this
+way.
+
 `client_playback_context.deliveries` is keyed by **class**, because a client's
 answer to "can you play HLS" does not differ between a remux and a transcode —
 the same player component handles both. The server folds its four values into
@@ -824,24 +841,31 @@ out of band, after which a client can retry or reload that URL with the new
 header.
 
 The signed playback token is what carries a reconstruction recipe across an
-API restart. Opting it out therefore also opts out of transparent session
-reconstruction: a missing in-memory session returns the normal expired/missing
-response and the client starts a fresh attempt. Once selected, this mode is
-sticky for the lifetime of the attempt; a client that can no longer honor it
-must stop and start a new attempt rather than downgrade a replan to a
-credential-bearing URL.
-
-**Replica affinity.** Because there is no reconstruction recipe, a
-header-authenticated attempt's session exists only in the memory of the API
-process that started it. A media request routed to any other replica finds no
-session and returns the expired/missing response, so a deployment serving
-tokenless attempts currently needs either a single API replica or session
-affinity on the media routes; legacy token-bearing attempts are unaffected,
-since they reconstruct anywhere. Proxy-origin URLs
-(`authorized_media_origins_v1`) are also unaffected: the proxy serves from the
-shared grant store rather than from an API process's memory. Moving session
-state into shared storage is the fix, and until it lands this constraint is
-part of the deployment contract.
+API restart, so an attempt without one keeps its recipe server-side instead.
+When a transport served from the API origin commits, the server records its
+recipe in Redis. A media or sidecar request that finds no in-memory session is
+rebuilt from that record, but only for an authenticated caller who owns the
+attempt (account and selected profile), and only while the durable attempt
+still names the recorded plan and has neither expired nor been stopped. The
+rebuilt session keeps requiring the client's own credential on every request.
+Without Redis, or once the record has lapsed with the 24 h token lifetime, a
+missing in-memory session returns the normal expired/missing response and the
+client starts a fresh attempt. Once selected, this mode is sticky for the
+lifetime of the attempt; a client that can no longer honor it must stop and
+start a new attempt rather than downgrade a replan to a credential-bearing URL.
+
+**Replica affinity.** The recorded recipe lets a restarted API process rebuild a
+header-authenticated session, and another replica can rebuild it the same way.
+A deployment with several API replicas should still keep session affinity on
+the media routes for these attempts: a replica that holds an idle copy of the
+session ends its transcode when that copy expires, and nothing in a tokenless
+request can start it again on the node. Without Redis the session exists only in
+the memory of the API process that started it, so it needs a single API replica
+or session affinity. A transcode the API executes itself (no transcode node) is
+only safe with one API replica or session affinity in any case: each replica
+that rebuilds it starts its own FFmpeg. Proxy-origin URLs
+(`authorized_media_origins_v1`) are unaffected: the proxy serves from the shared
+grant store rather than from an API process's memory.
 
 ### 4.2 Media and subtitle URL query parameters
 
@@ -852,8 +876,8 @@ parameter, and never carries a parameter across families.
 
 | Route family | Routes | Query parameters |
 | --- | --- | --- |
-| Media | `/stream/{session_id}`, `/playback/transcode/{session_id}/master.m3u8` and its segments | `seek` — the progressive-remux start offset in seconds, present only when it is non-zero; `hls_vars=1` on the HLS manifest of an attempt that advertised `hls_variable_substitution_v1` (below) |
-| Media on a designated origin | `{proxy}/stream/v3/{session_id}`, `{proxy}/stream/v3/{session_id}/master.m3u8` and its `segment/{name}` children (§4.1) | `seek` and `hls_vars`, with the same meanings; these routes never accept a credential parameter of any kind |
+| Media | `/stream/{session_id}`, `/playback/transcode/{session_id}/master.m3u8` and its segments | `seek` — the progressive-remux start offset in seconds, present only when it is non-zero; `hls_vars=1` on the HLS manifest of an attempt that advertised `hls_variable_substitution_v1` (below); `prairie_rendition=video` or `prairie_rendition=subtitles` on the `master.m3u8` URIs that a subtitle rendition's multivariant playlist emits (§8) |
+| Media on a designated origin | `{proxy}/stream/v3/{session_id}`, `{proxy}/stream/v3/{session_id}/master.m3u8` and its `segment/{name}` children (§4.1) | `seek` and `hls_vars`, with the same meanings, plus `prairie_rendition` on the multivariant playlist's own `master.m3u8` URIs as above; these routes never accept a credential parameter of any kind |
 | Subtitle artifact | `/stream/{session_id}/subtitles/{combined_index}{.ext}`, `/stream/{session_id}/subtitles/{combined_index}/fonts` | `file_id`, always; one identity pin: `embedded_stream_index`, `external_subtitle_key`, or `downloaded_subtitle_id` (§8); `original=1` on an original-SRT `.srt` URL (§8). VTT receivers may explicitly request `timestamp_offset` in seconds |
 
 A media route never carries `file_id` or `downloaded_subtitle_id` — the session
@@ -907,6 +931,19 @@ Three shapes exist:
 position, `can_seek_anywhere` is true when the runtime is known, and
 `seek_restoration` is `player_position` — the client seeks locally.
 
+Source positions count from the start of the file: the container's first
+timestamp is position 0. Most files start at timestamp zero, but MPEG-TS
+recordings and files remuxed from them can start seconds (or more) in. Plan positions, playlist time,
+subtitle tracks, and subtitle windows (`?position=&duration=`) are all on this
+container-relative timeline. Encoded HLS segments can still carry the source's
+own timestamps, so place them by playlist time, not by their PTS.
+A direct-play engine may keep the container's own timestamps instead:
+Chrome does for Matroska, reporting `currentTime` equal to the container start
+time at its first frame. Such a client must subtract that origin as part of its
+timeline offset, or subtitles, seeks, and reported positions drift by it. The
+web player reads the origin from `currentTime` at `loadedmetadata`, before it
+seeks to `player_start`.
+
 **Copy remux over HLS** is served from FFmpeg's live, still-growing playlist,
 which starts at the preceding keyframe selected by FFmpeg's input seek.
 For HEVC HDR copy packaging, the frozen plan also controls the sample entry: a
@@ -988,7 +1025,7 @@ commentary track.
 
 Omitting `quality_preference` on any replan preserves the session's current
 preference; sending it replaces that preference. A track change therefore does
-not silently reset `original` or a pinned rung, and failure recovery does not
+not silently reset a pinned rung, and failure recovery does not
 discard the viewer's requested quality unless the client explicitly asks it to.
 Clients should still send the current preference when they know it, so their
 intent remains explicit in diagnostics.
@@ -1007,11 +1044,14 @@ fallback to another media version must remap the selected subtitle. It
 prefers a version with an equivalent track; when none has one, playback
 continues with subtitles off and the plan carries `subtitle_track_unavailable`
 rather than ending in a terminal. A selection the effective file cannot honor
-on a direct start degrades the same way. A replan that would have to drop the
+on a direct start degrades the same way. When the file being planned was
+refused with `subtitle_conversion_unsupported` and the only other versions that
+play drop the subtitle, the server plays that file with subtitles off instead
+of moving to one of them, provided that plan can run; when no other version
+plays, the terminal stands. A replan that would have to drop the
 subtitle to return to the requested version stays on the version already
-playing, unless quality `original` pins the requested version; the requested
-version remains a fallback without the subtitle if no version that keeps it can
-play. Malformed
+playing; the requested version remains a fallback without the subtitle, ahead of any other version
+without it, if no version that keeps it can play. Malformed
 selections (a track identity that does not parse or names another file, or a
 negative index) are still rejected.
 
@@ -1026,8 +1066,8 @@ seek is not an authority boundary for replacing the client's declared abilities
 mid-session.
 
 **Attempt-sticky features.** `client_features` is otherwise refreshed by any
-replan that sends it, but four entries are fixed by the start negotiation and a
-replan can neither add nor drop them:
+replan that sends it, but the entries below are fixed by the start negotiation
+and a replan can neither add nor drop them:
 
 | Feature | Why it is fixed |
 | --- | --- |
@@ -1035,6 +1075,7 @@ replan can neither add nor drop them:
 | `authorized_media_origins_v1` | It selects which origins may serve the attempt's media. A plan that already handed out a proxy origin outlives the replan that would revoke it, so the client would be left holding a URL it no longer trusts (§4.1) |
 | `software_video_decode_v1` | It widens the direct-play evidence tiers. Dropping it converts a direct route into a transcode and persists that downgrade into the durable request |
 | `subrip_sidecar_v1` | It picks the representation of every SRT sidecar URL. A mid-attempt switch would publish one track under two URLs (§8) |
+| `hls_subtitle_renditions_v1` | It decides whether a transcode's stream URL is a multivariant playlist carrying the subtitle or a media playlist beside a sidecar. A reused HLS transport keeps the shape it was built with (§8) |
 
 The server silently restores the negotiated state of each, whatever the replan
 sends — including an explicit list that omits one, which is otherwise a valid
@@ -1212,6 +1253,20 @@ route, so a direct-play viewer would come back on a transcode. The web player
    the connection was lost and offers to try again. Leaving the player or
    starting other playback cancels the cycle.
 
+Keeping the current route eligible does not mean keeping a dead node. Every
+replan except `seek_reanchor` first asks the session's transcode node and egress
+proxy whether they answer, with a two-second bound. A node that does not answer
+is left out of that replan's plan and route: its capabilities don't count, its
+running transport is not reused even by a `track_change` that changes nothing,
+and the replacement starts elsewhere. A `failure_recovery` or
+`seek_failure_recovery` from such a node doesn't exclude the failed plan's key
+either: the node failed, not the recipe, so the same recipe can run on another
+node. If the dead node was the only proxy a progressive remux could use, the
+remux has no route left and is planned as HLS on a transcode node instead. The
+pool's health flag cannot be trusted for this: it changes only at the next health
+sweep, up to 30 seconds after the node went away, and until then the node still
+looks healthy.
+
 A network failure before a transport's own first frame stays on the ordinary
 failure path, even when an earlier transport of the same viewing played: the
 new route may be one this client cannot reach. If that recovery then cannot
@@ -1230,9 +1285,10 @@ must not branch on an unrecognized value.
 `hls_audio_adaptation`, `hls_packaging_required`, `subtitle_burn_in_required`,
 `client_dv7_to_dv81`, `client_dv7_to_hdr10`, `client_managed_dynamic_range`,
 `client_dv8_base_layer`, `evidence_insufficient_for_direct`,
-and the quality reasons `quality_original`, `quality_auto_source`,
-`quality_fixed_rung`, `quality_device_limit`, `quality_bandwidth_limit`,
-`quality_metered_limit`, `quality_bandwidth_cap`.
+and the quality reasons `quality_auto_source`, `quality_fixed_rung`,
+`quality_device_limit`, `quality_bandwidth_limit` (a measured estimate could
+not carry the source), `quality_bandwidth_cap`, and `quality_original` (an
+automatic reduction could not run, so the source size was kept).
 
 ### 7.2 Degradation warnings
 
@@ -1253,7 +1309,7 @@ The plan will play, but something the user might notice was given up.
 | `bandwidth_cap_applied` | `bandwidth_cap_kbps` limited the selection |
 | `evidence_insufficient_for_direct` | Evidence tier blocked a direct route |
 | `audio_track_unavailable` | The selected audio track is not on the effective file; its default track plays |
-| `subtitle_track_unavailable` | The selected subtitle has no equivalent on the effective file; playback starts with subtitles off |
+| `subtitle_track_unavailable` | The selected subtitle has no equivalent on the effective file, or is on it but cannot be shown there; playback continues with subtitles off. `message` says which |
 
 ### 7.3 Terminal reasons
 
@@ -1385,7 +1441,7 @@ transcodes it to a client-renderable format first — always to WebVTT, served a
 `text/vtt` at a `.vtt` URL), or `burn_in` (rendered into the video, which forces
 a transcode).
 
-`subtitle.artifact` describes the selected sidecar. A `render` decision carries either `artifact` or `embedded`, never both; `convert` carries an artifact. Under `off` and `burn_in` both are absent, and every plan states this afresh: an artifact is never carried over
+`subtitle.artifact` describes the selected sidecar. A `render` decision carries exactly one of `artifact`, `embedded`, or `hls_rendition`; `convert` carries an artifact or an `hls_rendition`. Under `off` and `burn_in` all three are absent, and every plan states this afresh: an artifact is never carried over
 from an earlier plan of the same session, so a client must take the current
 plan's `subtitle` block literally rather than remembering the previous one.
 `off` also carries no `subtitle.track_id`. The inventory `url`s are unaffected
@@ -1408,7 +1464,7 @@ Native embedded selection requires `embedded_subtitles_v1` in `client_features`
 
 The scanner records `container_track_id` as the MP4 track ID (`tkhd`) that FFprobe reports and, for Matroska, as the TrackEntry's `TrackNumber`, which FFprobe does not report. The scanner reads the Matroska `Tracks` element itself and maps each entry to its FFmpeg stream the way FFmpeg's demuxer creates streams. It records a number only when the per-type stream counts, the subtitle positions, and the subtitle codecs all agree with the probe. A track number is often not stream index + 1, because remuxes keep the original numbers. Tracks with the legacy codec IDs `S_ASS` and `S_SSA` get no ID: FFmpeg reports them as `ass`, but Media3 drops them, so a client could not resolve the number and its capability cannot exclude them. Files probed before Matroska numbers were recorded get them from the `backfill_matroska_track_numbers` task, which reads only the `Tracks` element and writes only when the file and the row still match the stored probe. It reads only files with a SubRip or ASS track lacking an ID, the codecs a client currently plays by track number, and records each file it reads in `matroska_track_backfill_checks` against the file's size, mtime and stored tracks. A recorded file is read again only after one of those changes or the matching rules do; a file storage could not open, or that differs on disk from its row until a scan rewrites it, is retried on the next start. A file skipped for its codecs, such as a PGS-only one, gets an ID from its next reprobe, or from the backfill once its codec is added to that list. Container and codec support must match; authored ASS preservation additionally requires styling and font support. The old `embedded_text` flag alone never authorizes native selection. Text sidecar rendering depends on `sidecar_text`, regardless of the source being embedded or external.
 
-The native decision is `subtitle: {"mode":"render", "track_id":"file:42:subtitle:0", "embedded":{"stream_index":3,"container_track_id":"4"}, "inventory":[...]}`. The client selects that exact stream from the original media and does not mount the inventory's fallback URL. Native selection applies only to `original_http`; remux and transcode plans use sidecars or burn-in. Inventory `delivery` continues to describe the available server representation, so even a `burn_in_only` entry can be selected natively when the client attests the exact bitmap codec.
+The native decision is `subtitle: {"mode":"render", "track_id":"file:42:subtitle:0", "embedded":{"stream_index":3,"container_track_id":"4"}, "inventory":[...]}`. The client selects that exact stream from the original media and does not mount the inventory's fallback URL. Native selection applies only to `original_http`; remux and transcode plans use sidecars, burn-in, or, for a transcode, an HLS subtitle rendition (below). Inventory `delivery` continues to describe the available server representation, so even a `burn_in_only` entry can be selected natively when the client attests the exact bitmap codec.
 
 A confirmed native selection failure triggers `failure_recovery` with `failure.classification: "subtitle_embedded_failed"`. The server disables native selection for the rest of that playback attempt, including later capability refreshes, and replans with an executable fallback. The native identity participates in both plan identifiers, so the same video route with extracted subtitles is a distinct attempt. Seek reanchors preserve the native identity and reject source drift.
 
@@ -1420,6 +1476,78 @@ The artifact `format` and `mime_type` describe served bytes, independently of th
 
 A client that sends `subrip_sidecar_v1` in `client_features` to `/api/v2` receives external and downloaded SRT tracks as the original file instead: the inventory URL is `.srt` with `original=1`, a `render` artifact uses that URL and reports `format: "srt"` and `mime_type: "application/x-subrip"`, and the bytes are the SRT exactly as stored. A `convert` artifact stays WebVTT at `.vtt`. Embedded SRT tracks keep their existing representation. A `.srt` request without `original=1`, and any request on the frozen `/api/v1` route, keeps the historical WebVTT response. `/api/v1` neither advertises nor negotiates the feature. The feature is attempt-sticky (§6). Realtime subtitle events publish the same representation as the session's current plan, and every replan, including a seek reanchor, keeps the representation the current plan published, even when the attempt started on a server that did not know the feature.
 
+**HLS subtitle renditions.** A whole-file sidecar of an embedded track has to
+demux the entire source, because Matroska interleaves subtitle packets and
+indexes only video; on network storage that outlasts a player's readiness
+deadline. A client that sends `hls_subtitle_renditions_v1` to `/api/v2` instead
+receives such a track inside the transcode itself. It applies when all of these
+hold:
+
+- the plan is `server_transcode_hls` (encoded video, never a copy remux);
+- the selected track is embedded text the policy already shows as text
+  (`render` or `convert`): SubRip, WebVTT, mov_text, or ASS/SSA unless the
+  client requires authored fidelity;
+- the source duration is known and the playlist fits the synthetic VOD bound;
+- an executor can emit it: this server, or a transcode node advertising the
+  `hls_subtitle_rendition_v1` transport feature. Node selection then admits only
+  such nodes, and a node that does not attest `subtitle_rendition` in its start
+  response is stopped and skipped.
+
+The decision is `subtitle: {"mode":"render", "track_id":"file:42:subtitle:2",
+"hls_rendition":{"group_id":"subs","name":"Subtitles","format":"vtt",
+"mime_type":"text/vtt"}, "inventory":[...]}`, with no `artifact` and no
+`embedded`. The inventory keeps every sidecar URL, so another selection still
+has one. The plan's stream URL is then a multivariant playlist: one
+`EXT-X-MEDIA:TYPE=SUBTITLES` rendition in group `group_id` (`DEFAULT=YES`,
+`AUTOSELECT=YES`) and one variant naming it in `SUBTITLES`. Both URIs are the
+same `master.m3u8` with `prairie_rendition=subtitles` or `prairie_rendition=video`
+and the original query, so every relay path serves them unchanged. The video
+playlist is the ordinary synthetic VOD playlist; the subtitle playlist lists
+the same segments (`segment/sub_NNNNN.vtt`) with the same durations. The client
+selects the rendition in the player's subtitle (legible) group and fetches no
+sidecar. A client that scopes its media credentials to the plan's URLs must
+admit `master.m3u8` with exactly one `prairie_rendition=video` or
+`prairie_rendition=subtitles` query, or the player cannot open either playlist.
+
+The transcode's own FFmpeg process writes the track as WebVTT beside the HLS
+output, on the same `-copyts` source clock, so a cue is on disk once the video
+around it is. Subtitle segment N carries every cue overlapping the source
+time video segment N covers, `[O + (N−K)·d, O + (N−K+1)·d)`, with its absolute
+source time and settings; a cue spanning segments repeats in each. K is the
+segment the generation started at and O the source time of its first video
+frame, read once per generation from that segment's first video PTS less the
+timestamp-map shift below. O is not `K·d` when the source clock does not start
+at zero: the first generation's grid starts at the first video frame, while an
+input seek counts from the container's start time. On MPEG-TS, whose
+timestamps wrap at 2^33 ticks, O takes the cue clock's epoch, and every window
+of the generation keeps it. A
+generation's output is read only while no restart is under way and no later
+generation has rewritten it; a generation whose origin cannot be read uses
+`[N·d, (N+1)·d)`. Every segment starts with
+`X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:<offset>`, where `<offset>` is the
+video segments' shift from the source clock: 900000 (10 s) for MPEG-TS and 0
+for fMP4. A segment whose cues are not produced yet is waited for while
+FFmpeg runs: as long as its video segment would be (up to 30 s) when the
+running or restarting transcode is about to reach it, otherwise a few seconds.
+It is then answered as a valid WebVTT document with no cues, which a player
+keeps, so the longer wait is what keeps cues after a slow seek restart.
+Subtitle segments never return `503` and never trigger a seek restart. Each seek restart writes a new cue file and
+keeps the earlier ones, so a backward seek into output an earlier generation
+produced keeps its cues. Bitmap tracks keep their sidecar or burn-in routes.
+
+The rendition is part of the transcode recipe. Turning subtitles on or
+choosing another track therefore starts a new HLS generation at the current
+position, like a burn-in change; turning them off keeps the running transport,
+whose playlist still offers the old rendition for the client to leave
+unselected. A rendition plan and the sidecar plan for the same track have
+different plan identifiers, so `failure_recovery` after a failed rendition
+falls back to the sidecar instead of `adaptation_exhausted`. A client whose
+player never offered the rendition sends that recovery with
+`failure.classification: "subtitle_hls_rendition_failed"`; the server then
+stops offering renditions for the rest of the attempt, so a later quality or
+track change does not repeat the failure. The feature is
+attempt-sticky (§6); `/api/v1` neither advertises nor negotiates it.
+
 An embedded `hdmv_pgs_subtitle`/PGS sidecar is lossless binary PGS at a `.sup`
 URL with `application/octet-stream`; cached full-track responses support `HEAD`
 and byte ranges. Text conversion is always WebVTT at `.vtt`, while lossless
@@ -1483,9 +1611,10 @@ does not publish its preimage.
 selection, sends a `quality_change` replan with the entry's `label`. It does not
 compute rungs.
 
-The source rung is always present, labelled `original`, with
-`preserves_source: true`. On `/api/v2` it also carries `display_name`
-`Original`; the frozen `/api/v1` response leaves it unnamed. Transcode rungs are added below the source resolution
+On `/api/v2` the menu lists only fixed rungs. The source is not an entry,
+because `auto` already returns to it. The frozen `/api/v1` response still leads
+with an unnamed source entry labelled `original` (`preserves_source: true`),
+which now selects `auto`. Transcode rungs are added below the source resolution
 class, plus at the same class when they reduce bitrate, and only when HLS is
 available to the client, transcoding is enabled, the viewer's account may
 transcode video (`transcode_allowed`; admission still enforces it), and 4K
@@ -1508,16 +1637,17 @@ remux without video encoding.
 
 A 4K version whose 4K transcoding is disabled takes its lower qualities from a
 lower-resolution version instead, when the item has one and the request allows
-version fallback. The menu is then `original` (the requested 4K version), the
+version fallback. The menu then lists the
 first non-4K version in fallback order at its plain resolution class (`1080p`
 or `720p`, with that version's height and bitrate; omitted when the version is
 taller than its class or the requested version is not taller than it), and the
-rungs a transcode of that version can serve. When that version cannot play and
+rungs a transcode of that version can serve (`/api/v1` also leads with
+`original`, the requested 4K version). When that version cannot play and
 the fallback adopts a later non-4K version, the plan it returns describes the
 version it adopted.
 Choosing any of them refuses the 4K source, so the fallback plays the lower
 version: unchanged for its plain label or a rung it fits, transcoded for a lower
-rung. `original` returns to the 4K version. The menu stays the same while the
+rung. `auto` returns to the 4K version. The menu stays the same while the
 lower version plays. It needs HLS and transcoding enabled, because the 4K
 refusal under any other policy is not one the fallback acts on.
 
@@ -1551,32 +1681,69 @@ clamp their bitrate but does not silently demote their resolution. Plain labels
 remain accepted for stored/default preferences and size their output like
 `auto` below.
 
-`auto` picks its resolution from the shared bitrate ladder
-([quality-ladder.md](quality-ladder.md)): 80% of the bandwidth estimate or cap
-earns a class for the source's frame rate. A source whose height already fits
-the class is sent as-is when its bitrate allows, even when it is wider than the
-16:9 box (a 2560x1080 film at the 1080p class). Otherwise automatic and
-plain-label targets fit the source into that class's 16:9 box, so a 3840x1600
-film at the 1080p class streams at 1920x800, and encode at the class bitrate: 20000 kbps for 2160p, 6000
-for 1080p, 2000 for 720p, 1800 for 540p and 1500 for 480p, never above that 80%
-budget. A source that already fits the class but whose bitrate exceeds 80% of the
-bandwidth estimate is re-encoded at its own size within that budget rather than
-sent as-is; a source of unknown bitrate counts as needing its class's full
-bitrate. Under a cap, a source over the cap itself is re-encoded, and so is a
-video source of unknown bitrate, since it cannot be shown to fit. A transcode
-also never targets more than the source's own bitrate, counted in the output
-codec (H.264 for a scaled encode, or HEVC for any encode when the planner
-chooses HEVC).
+`auto` is best-effort direct play. It sends the source as-is unless the device
+rules it out, through a `max_resolution` below the source or decode
+capabilities the source does not fit, or the source's bitrate exceeds 80% of a
+measured `bandwidth_estimate_kbps`. A source that fits that budget is sent as-is
+at any resolution; the estimate only lowers a source the link cannot carry.
+Without an estimate `auto` assumes the link can carry the source. `metered` is
+accepted from older clients and ignored: a client on a cellular link sends its
+cellular quality as `quality_preference` and `bandwidth_cap_kbps` instead. A
+fixed rung or plain resolution never reads the estimate, so a viewer who wants
+the source whatever the estimate says picks a resolution. `original` used to be
+that choice; it is now an alias of `auto`.
+
+A source over the estimate's budget, or over `bandwidth_cap_kbps`, is
+re-encoded at the class that 80% of the estimate or cap earns on the shared
+bitrate ladder ([quality-ladder.md](quality-ladder.md)) for the source's frame
+rate. A source of unknown bitrate counts as needing its class's full bitrate
+against an estimate, and is always re-encoded under a cap, since it cannot be
+shown to fit. A source whose height already fits the earned class keeps its own
+size, even when it is wider than the 16:9 box (a 2560x1080 film at the 1080p
+class). Otherwise automatic and plain-label targets fit the source into that
+class's 16:9 box, so a 3840x1600 film at the 1080p class streams at 1920x800,
+and encode at the class bitrate: 20000 kbps for 2160p, 6000 for 1080p, 2000 for
+720p, 1800 for 540p and 1500 for 480p, never above the estimate's 80% budget or
+the cap. A transcode also never targets more than the source's own bitrate,
+counted in the output codec (H.264 for a scaled encode, or HEVC for any encode
+when the planner chooses HEVC).
+
+`bandwidth_estimate_kbps` is optional and is the client's belief about its
+link, not a promise. An absent estimate removes the bandwidth term entirely, so
+`auto` plans from the device and the source alone; a client should omit the
+field rather than send a hint it knows is clamped, such as a browser's
+`navigator.connection.downlink`, which Chromium caps at 10 Mbps. Clients that
+can measure use the `/api/v2` bandwidth probe ([playback-api.md](../playback-api.md#bandwidth-probe)).
+
+A transcode is a single HLS rendition, so the player cannot step down on its
+own. A client on `auto` whose playback keeps rebuffering sends a
+`quality_change` replan that keeps `quality_preference: "auto"` and lowers
+`bandwidth_estimate_kbps` below the bitrate that stalled; the planner then
+re-runs `auto` against the lower estimate. The web player does this after two
+stalls of at least a second within two minutes, or one stall of six seconds.
+Stall time in the first ten seconds of a plan does not count, and buffering
+caused by a seek, pause or source reload is not a stall. It sends 70% of the
+delivered bitrate, so the next stream targets about 56% of the one that
+stalled. It keeps that lower estimate for the next 30 minutes. When the plan
+that follows is no lower, it leaves that plan alone for five minutes rather than
+replan in a loop. On a metered link it uses the estimate only if
+the stall was observed on the same kind of metered link, by the browser's
+connection type and Data Saver setting, since probe results and observations
+from other links do not describe it; back on an unmetered link it ignores a
+limit recorded on a metered one. Buffering while media requests fail (load
+errors, not timeouts) or while the browser is offline is an outage for the
+reconnect path and never counts toward a downshift.
 
 Registry availability is deliberately *not* consulted when building the menu: a
 capability check there could trigger lazy node fetches that a source-preserving
 start must never pay for. A rung whose toolchain turns out to be missing degrades
 to a retryable terminal at replan time instead.
 
-Audio-only sources publish a single `original` rung — quality rungs are a video
-concept.
+Audio-only sources publish no rungs on `/api/v2` (a single `original` entry on
+`/api/v1`), since quality rungs are a video concept.
 
-`quality_preference` accepts `auto`, `original` (aliases `source`, `max`), the
+`quality_preference` accepts `auto`, the legacy `original` (aliases `source`,
+`max`), which means `auto`, the
 plain `2160p` / `1080p` / `720p` / `480p` values with their obvious aliases
 (`4k`, `uhd`, `fhd`, `hd`, `sd`), and the compound labels in the table above.
 An unrecognized value normalizes to `auto` and the response carries the
@@ -1675,6 +1842,8 @@ or older node advertisement is rejected instead of silently changing modes.
 Dolby Vision compatibility IDs `1` through `6` resolve to their declared
 standards-compatible base layer: `1` and `6` are PQ, `2` is BT.709 SDR, `3` is
 legacy BT.709-gamut HLG, `4` is BT.2100 HLG, and `5` is BT.2020 SDR.
+A plain HLG source resolves to BT.2100 HLG, or to the BT.709-gamut HLG kind
+when its primaries and matrix are both tagged BT.709.
 Profile 5 and ID `0` carry a base only the stream's RPU can map to PQ, so they
 resolve to the `dolby_vision` source kind. Only executors that apply the RPU
 advertise it: software `tonemapx`, QSV `tonemap_opencl`, and NVENC
diff --git a/docs/architecture/postgres-search.md b/docs/architecture/postgres-search.md
index 73d35a4606..ca18b41117 100644
--- a/docs/architecture/postgres-search.md
+++ b/docs/architecture/postgres-search.md
@@ -40,15 +40,30 @@ stored representation.
 
 ## Ranking, counts, and continuation
 
-The relevance order is exact title, contiguous title, year hint, phrase rank,
-title prefix rank, overview rank, lower title, and content ID. A media title
-also counts as exact when it is the query followed by the item's own year, as
-providers title remakes and reboots ("Castle (2009)"); short whole-title
-admission accepts that form too. Episode titles have no year of their own and
-do not use this rule. Access filtering
-precedes results, and any accessible title or alias match suppresses the entire
-overview family. Overview matches must meet the existing rank floor. This gate
-applies to the complete family, including on later cursor pages.
+The relevance order is exact title, title position, year hint, phrase rank,
+title prefix rank, overview rank, lower title, and content ID. Title position
+is 2 when a title, original title, sort title, or alias starts with the query,
+1 when it contains the query, and 0 otherwise. When a title variant contains
+the query, title prefix rank is `1 / (1 + words)` of the shortest such variant,
+so shorter titles rank first. Otherwise it is `ts_rank_cd` divided by document
+length (normalization 2), as is phrase rank. Cover density adds a cover for
+each repeat of a query word, so it ranked "From Star Wars to Star Wars" above
+the films and an alias "The Godfather & the Lady" above "The Godfather 2". The
+episode exact tier computes the same rank for its constant prefix score. A
+media title also counts as exact when it is the query followed by the item's
+own year, as providers title remakes and reboots ("Castle (2009)"); short
+whole-title admission accepts that form too. Episode titles have no year of
+their own and do not use this rule. Access filtering precedes results, and any
+accessible title or alias match suppresses the entire overview family.
+Overview matches must meet the existing rank floor. This gate applies to the
+complete family, including on later cursor pages.
+
+Ranks are `float8`. A cursor carries each key as text and seeks with it cast
+to `numeric`; PostgreSQL compares that with a `real` rank as `float8`, so a
+`real` key such as 2.4 never equals itself, and continuation skipped or
+repeated rank ties. `postgresCursorConfig` names the meaning of the keys;
+change it with any ranking change so older cursors are rejected
+(`invalid_cursor` in `/api/v2`, `catalog_cursor_changed` in `/api/v1`).
 
 Title and alias lookups produce an indexed union of candidate IDs before media
 policy checks and scoring. Media library checks remain correlated with those
@@ -105,6 +120,33 @@ use the root `window_cursor` with `seek`, which may scan the ordered prefix and
 requires another boundary query. The wire contract and live-data continuation
 rules are documented in `docs/catalog-api.md`.
 
+## Typo fallback
+
+A first page with fewer than five FTS hits adds trigram typo candidates for
+queries with a word of four or more characters. PostgreSQL matches the query's
+words other than stopwords (the whole query when none has four characters)
+against title and alias trigrams and returns up to 500 candidates by trigram
+rank. With "the", "the godfathr" admitted a quarter of a 190,000-title catalog
+and ran close to the three-second search deadline. Whole-query similarity
+favors short titles, so a long title containing every word can rank in the
+hundreds. The whole-title similarity floor below still compares the full query.
+The server scores each candidate's title and up to eight aliases word by word:
+the four most similar to the query and the four covering the most query words,
+since similarity also ranks a long alias with every word below short aliases
+with one. It allows 0 edits for words of up to two characters, 1 for three to
+five, and 2 for longer words (Elasticsearch's fuzziness AUTO). A word may also
+match two adjacent title words joined, at one extra edit for ranking only.
+Stopwords ("the", "a", "of", and similar) take no edits and need not appear. A
+candidate is kept only when it matches every other query word, as
+Elasticsearch's AND operator and Meilisearch's `all` strategy require. When no
+candidate matches every word and FTS found nothing, the candidates missing the
+fewest words remain, as Typesense's token dropping does; a candidate matching
+only stopwords never does. When FTS found hits, candidates also need
+whole-title similarity of at least 0.45, and none is kept unless it matches
+every word. At most 50 typo rows follow the FTS hits; the total is inexact when
+candidates or kept rows were capped. The offset and cursor paths share this
+scoring and admission.
+
 ## Card enrichment
 
 Catalog and section badges select a file winner in SQL and decode only that
diff --git a/docs/architecture/realtime-monitoring.md b/docs/architecture/realtime-monitoring.md
index aed3e82571..c9b0573d84 100644
--- a/docs/architecture/realtime-monitoring.md
+++ b/docs/architecture/realtime-monitoring.md
@@ -29,7 +29,10 @@ operations are in `internal/apiv2/library_monitoring.go` and are described in
 Two switches control monitoring:
 
 - `scanner.realtime_monitoring`, the server-wide switch (default `true`). It
-  hot-reloads through the config watcher and needs no restart.
+  hot-reloads through the config watcher and needs no restart. Admins turn
+  monitoring on or off per library, so Library & Metadata shows this switch
+  only while it is saved off, which is where the library editor sends an admin
+  to turn it back on.
 - `media_folders.realtime_monitoring`, the per-library switch (default `true`
   for existing and new libraries). It is exposed on `/api/v2/libraries` only;
   the frozen `/api/v1` routes neither return nor change it.
diff --git a/docs/architecture/recommendations-evaluation.md b/docs/architecture/recommendations-evaluation.md
new file mode 100644
index 0000000000..0ca0d0ea60
--- /dev/null
+++ b/docs/architecture/recommendations-evaluation.md
@@ -0,0 +1,167 @@
+# Evaluating recommendations
+
+This document defines the measurements used to judge recommendation output
+against the Recommendations acceptance criteria in issue #1139: AC1 (a
+personalized, varied set per profile, refreshed in the background, with
+sensible choices for a new profile) and AC2 (clients render the output, and a
+default row instead of an empty shelf when there is none). It elaborates AC1
+and AC2 and does not change them. It sets no pass or fail values: the
+validators agree those on the validation tasks before they test.
+
+Every metric is computed from `/api/v2` responses as the acting profile sees
+them, so it measures what clients receive rather than internal state, and it
+does not depend on the engine's weights. `scripts/recs-probe/capture.sh`
+captures the responses and prints the numbers; see [Probe](#probe). How rows
+are built and served is in [recommendations.md](recommendations.md).
+
+## Terms
+
+- **Served window.** The first 20 cards of a row as v2 returns it with
+  `limit=20`, the default. Section pages (`getRecommendationSection`) return up
+  to 60 cards and are not served windows.
+- **Personal row.** A row whose `type` is `cluster` (the main For You row from
+  `getForYouMain` and the "Because you enjoy …" rows) or
+  `similar_users_liked`. Other row types are server-wide. `getForYouMain`
+  answers `200` with `items: []` when the profile has no row, so a check of
+  the main row's `type` or `title` must also check that it has cards.
+- **Upcoming card.** A Discover card with an `upcoming_event` announces an
+  airing; it is not a recommendation and every metric leaves it out.
+- **History.** The profile's items in `listHistory` (`GET /api/v2/history`)
+  whose `watch.completed` is true, plus its `listFavorites` items, each counted
+  once. Taste-seed picks are favorites. History cards for episodes are their
+  series, as recommendation cards are.
+- **History genre share.** For genre g, the share of history items that carry
+  g. The profile's top genres are those with the largest shares.
+- **Accessible catalog.** What `listCatalogItems` (`GET /api/v2/catalog`)
+  returns for the profile, which applies its access. Its `total` counts it;
+  `type` and `genre` narrow it, one media type and one genre per request.
+
+## Personalization
+
+**Overlap between profiles.** For two profiles on one account, the Jaccard
+index of their served main rows: shared cards divided by distinct cards, by
+`content_id`. The same index over the union of each profile's personal rows
+(the main row, `listForYouRows` and the personal rows of `getDiscover`) shows
+whether the rest of the page is shared. #1139 notes that profiles need not
+have disjoint sets.
+
+**On-taste share and lift.** For each of the profile's top two history genres
+g, compute per media type (movie, series):
+
+- served share: the share of served main-row cards of that type that carry g;
+- catalog share: `total` of `GET /api/v2/catalog?type=<type>&genre=<g>&limit=1`
+  divided by `total` of `GET /api/v2/catalog?type=<type>&limit=1`;
+- lift: served share divided by catalog share.
+
+A lift near 1 means the row carries g no more often than the profile's
+catalog does. A genre that most of the catalog carries cannot reach a high
+lift, so read the served share against the history share as well.
+
+## Variety
+
+**Genre shares.** The share of served main-row cards carrying each genre,
+against the history genre shares.
+
+**Amplification.** The served share of the served row's top genre minus that
+genre's history share. Positive values mean the row concentrates on the top
+genre more than the history does.
+
+**Taste coverage.** For each top history genre, the number of served main-row
+cards carrying it, and whether a cluster row on the page names it in its
+title. A profile with two distinct tastes shows whether both reach the page.
+
+## Repetition
+
+**Within one load.** Cards that appear in two or more Discover rows, and cards
+that appear in two or more home recommendation sections (`section_type`
+`recommended_for_you`, `because_you_watched`, `similar_users_liked` or
+`taste_match`, from `listHomeSections`).
+
+**Across loads.** For the same profile, the number of shared cards between
+two loads of the served main row, over the first 10 and the first 20 cards.
+Measure it for two loads on one day and, for a profile with no new signals,
+for loads on consecutive days. Rows change between loads when a refresh wrote
+new rows (see [Refresh window](#refresh-window)), and rows chosen by date, such
+as Discover's genre rows, change with the date.
+
+## Leakage
+
+Count the served cards, in every row of `getForYouMain`, `listForYouRows`,
+`getDiscover` and the home recommendation sections, that are:
+
+- **finished:** in the history with `watch.completed` true, or flagged
+  `user_state.played`;
+- **favorited:** in `listFavorites`, including taste-seed picks, or flagged
+  `user_state.is_favorite`;
+- **rated:** rated at all in `listRatings` (`GET /api/v2/ratings`), since rows
+  leave out every title the profile rated, not only those it rated 1 or 2;
+- **not accessible:** answered `404` by `getCatalogItem`
+  (`GET /api/v2/catalog/items/{id}`) for the profile, or rated above the
+  profile's `max_content_rating` (`listProfiles`);
+- **out of 1.0 scope:** of a type other than `movie` or `series`, in a personal
+  row of a profile with no book activity.
+
+Cards name a movie or series, so an episode or season in the history,
+favorites or ratings counts as its series, as the rows' own exclusion set does:
+a series the profile finished an episode of, favorited an episode of or rated
+an episode of is leakage when a row serves it. History and favorites items
+carry `series_id`; a rating names only the rated item, so its series comes from
+`getCatalogItem`.
+
+Watchlist titles are not leakage: they stay recommendable.
+
+## New-profile usefulness
+
+**Before any signal.** For a profile with no history: the number of
+`getDiscover` rows and the cards in each, on the first request, without a
+nightly run or an admin action in between. AC2 asks that clients then show a
+default row rather than an empty shelf.
+
+**After the taste seed.** After `createTasteSeed`
+(`POST /api/v2/recommendations/taste-seed`) with a few picks:
+
+- whether the next `getDiscover` and `listForYouRows` reads hold a personal
+  row, and how long after the submission it appeared;
+- how many picks appear in any row (they are favorites, so this is leakage);
+- the share of personal-row cards sharing a genre with at least one pick.
+
+The submission answers once the profile's refresh has finished, or after
+about 5 seconds; a slower refresh finishes in the background.
+
+## Refresh window
+
+The refresh window is the time from a signal (a rating, favorite, watchlist
+entry, watch progress or history import) to the first read whose rows reflect
+it. `getTasteProfile`'s `updated_at` moves past the time of the signal when the
+profile's refresh has stored its taste profile; the refresh writes the
+profile's rows next. The schedule that bounds it:
+
+| Path | When it runs |
+| --- | --- |
+| Signal write (native and Jellyfin handlers, history imports, watch-provider syncs, media-server webhooks) | At once, on the server that took the write, after any refresh already queued there; one at a time per server, each with a 2-minute budget |
+| Taste seed | At once, on the server that took it; the request waits up to about 5 seconds |
+| Stale sweep | Every 5 minutes, up to 50 profiles with a taste profile marked stale, oldest mark first; picks up a refresh whose server dropped it |
+| Read of a profile whose rows are missing | Requests a refresh at most once per 15 minutes per profile on each server |
+| Nightly jobs | Embeddings 03:00, taste profiles 04:00, co-watch 04:30, rows of every profile with a taste profile 05:00, in server-local time (the `recommendations.*_cron` settings) |
+
+Cached rows expire 26 hours after the run that wrote them. Ebook and
+Audiobookshelf progress (beta) do not request a refresh; those profiles
+refresh at the next nightly taste run or stale sweep.
+
+## Probe
+
+`scripts/recs-probe/capture.sh` sends only GET requests. It takes the server
+URL and a token from the environment and, per profile, saves the
+`getTasteProfile`, `getForYouMain`, `listForYouRows`, `getDiscover`,
+`listHomeSections`, `listHistory`, `listFavorites` and `listRatings` responses
+as JSON, and looks up each rated ID that is not a movie or series with
+`getCatalogItem` to find its series. It prints one line per check: signal counts, main row and Discover
+row sizes, leakage counts, repeats within the load, card types in personal
+rows, and genre shares with amplification. It then prints the overlap between
+each pair of profiles and, given an earlier capture in `PREV_DIR`, the
+day-over-day overlap of each main row. It captures the first 200 entries of
+the history, favorites and ratings and marks a list that has more. It prints
+numbers, never a verdict. Run it with `--help` for its settings.
+
+Catalog shares for lift, access checks of single cards and timings of the
+refresh window are taken by hand with the requests named above.
diff --git a/docs/architecture/recommendations.md b/docs/architecture/recommendations.md
new file mode 100644
index 0000000000..1d6f8efb83
--- /dev/null
+++ b/docs/architecture/recommendations.md
@@ -0,0 +1,519 @@
+# Recommendations
+
+Recommendations turn each catalog item into an embedding, build a taste
+profile per household profile from its signals, and cache rows of candidates
+that reads filter for the viewer. Rows are built in the background, and reads
+never call the embedding provider: the only interactive embedding calls are
+catalog search queries and the admin connection check.
+
+The code lives in `internal/recommendations`: the embedding backfill
+(`embed_backfill.go`, provider client in `embeddings/`), taste profiles
+(`taste.go`, `taste_signals.go`, `signals.go`, `cluster.go`), row building
+(`personal.go`, `collaborative.go`, `cowatch.go`, `diversity.go`), the worker
+and its jobs (`worker.go`, `jobs.go`), the admin reset
+(`embedding_reset.go`), and the cached-row reads (`reader.go`). Native reads
+go through `internal/api/handlers/recommendations*.go` and
+`internal/apiv2/recommendations.go`; home and library sections through
+`internal/sections`; Jellyfin's `/Movies/Recommendations` through
+`internal/jellycompat`. Admin operations are in
+[admin-recommendations-api.md](../admin-recommendations-api.md); the
+measurements used to judge the output are in
+[recommendations-evaluation.md](recommendations-evaluation.md).
+
+## Jobs
+
+Every API node runs a `Worker`. Each job takes the in-process running flag and
+a Postgres advisory lock for its kind before it starts, so one node runs it at
+a time across the cluster; a busy job is skipped by cron and answered with
+`409` by a manual trigger. Each finished run is recorded in `task_executions`
+under `recommendations.embeddings`, `recommendations.taste_profiles`,
+`recommendations.cowatch` and `recommendations.cache`, with its counts as
+`result_data`. Partial runs, the embedding catch-up and the startup global-row
+build, are recorded under `recommendations.embeddings.catch_up` and
+`recommendations.cache.global_rows`, so admin status shows them beside the
+last full run instead of in its place. A run that hit partial failures is `completed` and counts them.
+An advisory lock pins the pooled connection that took it, so every further
+lock a lock holder takes goes on that same session: a job's or the stale
+sweep's per-profile locks (each released after its profile), and the
+embeddings reset's job claims and sweep lock. A running job holds one
+connection for its locks.
+
+| Job | When | What |
+| --- | --- | --- |
+| Embeddings | `recommendations.embeddings_cron` (03:00) | Pass 1 then Pass 2, below |
+| Embedding catch-up | every 15 minutes, and at startup when items need it | Pass 1 only, under the embeddings job's claim; idle runs are not recorded, failed ones are |
+| Taste profiles | `recommendations.taste_profiles_cron` (04:00) | Rebuild every profile with signals or a taste row |
+| Co-watch | `recommendations.cowatch_cron` (04:30) | Rebuild `item_cowatch`, pruning pairs the run did not rewrite |
+| Cache | `recommendations.recommendations_cron` (05:00) | Global rows, then the rows of every profile with a taste-profile row, oldest For You row first (profiles without one first) |
+| Stale sweep | every 5 minutes, own lock | Refresh up to 50 stale profiles, oldest mark first; a sweep that refreshed or failed one is recorded under `recommendations.stale_sweep` |
+
+At startup the worker also builds the global rows when none are cached, so
+cold-start rows exist before the first nightly cache run. Recently Added
+fills from any matched movie or series; Popular needs viewing by at least two
+accounts and stays empty on smaller servers.
+
+## Embeddings
+
+Pass 1 embeds items with no embedding or one from another model. Pass 2 finds
+items whose stored canonical text no longer matches `BuildEmbeddingText`; it
+rebuilds the text in SQL, so the people ordering there must match Go's
+byte-wise sort (`COLLATE "C"` and the full sort key), and every SQL candidate
+is re-checked in Go before it counts against the 200-item quota.
+
+The first stored vector writes the embedding lock (base URL, model, source and
+storage dimensions) in `server_settings`. Every later vector must match it.
+
+- A vector is checked before the lock is read or written: an empty vector or
+  one wider than `embeddingvectors.CanonicalDimensions` (3072) ends the run,
+  so an unusable model never pins the lock.
+- Vectors are zero-padded to 3072 for storage; cosine is unaffected.
+- Changing the model or base URL requires the admin embeddings reset, which
+  deletes the lock, embeddings, clusters and per-profile cached rows, and
+  clears every taste vector, in one transaction while holding the embedding, taste and cache
+  job claims and the stale sweep lock. Its transaction also takes the
+  embedding writers lock (`EmbeddingWritersLock`) exclusively, which a catalog
+  import carrying embeddings holds shared for its transaction, so the reset
+  refuses while one runs and an import waits for a running reset before it
+  reads the embedding lock. It also refuses while the saved model or
+  base URL differs from the one the server runs with, since the old model
+  could otherwise be embedded and locked again before the restart.
+- Catalog seed imports keep only embeddings from the locked model, or the
+  configured one when nothing is locked, and never write the lock. An
+  embedding run that finds such vectors and no lock embeds a probe text with
+  the configured provider and writes the lock from it, so semantic search
+  turns on even when every item already has a vector.
+- The canonical text stored with a vector is always the full text, even when
+  the provider only accepted a shortened copy, so Pass 2 does not re-embed it.
+
+A run stops at once on provider limits, rejected credentials, a wrong model or
+URL (401/403/404) and unreachable hosts. It also stops after three single-item
+failures in a row, and when the first single-item retry after a failed batch
+fails before anything was stored. An input the provider refuses at every
+length (a 4xx answer other than 401, 403, 404, 408 and 429) counts as skipped
+and is not a failure: refused items cannot stop a run, and a run whose only
+misses are refused inputs completes. The first refusal before anything is
+stored, and every third refusal in a row after a stored vector or a test, is
+followed by one call with a fixed test text. A provider that refuses that too,
+as Gemini does a bad API key with 400 (including a key revoked mid-run), stops
+the run, and the refusals since the last stored vector or test count as
+failures that the next run retries, not as refused inputs. Each
+server remembers in memory the items it saw refused, with a hash of their
+text, and its catch-up passes skip them until the text changes; the nightly
+or a manual embedding run clears the record and retries them, and so do a
+restart and a run that finds a different embedding lock than the record was
+made under (an embeddings reset deletes the lock on every server). A lock that conflicts with the configuration fails every run,
+including the catch-up pass every 15 minutes, until an administrator resets
+embeddings or restores the settings.
+
+Search indexes only vectors from the locked model, and semantic search is
+ready for a type once a lock exists and at least 85% of that type's eligible
+items carry one of its vectors.
+
+## Signals and taste profiles
+
+Signals are ratings, favorites, watchlist entries, Not interested marks, video
+watch progress and history, and ebook reading progress. The write paths for
+ratings, favorites, watchlist, Not interested marks and video progress call
+`Worker.NotifySignalsChanged`, which marks
+the profile stale and queues a refresh on that server: native and Jellyfin
+handlers, history imports (once per run), watch-provider syncs (once per run
+that changed local state) and media-server webhooks. Catalog merges and splits
+only mark the affected profiles stale, for the stale sweep. Changes to a
+profile's access scope also notify (see Access). Ebook and Audiobookshelf
+progress (beta) do not notify; those profiles refresh at the next nightly taste
+run or stale sweep.
+
+A taste-seed submission calls `Worker.RefreshProfileNow` instead: it marks the
+profile stale, refreshes it on that server at once and waits up to 5 seconds,
+so the client's next read shows the picks' effect. The refresh holds the
+profile's pending key, so the queue and the sweep do not start a duplicate on
+that server, and it runs detached from the request with the usual 2-minute
+budget: a slower refresh finishes in the background and is not queued again.
+At most 4 run at once per server; past that the refresh is queued.
+
+A refresh takes a cluster-wide advisory lock for the profile, then records the
+database time it started, stores the taste profile with that time as
+`updated_at`, and clears only stale marks set before it. A refresh request
+made on the same server while the refresh runs makes it run once more as soon
+as it ends, so a burst of changes is applied within seconds; after 3 runs
+in a row a profile still changing is left to the stale sweep, so one
+profile cannot hold the queue. A mark set during
+the refresh from another server survives, and a failed refresh marks the
+profile stale again, so the stale sweep retries both. The sweep takes every
+profile with a mark; only a full refresh clears one, so a mark the nightly
+taste job passes over (it stores the vector but rebuilds no cached rows) stays
+pending. The scheduled taste and cache jobs take the same lock per profile and
+skip a profile another server is refreshing. Storing embeddings marks stale
+the profiles with signals on those titles (every profile when the user store
+is outside Postgres, where that query cannot see favorites, watchlist or
+progress), so a profile refreshed before its titles had vectors, or cleared by
+a reset, is rebuilt by the sweep. Marking a profile with no taste row yet
+creates a vectorless row updated at the epoch, so a change during its first
+build is
+not lost. A refresh that finds the profile's lock held by
+another server marks the profile stale and stops, so two refreshes never
+finish out of order.
+
+- Episodes roll up to their series. A series decays once by its most recent
+  signal, as a movie decays by its last watch. A series with no signal for
+  30 days counts in proportion to its episodes watched with a positive
+  weight: in full from 5, and at least a quarter. A series being watched now
+  is not scaled, and neither is a negative series score.
+- Progress below 15% counts as abandonment only after 14 days.
+- The taste vector and clusters average the titles with a positive weight
+  only. Dislikes and abandoned titles still count in `signal_counts`, but do
+  not pull the vector away from themselves. A title marked Not interested
+  leaves the vector however it was watched, rated or favorited, and counts
+  as `not_interested`; marks are not positive signals, so a profile with
+  only marks has no taste profile and asks for no refresh. The rows rank
+  against marked and 1-2 star titles instead (see Turned-away titles under
+  Ranking). A 3-star rating adds no weight of
+  its own and halves the title's watch and intent weight, so a 3-star
+  completion weighs less than an unrated one.
+- Clusters split the same titles into interests. A profile under 10 titles
+  has one cluster. A larger one gets 2 (10-19 titles), 3 (20-59), 4
+  (60-199) or 5 (200 or more), or more, up to 5, when a partition into
+  more has a higher silhouette (cosine distance) and one of at least 0.1;
+  every cluster holds at least 3 titles. A partition is the best of up to 8
+  deterministic k-means++ seedings (`min(8, 800/titles)`: fewer above 100
+  titles, one from 401),
+  by inertia, among those leaving no cluster under 3 titles. One seeding
+  can put two seeds in one interest and leave a sliver that merging folds
+  away together with every other interest. When no seeding qualifies, the
+  first seeding's small clusters are merged; it is not run again. Real distinct
+  interests scored 0.13-0.22 and one interest cut in two under 0.08
+  (gemini-embedding-001 on a real catalog).
+- Watch, rewatch, favorite and watchlist counts in `signal_counts` count each
+  canonical title once (a watch in the bucket of its strongest watch), so one
+  long series is one title.
+- A refresh also stores `positive_titles` in `signal_counts`: the titles with
+  an embedding and a positive weight, each once, leaving out titles that are
+  only on the watchlist. The cold-start level counts them: 0 titles is
+  level 0, global rows only; 1-2 is level 1, global rows then one personal
+  row; 3-9 (three is the taste-seed picker's minimum) is level 2, personal and
+  global rows interleaved, personal first; 10 or more is level 3, personal
+  rows first. A row without the entry, stored before it existed, uses the sum
+  of its positive signal counts until its next refresh. The taste-profile
+  summary leaves `positive_titles` out, so its `signal_counts` holds only
+  kinds of signal.
+- A profile with no positively weighted title that has an embedding keeps
+  its row with a `NULL` taste vector and loses its clusters and cached
+  personal rows. Vector reads treat it as
+  having no taste profile. A read of a profile with positive signals but no
+  personal rows asks for a refresh even at level 0, since its titles may have
+  gained embeddings since.
+- Clusters are seeded from item IDs only, so decaying weights do not reshuffle
+  them between rebuilds. A cached cluster row carries the title of the build
+  that produced it.
+- The taste-profile summary's genres come from the clusters: the first
+  dominant genre of each cluster, heaviest first, then the second of each,
+  without repeats, at most five, so a second interest shows next to the
+  heaviest. A profile without clusters has none. Favorite directors still
+  come from titles rated 4 stars or more and favorites.
+
+## Rows
+
+Personal rows leave out the profile's exclusion set: watched titles,
+favorites (which include taste-seed picks), titles marked Not interested,
+every title the profile rated,
+and every title it abandoned (progress under 15% left untouched for 14 days,
+which its taste profile counts as a dislike), canonicalized episode to
+series. A title the profile already judged is not news to it, and one it
+rated well would otherwise lead its own row. Watchlist titles stay
+recommendable. Rows are built leaving out the whole set; a read drops watched,
+favorited, marked and rated titles again, from every row, so rows cached
+before a change are cleaned, and abandoned titles leave at the next rebuild.
+
+A Not interested mark is per profile, on a movie or series only (a series
+mark covers its episodes); the API refuses episodes and seasons. Beyond the
+personal rows it keeps the title out of the live lists the recommendations
+handler filters (Popular, Recently Added, the airings Discover blends in,
+Watch Tonight), an item's "More like this" list (left out before ranking, on
+the native and Jellyfin surfaces), and the Home and library discovery
+sections `sections.HidesNotInterested` names, which drop marked titles after
+the shared list cache and may come out shorter: several draw a daily sample
+sized by the row's limit, so a wider refetch would swap unrelated titles. Library
+browsing, search, item detail, playback, collections, the profile's own
+lists, Continue Watching and Next Up keep the title. Because You Watched
+never anchors on a marked title.
+
+Similar Users needs at least 3 peer accounts and at least 2 supporting
+accounts per title, counted by account, so no single household's ratings are
+shown on their own. Below the floor the row is cached empty. Co-watch pairs,
+which feed Because You Watched and similar titles, follow the same rule: an
+item needs watchers on 5 accounts, and a pair's shared watchers must span 3
+accounts, so one household's profiles cannot make a pair.
+
+Every row, personal or not, and the taste-seed picker offer matched movies
+and series only, the types in `recommendableMediaTypes` (see Media types
+under Ranking). Popular counts login accounts, not profiles: a title needs
+at least 2 accounts that watched it in the last 90 days, so a
+single-account server has no Popular row, and the cached row keeps 200 titles
+for reads to filter. Genre rows rank a genre's titles by catalog rank, with
+watching accounts only as a tie-break. Catalog rank (`catalogRatingOrderSQL`)
+puts notable titles first (a logo and at least five keywords, since most
+titles have no recorded vote count and an obscure title's rating rests on a
+handful of votes), then rating reliability (an IMDb rating below 9.6, then a
+TMDB rating below 9.5; higher scores are nearly always a few votes or a
+copied score), then that rating. Highly Rated, the picker and the quality
+prior use the same ratings. The 16 cached genres are those most accounts watched, once at
+least 2 share one, then the largest. The picker interleaves its best 600
+candidates by first genre, then continues in rank order.
+
+Discover and its section pages serve two default rows live: Highly Rated in
+Your Library (a catalog rating of at least 7.0, movies and series
+interleaved in proportion to how many of each the viewer can see) and
+Recently Added (by the title's or its latest episode's addition, with no
+window). Reads query them under the viewer's access filter and exclusion
+set, so they show on a fresh server, with recommendations disabled, and for
+a restricted profile. Highly Rated is never cached. The cached global
+Recently Added row uses the same query without the access filter and also
+has no window, so on a server with no Popular row a new profile's cached
+reads still get a row.
+
+Both queries read each media type from its own index
+(`idx_media_items_type_added_at`, `idx_media_items_type_catalog_rank`)
+only as deep as the row needs, so a read's cost does not grow with the
+catalog. The index expressions repeat `addedAtSQL` and
+`catalogRatingOrderSQL` and must change with them. Each read is planned for
+its own exclusion set rather than reusing a generic plan. The per-type
+title counts Highly Rated interleaves by are the one part that reads every
+title, so each server reuses an access scope's counts for 10 minutes. The
+counts only set the mix, so they never fail or hold up a read: expired
+counts are served while a background count refreshes them, a read with no
+counts yet stops waiting when its request ends, and a failed count falls
+back to the scope's last counts, or equal weights, for a minute.
+Discover reads the profile's watched set once per request and shares it
+between its rows and the airings it blends in; Watch Tonight shares it
+between its candidates, its cold-start fallback and the handler's filter.
+
+Cache rows expire 26 hours after the run that wrote them, past the next daily
+cache run. A global row whose rebuild fails keeps its last good version until
+the new run's expiry; a global row whose rebuild finds nothing, and a genre row
+whose genre left the menu, is deleted. A personal row whose build fails keeps
+its cached version and the refresh is retried. A main row fails when any
+interest's candidates or embeddings cannot be read, rather than being cached
+without that interest, and the cluster rows then keep theirs too, since they
+leave out the main row's titles; a cluster row fails the same way. A main or Because You Watched
+row whose rebuild finds nothing is deleted, and a cluster row that rebuilds
+empty is cached empty (see Cluster rows).
+
+## Access
+
+Rows are built under the scope the API resolves for the profile (the policy
+viewer resolver, with `access.Resolver` as the legacy fallback): account and
+access-group libraries, profile restrictions, hidden libraries and maturity
+limits, with PIN verification skipped. A profile
+whose scope cannot be resolved is not cached. Profile restriction, hidden
+library, account and access-group changes trigger a rebuild; account- and
+group-wide changes mark the affected profiles stale in one statement for the
+stale sweep. A policy change marks every profile stale the same way, since a
+custom scope policy can change any account's scope. Every server announces a
+generation when it loads it, but only the first announcement marks: the
+generation marked last is stored in `server_settings`
+(`recommendations.policy_marked_generation`) and claimed in the same statement
+as the mark, so a change costs one full-table update, not one per server. A
+refresh, the only thing that clears marks, first checks that its server has
+loaded the stored generation and otherwise leaves the profile pending, so no
+server rebuilds under the old policy and clears the change's mark. Changing
+the server setting `access.unrated_content`, part of every rating ceiling's
+maturity limits, marks every profile stale too, and again once servers'
+10-second cache of the setting has expired.
+
+Every read filters again with the viewer's access filter. List endpoints that
+return bare identifiers filter before answering, and a list anchored on an
+item the viewer cannot see answers as one anchored on an unknown item.
+Deleting a profile purges its ratings, Not interested marks, taste profile,
+clusters and cached rows on both user-store backends. A refresh that runs afterwards writes no taste row
+for a profile the user store no longer lists, and on the Postgres store the
+nightly taste job skips such profiles, as the purge migration does.
+
+## Ranking
+
+A cached personal row holds `CacheCandidateLimit` (60) titles; a public read
+serves the first `ServedRowSize` (20) by default. Ranking shapes those 20
+for the viewer, and the rest is headroom for read-time filters and for
+library sections, which scope the whole row to their libraries.
+
+- **Main row.** A profile with at least 10 positive titles and at least two
+  clusters gets a row composed per cluster, each cluster an anchor. Anchors
+  are not merged by centroid cosine: a centroid averages away its titles'
+  differences, so centroids of large clusters of different genres sit
+  above 0.9 (most pairs with 50 or more titles on a real catalog), while
+  centroids of 3-title halves of one genre sit near 0.82. The clustering
+  decides what is one interest. Anchors get slots in proportion to
+  their weight by largest remainder, each at least `min(3, limit/anchors)`.
+  Each anchor fetches 3 candidates per slot around its centroid and ranks
+  them by MMR, and a smooth weighted round-robin interleaves the anchors'
+  rankings without repeats, so every prefix of the row holds each interest's
+  share. Any other profile, or one whose anchors find nothing, gets the
+  candidates nearest its averaged taste vector, ranked by MMR.
+- **Genre pass.** In a row from the averaged taste vector, a stable reorder
+  of the MMR order keeps each genre to half of the served window while the
+  row has other titles to offer. It is greedy in rank order and never
+  revisits a title it let in, so with multi-genre titles a genre can exceed
+  half when only a different set of titles would meet the cap. It deletes
+  nothing and moves nothing past the window. A composed row skips it: its slots already
+  spread the window over the interests by weight, and the cap would cut an
+  interest heavier than half the profile below its share.
+- **Type supplements.** The main row holds at least a fifth of its length of
+  each of `recommendableMediaTypes` the viewer can see, so a library section
+  fills. The extra titles go after the served window, replacing tail titles
+  of types above that floor; a type the viewer has no titles of is not
+  queried.
+- **Cluster rows.** A cluster row is built `max(3, 60 × weight share) + 20`
+  long (at most 60) from candidates sharing one of its dominant genres, then
+  loses the main row's first 30, every title its daily rotation can serve,
+  so the page does not repeat the main row.
+  A row left with fewer than 10 titles is cached empty, and a row cached
+  empty counts as built: reads do not ask for a rebuild of it.
+- **Turned-away titles.** Before MMR, the main row's pools and type
+  supplements, the cluster pools, Because You Watched (cached and live) and
+  Similar Users rank against the titles the
+  profile marked Not interested (weight 1, fading with a 365-day half-life)
+  and rated 1-2 stars (weight 0.6, on the taste half-life), the newest 200.
+  Everything is measured inside the pool being built, so the rule holds
+  whatever cosines an embedding model gives. A title counts for a pool only
+  when it is as near the pool's query (taste vector, centroid or source
+  title) as the pool's median candidate. It then pushes the candidates
+  nearer it than 90% of the pool, up to its whole weight 2 standard
+  deviations of the pool's similarities to it further on; pushes from
+  several titles combine as `1 − Π(1 − push)`. A candidate's score drops by
+  `2 × sd(pool scores) × aversion`, so a sequel of a marked title leaves the
+  served window while its genre-mates barely move, and marks in one area
+  add up. Each counting title also weighs against the pool's interest: an
+  anchor or cluster of weight `W` keeps `W / (W + 4 × Σ weights)` of its
+  share, its main-row slots are re-split by the reduced weights, and under
+  0.3 the anchor leaves the main row and the cluster row is cached empty.
+  The anchors left fetch again for the slots they gained, so the row keeps
+  its length, and their shares are taken again from the wider pools. A
+  profile whose every anchor leaves gets a main row cached empty, rather
+  than one around the averaged taste vector, which would serve those
+  interests again; reads count the empty row as built.
+  The pushes only reorder the pool, so rows keep their length. A profile
+  with no turned-away title gets exactly the rows it would without the
+  step. Rows are not built while the turned-away titles, or a pool's
+  embeddings, cannot be read; an anchor that leaves the main row also leaves
+  the pool type supplements are drawn from.
+- **Quality prior.** Before MMR a candidate's score becomes
+  `score + 0.5 × sd(pool scores) × clamp(z, −1, 1)`, where `z` standardizes
+  its catalog rating (trusted IMDb, else trusted TMDB) among the pool's rated
+  candidates of the same media type. A type with fewer than 10 rated
+  candidates or no spread in ratings is left alone, and cluster and Because
+  You Watched pools under 30 candidates get no prior.
+- **Freshness.** Before MMR, on the main row's pools and the cluster pools,
+  the positive score of a title added in the last 14 days is multiplied by up
+  to 1.05, less the older it is. A pool with more than a quarter of its
+  candidates inside the window, such as a freshly imported library, gets no
+  boost, so it never ranks by scan order. The date is the title's own, so a
+  new episode of an older series does not count, and the boost cannot reach
+  a title its candidate query did not retrieve.
+- **Labels.** A cluster's label names the genres that set it apart: those
+  that at least 40% of its titles carry, and carry at least 1.5 times as
+  often as the profile's positive titles do, most distinctive first, with
+  its most common genre (a tie goes to the genre of the heavier titles)
+  among them when at least 40% of its titles carry it, at most two in all.
+  Genres are joined with ", ", since TMDB genres such as "Sci-Fi &
+  Fantasy" contain "&". A cluster with no such genre, such as a profile's
+  only cluster, is labeled by its most common genre, and one whose most
+  common genre is on fewer than 40% of its titles, or whose titles carry no
+  genres, has an empty label, titled "Picked from your history". The dominant genres that drive retrieval, the
+  Discover genre exclusion and the taste-match section stay the top three
+  by count. The thresholds were tuned on synthetic profiles.
+- **Repeated titles.** A read never shows two cluster rows under one title
+  it can tell apart. Visiting the heaviest cluster first, a row titled like
+  a heavier one is hidden when their first served items overlap by more
+  than half (Jaccard index), and otherwise takes the first of its dominant
+  genres its title does not name yet. A row whose cached title its cluster
+  no longer has keeps it. A hidden row was built, so it does not count as
+  missing. A main or cluster row's "see all" page reads the profile's page
+  rows the same way, for a 20-item window and the day's rotation, and takes
+  the title and order they give its row, so it opens with the titles of the
+  row it was opened from; a row they hide keeps its cached title and order.
+- **Rotation.** Reads rotate the main row and the cluster rows daily, after
+  filtering and before trimming; Because You Watched, Similar Users, Watch
+  Tonight and the global and default rows stay in rank order. The served
+  window is 20 items whatever a read's limit, so a page of any limit,
+  Discover and a row's "see all" page agree on its order: a shorter page
+  serves the window's first titles. A row of at most 20 titles keeps its
+  order; in a longer one the first 10 titles stay, and the other
+  `take = 10` are drawn from the next `2 × take`, the title at tail
+  index `i` with weight `1/(i+5)`: the draw keeps the `take` largest
+  `ln(u)·(i+5)`, with `u` from `sha256(userID|profileID|rowKey|date|itemID)`.
+  The draws keep rank order and the titles not drawn follow them, so
+  nothing is lost. `rowKey` is the row's cache key, so a title two rows
+  share is drawn independently in each, and `date` is the UTC
+  `YYYY-MM-DD`, so rows change once a day at 00:00 UTC. The draw needs no
+  shared state: every node serves the same rotation, whatever its time
+  zone. Home and library sections rotate the main and taste-match rows
+  the same way.
+- **Titles.** Row titles come from one vocabulary in
+  `internal/recommendations/titles.go`: For You, `Because you enjoy
+  <label>`, Because You Watched, Profiles Like You Enjoyed, Popular on This
+  Server, Recently Added, Highly Rated in Your Library and `Top <genre>`. A
+  For You or taste-match section whose heading is still a default
+  ("Recommended for You", "Top Picks Today" or empty) takes the title of the
+  row it serves when that row is one every profile is offered, so a new
+  profile's section reads "Popular on This Server". A heading an admin chose
+  is never replaced.
+- **Media types.** Every row offers only `recommendableMediaTypes`, movies
+  and series: Popular, the genre rows, the live default rows (Highly Rated
+  in Your Library, Recently Added), the taste-seed picker, and the personal
+  rows. For personal rows the list gates the taste candidates (the main
+  row, cluster rows, type supplements and Watch Tonight's discover
+  candidates), Because You Watched anchors (a finished audiobook is passed
+  over for the next movie or series), co-watch neighbors and Similar Users
+  candidates. Reads drop other types from cached rows in the access check
+  they already run, so rows cached before a type left the list stop
+  showing it at once. Books still shape the taste vector. An item's own
+  "More like this" list keeps to the item's type, co-watch neighbors
+  included, so an audiobook's page can still list audiobooks. See Rows for
+  how each row ranks.
+
+## Reads
+
+With recommendations disabled the Reader serves no personal rows (the main
+For You row, cluster rows, Because You Watched, Similar Users), even ones
+still cached from before, and reads fall back to the global and default rows.
+Watch Tonight's discover-mode cards skip the taste profile the same way and
+come from the cached Popular row and the live Recently Added row.
+
+The Reader serves cached rows, except the default rows on Discover and their
+section pages, and the Recently Added row Watch Tonight and its
+discover-mode cards fall back to for a cold profile, which therefore still
+fills once the cached global rows expire with recommendations disabled; home
+and library sections keep the cached Recently Added row instead, since a
+library has its own shelves. The other live query is the server's top genre, for a taste-match section with no genre and no
+matching cluster; it is the same for every viewer and reads the whole
+catalog, so each server reuses it for 10 minutes, serving an expired genre
+while a background read refreshes it. The standalone popular and recently-added list endpoints
+query the catalog live rather than reading the cache. Discover leaves out of
+each row the items earlier rows show, but not those they cut at the row limit.
+A read that
+finds a profile's rows missing asks for a refresh at most once per profile per
+15 minutes on each server; a profile with signals but no taste-profile row yet
+asks too, so a lost first refresh recovers. Because You Watched anchors are the
+profile's three most recent completed titles of `recommendableMediaTypes` that
+still exist in the catalog, taken from its latest ten such completions and
+passing over those it rated 2 stars or lower; the worker, the reads and
+Watch Tonight choose them the same way. A read asks for a refresh only when
+there are anchors and none has a cached row.
+
+List reads return at most 50 items per row (default 20); the v1 for-you and
+similar-users reads keep 20, and section "see all" reads return up to 60, a
+whole cached row. Home and library sections read the whole cached pool,
+scope it to the section's libraries, then trim to the section's size. The
+main row is ranked for every title the profile can see, so a library with a
+small share of the catalog can hold few of its titles. A library's For You
+section that the main row leaves short continues with the library's titles
+from the profile's other personal rows: the cluster rows, heaviest cluster
+first, then the Because You Watched rows, most recent anchor first, then
+Similar Users, each title once. The fill is read only when the section is
+short, and a new profile's global row is never filled: the section is titled
+after it.
+Jellyfin's `/Movies/Recommendations` sends only rows its headings describe
+truthfully: up to two Because You Watched rows under their anchor's title,
+dropped when the viewer cannot see the anchor, and the taste-cluster rows
+under their genre label (see [jellycompat-api.md](../jellycompat-api.md)). A
+per-section items request that fails to load answers `500`; the aggregate
+sections endpoints still degrade to empty rows.
diff --git a/docs/architecture/restart-resilient-playback.md b/docs/architecture/restart-resilient-playback.md
index 86372e2d87..d5dcbf0dce 100644
--- a/docs/architecture/restart-resilient-playback.md
+++ b/docs/architecture/restart-resilient-playback.md
@@ -415,10 +415,13 @@ evolution:
   surviving token. No cross-process enumeration-failure mode for the supported
   topology.
 - **Signing-key blast radius (E / tr-7, G13).** A single `JWTSecret` signs native
-  auth, the stream token, and the node bearer, so a node-secret leak can forge
-  native logins. **Accepted risk** on the trusted-node precondition. **Deferred
-  hardening:** split the stream-token secret from the native-auth secret, then
-  asymmetric stream-token signing before any untrusted/edge node.
+  auth and the stream token, and every node holds it, so a compromised node can
+  forge native logins. **Accepted risk** on the trusted-node precondition.
+  Watching a node link is not the same as compromising a node: calls to nodes
+  carry an HMAC under a key derived from the secret, never the secret itself
+  (see [worker authentication](worker-http-protocol.md#authentication)).
+  **Deferred hardening:** split the stream-token secret from the native-auth
+  secret, then asymmetric stream-token signing before any untrusted/edge node.
 
 ---
 
@@ -646,7 +649,10 @@ sequenceDiagram
   requested segment (native path, P-3). A jellycompat session on a rebooted node
   reconstructs too: the node fetches the recipe central wrote to the shared Redis
   recipe store (`internal/noderecipe`) at transcode start, since the Jellyfin
-  client's token cannot carry it.
+  client's token cannot carry it. If the node dies and stays down while the API
+  relays a native session, the API moves the transcode to another executor
+  instead (see
+  [Transcode node lost under the API relay](#transcode-node-lost-under-the-api-relay)).
 - cleanup race: a segment dir is reaped only if absent from the live map AND the
   in-flight set AND older than 24h (max token TTL), so a token that can still
   reconstruct never gets its dir wiped.
@@ -741,6 +747,7 @@ request; **—** = the path never executes on that role (nothing to reconstruct)
 | native · direct | ✅ rebuild `Session` from `?st` token → `Range` re-serve | ✅ stateless re-serve from `claims.MediaPath` | — not served on a transcode node |
 | native · remux | ✅ token + `?seek`, or relay/reconstruct remote HLS | ✅ stateless per-request pipe or HLS relay | ✅ for remote HLS, using the same recipe carrier as native transcode |
 | native · transcode | ✅ token (full recipe) → respawn ffmpeg seeked to segment | ✅ same-node restart + token forward | ✅ self-contained — token is recipe-complete |
+| native · header-authenticated (any method) | ⚠️ API-origin transports: rebuild `Session` from the API's Redis recovery card for the authenticated owner, while the card exists and the durable attempt still names its plan; then as the token rows | ✅ proxy grant (`authorized_media_origins_v1`) | ✅ node recipe under the transport id |
 | jellycompat · direct | ✅ re-resolve from durable compat row → `Range` re-serve | ✅ stateless re-serve from token `MediaPath` | — |
 | jellycompat · remux | ✅ compat row + `?seek`, or relay remote HLS | ✅ stateless per-request pipe or HLS relay | ⚠️ for remote HLS, while the shared Redis recipe still exists |
 | jellycompat · transcode | ✅ `ReconstructTranscode(*ps.Recipe)` from compat row | ✅ same-node restart + token forward | ⚠️ reconstructs **iff** the shared Redis recipe (`internal/noderecipe`, ≤24h TTL) still exists; fails closed (404) otherwise |
@@ -753,6 +760,22 @@ request; **—** = the path never executes on that role (nothing to reconstruct)
 | proxy node     | self-describing path token, re-derived per request — the proxy holds no per-session state | same path token (identity); the recipe is not needed at the proxy               |
 | transcode node | forwarded `X-Prairie-Stream-Token`, recipe-complete                                       | identity token + Redis `noderecipe` recipe (the Jellyfin token cannot carry it) |
 
+A native attempt that negotiated `header_authenticated_media_v1` has no token on
+any URL, so its carriers are all server-side: the API's session recipe
+(`noderecipe.NewSessionRecipeStore`, keyed by playback session id), the proxy
+grant, and the node recipe. The session recipe is written when a transport
+served from the API origin commits, and re-recorded when a sidecar-only replan
+keeps the transport; a proxy-served transport has none, since its grant already
+covers it. A user's stop and an abort drop it on the replica that ends the
+session; a system teardown that leaves the attempt live (an FFmpeg exit, a
+copy-safety stop) keeps it for a transcode the API runs itself, so the next
+request rebuilds as a token would. A remote transcode's teardown drops it,
+since the node job and node recipe go with it. It is
+only a reconstruction aid: the durable v3 attempt row decides whether it may be
+used (same plan, same account and selected profile, not expired, not stopped),
+and the rebuilt session keeps refusing unauthenticated requests. Without Redis
+the session answers `404` after a restart and the client starts a new attempt.
+
 **Reading the matrix**
 
 - **Integrated restarts and restarts of the selected logical proxy node are
@@ -761,7 +784,10 @@ request; **—** = the path never executes on that role (nothing to reconstruct)
   transcode is reverse-proxied — and the artifact remains bound to the same
   `stream_nodes.id` across a process restart. A sibling proxy must not consume
   that artifact: failover to another node requires replanning and reminting so
-  capacity, group affinity, and the client-visible origin move together.
+  capacity, group affinity, and the client-visible origin move together. The
+  one exception is a transcode node that dies under an API-relayed transcode,
+  where the client-visible origin is the API and does not move (see
+  [Transcode node lost under the API relay](#transcode-node-lost-under-the-api-relay)).
 - **The two direct-play `—` cells are structural, not gaps.** Direct play has no
   executor. Remux is different: progressive remux can run on a proxy, while HLS
   remux can run on a transcode node and leave through either the API relay or a
@@ -794,5 +820,90 @@ holes — see §7, §10):
   next play, bounded by the ≤24h token, not by reconstruction.
 - Integrated transcode behind a non-sticky load balancer can split-brain into
   divergent segment dirs (P-1); safe single-front-end or with LB affinity. Remote
-  (node) sessions are immune — node affinity routes every front-end to the same
-  transcode node.
+  (node) sessions are immune while their node lives — node affinity routes every
+  front-end to the same transcode node. Once the API moves a transcode off a dead
+  node (below), the moved route lives only in that API process, so the same
+  limit applies to moved sessions.
+
+### Transcode node lost under the API relay
+
+The matrix covers a transcode node that *restarts*. A node that dies and stays
+down is a different event: nothing comes back to self-reconstruct, so before
+this rule every relayed request for the session failed until the client
+replanned. Now, when the API relays a remote HLS transcode (native protocol,
+API egress) and cannot reach the session's node, it moves the transcode itself:
+
+- **Trigger.** The relay got no HTTP response: the connection could not be
+  opened (refused, unroutable, DNS failure, dial timeout), or any transport
+  error occurred while the pool already lists the node as unhealthy or no
+  longer pools it. A node that answers with an HTTP error is alive; its answer
+  is relayed and nothing moves. A dial that failed on this host's own resources
+  (out of file descriptors or socket buffers, no local address) says nothing
+  about the node and does not count.
+- **Mark.** The relay marks the node unhealthy in this process's pool at once
+  (`Planner.MarkTranscodeNodeUnreachable`), so neither new sessions nor other
+  moves select it. The next health sweep overwrites the mark with whatever the
+  node answers.
+- **Recipe.** The same recipe the restart paths use: the client's `?st` token
+  when it names the session's current transport, otherwise the
+  `internal/noderecipe` card stored under the transport id for tokenless
+  (header-authenticated) sessions. The API's own session recipe never stands
+  in for a token here; a move of a header-authenticated session updates the
+  node recipe and then points the session recipe at the new executor. With
+  neither, nothing moves and the relay answers `502` as before. A stream-copy recipe answers to the persisted
+  copy-safety verdict first, like any other revival.
+- **Executor.** `noderouting.Resolve` with the current policy, restricted to
+  API-egress shapes and excluding the dead node: another pooled transcode node
+  per the normal selection rules, or this process when policy lets the API
+  execute. A hard `worker_only` boundary is still never crossed; with no other
+  node, that session's relay keeps failing until the client replans. Candidates
+  pass the same capability filter as a fresh start of the session's current v3
+  plan (advertised transformation recipe versions and tone-map support), and
+  the selected node is re-checked against a fresh inventory; a local move checks
+  this process's capabilities the same way. A node is started with the ordinary
+  `POST /transcode/start` contract and the same attestations as a fresh start;
+  a local move uses `ReconstructTranscode`. An executor that refuses is excluded
+  and the next one is tried; one that cannot be reached is also marked
+  unhealthy. A tone-map refusal about the source file itself
+  (`source_revision_changed`, `source_preflight_rejected`) ends the move, and
+  the client gets the documented terminal `422` with
+  `X-Prairie-Tone-Map-Execution-Error` instead of a `502`.
+- **Continuity.** The transport id, the session id, and every client URL stay
+  the same. The new executor starts where a reconstruction would
+  (`playback.ReconstructResumePoint`): an encoded recipe at the requested
+  segment, a copy-video recipe at its recorded start with segment recovery
+  seeking forward. A manifest request carries no segment and starts at the
+  recorded position.
+- **Commit and accounting.** The session's route moves with a compare-and-swap
+  on the dead route (`SessionManager.MoveTranscodeExecutor`), taken under the
+  session lifecycle lock. A replan reads the route it replaces under that same
+  lock, so whichever commits second sees the first: a replan stops the moved
+  transport, and a move that loses stops what it started and releases its
+  planner reservation. The planner reservation otherwise moves to the new node
+  (or is released for a local move), and the dead node's job is asked to stop
+  in case it is only unreachable from here; a failed stop is logged as a
+  warning, and the node's idle reaper ends a job that still runs. A stored node
+  recipe follows the transport to its new node, written after that stop
+  because a node deletes a transport's stored recipe when it stops it; a
+  candidate's rollback stop restores the card for the same reason.
+- **Pacing.** Moves are single-flighted per session
+  (`TranscodeManager.RehomeTranscode`), so every request that finds the node
+  dead waits on one move, and each remote start holds a `reconstructSem` slot
+  like a local reconstruct. A dead node with many sessions is replaced at the
+  same pace as a restart wave. A move whose deadline passes stops at once
+  rather than counting as another executor's refusal.
+- **Per-process scope.** The health mark, the single-flight, the lifecycle lock
+  and the moved route all live in one API process. The client's stream token
+  still names the dead node, so a session rebuilt from that token after an API
+  restart, or served by another API replica without load-balancer affinity,
+  can run a second move of the same transport. On one front-end that costs at
+  most an encode on the first move's node that nobody fetches, which the
+  node's idle reaper ends after 10 minutes; playback continues from the second
+  move, or from the old node if it came back. Several API replicas need
+  load-balancer affinity for moved sessions, as for integrated transcode
+  (P-1). A cluster-wide record of the moved route belongs with multi-front-end
+  support (G8).
+
+Out of scope: a session whose media URLs point at a proxy origin keeps the
+replan-and-remint rule above, and Jellyfin compatibility relays remote HLS
+through its own compat-store recipe, which this path does not rewrite.
diff --git a/docs/architecture/seasonal-picks.md b/docs/architecture/seasonal-picks.md
new file mode 100644
index 0000000000..ff808aa221
--- /dev/null
+++ b/docs/architecture/seasonal-picks.md
@@ -0,0 +1,70 @@
+# Seasonal Picks
+
+A `seasonal_themed` row shows titles for the holiday in season: curated public
+MDBList lists, ranked by IMDb popularity, optionally topped up with the
+library's closest matches by recommendation embedding. The code owners are
+`internal/sections/recipes` (catalog, params, selection),
+`internal/sections/seasonal_lists.go` (snapshots and refresh) and
+`fetchSeasonalThemed` in `internal/sections/fetcher.go`.
+
+## Themes and vibes
+
+`recipes.SeasonalThemes` is the built-in catalog, in calendar order (the
+editor's order). Each theme
+has a date predicate (`recipes.SeasonalPredicates`) and one or more vibes. Most
+themes declare a yearly `Start`–`End` window (MM-DD, wrapping across New
+Year when End comes first) and the predicate is built from it; Easter computes
+its window, and weekly themes (Saturday Morning, Family Movie Night) use a
+weekday-and-hour rule. A row may replace any non-weekly theme's window with its
+own in `theme_dates`; a moved Easter stays on those dates every year. A
+vibe is a curated MDBList list with a name and an in-season row title. The
+first vibe is the default. Theme and vibe keys are stored in section configs,
+so they are never renamed or reused. `GET /api/v2/sections/seasonal-themes`
+serves the catalog to the editor; hidden themes (`summer`, kept for old
+configs) are left out.
+
+Prefer small hand-curated lists. Large "set during the holiday" keyword lists
+drift off theme (Christmas lists that include Mean Girls).
+
+## Picking what a row shows
+
+`recipes.ActiveSeasonalPick` decides, from the row config and the time:
+
+1. The first custom holiday in season (`custom_holidays`, a yearly MM-DD
+   window that may wrap across New Year, and an MDBList list URL).
+2. Otherwise the first enabled built-in theme in `recipes.SeasonalThemeOrder`
+   (short holidays, then month-long ones, weekly themes, summer last) that is in
+   season (the row's `theme_dates[theme]` when set, else the predicate), with
+   the vibe from `vibes[theme]` or the default.
+3. Otherwise a legacy single-theme row (`theme`) when in season or pinned.
+
+Nothing in season means an empty row, which the home API drops. The row title
+in season is `theme_titles[theme]`, else the vibe's title (a custom holiday's
+`title`, else its name).
+
+## Lists
+
+`seasonal_list_snapshots` keeps one row per canonical MDBList `/json` URL with
+the list's external IDs (TMDB, IMDb, TVDB) in IMDb popularity order
+(`?sort=imdbpopular&sortorder=asc`). It deliberately stores no `content_id`:
+the read path resolves entries against the catalog each time, so titles added
+to the library appear without a refresh and content-ID renames need no
+handling here.
+
+`SeasonalListRefresher` downloads the lists every enabled seasonal row (server
+sections and profile overrides, found by `SectionDemandLister`) will show now
+or within 14 days, skipping copies younger than 20 hours. The
+`refresh_seasonal_lists` task runs at startup and every 6 hours; saving a
+seasonal section also refreshes its lists in the background. Claims use a
+lease like trending snapshots. A failed download keeps the last good entries.
+
+## Ranking and the recommendation fill
+
+The row shows the list's titles the viewer can see, in list order. Unless the
+row sets `source: "lists"`, a row with fewer titles than its limit is filled
+from `recommendations.Repo.ThemeNeighbors`: the average embedding of up to 40
+of the list's most popular owned titles, nearest movies and series first,
+keeping only titles no farther from that average than the median seed. The
+cutoff is relative, so it holds whichever embedding model the server uses.
+Fewer than three embedded seeds, or no embeddings at all, means no fill. The
+fill is best effort: an error leaves the list titles.
diff --git a/docs/architecture/server-discovery.md b/docs/architecture/server-discovery.md
index 5f8f419928..6dc7e60b8b 100644
--- a/docs/architecture/server-discovery.md
+++ b/docs/architecture/server-discovery.md
@@ -79,7 +79,10 @@ and a listener on one address serves only one link. A listener on
 unavailable, port 5353 taken) is logged once without affecting the server and
 retried every check interval. The advertisement reaches only the networks the
 process itself is attached to, and it carries the port the process listens
-on, not a port a container runtime publishes it under.
+on, not a port a container runtime publishes it under. `server.local_url`
+covers those deployments (a Docker bridge network, typically): signed-in
+clients read it from `GET /api/v2/system/connections` as a local route
+candidate.
 
 ## Overlay network: the provider's short name
 
@@ -132,4 +135,9 @@ is a convenience, not part of connection setup.
 - Listing servers a user can reach over the internet. A client learns the
   public and provider addresses of a known server from
   `GET /api/v2/system/connections` after sign-in.
-- Automatic switching between a server's addresses mid-session.
+- Switching a signed-in client to an address on trust in its advert alone. A
+  signed-in client may move its requests to the server's local address (the
+  local route) only over TLS that presents the key pinned from the
+  connections document; the advert and `server.local_url` only supply the
+  candidates. See
+  [server-identity.md](server-identity.md#local-network-tls).
diff --git a/docs/architecture/server-identity.md b/docs/architecture/server-identity.md
index fa458b708b..af4e5e4cc3 100644
--- a/docs/architecture/server-identity.md
+++ b/docs/architecture/server-identity.md
@@ -61,6 +61,12 @@ hint that makes the candidate worth trying and lets clients group saved
 servers; the approval is the gate. Profile confirmation and every other
 authorization rule are unchanged.
 
+The one other gate is the API server's own TLS key
+([Local network TLS](#local-network-tls)): a signed-in client may send its
+existing credentials to a local-network address when TLS there presents the
+key it pinned from the connections document. A matching ID or name is never
+enough on its own.
+
 ## Connections
 
 `GET /api/v2/system/connections` is authenticated (account, no profile) and
@@ -74,7 +80,10 @@ is the capability document for this feature: a client that gets
 - `endpoints`, the addresses the deployment offers: `server.public_url` as
   `kind: public` when configured, then one `kind: provider` entry per
   installed provider with its display name and its state on the API host,
-  carrying a `url` only while connected.
+  carrying a `url` only while connected;
+- `local_route`, the pin of the key the API listener presents over TLS and
+  `server.local_url` when an admin set it
+  ([Local network TLS](#local-network-tls)).
 
 What it deliberately leaves out: proxy-node backend addresses, provider
 enrollment URLs, provider error text and everything else on the admin status.
@@ -83,6 +92,60 @@ the request's `Host` and never enables public exposure. Reachability is the
 client's to test: a provider that is connected on the server says nothing
 about whether a given TV is on that overlay.
 
+## Local network TLS
+
+A client saved with the deployment's public URL, reverse proxy or tunnel takes
+the long way round at home: through hairpin NAT or the tunnel's bandwidth
+limits, and the server counts its streams as remote because the address it
+sees is public. The server's LAN address is shorter, but it is plain HTTP and
+anyone can advertise one, so the client has to authenticate it before sending
+credentials there. `internal/lantls` does that without a public certificate:
+
+- **TLS on the API port.** The API listener (not the Jellyfin, ABS or proxy
+  listeners) answers TLS and plain HTTP on the same port. It reads each new
+  connection's first byte in a goroutine of its own: a TLS handshake record
+  (`0x16`) gets the TLS server, anything else is served as plain HTTP with that
+  byte replayed, and a connection that says nothing for five seconds is handed
+  on as plain HTTP. Accept never waits on a slow client, a server shutdown
+  closes connections still being read, and TLS connections reach the HTTP
+  server as `*tls.Conn`, so `request.TLS` and the request scheme are set. HTTP/1.1
+  only. Docker port publishing, the network access plugins' plain upstream and
+  every existing client are unchanged.
+- **A derived key.** The key is ECDSA P-256, derived from `SECRET_KEY` with
+  HKDF-SHA256 (`prairie/lan-tls/v1`). Nothing is stored, every API process and
+  replica presents the same key, and rotating `SECRET_KEY` replaces it. The
+  self-signed certificate around it is minted per process; clients ignore its
+  names and dates.
+- **A pin over a trusted address.** `GET /api/v2/system/connections` carries
+  `local_route.spki_sha256`, the base64 SHA-256 of the key's
+  SubjectPublicKeyInfo. Clients learn and replace the pin only through a saved
+  address they already authenticate (HTTPS with a system-trusted certificate),
+  and follow no redirect on that read: a saved plain-HTTP address, or one a
+  redirect leads to, cannot vouch for a key.
+
+Client rules for using a local address (the local route):
+
+1. Candidates are `local_route.url` and `_prairie._tcp` adverts whose TXT
+   `id` matches the saved server's identity
+   ([server-discovery.md](server-discovery.md)). Each is reduced to a private
+   IPv4 address (RFC 1918) and tried as `https` on the same port, whatever
+   scheme the endpoint names. Public certificate authorities do not issue
+   certificates for those addresses, and App Transport Security exempts them,
+   so the pin is the only trust that applies.
+2. The connection is accepted only when the presented key matches the pin. No
+   other certificate is ever accepted for a candidate, publicly valid or not,
+   and redirects are not followed.
+3. `GET /api/v2/system/identity` over that connection must answer the saved
+   server's identity.
+4. The client keeps its saved address as the credential owner; only where its
+   requests go changes. It moves back as soon as a request on the local route
+   fails to connect, and checks again when the device's network changes.
+
+A relay cannot pass: it cannot present the key, and forwarding the TLS bytes to
+the real server only produces an end-to-end connection to the real server. The
+key authenticates the deployment, not a location, so a client on a VPN into the
+home network may use the local route too; that is intended.
+
 ## Client flow
 
 During companion setup the phone reads the connections document and hands
@@ -91,8 +154,11 @@ with the public identity operation, keeps those whose ID matches, and opens
 device login at the first reachable match. If the overlay address fails, the
 provider's display name drives setup help and the public endpoint, when
 present, is the explicit fallback. The address that worked is what the TV
-saves; the phone's preferred address does not change. Automatic mid-playback
-route switching is out of scope.
+saves; the phone's preferred address does not change, and the flow never
+changes a saved address later. The only automatic routing change is the local
+route above, which leaves the saved address in place: a stream already playing
+is not moved onto it, and a stream on it that fails reconnects from the saved
+address.
 
 ## jellycompat
 
diff --git a/docs/architecture/streaming-write-deadline.md b/docs/architecture/streaming-write-deadline.md
index 83c36153d5..bbffba033f 100644
--- a/docs/architecture/streaming-write-deadline.md
+++ b/docs/architecture/streaming-write-deadline.md
@@ -24,8 +24,10 @@ per-response; every JSON, image and other ordinary API route keeps it.
 - If the transport does not support per-response write deadlines, the wrapper degrades
   to a plain pass-through and the server-level `WriteTimeout` stays in effect.
 - A paused client that stops reading for longer than `window` has its connection
-  reaped. That is intended: the client's reconnect ladder resumes at its byte cursor,
+  reaped. That is intended: a range-capable stream resumes at the client's byte cursor,
   and this is a strict improvement on the 120s that applied to *all* streams before.
+  A progressive remux has no byte ranges, so its client reopens it at the paused
+  position instead ([playback protocol v3](playback-protocol-v3.md)).
 
 ### Bumps are throttled on `Write`, never on `ReadFrom`
 
diff --git a/docs/architecture/subtitle-sync.md b/docs/architecture/subtitle-sync.md
index c305d6f820..96cdf9139f 100644
--- a/docs/architecture/subtitle-sync.md
+++ b/docs/architecture/subtitle-sync.md
@@ -32,8 +32,9 @@ bytes never change.
   so effects keep pace with their stretched event. Other formats cannot be synced or retimed.
 - A timing change bumps the row's revision like any other update, so
   validators captured before it go stale.
-- Players already apply a per-device delay (`player.subtitle_sync_ms`); it
-  stacks on top of the stored correction.
+- Players already apply the profile's subtitle offset
+  (`player.subtitle_sync_ms`, which a device can override); it stacks on top
+  of the stored correction.
 
 ## Sidecar subtitles
 
diff --git a/docs/architecture/trickplay.md b/docs/architecture/trickplay.md
index cbe634799b..7380a7fa10 100644
--- a/docs/architecture/trickplay.md
+++ b/docs/architecture/trickplay.md
@@ -103,18 +103,34 @@ and runs each file at idle CPU and I/O priority:
   `k*interval + interval/2`, the last one a second inside the file, so it
   shows what plays in `[k*interval, (k+1)*interval)`.
 - The first `mediasample` Sheets request covers one sheet to learn actual
-  display geometry. Later requests cover at most 16 sheets and 64 million
+  display geometry. Later requests cover at most 16 sheets and 32 million
   pixels, keeping high-entropy JPEG responses within the bounded node limit; a longer file
-  takes several runs, which bounds each run's memory. Each run seeks to the
+  takes several runs, which bounds each run's memory: a run holds every tile
+  it decodes until its repairs are done. Each run seeks to the
   keyframe before each sample rather than reading the whole file
   (`Samples`); see [media sampling](media-sampling.md#sheets). AVI files,
   whose index seeks poorly, are read in one pass (`ReadThrough`), and
   containers without a keyframe index (MPEG-TS) always are.
-- HDR and Dolby Vision sources are tone mapped (`tonemap.NeedsToneMap`),
-  after scaling, so software tone mapping is always allowed.
+- A list run's missing and repeated cells are read again before the sheets
+  are encoded ([repairs](media-sampling.md#repairs)): samples a container
+  without keyframe flags (VC-1 in Matroska) or an HEVC picture-order
+  collision left without a frame, and samples a GOP longer than the interval
+  gave the previous sample's keyframe. `SheetFrames.Refined` counts them.
+- HDR and Dolby Vision sources are tone mapped (`tonemap.NeedsToneMap`) in
+  software after scaling, on GPU attempts too, so software tone mapping is
+  always allowed. The request names the base signal `tonemap.ResolveSource`
+  classifies the file's catalog facts as (`ToneMap.Source`), and every
+  attempt converts it with the chain playback converts it with in software:
+  a Dolby Vision base (Profile 5, compatibility id 0) only through
+  `tonemapx`, which applies its RPU, HLG with the HLG transfer. A file the
+  facts cannot classify keeps the best-effort chains, except a legacy row
+  whose catalog names Dolby Vision Profile 5, which takes the Dolby Vision
+  signal: no chain without its RPU can show that base.
 - Hardware decode follows `playback.hw_accel` and `playback.hw_device`
-  (QSV, VAAPI, VideoToolbox), with a software attempt after a hardware
-  failure. Attempt timeouts grow with the samples: two minutes plus half a
+  (QSV, VAAPI, VideoToolbox, and NVENC's CUDA decoder), with a software
+  attempt after a hardware failure. A GPU that cannot decode the codec fails
+  its attempt as `unsupported`, logged at debug rather than as the
+  accelerator's first failure. Attempt timeouts grow with the samples: two minutes plus half a
   second a sample on hardware, two seconds a sample in software.
 - A file selected for local extraction that this server cannot read
   (an offline mount) is given back for an hour without counting a failure;
@@ -180,8 +196,9 @@ the lease, and the uploads; a node only decodes and tiles
 [worker protocol](worker-http-protocol.md)).
 
 - A node is eligible while it is enabled, healthy, and advertises the
-  `trickplay_extract_v1` transport feature, so older nodes are never sent
-  work. The API server reserves capacity through the node planner shared
+  `trickplay_extract_v2` transport feature, so nodes that would ignore the
+  tone-map source signal (`trickplay_extract_v1` alone) are never sent
+  work. Nodes keep advertising v1 for older API servers. The API server reserves capacity through the node planner shared
   with playback and downloads and chooses among nodes by available capacity
   and load. Those provisional reservations belong to one API process; a node's
   reported load accounts for work accepted from other replicas.
diff --git a/docs/architecture/v1-scope.md b/docs/architecture/v1-scope.md
index 5ab14fd7f3..200f39db4e 100644
--- a/docs/architecture/v1-scope.md
+++ b/docs/architecture/v1-scope.md
@@ -66,13 +66,16 @@ migration ledger.
 | Removed | Release | Rationale |
 |---|---|---|
 | The `key` field from `GET /api/v1/api-keys`, `GET /api/v1/admin/api-keys`, and `GET /api/v1/admin/users/{userId}/api-keys` | API v2 migration, admin API-key lifecycle | Listing credentials returned reusable secrets on every read. Lists now return metadata and a short `key_prefix`; only creation responses contain the full key. Existing keys and their authentication behavior are unchanged. The bundled admin web editor is coordinated with this change before integration; native clients have no callers of these list routes. |
+| Upstream error text in the `warnings` of `POST /api/v1/subtitles/search`; each failed provider now reads `<provider>: search failed` | Subtitle search error redaction, critical bridge fix | A provider's transport error printed its full request URL, and SubDL sends the server's API key as a query parameter, so any account allowed to search could read the key while SubDL was unreachable. The field and its shape are unchanged; the cause moved to the server log with credentials masked. v2 already returned only a fixed summary, and the first-party clients call v2. |
+| The query string on SubDL result IDs from `POST /api/v1/subtitles/search`; each `id` is now the bare archive path, such as `/subtitle/123-456.zip` | SubDL result ID signing, critical bridge fix | SubDL signs the download link of each search row with the caller's API key, and that link was the result ID, so every account allowed to search received the server's key in each SubDL result. The field and its shape are unchanged, and `POST /api/v1/subtitles/download` still accepts an ID that carries a query: the server drops the query and signs the request with its own key. v2 returned the same IDs and changes with v1. |
 | Playback v3 subtitle artifacts reporting the source codec as `format` and the video resume origin as `timing_origin_seconds` | Subtitle reliability, before v1 lock, [contract](playback-protocol-v3.md#8-track-identity-and-the-subtitle-ordinal-space) | Artifact metadata now describes actual served bytes and absolute source cue timestamps (origin zero). Apple clock mapping is coordinated; Android and web already map sidecar source time separately from the video timeline. Native embedded selection is separately negotiated with `embedded_subtitles_v1`, so clients cannot mistake an embedded decision for a missing sidecar. |
 | String `GET`/`PUT`/`DELETE /api/v1/settings…`, the unknown-key extension bag, preference fields on profile/library/series DTOs | Cross-platform settings contract, [design](settings-contract.md) | Replaced wholesale by the typed settings contract. Deferring past lock would mean carrying the Deprecation/Sunset surface *and* the untyped key bag — which lets any client invent a production setting the server stores unvalidated — through the deprecation window, which is the exact surface the contract exists to close. |
 | The ten string-registry admin user-settings routes: `GET /api/v1/admin/users/{id}/settings`, `GET /api/v1/admin/users/{id}/settings/{key}`, `PUT /api/v1/admin/users/{id}/settings/{key}`, `DELETE /api/v1/admin/users/{id}/settings/{key}`, `GET /api/v1/admin/users/{id}/device-settings`, `GET /api/v1/admin/users/{id}/device-settings/{key}`, `DELETE /api/v1/admin/users/{id}/device-settings/{key}`, `PUT /api/v1/admin/users/{id}/profiles/{profile_id}/device-settings/{key}/{device_id}`, `DELETE /api/v1/admin/users/{id}/profiles/{profile_id}/device-settings/{key}/{device_id}`, `DELETE /api/v1/admin/users/{id}/profiles/{profile_id}/devices/{device_id}/settings` | Cross-platform settings contract, [design](settings-contract.md) | The admin projection of the removal above: these routes read and wrote the string registry the contract replaces. Their canonical successors are `GET /api/v1/admin/users/{id}/settings/values` (every stored value across all scopes) and `PUT`/`DELETE /api/v1/admin/users/{id}/settings/values/{key}` at an explicit scope, sharing the session routes' validation. Keeping the string routes past lock would preserve an admin-only write path into the untyped bag after the user-facing one closed. |
 | The legacy (pre-v3) request and response bodies of `POST /api/v1/playback/start`. The route stays; a body that does not declare `protocol_version: 3` now gets `426 client_upgrade_required` instead of a legacy plan | Playback protocol v3, [spec](playback-protocol-v3.md) | v3 is a platform-neutral contract that moves route selection, quality laddering and track choice server-side. The legacy body carried the opposite model — the client posted a decision it had already made. Running both means every planner change has to be made twice, in two shapes that disagree about who decides, and the legacy shape is the one the client-specific bugs live in. A deprecation window would extend that duplication across the whole window for a protocol no shipping client will still speak by lock. |
 | `POST /api/v1/playback/transcode/start` | Playback protocol v3, [spec](playback-protocol-v3.md) | Client-posted transcode recipes. Superseded by the `quality_change` replan operation: the client sends a label from `playback_plan.available_qualities` and the server picks the encode. Keeping the endpoint keeps a second, unvalidated way to start a transcode that bypasses plan identity entirely. |
 | The legacy `/api/v1/plex-sync/*` aliases of the webhook-sync surface: `GET /api/v1/plex-sync/connections`, `POST /api/v1/plex-sync/connections`, `DELETE /api/v1/plex-sync/connections/{id}`, `GET /api/v1/plex-sync/connections/{id}/actors`, `PUT /api/v1/plex-sync/connections/{id}/actors`, `POST /api/v1/plex-sync/connections/{id}/webhook/rotate` | API v2 migration, personal-imports section ([ledger](../../contracts/api/v2/migration.json)) | Plex-only projections of the provider-neutral `/api/v1/webhook-sync/*` routes, served by the same handler over the same connection rows, with no first-party consumer. Their successors are the `/api/v2/webhook-sync/*` operations; carrying a second, Plex-shaped spelling of every connection operation into v2 would double the contract for one provider. The public inbound receiver `POST /api/v1/plex-sync/webhooks/{secret}` is not in this entry: external Plex servers were configured with that URL, so it keeps working on v1 (see its ledger row). |
-| The community theme catalog routes: `GET /api/v1/theme/catalog`, `POST /api/v1/theme/catalog/refresh`, `GET /api/v1/theme/download` | Single web theme, 2026-09-26 | The web client now has one theme, Cinema Dark, which only the admin customizes with the accent color, token overrides and raw CSS. Profiles no longer pick or import themes, so nothing consumes a catalog of portable theme files, and the v2 catalog operations were removed before the v2 lock. The v1 routes are unchanged on the bridge surface, and `theme.catalog_url` keeps its default for them, until the retirement tombstone removes them with everything else. |
+| The community theme catalog routes: `GET /api/v1/theme/catalog`, `POST /api/v1/theme/catalog/refresh`, `GET /api/v1/theme/download` | Single web theme, 2026-09-26 | The web client now has one theme, Cinema Dark, with no profile theme choice (the admin's token overrides and raw CSS were removed later, in the next row; the accent color stays). Profiles no longer pick or import themes, so nothing consumes a catalog of portable theme files, and the v2 catalog operations were removed before the v2 lock. The v1 routes are unchanged on the bridge surface, and `theme.catalog_url` keeps its default for them, until the retirement tombstone removes them with everything else. |
+| The admin theme overrides route: `GET /api/v1/theme/admin-css` | Accent-only admin theming, 2026-10-13 | The web client no longer offers the admin token and font overrides or custom CSS, so nothing reads the overrides, and the v2 `getThemeOverrides` operation and the `overrides_available` capability field were removed before the v2 lock. The accent color stays: the web client now applies it from the branding document. The v1 route stays unchanged on the bridge surface, still reporting the stored `ui.admin_theme_vars` and `ui.admin_custom_css`, until the retirement tombstone removes it with everything else. |
 | Personal collection groups and per-profile allow lists on `/api/v1/collections`: `POST /api/v1/collections/groups`, `PUT /api/v1/collections/groups/order`, `PUT /api/v1/collections/groups/{id}` and `DELETE /api/v1/collections/groups/{id}` answer `501 unsupported`; `PUT /api/v1/collections/order` accepts only a null or absent `group_id`, and its `ordered_ids` names only the acting profile's own collections, so another profile's shared collection in the list is a `400`; `PUT /api/v1/collections/{id}` ignores a null or blank `group_id` and answers `501 unsupported` for a named one; `allowed_profile_ids` is ignored on create and update | Personal collection sharing, [#1615](https://github.com/prairie-server/prairie-server/issues/1615), [API](../collections-api.md) | Collections are either private to their creator or shared with every profile on the login, and each profile has one flat order of its own collections. The v1 routes share the service seams, so they follow the same model rather than keep a second one: list responses keep their shape, with `groups` always `[]`, `group_id` always `null`, and `allowed_profile_ids` reporting the effective audience. The group routes answer as they already did for an account on the SQLite user store. Keeping login-wide groups or per-profile allow lists on v1 would let one profile keep rearranging or narrowing another's collections, the defect #1615 removes. |
 | The `sections.allow_profile_custom_sections` admin setting routes: `GET /api/v1/admin/settings/sections`, `PUT /api/v1/admin/settings/sections` | Rule rows for every profile, 2026-10-05 | Profiles may always add rule rows ("Titles matching rules") to their pages, so the "Let profiles add rule rows" switch and its setting are gone, and the v2 operations were removed before the v2 lock. The v1 routes stay on the bridge surface until the retirement tombstone: `GET` answers `allow_profile_custom_sections: true`, and `PUT` checks that the body is JSON, changes nothing, and answers the same. `GET /api/v1/profile/sections/flags` and v2 `getProfileSectionFlags` keep the field, always `true`. Only an admin adds new Editor's picks rows; a profile keeps the ones it has. |
 | The meaning of `allow_profile_custom_sections` on `GET /api/v1/profile/sections/flags` | Rule rows for every profile, 2026-10-05 | The flag used to mean that a profile that is not an admin may also add rows of admin-only recipes (Editor's picks), and clients offered those rows on `role == "admin" \|\| flag`. It now answers `true` everywhere and no longer grants that: `PUT /api/v1/profile/sections` still refuses a new Editor's picks row from a profile that is not an admin with `403 custom_disabled` and its unchanged message. A client follows each recipe's `admin_only` in `listSectionRecipes` instead. No first-party client reads the flag. |
@@ -87,7 +90,9 @@ migration ledger.
 | Every authenticated v1 route for a remote-playback handoff session (one collected from an approved `remote_playback` request): they now answer `403 forbidden`, including `POST /api/v1/auth/device/approve`, `/approve-handoff` and `/deny`. `POST /api/v1/auth/refresh` still refreshes the session but never past its `session_expires_at`, and the v1 poll answer is unchanged | v1 bridge critical fix, 2026-10-12, [device sign-in](device-login.md#remote-playback-handoff) | A handoff the account owner meant as a day of playback on one profile was an ordinary sign-in: a refresh made it last the full refresh lifetime, it could act as any profile and use admin routes on an admin account, and it could approve a new ordinary device login. The Apple and Android TV apps use only `/api/v2` for handoffs. |
 | Admin powers for an admin login session that declares no `X-Profile-Id` on an account with a PIN-protected or access-restricted profile: every v1 route behind `RequireActingAdmin` (the `/api/v1/admin/...` groups, library management, `POST /api/v1/theme/catalog/refresh`) and the admin bypass on the metadata-curation item routes. They now get the `403 forbidden` "Admin access requires the account's primary profile" (curation: "Metadata curation permission required" unless the permission is assigned). Accounts whose profiles have no PIN or limit, and API keys, keep profile-less admin access | v1 bridge critical fix, 2026-10-06, [contract](api-contract.md#credential-continuity) | A device signed into the household, such as a child's, could drop the header and use every admin route, including minting an admin API key that skips profile PINs. |
 | Admin reach on v1 routes outside the admin groups for a caller that is not the acting admin (a non-primary profile on an admin account, or a profile-less admin login session on a household with a PIN-protected or access-restricted profile): reading and cancelling another account's request on `GET /api/v1/requests/{id}` and `POST /api/v1/requests/{id}/cancel` (cancelling even while requests are turned off), another account's `request_id` in the request state of the request search, discover and browse routes, `DELETE /api/v1/subtitles/{id}` on another account's subtitle, on-disk file paths in item detail and versions, adding a section of an admin-only recipe (Editor's picks) on `PUT /api/v1/profile/sections`, `GET /api/v1/admin/jobs/{id}` on jobs other than the account's own item refresh and the unsanitized job body, and the administrator channels and other accounts' events on `GET /api/v1/events/ws`. These callers now get what a regular account's profile gets: `403 forbidden` on the request, subtitle and job routes, `403 custom_disabled` on the section, paths stripped (unless metadata curation is assigned to the account), and the user channels | v1 bridge critical fix, 2026-10-12, [contract](api-contract.md#credential-continuity) | These routes read the account's admin role instead of the acting-admin decision the admin routes make (the rows above), so a child profile on an admin account could read and cancel every account's requests, delete their subtitles, and receive admin events. They now share that decision (`apimw.ActingAdmin`). |
+| Keeping the administrator channels on `GET /api/v1/events/ws` after the acting profile's PIN proof stops verifying (its PIN changed, or a PIN was set on it, during the login session). The connection now closes on its next session check, and a handshake whose ticket or `X-Profile-Token` no longer verifies gets the user channels | v1 bridge critical fix, 2026-10-16, [contract](api-contract.md#credential-continuity) | The v1 ticket kept only the account and profile, so the socket could not recheck the PIN proof the viewer gate checked when the ticket was minted. The ticket now keeps the profile token server-side, and the socket re-verifies it as the v2 socket does. |
 | An unlimited supply of fresh per-client budgets on the v1 routes that spend a named auth budget (`POST /api/v1/auth/login`, `setup`, `signup`, the invitation, device sign-in and password change routes, and the autoscan webhook) for a connection from a trusted proxy address that names a different client in `X-Forwarded-For` or `X-Real-IP` on each request. Such requests now also spend the connection's budget, ten times the per-client one, and get `429` with `Retry-After` once it is spent. Direct connections and network access ingress are unchanged | v1 bridge critical fix, 2026-10-12, [contract](../auth-api.md#sign-in-rate-limits) | Every private range and loopback is a trusted proxy by default, so a LAN host or a client reaching Prairie through a container bridge could guess passwords without limit by rotating the header. v2 and the Jellyfin listener spend the same budgets through the same limiter and change with v1. |
+| Trakt on every v1 route: the collection import routes `POST /api/v1/admin/collections/import/trakt` and `POST /api/v1/collections/import/trakt`, Trakt-backed collections and home rows, and the `trakt` watch provider under `/api/v1/watch-providers/trakt/*` | Trakt retired, 2026-10-16 | Prairie no longer supports Trakt. The two import routes had refused new Trakt collections with `410 unsupported_source` since Trakt collection creation was turned off, and keep that answer on the bridge surface until the retirement tombstone; the v2 `importAdminTrakt` and `importTraktCollection` operations were removed before the v2 lock. Existing Trakt collections became manual collections that keep their titles, Trakt trending rows became TMDB weekly trending and were turned off, and `trakt` connections were deleted, so v1 responses no longer report `collection_type: "trakt"`, a Trakt trending source, or a `trakt` provider, and the watch-provider routes answer for `trakt` as for any unknown provider. No first-party native client used any of them. |
 
 Feature-detection precedent: clients discover which metadata providers (including the
 built-in NFO provider, #216) apply to a library type via
diff --git a/docs/architecture/watch-party-synchronization.md b/docs/architecture/watch-party-synchronization.md
index 400bba6912..e62ac99a05 100644
--- a/docs/architecture/watch-party-synchronization.md
+++ b/docs/architecture/watch-party-synchronization.md
@@ -62,19 +62,107 @@ recover. Other viewers' broadcasts do not wait for its write deadline. Each
 broadcast builds and sorts the common roster once, then adds each viewer's own
 permissions and identity flags.
 
+## Drift correction
+
+Every transport command carries the room's position at its `execute_at`, and
+the room anchor is taken at that moment too. While the room plays, its position
+at server time `t` is `position_seconds + max(0, t - execute_at)` at 1x.
+Commands used to carry the position at issue time while members started one
+scheduling lead later, so every member trailed the server's model by that lead.
+A slow member raised the lead for everyone, and in a large or long-distance room
+the server then corrected members that were in sync, or let the host's reports
+re-anchor the whole room.
+
+The lead is the highest smoothed round trip among attached members, from 500
+milliseconds up to 2 seconds. A member with a longer round trip runs the command
+late and projects it forward to the room's position.
+
+Web, Apple, and Android clients converge on the room the same way:
+
+| Situation | Behavior |
+|---|---|
+| Clock offset | Ping on connect, every 2 seconds until 4 samples, then every 15 seconds. Use the offset of the fastest of the last 8 round trips. |
+| Drift up to 0.4 s | No correction. |
+| Drift 0.4–5 s, playing | Pitch-preserved playback rate of `1 ± clamp(drift / 25, 0.01, 0.04)` in 0.5 percent steps, until within 0.1 s. |
+| Drift over 5 s, playing | Seek to buffered media, or a budgeted load (see below). |
+| Not playing when a play or pause runs | Seek first only for drift over 5 s, or over 1 s when the target is reachable without rebuilding the stream. |
+
+Each client keeps the last command it ran as its room reference and measures
+drift against it about twice a second. That loop only changes the rate; it
+never seeks. Rate and play state change when a command executes, never when it
+arrives, and users cannot change playback speed in a room.
+
+The server corrects a member whose reports stay more than 1 second from the
+room, or whose pause state differs, and repeats a correction at most every 10
+seconds. A member of a playing room already closing its drift by rate, within
+5 seconds and closer than its best report since its last command, is left to
+finish; the first report after a command sets that best. A correction refreshes the
+client's reference; a client with the drift loop still closes up to 5 seconds
+by rate, and an older client without it is kept near the room. A command sent
+to a member starts this count over.
+
+Reports can trail the commands they follow. One sent within 1.5 seconds after
+a command's `execute_at` (or after the command was sent, if it went out late)
+is neither corrected nor taken as the host's decision, unless it names that
+command as the last one its client applied, reports the play state the command
+set, and the member was also sent the room's latest command. A report naming
+an older command than the member was last sent is treated the same way for up
+to 10 seconds. A host that has re-attached is corrected like a viewer until a
+report names its sync, plays as the sync said, and is within the host band; from
+then it may pause or resume the room again even while it closes the rest of its
+drift by rate. Naming the sync alone is not enough: a player whose play was
+refused (a browser blocking autoplay after a reload) or whose correction never
+loaded names it too.
+
+A play or pause request carries where the requester was, and the lead is added
+when the requester was playing. Once the room's latest command has run, the
+room's state says whether it was. While that command is still pending, the room
+already shows its outcome, so the server uses the state the room had before the
+pending change, which members keep until they run it. A second play inside the
+lead does not start the room a lead later, a second pause still lands a lead
+after its press, and a press that undoes the pending command neither moves a
+paused room nor leaves a playing one behind. The request's `is_paused` is not
+used for this, because clients send either their own state or the state they
+ask for.
+
+Every command executes one lead from when it is sent, and never before the
+room's own latest command or anchor, so a member synced after the lead drops
+never starts ahead of the room.
+
+A seek request within 1 second of the seek the room is already waiting on is
+the same seek: it does not restart the barrier. Clients compute a relative
+skip from their own position, which stays on the old stream until the room's
+seek runs there, so a burst of presses on an older client repeats the pending
+target. Current clients hold their newest request on the timeline and build
+the next skip on it. The room's seeks for earlier presses move the player but
+do not release the request. The room's seek to it releases it, as does a newer
+command that replaced that seek before it ran, or a 5 second timeout when the
+room never runs it. A seek during an open barrier also keeps whether the room
+resumes playing, since the requester is paused by the barrier rather than by
+choice.
+A paused member that stays where its last correction found it cannot apply
+one in place (a transcode lands on segment boundaries) and is not corrected
+again until it moves.
+
 ## Buffering policy
 
 The room waits for a viewer once, then lets them catch up. One slow connection
 must not pause everyone repeatedly, and one short hiccup must not make a viewer
 miss the scene.
 
-- Stalls shorter than 2 seconds stay local. The web player reports buffering
-  only after 2 seconds without playable media, and the viewer converges on the
-  room by playback rate. It sends no position reports while its element is
+- Stalls shorter than 2 seconds stay local. Clients report buffering only
+  after 2 seconds without playable media, and the viewer converges on the room
+  by playback rate. It sends no position reports while its element is
   stalled, or while its media is unplayable and a readiness acknowledgement is
   pending, because a stalled position is not a decision.
 - A longer stall pauses the room for at most the 10-second waiting deadline,
-  and the overlay names who everyone is waiting for.
+  and the overlay names who everyone is waiting for. When a guest stalls, the
+  room pauses where it is; only that guest is sent a seek to that point, and
+  the barrier waits for it to arrive within 5 seconds (1 second unless its
+  `ready` names that seek). Other viewers do not rewind to the guest's
+  position. When the host stalls, the room pauses at the host's position, as
+  it does for a viewer with nobody else watching, because the host's `ready`
+  re-anchors the room wherever its reloaded stream lands.
 - A viewer who missed the deadline, or who stalls again within 5 minutes of
   their last stall, catches up on their own: the room keeps playing and their
   stalls no longer pause it. Buffering also cannot pause the room within 1
@@ -96,23 +184,27 @@ miss the scene.
   matches the room also marks the member ready, which covers late joiners and
   clients that never send `ready`.
 - The host follows the same rules. While the host is buffering or catching up,
-  and whenever the host has drifted by 2 seconds or less, the host is corrected
-  like any viewer instead of moving the room anchor. A larger jump or a pause
-  mismatch still moves the room.
+  and whenever the host has drifted by 10 seconds or less, the host is corrected
+  like any viewer instead of moving the room anchor. Every client sends its
+  seeks as requests, so passive drift is the host falling behind, not a
+  decision. A larger jump or a pause mismatch still moves the room. The frozen
+  v1 room socket keeps its 2 second band, since its clients may report a host's
+  scrub instead of requesting it. A stalled host's position bounds where the
+  room pauses, measured from where the room is when the stall is reported.
 
 Stall times and the last buffering pause live in the room runtime, so every API
 server applies the same limits and a reconnect through another server does not
 reset them.
 
-Catching up is bounded on the web player. A small drift converges by playback
-rate, and a correction to media that is already buffered seeks at once. A
-correction that has to load new media, by a range request or a stream rebuild,
+Catching up is bounded on every client. Drift up to 5 seconds converges by
+playback rate, and a larger correction to media that is already buffered seeks
+at once. A correction that has to load new media, by a range request or a stream rebuild,
 lands late by its load time; chasing the advancing room with a fresh load on
 every correction never converges. Only one such load runs at a time. The next
 waits 10 seconds after the previous one started playing, doubling to 60 seconds
 until the viewer converges, and aims ahead of the room by the load time the
 previous one took, up to 10 seconds. After two sustained stalls within 5
-minutes, the player offers a lower quality for the same source file. Explicit
+minutes, the web player offers a lower quality for the same source file. Explicit
 room seeks are never delayed by this budget.
 
 Pausing cancels pending browser reports, and the server ignores delayed
@@ -192,9 +284,8 @@ means these guarantees and status fields are unsupported; an omitted false statu
 on a supported server means false.
 
 The additive member status fields are optional in v2 socket frames and HTTP v2
-snapshots. Apple has no active Watch
-Party implementation; Android's surface remains disabled. Jellyfin compatibility
-does not use these room sockets.
+snapshots. The web, Apple, and Android clients implement Watch Party with the
+drift correction above. Jellyfin compatibility does not use these room sockets.
 
 The Postgres tests run independent service instances against the same room and
 exercise readiness, notification loss, connection replacement, expiration, and
diff --git a/docs/architecture/watch-provider-plugins.md b/docs/architecture/watch-provider-plugins.md
index 0b78a372fd..0beef28325 100644
--- a/docs/architecture/watch-provider-plugins.md
+++ b/docs/architecture/watch-provider-plugins.md
@@ -1,11 +1,12 @@
 # Watch provider plugins
 
-Every watch provider is a `watch_sync_provider.v1` plugin. Trakt, Simkl, and
-MDBList used to be compiled into the server. They now ship as first-party
-plugins (`prairie.watchprovider.trakt`, `prairie.watchprovider.simkl`,
-`prairie.watchprovider.mdblist`) from the Prairie plugin repository. The host side of
-the contract lives in `internal/watchsync/plugin_provider*.go`, and the
-first-party rules described here live in `internal/watchsync/first_party.go`.
+Every watch provider is a `watch_sync_provider.v1` plugin. Simkl and MDBList
+used to be compiled into the server. They now ship as first-party plugins
+(`prairie.watchprovider.simkl`, `prairie.watchprovider.mdblist`) from the Prairie plugin
+repository. Trakt took the same path and was later retired (see
+[Retired providers](#retired-providers)). The host side of the contract lives in
+`internal/watchsync/plugin_provider*.go`, and the first-party rules described
+here live in `internal/watchsync/first_party.go`.
 
 ## Provider keys
 
@@ -19,8 +20,8 @@ The registry key names a provider everywhere it is stored:
 A plugin capability is normally keyed `plugin:<installation id>:<capability id>`.
 That key is unique and cannot be claimed by a plugin.
 
-The three first-party plugins keep the keys of the built-ins they replaced:
-`trakt`, `simkl`, and `mdblist`. As a result, every connection, stored token,
+The first-party plugins keep the keys of the built-ins they replaced: `simkl`
+and `mdblist`. As a result, every connection, stored token,
 export record, rating and dropped-show agreement, and history source those
 built-ins wrote stays valid, and nothing is re-encrypted or renamed. Three rules
 protect this:
@@ -28,8 +29,8 @@ protect this:
 - **Only a Prairie-managed repository can claim a legacy key.** A plugin gets one
   only when its installation came from a repository whose `source_kind` is
   `prairie`. Plugin IDs are not reserved, so a third-party plugin that reuses
-  `prairie.watchprovider.trakt` gets a per-installation key. It never receives
-  the tokens of existing Trakt connections. Replacing an installation records
+  `prairie.watchprovider.simkl` gets a per-installation key. It never receives
+  the tokens of existing Simkl connections. Replacing an installation records
   the new package's repository, and none for an upload, so a package from
   elsewhere installed over a Prairie one loses the key too.
 - **One installation holds a legacy key.** If two Prairie-managed installations of
@@ -50,7 +51,7 @@ next to the dedicated token columns. A row a built-in wrote has only the
 columns. Reading it falls back to them, and the next token write adds the
 bundle.
 
-Provider app credentials, such as the Trakt and Simkl client ID and secret,
+Provider app credentials, such as the Simkl client ID and secret,
 live in the plugin's global config entry `app`. On reload, the host copies the
 legacy `watchsync.<key>.client_id` and `client_secret` server settings into that
 entry when the plugin has none saved. Existing tokens were issued to that app,
@@ -63,9 +64,20 @@ A plugin connection reports `credentials_configured` as false until every
 global config entry its manifest marks required has a saved value, as the
 built-ins did for their app credentials.
 
-Trakt collections and trending send profile tokens issued to the Trakt app, so
-they read the client ID from the Trakt plugin. They fall back to the legacy
-setting only when no Trakt plugin is configured.
+## Retired providers
+
+Prairie no longer supports Trakt. `RetiredPlugin` lists `prairie.watchprovider.trakt`,
+and the host never registers an installation of it, from any repository, so a
+copy left installed cannot sync, scrobble, or claim a key. The `trakt` key is no
+longer a first-party key: no plugin can claim it, and no auto-install follows
+from old connections. Migration `20261016134645_retire_trakt_watch_sync` deleted the
+`trakt` connections with their per-connection rows, the legacy
+`watchsync.trakt.*` settings and migration markers, and disabled any installed
+copy. Watch history imported under the `trakt` source stays.
+
+Only that plugin ID is retired. A community Trakt plugin with its own plugin ID
+registers like any other third-party plugin, under a per-installation key; it
+starts with no connections, since the old ones were deleted.
 
 ## Connection settings
 
@@ -86,6 +98,50 @@ once when it is made and the host does not store.
   anything is stored. A stored value for a setting the plugin no longer declares stays
   in the row but is not sent.
 
+## List sync rows
+
+`watch_provider_list_items` holds one row per library item on a synced
+favorites or watchlist, unique on `(connection_id, list_kind, media_item_id)`.
+The `provider_item_key` is not unique. The key is the item's IMDb, TMDB, or TVDB
+id without its kind, and `media_items` does not keep those ids unique, so two
+items can share one: two library items for one title, or a movie and a series
+with the same TMDB id. The ratings and dropped-show rows work the same way.
+
+Several items with one key follow these rules:
+
+- A provider removal is held while another library item of the same kind,
+  still on the local list, has the key. Removing the key would take that item
+  off the provider too.
+- With removal sync on, an import does not add back an item whose local
+  removal has not reached the provider yet, unless the provider dated its
+  listing after the removal. An undated listing never counts as newer.
+- A full import counts every IMDb, TMDB, and TVDB id on a provider row as
+  present for that row's kind, since a plugin's key can use a different id than
+  the one stored at export (a provider may key shows by TVDB id first). A row or stored
+  item without a kind matches any kind.
+- A remote tombstone removes every row with its key, and with its kind when it
+  names one. Plugin tombstones carry only the key, so one whose rows name more
+  than one kind of title changes nothing and adds a warning.
+
+## Watched-history export
+
+A sync drains a connection's whole pending history-export backlog, oldest play
+first, in calls of at most the plugin's `max_batch_size` plays. Each call's
+per-play results are stored before the next call, so a run that stops partway
+keeps its progress. The run pages the backlog by `(watched_at, id)`, so a play
+that fails waits for the next sync instead of being retried within the same
+run; a play stops being retried after five failed attempts. A rate-limit fault
+ends the run and defers the connection until the provider's retry time. A run
+with a deadline (a manual sync) stops starting calls three minutes before it,
+and an export created after the run read local history waits for the next run
+rather than being retired as missing. The same `max_batch_size` also bounds
+every other `ApplyEvents` call and the page size Prairie asks for in
+`ListRemoteState`. A
+plugin must answer each play on its own. It reports `APPLIED` or `NO_CHANGE`
+only for a play the provider accepted, `REJECTED` for one the provider cannot
+take, and `RETRY` for one it cannot confirm. Prairie records `APPLIED` as sent and
+never sends that play again.
+
 ## Event media
 
 Playback scrobbles, watched exports and unwatch events send a plugin the
diff --git a/docs/architecture/web-decode-engine.md b/docs/architecture/web-decode-engine.md
new file mode 100644
index 0000000000..616e58b3f9
--- /dev/null
+++ b/docs/architecture/web-decode-engine.md
@@ -0,0 +1,229 @@
+# Web browser decode engine
+
+The web player can decode an original file itself when the browser's media
+element cannot: Dolby TrueHD, DTS (including DTS-HD MA), AC-3 and E-AC-3 audio,
+HDR10, HLG and Dolby Vision base layers on SDR screens, Matroska in Firefox, and
+a non-default audio track. The server then sends the untouched file
+(`original_http`) instead of converting it. Paths are repository-relative.
+
+The engine is a per-browser beta setting (Settings → Playback → This browser),
+stored in `localStorage` under `prairie-player-browser-decoding`, off by default.
+With it off, nothing below loads and the player behaves as before.
+
+## Capability contract
+
+The engine adds to the existing `declared`-tier capability block
+(`web/src/player/client-context-v3.ts`). It never changes the evidence tier.
+
+- `original_http` gains the engine's containers (`mkv`, `mp4`), video codecs
+  (whatever WebCodecs reports for H.264, HEVC, AV1, VP9, VP8), and audio codecs
+  (WebCodecs AAC, Opus, MP3, FLAC; the bundled FFmpeg decoders for `ac3`,
+  `eac3`, `dts`, `truehd`, `mlp`; uncompressed PCM).
+- `original_http` gains the validated claims `client_selected_audio_track_v1`
+  and, when the WebGPU presenter passes the probe and the display is SDR,
+  `client_managed_dynamic_range_v1`
+  (see [playback-protocol-v3.md](playback-protocol-v3.md) §3 and §4). The
+  engine presents only SDR, so on an HDR display (`dynamic-range: high`) the
+  claim stays off and HDR sources keep the routes that preserve HDR.
+- The device-level `client_capabilities` lists carry the same additions,
+  because the planner reads them before narrowing each route by its delivery
+  class. `progressive` and `hls` keep the media element's own lists, so remux
+  and transcode routes are unchanged.
+
+The probe (`web/src/player/engine/capabilities.ts`) asks WebCodecs
+`isConfigSupported` and checks the HDR presenter: a hardware (non-fallback)
+WebGPU adapter, a device, both presenter pipelines compiled, and one picture
+drawn through each path without a validation error (`probePresenter` in
+`renderers.ts`). The codec answers and the HDR answer are each bounded by
+`PROBE_TIMEOUT_MS`, and once a hardware adapter is found the rest of the HDR
+check gets `HDR_CHECK_GRACE_MS`, because every playback start waits for the
+probe and the check can take seconds on some Linux Vulkan drivers. A check
+still running then counts as passed when nothing has failed, because the
+presenter reports failures at runtime. What the check learns after its
+deadline (its own answer, or a hardware adapter that answered late) applies
+the next time the player opens. A device lost during the check, or a presenter chunk that
+fails to load, leaves the answer open. Like the rest of the web block it is a declaration,
+not a decode of real media. A source that passes the probe and still cannot be
+decoded or presented fails with a typed classification, and the normal
+`failure_recovery` replan excludes the plan's attempt key, so the server falls
+through to a packaged route.
+
+The server needs no change: the planner already honours both claims on
+`original_http`.
+
+## Routing an `original_http` plan
+
+`web/src/player/engine/routing.ts` decides who plays the plan:
+
+1. The media element, when it plays the container, video codec and audio codec
+   natively, the source is SDR, and the selected audio track is the container
+   default (the first track flagged default, else the first, as the server
+   computes it). Hardware decode and the browser's own A/V sync win whenever
+   they can.
+2. The engine, when it covers the container, both codecs and the dynamic range.
+   Dolby Vision plays its standards-compatible base layer: Profile 8.1 and
+   Profile 7 as HDR10, 8.4 as HLG, 8.2 as SDR.
+3. Otherwise neither, and the player reports
+   `browser_engine_unsupported_source` before loading any bytes. Profile 5
+   (no compatible base layer) and HDR without WebGPU land here.
+
+## Runtime
+
+```
+VideoPlayer (page)
+  <video>  — no source; keeps every listener, layout and ref
+  EnginePlayer (engine/EnginePlayer.ts) — media-element behaviour, clock, rAF presentation
+    ├─ engine.worker.ts — Mediabunny demux over HTTP ranges, WebCodecs video,
+    │                     WebCodecs / FFmpeg WASM / PCM audio, downmix
+    ├─ audio.worklet.ts — PCM ring and master clock, fed by the worker directly
+    └─ renderers.ts     — 2D canvas (SDR), or for HDR a WebGPU tone map plus a 2D canvas layer
+                          for frames only the browser can map
+```
+
+- **Facade.** `engine/facade.ts` installs instance-level overrides on the
+  player's `<video>` (`currentTime`, `paused`, `readyState`, `play`,
+  `requestVideoFrameCallback`, `addTextTrack`, …) that forward to the engine,
+  which dispatches the media events on the element in the order a media
+  element would. Deleting the overrides restores the native element. This is
+  what lets every existing hook (progress, Watch Together, keyboard, subtitles,
+  JASSUB) work unchanged. `addTextTrack` returns `EngineTextTrack`, because the
+  browser only activates cues on a media element whose own timeline advances.
+- **Clock.** With audio, the worklet reports which media time it rendered at
+  which context time; the page reads that mapping at the context time reaching
+  the speakers (`AudioContext.getOutputTimestamp`). Video frames are pulled
+  against it on every animation frame, and late frames are released undrawn.
+  Each report carries the rate the worklet rendered at, and the page reads
+  from the newest report at or before the audible time, so a speed change
+  takes effect when its audio reaches the speakers. Without audio, the clock
+  runs from `performance.now()` and holds while the decoder is starved.
+- **Credits.** The worker keeps at most 6 decoded frames outstanding and 1.5 s
+  of audio ahead of what the worklet has played. While the tab is hidden,
+  frames are presented on a 100 ms timer, so due frames are also released as
+  they arrive; otherwise fast playback would outrun the credits. A seek starts
+  a new generation; every message carries one, and stale ones are dropped
+  wherever they land.
+- **Audio.** The AudioContext opens at the track's sample rate. Surround
+  passes through when `destination.maxChannelCount` allows it; otherwise the
+  worker downmixes with ATSC A/52 Lo/Ro coefficients and the worklet soft-limits
+  overs. At a playback rate other than 1 the worklet's read head still steps
+  through the queue at that rate, which keeps the clock and the credits as at
+  1x, but the samples come from a WSOLA time stretcher (`timeStretch.ts`) that
+  keeps the pitch. Above 1x each sequence starts half its skip past the head,
+  so the audio stays centred on the clock. It builds each 40–60 ms sequence
+  only from PCM already queued (gaps in the timestamps count as silence), so
+  running short is an underrun rather than silence played as audio. Watch
+  Together still corrects the engine by seeking rather than by rate nudges.
+- **Picture.** Each session draws on canvases it creates inside a box under the
+  `<video>`: one for SDR, and for HDR a WebGPU canvas plus a 2D canvas added
+  when needed, because a canvas keeps the first context type it hands out. The
+  box is observed in device pixels (`device-pixel-content-box`) so canvases
+  match the screen exactly; where the browser cannot report that (Safari), the
+  box's CSS pixels times the device pixel ratio stand in, and a resolution
+  media query redraws on a ratio change.
+- **Readiness and autoplay.** The worker signals once enough audio has been sent
+  to the worklet, because the worklet does not run while the AudioContext is
+  suspended. `play()` refuses without events on a page that never had a user
+  gesture, like a media element; a refused `AudioContext.resume()` settles the
+  player paused. While playing, the engine holds a screen wake lock and
+  answers the Media Session play and pause actions, which a playing `<video>`
+  gets from the browser.
+
+## HDR presentation
+
+`engine/hdrShader.ts` mirrors the reference in `engine/colorMath.ts`: PQ or HLG
+decode, BT.2390 EETF from a 1000-nit source peak to SDR white at 100 nits, the
+source gamut to BT.709, sRGB encode. These match the server's tone-map recipes in
+`internal/tonemap`, so a picture looks the same whichever side tone-maps it.
+
+- **Planes.** Software-decoded 10/12-bit frames (`I420P10`, `I420P12` and their
+  4:2:2/4:4:4 forms) are copied out with `VideoFrame.copyTo`, uploaded as
+  `r16uint` textures and converted in the shader at full precision.
+- **External textures.** The worker re-tags HDR decoder configurations as
+  BT.709/sRGB so the browser applies only the Y'CbCr matrix when a GPU-backed
+  frame is imported with `importExternalTexture`, leaving the PQ/HLG codes for
+  the shader. Chromium imports these through an 8-bit surface, so this path
+  quantizes before tone mapping. WebKit imports 10-bit hardware-decoded frames
+  wrongly (the samples come out as if read at 8 bits), so each presenter draws
+  a frame both ways, imported and copied with `copyExternalImageToTexture` into
+  a half-float texture, at 8x8 and compares them. Where they agree it imports
+  from then on; where they differ (WebKit's 10-bit frames) it copies every
+  frame, at the cost of one GPU copy per frame. A dark or flat frame looks alike
+  both ways even when the import is wrong, so such a check decides nothing and
+  a later frame is tried. It copies until there is an answer, and imports where
+  the browser cannot copy a VideoFrame (Firefox).
+- **Routing.** Each picture goes to the path its kind and tag call for
+  (`routePicture` in `engine/renderers.ts`):
+
+  | Picture | Path |
+  | --- | --- |
+  | Uploaded planes | WebGPU, planes pipeline |
+  | Frame tagged BT.709 primaries and sRGB transfer (the re-tag held) | WebGPU, external texture or a copy (see above) |
+  | Frame tagged PQ or HLG (a hardware decoder ignored the re-tag: VideoToolbox, D3D11, VA-API) | 2D canvas, which tone-maps the way the browser's `<video>` does, when `canvasMapsHDR` |
+  | Anything else | `browser_engine_presentation_failed` |
+
+  Chromium's WebGPU import of a PQ/HLG-tagged frame is desaturated, so those
+  frames go to the 2D canvas. `canvasMapsHDR` checks, once per page and
+  transfer and only when a session first needs it, that a canvas set up like
+  the presenter's maps a dark code, reference white and a highlight
+  differently from sRGB and below clipping: Chromium and Safari do, Firefox
+  draws the raw codes, so there such a frame fails over instead. The canvas's mapping is the browser's, not the
+  server recipe's, so a session that switches paths changes brightness.
+- **Source colour.** The worker reads the stream's primaries, matrix and chroma
+  siting before the re-tag (`engine/pictureColor.ts`) and sends them with
+  `ready`. Primaries other than BT.709 and P3 (D65), and matrices other than
+  BT.709, are read as BT.2020, whether stated or unknown. Chroma siting comes from
+  AV1's signalled `chroma_sample_position`; H.264 and HEVC use type 0, the
+  position of an unsignalled stream (an explicit VUI value is not read); VP9,
+  which signals none, and unsignalled AV1 keep the centred position. 4:2:2 is
+  always co-sited horizontally.
+- **Scaling down.** Each fragment averages an N x N grid of bilinear samples
+  across its footprint, N being the texels of that plane the pixel covers (at
+  most 4), so a picture drawn smaller than its size does not alias.
+- **Errors.** Pipelines are built with `createRenderPipelineAsync` inside an
+  error scope, and each draw runs inside a validation scope; the first error,
+  or an `uncapturederror` event (allocation failures included), fails the engine with
+  `browser_engine_presentation_failed` so the replan runs. WebGPU never throws
+  for these, so without the scopes a broken presenter shows a black picture
+  while audio plays.
+- **Device.** The presenter uses the default adapter, the one the browser
+  composites with, and treats a software adapter as none. The page keeps one
+  presenter device: the probe offers its device as soon as the presenter
+  compiles (its test draw can take seconds to report on some Linux drivers),
+  and each playback hands it on when it ends unless it was lost or reported an
+  error. The device subscribes to its loss and uncaptured errors once and
+  forwards them to whichever renderer holds it; a renderer that takes a
+  device handles what it reported before then, such as a loss during
+  compilation, the same way. A lost device is replaced in
+  place with a fresh one within `DEVICE_RECOVERY_TIMEOUT_MS`, at most
+  `MAX_DEVICE_RECOVERIES` times per session. A hardware decoder dies with the
+  GPU process too, so after a video decoder error `EnginePlayer` starts a new
+  decode run at the current position, after `DECODER_RESTART_DELAY_MS` times
+  the restarts so far and at most `MAX_DECODER_RESTARTS` times per session,
+  showing only waiting and playing as a media element would; a run that then
+  shows no picture, or a stream that keeps failing, fails over as a decode
+  failure.
+- **Layers.** Each session draws in its own box, which replaces whatever an
+  earlier session left in the surface.
+- **Dolby Vision.** RPU (NAL 62) and enhancement-layer (NAL 63 or
+  `nuh_layer_id > 0`) units are removed before decode (`engine/hevc.ts`).
+
+## Limits
+
+- Containers are Matroska/WebM and MP4/MOV only; AVI and MPEG-TS stay on
+  server routes.
+- HEVC depends on the platform decoder WebCodecs exposes (hardware on Windows
+  and macOS; usually absent on Linux). MPEG-2 and VC-1 are not decoded.
+- Picture-in-picture is unavailable while the engine plays (the picture is a
+  canvas); the player hides the control.
+- Dolby Vision Profile 5 is refused; the server's own routes take it.
+
+## FFmpeg audio decoders
+
+`web/src/player/engine/wasm/prairie-audio-decoders.{mjs,wasm}` are built from a
+pinned FFmpeg release with only the `ac3`, `eac3`, `dca`, `truehd` and `mlp`
+decoders enabled, plus `web/wasm/audio-decoders/bridge.c`. They are committed
+so the web build never needs Emscripten. Rebuild them with
+`web/wasm/audio-decoders/build.sh` (Docker) after changing the FFmpeg tag, the
+decoder set, or the bridge; the FFmpeg commit is recorded in
+`prairie-audio-decoders.ffmpeg-revision`. FFmpeg is LGPL-2.1-or-later; see
+`THIRD_PARTY_NOTICES.md`.
diff --git a/docs/architecture/web-pgs-subtitles.md b/docs/architecture/web-pgs-subtitles.md
new file mode 100644
index 0000000000..edc6cc703b
--- /dev/null
+++ b/docs/architecture/web-pgs-subtitles.md
@@ -0,0 +1,53 @@
+# Web PGS subtitles
+
+The web player draws embedded PGS (Blu-ray bitmap) subtitles itself instead of
+asking the server to burn them into a transcode. Paths are
+repository-relative.
+
+## Contract
+
+The web player declares `embedded_bitmap: true` on every delivery class
+(`web/src/player/client-context-v3.ts`). The server then keeps the plan's
+delivery and publishes the embedded PGS track as a lossless `.sup` sidecar
+(`subtitle.mode: "render"`), the same way it publishes embedded text tracks
+(see [playback-protocol-v3.md](playback-protocol-v3.md) §8).
+`embedded_bitmap` covers embedded PGS only. The server still burns in embedded
+DVD (VobSub) and DVB bitmaps, and refuses external bitmap files
+(`subtitle_burn_in_source_unsupported`). `sidecar_bitmap` stays `false`.
+
+Auto-select and the initial start ask the same question through
+`subtitleNeedsBurnIn` (`web/src/player/utils/subtitleCodecs.ts`): embedded
+PGS does not need the server, so it is not ranked as a burn-in and a refused
+start is not blamed on it.
+
+## Rendering
+
+- `web/src/player/utils/pgs.ts` parses the `.sup` stream: segments, palettes
+  (YCbCr to RGBA, BT.709 for HD and BT.601 for SD), run-length objects,
+  windows, object cropping and composition states. It parses incrementally
+  and looks up the display set active at a media time.
+- Palettes and objects persist through an epoch, so a display set can place
+  objects an earlier one defined. A display set whose objects or palette the
+  parser never saw is dropped, never treated as a clear.
+- `web/src/player/hooks/usePGSSubtitles.ts` fetches positioned windows
+  (`windowed=1&position=&duration=`) through the same window planner as the
+  text-subtitle fetcher (`web/src/player/utils/subtitleWindows.ts`), so seeks
+  far into a file do not download the whole track. An extend window keeps the
+  parser's epoch state; a fresh window after a seek starts a new parser, so a
+  screen whose epoch began before the window shows from the next epoch start.
+- A screen stays up until the next display set replaces it, but never past
+  what has loaded: the end of the last finished window or, beyond it, the
+  latest segment read from the window on the wire. Screens more than one window
+  behind the playhead are dropped.
+- Each composition is drawn on a canvas that spans the player, scaled from the
+  PGS video size onto the picture rectangle (`web/src/player/utils/videoFit.ts`)
+  for both contain and cover fits. The plane matches the picture along its
+  uncropped side, so subtitles authored in a letterbox or pillarbox stay
+  there. Objects stay inside the player, shrinking when they do not fit (a
+  Fill crop, or a tall object over a short player), and lower-half objects
+  stay above the control bar while it is up, whatever the text position
+  setting says.
+- The subtitle delay and the stream's timeline origin apply as they do for text
+  cues.
+- A plan whose subtitle mode is still `burn_in` is left to the server, and the
+  overlay stays off so the subtitle is not drawn twice.
diff --git a/docs/architecture/worker-http-protocol.md b/docs/architecture/worker-http-protocol.md
index 8442c21ea9..d8aa566fbb 100644
--- a/docs/architecture/worker-http-protocol.md
+++ b/docs/architecture/worker-http-protocol.md
@@ -6,6 +6,11 @@ worker operation: proxy `/status` returns `active_sessions`, while transcode
 `/status` returns `status`, `active_jobs`, and `sessions`. Both can include the
 same optional system and GPU samples.
 
+"Node bearer" in this document names the route inventory's `node_bearer`
+authorization class: routes that admit only API servers and proxies. Despite the
+name, those callers send a per-request signature, never the shared secret; see
+[Authentication](#authentication).
+
 The `x-silo-worker-protocols` extension in `contracts/api/v2/openapi.json` describes
 retained operations by listener, method, path, handler identity, authorization
 class, and response status/media/schema. Schemas are generated by Huma from the
@@ -50,7 +55,7 @@ disconnected. A proxy that hosts no plugins answers plain-text 503. See
 [network-access.md](network-access.md).
 
 An unconfigured transcode listener also returns plain-text 503 from its bearer
-middleware, including for both reload commands. All six require the existing node bearer token. Reprobe refuses active probes;
+middleware, including for both reload commands. All six require node bearer authentication. Reprobe refuses active probes;
 the transcode node also refuses active jobs while holding its GPU admission gate.
 These commands have no durable replay receipt. Their descriptions classify them
 as `non_retryable`: a lost reply does not establish that the command had no effect,
@@ -88,7 +93,10 @@ whole run, software attempts included, so an admin re-probe is refused until
 the run ends. Failures use `trickplay.ExtractError` JSON;
 a `422` carries the sampling cause and whether it is `permanent` (a cause in
 the file itself). Nodes advertise the endpoint as the
-`trickplay_extract_v1` transport feature. It has no replay receipt and is
+`trickplay_extract_v1` transport feature, and as `trickplay_extract_v2` once
+they convert HDR with the tone-map source signal a request names
+(`sheets.tone_map.source`), decode on CUDA, and repair missing and repeated
+cells; API servers that send the signal only use v2 nodes. It has no replay receipt and is
 classified `non_retryable`; the API server keeps the work's lease and moves
 it to another node or back to the queue.
 
@@ -302,6 +310,76 @@ deadlines and stream accounting remain unchanged; a later read failure can
 truncate committed bytes without a new status. No transfer receipt, worker
 reconstruction or new native route is introduced.
 
+## Authentication
+
+API servers and proxies sign every call to a worker's node bearer routes;
+`internal/nodeauth` implements both sides. Senders call `nodeauth.Sign` just
+before sending, and the transcode node and proxy middleware call
+`nodeauth.Verify`. There is no worker-to-API call.
+
+A signed request never carries the shared `auth.jwt_secret`. That secret also
+signs login, profile, and stream tokens, so a copy captured from a worker link
+would mint them. Each side instead derives a MAC key from it with HKDF-SHA256 (no salt,
+info `prairie/node-request-auth/v1`, 32 bytes). Nothing else uses that label, so
+the key cannot sign or verify any other token. A request carries:
+
+```text
+Authorization: Prairie-Node-HMAC-SHA256 t=<unix seconds>,b=<hex body SHA-256>,sig=<hex HMAC-SHA256>
+```
+
+`b` is the SHA-256 of the body, or of the empty string when there is none. The
+MAC covers these values, joined by newlines: the literal
+`prairie-node-request-v1`, `t`, the method, the escaped request path (`/` when
+empty), the raw query, and `b` as sent. The sender signs the path relative to
+the worker's registered URL, leaving out any path prefix in that URL: workers
+serve their routes from `/`, so a reverse proxy that puts one under a prefix
+strips it, and the worker verifies the path it receives. The worker checks, in
+order:
+
+1. the MAC, recomputed over the request it received and compared with
+   `hmac.Equal`, before reading any body, so a caller without the secret cannot
+   make the worker buffer one;
+2. the timestamp, refused when more than 30 seconds from the worker's clock in
+   either direction;
+3. the body, at most 1 MiB, whose SHA-256 must equal `b`. The worker then hands
+   the buffered body to the handler.
+
+Every authentication refusal is a plain-text `401`. A sender with no secret
+configured sends the request unsigned, and the worker refuses it. The worker
+logs an invalid signature, a valid signature outside the window (with the
+clock offset), and a body that does not match its signature. Each kind logs at
+most once every ten minutes and counts the refusals it suppressed.
+
+What this requires and allows:
+
+- Worker clocks stay within 30 seconds of the API servers and proxies.
+- A reverse proxy in front of a worker may strip the path prefix of the
+  worker's registered URL, but must otherwise forward the path and query
+  unchanged. Headers, including `Host`, are not signed.
+- A captured signed request can be replayed, to the same or another worker,
+  until its timestamp expires. Its method, path, query, and body cannot be altered; its
+  headers can, since they are not signed. It reveals nothing that signs another
+  request or token. Signing does not encrypt: worker links that cross untrusted
+  networks still need TLS to keep media and requests private.
+
+### Upgrading to signed requests
+
+Release notes certify which component versions may run together
+([release versioning](../release-versioning.md)). Upgrading every component
+together, as a stop-and-replace, has no mixed state. For a rolling upgrade,
+workers also accept the previous release's `Authorization: Bearer <secret>`,
+compared in constant time, and log a warning at most once every ten minutes
+when they do. Senders from this release only sign, which earlier workers
+refuse, so upgrade transcode nodes first, then proxies, then API servers. Until
+the last older sender is upgraded, its requests still carry the secret, so a
+rolling upgrade over links without TLS exposes it for that window; a
+stop-and-replace upgrade does not. Recovery from a failed upgrade is the release-wide backup and redeploy;
+rolling one worker back alone leaves it refusing every upgraded sender.
+
+The next release removes the legacy bearer from `nodeauth.Verify`. Its release
+notes must name this release as a required step for rolling upgrades, because
+its workers refuse senders from before this release.
+
 ## Remaining progressive and HLS delivery chain
 
 Proxy token remux routes keep the legacy and audio-v2 suffixes distinct. The
diff --git a/docs/catalog-api.md b/docs/catalog-api.md
index 627b59c10b..03f482a1a3 100644
--- a/docs/catalog-api.md
+++ b/docs/catalog-api.md
@@ -244,8 +244,8 @@ The frozen `/api/v1/collections/preview` response is unchanged and carries no po
 
 ## Personal collection imports
 
-A personal collection imported with `importMDBListCollection`, `importTMDBCollection`,
-`importTMDBListCollection`, or `importTraktCollection` holds only titles its owner profile
+A personal collection imported with `importMDBListCollection`, `importTMDBCollection`, or
+`importTMDBListCollection` holds only titles its owner profile
 can access: titles in the owner's allowed libraries that pass its rating limits. Those are
 the `max_content_rating` ceiling, with the server's `access.unrated_content` setting for
 unrated titles, and the `max_advisory_age` limit, with `require_advisory_age` (see
@@ -256,8 +256,10 @@ whether it runs on import, through `syncCollection`, or on the collection's sche
 - The item limit fills with titles the owner can access. The sync checks every source entry
   it reads before it applies the limit, so titles outside the owner's access never take a
   slot. With an item limit set, the sync reads at most four times the limit from the source
-  (100 to 500 entries), so an owner with tight limits can get fewer titles than the limit
-  even when the full source list holds enough the owner can access.
+  (at least 100 entries), so an owner with tight limits can get fewer titles than the limit
+  even when the full source list holds enough the owner can access. The limit can be any
+  positive number. Without one, an MDBList sync reads up to 10,000 entries, a TMDB list sync
+  the whole list, and a TMDB preset its first 20.
 - `library_ids` keeps only titles in one of the listed libraries, and each title must still
   be one the owner can access. Omit it to match against everything the owner can access.
 - The sync summary counts only titles the owner can access. `items_matched` counts the
@@ -278,7 +280,7 @@ Each viewer of a shared collection still sees only the titles that viewer can ac
 ## Personal sync schedules
 
 `updateCollection` (`PATCH /api/v2/collections/{id}`) accepts `sync_schedule` on a synced list
-(a collection imported from MDBList, TMDB, or Trakt). The value is a cadence name, `daily`,
+(a collection imported from MDBList or TMDB). The value is a cadence name, `daily`,
 `weekly`, or `monthly`, or `""` to stop scheduled syncs; `syncCollection` still syncs on demand.
 Cron expressions are a validation failure for every account, administrators included, and so is
 `sync_schedule` on a manual or smart collection or `null`. A cadence sets `next_sync_at` to the
@@ -357,6 +359,16 @@ marks an episode only when every one of its files is unreadable, since any
 readable version still plays. `/api/v1` episode listings do not carry the
 field.
 
+## Episode ratings
+
+Each episode in `listSeasonEpisodes` and `listCatalogItemEpisodes` carries
+`ratings`, its IMDb and TMDB ratings in the same `CatalogRating` shape a title
+page's `ratings` uses: a 0-100 `score`, the source's own `display`, and the
+source's `name`. They are built from the episode's stored rating columns by the
+same rules as a title page, so a stored 0 (unrated) or a value off the 0-10
+scale is left out, and an episode with no rating omits the field. `/api/v1`
+episode listings do not carry ratings.
+
 ## Section quality badges
 
 Home and library section cards derive `overlay_summary` from the best accessible,
@@ -396,6 +408,16 @@ cannot extend that deadline. Cold or expired membership requires a fresh build;
 an older in-flight build cannot replace the current generation. Badge summaries
 and per-profile playability are recomputed during this grace period.
 
+## Continue Watching row
+
+When the profile's `ui.next_up_mode` is `combined` (the default), Continue
+Watching merges in-progress cards with next-up episodes, keeps one card per
+series, orders the cards by most recent activity, and returns at most the row's
+`item_limit` cards. A next-up card's activity is when the profile finished the
+previous episode; with `ui.next_up_new_releases_first` on, it is when the next
+episode was released to the server if that came later. With `separate`, the row holds only in-progress cards and
+Next Up is its own row.
+
 ## Bridge note
 
 The alpha `/api/v1` surface exposes the same saved-sort and capability features at
@@ -414,6 +436,25 @@ by the stored timestamp column so the existing profile/time indexes can serve th
 `added_at` fields remain UTC timestamps with millisecond precision. The frozen v1 list queries and their timestamp
 formatting are unchanged.
 
+## Not interested
+
+A profile marks a movie or series it does not want recommended with
+`PUT /api/v2/not-interested/{item_id}` and clears the mark with `DELETE` on the
+same path; both answer `204` and repeat safely. Episodes and seasons answer `422`;
+mark the series. `GET /api/v2/not-interested` pages the marks as catalog cards,
+newest first, with the same kind of cursor as the favorites list, and
+`GET /api/v2/not-interested/{item_id}` answers one mark or `404`. Every card's
+`user_state.not_interested` carries the flag. Detect support with
+`GET /api/v2/capabilities/not-interested`.
+
+A mark keeps the title out of the profile's recommendation and discovery rows
+and ranks similar titles lower there, after a rebuild that starts within
+seconds; it leaves library browsing, search, item detail, playback, favorites
+and the watchlist alone. A change publishes `user_state.changed` with
+`change: "not_interested"` and a `not_interested` boolean, so the profile's other
+clients can update. The frozen v1 surface has no mark and does not show it. See
+[recommendations.md](architecture/recommendations.md#rows).
+
 ## Watchlist titles outside the library
 
 The watchlist can also hold movies and series the library doesn't have, keyed by
@@ -582,7 +623,8 @@ PostgreSQL search retains the complete relevance tuple or requested SQL sort
 rather than a numeric page. It selects the FTS or bounded fuzzy retrieval family
 on the first page and retains that choice. The existing fuzzy candidate cap and
 reranking remain in force. A fuzzy-family query that becomes a richer FTS query
-returns `invalid_cursor` so the client can restart. PostgreSQL search retains its
+returns `invalid_cursor` so the client can restart, as does a cursor issued by a
+server whose PostgreSQL ranking differed. PostgreSQL search retains its
 three-second deadline inside the overall browse deadline.
 
 Meilisearch captures the configured ranked result window in one provider response,
@@ -1094,3 +1136,42 @@ issue #937. They need V2 discovery and fixtures, settings, playback, and lifecyc
 support before enabling it. Provider downloads, theme videos, uploads, remote
 URLs, and HLS theme transcoding are outside this local-file capability. No V1
 route or V1 item-detail shape changes.
+
+## Description translation
+
+Prairie can translate descriptions with an AI model into a profile's metadata
+language (`metadata_ai` settings). Localized text reaches clients through the
+ordinary localized fields; these members describe it:
+
+- `machine_translated_fields` on the item detail, season rows and episode rows
+  lists the localized fields whose text an AI translation wrote: `overview`
+  and, on items, `tagline`. It is absent when no shown field was
+  machine-translated, and it is never set for provider or manually entered
+  text. Clients label exactly the fields it names; an AI `tagline` alone says
+  nothing about the overview. The frozen v1 JSON does not carry it.
+- `pending_translation_language` on the item detail is this profile's
+  metadata language when the item's description is not available in it yet.
+  `POST /api/v2/catalog/items/{id}/translate-description` with that value as
+  `target_language` queues the translation, and a later detail read carries
+  the translated text. Reading the detail queues nothing. `on_view` from
+  `GET /api/v2/capabilities/metadata-ai` says when a client sends that
+  request: as soon as it shows such an item (`auto`), when the viewer asks
+  for it (`button`), or never (`off`).
+- On-view translation covers what the page shows: a movie or series its own
+  overview and tagline, a season its overview and its episodes' overviews, an
+  episode itself. A season's `pending_translation_language` is therefore also
+  set while any of its episodes lacks the language, and v2 episode rows carry
+  their own `pending_translation_language`, so a client that lists episodes
+  inline (a single-season series) can translate that season. Children whose
+  source text is already in the target language are skipped.
+- Home and library section cards carry the profile's localized title and
+  overview (an episode card its episode's), with the same
+  `pending_translation_language` and `machine_translated_fields` members as
+  the detail document. A library's rows resolve the language as a detail
+  page opened in that library does, so a profile without a metadata language
+  sees the library's. Cards keep the source poster, backdrop, and logo, and an
+  episode card's `series_title` stays the source title. Shuffle and Watch
+  Together picker cards come from the item detail and carry them too. Other
+  card lists, such as recommendations and Watch Tonight, are not localized
+  and never carry these members. The web Featured hero uses them to translate the
+  slide on screen; other cards only display them.
diff --git a/docs/collections-api.md b/docs/collections-api.md
index bacafeaa62..9a4dc4f81b 100644
--- a/docs/collections-api.md
+++ b/docs/collections-api.md
@@ -29,8 +29,8 @@ the profile does not own.
 ## Sharing
 
 `is_shared` is the one sharing switch, on `createCollection`, `updateCollection` and the import
-operations (`importMDBListCollection`, `importTMDBCollection`, `importTMDBListCollection`,
-`importTraktCollection`). Clients label it **Show to other profiles**.
+operations (`importMDBListCollection`, `importTMDBCollection`, `importTMDBListCollection`).
+Clients label it **Show to other profiles**.
 
 `include_in_server_collections` is independent: it places the collection in the library
 Collections tab (`listLibraryUserCollections`, `getLibraryCollections`) of every profile that can
diff --git a/docs/design/schemas/playback-v3/v3/decision-response.schema.json b/docs/design/schemas/playback-v3/v3/decision-response.schema.json
index 87c7acc246..34c070435b 100644
--- a/docs/design/schemas/playback-v3/v3/decision-response.schema.json
+++ b/docs/design/schemas/playback-v3/v3/decision-response.schema.json
@@ -626,10 +626,73 @@
             }
           },
           "additionalProperties": true
+        },
+        "hls_rendition": {
+          "type": "object",
+          "description": "The selected track is carried by the plan's HLS stream: a multivariant playlist whose SUBTITLES group group_id holds it as one WebVTT rendition. Published only on server_transcode_hls plans to clients that negotiated hls_subtitle_renditions_v1. Mutually exclusive with artifact and embedded; inventory URLs remain available for other selections.",
+          "required": [
+            "group_id",
+            "name",
+            "format",
+            "mime_type"
+          ],
+          "properties": {
+            "group_id": {
+              "type": "string",
+              "minLength": 1
+            },
+            "name": {
+              "type": "string",
+              "minLength": 1
+            },
+            "format": {
+              "type": "string",
+              "const": "vtt"
+            },
+            "mime_type": {
+              "type": "string",
+              "const": "text/vtt"
+            }
+          },
+          "additionalProperties": true
         }
       },
       "additionalProperties": true,
       "allOf": [
+        {
+          "if": {
+            "required": [
+              "hls_rendition"
+            ]
+          },
+          "then": {
+            "required": [
+              "track_id"
+            ],
+            "properties": {
+              "mode": {
+                "enum": [
+                  "render",
+                  "convert"
+                ]
+              }
+            },
+            "not": {
+              "anyOf": [
+                {
+                  "required": [
+                    "artifact"
+                  ]
+                },
+                {
+                  "required": [
+                    "embedded"
+                  ]
+                }
+              ]
+            }
+          }
+        },
         {
           "if": {
             "required": [
diff --git a/docs/design/schemas/playback-v3/v3/fixtures/invalid/hls-subtitle-rendition-ass-decision_response.json b/docs/design/schemas/playback-v3/v3/fixtures/invalid/hls-subtitle-rendition-ass-decision_response.json
new file mode 100644
index 0000000000..67a8f3f40d
--- /dev/null
+++ b/docs/design/schemas/playback-v3/v3/fixtures/invalid/hls-subtitle-rendition-ass-decision_response.json
@@ -0,0 +1,211 @@
+{
+  "protocol_version": 3,
+  "server_features": [
+    "playback_plan_v3",
+    "server_remote_stream_bitrate_policy_v1",
+    "server_local_stream_bitrate_policy_v1",
+    "neutral_playback_v3_contract_v1",
+    "embedded_subtitles_v1",
+    "layout_aware_passthrough",
+    "playback_route_diagnostics",
+    "device_quirks_v1",
+    "seek_reanchor_v1",
+    "output_change_v1",
+    "output_display_evidence_v1",
+    "direct_stream_resume_v1",
+    "header_authenticated_media_v1",
+    "authorized_media_origins_v1",
+    "software_video_decode_v1",
+    "plan_invalidated_v1",
+    "plan_source_duration_v1",
+    "subrip_sidecar_v1",
+    "marker_thumbnails_v1",
+    "hls_subtitle_renditions_v1"
+  ],
+  "outcome": "playable",
+  "session_id": "11111111-1111-4111-8111-111111111111",
+  "playback_plan": {
+    "protocol_version": 3,
+    "plan_id": "plan:a2bfe37d35d5f2cff351991b5fcbf627",
+    "plan_attempt_key": "v3:cd7f226dafc35c0a",
+    "session_id": "11111111-1111-4111-8111-111111111111",
+    "expires_at": "2030-01-01T00:00:00Z",
+    "delivery": "server_transcode_hls",
+    "stream": {
+      "url": "/playback/transcode/11111111-1111-4111-8111-111111111111/master.m3u8",
+      "protocol": "hls",
+      "container": "hls",
+      "mime_type": "application/vnd.apple.mpegurl",
+      "headers": {},
+      "header_refresh": "none"
+    },
+    "timeline": {
+      "source_start_seconds": 12.5,
+      "stream_origin_seconds": 0,
+      "player_start_seconds": 12.5,
+      "timeline_offset_seconds": 0,
+      "can_seek_anywhere": true,
+      "seek_restoration": "player_position"
+    },
+    "selected_tracks": {
+      "audio": {
+        "id": "file:42:audio:0",
+        "index": 0
+      },
+      "subtitle": {
+        "id": "file:42:subtitle:0",
+        "index": 0
+      }
+    },
+    "effective_recipe": {
+      "video_codec": "h264",
+      "audio_codec": "aac",
+      "width": 1280,
+      "height": 720,
+      "frame_rate": 23.976023976023978,
+      "bitrate_kbps": 2000,
+      "dynamic_range": "sdr",
+      "audio_channels": 2,
+      "audio_layout": "stereo"
+    },
+    "claims": {
+      "video": {
+        "hdr10": false,
+        "hdr10_plus": false,
+        "hlg": false,
+        "dolby_vision": false
+      },
+      "audio": {
+        "codec": "aac",
+        "passthrough": false,
+        "atmos_preserved": false,
+        "reason": "server_audio_adaptation"
+      },
+      "subtitles": {
+        "ass_styling_preserved": false,
+        "bitmap_overlay": false,
+        "bitmap_sidecar": false,
+        "reason": "server_hls_subtitle_rendition"
+      }
+    },
+    "subtitle": {
+      "hls_rendition": {
+        "group_id": "subs",
+        "name": "Subtitles",
+        "format": "ass",
+        "mime_type": "text/vtt"
+      },
+      "mode": "render",
+      "track_id": "file:42:subtitle:0",
+      "inventory": [
+        {
+          "track_id": "file:42:subtitle:0",
+          "combined_index": 0,
+          "source": "embedded",
+          "codec": "subrip",
+          "language": "eng",
+          "label": "English",
+          "forced": false,
+          "default": false,
+          "hearing_impaired": false,
+          "delivery": "sidecar",
+          "url": "/stream/11111111-1111-4111-8111-111111111111/subtitles/0.vtt?file_id=42&embedded_stream_index=3"
+        }
+      ]
+    },
+    "transformations": [
+      {
+        "name": "video_to_h264",
+        "executor": "server",
+        "recipe_version": "2",
+        "validated_claims": [
+          "h264_decode"
+        ]
+      },
+      {
+        "name": "audio_to_aac",
+        "executor": "server",
+        "recipe_version": "4",
+        "validated_claims": [
+          "audio_decode"
+        ]
+      }
+    ],
+    "applied_quirks": [],
+    "runtime_corrections": [],
+    "available_qualities": [
+      {
+        "label": "original",
+        "height": 1080,
+        "bitrate_kbps": 8000,
+        "preserves_source": true
+      },
+      {
+        "label": "1080p-medium",
+        "display_name": "1080p Medium",
+        "height": 1080,
+        "bitrate_kbps": 6000,
+        "preserves_source": false
+      },
+      {
+        "label": "1080p-low",
+        "display_name": "1080p Low",
+        "height": 1080,
+        "bitrate_kbps": 3000,
+        "preserves_source": false
+      },
+      {
+        "label": "720p-high",
+        "display_name": "720p High",
+        "height": 720,
+        "bitrate_kbps": 4000,
+        "preserves_source": false
+      },
+      {
+        "label": "720p-medium",
+        "display_name": "720p Medium",
+        "height": 720,
+        "bitrate_kbps": 2000,
+        "preserves_source": false
+      },
+      {
+        "label": "720p-low",
+        "display_name": "720p Low",
+        "height": 720,
+        "bitrate_kbps": 1500,
+        "preserves_source": false
+      },
+      {
+        "label": "480p",
+        "display_name": "480p",
+        "height": 480,
+        "bitrate_kbps": 1500,
+        "preserves_source": false
+      }
+    ],
+    "degradation_warnings": [],
+    "decision_reason": "quality_fixed_rung",
+    "requested_media_file_id": 42,
+    "effective_media_file_id": 42,
+    "source": {
+      "media_file_id": 42,
+      "duration_seconds": 7200,
+      "container": "mp4",
+      "video_codec": "h264",
+      "video_profile": "high",
+      "video_level": 41,
+      "bit_depth": 8,
+      "width": 1920,
+      "height": 1080,
+      "frame_rate": 23.976023976023978,
+      "bitrate_kbps": 8000,
+      "dynamic_range": "sdr",
+      "hdr10_plus": false,
+      "dv_enhancement_layer": "none",
+      "audio_codec": "aac",
+      "audio_channels": 2,
+      "audio_layout": "stereo"
+    },
+    "subtitle_fidelity_policy": "allow_simplified_rendering"
+  }
+}
diff --git a/docs/design/schemas/playback-v3/v3/fixtures/valid/hls-subtitle-rendition-decision_response.json b/docs/design/schemas/playback-v3/v3/fixtures/valid/hls-subtitle-rendition-decision_response.json
new file mode 100644
index 0000000000..e050c9b2ba
--- /dev/null
+++ b/docs/design/schemas/playback-v3/v3/fixtures/valid/hls-subtitle-rendition-decision_response.json
@@ -0,0 +1,211 @@
+{
+  "protocol_version": 3,
+  "server_features": [
+    "playback_plan_v3",
+    "server_remote_stream_bitrate_policy_v1",
+    "server_local_stream_bitrate_policy_v1",
+    "neutral_playback_v3_contract_v1",
+    "embedded_subtitles_v1",
+    "layout_aware_passthrough",
+    "playback_route_diagnostics",
+    "device_quirks_v1",
+    "seek_reanchor_v1",
+    "output_change_v1",
+    "output_display_evidence_v1",
+    "direct_stream_resume_v1",
+    "header_authenticated_media_v1",
+    "authorized_media_origins_v1",
+    "software_video_decode_v1",
+    "plan_invalidated_v1",
+    "plan_source_duration_v1",
+    "subrip_sidecar_v1",
+    "marker_thumbnails_v1",
+    "hls_subtitle_renditions_v1"
+  ],
+  "outcome": "playable",
+  "session_id": "11111111-1111-4111-8111-111111111111",
+  "playback_plan": {
+    "protocol_version": 3,
+    "plan_id": "plan:a2bfe37d35d5f2cff351991b5fcbf627",
+    "plan_attempt_key": "v3:cd7f226dafc35c0a",
+    "session_id": "11111111-1111-4111-8111-111111111111",
+    "expires_at": "2030-01-01T00:00:00Z",
+    "delivery": "server_transcode_hls",
+    "stream": {
+      "url": "/playback/transcode/11111111-1111-4111-8111-111111111111/master.m3u8",
+      "protocol": "hls",
+      "container": "hls",
+      "mime_type": "application/vnd.apple.mpegurl",
+      "headers": {},
+      "header_refresh": "none"
+    },
+    "timeline": {
+      "source_start_seconds": 12.5,
+      "stream_origin_seconds": 0,
+      "player_start_seconds": 12.5,
+      "timeline_offset_seconds": 0,
+      "can_seek_anywhere": true,
+      "seek_restoration": "player_position"
+    },
+    "selected_tracks": {
+      "audio": {
+        "id": "file:42:audio:0",
+        "index": 0
+      },
+      "subtitle": {
+        "id": "file:42:subtitle:0",
+        "index": 0
+      }
+    },
+    "effective_recipe": {
+      "video_codec": "h264",
+      "audio_codec": "aac",
+      "width": 1280,
+      "height": 720,
+      "frame_rate": 23.976023976023978,
+      "bitrate_kbps": 2000,
+      "dynamic_range": "sdr",
+      "audio_channels": 2,
+      "audio_layout": "stereo"
+    },
+    "claims": {
+      "video": {
+        "hdr10": false,
+        "hdr10_plus": false,
+        "hlg": false,
+        "dolby_vision": false
+      },
+      "audio": {
+        "codec": "aac",
+        "passthrough": false,
+        "atmos_preserved": false,
+        "reason": "server_audio_adaptation"
+      },
+      "subtitles": {
+        "ass_styling_preserved": false,
+        "bitmap_overlay": false,
+        "bitmap_sidecar": false,
+        "reason": "server_hls_subtitle_rendition"
+      }
+    },
+    "subtitle": {
+      "hls_rendition": {
+        "group_id": "subs",
+        "name": "Subtitles",
+        "format": "vtt",
+        "mime_type": "text/vtt"
+      },
+      "mode": "render",
+      "track_id": "file:42:subtitle:0",
+      "inventory": [
+        {
+          "track_id": "file:42:subtitle:0",
+          "combined_index": 0,
+          "source": "embedded",
+          "codec": "subrip",
+          "language": "eng",
+          "label": "English",
+          "forced": false,
+          "default": false,
+          "hearing_impaired": false,
+          "delivery": "sidecar",
+          "url": "/stream/11111111-1111-4111-8111-111111111111/subtitles/0.vtt?file_id=42\u0026embedded_stream_index=3"
+        }
+      ]
+    },
+    "transformations": [
+      {
+        "name": "video_to_h264",
+        "executor": "server",
+        "recipe_version": "2",
+        "validated_claims": [
+          "h264_decode"
+        ]
+      },
+      {
+        "name": "audio_to_aac",
+        "executor": "server",
+        "recipe_version": "4",
+        "validated_claims": [
+          "audio_decode"
+        ]
+      }
+    ],
+    "applied_quirks": [],
+    "runtime_corrections": [],
+    "available_qualities": [
+      {
+        "label": "original",
+        "height": 1080,
+        "bitrate_kbps": 8000,
+        "preserves_source": true
+      },
+      {
+        "label": "1080p-medium",
+        "display_name": "1080p Medium",
+        "height": 1080,
+        "bitrate_kbps": 6000,
+        "preserves_source": false
+      },
+      {
+        "label": "1080p-low",
+        "display_name": "1080p Low",
+        "height": 1080,
+        "bitrate_kbps": 3000,
+        "preserves_source": false
+      },
+      {
+        "label": "720p-high",
+        "display_name": "720p High",
+        "height": 720,
+        "bitrate_kbps": 4000,
+        "preserves_source": false
+      },
+      {
+        "label": "720p-medium",
+        "display_name": "720p Medium",
+        "height": 720,
+        "bitrate_kbps": 2000,
+        "preserves_source": false
+      },
+      {
+        "label": "720p-low",
+        "display_name": "720p Low",
+        "height": 720,
+        "bitrate_kbps": 1500,
+        "preserves_source": false
+      },
+      {
+        "label": "480p",
+        "display_name": "480p",
+        "height": 480,
+        "bitrate_kbps": 1500,
+        "preserves_source": false
+      }
+    ],
+    "degradation_warnings": [],
+    "decision_reason": "quality_fixed_rung",
+    "requested_media_file_id": 42,
+    "effective_media_file_id": 42,
+    "source": {
+      "media_file_id": 42,
+      "duration_seconds": 7200,
+      "container": "mp4",
+      "video_codec": "h264",
+      "video_profile": "high",
+      "video_level": 41,
+      "bit_depth": 8,
+      "width": 1920,
+      "height": 1080,
+      "frame_rate": 23.976023976023978,
+      "bitrate_kbps": 8000,
+      "dynamic_range": "sdr",
+      "hdr10_plus": false,
+      "dv_enhancement_layer": "none",
+      "audio_codec": "aac",
+      "audio_channels": 2,
+      "audio_layout": "stereo"
+    },
+    "subtitle_fidelity_policy": "allow_simplified_rendering"
+  }
+}
diff --git a/docs/downloads-api.md b/docs/downloads-api.md
index 505b4e4eb2..b84e26af61 100644
--- a/docs/downloads-api.md
+++ b/docs/downloads-api.md
@@ -527,8 +527,12 @@ are rejected. The response is `200` with the current `DownloadEntry`, whose opti
 
 An older or equal event returns the current entry without changing it. A different
 revision returns `409`: reload the registry and reconcile the new bytes instead of
-rewriting the old event's revision. Reports cannot promote preparing, failed, or
-revoked entries into completion. The body is limited to 4 KiB.
+rewriting the old event's revision. Reports cannot promote failed or revoked entries
+into completion, and a `downloading` report for a `preparing` entry returns `404`. A
+`completed` report for a `preparing` entry at the same revision applies: the server
+returns an in-flight entry to `preparing` when it loses the prepared file, and a
+device that fetched the whole file before then still holds it. Send the completion
+even when the registry shows the entry preparing again. The body is limited to 4 KiB.
 
 ### 4.4 Delete a download
 
@@ -854,6 +858,8 @@ compat/remux:          preparing -> ready -> downloading -> completed
 bitrate/transcode:     preparing -> ready -> downloading -> completed
 revoked:               any -> revoked (administrator)
 prepared again:        completed -> preparing -> ready -> downloading -> completed
+server file lost:      ready | downloading -> preparing -> ready -> downloading -> completed
+late completion:       preparing -> completed (same revision, after a lost file)
 failed artifact job:   preparing -> failed
 ```
 
@@ -861,8 +867,9 @@ Direct original rows are `ready` immediately; remux and transcode rows start at
 `preparing` and become `ready` when the artifact completes. `failed` means the
 artifact job exhausted its retries. `revoked` means an administrator revoked the
 entry (§9.3). `completed` returns to `preparing` only when the device asks for an
-expired file again (§4.12). `downloading` and `completed` are set by the client via
-`PATCH`.
+expired file again (§4.12). An entry still `ready` or `downloading` returns to
+`preparing` when the server finds its prepared file missing and prepares it again.
+`downloading` and `completed` are set by the client via `PATCH`.
 
 ---
 
diff --git a/docs/images-api.md b/docs/images-api.md
index 914a6559a9..a3de770ebf 100644
--- a/docs/images-api.md
+++ b/docs/images-api.md
@@ -28,8 +28,8 @@ the contract, so anything else is rejected by request validation as
 `422 validation_failed` — a typo is a client bug, and quietly serving a default
 would hide it behind artwork that is merely the wrong resolution.
 
-Omitting the parameter keeps the per-context defaults exactly as they were, so no
-existing client is affected.
+Omitting the parameter keeps the server's per-context defaults, described
+below.
 
 The parameter is accepted on:
 
@@ -38,12 +38,20 @@ The parameter is accepted on:
 - seasons, a single season, and episodes
 - home and library sections, including single-section items
 - the personal lists: `/api/v2/favorites`, `/api/v2/watchlist`, and `/api/v2/history`
+- shuffles, the not-interested list, and notification series
+- the recommendation reads: discover, For You, a recommendation section,
+  because-watched, popular, recently added, similar, similar users, the taste
+  seed grid, Watch Tonight and Watch Tonight cards
 
-Other surfaces ignore it.
+Other surfaces ignore it. The frozen `/api/v1` recommendation routes ignore it
+too.
 
 Within item detail this covers cast and crew headshots too: they follow the
 `profile` ladder, which has no wide rung, so `large` and `medium` land on the
-same 500px image.
+same 500px image. Without the parameter they are that 500px image as well.
+
+Without the parameter, an episode still standing in for a backdrop in a section
+hero or Continue Watching uses the widest still rung that fits, 1280px.
 
 The `/api/v2/catalog/people` operations do **not** take the parameter — their headshots are
 always the 500px variant. Browsing a person's filmography does honor it, because
@@ -53,27 +61,62 @@ On the personal lists the per-slot defaults are asymmetric — a 500px poster
 beside a 300px backdrop — so an explicit size changes both, not just the one that
 looks wrong.
 
+Watch Tonight cards carry each cast member's `photo_url` on the profile ladder:
+500px without a size, like item detail.
+
+## Per-slot widths
+
+One size for a whole response cannot serve a screen that draws one image of an
+item large and another small: a TV home row shows each item's poster as a card
+and its backdrop full-screen behind the row when the card has focus. Wherever
+`image_size` is accepted, a client can instead give the width in device pixels
+it draws each slot at:
+
+| Parameter | Slot |
+| --- | --- |
+| `poster_width` | every `poster_url` |
+| `backdrop_width` | every `backdrop_url` and `backdrop_urls` entry |
+| `logo_width` | every `logo_url` |
+| `still_width` | an episode row's `still_url` |
+| `photo_width` | a cast or crew `photo_url` |
+
+```http
+GET /api/v2/home/sections?image_size=medium&backdrop_width=2688&logo_width=1760
+```
+
+The server returns the narrowest cached size at least that wide on the image's
+own ladder, including sizes `image_size` cannot name (a 1000px backdrop slot gets
+the 1280px rung), and the original when every size is narrower. A slot is named
+for the field, not the image in it: an episode's `backdrop_url` often holds its
+still, and `backdrop_width` resolves it on the still ladder. A slot width
+overrides `image_size` for that slot; slots without one keep `image_size`, or the
+per-context default when it is absent too. Widths run from 1 to 7680; anything
+else is `422 validation_failed`. Artwork a metadata plugin hosts has no fixed
+widths and gets a semantic hint instead; a headshot keeps the `large` hint cast
+lists already use unless its width needs the original. Where a listing's continuation cursor
+is bound to `image_size`, it is bound to the widths too.
+
 ## Widths
 
 | Image type | `small` | `medium` | `large` | `original` |
 | --- | --- | --- | --- | --- |
-| poster | 300 | 500 | 780 | up to 1920 |
-| still | 300 | 500 | 780 | up to 1920 |
-| backdrop | 300 | 1920 | 1920 | up to 1920 |
-| logo | 500 | 500 | 1280 | up to 1920 |
-| profile | 300 | 500 | 500 | up to 1920 |
-| banner | 500 | 500 | 1000 | up to 1920 |
-| thumb | 300 | 500 | 1280 | up to 1920 |
-| clearart | 500 | 500 | 1000 | up to 1920 |
-| disc | 300 | 500 | 1000 | up to 1920 |
+| poster | 300 | 500 | 1000 | up to 3840 |
+| still | 300 | 500 | 1280 | up to 3840 |
+| backdrop | 300 | 1920 | 2560 | up to 3840 |
+| logo | 500 | 500 | 1280 | up to 3840 |
+| profile | 300 | 500 | 500 | up to 3840 |
+| banner | 500 | 500 | 1000 | up to 3840 |
+| thumb | 300 | 500 | 1280 | up to 3840 |
+| clearart | 500 | 500 | 1000 | up to 3840 |
+| disc | 300 | 500 | 1000 | up to 3840 |
 
 The last four rows are the [extended item artwork](#extended-item-artwork); only
 `/api/v2` lists them.
 
 `medium` is the width the server chose before this parameter existed, which is
-why it is not always the middle rung. `original` is the cached original, capped
-on ingest at 1920px on its longest edge — it is not the provider's untouched
-file.
+why it is not always the middle rung. `original` is the cached original at the
+source's full resolution, re-encoded as WebP and capped on ingest at 3840px on
+its longest edge — it is not the provider's untouched file.
 
 Artwork hosted by a metadata plugin rather than cached in the bucket has no
 fixed width. For those the size is forwarded to the plugin as a semantic variant
@@ -114,14 +157,21 @@ GET /api/v2/images/capabilities
   "state": "available",
   "allowed": true,
   "param": "image_size",
+  "slot_width_params": {
+    "poster": "poster_width",
+    "backdrop": "backdrop_width",
+    "logo": "logo_width",
+    "still": "still_width",
+    "photo": "photo_width"
+  },
   "season_list_artwork_param": "include_artwork",
   "episode_still_provenance": true,
   "extended_item_artwork": true,
   "sizes": ["small", "medium", "large", "original"],
   "widths": {
-    "poster": { "small": 300, "medium": 500, "large": 780 },
-    "backdrop": { "small": 300, "medium": 1920, "large": 1920 },
-    "still": { "small": 300, "medium": 500, "large": 780 },
+    "poster": { "small": 300, "medium": 500, "large": 1000 },
+    "backdrop": { "small": 300, "medium": 1920, "large": 2560 },
+    "still": { "small": 300, "medium": 500, "large": 1280 },
     "logo": { "small": 500, "medium": 500, "large": 1280 },
     "profile": { "small": 300, "medium": 500, "large": 500 },
     "banner": { "small": 500, "medium": 500, "large": 1000 },
@@ -129,7 +179,7 @@ GET /api/v2/images/capabilities
     "clearart": { "small": 500, "medium": 500, "large": 1000 },
     "disc": { "small": 300, "medium": 500, "large": 1000 }
   },
-  "original_max_width_px": 1920
+  "original_max_width_px": 3840
 }
 ```
 
@@ -158,10 +208,13 @@ storage loss schedules image caching for regenerable provider artwork while
 retaining catalog pointers and surviving variants;
 delivery-only failures retain the catalog pointers and are checked again.
 
-Before external delivery is verified, the server avoids newly added wide rungs
-and selects a published smaller size or original. Legacy artwork without a
+On every storage backend, a size the artwork's revision did not publish, such as
+a rung a ladder change added that the ladder backfill has not generated yet,
+resolves to a smaller size it did publish. Legacy artwork without a
 publication manifest uses an established smaller size until the ladder backfill
-regenerates it. A completed delivery check restricts selection to working keys.
+regenerates it. Before external delivery is verified, the server also avoids
+newly added wide rungs and selects a published smaller size or original. A
+completed delivery check restricts selection to working keys.
 If none remain, the URL is empty and the client should display its placeholder.
 Images can still fail at a particular client or CDN edge; this must not prevent
 rendering titles, episode counts, progress, or navigation.
@@ -223,9 +276,16 @@ series and season artwork visible. See
 ## Jellyfin compatibility
 
 The Jellyfin-protocol surface maps its own `MaxWidth`/`MaxHeight`/`FillWidth`/
-`FillHeight` parameters onto the same ladder: up to 320px is `small`, 780px to
-1199px is `large`, 1200px and above is `original`, and everything else is
-`medium`.
+`FillHeight` parameters onto the same ladder. It serves the narrowest of `small`,
+`medium` and `large` that is at least four fifths of the requested width on the
+ladder of the image that serves the request (`Primary` is a poster, an episode
+still or a headshot, and an item without the requested type can fall back to
+another), and `original` when even `large` is narrower. A height counts as the
+width it implies at that image's usual aspect ratio: 2:3 for posters and
+headshots, 16:9 for stills, `Backdrop` and `Thumb`. `MaxWidth` and `MaxHeight`
+bound the image, so with both the smaller width wins; `FillWidth` and
+`FillHeight` describe a box the image covers, so the larger wins. With no
+parameters, `Backdrop` is `medium` and every other type is `small`.
 
 Movies and series advertise their banner, thumb, clear art and disc art under the
 Jellyfin image types `Banner`, `Thumb`, `Art` and `Disc` in `ImageTags`, and every
diff --git a/docs/invitations-api.md b/docs/invitations-api.md
index 06c77bfa2f..59883c2488 100644
--- a/docs/invitations-api.md
+++ b/docs/invitations-api.md
@@ -60,8 +60,10 @@ Administrator creation takes optional `delivery`, `email`, optional `role`
 (default `user`), optional
 string `access_group_id`, optional string-ID array `library_ids`, optional
 `create_profile` and `show_tour` (both default true), and optional `note`.
-Omitted library IDs inherit access; `[]` is an explicit empty override. Omit
-optional members instead of sending null. Explicit false must remain false.
+Omitted library IDs inherit access; `[]` is an explicit empty override. An ID
+that names no library returns `422 validation_failed` at `body.library_ids`, and
+deleting a library removes its ID from stored invitations. Omit optional members
+instead of sending null. Explicit false must remain false.
 Default-profile requests are refused before effects when unsupported. Only the
 server Owner may create or resend an invitation with role `admin`; another
 administrator receives `403 permission_denied`.
diff --git a/docs/jellycompat-api.md b/docs/jellycompat-api.md
index 8a8a8e939f..3d03e90891 100644
--- a/docs/jellycompat-api.md
+++ b/docs/jellycompat-api.md
@@ -154,7 +154,10 @@ When `Limit` is omitted, episode listings on this route and series/season
 `/Items?ParentId=` requests use a 1,000-row page. Explicit limits retain their
 requested page size, subject to the 1,000-row cap; `Limit=0` requests only the
 count. Longer lists still require paging using `TotalRecordCount` and
-`StartIndex`. Other `/Items` browsing retains the 24-row default.
+`StartIndex`. An `/Items?Ids=` request without `Limit` returns every named
+item the viewer can see, as in Jellyfin. When it names no collection and also
+filters, searches, or sorts, that list is capped at 1,000 rows. Other `/Items`
+browsing retains the 24-row default.
 
 `/Items?ParentId={boxSetId}` lists a collection's members (movies, series, and
 the episodes of episode-scoped smart collections) in collection order unless
@@ -193,13 +196,21 @@ can show quality across a library without fetching each item. `IsHD` means
 carry none of the three. Similar and Suggestions ignore `Fields`.
 
 Global `/Shows/NextUp` and the Resume lists leave out series the profile dropped,
-as Silo's Home does; `/Shows/NextUp?SeriesId=` still answers for a dropped series.
-See [dropped-shows.md](architecture/dropped-shows.md).
+as Prairie's Home does; `/Shows/NextUp?SeriesId=` still answers for a dropped series.
+See [dropped-shows.md](architecture/dropped-shows.md). It orders series as
+Prairie's Home does: by when the profile finished the previous episode, the order
+Jellyfin uses. A profile that turns on `ui.next_up_new_releases_first` instead
+gets a caught-up series back at the front when its next episode is released to
+the server. `nextUpDateCutoff` still filters on last played.
 
 Items carry Jellyfin 12's `OriginalLanguage` (movies and series). Episodes set
 `ParentPrimaryImageItemId` and `ParentPrimaryImageTag` to their season's poster,
 or to the series poster when the season has none; both are removed when the
-request disables Primary images.
+request disables Primary images. Episodes also set `ParentLogoItemId` and
+`ParentLogoImageTag` to their series' logo when it has one, as Jellyfin does,
+since clients read an episode's show logo there; both are removed when a list
+request disables Logo images. `/Shows/Upcoming` episodes carry no series
+artwork, so they have neither these nor the parent poster and backdrop.
 
 ### Extended artwork
 
@@ -228,6 +239,8 @@ An episode's `ParentThumbImageTag` still names its series' backdrop; the series'
 | `GET /Shows/Upcoming` | Scoped episodes dated from yesterday in UTC onward, with paging. |
 | `GET /Items/{id}/ThemeMedia` | `ThemeSongsResult` and `ThemeVideosResult` envelopes after validating the owner. |
 | `GET /Items/{id}/ThemeSongs`, `/ThemeVideos` | Local theme songs for a visible owner; theme videos remain empty. |
+| `GET /Movies/Recommendations` | The profile's cached recommendation rows, filtered for the session and kept to movies, in Jellyfin's category shape. Only rows a Jellyfin heading describes truthfully are sent: up to two Because You Watched rows anchored on a movie as `SimilarToRecentlyPlayed` with the watched title as `BaselineItemName`, then taste-cluster rows as `SimilarToLikedItem` with the cluster's genre label (jellyfin-web shows "Because you watched {0}" and "Because you like {0}"). A library `ParentId` (jellyfin-web sends the movie library it shows suggestions for) keeps the titles and watched titles to that library; a library the session cannot browse, or any other parent, gets `[]`. A row whose watched title is a series or one the session cannot see, the main For You row, an unlabeled cluster, Similar Users and the server-wide rows are left out; a profile without such rows gets `[]`. A title appears in the first category that holds it, each category has its own `CategoryId`, and `categoryLimit` (default 5) and `itemLimit` (default 8) apply. |
+| `GET /Items/{id}/Similar`, `/Movies/{id}/Similar`, `/Shows/{id}/Similar` | With recommendations enabled, the item's nearest titles by embedding and co-watch, in that order, keeping those the session may see; otherwise, or when none is left, the top-rated titles of the same type in the item's first genre. An item the session cannot see answers an empty list. |
 | `GET /Persons`, `/Persons/{name}` | People with a credit on a movie, series, or episode visible to the current profile, under the native person-detail rule: an episode credit counts when the profile can see the parent series. `/Persons` accepts Jellyfin 12's `StartIndex`, `NameStartsWith`, `NameLessThan`, and `NameStartsWithOrGreater` (lowercased name comparisons) and a library, movie, series, or episode `ParentId`; a series parent includes its episodes' guest stars, a library parent includes the guest stars of its series, and other parents match nobody. Pages without `SearchTerm` hold up to 100 people; searches stay capped at 20. Person photo tags are signed and appear only in responses that passed this visibility check. `GET /Items/{personId}/Images/Primary` accepts a matching signed `tag` without authentication, as Jellyfin Web sends image requests without credentials; otherwise the session must see a credit for the person. Either check runs before cached artwork is used. |
 
 `/Library/VirtualFolders` reports `LibraryOptions.EnableRealtimeMonitor` from
diff --git a/docs/libraries-api.md b/docs/libraries-api.md
index 3a14e92107..a7d2ac11cd 100644
--- a/docs/libraries-api.md
+++ b/docs/libraries-api.md
@@ -4,14 +4,15 @@ The native v2 library administration operations are acting-admin operations. The
 complete request and response schemas are generated in `contracts/api/v2/openapi.json`.
 The frozen v1 bridge keeps its existing responses.
 
-`GET /api/v2/libraries/roots`, `GET /api/v2/libraries/skipped-roots`, and
-`GET /api/v2/libraries/stale-ids` return `{items, page, total}` collections, where `total`
+`GET /api/v2/libraries/roots`, `GET /api/v2/libraries/skipped-roots`,
+`GET /api/v2/libraries/stale-ids`, and `GET /api/v2/libraries/unmatched-items` return
+`{items, page, total}` collections, where `total`
 counts the matches across every page. `limit` defaults to 50 and is
 at most 200. Continue with `page.next_cursor` while `page.has_more` is true. A cursor
 is bound to the acting administrator and query filters; changing a filter starts a
 new listing without a cursor.
 
-All three operations accept a trimmed, case-insensitive substring query `q`. Search
+All four operations accept a trimmed, case-insensitive substring query `q`. Search
 runs before database pagination, so a match can be found without loading preceding
 pages. Percent signs and underscores are literal characters.
 
@@ -20,15 +21,46 @@ pages. Percent signs and underscores are literal characters.
 | Roots | Root path, title, sample file path | Required `library_id`; optional `state` |
 | Skipped roots | Root path, library name, reason | None |
 | Stale IDs | Title, provider, provider ID, library name | Actionable provider IDs only |
+| Unmatched items | Title, type, status, library name | Optional `ignored` |
 
 The web administration page loads diagnostics when their section opens. It requests
 more results through **Load more** and starts a new first page when the search changes.
+Unmatched items are the exception: they load with the page, for the section's count,
+and page through a page bar.
 Sorting controls on diagnostic tables sort the loaded results.
 
 Library poster uploads allow a file of up to 10 MiB plus 1 MiB of multipart framing.
 The file limit is checked separately from the total request size. Accepted library
 deletion and metadata-refresh jobs return their canonical job URI in `Location`.
 
+## Unmatched items
+
+`GET /api/v2/libraries/unmatched-items` (`listUnmatchedItems`) lists the items still
+`unmatched`, `pending`, or `ambiguous`, in title order. It leaves out items an
+administrator marked as intentionally unmatched; with `ignored=true` it lists only
+those, each with `ignored_at`. The cursor is bound to `q` and `ignored`. The frozen v1
+listing also leaves ignored items out; its response shape is unchanged.
+
+`PUT /api/v2/libraries/unmatched-items/{content_id}/ignore` (`ignoreUnmatchedItem`)
+marks a movie or series as intentionally unmatched, for media no provider lists. It
+answers `204`. Only an `unmatched`, `pending`, or `ambiguous` movie or series can be
+ignored; a matched item or a book answers `409 conflict` (books keep their own
+enrichment), and an unknown item `404`. Ignoring an ignored item again keeps its first
+`ignored_at`. While the mark is set, automatic matching skips the item: the matcher
+queues drop its files, a scan neither retries it nor reports it as still unmatched, a
+library refresh leaves it out, an item refresh completes without changes, and a season
+or episode refresh stops before any provider search and counts as a failed attempt. The
+item stays in its library and playable with its local metadata. Match Item
+still works, and a successful match clears the mark.
+
+`DELETE /api/v2/libraries/unmatched-items/{content_id}/ignore`
+(`unignoreUnmatchedItem`) clears the mark and answers `204`; an item without the mark is
+left as it is, and an unknown one answers `404`. The item returns to the listing and its
+files are queued for matching again.
+
+The mark lives on the item, and an unmatched item's `local-` ID comes from its file
+path, so a renamed or moved file comes back as a new unmatched item.
+
 ## Real-time monitoring
 
 The v2 library resource carries `realtime_monitoring`, the library's real-time
@@ -65,8 +97,8 @@ is ignored. `state` is the first that applies:
 
 `GET /api/v2/libraries/capabilities` (`getLibraryCapabilities`, administrators
 only) is the feature-detection document for these library features; it answers
-`realtime_monitoring: true` and `trickplay: true` alongside the common capability
-members. `trickplay_supported` reports whether public asset storage is configured,
+`realtime_monitoring: true`, `trickplay: true`, and `ignore_unmatched: true` (the
+unmatched-item ignore operations above) alongside the common capability members. `trickplay_supported` reports whether public asset storage is configured,
 so administrators can enable seek previews when creating the first library.
 
 Scans the monitor queues carry the trigger `realtime_monitor`.
diff --git a/docs/markers-api.md b/docs/markers-api.md
index 4749ddb319..1416cf455e 100644
--- a/docs/markers-api.md
+++ b/docs/markers-api.md
@@ -45,6 +45,15 @@ Existing installations retain their configured marker mode, which accepts `off`,
 
 Both paths honor provider priority, manual edits and deletions, and provider quota limits.
 
+Providers address an episode by its series' TMDB, TVDB, and IMDb IDs and the
+catalog's season and episode numbers; season 0 holds specials. When the catalog
+has them, lookups and contributions also carry the episode's own provider IDs,
+its title, and whose numbering it follows. Episode rows merge metadata
+providers' episodes by number in the order of the library's episode chain, so
+the numbering is that of the first TVDB or TMDB provider in the chain whose ID
+the episode carries. Automatic sharing skips specials; sharing a manually
+edited special's markers is allowed.
+
 A manual deletion removes every occurrence of that kind for the selected file.
 The empty range retains manual provenance: provider lookups, local detection,
 rescans, and file-identity changes cannot restore it. An explicit manual set
diff --git a/docs/network-access-api.md b/docs/network-access-api.md
index 13d693c627..dc7791e1bf 100644
--- a/docs/network-access-api.md
+++ b/docs/network-access-api.md
@@ -51,7 +51,11 @@ same providers, for a phone handing a TV an address it can reach:
     { "kind": "public", "url": "https://silo.example.test" },
     { "kind": "provider", "provider": "tailscale", "display_name": "Tailscale",
       "state": "connected", "url": "https://silo.overlay.example.test" }
-  ]
+  ],
+  "local_route": {
+    "spki_sha256": "n4bQgYhMfWWaL+qgxVrQFaO/TxsrC4Is0V1sFbDwCgg=",
+    "url": "http://192.168.1.20:8080"
+  }
 }
 ```
 
@@ -60,10 +64,14 @@ same providers, for a phone handing a TV an address it can reach:
 request arrived on (`provider` with the slug when it came through an overlay
 listener). `endpoints` lists `server.public_url` as `kind: public` when it is
 configured, then every installed provider in slug order with its state on the
-API host; `url` is present only while that provider is connected there. Node
+API host; `url` is present only while that provider is connected there.
+`local_route` carries `spki_sha256`, the pin of the key the API listener
+presents over TLS on its own port, and `url`, `server.local_url` when an admin
+set it. Node
 addresses, `auth_url` and error text stay on the admin status below. The
 identity is self-asserted: clients pair through device login before trusting
-an address. Design and client flow:
+an address, and use a local-network address only over TLS that presents the
+pinned key. Design and client flow:
 [docs/architecture/server-identity.md](architecture/server-identity.md).
 
 ## `GET /api/v2/admin/network-access/{provider}/status`
@@ -91,9 +99,10 @@ for its live status, with a ten-second timeout per host:
 - `host.id` is `api` for the API server and `node:<id>` for a proxy node; it
   is also the instance-state scope the plugin's node keys are stored under.
   The API host comes first, then every enabled proxy node in id order. Proxy
-  rows are read over the node's backend URL with the node bearer
+  rows are read over the node's backend URL with
+  [signed worker requests](architecture/worker-http-protocol.md#authentication)
   (`GET /network-access/{provider}/status` on the proxy listener) with the same
-  ten-second timeout; a proxy that cannot be reached, refuses the bearer,
+  ten-second timeout; a proxy that cannot be reached, refuses the request,
   runs a build without the routes, or has not resolved its `stream_nodes`
   row yet answers `unavailable` with the reason in `error`. Transcode nodes
   are never listed. Each request reads only the named provider, so another
@@ -143,7 +152,7 @@ Both are naturally idempotent: repeating connect converges on one connected
 instance per host, repeating disconnect on disconnected. An unknown provider
 is `404 not_found`.
 
-Proxy hosts are commanded over the node bearer routes
+Proxy hosts are commanded over the signed worker routes
 `POST /network-access/{provider}/connect` and
 `POST /network-access/{provider}/disconnect` on the proxy listener, each
 bounded by the same ten seconds; the proxy answers the state its own
diff --git a/docs/notifications-api.md b/docs/notifications-api.md
index ca225d9322..a8c0066e41 100644
--- a/docs/notifications-api.md
+++ b/docs/notifications-api.md
@@ -16,6 +16,9 @@ push-registration protocol retain their existing shapes.
 | `POST /read-all` | 204; body requires `{ "through": "<read_cutoff>" }` |
 | `GET /preferences` | Profile ID and five preference booleans |
 | `PUT /preferences` | Updated preferences; omitted fields retain their values |
+| `GET /series` | The series whose new episodes can notify the profile, as `items` and `page` |
+| `PUT /series/{series_id}/mute` | 204; mutes the series for the profile, already muted succeeds, a series the viewer may not see is 404 |
+| `DELETE /series/{series_id}/mute` | 204; unmutes the series, not muted succeeds |
 
 The inbox list accepts `status=all|unread`, `limit` up to 200, and `cursor`.
 A cursor binds the acting account/profile, filter, page size, last delivery tuple,
@@ -36,6 +39,81 @@ Fanout transactions lock their complete recipient profile union in sorted order
 before inserting; unrelated profiles can progress independently. Existing rows
 retain their timestamps, and migration seeds the boundary from their maximum.
 
+## Notified series
+
+`GET /series` (`listNotificationSeries`) lists every series the acting profile
+favorited, put on its watchlist, is partway through, or waits on a next episode
+of, and every series it muted. It reads the same interest index and mutes
+episode fanout reads, so it names exactly the series a new episode is evaluated
+for. A series in several libraries is one entry carrying every library's
+reasons.
+
+Each entry has the series as a catalog card in `item`, the profile's
+relationships in `reasons`, and in `active_reasons` the ones the profile's
+preferences let notify. `muted` is true when the profile muted the series.
+`notifies` is true when any reason is active and the series is not muted. A
+muted series keeps its `active_reasons`, so a client can say what would notify
+after an unmute, and it is listed even with no reason left, so the profile can
+still unmute it. With an
+active Next Up reason, `next_up_after` names the last episode the profile
+finished; on that reason alone, only a new episode after it notifies. It names
+the finished episode rather than the next one because the next may not exist
+yet: after a season finale, the following season's first episode notifies.
+The other reasons notify on any new episode. Delivery still skips an episode the profile was
+already notified about and a series the profile can no longer open.
+
+Filters combine:
+
+- `status=active` keeps the series that notify, `status=inactive` the ones that
+  do not (the preferences silence every reason, or the profile muted the
+  series), and the default `all` keeps both.
+- `reason=favorite|watchlist|continue_watching|next_up` keeps the series with
+  that relationship, whether or not the preferences let it notify.
+- `q` keeps the series whose title or sort title contains the text,
+  case-insensitively.
+
+`sort` takes one field, descending with a leading `-`: `title` (the default,
+by sort title), `year`, `added_at` (when the series joined the catalog), or
+`latest_episode_added` (when it last gained an episode). A series without a
+year or an episode sorts last in either direction, and ties order by sort title
+then item ID.
+
+The list accepts `limit` and `cursor`. The cursor carries every sort field of
+the last entry, so the next page resumes after it even if that series has left
+the list, and it binds the account, profile, viewer policy, filters, and sort.
+Series the viewer may not see are dropped before paging with one batch access
+check, so a cursor never names a hidden series. A page can still hold fewer
+than `limit` entries if access changes between that check and card resolution.
+`image_size` selects the card artwork variant.
+
+The interest index follows favorites, watchlist, and progress changes
+asynchronously, so a just-favorited series can take a moment to appear.
+`series.available` in `GET /capabilities` reports the operation.
+
+### Muting one series
+
+`PUT /series/{series_id}/mute` (`muteNotificationSeries`) mutes one series for
+the acting profile: it gets no new-episode notification for that series on any
+channel, whatever its reasons, until it unmutes. Favorites, the watchlist, Home,
+and watch history do not change, and other profiles on the account are not
+affected. The mute does not lapse when the profile watches the series again.
+Muting a series already muted succeeds and changes nothing. An ID that names no
+series, or a series the viewer may not see, is 404.
+
+`DELETE /series/{series_id}/mute` (`unmuteNotificationSeries`) lifts the mute.
+The series notifies again for its active reasons. Fanout reads the mute when it
+evaluates a new episode, after the release settle delay (30 seconds by
+default): an episode it evaluated while the series was muted is not announced
+later, and one still waiting for fanout when the profile unmutes is announced.
+The same holds the other way: a mute made just after an episode arrives can
+still stop its notification. Unmuting a series that is not muted succeeds. Unmute runs no access check, so a
+profile can lift a mute on a series it can no longer open.
+
+Notifications already delivered stay in the inbox, and a delivery fanout
+created before the mute committed can still reach its channels. Both writes
+answer 204 with no body. `series.mute` in `GET /capabilities` reports both
+operations and the `muted` field.
+
 ## Fixed read cutoff
 
 Capture the displayed list's `read_cutoff` when the user chooses to mark the inbox
@@ -115,6 +193,19 @@ new outbox attempt, invokes the configured sender, and returns HTTP 200 with
 `attempt_id`, `push_device_id`, `server_device_id`, `outcome`, and any existing
 relay/upstream diagnostic fields. A `retrying` or `failed` outcome is still a
 successful HTTP report of that attempt, not proof that a push was delivered.
+
+The test push carries the newest notification of the selected device's profile
+(matched by account as well, since profile IDs repeat across accounts), and the
+response names it as `delivery_id`. The device fetches that notification's real
+title, body and tap target exactly as for an ordinary push, and because the
+push reuses the notification's collapse ID it replaces that notification on the
+device if it is still shown. When the profile has no notification yet,
+`delivery_id` is absent and the push carries the attempt ID instead: it still
+proves transport, but the display fetch returns `404` and the device shows the
+relay's generic text. The test changes neither the notification's read state
+nor the inbox; it adds one `test` attempt to that notification's push attempt
+history, which nothing counts as a delivery. Pruning the notification removes
+the attempt with it.
 Background attempt recovery and sender retries retain their existing semantics.
 These operations are `non_retryable`: clients must not repeat a lost request
 automatically because another request creates another test attempt.
@@ -162,6 +253,23 @@ relay, and the relay keeps no device state, so a new deployment needs no client
 change. This covers a generation superseded by another holder of the same
 credential (a database cloned to a second server shares it), a signing key the
 relay retired, and a capability that expired past its renewal grace.
+
+Every push the server sends, administrator test pushes included, names the
+deployment (`server_id`, the identity `getServerIdentity` reports) and the push
+device's profile (`profile_id`). The relay forwards them to the device as
+`prairie_server_id` and `silo_profile_id`, so a device signed into several servers
+or profiles fetches display data from the one the push belongs to. The two are
+sent together or not at all; without a readable server identity the push goes
+out without them. A relay that predates the fields answers 400
+`unexpected_field`. The sender then resends the attempt once without them under
+the same idempotency key, and leaves them out of later sends to that relay for an
+hour. The fields are part of the relay's idempotency hash, and a retry can
+differ from the attempt's first send (an earlier server version, another
+replica, or the hour ending). The relay answers such a retry with 422
+`idempotency_key_reuse`, and the sender resends it once with the other choice,
+which the relay replays or resumes. When the identity lookup failed, so the
+sender has no other choice to offer, that 422 is retried later instead of
+failing the push.
 Only an administrator's clear or a relay `deployment_disabled` response parks
 delivery behind the re-registration marker; either one stores an empty
 credential. An older server stored the rejected key along with the marker. That
diff --git a/docs/notifications-push-api.md b/docs/notifications-push-api.md
index f64b49f996..d8e3b1928a 100644
--- a/docs/notifications-push-api.md
+++ b/docs/notifications-push-api.md
@@ -64,10 +64,20 @@ the display credential:
   "removed": false,
   "push_mode": "private_push",
   "display_token": "<jwt>",
-  "display_token_expires_at": "2026-10-03T00:00:00Z"
+  "display_token_expires_at": "2026-10-03T00:00:00Z",
+  "server_id": "3f2a9d5e-6b1c-4c7e-9a0d-2f4b8c1e7a35"
 }
 ```
 
+- `server_id` is the identity `getServerIdentity` reports. Each push from this
+  server carries it as `prairie_server_id`, with the registering profile as
+  `silo_profile_id`, beside `prairie_delivery_id`. A device signed into several
+  servers or profiles keys each display credential by that pair and fetches
+  from the server and profile a push names. The receipt omits `server_id` when
+  the server cannot read its identity, and older servers never send it; pushes
+  then carry neither key, and the client keeps using its active server and
+  profile.
+
 - `display_token` is a JWT with `token_type: "apple_push_display"`, bound to
   the registering user, login session, and profile.
 - Its lifetime follows the server's refresh-token expiry (30 days by
@@ -95,8 +105,8 @@ Authorization: Bearer <display token or access token>
 ```json
 {
   "delivery_id": "01M...",
-  "title": "The latest episode of Severance S02E01 just dropped!",
-  "body": "Hello, Ms. Cobel",
+  "title": "Severance",
+  "body": "New episode · S02E01 · Hello, Ms. Cobel",
   "thread_id": "series:series-1",
   "category": "episode_available",
   "url": "/item/episode-1"
@@ -116,6 +126,12 @@ Authentication rules for this route only:
 authenticated profile. The route is rate-limited like other authenticated
 routes.
 
+An administrator test push names the profile's newest notification, so this
+fetch returns that notification's display data. A test sent to a profile with
+no notification names its own attempt ID instead, and the fetch returns `404`;
+keep the generic text in that case. Android's `getNotification` fetch behaves
+the same way.
+
 ## Ordered Android registration
 
 `GET /api/v2/notifications/push/devices/capabilities` describes the
@@ -140,8 +156,9 @@ require these headers in addition to captured login/profile credentials:
   exact generation, payload and captured authority through uncertainty. Never
   allocate a new generation merely to retry a request.
 
-POST returns `200` with string `generation`, `registration_id`, `server_device_id`
-and the accepted `push_mode`. This acknowledges registration storage, not provider
+POST returns `200` with string `generation`, `registration_id`, `server_device_id`,
+the accepted `push_mode`, and `server_id`, which names the server in this
+server's pushes exactly as in the Apple receipt. This acknowledges registration storage, not provider
 acceptance or successful delivery. DELETE returns bodyless `204`. The latest
 exact command may replay with the same receipt and no device rewrite, re-enable,
 last-seen refresh, or provider request. A lower generation or same generation with
diff --git a/docs/playback-api.md b/docs/playback-api.md
index 1cbf28fc74..cd18bde45f 100644
--- a/docs/playback-api.md
+++ b/docs/playback-api.md
@@ -18,6 +18,7 @@ unavailable store is `503`.
 | `replanPlayback` | POST `/api/v2/playback/{session_id}/replan` | 200 v3 decision |
 | `reportPlaybackRouteEvent` | POST `/api/v2/playback/route-events` | 202 `{event_id, outcome: "accepted"}` |
 | `getPlaybackQualityLadder` | GET `/api/v2/playback/quality-ladder` | 200 `{rungs, modes, source_height}` |
+| `getPlaybackBandwidthProbe` | GET `/api/v2/playback/bandwidth-probe` | 200 random bytes |
 
 ## Capabilities
 
@@ -27,7 +28,8 @@ and `allowed` is `true`; a server without playback wired answers
 `not_configured` with `allowed: false`. `installation_id` is the persisted
 server instance UUID that diagnostics also report. `protocol_versions` is
 `[3]`. `features` is the v3 server feature set plus `sequenced_progress_v1`,
-`fixed_media_file_v1`, `marker_segments_v1`, and `trickplay_v1`. When the room service and
+`fixed_media_file_v1`, `marker_segments_v1`, `trickplay_v1`, and
+`bandwidth_probe_v1`. When the room service and
 authenticated room socket are configured, it also includes
 `watch_party_source_fallback_v1` and `watch_party_coordinator_v1`.
 The coordinator capability covers shared room
@@ -36,11 +38,50 @@ membership, command-aware readiness, and ready/buffering/syncing member status.
 `server_remux_hls` and, when transcoding is enabled, `server_transcode_hls`.
 `revision` is a digest of the rest.
 
+## Bandwidth probe
+
+`GET /api/v2/playback/bandwidth-probe?size=N` (feature `bandwidth_probe_v1`)
+sends `N` random bytes, 1 to 100,000,000, default 1,000,000, as
+`application/octet-stream` with `Cache-Control: no-store`. It needs an
+authenticated account but no profile. Each server runs at most 32 probes at
+once. On each server an account may run two of them and draw up to 400 MB per
+10 minutes; bytes a client does not read because it closed the connection early
+are not counted. Beyond any limit the probe gets `429 rate_limited` with
+`Retry-After`. The bytes are random so a compressing
+proxy cannot inflate the result. A client times the transfer from its first
+byte, may close the connection once it has timed enough, and sends the result
+as `bandwidth_estimate_kbps` on start and replan. Without a measurement a
+browser has only `navigator.connection.downlink`, which Chromium caps at
+10 Mbps, too low for Auto quality ever to send a 4K source as-is. The probe
+measures the path to the API server; media served from a remote node can take
+a different path. Its bytes count as viewer transfer egress, not playback, and
+are exempt from stream caps, like the Jellyfin-compatible `/Playback/BitrateTest`.
+
+The web app probes in the background a few seconds after sign-in, skips Data
+Saver and cellular connections and pages that are already playing media,
+cancels the probe when playback starts, and caches the result for 30 minutes,
+measuring again when it expires. Tabs share the cached result, and a Web Lock
+lets only one of them probe at a time. A tab holds a shared lock while its
+media plays or playback starts, and no tab probes while any tab holds it. A
+playback start is also broadcast to the other tabs, so a probe already running
+in one of them stops and discards its measurement. On a metered link (Data Saver or cellular) it
+sends no cached measurement.
+
 Every mutation body carries the `installation_id` the client read from
 capabilities. A different value is `409 installation_changed`: refresh
 capabilities and start a new attempt. There is no admission step and no
 per-account enrollment.
 
+## Watch artwork
+
+`GET /api/v2/watch/{id}` includes optional `poster_url`, `poster_thumbhash`,
+`backdrop_url`, and `backdrop_thumbhash` for system media controls. Movies
+use their own artwork, episodes use their still as the poster and their
+series' backdrop, and local extras inherit their parent's artwork. URLs use
+the same resolver and `image_size` query as catalog item detail. Missing
+artwork is omitted; clients can retain their catalog-detail fallback.
+The frozen v1 watch response does not gain these fields.
+
 ## Marker ranges
 
 V2 watch detail includes `marker_segments` on each file version, including
@@ -283,7 +324,7 @@ the start request's quality preference.
 | --- | --- |
 | Original bytes | GET/HEAD `/api/v2/stream/{session_id}` |
 | HLS manifest | GET `/api/v2/playback/transcode/{session_id}/master.m3u8` |
-| HLS segment | GET `/api/v2/playback/transcode/{session_id}/segment/{name}` |
+| HLS segment | GET `/api/v2/playback/transcode/{session_id}/segment/{name}`; `sub_NNNNN.vtt` names a subtitle rendition segment |
 | Subtitle sidecar | GET/HEAD `/api/v2/stream/{session_id}/subtitles/{track}` |
 | Subtitle fonts | GET `/api/v2/stream/{session_id}/subtitles/{track}/fonts`, JSON `{items: [{name, data}]}` |
 
diff --git a/docs/progress-api.md b/docs/progress-api.md
index 84c84546a4..01ea64f7de 100644
--- a/docs/progress-api.md
+++ b/docs/progress-api.md
@@ -84,6 +84,37 @@ Jellyfin-compatible browsing and existing progress uploads retain their behavior
 Storage and transaction invariants are described in
 [progress bootstrap storage](architecture/progress-bootstrap.md).
 
+## Clearing a resume position
+
+`clearResumePosition` (DELETE `/api/v2/progress/{media_item_id}/position`)
+clears the acting profile's resume position on a movie or episode and answers
+204. It is the manual edit for an item someone skimmed and does not want left
+partly watched. The progress entry stays with `position_seconds` 0 and keeps
+`completed` and `duration_seconds`, so a rewatched item stays watched. Watch
+history is untouched. Mark unwatched (`unmarkWatched`) is different: it removes
+the item's history, including unfinished plays.
+
+The write is stamped with the server time. It advances the delta-sync cursor, so
+other devices receive the cleared position, and an older provider resume point
+cannot restore it. No watch-provider event is sent, so a provider that kept a
+resume point from an earlier scrobble keeps it. Like mark unwatched, clearing an
+episode of a [dropped series](architecture/dropped-shows.md) ends the drop, and
+watch sync then lifts it on providers that sync drops. When a position was
+cleared, the server publishes `user_state.changed` with `change: "progress"`.
+
+An item without a resume position is a no-op 204. A season, series or ebook has
+no single resume position and fails validation at `path.media_item_id` (422). An
+unknown or hidden item is 404, as is any other kind `markWatched` does not
+handle, such as an audiobook. The operation is profile scoped and
+`non_retryable`: a delayed retry would also clear a position recorded after the
+first request.
+
+Clients detect the operation with `getProgressCapabilities`
+(GET `/api/v2/progress/capabilities`), a profile-scoped capability document
+whose `clear_resume_position` is true when it is served. Jellyfin clients
+already have the equivalent: `PlaybackPositionTicks` 0 without `Played` on
+`/UserItems/{itemId}/UserData` ([Jellyfin compatibility](jellycompat-api.md)).
+
 ## Playback-origin uploads
 
 `POST /api/v2/sync/progress` and its v1 counterpart upload playback positions,
diff --git a/docs/realtime-api.md b/docs/realtime-api.md
index c44ac157b3..59014e1bcc 100644
--- a/docs/realtime-api.md
+++ b/docs/realtime-api.md
@@ -50,7 +50,11 @@ node; restarting that node invalidates them. This store is distinct from the
 bridge's user/profile-only ticket, which cannot authenticate a v2 connection.
 
 Admission rechecks the current session, enabled account, account role and viewer
-policy/PIN proof. Secondary profiles do not receive administrator channels.
+policy/PIN proof. An admin account receives the administrator channels only while
+it is the acting admin (see [api-contract.md](architecture/api-contract.md)): as
+its primary profile, or with no profile while no profile on the account has a PIN
+or an access limit. Any other profile, and a profile-less session on a household
+that requires a profile, gets the user channels.
 Connections end at access-token expiry or after five minutes, whichever comes
 first. Current session/account/profile policy is rechecked every 15 seconds;
 a failed check closes the connection, with a two-second bound on authority
@@ -80,8 +84,9 @@ close frame:
 ```
 
 The close code is `4001` with reason `access_changed`. Access has changed when
-the account role, the effective role (an admin account's profile stopped or
-started being the primary profile), or the fingerprint of the resolved viewer
+the account role, the effective role (an admin account's connection stopped or
+started being the acting admin, for example its profile stopped being the
+primary profile or the household gained a PIN), or the fingerprint of the resolved viewer
 scope differs from the ticket's, or the profile is no longer verified. The
 scope covers the visible libraries, content-rating limits, playback-quality and
 bitrate limits, and `access_policy_revision`, which a group move, a permission,
@@ -114,7 +119,9 @@ The bridge events socket never sends this frame. It picks its channels once, at
 the handshake: an admin account gets the administrator channels and other
 accounts' events only while it is the acting admin (see
 [api-contract.md](architecture/api-contract.md)), judged on the handshake's
-`X-Profile-Id` or, without one, on the profile its ticket was minted for. Any
+`X-Profile-Id` or, without one, on the profile its ticket was minted for. That
+profile's PIN proof must still verify: the ticket keeps the `X-Profile-Token`
+sent when it was minted, server-side, and the socket re-verifies it. Any
 other profile on the account, such as a child profile, connects with the user
 channels. A rejected ticket (expired, reused, or for another account) leaves the
 connection unbound and judged as acting with no profile, so on a household with
@@ -122,7 +129,8 @@ a PIN-protected or limited profile it also gets the user channels until the
 client reconnects with a fresh ticket. The socket rechecks the login session on the same interval and closes
 without a frame once the session ends, the account's role differs from the
 token's, or a connection holding the administrator channels is no longer the
-acting admin or that check fails.
+acting admin (including when its profile's PIN proof stops verifying after a PIN
+change) or that check fails.
 The playback-control and Watch Together sockets share the recheck but still
 close without a frame or dedicated code when it fails.
 
@@ -161,7 +169,12 @@ lane only for the same account, profile and installation: it takes the lane
 over and the superseded connection is closed, so its later ack and result
 frames are never routed. Ack and result frames are applied only while the
 receiving registration still owns the lane, through the existing command
-tracker and stop-completion paths. Login authority and session ownership are
+tracker and stop-completion paths. A `completed` result for `pause` or
+`unpause` sets the session's pause state at once, so the administrator session
+views show it without waiting for the player's next progress report. Replaying
+already accepted progress does not undo a confirmation; progress accepted after
+its receipt supersedes a queued confirmation. A completed stop or terminate ends
+session authority before ordered watch-provider finalization. Login authority and session ownership are
 re-checked every 15 seconds and the connection ends when either is lost, at
 access-token expiry, or after four hours. The frames (`hello`, command, `ack`,
 `result`, event) are unchanged from the bridge socket. A client message larger
@@ -432,10 +445,14 @@ host's reported position becomes the room anchor before the room resumes. A
 rebuilt stream that lands on a keyframe or segment boundary short of the
 target therefore resumes from where the host really is instead of holding the
 room until the waiting deadline. Position validation uses the same finite,
-nonnegative range as other playback reports. Buffering pause commands can be
-acknowledged at the member's actual position: they do not require rebuilding an
-otherwise usable stream to reach an unbuffered anchor. Playback correction
-still runs when the room resumes.
+nonnegative range as other playback reports. When a guest stalls, the room
+pauses where it is and that guest alone is sent a seek to the room's position.
+An acknowledgement that names that seek's `command_id` is accepted within five
+seconds of the destination either way, because a rebuilt stream often lands
+short and the client closes the rest by rate once the room plays. When the host
+stalls, or nobody else is watching, the room pauses at the stalled member's
+position, and that pause can be acknowledged where the member is. Playback
+correction still runs when the room resumes.
 
 Readiness is level-triggered on the web player. It evaluates the same guards on
 every media event that can indicate playable media (`canplay`,
@@ -456,6 +473,22 @@ acknowledgements and returns to ordinary state reports every 1.5 s, even while
 other members are still waiting. A readiness reset for a new command enables
 retries again. Reports without `is_ready` are still ignored while waiting.
 
+Every `transport_command` carries the room's position at its `execute_at`, and
+the room anchors there too, so a client that runs the command at `execute_at`
+and projects from it at 1x is where the room says it is. A command that arrives
+late is projected forward from `execute_at`.
+
+Outside `waiting`, a `state_report` may carry the `command_id` of the last
+transport command the client applied. The server uses it to tell which reports
+predate a member's latest command: until that command's `execute_at` plus 1.5
+seconds, or for up to 10 seconds while a report names an older command, a report
+is neither corrected nor taken as the host's decision. A report that names the
+latest command ends that window early. Clients that omit the field get the time
+window alone. Reports from a host that has just re-attached are corrected like a
+guest's until one plays as its sync said, within the host band; only then is its
+pause or position a decision for the room. The host band is 10 seconds on the
+v2 socket and 2 seconds on the v1 socket.
+
 A viewer the room stopped waiting for sends `ready` while the room is `playing`
 or `paused`. The v2 snapshot shows this state as `self_ignore_wait: true`, or as
 the viewer's own member entry still marked `is_buffering`. The client sends the
diff --git a/docs/settings-api.md b/docs/settings-api.md
index 0da1a824e7..e717784177 100644
--- a/docs/settings-api.md
+++ b/docs/settings-api.md
@@ -450,13 +450,12 @@ Branding remains public so it can render before sign-in:
 
 | Method | Path | Response |
 |---|---|---|
-| GET | `/api/v2/theme/capabilities` | Branding, CSS-override, and asset-storage availability |
+| GET | `/api/v2/theme/capabilities` | Branding and asset-storage availability |
 | GET | `/api/v2/theme/branding` | Server name, login subtitle, optional accent color and asset URLs, storage availability |
-| GET | `/api/v2/theme/admin-css` | JSON object with `vars` and `raw_css` strings |
 | GET / HEAD | `/api/v2/branding/assets/{kind}` | Image bytes or matching headers without a body |
 
-Discovery uses the existing branding service and theme settings. When dependencies
-are absent, configuration returns default branding and empty overrides; capabilities
+Discovery uses the existing branding service. When dependencies are absent,
+configuration returns default branding; capabilities
 report availability explicitly. Discovery responses are not cached. The bundled web
 uses these v2 reads. Native server-identity discovery must adopt the same public
 endpoint through its negotiated API-version handling.
@@ -472,14 +471,20 @@ A valid kind without a configured asset returns `404`; missing asset storage ret
 
 The frozen v1 routes and administrator asset upload/delete operations are unchanged.
 
-The web client has one theme, Cinema Dark. Only an administrator customizes it, with
-the accent color and the overrides `admin-css` returns (`ui.admin_theme_vars` and
-`ui.admin_custom_css`), layered on that theme. The v2 branding document therefore
-has no default theme and no light-theme logo URLs, and v2 has no theme catalog.
-The frozen v1 `/theme/branding` response is unchanged: it still reports a stored
-`default_theme` and light logo URLs. The server keeps those settings for v1 alone. The v1
-`/theme/catalog`, `/theme/catalog/refresh` and `/theme/download` routes keep their
-behavior, and `theme.catalog_url` its default, until v1 retires.
+The web client has one theme, Cinema Dark. The only customization is the
+administrator's accent color (`branding.accent_color`), which the web client
+reads from the branding document and applies to the primary action color, the
+focus ring and the sidebar accent, turning the labels on those surfaces white
+when white reads better on the accent. A stored value that is not a `#rgb` or
+`#rrggbb` hex color is ignored, as email ignores it. Email buttons, the shell's `theme-color` and
+the web app manifest use it too. The v2 branding document has no default theme
+or light-theme logo URLs, and v2 has no theme overrides or theme catalog.
+The frozen v1 routes are unchanged: `/theme/branding` still reports a stored
+`default_theme` and light logo URLs, and `/theme/admin-css` still reports the
+stored `ui.admin_theme_vars` and `ui.admin_custom_css`. The server keeps those
+settings for v1 alone; nothing else reads them. The v1 `/theme/catalog`,
+`/theme/catalog/refresh` and `/theme/download` routes keep their behavior, and
+`theme.catalog_url` its default, until v1 retires.
 
 ### Retired theme settings
 
@@ -944,7 +949,10 @@ family-scoped winner.
 
 The device registry lists each device a profile uses, with its name, platform
 and `last_seen_at`. `GET /api/v2/devices` and the administrator device reads
-list it. The server registers the device named by `X-Prairie-Device-Id`, with the
+list it. A profile can also give its entry a `custom_name` through
+`PATCH /api/v2/devices/{device_id}`; `GET /api/v2/devices` returns it when set,
+and clients show it in place of the reported name. Registration below never
+changes it (see [API contract](architecture/api-contract.md#self-service-device-settings)). The server registers the device named by `X-Prairie-Device-Id`, with the
 optional `X-Prairie-Device-Name` and `X-Prairie-Device-Platform`, for the acting
 profile when the device:
 
@@ -1032,11 +1040,24 @@ process memory limit at one worker per 512 MiB and applies to the next run
 without a restart.
 
 `metadata.cache_images` defaults to `true` on fresh installations. It no longer
-requires a public S3 bucket because local artwork storage is available. It
-governs provider artwork only: local sidecar artwork found next to media files
-is copied into artwork storage and served whatever its value, because clients
-cannot load it any other way. An image URL an NFO file names is downloaded like
-provider artwork, so it is used only while the setting is on.
+requires a public S3 bucket because local artwork storage is available. With it
+off, clients load item artwork straight from the providers: refreshes select no
+local artwork (sidecar files, files or image URLs an NFO names, extra
+backdrops), nothing is copied into artwork storage, and NFO text still applies.
+Artwork stored earlier goes back to its providers through a hidden task that
+runs at startup, daily, and when the setting is turned off: a stored copy of
+provider artwork serves its provider source again, and a matched movie or
+series whose poster, backdrop, or logo has no provider source, or that keeps
+extra backdrops, or that a storage recovery left without artwork, is queued
+for a metadata refresh at most once a week. The item keeps that art until a
+refresh finds a provider image. A localized copy saved without any source is
+cleared, so the item's or season's own artwork shows. Items with locked
+artwork keep what they have; choosing artwork in Edit Metadata locks it, for a
+season or episode on the whole series. Banner, landscape thumb, clear art, and
+disc art come only from local files, so copies already stored stay. Nothing is
+deleted directly; the artwork revision GC collects the displaced copies.
+Turning the setting back on caches artwork for later refreshes; the Backfill
+Metadata Images task stores the provider artwork already served by URL.
 
 `catalog.scope_versions_to_library` (default `false`) makes a library-scoped v2
 catalog read return only the versions stored in the `library_id` it was given.
diff --git a/docs/subtitles-api.md b/docs/subtitles-api.md
index 17289cfea7..7ba0c8ce61 100644
--- a/docs/subtitles-api.md
+++ b/docs/subtitles-api.md
@@ -131,7 +131,9 @@ Stored subtitle IDs and file IDs are strings. Search result IDs remain opaque
 provider identifiers. Timestamps use UTC with millisecond precision; an unknown
 search upload date is omitted. Arrays are empty rather than null. Stored object
 keys and uploader identities are not exposed. Provider failures preserve partial
-results with a generic warning; their raw error details are not part of v2.
+results with a generic warning; their raw error details are not part of v2. The
+`/api/v1` bridge names each failed provider as `<provider>: search failed`, and
+the server log keeps the cause with credentials masked.
 
 Search accepts compatibility inputs including ISO 639-2 aliases (`ara`), case
 and underscore variants, and legacy English display names (`Arabic`). The
@@ -561,8 +563,9 @@ subtitle menu can still show the result and offer a reset.
 Corrected bytes reach every delivery path: playback subtitle routes, the
 Jellyfin subtitle stream, offline downloads (see [downloads](downloads-api.md)),
 and AI translation sources. Those responses are `Cache-Control: private,
-no-cache`, since the bytes change behind the same URL. Device delays
-(`player.subtitle_sync_ms`) still apply on top. The frozen v1 bridge exposes
+no-cache`, since the bytes change behind the same URL. The player's subtitle
+offset (`player.subtitle_sync_ms`, a profile value a device can override from
+settings manifest revision 19) still applies on top. The frozen v1 bridge exposes
 neither timing nor sync but serves corrected bytes.
 
 Replacing the media file (a new file hash or size at the same path) resets the
diff --git a/docs/transcode-node-api.md b/docs/transcode-node-api.md
index 4b52bc87cc..c052e63e1d 100644
--- a/docs/transcode-node-api.md
+++ b/docs/transcode-node-api.md
@@ -30,6 +30,15 @@ transport at the requested source position.
 The throttle fields belong to the internal API-to-node contract. Apple and
 Android clients require no request or response changes.
 
+When the API relays a transcode whose node it can no longer reach, it moves
+the transcode to another node with an ordinary `POST /transcode/start`: the
+same `session_id` (transport id), the recorded recipe, `throttle_seconds` from
+that recipe, `require_ready`, and a start position resumed at the requested
+segment. The response is checked with the same attestations as a fresh start,
+and a node that fails them is stopped and skipped. The API then sends a
+best-effort `DELETE /transcode/{session_id}` to the node it left. See
+[Transcode node lost under the API relay](architecture/restart-resilient-playback.md#transcode-node-lost-under-the-api-relay).
+
 The start response also reports `hw_accel`, the backend retained for video
 decoding and tone mapping, and optional `encoder_hw_accel`, the actual video
 encoder backend. When a GPU can tone-map but cannot encode HEVC, `hw_accel`
@@ -39,3 +48,25 @@ VBR nor CBR rate control; libx264 or libx265 then encodes.
 Activity reporting uses `encoder_hw_accel`, falling back to `hw_accel` for
 older nodes that omit it. Stored recipe cards preserve both values; execution
 validates the encoder again when reconstructing a session.
+
+## Subtitle renditions
+
+A node that advertises the `hls_subtitle_rendition_v1` transport feature
+accepts `subtitle_rendition: true` on `POST /transcode/start`, together with
+`subtitle_track_index` (the `0:s:N` ordinal), `subtitle_codec`, and
+`total_duration`. It emits that text track as WebVTT from the same FFmpeg
+process and echoes `subtitle_rendition: true` in the start response. The API
+rejects a missing echo and stops the transport, so an older node can never
+serve a plan that promises a rendition. The API plans a rendition only when one
+executor can run the whole recipe: itself, or a node that advertises both the
+feature and every server transformation the plan needs. Otherwise the plan
+keeps the sidecar. Recipe cards and signed reconstruction claims carry the
+flag, so reconstruction and restarts keep it.
+
+For such a session, `GET /transcode/{id}/master.m3u8` answers the multivariant
+playlist, and the `prairie_rendition` query parameter selects the video or
+subtitle media playlist. `GET /transcode/{id}/segment/sub_NNNNN.vtt` answers a
+WebVTT segment from the cues already on disk, waiting for FFmpeg to reach it
+no longer than its video segment would. It is never acknowledged, pruned, or used to restart
+FFmpeg. The protocol is described in
+[playback protocol v3](architecture/playback-protocol-v3.md#8-track-identity-and-the-subtitle-ordinal-space).
diff --git a/go.mod b/go.mod
index 1ff69394ff..fa30528048 100644
--- a/go.mod
+++ b/go.mod
@@ -3,6 +3,7 @@ module github.com/prairie-server/prairie-server
 go 1.26.9
 
 require (
+	github.com/DataDog/go-sqllexer v0.2.5
 	github.com/aws/aws-sdk-go-v2 v1.47.3
 	github.com/aws/aws-sdk-go-v2/credentials v1.20.9
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.114.3
@@ -35,6 +36,7 @@ require (
 	github.com/oklog/ulid/v2 v2.1.2
 	github.com/open-policy-agent/opa v1.21.2
 	github.com/pgvector/pgvector-go v0.4.1
+	github.com/pgvector/pgvector-go/pgx v0.4.1
 	github.com/pressly/goose/v3 v3.29.0
 	github.com/quasilyte/go-ruleguard/dsl v0.3.23
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.3
@@ -101,6 +103,7 @@ require (
 	github.com/vmihailenco/msgpack/v5 v5.4.1 // indirect
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
 	github.com/wI2L/jsondiff v0.7.1 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778 // indirect
@@ -140,7 +143,7 @@ require (
 	github.com/mmcdole/goxpp/v2 v2.0.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/ncruces/go-strftime v1.1.0 // indirect
-	github.com/prairie-server/prairie-plugin-sdk v0.12.1-0.20261012211536-3ea8c11a9099
+	github.com/prairie-server/prairie-plugin-sdk v0.12.1-0.20261019002507-0aec7216afa6
 	github.com/prometheus/common v0.72.0 // indirect
 	github.com/prometheus/procfs v0.22.0
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
diff --git a/go.sum b/go.sum
index 1c52c1d87c..19d356acd1 100644
--- a/go.sum
+++ b/go.sum
@@ -1,5 +1,7 @@
 cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE=
 cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU=
+github.com/DataDog/go-sqllexer v0.2.5 h1:G+mhNP7zhP/wADAUh4XqKodi02Bjh0IniE1Lxtq5RiA=
+github.com/DataDog/go-sqllexer v0.2.5/go.mod h1:3xTFXBU69vUikYpESggScvC0RKYA7ZIdVrIkLwUOWdE=
 github.com/SherClockHolmes/webpush-go v1.4.0 h1:ocnzNKWN23T9nvHi6IfyrQjkIc0oJWv1B1pULsf9i3s=
 github.com/SherClockHolmes/webpush-go v1.4.0/go.mod h1:XSq8pKX11vNV8MJEMwjrlTkxhAj1zKfxmyhdV7Pd6UA=
 github.com/TwiN/go-color v1.4.1 h1:mqG0P/KBgHKVqmtL5ye7K0/Gr4l6hTksPgTgMk3mUzc=
@@ -209,9 +211,11 @@ github.com/open-policy-agent/opa v1.21.2/go.mod h1:mHDS61rXyiZ+9bLINSK634BcbPZcs
 github.com/pborman/getopt v0.0.0-20170112200414-7148bc3a4c30/go.mod h1:85jBQOZwpVEaDAr341tbn15RS4fCAsIst0qp7i8ex1o=
 github.com/pgvector/pgvector-go v0.4.1 h1:Oaj0mC0Ky8KaTweNHHpLwyFlN6a0nUFoo1vgSFTEhPI=
 github.com/pgvector/pgvector-go v0.4.1/go.mod h1:4fSXyjl1TYAIdByAql6JazKWRr2s7J0g4hcRY5cBFCk=
+github.com/pgvector/pgvector-go/pgx v0.4.1 h1:4ASHKHkHKon+x3TlKCVoH0znhFWTWRvAF4z3vnY6bKc=
+github.com/pgvector/pgvector-go/pgx v0.4.1/go.mod h1:uGpIdPvyX/FxvOljT15nW/NY166HSDCC05JIcJBAzK0=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prairie-server/prairie-plugin-sdk v0.12.1-0.20261012211536-3ea8c11a9099 h1:Os1rTWSbyKkv6ritUArAV688N51l2QJ0D7knmCwLYXo=
-github.com/prairie-server/prairie-plugin-sdk v0.12.1-0.20261012211536-3ea8c11a9099/go.mod h1:9//dSqC0zUr+nap6ZssyMxQMYj3fxSEFGX7jDSErBa4=
+github.com/prairie-server/prairie-plugin-sdk v0.12.1-0.20261019002507-0aec7216afa6 h1:28bUpgTSdNA8jPzO1Vq4xsB2WO1DtFvWgrHsVulLg68=
+github.com/prairie-server/prairie-plugin-sdk v0.12.1-0.20261019002507-0aec7216afa6/go.mod h1:9//dSqC0zUr+nap6ZssyMxQMYj3fxSEFGX7jDSErBa4=
 github.com/pressly/goose/v3 v3.29.0 h1:dtEnBCT7CqkHIUCdgrXsrmeisaN8gFkRU4Y5OEwif4o=
 github.com/pressly/goose/v3 v3.29.0/go.mod h1:plA4aP4+u+Q3FMTgbFbhF8TuAWpAdfWpoFGkJsIFWh0=
 github.com/prometheus/client_golang v1.25.0 h1:cDtW1TcFsMi1RJc8khwCKB4VhzwV04aKqbYtNOXuiK0=
diff --git a/internal/access/group_audit.go b/internal/access/group_audit.go
index d82a6099ae..15513fd5b9 100644
--- a/internal/access/group_audit.go
+++ b/internal/access/group_audit.go
@@ -21,8 +21,9 @@ func groupAuditValues(group *Group) map[string]any {
 		"download_transcode_allowed": group.DownloadTranscodeAllowed, "transcode_allowed": group.TranscodeAllowed,
 		"audio_transcode_allowed": group.AudioTranscodeAllowed, "max_streams": group.MaxStreams,
 		"max_transcodes": group.MaxTranscodes, "max_remote_stream_bitrate_kbps": group.MaxRemoteStreamBitrateKbps,
-		"max_local_stream_bitrate_kbps": group.MaxLocalStreamBitrateKbps, "allowed_permissions": group.AllowedPermissions,
-		"requests_allowed": group.RequestsAllowed, auditFieldDefault: group.IsDefault,
+		"max_local_stream_bitrate_kbps": group.MaxLocalStreamBitrateKbps, "max_profiles": group.MaxProfiles,
+		"allowed_permissions": group.AllowedPermissions, "requests_allowed": group.RequestsAllowed,
+		auditFieldDefault: group.IsDefault,
 	}
 }
 func recordGroupMutation(ctx context.Context, tx pgx.Tx, before, after *Group) (*auditmutation.Entry, error) {
diff --git a/internal/access/group_audit_test.go b/internal/access/group_audit_test.go
new file mode 100644
index 0000000000..e79c73e51e
--- /dev/null
+++ b/internal/access/group_audit_test.go
@@ -0,0 +1,21 @@
+package access
+
+import (
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/auditmutation"
+)
+
+// TestGroupAuditRecordsProfileLimit checks that changing only a group's
+// profile limit leaves an audit change for it.
+func TestGroupAuditRecordsProfileLimit(t *testing.T) {
+	before := &Group{ID: 2, Name: "Guests", MaxProfiles: 5}
+	after := &Group{ID: 2, Name: "Guests", MaxProfiles: 2}
+	changes := auditmutation.Changes(groupAuditValues(before), groupAuditValues(after))
+	if len(changes) != 1 || changes[0].Field != "max_profiles" {
+		t.Fatalf("changes = %+v, want one max_profiles change", changes)
+	}
+	if changes[0].Before == nil || *changes[0].Before != "5" || changes[0].After == nil || *changes[0].After != "2" {
+		t.Fatalf("max_profiles change = %+v, want 5 -> 2", changes[0])
+	}
+}
diff --git a/internal/access/group_store.go b/internal/access/group_store.go
index 973c40a14a..039f38f4a0 100644
--- a/internal/access/group_store.go
+++ b/internal/access/group_store.go
@@ -29,6 +29,7 @@ type Group struct {
 	MaxTranscodes              int
 	MaxRemoteStreamBitrateKbps int
 	MaxLocalStreamBitrateKbps  int
+	MaxProfiles                int
 	AllowedPermissions         []string
 	RequestsAllowed            bool
 	IsDefault                  bool
@@ -51,6 +52,7 @@ func (g Group) Policy() GroupPolicy {
 		MaxTranscodes:              g.MaxTranscodes,
 		MaxRemoteStreamBitrateKbps: g.MaxRemoteStreamBitrateKbps,
 		MaxLocalStreamBitrateKbps:  g.MaxLocalStreamBitrateKbps,
+		MaxProfiles:                g.MaxProfiles,
 		AllowedPermissions:         cloneStrings(g.AllowedPermissions),
 		RequestsAllowed:            g.RequestsAllowed,
 	}
@@ -70,6 +72,7 @@ type CreateGroupInput struct {
 	MaxTranscodes              int
 	MaxRemoteStreamBitrateKbps int
 	MaxLocalStreamBitrateKbps  int
+	MaxProfiles                int // 0 = DefaultMaxProfiles
 	AllowedPermissions         []string
 	RequestsAllowed            bool
 	IsDefault                  bool
@@ -89,6 +92,7 @@ type UpdateGroupInput struct {
 	MaxTranscodes              *int
 	MaxRemoteStreamBitrateKbps *int
 	MaxLocalStreamBitrateKbps  *int
+	MaxProfiles                *int
 	AllowedPermissions         *[]string
 	RequestsAllowed            *bool
 	IsDefault                  *bool
@@ -119,7 +123,7 @@ func NewGroupStore(pool *pgxpool.Pool) *GroupStore {
 const accessGroupSelectColumns = `g.id, g.name, g.description, g.library_ids, g.max_playback_quality,
 	g.download_allowed, g.download_transcode_allowed, g.transcode_allowed, g.audio_transcode_allowed,
 	g.max_streams, g.max_transcodes, g.max_remote_stream_bitrate_kbps, g.max_local_stream_bitrate_kbps,
-	g.allowed_permissions, g.requests_allowed, g.is_default, g.created_at, g.updated_at, g.configuration_revision`
+	g.max_profiles, g.allowed_permissions, g.requests_allowed, g.is_default, g.created_at, g.updated_at, g.configuration_revision`
 
 type groupScanner interface {
 	Scan(dest ...any) error
@@ -141,6 +145,7 @@ func scanGroup(row groupScanner) (*Group, error) {
 		&g.MaxTranscodes,
 		&g.MaxRemoteStreamBitrateKbps,
 		&g.MaxLocalStreamBitrateKbps,
+		&g.MaxProfiles,
 		&g.AllowedPermissions,
 		&g.RequestsAllowed,
 		&g.IsDefault,
@@ -168,6 +173,7 @@ func scanGroupPolicy(row groupScanner) (*GroupPolicy, error) {
 		&p.MaxTranscodes,
 		&p.MaxRemoteStreamBitrateKbps,
 		&p.MaxLocalStreamBitrateKbps,
+		&p.MaxProfiles,
 		&p.AllowedPermissions,
 		&p.RequestsAllowed,
 	); err != nil {
@@ -226,6 +232,10 @@ func (s *GroupStore) Create(ctx context.Context, input CreateGroupInput) (*Group
 	if name == "" {
 		return nil, fmt.Errorf("access group name is required")
 	}
+	maxProfiles := input.MaxProfiles
+	if maxProfiles == 0 {
+		maxProfiles = DefaultMaxProfiles
+	}
 
 	tx, err := s.pool.Begin(ctx)
 	if err != nil {
@@ -250,9 +260,9 @@ func (s *GroupStore) Create(ctx context.Context, input CreateGroupInput) (*Group
 			name, description, library_ids, max_playback_quality,
 			download_allowed, download_transcode_allowed, transcode_allowed, audio_transcode_allowed,
 			max_streams, max_transcodes, max_remote_stream_bitrate_kbps, max_local_stream_bitrate_kbps,
-			allowed_permissions, requests_allowed, is_default
+			max_profiles, allowed_permissions, requests_allowed, is_default
 		)
-		VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15)
+		VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16)
 		RETURNING id`,
 		name,
 		input.Description,
@@ -266,6 +276,7 @@ func (s *GroupStore) Create(ctx context.Context, input CreateGroupInput) (*Group
 		input.MaxTranscodes,
 		input.MaxRemoteStreamBitrateKbps,
 		input.MaxLocalStreamBitrateKbps,
+		maxProfiles,
 		input.AllowedPermissions,
 		input.RequestsAllowed,
 		input.IsDefault,
@@ -371,6 +382,11 @@ func (s *GroupStore) UpdateConditional(ctx context.Context, id int64, input Upda
 		args = append(args, *input.MaxLocalStreamBitrateKbps)
 		arg++
 	}
+	if input.MaxProfiles != nil {
+		sets = append(sets, fmt.Sprintf("max_profiles = $%d", arg))
+		args = append(args, *input.MaxProfiles)
+		arg++
+	}
 	if input.AllowedPermissions != nil {
 		sets = append(sets, fmt.Sprintf("allowed_permissions = $%d", arg))
 		args = append(args, *input.AllowedPermissions)
@@ -577,6 +593,19 @@ func moveGroupMembersToDefault(ctx context.Context, tx pgx.Tx, id int64) ([]*aud
 		auditmutation.Changes(map[string]any{"access_group_id": id}, map[string]any{"access_group_id": defaultID}))
 }
 
+// MemberIDs lists the accounts in access group id.
+func (s *GroupStore) MemberIDs(ctx context.Context, id int64) ([]int, error) {
+	rows, err := s.pool.Query(ctx, `SELECT id FROM users WHERE access_group_id = $1 ORDER BY id`, id)
+	if err != nil {
+		return nil, fmt.Errorf("listing access group %d members: %w", id, err)
+	}
+	ids, err := pgx.CollectRows(rows, pgx.RowTo[int])
+	if err != nil {
+		return nil, fmt.Errorf("listing access group %d members: %w", id, err)
+	}
+	return ids, nil
+}
+
 // GetPolicyForUser returns the access-group policy for a user, or nil when
 // the user has no group.
 func (s *GroupStore) GetPolicyForUser(ctx context.Context, userID int) (*GroupPolicy, error) {
@@ -599,7 +628,7 @@ func groupPolicyForUser(ctx context.Context, db interface {
 		SELECT g.id, g.library_ids, g.max_playback_quality, g.download_allowed,
 			g.download_transcode_allowed, g.transcode_allowed, g.audio_transcode_allowed,
 			g.max_streams, g.max_transcodes, g.max_remote_stream_bitrate_kbps, g.max_local_stream_bitrate_kbps,
-			g.allowed_permissions, g.requests_allowed
+			g.max_profiles, g.allowed_permissions, g.requests_allowed
 		FROM users u
 		JOIN access_groups g ON g.id = u.access_group_id
 		WHERE u.id = $1`, userID))
diff --git a/internal/access/group_store_test.go b/internal/access/group_store_test.go
index 56c92a9b29..eae821c86b 100644
--- a/internal/access/group_store_test.go
+++ b/internal/access/group_store_test.go
@@ -109,6 +109,28 @@ func TestGroupStoreGetPolicyForUserDB(t *testing.T) {
 	if policy == nil || !policy.TranscodeAllowed {
 		t.Fatalf("policy after update = %#v, want transcode_allowed true", policy)
 	}
+	if group.MaxProfiles != DefaultMaxProfiles {
+		t.Fatalf("new group profile limit = %d, want %d", group.MaxProfiles, DefaultMaxProfiles)
+	}
+	before, err := store.Get(ctx, group.ID)
+	if err != nil {
+		t.Fatalf("Get() error: %v", err)
+	}
+	maxProfiles := 2
+	updated, err := store.Update(ctx, group.ID, UpdateGroupInput{MaxProfiles: &maxProfiles})
+	if err != nil {
+		t.Fatalf("Update(max_profiles) error: %v", err)
+	}
+	if updated.MaxProfiles != 2 || updated.Revision == before.Revision {
+		t.Fatalf("group after profile limit update = limit %d revision %d, want 2 and a revision after %d", updated.MaxProfiles, updated.Revision, before.Revision)
+	}
+	policy, err = store.GetPolicyForUser(ctx, memberID)
+	if err != nil {
+		t.Fatalf("GetPolicyForUser(after profile limit update) error: %v", err)
+	}
+	if policy == nil || policy.MaxProfiles != 2 {
+		t.Fatalf("policy after profile limit update = %#v, want max_profiles 2", policy)
+	}
 	policy, err = store.GetPolicyForUser(ctx, noGroupID)
 	if err != nil {
 		t.Fatalf("GetPolicyForUser(no group) error: %v", err)
diff --git a/internal/access/groups.go b/internal/access/groups.go
index 2f8e98f3f4..d46f13ede6 100644
--- a/internal/access/groups.go
+++ b/internal/access/groups.go
@@ -28,6 +28,7 @@ type GroupPolicy struct {
 	MaxTranscodes              int
 	MaxRemoteStreamBitrateKbps int      // 0 = unlimited
 	MaxLocalStreamBitrateKbps  int      // 0 = unlimited
+	MaxProfiles                int      // household profiles per account; at least 1
 	AllowedPermissions         []string // nil = all assignable
 	RequestsAllowed            bool
 }
@@ -46,6 +47,7 @@ type EffectiveUserPolicy struct {
 	MaxTranscodes              int
 	MaxRemoteStreamBitrateKbps int
 	MaxLocalStreamBitrateKbps  int
+	MaxProfiles                int
 	Permissions                []string
 	RequestsAllowed            bool
 }
@@ -60,12 +62,19 @@ func AdminPolicy() GroupPolicy {
 	return policy
 }
 
+// DefaultMaxProfiles is the household profile limit of an account outside
+// every access group, and of a new group that does not set one. It was the
+// stored default on every account before groups set the limit.
+const DefaultMaxProfiles = 5
+
 // NoGroupPolicy is the policy applied to a regular account with no access
 // group. It is permissive so that an unset field on such an account keeps
 // today's unrestricted behavior. DownloadTranscodeAllowed is the exception: it
 // defaults to false because that was the old column default on users (and is
 // the seeded Default Group's value), so an account that never had the gate
-// turned on does not silently gain it. Admins use AdminPolicy instead.
+// turned on does not silently gain it. MaxProfiles is DefaultMaxProfiles, the
+// limit such an account always had: profiles were never unlimited. Admins use
+// AdminPolicy instead.
 func NoGroupPolicy() GroupPolicy {
 	return GroupPolicy{
 		LibraryIDs:                 nil,
@@ -78,6 +87,7 @@ func NoGroupPolicy() GroupPolicy {
 		MaxTranscodes:              0,
 		MaxRemoteStreamBitrateKbps: 0,
 		MaxLocalStreamBitrateKbps:  0,
+		MaxProfiles:                DefaultMaxProfiles,
 		AllowedPermissions:         nil,
 		RequestsAllowed:            true,
 	}
@@ -134,6 +144,7 @@ func ApplyGroupPolicy(user *models.User, group *GroupPolicy) EffectiveUserPolicy
 		MaxTranscodes:              inheritInt(user.MaxTranscodes, base.MaxTranscodes),
 		MaxRemoteStreamBitrateKbps: inheritInt(user.MaxRemoteStreamBitrateKbps, base.MaxRemoteStreamBitrateKbps),
 		MaxLocalStreamBitrateKbps:  inheritInt(user.MaxLocalStreamBitrateKbps, base.MaxLocalStreamBitrateKbps),
+		MaxProfiles:                inheritInt(user.MaxProfiles, base.MaxProfiles),
 		Permissions:                cloneStrings(user.Permissions),
 		RequestsAllowed:            inheritBool(user.RequestsAllowed, base.RequestsAllowed),
 	}
diff --git a/internal/access/groups_test.go b/internal/access/groups_test.go
index f998dffc6e..fa51baa4bb 100644
--- a/internal/access/groups_test.go
+++ b/internal/access/groups_test.go
@@ -50,6 +50,28 @@ func TestLocalStreamBitratePolicyInheritanceAndOverride(t *testing.T) {
 	}
 }
 
+func TestMaxProfilesInheritanceAndOverride(t *testing.T) {
+	group := &GroupPolicy{MaxProfiles: 2}
+	user := &models.User{}
+	if got := ApplyGroupPolicy(user, group).MaxProfiles; got != 2 {
+		t.Fatalf("inherited profile limit = %d, want 2", got)
+	}
+	user.MaxProfiles = ptr(8)
+	if got := ApplyGroupPolicy(user, group).MaxProfiles; got != 8 {
+		t.Fatalf("profile limit override = %d, want 8", got)
+	}
+	user.MaxProfiles = nil
+	if got := ApplyGroupPolicy(user, nil).MaxProfiles; got != DefaultMaxProfiles {
+		t.Fatalf("no-group profile limit = %d, want %d", got, DefaultMaxProfiles)
+	}
+	// An admin row that still carries a group resolves as ungrouped.
+	admin := &models.User{Role: models.RoleAdmin, AccessGroupID: ptr(int64(4))}
+	got, err := EffectivePolicyForUser(t.Context(), admin, failingGroupProvider{t: t})
+	if err != nil || got.MaxProfiles != DefaultMaxProfiles {
+		t.Fatalf("admin profile limit = %d, %v; want %d", got.MaxProfiles, err, DefaultMaxProfiles)
+	}
+}
+
 func TestApplyGroupPolicyNoGroupUsesOverridesOverPermissiveDefault(t *testing.T) {
 	user := &models.User{
 		ID:                       7,
@@ -71,6 +93,7 @@ func TestApplyGroupPolicyNoGroupUsesOverridesOverPermissiveDefault(t *testing.T)
 		AudioTranscodeAllowed:    true,
 		MaxStreams:               6,
 		MaxTranscodes:            2,
+		MaxProfiles:              DefaultMaxProfiles,
 		Permissions:              []string{"metadata_curation", "marker_edit", "marker_edit"},
 		RequestsAllowed:          true,
 	}
@@ -92,6 +115,7 @@ func TestApplyGroupPolicyUnsetUserInheritsNoGroupDefaults(t *testing.T) {
 		AudioTranscodeAllowed:    true,
 		MaxStreams:               0,
 		MaxTranscodes:            0,
+		MaxProfiles:              DefaultMaxProfiles,
 		Permissions:              nil,
 		RequestsAllowed:          true,
 	}
@@ -395,6 +419,7 @@ func adminFullAccess() EffectiveUserPolicy {
 		TranscodeAllowed:         true,
 		AudioTranscodeAllowed:    true,
 		RequestsAllowed:          true,
+		MaxProfiles:              DefaultMaxProfiles,
 	}
 }
 
diff --git a/internal/access/profile_token.go b/internal/access/profile_token.go
index 8cb33f3d9a..e0515fb53d 100644
--- a/internal/access/profile_token.go
+++ b/internal/access/profile_token.go
@@ -74,7 +74,7 @@ func (s *ProfileTokenService) Validate(tokenStr string) (*ProfileTokenClaims, er
 		if errors.Is(err, jwt.ErrTokenExpired) {
 			return nil, fmt.Errorf("%w: expired", ErrProfileUnverified)
 		}
-		return nil, fmt.Errorf("%w: %w", ErrProfileUnverified, err)
+		return nil, fmt.Errorf("%w: %v", ErrProfileUnverified, err) //nolint:errorlint // the sentinel is the verdict on a client token; the jwt parse error is only reported
 	}
 	if !token.Valid {
 		return nil, ErrProfileUnverified
diff --git a/internal/access/resolver.go b/internal/access/resolver.go
index 075d210ab9..c49ced525b 100644
--- a/internal/access/resolver.go
+++ b/internal/access/resolver.go
@@ -109,6 +109,7 @@ func (r *Resolver) Resolve(ctx context.Context, input ResolveInput) (Scope, erro
 		scope.PreferredMetadataLanguage = preferences.PreferredMetadataLanguage
 		scope.MetadataLanguageOverrides = preferences.MetadataLanguageOverrides
 		scope.NextUpMode = preferences.NextUpMode
+		scope.NextUpNewReleasesFirst = preferences.NextUpNewReleasesFirst
 		scope.AllowedLibraryIDs, scope.LibrariesRestricted = effectiveLibraries(effective.LibraryIDs, profile)
 		verified, err := VerifyProfileForRequest(profile, input, user.ID, r.tokens)
 		if err != nil {
diff --git a/internal/access/resolver_test.go b/internal/access/resolver_test.go
index 5ac6408c68..9cac09d1b7 100644
--- a/internal/access/resolver_test.go
+++ b/internal/access/resolver_test.go
@@ -88,6 +88,9 @@ func (s stubStore) ClearProgressBatch(context.Context, string, []string, time.Ti
 	panic("unused")
 }
 func (s stubStore) ClearProgress(context.Context, string, string) error { panic("unused") }
+func (s stubStore) ClearResumePosition(context.Context, string, string, time.Time) (bool, error) {
+	panic("unused")
+}
 func (s stubStore) GetProgress(context.Context, string, string) (*userstore.WatchProgress, error) {
 	panic("unused")
 }
@@ -140,11 +143,11 @@ func (s stubStore) UpsertHomeDismissal(context.Context, userstore.HomeItemDismis
 func (s stubStore) DeleteHomeDismissal(context.Context, string, string, string) error {
 	panic("unused")
 }
-func (s stubStore) AddFavorite(context.Context, string, string) error { panic("unused") }
+func (s stubStore) AddFavorite(context.Context, string, string) (bool, error) { panic("unused") }
 func (s stubStore) AddFavoriteAt(context.Context, string, string, time.Time) (bool, error) {
 	panic("unused")
 }
-func (s stubStore) RemoveFavorite(context.Context, string, string) error {
+func (s stubStore) RemoveFavorite(context.Context, string, string) (bool, error) {
 	panic("unused")
 }
 func (s stubStore) ListFavorites(context.Context, string, int, int) ([]userstore.Favorite, error) {
@@ -157,20 +160,37 @@ func (s stubStore) ListFavoritesByMediaItems(context.Context, string, []string)
 	panic("unused")
 }
 func (s stubStore) IsFavorite(context.Context, string, string) (bool, error) { panic("unused") }
+func (s stubStore) MarkNotInterested(context.Context, string, string) (bool, error) {
+	panic("unused")
+}
+func (s stubStore) UnmarkNotInterested(context.Context, string, string) (bool, error) {
+	panic("unused")
+}
+func (s stubStore) GetNotInterested(context.Context, string, string) (*userstore.NotInterestedEntry, error) {
+	panic("unused")
+}
+func (s stubStore) ListNotInterestedPage(context.Context, string, *userstore.ListKey, int) ([]userstore.NotInterestedEntry, error) {
+	panic("unused")
+}
+func (s stubStore) ListNotInterestedByMediaItems(context.Context, string, []string) (map[string]bool, error) {
+	panic("unused")
+}
 func (s stubStore) GetFavorite(context.Context, string, string) (*userstore.Favorite, error) {
 	panic("unused")
 }
 func (s stubStore) GetWatchlistEntry(context.Context, string, string) (*userstore.WatchlistEntry, error) {
 	panic("unused")
 }
-func (s stubStore) AddToWatchlist(context.Context, string, string) error { panic("unused") }
+func (s stubStore) AddToWatchlist(context.Context, string, string) (bool, error) { panic("unused") }
 func (s stubStore) AddToWatchlistAt(context.Context, string, string, time.Time) (bool, error) {
 	panic("unused")
 }
 func (s stubStore) RemoveWatchedFromWatchlist(context.Context, string) (bool, error) {
 	return true, nil
 }
-func (s stubStore) RemoveFromWatchlist(context.Context, string, string) error { panic("unused") }
+func (s stubStore) RemoveFromWatchlist(context.Context, string, string) (bool, error) {
+	panic("unused")
+}
 func (s stubStore) ReplaceWatchlistOrder(context.Context, string, []string) error {
 	panic("unused")
 }
diff --git a/internal/access/types.go b/internal/access/types.go
index b5491e49b4..3c102f9933 100644
--- a/internal/access/types.go
+++ b/internal/access/types.go
@@ -44,6 +44,10 @@ type Scope struct {
 	// socket tickets and progress snapshots hash as the access fingerprint:
 	// changing the row mid-session must not invalidate either.
 	NextUpMode string `json:"-"`
+	// NextUpNewReleasesFirst is the profile's resolved
+	// ui.next_up_new_releases_first. It is set together with NextUpMode, so a
+	// scope whose NextUpMode is "" has not resolved it either.
+	NextUpNewReleasesFirst bool `json:"-"`
 	// PreferencesDegraded is set when the profile's viewer preferences could
 	// not be read and the scope carries their defaults (see
 	// ResolveViewerPreferences). It stays out of the access fingerprint, which
diff --git a/internal/access/viewer_preferences.go b/internal/access/viewer_preferences.go
index 05dfaef288..6e595de1c1 100644
--- a/internal/access/viewer_preferences.go
+++ b/internal/access/viewer_preferences.go
@@ -24,6 +24,9 @@ type ViewerPreferences struct {
 	// NextUpMode is ui.next_up_mode. It rides along so home-section requests
 	// can read it from the resolved scope instead of resolving it again.
 	NextUpMode string
+	// NextUpNewReleasesFirst is ui.next_up_new_releases_first, carried for the
+	// same reason.
+	NextUpNewReleasesFirst bool
 	// Degraded reports that the read failed and the values are the contract
 	// defaults rather than the profile's own.
 	Degraded bool
@@ -69,6 +72,7 @@ func ResolveViewerPreferencesStrict(ctx context.Context, store ViewerPreferenceR
 			settingskeys.CatalogMetadataLanguage,
 			settingskeys.CatalogMetadataLanguageOverrides,
 			settingskeys.UiNextUpMode,
+			settingskeys.UiNextUpNewReleasesFirst,
 		}, nil)
 	if err != nil {
 		return ViewerPreferences{}, err
@@ -91,6 +95,8 @@ func ResolveViewerPreferencesStrict(ctx context.Context, store ViewerPreferenceR
 			if json.Unmarshal(value.Value, &mode) == nil {
 				out.NextUpMode = strings.TrimSpace(mode)
 			}
+		case settingskeys.UiNextUpNewReleasesFirst:
+			_ = json.Unmarshal(value.Value, &out.NextUpNewReleasesFirst)
 		}
 	}
 	return out, nil
diff --git a/internal/activitylog/middleware.go b/internal/activitylog/middleware.go
index 6ac9a12abf..b0b48473a9 100644
--- a/internal/activitylog/middleware.go
+++ b/internal/activitylog/middleware.go
@@ -3,6 +3,7 @@ package activitylog
 import (
 	"bufio"
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"net"
@@ -153,7 +154,7 @@ func NewFilteredMiddleware(w Writer, nodeID string, skipRoute func(pattern strin
 				Method:             r.Method,
 				Path:               path,
 				PathPattern:        pathPattern,
-				StatusCode:         wrapped.status,
+				StatusCode:         RecordedStatus(r, wrapped.status, wrapped.wroteHeader),
 				UserAgent:          r.UserAgent(),
 				DurationMs:         int(time.Since(start).Milliseconds()),
 			}
@@ -170,6 +171,22 @@ func NewFilteredMiddleware(w Writer, nodeID string, skipRoute func(pattern strin
 	}
 }
 
+// StatusClientClosedRequest is the status recorded for a request its client
+// abandoned, as nginx records it.
+const StatusClientClosedRequest = 499
+
+// RecordedStatus is the status to record for a request that ended with
+// status, where wrote says whether a response was started. A request whose
+// client went away and that got no response, or a server error, is recorded
+// as StatusClientClosedRequest: the client never saw an answer, and the
+// failure is not one the server has to count.
+func RecordedStatus(r *http.Request, status int, wrote bool) int {
+	if errors.Is(r.Context().Err(), context.Canceled) && (!wrote || status >= 500) {
+		return StatusClientClosedRequest
+	}
+	return status
+}
+
 // RedactSecretPathParams strips bearer credentials from a request path before
 // it reaches any log sink. Public webhook endpoints authenticate via a secret
 // path segment (chi route params named "token" or "secret" — autoscan webhook
diff --git a/internal/activitylog/middleware_status_test.go b/internal/activitylog/middleware_status_test.go
new file mode 100644
index 0000000000..2329067762
--- /dev/null
+++ b/internal/activitylog/middleware_status_test.go
@@ -0,0 +1,52 @@
+package activitylog
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+)
+
+// A request its client abandoned is recorded as 499 when it got no response
+// or a server error: the client never saw an answer, so it is not a server
+// failure. Anything else keeps the status that was written.
+func TestMiddlewareRecordsAbandonedRequests(t *testing.T) {
+	canceled := func() context.Context {
+		ctx, cancel := context.WithCancel(context.Background())
+		cancel()
+		return ctx
+	}
+	expired := func() context.Context {
+		ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(-time.Second))
+		t.Cleanup(cancel)
+		return ctx
+	}
+	for _, tc := range []struct {
+		name   string
+		ctx    func() context.Context
+		status int // 0 writes nothing
+		want   int
+	}{
+		{"client gone, nothing written", canceled, 0, StatusClientClosedRequest},
+		{"client gone, server error", canceled, http.StatusInternalServerError, StatusClientClosedRequest},
+		{"client gone, not found", canceled, http.StatusNotFound, http.StatusNotFound},
+		{"client gone, success started", canceled, http.StatusOK, http.StatusOK},
+		{"client waiting, server error", context.Background, http.StatusInternalServerError, http.StatusInternalServerError},
+		{"client waiting, nothing written", context.Background, 0, http.StatusOK},
+		{"deadline, server error", expired, http.StatusServiceUnavailable, http.StatusServiceUnavailable},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			capture := &captureWriter{}
+			h := NewMiddleware(capture, "node")(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+				if tc.status != 0 {
+					w.WriteHeader(tc.status)
+				}
+			}))
+			h.ServeHTTP(httptest.NewRecorder(), httptest.NewRequest(http.MethodGet, "/api/v2/libraries", nil).WithContext(tc.ctx()))
+			if len(capture.entries) != 1 || capture.entries[0].StatusCode != tc.want {
+				t.Fatalf("entries = %+v, want status %d", capture.entries, tc.want)
+			}
+		})
+	}
+}
diff --git a/internal/activitylog/mutation_db_test.go b/internal/activitylog/mutation_db_test.go
index b1eec758b3..636212113c 100644
--- a/internal/activitylog/mutation_db_test.go
+++ b/internal/activitylog/mutation_db_test.go
@@ -49,7 +49,7 @@ func TestMutationCommitRollbackAndHistoryDB(t *testing.T) {
 	ctx = SetLogContext(ctx, lc)
 	resolver := clientip.NewResolver(nil)
 	var scoped context.Context
-	clientip.Middleware(resolver)(http.HandlerFunc(func(_ http.ResponseWriter, r *http.Request) { scoped = r.Context() })).ServeHTTP(httptest.NewRecorder(), lc.Request.WithContext(ctx))
+	clientip.Middleware(resolver)(http.HandlerFunc(func(_ http.ResponseWriter, r *http.Request) { scoped = r.Context() })).ServeHTTP(httptest.NewRecorder(), lc.Request.WithContext(ctx)) //nolint:fatcontext // captures the one request context the middleware builds
 	ctx = scoped
 	conn, err := pool.Acquire(ctx)
 	if err != nil {
diff --git a/internal/adminjob/image_cache_cleanup.go b/internal/adminjob/image_cache_cleanup.go
index 8f09bf3937..dff19225cc 100644
--- a/internal/adminjob/image_cache_cleanup.go
+++ b/internal/adminjob/image_cache_cleanup.go
@@ -69,8 +69,7 @@ func (e *ImageCacheCleanupExecutor) Execute(
 		deleted.DeletedS3Objects += n
 		if ctxErr := ctx.Err(); ctxErr != nil {
 			// After the deadline every remaining delete fails at once; stop
-			// instead of logging and skipping each of them. The S3 client's
-			// per-object fallback logs such failures and still returns nil.
+			// instead of logging and skipping each of them.
 			return index, deleted, ctxErr
 		}
 		if err != nil {
diff --git a/internal/adminjob/image_cache_cleanup_runner_test.go b/internal/adminjob/image_cache_cleanup_runner_test.go
index a679f93c01..d99566bae4 100644
--- a/internal/adminjob/image_cache_cleanup_runner_test.go
+++ b/internal/adminjob/image_cache_cleanup_runner_test.go
@@ -311,3 +311,307 @@ func TestJobOutcomeIsRecordedAfterItsContextEnds(t *testing.T) {
 		t.Fatalf("outcome %v %+v, want completed", err, terminal)
 	}
 }
+
+// Canceling a cleanup that yielded stops it at its next claim. The job ends
+// canceled with the progress and deletion totals the earlier claim recorded.
+func TestImageCacheCleanupCancelledBetweenSlicesKeepsTotals(t *testing.T) {
+	r := lifecycleRepo(t)
+	prefixes := cleanupPrefixes(8)
+	job := queueImageCacheCleanupJob(t, r, prefixes)
+	store := &cleanupStore{deleteFn: func(ctx context.Context, call int, _ string) (int, error) {
+		if call == 3 {
+			return stallUntilDone(ctx)
+		}
+		return 1, nil
+	}}
+	runner := imageCacheCleanupRunner(r, store, 2*time.Second)
+
+	runner.runNext()
+	if _, err := r.RequestCancellation(t.Context(), job.ID); err != nil {
+		t.Fatalf("request cancellation: %v", err)
+	}
+	runner.runNext()
+
+	canceled, err := r.GetByID(t.Context(), job.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if canceled.Status != StatusCancelled || canceled.ProgressCurrent != 3 || canceled.ProgressTotal != 8 {
+		t.Fatalf("after cancellation: status=%s progress=%d/%d, want canceled 3/8", canceled.Status, canceled.ProgressCurrent, canceled.ProgressTotal)
+	}
+	if !strings.Contains(canceled.Message, "remain in storage") {
+		t.Fatalf("cancellation message %q does not say undeleted images remain", canceled.Message)
+	}
+	if got := imageCacheCleanupResultOf(t, canceled); got.DeletedPrefixes != 3 || got.DeletedS3Objects != 3 {
+		t.Fatalf("canceled result %+v, want the 3 prefixes deleted before cancellation", got)
+	}
+	if calls := store.attempted(); len(calls) != 4 {
+		t.Fatalf("attempted %v, want no deletes after cancellation", calls)
+	}
+	if again, err := r.RequestCancellation(t.Context(), job.ID); err != nil || again.Status != StatusCancelled {
+		t.Fatalf("repeat cancellation: %v %+v", err, again)
+	}
+}
+
+// A cancellation requested while a slice is running stops the slice before the
+// next prefix. The job ends canceled with the totals of the prefixes deleted so
+// far, whether the request arrives through the database flag or the in-process
+// cancel registry.
+func TestImageCacheCleanupCanceledMidSliceStopsAndKeepsTotals(t *testing.T) {
+	for _, via := range []string{"flag", "registry"} {
+		t.Run(via, func(t *testing.T) {
+			r := lifecycleRepo(t)
+			prefixes := cleanupPrefixes(8)
+			job := queueImageCacheCleanupJob(t, r, prefixes)
+			var runner *Runner
+			store := &cleanupStore{deleteFn: func(ctx context.Context, call int, _ string) (int, error) {
+				if call == 3 {
+					if _, err := r.RequestCancellation(context.Background(), job.ID); err != nil {
+						t.Errorf("request cancellation: %v", err)
+					}
+					if via == "registry" && !runner.cancelRegistry.Cancel(job.ID) {
+						t.Error("cleanup is not registered for cancellation")
+					}
+					return stallUntilDone(ctx)
+				}
+				return 1, nil
+			}}
+			runner = imageCacheCleanupRunner(r, store, time.Minute)
+			if via == "flag" {
+				runner.heartbeatInterval = 50 * time.Millisecond
+			}
+
+			started := time.Now()
+			runner.runNext()
+			if elapsed := time.Since(started); elapsed > 30*time.Second {
+				t.Fatalf("cancellation took %s; the slice ran to its deadline", elapsed)
+			}
+
+			canceled, err := r.GetByID(t.Context(), job.ID)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if canceled.Status != StatusCancelled || canceled.ProgressCurrent != 3 || canceled.ProgressTotal != 8 {
+				t.Fatalf("status=%s progress=%d/%d, want canceled 3/8", canceled.Status, canceled.ProgressCurrent, canceled.ProgressTotal)
+			}
+			if !strings.Contains(canceled.Message, "canceled") || strings.Contains(canceled.Message, "completed") {
+				t.Fatalf("message %q should report the cancellation", canceled.Message)
+			}
+			if got := imageCacheCleanupResultOf(t, canceled); got.DeletedPrefixes != 3 || got.DeletedS3Objects != 3 {
+				t.Fatalf("canceled result %+v, want the 3 prefixes deleted before cancellation", got)
+			}
+			if calls := store.attempted(); len(calls) != 4 {
+				t.Fatalf("attempted %v, want no deletes after cancellation", calls)
+			}
+		})
+	}
+}
+
+// A cancellation that lands after the claim but before the slice registers
+// with the cancel registry finds no callback to run. The slice checks the flag
+// before its first delete, so it deletes nothing rather than running until its
+// first cancel poll.
+func TestImageCacheCleanupCanceledBeforeRegisterDeletesNothing(t *testing.T) {
+	r := lifecycleRepo(t)
+	job := queueImageCacheCleanupJob(t, r, cleanupPrefixes(4))
+	store := &cleanupStore{deleteFn: func(context.Context, int, string) (int, error) { return 1, nil }}
+	runner := imageCacheCleanupRunner(r, store, time.Minute)
+	runner.heartbeatInterval = time.Hour
+
+	claimed, err := r.ClaimNextQueued(t.Context(), JobTypeImageCacheCleanup)
+	if err != nil || claimed == nil || claimed.ID != job.ID {
+		t.Fatalf("claim: %+v %v", claimed, err)
+	}
+	if _, err := r.RequestCancellation(t.Context(), job.ID); err != nil {
+		t.Fatalf("request cancellation: %v", err)
+	}
+	if runner.cancelRegistry.Cancel(job.ID) {
+		t.Fatal("cleanup registered before its slice started")
+	}
+	runner.repo = runner.repo.withClaim(claimed)
+	runner.executeImageCacheCleanup(claimed)
+
+	canceled, err := r.GetByID(t.Context(), job.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if canceled.Status != StatusCancelled || canceled.ProgressCurrent != 0 {
+		t.Fatalf("status=%s progress=%d/%d, want canceled before the first prefix", canceled.Status, canceled.ProgressCurrent, canceled.ProgressTotal)
+	}
+	if calls := store.attempted(); len(calls) != 0 {
+		t.Fatalf("attempted %v, want no deletes after cancellation", calls)
+	}
+}
+
+// A cancellation that commits after the slice deadline, while the slice is
+// finishing, ends the job with its totals instead of requeueing it with the
+// flag set to wait for the next claim.
+func TestImageCacheCleanupCanceledAtSliceDeadlineDoesNotYield(t *testing.T) {
+	r := lifecycleRepo(t)
+	job := queueImageCacheCleanupJob(t, r, cleanupPrefixes(6))
+	store := &cleanupStore{deleteFn: func(ctx context.Context, call int, _ string) (int, error) {
+		if call == 2 {
+			<-ctx.Done()
+			if _, err := r.RequestCancellation(context.Background(), job.ID); err != nil {
+				t.Errorf("request cancellation: %v", err)
+			}
+			return 0, ctx.Err()
+		}
+		return 1, nil
+	}}
+	runner := imageCacheCleanupRunner(r, store, 300*time.Millisecond)
+	runner.heartbeatInterval = time.Hour
+
+	runner.runNext()
+
+	canceled, err := r.GetByID(t.Context(), job.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if canceled.Status != StatusCancelled || canceled.ProgressCurrent != 2 || canceled.ProgressTotal != 6 {
+		t.Fatalf("status=%s progress=%d/%d, want canceled 2/6", canceled.Status, canceled.ProgressCurrent, canceled.ProgressTotal)
+	}
+	if got := imageCacheCleanupResultOf(t, canceled); got.DeletedPrefixes != 2 || got.DeletedS3Objects != 2 {
+		t.Fatalf("canceled result %+v, want the 2 prefixes deleted before the deadline", got)
+	}
+}
+
+// Yield and a cancel request race on the same row. Whichever commits first,
+// the cleanup ends canceled with its totals: a flag set before Yield makes
+// Yield cancel the row itself, and a flag set after it finds the job queued.
+func TestImageCacheCleanupYieldCancelsAFlaggedRow(t *testing.T) {
+	r := lifecycleRepo(t)
+	job := queueImageCacheCleanupJob(t, r, cleanupPrefixes(6))
+	claimed, err := r.ClaimNextQueued(t.Context(), JobTypeImageCacheCleanup)
+	if err != nil || claimed == nil || claimed.ID != job.ID {
+		t.Fatalf("claim: %+v %v", claimed, err)
+	}
+	if _, err := r.RequestCancellation(t.Context(), job.ID); err != nil {
+		t.Fatalf("request cancellation: %v", err)
+	}
+	result := ImageCacheCleanupResult{DeletedPrefixes: 2, DeletedS3Objects: 5}
+	message := imageCacheCleanupCanceledMessage(2, 6)
+	if err := r.withClaim(claimed).Yield(t.Context(), job.ID, 2, 6, "Cleaning cached images 2/6", result, message, time.Now().Add(time.Hour)); err != nil {
+		t.Fatalf("yield: %v", err)
+	}
+
+	canceled, err := r.GetByID(t.Context(), job.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if canceled.Status != StatusCancelled || canceled.Message != message || canceled.ProgressCurrent != 2 || canceled.CompletedAt == nil || canceled.ExpiresAt == nil {
+		t.Fatalf("status=%s message=%q progress=%d completed=%v expires=%v, want canceled at 2/6", canceled.Status, canceled.Message, canceled.ProgressCurrent, canceled.CompletedAt, canceled.ExpiresAt)
+	}
+	if got := imageCacheCleanupResultOf(t, canceled); got.DeletedPrefixes != 2 || got.DeletedS3Objects != 5 {
+		t.Fatalf("canceled result %+v, want the totals passed to Yield", got)
+	}
+}
+
+// A cancellation that arrives during the last prefix, and is only seen after
+// it, still ends canceled, but keeps the deletion totals rather than the empty
+// result Complete would write, and does not claim that undeleted images remain.
+func TestImageCacheCleanupCanceledAfterLastPrefixKeepsTotals(t *testing.T) {
+	r := lifecycleRepo(t)
+	prefixes := cleanupPrefixes(2)
+	job := queueImageCacheCleanupJob(t, r, prefixes)
+	store := &cleanupStore{deleteFn: func(_ context.Context, call int, _ string) (int, error) {
+		if call == 1 {
+			if _, err := r.RequestCancellation(context.Background(), job.ID); err != nil {
+				t.Errorf("request cancellation: %v", err)
+			}
+		}
+		return 1, nil
+	}}
+	runner := imageCacheCleanupRunner(r, store, time.Minute)
+
+	runner.runNext()
+
+	canceled, err := r.GetByID(t.Context(), job.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if canceled.Status != StatusCancelled || strings.Contains(canceled.Message, "completed") {
+		t.Fatalf("status=%s message=%q, want a canceled job reported as canceled", canceled.Status, canceled.Message)
+	}
+	if got := imageCacheCleanupResultOf(t, canceled); got.DeletedPrefixes != 2 {
+		t.Fatalf("canceled result %+v, want both prefixes counted", got)
+	}
+	const want = "Image cache cleanup canceled after 2/2 prefixes; all prefixes were already processed"
+	if canceled.Message != want || canceled.ProgressCurrent != 2 || canceled.ProgressTotal != 2 {
+		t.Fatalf("message=%q progress=%d/%d, want %q at 2/2", canceled.Message, canceled.ProgressCurrent, canceled.ProgressTotal, want)
+	}
+}
+
+// A cancellation that lands between the runner's last check and Complete is
+// resolved atomically by Complete: the job ends canceled with the cleanup's
+// cancel message and keeps its totals instead of a cleared result.
+func TestImageCacheCleanupCompleteRacingCancelKeepsTotals(t *testing.T) {
+	r := lifecycleRepo(t)
+	job := queueImageCacheCleanupJob(t, r, cleanupPrefixes(2))
+	claimed, err := r.ClaimNextQueued(t.Context(), JobTypeImageCacheCleanup)
+	if err != nil || claimed == nil || claimed.ID != job.ID {
+		t.Fatalf("claim: %v %+v", err, claimed)
+	}
+	if _, err := r.RequestCancellation(t.Context(), job.ID); err != nil {
+		t.Fatalf("request cancellation: %v", err)
+	}
+	if err := r.Complete(t.Context(), job.ID, CompleteJobInput{
+		ResultPayload:   ImageCacheCleanupResult{LibraryID: 1, DeletedPrefixes: 2, DeletedS3Objects: 5},
+		Message:         "Cached image cleanup completed",
+		CanceledMessage: "Image cache cleanup canceled after 2/2 prefixes",
+		ProgressCurrent: 2,
+		ProgressTotal:   2,
+		ExpiresAt:       time.Now().UTC().Add(time.Hour),
+	}); err != nil {
+		t.Fatalf("complete: %v", err)
+	}
+	got, err := r.GetByID(t.Context(), job.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Status != StatusCancelled || got.Message != "Image cache cleanup canceled after 2/2 prefixes" {
+		t.Fatalf("status=%s message=%q, want canceled with the cleanup cancel message", got.Status, got.Message)
+	}
+	if result := imageCacheCleanupResultOf(t, got); result.DeletedPrefixes != 2 || result.DeletedS3Objects != 5 {
+		t.Fatalf("result %+v, want totals kept", result)
+	}
+}
+
+// CancelWithResult writes the canceled status and final totals together, and
+// only for the claim that still owns the running job. CancelState reports the
+// two fields the cancellation watcher polls.
+func TestImageCacheCleanupCancelWithResultIsOneFencedWrite(t *testing.T) {
+	r := lifecycleRepo(t)
+	job := queueImageCacheCleanupJob(t, r, cleanupPrefixes(4))
+	claimed, err := r.ClaimNextQueued(t.Context(), JobTypeImageCacheCleanup)
+	if err != nil || claimed == nil || claimed.ID != job.ID {
+		t.Fatalf("claim: %v %+v", err, claimed)
+	}
+	if requested, generation, err := r.CancelState(t.Context(), job.ID); err != nil || requested || generation != claimed.ClaimGeneration {
+		t.Fatalf("cancel state before request: %v %v %d", err, requested, generation)
+	}
+	if _, err := r.RequestCancellation(t.Context(), job.ID); err != nil {
+		t.Fatalf("request cancellation: %v", err)
+	}
+	if requested, _, err := r.CancelState(t.Context(), job.ID); err != nil || !requested {
+		t.Fatalf("cancel state after request: %v %v", err, requested)
+	}
+
+	stale := r.withClaim(&models.AdminJob{ClaimGeneration: claimed.ClaimGeneration + 1})
+	if _, err := stale.CancelWithResult(t.Context(), job.ID, 2, 4, "stale", ImageCacheCleanupResult{DeletedPrefixes: 9}, time.Now().Add(time.Hour)); err == nil {
+		t.Fatal("a stale claim canceled the job")
+	}
+
+	owner := r.withClaim(claimed)
+	canceled, err := owner.CancelWithResult(t.Context(), job.ID, 2, 4, "Image cache cleanup canceled after 2/4 prefixes",
+		ImageCacheCleanupResult{LibraryID: 1, DeletedPrefixes: 2, DeletedS3Objects: 7}, time.Now().Add(time.Hour))
+	if err != nil {
+		t.Fatalf("cancel with result: %v", err)
+	}
+	if canceled.Status != StatusCancelled || canceled.ProgressCurrent != 2 || canceled.ProgressTotal != 4 {
+		t.Fatalf("status=%s progress=%d/%d, want canceled 2/4", canceled.Status, canceled.ProgressCurrent, canceled.ProgressTotal)
+	}
+	if got := imageCacheCleanupResultOf(t, canceled); got.DeletedPrefixes != 2 || got.DeletedS3Objects != 7 {
+		t.Fatalf("result %+v, want the final totals", got)
+	}
+}
diff --git a/internal/adminjob/library_refresh.go b/internal/adminjob/library_refresh.go
index b7d404b8c1..b92c0757dc 100644
--- a/internal/adminjob/library_refresh.go
+++ b/internal/adminjob/library_refresh.go
@@ -99,7 +99,10 @@ func (l *PGLibraryRefreshItemLister) ListLibraryItems(ctx context.Context, libra
 		FROM media_item_libraries mil
 		JOIN media_folders f ON f.id = mil.media_folder_id
 		JOIN media_items mi ON mi.content_id = mil.content_id
-		WHERE mil.media_folder_id = $1`
+		WHERE mil.media_folder_id = $1
+		  -- An item an admin ignored is left unmatched on purpose; refreshing
+		  -- it would only rescan its folder for nothing.
+		  AND mi.match_ignored_at IS NULL`
 	args := []any{libraryID}
 
 	if normalizeLibraryRefreshMode(mode) == LibraryRefreshModeQuick {
diff --git a/internal/adminjob/library_refresh_ignore_db_test.go b/internal/adminjob/library_refresh_ignore_db_test.go
new file mode 100644
index 0000000000..380246a338
--- /dev/null
+++ b/internal/adminjob/library_refresh_ignore_db_test.go
@@ -0,0 +1,69 @@
+package adminjob
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// TestLibraryRefreshSkipsIgnoredItemsDB covers issue #2392: a library
+// refresh leaves out an item an admin marked as intentionally unmatched, in
+// both modes, while it still lists the library's other unmatched items.
+func TestLibraryRefreshSkipsIgnoredItemsDB(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatalf("connect test database: %v", err)
+	}
+	t.Cleanup(pool.Close)
+
+	suffix := time.Now().UnixNano()
+	ignoredID := fmt.Sprintf("local-refresh-ignored-%d", suffix)
+	unmatchedID := fmt.Sprintf("local-refresh-unmatched-%d", suffix)
+	var folderID int
+	if err := pool.QueryRow(ctx, `INSERT INTO media_folders (type, name, enabled) VALUES ('movies', $1, true) RETURNING id`,
+		fmt.Sprintf("Refresh ignore %d", suffix)).Scan(&folderID); err != nil {
+		t.Fatalf("seed folder: %v", err)
+	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(ctx, `DELETE FROM media_items WHERE content_id = ANY($1)`, []string{ignoredID, unmatchedID})
+		_, _ = pool.Exec(ctx, `DELETE FROM media_folders WHERE id = $1`, folderID)
+	})
+	for _, row := range []struct {
+		id      string
+		ignored bool
+	}{{ignoredID, true}, {unmatchedID, false}} {
+		if _, err := pool.Exec(ctx, `
+			INSERT INTO media_items (content_id, type, title, status, genres, tmdb_id, match_ignored_at)
+			VALUES ($1, 'movie', 'Bonus Disc', 'unmatched', '{}'::text[], '42', CASE WHEN $2 THEN NOW() END)
+		`, row.id, row.ignored); err != nil {
+			t.Fatalf("seed item %s: %v", row.id, err)
+		}
+		if _, err := pool.Exec(ctx, `INSERT INTO media_item_libraries (content_id, media_folder_id) VALUES ($1, $2)`, row.id, folderID); err != nil {
+			t.Fatalf("link item %s: %v", row.id, err)
+		}
+	}
+
+	lister := NewPGLibraryRefreshItemLister(pool)
+	for _, mode := range []LibraryRefreshMode{LibraryRefreshModeQuick, LibraryRefreshModeFull} {
+		items, err := lister.ListLibraryItems(ctx, folderID, mode)
+		if err != nil {
+			t.Fatalf("ListLibraryItems(%s): %v", mode, err)
+		}
+		var ids []string
+		for _, item := range items {
+			ids = append(ids, item.ContentID)
+		}
+		if len(ids) != 1 || ids[0] != unmatchedID {
+			t.Fatalf("ListLibraryItems(%s) = %v, want only %s", mode, ids, unmatchedID)
+		}
+	}
+}
diff --git a/internal/adminjob/lifecycle_test.go b/internal/adminjob/lifecycle_test.go
index 6fe6bd4f26..3b60dec1ae 100644
--- a/internal/adminjob/lifecycle_test.go
+++ b/internal/adminjob/lifecycle_test.go
@@ -121,7 +121,7 @@ func TestJobClaimRecoveryAndTerminalRace(t *testing.T) {
 			if err = stale.UpdateProgress(t.Context(), queued.ID, 9, 10, "stale"); !errors.Is(err, ErrJobNotFound) {
 				t.Fatalf("stale progress %v", err)
 			}
-			if err = stale.Yield(t.Context(), queued.ID, 9, 10, "stale", nil); !errors.Is(err, ErrJobNotFound) {
+			if err = stale.Yield(t.Context(), queued.ID, 9, 10, "stale", nil, "", time.Time{}); !errors.Is(err, ErrJobNotFound) {
 				t.Fatalf("stale yield %v", err)
 			}
 			owner := r.withClaim(fresh)
diff --git a/internal/adminjob/repository.go b/internal/adminjob/repository.go
index dbadc83afa..b9963b5b6e 100644
--- a/internal/adminjob/repository.go
+++ b/internal/adminjob/repository.go
@@ -66,6 +66,11 @@ type CompleteJobInput struct {
 	ArtifactKey       string
 	ArtifactSizeBytes int64
 	ExpiresAt         time.Time
+	// CanceledMessage, when set, is recorded instead of Message if a
+	// cancellation was requested before this write. The result payload is
+	// then kept rather than cleared, so partial totals survive a cancel that
+	// races completion.
+	CanceledMessage string
 }
 
 type FailJobInput struct {
@@ -480,8 +485,8 @@ func (r *Repository) Complete(ctx context.Context, id string, input CompleteJobI
 	tag, err := r.pool.Exec(ctx, `
 		UPDATE admin_jobs
 		SET status = CASE WHEN cancel_requested THEN 'cancelled' ELSE $2 END,
-			result_payload = CASE WHEN cancel_requested THEN '{}'::jsonb ELSE $3 END,
-			message = $4,
+			result_payload = CASE WHEN cancel_requested AND $12 = '' THEN '{}'::jsonb ELSE $3 END,
+			message = CASE WHEN cancel_requested AND $12 <> '' THEN $12 ELSE $4 END,
 			error_message = '',
 			progress_current = $5,
 			progress_total = $6,
@@ -504,6 +509,7 @@ func (r *Repository) Complete(ctx context.Context, id string, input CompleteJobI
 		input.ArtifactSizeBytes,
 		input.ExpiresAt,
 		r.claim,
+		input.CanceledMessage,
 	)
 	if err != nil {
 		return fmt.Errorf("completing admin job: %w", err)
@@ -648,6 +654,42 @@ func (r *Repository) Cancel(ctx context.Context, id, message string, expiresAt t
 	return nil, ErrJobNotFound
 }
 
+// CancelWithResult ends a running job as canceled and records its final
+// progress and result in the same claim-fenced update, so a canceled job can
+// never be left without the totals it reached.
+func (r *Repository) CancelWithResult(ctx context.Context, id string, current, total int, message string, result any, expiresAt time.Time) (*models.AdminJob, error) {
+	payload, err := marshalPayload(result)
+	if err != nil {
+		return nil, fmt.Errorf("marshaling admin job result payload: %w", err)
+	}
+	return scanAdminJob(r.pool.QueryRow(ctx, `
+		UPDATE admin_jobs
+		SET status = $2,
+			message = $3,
+			error_message = '',
+			progress_current = $4,
+			progress_total = $5,
+			result_payload = $6,
+			completed_at = NOW(),
+			heartbeat_at = NOW(),
+			expires_at = GREATEST($7, NOW() + INTERVAL '24 hours'),
+			updated_at = NOW()
+		WHERE id = $1
+		  AND status = $8
+		  AND ($9::bigint IS NULL OR claim_generation = $9)
+		RETURNING `+adminJobColumns,
+		id, StatusCancelled, message, current, total, payload, expiresAt, StatusRunning, r.claim,
+	))
+}
+
+// CancelState reads only whether cancellation was requested and the current
+// claim generation, for watchers that poll a long-running job.
+func (r *Repository) CancelState(ctx context.Context, id string) (cancelRequested bool, claimGeneration int64, err error) {
+	err = r.pool.QueryRow(ctx, `SELECT cancel_requested, claim_generation FROM admin_jobs WHERE id = $1`, id).
+		Scan(&cancelRequested, &claimGeneration)
+	return cancelRequested, claimGeneration, err
+}
+
 func (r *Repository) CancelQueued(ctx context.Context, id, message string, expiresAt time.Time) (*models.AdminJob, error) {
 	if message == "" {
 		message = "Admin job cancelled"
@@ -691,23 +733,30 @@ func (r *Repository) CancelQueued(ctx context.Context, id, message string, expir
 // next claim reads both back and resumes from them. requested_at is kept: the
 // admin job list sorts and pages by it, and among queued jobs of one type the
 // oldest still finishes first.
-func (r *Repository) Yield(ctx context.Context, id string, current, total int, message string, result any) error {
+// Yield returns a running job to the queue with its progress and result.
+// When canceledMessage is set and a cancellation was requested before this
+// write, the same write ends the job as canceled with that message instead,
+// so a cancel cannot slip in between a separate check and the requeue.
+func (r *Repository) Yield(ctx context.Context, id string, current, total int, message string, result any, canceledMessage string, expiresAt time.Time) error {
 	payload, err := marshalPayload(result)
 	if err != nil {
 		return fmt.Errorf("marshaling admin job result payload: %w", err)
 	}
 	tag, err := r.pool.Exec(ctx, `
 		UPDATE admin_jobs
-		SET status = $2,
+		SET status = CASE WHEN cancel_requested AND $9 <> '' THEN $10 ELSE $2 END,
 			progress_current = $3,
 			progress_total = $4,
-			message = $5,
+			message = CASE WHEN cancel_requested AND $9 <> '' THEN $9 ELSE $5 END,
 			result_payload = $6,
-			started_at = NULL,
-			heartbeat_at = NULL,
+			started_at = CASE WHEN cancel_requested AND $9 <> '' THEN started_at ELSE NULL END,
+			completed_at = CASE WHEN cancel_requested AND $9 <> '' THEN NOW() ELSE completed_at END,
+			heartbeat_at = CASE WHEN cancel_requested AND $9 <> '' THEN NOW() ELSE NULL END,
+			expires_at = CASE WHEN cancel_requested AND $9 <> '' THEN GREATEST($11, NOW() + INTERVAL '24 hours') ELSE expires_at END,
 			updated_at = NOW()
 		WHERE id = $1 AND status = $7 AND ($8::bigint IS NULL OR claim_generation = $8)`,
 		id, StatusQueued, current, total, message, payload, StatusRunning, r.claim,
+		canceledMessage, StatusCancelled, expiresAt,
 	)
 	if err != nil {
 		return fmt.Errorf("yielding admin job: %w", err)
@@ -797,7 +846,7 @@ func (r *Repository) RequestCancellation(ctx context.Context, id string) (*model
 	job, err := scanAdminJob(r.pool.QueryRow(ctx, `UPDATE admin_jobs
  SET cancel_requested = true, updated_at = CASE WHEN cancel_requested THEN updated_at ELSE NOW() END
  WHERE id = $1 AND job_type = ANY($2) AND status IN ('queued', 'running')
-	 RETURNING `+adminJobColumns, id, []string{JobTypeLibraryRefresh, JobTypeStorageTransition}))
+	 RETURNING `+adminJobColumns, id, []string{JobTypeLibraryRefresh, JobTypeStorageTransition, JobTypeImageCacheCleanup}))
 	if err == nil {
 		return job, nil
 	}
@@ -808,7 +857,7 @@ func (r *Repository) RequestCancellation(ctx context.Context, id string) (*model
 	if err != nil {
 		return nil, err
 	}
-	if (job.JobType == JobTypeLibraryRefresh || job.JobType == JobTypeStorageTransition) && job.Status == StatusCancelled {
+	if (job.JobType == JobTypeLibraryRefresh || job.JobType == JobTypeStorageTransition || job.JobType == JobTypeImageCacheCleanup) && job.Status == StatusCancelled {
 		return job, nil
 	}
 	return nil, ErrJobNotCancellable
diff --git a/internal/adminjob/runner.go b/internal/adminjob/runner.go
index ce775706fa..6f90fccbac 100644
--- a/internal/adminjob/runner.go
+++ b/internal/adminjob/runner.go
@@ -271,6 +271,9 @@ func (r *Runner) runNext() {
 	}
 	if job.CancelRequested {
 		message := "Library metadata refresh canceled"
+		if job.JobType == JobTypeImageCacheCleanup {
+			message = QueuedImageCacheCleanupCanceledMessage(job.ProgressCurrent, job.ProgressTotal)
+		}
 		if job.JobType == JobTypeStorageTransition {
 			message = "Storage transition canceled; verified copy checkpoints retained"
 			if recorder, ok := r.storageTransition.(storageTransitionCancellationRecorder); ok {
@@ -601,6 +604,30 @@ func (r *Runner) queueImageCacheCleanup(ctx context.Context, createdByUserID int
 	return cleanupJob
 }
 
+var (
+	errImageCacheCleanupCancelRequested = errors.New("image cache cleanup cancel requested")
+	errImageCacheCleanupClaimLost       = errors.New("image cache cleanup claim lost")
+)
+
+// QueuedImageCacheCleanupCanceledMessage is the message for a cleanup canceled
+// while queued, either before its first claim or between slices.
+func QueuedImageCacheCleanupCanceledMessage(current, total int) string {
+	if total > 0 && current >= total {
+		return imageCacheCleanupCanceledMessage(current, total)
+	}
+	return "Image cache cleanup canceled; cached images not yet deleted remain in storage"
+}
+
+// imageCacheCleanupCanceledMessage describes a canceled cleanup that stopped
+// before prefix next of total. A cancel seen only after the last prefix left
+// nothing behind, so it must not say that undeleted images remain.
+func imageCacheCleanupCanceledMessage(next, total int) string {
+	if next >= total {
+		return fmt.Sprintf("Image cache cleanup canceled after %d/%d prefixes; all prefixes were already processed", total, total)
+	}
+	return fmt.Sprintf("Image cache cleanup canceled after %d/%d prefixes; cached images not yet deleted remain in storage", next, total)
+}
+
 func (r *Runner) executeImageCacheCleanup(job *models.AdminJob) {
 	if r.imageCacheCleanup == nil {
 		r.failJob(job.ID, 0, 0, "Image cache cleanup failed", "image cache cleanup executor is not configured")
@@ -634,8 +661,48 @@ func (r *Runner) executeImageCacheCleanup(job *models.AdminJob) {
 	if slice <= 0 {
 		slice = imageCacheCleanupSlice
 	}
-	ctx, cancel := context.WithTimeout(r.executionContext(), slice)
-	defer cancel()
+	sliceCtx, sliceCancel := context.WithTimeout(r.executionContext(), slice)
+	defer sliceCancel()
+	// A cancellation request or a lost claim stops the slice at once, not at
+	// its next claim: Execute checks ctx before every prefix, so no further
+	// prefix is deleted once either cause is set.
+	ctx, stop := context.WithCancelCause(sliceCtx)
+	defer stop(nil)
+	unregisterCancel := r.cancelRegistry.Register(job.ID, func() { stop(errImageCacheCleanupCancelRequested) })
+	defer unregisterCancel()
+	// pollCancel reports whether it stopped the slice.
+	pollCancel := func() bool {
+		cancelRequested, claimGeneration, err := r.repo.CancelState(ctx, job.ID)
+		switch {
+		case err != nil:
+			return false
+		case claimGeneration != job.ClaimGeneration:
+			stop(errImageCacheCleanupClaimLost)
+		case cancelRequested:
+			stop(errImageCacheCleanupCancelRequested)
+		default:
+			return false
+		}
+		return true
+	}
+	// A cancel that arrived after the claim but before Register found no
+	// callback to run, so check the flag once before deleting anything.
+	if !pollCancel() {
+		go func() {
+			ticker := time.NewTicker(r.heartbeatInterval)
+			defer ticker.Stop()
+			for {
+				select {
+				case <-ctx.Done():
+					return
+				case <-ticker.C:
+					if pollCancel() {
+						return
+					}
+				}
+			}
+		}()
+	}
 
 	heartbeatStop := make(chan struct{})
 	go r.heartbeatLoop(ctx, job.ID, heartbeatStop)
@@ -660,11 +727,43 @@ func (r *Runner) executeImageCacheCleanup(job *models.AdminJob) {
 
 	finishCtx, finishCancel := r.finalizeContext()
 	defer finishCancel()
+	cause := context.Cause(ctx)
+	if (err == nil && cause == nil) || errors.Is(cause, context.DeadlineExceeded) {
+		// A cancellation seen only after the last prefix would be recorded by
+		// Complete as canceled with an empty result, and one that arrived
+		// after the slice deadline would be requeued until the next claim.
+		// End the job here with its totals instead.
+		if cancelRequested, _, getErr := r.repo.CancelState(finishCtx, job.ID); getErr == nil && cancelRequested {
+			cause = errImageCacheCleanupCancelRequested
+		}
+	}
 	switch {
+	case errors.Is(cause, errImageCacheCleanupClaimLost):
+		slog.Warn("admin jobs: image cache cleanup claim lost; leaving the job to its new owner", "job_id", job.ID)
+	case errors.Is(cause, errImageCacheCleanupCancelRequested):
+		message := imageCacheCleanupCanceledMessage(next, total)
+		// One claim-fenced write records the totals and the canceled status
+		// together. If it fails the job stays running; stale recovery then
+		// reclaims it and the claim-time cancel ends it with the last
+		// checkpointed totals.
+		canceled, err := r.repo.CancelWithResult(finishCtx, job.ID, next, total, message, result, time.Now().UTC().Add(r.retention))
+		if err != nil {
+			slog.Warn("admin jobs: failed to record image cache cleanup cancellation", "job_id", job.ID, "error", err)
+			return
+		}
+		if r.observation != nil {
+			r.observation.Finish(canceled.Status)
+		}
+		if r.realtimeHub != nil {
+			if err := r.realtimeHub.PublishJob(finishCtx, notifications.TypeJobCancelled, canceled); err != nil {
+				slog.Warn("admin jobs: failed to publish job cancellation", "job_id", job.ID, "error", err)
+			}
+		}
 	case err == nil:
 		if err := r.repo.Complete(finishCtx, job.ID, CompleteJobInput{
 			ResultPayload:   result,
 			Message:         "Cached image cleanup completed",
+			CanceledMessage: imageCacheCleanupCanceledMessage(total, total),
 			ProgressCurrent: total,
 			ProgressTotal:   total,
 			ExpiresAt:       time.Now().UTC().Add(r.retention),
@@ -687,7 +786,10 @@ func (r *Runner) executeImageCacheCleanup(job *models.AdminJob) {
 				"prefix_index", next, "stalled_claims", result.StalledClaims)
 		}
 		message := fmt.Sprintf("Cleaning cached images %d/%d", next, total)
-		if err := r.repo.Yield(finishCtx, job.ID, next, total, message, result); err != nil {
+		// A cancel that commits after the check above still ends the job here:
+		// Yield cancels a flagged row in the same write instead of requeueing it.
+		if err := r.repo.Yield(finishCtx, job.ID, next, total, message, result,
+			imageCacheCleanupCanceledMessage(next, total), time.Now().UTC().Add(r.retention)); err != nil {
 			slog.Warn("admin jobs: failed to yield image cache cleanup", "job_id", job.ID, "error", err)
 			return
 		}
diff --git a/internal/ai/jobrunner/runner.go b/internal/ai/jobrunner/runner.go
index 7a8aef1d73..12a118a741 100644
--- a/internal/ai/jobrunner/runner.go
+++ b/internal/ai/jobrunner/runner.go
@@ -169,12 +169,18 @@ func (r *Runner) Dispatch(id int64, run func(ctx context.Context), onAbort func(
 			}
 			return
 		}
-		defer func() { <-r.sem }()
+		jobSlot := &slot{sem: r.sem, held: true}
+		defer func() {
+			if jobSlot.held {
+				<-r.sem
+			}
+		}()
+		jobCtx := context.WithValue(runCtx, slotKey{}, jobSlot)
 
 		// A terminal signal or local cancellation can race semaphore admission.
-		if runCtx.Err() != nil {
+		if jobCtx.Err() != nil {
 			if onAbort != nil {
-				onAbort(context.WithoutCancel(runCtx))
+				onAbort(context.WithoutCancel(jobCtx))
 			}
 			return
 		}
@@ -185,12 +191,44 @@ func (r *Runner) Dispatch(id int64, run func(ctx context.Context), onAbort func(
 		case "metadata translation":
 			workload = "metadata"
 		}
-		runCtx, observation := workmetrics.Start(runCtx, workload, queuedAt)
+		jobCtx, observation := workmetrics.Start(jobCtx, workload, queuedAt)
 		defer observation.Finish("unknown")
-		workmetrics.Do(runCtx, run)
+		workmetrics.Do(jobCtx, run)
 	}()
 }
 
+type slotKey struct{}
+
+// slot is the semaphore slot a dispatched job holds; only that job's
+// goroutine touches it.
+type slot struct {
+	sem  chan struct{}
+	held bool
+}
+
+// Yield gives up the semaphore slot of the job running in ctx and queues for
+// it again, so jobs waiting on the shared bound can start between the units of
+// a long job. Waiting senders are admitted in order, so a job that was queued
+// runs before the yielding job gets its slot back. It returns ctx's error when
+// ctx ends first; the job must then stop. Outside a dispatched job it only
+// reports ctx's error.
+func Yield(ctx context.Context) error {
+	s, _ := ctx.Value(slotKey{}).(*slot)
+	if s == nil || !s.held {
+		return ctx.Err()
+	}
+	<-s.sem
+	s.held = false
+	select {
+	case s.sem <- struct{}{}:
+		s.held = true
+		// Both cases may be ready; a canceled job must still stop.
+		return ctx.Err()
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+}
+
 // Cancel cancels the in-flight goroutine for id, returning false when none is
 // registered (job on another node, or never dispatched) so the caller can
 // fall back to a best-effort terminal transition in the database.
diff --git a/internal/ai/jobrunner/runner_test.go b/internal/ai/jobrunner/runner_test.go
index 7a6f938d26..b0335b8aca 100644
--- a/internal/ai/jobrunner/runner_test.go
+++ b/internal/ai/jobrunner/runner_test.go
@@ -5,6 +5,7 @@ import (
 	"sync"
 	"sync/atomic"
 	"testing"
+	"testing/synctest"
 	"time"
 )
 
@@ -156,3 +157,56 @@ func TestCancelRunningJobCancelsContext(t *testing.T) {
 		t.Fatal("running job did not observe cancellation")
 	}
 }
+
+// A job canceled while it waits to get its yielded slot back must not release
+// a slot it no longer holds, which would take the queued job's slot.
+func TestYieldCanceledWhileWaitingKeepsOtherSlot(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		ctx, stop := context.WithCancel(context.Background())
+		defer stop()
+		sem := NewSemaphore(1)
+		r := New(ctx, sem, &fakeStore{}, "test", nil)
+
+		queued := make(chan struct{})
+		yieldErr := make(chan error, 1)
+		r.Dispatch(1, func(ctx context.Context) {
+			<-queued
+			yieldErr <- Yield(ctx)
+		}, nil)
+		synctest.Wait() // the job holds the slot
+
+		admitted := make(chan struct{})
+		go func() {
+			sem <- struct{}{}
+			close(admitted)
+		}()
+		synctest.Wait() // the job holds the slot; the other job waits for it
+		close(queued)
+		synctest.Wait()
+		select {
+		case <-admitted:
+		default:
+			t.Fatal("the queued job did not get the yielded slot")
+		}
+
+		r.Cancel(1)
+		if err := <-yieldErr; err == nil {
+			t.Fatal("Yield returned nil after the job was canceled")
+		}
+		r.wg.Wait()
+		if got := len(sem); got != 1 {
+			t.Fatalf("semaphore holds %d slots, want only the queued job's", got)
+		}
+	})
+}
+
+func TestYieldOutsideJobOnlyReportsContext(t *testing.T) {
+	if err := Yield(context.Background()); err != nil {
+		t.Fatalf("Yield = %v, want nil outside a job", err)
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	if err := Yield(ctx); err == nil {
+		t.Fatal("Yield ignored a canceled context")
+	}
+}
diff --git a/internal/api/handlers/access_filter.go b/internal/api/handlers/access_filter.go
index 6943647231..370b957d50 100644
--- a/internal/api/handlers/access_filter.go
+++ b/internal/api/handlers/access_filter.go
@@ -42,3 +42,17 @@ func accessFilterFromScope(scope access.Scope, userID int, profileID, deviceID s
 		DeviceID:           deviceID,
 	}
 }
+
+// withProfileMetadataLanguage fills the profile's metadata language
+// preferences into a filter built without them (accessFilterFromScope leaves
+// them out), so localization resolves the viewer's language.
+func withProfileMetadataLanguage(ctx context.Context, filter catalog.AccessFilter) catalog.AccessFilter {
+	if filter.ProfilePreferredLanguage != "" || len(filter.MetadataLanguageOverrides) > 0 {
+		return filter
+	}
+	if scope, ok := access.GetScope(ctx); ok {
+		filter.ProfilePreferredLanguage = scope.PreferredMetadataLanguage
+		filter.MetadataLanguageOverrides = scope.MetadataLanguageOverrides
+	}
+	return filter
+}
diff --git a/internal/api/handlers/access_groups.go b/internal/api/handlers/access_groups.go
index 4ec0debfb6..34790a23ab 100644
--- a/internal/api/handlers/access_groups.go
+++ b/internal/api/handlers/access_groups.go
@@ -26,6 +26,9 @@ type AccessGroupStore interface {
 
 type AccessGroupHandler struct {
 	store AccessGroupStore
+	// RecWorker is told when a group's libraries change or the group is
+	// deleted, so its members' recommendations are rebuilt. Optional.
+	RecWorker AccountsScopeNotifier
 }
 
 func NewAccessGroupHandler(store AccessGroupStore) *AccessGroupHandler {
@@ -202,11 +205,15 @@ func (h *AccessGroupHandler) HandleUpdate(w http.ResponseWriter, r *http.Request
 	if !ok {
 		return
 	}
+	librariesChange := h.groupLibrariesChange(input)
 	group, err := h.store.Update(r.Context(), id, input)
 	if err != nil {
 		writeAccessGroupError(w, err, "Failed to update access group")
 		return
 	}
+	if librariesChange {
+		notifyAccountsScopeChanged(r.Context(), h.RecWorker, h.groupMembers(r.Context(), id)...)
+	}
 	writeJSON(w, http.StatusOK, toAccessGroupResponse(*group))
 }
 
@@ -222,10 +229,12 @@ func (h *AccessGroupHandler) HandleDelete(w http.ResponseWriter, r *http.Request
 	if !ok {
 		return
 	}
+	members := h.groupMembers(r.Context(), id)
 	if err := h.store.Delete(r.Context(), id); err != nil {
 		writeAccessGroupError(w, err, "Failed to delete access group")
 		return
 	}
+	notifyAccountsScopeChanged(r.Context(), h.RecWorker, members...)
 	w.WriteHeader(http.StatusNoContent)
 }
 
diff --git a/internal/api/handlers/admin.go b/internal/api/handlers/admin.go
index 7444eeabfe..2211ef719a 100644
--- a/internal/api/handlers/admin.go
+++ b/internal/api/handlers/admin.go
@@ -179,6 +179,9 @@ type AdminHandler struct {
 	WatchlistTitlesSweeper interface {
 		SweepOrphanTitles(ctx context.Context) error
 	}
+	// RecWorker is told when an account update changes its profiles' access
+	// scope, so their recommendations are rebuilt. Optional.
+	RecWorker AccountsScopeNotifier
 	// logLevelCounts caches the 24h error/warning tallies served on
 	// /admin/server/status. The dashboard polls that route every 15s, and the
 	// counts are only ever read as a rough signal, so re-counting per request
@@ -307,7 +310,7 @@ type updateUserRequest struct {
 	MaxTranscodes            optionalField[int]     `json:"max_transcodes,omitempty"`
 	TranscodeAllowed         optionalField[bool]    `json:"transcode_allowed,omitempty"`
 	AudioTranscodeAllowed    optionalField[bool]    `json:"audio_transcode_allowed,omitempty"`
-	MaxProfiles              *int                   `json:"max_profiles,omitempty"`
+	MaxProfiles              optionalField[int]     `json:"max_profiles,omitempty"`
 	DownloadAllowed          optionalField[bool]    `json:"download_allowed,omitempty"`
 	DownloadTranscodeAllowed optionalField[bool]    `json:"download_transcode_allowed,omitempty"`
 	RequestsAllowed          optionalField[bool]    `json:"requests_allowed,omitempty"`
@@ -332,7 +335,9 @@ func (r *updateUserRequest) libraryIDsOptional() models.Optional[[]int] {
 // The policy fields carry the account's stored overrides: null means the
 // field is inherited from the access group. EffectivePolicy is the resolved
 // value the server enforces (override when set, otherwise the group's value,
-// otherwise the permissive no-group default).
+// otherwise the permissive no-group default). MaxProfiles is the exception:
+// the frozen v1 body has no inherit state for it, so it carries the limit that
+// applies, and the v2-only MaxProfilesOverride carries the stored override.
 type AdminUserView struct {
 	ID                         int                 `json:"id"`
 	Username                   string              `json:"username"`
@@ -349,6 +354,7 @@ type AdminUserView struct {
 	TranscodeAllowed           *bool               `json:"transcode_allowed"`
 	AudioTranscodeAllowed      *bool               `json:"audio_transcode_allowed"`
 	MaxProfiles                int                 `json:"max_profiles"`
+	MaxProfilesOverride        *int                `json:"-"`
 	DownloadAllowed            *bool               `json:"download_allowed"`
 	DownloadTranscodeAllowed   *bool               `json:"download_transcode_allowed"`
 	RequestsAllowed            *bool               `json:"requests_allowed"`
@@ -375,6 +381,7 @@ type EffectivePolicyView struct {
 	MaxTranscodes              int      `json:"max_transcodes"`
 	MaxRemoteStreamBitrateKbps int      `json:"-"`
 	MaxLocalStreamBitrateKbps  int      `json:"-"`
+	MaxProfiles                int      `json:"-"`
 	TranscodeAllowed           bool     `json:"transcode_allowed"`
 	AudioTranscodeAllowed      bool     `json:"audio_transcode_allowed"`
 	DownloadAllowed            bool     `json:"download_allowed"`
@@ -436,7 +443,8 @@ func toAdminUserResponse(u *models.User, group *access.GroupPolicy) AdminUserVie
 		MaxLocalStreamBitrateKbps:  clonePtr(u.MaxLocalStreamBitrateKbps),
 		TranscodeAllowed:           clonePtr(u.TranscodeAllowed),
 		AudioTranscodeAllowed:      clonePtr(u.AudioTranscodeAllowed),
-		MaxProfiles:                u.MaxProfiles,
+		MaxProfiles:                effective.MaxProfiles,
+		MaxProfilesOverride:        clonePtr(u.MaxProfiles),
 		DownloadAllowed:            clonePtr(u.DownloadAllowed),
 		DownloadTranscodeAllowed:   clonePtr(u.DownloadTranscodeAllowed),
 		RequestsAllowed:            clonePtr(u.RequestsAllowed),
@@ -452,6 +460,7 @@ func toAdminUserResponse(u *models.User, group *access.GroupPolicy) AdminUserVie
 			MaxTranscodes:              effective.MaxTranscodes,
 			MaxRemoteStreamBitrateKbps: effective.MaxRemoteStreamBitrateKbps,
 			MaxLocalStreamBitrateKbps:  effective.MaxLocalStreamBitrateKbps,
+			MaxProfiles:                effective.MaxProfiles,
 			TranscodeAllowed:           effective.TranscodeAllowed,
 			AudioTranscodeAllowed:      effective.AudioTranscodeAllowed,
 			DownloadAllowed:            effective.DownloadAllowed,
@@ -538,9 +547,9 @@ func checkScopedAPIKeyUpdate(ctx context.Context, target *models.User, input mod
 
 // rejectScopedAPIKeyUpdate applies the shared policy before v1 validation.
 //
-// It returns the target account when it had to load one, so the caller can
-// reuse it as the pre-update snapshot instead of reading the row twice, and
-// reports whether it wrote a response.
+// It returns the target account when it had to load one, so rejectGroupedAdmin
+// can reuse it instead of reading the row twice, and reports whether it wrote
+// a response.
 func (h *AdminHandler) rejectScopedAPIKeyUpdate(
 	w http.ResponseWriter,
 	r *http.Request,
@@ -581,17 +590,18 @@ func (h *AdminHandler) loadTargetUser(w http.ResponseWriter, r *http.Request, id
 // an access group: a group named in the request together with the admin role,
 // or for an account that already holds it. Writes that only change the role
 // are not its concern — the repository clears the group on promote and falls
-// back to the default group on demote. It loads the target when the role is
-// not in the request and returns it for reuse as the pre-update snapshot.
+// back to the default group on demote. It loads the target when neither the
+// request nor current carries the role, and reports whether it wrote a
+// response.
 func (h *AdminHandler) rejectGroupedAdmin(
 	w http.ResponseWriter,
 	r *http.Request,
 	id int,
 	req *updateUserRequest,
 	current *models.User,
-) (*models.User, bool) {
+) bool {
 	if !req.AccessGroupID.Set || req.AccessGroupID.Value == nil {
-		return current, false
+		return false
 	}
 	var role string
 	switch {
@@ -600,18 +610,18 @@ func (h *AdminHandler) rejectGroupedAdmin(
 	case current != nil:
 		role = current.Role
 	default:
-		var blocked bool
-		if current, blocked = h.loadTargetUser(w, r, id); blocked {
-			return nil, true
+		target, blocked := h.loadTargetUser(w, r, id)
+		if blocked {
+			return true
 		}
-		role = current.Role
+		role = target.Role
 	}
 	if role == roleAdmin {
 		writeError(w, http.StatusUnprocessableEntity, "unprocessable_entity",
 			"Admin accounts cannot belong to an access group")
-		return current, true
+		return true
 	}
-	return current, false
+	return false
 }
 
 // clonePtr copies a policy override pointer so a response never aliases the
@@ -964,7 +974,7 @@ func (h *AdminHandler) HandleUpdateUser(w http.ResponseWriter, r *http.Request)
 		}
 		maxPlaybackQuality.Value = &normalized
 	}
-	if req.MaxProfiles != nil && *req.MaxProfiles < 1 {
+	if req.MaxProfiles.Value != nil && *req.MaxProfiles.Value < 1 {
 		writeError(w, http.StatusBadRequest, "bad_request", "max_profiles must be at least 1")
 		return
 	}
@@ -977,8 +987,7 @@ func (h *AdminHandler) HandleUpdateUser(w http.ResponseWriter, r *http.Request)
 			writeError(w, http.StatusUnprocessableEntity, "unprocessable_entity", "Invalid access_group_id")
 			return
 		}
-		currentUser, blocked = h.rejectGroupedAdmin(w, r, id, &req, currentUser)
-		if blocked {
+		if h.rejectGroupedAdmin(w, r, id, &req, currentUser) {
 			return
 		}
 		if req.AccessGroupID.Value != nil {
@@ -1019,7 +1028,7 @@ func (h *AdminHandler) HandleUpdateUser(w http.ResponseWriter, r *http.Request)
 		MaxTranscodes:            req.MaxTranscodes.Optional(),
 		TranscodeAllowed:         req.TranscodeAllowed.Optional(),
 		AudioTranscodeAllowed:    req.AudioTranscodeAllowed.Optional(),
-		MaxProfiles:              req.MaxProfiles,
+		MaxProfiles:              req.MaxProfiles.Optional(),
 		DownloadAllowed:          req.DownloadAllowed.Optional(),
 		DownloadTranscodeAllowed: req.DownloadTranscodeAllowed.Optional(),
 		RequestsAllowed:          req.RequestsAllowed.Optional(),
@@ -1042,6 +1051,9 @@ func (h *AdminHandler) HandleUpdateUser(w http.ResponseWriter, r *http.Request)
 	}
 	revoked := false
 	_, err = repo.MutateAdminAccount(r.Context(), id, -1, &updateInput, func(current *models.User, tx pgx.Tx) (bool, error) {
+		if err := h.keepInheritedProfileLimit(r.Context(), tx, current, &updateInput); err != nil {
+			return false, err
+		}
 		if err := auth.CheckOwnerUpdate(actor, current, updateInput); err != nil {
 			return false, ownerError(err)
 		}
@@ -1076,6 +1088,9 @@ func (h *AdminHandler) HandleUpdateUser(w http.ResponseWriter, r *http.Request)
 	if revoked && h.OnUserSessionsRevoked != nil {
 		h.OnUserSessionsRevoked(r.Context(), id)
 	}
+	if accountScopeChanged(updateInput) {
+		notifyAccountsScopeChanged(r.Context(), h.RecWorker, id)
+	}
 
 	user, err := h.userRepo.GetByID(r.Context(), id)
 	if err != nil {
@@ -1091,6 +1106,51 @@ func (h *AdminHandler) HandleUpdateUser(w http.ResponseWriter, r *http.Request)
 	writeJSON(w, http.StatusOK, toAdminUserResponse(user, updatedGroupPolicy))
 }
 
+// keepInheritedProfileLimit drops a v1 max_profiles equal to the limit that
+// applies to an account that inherits it. The frozen v1 body reports that
+// limit rather than an inherit state, so a client that sends back what it read
+// would otherwise pin the inherited limit as an override and, for an admin
+// editing its own account, be refused for changing its access policy. The
+// reported limit belongs to the role and group the account had when the
+// client read it, so a request that moves either in the same call is sending
+// an explicit override for the new context, not an echo. The group is read
+// through tx, the transaction that updates the account: a pool read here
+// would take a second connection while that transaction holds its own. A nil
+// tx (test fakes) falls back to the pool.
+func (h *AdminHandler) keepInheritedProfileLimit(ctx context.Context, tx pgx.Tx, current *models.User, input *models.UpdateUserInput) error {
+	if !input.MaxProfiles.Set || input.MaxProfiles.Value == nil || current.MaxProfiles != nil {
+		return nil
+	}
+	if profileLimitContextChanges(current, input) {
+		return nil
+	}
+	var group *access.GroupPolicy
+	var err error
+	if tx != nil {
+		group, err = access.GroupPolicyInTransaction(ctx, tx, current.ID)
+	} else {
+		group, err = h.groupPolicyFor(ctx, current)
+	}
+	if err != nil {
+		return err
+	}
+	if *input.MaxProfiles.Value == access.ApplyGroupPolicy(current, group).MaxProfiles {
+		input.MaxProfiles = models.Optional[int]{}
+	}
+	return nil
+}
+
+func profileLimitContextChanges(current *models.User, input *models.UpdateUserInput) bool {
+	if input.Role != nil && *input.Role != current.Role {
+		return true
+	}
+	if !input.AccessGroupID.Set {
+		return false
+	}
+	next, now := input.AccessGroupID.Value, current.AccessGroupID
+	return (next == nil) != (now == nil) || (next != nil && now != nil && *next != *now)
+}
+
 // HandleDeleteUser handles DELETE /admin/users/{id}.
 func (h *AdminHandler) HandleDeleteUser(w http.ResponseWriter, r *http.Request) {
 	idStr := chi.URLParam(r, "id")
@@ -2358,7 +2418,6 @@ var adminSettingDependencyGroups = [][]string{
 	{"s3.private_access_key", "s3.private_secret_key"},
 	{"s3.public_url_auth", "s3.public_read_endpoint", "s3.public_token_secret"},
 	{"email.enabled", "email.smtp_host", "email.from_address"},
-	{"watchsync.trakt.client_id", "watchsync.trakt.client_secret"},
 	{"watchsync.simkl.client_id", "watchsync.simkl.client_secret"},
 	{"ratelimit.backend", "redis.url"},
 	{"download.max_per_period", "download.period_duration"},
@@ -2521,28 +2580,6 @@ func (h *AdminHandler) environmentRefusesSave(key, value string) bool {
 	return key != config.RedisDBSettingKey || strings.TrimSpace(value) != ""
 }
 
-// ensureRedisReachableBeforeSave rejects persisting a non-empty redis.url that
-// cannot be pinged (Prairie: an unreachable URL used to restart-loop the server
-// under Docker). Clearing Redis (empty URL) is always allowed. Env-managed
-// Redis is never written through these endpoints.
-func (h *AdminHandler) ensureRedisReachableBeforeSave(ctx context.Context, changed map[string]string) error {
-	raw, ok := changed["redis.url"]
-	if !ok {
-		return nil
-	}
-	normalized, err := config.NormalizeRedisURL(raw)
-	if err != nil {
-		return err
-	}
-	if normalized == "" {
-		return nil
-	}
-	if err := probeRedisConfig(ctx, config.RedisConfig{URL: normalized}); err != nil {
-		return fmt.Errorf("redis.url is unreachable; fix the URL or leave Redis disabled: %w", err)
-	}
-	return nil
-}
-
 func shouldPersistAdminSetting(stored map[string]string, key, normalized string, effectiveChanged bool) bool {
 	current, exists := stored[key]
 	if exists {
@@ -2642,9 +2679,9 @@ func (h *AdminHandler) UpdateAdminSettings(ctx context.Context, values map[strin
 		}
 		normalized[key] = value
 	}
-
-	if err := h.ensureRedisReachableBeforeSave(ctx, normalized); err != nil {
-		return AdminSettingsUpdateResult{}, &APIError{Status: http.StatusBadRequest, Code: "invalid_settings", Message: err.Error()}
+	checkedRedis, err := h.checkRedisSave(ctx, normalized)
+	if err != nil {
+		return AdminSettingsUpdateResult{}, err
 	}
 
 	modelValidation, err := h.prepareAIModelValidation(ctx, normalized)
@@ -2669,17 +2706,10 @@ func (h *AdminHandler) UpdateAdminSettings(ctx context.Context, values map[strin
 				}
 			}
 
-			prospective := maps.Clone(stored)
-			for key, value := range normalized {
-				prospective[key] = value
-			}
-			rows := normalized
-			if value, ok := normalized[config.RedisDBSettingKey]; ok {
-				// The same batch can replace redis.url, so the row is decided
-				// against the URL the batch leaves in place.
-				rows = maps.Clone(normalized)
-				rows[config.RedisDBSettingKey] = redisDBRow(h.activeAdminSettings(prospective), value)
-				prospective[config.RedisDBSettingKey] = rows[config.RedisDBSettingKey]
+			prospective, rows := h.prospectiveSettings(stored, normalized)
+			if err := h.confirmRedisSave(stored, prospective, checkedRedis); err != nil {
+				preconditionErr = err
+				return nil, err
 			}
 			if modelValidation != nil {
 				if err := modelValidation.Check(stored, prospective); err != nil {
@@ -2706,7 +2736,7 @@ func (h *AdminHandler) UpdateAdminSettings(ctx context.Context, values map[strin
 			validationSnapshot := adminSettingsValidationSnapshot(activeProspective, normalized)
 			if err := validateProspectiveAdminSettings(validationSnapshot, h.RedisBootstrapAvailable); err != nil {
 				validationErr = err
-				validationCode = "invalid_settings"
+				validationCode = adminInvalidSettingsCode
 				return nil, err
 			}
 			writes := make(map[string]string, len(normalized))
@@ -3036,9 +3066,10 @@ func (h *AdminHandler) UpdateAdminSetting(ctx context.Context, key, value string
 		}
 		req.Value = strconv.FormatBool(enabled)
 	}
-
-	if err := h.ensureRedisReachableBeforeSave(ctx, map[string]string{key: req.Value}); err != nil {
-		return AdminSettingUpdateResult{}, &APIError{Status: http.StatusBadRequest, Code: "invalid_settings", Message: err.Error()}
+	change := map[string]string{key: req.Value}
+	checkedRedis, err := h.checkRedisSave(ctx, change)
+	if err != nil {
+		return AdminSettingUpdateResult{}, err
 	}
 
 	modelValidation, err := h.prepareAIModelValidation(ctx, map[string]string{key: req.Value})
@@ -3062,12 +3093,12 @@ func (h *AdminHandler) UpdateAdminSetting(ctx context.Context, key, value string
 				}
 			}
 
-			prospective := maps.Clone(stored)
-			row := req.Value
-			if key == config.RedisDBSettingKey {
-				row = redisDBRow(h.activeAdminSettings(stored), req.Value)
+			prospective, rows := h.prospectiveSettings(stored, change)
+			row := rows[key]
+			if err := h.confirmRedisSave(stored, prospective, checkedRedis); err != nil {
+				preconditionErr = err
+				return nil, err
 			}
-			prospective[key] = row
 			if modelValidation != nil {
 				if err := modelValidation.Check(stored, prospective); err != nil {
 					validationErr, validationCode = err, adminInvalidSettingsCode
@@ -3085,7 +3116,7 @@ func (h *AdminHandler) UpdateAdminSetting(ctx context.Context, key, value string
 				validationSnapshot := adminSettingsValidationSnapshot(h.activeAdminSettings(prospective), changed)
 				if err := validateProspectiveAdminSettings(validationSnapshot, h.RedisBootstrapAvailable); err != nil {
 					validationErr = err
-					validationCode = "invalid_settings"
+					validationCode = adminInvalidSettingsCode
 					return nil, err
 				}
 			}
@@ -3100,7 +3131,7 @@ func (h *AdminHandler) UpdateAdminSetting(ctx context.Context, key, value string
 					h.RedisBootstrapAvailable,
 				); err != nil {
 					validationErr = err
-					validationCode = "invalid_settings"
+					validationCode = adminInvalidSettingsCode
 					return nil, err
 				}
 			}
@@ -3110,7 +3141,7 @@ func (h *AdminHandler) UpdateAdminSetting(ctx context.Context, key, value string
 			if key == artworkStorageBackendKey || key == s3PublicBucketKey || key == s3OperationalBucketKey {
 				if err := config.ValidateArtworkStorageSettings(h.effectiveAdminSettings(prospective)); err != nil {
 					validationErr = err
-					validationCode = "invalid_settings"
+					validationCode = adminInvalidSettingsCode
 					return nil, err
 				}
 			}
diff --git a/internal/api/handlers/admin_access_group_service.go b/internal/api/handlers/admin_access_group_service.go
index 4b0db08786..68629bf718 100644
--- a/internal/api/handlers/admin_access_group_service.go
+++ b/internal/api/handlers/admin_access_group_service.go
@@ -3,7 +3,9 @@ package handlers
 import (
 	"context"
 	"errors"
+	"log/slog"
 	"strings"
+	"time"
 
 	"github.com/prairie-server/prairie-server/internal/access"
 	"github.com/prairie-server/prairie-server/internal/auth"
@@ -42,6 +44,9 @@ func (h *AccessGroupHandler) CreateAdminAccessGroup(ctx context.Context, in acce
 		return nil, ErrAccessGroupUnavailable
 	}
 	update := access.UpdateGroupInput{Name: &in.Name, LibraryIDs: &in.LibraryIDs, MaxPlaybackQuality: &in.MaxPlaybackQuality, MaxStreams: &in.MaxStreams, MaxTranscodes: &in.MaxTranscodes, MaxRemoteStreamBitrateKbps: &in.MaxRemoteStreamBitrateKbps, MaxLocalStreamBitrateKbps: &in.MaxLocalStreamBitrateKbps, AllowedPermissions: &in.AllowedPermissions}
+	if in.MaxProfiles != 0 {
+		update.MaxProfiles = &in.MaxProfiles
+	}
 	if err := normalizeAdminGroupInput(&update); err != nil {
 		return nil, err
 	}
@@ -58,7 +63,15 @@ func (h *AccessGroupHandler) UpdateAdminAccessGroup(ctx context.Context, id int6
 	if err := normalizeAdminGroupInput(&in); err != nil {
 		return nil, err
 	}
-	return s.UpdateConditional(ctx, id, in, guard)
+	librariesChange := h.groupLibrariesChange(in)
+	group, err := s.UpdateConditional(ctx, id, in, guard)
+	if err != nil {
+		return nil, err
+	}
+	if librariesChange {
+		notifyAccountsScopeChanged(ctx, h.RecWorker, h.groupMembers(ctx, id)...)
+	}
+	return group, nil
 }
 
 // DeleteAdminAccessGroup deletes a group. Its members move into the default
@@ -70,12 +83,54 @@ func (h *AccessGroupHandler) DeleteAdminAccessGroup(ctx context.Context, id int6
 	if !ok {
 		return ErrAccessGroupUnavailable
 	}
-	mover, ok := h.store.(memberMovingGroupStore)
-	if !ok {
-		return s.DeleteConditional(ctx, id, guard)
+	// The members are listed first: the delete moves them out of the group.
+	members := h.groupMembers(ctx, id)
+	var err error
+	if mover, ok := h.store.(memberMovingGroupStore); ok {
+		// Set-based, so the group-writer lock is not held for per-member statements.
+		err = mover.DeleteMovingMembers(ctx, id, guard)
+	} else {
+		err = s.DeleteConditional(ctx, id, guard)
 	}
-	// Set-based, so the group-writer lock is not held for per-member statements.
-	return mover.DeleteMovingMembers(ctx, id, guard)
+	if err != nil {
+		return err
+	}
+	notifyAccountsScopeChanged(ctx, h.RecWorker, members...)
+	return nil
+}
+
+// accessGroupMemberLister lists the accounts in an access group.
+// *access.GroupStore implements it.
+type accessGroupMemberLister interface {
+	MemberIDs(ctx context.Context, id int64) ([]int, error)
+}
+
+// groupMembers lists group id's member accounts for a recommendations
+// rebuild; without a worker, or when the list fails, it is empty.
+func (h *AccessGroupHandler) groupMembers(ctx context.Context, id int64) []int {
+	lister, ok := h.store.(accessGroupMemberLister)
+	if h.RecWorker == nil || !ok {
+		return nil
+	}
+	// The update has committed: the request ending must not leave its
+	// members' rows built under the old scope.
+	ctx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
+	defer cancel()
+	members, err := lister.MemberIDs(ctx, id)
+	if err != nil {
+		slog.WarnContext(ctx, "listing access group members for a recommendations rebuild failed", "component", "api", "access_group_id", id, "error", err)
+		return nil
+	}
+	return members
+}
+
+// groupLibrariesChange reports whether in may change group id's libraries:
+// whenever it sets them. Comparing with the stored group would read it
+// outside the update's writer lock, where an overlapping update can change it
+// back and forth unnoticed; a save that keeps the same libraries only costs
+// its members a rebuild.
+func (h *AccessGroupHandler) groupLibrariesChange(in access.UpdateGroupInput) bool {
+	return in.LibraryIDs != nil && h.RecWorker != nil
 }
 func normalizeAdminGroupInput(in *access.UpdateGroupInput) error {
 	if in.Name != nil {
@@ -95,6 +150,9 @@ func normalizeAdminGroupInput(in *access.UpdateGroupInput) error {
 	if in.MaxStreams != nil && *in.MaxStreams < 0 || in.MaxTranscodes != nil && *in.MaxTranscodes < 0 || in.MaxRemoteStreamBitrateKbps != nil && *in.MaxRemoteStreamBitrateKbps < 0 || in.MaxLocalStreamBitrateKbps != nil && *in.MaxLocalStreamBitrateKbps < 0 {
 		return ErrInvalidAccessGroup
 	}
+	if in.MaxProfiles != nil && *in.MaxProfiles < 1 {
+		return ErrInvalidAccessGroup
+	}
 	if in.MaxPlaybackQuality != nil {
 		quality, ok := access.ParsePlaybackQualityPreset(*in.MaxPlaybackQuality)
 		if !ok {
diff --git a/internal/api/handlers/admin_collections_service.go b/internal/api/handlers/admin_collections_service.go
index 2f1e06ae63..85b71aae05 100644
--- a/internal/api/handlers/admin_collections_service.go
+++ b/internal/api/handlers/admin_collections_service.go
@@ -17,8 +17,8 @@ import (
 
 const (
 	adminCollectionBackdrop = "backdrop"
-	adminCollectionTrakt    = "trakt"
 	adminCollectionVisible  = "visible"
+	adminCollectionHidden   = "hidden"
 )
 
 type AdminCollection = libraryCollectionResponse
@@ -30,7 +30,6 @@ type AdminCollectionPreviewRequest = previewCollectionRequest
 type AdminCollectionImportMDBList = importMDBListRequest
 type AdminCollectionImportTMDB = importTMDBRequest
 type AdminCollectionImportTMDBList = importTMDBListRequest
-type AdminCollectionImportTrakt = importTraktRequest
 type AdminCollectionImportResult = importCollectionResponse
 type AdminCollectionTemplateApply = applyTemplateBundleRequest
 type AdminCollectionTemplateResult = applyTemplateBundleResponse
@@ -110,8 +109,8 @@ func (h *LibraryCollectionHandler) ListAdminCollections(ctx context.Context, lib
 
 func (h *LibraryCollectionHandler) createAdminCollection(ctx context.Context, req AdminCollectionCreate, artwork adminCollectionArtwork) (AdminCollection, error) {
 	var none AdminCollection
-	if req.CollectionType == adminCollectionTrakt || isTraktCollectionSourceConfig(req.SourceConfig) {
-		return none, apiError(http.StatusBadRequest, "unsupported_source", "new Trakt collections are not supported")
+	if err := validateCollectionVisibility(req.Visibility); err != nil {
+		return none, err
 	}
 	if !hasLibrarySelection(req.LibraryID, req.LibraryIDs) || strings.TrimSpace(req.Title) == "" {
 		return none, apiError(http.StatusBadRequest, "bad_request", "library_id/library_ids and title are required")
@@ -208,6 +207,11 @@ func (h *LibraryCollectionHandler) CreateAdminCollection(ctx context.Context, re
 
 func (h *LibraryCollectionHandler) updateAdminCollection(ctx context.Context, collectionID string, req AdminCollectionUpdate, artwork adminCollectionArtwork) (AdminCollection, error) {
 	var none AdminCollection
+	visibility, err := normalizeCollectionVisibilityUpdate(req.Visibility)
+	if err != nil {
+		return none, err
+	}
+	req.Visibility = visibility
 	existing, err := h.repo.GetByID(ctx, collectionID)
 	if err != nil {
 		return none, adminCollectionLookupAPIError(err)
@@ -309,6 +313,33 @@ func (h *LibraryCollectionHandler) updateAdminCollection(ctx context.Context, co
 	return h.libraryCollectionResponseOf(ctx, h.withViewerPoster(ctx, updated)), nil
 }
 
+// normalizeCollectionVisibilityUpdate validates an update's visibility. Nil
+// means "not provided" and stays nil; an explicit empty value means the
+// default, so it becomes visible rather than reaching the CHECK constraint.
+func normalizeCollectionVisibilityUpdate(visibility *string) (*string, error) {
+	if visibility == nil {
+		return nil, nil
+	}
+	if err := validateCollectionVisibility(*visibility); err != nil {
+		return nil, err
+	}
+	if *visibility == "" {
+		v := adminCollectionVisible
+		return &v, nil
+	}
+	return visibility, nil
+}
+
+// validateCollectionVisibility rejects values the library_collections
+// visibility CHECK constraint would refuse. An empty value means the default.
+func validateCollectionVisibility(visibility string) error {
+	switch visibility {
+	case "", adminCollectionVisible, adminCollectionHidden:
+		return nil
+	}
+	return fieldError("visibility", "visibility must be visible or hidden")
+}
+
 func adminCollectionLookupAPIError(err error) error {
 	if errors.Is(err, catalog.ErrLibraryCollectionNotFound) {
 		return apiError(http.StatusNotFound, "not_found", "Collection not found")
@@ -317,10 +348,6 @@ func adminCollectionLookupAPIError(err error) error {
 }
 
 func validateAdminCollectionSourceUpdate(existing *models.LibraryCollection, req AdminCollectionUpdate) error {
-	proposedType := existing.CollectionType
-	if req.CollectionType != nil {
-		proposedType = *req.CollectionType
-	}
 	proposedConfig := existing.SourceConfig
 	if len(req.SourceConfig) > 0 {
 		proposedConfig = req.SourceConfig
@@ -329,41 +356,12 @@ func validateAdminCollectionSourceUpdate(existing *models.LibraryCollection, req
 	if req.SourceURL != nil {
 		proposedURL = *req.SourceURL
 	}
-	wasTrakt := existing.CollectionType == adminCollectionTrakt || isTraktCollectionSourceConfig(existing.SourceConfig)
-	willBeTrakt := proposedType == adminCollectionTrakt || isTraktCollectionSourceConfig(proposedConfig)
-	if !wasTrakt && willBeTrakt {
-		return apiError(http.StatusBadRequest, "unsupported_source", "new Trakt collections are not supported")
-	}
 	if err := validateTMDBListSourceConfig(proposedConfig, proposedURL); err != nil {
 		return apiError(http.StatusBadRequest, "bad_request", err.Error())
 	}
-	if wasTrakt {
-		activatesSchedule := req.SyncSchedule != nil && strings.TrimSpace(*req.SyncSchedule) != "" && (existing.SyncSchedule == nil || strings.TrimSpace(*existing.SyncSchedule) == "")
-		changesLibraries := req.LibraryIDs != nil && !samePositiveIntSet(existing.LibraryIDs, *req.LibraryIDs)
-		if proposedType != existing.CollectionType || !jsonConfigEqual(existing.SourceConfig, proposedConfig) || proposedURL != existing.SourceURL || activatesSchedule || changesLibraries {
-			return apiError(http.StatusBadRequest, "legacy_source_immutable", "legacy Trakt collection sources cannot be changed or reactivated")
-		}
-	}
 	return nil
 }
 
-func samePositiveIntSet(left, right []int) bool {
-	left = uniquePositiveInts(left)
-	right = uniquePositiveInts(right)
-	if len(left) != len(right) {
-		return false
-	}
-	rightSet := make(map[int]struct{}, len(right))
-	for _, id := range right {
-		rightSet[id] = struct{}{}
-	}
-	for _, id := range left {
-		if _, ok := rightSet[id]; !ok {
-			return false
-		}
-	}
-	return true
-}
 func (h *LibraryCollectionHandler) UpdateAdminCollection(ctx context.Context, collectionID string, req AdminCollectionUpdate) (AdminCollection, error) {
 	if req.PosterSourceURL != nil || req.BackdropSourceURL != nil {
 		return AdminCollection{}, apiError(400, "bad_request", "Use the artwork endpoint for artwork sources")
@@ -528,14 +526,6 @@ func (h *LibraryCollectionHandler) ImportAdminTMDBList(ctx context.Context, req
 	return h.importAdminTMDBList(ctx, req, h.adminArtworkSources(ctx))
 }
 
-func (h *LibraryCollectionHandler) importAdminTrakt(ctx context.Context, req AdminCollectionImportTrakt, artwork adminCollectionArtwork) (AdminCollectionImportResult, error) {
-	var none AdminCollectionImportResult
-	return none, apiError(http.StatusGone, "unsupported_source", "new Trakt collections are not supported")
-}
-func (h *LibraryCollectionHandler) ImportAdminTrakt(ctx context.Context, req AdminCollectionImportTrakt) (AdminCollectionImportResult, error) {
-	return h.importAdminTrakt(ctx, req, h.adminArtworkSources(ctx))
-}
-
 func (h *LibraryCollectionHandler) GetAdminCollection(ctx context.Context, id string) (AdminCollection, int64, error) {
 	var none AdminCollection
 	before, err := h.repo.CollectionRevision(ctx, id)
diff --git a/internal/api/handlers/admin_collections_service_test.go b/internal/api/handlers/admin_collections_service_test.go
index cab91c2568..bbab0c7a80 100644
--- a/internal/api/handlers/admin_collections_service_test.go
+++ b/internal/api/handlers/admin_collections_service_test.go
@@ -26,6 +26,32 @@ func TestAdminCollectionServiceRejectsArtworkInDefinition(t *testing.T) {
 	}
 }
 
+func TestAdminCollectionServiceRejectsUnknownVisibility(t *testing.T) {
+	h := &LibraryCollectionHandler{}
+	_, err := h.CreateAdminCollection(t.Context(), AdminCollectionCreate{LibraryID: 1, Title: "repro", Visibility: "public"})
+	if e, ok := errors.AsType[*APIError](err); !ok || e.Status != 400 || e.Field != "visibility" {
+		t.Fatalf("create: expected visibility field error, got %v", err)
+	}
+	_, err = h.UpdateAdminCollection(t.Context(), "collection", AdminCollectionUpdate{Visibility: new("public")})
+	if e, ok := errors.AsType[*APIError](err); !ok || e.Status != 400 || e.Field != "visibility" {
+		t.Fatalf("update: expected visibility field error, got %v", err)
+	}
+	for _, v := range []string{"", "visible", "hidden"} {
+		if err := validateCollectionVisibility(v); err != nil {
+			t.Fatalf("%q rejected: %v", v, err)
+		}
+	}
+	if got, err := normalizeCollectionVisibilityUpdate(nil); err != nil || got != nil {
+		t.Fatalf("nil update: got %v, %v", got, err)
+	}
+	for in, want := range map[string]string{"": adminCollectionVisible, adminCollectionHidden: adminCollectionHidden, adminCollectionVisible: adminCollectionVisible} {
+		got, err := normalizeCollectionVisibilityUpdate(new(in))
+		if err != nil || got == nil || *got != want {
+			t.Fatalf("%q: got %v, %v, want %q", in, got, err, want)
+		}
+	}
+}
+
 func TestAdminCollectionLookupAPIErrorPreservesFailureClass(t *testing.T) {
 	for _, tc := range []struct {
 		name       string
@@ -45,52 +71,6 @@ func TestAdminCollectionLookupAPIErrorPreservesFailureClass(t *testing.T) {
 	}
 }
 
-func TestLegacyTraktAdminCollectionLibraryScopeIsImmutable(t *testing.T) {
-	for _, tc := range []struct {
-		name       string
-		existing   *models.LibraryCollection
-		libraryIDs []int
-		wantError  bool
-	}{
-		{
-			name: "collection type changed scope",
-			existing: &models.LibraryCollection{
-				CollectionType: "trakt", LibraryIDs: []int{1, 2},
-			},
-			libraryIDs: []int{2, 3}, wantError: true,
-		},
-		{
-			name: "source config changed scope",
-			existing: &models.LibraryCollection{
-				CollectionType: "manual", LibraryIDs: []int{1, 2},
-				SourceConfig: json.RawMessage(`{"provider":"trakt","mode":"trakt_list"}`),
-			},
-			libraryIDs: []int{2, 3}, wantError: true,
-		},
-		{
-			name: "reordered duplicate scope is unchanged",
-			existing: &models.LibraryCollection{
-				CollectionType: "trakt", LibraryIDs: []int{1, 2},
-			},
-			libraryIDs: []int{2, 1, 2},
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			err := validateAdminCollectionSourceUpdate(tc.existing, AdminCollectionUpdate{LibraryIDs: &tc.libraryIDs})
-			if tc.wantError {
-				apiErr, ok := errors.AsType[*APIError](err)
-				if !ok || apiErr.Code != "legacy_source_immutable" {
-					t.Fatalf("error = %#v, want legacy_source_immutable", err)
-				}
-				return
-			}
-			if err != nil {
-				t.Fatalf("validateAdminCollectionSourceUpdate: %v", err)
-			}
-		})
-	}
-}
-
 // The web editor changes a franchise list's TMDB collection ID by sending a
 // rebuilt tmdb_collection source; only Trakt sources are frozen.
 func TestAdminCollectionSourceUpdateAcceptsFranchiseID(t *testing.T) {
diff --git a/internal/api/handlers/admin_images.go b/internal/api/handlers/admin_images.go
index 05b1f220b8..34d2f097f5 100644
--- a/internal/api/handlers/admin_images.go
+++ b/internal/api/handlers/admin_images.go
@@ -13,6 +13,7 @@ import (
 
 	"github.com/prairie-server/prairie-server/internal/catalog"
 	evt "github.com/prairie-server/prairie-server/internal/events"
+	"github.com/prairie-server/prairie-server/internal/logredact"
 	"github.com/prairie-server/prairie-server/internal/metadata"
 	"github.com/prairie-server/prairie-server/internal/models"
 	"github.com/prairie-server/prairie-server/internal/netguard"
@@ -24,6 +25,9 @@ type ImageService interface {
 	FetchItemImages(ctx context.Context, providerIDs map[string]string, contentType string, language string, folderID int) ([]metadata.RemoteImage, map[string]string, error)
 	FetchSeasonImages(ctx context.Context, providerIDs map[string]string, language string, folderID int, seasonNumber int) ([]metadata.RemoteImage, map[string]string, error)
 	ApplyItemImage(ctx context.Context, req metadata.ApplyItemImageRequest) (*metadata.ApplyItemImageResult, error)
+	FetchItemImagesWithLocal(ctx context.Context, providerIDs map[string]string, contentType string, language string, folderID int, contentID string) ([]metadata.RemoteImage, map[string]string, error)
+	LocalImagePreview(ctx context.Context, contentID string, sourceURL string) (string, error)
+	ApplyLocalItemImage(ctx context.Context, req metadata.ApplyLocalItemImageRequest) (*metadata.ApplyItemImageResult, error)
 }
 
 // ImageItemLookup loads media items, seasons, and episodes by content ID.
@@ -80,6 +84,12 @@ func NewAdminImageHandler(
 	}
 }
 
+// offersLocalImages reports whether the picker offers local sidecar artwork
+// for an item type: the NFO provider serves movies and series only.
+func offersLocalImages(itemType string) bool {
+	return itemType == itemTypeMovie || itemType == itemTypeSeries
+}
+
 // --- Request/Response types ---
 
 type itemImageEntry struct {
@@ -192,7 +202,8 @@ func (h *AdminImageHandler) HandleGetItemImages(w http.ResponseWriter, r *http.R
 		return
 	}
 
-	out, err := h.GetAdminItemImages(r.Context(), contentID)
+	// Frozen v1 keeps its provider-only choices.
+	out, err := h.listItemImages(r.Context(), contentID, false)
 	if err != nil {
 		writeAPIError(w, err)
 		return
@@ -202,7 +213,13 @@ func (h *AdminImageHandler) HandleGetItemImages(w http.ResponseWriter, r *http.R
 
 type AdminItemImagesView = getItemImagesResponse
 
+// GetAdminItemImages lists provider choices plus, for a movie or series, the
+// local sidecar artwork next to its files.
 func (h *AdminImageHandler) GetAdminItemImages(ctx context.Context, contentID string) (AdminItemImagesView, error) {
+	return h.listItemImages(ctx, contentID, true)
+}
+
+func (h *AdminImageHandler) listItemImages(ctx context.Context, contentID string, includeLocal bool) (AdminItemImagesView, error) {
 	resolved, err := h.resolveContentID(ctx, contentID)
 	if err != nil {
 		if errors.Is(err, catalog.ErrItemNotFound) {
@@ -233,10 +250,17 @@ func (h *AdminImageHandler) GetAdminItemImages(ctx context.Context, contentID st
 
 	var images []metadata.RemoteImage
 	var providerErrors map[string]string
+	// Only the movie and series list runs sidecar discovery. Every other list
+	// treats a file:// URL as an ordinary provider choice, as before.
+	withLocal := includeLocal && resolved.season == nil && resolved.episode == nil && offersLocalImages(resolved.parentItem.Type)
 	if resolved.season != nil {
 		images, providerErrors, err = h.imageSvc.FetchSeasonImages(
 			ctx, providerIDs, language, folderID, resolved.season.SeasonNumber,
 		)
+	} else if withLocal {
+		images, providerErrors, err = h.imageSvc.FetchItemImagesWithLocal(
+			ctx, providerIDs, resolved.parentItem.Type, language, folderID, resolved.parentItem.ContentID,
+		)
 	} else {
 		// Movies, series, and episodes use the parent item's type for the plugin
 		// image call. Season browsing is handled above so a season can never
@@ -250,10 +274,13 @@ func (h *AdminImageHandler) GetAdminItemImages(ctx context.Context, contentID st
 		return AdminItemImagesView{}, apiError(http.StatusInternalServerError, "internal_error", "Failed to fetch images")
 	}
 
-	// Batch-resolve plugin-prefixed URLs for display.
-	rawPaths := make([]string, len(images))
-	for i, img := range images {
-		rawPaths[i] = img.URL
+	// Batch-resolve plugin-prefixed URLs for display. Local files get an
+	// inline preview below instead.
+	rawPaths := make([]string, 0, len(images))
+	for _, img := range images {
+		if !withLocal || !metadata.IsLocalImageSource(img.URL) {
+			rawPaths = append(rawPaths, img.URL)
+		}
 	}
 	var resolvedURLs map[string]string
 	if h.imageResolver != nil && len(rawPaths) > 0 {
@@ -264,11 +291,27 @@ func (h *AdminImageHandler) GetAdminItemImages(ctx context.Context, contentID st
 	entries := make([]itemImageEntry, 0, len(images))
 	for _, img := range images {
 		displayURL := img.URL
-		if resolved, ok := resolvedURLs[img.URL]; ok && resolved != "" {
+		providerID := img.ProviderID
+		if withLocal && metadata.IsLocalImageSource(img.URL) {
+			// A file the picker cannot preview could not be applied either:
+			// both read it under the same confinement and size checks. Report
+			// the failure so the admin can tell why the choice is missing.
+			preview, err := h.imageSvc.LocalImagePreview(ctx, resolved.parentItem.ContentID, img.URL)
+			if err != nil {
+				slog.WarnContext(ctx, "admin images: local image preview failed", "component", "api", "content_id", contentID, "error", logredact.SanitizeText(err.Error()))
+				if providerErrors == nil {
+					providerErrors = map[string]string{}
+				}
+				providerErrors[metadata.LocalImageProviderID] = "Local image preview failed"
+				continue
+			}
+			displayURL = preview
+			providerID = metadata.LocalImageProviderID
+		} else if resolved, ok := resolvedURLs[img.URL]; ok && resolved != "" {
 			displayURL = resolved
 		}
 		entries = append(entries, itemImageEntry{
-			ProviderID:  img.ProviderID,
+			ProviderID:  providerID,
 			URL:         displayURL,
 			OriginalURL: img.URL,
 			Type:        metadata.ImageTypeToString(img.Type),
@@ -312,7 +355,8 @@ func (h *AdminImageHandler) HandleApplyItemImage(w http.ResponseWriter, r *http.
 		writeError(w, http.StatusBadRequest, "bad_request", "Invalid request body")
 		return
 	}
-	out, err := h.ApplyAdminItemImage(r.Context(), contentID, req)
+	// Frozen v1 keeps applying provider images only.
+	out, err := h.applyItemImage(r.Context(), contentID, req, false)
 	if err != nil {
 		writeAPIError(w, err)
 		return
@@ -323,7 +367,13 @@ func (h *AdminImageHandler) HandleApplyItemImage(w http.ResponseWriter, r *http.
 type AdminItemImageResult = applyItemImageResponse
 type AdminItemImageRequest = applyItemImageRequest
 
+// ApplyAdminItemImage applies a provider image, or for a movie or series one
+// of the local sidecar images the list offered.
 func (h *AdminImageHandler) ApplyAdminItemImage(ctx context.Context, contentID string, req AdminItemImageRequest) (AdminItemImageResult, error) {
+	return h.applyItemImage(ctx, contentID, req, true)
+}
+
+func (h *AdminImageHandler) applyItemImage(ctx context.Context, contentID string, req AdminItemImageRequest, allowLocal bool) (AdminItemImageResult, error) {
 	if req.OriginalURL == "" || req.Type == "" {
 		return AdminItemImageResult{}, apiError(http.StatusBadRequest, "bad_request", "original_url and type are required")
 	}
@@ -349,44 +399,14 @@ func (h *AdminImageHandler) ApplyAdminItemImage(ctx context.Context, contentID s
 		return AdminItemImageResult{}, apiError(http.StatusBadRequest, "unsupported_image_type",
 			fmt.Sprintf("%s items do not accept %s images", resolved.contentType, metadata.ImageTypeToString(imageType)))
 	}
-	providerID := req.ProviderID
-	if providerID == "" {
-		providerID = primaryProvider(resolved.parentItem)
-	}
-
-	// Use the parent item's ContentID for S3 key construction. Season /
-	// episode numbers (when present) scope the S3 key beneath the series
-	// prefix so siblings do not collide.
-	cacheContentID := findBestContentID(resolved.parentItem, providerID)
-	var seasonNumber, episodeNumber *int
-	switch resolved.contentType {
-	case itemTypeSeason:
-		if resolved.season != nil {
-			seasonNumber = new(resolved.season.SeasonNumber)
-		}
-	case itemTypeEpisode:
-		if resolved.episode != nil {
-			seasonNumber = new(resolved.episode.SeasonNumber)
-			episodeNumber = new(resolved.episode.EpisodeNumber)
-		}
+	var result *metadata.ApplyItemImageResult
+	if allowLocal && metadata.IsLocalImageSource(req.OriginalURL) {
+		result, err = h.cacheLocalItemImage(ctx, contentID, resolved, imageType, req.OriginalURL)
+	} else {
+		result, err = h.cacheProviderItemImage(ctx, contentID, resolved, imageType, req)
 	}
-
-	// Only acting admins reach this call. Like the history-import sources an
-	// admin configures, the image an admin applies may be on the server's local
-	// network; netguard still refuses blocked addresses
-	// (docs/architecture/outbound-address-guard.md).
-	result, err := h.imageSvc.ApplyItemImage(netguard.WithPrivateAccess(ctx), metadata.ApplyItemImageRequest{
-		OriginalURL:   req.OriginalURL,
-		ProviderID:    providerID,
-		ContentType:   resolved.parentItem.Type,
-		ContentID:     cacheContentID,
-		ImageType:     imageType,
-		SeasonNumber:  seasonNumber,
-		EpisodeNumber: episodeNumber,
-	})
 	if err != nil {
-		slog.ErrorContext(ctx, "admin images: apply failed", "component", "api", "content_id", contentID, "error", err)
-		return AdminItemImageResult{}, apiError(http.StatusInternalServerError, "internal_error", "Failed to apply image")
+		return AdminItemImageResult{}, err
 	}
 
 	err = h.detailSvc.PublishArtworkSelection(ctx, catalog.ArtworkSelection{
@@ -436,6 +456,79 @@ func (h *AdminImageHandler) ApplyAdminItemImage(ctx context.Context, contentID s
 	}, nil
 }
 
+// cacheProviderItemImage downloads and caches a provider or HTTP(S) image.
+func (h *AdminImageHandler) cacheProviderItemImage(ctx context.Context, contentID string, resolved *resolvedItem, imageType metadata.ImageType, req AdminItemImageRequest) (*metadata.ApplyItemImageResult, error) {
+	providerID := req.ProviderID
+	if providerID == "" {
+		providerID = primaryProvider(resolved.parentItem)
+	}
+
+	// Use the parent item's ContentID for S3 key construction. Season /
+	// episode numbers (when present) scope the S3 key beneath the series
+	// prefix so siblings do not collide.
+	cacheContentID := findBestContentID(resolved.parentItem, providerID)
+	var seasonNumber, episodeNumber *int
+	switch resolved.contentType {
+	case "season":
+		if resolved.season != nil {
+			seasonNumber = new(resolved.season.SeasonNumber)
+		}
+	case "episode":
+		if resolved.episode != nil {
+			seasonNumber = new(resolved.episode.SeasonNumber)
+			episodeNumber = new(resolved.episode.EpisodeNumber)
+		}
+	}
+
+	// Only acting admins reach this call. Like the history-import sources an
+	// admin configures, the image an admin applies may be on the server's local
+	// network; netguard still refuses blocked addresses
+	// (docs/architecture/outbound-address-guard.md).
+	result, err := h.imageSvc.ApplyItemImage(netguard.WithPrivateAccess(ctx), metadata.ApplyItemImageRequest{
+		OriginalURL:   req.OriginalURL,
+		ProviderID:    providerID,
+		ContentType:   resolved.parentItem.Type,
+		ContentID:     cacheContentID,
+		ImageType:     imageType,
+		SeasonNumber:  seasonNumber,
+		EpisodeNumber: episodeNumber,
+	})
+	if err != nil {
+		slog.ErrorContext(ctx, "admin images: apply failed", "component", "api", "content_id", contentID, "error", err)
+		return nil, apiError(http.StatusInternalServerError, "internal_error", "Failed to apply image")
+	}
+	return result, nil
+}
+
+// cacheLocalItemImage caches one of the local sidecar images the list offered
+// for a movie or series.
+func (h *AdminImageHandler) cacheLocalItemImage(ctx context.Context, contentID string, resolved *resolvedItem, imageType metadata.ImageType, sourceURL string) (*metadata.ApplyItemImageResult, error) {
+	if resolved.season != nil || resolved.episode != nil || !offersLocalImages(resolved.parentItem.Type) {
+		return nil, apiError(http.StatusBadRequest, "bad_request", "Local images can only be applied to movies and series")
+	}
+	item := resolved.parentItem
+	folderID, err := h.resolveImageFolderID(ctx, item.ContentID)
+	if err != nil {
+		slog.ErrorContext(ctx, "admin images: resolve folder failed", "component", "api", "content_id", contentID, "error", err)
+		return nil, apiError(http.StatusInternalServerError, "internal_error", "Could not determine library for item")
+	}
+	result, err := h.imageSvc.ApplyLocalItemImage(ctx, metadata.ApplyLocalItemImageRequest{
+		ContentID:   item.ContentID,
+		ContentType: item.Type,
+		FolderID:    folderID,
+		ImageType:   imageType,
+		SourceURL:   sourceURL,
+	})
+	if errors.Is(err, metadata.ErrLocalImageNotOffered) {
+		return nil, apiError(http.StatusBadRequest, "bad_request", "The image is not one of this item's local images")
+	}
+	if err != nil {
+		slog.ErrorContext(ctx, "admin images: local apply failed", "component", "api", "content_id", contentID, "error", err)
+		return nil, apiError(http.StatusInternalServerError, "internal_error", "Failed to apply image")
+	}
+	return result, nil
+}
+
 // resolveImageFolderID finds the primary library folder for a content ID.
 func (h *AdminImageHandler) resolveImageFolderID(ctx context.Context, contentID string) (int, error) {
 	if h.folders == nil {
diff --git a/internal/api/handlers/admin_images_local_test.go b/internal/api/handlers/admin_images_local_test.go
new file mode 100644
index 0000000000..ecdb958783
--- /dev/null
+++ b/internal/api/handlers/admin_images_local_test.go
@@ -0,0 +1,223 @@
+package handlers
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+
+	"github.com/prairie-server/prairie-server/internal/metadata"
+)
+
+const (
+	localPosterURL   = "file:///media/Other/Show/poster.jpg"
+	localBackdropURL = "file:///media/Other/Show/fanart.jpg"
+	localPreviewURI  = "data:image/webp;base64,UklGRg=="
+)
+
+type localImageServiceFake struct {
+	plainCalls     int
+	localCalls     int
+	localContentID string
+	providerCalls  int
+	applyLocal     []metadata.ApplyLocalItemImageRequest
+	applyLocalErr  error
+	plainImages    []metadata.RemoteImage
+	previewCalls   int
+}
+
+func (f *localImageServiceFake) FetchItemImages(context.Context, map[string]string, string, string, int) ([]metadata.RemoteImage, map[string]string, error) {
+	f.plainCalls++
+	if f.plainImages != nil {
+		return f.plainImages, nil, nil
+	}
+	return []metadata.RemoteImage{{ProviderID: "tmdb", URL: "https://image.example/poster.jpg", Type: metadata.ImagePoster}}, nil, nil
+}
+
+func (f *localImageServiceFake) FetchItemImagesWithLocal(_ context.Context, _ map[string]string, _, _ string, _ int, contentID string) ([]metadata.RemoteImage, map[string]string, error) {
+	f.localCalls++
+	f.localContentID = contentID
+	return []metadata.RemoteImage{
+		{ProviderID: "tmdb", URL: "https://image.example/poster.jpg", Type: metadata.ImagePoster},
+		{ProviderID: "nfo", URL: localPosterURL, Type: metadata.ImagePoster},
+		{ProviderID: "nfo", URL: localBackdropURL, Type: metadata.ImageBackdrop},
+	}, nil, nil
+}
+
+func (f *localImageServiceFake) FetchSeasonImages(context.Context, map[string]string, string, int, int) ([]metadata.RemoteImage, map[string]string, error) {
+	return nil, nil, nil
+}
+
+// LocalImagePreview previews the poster and fails for the backdrop, the way an
+// oversized or unreadable file would.
+func (f *localImageServiceFake) LocalImagePreview(_ context.Context, _ string, sourceURL string) (string, error) {
+	f.previewCalls++
+	if sourceURL == localPosterURL {
+		return localPreviewURI, nil
+	}
+	return "", errors.New("local image exceeds 8388608 byte limit")
+}
+
+func (f *localImageServiceFake) ApplyItemImage(context.Context, metadata.ApplyItemImageRequest) (*metadata.ApplyItemImageResult, error) {
+	f.providerCalls++
+	return nil, errors.New("synthetic provider failure")
+}
+
+func (f *localImageServiceFake) ApplyLocalItemImage(_ context.Context, req metadata.ApplyLocalItemImageRequest) (*metadata.ApplyItemImageResult, error) {
+	f.applyLocal = append(f.applyLocal, req)
+	return nil, f.applyLocalErr
+}
+
+func newLocalImageHandlerForTest(svc *localImageServiceFake) *AdminImageHandler {
+	items := curationImageItems{
+		"local-series": {ContentID: "local-series", Type: "series", DefaultMetadataLanguage: "fr"},
+		"series":       {ContentID: "series", Type: "series", TmdbID: "42"},
+		"book":         {ContentID: "book", Type: "audiobook"},
+	}
+	return NewAdminImageHandler(items, curationImageSeasons{}, curationImageEpisodes{}, nil, svc, nil, nil)
+}
+
+func TestAdminItemImagesOffersPreviewableLocalImages(t *testing.T) {
+	svc := &localImageServiceFake{}
+	h := newLocalImageHandlerForTest(svc)
+
+	out, err := h.GetAdminItemImages(context.Background(), "local-series")
+	if err != nil {
+		t.Fatalf("GetAdminItemImages: %v", err)
+	}
+	if svc.localCalls != 1 || svc.plainCalls != 0 || svc.localContentID != "local-series" {
+		t.Fatalf("fetch calls local=%d plain=%d content=%q, want one local listing for the item", svc.localCalls, svc.plainCalls, svc.localContentID)
+	}
+	var local []itemImageEntry
+	for _, entry := range out.Images {
+		if strings.HasPrefix(entry.OriginalURL, "file://") {
+			local = append(local, entry)
+		}
+	}
+	// The backdrop cannot be previewed, so it is not offered either.
+	if len(local) != 1 {
+		t.Fatalf("local choices = %+v, want only the poster", local)
+	}
+	if got := local[0]; got.ProviderID != "local" || got.URL != localPreviewURI || got.OriginalURL != localPosterURL || got.Type != "poster" {
+		t.Fatalf("local choice = %+v", got)
+	}
+	if len(out.Images) != 2 {
+		t.Fatalf("choices = %+v, want the provider poster and the local poster", out.Images)
+	}
+	// The admin is told why the backdrop is missing.
+	// It is told by source only: the preview error stays in the log.
+	if got := out.ProviderErrors["local"]; got != "Local image preview failed" {
+		t.Fatalf("provider errors = %v, want the fixed local preview failure", out.ProviderErrors)
+	}
+}
+
+// Only the movie and series listing runs sidecar discovery. A file:// URL a
+// provider returns anywhere else is not read, previewed, or labeled local.
+func TestAdminItemImagesDoesNotPreviewProviderFileURLs(t *testing.T) {
+	svc := &localImageServiceFake{plainImages: []metadata.RemoteImage{
+		{ProviderID: "plugin", URL: localPosterURL, Type: metadata.ImagePoster},
+	}}
+	h := newLocalImageHandlerForTest(svc)
+
+	out, err := h.GetAdminItemImages(context.Background(), "book")
+	if err != nil {
+		t.Fatalf("GetAdminItemImages: %v", err)
+	}
+	if svc.previewCalls != 0 {
+		t.Fatalf("previewed %d provider file URLs, want none", svc.previewCalls)
+	}
+	if len(out.Images) != 1 || out.Images[0].ProviderID != "plugin" || out.Images[0].URL != localPosterURL {
+		t.Fatalf("choices = %+v, want the provider row unchanged", out.Images)
+	}
+}
+
+// Frozen v1 keeps its provider-only list.
+func TestAdminItemImagesV1ListOmitsLocalImages(t *testing.T) {
+	svc := &localImageServiceFake{}
+	router := chi.NewRouter()
+	router.Get("/{id}/images", newLocalImageHandlerForTest(svc).HandleGetItemImages)
+
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/local-series/images", nil))
+	if rec.Code != http.StatusOK || strings.Contains(rec.Body.String(), "file://") {
+		t.Fatalf("v1 list %d %s", rec.Code, rec.Body)
+	}
+	if svc.localCalls != 0 || svc.plainCalls != 1 {
+		t.Fatalf("fetch calls local=%d plain=%d, want the plain provider listing", svc.localCalls, svc.plainCalls)
+	}
+}
+
+func TestAdminApplyLocalImageValidatesTheTarget(t *testing.T) {
+	t.Run("movie or series uses the local apply", func(t *testing.T) {
+		svc := &localImageServiceFake{applyLocalErr: metadata.ErrLocalImageNotOffered}
+		h := newLocalImageHandlerForTest(svc)
+
+		_, err := h.ApplyAdminItemImage(context.Background(), "local-series", AdminItemImageRequest{OriginalURL: localPosterURL, Type: "poster", ProviderID: "local"})
+		var apiErr *APIError
+		if !errors.As(err, &apiErr) || apiErr.Status != http.StatusBadRequest {
+			t.Fatalf("err = %v, want 400 for an image the item does not offer", err)
+		}
+		if svc.providerCalls != 0 || len(svc.applyLocal) != 1 {
+			t.Fatalf("provider calls %d, local calls %d", svc.providerCalls, len(svc.applyLocal))
+		}
+		req := svc.applyLocal[0]
+		if req.ContentID != "local-series" || req.ContentType != "series" || req.ImageType != metadata.ImagePoster || req.SourceURL != localPosterURL {
+			t.Fatalf("local apply request = %+v", req)
+		}
+	})
+
+	t.Run("cache failure is an internal error", func(t *testing.T) {
+		svc := &localImageServiceFake{applyLocalErr: errors.New("local image missing: poster.jpg")}
+		_, err := newLocalImageHandlerForTest(svc).ApplyAdminItemImage(context.Background(), "local-series", AdminItemImageRequest{OriginalURL: localPosterURL, Type: "poster"})
+		var apiErr *APIError
+		if !errors.As(err, &apiErr) || apiErr.Status != http.StatusInternalServerError {
+			t.Fatalf("err = %v, want 500", err)
+		}
+	})
+
+	t.Run("episodes do not take local images", func(t *testing.T) {
+		svc := &localImageServiceFake{}
+		_, err := newLocalImageHandlerForTest(svc).ApplyAdminItemImage(context.Background(), "episode", AdminItemImageRequest{OriginalURL: localPosterURL, Type: "still"})
+		var apiErr *APIError
+		if !errors.As(err, &apiErr) || apiErr.Status != http.StatusBadRequest {
+			t.Fatalf("err = %v, want 400", err)
+		}
+		if len(svc.applyLocal) != 0 || svc.providerCalls != 0 {
+			t.Fatalf("local calls %d, provider calls %d, want none", len(svc.applyLocal), svc.providerCalls)
+		}
+	})
+
+	t.Run("frozen v1 never takes the local path", func(t *testing.T) {
+		svc := &localImageServiceFake{}
+		router := chi.NewRouter()
+		router.Post("/{id}/images/apply", newLocalImageHandlerForTest(svc).HandleApplyItemImage)
+		rec := httptest.NewRecorder()
+		router.ServeHTTP(rec, httptest.NewRequest(http.MethodPost, "/local-series/images/apply", strings.NewReader(`{"original_url":"`+localPosterURL+`","type":"poster"}`)))
+		if len(svc.applyLocal) != 0 || svc.providerCalls != 1 {
+			t.Fatalf("v1 apply %d: local calls %d, provider calls %d", rec.Code, len(svc.applyLocal), svc.providerCalls)
+		}
+	})
+}
+
+// Only movies and series offer local artwork; other item types keep the
+// provider-only list and refuse a local apply.
+func TestAdminLocalImagesAreLimitedToMoviesAndSeries(t *testing.T) {
+	svc := &localImageServiceFake{}
+	h := newLocalImageHandlerForTest(svc)
+
+	if _, err := h.GetAdminItemImages(context.Background(), "book"); err != nil {
+		t.Fatalf("GetAdminItemImages: %v", err)
+	}
+	if svc.localCalls != 0 || svc.plainCalls != 1 {
+		t.Fatalf("fetch calls local=%d plain=%d, want the plain provider listing", svc.localCalls, svc.plainCalls)
+	}
+	_, err := h.ApplyAdminItemImage(context.Background(), "book", AdminItemImageRequest{OriginalURL: localPosterURL, Type: "poster"})
+	var apiErr *APIError
+	if !errors.As(err, &apiErr) || apiErr.Status != http.StatusBadRequest || len(svc.applyLocal) != 0 {
+		t.Fatalf("err = %v, local calls %d, want 400 and none", err, len(svc.applyLocal))
+	}
+}
diff --git a/internal/api/handlers/admin_images_service_test.go b/internal/api/handlers/admin_images_service_test.go
index 27642f4af7..4d571ec603 100644
--- a/internal/api/handlers/admin_images_service_test.go
+++ b/internal/api/handlers/admin_images_service_test.go
@@ -61,6 +61,15 @@ func (f *curationImageService) ApplyItemImage(ctx context.Context, r metadata.Ap
 	}
 	return &metadata.ApplyItemImageResult{StoredPath: f.stored, Thumbhash: "hash", Revision: "revision"}, nil
 }
+func (f *curationImageService) FetchItemImagesWithLocal(ctx context.Context, providerIDs map[string]string, contentType, language string, folderID int, _ string) ([]metadata.RemoteImage, map[string]string, error) {
+	return f.FetchItemImages(ctx, providerIDs, contentType, language, folderID)
+}
+func (f *curationImageService) LocalImagePreview(context.Context, string, string) (string, error) {
+	return "", errors.New("no local images")
+}
+func (f *curationImageService) ApplyLocalItemImage(context.Context, metadata.ApplyLocalItemImageRequest) (*metadata.ApplyItemImageResult, error) {
+	return nil, errors.New("no local images")
+}
 func TestAdminImageSharedBridgeAndEpisodePreflight(t *testing.T) {
 	svc := &curationImageService{fail: true}
 	h := NewAdminImageHandler(curationImageItems{"series": {ContentID: "series", Type: "series", TmdbID: "42"}}, curationImageSeasons{}, curationImageEpisodes{}, nil, svc, nil, nil)
diff --git a/internal/api/handlers/admin_images_test.go b/internal/api/handlers/admin_images_test.go
index a4fa4b76f0..7e92bbf932 100644
--- a/internal/api/handlers/admin_images_test.go
+++ b/internal/api/handlers/admin_images_test.go
@@ -3,6 +3,7 @@ package handlers
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"net/http"
 	"net/http/httptest"
 	"testing"
@@ -82,6 +83,18 @@ func (f *imageServiceFake) ApplyItemImage(context.Context, metadata.ApplyItemIma
 	return nil, nil
 }
 
+func (f *imageServiceFake) FetchItemImagesWithLocal(ctx context.Context, providerIDs map[string]string, contentType, language string, folderID int, _ string) ([]metadata.RemoteImage, map[string]string, error) {
+	return f.FetchItemImages(ctx, providerIDs, contentType, language, folderID)
+}
+
+func (f *imageServiceFake) LocalImagePreview(context.Context, string, string) (string, error) {
+	return "", errors.New("no local images")
+}
+
+func (f *imageServiceFake) ApplyLocalItemImage(context.Context, metadata.ApplyLocalItemImageRequest) (*metadata.ApplyItemImageResult, error) {
+	return nil, errors.New("no local images")
+}
+
 func TestHandleGetItemImagesUsesSeasonSpecificFetch(t *testing.T) {
 	tests := []struct {
 		name          string
diff --git a/internal/api/handlers/admin_jobs_test.go b/internal/api/handlers/admin_jobs_test.go
index 7d0e672b81..ba1bc1d7a6 100644
--- a/internal/api/handlers/admin_jobs_test.go
+++ b/internal/api/handlers/admin_jobs_test.go
@@ -141,7 +141,6 @@ func TestCanReadAdminJob_OtherUserCannotReadItemRefreshJob(t *testing.T) {
 }
 
 func TestAdminJobToResponseFor_NonAdminSanitizesItemRefreshPayloads(t *testing.T) {
-	claims := &auth.Claims{UserID: 2, Role: "user"}
 	job := &models.AdminJob{
 		JobType:         adminjob.JobTypeItemRefresh,
 		CreatedByUserID: 2,
@@ -155,7 +154,7 @@ func TestAdminJobToResponseFor_NonAdminSanitizesItemRefreshPayloads(t *testing.T
 		PublicURL:    "https://example.test/public",
 	}
 
-	resp := adminJobToResponseFor(nil, job, nil, claims.Role == "admin")
+	resp := adminJobToResponseFor(nil, job, nil, false)
 
 	if string(resp.RequestPayload) != `{}` {
 		t.Fatalf("RequestPayload = %s, want sanitized empty object", resp.RequestPayload)
diff --git a/internal/api/handlers/admin_logs_socket_v2.go b/internal/api/handlers/admin_logs_socket_v2.go
index fd589c8b39..71d43b0024 100644
--- a/internal/api/handlers/admin_logs_socket_v2.go
+++ b/internal/api/handlers/admin_logs_socket_v2.go
@@ -31,7 +31,8 @@ import (
 const AdminLogsSocketProtocol = "prairie.admin-logs.v2"
 
 // ErrAdminLogsSocketForbidden reports a login session whose effective role is
-// not administrator (a secondary profile on an admin account included).
+// not administrator: a secondary profile on an admin account, or a
+// profile-less session on a household that requires a profile, included.
 var ErrAdminLogsSocketForbidden = errors.New("administrator authority required for the log stream")
 
 type AdminLogsSocketV2 struct {
@@ -47,8 +48,8 @@ type AdminLogsSocketV2 struct {
 
 // NewAdminLogsSocketV2 reuses the events socket's ticket store shape and the
 // current account, session and viewer authorities.
-func NewAdminLogsSocketV2(logs *AdminLogsHandler, tickets *evt.SocketTicketStore, sessions eventsSessionValidator, users access.UserRepository, resolver apimw.ViewerResolver, primary apimw.PrimaryProfileChecker, publicURL string) *AdminLogsSocketV2 {
-	return &AdminLogsSocketV2{Logs: logs, Tickets: tickets, Validate: newSocketAuthorityValidator(sessions, users, resolver, primary), PublicOrigin: publicURL}
+func NewAdminLogsSocketV2(logs *AdminLogsHandler, tickets *evt.SocketTicketStore, sessions eventsSessionValidator, users access.UserRepository, resolver apimw.ViewerResolver, actingAdmin apimw.ActingAdminDecider, publicURL string) *AdminLogsSocketV2 {
+	return &AdminLogsSocketV2{Logs: logs, Tickets: tickets, Validate: newSocketAuthorityValidator(sessions, users, resolver, actingAdmin), PublicOrigin: publicURL}
 }
 
 // Available reports whether the handshake is served on this process.
diff --git a/internal/api/handlers/admin_logs_socket_v2_test.go b/internal/api/handlers/admin_logs_socket_v2_test.go
index 5d7848676e..95828e52d6 100644
--- a/internal/api/handlers/admin_logs_socket_v2_test.go
+++ b/internal/api/handlers/admin_logs_socket_v2_test.go
@@ -2,6 +2,7 @@ package handlers
 
 import (
 	"context"
+	"errors"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -11,10 +12,12 @@ import (
 	"time"
 
 	"github.com/gorilla/websocket"
-
+	"github.com/prairie-server/prairie-server/internal/access"
+	apimw "github.com/prairie-server/prairie-server/internal/api/middleware"
 	"github.com/prairie-server/prairie-server/internal/auth"
 	evt "github.com/prairie-server/prairie-server/internal/events"
 	"github.com/prairie-server/prairie-server/internal/logstream"
+	"github.com/prairie-server/prairie-server/internal/models"
 )
 
 func adminLogsSocketFixture(t *testing.T) (*AdminLogsSocketV2, *logstream.Hub, *atomic.Bool, *atomic.Bool) {
@@ -212,3 +215,38 @@ func TestAuditSocketDomainFilterValidationMatchesHistory(t *testing.T) {
 		t.Fatalf("valid actor rejected: %+v, %v", opts, err)
 	}
 }
+
+// The log stream follows the acting-admin rule: a profile-less admin session
+// on a household that requires a profile cannot mint, and a ticket it minted
+// before the household gained a PIN or limit no longer connects.
+func TestAdminLogsSocketV2RefusesProfileLessAdminOnHouseholdRequiringProfile(t *testing.T) {
+	users := &socketUserFixture{user: models.User{ID: 7, Role: "admin", Enabled: true}}
+	sessions := &socketSessionFixture{valid: true, account: users}
+	viewer := &socketViewerFixture{scope: access.Scope{UserID: 7, ProfileVerified: true, PolicyRevision: 1}}
+	var requiresProfile atomic.Bool
+	decide := apimw.NewActingAdminDecider(
+		func(context.Context, int, string) (bool, bool, error) { return true, true, nil },
+		func(context.Context, int) (bool, error) { return requiresProfile.Load(), nil })
+	h := NewAdminLogsSocketV2(NewAdminLogsHandler(nil, nil, logstream.NewHub("admin-logs-household", nil)), evt.NewSocketTicketStore(nil), sessions, users, viewer, decide, "")
+	identity := evt.SocketIdentity{UserID: 7, SessionID: "session", Role: "admin", AccessExpiresAt: time.Now().Add(time.Minute)}
+	stale, err := h.Mint(t.Context(), identity)
+	if err != nil {
+		t.Fatalf("household without a requirement: %v", err)
+	}
+
+	requiresProfile.Store(true)
+	if _, err := h.Mint(t.Context(), identity); !errors.Is(err, ErrAdminLogsSocketForbidden) {
+		t.Fatalf("profile-less mint on a household that requires a profile: %v", err)
+	}
+	server := httptest.NewServer(h)
+	defer server.Close()
+	dialer := websocket.Dialer{Subprotocols: []string{AdminLogsSocketProtocol, eventsTicketProtocolPrefix + stale}}
+	conn, resp, err := dialer.DialContext(t.Context(), "ws"+strings.TrimPrefix(server.URL, "http")+"?stream=audit", nil)
+	if conn != nil {
+		_ = conn.Close()
+	}
+	if err == nil || resp == nil || resp.StatusCode == http.StatusSwitchingProtocols {
+		t.Fatal("ticket minted before the household gained a PIN still connected")
+	}
+	_ = resp.Body.Close()
+}
diff --git a/internal/api/handlers/admin_marker_providers.go b/internal/api/handlers/admin_marker_providers.go
index 47928e3f4b..cafd226192 100644
--- a/internal/api/handlers/admin_marker_providers.go
+++ b/internal/api/handlers/admin_marker_providers.go
@@ -282,7 +282,7 @@ func (h *AdminMarkerProvidersHandler) ValidateMarkerProvider(ctx context.Context
 	}
 	stats, err := submitter.FetchUserStats(ctx)
 	if err != nil {
-		return MarkerProviderValidationView{Error: err.Error()}, nil //nolint:nilerr // the provider failure is the validation result
+		return MarkerProviderValidationView{Error: err.Error()}, nil //nolint:nilerr // a rejected credential is the validation result (Valid=false), not a request failure
 	}
 	return MarkerProviderValidationView{Valid: true, Stats: new(toMarkerUserStatsResponse(stats))}, nil
 }
diff --git a/internal/api/handlers/admin_node_commands_test.go b/internal/api/handlers/admin_node_commands_test.go
index a4ed200c59..a43ec9d041 100644
--- a/internal/api/handlers/admin_node_commands_test.go
+++ b/internal/api/handlers/admin_node_commands_test.go
@@ -56,7 +56,7 @@ func TestAdminNodeReprobeView(t *testing.T) {
 		refreshErr error
 	}{{"success", 200, nil}, {"store failure", 200, errors.New("store unavailable")}, {"busy", 409, nil}, {"unavailable", 503, nil}} {
 		t.Run(tc.name, func(t *testing.T) {
-			url, auth := fakeNodeServer(t, tc.status, `{"resolved":"qsv","capability_hash":"new"}`)
+			url, signedWith := fakeNodeServer(t, tc.status, `{"resolved":"qsv","capability_hash":"new"}`)
 			repo := &stubNodeRepository{node: &nodepool.Node{ID: 1, Name: "Synthetic", URL: url, Type: nodepool.NodeTypeTranscode}}
 			refresh := &stubCapabilityRefresher{err: tc.refreshErr}
 			h := NewNodeHandler(repo, nil, nil, nil, nil, nil, "synthetic-secret")
@@ -64,8 +64,8 @@ func TestAdminNodeReprobeView(t *testing.T) {
 			writer := &deadlineRecorder{ResponseRecorder: httptest.NewRecorder()}
 			before := time.Now()
 			out, err := h.ReprobeAdminNode(writer, httptest.NewRequest("POST", "/", nil).WithContext(t.Context()), 1)
-			if err != nil || *auth != "Bearer synthetic-secret" || !writer.deadline.After(before) {
-				t.Fatal(out, err, *auth, writer.deadline)
+			if err != nil || !signedWith("synthetic-secret") || !writer.deadline.After(before) {
+				t.Fatal(out, err, writer.deadline)
 			}
 			if tc.status == 200 {
 				if out.Status != "ok" || out.CapabilityHash != "new" || out.CapabilitiesRefreshed != (tc.refreshErr == nil) || refresh.calls.Load() != 1 {
diff --git a/internal/api/handlers/admin_node_configuration_test.go b/internal/api/handlers/admin_node_configuration_test.go
index adcc91e0ab..69bea3f114 100644
--- a/internal/api/handlers/admin_node_configuration_test.go
+++ b/internal/api/handlers/admin_node_configuration_test.go
@@ -9,6 +9,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 	"github.com/prairie-server/prairie-server/internal/nodepool"
 )
 
@@ -101,12 +102,12 @@ func waitNodeConfiguration(t *testing.T, ready func() bool) {
 // server's cached capabilities for the node; a rename does neither. The response
 // is the committed row either way and does not wait on the worker.
 func TestUpdateAdminNodeNudgesWorkerOnlyOnPolicyTargetChange(t *testing.T) {
-	reloaded := make(chan string, 4)
+	reloaded := make(chan bool, 4)
 	var destructive atomic.Bool
 	worker := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch r.URL.Path {
 		case "/admin/reload-config":
-			reloaded <- r.Header.Get("Authorization")
+			reloaded <- nodeauthtest.Signed(r, "secret")
 		case "/admin/force-reload":
 			destructive.Store(true)
 		}
@@ -135,8 +136,8 @@ func TestUpdateAdminNodeNudgesWorkerOnlyOnPolicyTargetChange(t *testing.T) {
 			t.Fatal("post-commit work did not finish")
 		}
 		for len(reloaded) > 0 {
-			if auth := <-reloaded; auth != "Bearer secret" {
-				t.Fatalf("authorization %q", auth)
+			if signed := <-reloaded; !signed {
+				t.Fatal("reload request was not signed with the shared secret")
 			}
 			reloads++
 		}
diff --git a/internal/api/handlers/admin_node_network_access.go b/internal/api/handlers/admin_node_network_access.go
index 7a282a57d3..8f3f254ebe 100644
--- a/internal/api/handlers/admin_node_network_access.go
+++ b/internal/api/handlers/admin_node_network_access.go
@@ -3,6 +3,7 @@ package handlers
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -10,6 +11,7 @@ import (
 	"time"
 
 	"github.com/prairie-server/prairie-server/internal/netaccess"
+	"github.com/prairie-server/prairie-server/internal/nodeauth"
 	"github.com/prairie-server/prairie-server/internal/nodepool"
 	"github.com/prairie-server/prairie-server/internal/plugins"
 	"github.com/prairie-server/prairie-server/internal/telemetry"
@@ -64,7 +66,7 @@ func (h *NodeHandler) NodeNetworkAccessDisconnect(ctx context.Context, node plug
 	return status, err
 }
 
-// nodeNetworkAccessCall performs one bearer-authenticated request against a
+// nodeNetworkAccessCall performs one signed request against a
 // proxy's network-access routes and decodes the JSON answer into out. A 404
 // is the proxy saying the provider is not installed there and maps to
 // plugins.ErrNetworkAccessProviderNotFound; every other failure carries the
@@ -79,7 +81,9 @@ func (h *NodeHandler) nodeNetworkAccessCall(ctx context.Context, node plugins.Ne
 	if err != nil {
 		return err
 	}
-	req.Header.Set("Authorization", "Bearer "+h.jwtSecret)
+	if err := nodeauth.Sign(req, node.URL, h.jwtSecret); err != nil {
+		return err
+	}
 	req.Header.Set("Accept", "application/json")
 	client := &http.Client{Timeout: nodeNetworkAccessTimeout}
 	resp, err := telemetry.DoTrustedNode(client, req, operation)
@@ -99,7 +103,7 @@ func (h *NodeHandler) nodeNetworkAccessCall(ctx context.Context, node plugins.Ne
 	case http.StatusNotFound:
 		return plugins.ErrNetworkAccessProviderNotFound
 	case http.StatusUnauthorized:
-		return fmt.Errorf("proxy node refused the node bearer")
+		return errors.New("proxy node refused the signed request; check that it shares this server's secret, runs this Prairie version, and keeps the correct time")
 	case http.StatusServiceUnavailable:
 		return fmt.Errorf("proxy node does not host network access providers: %s", trimNodeReason(body))
 	default:
diff --git a/internal/api/handlers/admin_node_network_access_test.go b/internal/api/handlers/admin_node_network_access_test.go
index 5241d14425..69cbbb4c7a 100644
--- a/internal/api/handlers/admin_node_network_access_test.go
+++ b/internal/api/handlers/admin_node_network_access_test.go
@@ -11,6 +11,7 @@ import (
 	"testing"
 
 	"github.com/prairie-server/prairie-server/internal/netaccess"
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 	"github.com/prairie-server/prairie-server/internal/nodepool"
 	"github.com/prairie-server/prairie-server/internal/plugins"
 )
@@ -40,7 +41,7 @@ func (f *fakeProxyNode) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	f.mu.Lock()
 	defer f.mu.Unlock()
 	f.calls = append(f.calls, r.Method+" "+r.URL.Path)
-	if r.Header.Get("Authorization") != "Bearer "+f.secret {
+	if !nodeauthtest.Signed(r, f.secret) {
 		http.Error(w, "unauthorized", http.StatusUnauthorized)
 		return
 	}
@@ -131,11 +132,11 @@ func TestNodeHandlerFansNetworkAccessOutToProxies(t *testing.T) {
 		t.Fatalf("proxy calls = %v, want %v", calls, want)
 	}
 
-	// A wrong node secret is reported as the proxy refusing the bearer, not as
-	// an unknown provider.
+	// A wrong node secret is reported as the proxy refusing the signed
+	// request, not as an unknown provider.
 	wrong := NewNodeHandler(repo, nil, nil, nil, nil, nil, "other-secret")
-	if _, err := wrong.NodeNetworkAccessStatus(ctx, node, "stub"); err == nil || errors.Is(err, plugins.ErrNetworkAccessProviderNotFound) || !strings.Contains(err.Error(), "bearer") {
-		t.Fatalf("wrong bearer err = %v", err)
+	if _, err := wrong.NodeNetworkAccessStatus(ctx, node, "stub"); err == nil || errors.Is(err, plugins.ErrNetworkAccessProviderNotFound) || !strings.Contains(err.Error(), "refused the signed request") {
+		t.Fatalf("wrong secret err = %v", err)
 	}
 
 	// An unreachable proxy is an error the service turns into unavailable.
diff --git a/internal/api/handlers/admin_node_reload.go b/internal/api/handlers/admin_node_reload.go
index ab9362f254..3a133b3ee1 100644
--- a/internal/api/handlers/admin_node_reload.go
+++ b/internal/api/handlers/admin_node_reload.go
@@ -6,6 +6,7 @@ import (
 	"sync"
 	"time"
 
+	"github.com/prairie-server/prairie-server/internal/nodeauth"
 	"github.com/prairie-server/prairie-server/internal/telemetry"
 
 	"github.com/prairie-server/prairie-server/internal/nodepool"
@@ -17,7 +18,9 @@ func (h *NodeHandler) forceReloadRequest(ctx context.Context, node *nodepool.Nod
 	if err != nil {
 		return nil, err
 	}
-	req.Header.Set("Authorization", "Bearer "+h.jwtSecret)
+	if err := nodeauth.Sign(req, node.URL, h.jwtSecret); err != nil {
+		return nil, err
+	}
 	return req, nil
 }
 func (h *NodeHandler) ForceReloadAdminNodes(ctx context.Context) ([]ForceReloadResult, error) {
diff --git a/internal/api/handlers/admin_node_reload_test.go b/internal/api/handlers/admin_node_reload_test.go
index 7be58d423c..c1753a7d37 100644
--- a/internal/api/handlers/admin_node_reload_test.go
+++ b/internal/api/handlers/admin_node_reload_test.go
@@ -8,6 +8,7 @@ import (
 	"sync/atomic"
 	"testing"
 
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 	"github.com/prairie-server/prairie-server/internal/nodepool"
 )
 
@@ -21,19 +22,26 @@ func TestAdminNodeReloadBulk(t *testing.T) {
 	entered := make(chan string, 2)
 	release := make(chan struct{})
 	var calls atomic.Int32
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+	node := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		calls.Add(1)
-		if r.Method != "POST" || r.Header.Get("Authorization") != "Bearer synthetic-secret" {
+		if r.Method != "POST" || r.URL.Path != "/admin/force-reload" || !nodeauthtest.Signed(r, "synthetic-secret") {
 			t.Error("wrong command authority or method")
 		}
-		entered <- r.URL.Path
+		entered <- r.RequestURI
 		<-release
-		if r.URL.Path == "/first/admin/force-reload" {
+		if r.RequestURI == "/first/admin/force-reload" {
 			w.WriteHeader(204)
 		} else {
 			w.WriteHeader(503)
 		}
-	}))
+	})
+	// Each node sits under its own path prefix, which a reverse proxy strips:
+	// workers serve their routes from the root.
+	gateway := http.NewServeMux()
+	for _, prefix := range []string{"/first", "/second", "/disabled"} {
+		gateway.Handle(prefix+"/", http.StripPrefix(prefix, node))
+	}
+	server := httptest.NewServer(gateway)
 	defer server.Close()
 	repo := &reloadNodeRepo{stubNodeRepository: stubNodeRepository{nodes: []*nodepool.Node{
 		{ID: 1, Name: "First", URL: server.URL + "/first", Enabled: true},
@@ -77,7 +85,7 @@ func TestAdminNodeReloadSingle(t *testing.T) {
 			defer target.Close()
 			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 				calls.Add(1)
-				if r.Method != "POST" || r.URL.Path != "/admin/force-reload" || r.Header.Get("Authorization") != "Bearer synthetic-secret" {
+				if r.Method != "POST" || r.URL.Path != "/admin/force-reload" || !nodeauthtest.Signed(r, "synthetic-secret") {
 					t.Error("wrong command")
 				}
 				w.Header().Set("Location", target.URL)
diff --git a/internal/api/handlers/admin_scoped_api_key_test.go b/internal/api/handlers/admin_scoped_api_key_test.go
index 639ff9b5ac..63bb471a5f 100644
--- a/internal/api/handlers/admin_scoped_api_key_test.go
+++ b/internal/api/handlers/admin_scoped_api_key_test.go
@@ -111,7 +111,7 @@ func newScopedKeyAdminHandler(targetRole string) (*AdminHandler, *scopedKeyUserR
 		Role:        targetRole,
 		Permissions: []string{},
 		Enabled:     true,
-		MaxProfiles: 5,
+		MaxProfiles: new(5),
 	}}
 	return &AdminHandler{
 		userRepo:           repo,
diff --git a/internal/api/handlers/admin_sections_service.go b/internal/api/handlers/admin_sections_service.go
index b80b05745c..5bdb2a01cb 100644
--- a/internal/api/handlers/admin_sections_service.go
+++ b/internal/api/handlers/admin_sections_service.go
@@ -74,9 +74,6 @@ func (h *SectionHandler) CreateAdminSection(ctx context.Context, req AdminSectio
 	if !sections.ValidSectionTypes[sections.SectionType(req.SectionType)] {
 		return none, apiError(http.StatusBadRequest, "bad_request", "Invalid section_type")
 	}
-	if isTraktBackedSection(req.SectionType, req.Config) {
-		return none, apiError(http.StatusBadRequest, "unsupported_source", "new Trakt-backed sections are not supported")
-	}
 
 	scope := req.Scope
 	if scope == "" {
@@ -118,6 +115,9 @@ func (h *SectionHandler) CreateAdminSection(ctx context.Context, req AdminSectio
 	if err != nil {
 		return none, err
 	}
+	if created.SectionType == sections.SectionSeasonalThemed && created.Enabled {
+		h.refreshSeasonalLists(ctx, created.Config)
+	}
 
 	return toSectionResponse(created), nil
 }
@@ -205,9 +205,6 @@ func (h *SectionBulkHandler) BulkCreateAdminSections(ctx context.Context, req Ad
 	if !ok {
 		return none, apiError(http.StatusBadRequest, "bad_request", "unknown section_type")
 	}
-	if isTraktBackedSection(req.SectionType, req.Config) {
-		return none, apiError(http.StatusBadRequest, "unsupported_source", "new Trakt-backed sections are not supported")
-	}
 	if err := rec.Validate(req.Config); err != nil {
 		return none, apiError(http.StatusBadRequest, "bad_request", err.Error())
 	}
@@ -442,8 +439,6 @@ func (h *SectionHandler) UpdateAdminSection(ctx context.Context, id string, req
 		}
 		originalConfig := append(json.RawMessage(nil), existing.Config...)
 		originalType := existing.SectionType
-		originalEnabled := existing.Enabled
-		wasTraktBacked := isTraktBackedSection(string(existing.SectionType), existing.Config)
 		if req.Position != nil {
 			existing.Position = *req.Position
 		}
@@ -486,13 +481,6 @@ func (h *SectionHandler) UpdateAdminSection(ctx context.Context, id string, req
 				return none, apiError(400, "bad_request", msg)
 			}
 		}
-		willBeTraktBacked := isTraktBackedSection(string(existing.SectionType), existing.Config)
-		if !wasTraktBacked && willBeTraktBacked {
-			return none, apiError(http.StatusBadRequest, "unsupported_source", "new Trakt-backed sections are not supported")
-		}
-		if wasTraktBacked && (definitionChanged || (!originalEnabled && existing.Enabled)) {
-			return none, apiError(http.StatusBadRequest, "legacy_source_immutable", "legacy Trakt section sources cannot be changed or reactivated")
-		}
 
 		// PATCH merges into the same version passed to SQL, including wildcard
 		// requests. A wildcard may reread and remerge, never replay a stale full row.
@@ -507,6 +495,9 @@ func (h *SectionHandler) UpdateAdminSection(ctx context.Context, id string, req
 		if err != nil {
 			return none, err
 		}
+		if updated.SectionType == sections.SectionSeasonalThemed && updated.Enabled {
+			h.refreshSeasonalLists(ctx, updated.Config)
+		}
 		return toSectionResponse(updated), nil
 	}
 	return none, apiError(http.StatusConflict, "conflict", "The section changed repeatedly; reload it before retrying")
diff --git a/internal/api/handlers/admin_settings_checks.go b/internal/api/handlers/admin_settings_checks.go
index 2c5fcaf66a..2c38a84f38 100644
--- a/internal/api/handlers/admin_settings_checks.go
+++ b/internal/api/handlers/admin_settings_checks.go
@@ -13,14 +13,15 @@ import (
 	"time"
 
 	"github.com/go-chi/chi/v5"
-	"github.com/redis/go-redis/v9"
 
 	"github.com/prairie-server/prairie-server/internal/ai/chatgpt"
 	"github.com/prairie-server/prairie-server/internal/ai/llm"
 	"github.com/prairie-server/prairie-server/internal/cache"
 	"github.com/prairie-server/prairie-server/internal/catalog"
 	"github.com/prairie-server/prairie-server/internal/config"
+	"github.com/prairie-server/prairie-server/internal/embeddingvectors"
 	"github.com/prairie-server/prairie-server/internal/mdblist"
+	"github.com/prairie-server/prairie-server/internal/recommendations"
 	"github.com/prairie-server/prairie-server/internal/recommendations/embeddings"
 	"github.com/prairie-server/prairie-server/internal/s3client"
 )
@@ -59,36 +60,6 @@ type aiSettingsCheckClient interface {
 	Transcribe(ctx context.Context, req llm.TranscribeRequest) (*llm.Transcription, error)
 }
 
-// redisSettingsCheckClient is the Prairie seam probeRedisConfig pings through,
-// so tests can stand in for Redis when exercising the reject-unreachable save.
-type redisSettingsCheckClient interface {
-	Ping(ctx context.Context) error
-	Close() error
-}
-
-type redisSettingsCheckAdapter struct {
-	client *redis.Client
-}
-
-func (a *redisSettingsCheckAdapter) Ping(ctx context.Context) error {
-	return a.client.Ping(ctx).Err()
-}
-
-func (a *redisSettingsCheckAdapter) Close() error {
-	return cache.CloseRedisClient(a.client)
-}
-
-var newAdminRedisSettingsCheckClient = func(cfg config.RedisConfig) (redisSettingsCheckClient, error) {
-	client, err := cache.NewRedisClientForRole(cfg, "checks")
-	if err != nil {
-		return nil, err
-	}
-	if client == nil {
-		return nil, nil
-	}
-	return &redisSettingsCheckAdapter{client: client}, nil
-}
-
 var newAdminS3SettingsCheckClient = func(cfg s3client.BucketConfig) s3SettingsCheckClient {
 	cfg.Role = "checks"
 	return s3client.NewClient(cfg)
@@ -159,7 +130,7 @@ func (h *AdminHandler) runAdminSettingsConnectionCheck(ctx context.Context, kind
 	case "redis":
 		response = checkRedisConnection(ctx, cfg)
 	case "recommendations_embedding":
-		response = checkRecommendationsEmbeddingConnection(ctx, cfg)
+		response = checkRecommendationsEmbeddingConnection(ctx, cfg, effectiveSettings[recommendations.EmbeddingLockSettingKey])
 	case "ai_chat":
 		if cfg.AI.AuthMode == llm.AuthModeChatGPT {
 			if h.ChatGPT == nil {
@@ -373,7 +344,20 @@ func (h *AdminHandler) effectiveSettingsForConnectionCheck(
 			return nil, err
 		}
 	}
+	// A stored configuration that does not load has no base URL its
+	// embedding token may go to.
+	storedEmbeddingBaseURL := ""
+	if kind == "recommendations_embedding" {
+		if stored, loadErr := config.LoadFromDB(merged); loadErr == nil {
+			storedEmbeddingBaseURL = stored.Recommendations.EmbeddingBaseURL
+		}
+	}
 	for _, key := range req.DirtyKeys {
+		if key == recommendations.EmbeddingLockSettingKey {
+			// The lock is server state the embedding check compares a draft
+			// against, not a value a draft can replace.
+			continue
+		}
 		merged[key] = req.Values[key]
 	}
 	if storedAIConfig != nil {
@@ -383,10 +367,34 @@ func (h *AdminHandler) effectiveSettingsForConnectionCheck(
 		}
 		protectAIConnectionCheckSecrets(kind, req, storedAIConfig, draftAIConfig, merged)
 	}
+	if kind == "recommendations_embedding" {
+		protectEmbeddingConnectionCheckSecret(req, storedEmbeddingBaseURL, merged)
+	}
 
 	return merged, nil
 }
 
+// embeddingTokenSettingKeys hold the embedding provider's token: the token,
+// then the legacy OpenAI key it falls back to.
+var embeddingTokenSettingKeys = []string{"recommendations.embedding_auth_token", "recommendations.openai_api_key"}
+
+// protectEmbeddingConnectionCheckSecret sends the stored embedding token only
+// to the base URL it was saved for (same scheme, host and port). A draft that
+// points the check elsewhere, by its base URL or a legacy provider setting,
+// is checked with the token it carries itself, or none, so a check cannot
+// hand the saved token to another server.
+func protectEmbeddingConnectionCheckSecret(req adminSettingsConnectionCheckRequest, storedBaseURL string, settings map[string]string) {
+	draft, err := config.LoadFromDB(settings)
+	if err == nil && storedBaseURL != "" && endpointAuthority(draft.Recommendations.EmbeddingBaseURL) == endpointAuthority(storedBaseURL) {
+		return
+	}
+	for _, key := range embeddingTokenSettingKeys {
+		if !hasExplicitDraftSecret(req, key) {
+			settings[key] = ""
+		}
+	}
+}
+
 func protectAIConnectionCheckSecrets(
 	kind string,
 	req adminSettingsConnectionCheckRequest,
@@ -588,41 +596,66 @@ func checkRedisConnection(ctx context.Context, cfg *config.Config) connectionChe
 	if strings.TrimSpace(cfg.Redis.URL) == "" {
 		return connectionCheckResponse{Success: false, Message: "Redis URL is required."}
 	}
-	if err := probeRedisConfig(ctx, cfg.Redis); err != nil {
+
+	if err := probeRedis(ctx, cfg.Redis); err != nil {
 		return connectionCheckResponse{
 			Success: false,
 			Message: fmt.Sprintf("Redis connection check failed: %v", err),
 		}
 	}
+
 	return connectionCheckResponse{
 		Success: true,
 		Message: "Redis connection successful.",
 	}
 }
 
-// probeRedisConfig pings Redis so unreachable URLs cannot be persisted and later
-// brick startup under a process supervisor.
-func probeRedisConfig(ctx context.Context, redisCfg config.RedisConfig) error {
-	if strings.TrimSpace(redisCfg.URL) == "" {
-		return errors.New("redis URL is required")
-	}
-	client, err := newAdminRedisSettingsCheckClient(redisCfg)
+// errRedisChannelsRefused wraps the error Redis answers a subscription to the
+// event bus channels with.
+var errRedisChannelsRefused = errors.New("redis refused a subscription to Prairie's event channels")
+
+// errRedisURLUnreadable wraps the error a redis.url the Redis clients cannot
+// read gives, such as a bare host:port an older build saved.
+var errRedisURLUnreadable = errors.New("redis URL cannot be read")
+
+// probeRedis does what a starting server needs from the Redis cfg names, with
+// the client Prairie's services use: it connects, sends a PING and subscribes to
+// the event bus channels. Connecting selects the database number, so a number
+// the server does not have fails as well, and the subscription fails for a
+// user whose ACL does not grant the channels. The Redis connection check and a
+// save that changes the connection both run it.
+var probeRedis = func(ctx context.Context, cfg config.RedisConfig) error {
+	// The deadline client stops waiting when the check's time is up, even
+	// for a URL whose read_timeout disables the socket timeout.
+	client, err := cache.NewDeadlineRedisClientForRole(cfg, "checks")
 	if err != nil {
-		return err
+		return fmt.Errorf("%w: %w", errRedisURLUnreadable, err)
 	}
 	if client == nil {
 		return errors.New("redis URL is required")
 	}
-	defer func() { _ = client.Close() }()
+	defer func() { _ = cache.CloseRedisClient(client) }()
 
 	checkCtx, cancel := context.WithTimeout(ctx, 10*time.Second)
 	defer cancel()
-	return client.Ping(checkCtx)
+	if err := client.Ping(checkCtx).Err(); err != nil {
+		return err
+	}
+	if err := cache.CheckEventBusChannels(checkCtx, client); err != nil {
+		return fmt.Errorf("%w: %w", errRedisChannelsRefused, err)
+	}
+	return nil
 }
 
+// checkRecommendationsEmbeddingConnection embeds a test string and checks
+// that Prairie can store what the model returns and that the stored embedding
+// lock (rawLock, empty when none) accepts the configuration. Its failure
+// messages are authored here and never quote the base URL, so the v2 boundary
+// returns them as they are.
 func checkRecommendationsEmbeddingConnection(
 	ctx context.Context,
 	cfg *config.Config,
+	rawLock string,
 ) connectionCheckResponse {
 	if strings.TrimSpace(cfg.Recommendations.EmbeddingBaseURL) == "" {
 		return connectionCheckResponse{
@@ -645,15 +678,35 @@ func checkRecommendationsEmbeddingConnection(
 
 	checkCtx, cancel := context.WithTimeout(ctx, 20*time.Second)
 	defer cancel()
-	if _, err := client.Embed(checkCtx, []string{"prairie connection test"}); err != nil {
+	vectors, err := client.Embed(checkCtx, []string{"prairie connection test"})
+	if err != nil {
 		return connectionCheckResponse{
 			Success: false,
 			Message: fmt.Sprintf("Embedding connection check failed: %v", err),
 		}
 	}
+	failed := func(message string) connectionCheckResponse {
+		return connectionCheckResponse{Success: false, Message: message, safeMessage: message}
+	}
+	if len(vectors) == 0 || len(vectors[0]) == 0 {
+		return failed("The embedding provider returned no vector for the test text.")
+	}
+	dimensions := len(vectors[0])
+	if dimensions > embeddingvectors.CanonicalDimensions {
+		return failed(fmt.Sprintf("The model returns %d dimensions; Prairie stores at most %d.", dimensions, embeddingvectors.CanonicalDimensions))
+	}
+	lock, err := recommendations.ParseEmbeddingLock(rawLock)
+	if err != nil {
+		return failed("The stored embedding lock cannot be read. Reset embeddings to clear it.")
+	}
+	if lock != nil {
+		if conflict := recommendations.DescribeEmbeddingLockConflict(*lock, cfg.Recommendations.EmbeddingBaseURL, cfg.Recommendations.EmbeddingModel, dimensions); conflict != "" {
+			return failed(conflict)
+		}
+	}
 
 	return connectionCheckResponse{
 		Success: true,
-		Message: "Embedding connection successful.",
+		Message: fmt.Sprintf("Embedding connection successful. The model returns %d dimensions.", dimensions),
 	}
 }
diff --git a/internal/api/handlers/admin_settings_checks_test.go b/internal/api/handlers/admin_settings_checks_test.go
index 9665f3fc15..1b54fecd73 100644
--- a/internal/api/handlers/admin_settings_checks_test.go
+++ b/internal/api/handlers/admin_settings_checks_test.go
@@ -235,15 +235,15 @@ func TestAdminSettingsWritesRejectMachineManagedCheckpoint(t *testing.T) {
 func TestAdminSettingsValidationIncludesEnvironmentManagedValues(t *testing.T) {
 	newHandler := func() (*AdminHandler, *fakeServerSettingsStore) {
 		settings := &fakeServerSettingsStore{values: map[string]string{
-			"watchsync.trakt.client_id": "configured-client-id",
+			"watchsync.simkl.client_id": "configured-client-id",
 		}}
 		return &AdminHandler{
 			SettingsRepo: settings,
 			BootstrapSensitiveConfigured: map[string]bool{
-				"watchsync.trakt.client_secret": true,
+				"watchsync.simkl.client_secret": true,
 			},
 			BootstrapSensitiveValues: map[string]string{
-				"watchsync.trakt.client_secret": "clawrouter-e2e-secret",
+				"watchsync.simkl.client_secret": "clawrouter-e2e-secret",
 			},
 		}, settings
 	}
@@ -898,10 +898,10 @@ func TestAdminUpdateSettingPreservesLegacyPairedWriteFlow(t *testing.T) {
 		{
 			name: "clear first half of pair",
 			initial: map[string]string{
-				"watchsync.trakt.client_id":     "configured-client-id",
-				"watchsync.trakt.client_secret": "clawrouter-e2e-secret",
+				"watchsync.simkl.client_id":     "configured-client-id",
+				"watchsync.simkl.client_secret": "clawrouter-e2e-secret",
 			},
-			key:   "watchsync.trakt.client_id",
+			key:   "watchsync.simkl.client_id",
 			value: "",
 		},
 	} {
@@ -1055,21 +1055,6 @@ func TestCheckS3ObjectPermissionsSurfacesCleanupFailure(t *testing.T) {
 	}
 }
 
-type fakeRedisSettingsCheckClient struct {
-	ping func(ctx context.Context) error
-}
-
-func (f *fakeRedisSettingsCheckClient) Ping(ctx context.Context) error {
-	if f.ping != nil {
-		return f.ping(ctx)
-	}
-	return nil
-}
-
-func (f *fakeRedisSettingsCheckClient) Close() error {
-	return nil
-}
-
 type fakeMDBListSettingsCheckClient struct {
 	check func(context.Context) error
 }
@@ -1081,6 +1066,20 @@ func (f *fakeMDBListSettingsCheckClient) Check(ctx context.Context) error {
 	return nil
 }
 
+type fakeEmbeddingsSettingsCheckClient struct {
+	embed func(ctx context.Context, texts []string) ([][]float32, error)
+}
+
+func (f *fakeEmbeddingsSettingsCheckClient) Embed(
+	ctx context.Context,
+	texts []string,
+) ([][]float32, error) {
+	if f.embed != nil {
+		return f.embed(ctx, texts)
+	}
+	return [][]float32{{0.1, 0.2}}, nil
+}
+
 type fakeAISettingsCheckClient struct {
 	chat       func(ctx context.Context, messages []llm.Message, jsonObject bool) (string, error)
 	transcribe func(ctx context.Context, req llm.TranscribeRequest) (*llm.Transcription, error)
@@ -1499,102 +1498,7 @@ func TestHandleCheckSettingsConnectionRejectsInvalidDraftValues(t *testing.T) {
 	}
 }
 
-func TestAdminSettingsRejectUnreachableRedisURL(t *testing.T) {
-	originalFactory := newAdminRedisSettingsCheckClient
-	t.Cleanup(func() {
-		newAdminRedisSettingsCheckClient = originalFactory
-	})
-	newAdminRedisSettingsCheckClient = func(cfg config.RedisConfig) (redisSettingsCheckClient, error) {
-		return &fakeRedisSettingsCheckClient{
-			ping: func(context.Context) error {
-				return errors.New("dial tcp: connection refused")
-			},
-		}, nil
-	}
-
-	for _, tc := range []struct {
-		name   string
-		target string
-		body   string
-		single bool
-	}{
-		{
-			name:   "batch",
-			target: "/admin/settings",
-			body:   `{"values":{"redis.url":"redis://unreachable.example.invalid:6379"}}`,
-		},
-		{
-			name:   "single",
-			target: "/admin/settings/redis.url",
-			body:   `{"value":"redis://unreachable.example.invalid:6379"}`,
-			single: true,
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			settings := &fakeServerSettingsStore{values: map[string]string{}}
-			handler := &AdminHandler{SettingsRepo: settings}
-			req := httptest.NewRequest(http.MethodPut, tc.target, strings.NewReader(tc.body))
-			if tc.single {
-				req = withChiParam(req, "key", "redis.url")
-			}
-			rec := httptest.NewRecorder()
-
-			if tc.single {
-				handler.HandleUpdateSetting(rec, req)
-			} else {
-				handler.HandleUpdateSettings(rec, req)
-			}
-
-			if rec.Code != http.StatusBadRequest {
-				t.Fatalf("status = %d, want 400; body=%s", rec.Code, rec.Body.String())
-			}
-			if settings.setManyCalls != 0 || settings.setCalls != 0 {
-				t.Fatalf("unreachable redis.url was persisted: SetMany=%d Set=%d", settings.setManyCalls, settings.setCalls)
-			}
-			if !strings.Contains(rec.Body.String(), "unreachable") {
-				t.Fatalf("body = %q, want unreachable message", rec.Body.String())
-			}
-		})
-	}
-}
-
-func TestAdminSettingsAcceptReachableRedisURL(t *testing.T) {
-	originalFactory := newAdminRedisSettingsCheckClient
-	t.Cleanup(func() {
-		newAdminRedisSettingsCheckClient = originalFactory
-	})
-	newAdminRedisSettingsCheckClient = func(cfg config.RedisConfig) (redisSettingsCheckClient, error) {
-		return &fakeRedisSettingsCheckClient{}, nil
-	}
-
-	settings := &fakeServerSettingsStore{values: map[string]string{}}
-	handler := &AdminHandler{SettingsRepo: settings}
-	req := httptest.NewRequest(
-		http.MethodPut,
-		"/admin/settings",
-		strings.NewReader(`{"values":{"redis.url":"redis://cache.example:6379"}}`),
-	)
-	rec := httptest.NewRecorder()
-	handler.HandleUpdateSettings(rec, req)
-
-	if rec.Code != http.StatusOK {
-		t.Fatalf("status = %d, want 200; body=%s", rec.Code, rec.Body.String())
-	}
-	if settings.values["redis.url"] != "redis://cache.example:6379" {
-		t.Fatalf("values=%#v, want redis.url persisted", settings.values)
-	}
-}
-
 func TestSettingsCheckRouteIsNotShadowedByKeyRoute(t *testing.T) {
-	originalFactory := newAdminRedisSettingsCheckClient
-	t.Cleanup(func() {
-		newAdminRedisSettingsCheckClient = originalFactory
-	})
-
-	newAdminRedisSettingsCheckClient = func(cfg config.RedisConfig) (redisSettingsCheckClient, error) {
-		return &fakeRedisSettingsCheckClient{}, nil
-	}
-
 	handler := &AdminHandler{
 		SettingsRepo: &fakeServerSettingsStore{
 			values: map[string]string{
@@ -1633,7 +1537,7 @@ func TestSettingsCheckRouteIsNotShadowedByKeyRoute(t *testing.T) {
 }
 
 func TestAdminGetSettingRedactsSensitiveSetting(t *testing.T) {
-	for _, key := range []string{"watchsync.trakt.client_secret", "watchsync.simkl.client_secret"} {
+	for _, key := range []string{"watchsync.simkl.client_secret"} {
 		t.Run(key, func(t *testing.T) {
 			const storedSecret = "stored-watch-provider-secret"
 			handler := &AdminHandler{
@@ -1661,7 +1565,7 @@ func TestAdminGetSettingRedactsSensitiveSetting(t *testing.T) {
 }
 
 func TestAdminUpdateSettingRedactsSensitiveSetting(t *testing.T) {
-	for _, key := range []string{"watchsync.trakt.client_secret", "watchsync.simkl.client_secret"} {
+	for _, key := range []string{"watchsync.simkl.client_secret"} {
 		t.Run(key, func(t *testing.T) {
 			const submittedSecret = "submitted-watch-provider-secret"
 			settings := &fakeServerSettingsStore{}
diff --git a/internal/api/handlers/admin_settings_embedding_check_test.go b/internal/api/handlers/admin_settings_embedding_check_test.go
new file mode 100644
index 0000000000..e1fccfd9d9
--- /dev/null
+++ b/internal/api/handlers/admin_settings_embedding_check_test.go
@@ -0,0 +1,210 @@
+package handlers
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"maps"
+	"net/http"
+	"slices"
+	"strings"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/recommendations"
+	"github.com/prairie-server/prairie-server/internal/recommendations/embeddings"
+)
+
+func embeddingLockJSON(t *testing.T, lock recommendations.EmbeddingLock) string {
+	t.Helper()
+	raw, err := lock.Marshal()
+	if err != nil {
+		t.Fatal(err)
+	}
+	return raw
+}
+
+// The embedding check fails when Prairie could not store what the model returns
+// or the stored embedding lock rejects the configuration, and names the
+// model's dimensions when it passes. Its failure messages reach v2 callers.
+func TestCheckRecommendationsEmbeddingConnection(t *testing.T) {
+	originalFactory := newAdminEmbeddingsSettingsCheckClient
+	t.Cleanup(func() { newAdminEmbeddingsSettingsCheckClient = originalFactory })
+
+	const baseURL, model = "http://ollama:11434", "qwen3-embedding:0.6b"
+	vectorOf := func(n int) [][]float32 { return [][]float32{make([]float32, n)} }
+	for _, tc := range []struct {
+		name    string
+		vectors [][]float32
+		err     error
+		lock    string
+		dirty   map[string]string
+		success bool
+		want    string
+	}{
+		{name: "fits", vectors: vectorOf(1024), success: true, want: "returns 1024 dimensions"},
+		{name: "too many dimensions", vectors: vectorOf(4096), want: "The model returns 4096 dimensions; Prairie stores at most 3072."},
+		{name: "exactly the stored size", vectors: vectorOf(3072), success: true, want: "returns 3072 dimensions"},
+		{name: "no vectors", vectors: [][]float32{}, want: "returned no vector"},
+		{name: "nil vector", vectors: [][]float32{nil}, want: "returned no vector"},
+		{name: "empty vector", vectors: [][]float32{{}}, want: "returned no vector"},
+		{
+			name: "matching lock", vectors: vectorOf(1024), success: true, want: "returns 1024 dimensions",
+			lock: embeddingLockJSON(t, recommendations.EmbeddingLock{BaseURL: baseURL, Model: model, SourceDimensions: 1024}),
+		},
+		{
+			name: "lock on another model", vectors: vectorOf(1024),
+			lock: embeddingLockJSON(t, recommendations.EmbeddingLock{BaseURL: baseURL, Model: "all-minilm", SourceDimensions: 384}),
+			want: `Embeddings were created with model "all-minilm", not "qwen3-embedding:0.6b". Reset embeddings before switching models.`,
+		},
+		{
+			name: "lock on another provider", vectors: vectorOf(1024),
+			lock: embeddingLockJSON(t, recommendations.EmbeddingLock{BaseURL: "https://user:secret@other.example", Model: model, SourceDimensions: 1024}),
+			want: "Embeddings were created with a different provider base URL. Reset embeddings before switching providers.",
+		},
+		{
+			name: "lock with other dimensions", vectors: vectorOf(1024),
+			lock: embeddingLockJSON(t, recommendations.EmbeddingLock{BaseURL: baseURL, Model: model, SourceDimensions: 768}),
+			want: "created with 768-dimension vectors, but the model now returns 1024",
+		},
+		{
+			name: "lock pinned to an unstorable model", vectors: vectorOf(1024),
+			lock: embeddingLockJSON(t, recommendations.EmbeddingLock{BaseURL: baseURL, Model: model, SourceDimensions: 4096}),
+			want: "created with 4096-dimension vectors, but the model now returns 1024",
+		},
+		{
+			name: "a draft cannot replace the lock", vectors: vectorOf(1024),
+			lock:  embeddingLockJSON(t, recommendations.EmbeddingLock{BaseURL: baseURL, Model: "all-minilm", SourceDimensions: 384}),
+			dirty: map[string]string{recommendations.EmbeddingLockSettingKey: ""},
+			want:  `model "all-minilm"`,
+		},
+		{name: "unreadable lock", vectors: vectorOf(1024), lock: "{not json", want: "cannot be read"},
+		{name: "provider error", err: errors.New(`Post "http://ollama:11434/v1/embeddings": connection refused`), want: "Connection check failed."},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			newAdminEmbeddingsSettingsCheckClient = func(embeddings.ClientConfig) embeddingsSettingsCheckClient {
+				return &fakeEmbeddingsSettingsCheckClient{embed: func(context.Context, []string) ([][]float32, error) {
+					return tc.vectors, tc.err
+				}}
+			}
+			stored := map[string]string{
+				"recommendations.embedding_base_url": baseURL,
+				"recommendations.embedding_model":    model,
+			}
+			if tc.lock != "" {
+				stored[recommendations.EmbeddingLockSettingKey] = tc.lock
+			}
+			handler := &AdminHandler{SettingsRepo: &fakeServerSettingsStore{values: stored}}
+			var dirtyKeys []string
+			for key := range tc.dirty {
+				dirtyKeys = append(dirtyKeys, key)
+			}
+
+			// The v2 service returns authored messages and hides provider text.
+			result, err := handler.CheckAdminSettingsConnection(t.Context(), "recommendations_embedding", tc.dirty, dirtyKeys)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if result.Success != tc.success || !strings.Contains(result.Message, tc.want) {
+				t.Fatalf("v2 check = %+v, want success=%v and %q", result, tc.success, tc.want)
+			}
+			if strings.Contains(result.Message, "secret") || strings.Contains(result.Message, "ollama:11434") {
+				t.Fatalf("v2 check quotes a base URL: %q", result.Message)
+			}
+
+			// The v1 route keeps its wire shape.
+			rec := performSettingsCheckRequest(t, handler, "/admin/settings/check/recommendations_embedding", map[string]any{
+				"values": tc.dirty, "dirty_keys": dirtyKeys,
+			})
+			if rec.Code != http.StatusOK {
+				t.Fatalf("v1 status = %d; body=%s", rec.Code, rec.Body.String())
+			}
+			var response connectionCheckResponse
+			if err := json.NewDecoder(rec.Body).Decode(&response); err != nil {
+				t.Fatal(err)
+			}
+			if response.Success != tc.success || (tc.err == nil && !strings.Contains(response.Message, tc.want)) {
+				t.Fatalf("v1 check = %+v, want success=%v and %q", response, tc.success, tc.want)
+			}
+		})
+	}
+}
+
+// The check sends the saved embedding token only to the base URL it was saved
+// for, as the AI checks do. A draft that points the check at another scheme,
+// host or port, directly or through the legacy provider setting, is checked
+// with the token it carries itself, or none; the legacy OpenAI key and an
+// environment-managed token are held back the same way. A draft on the saved
+// host, such as a new model or path, still uses the saved token.
+func TestEmbeddingCheckSendsTheSavedTokenOnlyToItsBaseURL(t *testing.T) {
+	originalFactory := newAdminEmbeddingsSettingsCheckClient
+	t.Cleanup(func() { newAdminEmbeddingsSettingsCheckClient = originalFactory })
+	var captured *embeddings.ClientConfig
+	newAdminEmbeddingsSettingsCheckClient = func(cfg embeddings.ClientConfig) embeddingsSettingsCheckClient {
+		captured = &cfg
+		return &fakeEmbeddingsSettingsCheckClient{}
+	}
+
+	const (
+		baseKey, modelKey, tokenKey = "recommendations.embedding_base_url", "recommendations.embedding_model", "recommendations.embedding_auth_token"
+		saved, other                = "https://api.example.test/v1", "https://other.example.test/v1"
+	)
+	savedSettings := map[string]string{baseKey: saved, tokenKey: "saved-token"}
+	for _, tc := range []struct {
+		name      string
+		stored    map[string]string
+		bootstrap map[string]string
+		draft     map[string]string
+		wantURL   string
+		wantToken string
+	}{
+		{name: "new model", stored: savedSettings, draft: map[string]string{modelKey: "other-model"}, wantURL: saved, wantToken: "saved-token"},
+		{name: "same host, other path", stored: savedSettings, draft: map[string]string{baseKey: "https://API.example.test/v2"}, wantURL: "https://API.example.test/v2", wantToken: "saved-token"},
+		{name: "other host", stored: savedSettings, draft: map[string]string{baseKey: other}, wantURL: other},
+		{name: "other scheme", stored: savedSettings, draft: map[string]string{baseKey: "http://api.example.test/v1"}, wantURL: "http://api.example.test/v1"},
+		{name: "other port", stored: savedSettings, draft: map[string]string{baseKey: "https://api.example.test:8443/v1"}, wantURL: "https://api.example.test:8443/v1"},
+		{name: "other host, cleared token", stored: savedSettings, draft: map[string]string{baseKey: other, tokenKey: ""}, wantURL: other},
+		{name: "other host with its own token", stored: savedSettings, draft: map[string]string{baseKey: other, tokenKey: "draft-token"}, wantURL: other, wantToken: "draft-token"},
+		{
+			name:   "legacy OpenAI key",
+			stored: map[string]string{baseKey: saved, "recommendations.openai_api_key": "legacy-key"},
+			draft:  map[string]string{baseKey: other}, wantURL: other,
+		},
+		{
+			name:   "legacy provider resolving elsewhere",
+			stored: map[string]string{"recommendations.embedding_provider": "openai", tokenKey: "saved-token"},
+			draft:  map[string]string{"recommendations.embedding_provider": "ollama"}, wantURL: "http://ollama:11434",
+		},
+		{
+			name: "environment-managed token", stored: map[string]string{baseKey: saved}, bootstrap: map[string]string{tokenKey: "env-token"},
+			draft: map[string]string{baseKey: other}, wantURL: other,
+		},
+		{
+			name: "environment-managed token, saved base URL", stored: map[string]string{baseKey: saved}, bootstrap: map[string]string{tokenKey: "env-token"},
+			draft: map[string]string{modelKey: "other-model"}, wantURL: saved, wantToken: "env-token",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			handler := &AdminHandler{SettingsRepo: &fakeServerSettingsStore{values: maps.Clone(tc.stored)}, BootstrapSensitiveValues: tc.bootstrap}
+			dirtyKeys := slices.Sorted(maps.Keys(tc.draft))
+
+			captured = nil
+			if _, err := handler.CheckAdminSettingsConnection(t.Context(), "recommendations_embedding", tc.draft, dirtyKeys); err != nil {
+				t.Fatal(err)
+			}
+			if captured == nil || captured.BaseURL != tc.wantURL || captured.APIKey != tc.wantToken {
+				t.Fatalf("v2 check called %+v, want base URL %q with token %q", captured, tc.wantURL, tc.wantToken)
+			}
+
+			captured = nil
+			rec := performSettingsCheckRequest(t, handler, "/admin/settings/check/recommendations_embedding", map[string]any{
+				"values": tc.draft, "dirty_keys": dirtyKeys,
+			})
+			if rec.Code != http.StatusOK {
+				t.Fatalf("v1 status = %d; body=%s", rec.Code, rec.Body.String())
+			}
+			if captured == nil || captured.BaseURL != tc.wantURL || captured.APIKey != tc.wantToken {
+				t.Fatalf("v1 check called %+v, want base URL %q with token %q", captured, tc.wantURL, tc.wantToken)
+			}
+		})
+	}
+}
diff --git a/internal/api/handlers/admin_settings_legacy_pairs_test.go b/internal/api/handlers/admin_settings_legacy_pairs_test.go
index f9a7de02be..5ebe0249a4 100644
--- a/internal/api/handlers/admin_settings_legacy_pairs_test.go
+++ b/internal/api/handlers/admin_settings_legacy_pairs_test.go
@@ -47,7 +47,7 @@ func TestAdminUpdateSettingsGrandfathersUntouchedLegacyInvalidSettings(t *testin
 		{
 			name: "watchsync pair",
 			initial: map[string]string{
-				"watchsync.trakt.client_id": "configured-client-id",
+				"watchsync.simkl.client_id": "configured-client-id",
 			},
 		},
 		{
@@ -166,9 +166,9 @@ func TestAdminUpdateSettingsRequiresTouchedLegacyRelationshipsToBeValid(t *testi
 		{
 			name: "watchsync pair",
 			initial: map[string]string{
-				"watchsync.trakt.client_id": "old-client-id",
+				"watchsync.simkl.client_id": "old-client-id",
 			},
-			body: `{"values":{"watchsync.trakt.client_id":"new-client-id"}}`,
+			body: `{"values":{"watchsync.simkl.client_id":"new-client-id"}}`,
 		},
 		{
 			name: "Redis transport relationship",
@@ -243,7 +243,7 @@ func TestAdminUpdateSettingsDoesNotHideNewInvalidRelationshipBehindGrandfathered
 	req := httptest.NewRequest(
 		http.MethodPut,
 		"/admin/settings",
-		strings.NewReader(`{"values":{"watchsync.trakt.client_id":"new-client-id"}}`),
+		strings.NewReader(`{"values":{"watchsync.simkl.client_id":"new-client-id"}}`),
 	)
 	rec := httptest.NewRecorder()
 
diff --git a/internal/api/handlers/admin_settings_redis_db_test.go b/internal/api/handlers/admin_settings_redis_db_test.go
index fe8d8b817b..7996280a84 100644
--- a/internal/api/handlers/admin_settings_redis_db_test.go
+++ b/internal/api/handlers/admin_settings_redis_db_test.go
@@ -2,7 +2,6 @@ package handlers
 
 import (
 	"bufio"
-	"context"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -99,13 +98,6 @@ type redisDBSaveResponse struct {
 
 func saveSettings(t *testing.T, handler *AdminHandler, body string) (*httptest.ResponseRecorder, redisDBSaveResponse) {
 	t.Helper()
-	// Prairie rejects an unreachable redis.url on save; these cases use
-	// placeholder hosts, so stand in a reachable Redis.
-	originalFactory := newAdminRedisSettingsCheckClient
-	t.Cleanup(func() { newAdminRedisSettingsCheckClient = originalFactory })
-	newAdminRedisSettingsCheckClient = func(config.RedisConfig) (redisSettingsCheckClient, error) {
-		return &fakeRedisSettingsCheckClient{ping: func(context.Context) error { return nil }}, nil
-	}
 	rec := httptest.NewRecorder()
 	handler.HandleUpdateSettings(rec, httptest.NewRequest(http.MethodPut, "/admin/settings", strings.NewReader(body)))
 	var response redisDBSaveResponse
@@ -118,6 +110,7 @@ func saveSettings(t *testing.T, handler *AdminHandler, body string) (*httptest.R
 }
 
 func TestAdminSettingsSaveRedisDB(t *testing.T) {
+	acceptRedisSaves(t)
 	const savedURL = "redis://cache.example.invalid:6379/3"
 
 	t.Run("a new number is stored and needs a restart", func(t *testing.T) {
@@ -229,6 +222,7 @@ func redisDatabaseAfterRestart(t *testing.T, settings *fakeServerSettingsStore)
 // what a save stores cannot depend on the saves before it. Each of these
 // installs shows 3 or 5 and is then given the 3 its URL already names.
 func TestAdminSettingsRedisDBRowIgnoresEarlierSaves(t *testing.T) {
+	acceptRedisSaves(t)
 	const savedURL = "redis://cache.example.invalid:6379/3"
 	for name, stored := range map[string]map[string]string{
 		"never set":              {"redis.url": savedURL},
@@ -309,8 +303,11 @@ func TestAdminSettingsStoreNoRedisDBWithoutRedis(t *testing.T) {
 }
 
 // A redis.url saved by an older build can be a bare address, which names no
-// number to compare with.
+// number to compare with. The Redis clients cannot read it either, so outside
+// this test a save that changes redis.db next to it fails its connection check
+// until the URL is saved again.
 func TestAdminSettingsStoreRedisDBNextToAnUnreadableURL(t *testing.T) {
+	acceptRedisSaves(t)
 	for _, single := range []bool{false, true} {
 		settings := &fakeServerSettingsStore{values: map[string]string{"redis.url": "cache.example.invalid:6379"}}
 		if rec := saveRedisDB(&AdminHandler{SettingsRepo: settings}, "0", single); rec.Code != http.StatusOK {
@@ -391,6 +388,24 @@ func TestAdminSettingsClearRedisDBManagedByEnvironment(t *testing.T) {
 // redisCheckServer responds to go-redis initialization and reports which
 // database each PING used, so the check exercises the production Redis client.
 func redisCheckServer(t *testing.T) (string, <-chan int) {
+	t.Helper()
+	return fakeRedisServer(t, fakeRedis{})
+}
+
+// fakeRedis is the Redis fakeRedisServer plays.
+type fakeRedis struct {
+	// databases is how many databases the server has: it refuses a SELECT of
+	// any other number the way Redis does. With 0 it accepts every number.
+	databases int
+	// denyChannels refuses every SUBSCRIBE, as Redis does for a user whose
+	// ACL does not grant the channels.
+	denyChannels bool
+}
+
+// fakeRedisServer is redisCheckServer for the Redis server describes. It also
+// refuses a subscription to a channel not scoped to the selected database, so
+// a check that names the channels wrongly fails.
+func fakeRedisServer(t *testing.T, server fakeRedis) (string, <-chan int) {
 	t.Helper()
 	listener, err := net.Listen("tcp", "127.0.0.1:0")
 	if err != nil {
@@ -441,13 +456,23 @@ func redisCheckServer(t *testing.T) (string, <-chan int) {
 						if len(args) != 2 {
 							return
 						}
-						db, err = strconv.Atoi(args[1])
+						n, err := strconv.Atoi(args[1])
 						if err != nil {
 							return
 						}
+						if server.databases > 0 && (n < 0 || n >= server.databases) {
+							reply = "-ERR DB index is out of range\r\n"
+							break
+						}
+						db = n
 					case "PING":
-						checked <- db
+						select {
+						case checked <- db:
+						default:
+						}
 						reply = "+PONG\r\n"
+					case "SUBSCRIBE":
+						reply = subscribeReply(server, db, args[1:])
 					}
 					if _, err := fmt.Fprint(conn, reply); err != nil {
 						return
@@ -459,6 +484,22 @@ func redisCheckServer(t *testing.T) (string, <-chan int) {
 	return "redis://" + listener.Addr().String(), checked
 }
 
+// subscribeReply answers a SUBSCRIBE of channels on database db.
+func subscribeReply(server fakeRedis, db int, channels []string) string {
+	var reply strings.Builder
+	for i, channel := range channels {
+		if server.denyChannels {
+			return "-NOPERM User default has no permissions to access the '" + channel + "' channel\r\n"
+		}
+		_, scope, _ := strings.Cut(channel, "@")
+		if want := "db" + strconv.Itoa(db); (db > 0 && scope != want) || (db == 0 && scope != "") {
+			return "-ERR channel " + channel + " is not scoped to database " + strconv.Itoa(db) + "\r\n"
+		}
+		fmt.Fprintf(&reply, "*3\r\n$9\r\nsubscribe\r\n$%d\r\n%s\r\n:%d\r\n", len(channel), channel, i+1)
+	}
+	return reply.String()
+}
+
 func TestRedisConnectionCheckUsesRedisDB(t *testing.T) {
 	baseURL, checked := redisCheckServer(t)
 	const savedURL = "redis://cache.example.invalid:6379/3"
diff --git a/internal/api/handlers/admin_settings_redis_save.go b/internal/api/handlers/admin_settings_redis_save.go
new file mode 100644
index 0000000000..7759f8d8fe
--- /dev/null
+++ b/internal/api/handlers/admin_settings_redis_save.go
@@ -0,0 +1,138 @@
+package handlers
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"maps"
+	"net/http"
+
+	"github.com/redis/go-redis/v9"
+
+	"github.com/prairie-server/prairie-server/internal/config"
+	"github.com/prairie-server/prairie-server/internal/logredact"
+)
+
+// errRedisSettingsMoved refuses a save whose Redis connection another save
+// changed while this one was checking it.
+var errRedisSettingsMoved = &APIError{
+	Status:  http.StatusBadRequest,
+	Code:    adminInvalidSettingsCode,
+	Message: "The Redis settings changed while Prairie was checking them. Reload the settings and save again.",
+}
+
+// prospectiveSettings returns the stored settings once changes are written
+// over them, and the rows the write stores. The rows are changes, except that
+// redis.db holds what redisDBRow decides against the URL the write leaves in
+// place.
+func (h *AdminHandler) prospectiveSettings(stored, changes map[string]string) (prospective, rows map[string]string) {
+	prospective = maps.Clone(stored)
+	maps.Copy(prospective, changes)
+	rows = changes
+	if value, ok := changes[config.RedisDBSettingKey]; ok {
+		// The same batch can replace redis.url, so the row is decided
+		// against the URL the batch leaves in place.
+		rows = maps.Clone(changes)
+		rows[config.RedisDBSettingKey] = redisDBRow(h.activeAdminSettings(prospective), value)
+		prospective[config.RedisDBSettingKey] = rows[config.RedisDBSettingKey]
+	}
+	return prospective, rows
+}
+
+// savedRedisConnection returns the Redis connection a start reads from the
+// stored settings values, as config.LoadFromDB does. It reports false when a
+// start takes none from them: values name no URL, or REDIS_URL supplies the
+// whole connection to this process.
+func (h *AdminHandler) savedRedisConnection(values map[string]string) (config.RedisConfig, bool) {
+	if h.BootstrapSensitiveConfigured["redis.url"] {
+		return config.RedisConfig{}, false
+	}
+	cfg := config.RedisConfig{URL: values["redis.url"], DB: values[config.RedisDBSettingKey]}
+	return cfg, cfg.URL != ""
+}
+
+// changedRedisConnection returns the Redis connection the next start takes
+// from prospective, and reports whether it differs from the one stored
+// settings give it now.
+func (h *AdminHandler) changedRedisConnection(stored, prospective map[string]string) (config.RedisConfig, bool) {
+	next, ok := h.savedRedisConnection(prospective)
+	if !ok {
+		return config.RedisConfig{}, false
+	}
+	current, _ := h.savedRedisConnection(stored)
+	return next, !sameRedisConnection(next, current)
+}
+
+// sameRedisConnection reports whether a and b reach the same Redis on the same
+// database number. A redis.db row can name the number the URL already names,
+// so the number is compared as the clients read it.
+func sameRedisConnection(a, b config.RedisConfig) bool {
+	if a.URL != b.URL {
+		return false
+	}
+	dbA, okA := a.Database()
+	dbB, okB := b.Database()
+	if okA && okB {
+		return dbA == dbB
+	}
+	return a == b
+}
+
+// checkRedisSave connects to the Redis a save of changes moves the next start
+// to. A start that cannot connect to it stops the server, and the value can
+// then no longer be corrected in the admin UI, so the save is refused instead.
+// The check runs before the save takes the settings lock and returns the
+// connection it checked; confirmRedisSave holds the save to it. A save that
+// leaves the connection as it is checks nothing, so a Redis that is down for a
+// moment does not block unrelated saves.
+func (h *AdminHandler) checkRedisSave(ctx context.Context, changes map[string]string) (config.RedisConfig, error) {
+	_, urlChanged := changes["redis.url"]
+	_, dbChanged := changes[config.RedisDBSettingKey]
+	if !urlChanged && !dbChanged {
+		return config.RedisConfig{}, nil
+	}
+	stored, err := h.SettingsRepo.GetAll(ctx)
+	if err != nil {
+		return config.RedisConfig{}, err
+	}
+	prospective, _ := h.prospectiveSettings(stored, changes)
+	next, changed := h.changedRedisConnection(stored, prospective)
+	if !changed {
+		return config.RedisConfig{}, nil
+	}
+	if err := probeRedis(ctx, next); err != nil {
+		slog.WarnContext(ctx, "refused a Redis settings save that Prairie could not connect with", "error", logredact.SanitizeText(err.Error()))
+		return config.RedisConfig{}, &APIError{Status: http.StatusBadRequest, Code: adminInvalidSettingsCode, Message: redisSaveRefusal(err)}
+	}
+	return next, nil
+}
+
+// confirmRedisSave refuses a save whose Redis connection is not the one
+// checkRedisSave checked, which happens when another save changed the stored
+// settings in between.
+func (h *AdminHandler) confirmRedisSave(stored, prospective map[string]string, checked config.RedisConfig) error {
+	if next, changed := h.changedRedisConnection(stored, prospective); changed && !sameRedisConnection(next, checked) {
+		return errRedisSettingsMoved
+	}
+	return nil
+}
+
+// redisSaveRefusal explains a failed connection without quoting the error,
+// which can name hosts and addresses.
+func redisSaveRefusal(err error) string {
+	if errors.Is(err, errRedisURLUnreadable) {
+		return "Prairie could not read redis.url as a Redis URL, so it could not check these settings. " +
+			"Save redis.url again in the form redis://host:port, then save the database number."
+	}
+	_, refused := errors.AsType[redis.Error](err)
+	if refused && errors.Is(err, errRedisChannelsRefused) {
+		return "Redis refused a subscription to Prairie's event channels, so the server would not start with these settings. " +
+			"If the Redis user has an ACL, grant it the channel pattern &prairie:*."
+	}
+	if refused {
+		return "Redis refused the connection, so the server would not start with these settings. " +
+			"Check the database number (0 to 15 on a Redis with the default 16 databases) and the user name and password in redis.url."
+	}
+	return "Prairie could not connect to Redis with these settings, so the server would not start with them. " +
+		"Check that Redis is running and that redis.url has the right host and port."
+}
diff --git a/internal/api/handlers/admin_settings_redis_save_test.go b/internal/api/handlers/admin_settings_redis_save_test.go
new file mode 100644
index 0000000000..71303bbf47
--- /dev/null
+++ b/internal/api/handlers/admin_settings_redis_save_test.go
@@ -0,0 +1,311 @@
+package handlers
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"maps"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/prairie-server/prairie-server/internal/config"
+)
+
+// acceptRedisSaves makes every Redis connection a save checks succeed, for
+// tests about what a save stores rather than whether Redis answers.
+func acceptRedisSaves(t *testing.T) {
+	t.Helper()
+	previous := probeRedis
+	probeRedis = func(context.Context, config.RedisConfig) error { return nil }
+	t.Cleanup(func() { probeRedis = previous })
+}
+
+// closedRedisURL returns a redis:// URL for a local port nothing listens on.
+func closedRedisURL(t *testing.T) string {
+	t.Helper()
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	address := listener.Addr().String()
+	if err := listener.Close(); err != nil {
+		t.Fatal(err)
+	}
+	return "redis://" + address
+}
+
+// saveRedisSetting saves one key through the single-key endpoint or the batch
+// one.
+func saveRedisSetting(t *testing.T, handler *AdminHandler, key, value string, single bool) *httptest.ResponseRecorder {
+	t.Helper()
+	rec := httptest.NewRecorder()
+	if single {
+		body, err := json.Marshal(map[string]string{"value": value})
+		if err != nil {
+			t.Fatal(err)
+		}
+		req := httptest.NewRequest(http.MethodPut, "/admin/settings/"+key, strings.NewReader(string(body)))
+		handler.HandleUpdateSetting(rec, withChiParam(req, "key", key))
+		return rec
+	}
+	body, err := json.Marshal(map[string]map[string]string{"values": {key: value}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	handler.HandleUpdateSettings(rec, httptest.NewRequest(http.MethodPut, "/admin/settings", strings.NewReader(string(body))))
+	return rec
+}
+
+// A start that cannot connect to the Redis its settings name stops the
+// server, and the value can then no longer be corrected in the admin UI.
+func TestAdminSettingsRefuseRedisSettingsTheServerCannotStartWith(t *testing.T) {
+	redis16, _ := fakeRedisServer(t, fakeRedis{databases: 16})
+	aclDenied, _ := fakeRedisServer(t, fakeRedis{denyChannels: true})
+	unreachable := closedRedisURL(t)
+	for _, tc := range []struct {
+		name       string
+		stored     map[string]string
+		key, value string
+		want       string
+	}{
+		{
+			name:  "a host nothing answers on",
+			key:   "redis.url",
+			value: unreachable,
+			want:  "Prairie could not connect to Redis",
+		},
+		{
+			name:  "a database number in redis.url the server does not have",
+			key:   "redis.url",
+			value: redis16 + "/99",
+			want:  "Redis refused the connection",
+		},
+		{
+			name:  "a Redis user whose ACL does not grant Prairie's channels",
+			key:   "redis.url",
+			value: aclDenied + "/2",
+			want:  "Redis refused a subscription to Prairie's event channels",
+		},
+		{
+			name:   "a redis.db the server does not have",
+			stored: map[string]string{"redis.url": redis16 + "/3"},
+			key:    config.RedisDBSettingKey,
+			value:  "16",
+			want:   "Redis refused the connection",
+		},
+	} {
+		for _, single := range []bool{false, true} {
+			stored := tc.stored
+			if stored == nil {
+				stored = map[string]string{}
+			}
+			settings := &fakeServerSettingsStore{values: maps.Clone(stored)}
+			rec := saveRedisSetting(t, &AdminHandler{SettingsRepo: settings}, tc.key, tc.value, single)
+
+			if rec.Code != http.StatusBadRequest || !strings.Contains(rec.Body.String(), "invalid_settings") {
+				t.Errorf("%s (single=%v): status = %d, body = %s; want a 400 invalid_settings", tc.name, single, rec.Code, rec.Body.String())
+			}
+			if !strings.Contains(rec.Body.String(), tc.want) {
+				t.Errorf("%s (single=%v): body = %s; want it to say %q", tc.name, single, rec.Body.String(), tc.want)
+			}
+			// The message is written by Prairie. The client error names the
+			// address, which the native API does not return.
+			if strings.Contains(rec.Body.String(), "127.0.0.1") {
+				t.Errorf("%s (single=%v): body = %s; want no address in it", tc.name, single, rec.Body.String())
+			}
+			if !maps.Equal(settings.values, stored) {
+				t.Errorf("%s (single=%v): stored %v, want %v left alone", tc.name, single, settings.values, stored)
+			}
+		}
+	}
+}
+
+func TestAdminSettingsSaveRedisSettingsTheServerCanStartWith(t *testing.T) {
+	t.Run("a database the server has is checked and stored", func(t *testing.T) {
+		for _, single := range []bool{false, true} {
+			redis16, checked := fakeRedisServer(t, fakeRedis{databases: 16})
+			settings := &fakeServerSettingsStore{values: map[string]string{"redis.url": redis16 + "/3"}}
+			handler := &AdminHandler{SettingsRepo: settings}
+
+			if rec := saveRedisSetting(t, handler, config.RedisDBSettingKey, "15", single); rec.Code != http.StatusOK {
+				t.Fatalf("single=%v: status = %d, want 200; body=%s", single, rec.Code, rec.Body.String())
+			}
+			if got := settings.values[config.RedisDBSettingKey]; got != "15" {
+				t.Errorf("single=%v: stored redis.db = %q, want 15", single, got)
+			}
+			select {
+			case db := <-checked:
+				if db != 15 {
+					t.Errorf("single=%v: checked database %d, want the 15 being saved", single, db)
+				}
+			default:
+				t.Errorf("single=%v: the save did not check the connection", single)
+			}
+		}
+	})
+
+	// The web form sends redis.url with other edits. A Redis that is down for
+	// a moment must not block them.
+	t.Run("a redis.url that does not change is not checked", func(t *testing.T) {
+		down := closedRedisURL(t) + "/3"
+		for _, single := range []bool{false, true} {
+			settings := &fakeServerSettingsStore{values: map[string]string{"redis.url": down}}
+			if rec := saveRedisSetting(t, &AdminHandler{SettingsRepo: settings}, "redis.url", down, single); rec.Code != http.StatusOK {
+				t.Errorf("single=%v: status = %d, want 200; body=%s", single, rec.Code, rec.Body.String())
+			}
+			if rec := saveRedisSetting(t, &AdminHandler{SettingsRepo: settings}, config.RedisDBSettingKey, "3", single); rec.Code != http.StatusOK {
+				t.Errorf("single=%v: redis.db the URL already names: status = %d, want 200; body=%s", single, rec.Code, rec.Body.String())
+			}
+		}
+	})
+
+	// A URL saved after the row can name the row's number. Clearing the row
+	// then leaves the number in use as it is.
+	t.Run("a redis.db row the URL already names is not checked", func(t *testing.T) {
+		down := closedRedisURL(t) + "/3"
+		for _, single := range []bool{false, true} {
+			settings := &fakeServerSettingsStore{values: map[string]string{"redis.url": down, "redis.db": "3"}}
+			if rec := saveRedisSetting(t, &AdminHandler{SettingsRepo: settings}, config.RedisDBSettingKey, "3", single); rec.Code != http.StatusOK {
+				t.Errorf("single=%v: status = %d, want 200; body=%s", single, rec.Code, rec.Body.String())
+			}
+		}
+	})
+
+	t.Run("clearing redis.url switches Redis off without a check", func(t *testing.T) {
+		for _, single := range []bool{false, true} {
+			settings := &fakeServerSettingsStore{values: map[string]string{"redis.url": closedRedisURL(t), "redis.db": "5"}}
+			if rec := saveRedisSetting(t, &AdminHandler{SettingsRepo: settings}, "redis.url", "", single); rec.Code != http.StatusOK {
+				t.Fatalf("single=%v: status = %d, want 200; body=%s", single, rec.Code, rec.Body.String())
+			}
+			if got := settings.values["redis.url"]; got != "" {
+				t.Errorf("single=%v: stored redis.url = %q, want it cleared", single, got)
+			}
+		}
+	})
+}
+
+// A batch checks the database number it stores against the URL it stores.
+func TestAdminSettingsCheckRedisURLAndDBSavedTogether(t *testing.T) {
+	redis16, checked := fakeRedisServer(t, fakeRedis{databases: 16})
+	settings := &fakeServerSettingsStore{values: map[string]string{"redis.url": closedRedisURL(t) + "/3"}}
+	body := `{"values":{"redis.url":"` + redis16 + `","redis.db":"7"}}`
+	rec := httptest.NewRecorder()
+	(&AdminHandler{SettingsRepo: settings}).HandleUpdateSettings(rec, httptest.NewRequest(http.MethodPut, "/admin/settings", strings.NewReader(body)))
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200; body=%s", rec.Code, rec.Body.String())
+	}
+	select {
+	case db := <-checked:
+		if db != 7 {
+			t.Errorf("checked database %d, want 7", db)
+		}
+	default:
+		t.Fatal("the save did not check the connection")
+	}
+	if settings.values["redis.url"] != redis16 || settings.values[config.RedisDBSettingKey] != "7" {
+		t.Errorf("stored %v, want the new URL and 7", settings.values)
+	}
+}
+
+// racingSettingsStore stores concurrent once a save has read the settings to
+// check its Redis connection, the way a second admin's save would land
+// between that check and the save's transaction.
+type racingSettingsStore struct {
+	*fakeServerSettingsStore
+	concurrent map[string]string
+}
+
+func (s *racingSettingsStore) GetAll(ctx context.Context) (map[string]string, error) {
+	values, err := s.fakeServerSettingsStore.GetAll(ctx)
+	maps.Copy(s.values, s.concurrent)
+	s.concurrent = nil
+	return values, err
+}
+
+func TestAdminSettingsRefuseRedisSaveWhenTheConnectionMovedDuringTheCheck(t *testing.T) {
+	redis16, _ := fakeRedisServer(t, fakeRedis{databases: 16})
+	for _, single := range []bool{false, true} {
+		moved := closedRedisURL(t)
+		settings := &racingSettingsStore{
+			fakeServerSettingsStore: &fakeServerSettingsStore{values: map[string]string{"redis.url": redis16 + "/3"}},
+			concurrent:              map[string]string{"redis.url": moved},
+		}
+		rec := saveRedisSetting(t, &AdminHandler{SettingsRepo: settings}, config.RedisDBSettingKey, "5", single)
+		if rec.Code != http.StatusBadRequest || !strings.Contains(rec.Body.String(), "changed while Prairie was checking") {
+			t.Errorf("single=%v: status = %d, body = %s; want the save refused", single, rec.Code, rec.Body.String())
+		}
+		if got, stored := settings.values[config.RedisDBSettingKey]; stored {
+			t.Errorf("single=%v: stored redis.db = %q next to a URL that was never checked with it", single, got)
+		}
+		if got := settings.values["redis.url"]; got != moved {
+			t.Errorf("single=%v: stored redis.url = %q, want the other save's URL left alone", single, got)
+		}
+	}
+}
+
+// A URL can turn the socket timeout off, as a number or as a duration. The
+// check still gives up when its time is up, so a Redis that accepts the
+// connection and never answers cannot hold a save, or its connection, open.
+func TestRedisCheckGivesUpOnARedisThatNeverAnswers(t *testing.T) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var (
+		mu    sync.Mutex
+		conns []net.Conn
+	)
+	t.Cleanup(func() {
+		_ = listener.Close()
+		mu.Lock()
+		defer mu.Unlock()
+		for _, conn := range conns {
+			_ = conn.Close()
+		}
+	})
+	go func() {
+		for {
+			conn, err := listener.Accept()
+			if err != nil {
+				return
+			}
+			mu.Lock()
+			conns = append(conns, conn)
+			mu.Unlock()
+		}
+	}()
+
+	for _, timeouts := range []string{"read_timeout=-1&write_timeout=-1", "read_timeout=-1s&write_timeout=-1s"} {
+		ctx, cancel := context.WithTimeout(t.Context(), 200*time.Millisecond)
+		done := make(chan error, 1)
+		go func() {
+			done <- probeRedis(ctx, config.RedisConfig{URL: "redis://" + listener.Addr().String() + "?" + timeouts})
+		}()
+		select {
+		case err := <-done:
+			if err == nil {
+				t.Errorf("%s: the check succeeded against a Redis that never answers", timeouts)
+			}
+		case <-time.After(5 * time.Second):
+			t.Fatalf("%s: the check was still waiting 5 seconds after its context ended", timeouts)
+		}
+		cancel()
+	}
+}
+
+// A redis.url an older build saved as a bare address cannot be checked. The
+// refusal says how to save it again rather than blaming the host.
+func TestRedisSaveRefusalForAnUnreadableURL(t *testing.T) {
+	err := probeRedis(t.Context(), config.RedisConfig{URL: "cache.example.invalid:6379", DB: "2"})
+	if !errors.Is(err, errRedisURLUnreadable) {
+		t.Fatalf("probe error = %v, want errRedisURLUnreadable", err)
+	}
+	if got := redisSaveRefusal(err); !strings.Contains(got, "redis://host:port") {
+		t.Errorf("refusal = %q, want it to say how to save redis.url again", got)
+	}
+}
diff --git a/internal/api/handlers/admin_split.go b/internal/api/handlers/admin_split.go
index 0130806175..28d4bcddc5 100644
--- a/internal/api/handlers/admin_split.go
+++ b/internal/api/handlers/admin_split.go
@@ -47,6 +47,15 @@ type AdminSplitHandler struct {
 	scanner      *scanner.Scanner
 	folderRepo   *catalog.FolderRepository
 	overrideRepo *scanner.MediaIdentityOverrideRepository
+	recsStaler   metadata.RecommendationStaler // may be nil
+}
+
+// SetRecommendationStaler installs what marks recommendations stale after a
+// split moves user state onto its target.
+func (h *AdminSplitHandler) SetRecommendationStaler(staler metadata.RecommendationStaler) {
+	if h != nil {
+		h.recsStaler = staler
+	}
 }
 
 // NewAdminSplitHandler wires the split/merge endpoints. metadataSvc, merger,
@@ -285,6 +294,7 @@ func (h *AdminSplitHandler) SplitAdminItem(ctx context.Context, sourceID string,
 			"history_ambiguous", report.HistoryAmbiguous,
 			"progress_moved", report.ProgressMoved,
 		)
+		metadata.MarkRecommendationsStale(ctx, h.recsStaler, metadata.MovedStateTargets(report, target.contentID, episodePairs)...)
 		h.runPostSplitFollowUps(sourceID, target, moved)
 	}
 
diff --git a/internal/api/handlers/admin_split_service_test.go b/internal/api/handlers/admin_split_service_test.go
index 55fa3c1b8b..3d0dfdfd9d 100644
--- a/internal/api/handlers/admin_split_service_test.go
+++ b/internal/api/handlers/admin_split_service_test.go
@@ -63,3 +63,71 @@ func TestAdminSplitDryRunRollbackAndCommit(t *testing.T) {
 		t.Fatalf("commit target %s %v", content, err)
 	}
 }
+
+// recordingRecommendationStaler records the item sets it is asked to mark.
+type recordingRecommendationStaler struct{ calls [][]string }
+
+func (s *recordingRecommendationStaler) MarkProfilesStaleForItems(_ context.Context, itemIDs []string) (int64, error) {
+	s.calls = append(s.calls, itemIDs)
+	return 0, nil
+}
+
+// A committed split that moves user state onto its target marks the
+// recommendations of the profiles with state there stale; a dry run, or a
+// split that moves no user state, marks nothing.
+func TestAdminSplitMarksRecommendationsStaleWhenStateMoves(t *testing.T) {
+	pool := catalogTransferPool(t)
+	suffix := fmt.Sprint(time.Now().UnixNano())
+	source, target := "split-recs-source-"+suffix, "split-recs-target-"+suffix
+	for _, id := range []string{source, target} {
+		if _, err := pool.Exec(t.Context(), `INSERT INTO media_items(content_id,type,title)VALUES($1,'movie',$1)`, id); err != nil {
+			t.Fatal(err)
+		}
+	}
+	var folder, userID int
+	if err := pool.QueryRow(t.Context(), `INSERT INTO media_folders(type,name)VALUES('movies',$1)RETURNING id`, suffix).Scan(&folder); err != nil {
+		t.Fatal(err)
+	}
+	if err := pool.QueryRow(t.Context(), `INSERT INTO users(username,role)VALUES($1,'user')RETURNING id`, "split-recs-"+suffix).Scan(&userID); err != nil {
+		t.Fatal(err)
+	}
+	ids := []int{}
+	for i := range 3 {
+		var id int
+		if err := pool.QueryRow(t.Context(), `INSERT INTO media_files(media_folder_id,file_path,content_id)VALUES($1,$2,$3)RETURNING id`, folder, fmt.Sprintf("/split-recs-fixture/%s/%d.mkv", suffix, i), source).Scan(&id); err != nil {
+			t.Fatal(err)
+		}
+		ids = append(ids, id)
+	}
+	t.Cleanup(func() {
+		ctx := context.Background()
+		_, _ = pool.Exec(ctx, `DELETE FROM users WHERE id=$1`, userID)
+		_, _ = pool.Exec(ctx, `DELETE FROM media_files WHERE id=ANY($1)`, ids)
+		_, _ = pool.Exec(ctx, `DELETE FROM media_items WHERE content_id=ANY($1)`, []string{source, target})
+		_, _ = pool.Exec(ctx, `DELETE FROM media_folders WHERE id=$1`, folder)
+	})
+	if _, err := pool.Exec(t.Context(), `INSERT INTO user_favorites(user_id,profile_id,media_item_id)VALUES($1,'p1',$2)`, userID, source); err != nil {
+		t.Fatal(err)
+	}
+	staler := &recordingRecommendationStaler{}
+	h := NewAdminSplitHandler(pool, &fakeItemLookup{items: map[string]*models.MediaItem{source: {ContentID: source, Type: "movie", Title: "Source"}, target: {ContentID: target, Type: "movie", Title: "Target"}}}, nil, nil, nil, nil, nil)
+	h.SetRecommendationStaler(staler)
+	split := func(fileID int, mode string, dryRun bool) {
+		t.Helper()
+		req := AdminSplitRequest{FileIDs: []int{fileID}, Target: AdminSplitTarget{ContentID: target}, HistoryMode: mode, PersistOverride: new(false), DryRun: dryRun}
+		if _, err := h.SplitAdminItem(t.Context(), source, req); err != nil {
+			t.Fatalf("split file %d (%s, dry run %v): %v", fileID, mode, dryRun, err)
+		}
+	}
+
+	split(ids[0], "move_all", true)
+	// Evidence mode leaves the favorite, an item-level intent, on the source.
+	split(ids[0], "evidence", false)
+	if len(staler.calls) != 0 {
+		t.Fatalf("marks after a dry run and a split that moved no user state = %v, want none", staler.calls)
+	}
+	split(ids[1], "move_all", false)
+	if len(staler.calls) != 1 || len(staler.calls[0]) != 1 || staler.calls[0][0] != target {
+		t.Fatalf("marks after moving the favorite = %v, want one for the target", staler.calls)
+	}
+}
diff --git a/internal/api/handlers/admin_stats_playback.go b/internal/api/handlers/admin_stats_playback.go
index 3641a32a82..16eb8be2f5 100644
--- a/internal/api/handlers/admin_stats_playback.go
+++ b/internal/api/handlers/admin_stats_playback.go
@@ -350,7 +350,7 @@ func queryAdminPlaybackActivity(ctx context.Context, pool *pgxpool.Pool, hours i
 
 	// profiles_active_24h deliberately excludes imported and provider-synced
 	// history so the tile means "watched on this server", not "appeared in
-	// someone's Trakt backlog". Manual marks stay in: they are on-server
+	// someone's provider backlog". Manual marks stay in: they are on-server
 	// actions.
 	row := tx.QueryRow(ctx, adminPlaybackSessionsCTE+`,
 		reliability AS (
diff --git a/internal/api/handlers/admin_stats_timeseries.go b/internal/api/handlers/admin_stats_timeseries.go
index 09bb8c583e..167ae37084 100644
--- a/internal/api/handlers/admin_stats_timeseries.go
+++ b/internal/api/handlers/admin_stats_timeseries.go
@@ -34,6 +34,10 @@ const (
 	// under. A dashboard widget is a few hundred CSS pixels wide, so a month of
 	// minutes would spend megabytes drawing sub-pixel detail nobody can see.
 	adminTimeseriesMaxPoints = 750
+
+	// bytesPerKbpsMinute converts one sampled minute at 1 kbps into bytes:
+	// 1000 bits/s × 60 s ÷ 8 bits per byte.
+	bytesPerKbpsMinute = 1000 * adminTimeseriesResolutionSeconds / 8
 )
 
 // timeseriesBucketSeconds picks the display bucket for a window, keeping every
@@ -95,12 +99,22 @@ type AdminTimeseriesPoint struct {
 //
 // ResolutionSeconds is the bucket this window was aggregated into, not a
 // constant: it widens with the requested window (timeseriesBucketSeconds).
+//
+// EgressBytes and DownloadEgressBytes are the data transferred over the whole
+// window, integrated from every sampled minute rather than from Points: the
+// points are peak-per-bucket, so summing them would count a one-minute spike
+// as if it lasted the whole bucket. Minutes the sampler missed contribute
+// nothing, and node egress is a rolling average, so the totals are a close
+// estimate rather than exact byte accounting. /api/v1 is frozen, so only v2
+// emits them (json:"-").
 type AdminTimeseries struct {
-	ResolutionSeconds int                    `json:"resolution_seconds"`
-	From              time.Time              `json:"from"`
-	To                time.Time              `json:"to"`
-	OldestSampleAt    *time.Time             `json:"oldest_sample_at"`
-	Points            []AdminTimeseriesPoint `json:"points"`
+	ResolutionSeconds   int                    `json:"resolution_seconds"`
+	From                time.Time              `json:"from"`
+	To                  time.Time              `json:"to"`
+	OldestSampleAt      *time.Time             `json:"oldest_sample_at"`
+	EgressBytes         int64                  `json:"-"`
+	DownloadEgressBytes int64                  `json:"-"`
+	Points              []AdminTimeseriesPoint `json:"points"`
 }
 
 // AdminTimeseriesSource returns cached or freshly queried samples for a window
@@ -227,6 +241,20 @@ type timeseriesRow struct {
 	Transcode          *int64
 	EgressKbps         int64
 	DownloadEgressKbps int64
+	// The Sum columns add up every sampled minute's rate in the bucket, which
+	// the transfer totals integrate; the Kbps columns above are the peak.
+	EgressKbpsSum         int64
+	DownloadEgressKbpsSum int64
+}
+
+// sumTransferredBytes integrates the per-minute rates of every bucket into
+// total bytes transferred over the window.
+func sumTransferredBytes(rows []timeseriesRow) (egressBytes, downloadBytes int64) {
+	for _, row := range rows {
+		egressBytes += row.EgressKbpsSum * bytesPerKbpsMinute
+		downloadBytes += row.DownloadEgressKbpsSum * bytesPerKbpsMinute
+	}
+	return egressBytes, downloadBytes
 }
 
 // assembleTimeseries turns grouped rows into response points, reading a missing
@@ -271,7 +299,9 @@ func queryAdminTimeseries(ctx context.Context, pool *pgxpool.Pool, hours int) (*
 	// The outer one collapses those minutes into the display bucket by taking
 	// the peak minute of each column. Averaging would erase the spikes these
 	// charts exist to show; a bucket therefore answers "the worst minute in
-	// here", and its columns may come from different minutes.
+	// here", and its columns may come from different minutes. The trailing
+	// SUM columns are the exception: they feed the window's transfer totals,
+	// which need every minute's rate, not the peak.
 	rows, err := pool.Query(ctx, `
 		WITH minutes AS (
 			SELECT bucket,
@@ -291,7 +321,9 @@ func queryAdminTimeseries(ctx context.Context, pool *pgxpool.Pool, hours int) (*
 		       MAX(streams_remux),
 		       MAX(streams_transcode),
 		       MAX(egress_kbps)::bigint,
-		       MAX(download_egress_kbps)::bigint
+		       MAX(download_egress_kbps)::bigint,
+		       SUM(egress_kbps)::bigint,
+		       SUM(download_egress_kbps)::bigint
 		FROM minutes
 		GROUP BY display_bucket
 		ORDER BY display_bucket
@@ -312,6 +344,8 @@ func queryAdminTimeseries(ctx context.Context, pool *pgxpool.Pool, hours int) (*
 			&row.Transcode,
 			&row.EgressKbps,
 			&row.DownloadEgressKbps,
+			&row.EgressKbpsSum,
+			&row.DownloadEgressKbpsSum,
 		); err != nil {
 			return nil, fmt.Errorf("scanning dashboard metric sample: %w", err)
 		}
@@ -325,6 +359,7 @@ func queryAdminTimeseries(ctx context.Context, pool *pgxpool.Pool, hours int) (*
 		ResolutionSeconds: bucketSeconds,
 		Points:            assembleTimeseries(grouped),
 	}
+	series.EgressBytes, series.DownloadEgressBytes = sumTransferredBytes(grouped)
 
 	// The window bounds come from the same clock the samples were bucketed
 	// with, so a client comparing them against point timestamps never sees the
diff --git a/internal/api/handlers/admin_stats_timeseries_test.go b/internal/api/handlers/admin_stats_timeseries_test.go
index 38133b063e..34ffcec18c 100644
--- a/internal/api/handlers/admin_stats_timeseries_test.go
+++ b/internal/api/handlers/admin_stats_timeseries_test.go
@@ -114,6 +114,56 @@ func TestAssembleTimeseries(t *testing.T) {
 	}
 }
 
+func TestSumTransferredBytes(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name         string
+		rows         []timeseriesRow
+		wantEgress   int64
+		wantDownload int64
+	}{
+		{
+			name: "no samples transfer nothing",
+		},
+		{
+			// One minute at 8 kbps is 8,000 bits/s for 60 s: 60,000 bytes.
+			name:       "one minute converts kbps to bytes",
+			rows:       []timeseriesRow{{EgressKbpsSum: 8}},
+			wantEgress: 60_000,
+		},
+		{
+			// The totals integrate the per-minute sums, never the bucket
+			// peaks: a bucket whose peak minute hit 1,000 kbps but whose
+			// minutes added up to 1,200 kbps moved 1,200 kbps-minutes.
+			name: "buckets integrate the sum, not the peak",
+			rows: []timeseriesRow{
+				{EgressKbps: 1_000, EgressKbpsSum: 1_200, DownloadEgressKbps: 400, DownloadEgressKbpsSum: 500},
+				{EgressKbps: 50, EgressKbpsSum: 50},
+			},
+			wantEgress:   1_250 * bytesPerKbpsMinute,
+			wantDownload: 500 * bytesPerKbpsMinute,
+		},
+		{
+			// A month of minutes at 10 Gbps must not overflow.
+			name:       "a busy month fits in int64",
+			rows:       []timeseriesRow{{EgressKbpsSum: 10_000_000 * 31 * 24 * 60}},
+			wantEgress: 10_000_000 * 31 * 24 * 60 * bytesPerKbpsMinute,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			egress, download := sumTransferredBytes(tt.rows)
+			if egress != tt.wantEgress || download != tt.wantDownload {
+				t.Fatalf("sumTransferredBytes = (%d, %d), want (%d, %d)", egress, download, tt.wantEgress, tt.wantDownload)
+			}
+		})
+	}
+}
+
 func TestTimeseriesBucketSeconds(t *testing.T) {
 	t.Parallel()
 
@@ -240,8 +290,10 @@ func TestHandleGetTimeseriesFreshInstallSerializesCollectingState(t *testing.T)
 	t.Parallel()
 
 	source := &stubTimeseriesSource{series: &AdminTimeseries{
-		ResolutionSeconds: adminTimeseriesResolutionSeconds,
-		Points:            []AdminTimeseriesPoint{},
+		ResolutionSeconds:   adminTimeseriesResolutionSeconds,
+		EgressBytes:         1,
+		DownloadEgressBytes: 1,
+		Points:              []AdminTimeseriesPoint{},
 	}}
 	handler := &AdminHandler{TimeseriesSource: source}
 	rec := httptest.NewRecorder()
@@ -254,6 +306,8 @@ func TestHandleGetTimeseriesFreshInstallSerializesCollectingState(t *testing.T)
 		ResolutionSeconds int               `json:"resolution_seconds"`
 		Points            []json.RawMessage `json:"points"`
 		OldestSampleAt    *string           `json:"oldest_sample_at"`
+		EgressBytes       *int64            `json:"egress_bytes"`
+		DownloadBytes     *int64            `json:"download_egress_bytes"`
 	}
 	if err := json.NewDecoder(rec.Body).Decode(&body); err != nil {
 		t.Fatalf("decode body: %v", err)
@@ -270,6 +324,11 @@ func TestHandleGetTimeseriesFreshInstallSerializesCollectingState(t *testing.T)
 	if body.ResolutionSeconds != adminTimeseriesResolutionSeconds {
 		t.Fatalf("resolution_seconds = %d, want %d", body.ResolutionSeconds, adminTimeseriesResolutionSeconds)
 	}
+	// /api/v1 is frozen: the window totals are v2-only and must not leak into
+	// the bridge contract.
+	if body.EgressBytes != nil || body.DownloadBytes != nil {
+		t.Fatalf("egress_bytes = %v, download_egress_bytes = %v, want both absent from v1", body.EgressBytes, body.DownloadBytes)
+	}
 }
 
 func TestAdminTimeseriesProviderInvalidateClearsEveryWindow(t *testing.T) {
diff --git a/internal/api/handlers/admin_subtitle_inspection.go b/internal/api/handlers/admin_subtitle_inspection.go
index 181615c8b3..be16ff5392 100644
--- a/internal/api/handlers/admin_subtitle_inspection.go
+++ b/internal/api/handlers/admin_subtitle_inspection.go
@@ -6,6 +6,7 @@ import (
 	"net/http"
 	"time"
 
+	"github.com/prairie-server/prairie-server/internal/logredact"
 	"github.com/prairie-server/prairie-server/internal/subtitles"
 )
 
@@ -64,7 +65,7 @@ func (h *AdminSubtitleHandler) TestSubtitleProvider(ctx context.Context, provide
 		Languages: []string{"en"},
 	})
 	if err != nil {
-		return SubtitleProviderTestView{Error: err.Error()}
+		return SubtitleProviderTestView{Error: logredact.SanitizeText(logredact.SanitizeURLError(err).Error())}
 	}
 
 	if len(results) == 0 {
diff --git a/internal/api/handlers/admin_task_jobs_service.go b/internal/api/handlers/admin_task_jobs_service.go
index 3b763d23b3..f4afdde765 100644
--- a/internal/api/handlers/admin_task_jobs_service.go
+++ b/internal/api/handlers/admin_task_jobs_service.go
@@ -5,12 +5,14 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"log/slog"
 	"path"
 	"time"
 
 	"github.com/prairie-server/prairie-server/internal/adminjob"
 	"github.com/prairie-server/prairie-server/internal/blobstore"
 	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/notifications"
 	"github.com/prairie-server/prairie-server/internal/s3client"
 )
 
@@ -107,7 +109,47 @@ func (h *AdminJobsHandler) RequestAdminTaskJobCancellation(ctx context.Context,
 	if !ok {
 		return nil, fmt.Errorf("admin job cancellation unavailable")
 	}
-	return repo.RequestCancellation(ctx, id)
+	job, err := repo.RequestCancellation(ctx, id)
+	if err != nil {
+		return nil, err
+	}
+	if job.JobType != adminjob.JobTypeImageCacheCleanup {
+		return job, nil
+	}
+	switch job.Status {
+	case adminjob.StatusRunning:
+		// The flag reaches a cleanup running on any node at its next cancel
+		// poll. When it runs in this process, stop it now instead of one poll
+		// later.
+		if h.CancelRegistry != nil {
+			h.CancelRegistry.Cancel(job.ID)
+		}
+	case adminjob.StatusQueued:
+		// A queued cleanup, new or yielded between slices, holds nothing to
+		// release, so end it now rather than when a runner next claims it,
+		// which can be hours away behind other cleanups. If a runner claims it
+		// first, the claim sees the flag and ends it.
+		canceled, cancelErr := h.repo.CancelQueued(ctx, job.ID,
+			adminjob.QueuedImageCacheCleanupCanceledMessage(job.ProgressCurrent, job.ProgressTotal),
+			time.Now().UTC().Add(7*24*time.Hour))
+		if cancelErr != nil {
+			if !errors.Is(cancelErr, adminjob.ErrJobNotCancellable) {
+				slog.WarnContext(ctx, "admin jobs: failed to cancel queued image cache cleanup", "component", "api", "job_id", job.ID, "error", cancelErr)
+				return job, nil
+			}
+			// A runner claimed the job first. Report its current state: the
+			// claim may already have ended it from the flag.
+			if advanced, loadErr := h.repo.GetByID(ctx, job.ID); loadErr == nil {
+				return advanced, nil
+			}
+			return job, nil
+		}
+		if h.RealtimeHub != nil {
+			publishEventJob(ctx, h.RealtimeHub.EventsHub(), string(notifications.TypeJobCancelled), canceled)
+		}
+		return canceled, nil
+	}
+	return job, nil
 }
 func (h *AdminJobsHandler) AdminTaskJobDownload(ctx context.Context, job *models.AdminJob) (string, *time.Time) {
 	if h.store == nil || job.Status != adminjob.StatusCompleted || job.ArtifactBucket == "" || job.ArtifactKey == "" {
diff --git a/internal/api/handlers/admin_task_jobs_service_test.go b/internal/api/handlers/admin_task_jobs_service_test.go
index 4a5adff889..974d32b2d2 100644
--- a/internal/api/handlers/admin_task_jobs_service_test.go
+++ b/internal/api/handlers/admin_task_jobs_service_test.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"io"
 	"testing"
+	"time"
 
 	"github.com/prairie-server/prairie-server/internal/adminjob"
 	"github.com/prairie-server/prairie-server/internal/blobstore"
@@ -50,3 +51,92 @@ func TestOpenAdminJobArtifactReportsMissingObjectAsNotFound(t *testing.T) {
 		t.Fatalf("err = %v, want ErrJobArtifactNotFound", err)
 	}
 }
+
+type cancellationRequestingRepository struct {
+	fakeAdminJobRepository
+}
+
+func (r *cancellationRequestingRepository) RequestCancellation(_ context.Context, id string) (*models.AdminJob, error) {
+	if r.job == nil || r.job.ID != id {
+		return nil, adminjob.ErrJobNotFound
+	}
+	r.job.CancelRequested = true
+	cp := *r.job
+	return &cp, nil
+}
+
+// The cancel endpoint sets the shared flag that any node's runner polls. A
+// cleanup running in this process is also stopped through the cancel
+// registry, so it does not keep deleting until the next poll.
+func TestRequestAdminTaskJobCancellationStopsALocalImageCacheCleanup(t *testing.T) {
+	job := &models.AdminJob{ID: "cleanup", JobType: adminjob.JobTypeImageCacheCleanup, Status: adminjob.StatusRunning}
+	h := NewAdminJobsHandler(&cancellationRequestingRepository{fakeAdminJobRepository{job: job}}, nil)
+	h.CancelRegistry = adminjob.NewCancelRegistry()
+	stopped := false
+	defer h.CancelRegistry.Register(job.ID, func() { stopped = true })()
+
+	got, err := h.RequestAdminTaskJobCancellation(context.Background(), job.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !got.CancelRequested || !stopped {
+		t.Fatalf("cancel_requested=%v stopped=%v, want the flag set and the local cleanup stopped", got.CancelRequested, stopped)
+	}
+}
+
+// A queued cleanup, new or yielded between slices, is ended by the cancel
+// request itself rather than left canceling until a runner claims it.
+func TestRequestAdminTaskJobCancellationEndsAQueuedImageCacheCleanup(t *testing.T) {
+	job := &models.AdminJob{ID: "cleanup", JobType: adminjob.JobTypeImageCacheCleanup, Status: adminjob.StatusQueued, ProgressCurrent: 3, ProgressTotal: 8}
+	h := NewAdminJobsHandler(&cancellationRequestingRepository{fakeAdminJobRepository{job: job}}, nil)
+
+	got, err := h.RequestAdminTaskJobCancellation(context.Background(), job.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Status != adminjob.StatusCancelled || got.Message != adminjob.QueuedImageCacheCleanupCanceledMessage(3, 8) {
+		t.Fatalf("status=%q message=%q, want the queued cleanup canceled at once", got.Status, got.Message)
+	}
+}
+
+// When a runner claims the cleanup between the flag and the queued cancel, the
+// request still succeeds and the claim ends the job from the flag.
+func TestRequestAdminTaskJobCancellationLeavesAClaimedCleanupToItsRunner(t *testing.T) {
+	job := &models.AdminJob{ID: "cleanup", JobType: adminjob.JobTypeImageCacheCleanup, Status: adminjob.StatusQueued}
+	h := NewAdminJobsHandler(&cancellationRequestingRepository{fakeAdminJobRepository{job: job, promoteToRunningOnCancelQueued: true}}, nil)
+
+	got, err := h.RequestAdminTaskJobCancellation(context.Background(), job.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Status == adminjob.StatusCancelled || !got.CancelRequested {
+		t.Fatalf("status=%q cancel_requested=%v, want a pending cancel left to the runner", got.Status, got.CancelRequested)
+	}
+}
+
+type claimCancelsFirstRepository struct {
+	cancellationRequestingRepository
+}
+
+func (r *claimCancelsFirstRepository) CancelQueued(context.Context, string, string, time.Time) (*models.AdminJob, error) {
+	cp := *r.job
+	cp.Status = adminjob.StatusCancelled
+	r.job = &cp
+	return nil, adminjob.ErrJobNotCancellable
+}
+
+// When a runner claims the flagged cleanup and ends it before the queued
+// cancel runs, the request reports the canceled job rather than the stale
+// queued one.
+func TestRequestAdminTaskJobCancellationReportsACleanupItsClaimEnded(t *testing.T) {
+	job := &models.AdminJob{ID: "cleanup", JobType: adminjob.JobTypeImageCacheCleanup, Status: adminjob.StatusQueued}
+	h := NewAdminJobsHandler(&claimCancelsFirstRepository{cancellationRequestingRepository{fakeAdminJobRepository{job: job}}}, nil)
+
+	got, err := h.RequestAdminTaskJobCancellation(context.Background(), job.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.Status != adminjob.StatusCancelled {
+		t.Fatalf("status=%q, want the canceled job the claim recorded", got.Status)
+	}
+}
diff --git a/internal/api/handlers/admin_translation_library.go b/internal/api/handlers/admin_translation_library.go
new file mode 100644
index 0000000000..ad11ac538c
--- /dev/null
+++ b/internal/api/handlers/admin_translation_library.go
@@ -0,0 +1,89 @@
+package handlers
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"net/http"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/metadata/translation"
+	"github.com/prairie-server/prairie-server/internal/models"
+)
+
+// metadataAILibraryLookup resolves the library a prewarm targets.
+type metadataAILibraryLookup interface {
+	GetByID(ctx context.Context, id int) (*models.MediaFolder, error)
+}
+
+func (h *MetadataAIHandler) libraryNotConfigured() error {
+	return apiError(http.StatusServiceUnavailable, "not_configured", "Metadata AI translation is not configured on this server")
+}
+
+// ensureLibrary answers 404 for an unknown library.
+func (h *MetadataAIHandler) ensureLibrary(ctx context.Context, libraryID int) error {
+	if h.Libraries == nil {
+		return h.libraryNotConfigured()
+	}
+	folder, err := h.Libraries.GetByID(ctx, libraryID)
+	if errors.Is(err, catalog.ErrFolderNotFound) || (err == nil && folder == nil) {
+		return apiError(http.StatusNotFound, "not_found", "Library not found")
+	}
+	if err != nil {
+		return apiError(http.StatusInternalServerError, "internal_error", "Failed to load library")
+	}
+	return nil
+}
+
+// TranslateLibraryMetadata queues the prewarm of a library's missing
+// localizations for language, or returns the active one.
+func (h *MetadataAIHandler) TranslateLibraryMetadata(ctx context.Context, libraryID int, language string, userID int) (*translation.Job, error) {
+	if language == "" {
+		return nil, fieldError("target_language", "target_language is required")
+	}
+	if h == nil || h.service == nil {
+		return nil, h.libraryNotConfigured()
+	}
+	if err := h.ensureLibrary(ctx, libraryID); err != nil {
+		return nil, err
+	}
+	var requestedBy *int
+	if userID != 0 {
+		requestedBy = new(userID)
+	}
+	job, err := h.service.EnqueueLibrary(ctx, libraryID, language, requestedBy)
+	if err != nil {
+		switch {
+		case errors.Is(err, translation.ErrNotConfigured):
+			return nil, h.libraryNotConfigured()
+		case errors.Is(err, translation.ErrInvalidRequest):
+			return nil, fieldError("target_language", err.Error())
+		}
+		slog.ErrorContext(ctx, "failed to enqueue library metadata translation", "component", "api", "library_id", libraryID, "error", err)
+		return nil, apiError(http.StatusInternalServerError, "internal_error", "Failed to start translation")
+	}
+	return job, nil
+}
+
+// ListLibraryMetadataTranslationJobs returns a library's recent prewarm jobs.
+func (h *MetadataAIHandler) ListLibraryMetadataTranslationJobs(ctx context.Context, libraryID int) ([]translation.Job, error) {
+	if h == nil || h.service == nil {
+		return nil, h.libraryNotConfigured()
+	}
+	if err := h.ensureLibrary(ctx, libraryID); err != nil {
+		return nil, err
+	}
+	jobs, err := h.service.ListJobs(ctx, translation.LibraryContentID(libraryID))
+	if err != nil {
+		return nil, apiError(http.StatusInternalServerError, "list_error", "Failed to list jobs")
+	}
+	return jobs, nil
+}
+
+// CancelLibraryMetadataTranslation cancels a prewarm job of the library.
+func (h *MetadataAIHandler) CancelLibraryMetadataTranslation(ctx context.Context, libraryID int, jobID int64) error {
+	if h == nil || h.service == nil {
+		return h.libraryNotConfigured()
+	}
+	return h.CancelAdminMetadataTranslation(ctx, translation.LibraryContentID(libraryID), jobID)
+}
diff --git a/internal/api/handlers/admin_user_policy_test.go b/internal/api/handlers/admin_user_policy_test.go
index 8e8bd1564b..db6aa82c3f 100644
--- a/internal/api/handlers/admin_user_policy_test.go
+++ b/internal/api/handlers/admin_user_policy_test.go
@@ -65,7 +65,6 @@ func TestToAdminUserResponseReportsOverridesAndEffectivePolicy(t *testing.T) {
 		Enabled:         true,
 		MaxStreams:      ptrOf(6),
 		DownloadAllowed: ptrOf(true),
-		MaxProfiles:     5,
 		AccessGroupID:   &groupID,
 	}
 	group := &access.GroupPolicy{
@@ -78,6 +77,7 @@ func TestToAdminUserResponseReportsOverridesAndEffectivePolicy(t *testing.T) {
 		AudioTranscodeAllowed:    true,
 		MaxStreams:               2,
 		MaxTranscodes:            1,
+		MaxProfiles:              3,
 		RequestsAllowed:          true,
 	}
 
@@ -88,7 +88,8 @@ func TestToAdminUserResponseReportsOverridesAndEffectivePolicy(t *testing.T) {
 		t.Fatalf("overrides = streams %v download %v, want 6/true", resp.MaxStreams, resp.DownloadAllowed)
 	}
 	if resp.MaxTranscodes != nil || resp.MaxPlaybackQuality != nil || resp.TranscodeAllowed != nil ||
-		resp.AudioTranscodeAllowed != nil || resp.DownloadTranscodeAllowed != nil || resp.RequestsAllowed != nil || resp.LibraryIDs != nil {
+		resp.AudioTranscodeAllowed != nil || resp.DownloadTranscodeAllowed != nil || resp.RequestsAllowed != nil || resp.LibraryIDs != nil ||
+		resp.MaxProfilesOverride != nil {
 		t.Fatalf("inherited fields must serialize as null, got %+v", resp)
 	}
 
@@ -98,6 +99,7 @@ func TestToAdminUserResponseReportsOverridesAndEffectivePolicy(t *testing.T) {
 		MaxPlaybackQuality:       access.PlaybackQualityStandard,
 		MaxStreams:               6,
 		MaxTranscodes:            1,
+		MaxProfiles:              3,
 		TranscodeAllowed:         true,
 		AudioTranscodeAllowed:    true,
 		DownloadAllowed:          true,
@@ -121,6 +123,11 @@ func TestToAdminUserResponseReportsOverridesAndEffectivePolicy(t *testing.T) {
 	if decoded["max_transcodes"] != nil || decoded["library_ids"] != nil {
 		t.Fatalf("inherited fields should be JSON null, got %v / %v", decoded["max_transcodes"], decoded["library_ids"])
 	}
+	// The frozen v1 body has no inherit state for the profile limit: it
+	// carries the limit that applies.
+	if decoded["max_profiles"] != float64(3) {
+		t.Fatalf("max_profiles JSON = %v, want the inherited 3", decoded["max_profiles"])
+	}
 	effective, ok := decoded["effective_policy"].(map[string]any)
 	if !ok || effective["max_streams"] != float64(6) || effective["download_allowed"] != true {
 		t.Fatalf("effective_policy JSON = %v", decoded["effective_policy"])
diff --git a/internal/api/handlers/admin_users_service.go b/internal/api/handlers/admin_users_service.go
index 471064686d..4b01e96c23 100644
--- a/internal/api/handlers/admin_users_service.go
+++ b/internal/api/handlers/admin_users_service.go
@@ -216,7 +216,7 @@ func (h *AdminHandler) UpdateAdminAccount(ctx context.Context, id int, revision,
 	if input.Role != nil && *input.Role != roleAdmin && *input.Role != models.RoleUser {
 		return 0, fieldError("role", "Role must be admin or user")
 	}
-	if input.MaxProfiles != nil && *input.MaxProfiles < 1 {
+	if input.MaxProfiles.Value != nil && *input.MaxProfiles.Value < 1 {
 		return 0, fieldError("max_profiles", "Must be at least 1")
 	}
 	if err := validateStreamLimits(input.MaxStreams.Value, input.MaxTranscodes.Value); err != nil {
@@ -281,6 +281,9 @@ func (h *AdminHandler) UpdateAdminAccount(ctx context.Context, id int, revision,
 	if revoked && h.OnUserSessionsRevoked != nil {
 		h.OnUserSessionsRevoked(ctx, id)
 	}
+	if accountScopeChanged(input) {
+		notifyAccountsScopeChanged(ctx, h.RecWorker, id)
+	}
 	return snapshot.Revision, nil
 }
 func (h *AdminHandler) DeleteAdminAccount(ctx context.Context, id int, revision, groupRevision int64) error {
diff --git a/internal/api/handlers/artwork_widths_test.go b/internal/api/handlers/artwork_widths_test.go
new file mode 100644
index 0000000000..b2058d9fb6
--- /dev/null
+++ b/internal/api/handlers/artwork_widths_test.go
@@ -0,0 +1,251 @@
+package handlers
+
+import (
+	"context"
+	"slices"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/imagesize"
+	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/recommendations"
+)
+
+// The TV spec's home request: medium cards, a 4K hero backdrop and logo. Each
+// slot resolves on its own ladder, and an episode still in the backdrop slot
+// follows the backdrop width.
+var tvHomeArtwork = imagesize.Request{
+	Size:   imagesize.Medium,
+	Widths: imagesize.Widths{Backdrop: 2688, Logo: 1760},
+}
+
+func TestFeaturedArtworkResolvesEachSlotAtItsWidth(t *testing.T) {
+	resolver := &countingSectionImageResolver{}
+	detailSvc := &catalog.DetailService{}
+	detailSvc.SetImageResolver(resolver)
+
+	cards := []featuredArtworkCard[string]{
+		{key: "movie", item: &models.MediaItem{
+			ContentID:    "movie",
+			PosterPath:   "tmdb/movies/1/poster/original.r1.webp",
+			BackdropPath: "tmdb/movies/1/backdrop/original.r1.webp",
+			LogoPath:     "tmdb/movies/1/logo/original.r1.webp",
+		}},
+		{key: "episode", item: &models.MediaItem{
+			ContentID:    "episode",
+			BackdropPath: "tmdb/series/2/seasons/1/episodes/3/still/original.r2.webp",
+		}},
+	}
+	urls := resolveFeaturedArtwork(t.Context(), detailSvc, cards, tvHomeArtwork)
+
+	if resolver.batchCalls != 1 || resolver.singleCalls != 0 {
+		t.Fatalf("batch=%d single=%d, want one batch", resolver.batchCalls, resolver.singleCalls)
+	}
+	want := map[string]sectionItemImageURLs{
+		"movie": {
+			posterURL:   "resolved:tmdb/movies/1/poster/w500.r1.webp",
+			backdropURL: "resolved:tmdb/movies/1/backdrop/original.r1.webp",
+			logoURL:     "resolved:tmdb/movies/1/logo/original.r1.webp",
+		},
+		"episode": {
+			backdropURL: "resolved:tmdb/series/2/seasons/1/episodes/3/still/original.r2.webp",
+		},
+	}
+	for key, w := range want {
+		if urls[key] != w {
+			t.Errorf("%s artwork = %+v, want %+v", key, urls[key], w)
+		}
+	}
+	// Cached keys share one batch at image_size's hint, which only names the
+	// resolver's URL cache entry for them.
+	if resolver.variant != imagesize.PluginVariantFeatured {
+		t.Errorf("hint = %q, want %q", resolver.variant, imagesize.PluginVariantFeatured)
+	}
+}
+
+// Android TV's 1080p hero is 1344px of backdrop: the w1920 rung covers it, the
+// w200 TV poster rung covers a 176px card, and the logo's w500 covers 480px.
+func TestFeaturedArtworkPicksNarrowestCoveringRung(t *testing.T) {
+	item := &models.MediaItem{
+		PosterPath:   "tmdb/movies/1/poster/original.r1.webp",
+		BackdropPath: "tmdb/movies/1/backdrop/original.r1.webp",
+		LogoPath:     "tmdb/movies/1/logo/original.r1.webp",
+	}
+	got := featuredItemArtworkPaths(item, "", imagesize.Request{Widths: imagesize.Widths{Poster: 176, Backdrop: 1344, Logo: 480}})
+	want := featuredArtworkPaths{
+		posterPath:   "tmdb/movies/1/poster/w200.r1.webp",
+		backdropPath: "tmdb/movies/1/backdrop/w1920.r1.webp",
+		logoPath:     "tmdb/movies/1/logo/w500.r1.webp",
+	}
+	if got != want {
+		t.Fatalf("paths = %+v, want %+v", got, want)
+	}
+}
+
+// Plugin-hosted art has no cached rungs, so the slot's width reaches the
+// plugin as its hint: a 4K hero backdrop asks for the original while the card
+// poster beside it stays at the featured size.
+func TestFeaturedArtworkSendsPluginsEachSlotsHint(t *testing.T) {
+	presigner := &hintRecordingPresigner{}
+	cards := []featuredArtworkCard[string]{{key: "movie", item: &models.MediaItem{
+		ContentID:    "movie",
+		PosterPath:   "tmdb://poster/p.jpg",
+		BackdropPath: "tmdb://backdrop/b.jpg",
+		LogoPath:     "tmdb://logo/l.png",
+	}}}
+	urls := resolveFeaturedArtwork(t.Context(), presigner, cards, tvHomeArtwork)
+
+	want := sectionItemImageURLs{
+		posterURL:   imagesize.PluginVariantFeatured + ":tmdb://poster/p.jpg",
+		backdropURL: imagesize.PluginVariantOriginal + ":tmdb://backdrop/b.jpg",
+		logoURL:     imagesize.PluginVariantOriginal + ":tmdb://logo/l.png",
+	}
+	if urls["movie"] != want {
+		t.Fatalf("artwork = %+v, want %+v", urls["movie"], want)
+	}
+}
+
+type hintRecordingPresigner struct{}
+
+func (hintRecordingPresigner) PresignURLsWithExpiry(_ context.Context, paths []string, variant string) map[string]catalog.ResolvedImageURL {
+	out := make(map[string]catalog.ResolvedImageURL, len(paths))
+	for _, path := range paths {
+		out[path] = catalog.ResolvedImageURL{URL: variant + ":" + path}
+	}
+	return out
+}
+
+// Recommendation cards resolve through the featured resolver in one batch,
+// at the request's artwork, rather than one presign per image.
+func TestRecommendationCardsBatchArtworkAtRequestedWidths(t *testing.T) {
+	resolver := &countingSectionImageResolver{}
+	detailSvc := &catalog.DetailService{}
+	detailSvc.SetImageResolver(resolver)
+	h := &RecommendationsHandler{DetailSvc: detailSvc}
+
+	items := map[string]*models.MediaItem{
+		"a": {ContentID: "a", PosterPath: "tmdb/movies/1/poster/original.r1.webp", BackdropPath: "tmdb/movies/1/backdrop/original.r1.webp"},
+		"b": {ContentID: "b", PosterPath: "tmdb/movies/2/poster/original.r2.webp", LogoPath: "tmdb/movies/2/logo/original.r2.webp"},
+	}
+	enrichment := &itemEnrichment{items: items}
+	artwork := h.featuredCardArtwork(t.Context(), items, tvHomeArtwork)
+	cards := h.buildSectionItems(t.Context(),
+		[]recommendations.ScoredItem{{MediaItemID: "a"}, {MediaItemID: "b"}}, enrichment, nil, artwork)
+
+	if resolver.batchCalls != 1 || resolver.singleCalls != 0 {
+		t.Fatalf("batch=%d single=%d, want one batch", resolver.batchCalls, resolver.singleCalls)
+	}
+	if len(cards) != 2 {
+		t.Fatalf("cards = %d, want 2", len(cards))
+	}
+	if got, want := cards[0].BackdropURL, "resolved:tmdb/movies/1/backdrop/original.r1.webp"; got != want {
+		t.Errorf("hero backdrop = %q, want %q", got, want)
+	}
+	if got, want := cards[1].PosterURL, "resolved:tmdb/movies/2/poster/w500.r2.webp"; got != want {
+		t.Errorf("card poster = %q, want %q", got, want)
+	}
+	if got, want := cards[1].LogoURL, "resolved:tmdb/movies/2/logo/original.r2.webp"; got != want {
+		t.Errorf("logo = %q, want %q", got, want)
+	}
+}
+
+// Without sizes, recommendation cards keep the keys and hint they always had,
+// which the frozen /api/v1 routes depend on: the featured poster and backdrop,
+// the stored logo, and the featured plugin hint.
+func TestRecommendationCardsUnsizedKeepTheirArtwork(t *testing.T) {
+	resolver := &countingSectionImageResolver{}
+	detailSvc := &catalog.DetailService{}
+	detailSvc.SetImageResolver(resolver)
+	h := &RecommendationsHandler{DetailSvc: detailSvc}
+
+	items := map[string]*models.MediaItem{"a": {
+		ContentID:    "a",
+		PosterPath:   "tmdb/movies/1/poster/original.r1.webp",
+		BackdropPath: "tmdb/movies/1/backdrop/original.r1.webp",
+		LogoPath:     "tmdb/movies/1/logo/original.r1.webp",
+	}}
+	got := h.featuredCardArtwork(t.Context(), items, imagesize.Request{})["a"]
+	want := sectionItemImageURLs{
+		posterURL:   "resolved:" + featuredPosterPath(items["a"].PosterPath),
+		backdropURL: "resolved:" + featuredBackdropPath(items["a"].BackdropPath),
+		logoURL:     "resolved:" + items["a"].LogoPath,
+	}
+	if got != want {
+		t.Fatalf("artwork = %+v, want %+v", got, want)
+	}
+	if resolver.variant != imagesize.PluginVariantFeatured {
+		t.Errorf("hint = %q, want %q", resolver.variant, imagesize.PluginVariantFeatured)
+	}
+}
+
+// Watch Tonight cards fill cast headshots on the profile ladder, w500 unsized
+// like item detail, in one batch; an http(s) photo passes through.
+func TestWatchTonightCastPhotosResolveOnProfileLadder(t *testing.T) {
+	resolver := &countingSectionImageResolver{}
+	detailSvc := &catalog.DetailService{}
+	detailSvc.SetImageResolver(resolver)
+	h := &RecommendationsHandler{DetailSvc: detailSvc}
+
+	cards := []swipeCardResponse{{Cast: []swipeCardCastMember{
+		{Name: "Cached", photoPath: "tmdb/people/1/profile/original.r1.webp"},
+		{Name: "Remote", photoPath: "https://image.example.invalid/p.jpg"},
+		{Name: "None"},
+	}}}
+	h.resolveCastPhotos(t.Context(), cards, imagesize.Unset)
+
+	cast := cards[0].Cast
+	if got, want := cast[0].PhotoURL, "resolved:tmdb/people/1/profile/w500.r1.webp"; got != want {
+		t.Errorf("cached photo = %q, want %q", got, want)
+	}
+	if got, want := cast[1].PhotoURL, "https://image.example.invalid/p.jpg"; got != want {
+		t.Errorf("remote photo = %q, want %q", got, want)
+	}
+	if cast[2].PhotoURL != "" {
+		t.Errorf("photo without a path = %q, want empty", cast[2].PhotoURL)
+	}
+	if resolver.batchCalls != 1 || !slices.Equal(resolver.paths, []string{"tmdb/people/1/profile/w500.r1.webp"}) {
+		t.Fatalf("batch=%d paths=%v, want one batch of the cached headshot", resolver.batchCalls, resolver.paths)
+	}
+
+	// A plugin-hosted photo keeps its path; the plugin hint picks the size.
+	plugin := []swipeCardResponse{{Cast: []swipeCardCastMember{{Name: "Plugin", photoPath: "metadb://images/abc/original.jpg"}}}}
+	h.resolveCastPhotos(t.Context(), plugin, imagesize.Unset)
+	if got, want := plugin[0].Cast[0].PhotoURL, "resolved:metadb://images/abc/original.jpg"; got != want {
+		t.Errorf("plugin photo = %q, want %q", got, want)
+	}
+	if resolver.variant != imagesize.PluginVariantLarge {
+		t.Errorf("plugin hint = %q, want %q", resolver.variant, imagesize.PluginVariantLarge)
+	}
+
+	h.resolveCastPhotos(t.Context(), cards, imagesize.Width(200))
+	if got, want := cards[0].Cast[0].PhotoURL, "resolved:tmdb/people/1/profile/w200.r1.webp"; got != want {
+		t.Errorf("photo at 200px = %q, want %q", got, want)
+	}
+	// A plugin's narrower headshots are softer than a cast card, so a width
+	// short of the original keeps the large hint.
+	h.resolveCastPhotos(t.Context(), plugin, imagesize.Width(200))
+	if resolver.variant != imagesize.PluginVariantLarge {
+		t.Errorf("plugin hint at 200px = %q, want %q", resolver.variant, imagesize.PluginVariantLarge)
+	}
+}
+
+// A Watch Tonight page resolves artwork for the cards it returns, not for the
+// rest of the hydration window, which only decides whether more remain.
+func TestSwipeCardsResolveArtworkOnlyForReturnedCards(t *testing.T) {
+	resolver := &countingSectionImageResolver{}
+	detailSvc := &catalog.DetailService{}
+	detailSvc.SetImageResolver(resolver)
+	h := &RecommendationsHandler{DetailSvc: detailSvc, CastFetcher: castByID{}}
+	items := map[string]*models.MediaItem{}
+	for _, id := range []string{"a", "b", "c"} {
+		items[id] = &models.MediaItem{ContentID: id, PosterPath: "tmdb/movies/" + id + "/poster/original.r1.webp"}
+	}
+
+	cards, more := h.swipeCards(t.Context(), recommendationCandidates("a", "b", "c"), watchTonightEnrichment{items: items}, 1, imagesize.Request{})
+	if len(cards) != 1 || !more {
+		t.Fatalf("cards = %d, more = %v; want one card and more", len(cards), more)
+	}
+	if !slices.Equal(resolver.paths, []string{"tmdb/movies/a/poster/w500.r1.webp"}) {
+		t.Fatalf("resolved %v, want only the returned card's poster", resolver.paths)
+	}
+}
diff --git a/internal/api/handlers/audiobook_groups.go b/internal/api/handlers/audiobook_groups.go
index b4a9ede3b6..c20b07cf1b 100644
--- a/internal/api/handlers/audiobook_groups.go
+++ b/internal/api/handlers/audiobook_groups.go
@@ -107,7 +107,7 @@ func (h *CatalogHandler) HandleGetAudiobookGroups(w http.ResponseWriter, r *http
 
 // audiobookGroupsView renders a page of groups with presigned cover stacks.
 func (h *CatalogHandler) audiobookGroupsView(ctx context.Context, result catalog.AudiobookGroupsResult, filter catalog.AccessFilter) audiobookGroupsResponse {
-	resolvedPosters := h.resolveAudiobookGroupPosterURLs(ctx, result.Groups, filter.ImageSize)
+	resolvedPosters := h.resolveAudiobookGroupPosterURLs(ctx, result.Groups, filter.ImageSizeFor(imagesize.SlotPoster))
 	resp := audiobookGroupsResponse{
 		Total:      result.Total,
 		Next:       result.Next,
@@ -118,7 +118,7 @@ func (h *CatalogHandler) audiobookGroupsView(ctx context.Context, result catalog
 	for _, g := range result.Groups {
 		posterURLs := make([]string, 0, len(g.PosterPaths))
 		for _, path := range g.PosterPaths {
-			if resolved := resolvedPosters[sizedCardPath(path, artworkkey.ImagePoster, filter.ImageSize)]; resolved.URL != "" {
+			if resolved := resolvedPosters[sizedCardPath(path, artworkkey.ImagePoster, filter.ImageSizeFor(imagesize.SlotPoster))]; resolved.URL != "" {
 				posterURLs = append(posterURLs, resolved.URL)
 			}
 		}
diff --git a/internal/api/handlers/catalog.go b/internal/api/handlers/catalog.go
index 5e1ec1dc1f..262caddd81 100644
--- a/internal/api/handlers/catalog.go
+++ b/internal/api/handlers/catalog.go
@@ -183,7 +183,7 @@ func (h *CatalogHandler) catalogItemResponses(ctx context.Context, v ItemViewer,
 	responseWG.Add(2)
 	go func() {
 		defer responseWG.Done()
-		imageURLs = h.itemsH.itemListCardImageURLs(ctx, localizedItems, accessFilter.ImageSize)
+		imageURLs = h.itemsH.itemListCardImageURLs(ctx, localizedItems, accessFilter.Artwork())
 	}()
 	go func() {
 		defer responseWG.Done()
@@ -683,7 +683,7 @@ func (h *CatalogHandler) HandleLegacySearch(w http.ResponseWriter, r *http.Reque
 	userStates := h.itemsH.listItemUserStates(r.Context(), viewerFromRequest(r, accessFilter), items)
 	resp := make([]itemListResponse, 0, len(items))
 	for _, item := range items {
-		resp = append(resp, h.itemsH.toItemListResponseWithOverlay(r.Context(), viewerFromRequest(r, accessFilter), item, nil, userStates[item.ContentID], accessFilter.ImageSize))
+		resp = append(resp, h.itemsH.toItemListResponseWithOverlay(r.Context(), viewerFromRequest(r, accessFilter), item, nil, userStates[item.ContentID], accessFilter.Artwork()))
 	}
 
 	writeJSON(w, http.StatusOK, browseResponse{
diff --git a/internal/api/handlers/catalog_actions_service.go b/internal/api/handlers/catalog_actions_service.go
index fca912ead0..4bb54880c5 100644
--- a/internal/api/handlers/catalog_actions_service.go
+++ b/internal/api/handlers/catalog_actions_service.go
@@ -6,15 +6,18 @@ import (
 	"log/slog"
 	"net/http"
 	"strconv"
+	"strings"
 	"time"
 
 	"github.com/jackc/pgx/v5"
 
+	"github.com/prairie-server/prairie-server/internal/access"
 	"github.com/prairie-server/prairie-server/internal/catalog"
 	"github.com/prairie-server/prairie-server/internal/literaryworks"
 	"github.com/prairie-server/prairie-server/internal/metadata"
 	"github.com/prairie-server/prairie-server/internal/metadata/translation"
 	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/ratelimit"
 )
 
 // Seams of the catalog-items section's actions and lookups: trailer refresh,
@@ -182,12 +185,65 @@ func (h *MetadataAIHandler) TranslateOnView(ctx context.Context, filter catalog.
 		}
 		return nil, apiError(http.StatusInternalServerError, "internal_error", "Failed to authorize item")
 	}
+	// A disabled feature answers as disabled before any guard below can
+	// spend the budget or report a language problem instead.
+	if h.service.OnViewMode(ctx) == metadataAIOnViewOff {
+		return nil, onViewNotConfigured(translation.ErrNotConfigured)
+	}
+	// Fallback preferences from a failed settings read would check the
+	// request against the wrong language; refuse until the read recovers.
+	if scope, ok := access.GetScope(ctx); ok && scope.PreferencesDegraded {
+		unavailable := apiError(http.StatusServiceUnavailable, "unavailable", "Profile preferences are temporarily unavailable")
+		unavailable.RetryAfter = 1
+		return nil, unavailable
+	}
+	// The account budget comes first, so a refused request cannot fan out
+	// into the pending-language reads below without spending it.
+	if h.Limiter != nil && requestedBy != nil {
+		result := h.onViewAllow(ctx, *requestedBy)
+		if !result.Allowed {
+			limited := apiError(http.StatusTooManyRequests, "rate_limited", "Too many translation requests")
+			if result.RetryAfter > 0 {
+				limited.RetryAfter = ratelimit.RetryAfterSeconds(result.RetryAfter)
+			}
+			return nil, limited
+		}
+	}
+	if h.Pending != nil {
+		// Only the language this viewer's detail page reports missing may be
+		// queued; anything else would let any profile spend the provider
+		// budget on languages nobody reads.
+		pending, err := h.viewerPendingLanguage(ctx, target, filter, targetLanguage)
+		if err != nil {
+			slog.ErrorContext(ctx, "failed to check on-view translation language", "component", "api",
+				"content_id", contentID, "error", err)
+			return nil, apiError(http.StatusInternalServerError, "internal_error", "Failed to start translation")
+		}
+		if pending == "" {
+			// A retry sees nothing missing once its job's first batch has
+			// landed. As the coalescing contract promises, it gets back the
+			// job this account started, which is still running; anyone else
+			// gets the refusal. An invalid language has no job.
+			active, err := h.service.ActiveOnViewJob(ctx, target.kind, contentID, targetLanguage)
+			if err != nil && !errors.Is(err, translation.ErrInvalidRequest) {
+				slog.ErrorContext(ctx, "failed to look up on-view translation", "component", "api",
+					"content_id", contentID, "error", err)
+				return nil, apiError(http.StatusInternalServerError, "internal_error", "Failed to start translation")
+			}
+			if active != nil && requestedBy != nil && active.RequestedBy != nil && *active.RequestedBy == *requestedBy {
+				return active, nil
+			}
+			return nil, fieldError("target_language", "This item has nothing to translate for this profile")
+		}
+		if !strings.EqualFold(strings.TrimSpace(targetLanguage), pending) {
+			return nil, fieldError("target_language", "target_language must be this profile's metadata language ("+pending+")")
+		}
+	}
 	job, err := h.service.RequestOnView(ctx, target.kind, contentID, targetLanguage, requestedBy)
 	if err != nil {
 		switch {
 		case errors.Is(err, translation.ErrNotConfigured):
-			return nil, &APIError{Status: http.StatusServiceUnavailable, Code: "not_configured",
-				Message: "On-view translation is not enabled on this server", cause: err}
+			return nil, onViewNotConfigured(err)
 		case errors.Is(err, translation.ErrInvalidRequest):
 			return nil, &APIError{Status: http.StatusBadRequest, Code: policyErrorBadRequest, Message: err.Error(), cause: err}
 		}
@@ -198,6 +254,11 @@ func (h *MetadataAIHandler) TranslateOnView(ctx context.Context, filter catalog.
 	return job, nil
 }
 
+func onViewNotConfigured(cause error) *APIError {
+	return &APIError{Status: http.StatusServiceUnavailable, Code: "not_configured", //nolint:goconst // wire error code
+		Message: "On-view translation is not enabled on this server", cause: cause}
+}
+
 // SearchPeople answers up to limit people matching query that the viewer can
 // see through at least one credit, as person detail requires; limit <= 0 is 20.
 func (h *PeopleHandler) SearchPeople(ctx context.Context, query string, limit int, filter catalog.AccessFilter) ([]PersonView, error) {
diff --git a/internal/api/handlers/catalog_items_service.go b/internal/api/handlers/catalog_items_service.go
index 07f8d60857..9d271252a6 100644
--- a/internal/api/handlers/catalog_items_service.go
+++ b/internal/api/handlers/catalog_items_service.go
@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/imagesize"
 	"github.com/prairie-server/prairie-server/internal/models"
 	"github.com/prairie-server/prairie-server/internal/sections"
 	"github.com/prairie-server/prairie-server/internal/userstore"
@@ -309,6 +310,9 @@ func (h *CatalogHandler) QueryItems(ctx context.Context, v ItemViewer, req Catal
 		modelItems = append(modelItems, &item)
 		total = rowTotal
 	}
+	if err := rows.Err(); err != nil {
+		return CatalogQueryView{}, apiError(http.StatusInternalServerError, "internal_error", "Failed to query items")
+	}
 	// COUNT(*) OVER () emits no rows when the data SELECT is empty, so total
 	// stays 0 even when the broader result set has matching rows (OFFSET past
 	// the last page). Re-query the count to give callers the real total.
@@ -329,7 +333,7 @@ func (h *CatalogHandler) QueryItems(ctx context.Context, v ItemViewer, req Catal
 				item = localized
 			}
 		}
-		items = append(items, h.itemsH.toItemListResponseWithOverlay(ctx, viewer, item, nil, userStates[item.ContentID], accessFilter.ImageSize))
+		items = append(items, h.itemsH.toItemListResponseWithOverlay(ctx, viewer, item, nil, userStates[item.ContentID], accessFilter.Artwork()))
 	}
 	return CatalogQueryView{Total: total, HasMore: req.Offset+req.Limit < total, Items: items}, nil
 }
@@ -522,10 +526,10 @@ func (h *CatalogResourceHandler) seriesSeasons(ctx context.Context, v ItemViewer
 				paths := make([]string, 0, len(seasons))
 				for _, season := range seasons {
 					if episodeCounts[season.SeasonNumber] > 0 && season.PosterPath != "" {
-						paths = append(paths, sizedPosterPath(season.PosterPath, filter.ImageSize))
+						paths = append(paths, sizedPosterPath(season.PosterPath, filter.ImageSizeFor(imagesize.SlotPoster)))
 					}
 				}
-				posterURLs = h.items.detailSvc.PresignURLsWithExpiry(ctx, paths, requestVariantHint("featured", filter.ImageSize))
+				posterURLs = h.items.detailSvc.PresignURLsWithExpiry(ctx, paths, requestVariantHint("featured", filter.ImageSizeFor(imagesize.SlotPoster)))
 			}
 			resp := make([]seasonResponse, 0, len(seasons))
 			for _, s := range seasons {
@@ -539,8 +543,8 @@ func (h *CatalogResourceHandler) seriesSeasons(ctx context.Context, v ItemViewer
 				if !includeArtwork {
 					season.PosterThumbhash = ""
 				}
-				sr := h.items.localizedSeasonResponse(ctx, v, &season, episodeCount, userData[s.SeasonNumber], filter.ImageSize)
-				sr.PosterURL = posterURLs[sizedPosterPath(s.PosterPath, filter.ImageSize)].URL
+				sr := h.items.localizedSeasonResponse(ctx, v, &season, episodeCount, userData[s.SeasonNumber], filter.ImageSizeFor(imagesize.SlotPoster))
+				sr.PosterURL = posterURLs[sizedPosterPath(s.PosterPath, filter.ImageSizeFor(imagesize.SlotPoster))].URL
 				resp = append(resp, sr)
 			}
 			h.items.enrichSeasonPlayTargets(ctx, v, id, resp)
@@ -602,7 +606,7 @@ func (h *CatalogResourceHandler) SeriesSeason(ctx context.Context, v ItemViewer,
 				userData = h.items.getAggregateUserData(ctx, v, episodes)
 			}
 			h.items.maybeRequestStaleSeasonMetadataRefresh(ctx, season.ContentID, episodes)
-			resp := h.items.toSeasonResponseFromEpisodes(ctx, v, id, season, episodes, userData, v.Access.ImageSize)
+			resp := h.items.toSeasonResponseFromEpisodes(ctx, v, id, season, episodes, userData, v.Access.ImageSizeFor(imagesize.SlotPoster))
 			h.items.resolveSeasonPlayTarget(ctx, v, id, &resp)
 			return resp, nil
 		case !errors.Is(err, catalog.ErrSeasonNotFound):
diff --git a/internal/api/handlers/catalog_resources.go b/internal/api/handlers/catalog_resources.go
index 86d4f129d6..295a403511 100644
--- a/internal/api/handlers/catalog_resources.go
+++ b/internal/api/handlers/catalog_resources.go
@@ -10,6 +10,7 @@ import (
 
 	apimw "github.com/prairie-server/prairie-server/internal/api/middleware"
 	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/imagesize"
 	"github.com/prairie-server/prairie-server/internal/models"
 )
 
@@ -225,7 +226,7 @@ func (h *CatalogResourceHandler) syntheticSeasonDetail(ctx context.Context, v It
 		season,
 		episodes,
 		h.items.getAggregateUserData(ctx, v, episodes),
-		filter.ImageSize,
+		filter.ImageSizeFor(imagesize.SlotPoster),
 	)
 	return &catalog.ItemDetail{
 		ContentID:         seasonID,
@@ -326,11 +327,16 @@ func (h *CatalogResourceHandler) enrichViewerState(ctx context.Context, v ItemVi
 	if err != nil {
 		return
 	}
+	notInterested, err := store.GetNotInterested(ctx, profileID, detail.ContentID)
+	if err != nil {
+		return
+	}
 
 	detail.UserState = &catalog.ItemUserState{
-		Played:      detail.SeasonUserData != nil && detail.SeasonUserData.Played,
-		IsFavorite:  isFavorite,
-		InWatchlist: inWatchlist,
+		Played:        detail.SeasonUserData != nil && detail.SeasonUserData.Played,
+		IsFavorite:    isFavorite,
+		InWatchlist:   inWatchlist,
+		NotInterested: notInterested != nil,
 	}
 
 	if h.items.ratingsRepo == nil {
diff --git a/internal/api/handlers/clear_resume_position_db_test.go b/internal/api/handlers/clear_resume_position_db_test.go
new file mode 100644
index 0000000000..739516d222
--- /dev/null
+++ b/internal/api/handlers/clear_resume_position_db_test.go
@@ -0,0 +1,166 @@
+package handlers
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/cache"
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	evt "github.com/prairie-server/prairie-server/internal/events"
+	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/userstore"
+	"github.com/prairie-server/prairie-server/internal/userstore/pgstore"
+	"github.com/prairie-server/prairie-server/internal/watchstate"
+)
+
+// TestClearResumePositionTargetsDB pins which catalog items have a resume
+// position to clear (issue #2134): a movie or an episode clears and publishes
+// one progress change; a season, series or ebook is an invalid target; an
+// item without a resume position is a silent no-op.
+func TestClearResumePositionTargetsDB(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := t.Context()
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(pool.Close)
+
+	prefix := fmt.Sprintf("resume-reset-%d", time.Now().UnixNano())
+	movie, series, season, episode, ebook := prefix+"-movie", prefix+"-series", prefix+"-s1", prefix+"-s1e1", prefix+"-ebook"
+	libraries := map[string]int{}
+	for _, kind := range []string{"movies", "tv", "ebooks"} {
+		var id int
+		if err := pool.QueryRow(ctx, `INSERT INTO media_folders(type,name) VALUES($1,$2) RETURNING id`, kind, prefix+"-"+kind).Scan(&id); err != nil {
+			t.Fatal(err)
+		}
+		libraries[kind] = id
+	}
+	var userID int
+	if err := pool.QueryRow(ctx, `INSERT INTO users (username, role) VALUES ($1, 'user') RETURNING id`, prefix).Scan(&userID); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		bg := context.Background()
+		_, _ = pool.Exec(bg, `DELETE FROM user_watch_history WHERE user_id = $1`, userID)
+		_, _ = pool.Exec(bg, `DELETE FROM user_watch_progress WHERE user_id = $1`, userID)
+		_, _ = pool.Exec(bg, `DELETE FROM user_profiles WHERE user_id = $1`, userID)
+		_, _ = pool.Exec(bg, `DELETE FROM users WHERE id = $1`, userID)
+		_, _ = pool.Exec(bg, `DELETE FROM episodes WHERE content_id LIKE $1`, prefix+"%")
+		_, _ = pool.Exec(bg, `DELETE FROM seasons WHERE content_id LIKE $1`, prefix+"%")
+		_, _ = pool.Exec(bg, `DELETE FROM media_items WHERE content_id LIKE $1`, prefix+"%")
+		for _, id := range libraries {
+			_, _ = pool.Exec(bg, `DELETE FROM media_folders WHERE id = $1`, id)
+		}
+	})
+	for _, item := range []struct{ id, kind, library string }{{movie, "movie", "movies"}, {series, "series", "tv"}, {ebook, "ebook", "ebooks"}} {
+		if _, err := pool.Exec(ctx, `INSERT INTO media_items(content_id,type,title,genres,default_metadata_language) VALUES($1,$2,'Synthetic','{}','en')`, item.id, item.kind); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := pool.Exec(ctx, `INSERT INTO media_item_libraries(content_id,media_folder_id) VALUES($1,$2)`, item.id, libraries[item.library]); err != nil {
+			t.Fatal(err)
+		}
+	}
+	seasons, episodes := catalog.NewSeasonRepository(pool), catalog.NewEpisodeRepository(pool)
+	if err := seasons.Upsert(ctx, &models.Season{ContentID: season, SeriesID: series, SeasonNumber: 1, Title: "Season 1", DefaultMetadataLanguage: "en"}); err != nil {
+		t.Fatal(err)
+	}
+	if err := episodes.Upsert(ctx, &models.Episode{ContentID: episode, SeriesID: series, SeasonID: season, SeasonNumber: 1, EpisodeNumber: 1, Title: "Episode", DefaultMetadataLanguage: "en"}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := pool.Exec(ctx, `INSERT INTO episode_libraries(episode_id,media_folder_id) VALUES($1,$2)`, episode, libraries["tv"]); err != nil {
+		t.Fatal(err)
+	}
+
+	provider := pgstore.NewPostgresProvider(pool)
+	store, err := provider.ForUser(ctx, userID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	const profileID = "resume-reset"
+	if err := store.CreateProfile(ctx, userstore.Profile{ID: profileID, Name: "Resume Reset"}); err != nil {
+		t.Fatal(err)
+	}
+	hub := evt.NewHub("test", &cache.NoopEventBus{})
+	received, unsubscribe := hub.Subscribe()
+	t.Cleanup(unsubscribe)
+	h := &ItemsHandler{
+		itemRepo:    catalog.NewItemRepository(pool),
+		seasonRepo:  seasons,
+		episodeRepo: episodes,
+		watchState:  watchstate.NewService(provider),
+		EventsHub:   hub,
+	}
+	for _, id := range []string{movie, episode} {
+		if _, err := h.watchState.RecordPlaybackStop(ctx, userID, profileID, id, 3600, 1200, time.Now().UTC().Add(-time.Hour), userstore.VersionHints{}, userstore.ProgressThresholds{}); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	for _, id := range []string{movie, episode} {
+		if err := h.ClearResumePosition(ctx, userID, profileID, id, catalog.AccessFilter{}); err != nil {
+			t.Fatalf("clear %s: %v", id, err)
+		}
+		progress, err := store.GetProgress(ctx, profileID, id)
+		if err != nil || progress == nil || progress.PositionSeconds != 0 {
+			t.Fatalf("%s progress = %+v, %v; want position 0", id, progress, err)
+		}
+		select {
+		case envelope := <-received:
+			var payload userStateEventPayload
+			if err := json.Unmarshal(envelope.Data, &payload); err != nil {
+				t.Fatal(err)
+			}
+			if envelope.Channel != evt.ChannelUserState || payload.Change != "progress" || payload.ContentID != id || payload.ProfileID != profileID {
+				t.Fatalf("event for %s = %+v %+v, want one progress change", id, envelope, payload)
+			}
+		case <-time.After(5 * time.Second):
+			t.Fatalf("no user state event for %s", id)
+		}
+	}
+
+	for _, id := range []string{series, season, ebook} {
+		var apiErr *APIError
+		if err := h.ClearResumePosition(ctx, userID, profileID, id, catalog.AccessFilter{}); !errors.As(err, &apiErr) || apiErr.Code != "invalid_watch_target" || apiErr.Status != http.StatusBadRequest {
+			t.Fatalf("clear %s = %v, want invalid_watch_target", id, err)
+		}
+	}
+	var apiErr *APIError
+	if err := h.ClearResumePosition(ctx, userID, profileID, prefix+"-missing", catalog.AccessFilter{}); !errors.As(err, &apiErr) || apiErr.Status != http.StatusNotFound {
+		t.Fatalf("clear missing = %v, want 404", err)
+	}
+
+	// Mark watched shares the lookup and still expands a season or series
+	// into its episodes; the reset above rejected them before that.
+	for _, want := range []struct{ id, kind string }{{movie, "movie"}, {series, "series"}, {season, "season"}, {episode, "episode"}} {
+		kind, targets, err := h.resolveWatchedTargets(ctx, want.id, true, catalog.AccessFilter{})
+		leaf := episode
+		if want.id == movie {
+			leaf = movie
+		}
+		if err != nil || kind != want.kind || len(targets) != 1 || targets[0].ContentID != leaf {
+			t.Fatalf("resolveWatchedTargets(%s) = %q, %+v, %v; want %s with leaf %s", want.id, kind, targets, err, want.kind, leaf)
+		}
+	}
+
+	// Nothing left to clear: no write and no event.
+	if err := h.ClearResumePosition(ctx, userID, profileID, movie, catalog.AccessFilter{}); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case envelope := <-received:
+		t.Fatalf("a no-op clear published %+v", envelope)
+	default:
+	}
+}
diff --git a/internal/api/handlers/collection_artwork.go b/internal/api/handlers/collection_artwork.go
index af667a77de..a07e75b5b1 100644
--- a/internal/api/handlers/collection_artwork.go
+++ b/internal/api/handlers/collection_artwork.go
@@ -15,6 +15,7 @@ import (
 	"time"
 
 	"github.com/prairie-server/prairie-server/internal/artworkkey"
+	"github.com/prairie-server/prairie-server/internal/artworkurl"
 	"github.com/prairie-server/prairie-server/internal/blobstore"
 	"github.com/prairie-server/prairie-server/internal/catalog"
 	"github.com/prairie-server/prairie-server/internal/collage"
@@ -473,15 +474,15 @@ func (c collectionCollageComposer) CollectionCollagePath(collectionID, key strin
 }
 
 // fetchImage downloads an image from a resolved URL. The URL is a catalog
-// title's poster as the server resolved it, usually from its own artwork
-// storage, which may be on the local network; no request supplies it. The
-// fetch is therefore trusted with the local network, and netguard still
-// refuses blocked addresses.
+// title's poster as the server resolved it: a direct URL to the artwork
+// store, which may be on the local network, or a metadata provider's URL that
+// was not cached, which is untrusted. artworkurl.FetchContext tells them
+// apart, and netguard refuses blocked addresses either way.
 func (c collectionCollageComposer) fetchImage(ctx context.Context, imageURL string) ([]byte, error) {
 	if c.httpClient == nil {
 		return nil, errors.New("collage downloads have no HTTP client")
 	}
-	req, err := http.NewRequestWithContext(netguard.WithPrivateAccess(ctx), http.MethodGet, imageURL, nil)
+	req, err := http.NewRequestWithContext(artworkurl.FetchContext(ctx, c.store, imageURL), http.MethodGet, imageURL, nil)
 	if err != nil {
 		return nil, err
 	}
diff --git a/internal/api/handlers/collection_image_source_test.go b/internal/api/handlers/collection_image_source_test.go
index 834e9083eb..ac1216fda7 100644
--- a/internal/api/handlers/collection_image_source_test.go
+++ b/internal/api/handlers/collection_image_source_test.go
@@ -217,7 +217,8 @@ func TestCollectionImageDownloadsNeedAClient(t *testing.T) {
 
 // Collage sources are catalog posters the server resolves, often to artwork
 // storage on its own network, so the default personal collage generator still
-// fetches them from loopback. Blocked ranges stay refused.
+// fetches those from loopback. A poster off the artwork store is a provider's
+// URL and stays Public only; blocked ranges stay refused.
 func TestPersonalCollageFetchesLocalArtworkStorage(t *testing.T) {
 	var poster bytes.Buffer
 	if err := png.Encode(&poster, image.NewNRGBA(image.Rect(0, 0, 20, 30))); err != nil {
@@ -227,10 +228,11 @@ func TestPersonalCollageFetchesLocalArtworkStorage(t *testing.T) {
 		_, _ = w.Write(poster.Bytes())
 	}))
 	t.Cleanup(server.Close)
+	other, otherHits := countingImageServer(t)
 
 	detail := &catalog.DetailService{}
 	detail.SetImageResolver(collageSourceResolver{})
-	gen := NewPersonalCollectionCollageGenerator(blobstoretest.New(), detail, nil)
+	gen := NewPersonalCollectionCollageGenerator(blobstoretest.NewDirect(server.URL), detail, nil)
 	if gen == nil {
 		t.Fatal("no collage generator")
 	}
@@ -239,7 +241,13 @@ func TestPersonalCollageFetchesLocalArtworkStorage(t *testing.T) {
 	if _, _, err := gen.ComposeCollectionCollage(t.Context(), "c1", key, []string{server.URL + "/a.png", server.URL + "/b.png"}); err != nil {
 		t.Fatalf("compose from loopback storage: %v", err)
 	}
-	_, _, err := gen.ComposeCollectionCollage(t.Context(), "c1", key, []string{server.URL + "/a.png", "http://169.254.10.10/b.png"})
+	// A poster that is not on the artwork store is a metadata provider's
+	// URL, which may not reach the local network.
+	_, _, err := gen.ComposeCollectionCollage(t.Context(), "c1", key, []string{server.URL + "/a.png", other.URL + "/b.png"})
+	if !errors.Is(err, netguard.ErrPrivateDestination) || otherHits.Load() != 0 {
+		t.Fatalf("collage with a local provider source = %v (hits %d), want ErrPrivateDestination", err, otherHits.Load())
+	}
+	_, _, err = gen.ComposeCollectionCollage(t.Context(), "c1", key, []string{server.URL + "/a.png", "http://169.254.10.10/b.png"})
 	if !errors.Is(err, netguard.ErrBlockedDestination) {
 		t.Fatalf("collage with a link-local source = %v, want ErrBlockedDestination", err)
 	}
diff --git a/internal/api/handlers/collections_lifecycle_service.go b/internal/api/handlers/collections_lifecycle_service.go
index e42870d3f3..3cba5f9cdd 100644
--- a/internal/api/handlers/collections_lifecycle_service.go
+++ b/internal/api/handlers/collections_lifecycle_service.go
@@ -38,10 +38,6 @@ func (h *CollectionHandler) UpdatePersonalCollection(ctx context.Context, cmd Pe
 	if err != nil {
 		return none, err
 	}
-	if strings.EqualFold(strings.TrimSpace(existing.CollectionType), "trakt") &&
-		(req.SourceURL != nil || req.MaxItems != nil || req.LibraryIDs != nil) {
-		return none, apiError(http.StatusConflict, "legacy_source_immutable", "Legacy Trakt collection sources cannot be changed")
-	}
 
 	if cmd.PosterFile != nil || req.PosterSourceURL != nil {
 		if err := collectionFeatureError(store, "artwork"); err != nil {
diff --git a/internal/api/handlers/collections_lifecycle_service_test.go b/internal/api/handlers/collections_lifecycle_service_test.go
index 76eb698d25..fb5901877a 100644
--- a/internal/api/handlers/collections_lifecycle_service_test.go
+++ b/internal/api/handlers/collections_lifecycle_service_test.go
@@ -180,26 +180,6 @@ func TestPersonalCollectionUpdateWithoutGroupsIgnoresNullGroup(t *testing.T) {
 	}
 }
 
-func TestPersonalLegacyTraktSourceCannotBeEdited(t *testing.T) {
-	store := &lifecycleStore{collection: userstore.Collection{
-		ID: "c", CreatorProfileID: "owner",
-		CollectionType: "trakt", SourceConfig: `{"url":"https://trakt.tv/users/example/lists/list"}`,
-	}}
-	h := NewCollectionHandler(lifecycleProvider{store: store})
-	maxItems := 25
-	_, err := h.UpdatePersonalCollection(t.Context(), PersonalCollectionUpdateCommand{
-		UserID: 1, ProfileID: "owner", CollectionID: "c",
-		Request: PersonalCollectionUpdateRequest{MaxItems: &maxItems},
-	})
-	apiErr, ok := errors.AsType[*APIError](err)
-	if !ok || apiErr.Code != "legacy_source_immutable" {
-		t.Fatalf("error = %#v, want legacy_source_immutable", err)
-	}
-	if store.mutations != 0 {
-		t.Fatalf("source edit caused %d mutations", store.mutations)
-	}
-}
-
 // Sync answers like every other mutation: a collection the profile cannot
 // see does not exist for it (404), and a shared collection it does not own
 // is refused (403).
diff --git a/internal/api/handlers/collections_mutation_guards_test.go b/internal/api/handlers/collections_mutation_guards_test.go
index 6a718ad882..ea9dc4883f 100644
--- a/internal/api/handlers/collections_mutation_guards_test.go
+++ b/internal/api/handlers/collections_mutation_guards_test.go
@@ -24,7 +24,7 @@ func (r *collectionGuardReader) GetByIDsWithAccess(_ context.Context, _ []string
 }
 
 func TestPersonalCollectionManualMutationGuards(t *testing.T) {
-	for _, kind := range []string{"manual", "smart", "mdblist", "trakt", ""} {
+	for _, kind := range []string{"manual", "smart", "mdblist", "tmdb", ""} {
 		for _, visible := range []bool{true, false} {
 			t.Run(kind+"/"+map[bool]string{true: "visible", false: "missing-or-hidden"}[visible], func(t *testing.T) {
 				store := &lifecycleStore{collection: userstore.Collection{ID: "c", CreatorProfileID: "owner", CollectionType: kind}}
diff --git a/internal/api/handlers/devices_service.go b/internal/api/handlers/devices_service.go
index 2f64d1c35a..be82a6fc0c 100644
--- a/internal/api/handlers/devices_service.go
+++ b/internal/api/handlers/devices_service.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"net/http"
 	"strings"
+	"unicode"
 
 	"github.com/prairie-server/prairie-server/internal/access"
 	apimw "github.com/prairie-server/prairie-server/internal/api/middleware"
@@ -103,3 +104,97 @@ func (h *DeviceHandler) RemoveDeviceSettings(ctx context.Context, actor DeviceSe
 	auditSettingsForOther(ctx, settingsAuditRecord{Action: action, ActorProfileID: apimw.GetProfileID(ctx), TargetProfileID: profileID, TargetUserID: actor.UserID, DeviceID: deviceID, Scope: string(settingscontract.ScopeProfileDevice)})
 	return nil
 }
+
+// MaxDeviceNameRunes bounds a device name, reported or chosen, so both fit the
+// same rows and layouts.
+const MaxDeviceNameRunes = 120
+
+// DeviceUpdate changes one profile's registry entry for a device. A zero
+// update changes nothing but is still authorized and must name a known device.
+type DeviceUpdate struct {
+	// Rename is true when the update sets or clears the custom name.
+	Rename bool
+	// CustomName is the name the profile chose; nil clears it, so the device
+	// shows its reported name again.
+	CustomName *string
+}
+
+// UpdateDevice applies an update to a device under the same authorization as
+// forgetting it and returns the entry as it now stands. The reported name is
+// never changed, so the device can still be identified by it.
+func (h *DeviceHandler) UpdateDevice(ctx context.Context, actor DeviceSettingsActor, profileID, deviceID string, update DeviceUpdate) (userstore.DeviceSettingsEntry, error) {
+	profileID = strings.TrimSpace(profileID)
+	deviceID = strings.TrimSpace(deviceID)
+	if deviceID == "" {
+		return userstore.DeviceSettingsEntry{}, apiError(http.StatusBadRequest, "bad_request", "A device id is required")
+	}
+	name := ""
+	if update.Rename && update.CustomName != nil {
+		name = deviceCustomName(*update.CustomName)
+		if name == "" {
+			return userstore.DeviceSettingsEntry{}, fieldError("custom_name", "A device name needs at least one visible character")
+		}
+	}
+	store, err := h.deviceSettingsStore(ctx, actor, profileID, false)
+	if err != nil {
+		return userstore.DeviceSettingsEntry{}, err
+	}
+	if profileID == "" {
+		profileID = actor.ProfileID
+	}
+	notFound := apiError(http.StatusNotFound, "not_found", "Device not found")
+	if update.Rename {
+		err = store.RenameDevice(ctx, profileID, deviceID, name)
+		if errors.Is(err, userstore.ErrDeviceNotFound) {
+			return userstore.DeviceSettingsEntry{}, notFound
+		}
+		if err != nil {
+			return userstore.DeviceSettingsEntry{}, err
+		}
+		// Identity only: the chosen name is the user's text and stays out of logs.
+		auditSettingsForOther(ctx, settingsAuditRecord{Action: "rename_device", ActorProfileID: apimw.GetProfileID(ctx), TargetProfileID: profileID, TargetUserID: actor.UserID, DeviceID: deviceID})
+	}
+	// A forget that lands between the update and this read leaves nothing to
+	// return, which is the same answer as a device that was never there.
+	rows, err := store.ListDeviceSettingsPage(ctx, userstore.DevicePageOptions{ProfileID: profileID, DeviceID: deviceID, Limit: 1})
+	if err != nil {
+		return userstore.DeviceSettingsEntry{}, err
+	}
+	if len(rows) == 0 {
+		return userstore.DeviceSettingsEntry{}, notFound
+	}
+	return rows[0], nil
+}
+
+// deviceCustomName normalizes a chosen device name. Control characters, which
+// a JSON body can carry but a header cannot (and Postgres text rejects NUL),
+// and bidirectional overrides, which could make the name read as other text,
+// are removed; a tab or line break counts as a space. Runs of spaces collapse
+// to one, and the name is bounded like a reported one. It returns "" when no
+// visible character remains, such as a name of only zero-width spaces or
+// variation selectors.
+func deviceCustomName(name string) string {
+	name = strings.Map(func(r rune) rune {
+		switch {
+		case unicode.IsControl(r) && unicode.IsSpace(r):
+			return ' '
+		case unicode.IsControl(r), unicode.Is(unicode.Bidi_Control, r):
+			return -1
+		default:
+			return r
+		}
+	}, name)
+	name = clampHeaderValue(strings.Join(strings.Fields(name), " "), MaxDeviceNameRunes)
+	if strings.IndexFunc(name, visibleRune) < 0 {
+		return ""
+	}
+	return name
+}
+
+// visibleRune reports whether r draws something by itself: not a space, a
+// format character such as a zero-width space, a variation selector, or
+// another default-ignorable code point such as the combining grapheme joiner.
+// Such characters stay inside a visible name; they only can't make one.
+func visibleRune(r rune) bool {
+	return !unicode.IsSpace(r) && !unicode.In(r, unicode.Cf, unicode.Variation_Selector, unicode.Other_Default_Ignorable_Code_Point)
+}
diff --git a/internal/api/handlers/devices_service_test.go b/internal/api/handlers/devices_service_test.go
index 3117f0c044..51a4bc96f8 100644
--- a/internal/api/handlers/devices_service_test.go
+++ b/internal/api/handlers/devices_service_test.go
@@ -1,6 +1,7 @@
 package handlers
 
 import (
+	"errors"
 	"net/http"
 	"testing"
 
@@ -66,7 +67,98 @@ func TestDeviceSettingsProductionWrapper(t *testing.T) {
 	if err := h.RemoveDeviceSettings(ctx, actor, "", "d", false); err != nil {
 		t.Fatal(err)
 	}
+	name := "Kitchen"
+	for _, update := range []DeviceUpdate{{Rename: true, CustomName: &name}, {}} {
+		if _, err := h.UpdateDevice(ctx, actor, "", "d", update); err != nil {
+			t.Fatalf("wrapped update %+v: %v", update, err)
+		}
+	}
 	if err := h.RemoveDeviceSettings(ctx, actor, "", "d", true); err != nil {
 		t.Fatal(err)
 	}
 }
+
+// Renaming follows forgetting's authorization, keeps the reported name, and
+// stores only visible text.
+func TestUpdateDeviceRename(t *testing.T) {
+	h, store := newDevicesTestHandler(t)
+	seedDevice(t, store, "profile-1", "tv", "Apple TV")
+	seedDevice(t, store, "profile-2", "tv", "Apple TV")
+	status := func(_ userstore.DeviceSettingsEntry, err error) int {
+		var apiErr *APIError
+		if errors.As(err, &apiErr) {
+			return apiErr.Status
+		}
+		if err != nil {
+			t.Fatalf("unexpected error: %v", err)
+		}
+		return http.StatusNoContent
+	}
+	rename := func(name string) DeviceUpdate { return DeviceUpdate{Rename: true, CustomName: &name} }
+	names := func() map[string]string {
+		t.Helper()
+		page, err := store.(userstore.DeviceSettingsStore).ListDeviceSettingsPage(t.Context(), userstore.DevicePageOptions{Limit: 10})
+		if err != nil {
+			t.Fatal(err)
+		}
+		got := map[string]string{}
+		for _, entry := range page {
+			got[entry.ProfileID] = entry.DeviceName + "|" + entry.CustomName
+		}
+		return got
+	}
+
+	member := DeviceSettingsActor{UserID: 1, ProfileID: "profile-2"}
+	ctx := devicesRequest(http.MethodPatch, "/devices/tv", "profile-2").Context()
+	if got := status(h.UpdateDevice(ctx, member, "", "tv", rename(" \x00Living\tRoom\n "))); got != http.StatusNoContent {
+		t.Fatalf("own rename: %d", got)
+	}
+	if got := names()["profile-2"]; got != "Apple TV|Living Room" {
+		t.Fatalf("stored name: %q", got)
+	}
+	entry, err := h.UpdateDevice(ctx, member, "", "tv", DeviceUpdate{})
+	if err != nil || entry.ProfileID != "profile-2" || entry.DeviceID != "tv" || entry.CustomName != "Living Room" || entry.DeviceName != "Apple TV" {
+		t.Fatalf("returned entry: %+v %v", entry, err)
+	}
+	if got := status(h.UpdateDevice(ctx, member, "profile-1", "tv", rename("Den"))); got != http.StatusForbidden {
+		t.Fatalf("member renaming another profile's device: %d", got)
+	}
+	for _, blank := range []string{"\t\x00 ", "\u200b\u2060", "\u202e"} {
+		if got := status(h.UpdateDevice(ctx, member, "", "tv", rename(blank))); got != http.StatusBadRequest {
+			t.Fatalf("blank name %q: %d", blank, got)
+		}
+	}
+	for _, update := range []DeviceUpdate{rename("Den"), {}} {
+		if got := status(h.UpdateDevice(ctx, member, "", "missing", update)); got != http.StatusNotFound {
+			t.Fatalf("unknown device %+v: %d", update, got)
+		}
+	}
+	if got := status(h.UpdateDevice(ctx, member, "", "tv", DeviceUpdate{})); got != http.StatusNoContent {
+		t.Fatalf("empty update: %d", got)
+	}
+
+	primary := DeviceSettingsActor{UserID: 1, ProfileID: "profile-1"}
+	ctx = devicesRequest(http.MethodPatch, "/devices/tv", "profile-1").Context()
+	if got := status(h.UpdateDevice(ctx, primary, "profile-2", "tv", DeviceUpdate{Rename: true})); got != http.StatusNoContent {
+		t.Fatalf("household clear: %d", got)
+	}
+	if got := names(); got["profile-2"] != "Apple TV|" || got["profile-1"] != "Apple TV|" {
+		t.Fatalf("after clear: %v", got)
+	}
+}
+
+func TestDeviceCustomName(t *testing.T) {
+	for in, want := range map[string]string{
+		"  Living\r\n\tRoom  ":    "Living Room",
+		"Den\u202e\u2066vT elppA": "DenvT elppA",
+		"Kids\x00 TV":             "Kids TV",
+		"👨\u200d👩\u200d👧 room":    "👨\u200d👩\u200d👧 room",
+		"\u200b":                  "",
+		"\ufe0f\u034f":            "",
+		"TV\ufe0f":                "TV\ufe0f",
+	} {
+		if got := deviceCustomName(in); got != want {
+			t.Errorf("deviceCustomName(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
diff --git a/internal/api/handlers/ebook_reader.go b/internal/api/handlers/ebook_reader.go
index 93ed91f0be..834d36ddba 100644
--- a/internal/api/handlers/ebook_reader.go
+++ b/internal/api/handlers/ebook_reader.go
@@ -632,6 +632,26 @@ func NewPGEbookReaderProgressStore(pool *pgxpool.Pool) *PGEbookReaderProgressSto
 	return &PGEbookReaderProgressStore{pool: pool}
 }
 
+// PurgeProfile deletes a deleted profile's reading progress, reader settings
+// and annotations in one transaction. None of these tables has a foreign key
+// to the profile, which may live outside Postgres.
+func (s *PGEbookReaderProgressStore) PurgeProfile(ctx context.Context, userID int, profileID string) error {
+	tx, err := s.pool.Begin(ctx)
+	if err != nil {
+		return fmt.Errorf("begin ebook reader purge: %w", err)
+	}
+	defer func() { _ = tx.Rollback(ctx) }()
+	for _, table := range []string{"ebook_reader_progress", "ebook_reader_config", "ebook_reader_annotations"} {
+		if _, err := tx.Exec(ctx, "DELETE FROM "+table+" WHERE user_id = $1 AND profile_id = $2", userID, profileID); err != nil {
+			return fmt.Errorf("purge %s for user %d profile %s: %w", table, userID, profileID, err)
+		}
+	}
+	if err := tx.Commit(ctx); err != nil {
+		return fmt.Errorf("commit ebook reader purge: %w", err)
+	}
+	return nil
+}
+
 type PGEbookReaderConfigStore struct {
 	pool *pgxpool.Pool
 }
diff --git a/internal/api/handlers/ebook_reader_purge_db_test.go b/internal/api/handlers/ebook_reader_purge_db_test.go
new file mode 100644
index 0000000000..fe3f82750b
--- /dev/null
+++ b/internal/api/handlers/ebook_reader_purge_db_test.go
@@ -0,0 +1,82 @@
+package handlers
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// Purging a deleted profile removes its reading progress, reader settings and
+// annotations, and leaves another profile's on the same account.
+func TestEbookReaderPurgeProfileDB(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := t.Context()
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(pool.Close)
+	var userID int
+	if err := pool.QueryRow(ctx, `INSERT INTO users (username, role) VALUES ($1, 'user') RETURNING id`,
+		fmt.Sprintf("ebook-purge-%d", time.Now().UnixNano())).Scan(&userID); err != nil {
+		t.Fatalf("seed user: %v", err)
+	}
+	contentID := fmt.Sprintf("ebook:purge-%d", userID)
+	var folderID, fileID int
+	if err := pool.QueryRow(ctx, `INSERT INTO media_folders (type, name) VALUES ('ebooks', $1) RETURNING id`, contentID).Scan(&folderID); err != nil {
+		t.Fatalf("seed folder: %v", err)
+	}
+	if _, err := pool.Exec(ctx, `INSERT INTO media_items (content_id, type, title) VALUES ($1, 'ebook', 'Book')`, contentID); err != nil {
+		t.Fatalf("seed item: %v", err)
+	}
+	if err := pool.QueryRow(ctx, `INSERT INTO media_files (media_folder_id, file_path, content_id) VALUES ($1, $2, $3) RETURNING id`,
+		folderID, "/fixture/"+contentID+".epub", contentID).Scan(&fileID); err != nil {
+		t.Fatalf("seed file: %v", err)
+	}
+	t.Cleanup(func() {
+		ctx := context.Background()
+		_, _ = pool.Exec(ctx, `DELETE FROM users WHERE id = $1`, userID)
+		_, _ = pool.Exec(ctx, `DELETE FROM media_files WHERE id = $1`, fileID)
+		_, _ = pool.Exec(ctx, `DELETE FROM media_items WHERE content_id = $1`, contentID)
+		_, _ = pool.Exec(ctx, `DELETE FROM media_folders WHERE id = $1`, folderID)
+	})
+
+	for _, profileID := range []string{"deleted", "kept"} {
+		for _, stmt := range []string{
+			`INSERT INTO ebook_reader_progress (user_id, profile_id, content_id, file_id, location, progress, updated_at) VALUES ($1, $2, $3, $4, 'loc', 0.5, now())`,
+			`INSERT INTO ebook_reader_config (user_id, profile_id, content_id) VALUES ($1, $2, $3)`,
+			`INSERT INTO ebook_reader_annotations (id, user_id, profile_id, content_id, kind, location) VALUES ($2 || '-mark', $1, $2, $3, 'bookmark', 'loc')`,
+		} {
+			args := []any{userID, profileID, contentID}
+			if strings.Contains(stmt, "$4") {
+				args = append(args, fileID)
+			}
+			if _, err := pool.Exec(ctx, stmt, args...); err != nil {
+				t.Fatalf("seed %s: %v", profileID, err)
+			}
+		}
+	}
+
+	if err := NewPGEbookReaderProgressStore(pool).PurgeProfile(ctx, userID, "deleted"); err != nil {
+		t.Fatalf("PurgeProfile: %v", err)
+	}
+	for _, table := range []string{"ebook_reader_progress", "ebook_reader_config", "ebook_reader_annotations"} {
+		for profileID, want := range map[string]int{"deleted": 0, "kept": 1} {
+			var got int
+			if err := pool.QueryRow(ctx, "SELECT count(*) FROM "+table+" WHERE user_id = $1 AND profile_id = $2", userID, profileID).Scan(&got); err != nil {
+				t.Fatal(err)
+			}
+			if got != want {
+				t.Errorf("%s rows of %s = %d, want %d", table, profileID, got, want)
+			}
+		}
+	}
+}
diff --git a/internal/api/handlers/episode_image_provenance_test.go b/internal/api/handlers/episode_image_provenance_test.go
index 979345ebcd..6ef5fe53e4 100644
--- a/internal/api/handlers/episode_image_provenance_test.go
+++ b/internal/api/handlers/episode_image_provenance_test.go
@@ -1,7 +1,6 @@
 package handlers
 
 import (
-	"context"
 	"encoding/json"
 	"strings"
 	"testing"
@@ -40,7 +39,7 @@ func TestEpisodeImageProvenanceBeforeSigning(t *testing.T) {
 			if fallback.PosterIsEpisodeStill == nil || *fallback.PosterIsEpisodeStill != tc.posterStill || fallback.BackdropIsEpisodeStill == nil || *fallback.BackdropIsEpisodeStill != tc.backdropStill {
 				t.Fatalf("fallback provenance = %v / %v", fallback.PosterIsEpisodeStill, fallback.BackdropIsEpisodeStill)
 			}
-			wt := (&RecommendationsHandler{}).buildSectionItem(context.Background(), item, nil, nil)
+			wt := (&RecommendationsHandler{}).buildSectionItem(item, nil, nil, sectionItemImageURLs{})
 			if wt.PosterIsEpisodeStill != item.PosterIsEpisodeStill || wt.BackdropIsEpisodeStill != item.BackdropIsEpisodeStill {
 				t.Fatal("Watch Tonight card drops provenance")
 			}
diff --git a/internal/api/handlers/events_socket_v2.go b/internal/api/handlers/events_socket_v2.go
index 66f5c9c5cf..28aafc8f47 100644
--- a/internal/api/handlers/events_socket_v2.go
+++ b/internal/api/handlers/events_socket_v2.go
@@ -260,9 +260,9 @@ type eventsSessionValidator interface {
 }
 
 // NewEventsSocketV2 reuses the current account, session and viewer authorities.
-func NewEventsSocketV2(events *EventsHandler, tickets *evt.SocketTicketStore, sessions eventsSessionValidator, users access.UserRepository, resolver apimw.ViewerResolver, primary apimw.PrimaryProfileChecker, publicURL string) *EventsSocketV2 {
+func NewEventsSocketV2(events *EventsHandler, tickets *evt.SocketTicketStore, sessions eventsSessionValidator, users access.UserRepository, resolver apimw.ViewerResolver, actingAdmin apimw.ActingAdminDecider, publicURL string) *EventsSocketV2 {
 	h := &EventsSocketV2{Events: events, Tickets: tickets, PublicOrigin: publicURL}
-	h.Validate = newSocketAuthorityValidator(sessions, users, resolver, primary)
+	h.Validate = newSocketAuthorityValidator(sessions, users, resolver, actingAdmin)
 	return h
 }
 
@@ -284,8 +284,13 @@ func refuseRemotePlaybackSocket(validate EventsSocketValidator) EventsSocketVali
 	}
 }
 
-func newSocketAuthorityValidator(sessions eventsSessionValidator, users access.UserRepository, resolver apimw.ViewerResolver, primary apimw.PrimaryProfileChecker) EventsSocketValidator {
-	if sessions == nil || users == nil || resolver == nil || primary == nil {
+// newSocketAuthorityValidator checks a socket identity against the current
+// login session, account and profile. The admin role holds only while
+// actingAdmin allows it, the decision the HTTP admin routes apply: as the
+// account's primary profile, or with no profile while the household does not
+// require one. Otherwise the identity validates with the user role.
+func newSocketAuthorityValidator(sessions eventsSessionValidator, users access.UserRepository, resolver apimw.ViewerResolver, actingAdmin apimw.ActingAdminDecider) EventsSocketValidator {
+	if sessions == nil || users == nil || resolver == nil || actingAdmin == nil {
 		return nil
 	}
 	return func(ctx context.Context, identity evt.SocketIdentity) (context.Context, *auth.Claims, error) {
@@ -329,12 +334,16 @@ func newSocketAuthorityValidator(sessions eventsSessionValidator, users access.U
 			return ctx, nil, errSocketAccessChanged
 		}
 		role := authority.Role
-		if role == eventsAdminRole && identity.ProfileID != "" {
-			isPrimary, found, err := primary(checkCtx, identity.UserID, identity.ProfileID)
-			if err != nil || !found {
+		if role == eventsAdminRole {
+			acting, err := actingAdmin(checkCtx, apimw.ActingAdminRequest{
+				Claims:    &auth.Claims{ImpersonatorUserID: identity.ImpersonatorUserID, UserID: identity.UserID, SessionID: identity.SessionID, Role: role, TokenType: auth.TokenTypeAccess},
+				ProfileID: identity.ProfileID,
+				DeviceID:  identity.DeviceID,
+			})
+			if err != nil {
 				return ctx, nil, evt.ErrSocketTicket
 			}
-			if !isPrimary {
+			if !acting {
 				role = string(scopeUser)
 			}
 		}
diff --git a/internal/api/handlers/events_socket_v2_test.go b/internal/api/handlers/events_socket_v2_test.go
index 5b019a2f41..7bec6f616e 100644
--- a/internal/api/handlers/events_socket_v2_test.go
+++ b/internal/api/handlers/events_socket_v2_test.go
@@ -14,6 +14,7 @@ import (
 	"github.com/gorilla/websocket"
 
 	"github.com/prairie-server/prairie-server/internal/access"
+	apimw "github.com/prairie-server/prairie-server/internal/api/middleware"
 	"github.com/prairie-server/prairie-server/internal/auth"
 	evt "github.com/prairie-server/prairie-server/internal/events"
 	"github.com/prairie-server/prairie-server/internal/models"
@@ -164,7 +165,7 @@ func TestEventsSocketV2ValidatesCurrentSessionAccountAndProfile(t *testing.T) {
 	sessions := &socketSessionFixture{valid: true, account: users}
 	viewer := &socketViewerFixture{scope: access.Scope{UserID: 7, ProfileID: "secondary", ProfileVerified: true, PolicyRevision: 1}}
 	primaryFlag := false
-	h := NewEventsSocketV2(events.Events, events.Tickets, sessions, users, viewer, func(context.Context, int, string) (bool, bool, error) { return primaryFlag, true, nil }, "")
+	h := NewEventsSocketV2(events.Events, events.Tickets, sessions, users, viewer, apimw.NewActingAdminDecider(func(context.Context, int, string) (bool, bool, error) { return primaryFlag, true, nil }, nil), "")
 	proof := evt.SocketIdentity{UserID: 7, SessionID: "session", Role: "admin", ProfileID: "secondary", AccessExpiresAt: time.Now().Add(time.Minute)}
 	ticket, err := h.Mint(t.Context(), proof)
 	if err != nil {
@@ -335,7 +336,7 @@ func TestSocketValidatorBindsRemotePlayback(t *testing.T) {
 	users := &socketUserFixture{user: models.User{ID: 7, Role: "admin", Enabled: true}}
 	sessions := &socketSessionFixture{valid: true, account: users, remoteProfile: "kid"}
 	viewer := &socketViewerFixture{scope: access.Scope{UserID: 7, ProfileID: "kid", ProfileVerified: true, PolicyRevision: 1}}
-	h := NewEventsSocketV2(events.Events, events.Tickets, sessions, users, viewer, func(context.Context, int, string) (bool, bool, error) { return true, true, nil }, "")
+	h := NewEventsSocketV2(events.Events, events.Tickets, sessions, users, viewer, apimw.NewActingAdminDecider(func(context.Context, int, string) (bool, bool, error) { return true, true, nil }, nil), "")
 	identity := evt.SocketIdentity{UserID: 7, SessionID: "session", Role: "user", ProfileID: "kid", AccessExpiresAt: time.Now().Add(time.Minute)}
 	_, claims, err := h.Validate(t.Context(), identity)
 	if err != nil || claims.Role != "user" || !claims.IsRemotePlayback() || claims.IsOwnLoginSession() {
@@ -362,7 +363,7 @@ func TestWatchTogetherSocketRefusesRemotePlayback(t *testing.T) {
 	viewer := &socketViewerFixture{scope: access.Scope{UserID: 7, ProfileID: "kid", ProfileVerified: true, PolicyRevision: 1}}
 	primary := func(context.Context, int, string) (bool, bool, error) { return false, true, nil }
 	identity := evt.SocketIdentity{UserID: 7, SessionID: "session", Role: "user", ProfileID: "kid", AccessExpiresAt: time.Now().Add(time.Minute)}
-	room := NewWatchTogetherSocketV2(nil, nil, sessions, users, viewer, primary, "")
+	room := NewWatchTogetherSocketV2(nil, nil, sessions, users, viewer, apimw.NewActingAdminDecider(primary, nil), "")
 	if _, _, err := room.Validate(t.Context(), identity); !errors.Is(err, evt.ErrSocketTicket) {
 		t.Fatalf("handoff room ticket: %v", err)
 	}
@@ -371,3 +372,90 @@ func TestWatchTogetherSocketRefusesRemotePlayback(t *testing.T) {
 		t.Fatalf("ordinary room ticket = %+v, %v", claims, err)
 	}
 }
+
+// A profile-less admin session holds the administrator role only while its
+// household does not require a profile, the rule the HTTP admin routes apply:
+// a ticket minted after the household gains a PIN or a limit carries the user
+// role, and one minted before it stops validating.
+func TestSocketValidatorProfileLessAdminFollowsHouseholdRequirement(t *testing.T) {
+	events, _ := socketTestHandler()
+	users := &socketUserFixture{user: models.User{ID: 7, Role: "admin", Enabled: true}}
+	sessions := &socketSessionFixture{valid: true, account: users}
+	viewer := &socketViewerFixture{scope: access.Scope{UserID: 7, ProfileVerified: true, PolicyRevision: 1}}
+	var requiresProfile atomic.Bool
+	var householdDown atomic.Bool
+	decide := apimw.NewActingAdminDecider(
+		func(context.Context, int, string) (bool, bool, error) { return true, true, nil },
+		func(context.Context, int) (bool, error) {
+			if householdDown.Load() {
+				return false, errors.New("profile store down")
+			}
+			return requiresProfile.Load(), nil
+		})
+	h := NewEventsSocketV2(events.Events, events.Tickets, sessions, users, viewer, decide, "")
+	identity := evt.SocketIdentity{UserID: 7, SessionID: "session", Role: "admin", AccessExpiresAt: time.Now().Add(time.Minute)}
+	mint := func() evt.SocketIdentity {
+		t.Helper()
+		ticket, err := h.Mint(t.Context(), identity)
+		if err != nil {
+			t.Fatal(err)
+		}
+		proof, err := h.Tickets.Consume(t.Context(), ticket)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return proof
+	}
+
+	open := mint()
+	if _, claims, err := h.Validate(t.Context(), open); err != nil || claims.Role != "admin" {
+		t.Fatalf("household without a requirement: %+v, %v", claims, err)
+	}
+
+	requiresProfile.Store(true)
+	if _, _, err := h.Validate(t.Context(), open); !errors.Is(err, errSocketAccessChanged) {
+		t.Fatalf("open admin socket after the household gained a PIN: %v, want an access change", err)
+	}
+	demoted := mint()
+	if demoted.EffectiveRole != "user" {
+		t.Fatalf("profile-less ticket effective role = %q, want user", demoted.EffectiveRole)
+	}
+	_, claims, err := h.Validate(t.Context(), demoted)
+	if err != nil || claims.Role != "user" {
+		t.Fatalf("profile-less ticket on a household that requires a profile: %+v, %v", claims, err)
+	}
+	if channels := allowedChannelsForClaims(claims); slices.Contains(channels, evt.ChannelSessions) {
+		t.Fatalf("profile-less session offered the administrator channels: %v", channels)
+	}
+
+	householdDown.Store(true)
+	if _, _, err := h.Validate(t.Context(), demoted); !errors.Is(err, evt.ErrSocketTicket) {
+		t.Fatalf("failed household lookup: %v, want the credential refused", err)
+	}
+}
+
+// The acting-admin decision sees the minting request's device, as the HTTP
+// admin gate does, so a policy keyed on the device answers the same on both.
+func TestSocketValidatorPassesDeviceToActingAdmin(t *testing.T) {
+	events, _ := socketTestHandler()
+	users := &socketUserFixture{user: models.User{ID: 7, Role: "admin", Enabled: true}}
+	sessions := &socketSessionFixture{valid: true, account: users}
+	viewer := &socketViewerFixture{scope: access.Scope{UserID: 7, ProfileID: "parent", ProfileVerified: true, PolicyRevision: 1}}
+	var devices []string
+	decide := func(_ context.Context, in apimw.ActingAdminRequest) (bool, error) {
+		devices = append(devices, in.DeviceID)
+		return in.DeviceID != "refused-device", nil
+	}
+	h := NewEventsSocketV2(events.Events, events.Tickets, sessions, users, viewer, decide, "")
+	identity := evt.SocketIdentity{UserID: 7, SessionID: "session", Role: "admin", ProfileID: "parent", DeviceID: "refused-device", AccessExpiresAt: time.Now().Add(time.Minute)}
+	if _, claims, err := h.Validate(t.Context(), identity); err != nil || claims.Role != "user" {
+		t.Fatalf("refused device: %+v, %v", claims, err)
+	}
+	identity.DeviceID = "tv-1"
+	if _, claims, err := h.Validate(t.Context(), identity); err != nil || claims.Role != "admin" {
+		t.Fatalf("allowed device: %+v, %v", claims, err)
+	}
+	if !slices.Equal(devices, []string{"refused-device", "tv-1"}) {
+		t.Fatalf("decider saw devices %v", devices)
+	}
+}
diff --git a/internal/api/handlers/events_ws.go b/internal/api/handlers/events_ws.go
index ef341672f3..a021b1df3e 100644
--- a/internal/api/handlers/events_ws.go
+++ b/internal/api/handlers/events_ws.go
@@ -3,6 +3,7 @@ package handlers
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"log/slog"
 	"net/http"
 	"net/url"
@@ -12,7 +13,7 @@ import (
 
 	"github.com/gorilla/websocket"
 	"github.com/oklog/ulid/v2"
-
+	"github.com/prairie-server/prairie-server/internal/access"
 	"github.com/prairie-server/prairie-server/internal/adminjob"
 	apimw "github.com/prairie-server/prairie-server/internal/api/middleware"
 	"github.com/prairie-server/prairie-server/internal/auth"
@@ -87,6 +88,9 @@ type EventsHandler struct {
 	// periodic login-session check; see SetSessionRoles.
 	sessionRoles         sessionRoleChecker
 	sessionCheckInterval time.Duration
+	// profiles re-verifies the PIN proof of the profile a connection holding
+	// the admin channels acts as; see SetProfileVerifier.
+	profiles apimw.ViewerResolver
 }
 
 // sessionRoleChecker reports whether a login session is still active and its
@@ -106,6 +110,16 @@ func (h *EventsHandler) SetSessionRoles(sessions sessionRoleChecker) {
 	}
 }
 
+// SetProfileVerifier makes the v1 events socket re-verify, at the handshake
+// and on every session check, the PIN proof of the profile a connection on an
+// admin account acts as, so changing that profile's PIN takes the admin
+// channels away as it does on the v2 socket.
+func (h *EventsHandler) SetProfileVerifier(profiles apimw.ViewerResolver) {
+	if h != nil {
+		h.profiles = profiles
+	}
+}
+
 // SetNotificationsSystem wires the user-notification system: websocket
 // handshake tickets and the notifications channel snapshot.
 func (h *EventsHandler) SetNotificationsSystem(system *notifications.System) {
@@ -150,11 +164,11 @@ func (h *EventsHandler) HandleWebSocket(w http.ResponseWriter, r *http.Request)
 	// identity arrives as a short-lived single-use ticket minted via
 	// POST /events/ws-ticket. A connection without a ticket stays unbound and
 	// simply cannot subscribe to the profile-scoped notifications channel.
-	boundProfileID := ""
+	var bound notifications.Ticket
 	if ticket := r.URL.Query().Get("ticket"); ticket != "" && h.notifications != nil {
-		ticketUserID, ticketProfileID, ok := h.notifications.Tickets.Consume(r.Context(), ticket)
-		if ok && ticketUserID == claims.UserID {
-			boundProfileID = ticketProfileID
+		binding, ok := h.notifications.Tickets.Consume(r.Context(), ticket)
+		if ok && binding.UserID == claims.UserID {
+			bound = binding
 		} else {
 			// Expired, reused, consumed on a different node, or minted for
 			// another user: degrade to an unbound connection instead of
@@ -173,15 +187,20 @@ func (h *EventsHandler) HandleWebSocket(w http.ResponseWriter, r *http.Request)
 	// Admin channels and other accounts' events follow the acting profile, as
 	// on the v2 socket: another profile on an admin's account connects with
 	// the user role. A handshake that declares no profile acts as the profile
-	// its ticket was minted for, which the viewer gate verified then. The
-	// session check below still compares the account's real role.
+	// its ticket was minted for, which the viewer gate verified then. Either
+	// way the profile's PIN proof is re-verified here and on every session
+	// check. The session check below still compares the account's real role.
+	boundProfileID := bound.ProfileID
 	effective := claims
 	var stillActingAdmin func(context.Context) (bool, error)
 	if claims.Role == models.RoleAdmin {
 		stillActingAdmin = apimw.ActingAdmin
-		if apimw.GetProfileID(r.Context()) == "" && boundProfileID != "" {
+		actingProfileID, profileToken := apimw.GetProfileID(r.Context()), r.Header.Get("X-Profile-Token")
+		if actingProfileID == "" && boundProfileID != "" {
+			actingProfileID, profileToken = boundProfileID, bound.ProfileToken
 			stillActingAdmin = func(ctx context.Context) (bool, error) { return apimw.ActingAdminAs(ctx, boundProfileID) }
 		}
+		stillActingAdmin = h.withProfileProof(stillActingAdmin, claims, actingProfileID, profileToken)
 		actingAdmin, err := stillActingAdmin(r.Context())
 		if err != nil {
 			http.Error(w, "failed to verify active profile", http.StatusInternalServerError)
@@ -204,11 +223,42 @@ func (h *EventsHandler) HandleWebSocket(w http.ResponseWriter, r *http.Request)
 	h.serveWebSocket(w, r, effective, boundProfileID, wsUpgrader, nil)
 }
 
+// withProfileProof narrows decide to while profileID's PIN proof still
+// verifies for the connection's login session. The proof is bound to the
+// profile's PIN revision, so a PIN change, or a PIN newly set on the profile,
+// ends it. With no verifier wired, or no profile, decide is returned as is.
+func (h *EventsHandler) withProfileProof(decide func(context.Context) (bool, error), claims *auth.Claims, profileID, profileToken string) func(context.Context) (bool, error) {
+	if h.profiles == nil || profileID == "" {
+		return decide
+	}
+	input := access.ResolveInput{
+		UserID:       claims.UserID,
+		SessionID:    claims.SessionID,
+		ProfileID:    profileID,
+		ProfileToken: profileToken,
+		// API keys carry no PIN proof by design, as at the viewer gate.
+		SkipPINVerification: claims.TokenType == auth.TokenTypeAPIKey,
+	}
+	return func(ctx context.Context) (bool, error) {
+		scope, err := h.profiles.Resolve(ctx, input)
+		if errors.Is(err, access.ErrProfileUnverified) || errors.Is(err, access.ErrProfileNotFound) {
+			return false, nil
+		}
+		if err != nil {
+			return false, err
+		}
+		if !scope.ProfileVerified {
+			return false, nil
+		}
+		return decide(ctx)
+	}
+}
+
 // closeOnSessionChange cancels a v1 connection once its login session is no
 // longer active or the account's role differs from the access token's, and,
 // for a connection holding the admin channels, once stillActingAdmin stops
-// holding (say the household gained a PIN). A failed check is skipped; the
-// next one decides.
+// holding (say the household gained a PIN, or the acting profile's PIN
+// changed). A failed check is skipped; the next one decides.
 func (h *EventsHandler) closeOnSessionChange(ctx context.Context, cancel context.CancelFunc, claims *auth.Claims, stillActingAdmin func(context.Context) (bool, error)) {
 	interval := h.sessionCheckInterval
 	if interval <= 0 {
@@ -723,7 +773,7 @@ func (h *EventsHandler) snapshotForChannel(
 		if h == nil || h.notifications == nil || boundProfileID == "" {
 			return json.RawMessage("[]"), nil
 		}
-		rows, err := h.notifications.Deliveries.RecentUnread(r.Context(), boundProfileID, 25)
+		rows, err := h.notifications.Deliveries.RecentUnread(r.Context(), claims.UserID, boundProfileID, 25)
 		if err != nil {
 			return nil, err
 		}
diff --git a/internal/api/handlers/events_ws_declared_channels_test.go b/internal/api/handlers/events_ws_declared_channels_test.go
index 652345c392..5c98c7ff03 100644
--- a/internal/api/handlers/events_ws_declared_channels_test.go
+++ b/internal/api/handlers/events_ws_declared_channels_test.go
@@ -347,7 +347,7 @@ func TestEventsWebSocketAdminDecisionUsesTicketProfile(t *testing.T) {
 	for profile, wantAdmin := range map[string]bool{"parent": true, "kid": false} {
 		t.Run(profile, func(t *testing.T) {
 			tickets := notifications.NewTicketStore(nil)
-			ticket, _, err := tickets.Mint(t.Context(), 1, profile)
+			ticket, _, err := tickets.Mint(t.Context(), notifications.Ticket{UserID: 1, ProfileID: profile})
 			if err != nil {
 				t.Fatal(err)
 			}
diff --git a/internal/api/handlers/events_ws_session_check_test.go b/internal/api/handlers/events_ws_session_check_test.go
index 01fe97f1b3..194bc493f7 100644
--- a/internal/api/handlers/events_ws_session_check_test.go
+++ b/internal/api/handlers/events_ws_session_check_test.go
@@ -2,16 +2,23 @@ package handlers
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
+	"net/url"
+	"strings"
 	"sync/atomic"
 	"testing"
 	"time"
 
+	"github.com/gorilla/websocket"
+
+	"github.com/prairie-server/prairie-server/internal/access"
 	apimw "github.com/prairie-server/prairie-server/internal/api/middleware"
 	"github.com/prairie-server/prairie-server/internal/auth"
 	"github.com/prairie-server/prairie-server/internal/cache"
 	evt "github.com/prairie-server/prairie-server/internal/events"
 	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/notifications"
 )
 
 // sessionRoleFixture answers ActiveSession from values a test changes
@@ -107,3 +114,71 @@ func TestEventsWebSocketV1ClosesWhenSessionChanges(t *testing.T) {
 		})
 	}
 }
+
+// profileProofFixture verifies a profile's PIN proof as the viewer resolver
+// does: only the token the profile was unlocked with, until its PIN changes.
+type profileProofFixture struct{ pinChanged atomic.Bool }
+
+func (f *profileProofFixture) Resolve(_ context.Context, in access.ResolveInput) (access.Scope, error) {
+	if f.pinChanged.Load() || in.ProfileToken != "pin-proof" {
+		return access.Scope{}, access.ErrProfileUnverified
+	}
+	return access.Scope{UserID: in.UserID, ProfileID: in.ProfileID, ProfileVerified: true}, nil
+}
+
+// TestEventsWebSocketV1RechecksTicketProfileProof: a v1 connection holding
+// the administrator channels as the primary profile its ticket was minted for
+// re-verifies that profile's PIN proof, at the handshake and on every session
+// check, so a PIN change closes it as on the v2 socket.
+func TestEventsWebSocketV1RechecksTicketProfileProof(t *testing.T) {
+	decide := func(_ context.Context, in apimw.ActingAdminRequest) (bool, error) {
+		return in.ProfileID == "parent", nil
+	}
+	connect := func(t *testing.T, proofs *profileProofFixture, token string) (*websocket.Conn, func(string) map[string]json.RawMessage) {
+		t.Helper()
+		tickets := notifications.NewTicketStore(nil)
+		ticket, _, err := tickets.Mint(t.Context(), notifications.Ticket{UserID: 1, ProfileID: "parent", ProfileToken: token})
+		if err != nil {
+			t.Fatal(err)
+		}
+		sessions := new(sessionRoleFixture)
+		sessions.role.Store("admin")
+		handler := &EventsHandler{hub: evt.NewHub("test", &cache.NoopEventBus{}), sessionCheckInterval: 10 * time.Millisecond}
+		handler.SetNotificationsSystem(&notifications.System{Tickets: tickets})
+		handler.SetSessionRoles(sessions)
+		handler.SetProfileVerifier(proofs)
+		return eventsWSTestConnActing(t, handler, &auth.Claims{UserID: 1, Role: "admin", SessionID: "session"},
+			"?channels=user_settings&ticket="+url.QueryEscape(ticket), decide)
+	}
+	adminChannels := func(hello map[string]json.RawMessage) bool {
+		return strings.Contains(string(hello["available_channels"]), `"sessions"`)
+	}
+
+	t.Run("stale proof at the handshake", func(t *testing.T) {
+		_, readFrame := connect(t, new(profileProofFixture), "old-pin-proof")
+		if adminChannels(readFrame("hello")) {
+			t.Fatal("ticket with a stale PIN proof got the administrator channels")
+		}
+	})
+
+	t.Run("PIN changes while connected", func(t *testing.T) {
+		proofs := new(profileProofFixture)
+		conn, readFrame := connect(t, proofs, "pin-proof")
+		if !adminChannels(readFrame("hello")) {
+			t.Fatal("verified primary profile did not get the administrator channels")
+		}
+		readFrame("subscribed")
+		proofs.pinChanged.Store(true)
+		if err := conn.SetReadDeadline(time.Now().Add(2 * time.Second)); err != nil {
+			t.Fatal(err)
+		}
+		for {
+			if _, _, err := conn.ReadMessage(); err != nil {
+				if strings.Contains(err.Error(), "timeout") {
+					t.Fatal("connection stayed open after the PIN changed")
+				}
+				return
+			}
+		}
+	})
+}
diff --git a/internal/api/handlers/favorites.go b/internal/api/handlers/favorites.go
index 8f864b4af5..87703334e2 100644
--- a/internal/api/handlers/favorites.go
+++ b/internal/api/handlers/favorites.go
@@ -4,7 +4,9 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"maps"
 	"net/http"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -19,6 +21,7 @@ import (
 	"github.com/prairie-server/prairie-server/internal/models"
 	"github.com/prairie-server/prairie-server/internal/userstore"
 	"github.com/prairie-server/prairie-server/internal/watchlist"
+	"github.com/prairie-server/prairie-server/internal/watchstate"
 	"github.com/prairie-server/prairie-server/internal/watchsync"
 )
 
@@ -26,6 +29,7 @@ type personalDataItemRepository interface {
 	GetByID(ctx context.Context, contentID string) (*models.MediaItem, error)
 	GetByIDs(ctx context.Context, contentIDs []string) ([]*models.MediaItem, error)
 	EnsureAccessible(ctx context.Context, contentID string, filter catalog.AccessFilter) error
+	EnsureAccessibleIDs(ctx context.Context, contentIDs []string, filter catalog.AccessFilter) (map[string]bool, error)
 }
 
 type LocalListEventDispatcher interface {
@@ -34,17 +38,16 @@ type LocalListEventDispatcher interface {
 
 // PersonalDataHandler handles favorites, watchlist, and history endpoints.
 type PersonalDataHandler struct {
-	storeProvider           userstore.UserStoreProvider
-	itemRepo                personalDataItemRepository
-	episodeRepo             *catalog.EpisodeRepository
-	seasonRepo              *catalog.SeasonRepository
-	detailSvc               *catalog.DetailService
-	EventsHub               *evt.Hub
-	localListDispatcher     LocalListEventDispatcher
-	profileStaler           ProfileStaler
-	profileRefreshRequester ProfileRefreshRequester
-	ebookProgressStore      EbookReaderProgressLister
-	watchlistTitles         *watchlist.Titles
+	storeProvider       userstore.UserStoreProvider
+	itemRepo            personalDataItemRepository
+	episodeRepo         *catalog.EpisodeRepository
+	seasonRepo          *catalog.SeasonRepository
+	detailSvc           *catalog.DetailService
+	EventsHub           *evt.Hub
+	localListDispatcher LocalListEventDispatcher
+	signalsNotifier     SignalsChangedNotifier
+	ebookProgressStore  EbookReaderProgressLister
+	watchlistTitles     *watchlist.Titles
 }
 
 // NewPersonalDataHandler creates a new PersonalDataHandler.
@@ -64,14 +67,10 @@ func (h *PersonalDataHandler) SetEbookReaderProgressStore(store EbookReaderProgr
 	h.ebookProgressStore = store
 }
 
-// SetProfileStaler configures an optional staleness trigger for taste profiles.
-func (h *PersonalDataHandler) SetProfileStaler(ps ProfileStaler) {
-	h.profileStaler = ps
-}
-
-// SetProfileRefreshRequester configures an optional background refresh queue for taste profiles.
-func (h *PersonalDataHandler) SetProfileRefreshRequester(requester ProfileRefreshRequester) {
-	h.profileRefreshRequester = requester
+// SetSignalsChangedNotifier configures where changes to a profile's
+// recommendation signals are reported. Without it they are not reported.
+func (h *PersonalDataHandler) SetSignalsChangedNotifier(notifier SignalsChangedNotifier) {
+	h.signalsNotifier = notifier
 }
 
 func (h *PersonalDataHandler) SetEpisodeRepo(repo *catalog.EpisodeRepository) {
@@ -124,6 +123,14 @@ type PersonalListViewer struct {
 	ProfileID string
 	Access    catalog.AccessFilter
 	ImageSize imagesize.Size
+	// ImageWidths are per-slot target widths overriding ImageSize; only the
+	// native v2 API carries them.
+	ImageWidths imagesize.Widths
+}
+
+// Artwork is the viewer's artwork preference.
+func (v PersonalListViewer) Artwork() imagesize.Request {
+	return imagesize.Request{Size: v.ImageSize, Widths: v.ImageWidths}
 }
 
 func personalListViewerFromRequest(r *http.Request) PersonalListViewer {
@@ -198,8 +205,9 @@ func (h *PersonalDataHandler) GetFavorite(ctx context.Context, viewer PersonalLi
 }
 
 // AddFavorite adds an item the viewer may see to the profile's favorites.
-// Adding an item that is already a favorite is a no-op that still notifies
-// the same listeners, so a retried add converges.
+// Listeners hear only about an add that inserted the row: adding an item
+// that is already a favorite succeeds and notifies nobody, so a retried add
+// repeats no side effect.
 func (h *PersonalDataHandler) AddFavorite(ctx context.Context, viewer PersonalListViewer, itemID string) error {
 	store, err := h.storeProvider.ForUser(ctx, viewer.UserID)
 	if err != nil {
@@ -208,34 +216,33 @@ func (h *PersonalDataHandler) AddFavorite(ctx context.Context, viewer PersonalLi
 	if err := h.ensureAccessibleItem(ctx, itemID, viewer.Access); err != nil {
 		return apiError(http.StatusNotFound, "not_found", "Item not found")
 	}
-	if err := store.AddFavorite(ctx, viewer.ProfileID, itemID); err != nil {
+	added, err := store.AddFavorite(ctx, viewer.ProfileID, itemID)
+	if err != nil {
 		return apiError(http.StatusInternalServerError, "internal_error", "Failed to add favorite")
 	}
-	h.dispatchLocalListEvent(ctx, watchsync.ListKindFavorites, watchsync.ListChangeAdded, viewer.UserID, viewer.ProfileID, itemID)
-	triggerProfileRefresh(ctx, h.profileStaler, h.profileRefreshRequester, viewer.UserID, viewer.ProfileID)
-	publishUserStateEvent(ctx, h.EventsHub, viewer.UserID, viewer.ProfileID, itemID, "", "favorite", userStateEventState{
-		IsFavorite: boolPtr(true),
-	})
+	if added {
+		h.notifyListChange(ctx, watchsync.ListKindFavorites, watchsync.ListChangeAdded, viewer, itemID)
+	}
 	return nil
 }
 
 // RemoveFavorite removes an item from the profile's favorites. Removing an
-// item that is not a favorite succeeds, so a retried remove converges. No
-// access check runs: the item may have left the viewer's scope since it was
-// added, and the profile must still be able to drop it.
+// item that is not a favorite succeeds and notifies nobody, so a retried
+// remove converges and repeats no side effect. No access check runs: the
+// item may have left the viewer's scope since it was added, and the profile
+// must still be able to drop it.
 func (h *PersonalDataHandler) RemoveFavorite(ctx context.Context, viewer PersonalListViewer, itemID string) error {
 	store, err := h.storeProvider.ForUser(ctx, viewer.UserID)
 	if err != nil {
 		return apiError(http.StatusInternalServerError, "internal_error", "Failed to access user store")
 	}
-	if err := store.RemoveFavorite(ctx, viewer.ProfileID, itemID); err != nil {
+	removed, err := store.RemoveFavorite(ctx, viewer.ProfileID, itemID)
+	if err != nil {
 		return apiError(http.StatusInternalServerError, "internal_error", "Failed to remove favorite")
 	}
-	h.dispatchLocalListEvent(ctx, watchsync.ListKindFavorites, watchsync.ListChangeRemoved, viewer.UserID, viewer.ProfileID, itemID)
-	triggerProfileRefresh(ctx, h.profileStaler, h.profileRefreshRequester, viewer.UserID, viewer.ProfileID)
-	publishUserStateEvent(ctx, h.EventsHub, viewer.UserID, viewer.ProfileID, itemID, "", "favorite", userStateEventState{
-		IsFavorite: boolPtr(false),
-	})
+	if removed {
+		h.notifyListChange(ctx, watchsync.ListKindFavorites, watchsync.ListChangeRemoved, viewer, itemID)
+	}
 	return nil
 }
 
@@ -293,6 +300,29 @@ func (h *PersonalDataHandler) HandleRemoveFavorite(w http.ResponseWriter, r *htt
 	w.WriteHeader(http.StatusNoContent)
 }
 
+// listChangeNoticeTimeout bounds the notices for one committed favorites or
+// watchlist change, which no longer end with the request.
+const listChangeNoticeTimeout = 30 * time.Second
+
+// notifyListChange tells every listener about a favorites or watchlist row a
+// write inserted or deleted: connected watch providers, the profile's
+// recommendations, and the profile's clients. The row is already committed,
+// so the notices run on a context the request's cancellation does not reach.
+// A client that disconnects now would retry, and its retry changes no row and
+// sends nothing.
+func (h *PersonalDataHandler) notifyListChange(ctx context.Context, list watchsync.ListKind, change watchsync.ListChange, viewer PersonalListViewer, itemID string) {
+	ctx, cancel := context.WithTimeout(context.WithoutCancel(ctx), listChangeNoticeTimeout)
+	defer cancel()
+	h.dispatchLocalListEvent(ctx, list, change, viewer.UserID, viewer.ProfileID, itemID)
+	notifySignalsChanged(ctx, h.signalsNotifier, viewer.UserID, viewer.ProfileID)
+	member := change == watchsync.ListChangeAdded
+	state, stateChange := userStateEventState{IsFavorite: &member}, "favorite"
+	if list == watchsync.ListKindWatchlist {
+		state, stateChange = userStateEventState{InWatchlist: &member}, "watchlist"
+	}
+	publishUserStateEvent(ctx, h.EventsHub, viewer.UserID, viewer.ProfileID, itemID, "", stateChange, state)
+}
+
 func (h *PersonalDataHandler) dispatchLocalListEvent(ctx context.Context, list watchsync.ListKind, change watchsync.ListChange, userID int, profileID string, itemID string) {
 	if h == nil || h.localListDispatcher == nil || h.itemRepo == nil {
 		return
@@ -396,6 +426,26 @@ func (h *PersonalDataHandler) ListWatchlistPage(ctx context.Context, viewer Pers
 	return entries, items, nil
 }
 
+// VisibleItemIDs reports which of the given catalog items the viewer may see.
+func (h *PersonalDataHandler) VisibleItemIDs(ctx context.Context, viewer PersonalListViewer, ids []string) (map[string]bool, error) {
+	visible, err := h.itemRepo.EnsureAccessibleIDs(ctx, ids, viewer.Access)
+	if err != nil {
+		return nil, apiError(http.StatusInternalServerError, "internal_error", "Failed to check item access")
+	}
+	return visible, nil
+}
+
+// ResolveCards answers the cards of the given catalog items the viewer may
+// see, in the order given. Items the catalog no longer has or the viewer may
+// not see have no card.
+func (h *PersonalDataHandler) ResolveCards(ctx context.Context, viewer PersonalListViewer, ids []string) ([]CollectionItemView, error) {
+	items, err := resolveItemsByIDs(h, ctx, viewer, ids)
+	if err != nil {
+		return nil, apiError(http.StatusInternalServerError, "internal_error", "Failed to resolve items")
+	}
+	return items, nil
+}
+
 // filterHiddenWatchlistSeries drops fully-watched series from a watchlist page.
 // The entries stay in the store (and on synced providers) so a newly added
 // episode makes the series reappear; only the display surface hides them.
@@ -447,8 +497,9 @@ func (h *PersonalDataHandler) GetWatchlistEntry(ctx context.Context, viewer Pers
 }
 
 // AddToWatchlist adds an item the viewer may see to the profile's
-// watchlist. Adding an item that is already on it is a no-op that still
-// notifies the same listeners, so a retried add converges.
+// watchlist. Listeners hear only about an add that inserted the row: adding
+// an item that is already on it succeeds and notifies nobody, so a retried
+// add repeats no side effect.
 func (h *PersonalDataHandler) AddToWatchlist(ctx context.Context, viewer PersonalListViewer, itemID string) error {
 	store, err := h.storeProvider.ForUser(ctx, viewer.UserID)
 	if err != nil {
@@ -457,34 +508,33 @@ func (h *PersonalDataHandler) AddToWatchlist(ctx context.Context, viewer Persona
 	if err := h.ensureAccessibleItem(ctx, itemID, viewer.Access); err != nil {
 		return apiError(http.StatusNotFound, "not_found", "Item not found")
 	}
-	if err := store.AddToWatchlist(ctx, viewer.ProfileID, itemID); err != nil {
+	added, err := store.AddToWatchlist(ctx, viewer.ProfileID, itemID)
+	if err != nil {
 		return apiError(http.StatusInternalServerError, "internal_error", "Failed to add to watchlist")
 	}
-	h.dispatchLocalListEvent(ctx, watchsync.ListKindWatchlist, watchsync.ListChangeAdded, viewer.UserID, viewer.ProfileID, itemID)
-	triggerProfileRefresh(ctx, h.profileStaler, h.profileRefreshRequester, viewer.UserID, viewer.ProfileID)
-	publishUserStateEvent(ctx, h.EventsHub, viewer.UserID, viewer.ProfileID, itemID, "", "watchlist", userStateEventState{
-		InWatchlist: boolPtr(true),
-	})
+	if added {
+		h.notifyListChange(ctx, watchsync.ListKindWatchlist, watchsync.ListChangeAdded, viewer, itemID)
+	}
 	return nil
 }
 
 // RemoveFromWatchlist removes an item from the profile's watchlist.
-// Removing an item that is not on it succeeds, so a retried remove
-// converges. No access check runs: the item may have left the viewer's
-// scope since it was added, and the profile must still be able to drop it.
+// Removing an item that is not on it succeeds and notifies nobody, so a
+// retried remove converges and repeats no side effect. No access check
+// runs: the item may have left the viewer's scope since it was added, and
+// the profile must still be able to drop it.
 func (h *PersonalDataHandler) RemoveFromWatchlist(ctx context.Context, viewer PersonalListViewer, itemID string) error {
 	store, err := h.storeProvider.ForUser(ctx, viewer.UserID)
 	if err != nil {
 		return apiError(http.StatusInternalServerError, "internal_error", "Failed to access user store")
 	}
-	if err := store.RemoveFromWatchlist(ctx, viewer.ProfileID, itemID); err != nil {
+	removed, err := store.RemoveFromWatchlist(ctx, viewer.ProfileID, itemID)
+	if err != nil {
 		return apiError(http.StatusInternalServerError, "internal_error", "Failed to remove from watchlist")
 	}
-	h.dispatchLocalListEvent(ctx, watchsync.ListKindWatchlist, watchsync.ListChangeRemoved, viewer.UserID, viewer.ProfileID, itemID)
-	triggerProfileRefresh(ctx, h.profileStaler, h.profileRefreshRequester, viewer.UserID, viewer.ProfileID)
-	publishUserStateEvent(ctx, h.EventsHub, viewer.UserID, viewer.ProfileID, itemID, "", "watchlist", userStateEventState{
-		InWatchlist: boolPtr(false),
-	})
+	if removed {
+		h.notifyListChange(ctx, watchsync.ListKindWatchlist, watchsync.ListChangeRemoved, viewer, itemID)
+	}
 	return nil
 }
 
@@ -664,7 +714,7 @@ func (h *PersonalDataHandler) historyDisplayCards(ctx context.Context, viewer Se
 	for _, d := range display {
 		ids = append(ids, d.DisplayID)
 	}
-	items, err := resolveItemsByIDs(h, ctx, PersonalListViewer{UserID: apimw.GetUserID(ctx), ProfileID: apimw.GetProfileID(ctx), Access: viewer.Access, ImageSize: viewer.ImageSize}, ids)
+	items, err := resolveItemsByIDs(h, ctx, PersonalListViewer{UserID: apimw.GetUserID(ctx), ProfileID: apimw.GetProfileID(ctx), Access: viewer.Access, ImageSize: viewer.ImageSize, ImageWidths: viewer.ImageWidths}, ids)
 	if err != nil {
 		return nil, apiError(http.StatusInternalServerError, "internal_error", "Failed to resolve history items")
 	}
@@ -715,7 +765,7 @@ func (h *PersonalDataHandler) RemoveHistory(ctx context.Context, userID int, pro
 		addMediaItems(resolvedIDs)
 		filelessIDs = append(filelessIDs, fileless...)
 	}
-	watchedFileless, err := watchedHistoryItemIDs(ctx, store, profileID, filelessIDs)
+	watchedFileless, err := watchstate.WatchedItemIDs(ctx, store, profileID, filelessIDs)
 	if err != nil {
 		return apiError(http.StatusInternalServerError, "internal_error", "Failed to remove history")
 	}
@@ -725,7 +775,7 @@ func (h *PersonalDataHandler) RemoveHistory(ctx context.Context, userID int, pro
 		return apiError(http.StatusInternalServerError, "internal_error", "Failed to remove history")
 	}
 
-	triggerProfileRefresh(ctx, h.profileStaler, h.profileRefreshRequester, userID, profileID)
+	notifySignalsChanged(ctx, h.signalsNotifier, userID, profileID)
 	for _, mediaItemID := range mediaItemIDs {
 		publishUserStateEvent(
 			ctx,
@@ -804,18 +854,22 @@ func resolveItemsByIDs(h *PersonalDataHandler, ctx context.Context, viewer Perso
 	// an unrecognized value. Unset keeps the per-slot defaults below, which are
 	// deliberately asymmetric (a featured poster beside a card backdrop); an
 	// explicit size applies to every image in the response instead.
-	size := viewer.ImageSize
-	posterHint := requestVariantHint("featured", size)
-	cardHint := requestVariantHint("card", size)
+	art := viewer.Artwork()
+	posterHint := requestVariantHint("featured", art.For(imagesize.SlotPoster))
+	cardHint := requestVariantHint("card", art.For(imagesize.SlotBackdrop))
+	itemIDs := make([]string, len(mediaItems))
+	for i, mi := range mediaItems {
+		itemIDs[i] = mi.ContentID
+	}
+	accessible, err := h.itemRepo.EnsureAccessibleIDs(ctx, itemIDs, filter)
+	if err != nil {
+		return nil, err
+	}
 	accessibleItems := make([]*models.MediaItem, 0, len(mediaItems))
 	for _, mi := range mediaItems {
-		if err := h.itemRepo.EnsureAccessible(ctx, mi.ContentID, filter); err != nil {
-			if errors.Is(err, catalog.ErrItemNotFound) {
-				continue
-			}
-			return nil, err
+		if accessible[mi.ContentID] {
+			accessibleItems = append(accessibleItems, mi)
 		}
-		accessibleItems = append(accessibleItems, mi)
 	}
 
 	userStates := map[string]*itemUserStateResponse{}
@@ -828,6 +882,9 @@ func resolveItemsByIDs(h *PersonalDataHandler, ctx context.Context, viewer Perso
 		}
 	}
 
+	// Card images resolve together once every card is built, in one batch per
+	// hint, rather than one lookup each.
+	var images listCardImages
 	for _, mi := range accessibleItems {
 		resp := itemListResponse{
 			ContentID:         mi.ContentID,
@@ -844,8 +901,8 @@ func resolveItemsByIDs(h *PersonalDataHandler, ctx context.Context, viewer Perso
 			BackdropThumbhash: mi.BackdropThumbhash,
 			UserState:         userStates[mi.ContentID],
 		}
-		resp.PosterURL = h.presignURL(ctx, sizedPosterPath(mi.PosterPath, size), posterHint)
-		resp.BackdropURL = h.presignURL(ctx, sizedCardBackdropPath(mi.BackdropPath, size), cardHint)
+		images.add(&resp.PosterURL, sizedPosterPath(mi.PosterPath, art.For(imagesize.SlotPoster)), posterHint)
+		images.add(&resp.BackdropURL, sizedCardBackdropPath(mi.BackdropPath, art.For(imagesize.SlotBackdrop)), cardHint)
 		byID[mi.ContentID] = &resp
 	}
 	logoPaths := localizedLogoPaths(ctx, h.detailSvc, accessibleItems, filter)
@@ -888,14 +945,14 @@ func resolveItemsByIDs(h *PersonalDataHandler, ctx context.Context, viewer Perso
 					}
 					// Use episode still as backdrop, fall back to parent series images.
 					if ep.StillPath != "" {
-						resp.BackdropURL = h.presignURL(ctx, sizedCardPath(ep.StillPath, artworkkey.ImageStill, size), cardHint)
+						images.add(&resp.BackdropURL, sizedCardPath(ep.StillPath, artworkkey.ImageStill, art.For(imagesize.SlotBackdrop)), cardHint)
 						resp.BackdropThumbhash = ep.StillThumbhash
 					} else if parent != nil {
-						resp.BackdropURL = h.presignURL(ctx, sizedCardBackdropPath(parent.BackdropPath, size), cardHint)
+						images.add(&resp.BackdropURL, sizedCardBackdropPath(parent.BackdropPath, art.For(imagesize.SlotBackdrop)), cardHint)
 						resp.BackdropThumbhash = parent.BackdropThumbhash
 					}
 					if parent != nil {
-						resp.PosterURL = h.presignURL(ctx, sizedPosterPath(parent.PosterPath, size), posterHint)
+						images.add(&resp.PosterURL, sizedPosterPath(parent.PosterPath, art.For(imagesize.SlotPoster)), posterHint)
 						resp.PosterThumbhash = parent.PosterThumbhash
 						resp.Year = parent.Year
 						resp.Genres = parent.Genres
@@ -910,7 +967,8 @@ func resolveItemsByIDs(h *PersonalDataHandler, ctx context.Context, viewer Perso
 		}
 	}
 
-	for contentID, url := range signListingLogos(ctx, h.detailSvc, logoPaths, size) {
+	images.resolve(ctx, h.detailSvc)
+	for contentID, url := range signListingLogos(ctx, h.detailSvc, logoPaths, art.For(imagesize.SlotLogo)) {
 		if item, ok := byID[contentID]; ok {
 			item.LogoURL = url
 		}
@@ -1023,53 +1081,6 @@ func (h *PersonalDataHandler) seasonEpisodeIDs(ctx context.Context, seasonID str
 	return h.episodeRepo.PartitionIDsBySeason(ctx, seasonID)
 }
 
-// watchedHistoryItemIDBatch bounds each filter read below SQLite's default
-// limit of 32,766 bound variables.
-const watchedHistoryItemIDBatch = 1000
-
-// watchedHistoryItemIDs keeps the IDs the profile has visible history or
-// resume progress for, once each, in input order.
-func watchedHistoryItemIDs(ctx context.Context, store userstore.UserStore, profileID string, ids []string) ([]string, error) {
-	ids = compactHistoryItemIDs(ids)
-	var watched []string
-	for start := 0; start < len(ids); start += watchedHistoryItemIDBatch {
-		batch := ids[start:min(start+watchedHistoryItemIDBatch, len(ids))]
-		groups := make(map[string][]string, len(batch))
-		for _, id := range batch {
-			groups[id] = []string{id}
-		}
-		withHistory, err := store.LatestHistoryIDs(ctx, profileID, groups)
-		if err != nil {
-			return nil, err
-		}
-		withProgress, err := store.ListProgressByMediaItems(ctx, profileID, batch)
-		if err != nil {
-			return nil, err
-		}
-		for _, id := range batch {
-			_, history := withHistory[id]
-			_, progress := withProgress[id]
-			if history || progress {
-				watched = append(watched, id)
-			}
-		}
-	}
-	return watched, nil
-}
-
-func compactHistoryItemIDs(ids []string) []string {
-	seen := make(map[string]struct{}, len(ids))
-	unique := make([]string, 0, len(ids))
-	for _, id := range ids {
-		if _, ok := seen[id]; ok {
-			continue
-		}
-		seen[id] = struct{}{}
-		unique = append(unique, id)
-	}
-	return unique
-}
-
 func (h *PersonalDataHandler) userStoreFor(ctx context.Context, userID int, profileID string) (userstore.UserStore, string, bool) {
 	if h.storeProvider == nil || userID == 0 || profileID == "" {
 		return nil, "", false
@@ -1099,14 +1110,48 @@ func (h *PersonalDataHandler) ensureAccessibleItem(ctx context.Context, itemID s
 	return err
 }
 
-// presignURL resolves an image path to a usable URL, delegating to the
-// DetailService which handles plugin-prefixed paths, HTTP pass-through,
-// and legacy S3 presigning.
-func (h *PersonalDataHandler) presignURL(ctx context.Context, path string, variant string) string {
-	if h.detailSvc != nil {
-		return h.detailSvc.PresignURL(ctx, path, variant)
+// listCardImages collects a listing's card image fields for batch resolution.
+type listCardImages struct {
+	pending []listCardImage
+}
+
+type listCardImage struct {
+	dst        *string
+	path, hint string
+}
+
+// add queues path to fill *dst, resolved at hint. Empty paths and the "-"
+// placeholder leave *dst empty.
+func (l *listCardImages) add(dst *string, path, hint string) {
+	if path == "" || path == "-" {
+		return
+	}
+	l.pending = append(l.pending, listCardImage{dst: dst, path: path, hint: hint})
+}
+
+// resolve fills every queued field, one batch per hint.
+func (l *listCardImages) resolve(ctx context.Context, svc *catalog.DetailService) {
+	if svc == nil || len(l.pending) == 0 {
+		return
+	}
+	byHint := make(map[string][]string)
+	type pathAtHint struct{ path, hint string }
+	seen := make(map[pathAtHint]struct{}, len(l.pending))
+	for _, image := range l.pending {
+		key := pathAtHint{path: image.path, hint: image.hint}
+		if _, ok := seen[key]; ok {
+			continue
+		}
+		seen[key] = struct{}{}
+		byHint[image.hint] = append(byHint[image.hint], image.path)
+	}
+	resolved := make(map[string]map[string]catalog.ResolvedImageURL, len(byHint))
+	for _, hint := range slices.Sorted(maps.Keys(byHint)) {
+		resolved[hint] = svc.PresignURLsWithExpiry(ctx, byHint[hint], hint)
+	}
+	for _, image := range l.pending {
+		*image.dst = resolved[image.hint][image.path].URL
 	}
-	return ""
 }
 
 // parsePagination extracts limit and offset from query parameters with defaults.
diff --git a/internal/api/handlers/favorites_dispatch_test.go b/internal/api/handlers/favorites_dispatch_test.go
new file mode 100644
index 0000000000..1d0cd1b670
--- /dev/null
+++ b/internal/api/handlers/favorites_dispatch_test.go
@@ -0,0 +1,89 @@
+package handlers
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/cache"
+	evt "github.com/prairie-server/prairie-server/internal/events"
+	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/watchsync"
+)
+
+// recordingListDispatcher records each list event and whether the context it
+// arrived on was already canceled.
+type recordingListDispatcher struct {
+	events   []watchsync.LocalListEvent
+	canceled int
+}
+
+func (d *recordingListDispatcher) HandleLocalListEvent(ctx context.Context, event watchsync.LocalListEvent) error {
+	d.events = append(d.events, event)
+	if ctx.Err() != nil {
+		d.canceled++
+	}
+	return nil
+}
+
+// A favorites or watchlist write that changes no row answers 204 and
+// notifies nobody, so a client may retry it: the provider list event, the
+// recommendation refresh, and the user-state event fire once, for the call
+// that changed membership. Each write here runs on a request the client has
+// already abandoned; the change it committed is still announced on a live
+// context, since its retry would announce nothing.
+func TestPersonalListWritesNotifyOnlyWhenMembershipChanges(t *testing.T) {
+	cases := []struct {
+		name   string
+		method string
+		path   string
+		seed   func(h *PersonalDataHandler, w http.ResponseWriter, r *http.Request)
+		write  func(h *PersonalDataHandler, w http.ResponseWriter, r *http.Request)
+	}{
+		{"add favorite", http.MethodPut, "/favorites/movie-1", nil, (*PersonalDataHandler).HandleAddFavorite},
+		{"remove favorite", http.MethodDelete, "/favorites/movie-1", (*PersonalDataHandler).HandleAddFavorite, (*PersonalDataHandler).HandleRemoveFavorite},
+		{"add to watchlist", http.MethodPut, "/watchlist/movie-1", nil, (*PersonalDataHandler).HandleAddToWatchlist},
+		{"remove from watchlist", http.MethodDelete, "/watchlist/movie-1", (*PersonalDataHandler).HandleAddToWatchlist, (*PersonalDataHandler).HandleRemoveFromWatchlist},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			handler := NewPersonalDataHandler(testUserStoreProvider{store: newProfileTestStore(t)}, &fakeHistoryItemRepo{
+				items: map[string]*models.MediaItem{"movie-1": {ContentID: "movie-1", Type: "movie", Title: "Fight Club"}},
+			})
+			call := func(fn func(h *PersonalDataHandler, w http.ResponseWriter, r *http.Request)) {
+				t.Helper()
+				req := withChiParam(newAuthorizedProfileRequestWithRole(tc.method, tc.path, "", "user", "profile-1"), "item_id", "movie-1")
+				gone, cancel := context.WithCancel(req.Context())
+				cancel()
+				rr := httptest.NewRecorder()
+				fn(handler, rr, req.WithContext(gone))
+				if rr.Code != http.StatusNoContent {
+					t.Fatalf("status = %d, want 204: %s", rr.Code, rr.Body.String())
+				}
+			}
+			if tc.seed != nil {
+				call(tc.seed)
+			}
+
+			dispatcher := &recordingListDispatcher{}
+			notifier := &countingSignalsNotifier{}
+			handler.SetLocalListEventDispatcher(dispatcher)
+			handler.SetSignalsChangedNotifier(notifier)
+			handler.EventsHub = evt.NewHub("test", &cache.NoopEventBus{})
+			events, unsubscribe := handler.EventsHub.Subscribe()
+			defer unsubscribe()
+
+			call(tc.write)
+			call(tc.write)
+
+			if len(dispatcher.events) != 1 || notifier.calls != 1 || len(events) != 1 {
+				t.Fatalf("two identical writes: %d list events, %d signal notices, %d user-state events; want 1 each",
+					len(dispatcher.events), notifier.calls, len(events))
+			}
+			if dispatcher.canceled != 0 {
+				t.Fatal("the list event arrived on the abandoned request's canceled context")
+			}
+		})
+	}
+}
diff --git a/internal/api/handlers/favorites_history_remove_test.go b/internal/api/handlers/favorites_history_remove_test.go
index 88b36bf6f9..5e71ab5a9e 100644
--- a/internal/api/handlers/favorites_history_remove_test.go
+++ b/internal/api/handlers/favorites_history_remove_test.go
@@ -6,7 +6,6 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"os"
-	"slices"
 	"testing"
 	"time"
 
@@ -48,6 +47,14 @@ func (r *fakeHistoryItemRepo) EnsureAccessible(_ context.Context, contentID stri
 	return nil
 }
 
+func (r *fakeHistoryItemRepo) EnsureAccessibleIDs(ctx context.Context, ids []string, filter catalog.AccessFilter) (map[string]bool, error) {
+	out := make(map[string]bool, len(ids))
+	for _, id := range ids {
+		out[id] = r.EnsureAccessible(ctx, id, filter) == nil
+	}
+	return out, nil
+}
+
 func TestHandleRemoveHistoryAcceptsEbookTargets(t *testing.T) {
 	ctx := context.Background()
 	store := newProfileTestStore(t)
@@ -226,63 +233,3 @@ func TestRemoveHistoryHidesEpisodesWithoutLibraryFilePostgres(t *testing.T) {
 		t.Fatalf("removal hid the unwatched file-less episode; want it left out")
 	}
 }
-
-// batchRecordingStore answers the two reads watchedHistoryItemIDs makes and
-// records each batch size.
-type batchRecordingStore struct {
-	userstore.UserStore
-	history, progress map[string]bool
-	batches           []int
-}
-
-func (s *batchRecordingStore) LatestHistoryIDs(_ context.Context, _ string, groups map[string][]string) (map[string]string, error) {
-	s.batches = append(s.batches, len(groups))
-	result := map[string]string{}
-	for id := range groups {
-		if s.history[id] {
-			result[id] = "history-" + id
-		}
-	}
-	return result, nil
-}
-
-func (s *batchRecordingStore) ListProgressByMediaItems(_ context.Context, _ string, ids []string) (map[string]userstore.WatchProgress, error) {
-	s.batches = append(s.batches, len(ids))
-	result := map[string]userstore.WatchProgress{}
-	for _, id := range ids {
-		if s.progress[id] {
-			result[id] = userstore.WatchProgress{MediaItemID: id}
-		}
-	}
-	return result, nil
-}
-
-func TestWatchedHistoryItemIDsBatchesAndDeduplicates(t *testing.T) {
-	ids := make([]string, 0, 2600)
-	for i := range 2500 {
-		ids = append(ids, fmt.Sprintf("ep-%d", i))
-	}
-	ids = append(ids, ids[:100]...) // overlapping targets repeat candidates
-	store := &batchRecordingStore{
-		history:  map[string]bool{"ep-5": true},
-		progress: map[string]bool{"ep-2400": true},
-	}
-
-	watched, err := watchedHistoryItemIDs(context.Background(), store, "profile-1", ids)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if want := []string{"ep-5", "ep-2400"}; !slices.Equal(watched, want) {
-		t.Fatalf("watched = %v, want %v", watched, want)
-	}
-	total := 0
-	for _, n := range store.batches {
-		if n > watchedHistoryItemIDBatch {
-			t.Fatalf("batch of %d IDs, want at most %d", n, watchedHistoryItemIDBatch)
-		}
-		total += n
-	}
-	if total != 2*2500 {
-		t.Fatalf("read %d IDs across both reads, want each of the 2500 unique IDs once per read", total)
-	}
-}
diff --git a/internal/api/handlers/favorites_image_size_test.go b/internal/api/handlers/favorites_image_size_test.go
index 531ebacb9e..2aacec2787 100644
--- a/internal/api/handlers/favorites_image_size_test.go
+++ b/internal/api/handlers/favorites_image_size_test.go
@@ -63,7 +63,7 @@ func listFavoritesURLs(t *testing.T, handler *PersonalDataHandler, query string)
 
 func seedFavorite(t *testing.T, store userstore.UserStore) {
 	t.Helper()
-	if err := store.AddFavorite(context.Background(), "profile-1", "movie-1"); err != nil {
+	if _, err := store.AddFavorite(context.Background(), "profile-1", "movie-1"); err != nil {
 		t.Fatalf("AddFavorite: %v", err)
 	}
 }
@@ -83,6 +83,10 @@ func TestPersonalListsUnsetImageSizeUnchanged(t *testing.T) {
 	if !strings.Contains(item.BackdropURL, ":card:") || !strings.Contains(item.BackdropURL, "/backdrop/w300.") {
 		t.Errorf("backdrop URL = %q, want the card w300 backdrop", item.BackdropURL)
 	}
+	// Card images resolve in batches, not one lookup each.
+	if !strings.HasPrefix(item.PosterURL, "batch:") || !strings.HasPrefix(item.BackdropURL, "batch:") {
+		t.Errorf("poster %q, backdrop %q: want both resolved in a batch", item.PosterURL, item.BackdropURL)
+	}
 }
 
 // An explicit size applies to every image in the response, collapsing the
@@ -96,7 +100,7 @@ func TestPersonalListsHonorImageSize(t *testing.T) {
 	}{
 		{"small", ":card:", "/poster/w200.", "/backdrop/w300."},
 		{"medium", ":featured:", "/poster/w500.", "/backdrop/w1920."},
-		{"large", ":large:", "/poster/w500.", "/backdrop/w1920."},
+		{"large", ":large:", "/poster/w500.", "/backdrop/w2560."},
 		{"original", ":original:", "/poster/original.", "/backdrop/original."},
 	}
 
diff --git a/internal/api/handlers/home_missing_collection_test.go b/internal/api/handlers/home_missing_collection_test.go
index 525e911b5d..d4238a37c6 100644
--- a/internal/api/handlers/home_missing_collection_test.go
+++ b/internal/api/handlers/home_missing_collection_test.go
@@ -5,6 +5,7 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
+	"net/http"
 	"strconv"
 	"sync"
 	"testing"
@@ -187,7 +188,15 @@ func TestSectionRowOfDeletedCollectionLogsAtDebugDB(t *testing.T) {
 			} else {
 				row, err = h.HomeSectionItems(viewerContext(tc.profile), tc.id, viewer)
 			}
-			assertEmpty(t, row, err, tc.id)
+			if tc.wantError {
+				// The single-section service, which v2 calls, answers a
+				// real failure with an error; v1 keeps an empty row.
+				if apiErr, ok := errors.AsType[*APIError](err); !ok || apiErr.Status != http.StatusInternalServerError {
+					t.Fatalf("%s: err = %v, want a 500", tc.id, err)
+				}
+			} else {
+				assertEmpty(t, row, err, tc.id)
+			}
 			errs := logs.take(slog.LevelError)
 			if tc.wantError && (len(errs) != 1 || errs[0] != "fetching section items") {
 				t.Fatalf("ERROR records = %q, want one fetching section items record", errs)
diff --git a/internal/api/handlers/home_views_service.go b/internal/api/handlers/home_views_service.go
index 09499accad..e78e10df3e 100644
--- a/internal/api/handlers/home_views_service.go
+++ b/internal/api/handlers/home_views_service.go
@@ -47,7 +47,7 @@ func (h *SectionHandler) HomeSections(ctx context.Context, viewer SectionViewer)
 	}
 	withItems = applyDiversityFilter(withItems)
 	withItems = dropEmptySeasonalSections(withItems)
-	response := h.buildSectionsWithUserStates(ctx, withItems, nil, viewer.Access, viewer.ImageSize, userStates)
+	response := h.buildSectionsWithUserStates(ctx, withItems, nil, viewer.Access, viewer.Artwork(), userStates)
 	itemCount := 0
 	for _, section := range withItems {
 		itemCount += len(section.Items)
@@ -68,8 +68,16 @@ func (h *SectionHandler) HomeSections(ctx context.Context, viewer SectionViewer)
 	return response, nil
 }
 
-// HomeSectionItems answers one section of the home page with its items.
+// HomeSectionItems answers one section of the home page with its items, or an
+// error when its items cannot be fetched.
 func (h *SectionHandler) HomeSectionItems(ctx context.Context, sectionID string, viewer SectionViewer) (SectionView, error) {
+	return h.homeSectionItems(ctx, sectionID, viewer, false)
+}
+
+// homeSectionItems is HomeSectionItems. With emptyOnFetchError, a section
+// whose items cannot be fetched answers with no items, as the frozen v1
+// endpoint always has.
+func (h *SectionHandler) homeSectionItems(ctx context.Context, sectionID string, viewer SectionViewer, emptyOnFetchError bool) (SectionView, error) {
 	resolved, libraryIDs, accessFilter, profileID, err := h.loadResolvedHomeSections(ctx)
 	if err != nil {
 		return SectionView{}, apiError(http.StatusInternalServerError, "internal_error", "Failed to load sections")
@@ -84,10 +92,14 @@ func (h *SectionHandler) HomeSectionItems(ctx context.Context, sectionID string,
 		withItems, fetchErr := h.fetcher.FetchOne(ctx, homeSectionsForFetch([]sections.ResolvedSection{s}, hideWatched)[0], nil, libraryIDs, userID, profileID, accessFilter)
 		if fetchErr != nil {
 			sections.LogFetchError(ctx, "api", s, fetchErr)
-			withItems = sections.SectionWithItems{
-				ResolvedSection: s,
-				Items:           []*models.MediaItem{},
+			// Unlike the aggregate read, which keeps the page up with an
+			// empty row, a failed single section answers an error, so a
+			// client can tell it from a section with nothing to show. A
+			// deleted collection is not a failure and keeps its empty row.
+			if !emptyOnFetchError && !sections.IsMissingCollection(fetchErr) {
+				return SectionView{}, apiError(http.StatusInternalServerError, "internal_error", "Failed to load section")
 			}
+			withItems = sections.SectionWithItems{ResolvedSection: s, Items: []*models.MediaItem{}}
 		}
 		return h.homeSectionRow(ctx, s, withItems, hideWatched, viewer), nil
 	}
@@ -108,7 +120,7 @@ func (h *SectionHandler) homeSectionRow(ctx context.Context, s sections.Resolved
 		// filter empties it; only aggregate Home drops such sections.
 		rows, userStates = h.filterWatchedHomeSections(ctx, rows, []sections.ResolvedSection{s})
 	}
-	built := h.buildSectionsWithUserStates(ctx, rows, nil, viewer.Access, viewer.ImageSize, userStates).Sections
+	built := h.buildSectionsWithUserStates(ctx, rows, nil, viewer.Access, viewer.Artwork(), userStates).Sections
 	if len(built) == 0 {
 		return resolvedSectionResponse{
 			ID:          withItems.ID,
diff --git a/internal/api/handlers/household_acting_admin_test.go b/internal/api/handlers/household_acting_admin_test.go
index ed0d62874d..0bf8038a6e 100644
--- a/internal/api/handlers/household_acting_admin_test.go
+++ b/internal/api/handlers/household_acting_admin_test.go
@@ -49,7 +49,7 @@ func actingAdminHousehold(t *testing.T, primaryPIN string) userstore.UserStore {
 
 func actingAdminProfileHandler(store userstore.UserStore) *ProfileHandler {
 	handler := NewProfileHandler(testUserStoreProvider{store: store})
-	handler.UserRepo = testProfileUserRepo{user: &models.User{ID: 1, Role: models.RoleAdmin, MaxProfiles: 10}}
+	handler.UserRepo = testProfileUserRepo{user: &models.User{ID: 1, Role: models.RoleAdmin, MaxProfiles: new(10)}}
 	handler.ProfileTokens = access.NewProfileTokenService("test-secret-value-at-least-32-chars", time.Minute)
 	return handler
 }
diff --git a/internal/api/handlers/image_size.go b/internal/api/handlers/image_size.go
index d13cc0ec1c..b19ec42230 100644
--- a/internal/api/handlers/image_size.go
+++ b/internal/api/handlers/image_size.go
@@ -5,7 +5,6 @@ import (
 	"strings"
 
 	"github.com/prairie-server/prairie-server/internal/artworkkey"
-	"github.com/prairie-server/prairie-server/internal/catalog"
 	"github.com/prairie-server/prairie-server/internal/imagesize"
 )
 
@@ -45,6 +44,13 @@ func requestImageSize(r *http.Request) imagesize.Size {
 	return size
 }
 
+// requestArtwork is the artwork preference of a /api/v1 request: its
+// image_size alone. Per-slot widths are a native v2 parameter; the frozen v1
+// surface never carries them.
+func requestArtwork(r *http.Request) imagesize.Request {
+	return imagesize.Request{Size: requestImageSize(r)}
+}
+
 // requestVariantHint returns the semantic variant hint to send to a plugin
 // resolver alongside a path resolved at the request's size. Without an explicit
 // size the caller's per-context hint stands.
@@ -56,8 +62,10 @@ func requestVariantHint(defaultHint string, size imagesize.Size) string {
 }
 
 // sizedImagePath rewrites a cached image path to the variant the client asked
-// for. Without an explicit size it returns fallback — the per-context default
-// the server has always used, which differs between card and hero surfaces.
+// for, on the ladder of the image type the key was cached under (imageType
+// only when the key names none). Without an explicit size it returns fallback —
+// the per-context default the server has always used, which differs between
+// card and hero surfaces.
 // An explicit size wins uniformly instead, so every image in one response is
 // the same size. Full URLs and plugin-prefixed paths pass through: their
 // variant is chosen at resolution time.
@@ -68,7 +76,7 @@ func sizedImagePath(path, imageType string, size imagesize.Size, fallback string
 	if strings.Contains(path, "://") {
 		return path
 	}
-	return strings.Replace(path, "/original.", "/"+imagesize.Variant(imageType, size)+".", 1)
+	return strings.Replace(path, "/original.", "/"+imagesize.Variant(artworkkey.ImageTypeOf(path, imageType), size)+".", 1)
 }
 
 // sizedCardPath is cardThumbnailPath with the request's size applied.
@@ -79,11 +87,11 @@ func sizedCardPath(path, imageType string, size imagesize.Size) string {
 // sizedCardBackdropPath resolves an image sitting in a card's backdrop slot.
 //
 // That slot does not always hold a real backdrop: an episode row puts its still
-// there, and a still rides the still ladder, which has no w1920. Asking for the
-// backdrop ladder would name a key that was never generated, so the type is read
-// back off the key instead of assumed.
+// there, and a still rides the still ladder, which has no backdrop widths.
+// sizedImagePath reads the type back off the key, so backdrop is only the
+// fallback for keys that carry none.
 func sizedCardBackdropPath(path string, size imagesize.Size) string {
-	return sizedCardPath(path, imageTypeForBackdropPath(path), size)
+	return sizedCardPath(path, artworkkey.ImageBackdrop, size)
 }
 
 // sizedLogoPath is a listing card's wordmark at the request's size. Unsized it
@@ -97,7 +105,9 @@ func sizedLogoPath(path string, size imagesize.Size) string {
 }
 
 // sizedFeaturedLogoPath is a section card's wordmark at the request's size.
-// Unsized it stays the stored original, which sections have always served.
+// Unsized it stays the stored original, which sections have always served:
+// artwork cached before revision manifests has no wider rung to ask for, so a
+// rung would clamp to the 500px card logo.
 func sizedFeaturedLogoPath(path string, size imagesize.Size) string {
 	return sizedImagePath(path, artworkkey.ImageLogo, size, path)
 }
@@ -109,16 +119,5 @@ func sizedPosterPath(path string, size imagesize.Size) string {
 
 // sizedBackdropPath is featuredBackdropPath with the request's size applied.
 func sizedBackdropPath(path string, size imagesize.Size) string {
-	return sizedImagePath(path, imageTypeForBackdropPath(path), size, featuredBackdropPath(path))
-}
-
-// imageTypeForBackdropPath reports which ladder governs a path used in a
-// backdrop slot. Episode "backdrops" are frequently the episode still, which
-// rides the still ladder — asking for a backdrop width there would build a key
-// that was never generated.
-func imageTypeForBackdropPath(path string) string {
-	if imageType := catalog.ImageTypeFromCachedPath(path); imageType != "" {
-		return imageType
-	}
-	return artworkkey.ImageBackdrop
+	return sizedImagePath(path, artworkkey.ImageBackdrop, size, featuredBackdropPath(path))
 }
diff --git a/internal/api/handlers/image_size_test.go b/internal/api/handlers/image_size_test.go
index 1bef68d0a8..c14ea66eb9 100644
--- a/internal/api/handlers/image_size_test.go
+++ b/internal/api/handlers/image_size_test.go
@@ -12,7 +12,7 @@ import (
 
 // An explicit size overrides every per-context default uniformly, including the
 // Continue Watching w1280 backdrop. Widths follow Prairie's TV-tuned ladder
-// (posters w500/w300/w200, stills w500/w300; no w780 rung).
+// (posters w500/w300/w200, stills w1280/w500/w300; no w780 rung).
 func TestExplicitImageSizeOverridesContextDefaults(t *testing.T) {
 	const poster = "tmdb/movies/550/poster/original.abc123.webp"
 	const backdrop = "tmdb/movies/550/backdrop/original.abc123.webp"
@@ -59,7 +59,7 @@ func TestExplicitImageSizeLeavesNonCachedPathsAlone(t *testing.T) {
 }
 
 // An episode row puts its still in the card's backdrop slot. The still ladder
-// has no w1920, so resolving that slot against the backdrop ladder would name a
+// has no w2560, so resolving that slot against the backdrop ladder would name a
 // key the cache never generated — the URL would 404 rather than look wrong.
 func TestSizedCardBackdropPathFollowsTheStillLadder(t *testing.T) {
 	const still = "tvdb/series/73141/seasons/22/episodes/9/still/original.webp"
@@ -72,7 +72,7 @@ func TestSizedCardBackdropPathFollowsTheStillLadder(t *testing.T) {
 	}{
 		{imagesize.Small, "still/w300.webp", "backdrop/w300.abc123.webp"},
 		{imagesize.Medium, "still/w500.webp", "backdrop/w1920.abc123.webp"},
-		{imagesize.Large, "still/w500.webp", "backdrop/w1920.abc123.webp"},
+		{imagesize.Large, "still/w500.webp", "backdrop/w2560.abc123.webp"},
 		{imagesize.Original, "still/original.webp", "backdrop/original.abc123.webp"},
 	}
 	for _, tt := range tests {
diff --git a/internal/api/handlers/images_capability_test.go b/internal/api/handlers/images_capability_test.go
index fc244b861e..54323b9cd0 100644
--- a/internal/api/handlers/images_capability_test.go
+++ b/internal/api/handlers/images_capability_test.go
@@ -67,10 +67,16 @@ func TestHandleImagesCapability(t *testing.T) {
 		}
 	}
 
-	// Prairie's TV-tuned ladder: posters w500/w300/w200, a single w500 logo.
+	// Prairie's TV-tuned ladder: posters w500/w300/w200, stills w500/w300, a single w500 logo.
 	if w := got.Widths["poster"]; w.Large != 500 || w.Small != 200 {
 		t.Errorf("poster widths = %+v, want large 500 / small 200", w)
 	}
+	if got.Widths["still"].Large != 500 {
+		t.Errorf("still large width = %d, want 500", got.Widths["still"].Large)
+	}
+	if got.Widths["backdrop"].Large != 2560 {
+		t.Errorf("backdrop large width = %d, want 2560", got.Widths["backdrop"].Large)
+	}
 	if got.Widths["logo"].Large != 500 {
 		t.Errorf("logo large width = %d, want 500", got.Widths["logo"].Large)
 	}
diff --git a/internal/api/handlers/items.go b/internal/api/handlers/items.go
index f072ccde1d..6a3c8b435e 100644
--- a/internal/api/handlers/items.go
+++ b/internal/api/handlers/items.go
@@ -20,6 +20,7 @@ import (
 	"github.com/prairie-server/prairie-server/internal/artworkkey"
 	"github.com/prairie-server/prairie-server/internal/auth"
 	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/ctxerr"
 	evt "github.com/prairie-server/prairie-server/internal/events"
 	"github.com/prairie-server/prairie-server/internal/imagesize"
 	"github.com/prairie-server/prairie-server/internal/metadata"
@@ -100,8 +101,7 @@ type ItemsHandler struct {
 	detailSvc                *catalog.DetailService
 	storeProvider            userstore.UserStoreProvider
 	watchState               *watchstate.Service
-	profileStaler            ProfileStaler
-	profileRefreshRequester  ProfileRefreshRequester
+	signalsNotifier          SignalsChangedNotifier
 	metadataRefreshRequester MetadataRefreshRequester
 	trailerRefreshRequester  TrailerRefreshRequester
 	trailerItemAccess        trailerItemAccess
@@ -161,14 +161,10 @@ func (h *ItemsHandler) SetCompletionObserver(obs watchstate.CompletionObserver)
 	h.watchState.WithCompletionObserver(obs)
 }
 
-// SetProfileStaler configures an optional staleness trigger for taste profiles.
-func (h *ItemsHandler) SetProfileStaler(ps ProfileStaler) {
-	h.profileStaler = ps
-}
-
-// SetProfileRefreshRequester configures an optional background refresh queue for taste profiles.
-func (h *ItemsHandler) SetProfileRefreshRequester(requester ProfileRefreshRequester) {
-	h.profileRefreshRequester = requester
+// SetSignalsChangedNotifier configures where changes to a profile's
+// recommendation signals are reported. Without it they are not reported.
+func (h *ItemsHandler) SetSignalsChangedNotifier(notifier SignalsChangedNotifier) {
+	h.signalsNotifier = notifier
 }
 
 func (h *ItemsHandler) SetMetadataRefreshRequester(requester MetadataRefreshRequester) {
@@ -410,6 +406,8 @@ type seasonResponse struct {
 	PosterURL       string                  `json:"poster_url,omitempty"`
 	PosterThumbhash string                  `json:"poster_thumbhash,omitempty"`
 	UserData        *catalog.SeasonUserData `json:"user_data,omitempty"`
+	// MachineTranslatedFields reaches the v2 season row only; v1 is frozen.
+	MachineTranslatedFields []string `json:"-"`
 }
 
 // seasonsResponse wraps the seasons list for JSON serialization.
@@ -459,6 +457,14 @@ type episodeResponse struct {
 	UserData            *catalog.SeasonUserData `json:"user_data,omitempty"`
 	Files               []episodeFileResponse   `json:"files,omitempty"`
 	OverlaySummary      *models.OverlaySummary  `json:"overlay_summary,omitempty"`
+	// RatingIMDB and RatingTMDB feed the v2 episode's ratings; /api/v1 is
+	// frozen, so they stay off its wire.
+	RatingIMDB *float64 `json:"-"`
+	RatingTMDB *float64 `json:"-"`
+	// MachineTranslatedFields reaches the v2 episode row only; v1 is frozen.
+	MachineTranslatedFields []string `json:"-"`
+	// PendingTranslationLanguage reaches the v2 episode row only; v1 is frozen.
+	PendingTranslationLanguage string `json:"-"`
 }
 
 type episodeImageFallback struct {
@@ -523,6 +529,7 @@ func (h *ItemsHandler) HandleGetWatchDetail(w http.ResponseWriter, r *http.Reque
 	if !ok {
 		return
 	}
+	filter.OmitWatchArtwork = true
 
 	detail, err := h.WatchDetail(r.Context(), apimw.GetUserID(r.Context()), requestProfileID(r), id, filter)
 	if err != nil {
@@ -824,7 +831,7 @@ func (h *ItemsHandler) writeCatalogBrowseResponse(w http.ResponseWriter, r *http
 	episodeMetadata := h.listEpisodeBrowseMetadata(r.Context(), result.Items)
 	items := make([]itemListResponse, 0, len(result.Items))
 	for _, item := range result.Items {
-		resp := h.toItemListResponseWithOverlay(r.Context(), viewer, item, overlaySummaries[item.ContentID], userStates[item.ContentID], filter.ImageSize)
+		resp := h.toItemListResponseWithOverlay(r.Context(), viewer, item, overlaySummaries[item.ContentID], userStates[item.ContentID], filter.Artwork())
 		// The resolver validated the item's own hint against this profile, so
 		// its answer replaces the unvalidated one carried by the item.
 		resp.PlayContentID = playTargets[playableTargetKeyForItem(item)]
@@ -894,7 +901,7 @@ func (h *ItemsHandler) resolvePlayableTargets(ctx context.Context, v ItemViewer,
 		ProgressStore: store,
 	})
 	if err != nil {
-		slog.WarnContext(ctx, "resolving playable poster targets", "component", "api", "error", err)
+		slog.Log(ctx, ctxerr.LogLevel(ctx, err, slog.LevelWarn), "resolving playable poster targets", "component", "api", "error", err)
 		return map[string]catalog.PlayableTarget{}
 	}
 	return targets
@@ -971,20 +978,20 @@ func (h *ItemsHandler) writeCatalogFiltersResponse(w http.ResponseWriter, r *htt
 
 // toItemListResponse converts a MediaItem to an itemListResponse with presigned
 // URLs at the size the caller's request asked for.
-func (h *ItemsHandler) toItemListResponse(ctx context.Context, v ItemViewer, item *models.MediaItem, size imagesize.Size) itemListResponse {
-	return h.toItemListResponseWithOverlay(ctx, v, item, nil, nil, size)
+func (h *ItemsHandler) toItemListResponse(ctx context.Context, v ItemViewer, item *models.MediaItem, art imagesize.Request) itemListResponse {
+	return h.toItemListResponseWithOverlay(ctx, v, item, nil, nil, art)
 }
 
-func (h *ItemsHandler) toItemListResponseWithOverlay(ctx context.Context, v ItemViewer, item *models.MediaItem, overlaySummary *models.OverlaySummary, userState *itemUserStateResponse, size imagesize.Size) itemListResponse {
+func (h *ItemsHandler) toItemListResponseWithOverlay(ctx context.Context, v ItemViewer, item *models.MediaItem, overlaySummary *models.OverlaySummary, userState *itemUserStateResponse, art imagesize.Request) itemListResponse {
 	if h.detailSvc != nil {
 		if localized, err := h.detailSvc.LocalizeItemModel(ctx, item, v.Access); err == nil && localized != nil {
 			item = localized
 		}
 	}
 	resp := itemListResponseShell(item, overlaySummary, userState)
-	hint := requestVariantHint("card", size)
-	resp.PosterURL = h.presignURLCtx(ctx, sizedCardPath(item.PosterPath, artworkkey.ImagePoster, size), hint)
-	resp.BackdropURL = h.presignURLCtx(ctx, sizedCardBackdropPath(item.BackdropPath, size), hint)
+	poster, backdrop := art.For(imagesize.SlotPoster), art.For(imagesize.SlotBackdrop)
+	resp.PosterURL = h.presignURLCtx(ctx, sizedCardPath(item.PosterPath, artworkkey.ImagePoster, poster), requestVariantHint("card", poster))
+	resp.BackdropURL = h.presignURLCtx(ctx, sizedCardBackdropPath(item.BackdropPath, backdrop), requestVariantHint("card", backdrop))
 	return resp
 }
 
@@ -1045,7 +1052,7 @@ func (h *ItemsHandler) localizeItemListModels(ctx context.Context, items []*mode
 	return localized
 }
 
-func (h *ItemsHandler) itemListCardImageURLs(ctx context.Context, items []*models.MediaItem, size imagesize.Size) map[string]itemListImageURLs {
+func (h *ItemsHandler) itemListCardImageURLs(ctx context.Context, items []*models.MediaItem, art imagesize.Request) map[string]itemListImageURLs {
 	urls := make(map[string]itemListImageURLs, len(items))
 	if h == nil || h.detailSvc == nil || len(items) == 0 {
 		return urls
@@ -1058,19 +1065,10 @@ func (h *ItemsHandler) itemListCardImageURLs(ctx context.Context, items []*model
 	}
 
 	pending := make([]pendingImages, 0, len(items))
-	paths := make([]string, 0, len(items)*2)
-	seenPaths := make(map[string]struct{}, len(items)*2)
 	logoPaths := make(map[string]string, len(items))
-	addPath := func(path string) {
-		if path == "" || path == "-" {
-			return
-		}
-		if _, ok := seenPaths[path]; ok {
-			return
-		}
-		seenPaths[path] = struct{}{}
-		paths = append(paths, path)
-	}
+	posterSize, backdropSize := art.For(imagesize.SlotPoster), art.For(imagesize.SlotBackdrop)
+	posterHint, backdropHint := requestVariantHint("card", posterSize), requestVariantHint("card", backdropSize)
+	var batch catalog.ArtworkBatch
 
 	for _, item := range items {
 		if item == nil || item.ContentID == "" {
@@ -1078,21 +1076,21 @@ func (h *ItemsHandler) itemListCardImageURLs(ctx context.Context, items []*model
 		}
 		images := pendingImages{
 			contentID:    item.ContentID,
-			posterPath:   sizedCardPath(item.PosterPath, artworkkey.ImagePoster, size),
-			backdropPath: sizedCardBackdropPath(item.BackdropPath, size),
+			posterPath:   sizedCardPath(item.PosterPath, artworkkey.ImagePoster, posterSize),
+			backdropPath: sizedCardBackdropPath(item.BackdropPath, backdropSize),
 		}
 		pending = append(pending, images)
-		addPath(images.posterPath)
-		addPath(images.backdropPath)
+		batch.Add(images.posterPath, posterHint)
+		batch.Add(images.backdropPath, backdropHint)
 		logoPaths[item.ContentID] = item.LogoPath
 	}
 
-	resolved := h.detailSvc.PresignURLsWithExpiry(ctx, paths, requestVariantHint("card", size))
-	logoURLs := signListingLogos(ctx, h.detailSvc, logoPaths, size)
+	resolved := batch.Resolve(ctx, h.detailSvc, requestVariantHint("card", art.Size))
+	logoURLs := signListingLogos(ctx, h.detailSvc, logoPaths, art.For(imagesize.SlotLogo))
 	for _, images := range pending {
 		urls[images.contentID] = itemListImageURLs{
-			posterURL:   resolved[images.posterPath].URL,
-			backdropURL: resolved[images.backdropPath].URL,
+			posterURL:   resolved.Get(images.posterPath, posterHint).URL,
+			backdropURL: resolved.Get(images.backdropPath, backdropHint).URL,
 			logoURL:     logoURLs[images.contentID],
 		}
 	}
@@ -1259,7 +1257,12 @@ func episodeResponseShell(ep *models.Episode, fallback episodeImageFallback, siz
 		ImdbID:              ep.ImdbID,
 		TmdbID:              ep.TmdbID,
 		TvdbID:              ep.TvdbID,
+		RatingIMDB:          ep.RatingIMDB,
+		RatingTMDB:          ep.RatingTMDB,
 		StillThumbhash:      stillThumbhash,
+
+		MachineTranslatedFields:    ep.MachineTranslatedFields,
+		PendingTranslationLanguage: ep.PendingTranslationLanguage,
 	}
 
 	if ep.AirDate != nil {
@@ -1274,7 +1277,7 @@ func episodeResponseShell(ep *models.Episode, fallback episodeImageFallback, siz
 // each resolve in one round-trip for the whole list instead of per episode.
 func (h *ItemsHandler) buildEpisodeResponses(ctx context.Context, v ItemViewer, episodes []*models.Episode) []episodeResponse {
 	filter := v.Access
-	size := filter.ImageSize
+	size := filter.ImageSizeFor(imagesize.SlotStill)
 
 	if h.detailSvc != nil {
 		if localized, err := h.detailSvc.LocalizeEpisodeModels(ctx, episodes, filter); err == nil && len(localized) == len(episodes) {
@@ -1545,6 +1548,9 @@ func (h *ItemsHandler) listAudiobookSortMetrics(
 			resp.SeriesName = value
 		}
 	}
+	if err := rows.Err(); err != nil {
+		slog.Log(ctx, ctxerr.LogLevel(ctx, err, slog.LevelWarn), "listing audiobook sort metrics", "component", "api", "sort", sortField, "error", err)
+	}
 }
 
 func audiobookPersonSortMetricQuery(kind int) string {
@@ -1858,6 +1864,8 @@ func (h *ItemsHandler) localizedSeasonResponse(
 		Overview:        s.Overview,
 		EpisodeCount:    episodeCount,
 		PosterThumbhash: s.PosterThumbhash,
+
+		MachineTranslatedFields: s.MachineTranslatedFields,
 	}
 	if s.AirDate != nil {
 		resp.AirDate = s.AirDate.Format("2006-01-02")
@@ -2293,6 +2301,8 @@ type AccessFilterOptions struct {
 	ScopeFilesToLibrary bool
 	// ImageSize is the artwork variant to presign; Unset picks defaults.
 	ImageSize imagesize.Size
+	// ImageWidths are per-slot target widths overriding ImageSize.
+	ImageWidths imagesize.Widths
 }
 
 // ContextAccessFilter is the viewer's access filter from the identity on the
@@ -2314,6 +2324,7 @@ func (h *ItemsHandler) ContextAccessFilter(ctx context.Context, opts AccessFilte
 			MetadataLanguageOverrides: scope.MetadataLanguageOverrides,
 			SelectedFileID:            opts.SelectedFileID,
 			ImageSize:                 opts.ImageSize,
+			ImageWidths:               opts.ImageWidths,
 			UserID:                    apimw.GetUserID(ctx),
 			ProfileID:                 apimw.GetProfileID(ctx),
 			DeviceID:                  opts.DeviceID,
@@ -2349,6 +2360,7 @@ func (h *ItemsHandler) ContextAccessFilter(ctx context.Context, opts AccessFilte
 		ScopeFilesToLibrary:   opts.ScopeFilesToLibrary,
 		SelectedFileID:        opts.SelectedFileID,
 		ImageSize:             opts.ImageSize,
+		ImageWidths:           opts.ImageWidths,
 		UserID:                apimw.GetUserID(ctx),
 		ProfileID:             apimw.GetProfileID(ctx),
 		DeviceID:              opts.DeviceID,
@@ -2435,37 +2447,33 @@ type watchedLeafTarget struct {
 	DurationSeconds float64
 }
 
-func (h *ItemsHandler) resolveWatchedTargets(ctx context.Context, contentID string, filter catalog.AccessFilter) (string, []watchedLeafTarget, error) {
+// watchedTarget is a watched-state target that exists and that the viewer
+// may see, before a season or series is expanded into its episodes.
+type watchedTarget struct {
+	Type    string
+	Item    *models.MediaItem
+	Season  *models.Season
+	Episode *models.Episode
+}
+
+// lookupWatchedTarget finds a movie, ebook, series, season or episode and
+// checks the viewer's access without loading a season's or series' episodes.
+// Any other item type is not found.
+func (h *ItemsHandler) lookupWatchedTarget(ctx context.Context, contentID string, filter catalog.AccessFilter) (watchedTarget, error) {
 	item, err := h.itemRepo.GetByID(ctx, contentID)
 	switch {
 	case err == nil:
 		if err := h.itemRepo.EnsureAccessible(ctx, contentID, filter); err != nil {
-			return "", nil, err
+			return watchedTarget{}, err
 		}
 		switch item.Type {
-		case "movie":
-			return "movie", []watchedLeafTarget{{
-				ContentID:       item.ContentID,
-				DurationSeconds: h.contentDurationSeconds(ctx, item.ContentID, "", item.Runtime),
-			}}, nil
-		case "ebook":
-			// Ebooks have no playback duration; read state is keyed off
-			// ebook_reader_progress, so the leaf target only carries the ID.
-			return "ebook", []watchedLeafTarget{{ContentID: item.ContentID}}, nil
-		case "series":
-			if h.episodeRepo == nil {
-				return "", nil, catalog.ErrItemNotFound
-			}
-			episodes, err := h.episodeRepo.ListBySeries(ctx, item.ContentID)
-			if err != nil {
-				return "", nil, err
-			}
-			return "series", h.episodeTargets(ctx, episodes), nil
+		case itemTypeMovie, itemTypeEbook, "series":
+			return watchedTarget{Type: item.Type, Item: item}, nil
 		default:
-			return "", nil, catalog.ErrItemNotFound
+			return watchedTarget{}, catalog.ErrItemNotFound
 		}
 	case !errors.Is(err, catalog.ErrItemNotFound):
-		return "", nil, err
+		return watchedTarget{}, err
 	}
 
 	if h.seasonRepo != nil {
@@ -2473,37 +2481,77 @@ func (h *ItemsHandler) resolveWatchedTargets(ctx context.Context, contentID stri
 		switch {
 		case err == nil:
 			if err := h.itemRepo.EnsureAccessible(ctx, season.SeriesID, filter); err != nil {
-				return "", nil, err
-			}
-			if h.episodeRepo == nil {
-				return "", nil, catalog.ErrItemNotFound
-			}
-			episodes, err := h.episodeRepo.ListBySeasonID(ctx, season.ContentID)
-			if err != nil {
-				return "", nil, err
+				return watchedTarget{}, err
 			}
-			return "season", h.episodeTargets(ctx, episodes), nil
+			return watchedTarget{Type: "season", Season: season}, nil
 		case !errors.Is(err, catalog.ErrSeasonNotFound):
-			return "", nil, err
+			return watchedTarget{}, err
 		}
 	}
 
 	if h.episodeRepo == nil {
-		return "", nil, catalog.ErrItemNotFound
+		return watchedTarget{}, catalog.ErrItemNotFound
 	}
 
 	episode, err := h.episodeRepo.GetByID(ctx, contentID)
 	if err != nil {
-		return "", nil, err
+		return watchedTarget{}, err
 	}
 	if err := h.itemRepo.EnsureAccessible(ctx, episode.SeriesID, filter); err != nil {
-		return "", nil, err
+		return watchedTarget{}, err
 	}
+	return watchedTarget{Type: itemTypeEpisode, Episode: episode}, nil
+}
 
-	return "episode", []watchedLeafTarget{{
-		ContentID:       episode.ContentID,
-		DurationSeconds: h.contentDurationSeconds(ctx, "", episode.ContentID, episode.Runtime),
-	}}, nil
+// resolveWatchedTargets checks access to contentID and resolves the leaf
+// targets a watched mark writes. Unwatching a series or season returns no
+// targets: the caller expands it with watchstate.ParentUnwatchTargets, which
+// also reaches watched episodes that no longer have a file.
+func (h *ItemsHandler) resolveWatchedTargets(ctx context.Context, contentID string, played bool, filter catalog.AccessFilter) (string, []watchedLeafTarget, error) {
+	target, err := h.lookupWatchedTarget(ctx, contentID, filter)
+	if err != nil {
+		return "", nil, err
+	}
+	switch target.Type {
+	case itemTypeMovie:
+		return itemTypeMovie, []watchedLeafTarget{{
+			ContentID:       target.Item.ContentID,
+			DurationSeconds: h.contentDurationSeconds(ctx, target.Item.ContentID, "", target.Item.Runtime),
+		}}, nil
+	case itemTypeEbook:
+		// Ebooks have no playback duration; read state is keyed off
+		// ebook_reader_progress, so the leaf target only carries the ID.
+		return itemTypeEbook, []watchedLeafTarget{{ContentID: target.Item.ContentID}}, nil
+	case "series":
+		if h.episodeRepo == nil {
+			return "", nil, catalog.ErrItemNotFound
+		}
+		if !played {
+			return "series", nil, nil
+		}
+		episodes, err := h.episodeRepo.ListBySeries(ctx, target.Item.ContentID)
+		if err != nil {
+			return "", nil, err
+		}
+		return "series", h.episodeTargets(ctx, episodes), nil
+	case "season":
+		if h.episodeRepo == nil {
+			return "", nil, catalog.ErrItemNotFound
+		}
+		if !played {
+			return "season", nil, nil
+		}
+		episodes, err := h.episodeRepo.ListBySeasonID(ctx, target.Season.ContentID)
+		if err != nil {
+			return "", nil, err
+		}
+		return "season", h.episodeTargets(ctx, episodes), nil
+	default:
+		return itemTypeEpisode, []watchedLeafTarget{{
+			ContentID:       target.Episode.ContentID,
+			DurationSeconds: h.contentDurationSeconds(ctx, "", target.Episode.ContentID, target.Episode.Runtime),
+		}}, nil
+	}
 }
 
 // episodeTargets resolves the watched leaf targets for a season or series.
@@ -2604,7 +2652,7 @@ func (h *ItemsHandler) canViewFilePaths(ctx context.Context) bool {
 	}
 	user, err := h.UserRepo.GetByID(ctx, claims.UserID)
 	if err != nil {
-		slog.WarnContext(ctx, "checking file path visibility permissions", "component", "api", "user_id", claims.UserID, "error", err)
+		slog.Log(ctx, ctxerr.LogLevel(ctx, err, slog.LevelWarn), "checking file path visibility permissions", "component", "api", "user_id", claims.UserID, "error", err)
 		return false
 	}
 	return auth.HasEffectivePermission(user, auth.PermissionMetadataCuration)
diff --git a/internal/api/handlers/items_catalog_response_test.go b/internal/api/handlers/items_catalog_response_test.go
index f4027ce81e..e03f892075 100644
--- a/internal/api/handlers/items_catalog_response_test.go
+++ b/internal/api/handlers/items_catalog_response_test.go
@@ -81,7 +81,7 @@ func TestItemListCardImageURLsUsesBatchResolver(t *testing.T) {
 		},
 	}
 
-	urls := handler.itemListCardImageURLs(context.Background(), items, imagesize.Unset)
+	urls := handler.itemListCardImageURLs(context.Background(), items, imagesize.Request{})
 
 	if resolver.singleCalls != 0 {
 		t.Fatalf("single resolver calls = %d, want 0", resolver.singleCalls)
diff --git a/internal/api/handlers/jellyfin_compat_test.go b/internal/api/handlers/jellyfin_compat_test.go
index 4625e02519..d60af9284a 100644
--- a/internal/api/handlers/jellyfin_compat_test.go
+++ b/internal/api/handlers/jellyfin_compat_test.go
@@ -5,7 +5,6 @@ import (
 	"errors"
 	"net/http"
 	"net/http/httptest"
-	"os"
 	"strings"
 	"testing"
 	"time"
@@ -344,26 +343,18 @@ func TestPersistJellyfinCompatWebInstallSettingsEnablesWebUI(t *testing.T) {
 // asyncWebInstallRoot returns a temp dir for a handler that removes or installs
 // Jellyfin Web assets in a background goroutine.
 //
-// t.TempDir is wrong here: the endpoint returns 202 and its goroutine keeps
-// writing into the root after the test body returns, so t.TempDir's cleanup
-// trips "directory not empty" on an otherwise passing test.
-//
-// Removing the directory out from under a running goroutine only moves the
-// race, though: a write landing mid-traversal recreates a path RemoveAll has
-// already walked past, and the leftovers survive the run. The operation
-// records its own terminal state, so cleanup waits for that instead.
+// The endpoint returns 202 and its goroutine keeps writing into the root after
+// the test body returns. Removing the directory out from under it races: a
+// write landing mid-traversal recreates a path RemoveAll has already walked
+// past, which fails an otherwise passing test with "directory not empty" or
+// leaves files behind. The operation records its own terminal state, so a
+// cleanup waits for that first. It is registered after t.TempDir, and
+// cleanups run last registered first, so the wait always finishes before
+// t.TempDir removes the directory.
 func asyncWebInstallRoot(t *testing.T) string {
 	t.Helper()
-	dir, err := os.MkdirTemp("", "jellyfin-web-root-*")
-	if err != nil {
-		t.Fatalf("MkdirTemp: %v", err)
-	}
-	t.Cleanup(func() {
-		waitForWebOperation(t, dir)
-		if err := os.RemoveAll(dir); err != nil {
-			t.Errorf("removing %s: %v", dir, err)
-		}
-	})
+	dir := t.TempDir()
+	t.Cleanup(func() { waitForWebOperation(t, dir) })
 	return dir
 }
 
diff --git a/internal/api/handlers/libraries.go b/internal/api/handlers/libraries.go
index 114da505e4..6d72f1208c 100644
--- a/internal/api/handlers/libraries.go
+++ b/internal/api/handlers/libraries.go
@@ -126,6 +126,7 @@ type libraryScanQueuer interface {
 }
 
 type libraryMovieMatchQueue interface {
+	EnqueueMovieFile(ctx context.Context, fileID int) error
 	SyncForFolder(ctx context.Context, folderID int) error
 	DeleteByFolder(ctx context.Context, folderID int) (int, error)
 	CountStatesByFolder(ctx context.Context, folderID int) (pending int, parked int, err error)
@@ -135,6 +136,8 @@ type libraryMovieMatchQueue interface {
 }
 
 type librarySeriesMatchQueue interface {
+	EnqueueSeriesRoot(ctx context.Context, folderID int, observedRootPath string) error
+	WakeRoot(ctx context.Context, folderID int, observedRootPath string) error
 	SyncForFolder(ctx context.Context, folderID int) error
 	DeleteByFolder(ctx context.Context, folderID int) (int, error)
 	CountStatesByFolder(ctx context.Context, folderID int) (pending int, parked int, err error)
@@ -1781,6 +1784,9 @@ type unmatchedItemResponse struct {
 	LibraryID   int    `json:"library_id"`
 	LibraryName string `json:"library_name"`
 	Status      string `json:"status"`
+	// IgnoredAt is when an admin marked the item as intentionally unmatched,
+	// for the v2 view; it is not part of the v1 document.
+	IgnoredAt *time.Time `json:"-"`
 }
 
 type unmatchedItemsListResponse struct {
@@ -1789,8 +1795,9 @@ type unmatchedItemsListResponse struct {
 }
 
 // HandleListUnmatchedItems handles GET /libraries/unmatched-items.
-// Returns items that are in unmatched, pending, or ambiguous status, enriched with
-// library context so the admin maintenance page can link to them.
+// Returns items that are in unmatched, pending, or ambiguous status and that
+// no admin ignored, enriched with library context so the admin maintenance
+// page can link to them.
 func (h *LibraryHandler) HandleListUnmatchedItems(w http.ResponseWriter, r *http.Request) {
 	q := r.URL.Query()
 	limit := 100
@@ -1805,7 +1812,7 @@ func (h *LibraryHandler) HandleListUnmatchedItems(w http.ResponseWriter, r *http
 			offset = n
 		}
 	}
-	items, total, err := h.ListUnmatchedItems(r.Context(), q.Get("q"), limit, offset)
+	items, total, err := h.ListUnmatchedItems(r.Context(), q.Get("q"), false, limit, offset)
 	if err != nil {
 		writeAPIError(w, err)
 		return
diff --git a/internal/api/handlers/libraries_canceled_test.go b/internal/api/handlers/libraries_canceled_test.go
new file mode 100644
index 0000000000..9ff5f7c08c
--- /dev/null
+++ b/internal/api/handlers/libraries_canceled_test.go
@@ -0,0 +1,45 @@
+package handlers
+
+import (
+	"bytes"
+	"context"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+)
+
+// A client that leaves while its library list loads is not a failure to log:
+// the only error is its own cancellation. A list that fails while the client
+// waits still logs ERROR and answers 500.
+func TestListLibrariesCanceledRequestIsNotAServerError(t *testing.T) {
+	pool, err := pgxpool.New(context.Background(), "postgres://prairie:prairie@127.0.0.1:1/prairie?connect_timeout=1")
+	if err != nil {
+		t.Fatalf("create unreachable pool: %v", err)
+	}
+	t.Cleanup(pool.Close)
+	h := &LibraryHandler{folderRepo: catalog.NewFolderRepository(pool)}
+	var logs bytes.Buffer
+	previous := slog.Default()
+	slog.SetDefault(slog.New(slog.NewTextHandler(&logs, nil)))
+	t.Cleanup(func() { slog.SetDefault(previous) })
+	const failure = `level=ERROR msg="listing libraries"`
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	h.HandleListLibraries(httptest.NewRecorder(), httptest.NewRequest(http.MethodGet, "/api/v1/libraries", nil).WithContext(ctx))
+	if strings.Contains(logs.String(), failure) {
+		t.Fatalf("canceled request logged as a failure: %q", logs.String())
+	}
+
+	waiting := httptest.NewRecorder()
+	h.HandleListLibraries(waiting, httptest.NewRequest(http.MethodGet, "/api/v1/libraries", nil))
+	if waiting.Code != http.StatusInternalServerError || !strings.Contains(logs.String(), failure) {
+		t.Fatalf("failed list while the client waits: status=%d logs=%q", waiting.Code, logs.String())
+	}
+}
diff --git a/internal/api/handlers/libraries_match_test.go b/internal/api/handlers/libraries_match_test.go
index 9fda91b403..0d83bdda6f 100644
--- a/internal/api/handlers/libraries_match_test.go
+++ b/internal/api/handlers/libraries_match_test.go
@@ -198,6 +198,8 @@ func TestLibraryMetadataMatchQueueHandlers_NilFolderRepo(t *testing.T) {
 
 type noopMovieMatchQueue struct{}
 
+func (noopMovieMatchQueue) EnqueueMovieFile(context.Context, int) error { return nil }
+
 func (noopMovieMatchQueue) SyncForFolder(context.Context, int) error {
 	return nil
 }
@@ -229,7 +231,8 @@ type fakeMovieMatchQueue struct {
 	bulkCalls    int
 }
 
-func (f *fakeMovieMatchQueue) SyncForFolder(context.Context, int) error { return nil }
+func (f *fakeMovieMatchQueue) EnqueueMovieFile(context.Context, int) error { return nil }
+func (f *fakeMovieMatchQueue) SyncForFolder(context.Context, int) error    { return nil }
 func (f *fakeMovieMatchQueue) DeleteByFolder(context.Context, int) (int, error) {
 	return 0, nil
 }
@@ -260,7 +263,9 @@ type fakeSeriesMatchQueue struct {
 	bulkCalls    int
 }
 
-func (f *fakeSeriesMatchQueue) SyncForFolder(context.Context, int) error { return nil }
+func (f *fakeSeriesMatchQueue) EnqueueSeriesRoot(context.Context, int, string) error { return nil }
+func (f *fakeSeriesMatchQueue) WakeRoot(context.Context, int, string) error          { return nil }
+func (f *fakeSeriesMatchQueue) SyncForFolder(context.Context, int) error             { return nil }
 func (f *fakeSeriesMatchQueue) DeleteByFolder(context.Context, int) (int, error) {
 	return 0, nil
 }
diff --git a/internal/api/handlers/libraries_service.go b/internal/api/handlers/libraries_service.go
index 9af329384d..91d7742e67 100644
--- a/internal/api/handlers/libraries_service.go
+++ b/internal/api/handlers/libraries_service.go
@@ -11,10 +11,12 @@ import (
 	"slices"
 	"strings"
 
+	"github.com/jackc/pgx/v5"
 	"github.com/oklog/ulid/v2"
 
 	"github.com/prairie-server/prairie-server/internal/adminjob"
 	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/ctxerr"
 	"github.com/prairie-server/prairie-server/internal/metadata"
 	"github.com/prairie-server/prairie-server/internal/models"
 	"github.com/prairie-server/prairie-server/internal/scantrigger"
@@ -72,6 +74,10 @@ type UnmatchedItemView = unmatchedItemResponse
 func (h *LibraryHandler) ListLibraries(ctx context.Context) ([]LibraryView, error) {
 	folders, err := h.folderRepo.List(ctx)
 	if err != nil {
+		if ctxerr.Abandoned(ctx, err) {
+			// The client left; nothing failed, so there is nothing to log.
+			return nil, err
+		}
 		slog.ErrorContext(ctx, "listing libraries", "component", "api", "error", err)
 		return nil, apiError(http.StatusInternalServerError, "internal_error", "Failed to list libraries")
 	}
@@ -480,6 +486,9 @@ func (h *LibraryHandler) ListLibraryRoots(ctx context.Context, libraryID int, st
 				}
 				contentIDByGroup[groupOverrideLookupKey(version, groupKey)] = contentID
 			}
+			if err := claimRows.Err(); err != nil {
+				slog.WarnContext(ctx, "listing group claims", "component", "api", "library_id", libraryID, "error", err)
+			}
 		}
 	}
 
@@ -751,6 +760,10 @@ func (h *LibraryHandler) listAllStaleIDs(ctx context.Context) ([]StaleMediaIDVie
 			LibraryID: libID, LibraryName: libName,
 		}
 	}
+	if err := rows.Err(); err != nil {
+		slog.ErrorContext(ctx, "loading items for stale IDs", "component", "api", "error", err)
+		return nil, apiError(http.StatusInternalServerError, "internal_error", "Failed to load item data")
+	}
 
 	resp := make([]StaleMediaIDView, 0, len(staleIDs))
 	for _, s := range staleIDs {
@@ -840,8 +853,9 @@ func (h *LibraryHandler) RematchStaleID(ctx context.Context, contentID string) e
 
 // ListUnmatchedItems pages the items awaiting a metadata match, optionally
 // filtered by a case-insensitive search over title, type, status and
-// library name, plus the unpaged total.
-func (h *LibraryHandler) ListUnmatchedItems(ctx context.Context, search string, limit, offset int) ([]UnmatchedItemView, int, error) {
+// library name, plus the unpaged total. Items an admin ignored are left out;
+// with ignored set it pages only those instead.
+func (h *LibraryHandler) ListUnmatchedItems(ctx context.Context, search string, ignored bool, limit, offset int) ([]UnmatchedItemView, int, error) {
 	if h.pool == nil {
 		return nil, 0, apiError(http.StatusInternalServerError, "internal_error", "Database not configured")
 	}
@@ -864,12 +878,15 @@ func (h *LibraryHandler) ListUnmatchedItems(ctx context.Context, search string,
 		)`
 	}
 
-	mangaChapterGuard := ` AND ` + catalog.MangaChapterExclusionWhere("mi")
+	guards := ` AND ` + catalog.MangaChapterExclusionWhere("mi") + ` AND mi.match_ignored_at IS NULL`
+	if ignored {
+		guards = ` AND ` + catalog.MangaChapterExclusionWhere("mi") + ` AND mi.match_ignored_at IS NOT NULL`
+	}
 
 	countSQL := `
 		SELECT COUNT(*)
 		FROM media_items mi
-		WHERE mi.status IN ('unmatched', 'pending', 'ambiguous')` + mangaChapterGuard
+		WHERE mi.status IN ('unmatched', 'pending', 'ambiguous')` + guards
 	countSQL += filter
 
 	var total int
@@ -882,7 +899,8 @@ func (h *LibraryHandler) ListUnmatchedItems(ctx context.Context, search string,
 	listSQL := fmt.Sprintf(`
 		SELECT mi.content_id, mi.title, mi.year, mi.type, mi.status,
 		       COALESCE(lib.folder_id, 0),
-		       COALESCE(lib.folder_name, '')
+		       COALESCE(lib.folder_name, ''),
+		       mi.match_ignored_at
 		FROM media_items mi
 		LEFT JOIN LATERAL (
 			SELECT mil.media_folder_id AS folder_id, f.name AS folder_name
@@ -894,7 +912,7 @@ func (h *LibraryHandler) ListUnmatchedItems(ctx context.Context, search string,
 		WHERE mi.status IN ('unmatched', 'pending', 'ambiguous')%s%s
 		ORDER BY mi.title ASC, mi.content_id ASC
 		LIMIT $%d OFFSET $%d
-	`, mangaChapterGuard, filter, len(filterArgs)+1, len(filterArgs)+2)
+	`, guards, filter, len(filterArgs)+1, len(filterArgs)+2)
 
 	rows, err := h.pool.Query(ctx, listSQL, listArgs...)
 	if err != nil {
@@ -906,7 +924,7 @@ func (h *LibraryHandler) ListUnmatchedItems(ctx context.Context, search string,
 	items := make([]UnmatchedItemView, 0)
 	for rows.Next() {
 		var item UnmatchedItemView
-		if err := rows.Scan(&item.ContentID, &item.Title, &item.Year, &item.ContentType, &item.Status, &item.LibraryID, &item.LibraryName); err != nil {
+		if err := rows.Scan(&item.ContentID, &item.Title, &item.Year, &item.ContentType, &item.Status, &item.LibraryID, &item.LibraryName, &item.IgnoredAt); err != nil {
 			slog.ErrorContext(ctx, "scanning unmatched item", "component", "api", "error", err)
 			return nil, 0, apiError(http.StatusInternalServerError, "internal_error", "Failed to scan item")
 		}
@@ -919,6 +937,136 @@ func (h *LibraryHandler) ListUnmatchedItems(ctx context.Context, search string,
 	return items, total, nil
 }
 
+// SetUnmatchedItemIgnored marks an unmatched, pending or ambiguous movie or
+// series as intentionally unmatched, or clears that mark. Books keep their
+// own enrichment paths and cannot be ignored. An ignored item leaves the
+// unmatched list and the matcher queues, and automatic matching leaves it
+// alone until the mark is cleared, which queues it for matching again;
+// Identify still works and clears it. Ignoring keeps the first time it was
+// set and clearing an unmarked item changes nothing.
+func (h *LibraryHandler) SetUnmatchedItemIgnored(ctx context.Context, contentID string, ignored bool) error {
+	if h.pool == nil {
+		return apiError(http.StatusInternalServerError, "internal_error", "Database not configured")
+	}
+	contentID = strings.TrimSpace(contentID)
+	if contentID == "" {
+		return apiError(http.StatusBadRequest, "bad_request", "Missing content ID")
+	}
+	const ignorable = `lower(trim(status)) IN ('pending', 'unmatched', 'ambiguous') AND type IN ('movie', 'series')`
+	// Each statement writes only when the mark changes, so a repeated request
+	// leaves the matcher queues alone.
+	update := `UPDATE media_items SET match_ignored_at = NULL WHERE content_id = $1 AND match_ignored_at IS NOT NULL`
+	if ignored {
+		update = `UPDATE media_items SET match_ignored_at = NOW() WHERE content_id = $1 AND match_ignored_at IS NULL AND ` + ignorable
+	}
+	tag, err := h.pool.Exec(ctx, update, contentID)
+	if err != nil {
+		slog.ErrorContext(ctx, "setting media item match ignore", "component", "api", "content_id", contentID, "ignored", ignored, "error", err)
+		return apiError(http.StatusInternalServerError, "internal_error", "Failed to update item")
+	}
+	if tag.RowsAffected() > 0 {
+		h.requeueItemMatchWork(ctx, contentID, !ignored)
+		return nil
+	}
+	var canIgnore bool
+	if err := h.pool.QueryRow(ctx, `SELECT `+ignorable+` FROM media_items WHERE content_id = $1`, contentID).Scan(&canIgnore); err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return apiError(http.StatusNotFound, "not_found", "Item not found")
+		}
+		slog.ErrorContext(ctx, "checking media item for match ignore", "component", "api", "content_id", contentID, "error", err)
+		return apiError(http.StatusInternalServerError, "internal_error", "Failed to update item")
+	}
+	if !ignored || canIgnore {
+		// Already in the requested state.
+		return nil
+	}
+	return apiError(http.StatusConflict, "conflict", "Only an unmatched movie or series can be ignored")
+}
+
+// requeueItemMatchWork re-evaluates the matcher queue rows of the item's
+// present files, so an ignored item leaves the matcher backlog at once and a
+// restored one is queued for another match attempt. A restore also wakes a
+// series root's row that stayed queued, parked or backed off, for another item
+// sharing the root. A failure is only logged: the next scan's queue sync
+// reaches the same rows.
+func (h *LibraryHandler) requeueItemMatchWork(ctx context.Context, contentID string, restored bool) {
+	if h.MovieMatchQueueRepo == nil && h.SeriesMatchQueueRepo == nil {
+		return
+	}
+	// Each file goes to the queue whose eligibility it can meet, decided the
+	// way the queues decide it: by library type, and in a mixed library by
+	// the file's base type. A movie's files go through the movie queue and a
+	// series' roots through the series queue.
+	rows, err := h.pool.Query(ctx, `
+		SELECT mf.id, mf.media_folder_id, mf.observed_root_path,
+		       CASE
+				WHEN lower(trim(folders.type)) IN ('movie', 'movies') THEN 'movie'
+				WHEN lower(trim(folders.type)) IN ('series', 'tv', 'show', 'tvshows') THEN 'series'
+				WHEN lower(trim(folders.type)) = 'mixed' THEN lower(trim(mf.base_type))
+				ELSE ''
+		       END
+		FROM media_files mf
+		JOIN media_folders folders ON folders.id = mf.media_folder_id
+		WHERE mf.content_id = $1 AND mf.missing_since IS NULL
+		ORDER BY mf.id
+	`, contentID)
+	if err != nil {
+		slog.WarnContext(ctx, "listing item files to requeue match work", "component", "api", "content_id", contentID, "error", err)
+		return
+	}
+	type seriesRoot struct {
+		folderID int
+		path     string
+	}
+	var movieFiles []int
+	var roots []seriesRoot
+	seen := map[seriesRoot]bool{}
+	for rows.Next() {
+		var fileID int
+		var root seriesRoot
+		var queueKind string
+		if err := rows.Scan(&fileID, &root.folderID, &root.path, &queueKind); err != nil {
+			rows.Close()
+			slog.WarnContext(ctx, "scanning item file to requeue match work", "component", "api", "content_id", contentID, "error", err)
+			return
+		}
+		switch queueKind {
+		case itemTypeMovie:
+			movieFiles = append(movieFiles, fileID)
+		case itemTypeSeries:
+			if root.path != "" && !seen[root] {
+				seen[root] = true
+				roots = append(roots, root)
+			}
+		}
+	}
+	rows.Close()
+	if err := rows.Err(); err != nil {
+		slog.WarnContext(ctx, "listing item files to requeue match work", "component", "api", "content_id", contentID, "error", err)
+		return
+	}
+	if h.MovieMatchQueueRepo != nil {
+		for _, fileID := range movieFiles {
+			if err := h.MovieMatchQueueRepo.EnqueueMovieFile(ctx, fileID); err != nil {
+				slog.WarnContext(ctx, "requeueing movie match work", "component", "api", "content_id", contentID, "file_id", fileID, "error", err)
+			}
+		}
+	}
+	if h.SeriesMatchQueueRepo != nil {
+		for _, root := range roots {
+			if err := h.SeriesMatchQueueRepo.EnqueueSeriesRoot(ctx, root.folderID, root.path); err != nil {
+				slog.WarnContext(ctx, "requeueing series match work", "component", "api", "content_id", contentID, "library_id", root.folderID, "error", err)
+				continue
+			}
+			if restored {
+				if err := h.SeriesMatchQueueRepo.WakeRoot(ctx, root.folderID, root.path); err != nil {
+					slog.WarnContext(ctx, "waking series match work", "component", "api", "content_id", contentID, "library_id", root.folderID, "error", err)
+				}
+			}
+		}
+	}
+}
+
 // ConfirmEmptyRootCleanup lets the next scan of the library clean up an
 // empty root once instead of treating it as a lost mount.
 func (h *LibraryHandler) ConfirmEmptyRootCleanup(ctx context.Context, id int) error {
diff --git a/internal/api/handlers/libraries_unmatched_ignore_db_test.go b/internal/api/handlers/libraries_unmatched_ignore_db_test.go
new file mode 100644
index 0000000000..d225523125
--- /dev/null
+++ b/internal/api/handlers/libraries_unmatched_ignore_db_test.go
@@ -0,0 +1,298 @@
+package handlers
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/metadata"
+	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/scanner"
+)
+
+// TestIgnoredUnmatchedItemStaysIgnoredAcrossRescanDB covers issue #2392: an
+// item an admin marks as intentionally unmatched leaves the unmatched list,
+// the scan's retry list and the movie match queue (even a parked row), stays
+// out after a rescan writes its file and item again and syncs the queue, and
+// comes back, queued for matching, once the mark is cleared. A match clears
+// the mark.
+func TestIgnoredUnmatchedItemStaysIgnoredAcrossRescanDB(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatalf("connect test database: %v", err)
+	}
+	t.Cleanup(pool.Close)
+
+	suffix := time.Now().UnixNano()
+	// A per-run tag in the title scopes every list search to this test's rows.
+	tag := fmt.Sprintf("ignore2392-%d", suffix)
+	contentID := fmt.Sprintf("local-ignore-%d", suffix)
+	root := fmt.Sprintf("/ignore-%d/Bonus Disc (2003)", suffix)
+	filePath := root + "/Bonus Disc (2003).mkv"
+	var folderID int
+	if err := pool.QueryRow(ctx, `INSERT INTO media_folders (type, name, enabled) VALUES ('movies', $1, true) RETURNING id`, tag).Scan(&folderID); err != nil {
+		t.Fatalf("seed folder: %v", err)
+	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(ctx, `DELETE FROM media_files WHERE media_folder_id = $1`, folderID)
+		_, _ = pool.Exec(ctx, `DELETE FROM media_item_libraries WHERE media_folder_id = $1`, folderID)
+		_, _ = pool.Exec(ctx, `DELETE FROM media_items WHERE content_id = $1`, contentID)
+		_, _ = pool.Exec(ctx, `DELETE FROM media_folders WHERE id = $1`, folderID)
+	})
+
+	items := catalog.NewItemRepository(pool)
+	files := scanner.NewFileRepository(pool)
+	movieQueue := metadata.NewMovieMatchQueueRepository(pool, files)
+	// scan writes the item and its file the way a scan of the unchanged file
+	// does, so a rescan can be repeated.
+	var fileID int
+	scan := func(step string) {
+		t.Helper()
+		if err := items.Upsert(ctx, &models.MediaItem{ContentID: contentID, Type: "movie", Title: tag + " Bonus Disc", Year: 2003, Status: "unmatched"}); err != nil {
+			t.Fatalf("%s: upsert item: %v", step, err)
+		}
+		modifiedAt := time.Unix(1_700_000_000, 0).UTC()
+		file, err := files.Upsert(ctx, models.MediaFile{ContentID: contentID, MediaFolderID: folderID, FilePath: filePath, ObservedRootPath: root, FileSize: 1024, FileModifiedAt: &modifiedAt})
+		if err != nil {
+			t.Fatalf("%s: upsert file: %v", step, err)
+		}
+		fileID = file.ID
+		if err := movieQueue.SyncForFolder(ctx, folderID); err != nil {
+			t.Fatalf("%s: sync movie queue: %v", step, err)
+		}
+	}
+	scan("first scan")
+	// The matcher gave up on the file: its queue row is parked, which the
+	// Metadata Matcher section counts as still needing a match.
+	if _, err := pool.Exec(ctx, `UPDATE movie_match_queue SET state = 'parked', parked_at = NOW(), attempt_count = 3 WHERE media_file_id = $1`, fileID); err != nil {
+		t.Fatalf("park queue row: %v", err)
+	}
+	queueState := func(step string) string {
+		t.Helper()
+		var state string
+		err := pool.QueryRow(ctx, `SELECT state FROM movie_match_queue WHERE media_file_id = $1`, fileID).Scan(&state)
+		if errors.Is(err, pgx.ErrNoRows) {
+			return "none"
+		}
+		if err != nil {
+			t.Fatalf("%s: read queue row: %v", step, err)
+		}
+		return state
+	}
+	if got := queueState("before ignoring"); got != "parked" {
+		t.Fatalf("before ignoring: queue row = %s, want parked", got)
+	}
+	if _, err := pool.Exec(ctx, `INSERT INTO media_item_libraries (content_id, media_folder_id) VALUES ($1, $2) ON CONFLICT DO NOTHING`, contentID, folderID); err != nil {
+		t.Fatalf("seed library membership: %v", err)
+	}
+
+	h := NewLibraryHandler(nil, nil, nil, pool, nil)
+	h.MovieMatchQueueRepo = movieQueue
+	h.SeriesMatchQueueRepo = metadata.NewSeriesRootMatchQueueRepository(pool)
+	listed := func(step string, ignored bool) *UnmatchedItemView {
+		t.Helper()
+		views, total, err := h.ListUnmatchedItems(ctx, tag, ignored, 50, 0)
+		if err != nil {
+			t.Fatalf("%s: list (ignored=%v): %v", step, ignored, err)
+		}
+		if total != len(views) || total > 1 {
+			t.Fatalf("%s: list (ignored=%v) total = %d with %d rows, want at most this test's item", step, ignored, total, len(views))
+		}
+		if total == 0 {
+			return nil
+		}
+		return &views[0]
+	}
+	retried := func(step string) bool {
+		t.Helper()
+		ids, err := items.ListUnmatchedByFolderAndPathPrefix(ctx, folderID, root, 0)
+		if err != nil {
+			t.Fatalf("%s: retry list: %v", step, err)
+		}
+		for _, id := range ids {
+			if id == contentID {
+				return true
+			}
+		}
+		return false
+	}
+
+	if v := listed("before ignoring", false); v == nil || v.ContentID != contentID || v.IgnoredAt != nil || v.LibraryName != tag {
+		t.Fatalf("before ignoring: unmatched list = %+v, want the item without ignored_at", v)
+	}
+	if !retried("before ignoring") {
+		t.Fatal("before ignoring: the scan's retry list leaves the item out")
+	}
+
+	if err := h.SetUnmatchedItemIgnored(ctx, contentID, true); err != nil {
+		t.Fatalf("ignore: %v", err)
+	}
+	var ignoredAt time.Time
+	if err := pool.QueryRow(ctx, `SELECT match_ignored_at FROM media_items WHERE content_id = $1`, contentID).Scan(&ignoredAt); err != nil {
+		t.Fatalf("read mark: %v", err)
+	}
+	if err := h.SetUnmatchedItemIgnored(ctx, contentID, true); err != nil {
+		t.Fatalf("ignore again: %v", err)
+	}
+
+	for _, step := range []string{"after ignoring", "after a rescan"} {
+		if step == "after a rescan" {
+			scan(step)
+		}
+		if v := listed(step, false); v != nil {
+			t.Fatalf("%s: unmatched list still holds %+v", step, v)
+		}
+		v := listed(step, true)
+		if v == nil || v.ContentID != contentID || v.IgnoredAt == nil || !v.IgnoredAt.Equal(ignoredAt) {
+			t.Fatalf("%s: ignored list = %+v, want the item ignored at %v", step, v, ignoredAt)
+		}
+		if retried(step) {
+			t.Fatalf("%s: the scan's retry list still holds the item", step)
+		}
+		if got := queueState(step); got != "none" {
+			t.Fatalf("%s: movie queue row = %s, want none", step, got)
+		}
+	}
+
+	if err := h.SetUnmatchedItemIgnored(ctx, contentID, false); err != nil {
+		t.Fatalf("unignore: %v", err)
+	}
+	if err := h.SetUnmatchedItemIgnored(ctx, contentID, false); err != nil {
+		t.Fatalf("unignore again: %v", err)
+	}
+	if v := listed("after unignoring", false); v == nil || v.ContentID != contentID || v.IgnoredAt != nil {
+		t.Fatalf("after unignoring: unmatched list = %+v, want the item back", v)
+	}
+	if v := listed("after unignoring", true); v != nil {
+		t.Fatalf("after unignoring: ignored list still holds %+v", v)
+	}
+	if !retried("after unignoring") {
+		t.Fatal("after unignoring: the scan's retry list leaves the item out")
+	}
+	if got := queueState("after unignoring"); got != "pending" {
+		t.Fatalf("after unignoring: movie queue row = %s, want pending", got)
+	}
+
+	// A match clears the mark, and a matched item cannot be ignored.
+	if err := h.SetUnmatchedItemIgnored(ctx, contentID, true); err != nil {
+		t.Fatalf("ignore before matching: %v", err)
+	}
+	if err := items.Upsert(ctx, &models.MediaItem{ContentID: contentID, Type: "movie", Title: tag + " Bonus Disc", Year: 2003, Status: "matched"}); err != nil {
+		t.Fatalf("match: %v", err)
+	}
+	var cleared bool
+	if err := pool.QueryRow(ctx, `SELECT match_ignored_at IS NULL FROM media_items WHERE content_id = $1`, contentID).Scan(&cleared); err != nil {
+		t.Fatalf("read mark after match: %v", err)
+	}
+	if !cleared {
+		t.Fatal("a match left match_ignored_at set")
+	}
+	requireAPIStatus(t, h.SetUnmatchedItemIgnored(ctx, contentID, true), http.StatusConflict)
+	// Books keep their own enrichment paths, so a pending book cannot be ignored.
+	bookID := contentID + "-book"
+	t.Cleanup(func() { _, _ = pool.Exec(ctx, `DELETE FROM media_items WHERE content_id = $1`, bookID) })
+	if err := items.Upsert(ctx, &models.MediaItem{ContentID: bookID, Type: "audiobook", Title: tag + " Book", Status: "pending"}); err != nil {
+		t.Fatalf("seed book: %v", err)
+	}
+	requireAPIStatus(t, h.SetUnmatchedItemIgnored(ctx, bookID, true), http.StatusConflict)
+	requireAPIStatus(t, h.SetUnmatchedItemIgnored(ctx, contentID+"-missing", true), http.StatusNotFound)
+	requireAPIStatus(t, h.SetUnmatchedItemIgnored(ctx, contentID+"-missing", false), http.StatusNotFound)
+
+	// A series goes through the series root queue the same way.
+	var seriesFolder int
+	if err := pool.QueryRow(ctx, `INSERT INTO media_folders (type, name, enabled) VALUES ('series', $1, true) RETURNING id`, tag+" shows").Scan(&seriesFolder); err != nil {
+		t.Fatalf("seed series folder: %v", err)
+	}
+	seriesID := contentID + "-series"
+	seriesRoot := fmt.Sprintf("/ignore-%d/Backyard Workshop Diaries", suffix)
+	t.Cleanup(func() {
+		_, _ = pool.Exec(ctx, `DELETE FROM media_files WHERE media_folder_id = $1`, seriesFolder)
+		_, _ = pool.Exec(ctx, `DELETE FROM media_items WHERE content_id = $1`, seriesID)
+		_, _ = pool.Exec(ctx, `DELETE FROM media_folders WHERE id = $1`, seriesFolder)
+	})
+	if err := items.Upsert(ctx, &models.MediaItem{ContentID: seriesID, Type: "series", Title: tag + " Series", Status: "unmatched"}); err != nil {
+		t.Fatalf("seed series: %v", err)
+	}
+	for _, name := range []string{"S01E01.mkv", "S01E02.mkv"} {
+		if _, err := files.Upsert(ctx, models.MediaFile{ContentID: seriesID, MediaFolderID: seriesFolder, FilePath: seriesRoot + "/Season 01/" + name, ObservedRootPath: seriesRoot, FileSize: 1024, BaseType: "series"}); err != nil {
+			t.Fatalf("seed episode file: %v", err)
+		}
+	}
+	seriesQueued := func() int {
+		t.Helper()
+		var n int
+		if err := pool.QueryRow(ctx, `SELECT COUNT(*) FROM series_root_match_queue WHERE media_folder_id = $1`, seriesFolder).Scan(&n); err != nil {
+			t.Fatalf("count series queue rows: %v", err)
+		}
+		return n
+	}
+	if err := h.SeriesMatchQueueRepo.EnqueueSeriesRoot(ctx, seriesFolder, seriesRoot); err != nil {
+		t.Fatalf("queue series root: %v", err)
+	}
+	if got := seriesQueued(); got != 1 {
+		t.Fatalf("before ignoring the series: series queue rows = %d, want 1", got)
+	}
+	if err := h.SetUnmatchedItemIgnored(ctx, seriesID, true); err != nil {
+		t.Fatalf("ignore series: %v", err)
+	}
+	if got := seriesQueued(); got != 0 {
+		t.Fatalf("after ignoring the series: series queue rows = %d, want 0", got)
+	}
+	if err := h.SetUnmatchedItemIgnored(ctx, seriesID, false); err != nil {
+		t.Fatalf("unignore series: %v", err)
+	}
+	if got := seriesQueued(); got != 1 {
+		t.Fatalf("after unignoring the series: series queue rows = %d, want 1", got)
+	}
+
+	// A partial split leaves a second provisional item under the same root.
+	// Ignoring one keeps the root's row for the other, and a restore must wake
+	// that row even when the matcher had parked it.
+	splitID := seriesID + "-split"
+	t.Cleanup(func() { _, _ = pool.Exec(ctx, `DELETE FROM media_items WHERE content_id = $1`, splitID) })
+	if err := items.Upsert(ctx, &models.MediaItem{ContentID: splitID, Type: "series", Title: tag + " Series Split", Status: "unmatched"}); err != nil {
+		t.Fatalf("seed split series: %v", err)
+	}
+	if _, err := files.Upsert(ctx, models.MediaFile{ContentID: splitID, MediaFolderID: seriesFolder, FilePath: seriesRoot + "/Season 02/S02E01.mkv", ObservedRootPath: seriesRoot, FileSize: 1024, BaseType: "series"}); err != nil {
+		t.Fatalf("seed split episode file: %v", err)
+	}
+	if err := h.SeriesMatchQueueRepo.EnqueueSeriesRoot(ctx, seriesFolder, seriesRoot); err != nil {
+		t.Fatalf("queue shared series root: %v", err)
+	}
+	if _, err := pool.Exec(ctx, `UPDATE series_root_match_queue SET state = 'parked', parked_at = NOW(), deterministic_attempt_count = 3 WHERE media_folder_id = $1`, seriesFolder); err != nil {
+		t.Fatalf("park shared series root: %v", err)
+	}
+	seriesState := func(step string) string {
+		t.Helper()
+		var state string
+		if err := pool.QueryRow(ctx, `SELECT state FROM series_root_match_queue WHERE media_folder_id = $1`, seriesFolder).Scan(&state); err != nil {
+			t.Fatalf("%s: read series queue row: %v", step, err)
+		}
+		return state
+	}
+	if err := h.SetUnmatchedItemIgnored(ctx, seriesID, true); err != nil {
+		t.Fatalf("ignore series sharing a root: %v", err)
+	}
+	if got := seriesState("after ignoring one item of a shared root"); got != "parked" {
+		t.Fatalf("after ignoring one item of a shared root: series queue row = %s, want parked", got)
+	}
+	if err := h.SetUnmatchedItemIgnored(ctx, seriesID, false); err != nil {
+		t.Fatalf("unignore series sharing a root: %v", err)
+	}
+	if got := seriesState("after restoring one item of a shared root"); got != "pending" {
+		t.Fatalf("after restoring one item of a shared root: series queue row = %s, want pending", got)
+	}
+}
diff --git a/internal/api/handlers/library_collections.go b/internal/api/handlers/library_collections.go
index f1c6dfa989..b736a2ac32 100644
--- a/internal/api/handlers/library_collections.go
+++ b/internal/api/handlers/library_collections.go
@@ -31,6 +31,7 @@ import (
 	"github.com/prairie-server/prairie-server/internal/collections/templates"
 	"github.com/prairie-server/prairie-server/internal/collectionutil"
 	evt "github.com/prairie-server/prairie-server/internal/events"
+	"github.com/prairie-server/prairie-server/internal/imagesize"
 	"github.com/prairie-server/prairie-server/internal/models"
 	"github.com/prairie-server/prairie-server/internal/sections"
 	"github.com/prairie-server/prairie-server/internal/usercollections"
@@ -433,29 +434,6 @@ type importTMDBDiscoverSpecBody struct {
 	OriginalLanguage string   `json:"original_language,omitempty"`
 }
 
-type importTraktRequest struct {
-	SortConfig  json.RawMessage `json:"sort_config,omitempty"`
-	LibraryID   int             `json:"library_id"`
-	LibraryIDs  []int           `json:"library_ids"`
-	Title       string          `json:"title"`
-	Description string          `json:"description"`
-	Preset      string          `json:"preset"`
-	MediaType   string          `json:"media_type"`
-	ProfileID   string          `json:"profile_id,omitempty"`
-	// ListURL selects a user-authored Trakt list
-	// (https://trakt.tv/users/{user}/lists/{slug}) instead of a preset.
-	ListURL           string `json:"list_url,omitempty"`
-	Limit             *int   `json:"limit,omitempty"`
-	Featured          bool   `json:"featured"`
-	PosterURL         string `json:"poster_url"`
-	PosterSourceURL   string `json:"poster_source_url"`
-	BackdropSourceURL string `json:"backdrop_source_url"`
-	SyncSchedule      string `json:"sync_schedule"`
-	ManagementMode    string `json:"management_mode,omitempty"`
-	ManagementSource  string `json:"management_source,omitempty"`
-	ManagementKey     string `json:"management_key,omitempty"`
-}
-
 type importCollectionResponse struct {
 	Collection libraryCollectionResponse        `json:"collection"`
 	SyncRun    *models.LibraryCollectionSyncRun `json:"sync_run,omitempty"`
@@ -677,7 +655,7 @@ func templateEligibleForLibrary(tmpl templates.Template, library *models.MediaFo
 		return tmpl.MediaKind == templates.MediaTV || tmpl.MediaKind == templates.MediaMixed
 	case "audiobook", "audiobooks":
 		// Audiobook libraries only accept audiobook-targeted templates.
-		// Today the catalog has none (built-ins are TMDB/Trakt/MDBList
+		// Today the catalog has none (built-ins are TMDB/MDBList
 		// movie/TV imports), so this evaluates to an empty gallery —
 		// the correct UX. Previously this fell through to default:true
 		// and offered admins broken movie/TV templates.
@@ -1056,7 +1034,7 @@ func (h *LibraryCollectionHandler) requireManualCollection(w http.ResponseWriter
 }
 
 // HandleReorderAdminCollectionItems handles PUT /admin/collections/{id}/items/order.
-// Manual collections only — synced types (mdblist/tmdb/trakt) and smart
+// Manual collections only — synced types (mdblist/tmdb) and smart
 // collections reject the call.
 func (h *LibraryCollectionHandler) HandleReorderAdminCollectionItems(w http.ResponseWriter, r *http.Request) {
 	collectionID, ok := h.requireManualCollection(w, r)
@@ -2509,18 +2487,20 @@ func (h *LibraryCollectionHandler) HandleImportTMDBCollection(w http.ResponseWri
 	writeJSON(w, http.StatusCreated, resp)
 }
 
+// HandleImportTraktCollection answers the frozen v1 admin Trakt import route.
+// Prairie no longer supports Trakt, so every well-formed request is refused.
 func (h *LibraryCollectionHandler) HandleImportTraktCollection(w http.ResponseWriter, r *http.Request) {
-	var req importTraktRequest
+	var req struct{}
 	if err := decodeJSONOrMultipart(r, &req); err != nil {
 		writeError(w, http.StatusBadRequest, "bad_request", "Invalid request body")
 		return
 	}
-	resp, err := h.importAdminTrakt(r.Context(), req, func(id, p, b string) error { return h.processArtworkInputs(r, id, p, b) })
-	if err != nil {
-		writeAPIError(w, err)
-		return
-	}
-	writeJSON(w, http.StatusCreated, resp)
+	writeAPIError(w, traktImportRetired())
+}
+
+// traktImportRetired is the error the frozen v1 Trakt import routes return.
+func traktImportRetired() error {
+	return apiError(http.StatusGone, "unsupported_source", "new Trakt collections are not supported")
 }
 
 // loadOrderedCollectionItems answers a manual collection's stored items in
@@ -2687,7 +2667,7 @@ func (h *LibraryCollectionHandler) itemListResponseOf(ctx context.Context, item
 // setListingLogos fills in the logo of each card on a v2 collection page,
 // signed in one batch. items are the cards' media items in any order.
 func (h *LibraryCollectionHandler) setListingLogos(ctx context.Context, cards []itemListResponse, items []*models.MediaItem, access catalog.AccessFilter) {
-	urls := signListingLogos(ctx, h.detailSvc, localizedLogoPaths(ctx, h.detailSvc, items, access), access.ImageSize)
+	urls := signListingLogos(ctx, h.detailSvc, localizedLogoPaths(ctx, h.detailSvc, items, access), access.ImageSizeFor(imagesize.SlotLogo))
 	for i := range cards {
 		cards[i].LogoURL = urls[cards[i].ContentID]
 	}
@@ -3049,7 +3029,7 @@ type tmdbDiscoverConfigBody struct {
 //
 // The discover sub-object exists so additional discover-only fields don't
 // pollute the top-level libraryCollectionSourceConfig struct used for the
-// existing tmdb_preset / trakt_preset / mdblist_json modes.
+// existing tmdb_preset / mdblist_json modes.
 func buildTMDBDiscoverSourceConfig(mediaType string, spec importTMDBDiscoverSpecBody, limit *int) (json.RawMessage, error) {
 	payload := struct {
 		Mode      string                 `json:"mode"`
@@ -3076,48 +3056,6 @@ func buildTMDBDiscoverSourceURL(mediaType, sortBy string) string {
 	return fmt.Sprintf("tmdb://discover/%s?sort_by=%s", mediaType, sortBy)
 }
 
-// buildTraktListSourceConfig builds the source config for a user-authored
-// Trakt list (mode trakt_list, issue #214).
-func buildTraktListSourceConfig(listURL string, limit *int) (json.RawMessage, error) {
-	payload := struct {
-		Mode     string `json:"mode"`
-		Provider string `json:"provider"`
-		URL      string `json:"url"`
-		ListURL  string `json:"list_url"`
-		Limit    *int   `json:"limit,omitempty"`
-	}{
-		Mode:     "trakt_list",
-		Provider: "trakt",
-		URL:      listURL,
-		ListURL:  listURL,
-		Limit:    limit,
-	}
-	return json.Marshal(payload)
-}
-
-func buildTraktSourceConfig(preset, mediaType, profileID string, limit *int) (json.RawMessage, error) {
-	payload := struct {
-		Mode      string `json:"mode"`
-		Provider  string `json:"provider"`
-		Preset    string `json:"preset"`
-		MediaType string `json:"media_type"`
-		ProfileID string `json:"profile_id,omitempty"`
-		Limit     *int   `json:"limit,omitempty"`
-	}{
-		Mode:      "trakt_preset",
-		Provider:  "trakt",
-		Preset:    preset,
-		MediaType: mediaType,
-		ProfileID: profileID,
-		Limit:     limit,
-	}
-	raw, err := json.Marshal(payload)
-	if err != nil {
-		return nil, err
-	}
-	return raw, nil
-}
-
 func normalizeTMDBPresetRequest(preset, mediaType, timeWindow string) (string, string, string, error) {
 	switch preset {
 	case "trending":
@@ -3154,31 +3092,6 @@ func normalizeTMDBPresetRequest(preset, mediaType, timeWindow string) (string, s
 	}
 }
 
-func normalizeTraktPresetRequest(preset, mediaType, profileID string) (string, string, string, error) {
-	preset = strings.TrimSpace(strings.ToLower(preset))
-	mediaType = strings.TrimSpace(strings.ToLower(mediaType))
-	profileID = strings.TrimSpace(profileID)
-
-	switch preset {
-	case "trending", "popular":
-	case "recommended":
-		if profileID == "" {
-			return "", "", "", fmt.Errorf("profile_id is required for Trakt recommended collections")
-		}
-	default:
-		return "", "", "", fmt.Errorf("preset must be one of \"trending\", \"popular\", or \"recommended\"")
-	}
-	switch mediaType {
-	case "movie", "tv":
-	default:
-		return "", "", "", fmt.Errorf("media_type must be \"movie\" or \"tv\"")
-	}
-	if preset != "recommended" {
-		profileID = ""
-	}
-	return preset, mediaType, profileID, nil
-}
-
 func buildTMDBSourceURL(preset, mediaType, timeWindow string) string {
 	if preset == "trending" {
 		return fmt.Sprintf("tmdb://%s/%s/%s", preset, mediaType, timeWindow)
@@ -3186,13 +3099,6 @@ func buildTMDBSourceURL(preset, mediaType, timeWindow string) string {
 	return fmt.Sprintf("tmdb://%s/%s", preset, mediaType)
 }
 
-func buildTraktSourceURL(preset, mediaType, profileID string) string {
-	if preset == "recommended" {
-		return fmt.Sprintf("trakt://%s/%s/%s", preset, mediaType, profileID)
-	}
-	return fmt.Sprintf("trakt://%s/%s", preset, mediaType)
-}
-
 func (h *LibraryCollectionHandler) processCollectionImage(
 	ctx context.Context,
 	collectionID string,
diff --git a/internal/api/handlers/library_collections_test.go b/internal/api/handlers/library_collections_test.go
index 64159cdb43..3dd494569c 100644
--- a/internal/api/handlers/library_collections_test.go
+++ b/internal/api/handlers/library_collections_test.go
@@ -9,23 +9,6 @@ import (
 	"github.com/prairie-server/prairie-server/internal/models"
 )
 
-func TestNormalizeTraktPresetRequest(t *testing.T) {
-	preset, mediaType, profileID, err := normalizeTraktPresetRequest("recommended", "tv", "prof-1")
-	if err != nil {
-		t.Fatalf("normalizeTraktPresetRequest: %v", err)
-	}
-	if preset != "recommended" || mediaType != "tv" || profileID != "prof-1" {
-		t.Fatalf("got %q/%q/%q", preset, mediaType, profileID)
-	}
-
-	if _, _, _, err := normalizeTraktPresetRequest("recommended", "movie", ""); err == nil {
-		t.Fatal("expected profile_id error")
-	}
-	if _, _, _, err := normalizeTraktPresetRequest("popular", "all", ""); err == nil {
-		t.Fatal("expected media_type error")
-	}
-}
-
 func TestBuildTMDBCollectionSourceConfig(t *testing.T) {
 	limit := 12
 	raw, err := buildTMDBCollectionSourceConfig(86311, &limit)
@@ -289,26 +272,6 @@ func TestValidateTMDBDiscoverRequest(t *testing.T) {
 	}
 }
 
-func TestBuildTraktSourceConfig(t *testing.T) {
-	limit := 25
-	raw, err := buildTraktSourceConfig("recommended", "movie", "prof-1", &limit)
-	if err != nil {
-		t.Fatalf("buildTraktSourceConfig: %v", err)
-	}
-	var got map[string]any
-	if err := json.Unmarshal(raw, &got); err != nil {
-		t.Fatalf("unmarshal: %v", err)
-	}
-	if got["mode"] != "trakt_preset" || got["provider"] != "trakt" ||
-		got["preset"] != "recommended" || got["media_type"] != "movie" ||
-		got["profile_id"] != "prof-1" || got["limit"].(float64) != 25 {
-		t.Fatalf("source config = %#v", got)
-	}
-	if url := buildTraktSourceURL("recommended", "movie", "prof-1"); url != "trakt://recommended/movie/prof-1" {
-		t.Fatalf("source url = %q", url)
-	}
-}
-
 func TestNormalizeCollectionManagementFields(t *testing.T) {
 	mode, source, key, err := normalizeCollectionManagementFields("section", "recipe_gallery", "trakt:trending:movie:library:1")
 	if err != nil {
diff --git a/internal/api/handlers/library_views_service.go b/internal/api/handlers/library_views_service.go
index fbfe397d99..6592431c95 100644
--- a/internal/api/handlers/library_views_service.go
+++ b/internal/api/handlers/library_views_service.go
@@ -25,6 +25,14 @@ import (
 type SectionViewer struct {
 	Access    catalog.AccessFilter
 	ImageSize imagesize.Size
+	// ImageWidths are per-slot target widths overriding ImageSize; only the
+	// native v2 API carries them.
+	ImageWidths imagesize.Widths
+}
+
+// Artwork is the viewer's artwork preference.
+func (v SectionViewer) Artwork() imagesize.Request {
+	return imagesize.Request{Size: v.ImageSize, Widths: v.ImageWidths}
 }
 
 func sectionViewerFromRequest(r *http.Request) SectionViewer {
@@ -158,11 +166,19 @@ func (h *SectionHandler) LibrarySections(ctx context.Context, libraryID int, vie
 	withItems := h.fetcher.FetchAll(ctx, resolved, &libraryID, nil, userID, profileID, accessFilter)
 	withItems = applyDiversityFilter(withItems)
 	withItems = dropEmptySeasonalSections(withItems)
-	return h.buildSections(ctx, withItems, &libraryID, viewer.Access, viewer.ImageSize), nil
+	return h.buildSections(ctx, withItems, &libraryID, viewer.Access, viewer.Artwork()), nil
 }
 
-// LibrarySectionItems answers one section of the library with its items.
+// LibrarySectionItems answers one section of the library with its items, or
+// an error when its items cannot be fetched.
 func (h *SectionHandler) LibrarySectionItems(ctx context.Context, libraryID int, sectionID string, viewer SectionViewer) (SectionView, error) {
+	return h.librarySectionItems(ctx, libraryID, sectionID, viewer, false)
+}
+
+// librarySectionItems is LibrarySectionItems. With emptyOnFetchError, a
+// section whose items cannot be fetched answers with no items, as the frozen
+// v1 endpoint always has.
+func (h *SectionHandler) librarySectionItems(ctx context.Context, libraryID int, sectionID string, viewer SectionViewer, emptyOnFetchError bool) (SectionView, error) {
 	if err := h.requireViewableLibrary(ctx, libraryID); err != nil {
 		return SectionView{}, err
 	}
@@ -178,12 +194,14 @@ func (h *SectionHandler) LibrarySectionItems(ctx context.Context, libraryID int,
 		withItems, fetchErr := h.fetcher.FetchOne(ctx, s, &libraryID, nil, userID, profileID, accessFilter)
 		if fetchErr != nil {
 			sections.LogFetchError(ctx, "api", s, fetchErr)
-			withItems = sections.SectionWithItems{
-				ResolvedSection: s,
-				Items:           []*models.MediaItem{},
+			// As on Home, a failed single section answers an error rather
+			// than an empty row; a deleted collection keeps its empty row.
+			if !emptyOnFetchError && !sections.IsMissingCollection(fetchErr) {
+				return SectionView{}, apiError(http.StatusInternalServerError, "internal_error", "Failed to load section")
 			}
+			withItems = sections.SectionWithItems{ResolvedSection: s, Items: []*models.MediaItem{}}
 		}
-		resp := h.buildSections(ctx, []sections.SectionWithItems{withItems}, &libraryID, viewer.Access, viewer.ImageSize)
+		resp := h.buildSections(ctx, []sections.SectionWithItems{withItems}, &libraryID, viewer.Access, viewer.Artwork())
 		if len(resp.Sections) == 0 {
 			return resolvedSectionResponse{
 				ID:          withItems.ID,
diff --git a/internal/api/handlers/marker_population.go b/internal/api/handlers/marker_population.go
index 043051b1d3..de8b37dd28 100644
--- a/internal/api/handlers/marker_population.go
+++ b/internal/api/handlers/marker_population.go
@@ -5,6 +5,7 @@ import (
 	"log/slog"
 	"time"
 
+	"github.com/prairie-server/prairie-server/internal/ctxerr"
 	"github.com/prairie-server/prairie-server/internal/models"
 )
 
@@ -22,7 +23,7 @@ func populateFileMarkers(ctx context.Context, population MarkerPopulationService
 	defer cancel()
 	populated, _, err := population.Populate(lookupCtx, file)
 	if err != nil {
-		slog.WarnContext(ctx, "marker lookup failed", "file_id", file.ID, "error", err)
+		slog.Log(ctx, ctxerr.LogLevel(ctx, err, slog.LevelWarn), "marker lookup failed", "file_id", file.ID, "error", err)
 	}
 	if populated == nil {
 		return file
diff --git a/internal/api/handlers/metadata_ai.go b/internal/api/handlers/metadata_ai.go
index ec3eaa29e8..8e1f644fd9 100644
--- a/internal/api/handlers/metadata_ai.go
+++ b/internal/api/handlers/metadata_ai.go
@@ -5,7 +5,10 @@ import (
 	"encoding/json"
 	"errors"
 	"net/http"
+	"slices"
 	"strconv"
+	"strings"
+	"sync"
 
 	"github.com/go-chi/chi/v5"
 
@@ -14,6 +17,7 @@ import (
 	"github.com/prairie-server/prairie-server/internal/catalog"
 	"github.com/prairie-server/prairie-server/internal/metadata/translation"
 	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/ratelimit"
 )
 
 type metadataAIItemAccess interface {
@@ -29,9 +33,49 @@ type metadataAIEpisodeLookup interface {
 	GetByID(ctx context.Context, contentID string) (*models.Episode, error)
 }
 
+// metadataAIPendingLanguage reports the language a viewer's detail page is
+// missing for an item, season, or episode (the detail document's
+// pending_translation_language); *catalog.DetailService implements it.
+type metadataAIPendingLanguage interface {
+	PendingTranslationLanguageChecked(ctx context.Context, item *models.MediaItem, filter catalog.AccessFilter) (string, error)
+	PendingSeasonTranslationLanguageChecked(ctx context.Context, season *models.Season, filter catalog.AccessFilter) (string, error)
+	PendingEpisodeTranslationLanguageChecked(ctx context.Context, episode *models.Episode, filter catalog.AccessFilter) (string, error)
+}
+
 type metadataAITarget struct {
 	kind            translation.TargetKind
 	accessContentID string
+	item            *models.MediaItem
+	season          *models.Season
+	episode         *models.Episode
+}
+
+// metadataAIOnViewRate bounds viewer-triggered translation requests per
+// account. Auto mode sends one per detail view of an untranslated item, so a
+// person browsing stays well inside it; a script looping over the catalog
+// does not.
+var metadataAIOnViewRate = ratelimit.Rate{
+	RequestsPerSecond: 5,
+	RequestsPerMinute: 30,
+	Burst:             10,
+}
+
+func metadataAIOnViewLimiterKey(userID int) string {
+	return "metadata-translate-on-view:" + strconv.Itoa(userID)
+}
+
+// onViewAllow checks the account budget. A shared limiter that cannot reach
+// its store allows every request and reports Remaining -1; this route falls
+// back to a per-node budget then instead of letting the provider calls
+// through unbounded.
+func (h *MetadataAIHandler) onViewAllow(ctx context.Context, userID int) ratelimit.AllowResult {
+	key := metadataAIOnViewLimiterKey(userID)
+	result := h.Limiter.Allow(ctx, key, metadataAIOnViewRate)
+	if !result.Allowed || result.Remaining != -1 {
+		return result
+	}
+	h.localLimiterOnce.Do(func() { h.localLimiter = ratelimit.NewMemoryLimiter() })
+	return h.localLimiter.Allow(ctx, key, metadataAIOnViewRate)
 }
 
 // MetadataAIHandler exposes AI translation of catalog descriptions into the
@@ -46,6 +90,25 @@ type MetadataAIHandler struct {
 	// detail pages to the parent series for authorization.
 	SeasonLookup  metadataAISeasonLookup
 	EpisodeLookup metadataAIEpisodeLookup
+	// Libraries resolves library prewarm targets; nil leaves them unavailable.
+	Libraries metadataAILibraryLookup
+	// Pending limits the on-view route to the language the viewer's own detail
+	// page reports missing, so a caller cannot queue arbitrary languages.
+	Pending metadataAIPendingLanguage
+	// ItemLibraries lists the libraries of the requested item, or of the
+	// requested episode itself. A detail page opened inside a library resolves the language
+	// from that library when the profile sets none, so the check accepts the
+	// language any of the viewer's libraries of the item reports.
+	ItemLibraries metadataAIItemLibraries
+	// Limiter bounds on-view requests per account; the router passes a
+	// Redis limiter whenever Redis is configured, so every node shares one
+	// budget.
+	Limiter ratelimit.RateLimiter
+
+	// localLimiter enforces the budget on this node while the shared limiter
+	// fails open (Redis unreachable): this route spends provider money.
+	localLimiterOnce sync.Once
+	localLimiter     ratelimit.RateLimiter
 }
 
 // NewMetadataAIHandler creates a handler backed by the given service.
@@ -100,11 +163,13 @@ func (h *MetadataAIHandler) HandleTranslateOnView(w http.ResponseWriter, r *http
 		return
 	}
 	filter := catalog.AccessFilter{
-		AllowedLibraryIDs:  scope.AllowedLibraryIDs,
-		DisabledLibraryIDs: scope.DisabledLibraryIDs,
-		MaturityLimits:     scope.MaturityLimits,
-		UserID:             scope.UserID,
-		ProfileID:          scope.ProfileID,
+		AllowedLibraryIDs:         scope.AllowedLibraryIDs,
+		DisabledLibraryIDs:        scope.DisabledLibraryIDs,
+		MaturityLimits:            scope.MaturityLimits,
+		ProfilePreferredLanguage:  scope.PreferredMetadataLanguage,
+		MetadataLanguageOverrides: scope.MetadataLanguageOverrides,
+		UserID:                    scope.UserID,
+		ProfileID:                 scope.ProfileID,
 	}
 	var requestedBy *int
 	if userID := apimw.GetUserID(r.Context()); userID != 0 {
@@ -118,6 +183,81 @@ func (h *MetadataAIHandler) HandleTranslateOnView(w http.ResponseWriter, r *http
 	writeJSON(w, http.StatusAccepted, map[string]any{"job": job})
 }
 
+type metadataAIItemLibraries interface {
+	LibraryIDsForItem(ctx context.Context, contentID string) ([]int, error)
+}
+
+// viewerPendingLanguage is the language a detail page of target reports
+// missing that equals requested: the profile-level answer, or else the answer
+// of a library-scoped page in one of the viewer's libraries of the item. It
+// returns the profile-level answer (possibly "") when none matches, and an
+// error when a read fails.
+func (h *MetadataAIHandler) viewerPendingLanguage(ctx context.Context, target metadataAITarget, filter catalog.AccessFilter, requested string) (string, error) {
+	matches := func(language string) bool {
+		return language != "" && strings.EqualFold(strings.TrimSpace(requested), language)
+	}
+	pending, err := h.pendingLanguage(ctx, target, filter)
+	if err != nil {
+		return "", err
+	}
+	if matches(pending) || h.ItemLibraries == nil {
+		return pending, nil
+	}
+	// An episode page in a library is validated against the episode's own
+	// memberships, which can differ from its series'; seasons and items use
+	// the item the request authorizes.
+	membershipID := target.accessContentID
+	if target.episode != nil {
+		membershipID = target.episode.ContentID
+	}
+	libraryIDs, err := h.ItemLibraries.LibraryIDsForItem(ctx, membershipID)
+	if err != nil {
+		return "", err
+	}
+	// No membership means no library-scoped page resolves the target (an
+	// episode without files, say). LibraryScope would read an empty list as
+	// the viewer's whole allowlist, so stop here.
+	if len(libraryIDs) == 0 {
+		return pending, nil
+	}
+	scope, none := filter.LibraryScope(libraryIDs)
+	if none {
+		return pending, nil
+	}
+	if scope == nil {
+		scope = libraryIDs
+	}
+	for _, libraryID := range scope {
+		if slices.Contains(filter.DisabledLibraryIDs, libraryID) {
+			continue
+		}
+		scoped := filter
+		scoped.PresentationLibraryID = &libraryID
+		language, err := h.pendingLanguage(ctx, target, scoped)
+		if err != nil {
+			return "", err
+		}
+		if matches(language) {
+			return language, nil
+		}
+	}
+	return pending, nil
+}
+
+// pendingLanguage is the language the viewer's detail page for target reports
+// missing, or "" when nothing is missing.
+func (h *MetadataAIHandler) pendingLanguage(ctx context.Context, target metadataAITarget, filter catalog.AccessFilter) (string, error) {
+	switch {
+	case target.item != nil:
+		return h.Pending.PendingTranslationLanguageChecked(ctx, target.item, filter)
+	case target.season != nil:
+		return h.Pending.PendingSeasonTranslationLanguageChecked(ctx, target.season, filter)
+	case target.episode != nil:
+		return h.Pending.PendingEpisodeTranslationLanguageChecked(ctx, target.episode, filter)
+	}
+	return "", nil
+}
+
 func (h *MetadataAIHandler) resolveTranslationTarget(ctx context.Context, contentID string) (metadataAITarget, error) {
 	if h.ItemAccess == nil {
 		return metadataAITarget{}, catalog.ErrItemNotFound
@@ -129,7 +269,7 @@ func (h *MetadataAIHandler) resolveTranslationTarget(ctx context.Context, conten
 		if item == nil {
 			return metadataAITarget{}, catalog.ErrItemNotFound
 		}
-		return metadataAITarget{kind: translation.TargetItem, accessContentID: contentID}, nil
+		return metadataAITarget{kind: translation.TargetItem, accessContentID: contentID, item: item}, nil
 	case !errors.Is(err, catalog.ErrItemNotFound):
 		return metadataAITarget{}, err
 	}
@@ -141,7 +281,7 @@ func (h *MetadataAIHandler) resolveTranslationTarget(ctx context.Context, conten
 			if season == nil {
 				return metadataAITarget{}, catalog.ErrItemNotFound
 			}
-			return metadataAITarget{kind: translation.TargetSeason, accessContentID: season.SeriesID}, nil
+			return metadataAITarget{kind: translation.TargetSeason, accessContentID: season.SeriesID, season: season}, nil
 		case !errors.Is(err, catalog.ErrSeasonNotFound):
 			return metadataAITarget{}, err
 		}
@@ -154,7 +294,7 @@ func (h *MetadataAIHandler) resolveTranslationTarget(ctx context.Context, conten
 			if episode == nil {
 				return metadataAITarget{}, catalog.ErrItemNotFound
 			}
-			return metadataAITarget{kind: translation.TargetEpisode, accessContentID: episode.SeriesID}, nil
+			return metadataAITarget{kind: translation.TargetEpisode, accessContentID: episode.SeriesID, episode: episode}, nil
 		case !errors.Is(err, catalog.ErrEpisodeNotFound):
 			return metadataAITarget{}, err
 		}
diff --git a/internal/api/handlers/metadata_ai_guard_test.go b/internal/api/handlers/metadata_ai_guard_test.go
new file mode 100644
index 0000000000..6b78dbc9c9
--- /dev/null
+++ b/internal/api/handlers/metadata_ai_guard_test.go
@@ -0,0 +1,439 @@
+package handlers
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/prairie-server/prairie-server/internal/access"
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/metadata/translation"
+	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/ratelimit"
+)
+
+type guardItemAccess struct{}
+
+func (guardItemAccess) GetByID(_ context.Context, contentID string) (*models.MediaItem, error) {
+	return &models.MediaItem{ContentID: contentID, Overview: "An overview."}, nil
+}
+
+func (guardItemAccess) EnsureAccessible(context.Context, string, catalog.AccessFilter) error {
+	return nil
+}
+
+type guardPending struct{ language string }
+
+func (p guardPending) PendingTranslationLanguageChecked(context.Context, *models.MediaItem, catalog.AccessFilter) (string, error) {
+	return p.language, nil
+}
+
+func (p guardPending) PendingSeasonTranslationLanguageChecked(context.Context, *models.Season, catalog.AccessFilter) (string, error) {
+	return p.language, nil
+}
+
+func (p guardPending) PendingEpisodeTranslationLanguageChecked(context.Context, *models.Episode, catalog.AccessFilter) (string, error) {
+	return p.language, nil
+}
+
+type denyLimiter struct{}
+
+func (denyLimiter) Allow(context.Context, string, ratelimit.Rate) ratelimit.AllowResult {
+	return ratelimit.AllowResult{Allowed: false}
+}
+func (denyLimiter) Close() {}
+
+// guardJobs is the translation job store behind the guard tests. active is
+// the job a retry coalesces onto; RequestOnView's first read counts in
+// reached and fails with errGuardPassed, so a request that passes every
+// guard ends in a 500.
+type guardJobs struct {
+	translation.JobRepository
+	active  *translation.Job
+	reached int
+}
+
+var errGuardPassed = errors.New("passed every guard")
+
+func (j *guardJobs) GetActiveJobByIdempotencyKey(context.Context, string) (*translation.Job, error) {
+	return j.active, nil
+}
+
+func (j *guardJobs) ListJobsByContent(context.Context, string) ([]translation.Job, error) {
+	j.reached++
+	return nil, errGuardPassed
+}
+
+// guardContent reads every item as a movie, which has no children.
+type guardContent struct{ translation.ContentReader }
+
+func (guardContent) ItemText(_ context.Context, contentID string) (*translation.ItemText, error) {
+	return &translation.ItemText{ContentID: contentID, Type: "movie"}, nil
+}
+
+// passedGuards reports whether the last request passed every guard and
+// reached the service, as opposed to failing a read on the way; it resets the
+// count for the next request.
+func passedGuards(jobs *guardJobs, err error) bool {
+	reached := jobs.reached > 0
+	jobs.reached = 0
+	var apiErr *APIError
+	return reached && errors.As(err, &apiErr) && apiErr.Status == http.StatusInternalServerError
+}
+
+var guardConfig = translation.Config{Enabled: true, Configured: true, ChatModel: "test-model", OnView: "auto"}
+
+// newGuardHandler wires a handler whose on-view translation is on and whose
+// job store has no active job.
+func newGuardHandler(pending string, limiter ratelimit.RateLimiter) *MetadataAIHandler {
+	return newGuardHandlerWith(guardConfig, &guardJobs{}, pending, limiter)
+}
+
+func newGuardHandlerWith(cfg translation.Config, jobs *guardJobs, pending string, limiter ratelimit.RateLimiter) *MetadataAIHandler {
+	svc := translation.NewService(context.Background(), cfg, jobs, guardContent{}, nil, nil, nil, nil)
+	h := NewMetadataAIHandler(svc)
+	h.ItemAccess = guardItemAccess{}
+	h.Pending = guardPending{language: pending}
+	h.Limiter = limiter
+	return h
+}
+
+func TestTranslateOnViewOnlyQueuesTheViewersPendingLanguage(t *testing.T) {
+	userID := 7
+	cases := []struct {
+		name       string
+		pending    string
+		requested  string
+		limiter    ratelimit.RateLimiter
+		wantStatus int
+		wantField  string
+		reaches    bool
+	}{
+		{name: "nothing missing", pending: "", requested: "de", wantStatus: http.StatusBadRequest, wantField: "target_language"},
+		{name: "another language", pending: "de", requested: "ja", wantStatus: http.StatusBadRequest, wantField: "target_language"},
+		{name: "rate limited", pending: "de", requested: "de", limiter: denyLimiter{}, wantStatus: http.StatusTooManyRequests},
+		{name: "matching language reaches the service", pending: "de", requested: "DE", wantStatus: http.StatusInternalServerError, reaches: true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			jobs := &guardJobs{}
+			h := newGuardHandlerWith(guardConfig, jobs, tc.pending, tc.limiter)
+			_, err := h.TranslateOnView(context.Background(), catalog.AccessFilter{}, "item1", tc.requested, &userID)
+			if (jobs.reached > 0) != tc.reaches {
+				t.Fatalf("reached the service = %t, want %t", jobs.reached > 0, tc.reaches)
+			}
+			var apiErr *APIError
+			if !errors.As(err, &apiErr) {
+				t.Fatalf("err = %v, want *APIError", err)
+			}
+			if apiErr.Status != tc.wantStatus || apiErr.Field != tc.wantField {
+				t.Fatalf("got status %d field %q (%s), want %d field %q", apiErr.Status, apiErr.Field, apiErr.Message, tc.wantStatus, tc.wantField)
+			}
+		})
+	}
+}
+
+// libraryPending reports German only for a page scoped to library 7, as a
+// detail page does for a profile without a metadata language.
+type libraryPending struct{}
+
+func (libraryPending) PendingTranslationLanguageChecked(_ context.Context, _ *models.MediaItem, filter catalog.AccessFilter) (string, error) {
+	if filter.PresentationLibraryID != nil && *filter.PresentationLibraryID == 7 {
+		return "de", nil
+	}
+	return "", nil
+}
+
+func (libraryPending) PendingSeasonTranslationLanguageChecked(context.Context, *models.Season, catalog.AccessFilter) (string, error) {
+	return "", nil
+}
+
+func (libraryPending) PendingEpisodeTranslationLanguageChecked(context.Context, *models.Episode, catalog.AccessFilter) (string, error) {
+	return "", nil
+}
+
+type itemLibraries []int
+
+func (l itemLibraries) LibraryIDsForItem(context.Context, string) ([]int, error) { return l, nil }
+
+func TestTranslateOnViewAcceptsTheLanguageOfAViewerLibrary(t *testing.T) {
+	userID := 7
+	jobs := &guardJobs{}
+	h := newGuardHandlerWith(guardConfig, jobs, "", nil)
+	h.Pending = libraryPending{}
+	h.ItemLibraries = itemLibraries{3, 7}
+
+	// The library-scoped page asked for German: the check reaches the service.
+	_, err := h.TranslateOnView(context.Background(), catalog.AccessFilter{}, "item1", "de", &userID)
+	if !passedGuards(jobs, err) {
+		t.Fatalf("library language: err = %v, want it to reach the service", err)
+	}
+	var apiErr *APIError
+	// A library the viewer cannot see does not count.
+	_, err = h.TranslateOnView(context.Background(), catalog.AccessFilter{DisabledLibraryIDs: []int{7}}, "item1", "de", &userID)
+	if !errors.As(err, &apiErr) || apiErr.Status != http.StatusBadRequest {
+		t.Fatalf("hidden library: err = %v, want 400", err)
+	}
+	_, err = h.TranslateOnView(context.Background(), catalog.AccessFilter{AllowedLibraryIDs: []int{3}}, "item1", "de", &userID)
+	if !errors.As(err, &apiErr) || apiErr.Status != http.StatusBadRequest {
+		t.Fatalf("library outside the allowlist: err = %v, want 400", err)
+	}
+	// Other languages are still refused.
+	_, err = h.TranslateOnView(context.Background(), catalog.AccessFilter{}, "item1", "ja", &userID)
+	if !errors.As(err, &apiErr) || apiErr.Status != http.StatusBadRequest {
+		t.Fatalf("other language: err = %v, want 400", err)
+	}
+}
+
+// episodeOnlyAccess resolves every ID as an episode of series1.
+type episodeOnlyAccess struct{}
+
+func (episodeOnlyAccess) GetByID(context.Context, string) (*models.MediaItem, error) {
+	return nil, catalog.ErrItemNotFound
+}
+
+func (episodeOnlyAccess) EnsureAccessible(context.Context, string, catalog.AccessFilter) error {
+	return nil
+}
+
+type episodeLookup struct{}
+
+func (episodeLookup) GetByID(_ context.Context, contentID string) (*models.Episode, error) {
+	return &models.Episode{ContentID: contentID, SeriesID: "series1", Overview: "An overview."}, nil
+}
+
+// episodeLibraryPending reports German for an episode page scoped to library 7.
+type episodeLibraryPending struct{ libraryPending }
+
+func (episodeLibraryPending) PendingEpisodeTranslationLanguageChecked(_ context.Context, _ *models.Episode, filter catalog.AccessFilter) (string, error) {
+	if filter.PresentationLibraryID != nil && *filter.PresentationLibraryID == 7 {
+		return "de", nil
+	}
+	return "", nil
+}
+
+// membershipsByID answers the libraries of each content ID.
+type membershipsByID map[string][]int
+
+func (m membershipsByID) LibraryIDsForItem(_ context.Context, contentID string) ([]int, error) {
+	return m[contentID], nil
+}
+
+// An episode page is scoped by the episode's own libraries, not its series'.
+func TestTranslateOnViewUsesTheEpisodesOwnLibraries(t *testing.T) {
+	userID := 7
+	jobs := &guardJobs{}
+	h := newGuardHandlerWith(guardConfig, jobs, "", nil)
+	h.ItemAccess = episodeOnlyAccess{}
+	h.EpisodeLookup = episodeLookup{}
+	h.Pending = episodeLibraryPending{}
+
+	h.ItemLibraries = membershipsByID{"series1": {3}, "ep1": {7}}
+	_, err := h.TranslateOnView(context.Background(), catalog.AccessFilter{}, "ep1", "de", &userID)
+	if !passedGuards(jobs, err) {
+		t.Fatalf("episode library: err = %v, want it to reach the service", err)
+	}
+	var apiErr *APIError
+
+	h.ItemLibraries = membershipsByID{"series1": {3, 7}, "ep1": {3}}
+	_, err = h.TranslateOnView(context.Background(), catalog.AccessFilter{}, "ep1", "de", &userID)
+	if !errors.As(err, &apiErr) || apiErr.Status != http.StatusBadRequest {
+		t.Fatalf("series-only library: err = %v, want 400", err)
+	}
+
+	// An episode in no library is not widened to the viewer's allowlist.
+	h.ItemLibraries = membershipsByID{"series1": {7}}
+	_, err = h.TranslateOnView(context.Background(), catalog.AccessFilter{AllowedLibraryIDs: []int{7}}, "ep1", "de", &userID)
+	if !errors.As(err, &apiErr) || apiErr.Status != http.StatusBadRequest {
+		t.Fatalf("episode without libraries: err = %v, want 400", err)
+	}
+}
+
+// failOpenLimiter is a shared limiter whose store is unreachable: it allows
+// everything and says so with Remaining -1.
+type failOpenLimiter struct{}
+
+func (failOpenLimiter) Allow(context.Context, string, ratelimit.Rate) ratelimit.AllowResult {
+	return ratelimit.AllowResult{Allowed: true, Remaining: -1}
+}
+func (failOpenLimiter) Close() {}
+
+func TestTranslateOnViewKeepsABudgetWhileTheSharedLimiterFailsOpen(t *testing.T) {
+	userID := 7
+	h := newGuardHandler("de", failOpenLimiter{})
+	var limited int
+	for i := 0; i < 15; i++ {
+		_, err := h.TranslateOnView(context.Background(), catalog.AccessFilter{}, "item1", "de", &userID)
+		var apiErr *APIError
+		if errors.As(err, &apiErr) && apiErr.Status == http.StatusTooManyRequests {
+			limited++
+		}
+	}
+	if limited == 0 {
+		t.Fatal("no request was limited while the shared limiter failed open")
+	}
+}
+
+// A refused request spends budget before the pending-language lookup runs.
+func TestTranslateOnViewChecksTheBudgetBeforeTheLanguage(t *testing.T) {
+	userID := 7
+	h := newGuardHandler("de", denyLimiter{})
+	_, err := h.TranslateOnView(context.Background(), catalog.AccessFilter{}, "item1", "ja", &userID)
+	var apiErr *APIError
+	if !errors.As(err, &apiErr) || apiErr.Status != http.StatusTooManyRequests {
+		t.Fatalf("err = %v, want 429 before the language check", err)
+	}
+}
+
+type waitLimiter struct{ wait time.Duration }
+
+func (l waitLimiter) Allow(context.Context, string, ratelimit.Rate) ratelimit.AllowResult {
+	return ratelimit.AllowResult{Allowed: false, RetryAfter: l.wait}
+}
+func (waitLimiter) Close() {}
+
+// Retry-After rounds up, so a client that waits the advertised time is let in.
+func TestTranslateOnViewRoundsRetryAfterUp(t *testing.T) {
+	userID := 7
+	h := newGuardHandler("de", waitLimiter{wait: 1500 * time.Millisecond})
+	_, err := h.TranslateOnView(context.Background(), catalog.AccessFilter{}, "item1", "de", &userID)
+	var apiErr *APIError
+	if !errors.As(err, &apiErr) || apiErr.RetryAfter != 2 {
+		t.Fatalf("err = %#v, want a 429 with Retry-After 2", err)
+	}
+}
+
+// countingLimiter allows everything and counts the requests that spent budget.
+type countingLimiter struct{ calls int }
+
+func (l *countingLimiter) Allow(context.Context, string, ratelimit.Rate) ratelimit.AllowResult {
+	l.calls++
+	return ratelimit.AllowResult{Allowed: true, Remaining: 1}
+}
+func (*countingLimiter) Close() {}
+
+// With on-view translation off, every request gets the not-configured answer
+// without spending budget, whatever its language.
+func TestTranslateOnViewAnswersNotConfiguredBeforeTheGuards(t *testing.T) {
+	userID := 7
+	limiter := &countingLimiter{}
+	off := guardConfig
+	off.OnView = "off"
+	h := newGuardHandlerWith(off, &guardJobs{}, "", limiter)
+	_, err := h.TranslateOnView(context.Background(), catalog.AccessFilter{}, "item1", "ja", &userID)
+	var apiErr *APIError
+	if !errors.As(err, &apiErr) || apiErr.Status != http.StatusServiceUnavailable || apiErr.Code != "not_configured" {
+		t.Fatalf("err = %v, want 503 not_configured", err)
+	}
+	if limiter.calls != 0 {
+		t.Fatalf("limiter calls = %d, want none while the feature is off", limiter.calls)
+	}
+}
+
+// A retry after a lost response gets the running job back even once the job
+// has filled the description and nothing is reported missing any more.
+func TestTranslateOnViewReturnsTheActiveJobToARetry(t *testing.T) {
+	userID := 7
+	active := &translation.Job{ID: 9, TargetKind: translation.TargetItem, ContentID: "item1", TargetLanguage: "de", RequestedBy: &userID}
+	h := newGuardHandlerWith(guardConfig, &guardJobs{active: active}, "", nil)
+	job, err := h.TranslateOnView(context.Background(), catalog.AccessFilter{}, "item1", "de", &userID)
+	if err != nil || job == nil || job.ID != 9 {
+		t.Fatalf("job = %#v, err = %v, want the active job 9", job, err)
+	}
+}
+
+// Another account's job, or a job in a language this profile does not
+// read, is never handed out in place of the refusal.
+func TestTranslateOnViewKeepsOtherJobsToThemselves(t *testing.T) {
+	userID, otherID := 7, 8
+	cases := []struct {
+		name      string
+		pending   string
+		requested string
+		owner     *int
+	}{
+		{name: "another account's job", pending: "", requested: "de", owner: &otherID},
+		{name: "a job nobody requested", pending: "", requested: "de"},
+		{name: "a language the profile does not read", pending: "de", requested: "fr", owner: &userID},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			active := &translation.Job{ID: 9, TargetKind: translation.TargetItem, ContentID: "item1", TargetLanguage: tc.requested, RequestedBy: tc.owner}
+			h := newGuardHandlerWith(guardConfig, &guardJobs{active: active}, tc.pending, nil)
+			job, err := h.TranslateOnView(context.Background(), catalog.AccessFilter{}, "item1", tc.requested, &userID)
+			var apiErr *APIError
+			if job != nil || !errors.As(err, &apiErr) || apiErr.Field != "target_language" {
+				t.Fatalf("job = %#v, err = %v, want a target_language refusal", job, err)
+			}
+		})
+	}
+}
+
+type failingLibraries struct{}
+
+func (failingLibraries) LibraryIDsForItem(context.Context, string) ([]int, error) {
+	return nil, errors.New("database unavailable")
+}
+
+// A profile that inherits its language from the library depends on the
+// membership lookup; a failed lookup is a server error, not "nothing to
+// translate".
+func TestTranslateOnViewReportsAFailedLibraryLookup(t *testing.T) {
+	userID := 7
+	h := newGuardHandler("", nil)
+	h.Pending = libraryPending{}
+	h.ItemLibraries = failingLibraries{}
+	_, err := h.TranslateOnView(context.Background(), catalog.AccessFilter{}, "item1", "de", &userID)
+	var apiErr *APIError
+	if !errors.As(err, &apiErr) || apiErr.Status != http.StatusInternalServerError || apiErr.Field != "" {
+		t.Fatalf("err = %v, want a 500 without a field", err)
+	}
+}
+
+// failingPending fails every pending-language read.
+type failingPending struct{}
+
+func (failingPending) PendingTranslationLanguageChecked(context.Context, *models.MediaItem, catalog.AccessFilter) (string, error) {
+	return "", errors.New("database unavailable")
+}
+
+func (failingPending) PendingSeasonTranslationLanguageChecked(context.Context, *models.Season, catalog.AccessFilter) (string, error) {
+	return "", errors.New("database unavailable")
+}
+
+func (failingPending) PendingEpisodeTranslationLanguageChecked(context.Context, *models.Episode, catalog.AccessFilter) (string, error) {
+	return "", errors.New("database unavailable")
+}
+
+// A failed pending-language read is a server error, not "nothing to
+// translate".
+func TestTranslateOnViewReportsAFailedPendingRead(t *testing.T) {
+	userID := 7
+	h := newGuardHandler("", nil)
+	h.Pending = failingPending{}
+	_, err := h.TranslateOnView(context.Background(), catalog.AccessFilter{}, "item1", "de", &userID)
+	var apiErr *APIError
+	if !errors.As(err, &apiErr) || apiErr.Status != http.StatusInternalServerError || apiErr.Field != "" {
+		t.Fatalf("err = %v, want a 500 without a field", err)
+	}
+}
+
+// Fallback preferences from a failed settings read are not checked as the
+// profile's language: the request is refused as retryable without spending
+// budget.
+func TestTranslateOnViewRefusesWhilePreferencesAreDegraded(t *testing.T) {
+	userID := 7
+	limiter := &countingLimiter{}
+	h := newGuardHandler("de", limiter)
+	ctx := access.SetScope(context.Background(), access.Scope{UserID: userID, PreferencesDegraded: true})
+	_, err := h.TranslateOnView(ctx, catalog.AccessFilter{}, "item1", "de", &userID)
+	var apiErr *APIError
+	if !errors.As(err, &apiErr) || apiErr.Status != http.StatusServiceUnavailable || apiErr.RetryAfter == 0 {
+		t.Fatalf("err = %#v, want a retryable 503", err)
+	}
+	if limiter.calls != 0 {
+		t.Fatalf("limiter calls = %d, want none", limiter.calls)
+	}
+}
diff --git a/internal/api/handlers/nodes.go b/internal/api/handlers/nodes.go
index 296186a79b..dcbde475a4 100644
--- a/internal/api/handlers/nodes.go
+++ b/internal/api/handlers/nodes.go
@@ -15,6 +15,7 @@ import (
 	"sync"
 	"time"
 
+	"github.com/prairie-server/prairie-server/internal/nodeauth"
 	"github.com/prairie-server/prairie-server/internal/telemetry"
 
 	"github.com/go-chi/chi/v5"
@@ -64,7 +65,7 @@ type NodeHandler struct {
 	lister            NodeListEnabled
 	eventBus          cache.EventBus
 	redisClient       *redis.Client // for reading session keys
-	jwtSecret         string        // for bearer auth when calling force-reload on nodes
+	jwtSecret         string        // signs calls to nodes (see nodeauth)
 	// capabilities refreshes a node's stored inventory on demand; nil in a
 	// deployment with no health checker, where a re-probe still runs on the node
 	// and the stored row catches up on the next sweep.
@@ -416,7 +417,9 @@ func (h *NodeHandler) reloadNodeConfig(ctx context.Context, node *nodepool.Node)
 	if err != nil {
 		return false
 	}
-	req.Header.Set("Authorization", "Bearer "+h.jwtSecret)
+	if nodeauth.Sign(req, node.URL, h.jwtSecret) != nil {
+		return false
+	}
 	resp, err := telemetry.DoTrustedNode(&http.Client{Timeout: nodeConfigReloadTimeout}, req, "reload")
 	if err != nil {
 		slog.WarnContext(ctx, "node did not reload after an acceleration override change; it will pick it up on its next config poll",
@@ -768,7 +771,7 @@ type nodeReprobeResponse struct {
 	CapabilityHash string `json:"capability_hash"`
 }
 
-// reprobeNode performs the bearer-authenticated re-probe call against one node,
+// reprobeNode performs the signed re-probe call against one node,
 // mirroring the force-reload client.
 func (h *NodeHandler) reprobeNode(ctx context.Context, node *nodepool.Node) (nodeReprobeResponse, error) {
 	timeout := h.nodeReprobeTimeout(node)
@@ -780,7 +783,9 @@ func (h *NodeHandler) reprobeNode(ctx context.Context, node *nodepool.Node) (nod
 	if err != nil {
 		return nodeReprobeResponse{}, err
 	}
-	req.Header.Set("Authorization", "Bearer "+h.jwtSecret)
+	if err := nodeauth.Sign(req, node.URL, h.jwtSecret); err != nil {
+		return nodeReprobeResponse{}, err
+	}
 
 	resp, err := telemetry.DoTrustedNode(client, req, "reprobe")
 	if err != nil {
diff --git a/internal/api/handlers/nodes_reprobe_test.go b/internal/api/handlers/nodes_reprobe_test.go
index eec12c845b..41ee05aa65 100644
--- a/internal/api/handlers/nodes_reprobe_test.go
+++ b/internal/api/handlers/nodes_reprobe_test.go
@@ -1,8 +1,10 @@
 package handlers
 
 import (
+	"bytes"
 	"context"
 	"encoding/json"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -13,6 +15,7 @@ import (
 	"github.com/go-chi/chi/v5"
 
 	"github.com/prairie-server/prairie-server/internal/config"
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 	"github.com/prairie-server/prairie-server/internal/nodepool"
 	"github.com/prairie-server/prairie-server/internal/playback"
 	"github.com/prairie-server/prairie-server/internal/tonemap"
@@ -38,28 +41,30 @@ func reprobeRequest(t *testing.T) *http.Request {
 }
 
 // fakeNodeServer answers the node-side re-probe route with the given status and
-// body, recording the bearer token it was given.
-func fakeNodeServer(t *testing.T, status int, body string) (url string, authorization *string) {
+// body. signedWith reports whether the request it saw was signed with secret.
+func fakeNodeServer(t *testing.T, status int, body string) (url string, signedWith func(secret string) bool) {
 	t.Helper()
-	seen := ""
+	var seen *http.Request
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path != "/admin/reprobe-capabilities" || r.Method != http.MethodPost {
 			w.WriteHeader(http.StatusNotFound)
 			return
 		}
-		seen = r.Header.Get("Authorization")
+		requestBody, _ := io.ReadAll(r.Body)
+		seen = r.Clone(context.WithoutCancel(r.Context()))
+		seen.Body = io.NopCloser(bytes.NewReader(requestBody))
 		w.WriteHeader(status)
 		_, _ = w.Write([]byte(body))
 	}))
 	t.Cleanup(server.Close)
-	return server.URL, &seen
+	return server.URL, func(secret string) bool { return seen != nil && nodeauthtest.Signed(seen, secret) }
 }
 
 // The point of the API-side action is that the operator does not have to wait a
 // sweep interval: the node re-probes, and this server immediately refetches and
 // stores the report so the list, the pools, and the planner agree with it.
 func TestHandleReprobeNodeRefreshesStoredCapabilities(t *testing.T) {
-	url, authorization := fakeNodeServer(t, http.StatusOK,
+	url, signedWith := fakeNodeServer(t, http.StatusOK,
 		`{"resolved":"qsv","capability_hash":"sha256:new"}`)
 	repo := &stubNodeRepository{node: &nodepool.Node{ID: 1, Name: "gpu-1", Type: nodepool.NodeTypeTranscode, URL: url}}
 	refresher := &stubCapabilityRefresher{}
@@ -88,8 +93,8 @@ func TestHandleReprobeNodeRefreshesStoredCapabilities(t *testing.T) {
 	if got := refresher.calls.Load(); got != 1 {
 		t.Fatalf("refresh calls = %d, want exactly one", got)
 	}
-	if *authorization != "Bearer secret" {
-		t.Fatalf("node saw authorization %q, want the bearer secret", *authorization)
+	if !signedWith("secret") {
+		t.Fatal("node request was not signed with the shared secret")
 	}
 }
 
diff --git a/internal/api/handlers/nodes_test.go b/internal/api/handlers/nodes_test.go
index 3e3738f947..b06fde6641 100644
--- a/internal/api/handlers/nodes_test.go
+++ b/internal/api/handlers/nodes_test.go
@@ -15,6 +15,7 @@ import (
 
 	"github.com/prairie-server/prairie-server/internal/cache"
 	"github.com/prairie-server/prairie-server/internal/netaccess"
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 	"github.com/prairie-server/prairie-server/internal/nodepool"
 )
 
@@ -258,12 +259,12 @@ func equalStringPointer(a, b *string) bool {
 // The nudge targets /admin/reload-config, never /admin/force-reload: the latter
 // tears down every live playback session on a transcode node.
 func TestHandleUpdateNodeReloadsTheNodeAfterAnOverrideChange(t *testing.T) {
-	reloaded := make(chan string, 4)
+	reloaded := make(chan bool, 4)
 	var destructive atomic.Bool
 	node := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch r.URL.Path {
 		case "/admin/reload-config":
-			reloaded <- r.Header.Get("Authorization")
+			reloaded <- nodeauthtest.Signed(r, "secret")
 		case "/admin/force-reload":
 			destructive.Store(true)
 		}
@@ -287,9 +288,9 @@ func TestHandleUpdateNodeReloadsTheNodeAfterAnOverrideChange(t *testing.T) {
 		t.Fatalf("status = %d, body = %s", recorder.Code, recorder.Body.String())
 	}
 	select {
-	case authorization := <-reloaded:
-		if authorization != "Bearer secret" {
-			t.Fatalf("node saw authorization %q, want the bearer secret", authorization)
+	case signed := <-reloaded:
+		if !signed {
+			t.Fatal("reload request was not signed with the shared secret")
 		}
 	default:
 		t.Fatal("the node was not asked to reload after its overrides changed")
diff --git a/internal/api/handlers/not_interested.go b/internal/api/handlers/not_interested.go
new file mode 100644
index 0000000000..f90272a925
--- /dev/null
+++ b/internal/api/handlers/not_interested.go
@@ -0,0 +1,115 @@
+package handlers
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/prairie-server/prairie-server/internal/userstore"
+)
+
+// Not interested is a profile's mark on a movie or series it does not want
+// recommended. The mark keeps the title out of the profile's recommendation
+// and discovery rows and ranks similar titles lower there; library browsing,
+// search, item detail, playback and the profile's own lists are unchanged.
+// Only the v2 API serves it.
+
+// ListNotInterestedPage answers at most limit of the profile's marks ordered
+// by (added_at DESC, media_item_id DESC) strictly after the key (nil = from
+// the newest), and the cards of the marked titles the viewer may see, in the
+// same order.
+func (h *PersonalDataHandler) ListNotInterestedPage(ctx context.Context, viewer PersonalListViewer, after *userstore.ListKey, limit int) ([]userstore.NotInterestedEntry, []CollectionItemView, error) {
+	store, err := h.storeProvider.ForUser(ctx, viewer.UserID)
+	if err != nil {
+		return nil, nil, apiError(http.StatusInternalServerError, "internal_error", "Failed to access user store")
+	}
+	entries, err := store.ListNotInterestedPage(ctx, viewer.ProfileID, after, limit)
+	if err != nil {
+		return nil, nil, apiError(http.StatusInternalServerError, "internal_error", "Failed to list Not interested titles")
+	}
+	items, err := resolveItems(h, ctx, viewer, entries, func(e userstore.NotInterestedEntry) string { return e.MediaItemID })
+	if err != nil {
+		return nil, nil, apiError(http.StatusInternalServerError, "internal_error", "Failed to resolve Not interested titles")
+	}
+	return entries, items, nil
+}
+
+// GetNotInterested answers the profile's mark on an item the viewer may see.
+// found is false when the item is not marked; an item the viewer may not see
+// is a 404 error.
+func (h *PersonalDataHandler) GetNotInterested(ctx context.Context, viewer PersonalListViewer, itemID string) (entry userstore.NotInterestedEntry, found bool, err error) {
+	store, err := h.storeProvider.ForUser(ctx, viewer.UserID)
+	if err != nil {
+		return userstore.NotInterestedEntry{}, false, apiError(http.StatusInternalServerError, "internal_error", "Failed to access user store")
+	}
+	if err := h.ensureAccessibleItem(ctx, itemID, viewer.Access); err != nil {
+		return userstore.NotInterestedEntry{}, false, apiError(http.StatusNotFound, "not_found", "Item not found")
+	}
+	mark, err := store.GetNotInterested(ctx, viewer.ProfileID, itemID)
+	if err != nil {
+		return userstore.NotInterestedEntry{}, false, apiError(http.StatusInternalServerError, "internal_error", "Failed to check Not interested")
+	}
+	if mark == nil {
+		return userstore.NotInterestedEntry{}, false, nil
+	}
+	return *mark, true, nil
+}
+
+// MarkNotInterested marks a movie or series the viewer may see. Episodes,
+// seasons and other kinds are refused: recommendations offer movies and
+// series, and a series mark covers its episodes. Marking a marked title
+// succeeds and notifies nobody, so a retry repeats no side effect.
+func (h *PersonalDataHandler) MarkNotInterested(ctx context.Context, viewer PersonalListViewer, itemID string) error {
+	store, err := h.storeProvider.ForUser(ctx, viewer.UserID)
+	if err != nil {
+		return apiError(http.StatusInternalServerError, "internal_error", "Failed to access user store")
+	}
+	if err := h.ensureAccessibleItem(ctx, itemID, viewer.Access); err != nil {
+		return apiError(http.StatusNotFound, "not_found", "Item not found")
+	}
+	if h.itemRepo != nil {
+		item, err := h.itemRepo.GetByID(ctx, itemID)
+		if err != nil || item == nil {
+			return apiError(http.StatusNotFound, "not_found", "Item not found")
+		}
+		if item.Type != itemTypeMovie && item.Type != itemTypeSeries {
+			return apiError(http.StatusUnprocessableEntity, "validation_failed", "Only a movie or series can be marked Not interested")
+		}
+	}
+	marked, err := store.MarkNotInterested(ctx, viewer.ProfileID, itemID)
+	if err != nil {
+		return apiError(http.StatusInternalServerError, "internal_error", "Failed to mark Not interested")
+	}
+	if marked {
+		h.notifyNotInterestedChange(ctx, viewer, itemID, true)
+	}
+	return nil
+}
+
+// UnmarkNotInterested removes the profile's mark. Removing an absent mark
+// succeeds and notifies nobody. No access check runs: the item may have left
+// the viewer's scope since it was marked, and the profile must still be able
+// to clear it.
+func (h *PersonalDataHandler) UnmarkNotInterested(ctx context.Context, viewer PersonalListViewer, itemID string) error {
+	store, err := h.storeProvider.ForUser(ctx, viewer.UserID)
+	if err != nil {
+		return apiError(http.StatusInternalServerError, "internal_error", "Failed to access user store")
+	}
+	unmarked, err := store.UnmarkNotInterested(ctx, viewer.ProfileID, itemID)
+	if err != nil {
+		return apiError(http.StatusInternalServerError, "internal_error", "Failed to clear Not interested")
+	}
+	if unmarked {
+		h.notifyNotInterestedChange(ctx, viewer, itemID, false)
+	}
+	return nil
+}
+
+// notifyNotInterestedChange tells the profile's recommendations, which
+// rebuild its rows, and its clients about a committed mark or unmark. Like
+// notifyListChange it outlives the request.
+func (h *PersonalDataHandler) notifyNotInterestedChange(ctx context.Context, viewer PersonalListViewer, itemID string, marked bool) {
+	ctx, cancel := context.WithTimeout(context.WithoutCancel(ctx), listChangeNoticeTimeout)
+	defer cancel()
+	notifySignalsChanged(ctx, h.signalsNotifier, viewer.UserID, viewer.ProfileID)
+	publishUserStateEvent(ctx, h.EventsHub, viewer.UserID, viewer.ProfileID, itemID, "", "not_interested", userStateEventState{NotInterested: &marked})
+}
diff --git a/internal/api/handlers/not_interested_test.go b/internal/api/handlers/not_interested_test.go
new file mode 100644
index 0000000000..d9a44f2261
--- /dev/null
+++ b/internal/api/handlers/not_interested_test.go
@@ -0,0 +1,104 @@
+package handlers
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/models"
+)
+
+// markItemRepo answers the items it holds; anything else is not found.
+type markItemRepo struct {
+	items map[string]*models.MediaItem
+}
+
+func (r markItemRepo) GetByID(_ context.Context, id string) (*models.MediaItem, error) {
+	if item, ok := r.items[id]; ok {
+		return item, nil
+	}
+	return nil, catalog.ErrItemNotFound
+}
+
+func (r markItemRepo) GetByIDs(_ context.Context, ids []string) ([]*models.MediaItem, error) {
+	var out []*models.MediaItem
+	for _, id := range ids {
+		if item, ok := r.items[id]; ok {
+			out = append(out, item)
+		}
+	}
+	return out, nil
+}
+
+func (r markItemRepo) EnsureAccessible(_ context.Context, id string, _ catalog.AccessFilter) error {
+	if _, ok := r.items[id]; ok {
+		return nil
+	}
+	return catalog.ErrItemNotFound
+}
+
+func (r markItemRepo) EnsureAccessibleIDs(ctx context.Context, ids []string, filter catalog.AccessFilter) (map[string]bool, error) {
+	out := make(map[string]bool, len(ids))
+	for _, id := range ids {
+		out[id] = r.EnsureAccessible(ctx, id, filter) == nil
+	}
+	return out, nil
+}
+
+// Marking takes movies and series only, and tells recommendations once per
+// change: a repeated mark or unmark changes nothing and notifies nobody.
+func TestMarkNotInterested(t *testing.T) {
+	store := newHouseholdTestStore(t)
+	h := NewPersonalDataHandler(testUserStoreProvider{store: store}, markItemRepo{items: map[string]*models.MediaItem{
+		"movie:heat":      {ContentID: "movie:heat", Type: "movie"},
+		"series:show":     {ContentID: "series:show", Type: "series"},
+		"season:show-1":   {ContentID: "season:show-1", Type: "season"},
+		"audiobook:dune":  {ContentID: "audiobook:dune", Type: "audiobook"},
+		"episode:show-11": {ContentID: "episode:show-11", Type: "episode"},
+	}})
+	notifier := &countingSignalsNotifier{}
+	h.SetSignalsChangedNotifier(notifier)
+	viewer := PersonalListViewer{UserID: 1, ProfileID: "p1"}
+	ctx := context.Background()
+
+	for _, id := range []string{"movie:heat", "series:show"} {
+		for range 2 {
+			if err := h.MarkNotInterested(ctx, viewer, id); err != nil {
+				t.Fatalf("mark %s: %v", id, err)
+			}
+		}
+	}
+	if notifier.calls != 2 {
+		t.Fatalf("notifications = %d, want one per new mark", notifier.calls)
+	}
+	for _, id := range []string{"season:show-1", "audiobook:dune", "episode:show-11"} {
+		var apiErr *APIError
+		if err := h.MarkNotInterested(ctx, viewer, id); !errors.As(err, &apiErr) || apiErr.Status != http.StatusUnprocessableEntity {
+			t.Fatalf("mark %s = %v, want 422", id, err)
+		}
+	}
+	var apiErr *APIError
+	if err := h.MarkNotInterested(ctx, viewer, "movie:missing"); !errors.As(err, &apiErr) || apiErr.Status != http.StatusNotFound {
+		t.Fatalf("mark of an unknown item = %v, want 404", err)
+	}
+
+	entry, found, err := h.GetNotInterested(ctx, viewer, "movie:heat")
+	if err != nil || !found || entry.MediaItemID != "movie:heat" {
+		t.Fatalf("get = %+v, %v, %v", entry, found, err)
+	}
+	// Another profile on the account has no marks.
+	if _, found, _ := h.GetNotInterested(ctx, PersonalListViewer{UserID: 1, ProfileID: "p2"}, "movie:heat"); found {
+		t.Fatal("another profile sees p1's mark")
+	}
+
+	for range 2 {
+		if err := h.UnmarkNotInterested(ctx, viewer, "movie:heat"); err != nil {
+			t.Fatalf("unmark: %v", err)
+		}
+	}
+	if notifier.calls != 3 {
+		t.Fatalf("notifications = %d after unmark, want 3", notifier.calls)
+	}
+}
diff --git a/internal/api/handlers/notification_destination_service.go b/internal/api/handlers/notification_destination_service.go
index 251827910a..d8712af4cc 100644
--- a/internal/api/handlers/notification_destination_service.go
+++ b/internal/api/handlers/notification_destination_service.go
@@ -6,19 +6,19 @@ import (
 	"github.com/prairie-server/prairie-server/internal/notifications"
 )
 
-func (h *NotificationsHandler) ListNotificationWebPushPage(ctx context.Context, profile string, limit int, after *notifications.Cursor) ([]notifications.WebPushSubscription, error) {
+func (h *NotificationsHandler) ListNotificationWebPushPage(ctx context.Context, user int, profile string, limit int, after *notifications.Cursor) ([]notifications.WebPushSubscription, error) {
 	svc := h.webPush()
 	if svc == nil {
 		return nil, apiError(503, "unavailable", "Web push is not available")
 	}
-	return svc.ListPage(ctx, profile, limit, after)
+	return svc.ListPage(ctx, user, profile, limit, after)
 }
-func (h *NotificationsHandler) ListNotificationWebhookPage(ctx context.Context, profile string, limit int, after *notifications.Cursor) ([]notifications.Webhook, error) {
+func (h *NotificationsHandler) ListNotificationWebhookPage(ctx context.Context, user int, profile string, limit int, after *notifications.Cursor) ([]notifications.Webhook, error) {
 	svc := h.webhooks()
 	if svc == nil {
 		return nil, apiError(503, "unavailable", "Webhooks are not available")
 	}
-	return svc.ListPage(ctx, profile, limit, after)
+	return svc.ListPage(ctx, user, profile, limit, after)
 }
 func (h *NotificationsHandler) ListNotificationServerChannelPage(ctx context.Context, limit int, after *notifications.Cursor) ([]notifications.ServerChannel, error) {
 	if h == nil || h.system == nil || h.system.ServerChannels == nil {
@@ -27,12 +27,12 @@ func (h *NotificationsHandler) ListNotificationServerChannelPage(ctx context.Con
 	return h.system.ServerChannels.ListPage(ctx, limit, after)
 }
 
-func (h *NotificationsHandler) TestNotificationWebhook(ctx context.Context, profile, id string) (*notifications.WebhookTestResult, error) {
+func (h *NotificationsHandler) TestNotificationWebhook(ctx context.Context, user int, profile, id string) (*notifications.WebhookTestResult, error) {
 	svc := h.webhooks()
 	if svc == nil {
 		return nil, apiError(503, "unavailable", "Webhooks are not available")
 	}
-	return svc.Test(ctx, profile, id)
+	return svc.Test(ctx, user, profile, id)
 }
 func (h *NotificationsHandler) TestNotificationServerChannel(ctx context.Context, id string) (*notifications.WebhookTestResult, error) {
 	if h == nil || h.system == nil || h.system.ServerChannels == nil {
@@ -79,12 +79,12 @@ func (h *NotificationsHandler) SubscribeNotificationWebPush(ctx context.Context,
 	return svc.Subscribe(ctx, user, profile, endpoint, p256dh, auth, deviceName)
 }
 
-func (h *NotificationsHandler) DeleteNotificationWebhook(ctx context.Context, profile, id string, check func(int64) error) error {
+func (h *NotificationsHandler) DeleteNotificationWebhook(ctx context.Context, user int, profile, id string, check func(int64) error) error {
 	svc := h.webhooks()
 	if svc == nil {
 		return apiError(503, "unavailable", "Webhooks are not available")
 	}
-	return svc.DeleteGuarded(ctx, profile, id, check)
+	return svc.DeleteGuarded(ctx, user, profile, id, check)
 }
 
 func (h *NotificationsHandler) DeleteNotificationServerChannel(ctx context.Context, id string) error {
@@ -94,20 +94,20 @@ func (h *NotificationsHandler) DeleteNotificationServerChannel(ctx context.Conte
 	return h.system.ServerChannels.Delete(ctx, id)
 }
 
-func (h *NotificationsHandler) RotateNotificationWebhookSecret(ctx context.Context, profile, id string) (string, error) {
+func (h *NotificationsHandler) RotateNotificationWebhookSecret(ctx context.Context, user int, profile, id string) (string, error) {
 	svc := h.webhooks()
 	if svc == nil {
 		return "", apiError(503, "unavailable", "Webhooks are not available")
 	}
-	return svc.RotateSecretV2(ctx, profile, id)
+	return svc.RotateSecretV2(ctx, user, profile, id)
 }
 
-func (h *NotificationsHandler) UpdateNotificationWebhook(ctx context.Context, profile, id string, input notifications.WebhookInput, check func(int64) error) (*notifications.Webhook, error) {
+func (h *NotificationsHandler) UpdateNotificationWebhook(ctx context.Context, user int, profile, id string, input notifications.WebhookInput, check func(int64) error) (*notifications.Webhook, error) {
 	svc := h.webhooks()
 	if svc == nil {
 		return nil, apiError(503, "unavailable", "Webhooks are not available")
 	}
-	return svc.UpdateGuarded(ctx, profile, id, input, check)
+	return svc.UpdateGuarded(ctx, user, profile, id, input, check)
 }
 
 func (h *NotificationsHandler) RotateNotificationServerChannelSecret(ctx context.Context, id string) (string, error) {
diff --git a/internal/api/handlers/notification_inbox_service.go b/internal/api/handlers/notification_inbox_service.go
index 5a18350a5e..8c90d86f6c 100644
--- a/internal/api/handlers/notification_inbox_service.go
+++ b/internal/api/handlers/notification_inbox_service.go
@@ -2,6 +2,8 @@ package handlers
 
 import (
 	"context"
+	"errors"
+	"net/http"
 	"time"
 
 	evt "github.com/prairie-server/prairie-server/internal/events"
@@ -14,31 +16,31 @@ type NotificationInboxPageView struct {
 	More    bool
 }
 
-func (h *NotificationsHandler) ListNotificationInbox(ctx context.Context, profile string, unread bool, limit int, before, through *notifications.Cursor) (NotificationInboxPageView, error) {
+func (h *NotificationsHandler) ListNotificationInbox(ctx context.Context, userID int, profile string, unread bool, limit int, before, through *notifications.Cursor) (NotificationInboxPageView, error) {
 	var boundary notifications.Cursor
 	var err error
 	if through == nil {
-		boundary, err = h.system.Deliveries.InboxCutoff(ctx, profile)
+		boundary, err = h.system.Deliveries.InboxCutoff(ctx, userID, profile)
 		if err != nil {
 			return NotificationInboxPageView{}, err
 		}
 	} else {
 		boundary = *through
 	}
-	rows, more, err := h.system.Deliveries.ListInboxWindow(ctx, profile, unread, limit, before, boundary)
+	rows, more, err := h.system.Deliveries.ListInboxWindow(ctx, userID, profile, unread, limit, before, boundary)
 	if err != nil {
 		return NotificationInboxPageView{}, err
 	}
 	return NotificationInboxPageView{Items: h.system.PayloadsForRows(ctx, rows), Through: boundary, More: more}, nil
 }
-func (h *NotificationsHandler) SyncNotificationInbox(ctx context.Context, profile string, limit int, since *notifications.Cursor) ([]notifications.DeliveryRowPayload, bool, int, error) {
+func (h *NotificationsHandler) SyncNotificationInbox(ctx context.Context, userID int, profile string, limit int, since *notifications.Cursor) ([]notifications.DeliveryRowPayload, bool, int, error) {
 	// Initial sync is the existing bounded newest snapshot, returned ascending.
 	// A saved cursor subsequently advances through every newer delivery.
 	requested := limit
 	if since != nil {
 		requested++
 	}
-	rows, err := h.system.Deliveries.ListSync(ctx, profile, since, requested)
+	rows, err := h.system.Deliveries.ListSync(ctx, userID, profile, since, requested)
 	if err != nil {
 		return nil, false, 0, err
 	}
@@ -46,14 +48,14 @@ func (h *NotificationsHandler) SyncNotificationInbox(ctx context.Context, profil
 	if more {
 		rows = rows[:limit]
 	}
-	count, err := h.system.Deliveries.UnreadCount(ctx, profile)
+	count, err := h.system.Deliveries.UnreadCount(ctx, userID, profile)
 	if err != nil {
 		return nil, false, 0, err
 	}
 	return h.system.PayloadsForRows(ctx, rows), more, count, nil
 }
-func (h *NotificationsHandler) GetNotificationInboxItem(ctx context.Context, profile, id string) (notifications.DeliveryRowPayload, error) {
-	row, err := h.system.Deliveries.GetByID(ctx, profile, id)
+func (h *NotificationsHandler) GetNotificationInboxItem(ctx context.Context, userID int, profile, id string) (notifications.DeliveryRowPayload, error) {
+	row, err := h.system.Deliveries.GetByID(ctx, userID, profile, id)
 	if err != nil {
 		return notifications.DeliveryRowPayload{}, err
 	}
@@ -62,16 +64,16 @@ func (h *NotificationsHandler) GetNotificationInboxItem(ctx context.Context, pro
 	}
 	return h.system.PayloadForRow(ctx, *row), nil
 }
-func (h *NotificationsHandler) NotificationUnreadCount(ctx context.Context, profile string) (int, error) {
-	return h.system.Deliveries.UnreadCount(ctx, profile)
+func (h *NotificationsHandler) NotificationUnreadCount(ctx context.Context, userID int, profile string) (int, error) {
+	return h.system.Deliveries.UnreadCount(ctx, userID, profile)
 }
 func (h *NotificationsHandler) MarkNotificationRead(ctx context.Context, userID int, profile, id string) error {
-	changed, err := h.system.Deliveries.MarkRead(ctx, profile, id)
+	changed, err := h.system.Deliveries.MarkRead(ctx, userID, profile, id)
 	if err != nil {
 		return err
 	}
 	if !changed {
-		exists, err := h.system.Deliveries.Exists(ctx, profile, id)
+		exists, err := h.system.Deliveries.Exists(ctx, userID, profile, id)
 		if err != nil {
 			return err
 		}
@@ -85,7 +87,7 @@ func (h *NotificationsHandler) MarkNotificationRead(ctx context.Context, userID
 	return nil
 }
 func (h *NotificationsHandler) MarkNotificationInboxThrough(ctx context.Context, userID int, profile string, through notifications.Cursor) error {
-	changed, err := h.system.Deliveries.MarkReadThrough(ctx, profile, through)
+	changed, err := h.system.Deliveries.MarkReadThrough(ctx, userID, profile, through)
 	if err != nil {
 		return err
 	}
@@ -94,17 +96,38 @@ func (h *NotificationsHandler) MarkNotificationInboxThrough(ctx context.Context,
 	}
 	return nil
 }
-func (h *NotificationsHandler) NotificationPreferences(ctx context.Context, profile string) (notifications.Preferences, error) {
-	return h.system.Preferences.Get(ctx, profile)
+func (h *NotificationsHandler) NotificationPreferences(ctx context.Context, userID int, profile string) (notifications.Preferences, error) {
+	return h.system.Preferences.Get(ctx, userID, profile)
 }
-func (h *NotificationsHandler) PatchNotificationPreferences(ctx context.Context, profile string, patch notifications.PreferencePatch) (notifications.Preferences, error) {
-	return h.system.Preferences.Patch(ctx, profile, patch)
+func (h *NotificationsHandler) PatchNotificationPreferences(ctx context.Context, userID int, profile string, patch notifications.PreferencePatch) (notifications.Preferences, error) {
+	return h.system.Preferences.Patch(ctx, userID, profile, patch)
+}
+
+// ListNotifiedSeries answers every series whose new episodes the profile has
+// a reason to hear about, before catalog access filtering.
+func (h *NotificationsHandler) ListNotifiedSeries(ctx context.Context, userID int, profile string) ([]notifications.NotifiedSeries, error) {
+	return h.system.ListNotifiedSeries(ctx, userID, profile)
+}
+
+// MuteNotificationSeries mutes the series for the profile. The caller has
+// checked that the viewer may see the item; an ID that names no series is 404.
+func (h *NotificationsHandler) MuteNotificationSeries(ctx context.Context, userID int, profile, seriesID string) error {
+	err := h.system.MuteSeries(ctx, userID, profile, seriesID)
+	if errors.Is(err, notifications.ErrSeriesNotFound) {
+		return apiError(http.StatusNotFound, "not_found", "Series not found")
+	}
+	return err
+}
+
+// UnmuteNotificationSeries lifts the profile's mute of the series.
+func (h *NotificationsHandler) UnmuteNotificationSeries(ctx context.Context, userID int, profile, seriesID string) error {
+	return h.system.UnmuteSeries(ctx, userID, profile, seriesID)
 }
 
 // NotificationPushDisplay uses the same profile-scoped row and rendering as the
 // bridge notification extension endpoint without hydrating unrelated inbox data.
-func (h *NotificationsHandler) NotificationPushDisplay(ctx context.Context, profile, id string) (notifications.NotificationDisplay, error) {
-	row, err := h.system.Deliveries.GetByID(ctx, profile, id)
+func (h *NotificationsHandler) NotificationPushDisplay(ctx context.Context, userID int, profile, id string) (notifications.NotificationDisplay, error) {
+	row, err := h.system.Deliveries.GetByID(ctx, userID, profile, id)
 	if err != nil {
 		return notifications.NotificationDisplay{}, err
 	}
diff --git a/internal/api/handlers/notifications.go b/internal/api/handlers/notifications.go
index 3c7e603954..23266c712f 100644
--- a/internal/api/handlers/notifications.go
+++ b/internal/api/handlers/notifications.go
@@ -90,6 +90,7 @@ func parseNotificationsLimit(r *http.Request, fallback int) int {
 
 // HandleList handles GET /notifications (newest-first inbox page).
 func (h *NotificationsHandler) HandleList(w http.ResponseWriter, r *http.Request) {
+	userID := apimw.GetUserID(r.Context())
 	profileID := apimw.GetProfileID(r.Context())
 	unreadOnly := r.URL.Query().Get("status") == "unread"
 	limit := parseNotificationsLimit(r, notificationsDefaultLimit)
@@ -104,7 +105,7 @@ func (h *NotificationsHandler) HandleList(w http.ResponseWriter, r *http.Request
 		before = &cursor
 	}
 
-	rows, err := h.system.Deliveries.ListInbox(r.Context(), profileID, unreadOnly, limit, before)
+	rows, err := h.system.Deliveries.ListInbox(r.Context(), userID, profileID, unreadOnly, limit, before)
 	if err != nil {
 		writeError(w, http.StatusInternalServerError, "internal_error", "Failed to list notifications")
 		return
@@ -120,6 +121,7 @@ func (h *NotificationsHandler) HandleList(w http.ResponseWriter, r *http.Request
 // HandleSync handles GET /notifications/sync — the forward (ascending) cursor
 // sync used by clients waking from a push or reconnecting after a gap.
 func (h *NotificationsHandler) HandleSync(w http.ResponseWriter, r *http.Request) {
+	userID := apimw.GetUserID(r.Context())
 	profileID := apimw.GetProfileID(r.Context())
 	limit := parseNotificationsLimit(r, notificationsSyncLimit)
 
@@ -133,12 +135,12 @@ func (h *NotificationsHandler) HandleSync(w http.ResponseWriter, r *http.Request
 		since = &cursor
 	}
 
-	rows, err := h.system.Deliveries.ListSync(r.Context(), profileID, since, limit)
+	rows, err := h.system.Deliveries.ListSync(r.Context(), userID, profileID, since, limit)
 	if err != nil {
 		writeError(w, http.StatusInternalServerError, "internal_error", "Failed to sync notifications")
 		return
 	}
-	unread, err := h.system.Deliveries.UnreadCount(r.Context(), profileID)
+	unread, err := h.system.Deliveries.UnreadCount(r.Context(), userID, profileID)
 	if err != nil {
 		writeError(w, http.StatusInternalServerError, "internal_error", "Failed to count unread notifications")
 		return
@@ -159,10 +161,11 @@ func (h *NotificationsHandler) HandleSync(w http.ResponseWriter, r *http.Request
 
 // HandleGet handles GET /notifications/{id}; 404 for other profiles' rows.
 func (h *NotificationsHandler) HandleGet(w http.ResponseWriter, r *http.Request) {
+	userID := apimw.GetUserID(r.Context())
 	profileID := apimw.GetProfileID(r.Context())
 	id := chi.URLParam(r, "id")
 
-	row, err := h.system.Deliveries.GetByID(r.Context(), profileID, id)
+	row, err := h.system.Deliveries.GetByID(r.Context(), userID, profileID, id)
 	if err != nil {
 		writeError(w, http.StatusInternalServerError, "internal_error", "Failed to load notification")
 		return
@@ -179,13 +182,14 @@ func (h *NotificationsHandler) HandleGet(w http.ResponseWriter, r *http.Request)
 // enrichment, scoped to the active profile.
 func (h *NotificationsHandler) HandleApplePushDisplay(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Cache-Control", "no-store")
+	userID := apimw.GetUserID(r.Context())
 	profileID := apimw.GetProfileID(r.Context())
 	id := chi.URLParam(r, "delivery_id")
 	if id == "" {
 		writeError(w, http.StatusNotFound, "not_found", "Notification not found")
 		return
 	}
-	row, err := h.system.Deliveries.GetByID(r.Context(), profileID, id)
+	row, err := h.system.Deliveries.GetByID(r.Context(), userID, profileID, id)
 	if err != nil {
 		writeError(w, http.StatusInternalServerError, "internal_error", "Failed to load notification")
 		return
@@ -199,8 +203,9 @@ func (h *NotificationsHandler) HandleApplePushDisplay(w http.ResponseWriter, r *
 
 // HandleUnreadCount handles GET /notifications/unread-count.
 func (h *NotificationsHandler) HandleUnreadCount(w http.ResponseWriter, r *http.Request) {
+	userID := apimw.GetUserID(r.Context())
 	profileID := apimw.GetProfileID(r.Context())
-	count, err := h.system.Deliveries.UnreadCount(r.Context(), profileID)
+	count, err := h.system.Deliveries.UnreadCount(r.Context(), userID, profileID)
 	if err != nil {
 		writeError(w, http.StatusInternalServerError, "internal_error", "Failed to count unread notifications")
 		return
@@ -214,14 +219,14 @@ func (h *NotificationsHandler) HandleMarkRead(w http.ResponseWriter, r *http.Req
 	profileID := apimw.GetProfileID(r.Context())
 	id := chi.URLParam(r, "id")
 
-	transitioned, err := h.system.Deliveries.MarkRead(r.Context(), profileID, id)
+	transitioned, err := h.system.Deliveries.MarkRead(r.Context(), userID, profileID, id)
 	if err != nil {
 		writeError(w, http.StatusInternalServerError, "internal_error", "Failed to mark notification read")
 		return
 	}
 	if !transitioned {
 		// Already read is fine (idempotent); unknown IDs are a 404.
-		exists, err := h.system.Deliveries.Exists(r.Context(), profileID, id)
+		exists, err := h.system.Deliveries.Exists(r.Context(), userID, profileID, id)
 		if err != nil {
 			writeError(w, http.StatusInternalServerError, "internal_error", "Failed to mark notification read")
 			return
@@ -242,7 +247,7 @@ func (h *NotificationsHandler) HandleReadAll(w http.ResponseWriter, r *http.Requ
 	userID := apimw.GetUserID(r.Context())
 	profileID := apimw.GetProfileID(r.Context())
 
-	if _, err := h.system.Deliveries.MarkAllRead(r.Context(), profileID); err != nil {
+	if _, err := h.system.Deliveries.MarkAllRead(r.Context(), userID, profileID); err != nil {
 		writeError(w, http.StatusInternalServerError, "internal_error", "Failed to mark notifications read")
 		return
 	}
@@ -268,8 +273,9 @@ func (h *NotificationsHandler) publishReadEvent(r *http.Request, userID int, pro
 
 // HandleGetPreferences handles GET /notifications/preferences.
 func (h *NotificationsHandler) HandleGetPreferences(w http.ResponseWriter, r *http.Request) {
+	userID := apimw.GetUserID(r.Context())
 	profileID := apimw.GetProfileID(r.Context())
-	prefs, err := h.system.Preferences.Get(r.Context(), profileID)
+	prefs, err := h.system.Preferences.Get(r.Context(), userID, profileID)
 	if err != nil {
 		writeError(w, http.StatusInternalServerError, "internal_error", "Failed to load notification preferences")
 		return
@@ -288,6 +294,7 @@ type updatePreferencesRequest struct {
 // HandleUpdatePreferences handles PUT /notifications/preferences. Fields are
 // optional; omitted fields keep their current value. Idempotent.
 func (h *NotificationsHandler) HandleUpdatePreferences(w http.ResponseWriter, r *http.Request) {
+	userID := apimw.GetUserID(r.Context())
 	profileID := apimw.GetProfileID(r.Context())
 
 	var req updatePreferencesRequest
@@ -296,7 +303,7 @@ func (h *NotificationsHandler) HandleUpdatePreferences(w http.ResponseWriter, r
 		return
 	}
 
-	prefs, err := h.system.Preferences.Patch(r.Context(), profileID, notifications.PreferencePatch{Enabled: req.Enabled, NotifyFavorites: req.NotifyFavorites, NotifyWatchlist: req.NotifyWatchlist, NotifyContinueWatching: req.NotifyContinueWatching, NotifyNextUp: req.NotifyNextUp})
+	prefs, err := h.system.Preferences.Patch(r.Context(), userID, profileID, notifications.PreferencePatch{Enabled: req.Enabled, NotifyFavorites: req.NotifyFavorites, NotifyWatchlist: req.NotifyWatchlist, NotifyContinueWatching: req.NotifyContinueWatching, NotifyNextUp: req.NotifyNextUp})
 	if err != nil {
 		writeError(w, http.StatusInternalServerError, "internal_error", "Failed to save notification preferences")
 		return
@@ -437,12 +444,14 @@ func (h *NotificationsHandler) NotificationCapabilities(ctx context.Context) Not
 // HandleMintWSTicket handles POST /events/ws-ticket: mints a short-lived
 // single-use websocket handshake ticket bound to (user, profile). Long-lived
 // tokens must never ride the websocket query string — reverse-proxy access
-// logs capture it.
+// logs capture it. The profile's PIN proof stays server-side with the ticket,
+// so the socket can recheck it after the PIN changes.
 func (h *NotificationsHandler) HandleMintWSTicket(w http.ResponseWriter, r *http.Request) {
-	userID := apimw.GetUserID(r.Context())
-	profileID := apimw.GetProfileID(r.Context())
-
-	ticket, ttl, err := h.system.Tickets.Mint(r.Context(), userID, profileID)
+	ticket, ttl, err := h.system.Tickets.Mint(r.Context(), notifications.Ticket{
+		UserID:       apimw.GetUserID(r.Context()),
+		ProfileID:    apimw.GetProfileID(r.Context()),
+		ProfileToken: r.Header.Get("X-Profile-Token"),
+	})
 	if err != nil {
 		writeError(w, http.StatusInternalServerError, "internal_error", "Failed to mint websocket ticket")
 		return
diff --git a/internal/api/handlers/notifications_apple_display_test.go b/internal/api/handlers/notifications_apple_display_test.go
index 585c02abb3..e3174c7a64 100644
--- a/internal/api/handlers/notifications_apple_display_test.go
+++ b/internal/api/handlers/notifications_apple_display_test.go
@@ -12,6 +12,7 @@ import (
 	"github.com/jackc/pgx/v5/pgxpool"
 
 	apimw "github.com/prairie-server/prairie-server/internal/api/middleware"
+	"github.com/prairie-server/prairie-server/internal/auth"
 	"github.com/prairie-server/prairie-server/internal/envutil"
 	"github.com/prairie-server/prairie-server/internal/notifications"
 )
@@ -95,8 +96,12 @@ func TestHandleApplePushDisplayDB(t *testing.T) {
 	router := chi.NewRouter()
 	router.Get("/notifications/push/apple/display/{delivery_id}", handler.HandleApplePushDisplay)
 
-	req := httptest.NewRequest(http.MethodGet, "/notifications/push/apple/display/delivery-1", nil)
-	req = req.WithContext(apimw.SetProfileID(req.Context(), "profile-1"))
+	asProfile := func(userID int, profileID string) *http.Request {
+		req := httptest.NewRequest(http.MethodGet, "/notifications/push/apple/display/delivery-1", nil)
+		ctx := apimw.SetClaims(req.Context(), &auth.Claims{UserID: userID})
+		return req.WithContext(apimw.SetProfileID(ctx, profileID))
+	}
+	req := asProfile(42, "profile-1")
 	rr := httptest.NewRecorder()
 	router.ServeHTTP(rr, req)
 
@@ -111,28 +116,35 @@ func TestHandleApplePushDisplayDB(t *testing.T) {
 		t.Fatalf("decode response: %v", err)
 	}
 	if response.DeliveryID != "delivery-1" ||
-		response.Title != "The latest episode of Severance S02E01 just dropped!" ||
-		response.Body != "Hello, Ms. Cobel" ||
+		response.Title != "Severance" ||
+		response.Body != "New episode · S02E01 · Hello, Ms. Cobel" ||
 		response.ThreadID != "series:series-1" ||
 		response.Category != "episode_available" ||
 		response.URL != "/item/episode-1" {
 		t.Fatalf("response = %+v", response)
 	}
 
-	view, err := handler.NotificationPushDisplay(t.Context(), "profile-1", "delivery-1")
+	view, err := handler.NotificationPushDisplay(t.Context(), 42, "profile-1", "delivery-1")
 	if err != nil || view != response {
 		t.Fatalf("v2 service differs from bridge: %+v, %v", view, err)
 	}
-	if _, err := handler.NotificationPushDisplay(t.Context(), "other-profile", "delivery-1"); err == nil {
+	if _, err := handler.NotificationPushDisplay(t.Context(), 42, "other-profile", "delivery-1"); err == nil {
 		t.Fatal("v2 display admitted another profile")
 	}
+	// A profile with the same ID on another account does not see the row.
+	if _, err := handler.NotificationPushDisplay(t.Context(), 7, "profile-1", "delivery-1"); err == nil {
+		t.Fatal("v2 display admitted another account's profile")
+	}
 
-	req = httptest.NewRequest(http.MethodGet, "/notifications/push/apple/display/delivery-1", nil)
-	req = req.WithContext(apimw.SetProfileID(req.Context(), "other-profile"))
-	rr = httptest.NewRecorder()
-	router.ServeHTTP(rr, req)
-	if rr.Code != http.StatusNotFound {
-		t.Fatalf("cross-profile status = %d, body = %s", rr.Code, rr.Body.String())
+	for _, viewer := range []struct {
+		userID  int
+		profile string
+	}{{42, "other-profile"}, {7, "profile-1"}} {
+		rr = httptest.NewRecorder()
+		router.ServeHTTP(rr, asProfile(viewer.userID, viewer.profile))
+		if rr.Code != http.StatusNotFound {
+			t.Fatalf("display for %d/%s status = %d, body = %s", viewer.userID, viewer.profile, rr.Code, rr.Body.String())
+		}
 	}
 	if got := rr.Header().Get("Cache-Control"); got != "no-store" {
 		t.Fatalf("cross-profile Cache-Control = %q", got)
diff --git a/internal/api/handlers/notifications_apple_push_v2.go b/internal/api/handlers/notifications_apple_push_v2.go
index 00b40c3da9..d7686c481c 100644
--- a/internal/api/handlers/notifications_apple_push_v2.go
+++ b/internal/api/handlers/notifications_apple_push_v2.go
@@ -22,11 +22,11 @@ type OrderedApplePushV2 struct {
 	issuer   ApplePushDisplayTokenIssuer
 }
 
-func NewOrderedApplePushV2(store *notifications.PushDeviceService, issuer ApplePushDisplayTokenIssuer, sessions eventsSessionValidator, users access.UserRepository, resolver apimw.ViewerResolver, primary apimw.PrimaryProfileChecker) *OrderedApplePushV2 {
+func NewOrderedApplePushV2(store *notifications.PushDeviceService, issuer ApplePushDisplayTokenIssuer, sessions eventsSessionValidator, users access.UserRepository, resolver apimw.ViewerResolver, actingAdmin apimw.ActingAdminDecider) *OrderedApplePushV2 {
 	if jwt, ok := issuer.(*auth.JWTService); ok && jwt == nil {
 		issuer = nil
 	}
-	return &OrderedApplePushV2{store: store, issuer: issuer, validate: newSocketAuthorityValidator(sessions, users, resolver, primary)}
+	return &OrderedApplePushV2{store: store, issuer: issuer, validate: newSocketAuthorityValidator(sessions, users, resolver, actingAdmin)}
 }
 func (h *OrderedApplePushV2) OrderedApplePushAvailable() bool {
 	return h != nil && h.store != nil && h.store.OrderedAppleAvailable() && h.validate != nil && h.issuer != nil
diff --git a/internal/api/handlers/notifications_apple_push_v2_test.go b/internal/api/handlers/notifications_apple_push_v2_test.go
index 159afcc8a4..90b8c9800f 100644
--- a/internal/api/handlers/notifications_apple_push_v2_test.go
+++ b/internal/api/handlers/notifications_apple_push_v2_test.go
@@ -7,6 +7,7 @@ import (
 	"time"
 
 	"github.com/prairie-server/prairie-server/internal/access"
+	apimw "github.com/prairie-server/prairie-server/internal/api/middleware"
 	evt "github.com/prairie-server/prairie-server/internal/events"
 	"github.com/prairie-server/prairie-server/internal/models"
 	"github.com/prairie-server/prairie-server/internal/notifications"
@@ -57,7 +58,7 @@ func TestOrderedAppleDisplayRenewalAndAuthority(t *testing.T) {
 			users := &socketUserFixture{user: models.User{ID: 7, Enabled: true, Role: "user"}}
 			sessions := &socketSessionFixture{valid: true, account: users}
 			viewer := &socketViewerFixture{scope: access.Scope{UserID: 7, ProfileID: "profile", ProfileVerified: true, PolicyRevision: 1}}
-			h := NewOrderedApplePushV2(notifications.NewPushDeviceService(store, handlerPushCipher(t)), issuer, sessions, users, viewer, func(context.Context, int, string) (bool, bool, error) { return false, true, nil })
+			h := NewOrderedApplePushV2(notifications.NewPushDeviceService(store, handlerPushCipher(t)), issuer, sessions, users, viewer, apimw.NewActingAdminDecider(func(context.Context, int, string) (bool, bool, error) { return false, true, nil }, nil))
 			cmd := notifications.ApplePushCommand{UserID: 7, ProfileID: "profile", Generation: 1}
 			identity := evt.SocketIdentity{UserID: 7, ProfileID: "profile", SessionID: "session", Role: "user", ProfileToken: "original-pin", AccessExpiresAt: time.Now().Add(time.Minute)}
 			wantErr, wantMint := false, true
diff --git a/internal/api/handlers/notifications_push_devices.go b/internal/api/handlers/notifications_push_devices.go
index 50314ef3e3..1a0c08633e 100644
--- a/internal/api/handlers/notifications_push_devices.go
+++ b/internal/api/handlers/notifications_push_devices.go
@@ -162,7 +162,7 @@ func (h *NotificationsHandler) HandleUnregisterPushDevice(w http.ResponseWriter,
 		writeError(w, http.StatusServiceUnavailable, "unavailable", "Push registration is not available")
 		return
 	}
-	err := service.Unregister(r.Context(), apimw.GetProfileID(r.Context()), chi.URLParam(r, "device_id"))
+	err := service.Unregister(r.Context(), apimw.GetUserID(r.Context()), apimw.GetProfileID(r.Context()), chi.URLParam(r, "device_id"))
 	if err != nil {
 		switch {
 		case errors.Is(err, notifications.ErrPushLegacyWriter):
diff --git a/internal/api/handlers/notifications_push_devices_test.go b/internal/api/handlers/notifications_push_devices_test.go
index 5f683959e5..45a84ebb59 100644
--- a/internal/api/handlers/notifications_push_devices_test.go
+++ b/internal/api/handlers/notifications_push_devices_test.go
@@ -3,6 +3,7 @@ package handlers
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -59,8 +60,8 @@ func (f *handlerPushStore) UpsertFCM(ctx context.Context, registration notificat
 	}, nil
 }
 
-func (f *handlerPushStore) DeleteByProfileDevice(ctx context.Context, profileID, deviceID string) error {
-	f.deleted = append(f.deleted, profileID+"/"+deviceID)
+func (f *handlerPushStore) DeleteByProfileDevice(ctx context.Context, userID int, profileID, deviceID string) error {
+	f.deleted = append(f.deleted, fmt.Sprintf("%d/%s/%s", userID, profileID, deviceID))
 	return f.err
 }
 
diff --git a/internal/api/handlers/notifications_webhooks.go b/internal/api/handlers/notifications_webhooks.go
index 148bc82f8f..46fdb69f7c 100644
--- a/internal/api/handlers/notifications_webhooks.go
+++ b/internal/api/handlers/notifications_webhooks.go
@@ -112,8 +112,7 @@ func (h *NotificationsHandler) HandleListWebhooks(w http.ResponseWriter, r *http
 		writeError(w, http.StatusServiceUnavailable, "unavailable", "Webhooks are not available")
 		return
 	}
-	profileID := apimw.GetProfileID(r.Context())
-	hooks, err := service.List(r.Context(), profileID)
+	hooks, err := service.List(r.Context(), apimw.GetUserID(r.Context()), apimw.GetProfileID(r.Context()))
 	if err != nil {
 		writeError(w, http.StatusInternalServerError, "internal_error", "Failed to list webhooks")
 		return
@@ -158,6 +157,7 @@ func (h *NotificationsHandler) HandleUpdateWebhook(w http.ResponseWriter, r *htt
 		writeError(w, http.StatusServiceUnavailable, "unavailable", "Webhooks are not available")
 		return
 	}
+	userID := apimw.GetUserID(r.Context())
 	profileID := apimw.GetProfileID(r.Context())
 
 	var req webhookRequest
@@ -165,7 +165,7 @@ func (h *NotificationsHandler) HandleUpdateWebhook(w http.ResponseWriter, r *htt
 		writeError(w, http.StatusBadRequest, "bad_request", "Invalid request body")
 		return
 	}
-	hook, err := service.Update(r.Context(), profileID, chi.URLParam(r, "id"), req.toInput())
+	hook, err := service.Update(r.Context(), userID, profileID, chi.URLParam(r, "id"), req.toInput())
 	if err != nil {
 		writeWebhookError(w, err)
 		return
@@ -180,8 +180,7 @@ func (h *NotificationsHandler) HandleDeleteWebhook(w http.ResponseWriter, r *htt
 		writeError(w, http.StatusServiceUnavailable, "unavailable", "Webhooks are not available")
 		return
 	}
-	profileID := apimw.GetProfileID(r.Context())
-	if err := service.Delete(r.Context(), profileID, chi.URLParam(r, "id")); err != nil {
+	if err := service.Delete(r.Context(), apimw.GetUserID(r.Context()), apimw.GetProfileID(r.Context()), chi.URLParam(r, "id")); err != nil {
 		writeWebhookError(w, err)
 		return
 	}
@@ -195,8 +194,7 @@ func (h *NotificationsHandler) HandleRotateWebhookSecret(w http.ResponseWriter,
 		writeError(w, http.StatusServiceUnavailable, "unavailable", "Webhooks are not available")
 		return
 	}
-	profileID := apimw.GetProfileID(r.Context())
-	signingSecret, err := service.RotateSecret(r.Context(), profileID, chi.URLParam(r, "id"))
+	signingSecret, err := service.RotateSecret(r.Context(), apimw.GetUserID(r.Context()), apimw.GetProfileID(r.Context()), chi.URLParam(r, "id"))
 	if err != nil {
 		writeWebhookError(w, err)
 		return
@@ -212,8 +210,7 @@ func (h *NotificationsHandler) HandleTestWebhook(w http.ResponseWriter, r *http.
 		writeError(w, http.StatusServiceUnavailable, "unavailable", "Webhooks are not available")
 		return
 	}
-	profileID := apimw.GetProfileID(r.Context())
-	result, err := service.Test(r.Context(), profileID, chi.URLParam(r, "id"))
+	result, err := service.Test(r.Context(), apimw.GetUserID(r.Context()), apimw.GetProfileID(r.Context()), chi.URLParam(r, "id"))
 	if err != nil {
 		writeWebhookError(w, err)
 		return
diff --git a/internal/api/handlers/notifications_webpush.go b/internal/api/handlers/notifications_webpush.go
index 2b8150b449..f89beb7e07 100644
--- a/internal/api/handlers/notifications_webpush.go
+++ b/internal/api/handlers/notifications_webpush.go
@@ -89,8 +89,7 @@ func (h *NotificationsHandler) HandleWebPushList(w http.ResponseWriter, r *http.
 		writeError(w, http.StatusServiceUnavailable, "unavailable", "Web push is not available")
 		return
 	}
-	profileID := apimw.GetProfileID(r.Context())
-	subs, err := service.List(r.Context(), profileID)
+	subs, err := service.List(r.Context(), apimw.GetUserID(r.Context()), apimw.GetProfileID(r.Context()))
 	if err != nil {
 		writeError(w, http.StatusInternalServerError, "internal_error", "Failed to list push subscriptions")
 		return
diff --git a/internal/api/handlers/owner_test.go b/internal/api/handlers/owner_test.go
index 7968907c95..db40cd1fd2 100644
--- a/internal/api/handlers/owner_test.go
+++ b/internal/api/handlers/owner_test.go
@@ -9,6 +9,7 @@ import (
 	"testing"
 
 	"github.com/go-chi/chi/v5"
+	"github.com/jackc/pgx/v5"
 
 	apimw "github.com/prairie-server/prairie-server/internal/api/middleware"
 	"github.com/prairie-server/prairie-server/internal/auth"
@@ -23,15 +24,15 @@ const (
 )
 
 func ownerAccount() models.User {
-	return models.User{ID: testOwnerID, Username: "owner", Email: "owner@example.test", Role: models.RoleAdmin, Enabled: true, IsOwner: true, LocalPasswordLoginEnabled: true, MaxProfiles: 5}
+	return models.User{ID: testOwnerID, Username: "owner", Email: "owner@example.test", Role: models.RoleAdmin, Enabled: true, IsOwner: true, LocalPasswordLoginEnabled: true, MaxProfiles: new(5)}
 }
 
 func adminAccount() models.User {
-	return models.User{ID: testAdminID, Username: "admin", Email: "admin@example.test", Role: models.RoleAdmin, Enabled: true, LocalPasswordLoginEnabled: true, MaxProfiles: 5}
+	return models.User{ID: testAdminID, Username: "admin", Email: "admin@example.test", Role: models.RoleAdmin, Enabled: true, LocalPasswordLoginEnabled: true, MaxProfiles: new(5)}
 }
 
 func userAccount() models.User {
-	return models.User{ID: testAdminID, Username: "user", Email: "user@example.test", Role: models.RoleUser, Enabled: true, LocalPasswordLoginEnabled: true, MaxProfiles: 5}
+	return models.User{ID: testAdminID, Username: "user", Email: "user@example.test", Role: models.RoleUser, Enabled: true, LocalPasswordLoginEnabled: true, MaxProfiles: new(5)}
 }
 
 // providerAdminAccount is an admin that signs in only through a provider:
@@ -177,6 +178,9 @@ func TestCreateAdminNeedsOwner(t *testing.T) {
 }
 
 func TestV1AdminUserHandlersProtectAdmins(t *testing.T) {
+	// An admin that inherits the profile limit; the v1 body reports it as 5.
+	inheritingAdmin := adminAccount()
+	inheritingAdmin.MaxProfiles = nil
 	for _, tc := range []struct {
 		name, method, body string
 		target             models.User
@@ -194,6 +198,8 @@ func TestV1AdminUserHandlersProtectAdmins(t *testing.T) {
 		{"admin saves self with its role unchanged", http.MethodPut, `{"role":"admin","email":"new@example.test"}`, adminAccount(), testAdminID, http.StatusOK},
 		{"admin changes own policy", http.MethodPut, `{"download_transcode_allowed":false}`, adminAccount(), testAdminID, http.StatusForbidden},
 		{"admin saves self with its policy unchanged", http.MethodPut, `{"email":"new@example.test","max_streams":null}`, adminAccount(), testAdminID, http.StatusOK},
+		{"admin saves self re-sending the profile limit it read", http.MethodPut, `{"email":"new@example.test","max_profiles":5}`, inheritingAdmin, testAdminID, http.StatusOK},
+		{"admin changes own inherited profile limit", http.MethodPut, `{"max_profiles":3}`, inheritingAdmin, testAdminID, http.StatusForbidden},
 		{"owner limits admin", http.MethodPut, `{"max_streams":2}`, adminAccount(), scopedKeyTestOwnerID, http.StatusOK},
 		{"provider-only admin sets own password", http.MethodPut, `{"password":"long-enough-password"}`, providerAdminAccount(), testAdminID, http.StatusForbidden},
 		{"owner sets a provider-only admin's password", http.MethodPut, `{"password":"long-enough-password"}`, providerAdminAccount(), scopedKeyTestOwnerID, http.StatusOK},
@@ -416,3 +422,107 @@ func TestAdminAPIKeysProtectOwner(t *testing.T) {
 		}
 	}
 }
+
+// A v1 client that sends back the profile limit it read leaves an inheriting
+// account inheriting; a different limit becomes its override.
+func TestV1UpdateUserKeepsInheritedProfileLimit(t *testing.T) {
+	for _, tc := range []struct {
+		name    string
+		body    string
+		wantSet bool
+	}{
+		{"re-sent limit", `{"email":"new@example.test","max_profiles":5}`, false},
+		{"new limit", `{"max_profiles":3}`, true},
+	} {
+		target := userAccount()
+		target.MaxProfiles = nil
+		repo := &scopedKeyUserRepo{user: &target}
+		h := &AdminHandler{userRepo: repo}
+		req := httptest.NewRequest(http.MethodPut, "/api/v1/admin/users/9", strings.NewReader(tc.body))
+		rctx := chi.NewRouteContext()
+		rctx.URLParams.Add("id", "9")
+		req = req.WithContext(apimw.SetClaims(context.WithValue(req.Context(), chi.RouteCtxKey, rctx), &auth.Claims{UserID: scopedKeyTestOwnerID, Role: "admin", TokenType: auth.TokenTypeAccess, SessionID: "s1"}))
+		rec := httptest.NewRecorder()
+		h.HandleUpdateUser(rec, req)
+		if rec.Code != http.StatusOK || repo.updated == nil {
+			t.Fatalf("%s: status = %d (body %s), updated %v", tc.name, rec.Code, rec.Body.String(), repo.updated != nil)
+		}
+		if repo.updated.MaxProfiles.Set != tc.wantSet {
+			t.Errorf("%s: max_profiles set = %v, want %v", tc.name, repo.updated.MaxProfiles.Set, tc.wantSet)
+		}
+	}
+}
+
+func v1UpdateUser(t *testing.T, target models.User, body string) *scopedKeyUserRepo {
+	t.Helper()
+	repo := &scopedKeyUserRepo{user: &target}
+	h := &AdminHandler{userRepo: repo}
+	req := httptest.NewRequest(http.MethodPut, "/api/v1/admin/users/9", strings.NewReader(body))
+	rctx := chi.NewRouteContext()
+	rctx.URLParams.Add("id", "9")
+	req = req.WithContext(apimw.SetClaims(context.WithValue(req.Context(), chi.RouteCtxKey, rctx), &auth.Claims{UserID: scopedKeyTestOwnerID, Role: "admin", TokenType: auth.TokenTypeAccess, SessionID: "s1"}))
+	rec := httptest.NewRecorder()
+	h.HandleUpdateUser(rec, req)
+	if rec.Code != http.StatusOK || repo.updated == nil {
+		t.Fatalf("status = %d (body %s), updated %v", rec.Code, rec.Body.String(), repo.updated != nil)
+	}
+	return repo
+}
+
+// The limit an account reports belongs to the role and group it had when the
+// client read it. Sending that limit while the same request moves the
+// account is an explicit override for the new context, not an echo.
+func TestV1UpdateUserProfileLimitFollowsRoleChange(t *testing.T) {
+	target := userAccount()
+	target.Role = models.RoleAdmin
+	target.MaxProfiles = nil
+	repo := v1UpdateUser(t, target, `{"role":"user","max_profiles":5}`)
+	if !repo.updated.MaxProfiles.Set || repo.updated.MaxProfiles.Value == nil || *repo.updated.MaxProfiles.Value != 5 {
+		t.Errorf("max_profiles = %+v, want an override of 5", repo.updated.MaxProfiles)
+	}
+}
+
+type noRowsRow struct{}
+
+func (noRowsRow) Scan(...any) error { return pgx.ErrNoRows }
+
+// profileLimitTx answers the in-transaction group lookup with no group, so a
+// test can prove the limit resolves through the mutation transaction rather
+// than a second pool connection.
+type profileLimitTx struct {
+	pgx.Tx
+	queried bool
+}
+
+func (tx *profileLimitTx) QueryRow(context.Context, string, ...any) pgx.Row {
+	tx.queried = true
+	return noRowsRow{}
+}
+
+func TestKeepInheritedProfileLimitReadsGroupInTransaction(t *testing.T) {
+	target := userAccount()
+	target.MaxProfiles = nil
+	input := models.UpdateUserInput{MaxProfiles: models.Optional[int]{Set: true, Value: new(5)}}
+	tx := &profileLimitTx{}
+	h := &AdminHandler{}
+	if err := h.keepInheritedProfileLimit(t.Context(), tx, &target, &input); err != nil {
+		t.Fatal(err)
+	}
+	if !tx.queried {
+		t.Error("group was not resolved through the transaction")
+	}
+	if input.MaxProfiles.Set {
+		t.Errorf("max_profiles = %+v, want the re-sent limit dropped", input.MaxProfiles)
+	}
+}
+
+// A v1 client clears an override back to inherit with an explicit null, like
+// every other policy field in the same body.
+func TestV1UpdateUserClearsProfileLimit(t *testing.T) {
+	target := userAccount()
+	target.MaxProfiles = new(3)
+	repo := v1UpdateUser(t, target, `{"max_profiles":null}`)
+	if !repo.updated.MaxProfiles.Set || repo.updated.MaxProfiles.Value != nil {
+		t.Errorf("max_profiles = %+v, want set to inherit (null)", repo.updated.MaxProfiles)
+	}
+}
diff --git a/internal/api/handlers/people.go b/internal/api/handlers/people.go
index 3df5ffc710..1dc6f554a1 100644
--- a/internal/api/handlers/people.go
+++ b/internal/api/handlers/people.go
@@ -262,7 +262,7 @@ func (h *PeopleHandler) HandleGetPersonItems(w http.ResponseWriter, r *http.Requ
 
 	items := make([]itemListResponse, 0, len(result.Items))
 	for _, item := range result.Items {
-		items = append(items, h.itemsHandler.toItemListResponse(r.Context(), viewerFromRequest(r, filter), item, filter.ImageSize))
+		items = append(items, h.itemsHandler.toItemListResponse(r.Context(), viewerFromRequest(r, filter), item, filter.Artwork()))
 	}
 
 	writeJSON(w, http.StatusOK, browseResponse{
diff --git a/internal/api/handlers/playback.go b/internal/api/handlers/playback.go
index 1c9c3d4eeb..81c1d84cf7 100644
--- a/internal/api/handlers/playback.go
+++ b/internal/api/handlers/playback.go
@@ -25,9 +25,11 @@ import (
 	"github.com/prairie-server/prairie-server/internal/config"
 	evt "github.com/prairie-server/prairie-server/internal/events"
 	"github.com/prairie-server/prairie-server/internal/httpstream"
+	"github.com/prairie-server/prairie-server/internal/logredact"
 	"github.com/prairie-server/prairie-server/internal/markers"
 	"github.com/prairie-server/prairie-server/internal/models"
 	"github.com/prairie-server/prairie-server/internal/netaccess"
+	"github.com/prairie-server/prairie-server/internal/nodeauth"
 	"github.com/prairie-server/prairie-server/internal/nodepool"
 	"github.com/prairie-server/prairie-server/internal/noderouting"
 	"github.com/prairie-server/prairie-server/internal/playback"
@@ -183,22 +185,21 @@ type copySeekAnchorResolver func(
 
 // PlaybackHandler handles playback session HTTP endpoints.
 type PlaybackHandler struct {
-	sessionMgr              SessionManagerInterface
-	fileResolver            FilePathResolver            // optional; enables stream_url in responses
-	StoreProvider           userstore.UserStoreProvider // optional; enables progress/history persistence
-	DeviceSightings         *DeviceSightings            // optional; registers the device that starts playback
-	WatchScrobbler          PlaybackWatchScrobbler
-	StableIdentityResolver  *watchstate.StableIdentityResolver
-	CompletionObserver      watchstate.CompletionObserver // optional; auto-removes watched items from the watchlist
-	profileStaler           ProfileStaler
-	profileRefreshRequester ProfileRefreshRequester
-	AdminStore              PlaybackAdminStore    // optional; enables admin playback history/live session cleanup
-	SessionSyncer           PlaybackSessionSyncer // optional; enables immediate session sync to shared admin view
-	EventsHub               *evt.Hub
-	MissingMarker           MissingFileMarker
-	NodePlanner             nodepool.SessionPlanner   // optional; enables proxy/transcode node selection
-	JWTSecret               string                    // needed for signing stream tokens
-	StreamTelemetry         *streamtelemetry.Registry // local observation-only telemetry
+	sessionMgr             SessionManagerInterface
+	fileResolver           FilePathResolver            // optional; enables stream_url in responses
+	StoreProvider          userstore.UserStoreProvider // optional; enables progress/history persistence
+	DeviceSightings        *DeviceSightings            // optional; registers the device that starts playback
+	WatchScrobbler         PlaybackWatchScrobbler
+	StableIdentityResolver *watchstate.StableIdentityResolver
+	CompletionObserver     watchstate.CompletionObserver // optional; auto-removes watched items from the watchlist
+	signalsNotifier        SignalsChangedNotifier
+	AdminStore             PlaybackAdminStore    // optional; enables admin playback history/live session cleanup
+	SessionSyncer          PlaybackSessionSyncer // optional; enables immediate session sync to shared admin view
+	EventsHub              *evt.Hub
+	MissingMarker          MissingFileMarker
+	NodePlanner            nodepool.SessionPlanner   // optional; enables proxy/transcode node selection
+	JWTSecret              string                    // needed for signing stream tokens
+	StreamTelemetry        *streamtelemetry.Registry // local observation-only telemetry
 	// StreamDeny revokes a session's stream tokens before they expire (see
 	// docs/architecture/restart-resilient-playback.md). Nil-safe: without Redis
 	// a stopped session keeps serving from a valid token until the token expires.
@@ -212,6 +213,10 @@ type PlaybackHandler struct {
 	// progressSideEffectLocks serializes v2 progress side effects per session
 	// (see persistProgressV2).
 	progressSideEffectLocks sync.Map
+	// realtimeResultQueues orders completed realtime command results per
+	// session off the socket reader (see runRealtimeResult).
+	realtimeResultMu     sync.Mutex
+	realtimeResultQueues map[string]*realtimeResultQueue
 	// ProxyGrantStore hands a proxy the recipe it serves a header-authenticated
 	// session from. Optional: without it (or without Redis behind it) an attempt
 	// that negotiated authorized_media_origins_v1 simply stays on the API origin.
@@ -222,7 +227,13 @@ type PlaybackHandler struct {
 	// for transcode-executed progressive remuxes, whose signed tokens otherwise
 	// outlive a node's in-memory stop fence. Without a usable store those remuxes
 	// use another legal route; tokenless HLS sessions replan instead of recovering.
-	NodeRecipeStore    recipeCardStoreV3
+	NodeRecipeStore recipeCardStoreV3
+	// SessionRecipeStore keeps the committed recipe of a header-authenticated
+	// session, keyed by playback session id, so this server (after a restart, or
+	// any replica) can rebuild a session whose URLs carry no stream token. See
+	// playback_session_recipe.go. Without Redis behind it such a session answers
+	// 404 after a restart and the client starts a new attempt, as before.
+	SessionRecipeStore sessionRecipeStoreV3
 	ItemAccess         PlaybackItemAccessChecker // optional; enables file authorization checks
 	EpisodeLookup      PlaybackEpisodeLookup     // optional; resolves episode files to their series
 	ExtraLookup        PlaybackExtraLookup       // optional; resolves extras files to their parent item
@@ -272,6 +283,7 @@ type PlaybackHandler struct {
 	v3Registry           *playback.TransformationRegistryV3
 	v3RegistryProbe      func(context.Context, string, tonemap.Capabilities) (*playback.TransformationRegistryV3, error)
 	v3ToneMapProbe       func(context.Context, string, string, string) (tonemap.Capabilities, error)
+	v3RouteNodeProbe     func(context.Context, string) bool // nil: probeRouteNodeV3
 	v3NodeCapabilitiesMu sync.Mutex
 	v3NodeCapabilities   map[string]v3NodeCapabilityCache
 	// v3NodeProbeBudgets holds what each node last said a capability read of it
@@ -406,14 +418,10 @@ func (h *PlaybackHandler) TranscodeManager() *playback.TranscodeManager {
 	return h.tm
 }
 
-// SetProfileStaler configures an optional staleness trigger for taste profiles.
-func (h *PlaybackHandler) SetProfileStaler(ps ProfileStaler) {
-	h.profileStaler = ps
-}
-
-// SetProfileRefreshRequester configures an optional background refresh queue for taste profiles.
-func (h *PlaybackHandler) SetProfileRefreshRequester(requester ProfileRefreshRequester) {
-	h.profileRefreshRequester = requester
+// SetSignalsChangedNotifier configures where changes to a profile's
+// recommendation signals are reported. Without it they are not reported.
+func (h *PlaybackHandler) SetSignalsChangedNotifier(notifier SignalsChangedNotifier) {
+	h.signalsNotifier = notifier
 }
 
 // playbackConfig returns the current playback config, falling back to the
@@ -584,6 +592,12 @@ func (h *PlaybackHandler) loadTranscodeServeSession(r *http.Request, sessionID s
 			// reconstruction; plain cards just respawn the encode. Either way the
 			// atomic playback+runtime operation is the same front door.
 			card, claims := verifiedStreamCardFromToken(r.URL.Query().Get(streamTokenParam), sessionID, h.JWTSecret)
+			if card == nil && session.RequireMediaAuthorization {
+				var recipeErr error
+				if card, recipeErr = h.storedSessionRecipeV3(r.Context(), sessionID, requestUserID); recipeErr != nil {
+					return nil, playback.SessionLoadFailed, nil, nil, recipeErr
+				}
+			}
 			if card != nil && nativeAPIEgressStatusV3(card.RoutingWorkload, card.RoutingExecution, card.RoutingEgress) != 0 {
 				// The live session may have been replanned since this token was
 				// issued. Its API assignment is authoritative; a stale proxy card
@@ -604,8 +618,15 @@ func (h *PlaybackHandler) loadTranscodeServeSession(r *http.Request, sessionID s
 		return nil, playback.SessionLoadFailed, nil, nil, nil
 	}
 	// Genuine miss (e.g. after a restart): now — and only now — pay for the token
-	// decode so the recipe is available for reconstruction.
+	// decode so the recipe is available for reconstruction. A header-authenticated
+	// session carries no token; its recipe is the server-side recovery card.
 	card, claims := verifiedStreamCardFromToken(r.URL.Query().Get(streamTokenParam), sessionID, h.JWTSecret)
+	if card == nil {
+		var recipeErr error
+		if card, recipeErr = h.storedSessionRecipeV3(r.Context(), sessionID, requestUserID); recipeErr != nil {
+			return nil, playback.SessionLoadFailed, nil, nil, recipeErr
+		}
+	}
 	if card != nil {
 		if routeStatus := nativeAPIEgressStatusV3(card.RoutingWorkload, card.RoutingExecution, card.RoutingEgress); routeStatus != 0 {
 			return nil, playback.SessionUnavailable, card, claims, &nativeRouteBindingErrorV3{status: routeStatus}
@@ -773,9 +794,8 @@ func appendStreamToken(rawURL, token string) string {
 //
 // A session that requires media authorization gets the bare relative URL: it
 // authenticates every media request with the caller's own access token, so no
-// client-visible URL may carry a playback credential. Losing the token also
-// means losing transparent reconstruction after a restart, which is the
-// documented trade of that mode.
+// client-visible URL may carry a playback credential. Its reconstruction recipe
+// is kept server-side instead (see playback_session_recipe.go).
 func (h *PlaybackHandler) playbackStreamURL(s *playback.Session) string {
 	if s == nil {
 		return ""
@@ -996,7 +1016,7 @@ func (h *PlaybackHandler) persistProgress(ctx context.Context, session *playback
 		// A heartbeat that only moves the position leaves the taste profile
 		// alone; the stop (persistStopAndHistory) refreshes it for the play,
 		// and marking the item watched refreshes it here.
-		triggerProfileRefresh(ctx, h.profileStaler, h.profileRefreshRequester, session.UserID, session.ProfileID)
+		notifySignalsChanged(ctx, h.signalsNotifier, session.UserID, session.ProfileID)
 	}
 
 	if err := store.UpdateProgressHints(ctx, session.ProfileID, targetID, userstore.VersionHints{
@@ -1052,7 +1072,7 @@ func (h *PlaybackHandler) persistStopAndHistory(ctx context.Context, session *pl
 	// A history row this stop wrote still counts when a later write failed:
 	// no later stop of a once-recorded play refreshes the profile for it.
 	if (err == nil && !result.AlreadyRecorded) || result.HistoryID != "" {
-		triggerProfileRefresh(ctx, h.profileStaler, h.profileRefreshRequester, session.UserID, session.ProfileID)
+		notifySignalsChanged(ctx, h.signalsNotifier, session.UserID, session.ProfileID)
 	}
 	return result
 }
@@ -1203,8 +1223,30 @@ func (h *PlaybackHandler) finalizeSessionStopWithResult(ctx context.Context, ses
 		ctx = context.Background()
 	}
 	h.cancelPlaybackStartSideEffectsV3(ctx, session.ID)
+	h.cleanupStoppedSessionTransport(ctx, session)
+	if userInitiated || session.TranscodeNodeURL != "" {
+		// A system teardown (an FFmpeg exit, a copy-safety stop) leaves the
+		// attempt live for the client's next request to rebuild, as a stream
+		// token would; only a real stop retires the recovery card. A remote
+		// transport is the exception: the teardown above stopped its node job
+		// and dropped the node's recipe, so the card could only rebuild a
+		// session that relays the node's 404.
+		h.deleteSessionRecipeV3(ctx, session.ID)
+	}
+	stopResult := h.recordStoppedSession(ctx, session, userInitiated)
+	if syncNow {
+		h.syncSessionsNow(ctx, syncReason)
+	}
+	return stopResult
+}
 
+func (h *PlaybackHandler) recordStoppedSession(ctx context.Context, session *playback.Session, userInitiated bool) watchstate.PlaybackStopResult {
 	stopResult := h.recordStopHistory(ctx, session)
+	h.notifyStoppedSession(ctx, session, stopResult, userInitiated)
+	return stopResult
+}
+
+func (h *PlaybackHandler) notifyStoppedSession(ctx context.Context, session *playback.Session, stopResult watchstate.PlaybackStopResult, userInitiated bool) {
 	if h.WatchScrobbler != nil {
 		if event, ok := h.scrobbleEventForStoppedSession(ctx, session, stopResult); ok && (userInitiated || stopResult.Completed) {
 			if err := h.WatchScrobbler.ScrobbleStop(ctx, event); err != nil {
@@ -1221,7 +1263,9 @@ func (h *PlaybackHandler) finalizeSessionStopWithResult(ctx context.Context, ses
 			slog.ErrorContext(ctx, "failed to delete synced session", "component", "api", "session", session.ID, "error", err)
 		}
 	}
+}
 
+func (h *PlaybackHandler) cleanupStoppedSessionTransport(ctx context.Context, session *playback.Session) {
 	h.closeTranscodeForSession(session)
 	// A session that ends must stop egressing everywhere, not just here: the
 	// grant is a proxy's whole authority to serve these bytes, and unlike the
@@ -1232,10 +1276,6 @@ func (h *PlaybackHandler) finalizeSessionStopWithResult(ctx context.Context, ses
 	// outlive it: a buffered or retrying request would otherwise rebuild ffmpeg on
 	// the node for a transport that no longer exists.
 	h.deleteNodeRecipeV3(ctx, session.TranscodeTransportID)
-	if syncNow {
-		h.syncSessionsNow(ctx, syncReason)
-	}
-	return stopResult
 }
 
 // recordStopHistory writes a stopped session to watch history and the admin
@@ -1249,6 +1289,11 @@ func (h *PlaybackHandler) recordStopHistory(ctx context.Context, session *playba
 		return watchstate.PlaybackStopResult{}
 	}
 	result := h.persistStopAndHistory(ctx, session)
+	h.recordAdminStopHistory(ctx, session)
+	return result
+}
+
+func (h *PlaybackHandler) recordAdminStopHistory(ctx context.Context, session *playback.Session) {
 	if entry, err := h.buildAdminHistoryEntry(ctx, session); err != nil {
 		slog.ErrorContext(ctx, "failed to build admin history", "component", "api", "session", session.ID, "error", err)
 	} else if entry != nil && h.AdminStore != nil {
@@ -1256,7 +1301,6 @@ func (h *PlaybackHandler) recordStopHistory(ctx context.Context, session *playba
 			slog.ErrorContext(ctx, "failed to record admin history", "component", "api", "session", session.ID, "error", err)
 		}
 	}
-	return result
 }
 
 // compatPlayHistoryNamespace derives a Jellyfin play's watch-history row ID
@@ -1299,8 +1343,8 @@ func (h *PlaybackHandler) finalizeSessionAbort(ctx context.Context, session *pla
 		}
 	}
 
-	// Abort is a connection drop / non-terminal teardown — keep the recipe card
-	// so the client can reconstruct on reconnect.
+	// Abort has no user-visible stop, but its callers end the attempt, so no
+	// recipe here is a reconstruction aid any more.
 	h.closeTranscodeForSession(session)
 	// A session that ends must stop egressing everywhere, not just here: the
 	// grant is a proxy's whole authority to serve these bytes, and unlike the
@@ -1311,6 +1355,9 @@ func (h *PlaybackHandler) finalizeSessionAbort(ctx context.Context, session *pla
 	// outlive it: a buffered or retrying request would otherwise rebuild ffmpeg on
 	// the node for a transport that no longer exists.
 	h.deleteNodeRecipeV3(ctx, session.TranscodeTransportID)
+	// Every caller ends the attempt too, which refuses the card on any replica;
+	// drop it here like the node recipe rather than leave it to lapse.
+	h.deleteSessionRecipeV3(ctx, session.ID)
 	if syncNow {
 		h.syncSessionsNow(ctx, syncReason)
 	}
@@ -1336,9 +1383,8 @@ func (h *PlaybackHandler) handleExpiredSession(session *playback.Session) {
 			h.closeTranscodeForSession(&sessionCopy)
 			return
 		}
-		// Expiry is a liveness reap, not a user stop — keep the recipe card so a
-		// resume reconstructs under the same id (the card's own TTL reaps it if
-		// the session is truly abandoned).
+		// Expiry is a liveness reap, not a user stop, but it ends the attempt
+		// all the same (below), so nothing can reconstruct the session afterwards.
 		h.finalizeSessionStop(ctx, &sessionCopy, false, "", false)
 		// The attempt is over: mark its row stopped under a server-minted stop
 		// id so a start replay reports session_expired on every replica, and
@@ -1769,14 +1815,17 @@ func (h *PlaybackHandler) HandleGetTranscodeManifest(w http.ResponseWriter, r *h
 	attachPlaybackSession(r.Context(), session, claims)
 
 	transcodeSession := h.tm.GetTranscodeSession(sessionID)
-	if transcodeSession == nil {
-		// No local session — try proxying to remote transcode node.
-		if session.TranscodeNodeURL != "" {
-			h.touchSessionActivity(sessionID)
-			h.proxyToTranscodeNode(w, r, session.TranscodeNodeURL,
-				"/transcode/"+remoteTransportID(session)+"/master.m3u8")
+	if transcodeSession == nil && session.TranscodeNodeURL != "" {
+		// No local session — relay to the remote transcode node, moving the
+		// transcode to another executor if that node cannot be reached.
+		h.touchSessionActivity(sessionID)
+		var served bool
+		transcodeSession, served = h.relayOrRehomeTranscode(w, r, session, clientRecipeCard(card, claims), -1, "/master.m3u8")
+		if served {
 			return
 		}
+	}
+	if transcodeSession == nil {
 		// Local transcode whose process state was lost: reconstruct it from the
 		// token recipe. The manifest path has no segment context, so pass -1 (use
 		// the token's seek position).
@@ -1840,8 +1889,11 @@ func writePlaybackToneMapExecutionError(w http.ResponseWriter, err error) bool {
 func (h *PlaybackHandler) HandleGetTranscodeSegment(w http.ResponseWriter, r *http.Request) {
 	sessionID := chi.URLParam(r, "session_id")
 	requestedSegment := -1
+	subtitleSegment, isSubtitleSegment := playback.ParseSubtitleSegmentNumber(chi.URLParam(r, "name"))
 	if segNum, parseErr := playback.ParseSegmentNumber(chi.URLParam(r, "name")); parseErr == nil {
 		requestedSegment = segNum
+	} else if isSubtitleSegment {
+		requestedSegment = subtitleSegment
 	}
 	session, status, card, claims, reconstructErr := h.loadTranscodeServeSession(r, sessionID, requestedSegment)
 	switch status {
@@ -1884,14 +1936,16 @@ func (h *PlaybackHandler) HandleGetTranscodeSegment(w http.ResponseWriter, r *ht
 	attachPlaybackSession(r.Context(), session, claims)
 
 	transcodeSession := h.tm.GetTranscodeSession(sessionID)
-	if transcodeSession == nil {
-		if session.TranscodeNodeURL != "" {
-			h.touchSessionActivity(sessionID)
-			segmentName := chi.URLParam(r, "name")
-			h.proxyToTranscodeNode(w, r, session.TranscodeNodeURL,
-				"/transcode/"+remoteTransportID(session)+"/segment/"+segmentName)
+	if transcodeSession == nil && session.TranscodeNodeURL != "" {
+		h.touchSessionActivity(sessionID)
+		var served bool
+		transcodeSession, served = h.relayOrRehomeTranscode(w, r, session, clientRecipeCard(card, claims), requestedSegment,
+			"/segment/"+chi.URLParam(r, "name"))
+		if served {
 			return
 		}
+	}
+	if transcodeSession == nil {
 		// Resume near the segment the client is fetching so reconstruct does not
 		// restart from the original seek point and stall. A non-segment name
 		// (e.g. init.mp4) parses as negative and falls back to the token position.
@@ -1908,6 +1962,12 @@ func (h *PlaybackHandler) HandleGetTranscodeSegment(w http.ResponseWriter, r *ht
 	h.touchSessionActivity(sessionID)
 
 	segmentName := chi.URLParam(r, "name")
+	if isSubtitleSegment {
+		// Subtitle rendition segments never wait out or restart the video
+		// pipeline: they are answered from the cues already on disk.
+		transcodeSession.ServeSubtitleSegment(w, r, subtitleSegment)
+		return
+	}
 	segmentLease, err := transcodeSession.OpenSegment(segmentName)
 	if err != nil && errors.Is(err, playback.ErrSegmentNotFound) {
 		segNum, parseErr := playback.ParseSegmentNumber(segmentName)
@@ -2080,8 +2140,16 @@ func (h *PlaybackHandler) buildProxyManifestURL(card playback.RecipeCard, proxyN
 	return nodepool.NodeEndpoint(base, "/stream/transcode/"+token+"/master.m3u8")
 }
 
-// proxyToTranscodeNode forwards a request to the remote transcode node.
-func (h *PlaybackHandler) proxyToTranscodeNode(w http.ResponseWriter, r *http.Request, transcodeNodeURL, path string) {
+func writeTranscodeNodeUnavailable(w http.ResponseWriter) {
+	http.Error(w, "transcode node unavailable", http.StatusBadGateway)
+}
+
+// relayToTranscodeNode forwards a request to the remote transcode node and
+// writes the response. It writes nothing and returns an error wrapping
+// errTranscodeNodeUnreachable when the node could not be reached at all, so the
+// caller can move the transcode elsewhere before answering; every other outcome,
+// node HTTP errors included, is written and returns nil.
+func (h *PlaybackHandler) relayToTranscodeNode(w http.ResponseWriter, r *http.Request, transcodeNodeURL, path string) error {
 	sessionID := chi.URLParam(r, "session_id")
 	targetURL := transcodeNodeURL + path
 	isSegmentRoute := strings.Contains(path, "/segment/")
@@ -2106,9 +2174,12 @@ func (h *PlaybackHandler) proxyToTranscodeNode(w http.ResponseWriter, r *http.Re
 	req, err := http.NewRequestWithContext(r.Context(), r.Method, targetURL, nil)
 	if err != nil {
 		http.Error(w, "internal error", http.StatusInternalServerError)
-		return
+		return nil
+	}
+	if err := nodeauth.Sign(req, transcodeNodeURL, h.JWTSecret); err != nil {
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return nil
 	}
-	req.Header.Set("Authorization", "Bearer "+h.JWTSecret)
 	if isSegmentRoute {
 		// The node's immediate transport peer is this API process, so receiving a
 		// complete response there does not prove that the browser received it.
@@ -2137,9 +2208,13 @@ func (h *PlaybackHandler) proxyToTranscodeNode(w http.ResponseWriter, r *http.Re
 	resp, err := telemetry.DoTrustedNode(transcodeproxy.NodeClient(), req, "stream")
 	if err != nil {
 		nodepool.ReportConnectFailure(h.NodePlanner, transcodeNodeURL, err)
+		if r.Context().Err() == nil && h.transcodeNodeUnreachable(transcodeNodeURL, err) {
+			slog.WarnContext(r.Context(), "transcode node unreachable from the relay", "component", "api", "error", logredact.SanitizeText(err.Error()), "url", logredact.SanitizeURL(targetURL), "playback_session_id", sessionID)
+			return fmt.Errorf("%w: %w", errTranscodeNodeUnreachable, err)
+		}
 		slog.ErrorContext(r.Context(), "proxy to transcode node", "component", "api", "error", err, "url", targetURL, "playback_session_id", sessionID)
-		http.Error(w, "transcode node unavailable", http.StatusBadGateway)
-		return
+		writeTranscodeNodeUnavailable(w)
+		return nil
 	}
 	defer func() { _ = resp.Body.Close() }()
 
@@ -2153,8 +2228,8 @@ func (h *PlaybackHandler) proxyToTranscodeNode(w http.ResponseWriter, r *http.Re
 		body, readErr := io.ReadAll(resp.Body)
 		if readErr != nil {
 			slog.ErrorContext(r.Context(), "read transcode node manifest", "component", "api", "error", readErr, "url", targetURL, "playback_session_id", sessionID)
-			http.Error(w, "transcode node unavailable", http.StatusBadGateway)
-			return
+			writeTranscodeNodeUnavailable(w)
+			return nil
 		}
 		rewritten := playback.AppendManifestQueryParam(body, streamTokenParam, validToken)
 		for k, vv := range resp.Header {
@@ -2168,7 +2243,7 @@ func (h *PlaybackHandler) proxyToTranscodeNode(w http.ResponseWriter, r *http.Re
 		w.Header().Set("Content-Length", strconv.Itoa(len(rewritten)))
 		w.WriteHeader(resp.StatusCode)
 		_, _ = w.Write(rewritten)
-		return
+		return nil
 	}
 
 	generation := resp.Header.Get(transcodeproxy.GenerationHeader)
@@ -2178,15 +2253,16 @@ func (h *PlaybackHandler) proxyToTranscodeNode(w http.ResponseWriter, r *http.Re
 	sw := httpstream.NewRollingDeadlineWriter(w)
 	sw.WriteHeader(resp.StatusCode)
 	if _, copyErr := io.Copy(sw, resp.Body); copyErr != nil {
-		return
+		return nil
 	}
 	fullSize := transcodeproxy.FullRepresentationSize(resp)
 	if isMediaSegment && generation != "" && r.Method == http.MethodGet &&
 		sw.CompletedFullResponse(fullSize) {
-		if ackErr := transcodeproxy.Acknowledge(r.Context(), transcodeproxy.NodeClient(), transcodeNodeURL+path, h.JWTSecret, generation); ackErr != nil {
+		if ackErr := transcodeproxy.Acknowledge(r.Context(), transcodeproxy.NodeClient(), transcodeNodeURL, path, h.JWTSecret, generation); ackErr != nil {
 			slog.WarnContext(r.Context(), "acknowledge transcode segment completion", "component", "api", "error", ackErr, "playback_session_id", sessionID)
 		}
 	}
+	return nil
 }
 
 // maybeStartThrottler reads throttle settings and starts the throttler if enabled.
diff --git a/internal/api/handlers/playback_control_socket_v2.go b/internal/api/handlers/playback_control_socket_v2.go
index 6b48c22dba..60aab0b969 100644
--- a/internal/api/handlers/playback_control_socket_v2.go
+++ b/internal/api/handlers/playback_control_socket_v2.go
@@ -193,9 +193,9 @@ type PlaybackControlSocketV2 struct {
 	lanes  map[string]*playbackControlLane
 }
 
-func NewPlaybackControlSocketV2(playbackHandler *PlaybackHandler, client *redis.Client, sessions eventsSessionValidator, users access.UserRepository, resolver apimw.ViewerResolver, primary apimw.PrimaryProfileChecker, publicURL string) *PlaybackControlSocketV2 {
+func NewPlaybackControlSocketV2(playbackHandler *PlaybackHandler, client *redis.Client, sessions eventsSessionValidator, users access.UserRepository, resolver apimw.ViewerResolver, actingAdmin apimw.ActingAdminDecider, publicURL string) *PlaybackControlSocketV2 {
 	h := &PlaybackControlSocketV2{Playback: playbackHandler, Tickets: NewPlaybackControlTicketStore(client), PublicOrigin: publicURL, lanes: map[string]*playbackControlLane{}}
-	h.Validate = newSocketAuthorityValidator(sessions, users, resolver, primary)
+	h.Validate = newSocketAuthorityValidator(sessions, users, resolver, actingAdmin)
 	return h
 }
 
diff --git a/internal/api/handlers/playback_finish_history_test.go b/internal/api/handlers/playback_finish_history_test.go
index c3dd5ba7c0..c0b7bfe11a 100644
--- a/internal/api/handlers/playback_finish_history_test.go
+++ b/internal/api/handlers/playback_finish_history_test.go
@@ -248,9 +248,9 @@ func TestRecordedJellyfinPlayRefreshesProfileDespiteFailedHints(t *testing.T) {
 	admin := &recordingPlaybackAdminStore{}
 	stopped := newFinishHistoryReplica(store, admin, finishHistoryFile())
 	stale := newFinishHistoryReplica(store, admin, finishHistoryFile())
-	staler := &countingProfileStaler{}
-	stopped.handler.SetProfileStaler(staler)
-	stale.handler.SetProfileStaler(staler)
+	notifier := &countingSignalsNotifier{}
+	stopped.handler.SetSignalsChangedNotifier(notifier)
+	stale.handler.SetSignalsChangedNotifier(notifier)
 	session := compatFinishSession()
 	stopped.holdCopy(t, session, 3500)
 	staleCopy := stale.holdCopy(t, session, 1800)
@@ -261,8 +261,8 @@ func TestRecordedJellyfinPlayRefreshesProfileDespiteFailedHints(t *testing.T) {
 	stale.expire(staleCopy)
 
 	assertOneCompletedPlay(t, sqlite)
-	if staler.calls != 1 {
-		t.Fatalf("profile refreshes = %d, want 1", staler.calls)
+	if notifier.calls != 1 {
+		t.Fatalf("profile refreshes = %d, want 1", notifier.calls)
 	}
 }
 
diff --git a/internal/api/handlers/playback_profile_refresh_test.go b/internal/api/handlers/playback_profile_refresh_test.go
index 1f6bb3c0f8..faf6d04445 100644
--- a/internal/api/handlers/playback_profile_refresh_test.go
+++ b/internal/api/handlers/playback_profile_refresh_test.go
@@ -14,12 +14,9 @@ import (
 	"github.com/prairie-server/prairie-server/internal/playback"
 )
 
-type countingProfileStaler struct{ calls int }
+type countingSignalsNotifier struct{ calls int }
 
-func (c *countingProfileStaler) MarkProfileStale(context.Context, int, string) error {
-	c.calls++
-	return nil
-}
+func (c *countingSignalsNotifier) NotifySignalsChanged(context.Context, int, string) { c.calls++ }
 
 // playbackRefreshDriver plays one movie through a native playback surface.
 type playbackRefreshDriver struct {
@@ -101,15 +98,13 @@ func TestPlaybackProgressRefreshesTasteProfileOnlyOnCompletionAndStop(t *testing
 			h := NewPlaybackHandler(manager, testPlaybackFileResolver{file: file})
 			h.InstallationID = serviceInstallation
 			h.StoreProvider = testUserStoreProvider{store: newPlaybackTestStore(t)}
-			staler := &countingProfileStaler{}
-			requester := &countingProfileRefresher{}
-			h.SetProfileStaler(staler)
-			h.SetProfileRefreshRequester(requester)
+			notifier := &countingSignalsNotifier{}
+			h.SetSignalsChangedNotifier(notifier)
 			driver := newDriver(t, h, manager, file)
 			assertRefreshes := func(stage string, want int) {
 				t.Helper()
-				if staler.calls != want || requester.calls != want {
-					t.Fatalf("%s: stale marks = %d, refresh requests = %d, want %d each", stage, staler.calls, requester.calls, want)
+				if notifier.calls != want {
+					t.Fatalf("%s: signal change notifications = %d, want %d", stage, notifier.calls, want)
 				}
 			}
 
diff --git a/internal/api/handlers/playback_proxy_test.go b/internal/api/handlers/playback_proxy_test.go
index b63d4a4323..77a7ced87e 100644
--- a/internal/api/handlers/playback_proxy_test.go
+++ b/internal/api/handlers/playback_proxy_test.go
@@ -14,7 +14,7 @@ import (
 	"github.com/prairie-server/prairie-server/internal/transcodeproxy"
 )
 
-func TestProxyToTranscodeNodeAcknowledgesOnlyFullDownstreamResponse(t *testing.T) {
+func TestRelayToTranscodeNodeAcknowledgesOnlyFullDownstreamResponse(t *testing.T) {
 	const (
 		body       = "complete segment"
 		generation = "17"
@@ -63,7 +63,9 @@ func TestProxyToTranscodeNodeAcknowledgesOnlyFullDownstreamResponse(t *testing.T
 			)
 			req.Header.Set("Range", tt.rangeHeader)
 			rr := httptest.NewRecorder()
-			handler.proxyToTranscodeNode(rr, req, node.URL, "/transcode/remote/segment/seg_00007.ts")
+			if err := handler.relayToTranscodeNode(rr, req, node.URL, "/transcode/remote/segment/seg_00007.ts"); err != nil {
+				t.Fatalf("relay error = %v", err)
+			}
 
 			if rr.Code != tt.wantStatus {
 				t.Fatalf("status = %d, want %d; body = %q", rr.Code, tt.wantStatus, rr.Body.String())
@@ -81,7 +83,7 @@ func TestProxyToTranscodeNodeAcknowledgesOnlyFullDownstreamResponse(t *testing.T
 	}
 }
 
-func TestProxyToTranscodeNodeDoesNotAcknowledgeFailedDownstreamWrite(t *testing.T) {
+func TestRelayToTranscodeNodeDoesNotAcknowledgeFailedDownstreamWrite(t *testing.T) {
 	const body = "complete segment"
 	var acknowledgements atomic.Int32
 	node := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -102,7 +104,9 @@ func TestProxyToTranscodeNodeDoesNotAcknowledgeFailedDownstreamWrite(t *testing.
 		"public",
 	)
 	w := &failingProxyResponseWriter{header: make(http.Header), remaining: 5}
-	handler.proxyToTranscodeNode(w, req, node.URL, "/transcode/remote/segment/seg_00007.ts")
+	if err := handler.relayToTranscodeNode(w, req, node.URL, "/transcode/remote/segment/seg_00007.ts"); err != nil {
+		t.Fatalf("relay error = %v", err)
+	}
 
 	if got := acknowledgements.Load(); got != 0 {
 		t.Fatalf("failed downstream transfer produced %d acknowledgement(s)", got)
@@ -128,12 +132,12 @@ func (w *failingProxyResponseWriter) Write(p []byte) (int, error) {
 	return n, io.ErrClosedPipe
 }
 
-// TestProxyToTranscodeNodeReusesNodeConnections guards the API→node relay pool.
+// TestRelayToTranscodeNodeReusesNodeConnections guards the API→node relay pool.
 // The relay holds a node connection while it streams a segment to the viewer,
 // so many sessions on one node keep many connections in flight at once. A pool
 // that keeps only two idle connections per host (http.DefaultClient) closes the
 // rest after every wave and dials them again for the next segment and its ack.
-func TestProxyToTranscodeNodeReusesNodeConnections(t *testing.T) {
+func TestRelayToTranscodeNodeReusesNodeConnections(t *testing.T) {
 	const (
 		concurrency = 20
 		waves       = 2
@@ -182,7 +186,9 @@ func relaySegment(t *testing.T, handler *PlaybackHandler, nodeURL string) {
 		"public",
 	)
 	rr := httptest.NewRecorder()
-	handler.proxyToTranscodeNode(rr, req, nodeURL, "/transcode/remote/segment/seg_00007.ts")
+	if err := handler.relayToTranscodeNode(rr, req, nodeURL, "/transcode/remote/segment/seg_00007.ts"); err != nil {
+		t.Errorf("relay error = %v", err)
+	}
 	if rr.Code != http.StatusOK {
 		t.Errorf("relay status = %d, want 200", rr.Code)
 	}
diff --git a/internal/api/handlers/playback_realtime.go b/internal/api/handlers/playback_realtime.go
index 3fe30cdd64..4923fac7a2 100644
--- a/internal/api/handlers/playback_realtime.go
+++ b/internal/api/handlers/playback_realtime.go
@@ -5,8 +5,10 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
+	"time"
 
 	"github.com/prairie-server/prairie-server/internal/playback"
+	"github.com/prairie-server/prairie-server/internal/userstore"
 	"github.com/prairie-server/prairie-server/internal/watchstate"
 )
 
@@ -30,38 +32,53 @@ func (h *PlaybackHandler) stopPlaybackSessionWithResult(ctx context.Context, ses
 	if h == nil || session == nil || session.ID == "" {
 		return watchstate.PlaybackStopResult{}, playback.ErrSessionNotFound
 	}
+	unlock := h.tm.LockSessionLifecycle(session.ID)
+	defer unlock()
+	current, err := h.endPlaybackSessionAuthority(ctx, session, userInitiated)
+	if err != nil {
+		return watchstate.PlaybackStopResult{}, err
+	}
+	return h.finalizeSessionStopWithResult(ctx, current, true, "stop", userInitiated), nil
+}
+
+// endPlaybackSessionAuthority ends the live session and revokes its streams
+// before optional provider notifications run. The returned snapshot is used
+// for history and ordered provider finalization. The caller holds the
+// session lifecycle lock through authority and transport cleanup.
+func (h *PlaybackHandler) endPlaybackSessionAuthority(ctx context.Context, session *playback.Session, userInitiated bool) (*playback.Session, error) {
+	if h == nil || session == nil || session.ID == "" {
+		return nil, playback.ErrSessionNotFound
+	}
 	// Replacement preparation holds this lifecycle lock until its new live
 	// session state and durable plan are committed (or rolled back). Wait for
 	// that boundary, then reload the route: callers commonly hold a copy taken
 	// before the replacement started, and deleting authority from that stale
 	// copy would leave the successor transport playable after a successful stop.
-	unlock := h.tm.LockSessionLifecycle(session.ID)
-	defer unlock()
 	current, err := h.sessionMgr.GetSession(session.ID)
 	if err != nil {
-		return watchstate.PlaybackStopResult{}, err
+		return nil, err
 	}
 	session = current
 	if userInitiated {
 		if err := h.deleteRequiredProgressiveRemuxAuthorityV3(ctx, session); err != nil {
-			return watchstate.PlaybackStopResult{}, fmt.Errorf("persist progressive remux stop: %w", err)
+			return nil, fmt.Errorf("persist progressive remux stop: %w", err)
 		}
 		if requiresProgressiveRemuxAuthorityV3(session) {
 			if err := h.tm.CancelRemoteTranscode(ctx, remoteTransportID(session), session.TranscodeNodeURL); err != nil {
-				return watchstate.PlaybackStopResult{}, fmt.Errorf("cancel progressive remux transport: %w", err)
+				return nil, fmt.Errorf("cancel progressive remux transport: %w", err)
 			}
 		}
 	}
 
 	if err := h.sessionMgr.StopSession(session.ID); err != nil {
-		return watchstate.PlaybackStopResult{}, err
+		return nil, err
 	}
 	if userInitiated {
 		// A user or admin stop is final: revoke the session's stream tokens on
 		// every replica, not just the live entry here.
 		h.StreamDeny.Deny(ctx, session.ID)
 	}
-	return h.finalizeSessionStopWithResult(ctx, session, true, "stop", userInitiated), nil
+	return session, nil
 }
 
 func (h *PlaybackHandler) stopPlaybackSessionByID(ctx context.Context, sessionID string, userInitiated bool) error {
@@ -75,6 +92,101 @@ func (h *PlaybackHandler) stopPlaybackSessionByID(ctx context.Context, sessionID
 	return h.stopPlaybackSession(ctx, session, userInitiated)
 }
 
+// recordRealtimeStoppedSession shares native history finalization with the
+// client's HTTP stop. Authority is already removed, so the client may have
+// finalized from the attempt row while this provider work was queued.
+func (h *PlaybackHandler) recordRealtimeStoppedSession(ctx context.Context, session *playback.Session) {
+	result := h.realtimeStopHistory(ctx, session)
+	h.recordAdminStopHistory(ctx, session)
+	h.notifyStoppedSession(ctx, session, result, true)
+}
+
+func (h *PlaybackHandler) realtimeStopHistory(parent context.Context, session *playback.Session) watchstate.PlaybackStopResult {
+	store, ok := h.PlanStoreV3.(playback.ProgressStoreV3)
+	if !ok {
+		return h.persistStopAndHistory(parent, session)
+	}
+	ctx, cancel := context.WithTimeout(parent, stopFinalizationLease)
+	defer cancel()
+	// This queued worker is the stop's only finalizer, so transient store
+	// errors are retried rather than abandoning the stop.
+	record, err := h.realtimeProgressAttempt(ctx, session.ID)
+	if err != nil {
+		slog.WarnContext(ctx, "failed to read realtime stop attempt", "session", session.ID, "error", err)
+		return watchstate.PlaybackStopResult{}
+	}
+	if record == nil {
+		return h.persistStopAndHistory(ctx, session) // Unsequenced bridge play.
+	}
+	var final *playback.ProgressSampleV3
+	if record.LastSample == nil && session.Position > 0 {
+		// A bridge progress report may have updated the live session without
+		// a sequenced native sample. Preserve its final resume position.
+		final = &playback.ProgressSampleV3{Sequence: record.LastSequence + 1, Position: session.Position, IsPaused: session.IsPaused}
+	}
+	var receipt playback.StopReceiptV3
+	for range 3 {
+		// The CAS is idempotent for one stop id, so a retry after an
+		// ambiguous failure replays the stored receipt.
+		receipt, _, err = store.StopAttempt(ctx, session.ID, adminStopID(session.ID), final)
+		if err == nil || errors.Is(err, playback.ErrSessionNotFound) || ctx.Err() != nil {
+			break
+		}
+	}
+	if err != nil {
+		slog.WarnContext(ctx, "failed to record realtime stop attempt", "session", session.ID, "error", err)
+		return watchstate.PlaybackStopResult{}
+	}
+	// An administrator terminate or unconfirmed-command fallback that ran
+	// after this stop removed the live session found nothing to tear down, so
+	// its finalized receipt recorded no history. Write it from this snapshot.
+	markerWithoutHistory := receipt.Finalized && receipt.HistoryID == "" && receipt.StopID == adminStopID(session.ID)
+	if !receipt.Finalized {
+		receipt = h.finalizeRealtimeStop(parent, store, record, session.ID, receipt, stopFinalizationLease)
+	}
+	// Finalization may have spent the first context's whole budget.
+	ctx, cancelResult := context.WithTimeout(parent, stopFinalizationLease)
+	defer cancelResult()
+	if receipt.Accepted != nil {
+		session.Position = receipt.Accepted.Position
+		session.IsPaused = receipt.Accepted.IsPaused
+	}
+	if markerWithoutHistory {
+		receipt.HistoryID = h.persistStopAndHistory(ctx, session).HistoryID
+		if receipt.HistoryID != "" {
+			if err := store.RecordStopReceipt(ctx, session.ID, receipt); err != nil {
+				slog.WarnContext(ctx, "failed to record realtime stop history receipt", "session", session.ID, "error", err)
+			}
+		}
+	}
+	result := watchstate.PlaybackStopResult{HistoryID: receipt.HistoryID, FinalPositionSeconds: session.Position}
+	file, err := h.loadFileByPreferredID(ctx, requestedMediaFileID(session), session.MediaFileID)
+	if err == nil && file != nil {
+		result.MediaItemID = playbackProgressTarget(file)
+		result.DurationSeconds = float64(file.Duration)
+		result.Completed = result.HistoryID != "" && !session.DisableProgressPersistence && result.DurationSeconds > 0 &&
+			session.Position/result.DurationSeconds > userstore.WatchedFraction(h.playbackThresholds(ctx).WatchedPct)
+	}
+	return result
+}
+
+// finalizeRealtimeStop runs stop finalization for the one queued realtime
+// worker, which no client request will retry. A finalizer on another replica
+// may claim the stop just before this worker and die; its lease then outlasts
+// a single round. Each round's budget ends before the lease it claims, so a
+// second round outlasts that competitor without finalizing on an expired claim.
+func (h *PlaybackHandler) finalizeRealtimeStop(parent context.Context, store playback.ProgressStoreV3, record *playback.AttemptRecordV3, sessionID string, receipt playback.StopReceiptV3, round time.Duration) playback.StopReceiptV3 {
+	for range 2 {
+		ctx, cancel := context.WithTimeout(parent, round)
+		receipt = h.finalizeStopV2(ctx, store, record, sessionID, receipt)
+		cancel()
+		if receipt.Finalized {
+			break
+		}
+	}
+	return receipt
+}
+
 func (h *PlaybackHandler) abortPlaybackSession(ctx context.Context, session *playback.Session) error {
 	if h == nil || session == nil || session.ID == "" {
 		return playback.ErrSessionNotFound
@@ -202,3 +314,155 @@ func (h *PlaybackHandler) setRealtimeConnectionState(sessionID string, connected
 	}
 	return true
 }
+
+const maxPendingRealtimeResults = 32
+
+// realtimeReceiptReadBudget bounds the progress-sequence read a pause or
+// resume result makes on the socket reader; see defaultPlaybackControlDeadline.
+const realtimeReceiptReadBudget = time.Second
+
+type realtimeResultQueue struct {
+	pending        []func()
+	done           chan struct{}
+	terminalQueued bool
+}
+
+// runRealtimeResult orders results through one worker per session. When a
+// slow provider fills the queue, its last pending pause state is superseded
+// by the newest one. Terminal finalization is always retained: the caller
+// has already removed session authority, so later terminal results cannot
+// enqueue another finalization for the same session.
+func (h *PlaybackHandler) runRealtimeResult(sessionID string, background bool, apply func()) {
+	h.realtimeResultMu.Lock()
+	if h.realtimeResultQueues == nil {
+		h.realtimeResultQueues = make(map[string]*realtimeResultQueue)
+	}
+	if queue := h.realtimeResultQueues[sessionID]; queue != nil {
+		if queue.terminalQueued {
+			h.realtimeResultMu.Unlock()
+			return
+		}
+		if !background {
+			queue.terminalQueued = true
+		}
+		if background && len(queue.pending) >= maxPendingRealtimeResults {
+			queue.pending[len(queue.pending)-1] = apply
+		} else {
+			queue.pending = append(queue.pending, apply)
+		}
+		h.realtimeResultMu.Unlock()
+		return
+	}
+	queue := &realtimeResultQueue{done: make(chan struct{}), terminalQueued: !background}
+	h.realtimeResultQueues[sessionID] = queue
+	h.realtimeResultMu.Unlock()
+	run := func() {
+		apply()
+		for {
+			h.realtimeResultMu.Lock()
+			if len(queue.pending) == 0 {
+				delete(h.realtimeResultQueues, sessionID)
+				close(queue.done)
+				h.realtimeResultMu.Unlock()
+				return
+			}
+			next := queue.pending[0]
+			queue.pending[0] = nil
+			queue.pending = queue.pending[1:]
+			h.realtimeResultMu.Unlock()
+			next()
+		}
+	}
+	if background {
+		go run()
+		return
+	}
+	run()
+}
+
+// setConfirmedPauseState applies a pause or resume the player confirmed over
+// its control lane. When the state changed it syncs the admin session views
+// and sends the watch-provider pause or resume scrobble, which the next
+// progress report would otherwise skip because it sees no transition.
+func (h *PlaybackHandler) setConfirmedPauseState(sessionID string, paused bool, receivedSequence int64) {
+	type pauseSetter interface {
+		SetPaused(sessionID string, paused bool, acceptedSequence int64, latest *playback.ProgressSampleV3) (bool, error)
+	}
+	mgr, ok := h.sessionMgr.(pauseSetter)
+	if !ok {
+		return
+	}
+	// Progress side effects hold this lock while they compare the old and new
+	// pause state, so a report racing this change scrobbles it at most once.
+	unlock := h.progressSideEffectLock(sessionID)
+	defer unlock()
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	attempt, err := h.realtimeProgressAttempt(ctx, sessionID)
+	cancel()
+	if err != nil {
+		slog.WarnContext(ctx, "failed to read progress sequence for confirmed pause", "session", sessionID, "error", err)
+		return
+	}
+	var acceptedSequence int64
+	if attempt != nil {
+		acceptedSequence = attempt.LastSequence
+	}
+	// Another replica may have accepted progress without holding this live
+	// session, so offer the latest accepted sample even at the receipt
+	// sequence; otherwise the snapshot and scrobble below use a stale
+	// position. Progress accepted after receipt is a newer player
+	// observation, so its pause state also supersedes the command's.
+	var latest *playback.ProgressSampleV3
+	if attempt != nil {
+		latest = attempt.LastSample
+	}
+	if acceptedSequence > receivedSequence {
+		if attempt.LastSample == nil {
+			return
+		}
+		paused = attempt.LastSample.IsPaused
+	}
+	changed, err := mgr.SetPaused(sessionID, paused, acceptedSequence, latest)
+	if err != nil {
+		if !errors.Is(err, playback.ErrSessionNotFound) {
+			slog.Warn("failed to apply confirmed pause state", "session", sessionID, "playback_session_id", sessionID, "error", err)
+		}
+		return
+	}
+	if !changed {
+		return
+	}
+	syncCtx, cancelSync := context.WithTimeout(context.Background(), 10*time.Second)
+	h.syncSessionsNow(syncCtx, "realtime_pause")
+	cancelSync()
+	// A start scrobble still queued behind busy start workers must reach the
+	// provider first, or it would land after this pause and leave the
+	// provider playing. The admin views above are already up to date.
+	h.waitForPlaybackStartSideEffectsV3(context.Background(), sessionID)
+	if current, err := h.sessionMgr.GetSession(sessionID); err == nil && current != nil {
+		providerCtx, cancelProvider := context.WithTimeout(context.Background(), 10*time.Second)
+		h.scrobblePauseTransitionV2(providerCtx, current, !paused)
+		cancelProvider()
+	}
+}
+
+func (h *PlaybackHandler) realtimeProgressAttempt(ctx context.Context, sessionID string) (*playback.AttemptRecordV3, error) {
+	if h.PlanStoreV3 == nil {
+		return nil, nil
+	}
+	var err error
+	for range 3 {
+		var attempt *playback.AttemptRecordV3
+		attempt, err = h.PlanStoreV3.GetAttempt(ctx, sessionID)
+		if errors.Is(err, playback.ErrSessionNotFound) {
+			return nil, nil // Bridge sessions may have no native attempt row.
+		}
+		if err == nil {
+			return attempt, nil
+		}
+		if ctx.Err() != nil {
+			break
+		}
+	}
+	return nil, err
+}
diff --git a/internal/api/handlers/playback_service.go b/internal/api/handlers/playback_service.go
index 5d2d9b79b6..447827235e 100644
--- a/internal/api/handlers/playback_service.go
+++ b/internal/api/handlers/playback_service.go
@@ -185,7 +185,7 @@ func (h *PlaybackHandler) PlaybackCapabilities(ctx context.Context, userID int,
 		return view, playbackOperationError(http.StatusConflict, "capability_not_configured", "Playback installation identity is not configured")
 	}
 	view.InstallationID = h.InstallationID
-	view.Features = append(playback.NativeServerFeaturesV3(), "sequenced_progress_v1", "fixed_media_file_v1", "marker_segments_v1", "trickplay_v1")
+	view.Features = append(playback.NativeServerFeaturesV3(), "sequenced_progress_v1", "fixed_media_file_v1", "marker_segments_v1", "trickplay_v1", "bandwidth_probe_v1")
 	if h.WatchTogetherAvailable {
 		view.Features = append(view.Features, "watch_party_source_fallback_v1", "watch_party_coordinator_v1")
 	}
@@ -442,11 +442,19 @@ func (h *PlaybackHandler) writeProgressSideEffectsV2(ctx context.Context, record
 	session, err := h.sessionMgr.GetSession(sessionID)
 	if err == nil && session != nil {
 		wasPaused := session.IsPaused
-		if err := h.sessionMgr.UpdateProgress(sessionID, sample.Position, sample.IsPaused); err != nil && !errors.Is(err, playback.ErrSessionNotFound) {
-			slog.WarnContext(ctx, "failed to update live playback progress", "component", "api", "session", sessionID, "playback_session_id", sessionID, "error", err)
+		var updateErr error
+		if mgr, ok := h.sessionMgr.(interface {
+			UpdateProgressSample(string, playback.ProgressSampleV3) error
+		}); ok {
+			updateErr = mgr.UpdateProgressSample(sessionID, sample)
+		} else {
+			updateErr = h.sessionMgr.UpdateProgress(sessionID, sample.Position, sample.IsPaused)
+		}
+		if updateErr != nil && !errors.Is(updateErr, playback.ErrSessionNotFound) {
+			slog.WarnContext(ctx, "failed to update live playback progress", "component", "api", "session", sessionID, "playback_session_id", sessionID, "error", updateErr)
 		}
-		h.syncSessionsOnPauseChange(ctx, wasPaused, sample.IsPaused)
 		if current, getErr := h.sessionMgr.GetSession(sessionID); getErr == nil && current != nil {
+			h.syncSessionsOnPauseChange(ctx, wasPaused, current.IsPaused)
 			h.persistProgress(ctx, current)
 			h.scrobblePauseTransitionV2(ctx, current, wasPaused)
 			return
diff --git a/internal/api/handlers/playback_service_test.go b/internal/api/handlers/playback_service_test.go
index aaa3b94bf6..82776ecbd2 100644
--- a/internal/api/handlers/playback_service_test.go
+++ b/internal/api/handlers/playback_service_test.go
@@ -98,6 +98,9 @@ func TestPlaybackCapabilitiesV2IsAlwaysAvailable(t *testing.T) {
 	if !slices.Contains(view.Features, "marker_segments_v1") {
 		t.Fatal("marker collections are not advertised")
 	}
+	if !slices.Contains(view.Features, "bandwidth_probe_v1") {
+		t.Fatal("the bandwidth probe is not advertised")
+	}
 	for _, feature := range []string{"watch_party_source_fallback_v1", "watch_party_coordinator_v1"} {
 		if slices.Contains(view.Features, feature) {
 			t.Fatalf("unconfigured Watch Party feature advertised: %s", feature)
diff --git a/internal/api/handlers/playback_session_recipe.go b/internal/api/handlers/playback_session_recipe.go
new file mode 100644
index 0000000000..d4ebc820a5
--- /dev/null
+++ b/internal/api/handlers/playback_session_recipe.go
@@ -0,0 +1,229 @@
+package handlers
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"time"
+
+	apimw "github.com/prairie-server/prairie-server/internal/api/middleware"
+	"github.com/prairie-server/prairie-server/internal/noderouting"
+	"github.com/prairie-server/prairie-server/internal/playback"
+	"github.com/prairie-server/prairie-server/internal/streamtoken"
+)
+
+// A header-authenticated attempt publishes no stream token, so after a restart
+// (or on another API replica) nothing the client sends describes the session.
+// The API keeps the committed recipe card in SessionRecipeStore instead and
+// rebuilds the playback session from it for the session's owner, which is what
+// the token does for every other attempt. The durable v3 attempt row stays the
+// authority on whether the card may still be used: it must name the same plan,
+// belong to the caller and selected profile, and not be stopped.
+
+// sessionRecipeStoreV3 is the session-recipe key space (*noderecipe.Store): a
+// recipe store whose reads also report when Redis could not be read, so an
+// outage is not answered as a missing session.
+type sessionRecipeStoreV3 interface {
+	recipeCardStoreV3
+	Lookup(ctx context.Context, key string) (*playback.RecipeCard, bool, error)
+}
+
+// recordSessionRecipeV3 stores the recovery card of a header-authenticated
+// transport that has just committed under planID. The builders attach the base
+// card; the routing comes from the live session the commit produced, read under
+// its lifecycle lock, so a stop or an executor move that lands between the
+// commit and this write is not overwritten with the transport's earlier view.
+//
+// A proxy-served transport gets no card, and loses any earlier one: the proxy
+// serves it from its grant, and a playback session the API rebuilt for it
+// would be reaped on API-side activity alone while the proxy is still serving.
+//
+// Best effort, like the node recipe: a failed write only costs this session its
+// restart recovery, and the plan binding keeps the card it failed to replace
+// from rebuilding the superseded transport.
+func (h *PlaybackHandler) recordSessionRecipeV3(ctx context.Context, planID string, transport *preparedTransportV3) {
+	if h == nil || transport == nil || transport.sessionRecipe == nil || planID == "" ||
+		h.SessionRecipeStore == nil || !h.SessionRecipeStore.Enabled() {
+		return
+	}
+	card := *transport.sessionRecipe
+	unlock := h.tm.LockSessionLifecycle(card.SessionID)
+	defer unlock()
+	current, err := h.sessionMgr.GetSession(card.SessionID)
+	if err != nil || current.TranscodeTransportID != transport.transportID {
+		return
+	}
+	if current.RoutingEgress == string(noderouting.EgressProxy) {
+		h.deleteSessionRecipeV3(ctx, card.SessionID)
+		return
+	}
+	card.PlanID = planID
+	card.RequireMediaAuthorization = true
+	card.RequestedMediaFileID = current.RequestedMediaFileID
+	card.DisableProgressPersistence = current.DisableProgressPersistence
+	stampLiveRouteV3(&card, current)
+	h.putSessionRecipeV3(ctx, card)
+}
+
+// stampLiveRouteV3 copies the executor and routing a live session runs on onto
+// its recovery card, which a rebuilt session relays and enforces from.
+func stampLiveRouteV3(card *playback.RecipeCard, current *playback.Session) {
+	card.TranscodeNodeURL = current.TranscodeNodeURL
+	card.TranscodeTransportID = current.TranscodeTransportID
+	card.RoutingWorkload = current.RoutingWorkload
+	card.RoutingExecution = current.RoutingExecution
+	card.RoutingExecutionNodeID = current.RoutingExecutionNodeID
+	card.RoutingEgress = current.RoutingEgress
+	card.RoutingEgressNodeID = current.RoutingEgressNodeID
+}
+
+// sessionRecipeCardV3 is a builder's base card for the recovery copy, with the
+// client metadata stored cards carry so a rebuilt session keeps its label in
+// the admin views.
+func sessionRecipeCardV3(card playback.RecipeCard, session *playback.Session) *playback.RecipeCard {
+	card.ClientName = session.ClientName
+	card.ClientVersion = session.ClientVersion
+	card.ClientBuild = session.ClientBuild
+	card.ClientChannel = session.ClientChannel
+	card.ClientUserAgent = session.ClientUserAgent
+	return &card
+}
+
+// clientRecipeCard is the card a serve loader returned when the client carried
+// it in a stream token (claims are only decoded from one), or nil for the API's
+// own recovery card. A transcode move treats a client card as authoritative and
+// leaves the node store alone; a tokenless session must keep that store current.
+func clientRecipeCard(card *playback.RecipeCard, claims *streamtoken.Claims) *playback.RecipeCard {
+	if claims == nil {
+		return nil
+	}
+	return card
+}
+
+func (h *PlaybackHandler) putSessionRecipeV3(ctx context.Context, card playback.RecipeCard) {
+	putCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), nodeRecipeWriteTimeoutV3)
+	defer cancel()
+	if err := h.SessionRecipeStore.Put(putCtx, card.SessionID, card); err != nil {
+		slog.WarnContext(ctx, "persist session recipe failed; this session cannot survive an API restart",
+			"component", "api", "playback_session_id", card.SessionID, "error", err)
+	}
+}
+
+// reusedSessionRecipeV3 is the card a sidecar-only replan carries forward. The
+// transport and its bytes are unchanged, but the plan id is new, so the stored
+// card has to be recorded again under it or recovery would refuse it.
+func (h *PlaybackHandler) reusedSessionRecipeV3(ctx context.Context, sessionID, currentPlanID string) *playback.RecipeCard {
+	if h == nil || h.SessionRecipeStore == nil || !h.SessionRecipeStore.Enabled() {
+		return nil
+	}
+	card, ok := h.SessionRecipeStore.Get(ctx, sessionID)
+	if !ok || card == nil || card.SessionID != sessionID || card.PlanID != currentPlanID {
+		return nil
+	}
+	return card
+}
+
+// followSessionRecipeMoveV3 points the stored recovery card at the executor a
+// transcode moved to. A rebuilt session relays to the node named here, so a
+// card left on the dead node would send the next restart back to it. moved is
+// the card the move started the transport from; the plan binding, client label
+// and progress policy stay those of the stored card, and the route is the live
+// session's.
+func (h *PlaybackHandler) followSessionRecipeMoveV3(ctx context.Context, sessionID string, moved playback.RecipeCard) {
+	if h == nil || h.SessionRecipeStore == nil || !h.SessionRecipeStore.Enabled() {
+		return
+	}
+	unlock := h.tm.LockSessionLifecycle(sessionID)
+	defer unlock()
+	current, err := h.sessionMgr.GetSession(sessionID)
+	if err != nil || remoteTransportID(current) != moved.TranscodeTransportID {
+		return
+	}
+	stored, ok := h.SessionRecipeStore.Get(ctx, sessionID)
+	if !ok || stored == nil || stored.TranscodeTransportID != moved.TranscodeTransportID {
+		return
+	}
+	next := moved
+	next.SessionID = sessionID
+	next.PlanID = stored.PlanID
+	next.RequireMediaAuthorization = true
+	next.RequestedMediaFileID = stored.RequestedMediaFileID
+	next.DisableProgressPersistence = stored.DisableProgressPersistence
+	next.ClientName = stored.ClientName
+	next.ClientVersion = stored.ClientVersion
+	next.ClientBuild = stored.ClientBuild
+	next.ClientChannel = stored.ClientChannel
+	next.ClientUserAgent = stored.ClientUserAgent
+	stampLiveRouteV3(&next, current)
+	h.putSessionRecipeV3(ctx, next)
+}
+
+// deleteSessionRecipeV3 drops a session's recovery card where the session
+// ends: on a user's stop and on an abort. A replica that ends an attempt it does
+// not hold, or a teardown that ends the attempt without either, leaves the card
+// to its TTL; the stopped attempt refuses it everywhere regardless.
+func (h *PlaybackHandler) deleteSessionRecipeV3(ctx context.Context, sessionID string) {
+	if h != nil {
+		deleteSessionRecipeV3(ctx, h.SessionRecipeStore, sessionID)
+	}
+}
+
+func deleteSessionRecipeV3(ctx context.Context, recipes recipeCardStoreV3, sessionID string) {
+	if recipes == nil || sessionID == "" {
+		return
+	}
+	if err := recipes.Delete(context.WithoutCancel(ctx), sessionID); err != nil {
+		slog.WarnContext(ctx, "failed to drop the session recipe",
+			"component", "api", "playback_session_id", sessionID, "error", err)
+	}
+}
+
+// storedSessionRecipeV3 returns the recovery card for a header-authenticated
+// session this process has no live copy of, or nil. It answers only an
+// authenticated caller, and only while the durable attempt still names the
+// card's plan, belongs to that caller and selected profile, negotiated
+// header-authenticated media, has not expired, and has not been stopped.
+// Everything it checks happens before a session is registered or an executor
+// started. An error means Redis or the attempt row could not be read: the
+// caller answers a retryable failure rather than telling the client its session
+// is gone.
+func storedSessionRecipeV3(ctx context.Context, recipes sessionRecipeStoreV3, attempts playback.PlanStoreV3, sessionID string, userID int) (*playback.RecipeCard, error) {
+	if userID == 0 || sessionID == "" || recipes == nil || !recipes.Enabled() || attempts == nil {
+		return nil, nil
+	}
+	card, ok, err := recipes.Lookup(ctx, sessionID)
+	if err != nil {
+		return nil, err
+	}
+	if !ok || card == nil || card.SessionID != sessionID || card.UserID != userID ||
+		!card.RequireMediaAuthorization || card.PlanID == "" {
+		return nil, nil
+	}
+	record, err := attempts.GetAttempt(ctx, sessionID)
+	if err != nil {
+		if errors.Is(err, playback.ErrSessionNotFound) {
+			return nil, nil
+		}
+		slog.WarnContext(ctx, "could not read the playback attempt to recover its session",
+			"component", "api", "playback_session_id", sessionID, "error", err)
+		return nil, err
+	}
+	if record == nil || record.StoppedAt != nil || record.CurrentPlanID != card.PlanID ||
+		record.UserID != userID || record.ProfileID != card.ProfileID ||
+		(!record.ExpiresAt.IsZero() && time.Now().After(record.ExpiresAt)) ||
+		!playback.HasFeatureV3(record.NormalizedRequest.ClientFeatures, playback.FeatureHeaderAuthenticatedMediaV3) {
+		return nil, nil
+	}
+	if profileID := apimw.GetProfileID(ctx); profileID != "" && profileID != record.ProfileID {
+		return nil, nil
+	}
+	return card, nil
+}
+
+func (h *PlaybackHandler) storedSessionRecipeV3(ctx context.Context, sessionID string, userID int) (*playback.RecipeCard, error) {
+	return storedSessionRecipeV3(ctx, h.SessionRecipeStore, h.PlanStoreV3, sessionID, userID)
+}
+
+func (h *StreamHandler) storedSessionRecipeV3(ctx context.Context, sessionID string, userID int) (*playback.RecipeCard, error) {
+	return storedSessionRecipeV3(ctx, h.SessionRecipeStore, h.PlanStoreV3, sessionID, userID)
+}
diff --git a/internal/api/handlers/playback_session_recipe_test.go b/internal/api/handlers/playback_session_recipe_test.go
new file mode 100644
index 0000000000..e1c8088e65
--- /dev/null
+++ b/internal/api/handlers/playback_session_recipe_test.go
@@ -0,0 +1,409 @@
+package handlers
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+
+	apimw "github.com/prairie-server/prairie-server/internal/api/middleware"
+	"github.com/prairie-server/prairie-server/internal/auth"
+	"github.com/prairie-server/prairie-server/internal/nodepool"
+	"github.com/prairie-server/prairie-server/internal/playback"
+	"github.com/prairie-server/prairie-server/internal/transcodenode"
+)
+
+// headerAuthRestartFixtureV3 starts a header-authenticated transcode on a
+// pooled node, then stands in for the restarted API: a handler with an empty
+// session manager that shares only what survives a restart (the attempt rows,
+// the Redis recipe stores, the node pool).
+type headerAuthRestartFixtureV3 struct {
+	started   playback.DecisionResponseV3
+	startedOn string
+	other     string
+	nodes     map[string]*httptest.Server
+	attempts  *playback.MemoryPlanStoreV3
+	recipes   *recordingRecipeCardStoreV3
+	configure func(*PlaybackHandler)
+}
+
+func newHeaderAuthRestartFixtureV3(t *testing.T, startOpts ...func(*playback.StartRequestV3)) headerAuthRestartFixtureV3 {
+	t.Helper()
+	newNode := func() *httptest.Server {
+		var node *httptest.Server
+		node = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			switch {
+			case r.Method == http.MethodGet && r.URL.Path == "/hw-capabilities":
+				writeJSON(w, http.StatusOK, playback.HWAccelInfo{Transformations: remoteHLSPlanV3().Transformations})
+			case r.Method == http.MethodPost && r.URL.Path == "/transcode/start":
+				var request transcodenode.TranscodeStartRequest
+				if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+					t.Errorf("decode remote start: %v", err)
+				}
+				writeJSON(w, http.StatusAccepted, transcodenode.TranscodeStartResponse{SessionID: request.SessionID, Status: "started", AudioRecipeVersion: request.AudioRecipeVersion, ThrottleSeconds: request.ThrottleSeconds})
+			case r.Method == http.MethodGet && strings.HasPrefix(r.URL.Path, "/transcode/"):
+				// Name the node in the body so a test can tell which executor served.
+				_, _ = io.WriteString(w, "served-by "+node.URL)
+			default:
+				w.WriteHeader(http.StatusNoContent)
+			}
+		}))
+		t.Cleanup(node.Close)
+		return node
+	}
+	first, second := newNode(), newNode()
+	transcodes := nodepool.NewTranscodePool()
+	transcodes.SetNodes([]*nodepool.Node{
+		{ID: 1, URL: first.URL, Enabled: true, Healthy: true},
+		{ID: 2, URL: second.URL, Enabled: true, Healthy: true},
+	})
+	planner := nodepool.NewPlanner(nodepool.NewProxyPool(), transcodes)
+	file := v3HandlerFixtureFile(t)
+	file.CodecVideo, file.VideoTracks[0].Codec = "mpeg4", "mpeg4"
+	ffmpeg, transcodeDir := writePlaybackTestFFmpeg(t), t.TempDir()
+	f := headerAuthRestartFixtureV3{
+		nodes:    map[string]*httptest.Server{first.URL: first, second.URL: second},
+		attempts: playback.NewMemoryPlanStoreV3(),
+		recipes:  &recordingRecipeCardStoreV3{},
+	}
+	nodeRecipes := &lockedRecipeCardStoreV3{}
+	f.configure = func(handler *PlaybackHandler) {
+		handler.fileResolver = testPlaybackFileResolver{file: file}
+		handler.JWTSecret = "test-secret"
+		handler.SettingsRepo = &mutablePlaybackSettingsV3{values: map[string]string{"transcode_enabled": "true", "allow_4k_transcode": "true"}}
+		handler.ItemAccess = allowAllPlaybackItemAccess{}
+		handler.PlaybackConfig = playbackTestConfig(ffmpeg, transcodeDir)
+		handler.NodePlanner = planner
+		requireWorkerRoutingV3(handler)
+		handler.PlanStoreV3 = f.attempts
+		handler.SessionRecipeStore = f.recipes
+		handler.NodeRecipeStore = nodeRecipes
+		handler.v3Registry = playback.NewTransformationRegistryV3([]playback.TransformationSpecV3{
+			{Name: playback.TransformationAudioToAACV3, RecipeVersion: playback.TransformationAudioToAACRecipeVersionV3, Available: true},
+			{Name: playback.TransformationVideoToH264V3, RecipeVersion: playback.TransformationVideoToH264RecipeVersionV3, Available: true},
+		})
+	}
+	handler := NewPlaybackHandler(playback.NewSessionManager(0, 0))
+	f.configure(handler)
+
+	start := v3HandlerStartRequest()
+	start.ClientFeatures = append(start.ClientFeatures, playback.FeatureHeaderAuthenticatedMediaV3)
+	start.ClientPlaybackContext.Deliveries[playback.DeliveryClassHLSV3] = playback.DeliveryCapabilityV3{Enabled: true, SupportedOnDevice: true}
+	for _, opt := range startOpts {
+		opt(&start)
+	}
+	rr := httptest.NewRecorder()
+	handler.HandleStartPlayback(rr, httptest.NewRequest(http.MethodPost, "/api/v1/playback/start", strings.NewReader(marshalV3StartRequest(t, start))).WithContext(newAuthorizedPlaybackContext()))
+	if rr.Code != http.StatusCreated || json.Unmarshal(rr.Body.Bytes(), &f.started) != nil || f.started.PlaybackPlan == nil {
+		t.Fatalf("start status=%d body=%s", rr.Code, rr.Body.String())
+	}
+	if strings.Contains(f.started.PlaybackPlan.Stream.URL, streamTokenParam+"=") {
+		t.Fatalf("header-authenticated plan URL carries a token: %s", f.started.PlaybackPlan.Stream.URL)
+	}
+	session, err := handler.sessionMgr.GetSession(f.started.SessionID)
+	if err != nil || session.TranscodeNodeURL == "" {
+		t.Fatalf("start did not place the transcode on a node: %#v", session)
+	}
+	f.startedOn, f.other = session.TranscodeNodeURL, second.URL
+	if f.startedOn == second.URL {
+		f.other = first.URL
+	}
+	return f
+}
+
+// restart is the API process after a restart: nothing in memory.
+func (f headerAuthRestartFixtureV3) restart() *PlaybackHandler {
+	handler := NewPlaybackHandler(playback.NewSessionManager(0, 0))
+	f.configure(handler)
+	return handler
+}
+
+func transcodeServeRequestV3(ctx context.Context, sessionID, segment string) *http.Request {
+	path := "/api/v1/playback/transcode/" + sessionID + "/master.m3u8"
+	routeCtx := chi.NewRouteContext()
+	routeCtx.URLParams.Add("session_id", sessionID)
+	if segment != "" {
+		path = "/api/v1/playback/transcode/" + sessionID + "/segment/" + segment
+		routeCtx.URLParams.Add("name", segment)
+	}
+	return httptest.NewRequest(http.MethodGet, path, nil).WithContext(context.WithValue(ctx, chi.RouteCtxKey, routeCtx))
+}
+
+func playbackCallerContextV3(userID int, profileID string) context.Context {
+	ctx := context.Background()
+	if userID != 0 {
+		ctx = apimw.SetClaims(ctx, &auth.Claims{UserID: userID, Role: "user", TokenType: auth.TokenTypeAccess})
+	}
+	if profileID != "" {
+		ctx = apimw.SetProfileID(ctx, profileID)
+	}
+	return ctx
+}
+
+// A header-authenticated session's URLs carry no stream token, so the API
+// restart that every deploy performs used to leave its manifest and segments
+// answering 404 forever (#2495). The owner's next request now rebuilds it from
+// the server-side recovery card, and only the owner's.
+func TestHeaderAuthenticatedTranscodeRecoversAfterAnAPIRestart(t *testing.T) {
+	owner := func() context.Context { return newAuthorizedPlaybackContext() }
+	for _, test := range []struct {
+		name      string
+		mutate    func(t *testing.T, f headerAuthRestartFixtureV3)
+		restarted func(*PlaybackHandler)
+		caller    func() context.Context
+		want      int
+	}{
+		{name: "owner", caller: owner, want: http.StatusOK},
+		{name: "unauthenticated", caller: func() context.Context { return context.Background() }, want: http.StatusNotFound},
+		{name: "another account", caller: func() context.Context { return playbackCallerContextV3(2, "profile-1") }, want: http.StatusNotFound},
+		{name: "another profile of the account", caller: func() context.Context { return playbackCallerContextV3(1, "profile-2") }, want: http.StatusNotFound},
+		{
+			// The attempt row is the authority: a stop that reached Postgres but
+			// never cleared Redis must not let the card rebuild the session.
+			name: "stopped attempt", caller: owner, want: http.StatusNotFound,
+			mutate: func(t *testing.T, f headerAuthRestartFixtureV3) {
+				if _, _, err := f.attempts.StopAttempt(context.Background(), f.started.SessionID, "6f9619ff-8b86-4d01-b42d-00cf4fc964ff", nil); err != nil {
+					t.Fatal(err)
+				}
+			},
+		},
+		{
+			// A replan that committed but failed to overwrite the card leaves
+			// the previous transport's card behind; it must not rebuild that one.
+			name: "card from a superseded plan", caller: owner, want: http.StatusNotFound,
+			mutate: func(t *testing.T, f headerAuthRestartFixtureV3) {
+				card := f.recipes.cards[f.started.SessionID]
+				card.PlanID = "plan:superseded"
+				f.recipes.cards[f.started.SessionID] = card
+			},
+		},
+		{
+			// Redis being unreachable says nothing about the session either.
+			name: "recipe store unavailable", caller: owner, want: http.StatusInternalServerError,
+			mutate: func(_ *testing.T, f headerAuthRestartFixtureV3) {
+				f.recipes.lookupErr = errors.New("dial tcp: connection refused")
+			},
+		},
+		{
+			// The post-deploy reconnect wave can find Postgres busy. That must
+			// read as a retryable failure, not as the session being gone, which
+			// is the answer that makes a client tear playback down.
+			name: "attempt store unavailable", caller: owner, want: http.StatusInternalServerError,
+			restarted: func(h *PlaybackHandler) {
+				h.PlanStoreV3 = unavailableAttemptStoreV3{h.PlanStoreV3}
+			},
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			f := newHeaderAuthRestartFixtureV3(t)
+			if test.mutate != nil {
+				test.mutate(t, f)
+			}
+			restarted := f.restart()
+			if test.restarted != nil {
+				test.restarted(restarted)
+			}
+
+			rr := httptest.NewRecorder()
+			restarted.HandleGetTranscodeManifest(rr, transcodeServeRequestV3(test.caller(), f.started.SessionID, ""))
+			if rr.Code != test.want {
+				t.Fatalf("manifest after restart = %d (%s), want %d", rr.Code, rr.Body.String(), test.want)
+			}
+			if test.want != http.StatusOK {
+				// Refused before anything was registered or started for it.
+				if _, err := restarted.sessionMgr.GetSession(f.started.SessionID); err == nil {
+					t.Fatal("a refused recovery registered the playback session")
+				}
+				return
+			}
+			if body := rr.Body.String(); body != "served-by "+f.startedOn {
+				t.Fatalf("manifest body = %q, want the relay from the node the transcode runs on", body)
+			}
+			rr = httptest.NewRecorder()
+			restarted.HandleGetTranscodeSegment(rr, transcodeServeRequestV3(owner(), f.started.SessionID, "seg_00004.ts"))
+			if rr.Code != http.StatusOK {
+				t.Fatalf("segment after restart = %d (%s)", rr.Code, rr.Body.String())
+			}
+			// The rebuilt session is still header-authenticated: its UUID did not
+			// become a bearer credential on the way back.
+			rr = httptest.NewRecorder()
+			restarted.HandleGetTranscodeSegment(rr, transcodeServeRequestV3(context.Background(), f.started.SessionID, "seg_00005.ts"))
+			if rr.Code != http.StatusUnauthorized {
+				t.Fatalf("unauthenticated segment on the rebuilt session = %d, want 401", rr.Code)
+			}
+		})
+	}
+}
+
+// A client that owns its progress must not have the rebuilt session start
+// writing server-side resume state for it.
+func TestHeaderAuthenticatedRecoveryKeepsAClientOwnedProgressPolicy(t *testing.T) {
+	f := newHeaderAuthRestartFixtureV3(t, func(start *playback.StartRequestV3) {
+		position := 120.0
+		start.ProgressPersistence = playback.ProgressPersistenceClientV3
+		start.StartPosition = &position
+	})
+	restarted := f.restart()
+
+	rr := httptest.NewRecorder()
+	restarted.HandleGetTranscodeManifest(rr, transcodeServeRequestV3(newAuthorizedPlaybackContext(), f.started.SessionID, ""))
+	if rr.Code != http.StatusOK {
+		t.Fatalf("manifest after restart = %d (%s)", rr.Code, rr.Body.String())
+	}
+	session, err := restarted.sessionMgr.GetSession(f.started.SessionID)
+	if err != nil {
+		t.Fatalf("rebuilt session: %v", err)
+	}
+	if !session.DisableProgressPersistence || session.RequestedMediaFileID != 42 {
+		t.Fatalf("rebuilt session progress policy = disabled %v, requested file %d; want the start's client-owned policy and requested file 42",
+			session.DisableProgressPersistence, session.RequestedMediaFileID)
+	}
+}
+
+// After a restart the node the session ran on may be gone too. The move to
+// another node must keep the recovery card on the executor that now runs it,
+// or the next restart sends the session back to the dead node.
+func TestHeaderAuthenticatedRecoveryMovesOffADeadNodeAndRecordsTheMove(t *testing.T) {
+	f := newHeaderAuthRestartFixtureV3(t)
+	f.nodes[f.startedOn].Close()
+	restarted := f.restart()
+
+	rr := httptest.NewRecorder()
+	restarted.HandleGetTranscodeManifest(rr, transcodeServeRequestV3(newAuthorizedPlaybackContext(), f.started.SessionID, ""))
+	if rr.Code != http.StatusOK || rr.Body.String() != "served-by "+f.other {
+		t.Fatalf("manifest after restart with a dead node = %d %q, want the relay from %s", rr.Code, rr.Body.String(), f.other)
+	}
+	card := f.recipes.cards[f.started.SessionID]
+	if card.TranscodeNodeURL != f.other || card.PlanID != f.started.PlaybackPlan.PlanID || !card.RequireMediaAuthorization {
+		t.Fatalf("recovery card after the move = node %q plan %q media-auth %v, want node %q under plan %q",
+			card.TranscodeNodeURL, card.PlanID, card.RequireMediaAuthorization, f.other, f.started.PlaybackPlan.PlanID)
+	}
+}
+
+// Direct play and progressive remux are served by the stream handler, which
+// rebuilds a header-authenticated session the same way.
+func TestHeaderAuthenticatedDirectStreamRecoversAfterAnAPIRestart(t *testing.T) {
+	file := v3HandlerFixtureFile(t)
+	attempts := playback.NewMemoryPlanStoreV3()
+	recipes := &recordingRecipeCardStoreV3{}
+	handler := NewPlaybackHandler(playback.NewSessionManager(0, 0), testPlaybackFileResolver{file: file})
+	handler.JWTSecret = "test-secret"
+	handler.SettingsRepo = &mutablePlaybackSettingsV3{values: map[string]string{"allow_4k_transcode": "true"}}
+	handler.ItemAccess = allowAllPlaybackItemAccess{}
+	handler.PlanStoreV3 = attempts
+	handler.SessionRecipeStore = recipes
+
+	start := v3HandlerStartRequest()
+	start.ClientFeatures = append(start.ClientFeatures, playback.FeatureHeaderAuthenticatedMediaV3)
+	rr := httptest.NewRecorder()
+	handler.HandleStartPlayback(rr, httptest.NewRequest(http.MethodPost, "/api/v1/playback/start", strings.NewReader(marshalV3StartRequest(t, start))).WithContext(newAuthorizedPlaybackContext()))
+	var started playback.DecisionResponseV3
+	if rr.Code != http.StatusCreated || json.Unmarshal(rr.Body.Bytes(), &started) != nil || started.PlaybackPlan == nil ||
+		started.PlaybackPlan.Delivery != playback.DeliveryOriginalHTTPV3 {
+		t.Fatalf("start status=%d body=%s", rr.Code, rr.Body.String())
+	}
+
+	manager := playback.NewSessionManager(0, 0)
+	restarted := NewPlaybackHandler(manager, testPlaybackFileResolver{file: file})
+	stream := NewStreamHandler(manager, testPlaybackFileResolver{file: file})
+	stream.TM = restarted.TranscodeManager()
+	stream.PlanStoreV3 = attempts
+	stream.SessionRecipeStore = recipes
+
+	routeCtx := chi.NewRouteContext()
+	routeCtx.URLParams.Add("session_id", started.SessionID)
+	request := httptest.NewRequest(http.MethodGet, started.PlaybackPlan.Stream.URL, nil).
+		WithContext(context.WithValue(newAuthorizedPlaybackContext(), chi.RouteCtxKey, routeCtx))
+	rr = httptest.NewRecorder()
+	stream.HandleStream(rr, request)
+	if rr.Code != http.StatusOK || rr.Body.Len() == 0 {
+		t.Fatalf("direct stream after restart = %d (%s), want the file bytes", rr.Code, rr.Body.String())
+	}
+}
+
+// lockedRecipeCardStoreV3 is a recipe store safe for the goroutine that writes
+// a moved transport's node recipe after the move has returned.
+type lockedRecipeCardStoreV3 struct {
+	mu    sync.Mutex
+	inner recordingRecipeCardStoreV3
+}
+
+func (s *lockedRecipeCardStoreV3) Enabled() bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.inner.Enabled()
+}
+
+// unavailableAttemptStoreV3 is an attempt store whose reads fail the way a
+// saturated or failing-over Postgres does.
+type unavailableAttemptStoreV3 struct {
+	playback.PlanStoreV3
+}
+
+func (unavailableAttemptStoreV3) GetAttempt(context.Context, string) (*playback.AttemptRecordV3, error) {
+	return nil, errors.New("connection reset by peer")
+}
+
+func (s *lockedRecipeCardStoreV3) Get(ctx context.Context, key string) (*playback.RecipeCard, bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.inner.Get(ctx, key)
+}
+
+func (s *lockedRecipeCardStoreV3) Put(ctx context.Context, key string, card playback.RecipeCard) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.inner.Put(ctx, key, card)
+}
+
+func (s *lockedRecipeCardStoreV3) Delete(ctx context.Context, key string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.inner.Delete(ctx, key)
+}
+
+// An FFmpeg exit or a copy-safety stop tears the session down without ending
+// the attempt, so the client's next request rebuilds it, as a stream token
+// would. A user's stop retires the recovery card, and so does any teardown of
+// a remote transcode, whose node job and node recipe go with it.
+func TestSessionRecipeRetentionOnStop(t *testing.T) {
+	node := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { w.WriteHeader(http.StatusNoContent) }))
+	t.Cleanup(node.Close)
+	for _, test := range []struct {
+		name          string
+		userInitiated bool
+		nodeURL       string
+		wantDeleted   bool
+	}{
+		{name: "system teardown", userInitiated: false, wantDeleted: false},
+		{name: "user stop", userInitiated: true, wantDeleted: true},
+		// The teardown stops the node job and drops its recipe, so the card
+		// could only rebuild a session the node no longer serves.
+		{name: "system teardown of a remote transcode", userInitiated: false, nodeURL: node.URL, wantDeleted: true},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			manager := playback.NewSessionManager(0, 0)
+			manager.RegisterReconstructed(&playback.Session{ID: "session-recipe-stop", UserID: 1, ProfileID: "profile-1", PlayMethod: playback.PlayTranscode, RequireMediaAuthorization: true,
+				TranscodeNodeURL: test.nodeURL, TranscodeTransportID: "session-recipe-stop-transport"})
+			handler := NewPlaybackHandler(manager)
+			recipes := &recordingRecipeCardStoreV3{cards: map[string]playback.RecipeCard{
+				"session-recipe-stop": {SessionID: "session-recipe-stop", UserID: 1, PlanID: "plan:current", RequireMediaAuthorization: true},
+			}}
+			handler.SessionRecipeStore = recipes
+
+			if err := handler.stopPlaybackSessionByID(context.Background(), "session-recipe-stop", test.userInitiated); err != nil {
+				t.Fatalf("stop: %v", err)
+			}
+			if deleted := len(recipes.deleted) == 1 && recipes.deleted[0] == "session-recipe-stop"; deleted != test.wantDeleted {
+				t.Fatalf("session recipes deleted = %v, want deleted %v", recipes.deleted, test.wantDeleted)
+			}
+		})
+	}
+}
diff --git a/internal/api/handlers/playback_transcode_rehome.go b/internal/api/handlers/playback_transcode_rehome.go
new file mode 100644
index 0000000000..4e205dd31f
--- /dev/null
+++ b/internal/api/handlers/playback_transcode_rehome.go
@@ -0,0 +1,647 @@
+package handlers
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net"
+	"net/http"
+	"strings"
+	"syscall"
+
+	"github.com/prairie-server/prairie-server/internal/logredact"
+	"github.com/prairie-server/prairie-server/internal/nodepool"
+	"github.com/prairie-server/prairie-server/internal/noderouting"
+	"github.com/prairie-server/prairie-server/internal/playback"
+	"github.com/prairie-server/prairie-server/internal/tonemap"
+	"github.com/prairie-server/prairie-server/internal/transcodenode"
+)
+
+// A transcode whose node dies mid-stream is moved, not failed.
+//
+// When this server relays a remote transcode (API egress) and the relay cannot
+// reach the session's transcode node, the transcode is rebuilt from the same
+// recipe on another executor — another pooled transcode node, or this process
+// when policy lets the API execute — and the request is served from there. The
+// client keeps its URLs: they name the playback session, never the node, and
+// the transport identity the node serves under does not change either.
+//
+// The boundary is deliberate. Only a relay that never got an HTTP response
+// counts: a refused or failed connection, or any transport failure while the
+// pool already lists the node as unhealthy or no longer has it. A node that
+// answers with an HTTP error is alive, and its answer is relayed as before.
+// Sessions whose media URLs point at a proxy origin are not relayed here; they
+// keep the replan-and-remint rule for failover.
+
+// errTranscodeNodeUnreachable marks a relay that never reached its transcode
+// node, so nothing was written to the client.
+var errTranscodeNodeUnreachable = errors.New("transcode node unreachable")
+
+var (
+	errRehomeRecipeUnavailable = errors.New("no recipe to rebuild the transcode from")
+	errRehomeCopyUnsafe        = errors.New("stream-copy recipe is no longer safe to revive")
+)
+
+// maxRehomeAttemptsV3 bounds how many executors one move tries. Each failed
+// executor is excluded from the next selection, so the bound only matters in a
+// large pool where many nodes reject the recipe.
+const maxRehomeAttemptsV3 = 8
+
+type transcodeExecutorMoverV3 interface {
+	MoveTranscodeExecutor(sessionID string, expected playback.TranscodeRoute, move playback.TranscodeExecutorMove) (bool, error)
+}
+
+type sessionReservationHandleReleaserV3 interface {
+	ReleaseReservation(sessionID string, held nodepool.Reservation)
+}
+
+type transcodeNodeHealthMarkerV3 interface {
+	MarkTranscodeNodeUnreachable(nodeURL string) bool
+}
+
+type transcodeNodeHealthReaderV3 interface {
+	TranscodeNodeHealthy(nodeURL string) bool
+}
+
+// transcodeNodeUnreachable reports whether a relay transport error means the
+// node is gone rather than slow or mid-response. A connection that could not be
+// opened always counts. Any other transport failure counts only when the pool
+// already lists the node as unhealthy or no longer pools it.
+func (h *PlaybackHandler) transcodeNodeUnreachable(nodeURL string, err error) bool {
+	if isConnectFailure(err) {
+		return true
+	}
+	if reader, ok := h.NodePlanner.(transcodeNodeHealthReaderV3); ok {
+		return !reader.TranscodeNodeHealthy(nodeURL)
+	}
+	return false
+}
+
+// netOpDial is the net.OpError operation for opening a connection.
+const netOpDial = "dial"
+
+// isConnectFailure reports whether err happened while opening the connection,
+// before any request byte reached the node. A dial this process could not even
+// attempt (out of file descriptors or socket buffers, no local address) says
+// nothing about the node and does not count.
+func isConnectFailure(err error) bool {
+	if isLocalSocketFailure(err) {
+		return false
+	}
+	var opErr *net.OpError
+	if errors.As(err, &opErr) && opErr.Op == netOpDial {
+		return true
+	}
+	var dnsErr *net.DNSError
+	if errors.As(err, &dnsErr) {
+		return true
+	}
+	return errors.Is(err, syscall.ECONNREFUSED)
+}
+
+// isLocalSocketFailure reports a dial that failed on this host's own resources.
+// Go reports these as a dial OpError, the same shape as a refused connection.
+func isLocalSocketFailure(err error) bool {
+	return errors.Is(err, syscall.EMFILE) || errors.Is(err, syscall.ENFILE) ||
+		errors.Is(err, syscall.EADDRNOTAVAIL) || errors.Is(err, syscall.ENOBUFS)
+}
+
+// isTerminalToneMapMoveError reports a tone-map refusal about the source file
+// itself, which every executor would repeat: the move stops trying and the
+// client gets the documented terminal answer instead of a retryable 502.
+func isTerminalToneMapMoveError(err error) bool {
+	return errors.Is(err, tonemap.ErrSourceRevisionChanged) || errors.Is(err, tonemap.ErrSourcePreflightRejected)
+}
+
+// relayOrRehomeTranscode serves a manifest or segment request for a transcode
+// that runs on a transcode node and leaves through this server. suffix is the
+// node route after the transport id ("/master.m3u8" or "/segment/<name>").
+//
+// It returns served=true once a response has been written. Otherwise the
+// transcode now runs in this process and the caller serves the returned runtime
+// through its ordinary local path.
+func (h *PlaybackHandler) relayOrRehomeTranscode(
+	w http.ResponseWriter,
+	r *http.Request,
+	session *playback.Session,
+	card *playback.RecipeCard,
+	requestedSegment int,
+	suffix string,
+) (*playback.TranscodeSession, bool) {
+	err := h.relayToTranscodeNode(w, r, session.TranscodeNodeURL, "/transcode/"+remoteTransportID(session)+suffix)
+	if err == nil {
+		return nil, true
+	}
+	if marker, ok := h.NodePlanner.(transcodeNodeHealthMarkerV3); ok && marker.MarkTranscodeNodeUnreachable(session.TranscodeNodeURL) {
+		slog.WarnContext(r.Context(), "transcode node marked unhealthy after the relay could not reach it",
+			"component", "api", "node", logredact.SanitizeURL(session.TranscodeNodeURL), "playback_session_id", session.ID)
+	}
+	dead := playback.TranscodeRoute{NodeURL: session.TranscodeNodeURL, TransportID: session.TranscodeTransportID}
+	if card == nil {
+		// A live session is served without decoding its token, so the recipe the
+		// client carries has not been read yet.
+		card, _ = verifiedStreamCardFromToken(r.URL.Query().Get(streamTokenParam), session.ID, h.JWTSecret)
+	}
+	moveErr := h.tm.RehomeTranscode(r.Context(), session.ID, func(ctx context.Context) error {
+		return h.moveTranscodeOffNodeV3(ctx, session.ID, dead, card, requestedSegment)
+	})
+	if errors.Is(moveErr, errRehomeCopyUnsafe) {
+		writePlaybackSessionNotFound(w)
+		return nil, true
+	}
+	if moveErr != nil {
+		slog.WarnContext(r.Context(), "could not move the transcode off an unreachable node",
+			"component", "api", "node", logredact.SanitizeURL(dead.NodeURL), "playback_session_id", session.ID, "error", logredact.SanitizeText(moveErr.Error()))
+		if !writePlaybackToneMapExecutionError(w, moveErr) {
+			writeTranscodeNodeUnavailable(w)
+		}
+		return nil, true
+	}
+
+	// Serve from wherever the transcode runs now. This request may have joined
+	// a move another request led, or found the session already moved.
+	if runtime := h.tm.GetTranscodeSession(session.ID); runtime != nil {
+		return runtime, false
+	}
+	current, getErr := h.sessionMgr.GetSession(session.ID)
+	if getErr != nil || current.TranscodeNodeURL == "" ||
+		(current.TranscodeNodeURL == dead.NodeURL && current.TranscodeTransportID == dead.TransportID) {
+		writeTranscodeNodeUnavailable(w)
+		return nil, true
+	}
+	if err := h.relayToTranscodeNode(w, r, current.TranscodeNodeURL, "/transcode/"+remoteTransportID(current)+suffix); err != nil {
+		writeTranscodeNodeUnavailable(w)
+	}
+	return nil, true
+}
+
+// moveTranscodeOffNodeV3 rebuilds a session's transcode on a reachable
+// executor. It returns nil when the session no longer runs on the dead route,
+// whether this call moved it or something else did first.
+func (h *PlaybackHandler) moveTranscodeOffNodeV3(
+	ctx context.Context,
+	sessionID string,
+	dead playback.TranscodeRoute,
+	tokenCard *playback.RecipeCard,
+	requestedSegment int,
+) error {
+	mover, ok := h.sessionMgr.(transcodeExecutorMoverV3)
+	if !ok {
+		return errors.New("session manager cannot move a transcode")
+	}
+	session, err := h.sessionMgr.GetSession(sessionID)
+	if err != nil {
+		return err
+	}
+	if session.TranscodeNodeURL != dead.NodeURL || session.TranscodeTransportID != dead.TransportID {
+		return nil
+	}
+	transportID := remoteTransportID(session)
+	card, fromStore := h.rehomeRecipeCardV3(ctx, session, transportID, tokenCard)
+	if card == nil {
+		return errRehomeRecipeUnavailable
+	}
+	// Moving a stream-copy recipe revives it on a new executor, so it answers
+	// to the same persisted copy-safety verdict as any other revival.
+	if videoCopyReconstructRefused(ctx, h.fileResolver, h.CopySafetyRacer, card) {
+		return errRehomeCopyUnsafe
+	}
+
+	workload, delivery := noderouting.WorkloadVideoTranscode, noderouting.DeliveryHLSVideo
+	if card.VideoStreamCopy() {
+		workload, delivery = noderouting.WorkloadRemux, noderouting.DeliveryHLSRemux
+	}
+	// The moved transport continues the same timeline under the same URLs, so
+	// its executor must run the same recipe versions a fresh start of this
+	// plan would require: the same capability filter applies.
+	plan := h.rehomePlanV3(ctx, session, card)
+	capable := h.transcodeEligibilityV3(ctx, plan, nil)
+	excludedNodes := map[string]struct{}{nodepool.NormalizeNodeURL(dead.NodeURL): {}}
+	excludedShapes := map[string]struct{}{}
+	eligible := func(node *nodepool.Node) bool {
+		if node == nil {
+			return false
+		}
+		if _, skip := excludedNodes[nodepool.NormalizeNodeURL(node.URL)]; skip {
+			return false
+		}
+		return capable == nil || capable(node)
+	}
+	var lastErr error
+	for range maxRehomeAttemptsV3 {
+		// An expired move must not count as one executor's refusal: return it
+		// without excluding or stopping anything.
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+		// The client fetches media from this server and keeps doing so, so only
+		// API-egress shapes are candidates; the policy still decides between a
+		// worker and this process, and a hard execution boundary is never crossed.
+		decision, resolveErr := noderouting.Resolve(noderouting.AdaptSessionPlanner(h.NodePlanner), noderouting.ResolveRequest{
+			Request: noderouting.Request{
+				Workload: workload, Delivery: delivery, Policy: h.playbackRoutingPolicyV3(), ProxyAllowed: false,
+			},
+			SessionID:            sessionID,
+			EstimatedBitrateKbps: card.TargetBitrateKbps,
+			TranscodeEligible:    eligible,
+			ExcludedShapeIDs:     excludedShapes,
+		})
+		if resolveErr != nil {
+			return resolveErr
+		}
+		if !decision.Selected() {
+			if lastErr != nil {
+				return fmt.Errorf("%s: %w", decision.Outcome, lastErr)
+			}
+			return fmt.Errorf("no executor for the transcode: %s", decision.Outcome)
+		}
+		if decision.Shape.Execution == noderouting.ExecutionAPI {
+			moveErr := h.moveTranscodeToLocalV3(ctx, mover, session, dead, *card, plan, fromStore, requestedSegment)
+			if moveErr == nil {
+				return nil
+			}
+			if ctx.Err() != nil || isTerminalToneMapMoveError(moveErr) {
+				return moveErr
+			}
+			lastErr = moveErr
+			excludedShapes[decision.Shape.ID] = struct{}{}
+			continue
+		}
+		node := decision.Plan.TranscodeNode
+		moveErr := h.moveTranscodeToNodeV3(ctx, mover, session, dead, *card, plan, fromStore, node, decision.Plan.Reservation, requestedSegment)
+		if moveErr == nil {
+			return nil
+		}
+		h.releaseMoveReservationV3(sessionID, decision.Plan.Reservation)
+		if ctx.Err() != nil || isTerminalToneMapMoveError(moveErr) {
+			return moveErr
+		}
+		slog.WarnContext(ctx, "transcode node rejected a moved transcode", "component", "api",
+			"node", logredact.SanitizeURL(node.URL), "playback_session_id", sessionID, "error", logredact.SanitizeText(moveErr.Error()))
+		if isConnectFailure(moveErr) {
+			// A candidate that cannot be reached is as dead as the node the
+			// session left: keep every other move from trying it too.
+			if marker, ok := h.NodePlanner.(transcodeNodeHealthMarkerV3); ok {
+				marker.MarkTranscodeNodeUnreachable(node.URL)
+			}
+		}
+		excludedNodes[nodepool.NormalizeNodeURL(node.URL)] = struct{}{}
+		lastErr = moveErr
+	}
+	return fmt.Errorf("every executor refused the transcode: %w", lastErr)
+}
+
+// rehomePlanV3 is the planner result whose capability requirements the moved
+// transport must keep meeting: the session's current v3 plan, with the
+// tone-map identity and subtitle rendition the recipe froze. A session with no
+// recorded plan (the protocol store is absent or lost it) has no plan, which
+// applies no other capability filter, as at that session's own start.
+func (h *PlaybackHandler) rehomePlanV3(ctx context.Context, session *playback.Session, card *playback.RecipeCard) playback.PlannerResultV3 {
+	result := playback.PlannerResultV3{ToneMapMode: card.ToneMapMode, ToneMapSourceKind: card.ToneMapSourceKind, SubtitleRendition: card.SubtitleRendition}
+	if h.PlanStoreV3 == nil {
+		return result
+	}
+	record, err := h.PlanStoreV3.GetAttempt(ctx, session.ID)
+	if err != nil || record == nil {
+		return result
+	}
+	plan := record.CurrentPlan
+	result.Plan = &plan
+	return result
+}
+
+// rehomeRecipeCardV3 finds the recipe of the transport being moved: the one the
+// client carries in its stream token, or, for a session whose URLs carry no
+// token, the one stored for the node to rebuild from. The second result is true
+// when the card came from the store, which then has to follow the move.
+func (h *PlaybackHandler) rehomeRecipeCardV3(
+	ctx context.Context,
+	session *playback.Session,
+	transportID string,
+	tokenCard *playback.RecipeCard,
+) (*playback.RecipeCard, bool) {
+	if tokenCard != nil && rehomeRecipeServesV3(*tokenCard, session, transportID) {
+		card := *tokenCard
+		return &card, false
+	}
+	if h.NodeRecipeStore != nil && h.NodeRecipeStore.Enabled() {
+		if stored, ok := h.NodeRecipeStore.Get(ctx, transportID); ok && stored != nil && rehomeRecipeServesV3(*stored, session, transportID) {
+			card := *stored
+			return &card, true
+		}
+	}
+	return nil, false
+}
+
+// rehomeRecipeServesV3 accepts only a complete transcode recipe for exactly the
+// transport the session runs now and for the session's owner. A token minted
+// for an earlier plan names another transport and is ignored.
+func rehomeRecipeServesV3(card playback.RecipeCard, session *playback.Session, transportID string) bool {
+	cardTransport := card.TranscodeTransportID
+	if cardTransport == "" {
+		cardTransport = card.SessionID
+	}
+	return card.SessionID == session.ID && card.UserID == session.UserID && cardTransport == transportID &&
+		card.IsTranscodeRecipe() && playback.ValidateCopyFMP4RecipeCard(card) == nil &&
+		card.InputPath != "" && card.SegmentDuration > 0 && card.TargetCodecVideo != ""
+}
+
+// moveTranscodeToLocalV3 rebuilds the transport in this process through the
+// same reconstruction a restart uses, then points the session at it.
+func (h *PlaybackHandler) moveTranscodeToLocalV3(
+	ctx context.Context,
+	mover transcodeExecutorMoverV3,
+	session *playback.Session,
+	dead playback.TranscodeRoute,
+	card playback.RecipeCard,
+	plan playback.PlannerResultV3,
+	fromStore bool,
+	requestedSegment int,
+) error {
+	if capabilityErr := h.validateLocalTransportCapabilitiesV3(ctx, plan); capabilityErr != nil {
+		return capabilityErr
+	}
+	local := card
+	local.TranscodeNodeURL = ""
+	// The dead node's resolved backends describe its hardware, not this host's.
+	// Reconstruction resolves them again from the live configuration.
+	local.HWAccel, local.EncoderHWAccel, local.HWDevice, local.ToneMapFilter = "", "", "", ""
+	if local.RoutingWorkload != "" {
+		local.RoutingExecution = string(noderouting.ExecutionAPI)
+		local.RoutingExecutionNodeID = 0
+	}
+	runtime, err := h.tm.ReconstructTranscodeWithError(ctx, session.ID, requestedSegment, local)
+	if runtime == nil {
+		if err == nil {
+			err = errors.New("the transcode could not be rebuilt on this server")
+		}
+		return err
+	}
+	moved, err := mover.MoveTranscodeExecutor(session.ID, dead, playback.TranscodeExecutorMove{
+		Execution:        string(noderouting.ExecutionAPI),
+		TranscodeHWAccel: runtime.Opts().EffectiveEncoderHWAccel(),
+	})
+	if err != nil || !moved {
+		// The session left the dead route while this ran. A local runtime is
+		// only stale when the session now runs on a node; a local successor owns
+		// the slot otherwise and must be left alone.
+		if current, getErr := h.sessionMgr.GetSession(session.ID); getErr != nil || current.TranscodeNodeURL != "" {
+			h.tm.CloseTranscodeSessionIf(session.ID, runtime, "")
+		}
+		return err
+	}
+	if fromStore {
+		// The stored card rebuilt a node transport; a local one never reads it.
+		h.deleteNodeRecipeV3(ctx, remoteTransportID(session))
+		h.followSessionRecipeMoveV3(ctx, session.ID, local)
+	}
+	h.retireUnreachableTransportV3(ctx, dead.NodeURL, remoteTransportID(session), nil)
+	slog.WarnContext(ctx, "moved a transcode off an unreachable node", "component", "api",
+		"from_node", logredact.SanitizeURL(dead.NodeURL), "executor", "api",
+		"playback_session_id", session.ID, "requested_segment", requestedSegment)
+	return nil
+}
+
+// moveTranscodeToNodeV3 starts the same transport on another transcode node and
+// points the session at it once the node has accepted it.
+func (h *PlaybackHandler) moveTranscodeToNodeV3(
+	ctx context.Context,
+	mover transcodeExecutorMoverV3,
+	session *playback.Session,
+	dead playback.TranscodeRoute,
+	card playback.RecipeCard,
+	plan playback.PlannerResultV3,
+	fromStore bool,
+	node *nodepool.Node,
+	reservation nodepool.Reservation,
+	requestedSegment int,
+) error {
+	transportID := remoteTransportID(session)
+	// Re-check the selected node against the plan with a fresh inventory, as a
+	// fresh start does: the filter above may have read a cached one.
+	if planRequiresServerTransformationsV3(plan.Plan) {
+		transformations, err := h.remoteTransformationsV3(ctx, node.URL)
+		if err == nil {
+			err = validateAdvertisedTransformationsV3(plan.Plan, transformations)
+		}
+		if err != nil {
+			return err
+		}
+	}
+	hwAccel := node.EffectiveHWAccel(h.playbackConfig().HWAccel)
+	toneMapFilter := ""
+	if card.ToneMapMode != "" {
+		capabilities, err := h.remoteToneMapCapabilitiesV3(ctx, node.URL, false)
+		if err != nil {
+			return err
+		}
+		if !capabilities.Supports(card.ToneMapMode, card.ToneMapSourceKind) {
+			return fmt.Errorf("node lacks %s %s tone mapping", card.ToneMapMode, card.ToneMapSourceKind)
+		}
+		toneMapFilter = capabilities.FilterFor(card.ToneMapMode, card.ToneMapSourceKind)
+		hwAccel = playback.HWAccelNone
+		if card.ToneMapMode == tonemap.ModeHardware {
+			hwAccel = capabilities.BackendFor(card.ToneMapMode, card.ToneMapSourceKind)
+		}
+	}
+	req := rehomeStartRequestV3(card, transportID, hwAccel, requestedSegment)
+
+	var response transcodenode.TranscodeStartResponse
+	var status int
+	err := h.tm.WithReconstructSlot(ctx, func() error {
+		var startErr error
+		response, status, startErr = h.startRemotePlaybackTransport(ctx, node.URL, req)
+		return startErr
+	})
+	if err == nil && status != http.StatusAccepted {
+		err = fmt.Errorf("transcode node answered start with status %d", status)
+	}
+	if err == nil {
+		err = errors.Join(
+			transcodenode.ValidateAudioRecipeAttestation(req, response),
+			transcodenode.ValidateCopyFMP4RecipeAttestation(req, response),
+			transcodenode.ValidateThrottleAttestation(req, response),
+			transcodenode.ValidateSubtitleRenditionAttestation(req, response),
+		)
+	}
+	if err == nil && req.ToneMapMode != "" && response.ToneMapMode != req.ToneMapMode {
+		err = errors.New("transcode node did not confirm the tone-map recipe")
+	}
+	if err != nil {
+		// A start that timed out may still have begun; stopping is harmless when
+		// it did not.
+		h.rollBackMovedStartV3(ctx, session.ID, dead.NodeURL, transportID, node.URL, card, fromStore)
+		return err
+	}
+
+	// Commit under the session lifecycle lock, which a replan holds from
+	// reading the route it replaces until it commits: either the replan sees
+	// this move and stops the transport on its new node, or this compare-and-
+	// swap sees the replan and fails.
+	unlock := h.tm.LockSessionLifecycle(session.ID)
+	moved, err := mover.MoveTranscodeExecutor(session.ID, dead, playback.TranscodeExecutorMove{
+		NodeURL:          node.URL,
+		Execution:        string(noderouting.ExecutionTranscode),
+		ExecutionNodeID:  node.ID,
+		TranscodeHWAccel: firstNonEmptyHandlerV3(strings.TrimSpace(response.EncoderHWAccel), strings.TrimSpace(response.HWAccel), req.HWAccel),
+	})
+	unlock()
+	if err != nil || !moved {
+		// The route changed under the move: give back the planner reservation
+		// Resolve made on this node along with the job.
+		h.releaseMoveReservationV3(session.ID, reservation)
+		h.tm.StopRemoteTranscode(transportID, node.URL)
+		return err
+	}
+	if fromStore {
+		// The session's URLs carry no recipe, so the node rebuilds from the store
+		// after its own restart. The stored card has to name its new executor.
+		next := card
+		next.TranscodeNodeURL = node.URL
+		if next.RoutingWorkload != "" {
+			next.RoutingExecutionNodeID = node.ID
+		}
+		next.HWAccel = firstNonEmptyHandlerV3(strings.TrimSpace(response.HWAccel), req.HWAccel)
+		next.EncoderHWAccel = strings.TrimSpace(response.EncoderHWAccel)
+		next.SoftwareVideoDecode = req.SoftwareVideoDecode || response.SoftwareVideoDecode
+		next.ToneMapFilter = toneMapFilter
+		// The old node deletes this transport's stored recipe when the retire
+		// reaches it, so the new card is written only after that.
+		h.retireUnreachableTransportV3(ctx, dead.NodeURL, transportID, func(ctx context.Context) {
+			h.putNodeRecipeIfRouteV3(ctx, session.ID, playback.TranscodeRoute{NodeURL: node.URL, TransportID: transportID}, next)
+		})
+		h.followSessionRecipeMoveV3(ctx, session.ID, next)
+	} else {
+		h.retireUnreachableTransportV3(ctx, dead.NodeURL, transportID, nil)
+	}
+	slog.WarnContext(ctx, "moved a transcode off an unreachable node", "component", "api",
+		"from_node", logredact.SanitizeURL(dead.NodeURL), "executor", "transcode_node",
+		"to_node", logredact.SanitizeURL(node.URL), "playback_session_id", session.ID,
+		"requested_segment", requestedSegment, "start_segment_number", req.StartSegmentNumber)
+	return nil
+}
+
+// rehomeStartRequestV3 is the node start request for a moved transport: the
+// recipe exactly as recorded, resumed where a reconstruction would resume it.
+func rehomeStartRequestV3(card playback.RecipeCard, transportID, hwAccel string, requestedSegment int) transcodenode.TranscodeStartRequest {
+	req := transcodenode.TranscodeStartRequest{
+		SessionID:                  transportID,
+		InputPath:                  card.InputPath,
+		SourceVideoCodec:           card.SourceVideoCodec,
+		SourceVideoProfile:         card.SourceVideoProfile,
+		SourceVideoBitDepth:        card.SourceVideoBitDepth,
+		SourceAudioChannels:        card.SourceAudioChannels,
+		CopyFMP4RecipeVersion:      card.CopyFMP4RecipeVersion,
+		SoftwareVideoDecode:        card.SoftwareVideoDecode,
+		ToneMapPolicy:              card.ToneMapPolicy,
+		ToneMapMode:                card.ToneMapMode,
+		ToneMapSourceKind:          card.ToneMapSourceKind,
+		ToneMapRecipeVersion:       card.ToneMapRecipeVersion,
+		ToneMapPreflightRequired:   card.ToneMapPreflightRequired,
+		ToneMapSourceRevision:      card.ToneMapSourceRevision,
+		ToneMapDVConfigPresent:     card.ToneMapDVConfigPresent,
+		ToneMapDVBLCompatIDPresent: card.ToneMapDVBLCompatIDPresent,
+		ToneMapDVBLPresent:         card.ToneMapDVBLPresent,
+		ToneMapDVRPUPresent:        card.ToneMapDVRPUPresent,
+		VideoBitstreamFilter:       card.VideoBitstreamFilter,
+		VideoSampleEntry:           card.VideoSampleEntry,
+		CopyVideoMPEGTS:            card.CopyVideoMPEGTS,
+		SeekSeconds:                card.SeekSeconds,
+		StreamOriginSeconds:        card.StreamOriginSeconds,
+		CopySeekAnchorResolved:     card.CopySeekAnchorResolved,
+		StartSegmentNumber:         card.StartSegmentNumber,
+		TargetResolution:           card.TargetResolution,
+		TargetCodecVideo:           card.TargetCodecVideo,
+		TargetCodecAudio:           card.TargetCodecAudio,
+		TargetAudioChannels:        card.TargetAudioChannels,
+		TargetAudioBitrateKbps:     card.TargetAudioBitrateKbps,
+		TargetBitrateKbps:          card.TargetBitrateKbps,
+		SegmentDuration:            card.SegmentDuration,
+		HWAccel:                    hwAccel,
+		AudioTrackIndex:            card.AudioTrackIndex,
+		SubtitleTrackIndex:         card.SubtitleTrackIndex,
+		SubtitleBurnIn:             card.SubtitleBurnIn,
+		SubtitleCodec:              card.SubtitleCodec,
+		SubtitleRendition:          card.SubtitleRendition,
+		TotalDuration:              card.TotalDuration,
+		ThrottleSeconds:            card.ThrottleSeconds,
+		RequireReady:               true,
+	}
+	if segment, seekSeconds, ok := playback.ReconstructResumePoint(card, requestedSegment); ok {
+		req.StartSegmentNumber = segment
+		req.SeekSeconds = seekSeconds
+	}
+	if playback.IsAudioToAACStereoDownmixV3(req.SourceAudioChannels, req.TargetCodecAudio, req.TargetAudioChannels) {
+		req.TargetAudioChannels = 2
+		req.AudioRecipeVersion = playback.TransformationAudioToAACRecipeVersionV3
+	} else {
+		// SourceAudioChannels is a v2 recipe field at the node boundary; an
+		// ordinary encode must not carry it, exactly as at a fresh start.
+		req.SourceAudioChannels = 0
+	}
+	return req
+}
+
+// rollBackMovedStartV3 stops a start a candidate node refused or failed to
+// confirm. The stop makes the node delete the transport's stored recipe, which
+// a move for a tokenless session read its card from, so that card is written
+// back before the next candidate is tried. Without a stored card the stop is
+// not waited on. transportID is the resolved transport id (remoteTransportID),
+// which a legacy session's empty route field does not name.
+func (h *PlaybackHandler) rollBackMovedStartV3(ctx context.Context, sessionID, deadNodeURL, transportID, nodeURL string, card playback.RecipeCard, fromStore bool) {
+	if !fromStore {
+		go h.tm.StopRemoteTranscode(transportID, nodeURL)
+		return
+	}
+	h.tm.StopRemoteTranscode(transportID, nodeURL)
+	h.putNodeRecipeIfRouteV3(context.WithoutCancel(ctx), sessionID, playback.TranscodeRoute{NodeURL: deadNodeURL, TransportID: transportID}, card)
+}
+
+// putNodeRecipeIfRouteV3 writes a transport's stored recipe only while the
+// session still runs route. It holds the session lifecycle lock, under which a
+// stop or a replan deletes the recipe of the transport it ends, so a write
+// that lands after either cannot bring a stopped transport's recipe back.
+// route.TransportID is the resolved transport id, the store key, never the
+// empty route field of a legacy session.
+func (h *PlaybackHandler) putNodeRecipeIfRouteV3(ctx context.Context, sessionID string, route playback.TranscodeRoute, card playback.RecipeCard) {
+	unlock := h.tm.LockSessionLifecycle(sessionID)
+	defer unlock()
+	current, err := h.sessionMgr.GetSession(sessionID)
+	if err != nil || current.TranscodeNodeURL != route.NodeURL || remoteTransportID(current) != route.TransportID {
+		return
+	}
+	h.putNodeRecipeV3(ctx, route.TransportID, card)
+}
+
+// releaseMoveReservationV3 gives back the reservation Resolve made for a move,
+// leaving alone one a concurrent replan has since made for the same session,
+// on any node.
+func (h *PlaybackHandler) releaseMoveReservationV3(sessionID string, held nodepool.Reservation) {
+	if releaser, ok := h.NodePlanner.(sessionReservationHandleReleaserV3); ok {
+		releaser.ReleaseReservation(sessionID, held)
+		return
+	}
+	if releaser, ok := h.NodePlanner.(sessionReservationReleaserV3); ok {
+		releaser.ReleaseSession(sessionID)
+	}
+}
+
+// retireUnreachableTransportV3 asks the node the transport left to drop it, in
+// case the node is only unreachable from here and still running FFmpeg. A dead
+// node refuses the connection at once; the answer is not waited on. after, when
+// set, runs once the request has finished either way.
+func (h *PlaybackHandler) retireUnreachableTransportV3(ctx context.Context, nodeURL, transportID string, after func(context.Context)) {
+	detached := context.WithoutCancel(ctx)
+	go func() {
+		if err := h.tm.CancelRemoteTranscode(detached, transportID, nodeURL); err != nil {
+			// Expected when the node is down. When it is only unreachable from
+			// here, its FFmpeg keeps running until the node's idle reaper ends it.
+			slog.WarnContext(detached, "could not stop the transcode on the node it moved off; the node's idle reaper will end it if it still runs",
+				"component", "api", "node", logredact.SanitizeURL(nodeURL), "transport", transportID, "error", logredact.SanitizeText(err.Error()))
+		}
+		if after != nil {
+			after(detached)
+		}
+	}()
+}
diff --git a/internal/api/handlers/playback_transcode_rehome_test.go b/internal/api/handlers/playback_transcode_rehome_test.go
new file mode 100644
index 0000000000..08c52de46b
--- /dev/null
+++ b/internal/api/handlers/playback_transcode_rehome_test.go
@@ -0,0 +1,716 @@
+package handlers
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"syscall"
+	"testing"
+	"time"
+
+	"github.com/prairie-server/prairie-server/internal/config"
+	"github.com/prairie-server/prairie-server/internal/nodepool"
+	"github.com/prairie-server/prairie-server/internal/noderouting"
+	"github.com/prairie-server/prairie-server/internal/playback"
+	"github.com/prairie-server/prairie-server/internal/tonemap"
+	"github.com/prairie-server/prairie-server/internal/transcodenode"
+)
+
+const rehomeTestTransport = "rehome-transport"
+
+// fakeRehomeNode is a transcode node that accepts a start and then serves the
+// started transport's segments.
+type fakeRehomeNode struct {
+	server  *httptest.Server
+	starts  atomic.Int32
+	release chan struct{} // when non-nil, a start waits for it to close
+
+	mu       sync.Mutex
+	lastSeen transcodenode.TranscodeStartRequest
+}
+
+func newFakeRehomeNode(t *testing.T, gated bool) *fakeRehomeNode {
+	t.Helper()
+	node := &fakeRehomeNode{}
+	if gated {
+		node.release = make(chan struct{})
+	}
+	node.server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.Method == http.MethodPost && r.URL.Path == "/transcode/start":
+			var req transcodenode.TranscodeStartRequest
+			if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+				http.Error(w, err.Error(), http.StatusBadRequest)
+				return
+			}
+			node.mu.Lock()
+			node.lastSeen = req
+			node.mu.Unlock()
+			node.starts.Add(1)
+			if node.release != nil {
+				<-node.release
+			}
+			w.Header().Set("Content-Type", "application/json")
+			w.WriteHeader(http.StatusAccepted)
+			_ = json.NewEncoder(w).Encode(transcodenode.TranscodeStartResponse{SessionID: req.SessionID, Status: "started"})
+		case r.Method == http.MethodGet && strings.HasPrefix(r.URL.Path, "/transcode/"+rehomeTestTransport+"/segment/"):
+			_, _ = io.WriteString(w, "moved:"+strings.TrimPrefix(r.URL.Path, "/transcode/"+rehomeTestTransport+"/segment/"))
+		case r.Method == http.MethodDelete:
+			w.WriteHeader(http.StatusNoContent)
+		default:
+			http.NotFound(w, r)
+		}
+	}))
+	t.Cleanup(node.server.Close)
+	return node
+}
+
+func (n *fakeRehomeNode) lastStart() transcodenode.TranscodeStartRequest {
+	n.mu.Lock()
+	defer n.mu.Unlock()
+	return n.lastSeen
+}
+
+// unreachableNodeURL returns a URL nothing listens on, so a dial is refused.
+func unreachableNodeURL(t *testing.T) string {
+	t.Helper()
+	server := httptest.NewServer(http.NotFoundHandler())
+	url := server.URL
+	server.Close()
+	return url
+}
+
+type rehomeFixture struct {
+	handler  *PlaybackHandler
+	sessions *playback.SessionManager
+	planner  *nodepool.Planner
+	session  *playback.Session
+	token    string
+	deadURL  string
+}
+
+// newRehomeFixture starts a native API-relayed transcode on nodes[0] and pools
+// every node in nodes.
+func newRehomeFixture(t *testing.T, nodes []*nodepool.Node, ffmpegPath string) *rehomeFixture {
+	t.Helper()
+	pool := nodepool.NewTranscodePool()
+	pool.SetNodes(nodes)
+	planner := nodepool.NewPlanner(nodepool.NewProxyPool(), pool)
+
+	sessions := playback.NewSessionManager(0, 0)
+	handler := NewPlaybackHandler(sessions)
+	handler.JWTSecret = "rehome-secret"
+	handler.NodePlanner = planner
+	handler.PlaybackConfig = playbackTestConfig(ffmpegPath, t.TempDir())
+
+	session, err := sessions.StartSession(1, "profile-1", 42, playback.PlayTranscode, false)
+	if err != nil {
+		t.Fatalf("start session: %v", err)
+	}
+	t.Cleanup(func() {
+		if ts := handler.tm.GetTranscodeSession(session.ID); ts != nil {
+			_ = ts.Close()
+		}
+	})
+	deadURL := nodes[0].URL
+	if err := sessions.SetTranscodeRoute(session.ID, playback.TranscodeRoute{NodeURL: deadURL, TransportID: rehomeTestTransport}); err != nil {
+		t.Fatal(err)
+	}
+	if err := sessions.SetNodeRoutingAssignment(session.ID, playback.NodeRoutingAssignment{
+		Workload: string(noderouting.WorkloadVideoTranscode), Execution: string(noderouting.ExecutionTranscode),
+		ExecutionNodeID: nodes[0].ID, ExecutionNodeURL: deadURL, Egress: string(noderouting.EgressAPI),
+	}); err != nil {
+		t.Fatal(err)
+	}
+	card := playback.NewRecipeCard(1, "profile-1", 42, deadURL, playback.TranscodeOpts{
+		SessionID: session.ID, TranscodeTransportID: rehomeTestTransport, InputPath: "/media/movie.mkv",
+		TargetCodecVideo: "h264", TargetCodecAudio: "aac", SegmentDuration: 2,
+		AudioTrackIndex: -1, SubtitleTrackIndex: -1, TotalDuration: 600,
+	})
+	card.RoutingWorkload = string(noderouting.WorkloadVideoTranscode)
+	card.RoutingExecution = string(noderouting.ExecutionTranscode)
+	card.RoutingExecutionNodeID = nodes[0].ID
+	card.RoutingEgress = string(noderouting.EgressAPI)
+	token := handler.signSessionToken(card, false)
+	if token == "" {
+		t.Fatal("sign stream token returned empty")
+	}
+	return &rehomeFixture{handler: handler, sessions: sessions, planner: planner, session: session, token: token, deadURL: deadURL}
+}
+
+func (f *rehomeFixture) segment(name string) *httptest.ResponseRecorder {
+	rr := httptest.NewRecorder()
+	f.handler.HandleGetTranscodeSegment(rr, playbackTestRequest(http.MethodGet,
+		"/api/v2/playback/transcode/"+f.session.ID+"/segment/"+name+"?st="+f.token, nil,
+		map[string]string{"session_id": f.session.ID, "name": name}))
+	return rr
+}
+
+func pooledNode(id int, url string) *nodepool.Node {
+	return &nodepool.Node{ID: id, Name: "node", Type: "transcode", URL: url, Enabled: true, Healthy: true}
+}
+
+// TestRelayMovesTranscodeOffUnreachableNodeToAnotherNode covers the reported
+// failure: the node died, so the relay's connection is refused. The transcode
+// must restart on the healthy node at the requested segment, the request must
+// be served from it, and the dead node must stop being selected.
+func TestRelayMovesTranscodeOffUnreachableNodeToAnotherNode(t *testing.T) {
+	healthy := newFakeRehomeNode(t, false)
+	f := newRehomeFixture(t, []*nodepool.Node{
+		pooledNode(1, unreachableNodeURL(t)),
+		pooledNode(2, healthy.server.URL),
+	}, "ffmpeg")
+
+	rr := f.segment("seg_00003.ts")
+	if rr.Code != http.StatusOK || rr.Body.String() != "moved:seg_00003.ts" {
+		t.Fatalf("status = %d, body = %q; want the segment served by the healthy node", rr.Code, rr.Body.String())
+	}
+
+	start := healthy.lastStart()
+	if start.SessionID != rehomeTestTransport {
+		t.Fatalf("started transport %q, want the session's transport %q", start.SessionID, rehomeTestTransport)
+	}
+	if start.StartSegmentNumber != 3 || start.SeekSeconds != 6 {
+		t.Fatalf("started at segment %d (%.1fs), want segment 3 (6.0s) so numbering continues",
+			start.StartSegmentNumber, start.SeekSeconds)
+	}
+	if start.InputPath != "/media/movie.mkv" || start.TargetCodecVideo != "h264" || !start.RequireReady {
+		t.Fatalf("start request lost the recipe: %+v", start)
+	}
+
+	session, err := f.sessions.GetSession(f.session.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if session.TranscodeNodeURL != healthy.server.URL || session.TranscodeTransportID != rehomeTestTransport {
+		t.Fatalf("session route = %q/%q, want the healthy node with the same transport", session.TranscodeNodeURL, session.TranscodeTransportID)
+	}
+	if session.RoutingExecutionNodeID != 2 || session.RoutingEgress != string(noderouting.EgressAPI) {
+		t.Fatalf("routing = node %d egress %q, want node 2 behind the API", session.RoutingExecutionNodeID, session.RoutingEgress)
+	}
+	if f.planner.TranscodeNodeHealthy(f.deadURL) {
+		t.Fatal("the unreachable node is still selectable")
+	}
+
+	// The next segment goes straight to the new node, with no second start.
+	if rr := f.segment("seg_00004.ts"); rr.Code != http.StatusOK || rr.Body.String() != "moved:seg_00004.ts" {
+		t.Fatalf("next segment status = %d, body = %q", rr.Code, rr.Body.String())
+	}
+	if got := healthy.starts.Load(); got != 1 {
+		t.Fatalf("starts = %d, want 1", got)
+	}
+}
+
+// TestRelayMovesTokenlessTranscodeFromStoredRecipe covers a session whose URLs
+// carry no stream token: the recipe comes from the node recipe store, and the
+// stored card follows the transport to its new node so that node can rebuild
+// it after its own restart.
+func TestRelayMovesTokenlessTranscodeFromStoredRecipe(t *testing.T) {
+	healthy := newFakeRehomeNode(t, false)
+	f := newRehomeFixture(t, []*nodepool.Node{
+		pooledNode(1, unreachableNodeURL(t)),
+		pooledNode(2, healthy.server.URL),
+	}, "ffmpeg")
+	stored, _ := verifiedStreamCardFromToken(f.token, f.session.ID, f.handler.JWTSecret)
+	store := newSharedRecipeStore(*stored)
+	f.handler.NodeRecipeStore = store
+
+	rr := httptest.NewRecorder()
+	f.handler.HandleGetTranscodeSegment(rr, playbackTestRequest(http.MethodGet,
+		"/api/v2/playback/transcode/"+f.session.ID+"/segment/seg_00005.ts", nil,
+		map[string]string{"session_id": f.session.ID, "name": "seg_00005.ts"}))
+	if rr.Code != http.StatusOK || rr.Body.String() != "moved:seg_00005.ts" {
+		t.Fatalf("status = %d, body = %q", rr.Code, rr.Body.String())
+	}
+	if got := healthy.lastStart().StartSegmentNumber; got != 5 {
+		t.Fatalf("started at segment %d, want 5", got)
+	}
+	// The new card is written once the retire to the old node has finished.
+	waitForStoredRecipeNode(t, store, healthy.server.URL, 2)
+}
+
+// TestRelayMovesTranscodeOffUnreachableNodeToThisServer covers the
+// single-node deployment: with no other node, a policy that lets the API
+// execute rebuilds the transcode here and serves it locally.
+func TestRelayMovesTranscodeOffUnreachableNodeToThisServer(t *testing.T) {
+	f := newRehomeFixture(t, []*nodepool.Node{pooledNode(1, unreachableNodeURL(t))}, writePlaybackTestFFmpegSleep(t, "30"))
+
+	rr := httptest.NewRecorder()
+	f.handler.HandleGetTranscodeManifest(rr, playbackTestRequest(http.MethodGet,
+		"/api/v2/playback/transcode/"+f.session.ID+"/master.m3u8?st="+f.token, nil,
+		map[string]string{"session_id": f.session.ID}))
+	if rr.Code != http.StatusOK || !strings.Contains(rr.Body.String(), "#EXTM3U") {
+		t.Fatalf("status = %d, body = %q; want a manifest served by this server", rr.Code, rr.Body.String())
+	}
+	if f.handler.tm.GetTranscodeSession(f.session.ID) == nil {
+		t.Fatal("no local transcode runs the moved session")
+	}
+	session, err := f.sessions.GetSession(f.session.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if session.TranscodeNodeURL != "" || session.RoutingExecution != string(noderouting.ExecutionAPI) || session.RoutingExecutionNodeID != 0 {
+		t.Fatalf("session still names node %q (execution %q, node %d)", session.TranscodeNodeURL, session.RoutingExecution, session.RoutingExecutionNodeID)
+	}
+}
+
+// TestRelayDoesNotMoveTranscodeWhenWorkerOnlyHasNoOtherNode pins that the
+// move never crosses a hard execution boundary: worker_only with no healthy
+// node left answers the relay failure instead of transcoding on the API.
+func TestRelayDoesNotMoveTranscodeWhenWorkerOnlyHasNoOtherNode(t *testing.T) {
+	f := newRehomeFixture(t, []*nodepool.Node{pooledNode(1, unreachableNodeURL(t))}, writePlaybackTestFFmpegSleep(t, "30"))
+	previous := f.handler.PlaybackConfig
+	f.handler.PlaybackConfig = func() config.PlaybackConfig {
+		cfg := previous()
+		cfg.Routing = config.DefaultPlaybackRoutingPolicy()
+		cfg.Routing.VideoTranscodeExecution = config.PlaybackExecutionWorkerOnly
+		return cfg
+	}
+
+	if rr := f.segment("seg_00003.ts"); rr.Code != http.StatusBadGateway {
+		t.Fatalf("status = %d, body = %q; want 502", rr.Code, rr.Body.String())
+	}
+	if f.handler.tm.GetTranscodeSession(f.session.ID) != nil {
+		t.Fatal("worker_only transcode was moved onto the API")
+	}
+}
+
+// TestRelayKeepsLiveNodeHTTPErrors pins the other side of the boundary: a node
+// that answers is alive, so its HTTP error is relayed and nothing moves.
+func TestRelayKeepsLiveNodeHTTPErrors(t *testing.T) {
+	failing := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		http.Error(w, "encoder exploded", http.StatusInternalServerError)
+	}))
+	t.Cleanup(failing.Close)
+	spare := newFakeRehomeNode(t, false)
+	f := newRehomeFixture(t, []*nodepool.Node{pooledNode(1, failing.URL), pooledNode(2, spare.server.URL)}, "ffmpeg")
+
+	rr := f.segment("seg_00003.ts")
+	if rr.Code != http.StatusInternalServerError || !strings.Contains(rr.Body.String(), "encoder exploded") {
+		t.Fatalf("status = %d, body = %q; want the node's own error relayed", rr.Code, rr.Body.String())
+	}
+	if got := spare.starts.Load(); got != 0 {
+		t.Fatalf("starts on the spare node = %d, want 0", got)
+	}
+	session, err := f.sessions.GetSession(f.session.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if session.TranscodeNodeURL != failing.URL {
+		t.Fatalf("session moved to %q after an HTTP error", session.TranscodeNodeURL)
+	}
+	if !f.planner.TranscodeNodeHealthy(failing.URL) {
+		t.Fatal("a node that answered was marked unhealthy")
+	}
+}
+
+// TestRelayMovesEachSessionOnceUnderConcurrentRequests pins the pacing: every
+// request that finds the node dead waits on one move, so the replacement node
+// sees exactly one start however many segment requests arrive together.
+func TestRelayMovesEachSessionOnceUnderConcurrentRequests(t *testing.T) {
+	healthy := newFakeRehomeNode(t, true)
+	f := newRehomeFixture(t, []*nodepool.Node{
+		pooledNode(1, unreachableNodeURL(t)),
+		pooledNode(2, healthy.server.URL),
+	}, "ffmpeg")
+
+	const requests = 8
+	results := make(chan *httptest.ResponseRecorder, requests)
+	for i := range requests {
+		go func() { results <- f.segment("seg_0000" + string(rune('0'+i)) + ".ts") }()
+	}
+	deadline := time.Now().Add(10 * time.Second)
+	for healthy.starts.Load() == 0 {
+		if time.Now().After(deadline) {
+			t.Fatal("no start reached the healthy node")
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+	close(healthy.release)
+	for range requests {
+		rr := <-results
+		if rr.Code != http.StatusOK || !strings.HasPrefix(rr.Body.String(), "moved:") {
+			t.Fatalf("status = %d, body = %q", rr.Code, rr.Body.String())
+		}
+	}
+	if got := healthy.starts.Load(); got != 1 {
+		t.Fatalf("starts = %d, want exactly one move", got)
+	}
+}
+
+// sharedRecipeStore is the node recipe store every node and the API share
+// (Redis in production). It is safe for the move's background retire.
+type sharedRecipeStore struct {
+	mu    sync.Mutex
+	cards map[string]playback.RecipeCard
+}
+
+func newSharedRecipeStore(card playback.RecipeCard) *sharedRecipeStore {
+	return &sharedRecipeStore{cards: map[string]playback.RecipeCard{rehomeTestTransport: card}}
+}
+
+func (s *sharedRecipeStore) Enabled() bool { return true }
+
+func (s *sharedRecipeStore) Get(_ context.Context, transportID string) (*playback.RecipeCard, bool) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	card, ok := s.cards[transportID]
+	if !ok {
+		return nil, false
+	}
+	return &card, true
+}
+
+func (s *sharedRecipeStore) Put(_ context.Context, transportID string, card playback.RecipeCard) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.cards[transportID] = card
+	return nil
+}
+
+func (s *sharedRecipeStore) Delete(_ context.Context, transportID string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	delete(s.cards, transportID)
+	return nil
+}
+
+func waitForStoredRecipeNode(t *testing.T, store *sharedRecipeStore, nodeURL string, nodeID int) {
+	t.Helper()
+	deadline := time.Now().Add(10 * time.Second)
+	for {
+		card, ok := store.Get(context.Background(), rehomeTestTransport)
+		if ok && card.TranscodeNodeURL == nodeURL && card.RoutingExecutionNodeID == nodeID {
+			return
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("stored recipe = %+v (present %v), want one naming node %q (id %d)", card, ok, nodeURL, nodeID)
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+}
+
+// seedNodeTransformations records the transformation inventory a node
+// advertises, as a capability probe would.
+func seedNodeTransformations(h *PlaybackHandler, nodeURL, videoRecipeVersion string) {
+	h.v3NodeCapabilitiesMu.Lock()
+	defer h.v3NodeCapabilitiesMu.Unlock()
+	if h.v3NodeCapabilities == nil {
+		h.v3NodeCapabilities = map[string]v3NodeCapabilityCache{}
+	}
+	h.v3NodeCapabilities[nodepool.NormalizeNodeURL(nodeURL)] = v3NodeCapabilityCache{
+		transformations: []playback.TransformationV3{{Name: playback.TransformationVideoToH264V3, Executor: playback.ExecutorServerV3, RecipeVersion: videoRecipeVersion}},
+		expiresAt:       time.Now().Add(time.Hour),
+	}
+}
+
+// TestRelayMoveKeepsTheSessionsRecipeVersions pins that a move applies the
+// capability filter of a fresh start: during a rolling upgrade, a node that
+// advertises an older video recipe must not continue a transport encoded with
+// the newer one.
+func TestRelayMoveKeepsTheSessionsRecipeVersions(t *testing.T) {
+	older := newFakeRehomeNode(t, false)
+	current := newFakeRehomeNode(t, false)
+	f := newRehomeFixture(t, []*nodepool.Node{
+		pooledNode(1, unreachableNodeURL(t)),
+		pooledNode(2, older.server.URL),
+		pooledNode(3, current.server.URL),
+	}, "ffmpeg")
+	store := playback.NewMemoryPlanStoreV3()
+	if err := store.SaveAttempt(context.Background(), playback.AttemptRecordV3{
+		PlaybackAttemptID: "attempt-1", SessionID: f.session.ID, UserID: 1, CurrentPlanID: "plan-1",
+		CurrentPlan: playback.PlanV3{PlanID: "plan-1", Transformations: []playback.TransformationV3{
+			{Name: playback.TransformationVideoToH264V3, Executor: playback.ExecutorServerV3, RecipeVersion: "2"},
+		}},
+		ExpiresAt: time.Now().Add(time.Hour),
+	}); err != nil {
+		t.Fatal(err)
+	}
+	f.handler.PlanStoreV3 = store
+	seedNodeTransformations(f.handler, older.server.URL, "1")
+	seedNodeTransformations(f.handler, current.server.URL, "2")
+
+	if rr := f.segment("seg_00003.ts"); rr.Code != http.StatusOK || rr.Body.String() != "moved:seg_00003.ts" {
+		t.Fatalf("status = %d, body = %q; want the segment served by the current node", rr.Code, rr.Body.String())
+	}
+	if got := older.starts.Load(); got != 0 {
+		t.Fatalf("starts on the node with the older recipe = %d, want 0", got)
+	}
+	if got := current.starts.Load(); got != 1 {
+		t.Fatalf("starts on the node with the session's recipe = %d, want 1", got)
+	}
+}
+
+// TestRelayMoveRestoresStoredRecipeAfterRefusedStart pins that a candidate's
+// rollback stop, which makes the node delete the transport's stored recipe,
+// does not cost a tokenless session the only recipe it has.
+func TestRelayMoveRestoresStoredRecipeAfterRefusedStart(t *testing.T) {
+	var store *sharedRecipeStore
+	refusing := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodDelete {
+			// A node's stop drops the transport's stored recipe.
+			_ = store.Delete(r.Context(), strings.TrimPrefix(r.URL.Path, "/transcode/"))
+			w.WriteHeader(http.StatusNoContent)
+			return
+		}
+		http.Error(w, "no capacity", http.StatusServiceUnavailable)
+	}))
+	t.Cleanup(refusing.Close)
+	f := newRehomeFixture(t, []*nodepool.Node{
+		pooledNode(1, unreachableNodeURL(t)),
+		pooledNode(2, refusing.URL),
+	}, "ffmpeg")
+	previous := f.handler.PlaybackConfig
+	f.handler.PlaybackConfig = func() config.PlaybackConfig {
+		cfg := previous()
+		cfg.Routing = config.DefaultPlaybackRoutingPolicy()
+		cfg.Routing.VideoTranscodeExecution = config.PlaybackExecutionWorkerOnly
+		return cfg
+	}
+	stored, _ := verifiedStreamCardFromToken(f.token, f.session.ID, f.handler.JWTSecret)
+	store = newSharedRecipeStore(*stored)
+	f.handler.NodeRecipeStore = store
+
+	rr := httptest.NewRecorder()
+	f.handler.HandleGetTranscodeSegment(rr, playbackTestRequest(http.MethodGet,
+		"/api/v2/playback/transcode/"+f.session.ID+"/segment/seg_00005.ts", nil,
+		map[string]string{"session_id": f.session.ID, "name": "seg_00005.ts"}))
+	if rr.Code != http.StatusBadGateway {
+		t.Fatalf("status = %d, body = %q; want 502 with no executor left", rr.Code, rr.Body.String())
+	}
+	if card, ok := store.Get(context.Background(), rehomeTestTransport); !ok || card.TranscodeNodeURL != f.deadURL {
+		t.Fatalf("stored recipe = %+v (present %v), want the original card kept", card, ok)
+	}
+}
+
+// TestRelayMoveRestoresLegacySessionsStoredRecipe covers a session whose route
+// records no transport id: its transport, and its stored recipe's key, is the
+// session id. A refused candidate's stop deletes that recipe, and the rollback
+// must still write it back under the same key.
+func TestRelayMoveRestoresLegacySessionsStoredRecipe(t *testing.T) {
+	var store *sharedRecipeStore
+	refusing := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodDelete {
+			_ = store.Delete(r.Context(), strings.TrimPrefix(r.URL.Path, "/transcode/"))
+			w.WriteHeader(http.StatusNoContent)
+			return
+		}
+		http.Error(w, "no capacity", http.StatusServiceUnavailable)
+	}))
+	t.Cleanup(refusing.Close)
+	f := newRehomeFixture(t, []*nodepool.Node{
+		pooledNode(1, unreachableNodeURL(t)),
+		pooledNode(2, refusing.URL),
+	}, "ffmpeg")
+	if err := f.sessions.SetTranscodeRoute(f.session.ID, playback.TranscodeRoute{NodeURL: f.deadURL}); err != nil {
+		t.Fatal(err)
+	}
+	stored, _ := verifiedStreamCardFromToken(f.token, f.session.ID, f.handler.JWTSecret)
+	stored.TranscodeTransportID = ""
+	store = &sharedRecipeStore{cards: map[string]playback.RecipeCard{f.session.ID: *stored}}
+	f.handler.NodeRecipeStore = store
+
+	f.handler.rollBackMovedStartV3(context.Background(), f.session.ID, f.deadURL, f.session.ID, refusing.URL, *stored, true)
+	if card, ok := store.Get(context.Background(), f.session.ID); !ok || card.TranscodeNodeURL != f.deadURL {
+		t.Fatalf("stored recipe = %+v (present %v), want the original card restored under the session id", card, ok)
+	}
+}
+
+// TestRelayMoveWritesStoredRecipeAfterRetiringOldNode covers a node that was
+// only briefly unreachable: the retire stop reaches it and it deletes the
+// transport's stored recipe. The card naming the new node must be written
+// after that delete, not before it.
+func TestRelayMoveWritesStoredRecipeAfterRetiringOldNode(t *testing.T) {
+	var store *sharedRecipeStore
+	var retired atomic.Int32
+	flaky := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodDelete {
+			_ = store.Delete(r.Context(), strings.TrimPrefix(r.URL.Path, "/transcode/"))
+			retired.Add(1)
+			w.WriteHeader(http.StatusNoContent)
+			return
+		}
+		// The relay's request dies without a response.
+		conn, _, err := w.(http.Hijacker).Hijack()
+		if err == nil {
+			_ = conn.Close()
+		}
+	}))
+	t.Cleanup(flaky.Close)
+	healthy := newFakeRehomeNode(t, false)
+	f := newRehomeFixture(t, []*nodepool.Node{
+		pooledNode(1, flaky.URL),
+		pooledNode(2, healthy.server.URL),
+	}, "ffmpeg")
+	// The pool already lists the node as unhealthy, so a transport error
+	// counts as unreachable.
+	f.planner.MarkTranscodeNodeUnreachable(flaky.URL)
+	stored, _ := verifiedStreamCardFromToken(f.token, f.session.ID, f.handler.JWTSecret)
+	store = newSharedRecipeStore(*stored)
+	f.handler.NodeRecipeStore = store
+
+	rr := httptest.NewRecorder()
+	f.handler.HandleGetTranscodeSegment(rr, playbackTestRequest(http.MethodGet,
+		"/api/v2/playback/transcode/"+f.session.ID+"/segment/seg_00005.ts", nil,
+		map[string]string{"session_id": f.session.ID, "name": "seg_00005.ts"}))
+	if rr.Code != http.StatusOK || rr.Body.String() != "moved:seg_00005.ts" {
+		t.Fatalf("status = %d, body = %q", rr.Code, rr.Body.String())
+	}
+	waitForStoredRecipeNode(t, store, healthy.server.URL, 2)
+	if got := retired.Load(); got != 1 {
+		t.Fatalf("retire stops on the old node = %d, want 1", got)
+	}
+}
+
+// TestConnectFailureIgnoresLocalSocketExhaustion pins that a dial this host
+// could not attempt does not condemn the node.
+func TestConnectFailureIgnoresLocalSocketExhaustion(t *testing.T) {
+	local := &net.OpError{Op: "dial", Net: "tcp", Err: os.NewSyscallError("socket", syscall.EMFILE)}
+	if isConnectFailure(local) {
+		t.Fatal("a dial that ran out of file descriptors counted as a dead node")
+	}
+	refused := &net.OpError{Op: "dial", Net: "tcp", Err: os.NewSyscallError("connect", syscall.ECONNREFUSED)}
+	if !isConnectFailure(refused) {
+		t.Fatal("a refused connection did not count as a dead node")
+	}
+}
+
+// TestRelayMoveEndsOnSourceToneMapRefusal pins that a tone-map refusal about
+// the source file itself ends the move with the documented terminal 422,
+// instead of trying every executor and answering a retryable 502.
+func TestRelayMoveEndsOnSourceToneMapRefusal(t *testing.T) {
+	var starts atomic.Int32
+	refusing := func() *httptest.Server {
+		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if r.Method == http.MethodDelete {
+				w.WriteHeader(http.StatusNoContent)
+				return
+			}
+			starts.Add(1)
+			w.Header().Set(transcodenode.ToneMapExecutionErrorHeader, transcodenode.ToneMapSourceRevisionChangedCode)
+			http.Error(w, "source changed", http.StatusUnprocessableEntity)
+		}))
+		t.Cleanup(server.Close)
+		return server
+	}
+	first, second := refusing(), refusing()
+	f := newRehomeFixture(t, []*nodepool.Node{
+		pooledNode(1, unreachableNodeURL(t)),
+		pooledNode(2, first.URL),
+		pooledNode(3, second.URL),
+	}, "ffmpeg")
+	card, _ := verifiedStreamCardFromToken(f.token, f.session.ID, f.handler.JWTSecret)
+	card.ToneMapMode = tonemap.ModeSoftware
+	card.ToneMapSourceKind = tonemap.SourcePQ
+	f.token = f.handler.signSessionToken(*card, false)
+	for _, url := range []string{first.URL, second.URL} {
+		f.handler.v3NodeCapabilitiesMu.Lock()
+		if f.handler.v3NodeCapabilities == nil {
+			f.handler.v3NodeCapabilities = map[string]v3NodeCapabilityCache{}
+		}
+		f.handler.v3NodeCapabilities[nodepool.NormalizeNodeURL(url)] = v3NodeCapabilityCache{
+			toneMapCapabilities: tonemap.Capabilities{{Mode: tonemap.ModeSoftware, Backend: "none", Filter: "tonemap", SourceKinds: []tonemap.SourceKind{tonemap.SourcePQ}}},
+			expiresAt:           time.Now().Add(time.Hour),
+		}
+		f.handler.v3NodeCapabilitiesMu.Unlock()
+	}
+
+	rr := f.segment("seg_00003.ts")
+	if rr.Code != http.StatusUnprocessableEntity || rr.Header().Get(transcodenode.ToneMapExecutionErrorHeader) != transcodenode.ToneMapSourceRevisionChangedCode {
+		t.Fatalf("status = %d, tone-map error %q; want 422 %s", rr.Code, rr.Header().Get(transcodenode.ToneMapExecutionErrorHeader), transcodenode.ToneMapSourceRevisionChangedCode)
+	}
+	if got := starts.Load(); got != 1 {
+		t.Fatalf("starts = %d, want the move to stop after the first refusal", got)
+	}
+}
+
+// TestMovedRecipeWriteRequiresTheLiveRoute pins the guard on the stored
+// recipe writes a move makes late (after the old node's retire stop, or after
+// a candidate's rollback stop): once the session has stopped or left the
+// route, the stop or replan deleted the recipe, and writing it back would let
+// a buffered request rebuild an ended transport after a node restart.
+func TestMovedRecipeWriteRequiresTheLiveRoute(t *testing.T) {
+	healthy := newFakeRehomeNode(t, false)
+	f := newRehomeFixture(t, []*nodepool.Node{pooledNode(1, healthy.server.URL)}, "ffmpeg")
+	stored, _ := verifiedStreamCardFromToken(f.token, f.session.ID, f.handler.JWTSecret)
+	store := &sharedRecipeStore{cards: map[string]playback.RecipeCard{}}
+	f.handler.NodeRecipeStore = store
+	live := playback.TranscodeRoute{NodeURL: f.deadURL, TransportID: rehomeTestTransport}
+
+	f.handler.putNodeRecipeIfRouteV3(context.Background(), f.session.ID, playback.TranscodeRoute{NodeURL: "http://elsewhere:8080", TransportID: rehomeTestTransport}, *stored)
+	if _, ok := store.Get(context.Background(), rehomeTestTransport); ok {
+		t.Fatal("wrote the recipe for a route the session no longer runs")
+	}
+	f.handler.putNodeRecipeIfRouteV3(context.Background(), f.session.ID, live, *stored)
+	if _, ok := store.Get(context.Background(), rehomeTestTransport); !ok {
+		t.Fatal("did not write the recipe for the live route")
+	}
+
+	if _, err := f.handler.stopPlaybackSessionWithResult(context.Background(), f.session, true); err != nil {
+		t.Fatalf("stop: %v", err)
+	}
+	if _, ok := store.Get(context.Background(), rehomeTestTransport); ok {
+		t.Fatal("the stop left the stored recipe in place")
+	}
+	f.handler.putNodeRecipeIfRouteV3(context.Background(), f.session.ID, live, *stored)
+	if _, ok := store.Get(context.Background(), rehomeTestTransport); ok {
+		t.Fatal("wrote the recipe back after the session stopped")
+	}
+}
+
+// A moved transport keeps its subtitle rendition: node selection must admit
+// only nodes that emit one, and the start request asks the new node for it.
+func TestRelayMoveKeepsTheSubtitleRendition(t *testing.T) {
+	card := &playback.RecipeCard{SubtitleRendition: true, SubtitleTrackIndex: 2, SubtitleCodec: "subrip"}
+	if plan := (&PlaybackHandler{}).rehomePlanV3(t.Context(), &playback.Session{ID: "session"}, card); !plan.SubtitleRendition {
+		t.Fatal("rehome plan dropped the subtitle rendition, so node selection would admit nodes without it")
+	}
+	if req := rehomeStartRequestV3(*card, "transport", "", -1); !req.SubtitleRendition {
+		t.Fatal("rehome start request dropped the subtitle rendition")
+	}
+}
+
+// predicateEnumeratingNodePlannerV3 lists its nodes and accepts an eligibility
+// predicate, the seam transcodeEligibilityV3 builds its filter for.
+type predicateEnumeratingNodePlannerV3 struct{ enumeratingNodePlannerV3 }
+
+func (predicateEnumeratingNodePlannerV3) PlanSessionWith(string, string, bool, int, func(*nodepool.Node) bool) nodepool.Plan {
+	return nodepool.Plan{}
+}
+
+// A moved rendition whose attempt plan is no longer recorded still finds a
+// node that emits renditions: with no plan there are no transformations to
+// require, as at that session's own start.
+func TestRelayMoveWithoutARecordedPlanAdmitsRenditionNodes(t *testing.T) {
+	node := func(features ...string) *httptest.Server {
+		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			writeJSON(w, http.StatusOK, playback.HWAccelInfo{TransportFeatures: features})
+		}))
+		t.Cleanup(server.Close)
+		return server
+	}
+	capable := node(playback.TransportFeatureHLSSubtitleRenditionV1)
+	older := node()
+	handler := NewPlaybackHandler(playback.NewSessionManager(0, 0))
+	handler.NodePlanner = predicateEnumeratingNodePlannerV3{enumeratingNodePlannerV3{urls: []string{capable.URL, older.URL}}}
+
+	card := &playback.RecipeCard{SubtitleRendition: true, SubtitleTrackIndex: 2, SubtitleCodec: "subrip"}
+	plan := handler.rehomePlanV3(t.Context(), &playback.Session{ID: "session"}, card)
+	if plan.Plan != nil || !plan.SubtitleRendition {
+		t.Fatalf("rehome plan = %+v, want no recorded plan with the rendition kept", plan)
+	}
+	eligible := handler.transcodeEligibilityV3(t.Context(), plan, nil)
+	if eligible == nil || !eligible(&nodepool.Node{URL: capable.URL}) {
+		t.Fatal("the rendition-capable node was rejected")
+	}
+	if eligible(&nodepool.Node{URL: older.URL}) {
+		t.Fatal("a node without the rendition feature was admitted")
+	}
+}
diff --git a/internal/api/handlers/playback_transport.go b/internal/api/handlers/playback_transport.go
index 64a4c106ab..adb7e184d2 100644
--- a/internal/api/handlers/playback_transport.go
+++ b/internal/api/handlers/playback_transport.go
@@ -12,6 +12,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/prairie-server/prairie-server/internal/nodeauth"
 	"github.com/prairie-server/prairie-server/internal/telemetry"
 
 	"github.com/prairie-server/prairie-server/internal/logredact"
@@ -46,7 +47,9 @@ func (h *PlaybackHandler) startRemotePlaybackTransport(ctx context.Context, node
 		return transcodenode.TranscodeStartResponse{}, 0, logredact.SanitizeURLError(err)
 	}
 	httpRequest.Header.Set("Content-Type", "application/json")
-	httpRequest.Header.Set("Authorization", "Bearer "+h.JWTSecret)
+	if err := nodeauth.Sign(httpRequest, nodeURL, h.JWTSecret); err != nil {
+		return transcodenode.TranscodeStartResponse{}, 0, err
+	}
 	response, err := telemetry.DoTrustedNode(transcodeproxy.NodeClient(), httpRequest, "transcode_start")
 	if err != nil {
 		nodepool.ReportConnectFailure(h.NodePlanner, nodeURL, err)
diff --git a/internal/api/handlers/playback_transport_security_test.go b/internal/api/handlers/playback_transport_security_test.go
index 5dffea7834..98d0599cb0 100644
--- a/internal/api/handlers/playback_transport_security_test.go
+++ b/internal/api/handlers/playback_transport_security_test.go
@@ -9,6 +9,7 @@ import (
 	"sync/atomic"
 	"testing"
 
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 	"github.com/prairie-server/prairie-server/internal/playback"
 )
 
@@ -23,16 +24,16 @@ func TestFetchRemoteTranscodeCapabilitiesDoesNotForwardJWTOnRedirect(t *testing.
 	}))
 	defer redirectTarget.Close()
 
-	var sourceAuthorization atomic.Value
+	var sourceSigned atomic.Bool
 	source := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		sourceAuthorization.Store(r.Header.Get("Authorization"))
+		sourceSigned.Store(nodeauthtest.Signed(r, jwt))
 		http.Redirect(w, r, redirectTarget.URL+"/hw-capabilities", http.StatusFound)
 	}))
 	defer source.Close()
 
 	_, err := fetchRemoteTranscodeCapabilities(context.Background(), source.URL, jwt)
-	if got, want := sourceAuthorization.Load(), "Bearer "+jwt; got != want {
-		t.Fatalf("source Authorization = %#v, want %q", got, want)
+	if !sourceSigned.Load() {
+		t.Fatal("source request was not signed with the shared secret")
 	}
 	if got := redirectTargetHits.Load(); got != 0 {
 		t.Fatalf("redirect target requests = %d, Authorization = %#v; want no redirect request", got, redirectTargetAuthorization.Load())
diff --git a/internal/api/handlers/playback_v3.go b/internal/api/handlers/playback_v3.go
index cb8fead6f0..0a7673ab84 100644
--- a/internal/api/handlers/playback_v3.go
+++ b/internal/api/handlers/playback_v3.go
@@ -128,6 +128,10 @@ type preparedTransportV3 struct {
 	rollbackRequired   func() error
 	applySession       func() (func() error, error)
 	afterDurableCommit func()
+	// sessionRecipe is the recovery card of a header-authenticated transport,
+	// recorded once the transport commits (recordSessionRecipeV3). Nil for a
+	// token-bearing attempt, whose URLs carry the recipe themselves.
+	sessionRecipe *playback.RecipeCard
 }
 
 type preparedTimelineV3 struct {
@@ -214,11 +218,12 @@ func headerAuthenticatedMediaV3(clientFeatures []string) mediaAuthModeV3 {
 	}
 }
 
-// recipeCardStoreV3 is the shared control-plane store central hands a recipe
-// card to another Silo process through (*noderecipe.Store). One instance owns
-// one key space; the handler holds two of them, and what a stored card
-// authorizes or rebuilds is the field's business, not the interface's — see
-// PlaybackHandler.ProxyGrantStore and PlaybackHandler.NodeRecipeStore.
+// recipeCardStoreV3 is the shared control-plane store central keeps a recipe
+// card in for another Prairie process, or for itself after a restart
+// (*noderecipe.Store). One instance owns one key space; the handler holds three
+// of them, and what a stored card authorizes or rebuilds is the field's
+// business, not the interface's — see PlaybackHandler.ProxyGrantStore,
+// NodeRecipeStore and SessionRecipeStore.
 type recipeCardStoreV3 interface {
 	// Enabled reports whether the store can actually carry a card. A disabled
 	// store accepts Put silently, so a URL that only a stored card can serve
@@ -1101,7 +1106,7 @@ func (h *PlaybackHandler) hlsToneMapCapabilityInventoryForClientV3(
 
 	var nodeURLs []string
 	if enumerator, ok := h.NodePlanner.(transcodeNodeEnumeratorV3); ok && workerAllowed {
-		nodeURLs = transcodeNodeURLsForNewPlanV3(enumerator)
+		nodeURLs = withoutUnreachableRouteNodesV3(ctx, transcodeNodeURLsForNewPlanV3(enumerator))
 	}
 	results := make([]capabilityResult, len(nodeURLs))
 	var wg sync.WaitGroup
@@ -1164,6 +1169,64 @@ type hlsPlanningSnapshotV3 struct {
 	inventory           hlsToneMapCapabilityInventoryV3
 	inventoryErr        error
 	inventoryResolved   bool
+	renditionOnce       sync.Once
+	renditionExecutable bool
+}
+
+func (snapshot *hlsPlanningSnapshotV3) subtitleRenditionExecutable() bool {
+	snapshot.renditionOnce.Do(func() {
+		snapshot.renditionExecutable = snapshot.handler.hlsSubtitleRenditionExecutableV3(snapshot.ctx, snapshot.proxyAllowed)
+	})
+	return snapshot.renditionExecutable
+}
+
+// hlsSubtitleRenditionExecutableV3 reports whether a policy-eligible HLS video
+// executor can emit a subtitle rendition: this server, or a pooled transcode
+// node advertising the transport feature. Node selection then admits only
+// capable nodes for a plan that carries one (transcodeEligibilityV3).
+func (h *PlaybackHandler) hlsSubtitleRenditionExecutableV3(ctx context.Context, proxyAllowed bool) bool {
+	localAllowed, workerAllowed := hlsRouteExecutorAvailabilityForClientV3(
+		noderouting.WorkloadVideoTranscode, h.playbackRoutingPolicyForContextV3(ctx), proxyAllowed,
+	)
+	if localAllowed {
+		return true
+	}
+	enumerator, ok := h.NodePlanner.(transcodeNodeEnumeratorV3)
+	if !workerAllowed || !ok {
+		return false
+	}
+	for _, entry := range h.pooledNodeCapabilitiesV3(ctx, transcodeNodeURLsForNewPlanV3(enumerator)) {
+		if slices.Contains(entry.transportFeatures, playback.TransportFeatureHLSSubtitleRenditionV1) {
+			return true
+		}
+	}
+	return false
+}
+
+// subtitleRenditionRoutableV3 reports whether one policy-eligible executor can
+// run a rendition plan whole: this server, or a pooled node that passes the
+// filter node selection applies to the plan (transcodeEligibilityV3).
+func (h *PlaybackHandler) subtitleRenditionRoutableV3(ctx context.Context, result playback.PlannerResultV3, proxyAllowed bool) bool {
+	localAllowed, workerAllowed := hlsRouteExecutorAvailabilityForClientV3(
+		noderouting.WorkloadVideoTranscode, h.playbackRoutingPolicyForContextV3(ctx), proxyAllowed,
+	)
+	if localAllowed {
+		return true
+	}
+	enumerator, ok := h.NodePlanner.(transcodeNodeEnumeratorV3)
+	if !workerAllowed || !ok {
+		return false
+	}
+	eligible := h.transcodeEligibilityV3(ctx, result, nil)
+	if eligible == nil {
+		return true
+	}
+	for _, nodeURL := range transcodeNodeURLsForNewPlanV3(enumerator) {
+		if eligible(&nodepool.Node{URL: nodeURL}) {
+			return true
+		}
+	}
+	return false
 }
 
 func (snapshot *hlsPlanningSnapshotV3) progressiveRemuxRegistry() *playback.TransformationRegistryV3 {
@@ -1267,7 +1330,16 @@ func (h *PlaybackHandler) planPlaybackWithCapabilitiesV3(ctx context.Context, in
 	input.HLSRemuxRegistry = snapshot.hlsRemuxRegistry
 	input.HLSVideoRegistry = snapshot.hlsVideoRegistry
 	input.HLSToneMapCapabilities = snapshot.toneMapCapabilities
+	input.SubtitleRenditionExecutable = snapshot.subtitleRenditionExecutable
 	result := playback.PlanPlaybackV3(input)
+	if result.SubtitleRendition && result.Plan != nil && !h.subtitleRenditionRoutableV3(ctx, result, proxyAllowed) {
+		// The planning gate counts any executor that emits renditions, but
+		// this recipe may need transformations only nodes without one
+		// advertise. Marking the rendition attempted plans the sidecar.
+		input.AttemptedKeys = append(slices.Clone(input.AttemptedKeys),
+			playback.PlanAttemptKeyV3(*result.Plan, input.Request.ClientPlaybackContext.Output.OutputContextID, nil))
+		result = playback.PlanPlaybackV3(input)
+	}
 	if result.Terminal != nil {
 		switch result.Terminal.Reason {
 		case playback.TerminalHDRTranscodeUnsupportedV3, terminalSubtitleConversionUnsupportedV3:
@@ -1292,6 +1364,7 @@ func (h *PlaybackHandler) pooledNodeTransformationsV3(ctx context.Context, nodeU
 }
 
 func (h *PlaybackHandler) pooledNodeCapabilitiesV3(ctx context.Context, nodeURLs []string) map[string]v3NodeCapabilityCache {
+	nodeURLs = withoutUnreachableRouteNodesV3(ctx, nodeURLs)
 	fetchCtx, cancel := context.WithTimeout(ctx, v3NodeCapabilityPlanTimeout)
 	defer cancel()
 	results := make([]v3NodeCapabilityCache, len(nodeURLs))
@@ -1405,13 +1478,13 @@ func (h *PlaybackHandler) resolveHLSRouteWithPolicyV3(
 	if !ok || session == nil {
 		return noderouting.Decision{Outcome: noderouting.OutcomePolicyUnsatisfied}
 	}
-	eligible := h.transcodeEligibilityV3(ctx, result, excludedNodes)
+	eligible := excludeUnreachableRouteNodesV3(ctx, h.transcodeEligibilityV3(ctx, result, excludedNodes))
 	// A client that arrived through a network access provider can only use a
 	// proxy that has a connected origin on that same overlay; on the default
 	// path this is nil and every healthy proxy stays eligible. Filtering here
 	// rather than at the URL builder keeps the resolver's fallbacks (API
 	// egress, API relay to the transcode node) in charge of what happens next.
-	proxyEligible := nodepool.ClientReachableVia(netaccess.PathFromContext(ctx), nil)
+	proxyEligible := excludeUnreachableRouteNodesV3(ctx, nodepool.ClientReachableVia(netaccess.PathFromContext(ctx), nil))
 	decision, err := noderouting.Resolve(noderouting.AdaptSessionPlanner(h.NodePlanner), noderouting.ResolveRequest{
 		Request: noderouting.Request{
 			Workload: workload, Delivery: delivery, Policy: policy, ProxyAllowed: proxyAllowed,
@@ -1419,6 +1492,7 @@ func (h *PlaybackHandler) resolveHLSRouteWithPolicyV3(
 		SessionID: session.ID, CurrentTranscodeURL: session.TranscodeNodeURL,
 		EstimatedBitrateKbps: result.TargetBitrateKbps,
 		TranscodeEligible:    eligible, ProxyEligible: proxyEligible, ExcludedShapeIDs: excludedShapes,
+		UnreachableNodes: unreachableRouteNodesV3(ctx),
 	})
 	if err != nil {
 		slog.ErrorContext(ctx, "compile playback node route", "component", "noderouting", "error", err)
@@ -1448,13 +1522,18 @@ func (h *PlaybackHandler) transcodeEligibilityV3(ctx context.Context, result pla
 	_, predicatePlanner := h.NodePlanner.(predicateSessionPlannerV3)
 	requiresProgressiveRemux := result.Plan != nil && result.Plan.Delivery == playback.DeliveryRemuxProgressiveV3
 	if enumerator, ok := h.NodePlanner.(transcodeNodeEnumeratorV3); ok && (exactPlanner || predicatePlanner) &&
-		(planRequiresServerTransformationsV3(result.Plan) || requiresProgressiveRemux) {
+		(planRequiresServerTransformationsV3(result.Plan) || requiresProgressiveRemux || result.SubtitleRendition) {
 		capable := make(map[string]struct{})
 		for nodeURL, entry := range h.pooledNodeCapabilitiesV3(ctx, transcodeNodeURLsForNewPlanV3(enumerator)) {
 			if requiresProgressiveRemux && !slices.Contains(entry.transportFeatures, playback.TransportFeatureProgressiveRemuxExecutionV1) {
 				continue
 			}
-			if validateAdvertisedTransformationsV3(result.Plan, entry.transformations) != nil {
+			if result.SubtitleRendition && !slices.Contains(entry.transportFeatures, playback.TransportFeatureHLSSubtitleRenditionV1) {
+				continue
+			}
+			// A rehomed rendition whose plan record is gone has no plan to
+			// check transformations against, as at that session's own start.
+			if result.Plan != nil && validateAdvertisedTransformationsV3(result.Plan, entry.transformations) != nil {
 				continue
 			}
 			if planRequiresToneMapV3(result.Plan) {
@@ -1621,6 +1700,7 @@ func (h *PlaybackHandler) startPlaybackApplicationV3(r *http.Request, body []byt
 		// of every later replan of this attempt too.
 		req.ClientFeatures = playback.WithoutFeatureV3(req.ClientFeatures, playback.FeatureSubripSidecarV3)
 		req.ClientFeatures = playback.WithoutFeatureV3(req.ClientFeatures, playback.FeatureMarkerThumbnailsV3)
+		req.ClientFeatures = playback.WithoutFeatureV3(req.ClientFeatures, playback.FeatureHLSSubtitleRenditionsV3)
 	}
 	timings.mark("decode_validate")
 	profileID := apimw.GetProfileID(r.Context())
@@ -1747,7 +1827,7 @@ func (h *PlaybackHandler) startPlaybackApplicationV3(r *http.Request, body []byt
 		AdditionalSubtitles: h.downloadedSubtitleInventoryV3(r.Context(), effectiveFile),
 	})
 	timings.mark("planning")
-	if req.AllowsAlternateVersions() && terminalAllowsAlternateFileV3(result.Terminal) && shouldTryAlternateFileV3(req.QualityPreference) {
+	if req.AllowsAlternateVersions() && terminalAllowsAlternateFileV3(result.Terminal) { //nolint:nestif // existing alternate-version fallback; only its quality condition changed
 		accessFilter := requestAccessFilter(r)
 		if alternates, alternateErr := h.findAlternateFiles(r.Context(), alternateBase, accessFilter); alternateErr == nil {
 			if alternateBase != requestedFile {
@@ -1807,13 +1887,28 @@ func (h *PlaybackHandler) startPlaybackApplicationV3(r *http.Request, body []byt
 					firstFailureAudioIndex = candidateAudioIndex
 				}
 			}
+			subtitleNotShown := false
+			if result.Terminal != nil && droppedSubtitle != nil && subtitleRefusalV3(result.Terminal) {
+				// The planner pinned the requested file's refusal on the
+				// subtitle, and every sibling that plays drops the subtitle
+				// too. Playing the requested file without it keeps its
+				// picture, when that plan can run.
+				if candidate := h.planWithoutSubtitleV3(r.Context(), playback.PlannerInputV3{Request: baseReq, RequestedFile: requestedFile, EffectiveFile: effectiveFile, LowerVersion: lowerVersionForFileV3(lowerVersion, effectiveFile), ServerBitrateCapKbps: serverBitrateCapV3(r.Context()), AudioTrackIndex: baseAudioIndex, Settings: settings, Registry: h.transformationRegistryV3(r.Context()), DVRPUStrippable: h.lazyDVRPUStrippableV3(r.Context(), effectiveFile), Now: time.Now(), AdditionalSubtitles: h.downloadedSubtitleInventoryV3(r.Context(), effectiveFile)}); candidate != nil {
+					droppedSubtitle = candidate
+					subtitleNotShown = true
+				}
+			}
 			if result.Terminal != nil && droppedSubtitle != nil {
 				req = droppedSubtitle.request
 				effectiveFile = droppedSubtitle.file
 				audioIndex = droppedSubtitle.audioIndex
 				result = droppedSubtitle.result
 				toneMapCapabilityErr = droppedSubtitle.toneMapErr
-				warnings = append(warnings, playback.SubtitleTrackUnavailableWarningV3())
+				if subtitleNotShown {
+					warnings = append(warnings, playback.SubtitleNotShownWarningV3())
+				} else {
+					warnings = append(warnings, playback.SubtitleTrackUnavailableWarningV3())
+				}
 			} else if result.Terminal != nil && firstFailureFile != nil {
 				req = firstFailureReq
 				effectiveFile = firstFailureFile
@@ -1825,7 +1920,6 @@ func (h *PlaybackHandler) startPlaybackApplicationV3(r *http.Request, body []byt
 	}
 	result = retryIncompleteToneMapPlanningV3(result, toneMapCapabilityErr)
 	result = retryIncompletePlaybackSettingsV3(result, settingsErr)
-	h.clarifyOriginalQuality4KTerminalV3(r.Context(), requestAccessFilter(r), result.Terminal, requestedFile, !shouldTryAlternateFileV3(req.QualityPreference))
 	// The exact app identity is logged with every decision so a route or
 	// terminal reported against one build is attributable without asking the
 	// user which version they are running.
@@ -2109,6 +2203,7 @@ func (h *PlaybackHandler) startPlannedPlaybackV3(r *http.Request, userID int, pr
 		abort()
 		return playback.DecisionResponseV3{}, commitErr
 	}
+	h.recordSessionRecipeV3(r.Context(), result.Plan.PlanID, &transport)
 	// Start-side effects belong after both the attempt and transport commits:
 	// retries that lose the idempotency race must not emit duplicate provider
 	// scrobbles or analysis work for the short-lived session they roll back.
@@ -2860,7 +2955,12 @@ func (h *PlaybackHandler) prepareIdentityTransportV3(r *http.Request, session *p
 		releaseLifecycle()
 		return nil
 	}
+	var sessionRecipe *playback.RecipeCard
+	if mode.headerAuth {
+		sessionRecipe = sessionRecipeCardV3(identityRecipeCard(&routeSession), session)
+	}
 	return preparedTransportV3{
+		sessionRecipe:      sessionRecipe,
 		url:                streamURL,
 		nodeURL:            nodeURL,
 		transportID:        transportID,
@@ -3119,8 +3219,11 @@ func (h *PlaybackHandler) resolveIdentityRouteV3(r *http.Request, sessionID stri
 			Policy: policy, ProxyAllowed: proxyAllowed,
 		},
 		SessionID: sessionID, EstimatedBitrateKbps: identityStreamBitrateKbpsV3(result),
-		TranscodeEligible: h.transcodeEligibilityV3(r.Context(), result, nil), ProxyEligible: nodepool.ClientReachableVia(accessPath, relayEligible),
-		ProxyExecutionEligible: nodepool.ClientReachableVia(accessPath, h.identityProxyEligibilityV3(r.Context(), result)), ExcludedShapeIDs: excludedShapes,
+		TranscodeEligible:      excludeUnreachableRouteNodesV3(r.Context(), h.transcodeEligibilityV3(r.Context(), result, nil)),
+		ProxyEligible:          excludeUnreachableRouteNodesV3(r.Context(), nodepool.ClientReachableVia(accessPath, relayEligible)),
+		ProxyExecutionEligible: excludeUnreachableRouteNodesV3(r.Context(), nodepool.ClientReachableVia(accessPath, h.identityProxyEligibilityV3(r.Context(), result))),
+		ExcludedShapeIDs:       excludedShapes,
+		UnreachableNodes:       unreachableRouteNodesV3(r.Context()),
 	})
 	if err != nil {
 		return noderouting.Decision{}, &transportErrorV3{reason: string(noderouting.OutcomePolicyUnsatisfied), message: "The playback routing policy is invalid.", retryable: false, cause: err}
@@ -3319,8 +3422,15 @@ func (h *PlaybackHandler) escalateRefusedProgressiveRemuxV3(ctx context.Context,
 // API may execute, or a proxy-egress shape whose proxies this client can
 // address. It gates the escalation above, so a false answer means the delivery
 // is refused for every candidate, not merely that the preferred one is busy.
+// A proxy this request found not answering does not count: a replan leaving a
+// dead proxy would otherwise keep the remux and fail on route capacity instead
+// of moving to HLS on a transcode node.
 func (h *PlaybackHandler) progressiveRemuxRouteAvailableV3(ctx context.Context, mode mediaAuthModeV3) bool {
 	proxyAllowed := mode.proxyEgress || (!mode.headerAuth && h.JWTSecret != "")
+	reachableProxy := false
+	if enumerator, ok := h.NodePlanner.(proxyNodeEnumeratorV3); ok {
+		reachableProxy = len(withoutUnreachableRouteNodesV3(ctx, enumerator.ProxyNodeURLs())) > 0
+	}
 	compiled, err := noderouting.Candidates(noderouting.Request{
 		Workload: noderouting.WorkloadRemux, Delivery: noderouting.DeliveryProgressiveRemux,
 		Policy: h.playbackRoutingPolicyForContextV3(ctx), ProxyAllowed: proxyAllowed,
@@ -3333,13 +3443,12 @@ func (h *PlaybackHandler) progressiveRemuxRouteAvailableV3(ctx context.Context,
 			return true
 		}
 		if mode.headerAuth {
-			if h.proxyEgressOriginsAvailableV3() {
+			if reachableProxy && h.proxyEgressOriginsAvailableV3() {
 				return true
 			}
 			continue
 		}
-		enumerator, ok := h.NodePlanner.(proxyNodeEnumeratorV3)
-		if ok && h.JWTSecret != "" && len(enumerator.ProxyNodeURLs()) > 0 {
+		if reachableProxy && h.JWTSecret != "" {
 			return true
 		}
 	}
@@ -3770,7 +3879,7 @@ func (h *PlaybackHandler) prepareLocalTransportV3(r *http.Request, session *play
 	sourceMetadata := sourceExecutionMetadataV3(file, result)
 	sourceProfile, sourceBitDepth := sourceVideoTranscodeFactsV3(file, result)
 	unlock := h.tm.LockSessionLifecycle(session.ID)
-	opts := playback.TranscodeOpts{InputPath: file.FilePath, OutputDir: outputDir, OutputSubdir: outputSubdir, SessionID: session.ID, SourceVideoCodec: sourceMetadata.VideoCodec, SourceVideoProfile: sourceProfile, SourceVideoBitDepth: sourceBitDepth, SourceAudioChannels: result.SourceAudioChannels, SoftwareVideoDecode: sourceMetadata.SoftwareVideoDecode, ToneMapPolicy: result.ToneMapPolicy, ToneMapMode: result.ToneMapMode, ToneMapSourceKind: result.ToneMapSourceKind, ToneMapRecipeVersion: result.ToneMapRecipeVersion, ToneMapPreflightRequired: result.ToneMapPreflightRequired, ToneMapSourceRevision: result.ToneMapSourceRevision, VideoBitstreamFilter: videoBitstreamFilterForPlanV3(result.Plan), VideoSampleEntry: videoSampleEntryForPlanV3(result.Plan), SeekSeconds: timeline.seekSeconds, StreamOriginSeconds: timeline.streamOriginSeconds, CopySeekAnchorResolved: timeline.copySeekAnchorResolved, StartSegmentNumber: timeline.startSegmentNumber, TargetResolution: result.TargetResolution, TargetCodecVideo: videoCodec, TargetCodecAudio: result.TargetAudioCodec, TargetAudioChannels: result.TargetAudioChannels, TargetAudioBitrateKbps: result.TargetAudioBitrateKbps, TargetBitrateKbps: result.TargetBitrateKbps, SegmentDuration: playback.DefaultSegmentDuration, SegmentRetentionSeconds: cfg.SegmentRetentionSeconds, FFmpegPath: cfg.FFmpegPath, HWAccel: cfg.HWAccel, HWDevice: cfg.HWDevice, AudioTrackIndex: plannedAudioTrackIndexV3(result, session.AudioTrackIndex), SubtitleTrackIndex: result.SubtitleTransportTrackIndex, SubtitleBurnIn: result.SubtitleBurnIn, SubtitleCodec: result.SubtitleCodec, TotalDuration: sourceMetadata.DurationSeconds, FastStart: true, NodeType: playbackNodeIntegratedV3, ExecutionMode: playbackNodeIntegratedV3, FFmpegLogSink: h.FFmpegLogSink}
+	opts := playback.TranscodeOpts{InputPath: file.FilePath, OutputDir: outputDir, OutputSubdir: outputSubdir, SessionID: session.ID, SourceVideoCodec: sourceMetadata.VideoCodec, SourceVideoProfile: sourceProfile, SourceVideoBitDepth: sourceBitDepth, SourceAudioChannels: result.SourceAudioChannels, SoftwareVideoDecode: sourceMetadata.SoftwareVideoDecode, ToneMapPolicy: result.ToneMapPolicy, ToneMapMode: result.ToneMapMode, ToneMapSourceKind: result.ToneMapSourceKind, ToneMapRecipeVersion: result.ToneMapRecipeVersion, ToneMapPreflightRequired: result.ToneMapPreflightRequired, ToneMapSourceRevision: result.ToneMapSourceRevision, VideoBitstreamFilter: videoBitstreamFilterForPlanV3(result.Plan), VideoSampleEntry: videoSampleEntryForPlanV3(result.Plan), SeekSeconds: timeline.seekSeconds, StreamOriginSeconds: timeline.streamOriginSeconds, CopySeekAnchorResolved: timeline.copySeekAnchorResolved, StartSegmentNumber: timeline.startSegmentNumber, TargetResolution: result.TargetResolution, TargetCodecVideo: videoCodec, TargetCodecAudio: result.TargetAudioCodec, TargetAudioChannels: result.TargetAudioChannels, TargetAudioBitrateKbps: result.TargetAudioBitrateKbps, TargetBitrateKbps: result.TargetBitrateKbps, SegmentDuration: playback.DefaultSegmentDuration, KeyframePlaylist: cfg.KeyframePlaylist && videoCodec == "copy", SegmentRetentionSeconds: cfg.SegmentRetentionSeconds, FFmpegPath: cfg.FFmpegPath, HWAccel: cfg.HWAccel, HWDevice: cfg.HWDevice, AudioTrackIndex: plannedAudioTrackIndexV3(result, session.AudioTrackIndex), SubtitleTrackIndex: result.SubtitleTransportTrackIndex, SubtitleBurnIn: result.SubtitleBurnIn, SubtitleCodec: result.SubtitleCodec, SubtitleRendition: result.SubtitleRendition, TotalDuration: sourceMetadata.DurationSeconds, FastStart: true, NodeType: playbackNodeIntegratedV3, ExecutionMode: playbackNodeIntegratedV3, FFmpegLogSink: h.FFmpegLogSink}
 	if opts.ToneMapMode != "" {
 		opts.ToneMapDVConfigPresent = sourceMetadata.ToneMapDVConfigPresent
 		opts.ToneMapDVBLCompatIDPresent = sourceMetadata.ToneMapDVBLCompatIDPresent
@@ -3878,20 +3987,23 @@ func (h *PlaybackHandler) prepareLocalTransportV3(r *http.Request, session *play
 		}
 	}
 	url := fmt.Sprintf("/playback/transcode/%s/master.m3u8", session.ID)
-	if !mode.headerAuth {
-		card := playback.NewRecipeCard(session.UserID, session.ProfileID, file.ID, "", ts.Opts())
-		card.OriginalStartedAt = session.StartedAt
-		card.StreamLocation = session.StreamLocation
-		card.RoutingNetworkProvider = new(netaccess.PathFromContext(r.Context()).Provider)
-		card.RoutingWorkload = string(routingWorkloadV3(result))
-		card.RoutingExecution = string(noderouting.ExecutionAPI)
-		card.RoutingEgress = string(noderouting.EgressAPI)
+	card := playback.NewRecipeCard(session.UserID, session.ProfileID, file.ID, "", ts.Opts())
+	card.OriginalStartedAt = session.StartedAt
+	card.StreamLocation = session.StreamLocation
+	card.RoutingNetworkProvider = new(netaccess.PathFromContext(r.Context()).Provider)
+	card.RoutingWorkload = string(routingWorkloadV3(result))
+	card.RoutingExecution = string(noderouting.ExecutionAPI)
+	card.RoutingEgress = string(noderouting.EgressAPI)
+	var sessionRecipe *playback.RecipeCard
+	if mode.headerAuth {
+		sessionRecipe = sessionRecipeCardV3(card, session)
+	} else {
 		url = appendStreamToken(url, h.signSessionToken(card, mode.headerAuth))
 	}
 	committed := false
-	previousNodeURL := session.TranscodeNodeURL
-	previousTransportID := remoteTransportID(session)
+	previousNodeURL, previousTransportID := h.liveTranscodeRouteV3(session)
 	return preparedTransportV3{
+		sessionRecipe:    sessionRecipe,
 		url:              url,
 		hwAccel:          ts.Opts().EffectiveEncoderHWAccel(),
 		toneMapMode:      ts.Opts().ToneMapMode,
@@ -4000,7 +4112,7 @@ func (h *PlaybackHandler) prepareRemoteTransportV3(r *http.Request, session *pla
 			hwAccel = playback.HWAccelNone
 		}
 	}
-	req := transcodenode.TranscodeStartRequest{SessionID: transportID, InputPath: file.FilePath, SourceVideoCodec: sourceMetadata.VideoCodec, SourceVideoProfile: sourceProfile, SourceVideoBitDepth: sourceBitDepth, SourceAudioChannels: result.SourceAudioChannels, SoftwareVideoDecode: sourceMetadata.SoftwareVideoDecode, ToneMapPolicy: result.ToneMapPolicy, ToneMapMode: result.ToneMapMode, ToneMapSourceKind: result.ToneMapSourceKind, ToneMapRecipeVersion: result.ToneMapRecipeVersion, ToneMapPreflightRequired: result.ToneMapPreflightRequired, ToneMapSourceRevision: result.ToneMapSourceRevision, VideoBitstreamFilter: videoBitstreamFilterForPlanV3(result.Plan), VideoSampleEntry: videoSampleEntryForPlanV3(result.Plan), SeekSeconds: timeline.seekSeconds, StreamOriginSeconds: timeline.streamOriginSeconds, CopySeekAnchorResolved: timeline.copySeekAnchorResolved, StartSegmentNumber: timeline.startSegmentNumber, TargetResolution: result.TargetResolution, TargetCodecVideo: videoCodec, TargetCodecAudio: result.TargetAudioCodec, TargetAudioChannels: result.TargetAudioChannels, TargetAudioBitrateKbps: result.TargetAudioBitrateKbps, TargetBitrateKbps: result.TargetBitrateKbps, SegmentDuration: playback.DefaultSegmentDuration, HWAccel: hwAccel, AudioTrackIndex: plannedAudioTrackIndexV3(result, session.AudioTrackIndex), SubtitleTrackIndex: result.SubtitleTransportTrackIndex, SubtitleBurnIn: result.SubtitleBurnIn, SubtitleCodec: result.SubtitleCodec, TotalDuration: sourceMetadata.DurationSeconds, RequireReady: true}
+	req := transcodenode.TranscodeStartRequest{SessionID: transportID, InputPath: file.FilePath, SourceVideoCodec: sourceMetadata.VideoCodec, SourceVideoProfile: sourceProfile, SourceVideoBitDepth: sourceBitDepth, SourceAudioChannels: result.SourceAudioChannels, SoftwareVideoDecode: sourceMetadata.SoftwareVideoDecode, ToneMapPolicy: result.ToneMapPolicy, ToneMapMode: result.ToneMapMode, ToneMapSourceKind: result.ToneMapSourceKind, ToneMapRecipeVersion: result.ToneMapRecipeVersion, ToneMapPreflightRequired: result.ToneMapPreflightRequired, ToneMapSourceRevision: result.ToneMapSourceRevision, VideoBitstreamFilter: videoBitstreamFilterForPlanV3(result.Plan), VideoSampleEntry: videoSampleEntryForPlanV3(result.Plan), SeekSeconds: timeline.seekSeconds, StreamOriginSeconds: timeline.streamOriginSeconds, CopySeekAnchorResolved: timeline.copySeekAnchorResolved, StartSegmentNumber: timeline.startSegmentNumber, TargetResolution: result.TargetResolution, TargetCodecVideo: videoCodec, TargetCodecAudio: result.TargetAudioCodec, TargetAudioChannels: result.TargetAudioChannels, TargetAudioBitrateKbps: result.TargetAudioBitrateKbps, TargetBitrateKbps: result.TargetBitrateKbps, SegmentDuration: playback.DefaultSegmentDuration, KeyframePlaylist: h.playbackConfig().KeyframePlaylist && videoCodec == "copy", HWAccel: hwAccel, AudioTrackIndex: plannedAudioTrackIndexV3(result, session.AudioTrackIndex), SubtitleTrackIndex: result.SubtitleTransportTrackIndex, SubtitleBurnIn: result.SubtitleBurnIn, SubtitleCodec: result.SubtitleCodec, SubtitleRendition: result.SubtitleRendition, TotalDuration: sourceMetadata.DurationSeconds, RequireReady: true}
 	req.ThrottleSeconds = playback.ConfiguredTranscodeThrottleSeconds(r.Context(), h.SettingsRepo)
 	if strings.EqualFold(videoCodec, "copy") {
 		req.CopyFMP4RecipeVersion = playback.CopyFMP4RecipeVersion
@@ -4066,6 +4178,14 @@ func (h *PlaybackHandler) prepareRemoteTransportV3(r *http.Request, session *pla
 		h.tm.StopRemoteTranscode(transportID, node.URL)
 		return preparedTransportV3{}, &transportErrorV3{reason: transcodeStartFailedReasonV3, message: "The selected transcode node did not confirm the throttle policy.", retryable: true, cause: err}
 	}
+	if err := transcodenode.ValidateKeyframePlaylistAttestation(req, nodeResp); err != nil {
+		h.tm.StopRemoteTranscode(transportID, node.URL)
+		return preparedTransportV3{}, &transportErrorV3{reason: transcodeStartFailedReasonV3, message: "The selected transcode node did not confirm the keyframe playlist.", retryable: true, cause: err}
+	}
+	if err := transcodenode.ValidateSubtitleRenditionAttestation(req, nodeResp); err != nil {
+		h.tm.StopRemoteTranscode(transportID, node.URL)
+		return preparedTransportV3{}, &transportErrorV3{reason: transcodeStartFailedReasonV3, message: "The selected transcode node did not confirm the subtitle rendition.", retryable: true, cause: err}
+	}
 	if req.ToneMapMode != "" && nodeResp.ToneMapMode != req.ToneMapMode {
 		h.tm.StopRemoteTranscode(transportID, node.URL)
 		return preparedTransportV3{}, &transportErrorV3{reason: transcodeStartFailedReasonV3, message: "The selected transcode node did not confirm the tone-map recipe.", retryable: true}
@@ -4121,9 +4241,8 @@ func (h *PlaybackHandler) prepareRemoteTransportV3(r *http.Request, session *pla
 		}
 	}
 	committed := false
-	previousNodeURL := session.TranscodeNodeURL
-	previousTransportID := remoteTransportID(session)
 	unlock := h.tm.LockSessionLifecycle(session.ID)
+	previousNodeURL, previousTransportID := h.liveTranscodeRouteV3(session)
 	routingEgress := noderouting.EgressAPI
 	egressNodeID := 0
 	egressNodeURL := ""
@@ -4178,7 +4297,11 @@ func (h *PlaybackHandler) prepareRemoteTransportV3(r *http.Request, session *pla
 	if routingWorkloadV3(result) == noderouting.WorkloadRemux {
 		rollbackRequired = func() error { return rollbackTransport(true) }
 	}
-	return preparedTransportV3{url: url, nodeURL: node.URL, transportID: transportID, hwAccel: confirmedHWAccel, toneMapMode: confirmedToneMapMode,
+	var sessionRecipe *playback.RecipeCard
+	if mode.headerAuth {
+		sessionRecipe = sessionRecipeCardV3(card, session)
+	}
+	return preparedTransportV3{sessionRecipe: sessionRecipe, url: url, nodeURL: node.URL, transportID: transportID, hwAccel: confirmedHWAccel, toneMapMode: confirmedToneMapMode,
 		routingWorkload: routingWorkloadV3(result), routingExecution: noderouting.ExecutionTranscode, routingExecutorID: node.ID, routingExecutorURL: node.URL,
 		routingEgress: routingEgress, routingEgressID: egressNodeID, routingEgressURL: egressNodeURL, commit: func() *transportErrorV3 {
 			if committed {
@@ -4193,6 +4316,18 @@ func (h *PlaybackHandler) prepareRemoteTransportV3(r *http.Request, session *pla
 		}, rollbackRequired: rollbackRequired}, nil
 }
 
+// liveTranscodeRouteV3 is the transcode route the session runs now, which a
+// replacement stops once it commits. Callers read it under the session
+// lifecycle lock, not from the snapshot they planned with: a move off a dead
+// node commits under that lock, so a route read here is the one the commit
+// replaces. A session the manager no longer has falls back to the snapshot.
+func (h *PlaybackHandler) liveTranscodeRouteV3(session *playback.Session) (nodeURL, transportID string) {
+	if current, err := h.sessionMgr.GetSession(session.ID); err == nil && current != nil {
+		return current.TranscodeNodeURL, remoteTransportID(current)
+	}
+	return session.TranscodeNodeURL, remoteTransportID(session)
+}
+
 // remoteTranscodeRecipeCardV3 captures the byte-affecting recipe of a started
 // remote transcode. It is what a proxy relays from (grant) or a client carries
 // (signed token), and what a restarted node reconstructs from, so it must
@@ -4205,7 +4340,7 @@ func (h *PlaybackHandler) prepareRemoteTransportV3(r *http.Request, session *pla
 // not part of the node's request/response contract, so the caller supplies it.
 func remoteTranscodeRecipeCardV3(session *playback.Session, file *models.MediaFile, nodeURL, transportID string, req transcodenode.TranscodeStartRequest, nodeResp transcodenode.TranscodeStartResponse, toneMapFilter string) playback.RecipeCard {
 	hw := firstNonEmptyHandlerV3(strings.TrimSpace(nodeResp.HWAccel), strings.TrimSpace(req.HWAccel))
-	card := playback.NewRecipeCard(session.UserID, session.ProfileID, file.ID, nodeURL, playback.TranscodeOpts{InputPath: req.InputPath, SessionID: session.ID, TranscodeTransportID: transportID, SourceVideoCodec: req.SourceVideoCodec, SourceVideoProfile: req.SourceVideoProfile, SourceVideoBitDepth: req.SourceVideoBitDepth, SourceAudioChannels: req.SourceAudioChannels, SoftwareVideoDecode: req.SoftwareVideoDecode || nodeResp.SoftwareVideoDecode, ToneMapPolicy: req.ToneMapPolicy, ToneMapMode: req.ToneMapMode, ToneMapSourceKind: req.ToneMapSourceKind, ToneMapFilter: toneMapFilter, ToneMapRecipeVersion: req.ToneMapRecipeVersion, ToneMapPreflightRequired: req.ToneMapPreflightRequired, ToneMapSourceRevision: req.ToneMapSourceRevision, VideoBitstreamFilter: req.VideoBitstreamFilter, VideoSampleEntry: req.VideoSampleEntry, SeekSeconds: req.SeekSeconds, StreamOriginSeconds: req.StreamOriginSeconds, CopySeekAnchorResolved: req.CopySeekAnchorResolved, StartSegmentNumber: req.StartSegmentNumber, TargetResolution: req.TargetResolution, TargetCodecVideo: req.TargetCodecVideo, TargetCodecAudio: req.TargetCodecAudio, TargetAudioChannels: req.TargetAudioChannels, TargetAudioBitrateKbps: req.TargetAudioBitrateKbps, TargetBitrateKbps: req.TargetBitrateKbps, SegmentDuration: req.SegmentDuration, HWAccel: hw, AudioTrackIndex: req.AudioTrackIndex, SubtitleTrackIndex: req.SubtitleTrackIndex, SubtitleBurnIn: req.SubtitleBurnIn, SubtitleCodec: req.SubtitleCodec, TotalDuration: req.TotalDuration, ThrottleSeconds: req.ThrottleSeconds})
+	card := playback.NewRecipeCard(session.UserID, session.ProfileID, file.ID, nodeURL, playback.TranscodeOpts{InputPath: req.InputPath, SessionID: session.ID, TranscodeTransportID: transportID, SourceVideoCodec: req.SourceVideoCodec, SourceVideoProfile: req.SourceVideoProfile, SourceVideoBitDepth: req.SourceVideoBitDepth, SourceAudioChannels: req.SourceAudioChannels, SoftwareVideoDecode: req.SoftwareVideoDecode || nodeResp.SoftwareVideoDecode, ToneMapPolicy: req.ToneMapPolicy, ToneMapMode: req.ToneMapMode, ToneMapSourceKind: req.ToneMapSourceKind, ToneMapFilter: toneMapFilter, ToneMapRecipeVersion: req.ToneMapRecipeVersion, ToneMapPreflightRequired: req.ToneMapPreflightRequired, ToneMapSourceRevision: req.ToneMapSourceRevision, VideoBitstreamFilter: req.VideoBitstreamFilter, VideoSampleEntry: req.VideoSampleEntry, SeekSeconds: req.SeekSeconds, StreamOriginSeconds: req.StreamOriginSeconds, CopySeekAnchorResolved: req.CopySeekAnchorResolved, StartSegmentNumber: req.StartSegmentNumber, TargetResolution: req.TargetResolution, TargetCodecVideo: req.TargetCodecVideo, TargetCodecAudio: req.TargetCodecAudio, TargetAudioChannels: req.TargetAudioChannels, TargetAudioBitrateKbps: req.TargetAudioBitrateKbps, TargetBitrateKbps: req.TargetBitrateKbps, SegmentDuration: req.SegmentDuration, KeyframePlaylist: req.KeyframePlaylist, HWAccel: hw, AudioTrackIndex: req.AudioTrackIndex, SubtitleTrackIndex: req.SubtitleTrackIndex, SubtitleBurnIn: req.SubtitleBurnIn, SubtitleCodec: req.SubtitleCodec, SubtitleRendition: req.SubtitleRendition, TotalDuration: req.TotalDuration, ThrottleSeconds: req.ThrottleSeconds})
 	card.ToneMapDVConfigPresent = req.ToneMapDVConfigPresent
 	if encoderHWAccel := strings.TrimSpace(nodeResp.EncoderHWAccel); encoderHWAccel != "" {
 		card.EncoderHWAccel = encoderHWAccel
@@ -4476,6 +4611,7 @@ func (h *PlaybackHandler) attachSubtitleArtifactV3(ctx context.Context, sessionI
 	if selectedIndex < 0 || (plan.Subtitle.Mode != playback.SubtitleRenderV3 && plan.Subtitle.Mode != playback.SubtitleConvertV3) {
 		plan.Subtitle.Artifact = nil
 		plan.Subtitle.Embedded = nil
+		plan.Subtitle.HLSRendition = nil
 		if plan.Subtitle.Mode == playback.SubtitleOffV3 {
 			plan.Subtitle.TrackID = ""
 		}
@@ -4500,6 +4636,15 @@ func (h *PlaybackHandler) attachSubtitleArtifactV3(ctx context.Context, sessionI
 		plan.Subtitle.Artifact = nil
 		return nil
 	}
+	if plan.Subtitle.HLSRendition != nil {
+		// The track is carried by the transcode's own playlist; the inventory
+		// keeps its sidecar URL for a later selection.
+		if plan.Delivery != playback.DeliveryTranscodeHLSV3 || !ok || item.Source != playback.SubtitleSourceEmbeddedV3 || item.TrackID != plan.Subtitle.TrackID {
+			return errors.New("invalid HLS subtitle rendition route")
+		}
+		plan.Subtitle.Artifact = nil
+		return nil
+	}
 	if frozenDownloaded == nil && item.URL == "" {
 		return fmt.Errorf("subtitle track %d is %s and has no fetchable artifact", selectedIndex, item.Delivery)
 	}
@@ -4785,7 +4930,9 @@ func (h *PlaybackHandler) replanPlaybackApplicationV3(r *http.Request, sessionID
 		var err error
 		rollbackSession, err = transport.applySession()
 		if err != nil {
-			if rollbackErr, _ := rollbackFailedReplanV3(transport, nil); rollbackErr != nil {
+			// With no session to restore, only the transport can fail.
+			rollbackErr, _ := rollbackFailedReplanV3(transport, nil)
+			if rollbackErr != nil {
 				slog.ErrorContext(r.Context(), "protocol v3 unapplied replacement transport cancellation failed", "session", sessionID, "error", rollbackErr)
 				return playback.DecisionResponseV3{}, playbackOperationError(http.StatusInternalServerError, "internal_error", "Failed to cancel the unapplied replacement transport")
 			}
@@ -4796,8 +4943,10 @@ func (h *PlaybackHandler) replanPlaybackApplicationV3(r *http.Request, sessionID
 		if errors.Is(err, playback.ErrAttemptStoppedV3) {
 			// A stop landed on another replica while this replan ran: tear the
 			// replacement transport and the local session down and report the
-			// session gone; the deny marker refuses the plan anyway.
-			if transportRollbackErr, _ := rollbackFailedReplanV3(transport, rollbackSession); transportRollbackErr != nil {
+			// session gone; the deny marker refuses the plan anyway. The abort
+			// below makes a failed session restore moot.
+			transportRollbackErr, _ := rollbackFailedReplanV3(transport, rollbackSession)
+			if transportRollbackErr != nil {
 				slog.ErrorContext(r.Context(), "protocol v3 replacement transport cancellation failed", "session", sessionID, "error", transportRollbackErr)
 			}
 			_ = h.abortPlaybackSessionByID(context.WithoutCancel(r.Context()), sessionID)
@@ -4823,6 +4972,7 @@ func (h *PlaybackHandler) replanPlaybackApplicationV3(r *http.Request, sessionID
 			_ = h.abortPlaybackSessionByID(context.WithoutCancel(r.Context()), sessionID)
 			return playback.DecisionResponseV3{}, playbackOperationError(http.StatusServiceUnavailable, commitErr.reason, commitErr.message)
 		}
+		h.recordSessionRecipeV3(r.Context(), updated.CurrentPlanID, transport)
 		if transport.afterDurableCommit != nil {
 			transport.afterDurableCommit()
 		}
@@ -4873,6 +5023,9 @@ func (h *PlaybackHandler) executeReplanV3(r *http.Request, record *playback.Atte
 	r = r.WithContext(withServerBitrateCapV3(r.Context(), record.ServerBitrateCapKbps))
 	audioDegraded := false
 	subtitleDegraded := false
+	// subtitleNotShown marks a subtitle the effective file has but cannot
+	// show, as opposed to one the file lacks.
+	subtitleNotShown := false
 	reservationHeld := false
 	reservationHandedOff := false
 	cancelReservation := func() {
@@ -4893,6 +5046,16 @@ func (h *PlaybackHandler) executeReplanV3(r *http.Request, record *playback.Atte
 	seekReanchor := operation == playback.ReplanOperationSeekReanchorV3
 	seekFailureRecovery := operation == playback.ReplanOperationSeekFailureRecoveryV3
 	seekScopedRecovery := seekReanchor || seekFailureRecovery
+	// A seek reanchor must keep its route; every other replan first finds out
+	// whether the session's nodes still answer, so neither the plan nor the
+	// route is built on a node that went away.
+	var unreachableNodes map[string]struct{}
+	if !seekReanchor {
+		if current, err := h.sessionMgr.GetSession(record.SessionID); err == nil {
+			unreachableNodes = h.unreachableSessionNodesV3(r.Context(), current)
+			r = r.WithContext(withUnreachableRouteNodesV3(r.Context(), unreachableNodes))
+		}
+	}
 	trackChange := operation == playback.ReplanOperationTrackChangeV3
 	qualityChange := operation == playback.ReplanOperationQualityChangeV3
 	outputChange := operation == playback.ReplanOperationOutputChangeV3
@@ -4965,7 +5128,7 @@ func (h *PlaybackHandler) executeReplanV3(r *http.Request, record *playback.Atte
 		}
 		if strings.TrimSpace(req.QualityPreference) != "" {
 			// Replans may omit unchanged intent. Normalizing an absent quality
-			// would silently reset "original" or a fixed rung to "auto".
+			// would silently reset a fixed rung to "auto".
 			start.QualityPreference = req.QualityPreference
 		}
 		start.StartPosition = &req.PositionSeconds
@@ -4989,14 +5152,7 @@ func (h *PlaybackHandler) executeReplanV3(r *http.Request, record *playback.Atte
 			applySelectedTrackOverridesToStartV3(&start, req.SelectedTracks)
 		}
 	}
-	// Native selection is negotiated at start and can only be disabled during
-	// an attempt. Keep a confirmed failure disabled even when a later client
-	// replan resends its full capability/feature advertisement.
-	if !playback.HasFeatureV3(record.NormalizedRequest.ClientFeatures, playback.FeatureEmbeddedSubtitlesV3) || req.Failure.Classification == "subtitle_embedded_failed" {
-		start.ClientFeatures = slices.DeleteFunc(slices.Clone(start.ClientFeatures), func(feature string) bool {
-			return strings.EqualFold(strings.TrimSpace(feature), playback.FeatureEmbeddedSubtitlesV3)
-		})
-	}
+	start.ClientFeatures = withoutFailedSubtitleRoutesV3(start.ClientFeatures, record.NormalizedRequest.ClientFeatures, req.Failure.Classification)
 	requestedFallbackID := record.EffectiveMediaFileID
 	effectiveFallbackID := record.RequestedMediaFileID
 	if seekScopedRecovery {
@@ -5053,11 +5209,10 @@ func (h *PlaybackHandler) executeReplanV3(r *http.Request, record *playback.Atte
 			// An output refresh may make the requested edition viable again,
 			// but it must not retire a healthy active alternate merely because
 			// the viewer selected a track unique to that alternate. Other intent
-			// changes must not drop the viewer's subtitle to get back there either,
-			// unless quality "original" pins the requested edition. Staying keeps
-			// the selection, so a fallback can still prefer a version that has it.
-			keepActiveEdition := (outputChange && (remapErr != nil || subtitleDropped)) ||
-				(subtitleDropped && shouldTryAlternateFileV3(start.QualityPreference))
+			// changes must not drop the viewer's subtitle to get back there either.
+			// Staying keeps the selection, so a fallback can still prefer a
+			// version that has it.
+			keepActiveEdition := (outputChange && remapErr != nil) || subtitleDropped
 			if keepActiveEdition {
 				effectiveFile = currentEffectiveFile
 				keptActiveEditionForSubtitle = subtitleDropped
@@ -5101,10 +5256,21 @@ func (h *PlaybackHandler) executeReplanV3(r *http.Request, record *playback.Atte
 			return playback.DecisionResponseV3{}, *record, nil, &transportErrorV3{reason: "track_unavailable", message: err.Error()}
 		}
 	}
+	// A recovery whose node stopped answering failed on the node, not on its
+	// recipe: keep the failed plan eligible so the replacement can run the same
+	// recipe on another node instead of stepping down or running out of plans.
+	nodeRecovery := !userIntentOperation && len(unreachableNodes) > 0
+	currentKey := playback.PlanAttemptKeyV3(record.CurrentPlan, record.NormalizedRequest.ClientPlaybackContext.Output.OutputContextID, req.LocalMutations)
 	attemptedKeys := []string(nil)
 	if !intentChange && !seekReanchor && !userIntentOperation {
-		attemptedKeys = append(attemptedKeys, req.AttemptedPlanKeys...)
-		if !proxyOriginRecovery && !containsStringExactV3(attemptedKeys, req.PlanAttemptKey) {
+		failedKey := strings.TrimSpace(req.PlanAttemptKey)
+		for _, key := range req.AttemptedPlanKeys {
+			if trimmed := strings.TrimSpace(key); nodeRecovery && (trimmed == failedKey || trimmed == currentKey) {
+				continue
+			}
+			attemptedKeys = append(attemptedKeys, key)
+		}
+		if !proxyOriginRecovery && !nodeRecovery && !containsStringExactV3(attemptedKeys, req.PlanAttemptKey) {
 			attemptedKeys = append(attemptedKeys, req.PlanAttemptKey)
 		}
 	}
@@ -5114,11 +5280,10 @@ func (h *PlaybackHandler) executeReplanV3(r *http.Request, record *playback.Atte
 		// ping-pong the session. A client-reported local mutation (for example a
 		// PCM recovery route) is folded into the failed plan's key here — the
 		// server owns the hash; clients only echo opaque keys.
-		currentKey := playback.PlanAttemptKeyV3(record.CurrentPlan, record.NormalizedRequest.ClientPlaybackContext.Output.OutputContextID, req.LocalMutations)
-		if !proxyOriginRecovery && !containsStringExactV3(attemptedKeys, currentKey) {
+		if !proxyOriginRecovery && !nodeRecovery && !containsStringExactV3(attemptedKeys, currentKey) {
 			attemptedKeys = append(attemptedKeys, currentKey)
 		}
-		if len(req.LocalMutations) > 0 && !proxyOriginRecovery {
+		if len(req.LocalMutations) > 0 && !proxyOriginRecovery && !nodeRecovery {
 			// The unmutated recipe already failed before the client mutated it
 			// locally; exclude it as well.
 			unmutatedKey := playback.PlanAttemptKeyV3(record.CurrentPlan, record.NormalizedRequest.ClientPlaybackContext.Output.OutputContextID, nil)
@@ -5177,7 +5342,7 @@ func (h *PlaybackHandler) executeReplanV3(r *http.Request, record *playback.Atte
 		}
 		result, toneMapCapabilityErr = h.planPlaybackWithCapabilitiesV3(r.Context(), playback.PlannerInputV3{Request: start, RequestedFile: plannerRequestedFile, EffectiveFile: effectiveFile, LowerVersion: lowerVersionForFileV3(lowerVersion, effectiveFile), ServerBitrateCapKbps: serverBitrateCapV3(r.Context()), AudioTrackIndex: audioIndex, Settings: plannerSettings, Registry: h.transformationRegistryV3(r.Context()), DVRPUStrippable: h.lazyDVRPUStrippableV3(r.Context(), effectiveFile), Now: time.Now(), AttemptedKeys: attemptedKeys, AdditionalSubtitles: h.downloadedSubtitleInventoryV3(r.Context(), effectiveFile)})
 	}
-	if start.AllowsAlternateVersions() && terminalAllowsAlternateFileV3(result.Terminal) && replanAllowsAlternateFileV3(operation, start.QualityPreference) {
+	if start.AllowsAlternateVersions() && terminalAllowsAlternateFileV3(result.Terminal) && replanAllowsAlternateFileV3(operation) { //nolint:nestif // existing alternate-version fallback; only its quality condition changed
 		accessFilter := requestAccessFilter(r)
 		alternates, alternateErr := h.findAlternateFiles(r.Context(), requestedFile, accessFilter)
 		if keptActiveEditionForSubtitle {
@@ -5227,8 +5392,10 @@ func (h *PlaybackHandler) executeReplanV3(r *http.Request, record *playback.Atte
 				}
 				if candidateResult.Terminal == nil && subtitleDropped {
 					// Prefer a version that keeps the viewer's subtitle; hold
-					// this one back in case none does.
-					if droppedSubtitle == nil {
+					// this one back in case none does. The requested edition,
+					// listed last when it was passed over only for the
+					// subtitle, outranks any other version held back.
+					if droppedSubtitle == nil || candidateFile.ID == requestedFile.ID {
 						droppedSubtitle = &alternateCandidateV3{file: candidateFile, request: candidateStart, audioIndex: candidateAudioIndex, result: candidateResult, toneMapErr: candidateToneMapErr}
 					}
 					continue
@@ -5249,6 +5416,18 @@ func (h *PlaybackHandler) executeReplanV3(r *http.Request, record *playback.Atte
 					firstFailureAudioIndex = candidateAudioIndex
 				}
 			}
+			// A held-back requested edition is already the picture the
+			// viewer asked for, so it keeps its place.
+			if result.Terminal != nil && droppedSubtitle != nil && droppedSubtitle.file.ID != requestedFile.ID && subtitleRefusalV3(result.Terminal) {
+				// The planner pinned the effective file's refusal on the
+				// subtitle, and every sibling that plays drops the subtitle
+				// too. Playing the effective file without it keeps its
+				// picture, when that plan can run.
+				if candidate := h.planWithoutSubtitleV3(r.Context(), playback.PlannerInputV3{Request: baseStart, RequestedFile: plannerRequestedFile, EffectiveFile: baseEffectiveFile, LowerVersion: lowerVersionForFileV3(lowerVersion, baseEffectiveFile), ServerBitrateCapKbps: serverBitrateCapV3(r.Context()), AudioTrackIndex: baseAudioIndex, Settings: plannerSettings, Registry: h.transformationRegistryV3(r.Context()), DVRPUStrippable: h.lazyDVRPUStrippableV3(r.Context(), baseEffectiveFile), Now: time.Now(), AttemptedKeys: attemptedKeys, AdditionalSubtitles: h.downloadedSubtitleInventoryV3(r.Context(), baseEffectiveFile)}); candidate != nil {
+					droppedSubtitle = candidate
+					subtitleNotShown = true
+				}
+			}
 			if result.Terminal != nil && droppedSubtitle != nil {
 				start = droppedSubtitle.request
 				effectiveFile = droppedSubtitle.file
@@ -5267,7 +5446,6 @@ func (h *PlaybackHandler) executeReplanV3(r *http.Request, record *playback.Atte
 	}
 	result = retryIncompleteToneMapPlanningV3(result, toneMapCapabilityErr)
 	result = retryIncompletePlaybackSettingsV3(result, plannerSettingsErr)
-	h.clarifyOriginalQuality4KTerminalV3(r.Context(), requestAccessFilter(r), result.Terminal, requestedFile, replanAlternateFilePinnedByOriginalQualityV3(operation, start.QualityPreference))
 	// Media authentication is attempt-sticky (pinned in HandleReplanPlaybackV3),
 	// so this mode always equals the one the attempt started under: a reused
 	// transport cannot change the session's media security contract.
@@ -5298,7 +5476,11 @@ func (h *PlaybackHandler) executeReplanV3(r *http.Request, record *playback.Atte
 		result.Plan.DegradationWarnings = append(result.Plan.DegradationWarnings, playback.AudioTrackUnavailableWarningV3())
 	}
 	if subtitleDegraded {
-		result.Plan.DegradationWarnings = appendWarningOnceV3(result.Plan.DegradationWarnings, playback.SubtitleTrackUnavailableWarningV3())
+		warning := playback.SubtitleTrackUnavailableWarningV3()
+		if subtitleNotShown {
+			warning = playback.SubtitleNotShownWarningV3()
+		}
+		result.Plan.DegradationWarnings = appendWarningOnceV3(result.Plan.DegradationWarnings, warning)
 	}
 	session, err := h.sessionMgr.GetSession(record.SessionID)
 	if err != nil {
@@ -5350,7 +5532,7 @@ func (h *PlaybackHandler) executeReplanV3(r *http.Request, record *playback.Atte
 		}
 	}
 	transportReused := false
-	if trackChange && h.hasActiveHLSTransportV3(session) {
+	if trackChange && len(unreachableNodes) == 0 && h.hasActiveHLSTransportV3(session) {
 		proxyAllowed := mode.proxyEgress || (!mode.headerAuth && h.JWTSecret != "")
 		policy := h.playbackRoutingPolicyForContextV3(r.Context())
 		if reusedRecipe, ok := sidecarOnlyHLSReplanV3(record, result.Plan, artifactRecipe, req.ClientPlaybackContext.Output.OutputContextID); ok &&
@@ -5375,6 +5557,9 @@ func (h *PlaybackHandler) executeReplanV3(r *http.Request, record *playback.Atte
 		result.Plan.Timeline = reusedTimeline
 		result.Plan.ExpiresAt = record.CurrentPlan.ExpiresAt
 		transport = reusedHLSTransportV3(session, record.CurrentPlan.Stream.URL)
+		if mode.headerAuth {
+			transport.sessionRecipe = h.reusedSessionRecipeV3(r.Context(), session.ID, record.CurrentPlanID)
+		}
 		slog.InfoContext(r.Context(), "protocol v3 replan reused active HLS A/V transport",
 			logComponentKey, playbackLogValueV3,
 			"playback_session_id", session.ID,
@@ -5435,6 +5620,7 @@ func (h *PlaybackHandler) executeReplanV3(r *http.Request, record *playback.Atte
 	}
 	if seekScopedRecovery {
 		replacement.PositionSeconds = &req.PositionSeconds
+		replacement.PositionSequence = record.LastSequence
 		replacement.PreservePaused = true
 	}
 	transport.applySession = func() (func() error, error) {
@@ -5671,6 +5857,7 @@ func seekReanchorIdentityChangesV3(record *playback.AttemptRecordV3, candidate *
 	add("selected_subtitle", !sameTrackIdentityV3(candidate.SelectedTracks.Subtitle, current.SelectedTracks.Subtitle))
 	add("subtitle_mode", candidate.Subtitle.Mode != current.Subtitle.Mode || candidate.Subtitle.TrackID != current.Subtitle.TrackID)
 	add("subtitle_embedded_route", !sameEmbeddedSubtitleRouteV3(candidate.Subtitle.Embedded, current.Subtitle.Embedded))
+	add("subtitle_hls_rendition", !sameHLSSubtitleRenditionV3(candidate.Subtitle.HLSRendition, current.Subtitle.HLSRendition))
 	add("subtitle_artifact_route", !sameSubtitleArtifactRouteV3(candidate.Subtitle.Artifact, current.Subtitle.Artifact))
 	add("subtitle_fidelity", candidate.SubtitleFidelityPolicy != current.SubtitleFidelityPolicy)
 	add("transformations", !sameTransformationsV3(candidate.Transformations, current.Transformations))
@@ -5707,6 +5894,32 @@ func sameEmbeddedSubtitleRouteV3(left, right *playback.EmbeddedSubtitleV3) bool
 	return *left == *right
 }
 
+// withoutFailedSubtitleRoutesV3 removes the subtitle routes this attempt may
+// no longer use from a replan's client features.
+//
+// Native selection is negotiated at start and can only be disabled during an
+// attempt: a confirmed failure stays disabled even when a later replan resends
+// the full feature advertisement. A subtitle rendition the player could not
+// select would fail the same way on the next intent replan, which forgets the
+// attempted plan keys, so it is dropped from the durable request too; the
+// attempt-sticky pinning then keeps it dropped.
+func withoutFailedSubtitleRoutesV3(features, negotiated []string, failureClassification string) []string {
+	if !playback.HasFeatureV3(negotiated, playback.FeatureEmbeddedSubtitlesV3) || failureClassification == playback.FailureSubtitleEmbeddedFailedV3 {
+		features = playback.WithoutFeatureV3(features, playback.FeatureEmbeddedSubtitlesV3)
+	}
+	if failureClassification == playback.FailureSubtitleHLSRenditionFailedV3 {
+		features = playback.WithoutFeatureV3(features, playback.FeatureHLSSubtitleRenditionsV3)
+	}
+	return features
+}
+
+func sameHLSSubtitleRenditionV3(left, right *playback.HLSSubtitleRenditionV3) bool {
+	if left == nil || right == nil {
+		return left == nil && right == nil
+	}
+	return *left == *right
+}
+
 func sameSubtitleArtifactRouteV3(left, right *playback.SubtitleArtifactV3) bool {
 	if left == nil || right == nil {
 		return left == nil && right == nil
@@ -5790,6 +6003,11 @@ func sidecarOnlyHLSReplanV3(record *playback.AttemptRecordV3, candidate *playbac
 		record.CurrentPlan.EffectiveMediaFileID != candidate.EffectiveMediaFileID ||
 		!isHLSDeliveryV3(record.CurrentPlan.Delivery) || record.CurrentPlan.Delivery != candidate.Delivery ||
 		record.CurrentPlan.Subtitle.Mode == playback.SubtitleBurnInV3 || candidate.Subtitle.Mode == playback.SubtitleBurnInV3 ||
+		// A subtitle rendition is part of what FFmpeg emits, so only an
+		// unchanged one keeps the transport. Dropping a rendition is fine:
+		// the client stops selecting it.
+		candidate.Subtitle.HLSRendition != nil && (record.CurrentPlan.Subtitle.HLSRendition == nil ||
+			!record.FrozenRecipe.SubtitleRendition || record.FrozenRecipe.SubtitleTransportTrackIndex != candidateRecipe.SubtitleTransportTrackIndex) ||
 		!sameTrackIdentityV3(record.CurrentPlan.SelectedTracks.Audio, candidate.SelectedTracks.Audio) {
 		return candidateRecipe, false
 	}
@@ -6031,10 +6249,6 @@ func lowerVersionForFileV3(lower *playback.LowerVersionV3, file *models.MediaFil
 	return &playback.LowerVersionV3{Requested: lower.Requested, Lower: playback.SourceDescriptorFromFileV3(file, 0)}
 }
 
-func shouldTryAlternateFileV3(qualityPreference string) bool {
-	return !strings.EqualFold(strings.TrimSpace(qualityPreference), "original")
-}
-
 const (
 	terminalNoAlternateVersionV3            = "no_alternate_version"
 	terminalHDRTranscodeUnsupportedV3       = playback.TerminalHDRTranscodeUnsupportedV3
@@ -6074,6 +6288,31 @@ func terminalAllowsAlternateFileV3(terminal *playback.TerminalV3) bool {
 	}
 }
 
+// subtitleRefusalV3 reports a refusal the planner pinned on the selected
+// subtitle: a burn-in that was the only reason for an adaptation the file
+// cannot take, or a subtitle the fidelity policy cannot serve. The file may
+// then play with the subtitle cleared; callers re-plan it to find out.
+func subtitleRefusalV3(terminal *playback.TerminalV3) bool {
+	return terminal != nil && terminal.Reason == terminalSubtitleConversionUnsupportedV3
+}
+
+// planWithoutSubtitleV3 plans input's file again with the selected subtitle
+// cleared. It returns nil unless that plan can run: a progressive remux this
+// attempt cannot reach must escalate here, because the caller drops a sibling
+// that already plays in favor of the result.
+func (h *PlaybackHandler) planWithoutSubtitleV3(ctx context.Context, input playback.PlannerInputV3) *alternateCandidateV3 {
+	input.Request.SubtitleTrackID, input.Request.SubtitleTrackIndex = "", nil
+	result, toneMapErr := h.planPlaybackWithCapabilitiesV3(ctx, input)
+	if result.Terminal != nil {
+		return nil
+	}
+	result, escalateErr := h.escalateRefusedProgressiveRemuxV3(ctx, headerAuthenticatedMediaV3(input.Request.ClientFeatures), func() playback.PlannerInputV3 { return input }, result)
+	if escalateErr != nil {
+		return nil
+	}
+	return &alternateCandidateV3{file: input.EffectiveFile, request: input.Request, audioIndex: input.AudioTrackIndex, result: result, toneMapErr: toneMapErr}
+}
+
 // alternateCandidateV3 is a planned alternate version held back while the
 // fallback loop looks for a better one.
 type alternateCandidateV3 struct {
@@ -6094,7 +6333,7 @@ func appendWarningOnceV3(warnings []playback.DegradationWarningV3, warning playb
 	return append(warnings, warning)
 }
 
-func replanAllowsAlternateFileV3(operation playback.ReplanOperationV3, qualityPreference string) bool {
+func replanAllowsAlternateFileV3(operation playback.ReplanOperationV3) bool {
 	switch operation {
 	case playback.ReplanOperationFailureRecoveryV3, playback.ReplanOperationQualityChangeV3, playback.ReplanOperationOutputChangeV3, playback.ReplanOperationTrackChangeV3:
 		// Quality, output, and track changes can make another version the only
@@ -6102,28 +6341,12 @@ func replanAllowsAlternateFileV3(operation playback.ReplanOperationV3, qualityPr
 		// that an HDR source cannot support while an SDR alternate can. The
 		// subtitle identity is remapped before the alternate is adopted; seek-only
 		// operations remain pinned to the mounted source.
-		return shouldTryAlternateFileV3(qualityPreference)
+		return true
 	default:
 		return false
 	}
 }
 
-func replanAlternateFilePinnedByOriginalQualityV3(operation playback.ReplanOperationV3, qualityPreference string) bool {
-	if shouldTryAlternateFileV3(qualityPreference) {
-		return false
-	}
-	return operation == playback.ReplanOperationFailureRecoveryV3 || operation == playback.ReplanOperationQualityChangeV3 || operation == playback.ReplanOperationOutputChangeV3
-}
-
-func (h *PlaybackHandler) clarifyOriginalQuality4KTerminalV3(ctx context.Context, filter catalog.AccessFilter, terminal *playback.TerminalV3, requestedFile *models.MediaFile, alternateFilePinned bool) {
-	if !alternateFilePinned || terminal == nil || terminal.Reason != terminalNoAlternateVersionV3 || terminal.Message != playback.TerminalMessage4KTranscodeDisabledV3 {
-		return
-	}
-	if alternate, err := h.findAlternateFile(ctx, requestedFile, filter); err == nil && alternate != nil && !playback.Is4KMediaFileV3(alternate) {
-		terminal.Message = "4K transcoding is disabled and quality 'original' pins the 4K version; a compatible lower-resolution version of this title is available."
-	}
-}
-
 func (h *PlaybackHandler) lockReplanV3(sessionID string) func() {
 	h.v3ReplanMu.Lock()
 	if h.v3ReplanLocks == nil {
diff --git a/internal/api/handlers/playback_v3_node_recipe_test.go b/internal/api/handlers/playback_v3_node_recipe_test.go
index 32bb9a6898..43cb90b0d6 100644
--- a/internal/api/handlers/playback_v3_node_recipe_test.go
+++ b/internal/api/handlers/playback_v3_node_recipe_test.go
@@ -431,7 +431,8 @@ func TestPrepareTransportV3RemoteCommitDropsThePreviousTransportRecipe(t *testin
 	}
 }
 
-// A stopped session's node job is gone, so its stored recipe must be too.
+// A stopped session's node job is gone, so its stored recipe must be too, and a
+// stopped session is over, so its API recovery card goes with it.
 func TestFinalizeSessionStopDropsTheNodeRecipe(t *testing.T) {
 	handler := NewPlaybackHandler(playback.NewSessionManager(0, 0))
 	const transportID = "session-node-stop-plan0001-aaaabbbb"
@@ -445,6 +446,10 @@ func TestFinalizeSessionStopDropsTheNodeRecipe(t *testing.T) {
 		transportID: {SessionID: "session-node-stop", TranscodeTransportID: transportID},
 	}}
 	handler.NodeRecipeStore = recipes
+	sessionRecipes := &recordingRecipeCardStoreV3{cards: map[string]playback.RecipeCard{
+		"session-node-stop": {SessionID: "session-node-stop", TranscodeTransportID: transportID, RequireMediaAuthorization: true},
+	}}
+	handler.SessionRecipeStore = sessionRecipes
 	session := &playback.Session{
 		ID: "session-node-stop", UserID: 7, ProfileID: "profile-1",
 		TranscodeNodeURL: node.URL, TranscodeTransportID: transportID,
@@ -464,6 +469,9 @@ func TestFinalizeSessionStopDropsTheNodeRecipe(t *testing.T) {
 	if len(recipes.deleted) != 1 || recipes.deleted[0] != transportID {
 		t.Fatalf("recipes deleted on stop = %v, want the session's transport recipe dropped", recipes.deleted)
 	}
+	if len(sessionRecipes.deleted) != 1 || sessionRecipes.deleted[0] != "session-node-stop" {
+		t.Fatalf("session recipes deleted on stop = %v, want the session's recovery card dropped", sessionRecipes.deleted)
+	}
 }
 
 func TestStopPlaybackRetainsProgressiveSessionUntilAuthorityRevocationSucceeds(t *testing.T) {
diff --git a/internal/api/handlers/playback_v3_origins_test.go b/internal/api/handlers/playback_v3_origins_test.go
index efbb8a7140..c7bffd357c 100644
--- a/internal/api/handlers/playback_v3_origins_test.go
+++ b/internal/api/handlers/playback_v3_origins_test.go
@@ -24,6 +24,7 @@ type recordingRecipeCardStoreV3 struct {
 	disabled  bool
 	putErr    error
 	deleteErr error
+	lookupErr error
 	cards     map[string]playback.RecipeCard
 	deleted   []string
 	// ops is the ordered call log ("get", "put", "delete"), so a test can
@@ -42,6 +43,16 @@ func (s *recordingRecipeCardStoreV3) Get(_ context.Context, sessionID string) (*
 	return &card, true
 }
 
+// Lookup is Get as the session-recipe store reads it, with a store outage
+// reported rather than folded into a miss.
+func (s *recordingRecipeCardStoreV3) Lookup(ctx context.Context, sessionID string) (*playback.RecipeCard, bool, error) {
+	if s.lookupErr != nil {
+		return nil, false, s.lookupErr
+	}
+	card, ok := s.Get(ctx, sessionID)
+	return card, ok, nil
+}
+
 func (s *recordingRecipeCardStoreV3) Put(_ context.Context, sessionID string, card playback.RecipeCard) error {
 	s.ops = append(s.ops, "put")
 	if s.putErr != nil {
diff --git a/internal/api/handlers/playback_v3_route_nodes.go b/internal/api/handlers/playback_v3_route_nodes.go
new file mode 100644
index 0000000000..aae40cecf7
--- /dev/null
+++ b/internal/api/handlers/playback_v3_route_nodes.go
@@ -0,0 +1,131 @@
+package handlers
+
+import (
+	"context"
+	"log/slog"
+	"slices"
+	"sync"
+	"time"
+
+	"github.com/prairie-server/prairie-server/internal/logredact"
+	"github.com/prairie-server/prairie-server/internal/nodepool"
+	"github.com/prairie-server/prairie-server/internal/noderouting"
+	"github.com/prairie-server/prairie-server/internal/playback"
+)
+
+// routeNodeProbeTimeoutV3 bounds how long a replan waits to learn whether the
+// session's current nodes still answer. A refused connection returns at once;
+// the bound only matters for a node that stopped answering without closing
+// its port.
+const routeNodeProbeTimeoutV3 = 2 * time.Second
+
+type unreachableRouteNodesKeyV3 struct{}
+
+// withUnreachableRouteNodesV3 records nodes this request found unreachable, by
+// internal URL, so route resolution keeps them out of the selection. The pool's
+// health flag only changes at the next sweep, up to 30 seconds after the node
+// went away, and until then it still lists the node as healthy.
+func withUnreachableRouteNodesV3(ctx context.Context, urls map[string]struct{}) context.Context {
+	if len(urls) == 0 {
+		return ctx
+	}
+	return context.WithValue(ctx, unreachableRouteNodesKeyV3{}, urls)
+}
+
+func unreachableRouteNodesV3(ctx context.Context) map[string]struct{} {
+	if ctx == nil {
+		return nil
+	}
+	urls, _ := ctx.Value(unreachableRouteNodesKeyV3{}).(map[string]struct{})
+	return urls
+}
+
+// withoutUnreachableRouteNodesV3 drops the request's unreachable nodes from a
+// list of node URLs, so capability reads don't wait on a node that cannot be
+// selected.
+func withoutUnreachableRouteNodesV3(ctx context.Context, nodeURLs []string) []string {
+	unreachable := unreachableRouteNodesV3(ctx)
+	if len(unreachable) == 0 {
+		return nodeURLs
+	}
+	return slices.DeleteFunc(slices.Clone(nodeURLs), func(nodeURL string) bool {
+		_, skip := unreachable[nodeURL]
+		return skip
+	})
+}
+
+// excludeUnreachableRouteNodesV3 narrows a node predicate by the request's
+// unreachable nodes. A nil base accepts every node, as it does for the resolver.
+func excludeUnreachableRouteNodesV3(ctx context.Context, base func(*nodepool.Node) bool) func(*nodepool.Node) bool {
+	unreachable := unreachableRouteNodesV3(ctx)
+	if len(unreachable) == 0 {
+		return base
+	}
+	return func(node *nodepool.Node) bool {
+		if node == nil {
+			return false
+		}
+		if _, skip := unreachable[node.URL]; skip {
+			return false
+		}
+		return base == nil || base(node)
+	}
+}
+
+// unreachableSessionNodesV3 probes the transcode node and the egress proxy the
+// session currently uses and returns the ones that do not answer. A replan is
+// how a client recovers from a dead route, so it cannot take the pool's word
+// that the route it is leaving still works.
+func (h *PlaybackHandler) unreachableSessionNodesV3(ctx context.Context, session *playback.Session) map[string]struct{} {
+	if h == nil || session == nil {
+		return nil
+	}
+	var nodeURLs []string
+	if session.TranscodeNodeURL != "" {
+		nodeURLs = append(nodeURLs, session.TranscodeNodeURL)
+	}
+	if noderouting.Egress(session.RoutingEgress) == noderouting.EgressProxy && session.RoutingEgressNodeURL != "" &&
+		session.RoutingEgressNodeURL != session.TranscodeNodeURL {
+		nodeURLs = append(nodeURLs, session.RoutingEgressNodeURL)
+	}
+	if len(nodeURLs) == 0 {
+		return nil
+	}
+	probe := h.v3RouteNodeProbe
+	if probe == nil {
+		probe = probeRouteNodeV3
+	}
+	probeCtx, cancel := context.WithTimeout(ctx, routeNodeProbeTimeoutV3)
+	defer cancel()
+	answered := make([]bool, len(nodeURLs))
+	var wg sync.WaitGroup
+	for i, nodeURL := range nodeURLs {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			answered[i] = probe(probeCtx, nodeURL)
+		}()
+	}
+	wg.Wait()
+	var unreachable map[string]struct{}
+	for i, nodeURL := range nodeURLs {
+		if answered[i] {
+			continue
+		}
+		if unreachable == nil {
+			unreachable = make(map[string]struct{}, len(nodeURLs))
+		}
+		unreachable[nodeURL] = struct{}{}
+		slog.WarnContext(ctx, "protocol v3 replan found the session's node unreachable",
+			logComponentKey, playbackLogValueV3,
+			"playback_session_id", session.ID,
+			"node", logredact.SanitizeURL(nodeURL),
+		)
+	}
+	return unreachable
+}
+
+func probeRouteNodeV3(ctx context.Context, nodeURL string) bool {
+	healthy, _, _, _, _, _ := nodepool.CheckNode(ctx, &nodepool.Node{URL: nodeURL})
+	return healthy
+}
diff --git a/internal/api/handlers/playback_v3_route_nodes_test.go b/internal/api/handlers/playback_v3_route_nodes_test.go
new file mode 100644
index 0000000000..06962ffa90
--- /dev/null
+++ b/internal/api/handlers/playback_v3_route_nodes_test.go
@@ -0,0 +1,450 @@
+package handlers
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"slices"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/nodepool"
+	"github.com/prairie-server/prairie-server/internal/noderouting"
+	"github.com/prairie-server/prairie-server/internal/playback"
+	"github.com/prairie-server/prairie-server/internal/transcodenode"
+)
+
+// probeRecorderV3 answers route-node probes from a fixed set of dead URLs and
+// records which URLs were probed.
+type probeRecorderV3 struct {
+	mu     sync.Mutex
+	dead   map[string]bool
+	probed []string
+}
+
+func (p *probeRecorderV3) probe(_ context.Context, nodeURL string) bool {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	p.probed = append(p.probed, nodeURL)
+	return !p.dead[nodeURL]
+}
+
+func (p *probeRecorderV3) probedURLs() []string {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	urls := slices.Clone(p.probed)
+	slices.Sort(urls)
+	return urls
+}
+
+func TestUnreachableSessionNodesV3ProbesTheSessionsCurrentNodes(t *testing.T) {
+	const (
+		transcodeURL = "http://transcode-a:8082"
+		proxyURL     = "http://proxy-a:8083"
+	)
+	tests := []struct {
+		name        string
+		session     playback.Session
+		dead        []string
+		wantProbed  []string
+		wantMissing []string
+	}{
+		{
+			name:       "transcode node and proxy egress",
+			session:    playback.Session{ID: "s1", TranscodeNodeURL: transcodeURL, RoutingEgress: string(noderouting.EgressProxy), RoutingEgressNodeURL: proxyURL},
+			dead:       []string{proxyURL},
+			wantProbed: []string{proxyURL, transcodeURL}, wantMissing: []string{proxyURL},
+		},
+		{
+			name:       "API egress probes only the transcode node",
+			session:    playback.Session{ID: "s2", TranscodeNodeURL: transcodeURL, RoutingEgress: string(noderouting.EgressAPI)},
+			dead:       []string{transcodeURL},
+			wantProbed: []string{transcodeURL}, wantMissing: []string{transcodeURL},
+		},
+		{
+			name:       "direct play through a proxy",
+			session:    playback.Session{ID: "s3", RoutingEgress: string(noderouting.EgressProxy), RoutingEgressNodeURL: proxyURL},
+			wantProbed: []string{proxyURL},
+		},
+		{
+			name:    "local session probes nothing",
+			session: playback.Session{ID: "s4", RoutingEgress: string(noderouting.EgressAPI)},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			recorder := &probeRecorderV3{dead: map[string]bool{}}
+			for _, nodeURL := range tt.dead {
+				recorder.dead[nodeURL] = true
+			}
+			handler := NewPlaybackHandler(playback.NewSessionManager(0, 0))
+			handler.v3RouteNodeProbe = recorder.probe
+
+			unreachable := handler.unreachableSessionNodesV3(context.Background(), &tt.session)
+			if got := recorder.probedURLs(); !slices.Equal(got, tt.wantProbed) {
+				t.Fatalf("probed %v, want %v", got, tt.wantProbed)
+			}
+			if len(unreachable) != len(tt.wantMissing) {
+				t.Fatalf("unreachable = %v, want %v", unreachable, tt.wantMissing)
+			}
+			for _, nodeURL := range tt.wantMissing {
+				if _, ok := unreachable[nodeURL]; !ok {
+					t.Fatalf("unreachable = %v, want it to contain %s", unreachable, nodeURL)
+				}
+			}
+		})
+	}
+}
+
+// The pool still lists a node that died as healthy until the next health
+// sweep, and a session sticks to its current node. A request that found the
+// node unreachable must start the replacement elsewhere without trying it.
+func TestPrepareTransportV3SkipsAnUnreachableCurrentTranscodeNode(t *testing.T) {
+	var deadRequests atomic.Int32
+	dead := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		deadRequests.Add(1)
+		w.WriteHeader(http.StatusServiceUnavailable)
+	}))
+	t.Cleanup(dead.Close)
+	live := remoteTranscodeNodeStubV3(t)
+
+	transcodes := nodepool.NewTranscodePool()
+	transcodes.SetNodes([]*nodepool.Node{
+		{ID: 1, URL: dead.URL, Enabled: true, Healthy: true},
+		{ID: 2, URL: live.URL, Enabled: true, Healthy: true},
+	})
+	handler := NewPlaybackHandler(playback.NewSessionManager(0, 0))
+	handler.JWTSecret = "test-secret"
+	handler.NodePlanner = nodepool.NewPlanner(nodepool.NewProxyPool(), transcodes)
+	requireWorkerRoutingV3(handler)
+
+	session := &playback.Session{ID: "session-dead-node", UserID: 7, ProfileID: "profile-1", TranscodeNodeURL: dead.URL}
+	request := httptest.NewRequest(http.MethodPost, "/", nil)
+	request = request.WithContext(withUnreachableRouteNodesV3(request.Context(), map[string]struct{}{dead.URL: {}}))
+	transport, transportErr := handler.prepareTransportV3(request, session, v3HandlerFixtureFile(t), remoteHLSResultV3(), mediaAuthModeV3{})
+	if transportErr != nil {
+		t.Fatalf("prepare transport: %v", transportErr)
+	}
+	defer transport.rollback()
+	if transport.nodeURL != live.URL {
+		t.Fatalf("transport node = %q, want the live node %q", transport.nodeURL, live.URL)
+	}
+	if n := deadRequests.Load(); n != 0 {
+		t.Fatalf("the unreachable node received %d requests", n)
+	}
+}
+
+// A proxy that died is skipped for the replacement route. With another proxy
+// the stream moves there; with none left the route falls back to API egress.
+func TestPrepareTransportV3RoutesAroundAnUnreachableProxy(t *testing.T) {
+	const (
+		deadProxyURL = "http://10.0.0.21:8083"
+		liveProxyURL = "http://10.0.0.22:8083"
+	)
+	for _, tt := range []struct {
+		name    string
+		proxies []string
+		wantURL string
+	}{
+		{name: "another proxy", proxies: []string{deadProxyURL, liveProxyURL}, wantURL: liveProxyURL + "/"},
+		{name: "no proxy left", proxies: []string{deadProxyURL}},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			var nodes []*nodepool.Node
+			for i, proxyURL := range tt.proxies {
+				nodes = append(nodes, &nodepool.Node{ID: 40 + i, URL: proxyURL, Enabled: true, Healthy: true})
+			}
+			proxies := nodepool.NewProxyPool()
+			proxies.SetNodes(nodes)
+			handler := NewPlaybackHandler(playback.NewSessionManager(0, 0))
+			handler.JWTSecret = "test-secret"
+			handler.NodePlanner = nodepool.NewPlanner(proxies, nodepool.NewTranscodePool())
+			handler.ProxyGrantStore = &recordingRecipeCardStoreV3{}
+
+			request := httptest.NewRequest(http.MethodPost, "/", nil)
+			request = request.WithContext(withUnreachableRouteNodesV3(request.Context(), map[string]struct{}{deadProxyURL: {}}))
+			transport, transportErr := handler.prepareTransportV3(
+				request,
+				&playback.Session{ID: "session-dead-proxy", UserID: 7, ProfileID: "profile-1"},
+				v3HandlerFixtureFile(t),
+				playback.PlannerResultV3{Plan: identityProxyPlanV3(playback.DeliveryOriginalHTTPV3), PlayMethod: playback.PlayDirect},
+				mediaAuthModeV3{})
+			if transportErr != nil {
+				t.Fatalf("prepare transport: %v", transportErr)
+			}
+			defer transport.rollback()
+			if strings.Contains(transport.url, deadProxyURL) {
+				t.Fatalf("transport url %q uses the unreachable proxy", transport.url)
+			}
+			if tt.wantURL == "" {
+				assertAPIRelative(t, transport.url)
+				return
+			}
+			if !strings.HasPrefix(transport.url, tt.wantURL) {
+				t.Fatalf("transport url = %q, want the live proxy %q", transport.url, tt.wantURL)
+			}
+		})
+	}
+}
+
+// remoteReplanFixtureV3 starts a protocol-v3 transcode on one of two fake
+// transcode nodes and returns the handler, the start, and the node URLs.
+type remoteReplanFixtureV3 struct {
+	handler   *PlaybackHandler
+	probe     *probeRecorderV3
+	start     playback.StartRequestV3
+	started   playback.DecisionResponseV3
+	startedOn string
+	other     string
+	starts    func() int
+}
+
+func newRemoteReplanFixtureV3(t *testing.T) remoteReplanFixtureV3 {
+	t.Helper()
+	var mu sync.Mutex
+	starts := 0
+	newNode := func() *httptest.Server {
+		node := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			switch {
+			case r.Method == http.MethodGet && r.URL.Path == "/hw-capabilities":
+				writeJSON(w, http.StatusOK, playback.HWAccelInfo{Transformations: remoteHLSPlanV3().Transformations})
+			case r.Method == http.MethodPost && r.URL.Path == "/transcode/start":
+				var request transcodenode.TranscodeStartRequest
+				if err := json.NewDecoder(r.Body).Decode(&request); err != nil {
+					t.Errorf("decode remote start: %v", err)
+				}
+				mu.Lock()
+				starts++
+				mu.Unlock()
+				writeJSON(w, http.StatusAccepted, transcodenode.TranscodeStartResponse{SessionID: request.SessionID, Status: "started", AudioRecipeVersion: request.AudioRecipeVersion, ThrottleSeconds: request.ThrottleSeconds})
+			default:
+				w.WriteHeader(http.StatusNoContent)
+			}
+		}))
+		t.Cleanup(node.Close)
+		return node
+	}
+	first, second := newNode(), newNode()
+	transcodes := nodepool.NewTranscodePool()
+	transcodes.SetNodes([]*nodepool.Node{
+		{ID: 1, URL: first.URL, Enabled: true, Healthy: true},
+		{ID: 2, URL: second.URL, Enabled: true, Healthy: true},
+	})
+
+	file := v3HandlerFixtureFile(t)
+	file.CodecVideo, file.VideoTracks[0].Codec = "mpeg4", "mpeg4"
+	handler := NewPlaybackHandler(playback.NewSessionManager(0, 0), testPlaybackFileResolver{file: file})
+	handler.JWTSecret = "test-secret"
+	handler.SettingsRepo = &mutablePlaybackSettingsV3{values: map[string]string{"transcode_enabled": "true", "allow_4k_transcode": "true"}}
+	handler.ItemAccess = allowAllPlaybackItemAccess{}
+	handler.PlaybackConfig = playbackTestConfig(writePlaybackTestFFmpeg(t), t.TempDir())
+	handler.NodePlanner = nodepool.NewPlanner(nodepool.NewProxyPool(), transcodes)
+	requireWorkerRoutingV3(handler)
+	handler.v3Registry = playback.NewTransformationRegistryV3([]playback.TransformationSpecV3{
+		{Name: playback.TransformationAudioToAACV3, RecipeVersion: playback.TransformationAudioToAACRecipeVersionV3, Available: true},
+		{Name: playback.TransformationVideoToH264V3, RecipeVersion: playback.TransformationVideoToH264RecipeVersionV3, Available: true},
+	})
+	recorder := &probeRecorderV3{dead: map[string]bool{}}
+	handler.v3RouteNodeProbe = recorder.probe
+
+	startRequest := v3HandlerStartRequest()
+	startRequest.ClientPlaybackContext.Deliveries[playback.DeliveryClassHLSV3] = playback.DeliveryCapabilityV3{Enabled: true, SupportedOnDevice: true}
+	startRR := httptest.NewRecorder()
+	handler.HandleStartPlayback(startRR, httptest.NewRequest(http.MethodPost, "/api/v1/playback/start", strings.NewReader(marshalV3StartRequest(t, startRequest))).WithContext(newAuthorizedPlaybackContext()))
+	var started playback.DecisionResponseV3
+	if startRR.Code != http.StatusCreated || json.Unmarshal(startRR.Body.Bytes(), &started) != nil || started.PlaybackPlan == nil {
+		t.Fatalf("start status=%d body=%s", startRR.Code, startRR.Body.String())
+	}
+	session, err := handler.sessionMgr.GetSession(started.SessionID)
+	if err != nil || session.TranscodeNodeURL == "" {
+		t.Fatalf("start did not place the transcode on a node: %#v", session)
+	}
+	other := second.URL
+	if session.TranscodeNodeURL == second.URL {
+		other = first.URL
+	}
+	return remoteReplanFixtureV3{
+		handler: handler, probe: recorder, start: startRequest, started: started,
+		startedOn: session.TranscodeNodeURL, other: other,
+		starts: func() int { mu.Lock(); defer mu.Unlock(); return starts },
+	}
+}
+
+func (f remoteReplanFixtureV3) killStartedNode() {
+	f.probe.mu.Lock()
+	f.probe.dead[f.startedOn] = true
+	f.probe.mu.Unlock()
+}
+
+func (f remoteReplanFixtureV3) replan(t *testing.T, operation playback.ReplanOperationV3, failure playback.FailureV3, attempted []string) playback.DecisionResponseV3 {
+	t.Helper()
+	return postPlaybackReplanV3(t, f.handler, f.started.SessionID, playback.ReplanRequestV3{
+		ProtocolVersion:       playback.ProtocolV3,
+		Operation:             operation,
+		PlaybackAttemptID:     f.start.PlaybackAttemptID,
+		ReplanRequestID:       "dead-node-replan-0001",
+		FailedPlanID:          f.started.PlaybackPlan.PlanID,
+		PlanAttemptID:         "dead-node-plan-attempt-0001",
+		PlanAttemptKey:        f.started.PlaybackPlan.PlanAttemptKey,
+		AttemptedPlanKeys:     attempted,
+		AttemptCount:          1,
+		PositionSeconds:       120,
+		Failure:               failure,
+		SelectedTracks:        f.started.PlaybackPlan.SelectedTracks,
+		Capabilities:          f.start.Capabilities,
+		ClientPlaybackContext: f.start.ClientPlaybackContext,
+	})
+}
+
+func (f remoteReplanFixtureV3) currentNode(t *testing.T) string {
+	t.Helper()
+	session, err := f.handler.sessionMgr.GetSession(f.started.SessionID)
+	if err != nil {
+		t.Fatalf("replan dropped the session: %v", err)
+	}
+	return session.TranscodeNodeURL
+}
+
+// A replan that changes nothing keeps a working remote transport, and moves
+// one whose node no longer answers.
+func TestHandleReplanPlaybackV3MovesTrackChangeOffAnUnreachableNode(t *testing.T) {
+	t.Run("node answers", func(t *testing.T) {
+		f := newRemoteReplanFixtureV3(t)
+		replanned := f.replan(t, playback.ReplanOperationTrackChangeV3, playback.FailureV3{}, nil)
+		if replanned.PlaybackPlan == nil {
+			t.Fatalf("replan returned no plan: %#v", replanned)
+		}
+		if !slices.Contains(f.probe.probedURLs(), f.startedOn) {
+			t.Fatalf("replan probed %v, want the current node %s", f.probe.probedURLs(), f.startedOn)
+		}
+		if node := f.currentNode(t); node != f.startedOn || replanned.PlaybackPlan.Stream.URL != f.started.PlaybackPlan.Stream.URL {
+			t.Fatalf("working transport was replaced: node %s -> %s, url %s -> %s", f.startedOn, node, f.started.PlaybackPlan.Stream.URL, replanned.PlaybackPlan.Stream.URL)
+		}
+	})
+	t.Run("node unreachable", func(t *testing.T) {
+		f := newRemoteReplanFixtureV3(t)
+		f.killStartedNode()
+		replanned := f.replan(t, playback.ReplanOperationTrackChangeV3, playback.FailureV3{}, nil)
+		if replanned.PlaybackPlan == nil {
+			t.Fatalf("replan returned no plan: %#v", replanned)
+		}
+		if node := f.currentNode(t); node != f.other {
+			t.Fatalf("replanned node = %s, want %s (started on %s)", node, f.other, f.startedOn)
+		}
+		if replanned.PlaybackPlan.Stream.URL == f.started.PlaybackPlan.Stream.URL {
+			t.Fatalf("replan kept the stream URL of the unreachable node: %s", replanned.PlaybackPlan.Stream.URL)
+		}
+		if n := f.starts(); n != 2 {
+			t.Fatalf("remote starts = %d, want the original start and one replacement", n)
+		}
+	})
+}
+
+// A failure recovery from a node that stopped answering keeps the failed
+// recipe: the node failed, not the plan, so the same recipe runs on another
+// node instead of being excluded.
+func TestHandleReplanPlaybackV3FailureRecoveryFromAnUnreachableNodeKeepsTheRecipe(t *testing.T) {
+	f := newRemoteReplanFixtureV3(t)
+	key := f.started.PlaybackPlan.PlanAttemptKey
+	f.killStartedNode()
+	replanned := f.replan(t, playback.ReplanOperationFailureRecoveryV3, playback.FailureV3{Classification: "http_failure"}, []string{key})
+	if replanned.PlaybackPlan == nil {
+		t.Fatalf("recovery returned no plan: %#v", replanned)
+	}
+	if replanned.PlaybackPlan.PlanAttemptKey != key {
+		t.Fatalf("recovery recipe = %s, want the unfailed recipe %s", replanned.PlaybackPlan.PlanAttemptKey, key)
+	}
+	if node := f.currentNode(t); node != f.other {
+		t.Fatalf("recovered on %s, want %s", node, f.other)
+	}
+
+	// With the node answering, the same request still excludes the recipe.
+	g := newRemoteReplanFixtureV3(t)
+	gKey := g.started.PlaybackPlan.PlanAttemptKey
+	recovered := g.replan(t, playback.ReplanOperationFailureRecoveryV3, playback.FailureV3{Classification: "http_failure"}, []string{gKey})
+	if recovered.PlaybackPlan != nil && recovered.PlaybackPlan.PlanAttemptKey == gKey {
+		t.Fatalf("recovery from a reachable node reused the failed recipe %s", gKey)
+	}
+}
+
+// Planning reads capabilities from every pooled node; a node the replan found
+// unreachable is skipped, so the plan is not built on its stale inventory and
+// the read does not wait on it.
+func TestPlanningCapabilityReadsSkipUnreachableNodes(t *testing.T) {
+	var deadRequests atomic.Int32
+	dead := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		deadRequests.Add(1)
+		w.WriteHeader(http.StatusServiceUnavailable)
+	}))
+	t.Cleanup(dead.Close)
+	live := remoteTranscodeNodeStubV3(t)
+	handler := NewPlaybackHandler(playback.NewSessionManager(0, 0))
+	handler.JWTSecret = "test-secret"
+
+	ctx := withUnreachableRouteNodesV3(context.Background(), map[string]struct{}{dead.URL: {}})
+	capabilities := handler.pooledNodeCapabilitiesV3(ctx, []string{dead.URL, live.URL})
+	if _, ok := capabilities[live.URL]; !ok {
+		t.Fatalf("capabilities = %v, want the live node's inventory", capabilities)
+	}
+	if _, ok := capabilities[dead.URL]; ok {
+		t.Fatal("the unreachable node contributed capabilities")
+	}
+	if n := deadRequests.Load(); n != 0 {
+		t.Fatalf("the unreachable node received %d capability requests", n)
+	}
+}
+
+// Clients echo plan keys opaquely, and planning compares them trimmed, so a
+// padded copy of the failed key must not exclude the recipe either.
+func TestHandleReplanPlaybackV3NodeRecoveryIgnoresPaddedFailedKeys(t *testing.T) {
+	f := newRemoteReplanFixtureV3(t)
+	key := f.started.PlaybackPlan.PlanAttemptKey
+	f.killStartedNode()
+	replanned := f.replan(t, playback.ReplanOperationFailureRecoveryV3, playback.FailureV3{Classification: "http_failure"}, []string{key + " "})
+	if replanned.PlaybackPlan == nil || replanned.PlaybackPlan.PlanAttemptKey != key {
+		t.Fatalf("recovery = %#v, want the unfailed recipe %s", replanned.PlaybackPlan, key)
+	}
+	if node := f.currentNode(t); node != f.other {
+		t.Fatalf("recovered on %s, want %s", node, f.other)
+	}
+}
+
+// A progressive remux under worker-only routing runs only behind a proxy. When
+// the only proxy is one this request found not answering, the remux has no
+// route, so it escalates to HLS on a transcode node rather than failing on
+// route capacity.
+func TestEscalateRefusedProgressiveRemuxV3TreatsAnUnreachableProxyAsAbsent(t *testing.T) {
+	const proxyURL = "http://proxy-1"
+	for _, tt := range []struct {
+		name string
+		mode mediaAuthModeV3
+	}{
+		{name: "signed URLs", mode: mediaAuthModeV3{}},
+		{name: "authorized origins", mode: authorizedOriginsModeV3()},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			handler, input, result := escalationFixtureV3(t, true)
+			handler.JWTSecret = "test-secret"
+			handler.NodePlanner.(*recordingNodePlannerV3).plan.ProxyNode = &nodepool.Node{URL: proxyURL}
+			handler.ProxyGrantStore = &recordingRecipeCardStoreV3{}
+			plannerInput := func() playback.PlannerInputV3 { return input }
+
+			kept, transportErr := handler.escalateRefusedProgressiveRemuxV3(context.Background(), tt.mode, plannerInput, result)
+			if transportErr != nil || kept.Plan == nil || kept.Plan.Delivery != playback.DeliveryRemuxProgressiveV3 {
+				t.Fatalf("with the proxy answering: %s %#v, want the progressive remux kept", playback.ExplainPlannerResultV3(kept), transportErr)
+			}
+
+			ctx := withUnreachableRouteNodesV3(context.Background(), map[string]struct{}{proxyURL: {}})
+			escalated, transportErr := handler.escalateRefusedProgressiveRemuxV3(ctx, tt.mode, plannerInput, result)
+			if transportErr != nil {
+				t.Fatalf("escalation error = %#v", transportErr)
+			}
+			if escalated.Terminal != nil || escalated.Plan == nil || escalated.Plan.Delivery != playback.DeliveryRemuxHLSV3 {
+				t.Fatalf("escalated result = %s, want %q", playback.ExplainPlannerResultV3(escalated), playback.DeliveryRemuxHLSV3)
+			}
+		})
+	}
+}
diff --git a/internal/api/handlers/playback_v3_subtitle_rendition_test.go b/internal/api/handlers/playback_v3_subtitle_rendition_test.go
new file mode 100644
index 0000000000..c433085719
--- /dev/null
+++ b/internal/api/handlers/playback_v3_subtitle_rendition_test.go
@@ -0,0 +1,167 @@
+package handlers
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"slices"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/config"
+	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/playback"
+)
+
+func subtitleRenditionPlanV3(file *models.MediaFile, delivery playback.DeliveryV3, mode playback.SubtitleModeV3) *playback.PlanV3 {
+	return &playback.PlanV3{
+		Delivery: delivery,
+		Subtitle: playback.SubtitleDecisionV3{
+			Mode: mode, TrackID: playback.TrackIDV3(file.ID, "subtitle", 0),
+			HLSRendition: &playback.HLSSubtitleRenditionV3{GroupID: playback.SubtitleRenditionGroupID, Name: playback.SubtitleRenditionName, Format: "vtt", MIMEType: "text/vtt"},
+			Artifact:     &playback.SubtitleArtifactV3{URL: "/stale.vtt", Format: "vtt"},
+			Inventory:    playback.BuildSubtitleInventoryV3(file, nil),
+		},
+	}
+}
+
+func TestAttachSubtitleArtifactKeepsHLSSubtitleRendition(t *testing.T) {
+	file := &models.MediaFile{ID: 42, SubtitleTracks: []models.SubtitleTrack{{Index: 4, Codec: "subrip"}}}
+	plan := subtitleRenditionPlanV3(file, playback.DeliveryTranscodeHLSV3, playback.SubtitleRenderV3)
+	handler := &PlaybackHandler{}
+	if err := handler.attachSubtitleArtifactV3(t.Context(), "session", file, plan, 0, nil, nil); err != nil {
+		t.Fatal(err)
+	}
+	if plan.Subtitle.HLSRendition == nil || plan.Subtitle.Artifact != nil {
+		t.Fatalf("an in-manifest subtitle publishes no sidecar artifact: %#v", plan.Subtitle)
+	}
+	if plan.Subtitle.Inventory[0].URL == "" {
+		t.Fatal("the inventory keeps its sidecar URL for other selections")
+	}
+}
+
+func TestAttachSubtitleArtifactRejectsOrClearsMisplacedRendition(t *testing.T) {
+	file := &models.MediaFile{ID: 42, SubtitleTracks: []models.SubtitleTrack{{Index: 4, Codec: "subrip"}}}
+	handler := &PlaybackHandler{}
+	for _, delivery := range []playback.DeliveryV3{playback.DeliveryRemuxHLSV3, playback.DeliveryOriginalHTTPV3} {
+		plan := subtitleRenditionPlanV3(file, delivery, playback.SubtitleRenderV3)
+		if err := handler.attachSubtitleArtifactV3(t.Context(), "session", file, plan, 0, nil, nil); err == nil {
+			t.Fatalf("%s accepted an HLS subtitle rendition", delivery)
+		}
+	}
+	plan := subtitleRenditionPlanV3(file, playback.DeliveryTranscodeHLSV3, playback.SubtitleOffV3)
+	if err := handler.attachSubtitleArtifactV3(t.Context(), "session", file, plan, -1, nil, nil); err != nil {
+		t.Fatal(err)
+	}
+	if plan.Subtitle.HLSRendition != nil {
+		t.Fatalf("subtitles-off plan kept a rendition: %#v", plan.Subtitle)
+	}
+}
+
+func TestSidecarOnlyHLSReplanReusesTransportOnlyForAnUnchangedRendition(t *testing.T) {
+	rendition := &playback.HLSSubtitleRenditionV3{GroupID: "subs", Name: "Subtitles", Format: "vtt", MIMEType: "text/vtt"}
+	freeze := func(plan *playback.PlanV3, track int, withRendition bool) playback.ExecutableRecipeV3 {
+		return playback.FreezeExecutableRecipeV3(playback.PlannerResultV3{
+			Plan: plan, PlayMethod: playback.PlayTranscode, TargetVideoCodec: "h264", TargetAudioCodec: "aac",
+			SubtitleTrackIndex: track, SubtitleTransportTrackIndex: track, SubtitleCodec: "subrip", SubtitleRendition: withRendition,
+		})
+	}
+	for _, tc := range []struct {
+		name                       string
+		current, candidate         bool
+		currentTrack, candidateTrk int
+		want                       bool
+	}{
+		{"sidecar to rendition", false, true, 0, 0, false},
+		{"rendition to another track", true, true, 0, 1, false},
+		{"rendition kept", true, true, 0, 0, true},
+		{"rendition dropped", true, false, 0, -1, true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			currentPlan := playback.PlanV3{PlanID: "current-plan", Delivery: playback.DeliveryTranscodeHLSV3,
+				Stream: playback.StreamV3{URL: "/stream/current.m3u8"}, RequestedMediaFileID: 1, EffectiveMediaFileID: 1}
+			candidatePlan := currentPlan
+			candidatePlan.PlanID = "candidate-plan"
+			if tc.current {
+				currentPlan.Subtitle.HLSRendition = rendition
+			}
+			if tc.candidate {
+				candidatePlan.Subtitle.HLSRendition = rendition
+			}
+			record := &playback.AttemptRecordV3{EffectiveMediaFileID: 1, CurrentPlan: currentPlan,
+				FrozenRecipe: freeze(&currentPlan, tc.currentTrack, tc.current)}
+			record.NormalizedRequest.ClientPlaybackContext.Output.OutputContextID = "output-context"
+			_, reused := sidecarOnlyHLSReplanV3(record, &candidatePlan, freeze(&candidatePlan, tc.candidateTrk, tc.candidate), "output-context")
+			if reused != tc.want {
+				t.Fatalf("reused = %t, want %t", reused, tc.want)
+			}
+		})
+	}
+}
+
+func TestHLSSubtitleRenditionsAreNegotiatedOnlyOnAPIV2(t *testing.T) {
+	if slices.Contains(playback.ServerFeaturesV3(), playback.FeatureHLSSubtitleRenditionsV3) {
+		t.Fatal("the frozen /api/v1 surface must not advertise hls_subtitle_renditions_v1")
+	}
+	if !slices.Contains(playback.NativeServerFeaturesV3(), playback.FeatureHLSSubtitleRenditionsV3) ||
+		!slices.Contains(playback.AttemptStickyFeaturesV3(), playback.FeatureHLSSubtitleRenditionsV3) {
+		t.Fatal("/api/v2 advertises hls_subtitle_renditions_v1 as an attempt-sticky feature")
+	}
+}
+
+func TestFailedHLSSubtitleRenditionStaysOffForTheAttempt(t *testing.T) {
+	negotiated := []string{playback.FeaturePlaybackPlanV3, playback.FeatureHLSSubtitleRenditionsV3}
+	features := withoutFailedSubtitleRoutesV3(negotiated, negotiated, playback.FailureSubtitleHLSRenditionFailedV3)
+	if playback.HasFeatureV3(features, playback.FeatureHLSSubtitleRenditionsV3) {
+		t.Fatal("a rendition the player could not select is offered again")
+	}
+	// Pinning on the next replan restores sticky features from the durable
+	// request, which no longer carries the rendition.
+	if playback.HasFeatureV3(playback.PinAttemptStickyFeaturesV3(negotiated, features), playback.FeatureHLSSubtitleRenditionsV3) {
+		t.Fatal("attempt-sticky pinning re-enabled the failed rendition")
+	}
+	for _, classification := range []string{"", "network_error", "subtitle_embedded_failed"} {
+		if !playback.HasFeatureV3(withoutFailedSubtitleRoutesV3(negotiated, negotiated, classification), playback.FeatureHLSSubtitleRenditionsV3) {
+			t.Fatalf("%q dropped the rendition", classification)
+		}
+	}
+}
+
+// A rendition plan is routable only when one node both emits renditions and
+// runs the plan's transformations; a pool that splits the two across nodes
+// must keep the sidecar, which the node without the feature can run.
+func TestSubtitleRenditionRoutableRequiresOneNodeForTheWholeRecipe(t *testing.T) {
+	aac := playback.TransformationV3{
+		Name: playback.TransformationAudioToAACV3, Executor: playback.ExecutorServerV3,
+		RecipeVersion: playback.TransformationAudioToAACRecipeVersionV3,
+	}
+	node := func(info playback.HWAccelInfo) string {
+		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			writeJSON(w, http.StatusOK, info)
+		}))
+		t.Cleanup(server.Close)
+		return server.URL
+	}
+	renditionOnly := node(playback.HWAccelInfo{TransportFeatures: []string{playback.TransportFeatureHLSSubtitleRenditionV1}})
+	transformOnly := node(playback.HWAccelInfo{Transformations: []playback.TransformationV3{aac}})
+	both := node(playback.HWAccelInfo{
+		TransportFeatures: []string{playback.TransportFeatureHLSSubtitleRenditionV1},
+		Transformations:   []playback.TransformationV3{aac},
+	})
+
+	handler := NewPlaybackHandler(playback.NewSessionManager(0, 0))
+	policy := config.DefaultPlaybackRoutingPolicy()
+	policy.VideoTranscodeExecution = config.PlaybackExecutionWorkerOnly
+	handler.PlaybackConfig = func() config.PlaybackConfig { return config.PlaybackConfig{Routing: policy} }
+	result := playback.PlannerResultV3{
+		Plan:              &playback.PlanV3{Delivery: playback.DeliveryTranscodeHLSV3, Transformations: []playback.TransformationV3{aac}},
+		SubtitleRendition: true,
+	}
+
+	handler.NodePlanner = predicateEnumeratingNodePlannerV3{enumeratingNodePlannerV3{urls: []string{renditionOnly, transformOnly}}}
+	if handler.subtitleRenditionRoutableV3(t.Context(), result, true) {
+		t.Fatal("a pool with no node running the whole recipe was routable")
+	}
+	handler.NodePlanner = predicateEnumeratingNodePlannerV3{enumeratingNodePlannerV3{urls: []string{renditionOnly, both}}}
+	if !handler.subtitleRenditionRoutableV3(t.Context(), result, true) {
+		t.Fatal("a node running the whole recipe was not counted")
+	}
+}
diff --git a/internal/api/handlers/playback_v3_subtitle_version_test.go b/internal/api/handlers/playback_v3_subtitle_version_test.go
new file mode 100644
index 0000000000..2466e47a6d
--- /dev/null
+++ b/internal/api/handlers/playback_v3_subtitle_version_test.go
@@ -0,0 +1,380 @@
+package handlers
+
+import (
+	"encoding/json"
+	"maps"
+	"net/http"
+	"net/http/httptest"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/playback"
+)
+
+// subtitleBlockedHDRFixtureV3 is a 4K HDR10 HEVC file with an English PGS
+// subtitle and a 1080p SDR H.264 sibling without one. The client direct
+// plays the 4K file but cannot render PGS, and the server cannot re-encode
+// HDR, so burning the subtitle in is the only thing the 4K file cannot do.
+func subtitleBlockedHDRFixtureV3(t *testing.T) (*PlaybackHandler, *models.MediaFile, *models.MediaFile, playback.StartRequestV3) {
+	t.Helper()
+	source := v3HandlerFixtureFile(t)
+	source.Container = "mkv"
+	source.FilePath = writePlaybackTestMediaFile(t, "movie-4k.mkv")
+	source.CodecVideo = "hevc"
+	source.Resolution = "2160p"
+	source.Bitrate = 64_000
+	source.VideoTracks = []models.VideoTrack{{
+		Codec: "hevc", Profile: "main 10", Level: 153, Width: 3840, Height: 2160,
+		FrameRate: "24000/1001", Bitrate: 64_000, BitDepth: 10,
+		VideoRange: "HDR10", VideoRangeType: "HDR10",
+	}}
+	source.SubtitleTracks = []models.SubtitleTrack{{Index: 4, Codec: "hdmv_pgs_subtitle", Language: "eng", Title: "English"}}
+
+	alternateValue := *source
+	alternate := &alternateValue
+	alternate.ID = 84
+	alternate.FilePath = writePlaybackTestMediaFile(t, "movie-1080p.mkv")
+	alternate.CodecVideo = "h264"
+	alternate.Resolution = "1080p"
+	alternate.Bitrate = 8_000
+	alternate.VideoTracks = []models.VideoTrack{{
+		Codec: "h264", Profile: "high", Level: 41, Width: 1920, Height: 1080,
+		FrameRate: "24000/1001", Bitrate: 8_000, BitDepth: 8,
+		VideoRange: "SDR", VideoRangeType: "SDR",
+	}}
+	alternate.SubtitleTracks = nil
+
+	files := map[int]*models.MediaFile{source.ID: source, alternate.ID: alternate}
+	handler := NewPlaybackHandler(playback.NewSessionManager(0, 0), mapPlaybackFileResolver{files: files})
+	handler.FileVersionFetcher = testPlaybackFileVersionFetcher{byContent: map[string][]*models.MediaFile{
+		source.ContentID: {source, alternate},
+	}}
+	handler.SettingsRepo = &mutablePlaybackSettingsV3{values: map[string]string{"transcode_enabled": "true", "allow_4k_transcode": "true"}}
+	handler.PlaybackConfig = playbackTestConfig(writePlaybackTestFFmpeg(t), t.TempDir())
+	presetLocalRegistryV3(handler, playback.NewTransformationRegistryV3([]playback.TransformationSpecV3{
+		{Name: playback.TransformationAudioToAACV3, RecipeVersion: playback.TransformationAudioToAACRecipeVersionV3, Available: true},
+		{Name: playback.TransformationVideoToH264V3, RecipeVersion: "2", Available: true},
+	}))
+	handler.ItemAccess = allowAllPlaybackItemAccess{}
+
+	startRequest := v3HandlerStartRequest()
+	startRequest.QualityPreference = "auto"
+	startRequest.Capabilities.CodecsVideo = []string{"hevc", "h264"}
+	startRequest.Capabilities.CodecsVideoHardware = []string{"hevc", "h264"}
+	startRequest.Capabilities.Containers = []string{"mkv", "hls"}
+	startRequest.Capabilities.MaxResolution = "2160p"
+	startRequest.Capabilities.VideoDecode = []playback.VideoDecodeCapabilityV3{{
+		Codec: "hevc", Profiles: []string{"main 10"}, Levels: []int{153}, BitDepths: []int{10},
+		MaxWidth: 3840, MaxHeight: 2160, MaxFrameRate: 60, MaxBitrateKbps: 80_000, Hardware: true,
+	}}
+	hdr := &playback.HDRCapabilitiesV3{HDR10: true}
+	startRequest.Capabilities.HDRDetails = hdr
+	startRequest.ClientPlaybackContext.Output.HDRDetails = hdr
+	startRequest.ClientPlaybackContext.Deliveries = map[string]playback.DeliveryCapabilityV3{
+		playback.DeliveryClassOriginalHTTPV3: {
+			Enabled: true, SupportedOnDevice: true, Containers: []string{"mkv"},
+			VideoCodecs: []string{"hevc", "h264"}, AudioDecodeCodecs: []string{"aac"},
+		},
+		playback.DeliveryClassHLSV3: {
+			Enabled: true, SupportedOnDevice: true, Containers: []string{"hls"},
+			VideoCodecs: []string{"h264"}, AudioDecodeCodecs: []string{"aac"},
+		},
+	}
+	return handler, source, alternate, startRequest
+}
+
+// requireRequestedVersionWithoutSubtitleV3 fails unless plan stays on the
+// requested 4K file, plays it without converting the video, and reports the
+// subtitle it could not show exactly once.
+func requireRequestedVersionWithoutSubtitleV3(t *testing.T, plan *playback.PlanV3, source *models.MediaFile) {
+	t.Helper()
+	if plan.EffectiveMediaFileID != source.ID {
+		t.Fatalf("effective file = %d, want the requested 4K file %d: only its subtitle was blocked", plan.EffectiveMediaFileID, source.ID)
+	}
+	if plan.Subtitle.Mode != playback.SubtitleOffV3 || plan.SelectedTracks.Subtitle != nil {
+		t.Fatalf("subtitle = %#v selected = %#v, want subtitles off", plan.Subtitle, plan.SelectedTracks.Subtitle)
+	}
+	if plan.EffectiveRecipe.VideoCodec != "hevc" || !plan.Claims.Video.HDR10 {
+		t.Fatalf("recipe = %#v claims = %#v, want the 4K HDR10 HEVC picture", plan.EffectiveRecipe, plan.Claims.Video)
+	}
+	warned := 0
+	for _, warning := range plan.DegradationWarnings {
+		if warning.Code == playback.DegradationWarningSubtitleTrackUnavailableV3 {
+			warned++
+		}
+	}
+	if warned != 1 {
+		t.Fatalf("subtitle_track_unavailable reported %d times: %#v", warned, plan.DegradationWarnings)
+	}
+	if !slices.Contains(plan.DegradationWarnings, playback.SubtitleNotShownWarningV3()) {
+		t.Fatalf("warnings = %#v, want the subtitle reported as on the file but not shown", plan.DegradationWarnings)
+	}
+}
+
+// A subtitle that only the requested file cannot show is no reason to switch
+// to a lower version that has no subtitle either: the viewer would lose the
+// 4K picture and still get no subtitle. Playback starts on the requested
+// file with the subtitle off and says so.
+func TestHandleStartPlaybackV3SubtitleOnlyRefusalKeepsTheRequestedVersion(t *testing.T) {
+	handler, source, _, startRequest := subtitleBlockedHDRFixtureV3(t)
+	subtitleIndex := 0
+	startRequest.SubtitleTrackID = playback.TrackIDV3(source.ID, "subtitle", subtitleIndex)
+	startRequest.SubtitleTrackIndex = &subtitleIndex
+
+	rec := httptest.NewRecorder()
+	handler.HandleStartPlayback(rec, httptest.NewRequest(http.MethodPost, "/api/v1/playback/start", strings.NewReader(marshalV3StartRequest(t, startRequest))).WithContext(newAuthorizedPlaybackContext()))
+	var started playback.DecisionResponseV3
+	if rec.Code != http.StatusCreated || json.Unmarshal(rec.Body.Bytes(), &started) != nil || started.PlaybackPlan == nil {
+		t.Fatalf("start status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	t.Cleanup(func() { handler.tm.CloseTranscodeSession(started.SessionID, "") })
+	requireRequestedVersionWithoutSubtitleV3(t, started.PlaybackPlan, source)
+}
+
+// The same holds when the viewer turns the subtitle on during playback.
+func TestHandleReplanPlaybackV3SubtitleOnlyRefusalKeepsTheRequestedVersion(t *testing.T) {
+	handler, source, _, startRequest := subtitleBlockedHDRFixtureV3(t)
+	rec := httptest.NewRecorder()
+	handler.HandleStartPlayback(rec, httptest.NewRequest(http.MethodPost, "/api/v1/playback/start", strings.NewReader(marshalV3StartRequest(t, startRequest))).WithContext(newAuthorizedPlaybackContext()))
+	var started playback.DecisionResponseV3
+	if rec.Code != http.StatusCreated || json.Unmarshal(rec.Body.Bytes(), &started) != nil || started.PlaybackPlan == nil {
+		t.Fatalf("start status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	t.Cleanup(func() { handler.tm.CloseTranscodeSession(started.SessionID, "") })
+	if started.PlaybackPlan.EffectiveMediaFileID != source.ID {
+		t.Fatalf("start effective file = %d, want the 4K file %d", started.PlaybackPlan.EffectiveMediaFileID, source.ID)
+	}
+
+	subtitleIndex := 0
+	replanned := postPlaybackReplanV3(t, handler, started.SessionID, playback.ReplanRequestV3{
+		ProtocolVersion: playback.ProtocolV3, Operation: playback.ReplanOperationTrackChangeV3,
+		PlaybackAttemptID: startRequest.PlaybackAttemptID, ReplanRequestID: "subtitle-only-refusal-0001",
+		FailedPlanID: started.PlaybackPlan.PlanID, PlanAttemptID: "subtitle-only-refusal-attempt-0001",
+		PlanAttemptKey: started.PlaybackPlan.PlanAttemptKey, AttemptCount: 1, PositionSeconds: 30,
+		QualityPreference: "auto",
+		SelectedTracks: playback.SelectedTracksV3{
+			Audio: started.PlaybackPlan.SelectedTracks.Audio,
+			Subtitle: &playback.TrackIdentityV3{
+				ID: playback.TrackIDV3(source.ID, "subtitle", subtitleIndex), Index: &subtitleIndex,
+			},
+		},
+		Capabilities: startRequest.Capabilities, ClientPlaybackContext: startRequest.ClientPlaybackContext,
+	})
+	if replanned.PlaybackPlan == nil || replanned.Terminal != nil {
+		t.Fatalf("subtitle replan = %#v", replanned)
+	}
+	requireRequestedVersionWithoutSubtitleV3(t, replanned.PlaybackPlan, source)
+}
+
+// outputChangeAfterKeptAlternateV3 starts on the 4K edition (every other
+// version is unreadable at start), turns its English PGS on, repairs the other
+// versions, and then switches to an output that cannot draw PGS. The active
+// 4K edition was kept only for that subtitle, so the returned plan shows
+// where playback goes once the subtitle cannot be shown there either.
+func outputChangeAfterKeptAlternateV3(t *testing.T, handler *PlaybackHandler, active, requested *models.MediaFile, startRequest playback.StartRequestV3, others ...*models.MediaFile) *playback.PlanV3 {
+	t.Helper()
+	failedAt := time.Now().UTC()
+	unreadable := append([]*models.MediaFile{requested}, others...)
+	repaired := make([]models.MediaFile, len(unreadable))
+	for i, file := range unreadable {
+		repaired[i] = *file
+		*file = models.MediaFile{ID: file.ID, ContentID: file.ContentID, FilePath: file.FilePath, ProbeFailedAt: &failedAt}
+	}
+	startRequest.FileID = requested.ID
+	original := startRequest.ClientPlaybackContext.Deliveries[playback.DeliveryClassOriginalHTTPV3]
+	original.Subtitles.EmbeddedBitmap = true
+	startRequest.ClientPlaybackContext.Deliveries = maps.Clone(startRequest.ClientPlaybackContext.Deliveries)
+	startRequest.ClientPlaybackContext.Deliveries[playback.DeliveryClassOriginalHTTPV3] = original
+
+	rec := httptest.NewRecorder()
+	handler.HandleStartPlayback(rec, httptest.NewRequest(http.MethodPost, "/api/v1/playback/start", strings.NewReader(marshalV3StartRequest(t, startRequest))).WithContext(newAuthorizedPlaybackContext()))
+	var started playback.DecisionResponseV3
+	if rec.Code != http.StatusCreated || json.Unmarshal(rec.Body.Bytes(), &started) != nil || started.PlaybackPlan == nil || started.PlaybackPlan.EffectiveMediaFileID != active.ID {
+		t.Fatalf("start did not land on the 4K edition: status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	t.Cleanup(func() { handler.tm.CloseTranscodeSession(started.SessionID, "") })
+	for i, file := range unreadable {
+		*file = repaired[i]
+	}
+
+	subtitleIndex := 0
+	subtitled := postPlaybackReplanV3(t, handler, started.SessionID, playback.ReplanRequestV3{
+		ProtocolVersion: playback.ProtocolV3, Operation: playback.ReplanOperationTrackChangeV3,
+		PlaybackAttemptID: startRequest.PlaybackAttemptID, ReplanRequestID: "kept-edition-track-0001",
+		FailedPlanID: started.PlaybackPlan.PlanID, PlanAttemptID: "kept-edition-track-attempt-0001",
+		PlanAttemptKey: started.PlaybackPlan.PlanAttemptKey, AttemptCount: 1, PositionSeconds: 30,
+		QualityPreference: "auto",
+		SelectedTracks: playback.SelectedTracksV3{
+			Audio:    started.PlaybackPlan.SelectedTracks.Audio,
+			Subtitle: &playback.TrackIdentityV3{ID: playback.TrackIDV3(active.ID, "subtitle", subtitleIndex), Index: &subtitleIndex},
+		},
+		Capabilities: startRequest.Capabilities, ClientPlaybackContext: startRequest.ClientPlaybackContext,
+	})
+	if subtitled.PlaybackPlan == nil || subtitled.PlaybackPlan.EffectiveMediaFileID != active.ID || subtitled.PlaybackPlan.SelectedTracks.Subtitle == nil {
+		t.Fatalf("the PGS on the 4K edition was not selected: %#v", subtitled)
+	}
+
+	// The new output cannot draw PGS, so the 4K edition would need a burn-in
+	// its HDR picture cannot take.
+	nextContext := startRequest.ClientPlaybackContext
+	nextContext.Output.OutputContextID = "route-2"
+	nextContext.Deliveries = maps.Clone(startRequest.ClientPlaybackContext.Deliveries)
+	original.Subtitles.EmbeddedBitmap = false
+	nextContext.Deliveries[playback.DeliveryClassOriginalHTTPV3] = original
+	replanned := postPlaybackReplanV3(t, handler, started.SessionID, playback.ReplanRequestV3{
+		ProtocolVersion: playback.ProtocolV3, Operation: playback.ReplanOperationOutputChangeV3,
+		PlaybackAttemptID: startRequest.PlaybackAttemptID, ReplanRequestID: "kept-edition-output-0001",
+		FailedPlanID: subtitled.PlaybackPlan.PlanID, PlanAttemptID: "kept-edition-output-attempt-0001",
+		PlanAttemptKey: subtitled.PlaybackPlan.PlanAttemptKey, AttemptCount: 1, PositionSeconds: 40,
+		QualityPreference: "auto",
+		SelectedTracks:    subtitled.PlaybackPlan.SelectedTracks,
+		Capabilities:      startRequest.Capabilities, ClientPlaybackContext: nextContext,
+	})
+	if replanned.PlaybackPlan == nil || replanned.Terminal != nil {
+		t.Fatalf("output change = %#v", replanned)
+	}
+	return replanned.PlaybackPlan
+}
+
+// requireRequestedEditionWithoutSubtitleV3 fails unless plan is back on the
+// requested edition with the subtitle off and reported as not on that file.
+func requireRequestedEditionWithoutSubtitleV3(t *testing.T, plan *playback.PlanV3, requested *models.MediaFile) {
+	t.Helper()
+	if plan.EffectiveMediaFileID != requested.ID || plan.SelectedTracks.Subtitle != nil {
+		t.Fatalf("effective file = %d subtitle = %#v, want the requested edition %d without the subtitle", plan.EffectiveMediaFileID, plan.SelectedTracks.Subtitle, requested.ID)
+	}
+	if !slices.Contains(plan.DegradationWarnings, playback.SubtitleTrackUnavailableWarningV3()) {
+		t.Fatalf("warnings = %#v, want the subtitle reported as not on this file", plan.DegradationWarnings)
+	}
+}
+
+// The active alternate is kept during an output change only to keep the
+// viewer's subtitle. When the new output cannot show that subtitle on the
+// alternate either, playback still returns to the requested edition without
+// it: the requested edition is the picture the viewer asked for.
+func TestHandleReplanPlaybackV3OutputChangeReturnsToRequestedEditionWhenSubtitleCannotBeShown(t *testing.T) {
+	handler, active, requested, startRequest := subtitleBlockedHDRFixtureV3(t)
+	requireRequestedEditionWithoutSubtitleV3(t, outputChangeAfterKeptAlternateV3(t, handler, active, requested, startRequest), requested)
+}
+
+// The requested edition is listed after every other version, which the
+// fallback tries lower resolutions first. Another version that also drops the
+// subtitle must not take its place, and neither may the 4K edition without it.
+func TestHandleReplanPlaybackV3OutputChangeReturnsToRequestedEditionAheadOfOtherVersions(t *testing.T) {
+	handler, active, requested, startRequest := subtitleBlockedHDRFixtureV3(t)
+	lowerValue := *requested
+	lower := &lowerValue
+	lower.ID = 126
+	lower.FilePath = writePlaybackTestMediaFile(t, "movie-720p.mkv")
+	lower.Resolution = "720p"
+	lower.Bitrate = 3_000
+	lower.VideoTracks = []models.VideoTrack{{
+		Codec: "h264", Profile: "high", Level: 31, Width: 1280, Height: 720,
+		FrameRate: "24000/1001", Bitrate: 3_000, BitDepth: 8,
+		VideoRange: "SDR", VideoRangeType: "SDR",
+	}}
+	handler.FileVersionFetcher = testPlaybackFileVersionFetcher{byContent: map[string][]*models.MediaFile{
+		active.ContentID: {active, requested, lower},
+	}}
+	requireRequestedEditionWithoutSubtitleV3(t, outputChangeAfterKeptAlternateV3(t, handler, active, requested, startRequest, lower), requested)
+}
+
+// workerOnlyHeaderAuthenticatedV3 moves the fixture onto header-authenticated
+// media with remux_execution=worker_only, where the API refuses progressive
+// remuxes. The 1080p sibling becomes an MP4 the client direct plays, while
+// the 4K MKV without its subtitle needs a progressive MP4 remux, and HLS
+// carries only H.264, so that remux has nowhere to escalate.
+func workerOnlyHeaderAuthenticatedV3(t *testing.T, handler *PlaybackHandler, alternate *models.MediaFile, startRequest *playback.StartRequestV3) {
+	t.Helper()
+	requireWorkerRoutingV3(handler)
+	alternate.Container = "mp4"
+	alternate.FilePath = writePlaybackTestMediaFile(t, "movie-1080p.mp4")
+	startRequest.ClientFeatures = append(startRequest.ClientFeatures, playback.FeatureHeaderAuthenticatedMediaV3)
+	startRequest.Capabilities.VideoDecode = append(startRequest.Capabilities.VideoDecode, v3HandlerStartRequest().Capabilities.VideoDecode[0])
+	startRequest.Capabilities.Containers = []string{"mp4", "hls"}
+	deliveries := maps.Clone(startRequest.ClientPlaybackContext.Deliveries)
+	original := deliveries[playback.DeliveryClassOriginalHTTPV3]
+	original.Containers = []string{"mp4"}
+	deliveries[playback.DeliveryClassOriginalHTTPV3] = original
+	deliveries[playback.DeliveryClassProgressiveV3] = playback.DeliveryCapabilityV3{
+		Enabled: true, SupportedOnDevice: true, Containers: []string{"mp4"},
+		VideoCodecs: []string{"hevc", "h264"}, AudioDecodeCodecs: []string{"aac"},
+	}
+	startRequest.ClientPlaybackContext.Deliveries = deliveries
+}
+
+// requireExecutableSiblingV3 fails unless response plays the sibling that was
+// already found playable, rather than a requested-file route nothing can run.
+func requireExecutableSiblingV3(t *testing.T, response playback.DecisionResponseV3, alternate *models.MediaFile) {
+	t.Helper()
+	if response.PlaybackPlan == nil || response.Terminal != nil {
+		t.Fatalf("response = terminal %#v, want the playable sibling %d", response.Terminal, alternate.ID)
+	}
+	if response.PlaybackPlan.EffectiveMediaFileID != alternate.ID || response.PlaybackPlan.Delivery != playback.DeliveryClassOriginalHTTPV3 {
+		t.Fatalf("effective file = %d delivery = %s, want sibling %d direct", response.PlaybackPlan.EffectiveMediaFileID, response.PlaybackPlan.Delivery, alternate.ID)
+	}
+}
+
+// The requested file without its subtitle only replaces a playable sibling
+// when its plan can run. A progressive remux the API refuses and HLS cannot
+// carry would otherwise end the start in a terminal.
+func TestHandleStartPlaybackV3SubtitleOnlyRefusalKeepsAnExecutableSibling(t *testing.T) {
+	handler, source, alternate, startRequest := subtitleBlockedHDRFixtureV3(t)
+	workerOnlyHeaderAuthenticatedV3(t, handler, alternate, &startRequest)
+	startRequest.SubtitleTrackID = playback.TrackIDV3(source.ID, "subtitle", 0)
+	startRequest.SubtitleTrackIndex = new(0)
+
+	rec := httptest.NewRecorder()
+	handler.HandleStartPlayback(rec, httptest.NewRequest(http.MethodPost, "/api/v1/playback/start", strings.NewReader(marshalV3StartRequest(t, startRequest))).WithContext(newAuthorizedPlaybackContext()))
+	var started playback.DecisionResponseV3
+	if rec.Code != http.StatusCreated || json.Unmarshal(rec.Body.Bytes(), &started) != nil {
+		t.Fatalf("start status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	if started.SessionID != "" {
+		t.Cleanup(func() { handler.tm.CloseTranscodeSession(started.SessionID, "") })
+	}
+	requireExecutableSiblingV3(t, started, alternate)
+}
+
+// The same holds for an output change that leaves the 4K file unable to show
+// the PGS it was playing with.
+func TestHandleReplanPlaybackV3SubtitleOnlyRefusalKeepsAnExecutableSibling(t *testing.T) {
+	handler, source, alternate, startRequest := subtitleBlockedHDRFixtureV3(t)
+	workerOnlyHeaderAuthenticatedV3(t, handler, alternate, &startRequest)
+	original := startRequest.ClientPlaybackContext.Deliveries[playback.DeliveryClassOriginalHTTPV3]
+	original.Containers = []string{"mkv", "mp4"}
+	original.Subtitles.EmbeddedBitmap = true
+	startRequest.ClientPlaybackContext.Deliveries[playback.DeliveryClassOriginalHTTPV3] = original
+	startRequest.Capabilities.Containers = []string{"mkv", "mp4", "hls"}
+	startRequest.SubtitleTrackID = playback.TrackIDV3(source.ID, "subtitle", 0)
+	startRequest.SubtitleTrackIndex = new(0)
+
+	rec := httptest.NewRecorder()
+	handler.HandleStartPlayback(rec, httptest.NewRequest(http.MethodPost, "/api/v1/playback/start", strings.NewReader(marshalV3StartRequest(t, startRequest))).WithContext(newAuthorizedPlaybackContext()))
+	var started playback.DecisionResponseV3
+	if rec.Code != http.StatusCreated || json.Unmarshal(rec.Body.Bytes(), &started) != nil || started.PlaybackPlan == nil || started.PlaybackPlan.EffectiveMediaFileID != source.ID || started.PlaybackPlan.SelectedTracks.Subtitle == nil {
+		t.Fatalf("start did not play the 4K file with its PGS: status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	t.Cleanup(func() { handler.tm.CloseTranscodeSession(started.SessionID, "") })
+
+	capabilities := startRequest.Capabilities
+	capabilities.Containers = []string{"mp4", "hls"}
+	nextContext := startRequest.ClientPlaybackContext
+	nextContext.Output.OutputContextID = "route-2"
+	nextContext.Deliveries = maps.Clone(startRequest.ClientPlaybackContext.Deliveries)
+	original.Containers = []string{"mp4"}
+	original.Subtitles.EmbeddedBitmap = false
+	nextContext.Deliveries[playback.DeliveryClassOriginalHTTPV3] = original
+	replanned := postPlaybackReplanV3(t, handler, started.SessionID, playback.ReplanRequestV3{
+		ProtocolVersion: playback.ProtocolV3, Operation: playback.ReplanOperationOutputChangeV3,
+		PlaybackAttemptID: startRequest.PlaybackAttemptID, ReplanRequestID: "executable-sibling-output-0001",
+		FailedPlanID: started.PlaybackPlan.PlanID, PlanAttemptID: "executable-sibling-output-attempt-0001",
+		PlanAttemptKey: started.PlaybackPlan.PlanAttemptKey, AttemptCount: 1, PositionSeconds: 30,
+		QualityPreference: "auto", SelectedTracks: started.PlaybackPlan.SelectedTracks,
+		Capabilities: capabilities, ClientPlaybackContext: nextContext,
+	})
+	requireExecutableSiblingV3(t, replanned, alternate)
+}
diff --git a/internal/api/handlers/playback_v3_test.go b/internal/api/handlers/playback_v3_test.go
index ad6831f186..87455a6e83 100644
--- a/internal/api/handlers/playback_v3_test.go
+++ b/internal/api/handlers/playback_v3_test.go
@@ -222,17 +222,6 @@ func (f *failingCompletePlanStoreV3) CompleteReplan(context.Context, string, str
 	return fmt.Errorf("injected complete replan failure")
 }
 
-func TestShouldTryAlternateFileV3PinsOriginalQuality(t *testing.T) {
-	if shouldTryAlternateFileV3("original") || shouldTryAlternateFileV3(" ORIGINAL ") {
-		t.Fatal("original quality must pin the requested media file")
-	}
-	for _, quality := range []string{"auto", "2160p", "1080p", "480p"} {
-		if !shouldTryAlternateFileV3(quality) {
-			t.Fatalf("quality %q should permit alternate selection", quality)
-		}
-	}
-}
-
 func TestValidateAdvertisedTransformationsV3RejectsOldVideoRecipe(t *testing.T) {
 	plan := &playback.PlanV3{Transformations: []playback.TransformationV3{{
 		Name:          playback.TransformationVideoToH264V3,
@@ -257,13 +246,16 @@ func TestValidateAdvertisedTransformationsV3RejectsOldVideoRecipe(t *testing.T)
 	}
 }
 
-func TestHandleStartPlaybackV3ExplainsOriginalQuality4KPinWhenAlternateExists(t *testing.T) {
+// A legacy "original" preference no longer pins the requested 4K version: like
+// auto, it falls back to a lower-resolution version when 4K transcoding is
+// disabled, and only refuses when no such version exists.
+func TestHandleStartPlaybackV3OriginalQualityFallsBackFrom4K(t *testing.T) {
 	for _, test := range []struct {
 		name                string
 		alternateResolution string
 		wantMessage         string
 	}{
-		{name: "lower-resolution alternate exists", alternateResolution: "1080p", wantMessage: "compatible lower-resolution version of this title is available"},
+		{name: "lower-resolution alternate exists", alternateResolution: "1080p"},
 		{name: "only 4K alternate exists", alternateResolution: "UHD", wantMessage: playback.TerminalMessage4KTranscodeDisabledV3},
 		{name: "only label-only 8K alternate exists", alternateResolution: "8K", wantMessage: playback.TerminalMessage4KTranscodeDisabledV3},
 		{name: "no alternate", wantMessage: playback.TerminalMessage4KTranscodeDisabledV3},
@@ -310,10 +302,16 @@ func TestHandleStartPlaybackV3ExplainsOriginalQuality4KPinWhenAlternateExists(t
 			handler.HandleStartPlayback(rr, httptest.NewRequest(http.MethodPost, "/api/v1/playback/start", strings.NewReader(marshalV3StartRequest(t, start))).WithContext(newAuthorizedPlaybackContext()))
 
 			var response playback.DecisionResponseV3
-			if rr.Code != http.StatusCreated || json.Unmarshal(rr.Body.Bytes(), &response) != nil || response.Terminal == nil {
+			if rr.Code != http.StatusCreated || json.Unmarshal(rr.Body.Bytes(), &response) != nil {
 				t.Fatalf("status=%d body=%s", rr.Code, rr.Body.String())
 			}
-			if response.Terminal.Reason != "no_alternate_version" || !strings.Contains(response.Terminal.Message, test.wantMessage) {
+			if test.wantMessage == "" {
+				if response.PlaybackPlan == nil || response.PlaybackPlan.EffectiveMediaFileID != 84 {
+					t.Fatalf("response = %s, want the 1080p version played", rr.Body.String())
+				}
+				return
+			}
+			if response.Terminal == nil || response.Terminal.Reason != "no_alternate_version" || response.Terminal.Message != test.wantMessage {
 				t.Fatalf("terminal = %#v, want message containing %q", response.Terminal, test.wantMessage)
 			}
 		})
@@ -563,20 +561,19 @@ func TestReplanAllowsAlternateFileV3PinsSeekOperations(t *testing.T) {
 	tests := []struct {
 		name      string
 		operation playback.ReplanOperationV3
-		quality   string
 		want      bool
 	}{
-		{name: "ordinary failure may use another version", operation: playback.ReplanOperationFailureRecoveryV3, quality: "auto", want: true},
-		{name: "output change may use another version", operation: playback.ReplanOperationOutputChangeV3, quality: "auto", want: true},
-		{name: "track change may use another version", operation: playback.ReplanOperationTrackChangeV3, quality: "auto", want: true},
-		{name: "original quality remains pinned", operation: playback.ReplanOperationFailureRecoveryV3, quality: "original", want: false},
-		{name: "exact seek reanchor pins current version", operation: playback.ReplanOperationSeekReanchorV3, quality: "auto", want: false},
-		{name: "failed seek recovery pins current version", operation: playback.ReplanOperationSeekFailureRecoveryV3, quality: "auto", want: false},
+		{name: "ordinary failure may use another version", operation: playback.ReplanOperationFailureRecoveryV3, want: true},
+		{name: "quality change may use another version", operation: playback.ReplanOperationQualityChangeV3, want: true},
+		{name: "output change may use another version", operation: playback.ReplanOperationOutputChangeV3, want: true},
+		{name: "track change may use another version", operation: playback.ReplanOperationTrackChangeV3, want: true},
+		{name: "exact seek reanchor pins current version", operation: playback.ReplanOperationSeekReanchorV3, want: false},
+		{name: "failed seek recovery pins current version", operation: playback.ReplanOperationSeekFailureRecoveryV3, want: false},
 	}
 	for _, test := range tests {
 		t.Run(test.name, func(t *testing.T) {
-			if got := replanAllowsAlternateFileV3(test.operation, test.quality); got != test.want {
-				t.Fatalf("replanAllowsAlternateFileV3(%q, %q) = %v, want %v", test.operation, test.quality, got, test.want)
+			if got := replanAllowsAlternateFileV3(test.operation); got != test.want {
+				t.Fatalf("replanAllowsAlternateFileV3(%q) = %v, want %v", test.operation, got, test.want)
 			}
 		})
 	}
@@ -5318,6 +5315,7 @@ func TestHandleReplanPlaybackV3TrackChangeOperation(t *testing.T) {
 	handler.SettingsRepo = &mutablePlaybackSettingsV3{values: map[string]string{"allow_4k_transcode": "true"}}
 	handler.ItemAccess = allowAllPlaybackItemAccess{}
 	startRequest := v3HandlerStartRequest()
+	startRequest.QualityPreference = "1080p"
 	startRequest.ClientPlaybackContext.Deliveries[playback.DeliveryClassProgressiveV3] = playback.DeliveryCapabilityV3{Enabled: true, SupportedOnDevice: true}
 	startReq := httptest.NewRequest(http.MethodPost, "/api/v1/playback/start", strings.NewReader(marshalV3StartRequest(t, startRequest))).WithContext(newAuthorizedPlaybackContext())
 	startRR := httptest.NewRecorder()
@@ -5389,7 +5387,7 @@ func TestHandleReplanPlaybackV3TrackChangeOperation(t *testing.T) {
 		t.Fatal(err)
 	}
 	// A track change without a quality field keeps the durable quality intact.
-	if record.NormalizedRequest.QualityPreference != "original" {
+	if record.NormalizedRequest.QualityPreference != "1080p" {
 		t.Fatalf("quality after track change = %q", record.NormalizedRequest.QualityPreference)
 	}
 }
@@ -5792,7 +5790,8 @@ func TestHandleReplanPlaybackV3QualityChangeOperation(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if record.NormalizedRequest.QualityPreference != "original" || record.NormalizedRequest.AllowsAlternateVersions() || record.EffectiveMediaFileID != file.ID {
+	// The legacy "original" spelling is stored as the auto it now means.
+	if record.NormalizedRequest.QualityPreference != "auto" || record.NormalizedRequest.AllowsAlternateVersions() || record.EffectiveMediaFileID != file.ID {
 		t.Fatalf("durable quality = %q", record.NormalizedRequest.QualityPreference)
 	}
 }
diff --git a/internal/api/handlers/plugins.go b/internal/api/handlers/plugins.go
index ddc0d4e1fc..4d7bf16687 100644
--- a/internal/api/handlers/plugins.go
+++ b/internal/api/handlers/plugins.go
@@ -10,6 +10,7 @@ import (
 	"log/slog"
 	"net/http"
 	"os"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -17,6 +18,7 @@ import (
 	"github.com/go-chi/chi/v5"
 
 	pluginv1 "github.com/prairie-server/prairie-plugin-sdk/pkg/pluginproto/prairie/plugin/v1"
+	sdkcapability "github.com/prairie-server/prairie-plugin-sdk/pkg/pluginsdk/capability"
 
 	apimw "github.com/prairie-server/prairie-server/internal/api/middleware"
 	"github.com/prairie-server/prairie-server/internal/metadata"
@@ -201,7 +203,8 @@ type PluginInstallationView struct {
 
 // PluginRuntimeView is one installation's process state. Resident marks a
 // plugin the supervisor keeps running (network access providers); State is
-// the supervisor's machine for those and running/stopped for lazily started
+// the supervisor's machine for those and running, stopped, or failed (the
+// last launch on this host failed, LastError says why) for lazily started
 // plugins.
 type PluginRuntimeView struct {
 	Resident      bool
@@ -248,6 +251,11 @@ type PluginCapabilityView struct {
 	// admin view derives the binding's sign-in URLs from them; the frozen
 	// v1 projection does not carry them.
 	AuthModes []string `json:"-"`
+	// RequestRouter is a request_router.v1 capability's descriptor, nil when
+	// the manifest declares none. The v2 admin view reads which connection
+	// fields the plugin can do without from it; the frozen v1 projection does
+	// not carry it.
+	RequestRouter *pluginv1.RequestRouterDescriptor `json:"-"`
 }
 
 type PluginRouteView struct {
@@ -1427,7 +1435,7 @@ func (h *PluginHandler) buildInstallationResponseWithBindings(
 	}
 	var runtime *PluginRuntimeView
 	if h.service != nil {
-		state := h.service.RuntimeState(installation.ID)
+		state := h.service.RuntimeStateOf(installation)
 		runtime = &PluginRuntimeView{Resident: state.Resident, State: string(state.State), RestartCount: state.RestartCount, LastError: state.LastError, LastStartedAt: state.LastStartedAt, NextRestartAt: state.NextRestartAt}
 		// Before the supervisor arms (boot) the capability says what will be
 		// resident. Once armed, its entries are the truth: an enabled
@@ -1550,6 +1558,7 @@ func capabilitiesToJSON(descriptors []*pluginv1.CapabilityDescriptor) []PluginCa
 			ConfigSchema:  configSchemasToJSON(descriptor.GetConfigSchema()),
 			Metadata:      structToMap(descriptor.GetMetadata()),
 			AuthModes:     append([]string(nil), descriptor.GetAuthModes()...),
+			RequestRouter: descriptor.GetRequestRouter(),
 		})
 	}
 	return response
@@ -1705,7 +1714,8 @@ func (h *PluginHandler) loadInstallationCapabilities(
 	manifest *pluginv1.PluginManifest,
 ) ([]PluginCapabilityView, error) {
 	if manifest != nil {
-		return capabilitiesToJSON(manifest.GetCapabilities()), nil
+		views := capabilitiesToJSON(manifest.GetCapabilities())
+		return views, h.useStoredRequestRouters(ctx, installation, views)
 	}
 
 	records, err := h.installations.ListCapabilities(ctx, installation.ID)
@@ -1724,6 +1734,44 @@ func (h *PluginHandler) loadInstallationCapabilities(
 	return response, nil
 }
 
+// useStoredRequestRouters gives each request_router.v1 capability the
+// descriptor stored when the plugin was installed, which is what the requests
+// service reads. The installed manifest can declare flags that a host built on
+// an older SDK dropped when it stored the capability, and the admin form must
+// not offer a server setup that routing then refuses.
+func (h *PluginHandler) useStoredRequestRouters(ctx context.Context, installation *plugins.Installation, views []PluginCapabilityView) error {
+	if !slices.ContainsFunc(views, func(v PluginCapabilityView) bool { return v.Type == sdkcapability.RequestRouter }) {
+		return nil
+	}
+	records, err := h.installations.ListCapabilities(ctx, installation.ID)
+	if err != nil {
+		return err
+	}
+	return applyStoredRequestRouters(views, records)
+}
+
+// applyStoredRequestRouters sets each request_router.v1 view's descriptor to
+// the stored record's with the same ID, or none when no record has one.
+func applyStoredRequestRouters(views []PluginCapabilityView, records []*plugins.Capability) error {
+	stored := map[string]*pluginv1.RequestRouterDescriptor{}
+	for _, record := range records {
+		if record == nil || record.Type != sdkcapability.RequestRouter {
+			continue
+		}
+		descriptor, err := plugins.DecodeCapability(record)
+		if err != nil {
+			return err
+		}
+		stored[record.ID] = descriptor.GetRequestRouter()
+	}
+	for i := range views {
+		if views[i].Type == sdkcapability.RequestRouter {
+			views[i].RequestRouter = stored[views[i].ID]
+		}
+	}
+	return nil
+}
+
 func loadPluginManifest(installation *plugins.Installation) (*pluginv1.PluginManifest, error) {
 	return plugins.LoadManifestFile(plugins.InstalledManifestPath(installation.InstallPath))
 }
diff --git a/internal/api/handlers/plugins_request_router_test.go b/internal/api/handlers/plugins_request_router_test.go
new file mode 100644
index 0000000000..49dcbefd10
--- /dev/null
+++ b/internal/api/handlers/plugins_request_router_test.go
@@ -0,0 +1,46 @@
+package handlers
+
+import (
+	"testing"
+
+	pluginv1 "github.com/prairie-server/prairie-plugin-sdk/pkg/pluginproto/prairie/plugin/v1"
+	"github.com/prairie-server/prairie-plugin-sdk/pkg/pluginsdk/capability"
+
+	"github.com/prairie-server/prairie-server/internal/plugins"
+)
+
+// The admin form must offer what routing accepts, so a request router's view
+// takes its descriptor from the stored capability that routing reads, not
+// from the installed manifest. A host on an older SDK stored the capability
+// without flags the manifest declares.
+func TestApplyStoredRequestRoutersUsesTheStoredDescriptor(t *testing.T) {
+	t.Parallel()
+
+	installed := capabilitiesToJSON([]*pluginv1.CapabilityDescriptor{
+		{Type: capability.RequestRouter, Id: "local", RequestRouter: &pluginv1.RequestRouterDescriptor{ApiKeyOptional: true, BaseUrlOptional: true}},
+		{Type: capability.RequestRouter, Id: "gone", RequestRouter: &pluginv1.RequestRouterDescriptor{ApiKeyOptional: true}},
+		{Type: capability.ScheduledTask, Id: "task"},
+	})
+	records, err := plugins.CapabilityRecordsFromManifest(&pluginv1.PluginManifest{Capabilities: []*pluginv1.CapabilityDescriptor{
+		{Type: capability.RequestRouter, Id: "local", RequestRouter: &pluginv1.RequestRouterDescriptor{SupportsSeasons: true}},
+		{Type: capability.ScheduledTask, Id: "task"},
+	}})
+	if err != nil {
+		t.Fatalf("CapabilityRecordsFromManifest: %v", err)
+	}
+	stored := make([]*plugins.Capability, 0, len(records))
+	for i := range records {
+		stored = append(stored, &records[i])
+	}
+
+	if err := applyStoredRequestRouters(installed, stored); err != nil {
+		t.Fatalf("applyStoredRequestRouters: %v", err)
+	}
+	local := installed[0].RequestRouter
+	if !local.GetSupportsSeasons() || local.GetApiKeyOptional() || local.GetBaseUrlOptional() {
+		t.Fatalf("local descriptor = %v, want the stored one without the optional flags", local)
+	}
+	if installed[1].RequestRouter != nil {
+		t.Fatalf("gone descriptor = %v, want none when nothing is stored", installed[1].RequestRouter)
+	}
+}
diff --git a/internal/api/handlers/profile_refresh.go b/internal/api/handlers/profile_refresh.go
index 1c71c406aa..5427112cf2 100644
--- a/internal/api/handlers/profile_refresh.go
+++ b/internal/api/handlers/profile_refresh.go
@@ -1,27 +1,17 @@
 package handlers
 
-import (
-	"context"
-	"log/slog"
-)
+import "context"
 
-// ProfileStaler marks a user's taste profile as stale so it gets refreshed.
-type ProfileStaler interface {
-	MarkProfileStale(ctx context.Context, userID int, profileID string) error
+// SignalsChangedNotifier records that a profile's recommendation signals
+// (ratings, favorites, watchlist, watch progress or history) changed, so its
+// taste profile and cached recommendations get rebuilt.
+// *recommendations.Worker implements it.
+type SignalsChangedNotifier interface {
+	NotifySignalsChanged(ctx context.Context, userID int, profileID string)
 }
 
-// ProfileRefreshRequester enqueues an asynchronous profile-scoped recommendation refresh.
-type ProfileRefreshRequester interface {
-	RequestProfileRefresh(ctx context.Context, userID int, profileID string)
-}
-
-func triggerProfileRefresh(ctx context.Context, staler ProfileStaler, requester ProfileRefreshRequester, userID int, profileID string) {
-	if staler != nil {
-		if err := staler.MarkProfileStale(ctx, userID, profileID); err != nil {
-			slog.WarnContext(ctx, "failed to mark profile stale", "component", "api", "user_id", userID, "profile_id", profileID, "error", err)
-		}
-	}
-	if requester != nil {
-		requester.RequestProfileRefresh(ctx, userID, profileID)
+func notifySignalsChanged(ctx context.Context, notifier SignalsChangedNotifier, userID int, profileID string) {
+	if notifier != nil {
+		notifier.NotifySignalsChanged(ctx, userID, profileID)
 	}
 }
diff --git a/internal/api/handlers/profiles.go b/internal/api/handlers/profiles.go
index f509c925aa..348a19c766 100644
--- a/internal/api/handlers/profiles.go
+++ b/internal/api/handlers/profiles.go
@@ -29,6 +29,9 @@ type ProfileHandler struct {
 	UserRepo       interface {
 		GetByID(ctx context.Context, id int) (*models.User, error)
 	}
+	// AccessGroups resolves the profile limit an account inherits from its
+	// access group. Nil resolves every account as ungrouped.
+	AccessGroups   access.GroupPolicyProvider
 	ProfileTokens  *access.ProfileTokenService
 	AvatarStore    profileAvatarStore
 	AvatarResolver artworkurl.Resolver
@@ -50,6 +53,18 @@ type ProfileHandler struct {
 	WatchlistTitlesPurger interface {
 		PurgeProfile(ctx context.Context, userID int, profileID string) error
 	}
+	// EbookReaderPurger removes a deleted profile's ebook reading progress,
+	// reader settings and annotations, which live in Postgres whichever
+	// store holds the profile.
+	EbookReaderPurger interface {
+		PurgeProfile(ctx context.Context, userID int, profileID string) error
+	}
+	// RecommendationsPurger removes a deleted profile's ratings, taste
+	// profile and cached recommendations, which live in Postgres whichever
+	// store holds the profile.
+	RecommendationsPurger interface {
+		PurgeProfile(ctx context.Context, userID int, profileID string) error
+	}
 	// WatchlistRequestWithdrawer cancels the unsent requests a deleted
 	// profile's watchlist made, as removing each title would.
 	WatchlistRequestWithdrawer interface {
@@ -63,6 +78,9 @@ type ProfileHandler struct {
 	// ratelimit.ProfilePINPolicy). The router always sets it; nil, as in
 	// tests that do not exercise the limit, allows every attempt.
 	PINAttempts *ratelimit.AttemptLimiter
+	// RecWorker is told when an update changes a profile's access scope, so
+	// its recommendations are rebuilt under the new one. Optional.
+	RecWorker SignalsChangedNotifier
 }
 
 // NewProfileHandler creates a new ProfileHandler.
@@ -396,9 +414,15 @@ func (h *ProfileHandler) CreateProfile(ctx context.Context, cmd ProfileCreateCom
 		if err != nil {
 			return none, apiError(http.StatusInternalServerError, "internal_error", "Failed to load user")
 		}
-		if user != nil && user.MaxProfiles >= 1 && len(existingProfiles) >= user.MaxProfiles {
-			return none, apiError(http.StatusConflict, "profile_limit_reached",
-				fmt.Sprintf("This account has reached its profile limit (%d)", user.MaxProfiles))
+		if user != nil {
+			effective, err := access.EffectivePolicyForUser(ctx, user, h.AccessGroups)
+			if err != nil {
+				return none, apiError(http.StatusInternalServerError, "internal_error", "Failed to load the account's profile limit")
+			}
+			if limit := effective.MaxProfiles; limit >= 1 && len(existingProfiles) >= limit {
+				return none, apiError(http.StatusConflict, "profile_limit_reached",
+					fmt.Sprintf("This account has reached its profile limit (%d)", limit))
+			}
 		}
 	}
 
@@ -654,6 +678,9 @@ func (h *ProfileHandler) UpdateProfile(ctx context.Context, cmd ProfileUpdateCom
 		h.PINAttempts.Reset(resetCtx, ratelimit.ProfilePINKey(userID, profileID))
 		cancel()
 	}
+	if profileScopeSet(req) {
+		notifySignalsChanged(ctx, h.RecWorker, userID, profileID)
+	}
 	if currentProfile.Avatar != "" && avatarRef != nil && avatarRefReplacesUpload(currentProfile.Avatar, *avatarRef) {
 		if cleanupErr := deleteUploadedAvatarObjects(ctx, h.AvatarStore, userID, profileID); cleanupErr != nil {
 			slog.WarnContext(ctx, "profile avatar cleanup failed after update", "component", "api", "user_id", userID, "profile_id", profileID, "error", cleanupErr)
@@ -795,6 +822,20 @@ func (h *ProfileHandler) DeleteProfile(ctx context.Context, cmd ProfileDeleteCom
 			slog.WarnContext(ctx, "profile watchlist-title purge failed after delete", "component", "api", "user_id", userID, "profile_id", profileID, "error", purgeErr)
 		}
 	}
+	if h.EbookReaderPurger != nil {
+		purgeCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 30*time.Second)
+		defer cancel()
+		if purgeErr := h.EbookReaderPurger.PurgeProfile(purgeCtx, userID, profileID); purgeErr != nil {
+			slog.WarnContext(ctx, "profile ebook reader purge failed after delete", "component", "api", "user_id", userID, "profile_id", profileID, "error", purgeErr)
+		}
+	}
+	if h.RecommendationsPurger != nil {
+		purgeCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 30*time.Second)
+		defer cancel()
+		if purgeErr := h.RecommendationsPurger.PurgeProfile(purgeCtx, userID, profileID); purgeErr != nil {
+			slog.WarnContext(ctx, "profile recommendation purge failed after delete", "component", "api", "user_id", userID, "profile_id", profileID, "error", purgeErr)
+		}
+	}
 	return nil
 }
 
diff --git a/internal/api/handlers/profiles_advisory_age_test.go b/internal/api/handlers/profiles_advisory_age_test.go
index 16790b1f04..20f1627b2b 100644
--- a/internal/api/handlers/profiles_advisory_age_test.go
+++ b/internal/api/handlers/profiles_advisory_age_test.go
@@ -86,7 +86,7 @@ func TestUpdateProfile_AdvisoryAgeLimit(t *testing.T) {
 func TestCreateProfile_AdvisoryAgeLimitNeedsAManager(t *testing.T) {
 	store := newEmptyProfileTestStore(t)
 	handler := NewProfileHandler(testUserStoreProvider{store: store})
-	handler.UserRepo = testProfileUserRepo{user: &models.User{ID: 1, MaxProfiles: 5}}
+	handler.UserRepo = testProfileUserRepo{user: &models.User{ID: 1, MaxProfiles: new(5)}}
 
 	_, err := handler.CreateProfile(profileServiceContext(""), ProfileCreateCommand{
 		UserID:        1,
@@ -196,7 +196,7 @@ func TestUpdateProfile_RequireAdvisoryAge(t *testing.T) {
 func TestCreateProfile_RequireAdvisoryAgeNeedsAManager(t *testing.T) {
 	store := newEmptyProfileTestStore(t)
 	handler := NewProfileHandler(testUserStoreProvider{store: store})
-	handler.UserRepo = testProfileUserRepo{user: &models.User{ID: 1, MaxProfiles: 5}}
+	handler.UserRepo = testProfileUserRepo{user: &models.User{ID: 1, MaxProfiles: new(5)}}
 
 	_, err := handler.CreateProfile(profileServiceContext(""), ProfileCreateCommand{
 		UserID:        1,
diff --git a/internal/api/handlers/profiles_pin_limit_test.go b/internal/api/handlers/profiles_pin_limit_test.go
index e58a1e316a..ac8ce2a67b 100644
--- a/internal/api/handlers/profiles_pin_limit_test.go
+++ b/internal/api/handlers/profiles_pin_limit_test.go
@@ -20,7 +20,7 @@ import (
 func newPINLimitHandler(t *testing.T, store userstore.UserStore, limiter *ratelimit.AttemptLimiter) *ProfileHandler {
 	t.Helper()
 	h := NewProfileHandler(testUserStoreProvider{store: store})
-	h.UserRepo = testProfileUserRepo{user: &models.User{ID: 1, MaxProfiles: 5}}
+	h.UserRepo = testProfileUserRepo{user: &models.User{ID: 1, MaxProfiles: new(5)}}
 	h.ProfileTokens = access.NewProfileTokenService("test-secret", time.Minute)
 	h.PINAttempts = limiter
 	return h
diff --git a/internal/api/handlers/profiles_test.go b/internal/api/handlers/profiles_test.go
index 62d1ae59ab..108576c42a 100644
--- a/internal/api/handlers/profiles_test.go
+++ b/internal/api/handlers/profiles_test.go
@@ -100,7 +100,7 @@ func TestHandleCreateProfile_EnforcesUserProfileLimit(t *testing.T) {
 	store := newProfileTestStore(t)
 	handler := NewProfileHandler(testUserStoreProvider{store: store})
 	handler.UserRepo = testProfileUserRepo{
-		user: &models.User{ID: 1, MaxProfiles: 1},
+		user: &models.User{ID: 1, MaxProfiles: new(1)},
 	}
 
 	req := newAuthorizedProfileRequestWithRole(
@@ -139,7 +139,7 @@ func TestHandleCreateProfile_AllowsNonAdminUpToCap(t *testing.T) {
 	store := newProfileTestStore(t)
 	handler := NewProfileHandler(testUserStoreProvider{store: store})
 	handler.UserRepo = testProfileUserRepo{
-		user: &models.User{ID: 1, MaxProfiles: 5},
+		user: &models.User{ID: 1, MaxProfiles: new(5)},
 	}
 
 	req := newAuthorizedProfileRequestWithRole(
@@ -176,6 +176,47 @@ func TestHandleCreateProfile_AllowsNonAdminUpToCap(t *testing.T) {
 
 }
 
+// profileLimitGroups serves one access group's policy for every account.
+type profileLimitGroups struct{ policy access.GroupPolicy }
+
+func (g profileLimitGroups) GetPolicyForUser(context.Context, int) (*access.GroupPolicy, error) {
+	policy := g.policy
+	return &policy, nil
+}
+
+func TestHandleCreateProfile_EnforcesInheritedGroupProfileLimit(t *testing.T) {
+	groupID := int64(4)
+	tests := []struct {
+		name     string
+		override *int
+		want     int
+	}{
+		{name: "inherits the group's limit", want: http.StatusConflict},
+		{name: "an override above the group's limit wins", override: new(2), want: http.StatusCreated},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			store := newProfileTestStore(t)
+			handler := NewProfileHandler(testUserStoreProvider{store: store})
+			handler.UserRepo = testProfileUserRepo{
+				user: &models.User{ID: 1, Role: models.RoleUser, AccessGroupID: &groupID, MaxProfiles: tt.override},
+			}
+			handler.AccessGroups = profileLimitGroups{policy: access.GroupPolicy{ID: groupID, MaxProfiles: 1}}
+
+			req := newAuthorizedProfileRequestWithRole(http.MethodPost, "/profiles", `{"name":"Kids"}`, "user", "profile-1")
+			rr := httptest.NewRecorder()
+			handler.HandleCreateProfile(rr, req)
+
+			if rr.Code != tt.want {
+				t.Fatalf("status = %d, want %d, body = %s", rr.Code, tt.want, rr.Body.String())
+			}
+			if tt.want == http.StatusConflict && !strings.Contains(rr.Body.String(), "profile limit (1)") {
+				t.Fatalf("body = %s, want the group's limit in the message", rr.Body.String())
+			}
+		})
+	}
+}
+
 func TestHandleCreateProfile_RejectsDuplicateName(t *testing.T) {
 	store := newProfileTestStore(t)
 	handler := NewProfileHandler(testUserStoreProvider{store: store})
@@ -249,7 +290,7 @@ func TestHandleCreateProfile_BlocksNonPrimaryNonAdmin(t *testing.T) {
 	}
 	handler := NewProfileHandler(testUserStoreProvider{store: store})
 	handler.UserRepo = testProfileUserRepo{
-		user: &models.User{ID: 1, MaxProfiles: 5},
+		user: &models.User{ID: 1, MaxProfiles: new(5)},
 	}
 
 	req := newAuthorizedProfileRequestWithRole(
@@ -278,7 +319,7 @@ func TestHandleCreateProfile_RequiresVerifiedPrimaryPINWhenPrimaryHasPIN(t *test
 
 	handler := NewProfileHandler(testUserStoreProvider{store: store})
 	handler.UserRepo = testProfileUserRepo{
-		user: &models.User{ID: 1, MaxProfiles: 5, AccessPolicyRevision: 7},
+		user: &models.User{ID: 1, MaxProfiles: new(5), AccessPolicyRevision: 7},
 	}
 	handler.ProfileTokens = access.NewProfileTokenService("test-secret", time.Minute)
 
@@ -312,7 +353,7 @@ func TestHandleCreateProfile_AllowsVerifiedPrimaryPIN(t *testing.T) {
 
 	handler := NewProfileHandler(testUserStoreProvider{store: store})
 	handler.UserRepo = testProfileUserRepo{
-		user: &models.User{ID: 1, MaxProfiles: 5, AccessPolicyRevision: 7},
+		user: &models.User{ID: 1, MaxProfiles: new(5), AccessPolicyRevision: 7},
 	}
 	handler.ProfileTokens = access.NewProfileTokenService("test-secret", time.Minute)
 
@@ -348,7 +389,7 @@ func TestHandleCreateProfile_BlocksAdminOnlyFieldsForNonAdmin(t *testing.T) {
 	store := newEmptyProfileTestStore(t)
 	handler := NewProfileHandler(testUserStoreProvider{store: store})
 	handler.UserRepo = testProfileUserRepo{
-		user: &models.User{ID: 1, MaxProfiles: 5},
+		user: &models.User{ID: 1, MaxProfiles: new(5)},
 	}
 
 	req := newAuthorizedProfileRequest(`{"name":"Kids","is_child":true}`)
diff --git a/internal/api/handlers/progress.go b/internal/api/handlers/progress.go
index e836e3cf7e..d53e474d9a 100644
--- a/internal/api/handlers/progress.go
+++ b/internal/api/handlers/progress.go
@@ -54,12 +54,11 @@ type ProgressLibraryLookup interface {
 
 // ProgressHandler handles watch progress and sync endpoints.
 type ProgressHandler struct {
-	storeProvider           userstore.UserStoreProvider
-	LibraryLookup           ProgressLibraryLookup
-	SettingsRepo            PlaybackSettingsReader
-	EventsHub               *evt.Hub
-	profileStaler           ProfileStaler
-	profileRefreshRequester ProfileRefreshRequester
+	storeProvider   userstore.UserStoreProvider
+	LibraryLookup   ProgressLibraryLookup
+	SettingsRepo    PlaybackSettingsReader
+	EventsHub       *evt.Hub
+	signalsNotifier SignalsChangedNotifier
 }
 
 // NewProgressHandler creates a new ProgressHandler.
@@ -67,14 +66,10 @@ func NewProgressHandler(provider userstore.UserStoreProvider) *ProgressHandler {
 	return &ProgressHandler{storeProvider: provider}
 }
 
-// SetProfileStaler configures an optional staleness trigger for taste profiles.
-func (h *ProgressHandler) SetProfileStaler(ps ProfileStaler) {
-	h.profileStaler = ps
-}
-
-// SetProfileRefreshRequester configures an optional background refresh queue for taste profiles.
-func (h *ProgressHandler) SetProfileRefreshRequester(requester ProfileRefreshRequester) {
-	h.profileRefreshRequester = requester
+// SetSignalsChangedNotifier configures where changes to a profile's
+// recommendation signals are reported. Without it they are not reported.
+func (h *ProgressHandler) SetSignalsChangedNotifier(notifier SignalsChangedNotifier) {
+	h.signalsNotifier = notifier
 }
 
 // --- Request/Response types ---
@@ -524,7 +519,7 @@ func (h *ProgressHandler) SyncProgress(ctx context.Context, userID int, profileI
 	}
 
 	if hadSuccessfulUpdate {
-		triggerProfileRefresh(ctx, h.profileStaler, h.profileRefreshRequester, userID, profileID)
+		notifySignalsChanged(ctx, h.signalsNotifier, userID, profileID)
 		for i, item := range updates {
 			if item.CheckAccess && results[i].Status != "ok" {
 				continue
diff --git a/internal/api/handlers/ratings.go b/internal/api/handlers/ratings.go
index 65dc390fe8..ec3b3c8f44 100644
--- a/internal/api/handlers/ratings.go
+++ b/internal/api/handlers/ratings.go
@@ -30,11 +30,10 @@ type LocalRatingEventDispatcher interface {
 
 // RatingsHandler handles user rating operations.
 type RatingsHandler struct {
-	ratingsRepo             ratingsRepository
-	itemRepo                personalDataItemRepository
-	profileStaler           ProfileStaler
-	profileRefreshRequester ProfileRefreshRequester
-	ratingDispatcher        LocalRatingEventDispatcher
+	ratingsRepo      ratingsRepository
+	itemRepo         personalDataItemRepository
+	signalsNotifier  SignalsChangedNotifier
+	ratingDispatcher LocalRatingEventDispatcher
 }
 
 // NewRatingsHandler creates a new RatingsHandler.
@@ -42,14 +41,10 @@ func NewRatingsHandler(ratingsRepo ratingsRepository, itemRepo personalDataItemR
 	return &RatingsHandler{ratingsRepo: ratingsRepo, itemRepo: itemRepo}
 }
 
-// SetProfileStaler configures an optional staleness trigger for taste profiles.
-func (h *RatingsHandler) SetProfileStaler(ps ProfileStaler) {
-	h.profileStaler = ps
-}
-
-// SetProfileRefreshRequester configures an optional background refresh queue for taste profiles.
-func (h *RatingsHandler) SetProfileRefreshRequester(requester ProfileRefreshRequester) {
-	h.profileRefreshRequester = requester
+// SetSignalsChangedNotifier configures where changes to a profile's
+// recommendation signals are reported. Without it they are not reported.
+func (h *RatingsHandler) SetSignalsChangedNotifier(notifier SignalsChangedNotifier) {
+	h.signalsNotifier = notifier
 }
 
 // SetLocalRatingEventDispatcher configures where rating changes are sent for
@@ -58,10 +53,6 @@ func (h *RatingsHandler) SetLocalRatingEventDispatcher(dispatcher LocalRatingEve
 	h.ratingDispatcher = dispatcher
 }
 
-func (h *RatingsHandler) markStale(ctx context.Context, userID int, profileID string) {
-	triggerProfileRefresh(ctx, h.profileStaler, h.profileRefreshRequester, userID, profileID)
-}
-
 func (h *RatingsHandler) dispatchRatingChange(ctx context.Context, userID int, profileID, itemID string) {
 	if h.ratingDispatcher == nil {
 		return
@@ -136,7 +127,7 @@ func (h *RatingsHandler) SetRating(ctx context.Context, userID int, profileID, i
 	if err := h.ratingsRepo.Set(ctx, userID, profileID, itemID, rating); err != nil {
 		return apiError(http.StatusInternalServerError, "internal_error", "Failed to set rating")
 	}
-	h.markStale(ctx, userID, profileID)
+	notifySignalsChanged(ctx, h.signalsNotifier, userID, profileID)
 	h.dispatchRatingChange(ctx, userID, profileID, itemID)
 	return nil
 }
@@ -166,7 +157,7 @@ func (h *RatingsHandler) DeleteRating(ctx context.Context, userID int, profileID
 	if err := h.ratingsRepo.Delete(ctx, userID, profileID, itemID); err != nil {
 		return apiError(http.StatusInternalServerError, "internal_error", "Failed to delete rating")
 	}
-	h.markStale(ctx, userID, profileID)
+	notifySignalsChanged(ctx, h.signalsNotifier, userID, profileID)
 	h.dispatchRatingChange(ctx, userID, profileID, itemID)
 	return nil
 }
diff --git a/internal/api/handlers/recommendation_scope.go b/internal/api/handlers/recommendation_scope.go
new file mode 100644
index 0000000000..9567cfaa76
--- /dev/null
+++ b/internal/api/handlers/recommendation_scope.go
@@ -0,0 +1,55 @@
+package handlers
+
+import (
+	"context"
+
+	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/settingskeys"
+)
+
+// Cached recommendation rows are built under a profile's access scope and
+// only filtered by it when read, so rows built under an older, wider scope
+// come back thin and rows built under a narrower one miss titles. The writes
+// that change a scope tell the recommendations worker, which rebuilds the
+// affected profiles: a profile's own change is rebuilt now
+// (SignalsChangedNotifier), and an account-wide one is marked stale for the
+// stale sweep (AccountsScopeNotifier), since an access group can hold many
+// accounts.
+
+// AccountsScopeNotifier is told when the access scope of every profile on
+// some accounts changed: an account's libraries or access group, or the
+// libraries of its access group. *recommendations.Worker implements it.
+type AccountsScopeNotifier interface {
+	NotifyAccountsScopeChanged(ctx context.Context, userIDs []int)
+}
+
+func notifyAccountsScopeChanged(ctx context.Context, notifier AccountsScopeNotifier, userIDs ...int) {
+	if notifier != nil && len(userIDs) > 0 {
+		notifier.NotifyAccountsScopeChanged(ctx, userIDs)
+	}
+}
+
+// notifyScopeSettingChanged tells notifier when a written setting is part of
+// the profile's access scope: its hidden libraries.
+func notifyScopeSettingChanged(ctx context.Context, notifier SignalsChangedNotifier, userID int, profileID, key string) {
+	if key == settingskeys.UiDisabledLibraryIds && profileID != "" {
+		notifySignalsChanged(ctx, notifier, userID, profileID)
+	}
+}
+
+// profileScopeSet reports whether an update sets any field of the profile's
+// access scope: its maturity limits or its library restrictions. A value
+// equal to the stored one counts too: the stored profile is read outside the
+// update's writer lock, where an overlapping update can change it, and a
+// rebuild of one profile is cheap.
+func profileScopeSet(req ProfileUpdateRequest) bool {
+	return req.MaxContentRating != nil || req.MaxAdvisoryAge != nil || req.RequireAdvisoryAge != nil ||
+		req.LibraryRestrictionsEnabled != nil || req.AllowedLibraryIDs != nil
+}
+
+// accountScopeChanged reports whether an account update can change its
+// profiles' access scope: its libraries, its access group, or its role, which
+// decides whether an access group applies.
+func accountScopeChanged(input models.UpdateUserInput) bool {
+	return input.LibraryIDs.Set || input.AccessGroupID.Set || input.Role != nil
+}
diff --git a/internal/api/handlers/recommendation_scope_test.go b/internal/api/handlers/recommendation_scope_test.go
new file mode 100644
index 0000000000..ffdc219921
--- /dev/null
+++ b/internal/api/handlers/recommendation_scope_test.go
@@ -0,0 +1,213 @@
+package handlers
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"slices"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/access"
+	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/settingskeys"
+	"github.com/prairie-server/prairie-server/internal/userstore"
+)
+
+func TestProfileScopeSet(t *testing.T) {
+	str := func(v string) *string { return &v }
+	num := func(v int) *int { return &v }
+	flag := func(v bool) *bool { return &v }
+	ids := func(v ...int) *[]int { return &v }
+	for _, tc := range []struct {
+		name string
+		req  ProfileUpdateRequest
+		want bool
+	}{
+		{"name only", ProfileUpdateRequest{Name: str("Kid")}, false},
+		{"same values sent back", ProfileUpdateRequest{MaxContentRating: str("PG"), MaxAdvisoryAge: num(10), LibraryRestrictionsEnabled: flag(true), AllowedLibraryIDs: ids(5, 2)}, true},
+		{"rating ceiling", ProfileUpdateRequest{MaxContentRating: str("PG-13")}, true},
+		{"advisory age", ProfileUpdateRequest{MaxAdvisoryAge: num(0)}, true},
+		{"require advisory age", ProfileUpdateRequest{RequireAdvisoryAge: flag(true)}, true},
+		{"restrictions off", ProfileUpdateRequest{LibraryRestrictionsEnabled: flag(false)}, true},
+		{"allowed libraries", ProfileUpdateRequest{AllowedLibraryIDs: ids(2)}, true},
+	} {
+		if got := profileScopeSet(tc.req); got != tc.want {
+			t.Errorf("%s: set = %v, want %v", tc.name, got, tc.want)
+		}
+	}
+}
+
+func TestAccountScopeChanged(t *testing.T) {
+	role := models.RoleUser
+	email := "a@example.com"
+	if accountScopeChanged(models.UpdateUserInput{Email: &email}) {
+		t.Fatal("an email change does not change access scope")
+	}
+	for _, input := range []models.UpdateUserInput{
+		{LibraryIDs: models.SetValue([]int{1})},
+		{AccessGroupID: models.Optional[int64]{Set: true}},
+		{Role: &role},
+	} {
+		if !accountScopeChanged(input) {
+			t.Fatalf("input %+v changes access scope", input)
+		}
+	}
+}
+
+type recordingScopeNotifier struct {
+	profiles []string
+	accounts [][]int
+}
+
+func (n *recordingScopeNotifier) NotifySignalsChanged(_ context.Context, _ int, profileID string) {
+	n.profiles = append(n.profiles, profileID)
+}
+
+func (n *recordingScopeNotifier) NotifyAccountsScopeChanged(_ context.Context, userIDs []int) {
+	n.accounts = append(n.accounts, userIDs)
+}
+
+func TestHiddenLibrariesSettingRebuildsTheProfile(t *testing.T) {
+	n := &recordingScopeNotifier{}
+	notifyScopeSettingChanged(t.Context(), n, 7, "p1", settingskeys.UiDisabledLibraryIds)
+	notifyScopeSettingChanged(t.Context(), n, 7, "p1", settingskeys.UiLibraryOrder)
+	if !slices.Equal(n.profiles, []string{"p1"}) {
+		t.Fatalf("rebuilt %v, want p1 once, for the hidden-libraries key only", n.profiles)
+	}
+}
+
+// fakeGroupStore is an access group store whose group 3 has members 11 and
+// 12 and libraries [1 2].
+type fakeGroupStore struct {
+	AccessGroupStore
+	deleted bool
+}
+
+func (f *fakeGroupStore) Get(context.Context, int64) (*access.Group, error) {
+	return &access.Group{ID: 3, LibraryIDs: []int{1, 2}}, nil
+}
+
+func (f *fakeGroupStore) ListPage(context.Context, *access.GroupPageKey, int) ([]access.Group, bool, error) {
+	return nil, false, nil
+}
+
+func (f *fakeGroupStore) UpdateConditional(_ context.Context, id int64, _ access.UpdateGroupInput, _ access.GroupPrecondition) (*access.Group, error) {
+	return &access.Group{ID: id}, nil
+}
+
+func (f *fakeGroupStore) DeleteConditional(context.Context, int64, access.GroupPrecondition) error {
+	return nil
+}
+
+func (f *fakeGroupStore) DeleteMovingMembers(context.Context, int64, access.GroupPrecondition) error {
+	f.deleted = true
+	return nil
+}
+
+func (f *fakeGroupStore) MemberIDs(context.Context, int64) ([]int, error) {
+	if f.deleted {
+		return nil, nil // the delete moved them out
+	}
+	return []int{11, 12}, nil
+}
+
+// An update that sets an access group's libraries, or its deletion, rebuilds
+// its members' recommendations; other group edits do not. A save of the same
+// libraries rebuilds too: the stored set could only be compared outside the
+// update's writer lock, where an overlapping update can change it.
+func TestAccessGroupLibraryChangesRebuildMembers(t *testing.T) {
+	ctx := t.Context()
+	guard := access.GroupPrecondition{Any: true}
+	libs := func(v ...int) *[]int { return &v }
+	name := "Renamed"
+
+	for _, tc := range []struct {
+		name  string
+		input access.UpdateGroupInput
+		want  int
+	}{
+		{"name only", access.UpdateGroupInput{Name: &name}, 0},
+		{"same libraries", access.UpdateGroupInput{LibraryIDs: libs(2, 1)}, 1},
+		{"new libraries", access.UpdateGroupInput{LibraryIDs: libs(1)}, 1},
+	} {
+		n := &recordingScopeNotifier{}
+		h := NewAccessGroupHandler(&fakeGroupStore{})
+		h.RecWorker = n
+		if _, err := h.UpdateAdminAccessGroup(ctx, 3, tc.input, guard); err != nil {
+			t.Fatal(err)
+		}
+		if len(n.accounts) != tc.want {
+			t.Fatalf("%s: notified %v, want %d notices", tc.name, n.accounts, tc.want)
+		}
+		if tc.want == 1 && !slices.Equal(n.accounts[0], []int{11, 12}) {
+			t.Fatalf("%s: notified %v, want the members [11 12]", tc.name, n.accounts[0])
+		}
+	}
+
+	n := &recordingScopeNotifier{}
+	h := NewAccessGroupHandler(&fakeGroupStore{})
+	h.RecWorker = n
+	if err := h.DeleteAdminAccessGroup(ctx, 3, guard); err != nil {
+		t.Fatal(err)
+	}
+	if len(n.accounts) != 1 || !slices.Equal(n.accounts[0], []int{11, 12}) {
+		t.Fatalf("delete notified %v, want the members listed before the delete", n.accounts)
+	}
+}
+
+// A profile update that sets the profile's restrictions rebuilds its
+// recommendations, even when it sends the stored value back; one that sets
+// only other fields does not.
+func TestProfileRestrictionChangeRebuildsRecommendations(t *testing.T) {
+	store := newProfileTestStore(t)
+	if err := store.CreateProfile(context.Background(), userstore.Profile{ID: "kid", Name: "Kid", MaxContentRating: "PG"}); err != nil {
+		t.Fatal(err)
+	}
+	n := &recordingScopeNotifier{}
+	h := NewProfileHandler(testUserStoreProvider{store: store})
+	h.RecWorker = n
+	// profile-1 is the household primary; the update acts as it.
+	update := func(req ProfileUpdateRequest) {
+		t.Helper()
+		if _, err := h.UpdateProfile(profileServiceContext("profile-1"), ProfileUpdateCommand{
+			UserID: 1, ProfileID: "kid", ActiveProfileID: "profile-1", Request: req, VerifyProfile: noProfileVerification,
+		}); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	name := "Kiddo"
+	update(ProfileUpdateRequest{Name: &name})
+	if len(n.profiles) != 0 {
+		t.Fatalf("a name change rebuilt %v", n.profiles)
+	}
+	same, lower := "PG", "G"
+	update(ProfileUpdateRequest{MaxContentRating: &same})
+	update(ProfileUpdateRequest{MaxContentRating: &lower})
+	if !slices.Equal(n.profiles, []string{"kid", "kid"}) {
+		t.Fatalf("rebuilt %v, want kid for each update that set its ceiling", n.profiles)
+	}
+}
+
+// Deleting a profile purges its recommendation rows through the purger the
+// SQLite user store relies on, since its delete cannot reach Postgres.
+func TestDeleteProfilePurgesRecommendations(t *testing.T) {
+	store := newProfileTestStore(t)
+	if err := store.CreateProfile(context.Background(), userstore.Profile{ID: "profile-2", Name: "Kids"}); err != nil {
+		t.Fatal(err)
+	}
+	h := NewProfileHandler(testUserStoreProvider{store: store})
+	purger := &recordingProfilePurger{}
+	h.RecommendationsPurger = purger
+
+	req := newAuthorizedProfileRequestWithRole(http.MethodDelete, "/profiles/profile-2", "", "user", "profile-1")
+	rr := httptest.NewRecorder()
+	h.HandleDeleteProfile(rr, withProfileRouteParam(req, "id", "profile-2"))
+
+	if rr.Code != http.StatusNoContent {
+		t.Fatalf("status = %d, body = %s", rr.Code, rr.Body.String())
+	}
+	if !slices.Equal(purger.calls, []string{"1/profile-2"}) {
+		t.Fatalf("purge calls = %v, want one for profile-2", purger.calls)
+	}
+}
diff --git a/internal/api/handlers/recommendations.go b/internal/api/handlers/recommendations.go
index d5ecedd181..7ece4c40ac 100644
--- a/internal/api/handlers/recommendations.go
+++ b/internal/api/handlers/recommendations.go
@@ -3,7 +3,9 @@ package handlers
 import (
 	"context"
 	"log/slog"
+	"maps"
 	"net/http"
+	"slices"
 	"sort"
 	"strconv"
 	"strings"
@@ -13,6 +15,7 @@ import (
 
 	apimw "github.com/prairie-server/prairie-server/internal/api/middleware"
 	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/imagesize"
 	"github.com/prairie-server/prairie-server/internal/models"
 	"github.com/prairie-server/prairie-server/internal/recommendations"
 	"github.com/prairie-server/prairie-server/internal/sections"
@@ -20,11 +23,17 @@ import (
 )
 
 type recommendationsEngine interface {
-	SimilarItems(ctx context.Context, itemID string, limit int) ([]recommendations.ScoredItem, error)
-	BecauseYouWatched(ctx context.Context, userID int, profileID string, sourceItemID string, limit int) ([]recommendations.ScoredItem, error)
+	SimilarItems(ctx context.Context, userID int, profileID, itemID string, limit int, filter catalog.AccessFilter) ([]recommendations.ScoredItem, error)
+	BecauseYouWatched(ctx context.Context, userID int, profileID string, sourceItemID string, limit int, filter catalog.AccessFilter) ([]recommendations.ScoredItem, error)
 	GetTasteProfileSummary(ctx context.Context, userID int, profileID string) (*recommendations.TasteProfileSummary, error)
 }
 
+// accessibleItemIDFilter keeps the item IDs an access filter admits.
+// *recommendations.Repo implements it.
+type accessibleItemIDFilter interface {
+	FilterAccessibleItemIDs(ctx context.Context, itemIDs []string, filter catalog.AccessFilter) (map[string]struct{}, error)
+}
+
 type recommendationsReader interface {
 	GetForYouMain(ctx context.Context, userID int, profileID string, limit int, filter catalog.AccessFilter) (*recommendations.ForYouRow, error)
 	GetForYouRows(ctx context.Context, userID int, profileID string, limit int, filter catalog.AccessFilter) ([]recommendations.ForYouRow, error)
@@ -36,11 +45,17 @@ type recommendationsReader interface {
 
 // RecommendationsHandler handles recommendation API endpoints.
 type RecommendationsHandler struct {
-	engine              recommendationsEngine
-	reader              recommendationsReader
-	storeProvider       userstore.UserStoreProvider
-	ratingsRepo         *catalog.RatingsRepo
-	recsRepo            *recommendations.Repo
+	engine        recommendationsEngine
+	reader        recommendationsReader
+	storeProvider userstore.UserStoreProvider
+	ratingsRepo   *catalog.RatingsRepo
+	recsRepo      *recommendations.Repo
+	signals       *recommendations.SignalReader // watched set as the reader computes it; nil without recsRepo
+	// exclusionSet returns the canonical titles the profile's built rows
+	// leave out (SignalReader.BuildExclusionSet); nil without recsRepo.
+	exclusionSet        func(ctx context.Context, userID int, profileID string) (map[string]struct{}, error)
+	accessibleIDs       accessibleItemIDFilter
+	cardsRepo           discoverCardsRepo // nil without recsRepo
 	enabled             bool
 	Fetcher             discoverFetcher
 	DetailSvc           discoverPresigner
@@ -49,12 +64,19 @@ type RecommendationsHandler struct {
 	WatchTonightFetcher watchTonightSectionFetcher
 	CastFetcher         cardsCastFetcher
 	EbookProgress       EbookReaderProgressLister
-	// RecWorker enqueues asynchronous taste-profile refreshes after writes
-	// (taste seeding). Optional — when nil, refresh is simply skipped.
-	RecWorker ProfileRefreshRequester
+	// RecWorker refreshes the profile when taste seeding adds favorites.
+	// Optional: when nil, nothing is rebuilt until the next scheduled job.
+	RecWorker TasteSeedRefresher
 	nowFn     func() time.Time
 }
 
+// TasteSeedRefresher rebuilds a profile's taste profile and cached rows right
+// after its taste-seed picks are stored, waiting a few seconds for the result
+// so the client's next read shows it. *recommendations.Worker implements it.
+type TasteSeedRefresher interface {
+	RefreshProfileNow(ctx context.Context, userID int, profileID string) bool
+}
+
 type discoverFetcher interface {
 	FetchItemsByContentIDs(ctx context.Context, contentIDs []string, filter catalog.AccessFilter) ([]*models.MediaItem, error)
 	FetchEpisodesByContentIDs(ctx context.Context, contentIDs []string, filter catalog.AccessFilter) ([]*models.MediaItem, map[string]sections.SectionItemMeta, error)
@@ -63,11 +85,27 @@ type discoverFetcher interface {
 
 type discoverPresigner interface {
 	PresignURL(ctx context.Context, path string, variant string) string
+	PresignURLsWithExpiry(ctx context.Context, paths []string, variant string) map[string]catalog.ResolvedImageURL
+}
+
+// featuredCardArtwork resolves recommendation cards' artwork in one batch,
+// keyed by content ID, through the resolver home sections use.
+func (h *RecommendationsHandler) featuredCardArtwork(ctx context.Context, items map[string]*models.MediaItem, art imagesize.Request) map[string]sectionItemImageURLs {
+	if h.DetailSvc == nil || len(items) == 0 {
+		return nil
+	}
+	cards := make([]featuredArtworkCard[string], 0, len(items))
+	for _, id := range slices.Sorted(maps.Keys(items)) {
+		if mi := items[id]; mi != nil {
+			cards = append(cards, featuredArtworkCard[string]{key: mi.ContentID, item: mi})
+		}
+	}
+	return resolveFeaturedArtwork(ctx, h.DetailSvc, cards, art)
 }
 
 // NewRecommendationsHandler creates a new RecommendationsHandler.
 func NewRecommendationsHandler(engine recommendationsEngine, reader recommendationsReader, storeProvider userstore.UserStoreProvider, ratingsRepo *catalog.RatingsRepo, recsRepo *recommendations.Repo, enabled bool) *RecommendationsHandler {
-	return &RecommendationsHandler{
+	h := &RecommendationsHandler{
 		engine:        engine,
 		reader:        reader,
 		storeProvider: storeProvider,
@@ -76,6 +114,19 @@ func NewRecommendationsHandler(engine recommendationsEngine, reader recommendati
 		enabled:       enabled,
 		nowFn:         time.Now,
 	}
+	if recsRepo != nil {
+		h.signals = recommendations.NewSignalReader(recsRepo, storeProvider)
+		h.exclusionSet = func(ctx context.Context, userID int, profileID string) (map[string]struct{}, error) {
+			// A nil *RatingsRepo in the interface would be called; pass none.
+			if ratingsRepo == nil {
+				return h.signals.BuildExclusionSet(ctx, nil, userID, profileID, h.nowFn())
+			}
+			return h.signals.BuildExclusionSet(ctx, ratingsRepo, userID, profileID, h.nowFn())
+		}
+		h.accessibleIDs = recsRepo
+		h.cardsRepo = recsRepo
+	}
+	return h
 }
 
 // --- Response types ---
@@ -125,7 +176,11 @@ func (h *RecommendationsHandler) HandleSimilar(w http.ResponseWriter, r *http.Re
 		limit = 50
 	}
 
-	items, err := h.SimilarItems(r.Context(), itemID, limit)
+	filter := requestAccessFilter(r)
+	items, err := h.SimilarItems(r.Context(), apimw.GetUserID(r.Context()), apimw.GetProfileID(r.Context()), itemID, limit, filter)
+	if err == nil {
+		items, err = h.keepAccessible(r.Context(), items, filter)
+	}
 	if err != nil {
 		writeAPIError(w, err)
 		return
@@ -175,12 +230,20 @@ func (h *RecommendationsHandler) hydrateScoredCards(
 		return nil
 	}
 
-	return h.buildSectionItems(r.Context(), items, enrichment, nil)
+	artwork := h.featuredCardArtwork(r.Context(), enrichment.items, requestAccessFilter(r).Artwork())
+	return h.buildSectionItems(r.Context(), items, enrichment, nil, artwork)
+}
+
+// v1RecommendationRowLimit keeps a frozen v1 row read at the 20 items a row
+// has always answered there; the reader serves up to 50 for v2.
+func v1RecommendationRowLimit(r *http.Request) int {
+	limit, _ := parsePagination(r)
+	return min(limit, recommendationsDefaultLimit)
 }
 
 // HandleForYouMain handles GET /recommendations/for-you/main.
 func (h *RecommendationsHandler) HandleForYouMain(w http.ResponseWriter, r *http.Request) {
-	limit, _ := parsePagination(r)
+	limit := v1RecommendationRowLimit(r)
 	row, err := h.ForYouMain(r.Context(), apimw.GetUserID(r.Context()), apimw.GetProfileID(r.Context()), limit, requestAccessFilter(r))
 	if err != nil {
 		writeAPIError(w, err)
@@ -191,7 +254,7 @@ func (h *RecommendationsHandler) HandleForYouMain(w http.ResponseWriter, r *http
 
 // HandleForYouRows handles GET /recommendations/for-you/rows.
 func (h *RecommendationsHandler) HandleForYouRows(w http.ResponseWriter, r *http.Request) {
-	limit, _ := parsePagination(r)
+	limit := v1RecommendationRowLimit(r)
 	rows, err := h.ForYouRows(r.Context(), apimw.GetUserID(r.Context()), apimw.GetProfileID(r.Context()), limit, requestAccessFilter(r))
 	if err != nil {
 		writeAPIError(w, err)
@@ -214,7 +277,11 @@ func (h *RecommendationsHandler) HandleBecauseWatched(w http.ResponseWriter, r *
 	}
 
 	limit, _ := parsePagination(r)
-	items, err := h.BecauseWatched(r.Context(), apimw.GetUserID(r.Context()), apimw.GetProfileID(r.Context()), itemID, limit)
+	filter := requestAccessFilter(r)
+	items, err := h.BecauseWatched(r.Context(), apimw.GetUserID(r.Context()), apimw.GetProfileID(r.Context()), itemID, limit, filter)
+	if err == nil {
+		items, err = h.keepAccessible(r.Context(), items, filter)
+	}
 	if err != nil {
 		writeAPIError(w, err)
 		return
@@ -224,7 +291,7 @@ func (h *RecommendationsHandler) HandleBecauseWatched(w http.ResponseWriter, r *
 
 // HandleSimilarUsers handles GET /recommendations/similar-users.
 func (h *RecommendationsHandler) HandleSimilarUsers(w http.ResponseWriter, r *http.Request) {
-	limit, _ := parsePagination(r)
+	limit := v1RecommendationRowLimit(r)
 	items, err := h.SimilarUsersLiked(r.Context(), apimw.GetUserID(r.Context()), apimw.GetProfileID(r.Context()), limit, requestAccessFilter(r))
 	if err != nil {
 		writeAPIError(w, err)
@@ -255,7 +322,7 @@ func (h *RecommendationsHandler) HandlePopular(w http.ResponseWriter, r *http.Re
 		}
 	}
 
-	items, err := h.PopularItems(r.Context(), apimw.GetUserID(r.Context()), apimw.GetProfileID(r.Context()), days, limit)
+	items, err := h.PopularItems(r.Context(), apimw.GetUserID(r.Context()), apimw.GetProfileID(r.Context()), days, limit, requestAccessFilter(r))
 	if err != nil {
 		writeAPIError(w, err)
 		return
@@ -279,7 +346,7 @@ func (h *RecommendationsHandler) HandleRecentlyAdded(w http.ResponseWriter, r *h
 		}
 	}
 
-	items, err := h.RecentlyAddedItems(r.Context(), apimw.GetUserID(r.Context()), apimw.GetProfileID(r.Context()), days, limit)
+	items, err := h.RecentlyAddedItems(r.Context(), apimw.GetUserID(r.Context()), apimw.GetProfileID(r.Context()), days, limit, requestAccessFilter(r))
 	if err != nil {
 		writeAPIError(w, err)
 		return
@@ -287,18 +354,23 @@ func (h *RecommendationsHandler) HandleRecentlyAdded(w http.ResponseWriter, r *h
 	writeJSON(w, http.StatusOK, scoredItemsResponse{Items: items})
 }
 
-// filterRecommendations removes watched items and low-rated items from the list.
+// filterRecommendations removes watched, marked Not interested and rated items
+// from the list.
 func (h *RecommendationsHandler) filterRecommendations(ctx context.Context, userID int, profileID string, items []recommendations.ScoredItem) []recommendations.ScoredItem {
 	items = h.excludeWatchedRecommendations(ctx, userID, profileID, items)
-	return h.excludeLowRatedRecommendations(ctx, userID, profileID, items)
+	return h.excludeRatedRecommendations(ctx, userID, profileID, items)
 }
 
 func (h *RecommendationsHandler) excludeWatchedRecommendations(ctx context.Context, userID int, profileID string, items []recommendations.ScoredItem) []recommendations.ScoredItem {
 	if len(items) == 0 {
 		return items
 	}
-	watchedSet, err := h.watchedItemIDSet(ctx, userID, profileID)
-	if err != nil || len(watchedSet) == 0 {
+	watchedSet, err := h.skippedItemIDSet(ctx, userID, profileID)
+	if err != nil {
+		slog.WarnContext(ctx, "loading the watched set failed; recommendations are not filtered for it", "component", "api", "user_id", userID, "profile_id", profileID, "error", err)
+		return items
+	}
+	if len(watchedSet) == 0 {
 		return items
 	}
 
@@ -312,25 +384,43 @@ func (h *RecommendationsHandler) excludeWatchedRecommendations(ctx context.Conte
 	return filtered
 }
 
+// watchedItemIDSet is SignalReader.WatchedItemIDSet, or an empty set when the
+// handler has no recommendations repo.
 func (h *RecommendationsHandler) watchedItemIDSet(ctx context.Context, userID int, profileID string) (map[string]struct{}, error) {
-	if h.recsRepo == nil {
+	if h.signals == nil {
 		return map[string]struct{}{}, nil
 	}
+	return h.signals.WatchedItemIDSet(ctx, userID, profileID)
+}
 
-	if h.storeProvider != nil {
-		store, err := h.storeProvider.ForUser(ctx, userID)
-		if err == nil && store != nil {
-			set, err := h.recsRepo.GetWatchedItemIDSetFromStore(ctx, store, profileID)
-			if err == nil {
-				return set, nil
-			}
-		}
+// skippedItemIDSet is the titles a live recommendation list leaves out for the
+// profile: its watched set and the titles it marked Not interested. The
+// watched set may be shared (see recommendations.WithWatchedSetMemo), so a
+// profile with marks gets a copy. Marks that cannot be read are logged and
+// left out, so a failed read never also undoes the watched filter.
+func (h *RecommendationsHandler) skippedItemIDSet(ctx context.Context, userID int, profileID string) (map[string]struct{}, error) {
+	watched, err := h.watchedItemIDSet(ctx, userID, profileID)
+	if err != nil || h.signals == nil {
+		return watched, err
+	}
+	marks, err := h.signals.NotInterestedMarks(ctx, userID, profileID)
+	if err != nil {
+		slog.WarnContext(ctx, "loading Not interested marks failed; live recommendations are not filtered for them", "component", "api", "user_id", userID, "profile_id", profileID, "error", err)
+		return watched, nil
 	}
-
-	return h.recsRepo.GetWatchedItemIDSet(ctx, userID, profileID)
+	if len(marks) == 0 {
+		return watched, nil
+	}
+	skipped := maps.Clone(watched)
+	for _, m := range marks {
+		skipped[m.MediaItemID] = struct{}{}
+	}
+	return skipped, nil
 }
 
-func (h *RecommendationsHandler) excludeLowRatedRecommendations(ctx context.Context, userID int, profileID string, items []recommendations.ScoredItem) []recommendations.ScoredItem {
+// excludeRatedRecommendations drops every title the profile rated, as the
+// recommendation rows do.
+func (h *RecommendationsHandler) excludeRatedRecommendations(ctx context.Context, userID int, profileID string, items []recommendations.ScoredItem) []recommendations.ScoredItem {
 	if len(items) == 0 || h.ratingsRepo == nil {
 		return items
 	}
@@ -347,7 +437,7 @@ func (h *RecommendationsHandler) excludeLowRatedRecommendations(ctx context.Cont
 
 	filtered := make([]recommendations.ScoredItem, 0, len(items))
 	for _, item := range items {
-		if rating, ok := ratings[item.MediaItemID]; ok && rating <= 2 {
+		if _, rated := ratings[item.MediaItemID]; rated {
 			continue
 		}
 		filtered = append(filtered, item)
@@ -380,7 +470,7 @@ type sectionDetailResponse struct {
 const (
 	discoverForYouMaxItems     = 28
 	discoverUpcomingWindowDays = 14
-	discoverForYouLabel        = "For You"
+	discoverForYouLabel        = recommendations.ForYouLabel
 	sectionDetailDefaultLimit  = recommendations.CacheCandidateLimit
 )
 
@@ -512,6 +602,7 @@ func (h *RecommendationsHandler) buildSectionItems(
 	scoredItems []recommendations.ScoredItem,
 	enrichment *itemEnrichment,
 	upcomingEvents map[string]upcomingEventResponse,
+	artwork map[string]sectionItemImageURLs,
 ) []sectionItemResponse {
 	out := make([]sectionItemResponse, 0, len(scoredItems))
 	for _, scored := range scoredItems {
@@ -544,11 +635,8 @@ func (h *RecommendationsHandler) buildSectionItems(
 		if item.Keywords == nil {
 			item.Keywords = []string{}
 		}
-		if h.DetailSvc != nil {
-			item.PosterURL = h.DetailSvc.PresignURL(ctx, featuredPosterPath(mi.PosterPath), "featured")
-			item.BackdropURL = h.DetailSvc.PresignURL(ctx, featuredBackdropPath(mi.BackdropPath), "featured")
-			item.LogoURL = h.DetailSvc.PresignURL(ctx, mi.LogoPath, "featured")
-		}
+		urls := artwork[mi.ContentID]
+		item.PosterURL, item.BackdropURL, item.LogoURL = urls.posterURL, urls.backdropURL, urls.logoURL
 		if enrichment.overlays != nil {
 			item.OverlaySummary = enrichment.overlays[mi.ContentID]
 		}
@@ -606,12 +694,9 @@ func discoverRowSectionKey(rowType, label string, clusterIndex int) (string, str
 	case recommendations.RecTypeTopRated:
 		return recommendations.SectionKindTopRated, ""
 	case "genre_sampler":
-		// Cold-start labels rows "Top X"; the warm-discover path labels them
-		// "Popular in X". The genre name is always the label suffix.
-		for _, prefix := range []string{"Popular in ", "Top "} {
-			if name, ok := strings.CutPrefix(label, prefix); ok && name != "" {
-				return recommendations.SectionKindGenre, name
-			}
+		// Genre rows are titled "Top <genre>".
+		if name, ok := strings.CutPrefix(label, "Top "); ok && name != "" {
+			return recommendations.SectionKindGenre, name
 		}
 	}
 	return "", ""
@@ -683,7 +768,7 @@ func (h *RecommendationsHandler) blendUpcomingIntoDiscoverRows(
 		}
 	}
 
-	watchedSet, err := h.watchedItemIDSet(ctx, userID, profileID)
+	watchedSet, err := h.skippedItemIDSet(ctx, userID, profileID)
 	if err != nil {
 		return discoverRows, err
 	}
@@ -878,7 +963,7 @@ func rankUpcomingCandidates(
 		if _, watched := watchedSet[candidate.DisplayID]; watched {
 			continue
 		}
-		if rating, rated := lowRatings[candidate.DisplayID]; rated && rating <= 2 {
+		if rating, rated := lowRatings[candidate.DisplayID]; rated && rating <= recommendations.DislikedRatingMax {
 			continue
 		}
 
diff --git a/internal/api/handlers/recommendations_access_test.go b/internal/api/handlers/recommendations_access_test.go
new file mode 100644
index 0000000000..eb1c455a1d
--- /dev/null
+++ b/internal/api/handlers/recommendations_access_test.go
@@ -0,0 +1,288 @@
+package handlers
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/access"
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/recommendations"
+)
+
+// fakeRecsEngine answers a fixed list and records what it was asked.
+type fakeRecsEngine struct {
+	items        []recommendations.ScoredItem
+	similarCalls int
+	becauseCalls int
+	becauseWith  catalog.AccessFilter
+}
+
+func (f *fakeRecsEngine) SimilarItems(context.Context, int, string, string, int, catalog.AccessFilter) ([]recommendations.ScoredItem, error) {
+	f.similarCalls++
+	return f.items, nil
+}
+
+func (f *fakeRecsEngine) BecauseYouWatched(_ context.Context, _ int, _, _ string, _ int, filter catalog.AccessFilter) ([]recommendations.ScoredItem, error) {
+	f.becauseCalls++
+	f.becauseWith = filter
+	return f.items, nil
+}
+
+func (f *fakeRecsEngine) GetTasteProfileSummary(context.Context, int, string) (*recommendations.TasteProfileSummary, error) {
+	return nil, nil
+}
+
+// fakeAccessibleIDs admits every item outside hidden.
+type fakeAccessibleIDs struct {
+	hidden map[string]struct{}
+	err    error
+}
+
+func (f fakeAccessibleIDs) FilterAccessibleItemIDs(_ context.Context, ids []string, _ catalog.AccessFilter) (map[string]struct{}, error) {
+	if f.err != nil {
+		return nil, f.err
+	}
+	out := make(map[string]struct{}, len(ids))
+	for _, id := range ids {
+		if _, hidden := f.hidden[id]; !hidden {
+			out[id] = struct{}{}
+		}
+	}
+	return out, nil
+}
+
+func scored(ids ...string) []recommendations.ScoredItem {
+	items := make([]recommendations.ScoredItem, len(ids))
+	for i, id := range ids {
+		items[i] = recommendations.ScoredItem{MediaItemID: id, Score: float64(len(ids) - i)}
+	}
+	return items
+}
+
+func scoredIDs(items []recommendations.ScoredItem) []string {
+	ids := make([]string, len(items))
+	for i, item := range items {
+		ids[i] = item.MediaItemID
+	}
+	return ids
+}
+
+// restrictedRecsRequest is a v1 request for the anchored list, made by a
+// profile whose scope allows library 4 only.
+func restrictedRecsRequest(path, itemID string) *http.Request {
+	req := httptest.NewRequest(http.MethodGet, path, nil)
+	rctx := chi.NewRouteContext()
+	rctx.URLParams.Add("item_id", itemID)
+	ctx := authenticatedRecsContext(req.Context(), rctx)
+	ctx = access.SetScope(ctx, access.Scope{UserID: 7, ProfileID: "profile-1", AllowedLibraryIDs: []int{4}, LibrariesRestricted: true})
+	return req.WithContext(ctx)
+}
+
+func decodeScoredItems(t *testing.T, rec *httptest.ResponseRecorder) []string {
+	t.Helper()
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d, body %s", rec.Code, rec.Body.String())
+	}
+	var resp scoredItemsResponse
+	if err := json.Unmarshal(rec.Body.Bytes(), &resp); err != nil {
+		t.Fatal(err)
+	}
+	if resp.Items == nil {
+		t.Fatal("items must be an array, got null")
+	}
+	return scoredIDs(resp.Items)
+}
+
+// The v1 Similar and Because You Watched lists answer only identifiers the
+// viewer can see, in the engine's order.
+func TestV1AnchoredRecommendationsDropInaccessibleItems(t *testing.T) {
+	for _, tc := range []struct {
+		name   string
+		path   string
+		handle func(*RecommendationsHandler, http.ResponseWriter, *http.Request)
+	}{
+		{"similar", "/recommendations/similar/anchor", (*RecommendationsHandler).HandleSimilar},
+		{"because watched", "/recommendations/because-watched/anchor", (*RecommendationsHandler).HandleBecauseWatched},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			engine := &fakeRecsEngine{items: scored("a", "adult-1", "b", "adult-2", "c")}
+			h := NewRecommendationsHandler(engine, nil, nil, nil, nil, true)
+			h.accessibleIDs = fakeAccessibleIDs{hidden: map[string]struct{}{"adult-1": {}, "adult-2": {}}}
+
+			rec := httptest.NewRecorder()
+			tc.handle(h, rec, restrictedRecsRequest(tc.path, "anchor"))
+			if got := decodeScoredItems(t, rec); !slices.Equal(got, []string{"a", "b", "c"}) {
+				t.Fatalf("items = %v, want [a b c]", got)
+			}
+		})
+	}
+}
+
+// Because You Watched ranks under the viewer's scope, not only filters after.
+func TestBecauseWatchedRanksUnderTheViewerScope(t *testing.T) {
+	engine := &fakeRecsEngine{items: scored("a")}
+	h := NewRecommendationsHandler(engine, nil, nil, nil, nil, true)
+	h.accessibleIDs = fakeAccessibleIDs{}
+
+	rec := httptest.NewRecorder()
+	h.HandleBecauseWatched(rec, restrictedRecsRequest("/recommendations/because-watched/anchor", "anchor"))
+	decodeScoredItems(t, rec)
+	if !slices.Equal(engine.becauseWith.AllowedLibraryIDs, []int{4}) || engine.becauseWith.UserID != 7 || engine.becauseWith.ProfileID != "profile-1" {
+		t.Fatalf("engine filter = %+v, want the request scope", engine.becauseWith)
+	}
+}
+
+// An anchor the viewer cannot see answers what an unknown anchor answers: an
+// empty list, without running the engine, on v1 and on the v2 seams.
+func TestInaccessibleAnchorAnswersLikeAnUnknownOne(t *testing.T) {
+	engine := &fakeRecsEngine{items: scored("a", "b")}
+	h := NewRecommendationsHandler(engine, nil, nil, nil, nil, true)
+	h.accessibleIDs = fakeAccessibleIDs{hidden: map[string]struct{}{"hidden-anchor": {}}}
+
+	for _, tc := range []struct {
+		name   string
+		path   string
+		handle func(*RecommendationsHandler, http.ResponseWriter, *http.Request)
+	}{
+		{"v1 similar", "/recommendations/similar/hidden-anchor", (*RecommendationsHandler).HandleSimilar},
+		{"v1 because watched", "/recommendations/because-watched/hidden-anchor", (*RecommendationsHandler).HandleBecauseWatched},
+	} {
+		rec := httptest.NewRecorder()
+		tc.handle(h, rec, restrictedRecsRequest(tc.path, "hidden-anchor"))
+		if got := decodeScoredItems(t, rec); len(got) != 0 {
+			t.Fatalf("%s: items = %v, want none", tc.name, got)
+		}
+	}
+
+	filter := catalog.AccessFilter{UserID: 7, ProfileID: "profile-1"}
+	h.Fetcher = stubDiscoverFetcher{}
+	similar, err := h.SimilarCards(t.Context(), 7, "profile-1", "hidden-anchor", 10, filter)
+	if err != nil || len(similar) != 0 {
+		t.Fatalf("v2 similar = %v, %v; want none", similar, err)
+	}
+	because, err := h.BecauseWatchedCards(t.Context(), 7, "profile-1", "hidden-anchor", 10, filter)
+	if err != nil || len(because) != 0 {
+		t.Fatalf("v2 because watched = %v, %v; want none", because, err)
+	}
+	if engine.similarCalls != 0 || engine.becauseCalls != 0 {
+		t.Fatalf("engine ran %d similar and %d because-watched reads for a hidden anchor", engine.similarCalls, engine.becauseCalls)
+	}
+}
+
+func TestKeepAccessible(t *testing.T) {
+	h := &RecommendationsHandler{accessibleIDs: fakeAccessibleIDs{hidden: map[string]struct{}{"x": {}}}}
+	got, err := h.keepAccessible(t.Context(), scored("c", "x", "a", "b"), catalog.AccessFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if ids := scoredIDs(got); !slices.Equal(ids, []string{"c", "a", "b"}) {
+		t.Fatalf("kept = %v, want [c a b] in the given order", ids)
+	}
+
+	// A failed check is an error, never the unfiltered list.
+	h.accessibleIDs = fakeAccessibleIDs{err: errors.New("db down")}
+	if _, err := h.keepAccessible(t.Context(), scored("a"), catalog.AccessFilter{}); err == nil {
+		t.Fatal("keepAccessible answered without its access check")
+	} else {
+		var apiErr *APIError
+		if !errors.As(err, &apiErr) || apiErr.Status != http.StatusInternalServerError {
+			t.Fatalf("err = %v, want a 500 API error", err)
+		}
+	}
+
+	// With no access check wired, nothing is shown.
+	h.accessibleIDs = nil
+	if got, err := h.keepAccessible(t.Context(), scored("a"), catalog.AccessFilter{}); err != nil || len(got) != 0 {
+		t.Fatalf("unwired keepAccessible = %v, %v; want none", got, err)
+	}
+}
+
+// The v1 Recently Added list, which reads the server-wide query, answers only
+// the titles the viewer's libraries hold, newest first.
+func TestV1RecentlyAddedDropsInaccessibleItemsPostgres(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	pool, err := pgxpool.New(t.Context(), dsn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(pool.Close)
+	exec := func(query string, args ...any) {
+		t.Helper()
+		if _, err := pool.Exec(t.Context(), query, args...); err != nil {
+			t.Fatal(err)
+		}
+	}
+	prefix := fmt.Sprintf("v1-recent-access-%d-", time.Now().UnixNano())
+	library := func(name string) int {
+		var id int
+		if err := pool.QueryRow(t.Context(), `INSERT INTO media_folders (type,name) VALUES ('movies',$1) RETURNING id`, prefix+name).Scan(&id); err != nil {
+			t.Fatal(err)
+		}
+		return id
+	}
+	kids, adults := library("kids"), library("adults")
+	t.Cleanup(func() {
+		ctx := context.Background()
+		_, _ = pool.Exec(ctx, `DELETE FROM media_items WHERE content_id LIKE $1`, prefix+"%")
+		_, _ = pool.Exec(ctx, `DELETE FROM media_folders WHERE id = ANY($1)`, []int{kids, adults})
+	})
+	// Created in the future so they lead the server-wide list; newest first
+	// is kids-2, adult-1, kids-1, adult-0, kids-0.
+	var want []string
+	for i, id := range []string{"kids-0", "adult-0", "kids-1", "adult-1", "kids-2"} {
+		lib := kids
+		if strings.HasPrefix(id, "adult") {
+			lib = adults
+		} else {
+			want = append([]string{prefix + id}, want...)
+		}
+		exec(`INSERT INTO media_items (content_id,type,title,status,genres,created_at) VALUES ($1,'movie',$1,'matched','{}',NOW() + make_interval(hours => 1000 + $2))`, prefix+id, i)
+		exec(`INSERT INTO media_item_libraries (content_id,media_folder_id) VALUES ($1,$2)`, prefix+id, lib)
+	}
+
+	h := NewRecommendationsHandler(nil, nil, nil, nil, recommendations.NewRepo(pool), true)
+	req := httptest.NewRequest(http.MethodGet, "/recommendations/recently-added?limit=50", nil)
+	ctx := authenticatedRecsContext(req.Context(), nil)
+	ctx = access.SetScope(ctx, access.Scope{UserID: 7, ProfileID: "profile-1", AllowedLibraryIDs: []int{kids}, LibrariesRestricted: true})
+	rec := httptest.NewRecorder()
+	h.HandleRecentlyAdded(rec, req.WithContext(ctx))
+
+	var got []string
+	for _, id := range decodeScoredItems(t, rec) {
+		if strings.HasPrefix(id, prefix) {
+			got = append(got, id)
+		}
+	}
+	if !slices.Equal(got, want) {
+		t.Fatalf("recently added = %v, want the kids titles newest first %v", got, want)
+	}
+
+	// Hidden titles newer than every visible one do not take the list's
+	// places: it reads past them to fill the limit.
+	for i := range 10 {
+		id := fmt.Sprintf("%snewer-adult-%d", prefix, i)
+		exec(`INSERT INTO media_items (content_id,type,title,status,genres,created_at) VALUES ($1,'movie',$1,'matched','{}',NOW() + make_interval(hours => 2000 + $2))`, id, i)
+		exec(`INSERT INTO media_item_libraries (content_id,media_folder_id) VALUES ($1,$2)`, id, adults)
+	}
+	req = httptest.NewRequest(http.MethodGet, "/recommendations/recently-added?limit=2", nil)
+	rec = httptest.NewRecorder()
+	h.HandleRecentlyAdded(rec, req.WithContext(ctx))
+	if got := decodeScoredItems(t, rec); !slices.Equal(got, want[:2]) {
+		t.Fatalf("recently added with limit 2 = %v, want %v", got, want[:2])
+	}
+}
diff --git a/internal/api/handlers/recommendations_defaults_test.go b/internal/api/handlers/recommendations_defaults_test.go
new file mode 100644
index 0000000000..b89f2efe5d
--- /dev/null
+++ b/internal/api/handlers/recommendations_defaults_test.go
@@ -0,0 +1,37 @@
+package handlers
+
+import (
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/recommendations"
+)
+
+// With recommendations disabled (no engine), Discover still answers the
+// reader's rows, so the default rows show, and each links to its live
+// section page.
+func TestDiscoverServesDefaultRowsWithRecommendationsDisabled(t *testing.T) {
+	t.Parallel()
+
+	handler := NewRecommendationsHandler(nil, stubRecommendationsReader{
+		discoverRows: []recommendations.ForYouRow{
+			{Type: recommendations.RecTypeTopRated, Label: "Highly Rated in Your Library", Items: []recommendations.ScoredItem{{MediaItemID: "movie-1"}}},
+			{Type: recommendations.RecTypeRecentlyAdded, Label: "Recently Added", Items: []recommendations.ScoredItem{{MediaItemID: "movie-1"}}},
+		},
+	}, nil, nil, nil, false)
+	handler.Fetcher = stubDiscoverFetcher{items: []*models.MediaItem{{ContentID: "movie-1", Type: "movie", Title: "Movie One", Status: "matched"}}}
+
+	view, err := handler.Discover(t.Context(), 7, "profile-1", catalog.AccessFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(view.Rows) != 2 {
+		t.Fatalf("rows = %+v, want both default rows", view.Rows)
+	}
+	for i, want := range []string{recommendations.SectionKindTopRated, recommendations.SectionKindRecentlyAdded} {
+		if view.Rows[i].SectionKind != want || len(view.Rows[i].Items) != 1 {
+			t.Fatalf("row %d = %+v, want kind %q with its card", i, view.Rows[i], want)
+		}
+	}
+}
diff --git a/internal/api/handlers/recommendations_limit_test.go b/internal/api/handlers/recommendations_limit_test.go
new file mode 100644
index 0000000000..4cd0fe8b38
--- /dev/null
+++ b/internal/api/handlers/recommendations_limit_test.go
@@ -0,0 +1,92 @@
+package handlers
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/recommendations"
+	"github.com/prairie-server/prairie-server/internal/userstore"
+)
+
+// limitRecordingReader records the limit each row read was asked for.
+type limitRecordingReader struct {
+	stubRecommendationsReader
+	limits []int
+}
+
+func (r *limitRecordingReader) GetForYouMain(_ context.Context, _ int, _ string, limit int, _ catalog.AccessFilter) (*recommendations.ForYouRow, error) {
+	r.limits = append(r.limits, limit)
+	return nil, nil
+}
+
+func (r *limitRecordingReader) GetForYouRows(_ context.Context, _ int, _ string, limit int, _ catalog.AccessFilter) ([]recommendations.ForYouRow, error) {
+	r.limits = append(r.limits, limit)
+	return nil, nil
+}
+
+func (r *limitRecordingReader) GetSimilarUsersLiked(_ context.Context, _ int, _ string, limit int, _ catalog.AccessFilter) ([]recommendations.ScoredItem, error) {
+	r.limits = append(r.limits, limit)
+	return nil, nil
+}
+
+// The frozen v1 row reads keep answering at most 20 items per row, the
+// most the reader served before it allowed v2's 50; the shared service
+// passes a v2 limit through.
+func TestV1RecommendationRowReadsKeepTheirTwentyItemCap(t *testing.T) {
+	reader := &limitRecordingReader{}
+	h := NewRecommendationsHandler(nil, reader, nil, nil, nil, false)
+	for _, handle := range []http.HandlerFunc{h.HandleForYouMain, h.HandleForYouRows, h.HandleSimilarUsers} {
+		for _, tc := range []struct {
+			query string
+			want  int
+		}{{"", 20}, {"?limit=50", 20}, {"?limit=5", 5}} {
+			reader.limits = nil
+			req := httptest.NewRequest(http.MethodGet, "/recommendations"+tc.query, nil)
+			req = req.WithContext(authenticatedRecsContext(req.Context(), nil))
+			rec := httptest.NewRecorder()
+			handle(rec, req)
+			if rec.Code != http.StatusOK || len(reader.limits) != 1 || reader.limits[0] != tc.want {
+				t.Fatalf("query %q: status %d, reader limits %v; want %d", tc.query, rec.Code, reader.limits, tc.want)
+			}
+		}
+	}
+
+	reader.limits = nil
+	ctx := authenticatedRecsContext(context.Background(), nil)
+	if _, err := h.ForYouMain(ctx, 7, "profile-1", 50, catalog.AccessFilter{}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := h.SimilarUsersLiked(ctx, 7, "profile-1", 50, catalog.AccessFilter{}); err != nil {
+		t.Fatal(err)
+	}
+	if len(reader.limits) != 2 || reader.limits[0] != 50 || reader.limits[1] != 50 {
+		t.Fatalf("service limits = %v, want [50 50]", reader.limits)
+	}
+}
+
+type failingStoreProvider struct{}
+
+func (failingStoreProvider) ForUser(context.Context, int) (userstore.UserStore, error) {
+	return nil, errors.New("user store unavailable")
+}
+
+func (failingStoreProvider) Close() error { return nil }
+
+// A user store failure leaves the list unfiltered instead of answering the
+// watched set from Postgres progress, which a SQLite user store does not
+// keep. The repo has no pool, so a fallback read would panic.
+func TestWatchedFilterDoesNotFallBackToPostgres(t *testing.T) {
+	h := NewRecommendationsHandler(nil, nil, failingStoreProvider{}, nil, recommendations.NewRepo(nil), false)
+	items := []recommendations.ScoredItem{{MediaItemID: "a"}, {MediaItemID: "b"}}
+	got := h.excludeWatchedRecommendations(context.Background(), 7, "profile-1", items)
+	if len(got) != 2 {
+		t.Fatalf("items = %v, want both left in", got)
+	}
+	if _, err := h.watchedItemIDSet(context.Background(), 7, "profile-1"); err == nil {
+		t.Fatal("watched set error was swallowed")
+	}
+}
diff --git a/internal/api/handlers/recommendations_section_test.go b/internal/api/handlers/recommendations_section_test.go
index 6cd3f8b869..f63c224a5e 100644
--- a/internal/api/handlers/recommendations_section_test.go
+++ b/internal/api/handlers/recommendations_section_test.go
@@ -30,12 +30,14 @@ func TestDiscoverRowSectionKey(t *testing.T) {
 		{"for-you main", "cluster", "For You", 0, recommendations.SectionKindForYouMain, ""},
 		{"cluster row", "cluster", "Because you enjoy Drama", 2, recommendations.SectionKindCluster, "2"},
 		{"cluster zero", "cluster", "Because you enjoy Action", 0, recommendations.SectionKindCluster, "0"},
-		{"similar users", "similar_users_liked", "Users Like You Also Enjoyed", 0, recommendations.SectionKindSimilarUsers, ""},
+		{"similar users", "similar_users_liked", "Profiles Like You Enjoyed", 0, recommendations.SectionKindSimilarUsers, ""},
 		{"popular", "popular", "Popular on This Server", 0, recommendations.SectionKindPopular, ""},
 		{"recently added", "recently_added", "Recently Added", 0, recommendations.SectionKindRecentlyAdded, ""},
 		{"top rated", "top_rated", "Top Rated", 0, recommendations.SectionKindTopRated, ""},
-		{"genre warm", "genre_sampler", "Popular in Drama", 0, recommendations.SectionKindGenre, "Drama"},
-		{"genre cold", "genre_sampler", "Top Sci-Fi", 0, recommendations.SectionKindGenre, "Sci-Fi"},
+		{"highly rated", "top_rated", "Highly Rated in Your Library", 0, recommendations.SectionKindTopRated, ""},
+		{"genre", "genre_sampler", "Top Drama", 0, recommendations.SectionKindGenre, "Drama"},
+		{"genre with an ampersand", "genre_sampler", "Top Sci-Fi & Fantasy", 0, recommendations.SectionKindGenre, "Sci-Fi & Fantasy"},
+		{"genre without a name", "genre_sampler", "Top ", 0, "", ""},
 		{"unknown row", "watch_tonight", "Watch Tonight", 0, "", ""},
 	}
 
@@ -78,7 +80,7 @@ func TestRecommendationsHandleSection_ReturnsEnrichedRow(t *testing.T) {
 	handler := NewRecommendationsHandler(nil, stubSectionReader{
 		row: &recommendations.ForYouRow{
 			Type:  "genre_sampler",
-			Label: "Popular in Drama",
+			Label: "Top Drama",
 			Items: []recommendations.ScoredItem{{MediaItemID: "movie-1"}},
 		},
 	}, nil, nil, nil, false)
@@ -115,8 +117,8 @@ func TestRecommendationsHandleSection_ReturnsEnrichedRow(t *testing.T) {
 	if resp.Kind != "genre" || resp.Key != "Drama" {
 		t.Fatalf("kind/key = %q/%q, want genre/Drama", resp.Kind, resp.Key)
 	}
-	if resp.Label != "Popular in Drama" {
-		t.Fatalf("label = %q, want Popular in Drama", resp.Label)
+	if resp.Label != "Top Drama" {
+		t.Fatalf("label = %q, want Top Drama", resp.Label)
 	}
 	if len(resp.Items) != 1 || resp.Items[0].ContentID != "movie-1" {
 		t.Fatalf("items = %+v, want [movie-1]", resp.Items)
diff --git a/internal/api/handlers/recommendations_service.go b/internal/api/handlers/recommendations_service.go
index 85324f0ec1..2acaea2ccc 100644
--- a/internal/api/handlers/recommendations_service.go
+++ b/internal/api/handlers/recommendations_service.go
@@ -38,18 +38,26 @@ func recommendationsUnavailable(message string) *APIError {
 	return apiError(http.StatusInternalServerError, "internal_error", message)
 }
 
-// BecauseWatched answers "because you watched {item}" candidates, minus the
-// profile's watched and low-rated items. An unavailable engine answers an
-// empty list.
-func (h *RecommendationsHandler) BecauseWatched(ctx context.Context, userID int, profileID, itemID string, limit int) ([]recommendations.ScoredItem, error) {
+// BecauseWatched answers "because you watched {item}" candidates the viewer
+// can see, minus the profile's watched and low-rated items. An unavailable
+// engine, and an anchor the viewer cannot see, answer an empty list.
+func (h *RecommendationsHandler) BecauseWatched(ctx context.Context, userID int, profileID, itemID string, limit int, filter catalog.AccessFilter) ([]recommendations.ScoredItem, error) {
 	if h.engineUnavailable() {
 		return []recommendations.ScoredItem{}, nil
 	}
 	if limit <= 0 {
 		limit = recommendationsDefaultLimit
 	}
-	items, err := h.engine.BecauseYouWatched(ctx, userID, profileID, itemID, limit)
+	visible, err := h.anchorVisible(ctx, itemID, filter)
 	if err != nil {
+		return nil, err
+	}
+	if !visible {
+		return []recommendations.ScoredItem{}, nil
+	}
+	items, err := h.engine.BecauseYouWatched(ctx, userID, profileID, itemID, limit, filter)
+	if err != nil {
+		slog.WarnContext(ctx, "BecauseWatched failed", "component", "api", "user_id", userID, "profile_id", profileID, "item_id", itemID, "error", err)
 		return nil, recommendationsUnavailable("Failed to fetch recommendations")
 	}
 	items = h.filterRecommendations(ctx, userID, profileID, items)
@@ -95,30 +103,67 @@ func (h *RecommendationsHandler) ForYouRows(ctx context.Context, userID int, pro
 	return rows, nil
 }
 
-// PopularItems answers the server-wide popular items of the last days,
-// minus what the profile has watched.
-func (h *RecommendationsHandler) PopularItems(ctx context.Context, userID int, profileID string, days, limit int) ([]recommendations.ScoredItem, error) {
-	items, err := h.recsRepo.GetPopularItems(ctx, days, limit)
+// PopularItems answers up to limit of the server-wide popular items of the
+// last days that the viewer can see and the profile has not watched. Unlike
+// the cached Popular row, a title one account watched counts.
+func (h *RecommendationsHandler) PopularItems(ctx context.Context, userID int, profileID string, days, limit int, filter catalog.AccessFilter) ([]recommendations.ScoredItem, error) {
+	items, err := h.visibleListItems(ctx, userID, profileID, limit, filter, func(n int) ([]recommendations.ScoredItem, error) {
+		return h.recsRepo.GetPopularItems(ctx, days, 1, n)
+	})
 	if err != nil {
+		slog.WarnContext(ctx, "PopularItems failed", "component", "api", "user_id", userID, "profile_id", profileID, "error", err)
 		return nil, recommendationsUnavailable("Failed to fetch popular items")
 	}
-	if items == nil {
-		items = []recommendations.ScoredItem{}
+	return items, nil
+}
+
+// liveListMaxRead bounds how deep a live list reads to fill its limit with
+// titles the viewer can see.
+const liveListMaxRead = 1000
+
+// visibleListItems reads a server-wide list with read(n), n rows at a time,
+// and keeps the titles the viewer can see and the profile has neither watched
+// nor marked Not interested.
+// The list is filtered after its LIMIT, so it reads deeper until limit
+// titles are kept, the list runs out, or liveListMaxRead rows were read.
+func (h *RecommendationsHandler) visibleListItems(ctx context.Context, userID int, profileID string, limit int, filter catalog.AccessFilter, read func(n int) ([]recommendations.ScoredItem, error)) ([]recommendations.ScoredItem, error) {
+	watchedSet, err := h.skippedItemIDSet(ctx, userID, profileID)
+	if err != nil {
+		slog.WarnContext(ctx, "loading the watched set failed; recommendations are not filtered for it", "component", "api", "user_id", userID, "profile_id", profileID, "error", err)
+		watchedSet = nil
+	}
+	for n := min(limit*3, liveListMaxRead); ; n = min(n*4, liveListMaxRead) {
+		items, err := read(n)
+		if err != nil {
+			return nil, err
+		}
+		unwatched := make([]recommendations.ScoredItem, 0, len(items))
+		for _, item := range items {
+			if _, watched := watchedSet[item.MediaItemID]; !watched {
+				unwatched = append(unwatched, item)
+			}
+		}
+		kept, err := h.keepAccessible(ctx, unwatched, filter)
+		if err != nil {
+			return nil, err
+		}
+		if len(kept) >= limit || len(items) < n || n >= liveListMaxRead {
+			return kept[:min(len(kept), limit)], nil
+		}
 	}
-	return h.excludeWatchedRecommendations(ctx, userID, profileID, items), nil
 }
 
-// RecentlyAddedItems answers the items added in the last days, minus what
-// the profile has watched.
-func (h *RecommendationsHandler) RecentlyAddedItems(ctx context.Context, userID int, profileID string, days, limit int) ([]recommendations.ScoredItem, error) {
-	items, err := h.recsRepo.GetRecentlyAddedItems(ctx, days, limit)
+// RecentlyAddedItems answers up to limit of the items added in the last
+// days that the viewer can see and the profile has not watched.
+func (h *RecommendationsHandler) RecentlyAddedItems(ctx context.Context, userID int, profileID string, days, limit int, filter catalog.AccessFilter) ([]recommendations.ScoredItem, error) {
+	items, err := h.visibleListItems(ctx, userID, profileID, limit, filter, func(n int) ([]recommendations.ScoredItem, error) {
+		return h.recsRepo.GetRecentlyAddedItems(ctx, days, n)
+	})
 	if err != nil {
+		slog.WarnContext(ctx, "RecentlyAddedItems failed", "component", "api", "user_id", userID, "profile_id", profileID, "error", err)
 		return nil, recommendationsUnavailable("Failed to fetch recently added items")
 	}
-	if items == nil {
-		items = []recommendations.ScoredItem{}
-	}
-	return h.excludeWatchedRecommendations(ctx, userID, profileID, items), nil
+	return items, nil
 }
 
 // Discover answers the discover page: the cached rows blended with upcoming
@@ -127,6 +172,9 @@ func (h *RecommendationsHandler) Discover(ctx context.Context, userID int, profi
 	if h.reader == nil || h.Fetcher == nil {
 		return discoverResponse{Rows: []discoverRowResponse{}}, nil
 	}
+	// The rows and the airings blend both leave out what the profile watched;
+	// read that once.
+	ctx = recommendations.WithWatchedSetMemo(ctx)
 	rows, err := h.reader.GetDiscoverRows(ctx, userID, profileID, recommendationsDefaultLimit, filter)
 	if err != nil {
 		slog.ErrorContext(ctx, "Discover failed", "component", "api", "user_id", userID, "profile_id", profileID, "error", err)
@@ -204,8 +252,10 @@ func (h *RecommendationsHandler) renderDiscoverRows(ctx context.Context, userID
 	}
 	enrichment, err := h.loadItemEnrichment(ctx, userID, profileID, filter, allIDs)
 	if err != nil {
+		slog.WarnContext(ctx, "recommendation cards: item details failed", "component", "api", "user_id", userID, "profile_id", profileID, "error", err)
 		return nil, recommendationsUnavailable("Failed to fetch item details")
 	}
+	artwork := h.featuredCardArtwork(ctx, enrichment.items, filter.Artwork())
 	out := make([]discoverRowResponse, 0, len(discoverRows))
 	for _, row := range discoverRows {
 		kind, key := discoverRowSectionKey(row.Type, row.Label, row.ClusterIndex)
@@ -214,7 +264,7 @@ func (h *RecommendationsHandler) renderDiscoverRows(ctx context.Context, userID
 			Label:       row.Label,
 			SectionKind: kind,
 			SectionKey:  key,
-			Items:       h.buildSectionItems(ctx, row.Items, enrichment, row.UpcomingEvents),
+			Items:       h.buildSectionItems(ctx, row.Items, enrichment, row.UpcomingEvents, artwork),
 		}
 		if len(respRow.Items) > 0 {
 			out = append(out, respRow)
@@ -238,7 +288,7 @@ func (h *RecommendationsHandler) cardsOf(ctx context.Context, userID int, profil
 
 // BecauseWatchedCards is BecauseWatched rendered as cards.
 func (h *RecommendationsHandler) BecauseWatchedCards(ctx context.Context, userID int, profileID, itemID string, limit int, filter catalog.AccessFilter) ([]SectionItemView, error) {
-	items, err := h.BecauseWatched(ctx, userID, profileID, itemID, limit)
+	items, err := h.BecauseWatched(ctx, userID, profileID, itemID, limit, filter)
 	if err != nil {
 		return nil, err
 	}
@@ -247,7 +297,7 @@ func (h *RecommendationsHandler) BecauseWatchedCards(ctx context.Context, userID
 
 // PopularCards is PopularItems rendered as cards.
 func (h *RecommendationsHandler) PopularCards(ctx context.Context, userID int, profileID string, days, limit int, filter catalog.AccessFilter) ([]SectionItemView, error) {
-	items, err := h.PopularItems(ctx, userID, profileID, days, limit)
+	items, err := h.PopularItems(ctx, userID, profileID, days, limit, filter)
 	if err != nil {
 		return nil, err
 	}
@@ -256,7 +306,7 @@ func (h *RecommendationsHandler) PopularCards(ctx context.Context, userID int, p
 
 // RecentlyAddedCards is RecentlyAddedItems rendered as cards.
 func (h *RecommendationsHandler) RecentlyAddedCards(ctx context.Context, userID int, profileID string, days, limit int, filter catalog.AccessFilter) ([]SectionItemView, error) {
-	items, err := h.RecentlyAddedItems(ctx, userID, profileID, days, limit)
+	items, err := h.RecentlyAddedItems(ctx, userID, profileID, days, limit, filter)
 	if err != nil {
 		return nil, err
 	}
@@ -294,17 +344,28 @@ func (h *RecommendationsHandler) ForYouRowCards(ctx context.Context, userID int,
 	return h.renderDiscoverRows(ctx, userID, profileID, filter, discoverRowModelsFromRecommendations(rows))
 }
 
-// SimilarItems answers items similar to itemID; an unavailable engine
-// answers an empty list. The list is not viewer-filtered, as in v1.
-func (h *RecommendationsHandler) SimilarItems(ctx context.Context, itemID string, limit int) ([]recommendations.ScoredItem, error) {
+// SimilarItems answers items similar to itemID for the profile, without the
+// titles it marked Not interested; an unavailable engine, and an anchor the
+// viewer cannot see, answer an empty list. The engine leaves out
+// titles the viewer cannot see before it ranks; v1 filters again with
+// keepAccessible and v2 as it renders the cards.
+func (h *RecommendationsHandler) SimilarItems(ctx context.Context, userID int, profileID, itemID string, limit int, filter catalog.AccessFilter) ([]recommendations.ScoredItem, error) {
 	if h.engineUnavailable() {
 		return []recommendations.ScoredItem{}, nil
 	}
 	if limit <= 0 {
 		limit = recommendationsDefaultLimit
 	}
-	items, err := h.engine.SimilarItems(ctx, itemID, limit)
+	visible, err := h.anchorVisible(ctx, itemID, filter)
 	if err != nil {
+		return nil, err
+	}
+	if !visible {
+		return []recommendations.ScoredItem{}, nil
+	}
+	items, err := h.engine.SimilarItems(ctx, userID, profileID, itemID, limit, filter)
+	if err != nil {
+		slog.WarnContext(ctx, "SimilarItems failed", "component", "api", "item_id", itemID, "error", err)
 		return nil, recommendationsUnavailable("Failed to fetch similar items")
 	}
 	if items == nil {
@@ -324,6 +385,7 @@ func (h *RecommendationsHandler) SimilarUsersLiked(ctx context.Context, userID i
 	}
 	items, err := h.reader.GetSimilarUsersLiked(ctx, userID, profileID, limit, filter)
 	if err != nil {
+		slog.WarnContext(ctx, "SimilarUsersLiked failed", "component", "api", "user_id", userID, "profile_id", profileID, "error", err)
 		return nil, recommendationsUnavailable("Failed to fetch recommendations")
 	}
 	if items == nil {
@@ -334,7 +396,7 @@ func (h *RecommendationsHandler) SimilarUsersLiked(ctx context.Context, userID i
 
 // SimilarCards is SimilarItems rendered as cards for the acting profile.
 func (h *RecommendationsHandler) SimilarCards(ctx context.Context, userID int, profileID, itemID string, limit int, filter catalog.AccessFilter) ([]SectionItemView, error) {
-	items, err := h.SimilarItems(ctx, itemID, limit)
+	items, err := h.SimilarItems(ctx, userID, profileID, itemID, limit, filter)
 	if err != nil {
 		return nil, err
 	}
@@ -358,21 +420,77 @@ func (h *RecommendationsHandler) TasteProfile(ctx context.Context, userID int, p
 		return emptyTasteProfileSummary()
 	}
 	summary, err := h.engine.GetTasteProfileSummary(ctx, userID, profileID)
-	if err != nil || summary == nil {
+	if err != nil {
+		slog.WarnContext(ctx, "TasteProfile failed; answering an empty summary", "component", "api", "user_id", userID, "profile_id", profileID, "error", err)
+		return emptyTasteProfileSummary()
+	}
+	if summary == nil {
 		return emptyTasteProfileSummary()
 	}
 	return *summary
 }
 
-// TasteSeedItems answers one offset page of taste-seeding picker cards.
+// keepAccessible drops the items filter does not admit, keeping their order.
+// The v1 lists answer bare identifiers, so they filter here; the v2 card
+// renderings filter as they hydrate. Without an access check nothing is shown.
+func (h *RecommendationsHandler) keepAccessible(ctx context.Context, items []recommendations.ScoredItem, filter catalog.AccessFilter) ([]recommendations.ScoredItem, error) {
+	if len(items) == 0 {
+		return items, nil
+	}
+	ids := make([]string, len(items))
+	for i, item := range items {
+		ids[i] = item.MediaItemID
+	}
+	accessible, err := h.accessibleItemIDs(ctx, ids, filter)
+	if err != nil {
+		return nil, err
+	}
+	kept := make([]recommendations.ScoredItem, 0, len(items))
+	for _, item := range items {
+		if _, ok := accessible[item.MediaItemID]; ok {
+			kept = append(kept, item)
+		}
+	}
+	return kept, nil
+}
+
+// anchorVisible reports whether the viewer can see the item a list is
+// anchored on. A list anchored on a hidden item answers as one anchored on an
+// unknown item does, so it cannot confirm that the item exists or show what
+// it resembles.
+func (h *RecommendationsHandler) anchorVisible(ctx context.Context, itemID string, filter catalog.AccessFilter) (bool, error) {
+	accessible, err := h.accessibleItemIDs(ctx, []string{itemID}, filter)
+	if err != nil {
+		return false, err
+	}
+	_, ok := accessible[itemID]
+	return ok, nil
+}
+
+// accessibleItemIDs is the subset of ids filter admits; with no access check
+// wired it is empty.
+func (h *RecommendationsHandler) accessibleItemIDs(ctx context.Context, ids []string, filter catalog.AccessFilter) (map[string]struct{}, error) {
+	if h.accessibleIDs == nil {
+		return map[string]struct{}{}, nil
+	}
+	accessible, err := h.accessibleIDs.FilterAccessibleItemIDs(ctx, ids, filter)
+	if err != nil {
+		slog.WarnContext(ctx, "recommendations: access check failed", "component", "api", "user_id", filter.UserID, "profile_id", filter.ProfileID, "error", err)
+		return nil, recommendationsUnavailable("Failed to fetch recommendations")
+	}
+	return accessible, nil
+}
+
+// TasteSeedItems answers one offset page of taste-seeding picker cards. The
+// candidate window holds only titles filter admits; hydration filters again.
 // candidates is how many candidate identifiers the page window held before
-// hydration dropped inaccessible ones; a window as large as limit means a
-// next page may exist. An unwired repository or fetcher answers no cards.
+// hydration; a window as large as limit means a next page may exist. An
+// unwired repository or fetcher answers no cards.
 func (h *RecommendationsHandler) TasteSeedItems(ctx context.Context, userID int, profileID string, filter catalog.AccessFilter, limit, offset int) (items []SectionItemView, candidates int, err error) {
 	if h.recsRepo == nil || h.Fetcher == nil {
 		return []SectionItemView{}, 0, nil
 	}
-	candidateIDs, err := h.recsRepo.GetTasteSeedCandidates(ctx, limit, offset)
+	candidateIDs, err := h.recsRepo.GetTasteSeedCandidates(ctx, filter, limit, offset)
 	if err != nil {
 		slog.ErrorContext(ctx, "TasteSeedItems: candidate query failed", "component", "api", "user_id", userID, "profile_id", profileID, "error", err)
 		return nil, 0, recommendationsUnavailable("Failed to fetch taste seed candidates")
@@ -390,25 +508,28 @@ func (h *RecommendationsHandler) TasteSeedItems(ctx context.Context, userID int,
 		itemMap[mi.ContentID] = mi
 	}
 	stateMap := h.resolveTasteSeedUserStates(ctx, userID, profileID, mediaItems)
+	posters := h.tasteSeedPosterURLs(ctx, mediaItems, filter.Artwork())
 	items = make([]SectionItemView, 0, len(candidateIDs))
 	for _, id := range candidateIDs {
 		mi, ok := itemMap[id]
 		if !ok || mi == nil {
 			continue
 		}
-		items = append(items, h.tasteSeedSectionItem(ctx, mi, stateMap))
+		items = append(items, tasteSeedSectionItem(mi, stateMap, posters[mi.ContentID]))
 	}
 	return items, len(candidateIDs), nil
 }
 
 // SubmitTasteSeed favorites every picked item for the profile and, when
-// any was added, queues a taste-profile refresh. All picks must first be visible
+// any was added, refreshes its taste profile and cached rows, waiting a few
+// seconds for the refresh so the client's next read shows the picks' effect;
+// a slower refresh finishes in the background. All picks must first be visible
 // in the acting profile's access-filtered catalog. It answers how many picks
 // were newly recorded; an item that fails to record is skipped, not fatal.
 // Favouriting is set membership, so a duplicate pick, an item the profile
 // already favorited, or a retried submission adds nothing: the store's
 // insert is a no-op that the count leaves out, and a submission that added
-// nothing queues no refresh.
+// nothing refreshes nothing.
 func (h *RecommendationsHandler) SubmitTasteSeed(ctx context.Context, userID int, profileID string, itemIDs []string, filter catalog.AccessFilter) (int, error) {
 	if h.storeProvider == nil {
 		return 0, apiError(http.StatusServiceUnavailable, "unavailable", "User store unavailable")
@@ -418,6 +539,7 @@ func (h *RecommendationsHandler) SubmitTasteSeed(ctx context.Context, userID int
 	}
 	items, err := h.Fetcher.FetchItemsByContentIDs(ctx, itemIDs, filter)
 	if err != nil {
+		slog.WarnContext(ctx, "TasteSeed: validating picks failed", "component", "api", "user_id", userID, "profile_id", profileID, "error", err)
 		return 0, recommendationsUnavailable("Failed to validate taste-seed items")
 	}
 	visible := make(map[string]bool, len(items))
@@ -451,12 +573,8 @@ func (h *RecommendationsHandler) SubmitTasteSeed(ctx context.Context, userID int
 			added++
 		}
 	}
-	if added > 0 {
-		var staler ProfileStaler
-		if h.recsRepo != nil {
-			staler = h.recsRepo
-		}
-		triggerProfileRefresh(ctx, staler, h.RecWorker, userID, profileID)
+	if added > 0 && h.RecWorker != nil {
+		h.RecWorker.RefreshProfileNow(ctx, userID, profileID)
 	}
 	return added, nil
 }
diff --git a/internal/api/handlers/recommendations_similar_test.go b/internal/api/handlers/recommendations_similar_test.go
index 3ce4602a5a..79678c48e3 100644
--- a/internal/api/handlers/recommendations_similar_test.go
+++ b/internal/api/handlers/recommendations_similar_test.go
@@ -21,11 +21,11 @@ type stubSimilarEngine struct {
 	err   error
 }
 
-func (s *stubSimilarEngine) SimilarItems(context.Context, string, int) ([]recommendations.ScoredItem, error) {
+func (s *stubSimilarEngine) SimilarItems(context.Context, int, string, string, int, catalog.AccessFilter) ([]recommendations.ScoredItem, error) {
 	return s.items, s.err
 }
 
-func (s *stubSimilarEngine) BecauseYouWatched(context.Context, int, string, string, int) ([]recommendations.ScoredItem, error) {
+func (s *stubSimilarEngine) BecauseYouWatched(context.Context, int, string, string, int, catalog.AccessFilter) ([]recommendations.ScoredItem, error) {
 	return nil, nil
 }
 
@@ -62,6 +62,16 @@ func (stubPresigner) PresignURL(_ context.Context, path string, _ string) string
 	return "https://cdn.example.com/" + path
 }
 
+func (p stubPresigner) PresignURLsWithExpiry(ctx context.Context, paths []string, variant string) map[string]catalog.ResolvedImageURL {
+	out := make(map[string]catalog.ResolvedImageURL, len(paths))
+	for _, path := range paths {
+		if url := p.PresignURL(ctx, path, variant); url != "" {
+			out[path] = catalog.ResolvedImageURL{URL: url}
+		}
+	}
+	return out
+}
+
 func similarRequest(itemID string) *http.Request {
 	req := httptest.NewRequest(http.MethodGet, "/recommendations/similar/"+itemID, nil)
 	routeCtx := chi.NewRouteContext()
@@ -91,6 +101,7 @@ func TestHandleSimilar_ReturnsHydratedCards(t *testing.T) {
 	}}
 
 	h := NewRecommendationsHandler(engine, nil, nil, nil, nil, true)
+	h.accessibleIDs = fakeAccessibleIDs{}
 	h.Fetcher = fetcher
 	h.DetailSvc = stubPresigner{}
 
@@ -137,6 +148,7 @@ func TestHandleSimilar_DropsItemsTheProfileCannotSee(t *testing.T) {
 	}}
 
 	h := NewRecommendationsHandler(engine, nil, nil, nil, nil, true)
+	h.accessibleIDs = fakeAccessibleIDs{}
 	h.Fetcher = fetcher
 	h.DetailSvc = stubPresigner{}
 
@@ -157,6 +169,7 @@ func TestHandleSimilar_OmitsCardsWhenHydrationUnavailable(t *testing.T) {
 
 	engine := &stubSimilarEngine{items: []recommendations.ScoredItem{{MediaItemID: "movie-a"}}}
 	h := NewRecommendationsHandler(engine, nil, nil, nil, nil, true)
+	h.accessibleIDs = fakeAccessibleIDs{}
 	// No Fetcher configured.
 
 	rec := httptest.NewRecorder()
@@ -176,6 +189,7 @@ func TestHandleSimilar_DegradesWhenHydrationFails(t *testing.T) {
 
 	engine := &stubSimilarEngine{items: []recommendations.ScoredItem{{MediaItemID: "movie-a"}}}
 	h := NewRecommendationsHandler(engine, nil, nil, nil, nil, true)
+	h.accessibleIDs = fakeAccessibleIDs{}
 	h.Fetcher = &stubCardFetcher{err: errors.New("db down")}
 	h.DetailSvc = stubPresigner{}
 
diff --git a/internal/api/handlers/recommendations_upcoming_test.go b/internal/api/handlers/recommendations_upcoming_test.go
index 990ccff1c6..6fb70e2397 100644
--- a/internal/api/handlers/recommendations_upcoming_test.go
+++ b/internal/api/handlers/recommendations_upcoming_test.go
@@ -83,7 +83,7 @@ func TestMergePremieresIntoDiscoverRow_PromotesAndRanksCandidates(t *testing.T)
 		},
 		{
 			Type:  "genre_sampler",
-			Label: "Popular in Drama",
+			Label: "Top Drama",
 			Items: []recommendations.ScoredItem{
 				{MediaItemID: "movie-c"},
 			},
@@ -151,7 +151,7 @@ func TestBlendUpcomingIntoDiscoverRows_LeavesRowsUnchangedWithoutForYou(t *testi
 
 	rows := []discoverRowModel{{
 		Type:  "genre_sampler",
-		Label: "Popular in Drama",
+		Label: "Top Drama",
 		Items: []recommendations.ScoredItem{{MediaItemID: "movie-1"}},
 	}}
 
@@ -166,7 +166,7 @@ func TestBlendUpcomingIntoDiscoverRows_LeavesRowsUnchangedWithoutForYou(t *testi
 	if err != nil {
 		t.Fatalf("blendUpcomingIntoDiscoverRows error = %v", err)
 	}
-	if len(blended) != 1 || blended[0].Label != "Popular in Drama" {
+	if len(blended) != 1 || blended[0].Label != "Top Drama" {
 		t.Fatalf("blended rows = %+v, want unchanged rows", blended)
 	}
 }
diff --git a/internal/api/handlers/section_items_error_db_test.go b/internal/api/handlers/section_items_error_db_test.go
new file mode 100644
index 0000000000..51ed424ec5
--- /dev/null
+++ b/internal/api/handlers/section_items_error_db_test.go
@@ -0,0 +1,116 @@
+package handlers
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/recommendations"
+	"github.com/prairie-server/prairie-server/internal/sections"
+)
+
+// sectionRowReader answers every recommendation section read with err, or
+// with an empty row when err is nil.
+type sectionRowReader struct{ err error }
+
+func (r sectionRowReader) SectionForYouMain(context.Context, int, string, catalog.AccessFilter) (*recommendations.ForYouRow, error) {
+	return nil, r.err
+}
+
+func (r sectionRowReader) SectionForYouFill(context.Context, int, string, catalog.AccessFilter) ([]recommendations.ScoredItem, error) {
+	return nil, r.err
+}
+
+func (r sectionRowReader) SectionBecauseYouWatched(context.Context, int, string, string, []int, catalog.AccessFilter) ([]recommendations.ScoredItem, string, error) {
+	return nil, "", r.err
+}
+
+func (r sectionRowReader) SectionSimilarUsersLiked(context.Context, int, string, catalog.AccessFilter) ([]recommendations.ScoredItem, error) {
+	return nil, r.err
+}
+
+func (r sectionRowReader) SectionTasteMatchRow(context.Context, int, string, string, catalog.AccessFilter) (*recommendations.ForYouRow, error) {
+	return nil, r.err
+}
+
+// A library section whose recommendation read fails answers a 500 problem on
+// v2, so the client shows the section's error and retry state; the frozen v1
+// endpoint keeps answering it with no items. A section with nothing to
+// recommend answers an empty 200 on both.
+func TestLibrarySectionItemsAnswersAnErrorWhenTheFetchFailsDB(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatalf("connect test database: %v", err)
+	}
+	t.Cleanup(pool.Close)
+
+	var libraryID int
+	if err := pool.QueryRow(ctx, `INSERT INTO media_folders (type, name, enabled) VALUES ('movies', $1, true) RETURNING id`, "section-error-"+uuid.NewString()).Scan(&libraryID); err != nil {
+		t.Fatalf("seed library: %v", err)
+	}
+	t.Cleanup(func() { _, _ = pool.Exec(context.Background(), `DELETE FROM media_folders WHERE id = $1`, libraryID) })
+
+	handler := func(reader sectionRowReader) *SectionHandler {
+		fetcher := sections.NewFetcher(pool)
+		fetcher.RecommendationReader = reader
+		h := NewSectionHandler(sections.NewRepository(pool), fetcher)
+		h.FolderRepo = catalog.NewFolderRepository(pool)
+		return h
+	}
+	const sectionID = "default-recommended-for-you"
+	v1 := func(reader sectionRowReader) *httptest.ResponseRecorder {
+		t.Helper()
+		router := chi.NewRouter()
+		router.Get("/library/{id}/sections/{sectionId}/items", handler(reader).HandleLibrarySectionItems)
+		req := httptest.NewRequest(http.MethodGet, fmt.Sprintf("/library/%d/sections/%s/items", libraryID, sectionID), nil)
+		req = req.WithContext(authenticatedRecsContext(req.Context(), nil))
+		rec := httptest.NewRecorder()
+		router.ServeHTTP(rec, req)
+		return rec
+	}
+	emptySection := func(name string, rec *httptest.ResponseRecorder) {
+		t.Helper()
+		if rec.Code != http.StatusOK {
+			t.Fatalf("%s: %d %s; want 200", name, rec.Code, rec.Body.String())
+		}
+		var body homeSectionItemsResponse
+		if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+			t.Fatal(err)
+		}
+		if body.Section.ID != sectionID || len(body.Section.Items) != 0 {
+			t.Fatalf("%s = %+v, want the section with no items", name, body.Section)
+		}
+	}
+	failing := sectionRowReader{err: errors.New("recommendation cache read failed")}
+
+	// The service the v2 adapter calls answers the failure as a 500 problem.
+	ctx = authenticatedRecsContext(ctx, nil)
+	_, err = handler(failing).LibrarySectionItems(ctx, libraryID, sectionID, SectionViewer{Access: catalog.AccessFilter{UserID: 7, ProfileID: "profile-1"}})
+	failed := httptest.NewRecorder()
+	writeAPIError(failed, err)
+	if failed.Code != http.StatusInternalServerError || !strings.Contains(failed.Body.String(), `"internal_error"`) {
+		t.Fatalf("failed fetch: %d %s; want a 500 internal_error", failed.Code, failed.Body.String())
+	}
+	if strings.Contains(failed.Body.String(), "cache read failed") {
+		t.Fatalf("failed fetch leaks the cause: %s", failed.Body.String())
+	}
+
+	emptySection("v1 failed fetch", v1(failing))
+	emptySection("empty row", v1(sectionRowReader{}))
+}
diff --git a/internal/api/handlers/section_source_policy.go b/internal/api/handlers/section_source_policy.go
deleted file mode 100644
index 42af970410..0000000000
--- a/internal/api/handlers/section_source_policy.go
+++ /dev/null
@@ -1,62 +0,0 @@
-package handlers
-
-import (
-	"bytes"
-	"encoding/json"
-	"reflect"
-	"strings"
-
-	"github.com/prairie-server/prairie-server/internal/sections"
-)
-
-func isTraktBackedSection(sectionType string, config json.RawMessage) bool {
-	var values struct {
-		Source         string `json:"source"`
-		SourceProvider string `json:"source_provider"`
-	}
-	if len(config) == 0 || json.Unmarshal(config, &values) != nil {
-		return false
-	}
-	switch sectionType {
-	case string(sections.SectionTrendingDiscover):
-		return values.Source == adminCollectionTrakt
-	case string(sections.SectionCollection):
-		return values.SourceProvider == adminCollectionTrakt
-	default:
-		return false
-	}
-}
-
-func jsonConfigEqual(left, right json.RawMessage) bool {
-	var leftValue, rightValue any
-	if json.Unmarshal(left, &leftValue) == nil && json.Unmarshal(right, &rightValue) == nil {
-		return reflect.DeepEqual(leftValue, rightValue)
-	}
-	return bytes.Equal(bytes.TrimSpace(left), bytes.TrimSpace(right))
-}
-
-func hasSectionConfig(config json.RawMessage) bool {
-	trimmed := bytes.TrimSpace(config)
-	return len(trimmed) > 0 && !bytes.Equal(trimmed, []byte("null"))
-}
-
-func traktSectionKind(config json.RawMessage) string {
-	if isTraktBackedSection(string(sections.SectionTrendingDiscover), config) {
-		return string(sections.SectionTrendingDiscover)
-	}
-	if isTraktBackedSection(string(sections.SectionCollection), config) {
-		return string(sections.SectionCollection)
-	}
-	return ""
-}
-
-func isTraktCollectionSourceConfig(config json.RawMessage) bool {
-	var values struct {
-		Provider string `json:"provider"`
-		Mode     string `json:"mode"`
-	}
-	if len(config) == 0 || json.Unmarshal(config, &values) != nil {
-		return false
-	}
-	return values.Provider == adminCollectionTrakt || strings.HasPrefix(values.Mode, adminCollectionTrakt+"_")
-}
diff --git a/internal/api/handlers/section_source_policy_test.go b/internal/api/handlers/section_source_policy_test.go
index 925145b3f1..44a50138e8 100644
--- a/internal/api/handlers/section_source_policy_test.go
+++ b/internal/api/handlers/section_source_policy_test.go
@@ -82,69 +82,6 @@ func TestProfileOverrideSaveStopsOnBaseSectionReadFailure(t *testing.T) {
 	}
 }
 
-func TestProfileOverrideResetStopsOnBaseSectionReadFailure(t *testing.T) {
-	store := &sourcePolicyStore{overrides: []userstore.SectionOverride{{
-		ID: "existing", SectionID: "admin-trending", Hidden: true,
-	}}}
-	h := &SectionHandler{
-		StoreProvider: sourcePolicyProvider{store: store},
-		sectionReader: sourcePolicySectionReader{err: errors.New("database unavailable")},
-	}
-	err := h.ResetProfileOverrides(t.Context(), SectionOverridesQuery{UserID: 1, ProfileID: "p1", Scope: "home"})
-	apiErr, ok := errors.AsType[*APIError](err)
-	if !ok || apiErr.Status != 500 || apiErr.Code != "internal_error" {
-		t.Fatalf("error = %#v, want internal_error", err)
-	}
-	if len(store.overrides) != 1 || store.overrides[0].ID != "existing" || !store.overrides[0].Hidden {
-		t.Fatalf("failed lookup mutated overrides: %+v", store.overrides)
-	}
-}
-
-func TestProfileCannotCreateTraktTrendingSection(t *testing.T) {
-	store := &sourcePolicyStore{}
-	h := &SectionHandler{StoreProvider: sourcePolicyProvider{store: store}}
-	err := h.SaveProfileOverrides(t.Context(), SectionOverridesQuery{UserID: 1, ProfileID: "p1", Scope: "home"}, []SectionOverrideWrite{{
-		ID: "new", IsUserAdded: true, UserSectionType: "trending_discover",
-		UserConfig: json.RawMessage(`{"source":"trakt","window":"week"}`),
-	}})
-	apiErr, ok := errors.AsType[*APIError](err)
-	if !ok || apiErr.Code != "unsupported_source" {
-		t.Fatalf("error = %#v, want unsupported_source", err)
-	}
-}
-
-func TestAdminCannotCreateTraktTrendingSection(t *testing.T) {
-	_, err := (&SectionHandler{}).CreateAdminSection(t.Context(), AdminSectionCreate{
-		Title: "Trakt Trending", SectionType: "trending_discover",
-		Config: json.RawMessage(`{"source":"trakt","window":"week"}`),
-	})
-	apiErr, ok := errors.AsType[*APIError](err)
-	if !ok || apiErr.Code != "unsupported_source" {
-		t.Fatalf("error = %#v, want unsupported_source", err)
-	}
-}
-
-func TestAdminBulkCannotCreateTraktTrendingSection(t *testing.T) {
-	_, err := (&SectionBulkHandler{}).BulkCreateAdminSections(t.Context(), AdminSectionBulkCreate{
-		Scope: "home", Title: "Trakt Trending", SectionType: "trending_discover",
-		Config: json.RawMessage(`{"source":"trakt","window":"week"}`),
-	})
-	apiErr, ok := errors.AsType[*APIError](err)
-	if !ok || apiErr.Code != "unsupported_source" {
-		t.Fatalf("error = %#v, want unsupported_source", err)
-	}
-}
-
-func TestGenericAdminCollectionCannotCreateTraktSource(t *testing.T) {
-	_, err := (&LibraryCollectionHandler{}).CreateAdminCollection(t.Context(), AdminCollectionCreate{
-		Title: "Trakt", CollectionType: "trakt",
-	})
-	apiErr, ok := errors.AsType[*APIError](err)
-	if !ok || apiErr.Code != "unsupported_source" {
-		t.Fatalf("error = %#v, want unsupported_source", err)
-	}
-}
-
 func TestProfileTMDBTrendingUnchangedSaveDoesNotRefreshAgain(t *testing.T) {
 	store := &sourcePolicyStore{}
 	refresher := sourcePolicyRefresher{configs: make(chan json.RawMessage, 2)}
@@ -188,7 +125,7 @@ func TestProfileConflictingLegacyFieldsResolveToValidatedUserFields(t *testing.T
 	err := h.SaveProfileOverrides(t.Context(), SectionOverridesQuery{UserID: 1, ProfileID: "p1", Scope: "home"}, []SectionOverrideWrite{{
 		ID:              "conflicting",
 		SectionType:     "trending_discover",
-		Config:          json.RawMessage(`{"source":"trakt","window":"week"}`),
+		Config:          json.RawMessage(`{"source":"tmdb","window":"week"}`),
 		UserSectionType: "trending_discover",
 		UserConfig:      json.RawMessage(`{"source":"tmdb","window":"day"}`),
 	}})
@@ -250,169 +187,6 @@ func TestLinkedProfileTMDBConfigChangeRequestsImmediateRefresh(t *testing.T) {
 	}
 }
 
-func TestLinkedProfileContradictoryUserAddedFlagCannotBypassTraktPolicy(t *testing.T) {
-	store := &sourcePolicyStore{}
-	h := &SectionHandler{
-		StoreProvider: sourcePolicyProvider{store: store},
-		sectionReader: sourcePolicySectionReader{sections: map[string]*sectionspkg.PageSection{
-			"admin-trending": {
-				ID: "admin-trending", SectionType: sectionspkg.SectionTrendingDiscover,
-				Config: json.RawMessage(`{"source":"tmdb","window":"week"}`), Enabled: true,
-			},
-		}},
-	}
-	err := h.SaveProfileOverrides(t.Context(), SectionOverridesQuery{UserID: 1, ProfileID: "p1", Scope: "home"}, []SectionOverrideWrite{{
-		ID: "new-linked", SectionID: "admin-trending", IsUserAdded: true,
-		Config:          json.RawMessage(`{"source":"trakt","window":"week"}`),
-		UserSectionType: "trending_discover", UserConfig: json.RawMessage(`{"source":"tmdb","window":"day"}`),
-	}})
-	apiErr, ok := errors.AsType[*APIError](err)
-	if !ok || apiErr.Code != "unsupported_source" {
-		t.Fatalf("error = %#v, want unsupported_source", err)
-	}
-}
-
-func TestLinkedProfileInheritedLegacyTraktCannotBeReactivated(t *testing.T) {
-	store := &sourcePolicyStore{overrides: []userstore.SectionOverride{{
-		ID: "legacy-linked", SectionID: "legacy-admin-trending", Hidden: true,
-	}}}
-	h := &SectionHandler{
-		StoreProvider: sourcePolicyProvider{store: store},
-		sectionReader: sourcePolicySectionReader{sections: map[string]*sectionspkg.PageSection{
-			"legacy-admin-trending": {
-				ID: "legacy-admin-trending", SectionType: sectionspkg.SectionTrendingDiscover,
-				Config: json.RawMessage(`{"source":"trakt","window":"week"}`), Enabled: true,
-			},
-		}},
-	}
-	err := h.SaveProfileOverrides(t.Context(), SectionOverridesQuery{UserID: 1, ProfileID: "p1", Scope: "home"}, []SectionOverrideWrite{{
-		ID: "legacy-linked", SectionID: "legacy-admin-trending",
-	}})
-	apiErr, ok := errors.AsType[*APIError](err)
-	if !ok || apiErr.Code != "legacy_source_immutable" {
-		t.Fatalf("error = %#v, want legacy_source_immutable", err)
-	}
-}
-
-func TestLinkedProfileCanSuppressInheritedLegacyTrakt(t *testing.T) {
-	store := &sourcePolicyStore{}
-	h := &SectionHandler{
-		StoreProvider: sourcePolicyProvider{store: store},
-		sectionReader: sourcePolicySectionReader{sections: map[string]*sectionspkg.PageSection{
-			"legacy-admin-trending": {
-				ID: "legacy-admin-trending", SectionType: sectionspkg.SectionTrendingDiscover,
-				Config: json.RawMessage(`{"source":"trakt","window":"week"}`), Enabled: true,
-			},
-		}},
-	}
-	err := h.SaveProfileOverrides(t.Context(), SectionOverridesQuery{UserID: 1, ProfileID: "p1", Scope: "home"}, []SectionOverrideWrite{{
-		ID: "hide-legacy", SectionID: "legacy-admin-trending", Hidden: true,
-	}})
-	if err != nil {
-		t.Fatalf("SaveProfileOverrides: %v", err)
-	}
-	if len(store.overrides) != 1 || !store.overrides[0].Hidden || store.overrides[0].IsUserAdded {
-		t.Fatalf("stored override = %+v, want linked hidden suppression", store.overrides)
-	}
-}
-
-func TestLinkedProfileCannotReactivateLegacyTraktByOmission(t *testing.T) {
-	store := &sourcePolicyStore{overrides: []userstore.SectionOverride{{
-		ID: "hide-legacy", SectionID: "legacy-admin-trending", Hidden: true,
-	}}}
-	h := &SectionHandler{
-		StoreProvider: sourcePolicyProvider{store: store},
-		sectionReader: sourcePolicySectionReader{sections: map[string]*sectionspkg.PageSection{
-			"legacy-admin-trending": {
-				ID: "legacy-admin-trending", SectionType: sectionspkg.SectionTrendingDiscover,
-				Config: json.RawMessage(`{"source":"trakt","window":"week"}`), Enabled: true,
-			},
-		}},
-	}
-	err := h.SaveProfileOverrides(t.Context(), SectionOverridesQuery{UserID: 1, ProfileID: "p1", Scope: "home"}, nil)
-	apiErr, ok := errors.AsType[*APIError](err)
-	if !ok || apiErr.Code != "legacy_source_immutable" {
-		t.Fatalf("error = %#v, want legacy_source_immutable", err)
-	}
-}
-
-func TestLinkedProfileCannotExposeLegacyTraktByReusingOverrideID(t *testing.T) {
-	store := &sourcePolicyStore{overrides: []userstore.SectionOverride{{
-		ID: "movable", SectionID: "legacy-admin-trending", Config: `{"source":"tmdb","window":"day"}`,
-	}}}
-	h := &SectionHandler{
-		StoreProvider: sourcePolicyProvider{store: store},
-		sectionReader: sourcePolicySectionReader{sections: map[string]*sectionspkg.PageSection{
-			"legacy-admin-trending": {
-				ID: "legacy-admin-trending", SectionType: sectionspkg.SectionTrendingDiscover,
-				Config: json.RawMessage(`{"source":"trakt","window":"week"}`), Enabled: true,
-			},
-			"tmdb-admin-trending": {
-				ID: "tmdb-admin-trending", SectionType: sectionspkg.SectionTrendingDiscover,
-				Config: json.RawMessage(`{"source":"tmdb","window":"week"}`), Enabled: true,
-			},
-		}},
-	}
-	err := h.SaveProfileOverrides(t.Context(), SectionOverridesQuery{UserID: 1, ProfileID: "p1", Scope: "home"}, []SectionOverrideWrite{{
-		ID: "movable", SectionID: "tmdb-admin-trending",
-	}})
-	apiErr, ok := errors.AsType[*APIError](err)
-	if !ok || apiErr.Code != "legacy_source_immutable" {
-		t.Fatalf("error = %#v, want legacy_source_immutable", err)
-	}
-}
-
-func TestResetCannotReactivateInheritedLegacyTrakt(t *testing.T) {
-	store := &sourcePolicyStore{overrides: []userstore.SectionOverride{{
-		ID: "hide-legacy", SectionID: "legacy-admin-trending", Removed: true,
-	}}}
-	h := &SectionHandler{
-		StoreProvider: sourcePolicyProvider{store: store},
-		sectionReader: sourcePolicySectionReader{sections: map[string]*sectionspkg.PageSection{
-			"legacy-admin-trending": {
-				ID: "legacy-admin-trending", SectionType: sectionspkg.SectionTrendingDiscover,
-				Config: json.RawMessage(`{"source":"trakt","window":"week"}`), Enabled: true,
-			},
-		}},
-	}
-	err := h.ResetProfileOverrides(t.Context(), SectionOverridesQuery{UserID: 1, ProfileID: "p1", Scope: "home"})
-	apiErr, ok := errors.AsType[*APIError](err)
-	if !ok || apiErr.Code != "legacy_source_immutable" {
-		t.Fatalf("error = %#v, want legacy_source_immutable", err)
-	}
-}
-
-func TestProfileLegacyTraktSourceCannotBeChangedOrReactivated(t *testing.T) {
-	originalConfig := json.RawMessage(`{"source":"trakt","window":"week"}`)
-	query := SectionOverridesQuery{UserID: 1, ProfileID: "p1", Scope: "home"}
-
-	for _, tc := range []struct {
-		name   string
-		config json.RawMessage
-		hidden bool
-	}{
-		{name: "source config", config: json.RawMessage(`{"source":"trakt","window":"day"}`), hidden: true},
-		{name: "source migration", config: json.RawMessage(`{"source":"tmdb","window":"week"}`), hidden: true},
-		{name: "reactivation", config: originalConfig, hidden: false},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			store := &sourcePolicyStore{overrides: []userstore.SectionOverride{{
-				ID: "legacy", IsUserAdded: true, UserSectionType: "trending_discover",
-				UserConfig: string(originalConfig), Hidden: true,
-			}}}
-			h := &SectionHandler{StoreProvider: sourcePolicyProvider{store: store}}
-			err := h.SaveProfileOverrides(t.Context(), query, []SectionOverrideWrite{{
-				ID: "legacy", IsUserAdded: true, UserSectionType: "trending_discover",
-				UserConfig: tc.config, Hidden: tc.hidden,
-			}})
-			apiErr, ok := errors.AsType[*APIError](err)
-			if !ok || apiErr.Code != "legacy_source_immutable" {
-				t.Fatalf("error = %#v, want legacy_source_immutable", err)
-			}
-		})
-	}
-}
-
 func TestProfileOverrideIDsMustBeUnique(t *testing.T) {
 	h := &SectionHandler{StoreProvider: sourcePolicyProvider{store: &sourcePolicyStore{}}}
 	err := h.SaveProfileOverrides(t.Context(), SectionOverridesQuery{UserID: 1, ProfileID: "p1", Scope: "home"}, []SectionOverrideWrite{
@@ -425,19 +199,6 @@ func TestProfileOverrideIDsMustBeUnique(t *testing.T) {
 	}
 }
 
-func TestTraktCollectionImportsAreDisabled(t *testing.T) {
-	if _, err := (&LibraryCollectionHandler{}).ImportAdminTrakt(t.Context(), AdminCollectionImportTrakt{}); err == nil {
-		t.Fatalf("admin Trakt import error = %#v", err)
-	} else if apiErr, ok := errors.AsType[*APIError](err); !ok || apiErr.Code != "unsupported_source" {
-		t.Fatalf("admin Trakt import error = %#v", err)
-	}
-	if _, err := (&UserCollectionImportHandler{}).ImportTrakt(t.Context(), 1, "p1", UserImportTraktRequest{}); err == nil {
-		t.Fatalf("profile Trakt import error = %#v", err)
-	} else if apiErr, ok := errors.AsType[*APIError](err); !ok || apiErr.Code != "unsupported_source" {
-		t.Fatalf("profile Trakt import error = %#v", err)
-	}
-}
-
 // A profile that is not an admin may always add rule rows, and keeps and
 // changes the Editor's picks rows it already has, but can't add a new one.
 func TestProfileRuleRowsAndKeptEditorsPicks(t *testing.T) {
diff --git a/internal/api/handlers/sections.go b/internal/api/handlers/sections.go
index a6d0b68778..e149dc5b6f 100644
--- a/internal/api/handlers/sections.go
+++ b/internal/api/handlers/sections.go
@@ -1,11 +1,13 @@
 package handlers
 
 import (
+	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
 	"log/slog"
 	"net/http"
+	"reflect"
 	"strconv"
 	"strings"
 	"sync"
@@ -15,8 +17,11 @@ import (
 
 	"github.com/prairie-server/prairie-server/internal/access"
 	apimw "github.com/prairie-server/prairie-server/internal/api/middleware"
+	"github.com/prairie-server/prairie-server/internal/artworkkey"
 	"github.com/prairie-server/prairie-server/internal/auth"
 	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/ctxerr"
+	"github.com/prairie-server/prairie-server/internal/database/queryattr"
 	"github.com/prairie-server/prairie-server/internal/imagesize"
 	"github.com/prairie-server/prairie-server/internal/models"
 	"github.com/prairie-server/prairie-server/internal/sections"
@@ -46,6 +51,26 @@ type SectionHandler struct {
 	TrendingRefresher     interface {
 		RefreshConfig(context.Context, json.RawMessage)
 	}
+	// SeasonalLists fetches the lists a saved seasonal row needs, so it fills
+	// without waiting for the scheduled refresh.
+	SeasonalLists interface {
+		RefreshConfig(context.Context, json.RawMessage)
+	}
+}
+
+// refreshSeasonalLists fetches, in the background, the lists saved seasonal
+// row configs need. The refresher skips lists it already has.
+func (h *SectionHandler) refreshSeasonalLists(ctx context.Context, configs ...json.RawMessage) {
+	if h.SeasonalLists == nil || len(configs) == 0 {
+		return
+	}
+	go func() {
+		refreshCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 2*time.Minute)
+		defer cancel()
+		for _, config := range configs {
+			h.SeasonalLists.RefreshConfig(refreshCtx, config)
+		}
+	}()
 }
 
 // NewSectionHandler creates a new SectionHandler.
@@ -415,6 +440,10 @@ type sectionItemResponse struct {
 	ItemSource             string                 `json:"item_source,omitempty"`
 	UserState              *itemUserStateResponse `json:"user_state,omitempty"`
 	UpcomingEvent          *upcomingEventResponse `json:"upcoming_event,omitempty"`
+	// PendingTranslationLanguage and MachineTranslatedFields reach the v2
+	// card only; v1 is frozen.
+	PendingTranslationLanguage string   `json:"-"`
+	MachineTranslatedFields    []string `json:"-"`
 }
 
 type resolvedSectionResponse struct {
@@ -502,7 +531,9 @@ func (h *SectionHandler) HandleHomeSectionItems(w http.ResponseWriter, r *http.R
 		return
 	}
 
-	section, err := h.HomeSectionItems(r.Context(), sectionID, sectionViewerFromRequest(r))
+	// The frozen v1 endpoint answers a section whose items cannot be fetched
+	// with no items; v2 answers the error.
+	section, err := h.homeSectionItems(r.Context(), sectionID, sectionViewerFromRequest(r), true)
 	if err != nil {
 		writeAPIError(w, err)
 		return
@@ -548,7 +579,8 @@ func (h *SectionHandler) HandleLibrarySectionItems(w http.ResponseWriter, r *htt
 		return
 	}
 
-	section, err := h.LibrarySectionItems(r.Context(), libraryID, sectionID, sectionViewerFromRequest(r))
+	// As on Home, v1 answers a failed fetch with no items.
+	section, err := h.librarySectionItems(r.Context(), libraryID, sectionID, sectionViewerFromRequest(r), true)
 	if err != nil {
 		writeAPIError(w, err)
 		return
@@ -849,16 +881,9 @@ func (h *SectionHandler) saveProfileOverrides(ctx context.Context, q SectionOver
 		id     string
 		config json.RawMessage
 	}
-	type traktWrite struct {
-		sectionID string
-		kind      string
-		config    json.RawMessage
-		active    bool
-	}
 	refreshCandidates := make([]trendingCandidate, 0, len(writes))
-	sourceWrites := make(map[string]traktWrite)
+	var seasonalConfigs []json.RawMessage
 	seenIDs := make(map[string]struct{}, len(writes))
-	retainedSectionIDs := make(map[string]string, len(writes))
 	baseSections := make(map[string]*sections.PageSection)
 	loadBaseSection := func(sectionID string) (*sections.PageSection, bool, error) {
 		if sectionID == "" || h.sectionReader == nil {
@@ -884,7 +909,6 @@ func (h *SectionHandler) saveProfileOverrides(ctx context.Context, q SectionOver
 				return apiError(http.StatusBadRequest, "duplicate_override", "section override IDs must be unique")
 			}
 			seenIDs[o.ID] = struct{}{}
-			retainedSectionIDs[o.ID] = o.SectionID
 		}
 		// SectionID is the authoritative shape discriminator used by the resolver
 		// and scheduled-demand scan. Canonicalize IsUserAdded to match it so a
@@ -892,27 +916,26 @@ func (h *SectionHandler) saveProfileOverrides(ctx context.Context, q SectionOver
 		isUserAdded := o.SectionID == ""
 		o.IsUserAdded = isUserAdded
 		if !isUserAdded {
-			cfg := o.Config
+			if o.Hidden || o.Removed {
+				continue
+			}
 			base, hasBase, err := loadBaseSection(o.SectionID)
 			if err != nil {
 				return err
 			}
-			if !hasSectionConfig(cfg) && hasBase {
-				cfg = base.Config
-			}
-			kind := traktSectionKind(cfg)
-			if kind != "" && o.ID == "" {
-				return apiError(http.StatusBadRequest, "unsupported_source", "new Trakt-backed sections are not supported")
-			}
-			if o.ID != "" {
-				sourceWrites[o.ID] = traktWrite{sectionID: o.SectionID, kind: kind, config: append(json.RawMessage(nil), cfg...), active: !o.Hidden && !o.Removed}
+			if hasBase && base.Enabled && base.SectionType == sections.SectionTrendingDiscover {
+				cfg := o.Config
+				if !hasSectionConfig(cfg) {
+					cfg = base.Config
+				}
+				refreshCandidates = append(refreshCandidates, trendingCandidate{id: o.ID, config: append(json.RawMessage(nil), cfg...)})
 			}
-			if !o.Hidden && !o.Removed {
-				if hasBase && base.Enabled && base.SectionType == sections.SectionTrendingDiscover {
-					if !isTraktBackedSection(string(base.SectionType), cfg) {
-						refreshCandidates = append(refreshCandidates, trendingCandidate{id: o.ID, config: append(json.RawMessage(nil), cfg...)})
-					}
+			if hasBase && base.Enabled && base.SectionType == sections.SectionSeasonalThemed {
+				cfg := o.Config
+				if !hasSectionConfig(cfg) {
+					cfg = base.Config
 				}
+				seasonalConfigs = append(seasonalConfigs, append(json.RawMessage(nil), cfg...))
 			}
 			continue
 		}
@@ -941,16 +964,12 @@ func (h *SectionHandler) saveProfileOverrides(ctx context.Context, q SectionOver
 		if err := rec.Validate(cfg); err != nil {
 			return apiError(http.StatusBadRequest, "invalid_config", err.Error())
 		}
-		kind := traktSectionKind(cfg)
-		if kind != "" && o.ID == "" {
-			return apiError(http.StatusBadRequest, "unsupported_source", "new Trakt-backed sections are not supported")
-		}
-		if o.ID != "" {
-			sourceWrites[o.ID] = traktWrite{sectionID: o.SectionID, kind: kind, config: append(json.RawMessage(nil), cfg...), active: !o.Hidden && !o.Removed}
-		}
-		if recipeType == string(sections.SectionTrendingDiscover) && !o.Hidden && !o.Removed && !isTraktBackedSection(recipeType, cfg) {
+		if recipeType == string(sections.SectionTrendingDiscover) && !o.Hidden && !o.Removed {
 			refreshCandidates = append(refreshCandidates, trendingCandidate{id: o.ID, config: append(json.RawMessage(nil), cfg...)})
 		}
+		if recipeType == string(sections.SectionSeasonalThemed) && !o.Hidden && !o.Removed {
+			seasonalConfigs = append(seasonalConfigs, append(json.RawMessage(nil), cfg...))
+		}
 	}
 
 	if h.StoreProvider == nil {
@@ -968,45 +987,12 @@ func (h *SectionHandler) saveProfileOverrides(ctx context.Context, q SectionOver
 	for _, override := range existing {
 		existingByID[override.ID] = override
 	}
-	if err := h.rejectLegacyTraktReactivationByRemoval(ctx, existing, retainedSectionIDs); err != nil {
-		return err
-	}
 	for id, recipeType := range keptAdminOnly {
 		old, ok := existingByID[id]
 		if !ok || old.SectionID != "" || userAddedRecipe(old) != recipeType {
 			return adminOnlyRecipeError()
 		}
 	}
-	for id, write := range sourceWrites {
-		old, ok := existingByID[id]
-		if !ok && write.kind != "" && (write.sectionID == "" || write.active) {
-			return apiError(http.StatusBadRequest, "unsupported_source", "new Trakt-backed sections are not supported")
-		}
-		if !ok {
-			continue
-		}
-		oldConfig := json.RawMessage(old.Config)
-		if old.SectionID != "" {
-			base, found, err := loadBaseSection(old.SectionID)
-			if err != nil {
-				return err
-			}
-			if found && !hasSectionConfig(oldConfig) {
-				oldConfig = base.Config
-			}
-		} else if old.UserConfig != "" {
-			oldConfig = json.RawMessage(old.UserConfig)
-		}
-		oldKind := traktSectionKind(oldConfig)
-		if oldKind == "" && write.kind == "" {
-			continue
-		}
-		oldActive := !old.Hidden && !old.Removed
-		if oldKind == "" || oldKind != write.kind || old.SectionID != write.sectionID || !jsonConfigEqual(oldConfig, write.config) || (!oldActive && write.active) {
-			return apiError(http.StatusBadRequest, "legacy_source_immutable", "legacy Trakt section sources cannot be changed or reactivated")
-		}
-	}
-
 	refreshConfigsByKey := make(map[string]json.RawMessage, len(refreshCandidates))
 	for _, candidate := range refreshCandidates {
 		key := sections.CanonicalTrendingConfigKey(candidate.config)
@@ -1075,52 +1061,13 @@ func (h *SectionHandler) saveProfileOverrides(ctx context.Context, q SectionOver
 		for _, config := range refreshConfigsByKey {
 			config := config
 			go func() {
-				refreshCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 2*time.Minute)
+				refreshCtx, cancel := context.WithTimeout(queryattr.Detach(context.WithoutCancel(ctx)), 2*time.Minute)
 				defer cancel()
 				h.TrendingRefresher.RefreshConfig(refreshCtx, config)
 			}()
 		}
 	}
-	return nil
-}
-
-// rejectLegacyTraktReactivationByRemoval checks linked overrides that a full
-// replacement (or reset) would delete. Removing an override is allowed unless
-// it would newly expose an enabled legacy Trakt base section.
-func (h *SectionHandler) rejectLegacyTraktReactivationByRemoval(ctx context.Context, existing []userstore.SectionOverride, retainedSectionIDs map[string]string) error {
-	if h.sectionReader == nil {
-		return nil
-	}
-	for _, old := range existing {
-		if retainedSectionIDs != nil {
-			if sectionID, retained := retainedSectionIDs[old.ID]; retained && sectionID == old.SectionID {
-				continue
-			}
-		}
-		if old.SectionID == "" {
-			continue
-		}
-		base, err := h.sectionReader.GetByID(ctx, old.SectionID)
-		if errors.Is(err, sections.ErrSectionNotFound) {
-			continue
-		}
-		if err != nil {
-			return apiError(http.StatusInternalServerError, "internal_error", "Failed to load section")
-		}
-		if !base.Enabled || !isTraktBackedSection(string(base.SectionType), base.Config) {
-			continue
-		}
-
-		oldConfig := json.RawMessage(old.Config)
-		if !hasSectionConfig(oldConfig) {
-			oldConfig = base.Config
-		}
-		oldActive := !old.Hidden && !old.Removed
-		if oldActive && traktSectionKind(oldConfig) != "" && jsonConfigEqual(oldConfig, base.Config) {
-			continue
-		}
-		return apiError(http.StatusBadRequest, "legacy_source_immutable", "legacy Trakt section sources cannot be changed or reactivated")
-	}
+	h.refreshSeasonalLists(ctx, seasonalConfigs...)
 	return nil
 }
 
@@ -1162,13 +1109,6 @@ func (h *SectionHandler) resetProfileOverrides(ctx context.Context, q SectionOve
 	if err != nil {
 		return apiError(http.StatusInternalServerError, "internal_error", "Failed to access user store")
 	}
-	existing, err := store.ListSectionOverrides(ctx, q.ProfileID, q.Scope, q.LibraryID)
-	if err != nil {
-		return apiError(http.StatusInternalServerError, "internal_error", "Failed to load overrides")
-	}
-	if err := h.rejectLegacyTraktReactivationByRemoval(ctx, existing, nil); err != nil {
-		return err
-	}
 	if err := store.ResetSectionOverrides(ctx, q.ProfileID, q.Scope, q.LibraryID); err != nil {
 		return apiError(http.StatusInternalServerError, "internal_error", "Failed to reset overrides")
 	}
@@ -1367,19 +1307,19 @@ type sectionItemImageURLs struct {
 // already-validated library scope of library-scoped endpoints (nil for the
 // home/profile surfaces) so play-target resolution stays scoped to it.
 func (h *SectionHandler) buildSectionsResponse(r *http.Request, withItems []sections.SectionWithItems, libraryID *int) homeSectionsResponse {
-	return h.buildSections(r.Context(), withItems, libraryID, requestAccessFilter(r), requestImageSize(r))
+	return h.buildSections(r.Context(), withItems, libraryID, requestAccessFilter(r), requestArtwork(r))
 }
 
 // buildSections renders sections for a viewer described by its context,
 // access filter and artwork size; it is what v1 and v2 share.
-func (h *SectionHandler) buildSections(ctx context.Context, withItems []sections.SectionWithItems, libraryID *int, viewerAccess catalog.AccessFilter, size imagesize.Size) homeSectionsResponse {
-	return h.buildSectionsWithUserStates(ctx, withItems, libraryID, viewerAccess, size, nil)
+func (h *SectionHandler) buildSections(ctx context.Context, withItems []sections.SectionWithItems, libraryID *int, viewerAccess catalog.AccessFilter, art imagesize.Request) homeSectionsResponse {
+	return h.buildSectionsWithUserStates(ctx, withItems, libraryID, viewerAccess, art, nil)
 }
 
 // buildSectionsWithUserStates is buildSections reusing user states the caller
 // already loaded for these items (the Home hide-watched filter does); nil
 // loads them as buildSections does.
-func (h *SectionHandler) buildSectionsWithUserStates(ctx context.Context, withItems []sections.SectionWithItems, libraryID *int, viewerAccess catalog.AccessFilter, size imagesize.Size, knownUserStates map[string]*itemUserStateResponse) homeSectionsResponse {
+func (h *SectionHandler) buildSectionsWithUserStates(ctx context.Context, withItems []sections.SectionWithItems, libraryID *int, viewerAccess catalog.AccessFilter, art imagesize.Request, knownUserStates map[string]*itemUserStateResponse) homeSectionsResponse {
 	deduplicateSectionItems(ctx, withItems)
 
 	contentIDs := make([]string, 0)
@@ -1405,7 +1345,7 @@ func (h *SectionHandler) buildSectionsWithUserStates(ctx context.Context, withIt
 	// These lookups read shared inputs and own separate results. Wait before
 	// assembling cards so v1 and v2 both pay the slowest lookup, not their sum.
 	overlaySummaries := make(map[string]*models.OverlaySummary)
-	playTargets := map[string]string{}
+	var playTargets map[string]string
 	var userStates map[string]*itemUserStateResponse
 	var imageURLs map[sectionItemImageKey]sectionItemImageURLs
 	var episodeMeta map[string]sections.SectionItemMeta
@@ -1425,45 +1365,22 @@ func (h *SectionHandler) buildSectionsWithUserStates(ctx context.Context, withIt
 		overlaySummaries = summaries
 	})
 
-	wg.Go(func() {
-		if h.playableTargets == nil {
-			return
-		}
-		inputs := make([]catalog.PlayableTargetInput, 0, len(allItems))
-		for _, item := range allItems {
-			if item == nil || item.ContentID == "" {
-				continue
-			}
-			// Section items can come from the process-global resolved-list
-			// cache, so their hint is profile-independent: the resolver
-			// validates it instead of the response emitting it directly.
-			inputs = append(inputs, playableTargetInputForItem(item))
-		}
-		var libraryIDs []int
-		if libraryID != nil && *libraryID > 0 {
-			libraryIDs = []int{*libraryID}
-		}
-		resolvedTargets, err := h.playableTargets.ResolvePlayableTargets(ctx, catalog.PlayableTargetQuery{
-			UserID:        apimw.GetUserID(ctx),
-			ProfileID:     apimw.GetProfileID(ctx),
-			LibraryIDs:    libraryIDs,
-			Access:        viewerAccess,
-			Items:         inputs,
-			ProgressStore: h.sectionProgressStore(ctx),
-		})
-		if err != nil {
-			slog.WarnContext(ctx, "resolving section playable targets", "component", "api", "error", err)
-			return
-		}
-		playTargets = resolvedTargets
-	})
+	wg.Go(func() { playTargets = h.resolveSectionPlayableTargets(ctx, allItems, libraryID, viewerAccess) })
 
 	if knownUserStates != nil {
 		userStates = knownUserStates
 	} else {
 		wg.Go(func() { userStates = h.listSectionItemUserStates(ctx, allItems) })
 	}
-	wg.Go(func() { imageURLs = h.resolveSectionItemImageURLs(ctx, withItems, size) })
+	// localizedItems lines up with allItems: a content ID can sit in several
+	// rows with different artwork, so each row keeps its own clone.
+	var localizedItems []*models.MediaItem
+	var pendingTranslations map[string]string
+	localizationAccess := sectionLocalizationAccess(viewerAccess, libraryID)
+	wg.Go(func() {
+		localizedItems, pendingTranslations = h.localizeSectionItems(ctx, allItems, localizationAccess)
+	})
+	wg.Go(func() { imageURLs = h.resolveSectionItemImageURLs(ctx, withItems, art) })
 	wg.Go(func() { episodeMeta = h.listSectionEpisodeItemMeta(ctx, withItems, viewerAccess) })
 	wg.Go(func() { mangaChapterMeta = h.listSectionMangaChapterItemMeta(ctx, allItems) })
 
@@ -1472,33 +1389,20 @@ func (h *SectionHandler) buildSectionsWithUserStates(ctx context.Context, withIt
 	resp := homeSectionsResponse{
 		Sections: make([]resolvedSectionResponse, 0, len(withItems)),
 	}
+	position := 0
 	for _, s := range withItems {
 		items := make([]sectionItemResponse, 0, len(s.Items))
 		for _, item := range s.Items {
-			var meta *sections.SectionItemMeta
-			if s.ItemMeta != nil {
-				if value, ok := s.ItemMeta[item.ContentID]; ok {
-					meta = &value
-				}
-			}
-			if meta == nil {
-				if value, ok := episodeMeta[item.ContentID]; ok {
-					meta = &value
-				}
-			}
-			// Manga chapters carry their series linkage on top of whatever
-			// meta (e.g. reading progress) the section already resolved, so
-			// continue-reading cards can head to the series.
-			if value, ok := mangaChapterMeta[item.ContentID]; ok {
-				if meta == nil {
-					empty := sections.SectionItemMeta{}
-					meta = &empty
-				}
-				meta.SeriesID = value.SeriesID
-				meta.SeriesTitle = value.SeriesTitle
+			card := item
+			if position < len(localizedItems) && localizedItems[position] != nil {
+				card = localizedItems[position]
 			}
+			position++
+			meta := sectionCardMeta(s, item.ContentID, episodeMeta, mangaChapterMeta)
 			imageKey := sectionItemImageKey{sectionID: s.ID, contentID: item.ContentID}
-			items = append(items, h.toSectionItemResponse(s.SectionType, item, meta, overlaySummaries[item.ContentID], userStates[item.ContentID], imageURLs[imageKey], playTargets[playableTargetKeyForItem(item)]))
+			response := h.toSectionItemResponse(s.SectionType, card, meta, overlaySummaries[item.ContentID], userStates[item.ContentID], imageURLs[imageKey], playTargets[playableTargetKeyForItem(item)])
+			response.PendingTranslationLanguage = pendingTranslations[item.ContentID]
+			items = append(items, response)
 		}
 		resp.Sections = append(resp.Sections, resolvedSectionResponse{
 			ID:          s.ID,
@@ -1515,6 +1419,69 @@ func (h *SectionHandler) buildSectionsWithUserStates(ctx context.Context, withIt
 	return resp
 }
 
+// resolveSectionPlayableTargets resolves the play target of every section
+// card, or nil when there is no resolver or resolution fails.
+func (h *SectionHandler) resolveSectionPlayableTargets(ctx context.Context, allItems []*models.MediaItem, libraryID *int, viewerAccess catalog.AccessFilter) map[string]string {
+	if h.playableTargets == nil {
+		return nil
+	}
+	inputs := make([]catalog.PlayableTargetInput, 0, len(allItems))
+	for _, item := range allItems {
+		if item == nil || item.ContentID == "" {
+			continue
+		}
+		// Section items can come from the process-global resolved-list
+		// cache, so their hint is profile-independent: the resolver
+		// validates it instead of the response emitting it directly.
+		inputs = append(inputs, playableTargetInputForItem(item))
+	}
+	var libraryIDs []int
+	if libraryID != nil && *libraryID > 0 {
+		libraryIDs = []int{*libraryID}
+	}
+	resolvedTargets, err := h.playableTargets.ResolvePlayableTargets(ctx, catalog.PlayableTargetQuery{
+		UserID:        apimw.GetUserID(ctx),
+		ProfileID:     apimw.GetProfileID(ctx),
+		LibraryIDs:    libraryIDs,
+		Access:        viewerAccess,
+		Items:         inputs,
+		ProgressStore: h.sectionProgressStore(ctx),
+	})
+	if err != nil {
+		slog.Log(ctx, ctxerr.LogLevel(ctx, err, slog.LevelWarn), "resolving section playable targets", "component", "api", "error", err)
+		return nil
+	}
+	return resolvedTargets
+}
+
+// sectionCardMeta is a section card's item meta: the section's own, else the
+// episode meta, with a manga chapter's series linkage laid on top.
+func sectionCardMeta(section sections.SectionWithItems, contentID string, episodeMeta, mangaChapterMeta map[string]sections.SectionItemMeta) *sections.SectionItemMeta {
+	var meta *sections.SectionItemMeta
+	if section.ItemMeta != nil {
+		if value, ok := section.ItemMeta[contentID]; ok {
+			meta = &value
+		}
+	}
+	if meta == nil {
+		if value, ok := episodeMeta[contentID]; ok {
+			meta = &value
+		}
+	}
+	// Manga chapters carry their series linkage on top of whatever meta (e.g.
+	// reading progress) the section already resolved, so continue-reading
+	// cards can head to the series.
+	if value, ok := mangaChapterMeta[contentID]; ok {
+		if meta == nil {
+			empty := sections.SectionItemMeta{}
+			meta = &empty
+		}
+		meta.SeriesID = value.SeriesID
+		meta.SeriesTitle = value.SeriesTitle
+	}
+	return meta
+}
+
 // deduplicateSectionItems enforces the wire-level invariant that a non-empty
 // content ID appears at most once within one section. Invalid cards are dropped
 // because downstream enrichment and keyed client layouts require a usable
@@ -1649,60 +1616,58 @@ func (h *SectionHandler) listSectionEpisodeItemMeta(ctx context.Context, withIte
 	return meta
 }
 
-func (h *SectionHandler) resolveSectionItemImageURLs(ctx context.Context, withItems []sections.SectionWithItems, size imagesize.Size) map[sectionItemImageKey]sectionItemImageURLs {
-	result := make(map[sectionItemImageKey]sectionItemImageURLs)
+func (h *SectionHandler) resolveSectionItemImageURLs(ctx context.Context, withItems []sections.SectionWithItems, art imagesize.Request) map[sectionItemImageKey]sectionItemImageURLs {
 	if h.DetailSvc == nil {
-		return result
+		return map[sectionItemImageKey]sectionItemImageURLs{}
 	}
-
-	type pendingImages struct {
-		key          sectionItemImageKey
-		posterPath   string
-		backdropPath string
-		logoPath     string
-	}
-
-	pending := make([]pendingImages, 0)
-	paths := make([]string, 0)
-	seenPaths := make(map[string]struct{})
-	addPath := func(path string) {
-		if path == "" || path == "-" {
-			return
-		}
-		if _, ok := seenPaths[path]; ok {
-			return
-		}
-		seenPaths[path] = struct{}{}
-		paths = append(paths, path)
-	}
-
+	cards := make([]featuredArtworkCard[sectionItemImageKey], 0)
 	for _, section := range withItems {
 		for _, item := range section.Items {
 			if item == nil {
 				continue
 			}
-			images := pendingImages{
-				key: sectionItemImageKey{
-					sectionID: section.ID,
-					contentID: item.ContentID,
-				},
-				posterPath:   sizedPosterPath(item.PosterPath, size),
-				backdropPath: sizedSectionBackdropPath(section.SectionType, item.BackdropPath, size),
-				logoPath:     sizedFeaturedLogoPath(item.LogoPath, size),
-			}
-			pending = append(pending, images)
-			addPath(images.posterPath)
-			addPath(images.backdropPath)
-			addPath(images.logoPath)
-		}
-	}
-
-	resolved := h.DetailSvc.PresignURLsWithExpiry(ctx, paths, requestVariantHint("featured", size))
-	for _, images := range pending {
-		result[images.key] = sectionItemImageURLs{
-			posterURL:   resolved[images.posterPath].URL,
-			backdropURL: resolved[images.backdropPath].URL,
-			logoURL:     resolved[images.logoPath].URL,
+			cards = append(cards, featuredArtworkCard[sectionItemImageKey]{
+				key:         sectionItemImageKey{sectionID: section.ID, contentID: item.ContentID},
+				item:        item,
+				sectionType: section.SectionType,
+			})
+		}
+	}
+	return resolveFeaturedArtwork(ctx, h.DetailSvc, cards, art)
+}
+
+// featuredArtworkCard is one card on a featured surface whose artwork is
+// resolved in a batch, keyed however the surface looks it up.
+type featuredArtworkCard[K comparable] struct {
+	key         K
+	item        *models.MediaItem
+	sectionType sections.SectionType
+}
+
+// resolveFeaturedArtwork resolves every card's poster, backdrop and logo
+// together, each slot at the request's size or target width for it: cached
+// keys in one batch and plugin-hosted art once per slot hint (see
+// catalog.ArtworkBatch). Home and library sections and recommendations share
+// it so a title's card artwork is the same file on every featured surface.
+func resolveFeaturedArtwork[K comparable](ctx context.Context, svc catalog.ArtworkPresigner, cards []featuredArtworkCard[K], art imagesize.Request) map[K]sectionItemImageURLs {
+	posterHint := requestVariantHint("featured", art.For(imagesize.SlotPoster))
+	backdropHint := requestVariantHint("featured", art.For(imagesize.SlotBackdrop))
+	logoHint := requestVariantHint("featured", art.For(imagesize.SlotLogo))
+	var batch catalog.ArtworkBatch
+	pending := make([]featuredArtworkPaths, len(cards))
+	for i, card := range cards {
+		pending[i] = featuredItemArtworkPaths(card.item, card.sectionType, art)
+		batch.Add(pending[i].posterPath, posterHint)
+		batch.Add(pending[i].backdropPath, backdropHint)
+		batch.Add(pending[i].logoPath, logoHint)
+	}
+	resolved := batch.Resolve(ctx, svc, requestVariantHint("featured", art.Size))
+	result := make(map[K]sectionItemImageURLs, len(cards))
+	for i, card := range cards {
+		result[card.key] = sectionItemImageURLs{
+			posterURL:   resolved.Get(pending[i].posterPath, posterHint).URL,
+			backdropURL: resolved.Get(pending[i].backdropPath, backdropHint).URL,
+			logoURL:     resolved.Get(pending[i].logoPath, logoHint).URL,
 		}
 	}
 	return result
@@ -1739,6 +1704,8 @@ func (h *SectionHandler) toSectionItemResponse(sectionType sections.SectionType,
 		BackdropIsEpisodeStill: item.BackdropIsEpisodeStill,
 		OverlaySummary:         overlaySummary,
 		UserState:              userState,
+
+		MachineTranslatedFields: item.MachineTranslatedFields,
 	}
 	if meta != nil {
 		if item.Type == "episode" && item.PosterIsEpisodeStill == nil && meta.EpisodeStillPath != nil {
@@ -1775,12 +1742,59 @@ func (h *SectionHandler) toSectionItemResponse(sectionType sections.SectionType,
 	return resp
 }
 
+// sectionLocalizationAccess scopes a library's rows to that library, so its
+// cards localize like a detail page opened there: a profile without a
+// metadata language falls back to the library's. Home rows stay unscoped.
+func sectionLocalizationAccess(viewerAccess catalog.AccessFilter, libraryID *int) catalog.AccessFilter {
+	if libraryID != nil && *libraryID > 0 {
+		id := *libraryID
+		viewerAccess.PresentationLibraryID = &id
+	}
+	return viewerAccess
+}
+
+// localizeSectionItems localizes the section cards for the viewer in one
+// batch and returns the clones in input order. Section items are shared across
+// profiles (the resolved-list cache is process-global), so localized clones
+// are kept per request and never written back. A failure keeps the base text:
+// localization must not fail Home.
+func (h *SectionHandler) localizeSectionItems(ctx context.Context, items []*models.MediaItem, viewerAccess catalog.AccessFilter) ([]*models.MediaItem, map[string]string) {
+	if h == nil || h.DetailSvc == nil || len(items) == 0 {
+		return nil, nil
+	}
+	localized, pending, err := h.DetailSvc.LocalizeSectionItems(ctx, items, withProfileMetadataLanguage(ctx, viewerAccess))
+	if err != nil {
+		slog.Log(ctx, ctxerr.LogLevel(ctx, err, slog.LevelWarn), "localizing section items", "component", "api", "error", err)
+		return nil, nil
+	}
+	return localized, pending
+}
+
 // sizedSectionBackdropPath applies the request's image size to a section
 // backdrop. An explicit size wins over the per-section default, including the
 // Continue Watching / Next Up special case below: a client that asked for one
 // size gets that size in every row.
 func sizedSectionBackdropPath(sectionType sections.SectionType, path string, size imagesize.Size) string {
-	return sizedImagePath(path, imageTypeForBackdropPath(path), size, sectionBackdropPath(sectionType, path))
+	return sizedImagePath(path, artworkkey.ImageBackdrop, size, sectionBackdropPath(sectionType, path))
+}
+
+// featuredArtworkPaths are an item card's poster, backdrop and logo keys on a
+// featured surface: home and library sections and recommendations.
+type featuredArtworkPaths struct {
+	posterPath   string
+	backdropPath string
+	logoPath     string
+}
+
+// featuredItemArtworkPaths sizes an item card's artwork for a featured surface,
+// each slot at the request's size or target width for it. sectionType picks the
+// unsized backdrop default; recommendations pass none.
+func featuredItemArtworkPaths(item *models.MediaItem, sectionType sections.SectionType, art imagesize.Request) featuredArtworkPaths {
+	return featuredArtworkPaths{
+		posterPath:   sizedPosterPath(item.PosterPath, art.For(imagesize.SlotPoster)),
+		backdropPath: sizedSectionBackdropPath(sectionType, item.BackdropPath, art.For(imagesize.SlotBackdrop)),
+		logoPath:     sizedFeaturedLogoPath(item.LogoPath, art.For(imagesize.SlotLogo)),
+	}
 }
 
 // sectionBackdropPath keeps featured-style backdrops for most sections, but
@@ -1936,3 +1950,16 @@ func (h *SectionHandler) HandleRestoreDefaults(w http.ResponseWriter, r *http.Re
 func (h *SectionHandler) canResetAllSectionProfileOverrides() bool {
 	return h.repo.CanResetAllProfileOverrides(h.StoreProvider)
 }
+
+func jsonConfigEqual(left, right json.RawMessage) bool {
+	var leftValue, rightValue any
+	if json.Unmarshal(left, &leftValue) == nil && json.Unmarshal(right, &rightValue) == nil {
+		return reflect.DeepEqual(leftValue, rightValue)
+	}
+	return bytes.Equal(bytes.TrimSpace(left), bytes.TrimSpace(right))
+}
+
+func hasSectionConfig(config json.RawMessage) bool {
+	trimmed := bytes.TrimSpace(config)
+	return len(trimmed) > 0 && !bytes.Equal(trimmed, []byte("null"))
+}
diff --git a/internal/api/handlers/sections_concurrency_test.go b/internal/api/handlers/sections_concurrency_test.go
index a4a4ddb5fd..4a2a15fdbb 100644
--- a/internal/api/handlers/sections_concurrency_test.go
+++ b/internal/api/handlers/sections_concurrency_test.go
@@ -52,7 +52,7 @@ func TestBuildSectionsEnrichesConcurrentlyForViewer(t *testing.T) {
 	response := handler.buildSections(ctx, []sections.SectionWithItems{{
 		ResolvedSection: sections.ResolvedSection{ID: "row", SectionType: sections.SectionRecentlyAdded},
 		Items:           []*models.MediaItem{{ContentID: "episode", Type: "episode", Title: "Episode"}},
-	}}, new(3), access, imagesize.Unset)
+	}}, new(3), access, imagesize.Request{})
 	if err := ctx.Err(); err != nil {
 		t.Fatalf("enrichment did not finish concurrently: %v", err)
 	}
diff --git a/internal/api/handlers/sections_home_watched_test.go b/internal/api/handlers/sections_home_watched_test.go
index fa8c99b960..2d82913b34 100644
--- a/internal/api/handlers/sections_home_watched_test.go
+++ b/internal/api/handlers/sections_home_watched_test.go
@@ -286,7 +286,7 @@ func TestHomePreferenceFiltersOnlyHomeResponses(t *testing.T) {
 	}
 	resolved := []sections.ResolvedSection{sectionItems[0].ResolvedSection}
 	prepared, states := handler.filterWatchedHomeSections(ctx, sectionItems, resolved)
-	home := handler.buildSectionsWithUserStates(ctx, prepared, nil, requestAccessFilter(req), requestImageSize(req), states)
+	home := handler.buildSectionsWithUserStates(ctx, prepared, nil, requestAccessFilter(req), requestArtwork(req), states)
 	if got := home.Sections[0].Items; len(got) != 1 || got[0].ContentID != "unwatched" {
 		t.Fatalf("Home response items = %#v, want only unwatched", got)
 	}
diff --git a/internal/api/handlers/sections_test.go b/internal/api/handlers/sections_test.go
index b38fbebf99..174b7623ad 100644
--- a/internal/api/handlers/sections_test.go
+++ b/internal/api/handlers/sections_test.go
@@ -57,13 +57,13 @@ func TestSectionBackdropPathUsesExpectedVariants(t *testing.T) {
 			want:        "/tmdb/shows/1399/backdrop/w1920.jpg",
 		},
 		{
-			name:        "continue watching episode still clamps to w500",
+			name:        "continue watching episode still gets its widest rung (w500)",
 			sectionType: sections.SectionContinueWatching,
 			path:        "tvdb/series/73141/seasons/22/episodes/9/still/original.webp",
 			want:        "tvdb/series/73141/seasons/22/episodes/9/still/w500.webp",
 		},
 		{
-			name:        "featured section episode still clamps to w500",
+			name:        "featured section episode still clamps to its widest rung",
 			sectionType: sections.SectionRecentlyAdded,
 			path:        "tvdb/series/73141/seasons/22/episodes/9/still/original.webp",
 			want:        "tvdb/series/73141/seasons/22/episodes/9/still/w500.webp",
@@ -895,3 +895,18 @@ func TestToSectionOverridesPropagatesUserAddedFields(t *testing.T) {
 		t.Errorf("legacy customization leaked user-added fields: %+v", got[1])
 	}
 }
+
+func TestSectionLocalizationAccessScopesLibraryRows(t *testing.T) {
+	viewer := catalog.AccessFilter{ProfilePreferredLanguage: ""}
+	libraryID := 7
+	scoped := sectionLocalizationAccess(viewer, &libraryID)
+	if scoped.PresentationLibraryID == nil || *scoped.PresentationLibraryID != 7 {
+		t.Fatalf("library rows: PresentationLibraryID = %v, want 7", scoped.PresentationLibraryID)
+	}
+	if viewer.PresentationLibraryID != nil {
+		t.Fatal("the viewer's filter was modified")
+	}
+	if home := sectionLocalizationAccess(viewer, nil); home.PresentationLibraryID != nil {
+		t.Fatalf("home rows: PresentationLibraryID = %v, want nil", *home.PresentationLibraryID)
+	}
+}
diff --git a/internal/api/handlers/session_ws.go b/internal/api/handlers/session_ws.go
index d4ca05f782..7bdb3c4379 100644
--- a/internal/api/handlers/session_ws.go
+++ b/internal/api/handlers/session_ws.go
@@ -199,10 +199,53 @@ func (h *PlaybackHandler) handleRealtimeClientMessage(sessionID string, data []b
 		}
 		switch record.Name {
 		case playback.CommandStop, playback.CommandTerminate:
-			err := h.stopPlaybackSessionByID(context.Background(), sessionID, true)
-			if err != nil && !errors.Is(err, playback.ErrSessionNotFound) {
-				slog.Error("failed to stop playback after realtime completion", "session", sessionID, "playback_session_id", sessionID, "error", err)
+			ctx := context.Background()
+			session, err := func() (*playback.Session, error) {
+				unlock := h.tm.LockSessionLifecycle(sessionID)
+				defer unlock()
+				session, err := h.sessionMgr.GetSession(sessionID)
+				if err != nil {
+					return nil, err
+				}
+				session, err = h.endPlaybackSessionAuthority(ctx, session, true)
+				if err == nil {
+					h.cleanupStoppedSessionTransport(ctx, session)
+				}
+				return session, err
+			}()
+			if err != nil {
+				if !errors.Is(err, playback.ErrSessionNotFound) {
+					slog.Error("failed to stop playback after realtime completion", "session", sessionID, "playback_session_id", sessionID, "error", err)
+				}
+				return nil
+			}
+			// Stop authority and transport immediately. Only provider/history
+			// finalization waits for an in-flight pause or resume scrobble.
+			h.runRealtimeResult(sessionID, false, func() {
+				h.cancelPlaybackStartSideEffectsV3(ctx, session.ID)
+				h.recordRealtimeStoppedSession(ctx, session)
+				h.syncSessionsNow(ctx, "stop")
+			})
+		case playback.CommandPause, playback.CommandUnpause:
+			// The player confirmed the new state; show it now instead of after
+			// its next progress report, up to ten seconds later.
+			paused := record.Name == playback.CommandPause
+			// The sequence must be read at receipt, on this reader. Keep the
+			// read well inside the default command deadline so a stalled
+			// store cannot hold back the next command's result and trigger
+			// its fallback stop; the next progress report recovers state.
+			ctx, cancel := context.WithTimeout(context.Background(), realtimeReceiptReadBudget)
+			attempt, err := h.realtimeProgressAttempt(ctx, sessionID)
+			cancel()
+			if err != nil {
+				slog.Warn("failed to read progress sequence at realtime confirmation", "session", sessionID, "error", err)
+				return nil
+			}
+			var sequence int64
+			if attempt != nil {
+				sequence = attempt.LastSequence
 			}
+			h.runRealtimeResult(sessionID, true, func() { h.setConfirmedPauseState(sessionID, paused, sequence) })
 		case playback.CommandPlanInvalidated:
 			// Completion means the client replanned itself; the session stays
 			// alive on its replacement plan and nothing else is required here.
diff --git a/internal/api/handlers/session_ws_pause_state_test.go b/internal/api/handlers/session_ws_pause_state_test.go
new file mode 100644
index 0000000000..d6282f7994
--- /dev/null
+++ b/internal/api/handlers/session_ws_pause_state_test.go
@@ -0,0 +1,858 @@
+package handlers
+
+import (
+	"context"
+	"errors"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+
+	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/playback"
+	"github.com/prairie-server/prairie-server/internal/watchsync"
+)
+
+// waitConfirmedPauseStates waits until the session's queued confirmed pause
+// and resume results have been applied.
+func waitConfirmedPauseStates(t *testing.T, h *PlaybackHandler, sessionID string) {
+	t.Helper()
+	h.realtimeResultMu.Lock()
+	queue := h.realtimeResultQueues[sessionID]
+	h.realtimeResultMu.Unlock()
+	if queue == nil {
+		return
+	}
+	select {
+	case <-queue.done:
+	case <-time.After(5 * time.Second):
+		t.Fatal("confirmed pause state was not applied")
+	}
+}
+
+// A pause or resume the player confirms is the session's state at once, so
+// the admin views do not wait for the next progress report; a rejected
+// command changes nothing.
+func TestRealtimeConfirmedPauseAndResumeSetSessionState(t *testing.T) {
+	sessionMgr := playback.NewSessionManager(0, 0)
+	handler := NewPlaybackHandler(sessionMgr)
+	handler.CommandTracker = playback.NewCommandTracker()
+	defer handler.CommandTracker.Close()
+
+	session, err := sessionMgr.StartSession(1, "profile-1", 100, playback.PlayDirect, false)
+	if err != nil {
+		t.Fatalf("StartSession: %v", err)
+	}
+	paused := func() bool {
+		t.Helper()
+		current, err := sessionMgr.GetSession(session.ID)
+		if err != nil {
+			t.Fatalf("GetSession: %v", err)
+		}
+		return current.IsPaused
+	}
+	send := func(commandID string, name playback.CommandName, status playback.RealtimeResultStatus) {
+		t.Helper()
+		handler.rememberRealtimeCommand(commandID, session.ID, name)
+		if err := handler.handleRealtimeClientMessage(session.ID, realtimeResultMessage(t, session.ID, commandID, status)); err != nil {
+			t.Fatalf("handleRealtimeClientMessage: %v", err)
+		}
+		waitConfirmedPauseStates(t, handler, session.ID)
+	}
+
+	send("cmd-pause-rejected", playback.CommandPause, playback.RealtimeResultStatusRejected)
+	if paused() {
+		t.Fatal("a rejected pause paused the session")
+	}
+	send("cmd-pause", playback.CommandPause, playback.RealtimeResultStatusCompleted)
+	if !paused() {
+		t.Fatal("a confirmed pause left the session playing")
+	}
+	send("cmd-resume", playback.CommandUnpause, playback.RealtimeResultStatusCompleted)
+	if paused() {
+		t.Fatal("a confirmed resume left the session paused")
+	}
+}
+
+// A confirmed pause or resume sends the watch-provider transition itself; a
+// progress report that follows sees no change and must not send it again.
+func TestRealtimeConfirmedPauseAndResumeScrobbleOnce(t *testing.T) {
+	file := &models.MediaFile{ID: 42, ContentID: "movie-1", Duration: 3600}
+	sessionMgr := playback.NewSessionManager(0, 0)
+	handler := NewPlaybackHandler(sessionMgr, testPlaybackFileResolver{file: file})
+	handler.CommandTracker = playback.NewCommandTracker()
+	defer handler.CommandTracker.Close()
+	scrobbler := &recordingPlaybackWatchScrobbler{}
+	handler.WatchScrobbler = scrobbler
+
+	session, err := sessionMgr.StartSession(1, "profile-1", file.ID, playback.PlayDirect, false)
+	if err != nil {
+		t.Fatalf("StartSession: %v", err)
+	}
+	send := func(commandID string, name playback.CommandName) {
+		t.Helper()
+		handler.rememberRealtimeCommand(commandID, session.ID, name)
+		if err := handler.handleRealtimeClientMessage(session.ID, realtimeResultMessage(t, session.ID, commandID, playback.RealtimeResultStatusCompleted)); err != nil {
+			t.Fatalf("handleRealtimeClientMessage: %v", err)
+		}
+		waitConfirmedPauseStates(t, handler, session.ID)
+	}
+
+	send("cmd-pause", playback.CommandPause)
+	handler.writeProgressSideEffectsV2(context.Background(), nil, session.ID, playback.ProgressSampleV3{Sequence: 1, Position: 30, IsPaused: true})
+	if len(scrobbler.pauses) != 1 || len(scrobbler.starts) != 0 {
+		t.Fatalf("after pause: pauses = %d, starts = %d, want 1, 0", len(scrobbler.pauses), len(scrobbler.starts))
+	}
+	send("cmd-resume", playback.CommandUnpause)
+	handler.writeProgressSideEffectsV2(context.Background(), nil, session.ID, playback.ProgressSampleV3{Sequence: 2, Position: 31})
+	if len(scrobbler.pauses) != 1 || len(scrobbler.starts) != 1 {
+		t.Fatalf("after resume: pauses = %d, starts = %d, want 1, 1", len(scrobbler.pauses), len(scrobbler.starts))
+	}
+}
+
+// blockingPauseScrobbler holds every pause scrobble until released, like a
+// provider whose token refresh is slow.
+type blockingPauseScrobbler struct {
+	release chan struct{}
+	entered chan struct{}
+	mu      sync.Mutex
+	actions []string
+}
+
+func (s *blockingPauseScrobbler) record(action string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.actions = append(s.actions, action)
+}
+
+func (s *blockingPauseScrobbler) ScrobbleStart(context.Context, watchsync.ScrobbleEvent) error {
+	s.record("start")
+	return nil
+}
+
+func (s *blockingPauseScrobbler) ScrobblePause(context.Context, watchsync.ScrobbleEvent) error {
+	if s.entered != nil {
+		close(s.entered)
+	}
+	<-s.release
+	s.record("pause")
+	return nil
+}
+
+func (s *blockingPauseScrobbler) ScrobbleStop(context.Context, watchsync.ScrobbleEvent) error {
+	s.record("stop")
+	return nil
+}
+
+// A slow watch-provider scrobble must not hold up the socket reader, and the
+// confirmed pause and resume still apply in the order the player sent them.
+func TestRealtimeConfirmedPauseDoesNotBlockReader(t *testing.T) {
+	file := &models.MediaFile{ID: 42, ContentID: "movie-1", Duration: 3600}
+	sessionMgr := playback.NewSessionManager(0, 0)
+	handler := NewPlaybackHandler(sessionMgr, testPlaybackFileResolver{file: file})
+	handler.CommandTracker = playback.NewCommandTracker()
+	defer handler.CommandTracker.Close()
+	scrobbler := &blockingPauseScrobbler{release: make(chan struct{})}
+	handler.WatchScrobbler = scrobbler
+
+	session, err := sessionMgr.StartSession(1, "profile-1", file.ID, playback.PlayDirect, false)
+	if err != nil {
+		t.Fatalf("StartSession: %v", err)
+	}
+	reader := make(chan error, 1)
+	go func() {
+		for _, cmd := range []struct {
+			id   string
+			name playback.CommandName
+		}{{"cmd-pause", playback.CommandPause}, {"cmd-resume", playback.CommandUnpause}} {
+			handler.rememberRealtimeCommand(cmd.id, session.ID, cmd.name)
+			if err := handler.handleRealtimeClientMessage(session.ID, realtimeResultMessage(t, session.ID, cmd.id, playback.RealtimeResultStatusCompleted)); err != nil {
+				reader <- err
+				return
+			}
+		}
+		reader <- nil
+	}()
+	select {
+	case err := <-reader:
+		if err != nil {
+			t.Fatalf("handleRealtimeClientMessage: %v", err)
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("the socket reader waited on the watch-provider scrobble")
+	}
+
+	close(scrobbler.release)
+	waitConfirmedPauseStates(t, handler, session.ID)
+	scrobbler.mu.Lock()
+	actions := append([]string(nil), scrobbler.actions...)
+	scrobbler.mu.Unlock()
+	if len(actions) != 2 || actions[0] != "pause" || actions[1] != "start" {
+		t.Fatalf("scrobbles = %v, want [pause start]", actions)
+	}
+	current, err := sessionMgr.GetSession(session.ID)
+	if err != nil {
+		t.Fatalf("GetSession: %v", err)
+	}
+	if current.IsPaused {
+		t.Fatal("session paused after a confirmed pause then resume")
+	}
+}
+
+// A stop ends session authority even while a provider call is blocked.
+// Pending resume state is discarded; provider finalization still runs last.
+func TestRealtimeConfirmedStopRevokesAuthorityBeforeProviderFinalization(t *testing.T) {
+	file := &models.MediaFile{ID: 42, ContentID: "movie-1", Duration: 3600}
+	sessionMgr := playback.NewSessionManager(0, 0)
+	handler := NewPlaybackHandler(sessionMgr, testPlaybackFileResolver{file: file})
+	handler.CommandTracker = playback.NewCommandTracker()
+	defer handler.CommandTracker.Close()
+	scrobbler := &blockingPauseScrobbler{release: make(chan struct{}), entered: make(chan struct{})}
+	handler.WatchScrobbler = scrobbler
+
+	session, err := sessionMgr.StartSession(1, "profile-1", file.ID, playback.PlayDirect, false)
+	if err != nil {
+		t.Fatalf("StartSession: %v", err)
+	}
+	release := sync.OnceFunc(func() { close(scrobbler.release) })
+	defer func() { release(); waitConfirmedPauseStates(t, handler, session.ID) }()
+	handler.rememberRealtimeCommand("cmd-pause", session.ID, playback.CommandPause)
+	if err := handler.handleRealtimeClientMessage(session.ID, realtimeResultMessage(t, session.ID, "cmd-pause", playback.RealtimeResultStatusCompleted)); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case <-scrobbler.entered:
+	case <-time.After(5 * time.Second):
+		t.Fatal("pause scrobble did not start")
+	}
+	reader := make(chan error, 1)
+	go func() {
+		for _, cmd := range []struct {
+			id   string
+			name playback.CommandName
+		}{{"cmd-resume", playback.CommandUnpause}, {"cmd-stop", playback.CommandStop}} {
+			handler.rememberRealtimeCommand(cmd.id, session.ID, cmd.name)
+			if err := handler.handleRealtimeClientMessage(session.ID, realtimeResultMessage(t, session.ID, cmd.id, playback.RealtimeResultStatusCompleted)); err != nil {
+				reader <- err
+				return
+			}
+		}
+		reader <- nil
+	}()
+	select {
+	case err := <-reader:
+		if err != nil {
+			t.Fatalf("handleRealtimeClientMessage: %v", err)
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("the socket reader waited on the watch-provider scrobble")
+	}
+	if _, err := sessionMgr.GetSession(session.ID); !errors.Is(err, playback.ErrSessionNotFound) {
+		t.Fatalf("confirmed stop left the session live while provider was blocked: %v", err)
+	}
+
+	scrobbler.mu.Lock()
+	if len(scrobbler.actions) != 0 {
+		t.Errorf("provider finalization ran before pause release: %v", scrobbler.actions)
+	}
+	scrobbler.mu.Unlock()
+	release()
+	waitConfirmedPauseStates(t, handler, session.ID)
+	scrobbler.mu.Lock()
+	actions := append([]string(nil), scrobbler.actions...)
+	scrobbler.mu.Unlock()
+	if len(actions) != 2 || actions[0] != "pause" || actions[1] != "stop" {
+		t.Fatalf("scrobbles = %v, want [pause stop]", actions)
+	}
+	if _, err := sessionMgr.GetSession(session.ID); err == nil {
+		t.Fatal("session still live after a confirmed stop")
+	}
+}
+
+func TestRealtimeConfirmationSurvivesAcceptedProgressReplay(t *testing.T) {
+	for _, paused := range []bool{true, false} {
+		name := "pause"
+		commandName := playback.CommandPause
+		if !paused {
+			name = "resume"
+			commandName = playback.CommandUnpause
+		}
+		t.Run(name, func(t *testing.T) {
+			f := newPlaybackServiceFixture(t)
+			f.handler.fileResolver = testPlaybackFileResolver{file: &models.MediaFile{ID: 100, ContentID: "movie-1", Duration: 3600}}
+			scrobbler := &recordingPlaybackWatchScrobbler{}
+			f.handler.WatchScrobbler = scrobbler
+			sample := PlaybackProgressCommand{Sequence: 1, Position: 30, IsPaused: !paused}
+			if _, err := f.handler.ApplyProgressV2(f.ctx, f.caller, f.session.ID, sample); err != nil {
+				t.Fatal(err)
+			}
+			f.handler.rememberRealtimeCommand("cmd-confirm", f.session.ID, commandName)
+			if err := f.handler.handleRealtimeClientMessage(f.session.ID, realtimeResultMessage(t, f.session.ID, "cmd-confirm", playback.RealtimeResultStatusCompleted)); err != nil {
+				t.Fatal(err)
+			}
+			waitConfirmedPauseStates(t, f.handler, f.session.ID)
+			pauseCount, startCount := len(scrobbler.pauses), len(scrobbler.starts)
+			receipt, err := f.handler.ApplyProgressV2(f.ctx, f.caller, f.session.ID, sample)
+			if err != nil || receipt.Outcome != PlaybackOutcomeReplayed {
+				t.Fatalf("replay = %+v, %v", receipt, err)
+			}
+			current, err := f.manager.GetSession(f.session.ID)
+			if err != nil || current.IsPaused != paused || current.Position != 30 {
+				t.Fatalf("replayed state = %+v, %v", current, err)
+			}
+			if len(scrobbler.pauses) != pauseCount || len(scrobbler.starts) != startCount {
+				t.Fatal("progress replay emitted another provider transition")
+			}
+			sample.Sequence = 2
+			sample.Position = 31
+			if _, err := f.handler.ApplyProgressV2(f.ctx, f.caller, f.session.ID, sample); err != nil {
+				t.Fatal(err)
+			}
+			current, err = f.manager.GetSession(f.session.ID)
+			if err != nil || current.IsPaused == paused || current.Position != 31 {
+				t.Fatalf("newer progress = %+v, %v", current, err)
+			}
+		})
+	}
+}
+
+func TestRealtimeResultQueueBoundsPendingPauseStates(t *testing.T) {
+	h := NewPlaybackHandler(playback.NewSessionManager(0, 0))
+	entered := make(chan struct{})
+	release := make(chan struct{})
+	released := sync.OnceFunc(func() { close(release) })
+	defer func() { released(); waitConfirmedPauseStates(t, h, "session-queue") }()
+	h.runRealtimeResult("session-queue", true, func() { close(entered); <-release })
+	select {
+	case <-entered:
+	case <-time.After(5 * time.Second):
+		t.Fatal("worker did not start")
+	}
+	var mu sync.Mutex
+	var applied []int
+	for i := range 1000 {
+		h.runRealtimeResult("session-queue", true, func() { mu.Lock(); applied = append(applied, i); mu.Unlock() })
+	}
+	h.realtimeResultMu.Lock()
+	count := len(h.realtimeResultQueues["session-queue"].pending)
+	h.realtimeResultMu.Unlock()
+	if count != maxPendingRealtimeResults {
+		t.Fatalf("pending results = %d", count)
+	}
+	terminal := make(chan struct{})
+	h.runRealtimeResult("session-queue", false, func() { close(terminal) })
+	// Results received after terminal authority was removed cannot replace
+	// the finalization, even when the pending queue is already full.
+	for range 100 {
+		h.runRealtimeResult("session-queue", true, func() { t.Error("late pause applied after terminal result") })
+	}
+	released()
+	waitConfirmedPauseStates(t, h, "session-queue")
+	select {
+	case <-terminal:
+	default:
+		t.Fatal("terminal finalization was dropped")
+	}
+	mu.Lock()
+	defer mu.Unlock()
+	if len(applied) != maxPendingRealtimeResults || applied[len(applied)-1] != 999 {
+		t.Fatalf("applied states = %v", applied)
+	}
+	for i := 1; i < len(applied); i++ {
+		if applied[i] <= applied[i-1] {
+			t.Fatalf("results out of order: %v", applied)
+		}
+	}
+	h.realtimeResultMu.Lock()
+	_, retained := h.realtimeResultQueues["session-queue"]
+	h.realtimeResultMu.Unlock()
+	if retained {
+		t.Fatal("drained queue retained")
+	}
+}
+
+func TestRealtimeDelayedConfirmationPreservesNewerProgress(t *testing.T) {
+	f := newPlaybackServiceFixture(t)
+	if _, err := f.handler.ApplyProgressV2(f.ctx, f.caller, f.session.ID, PlaybackProgressCommand{Sequence: 1, Position: 30}); err != nil {
+		t.Fatal(err)
+	}
+	entered := make(chan struct{})
+	release := make(chan struct{})
+	released := sync.OnceFunc(func() { close(release) })
+	defer func() { released(); waitConfirmedPauseStates(t, f.handler, f.session.ID) }()
+	f.handler.runRealtimeResult(f.session.ID, true, func() { close(entered); <-release })
+	select {
+	case <-entered:
+	case <-time.After(5 * time.Second):
+		t.Fatal("worker did not start")
+	}
+	f.handler.rememberRealtimeCommand("cmd-delayed-pause", f.session.ID, playback.CommandPause)
+	if err := f.handler.handleRealtimeClientMessage(f.session.ID, realtimeResultMessage(t, f.session.ID, "cmd-delayed-pause", playback.RealtimeResultStatusCompleted)); err != nil {
+		t.Fatal(err)
+	}
+	// The player resumed locally after its pause confirmation. This newer
+	// observation reaches the server while the old confirmation is queued.
+	if _, err := f.handler.ApplyProgressV2(f.ctx, f.caller, f.session.ID, PlaybackProgressCommand{Sequence: 2, Position: 31}); err != nil {
+		t.Fatal(err)
+	}
+	released()
+	waitConfirmedPauseStates(t, f.handler, f.session.ID)
+	current, err := f.manager.GetSession(f.session.ID)
+	if err != nil || current.IsPaused || current.Position != 31 {
+		t.Fatalf("newer progress overwritten by queued confirmation: %+v, %v", current, err)
+	}
+}
+
+func TestRealtimeDelayedConfirmationUsesNewerReplicaProgress(t *testing.T) {
+	f := newPlaybackServiceFixture(t)
+	if _, err := f.handler.ApplyProgressV2(f.ctx, f.caller, f.session.ID, PlaybackProgressCommand{Sequence: 1, Position: 30, IsPaused: true}); err != nil {
+		t.Fatal(err)
+	}
+	entered := make(chan struct{})
+	release := make(chan struct{})
+	released := sync.OnceFunc(func() { close(release) })
+	defer func() { released(); waitConfirmedPauseStates(t, f.handler, f.session.ID) }()
+	f.handler.runRealtimeResult(f.session.ID, true, func() { close(entered); <-release })
+	select {
+	case <-entered:
+	case <-time.After(5 * time.Second):
+		t.Fatal("worker did not start")
+	}
+	f.handler.rememberRealtimeCommand("cmd-delayed-resume", f.session.ID, playback.CommandUnpause)
+	if err := f.handler.handleRealtimeClientMessage(f.session.ID, realtimeResultMessage(t, f.session.ID, "cmd-delayed-resume", playback.RealtimeResultStatusCompleted)); err != nil {
+		t.Fatal(err)
+	}
+	// Another replica accepts playing progress but does not hold this live
+	// session. The result worker must use the durable observation locally.
+	store := f.handler.PlanStoreV3.(playback.ProgressStoreV3)
+	if _, err := store.ApplyProgress(f.ctx, f.session.ID, playback.ProgressSampleV3{Sequence: 2, Position: 31}); err != nil {
+		t.Fatal(err)
+	}
+	released()
+	waitConfirmedPauseStates(t, f.handler, f.session.ID)
+	current, err := f.manager.GetSession(f.session.ID)
+	if err != nil || current.IsPaused || current.Position != 31 {
+		t.Fatalf("newer replica progress not reflected locally: %+v, %v", current, err)
+	}
+}
+
+func TestRealtimeAndClientStopShareHistoryReceipt(t *testing.T) {
+	f := newPlaybackServiceFixture(t)
+	userStore := newPlaybackTestStore(t)
+	f.handler.StoreProvider = testUserStoreProvider{store: userStore}
+	f.handler.fileResolver = testPlaybackFileResolver{file: &models.MediaFile{ID: 100, ContentID: "movie-1", Duration: 3600}}
+	if _, err := f.handler.ApplyProgressV2(f.ctx, f.caller, f.session.ID, PlaybackProgressCommand{Sequence: 1, Position: 1800}); err != nil {
+		t.Fatal(err)
+	}
+	scrobbler := &blockingPauseScrobbler{release: make(chan struct{}), entered: make(chan struct{})}
+	f.handler.WatchScrobbler = scrobbler
+	released := sync.OnceFunc(func() { close(scrobbler.release) })
+	defer func() { released(); waitConfirmedPauseStates(t, f.handler, f.session.ID) }()
+	f.handler.rememberRealtimeCommand("cmd-history-pause", f.session.ID, playback.CommandPause)
+	if err := f.handler.handleRealtimeClientMessage(f.session.ID, realtimeResultMessage(t, f.session.ID, "cmd-history-pause", playback.RealtimeResultStatusCompleted)); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case <-scrobbler.entered:
+	case <-time.After(5 * time.Second):
+		t.Fatal("pause scrobble did not start")
+	}
+	f.handler.rememberRealtimeCommand("cmd-history-stop", f.session.ID, playback.CommandStop)
+	if err := f.handler.handleRealtimeClientMessage(f.session.ID, realtimeResultMessage(t, f.session.ID, "cmd-history-stop", playback.RealtimeResultStatusCompleted)); err != nil {
+		t.Fatal(err)
+	}
+	receipt, err := f.handler.StopPlaybackV2(f.ctx, f.caller, f.session.ID, PlaybackStopCommand{StopID: uuid.NewString(), Sequence: 2, Position: new(1900.0)})
+	if err != nil || receipt.HistoryID == "" {
+		t.Fatalf("client stop receipt = %+v, %v", receipt, err)
+	}
+	released()
+	waitConfirmedPauseStates(t, f.handler, f.session.ID)
+	history, err := userStore.ListHistory(t.Context(), "profile-1", 10, 0)
+	if err != nil || len(history) != 1 || history[0].ID != receipt.HistoryID {
+		t.Fatalf("history = %+v, %v; want one receipt history row", history, err)
+	}
+	progress, err := userStore.GetProgress(t.Context(), "profile-1", "movie-1")
+	if err != nil || progress == nil || progress.PositionSeconds != 1900 {
+		t.Fatalf("final progress = %+v, %v; want client stop position 1900", progress, err)
+	}
+}
+
+// A terminate that lands while a confirmed stop waits behind provider work
+// finds no live session and stops the attempt without history. The queued
+// finalizer must still record the stop.
+func TestRealtimeStopRecordsHistoryAfterTerminateMarker(t *testing.T) {
+	f := newPlaybackServiceFixture(t)
+	userStore := newPlaybackTestStore(t)
+	f.handler.StoreProvider = testUserStoreProvider{store: userStore}
+	f.handler.fileResolver = testPlaybackFileResolver{file: &models.MediaFile{ID: 100, ContentID: "movie-1", Duration: 3600}}
+	if _, err := f.handler.ApplyProgressV2(f.ctx, f.caller, f.session.ID, PlaybackProgressCommand{Sequence: 1, Position: 1800}); err != nil {
+		t.Fatal(err)
+	}
+	scrobbler := &blockingPauseScrobbler{release: make(chan struct{}), entered: make(chan struct{})}
+	f.handler.WatchScrobbler = scrobbler
+	released := sync.OnceFunc(func() { close(scrobbler.release) })
+	defer func() { released(); waitConfirmedPauseStates(t, f.handler, f.session.ID) }()
+	f.handler.rememberRealtimeCommand("cmd-terminate-pause", f.session.ID, playback.CommandPause)
+	if err := f.handler.handleRealtimeClientMessage(f.session.ID, realtimeResultMessage(t, f.session.ID, "cmd-terminate-pause", playback.RealtimeResultStatusCompleted)); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case <-scrobbler.entered:
+	case <-time.After(5 * time.Second):
+		t.Fatal("pause scrobble did not start")
+	}
+	f.handler.rememberRealtimeCommand("cmd-terminate-stop", f.session.ID, playback.CommandStop)
+	if err := f.handler.handleRealtimeClientMessage(f.session.ID, realtimeResultMessage(t, f.session.ID, "cmd-terminate-stop", playback.RealtimeResultStatusCompleted)); err != nil {
+		t.Fatal(err)
+	}
+	control := NewAdminPlaybackControlHandler(f.handler)
+	if _, err := control.Terminate(t.Context(), AdminTerminateInput{SessionID: f.session.ID, ActorID: 2}); err != nil {
+		t.Fatalf("Terminate: %v", err)
+	}
+	released()
+	waitConfirmedPauseStates(t, f.handler, f.session.ID)
+	history, err := userStore.ListHistory(t.Context(), "profile-1", 10, 0)
+	if err != nil || len(history) != 1 {
+		t.Fatalf("history = %+v, %v; want one stop row", history, err)
+	}
+	receipt, _, err := f.handler.PlanStoreV3.(playback.ProgressStoreV3).StopAttempt(t.Context(), f.session.ID, uuid.NewString(), nil)
+	if err != nil || receipt.StopID != adminStopID(f.session.ID) || receipt.HistoryID != history[0].ID {
+		t.Fatalf("stop receipt = %+v, %v; want administrator receipt with history %s", receipt, err, history[0].ID)
+	}
+}
+
+func TestRealtimeStopReceiptKeepsCompletionAndBridgePosition(t *testing.T) {
+	for _, nativeSample := range []bool{true, false} {
+		name := "bridge-position"
+		position := 1800.0
+		if nativeSample {
+			name = "completed-native-receipt"
+			position = 3500
+		}
+		t.Run(name, func(t *testing.T) {
+			f := newPlaybackServiceFixture(t)
+			userStore := newPlaybackTestStore(t)
+			f.handler.StoreProvider = testUserStoreProvider{store: userStore}
+			f.handler.fileResolver = testPlaybackFileResolver{file: &models.MediaFile{ID: 100, ContentID: "movie-1", Duration: 3600}}
+			if err := f.manager.UpdateProgress(f.session.ID, position, false); err != nil {
+				t.Fatal(err)
+			}
+			snapshot, err := f.manager.GetSession(f.session.ID)
+			if err != nil {
+				t.Fatal(err)
+			}
+			var historyID string
+			if nativeSample {
+				receipt, err := f.handler.StopPlaybackV2(f.ctx, f.caller, f.session.ID, PlaybackStopCommand{StopID: uuid.NewString(), Sequence: 1, Position: new(position)})
+				if err != nil || receipt.HistoryID == "" {
+					t.Fatalf("native stop = %+v, %v", receipt, err)
+				}
+				historyID = receipt.HistoryID
+			} else {
+				if err := f.manager.StopSession(f.session.ID); err != nil {
+					t.Fatal(err)
+				}
+			}
+			result := f.handler.realtimeStopHistory(t.Context(), snapshot)
+			if result.HistoryID == "" || (historyID != "" && result.HistoryID != historyID) || result.Completed != nativeSample || result.FinalPositionSeconds != position {
+				t.Fatalf("realtime stop result = %+v", result)
+			}
+			history, err := userStore.ListHistory(t.Context(), "profile-1", 10, 0)
+			if err != nil || len(history) != 1 {
+				t.Fatalf("history = %+v, %v", history, err)
+			}
+			if !nativeSample {
+				progress, err := userStore.GetProgress(t.Context(), "profile-1", "movie-1")
+				if err != nil || progress == nil || progress.PositionSeconds != position {
+					t.Fatalf("bridge progress = %+v, %v", progress, err)
+				}
+			}
+		})
+	}
+}
+
+// A transient read failure must not discard the one completed control result.
+type transientRealtimePlanStore struct {
+	playback.PlanStoreV3
+	calls int
+}
+
+func (s *transientRealtimePlanStore) GetAttempt(ctx context.Context, id string) (*playback.AttemptRecordV3, error) {
+	s.calls++
+	if s.calls == 1 || s.calls == 3 {
+		return nil, errors.New("transient attempt read failure")
+	}
+	return s.PlanStoreV3.GetAttempt(ctx, id)
+}
+
+func TestRealtimeConfirmationRetriesTransientAttemptReads(t *testing.T) {
+	f := newPlaybackServiceFixture(t)
+	store := &transientRealtimePlanStore{PlanStoreV3: f.handler.PlanStoreV3}
+	f.handler.PlanStoreV3 = store
+	f.handler.rememberRealtimeCommand("cmd-retry-pause", f.session.ID, playback.CommandPause)
+	if err := f.handler.handleRealtimeClientMessage(f.session.ID, realtimeResultMessage(t, f.session.ID, "cmd-retry-pause", playback.RealtimeResultStatusCompleted)); err != nil {
+		t.Fatal(err)
+	}
+	waitConfirmedPauseStates(t, f.handler, f.session.ID)
+	current, err := f.manager.GetSession(f.session.ID)
+	if err != nil || !current.IsPaused || store.calls != 4 {
+		t.Fatalf("confirmed pause = %+v, %v; reads = %d, want 4", current, err, store.calls)
+	}
+}
+
+type deadlineRealtimeSyncer struct{}
+
+func (deadlineRealtimeSyncer) SyncNow(ctx context.Context) error {
+	<-ctx.Done()
+	return ctx.Err()
+}
+
+type contextCheckingPauseScrobbler struct {
+	recordingPlaybackWatchScrobbler
+	pauseContextErr error
+}
+
+func (s *contextCheckingPauseScrobbler) ScrobblePause(ctx context.Context, event watchsync.ScrobbleEvent) error {
+	s.pauseContextErr = ctx.Err()
+	return s.recordingPlaybackWatchScrobbler.ScrobblePause(ctx, event)
+}
+
+func TestRealtimeSyncDeadlineDoesNotConsumeProviderBudget(t *testing.T) {
+	f := newPlaybackServiceFixture(t)
+	f.handler.fileResolver = testPlaybackFileResolver{file: &models.MediaFile{ID: 100, ContentID: "movie-1", Duration: 3600}}
+	f.handler.SessionSyncer = deadlineRealtimeSyncer{}
+	scrobbler := &contextCheckingPauseScrobbler{}
+	f.handler.WatchScrobbler = scrobbler
+	f.handler.setConfirmedPauseState(f.session.ID, true, 0)
+	if len(scrobbler.pauses) != 1 || scrobbler.pauseContextErr != nil {
+		t.Fatalf("pause scrobbles = %d, provider context = %v", len(scrobbler.pauses), scrobbler.pauseContextErr)
+	}
+}
+
+// Progress another replica accepted before the result arrived was never
+// applied to this live session; the confirmation must still use its position.
+func TestRealtimeConfirmationUsesReplicaPositionAtReceiptSequence(t *testing.T) {
+	f := newPlaybackServiceFixture(t)
+	if _, err := f.handler.ApplyProgressV2(f.ctx, f.caller, f.session.ID, PlaybackProgressCommand{Sequence: 1, Position: 30}); err != nil {
+		t.Fatal(err)
+	}
+	store := f.handler.PlanStoreV3.(playback.ProgressStoreV3)
+	if _, err := store.ApplyProgress(f.ctx, f.session.ID, playback.ProgressSampleV3{Sequence: 2, Position: 45}); err != nil {
+		t.Fatal(err)
+	}
+	f.handler.rememberRealtimeCommand("cmd-replica-pause", f.session.ID, playback.CommandPause)
+	if err := f.handler.handleRealtimeClientMessage(f.session.ID, realtimeResultMessage(t, f.session.ID, "cmd-replica-pause", playback.RealtimeResultStatusCompleted)); err != nil {
+		t.Fatal(err)
+	}
+	waitConfirmedPauseStates(t, f.handler, f.session.ID)
+	current, err := f.manager.GetSession(f.session.ID)
+	if err != nil || !current.IsPaused || current.Position != 45 {
+		t.Fatalf("confirmed pause = %+v, %v; want paused at replica position 45", current, err)
+	}
+}
+
+type stalledRealtimePlanStore struct {
+	playback.PlanStoreV3
+}
+
+func (stalledRealtimePlanStore) GetAttempt(ctx context.Context, _ string) (*playback.AttemptRecordV3, error) {
+	<-ctx.Done()
+	return nil, ctx.Err()
+}
+
+// The receipt read runs on the socket reader. A stalled store must release
+// the reader well before the default command deadline, so the next command's
+// result is not held back into its fallback stop.
+func TestRealtimeConfirmationReadReleasesReaderBeforeCommandDeadline(t *testing.T) {
+	f := newPlaybackServiceFixture(t)
+	f.handler.PlanStoreV3 = stalledRealtimePlanStore{PlanStoreV3: f.handler.PlanStoreV3}
+	f.handler.rememberRealtimeCommand("cmd-stalled-pause", f.session.ID, playback.CommandPause)
+	started := time.Now()
+	if err := f.handler.handleRealtimeClientMessage(f.session.ID, realtimeResultMessage(t, f.session.ID, "cmd-stalled-pause", playback.RealtimeResultStatusCompleted)); err != nil {
+		t.Fatal(err)
+	}
+	if elapsed := time.Since(started); elapsed >= defaultPlaybackControlDeadline {
+		t.Fatalf("reader held for %v, want under the %v command deadline", elapsed, defaultPlaybackControlDeadline)
+	}
+}
+
+// competingLeaseStore reports another replica's finalization claim, held
+// until claimedUntil, as a dead finalizer would leave it.
+type competingLeaseStore struct {
+	playback.ProgressStoreV3
+	claimedUntil time.Time
+}
+
+func (s competingLeaseStore) StopAttempt(ctx context.Context, id, stopID string, final *playback.ProgressSampleV3) (playback.StopReceiptV3, bool, error) {
+	receipt, first, err := s.ProgressStoreV3.StopAttempt(ctx, id, stopID, final)
+	if err == nil && !receipt.Finalized && receipt.FinalizingUntil.Before(s.claimedUntil) {
+		receipt.FinalizingUntil = s.claimedUntil
+	}
+	return receipt, first, err
+}
+
+func (s competingLeaseStore) ClaimStopFinalization(ctx context.Context, id string, leaseUntil time.Time) (bool, error) {
+	if time.Now().Before(s.claimedUntil) {
+		return false, nil
+	}
+	return s.ProgressStoreV3.ClaimStopFinalization(ctx, id, leaseUntil)
+}
+
+// The queued realtime finalizer is the only caller left for its stop, so it
+// must outlast a competing claim that expires after its first round.
+func TestRealtimeStopFinalizationOutlastsCompetingLease(t *testing.T) {
+	f := newPlaybackServiceFixture(t)
+	userStore := newPlaybackTestStore(t)
+	f.handler.StoreProvider = testUserStoreProvider{store: userStore}
+	f.handler.fileResolver = testPlaybackFileResolver{file: &models.MediaFile{ID: 100, ContentID: "movie-1", Duration: 3600}}
+	if _, err := f.handler.ApplyProgressV2(f.ctx, f.caller, f.session.ID, PlaybackProgressCommand{Sequence: 1, Position: 1800}); err != nil {
+		t.Fatal(err)
+	}
+	if err := f.manager.StopSession(f.session.ID); err != nil {
+		t.Fatal(err)
+	}
+	base := f.handler.PlanStoreV3.(playback.ProgressStoreV3)
+	receipt, _, err := base.StopAttempt(t.Context(), f.session.ID, adminStopID(f.session.ID), nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	record, err := f.handler.PlanStoreV3.GetAttempt(t.Context(), f.session.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	const round = 100 * time.Millisecond
+	store := competingLeaseStore{ProgressStoreV3: base, claimedUntil: time.Now().Add(round + 50*time.Millisecond)}
+	receipt = f.handler.finalizeRealtimeStop(t.Context(), store, record, f.session.ID, receipt, round)
+	history, err := userStore.ListHistory(t.Context(), "profile-1", 10, 0)
+	if err != nil || !receipt.Finalized || len(history) != 1 || receipt.HistoryID != history[0].ID {
+		t.Fatalf("receipt = %+v, history = %+v, %v; want finalized with one history row", receipt, history, err)
+	}
+}
+
+type signalingSyncer struct{ synced chan struct{} }
+
+func (s signalingSyncer) SyncNow(context.Context) error {
+	select {
+	case s.synced <- struct{}{}:
+	default:
+	}
+	return nil
+}
+
+type orderedPauseScrobbler struct {
+	recordingPlaybackWatchScrobbler
+	mu      sync.Mutex
+	actions []string
+	paused  chan struct{}
+}
+
+func (s *orderedPauseScrobbler) ScrobbleStart(context.Context, watchsync.ScrobbleEvent) error {
+	s.mu.Lock()
+	s.actions = append(s.actions, "start")
+	s.mu.Unlock()
+	return nil
+}
+
+func (s *orderedPauseScrobbler) ScrobblePause(context.Context, watchsync.ScrobbleEvent) error {
+	s.mu.Lock()
+	s.actions = append(s.actions, "pause")
+	s.mu.Unlock()
+	close(s.paused)
+	return nil
+}
+
+// A confirmed pause shows in the admin views at once, but its provider pause
+// waits for a start scrobble still queued behind busy start workers.
+func TestRealtimeConfirmedPauseScrobblesAfterPendingStart(t *testing.T) {
+	f := newPlaybackServiceFixture(t)
+	f.handler.fileResolver = testPlaybackFileResolver{file: &models.MediaFile{ID: 100, ContentID: "movie-1", Duration: 3600}}
+	syncer := signalingSyncer{synced: make(chan struct{}, 1)}
+	f.handler.SessionSyncer = syncer
+	scrobbler := &orderedPauseScrobbler{paused: make(chan struct{})}
+	f.handler.WatchScrobbler = scrobbler
+	pending := &playbackStartSideEffectsStateV3{done: make(chan struct{})}
+	f.handler.v3StartEffectsMu.Lock()
+	f.handler.v3StartEffectsPending = map[string]*playbackStartSideEffectsStateV3{f.session.ID: pending}
+	f.handler.v3StartEffectsMu.Unlock()
+
+	f.handler.rememberRealtimeCommand("cmd-start-order-pause", f.session.ID, playback.CommandPause)
+	if err := f.handler.handleRealtimeClientMessage(f.session.ID, realtimeResultMessage(t, f.session.ID, "cmd-start-order-pause", playback.RealtimeResultStatusCompleted)); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case <-syncer.synced:
+	case <-time.After(5 * time.Second):
+		t.Fatal("confirmed pause did not sync the admin views")
+	}
+	if current, err := f.manager.GetSession(f.session.ID); err != nil || !current.IsPaused {
+		t.Fatalf("session after sync = %+v, %v; want paused", current, err)
+	}
+	select {
+	case <-scrobbler.paused:
+		t.Fatal("pause scrobble sent before the pending start scrobble")
+	case <-time.After(50 * time.Millisecond):
+	}
+	_ = scrobbler.ScrobbleStart(t.Context(), watchsync.ScrobbleEvent{})
+	close(pending.done)
+	waitConfirmedPauseStates(t, f.handler, f.session.ID)
+	scrobbler.mu.Lock()
+	defer scrobbler.mu.Unlock()
+	if len(scrobbler.actions) != 2 || scrobbler.actions[0] != "start" || scrobbler.actions[1] != "pause" {
+		t.Fatalf("scrobbles = %v, want [start pause]", scrobbler.actions)
+	}
+}
+
+type progressPlanStore interface {
+	playback.PlanStoreV3
+	playback.ProgressStoreV3
+}
+
+// transientStopStore fails the first attempt read and the first stop CAS.
+type transientStopStore struct {
+	progressPlanStore
+	reads, stops int
+}
+
+func (s *transientStopStore) GetAttempt(ctx context.Context, id string) (*playback.AttemptRecordV3, error) {
+	s.reads++
+	if s.reads == 1 {
+		return nil, errors.New("transient attempt read failure")
+	}
+	return s.progressPlanStore.GetAttempt(ctx, id)
+}
+
+func (s *transientStopStore) StopAttempt(ctx context.Context, id, stopID string, final *playback.ProgressSampleV3) (playback.StopReceiptV3, bool, error) {
+	s.stops++
+	if s.stops == 1 {
+		return playback.StopReceiptV3{}, false, errors.New("transient stop failure")
+	}
+	return s.progressPlanStore.StopAttempt(ctx, id, stopID, final)
+}
+
+// The queued realtime finalizer is the stop's only finalizer; a transient
+// store error must not leave the attempt live without history.
+func TestRealtimeStopRetriesTransientStoreErrors(t *testing.T) {
+	f := newPlaybackServiceFixture(t)
+	userStore := newPlaybackTestStore(t)
+	f.handler.StoreProvider = testUserStoreProvider{store: userStore}
+	f.handler.fileResolver = testPlaybackFileResolver{file: &models.MediaFile{ID: 100, ContentID: "movie-1", Duration: 3600}}
+	if _, err := f.handler.ApplyProgressV2(f.ctx, f.caller, f.session.ID, PlaybackProgressCommand{Sequence: 1, Position: 1800}); err != nil {
+		t.Fatal(err)
+	}
+	store := &transientStopStore{progressPlanStore: f.handler.PlanStoreV3.(progressPlanStore)}
+	f.handler.PlanStoreV3 = store
+	f.handler.rememberRealtimeCommand("cmd-transient-stop", f.session.ID, playback.CommandStop)
+	if err := f.handler.handleRealtimeClientMessage(f.session.ID, realtimeResultMessage(t, f.session.ID, "cmd-transient-stop", playback.RealtimeResultStatusCompleted)); err != nil {
+		t.Fatal(err)
+	}
+	waitConfirmedPauseStates(t, f.handler, f.session.ID)
+	history, err := userStore.ListHistory(t.Context(), "profile-1", 10, 0)
+	if err != nil || len(history) != 1 {
+		t.Fatalf("history = %+v, %v; want one stop row", history, err)
+	}
+	record, err := store.progressPlanStore.GetAttempt(t.Context(), f.session.ID)
+	if err != nil || !attemptEndedByAdmin(record) {
+		t.Fatalf("attempt = %+v, %v; want stopped by administrator", record, err)
+	}
+}
diff --git a/internal/api/handlers/session_ws_test.go b/internal/api/handlers/session_ws_test.go
index af7a413384..d8881ce5af 100644
--- a/internal/api/handlers/session_ws_test.go
+++ b/internal/api/handlers/session_ws_test.go
@@ -46,12 +46,10 @@ func TestHandleSessionWebSocket_RequiresHelloBeforeRealtimeReady(t *testing.T) {
 
 	wsURL := "ws" + strings.TrimPrefix(server.URL, "http") + "/playback/ws/" + session.ID
 	conn, resp, err := websocket.DefaultDialer.Dial(wsURL, nil)
-	if resp != nil {
-		defer resp.Body.Close()
-	}
 	if err != nil {
 		t.Fatalf("Dial websocket: %v", err)
 	}
+	defer func() { _ = resp.Body.Close() }()
 	defer conn.Close()
 
 	got, err := sessionMgr.GetSession(session.ID)
diff --git a/internal/api/handlers/settings.go b/internal/api/handlers/settings.go
index fcf1635ac4..0329f1bab0 100644
--- a/internal/api/handlers/settings.go
+++ b/internal/api/handlers/settings.go
@@ -62,6 +62,8 @@ type SettingsHandler struct {
 	// instance across every handler that records sightings.
 	DeviceSightings *DeviceSightings
 	EventsHub       *evt.Hub
+	// RecWorker is told when a profile's hidden libraries change. Optional.
+	RecWorker SignalsChangedNotifier
 }
 
 // NewSettingsHandler creates a new SettingsHandler.
@@ -521,7 +523,7 @@ func DeviceMetadataFromHeaders(h http.Header) DeviceMetadata {
 func NewDeviceMetadata(id, name, platform string) DeviceMetadata {
 	return DeviceMetadata{
 		DeviceID:       clampHeaderValue(id, 128),
-		DeviceName:     clampHeaderValue(name, 120),
+		DeviceName:     clampHeaderValue(name, MaxDeviceNameRunes),
 		DevicePlatform: clampHeaderValue(platform, 40),
 	}
 }
@@ -685,6 +687,7 @@ func (h *SettingsHandler) syncLegacyUserSetting(
 		for _, changedKey := range profile.keys {
 			publishUserSettingsEvent(ctx, h.EventsHub, userID, profile.profileID,
 				changedKey, string(settingscontract.ScopeProfile))
+			notifyScopeSettingChanged(ctx, h.RecWorker, userID, profile.profileID, changedKey)
 		}
 	}
 	return nil
diff --git a/internal/api/handlers/settings_values.go b/internal/api/handlers/settings_values.go
index b7a0e9571d..5a103f01d6 100644
--- a/internal/api/handlers/settings_values.go
+++ b/internal/api/handlers/settings_values.go
@@ -50,6 +50,10 @@ type SettingValuesHandler struct {
 	// successful write or delete. Nil (as in tests) simply skips publishing.
 	EventsHub *evt.Hub
 
+	// RecWorker is told when a profile's hidden libraries change, so its
+	// recommendations are rebuilt without them. Optional.
+	RecWorker SignalsChangedNotifier
+
 	// ProfileTokens enables household management for a PIN-locked primary
 	// profile naming another profile on its own account. Nil means that
 	// widening is simply unavailable — never that it is unguarded.
diff --git a/internal/api/handlers/settings_values_seam.go b/internal/api/handlers/settings_values_seam.go
index 2dac05c9ce..63187e37b3 100644
--- a/internal/api/handlers/settings_values_seam.go
+++ b/internal/api/handlers/settings_values_seam.go
@@ -549,6 +549,7 @@ func (h *SettingValuesHandler) writeSettingValue(
 	}
 	publishUserSettingsEvent(ctx, h.EventsHub,
 		eventUserID, identity.ProfileID, identity.Key, string(identity.Scope))
+	notifyScopeSettingChanged(ctx, h.RecWorker, eventUserID, identity.ProfileID, identity.Key)
 	auditSettingsForOther(ctx, settingsAuditRecord{
 		Action:          settingsAuditActionSet,
 		ActorProfileID:  acting,
@@ -641,6 +642,7 @@ func (h *SettingValuesHandler) clearSettingValue(
 	})
 	publishUserSettingsEvent(ctx, h.EventsHub,
 		eventUserID, identity.ProfileID, identity.Key, string(identity.Scope))
+	notifyScopeSettingChanged(ctx, h.RecWorker, eventUserID, identity.ProfileID, identity.Key)
 	return nil
 }
 
diff --git a/internal/api/handlers/stream.go b/internal/api/handlers/stream.go
index 86e5b93a35..c3a668cffb 100644
--- a/internal/api/handlers/stream.go
+++ b/internal/api/handlers/stream.go
@@ -64,6 +64,10 @@ type StreamHandler struct {
 	// PlaybackHandler's); an aborted session's attempt row is marked stopped
 	// through it. May be nil (tests / minimal setups).
 	PlanStoreV3 playback.PlanStoreV3
+	// SessionRecipeStore is the PlaybackHandler's store of header-authenticated
+	// session recipes (same instance), the only reconstruction source for a
+	// session whose URLs carry no stream token. May be nil.
+	SessionRecipeStore sessionRecipeStoreV3
 	// PlaybackConfig returns the current playback config; read it through
 	// ffmpegPath(). May be nil (tests).
 	PlaybackConfig func() config.PlaybackConfig
@@ -155,9 +159,20 @@ func (h *StreamHandler) HandleStream(w http.ResponseWriter, r *http.Request) {
 		// let stale recipe routing override the current session, and do not revive
 		// the stale recipe if the live session disappears during this request.
 		loadCard = nil
-	} else if errors.Is(err, playback.ErrSessionNotFound) && !requireNativeRecipeAPIEgressV3(w, card) {
-		return
-	} else if err != nil && !errors.Is(err, playback.ErrSessionNotFound) {
+	} else if errors.Is(err, playback.ErrSessionNotFound) {
+		if loadCard == nil {
+			// A header-authenticated session carries no token; its recipe is the
+			// server-side recovery card.
+			var recipeErr error
+			if loadCard, recipeErr = h.storedSessionRecipeV3(r.Context(), sessionID, userID); recipeErr != nil {
+				writeError(w, http.StatusInternalServerError, "internal_error", "Failed to load playback session")
+				return
+			}
+		}
+		if !requireNativeRecipeAPIEgressV3(w, loadCard) {
+			return
+		}
+	} else {
 		// Do not turn an inconsistent backend read into authority to reconstruct
 		// from a recipe whose route was never checked against a clean miss.
 		loadCard = nil
@@ -300,6 +315,12 @@ func (h *StreamHandler) loadSidecarSession(ctx context.Context, reference, sessi
 		loadCard = nil
 	} else if !errors.Is(err, playback.ErrSessionNotFound) {
 		loadCard = nil
+	} else if loadCard == nil {
+		// A header-authenticated session's sidecar URLs carry no reference either.
+		var recipeErr error
+		if loadCard, recipeErr = h.storedSessionRecipeV3(ctx, sessionID, userID); recipeErr != nil {
+			return nil, nil, apiError(http.StatusInternalServerError, "internal_error", "Failed to load playback session")
+		}
 	}
 	session, status, _ := h.TM.LoadOrReconstructSessionDetail(ctx, h.sessionMgr.GetSession, sessionID, userID, loadCard)
 	switch status {
@@ -815,6 +836,7 @@ func (h *StreamHandler) abortPlaybackSession(ctx context.Context, session *playb
 	}
 	h.finalizeSessionAbort(ctx, session, true, "stream_abort")
 	markAttemptStoppedServerSide(ctx, h.PlanStoreV3, h.StreamDeny, session.ID)
+	deleteSessionRecipeV3(ctx, h.SessionRecipeStore, session.ID)
 }
 
 func (h *StreamHandler) handleTransportStartFailure(ctx context.Context, session *playback.Session, file *models.MediaFile, err error) {
diff --git a/internal/api/handlers/subtitle_download.go b/internal/api/handlers/subtitle_download.go
index 2f78a6e196..70f07faaa2 100644
--- a/internal/api/handlers/subtitle_download.go
+++ b/internal/api/handlers/subtitle_download.go
@@ -5,8 +5,10 @@ import (
 	"errors"
 	"log/slog"
 	"net/http"
+	"strings"
 
 	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/logredact"
 	"github.com/prairie-server/prairie-server/internal/subtitles"
 )
 
@@ -34,7 +36,12 @@ func (h *SubtitleSearchHandler) downloadAuthorizedSubtitle(ctx context.Context,
 			slog.WarnContext(ctx, "subtitle download refused malformed result id", "component", "api", "provider", req.ProviderName)
 			return nil, fieldError("subtitle_id", "subtitle_id is not a result ID this provider returns").WithCause(err)
 		}
-		slog.ErrorContext(ctx, "subtitle download failed", "component", "api", "provider", req.ProviderName, "subtitle_id", req.SubtitleID, "error", err)
+		// A client can resend a SubDL ID issued while result IDs still carried
+		// a signed query string, and provider errors can quote a request URL or
+		// an upstream body; keep credentials from either out of the log.
+		loggedID, _, _ := strings.Cut(req.SubtitleID, "?")
+		slog.ErrorContext(ctx, "subtitle download failed", "component", "api", "provider", req.ProviderName, "subtitle_id", loggedID,
+			"error", logredact.SanitizeText(logredact.SanitizeURLError(err).Error()))
 		return nil, apiError(http.StatusInternalServerError, "download_error", "Failed to download subtitle")
 	}
 	h.requestAutoSync(ctx, sub)
diff --git a/internal/api/handlers/subtitle_download_test.go b/internal/api/handlers/subtitle_download_test.go
index 1f826374e9..75845a66c8 100644
--- a/internal/api/handlers/subtitle_download_test.go
+++ b/internal/api/handlers/subtitle_download_test.go
@@ -1,8 +1,10 @@
 package handlers
 
 import (
+	"bytes"
 	"context"
 	"errors"
+	"log/slog"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -123,3 +125,28 @@ func TestSubtitleDownloadInvalidSubtitleIDIsBadRequest(t *testing.T) {
 		t.Fatal(rec.Code, rec.Body.String())
 	}
 }
+
+// A client can resend a SubDL result ID issued while IDs still carried the
+// signed api_key query; neither that query nor a credential quoted in the
+// provider's error reaches the failure log.
+func TestSubtitleDownloadFailureLogOmitsCredentials(t *testing.T) {
+	var logs bytes.Buffer
+	previous := slog.Default()
+	slog.SetDefault(slog.New(slog.NewTextHandler(&logs, nil)))
+	t.Cleanup(func() { slog.SetDefault(previous) })
+
+	repo := newMockSubtitleRepoForHandler()
+	manager := subtitles.NewManager(repo, newMockBlobStoreForHandler())
+	manager.RegisterProvider(&downloadRecordingProvider{err: errors.New("upstream said api_key=synthetic-error-key")})
+	h := NewSubtitleSearchHandler(manager, repo, nil)
+	h.FileAuthorizer = &MediaFileAuthorizer{FileResolver: stubMediaFileResolver{file: &models.MediaFile{ID: 42, ContentID: "movie"}}, ItemAccess: stubItemAccessChecker{}}
+
+	_, err := h.DownloadStoredSubtitle(t.Context(), catalog.AccessFilter{UserID: 1}, subtitles.DownloadRequest{MediaFileID: 42, ProviderName: "example", SubtitleID: "/subtitle/1-2.zip?api_key=synthetic-id-key", Language: "en"})
+	if failure, ok := errors.AsType[*APIError](err); !ok || failure.Code != "download_error" {
+		t.Fatalf("service error = %v", err)
+	}
+	got := logs.String()
+	if !strings.Contains(got, "subtitle_id=/subtitle/1-2.zip ") || strings.Contains(got, "synthetic-id-key") || strings.Contains(got, "synthetic-error-key") {
+		t.Fatalf("failure log = %q", got)
+	}
+}
diff --git a/internal/api/handlers/taste_seed.go b/internal/api/handlers/taste_seed.go
index 391d1b8976..f68d57af83 100644
--- a/internal/api/handlers/taste_seed.go
+++ b/internal/api/handlers/taste_seed.go
@@ -7,6 +7,8 @@ import (
 	"strconv"
 
 	apimw "github.com/prairie-server/prairie-server/internal/api/middleware"
+	"github.com/prairie-server/prairie-server/internal/artworkkey"
+	"github.com/prairie-server/prairie-server/internal/imagesize"
 	"github.com/prairie-server/prairie-server/internal/models"
 )
 
@@ -55,8 +57,8 @@ func (h *RecommendationsHandler) HandleTasteSeedItems(w http.ResponseWriter, r *
 // HandleTasteSeed handles POST /recommendations/taste-seed.
 //
 // Accepts a list of item IDs the user picked in the taste-seeding UI and
-// records each as a favorite for the active profile, then queues a
-// taste-profile refresh.
+// records each as a favorite for the active profile, then refreshes its
+// recommendations (see SubmitTasteSeed).
 func (h *RecommendationsHandler) HandleTasteSeed(w http.ResponseWriter, r *http.Request) {
 	var req tasteSeedSubmitRequest
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
@@ -99,10 +101,10 @@ func (h *RecommendationsHandler) resolveTasteSeedUserStates(ctx context.Context,
 	return states
 }
 
-// tasteSeedSectionItem builds the trimmed section item used by the seed grid.
-// We only populate poster fields — the picker doesn't need overlays, ratings,
-// or progress.
-func (h *RecommendationsHandler) tasteSeedSectionItem(ctx context.Context, mi *models.MediaItem, stateMap map[string]*itemUserStateResponse) sectionItemResponse {
+// tasteSeedSectionItem builds the trimmed section item used by the seed grid
+// from its resolved poster (see tasteSeedPosterURLs). We only populate poster
+// fields — the picker doesn't need overlays, ratings, or progress.
+func tasteSeedSectionItem(mi *models.MediaItem, stateMap map[string]*itemUserStateResponse, posterURL string) sectionItemResponse {
 	item := sectionItemResponse{
 		ContentID:       mi.ContentID,
 		Type:            mi.Type,
@@ -118,9 +120,7 @@ func (h *RecommendationsHandler) tasteSeedSectionItem(ctx context.Context, mi *m
 	if item.Keywords == nil {
 		item.Keywords = []string{}
 	}
-	if h.DetailSvc != nil {
-		item.PosterURL = h.DetailSvc.PresignURL(ctx, cardThumbnailPath(mi.PosterPath), "card")
-	}
+	item.PosterURL = posterURL
 	if stateMap != nil {
 		item.UserState = stateMap[mi.ContentID]
 	}
@@ -147,3 +147,28 @@ func parseTasteSeedOffset(r *http.Request) int {
 	}
 	return 0
 }
+
+// tasteSeedPosterURLs resolves the seed grid's card posters in one batch, at
+// the request's poster size or width, keyed by content ID.
+func (h *RecommendationsHandler) tasteSeedPosterURLs(ctx context.Context, items []*models.MediaItem, art imagesize.Request) map[string]string {
+	urls := make(map[string]string, len(items))
+	if h.DetailSvc == nil || len(items) == 0 {
+		return urls
+	}
+	size := art.For(imagesize.SlotPoster)
+	sized := make(map[string]string, len(items))
+	paths := make([]string, 0, len(items))
+	for _, mi := range items {
+		if mi == nil {
+			continue
+		}
+		path := sizedCardPath(mi.PosterPath, artworkkey.ImagePoster, size)
+		sized[mi.ContentID] = path
+		paths = append(paths, path)
+	}
+	resolved := h.DetailSvc.PresignURLsWithExpiry(ctx, paths, requestVariantHint("card", size))
+	for contentID, path := range sized {
+		urls[contentID] = resolved[path].URL
+	}
+	return urls
+}
diff --git a/internal/api/handlers/taste_seed_test.go b/internal/api/handlers/taste_seed_test.go
index 73755f474d..6bf2bb1281 100644
--- a/internal/api/handlers/taste_seed_test.go
+++ b/internal/api/handlers/taste_seed_test.go
@@ -6,22 +6,42 @@ import (
 
 	"github.com/prairie-server/prairie-server/internal/catalog"
 	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/userstore"
 )
 
-type countingProfileRefresher struct{ calls int }
+// recordingTasteSeedRefresher records each refresh and how many favorites the
+// profile held when it was asked for.
+type recordingTasteSeedRefresher struct {
+	store interface {
+		ListFavorites(context.Context, string, int, int) ([]userstore.Favorite, error)
+	}
+	calls          int
+	favoritesAtRun []int
+	userID         int
+	profileID      string
+}
 
-func (c *countingProfileRefresher) RequestProfileRefresh(context.Context, int, string) { c.calls++ }
+func (r *recordingTasteSeedRefresher) RefreshProfileNow(ctx context.Context, userID int, profileID string) bool {
+	r.calls++
+	r.userID, r.profileID = userID, profileID
+	if r.store != nil {
+		favorites, _ := r.store.ListFavorites(ctx, profileID, 100, 0)
+		r.favoritesAtRun = append(r.favoritesAtRun, len(favorites))
+	}
+	return true
+}
 
 // A taste-seed submission counts only the favorites it newly recorded: a
 // duplicate pick, an already-favorited item, and a retried submission all
-// report 0 added and queue no refresh.
+// report 0 added and refresh nothing. A submission that added picks refreshes
+// the profile once, after every pick is stored.
 func TestSubmitTasteSeedCountsOnlyNewFavorites(t *testing.T) {
 	store := newHouseholdTestStore(t)
-	refresher := &countingProfileRefresher{}
+	refresher := &recordingTasteSeedRefresher{store: store}
 	h := &RecommendationsHandler{storeProvider: testUserStoreProvider{store: store}, RecWorker: refresher, Fetcher: stubDiscoverFetcher{items: []*models.MediaItem{{ContentID: "movie:heat-1995"}, {ContentID: "movie:already"}, {ContentID: "movie:collateral-2004"}}}}
 	ctx := context.Background()
 
-	if err := store.AddFavorite(ctx, "p1", "movie:already"); err != nil {
+	if _, err := store.AddFavorite(ctx, "p1", "movie:already"); err != nil {
 		t.Fatal(err)
 	}
 
@@ -32,6 +52,9 @@ func TestSubmitTasteSeedCountsOnlyNewFavorites(t *testing.T) {
 	if added != 2 || refresher.calls != 1 {
 		t.Fatalf("first submission: added=%d refreshes=%d, want 2 and 1", added, refresher.calls)
 	}
+	if refresher.userID != 7 || refresher.profileID != "p1" || refresher.favoritesAtRun[0] != 3 {
+		t.Fatalf("refreshed user %d profile %q holding %v favorites, want 7, p1 and all 3 stored first", refresher.userID, refresher.profileID, refresher.favoritesAtRun)
+	}
 
 	added, err = h.SubmitTasteSeed(ctx, 7, "p1", []string{"movie:heat-1995", "movie:collateral-2004"}, catalog.AccessFilter{})
 	if err != nil {
@@ -64,7 +87,7 @@ func TestSubmitTasteSeedRejectsInvisiblePicksBeforeWriting(t *testing.T) {
 	for _, inaccessible := range []string{"movie:hidden-library", "movie:unknown", " "} {
 		t.Run(inaccessible, func(t *testing.T) {
 			store := newHouseholdTestStore(t)
-			refresher := &countingProfileRefresher{}
+			refresher := &recordingTasteSeedRefresher{}
 			fetcher := &tasteSeedAccessFetcher{}
 			h := &RecommendationsHandler{storeProvider: testUserStoreProvider{store: store}, RecWorker: refresher, Fetcher: fetcher}
 			filter := catalog.AccessFilter{AllowedLibraryIDs: []int{7}}
diff --git a/internal/api/handlers/theme.go b/internal/api/handlers/theme.go
index 98530a9df4..30bf2e08ff 100644
--- a/internal/api/handlers/theme.go
+++ b/internal/api/handlers/theme.go
@@ -14,7 +14,9 @@ type ThemeSettingsReader interface {
 	Get(ctx context.Context, key string) (string, error)
 }
 
-// ThemeHandler serves theme-related public endpoints.
+// ThemeHandler serves the frozen /api/v1 theme routes. The web client has one
+// look and reads none of them; they stay on the bridge surface, reporting
+// whatever is stored, until v1 retires.
 type ThemeHandler struct {
 	settings ThemeSettingsReader
 
@@ -45,19 +47,13 @@ type AdminCSSView struct {
 	RawCSS string `json:"raw_css"`
 }
 
-// HandleAdminCSS returns the server-wide admin theme overrides.
-// Public endpoint — no authentication required. This allows admin
-// branding to apply before login (white-label).
+// HandleAdminCSS returns the retired server-wide theme overrides. Public
+// endpoint — no authentication required, as it was read before login.
 func (h *ThemeHandler) HandleAdminCSS(w http.ResponseWriter, r *http.Request) {
+	vars, _ := h.settings.Get(r.Context(), "ui.admin_theme_vars")
+	rawCSS, _ := h.settings.Get(r.Context(), "ui.admin_custom_css")
 	w.Header().Set("Cache-Control", "no-store")
-	writeJSON(w, http.StatusOK, h.AdminCSS(r.Context()))
-}
-
-// AdminCSS reads the shared server overrides used before login.
-func (h *ThemeHandler) AdminCSS(ctx context.Context) AdminCSSView {
-	vars, _ := h.settings.Get(ctx, "ui.admin_theme_vars")
-	rawCSS, _ := h.settings.Get(ctx, "ui.admin_custom_css")
-	return AdminCSSView{Vars: vars, RawCSS: rawCSS}
+	writeJSON(w, http.StatusOK, AdminCSSView{Vars: vars, RawCSS: rawCSS})
 }
 
 // HandleDownload retains the frozen portable JSON response.
diff --git a/internal/api/handlers/user_collection_imports.go b/internal/api/handlers/user_collection_imports.go
index 27214825b5..f432184d36 100644
--- a/internal/api/handlers/user_collection_imports.go
+++ b/internal/api/handlers/user_collection_imports.go
@@ -92,12 +92,6 @@ type UserImportTMDBListRequest struct {
 	URL string `json:"url"`
 }
 
-type UserImportTraktRequest struct {
-	UserImportSharedFields
-	Preset    string `json:"preset"`
-	MediaType string `json:"media_type"`
-}
-
 type UserImportView struct {
 	Collection PersonalCollectionView      `json:"collection"`
 	Sync       *usercollections.SyncResult `json:"sync,omitempty"`
@@ -139,22 +133,15 @@ func (h *UserCollectionImportHandler) HandleImportTMDB(w http.ResponseWriter, r
 	writeJSON(w, http.StatusCreated, resp)
 }
 
+// HandleImportTrakt answers the frozen v1 profile Trakt import route. Prairie no
+// longer supports Trakt, so every well-formed request is refused.
 func (h *UserCollectionImportHandler) HandleImportTrakt(w http.ResponseWriter, r *http.Request) {
-	var req UserImportTraktRequest
+	var req struct{}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		writeError(w, http.StatusBadRequest, "bad_request", "Invalid request body")
 		return
 	}
-	userID := apimw.GetUserID(r.Context())
-	resp, err := h.ImportTrakt(r.Context(), userID, apimw.GetProfileID(r.Context()), req)
-	if err == nil {
-		err = v1CollectionAudience(r.Context(), h.storeProvider, userID, &resp.Collection)
-	}
-	if err != nil {
-		writeAPIError(w, err)
-		return
-	}
-	writeJSON(w, http.StatusCreated, resp)
+	writeAPIError(w, traktImportRetired())
 }
 
 // ImportMDBList creates an MDBList-backed collection for the profile and
@@ -229,36 +216,6 @@ func (h *UserCollectionImportHandler) ImportTMDBList(ctx context.Context, userID
 	return h.createImportedCollection(ctx, userID, profileID, "tmdb", cfg, req.UserImportSharedFields)
 }
 
-// ImportTrakt creates a Trakt-preset collection for the profile and runs its
-// first sync.
-func (h *UserCollectionImportHandler) ImportTrakt(ctx context.Context, userID int, profileID string, req UserImportTraktRequest) (UserImportView, error) {
-	var none UserImportView
-	return none, apiError(http.StatusGone, "unsupported_source", "new Trakt collections are not supported")
-	/* Legacy implementation retained below so existing Trakt collections can
-	continue to sync while creation is disabled.
-	if strings.TrimSpace(req.Title) == "" {
-		return none, fieldError("title", "title is required")
-	}
-	preset, mediaType, normalizedProfileID, err := normalizeTraktPresetRequest(req.Preset, req.MediaType, profileID)
-	if err != nil {
-		return none, apiError(http.StatusBadRequest, policyErrorBadRequest, err.Error())
-	}
-	if err := validateOptionalLimit(req.Limit); err != nil {
-		return none, err
-	}
-	cfg := usercollections.SourceConfig{
-		Mode:       usercollections.SourceModeTraktPreset,
-		Provider:   "trakt",
-		Preset:     preset,
-		MediaType:  mediaType,
-		ProfileID:  normalizedProfileID,
-		Limit:      req.Limit,
-		LibraryIDs: req.LibraryIDs,
-	}
-	return h.createImportedCollection(ctx, userID, profileID, "trakt", cfg, req.UserImportSharedFields)
-	*/
-}
-
 func (h *UserCollectionImportHandler) createImportedCollection(
 	ctx context.Context,
 	userID int,
@@ -501,8 +458,8 @@ func validateOptionalLimit(limit *int) error {
 	if limit == nil {
 		return nil
 	}
-	if *limit <= 0 || *limit > collectionutil.MaxExplicitItemLimit {
-		return fieldError("limit", fmt.Sprintf("limit must be between 1 and %d", collectionutil.MaxExplicitItemLimit))
+	if *limit <= 0 {
+		return fieldError("limit", "limit must be at least 1")
 	}
 	return nil
 }
diff --git a/internal/api/handlers/user_collection_imports_limit_test.go b/internal/api/handlers/user_collection_imports_limit_test.go
new file mode 100644
index 0000000000..b30fc793d1
--- /dev/null
+++ b/internal/api/handlers/user_collection_imports_limit_test.go
@@ -0,0 +1,21 @@
+package handlers
+
+import "testing"
+
+// Imports accept any positive item limit: a synced collection has no item cap
+// of its own.
+func TestValidateOptionalLimit(t *testing.T) {
+	if err := validateOptionalLimit(nil); err != nil {
+		t.Fatalf("validateOptionalLimit(nil) = %v, want nil", err)
+	}
+	for _, limit := range []int{1, 500, 501, 10000} {
+		if err := validateOptionalLimit(&limit); err != nil {
+			t.Fatalf("validateOptionalLimit(%d) = %v, want nil", limit, err)
+		}
+	}
+	for _, limit := range []int{0, -1} {
+		if err := validateOptionalLimit(&limit); err == nil {
+			t.Fatalf("validateOptionalLimit(%d) accepted a non-positive limit", limit)
+		}
+	}
+}
diff --git a/internal/api/handlers/user_state.go b/internal/api/handlers/user_state.go
index b2bd103854..fa5cb00473 100644
--- a/internal/api/handlers/user_state.go
+++ b/internal/api/handlers/user_state.go
@@ -12,6 +12,8 @@ type itemUserStateResponse struct {
 	Played      bool `json:"played"`
 	IsFavorite  bool `json:"is_favorite"`
 	InWatchlist bool `json:"in_watchlist"`
+	// NotInterested is served by v2 only; the frozen v1 shape leaves it out.
+	NotInterested bool `json:"-"`
 }
 
 type itemUserStateOptions struct {
@@ -80,6 +82,10 @@ func resolveItemUserStatesWithOptions(
 	if err != nil {
 		return nil, err
 	}
+	notInterestedMap, err := store.ListNotInterestedByMediaItems(ctx, profileID, contentIDs)
+	if err != nil {
+		return nil, err
+	}
 
 	progressIDs := append([]string{}, contentIDs...)
 	seriesEpisodes := map[string][]string{}
@@ -154,8 +160,9 @@ func resolveItemUserStatesWithOptions(
 			continue
 		}
 		state := &itemUserStateResponse{
-			IsFavorite:  favoriteMap[item.ContentID],
-			InWatchlist: watchlistMap[item.ContentID],
+			IsFavorite:    favoriteMap[item.ContentID],
+			InWatchlist:   watchlistMap[item.ContentID],
+			NotInterested: notInterestedMap[item.ContentID],
 		}
 		switch item.Type {
 		case itemTypeSeries:
diff --git a/internal/api/handlers/user_state_episode_db_test.go b/internal/api/handlers/user_state_episode_db_test.go
index 2f970e4b25..f966ab2bd9 100644
--- a/internal/api/handlers/user_state_episode_db_test.go
+++ b/internal/api/handlers/user_state_episode_db_test.go
@@ -102,10 +102,10 @@ func checkEpisodeCompletionUserStates(t *testing.T, pool *pgxpool.Pool, store us
 	if err := store.SetProgressAt(t.Context(), profileID, episode1, 100, 100, true, at); err != nil {
 		t.Fatal(err)
 	}
-	if err := store.AddFavorite(t.Context(), profileID, series); err != nil {
+	if _, err := store.AddFavorite(t.Context(), profileID, series); err != nil {
 		t.Fatal(err)
 	}
-	if err := store.AddToWatchlist(t.Context(), profileID, season); err != nil {
+	if _, err := store.AddToWatchlist(t.Context(), profileID, season); err != nil {
 		t.Fatal(err)
 	}
 	items := []*models.MediaItem{nil, {ContentID: series, Type: "series"}, {ContentID: season, Type: "season"}, {ContentID: empty, Type: "series"}, {ContentID: episode1, Type: "episode"}, {ContentID: series, Type: "series"}}
diff --git a/internal/api/handlers/user_state_events.go b/internal/api/handlers/user_state_events.go
index 21d1ba4718..6849da26b9 100644
--- a/internal/api/handlers/user_state_events.go
+++ b/internal/api/handlers/user_state_events.go
@@ -14,12 +14,15 @@ type userStateEventPayload struct {
 	Played      *bool  `json:"played,omitempty"`
 	IsFavorite  *bool  `json:"is_favorite,omitempty"`
 	InWatchlist *bool  `json:"in_watchlist,omitempty"`
+	// NotInterested accompanies change "not_interested".
+	NotInterested *bool `json:"not_interested,omitempty"`
 }
 
 type userStateEventState struct {
-	Played      *bool
-	IsFavorite  *bool
-	InWatchlist *bool
+	Played        *bool
+	IsFavorite    *bool
+	InWatchlist   *bool
+	NotInterested *bool
 }
 
 const userStateChangedEvent = "user_state.changed"
@@ -35,13 +38,14 @@ func publishUserStateEvent(
 		return
 	}
 	_ = hub.PublishJSON(ctx, evt.ChannelUserState, userStateChangedEvent, userStateEventPayload{
-		ProfileID:   profileID,
-		ContentID:   contentID,
-		SeriesID:    seriesID,
-		Change:      change,
-		Played:      state.Played,
-		IsFavorite:  state.IsFavorite,
-		InWatchlist: state.InWatchlist,
+		ProfileID:     profileID,
+		ContentID:     contentID,
+		SeriesID:      seriesID,
+		Change:        change,
+		Played:        state.Played,
+		IsFavorite:    state.IsFavorite,
+		InWatchlist:   state.InWatchlist,
+		NotInterested: state.NotInterested,
 	}, evt.PublishOptions{
 		UserID:    userID,
 		ProfileID: profileID,
diff --git a/internal/api/handlers/watch_state_service.go b/internal/api/handlers/watch_state_service.go
index 0335f529f6..7eb8e879d8 100644
--- a/internal/api/handlers/watch_state_service.go
+++ b/internal/api/handlers/watch_state_service.go
@@ -104,13 +104,22 @@ func (h *ItemsHandler) populateWatchMarkers(ctx context.Context, detail *catalog
 // episodes and an ebook's read state lives in the reader-progress store. It
 // is the command behind v1 POST/DELETE /watched/{id} and the v2 operations.
 func (h *ItemsHandler) SetWatchedState(ctx context.Context, userID int, profileID, contentID string, played bool, filter catalog.AccessFilter) (WatchedStateView, error) {
-	targetType, targets, err := h.resolveWatchedTargets(ctx, contentID, filter)
+	targetType, targets, err := h.resolveWatchedTargets(ctx, contentID, played, filter)
 	if err != nil {
 		if isNotFound(err) {
 			return WatchedStateView{}, apiError(http.StatusNotFound, "not_found", "Item not found")
 		}
 		return WatchedStateView{}, apiError(http.StatusInternalServerError, "internal_error", "Failed to update watched state")
 	}
+	if !played && h.watchState != nil && (targetType == watchstate.ParentSeries || targetType == watchstate.ParentSeason) {
+		ids, err := h.watchState.ParentUnwatchTargets(ctx, userID, profileID, h.episodeRepo, targetType, contentID)
+		if err != nil {
+			return WatchedStateView{}, apiError(http.StatusInternalServerError, "internal_error", "Failed to update watched state")
+		}
+		for _, id := range ids {
+			targets = append(targets, watchedLeafTarget{ContentID: id})
+		}
+	}
 
 	switch {
 	case targetType == itemTypeEbook:
@@ -132,7 +141,7 @@ func (h *ItemsHandler) SetWatchedState(ctx context.Context, userID int, profileI
 		return WatchedStateView{}, apiError(http.StatusInternalServerError, "internal_error", "Failed to update watched state")
 	}
 
-	triggerProfileRefresh(ctx, h.profileStaler, h.profileRefreshRequester, userID, profileID)
+	notifySignalsChanged(ctx, h.signalsNotifier, userID, profileID)
 	publishUserStateEvent(ctx, h.EventsHub, userID, profileID, contentID, "", "watched", userStateEventState{
 		Played: boolPtr(played),
 	})
@@ -145,6 +154,41 @@ func (h *ItemsHandler) SetWatchedState(ctx context.Context, userID int, profileI
 	}, nil
 }
 
+// ClearResumePosition clears the profile's resume position on a movie or
+// episode and keeps its watched state and watch history; an item without a
+// resume position is a no-op. A season, series or ebook has no single resume
+// position (400 invalid_watch_target); an unknown or inaccessible item is 404,
+// as is a kind the watched-state resolver does not handle, such as an
+// audiobook.
+// It is the command behind the v2 operation; the frozen v1 API has none.
+func (h *ItemsHandler) ClearResumePosition(ctx context.Context, userID int, profileID, contentID string, filter catalog.AccessFilter) error {
+	// Only the target's type is needed: a season or series is rejected
+	// without loading its episodes.
+	target, err := h.lookupWatchedTarget(ctx, contentID, filter)
+	if err != nil {
+		if isNotFound(err) {
+			return apiError(http.StatusNotFound, "not_found", "Item not found")
+		}
+		return apiError(http.StatusInternalServerError, "internal_error", "Failed to clear resume position")
+	}
+	if target.Type != itemTypeMovie && target.Type != itemTypeEpisode {
+		return apiError(http.StatusBadRequest, "invalid_watch_target", "Only a movie or an episode has a resume position")
+	}
+	if h.watchState == nil {
+		return apiError(http.StatusInternalServerError, "internal_error", "Failed to access user store")
+	}
+	cleared, err := h.watchState.ClearResumePosition(ctx, userID, profileID, contentID)
+	if err != nil {
+		return apiError(http.StatusInternalServerError, "internal_error", "Failed to clear resume position")
+	}
+	if !cleared {
+		return nil
+	}
+	notifySignalsChanged(ctx, h.signalsNotifier, userID, profileID)
+	publishUserStateEvent(ctx, h.EventsHub, userID, profileID, contentID, "", "progress", userStateEventState{})
+	return nil
+}
+
 // markLeafTargetsWatched records a manual play for every leaf target the
 // profile has not already completed and queues one outbound provider event
 // for the plays it recorded. A target already completed is a no-op: no
diff --git a/internal/api/handlers/watch_state_unwatch_db_test.go b/internal/api/handlers/watch_state_unwatch_db_test.go
new file mode 100644
index 0000000000..cdee086aee
--- /dev/null
+++ b/internal/api/handlers/watch_state_unwatch_db_test.go
@@ -0,0 +1,135 @@
+package handlers
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/userstore/pgstore"
+	"github.com/prairie-server/prairie-server/internal/watchstate"
+)
+
+// A watched episode whose file was deleted has no library membership, so the
+// episode listings leave it out. Marking its series or season unwatched must
+// still clear it: its completed progress otherwise keeps anchoring Next Up on
+// the series. File-less episodes nobody watched stay out of the unwatch.
+func TestParentUnwatchClearsEpisodesWithoutLibraryFilePostgres(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := t.Context()
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(pool.Close)
+
+	for _, parent := range []string{watchstate.ParentSeries, watchstate.ParentSeason} {
+		t.Run(parent, func(t *testing.T) {
+			exec := func(sql string, args ...any) {
+				t.Helper()
+				if _, err := pool.Exec(ctx, sql, args...); err != nil {
+					t.Fatal(err)
+				}
+			}
+			prefix := fmt.Sprintf("parent-unwatch-%s-%d", parent, time.Now().UnixNano())
+			series := prefix + "-series"
+			season := prefix + "-season-1"
+			deleted1, deleted2, onDisk, neverWatched := prefix+"-s01e01", prefix+"-s01e02", prefix+"-s01e03", prefix+"-s01e04"
+			var folder, userID int
+			if err := pool.QueryRow(ctx, `INSERT INTO media_folders (type,name,enabled) VALUES ('series',$1,true) RETURNING id`, prefix).Scan(&folder); err != nil {
+				t.Fatal(err)
+			}
+			if err := pool.QueryRow(ctx, `INSERT INTO users (username,role) VALUES ($1,'user') RETURNING id`, prefix).Scan(&userID); err != nil {
+				t.Fatal(err)
+			}
+			t.Cleanup(func() {
+				_, _ = pool.Exec(context.Background(), `DELETE FROM users WHERE id=$1`, userID)
+				_, _ = pool.Exec(context.Background(), `DELETE FROM media_files WHERE media_folder_id=$1`, folder)
+				_, _ = pool.Exec(context.Background(), `DELETE FROM media_items WHERE content_id=$1`, series)
+				_, _ = pool.Exec(context.Background(), `DELETE FROM media_folders WHERE id=$1`, folder)
+			})
+			exec(`INSERT INTO media_items (content_id,type,title) VALUES ($1,'series','Unwatch Series')`, series)
+			exec(`INSERT INTO media_item_libraries (content_id,media_folder_id) VALUES ($1,$2)`, series, folder)
+			if err := catalog.NewSeasonRepository(pool).Upsert(ctx, &models.Season{ContentID: season, SeriesID: series, SeasonNumber: 1, Title: "Season 1", DefaultMetadataLanguage: "en"}); err != nil {
+				t.Fatal(err)
+			}
+			exec(`INSERT INTO episodes (content_id,series_id,season_id,season_number,episode_number,title) VALUES
+				($1,$5,$6,1,1,'Deleted one'), ($2,$5,$6,1,2,'Deleted two'), ($3,$5,$6,1,3,'On disk'), ($4,$5,$6,1,4,'Never watched')`,
+				deleted1, deleted2, onDisk, neverWatched, series, season)
+			exec(`INSERT INTO episode_libraries (episode_id,media_folder_id) VALUES ($1,$2)`, onDisk, folder)
+			exec(`INSERT INTO media_files (episode_id,media_folder_id,file_path) VALUES ($1,$2,$3)`, onDisk, folder, "/"+onDisk)
+			profileID := fmt.Sprintf("00000000-0000-4000-8000-%012d", time.Now().UnixNano()%1_000_000_000_000)
+			exec(`INSERT INTO user_profiles (id,user_id,name) VALUES ($1,$2,'Unwatch fixture')`, profileID, userID)
+
+			provider := pgstore.NewPostgresProvider(pool)
+			episodes := catalog.NewEpisodeRepository(pool)
+			handler := &ItemsHandler{
+				itemRepo:    catalog.NewItemRepository(pool),
+				seasonRepo:  catalog.NewSeasonRepository(pool),
+				episodeRepo: episodes,
+				watchState:  watchstate.NewService(provider),
+			}
+			nextUp := catalog.NewNextUpRepository(pool, provider)
+			listNextUp := func() []catalog.NextUpResult {
+				t.Helper()
+				results, err := nextUp.ListNextUp(ctx, catalog.NextUpQuery{UserID: userID, ProfileID: profileID, SeriesID: series, Limit: 5})
+				if err != nil {
+					t.Fatal(err)
+				}
+				return results
+			}
+
+			// The two episodes were watched while their files existed; the
+			// scanner then dropped their library membership.
+			if err := handler.markLeafTargetsWatched(ctx, userID, profileID, []watchedLeafTarget{{ContentID: deleted1}, {ContentID: deleted2}}); err != nil {
+				t.Fatal(err)
+			}
+			if got := listNextUp(); len(got) != 1 || got[0].ContentID != onDisk {
+				t.Fatalf("next up before unwatch = %+v, want %s", got, onDisk)
+			}
+
+			target := series
+			if parent == watchstate.ParentSeason {
+				target = season
+			}
+			view, err := handler.SetWatchedState(ctx, userID, profileID, target, false, catalog.AccessFilter{})
+			if err != nil {
+				t.Fatalf("SetWatchedState: %v", err)
+			}
+			if view.Type != parent || view.AffectedCount != 3 {
+				t.Fatalf("view = %+v, want %s with the on-disk episode and the two watched deleted ones", view, parent)
+			}
+			if got := listNextUp(); len(got) != 0 {
+				t.Fatalf("next up after unwatch = %+v, want the series gone", got)
+			}
+			store, err := provider.ForUser(ctx, userID)
+			if err != nil {
+				t.Fatal(err)
+			}
+			for _, id := range []string{deleted1, deleted2} {
+				progress, err := store.GetProgress(ctx, profileID, id)
+				if err != nil {
+					t.Fatal(err)
+				}
+				if progress != nil {
+					t.Fatalf("%s progress after unwatch = %+v, want cleared", id, progress)
+				}
+			}
+			var hiddenNeverWatched int
+			if err := pool.QueryRow(ctx, `SELECT count(*) FROM user_history_hidden_items WHERE user_id=$1 AND media_item_id=$2`, userID, neverWatched).Scan(&hiddenNeverWatched); err != nil {
+				t.Fatal(err)
+			}
+			if hiddenNeverWatched != 0 {
+				t.Fatal("unwatch hid the never-watched file-less episode; want it left out")
+			}
+		})
+	}
+}
diff --git a/internal/api/handlers/watch_together.go b/internal/api/handlers/watch_together.go
index 66cb5ebb4d..f0d9e2bfc0 100644
--- a/internal/api/handlers/watch_together.go
+++ b/internal/api/handlers/watch_together.go
@@ -231,6 +231,12 @@ func (c *watchTogetherRoomConn) Close() error {
 	return err
 }
 
+// LegacyRoomProtocol reports a connection on the frozen /api/v1 room socket,
+// which keeps its narrower host band.
+func (c *watchTogetherRoomConn) LegacyRoomProtocol() bool {
+	return !c.includeMemberStatus
+}
+
 // CloseReplaced uses the socket's single writer and waits for the terminal
 // frame to be written before closing. A blocked peer can delay takeover by at
 // most one second. V1 keeps its frozen, unexplained close behavior.
diff --git a/internal/api/handlers/watch_together_socket_v2.go b/internal/api/handlers/watch_together_socket_v2.go
index 7db78c01fe..833be4216a 100644
--- a/internal/api/handlers/watch_together_socket_v2.go
+++ b/internal/api/handlers/watch_together_socket_v2.go
@@ -31,8 +31,8 @@ type WatchTogetherSocketV2 struct {
 	checkInterval  time.Duration
 }
 
-func NewWatchTogetherSocketV2(room *WatchTogetherHandler, tickets *watchtogether.RoomSocketCredentialStore, sessions eventsSessionValidator, users access.UserRepository, resolver apimw.ViewerResolver, primary apimw.PrimaryProfileChecker, publicURL string) *WatchTogetherSocketV2 {
-	return &WatchTogetherSocketV2{Room: room, Tickets: tickets, Validate: refuseRemotePlaybackSocket(newSocketAuthorityValidator(sessions, users, resolver, primary)), PublicOrigin: publicURL}
+func NewWatchTogetherSocketV2(room *WatchTogetherHandler, tickets *watchtogether.RoomSocketCredentialStore, sessions eventsSessionValidator, users access.UserRepository, resolver apimw.ViewerResolver, actingAdmin apimw.ActingAdminDecider, publicURL string) *WatchTogetherSocketV2 {
+	return &WatchTogetherSocketV2{Room: room, Tickets: tickets, Validate: refuseRemotePlaybackSocket(newSocketAuthorityValidator(sessions, users, resolver, actingAdmin)), PublicOrigin: publicURL}
 }
 func (h *WatchTogetherSocketV2) available() bool {
 	return h != nil && h.Room != nil && h.Room.Service != nil && h.Room.TokenService != nil && h.Tickets != nil && h.Validate != nil
diff --git a/internal/api/handlers/watch_together_socket_v2_test.go b/internal/api/handlers/watch_together_socket_v2_test.go
index 5b08400669..6955bd7f5a 100644
--- a/internal/api/handlers/watch_together_socket_v2_test.go
+++ b/internal/api/handlers/watch_together_socket_v2_test.go
@@ -16,6 +16,7 @@ import (
 	"github.com/gorilla/websocket"
 
 	"github.com/prairie-server/prairie-server/internal/access"
+	apimw "github.com/prairie-server/prairie-server/internal/api/middleware"
 	"github.com/prairie-server/prairie-server/internal/auth"
 	evt "github.com/prairie-server/prairie-server/internal/events"
 	"github.com/prairie-server/prairie-server/internal/models"
@@ -297,7 +298,7 @@ func TestRoomSocketV2MintValidatesRoomAndCurrentPIN(t *testing.T) {
 	users := &socketUserFixture{user: models.User{ID: 7, Role: "user", Enabled: true}}
 	sessions := &socketSessionFixture{valid: true, account: users}
 	viewer := &socketViewerFixture{scope: access.Scope{UserID: 7, ProfileID: "profile", ProfileVerified: true, PolicyRevision: 1}}
-	h.Validate = newSocketAuthorityValidator(sessions, users, viewer, func(context.Context, int, string) (bool, bool, error) { return false, true, nil })
+	h.Validate = newSocketAuthorityValidator(sessions, users, viewer, apimw.NewActingAdminDecider(func(context.Context, int, string) (bool, bool, error) { return false, true, nil }, nil))
 	identity := evt.SocketIdentity{UserID: 7, SessionID: "session", Role: "user", ProfileID: "profile", ProfileToken: "original-pin", AccessExpiresAt: time.Now().Add(time.Minute)}
 	proof, _, err := h.Room.TokenService.Mint(watchtogether.RoomTokenClaims{RoomID: "room", UserID: 7, ProfileID: "profile"})
 	if err != nil {
diff --git a/internal/api/handlers/watch_tonight.go b/internal/api/handlers/watch_tonight.go
index 4b181dd82f..d18d7689d8 100644
--- a/internal/api/handlers/watch_tonight.go
+++ b/internal/api/handlers/watch_tonight.go
@@ -2,6 +2,7 @@ package handlers
 
 import (
 	"context"
+	"fmt"
 	"log/slog"
 	"net/http"
 	"sort"
@@ -59,7 +60,7 @@ func (h *RecommendationsHandler) HandleWatchTonight(w http.ResponseWriter, r *ht
 			limit = n
 		}
 	}
-	resp, err := h.WatchTonight(r.Context(), apimw.GetUserID(r.Context()), apimw.GetProfileID(r.Context()), requestAccessFilter(r), limit)
+	resp, err := h.watchTonight(r.Context(), apimw.GetUserID(r.Context()), apimw.GetProfileID(r.Context()), requestAccessFilter(r), limit, true)
 	if err != nil {
 		writeAPIError(w, err)
 		return
@@ -70,6 +71,17 @@ func (h *RecommendationsHandler) HandleWatchTonight(w http.ResponseWriter, r *ht
 // WatchTonight is the Watch Tonight seam: the merged, boosted and enriched
 // list the v1 and v2 handlers both answer. limit must already be validated.
 func (h *RecommendationsHandler) WatchTonight(ctx context.Context, userID int, profileID string, filter catalog.AccessFilter, limit int) (WatchTonightView, error) {
+	return h.watchTonight(ctx, userID, profileID, filter, limit, false)
+}
+
+// watchTonight is WatchTonight. With emptyOnFetchError, a failed item lookup
+// answers the list without items instead of an error, as the frozen v1 route
+// always has.
+func (h *RecommendationsHandler) watchTonight(ctx context.Context, userID int, profileID string, filter catalog.AccessFilter, limit int, emptyOnFetchError bool) (WatchTonightView, error) {
+	// The reader and the filter below each leave out what the profile
+	// watched; read that once.
+	ctx = recommendations.WithWatchedSetMemo(ctx)
+
 	// Fan out: recommendation candidates + live CW/Next-Up in parallel.
 	var (
 		recResult recommendations.WatchTonightResult
@@ -203,15 +215,23 @@ func (h *RecommendationsHandler) WatchTonight(ctx context.Context, userID int, p
 		return resp, nil
 	}
 
-	itemMap, overlayMap, stateMap, enrichedEpMeta := h.enrichItems(ctx, userID, profileID, filter, contentIDs)
+	enriched, err := h.enrichItems(ctx, userID, profileID, filter, contentIDs)
+	if err != nil {
+		slog.WarnContext(ctx, "WatchTonight: item details failed", "component", "api", "user_id", userID, "profile_id", profileID, "error", err)
+		if emptyOnFetchError {
+			return resp, nil
+		}
+		return WatchTonightView{}, recommendationsUnavailable("Failed to fetch item details")
+	}
 
+	artwork := h.featuredCardArtwork(ctx, enriched.items, filter.Artwork())
 	for _, m := range merged {
-		mi, ok := itemMap[m.scored.MediaItemID]
+		mi, ok := enriched.items[m.scored.MediaItemID]
 		if !ok || mi == nil {
 			continue
 		}
 
-		item := h.buildSectionItem(ctx, mi, overlayMap, stateMap)
+		item := h.buildSectionItem(mi, enriched.overlays, enriched.states, artwork[mi.ContentID])
 		item.ItemSource = m.source
 
 		// Apply CW/Next-Up metadata (position, duration, progress).
@@ -235,7 +255,7 @@ func (h *RecommendationsHandler) WatchTonight(ctx context.Context, userID int, p
 
 		// Fill in episode metadata from the enrichment step for items that came
 		// through the episodes table (CW/Next-Up episodes).
-		if epMeta, ok := enrichedEpMeta[m.scored.MediaItemID]; ok {
+		if epMeta, ok := enriched.episodeMeta[m.scored.MediaItemID]; ok {
 			if epMeta.SeriesID != nil && item.SeriesID == "" {
 				item.SeriesID = *epMeta.SeriesID
 			}
@@ -378,48 +398,55 @@ func (h *RecommendationsHandler) fetchLiveCWAndNextUp(ctx context.Context, userI
 	return cwItems, nextUpItems, nil
 }
 
+// watchTonightEnrichment is what enrichItems loads for a set of content IDs.
+// An ID missing from items is one the viewer cannot see or that no longer
+// exists.
+type watchTonightEnrichment struct {
+	items       map[string]*models.MediaItem
+	overlays    map[string]*models.OverlaySummary
+	states      map[string]*itemUserStateResponse
+	episodeMeta map[string]sections.SectionItemMeta
+}
+
 // enrichItems fetches full MediaItem objects, overlay summaries, and user states
 // for the given content IDs. Handles both movies/series (from media_items) and
 // episodes (from episodes table) since CW/Next-Up items are episode content IDs.
-func (h *RecommendationsHandler) enrichItems(ctx context.Context, userID int, profileID string, filter catalog.AccessFilter, contentIDs []string) (
-	itemMap map[string]*models.MediaItem,
-	overlayMap map[string]*models.OverlaySummary,
-	stateMap map[string]*itemUserStateResponse,
-	episodeMeta map[string]sections.SectionItemMeta,
-) {
+// A failed item or episode lookup is an error: answering without the items
+// would look like an empty list. Overlays and user states are decorations and
+// degrade to absent.
+func (h *RecommendationsHandler) enrichItems(ctx context.Context, userID int, profileID string, filter catalog.AccessFilter, contentIDs []string) (watchTonightEnrichment, error) {
+	var out watchTonightEnrichment
 	if h.Fetcher == nil || len(contentIDs) == 0 {
-		return nil, nil, nil, nil
+		return out, nil
 	}
 
 	// Fetch movies/series from media_items table.
 	mediaItems, err := h.Fetcher.FetchItemsByContentIDs(ctx, contentIDs, filter)
 	if err != nil {
-		slog.ErrorContext(ctx, "WatchTonight: fetch items failed", "component", "api", "error", err)
-		return nil, nil, nil, nil
+		return out, fmt.Errorf("fetch items: %w", err)
 	}
 
-	itemMap = make(map[string]*models.MediaItem, len(mediaItems)*2)
+	out.items = make(map[string]*models.MediaItem, len(mediaItems)*2)
 	for _, mi := range mediaItems {
-		itemMap[mi.ContentID] = mi
+		out.items[mi.ContentID] = mi
 	}
 
 	// Also fetch episodes — CW/Next-Up content IDs are typically episode IDs.
-	episodeItems, epMeta, epErr := h.Fetcher.FetchEpisodesByContentIDs(ctx, contentIDs, filter)
-	if epErr != nil {
-		slog.ErrorContext(ctx, "WatchTonight: fetch episodes failed", "component", "api", "error", epErr)
-	} else {
-		for _, item := range episodeItems {
-			itemMap[item.ContentID] = item
-		}
-		episodeMeta = epMeta
-		mediaItems = append(mediaItems, episodeItems...)
+	episodeItems, epMeta, err := h.Fetcher.FetchEpisodesByContentIDs(ctx, contentIDs, filter)
+	if err != nil {
+		return out, fmt.Errorf("fetch episodes: %w", err)
+	}
+	for _, item := range episodeItems {
+		out.items[item.ContentID] = item
 	}
+	out.episodeMeta = epMeta
+	mediaItems = append(mediaItems, episodeItems...)
 
 	overlays, err := h.Fetcher.ListOverlaySummaries(ctx, contentIDs, filter)
 	if err != nil {
-		slog.ErrorContext(ctx, "WatchTonight: overlay summaries failed", "component", "api", "error", err)
+		slog.WarnContext(ctx, "WatchTonight: overlay summaries failed", "component", "api", "error", err)
 	} else {
-		overlayMap = overlays
+		out.overlays = overlays
 	}
 
 	if h.storeProvider != nil {
@@ -430,17 +457,17 @@ func (h *RecommendationsHandler) enrichItems(ctx context.Context, userID int, pr
 				EbookProgressStore: h.EbookProgress,
 			})
 			if stateErr == nil {
-				stateMap = states
+				out.states = states
 			}
 		}
 	}
 
-	return itemMap, overlayMap, stateMap, episodeMeta
+	return out, nil
 }
 
-// buildSectionItem constructs a sectionItemResponse from a MediaItem,
-// applying presigning and overlay/state lookups.
-func (h *RecommendationsHandler) buildSectionItem(ctx context.Context, mi *models.MediaItem, overlayMap map[string]*models.OverlaySummary, stateMap map[string]*itemUserStateResponse) sectionItemResponse {
+// buildSectionItem constructs a sectionItemResponse from a MediaItem with its
+// resolved artwork (see featuredCardArtwork) and overlay/state lookups.
+func (h *RecommendationsHandler) buildSectionItem(mi *models.MediaItem, overlayMap map[string]*models.OverlaySummary, stateMap map[string]*itemUserStateResponse, urls sectionItemImageURLs) sectionItemResponse {
 	item := sectionItemResponse{
 		ContentID:              mi.ContentID,
 		Type:                   mi.Type,
@@ -462,11 +489,7 @@ func (h *RecommendationsHandler) buildSectionItem(ctx context.Context, mi *model
 	if item.Genres == nil {
 		item.Genres = []string{}
 	}
-	if h.DetailSvc != nil {
-		item.PosterURL = h.DetailSvc.PresignURL(ctx, featuredPosterPath(mi.PosterPath), "featured")
-		item.BackdropURL = h.DetailSvc.PresignURL(ctx, featuredBackdropPath(mi.BackdropPath), "featured")
-		item.LogoURL = h.DetailSvc.PresignURL(ctx, mi.LogoPath, "featured")
-	}
+	item.PosterURL, item.BackdropURL, item.LogoURL = urls.posterURL, urls.backdropURL, urls.logoURL
 	if overlayMap != nil {
 		item.OverlaySummary = overlayMap[mi.ContentID]
 	}
diff --git a/internal/api/handlers/watch_tonight_cards.go b/internal/api/handlers/watch_tonight_cards.go
index a41aaded45..42a0aac617 100644
--- a/internal/api/handlers/watch_tonight_cards.go
+++ b/internal/api/handlers/watch_tonight_cards.go
@@ -11,7 +11,9 @@ import (
 	"strings"
 
 	apimw "github.com/prairie-server/prairie-server/internal/api/middleware"
+	"github.com/prairie-server/prairie-server/internal/artworkkey"
 	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/imagesize"
 	"github.com/prairie-server/prairie-server/internal/models"
 	"github.com/prairie-server/prairie-server/internal/recommendations"
 )
@@ -26,6 +28,8 @@ type swipeCardCastMember struct {
 	Name      string `json:"name"`
 	Character string `json:"character,omitempty"`
 	PhotoURL  string `json:"photo_url,omitempty"`
+	// photoPath is the stored headshot WatchTonightCards resolves into PhotoURL.
+	photoPath string
 }
 
 // swipeCardResponse extends sectionItemResponse with cast and runtime for the card back.
@@ -65,6 +69,17 @@ const (
 	discoverMaxPoolSize = 500
 )
 
+// discoverCardsRepo is the part of *recommendations.Repo discover-mode
+// cards read.
+type discoverCardsRepo interface {
+	GetTasteProfile(ctx context.Context, userID int, profileID string) ([]float32, error)
+	FindTasteProfileCandidates(ctx context.Context, embedding []float32, excludeIDs []string, genres []string, limit int, filter catalog.AccessFilter) ([]recommendations.ScoredItem, map[string][]string, error)
+	GetItemAllGenres(ctx context.Context, itemIDs []string) (map[string][]string, error)
+	GetRecommendationCache(ctx context.Context, userID int, profileID, recType, sourceItemID string) ([]recommendations.ScoredItem, error)
+	ListDefaultRowItems(ctx context.Context, filter catalog.AccessFilter, kind string, exclude []string, limit int) ([]recommendations.ScoredItem, error)
+	FilterRecommendableItemIDs(ctx context.Context, itemIDs []string, filter catalog.AccessFilter) (map[string]struct{}, error)
+}
+
 // knownGenres is the validated set of genre names accepted by the cards endpoint.
 var knownGenres = map[string]struct{}{
 	"Action": {}, "Adventure": {}, "Animation": {}, "Comedy": {},
@@ -92,23 +107,91 @@ func (h *RecommendationsHandler) HandleWatchTonightCards(w http.ResponseWriter,
 			limit = n
 		}
 	}
-	resp := h.WatchTonightCards(r.Context(), apimw.GetUserID(r.Context()), apimw.GetProfileID(r.Context()), requestAccessFilter(r), mode, genres, excludeIDs, limit)
+	resp, err := h.watchTonightCards(r.Context(), apimw.GetUserID(r.Context()), apimw.GetProfileID(r.Context()), requestAccessFilter(r), mode, genres, excludeIDs, limit, true)
+	if err != nil {
+		writeAPIError(w, err)
+		return
+	}
 	writeJSON(w, http.StatusOK, resp)
 }
 
 // WatchTonightCards is the swipe-card seam. mode is "continue" or
 // "discover", genres are already validated against KnownWatchTonightGenres,
-// excludeIDs is already bounded, and limit is within 1..swipeMaxLimit; the
-// seam never fails, every fetch failure degrades to an empty or shorter page
-// as v1 does.
-func (h *RecommendationsHandler) WatchTonightCards(ctx context.Context, userID int, profileID string, filter catalog.AccessFilter, mode string, genres []string, excludeIDs map[string]struct{}, limit int) WatchTonightCardsView {
+// excludeIDs is already bounded, and limit is within 1..swipeMaxLimit. A
+// candidate source that fails degrades to a shorter page; a failed item
+// lookup is an error, since the page would look empty.
+//
+// Cast members carry their headshot, which the frozen v1 route never has.
+func (h *RecommendationsHandler) WatchTonightCards(ctx context.Context, userID int, profileID string, filter catalog.AccessFilter, mode string, genres []string, excludeIDs map[string]struct{}, limit int) (WatchTonightCardsView, error) {
+	view, err := h.watchTonightCards(ctx, userID, profileID, filter, mode, genres, excludeIDs, limit, false)
+	if err == nil {
+		h.resolveCastPhotos(ctx, view.Cards, filter.ImageSizeFor(imagesize.SlotPhoto))
+	}
+	return view, err
+}
+
+// resolveCastPhotos fills every card's cast headshots in one batch on the
+// profile ladder at size: unsized, the w500 item detail serves for the same
+// people. A photo stored as an http(s) URL passes through.
+func (h *RecommendationsHandler) resolveCastPhotos(ctx context.Context, cards []swipeCardResponse, size imagesize.Size) {
+	if h.DetailSvc == nil {
+		return
+	}
+	sizedPath := func(path string) string {
+		if strings.Contains(path, "://") {
+			return path // plugin-hosted: its hint picks the size
+		}
+		medium := artworkkey.Variant(path, imagesize.Variant(artworkkey.ImageProfile, imagesize.Medium))
+		return sizedImagePath(path, artworkkey.ImageProfile, size, medium)
+	}
+	var paths []string
+	seen := make(map[string]struct{})
+	for _, card := range cards {
+		for _, member := range card.Cast {
+			if member.photoPath == "" || member.photoPath == "-" || isHTTPImageURL(member.photoPath) {
+				continue
+			}
+			path := sizedPath(member.photoPath)
+			if _, ok := seen[path]; !ok {
+				seen[path] = struct{}{}
+				paths = append(paths, path)
+			}
+		}
+	}
+	resolved := h.DetailSvc.PresignURLsWithExpiry(ctx, paths, imagesize.PhotoPluginVariant(size))
+	for _, card := range cards {
+		cast := card.Cast
+		for j := range cast {
+			member := &cast[j]
+			switch {
+			case member.photoPath == "" || member.photoPath == "-":
+			case isHTTPImageURL(member.photoPath):
+				member.PhotoURL = member.photoPath
+			default:
+				member.PhotoURL = resolved[sizedPath(member.photoPath)].URL
+			}
+		}
+	}
+}
+
+// watchTonightCards is WatchTonightCards. With emptyOnFetchError, a failed
+// lookup answers an empty page instead of an error, as the frozen v1 route
+// always has.
+func (h *RecommendationsHandler) watchTonightCards(ctx context.Context, userID int, profileID string, filter catalog.AccessFilter, mode string, genres []string, excludeIDs map[string]struct{}, limit int, emptyOnFetchError bool) (WatchTonightCardsView, error) {
 	var merged []mergedItem
 	var isCold bool
 
 	if mode == "continue" {
 		merged, isCold = h.buildContinueCards(ctx, userID, profileID, filter, excludeIDs, limit)
 	} else {
-		merged, isCold = h.buildDiscoverCards(ctx, userID, profileID, filter, genres, excludeIDs, limit)
+		var err error
+		merged, isCold, err = h.buildDiscoverCards(ctx, userID, profileID, filter, genres, excludeIDs, limit)
+		if err != nil {
+			if emptyOnFetchError {
+				return swipeCardsPageResponse{Cards: []swipeCardResponse{}, IsCold: isCold}, nil
+			}
+			return WatchTonightCardsView{}, err
+		}
 	}
 
 	resp := swipeCardsPageResponse{
@@ -117,50 +200,83 @@ func (h *RecommendationsHandler) WatchTonightCards(ctx context.Context, userID i
 	}
 
 	if len(merged) == 0 {
-		return resp
+		return resp, nil
 	}
 
 	// Over-fetch for enrichment so we can still fill a full page after item
 	// lookups drop inaccessible or missing entries. Trim to limit+buffer to
 	// control enrichment cost.
-	enrichLimit := limit + 10
-	if len(merged) > enrichLimit {
-		merged = merged[:enrichLimit]
+	window := merged
+	if enrichLimit := limit + 10; len(window) > enrichLimit {
+		window = window[:enrichLimit]
 	}
 
 	// Collect content IDs for enrichment.
-	contentIDs := make([]string, len(merged))
-	for i, m := range merged {
+	contentIDs := make([]string, len(window))
+	for i, m := range window {
 		contentIDs[i] = m.scored.MediaItemID
 	}
 
-	itemMap, overlayMap, stateMap, enrichedEpMeta := h.enrichItems(ctx, userID, profileID, filter, contentIDs)
-
-	// Determine if there are more items beyond what we return.
-	resp.HasMore = len(merged) > limit
-	if len(merged) > limit {
-		merged = merged[:limit]
+	enriched, err := h.enrichItems(ctx, userID, profileID, filter, contentIDs)
+	if err != nil {
+		slog.WarnContext(ctx, "WatchTonightCards: item details failed", "component", "api", "user_id", userID, "profile_id", profileID, "error", err)
+		if emptyOnFetchError {
+			return resp, nil
+		}
+		return WatchTonightCardsView{}, recommendationsUnavailable("Failed to fetch item details")
 	}
 
+	var moreHydrated bool
+	resp.Cards, moreHydrated = h.swipeCards(ctx, window, enriched, limit, filter.Artwork())
+	// More cards exist when a hydrated candidate was left over, or when this
+	// page showed cards and candidates past the enrichment window remain: the
+	// client excludes the cards it was shown, so the next page moves on. A
+	// page with no card never claims more, since its repeat would be the same.
+	resp.HasMore = moreHydrated || (len(resp.Cards) > 0 && len(merged) > len(window))
+	return resp, nil
+}
+
+// swipeCards builds up to limit cards, in order, from the candidates whose
+// items were hydrated, and reports whether a further hydrated candidate was
+// left over.
+func (h *RecommendationsHandler) swipeCards(ctx context.Context, candidates []mergedItem, enriched watchTonightEnrichment, limit int, art imagesize.Request) ([]swipeCardResponse, bool) {
 	// First pass: build enriched items and collect cast lookup IDs.
 	type enrichedCard struct {
 		item    sectionItemResponse
 		source  string
 		runtime int
+		// castLookupID is the item whose cast the card shows: the series
+		// for an episode.
+		castLookupID string
+	}
+	enrichedCards := make([]enrichedCard, 0, limit)
+	castLookupIDs := make([]string, 0, limit)
+	castLookupSeen := make(map[string]struct{}, limit)
+	more := false
+	// Artwork is resolved only for the cards this page returns; the rest of
+	// the hydration window only decides whether more remain.
+	shown := make(map[string]*models.MediaItem, limit)
+	for _, m := range candidates {
+		if len(shown) == limit {
+			break
+		}
+		if mi := enriched.items[m.scored.MediaItemID]; mi != nil {
+			shown[mi.ContentID] = mi
+		}
 	}
-	enrichedCards := make([]enrichedCard, 0, len(merged))
-	castLookupIDs := make([]string, 0, len(merged))
-	castLookupSeen := make(map[string]struct{}, len(merged))
-	// Map content ID → cast lookup ID for the second pass.
-	contentToCastLookup := make(map[string]string, len(merged))
+	artwork := h.featuredCardArtwork(ctx, shown, art)
 
-	for _, m := range merged {
-		mi, ok := itemMap[m.scored.MediaItemID]
+	for _, m := range candidates {
+		mi, ok := enriched.items[m.scored.MediaItemID]
 		if !ok || mi == nil {
 			continue
 		}
+		if len(enrichedCards) == limit {
+			more = true
+			break
+		}
 
-		item := h.buildSectionItem(ctx, mi, overlayMap, stateMap)
+		item := h.buildSectionItem(mi, enriched.overlays, enriched.states, artwork[mi.ContentID])
 		item.ItemSource = m.source
 
 		// Apply CW/Next-Up metadata.
@@ -182,7 +298,7 @@ func (h *RecommendationsHandler) WatchTonightCards(ctx context.Context, userID i
 			}
 		}
 
-		if epMeta, ok := enrichedEpMeta[m.scored.MediaItemID]; ok {
+		if epMeta, ok := enriched.episodeMeta[m.scored.MediaItemID]; ok {
 			if epMeta.SeriesID != nil && item.SeriesID == "" {
 				item.SeriesID = *epMeta.SeriesID
 			}
@@ -202,16 +318,16 @@ func (h *RecommendationsHandler) WatchTonightCards(ctx context.Context, userID i
 		if item.SeriesID != "" {
 			castLookupID = item.SeriesID
 		}
-		contentToCastLookup[m.scored.MediaItemID] = castLookupID
 		if _, seen := castLookupSeen[castLookupID]; !seen {
 			castLookupSeen[castLookupID] = struct{}{}
 			castLookupIDs = append(castLookupIDs, castLookupID)
 		}
 
 		enrichedCards = append(enrichedCards, enrichedCard{
-			item:    item,
-			source:  m.source,
-			runtime: mi.Runtime,
+			item:         item,
+			source:       m.source,
+			runtime:      mi.Runtime,
+			castLookupID: castLookupID,
 		})
 	}
 
@@ -219,19 +335,16 @@ func (h *RecommendationsHandler) WatchTonightCards(ctx context.Context, userID i
 	castMap := h.fetchCastByIDs(ctx, castLookupIDs)
 
 	// Second pass: assemble response cards with cast.
-	for i, ec := range enrichedCards {
-		lookupID := contentToCastLookup[merged[i].scored.MediaItemID]
-		cast := buildCastSlice(castMap, lookupID)
-
-		resp.Cards = append(resp.Cards, swipeCardResponse{
+	cards := make([]swipeCardResponse, 0, len(enrichedCards))
+	for _, ec := range enrichedCards {
+		cards = append(cards, swipeCardResponse{
 			sectionItemResponse: ec.item,
 			WatchTonightSource:  ec.source,
 			Runtime:             ec.runtime,
-			Cast:                cast,
+			Cast:                buildCastSlice(castMap, ec.castLookupID),
 		})
 	}
-
-	return resp
+	return cards, more
 }
 
 // buildContinueCards returns CW + Next Up items as swipe cards.
@@ -285,16 +398,27 @@ func (h *RecommendationsHandler) buildContinueCards(ctx context.Context, userID
 // buildDiscoverCards returns recommendation candidates for discover mode.
 // It searches the user's taste profile against the full embedded library,
 // optionally requiring at least one selected genre match, and falls back to
-// cold-start caches when no taste profile is available.
-func (h *RecommendationsHandler) buildDiscoverCards(ctx context.Context, userID int, profileID string, filter catalog.AccessFilter, genres []string, excludeIDs map[string]struct{}, limit int) ([]mergedItem, bool) {
-	if h.recsRepo == nil {
-		return nil, true
+// the cold-start rows when no taste profile is available or recommendations
+// are disabled, which serve no personal candidates. Every candidate is one
+// the viewer can see, of a type recommendation rows offer.
+func (h *RecommendationsHandler) buildDiscoverCards(ctx context.Context, userID int, profileID string, filter catalog.AccessFilter, genres []string, excludeIDs map[string]struct{}, limit int) ([]mergedItem, bool, error) {
+	repo := h.cardsRepo
+	if repo == nil {
+		return nil, true, nil
 	}
 
 	poolSize := discoverCandidatePoolSize(limit, len(genres))
-	embedding, err := h.recsRepo.GetTasteProfile(ctx, userID, profileID)
-	if err != nil {
-		slog.WarnContext(ctx, "WatchTonightCards: taste profile fetch failed", "component", "api", "user_id", userID, "profile_id", profileID, "error", err)
+	// The candidate queries are limited, so the titles the profile's rows
+	// leave out are excluded in them: removed afterwards, they would leave a
+	// short or empty page.
+	excludeIDs = h.withProfileExclusions(ctx, userID, profileID, excludeIDs)
+	var embedding []float32
+	if !h.engineUnavailable() {
+		var err error
+		embedding, err = repo.GetTasteProfile(ctx, userID, profileID)
+		if err != nil {
+			slog.WarnContext(ctx, "WatchTonightCards: taste profile fetch failed", "component", "api", "user_id", userID, "profile_id", profileID, "error", err)
+		}
 	}
 
 	candidates := []recommendations.ScoredItem{}
@@ -302,7 +426,7 @@ func (h *RecommendationsHandler) buildDiscoverCards(ctx context.Context, userID
 	isCold := embedding == nil
 
 	if embedding != nil {
-		candidateItems, candidateGenres, err := h.recsRepo.FindTasteProfileCandidates(
+		candidateItems, candidateGenres, err := repo.FindTasteProfileCandidates(
 			ctx,
 			embedding,
 			mapKeys(excludeIDs),
@@ -320,20 +444,48 @@ func (h *RecommendationsHandler) buildDiscoverCards(ctx context.Context, userID
 
 	if len(candidates) == 0 {
 		isCold = true
-		candidates = h.buildColdStartDiscoverCandidates(ctx)
+		// The global rows are not viewer-scoped. Inaccessible titles leave
+		// before the page is cut, or a restricted profile would get pages
+		// emptied by hydration, and so do types the rows no longer offer,
+		// such as books cached before they left them.
+		var err error
+		candidates, err = keepRecommendable(ctx, repo, h.buildColdStartDiscoverCandidates(ctx, repo, filter, excludeIDs, poolSize), filter)
+		if err != nil {
+			return nil, true, err
+		}
 		if len(candidates) > 0 {
 			candidateIDs := make([]string, len(candidates))
 			for i, item := range candidates {
 				candidateIDs[i] = item.MediaItemID
 			}
-			genreMap, _ = h.recsRepo.GetItemAllGenres(ctx, candidateIDs)
+			genreMap, _ = repo.GetItemAllGenres(ctx, candidateIDs)
 		}
 	}
 
 	candidates = h.filterRecommendations(ctx, userID, profileID, candidates)
 	candidates = recommendations.FilterAndRankGenreMatches(candidates, genres, genreMap)
 
-	return recommendationCardItems(candidates, excludeIDs), isCold
+	return recommendationCardItems(candidates, excludeIDs), isCold, nil
+}
+
+// withProfileExclusions returns excludeIDs, the titles the client already
+// showed, together with the canonical titles the profile's built rows leave
+// out: watched, favorited, rated and abandoned ones, an episode standing for
+// its series. When that set cannot be read it returns excludeIDs, and
+// filterRecommendations still removes watched and rated titles afterwards.
+func (h *RecommendationsHandler) withProfileExclusions(ctx context.Context, userID int, profileID string, excludeIDs map[string]struct{}) map[string]struct{} {
+	if h.exclusionSet == nil || profileID == "" {
+		return excludeIDs
+	}
+	excluded, err := h.exclusionSet(ctx, userID, profileID)
+	if err != nil {
+		slog.WarnContext(ctx, "WatchTonightCards: exclusion set unavailable", "component", "api", "user_id", userID, "profile_id", profileID, "error", err)
+		return excludeIDs
+	}
+	merged := make(map[string]struct{}, len(excluded)+len(excludeIDs))
+	maps.Copy(merged, excluded)
+	maps.Copy(merged, excludeIDs)
+	return merged
 }
 
 func recommendationCardItems(candidates []recommendations.ScoredItem, excludeIDs map[string]struct{}) []mergedItem {
@@ -350,10 +502,15 @@ func recommendationCardItems(candidates []recommendations.ScoredItem, excludeIDs
 	return merged
 }
 
-func (h *RecommendationsHandler) buildColdStartDiscoverCandidates(ctx context.Context) []recommendations.ScoredItem {
+// buildColdStartDiscoverCandidates returns the cached Popular row and up to
+// limit titles of the live Recently Added row the viewer can see, leaving out
+// excludeIDs. Recently Added is read live, as Watch Tonight's fallback reads
+// it, so the cards still fill on a fresh server or with recommendations
+// disabled, when nothing builds or renews the cached rows.
+func (h *RecommendationsHandler) buildColdStartDiscoverCandidates(ctx context.Context, repo discoverCardsRepo, filter catalog.AccessFilter, excludeIDs map[string]struct{}, limit int) []recommendations.ScoredItem {
 	byID := make(map[string]recommendations.ScoredItem)
 
-	popular, err := h.recsRepo.GetRecommendationCache(
+	popular, err := repo.GetRecommendationCache(
 		ctx,
 		recommendations.GlobalCacheUserID,
 		recommendations.GlobalCacheProfileID,
@@ -367,15 +524,9 @@ func (h *RecommendationsHandler) buildColdStartDiscoverCandidates(ctx context.Co
 		byID[item.MediaItemID] = item
 	}
 
-	recentlyAdded, err := h.recsRepo.GetRecommendationCache(
-		ctx,
-		recommendations.GlobalCacheUserID,
-		recommendations.GlobalCacheProfileID,
-		recommendations.RecTypeRecentlyAdded,
-		"",
-	)
+	recentlyAdded, err := repo.ListDefaultRowItems(ctx, filter, recommendations.RecTypeRecentlyAdded, mapKeys(excludeIDs), limit)
 	if err != nil {
-		slog.WarnContext(ctx, "WatchTonightCards: recently added cache unavailable", "component", "api", "error", err)
+		slog.WarnContext(ctx, "WatchTonightCards: recently added unavailable", "component", "api", "error", err)
 	}
 	for _, item := range recentlyAdded {
 		if existing, exists := byID[item.MediaItemID]; !exists || item.Score > existing.Score {
@@ -397,6 +548,30 @@ func (h *RecommendationsHandler) buildColdStartDiscoverCandidates(ctx context.Co
 	return candidates
 }
 
+// keepRecommendable keeps the items filter admits that are of a type
+// recommendation rows offer, in order.
+func keepRecommendable(ctx context.Context, repo discoverCardsRepo, items []recommendations.ScoredItem, filter catalog.AccessFilter) ([]recommendations.ScoredItem, error) {
+	if len(items) == 0 {
+		return items, nil
+	}
+	ids := make([]string, len(items))
+	for i, item := range items {
+		ids[i] = item.MediaItemID
+	}
+	kept, err := repo.FilterRecommendableItemIDs(ctx, ids, filter)
+	if err != nil {
+		slog.WarnContext(ctx, "WatchTonightCards: access check failed", "component", "api", "user_id", filter.UserID, "profile_id", filter.ProfileID, "error", err)
+		return nil, recommendationsUnavailable("Failed to fetch recommendations")
+	}
+	out := make([]recommendations.ScoredItem, 0, len(items))
+	for _, item := range items {
+		if _, ok := kept[item.MediaItemID]; ok {
+			out = append(out, item)
+		}
+	}
+	return out, nil
+}
+
 // fetchCastByIDs fetches cast members for the given pre-resolved lookup IDs.
 func (h *RecommendationsHandler) fetchCastByIDs(ctx context.Context, lookupIDs []string) map[string][]models.ItemPerson {
 	if h.CastFetcher == nil || len(lookupIDs) == 0 {
@@ -428,6 +603,7 @@ func buildCastSlice(castMap map[string][]models.ItemPerson, lookupID string) []s
 		cast = append(cast, swipeCardCastMember{
 			Name:      p.Name,
 			Character: p.Character,
+			photoPath: p.PhotoPath,
 		})
 		if len(cast) >= maxCastPerCard {
 			break
@@ -522,3 +698,7 @@ func (c swipeCardResponse) Card() SectionItemView {
 func NewWatchTonightCardView(card SectionItemView, source string, runtime int, cast []WatchTonightCastMemberView) WatchTonightCardView {
 	return swipeCardResponse{sectionItemResponse: card, WatchTonightSource: source, Runtime: runtime, Cast: cast}
 }
+
+func isHTTPImageURL(path string) bool {
+	return strings.HasPrefix(path, "http://") || strings.HasPrefix(path, "https://")
+}
diff --git a/internal/api/handlers/watch_tonight_cards_access_test.go b/internal/api/handlers/watch_tonight_cards_access_test.go
new file mode 100644
index 0000000000..077a19e05b
--- /dev/null
+++ b/internal/api/handlers/watch_tonight_cards_access_test.go
@@ -0,0 +1,283 @@
+package handlers
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"slices"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/imagesize"
+	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/recommendations"
+	"github.com/prairie-server/prairie-server/internal/sections"
+)
+
+// hydratingFetcher hydrates every requested ID outside missing.
+type hydratingFetcher struct {
+	missing map[string]struct{}
+	err     error
+}
+
+func (f hydratingFetcher) FetchItemsByContentIDs(_ context.Context, ids []string, _ catalog.AccessFilter) ([]*models.MediaItem, error) {
+	if f.err != nil {
+		return nil, f.err
+	}
+	var items []*models.MediaItem
+	for _, id := range ids {
+		if _, gone := f.missing[id]; !gone {
+			items = append(items, &models.MediaItem{ContentID: id, Type: "movie", Title: id})
+		}
+	}
+	return items, nil
+}
+
+func (hydratingFetcher) FetchEpisodesByContentIDs(context.Context, []string, catalog.AccessFilter) ([]*models.MediaItem, map[string]sections.SectionItemMeta, error) {
+	return nil, map[string]sections.SectionItemMeta{}, nil
+}
+
+func (hydratingFetcher) ListOverlaySummaries(context.Context, []string, catalog.AccessFilter) (map[string]*models.OverlaySummary, error) {
+	return map[string]*models.OverlaySummary{}, nil
+}
+
+// castByID gives every item one actor named after it.
+type castByID struct{}
+
+func (castByID) ListForItems(_ context.Context, ids []string) (map[string][]models.ItemPerson, error) {
+	out := make(map[string][]models.ItemPerson, len(ids))
+	for _, id := range ids {
+		out[id] = []models.ItemPerson{{Person: models.Person{Name: id + "-actor"}, Kind: models.PersonKindActor}}
+	}
+	return out, nil
+}
+
+func recommendationCandidates(ids ...string) []mergedItem {
+	out := make([]mergedItem, len(ids))
+	for i, id := range ids {
+		out[i] = mergedItem{scored: recommendations.ScoredItem{MediaItemID: id}, source: "recommendation"}
+	}
+	return out
+}
+
+// A candidate dropped in hydration takes no card, and every later card keeps
+// its own cast; a page is full only when a hydrated candidate is left over.
+func TestSwipeCardsSkipADroppedCandidateWithoutShiftingCast(t *testing.T) {
+	h := &RecommendationsHandler{CastFetcher: castByID{}}
+	candidates := recommendationCandidates("a", "dropped", "c", "d")
+	enriched, err := (&RecommendationsHandler{Fetcher: hydratingFetcher{missing: map[string]struct{}{"dropped": {}}}}).
+		enrichItems(t.Context(), 7, "p1", catalog.AccessFilter{}, []string{"a", "dropped", "c", "d"})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	cards, more := h.swipeCards(t.Context(), candidates, enriched, 3, imagesize.Request{})
+	var got []string
+	for _, card := range cards {
+		if len(card.Cast) != 1 || card.Cast[0].Name != card.ContentID+"-actor" {
+			t.Fatalf("card %s has cast %+v, want its own", card.ContentID, card.Cast)
+		}
+		got = append(got, card.ContentID)
+	}
+	if !slices.Equal(got, []string{"a", "c", "d"}) || more {
+		t.Fatalf("cards = %v more=%v, want [a c d] and no more", got, more)
+	}
+
+	cards, more = h.swipeCards(t.Context(), candidates, enriched, 2, imagesize.Request{})
+	if len(cards) != 2 || cards[1].ContentID != "c" || !more {
+		t.Fatalf("limit 2: %d cards, more=%v; want a and c with more", len(cards), more)
+	}
+}
+
+type watchTonightReader struct {
+	stubRecommendationsReader
+	result recommendations.WatchTonightResult
+}
+
+func (r watchTonightReader) GetWatchTonight(context.Context, int, string, int, catalog.AccessFilter) (recommendations.WatchTonightResult, error) {
+	return r.result, nil
+}
+
+// A failed item lookup is a 500, not 200 with no items.
+func TestWatchTonightItemLookupFailureIsAnError(t *testing.T) {
+	h := NewRecommendationsHandler(nil, watchTonightReader{result: recommendations.WatchTonightResult{Items: []recommendations.ScoredItem{{MediaItemID: "a", Score: 1}}}}, nil, nil, nil, true)
+	h.Fetcher = hydratingFetcher{err: errors.New("db down")}
+
+	_, err := h.WatchTonight(t.Context(), 7, "p1", catalog.AccessFilter{}, 5)
+	var apiErr *APIError
+	if !errors.As(err, &apiErr) || apiErr.Status != http.StatusInternalServerError {
+		t.Fatalf("err = %v, want a 500 API error", err)
+	}
+}
+
+// The frozen v1 route keeps answering 200 with no items when the lookup
+// fails, as it did before the v2 seam started reporting the error.
+func TestV1WatchTonightItemLookupFailureAnswersEmpty(t *testing.T) {
+	h := NewRecommendationsHandler(nil, watchTonightReader{result: recommendations.WatchTonightResult{Items: []recommendations.ScoredItem{{MediaItemID: "a", Score: 1}}}}, nil, nil, nil, true)
+	h.Fetcher = hydratingFetcher{err: errors.New("db down")}
+
+	rr := httptest.NewRecorder()
+	h.HandleWatchTonight(rr, newAuthorizedProfileRequestWithRole(http.MethodGet, "/api/v1/recommendations/watch-tonight", "", "user", "p1"))
+	if rr.Code != http.StatusOK {
+		t.Fatalf("status = %d, want 200: %s", rr.Code, rr.Body.String())
+	}
+	var body struct {
+		Items []json.RawMessage `json:"items"`
+	}
+	if err := json.Unmarshal(rr.Body.Bytes(), &body); err != nil || len(body.Items) != 0 {
+		t.Fatalf("body = %s (%v), want no items", rr.Body.String(), err)
+	}
+}
+
+// fakeCardsRepo serves discover-mode cards from memory: a taste profile
+// whose candidates are personal, cached global rows, and a type check that
+// leaves books out.
+type fakeCardsRepo struct {
+	tasteReads int
+	global     map[string][]recommendations.ScoredItem
+	// recent is the live Recently Added row; recentExclude and recentLimit
+	// record its last read.
+	recent        []recommendations.ScoredItem
+	recentExclude []string
+	recentLimit   int
+	books         map[string]struct{}
+}
+
+func (f *fakeCardsRepo) ListDefaultRowItems(_ context.Context, _ catalog.AccessFilter, kind string, exclude []string, limit int) ([]recommendations.ScoredItem, error) {
+	if kind != recommendations.RecTypeRecentlyAdded {
+		return nil, fmt.Errorf("unexpected default row %q", kind)
+	}
+	f.recentExclude, f.recentLimit = slices.Sorted(slices.Values(exclude)), limit
+	var out []recommendations.ScoredItem
+	for _, item := range f.recent {
+		if !slices.Contains(exclude, item.MediaItemID) && len(out) < limit {
+			out = append(out, item)
+		}
+	}
+	return out, nil
+}
+
+func (f *fakeCardsRepo) GetTasteProfile(context.Context, int, string) ([]float32, error) {
+	f.tasteReads++
+	return []float32{1}, nil
+}
+
+func (f *fakeCardsRepo) FindTasteProfileCandidates(context.Context, []float32, []string, []string, int, catalog.AccessFilter) ([]recommendations.ScoredItem, map[string][]string, error) {
+	return []recommendations.ScoredItem{{MediaItemID: "personal", Score: 1}}, map[string][]string{}, nil
+}
+
+func (f *fakeCardsRepo) GetItemAllGenres(context.Context, []string) (map[string][]string, error) {
+	return map[string][]string{}, nil
+}
+
+func (f *fakeCardsRepo) GetRecommendationCache(_ context.Context, _ int, _, recType, _ string) ([]recommendations.ScoredItem, error) {
+	return f.global[recType], nil
+}
+
+func (f *fakeCardsRepo) FilterRecommendableItemIDs(_ context.Context, ids []string, _ catalog.AccessFilter) (map[string]struct{}, error) {
+	out := make(map[string]struct{}, len(ids))
+	for _, id := range ids {
+		if _, book := f.books[id]; !book {
+			out[id] = struct{}{}
+		}
+	}
+	return out, nil
+}
+
+// With recommendations disabled, discover-mode cards come from the global
+// rows only, never the profile's taste profile, and leave out types the rows
+// no longer offer, such as a book cached before books left them.
+func TestDiscoverCardsServeNoPersonalCandidatesWhileDisabled(t *testing.T) {
+	repo := &fakeCardsRepo{
+		global: map[string][]recommendations.ScoredItem{
+			recommendations.RecTypePopular: {{MediaItemID: "popular", Score: 2}, {MediaItemID: "cached-book", Score: 3}},
+		},
+		recent: []recommendations.ScoredItem{{MediaItemID: "recent", Score: 1}},
+		books:  map[string]struct{}{"cached-book": {}},
+	}
+	h := &RecommendationsHandler{cardsRepo: repo, enabled: false}
+	merged, isCold, err := h.buildDiscoverCards(t.Context(), 7, "p1", catalog.AccessFilter{}, nil, map[string]struct{}{}, 12)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var ids []string
+	for _, m := range merged {
+		ids = append(ids, m.scored.MediaItemID)
+	}
+	if !isCold || !slices.Equal(ids, []string{"popular", "recent"}) {
+		t.Fatalf("cards = %v (cold %t), want the global rows without the book", ids, isCold)
+	}
+	if repo.tasteReads != 0 {
+		t.Fatalf("taste profile read %d times, want none while disabled", repo.tasteReads)
+	}
+}
+
+// With nothing cached, as on a fresh server or once the cached rows expire
+// with recommendations disabled, discover-mode cards come from the live
+// Recently Added row, read without the titles the client already showed.
+func TestDiscoverCardsFallBackToTheLiveRecentlyAddedRow(t *testing.T) {
+	repo := &fakeCardsRepo{recent: []recommendations.ScoredItem{
+		{MediaItemID: "shown", Score: 3}, {MediaItemID: "newest", Score: 2}, {MediaItemID: "older", Score: 1},
+	}}
+	h := &RecommendationsHandler{cardsRepo: repo, enabled: false}
+	merged, isCold, err := h.buildDiscoverCards(t.Context(), 7, "p1", catalog.AccessFilter{}, nil, map[string]struct{}{"shown": {}}, 12)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var ids []string
+	for _, m := range merged {
+		ids = append(ids, m.scored.MediaItemID)
+	}
+	if !isCold || !slices.Equal(ids, []string{"newest", "older"}) {
+		t.Fatalf("cards = %v (cold %t), want the live Recently Added row", ids, isCold)
+	}
+	if !slices.Equal(repo.recentExclude, []string{"shown"}) || repo.recentLimit != discoverCandidatePoolSize(12, 0) {
+		t.Fatalf("Recently Added read with exclude=%v limit=%d", repo.recentExclude, repo.recentLimit)
+	}
+}
+
+// The live Recently Added fallback is limited in SQL, so the profile's
+// excluded titles (watched, favorited, rated) go into the query with the
+// shown ones. Removed only afterwards, they would leave a cold profile a
+// short page, and a favorite would come back as a recommendation.
+func TestDiscoverCardsExcludeTheProfilesTitlesInTheQuery(t *testing.T) {
+	repo := &fakeCardsRepo{recent: []recommendations.ScoredItem{
+		{MediaItemID: "favorite", Score: 5}, {MediaItemID: "watched", Score: 4}, {MediaItemID: "shown", Score: 3},
+		{MediaItemID: "newest", Score: 2}, {MediaItemID: "older", Score: 1},
+	}}
+	h := &RecommendationsHandler{cardsRepo: repo, enabled: false}
+	h.exclusionSet = func(_ context.Context, userID int, profileID string) (map[string]struct{}, error) {
+		if userID != 7 || profileID != "p1" {
+			t.Fatalf("exclusion set read for %d/%s", userID, profileID)
+		}
+		return map[string]struct{}{"favorite": {}, "watched": {}}, nil
+	}
+	merged, _, err := h.buildDiscoverCards(t.Context(), 7, "p1", catalog.AccessFilter{}, nil, map[string]struct{}{"shown": {}}, 2)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var ids []string
+	for _, m := range merged {
+		ids = append(ids, m.scored.MediaItemID)
+	}
+	if !slices.Equal(repo.recentExclude, []string{"favorite", "shown", "watched"}) {
+		t.Fatalf("Recently Added read with exclude=%v, want the shown and the profile's excluded titles", repo.recentExclude)
+	}
+	if !slices.Equal(ids, []string{"newest", "older"}) {
+		t.Fatalf("cards = %v, want only eligible titles", ids)
+	}
+
+	// Without the set, the shown titles are still left out.
+	h.exclusionSet = func(context.Context, int, string) (map[string]struct{}, error) {
+		return nil, errors.New("signals unavailable")
+	}
+	if _, _, err := h.buildDiscoverCards(t.Context(), 7, "p1", catalog.AccessFilter{}, nil, map[string]struct{}{"shown": {}}, 2); err != nil {
+		t.Fatal(err)
+	}
+	if !slices.Equal(repo.recentExclude, []string{"shown"}) {
+		t.Fatalf("Recently Added read with exclude=%v after the set failed, want the shown title", repo.recentExclude)
+	}
+}
diff --git a/internal/api/handlers/watchlist_titles.go b/internal/api/handlers/watchlist_titles.go
index de0f6605f4..d649ef4178 100644
--- a/internal/api/handlers/watchlist_titles.go
+++ b/internal/api/handlers/watchlist_titles.go
@@ -32,7 +32,7 @@ func (h *PersonalDataHandler) SetWatchlistTitles(titles *watchlist.Titles) {
 // library watchlist notifies the same listeners as a manual add.
 func (h *PersonalDataHandler) WatchlistPromoted(ctx context.Context, userID int, profileID, contentID string) {
 	h.dispatchLocalListEvent(ctx, watchsync.ListKindWatchlist, watchsync.ListChangeAdded, userID, profileID, contentID)
-	triggerProfileRefresh(ctx, h.profileStaler, h.profileRefreshRequester, userID, profileID)
+	notifySignalsChanged(ctx, h.signalsNotifier, userID, profileID)
 	publishUserStateEvent(ctx, h.EventsHub, userID, profileID, contentID, "", "watchlist", userStateEventState{
 		InWatchlist: boolPtr(true),
 	})
diff --git a/internal/api/handlers/watchlist_titles_db_test.go b/internal/api/handlers/watchlist_titles_db_test.go
index c34dcf544e..3279065060 100644
--- a/internal/api/handlers/watchlist_titles_db_test.go
+++ b/internal/api/handlers/watchlist_titles_db_test.go
@@ -89,7 +89,7 @@ func TestWatchlistTitleOffDB(t *testing.T) {
 	}
 	check(false, "promoted onto the library watchlist")
 
-	if err := store.RemoveFromWatchlist(ctx, "p1", prefix); err != nil {
+	if _, err := store.RemoveFromWatchlist(ctx, "p1", prefix); err != nil {
 		t.Fatal(err)
 	}
 	check(true, "library watchlist entry removed")
@@ -115,9 +115,9 @@ type failingRemoveStore struct {
 	fail *bool
 }
 
-func (s failingRemoveStore) RemoveFromWatchlist(ctx context.Context, profileID, mediaItemID string) error {
+func (s failingRemoveStore) RemoveFromWatchlist(ctx context.Context, profileID, mediaItemID string) (bool, error) {
 	if *s.fail {
-		return fmt.Errorf("user store unavailable")
+		return false, fmt.Errorf("user store unavailable")
 	}
 	return s.UserStore.RemoveFromWatchlist(ctx, profileID, mediaItemID)
 }
@@ -191,7 +191,7 @@ func TestRemoveWatchlistTitleRetryKeepsFormerIDsDB(t *testing.T) {
 	if _, err := pool.Exec(ctx, `INSERT INTO media_item_libraries (content_id, media_folder_id) VALUES ($1, $2)`, prefix, folder); err != nil {
 		t.Fatal(err)
 	}
-	if err := store.AddToWatchlist(ctx, "p1", prefix); err != nil {
+	if _, err := store.AddToWatchlist(ctx, "p1", prefix); err != nil {
 		t.Fatal(err)
 	}
 
diff --git a/internal/auth/initial_setup_atomic_test.go b/internal/api/initial_setup_atomic_test.go
similarity index 99%
rename from internal/auth/initial_setup_atomic_test.go
rename to internal/api/initial_setup_atomic_test.go
index 97139ebc84..506909bbc4 100644
--- a/internal/auth/initial_setup_atomic_test.go
+++ b/internal/api/initial_setup_atomic_test.go
@@ -1,4 +1,4 @@
-package auth_test
+package api_test
 
 import (
 	"bytes"
diff --git a/internal/api/media_routes.go b/internal/api/media_routes.go
index c6a5684905..ae03aa7871 100644
--- a/internal/api/media_routes.go
+++ b/internal/api/media_routes.go
@@ -25,7 +25,13 @@ var nativeMediaRoutes = []streamtelemetry.MediaRoute{
 	nativeRoute(http.MethodGet, "/api/v1/downloads/{id}/file-proxy", streamtelemetry.ClassTransfer, false),
 	nativeRoute(http.MethodHead, "/api/v1/downloads/{id}/file-proxy", streamtelemetry.ClassTransfer, false),
 	nativeRoute(http.MethodGet, "/api/v1/downloads/{id}/subtitles/{ref}", streamtelemetry.ClassTransfer, false),
+	nativeRoute(http.MethodGet, "/api/v2/downloads/{id}/file", streamtelemetry.ClassTransfer, false),
+	nativeRoute(http.MethodHead, "/api/v2/downloads/{id}/file", streamtelemetry.ClassTransfer, false),
+	nativeRoute(http.MethodGet, "/api/v2/downloads/{id}/file-proxy", streamtelemetry.ClassTransfer, false),
+	nativeRoute(http.MethodHead, "/api/v2/downloads/{id}/file-proxy", streamtelemetry.ClassTransfer, false),
+	nativeRoute(http.MethodGet, "/api/v2/downloads/{id}/subtitles/{ref}", streamtelemetry.ClassTransfer, false),
 	nativeRoute(http.MethodGet, "/api/v2/direct-download", streamtelemetry.ClassTransfer, false),
+	nativeRoute(http.MethodGet, "/api/v2/playback/bandwidth-probe", streamtelemetry.ClassTransfer, false),
 	nativeRoute(http.MethodHead, "/api/v2/direct-download", streamtelemetry.ClassTransfer, false),
 	nativeRoute(http.MethodGet, "/api/v2/direct-download-proxy", streamtelemetry.ClassTransfer, false),
 	nativeRoute(http.MethodHead, "/api/v2/direct-download-proxy", streamtelemetry.ClassTransfer, false),
diff --git a/internal/api/media_routes_test.go b/internal/api/media_routes_test.go
index 57bdb5ae90..f2614b22bd 100644
--- a/internal/api/media_routes_test.go
+++ b/internal/api/media_routes_test.go
@@ -41,7 +41,12 @@ func TestMediaRouteManifest(t *testing.T) {
 		return func(routes []streamtelemetry.WalkedRoute) { snapshots[index]["/api/v2/*"] = routes }
 	}
 	minimal := newChiRouter(Dependencies{Config: cfg, v2RouteSnapshot: observeV2(0)})
-	maximal := newChiRouter(Dependencies{DB: pool, Config: cfg, FileRepo: scanner.NewFileRepository(pool), FolderRepo: catalog.NewFolderRepository(pool), SessionMgr: playback.NewSessionManager(0, 0), v2RouteSnapshot: observeV2(1)})
+	// A live registry makes observeNative resolve every wrapped pattern, so a
+	// handler wired to an undeclared media route panics here, not at startup.
+	telemetryCfg := streamtelemetry.DefaultConfig("test")
+	telemetryCfg.Enabled = true
+	telemetry := streamtelemetry.NewRegistry(telemetryCfg, streamtelemetry.NewLocalStore(), nil)
+	maximal := newChiRouter(Dependencies{DB: pool, Config: cfg, FileRepo: scanner.NewFileRepository(pool), FolderRepo: catalog.NewFolderRepository(pool), SessionMgr: playback.NewSessionManager(0, 0), StreamTelemetry: telemetry, v2RouteSnapshot: observeV2(1)})
 	actual, err := streamtelemetry.BuildRouteManifest([]chi.Routes{minimal, maximal}, nativeMediaRoutes, snapshots...)
 	if err != nil {
 		t.Fatal(err)
diff --git a/internal/api/middleware/acting_admin_decision_test.go b/internal/api/middleware/acting_admin_decision_test.go
index 1684d5ec6d..48f1b17d65 100644
--- a/internal/api/middleware/acting_admin_decision_test.go
+++ b/internal/api/middleware/acting_admin_decision_test.go
@@ -113,8 +113,8 @@ func TestActingAdminNeedsAVerifiedProfile(t *testing.T) {
 			access.Scope{UserID: 7, ProfileID: "parent"}),
 	} {
 		t.Run(name, func(t *testing.T) {
-			ctx = SetActingAdminDecider(SetClaims(ctx, adminClaims()), decide)
-			if ok, err := ActingAdmin(ctx); ok || err != nil {
+			decided := SetActingAdminDecider(SetClaims(ctx, adminClaims()), decide)
+			if ok, err := ActingAdmin(decided); ok || err != nil {
 				t.Fatalf("ActingAdmin = %v, %v; want false", ok, err)
 			}
 		})
diff --git a/internal/api/middleware/metrics.go b/internal/api/middleware/metrics.go
index 8e1655f84f..750dc052a0 100644
--- a/internal/api/middleware/metrics.go
+++ b/internal/api/middleware/metrics.go
@@ -14,6 +14,7 @@ import (
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/promauto"
 
+	"github.com/prairie-server/prairie-server/internal/activitylog"
 	"github.com/prairie-server/prairie-server/internal/httpstream"
 )
 
@@ -58,7 +59,7 @@ func Metrics(next http.Handler) http.Handler {
 		}
 		method := metricMethod(r.Method)
 
-		httpRequestsTotal.WithLabelValues(method, path, strconv.Itoa(wrapped.status)).Inc()
+		httpRequestsTotal.WithLabelValues(method, path, strconv.Itoa(activitylog.RecordedStatus(r, wrapped.status, wrapped.written))).Inc()
 		httpRequestDuration.WithLabelValues(method, path).Observe(duration)
 	})
 }
diff --git a/internal/api/middleware/request_attribution_test.go b/internal/api/middleware/request_attribution_test.go
new file mode 100644
index 0000000000..c1e0c93a2d
--- /dev/null
+++ b/internal/api/middleware/request_attribution_test.go
@@ -0,0 +1,80 @@
+package middleware
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"regexp"
+	"runtime"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/database/queryattr"
+)
+
+func attributionLogs(t *testing.T) *bytes.Buffer {
+	t.Helper()
+	t.Setenv("PRAIRIE_QUERY_ATTRIBUTION_ENABLED", "true")
+	if !queryattr.Initialize() {
+		t.Fatal("query attribution is disabled")
+	}
+	var logs bytes.Buffer
+	previous := slog.Default()
+	slog.SetDefault(slog.New(slog.NewJSONHandler(&logs, nil)))
+	t.Cleanup(func() { slog.SetDefault(previous) })
+	return &logs
+}
+
+func TestRequestLoggerAddsDatabaseFields(t *testing.T) {
+	logs := attributionLogs(t)
+	var queryLine int
+	h := RequestLogger("test-node")(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _, line, _ := runtime.Caller(0)
+		op := queryattr.Begin(r.Context(), queryattr.KindQuery, "SELECT 1", nil, 1)
+		queryLine = line + 1
+		op.End(r.Context(), nil)
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	h.ServeHTTP(httptest.NewRecorder(), httptest.NewRequest(http.MethodGet, "/api/v1/items", nil))
+	var record map[string]any
+	if err := json.Unmarshal(logs.Bytes(), &record); err != nil {
+		t.Fatal(err)
+	}
+	if record["msg"] != "api request" || record["db_queries"] != float64(1) {
+		t.Errorf("request msg=%v db_queries=%v, want api request and 1", record["msg"], record["db_queries"])
+	}
+	wantSite := fmt.Sprintf("api/middleware.TestRequestLoggerAddsDatabaseFields.func1:%d", queryLine)
+	if record["db_slowest_site"] != wantSite {
+		t.Errorf("db_slowest_site = %v, want %s", record["db_slowest_site"], wantSite)
+	}
+	if shape, ok := record["db_slowest_shape"].(string); !ok || !regexp.MustCompile(`^[0-9a-f]{16}$`).MatchString(shape) {
+		t.Errorf("db_slowest_shape = %v, want 16 lowercase hex digits", record["db_slowest_shape"])
+	}
+	if record["db_top_count"] != float64(1) {
+		t.Errorf("db_top_count = %v, want 1", record["db_top_count"])
+	}
+}
+
+func TestRequestLoggerNoQuery(t *testing.T) {
+	logs := attributionLogs(t)
+	h := RequestLogger("test-node")(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	h.ServeHTTP(httptest.NewRecorder(), httptest.NewRequest(http.MethodGet, "/api/v1/items", nil))
+	var record map[string]any
+	if err := json.Unmarshal(logs.Bytes(), &record); err != nil {
+		t.Fatal(err)
+	}
+	for _, key := range []string{"db_slowest_site", "db_slowest_shape", "db_top_site", "db_top_shape"} {
+		if value, present := record[key]; present {
+			t.Errorf("%s = %v, want field absent", key, value)
+		}
+	}
+	for _, key := range []string{"db_queries", "db_query_ns", "db_acquire_wait_ns", "db_slowest_ns", "db_top_count"} {
+		if value, present := record[key]; present {
+			t.Errorf("%s = %v, want field absent", key, value)
+		}
+	}
+}
diff --git a/internal/api/middleware/request_logger.go b/internal/api/middleware/request_logger.go
index e56146c9e3..5697932cee 100644
--- a/internal/api/middleware/request_logger.go
+++ b/internal/api/middleware/request_logger.go
@@ -15,6 +15,7 @@ import (
 
 	"github.com/prairie-server/prairie-server/internal/activitylog"
 	"github.com/prairie-server/prairie-server/internal/clientip"
+	"github.com/prairie-server/prairie-server/internal/database/queryattr"
 	"github.com/prairie-server/prairie-server/internal/httpstream"
 )
 
@@ -28,6 +29,10 @@ func RequestLogger(nodeID string) func(http.Handler) http.Handler {
 				}
 			}
 
+			ctx, db := queryattr.StartRequest(r.Context())
+			if db != nil {
+				r = r.WithContext(ctx)
+			}
 			start := time.Now()
 			wrapped := &requestStatusWriter{ResponseWriter: w, status: http.StatusOK}
 			lc := activitylog.GetLogContext(r.Context())
@@ -56,7 +61,7 @@ func RequestLogger(nodeID string) func(http.Handler) http.Handler {
 				"method", r.Method,
 				"path", activitylog.RedactSecretPathParams(r, r.URL.Path),
 				"path_pattern", pathPattern,
-				"status", wrapped.status,
+				"status", activitylog.RecordedStatus(r, wrapped.status, wrapped.wroteHeader),
 				"duration_ms", time.Since(start).Milliseconds(),
 				"client_ip", clientip.FromContext(r.Context()),
 				"user_agent", r.UserAgent(),
@@ -71,6 +76,7 @@ func RequestLogger(nodeID string) func(http.Handler) http.Handler {
 			if playbackLC.PlaybackSessionID != "" {
 				attrs = append(attrs, "playback_session_id", playbackLC.PlaybackSessionID)
 			}
+			attrs = append(attrs, db.LogAttrs()...)
 			slog.InfoContext(r.Context(), "api request", append([]any{"component", "api"}, attrs...)...)
 		})
 	}
diff --git a/internal/api/requests_wiring.go b/internal/api/requests_wiring.go
index 5c6c64ca83..b675f37c0e 100644
--- a/internal/api/requests_wiring.go
+++ b/internal/api/requests_wiring.go
@@ -36,6 +36,8 @@ func (a PluginRequestRouterAdapter) RouterFeatures(ctx context.Context, installa
 	return mediarequests.RouterFeatures{
 		SupportsSeasons:         descriptor.GetSupportsSeasons(),
 		ReportsDownloadProgress: descriptor.GetReportsDownloadProgress(),
+		APIKeyOptional:          descriptor.GetApiKeyOptional(),
+		BaseURLOptional:         descriptor.GetBaseUrlOptional(),
 	}, nil
 }
 
diff --git a/internal/api/router.go b/internal/api/router.go
index 79a1e45a6f..964cb3cf53 100644
--- a/internal/api/router.go
+++ b/internal/api/router.go
@@ -55,7 +55,6 @@ import (
 	"github.com/prairie-server/prairie-server/internal/mdblist"
 	"github.com/prairie-server/prairie-server/internal/metadata"
 	"github.com/prairie-server/prairie-server/internal/metadata/tmdb"
-	metatrakt "github.com/prairie-server/prairie-server/internal/metadata/trakt"
 	metadatatranslation "github.com/prairie-server/prairie-server/internal/metadata/translation"
 	"github.com/prairie-server/prairie-server/internal/netaccess"
 	"github.com/prairie-server/prairie-server/internal/nodemetrics"
@@ -290,7 +289,7 @@ type Dependencies struct {
 	ServerRestartStatus    *handlers.ServerRestartStatusTracker
 
 	// UserCollectionSync handles per-profile imported collections (TMDB /
-	// Trakt / MDBList) — the user-facing analogue of CollectionService.
+	// MDBList) — the user-facing counterpart of CollectionService.
 	UserCollectionSync      *usercollections.Service
 	UserCollectionScheduler *usercollections.Scheduler
 	// PersonalCollectionCollages serves and builds personal collection
@@ -301,13 +300,16 @@ type Dependencies struct {
 	PersonalCollectionCollages *catalog.PersonalCollectionCollages
 
 	// TrendingRefresher refreshes the persisted trending_discover snapshots.
-	// Built in main.go with TMDB wired; its Trakt fetcher is propagated here in
-	// router.go once the Trakt adapter exists (mirrors UserCollectionSync).
+	// Built in main.go with TMDB wired.
 	TrendingRefresher *sections.TrendingRefresher
 
 	// LiveTV is the shared Live TV / OTA / DVR service (nil when DB unavailable).
 	LiveTV *livetv.Service
 
+	// SeasonalListRefresher downloads the MDBList lists seasonal rows show.
+	// Built in main.go alongside the trending refresher.
+	SeasonalListRefresher *sections.SeasonalListRefresher
+
 	// MDBListClient is used by user-facing list discovery endpoints
 	// (search/top). May be nil; the handlers report "not configured" in
 	// that case rather than failing.
@@ -325,6 +327,11 @@ type Dependencies struct {
 	// clients hitting /login, /api/*, /abs/api/*, and /abs/socket.io/* all
 	// resolve correctly. May be nil; no ABS routes are registered in that case.
 	ABSHandler absHandler
+
+	// LocalTLSPin is the pin of the key the API listener presents over TLS on
+	// its own port (internal/lantls), published in the connections document.
+	// Empty when the listener does not answer TLS (tests).
+	LocalTLSPin string
 }
 
 // absHandler is the narrow interface the router needs from the ABS handler.
@@ -364,6 +371,18 @@ func (deps Dependencies) themeRouter(playbackHandler *handlers.PlaybackHandler)
 	return router
 }
 
+// recommendationReader builds a cache-backed recommendations reader. Its
+// reads queue profile refreshes only while recommendations are enabled.
+func (deps Dependencies) recommendationReader(repo *recommendations.Repo, ratingsRepo *catalog.RatingsRepo) *recommendations.Reader {
+	var refresh recommendations.ReadRefreshRequester
+	if deps.RecWorker != nil {
+		refresh = deps.RecWorker
+	}
+	return recommendations.NewReader(repo, ratingsRepo, refresh, deps.UserStoreProvider).
+		WithUserStoreOutsidePostgres(deps.Config != nil && deps.Config.UserDB.Backend == "sqlite").
+		WithPersonalRows(deps.Config == nil || deps.Config.Recommendations.Enabled)
+}
+
 // invalidateNodeCapabilities drops every cached view of one node's hardware.
 //
 // There is more than one: protocol-v3 planning holds an inventory, and prepared
@@ -1158,11 +1177,22 @@ func newChiRouter(deps Dependencies) chi.Router {
 	if deps.UserStoreProvider != nil {
 		profileHandler = handlers.NewProfileHandler(deps.UserStoreProvider)
 		profileHandler.UserRepo = userRepo
+		if accessGroupStore != nil {
+			profileHandler.AccessGroups = accessGroupStore
+		}
 		profileHandler.EventsHub = deps.EventsHub
+		if deps.RecWorker != nil {
+			profileHandler.RecWorker = deps.RecWorker
+		}
 		if deps.DB != nil {
 			// Drops live in Postgres whichever store holds the profile.
 			profileHandler.DroppedSeriesPurger = catalog.NewDroppedSeriesRepo(deps.DB)
 			profileHandler.WatchlistTitlesPurger = watchlistTitles
+			// So do ratings and recommendation state; the Postgres store
+			// already deleted them with the profile.
+			profileHandler.RecommendationsPurger = recommendations.NewRepo(deps.DB)
+			// Ebook reading data lives there too.
+			profileHandler.EbookReaderPurger = handlers.NewPGEbookReaderProgressStore(deps.DB)
 		}
 		if watchlistRequestWithdrawer != nil {
 			profileHandler.WatchlistRequestWithdrawer = watchlistRequestWithdrawer
@@ -1231,6 +1261,11 @@ func newChiRouter(deps Dependencies) chi.Router {
 		settingsHandler = handlers.NewSettingsHandler(deps.UserStoreProvider)
 		settingsHandler.DeviceSightings = deviceSightings
 		settingsHandler.EventsHub = deps.EventsHub
+		// A profile's hidden libraries are part of the scope its
+		// recommendations are built under.
+		if deps.RecWorker != nil {
+			settingsHandler.RecWorker = deps.RecWorker
+		}
 		if settingsRepo != nil {
 			settingsHandler.SetServerSettings(settingsRepo)
 		}
@@ -1242,6 +1277,9 @@ func newChiRouter(deps Dependencies) chi.Router {
 			settingValuesHandler = handlers.NewSettingValuesHandler(deps.UserStoreProvider, contract)
 			settingValuesHandler.DeviceSightings = deviceSightings
 			settingValuesHandler.EventsHub = deps.EventsHub
+			if deps.RecWorker != nil {
+				settingValuesHandler.RecWorker = deps.RecWorker
+			}
 			// Household management: a primary profile acting for another
 			// profile on its own account. Without the token service a
 			// PIN-locked primary cannot widen rather than widening unguarded.
@@ -1284,28 +1322,26 @@ func newChiRouter(deps Dependencies) chi.Router {
 
 	// Build ratings handler if both repo and itemRepo are available.
 	var ratingsHandler *handlers.RatingsHandler
-	var recsRepoForStale *recommendations.Repo
 	if ratingsRepo != nil && itemRepo != nil {
 		ratingsHandler = handlers.NewRatingsHandler(ratingsRepo, itemRepo)
 		if dispatcher, ok := deps.WatchProviderService.(handlers.LocalRatingEventDispatcher); ok {
 			ratingsHandler.SetLocalRatingEventDispatcher(dispatcher)
 		}
-		if deps.DB != nil {
-			recsRepoForStale = recommendations.NewRepo(deps.DB)
-			ratingsHandler.SetProfileStaler(recsRepoForStale)
-			ratingsHandler.SetProfileRefreshRequester(deps.RecWorker)
-			if personalDataHandler != nil {
-				personalDataHandler.SetProfileStaler(recsRepoForStale)
-				personalDataHandler.SetProfileRefreshRequester(deps.RecWorker)
-			}
-			if progressHandler != nil {
-				progressHandler.SetProfileStaler(recsRepoForStale)
-				progressHandler.SetProfileRefreshRequester(deps.RecWorker)
-			}
-			if itemsHandler != nil {
-				itemsHandler.SetProfileStaler(recsRepoForStale)
-				itemsHandler.SetProfileRefreshRequester(deps.RecWorker)
-			}
+	}
+	// Ratings, favorites, watchlist, progress and watched-state writes rebuild
+	// the profile's recommendations when they are enabled.
+	if deps.RecWorker != nil {
+		if ratingsHandler != nil {
+			ratingsHandler.SetSignalsChangedNotifier(deps.RecWorker)
+		}
+		if personalDataHandler != nil {
+			personalDataHandler.SetSignalsChangedNotifier(deps.RecWorker)
+		}
+		if progressHandler != nil {
+			progressHandler.SetSignalsChangedNotifier(deps.RecWorker)
+		}
+		if itemsHandler != nil {
+			itemsHandler.SetSignalsChangedNotifier(deps.RecWorker)
 		}
 	}
 
@@ -1413,6 +1449,14 @@ func newChiRouter(deps Dependencies) chi.Router {
 		// transcodes from after a restart. Same nil-safety: without Redis such a
 		// session replans instead of recovering, as it did before.
 		playbackHandler.NodeRecipeStore = noderecipe.NewStore(deps.RedisClient, 0)
+		// Keep the recipe of a header-authenticated session server-side, the only
+		// place it exists, so a restarted or different API process can rebuild the
+		// playback session. Same nil-safety: without Redis such a session answers
+		// 404 after a restart and the client starts a new attempt.
+		playbackHandler.SessionRecipeStore = noderecipe.NewSessionRecipeStore(deps.RedisClient, 0)
+		if streamHandler != nil {
+			streamHandler.SessionRecipeStore = playbackHandler.SessionRecipeStore
+		}
 		if deps.Config != nil {
 			playbackHandler.PlaybackConfig = func() config.PlaybackConfig {
 				return deps.CurrentConfig().Playback
@@ -1440,9 +1484,8 @@ func newChiRouter(deps Dependencies) chi.Router {
 		if subtitleRepo != nil {
 			playbackHandler.SubtitleRepo = subtitleRepo
 		}
-		if recsRepoForStale != nil {
-			playbackHandler.SetProfileStaler(recsRepoForStale)
-			playbackHandler.SetProfileRefreshRequester(deps.RecWorker)
+		if deps.RecWorker != nil {
+			playbackHandler.SetSignalsChangedNotifier(deps.RecWorker)
 		}
 		playbackHandler.StartCapabilityWarmupV3(deps.AppContext)
 		// The health sweep sees a node's capability hash change long before this
@@ -1650,9 +1693,15 @@ func newChiRouter(deps Dependencies) chi.Router {
 		if deps.OnServerSettingUpdated != nil {
 			adminHandler.OnServerSettingUpdated = deps.OnServerSettingUpdated
 		}
+		if deps.RecWorker != nil {
+			adminHandler.RecWorker = deps.RecWorker
+		}
 	}
 	if accessGroupStore != nil {
 		accessGroupHandler = handlers.NewAccessGroupHandler(accessGroupStore)
+		if deps.RecWorker != nil {
+			accessGroupHandler.RecWorker = deps.RecWorker
+		}
 	}
 	if deps.DB != nil {
 		jobRepo := adminjob.NewRepository(deps.DB)
@@ -1664,7 +1713,11 @@ func newChiRouter(deps Dependencies) chi.Router {
 		} else if api := blobstore.NewBucketAPI(deps.Blobs.Operational); api != nil {
 			privateStore = api
 		}
-		catalogSeedHandler = handlers.NewCatalogSeedHandler(catalogseed.NewService(deps.DB, deps.PersonRepo, recommendations.NewRepo(deps.DB)), jobRepo, privateStore)
+		catalogSeedService := catalogseed.NewService(deps.DB, deps.PersonRepo, recommendations.NewRepo(deps.DB))
+		if deps.Config != nil {
+			catalogSeedService.WithEmbeddingModel(deps.Config.Recommendations.EmbeddingModel)
+		}
+		catalogSeedHandler = handlers.NewCatalogSeedHandler(catalogSeedService, jobRepo, privateStore)
 		catalogSeedHandler.RealtimeHub = deps.RealtimeHub
 		adminJobsHandler = handlers.NewAdminJobsHandler(jobRepo, privateStore)
 		adminJobsHandler.CancelRegistry = deps.AdminJobCancelRegistry
@@ -1707,6 +1760,9 @@ func newChiRouter(deps Dependencies) chi.Router {
 			deps.Scanner,
 			deps.FolderRepo,
 		)
+		if deps.RecWorker != nil {
+			adminSplitHandler.SetRecommendationStaler(recommendations.NewRepo(deps.DB))
+		}
 	}
 
 	// Build admin image handler for poster/backdrop/logo selection.
@@ -1759,7 +1815,7 @@ func newChiRouter(deps Dependencies) chi.Router {
 		markersHandler = handlers.NewMarkersHandler(
 			deps.FileRepo, deps.FileRepo, contributor, contributions, notifier, slog.Default(),
 		)
-		markersHandler.BaseContext = deps.AppContext
+		markersHandler.BaseContext = deps.AppContext //nolint:fatcontext // set once on a new handler to the app context
 		if deps.DB != nil {
 			markersHandler.Libraries = catalog.NewFolderRepository(deps.DB)
 		}
@@ -1910,6 +1966,9 @@ func newChiRouter(deps Dependencies) chi.Router {
 			aiSem,
 		)
 		aiService.SetExternalTimings(subtitleRepo)
+		if streamHandler != nil && streamHandler.SubtitleCache != nil {
+			aiService.SetSubtitleCache(streamHandler.SubtitleCache)
+		}
 		aiService.Recover()
 		if deps.OnConfigChange != nil {
 			deps.OnConfigChange(func(_, updated *config.Config) {
@@ -1986,7 +2045,7 @@ func newChiRouter(deps Dependencies) chi.Router {
 		if deps.DB != nil {
 			sectionFetcher.RecommendationRepo = recommendations.NewRepo(deps.DB)
 			if ratingsRepo != nil {
-				sectionFetcher.RecommendationReader = recommendations.NewReader(sectionFetcher.RecommendationRepo, ratingsRepo, deps.RecWorker, deps.UserStoreProvider)
+				sectionFetcher.RecommendationReader = deps.recommendationReader(sectionFetcher.RecommendationRepo, ratingsRepo)
 			}
 		}
 		sections.InstallRecipeDelegate(sectionFetcher)
@@ -1995,6 +2054,9 @@ func newChiRouter(deps Dependencies) chi.Router {
 		if deps.TrendingRefresher != nil {
 			sectionHandler.TrendingRefresher = deps.TrendingRefresher
 		}
+		if deps.SeasonalListRefresher != nil {
+			sectionHandler.SeasonalLists = deps.SeasonalListRefresher
+		}
 		sectionHandler.CollectionRepo = sectionFetcher.CollectionRepo
 		sectionHandler.FolderRepo = deps.FolderRepo
 		if deps.UserStoreProvider != nil {
@@ -2068,35 +2130,10 @@ func newChiRouter(deps Dependencies) chi.Router {
 				client: tmdb.NewClient(apiKey, 40),
 			}
 		}
-		if libraryCollectionService.TraktCollections == nil {
-			// The client ID is resolved per call rather than captured here, so
-			// saving new Trakt credentials applies without a server restart.
-			adapter := &traktCollectionAdapter{
-				client:   metatrakt.NewClient("", 5),
-				settings: settingsRepo,
-			}
-			if clientIDs, ok := deps.WatchProviderService.(watchProviderAppClientIDs); ok {
-				adapter.watchProviders = clientIDs
-			}
-			libraryCollectionService.TraktCollections = adapter
-		}
-		if tokens, ok := deps.WatchProviderService.(watchProviderAccessTokens); ok && libraryCollectionService.TraktTokenResolver == nil && deps.DB != nil {
-			libraryCollectionService.TraktTokenResolver = &traktCollectionTokenResolver{
-				pool:   deps.DB,
-				tokens: tokens,
-			}
-		}
-
-		// Propagate the now-wired Trakt + TMDB fetchers to the user-side sync
-		// service (constructed earlier in main.go before settingsRepo and the
-		// Trakt adapters existed, so its fetcher fields started nil).
+		// Propagate the now-wired TMDB fetchers to the user-side sync service
+		// (constructed earlier in main.go before settingsRepo existed, so its
+		// fetcher fields started nil).
 		if deps.UserCollectionSync != nil {
-			if deps.UserCollectionSync.TraktCollections == nil {
-				deps.UserCollectionSync.TraktCollections = libraryCollectionService.TraktCollections
-			}
-			if deps.UserCollectionSync.TraktTokenResolver == nil {
-				deps.UserCollectionSync.TraktTokenResolver = libraryCollectionService.TraktTokenResolver
-			}
 			if deps.UserCollectionSync.TMDBCollections == nil {
 				deps.UserCollectionSync.TMDBCollections = libraryCollectionService.TMDBCollections
 			}
@@ -2105,17 +2142,15 @@ func newChiRouter(deps Dependencies) chi.Router {
 			}
 		}
 
-		// Propagate the now-wired Trakt fetcher to the trending refresher (built
-		// in main.go with TMDB only, before the Trakt adapter existed).
-		if deps.TrendingRefresher != nil && deps.TrendingRefresher.TraktTrending == nil {
-			deps.TrendingRefresher.TraktTrending = libraryCollectionService.TraktCollections
-		}
-
 		// Wire the trending snapshot reader into the section fetcher. The
 		// trending_discover home section reads its list from the persisted
 		// snapshot table; the upstream fetch happens out-of-band in the refresh
 		// task, so the read path never calls the provider.
 		sectionFetcher.TrendingSnapshots = sections.NewTrendingSnapshotRepository(deps.DB)
+		sectionFetcher.SeasonalLists = sections.NewSeasonalListRepository(deps.DB)
+		if sectionFetcher.RecommendationRepo != nil {
+			sectionFetcher.SeasonalNeighbors = sectionFetcher.RecommendationRepo
+		}
 
 		libraryCollectionHandler = handlers.NewLibraryCollectionHandler(
 			libraryCollectionRepo,
@@ -2191,7 +2226,7 @@ func newChiRouter(deps Dependencies) chi.Router {
 		var recsReader *recommendations.Reader
 		if deps.DB != nil {
 			recsRepo = recommendations.NewRepo(deps.DB)
-			recsReader = recommendations.NewReader(recsRepo, ratingsRepo, deps.RecWorker, deps.UserStoreProvider)
+			recsReader = deps.recommendationReader(recsRepo, ratingsRepo)
 		}
 		recsHandler = handlers.NewRecommendationsHandler(deps.Recommender, recsReader, deps.UserStoreProvider, ratingsRepo, recsRepo, deps.Recommender != nil)
 		if deps.DB != nil {
@@ -2345,12 +2380,18 @@ func newChiRouter(deps Dependencies) chi.Router {
 		if deps.EventsHub != nil {
 			historyImportSvc.AddObserver(evt.NewHistoryImportObserver(deps.EventsHub))
 		}
+		if deps.RecWorker != nil {
+			historyImportSvc.SetSignalsChangedNotifier(deps.RecWorker)
+		}
 		historyImportSvc.StartBackgroundWork()
 		historyImportHandler = handlers.NewHistoryImportHandler(historyImportSvc)
 		if deps.UserStoreProvider != nil {
 			webhookSyncSvc := webhooksync.NewService(webhooksync.NewRepository(deps.DB, deps.SecretCipher), historyRepo, deps.UserStoreProvider)
 			webhookSyncSvc.SetLocalNetworkAccess(localNetworkAccess)
 			webhookSyncSvc.SetStableIdentityResolver(historyIdentity)
+			if deps.RecWorker != nil {
+				webhookSyncSvc.SetSignalsChangedNotifier(deps.RecWorker)
+			}
 			webhookSyncHandler = handlers.NewWebhookSyncHandler(webhookSyncSvc)
 		}
 	}
@@ -2449,12 +2490,21 @@ func newChiRouter(deps Dependencies) chi.Router {
 	if deps.DB != nil {
 		v2deps.ServerIdentity = serveridentity.New(catalog.NewServerSettingsRepo(deps.DB))
 	}
-	v2deps.ServerConnections = apiv2.ServerConnections{PublicURL: func() string {
-		if cfg := deps.CurrentConfig(); cfg != nil {
-			return cfg.Server.PublicURL
-		}
-		return ""
-	}}
+	v2deps.ServerConnections = apiv2.ServerConnections{
+		PublicURL: func() string {
+			if cfg := deps.CurrentConfig(); cfg != nil {
+				return cfg.Server.PublicURL
+			}
+			return ""
+		},
+		LocalURL: func() string {
+			if cfg := deps.CurrentConfig(); cfg != nil {
+				return cfg.Server.LocalURL
+			}
+			return ""
+		},
+		LocalTLSPin: deps.LocalTLSPin,
+	}
 	if deps.NetworkAccess != nil {
 		v2deps.ServerConnections.Providers = deps.NetworkAccess.Status
 	}
@@ -2468,7 +2518,7 @@ func newChiRouter(deps Dependencies) chi.Router {
 		v2deps.ScanControls = libraryHandler
 	}
 	if deps.OpsLogRepo != nil && deps.ActivityLogRepo != nil && deps.LogStreamHub != nil && sessionRepo != nil && userRepo != nil {
-		socket := handlers.NewAdminLogsSocketV2(handlers.NewAdminLogsHandler(deps.OpsLogRepo, deps.ActivityLogRepo, deps.LogStreamHub), evt.NewSocketTicketStore(deps.RedisClient), sessionRepo, userRepo, viewerResolver, checkPrimaryProfile, deps.PublicURL)
+		socket := handlers.NewAdminLogsSocketV2(handlers.NewAdminLogsHandler(deps.OpsLogRepo, deps.ActivityLogRepo, deps.LogStreamHub), evt.NewSocketTicketStore(deps.RedisClient), sessionRepo, userRepo, viewerResolver, actingAdmin, deps.PublicURL)
 		v2deps.AdminLogsSocket = socket
 		if deps.OnConfigChange != nil {
 			deps.OnConfigChange(func(_, updated *config.Config) { socket.SetPublicOrigin(updated.Server.PublicURL) })
@@ -2543,11 +2593,16 @@ func newChiRouter(deps Dependencies) chi.Router {
 	v2deps.ObserveThemeAudio = func(method string, handler http.Handler) http.Handler {
 		return observeNative(deps.StreamTelemetry, method, "/api/v2/catalog/items/{id}/themes/{theme_id}/audio", handler.ServeHTTP)
 	}
+	v2deps.ObserveDownloadDelivery = func(method, pattern string, handler http.Handler) http.Handler {
+		return observeNative(deps.StreamTelemetry, method, pattern, handler.ServeHTTP)
+	}
+	v2deps.ObserveBandwidthProbe = func(handler http.Handler) http.Handler {
+		return observeNative(deps.StreamTelemetry, http.MethodGet, "/api/v2/playback/bandwidth-probe", handler.ServeHTTP)
+	}
 
 	var themeHandler *handlers.ThemeHandler
 	if settingsRepo != nil {
 		themeHandler = handlers.NewThemeHandler(settingsRepo)
-		v2deps.ThemeOverrides = themeHandler
 	}
 	if deps.BrandingService != nil {
 		v2deps.Branding = deps.BrandingService
@@ -2600,7 +2655,7 @@ func newChiRouter(deps Dependencies) chi.Router {
 	if playbackHandler != nil {
 		v2deps.Playback = playbackHandler
 		if sessionRepo != nil && userRepo != nil {
-			socket := handlers.NewPlaybackControlSocketV2(playbackHandler, deps.RedisClient, sessionRepo, userRepo, viewerResolver, checkPrimaryProfile, deps.PublicURL)
+			socket := handlers.NewPlaybackControlSocketV2(playbackHandler, deps.RedisClient, sessionRepo, userRepo, viewerResolver, actingAdmin, deps.PublicURL)
 			v2deps.PlaybackControlSocket = socket
 			if deps.OnConfigChange != nil {
 				deps.OnConfigChange(func(_, updated *config.Config) { socket.SetPublicOrigin(updated.Server.PublicURL) })
@@ -2719,7 +2774,7 @@ func newChiRouter(deps Dependencies) chi.Router {
 		v2deps.WatchTogetherCapability = watchTogetherHandler
 		v2deps.WatchTogetherCreate = watchTogetherHandler
 		if deps.RedisClient != nil && sessionRepo != nil && userRepo != nil {
-			socket := handlers.NewWatchTogetherSocketV2(watchTogetherHandler, watchtogether.NewRoomSocketCredentialStore(deps.RedisClient), sessionRepo, userRepo, viewerResolver, checkPrimaryProfile, deps.PublicURL)
+			socket := handlers.NewWatchTogetherSocketV2(watchTogetherHandler, watchtogether.NewRoomSocketCredentialStore(deps.RedisClient), sessionRepo, userRepo, viewerResolver, actingAdmin, deps.PublicURL)
 			v2deps.WatchTogetherSocket = socket
 			playbackHandler.WatchTogetherAvailable = true
 			if deps.OnConfigChange != nil {
@@ -2735,7 +2790,7 @@ func newChiRouter(deps Dependencies) chi.Router {
 		events.SetNotificationsSystem(deps.Notifications)
 		v2deps.EventsCapability = events
 		if sessionRepo != nil && userRepo != nil {
-			socket := handlers.NewEventsSocketV2(events, evt.NewSocketTicketStore(deps.RedisClient), sessionRepo, userRepo, viewerResolver, checkPrimaryProfile, deps.PublicURL)
+			socket := handlers.NewEventsSocketV2(events, evt.NewSocketTicketStore(deps.RedisClient), sessionRepo, userRepo, viewerResolver, actingAdmin, deps.PublicURL)
 			v2deps.EventsSocket = socket
 			if deps.OnConfigChange != nil {
 				deps.OnConfigChange(func(_, updated *config.Config) { socket.SetPublicOrigin(updated.Server.PublicURL) })
@@ -2753,7 +2808,7 @@ func newChiRouter(deps Dependencies) chi.Router {
 		v2deps.NotificationDestinationTests = inbox
 		v2deps.NotificationDestinationCreate = inbox
 		v2deps.OrderedAndroidPush = inbox
-		v2deps.OrderedApplePush = handlers.NewOrderedApplePushV2(deps.Notifications.PushDevices, jwtService, sessionRepo, userRepo, viewerResolver, checkPrimaryProfile)
+		v2deps.OrderedApplePush = handlers.NewOrderedApplePushV2(deps.Notifications.PushDevices, jwtService, sessionRepo, userRepo, viewerResolver, actingAdmin)
 		v2deps.AdminNotificationPush = deps.Notifications
 		v2deps.AdminNotificationDiscord = deps.Notifications
 		v2deps.NotificationChannels = deps.Notifications
@@ -2990,6 +3045,7 @@ func newChiRouter(deps Dependencies) chi.Router {
 	v2deps.Recipes = &handlers.RecipeHandler{}
 	if personalDataHandler != nil && itemsHandler != nil {
 		v2deps.PersonalLists = personalDataHandler
+		v2deps.NotInterested = personalDataHandler
 	}
 	if ratingsHandler != nil {
 		v2deps.Ratings = ratingsHandler
@@ -3441,6 +3497,7 @@ func newChiRouter(deps Dependencies) chi.Router {
 					if sessionRepo != nil {
 						eventsHandler.SetSessionRoles(sessionRepo)
 					}
+					eventsHandler.SetProfileVerifier(viewerResolver)
 					r.Get("/events/ws", eventsHandler.HandleWebSocket)
 					r.Get("/events/capability", eventsHandler.HandleCapability)
 				}
@@ -3970,6 +4027,24 @@ func newChiRouter(deps Dependencies) chi.Router {
 						metadataAIHandler.ItemAccess = itemRepo
 						metadataAIHandler.SeasonLookup = seasonRepo
 						metadataAIHandler.EpisodeLookup = episodeRepo
+						if deps.FolderRepo != nil {
+							metadataAIHandler.Libraries = deps.FolderRepo
+						} else if deps.DB != nil {
+							metadataAIHandler.Libraries = catalog.NewFolderRepository(deps.DB)
+						}
+						if detailSvc != nil {
+							metadataAIHandler.Pending = detailSvc
+						}
+						metadataAIHandler.ItemLibraries = itemRepo
+						// The budget caps provider spend, so like the profile
+						// PIN limiter it counts in Redis whenever Redis is
+						// configured, whatever ratelimit.backend says, and per
+						// node only without Redis.
+						if deps.RedisClient != nil {
+							metadataAIHandler.Limiter = ratelimit.NewRedisLimiter(deps.RedisClient)
+						} else {
+							metadataAIHandler.Limiter = ratelimit.NewMemoryLimiter()
+						}
 						r.With(householdProfileGate).Post("/items/{id}/translate-description", metadataAIHandler.HandleTranslateOnView)
 					}
 				} else {
@@ -5046,29 +5121,19 @@ func (a *tmdbCollectionAdapter) GetCollectionPreset(ctx context.Context, preset,
 	if err != nil {
 		return nil, err
 	}
-	entries := make([]catalog.TMDBCollectionEntry, len(results))
-	for i, r := range results {
-		entry := catalog.TMDBCollectionEntry{
-			ID:        r.ID,
-			MediaType: r.MediaType,
-			Title:     r.Title,
-		}
+	return tmdbCollectionEntries(results), nil
+}
 
-		// Fetch external IDs (IMDb, TVDB) for better matching against local library.
-		if externalIDs, err := a.client.GetExternalIDs(ctx, r.MediaType, r.ID); err == nil && externalIDs != nil {
-			entry.IMDbID = externalIDs.IMDbID
-			entry.TVDBID = externalIDs.TVDBID
-		}
+func (a *tmdbCollectionAdapter) EnrichExternalIDs(ctx context.Context, entries []catalog.TMDBCollectionEntry) error {
+	return enrichTMDBExternalIDs(ctx, a.client, entries)
+}
 
-		entries[i] = entry
-	}
-	return entries, nil
+func (a *tmdbCollectionAdapter) FindTMDBIDs(ctx context.Context, itemType string, titles []catalog.TitleWithoutTMDBID) ([]int, error) {
+	return findTMDBIDs(ctx, a.client, itemType, titles)
 }
 
 // tmdbFranchiseAdapter adapts tmdb.Client to catalog.TMDBCollectionByIDFetcher
-// for the `tmdb_collection` sync mode. Like the preset adapter, it enriches
-// each TMDB collection part with external IDs so the catalog matcher can fall
-// back to IMDb/TVDB when a local item lacks a TMDB ID.
+// for the `tmdb_collection` sync mode.
 type tmdbFranchiseAdapter struct {
 	client *tmdb.Client
 }
@@ -5087,24 +5152,25 @@ func (a *tmdbFranchiseAdapter) GetCollection(ctx context.Context, id int) ([]cat
 		if mediaType == "" {
 			mediaType = "movie"
 		}
-		entry := catalog.TMDBCollectionEntry{
+		entries[i] = catalog.TMDBCollectionEntry{
 			ID:        p.ID,
 			MediaType: mediaType,
 			Title:     p.Title,
 		}
-		if externalIDs, err := a.client.GetExternalIDs(ctx, mediaType, p.ID); err == nil && externalIDs != nil {
-			entry.IMDbID = externalIDs.IMDbID
-			entry.TVDBID = externalIDs.TVDBID
-		}
-		entries[i] = entry
 	}
 	return entries, nil
 }
 
+func (a *tmdbFranchiseAdapter) EnrichExternalIDs(ctx context.Context, entries []catalog.TMDBCollectionEntry) error {
+	return enrichTMDBExternalIDs(ctx, a.client, entries)
+}
+
+func (a *tmdbFranchiseAdapter) FindTMDBIDs(ctx context.Context, itemType string, titles []catalog.TitleWithoutTMDBID) ([]int, error) {
+	return findTMDBIDs(ctx, a.client, itemType, titles)
+}
+
 // tmdbDiscoverAdapter adapts tmdb.Client to catalog.TMDBDiscoverFetcher for
-// the `tmdb_discover` sync mode. Like the preset adapter, it enriches each
-// result with external IDs so the catalog matcher can fall back to IMDb/TVDB
-// when a local item lacks a TMDB ID.
+// the `tmdb_discover` sync mode.
 type tmdbDiscoverAdapter struct {
 	client *tmdb.Client
 }
@@ -5128,77 +5194,109 @@ func (a *tmdbDiscoverAdapter) Discover(ctx context.Context, mediaType string, pa
 	if err != nil {
 		return nil, err
 	}
-	entries := make([]catalog.TMDBCollectionEntry, len(results))
-	for i, r := range results {
-		entry := catalog.TMDBCollectionEntry{
-			ID:        r.ID,
-			MediaType: r.MediaType,
-			Title:     r.Title,
-		}
-		if externalIDs, err := a.client.GetExternalIDs(ctx, r.MediaType, r.ID); err == nil && externalIDs != nil {
-			entry.IMDbID = externalIDs.IMDbID
-			entry.TVDBID = externalIDs.TVDBID
-		}
-		entries[i] = entry
-	}
-	return entries, nil
+	return tmdbCollectionEntries(results), nil
+}
+
+func (a *tmdbDiscoverAdapter) EnrichExternalIDs(ctx context.Context, entries []catalog.TMDBCollectionEntry) error {
+	return enrichTMDBExternalIDs(ctx, a.client, entries)
+}
+
+func (a *tmdbDiscoverAdapter) FindTMDBIDs(ctx context.Context, itemType string, titles []catalog.TitleWithoutTMDBID) ([]int, error) {
+	return findTMDBIDs(ctx, a.client, itemType, titles)
 }
 
 // tmdbListAdapter adapts tmdb.Client to catalog.TMDBListFetcher for the
-// `tmdb_list` sync mode. Like the other TMDB adapters, it enriches each entry
-// with external IDs so the matcher can fall back to IMDb/TVDB when a local
-// item lacks a TMDB ID.
+// `tmdb_list` sync mode.
 type tmdbListAdapter struct {
 	client *tmdb.Client
 }
 
-// tmdbListExternalIDLookups bounds the concurrent external-ID lookups for one
-// list. A list can hold up to 500 entries and the import runs its first sync
-// inside the request, so sequential lookups (one round trip each) would take
-// far longer than the client's shared rate limit requires.
-const tmdbListExternalIDLookups = 8
-
 func (a *tmdbListAdapter) GetList(ctx context.Context, id, limit int) ([]catalog.TMDBCollectionEntry, error) {
 	results, err := a.client.GetList(ctx, id, limit)
 	if err != nil {
 		return nil, err
 	}
+	return tmdbCollectionEntries(results), nil
+}
+
+func (a *tmdbListAdapter) EnrichExternalIDs(ctx context.Context, entries []catalog.TMDBCollectionEntry) error {
+	return enrichTMDBExternalIDs(ctx, a.client, entries)
+}
+
+func (a *tmdbListAdapter) FindTMDBIDs(ctx context.Context, itemType string, titles []catalog.TitleWithoutTMDBID) ([]int, error) {
+	return findTMDBIDs(ctx, a.client, itemType, titles)
+}
+
+func tmdbCollectionEntries(results []tmdb.CollectionResult) []catalog.TMDBCollectionEntry {
 	entries := make([]catalog.TMDBCollectionEntry, len(results))
-	g, gctx := errgroup.WithContext(ctx)
-	g.SetLimit(tmdbListExternalIDLookups)
 	for i, r := range results {
-		entries[i] = catalog.TMDBCollectionEntry{
-			ID:        r.ID,
-			MediaType: r.MediaType,
-			Title:     r.Title,
-		}
+		entries[i] = catalog.TMDBCollectionEntry{ID: r.ID, MediaType: r.MediaType, Title: r.Title}
+	}
+	return entries
+}
+
+// tmdbExternalIDLookups bounds the concurrent external-ID lookups of one sync.
+// The client's shared rate limit sets the pace; concurrency only keeps the
+// round trips from adding up, since an import runs its first sync inside the
+// request.
+const tmdbExternalIDLookups = 8
+
+// enrichTMDBExternalIDs fills in the IMDb and TVDB IDs of entries, which lets
+// the matcher find a local title that lacks a TMDB ID. The matcher asks only
+// for the entries their TMDB ID left unmatched.
+func enrichTMDBExternalIDs(ctx context.Context, client *tmdb.Client, entries []catalog.TMDBCollectionEntry) error {
+	g, gctx := errgroup.WithContext(ctx)
+	g.SetLimit(tmdbExternalIDLookups)
+	for i := range entries {
 		g.Go(func() error {
 			// A failed lookup leaves the entry matchable by TMDB ID alone; only
 			// cancellation ends the sync.
-			if externalIDs, err := a.client.GetExternalIDs(gctx, r.MediaType, r.ID); err == nil && externalIDs != nil {
+			if externalIDs, err := client.GetExternalIDs(gctx, entries[i].MediaType, entries[i].ID); err == nil && externalIDs != nil {
 				entries[i].IMDbID = externalIDs.IMDbID
 				entries[i].TVDBID = externalIDs.TVDBID
 			}
 			return gctx.Err()
 		})
 	}
+	return g.Wait()
+}
+
+// findTMDBIDs looks up the TMDB ID of each catalog title known only by IMDb or
+// TVDB ID, trying the provider that identifies itemType best first. A title
+// TMDB does not know, or whose lookup fails, gets 0; only cancellation ends
+// the sync.
+func findTMDBIDs(ctx context.Context, client *tmdb.Client, itemType string, titles []catalog.TitleWithoutTMDBID) ([]int, error) {
+	ids := make([]int, len(titles))
+	g, gctx := errgroup.WithContext(ctx)
+	g.SetLimit(tmdbExternalIDLookups)
+	for i, title := range titles {
+		g.Go(func() error {
+			lookups := [][2]string{{tmdb.ExternalSourceIMDb, title.IMDbID}, {tmdb.ExternalSourceTVDB, title.TVDBID}}
+			if itemType == "series" {
+				lookups[0], lookups[1] = lookups[1], lookups[0]
+			}
+			for _, lookup := range lookups {
+				if lookup[1] == "" {
+					continue
+				}
+				results, err := client.FindByExternalIDCached(gctx, lookup[0], lookup[1])
+				if err != nil {
+					continue
+				}
+				for _, result := range results {
+					if result.MediaType == itemType {
+						ids[i] = result.ID
+						return nil
+					}
+				}
+			}
+			return gctx.Err()
+		})
+	}
 	if err := g.Wait(); err != nil {
 		return nil, err
 	}
-	return entries, nil
-}
-
-// traktClientIDSettingKey holds the Trakt app client ID that the built-in Trakt
-// watch provider used. The adapter falls back to it when no Trakt watch-sync
-// plugin is configured, so a server that uses Trakt only for collections keeps
-// working. It is deliberately not in config.restartRequiredKeys: the adapter
-// re-reads it before every upstream call.
-const traktClientIDSettingKey = "watchsync.trakt.client_id"
-
-// watchProviderAppClientIDs reads the app client ID a watch-sync plugin is
-// configured with.
-type watchProviderAppClientIDs interface {
-	AppClientID(ctx context.Context, providerKey string) (string, error)
+	return ids, nil
 }
 
 // adminJobArtifactURLTTL matches the presigned lifetime an S3 deployment hands
@@ -5218,85 +5316,6 @@ func newAdminJobArtifactSigner(deps *Dependencies) *artworkurl.Signer {
 	return artworkurl.NewJobArtifactSigner(deps.CurrentConfig().Auth.JWTSecret, adminJobArtifactURLTTL)
 }
 
-type traktCollectionAdapter struct {
-	client *metatrakt.Client
-	// watchProviders supplies the Trakt watch-sync plugin's app client ID,
-	// the app that issued the profile tokens these calls send. Nil when watch
-	// sync is unavailable.
-	watchProviders watchProviderAppClientIDs
-	// settings is the fallback source of the app client ID. Nil only where no
-	// settings store exists (tests), where the client ID stays empty and the
-	// upstream call fails the same way it always did.
-	settings catalog.SettingsStore
-}
-
-// refreshClientID pushes the current app client ID onto the shared client:
-// the Trakt watch-sync plugin's, else the legacy setting. A read failure
-// leaves the last known value in place: failing the request at Trakt is more
-// useful than failing it here on a transient DB blip.
-func (a *traktCollectionAdapter) refreshClientID(ctx context.Context) {
-	if a.watchProviders != nil {
-		clientID, err := a.watchProviders.AppClientID(ctx, "trakt")
-		if err != nil {
-			return
-		}
-		if clientID != "" {
-			a.client.SetClientID(clientID)
-			return
-		}
-	}
-	if a.settings == nil {
-		return
-	}
-	if clientID, err := a.settings.Get(ctx, traktClientIDSettingKey); err == nil {
-		a.client.SetClientID(clientID)
-	}
-}
-
-func (a *traktCollectionAdapter) GetCollectionPreset(ctx context.Context, preset, mediaType string, limit int, accessToken string) ([]catalog.TraktCollectionEntry, error) {
-	a.refreshClientID(ctx)
-	results, err := a.client.GetCollectionPreset(ctx, preset, mediaType, limit, accessToken)
-	if err != nil {
-		return nil, err
-	}
-	entries := make([]catalog.TraktCollectionEntry, len(results))
-	for i, r := range results {
-		entries[i] = catalog.TraktCollectionEntry{
-			TraktID:   r.TraktID,
-			TMDBID:    r.TMDBID,
-			TVDBID:    r.TVDBID,
-			IMDbID:    r.IMDbID,
-			MediaType: r.MediaType,
-			Title:     r.Title,
-			Year:      r.Year,
-			Rank:      r.Rank,
-		}
-	}
-	return entries, nil
-}
-
-func (a *traktCollectionAdapter) GetUserList(ctx context.Context, user, list string, limit int, accessToken string) ([]catalog.TraktCollectionEntry, error) {
-	a.refreshClientID(ctx)
-	results, err := a.client.GetUserList(ctx, user, list, limit, accessToken)
-	if err != nil {
-		return nil, err
-	}
-	entries := make([]catalog.TraktCollectionEntry, len(results))
-	for i, r := range results {
-		entries[i] = catalog.TraktCollectionEntry{
-			TraktID:   r.TraktID,
-			TMDBID:    r.TMDBID,
-			TVDBID:    r.TVDBID,
-			IMDbID:    r.IMDbID,
-			MediaType: r.MediaType,
-			Title:     r.Title,
-			Year:      r.Year,
-			Rank:      r.Rank,
-		}
-	}
-	return entries, nil
-}
-
 // llmConfigFromServer derives the shared AI client config from the server
 // config. Used at construction and again on every config reload.
 func llmConfigFromServer(cfg *config.Config) llm.Config {
diff --git a/internal/api/testdata/media_routes.txt b/internal/api/testdata/media_routes.txt
index 5a95e643cd..b128b97e6f 100644
--- a/internal/api/testdata/media_routes.txt
+++ b/internal/api/testdata/media_routes.txt
@@ -80,7 +80,6 @@ GET /api/v2/admin/collections/capabilities	non-media
 POST /api/v2/admin/collections/import/mdblist	non-media
 POST /api/v2/admin/collections/import/tmdb	non-media
 POST /api/v2/admin/collections/import/tmdb-list	non-media
-POST /api/v2/admin/collections/import/trakt	non-media
 GET /api/v2/admin/collections/order	non-media
 PUT /api/v2/admin/collections/order	non-media
 POST /api/v2/admin/collections/preview	non-media
@@ -194,6 +193,9 @@ GET /api/v2/admin/libraries/{library_id}/collection-groups	non-media
 POST /api/v2/admin/libraries/{library_id}/collection-groups	non-media
 GET /api/v2/admin/libraries/{library_id}/collection-groups/order	non-media
 PUT /api/v2/admin/libraries/{library_id}/collection-groups/order	non-media
+POST /api/v2/admin/libraries/{library_id}/metadata-translation	non-media
+GET /api/v2/admin/libraries/{library_id}/metadata-translation/jobs	non-media
+POST /api/v2/admin/libraries/{library_id}/metadata-translation/jobs/{job_id}/cancel	non-media
 GET /api/v2/admin/literary-works/items/{content_id}/candidates	non-media
 POST /api/v2/admin/literary-works/link	non-media
 POST /api/v2/admin/literary-works/matches/confirm	non-media
@@ -297,6 +299,7 @@ PATCH /api/v2/admin/rate-limits/config	non-media
 GET /api/v2/admin/rate-limits/status	non-media
 GET /api/v2/admin/rating-sources	non-media
 GET /api/v2/admin/rating-sources/capabilities	non-media
+POST /api/v2/admin/recommendations/embeddings/reset	non-media
 GET /api/v2/admin/recommendations/status	non-media
 POST /api/v2/admin/recommendations/trigger/cowatch	non-media
 POST /api/v2/admin/recommendations/trigger/embeddings	non-media
@@ -472,6 +475,7 @@ GET /api/v2/calendar	non-media
 GET /api/v2/capabilities/downloads	non-media
 GET /api/v2/capabilities/ebooks	non-media
 GET /api/v2/capabilities/metadata-ai	non-media
+GET /api/v2/capabilities/not-interested	non-media
 GET /api/v2/capabilities/password-reset	non-media
 GET /api/v2/capabilities/ratings	non-media
 GET /api/v2/capabilities/trailers	non-media
@@ -513,7 +517,6 @@ GET /api/v2/collections/import/mdblist/search	non-media
 GET /api/v2/collections/import/mdblist/top	non-media
 POST /api/v2/collections/import/tmdb	non-media
 POST /api/v2/collections/import/tmdb-list	non-media
-POST /api/v2/collections/import/trakt	non-media
 GET /api/v2/collections/order	non-media
 PUT /api/v2/collections/order	non-media
 POST /api/v2/collections/preview	non-media
@@ -537,6 +540,7 @@ GET /api/v2/devices	non-media
 POST /api/v2/devices/push/apple	non-media
 GET /api/v2/devices/push/apple/capabilities	non-media
 DELETE /api/v2/devices/{device_id}	non-media
+PATCH /api/v2/devices/{device_id}	non-media
 DELETE /api/v2/devices/{device_id}/settings	non-media
 GET /api/v2/diagnostics/capabilities	non-media
 POST /api/v2/diagnostics/client-events	non-media
@@ -572,13 +576,13 @@ PATCH /api/v2/downloads/subscriptions/{id}	non-media
 DELETE /api/v2/downloads/{id}	non-media
 PATCH /api/v2/downloads/{id}	non-media
 GET /api/v2/downloads/{id}/artwork/{kind}	non-media
-GET /api/v2/downloads/{id}/file	non-media
-HEAD /api/v2/downloads/{id}/file	non-media
-GET /api/v2/downloads/{id}/file-proxy	non-media
-HEAD /api/v2/downloads/{id}/file-proxy	non-media
+GET /api/v2/downloads/{id}/file	media	transfer	viewer_egress	false	true
+HEAD /api/v2/downloads/{id}/file	media	transfer	viewer_egress	false	true
+GET /api/v2/downloads/{id}/file-proxy	media	transfer	viewer_egress	false	true
+HEAD /api/v2/downloads/{id}/file-proxy	media	transfer	viewer_egress	false	true
 GET /api/v2/downloads/{id}/manifest	non-media
 POST /api/v2/downloads/{id}/prepare	non-media
-GET /api/v2/downloads/{id}/subtitles/{ref}	non-media
+GET /api/v2/downloads/{id}/subtitles/{ref}	media	transfer	viewer_egress	false	true
 GET /api/v2/ebooks/{content_id}/annotations	non-media
 POST /api/v2/ebooks/{content_id}/annotations	non-media
 DELETE /api/v2/ebooks/{content_id}/annotations/{annotation_id}	non-media
@@ -630,6 +634,8 @@ GET /api/v2/libraries/skipped-roots	non-media
 GET /api/v2/libraries/stale-ids	non-media
 POST /api/v2/libraries/stale-ids/{content_id}/rematch	non-media
 GET /api/v2/libraries/unmatched-items	non-media
+DELETE /api/v2/libraries/unmatched-items/{content_id}/ignore	non-media
+PUT /api/v2/libraries/unmatched-items/{content_id}/ignore	non-media
 DELETE /api/v2/libraries/{id}	non-media
 PATCH /api/v2/libraries/{id}	non-media
 POST /api/v2/libraries/{id}/check-mount	non-media
@@ -671,6 +677,10 @@ DELETE /api/v2/markers/files/{file_id}/{segment}	non-media
 GET /api/v2/markers/items/{item_id}	non-media
 PUT /api/v2/markers/items/{item_id}	non-media
 GET /api/v2/network-access/capabilities	non-media
+GET /api/v2/not-interested	non-media
+DELETE /api/v2/not-interested/{item_id}	non-media
+GET /api/v2/not-interested/{item_id}	non-media
+PUT /api/v2/not-interested/{item_id}	non-media
 GET /api/v2/notifications	non-media
 GET /api/v2/notifications/capabilities	non-media
 DELETE /api/v2/notifications/discord-link	non-media
@@ -693,6 +703,9 @@ POST /api/v2/notifications/push/devices	non-media
 GET /api/v2/notifications/push/devices/capabilities	non-media
 DELETE /api/v2/notifications/push/devices/{device_id}	non-media
 POST /api/v2/notifications/read-all	non-media
+GET /api/v2/notifications/series	non-media
+DELETE /api/v2/notifications/series/{series_id}/mute	non-media
+PUT /api/v2/notifications/series/{series_id}/mute	non-media
 GET /api/v2/notifications/sync	non-media
 GET /api/v2/notifications/unread-count	non-media
 GET /api/v2/notifications/web-push/subscriptions	non-media
@@ -715,6 +728,7 @@ GET /api/v2/openapi.json	non-media
 POST /api/v2/password-resets	non-media
 GET /api/v2/password-resets/{token}	non-media
 POST /api/v2/password-resets/{token}/complete	non-media
+GET /api/v2/playback/bandwidth-probe	media	transfer	viewer_egress	false	true
 GET /api/v2/playback/capabilities	non-media
 GET /api/v2/playback/quality-ladder	non-media
 POST /api/v2/playback/route-events	non-media
@@ -763,6 +777,8 @@ DELETE /api/v2/profiles/{id}/avatar	non-media
 PUT /api/v2/profiles/{id}/avatar	non-media
 POST /api/v2/profiles/{id}/verify-pin	non-media
 GET /api/v2/progress	non-media
+GET /api/v2/progress/capabilities	non-media
+DELETE /api/v2/progress/{media_item_id}/position	non-media
 GET /api/v2/ratings	non-media
 DELETE /api/v2/ratings/{item_id}	non-media
 GET /api/v2/ratings/{item_id}	non-media
@@ -803,6 +819,7 @@ POST /api/v2/scan/cancel	non-media
 GET /api/v2/scan/capabilities	non-media
 GET /api/v2/sections/recipes	non-media
 GET /api/v2/sections/recipes/{type}/candidates	non-media
+GET /api/v2/sections/seasonal-themes	non-media
 GET /api/v2/settings/contract	non-media
 GET /api/v2/settings/contract/capabilities	non-media
 DELETE /api/v2/settings/device/subtitle-appearance	non-media
@@ -863,7 +880,6 @@ GET /api/v2/system/connections	non-media
 GET /api/v2/system/identity	non-media
 GET /api/v2/system/info	non-media
 GET /api/v2/system/setup	non-media
-GET /api/v2/theme/admin-css	non-media
 GET /api/v2/theme/branding	non-media
 GET /api/v2/theme/capabilities	non-media
 GET /api/v2/user/libraries	non-media
@@ -1405,7 +1421,6 @@ GET /api/v2/admin/collections/capabilities	non-media
 POST /api/v2/admin/collections/import/mdblist	non-media
 POST /api/v2/admin/collections/import/tmdb	non-media
 POST /api/v2/admin/collections/import/tmdb-list	non-media
-POST /api/v2/admin/collections/import/trakt	non-media
 GET /api/v2/admin/collections/order	non-media
 PUT /api/v2/admin/collections/order	non-media
 POST /api/v2/admin/collections/preview	non-media
@@ -1519,6 +1534,9 @@ GET /api/v2/admin/libraries/{library_id}/collection-groups	non-media
 POST /api/v2/admin/libraries/{library_id}/collection-groups	non-media
 GET /api/v2/admin/libraries/{library_id}/collection-groups/order	non-media
 PUT /api/v2/admin/libraries/{library_id}/collection-groups/order	non-media
+POST /api/v2/admin/libraries/{library_id}/metadata-translation	non-media
+GET /api/v2/admin/libraries/{library_id}/metadata-translation/jobs	non-media
+POST /api/v2/admin/libraries/{library_id}/metadata-translation/jobs/{job_id}/cancel	non-media
 GET /api/v2/admin/literary-works/items/{content_id}/candidates	non-media
 POST /api/v2/admin/literary-works/link	non-media
 POST /api/v2/admin/literary-works/matches/confirm	non-media
@@ -1622,6 +1640,7 @@ PATCH /api/v2/admin/rate-limits/config	non-media
 GET /api/v2/admin/rate-limits/status	non-media
 GET /api/v2/admin/rating-sources	non-media
 GET /api/v2/admin/rating-sources/capabilities	non-media
+POST /api/v2/admin/recommendations/embeddings/reset	non-media
 GET /api/v2/admin/recommendations/status	non-media
 POST /api/v2/admin/recommendations/trigger/cowatch	non-media
 POST /api/v2/admin/recommendations/trigger/embeddings	non-media
@@ -1797,6 +1816,7 @@ GET /api/v2/calendar	non-media
 GET /api/v2/capabilities/downloads	non-media
 GET /api/v2/capabilities/ebooks	non-media
 GET /api/v2/capabilities/metadata-ai	non-media
+GET /api/v2/capabilities/not-interested	non-media
 GET /api/v2/capabilities/password-reset	non-media
 GET /api/v2/capabilities/ratings	non-media
 GET /api/v2/capabilities/trailers	non-media
@@ -1838,7 +1858,6 @@ GET /api/v2/collections/import/mdblist/search	non-media
 GET /api/v2/collections/import/mdblist/top	non-media
 POST /api/v2/collections/import/tmdb	non-media
 POST /api/v2/collections/import/tmdb-list	non-media
-POST /api/v2/collections/import/trakt	non-media
 GET /api/v2/collections/order	non-media
 PUT /api/v2/collections/order	non-media
 POST /api/v2/collections/preview	non-media
@@ -1862,6 +1881,7 @@ GET /api/v2/devices	non-media
 POST /api/v2/devices/push/apple	non-media
 GET /api/v2/devices/push/apple/capabilities	non-media
 DELETE /api/v2/devices/{device_id}	non-media
+PATCH /api/v2/devices/{device_id}	non-media
 DELETE /api/v2/devices/{device_id}/settings	non-media
 GET /api/v2/diagnostics/capabilities	non-media
 POST /api/v2/diagnostics/client-events	non-media
@@ -1897,13 +1917,13 @@ PATCH /api/v2/downloads/subscriptions/{id}	non-media
 DELETE /api/v2/downloads/{id}	non-media
 PATCH /api/v2/downloads/{id}	non-media
 GET /api/v2/downloads/{id}/artwork/{kind}	non-media
-GET /api/v2/downloads/{id}/file	non-media
-HEAD /api/v2/downloads/{id}/file	non-media
-GET /api/v2/downloads/{id}/file-proxy	non-media
-HEAD /api/v2/downloads/{id}/file-proxy	non-media
+GET /api/v2/downloads/{id}/file	media	transfer	viewer_egress	false	true
+HEAD /api/v2/downloads/{id}/file	media	transfer	viewer_egress	false	true
+GET /api/v2/downloads/{id}/file-proxy	media	transfer	viewer_egress	false	true
+HEAD /api/v2/downloads/{id}/file-proxy	media	transfer	viewer_egress	false	true
 GET /api/v2/downloads/{id}/manifest	non-media
 POST /api/v2/downloads/{id}/prepare	non-media
-GET /api/v2/downloads/{id}/subtitles/{ref}	non-media
+GET /api/v2/downloads/{id}/subtitles/{ref}	media	transfer	viewer_egress	false	true
 GET /api/v2/ebooks/{content_id}/annotations	non-media
 POST /api/v2/ebooks/{content_id}/annotations	non-media
 DELETE /api/v2/ebooks/{content_id}/annotations/{annotation_id}	non-media
@@ -1955,6 +1975,8 @@ GET /api/v2/libraries/skipped-roots	non-media
 GET /api/v2/libraries/stale-ids	non-media
 POST /api/v2/libraries/stale-ids/{content_id}/rematch	non-media
 GET /api/v2/libraries/unmatched-items	non-media
+DELETE /api/v2/libraries/unmatched-items/{content_id}/ignore	non-media
+PUT /api/v2/libraries/unmatched-items/{content_id}/ignore	non-media
 DELETE /api/v2/libraries/{id}	non-media
 PATCH /api/v2/libraries/{id}	non-media
 POST /api/v2/libraries/{id}/check-mount	non-media
@@ -1996,6 +2018,10 @@ DELETE /api/v2/markers/files/{file_id}/{segment}	non-media
 GET /api/v2/markers/items/{item_id}	non-media
 PUT /api/v2/markers/items/{item_id}	non-media
 GET /api/v2/network-access/capabilities	non-media
+GET /api/v2/not-interested	non-media
+DELETE /api/v2/not-interested/{item_id}	non-media
+GET /api/v2/not-interested/{item_id}	non-media
+PUT /api/v2/not-interested/{item_id}	non-media
 GET /api/v2/notifications	non-media
 GET /api/v2/notifications/capabilities	non-media
 DELETE /api/v2/notifications/discord-link	non-media
@@ -2018,6 +2044,9 @@ POST /api/v2/notifications/push/devices	non-media
 GET /api/v2/notifications/push/devices/capabilities	non-media
 DELETE /api/v2/notifications/push/devices/{device_id}	non-media
 POST /api/v2/notifications/read-all	non-media
+GET /api/v2/notifications/series	non-media
+DELETE /api/v2/notifications/series/{series_id}/mute	non-media
+PUT /api/v2/notifications/series/{series_id}/mute	non-media
 GET /api/v2/notifications/sync	non-media
 GET /api/v2/notifications/unread-count	non-media
 GET /api/v2/notifications/web-push/subscriptions	non-media
@@ -2040,6 +2069,7 @@ GET /api/v2/openapi.json	non-media
 POST /api/v2/password-resets	non-media
 GET /api/v2/password-resets/{token}	non-media
 POST /api/v2/password-resets/{token}/complete	non-media
+GET /api/v2/playback/bandwidth-probe	media	transfer	viewer_egress	false	true
 GET /api/v2/playback/capabilities	non-media
 GET /api/v2/playback/quality-ladder	non-media
 POST /api/v2/playback/route-events	non-media
@@ -2088,6 +2118,8 @@ DELETE /api/v2/profiles/{id}/avatar	non-media
 PUT /api/v2/profiles/{id}/avatar	non-media
 POST /api/v2/profiles/{id}/verify-pin	non-media
 GET /api/v2/progress	non-media
+GET /api/v2/progress/capabilities	non-media
+DELETE /api/v2/progress/{media_item_id}/position	non-media
 GET /api/v2/ratings	non-media
 DELETE /api/v2/ratings/{item_id}	non-media
 GET /api/v2/ratings/{item_id}	non-media
@@ -2128,6 +2160,7 @@ POST /api/v2/scan/cancel	non-media
 GET /api/v2/scan/capabilities	non-media
 GET /api/v2/sections/recipes	non-media
 GET /api/v2/sections/recipes/{type}/candidates	non-media
+GET /api/v2/sections/seasonal-themes	non-media
 GET /api/v2/settings/contract	non-media
 GET /api/v2/settings/contract/capabilities	non-media
 DELETE /api/v2/settings/device/subtitle-appearance	non-media
@@ -2188,7 +2221,6 @@ GET /api/v2/system/connections	non-media
 GET /api/v2/system/identity	non-media
 GET /api/v2/system/info	non-media
 GET /api/v2/system/setup	non-media
-GET /api/v2/theme/admin-css	non-media
 GET /api/v2/theme/branding	non-media
 GET /api/v2/theme/capabilities	non-media
 GET /api/v2/user/libraries	non-media
diff --git a/internal/api/tmdb_list_adapter_test.go b/internal/api/tmdb_list_adapter_test.go
index b6e0c80e9f..77e20e3537 100644
--- a/internal/api/tmdb_list_adapter_test.go
+++ b/internal/api/tmdb_list_adapter_test.go
@@ -9,6 +9,7 @@ import (
 	"strconv"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"testing"
 
 	"github.com/prairie-server/prairie-server/internal/metadata/tmdb"
@@ -44,8 +45,11 @@ func tmdbListTestServer(entries int, onLookup func()) *httptest.Server {
 	}))
 }
 
-func TestTMDBListAdapterKeepsListOrderWithExternalIDs(t *testing.T) {
-	server := tmdbListTestServer(20, nil)
+// GetList keeps list order and makes no per-entry lookups; the matcher asks
+// for external IDs only for entries their TMDB ID leaves unmatched.
+func TestTMDBListAdapterReadsListWithoutLookups(t *testing.T) {
+	var lookups atomic.Int64
+	server := tmdbListTestServer(20, func() { lookups.Add(1) })
 	defer server.Close()
 	client := tmdb.NewClient("test-key", 1000)
 	client.SetBaseURL(server.URL)
@@ -57,6 +61,30 @@ func TestTMDBListAdapterKeepsListOrderWithExternalIDs(t *testing.T) {
 	if len(entries) != 20 {
 		t.Fatalf("entries = %d, want 20", len(entries))
 	}
+	for i, entry := range entries {
+		if entry.ID != i+1 || entry.IMDbID != "" || entry.TVDBID != 0 {
+			t.Fatalf("entries[%d] = %+v, want list position %d without external IDs", i, entry, i+1)
+		}
+	}
+	if n := lookups.Load(); n != 0 {
+		t.Fatalf("GetList made %d external-ID lookups, want 0", n)
+	}
+}
+
+func TestTMDBEnrichExternalIDsFillsEntriesInPlace(t *testing.T) {
+	server := tmdbListTestServer(20, nil)
+	defer server.Close()
+	client := tmdb.NewClient("test-key", 1000)
+	client.SetBaseURL(server.URL)
+	adapter := &tmdbListAdapter{client: client}
+
+	entries, err := adapter.GetList(t.Context(), 310, 0)
+	if err != nil {
+		t.Fatalf("GetList: %v", err)
+	}
+	if err := adapter.EnrichExternalIDs(t.Context(), entries); err != nil {
+		t.Fatalf("EnrichExternalIDs: %v", err)
+	}
 	for i, entry := range entries {
 		id := i + 1
 		if entry.ID != id || entry.IMDbID != fmt.Sprintf("tt%07d", id) || entry.TVDBID != id*10 {
@@ -65,15 +93,20 @@ func TestTMDBListAdapterKeepsListOrderWithExternalIDs(t *testing.T) {
 	}
 }
 
-func TestTMDBListAdapterStopsWhenCancelledDuringLookups(t *testing.T) {
+func TestTMDBEnrichExternalIDsStopsWhenCancelled(t *testing.T) {
 	ctx, cancel := context.WithCancel(t.Context())
 	var once sync.Once
 	server := tmdbListTestServer(20, func() { once.Do(cancel) })
 	defer server.Close()
 	client := tmdb.NewClient("test-key", 1000)
 	client.SetBaseURL(server.URL)
+	adapter := &tmdbListAdapter{client: client}
 
-	if _, err := (&tmdbListAdapter{client: client}).GetList(ctx, 310, 0); !errors.Is(err, context.Canceled) {
-		t.Fatalf("GetList error = %v, want context.Canceled", err)
+	entries, err := adapter.GetList(t.Context(), 310, 0)
+	if err != nil {
+		t.Fatalf("GetList: %v", err)
+	}
+	if err := adapter.EnrichExternalIDs(ctx, entries); !errors.Is(err, context.Canceled) {
+		t.Fatalf("EnrichExternalIDs error = %v, want context.Canceled", err)
 	}
 }
diff --git a/internal/api/trakt_collection_adapter_test.go b/internal/api/trakt_collection_adapter_test.go
deleted file mode 100644
index 11c9332c80..0000000000
--- a/internal/api/trakt_collection_adapter_test.go
+++ /dev/null
@@ -1,50 +0,0 @@
-package api
-
-import (
-	"context"
-	"errors"
-	"testing"
-
-	metatrakt "github.com/prairie-server/prairie-server/internal/metadata/trakt"
-)
-
-type fakeAppClientIDs struct {
-	clientID string
-	err      error
-}
-
-func (f fakeAppClientIDs) AppClientID(context.Context, string) (string, error) {
-	return f.clientID, f.err
-}
-
-type fakeTraktSettings map[string]string
-
-func (f fakeTraktSettings) Get(_ context.Context, key string) (string, error) { return f[key], nil }
-func (f fakeTraktSettings) Set(context.Context, string, string) error         { return nil }
-func (f fakeTraktSettings) GetAll(context.Context) (map[string]string, error) { return f, nil }
-
-func TestTraktCollectionAdapterClientID(t *testing.T) {
-	legacy := fakeTraktSettings{traktClientIDSettingKey: "legacy-id"}
-	for _, tc := range []struct {
-		name    string
-		plugins watchProviderAppClientIDs
-		want    string
-	}{
-		{name: "plugin app wins", plugins: fakeAppClientIDs{clientID: "plugin-id"}, want: "plugin-id"},
-		{name: "legacy setting without a plugin app", plugins: fakeAppClientIDs{}, want: "legacy-id"},
-		{name: "legacy setting without watch sync", want: "legacy-id"},
-		{name: "plugin read failure keeps the last value", plugins: fakeAppClientIDs{err: errors.New("down")}, want: "previous-id"},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			adapter := &traktCollectionAdapter{
-				client:         metatrakt.NewClient("previous-id", 5),
-				watchProviders: tc.plugins,
-				settings:       legacy,
-			}
-			adapter.refreshClientID(t.Context())
-			if got := adapter.client.ClientID(); got != tc.want {
-				t.Fatalf("client ID = %q, want %q", got, tc.want)
-			}
-		})
-	}
-}
diff --git a/internal/api/trakt_collection_token_resolver.go b/internal/api/trakt_collection_token_resolver.go
deleted file mode 100644
index 082846e73b..0000000000
--- a/internal/api/trakt_collection_token_resolver.go
+++ /dev/null
@@ -1,53 +0,0 @@
-package api
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"strings"
-
-	"github.com/jackc/pgx/v5"
-	"github.com/jackc/pgx/v5/pgxpool"
-)
-
-// watchProviderAccessTokens hands out a saved watch-provider connection's
-// access token, refreshing it first when needed (watchsync.Service).
-type watchProviderAccessTokens interface {
-	AccessToken(ctx context.Context, connectionID string) (string, error)
-}
-
-// traktCollectionTokenResolver finds a profile's Trakt connection for
-// recommendation collections and takes its token from watch sync, so a
-// refresh started here is serialized with watch sync's own refreshes.
-type traktCollectionTokenResolver struct {
-	pool   *pgxpool.Pool
-	tokens watchProviderAccessTokens
-}
-
-func (r *traktCollectionTokenResolver) ResolveTraktAccessToken(ctx context.Context, profileID string) (string, error) {
-	if r == nil || r.pool == nil || r.tokens == nil {
-		return "", errors.New("trakt token resolver is not configured")
-	}
-	profileID = strings.TrimSpace(profileID)
-	if profileID == "" {
-		return "", errors.New("profile id is required")
-	}
-
-	var connectionID string
-	err := r.pool.QueryRow(ctx, `
-		SELECT id::text
-		FROM watch_provider_connections
-		WHERE provider = 'trakt'
-		  AND profile_id = $1
-		  AND access_token <> ''
-		ORDER BY updated_at DESC
-		LIMIT 1
-	`, profileID).Scan(&connectionID)
-	if errors.Is(err, pgx.ErrNoRows) {
-		return "", errors.New("trakt connection not found for profile")
-	}
-	if err != nil {
-		return "", fmt.Errorf("load trakt connection: %w", err)
-	}
-	return r.tokens.AccessToken(ctx, connectionID)
-}
diff --git a/internal/apibench/bench_test.go b/internal/apibench/bench_test.go
index 80b04cc56d..721c4bd389 100644
--- a/internal/apibench/bench_test.go
+++ b/internal/apibench/bench_test.go
@@ -7,7 +7,6 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"os"
-	"path/filepath"
 	"testing"
 	"time"
 )
@@ -45,7 +44,7 @@ func TestRunnerAgainstStub(t *testing.T) {
 	// shipped example plan expects.
 	plan := Plan{
 		NativeBaseURL: srv.URL,
-		BaseDir:       filepath.Join("testdata"),
+		BaseDir:       "testdata",
 		Bearer:        "${APIBENCH_TEST_BEARER}",
 		ProfileID:     "fixture-profile",
 		Concurrency:   4,
diff --git a/internal/apiv2/admin_access_group_inputs.go b/internal/apiv2/admin_access_group_inputs.go
index 0298eed91f..d103570a45 100644
--- a/internal/apiv2/admin_access_group_inputs.go
+++ b/internal/apiv2/admin_access_group_inputs.go
@@ -20,7 +20,7 @@ func groupInput(body AdminAccessGroupBody, raw []byte) (access.UpdateGroupInput,
 	if p := rejectNonNullableNulls(raw, map[string]bool{groupLibraryIDsField: true, "allowed_permissions": true}); p != nil {
 		return access.UpdateGroupInput{}, p
 	}
-	in := access.UpdateGroupInput{Name: body.Name, Description: body.Description, MaxPlaybackQuality: body.MaxPlaybackQuality, DownloadAllowed: body.DownloadAllowed, DownloadTranscodeAllowed: body.DownloadTranscodeAllowed, TranscodeAllowed: body.TranscodeAllowed, AudioTranscodeAllowed: body.AudioTranscodeAllowed, MaxStreams: body.MaxStreams, MaxTranscodes: body.MaxTranscodes, MaxRemoteStreamBitrateKbps: body.MaxRemoteStreamBitrateKbps, MaxLocalStreamBitrateKbps: body.MaxLocalStreamBitrateKbps, AllowedPermissions: body.AllowedPermissions, RequestsAllowed: body.RequestsAllowed, IsDefault: body.IsDefault}
+	in := access.UpdateGroupInput{Name: body.Name, Description: body.Description, MaxPlaybackQuality: body.MaxPlaybackQuality, DownloadAllowed: body.DownloadAllowed, DownloadTranscodeAllowed: body.DownloadTranscodeAllowed, TranscodeAllowed: body.TranscodeAllowed, AudioTranscodeAllowed: body.AudioTranscodeAllowed, MaxStreams: body.MaxStreams, MaxTranscodes: body.MaxTranscodes, MaxRemoteStreamBitrateKbps: body.MaxRemoteStreamBitrateKbps, MaxLocalStreamBitrateKbps: body.MaxLocalStreamBitrateKbps, MaxProfiles: body.MaxProfiles, AllowedPermissions: body.AllowedPermissions, RequestsAllowed: body.RequestsAllowed, IsDefault: body.IsDefault}
 	if body.LibraryIDs != nil {
 		ids := make([]int, 0, len(*body.LibraryIDs))
 		for _, id := range *body.LibraryIDs {
@@ -80,6 +80,9 @@ func applyGroupCreate(out *access.CreateGroupInput, in access.UpdateGroupInput)
 	if in.MaxLocalStreamBitrateKbps != nil {
 		out.MaxLocalStreamBitrateKbps = *in.MaxLocalStreamBitrateKbps
 	}
+	if in.MaxProfiles != nil {
+		out.MaxProfiles = *in.MaxProfiles
+	}
 	if in.AllowedPermissions != nil {
 		out.AllowedPermissions = *in.AllowedPermissions
 	}
diff --git a/internal/apiv2/admin_access_groups.go b/internal/apiv2/admin_access_groups.go
index a1ae992adc..a1ae46b7b6 100644
--- a/internal/apiv2/admin_access_groups.go
+++ b/internal/apiv2/admin_access_groups.go
@@ -35,6 +35,7 @@ type AdminAccessGroup struct {
 	MaxTranscodes              int      `json:"max_transcodes"`
 	MaxRemoteStreamBitrateKbps int      `json:"max_remote_stream_bitrate_kbps" minimum:"0" doc:"Remote per-stream bitrate ceiling in kbps; 0 means unlimited"`
 	MaxLocalStreamBitrateKbps  int      `json:"max_local_stream_bitrate_kbps" minimum:"0" doc:"Local per-stream bitrate ceiling in kbps; 0 means unlimited"`
+	MaxProfiles                int      `json:"max_profiles" minimum:"1" doc:"Household profiles each member account may have, unless the account overrides it"`
 	AllowedPermissions         []string `json:"allowed_permissions" nullable:"true"`
 	RequestsAllowed            bool     `json:"requests_allowed"`
 	IsDefault                  bool     `json:"is_default"`
@@ -77,6 +78,7 @@ type AdminAccessGroupBody struct {
 	MaxTranscodes              *int      `json:"max_transcodes,omitempty" minimum:"0"`
 	MaxRemoteStreamBitrateKbps *int      `json:"max_remote_stream_bitrate_kbps,omitempty" minimum:"0"`
 	MaxLocalStreamBitrateKbps  *int      `json:"max_local_stream_bitrate_kbps,omitempty" minimum:"0"`
+	MaxProfiles                *int      `json:"max_profiles,omitempty" minimum:"1" doc:"Household profiles each member account may have; 5 when a new group omits it"`
 	AllowedPermissions         *[]string `json:"allowed_permissions,omitempty" nullable:"true"`
 	RequestsAllowed            *bool     `json:"requests_allowed,omitempty"`
 	IsDefault                  *bool     `json:"is_default,omitempty"`
@@ -101,7 +103,7 @@ func adminAccessGroupOf(g *access.Group) AdminAccessGroup {
 			ids = append(ids, IDFromInt(int64(id)))
 		}
 	}
-	return AdminAccessGroup{ID: IDFromInt(g.ID), Name: g.Name, Description: g.Description, LibraryIDs: ids, MaxPlaybackQuality: g.MaxPlaybackQuality, DownloadAllowed: g.DownloadAllowed, DownloadTranscodeAllowed: g.DownloadTranscodeAllowed, TranscodeAllowed: g.TranscodeAllowed, AudioTranscodeAllowed: g.AudioTranscodeAllowed, MaxStreams: g.MaxStreams, MaxTranscodes: g.MaxTranscodes, MaxRemoteStreamBitrateKbps: g.MaxRemoteStreamBitrateKbps, MaxLocalStreamBitrateKbps: g.MaxLocalStreamBitrateKbps, AllowedPermissions: g.AllowedPermissions, RequestsAllowed: g.RequestsAllowed, IsDefault: g.IsDefault, CreatedAt: NewInstant(g.CreatedAt), UpdatedAt: NewInstant(g.UpdatedAt)}
+	return AdminAccessGroup{ID: IDFromInt(g.ID), Name: g.Name, Description: g.Description, LibraryIDs: ids, MaxPlaybackQuality: g.MaxPlaybackQuality, DownloadAllowed: g.DownloadAllowed, DownloadTranscodeAllowed: g.DownloadTranscodeAllowed, TranscodeAllowed: g.TranscodeAllowed, AudioTranscodeAllowed: g.AudioTranscodeAllowed, MaxStreams: g.MaxStreams, MaxTranscodes: g.MaxTranscodes, MaxRemoteStreamBitrateKbps: g.MaxRemoteStreamBitrateKbps, MaxLocalStreamBitrateKbps: g.MaxLocalStreamBitrateKbps, MaxProfiles: g.MaxProfiles, AllowedPermissions: g.AllowedPermissions, RequestsAllowed: g.RequestsAllowed, IsDefault: g.IsDefault, CreatedAt: NewInstant(g.CreatedAt), UpdatedAt: NewInstant(g.UpdatedAt)}
 }
 func groupTag(ctx context.Context, g *access.Group) EntityTag {
 	return RenderETag("admin-access-groups/"+strconv.Itoa(claimsFrom(ctx).UserID)+"/"+profileFrom(ctx), strconv.FormatInt(g.ID, 10), g.Revision)
@@ -226,6 +228,9 @@ func registerAdminAccessGroups(reg *Registry) {
 		if update.Name == nil {
 			return nil, NewProblem(TypeValidationFailed, "Access group name is required.")
 		}
+		if p = reg.rejectUnknownLibraries(ctx, update.LibraryIDs, locationLibraryIDs); p != nil {
+			return nil, p
+		}
 		body := access.CreateGroupInput{Name: *update.Name, DownloadAllowed: true, DownloadTranscodeAllowed: true, TranscodeAllowed: true, AudioTranscodeAllowed: true, RequestsAllowed: true}
 		applyGroupCreate(&body, update)
 		g, err := svc.CreateAdminAccessGroup(ctx, body)
@@ -255,6 +260,11 @@ func registerAdminAccessGroups(reg *Registry) {
 		if p != nil {
 			return nil, p
 		}
+		// After the guard: an editor opened before a library was deleted holds
+		// the old ETag and gets 412, which tells it to reload.
+		if p = reg.rejectUnknownLibraries(ctx, body.LibraryIDs, locationLibraryIDs); p != nil {
+			return nil, p
+		}
 		g, err = svc.UpdateAdminAccessGroup(ctx, id, body, guard)
 		if err != nil {
 			return nil, groupProblem(ctx, err)
diff --git a/internal/apiv2/admin_access_groups_test.go b/internal/apiv2/admin_access_groups_test.go
index 7367ec03fb..b3140eb22d 100644
--- a/internal/apiv2/admin_access_groups_test.go
+++ b/internal/apiv2/admin_access_groups_test.go
@@ -4,6 +4,8 @@ import (
 	"context"
 	"encoding/json"
 	"net/http"
+	"net/http/httptest"
+	"slices"
 	"strings"
 	"testing"
 
@@ -23,7 +25,7 @@ type fakeAdminAccessGroups struct {
 }
 
 func fixtureAdminAccessGroups() *fakeAdminAccessGroups {
-	return &fakeAdminAccessGroups{g: access.Group{ID: 7, Revision: 11, Name: "Group", MaxPlaybackQuality: "original", MemberCount: 3, CreatedAt: fixedTime(), UpdatedAt: fixedTime()}}
+	return &fakeAdminAccessGroups{g: access.Group{ID: 7, Revision: 11, Name: "Group", MaxPlaybackQuality: "original", MaxProfiles: 5, MemberCount: 3, CreatedAt: fixedTime(), UpdatedAt: fixedTime()}}
 }
 func (f *fakeAdminAccessGroups) GetAdminAccessGroup(context.Context, int64) (*access.Group, error) {
 	g := f.g
@@ -102,6 +104,55 @@ func TestAdminAccessGroupTransport(t *testing.T) {
 		t.Fatal(created.Code, created.Body.String(), f.created)
 	}
 }
+func TestAdminAccessGroupProfileLimit(t *testing.T) {
+	f := fixtureAdminAccessGroups()
+	deps := requestDeps(fixtureRequests())
+	deps.AdminAccessGroups = f
+	h := NewHandler(deps)
+	create := Prefix + "/admin/access-groups"
+	created := do(t, h, http.MethodPost, create, `{"name":"Guests","max_profiles":2}`, actingRequestAdmin)
+	if created.Code != 201 || f.created.MaxProfiles != 2 {
+		t.Fatal(created.Code, created.Body.String(), f.created)
+	}
+	// A limit below 1 is refused before any write, so 0 never reaches the
+	// store, where it would mean "use the default".
+	writes := f.writes
+	requireProblem(t, do(t, h, http.MethodPost, create, `{"name":"None","max_profiles":0}`, actingRequestAdmin), TypeValidationFailed)
+	requireProblem(t, do(t, h, http.MethodPut, create+"/7", `{"max_profiles":0}`, with(actingRequestAdmin, "If-Match", "*")), TypeValidationFailed)
+	if f.writes != writes {
+		t.Fatalf("writes = %d, want %d after refused limits", f.writes, writes)
+	}
+	updated := do(t, h, http.MethodPut, create+"/7", `{"max_profiles":4}`, with(actingRequestAdmin, "If-Match", "*"))
+	if updated.Code != 200 || f.last.MaxProfiles == nil || *f.last.MaxProfiles != 4 {
+		t.Fatal(updated.Code, updated.Body.String(), f.last)
+	}
+}
+
+// Clients detect profile limits on groups and accounts through the admin
+// users capabilities, as older servers reject max_profiles on a group.
+func TestAdminAccountCapabilitiesAdvertiseProfileLimits(t *testing.T) {
+	read := func(deps Dependencies) any {
+		t.Helper()
+		reply := do(t, NewHandler(deps), http.MethodGet, Prefix+"/admin/users/capabilities", "", actingRequestAdmin)
+		if reply.Code != http.StatusOK {
+			t.Fatalf("%d %s", reply.Code, reply.Body.String())
+		}
+		var body map[string]any
+		if err := json.Unmarshal(reply.Body.Bytes(), &body); err != nil {
+			t.Fatal(err)
+		}
+		return body["profile_limits"]
+	}
+	deps := requestDeps(fixtureRequests())
+	if got := read(deps); got != false {
+		t.Errorf("without access groups: profile_limits = %v, want false", got)
+	}
+	deps.AdminAccessGroups = fixtureAdminAccessGroups()
+	if got := read(deps); got != true {
+		t.Errorf("with access groups: profile_limits = %v, want true", got)
+	}
+}
+
 func TestAdminAccessGroupPaginationAuthority(t *testing.T) {
 	f := fixtureAdminAccessGroups()
 	deps := requestDeps(fixtureRequests())
@@ -175,3 +226,32 @@ func TestAdminAccessGroupAuthenticationPolicy(t *testing.T) {
 		})
 	}
 }
+
+// A group's library list is an integer array no foreign key covers, so an id
+// no library carries is refused before the store, on create and update alike.
+func TestAdminAccessGroupRejectsUnknownLibraries(t *testing.T) {
+	f := fixtureAdminAccessGroups()
+	deps := requestDeps(fixtureRequests()) // knows libraries 1-4
+	deps.AdminAccessGroups = f
+	h := NewHandler(deps)
+	path := Prefix + "/admin/access-groups/7"
+	for _, rec := range []*httptest.ResponseRecorder{
+		do(t, h, http.MethodPost, Prefix+"/admin/access-groups", `{"name":"New","library_ids":["1","9"]}`, actingRequestAdmin),
+		do(t, h, http.MethodPut, path, `{"library_ids":["9"]}`, with(actingRequestAdmin, "If-Match", "*")),
+	} {
+		p := requireProblem(t, rec, TypeValidationFailed)
+		if len(p.Errors) != 1 || p.Errors[0].Location != locationLibraryIDs || p.Errors[0].Detail != "unknown library identifier: 9" {
+			t.Fatalf("errors = %+v", p.Errors)
+		}
+	}
+	// An editor opened before the library was deleted holds an old ETag: 412
+	// tells it to reload, rather than 422 for a library it no longer lists.
+	requireProblem(t, do(t, h, http.MethodPut, path, `{"library_ids":["9"]}`, with(actingRequestAdmin, "If-Match", `"stale"`)), TypePreconditionFailed)
+	if f.writes != 0 {
+		t.Fatal("unknown library reached the store")
+	}
+	saved := do(t, h, http.MethodPut, path, `{"library_ids":["2","1"]}`, with(actingRequestAdmin, "If-Match", "*"))
+	if saved.Code != 200 || f.last.LibraryIDs == nil || !slices.Equal(*f.last.LibraryIDs, []int{2, 1}) {
+		t.Fatal(saved.Code, saved.Body.String(), f.last.LibraryIDs)
+	}
+}
diff --git a/internal/apiv2/admin_accounts.go b/internal/apiv2/admin_accounts.go
index a73526b414..dd5a5ddaa2 100644
--- a/internal/apiv2/admin_accounts.go
+++ b/internal/apiv2/admin_accounts.go
@@ -57,6 +57,7 @@ type AdminAccountCapabilitiesOutputBody struct {
 	DefaultProfile       bool `json:"default_profile"`
 	ExactIdentityFilter  bool `json:"exact_identity_filter"`
 	AccessGroups         bool `json:"access_groups"`
+	ProfileLimits        bool `json:"profile_limits" doc:"Whether access groups and account policy overrides take max_profiles, the household profile limit; null on an account inherits its group's limit"`
 	PasswordResetLink    bool `json:"password_reset_link" doc:"Whether createAdminUserPasswordReset can return a link to share; needs the server's public URL"`
 	PasswordResetEmail   bool `json:"password_reset_email" doc:"Whether createAdminUserPasswordReset can email the link; needs the public URL and a configured mail server"`
 	OwnershipTransfer    bool `json:"ownership_transfer" doc:"Whether transferAdminUserOwnership can make another enabled admin the server Owner"`
@@ -76,6 +77,7 @@ type AdminAccountPolicyInput struct {
 	MaxTranscodes              *int    `json:"max_transcodes,omitempty" nullable:"true" minimum:"0"`
 	MaxRemoteStreamBitrateKbps *int    `json:"max_remote_stream_bitrate_kbps,omitempty" nullable:"true" minimum:"0"`
 	MaxLocalStreamBitrateKbps  *int    `json:"max_local_stream_bitrate_kbps,omitempty" nullable:"true" minimum:"0"`
+	MaxProfiles                *int    `json:"max_profiles,omitempty" nullable:"true" minimum:"1" doc:"Household profile limit override; null inherits the access group's limit"`
 	TranscodeAllowed           *bool   `json:"transcode_allowed,omitempty" nullable:"true"`
 	AudioTranscodeAllowed      *bool   `json:"audio_transcode_allowed,omitempty" nullable:"true"`
 	DownloadAllowed            *bool   `json:"download_allowed,omitempty" nullable:"true"`
@@ -91,7 +93,6 @@ type AdminAccountCreateBody struct {
 	RequirePasswordChange bool         `json:"require_password_change,omitempty" doc:"Make password temporary: the account must choose a new one at its first sign-in before it can do anything else"`
 	Role                  string       `json:"role" enum:"admin,user"`
 	Permissions           []Permission `json:"permissions,omitempty"`
-	MaxProfiles           *int         `json:"max_profiles,omitempty" minimum:"1"`
 	CreateDefaultProfile  bool         `json:"create_default_profile"`
 	DefaultProfileName    string       `json:"default_profile_name,omitempty" maxLength:"100"`
 }
@@ -103,7 +104,6 @@ type AdminAccountUpdateBody struct {
 	RequirePasswordChange *bool        `json:"require_password_change,omitempty" doc:"Only with password: make it temporary, so the account must choose a new one at its next sign-in before it can do anything else. A password sent without it is not temporary"`
 	Role                  *string      `json:"role,omitempty" enum:"admin,user"`
 	Permissions           []Permission `json:"permissions,omitempty"`
-	MaxProfiles           *int         `json:"max_profiles,omitempty" minimum:"1"`
 	Enabled               *bool        `json:"enabled,omitempty"`
 	BreakGlass            *bool        `json:"break_glass,omitempty" doc:"Make the admin account a break-glass account, which keeps local password sign-in while the server turns it off, or clear it. Only admins may hold it, and only the server Owner may set or clear it (403 permission_denied otherwise); clearing the last usable one while local password sign-in is off is 409 break_glass_required"`
 }
@@ -134,7 +134,7 @@ type AdminAccountProfilesOutput struct {
 	Body Collection[AdminAccountProfile]
 }
 
-var adminAccountNullable = map[string]bool{groupLibraryIDsField: true, "max_playback_quality": true, "max_streams": true, "max_transcodes": true, "max_remote_stream_bitrate_kbps": true, "max_local_stream_bitrate_kbps": true, "transcode_allowed": true, "audio_transcode_allowed": true, "download_allowed": true, "download_transcode_allowed": true, "requests_allowed": true, "access_group_id": true}
+var adminAccountNullable = map[string]bool{groupLibraryIDsField: true, "max_playback_quality": true, "max_streams": true, "max_transcodes": true, "max_remote_stream_bitrate_kbps": true, "max_local_stream_bitrate_kbps": true, "max_profiles": true, "transcode_allowed": true, "audio_transcode_allowed": true, "download_allowed": true, "download_transcode_allowed": true, "requests_allowed": true, "access_group_id": true}
 
 func adminAccountID(id ID) (int, *Problem) {
 	n, err := strconv.Atoi(string(id))
@@ -231,6 +231,7 @@ func (b AdminAccountPolicyInput) model(raw []byte) (models.UpdateUserInput, *Pro
 		MaxTranscodes:              models.Optional[int]{Set: present("max_transcodes"), Value: b.MaxTranscodes},
 		MaxRemoteStreamBitrateKbps: models.Optional[int]{Set: present("max_remote_stream_bitrate_kbps"), Value: b.MaxRemoteStreamBitrateKbps},
 		MaxLocalStreamBitrateKbps:  models.Optional[int]{Set: present("max_local_stream_bitrate_kbps"), Value: b.MaxLocalStreamBitrateKbps},
+		MaxProfiles:                models.Optional[int]{Set: present("max_profiles"), Value: b.MaxProfiles},
 		TranscodeAllowed:           models.Optional[bool]{Set: present("transcode_allowed"), Value: b.TranscodeAllowed},
 		AudioTranscodeAllowed:      models.Optional[bool]{Set: present("audio_transcode_allowed"), Value: b.AudioTranscodeAllowed},
 		DownloadAllowed:            models.Optional[bool]{Set: present("download_allowed"), Value: b.DownloadAllowed},
@@ -248,6 +249,7 @@ func registerAdminAccounts(reg *Registry) {
 			out.Body.OwnershipTransfer = out.Body.Available
 		}
 		out.Body.AccessGroups = reg.deps.AdminAccessGroups != nil
+		out.Body.ProfileLimits = out.Body.AccessGroups
 		out.Body.ExactIdentityFilter = reg.deps.AdminUsers != nil
 		out.Body.AccountDevices = reg.deps.AdminAccountDevices != nil
 		out.Body.LoginSessions = reg.deps.AdminLoginSessions != nil && reg.deps.AdminLoginSessions.AdminLoginSessionsAvailable()
@@ -379,7 +381,7 @@ func (reg *Registry) createAdminAccount(ctx context.Context, in *AdminAccountCre
 	if p != nil {
 		return nil, p
 	}
-	if p = reg.rejectUnknownLibraries(ctx, policy.LibraryIDs.Value); p != nil {
+	if p = reg.rejectUnknownLibraries(ctx, policy.LibraryIDs.Value, locationLibraryIDs); p != nil {
 		return nil, p
 	}
 	b := in.Body
@@ -417,7 +419,7 @@ func (reg *Registry) updateAdminAccount(ctx context.Context, in *AdminAccountUpd
 	if p != nil {
 		return nil, p
 	}
-	if p = reg.rejectUnknownLibraries(ctx, input.LibraryIDs.Value); p != nil {
+	if p = reg.rejectUnknownLibraries(ctx, input.LibraryIDs.Value, locationLibraryIDs); p != nil {
 		return nil, p
 	}
 	b := in.Body
@@ -437,7 +439,6 @@ func (reg *Registry) updateAdminAccount(ctx context.Context, in *AdminAccountUpd
 	input.Role = b.Role
 	input.Enabled = b.Enabled
 	input.BreakGlass = b.BreakGlass
-	input.MaxProfiles = b.MaxProfiles
 	var members map[string]json.RawMessage
 	_ = json.Unmarshal(in.RawBody, &members)
 	if _, ok := members["permissions"]; ok {
diff --git a/internal/apiv2/admin_accounts_test.go b/internal/apiv2/admin_accounts_test.go
index bf0114eb5f..af0ecfb5eb 100644
--- a/internal/apiv2/admin_accounts_test.go
+++ b/internal/apiv2/admin_accounts_test.go
@@ -26,7 +26,7 @@ type fakeAdminAccounts struct {
 }
 
 func fixtureAdminAccounts() *fakeAdminAccounts {
-	return &fakeAdminAccounts{snapshot: handlers.AdminAccountView{User: handlers.AdminUserView{ID: 7, Username: "sample", Email: "sample@example.test", Role: "user", Enabled: true, MaxProfiles: 5, CreatedAt: fixedTime(), UpdatedAt: fixedTime()}, Revision: 10, GroupRevision: 3}}
+	return &fakeAdminAccounts{snapshot: handlers.AdminAccountView{User: handlers.AdminUserView{ID: 7, Username: "sample", Email: "sample@example.test", Role: "user", Enabled: true, MaxProfiles: 5, EffectivePolicy: handlers.EffectivePolicyView{MaxProfiles: 5}, CreatedAt: fixedTime(), UpdatedAt: fixedTime()}, Revision: 10, GroupRevision: 3}}
 }
 func (*fakeAdminAccounts) AdminAccountCapabilities() (bool, bool) { return true, true }
 func (f *fakeAdminAccounts) GetAdminAccount(context.Context, int) (handlers.AdminAccountView, error) {
@@ -185,6 +185,11 @@ func TestAdminAccountCreateAndErrors(t *testing.T) {
 	if f.create.DefaultProfile.Enabled || f.create.User.LibraryIDs == nil || f.create.User.DownloadAllowed == nil || *f.create.User.DownloadAllowed {
 		t.Fatalf("creation lost explicit values: %+v", f.create)
 	}
+	// An unknown library is named at the member the account body sends.
+	unknown := requireProblem(t, do(t, h, http.MethodPost, path, strings.Replace(body, `"library_ids":[]`, `"library_ids":["9"]`, 1), actingRequestAdmin), TypeValidationFailed)
+	if len(unknown.Errors) != 1 || unknown.Errors[0].Location != locationLibraryIDs {
+		t.Fatalf("unknown library errors = %+v", unknown.Errors)
+	}
 	f.err = auth.ErrDuplicate
 	requireProblem(t, do(t, h, http.MethodPost, path, body, actingRequestAdmin), TypeConflict)
 	f.err = errors.New("storage down")
diff --git a/internal/apiv2/admin_catalog_images.go b/internal/apiv2/admin_catalog_images.go
index 207e648e8e..425e3b5d4e 100644
--- a/internal/apiv2/admin_catalog_images.go
+++ b/internal/apiv2/admin_catalog_images.go
@@ -11,6 +11,7 @@ import (
 	"strings"
 
 	"github.com/prairie-server/prairie-server/internal/api/handlers"
+	"github.com/prairie-server/prairie-server/internal/metadata"
 )
 
 type AdminCatalogImagesService interface {
@@ -86,9 +87,21 @@ func registerAdminCatalogImages(reg *Registry) {
 			}
 			choices = append(choices, choice{string(raw), row})
 		}
-		// Keep the metadata service's rating-first presentation. The stable
-		// identity breaks ties without letting expiring display URLs affect pages.
+		// Local sidecar artwork leads in discovery order, which puts the file a
+		// refresh would pick first. Provider choices follow, highest rated
+		// first; the stable identity breaks their ties without letting expiring
+		// display URLs affect pages.
 		slices.SortStableFunc(choices, func(a, b choice) int {
+			aLocal := a.row.ProviderID == metadata.LocalImageProviderID
+			bLocal := b.row.ProviderID == metadata.LocalImageProviderID
+			switch {
+			case aLocal && bLocal:
+				return 0
+			case aLocal:
+				return -1
+			case bLocal:
+				return 1
+			}
 			if order := cmp.Compare(b.row.Rating, a.row.Rating); order != 0 {
 				return order
 			}
diff --git a/internal/apiv2/admin_catalog_images_test.go b/internal/apiv2/admin_catalog_images_test.go
index 3ee91bcfb6..a22c859620 100644
--- a/internal/apiv2/admin_catalog_images_test.go
+++ b/internal/apiv2/admin_catalog_images_test.go
@@ -3,10 +3,12 @@ package apiv2
 import (
 	"context"
 	"encoding/json"
+	"slices"
 	"strings"
 	"testing"
 
 	"github.com/prairie-server/prairie-server/internal/api/handlers"
+	"github.com/prairie-server/prairie-server/internal/metadata"
 )
 
 type fakeAdminImages struct {
@@ -24,6 +26,29 @@ func (f *fakeAdminImages) ApplyAdminItemImage(_ context.Context, id string, r ha
 	f.request = r
 	return handlers.AdminItemImageResult{ContentID: id, StoredPath: "immutable-artwork", Revision: "revision", Thumbhash: "hash"}, nil
 }
+func TestAdminImageListLeadsWithLocalArtwork(t *testing.T) {
+	deps := pilotDeps(nil, nil)
+	deps.AdminCatalogImages = &fakeAdminImages{rows: []handlers.AdminImageEntryView{
+		{ProviderID: "tvdb", OriginalURL: "unrated", Type: "poster"},
+		{ProviderID: "tmdb", OriginalURL: "rated", Type: "poster", Rating: 9},
+		{ProviderID: metadata.LocalImageProviderID, OriginalURL: "file:///fanart.jpg", Type: "backdrop"},
+		{ProviderID: metadata.LocalImageProviderID, OriginalURL: "file:///backdrop1.jpg", Type: "backdrop"},
+	}}
+	rec := do(t, newTestHandler(t, deps), "GET", Prefix+"/admin/items/item-1/images", "", bearer(adminToken))
+	var page AdminImagesPage
+	if err := json.Unmarshal(rec.Body.Bytes(), &page); err != nil {
+		t.Fatal(err)
+	}
+	var got []string
+	for _, row := range page.Items {
+		got = append(got, row.OriginalURL)
+	}
+	// Local choices keep discovery order rather than sorting by path.
+	if want := []string{"file:///fanart.jpg", "file:///backdrop1.jpg", "rated", "unrated"}; !slices.Equal(got, want) {
+		t.Fatalf("order %v, want %v", got, want)
+	}
+}
+
 func TestAdminImagePagesAndApply(t *testing.T) {
 	deps := pilotDeps(nil, nil)
 	f := &fakeAdminImages{rows: []handlers.AdminImageEntryView{{ProviderID: "p", OriginalURL: "b", URL: "display-b", Type: "poster", Rating: 9}, {ProviderID: "p", OriginalURL: "a", URL: "display-a", Type: "poster", Rating: 1}}}
diff --git a/internal/apiv2/admin_catalog_translation.go b/internal/apiv2/admin_catalog_translation.go
index c16a4b4f57..0219e462d4 100644
--- a/internal/apiv2/admin_catalog_translation.go
+++ b/internal/apiv2/admin_catalog_translation.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"net/http"
 	"net/url"
+	"strconv"
 
 	"github.com/prairie-server/prairie-server/internal/api/handlers"
 	"github.com/prairie-server/prairie-server/internal/metadata/translation"
@@ -14,13 +15,35 @@ type AdminMetadataTranslationService interface {
 	TranslateAdminMetadata(context.Context, string, handlers.TranslateMetadataRequest, int) (*translation.Job, error)
 	ListAdminMetadataTranslationJobs(context.Context, string) ([]translation.Job, error)
 	CancelAdminMetadataTranslation(context.Context, string, int64) error
+	TranslateLibraryMetadata(context.Context, int, string, int) (*translation.Job, error)
+	ListLibraryMetadataTranslationJobs(context.Context, int) ([]translation.Job, error)
+	CancelLibraryMetadataTranslation(context.Context, int, int64) error
+}
+
+// AdminTranslateLibraryInput starts a library prewarm.
+type AdminTranslateLibraryInput struct {
+	ID   ID `path:"library_id" doc:"The library" example:"1"`
+	Body struct {
+		TargetLanguage string `json:"target_language" minLength:"1" maxLength:"16" doc:"BCP 47 tag of the language to fill in" example:"de"`
+	}
+}
+
+// AdminLibraryTranslationJobsInput names the library whose prewarm jobs to list.
+type AdminLibraryTranslationJobsInput struct {
+	ID ID `path:"library_id" doc:"The library" example:"1"`
+}
+
+// AdminLibraryTranslationCancelInput names a library prewarm job.
+type AdminLibraryTranslationCancelInput struct {
+	ID    ID `path:"library_id" doc:"The library" example:"1"`
+	JobID ID `path:"job_id"`
 }
 type AdminTranslateMetadataInput struct {
 	ID   string `path:"id" minLength:"1" maxLength:"512"`
 	Body struct {
 		TargetLanguage  string `json:"target_language" minLength:"1" maxLength:"16"`
 		IncludeChildren *bool  `json:"include_children,omitempty" nullable:"true" doc:"Defaults true for item targets; ignored for season and episode targets."`
-		Force           bool   `json:"force,omitempty"`
+		Force           bool   `json:"force,omitempty" doc:"Also replace text an earlier AI translation wrote. Provider and manual text is never replaced."`
 	}
 }
 type AdminTranslationItemInput struct {
@@ -54,6 +77,21 @@ func registerAdminCatalogTranslation(reg *Registry) {
 	cancel := op(http.MethodPost, "/jobs/{job_id}/cancel", "cancelAdminMetadataTranslation", "Request cancellation only for a job belonging to the authorized item.")
 	cancel.DefaultStatus = http.StatusNoContent
 	Register(reg, cancel, reg.cancelAdminMetadataTranslation)
+
+	libraryOp := func(method, suffix, id, summary string) Operation {
+		o := Operation{Operation: humaOp(method, Prefix+"/admin/libraries/{library_id}/metadata-translation"+suffix, id, "admin-catalog", summary), Class: ClassActingAdmin, ServiceBacked: true, DemoRestricted: isMutatingMethod(method)}
+		if method != http.MethodGet {
+			o.RetrySafety = RetrySafetyNonRetryable
+		}
+		return o
+	}
+	startLibrary := libraryOp(http.MethodPost, "", "translateLibraryMetadata", "Prewarm a library: persist or reuse an active job that translates the missing descriptions of every item in the library, with their seasons and episodes, into a language. Existing provider, manual and AI text is kept. Progress counts items.")
+	startLibrary.DefaultStatus = http.StatusAccepted
+	Register(reg, startLibrary, reg.translateLibraryMetadata)
+	Register(reg, libraryOp(http.MethodGet, "/jobs", "listLibraryMetadataTranslationJobs", "Read the latest 50 prewarm jobs of a library."), reg.listLibraryMetadataTranslationJobs)
+	cancelLibrary := libraryOp(http.MethodPost, "/jobs/{job_id}/cancel", "cancelLibraryMetadataTranslation", "Request cancellation only for a prewarm job of the library.")
+	cancelLibrary.DefaultStatus = http.StatusNoContent
+	Register(reg, cancelLibrary, reg.cancelLibraryMetadataTranslation)
 }
 func (reg *Registry) translateAdminItemMetadata(ctx context.Context, in *AdminTranslateMetadataInput) (*AdminMetadataTranslationAcceptedOutput, error) {
 	if reg.deps.AdminMetadataTranslation == nil {
@@ -93,3 +131,55 @@ func (reg *Registry) cancelAdminMetadataTranslation(ctx context.Context, in *Adm
 	}
 	return nil, nil
 }
+
+func (reg *Registry) translateLibraryMetadata(ctx context.Context, in *AdminTranslateLibraryInput) (*AdminMetadataTranslationAcceptedOutput, error) {
+	if reg.deps.AdminMetadataTranslation == nil {
+		return nil, unavailable("metadata translation")
+	}
+	id, p := libraryID(in.ID)
+	if p != nil {
+		return nil, p
+	}
+	job, err := reg.deps.AdminMetadataTranslation.TranslateLibraryMetadata(ctx, id, in.Body.TargetLanguage, claimsFrom(ctx).UserID)
+	if err != nil {
+		return nil, collectionProblem(err)
+	}
+	return &AdminMetadataTranslationAcceptedOutput{Location: Prefix + "/admin/libraries/" + strconv.Itoa(id) + "/metadata-translation/jobs", Body: translationJobOf(job)}, nil
+}
+
+func (reg *Registry) listLibraryMetadataTranslationJobs(ctx context.Context, in *AdminLibraryTranslationJobsInput) (*AdminMetadataTranslationJobsOutput, error) {
+	if reg.deps.AdminMetadataTranslation == nil {
+		return nil, unavailable("metadata translation")
+	}
+	id, p := libraryID(in.ID)
+	if p != nil {
+		return nil, p
+	}
+	jobs, err := reg.deps.AdminMetadataTranslation.ListLibraryMetadataTranslationJobs(ctx, id)
+	if err != nil {
+		return nil, collectionProblem(err)
+	}
+	out := &AdminMetadataTranslationJobsOutput{Body: AdminMetadataTranslationJobs{Jobs: make([]MetadataTranslationJob, 0, len(jobs))}}
+	for i := range jobs {
+		out.Body.Jobs = append(out.Body.Jobs, translationJobOf(&jobs[i]))
+	}
+	return out, nil
+}
+
+func (reg *Registry) cancelLibraryMetadataTranslation(ctx context.Context, in *AdminLibraryTranslationCancelInput) (*struct{}, error) {
+	if reg.deps.AdminMetadataTranslation == nil {
+		return nil, unavailable("metadata translation")
+	}
+	id, p := libraryID(in.ID)
+	if p != nil {
+		return nil, p
+	}
+	jobID, p := in.JobID.positive("path.job_id")
+	if p != nil {
+		return nil, p
+	}
+	if err := reg.deps.AdminMetadataTranslation.CancelLibraryMetadataTranslation(ctx, id, int64(jobID)); err != nil {
+		return nil, collectionProblem(err)
+	}
+	return nil, nil
+}
diff --git a/internal/apiv2/admin_catalog_translation_test.go b/internal/apiv2/admin_catalog_translation_test.go
index 1812d3c159..634c0f2da6 100644
--- a/internal/apiv2/admin_catalog_translation_test.go
+++ b/internal/apiv2/admin_catalog_translation_test.go
@@ -18,6 +18,8 @@ type fakeAdminTranslation struct {
 	content       string
 	jobID         int64
 	request       handlers.TranslateMetadataRequest
+	libraryID     int
+	language      string
 }
 
 func (f *fakeAdminTranslation) TranslateAdminMetadata(_ context.Context, id string, req handlers.TranslateMetadataRequest, userID int) (*translation.Job, error) {
@@ -35,6 +37,21 @@ func (f *fakeAdminTranslation) CancelAdminMetadataTranslation(_ context.Context,
 	f.content, f.jobID = id, jobID
 	return nil
 }
+func (f *fakeAdminTranslation) TranslateLibraryMetadata(_ context.Context, libraryID int, language string, userID int) (*translation.Job, error) {
+	f.calls++
+	f.libraryID, f.language, f.userID = libraryID, language, userID
+	return &translation.Job{ID: 9, TargetKind: translation.TargetLibrary, ContentID: translation.LibraryContentID(libraryID), TargetLanguage: language, IncludeChildren: true, CreatedAt: fixedTime(), UpdatedAt: fixedTime()}, nil
+}
+func (f *fakeAdminTranslation) ListLibraryMetadataTranslationJobs(_ context.Context, libraryID int) ([]translation.Job, error) {
+	f.calls++
+	f.libraryID = libraryID
+	return nil, nil
+}
+func (f *fakeAdminTranslation) CancelLibraryMetadataTranslation(_ context.Context, libraryID int, jobID int64) error {
+	f.calls++
+	f.libraryID, f.jobID = libraryID, jobID
+	return nil
+}
 func adminTranslationGate(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if chi.URLParam(r, "id") != "item-1" {
@@ -89,3 +106,41 @@ func adminCatalogTranslationFixtureCases() []fixtureCase {
 		{name: "admin_metadata_translation_cancel", operationID: "cancelAdminMetadataTranslation", method: "POST", path: path + "/jobs/7/cancel", headers: bearer(memberToken), status: 204, scenario: "Cancellation binds both authorized content and exact job identity."},
 	}
 }
+
+func TestAdminLibraryTranslationIsAdminOnly(t *testing.T) {
+	deps := pilotDeps(nil, nil)
+	f := &fakeAdminTranslation{}
+	deps.AdminMetadataTranslation = f
+	h := newTestHandler(t, deps)
+	path := Prefix + "/admin/libraries/3/metadata-translation"
+
+	rec := do(t, h, "POST", path, `{"target_language":"de"}`, bearer(adminToken))
+	if rec.Code != 202 || f.libraryID != 3 || f.language != "de" || rec.Header().Get("Location") != path+"/jobs" ||
+		!strings.Contains(rec.Body.String(), `"target_kind":"library"`) {
+		t.Fatalf("enqueue: %d %s %#v", rec.Code, rec.Body, f)
+	}
+	rec = do(t, h, "GET", path+"/jobs", "", bearer(adminToken))
+	if rec.Code != 200 || !strings.Contains(rec.Body.String(), `"jobs":[]`) {
+		t.Fatalf("jobs: %d %s", rec.Code, rec.Body)
+	}
+	rec = do(t, h, "POST", path+"/jobs/9/cancel", "", bearer(adminToken))
+	if rec.Code != 204 || f.jobID != 9 || f.libraryID != 3 {
+		t.Fatalf("cancel: %d %s %#v", rec.Code, rec.Body, f)
+	}
+
+	before := f.calls
+	for _, tc := range []struct{ method, path, body string }{{"POST", "", `{"target_language":"de"}`}, {"GET", "/jobs", ""}, {"POST", "/jobs/9/cancel", ""}} {
+		rec = do(t, h, tc.method, path+tc.path, tc.body, bearer(memberToken))
+		if rec.Code != 403 || f.calls != before {
+			t.Fatalf("member reached library prewarm: %s %s %d calls=%d", tc.method, tc.path, rec.Code, f.calls)
+		}
+	}
+	rec = do(t, h, "POST", path, `{"target_language":""}`, bearer(adminToken))
+	if rec.Code != 422 || f.calls != before {
+		t.Fatalf("invalid reached service: %d", rec.Code)
+	}
+	rec = do(t, h, "POST", Prefix+"/admin/libraries/0/metadata-translation", `{"target_language":"de"}`, bearer(adminToken))
+	if rec.Code != 404 || f.calls != before {
+		t.Fatalf("bad library id: %d", rec.Code)
+	}
+}
diff --git a/internal/apiv2/admin_collection_extras.go b/internal/apiv2/admin_collection_extras.go
index 859f5ee3cc..d22ea7b79c 100644
--- a/internal/apiv2/admin_collection_extras.go
+++ b/internal/apiv2/admin_collection_extras.go
@@ -24,7 +24,6 @@ type AdminCollectionExtrasService interface {
 	ImportAdminMDBList(context.Context, handlers.AdminCollectionImportMDBList) (handlers.AdminCollectionImportResult, error)
 	ImportAdminTMDB(context.Context, handlers.AdminCollectionImportTMDB) (handlers.AdminCollectionImportResult, error)
 	ImportAdminTMDBList(context.Context, handlers.AdminCollectionImportTMDBList) (handlers.AdminCollectionImportResult, error)
-	ImportAdminTrakt(context.Context, handlers.AdminCollectionImportTrakt) (handlers.AdminCollectionImportResult, error)
 	ListAdminCollectionTemplates(context.Context) ([]templates.BundleWithTemplates, error)
 	AdminCollectionTemplateCatalog(context.Context) templates.Catalog
 	ApplyAdminCollectionTemplate(context.Context, string, handlers.AdminCollectionTemplateApply) (handlers.AdminCollectionTemplateResult, error)
@@ -78,10 +77,6 @@ type AdminTMDBListInput struct {
 	Body    AdminTMDBListImport
 	RawBody []byte
 }
-type AdminTraktInput struct {
-	Body    AdminTraktImport
-	RawBody []byte
-}
 type AdminCollectionImportOutput struct {
 	Location string `header:"Location"`
 	Body     AdminCollectionImportResult
@@ -177,9 +172,6 @@ func registerAdminCollectionExtras(reg *Registry) {
 	tmdbList := adminCollectionOperation(http.MethodPost, "/admin/collections/import/tmdb-list", "importAdminTMDBList", "Import a public TMDB list as a collection.", false)
 	tmdbList.DefaultStatus = http.StatusCreated
 	Register(reg, tmdbList, reg.importAdminTMDBList)
-	trakt := adminCollectionOperation(http.MethodPost, "/admin/collections/import/trakt", "importAdminTrakt", "Import a Trakt collection.", false)
-	trakt.DefaultStatus = http.StatusCreated
-	Register(reg, trakt, reg.importAdminTrakt)
 	Register(reg, adminCollectionOperation(http.MethodGet, "/admin/collections/templates", "listAdminCollectionTemplates", "List the collection templates with an mdblist, tmdb or tmdb_list source.", false), func(ctx context.Context, _ *struct{}) (*AdminTemplateCatalogOutput, error) {
 		s, p := reg.adminCollectionExtras()
 		if p != nil {
@@ -386,25 +378,6 @@ func (reg *Registry) importAdminTMDBList(ctx context.Context, in *AdminTMDBListI
 	}
 	return adminImportOutput(v), nil
 }
-func (reg *Registry) importAdminTrakt(ctx context.Context, in *AdminTraktInput) (*AdminCollectionImportOutput, error) {
-
-	if p := rejectNonNullableNulls(in.RawBody, nil); p != nil {
-		return nil, p
-	}
-	s, p := reg.adminCollectionExtras()
-	if p != nil {
-		return nil, p
-	}
-	cmd, p := in.Body.command()
-	if p != nil {
-		return nil, p
-	}
-	v, e := s.ImportAdminTrakt(ctx, cmd)
-	if e != nil {
-		return nil, adminCollectionError(e)
-	}
-	return adminImportOutput(v), nil
-}
 func (reg *Registry) applyAdminTemplate(ctx context.Context, in *AdminTemplateInput) (*AdminTemplateOutput, error) {
 
 	if p := rejectNonNullableNulls(in.RawBody, nil); p != nil {
diff --git a/internal/apiv2/admin_collection_types.go b/internal/apiv2/admin_collection_types.go
index 6d256b08e3..d40f7d40fa 100644
--- a/internal/apiv2/admin_collection_types.go
+++ b/internal/apiv2/admin_collection_types.go
@@ -150,25 +150,6 @@ type AdminTMDBListImport struct {
 	ManagementKey    string          `json:"management_key,omitempty"`
 }
 
-type AdminTraktImport struct {
-	SortConfig       json.RawMessage `json:"sort_config,omitempty"`
-	LibraryID        ID              `json:"library_id,omitempty"`
-	LibraryIDs       []ID            `json:"library_ids,omitempty" maxItems:"1000"`
-	Title            string          `json:"title" minLength:"1"`
-	Description      string          `json:"description,omitempty"`
-	Preset           string          `json:"preset,omitempty"`
-	MediaType        string          `json:"media_type,omitempty"`
-	ProfileID        ID              `json:"profile_id,omitempty"`
-	ListURL          string          `json:"list_url,omitempty"`
-	Limit            *int            `json:"limit,omitempty" nullable:"false"`
-	Featured         bool            `json:"featured,omitempty"`
-	PosterURL        string          `json:"poster_url,omitempty"`
-	SyncSchedule     string          `json:"sync_schedule,omitempty"`
-	ManagementMode   string          `json:"management_mode,omitempty"`
-	ManagementSource string          `json:"management_source,omitempty"`
-	ManagementKey    string          `json:"management_key,omitempty"`
-}
-
 type AdminTemplateApply struct {
 	LibraryIDs     []ID                   `json:"library_ids" minItems:"1" maxItems:"1000"`
 	DryRun         bool                   `json:"dry_run,omitempty"`
@@ -363,26 +344,6 @@ func (v AdminTMDBListImport) command() (handlers.AdminCollectionImportTMDBList,
 	c.ManagementMode, c.ManagementSource, c.ManagementKey = v.ManagementMode, v.ManagementSource, v.ManagementKey
 	return c, nil
 }
-func (v AdminTraktImport) command() (handlers.AdminCollectionImportTrakt, *Problem) {
-	var c handlers.AdminCollectionImportTrakt
-	ids, p := intsOfIDs(v.LibraryIDs, "library_ids")
-	if p != nil {
-		return c, p
-	}
-	var libraryID int
-	if v.LibraryID != "" {
-		lowered, p := intsOfIDs([]ID{v.LibraryID}, "library_id")
-		if p != nil {
-			return c, p
-		}
-		libraryID = lowered[0]
-	}
-	c.LibraryID, c.LibraryIDs, c.Title, c.Description = libraryID, ids, v.Title, v.Description
-	c.Preset, c.MediaType, c.ProfileID, c.ListURL, c.Limit = v.Preset, v.MediaType, string(v.ProfileID), v.ListURL, v.Limit
-	c.SortConfig, c.Featured, c.PosterURL, c.SyncSchedule = v.SortConfig, v.Featured, v.PosterURL, v.SyncSchedule
-	c.ManagementMode, c.ManagementSource, c.ManagementKey = v.ManagementMode, v.ManagementSource, v.ManagementKey
-	return c, nil
-}
 func (v AdminTemplateApply) command() (handlers.AdminCollectionTemplateApply, *Problem) {
 	var c handlers.AdminCollectionTemplateApply
 	ids, p := intsOfIDs(v.LibraryIDs, "library_ids")
diff --git a/internal/apiv2/admin_dashboard_capabilities.go b/internal/apiv2/admin_dashboard_capabilities.go
index 5fbd2e22dd..80d283e2bb 100644
--- a/internal/apiv2/admin_dashboard_capabilities.go
+++ b/internal/apiv2/admin_dashboard_capabilities.go
@@ -14,6 +14,9 @@ type AdminDashboardCapabilities struct {
 	LogLevelList     bool `json:"log_level_list"`
 	WatchProviders   bool `json:"watch_providers"`
 	DownloadsStats   bool `json:"downloads_stats"`
+	// EgressTotals reports that GET /admin/stats/timeseries carries the
+	// window's egress_bytes and download_egress_bytes totals.
+	EgressTotals bool `json:"egress_totals"`
 }
 type AdminDashboardCapabilitiesOutput struct {
 	Status       int
@@ -26,7 +29,7 @@ func registerAdminDashboardCapabilities(reg *Registry) {
 	op := Operation{Operation: humaOp("GET", Prefix+"/admin/dashboard/capabilities", "getAdminDashboardCapabilities", "admin-observability", "Discover dashboard features supported by v2 in this build. Support does not promise dependency readiness; layout storage is not yet available on v2."), Class: ClassActingAdmin}
 	Register(reg, op, func(context.Context, *CapabilityInput) (*AdminDashboardCapabilitiesOutput, error) {
 		return &AdminDashboardCapabilitiesOutput{Body: AdminDashboardCapabilities{
-			Timeseries: true, PlaybackActivity: true, TopActivity: true, Health: true, WatchProviders: true, DownloadsStats: true, LogLevelList: true,
+			Timeseries: true, PlaybackActivity: true, TopActivity: true, Health: true, WatchProviders: true, DownloadsStats: true, LogLevelList: true, EgressTotals: true,
 		}}, nil
 	})
 }
diff --git a/internal/apiv2/admin_dashboard_capabilities_test.go b/internal/apiv2/admin_dashboard_capabilities_test.go
index 9ff86a99a4..4079f3b380 100644
--- a/internal/apiv2/admin_dashboard_capabilities_test.go
+++ b/internal/apiv2/admin_dashboard_capabilities_test.go
@@ -19,7 +19,7 @@ func TestAdminDashboardCapabilities(t *testing.T) {
 	if err := json.Unmarshal(rec.Body.Bytes(), &got); err != nil {
 		t.Fatal(err)
 	}
-	expected := map[string]any{"server_layouts": false, "timeseries": true, "playback_activity": true, "top_activity": true, "health": true, "log_level_list": true, "watch_providers": true, "downloads_stats": true}
+	expected := map[string]any{"server_layouts": false, "timeseries": true, "playback_activity": true, "top_activity": true, "health": true, "log_level_list": true, "watch_providers": true, "downloads_stats": true, "egress_totals": true}
 	if len(got) != len(expected)+3 {
 		t.Fatal(got)
 	}
diff --git a/internal/apiv2/admin_dashboard_insights.go b/internal/apiv2/admin_dashboard_insights.go
index ed65337f3c..3be0aeda1f 100644
--- a/internal/apiv2/admin_dashboard_insights.go
+++ b/internal/apiv2/admin_dashboard_insights.go
@@ -36,11 +36,13 @@ type AdminDashboardTimeseriesPoint struct {
 	DownloadEgressKbps int64   `json:"download_egress_kbps"`
 }
 type AdminDashboardTimeseries struct {
-	ResolutionSeconds int                             `json:"resolution_seconds"`
-	From              Instant                         `json:"from"`
-	To                Instant                         `json:"to"`
-	OldestSampleAt    NullableInstant                 `json:"oldest_sample_at"`
-	Points            []AdminDashboardTimeseriesPoint `json:"points"`
+	ResolutionSeconds   int                             `json:"resolution_seconds"`
+	From                Instant                         `json:"from"`
+	To                  Instant                         `json:"to"`
+	OldestSampleAt      NullableInstant                 `json:"oldest_sample_at"`
+	EgressBytes         int64                           `json:"egress_bytes"`
+	DownloadEgressBytes int64                           `json:"download_egress_bytes"`
+	Points              []AdminDashboardTimeseriesPoint `json:"points"`
 }
 type AdminDashboardTimeseriesOutput struct{ Body AdminDashboardTimeseries }
 type AdminDashboardPlaybackBucket struct {
@@ -111,7 +113,7 @@ func registerAdminDashboardInsights(reg *Registry) {
 		if err != nil || s == nil {
 			return nil, adminDashboardInsightProblem(err)
 		}
-		body := AdminDashboardTimeseries{ResolutionSeconds: s.ResolutionSeconds, From: NewInstant(s.From), To: NewInstant(s.To), Points: make([]AdminDashboardTimeseriesPoint, 0, len(s.Points))}
+		body := AdminDashboardTimeseries{ResolutionSeconds: s.ResolutionSeconds, From: NewInstant(s.From), To: NewInstant(s.To), EgressBytes: s.EgressBytes, DownloadEgressBytes: s.DownloadEgressBytes, Points: make([]AdminDashboardTimeseriesPoint, 0, len(s.Points))}
 		if s.OldestSampleAt != nil {
 			body.OldestSampleAt = NullableInstant{Valid: true, Time: NewInstant(*s.OldestSampleAt)}
 		}
diff --git a/internal/apiv2/admin_dashboard_insights_test.go b/internal/apiv2/admin_dashboard_insights_test.go
index d48da9ea2e..9885f9cc8b 100644
--- a/internal/apiv2/admin_dashboard_insights_test.go
+++ b/internal/apiv2/admin_dashboard_insights_test.go
@@ -45,7 +45,7 @@ func (s *dashboardInsightsStub) ReadAdminDownloadsStats(_ context.Context, limit
 }
 func TestAdminDashboardInsights(t *testing.T) {
 	at := time.Date(2026, 9, 1, 1, 2, 3, 123456789, time.FixedZone("test", 3600))
-	s := &dashboardInsightsStub{series: &handlers.AdminTimeseries{ResolutionSeconds: 60, From: at, To: at.Add(time.Hour), Points: []handlers.AdminTimeseriesPoint{{T: at, EgressKbps: 50, DownloadEgressKbps: 20}}}}
+	s := &dashboardInsightsStub{series: &handlers.AdminTimeseries{ResolutionSeconds: 60, From: at, To: at.Add(time.Hour), EgressBytes: 412_500_000_000, DownloadEgressBytes: 37_800_000_000, Points: []handlers.AdminTimeseriesPoint{{T: at, EgressKbps: 50, DownloadEgressKbps: 20}}}}
 	deps := requestDeps(fixtureRequests())
 	deps.AdminDashboardInsights = s
 	h := NewHandler(deps)
@@ -56,7 +56,7 @@ func TestAdminDashboardInsights(t *testing.T) {
 	for _, tc := range []struct {
 		path      string
 		fragments []string
-	}{{"timeseries?hours=1&refresh=true", []string{`"from":"2026-09-01T00:02:03.123Z"`, `"oldest_sample_at":null`, `"download_egress_kbps":20`}}, {"playback-activity?hours=1&refresh=true", []string{`"hours":1`, `"buckets":[]`, `"profiles_active_24h":0`}}, {"top-activity?days=1&limit=2&refresh=true", []string{`"titles":[]`, `"user_id":"7"`, `"profile_id":"household-profile"`}}, {"downloads?limit=2&refresh=true", []string{`"active_downloads":3`, `"user_id":"7"`}}} {
+	}{{"timeseries?hours=1&refresh=true", []string{`"from":"2026-09-01T00:02:03.123Z"`, `"oldest_sample_at":null`, `"download_egress_kbps":20`, `"egress_bytes":412500000000`, `"download_egress_bytes":37800000000`}}, {"playback-activity?hours=1&refresh=true", []string{`"hours":1`, `"buckets":[]`, `"profiles_active_24h":0`}}, {"top-activity?days=1&limit=2&refresh=true", []string{`"titles":[]`, `"user_id":"7"`, `"profile_id":"household-profile"`}}, {"downloads?limit=2&refresh=true", []string{`"active_downloads":3`, `"user_id":"7"`}}} {
 		r := do(t, h, "GET", path+tc.path, "", actingRequestAdmin)
 		if r.Code != 200 || !s.refresh {
 			t.Fatal(tc.path, r.Code, r.Body.String(), s)
diff --git a/internal/apiv2/admin_jobs.go b/internal/apiv2/admin_jobs.go
index 0aa904e291..e3d42f3299 100644
--- a/internal/apiv2/admin_jobs.go
+++ b/internal/apiv2/admin_jobs.go
@@ -79,7 +79,7 @@ func adminJobOf(job *models.AdminJob) AdminJob {
 	if job.CancelRequested && !out.Terminal {
 		out.State = "canceling"
 	}
-	out.Cancelable = (job.JobType == adminjob.JobTypeLibraryRefresh || job.JobType == adminjob.JobTypeStorageTransition) && !out.Terminal
+	out.Cancelable = (job.JobType == adminjob.JobTypeLibraryRefresh || job.JobType == adminjob.JobTypeStorageTransition || job.JobType == adminjob.JobTypeImageCacheCleanup) && !out.Terminal
 	if job.JobType == adminjob.JobTypeLibraryRefresh && job.ProgressTotal > 0 && job.ProgressCurrent >= 0 && job.ProgressCurrent <= job.ProgressTotal {
 		out.Progress = &JobProgress{Current: job.ProgressCurrent, Total: job.ProgressTotal, Unit: "items"}
 	}
diff --git a/internal/apiv2/admin_notification_push.go b/internal/apiv2/admin_notification_push.go
index 27ff9dd839..2386ce8371 100644
--- a/internal/apiv2/admin_notification_push.go
+++ b/internal/apiv2/admin_notification_push.go
@@ -31,6 +31,7 @@ type AdminNotificationPushTestResult struct {
 	AttemptID      ID     `json:"attempt_id"`
 	PushDeviceID   ID     `json:"push_device_id"`
 	ServerDeviceID ID     `json:"server_device_id"`
+	DeliveryID     ID     `json:"delivery_id,omitempty" doc:"The target profile's newest notification, which the test push carried so the device shows its real text; absent when the profile has no notification and the device can show only generic text."`
 	Outcome        string `json:"outcome"`
 	RelayRequestID string `json:"relay_request_id,omitempty"`
 	UpstreamStatus *int   `json:"upstream_status,omitempty"`
@@ -49,7 +50,7 @@ func registerAdminNotificationPush(reg *Registry) {
 		{"apple", testAdminApplePushOperation, true},
 		{"fcm", testAdminAndroidPushOperation, false},
 	} {
-		op := Operation{Operation: humaOp(http.MethodPost, Prefix+"/admin/notifications/push/"+platform.path+"/test", platform.operation, "admin", "Dispatch one test push notification and report its current delivery outcome."), Class: ClassActingAdmin, DemoRestricted: true, ServiceBacked: true, RetrySafety: RetrySafetyNonRetryable}
+		op := Operation{Operation: humaOp(http.MethodPost, Prefix+"/admin/notifications/push/"+platform.path+"/test", platform.operation, "admin", "Dispatch one test push carrying the target profile's newest notification and report its current delivery outcome."), Class: ClassActingAdmin, DemoRestricted: true, ServiceBacked: true, RetrySafety: RetrySafetyNonRetryable}
 		Register(reg, op, func(ctx context.Context, in *AdminNotificationPushTestInput) (*AdminNotificationPushTestOutput, error) {
 			svc := reg.deps.AdminNotificationPush
 			if svc == nil {
@@ -72,7 +73,7 @@ func registerAdminNotificationPush(reg *Registry) {
 					return nil, serviceProblem(err)
 				}
 			}
-			return &AdminNotificationPushTestOutput{Body: AdminNotificationPushTestResult{AttemptID: ID(view.AttemptID), PushDeviceID: ID(view.PushDeviceID), ServerDeviceID: ID(view.ServerDeviceID), Outcome: view.Outcome, RelayRequestID: view.RelayRequestID, UpstreamStatus: view.UpstreamStatus, UpstreamReason: view.UpstreamReason, FailureMessage: view.FailureMessage}}, nil
+			return &AdminNotificationPushTestOutput{Body: AdminNotificationPushTestResult{AttemptID: ID(view.AttemptID), PushDeviceID: ID(view.PushDeviceID), ServerDeviceID: ID(view.ServerDeviceID), DeliveryID: ID(view.DeliveryID), Outcome: view.Outcome, RelayRequestID: view.RelayRequestID, UpstreamStatus: view.UpstreamStatus, UpstreamReason: view.UpstreamReason, FailureMessage: view.FailureMessage}}, nil
 		})
 	}
 }
diff --git a/internal/apiv2/admin_notification_push_test.go b/internal/apiv2/admin_notification_push_test.go
index e74777b68b..e2b6745d67 100644
--- a/internal/apiv2/admin_notification_push_test.go
+++ b/internal/apiv2/admin_notification_push_test.go
@@ -16,10 +16,18 @@ type fakeAdminNotificationPush struct {
 	err                       error
 }
 
+// fixtureNotifiedProfile is the one profile the fake reports a notification
+// for, standing in for a profile whose inbox is not empty.
+const fixtureNotifiedProfile = "notified-profile"
+
 func (f *fakeAdminNotificationPush) send(platform, profile, device string) (*notifications.ApplePushTestResult, error) {
 	f.calls++
 	f.platform, f.profile, f.device = platform, profile, device
-	return &notifications.ApplePushTestResult{AttemptID: "attempt-1", PushDeviceID: "device-1", ServerDeviceID: device, Outcome: "retrying", UpstreamStatus: new(503)}, f.err
+	result := &notifications.ApplePushTestResult{AttemptID: "attempt-1", PushDeviceID: "device-1", ServerDeviceID: device, Outcome: "retrying", UpstreamStatus: new(503)}
+	if profile == fixtureNotifiedProfile {
+		result.DeliveryID, result.Outcome, result.UpstreamStatus = "delivery-1", "delivered", new(200)
+	}
+	return result, f.err
 }
 func (f *fakeAdminNotificationPush) SendApplePushTest(_ context.Context, profile, device string) (*notifications.ApplePushTestResult, error) {
 	return f.send("apple", profile, device)
@@ -55,9 +63,13 @@ func TestAdminNotificationPushDispatch(t *testing.T) {
 			if err := json.Unmarshal(rec.Body.Bytes(), &result); err != nil {
 				t.Fatal(err)
 			}
-			if fake.calls != 1 || fake.platform != platform || fake.profile != "target-profile" || fake.device != "target-device" || result.Outcome != "retrying" || result.UpstreamStatus == nil || *result.UpstreamStatus != 503 {
+			if fake.calls != 1 || fake.platform != platform || fake.profile != "target-profile" || fake.device != "target-device" || result.Outcome != "retrying" || result.UpstreamStatus == nil || *result.UpstreamStatus != 503 || result.DeliveryID != "" {
 				t.Fatalf("dispatch/result mismatch: %+v %+v", fake, result)
 			}
+			rec = do(t, h, http.MethodPost, path, `{"profile_id":"`+fixtureNotifiedProfile+`"}`, bearer(adminToken))
+			if err := json.Unmarshal(rec.Body.Bytes(), &result); err != nil || rec.Code != 200 || result.DeliveryID != "delivery-1" {
+				t.Fatalf("notified profile: %d %s", rec.Code, rec.Body.String())
+			}
 			for _, tc := range []struct {
 				err    error
 				status int
@@ -88,3 +100,11 @@ func adminNotificationPushFixtureCases() []fixtureCase {
 		{name: "admin_android_push_test", operationID: testAdminAndroidPushOperation, method: "POST", path: Prefix + "/admin/notifications/push/fcm/test", body: `{"profile_id":"target-profile","server_device_id":"target-device"}`, headers: bearer(adminToken), status: 200, schema: "#/components/schemas/AdminNotificationPushTestResult", assertHeaders: []string{"Content-Type", "Cache-Control"}, scenario: "A synthetic Android test dispatch preserves its upstream status."},
 	}
 }
+
+// adminNotificationPushDeliveryFixtureCases are appended last so the request
+// ids of earlier fixtures stay put.
+func adminNotificationPushDeliveryFixtureCases() []fixtureCase {
+	return []fixtureCase{
+		{name: "admin_apple_push_test_notification", operationID: testAdminApplePushOperation, method: "POST", path: Prefix + "/admin/notifications/push/apple/test", body: `{"profile_id":"` + fixtureNotifiedProfile + `","server_device_id":"target-device"}`, headers: bearer(adminToken), status: 200, schema: "#/components/schemas/AdminNotificationPushTestResult", assertHeaders: []string{"Content-Type", "Cache-Control"}, scenario: "The test push carries the profile's newest notification and names it, so the device shows that notification's real text."},
+	}
+}
diff --git a/internal/apiv2/admin_plugin_installations.go b/internal/apiv2/admin_plugin_installations.go
index 5f87ece6a4..a453e788f6 100644
--- a/internal/apiv2/admin_plugin_installations.go
+++ b/internal/apiv2/admin_plugin_installations.go
@@ -133,9 +133,19 @@ type AdminPluginCapability struct {
 	// SignInMode, CallbackURL and PostLogoutRedirectURL describe an
 	// auth_provider.v1 capability whether or not a binding row exists yet,
 	// so the admin page can show a fresh installation's registration URLs.
-	SignInMode            string  `json:"sign_in_mode,omitempty" enum:"oauth,credentials,network" doc:"How an auth_provider.v1 capability signs people in: oauth (a provider button and browser handshake, such as OIDC), credentials (a username and password form, such as LDAP) or network (a network access plugin, such as Tailscale, that signs in the owner of the device a request came from; one network binding may be on beside the one oauth or credentials binding). Omitted for other capability types" example:"oauth"`
-	CallbackURL           *string `json:"callback_url,omitempty" doc:"On an installation's OAuth sign-in capability: the redirect URI to register at the provider, the v2 callback on the public URL (server.public_url). Empty while no public URL is configured; omitted for other capabilities and in the catalog" example:"https://silo.example.test/api/v2/auth/oauth/3/callback"`
-	PostLogoutRedirectURL *string `json:"post_logout_redirect_url,omitempty" doc:"On an installation's OAuth sign-in capability: the post-logout redirect URI to register at the provider for provider logout, the login page on the public URL. Empty while no public URL is configured; omitted for other capabilities and in the catalog" example:"https://silo.example.test/login"`
+	SignInMode            string                    `json:"sign_in_mode,omitempty" enum:"oauth,credentials,network" doc:"How an auth_provider.v1 capability signs people in: oauth (a provider button and browser handshake, such as OIDC), credentials (a username and password form, such as LDAP) or network (a network access plugin, such as Tailscale, that signs in the owner of the device a request came from; one network binding may be on beside the one oauth or credentials binding). Omitted for other capability types" example:"oauth"`
+	CallbackURL           *string                   `json:"callback_url,omitempty" doc:"On an installation's OAuth sign-in capability: the redirect URI to register at the provider, the v2 callback on the public URL (server.public_url). Empty while no public URL is configured; omitted for other capabilities and in the catalog" example:"https://silo.example.test/api/v2/auth/oauth/3/callback"`
+	PostLogoutRedirectURL *string                   `json:"post_logout_redirect_url,omitempty" doc:"On an installation's OAuth sign-in capability: the post-logout redirect URI to register at the provider for provider logout, the login page on the public URL. Empty while no public URL is configured; omitted for other capabilities and in the catalog" example:"https://silo.example.test/login"`
+	RequestRouter         *AdminPluginRequestRouter `json:"request_router,omitempty" doc:"On a request_router.v1 capability: which request server fields its plugin can do without. Omitted for other capability types"`
+}
+
+// AdminPluginRequestRouter says which request server fields a
+// request_router.v1 plugin can do without, from its manifest. Both are false
+// for a plugin that declares neither, including every plugin built before
+// the flags existed.
+type AdminPluginRequestRouter struct {
+	APIKeyOptional  bool `json:"api_key_optional" doc:"The plugin works without an API key: a request server for it can be saved and tested without one, and gets requests without one"`
+	BaseURLOptional bool `json:"base_url_optional" doc:"The plugin works without a base URL: a request server for it can be saved and tested without one"`
 }
 type AdminPluginConfigValue struct {
 	Key               string          `json:"key"`
@@ -186,10 +196,12 @@ type AdminPluginCatalogEntry struct {
 // access provider) is supervised: started at boot, restarted after a crash
 // with exponential backoff, and parked as failed after repeated failures
 // until an administrator restarts or reconfigures it. Other plugins start on
-// first use and report only running or stopped.
+// first use and report running, stopped, or failed when their last launch on
+// this server failed (with last_error); a later successful launch, an
+// administrator restart, an update or a configuration change clears the failure.
 type AdminPluginRuntime struct {
 	Resident      bool     `json:"resident" doc:"True when the server supervises this plugin's process"`
-	State         string   `json:"state" enum:"stopped,starting,running,backoff,failed" doc:"Process state; backoff and failed occur only for resident plugins"`
+	State         string   `json:"state" enum:"stopped,starting,running,backoff,failed" doc:"Process state; starting and backoff occur only for resident plugins, failed also marks a non-resident plugin whose last launch failed"`
 	RestartCount  int      `json:"restart_count" doc:"Automatic restarts since the plugin last ran stably or was restarted by an administrator"`
 	LastError     string   `json:"last_error,omitempty" doc:"Why the process last stopped or failed to start"`
 	LastStartedAt *Instant `json:"last_started_at,omitempty"`
@@ -304,6 +316,12 @@ func adminPluginCapabilitiesOf(views []handlers.PluginCapabilityView) ([]AdminPl
 		if v.Type == sdkcapability.AuthProvider {
 			capability.SignInMode = auth.ProviderModeForAuthModes(v.AuthModes)
 		}
+		if v.Type == sdkcapability.RequestRouter {
+			capability.RequestRouter = &AdminPluginRequestRouter{
+				APIKeyOptional:  v.RequestRouter.GetApiKeyOptional(),
+				BaseURLOptional: v.RequestRouter.GetBaseUrlOptional(),
+			}
+		}
 		out = append(out, capability)
 	}
 	return out, nil
diff --git a/internal/apiv2/admin_plugin_installations_test.go b/internal/apiv2/admin_plugin_installations_test.go
index 6d5d862b64..9a882e72f8 100644
--- a/internal/apiv2/admin_plugin_installations_test.go
+++ b/internal/apiv2/admin_plugin_installations_test.go
@@ -9,6 +9,9 @@ import (
 	"testing"
 	"time"
 
+	pluginv1 "github.com/prairie-server/prairie-plugin-sdk/pkg/pluginproto/prairie/plugin/v1"
+	sdkcapability "github.com/prairie-server/prairie-plugin-sdk/pkg/pluginsdk/capability"
+
 	"github.com/prairie-server/prairie-server/internal/api/handlers"
 	"github.com/prairie-server/prairie-server/internal/plugins"
 )
@@ -215,3 +218,25 @@ type noPublicURLOAuth struct{ fakeOAuth }
 func (noPublicURLOAuth) PostLogoutRedirectURL() string { return "" }
 
 func (noPublicURLOAuth) NativeSignInAvailable() bool { return false }
+
+// A request_router.v1 capability says which request server fields its plugin
+// can do without; other capability types carry no request_router.
+func TestAdminPluginCapabilitiesCarryRequestRouterFlags(t *testing.T) {
+	caps, err := adminPluginCapabilitiesOf([]handlers.PluginCapabilityView{
+		{Type: sdkcapability.RequestRouter, ID: "local", RequestRouter: &pluginv1.RequestRouterDescriptor{ApiKeyOptional: true, BaseUrlOptional: true}},
+		{Type: sdkcapability.RequestRouter, ID: "arr"},
+		{Type: sdkcapability.ScheduledTask, ID: "task"},
+	})
+	if err != nil {
+		t.Fatalf("adminPluginCapabilitiesOf: %v", err)
+	}
+	if got := caps[0].RequestRouter; got == nil || !got.APIKeyOptional || !got.BaseURLOptional {
+		t.Fatalf("local request_router = %+v, want both fields optional", got)
+	}
+	if got := caps[1].RequestRouter; got == nil || got.APIKeyOptional || got.BaseURLOptional {
+		t.Fatalf("arr request_router = %+v, want both fields needed", got)
+	}
+	if caps[2].RequestRouter != nil {
+		t.Fatalf("task request_router = %+v, want none", caps[2].RequestRouter)
+	}
+}
diff --git a/internal/apiv2/admin_policy_defaults.go b/internal/apiv2/admin_policy_defaults.go
index 20c86cc5bc..f1503c655f 100644
--- a/internal/apiv2/admin_policy_defaults.go
+++ b/internal/apiv2/admin_policy_defaults.go
@@ -16,6 +16,7 @@ type PolicyDefaults struct {
 	MaxTranscodes              int    `json:"max_transcodes" doc:"Concurrent transcode limit; 0 means unlimited" example:"0"`
 	MaxRemoteStreamBitrateKbps int    `json:"max_remote_stream_bitrate_kbps" minimum:"0" doc:"Remote per-stream bitrate limit in kbps; 0 means unlimited" example:"0"`
 	MaxLocalStreamBitrateKbps  int    `json:"max_local_stream_bitrate_kbps" minimum:"0" doc:"Local per-stream bitrate limit in kbps; 0 means unlimited" example:"0"`
+	MaxProfiles                int    `json:"max_profiles" minimum:"1" doc:"Household profile limit" example:"5"`
 	TranscodeAllowed           bool   `json:"transcode_allowed" example:"true"`
 	AudioTranscodeAllowed      bool   `json:"audio_transcode_allowed" example:"true"`
 	DownloadAllowed            bool   `json:"download_allowed" example:"true"`
@@ -40,6 +41,7 @@ func policyDefaultsOf(p access.GroupPolicy) PolicyDefaults {
 		MaxTranscodes:              p.MaxTranscodes,
 		MaxRemoteStreamBitrateKbps: p.MaxRemoteStreamBitrateKbps,
 		MaxLocalStreamBitrateKbps:  p.MaxLocalStreamBitrateKbps,
+		MaxProfiles:                p.MaxProfiles,
 		TranscodeAllowed:           p.TranscodeAllowed,
 		AudioTranscodeAllowed:      p.AudioTranscodeAllowed,
 		DownloadAllowed:            p.DownloadAllowed,
diff --git a/internal/apiv2/admin_policy_pages_test.go b/internal/apiv2/admin_policy_pages_test.go
index 30c0aa233d..0be8b71138 100644
--- a/internal/apiv2/admin_policy_pages_test.go
+++ b/internal/apiv2/admin_policy_pages_test.go
@@ -21,7 +21,7 @@ func testAdminPolicyPages(t *testing.T, pool *pgxpool.Pool, h http.Handler, docu
 		if err := pool.QueryRow(ctx, `INSERT INTO policy_documents(domain,name,enabled) VALUES('action',$1,false) RETURNING id`, fmt.Sprintf("Policy pagination fixture %d", i)).Scan(&id); err != nil {
 			t.Fatal(err)
 		}
-		defer func() { _, _ = pool.Exec(ctx, `DELETE FROM policy_documents WHERE id=$1`, id) }()
+		defer func() { _, _ = pool.Exec(ctx, `DELETE FROM policy_documents WHERE id=$1`, id) }() //nolint:gocritic,revive // each fixture row is removed when the test returns
 	}
 	if _, err := pool.Exec(ctx, `INSERT INTO policy_document_versions(document_id,version_number,rego_source,source_sha256,compiled_ok) SELECT $1,n,'fixture','fixture',false FROM generate_series(3,7) AS n`, string(document)); err != nil {
 		t.Fatal(err)
diff --git a/internal/apiv2/admin_recommendations.go b/internal/apiv2/admin_recommendations.go
index 4897dee0bd..0d901035be 100644
--- a/internal/apiv2/admin_recommendations.go
+++ b/internal/apiv2/admin_recommendations.go
@@ -2,36 +2,73 @@ package apiv2
 
 import (
 	"context"
+	"encoding/json"
+	"errors"
 	"net/http"
+	"time"
 
+	"github.com/prairie-server/prairie-server/internal/logredact"
 	"github.com/prairie-server/prairie-server/internal/recommendations"
+	"github.com/prairie-server/prairie-server/internal/taskmanager"
 )
 
 // AdminRecommendationsService is the existing process-local recommendation worker.
 type AdminRecommendationsService interface {
 	StatusCounts(context.Context) (int, int, int, int, int, error)
 	IsRunning(recommendations.JobName) bool
+	LastRuns(context.Context) (map[recommendations.JobName]recommendations.JobRuns, error)
+	EmbeddingLockConflict(context.Context) (string, error)
+	CacheRefreshedAt(context.Context) (*time.Time, error)
+	StaleSweep(context.Context) (recommendations.StaleSweepStatus, error)
 	TriggerEmbeddings() error
 	TriggerTasteProfiles() error
 	TriggerCowatch() error
 	TriggerRecommendations() error
+	ResetEmbeddings(context.Context) (recommendations.EmbeddingsReset, error)
 }
 type AdminRecommendationJobStatus struct {
-	Running bool `json:"running"`
-	Count   int  `json:"count"`
-	Total   *int `json:"total,omitempty"`
+	Running bool                       `json:"running"`
+	Count   int                        `json:"count"`
+	Total   *int                       `json:"total,omitempty"`
+	LastRun *AdminRecommendationJobRun `json:"last_run,omitempty" doc:"The newest finished full run of this job on any server: scheduled or triggered. Absent until one finishes."`
+	// LastPartialRun is recorded apart from LastRun so frequent partial runs
+	// never hide a failed full run.
+	LastPartialRun *AdminRecommendationJobRun `json:"last_partial_run,omitempty" doc:"The newest finished partial run on any server: the embedding catch-up pass for embeddings, the startup global-row build for recommendations. Absent for other jobs and until one finishes."`
+}
+type AdminRecommendationJobRun struct {
+	Status      string         `json:"status" enum:"completed,failed" doc:"completed also covers runs that finished with partial failures; result counts them."`
+	StartedAt   Instant        `json:"started_at"`
+	CompletedAt Instant        `json:"completed_at"`
+	Error       string         `json:"error,omitempty" doc:"Why the run failed, with credentials masked. Present only when status is failed."`
+	Result      map[string]any `json:"result,omitempty" doc:"Counts the run reported. Keys differ by job and may grow."`
 }
 type AdminRecommendationsStatus struct {
-	Embeddings      AdminRecommendationJobStatus `json:"embeddings"`
-	TasteProfiles   AdminRecommendationJobStatus `json:"taste_profiles"`
-	Cowatch         AdminRecommendationJobStatus `json:"cowatch"`
-	Recommendations AdminRecommendationJobStatus `json:"recommendations"`
+	Embeddings       AdminRecommendationJobStatus  `json:"embeddings"`
+	TasteProfiles    AdminRecommendationJobStatus  `json:"taste_profiles"`
+	Cowatch          AdminRecommendationJobStatus  `json:"cowatch"`
+	Recommendations  AdminRecommendationJobStatus  `json:"recommendations"`
+	LockConflict     string                        `json:"lock_conflict" doc:"Why the stored embedding lock rejects the embedding settings this server runs with; empty when it does not."`
+	StaleSweep       AdminRecommendationStaleSweep `json:"stale_sweep" doc:"The stale profile sweep, which rebuilds profiles after their signals or access change."`
+	CacheRefreshedAt *Instant                      `json:"cache_refreshed_at,omitempty" doc:"When the newest cached recommendation row was written, by the cache job or a profile refresh. It is not job health: profile refreshes keep it recent while the cache job fails; read recommendations.last_run for that. Absent when nothing is cached."`
+}
+type AdminRecommendationStaleSweep struct {
+	Pending int                        `json:"pending" doc:"Profiles whose recommendations wait for a rebuild. The sweep rebuilds up to 50 every 5 minutes; a profile whose rebuild fails stays pending."`
+	LastRun *AdminRecommendationJobRun `json:"last_run,omitempty" doc:"The newest sweep on any server that rebuilt or failed at least one profile. Absent until one does."`
 }
 type AdminRecommendationsStatusOutput struct{ Body AdminRecommendationsStatus }
 type AdminRecommendationStarted struct {
 	Status string `json:"status" enum:"started" doc:"This process started background work; no durable job is created."`
 }
 type AdminRecommendationStartedOutput struct{ Body AdminRecommendationStarted }
+type AdminRecommendationEmbeddingsReset struct {
+	Embeddings    int64 `json:"embeddings" doc:"Item embeddings deleted."`
+	TasteProfiles int64 `json:"taste_profiles" doc:"Taste profiles whose vectors were cleared. Each is rebuilt once the embedding job stores its titles' vectors again."`
+	TasteClusters int64 `json:"taste_clusters" doc:"Taste clusters deleted."`
+	CachedRows    int64 `json:"cached_rows" doc:"Per-profile cached recommendation rows deleted. Global rows are kept."`
+}
+type AdminRecommendationEmbeddingsResetOutput struct {
+	Body AdminRecommendationEmbeddingsReset
+}
 
 func registerAdminRecommendations(reg *Registry) {
 	op := func(method, path, id, summary string) Operation {
@@ -41,7 +78,7 @@ func registerAdminRecommendations(reg *Registry) {
 		}
 		return o
 	}
-	Register(reg, op(http.MethodGet, "/status", "getAdminRecommendationsStatus", "Read persisted counts and this process's running flags."), reg.getAdminRecommendationsStatus)
+	Register(reg, op(http.MethodGet, "/status", "getAdminRecommendationsStatus", "Read persisted counts, each job's last run, the embedding lock conflict and this process's running flags."), reg.getAdminRecommendationsStatus)
 	for _, action := range []struct {
 		path, id string
 		start    func(AdminRecommendationsService) error
@@ -56,12 +93,50 @@ func registerAdminRecommendations(reg *Registry) {
 				return nil, unavailable("recommendations")
 			}
 			if err := action.start(reg.deps.AdminRecommendations); err != nil {
-				return nil, NewProblem(TypeConflict, "This recommendation job is already running on this process.")
+				switch {
+				case errors.Is(err, recommendations.ErrJobRunningElsewhere):
+					return nil, NewProblem(TypeConflict, "This recommendation job is already running on another server.")
+				case errors.Is(err, recommendations.ErrJobRunning):
+					return nil, NewProblem(TypeConflict, "This recommendation job is already running on this process.")
+				default:
+					return nil, serviceProblem(err)
+				}
 			}
 			return &AdminRecommendationStartedOutput{Body: AdminRecommendationStarted{Status: "started"}}, nil
 		})
 	}
+	reset := op(http.MethodPost, "/embeddings/reset", "resetAdminRecommendationEmbeddings", "Delete the embedding lock, every item embedding, taste clusters and per-profile cached rows, and clear taste profile vectors, in one transaction.")
+	reset.Description = "Recovers a server whose embedding lock pins a model it can no longer use, or switches embedding models. " +
+		"It refuses with 409 while the embedding, taste profile or recommendation job, or a stale profile sweep, runs on any server, " +
+		"while a catalog import with embeddings runs, and while saved embedding settings wait for a server restart. " +
+		"Run the embedding job afterwards to build the new embedding space."
+	reset.Errors = append(reset.Errors, http.StatusConflict)
+	Register(reg, reset, reg.resetAdminRecommendationEmbeddings)
 }
+
+func (reg *Registry) resetAdminRecommendationEmbeddings(ctx context.Context, _ *struct{}) (*AdminRecommendationEmbeddingsResetOutput, error) {
+	w := reg.deps.AdminRecommendations
+	if w == nil {
+		return nil, unavailable("recommendations")
+	}
+	res, err := w.ResetEmbeddings(ctx)
+	if err != nil {
+		if errors.Is(err, recommendations.ErrJobRunning) || errors.Is(err, recommendations.ErrJobRunningElsewhere) || errors.Is(err, recommendations.ErrStaleSweepRunning) {
+			return nil, NewProblem(TypeConflict, "Recommendation work that uses embeddings is running on this or another server. Reset embeddings after it finishes.")
+		}
+		if errors.Is(err, recommendations.ErrCatalogImportRunning) {
+			return nil, NewProblem(TypeConflict, "A catalog import with embeddings is running. Reset embeddings after it finishes.")
+		}
+		if errors.Is(err, recommendations.ErrEmbeddingSettingsPendingRestart) {
+			return nil, NewProblem(TypeConflict, "The saved embedding settings take effect after a server restart. Restart the server, then reset embeddings.")
+		}
+		return nil, serviceProblem(err)
+	}
+	return &AdminRecommendationEmbeddingsResetOutput{Body: AdminRecommendationEmbeddingsReset{
+		Embeddings: res.Embeddings, TasteProfiles: res.TasteProfiles, TasteClusters: res.TasteClusters, CachedRows: res.CachedRows,
+	}}, nil
+}
+
 func (reg *Registry) getAdminRecommendationsStatus(ctx context.Context, _ *struct{}) (*AdminRecommendationsStatusOutput, error) {
 	w := reg.deps.AdminRecommendations
 	if w == nil {
@@ -71,14 +146,63 @@ func (reg *Registry) getAdminRecommendationsStatus(ctx context.Context, _ *struc
 	if err != nil {
 		return nil, serviceProblem(err)
 	}
+	lastRuns, err := w.LastRuns(ctx)
+	if err != nil {
+		return nil, serviceProblem(err)
+	}
+	conflict, err := w.EmbeddingLockConflict(ctx)
+	if err != nil {
+		return nil, serviceProblem(err)
+	}
+	refreshedAt, err := w.CacheRefreshedAt(ctx)
+	if err != nil {
+		return nil, serviceProblem(err)
+	}
+	sweep, err := w.StaleSweep(ctx)
+	if err != nil {
+		return nil, serviceProblem(err)
+	}
+	jobStatus := func(name recommendations.JobName, count int) AdminRecommendationJobStatus {
+		status := AdminRecommendationJobStatus{Running: w.IsRunning(name), Count: count}
+		runs := lastRuns[name]
+		if runs.Full != nil {
+			status.LastRun = adminRecommendationJobRunOf(*runs.Full)
+		}
+		if runs.Partial != nil {
+			status.LastPartialRun = adminRecommendationJobRunOf(*runs.Partial)
+		}
+		return status
+	}
 	out := &AdminRecommendationsStatusOutput{Body: AdminRecommendationsStatus{
-		Embeddings:      AdminRecommendationJobStatus{Running: w.IsRunning(recommendations.JobEmbeddings), Count: embedded},
-		TasteProfiles:   AdminRecommendationJobStatus{Running: w.IsRunning(recommendations.JobTasteProfiles), Count: taste},
-		Cowatch:         AdminRecommendationJobStatus{Running: w.IsRunning(recommendations.JobCowatch), Count: cowatch},
-		Recommendations: AdminRecommendationJobStatus{Running: w.IsRunning(recommendations.JobRecommendations), Count: cache},
+		Embeddings:       jobStatus(recommendations.JobEmbeddings, embedded),
+		TasteProfiles:    jobStatus(recommendations.JobTasteProfiles, taste),
+		Cowatch:          jobStatus(recommendations.JobCowatch, cowatch),
+		Recommendations:  jobStatus(recommendations.JobRecommendations, cache),
+		LockConflict:     conflict,
+		StaleSweep:       AdminRecommendationStaleSweep{Pending: sweep.Pending},
+		CacheRefreshedAt: instantPtr(refreshedAt),
 	}}
+	if sweep.LastRun != nil {
+		out.Body.StaleSweep.LastRun = adminRecommendationJobRunOf(*sweep.LastRun)
+	}
 	if total != 0 {
 		out.Body.Embeddings.Total = new(total)
 	}
 	return out, nil
 }
+
+func adminRecommendationJobRunOf(run taskmanager.ExecutionResult) *AdminRecommendationJobRun {
+	out := &AdminRecommendationJobRun{Status: run.Status, StartedAt: NewInstant(run.StartedAt), CompletedAt: NewInstant(run.CompletedAt)}
+	if run.ErrorMessage != "" {
+		// Job errors can quote provider responses; mask credentials the
+		// way stored diagnostics are masked.
+		out.Error = logredact.SanitizeText(run.ErrorMessage)
+	}
+	if len(run.ResultData) > 0 {
+		var result map[string]any
+		if json.Unmarshal(run.ResultData, &result) == nil {
+			out.Result = result
+		}
+	}
+	return out
+}
diff --git a/internal/apiv2/admin_recommendations_fixtures_test.go b/internal/apiv2/admin_recommendations_fixtures_test.go
index 3fbc7ff872..08fec93857 100644
--- a/internal/apiv2/admin_recommendations_fixtures_test.go
+++ b/internal/apiv2/admin_recommendations_fixtures_test.go
@@ -3,11 +3,12 @@ package apiv2
 import "strings"
 
 func adminRecommendationsFixtureCases() []fixtureCase {
-	cases := []fixtureCase{{name: "admin_recommendations_status", operationID: "getAdminRecommendationsStatus", method: "GET", path: Prefix + "/admin/recommendations/status", headers: bearer(adminToken), status: 200, schema: "#/components/schemas/AdminRecommendationsStatus", assertHeaders: []string{"Content-Type"}, scenario: "Persisted counts and process-local running flags have distinct meanings."}}
+	cases := []fixtureCase{{name: "admin_recommendations_status", operationID: "getAdminRecommendationsStatus", method: "GET", path: Prefix + "/admin/recommendations/status", headers: bearer(adminToken), status: 200, schema: "#/components/schemas/AdminRecommendationsStatus", assertHeaders: []string{"Content-Type"}, scenario: "Persisted counts, last runs from any server and process-local running flags have distinct meanings."}}
 	for _, tc := range []struct{ suffix, id string }{
 		{"embeddings", "triggerAdminRecommendationEmbeddings"}, {"taste-profiles", "triggerAdminRecommendationTasteProfiles"}, {"cowatch", "triggerAdminRecommendationCowatch"}, {"recommendations", "triggerAdminRecommendationRefresh"},
 	} {
 		cases = append(cases, fixtureCase{name: "admin_recommendations_" + strings.ReplaceAll(tc.suffix, "-", "_"), operationID: tc.id, method: "POST", path: Prefix + "/admin/recommendations/trigger/" + tc.suffix, headers: bearer(adminToken), status: 200, schema: "#/components/schemas/AdminRecommendationStarted", assertHeaders: []string{"Content-Type"}, scenario: "Started acknowledges process-local background execution, not a persisted job."})
 	}
+	cases = append(cases, fixtureCase{name: "admin_recommendations_embeddings_reset", operationID: "resetAdminRecommendationEmbeddings", method: "POST", path: Prefix + "/admin/recommendations/embeddings/reset", headers: bearer(adminToken), status: 200, schema: "#/components/schemas/AdminRecommendationEmbeddingsReset", assertHeaders: []string{"Content-Type"}, scenario: "A reset reports what it deleted; global rows are kept."})
 	return cases
 }
diff --git a/internal/apiv2/admin_recommendations_test.go b/internal/apiv2/admin_recommendations_test.go
index 90fff2f373..43f3c4efa9 100644
--- a/internal/apiv2/admin_recommendations_test.go
+++ b/internal/apiv2/admin_recommendations_test.go
@@ -4,16 +4,33 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/prairie-server/prairie-server/internal/recommendations"
+	"github.com/prairie-server/prairie-server/internal/taskmanager"
 )
 
+// fakeAdminRecommendationsTime is the fixed time the fake reports, so the
+// contract fixtures stay byte-stable.
+var fakeAdminRecommendationsTime = time.Date(2026, 10, 3, 3, 0, 0, 0, time.UTC)
+
 type fakeAdminRecommendations struct {
 	calls int
 	last  recommendations.JobName
 	err   error
+
+	runsErr     error
+	noRuns      bool
+	conflict    string
+	conflictErr error
+	noRefresh   bool
+	refreshErr  error
+	resets      int
+	resetErr    error
+	sweepErr    error
 }
 
 func (f *fakeAdminRecommendations) StatusCounts(context.Context) (int, int, int, int, int, error) {
@@ -22,6 +39,63 @@ func (f *fakeAdminRecommendations) StatusCounts(context.Context) (int, int, int,
 func (*fakeAdminRecommendations) IsRunning(job recommendations.JobName) bool {
 	return job == recommendations.JobEmbeddings
 }
+func (f *fakeAdminRecommendations) LastRuns(context.Context) (map[recommendations.JobName]recommendations.JobRuns, error) {
+	if f.runsErr != nil || f.noRuns {
+		return map[recommendations.JobName]recommendations.JobRuns{}, f.runsErr
+	}
+	return map[recommendations.JobName]recommendations.JobRuns{
+		recommendations.JobEmbeddings: {
+			Full: &taskmanager.ExecutionResult{
+				TaskKey: "recommendations.embeddings", Status: "failed",
+				StartedAt: fakeAdminRecommendationsTime, CompletedAt: fakeAdminRecommendationsTime.Add(90 * time.Second),
+				ResultData:   json.RawMessage(`{"embedded":0}`),
+				ErrorMessage: `embed batch: POST https://user:hunter2@embed.example/v1/embeddings: api_key=secret-value rejected`,
+			},
+			Partial: &taskmanager.ExecutionResult{
+				TaskKey: "recommendations.embeddings.catch_up", Status: "completed",
+				StartedAt: fakeAdminRecommendationsTime.Add(15 * time.Minute), CompletedAt: fakeAdminRecommendationsTime.Add(16 * time.Minute),
+				ResultData: json.RawMessage(`{"missing_only":true,"embedded":2}`),
+			},
+		},
+		recommendations.JobRecommendations: {
+			Full: &taskmanager.ExecutionResult{
+				TaskKey: "recommendations.cache", Status: "completed",
+				StartedAt: fakeAdminRecommendationsTime.Add(2 * time.Hour), CompletedAt: fakeAdminRecommendationsTime.Add(2*time.Hour + time.Minute),
+				ResultData: json.RawMessage(`{"profiles":2,"processed":2,"cached_rows":14,"build_errors":0}`),
+			},
+		},
+	}, nil
+}
+func (f *fakeAdminRecommendations) EmbeddingLockConflict(context.Context) (string, error) {
+	return f.conflict, f.conflictErr
+}
+func (f *fakeAdminRecommendations) CacheRefreshedAt(context.Context) (*time.Time, error) {
+	if f.refreshErr != nil || f.noRefresh {
+		return nil, f.refreshErr
+	}
+	at := fakeAdminRecommendationsTime.Add(2*time.Hour + time.Minute)
+	return &at, nil
+}
+func (f *fakeAdminRecommendations) StaleSweep(context.Context) (recommendations.StaleSweepStatus, error) {
+	if f.sweepErr != nil {
+		return recommendations.StaleSweepStatus{}, f.sweepErr
+	}
+	if f.noRuns {
+		return recommendations.StaleSweepStatus{}, nil
+	}
+	return recommendations.StaleSweepStatus{Pending: 7, LastRun: &taskmanager.ExecutionResult{
+		TaskKey: "recommendations.stale_sweep", Status: "completed",
+		StartedAt: fakeAdminRecommendationsTime.Add(3 * time.Hour), CompletedAt: fakeAdminRecommendationsTime.Add(3*time.Hour + 20*time.Second),
+		ResultData: json.RawMessage(`{"stale":3,"refreshed":2,"failed":1,"deferred":0,"queued":0}`),
+	}}, nil
+}
+func (f *fakeAdminRecommendations) ResetEmbeddings(context.Context) (recommendations.EmbeddingsReset, error) {
+	f.resets++
+	if f.resetErr != nil {
+		return recommendations.EmbeddingsReset{}, f.resetErr
+	}
+	return recommendations.EmbeddingsReset{Embeddings: 120, TasteProfiles: 3, TasteClusters: 9, CachedRows: 41}, nil
+}
 func (f *fakeAdminRecommendations) start(job recommendations.JobName) error {
 	f.calls++
 	f.last = job
@@ -63,10 +137,24 @@ func TestAdminRecommendationsTransport(t *testing.T) {
 		if rec.Code != 200 || f.calls != before+1 || f.last != tc.job || rec.Header().Get("Location") != "" || !strings.Contains(rec.Body.String(), `"status":"started"`) {
 			t.Fatalf("start %s: %d %s %#v", tc.path, rec.Code, rec.Body, f)
 		}
-		f.err = errors.New("private worker detail")
+		for _, busy := range []struct {
+			err   error
+			where string
+		}{
+			{fmt.Errorf("private worker detail: %w", recommendations.ErrJobRunning), "this process"},
+			{fmt.Errorf("private worker detail: %w", recommendations.ErrJobRunningElsewhere), "another server"},
+		} {
+			f.err = busy.err
+			rec = do(t, h, "POST", path, "", bearer(adminToken))
+			if rec.Code != 409 || !strings.Contains(rec.Body.String(), busy.where) || strings.Contains(rec.Body.String(), "private worker") {
+				t.Fatalf("conflict %s (%s): %d %s", tc.path, busy.where, rec.Code, rec.Body)
+			}
+		}
+		// Failing to take the cluster lock is not a conflict.
+		f.err = errors.New("private lock detail")
 		rec = do(t, h, "POST", path, "", bearer(adminToken))
-		if rec.Code != 409 || strings.Contains(rec.Body.String(), "private worker") {
-			t.Fatalf("conflict %s: %d %s", tc.path, rec.Code, rec.Body)
+		if rec.Code != 500 || strings.Contains(rec.Body.String(), "private lock") {
+			t.Fatalf("lock failure %s: %d %s", tc.path, rec.Code, rec.Body)
 		}
 		before = f.calls
 		rec = do(t, h, "POST", path, "", bearer(memberToken))
@@ -82,10 +170,128 @@ func TestAdminRecommendationsTransport(t *testing.T) {
 	}
 	deps.AdminRecommendations = nil
 	h = newTestHandler(t, deps)
-	for _, tc := range []struct{ method, path string }{{"GET", "/status"}, {"POST", "/trigger/embeddings"}, {"POST", "/trigger/taste-profiles"}, {"POST", "/trigger/cowatch"}, {"POST", "/trigger/recommendations"}} {
+	for _, tc := range []struct{ method, path string }{{"GET", "/status"}, {"POST", "/trigger/embeddings"}, {"POST", "/trigger/taste-profiles"}, {"POST", "/trigger/cowatch"}, {"POST", "/trigger/recommendations"}, {"POST", "/embeddings/reset"}} {
 		rec = do(t, h, tc.method, Prefix+"/admin/recommendations"+tc.path, "", bearer(adminToken))
 		if rec.Code != 503 {
 			t.Fatalf("unwired %s: %d %s", tc.path, rec.Code, rec.Body)
 		}
 	}
 }
+
+func TestAdminRecommendationsStatusReportsRunsConflictAndRefresh(t *testing.T) {
+	deps := pilotDeps(nil, nil)
+	f := &fakeAdminRecommendations{conflict: `Embeddings were created with model "a", not "b". Reset embeddings before switching models.`}
+	deps.AdminRecommendations = f
+	h := newTestHandler(t, deps)
+
+	rec := do(t, h, "GET", Prefix+"/admin/recommendations/status", "", bearer(adminToken))
+	if rec.Code != 200 {
+		t.Fatalf("status: %d %s", rec.Code, rec.Body)
+	}
+	var status AdminRecommendationsStatus
+	if err := json.Unmarshal(rec.Body.Bytes(), &status); err != nil {
+		t.Fatal(err)
+	}
+	if status.LockConflict != f.conflict {
+		t.Fatalf("lock_conflict = %q", status.LockConflict)
+	}
+	if status.CacheRefreshedAt == nil || !status.CacheRefreshedAt.Equal(fakeAdminRecommendationsTime.Add(2*time.Hour+time.Minute)) {
+		t.Fatalf("cache_refreshed_at = %v", status.CacheRefreshedAt)
+	}
+	emb := status.Embeddings.LastRun
+	if emb == nil || emb.Status != "failed" || !emb.StartedAt.Equal(fakeAdminRecommendationsTime) || !emb.CompletedAt.Equal(fakeAdminRecommendationsTime.Add(90*time.Second)) {
+		t.Fatalf("embeddings last run = %+v", emb)
+	}
+	// The stored error reaches the admin with credentials masked.
+	if !strings.Contains(emb.Error, "embed.example") || strings.Contains(emb.Error, "hunter2") || strings.Contains(emb.Error, "secret-value") {
+		t.Fatalf("embeddings last run error = %q", emb.Error)
+	}
+	if emb.Result["embedded"] != float64(0) {
+		t.Fatalf("embeddings last run result = %v", emb.Result)
+	}
+	cache := status.Recommendations.LastRun
+	if cache == nil || cache.Status != "completed" || cache.Error != "" || cache.Result["cached_rows"] != float64(14) {
+		t.Fatalf("cache last run = %+v", cache)
+	}
+	// The catch-up pass that ran after the failed full run is reported
+	// beside it, not instead of it.
+	if p := status.Embeddings.LastPartialRun; p == nil || p.Status != "completed" || p.Result["missing_only"] != true {
+		t.Fatalf("embeddings last partial run = %+v", p)
+	}
+	if status.Recommendations.LastPartialRun != nil {
+		t.Fatalf("cache last partial run = %+v, want none recorded", status.Recommendations.LastPartialRun)
+	}
+	if status.TasteProfiles.LastRun != nil || status.Cowatch.LastRun != nil {
+		t.Fatalf("jobs with no recorded run report one: %+v %+v", status.TasteProfiles.LastRun, status.Cowatch.LastRun)
+	}
+	// The stale sweep's backlog and a sweep whose refresh failed are visible.
+	if sw := status.StaleSweep; sw.Pending != 7 || sw.LastRun == nil || sw.LastRun.Result["failed"] != float64(1) {
+		t.Fatalf("stale sweep = %+v", sw)
+	}
+
+	// Nothing recorded, no conflict and an empty cache: last_run and
+	// cache_refreshed_at are absent and lock_conflict is empty.
+	f.conflict, f.noRuns, f.noRefresh = "", true, true
+	rec = do(t, h, "GET", Prefix+"/admin/recommendations/status", "", bearer(adminToken))
+	body := rec.Body.String()
+	if rec.Code != 200 || strings.Contains(body, "last_run") || strings.Contains(body, "cache_refreshed_at") || !strings.Contains(body, `"lock_conflict":""`) {
+		t.Fatalf("empty status: %d %s", rec.Code, body)
+	}
+
+	for name, fail := range map[string]func(){
+		"runs":     func() { f.runsErr = errors.New("private history detail") },
+		"conflict": func() { f.conflictErr = errors.New("private history detail") },
+		"refresh":  func() { f.refreshErr = errors.New("private history detail") },
+		"sweep":    func() { f.sweepErr = errors.New("private history detail") },
+	} {
+		f.runsErr, f.conflictErr, f.refreshErr, f.sweepErr = nil, nil, nil, nil
+		fail()
+		rec = do(t, h, "GET", Prefix+"/admin/recommendations/status", "", bearer(adminToken))
+		if rec.Code != 500 || strings.Contains(rec.Body.String(), "private history") {
+			t.Fatalf("%s failure: %d %s", name, rec.Code, rec.Body)
+		}
+	}
+}
+
+func TestAdminRecommendationsResetEmbeddings(t *testing.T) {
+	deps := pilotDeps(nil, nil)
+	f := &fakeAdminRecommendations{}
+	deps.AdminRecommendations = f
+	h := newTestHandler(t, deps)
+	path := Prefix + "/admin/recommendations/embeddings/reset"
+
+	rec := do(t, h, "POST", path, "", bearer(adminToken))
+	if rec.Code != 200 || f.resets != 1 {
+		t.Fatalf("reset: %d %s resets=%d", rec.Code, rec.Body, f.resets)
+	}
+	var out AdminRecommendationEmbeddingsReset
+	if err := json.Unmarshal(rec.Body.Bytes(), &out); err != nil {
+		t.Fatal(err)
+	}
+	if out != (AdminRecommendationEmbeddingsReset{Embeddings: 120, TasteProfiles: 3, TasteClusters: 9, CachedRows: 41}) {
+		t.Fatalf("reset body = %+v", out)
+	}
+
+	for _, busy := range []error{
+		fmt.Errorf("private worker detail: %w", recommendations.ErrJobRunning),
+		fmt.Errorf("private worker detail: %w", recommendations.ErrJobRunningElsewhere),
+		recommendations.ErrStaleSweepRunning,
+	} {
+		f.resetErr = busy
+		rec = do(t, h, "POST", path, "", bearer(adminToken))
+		if rec.Code != 409 || !strings.Contains(rec.Body.String(), "Reset embeddings after it finishes") || strings.Contains(rec.Body.String(), "private worker") {
+			t.Fatalf("busy reset (%v): %d %s", busy, rec.Code, rec.Body)
+		}
+	}
+	f.resetErr = errors.New("private database detail")
+	rec = do(t, h, "POST", path, "", bearer(adminToken))
+	if rec.Code != 500 || strings.Contains(rec.Body.String(), "private database") {
+		t.Fatalf("failed reset: %d %s", rec.Code, rec.Body)
+	}
+
+	before := f.resets
+	rec = do(t, h, "POST", path, "", bearer(memberToken))
+	if rec.Code != 403 || f.resets != before {
+		t.Fatalf("member reset embeddings: %d resets=%d", rec.Code, f.resets)
+	}
+}
diff --git a/internal/apiv2/admin_requests.go b/internal/apiv2/admin_requests.go
index e0fa07cb05..123fe7b4db 100644
--- a/internal/apiv2/admin_requests.go
+++ b/internal/apiv2/admin_requests.go
@@ -151,7 +151,7 @@ type AdminRequestOptionsInput struct {
 		Name           string         `json:"name,omitempty"`
 		CapabilityID   string         `json:"capability_id,omitempty"`
 		InstallationID *ID            `json:"installation_id,omitempty" pattern:"^[1-9][0-9]*$"`
-		BaseURL        string         `json:"base_url,omitempty"`
+		BaseURL        *string        `json:"base_url,omitempty"`
 		APIKey         string         `json:"api_key_ref,omitempty" writeOnly:"true"`
 		PluginConfig   map[string]any `json:"plugin_config,omitempty"`
 	}
@@ -451,10 +451,11 @@ func adminIntegrationOf(r mediarequests.Integration) AdminRequestIntegration {
 
 // adminRequestBaseURL is the address a v2 probe or save sends on: http://
 // assumed and no trailing slash, so the probe and the saved row agree. A blank
-// address stays blank; the service then uses the saved one.
+// address, spaces included, is "": the save stores it blank, and a probe that
+// sends it blank tests no address for a router that needs none.
 func adminRequestBaseURL(raw string) (string, *Problem) {
 	if strings.TrimSpace(raw) == "" {
-		return raw, nil
+		return "", nil
 	}
 	normalized, err := mediarequests.NormalizeIntegrationBaseURL(raw)
 	if err != nil {
@@ -611,11 +612,16 @@ func (reg *Registry) loadAdminRequestOptions(ctx context.Context, in *AdminReque
 		}
 		install = &id
 	}
-	baseURL, p := adminRequestBaseURL(b.BaseURL)
-	if p != nil {
-		return nil, p
+	// An omitted base_url tests the saved address; a blank one tests none,
+	// for a router that needs none.
+	var baseURL string
+	if b.BaseURL != nil {
+		if baseURL, p = adminRequestBaseURL(*b.BaseURL); p != nil {
+			return nil, p
+		}
 	}
-	options, err := s.LoadIntegrationOptions(ctx, adminRequestViewer(ctx), mediarequests.Integration{ID: string(in.ID), Name: b.Name, CapabilityID: b.CapabilityID, InstallationID: install, BaseURL: baseURL, APIKeyRef: b.APIKey, PluginConfig: b.PluginConfig})
+	cleared := b.BaseURL != nil && baseURL == ""
+	options, err := s.LoadIntegrationOptions(ctx, adminRequestViewer(ctx), mediarequests.Integration{ID: string(in.ID), Name: b.Name, CapabilityID: b.CapabilityID, InstallationID: install, BaseURL: baseURL, BaseURLCleared: cleared, APIKeyRef: b.APIKey, PluginConfig: b.PluginConfig})
 	if err != nil {
 		return nil, requestProblem(err)
 	}
diff --git a/internal/apiv2/admin_requests_test.go b/internal/apiv2/admin_requests_test.go
index 24019d7d7f..b10568fc22 100644
--- a/internal/apiv2/admin_requests_test.go
+++ b/internal/apiv2/admin_requests_test.go
@@ -22,6 +22,7 @@ type fakeAdminRequests struct {
 	filter                    mediarequests.ListFilter
 	action, reason, requestID string
 	probedBaseURL             string
+	probedBaseURLCleared      bool
 	// failed gives every returned request the errors a failed submission
 	// leaves (withSubmissionErrors).
 	failed bool
@@ -106,6 +107,7 @@ func (f *fakeAdminRequests) DeleteIntegrationConditional(_ context.Context, v me
 func (f *fakeAdminRequests) LoadIntegrationOptions(_ context.Context, v mediarequests.Viewer, r mediarequests.Integration) (map[string][]mediarequests.RouterOption, error) {
 	f.viewer = v
 	f.probedBaseURL = r.BaseURL
+	f.probedBaseURLCleared = r.BaseURLCleared
 	if r.APIKeyRef == "bad" {
 		return nil, &mediarequests.ValidationError{FieldErrors: map[string]string{"api_key_ref": "invalid key"}}
 	}
@@ -276,6 +278,31 @@ func TestAdminRequestOptionsNormalizesBaseURL(t *testing.T) {
 	}
 }
 
+// A probe that leaves base_url out tests the saved address; one that sends it
+// blank clears it, which a router that needs no URL is then tested without.
+func TestAdminRequestOptionsTellsOmittedFromClearedBaseURL(t *testing.T) {
+	f := fixtureAdminRequests()
+	h := adminRequestsHandler(f)
+	path := Prefix + "/admin/request-integrations/7/options"
+	for _, tc := range []struct {
+		body        string
+		wantCleared bool
+		wantURL     string
+	}{
+		{`{}`, false, ""},
+		{`{"base_url":""}`, true, ""},
+		{`{"base_url":"  "}`, true, ""},
+		{`{"base_url":"10.0.0.5:8989"}`, false, "http://10.0.0.5:8989"},
+	} {
+		if rec := do(t, h, http.MethodPost, path, tc.body, actingRequestAdmin); rec.Code != 200 {
+			t.Fatal(tc.body, rec.Code, rec.Body.String())
+		}
+		if f.probedBaseURLCleared != tc.wantCleared || f.probedBaseURL != tc.wantURL {
+			t.Fatalf("%s: cleared = %v, url = %q; want %v, %q", tc.body, f.probedBaseURLCleared, f.probedBaseURL, tc.wantCleared, tc.wantURL)
+		}
+	}
+}
+
 // A v2 save stores the address the options probe used, and refuses one it
 // could never probe as a field error.
 func TestAdminRequestIntegrationSaveNormalizesBaseURL(t *testing.T) {
diff --git a/internal/apiv2/admin_scoped_email_db_test.go b/internal/apiv2/admin_scoped_email_db_test.go
index 94dff3c2c9..1b1dc6ace2 100644
--- a/internal/apiv2/admin_scoped_email_db_test.go
+++ b/internal/apiv2/admin_scoped_email_db_test.go
@@ -160,18 +160,30 @@ func TestScopedAdminKeyCannotRedirectRecoveryDB(t *testing.T) {
 				if stored.Email != originalEmail {
 					t.Errorf("stored recovery email = %q, want %q", stored.Email, originalEmail)
 				}
-				// A metadata-only update remains in scope for the same key.
+				// A metadata-only update remains in scope for the same key. The
+				// profile limit is access policy, so only the Owner's key may
+				// change it on its own admin account.
 				metadata := do(t, router, http.MethodPut, path, `{"max_profiles":6}`, headers)
 				wantStatus := http.StatusNoContent
 				if version == "v1" {
 					wantStatus = http.StatusOK
 				}
-				if metadata.Code != wantStatus {
-					t.Fatalf("metadata update: %d %s", metadata.Code, metadata.Body)
-				}
-				stored, err = users.GetByID(ctx, admin.ID)
-				if err != nil || stored.MaxProfiles != 6 {
-					t.Fatalf("metadata update was not persisted: %+v, %v", stored, err)
+				if owner {
+					if metadata.Code != wantStatus {
+						t.Fatalf("metadata update: %d %s", metadata.Code, metadata.Body)
+					}
+					stored, err = users.GetByID(ctx, admin.ID)
+					if err != nil || stored.MaxProfiles == nil || *stored.MaxProfiles != 6 {
+						t.Fatalf("metadata update was not persisted: %+v, %v", stored, err)
+					}
+				} else {
+					if metadata.Code != http.StatusForbidden {
+						t.Fatalf("metadata update: %d %s, want 403", metadata.Code, metadata.Body)
+					}
+					stored, err = users.GetByID(ctx, admin.ID)
+					if err != nil || stored.MaxProfiles != nil {
+						t.Fatalf("refused metadata update was persisted: %+v, %v", stored, err)
+					}
 				}
 				requested := do(t, router, http.MethodPost, Prefix+"/password-resets", fmt.Sprintf(`{"login":%q}`, name), nil)
 				if requested.Code != http.StatusAccepted {
diff --git a/internal/apiv2/admin_task_jobs.go b/internal/apiv2/admin_task_jobs.go
index 43e1490a4d..1724e3ed81 100644
--- a/internal/apiv2/admin_task_jobs.go
+++ b/internal/apiv2/admin_task_jobs.go
@@ -113,7 +113,7 @@ func registerAdminTaskJobs(reg *Registry) {
 	cancel.DefaultStatus = 202
 	cancel.Errors = []int{409}
 	cancel.Responses = map[string]*huma.Response{"200": {
-		Description: "The job was already canceled.",
+		Description: "The job is canceled: it was already canceled, or it was a queued image cache cleanup that this request canceled at once.",
 		Content:     map[string]*huma.MediaType{mediaTypeJSON: {Schema: &huma.Schema{Ref: adminTaskJobSchemaRef}}},
 	}}
 	Register(reg, Operation{Operation: cancel, Class: ClassActingAdmin, DemoRestricted: true, ServiceBacked: true, RetrySafety: RetrySafetyCoalescing}, reg.cancelAdminTaskJob)
@@ -130,7 +130,7 @@ func (reg *Registry) cancelAdminTaskJob(ctx context.Context, in *AdminTaskJobInp
 	if err != nil {
 		return nil, serviceProblem(err)
 	}
-	if job.JobType != adminjob.JobTypeStorageTransition {
+	if job.JobType != adminjob.JobTypeStorageTransition && job.JobType != adminjob.JobTypeImageCacheCleanup {
 		return nil, NewProblem(TypeJobNotCancelable, "This job cannot be canceled from this endpoint")
 	}
 	canceller, ok := reg.deps.AdminTaskJobs.(interface {
@@ -192,7 +192,10 @@ func (reg *Registry) adminTaskJobOf(ctx context.Context, job *models.AdminJob, a
 			}
 			out.LibraryName = request.LibraryName
 		}
-		if job.Status == adminjob.StatusCompleted {
+		// A canceled image cache cleanup keeps the totals deleted before the
+		// cancel, so report them the same way as a completed job.
+		if job.Status == adminjob.StatusCompleted ||
+			(job.JobType == adminjob.JobTypeImageCacheCleanup && job.Status == adminjob.StatusCancelled) {
 			var result AdminTaskJobLibraryResult
 			if json.Unmarshal(job.ResultPayload, &result) == nil {
 				out.LibraryResult = &result
diff --git a/internal/apiv2/admin_tasks_test.go b/internal/apiv2/admin_tasks_test.go
index 8b08c1d151..f56105c8bd 100644
--- a/internal/apiv2/admin_tasks_test.go
+++ b/internal/apiv2/admin_tasks_test.go
@@ -171,6 +171,35 @@ func TestStorageTransitionJobCancellationContract(t *testing.T) {
 	}
 }
 
+func TestImageCacheCleanupJobCanBeCanceled(t *testing.T) {
+	job := &models.AdminJob{ID: "cleanup", JobType: adminjob.JobTypeImageCacheCleanup, Status: adminjob.StatusRunning, RequestedAt: fixedTime()}
+	deps, _ := libraryDeps(t)
+	deps.AdminTaskJobs = &fakeStorageTransitionJobs{job: job}
+	h := newTestHandler(t, deps)
+	cancel := Prefix + "/admin/jobs/cleanup/cancel"
+
+	var body AdminTaskJob
+	response := do(t, h, http.MethodPost, cancel, "", bearer(adminToken))
+	decodeJSON(t, response.Body, &body)
+	if response.Code != http.StatusAccepted || body.State != "canceling" || !body.Cancelable {
+		t.Fatalf("pending cleanup cancellation: %d %s", response.Code, response.Body)
+	}
+	job.Status = adminjob.StatusCancelled
+	job.ProgressCurrent, job.ProgressTotal = 3, 8
+	job.ResultPayload = []byte(`{"deleted_prefixes":3,"deleted_s3_objects":5}`)
+	response = do(t, h, http.MethodPost, cancel, "", bearer(adminToken))
+	decodeJSON(t, response.Body, &body)
+	if response.Code != http.StatusOK || body.State != "canceled" || body.Cancelable {
+		t.Fatalf("already canceled cleanup: %d %s", response.Code, response.Body)
+	}
+	if body.LibraryResult == nil || body.LibraryResult.DeletedPrefixes != 3 || body.LibraryResult.DeletedS3Objects != 5 {
+		t.Fatalf("canceled cleanup lost its partial totals: %s", response.Body)
+	}
+	if body.Progress == nil || body.Progress.Current != 3 || body.Progress.Total != 8 {
+		t.Fatalf("canceled cleanup progress: %s", response.Body)
+	}
+}
+
 func TestStorageTransitionJobProjectsSafeProgressAndFailure(t *testing.T) {
 	job := &models.AdminJob{
 		ID: "transition", JobType: adminjob.JobTypeStorageTransition, Status: adminjob.StatusRunning,
diff --git a/internal/apiv2/admin_users.go b/internal/apiv2/admin_users.go
index db1906e7a2..0234f31da9 100644
--- a/internal/apiv2/admin_users.go
+++ b/internal/apiv2/admin_users.go
@@ -20,6 +20,7 @@ type EffectivePolicy struct {
 	MaxTranscodes              int          `json:"max_transcodes" doc:"Concurrent transcode limit; 0 means unlimited" example:"0"`
 	MaxRemoteStreamBitrateKbps int          `json:"max_remote_stream_bitrate_kbps" minimum:"0" doc:"Remote per-stream bitrate limit in kbps; 0 means unlimited" example:"0"`
 	MaxLocalStreamBitrateKbps  int          `json:"max_local_stream_bitrate_kbps" minimum:"0" doc:"Local per-stream bitrate limit in kbps; 0 means unlimited" example:"0"`
+	MaxProfiles                int          `json:"max_profiles" minimum:"1" doc:"Household profile limit" example:"5"`
 	TranscodeAllowed           bool         `json:"transcode_allowed" example:"true"`
 	AudioTranscodeAllowed      bool         `json:"audio_transcode_allowed" example:"false"`
 	DownloadAllowed            bool         `json:"download_allowed" example:"true"`
@@ -45,7 +46,7 @@ type AdminUser struct {
 	MaxLocalStreamBitrateKbps  *int            `json:"max_local_stream_bitrate_kbps" nullable:"true" minimum:"0" doc:"Local per-stream bitrate override in kbps; null inherits, 0 means unlimited" example:"0"`
 	TranscodeAllowed           *bool           `json:"transcode_allowed" nullable:"true" doc:"Override; null inherits" example:"true"`
 	AudioTranscodeAllowed      *bool           `json:"audio_transcode_allowed" nullable:"true" doc:"Override; null inherits" example:"false"`
-	MaxProfiles                int             `json:"max_profiles" doc:"Household profile limit" example:"5"`
+	MaxProfiles                *int            `json:"max_profiles" nullable:"true" minimum:"1" doc:"Household profile limit override; null inherits the access group's limit" example:"5"`
 	DownloadAllowed            *bool           `json:"download_allowed" nullable:"true" doc:"Override; null inherits" example:"true"`
 	DownloadTranscodeAllowed   *bool           `json:"download_transcode_allowed" nullable:"true" doc:"Override; null inherits" example:"false"`
 	RequestsAllowed            *bool           `json:"requests_allowed" nullable:"true" doc:"Override; null inherits" example:"false"`
@@ -167,7 +168,7 @@ func adminUserFromView(v handlers.AdminUserView) AdminUser {
 		MaxLocalStreamBitrateKbps:  v.MaxLocalStreamBitrateKbps,
 		TranscodeAllowed:           v.TranscodeAllowed,
 		AudioTranscodeAllowed:      v.AudioTranscodeAllowed,
-		MaxProfiles:                v.MaxProfiles,
+		MaxProfiles:                v.MaxProfilesOverride,
 		DownloadAllowed:            v.DownloadAllowed,
 		DownloadTranscodeAllowed:   v.DownloadTranscodeAllowed,
 		RequestsAllowed:            v.RequestsAllowed,
@@ -182,6 +183,7 @@ func adminUserFromView(v handlers.AdminUserView) AdminUser {
 			MaxTranscodes:              v.EffectivePolicy.MaxTranscodes,
 			MaxRemoteStreamBitrateKbps: v.EffectivePolicy.MaxRemoteStreamBitrateKbps,
 			MaxLocalStreamBitrateKbps:  v.EffectivePolicy.MaxLocalStreamBitrateKbps,
+			MaxProfiles:                v.EffectivePolicy.MaxProfiles,
 			TranscodeAllowed:           v.EffectivePolicy.TranscodeAllowed,
 			AudioTranscodeAllowed:      v.EffectivePolicy.AudioTranscodeAllowed,
 			DownloadAllowed:            v.EffectivePolicy.DownloadAllowed,
diff --git a/internal/apiv2/artwork_query.go b/internal/apiv2/artwork_query.go
new file mode 100644
index 0000000000..5ea1c060bd
--- /dev/null
+++ b/internal/apiv2/artwork_query.go
@@ -0,0 +1,64 @@
+package apiv2
+
+import (
+	"strings"
+
+	"github.com/prairie-server/prairie-server/internal/imagesize"
+)
+
+// ArtworkQuery is how a client sizes a response's artwork: one image_size for
+// every image, and per-slot target widths that override it for their slot.
+// A slot is named for the response field, so backdrop_width governs an
+// episode's backdrop_url even when that holds the episode's still. Embed it in
+// an operation's input to accept both; see docs/images-api.md.
+type ArtworkQuery struct {
+	ImageSize     string `query:"image_size" enum:"small,medium,large,original" doc:"Artwork size for every image in the response; absent picks each surface's default" example:"medium"`
+	PosterWidth   int    `query:"poster_width" minimum:"1" maximum:"7680" doc:"Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original" example:"352"`
+	BackdropWidth int    `query:"backdrop_width" minimum:"1" maximum:"7680" doc:"Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops" example:"2688"`
+	LogoWidth     int    `query:"logo_width" minimum:"1" maximum:"7680" doc:"Width in device pixels the client draws logo_url at. Overrides image_size for logos" example:"1760"`
+	StillWidth    int    `query:"still_width" minimum:"1" maximum:"7680" doc:"Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills" example:"720"`
+	PhotoWidth    int    `query:"photo_width" minimum:"1" maximum:"7680" doc:"Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots" example:"400"`
+}
+
+// Artwork is the request's artwork preference. image_size is enum-validated
+// before a handler runs, so a value that fails to parse here is absent.
+func (q ArtworkQuery) Artwork() imagesize.Request {
+	size, err := imagesize.Parse(q.ImageSize)
+	if err != nil {
+		size = imagesize.Unset
+	}
+	return imagesize.Request{Size: size, Widths: imagesize.Widths{
+		Poster:   q.PosterWidth,
+		Backdrop: q.BackdropWidth,
+		Logo:     q.LogoWidth,
+		Still:    q.StillWidth,
+		Photo:    q.PhotoWidth,
+	}}
+}
+
+// widthsCursorFilter extends a pagination cursor's binding to image_size with
+// the slot widths, so a continuation cannot mix sizes within one listing. It
+// is empty without widths, which keeps cursors issued before they existed
+// valid.
+func (q ArtworkQuery) widthsCursorFilter() string {
+	if widths := q.Artwork().Widths.Encode(); widths != "" {
+		return "&image_widths=" + widths
+	}
+	return ""
+}
+
+// isArtworkQueryLocation reports whether a validation error points at one of
+// the ArtworkQuery parameters, which stay query parameters even on operations
+// whose other inputs travel in the body.
+func isArtworkQueryLocation(location string) bool {
+	name, ok := strings.CutPrefix(location, "query.")
+	if !ok {
+		return false
+	}
+	switch name {
+	case "image_size", "poster_width", "backdrop_width", "logo_width", "still_width", "photo_width":
+		return true
+	default:
+		return false
+	}
+}
diff --git a/internal/apiv2/branding.go b/internal/apiv2/branding.go
index 86cfa5c9d8..935077ebbe 100644
--- a/internal/apiv2/branding.go
+++ b/internal/apiv2/branding.go
@@ -9,8 +9,6 @@ import (
 
 	"github.com/danielgtaylor/huma/v2"
 	"github.com/go-chi/chi/v5"
-
-	"github.com/prairie-server/prairie-server/internal/api/handlers"
 	"github.com/prairie-server/prairie-server/internal/branding"
 )
 
@@ -19,9 +17,6 @@ type BrandingService interface {
 	Load(context.Context) branding.Snapshot
 	GetAsset(context.Context, branding.AssetKind) ([]byte, string, string, error)
 }
-type ThemeOverrideService interface {
-	AdminCSS(context.Context) handlers.AdminCSSView
-}
 type BrandingConfiguration struct {
 	ServerName       string `json:"server_name"`
 	LoginSubtitle    string `json:"login_subtitle"`
@@ -33,11 +28,6 @@ type BrandingConfiguration struct {
 	StorageAvailable bool   `json:"storage_available"`
 }
 type BrandingOutput struct{ Body BrandingConfiguration }
-type ThemeOverrides struct {
-	Vars   string `json:"vars"`
-	RawCSS string `json:"raw_css"`
-}
-type ThemeOverridesOutput struct{ Body ThemeOverrides }
 type BrandingCapabilitiesOutput struct {
 	Status       int
 	ETag         string `header:"ETag"`
@@ -47,9 +37,8 @@ type BrandingCapabilitiesOutput struct {
 
 type BrandingCapabilitiesOutputBody struct {
 	Capability
-	BrandingAvailable  bool `json:"branding_available"`
-	OverridesAvailable bool `json:"overrides_available"`
-	StorageAvailable   bool `json:"storage_available"`
+	BrandingAvailable bool `json:"branding_available"`
+	StorageAvailable  bool `json:"storage_available"`
 }
 
 func brandingAssetURL(snap branding.Snapshot, kind branding.AssetKind) string {
@@ -66,7 +55,6 @@ func registerBranding(reg *Registry) {
 	Register(reg, op("/theme/capabilities", "getBrandingCapabilities", "Discover public branding and asset storage availability."), func(_ context.Context, _ *CapabilityInput) (*BrandingCapabilitiesOutput, error) {
 		out := new(BrandingCapabilitiesOutput)
 		out.Body.BrandingAvailable = reg.deps.Branding != nil
-		out.Body.OverridesAvailable = reg.deps.ThemeOverrides != nil
 		out.Body.StorageAvailable = reg.deps.Branding != nil && reg.deps.Branding.HasStorage()
 		return out, nil
 	})
@@ -79,13 +67,6 @@ func registerBranding(reg *Registry) {
 		}
 		return &BrandingOutput{Body: BrandingConfiguration{ServerName: snap.ServerName, LoginSubtitle: snap.LoginSubtitle, AccentColor: snap.AccentColor, WordmarkURL: brandingAssetURL(snap, branding.KindWordmark), MarkURL: brandingAssetURL(snap, branding.KindMark), FaviconURL: brandingAssetURL(snap, branding.KindFavicon), LoginBgURL: brandingAssetURL(snap, branding.KindLoginBg), StorageAvailable: storage}}, nil
 	})
-	Register(reg, op("/theme/admin-css", "getThemeOverrides", "Read public pre-login theme overrides."), func(ctx context.Context, _ *struct{}) (*ThemeOverridesOutput, error) {
-		view := handlers.AdminCSSView{}
-		if reg.deps.ThemeOverrides != nil {
-			view = reg.deps.ThemeOverrides.AdminCSS(ctx)
-		}
-		return &ThemeOverridesOutput{Body: ThemeOverrides{Vars: view.Vars, RawCSS: view.RawCSS}}, nil
-	})
 	for _, method := range []string{http.MethodGet, http.MethodHead} {
 		id := "getBrandingAsset"
 		if method == http.MethodHead {
diff --git a/internal/apiv2/branding_test.go b/internal/apiv2/branding_test.go
index a69aaeb96b..3ed9c1d27f 100644
--- a/internal/apiv2/branding_test.go
+++ b/internal/apiv2/branding_test.go
@@ -29,8 +29,8 @@ func (brandingAssets) Stat(context.Context, string) (blobstore.ObjectInfo, error
 	return blobstore.ObjectInfo{}, nil
 }
 func brandingHandler() http.Handler {
-	settings := brandingSettings{branding.KeyServerName: "Synthetic Server", "branding.favicon_ref": "abc.svg", "ui.admin_theme_vars": `{"--primary":"red"}`, "ui.admin_custom_css": "body { color: red; }"}
-	return NewHandler(Dependencies{Branding: branding.NewService(settings, brandingAssets{}), ThemeOverrides: handlers.NewThemeHandler(settings)})
+	settings := brandingSettings{branding.KeyServerName: "Synthetic Server", "branding.favicon_ref": "abc.svg", branding.KeyAccentColor: "#5bc39d"}
+	return NewHandler(Dependencies{Branding: branding.NewService(settings, brandingAssets{})})
 }
 func TestBrandingPublicDiscovery(t *testing.T) {
 	h := brandingHandler()
@@ -42,10 +42,11 @@ func TestBrandingPublicDiscovery(t *testing.T) {
 	if got.Code != 200 || body.ServerName != "Synthetic Server" || body.FaviconURL != Prefix+"/branding/assets/favicon?v=abc.svg" || !body.StorageAvailable {
 		t.Fatal(got.Code, got.Body.String())
 	}
-	css := do(t, h, "GET", Prefix+"/theme/admin-css", "", nil)
-	if css.Code != 200 || !strings.Contains(css.Body.String(), "body { color: red; }") {
-		t.Fatal(css.Code, css.Body.String())
+	if body.AccentColor != "#5bc39d" {
+		t.Fatal(got.Body.String())
 	}
+	// v2 has no theme overrides.
+	requireProblem(t, do(t, h, "GET", Prefix+"/theme/admin-css", "", nil), TypeNotFound)
 	fallback := do(t, NewHandler(Dependencies{}), "GET", Prefix+"/theme/branding", "", nil)
 	if err := json.Unmarshal(fallback.Body.Bytes(), &body); err != nil {
 		t.Fatal(err)
diff --git a/internal/apiv2/canceled_response_test.go b/internal/apiv2/canceled_response_test.go
new file mode 100644
index 0000000000..a5dcf8958e
--- /dev/null
+++ b/internal/apiv2/canceled_response_test.go
@@ -0,0 +1,115 @@
+package apiv2
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"encoding/json"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+)
+
+// A server error raised by the client's own cancellation is still written, but
+// it is recorded as abandoned, not counted as a 5xx: the client has gone.
+// Every other failure is recorded with its status.
+func TestCanceledClientServerErrorIsAbandoned(t *testing.T) {
+	canceled := func() context.Context {
+		ctx, cancel := context.WithCancel(context.Background())
+		cancel()
+		return ctx
+	}
+	expired := func() context.Context {
+		ctx, cancel := context.WithDeadline(context.Background(), time.Now().Add(-time.Second))
+		t.Cleanup(cancel)
+		return ctx
+	}
+	for _, tc := range []struct {
+		name       string
+		ctx        func() context.Context
+		problem    ProblemType
+		wantSent   int
+		wantLogged float64
+		wantClass  string
+	}{
+		{"client gone", canceled, TypeInternalError, http.StatusInternalServerError, 0, "abandoned"},
+		{"client gone, unavailable", canceled, TypeDependencyUnavailable, http.StatusServiceUnavailable, 0, "abandoned"},
+		{"client gone, body read timeout", canceled, TypeRequestTimeout, http.StatusRequestTimeout, http.StatusRequestTimeout, "4xx"},
+		{"client waiting", context.Background, TypeInternalError, http.StatusInternalServerError, http.StatusInternalServerError, "5xx"},
+		{"deadline", expired, TypeInternalError, http.StatusInternalServerError, http.StatusInternalServerError, "5xx"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			logs := captureLogs(t)
+			h := observe(bufferResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				writeProblem(w, r, NewProblem(tc.problem, "An unexpected error occurred."))
+			})))
+			w := httptest.NewRecorder()
+			h.ServeHTTP(w, httptest.NewRequest(http.MethodGet, Prefix+"/libraries", nil).WithContext(tc.ctx()))
+			if w.Code != tc.wantSent || w.Body.Len() == 0 {
+				t.Fatalf("sent %d with %d body bytes, want the %d problem", w.Code, w.Body.Len(), tc.wantSent)
+			}
+			var line struct {
+				Msg    string  `json:"msg"`
+				Status float64 `json:"status"`
+				Class  string  `json:"status_class"`
+			}
+			for _, raw := range bytes.Split(logs.Bytes(), []byte("\n")) {
+				if bytes.Contains(raw, []byte(`"msg":"apiv2 request"`)) {
+					if err := json.Unmarshal(raw, &line); err != nil {
+						t.Fatal(err)
+					}
+				}
+			}
+			if line.Msg != "apiv2 request" {
+				t.Fatalf("no request log line: %q", logs.String())
+			}
+			if line.Status != tc.wantLogged || line.Class != tc.wantClass {
+				t.Fatalf("logged status %v class %q, want %v %q", line.Status, line.Class, tc.wantLogged, tc.wantClass)
+			}
+		})
+	}
+}
+
+// net/http cancels the request context when an HTTP/1.1 client half-closes
+// its side, though that client is still reading. Its server error has to
+// arrive: a handler that writes nothing gets net/http's empty 200 instead.
+func TestHalfClosedClientGetsServerError(t *testing.T) {
+	handlerDone := make(chan error, 1)
+	srv := httptest.NewServer(observe(bufferResponse(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = io.Copy(io.Discard, r.Body)
+		<-r.Context().Done() // the half-close has reached the server
+		handlerDone <- r.Context().Err()
+		writeProblem(w, r, NewProblem(TypeInternalError, "An unexpected error occurred."))
+	}))))
+	t.Cleanup(srv.Close)
+
+	conn, err := net.Dial("tcp", srv.Listener.Addr().String())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = conn.Close() })
+	if _, err := io.WriteString(conn, "POST "+Prefix+"/libraries HTTP/1.1\r\nHost: prairie\r\nContent-Type: application/json\r\nContent-Length: 2\r\n\r\n{}"); err != nil {
+		t.Fatal(err)
+	}
+	if err := conn.(*net.TCPConn).CloseWrite(); err != nil {
+		t.Fatal(err)
+	}
+	if err := conn.SetReadDeadline(time.Now().Add(5 * time.Second)); err != nil {
+		t.Fatal(err)
+	}
+	resp, err := http.ReadResponse(bufio.NewReader(conn), nil)
+	if err != nil {
+		t.Fatalf("reading response: %v", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	body, _ := io.ReadAll(resp.Body)
+	if ctxErr := <-handlerDone; ctxErr != context.Canceled { //nolint:errorlint // net/http cancels with the bare sentinel
+		t.Fatalf("request context ended with %v, want context.Canceled", ctxErr)
+	}
+	if resp.StatusCode != http.StatusInternalServerError || len(body) == 0 {
+		t.Fatalf("half-closed client got %s with body %q, want the 500 problem", resp.Status, body)
+	}
+}
diff --git a/internal/apiv2/catalog_actions.go b/internal/apiv2/catalog_actions.go
index 4a1b61499d..db78bf7f1e 100644
--- a/internal/apiv2/catalog_actions.go
+++ b/internal/apiv2/catalog_actions.go
@@ -12,6 +12,7 @@ import (
 
 	"github.com/prairie-server/prairie-server/internal/api/handlers"
 	catalogpkg "github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/imagesize"
 	"github.com/prairie-server/prairie-server/internal/literaryworks"
 	"github.com/prairie-server/prairie-server/internal/metadata/translation"
 )
@@ -35,7 +36,7 @@ type TranslateDescriptionInput struct {
 
 // TranslateDescription names the language the viewer wants.
 type TranslateDescription struct {
-	TargetLanguage string `json:"target_language" minLength:"1" maxLength:"16" doc:"BCP 47 tag of the wanted language, as the detail document's pending_translation_language reported it" example:"de"`
+	TargetLanguage string `json:"target_language" minLength:"1" maxLength:"16" doc:"BCP 47 tag of the wanted language, exactly as this profile's detail document reported it in pending_translation_language. Any other language, or a target with nothing left to translate, is refused with 422 at body.target_language." example:"de"`
 }
 
 // PeopleSearchInput is the listPeople query.
@@ -97,7 +98,7 @@ type TrailerRefreshOutput struct {
 // and how the viewer-facing on-view translation behaves.
 type MetadataAICapability struct {
 	Capability
-	OnView string `json:"on_view" doc:"Viewer-triggered translation mode: off, button (the detail page offers the action), or auto (the server queues it on view)" example:"button"`
+	OnView string `json:"on_view" doc:"Viewer-triggered translation mode: off, button (the detail page offers the action), or auto (the client requests the translation itself when it shows an item whose pending_translation_language is set)" example:"button"`
 }
 
 // MetadataAICapabilityOutput is the getMetadataAICapability response.
@@ -111,7 +112,7 @@ type MetadataAICapabilityOutput struct {
 // MetadataTranslationJob is one queued or running translation.
 type MetadataTranslationJob struct {
 	ID              ID      `json:"id" example:"42"`
-	TargetKind      string  `json:"target_kind" doc:"item, season, or episode"`
+	TargetKind      string  `json:"target_kind" doc:"item, season, episode, or library (a prewarm, whose fields_done and fields_total count items)"`
 	ContentID       string  `json:"content_id"`
 	IncludeChildren bool    `json:"include_children"`
 	SourceLanguage  string  `json:"source_language"`
@@ -123,7 +124,7 @@ type MetadataTranslationJob struct {
 	ProgressMessage string  `json:"progress_message"`
 	FieldsDone      int     `json:"fields_done"`
 	FieldsTotal     int     `json:"fields_total"`
-	Force           bool    `json:"force"`
+	Force           bool    `json:"force" doc:"The job also replaces earlier AI text; provider and manual text is never replaced"`
 	ErrorMessage    string  `json:"error_message,omitempty"`
 	CreatedAt       Instant `json:"created_at"`
 	UpdatedAt       Instant `json:"updated_at"`
@@ -269,9 +270,9 @@ func registerCatalogActions(reg *Registry) {
 	Register(reg, viewerOperation(humaOp(http.MethodGet, Prefix+"/capabilities/metadata-ai", "getMetadataAICapability", "catalog",
 		"Whether AI metadata translation is configured and how the viewer-facing on-view translation behaves.")), reg.getMetadataAICapability)
 	translate := humaOp(http.MethodPost, Prefix+"/catalog/items/{id}/translate-description", "translateCatalogItemDescription", "catalog",
-		"Queue a translation of the item's descriptions into the language the detail document reported missing; answers 202 with the job.")
+		"Queue a translation of the descriptions a page shows into the language its detail document reported missing: a movie's or series' own overview and tagline, a season's overview and its episodes' overviews, or one episode. Answers 202 with the job.")
 	translate.DefaultStatus = http.StatusAccepted
-	translate.Errors = []int{http.StatusConflict}
+	translate.Errors = []int{http.StatusConflict, http.StatusTooManyRequests}
 	translateOperation := viewerOperation(translate)
 	translateOperation.RetrySafety = RetrySafetyCoalescing
 	Register(reg, translateOperation, reg.translateCatalogItemDescription)
@@ -376,7 +377,7 @@ func (reg *Registry) translateCatalogItemDescription(ctx context.Context, in *Tr
 	if userID != 0 {
 		requestedBy = &userID
 	}
-	viewer, p := reg.itemViewer(ctx, "", "", "")
+	viewer, p := reg.itemViewer(ctx, imagesize.Request{}, "", "")
 	if p != nil {
 		return nil, p
 	}
diff --git a/internal/apiv2/catalog_actions_test.go b/internal/apiv2/catalog_actions_test.go
index fcdb35ebe6..3982ad8931 100644
--- a/internal/apiv2/catalog_actions_test.go
+++ b/internal/apiv2/catalog_actions_test.go
@@ -91,7 +91,7 @@ func (f *fakeCatalogActions) SearchPeopleScoped(_ context.Context, query string,
 	f.lastUser = limit
 	f.lastMediaScope = mediaScope
 	f.lastFilter = filter
-	if strings.HasPrefix("al pacino", strings.ToLower(query)) {
+	if strings.HasPrefix("al pacino", strings.ToLower(query)) { //nolint:gocritic // the fake matches a typed prefix of the name
 		return []handlers.PersonView{fakePerson(7)}, nil
 	}
 	return nil, nil
diff --git a/internal/apiv2/catalog_items.go b/internal/apiv2/catalog_items.go
index 853c4eacdc..da899b1b3c 100644
--- a/internal/apiv2/catalog_items.go
+++ b/internal/apiv2/catalog_items.go
@@ -15,6 +15,7 @@ import (
 	"github.com/prairie-server/prairie-server/internal/api/handlers"
 	catalogpkg "github.com/prairie-server/prairie-server/internal/catalog"
 	"github.com/prairie-server/prairie-server/internal/config"
+	"github.com/prairie-server/prairie-server/internal/ctxerr"
 	"github.com/prairie-server/prairie-server/internal/imagesize"
 	"github.com/prairie-server/prairie-server/internal/models"
 	"github.com/prairie-server/prairie-server/internal/ratingsources"
@@ -47,7 +48,7 @@ type CatalogBrowseInput struct {
 	Sort          string   `query:"sort" doc:"sort=field or -field; one term. Fields: title, year, release_date, added_at, rating, runtime, random, … (see the filters document); absent applies the source's saved or default order" example:"-release_date"`
 	Group         string   `query:"group" enum:"work" doc:"group=work collapses editions of one book into one card"`
 	SkipTotal     bool     `query:"skip_total" doc:"true skips the exact count; the total is then an estimate"`
-	ImageSize     string   `query:"image_size" enum:"small,medium,large,original" doc:"Artwork variant to presign"`
+	ArtworkQuery
 	LimitParam
 	Cursor      string `query:"cursor" doc:"Opaque cursor from page.next_cursor"`
 	Groups      string `query:"groups" maxLength:"32768" doc:"JSON array of structured rule groups; use POST catalog/query for larger queries"`
@@ -85,7 +86,7 @@ type AudiobookGroupsInput struct {
 	Sort      string `query:"sort" enum:"name,count,duration" doc:"Default name"`
 	Q         string `query:"q" doc:"Case-insensitive prefix on the group name"`
 	SkipTotal bool   `query:"skip_total" doc:"true skips the exact count; the total is then an estimate"`
-	ImageSize string `query:"image_size" enum:"small,medium,large,original"`
+	ArtworkQuery
 	LimitParam
 	Cursor string `query:"cursor" doc:"Opaque cursor from page.next_cursor"`
 }
@@ -93,8 +94,8 @@ type AudiobookGroupsInput struct {
 // CatalogQueryInput is the queryCatalogItems request: the JSON form of a
 // filtered, sorted page.
 type CatalogQueryInput struct {
-	ImageSize string `query:"image_size" enum:"small,medium,large,original"`
-	Body      CatalogQuery
+	ArtworkQuery
+	Body CatalogQuery
 }
 
 // CatalogQuery is the queryCatalogItems body.
@@ -135,10 +136,10 @@ type CatalogQueryRule struct {
 
 // CatalogItemInput names one item.
 type CatalogItemInput struct {
-	ID        string `path:"id" doc:"Content id" example:"movie:heat-1995"`
-	ImageSize string `query:"image_size" enum:"small,medium,large,original"`
-	LibraryID ID     `query:"library_id" doc:"The library the item is being viewed in; picks its presentation when the item is in several"`
-	FileID    ID     `query:"file_id" doc:"The version the viewer selected; affects the effective playback answer"`
+	ID string `path:"id" doc:"Content id" example:"movie:heat-1995"`
+	ArtworkQuery
+	LibraryID ID `query:"library_id" doc:"The library the item is being viewed in; picks its presentation when the item is in several"`
+	FileID    ID `query:"file_id" doc:"The version the viewer selected; affects the effective playback answer"`
 }
 
 // CatalogItemDeviceInput names one item whose answer carries the effective
@@ -151,9 +152,9 @@ type CatalogItemDeviceInput struct {
 
 // CatalogSeriesInput names one series.
 type CatalogSeriesInput struct {
-	ID        string `path:"id" doc:"Series content id" example:"series:severance"`
-	ImageSize string `query:"image_size" enum:"small,medium,large,original"`
-	LibraryID ID     `query:"library_id" doc:"The library the series is being viewed in"`
+	ID string `path:"id" doc:"Series content id" example:"series:severance"`
+	ArtworkQuery
+	LibraryID ID `query:"library_id" doc:"The library the series is being viewed in"`
 }
 
 // CatalogSeasonsInput selects artwork for a season list.
@@ -370,7 +371,6 @@ type CatalogItemDetail struct {
 	SortTitle                       string                               `json:"sort_title,omitempty"`
 	OriginalTitle                   string                               `json:"original_title,omitempty"`
 	Tagline                         string                               `json:"tagline,omitempty"`
-	PendingTranslationLanguage      string                               `json:"pending_translation_language,omitempty" doc:"A translation of the overview is queued for this language"`
 	ImdbID                          string                               `json:"imdb_id,omitempty"`
 	TmdbID                          string                               `json:"tmdb_id,omitempty"`
 	TvdbID                          string                               `json:"tvdb_id,omitempty"`
@@ -451,6 +451,11 @@ func catalogRatingsOf(d *catalogpkg.ItemDetail, sel ratingsources.Selection) []C
 			item.Sources[source.Source] = source.Score
 		}
 	}
+	return builtRatingsOf(item, sel)
+}
+
+// builtRatingsOf renders item's ratings, keeping only the sources sel shows.
+func builtRatingsOf(item ratingsources.Item, sel ratingsources.Selection) []CatalogRating {
 	built := ratingsources.Build(item, sel)
 	out := make([]CatalogRating, 0, len(built))
 	for _, r := range built {
@@ -529,22 +534,25 @@ type EpisodeFile struct {
 
 // Episode is one episode row of a season listing.
 type Episode struct {
-	ContentID           string              `json:"content_id" example:"episode:severance-s01e01"`
-	SeasonNumber        int                 `json:"season_number"`
-	EpisodeNumber       int                 `json:"episode_number"`
-	Title               string              `json:"title"`
-	Overview            string              `json:"overview,omitempty"`
-	AirDate             *string             `json:"air_date,omitempty" doc:"Calendar date, YYYY-MM-DD"`
-	Runtime             int                 `json:"runtime" doc:"Minutes"`
-	ImdbID              string              `json:"imdb_id,omitempty"`
-	TmdbID              string              `json:"tmdb_id,omitempty"`
-	TvdbID              string              `json:"tvdb_id,omitempty"`
-	StillIsEpisodeStill *bool               `json:"still_is_episode_still,omitempty" doc:"Whether still_url is an episode still. False when series artwork is used as a fallback; absent when provenance is unavailable."`
-	StillURL            string              `json:"still_url,omitempty" doc:"Presigned, short-lived"`
-	StillThumbhash      string              `json:"still_thumbhash,omitempty"`
-	UserData            *WatchRollup        `json:"user_data,omitempty"`
-	Files               []EpisodeFile       `json:"files,omitempty"`
-	OverlaySummary      *CatalogItemOverlay `json:"overlay_summary,omitempty"`
+	ContentID                  string              `json:"content_id" example:"episode:severance-s01e01"`
+	SeasonNumber               int                 `json:"season_number"`
+	EpisodeNumber              int                 `json:"episode_number"`
+	Title                      string              `json:"title"`
+	Overview                   string              `json:"overview,omitempty"`
+	AirDate                    *string             `json:"air_date,omitempty" doc:"Calendar date, YYYY-MM-DD"`
+	Runtime                    int                 `json:"runtime" doc:"Minutes"`
+	ImdbID                     string              `json:"imdb_id,omitempty"`
+	TmdbID                     string              `json:"tmdb_id,omitempty"`
+	TvdbID                     string              `json:"tvdb_id,omitempty"`
+	Ratings                    []CatalogRating     `json:"ratings,omitempty" doc:"The episode's IMDb and TMDB ratings, in the shape a title page's ratings use. Absent when the episode has no rating."`
+	StillIsEpisodeStill        *bool               `json:"still_is_episode_still,omitempty" doc:"Whether still_url is an episode still. False when series artwork is used as a fallback; absent when provenance is unavailable."`
+	StillURL                   string              `json:"still_url,omitempty" doc:"Presigned, short-lived"`
+	StillThumbhash             string              `json:"still_thumbhash,omitempty"`
+	UserData                   *WatchRollup        `json:"user_data,omitempty"`
+	Files                      []EpisodeFile       `json:"files,omitempty"`
+	OverlaySummary             *CatalogItemOverlay `json:"overlay_summary,omitempty"`
+	MachineTranslatedFields    []string            `json:"machine_translated_fields,omitempty" enum:"overview" doc:"Localized fields whose text was machine-translated by AI; absent when none were"`
+	PendingTranslationLanguage string              `json:"pending_translation_language,omitempty" doc:"The language this profile reads here (its metadata language, or the library's when it sets none) when the episode's description is not available in it yet; translating the episode's season fills it"`
 }
 
 // EpisodeCollection is the episodes of one season.
@@ -559,17 +567,18 @@ type EpisodeCollectionOutput struct {
 
 // Season is one season row.
 type Season struct {
-	ContentID       string       `json:"content_id" example:"series:severance-S01"`
-	PlayContentID   string       `json:"play_content_id,omitempty" doc:"The episode to play next"`
-	SeasonNumber    int          `json:"season_number"`
-	IsSpecials      bool         `json:"is_specials,omitempty"`
-	Title           string       `json:"title" example:"Season 1"`
-	Overview        string       `json:"overview,omitempty"`
-	AirDate         *string      `json:"air_date,omitempty" doc:"Calendar date, YYYY-MM-DD"`
-	EpisodeCount    int          `json:"episode_count"`
-	PosterURL       string       `json:"poster_url,omitempty" doc:"Presigned, short-lived"`
-	PosterThumbhash string       `json:"poster_thumbhash,omitempty"`
-	UserData        *WatchRollup `json:"user_data,omitempty"`
+	ContentID               string       `json:"content_id" example:"series:severance-S01"`
+	PlayContentID           string       `json:"play_content_id,omitempty" doc:"The episode to play next"`
+	SeasonNumber            int          `json:"season_number"`
+	IsSpecials              bool         `json:"is_specials,omitempty"`
+	Title                   string       `json:"title" example:"Season 1"`
+	Overview                string       `json:"overview,omitempty"`
+	AirDate                 *string      `json:"air_date,omitempty" doc:"Calendar date, YYYY-MM-DD"`
+	EpisodeCount            int          `json:"episode_count"`
+	PosterURL               string       `json:"poster_url,omitempty" doc:"Presigned, short-lived"`
+	PosterThumbhash         string       `json:"poster_thumbhash,omitempty"`
+	UserData                *WatchRollup `json:"user_data,omitempty"`
+	MachineTranslatedFields []string     `json:"machine_translated_fields,omitempty" enum:"overview" doc:"Localized fields whose text was machine-translated by AI; absent when none were"`
 }
 
 // SeasonCollection is the seasons of a series.
@@ -590,11 +599,10 @@ type SeasonOutput struct {
 // --- registration ---
 
 const (
-	opListCatalogItems     = "listCatalogItems"
-	opQueryCatalogItems    = "queryCatalogItems"
-	locationQueryImageSize = "query.image_size"
-	locationQueryGroups    = "query.groups"
-	opListAudiobookGroups  = "listAudiobookGroups"
+	opListCatalogItems    = "listCatalogItems"
+	opQueryCatalogItems   = "queryCatalogItems"
+	locationQueryGroups   = "query.groups"
+	opListAudiobookGroups = "listAudiobookGroups"
 )
 
 func registerCatalogItems(reg *Registry) {
@@ -662,14 +670,14 @@ func (reg *Registry) catalogItems() (CatalogItemService, *Problem) {
 // context, access policy from the access seam, artwork size and
 // presentation hints from the query. The filter carries no device id; reads
 // that resolve device-scoped preferences use itemViewerOnDevice.
-func (reg *Registry) itemViewer(ctx context.Context, imageSize string, libraryID, fileID ID) (handlers.ItemViewer, *Problem) {
-	return reg.itemViewerOnDevice(ctx, "", imageSize, libraryID, fileID)
+func (reg *Registry) itemViewer(ctx context.Context, art imagesize.Request, libraryID, fileID ID) (handlers.ItemViewer, *Problem) {
+	return reg.itemViewerOnDevice(ctx, "", art, libraryID, fileID)
 }
 
 // itemViewerOnDevice is itemViewer for the caller's declared
 // X-Prairie-Device-Id, so device-scoped playback preferences resolve as they
 // do on v1 and in getWatchState. The id is clamped like v1's header read.
-func (reg *Registry) itemViewerOnDevice(ctx context.Context, deviceID, imageSize string, libraryID, fileID ID) (handlers.ItemViewer, *Problem) {
+func (reg *Registry) itemViewerOnDevice(ctx context.Context, deviceID string, art imagesize.Request, libraryID, fileID ID) (handlers.ItemViewer, *Problem) {
 	_, profileID, p := viewerIdentity(ctx)
 	if p != nil {
 		return handlers.ItemViewer{}, p
@@ -694,11 +702,8 @@ func (reg *Registry) itemViewerOnDevice(ctx context.Context, deviceID, imageSize
 	if err != nil {
 		return handlers.ItemViewer{}, NewProblem(TypeInternalError, "An unexpected error occurred.")
 	}
-	size, err := imagesize.Parse(imageSize)
-	if err != nil {
-		size = imagesize.Unset
-	}
-	filter.ImageSize = size
+	filter.ImageSize = art.Size
+	filter.ImageWidths = art.Widths
 	return handlers.ItemViewer{Access: filter, ProfileID: profileID}, nil
 }
 
@@ -936,7 +941,7 @@ func (reg *Registry) listCatalogItems(ctx context.Context, cursors *Cursors, in
 	if p != nil {
 		return nil, p
 	}
-	viewer, p := reg.itemViewer(ctx, in.ImageSize, "", "")
+	viewer, p := reg.itemViewer(ctx, in.Artwork(), "", "")
 	if p != nil {
 		return nil, p
 	}
@@ -974,7 +979,7 @@ func (reg *Registry) listCatalogItems(ctx context.Context, cursors *Cursors, in
 	scope := CursorScope{
 		OperationID: operationID,
 		Security:    strconv.Itoa(claims.UserID) + "/" + viewer.ProfileID + "/" + viewerScopeDigest(ctx),
-		Filter:      values.Encode() + "&group=" + in.Group + "&image_size=" + in.ImageSize,
+		Filter:      values.Encode() + "&group=" + in.Group + "&image_size=" + in.ImageSize + in.widthsCursorFilter(),
 		Sort:        req.Query.Sort.Field + "," + req.Query.Sort.Order,
 		Tiebreaker:  tiebreakerOffset,
 	}
@@ -1041,7 +1046,7 @@ func (reg *Registry) listAudiobookGroups(ctx context.Context, cursors *Cursors,
 	if p != nil {
 		return nil, p
 	}
-	viewer, p := reg.itemViewer(ctx, in.ImageSize, "", "")
+	viewer, p := reg.itemViewer(ctx, in.Artwork(), "", "")
 	if p != nil {
 		return nil, p
 	}
@@ -1054,7 +1059,7 @@ func (reg *Registry) listAudiobookGroups(ctx context.Context, cursors *Cursors,
 	scope := CursorScope{
 		OperationID: opListAudiobookGroups,
 		Security:    strconv.Itoa(claims.UserID) + "/" + viewer.ProfileID + "/" + viewerScopeDigest(ctx),
-		Filter:      "library_id=" + strconv.Itoa(libraryID) + "&group_by=" + in.GroupBy + "&q=" + in.Q + "&image_size=" + in.ImageSize + "&limit=" + strconv.Itoa(in.Limit),
+		Filter:      "library_id=" + strconv.Itoa(libraryID) + "&group_by=" + in.GroupBy + "&q=" + in.Q + "&image_size=" + in.ImageSize + in.widthsCursorFilter() + "&limit=" + strconv.Itoa(in.Limit),
 		Sort:        in.Sort,
 		Tiebreaker:  "group_key",
 	}
@@ -1097,7 +1102,7 @@ func (reg *Registry) getCatalogFilters(ctx context.Context, in *CatalogFiltersIn
 	if p != nil {
 		return nil, p
 	}
-	viewer, p := reg.itemViewer(ctx, "", "", "")
+	viewer, p := reg.itemViewer(ctx, imagesize.Request{}, "", "")
 	if p != nil {
 		return nil, p
 	}
@@ -1125,7 +1130,7 @@ func (reg *Registry) searchCatalogFacet(ctx context.Context, in *CatalogFacetSea
 	if p != nil {
 		return nil, p
 	}
-	viewer, p := reg.itemViewer(ctx, "", "", "")
+	viewer, p := reg.itemViewer(ctx, imagesize.Request{}, "", "")
 	if p != nil {
 		return nil, p
 	}
@@ -1165,13 +1170,13 @@ func (reg *Registry) queryCatalogItems(ctx context.Context, cursors *Cursors, in
 		Source: body.Source, Scope: body.Scope, SectionID: body.SectionID,
 		LibraryID: body.LibraryID, CollectionID: body.CollectionID, PersonID: body.PersonID,
 		Q: body.Q, NamePrefix: body.NamePrefix, Match: body.Match, Type: body.Type,
-		Sort: sort, Group: body.Group, SkipTotal: body.SkipTotal, ImageSize: in.ImageSize,
+		Sort: sort, Group: body.Group, SkipTotal: body.SkipTotal, ArtworkQuery: in.ArtworkQuery,
 		LimitParam: LimitParam{Limit: limit}, Cursor: body.Cursor, Groups: string(groups),
 		QueryLimit: body.QueryLimit, Seek: body.Seek, operationID: opQueryCatalogItems,
 	})
 	if p, ok := errors.AsType[*Problem](err); ok {
 		for i := range p.Errors {
-			if strings.HasPrefix(p.Errors[i].Location, "query.") && p.Errors[i].Location != locationQueryImageSize {
+			if strings.HasPrefix(p.Errors[i].Location, "query.") && !isArtworkQueryLocation(p.Errors[i].Location) {
 				p.Errors[i].Location = "body." + strings.TrimPrefix(p.Errors[i].Location, "query.")
 			}
 		}
@@ -1184,7 +1189,7 @@ func (reg *Registry) getCatalogItem(ctx context.Context, in *CatalogItemDeviceIn
 	if p != nil {
 		return nil, p
 	}
-	viewer, p := reg.itemViewerOnDevice(ctx, in.DeviceID, in.ImageSize, in.LibraryID, in.FileID)
+	viewer, p := reg.itemViewerOnDevice(ctx, in.DeviceID, in.Artwork(), in.LibraryID, in.FileID)
 	if p != nil {
 		return nil, p
 	}
@@ -1196,7 +1201,7 @@ func (reg *Registry) getCatalogItem(ctx context.Context, in *CatalogItemDeviceIn
 	if reg.deps.ThemeSongs != nil && (detail.Type == themeOwnerMovie || detail.Type == themeOwnerSeries || detail.Type == themeOwnerSeason || detail.Type == themeOwnerEpisode) {
 		themes, err := reg.deps.ThemeSongs.Discover(ctx, in.ID, true, viewer.Access)
 		if err != nil {
-			slog.WarnContext(ctx, "catalog theme lookup failed", "component", "apiv2", "item_id", in.ID, "error", err)
+			slog.Log(ctx, ctxerr.LogLevel(ctx, err, slog.LevelWarn), "catalog theme lookup failed", "component", "apiv2", "item_id", in.ID, "error", err)
 			return &CatalogItemDetailOutput{Body: out}, nil
 		}
 		out.Themes = &ThemeSongSet{OwnerID: themes.OwnerID, Items: []ThemeSong{}}
@@ -1212,7 +1217,7 @@ func (reg *Registry) listCatalogItemVersions(ctx context.Context, in *CatalogIte
 	if p != nil {
 		return nil, p
 	}
-	viewer, p := reg.itemViewerOnDevice(ctx, in.DeviceID, in.ImageSize, in.LibraryID, in.FileID)
+	viewer, p := reg.itemViewerOnDevice(ctx, in.DeviceID, in.Artwork(), in.LibraryID, in.FileID)
 	if p != nil {
 		return nil, p
 	}
@@ -1228,7 +1233,7 @@ func (reg *Registry) listCatalogItemMangaFiles(ctx context.Context, in *CatalogI
 	if p != nil {
 		return nil, p
 	}
-	viewer, p := reg.itemViewer(ctx, in.ImageSize, in.LibraryID, in.FileID)
+	viewer, p := reg.itemViewer(ctx, in.Artwork(), in.LibraryID, in.FileID)
 	if p != nil {
 		return nil, p
 	}
@@ -1249,7 +1254,7 @@ func (reg *Registry) listCatalogItemEpisodes(ctx context.Context, in *CatalogIte
 	if p != nil {
 		return nil, p
 	}
-	viewer, p := reg.itemViewer(ctx, in.ImageSize, in.LibraryID, in.FileID)
+	viewer, p := reg.itemViewer(ctx, in.Artwork(), in.LibraryID, in.FileID)
 	if p != nil {
 		return nil, p
 	}
@@ -1265,7 +1270,7 @@ func (reg *Registry) listSeriesSeasons(ctx context.Context, in *CatalogSeasonsIn
 	if p != nil {
 		return nil, p
 	}
-	viewer, p := reg.itemViewer(ctx, in.ImageSize, in.LibraryID, "")
+	viewer, p := reg.itemViewer(ctx, in.Artwork(), in.LibraryID, "")
 	if p != nil {
 		return nil, p
 	}
@@ -1285,7 +1290,7 @@ func (reg *Registry) getSeriesSeason(ctx context.Context, in *CatalogSeasonInput
 	if p != nil {
 		return nil, p
 	}
-	viewer, p := reg.itemViewer(ctx, in.ImageSize, in.LibraryID, "")
+	viewer, p := reg.itemViewer(ctx, in.Artwork(), in.LibraryID, "")
 	if p != nil {
 		return nil, p
 	}
@@ -1301,7 +1306,7 @@ func (reg *Registry) listSeasonEpisodes(ctx context.Context, in *CatalogSeasonIn
 	if p != nil {
 		return nil, p
 	}
-	viewer, p := reg.itemViewer(ctx, in.ImageSize, in.LibraryID, "")
+	viewer, p := reg.itemViewer(ctx, in.Artwork(), in.LibraryID, "")
 	if p != nil {
 		return nil, p
 	}
@@ -1385,6 +1390,7 @@ func catalogItemCardOf(d *catalogpkg.ItemDetail) CatalogItem {
 		Overview: d.Overview, ReleaseDate: d.ReleaseDate, LastAirDate: d.LastAirDate,
 		PosterURL: d.PosterURL, PosterThumbhash: d.PosterThumbhash, BackdropURL: d.BackdropURL, BackdropThumbhash: d.BackdropThumbhash, LogoURL: d.LogoURL,
 		OverlaySummary: catalogOverlayOf(d.OverlaySummary), WorkID: d.WorkID, WorkTitle: d.WorkTitle,
+		PendingTranslationLanguage: d.PendingTranslationLanguage, MachineTranslatedFields: d.MachineTranslatedFields,
 	}
 	if d.Type == themeOwnerEpisode {
 		// An episode detail's poster is its still; the still's ThumbHash is
@@ -1393,7 +1399,7 @@ func catalogItemCardOf(d *catalogpkg.ItemDetail) CatalogItem {
 		card.BackdropIsEpisodeStill = new(false)
 	}
 	if s := d.UserState; s != nil {
-		card.UserState = &CatalogItemUserState{Played: s.Played, IsFavorite: s.IsFavorite, InWatchlist: s.InWatchlist}
+		card.UserState = &CatalogItemUserState{Played: s.Played, IsFavorite: s.IsFavorite, InWatchlist: s.InWatchlist, NotInterested: s.NotInterested}
 	}
 	for _, f := range d.WorkFormats {
 		card.WorkFormats = append(card.WorkFormats, CatalogWorkFormat{Type: f.Type, ContentID: f.ContentID, LibraryID: idOfPositive(f.LibraryID)})
@@ -1415,7 +1421,7 @@ func catalogItemDetailOf(d *catalogpkg.ItemDetail, sel ratingsources.Selection)
 	}
 	out := CatalogItemDetail{
 		CatalogItem: card, PlaySeasonNumber: d.PlaySeasonNumber,
-		SortTitle: d.SortTitle, OriginalTitle: d.OriginalTitle, Tagline: d.Tagline, PendingTranslationLanguage: d.PendingTranslationLanguage,
+		SortTitle: d.SortTitle, OriginalTitle: d.OriginalTitle, Tagline: d.Tagline,
 		ImdbID: d.ImdbID, TmdbID: d.TmdbID, TvdbID: d.TvdbID, Cast: NonNil(d.Cast), Crew: NonNil(d.Crew), Countries: d.Countries, LockedFields: d.LockedFields,
 		BannerURL: d.BannerURL, BannerThumbhash: d.BannerThumbhash, ThumbURL: d.ThumbURL, ThumbThumbhash: d.ThumbThumbhash,
 		ClearArtURL: d.ClearArtURL, DiscURL: d.DiscURL, BackdropURLs: d.BackdropURLs,
@@ -1450,12 +1456,15 @@ func datePtr(s string) *string {
 	return &s
 }
 
+// episodesOf renders episode rows. An episode's ratings come from its IMDb and
+// TMDB columns only, which every selection shows, so it needs no rating policy.
 func episodesOf(views []handlers.EpisodeView) []Episode {
 	out := make([]Episode, 0, len(views))
 	for _, e := range views {
 		ep := Episode{ContentID: e.ContentID, SeasonNumber: e.SeasonNumber, EpisodeNumber: e.EpisodeNumber, Title: e.Title, Overview: e.Overview,
 			AirDate: datePtr(e.AirDate), Runtime: e.Runtime, ImdbID: e.ImdbID, TmdbID: e.TmdbID, TvdbID: e.TvdbID, StillIsEpisodeStill: e.StillIsEpisodeStill, StillURL: e.StillURL, StillThumbhash: e.StillThumbhash,
-			UserData: watchRollupOf(e.UserData), OverlaySummary: catalogOverlayOf(e.OverlaySummary)}
+			Ratings:  builtRatingsOf(ratingsources.Item{IMDB: e.RatingIMDB, TMDB: e.RatingTMDB}, ratingsources.Selection{}),
+			UserData: watchRollupOf(e.UserData), OverlaySummary: catalogOverlayOf(e.OverlaySummary), MachineTranslatedFields: e.MachineTranslatedFields, PendingTranslationLanguage: e.PendingTranslationLanguage}
 		for _, f := range e.Files {
 			ep.Files = append(ep.Files, EpisodeFile{FileID: IDFromInt(int64(f.FileID)), Resolution: f.Resolution, CodecVideo: f.CodecVideo, HDR: f.HDR,
 				AudioChannels: f.AudioChannels, Container: f.Container, FileSize: f.FileSize, Unreadable: f.Unreadable})
@@ -1468,7 +1477,7 @@ func episodesOf(views []handlers.EpisodeView) []Episode {
 func seasonOf(s handlers.SeasonView) Season {
 	return Season{ContentID: s.ContentID, PlayContentID: s.PlayContentID, SeasonNumber: s.SeasonNumber, IsSpecials: s.IsSpecials, Title: s.Title,
 		Overview: s.Overview, AirDate: datePtr(s.AirDate), EpisodeCount: s.EpisodeCount, PosterURL: s.PosterURL, PosterThumbhash: s.PosterThumbhash,
-		UserData: watchRollupOf(s.UserData)}
+		UserData: watchRollupOf(s.UserData), MachineTranslatedFields: s.MachineTranslatedFields}
 }
 
 func catalogCommunityRatingOf(r *catalogpkg.CommunityRating) *CatalogCommunityRating {
diff --git a/internal/apiv2/catalog_items_test.go b/internal/apiv2/catalog_items_test.go
index 8f7ac4f077..d3400e5ca7 100644
--- a/internal/apiv2/catalog_items_test.go
+++ b/internal/apiv2/catalog_items_test.go
@@ -75,7 +75,7 @@ func (f *fakeCatalog) SearchFacet(_ context.Context, _ handlers.ItemViewer, req
 		return handlers.CatalogFacetSearchView{}, f.err
 	}
 	f.lastReq = req
-	if facet == "author" && strings.HasPrefix("frank herbert", q) {
+	if facet == "author" && strings.HasPrefix("frank herbert", q) { //nolint:gocritic // the fake matches a typed prefix of the name
 		return handlers.CatalogFacetSearchView{
 			Matches: []string{"Frank Herbert"}, HasMore: limit == 1,
 			Values: []catalogpkg.FacetValue{{Value: "Frank Herbert", Count: 6}}, ValuesHasMore: limit == 1,
@@ -186,8 +186,12 @@ func (f *fakeCatalog) MangaFiles(_ context.Context, _ handlers.ItemViewer, id st
 }
 
 func fakeEpisode(n int) handlers.EpisodeView {
-	return handlers.EpisodeView{ContentID: "episode:severance-s01e0" + string(rune('0'+n)), SeasonNumber: 1, EpisodeNumber: n, Title: "Good News About Hell", AirDate: "2022-02-18", Runtime: 57,
+	ep := handlers.EpisodeView{ContentID: "episode:severance-s01e0" + string(rune('0'+n)), SeasonNumber: 1, EpisodeNumber: n, Title: "Good News About Hell", AirDate: "2022-02-18", Runtime: 57,
 		Files: []handlers.EpisodeFileView{{FileID: 200 + n, Resolution: "1080p", FileSize: 1}}, UserData: &catalogpkg.SeasonUserData{Played: n == 1, WatchedCount: 1}}
+	if n == 1 {
+		ep.RatingIMDB, ep.RatingTMDB = new(8.7), new(8.25)
+	}
+	return ep
 }
 
 func (f *fakeCatalog) ItemEpisodes(_ context.Context, _ handlers.ItemViewer, id string) ([]handlers.EpisodeView, error) {
@@ -526,7 +530,7 @@ func TestGetCatalogItem(t *testing.T) {
 	decodeJSON(t, rec.Body, &body)
 	for k, want := range map[string]string{
 		"content_id": `"movie:heat-1995"`, "tagline": `"A Los Angeles crime saga"`, "keywords": `[]`, "crew": `[]`, "subtitles": `[]`,
-		"user_state": `{"played":true,"is_favorite":true,"in_watchlist":false}`, "overlay_summary": `{"resolution":"4K"}`,
+		"user_state": `{"played":true,"is_favorite":true,"in_watchlist":false,"not_interested":false}`, "overlay_summary": `{"resolution":"4K"}`,
 		"work_formats": `[{"type":"ebook","content_id":"ebook:heat","library_id":"2"}]`,
 	} {
 		if string(body[k]) != want {
@@ -818,3 +822,45 @@ func TestListCatalogItemsVideoWithEpisodesScope(t *testing.T) {
 		t.Fatalf("section errors = %+v", p.Errors)
 	}
 }
+
+// An episode states its ratings as a title page does: on a 0-100 score with
+// the source's own display, IMDb before TMDB. A stored 0 (unrated) or a value
+// off the 0-10 scale is dropped, and an episode with no rating omits the field.
+func TestEpisodesOfStatesRatings(t *testing.T) {
+	episodes := episodesOf([]handlers.EpisodeView{
+		{ContentID: "episode:1", RatingIMDB: new(8.7), RatingTMDB: new(8.25)},
+		{ContentID: "episode:2", RatingIMDB: new(0.0), RatingTMDB: new(42.0)},
+		{ContentID: "episode:3"},
+	})
+	want := []CatalogRating{
+		{Source: "imdb", Name: "IMDb", Score: 87, Display: "8.7"},
+		{Source: "tmdb", Name: "TMDB", Score: 82.5, Display: "8.3"},
+	}
+	if !reflect.DeepEqual(episodes[0].Ratings, want) {
+		t.Fatalf("ratings = %+v, want %+v", episodes[0].Ratings, want)
+	}
+	for _, ep := range episodes[1:] {
+		body, err := json.Marshal(ep)
+		if err != nil {
+			t.Fatal(err)
+		}
+		var fields map[string]any
+		if err := json.Unmarshal(body, &fields); err != nil {
+			t.Fatal(err)
+		}
+		if _, ok := fields["ratings"]; ok {
+			t.Fatalf("%s carries ratings: %s", ep.ContentID, body)
+		}
+	}
+}
+
+// The episode's rating columns stay off the frozen /api/v1 wire.
+func TestEpisodeViewKeepsRatingsOffV1(t *testing.T) {
+	body, err := json.Marshal(handlers.EpisodeView{ContentID: "episode:1", RatingIMDB: new(8.7), RatingTMDB: new(8.2)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(string(body), "rating") {
+		t.Fatalf("v1 episode = %s", body)
+	}
+}
diff --git a/internal/apiv2/catalog_letters.go b/internal/apiv2/catalog_letters.go
index b1925143e4..c7b1e861d4 100644
--- a/internal/apiv2/catalog_letters.go
+++ b/internal/apiv2/catalog_letters.go
@@ -6,6 +6,7 @@ import (
 	"strings"
 
 	catalogpkg "github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/imagesize"
 )
 
 // Section catalog-letters: the letter index behind an alphabetical jump bar.
@@ -75,7 +76,7 @@ func (reg *Registry) queryCatalogLetters(ctx context.Context, in *CatalogLetters
 	if p != nil {
 		return nil, p
 	}
-	viewer, p := reg.itemViewer(ctx, "", "", "")
+	viewer, p := reg.itemViewer(ctx, imagesize.Request{}, "", "")
 	if p != nil {
 		return nil, p
 	}
diff --git a/internal/apiv2/catalog_types.go b/internal/apiv2/catalog_types.go
index e963e82545..9017f04d3d 100644
--- a/internal/apiv2/catalog_types.go
+++ b/internal/apiv2/catalog_types.go
@@ -62,9 +62,14 @@ type CatalogItem struct {
 	SortMetrics            *CatalogItemSortMetrics   `json:"sort_metrics,omitempty" doc:"The values the listing was sorted by"`
 	UserState              *CatalogItemUserState     `json:"user_state,omitempty" doc:"The viewer's flags; absent without a profile"`
 	UpcomingEvent          *CatalogItemUpcomingEvent `json:"upcoming_event,omitempty"`
-	WorkID                 string                    `json:"work_id,omitempty" doc:"The work (book) an audiobook or ebook edition belongs to"`
-	WorkTitle              string                    `json:"work_title,omitempty"`
-	WorkFormats            []CatalogWorkFormat       `json:"work_formats,omitempty" doc:"Sibling editions of the same work"`
+	// PendingTranslationLanguage and MachineTranslatedFields are set on
+	// detail documents, the cards built from them, and section cards; other
+	// listings leave them absent.
+	PendingTranslationLanguage string              `json:"pending_translation_language,omitempty" doc:"The language this profile reads here when the descriptions this item's page shows are not available in it yet. That is the profile's metadata language after its per-language exceptions, or, when it sets none, the library's for a library's rows or a detail opened in that library. It is pending for the item's own overview, or for a season its overview or any of its episodes' overviews. Echo it to translateCatalogItemDescription to translate on view. Set only on item details, the cards built from them (shuffles, the Watch Together picker), and Home and library section cards; other listings never carry it, so its absence there says nothing about the language."`
+	MachineTranslatedFields    []string            `json:"machine_translated_fields,omitempty" enum:"overview,tagline" doc:"Localized fields whose text was machine-translated by AI rather than supplied by a metadata provider or a person; absent when none were. Set only on item details, the cards built from them (shuffles, the Watch Together picker), and Home and library section cards. A card shows no tagline, so a card's overview label depends on overview alone."`
+	WorkID                     string              `json:"work_id,omitempty" doc:"The work (book) an audiobook or ebook edition belongs to"`
+	WorkTitle                  string              `json:"work_title,omitempty"`
+	WorkFormats                []CatalogWorkFormat `json:"work_formats,omitempty" doc:"Sibling editions of the same work"`
 }
 
 // CatalogItemOverlay is the technical summary a card overlays.
@@ -84,9 +89,10 @@ type CatalogItemOverlay struct {
 
 // CatalogItemUserState is the viewer's flags on an item.
 type CatalogItemUserState struct {
-	Played      bool `json:"played" example:"false"`
-	IsFavorite  bool `json:"is_favorite" example:"false"`
-	InWatchlist bool `json:"in_watchlist" example:"false"`
+	Played        bool `json:"played" example:"false"`
+	IsFavorite    bool `json:"is_favorite" example:"false"`
+	InWatchlist   bool `json:"in_watchlist" example:"false"`
+	NotInterested bool `json:"not_interested" doc:"The profile marked the movie or series Not interested: recommendations leave it out and rank similar titles lower" example:"false"`
 }
 
 // CatalogItemUpcomingEvent is the next airing a card announces.
@@ -133,7 +139,7 @@ func catalogUserStateOf(s *handlers.ItemUserStateView) *CatalogItemUserState {
 	if s == nil {
 		return nil
 	}
-	return &CatalogItemUserState{Played: s.Played, IsFavorite: s.IsFavorite, InWatchlist: s.InWatchlist}
+	return &CatalogItemUserState{Played: s.Played, IsFavorite: s.IsFavorite, InWatchlist: s.InWatchlist, NotInterested: s.NotInterested}
 }
 
 // instantOfRFC3339 parses a stored RFC 3339 stamp; an unparseable one is
@@ -164,6 +170,7 @@ func catalogItemOfSection(v handlers.SectionItemView, sel ratingsources.Selectio
 		PosterIsEpisodeStill: v.PosterIsEpisodeStill, BackdropIsEpisodeStill: v.BackdropIsEpisodeStill,
 		PosterURL: v.PosterURL, PosterThumbhash: v.PosterThumbhash, BackdropURL: v.BackdropURL, BackdropThumbhash: v.BackdropThumbhash, LogoURL: v.LogoURL,
 		OverlaySummary: catalogOverlayOf(v.OverlaySummary), Badges: v.Badges, ItemSource: v.ItemSource, UserState: catalogUserStateOf(v.UserState),
+		PendingTranslationLanguage: v.PendingTranslationLanguage, MachineTranslatedFields: v.MachineTranslatedFields,
 	}
 	if e := v.UpcomingEvent; e != nil {
 		item.UpcomingEvent = &CatalogItemUpcomingEvent{Type: e.Type, AirDate: e.AirDate, AirTime: e.AirTime, EpisodeTitle: e.EpisodeTitle,
diff --git a/internal/apiv2/device_login.go b/internal/apiv2/device_login.go
index c0d0c58ac3..438eefdcc8 100644
--- a/internal/apiv2/device_login.go
+++ b/internal/apiv2/device_login.go
@@ -406,15 +406,11 @@ func (reg *Registry) getDeviceLogin(ctx context.Context, in *GetDeviceLoginInput
 		ClientPurpose:  info.ClientPurpose,
 		Temporary:      info.Temporary,
 		ServerName:     reg.serverDisplayName(ctx),
+		ServerID:       reg.knownServerID(ctx),
 	}
 	if !info.ExpiresAt.IsZero() {
 		out.ExpiresAt = ptr(NewInstant(info.ExpiresAt))
 	}
-	if reg.deps.ServerIdentity != nil {
-		if id, err := reg.deps.ServerIdentity.ServerID(ctx); err == nil {
-			out.ServerID = id
-		}
-	}
 	return &DeviceLoginOutput{Body: out}, nil
 }
 
diff --git a/internal/apiv2/devices.go b/internal/apiv2/devices.go
index 91d8c6b62e..dcdc2d567f 100644
--- a/internal/apiv2/devices.go
+++ b/internal/apiv2/devices.go
@@ -13,16 +13,19 @@ const (
 	opListDevices         = "listDevices"
 	opClearDeviceSettings = "clearDeviceSettings"
 	opForgetDevice        = "forgetDevice"
+	opUpdateDevice        = "updateDevice"
 )
 
 type DeviceSettingsService interface {
 	DeviceSettingsPage(context.Context, handlers.DeviceSettingsActor, bool, userstore.DevicePageOptions) ([]userstore.DeviceSettingsEntry, error)
 	RemoveDeviceSettings(context.Context, handlers.DeviceSettingsActor, string, string, bool) error
+	UpdateDevice(context.Context, handlers.DeviceSettingsActor, string, string, handlers.DeviceUpdate) (userstore.DeviceSettingsEntry, error)
 }
 
 type DeviceSettings struct {
 	DeviceID        string  `json:"device_id"`
-	DeviceName      string  `json:"device_name"`
+	DeviceName      string  `json:"device_name" doc:"Name the device reports for itself"`
+	CustomName      string  `json:"custom_name,omitempty" doc:"Name the profile gave the device; show it in place of device_name. Absent when none was given" example:"Living Room"`
 	DevicePlatform  string  `json:"device_platform"`
 	LastSeenAt      Instant `json:"last_seen_at"`
 	ProfileID       ID      `json:"profile_id"`
@@ -44,6 +47,18 @@ type DeviceSettingsRemoveInput struct {
 	DeviceID  string `path:"device_id" minLength:"1" maxLength:"128"`
 	ProfileID ID     `query:"profile_id" doc:"Another profile on the account; requires household management authority"`
 }
+type DeviceUpdateInput struct {
+	DeviceID     string `path:"device_id" minLength:"1" maxLength:"128"`
+	ProfileID    ID     `query:"profile_id" doc:"Another profile on the account; requires household management authority"`
+	DeviceHeader string `header:"X-Prairie-Device-Id" maxLength:"128"`
+	Body         DeviceUpdate
+}
+type DeviceUpdateOutput struct{ Body DeviceSettings }
+
+// DeviceUpdate is the updateDevice body. Omitted members are unchanged.
+type DeviceUpdate struct {
+	CustomName Patch[string] `json:"custom_name,omitzero" minLength:"1" maxLength:"120" doc:"Name to show for the device in place of the name it reports. Control characters and bidirectional overrides are removed and runs of spaces collapse; a name with no visible character is rejected. null removes it. The reported device_name is kept" example:"Living Room"`
+}
 
 func registerDeviceSettings(reg *Registry) {
 	cursors := NewCursors(reg.deps.CursorSecret)
@@ -70,6 +85,33 @@ func registerDeviceSettings(reg *Registry) {
 			return nil, nil
 		})
 	}
+	update := humaOp(http.MethodPatch, Prefix+"/devices/{device_id}", opUpdateDevice, "devices", "Update a device's entry for the acting profile, or another household profile, and return it; omitted members are unchanged. Settings and login sessions are untouched.")
+	// The name converges: repeating the request leaves the same row and
+	// returns the same representation.
+	Register(reg, Operation{Operation: update, Class: ClassProfileScoped, ServiceBacked: true, RetrySafety: RetrySafetyNaturalIdempotent}, reg.updateDevice)
+}
+
+func (reg *Registry) updateDevice(ctx context.Context, in *DeviceUpdateInput) (*DeviceUpdateOutput, error) {
+	if reg.deps.DeviceSettings == nil {
+		return nil, unavailable("device settings")
+	}
+	actor, p := deviceSettingsActor(ctx)
+	if p != nil {
+		return nil, p
+	}
+	update := handlers.DeviceUpdate{Rename: in.Body.CustomName.Present}
+	if in.Body.CustomName.Present && !in.Body.CustomName.Null {
+		update.CustomName = &in.Body.CustomName.Value
+	}
+	row, err := reg.deps.DeviceSettings.UpdateDevice(ctx, actor, string(in.ProfileID), in.DeviceID, update)
+	if err != nil {
+		return nil, fieldProblem(err)
+	}
+	item, p := deviceSettingsItem(row, handlers.NewDeviceMetadata(in.DeviceHeader, "", "").DeviceID)
+	if p != nil {
+		return nil, p
+	}
+	return &DeviceUpdateOutput{Body: item}, nil
 }
 
 func deviceSettingsActor(ctx context.Context) (handlers.DeviceSettingsActor, *Problem) {
@@ -109,11 +151,21 @@ func (reg *Registry) listDevices(ctx context.Context, cursors *Cursors, in *Devi
 	items := make([]DeviceSettings, 0, len(rows))
 	current := handlers.NewDeviceMetadata(in.DeviceHeader, "", "").DeviceID
 	for _, row := range rows {
-		seen, p := storeInstant(row.LastSeenAt)
+		item, p := deviceSettingsItem(row, current)
 		if p != nil {
 			return nil, p
 		}
-		items = append(items, DeviceSettings{DeviceID: row.DeviceID, DeviceName: row.DeviceName, DevicePlatform: row.DevicePlatform, LastSeenAt: seen, ProfileID: ID(row.ProfileID), ProfileName: row.ProfileName, ChangedCount: row.ChangedCount, IsCurrentDevice: row.DeviceID == current})
+		items = append(items, item)
 	}
 	return &DeviceSettingsListOutput{Body: DeviceSettingsCollection{Collection: Paginated(items, next)}}, nil
 }
+
+// deviceSettingsItem renders one registry entry; current is the requesting
+// device's id.
+func deviceSettingsItem(row userstore.DeviceSettingsEntry, current string) (DeviceSettings, *Problem) {
+	seen, p := storeInstant(row.LastSeenAt)
+	if p != nil {
+		return DeviceSettings{}, p
+	}
+	return DeviceSettings{DeviceID: row.DeviceID, DeviceName: row.DeviceName, CustomName: row.CustomName, DevicePlatform: row.DevicePlatform, LastSeenAt: seen, ProfileID: ID(row.ProfileID), ProfileName: row.ProfileName, ChangedCount: row.ChangedCount, IsCurrentDevice: row.DeviceID == current}, nil
+}
diff --git a/internal/apiv2/devices_test.go b/internal/apiv2/devices_test.go
index 23e5e76a40..d35cdb70b4 100644
--- a/internal/apiv2/devices_test.go
+++ b/internal/apiv2/devices_test.go
@@ -18,6 +18,7 @@ type fakeDeviceSettings struct {
 	options                     userstore.DevicePageOptions
 	targetProfile, targetDevice string
 	forget                      bool
+	update                      handlers.DeviceUpdate
 }
 
 func (f *fakeDeviceSettings) DeviceSettingsPage(_ context.Context, a handlers.DeviceSettingsActor, h bool, o userstore.DevicePageOptions) ([]userstore.DeviceSettingsEntry, error) {
@@ -29,7 +30,7 @@ func (f *fakeDeviceSettings) DeviceSettingsPage(_ context.Context, a handlers.De
 		return []userstore.DeviceSettingsEntry{}, nil
 	}
 	return []userstore.DeviceSettingsEntry{
-		{DeviceEntry: userstore.DeviceEntry{ProfileID: a.ProfileID, DeviceID: "d-1", LastSeenAt: "2026-01-02T03:04:05.123456Z"}, ProfileName: "Viewer", ChangedCount: 1},
+		{DeviceEntry: userstore.DeviceEntry{ProfileID: a.ProfileID, DeviceID: "d-1", DeviceName: "Apple TV", LastSeenAt: "2026-01-02T03:04:05.123456Z"}, CustomName: "Living Room", ProfileName: "Viewer", ChangedCount: 1},
 		{DeviceEntry: userstore.DeviceEntry{ProfileID: a.ProfileID, DeviceID: "d-2", LastSeenAt: "2026-01-02T03:04:05.123456Z"}},
 	}, nil
 }
@@ -44,6 +45,21 @@ func (f *fakeDeviceSettings) RemoveDeviceSettings(_ context.Context, a handlers.
 	}
 	return nil
 }
+func (f *fakeDeviceSettings) UpdateDevice(_ context.Context, a handlers.DeviceSettingsActor, p, d string, u handlers.DeviceUpdate) (userstore.DeviceSettingsEntry, error) {
+	f.calls++
+	f.actor = a
+	f.targetProfile = p
+	f.targetDevice = d
+	f.update = u
+	if d == "missing" {
+		return userstore.DeviceSettingsEntry{}, &handlers.APIError{Status: 404, Code: "not_found", Message: "Device not found"}
+	}
+	entry := userstore.DeviceSettingsEntry{DeviceEntry: userstore.DeviceEntry{ProfileID: p, DeviceID: d, DeviceName: "Apple TV", DevicePlatform: "tvOS", LastSeenAt: "2026-01-02T03:04:05.123456Z"}, ProfileName: "Family"}
+	if u.Rename && u.CustomName != nil {
+		entry.CustomName = *u.CustomName
+	}
+	return entry, nil
+}
 func TestDeviceSettingsWire(t *testing.T) {
 	f := &fakeDeviceSettings{}
 	deps := pilotDeps(nil, nil)
@@ -59,7 +75,8 @@ func TestDeviceSettingsWire(t *testing.T) {
 	if err := json.Unmarshal(rec.Body.Bytes(), &page); err != nil {
 		t.Fatal(err)
 	}
-	if len(page.Items) != 1 || !page.Items[0].IsCurrentDevice || !page.Page.HasMore || page.Page.NextCursor == "" {
+	if len(page.Items) != 1 || !page.Items[0].IsCurrentDevice || !page.Page.HasMore || page.Page.NextCursor == "" ||
+		page.Items[0].DeviceName != "Apple TV" || page.Items[0].CustomName != "Living Room" {
 		t.Fatalf("page: %s", rec.Body.String())
 	}
 	if f.options.Limit != 2 || f.actor.ProfileID != "p-owner" || f.actor.UserID != 1 {
@@ -85,17 +102,66 @@ func TestDeviceSettingsWire(t *testing.T) {
 		t.Fatalf("missing: %d %s", rec.Code, rec.Body.String())
 	}
 }
+
+// updateDevice carries the three PATCH states of custom_name to the seam:
+// a value renames, null clears, and omission changes nothing.
+func TestUpdateDeviceWire(t *testing.T) {
+	f := &fakeDeviceSettings{}
+	deps := pilotDeps(nil, nil)
+	deps.DeviceSettings = f
+	h := newTestHandler(t, deps)
+	headers := viewerHeaders()
+	name := func(u handlers.DeviceUpdate) string {
+		if !u.Rename {
+			return "<unchanged>"
+		}
+		if u.CustomName == nil {
+			return "<cleared>"
+		}
+		return *u.CustomName
+	}
+	for _, c := range []struct{ body, want string }{
+		{`{"custom_name":"Living Room"}`, "Living Room"},
+		{`{"custom_name":null}`, "<cleared>"},
+		{`{}`, "<unchanged>"},
+	} {
+		rec := do(t, h, http.MethodPatch, "/api/v2/devices/d-1?profile_id=p-family", c.body, headers)
+		if rec.Code != 200 || f.targetProfile != "p-family" || f.targetDevice != "d-1" || name(f.update) != c.want {
+			t.Fatalf("%s: %d %q %s", c.body, rec.Code, name(f.update), rec.Body.String())
+		}
+		var got DeviceSettings
+		if err := json.Unmarshal(rec.Body.Bytes(), &got); err != nil || got.DeviceID != "d-1" || got.DeviceName != "Apple TV" || got.ProfileID != "p-family" || (c.want == "Living Room") != (got.CustomName == "Living Room") {
+			t.Fatalf("%s: representation %s", c.body, rec.Body.String())
+		}
+	}
+	before := f.calls
+	for _, body := range []string{`{"custom_name":""}`, `{"custom_name":"` + strings.Repeat("é", 121) + `"}`} {
+		if rec := do(t, h, http.MethodPatch, "/api/v2/devices/d-1", body, headers); rec.Code != 422 || f.calls != before {
+			t.Fatalf("invalid name reached the seam: %d %s", rec.Code, rec.Body.String())
+		}
+	}
+	if rec := do(t, h, http.MethodPatch, "/api/v2/devices/d-1", `{"custom_name":"`+strings.Repeat("é", 120)+`"}`, headers); rec.Code != 200 {
+		t.Fatalf("120 runes: %d %s", rec.Code, rec.Body.String())
+	}
+	if rec := do(t, h, http.MethodPatch, "/api/v2/devices/missing", `{"custom_name":"x"}`, headers); rec.Code != 404 {
+		t.Fatalf("missing: %d %s", rec.Code, rec.Body.String())
+	}
+}
 func TestDeviceSettingsGates(t *testing.T) {
 	f := &fakeDeviceSettings{}
 	deps := pilotDeps(nil, nil)
 	deps.DeviceSettings = f
 	h := newTestHandler(t, deps)
-	for _, method := range []string{http.MethodGet, http.MethodDelete} {
+	for _, method := range []string{http.MethodGet, http.MethodDelete, http.MethodPatch} {
 		path := "/api/v2/devices"
-		if method == http.MethodDelete {
+		body := ""
+		if method != http.MethodGet {
 			path += "/d"
 		}
-		rec := do(t, h, method, path, "", nil)
+		if method == http.MethodPatch {
+			body = `{"custom_name":"x"}`
+		}
+		rec := do(t, h, method, path, body, nil)
 		if rec.Code != 401 || f.calls != 0 {
 			t.Fatalf("unauthenticated: %d", rec.Code)
 		}
diff --git a/internal/apiv2/direct_download.go b/internal/apiv2/direct_download.go
index d23c324b46..9ae2169616 100644
--- a/internal/apiv2/direct_download.go
+++ b/internal/apiv2/direct_download.go
@@ -3,6 +3,7 @@ package apiv2
 import (
 	"context"
 	"errors"
+	"io"
 	"net/http"
 	"net/url"
 	"reflect"
@@ -237,3 +238,6 @@ func (w *directDownloadWriter) Unwrap() http.ResponseWriter    { return w.Respon
 func (w *directDownloadWriter) WriteHeader(status int)         { w.transport().WriteHeader(status) }
 func (w *directDownloadWriter) Write(data []byte) (int, error) { return w.transport().Write(data) }
 func (w *directDownloadWriter) FlushError() error              { return w.transport().FlushError() }
+func (w *directDownloadWriter) ReadFrom(src io.Reader) (int64, error) {
+	return w.transport().ReadFrom(src)
+}
diff --git a/internal/apiv2/document.go b/internal/apiv2/document.go
index a944531324..1c52028b9d 100644
--- a/internal/apiv2/document.go
+++ b/internal/apiv2/document.go
@@ -566,6 +566,7 @@ func registerAll(reg *Registry) {
 	registerAdminPolicyDefaults(reg)
 	registerExternalSignIn(reg)
 	registerNotificationInbox(reg)
+	registerNotificationSeries(reg)
 	registerAdminNotificationPush(reg)
 	registerAdminNotificationDiscord(reg)
 	registerNotificationRelay(reg)
@@ -586,6 +587,7 @@ func registerAll(reg *Registry) {
 	registerPreferences(reg)
 	registerHome(reg)
 	registerFavorites(reg)
+	registerNotInterested(reg)
 	registerHistory(reg)
 	registerDeviceSettings(reg)
 	registerLibraries(reg)
@@ -695,6 +697,7 @@ func registerAll(reg *Registry) {
 	registerPlaybackQualityLadder(reg)
 	registerPlaybackDelivery(reg)
 	registerLiveTV(reg)
+	registerPlaybackBandwidthProbe(reg)
 	registerProfiles(reg)
 	registerEbookAnnotations(reg)
 	registerDownloadRegistry(reg)
diff --git a/internal/apiv2/download_delivery.go b/internal/apiv2/download_delivery.go
index 49efc2f140..c00bcfe675 100644
--- a/internal/apiv2/download_delivery.go
+++ b/internal/apiv2/download_delivery.go
@@ -16,43 +16,53 @@ type DownloadDeliveryService interface {
 	ServeDownloadSubtitle(http.ResponseWriter, *http.Request, string, string) error
 }
 
+// Kinds of managed-download asset served by the raw delivery routes.
+const (
+	downloadAssetFile     = "file"
+	downloadAssetArtwork  = "artwork"
+	downloadAssetSubtitle = "subtitle"
+)
+
 func registerDownloadDelivery(reg *Registry) {
+	// observe marks the routes counted as viewer transfer egress, mirroring
+	// v1: media bytes and subtitles, not catalog artwork. Each observed
+	// pattern must be declared in the API's native media routes.
 	type route struct {
 		method, path, id, kind string
-		proxy                  bool
+		proxy, observe         bool
 	}
 	routes := []route{
-		{"GET", "/downloads/{id}/file", "downloadFile", "file", false},
-		{"HEAD", "/downloads/{id}/file", "headDownloadFile", "file", false},
-		{"GET", "/downloads/{id}/file-proxy", "downloadFileViaProxy", "file", true},
-		{"HEAD", "/downloads/{id}/file-proxy", "headDownloadFileViaProxy", "file", true},
-		{"GET", "/downloads/{id}/artwork/{kind}", "getDownloadArtwork", "artwork", false},
-		{"GET", "/downloads/{id}/subtitles/{ref}", "getDownloadSubtitle", "subtitle", false},
+		{http.MethodGet, "/downloads/{id}/file", "downloadFile", downloadAssetFile, false, true},
+		{http.MethodHead, "/downloads/{id}/file", "headDownloadFile", downloadAssetFile, false, true},
+		{http.MethodGet, "/downloads/{id}/file-proxy", "downloadFileViaProxy", downloadAssetFile, true, true},
+		{http.MethodHead, "/downloads/{id}/file-proxy", "headDownloadFileViaProxy", downloadAssetFile, true, true},
+		{http.MethodGet, "/downloads/{id}/artwork/{kind}", "getDownloadArtwork", downloadAssetArtwork, false, false},
+		{http.MethodGet, "/downloads/{id}/subtitles/{ref}", "getDownloadSubtitle", downloadAssetSubtitle, false, true},
 	}
 	for _, route := range routes {
 		op := humaOp(route.method, Prefix+route.path, route.id, "downloads", "Stream an authorized download file or offline asset using the existing delivery service.")
 		op.Parameters = []*huma.Param{{Name: "id", In: "path", Required: true, Schema: &huma.Schema{Type: huma.TypeString, MinLength: new(1)}}}
-		if route.kind != "file" {
+		if route.kind != downloadAssetFile {
 			name := "kind"
-			if route.kind == "subtitle" {
+			if route.kind == downloadAssetSubtitle {
 				name = "ref"
 			}
 			op.Parameters = append(op.Parameters, &huma.Param{Name: name, In: "path", Required: true, Schema: &huma.Schema{Type: huma.TypeString, MinLength: new(1)}})
 		}
-		op.Parameters = append(op.Parameters, &huma.Param{Name: "X-Prairie-Device-Id", In: "header", Required: route.kind != "file", Schema: &huma.Schema{Type: huma.TypeString, MaxLength: new(128)}})
+		op.Parameters = append(op.Parameters, &huma.Param{Name: "X-Prairie-Device-Id", In: paramInHeader, Required: route.kind != downloadAssetFile, Schema: &huma.Schema{Type: huma.TypeString, MaxLength: new(128)}})
 		headers := map[string]*huma.Param{}
 		for _, name := range []string{"Content-Length", "Content-Disposition", "Cache-Control", "Content-Range", "Accept-Ranges", "Last-Modified", "ETag", "Location"} {
 			headers[name] = &huma.Param{Schema: &huma.Schema{Type: huma.TypeString}}
 		}
 		media := map[string]*huma.MediaType{}
-		if route.method == "GET" {
+		if route.method == http.MethodGet {
 			types := []string{"application/octet-stream"}
 			switch route.kind {
-			case "file":
+			case downloadAssetFile:
 				types = append(types, "video/*", "audio/*", "multipart/byteranges")
-			case "artwork":
+			case downloadAssetArtwork:
 				types = []string{"image/*"}
-			case "subtitle":
+			case downloadAssetSubtitle:
 				types = []string{"text/plain", "text/vtt", "application/x-subrip", "text/x-ssa", "text/x-ass", "application/ttml+xml", "application/octet-stream"}
 			}
 			for _, name := range types {
@@ -63,7 +73,7 @@ func registerDownloadDelivery(reg *Registry) {
 			return &huma.Response{Description: description, Content: map[string]*huma.MediaType{problemContentType: {Schema: reg.api.OpenAPI().Components.Schemas.Schema(reflect.TypeFor[Problem](), true, "")}}}
 		}
 		op.Responses = map[string]*huma.Response{"200": {Description: "Authorized bytes; HEAD returns only file metadata.", Content: media, Headers: headers}, "400": problem("Invalid subtitle reference."), "422": problem("Invalid download identity or device scope."), "404": problem("Download or asset not found in this scope."), "409": problem("The download is not active.")}
-		if route.kind == "file" {
+		if route.kind == downloadAssetFile {
 			for _, name := range []string{"Range", "If-Range", "If-Match", "If-None-Match", "If-Modified-Since", "If-Unmodified-Since"} {
 				op.Parameters = append(op.Parameters, &huma.Param{Name: name, In: "header", Schema: &huma.Schema{Type: huma.TypeString}})
 			}
@@ -72,7 +82,7 @@ func registerDownloadDelivery(reg *Registry) {
 			op.Responses["412"] = &huma.Response{Description: "File precondition failed.", Headers: headers}
 			op.Responses["416"] = &huma.Response{Description: "Range not satisfiable.", Content: map[string]*huma.MediaType{"text/plain": {Schema: &huma.Schema{Type: huma.TypeString}}}, Headers: headers}
 		}
-		if route.kind == "subtitle" {
+		if route.kind == downloadAssetSubtitle {
 			// Downloaded subtitles revalidate: a stored timing correction can
 			// change their bytes (ETag carries the subtitle revision).
 			op.Parameters = append(op.Parameters, &huma.Param{Name: "If-None-Match", In: "header", Schema: &huma.Schema{Type: huma.TypeString}})
@@ -84,14 +94,18 @@ func registerDownloadDelivery(reg *Registry) {
 				op.Responses["307"].Content = map[string]*huma.MediaType{"text/html": {Schema: &huma.Schema{Type: huma.TypeString}}}
 			}
 		}
-		if route.kind == "artwork" {
+		if route.kind == downloadAssetArtwork {
 			op.Responses["503"] = problem("Service Unavailable")
 			op.Responses["503"].Headers = map[string]*huma.Header{}
 			op.Responses["503"].Headers["Retry-After"] = &huma.Header{Schema: &huma.Schema{Type: huma.TypeString}, Description: "Seconds to wait before retrying when the artwork store failed or could not be reached."}
 		}
-		RegisterRaw(reg, RawOperation{Operation: Operation{Operation: op, Class: ClassProfileScoped, ServiceBacked: true}, Protocol: "managed-download-" + route.kind, Reason: "Offline media and assets are binary streams; file routes preserve HTTP range, conditional and optional proxy semantics."}, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		var handler http.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 			reg.serveDownloadDelivery(w, r, route.kind, route.proxy)
-		}))
+		})
+		if route.observe && reg.deps.ObserveDownloadDelivery != nil {
+			handler = reg.deps.ObserveDownloadDelivery(route.method, Prefix+route.path, handler)
+		}
+		RegisterRaw(reg, RawOperation{Operation: Operation{Operation: op, Class: ClassProfileScoped, ServiceBacked: true}, Protocol: "managed-download-" + route.kind, Reason: "Offline media and assets are binary streams; file routes preserve HTTP range, conditional and optional proxy semantics."}, handler)
 	}
 }
 func (reg *Registry) serveDownloadDelivery(w http.ResponseWriter, r *http.Request, kind string, proxy bool) {
@@ -101,7 +115,7 @@ func (reg *Registry) serveDownloadDelivery(w http.ResponseWriter, r *http.Reques
 	}
 	id := chi.URLParam(r, "id")
 	device := strings.TrimSpace(r.Header.Get("X-Prairie-Device-Id"))
-	if id == "" || len(device) > 128 || (kind != "file" && device == "") {
+	if id == "" || len(device) > 128 || (kind != downloadAssetFile && device == "") {
 		writeProblem(w, r, NewProblem(TypeValidationFailed, "A download identity and valid device scope are required."))
 		return
 	}
@@ -114,11 +128,11 @@ func (reg *Registry) serveDownloadDelivery(w http.ResponseWriter, r *http.Reques
 	asset := assetResponseWriter{writer}
 	var err error
 	switch kind {
-	case "file":
+	case downloadAssetFile:
 		err = reg.deps.DownloadDelivery.ServeDownloadFile(writer, r, id, proxy)
-	case "artwork":
+	case downloadAssetArtwork:
 		err = reg.deps.DownloadDelivery.ServeDownloadArtwork(asset, r, id, chi.URLParam(r, "kind"))
-	case "subtitle":
+	case downloadAssetSubtitle:
 		err = reg.deps.DownloadDelivery.ServeDownloadSubtitle(asset, r, id, chi.URLParam(r, "ref"))
 	}
 	if err == nil || writer.Status() != 0 {
diff --git a/internal/apiv2/download_delivery_test.go b/internal/apiv2/download_delivery_test.go
index deb15861f7..71f3dadec2 100644
--- a/internal/apiv2/download_delivery_test.go
+++ b/internal/apiv2/download_delivery_test.go
@@ -172,3 +172,55 @@ func TestDownloadRawAssetFailureBoundaries(t *testing.T) {
 		t.Fatalf("appended problem: %d %s", rec.Code, rec.Body.String())
 	}
 }
+
+// TestDownloadRawDeliveryObserved pins the routes handed to stream telemetry.
+// The patterns must match the API's declared native media routes, and artwork
+// stays unobserved as it does on v1.
+func TestDownloadRawDeliveryObserved(t *testing.T) {
+	domain := &downloadDeliveryDomain{}
+	deps := pilotDeps(nil, nil)
+	deps.DownloadDelivery = handlers.NewDownloadHandler(domain)
+	wrapped := map[string]bool{}
+	var served []string
+	deps.ObserveDownloadDelivery = func(method, pattern string, next http.Handler) http.Handler {
+		key := method + " " + pattern
+		wrapped[key] = true
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			served = append(served, key)
+			next.ServeHTTP(w, r)
+		})
+	}
+	h := newTestHandler(t, deps)
+	want := []string{
+		"GET " + Prefix + "/downloads/{id}/file",
+		"HEAD " + Prefix + "/downloads/{id}/file",
+		"GET " + Prefix + "/downloads/{id}/file-proxy",
+		"HEAD " + Prefix + "/downloads/{id}/file-proxy",
+		"GET " + Prefix + "/downloads/{id}/subtitles/{ref}",
+	}
+	if len(wrapped) != len(want) {
+		t.Fatalf("observed routes = %v, want %v", wrapped, want)
+	}
+	for _, key := range want {
+		if !wrapped[key] {
+			t.Fatalf("route %q not observed; observed %v", key, wrapped)
+		}
+	}
+
+	viewer := with(with(bearer(memberToken), "X-Profile-Id", "p-owner"), "X-Prairie-Device-Id", "device-one")
+	rec := do(t, h, "GET", Prefix+"/downloads/entry/file", "", viewer)
+	if rec.Code != 200 || rec.Body.String() != "0123456789" {
+		t.Fatalf("file through observer: %d %s", rec.Code, rec.Body.String())
+	}
+	rec = do(t, h, "GET", Prefix+"/downloads/entry/subtitles/external:0", "", viewer)
+	if rec.Code != 200 || rec.Body.String() != "WEBVTT" {
+		t.Fatalf("subtitle through observer: %d %s", rec.Code, rec.Body.String())
+	}
+	rec = do(t, h, "GET", Prefix+"/downloads/entry/artwork/poster", "", viewer)
+	if rec.Code != 200 {
+		t.Fatalf("artwork: %d %s", rec.Code, rec.Body.String())
+	}
+	if got := strings.Join(served, ", "); got != want[0]+", "+want[4] {
+		t.Fatalf("served through observer: %s", got)
+	}
+}
diff --git a/internal/apiv2/favorites.go b/internal/apiv2/favorites.go
index c9bad2d79a..2749f29105 100644
--- a/internal/apiv2/favorites.go
+++ b/internal/apiv2/favorites.go
@@ -16,7 +16,7 @@ import (
 
 // FavoriteListInput is the listFavorites query.
 type FavoriteListInput struct {
-	ImageSize string `query:"image_size" enum:"small,medium,large,original" doc:"Artwork variant to presign; absent picks each surface's default" example:"medium"`
+	ArtworkQuery
 	LimitParam
 	Cursor string `query:"cursor" doc:"Opaque cursor from page.next_cursor" example:"eyJvIjo1MH0"`
 }
@@ -62,26 +62,25 @@ func registerFavorites(reg *Registry) {
 		"Answer whether the item is one of the acting profile's favorites: the entry, or 404 when it is not (or the viewer may not see it).")),
 		reg.getFavorite)
 	Register(reg, viewerNoContentMutation(humaOp(http.MethodPut, Prefix+"/favorites/{item_id}", "addFavorite", "favorites",
-		"Add the item to the acting profile's favorites. Automatic retries are unsafe because provider and refresh effects are not change-gated.")),
+		"Add the item to the acting profile's favorites. Adding an item already there succeeds and changes nothing, so a retry repeats no change or notification; it cannot resend notifications an interrupted earlier call never sent.")),
 		reg.addFavorite)
 	Register(reg, viewerNoContentMutation(humaOp(http.MethodDelete, Prefix+"/favorites/{item_id}", "deleteFavorite", "favorites",
-		"Remove the item from the acting profile's favorites; an absent entry succeeds, but automatic retries can repeat provider and refresh effects.")),
+		"Remove the item from the acting profile's favorites. An absent entry succeeds and changes nothing, so a retry repeats no change or notification; it cannot resend notifications an interrupted earlier call never sent.")),
 		reg.deleteFavorite)
 }
 
 // personalListViewer is the identity a personal-list seam acts as. The v2
 // listener does not read a device header, so the access filter carries no
 // device id.
-func personalListViewer(ctx context.Context, imageSize string) (handlers.PersonalListViewer, *Problem) {
+func personalListViewer(ctx context.Context, art imagesize.Request) (handlers.PersonalListViewer, *Problem) {
 	userID, profileID, p := viewerIdentity(ctx)
 	if p != nil {
 		return handlers.PersonalListViewer{}, p
 	}
-	size, err := imagesize.Parse(imageSize)
-	if err != nil {
-		size = imagesize.Unset
-	}
-	return handlers.PersonalListViewer{UserID: userID, ProfileID: profileID, Access: handlers.AccessFilterFromContext(ctx, ""), ImageSize: size}, nil
+	return handlers.PersonalListViewer{
+		UserID: userID, ProfileID: profileID, Access: handlers.AccessFilterFromContext(ctx, ""),
+		ImageSize: art.Size, ImageWidths: art.Widths,
+	}, nil
 }
 
 // personalListScope binds a personal list's cursor to the profile and the
@@ -126,7 +125,7 @@ func (reg *Registry) listFavorites(ctx context.Context, cursors *Cursors, in *Fa
 	if reg.deps.PersonalLists == nil {
 		return nil, unavailable("favorites")
 	}
-	viewer, p := personalListViewer(ctx, in.ImageSize)
+	viewer, p := personalListViewer(ctx, in.Artwork())
 	if p != nil {
 		return nil, p
 	}
@@ -177,7 +176,7 @@ func (reg *Registry) getFavorite(ctx context.Context, in *FavoriteItemInput) (*F
 	if reg.deps.PersonalLists == nil {
 		return nil, unavailable("favorites")
 	}
-	viewer, p := personalListViewer(ctx, "")
+	viewer, p := personalListViewer(ctx, imagesize.Request{})
 	if p != nil {
 		return nil, p
 	}
@@ -199,7 +198,7 @@ func (reg *Registry) addFavorite(ctx context.Context, in *FavoriteItemInput) (*s
 	if reg.deps.PersonalLists == nil {
 		return nil, unavailable("favorites")
 	}
-	viewer, p := personalListViewer(ctx, "")
+	viewer, p := personalListViewer(ctx, imagesize.Request{})
 	if p != nil {
 		return nil, p
 	}
@@ -213,7 +212,7 @@ func (reg *Registry) deleteFavorite(ctx context.Context, in *FavoriteItemInput)
 	if reg.deps.PersonalLists == nil {
 		return nil, unavailable("favorites")
 	}
-	viewer, p := personalListViewer(ctx, "")
+	viewer, p := personalListViewer(ctx, imagesize.Request{})
 	if p != nil {
 		return nil, p
 	}
diff --git a/internal/apiv2/favorites_test.go b/internal/apiv2/favorites_test.go
index f3eb0d0c05..355e0223bb 100644
--- a/internal/apiv2/favorites_test.go
+++ b/internal/apiv2/favorites_test.go
@@ -77,6 +77,34 @@ func (f *fakePersonalLists) ListFavoritesPage(_ context.Context, viewer handlers
 	return page, cards, nil
 }
 
+// VisibleItemIDs reports every id the catalog "has" as visible.
+func (f *fakePersonalLists) VisibleItemIDs(_ context.Context, _ handlers.PersonalListViewer, ids []string) (map[string]bool, error) {
+	if f.err != nil {
+		return nil, f.err
+	}
+	visible := make(map[string]bool, len(ids))
+	for _, id := range ids {
+		visible[id] = !f.missing[id]
+	}
+	return visible, nil
+}
+
+// ResolveCards resolves a series card for every id the catalog "has".
+func (f *fakePersonalLists) ResolveCards(_ context.Context, viewer handlers.PersonalListViewer, ids []string) ([]handlers.CollectionItemView, error) {
+	f.viewers = append(f.viewers, viewer)
+	if f.err != nil {
+		return nil, f.err
+	}
+	cards := make([]handlers.CollectionItemView, 0, len(ids))
+	for _, id := range ids {
+		if f.missing[id] {
+			continue
+		}
+		cards = append(cards, handlers.CollectionItemView{ContentID: id, Type: "series", Title: "Title " + id, Status: "matched"})
+	}
+	return cards, nil
+}
+
 func (f *fakePersonalLists) GetFavorite(_ context.Context, viewer handlers.PersonalListViewer, itemID string) (userstore.Favorite, bool, error) {
 	if f.err != nil {
 		return userstore.Favorite{}, false, f.err
diff --git a/internal/apiv2/fixtures_test.go b/internal/apiv2/fixtures_test.go
index e20a90fd66..ab55d3b2be 100644
--- a/internal/apiv2/fixtures_test.go
+++ b/internal/apiv2/fixtures_test.go
@@ -16,6 +16,7 @@ import (
 	"time"
 
 	"github.com/prairie-server/prairie-server/internal/policy"
+	"github.com/prairie-server/prairie-server/internal/sections/recipes"
 
 	chimw "github.com/go-chi/chi/v5/middleware"
 
@@ -1755,7 +1756,103 @@ func fixtureCases() []fixtureCase {
 	cases = append(cases, loginSessionFixtureCases()...)
 	cases = append(cases, adminDownloadStorageFixtureCases()...)
 	cases = append(cases, homeLayoutItemsFixtureCases()...)
-	return append(cases, catalogLettersFixtureCases()...)
+	cases = append(cases, resumePositionFixtureCases()...)
+	cases = append(cases, catalogLettersFixtureCases()...)
+	cases = append(cases, pushRegistrationReceiptFixtureCases()...)
+	cases = append(cases, adminNotificationPushDeliveryFixtureCases()...)
+	cases = append(cases, unmatchedItemIgnoreFixtureCases()...)
+	cases = append(cases, notInterestedFixtureCases()...)
+	cases = append(cases, notificationSeriesFixtureCases()...)
+	cases = append(cases, notificationSeriesMuteFixtureCases()...)
+	return append(cases, seasonalThemeFixtureCases()...)
+}
+
+// fixtureSeasonalThemes is recipes.SeasonalThemes with every list link moved
+// to a reserved host, so the committed fixture names no real list site. The
+// web editor tests use the resulting fixture as their catalog.
+func fixtureSeasonalThemes() []recipes.SeasonalTheme {
+	themes := make([]recipes.SeasonalTheme, 0, len(recipes.SeasonalThemes))
+	for _, theme := range recipes.SeasonalThemes {
+		vibes := make([]recipes.SeasonalVibe, len(theme.Vibes))
+		for i, vibe := range theme.Vibes {
+			vibe.ListURL = strings.Replace(vibe.ListURL, "https://mdblist.com/", "https://lists.example.test/", 1)
+			vibes[i] = vibe
+		}
+		theme.Vibes = vibes
+		themes = append(themes, theme)
+	}
+	return themes
+}
+
+// seasonalThemeFixtureCases pin the Seasonal Picks holiday catalog.
+func seasonalThemeFixtureCases() []fixtureCase {
+	return []fixtureCase{
+		{name: "list_seasonal_themes_ok", operationID: opListSeasonalThemes,
+			scenario: "The holidays a Seasonal Picks row can follow in calendar order, each with its curated vibes; a holiday that moves or recurs weekly has no start and end, and a weekly one cannot take a row's own dates.",
+			method:   http.MethodGet, path: "/api/v2/sections/seasonal-themes", headers: with(bearer(memberToken), "X-Profile-Id", "p-owner"),
+			status: http.StatusOK, assertHeaders: []string{"Content-Type", "Cache-Control"}, schema: "#/components/schemas/SeasonalThemeCatalog"},
+	}
+}
+
+// notInterestedFixtureCases pin the Not interested marks: the paged list, one
+// mark, the refusals, and the capability document.
+func notInterestedFixtureCases() []fixtureCase {
+	problem := "#/components/schemas/Problem"
+	return []fixtureCase{
+		{name: "list_not_interested_ok", operationID: opListNotInterested,
+			scenario: "The first page of the titles a profile marked Not interested as catalog cards, newest mark first, with an opaque cursor for the next page.",
+			method:   http.MethodGet, path: "/api/v2/not-interested?limit=1", headers: with(bearer(memberToken), "X-Profile-Id", "p-owner"),
+			status: http.StatusOK, assertHeaders: []string{"Content-Type", "Cache-Control"}, schema: "#/components/schemas/NotInterestedCollection"},
+		{name: "get_not_interested_ok", operationID: "getNotInterested",
+			scenario: "The profile marked the title Not interested: the mark with when it was made.",
+			method:   http.MethodGet, path: "/api/v2/not-interested/movie:c", headers: with(bearer(memberToken), "X-Profile-Id", "p-owner"),
+			status: http.StatusOK, assertHeaders: []string{"Content-Type", "Cache-Control"}, schema: "#/components/schemas/NotInterestedEntry"},
+		{name: "get_not_interested_not_found", operationID: "getNotInterested",
+			scenario: "The profile has not marked the title.",
+			method:   http.MethodGet, path: "/api/v2/not-interested/movie:nope", headers: with(bearer(memberToken), "X-Profile-Id", "p-owner"),
+			status: http.StatusNotFound, assertHeaders: []string{"Content-Type", "Cache-Control"}, schema: problem},
+		{name: "mark_not_interested_episode_rejected", operationID: "markNotInterested",
+			scenario: "An episode cannot be marked; the series can.",
+			method:   http.MethodPut, path: "/api/v2/not-interested/episode:x", headers: with(bearer(memberToken), "X-Profile-Id", "p-owner"),
+			status: http.StatusUnprocessableEntity, assertHeaders: []string{"Content-Type", "Cache-Control"}, schema: problem},
+		{name: "mark_not_interested_not_found", operationID: "markNotInterested",
+			scenario: "A title the viewer may not see cannot be marked.",
+			method:   http.MethodPut, path: "/api/v2/not-interested/movie:hidden", headers: with(bearer(memberToken), "X-Profile-Id", "p-owner"),
+			status: http.StatusNotFound, assertHeaders: []string{"Content-Type", "Cache-Control"}, schema: problem},
+		{name: "unmark_not_interested_locked_profile", operationID: "unmarkNotInterested",
+			scenario: "A PIN-locked profile without X-Profile-Token.",
+			method:   http.MethodDelete, path: "/api/v2/not-interested/movie:c", headers: with(bearer(memberToken), "X-Profile-Id", "p-locked"),
+			status: http.StatusForbidden, assertHeaders: []string{"Content-Type", "Cache-Control"}, schema: problem},
+		{name: "get_not_interested_capability_ok", operationID: "getNotInterestedCapability",
+			scenario: "Profiles on this server can mark movies and series Not interested.",
+			method:   http.MethodGet, path: "/api/v2/capabilities/not-interested", headers: with(bearer(memberToken), "X-Profile-Id", "p-owner"),
+			status: http.StatusOK, assertHeaders: []string{"Content-Type", "Cache-Control", "ETag"}, schema: "#/components/schemas/NotInterestedCapability"},
+	}
+}
+
+// resumePositionFixtureCases pin clearing a resume position and the progress
+// capability document that advertises it.
+func resumePositionFixtureCases() []fixtureCase {
+	problem := "#/components/schemas/Problem"
+	owner := with(bearer(memberToken), "X-Profile-Id", "p-owner")
+	return []fixtureCase{
+		{name: "get_progress_capabilities_ok", operationID: "getProgressCapabilities",
+			scenario: "The progress capability document: clearResumePosition is served.",
+			method:   http.MethodGet, path: "/api/v2/progress/capabilities", headers: owner,
+			status: http.StatusOK, assertHeaders: []string{"Content-Type", "Cache-Control", "ETag"}, schema: "#/components/schemas/ProgressCapabilities"},
+		{name: "clear_resume_position_ok", operationID: "clearResumePosition",
+			scenario: "Clearing a movie's resume position: 204 with no body; its watched state and history stay.",
+			method:   http.MethodDelete, path: "/api/v2/progress/movie:heat-1995/position", headers: owner,
+			status: http.StatusNoContent, assertHeaders: []string{"Cache-Control"}},
+		{name: "clear_resume_position_not_leaf", operationID: "clearResumePosition",
+			scenario: "A season or series has no single resume position: a validation failure naming the path parameter.",
+			method:   http.MethodDelete, path: "/api/v2/progress/series:heat/position", headers: owner,
+			status: http.StatusUnprocessableEntity, assertHeaders: []string{"Content-Type", "Cache-Control"}, schema: problem},
+		{name: "clear_resume_position_not_found", operationID: "clearResumePosition",
+			scenario: "An item outside the viewer's catalog has no resume position to clear.",
+			method:   http.MethodDelete, path: "/api/v2/progress/movie:missing/position", headers: owner,
+			status: http.StatusNotFound, assertHeaders: []string{"Content-Type", "Cache-Control"}, schema: problem},
+	}
 }
 
 // homeLayoutItemsFixtureCases pin the home layout carrying the cards of its
@@ -1922,10 +2019,18 @@ func fixtureDeps() Dependencies {
 	deps := pilotDeps(&fakeProgress{entries: progressRows()}, nil)
 	deps.NetworkAccess = newFakeNetworkAccess()
 	deps.ServerIdentity = fakeServerIdentity{id: fixtureServerID}
+	deps.OrderedApplePush = new(fakeOrderedApple)
+	deps.OrderedAndroidPush = new(fakeOrderedPush)
 	fixtureProviders := netaccess.NewStatusCache()
 	fixtureProviders.Report(netaccess.Status{InstallationID: 7, Provider: "stub", State: netaccess.StateConnected, Origin: "https://silo.overlay.example.test"})
-	deps.ServerConnections = ServerConnections{PublicURL: func() string { return "https://silo.example.test" }, Providers: fixtureProviders}
+	deps.ServerConnections = ServerConnections{
+		PublicURL:   func() string { return "https://silo.example.test" },
+		LocalURL:    func() string { return "http://prairie.lan.example.test:8080" },
+		Providers:   fixtureProviders,
+		LocalTLSPin: "n4bQgYhMfWWaL+qgxVrQFaO/TxsrC4Is0V1sFbDwCgg=",
+	}
 	deps.SubtitleAIReads = &fakeSubtitleAIReads{}
+	deps.SeasonalThemes = fixtureSeasonalThemes()
 	deps.Downloads = &fakeDownloadRegistry{}
 	deps.DownloadCreation = &fakeDownloadCreation{row: &downloads.Download{ID: "entry", ContentID: "movie", MediaFileID: 42, Revision: 1, CreatedAt: time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC), Status: downloads.StatusReady, Quality: downloads.QualityOriginal, EffectiveQuality: downloads.QualityOriginal, Format: downloads.FormatOriginal, DeviceID: "device-one"}, page: downloads.CreatePage{BatchID: "intent", Skipped: []downloads.SkippedDownload{{EpisodeID: "missing", Reason: "no_file"}}}}
 	deps.DownloadSubscriptionMutations = &fakeSubscriptionMutations{row: syntheticDownloadSubscription()}
@@ -1999,6 +2104,7 @@ func fixtureDeps() Dependencies {
 	deps.HomeSections = home
 	deps.Recipes = home
 	deps.PersonalLists = &fakePersonalLists{favorites: favoriteRows(), watchlist: watchlistRows(), missing: map[string]bool{"movie:hidden": true, "series:hidden": true}}
+	deps.NotInterested = &fakeNotInterested{marks: notInterestedRows(), missing: map[string]bool{"movie:hidden": true}}
 	deps.Ratings = &fakeRatings{ratings: ratingRows(), hidden: map[string]bool{"movie:hidden": true}}
 	deps.History = newFakeHistory()
 	deps.Watch = &fakeWatch{}
diff --git a/internal/apiv2/history.go b/internal/apiv2/history.go
index b9ed6ee751..99cfe67855 100644
--- a/internal/apiv2/history.go
+++ b/internal/apiv2/history.go
@@ -31,7 +31,7 @@ type HistoryCard struct {
 
 // HistoryListInput is the listHistory query.
 type HistoryListInput struct {
-	ImageSize string `query:"image_size" enum:"small,medium,large,original" doc:"Artwork variant to presign; absent picks each surface's default" example:"medium"`
+	ArtworkQuery
 	LimitParam
 	Cursor string `query:"cursor" doc:"Opaque cursor from page.next_cursor" example:"eyJvIjo1MH0"`
 }
@@ -104,7 +104,7 @@ func (reg *Registry) listHistory(ctx context.Context, cursors *Cursors, in *Hist
 		// The cards are access-filtered, so the cursor dies with the viewer
 		// policy it was minted under.
 		Security:   strconv.Itoa(userID) + "/" + profileID + "/" + viewerScopeDigest(ctx),
-		Filter:     in.ImageSize,
+		Filter:     in.ImageSize + in.widthsCursorFilter(),
 		Sort:       "-watched_at,-id",
 		Tiebreaker: "id",
 	}
@@ -132,7 +132,7 @@ func (reg *Registry) listHistory(ctx context.Context, cursors *Cursors, in *Hist
 			return nil, NewProblem(TypeInternalError, "An unexpected error occurred.")
 		}
 	}
-	cards, err := reg.deps.History.HistoryPageCards(ctx, sectionViewer(ctx, in.ImageSize), entries)
+	cards, err := reg.deps.History.HistoryPageCards(ctx, sectionViewer(ctx, in.Artwork()), entries)
 	if err != nil {
 		return nil, serviceProblem(err)
 	}
diff --git a/internal/apiv2/home.go b/internal/apiv2/home.go
index 039c010d9d..797070fdce 100644
--- a/internal/apiv2/home.go
+++ b/internal/apiv2/home.go
@@ -85,8 +85,8 @@ type HomeDismissalUpsertInput struct {
 type HomeLayoutInput struct {
 	// The maximum must equal handlers.MaxHomeLayoutIncludedSections, which
 	// getHomeCapabilities advertises; TestHomeCapabilities pins the two.
-	IncludeItems int    `query:"include_items" default:"0" minimum:"0" maximum:"4" doc:"Also answer the cards of the first N sections in display order (featured sections count where they appear) in included_sections, saving a getHomeSectionItems call per row. 0 answers the layout alone. Send it only when getHomeCapabilities reports include_items_max; an older server rejects the parameter" example:"2"`
-	ImageSize    string `query:"image_size" enum:"small,medium,large,original" doc:"Artwork variant to presign for included_sections, as on getHomeSectionItems; absent picks each surface's default" example:"medium"`
+	IncludeItems int `query:"include_items" default:"0" minimum:"0" maximum:"4" doc:"Also answer the cards of the first N sections in display order (featured sections count where they appear) in included_sections, saving a getHomeSectionItems call per row. 0 answers the layout alone. Send it only when getHomeCapabilities reports include_items_max; an older server rejects the parameter" example:"2"`
+	ArtworkQuery
 }
 
 // HomeLayout is the home page's sections in display order and, on request,
@@ -117,13 +117,13 @@ type HomeCapabilitiesOutput struct {
 
 // HomeSectionsInput is the listHomeSections query.
 type HomeSectionsInput struct {
-	ImageSize string `query:"image_size" enum:"small,medium,large,original" doc:"Artwork variant to presign; absent picks each surface's default" example:"medium"`
+	ArtworkQuery
 }
 
 // HomeSectionItemsInput is the getHomeSectionItems query.
 type HomeSectionItemsInput struct {
-	ID        string `path:"id" minLength:"1" doc:"Section identifier from the home layout" example:"continue_watching"`
-	ImageSize string `query:"image_size" enum:"small,medium,large,original" doc:"Artwork variant to presign; absent picks each surface's default" example:"medium"`
+	ID string `path:"id" minLength:"1" doc:"Section identifier from the home layout" example:"continue_watching"`
+	ArtworkQuery
 }
 
 // RecipePreset is one gallery preset: a recipe plus the config it starts from.
@@ -158,6 +158,38 @@ type RecipeCatalog struct {
 	Categories []RecipeCategory `json:"categories" doc:"Empty, never null"`
 }
 
+// SeasonalVibe is one curated take on a holiday: a public MDBList list whose
+// titles a Seasonal Picks row shows, most popular on IMDb first.
+type SeasonalVibe struct {
+	Key         string `json:"key" doc:"Stored in the row's vibes config; stable" example:"family"`
+	Name        string `json:"name" example:"Family Halloween"`
+	Title       string `json:"title" doc:"The row's title while this vibe is in season, unless the row sets its own" example:"Family Halloween"`
+	Description string `json:"description" example:"Spooky fun for all ages."`
+	ListURL     string `json:"list_url" doc:"The MDBList list behind the vibe" example:"https://mdblist.com/lists/purple_smurf/halloween-family2"`
+}
+
+// SeasonalTheme is one holiday a Seasonal Picks row can follow.
+type SeasonalTheme struct {
+	Key           string         `json:"key" doc:"Stored in the row's enabled_themes config; stable" example:"halloween"`
+	Name          string         `json:"name" example:"Halloween"`
+	When          string         `json:"when" doc:"When the holiday is in season by default, for display" example:"October"`
+	Start         string         `json:"start,omitempty" doc:"First day of the default window, MM-DD. Absent when the holiday moves (Easter) or recurs weekly." example:"10-01"`
+	End           string         `json:"end,omitempty" doc:"Last day of the default window, MM-DD, inclusive; before start when the window wraps across New Year" example:"10-31"`
+	DatesEditable bool           `json:"dates_editable" doc:"Whether a row may set its own yearly window for this holiday in theme_dates. False for weekly themes."`
+	Vibes         []SeasonalVibe `json:"vibes" doc:"The first vibe is the default; never empty"`
+}
+
+// SeasonalThemeCatalog is the listSeasonalThemes response.
+type SeasonalThemeCatalog struct {
+	Themes            []SeasonalTheme `json:"themes" doc:"In calendar order, for display: dated holidays by their usual start, then the weekly ones"`
+	MaxCustomHolidays int             `json:"max_custom_holidays" doc:"The most custom holidays one row may define" example:"12"`
+}
+
+// SeasonalThemeCatalogOutput wraps SeasonalThemeCatalog.
+type SeasonalThemeCatalogOutput struct {
+	Body SeasonalThemeCatalog
+}
+
 // RecipeCatalogOutput is the listSectionRecipes response.
 type RecipeCatalogOutput struct {
 	Body RecipeCatalog
@@ -197,6 +229,7 @@ const (
 	opGetHomeSectionItems         = "getHomeSectionItems"
 	opListSectionRecipes          = "listSectionRecipes"
 	opListSectionRecipeCandidates = "listSectionRecipeCandidates"
+	opListSeasonalThemes          = "listSeasonalThemes"
 )
 
 func registerHome(reg *Registry) {
@@ -235,6 +268,8 @@ func registerHome(reg *Registry) {
 		"The section recipe gallery: every visible recipe with its presets, grouped by category.")), reg.listSectionRecipes)
 	Register(reg, gallery(humaOp(http.MethodGet, Prefix+"/sections/recipes/{type}/candidates", opListSectionRecipeCandidates, "home",
 		"The values a parameterized recipe offers for its parameter.")), reg.listSectionRecipeCandidates)
+	Register(reg, Operation{Operation: humaOp(http.MethodGet, Prefix+"/sections/seasonal-themes", opListSeasonalThemes, "home",
+		"The holidays a Seasonal Picks row can follow, with the curated vibes each offers."), Class: ClassProfileScoped, ProfileOptional: true}, reg.listSeasonalThemes)
 }
 
 func (reg *Registry) recipes() (RecipeService, *Problem) {
@@ -408,7 +443,7 @@ func (reg *Registry) getHomeLayout(ctx context.Context, in *HomeLayoutInput) (*H
 	if _, _, p := viewerIdentity(ctx); p != nil {
 		return nil, p
 	}
-	view, err := svc.HomeLayoutWithItems(ctx, sectionViewer(ctx, in.ImageSize), in.IncludeItems)
+	view, err := svc.HomeLayoutWithItems(ctx, sectionViewer(ctx, in.Artwork()), in.IncludeItems)
 	if err != nil {
 		return nil, serviceProblem(err)
 	}
@@ -430,7 +465,7 @@ func (reg *Registry) listHomeSections(ctx context.Context, in *HomeSectionsInput
 	if _, _, p := viewerIdentity(ctx); p != nil {
 		return nil, p
 	}
-	view, err := svc.HomeSections(ctx, sectionViewer(ctx, in.ImageSize))
+	view, err := svc.HomeSections(ctx, sectionViewer(ctx, in.Artwork()))
 	if err != nil {
 		return nil, serviceProblem(err)
 	}
@@ -450,7 +485,7 @@ func (reg *Registry) getHomeSectionItems(ctx context.Context, in *HomeSectionIte
 	if _, _, p := viewerIdentity(ctx); p != nil {
 		return nil, p
 	}
-	view, err := svc.HomeSectionItems(ctx, in.ID, sectionViewer(ctx, in.ImageSize))
+	view, err := svc.HomeSectionItems(ctx, in.ID, sectionViewer(ctx, in.Artwork()))
 	if err != nil {
 		return nil, serviceProblem(err)
 	}
@@ -497,6 +532,32 @@ func (reg *Registry) listSectionRecipes(ctx context.Context, _ *struct{}) (*Reci
 	return &RecipeCatalogOutput{Body: out}, nil
 }
 
+func (reg *Registry) listSeasonalThemes(ctx context.Context, _ *struct{}) (*SeasonalThemeCatalogOutput, error) {
+	if claimsFrom(ctx) == nil {
+		return nil, NewProblem(TypeAuthenticationRequired, "Authentication is required.")
+	}
+	out := SeasonalThemeCatalog{Themes: []SeasonalTheme{}, MaxCustomHolidays: recipes.MaxSeasonalCustomHolidays}
+	themes := reg.deps.SeasonalThemes
+	if themes == nil {
+		themes = recipes.SeasonalThemes
+	}
+	for _, theme := range themes {
+		if theme.Hidden {
+			continue
+		}
+		vibes := make([]SeasonalVibe, 0, len(theme.Vibes))
+		for _, v := range theme.Vibes {
+			vibes = append(vibes, SeasonalVibe{Key: v.Key, Name: v.Name, Title: v.Title, Description: v.Description, ListURL: v.ListURL})
+		}
+		out.Themes = append(out.Themes, SeasonalTheme{
+			Key: theme.Key, Name: theme.Name, When: theme.When,
+			Start: theme.Start, End: theme.End, DatesEditable: !theme.Weekly,
+			Vibes: vibes,
+		})
+	}
+	return &SeasonalThemeCatalogOutput{Body: out}, nil
+}
+
 func (reg *Registry) listSectionRecipeCandidates(ctx context.Context, in *RecipeCandidatesInput) (*RecipeCandidateCollectionOutput, error) {
 	svc, p := reg.recipes()
 	if p != nil {
diff --git a/internal/apiv2/home_test.go b/internal/apiv2/home_test.go
index 96cb050e29..a0dba06043 100644
--- a/internal/apiv2/home_test.go
+++ b/internal/apiv2/home_test.go
@@ -313,11 +313,12 @@ func TestGetHomeLayoutIncludedSections(t *testing.T) {
 func TestListHomeSections(t *testing.T) {
 	deps, fake := homeDeps(t)
 	h := newTestHandler(t, deps)
-	rec := do(t, h, http.MethodGet, "/api/v2/home/sections?image_size=large", "", viewerHeaders())
+	rec := do(t, h, http.MethodGet, "/api/v2/home/sections?image_size=large&backdrop_width=2688", "", viewerHeaders())
 	if rec.Code != 200 || !strings.Contains(rec.Body.String(), `"id":"continue_watching"`) || !strings.Contains(rec.Body.String(), `"total_count":1`) || !strings.Contains(rec.Body.String(), `"items":[{`) {
 		t.Fatal(rec.Code, rec.Body.String())
 	}
-	if fake.lastViewer.ImageSize != imagesize.Large || fake.lastViewer.Access.UserID != 1 || fake.lastViewer.Access.ProfileID != "p-owner" {
+	if fake.lastViewer.ImageSize != imagesize.Large || fake.lastViewer.ImageWidths != (imagesize.Widths{Backdrop: 2688}) ||
+		fake.lastViewer.Access.UserID != 1 || fake.lastViewer.Access.ProfileID != "p-owner" {
 		t.Fatalf("viewer = %+v", fake.lastViewer)
 	}
 	requireProblem(t, do(t, h, http.MethodGet, "/api/v2/home/sections?image_size=huge", "", viewerHeaders()), TypeValidationFailed)
diff --git a/internal/apiv2/household_profile_gate_test.go b/internal/apiv2/household_profile_gate_test.go
index 886e93805a..6d4d8eabd0 100644
--- a/internal/apiv2/household_profile_gate_test.go
+++ b/internal/apiv2/household_profile_gate_test.go
@@ -342,6 +342,7 @@ var householdGateExemptOperations = map[string]string{
 	"getNotificationApplePushDisplay": "a display token binds the profile from its claims",
 	"listSectionRecipeCandidates":     "section recipe gallery metadata",
 	"listSectionRecipes":              "section recipe gallery metadata",
+	"listSeasonalThemes":              "static seasonal holiday and vibe catalog",
 }
 
 // TestHouseholdProfileGateCoversProfileOptionalOperations: every operation
diff --git a/internal/apiv2/invitations.go b/internal/apiv2/invitations.go
index 2ea116f17d..2c7c70227b 100644
--- a/internal/apiv2/invitations.go
+++ b/internal/apiv2/invitations.go
@@ -392,6 +392,9 @@ func registerInvitations(reg *Registry) {
 				}
 				input.LibraryIDs = append(input.LibraryIDs, n)
 			}
+			if p := reg.rejectUnknownLibraries(ctx, &input.LibraryIDs, locationLibraryIDs); p != nil {
+				return nil, p
+			}
 		}
 		return invitationDelivery(svc.Send(ctx, input))
 	})
diff --git a/internal/apiv2/invitations_test.go b/internal/apiv2/invitations_test.go
index 97c5975423..c761d7308c 100644
--- a/internal/apiv2/invitations_test.go
+++ b/internal/apiv2/invitations_test.go
@@ -6,6 +6,7 @@ import (
 	"errors"
 	"net/http"
 	"net/http/httptest"
+	"slices"
 	"strings"
 	"testing"
 	"time"
@@ -379,3 +380,22 @@ func TestResendInvitationDeliveryChoice(t *testing.T) {
 		t.Fatal(noAddress.Body.String())
 	}
 }
+
+// An invitation's library list is applied verbatim when it is accepted, so an
+// id no library carries is refused before the invitation is sent.
+func TestInvitationRejectsUnknownLibraries(t *testing.T) {
+	f := fixtureInvitations()
+	h := invitationTestHandler(f) // knows libraries 1-4
+	path := Prefix + "/admin/invitations"
+	p := requireProblem(t, do(t, h, http.MethodPost, path, `{"email":"a@example.invalid","library_ids":["2","9"]}`, actingRequestAdmin), TypeValidationFailed)
+	if len(p.Errors) != 1 || p.Errors[0].Location != locationLibraryIDs || p.Errors[0].Detail != "unknown library identifier: 9" {
+		t.Fatalf("errors = %+v", p.Errors)
+	}
+	if f.writes != 0 {
+		t.Fatal("unknown library reached the service")
+	}
+	r := do(t, h, http.MethodPost, path, `{"email":"a@example.invalid","library_ids":["2","1"]}`, actingRequestAdmin)
+	if r.Code != 201 || f.send == nil || !slices.Equal(f.send.LibraryIDs, []int{2, 1}) {
+		t.Fatal(r.Code, r.Body.String(), f.send)
+	}
+}
diff --git a/internal/apiv2/libraries.go b/internal/apiv2/libraries.go
index 3af266eaa0..5a5d426fda 100644
--- a/internal/apiv2/libraries.go
+++ b/internal/apiv2/libraries.go
@@ -358,20 +358,28 @@ type StaleIDRematchInput struct {
 
 // UnmatchedItem is a catalog item awaiting a metadata match.
 type UnmatchedItem struct {
-	ContentID   string `json:"content_id" example:"movie:heat-1995"`
-	Title       string `json:"title" example:"Heat"`
-	Year        int    `json:"year" example:"1995"`
-	ContentType string `json:"content_type" example:"movie"`
-	LibraryID   ID     `json:"library_id" doc:"\"0\" when the item is in no library" example:"1"`
-	LibraryName string `json:"library_name" example:"Movies"`
-	Status      string `json:"status" doc:"unmatched, pending or ambiguous" example:"unmatched"`
+	ContentID   string   `json:"content_id" example:"movie:heat-1995"`
+	Title       string   `json:"title" example:"Heat"`
+	Year        int      `json:"year" example:"1995"`
+	ContentType string   `json:"content_type" example:"movie"`
+	LibraryID   ID       `json:"library_id" doc:"\"0\" when the item is in no library" example:"1"`
+	LibraryName string   `json:"library_name" example:"Movies"`
+	Status      string   `json:"status" doc:"unmatched, pending or ambiguous" example:"unmatched"`
+	IgnoredAt   *Instant `json:"ignored_at,omitempty" doc:"When an admin marked the item as intentionally unmatched; absent unless it is ignored"`
 }
 
 // UnmatchedItemListInput is the listUnmatchedItems query.
 type UnmatchedItemListInput struct {
 	LimitParam
-	Query  string `query:"q" doc:"Case-insensitive substring over title, type, status and library name" example:"heat"`
-	Cursor string `query:"cursor" doc:"Opaque cursor from page.next_cursor" example:"eyJvIjo1MH0"`
+	Query   string `query:"q" doc:"Case-insensitive substring over title, type, status and library name" example:"heat"`
+	Ignored bool   `query:"ignored" default:"false" doc:"List the items an admin marked as intentionally unmatched instead of the ones awaiting a match"`
+	Cursor  string `query:"cursor" doc:"Opaque cursor from page.next_cursor" example:"eyJvIjo1MH0"`
+}
+
+// UnmatchedItemIgnoreInput names the item ignoreUnmatchedItem and
+// unignoreUnmatchedItem act on.
+type UnmatchedItemIgnoreInput struct {
+	ContentID string `path:"content_id" minLength:"1" doc:"The catalog item" example:"local-ad5847acdd9590cc9d353da12446"`
 }
 
 // UnmatchedItemCollection is the named envelope the contract carries, with
@@ -570,6 +578,8 @@ const (
 	opRefreshLibraryMetadata   = "refreshLibraryMetadata"
 	opListLibraryRoots         = "listLibraryRoots"
 	opListUnmatchedItems       = "listUnmatchedItems"
+	opIgnoreUnmatchedItem      = "ignoreUnmatchedItem"
+	opUnignoreUnmatchedItem    = "unignoreUnmatchedItem"
 	opListStaleIDs             = "listStaleIds"
 	opListSkippedRoots         = "listSkippedRoots"
 	tiebreakerContentID        = "content_id"
@@ -586,7 +596,7 @@ func registerLibraries(reg *Registry) {
 		case opCreateLibrary, opUpdateLibrary, opRematchStaleId, opSetLibraryProviders,
 			opConfirmEmptyRootCleanup, opRetryMetadataMatchQueue, opCancelMetadataMatchQueue, opDeleteLibraryPoster, opDeleteRootOverride, opSetRootOverride:
 			operation.RetrySafety = RetrySafetyNonRetryable
-		case opDeleteLibrary, opCheckLibraryMount, opReorderLibraries:
+		case opDeleteLibrary, opCheckLibraryMount, opReorderLibraries, opIgnoreUnmatchedItem, opUnignoreUnmatchedItem:
 			operation.RetrySafety = RetrySafetyNaturalIdempotent
 		case opRefreshLibraryMetadata:
 			operation.RetrySafety = RetrySafetyCoalescing
@@ -657,10 +667,22 @@ func registerLibraries(reg *Registry) {
 		"Clear an item's provider identifiers and refresh its metadata in the background.")), reg.rematchStaleID)
 
 	Register(reg, admin(humaOp(http.MethodGet, Prefix+"/libraries/unmatched-items", opListUnmatchedItems, "libraries",
-		"Page the catalog items awaiting a metadata match, in title order.")), func(ctx context.Context, in *UnmatchedItemListInput) (*UnmatchedItemCollectionOutput, error) {
+		"Page the catalog items awaiting a metadata match, in title order. Items an admin marked as intentionally unmatched are left out unless ignored is set, which lists only those.")), func(ctx context.Context, in *UnmatchedItemListInput) (*UnmatchedItemCollectionOutput, error) {
 		return reg.listUnmatchedItems(ctx, cursors, in)
 	})
 
+	ignore := humaOp(http.MethodPut, Prefix+"/libraries/unmatched-items/{content_id}/ignore", opIgnoreUnmatchedItem, "libraries",
+		"Mark an unmatched, pending or ambiguous movie or series as intentionally unmatched: it leaves the unmatched list and the matcher queues and automatic matching leaves it alone, while it stays playable with its local metadata. Match Item still works and clears the mark. Books cannot be ignored.")
+	ignore.DefaultStatus = http.StatusNoContent
+	ignore.Errors = []int{http.StatusNotFound, http.StatusConflict}
+	Register(reg, admin(ignore), reg.ignoreUnmatchedItem)
+
+	unignore := humaOp(http.MethodDelete, Prefix+"/libraries/unmatched-items/{content_id}/ignore", opUnignoreUnmatchedItem, "libraries",
+		"Clear an item's intentionally-unmatched mark so it returns to the unmatched list and automatic matching tries it again; an unmarked item is left as is.")
+	unignore.DefaultStatus = http.StatusNoContent
+	unignore.Errors = []int{http.StatusNotFound}
+	Register(reg, admin(unignore), reg.unignoreUnmatchedItem)
+
 	Register(reg, admin(humaOp(http.MethodPost, Prefix+"/libraries/{id}/confirm-empty-root-cleanup", opConfirmEmptyRootCleanup, "libraries",
 		"Arm the library's next scan to clean up an empty root once instead of treating it as a lost mount.")), reg.confirmEmptyRootCleanup)
 
@@ -1418,6 +1440,25 @@ func (reg *Registry) rematchStaleID(ctx context.Context, in *StaleIDRematchInput
 	return nil, nil
 }
 
+func (reg *Registry) ignoreUnmatchedItem(ctx context.Context, in *UnmatchedItemIgnoreInput) (*struct{}, error) {
+	return reg.setUnmatchedItemIgnored(ctx, in.ContentID, true)
+}
+
+func (reg *Registry) unignoreUnmatchedItem(ctx context.Context, in *UnmatchedItemIgnoreInput) (*struct{}, error) {
+	return reg.setUnmatchedItemIgnored(ctx, in.ContentID, false)
+}
+
+func (reg *Registry) setUnmatchedItemIgnored(ctx context.Context, contentID string, ignored bool) (*struct{}, error) {
+	svc, p := reg.libraryAdmin()
+	if p != nil {
+		return nil, p
+	}
+	if err := svc.SetUnmatchedItemIgnored(ctx, contentID, ignored); err != nil {
+		return nil, libraryProblem(err)
+	}
+	return nil, nil
+}
+
 func (reg *Registry) listUnmatchedItems(ctx context.Context, cursors *Cursors, in *UnmatchedItemListInput) (*UnmatchedItemCollectionOutput, error) {
 	svc, p := reg.libraryAdmin()
 	if p != nil {
@@ -1428,10 +1469,16 @@ func (reg *Registry) listUnmatchedItems(ctx context.Context, cursors *Cursors, i
 		return nil, p
 	}
 	search := strings.TrimSpace(in.Query)
+	filter := "q=" + search
+	if in.Ignored {
+		// Encoded, so no search text can spell this filter; the default keeps
+		// its original form so cursors issued before ignoring existed still work.
+		filter = url.Values{"q": {search}, "ignored": {strconv.FormatBool(in.Ignored)}}.Encode()
+	}
 	scope := CursorScope{
 		OperationID: opListUnmatchedItems,
 		Security:    strconv.Itoa(userID),
-		Filter:      "q=" + search,
+		Filter:      filter,
 		Sort:        "title",
 		Tiebreaker:  tiebreakerContentID,
 	}
@@ -1439,7 +1486,7 @@ func (reg *Registry) listUnmatchedItems(ctx context.Context, cursors *Cursors, i
 	if p != nil {
 		return nil, p
 	}
-	views, total, err := svc.ListUnmatchedItems(ctx, search, in.Limit+1, offset)
+	views, total, err := svc.ListUnmatchedItems(ctx, search, in.Ignored, in.Limit+1, offset)
 	if err != nil {
 		return nil, libraryProblem(err)
 	}
@@ -1457,6 +1504,7 @@ func (reg *Registry) listUnmatchedItems(ctx context.Context, cursors *Cursors, i
 			LibraryID:   IDFromInt(int64(v.LibraryID)),
 			LibraryName: v.LibraryName,
 			Status:      v.Status,
+			IgnoredAt:   instantPtr(v.IgnoredAt),
 		})
 	}
 	return &UnmatchedItemCollectionOutput{Body: UnmatchedItemCollection{Collection: Paginated(items, next), Total: total}}, nil
diff --git a/internal/apiv2/libraries_test.go b/internal/apiv2/libraries_test.go
index deba2d7aa3..e08f5e7d53 100644
--- a/internal/apiv2/libraries_test.go
+++ b/internal/apiv2/libraries_test.go
@@ -35,6 +35,7 @@ type fakeLibraryAdmin struct {
 	lastSearch      string
 	lastLimit       int
 	lastOffset      int
+	lastIgnored     bool
 	// stage B commands.
 	lastRefreshMode adminjob.LibraryRefreshMode
 	lastPosterType  string
@@ -260,18 +261,15 @@ func (f *fakeLibraryAdmin) RematchStaleID(_ context.Context, contentID string) e
 	return f.err
 }
 
-func (f *fakeLibraryAdmin) ListUnmatchedItems(_ context.Context, search string, limit, offset int) ([]handlers.UnmatchedItemView, int, error) {
+func (f *fakeLibraryAdmin) ListUnmatchedItems(_ context.Context, search string, ignored bool, limit, offset int) ([]handlers.UnmatchedItemView, int, error) {
 	if f.err != nil {
 		return nil, 0, f.err
 	}
-	f.lastSearch, f.lastLimit, f.lastOffset = search, limit, offset
-	rows := f.unmatched
-	if search != "" {
-		rows = nil
-		for _, r := range f.unmatched {
-			if strings.Contains(strings.ToLower(r.Title), strings.ToLower(search)) {
-				rows = append(rows, r)
-			}
+	f.lastSearch, f.lastIgnored, f.lastLimit, f.lastOffset = search, ignored, limit, offset
+	rows := []handlers.UnmatchedItemView{}
+	for _, r := range f.unmatched {
+		if (r.IgnoredAt != nil) == ignored && strings.Contains(strings.ToLower(r.Title), strings.ToLower(search)) {
+			rows = append(rows, r)
 		}
 	}
 	if offset > len(rows) {
@@ -280,6 +278,25 @@ func (f *fakeLibraryAdmin) ListUnmatchedItems(_ context.Context, search string,
 	return rows[offset:min(offset+limit, len(rows))], len(rows), nil
 }
 
+func (f *fakeLibraryAdmin) SetUnmatchedItemIgnored(_ context.Context, contentID string, ignored bool) error {
+	if f.err != nil {
+		return f.err
+	}
+	for i := range f.unmatched {
+		if f.unmatched[i].ContentID != contentID {
+			continue
+		}
+		switch {
+		case !ignored:
+			f.unmatched[i].IgnoredAt = nil
+		case f.unmatched[i].IgnoredAt == nil:
+			f.unmatched[i].IgnoredAt = ptr(fixedTime())
+		}
+		return nil
+	}
+	return &handlers.APIError{Status: http.StatusNotFound, Code: "not_found", Message: "Item not found"}
+}
+
 func libraryDeps(t *testing.T) (Dependencies, *fakeLibraryAdmin) {
 	t.Helper()
 	return withLibraryAdmin(pilotDeps(nil, nil))
@@ -301,6 +318,7 @@ func withLibraryAdmin(deps Dependencies) (Dependencies, *fakeLibraryAdmin) {
 			{ContentID: "movie:a", Title: "Alpha", Year: 2001, ContentType: "movie", LibraryID: 1, LibraryName: "Movies", Status: "unmatched"},
 			{ContentID: "movie:b", Title: "Beta", Year: 2002, ContentType: "movie", Status: "pending"},
 			{ContentID: "movie:c", Title: "Gamma", Year: 2003, ContentType: "movie", LibraryID: 1, LibraryName: "Movies", Status: "ambiguous"},
+			{ContentID: "movie:d", Title: "Delta", Year: 2004, ContentType: "movie", LibraryID: 1, LibraryName: "Movies", Status: "unmatched", IgnoredAt: ptr(fixedTime())},
 		},
 	}
 	deps.LibraryAdmin = fake
@@ -768,6 +786,98 @@ func TestListUnmatchedItems(t *testing.T) {
 	requireProblem(t, do(t, h, http.MethodGet, "/api/v2/libraries/unmatched-items", "", bearer(memberToken)), TypePermissionDenied)
 }
 
+func TestIgnoreUnmatchedItem(t *testing.T) {
+	deps, fake := libraryDeps(t)
+	h := newTestHandler(t, deps)
+	list := func(query string) rootPage {
+		t.Helper()
+		rec := do(t, h, http.MethodGet, "/api/v2/libraries/unmatched-items"+query, "", bearer(adminToken))
+		if rec.Code != 200 {
+			t.Fatalf("list %s: %d %s", query, rec.Code, rec.Body.String())
+		}
+		var page rootPage
+		decodeJSON(t, rec.Body, &page)
+		return page
+	}
+	titles := func(page rootPage) []string {
+		out := make([]string, 0, len(page.Items))
+		for _, item := range page.Items {
+			out = append(out, strings.Trim(string(item["title"]), `"`))
+		}
+		return out
+	}
+
+	// Delta is ignored already: it stays out of the default list, which
+	// carries no ignored_at, and is the only item of the ignored view.
+	page := list("")
+	if got := titles(page); page.Total != 3 || strings.Join(got, ",") != "Alpha,Beta,Gamma" || page.Items[0]["ignored_at"] != nil {
+		t.Fatalf("default list = %s total %d", got, page.Total)
+	}
+	page = list("?ignored=true")
+	if got := titles(page); page.Total != 1 || strings.Join(got, ",") != "Delta" || string(page.Items[0]["ignored_at"]) != `"2026-01-02T03:04:05.678Z"` || !fake.lastIgnored {
+		t.Fatalf("ignored list = %s total %d: %v", got, page.Total, page.Items)
+	}
+
+	rec := do(t, h, http.MethodPut, "/api/v2/libraries/unmatched-items/movie:a/ignore", "", bearer(adminToken))
+	if rec.Code != http.StatusNoContent || rec.Body.Len() != 0 {
+		t.Fatalf("ignore = %d %s", rec.Code, rec.Body.String())
+	}
+	if got := titles(list("")); strings.Join(got, ",") != "Beta,Gamma" {
+		t.Fatalf("after ignore, default list = %v", got)
+	}
+	if got := titles(list("?ignored=true")); strings.Join(got, ",") != "Alpha,Delta" {
+		t.Fatalf("after ignore, ignored list = %v", got)
+	}
+	// Ignoring again is a no-op.
+	if rec := do(t, h, http.MethodPut, "/api/v2/libraries/unmatched-items/movie:a/ignore", "", bearer(adminToken)); rec.Code != http.StatusNoContent {
+		t.Fatalf("repeat ignore = %d %s", rec.Code, rec.Body.String())
+	}
+
+	rec = do(t, h, http.MethodDelete, "/api/v2/libraries/unmatched-items/movie:a/ignore", "", bearer(adminToken))
+	if rec.Code != http.StatusNoContent || rec.Body.Len() != 0 {
+		t.Fatalf("unignore = %d %s", rec.Code, rec.Body.String())
+	}
+	if got := titles(list("")); strings.Join(got, ",") != "Alpha,Beta,Gamma" {
+		t.Fatalf("after unignore, default list = %v", got)
+	}
+
+	// The cursor is bound to the ignored filter.
+	first := list("?limit=1")
+	requireProblem(t, do(t, h, http.MethodGet, "/api/v2/libraries/unmatched-items?limit=1&ignored=true&cursor="+first.Page.NextCursor, "", bearer(adminToken)), TypeInvalidCursor)
+
+	requireProblem(t, do(t, h, http.MethodPut, "/api/v2/libraries/unmatched-items/movie:missing/ignore", "", bearer(adminToken)), TypeNotFound)
+	requireProblem(t, do(t, h, http.MethodDelete, "/api/v2/libraries/unmatched-items/movie:missing/ignore", "", bearer(adminToken)), TypeNotFound)
+	requireProblem(t, do(t, h, http.MethodPut, "/api/v2/libraries/unmatched-items/movie:a/ignore", "", bearer(memberToken)), TypePermissionDenied)
+	requireProblem(t, do(t, h, http.MethodDelete, "/api/v2/libraries/unmatched-items/movie:a/ignore", "", bearer(memberToken)), TypePermissionDenied)
+	fake.err = &handlers.APIError{Status: http.StatusConflict, Code: "conflict", Message: "Only an unmatched item can be ignored"}
+	requireProblem(t, do(t, h, http.MethodPut, "/api/v2/libraries/unmatched-items/movie:a/ignore", "", bearer(adminToken)), TypeConflict)
+}
+
+// unmatchedItemIgnoreFixtureCases pin the ignored view of the unmatched
+// list and the mark that puts an item there. The ignore and unignore cases
+// leave the shared fake as they found it.
+func unmatchedItemIgnoreFixtureCases() []fixtureCase {
+	problem := "#/components/schemas/Problem"
+	return []fixtureCase{
+		{name: "list_ignored_unmatched_items_ok", operationID: opListUnmatchedItems,
+			scenario: "The items an admin marked as intentionally unmatched, each with when it was ignored.",
+			method:   http.MethodGet, path: "/api/v2/libraries/unmatched-items?ignored=true", headers: bearer(adminToken),
+			status: http.StatusOK, assertHeaders: []string{"Content-Type", "Cache-Control"}, schema: "#/components/schemas/UnmatchedItemCollection"},
+		{name: "ignore_unmatched_item_ok", operationID: opIgnoreUnmatchedItem,
+			scenario: "An admin marks an item as intentionally unmatched; ignoring an ignored item again is a no-op. Success answers 204 with no body.",
+			method:   http.MethodPut, path: "/api/v2/libraries/unmatched-items/movie:d/ignore", headers: bearer(adminToken),
+			status: http.StatusNoContent, assertHeaders: []string{"Cache-Control"}},
+		{name: "ignore_unmatched_item_not_found", operationID: opIgnoreUnmatchedItem,
+			scenario: "Ignoring an item the catalog does not hold.",
+			method:   http.MethodPut, path: "/api/v2/libraries/unmatched-items/movie:missing/ignore", headers: bearer(adminToken),
+			status: http.StatusNotFound, assertHeaders: []string{"Content-Type", "Cache-Control"}, schema: problem},
+		{name: "unignore_unmatched_item_ok", operationID: opUnignoreUnmatchedItem,
+			scenario: "Clearing the mark of an item that is not ignored leaves it as is. Success answers 204 with no body.",
+			method:   http.MethodDelete, path: "/api/v2/libraries/unmatched-items/movie:b/ignore", headers: bearer(adminToken),
+			status: http.StatusNoContent, assertHeaders: []string{"Cache-Control"}},
+	}
+}
+
 func TestDiagnosticsSearchAndSkippedPagination(t *testing.T) {
 	deps, fake := libraryDeps(t)
 	h := newTestHandler(t, deps)
diff --git a/internal/apiv2/library_monitoring.go b/internal/apiv2/library_monitoring.go
index 7cf1bd088a..53bc5fede5 100644
--- a/internal/apiv2/library_monitoring.go
+++ b/internal/apiv2/library_monitoring.go
@@ -72,6 +72,7 @@ type LibraryCapabilities struct {
 	RealtimeMonitoring bool `json:"realtime_monitoring" doc:"This build supports real-time library monitoring and its status read" example:"true"`
 	Trickplay          bool `json:"trickplay" doc:"This build supports the per-library trickplay_enabled setting, which generates seek-bar previews" example:"true"`
 	TrickplaySupported bool `json:"trickplay_supported" doc:"Whether public asset storage is configured so seek previews can be enabled, including before the first library is created" example:"true"`
+	IgnoreUnmatched    bool `json:"ignore_unmatched" doc:"This build supports marking unmatched items as intentionally unmatched with ignoreUnmatchedItem, and listing them with listUnmatchedItems' ignored filter" example:"true"`
 }
 
 func (c LibraryCapabilities) capabilityState() string { return StateAvailable }
@@ -97,7 +98,7 @@ func registerLibraryMonitoring(reg *Registry) {
 			"Discover library features supported by this build."),
 		Class: ClassActingAdmin,
 	}, func(context.Context, *CapabilityInput) (*LibraryCapabilitiesOutput, error) {
-		return &LibraryCapabilitiesOutput{Body: LibraryCapabilities{RealtimeMonitoring: true, Trickplay: true, TrickplaySupported: reg.deps.ArtworkStore != nil}}, nil
+		return &LibraryCapabilitiesOutput{Body: LibraryCapabilities{RealtimeMonitoring: true, Trickplay: true, TrickplaySupported: reg.deps.ArtworkStore != nil, IgnoreUnmatched: true}}, nil
 	})
 }
 
diff --git a/internal/apiv2/library_monitoring_test.go b/internal/apiv2/library_monitoring_test.go
index 746ef03a92..8958b3de17 100644
--- a/internal/apiv2/library_monitoring_test.go
+++ b/internal/apiv2/library_monitoring_test.go
@@ -223,10 +223,10 @@ func TestLibraryCapabilities(t *testing.T) {
 	}
 	var got map[string]any
 	decodeJSON(t, rec.Body, &got)
-	if got["realtime_monitoring"] != true || got["trickplay"] != true || got["trickplay_supported"] != false || got["state"] != StateAvailable || got["allowed"] != true || got["revision"] == "" {
+	if got["realtime_monitoring"] != true || got["trickplay"] != true || got["trickplay_supported"] != false || got["ignore_unmatched"] != true || got["state"] != StateAvailable || got["allowed"] != true || got["revision"] == "" {
 		t.Fatalf("body = %v", got)
 	}
-	if len(got) != 6 {
+	if len(got) != 7 {
 		t.Fatalf("unexpected members: %v", got)
 	}
 	etag := rec.Header().Get("ETag")
diff --git a/internal/apiv2/library_views.go b/internal/apiv2/library_views.go
index 7071f20236..a08984767a 100644
--- a/internal/apiv2/library_views.go
+++ b/internal/apiv2/library_views.go
@@ -22,15 +22,15 @@ type LibraryViewInput struct {
 
 // LibrarySectionsInput is the listLibrarySections query.
 type LibrarySectionsInput struct {
-	ID        ID     `path:"id" doc:"Library identifier" example:"1"`
-	ImageSize string `query:"image_size" enum:"small,medium,large,original" doc:"Artwork variant to presign; absent picks each surface's default" example:"medium"`
+	ID ID `path:"id" doc:"Library identifier" example:"1"`
+	ArtworkQuery
 }
 
 // LibrarySectionItemsInput is the getLibrarySectionItems query.
 type LibrarySectionItemsInput struct {
 	ID        ID     `path:"id" doc:"Library identifier" example:"1"`
 	SectionID string `path:"section_id" minLength:"1" doc:"Section identifier from the layout" example:"recently_added"`
-	ImageSize string `query:"image_size" enum:"small,medium,large,original" doc:"Artwork variant to presign; absent picks each surface's default" example:"medium"`
+	ArtworkQuery
 }
 
 // SectionLayoutEntry is one section of a page layout, without items.
@@ -219,12 +219,8 @@ func viewerIdentity(ctx context.Context) (int, string, *Problem) {
 // sectionViewer is what the section seams need beyond the context. The v2
 // listener does not read a device header, so the access filter carries no
 // device id.
-func sectionViewer(ctx context.Context, imageSize string) handlers.SectionViewer {
-	size, err := imagesize.Parse(imageSize)
-	if err != nil {
-		size = imagesize.Unset
-	}
-	return handlers.SectionViewer{Access: handlers.AccessFilterFromContext(ctx, ""), ImageSize: size}
+func sectionViewer(ctx context.Context, art imagesize.Request) handlers.SectionViewer {
+	return handlers.SectionViewer{Access: handlers.AccessFilterFromContext(ctx, ""), ImageSize: art.Size, ImageWidths: art.Widths}
 }
 
 func (reg *Registry) librarySections() (LibrarySectionService, *Problem) {
@@ -288,7 +284,7 @@ func (reg *Registry) listLibrarySections(ctx context.Context, in *LibrarySection
 	if _, _, p := viewerIdentity(ctx); p != nil {
 		return nil, p
 	}
-	view, err := svc.LibrarySections(ctx, id, sectionViewer(ctx, in.ImageSize))
+	view, err := svc.LibrarySections(ctx, id, sectionViewer(ctx, in.Artwork()))
 	if err != nil {
 		return nil, serviceProblem(err)
 	}
@@ -312,7 +308,7 @@ func (reg *Registry) getLibrarySectionItems(ctx context.Context, in *LibrarySect
 	if _, _, p := viewerIdentity(ctx); p != nil {
 		return nil, p
 	}
-	view, err := svc.LibrarySectionItems(ctx, id, in.SectionID, sectionViewer(ctx, in.ImageSize))
+	view, err := svc.LibrarySectionItems(ctx, id, in.SectionID, sectionViewer(ctx, in.Artwork()))
 	if err != nil {
 		return nil, serviceProblem(err)
 	}
diff --git a/internal/apiv2/library_views_test.go b/internal/apiv2/library_views_test.go
index 24bc87a8fb..b007edc1d1 100644
--- a/internal/apiv2/library_views_test.go
+++ b/internal/apiv2/library_views_test.go
@@ -430,7 +430,7 @@ func TestLibraryLayoutAndSections(t *testing.T) {
 		t.Fatalf("body = %s", rec.Body.String())
 	}
 	card := body.Sections[0].Items[0]
-	for k, want := range map[string]string{tiebreakerContentID: `"movie:heat-1995"`, "keywords": `[]`, "progress_updated_at": `"2026-01-02T03:04:05.000Z"`, "overlay_summary": `{"resolution":"4K","hdr":"Dolby Vision"}`, "user_state": `{"played":false,"is_favorite":false,"in_watchlist":true}`, "item_source": `"in_progress"`} {
+	for k, want := range map[string]string{tiebreakerContentID: `"movie:heat-1995"`, "keywords": `[]`, "progress_updated_at": `"2026-01-02T03:04:05.000Z"`, "overlay_summary": `{"resolution":"4K","hdr":"Dolby Vision"}`, "user_state": `{"played":false,"is_favorite":false,"in_watchlist":true,"not_interested":false}`, "item_source": `"in_progress"`} {
 		if string(card[k]) != want {
 			t.Errorf("%s = %s, want %s", k, card[k], want)
 		}
diff --git a/internal/apiv2/not_interested.go b/internal/apiv2/not_interested.go
new file mode 100644
index 0000000000..363d11092e
--- /dev/null
+++ b/internal/apiv2/not_interested.go
@@ -0,0 +1,187 @@
+package apiv2
+
+import (
+	"context"
+	"net/http"
+
+	"github.com/prairie-server/prairie-server/internal/api/handlers"
+	"github.com/prairie-server/prairie-server/internal/imagesize"
+	"github.com/prairie-server/prairie-server/internal/userstore"
+)
+
+// The not-interested domain: the movies and series the acting profile marked
+// Not interested. A mark keeps the title out of the profile's recommendation
+// and discovery rows and ranks similar titles lower there; library browsing,
+// search, item detail, playback and the profile's favorites and watchlist are
+// unchanged. It pages like the favorites domain (favorites.go).
+
+// NotInterestedService is the slice of *handlers.PersonalDataHandler the
+// not-interested operations use. Every method acts as the viewer's profile
+// and returns an *handlers.APIError on failure.
+type NotInterestedService interface {
+	// ListNotInterestedPage answers at most limit of the profile's marks
+	// ordered by (added_at DESC, media_item_id DESC) strictly after the key
+	// (nil = from the newest), and the cards of the marked titles the viewer
+	// may see, in the same order.
+	ListNotInterestedPage(ctx context.Context, viewer handlers.PersonalListViewer, after *userstore.ListKey, limit int) ([]userstore.NotInterestedEntry, []handlers.CollectionItemView, error)
+	// GetNotInterested answers the mark of an item the viewer may see; found
+	// is false when the item is not marked.
+	GetNotInterested(ctx context.Context, viewer handlers.PersonalListViewer, itemID string) (entry userstore.NotInterestedEntry, found bool, err error)
+	MarkNotInterested(ctx context.Context, viewer handlers.PersonalListViewer, itemID string) error
+	UnmarkNotInterested(ctx context.Context, viewer handlers.PersonalListViewer, itemID string) error
+}
+
+// NotInterestedListInput is the listNotInterested query.
+type NotInterestedListInput struct {
+	ArtworkQuery
+	LimitParam
+	Cursor string `query:"cursor" doc:"Opaque cursor from page.next_cursor" example:"eyJvIjo1MH0"`
+}
+
+// NotInterestedItemInput names one movie or series.
+type NotInterestedItemInput struct {
+	ItemID ID `path:"item_id" doc:"Catalog item identifier of a movie or series" example:"movie:heat-1995"`
+}
+
+// NotInterestedCollection is the named envelope the contract carries: the
+// marked titles as catalog cards, newest mark first.
+type NotInterestedCollection struct {
+	Collection[CatalogItem]
+}
+
+// NotInterestedCollectionOutput is the listNotInterested response.
+type NotInterestedCollectionOutput struct {
+	Body NotInterestedCollection
+}
+
+// NotInterestedEntry is one title's Not interested mark.
+type NotInterestedEntry struct {
+	ItemID   ID      `json:"item_id" doc:"The movie or series" example:"movie:heat-1995"`
+	MarkedAt Instant `json:"marked_at" doc:"When the profile marked it" example:"2026-01-02T03:04:05.000Z"`
+}
+
+// NotInterestedEntryOutput is the getNotInterested response.
+type NotInterestedEntryOutput struct {
+	Body NotInterestedEntry
+}
+
+// NotInterestedCapability reports whether profiles can mark titles Not
+// interested.
+type NotInterestedCapability struct {
+	Capability
+}
+
+// NotInterestedCapabilityOutput is the getNotInterestedCapability response.
+type NotInterestedCapabilityOutput struct {
+	Status       int
+	ETag         string `header:"ETag"`
+	CacheControl string `header:"Cache-Control"`
+	Body         NotInterestedCapability
+}
+
+const opListNotInterested = "listNotInterested"
+
+func registerNotInterested(reg *Registry) {
+	cursors := NewCursors(reg.deps.CursorSecret)
+
+	Register(reg, viewerOperation(humaOp(http.MethodGet, Prefix+"/capabilities/not-interested", "getNotInterestedCapability", "not-interested",
+		"Whether the acting profile can mark movies and series Not interested.")), reg.getNotInterestedCapability)
+	Register(reg, viewerOperation(humaOp(http.MethodGet, Prefix+"/not-interested", opListNotInterested, "not-interested",
+		"List the movies and series the acting profile marked Not interested as catalog cards, newest mark first; items the viewer may not see are omitted.")),
+		func(ctx context.Context, in *NotInterestedListInput) (*NotInterestedCollectionOutput, error) {
+			return reg.listNotInterested(ctx, cursors, in)
+		})
+	Register(reg, viewerOperation(humaOp(http.MethodGet, Prefix+"/not-interested/{item_id}", "getNotInterested", "not-interested",
+		"Answer whether the acting profile marked the item Not interested: the mark, or 404 when it did not (or the viewer may not see the item).")),
+		reg.getNotInterested)
+	Register(reg, viewerNoContentMutation(humaOp(http.MethodPut, Prefix+"/not-interested/{item_id}", "markNotInterested", "not-interested",
+		"Mark a movie or series Not interested for the acting profile: its recommendation and discovery rows leave it out and rank similar titles lower, after a rebuild that starts within seconds. Library browsing, search, item detail, playback, favorites and the watchlist are unchanged. Episodes and seasons are refused with 422; mark the series. Marking a marked title succeeds and changes nothing.")),
+		reg.markNotInterested)
+	Register(reg, viewerNoContentMutation(humaOp(http.MethodDelete, Prefix+"/not-interested/{item_id}", "unmarkNotInterested", "not-interested",
+		"Clear the acting profile's Not interested mark on the item. An absent mark succeeds and changes nothing.")),
+		reg.unmarkNotInterested)
+}
+
+func (reg *Registry) getNotInterestedCapability(_ context.Context, _ *CapabilityInput) (*NotInterestedCapabilityOutput, error) {
+	state := StateAvailable
+	if reg.deps.NotInterested == nil {
+		state = StateUnsupported
+	}
+	return &NotInterestedCapabilityOutput{CacheControl: cacheControlPrivateNoCache, Body: NotInterestedCapability{Capability: Capability{State: state}}}, nil
+}
+
+func (reg *Registry) listNotInterested(ctx context.Context, cursors *Cursors, in *NotInterestedListInput) (*NotInterestedCollectionOutput, error) {
+	if reg.deps.NotInterested == nil {
+		return nil, unavailable("not-interested")
+	}
+	viewer, p := personalListViewer(ctx, in.Artwork())
+	if p != nil {
+		return nil, p
+	}
+	scope := personalListScope(ctx, opListNotInterested, viewer)
+	after, p := decodeListKey(cursors, scope, in.Cursor)
+	if p != nil {
+		return nil, p
+	}
+	entries, cards, err := reg.deps.NotInterested.ListNotInterestedPage(ctx, viewer, after, in.Limit+1)
+	if err != nil {
+		return nil, serviceProblem(err)
+	}
+	items, next, p := personalListPage(cursors, scope, in.Limit, entries, cards, reg.ratingSelection(ctx), func(e userstore.NotInterestedEntry) userstore.ListKey {
+		return userstore.ListKey{AddedAt: e.AddedAt, MediaItemID: e.MediaItemID}
+	})
+	if p != nil {
+		return nil, p
+	}
+	return &NotInterestedCollectionOutput{Body: NotInterestedCollection{Collection: Paginated(items, next)}}, nil
+}
+
+func (reg *Registry) getNotInterested(ctx context.Context, in *NotInterestedItemInput) (*NotInterestedEntryOutput, error) {
+	if reg.deps.NotInterested == nil {
+		return nil, unavailable("not-interested")
+	}
+	viewer, p := personalListViewer(ctx, imagesize.Request{})
+	if p != nil {
+		return nil, p
+	}
+	entry, found, err := reg.deps.NotInterested.GetNotInterested(ctx, viewer, string(in.ItemID))
+	if err != nil {
+		return nil, serviceProblem(err)
+	}
+	if !found {
+		return nil, NewProblem(TypeNotFound, "The profile has not marked the item Not interested.")
+	}
+	marked, p := storeInstant(entry.AddedAt)
+	if p != nil {
+		return nil, p
+	}
+	return &NotInterestedEntryOutput{Body: NotInterestedEntry{ItemID: ID(entry.MediaItemID), MarkedAt: marked}}, nil
+}
+
+func (reg *Registry) markNotInterested(ctx context.Context, in *NotInterestedItemInput) (*struct{}, error) {
+	if reg.deps.NotInterested == nil {
+		return nil, unavailable("not-interested")
+	}
+	viewer, p := personalListViewer(ctx, imagesize.Request{})
+	if p != nil {
+		return nil, p
+	}
+	if err := reg.deps.NotInterested.MarkNotInterested(ctx, viewer, string(in.ItemID)); err != nil {
+		return nil, serviceProblem(err)
+	}
+	return nil, nil
+}
+
+func (reg *Registry) unmarkNotInterested(ctx context.Context, in *NotInterestedItemInput) (*struct{}, error) {
+	if reg.deps.NotInterested == nil {
+		return nil, unavailable("not-interested")
+	}
+	viewer, p := personalListViewer(ctx, imagesize.Request{})
+	if p != nil {
+		return nil, p
+	}
+	if err := reg.deps.NotInterested.UnmarkNotInterested(ctx, viewer, string(in.ItemID)); err != nil {
+		return nil, serviceProblem(err)
+	}
+	return nil, nil
+}
diff --git a/internal/apiv2/not_interested_test.go b/internal/apiv2/not_interested_test.go
new file mode 100644
index 0000000000..7daf4a8421
--- /dev/null
+++ b/internal/apiv2/not_interested_test.go
@@ -0,0 +1,152 @@
+package apiv2
+
+import (
+	"context"
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/api/handlers"
+	"github.com/prairie-server/prairie-server/internal/userstore"
+)
+
+// fakeNotInterested is NotInterestedService over in-memory marks. Episodes,
+// whose IDs start with "episode:", are refused as the handler refuses them.
+type fakeNotInterested struct {
+	marks   []userstore.NotInterestedEntry
+	missing map[string]bool
+	viewers []handlers.PersonalListViewer
+	limits  []int
+}
+
+func notInterestedKey(e userstore.NotInterestedEntry) userstore.ListKey {
+	return userstore.ListKey{AddedAt: e.AddedAt, MediaItemID: e.MediaItemID}
+}
+
+func (f *fakeNotInterested) ListNotInterestedPage(_ context.Context, viewer handlers.PersonalListViewer, after *userstore.ListKey, limit int) ([]userstore.NotInterestedEntry, []handlers.CollectionItemView, error) {
+	f.viewers = append(f.viewers, viewer)
+	f.limits = append(f.limits, limit)
+	page := keysetPage(f.marks, viewer.ProfileID, notInterestedKey,
+		func(e userstore.NotInterestedEntry) string { return e.ProfileID }, after, limit)
+	cards := make([]handlers.CollectionItemView, 0, len(page))
+	for _, e := range page {
+		if !f.missing[e.MediaItemID] {
+			cards = append(cards, handlers.CollectionItemView{ContentID: e.MediaItemID, Type: "movie", Title: "Title " + e.MediaItemID, Status: "matched"})
+		}
+	}
+	return page, cards, nil
+}
+
+func (f *fakeNotInterested) GetNotInterested(_ context.Context, viewer handlers.PersonalListViewer, itemID string) (userstore.NotInterestedEntry, bool, error) {
+	if f.missing[itemID] {
+		return userstore.NotInterestedEntry{}, false, &handlers.APIError{Status: http.StatusNotFound, Code: "not_found", Message: "Item not found"}
+	}
+	for _, e := range f.marks {
+		if e.ProfileID == viewer.ProfileID && e.MediaItemID == itemID {
+			return e, true, nil
+		}
+	}
+	return userstore.NotInterestedEntry{}, false, nil
+}
+
+func (f *fakeNotInterested) MarkNotInterested(_ context.Context, viewer handlers.PersonalListViewer, itemID string) error {
+	if f.missing[itemID] {
+		return &handlers.APIError{Status: http.StatusNotFound, Code: "not_found", Message: "Item not found"}
+	}
+	if strings.HasPrefix(itemID, "episode:") {
+		return &handlers.APIError{Status: http.StatusUnprocessableEntity, Code: "validation_failed", Message: "Only a movie or series can be marked Not interested"}
+	}
+	for _, e := range f.marks {
+		if e.ProfileID == viewer.ProfileID && e.MediaItemID == itemID {
+			return nil
+		}
+	}
+	f.marks = append([]userstore.NotInterestedEntry{{ProfileID: viewer.ProfileID, MediaItemID: itemID, AddedAt: "2026-01-03T00:00:00Z"}}, f.marks...)
+	return nil
+}
+
+func (f *fakeNotInterested) UnmarkNotInterested(_ context.Context, viewer handlers.PersonalListViewer, itemID string) error {
+	kept := f.marks[:0]
+	for _, e := range f.marks {
+		if e.ProfileID != viewer.ProfileID || e.MediaItemID != itemID {
+			kept = append(kept, e)
+		}
+	}
+	f.marks = kept
+	return nil
+}
+
+func notInterestedRows() []userstore.NotInterestedEntry {
+	return []userstore.NotInterestedEntry{
+		{ProfileID: "p-owner", MediaItemID: "movie:c", AddedAt: "2026-01-02T03:04:05Z"},
+		{ProfileID: "p-owner", MediaItemID: "series:b", AddedAt: "2026-01-01T00:00:00Z"},
+		{ProfileID: "p-owner", MediaItemID: "movie:a", AddedAt: "2026-01-01T00:00:00Z"},
+		{ProfileID: "p-other", MediaItemID: "movie:z", AddedAt: "2025-12-30T00:00:00Z"},
+	}
+}
+
+func notInterestedDeps(svc NotInterestedService) Dependencies {
+	deps := pilotDeps(nil, nil)
+	deps.NotInterested = svc
+	return deps
+}
+
+// The list pages the acting profile's marks newest first, through ties.
+func TestListNotInterested(t *testing.T) {
+	svc := &fakeNotInterested{marks: notInterestedRows()}
+	h := newTestHandler(t, notInterestedDeps(svc))
+	ids, pages := listCardIDs(t, h, "/api/v2/not-interested?limit=2", viewerHeaders())
+	if pages != 2 || strings.Join(ids, ",") != "movie:c,series:b,movie:a" {
+		t.Fatalf("ids = %v pages = %d", ids, pages)
+	}
+	if svc.limits[0] != 3 || svc.viewers[0].ProfileID != "p-owner" {
+		t.Fatalf("call = %d %+v", svc.limits[0], svc.viewers[0])
+	}
+}
+
+func TestMarkGetAndUnmarkNotInterested(t *testing.T) {
+	svc := &fakeNotInterested{missing: map[string]bool{"movie:hidden": true}}
+	h := newTestHandler(t, notInterestedDeps(svc))
+	requireProblem(t, do(t, h, http.MethodGet, "/api/v2/not-interested/movie:new", "", viewerHeaders()), TypeNotFound)
+
+	for range 2 {
+		if rec := do(t, h, http.MethodPut, "/api/v2/not-interested/movie:new", "", viewerHeaders()); rec.Code != http.StatusNoContent {
+			t.Fatalf("mark = %d %s", rec.Code, rec.Body.String())
+		}
+	}
+	if len(svc.marks) != 1 {
+		t.Fatalf("marks = %+v", svc.marks)
+	}
+	rec := do(t, h, http.MethodGet, "/api/v2/not-interested/movie:new", "", viewerHeaders())
+	if rec.Code != 200 || rec.Body.String() != `{"item_id":"movie:new","marked_at":"2026-01-03T00:00:00.000Z"}`+"\n" {
+		t.Fatalf("%d %s", rec.Code, rec.Body.String())
+	}
+
+	requireProblem(t, do(t, h, http.MethodPut, "/api/v2/not-interested/movie:hidden", "", viewerHeaders()), TypeNotFound)
+	requireProblem(t, do(t, h, http.MethodPut, "/api/v2/not-interested/episode:x", "", viewerHeaders()), TypeValidationFailed)
+
+	for range 2 {
+		if rec := do(t, h, http.MethodDelete, "/api/v2/not-interested/movie:new", "", viewerHeaders()); rec.Code != http.StatusNoContent {
+			t.Fatalf("unmark = %d %s", rec.Code, rec.Body.String())
+		}
+	}
+	if len(svc.marks) != 0 {
+		t.Fatalf("marks after unmark = %+v", svc.marks)
+	}
+}
+
+func TestNotInterestedCapability(t *testing.T) {
+	for _, tc := range []struct {
+		svc  NotInterestedService
+		want string
+	}{
+		{&fakeNotInterested{}, StateAvailable},
+		{nil, StateUnsupported},
+	} {
+		h := newTestHandler(t, notInterestedDeps(tc.svc))
+		rec := do(t, h, http.MethodGet, "/api/v2/capabilities/not-interested", "", viewerHeaders())
+		if rec.Code != 200 || !strings.Contains(rec.Body.String(), `"state":"`+tc.want+`"`) {
+			t.Fatalf("capability = %d %s, want state %s", rec.Code, rec.Body.String(), tc.want)
+		}
+	}
+}
diff --git a/internal/apiv2/notification_android_push.go b/internal/apiv2/notification_android_push.go
index b6e57bff87..625482001e 100644
--- a/internal/apiv2/notification_android_push.go
+++ b/internal/apiv2/notification_android_push.go
@@ -36,6 +36,7 @@ type AndroidPushRegistrationReceipt struct {
 	RegistrationID ID     `json:"registration_id"`
 	ServerDeviceID ID     `json:"server_device_id"`
 	PushMode       string `json:"push_mode"`
+	ServerID       string `json:"server_id,omitempty" doc:"This deployment's identity, the server_id getServerIdentity reports. Key this registration's push credentials by it and the registering profile: pushes name both. Absent when unavailable." example:"3f2a9d5e-6b1c-4c7e-9a0d-2f4b8c1e7a35"`
 }
 type AndroidPushRegistrationOutput struct {
 	Body AndroidPushRegistrationReceipt
@@ -101,7 +102,7 @@ func registerOrderedAndroidPush(reg *Registry) {
 		if err != nil {
 			return nil, orderedPushProblem(err)
 		}
-		return &AndroidPushRegistrationOutput{Body: AndroidPushRegistrationReceipt{Generation: ID(strconv.FormatInt(result.Generation, 10)), RegistrationID: ID(result.RegistrationID), ServerDeviceID: ID(result.ServerDeviceID), PushMode: result.PushMode}}, nil
+		return &AndroidPushRegistrationOutput{Body: AndroidPushRegistrationReceipt{Generation: ID(strconv.FormatInt(result.Generation, 10)), RegistrationID: ID(result.RegistrationID), ServerDeviceID: ID(result.ServerDeviceID), PushMode: result.PushMode, ServerID: reg.knownServerID(ctx)}}, nil
 	})
 	remove := notificationOperation(http.MethodDelete, "/push/devices/{device_id}", "unregisterPushDevice")
 	remove.Summary = "Apply an ordered removal for the installation's current account/profile. Tombstones prevent stale registration replay."
diff --git a/internal/apiv2/notification_android_push_test.go b/internal/apiv2/notification_android_push_test.go
index 22b4e542be..9877b4da34 100644
--- a/internal/apiv2/notification_android_push_test.go
+++ b/internal/apiv2/notification_android_push_test.go
@@ -27,6 +27,7 @@ func TestOrderedAndroidPushTransport(t *testing.T) {
 	f := new(fakeOrderedPush)
 	deps := pilotDeps(nil, nil)
 	deps.OrderedAndroidPush = f
+	deps.ServerIdentity = fakeServerIdentity{id: fixtureServerID}
 	h := NewHandler(deps)
 	headers := profileOwner()
 	headers["X-Push-Installation-Key"] = base64.RawURLEncoding.EncodeToString([]byte(strings.Repeat("k", 32)))
@@ -40,7 +41,7 @@ func TestOrderedAndroidPushTransport(t *testing.T) {
 	if err := json.Unmarshal(rec.Body.Bytes(), &receipt); err != nil {
 		t.Fatal(err)
 	}
-	if receipt.Generation != "9007199254740993" || f.cmd.UserID != 1 || f.cmd.ProfileID != "p-owner" || f.cmd.DeviceID != "install" || f.cmd.Remove {
+	if receipt.Generation != "9007199254740993" || receipt.ServerID != fixtureServerID || f.cmd.UserID != 1 || f.cmd.ProfileID != "p-owner" || f.cmd.DeviceID != "install" || f.cmd.Remove {
 		t.Fatalf("receipt=%+v", receipt)
 	}
 	if strings.Contains(rec.Body.String(), headers["X-Push-Installation-Key"]) || strings.Contains(rec.Body.String(), strings.Repeat("a", 64)) {
diff --git a/internal/apiv2/notification_apple_push.go b/internal/apiv2/notification_apple_push.go
index 9c9f6e6160..45489f1763 100644
--- a/internal/apiv2/notification_apple_push.go
+++ b/internal/apiv2/notification_apple_push.go
@@ -36,6 +36,7 @@ type ApplePushRegistrationReceipt struct {
 	Removed               bool   `json:"removed" doc:"The retained intent references a deleted registration. Exact replay never resurrects it."`
 	DisplayToken          string `json:"display_token,omitempty"`
 	DisplayTokenExpiresAt string `json:"display_token_expires_at,omitempty" format:"date-time"`
+	ServerID              string `json:"server_id,omitempty" doc:"This deployment's identity, the server_id getServerIdentity reports. Key this registration's push credentials by it and the registering profile: pushes name both. Absent when unavailable." example:"3f2a9d5e-6b1c-4c7e-9a0d-2f4b8c1e7a35"`
 }
 type ApplePushRegistrationOutput struct{ Body ApplePushRegistrationReceipt }
 type ApplePushRegistrationCapability struct {
@@ -87,12 +88,13 @@ func registerOrderedApplePush(reg *Registry) {
 		identity := evt.SocketIdentity{UserID: user, ProfileID: profile, SessionID: claims.SessionID, Role: claims.Role, ImpersonatorUserID: claims.ImpersonatorUserID, AccessExpiresAt: claims.ExpiresAt.Time}
 		if r := requestFrom(ctx); r != nil {
 			identity.ProfileToken = r.Header.Get("X-Profile-Token")
+			identity.DeviceID = socketDeviceID(r)
 		}
 		receipt, token, expiry, err := reg.deps.OrderedApplePush.RegisterApplePush(ctx, cmd, identity)
 		if err != nil {
 			return nil, applePushProblem(err)
 		}
-		out := ApplePushRegistrationReceipt{Generation: ID(strconv.FormatInt(receipt.Generation, 10)), ID: ID(receipt.RegistrationID), ServerDeviceID: ID(receipt.ServerDeviceID), PushMode: receipt.PushMode, Enabled: receipt.Enabled, Removed: receipt.Removed, DisplayToken: token}
+		out := ApplePushRegistrationReceipt{Generation: ID(strconv.FormatInt(receipt.Generation, 10)), ID: ID(receipt.RegistrationID), ServerDeviceID: ID(receipt.ServerDeviceID), PushMode: receipt.PushMode, Enabled: receipt.Enabled, Removed: receipt.Removed, DisplayToken: token, ServerID: reg.knownServerID(ctx)}
 		if token != "" {
 			out.DisplayTokenExpiresAt = expiry.UTC().Format(time.RFC3339Nano)
 		}
diff --git a/internal/apiv2/notification_apple_push_fixtures_test.go b/internal/apiv2/notification_apple_push_fixtures_test.go
index 9998485142..20c5b17758 100644
--- a/internal/apiv2/notification_apple_push_fixtures_test.go
+++ b/internal/apiv2/notification_apple_push_fixtures_test.go
@@ -1,7 +1,31 @@
 package apiv2
 
+import (
+	"encoding/base64"
+	"net/http"
+	"strings"
+)
+
+// orderedPushFixtureHeaders are a current login session acting as its owner
+// profile, plus a synthetic installation credential and generation.
+func orderedPushFixtureHeaders() map[string]string {
+	headers := with(bearer("tok-events"), "X-Profile-Id", "p-owner")
+	headers["X-Push-Installation-Key"] = base64.RawURLEncoding.EncodeToString([]byte(strings.Repeat("k", 32)))
+	headers["X-Push-Generation"] = "3"
+	return headers
+}
+
 func applePushFixtureCases() []fixtureCase {
 	return []fixtureCase{
-		{name: "apple_push_registration_capability", operationID: "getApplePushRegistrationCapabilities", scenario: "Local ordered Apple registration is unavailable when the service is absent; this does not describe provider delivery.", method: "GET", path: Prefix + "/devices/push/apple/capabilities", headers: profileOwner(), status: 200, schema: "#/components/schemas/ApplePushRegistrationCapability", assertHeaders: []string{"Content-Type", "Cache-Control"}},
+		{name: "apple_push_registration_capability", operationID: "getApplePushRegistrationCapabilities", scenario: "Local ordered Apple registration and current-login validation are configured; this does not describe provider delivery.", method: "GET", path: Prefix + "/devices/push/apple/capabilities", headers: profileOwner(), status: 200, schema: "#/components/schemas/ApplePushRegistrationCapability", assertHeaders: []string{"Content-Type", "Cache-Control"}},
+	}
+}
+
+// pushRegistrationReceiptFixtureCases are appended last so the request ids of
+// earlier fixtures stay put.
+func pushRegistrationReceiptFixtureCases() []fixtureCase {
+	return []fixtureCase{
+		{name: "apple_push_registration_ok", operationID: "registerApplePushDevice", scenario: "An iPhone registers for private push and receives a display credential; the receipt names the server so the app can key that credential by server and profile.", method: http.MethodPost, path: Prefix + "/devices/push/apple", headers: orderedPushFixtureHeaders(), body: `{"device_id":"install","apns_token":"` + strings.Repeat("a", 64) + `","apns_environment":"production","apns_topic":"org.prairieserver.prairie","push_mode":"private_push"}`, status: 200, schema: "#/components/schemas/ApplePushRegistrationReceipt", assertHeaders: []string{"Content-Type", "Cache-Control"}},
+		{name: "android_push_registration_ok", operationID: "registerPushDevice", scenario: "An Android installation registers for private push; the receipt names the server so the app can route that server's pushes by server and profile.", method: http.MethodPost, path: Prefix + "/notifications/push/devices", headers: orderedPushFixtureHeaders(), body: `{"device_id":"install","platform":"android","token":"` + strings.Repeat("a", 64) + `","push_mode":"private_push"}`, status: 200, schema: "#/components/schemas/AndroidPushRegistrationReceipt", assertHeaders: []string{"Content-Type", "Cache-Control"}},
 	}
 }
diff --git a/internal/apiv2/notification_apple_push_test.go b/internal/apiv2/notification_apple_push_test.go
index 56e61b40a2..996fa91694 100644
--- a/internal/apiv2/notification_apple_push_test.go
+++ b/internal/apiv2/notification_apple_push_test.go
@@ -28,12 +28,13 @@ func (f *fakeOrderedApple) RegisterApplePush(_ context.Context, cmd notification
 	f.calls++
 	f.cmd = cmd
 	f.identity = identity
-	return notifications.ApplePushReceipt{Generation: cmd.Generation, RegistrationID: "registration", ServerDeviceID: "server-device", Enabled: true, PushMode: cmd.PushMode}, "synthetic-display", time.Now().Add(time.Hour), f.err
+	return notifications.ApplePushReceipt{Generation: cmd.Generation, RegistrationID: "registration", ServerDeviceID: "server-device", Enabled: true, PushMode: cmd.PushMode}, "synthetic-display", fixedTime().Add(30 * 24 * time.Hour), f.err
 }
 func TestOrderedApplePushTransport(t *testing.T) {
 	f := new(fakeOrderedApple)
 	deps := pilotDeps(nil, nil)
 	deps.OrderedApplePush = f
+	deps.ServerIdentity = fakeServerIdentity{id: fixtureServerID}
 	claims := &auth.Claims{UserID: 1, Role: "user", SessionID: "session", TokenType: auth.TokenTypeAccess, RegisteredClaims: jwt.RegisteredClaims{ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Minute))}}
 	deps.Auth = apimw.NewAuthMiddleware(fakeTokens{map[string]*auth.Claims{memberToken: claims}}, fakeSessions{map[string]string{"session": "user"}}, nil, nil)
 	h := NewHandler(deps)
@@ -43,7 +44,7 @@ func TestOrderedApplePushTransport(t *testing.T) {
 	body := `{"device_id":"install","apns_token":"` + strings.Repeat("a", 64) + `","apns_environment":"production","apns_topic":"org.prairieserver.prairie","push_mode":"private_push"}`
 	path := Prefix + "/devices/push/apple"
 	r := do(t, h, http.MethodPost, path, body, headers)
-	if r.Code != 200 || !strings.Contains(r.Body.String(), `"generation":"9007199254740993"`) || !strings.Contains(r.Body.String(), `"display_token":"synthetic-display"`) || f.identity.SessionID != "session" || f.cmd.ProfileID != "p-owner" || f.cmd.UserID != 1 {
+	if r.Code != 200 || !strings.Contains(r.Body.String(), `"generation":"9007199254740993"`) || !strings.Contains(r.Body.String(), `"display_token":"synthetic-display"`) || !strings.Contains(r.Body.String(), `"server_id":"`+fixtureServerID+`"`) || f.identity.SessionID != "session" || f.cmd.ProfileID != "p-owner" || f.cmd.UserID != 1 {
 		t.Fatalf("%d %s %+v", r.Code, r.Body.String(), f)
 	}
 	if r.Header().Get("Cache-Control") != "no-store" || strings.Contains(r.Body.String(), headers["X-Push-Installation-Key"]) || strings.Contains(r.Body.String(), strings.Repeat("a", 64)) {
diff --git a/internal/apiv2/notification_destination_tests.go b/internal/apiv2/notification_destination_tests.go
index 8daa2af04c..ffbe13a6be 100644
--- a/internal/apiv2/notification_destination_tests.go
+++ b/internal/apiv2/notification_destination_tests.go
@@ -14,7 +14,7 @@ const (
 )
 
 type NotificationDestinationTestService interface {
-	TestNotificationWebhook(context.Context, string, string) (*notifications.WebhookTestResult, error)
+	TestNotificationWebhook(context.Context, int, string, string) (*notifications.WebhookTestResult, error)
 	TestNotificationServerChannel(context.Context, string) (*notifications.WebhookTestResult, error)
 }
 
@@ -54,7 +54,11 @@ func registerNotificationDestinationTests(reg *Registry) {
 		if svc == nil {
 			return nil, unavailable("notification test delivery")
 		}
-		return notificationDestinationTestOutput(svc.TestNotificationWebhook(ctx, profileFrom(ctx), string(in.ID)))
+		user, profile, p := viewerIdentity(ctx)
+		if p != nil {
+			return nil, p
+		}
+		return notificationDestinationTestOutput(svc.TestNotificationWebhook(ctx, user, profile, string(in.ID)))
 	})
 	admin := Operation{Operation: humaOp(http.MethodPost, Prefix+"/admin/notifications/server-channels/{id}/test", testNotificationServerChannelOperation, "admin", "Send one synchronous sample to a server notification channel."), Class: ClassActingAdmin, DemoRestricted: true, ServiceBacked: true, RetrySafety: RetrySafetyNonRetryable}
 	Register(reg, admin, func(ctx context.Context, in *NotificationDestinationTestInput) (*NotificationDestinationTestOutput, error) {
diff --git a/internal/apiv2/notification_destination_tests_test.go b/internal/apiv2/notification_destination_tests_test.go
index 45a8e3531b..fd3298b918 100644
--- a/internal/apiv2/notification_destination_tests_test.go
+++ b/internal/apiv2/notification_destination_tests_test.go
@@ -12,18 +12,19 @@ import (
 
 type fakeNotificationDestinationTests struct {
 	calls       int
+	user        int
 	profile, id string
 	err         error
 }
 
-func (f *fakeNotificationDestinationTests) TestNotificationWebhook(_ context.Context, profile, id string) (*notifications.WebhookTestResult, error) {
+func (f *fakeNotificationDestinationTests) TestNotificationWebhook(_ context.Context, user int, profile, id string) (*notifications.WebhookTestResult, error) {
 	f.calls++
-	f.profile = profile
+	f.user, f.profile = user, profile
 	f.id = id
 	return &notifications.WebhookTestResult{OK: false, HTTPStatus: 429, DurationMS: 2, Message: "429 Too Many Requests"}, f.err
 }
 func (f *fakeNotificationDestinationTests) TestNotificationServerChannel(ctx context.Context, id string) (*notifications.WebhookTestResult, error) {
-	return f.TestNotificationWebhook(ctx, "", id)
+	return f.TestNotificationWebhook(ctx, 0, "", id)
 }
 
 func TestNotificationDestinationDispatch(t *testing.T) {
@@ -33,11 +34,12 @@ func TestNotificationDestinationDispatch(t *testing.T) {
 	h := NewHandler(deps)
 	for _, tc := range []struct {
 		name, path, profile string
+		user                int
 		headers             map[string]string
 		missing, disabled   error
 	}{
-		{"webhook", Prefix + "/notifications/webhooks/hook/test", "p-owner", profileOwner(), notifications.ErrWebhookNotFound, notifications.ErrWebhooksDisabled},
-		{"server-channel", Prefix + "/admin/notifications/server-channels/hook/test", "", bearer(adminToken), notifications.ErrServerChannelNotFound, notifications.ErrServerChannelsDisabled},
+		{"webhook", Prefix + "/notifications/webhooks/hook/test", "p-owner", 1, profileOwner(), notifications.ErrWebhookNotFound, notifications.ErrWebhooksDisabled},
+		{"server-channel", Prefix + "/admin/notifications/server-channels/hook/test", "", 0, bearer(adminToken), notifications.ErrServerChannelNotFound, notifications.ErrServerChannelsDisabled},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			*fake = fakeNotificationDestinationTests{}
@@ -50,7 +52,7 @@ func TestNotificationDestinationDispatch(t *testing.T) {
 			if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
 				t.Fatal(err)
 			}
-			if rec.Code != 200 || fake.calls != 1 || fake.profile != tc.profile || fake.id != "hook" || body.OK || body.HTTPStatus != 429 || body.DurationMS != 2 || body.Message != "429 Too Many Requests" {
+			if rec.Code != 200 || fake.calls != 1 || fake.user != tc.user || fake.profile != tc.profile || fake.id != "hook" || body.OK || body.HTTPStatus != 429 || body.DurationMS != 2 || body.Message != "429 Too Many Requests" {
 				t.Fatalf("%d %+v %+v", rec.Code, body, fake)
 			}
 			if rec.Header().Get("Cache-Control") != "no-store" {
diff --git a/internal/apiv2/notification_destinations.go b/internal/apiv2/notification_destinations.go
index 723026c220..80275439c6 100644
--- a/internal/apiv2/notification_destinations.go
+++ b/internal/apiv2/notification_destinations.go
@@ -19,16 +19,16 @@ const (
 type NotificationDestinationService interface {
 	UpdateNotificationServerChannel(context.Context, string, notifications.ServerChannelInput) (*notifications.ServerChannel, error)
 	RotateNotificationServerChannelSecret(context.Context, string) (string, error)
-	UpdateNotificationWebhook(context.Context, string, string, notifications.WebhookInput, func(int64) error) (*notifications.Webhook, error)
-	RotateNotificationWebhookSecret(context.Context, string, string) (string, error)
+	UpdateNotificationWebhook(context.Context, int, string, string, notifications.WebhookInput, func(int64) error) (*notifications.Webhook, error)
+	RotateNotificationWebhookSecret(context.Context, int, string, string) (string, error)
 	DeleteNotificationServerChannel(context.Context, string) error
-	DeleteNotificationWebhook(context.Context, string, string, func(int64) error) error
+	DeleteNotificationWebhook(context.Context, int, string, string, func(int64) error) error
 	SubscribeNotificationWebPush(context.Context, int, string, string, string, string, string) (*notifications.WebPushSubscription, error)
 	UnsubscribeNotificationWebPush(context.Context, int, string, string) error
 	DeleteNotificationWebPushSubscription(context.Context, int, string, string) error
 
-	ListNotificationWebPushPage(context.Context, string, int, *notifications.Cursor) ([]notifications.WebPushSubscription, error)
-	ListNotificationWebhookPage(context.Context, string, int, *notifications.Cursor) ([]notifications.Webhook, error)
+	ListNotificationWebPushPage(context.Context, int, string, int, *notifications.Cursor) ([]notifications.WebPushSubscription, error)
+	ListNotificationWebhookPage(context.Context, int, string, int, *notifications.Cursor) ([]notifications.Webhook, error)
 	ListNotificationServerChannelPage(context.Context, int, *notifications.Cursor) ([]notifications.ServerChannel, error)
 }
 
@@ -230,7 +230,11 @@ func registerNotificationDestinations(reg *Registry) {
 		if reg.deps.NotificationDestinations == nil {
 			return nil, unavailable("notification destinations")
 		}
-		value, err := reg.deps.NotificationDestinations.RotateNotificationWebhookSecret(ctx, profileFrom(ctx), in.ID)
+		user, profile, p := viewerIdentity(ctx)
+		if p != nil {
+			return nil, p
+		}
+		value, err := reg.deps.NotificationDestinations.RotateNotificationWebhookSecret(ctx, user, profile, in.ID)
 		if errors.Is(err, notifications.ErrWebhookNotFound) {
 			return nil, NewProblem(TypeNotFound, "Webhook not found.")
 		}
@@ -287,8 +291,12 @@ func registerNotificationDestinations(reg *Registry) {
 		if reg.deps.NotificationDestinations == nil {
 			return nil, unavailable("notification destinations")
 		}
-		err := reg.deps.NotificationDestinations.DeleteNotificationWebhook(ctx, profileFrom(ctx), in.ID, func(revision int64) error {
-			if p := EvaluateGuardedPreconditions(in.IfMatch, in.IfNoneMatch, notificationWebhookTag(profileFrom(ctx), in.ID, revision)); p != nil {
+		user, profile, p := viewerIdentity(ctx)
+		if p != nil {
+			return nil, p
+		}
+		err := reg.deps.NotificationDestinations.DeleteNotificationWebhook(ctx, user, profile, in.ID, func(revision int64) error {
+			if p := EvaluateGuardedPreconditions(in.IfMatch, in.IfNoneMatch, notificationWebhookTag(profile, in.ID, revision)); p != nil {
 				return p
 			}
 			return nil
@@ -380,7 +388,11 @@ func registerNotificationDestinations(reg *Registry) {
 				return nil, p
 			}
 		}
-		rows, err := svc.ListNotificationWebPushPage(ctx, profileFrom(ctx), in.Limit+1, after)
+		user, profile, p := viewerIdentity(ctx)
+		if p != nil {
+			return nil, p
+		}
+		rows, err := svc.ListNotificationWebPushPage(ctx, user, profile, in.Limit+1, after)
 		if err != nil {
 			return nil, serviceProblem(err)
 		}
@@ -416,7 +428,11 @@ func registerNotificationDestinations(reg *Registry) {
 				return nil, p
 			}
 		}
-		rows, err := svc.ListNotificationWebhookPage(ctx, profileFrom(ctx), in.Limit+1, after)
+		user, profile, p := viewerIdentity(ctx)
+		if p != nil {
+			return nil, p
+		}
+		rows, err := svc.ListNotificationWebhookPage(ctx, user, profile, in.Limit+1, after)
 		if err != nil {
 			return nil, serviceProblem(err)
 		}
diff --git a/internal/apiv2/notification_destinations_test.go b/internal/apiv2/notification_destinations_test.go
index 7b22c405b2..a63e0133e6 100644
--- a/internal/apiv2/notification_destinations_test.go
+++ b/internal/apiv2/notification_destinations_test.go
@@ -15,20 +15,21 @@ import (
 type fakeNotificationDestinations struct {
 	deleted string
 	calls   int
+	user    int
 	profile string
 	limit   int
 }
 
-func (f *fakeNotificationDestinations) ListNotificationWebPushPage(_ context.Context, profile string, limit int, after *notifications.Cursor) ([]notifications.WebPushSubscription, error) {
-	f.profile, f.limit = profile, limit
+func (f *fakeNotificationDestinations) ListNotificationWebPushPage(_ context.Context, user int, profile string, limit int, after *notifications.Cursor) ([]notifications.WebPushSubscription, error) {
+	f.user, f.profile, f.limit = user, profile, limit
 	rows := []notifications.WebPushSubscription{{ID: "01", Endpoint: "https://push.example.test/1", P256dh: "sensitive-p256dh", Auth: "sensitive-auth", CreatedAt: fixedTime()}, {ID: "02", Endpoint: "https://push.example.test/2", CreatedAt: fixedTime()}}
 	if after != nil {
 		rows = rows[1:]
 	}
 	return rows, nil
 }
-func (f *fakeNotificationDestinations) ListNotificationWebhookPage(_ context.Context, profile string, limit int, after *notifications.Cursor) ([]notifications.Webhook, error) {
-	f.profile, f.limit = profile, limit
+func (f *fakeNotificationDestinations) ListNotificationWebhookPage(_ context.Context, user int, profile string, limit int, after *notifications.Cursor) ([]notifications.Webhook, error) {
+	f.user, f.profile, f.limit = user, profile, limit
 	rows := []notifications.Webhook{{ID: "01", ProfileID: profile, Revision: 7, Name: "Example", Type: "generic", URLHost: "example.test", URLCiphertext: "sensitive-url", SigningSecretCiphertext: new("sensitive-secret"), CreatedAt: fixedTime()}, {ID: "02", ProfileID: profile, Revision: 7, Name: "Other", Type: "generic", URLHost: "example.test", CreatedAt: fixedTime()}}
 	if after != nil {
 		rows = rows[1:]
@@ -59,6 +60,7 @@ func TestNotificationDestinationCursors(t *testing.T) {
 		{Prefix + "/admin/notifications/server-channels", bearer(adminToken), ""},
 	} {
 		t.Run(tc.path, func(t *testing.T) {
+			fake.user = 0
 			rec := do(t, h, http.MethodGet, tc.path+"?limit=1", "", tc.headers)
 			if rec.Code != 200 || fake.limit != 2 {
 				t.Fatalf("%d %s", rec.Code, rec.Body.String())
@@ -90,6 +92,9 @@ func TestNotificationDestinationCursors(t *testing.T) {
 				t.Fatalf("%+v", page)
 			}
 			requireProblem(t, do(t, h, http.MethodGet, tc.path+strings.Replace(query, "limit=1", "limit=2", 1), "", tc.headers), TypeInvalidCursor)
+			if tc.profile != "" && (fake.user != 1 || fake.profile != tc.profile) {
+				t.Fatalf("listed for user %d profile %q, want the acting account's profile", fake.user, fake.profile)
+			}
 			if tc.profile != "" {
 				requireProblem(t, do(t, h, http.MethodGet, tc.path+query, "", with(bearer(memberToken), "X-Profile-Id", "p-primary")), TypeInvalidCursor)
 			}
@@ -113,9 +118,9 @@ func notificationDestinationFixtureCases() []fixtureCase {
 	return cases
 }
 
-func (f *fakeNotificationDestinations) DeleteNotificationWebPushSubscription(_ context.Context, _ int, profile, id string) error {
+func (f *fakeNotificationDestinations) DeleteNotificationWebPushSubscription(_ context.Context, user int, profile, id string) error {
 	f.calls++
-	f.profile, f.deleted = profile, id
+	f.user, f.profile, f.deleted = user, profile, id
 	return nil
 }
 func TestNotificationWebPushDelete(t *testing.T) {
@@ -130,7 +135,7 @@ func TestNotificationWebPushDelete(t *testing.T) {
 			t.Fatalf("%d %s", rec.Code, rec.Body.String())
 		}
 	}
-	if f.calls != 2 || f.profile != "p-owner" || f.deleted != "row-one" {
+	if f.calls != 2 || f.user != 1 || f.profile != "p-owner" || f.deleted != "row-one" {
 		t.Fatalf("%+v", f)
 	}
 	requireProblem(t, do(t, h, http.MethodDelete, path, "", nil), TypeAuthenticationRequired)
@@ -197,12 +202,12 @@ func TestNotificationWebPushSubscribe(t *testing.T) {
 	requireProblem(t, do(t, NewHandler(deps), http.MethodPost, path, body, profileOwner()), TypeDependencyUnavailable)
 }
 
-func (f *fakeNotificationDestinations) DeleteNotificationWebhook(_ context.Context, profile, id string, check func(int64) error) error {
+func (f *fakeNotificationDestinations) DeleteNotificationWebhook(_ context.Context, user int, profile, id string, check func(int64) error) error {
 	if err := check(7); err != nil {
 		return err
 	}
 	f.calls++
-	f.profile, f.deleted = profile, id
+	f.user, f.profile, f.deleted = user, profile, id
 	return nil
 }
 func TestNotificationWebhookDelete(t *testing.T) {
@@ -226,7 +231,7 @@ func TestNotificationWebhookDelete(t *testing.T) {
 			t.Fatalf("%d %s", rec.Code, rec.Body.String())
 		}
 	}
-	if f.calls != 2 || f.profile != "p-owner" || f.deleted != "01" {
+	if f.calls != 2 || f.user != 1 || f.profile != "p-owner" || f.deleted != "01" {
 		t.Fatalf("%+v", f)
 	}
 	requireProblem(t, do(t, h, http.MethodDelete, path, "", nil), TypeAuthenticationRequired)
@@ -273,9 +278,9 @@ func TestNotificationServerChannelDelete(t *testing.T) {
 	requireProblem(t, do(t, NewHandler(deps), http.MethodDelete, path, "", bearer(adminToken)), TypeDependencyUnavailable)
 }
 
-func (f *fakeNotificationDestinations) RotateNotificationWebhookSecret(_ context.Context, profile, id string) (string, error) {
+func (f *fakeNotificationDestinations) RotateNotificationWebhookSecret(_ context.Context, user int, profile, id string) (string, error) {
 	f.calls++
-	f.profile, f.deleted = profile, id
+	f.user, f.profile, f.deleted = user, profile, id
 	if id == "discord" {
 		return "", notifications.ErrWebhookInvalid
 	}
@@ -291,7 +296,7 @@ func TestNotificationWebhookRotate(t *testing.T) {
 	h := NewHandler(deps)
 	path := Prefix + "/notifications/webhooks/row-one/rotate-secret"
 	rec := do(t, h, http.MethodPost, path, "", profileOwner())
-	if rec.Code != 200 || rec.Header().Get("Cache-Control") != "no-store" || !strings.Contains(rec.Body.String(), `"signing_secret":"synthetic-secret"`) || f.calls != 1 || f.profile != "p-owner" {
+	if rec.Code != 200 || rec.Header().Get("Cache-Control") != "no-store" || !strings.Contains(rec.Body.String(), `"signing_secret":"synthetic-secret"`) || f.calls != 1 || f.user != 1 || f.profile != "p-owner" {
 		t.Fatalf("%d %s %+v", rec.Code, rec.Body.String(), f)
 	}
 	requireProblem(t, do(t, h, http.MethodPost, path, "", nil), TypeAuthenticationRequired)
@@ -304,8 +309,9 @@ func TestNotificationWebhookRotate(t *testing.T) {
 	requireProblem(t, do(t, NewHandler(deps), http.MethodPost, path, "", profileOwner()), TypeDependencyUnavailable)
 }
 
-func (f *fakeNotificationDestinations) UpdateNotificationWebhook(_ context.Context, profile, id string, input notifications.WebhookInput, check func(int64) error) (*notifications.Webhook, error) {
+func (f *fakeNotificationDestinations) UpdateNotificationWebhook(_ context.Context, user int, profile, id string, input notifications.WebhookInput, check func(int64) error) (*notifications.Webhook, error) {
 	f.calls++
+	f.user, f.profile = user, profile
 	if id == "missing" {
 		return nil, notifications.ErrWebhookNotFound
 	}
@@ -328,8 +334,8 @@ func TestNotificationWebhookUpdate(t *testing.T) {
 	headers := profileOwner()
 	headers["If-Match"] = tag
 	rec := do(t, h, http.MethodPut, path, `{"name":"updated","enabled":false}`, headers)
-	if rec.Code != 200 || rec.Header().Get("ETag") != notificationWebhookTag("p-owner", "row-one", 8).String() || !strings.Contains(rec.Body.String(), `"name":"updated"`) {
-		t.Fatalf("%d %s", rec.Code, rec.Body.String())
+	if rec.Code != 200 || rec.Header().Get("ETag") != notificationWebhookTag("p-owner", "row-one", 8).String() || !strings.Contains(rec.Body.String(), `"name":"updated"`) || f.user != 1 || f.profile != "p-owner" {
+		t.Fatalf("%d %s %+v", rec.Code, rec.Body.String(), f)
 	}
 	requireProblem(t, do(t, h, http.MethodPut, path, `{}`, profileOwner()), TypePreconditionRequired)
 	headers["If-Match"] = notificationWebhookTag("p-owner", "row-one", 6).String()
diff --git a/internal/api/handlers/notification_discord_links_test.go b/internal/apiv2/notification_discord_links_external_test.go
similarity index 99%
rename from internal/api/handlers/notification_discord_links_test.go
rename to internal/apiv2/notification_discord_links_external_test.go
index 81c3655a9a..fecef66623 100644
--- a/internal/api/handlers/notification_discord_links_test.go
+++ b/internal/apiv2/notification_discord_links_external_test.go
@@ -1,4 +1,4 @@
-package handlers_test
+package apiv2_test
 
 import (
 	"context"
diff --git a/internal/api/handlers/notification_email_links_v2_test.go b/internal/apiv2/notification_email_links_v2_test.go
similarity index 99%
rename from internal/api/handlers/notification_email_links_v2_test.go
rename to internal/apiv2/notification_email_links_v2_test.go
index 1595e64f83..dcd1c03506 100644
--- a/internal/api/handlers/notification_email_links_v2_test.go
+++ b/internal/apiv2/notification_email_links_v2_test.go
@@ -1,4 +1,4 @@
-package handlers_test
+package apiv2_test
 
 import (
 	"context"
diff --git a/internal/apiv2/notification_inbox.go b/internal/apiv2/notification_inbox.go
index f95b3f88b3..e94050c7c6 100644
--- a/internal/apiv2/notification_inbox.go
+++ b/internal/apiv2/notification_inbox.go
@@ -8,47 +8,78 @@ import (
 	"strconv"
 	"time"
 
+	"github.com/danielgtaylor/huma/v2"
+
 	"github.com/prairie-server/prairie-server/internal/api/handlers"
 	apimw "github.com/prairie-server/prairie-server/internal/api/middleware"
 	"github.com/prairie-server/prairie-server/internal/notifications"
 )
 
 type NotificationInboxService interface {
-	NotificationPushDisplay(context.Context, string, string) (notifications.NotificationDisplay, error)
+	NotificationPushDisplay(context.Context, int, string, string) (notifications.NotificationDisplay, error)
 	NotificationCapabilities(context.Context) handlers.NotificationCapabilitiesView
-	ListNotificationInbox(context.Context, string, bool, int, *notifications.Cursor, *notifications.Cursor) (handlers.NotificationInboxPageView, error)
-	SyncNotificationInbox(context.Context, string, int, *notifications.Cursor) ([]notifications.DeliveryRowPayload, bool, int, error)
-	GetNotificationInboxItem(context.Context, string, string) (notifications.DeliveryRowPayload, error)
-	NotificationUnreadCount(context.Context, string) (int, error)
+	ListNotificationInbox(context.Context, int, string, bool, int, *notifications.Cursor, *notifications.Cursor) (handlers.NotificationInboxPageView, error)
+	SyncNotificationInbox(context.Context, int, string, int, *notifications.Cursor) ([]notifications.DeliveryRowPayload, bool, int, error)
+	GetNotificationInboxItem(context.Context, int, string, string) (notifications.DeliveryRowPayload, error)
+	NotificationUnreadCount(context.Context, int, string) (int, error)
 	MarkNotificationRead(context.Context, int, string, string) error
 	MarkNotificationInboxThrough(context.Context, int, string, notifications.Cursor) error
-	NotificationPreferences(context.Context, string) (notifications.Preferences, error)
-	PatchNotificationPreferences(context.Context, string, notifications.PreferencePatch) (notifications.Preferences, error)
+	NotificationPreferences(context.Context, int, string) (notifications.Preferences, error)
+	PatchNotificationPreferences(context.Context, int, string, notifications.PreferencePatch) (notifications.Preferences, error)
+	ListNotifiedSeries(context.Context, int, string) ([]notifications.NotifiedSeries, error)
+	MuteNotificationSeries(context.Context, int, string, string) error
+	UnmuteNotificationSeries(context.Context, int, string, string) error
 }
 
 // NotificationItem preserves event-specific reason data while normalizing IDs
 // and timestamps for the native API. Realtime retains its existing event shape.
 type NotificationItem struct {
-	ID              ID              `json:"id"`
-	Type            string          `json:"type"`
-	ProfileID       ID              `json:"profile_id"`
-	LibraryID       *ID             `json:"library_id,omitempty"`
-	SeriesID        *ID             `json:"series_id,omitempty"`
-	EpisodeID       *ID             `json:"episode_id,omitempty"`
-	SeriesTitle     string          `json:"series_title,omitempty"`
-	EpisodeTitle    string          `json:"episode_title,omitempty"`
-	SeasonNumber    *int            `json:"season_number,omitempty"`
-	EpisodeNumber   *int            `json:"episode_number,omitempty"`
-	PosterPath      string          `json:"poster_path,omitempty"`
-	PosterURL       string          `json:"poster_url,omitempty"`
-	PosterThumbhash string          `json:"poster_thumbhash,omitempty"`
-	ReasonFlags     JSONValue       `json:"reason_flags"`
-	CreatedAt       Instant         `json:"created_at"`
-	ReadAt          NullableInstant `json:"read_at"`
+	ID              ID                      `json:"id"`
+	Type            string                  `json:"type"`
+	ProfileID       ID                      `json:"profile_id"`
+	LibraryID       *ID                     `json:"library_id,omitempty"`
+	SeriesID        *ID                     `json:"series_id,omitempty"`
+	EpisodeID       *ID                     `json:"episode_id,omitempty"`
+	SeriesTitle     string                  `json:"series_title,omitempty"`
+	EpisodeTitle    string                  `json:"episode_title,omitempty"`
+	SeasonNumber    *int                    `json:"season_number,omitempty"`
+	EpisodeNumber   *int                    `json:"episode_number,omitempty"`
+	PosterPath      string                  `json:"poster_path,omitempty"`
+	PosterURL       string                  `json:"poster_url,omitempty"`
+	PosterThumbhash string                  `json:"poster_thumbhash,omitempty"`
+	ReasonFlags     NotificationReasonFlags `json:"reason_flags"`
+	CreatedAt       Instant                 `json:"created_at"`
+	ReadAt          NullableInstant         `json:"read_at"`
+}
+
+// NotificationReasonFlags is a delivery's event-specific reason data: the
+// stored reason_flags object, carried as written. Its keys depend on the
+// delivery type, so the contract declares only an object.
+type NotificationReasonFlags []byte
+
+func (v NotificationReasonFlags) MarshalJSON() ([]byte, error) {
+	if len(v) == 0 {
+		return []byte("{}"), nil
+	}
+	return v, nil
+}
+
+func (v *NotificationReasonFlags) UnmarshalJSON(b []byte) error {
+	*v = append((*v)[:0], b...)
+	return nil
+}
+
+func (NotificationReasonFlags) Schema(huma.Registry) *huma.Schema {
+	return &huma.Schema{
+		Type:                 huma.TypeObject,
+		AdditionalProperties: true,
+		Description:          "Event-specific reason data. Its keys depend on the notification type; clients ignore keys they do not recognize.",
+		Extensions:           map[string]any{extExtensionBag: "notification-reason-flags"},
+	}
 }
 
 func notificationItemOf(row notifications.DeliveryRowPayload) NotificationItem {
-	out := NotificationItem{ID: ID(row.ID), Type: row.Type, ProfileID: ID(row.ProfileID), SeriesTitle: row.SeriesTitle, EpisodeTitle: row.EpisodeTitle, SeasonNumber: row.SeasonNumber, EpisodeNumber: row.EpisodeNumber, PosterPath: row.PosterPath, PosterURL: row.PosterURL, PosterThumbhash: row.PosterThumbhash, ReasonFlags: JSONValue(row.ReasonFlags), CreatedAt: NewInstant(row.CreatedAt)}
+	out := NotificationItem{ID: ID(row.ID), Type: row.Type, ProfileID: ID(row.ProfileID), SeriesTitle: row.SeriesTitle, EpisodeTitle: row.EpisodeTitle, SeasonNumber: row.SeasonNumber, EpisodeNumber: row.EpisodeNumber, PosterPath: row.PosterPath, PosterURL: row.PosterURL, PosterThumbhash: row.PosterThumbhash, ReasonFlags: NotificationReasonFlags(row.ReasonFlags), CreatedAt: NewInstant(row.CreatedAt)}
 	if row.LibraryID != nil {
 		out.LibraryID = new(ID(strconv.Itoa(*row.LibraryID)))
 	}
@@ -179,7 +210,7 @@ func registerNotificationInbox(reg *Registry) {
 		if p != nil {
 			return nil, p
 		}
-		view, err := svc.NotificationPushDisplay(ctx, profileFrom(ctx), string(in.DeliveryID))
+		view, err := svc.NotificationPushDisplay(ctx, claimsFrom(ctx).UserID, profileFrom(ctx), string(in.DeliveryID))
 		if err != nil {
 			return nil, serviceProblem(err)
 		}
@@ -193,7 +224,10 @@ func registerNotificationInbox(reg *Registry) {
 			body.State = StateNotConfigured
 			return &NotificationCapabilitiesOutput{Body: body}, nil
 		}
-		return &NotificationCapabilitiesOutput{Body: notificationCapabilitiesOf(svc.NotificationCapabilities(ctx))}, nil
+		body := notificationCapabilitiesOf(svc.NotificationCapabilities(ctx))
+		body.Series.Available = reg.deps.PersonalLists != nil
+		body.Series.Mute = body.Series.Available
+		return &NotificationCapabilitiesOutput{Body: body}, nil
 	})
 	Register(reg, notificationOperation(http.MethodGet, "", "listNotifications"), func(ctx context.Context, in *NotificationListInput) (*NotificationListOutput, error) {
 		svc, p := reg.notificationInbox()
@@ -209,7 +243,7 @@ func registerNotificationInbox(reg *Registry) {
 			}
 			through = &pos.Through
 		}
-		view, err := svc.ListNotificationInbox(ctx, profileFrom(ctx), in.Status == "unread", in.Limit, pos.Before, through)
+		view, err := svc.ListNotificationInbox(ctx, claimsFrom(ctx).UserID, profileFrom(ctx), in.Status == "unread", in.Limit, pos.Before, through)
 		if err != nil {
 			return nil, serviceProblem(err)
 		}
@@ -247,7 +281,7 @@ func registerNotificationInbox(reg *Registry) {
 				return nil, p
 			}
 		}
-		rows, more, count, err := svc.SyncNotificationInbox(ctx, profileFrom(ctx), in.Limit, since)
+		rows, more, count, err := svc.SyncNotificationInbox(ctx, claimsFrom(ctx).UserID, profileFrom(ctx), in.Limit, since)
 		if err != nil {
 			return nil, serviceProblem(err)
 		}
@@ -283,7 +317,7 @@ func registerNotificationInbox(reg *Registry) {
 		if p != nil {
 			return nil, p
 		}
-		count, err := svc.NotificationUnreadCount(ctx, profileFrom(ctx))
+		count, err := svc.NotificationUnreadCount(ctx, claimsFrom(ctx).UserID, profileFrom(ctx))
 		if err != nil {
 			return nil, serviceProblem(err)
 		}
@@ -296,7 +330,7 @@ func registerNotificationInbox(reg *Registry) {
 		if p != nil {
 			return nil, p
 		}
-		row, err := svc.GetNotificationInboxItem(ctx, profileFrom(ctx), string(in.ID))
+		row, err := svc.GetNotificationInboxItem(ctx, claimsFrom(ctx).UserID, profileFrom(ctx), string(in.ID))
 		if err != nil {
 			return nil, serviceProblem(err)
 		}
@@ -335,7 +369,7 @@ func registerNotificationInbox(reg *Registry) {
 		if p != nil {
 			return nil, p
 		}
-		prefs, err := svc.NotificationPreferences(ctx, profileFrom(ctx))
+		prefs, err := svc.NotificationPreferences(ctx, claimsFrom(ctx).UserID, profileFrom(ctx))
 		if err != nil {
 			return nil, serviceProblem(err)
 		}
@@ -356,7 +390,7 @@ func registerNotificationInbox(reg *Registry) {
 			}
 		}
 		b := in.Body
-		prefs, err := svc.PatchNotificationPreferences(ctx, profileFrom(ctx), notifications.PreferencePatch{Enabled: b.Enabled, NotifyFavorites: b.NotifyFavorites, NotifyWatchlist: b.NotifyWatchlist, NotifyContinueWatching: b.NotifyContinueWatching, NotifyNextUp: b.NotifyNextUp})
+		prefs, err := svc.PatchNotificationPreferences(ctx, claimsFrom(ctx).UserID, profileFrom(ctx), notifications.PreferencePatch{Enabled: b.Enabled, NotifyFavorites: b.NotifyFavorites, NotifyWatchlist: b.NotifyWatchlist, NotifyContinueWatching: b.NotifyContinueWatching, NotifyNextUp: b.NotifyNextUp})
 		if err != nil {
 			return nil, serviceProblem(err)
 		}
@@ -399,6 +433,14 @@ type NotificationCapabilities struct {
 	Webhooks    NotificationWebhookCapability        `json:"webhooks"`
 	Email       NotificationAccountChannelCapability `json:"email"`
 	Discord     NotificationAccountChannelCapability `json:"discord"`
+	Series      NotificationSeriesCapability         `json:"series"`
+}
+
+// NotificationSeriesCapability reports listNotificationSeries and the series
+// mute.
+type NotificationSeriesCapability struct {
+	Available bool `json:"available" doc:"GET /notifications/series lists the series whose new episodes can notify the profile"`
+	Mute      bool `json:"mute" doc:"PUT and DELETE /notifications/series/{series_id}/mute mute and unmute one series, and list entries carry muted"`
 }
 type NotificationInAppCapability struct {
 	Enabled bool `json:"enabled"`
diff --git a/internal/apiv2/notification_inbox_test.go b/internal/apiv2/notification_inbox_test.go
index 069720e5a8..898ff533f1 100644
--- a/internal/apiv2/notification_inbox_test.go
+++ b/internal/apiv2/notification_inbox_test.go
@@ -3,8 +3,10 @@ package apiv2
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"net/http"
 	"net/url"
+	"strings"
 	"testing"
 	"time"
 
@@ -26,6 +28,50 @@ type fakeNotificationInbox struct {
 	writes int
 	patch  notifications.PreferencePatch
 	empty  bool
+	// series is the notified-series list; nil answers fixtureNotifiedSeries.
+	series []notifications.NotifiedSeries
+	// mutes and unmutes record the series each call named, as
+	// account/profile/series.
+	mutes, unmutes []string
+}
+
+// fixtureNotifiedSeries is a profile's notified-series list in service
+// order: Next Up alone, two active reasons, a series the viewer may not see,
+// a watchlist series the preferences silence, and a muted favorite.
+func fixtureNotifiedSeries() []notifications.NotifiedSeries {
+	nextUp := notifications.EpisodeKey(2, 9)
+	day := func(n int) time.Time { return fixedTime().Add(time.Duration(n) * 24 * time.Hour) }
+	latest := func(n int) *time.Time { t := day(n); return &t }
+	return []notifications.NotifiedSeries{
+		{SeriesID: "series:andor", SeriesSortFields: notifications.SeriesSortFields{SortKey: "andor", Title: "Andor", Year: 2022, AddedAt: day(0), LatestEpisodeAddedAt: latest(3)}, Reasons: notifications.ReasonFlags{NextUp: true}, Active: notifications.ReasonFlags{NextUp: true}, NextExpectedEpisodeKey: &nextUp},
+		{SeriesID: "series:bear", SeriesSortFields: notifications.SeriesSortFields{SortKey: "bear", Title: "The Bear", Year: 2024, AddedAt: day(1), LatestEpisodeAddedAt: latest(5)}, Reasons: notifications.ReasonFlags{Favorite: true, ContinueWatching: true}, Active: notifications.ReasonFlags{Favorite: true, ContinueWatching: true}},
+		{SeriesID: "series:hidden", SeriesSortFields: notifications.SeriesSortFields{SortKey: "hidden", Title: "Hidden", AddedAt: day(2)}, Reasons: notifications.ReasonFlags{Favorite: true}, Active: notifications.ReasonFlags{Favorite: true}},
+		{SeriesID: "series:slow-horses", SeriesSortFields: notifications.SeriesSortFields{SortKey: "slow horses", Title: "Slow Horses", Year: 2023, AddedAt: day(3), LatestEpisodeAddedAt: latest(1)}, Reasons: notifications.ReasonFlags{Watchlist: true}},
+		{SeriesID: "series:wire", SeriesSortFields: notifications.SeriesSortFields{SortKey: "wire", Title: "The Wire", Year: 2002, AddedAt: day(4), LatestEpisodeAddedAt: latest(2)}, Reasons: notifications.ReasonFlags{Favorite: true}, Active: notifications.ReasonFlags{Favorite: true}, Muted: true},
+	}
+}
+
+// notificationNotASeriesID is an item the viewer may see that is no series.
+const notificationNotASeriesID = "movie:heat-1995"
+
+func (f *fakeNotificationInbox) MuteNotificationSeries(_ context.Context, userID int, profile, seriesID string) error {
+	if seriesID == notificationNotASeriesID {
+		return &handlers.APIError{Status: http.StatusNotFound, Code: "not_found", Message: "Series not found"}
+	}
+	f.mutes = append(f.mutes, fmt.Sprintf("%d/%s/%s", userID, profile, seriesID))
+	return nil
+}
+
+func (f *fakeNotificationInbox) UnmuteNotificationSeries(_ context.Context, userID int, profile, seriesID string) error {
+	f.unmutes = append(f.unmutes, fmt.Sprintf("%d/%s/%s", userID, profile, seriesID))
+	return nil
+}
+
+func (f *fakeNotificationInbox) ListNotifiedSeries(context.Context, int, string) ([]notifications.NotifiedSeries, error) {
+	if f.series == nil {
+		return fixtureNotifiedSeries(), nil
+	}
+	return f.series, nil
 }
 
 func fixtureNotificationInbox() *fakeNotificationInbox {
@@ -39,7 +85,7 @@ func (*fakeNotificationInbox) NotificationCapabilities(context.Context) handlers
 func (f *fakeNotificationInbox) row(profile string) notifications.DeliveryRowPayload {
 	return notifications.DeliveryRowPayload{ID: notificationFixtureID, Type: "request.approved", ProfileID: profile, CreatedAt: f.cutoff.CreatedAt, ReasonFlags: json.RawMessage(`{"request_id":"request-1"}`)}
 }
-func (f *fakeNotificationInbox) ListNotificationInbox(_ context.Context, profile string, _ bool, _ int, before, through *notifications.Cursor) (handlers.NotificationInboxPageView, error) {
+func (f *fakeNotificationInbox) ListNotificationInbox(_ context.Context, _ int, profile string, _ bool, _ int, before, through *notifications.Cursor) (handlers.NotificationInboxPageView, error) {
 	boundary := f.cutoff
 	if through != nil {
 		boundary = *through
@@ -54,19 +100,19 @@ func (f *fakeNotificationInbox) ListNotificationInbox(_ context.Context, profile
 	}
 	return handlers.NotificationInboxPageView{Items: rows, Through: boundary, More: before == nil && !f.empty}, nil
 }
-func (f *fakeNotificationInbox) SyncNotificationInbox(_ context.Context, profile string, _ int, _ *notifications.Cursor) ([]notifications.DeliveryRowPayload, bool, int, error) {
+func (f *fakeNotificationInbox) SyncNotificationInbox(_ context.Context, _ int, profile string, _ int, _ *notifications.Cursor) ([]notifications.DeliveryRowPayload, bool, int, error) {
 	if f.empty {
 		return nil, false, 0, nil
 	}
 	return []notifications.DeliveryRowPayload{f.row(profile)}, false, 1, nil
 }
-func (f *fakeNotificationInbox) GetNotificationInboxItem(_ context.Context, profile, id string) (notifications.DeliveryRowPayload, error) {
+func (f *fakeNotificationInbox) GetNotificationInboxItem(_ context.Context, _ int, profile, id string) (notifications.DeliveryRowPayload, error) {
 	if id != notificationFixtureID {
 		return notifications.DeliveryRowPayload{}, &handlers.APIError{Status: 404, Code: "not_found", Message: "Notification not found"}
 	}
 	return f.row(profile), nil
 }
-func (*fakeNotificationInbox) NotificationUnreadCount(context.Context, string) (int, error) {
+func (*fakeNotificationInbox) NotificationUnreadCount(context.Context, int, string) (int, error) {
 	return 1, nil
 }
 func (f *fakeNotificationInbox) MarkNotificationRead(context.Context, int, string, string) error {
@@ -78,13 +124,13 @@ func (f *fakeNotificationInbox) MarkNotificationInboxThrough(_ context.Context,
 	f.writes++
 	return nil
 }
-func (*fakeNotificationInbox) NotificationPreferences(_ context.Context, profile string) (notifications.Preferences, error) {
-	return notifications.DefaultPreferences(profile), nil
+func (*fakeNotificationInbox) NotificationPreferences(_ context.Context, userID int, profile string) (notifications.Preferences, error) {
+	return notifications.DefaultPreferences(userID, profile), nil
 }
-func (f *fakeNotificationInbox) PatchNotificationPreferences(_ context.Context, profile string, patch notifications.PreferencePatch) (notifications.Preferences, error) {
+func (f *fakeNotificationInbox) PatchNotificationPreferences(_ context.Context, userID int, profile string, patch notifications.PreferencePatch) (notifications.Preferences, error) {
 	f.patch = patch
 	f.writes++
-	p := notifications.DefaultPreferences(profile)
+	p := notifications.DefaultPreferences(userID, profile)
 	if patch.Enabled != nil {
 		p.Enabled = *patch.Enabled
 	}
@@ -171,7 +217,7 @@ func TestNotificationEmptySyncHasStableCheckpoint(t *testing.T) {
 	}
 }
 
-func (f *fakeNotificationInbox) NotificationPushDisplay(_ context.Context, profile, id string) (notifications.NotificationDisplay, error) {
+func (f *fakeNotificationInbox) NotificationPushDisplay(_ context.Context, _ int, profile, id string) (notifications.NotificationDisplay, error) {
 	if profile != "p-owner" || id != notificationFixtureID {
 		return notifications.NotificationDisplay{}, &handlers.APIError{Status: 404, Code: "not_found", Message: "Notification not found"}
 	}
@@ -243,3 +289,42 @@ func TestNotificationDisplayCredentialScope(t *testing.T) {
 		})
 	}
 }
+
+// reason_flags is notification data, not a settings value: the contract must
+// not borrow JSONValue's settings description for it.
+func TestNotificationItemReasonFlagsSchema(t *testing.T) {
+	NewHandler(Dependencies{testRegister: func(reg *Registry) {
+		item := reg.api.OpenAPI().Components.Schemas.Map()["NotificationItem"]
+		if item == nil {
+			t.Fatal("NotificationItem schema is not published")
+		}
+		flags := item.Properties["reason_flags"]
+		if flags == nil {
+			t.Fatal("NotificationItem.reason_flags is not declared")
+		}
+		if flags.Type != "object" || flags.AdditionalProperties != true {
+			t.Fatalf("reason_flags = type %q, additionalProperties %v; want an open object", flags.Type, flags.AdditionalProperties)
+		}
+		if flags.Extensions[extExtensionBag] != "notification-reason-flags" {
+			t.Fatalf("reason_flags extension bag = %v", flags.Extensions[extExtensionBag])
+		}
+		if !strings.Contains(flags.Description, "notification type") || strings.Contains(flags.Description, "value_schema") {
+			t.Fatalf("reason_flags description = %q", flags.Description)
+		}
+	}})
+}
+
+func TestNotificationReasonFlagsMarshal(t *testing.T) {
+	for _, tc := range []struct {
+		in   NotificationReasonFlags
+		want string
+	}{
+		{nil, `{}`},
+		{NotificationReasonFlags(`{"follower":true,"request_id":"request-1"}`), `{"follower":true,"request_id":"request-1"}`},
+	} {
+		got, err := json.Marshal(tc.in)
+		if err != nil || string(got) != tc.want {
+			t.Fatalf("marshal %q = %s, %v; want %s", tc.in, got, err, tc.want)
+		}
+	}
+}
diff --git a/internal/apiv2/notification_series.go b/internal/apiv2/notification_series.go
new file mode 100644
index 0000000000..4340977eb3
--- /dev/null
+++ b/internal/apiv2/notification_series.go
@@ -0,0 +1,337 @@
+package apiv2
+
+import (
+	"cmp"
+	"context"
+	"net/http"
+	"slices"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/prairie-server/prairie-server/internal/imagesize"
+	"github.com/prairie-server/prairie-server/internal/notifications"
+)
+
+// The notified-series list: every series whose new episodes the acting
+// profile has a reason to hear about, the index episode fanout reads, so a
+// profile can see why a series notifies it or why it does not. A profile can
+// mute one series, which stops its new-episode notifications whatever its
+// reasons, until it unmutes.
+
+const (
+	opListNotificationSeries   = "listNotificationSeries"
+	opMuteNotificationSeries   = "muteNotificationSeries"
+	opUnmuteNotificationSeries = "unmuteNotificationSeries"
+)
+
+// The listNotificationSeries sort fields besides the default title.
+const (
+	notificationSeriesSortYear          = "year"
+	notificationSeriesSortAddedAt       = "added_at"
+	notificationSeriesSortLatestEpisode = "latest_episode_added"
+)
+
+// The listNotificationSeries status filters besides the default "all".
+const (
+	notificationSeriesActive   = "active"
+	notificationSeriesInactive = "inactive"
+)
+
+// NotificationSeriesInput is the listNotificationSeries query.
+type NotificationSeriesInput struct {
+	ArtworkQuery
+	LimitParam
+	Cursor string `query:"cursor" doc:"Opaque cursor from page.next_cursor" example:"eyJ0IjoiYmVhciJ9"`
+	Status string `query:"status" default:"all" enum:"all,active,inactive" doc:"active keeps the series that notify; inactive keeps the ones that do not, because the profile's preferences silence every reason or the profile muted the series"`
+	Reason string `query:"reason" enum:"favorite,watchlist,continue_watching,next_up" doc:"Keeps the series with this reason, whether or not the preferences let it notify; absent keeps every reason"`
+	Q      string `query:"q" maxLength:"200" doc:"Keeps the series whose title or sort title contains this text, case-insensitively" example:"bear"`
+	Sort   string `query:"sort" default:"title" enum:"title,-title,year,-year,added_at,-added_at,latest_episode_added,-latest_episode_added" doc:"One field, descending with a leading '-'. added_at is when the series joined the catalog; latest_episode_added when it last gained an episode. A series without a year or an episode sorts last either way; ties order by title."`
+}
+
+// NotificationSeriesReasons are the reasons a profile can hear about a
+// series, keyed like an episode notification's reason_flags.
+type NotificationSeriesReasons struct {
+	Favorite         bool `json:"favorite" doc:"The series is one of the profile's favorites"`
+	Watchlist        bool `json:"watchlist" doc:"The series is on the profile's watchlist"`
+	ContinueWatching bool `json:"continue_watching" doc:"The profile is partway through the series"`
+	NextUp           bool `json:"next_up" doc:"The profile finished an episode and waits for the next"`
+}
+
+func notificationSeriesReasonsOf(f notifications.ReasonFlags) NotificationSeriesReasons {
+	return NotificationSeriesReasons{Favorite: f.Favorite, Watchlist: f.Watchlist, ContinueWatching: f.ContinueWatching, NextUp: f.NextUp}
+}
+
+// NotificationEpisodeRef names an episode by its season and episode number.
+type NotificationEpisodeRef struct {
+	SeasonNumber  int `json:"season_number" example:"2"`
+	EpisodeNumber int `json:"episode_number" example:"9"`
+}
+
+// NotificationSeries is one series on the list.
+type NotificationSeries struct {
+	Item          CatalogItem               `json:"item" doc:"The series as a catalog card"`
+	Reasons       NotificationSeriesReasons `json:"reasons" doc:"The profile's relationships to the series"`
+	ActiveReasons NotificationSeriesReasons `json:"active_reasons" doc:"The reasons the profile's notification preferences let notify; all false when they silence the series"`
+	Notifies      bool                      `json:"notifies" doc:"True when at least one reason is active and the profile has not muted the series"`
+	Muted         bool                      `json:"muted" doc:"The profile muted the series: it gets no new-episode notification for it, whatever the reasons, until it unmutes. active_reasons still names the reasons that would notify once unmuted."`
+	NextUpAfter   *NotificationEpisodeRef   `json:"next_up_after,omitempty" doc:"With an active Next Up reason, the last episode the profile finished: on that reason alone, only a new episode after it notifies"`
+}
+
+// NotificationSeriesCollection is the listNotificationSeries envelope.
+type NotificationSeriesCollection struct {
+	Collection[NotificationSeries]
+}
+
+// NotificationSeriesOutput is the listNotificationSeries response.
+type NotificationSeriesOutput struct {
+	Body NotificationSeriesCollection
+}
+
+// notificationSeriesPosition is the keyset of the last series a page
+// emitted: every field an order compares, so the next page resumes strictly
+// after it in any sort, even once that series has left the list.
+type notificationSeriesPosition struct {
+	SortKey  string     `json:"t"`
+	Year     int        `json:"y,omitempty"`
+	AddedAt  time.Time  `json:"a"`
+	Latest   *time.Time `json:"l,omitempty"`
+	SeriesID string     `json:"s"`
+}
+
+func notificationSeriesPositionOf(s notifications.NotifiedSeries) notificationSeriesPosition {
+	return notificationSeriesPosition{SortKey: s.SortKey, Year: s.Year, AddedAt: s.AddedAt, Latest: s.LatestEpisodeAddedAt, SeriesID: s.SeriesID}
+}
+
+func (p notificationSeriesPosition) series() notifications.NotifiedSeries {
+	return notifications.NotifiedSeries{SeriesID: p.SeriesID, SeriesSortFields: notifications.SeriesSortFields{SortKey: p.SortKey, Year: p.Year, AddedAt: p.AddedAt, LatestEpisodeAddedAt: p.Latest}}
+}
+
+// notificationSeriesOrder compares series in a listNotificationSeries sort:
+// the field, then sort title and item ID ascending.
+func notificationSeriesOrder(sort string) func(a, b notifications.NotifiedSeries) int {
+	field, desc := strings.CutPrefix(sort, "-")
+	return func(a, b notifications.NotifiedSeries) int {
+		var primary int
+		switch field {
+		case notificationSeriesSortYear:
+			primary = orderMissingLast(a.Year == 0, b.Year == 0, cmp.Compare(a.Year, b.Year), desc)
+		case notificationSeriesSortAddedAt:
+			primary = orderMissingLast(false, false, a.AddedAt.Compare(b.AddedAt), desc)
+		case notificationSeriesSortLatestEpisode:
+			aMissing, bMissing := a.LatestEpisodeAddedAt == nil, b.LatestEpisodeAddedAt == nil
+			c := 0
+			if !aMissing && !bMissing {
+				c = a.LatestEpisodeAddedAt.Compare(*b.LatestEpisodeAddedAt)
+			}
+			primary = orderMissingLast(aMissing, bMissing, c, desc)
+		default:
+			primary = orderMissingLast(false, false, strings.Compare(a.SortKey, b.SortKey), desc)
+		}
+		return cmp.Or(primary, strings.Compare(a.SortKey, b.SortKey), strings.Compare(a.SeriesID, b.SeriesID))
+	}
+}
+
+// orderMissingLast applies a direction to c, keeping missing values last.
+func orderMissingLast(aMissing, bMissing bool, c int, desc bool) int {
+	switch {
+	case aMissing && bMissing:
+		return 0
+	case aMissing:
+		return 1
+	case bMissing:
+		return -1
+	case desc:
+		return -c
+	}
+	return c
+}
+
+// notificationSeriesMatch reports whether a series passes the query's
+// status, reason, and search filters.
+func notificationSeriesMatch(in *NotificationSeriesInput, query string) func(notifications.NotifiedSeries) bool {
+	return func(s notifications.NotifiedSeries) bool {
+		switch {
+		case in.Status == notificationSeriesActive && !s.Notifies(),
+			in.Status == notificationSeriesInactive && s.Notifies():
+			return false
+		case in.Reason != "" && !s.Reasons.Has(in.Reason):
+			return false
+		}
+		return query == "" || strings.Contains(strings.ToLower(s.Title), query) || strings.Contains(s.SortKey, query)
+	}
+}
+
+func registerNotificationSeries(reg *Registry) {
+	cursors := NewCursors(reg.deps.CursorSecret)
+	op := notificationOperation(http.MethodGet, "/series", opListNotificationSeries)
+	op.Summary = "List the series whose new episodes can notify the acting profile."
+	op.Description = "Every series the profile favorited, put on its watchlist, is partway through, or waits on a next episode of, and every series it muted, filtered and sorted as asked (by title by default). Each carries its reasons, which of them the profile's notification preferences let notify, and whether the profile muted it. Series the viewer may not see are omitted."
+	Register(reg, op, func(ctx context.Context, in *NotificationSeriesInput) (*NotificationSeriesOutput, error) {
+		return reg.listNotificationSeries(ctx, cursors, in)
+	})
+
+	mute := notificationOperation(http.MethodPut, "/series/{series_id}/mute", opMuteNotificationSeries)
+	mute.DefaultStatus = http.StatusNoContent
+	mute.Summary = "Mute new-episode notifications for one series."
+	mute.Description = "The acting profile gets no new-episode notification for the series on any channel, whatever its reasons, until it unmutes. Favorites, the watchlist, Home, and watch history are unchanged, and other profiles are unaffected. Muting a series already muted succeeds and changes nothing. A series the viewer may not see, or an item that is not a series, is 404."
+	Register(reg, mute, reg.muteNotificationSeries)
+
+	unmute := notificationOperation(http.MethodDelete, "/series/{series_id}/mute", opUnmuteNotificationSeries)
+	unmute.DefaultStatus = http.StatusNoContent
+	unmute.Summary = "Unmute new-episode notifications for one series."
+	unmute.Description = "The series notifies the acting profile again for its active reasons. The mute applies when notification delivery evaluates a new episode, normally within a minute of it arriving: an episode evaluated while the series was muted is not announced later, and one still waiting to be evaluated when the profile unmutes is announced. Unmuting a series that is not muted succeeds and changes nothing. No access check runs, so a profile can lift a mute on a series it can no longer see."
+	Register(reg, unmute, reg.unmuteNotificationSeries)
+}
+
+// NotificationSeriesMuteInput names the series to mute or unmute.
+type NotificationSeriesMuteInput struct {
+	SeriesID ID `path:"series_id" minLength:"1" doc:"Catalog item identifier of the series" example:"series-tvdb-81189"`
+}
+
+func (reg *Registry) muteNotificationSeries(ctx context.Context, in *NotificationSeriesMuteInput) (*struct{}, error) {
+	svc, p := reg.notificationInbox()
+	if p != nil {
+		return nil, p
+	}
+	if reg.deps.PersonalLists == nil {
+		return nil, unavailable("notification series")
+	}
+	viewer, p := personalListViewer(ctx, imagesize.Request{})
+	if p != nil {
+		return nil, p
+	}
+	seriesID := string(in.SeriesID)
+	visible, err := reg.deps.PersonalLists.VisibleItemIDs(ctx, viewer, []string{seriesID})
+	if err != nil {
+		return nil, serviceProblem(err)
+	}
+	if !visible[seriesID] {
+		return nil, NewProblem(TypeNotFound, "Series not found.")
+	}
+	if err := svc.MuteNotificationSeries(ctx, viewer.UserID, viewer.ProfileID, seriesID); err != nil {
+		return nil, serviceProblem(err)
+	}
+	return nil, nil
+}
+
+func (reg *Registry) unmuteNotificationSeries(ctx context.Context, in *NotificationSeriesMuteInput) (*struct{}, error) {
+	svc, p := reg.notificationInbox()
+	if p != nil {
+		return nil, p
+	}
+	userID, profileID, p := viewerIdentity(ctx)
+	if p != nil {
+		return nil, p
+	}
+	if err := svc.UnmuteNotificationSeries(ctx, userID, profileID, string(in.SeriesID)); err != nil {
+		return nil, serviceProblem(err)
+	}
+	return nil, nil
+}
+
+func (reg *Registry) listNotificationSeries(ctx context.Context, cursors *Cursors, in *NotificationSeriesInput) (*NotificationSeriesOutput, error) {
+	svc, p := reg.notificationInbox()
+	if p != nil {
+		return nil, p
+	}
+	if reg.deps.PersonalLists == nil {
+		return nil, unavailable("notification series")
+	}
+	viewer, p := personalListViewer(ctx, in.Artwork())
+	if p != nil {
+		return nil, p
+	}
+	query := strings.ToLower(strings.TrimSpace(in.Q))
+	scope := CursorScope{
+		OperationID: opListNotificationSeries,
+		Security:    strconv.Itoa(viewer.UserID) + "/" + viewer.ProfileID + "/" + viewerScopeDigest(ctx),
+		Filter:      in.Status + "|" + in.Reason + "|" + query,
+		Sort:        in.Sort,
+		Tiebreaker:  tiebreakerItemID,
+	}
+	var after *notificationSeriesPosition
+	if in.Cursor != "" {
+		after = new(notificationSeriesPosition)
+		if p := cursors.Decode(scope, in.Cursor, after); p != nil {
+			return nil, p
+		}
+	}
+	all, err := svc.ListNotifiedSeries(ctx, viewer.UserID, viewer.ProfileID)
+	if err != nil {
+		return nil, serviceProblem(err)
+	}
+	order := notificationSeriesOrder(in.Sort)
+	keep := notificationSeriesMatch(in, query)
+	candidates := make([]notifications.NotifiedSeries, 0, len(all))
+	ids := make([]string, 0, len(all))
+	for _, s := range all {
+		if keep(s) {
+			candidates = append(candidates, s)
+			ids = append(ids, s.SeriesID)
+		}
+	}
+	// Pages hold only series the viewer may see, so a cursor never carries a
+	// hidden series' sort fields and no page comes back empty with more behind it.
+	visible, err := reg.deps.PersonalLists.VisibleItemIDs(ctx, viewer, ids)
+	if err != nil {
+		return nil, serviceProblem(err)
+	}
+	matches := slices.DeleteFunc(candidates, func(s notifications.NotifiedSeries) bool { return !visible[s.SeriesID] })
+	slices.SortFunc(matches, order)
+	start := 0
+	if after != nil {
+		last := after.series()
+		start = len(matches)
+		if i := slices.IndexFunc(matches, func(s notifications.NotifiedSeries) bool { return order(s, last) > 0 }); i >= 0 {
+			start = i
+		}
+	}
+	// A limit+1 probe decides has_more.
+	page := matches[start:min(start+in.Limit+1, len(matches))]
+	next := ""
+	if len(page) > in.Limit {
+		page = page[:in.Limit]
+		if next, err = cursors.Encode(scope, notificationSeriesPositionOf(page[len(page)-1])); err != nil {
+			return nil, serviceProblem(err)
+		}
+	}
+	pageIDs := make([]string, len(page))
+	for i, s := range page {
+		pageIDs[i] = s.SeriesID
+	}
+	cards, err := reg.deps.PersonalLists.ResolveCards(ctx, viewer, pageIDs)
+	if err != nil {
+		return nil, serviceProblem(err)
+	}
+	sel := reg.ratingSelection(ctx)
+	byID := make(map[string]int, len(cards))
+	for i, card := range cards {
+		byID[card.ContentID] = i
+	}
+	items := make([]NotificationSeries, 0, len(cards))
+	for _, s := range page {
+		if i, ok := byID[s.SeriesID]; ok {
+			items = append(items, notificationSeriesOf(s, catalogItemOfListing(cards[i], sel)))
+		}
+	}
+	return &NotificationSeriesOutput{Body: NotificationSeriesCollection{Collection: Paginated(items, next)}}, nil
+}
+
+func notificationSeriesOf(s notifications.NotifiedSeries, item CatalogItem) NotificationSeries {
+	out := NotificationSeries{
+		Item:          item,
+		Reasons:       notificationSeriesReasonsOf(s.Reasons),
+		ActiveReasons: notificationSeriesReasonsOf(s.Active),
+		Notifies:      s.Notifies(),
+		Muted:         s.Muted,
+	}
+	// Next Up waits for any episode keyed at or past last-finished + 1, which
+	// need not exist (after a season finale the next is the following season's
+	// first), so the contract names the finished episode instead.
+	if s.NextExpectedEpisodeKey != nil {
+		season, episode := notifications.SplitEpisodeKey(*s.NextExpectedEpisodeKey - 1)
+		out.NextUpAfter = &NotificationEpisodeRef{SeasonNumber: season, EpisodeNumber: episode}
+	}
+	return out
+}
diff --git a/internal/apiv2/notification_series_test.go b/internal/apiv2/notification_series_test.go
new file mode 100644
index 0000000000..e26079b613
--- /dev/null
+++ b/internal/apiv2/notification_series_test.go
@@ -0,0 +1,261 @@
+package apiv2
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/url"
+	"slices"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/notifications"
+)
+
+type notificationSeriesPage struct {
+	Items []NotificationSeries `json:"items"`
+	Page  PageInfo             `json:"page"`
+}
+
+func notificationSeriesHandler(t *testing.T) (http.Handler, *fakePersonalLists) {
+	t.Helper()
+	lists := &fakePersonalLists{missing: map[string]bool{"series:hidden": true}}
+	deps := pilotDeps(nil, nil)
+	deps.NotificationInbox = fixtureNotificationInbox()
+	deps.PersonalLists = lists
+	return NewHandler(deps), lists
+}
+
+func getNotificationSeries(t *testing.T, h http.Handler, query string) notificationSeriesPage {
+	t.Helper()
+	rec := do(t, h, http.MethodGet, Prefix+"/notifications/series"+query, "", profileOwner())
+	if rec.Code != http.StatusOK {
+		t.Fatal(rec.Code, rec.Body.String())
+	}
+	var page notificationSeriesPage
+	if err := json.Unmarshal(rec.Body.Bytes(), &page); err != nil {
+		t.Fatal(err)
+	}
+	return page
+}
+
+func notificationSeriesIDs(items []NotificationSeries) []string {
+	ids := make([]string, len(items))
+	for i, item := range items {
+		ids[i] = item.Item.ContentID
+	}
+	return ids
+}
+
+func TestNotificationSeriesListsReasonsAndOmitsHiddenSeries(t *testing.T) {
+	h, lists := notificationSeriesHandler(t)
+	page := getNotificationSeries(t, h, "")
+	if got := notificationSeriesIDs(page.Items); !slices.Equal(got, []string{"series:andor", "series:bear", "series:slow-horses", "series:wire"}) {
+		t.Fatalf("items = %v", got)
+	}
+	if page.Page.HasMore {
+		t.Fatal("a complete list has no next page")
+	}
+	andor, bear, slow, wire := page.Items[0], page.Items[1], page.Items[2], page.Items[3]
+	if !andor.Notifies || !andor.ActiveReasons.NextUp || andor.NextUpAfter == nil || *andor.NextUpAfter != (NotificationEpisodeRef{SeasonNumber: 2, EpisodeNumber: 8}) {
+		t.Fatalf("next up series = %+v", andor)
+	}
+	if !bear.Notifies || !bear.Reasons.Favorite || !bear.Reasons.ContinueWatching || bear.NextUpAfter != nil {
+		t.Fatalf("favorite series = %+v", bear)
+	}
+	if slow.Notifies || slow.Muted || !slow.Reasons.Watchlist || slow.ActiveReasons != (NotificationSeriesReasons{}) {
+		t.Fatalf("silenced series = %+v", slow)
+	}
+	// A muted series notifies nobody; its active reasons still say what
+	// would notify once unmuted.
+	if wire.Notifies || !wire.Muted || !wire.ActiveReasons.Favorite || andor.Muted || bear.Muted {
+		t.Fatalf("muted series = %+v", wire)
+	}
+	if len(lists.viewers) != 1 || lists.viewers[0].ProfileID != "p-owner" {
+		t.Fatalf("cards resolved as %+v", lists.viewers)
+	}
+}
+
+func TestNotificationSeriesStatusFilter(t *testing.T) {
+	h, _ := notificationSeriesHandler(t)
+	if got := notificationSeriesIDs(getNotificationSeries(t, h, "?status=active").Items); !slices.Equal(got, []string{"series:andor", "series:bear"}) {
+		t.Fatalf("active = %v", got)
+	}
+	if got := notificationSeriesIDs(getNotificationSeries(t, h, "?status=inactive").Items); !slices.Equal(got, []string{"series:slow-horses", "series:wire"}) {
+		t.Fatalf("inactive = %v", got)
+	}
+}
+
+// Series the viewer may not see are dropped before paging: every page is
+// full, and no cursor is minted at a hidden series.
+func TestNotificationSeriesPagesByTitle(t *testing.T) {
+	h, _ := notificationSeriesHandler(t)
+	var got []string
+	query := "?limit=1"
+	for range 5 {
+		page := getNotificationSeries(t, h, query)
+		if len(page.Items) != 1 {
+			t.Fatalf("page %s holds %d series, want 1", query, len(page.Items))
+		}
+		got = append(got, notificationSeriesIDs(page.Items)...)
+		if !page.Page.HasMore {
+			break
+		}
+		query = "?limit=1&cursor=" + url.QueryEscape(page.Page.NextCursor)
+	}
+	if !slices.Equal(got, []string{"series:andor", "series:bear", "series:slow-horses", "series:wire"}) {
+		t.Fatalf("paged = %v", got)
+	}
+	first := getNotificationSeries(t, h, "?limit=1")
+	requireProblem(t, do(t, h, http.MethodGet, Prefix+"/notifications/series?limit=1&status=active&cursor="+url.QueryEscape(first.Page.NextCursor), "", profileOwner()), TypeInvalidCursor)
+}
+
+func TestNotificationSeriesSearchAndReasonFilter(t *testing.T) {
+	h, _ := notificationSeriesHandler(t)
+	for query, want := range map[string][]string{
+		"?q=BEAR":                        {"series:bear"},
+		"?q=+horses+":                    {"series:slow-horses"},
+		"?reason=watchlist":              {"series:slow-horses"},
+		"?reason=favorite":               {"series:bear", "series:wire"},
+		"?reason=favorite&status=active": {"series:bear"},
+		"?reason=next_up&status=active":  {"series:andor"},
+		"?q=zzz":                         {},
+	} {
+		if got := notificationSeriesIDs(getNotificationSeries(t, h, query).Items); !slices.Equal(got, want) {
+			t.Errorf("%s = %v, want %v", query, got, want)
+		}
+	}
+	requireProblem(t, do(t, h, http.MethodGet, Prefix+"/notifications/series?reason=other", "", profileOwner()), TypeValidationFailed)
+	requireProblem(t, do(t, h, http.MethodGet, Prefix+"/notifications/series?sort=rating", "", profileOwner()), TypeValidationFailed)
+}
+
+// Every sort orders its field with missing values last, then pages through
+// the same order.
+func TestNotificationSeriesSorts(t *testing.T) {
+	h, _ := notificationSeriesHandler(t)
+	for sort, want := range map[string][]string{
+		"-title":                {"series:wire", "series:slow-horses", "series:bear", "series:andor"},
+		"year":                  {"series:wire", "series:andor", "series:slow-horses", "series:bear"},
+		"-year":                 {"series:bear", "series:slow-horses", "series:andor", "series:wire"},
+		"-added_at":             {"series:wire", "series:slow-horses", "series:bear", "series:andor"},
+		"latest_episode_added":  {"series:slow-horses", "series:wire", "series:andor", "series:bear"},
+		"-latest_episode_added": {"series:bear", "series:andor", "series:wire", "series:slow-horses"},
+	} {
+		if got := notificationSeriesIDs(getNotificationSeries(t, h, "?sort="+sort).Items); !slices.Equal(got, want) {
+			t.Errorf("sort %s = %v, want %v", sort, got, want)
+		}
+		var paged []string
+		query := "?limit=1&sort=" + url.QueryEscape(sort)
+		for range 6 {
+			page := getNotificationSeries(t, h, query)
+			paged = append(paged, notificationSeriesIDs(page.Items)...)
+			if !page.Page.HasMore {
+				break
+			}
+			query = "?limit=1&sort=" + url.QueryEscape(sort) + "&cursor=" + url.QueryEscape(page.Page.NextCursor)
+		}
+		if !slices.Equal(paged, want) {
+			t.Errorf("sort %s paged = %v, want %v", sort, paged, want)
+		}
+	}
+	first := getNotificationSeries(t, h, "?limit=1&sort=-year")
+	for _, changed := range []string{"&sort=year", "&sort=-year&q=a", "&sort=-year&reason=favorite"} {
+		requireProblem(t, do(t, h, http.MethodGet, Prefix+"/notifications/series?limit=1"+changed+"&cursor="+url.QueryEscape(first.Page.NextCursor), "", profileOwner()), TypeInvalidCursor)
+	}
+}
+
+func TestNotificationSeriesCapabilityAndAvailability(t *testing.T) {
+	h, _ := notificationSeriesHandler(t)
+	rec := do(t, h, http.MethodGet, Prefix+"/notifications/capabilities", "", profileOwner())
+	var caps NotificationCapabilities
+	if err := json.Unmarshal(rec.Body.Bytes(), &caps); err != nil || !caps.Series.Available || !caps.Series.Mute {
+		t.Fatal(rec.Code, rec.Body.String(), err)
+	}
+
+	deps := pilotDeps(nil, nil)
+	deps.NotificationInbox = fixtureNotificationInbox()
+	deps.PersonalLists = nil
+	h = NewHandler(deps)
+	rec = do(t, h, http.MethodGet, Prefix+"/notifications/capabilities", "", profileOwner())
+	if err := json.Unmarshal(rec.Body.Bytes(), &caps); err != nil || caps.Series.Available || caps.Series.Mute {
+		t.Fatal(rec.Code, rec.Body.String(), err)
+	}
+	requireProblem(t, do(t, h, http.MethodGet, Prefix+"/notifications/series", "", profileOwner()), TypeDependencyUnavailable)
+	requireProblem(t, do(t, h, http.MethodPut, Prefix+"/notifications/series/series:bear/mute", "", profileOwner()), TypeDependencyUnavailable)
+}
+
+func notificationSeriesMuteHandler(t *testing.T) (http.Handler, *fakeNotificationInbox) {
+	t.Helper()
+	inbox := fixtureNotificationInbox()
+	deps := pilotDeps(nil, nil)
+	deps.NotificationInbox = inbox
+	deps.PersonalLists = &fakePersonalLists{missing: map[string]bool{"series:hidden": true}}
+	return NewHandler(deps), inbox
+}
+
+// Mute and unmute act as the acting profile on its account and are idempotent
+// writes.
+func TestNotificationSeriesMuteAndUnmute(t *testing.T) {
+	h, inbox := notificationSeriesMuteHandler(t)
+	for range 2 {
+		if rec := do(t, h, http.MethodPut, Prefix+"/notifications/series/series:bear/mute", "", profileOwner()); rec.Code != http.StatusNoContent {
+			t.Fatal(rec.Code, rec.Body.String())
+		}
+		if rec := do(t, h, http.MethodDelete, Prefix+"/notifications/series/series:wire/mute", "", profileOwner()); rec.Code != http.StatusNoContent {
+			t.Fatal(rec.Code, rec.Body.String())
+		}
+	}
+	if !slices.Equal(inbox.mutes, []string{"1/p-owner/series:bear", "1/p-owner/series:bear"}) || !slices.Equal(inbox.unmutes, []string{"1/p-owner/series:wire", "1/p-owner/series:wire"}) {
+		t.Fatalf("mutes = %v, unmutes = %v", inbox.mutes, inbox.unmutes)
+	}
+}
+
+// A series the viewer may not see and an item that is not a series are 404
+// on mute, and the hidden one is never written. Unmute runs no access check,
+// so a profile can lift a mute on a series it can no longer see.
+func TestNotificationSeriesMuteRefusals(t *testing.T) {
+	h, inbox := notificationSeriesMuteHandler(t)
+	requireProblem(t, do(t, h, http.MethodPut, Prefix+"/notifications/series/series:hidden/mute", "", profileOwner()), TypeNotFound)
+	requireProblem(t, do(t, h, http.MethodPut, Prefix+"/notifications/series/"+notificationNotASeriesID+"/mute", "", profileOwner()), TypeNotFound)
+	if len(inbox.mutes) != 0 {
+		t.Fatalf("mutes = %v", inbox.mutes)
+	}
+	if rec := do(t, h, http.MethodDelete, Prefix+"/notifications/series/series:hidden/mute", "", profileOwner()); rec.Code != http.StatusNoContent {
+		t.Fatal(rec.Code, rec.Body.String())
+	}
+	if !slices.Equal(inbox.unmutes, []string{"1/p-owner/series:hidden"}) {
+		t.Fatalf("unmutes = %v", inbox.unmutes)
+	}
+}
+
+func notificationSeriesFixtureCases() []fixtureCase {
+	return []fixtureCase{{name: "notification_list_notification_series", operationID: opListNotificationSeries, scenario: "Series that can notify the acting profile, with one the viewer may not see omitted.", method: http.MethodGet, path: "/api/v2/notifications/series", headers: profileOwner(), status: http.StatusOK, schema: "#/components/schemas/NotificationSeriesCollection", assertHeaders: []string{"Content-Type", "Cache-Control"}}}
+}
+
+// notificationSeriesMuteFixtureCases pin muting and unmuting one series and
+// the refusal of a series the viewer may not see.
+func notificationSeriesMuteFixtureCases() []fixtureCase {
+	problem := "#/components/schemas/Problem"
+	return []fixtureCase{
+		{name: "notification_mute_notification_series", operationID: opMuteNotificationSeries,
+			scenario: "The acting profile mutes one series: no new-episode notification for it on any channel until it unmutes. Repeating the call changes nothing.",
+			method:   http.MethodPut, path: "/api/v2/notifications/series/series:bear/mute", headers: profileOwner(),
+			status: http.StatusNoContent, assertHeaders: []string{"Cache-Control"}},
+		{name: "notification_mute_notification_series_not_found", operationID: opMuteNotificationSeries,
+			scenario: "A series the viewer may not see cannot be muted.",
+			method:   http.MethodPut, path: "/api/v2/notifications/series/series:hidden/mute", headers: profileOwner(),
+			status: http.StatusNotFound, assertHeaders: []string{"Content-Type", "Cache-Control"}, schema: problem},
+		{name: "notification_unmute_notification_series", operationID: opUnmuteNotificationSeries,
+			scenario: "The acting profile unmutes a series; it notifies again from the next new episode. Unmuting a series that is not muted changes nothing.",
+			method:   http.MethodDelete, path: "/api/v2/notifications/series/series:wire/mute", headers: profileOwner(),
+			status: http.StatusNoContent, assertHeaders: []string{"Cache-Control"}},
+	}
+}
+
+// Next Up waits for any episode past the last finished one; after a season
+// finale that is the next season's first, so the response names the finale.
+func TestNotificationSeriesNextUpNamesTheFinishedEpisode(t *testing.T) {
+	expected := notifications.EpisodeKey(1, 10) + 1
+	got := notificationSeriesOf(notifications.NotifiedSeries{Active: notifications.ReasonFlags{NextUp: true}, NextExpectedEpisodeKey: &expected}, CatalogItem{})
+	if got.NextUpAfter == nil || *got.NextUpAfter != (NotificationEpisodeRef{SeasonNumber: 1, EpisodeNumber: 10}) {
+		t.Fatalf("next_up_after = %+v, want S1E10", got.NextUpAfter)
+	}
+}
diff --git a/internal/apiv2/notification_webhook_update.go b/internal/apiv2/notification_webhook_update.go
index cc0b67334b..5da986262a 100644
--- a/internal/apiv2/notification_webhook_update.go
+++ b/internal/apiv2/notification_webhook_update.go
@@ -39,12 +39,16 @@ func registerNotificationWebhookUpdate(reg *Registry) {
 		if reg.deps.NotificationDestinations == nil {
 			return nil, unavailable("notification destinations")
 		}
-		row, err := reg.deps.NotificationDestinations.UpdateNotificationWebhook(ctx, profileFrom(ctx), in.ID, notifications.WebhookInput{
+		user, profile, p := viewerIdentity(ctx)
+		if p != nil {
+			return nil, p
+		}
+		row, err := reg.deps.NotificationDestinations.UpdateNotificationWebhook(ctx, user, profile, in.ID, notifications.WebhookInput{
 			Name: in.Body.Name, URL: in.Body.URL, Enabled: in.Body.Enabled,
 			NotifyFavorites: in.Body.NotifyFavorites, NotifyWatchlist: in.Body.NotifyWatchlist,
 			NotifyContinueWatching: in.Body.NotifyContinueWatching, NotifyNextUp: in.Body.NotifyNextUp, NotifyRequests: in.Body.NotifyRequests,
 		}, func(revision int64) error {
-			if p := EvaluateGuardedPreconditions(in.IfMatch, in.IfNoneMatch, notificationWebhookTag(profileFrom(ctx), in.ID, revision)); p != nil {
+			if p := EvaluateGuardedPreconditions(in.IfMatch, in.IfNoneMatch, notificationWebhookTag(profile, in.ID, revision)); p != nil {
 				return p
 			}
 			return nil
diff --git a/internal/apiv2/observe.go b/internal/apiv2/observe.go
index 0dfee897cf..aabe5304a5 100644
--- a/internal/apiv2/observe.go
+++ b/internal/apiv2/observe.go
@@ -20,9 +20,11 @@ import (
 	"go.opentelemetry.io/otel/codes"
 	"go.opentelemetry.io/otel/trace"
 
+	"github.com/prairie-server/prairie-server/internal/activitylog"
 	apimw "github.com/prairie-server/prairie-server/internal/api/middleware"
 	"github.com/prairie-server/prairie-server/internal/auth"
 	"github.com/prairie-server/prairie-server/internal/clientip"
+	"github.com/prairie-server/prairie-server/internal/database/queryattr"
 	"github.com/prairie-server/prairie-server/internal/httpstream"
 	"github.com/prairie-server/prairie-server/internal/telemetry"
 )
@@ -106,6 +108,7 @@ func RecordV1Tombstone(method string) { v1TombstoneRequests.WithLabelValues(meth
 // request moves through the router, and the observe middleware reports once
 // the response is written.
 type observation struct {
+	db          *queryattr.Request
 	operationID string
 	pathPattern string
 	errorCode   string
@@ -135,26 +138,36 @@ func observe(next http.Handler) http.Handler {
 			span.SetAttributes(attribute.String("http.request.method", methodLabel(r.Method)))
 		}
 		defer span.End()
+		ctx, db := queryattr.StartRequest(ctx)
 		r = r.WithContext(ctx)
-		o := &observation{operationID: labelNone, errorCode: labelNone, authClass: authClassAnonymous}
+		o := &observation{db: db, operationID: labelNone, errorCode: labelNone, authClass: authClassAnonymous}
 		o.clientName, o.clientVersion = clientIdentity(r)
 		r = r.WithContext(context.WithValue(r.Context(), observationKey{}, o))
 		sw := &statusRecorder{ResponseWriter: w}
 		next.ServeHTTP(sw, r)
+		status := sw.status
+		if activitylog.RecordedStatus(r, status, status != 0) == activitylog.StatusClientClosedRequest {
+			// The client went away, and its server error is recorded as
+			// abandoned, as the activity log records it as 499. The error is
+			// still written: net/http also cancels the context of a client
+			// that only half-closed, and an unwritten response would reach
+			// that client as an empty 200.
+			status = 0
+		}
 		if span.IsRecording() {
 			span.SetAttributes(attribute.String("operation", o.operationID), attribute.String("error.type", o.errorCode))
-			if sw.status != 0 {
-				span.SetAttributes(attribute.Int("http.response.status_code", sw.status))
+			if status != 0 {
+				span.SetAttributes(attribute.Int("http.response.status_code", status))
 			} else if sw.hijacked {
 				span.SetAttributes(attribute.String("http.response.outcome", "hijacked"))
 			} else {
 				span.SetAttributes(attribute.String("http.response.outcome", "abandoned"))
 			}
-			if sw.status >= 500 {
+			if status >= 500 {
 				span.SetStatus(codes.Error, "server_error")
 			}
 		}
-		report(r, o, sw.status, sw.hijacked, sw.bytes, time.Since(start))
+		report(r, o, status, sw.hijacked, sw.bytes, time.Since(start))
 	})
 }
 
@@ -266,6 +279,7 @@ func report(r *http.Request, o *observation, status int, hijacked bool, bodyByte
 	if o.userID != nil {
 		attrs = append(attrs, "user_id", *o.userID)
 	}
+	attrs = append(attrs, o.db.LogAttrs()...)
 	slog.InfoContext(r.Context(), "apiv2 request", attrs...)
 }
 
diff --git a/internal/apiv2/observe_attribution_test.go b/internal/apiv2/observe_attribution_test.go
new file mode 100644
index 0000000000..7d403ee7da
--- /dev/null
+++ b/internal/apiv2/observe_attribution_test.go
@@ -0,0 +1,39 @@
+package apiv2
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+
+	"github.com/prairie-server/prairie-server/internal/database/queryattr"
+)
+
+func TestObserveLogsDatabaseFields(t *testing.T) {
+	t.Setenv("PRAIRIE_QUERY_ATTRIBUTION_ENABLED", "true")
+	if !queryattr.Initialize() {
+		t.Fatal("query attribution is disabled")
+	}
+	logs := captureLogs(t)
+	router := chi.NewRouter()
+	router.Use(observe)
+	router.Get("/api/v2/items", func(w http.ResponseWriter, r *http.Request) {
+		op := queryattr.Begin(r.Context(), queryattr.KindQuery, "SELECT 1", nil, 1)
+		op.End(r.Context(), nil)
+		w.WriteHeader(http.StatusNoContent)
+	})
+	router.ServeHTTP(httptest.NewRecorder(), httptest.NewRequest(http.MethodGet, "/api/v2/items", nil))
+	var record map[string]any
+	if err := json.Unmarshal(logs.Bytes(), &record); err != nil {
+		t.Fatal(err)
+	}
+	if record["msg"] != "apiv2 request" || record["db_queries"] != float64(1) {
+		t.Errorf("request msg=%v db_queries=%v, want apiv2 request and 1", record["msg"], record["db_queries"])
+	}
+	if site, ok := record["db_slowest_site"].(string); !ok || !strings.HasPrefix(site, "apiv2.TestObserveLogsDatabaseFields.func1:") {
+		t.Errorf("db_slowest_site = %v, want routed handler site", record["db_slowest_site"])
+	}
+}
diff --git a/internal/apiv2/observe_test.go b/internal/apiv2/observe_test.go
index 5c142753fe..3a33093695 100644
--- a/internal/apiv2/observe_test.go
+++ b/internal/apiv2/observe_test.go
@@ -7,6 +7,7 @@ import (
 	"log/slog"
 	"net/http"
 	"net/http/httptest"
+	"os"
 	"strings"
 	"testing"
 	"testing/iotest"
@@ -207,15 +208,26 @@ func TestMethodLabelIsBounded(t *testing.T) {
 }
 
 // zeroCopyWriter stands in for net/http's response writer, whose ReadFrom is
-// the sendfile path, and records how many bytes arrived through it.
+// the sendfile path, and records how many bytes arrived through it. fromFile
+// counts the ones whose source sendfile could use: an *os.File, alone or under
+// one *io.LimitedReader.
 type zeroCopyWriter struct {
 	*httptest.ResponseRecorder
 	readFrom int64
+	fromFile int64
 }
 
 func (w *zeroCopyWriter) ReadFrom(src io.Reader) (int64, error) {
+	file := src
+	if limited, ok := src.(*io.LimitedReader); ok {
+		file = limited.R
+	}
+	_, isFile := file.(*os.File)
 	n, err := io.Copy(w.ResponseRecorder, src)
 	w.readFrom += n
+	if isFile {
+		w.fromFile += n
+	}
 	return n, err
 }
 
diff --git a/internal/apiv2/operational_discovery.go b/internal/apiv2/operational_discovery.go
index fa9418868b..17570b6588 100644
--- a/internal/apiv2/operational_discovery.go
+++ b/internal/apiv2/operational_discovery.go
@@ -26,6 +26,7 @@ type ImageCapabilities struct {
 	ExtendedItemArtwork    bool                       `json:"extended_item_artwork" doc:"Movie and series detail (getCatalogItem) may carry banner_url, thumb_url, clearart_url, disc_url and backdrop_urls, and widths lists banner, thumb, clearart and disc"`
 	SeasonListArtworkParam string                     `json:"season_list_artwork_param" doc:"Season-list boolean query parameter; false omits poster URLs and thumbhashes"`
 	Param                  string                     `json:"param"`
+	SlotWidthParams        map[string]string          `json:"slot_width_params" doc:"Per-slot width query parameters, keyed by slot: poster (poster_url), backdrop (backdrop_url, backdrop_urls), logo (logo_url), still (an episode's still_url), photo (cast and crew photo_url). Each takes the width in device pixels the client draws that field at and overrides param for it; the server returns the narrowest cached size at least that wide, else the original. Accepted wherever param is"`
 	Sizes                  []imagesize.Size           `json:"sizes"`
 	Widths                 map[string]ImageSizeWidths `json:"widths"`
 	OriginalMaxWidthPx     int                        `json:"original_max_width_px"`
@@ -33,6 +34,15 @@ type ImageCapabilities struct {
 	Delivery               string                     `json:"delivery" enum:"server,direct"`
 }
 
+// slotWidthParams names each ArtworkQuery slot width parameter by its slot.
+var slotWidthParams = func() map[string]string {
+	params := make(map[string]string, len(imagesize.Slots))
+	for _, slot := range imagesize.Slots {
+		params[slot.Name()] = slot.Name() + "_width"
+	}
+	return params
+}()
+
 // extendedItemArtworkTypes are the item artwork types beyond poster, backdrop
 // and logo that movie and series detail can carry.
 var extendedItemArtworkTypes = []string{artworkkey.ImageBanner, artworkkey.ImageThumb, artworkkey.ImageClearArt, artworkkey.ImageDisc}
@@ -69,6 +79,7 @@ func registerOperationalDiscovery(reg *Registry) {
 				EpisodeStillProvenance: true,
 				ExtendedItemArtwork:    true,
 				SeasonListArtworkParam: view.SeasonListArtworkParam,
+				SlotWidthParams:        slotWidthParams,
 				StorageBackend:         view.StorageBackend, Delivery: view.Delivery,
 				Capability: Capability{State: StateAvailable}, Param: view.Param, Sizes: view.Sizes, Widths: widths, OriginalMaxWidthPx: view.OriginalMaxWidthPx,
 			}}, nil
diff --git a/internal/apiv2/personal_collections.go b/internal/apiv2/personal_collections.go
index ba94e48295..db1723469b 100644
--- a/internal/apiv2/personal_collections.go
+++ b/internal/apiv2/personal_collections.go
@@ -28,7 +28,7 @@ type PersonalCollection struct {
 	CreatorProfileID           ID              `json:"creator_profile_id" example:"p-owner"`
 	Name                       string          `json:"name" example:"Rainy days"`
 	Description                string          `json:"description" example:""`
-	CollectionType             string          `json:"collection_type" doc:"manual, smart, or an import source (mdblist, tmdb, trakt)" example:"manual"`
+	CollectionType             string          `json:"collection_type" doc:"manual, smart, or an import source (mdblist, tmdb)" example:"manual"`
 	IsShared                   bool            `json:"is_shared" doc:"Every profile on the login sees the collection read-only, including profiles added later; otherwise only its creator does" example:"false"`
 	QueryDefinition            json.RawMessage `json:"query_definition" doc:"Smart-collection query document; {} for a manual collection"`
 	SortConfig                 json.RawMessage `json:"sort_config" doc:"Default sort document; {} when unset"`
@@ -150,8 +150,7 @@ type CollectionCapabilities struct {
 }
 
 // importableCollectionSources are the import sources a new collection can be
-// created from. Trakt is absent: existing Trakt collections still sync, but
-// new ones are refused.
+// created from.
 var importableCollectionSources = [...]string{importSourceMDBList, importSourceTMDB, importSourceTMDBList}
 
 // Import source names reported in import_sources.
@@ -296,18 +295,6 @@ type TMDBListCollectionImportInput struct {
 	Body TMDBListCollectionImport
 }
 
-// TraktCollectionImport is the importTraktCollection body.
-type TraktCollectionImport struct {
-	CollectionImportBase
-	Preset    string  `json:"preset" minLength:"1" doc:"A Trakt preset name" example:"trending"`
-	MediaType *string `json:"media_type,omitempty" nullable:"false" doc:"movie or show; the preset's default when omitted" example:"movie"`
-}
-
-// TraktCollectionImportInput is the importTraktCollection request.
-type TraktCollectionImportInput struct {
-	Body TraktCollectionImport
-}
-
 // CollectionSyncResult is one sync run's outcome.
 type CollectionSyncResult struct {
 	Status         string  `json:"status" doc:"success, partial or failed" example:"success"`
@@ -384,7 +371,6 @@ type CollectionImportService interface {
 	ImportMDBList(ctx context.Context, userID int, profileID string, req handlers.UserImportMDBListRequest) (handlers.UserImportView, error)
 	ImportTMDB(ctx context.Context, userID int, profileID string, req handlers.UserImportTMDBRequest) (handlers.UserImportView, error)
 	ImportTMDBList(ctx context.Context, userID int, profileID string, req handlers.UserImportTMDBListRequest) (handlers.UserImportView, error)
-	ImportTrakt(ctx context.Context, userID int, profileID string, req handlers.UserImportTraktRequest) (handlers.UserImportView, error)
 	SearchMDBList(ctx context.Context, query string) (handlers.MDBListDiscoveryView, error)
 	TopMDBList(ctx context.Context) (handlers.MDBListDiscoveryView, error)
 	MDBListConfigured() bool
@@ -469,8 +455,6 @@ func registerPersonalCollections(reg *Registry) {
 		"Import a TMDB preset as a synced collection.")), reg.importTMDBCollection)
 	Register(reg, write(importOp("/collections/import/tmdb-list", "importTMDBListCollection",
 		"Import a public TMDB list as a synced collection.")), reg.importTMDBListCollection)
-	Register(reg, write(importOp("/collections/import/trakt", "importTraktCollection",
-		"Import a Trakt preset as a synced collection.")), reg.importTraktCollection)
 
 	Register(reg, read(humaOp(http.MethodGet, Prefix+"/collections/import/mdblist/search", "searchMDBListLists", "collections",
 		"Search MDBList for lists to import.")), reg.searchMDBListLists)
@@ -898,30 +882,6 @@ func (reg *Registry) importTMDBListCollection(ctx context.Context, in *TMDBListC
 	return importOutput(view), nil
 }
 
-func (reg *Registry) importTraktCollection(ctx context.Context, in *TraktCollectionImportInput) (*CollectionImportOutput, error) {
-	svc, p := reg.collectionImports()
-	if p != nil {
-		return nil, p
-	}
-	userID, p := actingUserID(ctx)
-	if p != nil {
-		return nil, p
-	}
-	shared, p := importSharedFields(in.Body.CollectionImportBase)
-	if p != nil {
-		return nil, p
-	}
-	req := handlers.UserImportTraktRequest{UserImportSharedFields: shared, Preset: in.Body.Preset}
-	if in.Body.MediaType != nil {
-		req.MediaType = *in.Body.MediaType
-	}
-	view, err := svc.ImportTrakt(ctx, userID, profileFrom(ctx), req)
-	if err != nil {
-		return nil, collectionProblem(err)
-	}
-	return importOutput(view), nil
-}
-
 func mdblistDiscoveryOf(v handlers.MDBListDiscoveryView) *MDBListListCollectionOutput {
 	items := make([]MDBListList, 0, len(v.Lists))
 	for _, l := range v.Lists {
diff --git a/internal/apiv2/personal_collections_test.go b/internal/apiv2/personal_collections_test.go
index 8a1800df15..0f236829d3 100644
--- a/internal/apiv2/personal_collections_test.go
+++ b/internal/apiv2/personal_collections_test.go
@@ -122,7 +122,6 @@ type fakeCollectionImports struct {
 	lastMDB    handlers.UserImportMDBListRequest
 	lastTMDB   handlers.UserImportTMDBRequest
 	lastList   handlers.UserImportTMDBListRequest
-	lastTrakt  handlers.UserImportTraktRequest
 	lastQuery  string
 }
 
@@ -156,11 +155,6 @@ func (f *fakeCollectionImports) ImportTMDBList(_ context.Context, _ int, _ strin
 	return f.view()
 }
 
-func (f *fakeCollectionImports) ImportTrakt(_ context.Context, _ int, _ string, req handlers.UserImportTraktRequest) (handlers.UserImportView, error) {
-	f.lastTrakt = req
-	return f.view()
-}
-
 func (f *fakeCollectionImports) SearchMDBList(_ context.Context, q string) (handlers.MDBListDiscoveryView, error) {
 	f.lastQuery = q
 	if f.err != nil {
@@ -406,20 +400,16 @@ func TestImportCollections(t *testing.T) {
 		t.Fatalf("%d %+v", rec.Code, ci.lastList)
 	}
 	requireProblem(t, do(t, h, http.MethodPost, "/api/v2/collections/import/tmdb-list", `{"title":"My list"}`, viewerHeaders()), TypeValidationFailed)
-	rec = do(t, h, http.MethodPost, "/api/v2/collections/import/trakt", `{"title":"Trending","preset":"trending"}`, viewerHeaders())
-	if rec.Code != 201 || ci.lastTrakt.Preset != "trending" || ci.lastTrakt.MediaType != "" {
-		t.Fatalf("%d %+v", rec.Code, ci.lastTrakt)
-	}
 	// The seam's field error, the class, demo mode, and an unwired service.
 	deps.CollectionImports = &fakeCollectionImports{err: &handlers.APIError{Status: 400, Code: "bad_request", Message: "url must be an MDBList list", Field: "url"}}
 	p = requireProblem(t, do(t, newTestHandler(t, deps), http.MethodPost, "/api/v2/collections/import/mdblist", `{"title":"Top","url":"u"}`, viewerHeaders()), TypeValidationFailed)
 	if len(p.Errors) != 1 || p.Errors[0].Location != "body.url" {
 		t.Fatalf("errors = %+v", p.Errors)
 	}
-	requireProblem(t, do(t, h, http.MethodPost, "/api/v2/collections/import/trakt", `{"title":"x","preset":"trending"}`, bearer(memberToken)), TypeValidationFailed)
+	requireProblem(t, do(t, h, http.MethodPost, "/api/v2/collections/import/tmdb", `{"title":"x","preset":"trending"}`, bearer(memberToken)), TypeValidationFailed)
 	demo := deps
 	demo.DemoSettings = fakeSettings{demo: true}
-	requireProblem(t, do(t, newTestHandler(t, demo), http.MethodPost, "/api/v2/collections/import/trakt", `{"title":"x","preset":"trending"}`, viewerHeaders()), TypePermissionDenied)
+	requireProblem(t, do(t, newTestHandler(t, demo), http.MethodPost, "/api/v2/collections/import/tmdb", `{"title":"x","preset":"trending"}`, viewerHeaders()), TypePermissionDenied)
 	deps.CollectionImports = nil
 	requireProblem(t, do(t, newTestHandler(t, deps), http.MethodPost, "/api/v2/collections/import/tmdb", `{"title":"x","preset":"trending"}`, viewerHeaders()), TypeDependencyUnavailable)
 }
diff --git a/internal/apiv2/pilot_fakes_test.go b/internal/apiv2/pilot_fakes_test.go
index dad55f040c..c5d9c1e3af 100644
--- a/internal/apiv2/pilot_fakes_test.go
+++ b/internal/apiv2/pilot_fakes_test.go
@@ -481,10 +481,10 @@ func pilotDeps(progress *fakeProgress, profiles *fakeProfiles) Dependencies {
 	deps.AdminUsers = fakeAdminUsers{users: []handlers.AdminUserView{
 		{ID: 1, Username: "laura", Email: "laura@example.test", Role: "user", Permissions: []string{}, Enabled: true,
 			MaxStreams: &two, DownloadAllowed: &yes, MaxProfiles: 5, AccessGroupID: &groupID,
-			EffectivePolicy: handlers.EffectivePolicyView{LibraryIDs: []int{3}, MaxPlaybackQuality: "1080p", MaxStreams: 2, TranscodeAllowed: true, Permissions: []string{}},
+			EffectivePolicy: handlers.EffectivePolicyView{LibraryIDs: []int{3}, MaxPlaybackQuality: "1080p", MaxStreams: 2, MaxProfiles: 5, TranscodeAllowed: true, Permissions: []string{}},
 			CreatedAt:       fixedTime(), UpdatedAt: fixedTime(), LastActiveAt: &last},
 		{ID: 2, Username: "ada", Role: "admin", Permissions: []string{"marker_edit"}, Enabled: true, LibraryIDs: []int{}, MaxProfiles: 5,
-			EffectivePolicy: handlers.EffectivePolicyView{Permissions: []string{"marker_edit", "metadata_curation"}},
+			EffectivePolicy: handlers.EffectivePolicyView{MaxProfiles: 5, Permissions: []string{"marker_edit", "metadata_curation"}},
 			CreatedAt:       fixedTime(), UpdatedAt: fixedTime()},
 	}}
 	deps.SettingsContract, deps.Settings, deps.PluginSettings, deps.SettingValues = settingsFakes()
diff --git a/internal/apiv2/playback.go b/internal/apiv2/playback.go
index 0c94171ae4..ea69521eb5 100644
--- a/internal/apiv2/playback.go
+++ b/internal/apiv2/playback.go
@@ -53,7 +53,7 @@ type PlaybackStartBody struct {
 	FileID                     ID                                 `json:"file_id"`
 	ProfileID                  ID                                 `json:"profile_id"`
 	PlaybackAttemptID          string                             `json:"playback_attempt_id"`
-	QualityPreference          string                             `json:"quality_preference"`
+	QualityPreference          string                             `json:"quality_preference" doc:"auto (the default), a resolution such as 1080p, or a rung label from available_qualities. auto plays the source unless the device cannot, a measured bandwidth_estimate_kbps cannot carry it, or it is above bandwidth_cap_kbps. original is a deprecated alias of auto."`
 	AllowAlternateVersions     *bool                              `json:"allow_alternate_versions,omitempty" nullable:"false" doc:"False keeps the requested source file for this attempt, including quality changes and failure recovery. Omitted or true allows alternate versions."`
 	SubtitleFidelityPreference playback.SubtitleFidelityV3        `json:"subtitle_fidelity_preference"`
 	StartPosition              *float64                           `json:"start_position,omitempty" nullable:"false"`
@@ -62,8 +62,8 @@ type PlaybackStartBody struct {
 	AudioTrackIndex            *int                               `json:"audio_track_index,omitempty" nullable:"false"`
 	SubtitleTrackID            string                             `json:"subtitle_track_id,omitempty"`
 	SubtitleTrackIndex         *int                               `json:"subtitle_track_index,omitempty" nullable:"false"`
-	Metered                    bool                               `json:"metered"`
-	BandwidthEstimateKbps      *int                               `json:"bandwidth_estimate_kbps,omitempty" nullable:"false"`
+	Metered                    bool                               `json:"metered,omitempty" doc:"Deprecated; ignored. A client on a metered link sends its cellular quality as quality_preference and bandwidth_cap_kbps instead." deprecated:"true"`
+	BandwidthEstimateKbps      *int                               `json:"bandwidth_estimate_kbps,omitempty" nullable:"false" doc:"Measured throughput to this server, such as a bandwidth probe result. auto sends a source whose bitrate fits 80% of it as-is and lowers only one that does not. Omit it rather than send a guess."`
 	BandwidthCapKbps           *int                               `json:"bandwidth_cap_kbps,omitempty" nullable:"false"`
 	Capabilities               playback.ClientCodecCapabilitiesV3 `json:"client_capabilities"`
 	ClientPlaybackContext      playback.ClientPlaybackContextV3   `json:"client_playback_context"`
@@ -84,7 +84,7 @@ type PlaybackPlan struct {
 	Transformations        []playback.TransformationV3     `json:"transformations"`
 	AppliedQuirks          []playback.AppliedQuirkV3       `json:"applied_quirks"`
 	RuntimeCorrections     []string                        `json:"runtime_corrections"`
-	AvailableQualities     []playback.AvailableQualityV3   `json:"available_qualities"`
+	AvailableQualities     []playback.AvailableQualityV3   `json:"available_qualities" doc:"Fixed quality rungs a quality_change replan may request, in menu order. The source is not listed: quality_preference auto returns to it. Empty when no rung applies."`
 	DegradationWarnings    []playback.DegradationWarningV3 `json:"degradation_warnings"`
 	DecisionReason         string                          `json:"decision_reason"`
 	RequestedMediaFileID   ID                              `json:"requested_media_file_id"`
@@ -238,10 +238,10 @@ type PlaybackReplanBody struct {
 	AttemptedPlanKeys     []string                           `json:"attempted_plan_keys" maxItems:"16"`
 	LocalMutations        []string                           `json:"local_mutations,omitempty" maxItems:"8"`
 	AttemptCount          int                                `json:"attempt_count" minimum:"1" maximum:"8"`
-	QualityPreference     string                             `json:"quality_preference"`
+	QualityPreference     string                             `json:"quality_preference" doc:"auto (the default), a resolution such as 1080p, or a rung label from available_qualities. auto plays the source unless the device cannot, a measured bandwidth_estimate_kbps cannot carry it, or it is above bandwidth_cap_kbps. original is a deprecated alias of auto."`
 	PositionSeconds       float64                            `json:"position_seconds" minimum:"0"`
-	Metered               bool                               `json:"metered"`
-	BandwidthEstimateKbps *int                               `json:"bandwidth_estimate_kbps,omitempty" nullable:"false"`
+	Metered               bool                               `json:"metered,omitempty" doc:"Deprecated; ignored. A client on a metered link sends its cellular quality as quality_preference and bandwidth_cap_kbps instead." deprecated:"true"`
+	BandwidthEstimateKbps *int                               `json:"bandwidth_estimate_kbps,omitempty" nullable:"false" doc:"Measured throughput to this server, such as a bandwidth probe result. auto sends a source whose bitrate fits 80% of it as-is and lowers only one that does not. Omit it rather than send a guess."`
 	BandwidthCapKbps      *int                               `json:"bandwidth_cap_kbps,omitempty" nullable:"false"`
 	SelectedTracks        playback.SelectedTracksV3          `json:"selected_tracks"`
 	Failure               playback.FailureV3                 `json:"failure,omitzero"`
@@ -501,20 +501,14 @@ func playbackDecision(in playback.DecisionResponseV3) PlaybackDecision {
 	return out
 }
 
-// sourceQualityDisplayName is the v2 display name of the source quality entry.
-const sourceQualityDisplayName = "Original"
-
-// playbackQualities names the source entry "Original" on v2, so clients that
-// show display_name do not fall back to the wire label "original". The shared
-// plan keeps it unnamed: v1 serializes that plan and is frozen.
+// playbackQualities drops the source entry from the v2 menu: auto already
+// plays the source whenever the device can, so a separate Original choice
+// only duplicated it. The shared plan keeps the entry because v1 serializes
+// that plan and is frozen.
 func playbackQualities(in []playback.AvailableQualityV3) []playback.AvailableQualityV3 {
-	out := slices.Clone(in)
-	for i := range out {
-		if out[i].PreservesSource && out[i].DisplayName == "" {
-			out[i].DisplayName = sourceQualityDisplayName
-		}
-	}
-	return out
+	return slices.DeleteFunc(slices.Clone(in), func(quality playback.AvailableQualityV3) bool {
+		return quality.Label == playback.QualityOriginalV3
+	})
 }
 func playbackSource(in playback.SourceDescriptorV3) PlaybackSource {
 	return PlaybackSource{MediaFileID: ID(strconv.Itoa(in.MediaFileID)), DurationSeconds: in.DurationSeconds, Container: in.Container, VideoCodec: in.VideoCodec, VideoProfile: in.VideoProfile, VideoLevel: in.VideoLevel, BitDepth: in.BitDepth, ColorRange: in.ColorRange, Width: in.Width, Height: in.Height, FrameRate: in.FrameRate, BitrateKbps: in.BitrateKbps, DynamicRange: in.DynamicRange, HDR10Plus: in.HDR10Plus, DVProfile: in.DVProfile, DVLevel: in.DVLevel, DVBLCompatID: in.DVBLCompatID, DVBaseLayerProven: in.DVBaseLayerProven, DVEnhancementLayer: in.DVEnhancementLayer, AudioCodec: in.AudioCodec, AudioChannels: in.AudioChannels, AudioLayout: in.AudioLayout, VideoCopyUnsafe: in.VideoCopyUnsafe}
diff --git a/internal/apiv2/playback_bandwidth_probe.go b/internal/apiv2/playback_bandwidth_probe.go
new file mode 100644
index 0000000000..988d57c3b2
--- /dev/null
+++ b/internal/apiv2/playback_bandwidth_probe.go
@@ -0,0 +1,183 @@
+package apiv2
+
+import (
+	"io"
+	"net/http"
+	"reflect"
+	"strconv"
+	"sync"
+	"time"
+
+	"github.com/danielgtaylor/huma/v2"
+
+	"github.com/prairie-server/prairie-server/internal/bandwidthprobe"
+	"github.com/prairie-server/prairie-server/internal/streamtelemetry"
+)
+
+const (
+	opGetPlaybackBandwidthProbe = "getPlaybackBandwidthProbe"
+	bandwidthProbeSizeParam     = "size"
+	bandwidthProbeDefaultSize   = 1_000_000
+	// bandwidthProbeMaxInFlight bounds the probes one account can run at once
+	// on this server. A client needs one at a time; the request rate limiter
+	// counts requests, not the bytes each one streams.
+	bandwidthProbeMaxInFlight = 2
+	// bandwidthProbeWindowBytes bounds the probe bytes one account may draw
+	// from this server per bandwidthProbeWindow. The web client sends at most
+	// 40 MB about every 30 minutes, so the budget only stops an account that
+	// probes back to back.
+	bandwidthProbeWindowBytes = 400_000_000
+	bandwidthProbeWindow      = 10 * time.Minute
+	// bandwidthProbeNodeMaxInFlight bounds probes on this server across all
+	// accounts, so many viewers signing in together cannot tie up its CPU and
+	// egress with probes. A refused client tries again a few minutes later.
+	bandwidthProbeNodeMaxInFlight = 32
+	bandwidthProbeNodeRetryAfter  = 30 * time.Second
+)
+
+// bandwidthProbeLimiter bounds probes on this server: how many run at once
+// overall and per account, and how many bytes each account's probes send per
+// window. It is per node on purpose; what it protects (sockets, goroutines,
+// the random-byte work) is per node too.
+type bandwidthProbeLimiter struct {
+	mu       sync.Mutex
+	accounts map[int]*bandwidthProbeAccount
+	// inFlight counts probes running on this server across all accounts.
+	inFlight int
+}
+
+type bandwidthProbeAccount struct {
+	inFlight    int
+	windowStart time.Time
+	// windowBytes is what the window has granted: sizes reserved by running
+	// probes plus bytes finished probes actually sent.
+	windowBytes int
+}
+
+// acquire reserves a probe slot and size bytes of the account's window. It
+// returns the window the reservation belongs to, for release, or how long to
+// wait before retrying when the account is over either limit.
+func (l *bandwidthProbeLimiter) acquire(userID, size int, now time.Time) (bool, time.Time, time.Duration) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	// Forget accounts with nothing running whose window has passed. Probes are
+	// rare (one per client about every 30 minutes), so a sweep per admission
+	// is cheap and keeps the map to the accounts probing now.
+	for id, idle := range l.accounts {
+		if idle.inFlight <= 0 && now.Sub(idle.windowStart) >= bandwidthProbeWindow {
+			delete(l.accounts, id)
+		}
+	}
+	account := l.accounts[userID]
+	if account == nil {
+		account = &bandwidthProbeAccount{windowStart: now}
+		l.accounts[userID] = account
+	}
+	if now.Sub(account.windowStart) >= bandwidthProbeWindow {
+		account.windowStart, account.windowBytes = now, 0
+	}
+	if l.inFlight >= bandwidthProbeNodeMaxInFlight {
+		return false, time.Time{}, bandwidthProbeNodeRetryAfter
+	}
+	if account.inFlight >= bandwidthProbeMaxInFlight {
+		return false, time.Time{}, 5 * time.Second
+	}
+	if account.windowBytes+size > bandwidthProbeWindowBytes {
+		return false, time.Time{}, account.windowStart.Add(bandwidthProbeWindow).Sub(now)
+	}
+	l.inFlight++
+	account.inFlight++
+	account.windowBytes += size
+	return true, account.windowStart, 0
+}
+
+// release frees the slot and refunds the bytes a probe reserved but did not
+// send, as when the client closed the connection once it had timed enough.
+// The refund only goes back to the window that granted it; a later window
+// never held the reservation.
+func (l *bandwidthProbeLimiter) release(userID, unsent int, granted, now time.Time) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	l.inFlight--
+	account := l.accounts[userID]
+	if account == nil {
+		return
+	}
+	account.inFlight--
+	if account.windowStart.Equal(granted) {
+		account.windowBytes = max(0, account.windowBytes-unsent)
+	}
+	if account.inFlight <= 0 && now.Sub(account.windowStart) >= bandwidthProbeWindow {
+		delete(l.accounts, userID)
+	}
+}
+
+// countingWriter counts the bytes written through it.
+type countingWriter struct {
+	w io.Writer
+	n int
+}
+
+func (c *countingWriter) Write(p []byte) (int, error) {
+	n, err := c.w.Write(p)
+	c.n += n
+	return n, err
+}
+
+// registerPlaybackBandwidthProbe serves random bytes a client times to
+// estimate its throughput to this server for bandwidth_estimate_kbps.
+// Browsers cap their own downlink hint (Chromium reports at most 10 Mbps), so
+// a client that wants Auto quality to pick 4K has to measure.
+func registerPlaybackBandwidthProbe(reg *Registry) {
+	params := []*huma.Param{{
+		Name: bandwidthProbeSizeParam, In: playbackParamQuery,
+		Description: "Number of bytes to send. A client may close the connection early once it has timed enough of the transfer.",
+		Schema:      &huma.Schema{Type: huma.TypeInteger, Format: playbackIntegerFormat, Minimum: new(float64(1)), Maximum: new(float64(bandwidthprobe.MaxSize)), Default: bandwidthProbeDefaultSize},
+	}}
+	headers := map[string]*huma.Param{playbackContentLength: {Schema: &huma.Schema{Type: huma.TypeInteger, Format: playbackIntegerFormat}}, playbackCacheControlHeader: {Schema: &huma.Schema{Type: huma.TypeString}}}
+	responses := map[string]*huma.Response{
+		"200": {Description: "Random bytes", Content: map[string]*huma.MediaType{playbackMediaBinary: {Schema: &huma.Schema{Type: huma.TypeString, Format: playbackBinaryFormat}}}, Headers: headers},
+		"422": {Description: http.StatusText(http.StatusUnprocessableEntity), Content: map[string]*huma.MediaType{problemContentType: {Schema: reg.api.OpenAPI().Components.Schemas.Schema(reflect.TypeFor[Problem](), true, "")}}},
+	}
+	op := humaOp(http.MethodGet, Prefix+"/playback/bandwidth-probe", opGetPlaybackBandwidthProbe, playbackTag,
+		"Download random bytes to measure throughput to this server. Clients time the transfer and send the result as bandwidth_estimate_kbps; the bytes count as transfer egress, not playback. A server runs at most 32 probes at once; an account may run two of them and draw up to 400 MB per 10 minutes. Beyond any limit the request gets 429 with Retry-After.")
+	op.Parameters = params
+	op.Responses = responses
+	raw := RawOperation{Operation: Operation{Operation: op, Class: ClassAuthenticated}, Protocol: "bandwidth-probe",
+		Reason: "A throughput measurement needs an unbuffered, uncompressible byte stream the client can time and abandon mid-transfer."}
+	limiter := &bandwidthProbeLimiter{accounts: map[int]*bandwidthProbeAccount{}}
+	var handler http.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		size := bandwidthProbeDefaultSize
+		if value := r.URL.Query().Get(bandwidthProbeSizeParam); value != "" {
+			parsed, err := strconv.Atoi(value)
+			if err != nil || parsed < 1 || parsed > bandwidthprobe.MaxSize {
+				writeProblem(w, r, validationProblem("query.size", codeInvalid, "Expected an integer from 1 to "+strconv.Itoa(bandwidthprobe.MaxSize)+"."))
+				return
+			}
+			size = parsed
+		}
+		claims := claimsFrom(r.Context())
+		if claims == nil {
+			writeProblem(w, r, NewProblem(TypeAuthenticationRequired, "Authentication is required."))
+			return
+		}
+		admitted, window, wait := limiter.acquire(claims.UserID, size, time.Now())
+		if !admitted {
+			writeProblem(w, r, NewProblem(TypeRateLimited, "This account has reached its bandwidth probe limit on this server.").WithRetryAfter(max(1, int(wait.Round(time.Second)/time.Second))))
+			return
+		}
+		sent := &countingWriter{w: w}
+		defer func() { limiter.release(claims.UserID, size-sent.n, window, time.Now()) }()
+		streamtelemetry.Attach(r.Context(), streamtelemetry.Attachment{Subject: streamtelemetry.UserSubject(claims.UserID),
+			StartedAtSource: streamtelemetry.StartedAtSourceFirstSeen, TokenIssuedAtSource: streamtelemetry.TokenIssuedAtSourceNone})
+		w.Header().Set("Content-Type", playbackMediaBinary)
+		w.Header().Set(playbackContentLength, strconv.Itoa(size))
+		w.Header().Set(playbackCacheControlHeader, "no-store")
+		w.WriteHeader(http.StatusOK)
+		_ = bandwidthprobe.Write(sent, size)
+	})
+	if reg.deps.ObserveBandwidthProbe != nil {
+		handler = reg.deps.ObserveBandwidthProbe(handler)
+	}
+	RegisterRaw(reg, raw, handler)
+}
diff --git a/internal/apiv2/playback_bandwidth_probe_test.go b/internal/apiv2/playback_bandwidth_probe_test.go
new file mode 100644
index 0000000000..2ac3007f6c
--- /dev/null
+++ b/internal/apiv2/playback_bandwidth_probe_test.go
@@ -0,0 +1,163 @@
+package apiv2
+
+import (
+	"net/http"
+	"testing"
+	"time"
+)
+
+func TestBandwidthProbeLimiterBoundsInFlightProbesPerAccount(t *testing.T) {
+	limiter := &bandwidthProbeLimiter{accounts: map[int]*bandwidthProbeAccount{}}
+	now := time.Unix(1_000_000, 0)
+	for range bandwidthProbeMaxInFlight {
+		if ok, _, _ := limiter.acquire(1, 1000, now); !ok {
+			t.Fatal("refused a probe under the limit")
+		}
+	}
+	if ok, _, _ := limiter.acquire(1, 1000, now); ok {
+		t.Fatal("admitted a probe over the limit")
+	}
+	if ok, _, _ := limiter.acquire(2, 1000, now); !ok {
+		t.Fatal("one account's probes blocked another account")
+	}
+	limiter.release(1, 0, now, now)
+	if ok, _, _ := limiter.acquire(1, 1000, now); !ok {
+		t.Fatal("a finished probe did not free its slot")
+	}
+}
+
+func TestBandwidthProbeLimiterBoundsProbesPerNode(t *testing.T) {
+	limiter := &bandwidthProbeLimiter{accounts: map[int]*bandwidthProbeAccount{}}
+	now := time.Unix(1_000_000, 0)
+	for id := range bandwidthProbeNodeMaxInFlight {
+		if ok, _, _ := limiter.acquire(id, 1000, now); !ok {
+			t.Fatalf("refused account %d under the node limit", id)
+		}
+	}
+	ok, _, wait := limiter.acquire(bandwidthProbeNodeMaxInFlight, 1000, now)
+	if ok || wait != bandwidthProbeNodeRetryAfter {
+		t.Fatalf("admitted=%v wait=%v past the node limit", ok, wait)
+	}
+	limiter.release(0, 0, now, now)
+	if ok, _, _ := limiter.acquire(bandwidthProbeNodeMaxInFlight, 1000, now); !ok {
+		t.Fatal("a finished probe did not free a node slot")
+	}
+}
+
+func TestBandwidthProbeLimiterBoundsBytesPerWindow(t *testing.T) {
+	limiter := &bandwidthProbeLimiter{accounts: map[int]*bandwidthProbeAccount{}}
+	now := time.Unix(1_000_000, 0)
+	const size = 100_000_000
+	for i := range bandwidthProbeWindowBytes / size {
+		ok, window, _ := limiter.acquire(1, size, now)
+		if !ok {
+			t.Fatalf("refused probe %d inside the budget", i)
+		}
+		limiter.release(1, 0, window, now)
+	}
+	ok, _, wait := limiter.acquire(1, size, now.Add(time.Minute))
+	if ok {
+		t.Fatal("admitted a probe past the byte budget")
+	}
+	if wait != bandwidthProbeWindow-time.Minute {
+		t.Fatalf("retry after %v, want the rest of the window", wait)
+	}
+	if ok, _, _ := limiter.acquire(1, size, now.Add(bandwidthProbeWindow)); !ok {
+		t.Fatal("a new window did not restore the budget")
+	}
+}
+
+func TestBandwidthProbeLimiterRefundsUnsentBytes(t *testing.T) {
+	limiter := &bandwidthProbeLimiter{accounts: map[int]*bandwidthProbeAccount{}}
+	now := time.Unix(1_000_000, 0)
+	for range 50 {
+		ok, window, _ := limiter.acquire(1, 40_000_000, now)
+		if !ok {
+			t.Fatal("refused a probe the client cut short")
+		}
+		// The client closed the connection after 2 MB.
+		limiter.release(1, 38_000_000, window, now)
+	}
+}
+
+func TestBandwidthProbeLimiterRefundsOnlyTheGrantingWindow(t *testing.T) {
+	limiter := &bandwidthProbeLimiter{accounts: map[int]*bandwidthProbeAccount{}}
+	now := time.Unix(1_000_000, 0)
+	_, first, _ := limiter.acquire(1, 100_000_000, now)
+	// The window rolls over while the first probe runs, and the new window
+	// fills up.
+	later := now.Add(bandwidthProbeWindow)
+	for range bandwidthProbeWindowBytes / 100_000_000 {
+		if ok, _, _ := limiter.acquire(1, 100_000_000, later); !ok {
+			t.Fatal("refused a probe inside the new window's budget")
+		}
+		limiter.release(1, 0, later, later)
+	}
+	// The first probe ends early; its refund must not reopen the new window.
+	limiter.release(1, 90_000_000, first, later)
+	if ok, _, _ := limiter.acquire(1, 1000, later); ok {
+		t.Fatal("a refund from an earlier window reopened the current one")
+	}
+}
+
+func TestBandwidthProbeLimiterForgetsIdleAccounts(t *testing.T) {
+	limiter := &bandwidthProbeLimiter{accounts: map[int]*bandwidthProbeAccount{}}
+	now := time.Unix(1_000_000, 0)
+	_, window, _ := limiter.acquire(1, 1000, now)
+	limiter.release(1, 0, window, now.Add(bandwidthProbeWindow))
+	if len(limiter.accounts) != 0 {
+		t.Fatalf("idle account still tracked: %v", limiter.accounts)
+	}
+
+	// A probe that finishes inside its window is swept by a later admission.
+	_, window, _ = limiter.acquire(2, 1000, now)
+	limiter.release(2, 0, window, now)
+	limiter.acquire(3, 1000, now.Add(bandwidthProbeWindow))
+	if _, tracked := limiter.accounts[2]; tracked {
+		t.Fatal("account whose window passed is still tracked")
+	}
+	if _, tracked := limiter.accounts[3]; !tracked {
+		t.Fatal("the admitted account is not tracked")
+	}
+}
+
+func TestPlaybackBandwidthProbe(t *testing.T) {
+	handler := NewHandler(parityDeps(false))
+	path := Prefix + "/playback/bandwidth-probe"
+
+	t.Run("requires authentication", func(t *testing.T) {
+		response := do(t, handler, http.MethodGet, path, "", nil)
+		if response.Code != http.StatusUnauthorized {
+			t.Fatalf("status %d, want 401", response.Code)
+		}
+	})
+
+	t.Run("sends the requested byte count uncached", func(t *testing.T) {
+		response := do(t, handler, http.MethodGet, path+"?size=70000", "", bearer(memberToken))
+		if response.Code != http.StatusOK {
+			t.Fatalf("status %d: %s", response.Code, response.Body.String())
+		}
+		if got := response.Body.Len(); got != 70000 {
+			t.Fatalf("body %d bytes, want 70000", got)
+		}
+		if got := response.Header().Get("Content-Length"); got != "70000" {
+			t.Fatalf("Content-Length %q", got)
+		}
+		if got := response.Header().Get("Cache-Control"); got != "no-store" {
+			t.Fatalf("Cache-Control %q, want no-store", got)
+		}
+	})
+
+	t.Run("defaults the size", func(t *testing.T) {
+		response := do(t, handler, http.MethodGet, path, "", bearer(memberToken))
+		if response.Code != http.StatusOK || response.Body.Len() != bandwidthProbeDefaultSize {
+			t.Fatalf("status %d, %d bytes", response.Code, response.Body.Len())
+		}
+	})
+
+	for _, size := range []string{"0", "-1", "abc", "100000001"} {
+		t.Run("rejects size "+size, func(t *testing.T) {
+			requireProblem(t, do(t, handler, http.MethodGet, path+"?size="+size, "", bearer(memberToken)), TypeValidationFailed)
+		})
+	}
+}
diff --git a/internal/apiv2/playback_delivery.go b/internal/apiv2/playback_delivery.go
index bf2604cba4..ad7d33238c 100644
--- a/internal/apiv2/playback_delivery.go
+++ b/internal/apiv2/playback_delivery.go
@@ -3,6 +3,7 @@ package apiv2
 import (
 	"context"
 	"errors"
+	"io"
 	"net/http"
 	"net/url"
 	"reflect"
@@ -97,7 +98,7 @@ func registerPlaybackDelivery(reg *Registry) {
 		{http.MethodGet, "/stream/{session_id}", "getPlaybackMedia", "media-bytes", handlers.Original, append(playback.MediaMIMETypes(), playbackMediaBinary, "multipart/byteranges"), true},
 		{http.MethodHead, "/stream/{session_id}", "headPlaybackMedia", "media-bytes", handlers.Original, nil, true},
 		{http.MethodGet, "/playback/transcode/{session_id}/master.m3u8", "getPlaybackManifest", "hls", handlers.Manifest, []string{"application/vnd.apple.mpegurl"}, false},
-		{http.MethodGet, "/playback/transcode/{session_id}/segment/{name}", playbackSegmentOperation, "hls", handlers.Segment, []string{"video/mp4", "video/mp2t", playbackMediaBinary, "multipart/byteranges"}, true},
+		{http.MethodGet, "/playback/transcode/{session_id}/segment/{name}", playbackSegmentOperation, "hls", handlers.Segment, []string{"video/mp4", "video/mp2t", playbackSubtitleVTT, playbackMediaBinary, "multipart/byteranges"}, true},
 		{http.MethodGet, "/stream/{session_id}/subtitles/{track}", playbackSubtitleOperation, "subtitle-sidecar", handlers.Subtitle, []string{playbackSubtitleVTT, playbackSubtitleSSA, playbackSubtitleSubrip, playbackMediaBinary}, false},
 		{http.MethodHead, "/stream/{session_id}/subtitles/{track}", playbackSubtitleHead, "subtitle-sidecar", handlers.Subtitle, nil, false},
 	} {
@@ -110,7 +111,10 @@ func registerPlaybackDelivery(reg *Registry) {
 			params = append(params, &huma.Param{Name: playback.HLSVariableSubstitutionQueryParam, In: playbackParamQuery, Description: hlsVariableSubstitutionParamDescription, Schema: &huma.Schema{Type: huma.TypeString}})
 		}
 		if route.id == playbackSegmentOperation {
-			params = append(params, &huma.Param{Name: playbackSegmentName, In: playbackParamPath, Required: true, Schema: &huma.Schema{Type: huma.TypeString, MinLength: new(1)}})
+			params = append(params, &huma.Param{Name: playbackSegmentName, In: playbackParamPath, Required: true, Description: "Segment name from the media playlist. sub_NNNNN.vtt names a WebVTT subtitle rendition segment, answered from the cues already produced; one the transcode does not reach in time is an empty WebVTT document.", Schema: &huma.Schema{Type: huma.TypeString, MinLength: new(1)}})
+		}
+		if route.id == "getPlaybackManifest" {
+			params = append(params, &huma.Param{Name: playback.SubtitleRenditionQueryParam, In: playbackParamQuery, Description: "Set by the multivariant playlist of a plan with subtitle.hls_rendition: video selects the media playlist, subtitles the WebVTT subtitle playlist. Absent, such a plan's manifest is the multivariant playlist.", Schema: &huma.Schema{Type: huma.TypeString, Enum: []any{"video", "subtitles"}}})
 		}
 		subtitle := route.id == playbackSubtitleOperation || route.id == playbackSubtitleHead
 		if subtitle {
@@ -236,3 +240,6 @@ func (w *playbackDeliveryWriter) Unwrap() http.ResponseWriter    { return w.Resp
 func (w *playbackDeliveryWriter) WriteHeader(status int)         { w.transport().WriteHeader(status) }
 func (w *playbackDeliveryWriter) Write(data []byte) (int, error) { return w.transport().Write(data) }
 func (w *playbackDeliveryWriter) FlushError() error              { return w.transport().FlushError() }
+func (w *playbackDeliveryWriter) ReadFrom(src io.Reader) (int64, error) {
+	return w.transport().ReadFrom(src)
+}
diff --git a/internal/apiv2/playback_delivery_test.go b/internal/apiv2/playback_delivery_test.go
index f55544576a..ede7998685 100644
--- a/internal/apiv2/playback_delivery_test.go
+++ b/internal/apiv2/playback_delivery_test.go
@@ -7,8 +7,11 @@ import (
 	"io"
 	"net/http"
 	"net/http/httptest"
+	"os"
+	"path/filepath"
 	"strings"
 	"testing"
+	"testing/iotest"
 	"time"
 
 	"github.com/prairie-server/prairie-server/internal/api/handlers"
@@ -90,6 +93,84 @@ func TestPlaybackDeliveryFailureAfterBytesAborts(t *testing.T) {
 	http.Error(writer, "PRIVATE_ERROR", 500)
 }
 
+// A file served on the v2 stream route must reach the connection's ReadFrom,
+// which is net/http's sendfile path, with the file still visible under at most
+// one limiter. io.Copy finds ReadFrom only by direct assertion, so every writer
+// on the route has to forward it. The handler is the real direct-play path,
+// with its rolling-deadline writer on top.
+func TestPlaybackDeliveryKeepsZeroCopy(t *testing.T) {
+	deps, _ := catalogDeps(t)
+	body := strings.Repeat("x", 64<<10)
+	path := filepath.Join(t.TempDir(), "fixture.mp4")
+	if err := os.WriteFile(path, []byte(body), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	deps.PlaybackMedia = &PlaybackMediaHandlers{Original: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if err := playback.ServeDirectPlay(w, r, path); err != nil {
+			t.Errorf("direct play: %v", err)
+		}
+	})}
+	h := newTestHandler(t, deps)
+	for _, tc := range []struct {
+		name, rangeHeader string
+		status            int
+		want              int64
+	}{
+		{"full", "", http.StatusOK, int64(len(body))},
+		{"range", "bytes=10-1033", http.StatusPartialContent, 1024},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			r := httptest.NewRequest(http.MethodGet, Prefix+"/stream/"+deliveryTestSession+"?st=opaque", nil)
+			for k, v := range viewerHeaders() {
+				r.Header.Set(k, v)
+			}
+			if tc.rangeHeader != "" {
+				r.Header.Set("Range", tc.rangeHeader)
+			}
+			inner := &zeroCopyWriter{ResponseRecorder: httptest.NewRecorder()}
+			h.ServeHTTP(inner, r)
+			if inner.Code != tc.status || int64(inner.Body.Len()) != tc.want || inner.fromFile != tc.want {
+				t.Fatalf("status %d, body %d bytes, %d of them read from the file by ReadFrom; want %d and %d", inner.Code, inner.Body.Len(), inner.fromFile, tc.status, tc.want)
+			}
+		})
+	}
+}
+
+// A copy that starts before any status must not commit one until a byte
+// arrives: a source that fails at once still gets its problem response, and
+// one that fails after bytes ends the stream instead of appending JSON.
+func TestPlaybackDeliveryCopyBeforeStatus(t *testing.T) {
+	t.Run("fails before bytes", func(t *testing.T) {
+		inner := &zeroCopyWriter{ResponseRecorder: httptest.NewRecorder()}
+		writer := &playbackDeliveryWriter{ResponseWriter: inner, request: httptest.NewRequest(http.MethodGet, "/", nil)}
+		if _, err := io.Copy(writer, iotest.ErrReader(io.ErrUnexpectedEOF)); err == nil {
+			t.Fatal("copy succeeded")
+		}
+		http.Error(writer, "PRIVATE_ERROR", http.StatusServiceUnavailable)
+		if inner.Code != http.StatusServiceUnavailable || inner.Header().Get("Content-Type") != problemContentType || strings.Contains(inner.Body.String(), "PRIVATE") {
+			t.Fatalf("problem response: %d %v %s", inner.Code, inner.Header(), inner.Body.String())
+		}
+	})
+	t.Run("fails after bytes", func(t *testing.T) {
+		inner := &zeroCopyWriter{ResponseRecorder: httptest.NewRecorder()}
+		writer := &playbackDeliveryWriter{ResponseWriter: inner, request: httptest.NewRequest(http.MethodGet, "/", nil)}
+		// Hide MultiReader's WriteTo so io.Copy has to use the writer's ReadFrom.
+		src := struct{ io.Reader }{io.MultiReader(strings.NewReader("first"), iotest.ErrReader(io.ErrUnexpectedEOF))}
+		if _, err := io.Copy(writer, src); err == nil {
+			t.Fatal("copy succeeded")
+		}
+		defer func() {
+			if err, ok := recover().(error); !ok || !errors.Is(err, http.ErrAbortHandler) {
+				t.Fatalf("late failure did not abort: %v", err)
+			}
+			if inner.Code != http.StatusOK || inner.Body.String() != "first" {
+				t.Fatalf("appended error bytes: %d %q", inner.Code, inner.Body.String())
+			}
+		}()
+		http.Error(writer, "PRIVATE_ERROR", http.StatusBadGateway)
+	})
+}
+
 func TestPlaybackDecisionV2ProjectsOnlyLocalMediaURLs(t *testing.T) {
 	for _, tc := range []struct{ path, want string }{
 		{"/api/v1/stream/session?st=opaque%2Btoken", "/api/v2/stream/session?st=opaque%2Btoken"},
diff --git a/internal/apiv2/playback_test.go b/internal/apiv2/playback_test.go
index 34a10313fc..e8e118f07c 100644
--- a/internal/apiv2/playback_test.go
+++ b/internal/apiv2/playback_test.go
@@ -257,23 +257,24 @@ func TestPlaybackV2StartForwardsDeclaredDevice(t *testing.T) {
 	}
 }
 
-// v2 names every source entry, video or audio-only, without touching other
+// v2 drops the source entry, video or audio-only, without touching other
 // entries or the shared plan that v1 serializes.
-func TestPlaybackQualitiesNamesTheSourceEntry(t *testing.T) {
+func TestPlaybackQualitiesDropsTheSourceEntry(t *testing.T) {
 	plan := []playback.AvailableQualityV3{
 		{Label: playback.QualityOriginalV3, Height: 2160, BitrateKbps: 40_000, PreservesSource: true},
+		{Label: "1080p", DisplayName: "1080p", Height: 1080, BitrateKbps: 8_000},
 		{Label: "1080p-medium", DisplayName: "1080p Medium", Height: 1080, BitrateKbps: 6_000},
 	}
 	got := playbackQualities(plan)
-	if got[0].DisplayName != sourceQualityDisplayName || got[1].DisplayName != "1080p Medium" {
+	if len(got) != 2 || got[0].Label != "1080p" || got[1].Label != "1080p-medium" {
 		t.Fatalf("v2 qualities = %#v", got)
 	}
-	if plan[0].DisplayName != "" {
-		t.Fatalf("shared plan changed: %#v", plan[0])
+	if len(plan) != 3 || plan[0].Label != playback.QualityOriginalV3 {
+		t.Fatalf("shared plan changed: %#v", plan)
 	}
 	audio := playbackQualities([]playback.AvailableQualityV3{{Label: playback.QualityOriginalV3, BitrateKbps: 128, PreservesSource: true}})
-	if audio[0].DisplayName != sourceQualityDisplayName {
-		t.Fatalf("audio-only source entry = %#v", audio[0])
+	if len(audio) != 0 {
+		t.Fatalf("audio-only menu = %#v, want empty", audio)
 	}
 	if playbackQualities(nil) != nil {
 		t.Fatal("an absent menu stays absent")
diff --git a/internal/apiv2/profile_token_revision_test.go b/internal/apiv2/profile_token_revision_test.go
index 88cac41280..1d64a2358e 100644
--- a/internal/apiv2/profile_token_revision_test.go
+++ b/internal/apiv2/profile_token_revision_test.go
@@ -53,7 +53,7 @@ func TestProfileTokenSurvivesManagingAnotherProfile(t *testing.T) {
 	}
 	db.DB.SetMaxOpenConns(1)
 	t.Cleanup(func() { _ = db.Close() })
-	users := &revisionUsers{user: &models.User{ID: 1, Role: "user", Enabled: true, MaxProfiles: 5, AccessPolicyRevision: 1}}
+	users := &revisionUsers{user: &models.User{ID: 1, Role: "user", Enabled: true, MaxProfiles: new(5), AccessPolicyRevision: 1}}
 	store := userdb.NewSQLiteUserStore(db.DB)
 	for _, p := range []userstore.Profile{{ID: "p-parent", Name: "Parent"}, {ID: "p-kid", Name: "Kid"}} {
 		if err := store.CreateProfile(ctx, p); err != nil {
diff --git a/internal/apiv2/profiles.go b/internal/apiv2/profiles.go
index dd10d22371..053b15a4cd 100644
--- a/internal/apiv2/profiles.go
+++ b/internal/apiv2/profiles.go
@@ -27,7 +27,7 @@ type Profile struct {
 	MaxContentRating           string  `json:"max_content_rating" doc:"Content-rating ceiling; empty means none" example:"PG-13"`
 	MaxAdvisoryAge             *int    `json:"max_advisory_age" nullable:"true" minimum:"1" maximum:"21" doc:"Advisory-age limit: titles whose advisory age (for example Common Sense Media's 13+) is above it are hidden from the profile. Titles with no advisory age are limited by max_content_rating alone unless require_advisory_age is set; null means no limit" example:"12"`
 	RequireAdvisoryAge         bool    `json:"require_advisory_age" doc:"Hide titles with no advisory age as well, so the profile sees only titles an advisory service rated at or under max_advisory_age. Advisory ages are looked up over time, so on a large library a profile with this set starts with few titles. No effect without max_advisory_age" example:"false"`
-	QualityPreference          string  `json:"quality_preference" doc:"Free-form until the vocabulary is ratified (#135). Canonical values today: auto, original, 720p, 1080p, 2160p, 4k; empty when unset" example:"auto"`
+	QualityPreference          string  `json:"quality_preference" doc:"Free-form until the vocabulary is ratified (#135). Canonical values today: auto, 720p, 1080p, 2160p, 4k; original is a deprecated alias of auto; empty when unset" example:"auto"`
 	Language                   string  `json:"language" doc:"Preferred audio language (ISO 639-1); empty inherits" example:"en"`
 	PreferredMetadataLanguage  string  `json:"preferred_metadata_language" doc:"Metadata language (ISO 639-1); empty inherits the library's" example:"en"`
 	SubtitleLanguage           string  `json:"subtitle_language" doc:"Preferred subtitle language (ISO 639-1); empty inherits" example:"en"`
@@ -54,7 +54,7 @@ type ProfileUpdate struct {
 	MaxContentRating           Patch[string] `json:"max_content_rating,omitzero" doc:"Content-rating ceiling; null removes it" example:"PG-13"`
 	MaxAdvisoryAge             Patch[int]    `json:"max_advisory_age,omitzero" minimum:"1" maximum:"21" doc:"Advisory-age limit: titles whose advisory age (for example Common Sense Media's 13+) is above it are hidden from the profile. Titles with no advisory age are limited by max_content_rating alone unless require_advisory_age is set; null removes it" example:"12"`
 	RequireAdvisoryAge         *bool         `json:"require_advisory_age,omitempty" nullable:"false" doc:"Hide titles with no advisory age as well, so the profile sees only titles an advisory service rated at or under max_advisory_age. Advisory ages are looked up over time, so on a large library a profile with this set starts with few titles. No effect without max_advisory_age" example:"true"`
-	QualityPreference          *string       `json:"quality_preference,omitempty" nullable:"false" maxLength:"32" doc:"Free-form until the vocabulary is ratified (#135); v1 never validated it. Canonical values today: auto, original, 720p, 1080p, 2160p, 4k" example:"auto"`
+	QualityPreference          *string       `json:"quality_preference,omitempty" nullable:"false" maxLength:"32" doc:"Free-form until the vocabulary is ratified (#135); v1 never validated it. Canonical values today: auto, 720p, 1080p, 2160p, 4k; original is a deprecated alias of auto" example:"auto"`
 	Language                   Patch[string] `json:"language,omitzero" doc:"Preferred audio language (ISO 639-1); null inherits" example:"en"`
 	PreferredMetadataLanguage  Patch[string] `json:"preferred_metadata_language,omitzero" doc:"Metadata language (ISO 639-1); null inherits the library's" example:"en"`
 	SubtitleLanguage           Patch[string] `json:"subtitle_language,omitzero" doc:"Preferred subtitle language (ISO 639-1); null inherits" example:"en"`
@@ -90,9 +90,11 @@ const fieldMaxAdvisoryAge = "max_advisory_age"
 // check the caller did not pass (an unverified PIN-locked primary profile).
 const codeProfileManagement = "profile_management"
 
-// locationAllowedLibraryIDs is the problem location of the allowlist member.
+// locationAllowedLibraryIDs is the problem location of the profile allowlist
+// member; locationLibraryIDs is the account, access group and invitation one.
 const (
 	locationAllowedLibraryIDs = locationBody + ".allowed_library_ids"
+	locationLibraryIDs        = locationBody + ".library_ids"
 	locationPIN               = locationBody + ".pin"
 )
 
@@ -145,7 +147,7 @@ type ProfileCreate struct {
 	MaxContentRating           *string `json:"max_content_rating,omitempty" nullable:"false" doc:"Content-rating ceiling" example:"PG-13"`
 	MaxAdvisoryAge             *int    `json:"max_advisory_age,omitempty" nullable:"false" minimum:"1" maximum:"21" doc:"Advisory-age limit: titles whose advisory age (for example Common Sense Media's 13+) is above it are hidden from the profile. Titles with no advisory age are limited by max_content_rating alone unless require_advisory_age is set" example:"12"`
 	RequireAdvisoryAge         *bool   `json:"require_advisory_age,omitempty" nullable:"false" doc:"Hide titles with no advisory age as well, so the profile sees only titles an advisory service rated at or under max_advisory_age. Advisory ages are looked up over time, so on a large library a profile with this set starts with few titles. No effect without max_advisory_age" example:"true"`
-	QualityPreference          *string `json:"quality_preference,omitempty" nullable:"false" maxLength:"32" doc:"Free-form until the vocabulary is ratified (#135); v1 never validated it. Canonical values today: auto, original, 720p, 1080p, 2160p, 4k" example:"auto"`
+	QualityPreference          *string `json:"quality_preference,omitempty" nullable:"false" maxLength:"32" doc:"Free-form until the vocabulary is ratified (#135); v1 never validated it. Canonical values today: auto, 720p, 1080p, 2160p, 4k; original is a deprecated alias of auto" example:"auto"`
 	Language                   *string `json:"language,omitempty" nullable:"false" doc:"Preferred audio language (ISO 639-1)" example:"en"`
 	PreferredMetadataLanguage  *string `json:"preferred_metadata_language,omitempty" nullable:"false" doc:"Metadata language (ISO 639-1)" example:"en"`
 	SubtitleLanguage           *string `json:"subtitle_language,omitempty" nullable:"false" doc:"Preferred subtitle language (ISO 639-1)" example:"en"`
@@ -691,7 +693,7 @@ func (reg *Registry) createProfile(ctx context.Context, in *ProfileCreateInput)
 		return nil, p
 	}
 	if len(req.AllowedLibraryIDs) > 0 {
-		if p := reg.rejectUnknownLibraries(ctx, &req.AllowedLibraryIDs); p != nil {
+		if p := reg.rejectUnknownLibraries(ctx, &req.AllowedLibraryIDs, locationAllowedLibraryIDs); p != nil {
 			return nil, p
 		}
 	}
@@ -780,7 +782,7 @@ func (reg *Registry) updateProfile(ctx context.Context, in *ProfileUpdateInput)
 	if p != nil {
 		return nil, p
 	}
-	if p := reg.rejectUnknownLibraries(ctx, req.AllowedLibraryIDs); p != nil {
+	if p := reg.rejectUnknownLibraries(ctx, req.AllowedLibraryIDs, locationAllowedLibraryIDs); p != nil {
 		return nil, p
 	}
 	view, err := reg.deps.Profiles.UpdateProfile(ctx, handlers.ProfileUpdateCommand{
@@ -800,11 +802,13 @@ func (reg *Registry) updateProfile(ctx context.Context, in *ProfileUpdateInput)
 	return &ProfileOutput{Body: profile}, nil
 }
 
-// rejectUnknownLibraries refuses an allowlist naming a library that does not
-// exist. The store's row-by-row insert would otherwise hit the library
-// foreign key (a 500) on Postgres, and persist a dangling id where no key
-// is enforced. A nil or empty allowlist has nothing to check.
-func (reg *Registry) rejectUnknownLibraries(ctx context.Context, ids *[]int) *Problem {
+// rejectUnknownLibraries refuses a library list naming a library that does not
+// exist, reporting it at location. A profile allowlist's row-by-row insert
+// would otherwise hit the library foreign key (a 500) on Postgres; the
+// database silently drops an unknown id from account, access group and
+// invitation lists, so the client hears about it here. A nil or empty list
+// has nothing to check.
+func (reg *Registry) rejectUnknownLibraries(ctx context.Context, ids *[]int, location string) *Problem {
 	if ids == nil || len(*ids) == 0 {
 		return nil
 	}
@@ -822,7 +826,7 @@ func (reg *Registry) rejectUnknownLibraries(ctx context.Context, ids *[]int) *Pr
 	for _, id := range *ids {
 		if !known[id] {
 			return NewProblem(TypeValidationFailed, "The request did not pass validation; see errors.").
-				WithErrors(ProblemError{Location: locationAllowedLibraryIDs, Code: codeInvalid, Detail: "unknown library identifier: " + strconv.Itoa(id)})
+				WithErrors(ProblemError{Location: location, Code: codeInvalid, Detail: "unknown library identifier: " + strconv.Itoa(id)})
 		}
 	}
 	return nil
diff --git a/internal/apiv2/progress.go b/internal/apiv2/progress.go
index f914d6add5..d916e5f013 100644
--- a/internal/apiv2/progress.go
+++ b/internal/apiv2/progress.go
@@ -107,6 +107,27 @@ type ProgressSyncBatchResult struct {
 // ProgressSyncOutput is always HTTP 200 after a per-item batch completes.
 type ProgressSyncOutput struct{ Body ProgressSyncBatchResult }
 
+// ResumePositionInput names the item whose resume position to clear.
+type ResumePositionInput struct {
+	MediaItemID ID `path:"media_item_id" doc:"A movie or episode" example:"movie-8f2c1a"`
+}
+
+// ProgressCapabilities is the getProgressCapabilities body.
+type ProgressCapabilities struct {
+	Capability
+	ClearResumePosition bool `json:"clear_resume_position" doc:"Whether clearResumePosition is served: it clears a movie or episode's resume position and keeps its watched state and watch history" example:"true"`
+}
+
+// ProgressCapabilitiesOutput is the getProgressCapabilities response.
+type ProgressCapabilitiesOutput struct {
+	Status       int
+	ETag         string `header:"ETag"`
+	CacheControl string `header:"Cache-Control"`
+	Body         ProgressCapabilities
+}
+
+const locationPathMediaItemID = "path.media_item_id"
+
 // opListProgress is the operation id; the cursor scope is bound to it.
 const opListProgress = "listProgress"
 
@@ -127,6 +148,41 @@ func registerProgress(reg *Registry) {
 		Class:         ClassProfileScoped,
 		ServiceBacked: true,
 	}, reg.syncProgress)
+	Register(reg, viewerOperation(humaOp(http.MethodGet, Prefix+"/progress/capabilities", "getProgressCapabilities", "progress",
+		"The watch progress features this server supports, such as clearing a resume position.")), reg.getProgressCapabilities)
+	// Non-retryable as unmark is: a delayed retry would also clear a position
+	// the profile recorded after the first request.
+	clearPosition := humaOp(http.MethodDelete, Prefix+"/progress/{media_item_id}/position", "clearResumePosition", "progress",
+		"Clear the acting profile's resume position on a movie or episode, keeping its watched state and watch history. An item without a resume position is a no-op.")
+	clearPosition.DefaultStatus = http.StatusNoContent
+	Register(reg, Operation{Operation: clearPosition, Class: ClassProfileScoped, ServiceBacked: true, RetrySafety: RetrySafetyNonRetryable}, reg.clearResumePosition)
+}
+
+func (reg *Registry) getProgressCapabilities(_ context.Context, _ *CapabilityInput) (*ProgressCapabilitiesOutput, error) {
+	if reg.deps.Watch == nil {
+		return &ProgressCapabilitiesOutput{Body: ProgressCapabilities{Capability: Capability{State: StateNotConfigured}}}, nil
+	}
+	return &ProgressCapabilitiesOutput{Body: ProgressCapabilities{Capability: Capability{State: StateAvailable}, ClearResumePosition: true}}, nil
+}
+
+// clearResumePosition resets a movie or episode to no resume position for the
+// acting profile. A season, series or ebook fails validation of the path.
+func (reg *Registry) clearResumePosition(ctx context.Context, in *ResumePositionInput) (*struct{}, error) {
+	if reg.deps.Watch == nil {
+		return nil, unavailable("watch")
+	}
+	userID, profileID, p := viewerIdentity(ctx)
+	if p != nil {
+		return nil, p
+	}
+	filter, err := reg.deps.Watch.ContextAccessFilter(ctx, handlers.AccessFilterOptions{})
+	if err != nil {
+		return nil, NewProblem(TypeInternalError, "An unexpected error occurred.")
+	}
+	if err := reg.deps.Watch.ClearResumePosition(ctx, userID, profileID, string(in.MediaItemID), filter); err != nil {
+		return nil, watchTargetProblem(err, locationPathMediaItemID)
+	}
+	return nil, nil
 }
 
 // syncProgress runs the same batch write as v1 POST /sync/progress; a write
diff --git a/internal/apiv2/raw_protocol_extension_test.go b/internal/apiv2/raw_protocol_extension_test.go
index 42d57b079c..af21801468 100644
--- a/internal/apiv2/raw_protocol_extension_test.go
+++ b/internal/apiv2/raw_protocol_extension_test.go
@@ -156,6 +156,7 @@ func TestRawProtocolWebSocketRealUpgradeAndAuthorization(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
+	defer func() { _ = response.Body.Close() }()
 	defer conn.Close()
 	if response.StatusCode != 101 || response.Header.Get("Upgrade") != "websocket" || response.Header.Get("Sec-WebSocket-Accept") == "" {
 		t.Fatal(response.StatusCode, response.Header)
diff --git a/internal/apiv2/recommendations.go b/internal/apiv2/recommendations.go
index 4e4c661dd9..c478c61fe0 100644
--- a/internal/apiv2/recommendations.go
+++ b/internal/apiv2/recommendations.go
@@ -6,8 +6,10 @@ import (
 	"net/http"
 	"strconv"
 	"strings"
+	"unicode/utf8"
 
 	"github.com/prairie-server/prairie-server/internal/api/handlers"
+	catalogsvc "github.com/prairie-server/prairie-server/internal/catalog"
 	"github.com/prairie-server/prairie-server/internal/ratingsources"
 	"github.com/prairie-server/prairie-server/internal/recommendations"
 )
@@ -44,7 +46,13 @@ type RecommendationRowCollectionOutput struct {
 	Body RecommendationRowCollection
 }
 
+// DiscoverInput is the getDiscover request.
+type DiscoverInput struct {
+	ArtworkQuery
+}
+
 // RecommendationLimitParam is the page size of a recommendation list.
+
 type RecommendationLimitParam struct {
 	Limit int `query:"limit" minimum:"1" maximum:"50" default:"20" doc:"Cards to answer; default 20, maximum 50" example:"20"`
 }
@@ -53,23 +61,27 @@ type RecommendationLimitParam struct {
 type BecauseWatchedInput struct {
 	ItemID string `path:"item_id" minLength:"1" doc:"The watched item recommendations are drawn from" example:"movie:heat-1995"`
 	RecommendationLimitParam
+	ArtworkQuery
 }
 
 // ForYouInput is the getForYouMain and listForYouRows query.
 type ForYouInput struct {
 	RecommendationLimitParam
+	ArtworkQuery
 }
 
 // PopularInput is the listPopular query.
 type PopularInput struct {
 	Days int `query:"days" minimum:"1" default:"30" doc:"Window in days; default 30" example:"30"`
 	RecommendationLimitParam
+	ArtworkQuery
 }
 
 // RecentlyAddedInput is the listRecentlyAdded query.
 type RecentlyAddedInput struct {
 	Days int `query:"days" minimum:"1" default:"14" doc:"Window in days; default 14" example:"14"`
 	RecommendationLimitParam
+	ArtworkQuery
 }
 
 // RecommendationSectionInput is the getRecommendationSection request.
@@ -77,17 +89,20 @@ type RecommendationSectionInput struct {
 	Kind  string `path:"kind" enum:"for-you-main,cluster,similar-users,popular,recently-added,top-rated,genre" doc:"Section kind, as a discover row's kind names it" example:"genre"`
 	Key   string `query:"key" doc:"Section key: the cluster index of a cluster section or the genre name of a genre section" example:"Crime"`
 	Limit int    `query:"limit" minimum:"1" maximum:"60" default:"60" doc:"Cards to answer; default and maximum 60" example:"60"`
+	ArtworkQuery
 }
 
 // SimilarInput is the listSimilar request.
 type SimilarInput struct {
 	ItemID string `path:"item_id" minLength:"1" doc:"The item similar items are drawn from" example:"movie:heat-1995"`
 	RecommendationLimitParam
+	ArtworkQuery
 }
 
 // SimilarUsersInput is the listSimilarUsersLiked query.
 type SimilarUsersInput struct {
 	RecommendationLimitParam
+	ArtworkQuery
 }
 
 // TasteProfile is the acting profile's taste summary; empty members, not
@@ -108,6 +123,7 @@ type TasteProfileOutput struct {
 type TasteSeedItemsInput struct {
 	Limit  int    `query:"limit" minimum:"1" maximum:"60" default:"30" doc:"Cards per page; default 30, maximum 60" example:"30"`
 	Cursor string `query:"cursor" doc:"Opaque cursor from page.next_cursor" example:"eyJvIjozMH0"`
+	ArtworkQuery
 }
 
 // TasteSeedSubmission is the createTasteSeed body: the items the profile
@@ -134,6 +150,7 @@ type TasteSeedResultOutput struct {
 // WatchTonightInput is the getWatchTonight query.
 type WatchTonightInput struct {
 	Limit int `query:"limit" minimum:"1" maximum:"20" default:"5" doc:"Cards to answer; default 5, maximum 20" example:"5"`
+	ArtworkQuery
 }
 
 // WatchTonightItem is one Watch Tonight card: the shared card plus where
@@ -160,6 +177,7 @@ type WatchTonightCardsInput struct {
 	Genres     []string `query:"genres,explode" maxItems:"18" doc:"Discover-mode genre filter, repeated (genres=Crime&genres=Thriller); each must be a known genre" example:"Crime"`
 	ExcludeIDs []string `query:"exclude_ids,explode" maxItems:"200" doc:"Catalog identifiers already swiped, repeated (exclude_ids=a&exclude_ids=b)" example:"movie:heat-1995"`
 	Limit      int      `query:"limit" minimum:"1" maximum:"20" default:"12" doc:"Cards per page; default 12, maximum 20" example:"12"`
+	ArtworkQuery
 }
 
 // WatchTonightCastMember is one cast member on a swipe card.
@@ -200,7 +218,7 @@ const (
 func registerRecommendations(reg *Registry) {
 	cursors := NewCursors(reg.deps.CursorSecret)
 	Register(reg, viewerOperation(humaOp(http.MethodGet, Prefix+"/recommendations/because-watched/{item_id}", "listBecauseWatched", "recommendations",
-		"Cards recommended because the acting profile watched the item, minus what it has watched or rated low.")), reg.listBecauseWatched)
+		"Cards recommended because the acting profile watched the item, minus what it has watched or rated.")), reg.listBecauseWatched)
 	Register(reg, viewerOperation(humaOp(http.MethodGet, Prefix+"/recommendations/discover", "getDiscover", "recommendations",
 		"The Discover page: the acting profile's recommendation rows with their cards, blended with upcoming airings.")), reg.getDiscover)
 	Register(reg, viewerOperation(humaOp(http.MethodGet, Prefix+"/recommendations/for-you/main", "getForYouMain", "recommendations",
@@ -208,13 +226,13 @@ func registerRecommendations(reg *Registry) {
 	Register(reg, viewerOperation(humaOp(http.MethodGet, Prefix+"/recommendations/for-you/rows", "listForYouRows", "recommendations",
 		"The acting profile's For You rows, one per taste cluster.")), reg.listForYouRows)
 	Register(reg, viewerOperation(humaOp(http.MethodGet, Prefix+"/recommendations/popular", "listPopular", "recommendations",
-		"The server's most played items over the window, minus what the acting profile has watched.")), reg.listPopular)
+		"The server's most played items over the window, minus what the acting profile has watched or marked Not interested.")), reg.listPopular)
 	Register(reg, viewerOperation(humaOp(http.MethodGet, Prefix+"/recommendations/recently-added", "listRecentlyAdded", "recommendations",
-		"Items added over the window, minus what the acting profile has watched.")), reg.listRecentlyAdded)
+		"Items added over the window, minus what the acting profile has watched or marked Not interested.")), reg.listRecentlyAdded)
 	Register(reg, viewerOperation(humaOp(http.MethodGet, Prefix+"/recommendations/section/{kind}", "getRecommendationSection", "recommendations",
 		"One recommendation row in full, for a dedicated see-all page; empty when the profile has no such row.")), reg.getRecommendationSection)
 	Register(reg, viewerOperation(humaOp(http.MethodGet, Prefix+"/recommendations/similar/{item_id}", "listSimilar", "recommendations",
-		"Cards similar to the item by content; not personalised beyond the acting profile's access.")), reg.listSimilar)
+		"Cards similar to the item by content; personalised only by the acting profile's access and by leaving out the titles it marked Not interested.")), reg.listSimilar)
 	Register(reg, viewerOperation(humaOp(http.MethodGet, Prefix+"/recommendations/similar-users", "listSimilarUsersLiked", "recommendations",
 		"Cards profiles with similar taste liked.")), reg.listSimilarUsersLiked)
 	Register(reg, viewerOperation(humaOp(http.MethodGet, Prefix+"/recommendations/taste-profile", "getTasteProfile", "recommendations",
@@ -278,19 +296,19 @@ func (reg *Registry) recommendationCards(ctx context.Context, fetch func(svc Rec
 
 func (reg *Registry) listBecauseWatched(ctx context.Context, in *BecauseWatchedInput) (*CatalogItemCollectionOutput, error) {
 	return reg.recommendationCards(ctx, func(svc RecommendationService, userID int, profileID string) ([]handlers.SectionItemView, error) {
-		return svc.BecauseWatchedCards(ctx, userID, profileID, in.ItemID, in.Limit, handlers.AccessFilterFromContext(ctx, ""))
+		return svc.BecauseWatchedCards(ctx, userID, profileID, in.ItemID, in.Limit, recommendationFilter(ctx, in.ArtworkQuery))
 	})
 }
 
 func (reg *Registry) listPopular(ctx context.Context, in *PopularInput) (*CatalogItemCollectionOutput, error) {
 	return reg.recommendationCards(ctx, func(svc RecommendationService, userID int, profileID string) ([]handlers.SectionItemView, error) {
-		return svc.PopularCards(ctx, userID, profileID, in.Days, in.Limit, handlers.AccessFilterFromContext(ctx, ""))
+		return svc.PopularCards(ctx, userID, profileID, in.Days, in.Limit, recommendationFilter(ctx, in.ArtworkQuery))
 	})
 }
 
 func (reg *Registry) listRecentlyAdded(ctx context.Context, in *RecentlyAddedInput) (*CatalogItemCollectionOutput, error) {
 	return reg.recommendationCards(ctx, func(svc RecommendationService, userID int, profileID string) ([]handlers.SectionItemView, error) {
-		return svc.RecentlyAddedCards(ctx, userID, profileID, in.Days, in.Limit, handlers.AccessFilterFromContext(ctx, ""))
+		return svc.RecentlyAddedCards(ctx, userID, profileID, in.Days, in.Limit, recommendationFilter(ctx, in.ArtworkQuery))
 	})
 }
 
@@ -303,7 +321,7 @@ func (reg *Registry) getForYouMain(ctx context.Context, in *ForYouInput) (*Recom
 	if p != nil {
 		return nil, p
 	}
-	row, err := svc.ForYouMainCards(ctx, userID, profileID, in.Limit, handlers.AccessFilterFromContext(ctx, ""))
+	row, err := svc.ForYouMainCards(ctx, userID, profileID, in.Limit, recommendationFilter(ctx, in.ArtworkQuery))
 	if err != nil {
 		return nil, serviceProblem(err)
 	}
@@ -333,13 +351,13 @@ func (reg *Registry) recommendationRows(ctx context.Context, fetch func(svc Reco
 
 func (reg *Registry) listForYouRows(ctx context.Context, in *ForYouInput) (*RecommendationRowCollectionOutput, error) {
 	return reg.recommendationRows(ctx, func(svc RecommendationService, userID int, profileID string) ([]handlers.DiscoverRowView, error) {
-		return svc.ForYouRowCards(ctx, userID, profileID, in.Limit, handlers.AccessFilterFromContext(ctx, ""))
+		return svc.ForYouRowCards(ctx, userID, profileID, in.Limit, recommendationFilter(ctx, in.ArtworkQuery))
 	})
 }
 
-func (reg *Registry) getDiscover(ctx context.Context, _ *struct{}) (*RecommendationRowCollectionOutput, error) {
+func (reg *Registry) getDiscover(ctx context.Context, in *DiscoverInput) (*RecommendationRowCollectionOutput, error) {
 	return reg.recommendationRows(ctx, func(svc RecommendationService, userID int, profileID string) ([]handlers.DiscoverRowView, error) {
-		view, err := svc.Discover(ctx, userID, profileID, handlers.AccessFilterFromContext(ctx, ""))
+		view, err := svc.Discover(ctx, userID, profileID, recommendationFilter(ctx, in.ArtworkQuery))
 		if err != nil {
 			return nil, err
 		}
@@ -360,22 +378,43 @@ func (reg *Registry) getRecommendationSection(ctx context.Context, in *Recommend
 		return nil, NewProblem(TypeValidationFailed, "The request did not pass validation; see errors.").
 			WithErrors(ProblemError{Location: "query.key", Code: codeRequired, Detail: "a " + in.Kind + " section needs a key"})
 	}
-	view, err := svc.Section(ctx, userID, profileID, in.Kind, in.Key, in.Limit, handlers.AccessFilterFromContext(ctx, ""))
+	if detail := invalidSectionKey(in.Kind, in.Key); detail != "" {
+		return nil, NewProblem(TypeValidationFailed, "The request did not pass validation; see errors.").
+			WithErrors(ProblemError{Location: "query.key", Code: codeInvalid, Detail: detail})
+	}
+	view, err := svc.Section(ctx, userID, profileID, in.Kind, in.Key, in.Limit, recommendationFilter(ctx, in.ArtworkQuery))
 	if err != nil {
 		return nil, serviceProblem(err)
 	}
 	return &RecommendationRowOutput{Body: RecommendationRow{Type: view.Type, Title: view.Label, Kind: view.Kind, Key: view.Key, Items: catalogItemsOfSection(view.Items, reg.ratingSelection(ctx))}}, nil
 }
 
+// invalidSectionKey explains why key cannot name a section of kind, or is
+// empty when it can: a cluster section's key is its index, and a genre
+// section's key is the genre's name as text.
+func invalidSectionKey(kind, key string) string {
+	switch kind {
+	case recommendations.SectionKindCluster:
+		if idx, err := strconv.Atoi(key); err != nil || idx < 0 {
+			return "a cluster section's key is its index, a whole number from 0"
+		}
+	case recommendations.SectionKindGenre:
+		if !utf8.ValidString(key) || strings.ContainsRune(key, 0) {
+			return "a genre section's key is the genre's name"
+		}
+	}
+	return ""
+}
+
 func (reg *Registry) listSimilar(ctx context.Context, in *SimilarInput) (*CatalogItemCollectionOutput, error) {
 	return reg.recommendationCards(ctx, func(svc RecommendationService, userID int, profileID string) ([]handlers.SectionItemView, error) {
-		return svc.SimilarCards(ctx, userID, profileID, in.ItemID, in.Limit, handlers.AccessFilterFromContext(ctx, ""))
+		return svc.SimilarCards(ctx, userID, profileID, in.ItemID, in.Limit, recommendationFilter(ctx, in.ArtworkQuery))
 	})
 }
 
 func (reg *Registry) listSimilarUsersLiked(ctx context.Context, in *SimilarUsersInput) (*CatalogItemCollectionOutput, error) {
 	return reg.recommendationCards(ctx, func(svc RecommendationService, userID int, profileID string) ([]handlers.SectionItemView, error) {
-		return svc.SimilarUsersCards(ctx, userID, profileID, in.Limit, handlers.AccessFilterFromContext(ctx, ""))
+		return svc.SimilarUsersCards(ctx, userID, profileID, in.Limit, recommendationFilter(ctx, in.ArtworkQuery))
 	})
 }
 
@@ -420,7 +459,7 @@ func (reg *Registry) listTasteSeedItems(ctx context.Context, cursors *Cursors, i
 	if p != nil {
 		return nil, p
 	}
-	views, candidates, err := svc.TasteSeedItems(ctx, userID, profileID, handlers.AccessFilterFromContext(ctx, ""), in.Limit, offset)
+	views, candidates, err := svc.TasteSeedItems(ctx, userID, profileID, recommendationFilter(ctx, in.ArtworkQuery), in.Limit, offset)
 	if err != nil {
 		return nil, serviceProblem(err)
 	}
@@ -473,7 +512,7 @@ func (reg *Registry) getWatchTonight(ctx context.Context, in *WatchTonightInput)
 	if p != nil {
 		return nil, p
 	}
-	view, err := svc.WatchTonight(ctx, userID, profileID, handlers.AccessFilterFromContext(ctx, ""), in.Limit)
+	view, err := svc.WatchTonight(ctx, userID, profileID, recommendationFilter(ctx, in.ArtworkQuery), in.Limit)
 	if err != nil {
 		return nil, serviceProblem(err)
 	}
@@ -507,7 +546,10 @@ func (reg *Registry) listWatchTonightCards(ctx context.Context, in *WatchTonight
 			excludeIDs[id] = struct{}{}
 		}
 	}
-	view := svc.WatchTonightCards(ctx, userID, profileID, handlers.AccessFilterFromContext(ctx, ""), in.Mode, genres, excludeIDs, in.Limit)
+	view, err := svc.WatchTonightCards(ctx, userID, profileID, recommendationFilter(ctx, in.ArtworkQuery), in.Mode, genres, excludeIDs, in.Limit)
+	if err != nil {
+		return nil, serviceProblem(err)
+	}
 	remaining := max(0, watchTonightExclusionLimit-len(excludeIDs))
 	if len(view.Cards) > remaining {
 		view.Cards = view.Cards[:remaining]
@@ -553,3 +595,12 @@ func watchTonightGenres(raw []string) ([]string, *Problem) {
 	}
 	return genres, nil
 }
+
+// recommendationFilter is the viewer filter a recommendation read resolves
+// under, carrying the request's artwork sizes.
+func recommendationFilter(ctx context.Context, q ArtworkQuery) catalogsvc.AccessFilter {
+	filter := handlers.AccessFilterFromContext(ctx, "")
+	art := q.Artwork()
+	filter.ImageSize, filter.ImageWidths = art.Size, art.Widths
+	return filter
+}
diff --git a/internal/apiv2/recommendations_test.go b/internal/apiv2/recommendations_test.go
index 5122664b3d..71d2f48a48 100644
--- a/internal/apiv2/recommendations_test.go
+++ b/internal/apiv2/recommendations_test.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/prairie-server/prairie-server/internal/api/handlers"
 	catalogpkg "github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/imagesize"
 	"github.com/prairie-server/prairie-server/internal/recommendations"
 )
 
@@ -30,6 +31,7 @@ type fakeRecommendations struct {
 	lastExclude         map[string]struct{}
 	cardsHasMore        bool
 	swipePool           int
+	lastFilter          catalogpkg.AccessFilter
 }
 
 func fakeRecommendationRow() handlers.DiscoverRowView {
@@ -49,8 +51,8 @@ func (f *fakeRecommendations) BecauseWatchedCards(_ context.Context, _ int, _, i
 	return f.cards(limit)
 }
 
-func (f *fakeRecommendations) PopularCards(_ context.Context, _ int, _ string, days, limit int, _ catalogpkg.AccessFilter) ([]handlers.SectionItemView, error) {
-	f.lastItemID, f.lastDays = "", days
+func (f *fakeRecommendations) PopularCards(_ context.Context, _ int, _ string, days, limit int, filter catalogpkg.AccessFilter) ([]handlers.SectionItemView, error) {
+	f.lastItemID, f.lastDays, f.lastFilter = "", days, filter
 	return f.cards(limit)
 }
 
@@ -137,8 +139,11 @@ func (f *fakeRecommendations) WatchTonight(_ context.Context, _ int, _ string, _
 	return handlers.WatchTonightView{Items: []handlers.WatchTonightItemView{fakeWatchTonightItem()}, IsCold: true}, nil
 }
 
-func (f *fakeRecommendations) WatchTonightCards(_ context.Context, _ int, _ string, _ catalogpkg.AccessFilter, mode string, genres []string, excludeIDs map[string]struct{}, limit int) handlers.WatchTonightCardsView {
+func (f *fakeRecommendations) WatchTonightCards(_ context.Context, _ int, _ string, _ catalogpkg.AccessFilter, mode string, genres []string, excludeIDs map[string]struct{}, limit int) (handlers.WatchTonightCardsView, error) {
 	f.lastMode, f.lastGenres, f.lastExclude, f.lastLimit = mode, genres, excludeIDs, limit
+	if f.err != nil {
+		return handlers.WatchTonightCardsView{}, f.err
+	}
 	if f.swipePool > 0 {
 		cards := make([]handlers.WatchTonightCardView, 0, limit)
 		more := false
@@ -155,9 +160,9 @@ func (f *fakeRecommendations) WatchTonightCards(_ context.Context, _ int, _ stri
 			card.ContentID = id
 			cards = append(cards, card)
 		}
-		return handlers.WatchTonightCardsView{Cards: cards, HasMore: more}
+		return handlers.WatchTonightCardsView{Cards: cards, HasMore: more}, nil
 	}
-	return handlers.WatchTonightCardsView{Cards: []handlers.WatchTonightCardView{fakeWatchTonightCard()}, HasMore: f.cardsHasMore}
+	return handlers.WatchTonightCardsView{Cards: []handlers.WatchTonightCardView{fakeWatchTonightCard()}, HasMore: f.cardsHasMore}, nil
 }
 
 func recommendationDeps(t *testing.T) (Dependencies, *fakeRecommendations) {
@@ -178,7 +183,7 @@ type recommendationRowDoc struct {
 
 func requireFakeCard(t *testing.T, card map[string]json.RawMessage) {
 	t.Helper()
-	for k, want := range map[string]string{tiebreakerContentID: `"movie:heat-1995"`, "keywords": `[]`, "progress_updated_at": `"2026-01-02T03:04:05.000Z"`, "overlay_summary": `{"resolution":"4K","hdr":"Dolby Vision"}`, "user_state": `{"played":false,"is_favorite":false,"in_watchlist":true}`} {
+	for k, want := range map[string]string{tiebreakerContentID: `"movie:heat-1995"`, "keywords": `[]`, "progress_updated_at": `"2026-01-02T03:04:05.000Z"`, "overlay_summary": `{"resolution":"4K","hdr":"Dolby Vision"}`, "user_state": `{"played":false,"is_favorite":false,"in_watchlist":true,"not_interested":false}`} {
 		if string(card[k]) != want {
 			t.Errorf("%s = %s, want %s", k, card[k], want)
 		}
@@ -235,6 +240,24 @@ func TestRecommendationCardLists(t *testing.T) {
 	requireProblem(t, do(t, newTestHandler(t, deps), http.MethodGet, "/api/v2/recommendations/popular", "", viewerHeaders()), TypeDependencyUnavailable)
 }
 
+// Recommendation reads take the request's artwork sizes like every other
+// card surface: image_size and the per-slot widths reach the card builder.
+func TestRecommendationCardsTakeArtworkSizes(t *testing.T) {
+	deps, fake := recommendationDeps(t)
+	h := newTestHandler(t, deps)
+	rec := do(t, h, http.MethodGet, "/api/v2/recommendations/popular?image_size=medium&backdrop_width=2688&logo_width=1760", "", viewerHeaders())
+	if rec.Code != 200 {
+		t.Fatalf("popular: %d %s", rec.Code, rec.Body.String())
+	}
+	want := imagesize.Request{Size: imagesize.Medium, Widths: imagesize.Widths{Backdrop: 2688, Logo: 1760}}
+	if got := fake.lastFilter.Artwork(); got != want {
+		t.Fatalf("seam artwork = %+v, want %+v", got, want)
+	}
+	for _, query := range []string{"image_size=huge", "backdrop_width=0", "poster_width=7681"} {
+		requireProblem(t, do(t, h, http.MethodGet, "/api/v2/recommendations/popular?"+query, "", viewerHeaders()), TypeValidationFailed)
+	}
+}
+
 func TestRecommendationRows(t *testing.T) {
 	deps, fake := recommendationDeps(t)
 	h := newTestHandler(t, deps)
@@ -307,6 +330,14 @@ func TestRecommendationSection(t *testing.T) {
 	if len(p.Errors) != 1 || p.Errors[0].Location != "query.key" || p.Errors[0].Code != codeRequired {
 		t.Fatalf("errors = %+v", p.Errors)
 	}
+	// A key that cannot name a section is a validation failure, not a
+	// server error.
+	for _, path := range []string{"/section/cluster?key=abc", "/section/cluster?key=-1", "/section/cluster?key=%FF%FE", "/section/genre?key=%FF", "/section/genre?key=Drama%00"} {
+		p := requireProblem(t, do(t, h, http.MethodGet, "/api/v2/recommendations"+path, "", viewerHeaders()), TypeValidationFailed)
+		if len(p.Errors) != 1 || p.Errors[0].Location != "query.key" || p.Errors[0].Code != codeInvalid {
+			t.Fatalf("%s: errors = %+v", path, p.Errors)
+		}
+	}
 	requireProblem(t, do(t, h, http.MethodGet, "/api/v2/recommendations/section/nope", "", viewerHeaders()), TypeValidationFailed)
 	requireProblem(t, do(t, h, http.MethodGet, "/api/v2/recommendations/section/popular?limit=61", "", viewerHeaders()), TypeValidationFailed)
 	requireProblem(t, do(t, h, http.MethodGet, "/api/v2/recommendations/section/popular", "", bearer(memberToken)), TypeValidationFailed)
@@ -493,6 +524,11 @@ func TestRecommendationWatchTonightCards(t *testing.T) {
 	requireProblem(t, do(t, h, http.MethodGet, "/api/v2/recommendations/watch-tonight/cards?mode=discover&limit=21", "", viewerHeaders()), TypeValidationFailed)
 	requireProblem(t, do(t, h, http.MethodGet, "/api/v2/recommendations/watch-tonight/cards?mode=discover", "", bearer(memberToken)), TypeValidationFailed)
 	requireProblem(t, do(t, h, http.MethodGet, "/api/v2/recommendations/watch-tonight/cards?mode=discover", "", nil), TypeAuthenticationRequired)
+	// A failed item lookup is a 500, not an empty page that looks like the
+	// end of the deck.
+	fake.err = &handlers.APIError{Status: http.StatusInternalServerError, Code: "internal_error", Message: "Failed to fetch item details"}
+	requireProblem(t, do(t, h, http.MethodGet, "/api/v2/recommendations/watch-tonight/cards?mode=discover", "", viewerHeaders()), TypeInternalError)
+	fake.err = nil
 	deps.Recommendations = nil
 	requireProblem(t, do(t, newTestHandler(t, deps), http.MethodGet, "/api/v2/recommendations/watch-tonight/cards?mode=discover", "", viewerHeaders()), TypeDependencyUnavailable)
 }
diff --git a/internal/apiv2/registration_helpers.go b/internal/apiv2/registration_helpers.go
index 7c659f9b4a..56b309936e 100644
--- a/internal/apiv2/registration_helpers.go
+++ b/internal/apiv2/registration_helpers.go
@@ -12,7 +12,11 @@ func viewerOperation(op huma.Operation) Operation {
 	return Operation{Operation: op, Class: ClassProfileScoped, ServiceBacked: true}
 }
 
+// viewerNoContentMutation registers a bodiless 204 favorites or watchlist
+// membership write for a verified profile. A repeated add or remove changes
+// no row and the shared seam notifies nobody for it, so the write is
+// naturally idempotent.
 func viewerNoContentMutation(op huma.Operation) Operation {
 	op.DefaultStatus = http.StatusNoContent
-	return Operation{Operation: op, Class: ClassProfileScoped, ServiceBacked: true, RetrySafety: RetrySafetyNonRetryable}
+	return Operation{Operation: op, Class: ClassProfileScoped, ServiceBacked: true, RetrySafety: RetrySafetyNaturalIdempotent}
 }
diff --git a/internal/apiv2/router.go b/internal/apiv2/router.go
index ec5b04fa57..55b058f436 100644
--- a/internal/apiv2/router.go
+++ b/internal/apiv2/router.go
@@ -34,6 +34,7 @@ import (
 	"github.com/prairie-server/prairie-server/internal/recommendations"
 	mediarequests "github.com/prairie-server/prairie-server/internal/requests"
 	"github.com/prairie-server/prairie-server/internal/sections"
+	"github.com/prairie-server/prairie-server/internal/sections/recipes"
 	"github.com/prairie-server/prairie-server/internal/streamtelemetry"
 	"github.com/prairie-server/prairie-server/internal/usercollections"
 	"github.com/prairie-server/prairie-server/internal/userstore"
@@ -75,6 +76,13 @@ func init() {
 type Dependencies struct {
 	ThemeSongs        ThemeSongService
 	ObserveThemeAudio func(string, http.Handler) http.Handler
+	// ObserveDownloadDelivery wraps the managed-download file and subtitle
+	// routes, given method and full path pattern, so their bytes count as
+	// viewer transfer egress like the v1 routes they mirror.
+	ObserveDownloadDelivery func(method, pattern string, handler http.Handler) http.Handler
+	// ObserveBandwidthProbe wraps the bandwidth probe so its bytes count as
+	// viewer transfer egress, like the Jellyfin-compat bitrate test.
+	ObserveBandwidthProbe func(http.Handler) http.Handler
 	// ObserveRoutes receives detached method/path values after this actual router
 	// is fully registered. It cannot mutate or recover the sealed router.
 	ObserveRoutes func([]streamtelemetry.WalkedRoute)
@@ -384,9 +392,16 @@ type Dependencies struct {
 	HomeSections HomeSectionService
 	// Recipes answers the section recipe gallery (*handlers.RecipeHandler).
 	Recipes RecipeService
+	// SeasonalThemes is the holiday catalog listSeasonalThemes serves; nil
+	// serves recipes.SeasonalThemes. Contract fixtures pass their own so the
+	// committed bodies name no real list hosts.
+	SeasonalThemes []recipes.SeasonalTheme
 	// PersonalLists reads and edits a profile's favorites
 	// (*handlers.PersonalDataHandler).
 	PersonalLists PersonalListService
+	// NotInterested reads and edits a profile's Not interested marks
+	// (*handlers.PersonalDataHandler).
+	NotInterested NotInterestedService
 	// WatchlistTitles keeps a profile's watchlist entries for titles the
 	// library doesn't have (*handlers.PersonalDataHandler).
 	WatchlistTitles WatchlistTitleService
@@ -425,7 +440,6 @@ type Dependencies struct {
 	ArtworkBackend                     string
 	ArtworkSigner                      *artworkurl.Signer
 	ArtworkRepair                      ArtworkRepairService
-	ThemeOverrides                     ThemeOverrideService
 	AdminInviteCodes                   AdminInviteCodeService
 	Invitations                        InvitationService
 	PasswordResets                     PasswordResetService
@@ -941,7 +955,8 @@ type LibraryAdminService interface {
 	ListSkippedRoots(ctx context.Context, search string, limit, offset int) ([]handlers.SkippedRootView, int, error)
 	ListStaleIDs(ctx context.Context, search string, limit, offset int) ([]handlers.StaleMediaIDView, int, error)
 	RematchStaleID(ctx context.Context, contentID string) error
-	ListUnmatchedItems(ctx context.Context, search string, limit, offset int) ([]handlers.UnmatchedItemView, int, error)
+	ListUnmatchedItems(ctx context.Context, search string, ignored bool, limit, offset int) ([]handlers.UnmatchedItemView, int, error)
+	SetUnmatchedItemIgnored(ctx context.Context, contentID string, ignored bool) error
 	GetMetadataMatchQueue(ctx context.Context, id, limit, offset int) (handlers.MetadataMatchQueueDetailView, error)
 	RetryMetadataMatchQueue(ctx context.Context, id int) (handlers.MetadataMatchQueueActionView, error)
 	CancelMetadataMatchQueue(ctx context.Context, id int) (handlers.MetadataMatchQueueActionView, error)
@@ -1018,6 +1033,12 @@ type PersonalListService interface {
 	GetWatchlistEntry(ctx context.Context, viewer handlers.PersonalListViewer, itemID string) (entry userstore.WatchlistEntry, found bool, err error)
 	AddToWatchlist(ctx context.Context, viewer handlers.PersonalListViewer, itemID string) error
 	RemoveFromWatchlist(ctx context.Context, viewer handlers.PersonalListViewer, itemID string) error
+	// VisibleItemIDs reports which of the given catalog items the viewer
+	// may see, in one query.
+	VisibleItemIDs(ctx context.Context, viewer handlers.PersonalListViewer, ids []string) (map[string]bool, error)
+	// ResolveCards answers the cards of the given catalog items the viewer
+	// may see, in the order given.
+	ResolveCards(ctx context.Context, viewer handlers.PersonalListViewer, ids []string) ([]handlers.CollectionItemView, error)
 }
 
 // RatingService is the slice of *handlers.RatingsHandler the ratings
@@ -1054,7 +1075,7 @@ type RecommendationService interface {
 	TasteSeedItems(ctx context.Context, userID int, profileID string, filter mediacatalog.AccessFilter, limit, offset int) (items []handlers.SectionItemView, candidates int, err error)
 	SubmitTasteSeed(ctx context.Context, userID int, profileID string, itemIDs []string, filter mediacatalog.AccessFilter) (int, error)
 	WatchTonight(ctx context.Context, userID int, profileID string, filter mediacatalog.AccessFilter, limit int) (handlers.WatchTonightView, error)
-	WatchTonightCards(ctx context.Context, userID int, profileID string, filter mediacatalog.AccessFilter, mode string, genres []string, excludeIDs map[string]struct{}, limit int) handlers.WatchTonightCardsView
+	WatchTonightCards(ctx context.Context, userID int, profileID string, filter mediacatalog.AccessFilter, mode string, genres []string, excludeIDs map[string]struct{}, limit int) (handlers.WatchTonightCardsView, error)
 }
 
 // MediaRequestService is the slice of *requests.Service (the v1
diff --git a/internal/apiv2/schema_ownership_test.go b/internal/apiv2/schema_ownership_test.go
index c451ef81c4..4ac5c40257 100644
--- a/internal/apiv2/schema_ownership_test.go
+++ b/internal/apiv2/schema_ownership_test.go
@@ -13,7 +13,7 @@ var approvedDomainSchemaTypes = map[string]string{
 	"github.com/prairie-server/prairie-server/internal/auth":                  "APIKeyScope",
 	"github.com/prairie-server/prairie-server/internal/catalog":               "AudiobookDetailExtension AudiobookNarration AudiobookPerson AudiobookRelatedContent AudiobookRelatedItem AudiobookSeriesGroup CastCredit CrewCredit EbookDetailExtension ItemExtraInfo ItemVideoInfo MangaChapter MangaDetailExtension Marker SubtitleInfo VersionChapter VersionSubtitleTrack",
 	"github.com/prairie-server/prairie-server/internal/catalogseed":           "ImportResult PathRewrite",
-	"github.com/prairie-server/prairie-server/internal/collections/templates": "Bundle BundleCatalog Catalog CategoryGroup MDBListSpec TMDBCollectionSpec TMDBDiscoverSpec TMDBListSpec TMDBSpec Template TraktSpec",
+	"github.com/prairie-server/prairie-server/internal/collections/templates": "Bundle BundleCatalog Catalog CategoryGroup MDBListSpec TMDBCollectionSpec TMDBDiscoverSpec TMDBListSpec TMDBSpec Template",
 	"github.com/prairie-server/prairie-server/internal/diagnostics":           "IngestResult",
 	"github.com/prairie-server/prairie-server/internal/downloads":             "OfflineAudioTrack OfflineChapter OfflineIdentity OfflineIntegrity OfflineSubtitle SkippedDownload SkippedManifest",
 	"github.com/prairie-server/prairie-server/internal/historyimport":         "ExternalUser",
@@ -21,7 +21,7 @@ var approvedDomainSchemaTypes = map[string]string{
 	"github.com/prairie-server/prairie-server/internal/metadata":              "MatchCandidate TitleAlias",
 	"github.com/prairie-server/prairie-server/internal/models":                "AudioTrack VideoTrack",
 	"github.com/prairie-server/prairie-server/internal/onboarding":            "Flow SettingOption SettingSpec Step StepLink",
-	"github.com/prairie-server/prairie-server/internal/playback":              "AppliedQuirkV3 AudioClaimsV3 AudioPassthroughEntryV3 AudioPassthroughV3 AvailableQualityV3 ClientCapabilities ClientCodecCapabilitiesV3 ClientPlaybackContextV3 DegradationWarningV3 DeliveryCapabilityV3 DeliverySubtitleCapabilitiesV3 DetectedBackend DeviceContextV3 DolbyVisionProfileCapabilityV3 EffectiveRecipeV3 EmbeddedSubtitleV3 FailureV3 HDRCapabilitiesV3 NativeEmbeddedSubtitleCapabilityV3 OutputContextV3 OutputDisplayV3 RenderDeviceInfo SelectedTracksV3 StreamV3 SubtitleArtifactV3 SubtitleClaimsV3 SubtitleDecisionV3 SubtitleInventoryItemV3 TerminalV3 TimelineV3 TrackIdentityV3 TransformationV3 ValidationClaimsV3 VideoClaimsV3 VideoDecodeCapabilityV3",
+	"github.com/prairie-server/prairie-server/internal/playback":              "AppliedQuirkV3 AudioClaimsV3 AudioPassthroughEntryV3 AudioPassthroughV3 AvailableQualityV3 ClientCapabilities ClientCodecCapabilitiesV3 ClientPlaybackContextV3 DegradationWarningV3 DeliveryCapabilityV3 DeliverySubtitleCapabilitiesV3 DetectedBackend DeviceContextV3 DolbyVisionProfileCapabilityV3 EffectiveRecipeV3 EmbeddedSubtitleV3 FailureV3 HDRCapabilitiesV3 HLSSubtitleRenditionV3 NativeEmbeddedSubtitleCapabilityV3 OutputContextV3 OutputDisplayV3 RenderDeviceInfo SelectedTracksV3 StreamV3 SubtitleArtifactV3 SubtitleClaimsV3 SubtitleDecisionV3 SubtitleInventoryItemV3 TerminalV3 TimelineV3 TrackIdentityV3 TransformationV3 ValidationClaimsV3 VideoClaimsV3 VideoDecodeCapabilityV3",
 	"github.com/prairie-server/prairie-server/internal/policy":                "CompileIssue",
 	"github.com/prairie-server/prairie-server/internal/requests":              "FeatureStatus RouterOption",
 	"github.com/prairie-server/prairie-server/internal/streamtelemetry":       "ParityMismatch ParityReport",
diff --git a/internal/apiv2/settings.go b/internal/apiv2/settings.go
index 02d174fc3a..928dd1b466 100644
--- a/internal/apiv2/settings.go
+++ b/internal/apiv2/settings.go
@@ -59,6 +59,7 @@ type SettingsContractCapabilities struct {
 	SupportsBatchedEffective bool     `json:"supports_batched_effective" doc:"Whether the effective resolver accepts a batch of keys" example:"true"`
 	SupportsIdempotentWrites bool     `json:"supports_idempotent_writes" doc:"Whether repeating a value write converges on the same state" example:"true"`
 	SupportsAtomicShortcuts  bool     `json:"supports_atomic_shortcuts" doc:"Whether navigation shortcut list mutations are atomic" example:"true"`
+	SupportsDeviceRename     bool     `json:"supports_device_rename" doc:"Whether updateDevice can give a device a custom name, which listDevices returns as custom_name" example:"true"`
 }
 
 // SettingsContractCapabilitiesOutput is the getSettingsContractCapabilities
@@ -434,6 +435,7 @@ func (reg *Registry) getSettingsContractCapabilities(ctx context.Context, _ *Cap
 		SupportsBatchedEffective: view.SupportsBatchedEffective,
 		SupportsIdempotentWrites: view.SupportsIdempotentWrites,
 		SupportsAtomicShortcuts:  view.SupportsAtomicShortcuts,
+		SupportsDeviceRename:     reg.deps.DeviceSettings != nil,
 	}}, nil
 }
 
diff --git a/internal/apiv2/settings_test.go b/internal/apiv2/settings_test.go
index ab845d63b8..bfd2f7ad10 100644
--- a/internal/apiv2/settings_test.go
+++ b/internal/apiv2/settings_test.go
@@ -53,10 +53,16 @@ func TestGetSettingsContractCapabilities(t *testing.T) {
 	if rec.Code != 200 {
 		t.Fatal(rec.Body.String())
 	}
-	want := `{"api_version":1,"manifest_revision":12,"contract_etag":"\"etag-12\"","definition_count":40,"scopes":["account","profile"],"client_families":["tv","web"],"supports_batched_effective":true,"supports_idempotent_writes":true,"supports_atomic_shortcuts":true}` + "\n"
+	want := `{"api_version":1,"manifest_revision":12,"contract_etag":"\"etag-12\"","definition_count":40,"scopes":["account","profile"],"client_families":["tv","web"],"supports_batched_effective":true,"supports_idempotent_writes":true,"supports_atomic_shortcuts":true,"supports_device_rename":false}` + "\n"
 	if !capabilityBodyMatches(t, rec.Body.Bytes(), want) {
 		t.Fatalf("body = %s", rec.Body.String())
 	}
+	withDevices := pilotDeps(nil, nil)
+	withDevices.DeviceSettings = &fakeDeviceSettings{}
+	renamable := do(t, newTestHandler(t, withDevices), http.MethodGet, "/api/v2/settings/contract/capabilities", "", bearer(memberToken))
+	if !strings.Contains(renamable.Body.String(), `"supports_device_rename":true`) {
+		t.Fatalf("device settings wired, body = %s", renamable.Body.String())
+	}
 	deps := pilotDeps(nil, nil)
 	deps.SettingsContract = nil
 	missing := do(t, newTestHandler(t, deps), http.MethodGet, "/api/v2/settings/contract/capabilities", "", bearer(memberToken))
diff --git a/internal/apiv2/shuffles.go b/internal/apiv2/shuffles.go
index f0248f289c..e68120638d 100644
--- a/internal/apiv2/shuffles.go
+++ b/internal/apiv2/shuffles.go
@@ -7,6 +7,7 @@ import (
 
 	"github.com/prairie-server/prairie-server/internal/api/handlers"
 	catalogpkg "github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/imagesize"
 	"github.com/prairie-server/prairie-server/internal/shuffle"
 )
 
@@ -76,14 +77,14 @@ type SkipShuffleItemRequest struct {
 
 // CreateShuffleInput is the createShuffle request.
 type CreateShuffleInput struct {
-	ImageSize string `query:"image_size" enum:"small,medium,large,original" doc:"Artwork variant to presign on the item cards"`
-	Body      CreateShuffleRequest
+	ArtworkQuery
+	Body CreateShuffleRequest
 }
 
 // ShuffleInput names one shuffle.
 type ShuffleInput struct {
 	ShuffleID string `path:"shuffle_id" doc:"Shuffle id"`
-	ImageSize string `query:"image_size" enum:"small,medium,large,original" doc:"Artwork variant to presign on the item cards"`
+	ArtworkQuery
 }
 
 // DeleteShuffleInput names the shuffle to stop.
@@ -166,7 +167,7 @@ func (reg *Registry) getShuffleCapability(ctx context.Context, _ *CapabilityInpu
 
 // shuffleViewer resolves what every shuffle operation needs: the service,
 // the owner, and the viewer the item cards render for.
-func (reg *Registry) shuffleViewer(ctx context.Context, imageSize string) (ShuffleAPI, shuffle.Owner, handlers.ItemViewer, *Problem) {
+func (reg *Registry) shuffleViewer(ctx context.Context, art imagesize.Request) (ShuffleAPI, shuffle.Owner, handlers.ItemViewer, *Problem) {
 	if reg.deps.Shuffles == nil {
 		return nil, shuffle.Owner{}, handlers.ItemViewer{}, unavailable("shuffle")
 	}
@@ -177,7 +178,7 @@ func (reg *Registry) shuffleViewer(ctx context.Context, imageSize string) (Shuff
 	if p != nil {
 		return nil, shuffle.Owner{}, handlers.ItemViewer{}, p
 	}
-	viewer, p := reg.itemViewer(ctx, imageSize, "", "")
+	viewer, p := reg.itemViewer(ctx, art, "", "")
 	if p != nil {
 		return nil, shuffle.Owner{}, handlers.ItemViewer{}, p
 	}
@@ -185,7 +186,7 @@ func (reg *Registry) shuffleViewer(ctx context.Context, imageSize string) (Shuff
 }
 
 func (reg *Registry) createShuffle(ctx context.Context, in *CreateShuffleInput) (*ShuffleCreatedOutput, error) {
-	svc, owner, viewer, p := reg.shuffleViewer(ctx, in.ImageSize)
+	svc, owner, viewer, p := reg.shuffleViewer(ctx, in.Artwork())
 	if p != nil {
 		return nil, p
 	}
@@ -202,7 +203,7 @@ func (reg *Registry) createShuffle(ctx context.Context, in *CreateShuffleInput)
 }
 
 func (reg *Registry) getShuffle(ctx context.Context, in *ShuffleInput) (*ShuffleOutput, error) {
-	svc, owner, viewer, p := reg.shuffleViewer(ctx, in.ImageSize)
+	svc, owner, viewer, p := reg.shuffleViewer(ctx, in.Artwork())
 	if p != nil {
 		return nil, p
 	}
@@ -214,7 +215,7 @@ func (reg *Registry) getShuffle(ctx context.Context, in *ShuffleInput) (*Shuffle
 }
 
 func (reg *Registry) advanceShuffle(ctx context.Context, in *AdvanceShuffleInput) (*ShuffleOutput, error) {
-	svc, owner, viewer, p := reg.shuffleViewer(ctx, in.ImageSize)
+	svc, owner, viewer, p := reg.shuffleViewer(ctx, in.Artwork())
 	if p != nil {
 		return nil, p
 	}
@@ -226,7 +227,7 @@ func (reg *Registry) advanceShuffle(ctx context.Context, in *AdvanceShuffleInput
 }
 
 func (reg *Registry) skipShuffleItem(ctx context.Context, in *SkipShuffleItemInput) (*ShuffleOutput, error) {
-	svc, owner, viewer, p := reg.shuffleViewer(ctx, in.ImageSize)
+	svc, owner, viewer, p := reg.shuffleViewer(ctx, in.Artwork())
 	if p != nil {
 		return nil, p
 	}
diff --git a/internal/apiv2/socket_helpers.go b/internal/apiv2/socket_helpers.go
index dabea82ea6..8775087c5d 100644
--- a/internal/apiv2/socket_helpers.go
+++ b/internal/apiv2/socket_helpers.go
@@ -21,10 +21,19 @@ func socketIdentity(ctx context.Context) (evt.SocketIdentity, *Problem) {
 	identity := evt.SocketIdentity{ImpersonatorUserID: claims.ImpersonatorUserID, UserID: claims.UserID, SessionID: claims.SessionID, Role: claims.Role, ProfileID: profileFrom(ctx), AccessExpiresAt: claims.ExpiresAt.Time}
 	if r := requestFrom(ctx); r != nil {
 		identity.ProfileToken = r.Header.Get(profileTokenHeader)
+		identity.DeviceID = socketDeviceID(r)
 	}
 	return identity, nil
 }
 
+// socketDeviceID is the request's X-Prairie-Device-Id as a ticket keeps it for
+// the acting-admin decision. An id sign-in would not record (over 128
+// characters, or not shaped like one) is dropped rather than held with the
+// ticket.
+func socketDeviceID(r *http.Request) string {
+	return auth.ClientDeviceFromHeaders(r.Header).ID
+}
+
 func socketResponses(statuses []string, refused, established, headerDescription string) map[string]*huma.Response {
 	responses := map[string]*huma.Response{}
 	for _, status := range statuses {
diff --git a/internal/apiv2/socket_helpers_device_test.go b/internal/apiv2/socket_helpers_device_test.go
new file mode 100644
index 0000000000..eb0cd9a0bb
--- /dev/null
+++ b/internal/apiv2/socket_helpers_device_test.go
@@ -0,0 +1,29 @@
+package apiv2
+
+import (
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// A ticket keeps the device id sign-in would record, and nothing longer.
+func TestSocketDeviceIDKeepsOnlyARecordableID(t *testing.T) {
+	for _, tc := range []struct {
+		name, header, want string
+	}{
+		{"uuid", "8d2f6a4e-3c1b-4e5f-9a7d-0b1c2d3e4f50", "8d2f6a4e-3c1b-4e5f-9a7d-0b1c2d3e4f50"},
+		{"at the limit", strings.Repeat("a", 128), strings.Repeat("a", 128)},
+		{"over the limit", strings.Repeat("a", 512<<10), ""},
+		{"absent", "", ""},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			r := httptest.NewRequest("POST", "/api/v2/events/ws-ticket", nil)
+			if tc.header != "" {
+				r.Header.Set(deviceIDHeader, tc.header)
+			}
+			if got := socketDeviceID(r); got != tc.want {
+				t.Fatalf("socketDeviceID = %.40q (len %d), want %.40q", got, len(got), tc.want)
+			}
+		})
+	}
+}
diff --git a/internal/apiv2/stream_response_writer.go b/internal/apiv2/stream_response_writer.go
index 1ee7d0c993..fe5ed3b497 100644
--- a/internal/apiv2/stream_response_writer.go
+++ b/internal/apiv2/stream_response_writer.go
@@ -1,7 +1,10 @@
 package apiv2
 
 import (
+	"io"
 	"net/http"
+
+	"github.com/prairie-server/prairie-server/internal/httpstream"
 )
 
 // streamResponseWriter adapts legacy byte handlers to the v2 problem format.
@@ -52,6 +55,24 @@ func (w *streamResponseWriter) Write(data []byte) (int, error) {
 	return w.ResponseWriter.Write(data)
 }
 
+// ReadFrom keeps the sendfile path for file bodies. io.Copy finds
+// io.ReaderFrom only by direct assertion, so without it every byte behind this
+// writer goes through a 32 KB buffer. http.ServeContent commits its status
+// before copying, so a file body reaches the wrapped writer's ReadFrom.
+//
+// A copy that starts before any status goes through Write instead. Forwarding
+// it would let the wrapped writer commit 200 without this writer knowing, so a
+// later failure would append a problem body to the media instead of aborting;
+// committing 200 first would lose the problem response of a source that fails
+// before its first byte. Write commits only on the first byte, and discards
+// the body after a rejected status.
+func (w *streamResponseWriter) ReadFrom(src io.Reader) (int64, error) {
+	if w.status == 0 || w.rejected {
+		return io.Copy(httpstream.WriterOnly(w), src)
+	}
+	return httpstream.ForwardReadFrom(w.ResponseWriter, w, src, 0, nil)
+}
+
 func (w *streamResponseWriter) FlushError() error {
 	if w.status == 0 {
 		w.WriteHeader(http.StatusOK)
diff --git a/internal/apiv2/subtitle_reads.go b/internal/apiv2/subtitle_reads.go
index a3e892cba5..4301060872 100644
--- a/internal/apiv2/subtitle_reads.go
+++ b/internal/apiv2/subtitle_reads.go
@@ -123,8 +123,9 @@ func registerSubtitleReads(reg *Registry) {
 			}
 			out.Results = append(out.Results, result)
 		}
-		// Provider errors can contain credential-bearing upstream URLs. The
-		// bridge preserves its old warnings; v2 exposes only a bounded summary.
+		// Provider errors can contain credential-bearing upstream URLs, so the
+		// manager reports each failed provider by name only; v2 goes further and
+		// exposes one bounded summary.
 		if len(view.Warnings) > 0 {
 			out.Warnings = append(out.Warnings, "One or more subtitle providers could not complete the search.")
 		}
diff --git a/internal/apiv2/system_identity.go b/internal/apiv2/system_identity.go
index 25a7cbfb79..8227adbb08 100644
--- a/internal/apiv2/system_identity.go
+++ b/internal/apiv2/system_identity.go
@@ -24,7 +24,9 @@ import (
 // The identity alone authorizes nothing: it is public and any host can echo
 // one. Clients pair or send credentials to an alternate address only after
 // the existing device-login approval, which proves both addresses share one
-// backend, has succeeded there.
+// backend, has succeeded there, or, for the API server's own local-network
+// address, after TLS there presents the key pinned in the connections
+// document (internal/lantls).
 
 // ServerIdentityService reads the deployment's stable native server identity.
 // *serveridentity.Service implements it.
@@ -33,12 +35,15 @@ type ServerIdentityService interface {
 }
 
 // ServerConnections is where the connections document reads the deployment's
-// client-facing addresses from: the configured public URL, read live so a
-// settings change applies without restart, and the API host's provider
-// status cache for overlay origins. Both are optional.
+// client-facing addresses from: the configured public and local URLs, read
+// live so a settings change applies without restart, the API host's provider
+// status cache for overlay origins, and the pin of the API listener's
+// local-network TLS key. All are optional.
 type ServerConnections struct {
-	PublicURL func() string
-	Providers *netaccess.StatusCache
+	PublicURL   func() string
+	LocalURL    func() string
+	Providers   *netaccess.StatusCache
+	LocalTLSPin string
 }
 
 // ServerIdentity is the public identity document.
@@ -126,12 +131,22 @@ func (ServerAccessPath) Schema(r huma.Registry) *huma.Schema {
 	}}
 }
 
+// ServerLocalRoute tells a signed-in client how to reach the API server
+// directly on the local network: the key the API listener presents over TLS
+// on its own port, and the admin-configured local address when there is one.
+// Clients use a local address only over TLS that presents this key.
+type ServerLocalRoute struct {
+	SPKISHA256 string `json:"spki_sha256" doc:"Base64 SHA-256 of the SubjectPublicKeyInfo of the certificate the API listener presents over TLS on its own port. A client accepts a local-network address only when TLS there presents this key, and learns it only over an address it already trusts. Derived from SECRET_KEY, so it changes when that key is rotated." example:"n4bQgYhMfWWaL+qgxVrQFaO/TxsrC4Is0V1sFbDwCgg="`
+	URL        string `json:"url,omitempty" doc:"server.local_url: scheme://host[:port] of the API server on the local network, when an admin set one. Clients connect with https on the same host and port, whatever the scheme says, and require the pinned key. Absent when unset; clients may still find local addresses through LAN discovery." example:"http://192.168.1.20:8080"`
+}
+
 // ServerConnectionsDocument is the connections capability document.
 type ServerConnectionsDocument struct {
 	Capability
-	ServerID  string           `json:"server_id" doc:"The same identity getServerIdentity reports"`
-	Current   ServerAccessPath `json:"current" doc:"How this request reached the server"`
-	Endpoints []ServerEndpoint `json:"endpoints" doc:"Addresses the deployment offers, public first then providers in slug order; empty when no public URL is configured and no provider is installed. Reachability is the client's to test."`
+	ServerID   string            `json:"server_id" doc:"The same identity getServerIdentity reports"`
+	Current    ServerAccessPath  `json:"current" doc:"How this request reached the server"`
+	Endpoints  []ServerEndpoint  `json:"endpoints" doc:"Addresses the deployment offers, public first then providers in slug order; empty when no public URL is configured and no provider is installed. Reachability is the client's to test."`
+	LocalRoute *ServerLocalRoute `json:"local_route,omitempty" doc:"How to reach the API server directly on the local network; absent on a server whose API port does not answer TLS."`
 }
 
 // ServerConnectionsOutput is the getServerConnections response.
@@ -171,6 +186,19 @@ func (reg *Registry) serverID(ctx context.Context) (string, error) {
 	return id, nil
 }
 
+// knownServerID is the identity for a response that names it as a courtesy
+// and must not fail over it: empty when the identity cannot be read.
+func (reg *Registry) knownServerID(ctx context.Context) string {
+	if reg.deps.ServerIdentity == nil {
+		return ""
+	}
+	id, err := reg.deps.ServerIdentity.ServerID(ctx)
+	if err != nil {
+		return ""
+	}
+	return id
+}
+
 func (reg *Registry) getServerIdentity(ctx context.Context, _ *struct{}) (*ServerIdentityOutput, error) {
 	id, err := reg.serverID(ctx)
 	if err != nil {
@@ -194,6 +222,14 @@ func (reg *Registry) getServerConnections(ctx context.Context, _ *CapabilityInpu
 			doc.Endpoints = append(doc.Endpoints, ServerEndpoint{Kind: EndpointKindPublic, URL: origin})
 		}
 	}
+	if connections.LocalTLSPin != "" {
+		doc.LocalRoute = &ServerLocalRoute{SPKISHA256: connections.LocalTLSPin}
+		if connections.LocalURL != nil {
+			if origin, ok := netaccess.NormalizeOrigin(connections.LocalURL()); ok {
+				doc.LocalRoute.URL = origin
+			}
+		}
+	}
 	if reg.deps.NetworkAccess != nil {
 		providers, err := reg.deps.NetworkAccess.ListNetworkAccessProviders(ctx)
 		if err != nil {
diff --git a/internal/apiv2/system_identity_fixtures_test.go b/internal/apiv2/system_identity_fixtures_test.go
index 08d5412a8b..70e89962ed 100644
--- a/internal/apiv2/system_identity_fixtures_test.go
+++ b/internal/apiv2/system_identity_fixtures_test.go
@@ -5,6 +5,6 @@ import "net/http"
 func serverIdentityFixtureCases() []fixtureCase {
 	return []fixtureCase{
 		{name: "server_identity_ok", operationID: "getServerIdentity", scenario: "Discovery before login: the deployment's stable server identity, the same at every address.", method: http.MethodGet, path: Prefix + "/system/identity", status: 200, assertHeaders: []string{"Content-Type", "Cache-Control"}, schema: "#/components/schemas/ServerIdentity"},
-		{name: "server_connections_ok", operationID: "getServerConnections", scenario: "A signed-in client reads the addresses the deployment offers: the public URL, a connected provider with its overlay origin, and an installed provider whose plugin is not running.", method: http.MethodGet, path: Prefix + "/system/connections", headers: bearer(memberToken), status: 200, assertHeaders: []string{"Content-Type", "Cache-Control", "ETag"}, schema: "#/components/schemas/ServerConnectionsDocument"},
+		{name: "server_connections_ok", operationID: "getServerConnections", scenario: "A signed-in client reads the addresses the deployment offers: the public URL, a connected provider with its overlay origin, and an installed provider whose plugin is not running, and the local route: the pin of the key the API listener presents over TLS and the admin-set local address.", method: http.MethodGet, path: Prefix + "/system/connections", headers: bearer(memberToken), status: 200, assertHeaders: []string{"Content-Type", "Cache-Control", "ETag"}, schema: "#/components/schemas/ServerConnectionsDocument"},
 	}
 }
diff --git a/internal/apiv2/system_identity_test.go b/internal/apiv2/system_identity_test.go
index c95969cf3f..b3f2fbd64e 100644
--- a/internal/apiv2/system_identity_test.go
+++ b/internal/apiv2/system_identity_test.go
@@ -22,11 +22,12 @@ func (f fakeServerIdentity) ServerID(context.Context) (string, error) { return f
 const fixtureServerID = "3f2a9d5e-6b1c-4c7e-9a0d-2f4b8c1e7a35"
 
 type connectionsDoc struct {
-	State     string `json:"state"`
-	Allowed   bool   `json:"allowed"`
-	ServerID  string `json:"server_id"`
-	Current   ServerAccessPath
-	Endpoints []ServerEndpoint `json:"endpoints"`
+	State      string `json:"state"`
+	Allowed    bool   `json:"allowed"`
+	ServerID   string `json:"server_id"`
+	Current    ServerAccessPath
+	Endpoints  []ServerEndpoint  `json:"endpoints"`
+	LocalRoute *ServerLocalRoute `json:"local_route"`
 }
 
 func decodeConnections(t *testing.T, rec *httptest.ResponseRecorder) connectionsDoc {
@@ -90,7 +91,14 @@ func TestGetServerConnections(t *testing.T) {
 	cache := netaccess.NewStatusCache()
 	cache.Report(netaccess.Status{InstallationID: 7, Provider: "stub", State: netaccess.StateConnected, Origin: "HTTPS://Silo.Overlay.Example.Test/"})
 	publicURL := "https://silo.example.test/"
-	deps.ServerConnections = ServerConnections{PublicURL: func() string { return publicURL }, Providers: cache}
+	localURL := "HTTP://192.168.1.20:8080/"
+	const pin = "n4bQgYhMfWWaL+qgxVrQFaO/TxsrC4Is0V1sFbDwCgg="
+	deps.ServerConnections = ServerConnections{
+		PublicURL:   func() string { return publicURL },
+		LocalURL:    func() string { return localURL },
+		Providers:   cache,
+		LocalTLSPin: pin,
+	}
 	h := newTestHandler(t, deps)
 	path := Prefix + "/system/connections"
 
@@ -104,6 +112,9 @@ func TestGetServerConnections(t *testing.T) {
 	if doc.Current.Kind != AccessPathDefault || doc.Current.Provider != "" {
 		t.Fatalf("current = %+v", doc.Current)
 	}
+	if doc.LocalRoute == nil || *doc.LocalRoute != (ServerLocalRoute{SPKISHA256: pin, URL: "http://192.168.1.20:8080"}) {
+		t.Fatalf("local_route = %+v", doc.LocalRoute)
+	}
 	want := []ServerEndpoint{
 		{Kind: EndpointKindPublic, URL: "https://silo.example.test"},
 		{Kind: EndpointKindProvider, Provider: "down", DisplayName: "Down Overlay", State: netaccess.StateUnavailable},
@@ -139,13 +150,17 @@ func TestGetServerConnections(t *testing.T) {
 		t.Fatalf("coerced state = %+v", doc.Endpoints[2])
 	}
 
-	// No public URL: the endpoint is absent, never manufactured. An
-	// unparsable one is treated the same.
+	// No public or local URL: the endpoint and the local url are absent,
+	// never manufactured. An unparsable one is treated the same. The pin
+	// stays: LAN discovery still supplies local addresses.
 	for _, raw := range []string{"", "not a url", "ftp://silo.example.test"} {
-		publicURL = raw
+		publicURL, localURL = raw, raw
 		doc = decodeConnections(t, do(t, h, http.MethodGet, path, "", bearer(memberToken)))
 		if len(doc.Endpoints) != 2 || doc.Endpoints[0].Kind != EndpointKindProvider {
-			t.Fatalf("public_url=%q endpoints = %+v", raw, doc.Endpoints)
+			t.Fatalf("url=%q endpoints = %+v", raw, doc.Endpoints)
+		}
+		if doc.LocalRoute == nil || doc.LocalRoute.URL != "" || doc.LocalRoute.SPKISHA256 != pin {
+			t.Fatalf("url=%q local_route = %+v", raw, doc.LocalRoute)
 		}
 	}
 }
@@ -163,8 +178,9 @@ func TestGetServerConnectionsCurrentPath(t *testing.T) {
 	if doc.Current.Kind != EndpointKindProvider || doc.Current.Provider != "tailscale" {
 		t.Fatalf("current = %+v", doc.Current)
 	}
-	// Nothing wired beyond identity: an empty, still-available document.
-	if doc.State != StateAvailable || len(doc.Endpoints) != 0 {
+	// Nothing wired beyond identity: an empty, still-available document
+	// with no local route.
+	if doc.State != StateAvailable || len(doc.Endpoints) != 0 || doc.LocalRoute != nil {
 		t.Fatalf("doc = %+v", doc)
 	}
 }
diff --git a/internal/apiv2/theme_songs.go b/internal/apiv2/theme_songs.go
index 3a34e4840f..c3c4080260 100644
--- a/internal/apiv2/theme_songs.go
+++ b/internal/apiv2/theme_songs.go
@@ -14,6 +14,7 @@ import (
 	"github.com/go-chi/chi/v5"
 
 	catalogpkg "github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/imagesize"
 	"github.com/prairie-server/prairie-server/internal/themedelivery"
 	"github.com/prairie-server/prairie-server/internal/themesongs"
 )
@@ -106,7 +107,7 @@ func registerThemeSongs(reg *Registry) {
 		if !capabilityLoginAllowed(ctx) {
 			return nil, NewProblem(TypeAuthenticationRequired, "A current login session is required.")
 		}
-		viewer, p := reg.itemViewer(ctx, "", "", "")
+		viewer, p := reg.itemViewer(ctx, imagesize.Request{}, "", "")
 		if p != nil {
 			return nil, p
 		}
diff --git a/internal/apiv2/theme_songs_test.go b/internal/apiv2/theme_songs_test.go
index 98b1f07a6e..9413aee1d0 100644
--- a/internal/apiv2/theme_songs_test.go
+++ b/internal/apiv2/theme_songs_test.go
@@ -4,7 +4,9 @@ import (
 	"context"
 	"errors"
 	"net/http"
+	"net/http/httptest"
 	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 	"time"
@@ -126,6 +128,40 @@ func TestThemeSongsContractAndAuthorization(t *testing.T) {
 	}
 }
 
+// originalThemeSongs grants every audio request the original file at path.
+type originalThemeSongs struct {
+	fakeThemeSongs
+	path string
+}
+
+func (s *originalThemeSongs) OpenGrant(context.Context, string, string, string) (themesongs.File, themesongs.Delivery, *os.File, error) {
+	f, err := os.Open(s.path)
+	if err != nil {
+		return themesongs.File{}, "", nil, err
+	}
+	file := themesongs.File{Song: themesongs.Song{ID: "7", Title: "Opening", Container: "mp3"}, Size: 64 << 10, Modified: time.Unix(1700000000, 0)}
+	return file, themesongs.DeliveryOriginal, f, nil
+}
+
+// Original theme audio must reach the connection's ReadFrom with the file
+// still visible to sendfile, as TestPlaybackDeliveryKeepsZeroCopy checks for
+// the stream route.
+func TestThemeSongAudioKeepsZeroCopy(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "theme.mp3")
+	body := strings.Repeat("x", 64<<10)
+	if err := os.WriteFile(path, []byte(body), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	deps, _ := catalogDeps(t)
+	deps.ThemeSongs = &originalThemeSongs{path: path}
+	h := newTestHandler(t, deps)
+	inner := &zeroCopyWriter{ResponseRecorder: httptest.NewRecorder()}
+	h.ServeHTTP(inner, httptest.NewRequest(http.MethodGet, Prefix+"/catalog/items/movie:heat-1995/themes/7/audio?token=grant", nil))
+	if inner.Code != http.StatusOK || inner.Body.String() != body || inner.fromFile != int64(len(body)) {
+		t.Fatalf("status %d, body %d bytes, %d of them read from the file by ReadFrom", inner.Code, inner.Body.Len(), inner.fromFile)
+	}
+}
+
 func themeSongsFixtureCases() []fixtureCase {
 	return []fixtureCase{
 		{name: "theme_songs_capability", operationID: "getThemeSongsCapability", method: "GET", path: Prefix + "/catalog/themes/capabilities", headers: themeSongHeaders(), status: 200, assertHeaders: []string{"Content-Type", "Cache-Control", "ETag"}, schema: "#/components/schemas/ThemeSongsCapability", scenario: "A profile can discover routed theme audio, conversion and cluster delivery."},
diff --git a/internal/apiv2/watch.go b/internal/apiv2/watch.go
index 2017194b45..66c6389197 100644
--- a/internal/apiv2/watch.go
+++ b/internal/apiv2/watch.go
@@ -8,7 +8,6 @@ import (
 
 	"github.com/prairie-server/prairie-server/internal/api/handlers"
 	catalogpkg "github.com/prairie-server/prairie-server/internal/catalog"
-	"github.com/prairie-server/prairie-server/internal/imagesize"
 	"github.com/prairie-server/prairie-server/internal/models"
 	"github.com/prairie-server/prairie-server/internal/userstore"
 )
@@ -22,7 +21,7 @@ type WatchDetailInput struct {
 	ID        ID     `path:"id" doc:"A movie, episode, audiobook or ebook; a series is not directly playable" example:"movie:heat-1995"`
 	FileID    ID     `query:"file_id" doc:"Prefer this file when the item has several versions" example:"42"`
 	LibraryID ID     `query:"library_id" doc:"Present the item as a member of this library" example:"1"`
-	ImageSize string `query:"image_size" enum:"small,medium,large,original" doc:"Artwork variant to presign; absent picks each surface's default" example:"medium"`
+	ArtworkQuery
 }
 
 // WatchDetailOutput is the getWatchState response.
@@ -58,6 +57,10 @@ type WatchDetail struct {
 	EffectiveVersionHDR             *bool                   `json:"effective_version_hdr,omitempty"`
 	EffectiveVersionCodecVideo      *string                 `json:"effective_version_codec_video,omitempty"`
 	EffectiveVersionEditionKey      *string                 `json:"effective_version_edition_key,omitempty"`
+	PosterURL                       string                  `json:"poster_url,omitempty" doc:"The item's poster, an episode's still, or an extra's parent poster, sized by image_size; for system media controls"`
+	PosterThumbhash                 string                  `json:"poster_thumbhash,omitempty"`
+	BackdropURL                     string                  `json:"backdrop_url,omitempty" doc:"The item's backdrop, an episode's series backdrop, or an extra's parent backdrop, sized by image_size"`
+	BackdropThumbhash               string                  `json:"backdrop_thumbhash,omitempty"`
 }
 
 // WatchFileVersion is one playable file of the item.
@@ -303,9 +306,8 @@ func (reg *Registry) getWatchState(ctx context.Context, in *WatchDetailInput) (*
 		}
 		opts.PresentationLibraryID = &n
 	}
-	if size, err := imagesize.Parse(in.ImageSize); err == nil {
-		opts.ImageSize = size
-	}
+	art := in.Artwork()
+	opts.ImageSize, opts.ImageWidths = art.Size, art.Widths
 	filter, err := reg.deps.Watch.ContextAccessFilter(ctx, opts)
 	if err != nil {
 		return nil, NewProblem(TypeInternalError, "An unexpected error occurred.")
@@ -320,9 +322,15 @@ func (reg *Registry) getWatchState(ctx context.Context, in *WatchDetailInput) (*
 // watchDetailProblem maps a watch detail error to its problem: a target that
 // is not directly playable fails validation of the path.
 func watchDetailProblem(err error) error {
+	return watchTargetProblem(err, locationPathID)
+}
+
+// watchTargetProblem maps a watch-state error to its problem: a target the
+// operation cannot act on fails validation of the path parameter at location.
+func watchTargetProblem(err error, location string) error {
 	if apiErr, ok := errors.AsType[*handlers.APIError](err); ok && apiErr.Code == "invalid_watch_target" {
 		return NewProblem(TypeValidationFailed, "The request did not pass validation; see errors.").
-			WithErrors(ProblemError{Location: locationPathID, Code: codeInvalid, Detail: apiErr.Message})
+			WithErrors(ProblemError{Location: location, Code: codeInvalid, Detail: apiErr.Message})
 	}
 	return serviceProblem(err)
 }
@@ -369,6 +377,10 @@ func watchDetailOf(d *catalogpkg.WatchDetail) WatchDetail {
 		EffectiveVersionHDR:        d.EffectiveVersionHDR,
 		EffectiveVersionCodecVideo: d.EffectiveVersionCodecVideo,
 		EffectiveVersionEditionKey: d.EffectiveVersionEditionKey,
+		PosterURL:                  d.PosterURL,
+		PosterThumbhash:            d.PosterThumbhash,
+		BackdropURL:                d.BackdropURL,
+		BackdropThumbhash:          d.BackdropThumbhash,
 	}
 	for _, s := range d.Subtitles {
 		out.Subtitles = append(out.Subtitles, WatchSubtitle{Source: s.Source, Language: s.Language, Codec: s.Codec, Forced: s.Forced, HearingImpaired: s.HearingImpaired, Title: s.Title})
@@ -516,4 +528,5 @@ type WatchService interface {
 	ContextAccessFilter(ctx context.Context, opts handlers.AccessFilterOptions) (catalogpkg.AccessFilter, error)
 	WatchDetail(ctx context.Context, userID int, profileID, contentID string, filter catalogpkg.AccessFilter) (*catalogpkg.WatchDetail, error)
 	SetWatchedState(ctx context.Context, userID int, profileID, contentID string, played bool, filter catalogpkg.AccessFilter) (handlers.WatchedStateView, error)
+	ClearResumePosition(ctx context.Context, userID int, profileID, contentID string, filter catalogpkg.AccessFilter) error
 }
diff --git a/internal/apiv2/watch_test.go b/internal/apiv2/watch_test.go
index 3a055c2966..b997e71ea2 100644
--- a/internal/apiv2/watch_test.go
+++ b/internal/apiv2/watch_test.go
@@ -17,6 +17,7 @@ import (
 type fakeWatch struct {
 	filters   []catalogpkg.AccessFilter
 	marks     []fakeMark
+	clears    []fakeMark
 	err       error
 	trickplay *catalogpkg.TrickplayGrid
 }
@@ -46,6 +47,8 @@ func (f *fakeWatch) WatchDetail(_ context.Context, userID int, profileID, conten
 		detail := &catalogpkg.WatchDetail{
 			ContentID: contentID, Type: "movie", Title: "Heat", Year: 1995,
 			EffectiveSubtitleLanguage: "eng", HasEffectiveSubtitleLang: true,
+			PosterURL: "/api/images/poster/heat.jpg?size=medium", PosterThumbhash: "poster-hash",
+			BackdropURL: "/api/images/backdrop/heat.jpg?size=medium", BackdropThumbhash: "backdrop-hash",
 			Versions: []catalogpkg.FileVersion{{
 				FileID: 42, Resolution: "1080p", CodecVideo: "h264", CodecAudio: "eac3", Container: "mkv", FileSize: 1024, Duration: 10200, Bitrate: 8000000,
 				AddedAt:        time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC),
@@ -80,6 +83,20 @@ func (f *fakeWatch) SetWatchedState(_ context.Context, userID int, profileID, co
 	return handlers.WatchedStateView{ContentID: contentID, Type: "movie", AffectedCount: 1, Played: played}, nil
 }
 
+func (f *fakeWatch) ClearResumePosition(_ context.Context, userID int, profileID, contentID string, _ catalogpkg.AccessFilter) error {
+	if f.err != nil {
+		return f.err
+	}
+	switch contentID {
+	case "series:heat":
+		return &handlers.APIError{Status: http.StatusBadRequest, Code: "invalid_watch_target", Message: "Only a movie or an episode has a resume position"}
+	case "movie:heat-1995":
+		f.clears = append(f.clears, fakeMark{userID: userID, profileID: profileID, contentID: contentID})
+		return nil
+	}
+	return &handlers.APIError{Status: http.StatusNotFound, Code: "not_found", Message: "Item not found"}
+}
+
 func watchDeps(watch *fakeWatch) Dependencies {
 	deps := pilotDeps(nil, nil)
 	deps.Watch = watch
@@ -102,6 +119,11 @@ func TestGetWatchState(t *testing.T) {
 	if body["content_id"] != "movie:heat-1995" || body["effective_subtitle_language"] != "eng" || body["effective_subtitle_mode"] != nil {
 		t.Fatalf("body = %s", rec.Body.String())
 	}
+	// The artwork system media controls show (#803).
+	if body["poster_url"] != "/api/images/poster/heat.jpg?size=medium" || body["poster_thumbhash"] != "poster-hash" ||
+		body["backdrop_url"] != "/api/images/backdrop/heat.jpg?size=medium" || body["backdrop_thumbhash"] != "backdrop-hash" {
+		t.Fatalf("artwork in body = %s", rec.Body.String())
+	}
 	versions := body["versions"].([]any)
 	v := versions[0].(map[string]any)
 	if v["file_id"] != "42" || v["duration_seconds"].(float64) != 10200 || v["added_at"] != "2026-01-02T03:04:05.000Z" || v["intro"].(map[string]any)["end_seconds"].(float64) != 90 || v["trickplay_available"] != true {
@@ -194,6 +216,73 @@ func TestMarkWatched(t *testing.T) {
 	requireProblem(t, do(t, off, http.MethodPost, "/api/v2/watched/movie:heat-1995", "", owner), TypeDependencyUnavailable)
 }
 
+func TestClearResumePosition(t *testing.T) {
+	watch := &fakeWatch{}
+	h := newTestHandler(t, watchDeps(watch))
+	owner := with(bearer(memberToken), "X-Profile-Id", "p-owner")
+	path := Prefix + "/progress/movie:heat-1995/position"
+
+	rec := do(t, h, http.MethodDelete, path, "", owner)
+	if rec.Code != http.StatusNoContent || rec.Body.Len() != 0 {
+		t.Fatalf("%d %s", rec.Code, rec.Body.String())
+	}
+	if len(watch.clears) != 1 || watch.clears[0] != (fakeMark{userID: 1, profileID: "p-owner", contentID: "movie:heat-1995"}) {
+		t.Fatalf("clears = %+v", watch.clears)
+	}
+
+	// A season or series has no single resume position to clear.
+	problem := requireProblem(t, do(t, h, http.MethodDelete, Prefix+"/progress/series:heat/position", "", owner), TypeValidationFailed)
+	if len(problem.Errors) != 1 || problem.Errors[0].Location != "path.media_item_id" {
+		t.Fatalf("errors = %+v", problem.Errors)
+	}
+	requireProblem(t, do(t, h, http.MethodDelete, Prefix+"/progress/movie:missing/position", "", owner), TypeNotFound)
+	requireProblem(t, do(t, h, http.MethodDelete, path, "", bearer(memberToken)), TypeValidationFailed)
+	requireProblem(t, do(t, h, http.MethodDelete, path, "", nil), TypeAuthenticationRequired)
+	if len(watch.clears) != 1 {
+		t.Fatalf("rejected requests cleared progress: %+v", watch.clears)
+	}
+
+	watch.err = &handlers.APIError{Status: http.StatusInternalServerError, Code: "internal_error", Message: "Failed to clear resume position"}
+	requireProblem(t, do(t, h, http.MethodDelete, path, "", owner), TypeInternalError)
+
+	off := newTestHandler(t, parityDeps(false))
+	requireProblem(t, do(t, off, http.MethodDelete, path, "", owner), TypeDependencyUnavailable)
+}
+
+func TestGetProgressCapabilities(t *testing.T) {
+	path := Prefix + "/progress/capabilities"
+	owner := with(bearer(memberToken), "X-Profile-Id", "p-owner")
+	h := newTestHandler(t, watchDeps(&fakeWatch{}))
+	requireProblem(t, do(t, h, http.MethodGet, path, "", nil), TypeAuthenticationRequired)
+
+	rec := do(t, h, http.MethodGet, path, "", owner)
+	var out ProgressCapabilities
+	if err := json.Unmarshal(rec.Body.Bytes(), &out); err != nil {
+		t.Fatal(err)
+	}
+	if rec.Code != http.StatusOK || out.State != StateAvailable || out.Allowed == nil || !*out.Allowed || out.Revision == "" || !out.ClearResumePosition {
+		t.Fatalf("capabilities: %d %s", rec.Code, rec.Body.String())
+	}
+	if got := rec.Header().Get("Cache-Control"); got != cachePrivateNoCache {
+		t.Fatalf("Cache-Control = %q", got)
+	}
+	tag := rec.Header().Get("ETag")
+	if cached := do(t, h, http.MethodGet, path, "", with(owner, "If-None-Match", tag)); tag == "" || cached.Code != http.StatusNotModified {
+		t.Fatalf("revalidation with %q: %d", tag, cached.Code)
+	}
+
+	deps := watchDeps(&fakeWatch{})
+	deps.Watch = nil
+	rec = do(t, newTestHandler(t, deps), http.MethodGet, path, "", owner)
+	out = ProgressCapabilities{}
+	if err := json.Unmarshal(rec.Body.Bytes(), &out); err != nil {
+		t.Fatal(err)
+	}
+	if rec.Code != http.StatusOK || out.State != StateNotConfigured || out.Allowed == nil || *out.Allowed || out.ClearResumePosition {
+		t.Fatalf("unconfigured: %d %s", rec.Code, rec.Body.String())
+	}
+}
+
 func TestGetWatchStatePreservesDevicePreferenceContext(t *testing.T) {
 	watch := &fakeWatch{}
 	h := newTestHandler(t, watchDeps(watch))
diff --git a/internal/apiv2/watch_trickplay.go b/internal/apiv2/watch_trickplay.go
index 3d9f5c10f2..edb44d4857 100644
--- a/internal/apiv2/watch_trickplay.go
+++ b/internal/apiv2/watch_trickplay.go
@@ -79,6 +79,7 @@ func (reg *Registry) getWatchTrickplay(ctx context.Context, in *WatchTrickplayIn
 	if err != nil {
 		return nil, NewProblem(TypeInternalError, "An unexpected error occurred.")
 	}
+	filter.OmitWatchArtwork = true
 	detail, err := reg.deps.Watch.WatchDetail(ctx, claims.UserID, profileFrom(ctx), string(in.ID), filter)
 	if err != nil {
 		return nil, watchDetailProblem(err)
diff --git a/internal/apiv2/watch_trickplay_test.go b/internal/apiv2/watch_trickplay_test.go
index 795ef29c7d..894a346738 100644
--- a/internal/apiv2/watch_trickplay_test.go
+++ b/internal/apiv2/watch_trickplay_test.go
@@ -8,6 +8,7 @@ import (
 	"testing"
 	"time"
 
+	catalogpkg "github.com/prairie-server/prairie-server/internal/catalog"
 	"github.com/prairie-server/prairie-server/internal/trickplay"
 )
 
@@ -46,6 +47,27 @@ func trickplayDeps(watch *fakeWatch, tp *fakeTrickplay) Dependencies {
 	return deps
 }
 
+type watchWithUnavailableArtwork struct{ fakeWatch }
+
+func (f *watchWithUnavailableArtwork) WatchDetail(ctx context.Context, userID int, profileID, contentID string, filter catalogpkg.AccessFilter) (*catalogpkg.WatchDetail, error) {
+	if !filter.OmitWatchArtwork {
+		return nil, errors.New("artwork provider unavailable")
+	}
+	return f.fakeWatch.WatchDetail(ctx, userID, profileID, contentID, filter)
+}
+
+func TestWatchTrickplayDoesNotNeedArtwork(t *testing.T) {
+	tp := &fakeTrickplay{}
+	deps := trickplayDeps(&fakeWatch{}, tp)
+	deps.Watch = &watchWithUnavailableArtwork{}
+	h := newTestHandler(t, deps)
+	owner := with(bearer(memberToken), "X-Profile-Id", "p-owner")
+	rec := do(t, h, http.MethodGet, "/api/v2/watch/movie:heat-1995/trickplay?file_id=42", "", owner)
+	if rec.Code != http.StatusOK || len(tp.calls) != 1 || tp.calls[0] != 42 {
+		t.Fatalf("seek previews = %d %s; manifest calls = %v", rec.Code, rec.Body.String(), tp.calls)
+	}
+}
+
 func TestGetWatchTrickplay(t *testing.T) {
 	watch, tp := &fakeWatch{}, &fakeTrickplay{}
 	h := newTestHandler(t, trickplayDeps(watch, tp))
diff --git a/internal/apiv2/watchlist.go b/internal/apiv2/watchlist.go
index a409fbafe2..503713b3ff 100644
--- a/internal/apiv2/watchlist.go
+++ b/internal/apiv2/watchlist.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"net/http"
 
+	"github.com/prairie-server/prairie-server/internal/imagesize"
 	"github.com/prairie-server/prairie-server/internal/userstore"
 )
 
@@ -12,7 +13,7 @@ import (
 
 // WatchlistListInput is the listWatchlist query.
 type WatchlistListInput struct {
-	ImageSize string `query:"image_size" enum:"small,medium,large,original" doc:"Artwork variant to presign; absent picks each surface's default" example:"medium"`
+	ArtworkQuery
 	LimitParam
 	Cursor string `query:"cursor" doc:"Opaque cursor from page.next_cursor" example:"eyJvIjo1MH0"`
 }
@@ -58,10 +59,10 @@ func registerWatchlist(reg *Registry) {
 		"Answer whether the item is on the acting profile's watchlist: the entry, or 404 when it is not (or the viewer may not see it).")),
 		reg.getWatchlistEntry)
 	Register(reg, viewerNoContentMutation(humaOp(http.MethodPut, Prefix+"/watchlist/{item_id}", "addToWatchlist", "watchlist",
-		"Add the item to the acting profile's watchlist. Automatic retries are unsafe because provider and refresh effects are not change-gated.")),
+		"Add the item to the acting profile's watchlist. Adding an item already there succeeds and changes nothing, so a retry repeats no change or notification; it cannot resend notifications an interrupted earlier call never sent.")),
 		reg.addToWatchlist)
 	Register(reg, viewerNoContentMutation(humaOp(http.MethodDelete, Prefix+"/watchlist/{item_id}", "deleteWatchlistEntry", "watchlist",
-		"Remove the item from the acting profile's watchlist; an absent entry succeeds, but automatic retries can repeat provider and refresh effects.")),
+		"Remove the item from the acting profile's watchlist. An absent entry succeeds and changes nothing, so a retry repeats no change or notification; it cannot resend notifications an interrupted earlier call never sent.")),
 		reg.deleteWatchlistEntry)
 }
 
@@ -73,7 +74,7 @@ func (reg *Registry) listWatchlist(ctx context.Context, cursors *Cursors, in *Wa
 	if reg.deps.PersonalLists == nil {
 		return nil, unavailable("watchlist")
 	}
-	viewer, p := personalListViewer(ctx, in.ImageSize)
+	viewer, p := personalListViewer(ctx, in.Artwork())
 	if p != nil {
 		return nil, p
 	}
@@ -99,7 +100,7 @@ func (reg *Registry) getWatchlistEntry(ctx context.Context, in *WatchlistItemInp
 	if reg.deps.PersonalLists == nil {
 		return nil, unavailable("watchlist")
 	}
-	viewer, p := personalListViewer(ctx, "")
+	viewer, p := personalListViewer(ctx, imagesize.Request{})
 	if p != nil {
 		return nil, p
 	}
@@ -121,7 +122,7 @@ func (reg *Registry) addToWatchlist(ctx context.Context, in *WatchlistItemInput)
 	if reg.deps.PersonalLists == nil {
 		return nil, unavailable("watchlist")
 	}
-	viewer, p := personalListViewer(ctx, "")
+	viewer, p := personalListViewer(ctx, imagesize.Request{})
 	if p != nil {
 		return nil, p
 	}
@@ -135,7 +136,7 @@ func (reg *Registry) deleteWatchlistEntry(ctx context.Context, in *WatchlistItem
 	if reg.deps.PersonalLists == nil {
 		return nil, unavailable("watchlist")
 	}
-	viewer, p := personalListViewer(ctx, "")
+	viewer, p := personalListViewer(ctx, imagesize.Request{})
 	if p != nil {
 		return nil, p
 	}
diff --git a/internal/apiv2/watchlist_titles.go b/internal/apiv2/watchlist_titles.go
index e384d7f0ed..49629b4ac1 100644
--- a/internal/apiv2/watchlist_titles.go
+++ b/internal/apiv2/watchlist_titles.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/prairie-server/prairie-server/internal/access"
 	"github.com/prairie-server/prairie-server/internal/api/handlers"
+	"github.com/prairie-server/prairie-server/internal/imagesize"
 	"github.com/prairie-server/prairie-server/internal/metadata/tmdb"
 	mediarequests "github.com/prairie-server/prairie-server/internal/requests"
 	"github.com/prairie-server/prairie-server/internal/watchlist"
@@ -159,7 +160,7 @@ func (reg *Registry) watchlistTitleViewer(ctx context.Context) (handlers.Persona
 	if reg.deps.WatchlistRequests == nil {
 		return handlers.PersonalListViewer{}, mediarequests.Viewer{}, "", unavailable("requests")
 	}
-	viewer, p := personalListViewer(ctx, "")
+	viewer, p := personalListViewer(ctx, imagesize.Request{})
 	if p != nil {
 		return handlers.PersonalListViewer{}, mediarequests.Viewer{}, "", p
 	}
@@ -424,7 +425,7 @@ func (reg *Registry) markInWatchlist(ctx context.Context, marks []watchlistMark)
 	if reg.deps.WatchlistTitles == nil || len(marks) == 0 {
 		return
 	}
-	viewer, p := personalListViewer(ctx, "")
+	viewer, p := personalListViewer(ctx, imagesize.Request{})
 	if p != nil {
 		return
 	}
diff --git a/internal/apiv2/worker_download_prepare_test.go b/internal/apiv2/worker_download_prepare_test.go
index 7ab7e42043..664ca9e5c2 100644
--- a/internal/apiv2/worker_download_prepare_test.go
+++ b/internal/apiv2/worker_download_prepare_test.go
@@ -15,6 +15,7 @@ import (
 	"github.com/santhosh-tekuri/jsonschema/v6"
 
 	"github.com/prairie-server/prairie-server/internal/config"
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 	"github.com/prairie-server/prairie-server/internal/nodeconfig"
 	"github.com/prairie-server/prairie-server/internal/transcodenode"
 	"github.com/prairie-server/prairie-server/internal/workerprotocol"
@@ -88,7 +89,7 @@ func TestWorkerDownloadPreparationProtocol(t *testing.T) {
 	} {
 		req := httptest.NewRequest(http.MethodPost, op.Path, strings.NewReader(tc.body))
 		if tc.auth {
-			req.Header.Set("Authorization", "Bearer "+cfg.Auth.JWTSecret)
+			nodeauthtest.Sign(t, req, cfg.Auth.JWTSecret)
 		}
 		rec := httptest.NewRecorder()
 		handler.ServeHTTP(rec, req)
diff --git a/internal/apiv2/worker_protocols_test.go b/internal/apiv2/worker_protocols_test.go
index e5c4208bcb..847296cd33 100644
--- a/internal/apiv2/worker_protocols_test.go
+++ b/internal/apiv2/worker_protocols_test.go
@@ -16,6 +16,7 @@ import (
 	"github.com/santhosh-tekuri/jsonschema/v6"
 
 	"github.com/prairie-server/prairie-server/internal/config"
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 	"github.com/prairie-server/prairie-server/internal/nodeconfig"
 	"github.com/prairie-server/prairie-server/internal/playback"
 	"github.com/prairie-server/prairie-server/internal/proxy"
@@ -111,7 +112,7 @@ func TestWorkerStatusSchemasMatchRealListeners(t *testing.T) {
 		}
 		schemas[read.Listener] = schema
 		request := httptest.NewRequest(http.MethodGet, read.Path, nil)
-		request.Header.Set("Authorization", "Bearer "+cfg.Auth.JWTSecret)
+		nodeauthtest.Sign(t, request, cfg.Auth.JWTSecret)
 		response := httptest.NewRecorder()
 		handlers[read.Listener].ServeHTTP(response, request)
 		if response.Code != http.StatusOK || response.Header().Get("Content-Type") != "application/json" {
@@ -248,7 +249,7 @@ func TestWorkerChapterExtractionProtocol(t *testing.T) {
 	} {
 		request := httptest.NewRequest(op.Method, op.Path, strings.NewReader(tc.body))
 		if tc.auth {
-			request.Header.Set("Authorization", "Bearer "+cfg.Auth.JWTSecret)
+			nodeauthtest.Sign(t, request, cfg.Auth.JWTSecret)
 		}
 		response := httptest.NewRecorder()
 		handler.ServeHTTP(response, request)
@@ -306,7 +307,7 @@ func TestWorkerArtifactConditionalProtocol(t *testing.T) {
 		if err != nil {
 			t.Fatal(err)
 		}
-		req.Header.Set("Authorization", "Bearer "+cfg.Auth.JWTSecret)
+		nodeauthtest.Sign(t, req, cfg.Auth.JWTSecret)
 		if tc.header != "" {
 			req.Header.Set(tc.header, tc.value)
 		}
@@ -414,7 +415,7 @@ func TestWorkerSegmentAcknowledgementRefusals(t *testing.T) {
 	} {
 		req := httptest.NewRequest(http.MethodPost, "/transcode/missing/segment/"+tc.name+"/downloaded", nil)
 		if tc.auth {
-			req.Header.Set("Authorization", "Bearer "+cfg.Auth.JWTSecret)
+			nodeauthtest.Sign(t, req, cfg.Auth.JWTSecret)
 		}
 		req.Header.Set(transcodeproxy.GenerationHeader, tc.generation)
 		response := httptest.NewRecorder()
diff --git a/internal/apiv2/worker_start_test.go b/internal/apiv2/worker_start_test.go
index ccaacd5e40..fad4567041 100644
--- a/internal/apiv2/worker_start_test.go
+++ b/internal/apiv2/worker_start_test.go
@@ -11,6 +11,7 @@ import (
 	"github.com/santhosh-tekuri/jsonschema/v6"
 
 	"github.com/prairie-server/prairie-server/internal/config"
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 	"github.com/prairie-server/prairie-server/internal/nodeconfig"
 	"github.com/prairie-server/prairie-server/internal/transcodenode"
 )
@@ -85,7 +86,7 @@ func TestWorkerStartProtocol(t *testing.T) {
 	} {
 		req := httptest.NewRequest(http.MethodPost, op.Path, strings.NewReader(tc.body))
 		if tc.auth {
-			req.Header.Set("Authorization", "Bearer "+cfg.Auth.JWTSecret)
+			nodeauthtest.Sign(t, req, cfg.Auth.JWTSecret)
 		}
 		rec := httptest.NewRecorder()
 		handler.ServeHTTP(rec, req)
diff --git a/internal/apiv2/worker_stop_test.go b/internal/apiv2/worker_stop_test.go
index 6e58e7ce3d..4ea46d019c 100644
--- a/internal/apiv2/worker_stop_test.go
+++ b/internal/apiv2/worker_stop_test.go
@@ -8,6 +8,7 @@ import (
 	"testing"
 
 	"github.com/prairie-server/prairie-server/internal/config"
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 	"github.com/prairie-server/prairie-server/internal/nodeconfig"
 	"github.com/prairie-server/prairie-server/internal/transcodenode"
 )
@@ -34,7 +35,7 @@ func TestWorkerLegacyStopProtocol(t *testing.T) {
 		}
 		req := httptest.NewRequest(http.MethodDelete, "/transcode/missing", nil)
 		if tc.authenticated {
-			req.Header.Set("Authorization", "Bearer "+cfg.Auth.JWTSecret)
+			nodeauthtest.Sign(t, req, cfg.Auth.JWTSecret)
 		}
 		rec := httptest.NewRecorder()
 		handler.ServeHTTP(rec, req)
diff --git a/internal/apiv2/worker_streaming_test.go b/internal/apiv2/worker_streaming_test.go
index 02c6753340..c093588ef2 100644
--- a/internal/apiv2/worker_streaming_test.go
+++ b/internal/apiv2/worker_streaming_test.go
@@ -8,6 +8,7 @@ import (
 	"testing"
 
 	"github.com/prairie-server/prairie-server/internal/config"
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 	"github.com/prairie-server/prairie-server/internal/nodeconfig"
 	"github.com/prairie-server/prairie-server/internal/routeinventory"
 	"github.com/prairie-server/prairie-server/internal/transcodenode"
@@ -53,7 +54,7 @@ func TestWorkerStreamingRefusalDescription(t *testing.T) {
 		for _, authenticated := range []bool{false, true} {
 			req := httptest.NewRequest(op.Method, path, nil)
 			if authenticated {
-				req.Header.Set("Authorization", "Bearer "+cfg.Auth.JWTSecret)
+				nodeauthtest.Sign(t, req, cfg.Auth.JWTSecret)
 			}
 			response := httptest.NewRecorder()
 			handler.ServeHTTP(response, req)
@@ -72,7 +73,7 @@ func TestWorkerStreamingRefusalDescription(t *testing.T) {
 	// Proxy manifest HEAD is forwarded unchanged to a worker that registers GET
 	// only. The existing node therefore refuses it; do not promise HEAD support.
 	req := httptest.NewRequest(http.MethodHead, "/transcode/missing/master.m3u8", nil)
-	req.Header.Set("Authorization", "Bearer "+cfg.Auth.JWTSecret)
+	nodeauthtest.Sign(t, req, cfg.Auth.JWTSecret)
 	response := httptest.NewRecorder()
 	handler.ServeHTTP(response, req)
 	if response.Code != 405 {
diff --git a/internal/artworkkey/artworkkey.go b/internal/artworkkey/artworkkey.go
index 5025d38021..a542e69696 100644
--- a/internal/artworkkey/artworkkey.go
+++ b/internal/artworkkey/artworkkey.go
@@ -45,11 +45,33 @@ const (
 	ImageDisc     = "disc"
 )
 
+// ImageTypeOf returns the image type a cached key was generated under: its
+// image-type directory segment (".../{imageType}/{variant}.{ext}") when that
+// names one of the types above, else fallback. The segment is authoritative
+// because the cacher generates the ladder for the same type it writes there,
+// so a slot that carries another type's art (an episode still in a backdrop or
+// poster slot) still resolves to rungs that exist.
+func ImageTypeOf(objectPath, fallback string) string {
+	dir := Directory(objectPath)
+	if dir == "" {
+		return fallback
+	}
+	switch segment := path.Base(dir); segment {
+	case ImagePoster, ImageBackdrop, ImageStill, ImageLogo, ImageProfile,
+		ImageBanner, ImageThumb, ImageClearArt, ImageDisc:
+		return segment
+	default:
+		return fallback
+	}
+}
+
 // LadderVersion identifies the current shape of the variant ladder returned by
 // VariantWidths. It MUST be bumped whenever an existing type's widths change so
 // the one-shot ladder backfill re-enqueues already-cached artwork and generates
-// the newly-added rungs. Adding a type does not need a bump.
-const LadderVersion = 2
+// the newly-added rungs. Adding a type does not need a bump. Existing deployments compare their recorded
+// backfilled_version against this value; leaving it stale means clients asking
+// for a new rung keep falling back to the next lower one forever.
+const LadderVersion = 3
 
 // Build returns an object key for a variant under basePath.
 func Build(basePath, variant, revision, ext string) string {
@@ -217,9 +239,17 @@ func WiderVariantKeys(objectPath string) []string {
 // needs no bump: nothing cached under it predates its ladder.
 func VariantWidths(imageType string) []int {
 	switch strings.ToLower(strings.TrimSpace(imageType)) {
-	case "backdrop":
-		return []int{1920, 1280, 300}
-	case "logo":
+	case ImageBackdrop:
+		// w2560 serves 1440p and high-density laptop and tablet heroes without
+		// sending the 4K original.
+		return []int{2560, 1920, 1280, 300}
+	case ImageStill:
+		// No w200 rung, and no w1280 hero rung: an episode still renders ~140 CSS-px
+		// in the browser and ~358 px on a UHD television, so w500 and w300 cover both.
+		// cachedImageVariantKeyFor keeps stills at w500 for TV clients and the
+		// smart-TV client pins STILL_WIDTH to 500. Nothing asks for a w200 still.
+		return []int{500, 300}
+	case ImageLogo:
 		return []int{500}
 	case ImageThumb:
 		// Landscape thumbs are 16:9 cards, shown smaller than backdrops.
@@ -229,15 +259,6 @@ func VariantWidths(imageType string) []int {
 		return []int{1000, 500}
 	case ImageDisc:
 		return []int{1000, 500, 300}
-	case "still":
-		// No w200 rung. An episode still renders ~140 CSS-px in the browser
-		// (EpisodeRow) and ~358 px on a UHD television, so w300 covers both
-		// while w200 would be upscaled on the larger one. Nothing asks for a
-		// w200 still: cachedImageVariantKeyFor keeps stills at w500 for TV
-		// clients, the smart-TV client pins STILL_WIDTH to 500, and no caller
-		// passes size="small" for a still. Generating it cost one encode plus
-		// an AVIF sibling per episode for an object only a sweeper would read.
-		return []int{500, 300}
 	default: // poster, profile
 		// w200 is the TV rung: poster cards render ~155 CSS-px, so w300 decodes
 		// ~4x the pixels shown. w200 roughly halves decoded surface (and bytes)
diff --git a/internal/artworkkey/artworkkey_test.go b/internal/artworkkey/artworkkey_test.go
index 8d496b4643..4b4de2b582 100644
--- a/internal/artworkkey/artworkkey_test.go
+++ b/internal/artworkkey/artworkkey_test.go
@@ -199,11 +199,12 @@ func TestWiderVariantKeys(t *testing.T) {
 }
 
 func TestWiderVariantKeysUsesImageTypeLadder(t *testing.T) {
-	// Backdrops have their own ladder (1920/1280/300).
+	// Backdrops have their own ladder (2560/1920/1280/300).
 	got := WiderVariantKeys("tmdb/movies/550/backdrop/w300.rev.webp")
 	want := []string{
 		"tmdb/movies/550/backdrop/w1280.rev.webp",
 		"tmdb/movies/550/backdrop/w1920.rev.webp",
+		"tmdb/movies/550/backdrop/w2560.rev.webp",
 	}
 	if len(got) != len(want) {
 		t.Fatalf("got %v, want %v", got, want)
@@ -283,3 +284,22 @@ func TestVariantWidthsExtendedArtworkTypes(t *testing.T) {
 		}
 	}
 }
+
+func TestImageTypeOf(t *testing.T) {
+	tests := []struct {
+		key, fallback, want string
+	}{
+		{"tvdb/series/1/seasons/2/episodes/3/still/original.webp", ImagePoster, ImageStill},
+		{"/tmdb/movies/550/backdrop/original.abc.jpg", ImageThumb, ImageBackdrop},
+		{"local/movies/m/aa/clearart/original.r1.webp", "", ImageClearArt},
+		{"collections/7/cover/original.webp", ImagePoster, ImagePoster},
+		{"plugin://tmdb/still/original.webp", ImagePoster, ImagePoster},
+		{"original.webp", ImageLogo, ImageLogo},
+		{"", ImageBackdrop, ImageBackdrop},
+	}
+	for _, tt := range tests {
+		if got := ImageTypeOf(tt.key, tt.fallback); got != tt.want {
+			t.Errorf("ImageTypeOf(%q, %q) = %q, want %q", tt.key, tt.fallback, got, tt.want)
+		}
+	}
+}
diff --git a/internal/artworkkey/coverage_gate_test.go b/internal/artworkkey/coverage_gate_test.go
index 5213ffa031..df7f76c353 100644
--- a/internal/artworkkey/coverage_gate_test.go
+++ b/internal/artworkkey/coverage_gate_test.go
@@ -27,7 +27,7 @@ func TestArtworkKeyEdgeCases(t *testing.T) {
 	if Revision("noext") != "" || Revision("original.") != "" {
 		t.Fatal("revision empty")
 	}
-	if len(VariantWidths("backdrop")) != 3 || len(VariantWidths("logo")) != 1 || len(VariantWidths("poster")) != 3 {
+	if len(VariantWidths("backdrop")) != 4 || len(VariantWidths("logo")) != 1 || len(VariantWidths("poster")) != 3 {
 		t.Fatal("widths")
 	}
 	if ObjectKeys("", "poster") != nil || ObjectKeys("https://x/y.webp", "poster") != nil {
diff --git a/internal/artworkkey/retired_test.go b/internal/artworkkey/retired_test.go
index 5b5f6bf7ca..39d85fff2d 100644
--- a/internal/artworkkey/retired_test.go
+++ b/internal/artworkkey/retired_test.go
@@ -18,8 +18,8 @@ func TestVariantWidthsStillHasNoTVRung(t *testing.T) {
 			t.Errorf("VariantWidths(%s) = %v, want the w200 TV rung retained", imageType, got)
 		}
 	}
-	if got := VariantWidths("backdrop"); !reflect.DeepEqual(got, []int{1920, 1280, 300}) {
-		t.Errorf("VariantWidths(backdrop) = %v, want [1920 1280 300]", got)
+	if got := VariantWidths("backdrop"); !reflect.DeepEqual(got, []int{2560, 1920, 1280, 300}) {
+		t.Errorf("VariantWidths(backdrop) = %v, want [2560 1920 1280 300]", got)
 	}
 	if got := VariantWidths("logo"); !reflect.DeepEqual(got, []int{500}) {
 		t.Errorf("VariantWidths(logo) = %v, want [500]", got)
diff --git a/internal/artworkurl/fetch.go b/internal/artworkurl/fetch.go
new file mode 100644
index 0000000000..50b2db6441
--- /dev/null
+++ b/internal/artworkurl/fetch.go
@@ -0,0 +1,81 @@
+package artworkurl
+
+import (
+	"context"
+	"net/url"
+	"path"
+	"strings"
+	"time"
+
+	"github.com/prairie-server/prairie-server/internal/blobstore"
+	"github.com/prairie-server/prairie-server/internal/netguard"
+)
+
+// originProbeKey names no object. FetchContext presigns it only to learn the
+// origin the store's direct URLs use.
+const originProbeKey = "origin-probe"
+
+// FetchContext returns the context for the server's own request to an
+// artwork URL it resolved, sent through a netguard transport. A direct URL to
+// store's objects may reach the server's local network, where S3-compatible
+// storage often runs. Any other URL reaches public addresses only: catalog
+// artwork can still be a metadata provider's URL, kept when caching it
+// failed or not yet cached, and a provider's URL is untrusted. See
+// docs/architecture/outbound-address-guard.md.
+func FetchContext(ctx context.Context, store blobstore.Store, rawURL string) context.Context {
+	if isDirectStoreURL(ctx, store, rawURL) {
+		return netguard.WithPrivateAccess(ctx)
+	}
+	return ctx
+}
+
+// isDirectStoreURL reports whether rawURL is under the scheme, host, and path
+// prefix (bucket, key prefix, or read endpoint path) of the URLs store's
+// DirectURL issues. The path must already be clean, so dot segments cannot
+// step outside the prefix.
+func isDirectStoreURL(ctx context.Context, store blobstore.Store, rawURL string) bool {
+	direct, ok := store.(blobstore.DirectURLer)
+	if !ok {
+		return false
+	}
+	target, err := url.Parse(rawURL)
+	if err != nil || target.Host == "" || target.Path == "" || path.Clean(target.Path) != target.Path {
+		return false
+	}
+	probeURL, _, err := direct.DirectURL(ctx, originProbeKey, time.Minute, 0)
+	if err != nil {
+		return false
+	}
+	probe, err := url.Parse(probeURL)
+	if err != nil || probe.Host == "" {
+		return false
+	}
+	prefix, ok := strings.CutSuffix(probe.Path, originProbeKey)
+	if !ok {
+		return false
+	}
+	return equalASCIIFold(probe.Scheme, target.Scheme) && equalASCIIFold(probe.Host, target.Host) &&
+		strings.HasPrefix(target.Path, prefix)
+}
+
+// equalASCIIFold compares a and b ignoring ASCII case only. Unicode folding
+// (strings.EqualFold) would match host names that resolve as different IDNA
+// names, such as σ and ς, so every non-ASCII byte must match exactly.
+func equalASCIIFold(a, b string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i := range len(a) {
+		x, y := a[i], b[i]
+		if 'A' <= x && x <= 'Z' {
+			x += 'a' - 'A'
+		}
+		if 'A' <= y && y <= 'Z' {
+			y += 'a' - 'A'
+		}
+		if x != y {
+			return false
+		}
+	}
+	return true
+}
diff --git a/internal/artworkurl/fetch_test.go b/internal/artworkurl/fetch_test.go
new file mode 100644
index 0000000000..a4aaac5018
--- /dev/null
+++ b/internal/artworkurl/fetch_test.go
@@ -0,0 +1,44 @@
+package artworkurl
+
+import (
+	"context"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/blobstore"
+	"github.com/prairie-server/prairie-server/internal/blobstore/blobstoretest"
+	"github.com/prairie-server/prairie-server/internal/netguard"
+)
+
+func TestFetchContextTrustsOnlyTheStoresDirectURLs(t *testing.T) {
+	store := blobstoretest.NewDirect("http://media.minio.lan:9000/artwork")
+	for _, tc := range []struct {
+		name  string
+		store blobstore.Store
+		url   string
+		want  bool
+	}{
+		{"store URL", store, "http://media.minio.lan:9000/artwork/tmdb/movies/1/poster/w500.webp?X-Amz-Signature=x", true},
+		{"store host in another case", store, "HTTP://Media.MinIO.lan:9000/artwork/key", true},
+		{"other bucket on the store host", store, "http://media.minio.lan:9000/other-bucket/key", false},
+		{"bucket name as a longer prefix", store, "http://media.minio.lan:9000/artwork-admin/key", false},
+		{"dot segments out of the bucket", store, "http://media.minio.lan:9000/artwork/../minio/admin", false},
+		{"encoded dot segments", store, "http://media.minio.lan:9000/artwork/%2e%2e/minio/admin", false},
+		{"other port", store, "http://media.minio.lan:9001/artwork/key", false},
+		{"other scheme", store, "https://media.minio.lan:9000/artwork/key", false},
+		{"other host", store, "http://10.0.0.5:9000/artwork/key", false},
+		{"relative URL", store, "/api/v2/artwork/key?sig=x", false},
+		{"store without direct URLs", blobstoretest.New(), "http://media.minio.lan:9000/artwork/key", false},
+		// Unicode case folding matches these, but they resolve as other names.
+		{"final sigma for sigma", blobstoretest.NewDirect("http://σ.example.test:8080/artwork"), "http://ς.example.test:8080/artwork/key", false},
+		{"Kelvin sign for k", blobstoretest.NewDirect("http://k.example.test:8080/artwork"), "http://\u212a.example.test:8080/artwork/key", false},
+		{"same internationalized host", blobstoretest.NewDirect("http://σ.example.test:8080/artwork"), "http://σ.example.test:8080/artwork/key", true},
+		{"no store", nil, "http://media.minio.lan:9000/artwork/key", false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx := FetchContext(context.Background(), tc.store, tc.url)
+			if got := netguard.PrivateAccess(ctx); got != tc.want {
+				t.Fatalf("private access = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
diff --git a/internal/audiobooks/abs/playlists_handler.go b/internal/audiobooks/abs/playlists_handler.go
index 46cdaf5adc..bde3311caa 100644
--- a/internal/audiobooks/abs/playlists_handler.go
+++ b/internal/audiobooks/abs/playlists_handler.go
@@ -108,9 +108,7 @@ func (h *Handler) handleCreatePlaylist(w http.ResponseWriter, r *http.Request) {
 	}
 
 	persisted, err := h.deps.PlaylistStore.GetPlaylist(r.Context(), p.ID)
-	if errors.Is(err, ErrNotFound) {
-		persisted = p
-	} else if err != nil {
+	if err != nil {
 		persisted = p
 	}
 
diff --git a/internal/audiobooks/abs_playback_session_store.go b/internal/audiobooks/abs_playback_session_store.go
index 5a14b2fd87..820a705098 100644
--- a/internal/audiobooks/abs_playback_session_store.go
+++ b/internal/audiobooks/abs_playback_session_store.go
@@ -167,6 +167,9 @@ func (s *ABSPlaybackSessionStore) AggregateStats(ctx context.Context, userID, pr
 		out.Days = append(out.Days, d)
 	}
 	rows.Close()
+	if err := rows.Err(); err != nil {
+		return abs.Stats{}, fmt.Errorf("abs_playback_session_store: stats days: %w", err)
+	}
 
 	dowRows, err := s.Pool.Query(ctx, `
 		SELECT EXTRACT(DOW FROM started_at)::int,
@@ -190,6 +193,9 @@ func (s *ABSPlaybackSessionStore) AggregateStats(ctx context.Context, userID, pr
 		}
 	}
 	dowRows.Close()
+	if err := dowRows.Err(); err != nil {
+		return abs.Stats{}, fmt.Errorf("abs_playback_session_store: stats dow: %w", err)
+	}
 
 	mRows, err := s.Pool.Query(ctx, `
 		SELECT TO_CHAR(date_trunc('month', started_at), 'YYYY-MM'),
@@ -213,6 +219,9 @@ func (s *ABSPlaybackSessionStore) AggregateStats(ctx context.Context, userID, pr
 		out.Monthly = append(out.Monthly, m)
 	}
 	mRows.Close()
+	if err := mRows.Err(); err != nil {
+		return abs.Stats{}, fmt.Errorf("abs_playback_session_store: stats months: %w", err)
+	}
 	return out, nil
 }
 
diff --git a/internal/audiobooks/config.go b/internal/audiobooks/config.go
index 68a1c14bf2..f8f4f02246 100644
--- a/internal/audiobooks/config.go
+++ b/internal/audiobooks/config.go
@@ -88,12 +88,13 @@ func (c *ABSConfigProvider) RefreshTTL(_ context.Context) (time.Duration, error)
 
 // StandaloneLoginEnabled reports whether body-creds login is permitted.
 // We default to true; an operator can set "audiobooks.abs.login_disabled"
-// to "true" in server_settings to gate it off.
+// to "true" in server_settings to gate it off. A failed settings read is
+// returned rather than treated as enabled, so the operator's gate cannot be
+// bypassed by a database error.
 func (c *ABSConfigProvider) StandaloneLoginEnabled(ctx context.Context) (bool, error) {
 	disabled, err := c.Settings.Get(ctx, "audiobooks.abs.login_disabled")
-	if err == nil {
-		return disabled != "true", nil
+	if err != nil {
+		return false, fmt.Errorf("abs_config: read login_disabled: %w", err)
 	}
-	// Fail open when settings are unavailable.
-	return true, nil
+	return disabled != "true", nil
 }
diff --git a/internal/audiobooks/config_test.go b/internal/audiobooks/config_test.go
new file mode 100644
index 0000000000..661ee88372
--- /dev/null
+++ b/internal/audiobooks/config_test.go
@@ -0,0 +1,55 @@
+package audiobooks
+
+import (
+	"context"
+	"errors"
+	"testing"
+)
+
+// loginSettingsStore serves one stored value (or error) for every key.
+type loginSettingsStore struct {
+	value string
+	err   error
+}
+
+func (s loginSettingsStore) Get(context.Context, string) (string, error) { return s.value, s.err }
+func (loginSettingsStore) Set(context.Context, string, string) error     { return nil }
+func (loginSettingsStore) GetAll(context.Context) (map[string]string, error) {
+	return map[string]string{}, nil
+}
+
+func TestStandaloneLoginEnabledReadsGate(t *testing.T) {
+	for _, tc := range []struct {
+		name   string
+		stored string
+		want   bool
+	}{
+		{"unset defaults on", "", true},
+		{"gated off", "true", false},
+		{"explicitly on", "false", true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			provider := &ABSConfigProvider{Settings: loginSettingsStore{value: tc.stored}}
+			got, err := provider.StandaloneLoginEnabled(t.Context())
+			if err != nil {
+				t.Fatalf("StandaloneLoginEnabled: %v", err)
+			}
+			if got != tc.want {
+				t.Fatalf("StandaloneLoginEnabled = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
+
+// A settings read failure must not reopen login an operator turned off.
+func TestStandaloneLoginEnabledReturnsReadError(t *testing.T) {
+	wantErr := errors.New("settings unavailable")
+	provider := &ABSConfigProvider{Settings: loginSettingsStore{err: wantErr}}
+	enabled, err := provider.StandaloneLoginEnabled(t.Context())
+	if !errors.Is(err, wantErr) {
+		t.Fatalf("StandaloneLoginEnabled error = %v, want %v", err, wantErr)
+	}
+	if enabled {
+		t.Fatal("StandaloneLoginEnabled reported enabled on a failed settings read")
+	}
+}
diff --git a/internal/audiobooks/enrichment.go b/internal/audiobooks/enrichment.go
index a667c33aab..ec1e522bf1 100644
--- a/internal/audiobooks/enrichment.go
+++ b/internal/audiobooks/enrichment.go
@@ -320,7 +320,7 @@ func (e *Enricher) runBatch(ctx context.Context, items []enrichmentItemRow, enri
 	}()
 	release := func(item enrichmentItemRow) {
 		cleanupOnce.Do(func() {
-			cleanupCtx, cleanupCancel = context.WithTimeout(context.WithoutCancel(ctx), 5*time.Second)
+			cleanupCtx, cleanupCancel = context.WithTimeout(context.WithoutCancel(ctx), 5*time.Second) //nolint:fatcontext,gosec // set once under cleanupOnce from the batch ctx; the deferred func above calls cleanupCancel
 		})
 		e.releaseClaim(cleanupCtx, item)
 	}
diff --git a/internal/audiobooks/recommender.go b/internal/audiobooks/recommender.go
index 88a8908f69..d53b8d7fc6 100644
--- a/internal/audiobooks/recommender.go
+++ b/internal/audiobooks/recommender.go
@@ -7,6 +7,7 @@ import (
 	"github.com/jackc/pgx/v5/pgxpool"
 
 	"github.com/prairie-server/prairie-server/internal/audiobooks/abs"
+	"github.com/prairie-server/prairie-server/internal/catalog"
 	"github.com/prairie-server/prairie-server/internal/models"
 	"github.com/prairie-server/prairie-server/internal/recommendations"
 )
@@ -34,7 +35,7 @@ func (r *ABSRecommender) Similar(ctx context.Context, contentID string, limit in
 	}
 	if r.Recs != nil {
 		if emb, err := r.Recs.GetEmbedding(ctx, contentID); err == nil && emb != nil {
-			scored, err := r.Recs.FindSimilar(ctx, emb, []string{contentID}, "audiobook", limit*3)
+			scored, err := r.Recs.FindSimilar(ctx, emb, []string{contentID}, "audiobook", limit*3, catalog.AccessFilter{})
 			if err == nil && len(scored) > 0 {
 				ids := make([]string, 0, limit)
 				for _, s := range scored {
diff --git a/internal/auth/account_provisioner.go b/internal/auth/account_provisioner.go
index 61561df630..c7e0d717f4 100644
--- a/internal/auth/account_provisioner.go
+++ b/internal/auth/account_provisioner.go
@@ -60,7 +60,7 @@ func (p *AccountProvisioner) CreateAccount(
 			return nil, fmt.Errorf(
 				"create default profile: %w (cleanup user: %w)",
 				err,
-				deleteErr,
+				deleteErr, //nolint:errorlint // callers classify the profile error; the cleanup failure is only reported
 			)
 		}
 		return nil, fmt.Errorf("create default profile: %w", err)
diff --git a/internal/auth/device_login_db_test.go b/internal/auth/device_login_db_test.go
index 6896a15e22..7ee4943fac 100644
--- a/internal/auth/device_login_db_test.go
+++ b/internal/auth/device_login_db_test.go
@@ -383,6 +383,9 @@ func TestDeviceLoginRetentionDeletesOldRequestsDB(t *testing.T) {
 		}
 		left = append(left, n)
 	}
+	if err := rows.Err(); err != nil {
+		t.Fatal(err)
+	}
 	if len(left) != 1 || left[0] != name("recent") {
 		t.Fatalf("remaining = %v, want only the recent request", left)
 	}
diff --git a/internal/auth/external_sign_in_db_test.go b/internal/auth/external_sign_in_db_test.go
index cedea22470..6a0ea21992 100644
--- a/internal/auth/external_sign_in_db_test.go
+++ b/internal/auth/external_sign_in_db_test.go
@@ -492,7 +492,7 @@ func TestLocalPasswordPolicyDB(t *testing.T) {
 		"disable":       {Enabled: new(false)},
 		"password off":  {LocalPasswordLoginEnabled: new(false)},
 		"delete (nil)":  nil,
-		"harmless edit": {MaxProfiles: new(3)},
+		"harmless edit": {MaxProfiles: models.SetValue(3)},
 	} {
 		t.Run(name, func(t *testing.T) {
 			if count := env.usableBreakGlass(t); count != 1 {
diff --git a/internal/auth/oauth_completion_authority_db_test.go b/internal/auth/oauth_completion_authority_db_test.go
index cfcf2bb101..670aec305e 100644
--- a/internal/auth/oauth_completion_authority_db_test.go
+++ b/internal/auth/oauth_completion_authority_db_test.go
@@ -53,8 +53,8 @@ func TestOAuthCompletionReturnsLockedAccountDB(t *testing.T) {
 			if got.err != nil || got.completion.User == nil {
 				t.Fatalf("redeem updated account: %v", got.err)
 			}
-			if got.completion.User.ID != userID || got.completion.User.Role != models.RoleAdmin || got.completion.User.MaxProfiles != 9 {
-				t.Fatalf("redemption returned an account snapshot from before the locked update: id = %d, role = %q, max profiles = %d",
+			if maxProfiles := got.completion.User.MaxProfiles; got.completion.User.ID != userID || got.completion.User.Role != models.RoleAdmin || maxProfiles == nil || *maxProfiles != 9 {
+				t.Fatalf("redemption returned an account snapshot from before the locked update: id = %d, role = %q, max profiles = %v",
 					got.completion.User.ID, got.completion.User.Role, got.completion.User.MaxProfiles)
 			}
 			claims, err := rig.svc.jwt.ValidateToken(got.completion.AccessToken)
diff --git a/internal/auth/owner.go b/internal/auth/owner.go
index 8e4d772772..fcda691fcd 100644
--- a/internal/auth/owner.go
+++ b/internal/auth/owner.go
@@ -135,6 +135,7 @@ func changesAccessPolicy(target *models.User, input models.UpdateUserInput) bool
 		changesOverride(input.MaxTranscodes, target.MaxTranscodes) ||
 		changesOverride(input.MaxRemoteStreamBitrateKbps, target.MaxRemoteStreamBitrateKbps) ||
 		changesOverride(input.MaxLocalStreamBitrateKbps, target.MaxLocalStreamBitrateKbps) ||
+		changesOverride(input.MaxProfiles, target.MaxProfiles) ||
 		changesOverride(input.TranscodeAllowed, target.TranscodeAllowed) ||
 		changesOverride(input.AudioTranscodeAllowed, target.AudioTranscodeAllowed) ||
 		changesOverride(input.DownloadAllowed, target.DownloadAllowed) ||
diff --git a/internal/auth/owner_test.go b/internal/auth/owner_test.go
index 916414110b..4b85a354c3 100644
--- a/internal/auth/owner_test.go
+++ b/internal/auth/owner_test.go
@@ -26,13 +26,14 @@ func TestOwnerChecks(t *testing.T) {
 	disable := models.UpdateUserInput{Enabled: new(false)}
 	rename := models.UpdateUserInput{Username: new("renamed")}
 	// A non-Owner admin the Owner restricted.
-	limited := &models.User{ID: 5, Role: models.RoleAdmin, Enabled: true, MaxStreams: new(2), LibraryIDs: []int{2, 1}, DownloadTranscodeAllowed: new(false)}
+	limited := &models.User{ID: 5, Role: models.RoleAdmin, Enabled: true, MaxStreams: new(2), LibraryIDs: []int{2, 1}, DownloadTranscodeAllowed: new(false), MaxProfiles: new(2)}
 	resend := models.UpdateUserInput{
 		MaxStreams:               models.SetValue(2),
 		LibraryIDs:               models.SetValue([]int{1, 2}),
 		DownloadTranscodeAllowed: models.SetValue(false),
 		MaxTranscodes:            models.ClearValue[int](),
 		RequestsAllowed:          models.ClearValue[bool](),
+		MaxProfiles:              models.SetValue(2),
 	}
 
 	cases := []struct {
@@ -81,6 +82,8 @@ func TestOwnerChecks(t *testing.T) {
 		{"admin sets own override", CheckOwnerUpdate(OwnerActor{ID: admin.ID}, admin, models.UpdateUserInput{DownloadTranscodeAllowed: models.SetValue(false)}), ErrAdminPolicyProtected},
 		{"admin widens own libraries", CheckOwnerUpdate(OwnerActor{ID: limited.ID}, limited, models.UpdateUserInput{LibraryIDs: models.SetValue([]int{1, 2, 3})}), ErrAdminPolicyProtected},
 		{"admin clears own libraries", CheckOwnerUpdate(OwnerActor{ID: limited.ID}, limited, models.UpdateUserInput{LibraryIDs: models.ClearValue[[]int]()}), ErrAdminPolicyProtected},
+		{"admin raises own profile limit", CheckOwnerUpdate(OwnerActor{ID: limited.ID}, limited, models.UpdateUserInput{MaxProfiles: models.SetValue(10)}), ErrAdminPolicyProtected},
+		{"admin clears own profile limit", CheckOwnerUpdate(OwnerActor{ID: limited.ID}, limited, models.UpdateUserInput{MaxProfiles: models.ClearValue[int]()}), ErrAdminPolicyProtected},
 		{"admin resends own policy", CheckOwnerUpdate(OwnerActor{ID: limited.ID}, limited, resend), nil},
 		{"admin edits own email beside policy", CheckOwnerUpdate(OwnerActor{ID: limited.ID}, limited, models.UpdateUserInput{Email: new("new@example.test"), MaxStreams: models.SetValue(2)}), nil},
 		{"owner limits admin", CheckOwnerUpdate(asOwner, admin, models.UpdateUserInput{MaxStreams: models.SetValue(2)}), nil},
@@ -324,6 +327,9 @@ func requireOwner(t *testing.T, r *UserRepository, id int) {
 		}
 		owners = append(owners, owner)
 	}
+	if err := rows.Err(); err != nil {
+		t.Fatal(err)
+	}
 	if len(owners) != 1 || owners[0] != id {
 		t.Fatalf("owners = %v, want [%d]", owners, id)
 	}
diff --git a/internal/auth/repository.go b/internal/auth/repository.go
index d189cb97f8..fc75eacc07 100644
--- a/internal/auth/repository.go
+++ b/internal/auth/repository.go
@@ -174,7 +174,7 @@ func createUser(ctx context.Context, db interface {
 	cols := []string{
 		"email", "username", "password_hash", "local_password_login_enabled", "password_change_required", "role", "permissions",
 		"library_ids", "max_playback_quality", "max_streams", "max_transcodes", "max_remote_stream_bitrate_kbps", "max_local_stream_bitrate_kbps",
-		"transcode_allowed", "audio_transcode_allowed", "download_allowed", "download_transcode_allowed",
+		"transcode_allowed", "audio_transcode_allowed", "max_profiles", "download_allowed", "download_transcode_allowed",
 		"requests_allowed",
 	}
 	args := []any{
@@ -193,16 +193,12 @@ func createUser(ctx context.Context, db interface {
 		input.MaxLocalStreamBitrateKbps,
 		input.TranscodeAllowed,
 		input.AudioTranscodeAllowed,
+		input.MaxProfiles,
 		input.DownloadAllowed,
 		input.DownloadTranscodeAllowed,
 		input.RequestsAllowed,
 	}
 
-	// Optional columns: nil means use DB default.
-	if input.MaxProfiles != nil {
-		cols = append(cols, "max_profiles")
-		args = append(args, *input.MaxProfiles)
-	}
 	accessGroupID := input.AccessGroupID
 	if input.Role == models.RoleAdmin {
 		accessGroupID = nil
@@ -213,9 +209,9 @@ func createUser(ctx context.Context, db interface {
 	}
 
 	// Build placeholders: $1, $2, ..., $N
-	placeholders := make([]string, len(args))
+	placeholders := make([]string, 0, len(args)+1)
 	for i := range args {
-		placeholders[i] = fmt.Sprintf("$%d", i+1)
+		placeholders = append(placeholders, fmt.Sprintf("$%d", i+1))
 	}
 	// Admins stay ungrouped: scope/action decisions are role-blind, so the
 	// default group's ceilings would cap the server owner (mirrors the
@@ -418,7 +414,7 @@ func updateUser(ctx context.Context, db interface {
 		{column: "max_local_stream_bitrate_kbps", set: input.MaxLocalStreamBitrateKbps.Set, value: input.MaxLocalStreamBitrateKbps.Value},
 		{column: "transcode_allowed", set: input.TranscodeAllowed.Set, value: input.TranscodeAllowed.Value},
 		{column: "audio_transcode_allowed", set: input.AudioTranscodeAllowed.Set, value: input.AudioTranscodeAllowed.Value},
-		{column: "max_profiles", set: input.MaxProfiles != nil, value: input.MaxProfiles},
+		{column: "max_profiles", set: input.MaxProfiles.Set, value: input.MaxProfiles.Value},
 		{column: "download_allowed", set: input.DownloadAllowed.Set, value: input.DownloadAllowed.Value},
 		{column: "download_transcode_allowed", set: input.DownloadTranscodeAllowed.Set, value: input.DownloadTranscodeAllowed.Value},
 		{column: "requests_allowed", set: input.RequestsAllowed.Set, value: input.RequestsAllowed.Value},
diff --git a/internal/auth/repository_policy_override_test.go b/internal/auth/repository_policy_override_test.go
index cd75e759ee..b72a2adbeb 100644
--- a/internal/auth/repository_policy_override_test.go
+++ b/internal/auth/repository_policy_override_test.go
@@ -23,12 +23,10 @@ func TestUserRepositoryPolicyOverridesDB(t *testing.T) {
 	}
 	if created.LibraryIDs != nil || created.MaxPlaybackQuality != nil || created.MaxStreams != nil ||
 		created.MaxTranscodes != nil || created.TranscodeAllowed != nil || created.AudioTranscodeAllowed != nil ||
-		created.DownloadAllowed != nil || created.DownloadTranscodeAllowed != nil || created.RequestsAllowed != nil {
+		created.DownloadAllowed != nil || created.DownloadTranscodeAllowed != nil || created.RequestsAllowed != nil ||
+		created.MaxProfiles != nil {
 		t.Fatalf("new user should inherit every policy field, got %+v", created)
 	}
-	if created.MaxProfiles < 1 {
-		t.Fatalf("MaxProfiles = %d, want the DB default", created.MaxProfiles)
-	}
 
 	input := createAuthAccessGroupUserInput(suffix, "policy-override", nil)
 	input.LibraryIDs = []int{}
@@ -40,6 +38,7 @@ func TestUserRepositoryPolicyOverridesDB(t *testing.T) {
 	input.DownloadAllowed = ptrOf(true)
 	input.DownloadTranscodeAllowed = ptrOf(false)
 	input.RequestsAllowed = ptrOf(false)
+	input.MaxProfiles = ptrOf(2)
 	overridden, err := users.Create(ctx, input)
 	if err != nil {
 		t.Fatalf("Create(overrides) error: %v", err)
@@ -62,6 +61,9 @@ func TestUserRepositoryPolicyOverridesDB(t *testing.T) {
 	if overridden.RequestsAllowed == nil || *overridden.RequestsAllowed {
 		t.Fatalf("RequestsAllowed = %v, want explicit false", overridden.RequestsAllowed)
 	}
+	if overridden.MaxProfiles == nil || *overridden.MaxProfiles != 2 {
+		t.Fatalf("MaxProfiles = %v, want 2", overridden.MaxProfiles)
+	}
 
 	// Update: set overrides on the inheriting user, bumping the policy
 	// revision only for the quality ceiling.
@@ -71,6 +73,7 @@ func TestUserRepositoryPolicyOverridesDB(t *testing.T) {
 		MaxPlaybackQuality: models.SetValue("1080p"),
 		MaxStreams:         models.SetValue(5),
 		DownloadAllowed:    models.SetValue(false),
+		MaxProfiles:        models.SetValue(3),
 	}); err != nil {
 		t.Fatalf("Update(set overrides) error: %v", err)
 	}
@@ -90,6 +93,9 @@ func TestUserRepositoryPolicyOverridesDB(t *testing.T) {
 	if updated.DownloadAllowed == nil || *updated.DownloadAllowed {
 		t.Fatalf("DownloadAllowed = %v, want explicit false", updated.DownloadAllowed)
 	}
+	if updated.MaxProfiles == nil || *updated.MaxProfiles != 3 {
+		t.Fatalf("MaxProfiles = %v, want 3", updated.MaxProfiles)
+	}
 	if updated.MaxTranscodes != nil || updated.TranscodeAllowed != nil {
 		t.Fatalf("untouched fields should still inherit, got transcodes=%v transcode_allowed=%v", updated.MaxTranscodes, updated.TranscodeAllowed)
 	}
@@ -103,6 +109,7 @@ func TestUserRepositoryPolicyOverridesDB(t *testing.T) {
 		MaxPlaybackQuality: models.ClearValue[string](),
 		MaxStreams:         models.ClearValue[int](),
 		DownloadAllowed:    models.ClearValue[bool](),
+		MaxProfiles:        models.ClearValue[int](),
 	}); err != nil {
 		t.Fatalf("Update(clear overrides) error: %v", err)
 	}
@@ -110,7 +117,8 @@ func TestUserRepositoryPolicyOverridesDB(t *testing.T) {
 	if err != nil {
 		t.Fatalf("GetByID() after clear error: %v", err)
 	}
-	if cleared.LibraryIDs != nil || cleared.MaxPlaybackQuality != nil || cleared.MaxStreams != nil || cleared.DownloadAllowed != nil {
+	if cleared.LibraryIDs != nil || cleared.MaxPlaybackQuality != nil || cleared.MaxStreams != nil || cleared.DownloadAllowed != nil ||
+		cleared.MaxProfiles != nil {
 		t.Fatalf("cleared fields should inherit, got %+v", cleared)
 	}
 	if cleared.AccessPolicyRevision != updated.AccessPolicyRevision+1 {
diff --git a/internal/autoscan/arrwebhook/parse.go b/internal/autoscan/arrwebhook/parse.go
index 6ede232d17..089162e64d 100644
--- a/internal/autoscan/arrwebhook/parse.go
+++ b/internal/autoscan/arrwebhook/parse.go
@@ -7,6 +7,7 @@
 package arrwebhook
 
 import (
+	"bytes"
 	"encoding/json"
 	"errors"
 	"strings"
@@ -67,7 +68,36 @@ type payload struct {
 	// Download/import payloads include the files replaced by an upgrade. They
 	// must be reconciled as vanished paths even when a separate "file delete for
 	// upgrade" notification is not enabled in arr.
-	DeletedFiles []fileRef `json:"deletedFiles"`
+	DeletedFiles    []fileRef       `json:"-"`
+	DeletedFilesRaw json.RawMessage `json:"deletedFiles"`
+}
+
+// folderDeleteEventTypes send deletedFiles as a bool (whether arr deleted the
+// folder) rather than as files.
+var folderDeleteEventTypes = map[string]bool{
+	"SeriesDelete": true,
+	"MovieDelete":  true,
+}
+
+// decodeDeletedFiles reads deletedFiles once the event type is known: the bool
+// folder-delete events send names no files, and anything else that is not a
+// list of files is malformed.
+func decodeDeletedFiles(eventType string, raw json.RawMessage) ([]fileRef, error) {
+	trimmed := bytes.TrimSpace(raw)
+	if len(trimmed) == 0 {
+		return nil, nil
+	}
+	if folderDeleteEventTypes[eventType] {
+		switch string(trimmed) {
+		case "true", "false":
+			return nil, nil
+		}
+	}
+	var files []fileRef
+	if err := json.Unmarshal(trimmed, &files); err != nil {
+		return nil, err
+	}
+	return files, nil
 }
 
 // importEventTypes are the events that carry newly imported files.
@@ -97,6 +127,11 @@ func Parse(provider string, body []byte) (ParsedWebhook, error) {
 	if eventType == "" {
 		return ParsedWebhook{}, ErrMalformedPayload
 	}
+	deletedFiles, err := decodeDeletedFiles(eventType, p.DeletedFilesRaw)
+	if err != nil {
+		return ParsedWebhook{}, ErrMalformedPayload
+	}
+	p.DeletedFiles = deletedFiles
 
 	out := ParsedWebhook{EventType: eventType, Provider: resolveProvider(provider, p)}
 	if strings.EqualFold(eventType, "Test") {
diff --git a/internal/autoscan/arrwebhook/parse_test.go b/internal/autoscan/arrwebhook/parse_test.go
index d0e66e44d3..73eb3be381 100644
--- a/internal/autoscan/arrwebhook/parse_test.go
+++ b/internal/autoscan/arrwebhook/parse_test.go
@@ -187,6 +187,39 @@ func TestParseUnknownEventIsNoOpNotError(t *testing.T) {
 	}
 }
 
+// SeriesDelete and MovieDelete send deletedFiles as a bool, not the file list
+// an upgrade's download carries; they are valid deliveries with nothing to do.
+func TestParseSeriesAndMovieDeleteAreNoOps(t *testing.T) {
+	for _, tc := range []struct{ fixture, eventType, provider string }{
+		{"sonarr_series_delete.json", "SeriesDelete", ProviderSonarr},
+		{"radarr_movie_delete.json", "MovieDelete", ProviderRadarr},
+	} {
+		parsed, err := Parse(ProviderAuto, fixture(t, tc.fixture))
+		if err != nil {
+			t.Fatalf("%s: Parse: %v", tc.fixture, err)
+		}
+		if parsed.EventType != tc.eventType || parsed.Provider != tc.provider || parsed.Test || len(parsed.Changes) != 0 {
+			t.Fatalf("%s: want a no-op %s from %s, got %+v", tc.fixture, tc.eventType, tc.provider, parsed)
+		}
+	}
+}
+
+// Outside SeriesDelete and MovieDelete, a deletedFiles value that is not a list
+// of files is malformed, so a broken upgrade payload is not accepted with its
+// replaced files dropped.
+func TestParseMalformedDeletedFiles(t *testing.T) {
+	for _, deleted := range []string{`[1]`, `{"path":"/tv/x/old.mkv"}`, `"/tv/x/old.mkv"`, `1`, `true`} {
+		body := []byte(`{"eventType":"Download","series":{"path":"/tv/x"},"deletedFiles":` + deleted + `}`)
+		if _, err := Parse(ProviderAuto, body); !errors.Is(err, ErrMalformedPayload) {
+			t.Fatalf("deletedFiles %s: want ErrMalformedPayload, got %v", deleted, err)
+		}
+	}
+	body := []byte(`{"eventType":"Download","series":{"path":"/tv/x"},"episodeFile":{"path":"/tv/x/new.mkv"},"deletedFiles":null}`)
+	if parsed, err := Parse(ProviderAuto, body); err != nil || len(parsed.Changes) != 1 {
+		t.Fatalf("deletedFiles null: got %+v, %v; want the imported file only", parsed, err)
+	}
+}
+
 func TestParseMalformedBody(t *testing.T) {
 	if _, err := Parse(ProviderAuto, []byte("{not json")); !errors.Is(err, ErrMalformedPayload) {
 		t.Fatalf("want ErrMalformedPayload, got %v", err)
diff --git a/internal/autoscan/arrwebhook/testdata/radarr_movie_delete.json b/internal/autoscan/arrwebhook/testdata/radarr_movie_delete.json
new file mode 100644
index 0000000000..a0a6aa9a18
--- /dev/null
+++ b/internal/autoscan/arrwebhook/testdata/radarr_movie_delete.json
@@ -0,0 +1,13 @@
+{
+  "movie": {
+    "id": 44,
+    "title": "Example Movie",
+    "year": 2024,
+    "folderPath": "/data/movies/Example Movie (2024)",
+    "tmdbId": 654321
+  },
+  "deletedFiles": false,
+  "movieFolderSize": 4294967296,
+  "eventType": "MovieDelete",
+  "instanceName": "Radarr"
+}
diff --git a/internal/autoscan/arrwebhook/testdata/sonarr_series_delete.json b/internal/autoscan/arrwebhook/testdata/sonarr_series_delete.json
new file mode 100644
index 0000000000..95396adc70
--- /dev/null
+++ b/internal/autoscan/arrwebhook/testdata/sonarr_series_delete.json
@@ -0,0 +1,12 @@
+{
+  "series": {
+    "id": 12,
+    "title": "Example Show",
+    "path": "/data/tv/Example Show",
+    "tvdbId": 123456,
+    "type": "standard"
+  },
+  "deletedFiles": true,
+  "eventType": "SeriesDelete",
+  "instanceName": "Sonarr"
+}
diff --git a/internal/autoscan/probe.go b/internal/autoscan/probe.go
index 4703cafbce..ea8f060219 100644
--- a/internal/autoscan/probe.go
+++ b/internal/autoscan/probe.go
@@ -34,14 +34,14 @@ func (s *Service) TestConnection(ctx context.Context, c Connection) (ConnectionT
 		return ConnectionTestResult{}, fmt.Errorf("autoscan: connection probe not configured")
 	}
 	resolved, err := s.connres.Resolve(ctx, c)
-	if err == nil {
-		version, err := probe.SystemStatus(ctx, resolved.BaseURL, resolved.APIKey)
-		if err == nil {
-			return ConnectionTestResult{OK: true, Version: version}, nil
-		}
-		return ConnectionTestResult{OK: false, Err: err.Error()}, nil
+	if err != nil {
+		return ConnectionTestResult{OK: false, Err: err.Error()}, nil //nolint:nilerr // a resolve failure is a probe outcome reported in the payload, per the contract above
+	}
+	version, err := probe.SystemStatus(ctx, resolved.BaseURL, resolved.APIKey)
+	if err != nil {
+		return ConnectionTestResult{OK: false, Err: err.Error()}, nil //nolint:nilerr // an unreachable or rejected endpoint is a probe outcome reported in the payload
 	}
-	return ConnectionTestResult{OK: false, Err: err.Error()}, nil
+	return ConnectionTestResult{OK: true, Version: version}, nil
 }
 
 // TestConnectionByID loads a stored connection by id and tests it.
diff --git a/internal/autoscan/repository.go b/internal/autoscan/repository.go
index cc4f839e53..9f8c75c00c 100644
--- a/internal/autoscan/repository.go
+++ b/internal/autoscan/repository.go
@@ -648,49 +648,71 @@ func (r *Repository) AdvanceMarker(ctx context.Context, adv MarkerAdvance) (bool
 	if src.ConnectionID != nil && (adv.Connection == nil || adv.Connection.ID != *src.ConnectionID) {
 		return false, fmt.Errorf("advance autoscan marker: source %s: the poll's connection row is missing or does not match its binding", src.ID)
 	}
+	wrote, err := r.writeIfPollStateHolds(ctx, src, adv.Connection,
+		`marker = $5, last_run_at = now(), last_error = NULL, updated_at = now()`, nullable(adv.NextMarker))
+	if err != nil {
+		return false, fmt.Errorf("advance autoscan marker: %w", err)
+	}
+	return wrote, nil
+}
+
+// writeIfPollStateHolds applies set to the source in one transaction, but only
+// while the source and connection rows a poll read still describe the upstream
+// it polled: the same marker, connection binding and source_config, and, when
+// conn is given, the same connection upstream. It reports whether it wrote.
+// $1-$4 in the statement are the snapshot, so set's own arguments start at $5.
+// A given conn must be the source's bound connection.
+//
+// The connection row is read FOR SHARE first, so a concurrent connection
+// update either commits before the check or waits for this write and then
+// resets it, matching UpdateConnection's lock order.
+func (r *Repository) writeIfPollStateHolds(ctx context.Context, src Source, conn *Connection, set string, args ...any) (bool, error) {
+	if conn != nil && (src.ConnectionID == nil || conn.ID != *src.ConnectionID) {
+		return false, fmt.Errorf("source %s: the poll's connection row does not match its binding", src.ID)
+	}
 	sourceConfig, err := sourceConfigSnapshot(src.SourceConfig)
 	if err != nil {
 		return false, err
 	}
 	tx, err := r.pool.Begin(ctx)
 	if err != nil {
-		return false, fmt.Errorf("begin autoscan marker advance: %w", err)
+		return false, fmt.Errorf("begin: %w", err)
 	}
 	defer func() { _ = tx.Rollback(ctx) }()
 
-	if src.ConnectionID != nil {
+	if conn != nil {
 		var current connectionUpstream
 		err := tx.QueryRow(ctx, `
 			SELECT base_url, request_integration_id
 			FROM autoscan_connections
 			WHERE id = $1
-			FOR SHARE`, adv.Connection.ID).Scan(&current.baseURL, &current.integrationID)
+			FOR SHARE`, conn.ID).Scan(&current.baseURL, &current.integrationID)
 		if errors.Is(err, pgx.ErrNoRows) {
 			return false, nil
 		}
 		if err != nil {
-			return false, fmt.Errorf("read autoscan connection for marker advance: %w", err)
+			return false, fmt.Errorf("read connection: %w", err)
 		}
-		if current.differsFrom(*adv.Connection) {
+		if current.differsFrom(*conn) {
 			return false, nil
 		}
 	}
 
 	tag, err := tx.Exec(ctx, `
 		UPDATE autoscan_sources
-		SET marker = $2, last_run_at = now(), last_error = NULL, updated_at = now()
+		SET `+set+`
 		WHERE id = $1
-		  AND COALESCE(marker, '') = $3
-		  AND connection_id IS NOT DISTINCT FROM $4::uuid
-		  AND source_config = $5::jsonb`,
-		src.ID, nullable(adv.NextMarker), derefString(src.Marker), connectionIDArg(src.ConnectionID), sourceConfig)
+		  AND COALESCE(marker, '') = $2
+		  AND connection_id IS NOT DISTINCT FROM $3::uuid
+		  AND source_config = $4::jsonb`,
+		append([]any{src.ID, derefString(src.Marker), connectionIDArg(src.ConnectionID), sourceConfig}, args...)...)
 	if err != nil {
-		return false, fmt.Errorf("advance autoscan marker: %w", err)
+		return false, err
 	}
 	if tag.RowsAffected() == 0 {
 		var exists bool
 		if err := tx.QueryRow(ctx, `SELECT EXISTS (SELECT 1 FROM autoscan_sources WHERE id = $1)`, src.ID).Scan(&exists); err != nil {
-			return false, fmt.Errorf("check autoscan source: %w", err)
+			return false, fmt.Errorf("check source: %w", err)
 		}
 		if !exists {
 			return false, fmt.Errorf("%w: source %s", ErrNotFound, src.ID)
@@ -698,7 +720,7 @@ func (r *Repository) AdvanceMarker(ctx context.Context, adv MarkerAdvance) (bool
 		return false, nil
 	}
 	if err := tx.Commit(ctx); err != nil {
-		return false, fmt.Errorf("commit autoscan marker advance: %w", err)
+		return false, fmt.Errorf("commit: %w", err)
 	}
 	return true, nil
 }
@@ -736,21 +758,36 @@ func truncateUTF8(s string, maxBytes int) string {
 	return s[:cut]
 }
 
+// PollFailure is a failed poll's error message together with the rows the poll
+// read, which the write is compared against as MarkerAdvance's are.
+type PollFailure struct {
+	// Source is the source row the poll used.
+	Source Source
+	// Connection is the connection row the poll read. It is nil when there is
+	// none to compare: the source has no connection, the poll failed before
+	// reading it, or the caller is a webhook delivery, which doesn't read it.
+	// Without it only the source's own columns are compared.
+	Connection *Connection
+	Message    string
+}
+
 // RecordError records a poll failure for a source: it stamps last_run_at and
 // stores the (length-bounded) error message without advancing the marker.
-func (r *Repository) RecordError(ctx context.Context, sourceID, msg string) error {
-	msg = truncateUTF8(msg, maxLastErrorLen)
-	tag, err := r.pool.Exec(ctx, `
-		UPDATE autoscan_sources
-		SET last_error = $2, last_run_at = now(), updated_at = now()
-		WHERE id = $1`, sourceID, msg)
+//
+// Like AdvanceMarker, it writes only while the poll's snapshot still holds. A
+// poll that read the source before an admin reset its marker was talking to
+// the old upstream, so its error says nothing about the new one, and stamping
+// last_run_at would make the source wait out its interval before its first
+// poll of the new upstream. RecordError then writes nothing and returns false;
+// the caller still records the error on the poll's own event.
+func (r *Repository) RecordError(ctx context.Context, failure PollFailure) (bool, error) {
+	msg := truncateUTF8(failure.Message, maxLastErrorLen)
+	wrote, err := r.writeIfPollStateHolds(ctx, failure.Source, failure.Connection,
+		`last_error = $5, last_run_at = now(), updated_at = now()`, msg)
 	if err != nil {
-		return fmt.Errorf("record autoscan error: %w", err)
-	}
-	if tag.RowsAffected() == 0 {
-		return fmt.Errorf("%w: source %s", ErrNotFound, sourceID)
+		return false, fmt.Errorf("record autoscan error: %w", err)
 	}
-	return nil
+	return wrote, nil
 }
 
 const eventColumns = `id, source_id, plugin_id, capability_id, started_at, completed_at,
diff --git a/internal/autoscan/repository_record_error_test.go b/internal/autoscan/repository_record_error_test.go
new file mode 100644
index 0000000000..b8148f2e2c
--- /dev/null
+++ b/internal/autoscan/repository_record_error_test.go
@@ -0,0 +1,159 @@
+package autoscan
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+)
+
+// A poll that fails after an admin reset its source was talking to the old
+// upstream. Its error must not land on the source, and last_run_at must stay
+// as the reset left it, so the next cycle polls the new upstream. Edits that
+// keep the upstream still record the error.
+func TestRecordErrorSkipsStalePoll(t *testing.T) {
+	const msg = "dial tcp: i/o timeout"
+	for name, tc := range map[string]struct {
+		unmarked     bool // the poll started without a marker
+		noConnection bool // the poll failed before it read its connection row
+		edit         func(ctx context.Context, t *testing.T, repo *Repository, src Source, other Connection)
+		wantRecord   bool
+	}{
+		"unchanged source records the error": {
+			edit:       func(context.Context, *testing.T, *Repository, Source, Connection) {},
+			wantRecord: true,
+		},
+		"label change still records the error": {
+			edit: func(ctx context.Context, t *testing.T, repo *Repository, src Source, _ Connection) {
+				src.Label = "Renamed"
+				mustUpdateSource(ctx, t, repo, src)
+			},
+			wantRecord: true,
+		},
+		"api key rotation still records the error": {
+			edit: func(ctx context.Context, t *testing.T, repo *Repository, src Source, _ Connection) {
+				editConnection(ctx, t, repo, *src.ConnectionID, func(c *Connection) { c.APIKeyRef = "rotated-key" })
+			},
+			wantRecord: true,
+		},
+		"source config change drops the error": {
+			edit: func(ctx context.Context, t *testing.T, repo *Repository, src Source, _ Connection) {
+				src.SourceConfig = map[string]string{"scope": "movies"}
+				mustUpdateSource(ctx, t, repo, src)
+			},
+		},
+		"connection switch drops the error": {
+			edit: func(ctx context.Context, t *testing.T, repo *Repository, src Source, other Connection) {
+				src.ConnectionID = &other.ID
+				mustUpdateSource(ctx, t, repo, src)
+			},
+		},
+		"connection repoint drops the error": {
+			edit: func(ctx context.Context, t *testing.T, repo *Repository, src Source, _ Connection) {
+				editConnection(ctx, t, repo, *src.ConnectionID, func(c *Connection) { c.BaseURL = "http://sonarr-4k.invalid" })
+			},
+		},
+		"connection repoint without a starting marker drops the error": {
+			unmarked: true,
+			edit: func(ctx context.Context, t *testing.T, repo *Repository, src Source, _ Connection) {
+				editConnection(ctx, t, repo, *src.ConnectionID, func(c *Connection) { c.BaseURL = "http://sonarr-4k.invalid" })
+			},
+		},
+		"no connection row, unchanged source records the error": {
+			noConnection: true,
+			edit:         func(context.Context, *testing.T, *Repository, Source, Connection) {},
+			wantRecord:   true,
+		},
+		"no connection row, source config change drops the error": {
+			noConnection: true,
+			edit: func(ctx context.Context, t *testing.T, repo *Repository, src Source, _ Connection) {
+				src.SourceConfig = map[string]string{"scope": "movies"}
+				mustUpdateSource(ctx, t, repo, src)
+			},
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			ctx, repo, src, other := newSourceMarkerDBTest(t)
+			if tc.unmarked {
+				// Clear the seeded marker, as a fresh source has none.
+				src.SourceConfig = map[string]string{"scope": "fresh"}
+				src = mustUpdateSource(ctx, t, repo, src)
+				if src.Marker != nil {
+					t.Fatalf("marker = %q, want none before the poll", *src.Marker)
+				}
+			}
+			snap := pollSnapshot(ctx, t, repo, src)
+			failure := PollFailure{Source: snap.Source, Connection: snap.Connection, Message: msg}
+			if tc.noConnection {
+				failure.Connection = nil
+			}
+
+			tc.edit(ctx, t, repo, snap.Source, other)
+			afterEdit := mustGetSource(ctx, t, repo, src.ID)
+
+			recorded, err := repo.RecordError(ctx, failure)
+			if err != nil {
+				t.Fatalf("record error: %v", err)
+			}
+			got := mustGetSource(ctx, t, repo, src.ID)
+			if recorded != tc.wantRecord {
+				t.Fatalf("recorded = %v, want %v", recorded, tc.wantRecord)
+			}
+			if tc.wantRecord {
+				if got.LastError == nil || *got.LastError != msg {
+					t.Fatalf("last_error = %v, want %q", got.LastError, msg)
+				}
+				if got.LastRunAt == nil {
+					t.Fatal("last_run_at not stamped by the error")
+				}
+				return
+			}
+			if afterEdit.Marker != nil {
+				t.Fatalf("edit left marker %q, want the reset", *afterEdit.Marker)
+			}
+			if got.LastError != nil {
+				t.Fatalf("stale poll wrote last_error %q over the reset", *got.LastError)
+			}
+			if !sameTime(got.LastRunAt, afterEdit.LastRunAt) {
+				t.Fatalf("last_run_at = %v, want %v as the edit left it", got.LastRunAt, afterEdit.LastRunAt)
+			}
+		})
+	}
+}
+
+func TestRecordErrorUnknownSource(t *testing.T) {
+	ctx, repo, src, _ := newSourceMarkerDBTest(t)
+	snap := pollSnapshot(ctx, t, repo, src)
+	snap.Source.ID = "00000000-0000-0000-0000-000000000000"
+	if _, err := repo.RecordError(ctx, PollFailure{Source: snap.Source, Connection: snap.Connection, Message: "x"}); !errors.Is(err, ErrNotFound) {
+		t.Fatalf("err = %v, want ErrNotFound", err)
+	}
+}
+
+// A connection row that isn't the source's binding can't vouch for its upstream.
+func TestRecordErrorRejectsAnotherConnectionsRow(t *testing.T) {
+	ctx, repo, src, other := newSourceMarkerDBTest(t)
+	snap := pollSnapshot(ctx, t, repo, src)
+	if _, err := repo.RecordError(ctx, PollFailure{Source: snap.Source, Connection: &other, Message: "x"}); err == nil {
+		t.Fatal("recording with another connection's row succeeded")
+	}
+	if got := mustGetSource(ctx, t, repo, src.ID); got.LastError != nil {
+		t.Fatalf("last_error = %q, want none", *got.LastError)
+	}
+}
+
+func mustGetSource(ctx context.Context, t *testing.T, repo *Repository, id string) Source {
+	t.Helper()
+	src, err := repo.GetSource(ctx, id)
+	if err != nil {
+		t.Fatalf("get source: %v", err)
+	}
+	return src
+}
+
+func sameTime(a, b *time.Time) bool {
+	if a == nil || b == nil {
+		return a == b
+	}
+	return a.Equal(*b)
+}
diff --git a/internal/autoscan/repository_source_marker_test.go b/internal/autoscan/repository_source_marker_test.go
index 044988ae95..952bee7cc9 100644
--- a/internal/autoscan/repository_source_marker_test.go
+++ b/internal/autoscan/repository_source_marker_test.go
@@ -440,8 +440,9 @@ func TestUpdateConnectionMarkerReset(t *testing.T) {
 				t.Fatalf("create source: %v", err)
 			}
 			t.Cleanup(func() { _ = repo.DeleteSource(ctx, failedFirst.ID) })
-			if err := repo.RecordError(ctx, failedFirst.ID, "connection refused"); err != nil {
-				t.Fatalf("record error: %v", err)
+			recorded, err := repo.RecordError(ctx, PollFailure{Source: failedFirst, Message: "connection refused"})
+			if err != nil || !recorded {
+				t.Fatalf("record error = %v, %v; want true, nil", recorded, err)
 			}
 
 			conn, err := repo.GetConnection(ctx, *bound.ConnectionID)
diff --git a/internal/autoscan/service.go b/internal/autoscan/service.go
index 5ab39860fc..d9cd06c362 100644
--- a/internal/autoscan/service.go
+++ b/internal/autoscan/service.go
@@ -31,7 +31,7 @@ type Store interface {
 	GetSource(ctx context.Context, id string) (Source, error)
 	GetConnection(ctx context.Context, id string) (Connection, error)
 	AdvanceMarker(ctx context.Context, adv MarkerAdvance) (bool, error)
-	RecordError(ctx context.Context, sourceID, msg string) error
+	RecordError(ctx context.Context, failure PollFailure) (bool, error)
 	CreateEvent(ctx context.Context, event EventCreate) (int64, error)
 	FinishEvent(ctx context.Context, event EventFinish) error
 	CreateWebhookDelivery(ctx context.Context, in ChangeIngest) (WebhookDelivery, error)
@@ -233,7 +233,7 @@ func (s *Service) poll(ctx context.Context, ignoreIntervals bool) error {
 				requirementsLoaded = true
 			}
 			if requirements[sourceIdentity{src.PluginID, src.CapabilityID}] == ConnectionRequired {
-				s.failPoll(ctx, src, eventID, marker, missingConnectionMessage)
+				s.failPoll(ctx, PollFailure{Source: src, Message: missingConnectionMessage}, eventID, marker)
 				continue
 			}
 		}
@@ -243,7 +243,12 @@ func (s *Service) poll(ctx context.Context, ignoreIntervals bool) error {
 			row, resolved, cerr := s.resolveConnection(ctx, *src.ConnectionID)
 			if cerr != nil {
 				slog.WarnContext(ctx, "autoscan: resolve connection failed", "component", "autoscan", "source_id", src.ID, "err", cerr)
-				s.failPoll(ctx, src, eventID, marker, cerr.Error())
+				failure := PollFailure{Source: src, Message: cerr.Error()}
+				if row.ID != "" {
+					// The row was read; only resolving its credentials failed.
+					failure.Connection = &row
+				}
+				s.failPoll(ctx, failure, eventID, marker)
 				continue
 			}
 			conn = resolved
@@ -252,7 +257,7 @@ func (s *Service) poll(ctx context.Context, ignoreIntervals bool) error {
 		changes, next, perr := s.provider.PollChanges(ctx, src.PluginID, src.CapabilityID, marker, conn, src.SourceConfig)
 		if perr != nil {
 			slog.WarnContext(ctx, "autoscan: poll changes failed", "component", "autoscan", "source_id", src.ID, "err", perr)
-			s.failPoll(ctx, src, eventID, marker, pollErrorMessage(perr))
+			s.failPoll(ctx, PollFailure{Source: src, Connection: connRow, Message: pollErrorMessage(perr)}, eventID, marker)
 			continue // do NOT advance marker
 		}
 
@@ -275,12 +280,14 @@ func (s *Service) poll(ctx context.Context, ignoreIntervals bool) error {
 // who sees it on the source row and in poll activity.
 const missingConnectionMessage = "No server selected. Edit the source and choose a server."
 
-// failPoll records a poll that ended before the provider returned changes: the
-// source's last_error and the event both carry msg, and the marker is held so
-// the next poll re-reads the same window.
-func (s *Service) failPoll(ctx context.Context, src Source, eventID int64, marker, msg string) {
-	if rerr := s.store.RecordError(ctx, src.ID, msg); rerr != nil {
-		slog.WarnContext(ctx, "autoscan: record error failed", "component", "autoscan", "source_id", src.ID, "err", rerr)
+// failPoll records a poll that ended before the provider returned changes. The
+// event carries the failure's message, and so does the source's last_error
+// unless an admin edit reset the source while the poll ran. The marker is held
+// so the next poll re-reads the same window.
+func (s *Service) failPoll(ctx context.Context, failure PollFailure, eventID int64, marker string) {
+	msg := failure.Message
+	if s.recordPollError(ctx, failure) {
+		msg += "; " + errorNotStoredMessage
 	}
 	s.finishEvent(ctx, eventID, EventFinish{
 		Status:       EventStatusError,
@@ -289,6 +296,26 @@ func (s *Service) failPoll(ctx context.Context, src Source, eventID int64, marke
 	})
 }
 
+// errorNotStoredMessage notes on a poll event that the source changed while
+// the poll ran, so its error was kept off the source.
+const errorNotStoredMessage = "source changed during the poll; its error was not stored on the source"
+
+// recordPollError stores a failed poll's error on its source, and reports
+// whether it skipped the write because an admin edit reset the source while
+// the poll ran. Such an error belongs to the old upstream, so only the poll's
+// event keeps it.
+func (s *Service) recordPollError(ctx context.Context, failure PollFailure) (sourceChanged bool) {
+	recorded, err := s.store.RecordError(ctx, failure)
+	if err != nil {
+		slog.WarnContext(ctx, "autoscan: record error failed", "component", "autoscan", "source_id", failure.Source.ID, "err", err)
+		return false
+	}
+	if !recorded {
+		slog.DebugContext(ctx, "autoscan: source changed during poll; not storing its error", "component", "autoscan", "source_id", failure.Source.ID)
+	}
+	return !recorded
+}
+
 // sourceIdentity is the (plugin, capability) pair a source is created against.
 type sourceIdentity struct {
 	pluginID     string
@@ -329,7 +356,8 @@ type consumeOptions struct {
 	NextMarker    string // poll: the provider's next marker
 	AdvanceMarker bool   // poll: true; webhook: false
 	// Connection is the connection row the poll read from (nil when the
-	// source has none); the marker advance is conditional on it.
+	// source has none); the marker advance, and recording an error on the
+	// source, are conditional on it.
 	Connection *Connection
 }
 
@@ -426,8 +454,8 @@ func (s *Service) consumeSourceChanges(ctx context.Context, src Source, changes
 		if opts.AdvanceMarker {
 			msg += " — holding marker to retry"
 		}
-		if rerr := s.store.RecordError(ctx, src.ID, msg); rerr != nil {
-			slog.WarnContext(ctx, "autoscan: record error failed", "component", "autoscan", "source_id", src.ID, "err", rerr)
+		if s.recordPollError(ctx, PollFailure{Source: src, Connection: opts.Connection, Message: msg}) {
+			msg += "; " + errorNotStoredMessage
 		}
 		result.Status = EventStatusError
 		finish(EventFinish{
diff --git a/internal/autoscan/service_test.go b/internal/autoscan/service_test.go
index 021a84fe1a..9f20787e2e 100644
--- a/internal/autoscan/service_test.go
+++ b/internal/autoscan/service_test.go
@@ -24,6 +24,9 @@ type fakeStore struct {
 	advances       []MarkerAdvance   // every advance attempt, stored or not
 	staleAdvance   bool              // reject advances as if an admin reset the marker
 	recorded       map[string]string // source ID -> error message
+	failures       []PollFailure     // every error write, with the rows the poll read
+	staleError     bool              // skip error writes as if an admin reset the source
+	getConnErr     error
 	createdEvents  []EventCreate
 	events         []EventFinish
 	createEventErr error
@@ -46,6 +49,9 @@ func (f *fakeStore) GetSource(_ context.Context, id string) (Source, error) {
 	return Source{}, ErrNotFound
 }
 func (f *fakeStore) GetConnection(context.Context, string) (Connection, error) {
+	if f.getConnErr != nil {
+		return Connection{}, f.getConnErr
+	}
 	return f.connection, nil
 }
 func (f *fakeStore) AdvanceMarker(_ context.Context, adv MarkerAdvance) (bool, error) {
@@ -59,12 +65,16 @@ func (f *fakeStore) AdvanceMarker(_ context.Context, adv MarkerAdvance) (bool, e
 	f.advanced[adv.Source.ID] = adv.NextMarker
 	return true, nil
 }
-func (f *fakeStore) RecordError(_ context.Context, sourceID, msg string) error {
+func (f *fakeStore) RecordError(_ context.Context, failure PollFailure) (bool, error) {
+	f.failures = append(f.failures, failure)
+	if f.staleError {
+		return false, nil
+	}
 	if f.recorded == nil {
 		f.recorded = map[string]string{}
 	}
-	f.recorded[sourceID] = msg
-	return nil
+	f.recorded[failure.Source.ID] = failure.Message
+	return true, nil
 }
 func (f *fakeStore) CreateEvent(_ context.Context, event EventCreate) (int64, error) {
 	if f.createEventErr != nil {
@@ -1126,6 +1136,116 @@ func TestPollOnceAdvancesMarkerWhenPathsReturnedButNoneResolve(t *testing.T) {
 	}
 }
 
+// A failed poll's error is written against the rows the poll read, so the
+// store can drop it when an admin reset the source while the poll ran.
+func TestPollOnceRecordsAFailureAgainstTheRowsThePollRead(t *testing.T) {
+	store := &fakeStore{
+		settings: Settings{Enabled: true, DefaultPollIntervalSeconds: 600},
+		sources: []Source{{
+			ID: "s1", PluginID: "prairie.autoscan.arr", CapabilityID: "arr", ConnectionID: strptr("c1"),
+			Marker: strptr("m0"), SourceConfig: map[string]string{"scope": "all"}, Enabled: true,
+		}},
+		connection: Connection{ID: "c1", Kind: "sonarr", BaseURL: "http://sonarr.invalid"},
+	}
+	prov := &fakeProvider{err: errors.New("dial tcp: i/o timeout")}
+	svc := NewService(store, prov, passthroughConnRes{}, nil, &recordingQueuer{}, allowSuppressor{}, nil)
+	if err := svc.PollOnce(context.Background()); err != nil {
+		t.Fatalf("PollOnce: %v", err)
+	}
+	if len(store.failures) != 1 {
+		t.Fatalf("error writes = %d, want 1", len(store.failures))
+	}
+	failure := store.failures[0]
+	if failure.Source.Marker == nil || *failure.Source.Marker != "m0" || failure.Source.SourceConfig["scope"] != "all" {
+		t.Fatalf("failure source = %+v, want the row the poll read", failure.Source)
+	}
+	if failure.Connection == nil || failure.Connection.ID != "c1" || failure.Connection.BaseURL != "http://sonarr.invalid" {
+		t.Fatalf("failure connection = %+v, want the row the poll resolved", failure.Connection)
+	}
+	if len(store.events) != 1 || store.events[0].Status != EventStatusError || store.events[0].ErrorMessage != failure.Message {
+		t.Fatalf("events = %+v, want the error on the poll's event", store.events)
+	}
+}
+
+// When an admin reset the source while the poll ran, the error stays off the
+// source, and the poll's event says so and still holds the marker.
+func TestPollOnceNotesAnErrorItCouldNotStore(t *testing.T) {
+	store := &fakeStore{
+		settings: Settings{Enabled: true, DefaultPollIntervalSeconds: 600},
+		sources: []Source{{
+			ID: "s1", PluginID: "prairie.autoscan.arr", CapabilityID: "arr", ConnectionID: strptr("c1"),
+			Marker: strptr("m0"), Enabled: true,
+		}},
+		connection: Connection{ID: "c1", Kind: "sonarr", BaseURL: "http://sonarr.invalid"},
+		staleError: true,
+	}
+	prov := &fakeProvider{err: errors.New("dial tcp: i/o timeout")}
+	svc := NewService(store, prov, passthroughConnRes{}, nil, &recordingQueuer{}, allowSuppressor{}, nil)
+	if err := svc.PollOnce(context.Background()); err != nil {
+		t.Fatalf("PollOnce: %v", err)
+	}
+	if _, ok := store.recorded["s1"]; ok {
+		t.Fatal("the error was stored on the source")
+	}
+	if len(store.events) != 1 {
+		t.Fatalf("events = %d, want 1", len(store.events))
+	}
+	event := store.events[0]
+	if event.Status != EventStatusError || event.MarkerAfter != "m0" {
+		t.Fatalf("event = %+v, want an error holding marker m0", event)
+	}
+	if want := "dial tcp: i/o timeout; " + errorNotStoredMessage; event.ErrorMessage != want {
+		t.Fatalf("event message = %q, want %q", event.ErrorMessage, want)
+	}
+}
+
+type failingConnRes struct{}
+
+func (failingConnRes) Resolve(context.Context, Connection) (ResolvedConnection, error) {
+	return ResolvedConnection{}, errors.New("linked Requests integration is unavailable")
+}
+
+// A poll that fails resolving its connection compares the connection row when
+// it read one, and only the source's own columns when the lookup itself failed.
+func TestPollOnceResolveFailureCarriesTheRowItRead(t *testing.T) {
+	for name, tc := range map[string]struct {
+		getConnErr error
+		wantRow    bool
+	}{
+		"credentials failed after the row was read": {wantRow: true},
+		"the row lookup failed":                     {getConnErr: errors.New("connection refused")},
+	} {
+		t.Run(name, func(t *testing.T) {
+			store := &fakeStore{
+				settings: Settings{Enabled: true, DefaultPollIntervalSeconds: 600},
+				sources: []Source{{
+					ID: "s1", PluginID: "prairie.autoscan.arr", CapabilityID: "arr", ConnectionID: strptr("c1"), Enabled: true,
+				}},
+				connection: Connection{ID: "c1", Kind: "sonarr", BaseURL: "http://sonarr.invalid"},
+				getConnErr: tc.getConnErr,
+			}
+			prov := &fakeProvider{}
+			svc := NewService(store, prov, failingConnRes{}, nil, &recordingQueuer{}, allowSuppressor{}, nil)
+			if err := svc.PollOnce(context.Background()); err != nil {
+				t.Fatalf("PollOnce: %v", err)
+			}
+			if prov.calls != 0 {
+				t.Fatalf("plugin polled %d times after the connection failed", prov.calls)
+			}
+			if len(store.failures) != 1 {
+				t.Fatalf("error writes = %d, want 1", len(store.failures))
+			}
+			got := store.failures[0].Connection
+			if tc.wantRow && (got == nil || got.ID != "c1") {
+				t.Fatalf("failure connection = %+v, want the row the poll read", got)
+			}
+			if !tc.wantRow && got != nil {
+				t.Fatalf("failure connection = %+v, want none after the lookup failed", got)
+			}
+		})
+	}
+}
+
 func TestPollOnceHoldsMarkerOnTransientResolveFailure(t *testing.T) {
 	// Nothing resolved because the resolver failed INTERNALLY (e.g. a database
 	// fault), not because the paths are outside Prairie's libraries. Advancing
diff --git a/internal/autoscan/suppress.go b/internal/autoscan/suppress.go
index 0ff46be28f..b200c13e70 100644
--- a/internal/autoscan/suppress.go
+++ b/internal/autoscan/suppress.go
@@ -54,7 +54,7 @@ func (s *redisSuppressor) ShouldScan(ctx context.Context, key, state string, ttl
 	ttlMillis := max(ttl.Milliseconds(), 1)
 	claimed, err := claimStateScript.Run(ctx, s.client, []string{suppressRedisKey(key)}, state, ttlMillis).Int()
 	if err != nil {
-		return true, nil //nolint:nilerr // fail open: a Redis hiccup should not block scanning
+		return true, nil //nolint:nilerr // fail open: a Redis hiccup should not block scanning, and claimTarget drops the scan on any error
 	}
 	return claimed == 1, nil
 }
diff --git a/internal/bandwidthprobe/bandwidthprobe.go b/internal/bandwidthprobe/bandwidthprobe.go
new file mode 100644
index 0000000000..405496d48e
--- /dev/null
+++ b/internal/bandwidthprobe/bandwidthprobe.go
@@ -0,0 +1,38 @@
+// Package bandwidthprobe writes the payload clients download to measure their
+// throughput to the server.
+package bandwidthprobe
+
+import (
+	crand "crypto/rand"
+	"io"
+	"math/rand/v2"
+)
+
+// MaxSize is the largest probe a client may request. It is large enough to
+// time a fast link for a couple of seconds and small enough that a probe stays
+// cheap next to the media the same viewer could download.
+const MaxSize = 100_000_000
+
+// Write sends size random bytes to w. The bytes are random rather than
+// constant so a compressing proxy cannot shrink the payload and inflate the
+// measured bandwidth. It stops at the first write error, which is how a client
+// that has seen enough ends the probe.
+func Write(w io.Writer, size int) error {
+	var seed [32]byte
+	_, _ = crand.Read(seed[:])
+	source := rand.NewChaCha8(seed)
+	block := make([]byte, min(size, 32768))
+	for size > 0 {
+		chunk := block[:min(size, len(block))]
+		_, _ = source.Read(chunk)
+		n, err := w.Write(chunk)
+		if err != nil {
+			return err
+		}
+		if n == 0 {
+			return io.ErrShortWrite
+		}
+		size -= n
+	}
+	return nil
+}
diff --git a/internal/bandwidthprobe/bandwidthprobe_test.go b/internal/bandwidthprobe/bandwidthprobe_test.go
new file mode 100644
index 0000000000..9f71333b47
--- /dev/null
+++ b/internal/bandwidthprobe/bandwidthprobe_test.go
@@ -0,0 +1,46 @@
+package bandwidthprobe
+
+import (
+	"bytes"
+	"errors"
+	"testing"
+)
+
+func TestWriteSendsExactlySizeBytes(t *testing.T) {
+	for _, size := range []int{1, 32768, 100_000} {
+		var buf bytes.Buffer
+		if err := Write(&buf, size); err != nil {
+			t.Fatalf("Write(%d): %v", size, err)
+		}
+		if buf.Len() != size {
+			t.Fatalf("Write(%d) wrote %d bytes", size, buf.Len())
+		}
+	}
+}
+
+func TestWriteIsNotCompressible(t *testing.T) {
+	var buf bytes.Buffer
+	if err := Write(&buf, 4096); err != nil {
+		t.Fatal(err)
+	}
+	if bytes.Count(buf.Bytes(), buf.Bytes()[:1]) > 256 {
+		t.Fatal("probe payload repeats one byte value; a compressing proxy would shrink it")
+	}
+}
+
+type failingWriter struct{ writes int }
+
+func (f *failingWriter) Write(p []byte) (int, error) {
+	f.writes++
+	return 0, errors.New("client went away")
+}
+
+func TestWriteStopsAtFirstError(t *testing.T) {
+	w := &failingWriter{}
+	if err := Write(w, 1_000_000); err == nil {
+		t.Fatal("expected the write error")
+	}
+	if w.writes != 1 {
+		t.Fatalf("kept writing after an error: %d writes", w.writes)
+	}
+}
diff --git a/internal/blobgc/blobgc_db_test.go b/internal/blobgc/blobgc_db_test.go
index a18e94043f..cbd124d8f0 100644
--- a/internal/blobgc/blobgc_db_test.go
+++ b/internal/blobgc/blobgc_db_test.go
@@ -190,6 +190,9 @@ func queueRows(t *testing.T, pool *pgxpool.Pool) map[string]queueRow {
 		}
 		result[prefix] = row
 	}
+	if err := rows.Err(); err != nil {
+		t.Fatal(err)
+	}
 	return result
 }
 
diff --git a/internal/blobstore/blobstoretest/memory.go b/internal/blobstore/blobstoretest/memory.go
index b18fc1bec8..91aea7f1fa 100644
--- a/internal/blobstore/blobstoretest/memory.go
+++ b/internal/blobstore/blobstoretest/memory.go
@@ -122,3 +122,17 @@ func (m *Memory) Probe(context.Context) error { return nil }
 func (m *Memory) Identity() string            { return "memory" }
 
 var _ blobstore.Store = (*Memory)(nil)
+
+// Direct is a Memory whose direct URLs point at Base, like S3-compatible
+// storage on the server's local network.
+type Direct struct {
+	*Memory
+	Base string
+}
+
+// NewDirect returns an empty Direct store serving direct URLs from base.
+func NewDirect(base string) Direct { return Direct{Memory: New(), Base: base} }
+
+func (d Direct) DirectURL(_ context.Context, key string, ttl, _ time.Duration) (string, time.Time, error) {
+	return d.Base + "/" + key + "?X-Amz-Signature=test", time.Now().Add(ttl), nil
+}
diff --git a/internal/blobstore/bytes.go b/internal/blobstore/bytes.go
index 3fec216447..d9b18b151d 100644
--- a/internal/blobstore/bytes.go
+++ b/internal/blobstore/bytes.go
@@ -40,11 +40,11 @@ func (b *ByteStore) Get(ctx context.Context, key string) ([]byte, error) {
 // Delete removes one object. An absent key counts as deleted, matching the
 // store contract, so cleanup after a failed publish is not an error.
 //
-// The count is checked rather than discarded. S3 batch deletion reports
-// per-object failures in its response body and still returns a nil error with a
-// short count, so ignoring it would report success while the object remains.
-// Subtitle deletion removes the database row before the object, and a silent
-// success there leaves an orphan nothing will ever look for again.
+// The count is checked as well as the error. The store contract reports
+// failures as an error, but a backend that returned a short count with a nil
+// error would otherwise report success while the object remains. Subtitle
+// deletion removes the database row before the object, and a silent success
+// there leaves an orphan nothing will ever look for again.
 func (b *ByteStore) Delete(ctx context.Context, key string) error {
 	deleted, err := b.store.Delete(ctx, []string{key})
 	if err != nil {
diff --git a/internal/blobstore/filesystem.go b/internal/blobstore/filesystem.go
index 159268f03f..64bf2812f2 100644
--- a/internal/blobstore/filesystem.go
+++ b/internal/blobstore/filesystem.go
@@ -524,7 +524,7 @@ func (f *Filesystem) Probe(ctx context.Context) error {
 		return err
 	}
 	defer func() { _ = root.Remove(name) }()
-	_, err = file.Write([]byte("ok"))
+	_, err = file.WriteString("ok")
 	if err == nil {
 		err = file.Sync()
 	}
diff --git a/internal/cache/redis.go b/internal/cache/redis.go
index 3f3acd3f96..7f4b3ce87b 100644
--- a/internal/cache/redis.go
+++ b/internal/cache/redis.go
@@ -271,6 +271,37 @@ func redisChannel(channel string, db int) string {
 	return channel + "@db" + strconv.Itoa(db)
 }
 
+// eventBusChannels are the channels a starting server subscribes to. Redis
+// refuses a subscription that the user's ACL does not grant, and a refused
+// subscription stops the start.
+var eventBusChannels = []string{ChannelCatalog, ChannelAdmin, ChannelPlayback, ChannelLogs, ChannelEvents}
+
+// CheckEventBusChannels subscribes client to every event bus channel on its
+// database number, as a starting server does, and returns the error Redis
+// answers with. It leaves no subscription behind.
+func CheckEventBusChannels(ctx context.Context, client *redis.Client) error {
+	db := client.Options().DB
+	channels := make([]string, 0, len(eventBusChannels))
+	for _, channel := range eventBusChannels {
+		channels = append(channels, redisChannel(channel, db))
+	}
+	pubsub := client.Subscribe(ctx, channels...)
+	defer func() { _ = pubsub.Close() }()
+	// Redis refuses the whole command when its ACL denies one channel, but a
+	// compatible server or a proxy can answer each channel on its own, so
+	// every channel's confirmation is read.
+	for confirmed := 0; confirmed < len(channels); {
+		msg, err := pubsub.Receive(ctx)
+		if err != nil {
+			return err
+		}
+		if _, ok := msg.(*redis.Subscription); ok {
+			confirmed++
+		}
+	}
+	return nil
+}
+
 // Publish serializes the event as JSON and publishes it on the given
 // channel, scoped to the bus's database number.
 func (r *RedisEventBus) Publish(ctx context.Context, channel string, event Event) error {
@@ -492,9 +523,27 @@ func newRedisClient(cfg config.RedisConfig, honorContextDeadlines bool) (*redis.
 		return nil, false, err
 	}
 	if failover != nil {
-		failover.ContextTimeoutEnabled = failover.ContextTimeoutEnabled || honorContextDeadlines
+		if honorContextDeadlines {
+			failover.ContextTimeoutEnabled = true
+			keepSocketDeadlines(&failover.ReadTimeout, &failover.WriteTimeout)
+		}
 		return redis.NewFailoverClient(failover), true, nil
 	}
-	options.ContextTimeoutEnabled = options.ContextTimeoutEnabled || honorContextDeadlines
+	if honorContextDeadlines {
+		options.ContextTimeoutEnabled = true
+		keepSocketDeadlines(&options.ReadTimeout, &options.WriteTimeout)
+	}
 	return redis.NewClient(options), false, nil
 }
+
+// keepSocketDeadlines turns a negative timeout into -1, which go-redis reads
+// as no timeout of its own, so the context's deadline still reaches the
+// socket. go-redis sets no socket deadline at all, context or not, for any
+// other negative timeout, such as the -1s a URL's read_timeout=-1s gives.
+func keepSocketDeadlines(timeouts ...*time.Duration) {
+	for _, timeout := range timeouts {
+		if *timeout < 0 {
+			*timeout = -1
+		}
+	}
+}
diff --git a/internal/cache/redis_eventbus_test.go b/internal/cache/redis_eventbus_test.go
index 5c83df9115..72401cf0de 100644
--- a/internal/cache/redis_eventbus_test.go
+++ b/internal/cache/redis_eventbus_test.go
@@ -2,6 +2,7 @@ package cache
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
 	"os"
 	"slices"
@@ -119,6 +120,58 @@ func TestRedisEventBusSendsScopedChannelToRedis(t *testing.T) {
 	}
 }
 
+// The admin settings check subscribes the way a starting server does: to every
+// event bus channel, scoped to the database number.
+func TestCheckEventBusChannels(t *testing.T) {
+	check := func(t *testing.T, server *respTestServer, path string) error {
+		t.Helper()
+		client, err := NewRedisClientForRole(config.RedisConfig{URL: "redis://" + server.addr + path}, "checks")
+		if err != nil {
+			t.Fatal(err)
+		}
+		t.Cleanup(func() { _ = CloseRedisClient(client) })
+		return CheckEventBusChannels(t.Context(), client)
+	}
+
+	for _, tc := range []struct{ path, want string }{
+		{"/3", "SUBSCRIBE silo:catalog@db3 silo:admin@db3 silo:playback@db3 silo:logs@db3 silo:events@db3"},
+		{"/0", "SUBSCRIBE silo:catalog silo:admin silo:playback silo:logs silo:events"},
+	} {
+		server := startRESPTestServer(t, nil, respTestRedis)
+		if err := check(t, server, tc.path); err != nil {
+			t.Fatalf("%s: %v", tc.path, err)
+		}
+		if got := server.received(); !slices.Contains(got, tc.want) {
+			t.Errorf("%s: Redis received %q, want %q", tc.path, got, tc.want)
+		}
+	}
+
+	server := startRESPTestServer(t, nil, func(args []string) (string, bool) {
+		if args[0] != "SUBSCRIBE" {
+			return "", false
+		}
+		return "-NOPERM User silo has no permissions to access the 'silo:catalog' channel\r\n", true
+	})
+	err := check(t, server, "/0")
+	if _, refused := errors.AsType[redis.Error](err); !refused || !strings.Contains(err.Error(), "NOPERM") {
+		t.Errorf("a subscription the ACL denies: %v, want the NOPERM reply", err)
+	}
+
+	// A server that answers each channel on its own can confirm the first and
+	// refuse a later one.
+	server = startRESPTestServer(t, nil, func(args []string) (string, bool) {
+		if args[0] != "SUBSCRIBE" {
+			return "", false
+		}
+		return fmt.Sprintf("*3\r\n$9\r\nsubscribe\r\n$%d\r\n%s\r\n:1\r\n", len(args[1]), args[1]) +
+			"-NOPERM User silo has no permissions to access the '" + args[2] + "' channel\r\n", true
+	})
+	err = check(t, server, "/0")
+	if _, refused := errors.AsType[redis.Error](err); !refused || !strings.Contains(err.Error(), "silo:admin") {
+		t.Errorf("a later channel refused: %v, want the NOPERM reply for silo:admin", err)
+	}
+}
+
 func TestRedisEventBusRejectsInvalidDatabaseOnBareAddress(t *testing.T) {
 	for _, db := range []string{"five", "-1", "999999999999999999999999999999"} {
 		t.Run(db, func(t *testing.T) {
diff --git a/internal/catalog/access_filter.go b/internal/catalog/access_filter.go
index 767b2628e6..a409d1151c 100644
--- a/internal/catalog/access_filter.go
+++ b/internal/catalog/access_filter.go
@@ -53,6 +53,14 @@ type AccessFilter struct {
 	// size. Unset means the caller expressed no preference, and the per-context
 	// defaults apply. See internal/imagesize.
 	ImageSize imagesize.Size
+	// ImageWidths are the client's per-slot target widths, which override
+	// ImageSize for their slot. Read artwork sizes through ImageSizeFor. Like
+	// ImageSize it only shapes artwork URLs, so it stays out of every key
+	// derived from the filter's encoding.
+	ImageWidths imagesize.Widths `json:"-"`
+	// OmitWatchArtwork skips presentation-only artwork in watch detail for
+	// legacy responses and internal source selection. It does not change access.
+	OmitWatchArtwork bool
 	// NamePrefix, when non-empty, restricts results to items whose
 	// LOWER(COALESCE(NULLIF(BTRIM(sort_title),''), title)) starts with the
 	// given (case-insensitive) prefix. Pushed into the SQL WHERE clause so
@@ -390,3 +398,14 @@ func mediaFileAccessConditions(alias string, filter AccessFilter, bind func(any)
 	}
 	return conditions
 }
+
+// ImageSizeFor is the size to resolve one artwork slot at: the slot's target
+// width when the client gave one, else ImageSize.
+func (f AccessFilter) ImageSizeFor(slot imagesize.Slot) imagesize.Size {
+	return f.Artwork().For(slot)
+}
+
+// Artwork is the client's artwork preference for this request.
+func (f AccessFilter) Artwork() imagesize.Request {
+	return imagesize.Request{Size: f.ImageSize, Widths: f.ImageWidths}
+}
diff --git a/internal/catalog/artwork_batch.go b/internal/catalog/artwork_batch.go
new file mode 100644
index 0000000000..303fa1173e
--- /dev/null
+++ b/internal/catalog/artwork_batch.go
@@ -0,0 +1,86 @@
+package catalog
+
+import (
+	"context"
+	"maps"
+	"slices"
+	"strings"
+)
+
+// ArtworkPresigner resolves artwork keys in one batch, asking metadata plugins
+// for the variant hint.
+type ArtworkPresigner interface {
+	PresignURLsWithExpiry(ctx context.Context, paths []string, variant string) map[string]ResolvedImageURL
+}
+
+// ArtworkBatch collects one response's artwork for batch resolution when its
+// slots can ask plugins for different sizes, such as a card poster beside a
+// hero backdrop. A cached key or an http(s) URL resolves the same whatever the
+// hint, so those share one batch; a plugin-hosted path is resolved once for
+// each hint a slot asks for it at.
+type ArtworkBatch struct {
+	keys   []string
+	plugin map[string][]string // hint -> plugin-hosted paths
+	seen   map[artworkBatchEntry]struct{}
+}
+
+type artworkBatchEntry struct{ path, hint string }
+
+// Add queues path for a slot that asks plugins for hint. Empty paths and the
+// "-" placeholder are skipped.
+func (b *ArtworkBatch) Add(path, hint string) {
+	if path == "" || path == "-" {
+		return
+	}
+	if !isPluginArtworkPath(path) {
+		hint = ""
+	}
+	entry := artworkBatchEntry{path: path, hint: hint}
+	if _, ok := b.seen[entry]; ok {
+		return
+	}
+	if b.seen == nil {
+		b.seen = make(map[artworkBatchEntry]struct{})
+		b.plugin = make(map[string][]string)
+	}
+	b.seen[entry] = struct{}{}
+	if hint == "" {
+		b.keys = append(b.keys, path)
+		return
+	}
+	b.plugin[hint] = append(b.plugin[hint], path)
+}
+
+// Resolve resolves everything added: cached keys and URLs in one batch at
+// keyHint, which only names the resolver's URL cache entry for them, and
+// plugin-hosted paths in one batch per hint.
+func (b *ArtworkBatch) Resolve(ctx context.Context, presigner ArtworkPresigner, keyHint string) ArtworkURLs {
+	urls := ArtworkURLs{plugin: make(map[string]map[string]ResolvedImageURL, len(b.plugin))}
+	if len(b.keys) > 0 {
+		urls.keys = presigner.PresignURLsWithExpiry(ctx, b.keys, keyHint)
+	}
+	for _, hint := range slices.Sorted(maps.Keys(b.plugin)) {
+		urls.plugin[hint] = presigner.PresignURLsWithExpiry(ctx, b.plugin[hint], hint)
+	}
+	return urls
+}
+
+// ArtworkURLs are an ArtworkBatch's resolved URLs.
+type ArtworkURLs struct {
+	keys   map[string]ResolvedImageURL
+	plugin map[string]map[string]ResolvedImageURL
+}
+
+// Get is the URL for path as added for a slot at hint.
+func (u ArtworkURLs) Get(path, hint string) ResolvedImageURL {
+	if isPluginArtworkPath(path) {
+		return u.plugin[hint][path]
+	}
+	return u.keys[path]
+}
+
+// isPluginArtworkPath reports whether a metadata plugin hosts path, so the
+// variant hint picks the image it returns.
+func isPluginArtworkPath(path string) bool {
+	return strings.Contains(path, "://") && !strings.HasPrefix(path, "http://") && !strings.HasPrefix(path, "https://")
+}
diff --git a/internal/catalog/artwork_batch_test.go b/internal/catalog/artwork_batch_test.go
new file mode 100644
index 0000000000..f2f50d635f
--- /dev/null
+++ b/internal/catalog/artwork_batch_test.go
@@ -0,0 +1,56 @@
+package catalog
+
+import (
+	"context"
+	"slices"
+	"testing"
+)
+
+type hintEchoPresigner struct{ calls [][]string }
+
+func (p *hintEchoPresigner) PresignURLsWithExpiry(_ context.Context, paths []string, variant string) map[string]ResolvedImageURL {
+	p.calls = append(p.calls, append([]string{variant}, paths...))
+	out := make(map[string]ResolvedImageURL, len(paths))
+	for _, path := range paths {
+		out[path] = ResolvedImageURL{URL: variant + ":" + path}
+	}
+	return out
+}
+
+// Cached keys resolve the same at any hint, so a page's keys share one batch
+// however its slots are sized; a plugin-hosted path is resolved at each hint a
+// slot asks for it at.
+func TestArtworkBatchResolvesPluginPathsPerHint(t *testing.T) {
+	var batch ArtworkBatch
+	batch.Add("tmdb/movies/1/poster/w500.r1.webp", "featured")
+	batch.Add("tmdb/movies/1/backdrop/original.r1.webp", "original")
+	batch.Add("tmdb://backdrop/a.jpg", "original")
+	batch.Add("tmdb://poster/b.jpg", "featured")
+	batch.Add("tmdb://backdrop/a.jpg", "featured")
+	batch.Add("https://image.example.invalid/c.jpg", "original")
+	batch.Add("-", "featured")
+	batch.Add("", "featured")
+
+	presigner := &hintEchoPresigner{}
+	urls := batch.Resolve(t.Context(), presigner, "featured")
+
+	want := [][]string{
+		{"featured", "tmdb/movies/1/poster/w500.r1.webp", "tmdb/movies/1/backdrop/original.r1.webp", "https://image.example.invalid/c.jpg"},
+		{"featured", "tmdb://poster/b.jpg", "tmdb://backdrop/a.jpg"},
+		{"original", "tmdb://backdrop/a.jpg"},
+	}
+	if !slices.EqualFunc(presigner.calls, want, slices.Equal[[]string]) {
+		t.Fatalf("batches = %q, want %q", presigner.calls, want)
+	}
+	for _, tc := range []struct{ path, hint, want string }{
+		{"tmdb/movies/1/backdrop/original.r1.webp", "original", "featured:tmdb/movies/1/backdrop/original.r1.webp"},
+		{"tmdb://backdrop/a.jpg", "original", "original:tmdb://backdrop/a.jpg"},
+		{"tmdb://backdrop/a.jpg", "featured", "featured:tmdb://backdrop/a.jpg"},
+		{"https://image.example.invalid/c.jpg", "original", "featured:https://image.example.invalid/c.jpg"},
+		{"-", "featured", ""},
+	} {
+		if got := urls.Get(tc.path, tc.hint).URL; got != tc.want {
+			t.Errorf("Get(%q, %q) = %q, want %q", tc.path, tc.hint, got, tc.want)
+		}
+	}
+}
diff --git a/internal/catalog/collection_type.go b/internal/catalog/collection_type.go
index 73eb0445d0..7740179d7e 100644
--- a/internal/catalog/collection_type.go
+++ b/internal/catalog/collection_type.go
@@ -8,11 +8,17 @@ func IsLiveQueryType(collectionType string) bool {
 	return strings.EqualFold(strings.TrimSpace(collectionType), "smart")
 }
 
+// The collection types a sync fills from an external list.
+const (
+	collectionTypeMDBList = "mdblist"
+	collectionTypeTMDB    = "tmdb"
+)
+
 // IsSyncableType returns true for collection types that support external sync.
 // Mirrored by isListBackedCollectionType in web/src/lib/collections/types.ts.
 func IsSyncableType(collectionType string) bool {
 	switch strings.TrimSpace(strings.ToLower(collectionType)) {
-	case "mdblist", "tmdb", "trakt":
+	case collectionTypeMDBList, collectionTypeTMDB:
 		return true
 	default:
 		return false
diff --git a/internal/catalog/detail.go b/internal/catalog/detail.go
index 78535df4ce..d9297cfd13 100644
--- a/internal/catalog/detail.go
+++ b/internal/catalog/detail.go
@@ -17,6 +17,7 @@ import (
 
 	"github.com/prairie-server/prairie-server/internal/access"
 	"github.com/prairie-server/prairie-server/internal/artworkkey"
+	"github.com/prairie-server/prairie-server/internal/ctxerr"
 	"github.com/prairie-server/prairie-server/internal/deviceclass"
 	"github.com/prairie-server/prairie-server/internal/imagesize"
 	"github.com/prairie-server/prairie-server/internal/lang"
@@ -208,8 +209,12 @@ type ItemDetail struct {
 	// language that the description is missing — the on-view AI translation
 	// affordance keys off it.
 	PendingTranslationLanguage string `json:"pending_translation_language,omitempty"`
-	Runtime                    int    `json:"runtime,omitempty"`
-	ContentRating              string `json:"content_rating,omitempty"`
+	// MachineTranslatedFields names the localized fields ("overview",
+	// "tagline") that AI translation wrote. The native v2 document carries it;
+	// the frozen v1 JSON does not.
+	MachineTranslatedFields []string `json:"-"`
+	Runtime                 int      `json:"runtime,omitempty"`
+	ContentRating           string   `json:"content_rating,omitempty"`
 	// AdvisoryAge and AdvisorySource carry the item's advisory to the
 	// v2 renderer. Kept out of this JSON contract the way OriginalLanguage is:
 	// /api/v1 is frozen, so the fields ride the Go struct and apiv2 emits them
@@ -262,6 +267,18 @@ type ItemDetail struct {
 	DiscPath           string   `json:"-"`
 	ExtraBackdropPaths []string `json:"-"`
 
+	// The stored poster, backdrop and logo paths (localized, when a
+	// localization supplies the artwork) and the item's last modification,
+	// kept out of the JSON contract like the paths above. With the thumbhashes
+	// they seed the Jellyfin-compatible image tags the way list rows do, so an
+	// image keeps one tag across list and detail responses, and the tag still
+	// changes with the artwork and the viewer's language. Set for movies and
+	// series.
+	PosterPath   string    `json:"-"`
+	BackdropPath string    `json:"-"`
+	LogoPath     string    `json:"-"`
+	UpdatedAt    time.Time `json:"-"`
+
 	// Literary work linkage. Present for linked ebook/audiobook items.
 	WorkID      string              `json:"work_id,omitempty"`
 	WorkTitle   string              `json:"work_title,omitempty"`
@@ -457,6 +474,8 @@ type ItemUserState struct {
 	Played      bool `json:"played"`
 	IsFavorite  bool `json:"is_favorite"`
 	InWatchlist bool `json:"in_watchlist"`
+	// NotInterested is served by v2 only; the frozen v1 shape leaves it out.
+	NotInterested bool `json:"-"`
 }
 
 // CastCredit is the item-detail API shape for a cast member.
@@ -701,6 +720,11 @@ type WatchDetail struct {
 	EffectiveVersionHDR             *bool                             `json:"effective_version_hdr,omitempty"`
 	EffectiveVersionCodecVideo      *string                           `json:"effective_version_codec_video,omitempty"`
 	EffectiveVersionEditionKey      *string                           `json:"effective_version_edition_key,omitempty"`
+	// Artwork is mapped explicitly by v2; the frozen v1 JSON omits it.
+	PosterURL         string `json:"-"`
+	PosterThumbhash   string `json:"-"`
+	BackdropURL       string `json:"-"`
+	BackdropThumbhash string `json:"-"`
 }
 
 func (d ItemDetail) MarshalJSON() ([]byte, error) {
@@ -907,7 +931,7 @@ func (s *DetailService) markTrickplay(ctx context.Context, versions []FileVersio
 	}
 	grids, err := availability.TrickplayGrids(ctx, ids)
 	if err != nil {
-		slog.WarnContext(ctx, "trickplay lookup failed", "component", "catalog", "error", err)
+		slog.Log(ctx, ctxerr.LogLevel(ctx, err, slog.LevelWarn), "trickplay lookup failed", "component", "catalog", "error", err)
 		return
 	}
 	for i := range versions {
@@ -939,7 +963,7 @@ func (s *DetailService) prefetchTrickplay(ctx context.Context, filesByID map[str
 	}
 	grids, err := s.trickplay.TrickplayGrids(ctx, fileIDs)
 	if err != nil {
-		slog.WarnContext(ctx, "trickplay lookup failed", "component", "catalog", "error", err)
+		slog.Log(ctx, ctxerr.LogLevel(ctx, err, slog.LevelWarn), "trickplay lookup failed", "component", "catalog", "error", err)
 		grids = nil
 	}
 	return prefetchedTrickplay(grids)
@@ -1080,6 +1104,16 @@ func (s *DetailService) seriesOriginalLanguage(ctx context.Context, seriesID str
 	return series.OriginalLanguage
 }
 
+// seriesOriginalLanguageChecked is seriesOriginalLanguage with its read
+// error, for the checked pending paths; a missing series has none.
+func (s *DetailService) seriesOriginalLanguageChecked(ctx context.Context, seriesID string, filter AccessFilter) (string, error) {
+	originalBySeries, err := s.seriesOriginalLanguages(ctx, []string{seriesID}, filter)
+	if err != nil {
+		return "", err
+	}
+	return originalBySeries[strings.TrimSpace(seriesID)], nil
+}
+
 // seriesOriginalLanguages is the batch equivalent of seriesOriginalLanguage.
 // A season or episode page usually contains many children of one series; load
 // each distinct parent once so original-language preferences do not introduce
@@ -1131,20 +1165,28 @@ func (s *DetailService) seriesOriginalLanguages(
 // the item's base metadata language, the base overview has text, and no
 // localized overview exists yet. Clients use it to offer (or auto-run)
 // on-view AI translation; it is pure data, independent of whether the AI
-// feature is enabled.
+// feature is enabled. A failed read reports nothing missing.
 func (s *DetailService) PendingTranslationLanguage(ctx context.Context, item *models.MediaItem, filter AccessFilter) string {
+	language, _ := s.PendingTranslationLanguageChecked(ctx, item, filter)
+	return language
+}
+
+// PendingTranslationLanguageChecked is PendingTranslationLanguage with its
+// read errors, for callers that must not mistake a failed read for nothing
+// missing. A presentation library that no longer exists is nothing missing.
+func (s *DetailService) PendingTranslationLanguageChecked(ctx context.Context, item *models.MediaItem, filter AccessFilter) (string, error) {
 	if item == nil || strings.TrimSpace(item.Overview) == "" || s.itemLocRepo == nil {
-		return ""
+		return "", nil
 	}
-	language, err := s.resolvePresentationLanguage(ctx, filter, item.OriginalLanguage)
+	language, err := s.pendingPresentationLanguage(ctx, filter, item.OriginalLanguage)
 	if err != nil || language == "" || sameMetadataLanguage(item.DefaultMetadataLanguage, language) {
-		return ""
+		return "", err
 	}
 	loc, err := s.itemLocRepo.Get(ctx, item.ContentID, language)
 	if err != nil {
-		return ""
+		return "", err
 	}
-	return pendingTranslationLanguageWith(item, language, loc)
+	return pendingTranslationLanguageWith(item, language, loc), nil
 }
 
 // pendingTranslationLanguageWith is the shared core of PendingTranslationLanguage:
@@ -1163,37 +1205,131 @@ func pendingTranslationLanguageWith(item *models.MediaItem, language string, loc
 }
 
 // PendingSeasonTranslationLanguage is the season-row equivalent of
-// PendingTranslationLanguage.
+// PendingTranslationLanguage. A season page also lists its episodes, so the
+// language is pending while the season overview or any of its episodes'
+// overviews lacks a localization.
 func (s *DetailService) PendingSeasonTranslationLanguage(ctx context.Context, season *models.Season, filter AccessFilter) string {
-	if season == nil || strings.TrimSpace(season.Overview) == "" || s.seasonLocRepo == nil {
-		return ""
+	language, _ := s.PendingSeasonTranslationLanguageChecked(ctx, season, filter)
+	return language
+}
+
+// PendingSeasonTranslationLanguageChecked is PendingSeasonTranslationLanguage
+// with its read errors.
+func (s *DetailService) PendingSeasonTranslationLanguageChecked(ctx context.Context, season *models.Season, filter AccessFilter) (string, error) {
+	return s.pendingSeasonTranslationLanguageChecked(ctx, season, filter, nil)
+}
+
+// pendingSeasonTranslationLanguage takes the season's episodes when the
+// caller already listed them; nil lists them here. A failed read reports
+// nothing missing.
+func (s *DetailService) pendingSeasonTranslationLanguage(ctx context.Context, season *models.Season, filter AccessFilter, episodes []*models.Episode) string {
+	language, _ := s.pendingSeasonTranslationLanguageChecked(ctx, season, filter, episodes)
+	return language
+}
+
+// pendingSeasonTranslationLanguageChecked is pendingSeasonTranslationLanguage
+// with its read errors.
+func (s *DetailService) pendingSeasonTranslationLanguageChecked(ctx context.Context, season *models.Season, filter AccessFilter, episodes []*models.Episode) (string, error) {
+	if season == nil || s.seasonLocRepo == nil {
+		return "", nil
 	}
-	language, err := s.resolvePresentationLanguage(ctx, filter, s.seriesOriginalLanguage(ctx, season.SeriesID, filter))
-	if err != nil || language == "" || sameMetadataLanguage(season.DefaultMetadataLanguage, language) {
-		return ""
+	original, err := s.seriesOriginalLanguageChecked(ctx, season.SeriesID, filter)
+	if err != nil {
+		return "", err
 	}
-	loc, err := s.seasonLocRepo.Get(ctx, season.ContentID, language)
-	if err != nil || (loc != nil && loc.Overview != "") {
-		return ""
+	language, err := s.pendingPresentationLanguage(ctx, filter, original)
+	if err != nil || language == "" {
+		return "", err
 	}
-	return language
+	if strings.TrimSpace(season.Overview) != "" && !sameMetadataLanguage(season.DefaultMetadataLanguage, language) {
+		loc, err := s.seasonLocRepo.Get(ctx, season.ContentID, language)
+		if err != nil {
+			return "", err
+		}
+		if loc == nil || loc.Overview == "" {
+			return language, nil
+		}
+	}
+	if episodes == nil {
+		if s.episodeRepo == nil {
+			return "", nil
+		}
+		episodes, err = s.episodeRepo.ListBySeasonID(ctx, season.ContentID)
+		if err != nil {
+			return "", err
+		}
+	}
+	missing, err := s.episodesMissingLanguage(ctx, episodes, language)
+	if err != nil || !missing {
+		return "", err
+	}
+	return language, nil
+}
+
+// episodesMissingLanguage reports whether any episode has a description in
+// another language and no localized description for language.
+func (s *DetailService) episodesMissingLanguage(ctx context.Context, episodes []*models.Episode, language string) (bool, error) {
+	if s.episodeLocRepo == nil {
+		return false, nil
+	}
+	ids := make([]string, 0, len(episodes))
+	for _, episode := range episodes {
+		if episode != nil && strings.TrimSpace(episode.Overview) != "" && !sameMetadataLanguage(episode.DefaultMetadataLanguage, language) {
+			ids = append(ids, episode.ContentID)
+		}
+	}
+	if len(ids) == 0 {
+		return false, nil
+	}
+	locs, err := s.episodeLocRepo.GetByEpisodeIDs(ctx, ids, language)
+	if err != nil {
+		return false, err
+	}
+	for _, id := range ids {
+		if loc := locs[id]; loc == nil || loc.Overview == "" {
+			return true, nil
+		}
+	}
+	return false, nil
 }
 
 // PendingEpisodeTranslationLanguage is the episode-row equivalent of
 // PendingTranslationLanguage.
 func (s *DetailService) PendingEpisodeTranslationLanguage(ctx context.Context, episode *models.Episode, filter AccessFilter) string {
+	language, _ := s.PendingEpisodeTranslationLanguageChecked(ctx, episode, filter)
+	return language
+}
+
+// PendingEpisodeTranslationLanguageChecked is
+// PendingEpisodeTranslationLanguage with its read errors.
+func (s *DetailService) PendingEpisodeTranslationLanguageChecked(ctx context.Context, episode *models.Episode, filter AccessFilter) (string, error) {
 	if episode == nil || strings.TrimSpace(episode.Overview) == "" || s.episodeLocRepo == nil {
-		return ""
+		return "", nil
+	}
+	original, err := s.seriesOriginalLanguageChecked(ctx, episode.SeriesID, filter)
+	if err != nil {
+		return "", err
 	}
-	language, err := s.resolvePresentationLanguage(ctx, filter, s.seriesOriginalLanguage(ctx, episode.SeriesID, filter))
+	language, err := s.pendingPresentationLanguage(ctx, filter, original)
 	if err != nil || language == "" || sameMetadataLanguage(episode.DefaultMetadataLanguage, language) {
-		return ""
+		return "", err
 	}
 	loc, err := s.episodeLocRepo.Get(ctx, episode.ContentID, language)
 	if err != nil || (loc != nil && loc.Overview != "") {
-		return ""
+		return "", err
 	}
-	return language
+	return language, nil
+}
+
+// pendingPresentationLanguage resolves the presentation language for the
+// pending checks, where a presentation library that no longer exists means
+// nothing is missing rather than a failed read.
+func (s *DetailService) pendingPresentationLanguage(ctx context.Context, filter AccessFilter, originalLanguage string) (string, error) {
+	language, err := s.resolvePresentationLanguage(ctx, filter, originalLanguage)
+	if errors.Is(err, ErrItemNotFound) {
+		return "", nil
+	}
+	return language, err
 }
 
 func (s *DetailService) validatePresentationItemAccess(ctx context.Context, filter AccessFilter, contentID string) error {
@@ -1457,8 +1593,10 @@ func (s *DetailService) LocalizeEpisodeModel(ctx context.Context, episode *model
 }
 
 // LocalizeEpisodeModels applies presentation-language localization to a batch
-// of episodes with a single lookup. Episodes without a localization row are
-// returned unchanged; the result preserves input order and length.
+// of episodes with a single lookup. An episode whose description is missing
+// in the presentation language comes back as a copy carrying
+// PendingTranslationLanguage; other episodes without a localization row are
+// returned unchanged. The result preserves input order and length.
 func (s *DetailService) LocalizeEpisodeModels(ctx context.Context, episodes []*models.Episode, filter AccessFilter) ([]*models.Episode, error) {
 	if len(episodes) == 0 {
 		return episodes, nil
@@ -1514,11 +1652,19 @@ func (s *DetailService) LocalizeEpisodeModels(ctx context.Context, episodes []*m
 		if ep == nil {
 			continue
 		}
-		if loc := locs[ep.ContentID]; loc != nil {
-			target := targets[ep.ContentID]
-			if target != "" && !sameMetadataLanguage(ep.DefaultMetadataLanguage, target) {
-				localized[i] = applyEpisodeLocalization(ep, loc)
+		target := targets[ep.ContentID]
+		if target == "" || sameMetadataLanguage(ep.DefaultMetadataLanguage, target) {
+			continue
+		}
+		loc := locs[ep.ContentID]
+		if loc != nil {
+			localized[i] = applyEpisodeLocalization(ep, loc)
+		}
+		if strings.TrimSpace(ep.Overview) != "" && (loc == nil || loc.Overview == "") {
+			if localized[i] == ep {
+				localized[i] = cloneEpisode(ep)
 			}
+			localized[i].PendingTranslationLanguage = target
 		}
 	}
 	return localized, nil
@@ -1536,7 +1682,7 @@ func (s *DetailService) GetItemDetail(ctx context.Context, contentID string, fil
 		if err != nil {
 			return nil, err
 		}
-		s.attachExtraBackdrops(ctx, []*ItemDetail{detail}, string(filter.ImageSize), true)
+		s.attachExtraBackdrops(ctx, []*ItemDetail{detail}, filter.Artwork(), true)
 		return detail, nil
 	case target.season != nil:
 		return s.buildSeasonDetail(ctx, target.season, filter)
@@ -1754,7 +1900,7 @@ func (s *DetailService) buildSeriesDetailContext(ctx context.Context, seriesID s
 		castCredits:      castCredits,
 		crewCredits:      crewCredits,
 		versionPref:      s.effectiveVersionDefaults(ctx, filter, seriesID),
-		backdropURL:      s.PresignImageURL(ctx, series.BackdropPath, "backdrop", string(filter.ImageSize)),
+		backdropURL:      s.PresignImageURL(ctx, series.BackdropPath, "backdrop", string(filter.ImageSizeFor(imagesize.SlotBackdrop))),
 		audio:            s.newAudioPrefResolver(ctx, filter, seriesID),
 		subtitleDefaults: map[int]subtitleDefaults{},
 		trickplay:        s.trickplay,
@@ -2050,7 +2196,7 @@ func (s *DetailService) GetItemDetailsByIDs(ctx context.Context, contentIDs []st
 		}
 		result[id] = detail
 	}
-	s.attachExtraBackdrops(ctx, slices.Collect(maps.Values(result)), string(filter.ImageSize), false)
+	s.attachExtraBackdrops(ctx, slices.Collect(maps.Values(result)), filter.Artwork(), false)
 	return result, nil
 }
 
@@ -2063,7 +2209,7 @@ func (s *DetailService) fetchItemVideos(ctx context.Context, contentID string, p
 	} else if s.videoRepo != nil {
 		fetched, err := s.videoRepo.GetByContentID(ctx, contentID)
 		if err != nil {
-			slog.WarnContext(ctx, "failed to fetch item videos", "content_id", contentID, "error", err)
+			slog.Log(ctx, ctxerr.LogLevel(ctx, err, slog.LevelWarn), "failed to fetch item videos", "content_id", contentID, "error", err)
 			return nil
 		}
 		videos = fetched
@@ -2095,7 +2241,7 @@ func (s *DetailService) fetchItemRatingSources(ctx context.Context, contentID st
 	} else if s.ratingSourceRepo != nil {
 		fetched, err := s.ratingSourceRepo.GetByContentID(ctx, contentID)
 		if err != nil {
-			slog.WarnContext(ctx, "failed to fetch item rating sources", "content_id", contentID, "error", err)
+			slog.Log(ctx, ctxerr.LogLevel(ctx, err, slog.LevelWarn), "failed to fetch item rating sources", "content_id", contentID, "error", err)
 			return nil
 		}
 		sources = fetched
@@ -2123,7 +2269,7 @@ func (s *DetailService) fetchItemExtras(ctx context.Context, contentID string, p
 	} else if s.extraRepo != nil {
 		fetched, err := s.extraRepo.ListWithFilesByParentID(ctx, contentID)
 		if err != nil {
-			slog.WarnContext(ctx, "failed to fetch item extras", "content_id", contentID, "error", err)
+			slog.Log(ctx, ctxerr.LogLevel(ctx, err, slog.LevelWarn), "failed to fetch item extras", "content_id", contentID, "error", err)
 			return nil
 		}
 		extras = fetched
@@ -2228,6 +2374,7 @@ func (s *DetailService) buildMediaItemDetail(ctx context.Context, item *models.M
 		Overview:                   item.Overview,
 		Tagline:                    item.Tagline,
 		PendingTranslationLanguage: pendingTranslation,
+		MachineTranslatedFields:    item.MachineTranslatedFields,
 		Runtime:                    item.Runtime,
 		ContentRating:              item.ContentRating,
 		AdvisoryAge:                item.AdvisoryAge,
@@ -2262,9 +2409,13 @@ func (s *DetailService) buildMediaItemDetail(ctx context.Context, item *models.M
 
 	// Resolve image URLs: full URLs (TVDB/TMDB) pass through; S3 cached base paths get
 	// variant-resolved and presigned.
-	detail.PosterURL = s.PresignImageURL(ctx, item.PosterPath, "poster", string(filter.ImageSize))
-	detail.BackdropURL = s.PresignImageURL(ctx, item.BackdropPath, "backdrop", string(filter.ImageSize))
-	detail.LogoURL = s.PresignImageURL(ctx, item.LogoPath, "logo", string(filter.ImageSize))
+	detail.PosterURL = s.PresignImageURL(ctx, item.PosterPath, "poster", string(filter.ImageSizeFor(imagesize.SlotPoster)))
+	detail.BackdropURL = s.PresignImageURL(ctx, item.BackdropPath, "backdrop", string(filter.ImageSizeFor(imagesize.SlotBackdrop)))
+	detail.LogoURL = s.PresignImageURL(ctx, item.LogoPath, "logo", string(filter.ImageSizeFor(imagesize.SlotLogo)))
+	detail.PosterPath = item.PosterPath
+	detail.BackdropPath = item.BackdropPath
+	detail.LogoPath = item.LogoPath
+	detail.UpdatedAt = item.UpdatedAt
 	copyExtraArtwork(detail, item)
 
 	// File versions and subtitle aggregation only apply to movies.
@@ -2402,20 +2553,18 @@ func (s *DetailService) personCredits(ctx context.Context, people []models.ItemP
 	photoPaths := make([]string, len(people))
 	paths := make([]string, 0, len(people))
 	seen := make(map[string]struct{}, len(people))
-	variant := imagesize.PluginVariantFeatured
-	if filter.ImageSize != imagesize.Unset {
-		variant = sizeToVariant(string(filter.ImageSize))
-	}
+	size := filter.ImageSizeFor(imagesize.SlotPhoto)
+	variant := imagesize.PhotoPluginVariant(size)
 	for i, person := range people {
 		path := person.PhotoPath
 		if path == "" || path == "-" || strings.HasPrefix(path, "http://") || strings.HasPrefix(path, "https://") {
 			continue
 		}
-		// An absent size preserves the stored key and historical plugin hint;
-		// explicit sizes use the same profile ladder as individual resolution.
-		if filter.ImageSize != imagesize.Unset {
-			path = cachedImageVariantPath(ctx, path, artworkkey.ImageProfile, string(filter.ImageSize))
-		}
+		// Cached headshots resolve on the profile ladder; an absent size is its
+		// medium rung, the w500 the people endpoints serve, because the stored
+		// original can be up to 3840px tall and no cast card draws that.
+		// Plugin-hosted photos keep the historical large hint above.
+		path = cachedImageVariantPath(ctx, path, artworkkey.ImageProfile, string(size))
 		photoPaths[i] = path
 		if _, ok := seen[path]; !ok {
 			seen[path] = struct{}{}
@@ -2661,7 +2810,7 @@ func (s *DetailService) fetchMangaChapters(ctx context.Context, seriesContentID
 	}
 	// Presign every chapter poster in one batch rather than per chapter — a
 	// long-running series has hundreds of chapters.
-	resolved := s.PresignImageURLs(ctx, posterPaths, "poster", string(filter.ImageSize))
+	resolved := s.PresignImageURLs(ctx, posterPaths, "poster", string(filter.ImageSizeFor(imagesize.SlotPoster)))
 	for i := range chapters {
 		chapters[i].PosterURL = resolved[chapters[i].PosterURL]
 	}
@@ -2694,7 +2843,7 @@ func firstNonEmptyString(values []string) string {
 }
 
 func (s *DetailService) presignAudiobookPosterURL(ctx context.Context, posterPath string, filter AccessFilter) string {
-	return s.PresignImageURL(ctx, posterPath, "poster", string(filter.ImageSize))
+	return s.PresignImageURL(ctx, posterPath, "poster", string(filter.ImageSizeFor(imagesize.SlotPoster)))
 }
 
 func appendAudiobookItemAccessConditions(
@@ -2793,6 +2942,9 @@ func (s *DetailService) fetchBookAlsoByAuthor(ctx context.Context, contentID str
 		item.PosterURL = s.presignAudiobookPosterURL(ctx, posterPath, filter)
 		out = append(out, item)
 	}
+	if rows.Err() != nil {
+		return []AudiobookRelatedItem{}
+	}
 	return out
 }
 
@@ -2860,6 +3012,9 @@ func (s *DetailService) fetchBookSimilarByGenres(ctx context.Context, contentID
 		item.PosterURL = s.presignAudiobookPosterURL(ctx, posterPath, filter)
 		out = append(out, item)
 	}
+	if rows.Err() != nil {
+		return []AudiobookRelatedItem{}
+	}
 	return out
 }
 
@@ -2934,6 +3089,9 @@ func (s *DetailService) fetchBookSeries(ctx context.Context, contentID string, m
 		item.PosterURL = s.presignAudiobookPosterURL(ctx, poster, filter)
 		entries = append(entries, item)
 	}
+	if rows.Err() != nil {
+		return nil
+	}
 	if len(entries) < 2 {
 		return nil
 	}
@@ -2998,6 +3156,9 @@ func (s *DetailService) fetchAudiobookOtherNarrations(ctx context.Context, conte
 		item.Narrators = splitDelimitedNames(narrators)
 		out = append(out, item)
 	}
+	if rows.Err() != nil {
+		return []AudiobookNarration{}
+	}
 	return out
 }
 
@@ -3053,7 +3214,15 @@ func (s *DetailService) buildSeasonDetail(ctx context.Context, season *models.Se
 	}
 	localizationFilter := filter
 	localizationFilter.PresentationOriginalLanguage = series.OriginalLanguage
-	pendingTranslation := s.PendingSeasonTranslationLanguage(ctx, season, localizationFilter)
+
+	episodes := []*models.Episode{}
+	if s.episodeRepo != nil {
+		episodes, err = s.episodeRepo.ListBySeasonID(ctx, season.ContentID)
+		if err != nil {
+			return nil, fmt.Errorf("listing season episodes: %w", err)
+		}
+	}
+	pendingTranslation := s.pendingSeasonTranslationLanguage(ctx, season, localizationFilter, episodes)
 	localizedSeason, err := s.LocalizeSeasonModel(ctx, season, localizationFilter)
 	if err != nil {
 		return nil, fmt.Errorf("localizing season detail: %w", err)
@@ -3064,14 +3233,6 @@ func (s *DetailService) buildSeasonDetail(ctx context.Context, season *models.Se
 		return nil, fmt.Errorf("localizing season series detail: %w", err)
 	}
 
-	episodes := []*models.Episode{}
-	if s.episodeRepo != nil {
-		episodes, err = s.episodeRepo.ListBySeasonID(ctx, season.ContentID)
-		if err != nil {
-			return nil, fmt.Errorf("listing season episodes: %w", err)
-		}
-	}
-
 	title := season.Title
 	if title == "" {
 		if season.SeasonNumber == 0 {
@@ -3090,6 +3251,7 @@ func (s *DetailService) buildSeasonDetail(ctx context.Context, season *models.Se
 		Title:                      title,
 		Overview:                   season.Overview,
 		PendingTranslationLanguage: pendingTranslation,
+		MachineTranslatedFields:    season.MachineTranslatedFields,
 		PosterThumbhash:            season.PosterThumbhash,
 		BackdropThumbhash:          series.BackdropThumbhash,
 		SeriesID:                   season.SeriesID,
@@ -3108,8 +3270,8 @@ func (s *DetailService) buildSeasonDetail(ctx context.Context, season *models.Se
 		detail.AirDate = &airDate
 	}
 
-	detail.PosterURL = s.PresignImageURL(ctx, season.PosterPath, "poster", string(filter.ImageSize))
-	detail.BackdropURL = s.PresignImageURL(ctx, series.BackdropPath, "backdrop", string(filter.ImageSize))
+	detail.PosterURL = s.PresignImageURL(ctx, season.PosterPath, "poster", string(filter.ImageSizeFor(imagesize.SlotPoster)))
+	detail.BackdropURL = s.PresignImageURL(ctx, series.BackdropPath, "backdrop", string(filter.ImageSizeFor(imagesize.SlotBackdrop)))
 	return detail, nil
 }
 
@@ -3132,6 +3294,7 @@ func (s *DetailService) buildEpisodeDetail(ctx context.Context, episode *models.
 		Title:                      episode.Title,
 		Overview:                   episode.Overview,
 		PendingTranslationLanguage: pendingTranslation,
+		MachineTranslatedFields:    episode.MachineTranslatedFields,
 		Runtime:                    episode.Runtime,
 		RatingIMDB:                 episode.RatingIMDB,
 		RatingTMDB:                 episode.RatingTMDB,
@@ -3158,7 +3321,7 @@ func (s *DetailService) buildEpisodeDetail(ctx context.Context, episode *models.
 		detail.Title = fmt.Sprintf("Episode %d", episode.EpisodeNumber)
 	}
 
-	detail.PosterURL = s.PresignImageURL(ctx, episode.StillPath, "still", string(filter.ImageSize))
+	detail.PosterURL = s.PresignImageURL(ctx, episode.StillPath, "still", string(filter.ImageSizeFor(imagesize.SlotPoster)))
 	detail.BackdropURL = seriesCtx.backdropURL
 
 	files := seriesCtx.filesByEpisode[episode.ContentID]
@@ -3236,6 +3399,12 @@ func (s *DetailService) GetWatchDetail(ctx context.Context, contentID string, fi
 			item.ContentID,
 		)
 		detail.Year = item.Year
+		if !filter.OmitWatchArtwork {
+			detail.PosterThumbhash = item.PosterThumbhash
+			detail.BackdropThumbhash = item.BackdropThumbhash
+			detail.PosterURL = s.PresignImageURL(ctx, item.PosterPath, "poster", string(filter.ImageSizeFor(imagesize.SlotPoster)))
+			detail.BackdropURL = s.PresignImageURL(ctx, item.BackdropPath, "backdrop", string(filter.ImageSizeFor(imagesize.SlotBackdrop)))
+		}
 		s.effectiveSubtitleDefaults(ctx, filter, item.ContentID, files).applyToWatchDetail(detail)
 		return detail, nil
 	case !errors.Is(err, ErrItemNotFound):
@@ -3306,6 +3475,11 @@ func (s *DetailService) GetWatchDetail(ctx context.Context, contentID string, fi
 		}
 	}
 
+	if !filter.OmitWatchArtwork {
+		detail.PosterThumbhash = episode.StillThumbhash
+		detail.PosterURL = s.PresignImageURL(ctx, episode.StillPath, "still", string(filter.ImageSizeFor(imagesize.SlotPoster)))
+	}
+
 	if seriesErr == nil && series != nil {
 		series, err = s.LocalizeItemModel(ctx, series, localizationFilter)
 		if err != nil {
@@ -3313,6 +3487,10 @@ func (s *DetailService) GetWatchDetail(ctx context.Context, contentID string, fi
 		}
 		detail.SeriesTitle = series.Title
 		detail.Year = series.Year
+		if !filter.OmitWatchArtwork {
+			detail.BackdropThumbhash = series.BackdropThumbhash
+			detail.BackdropURL = s.PresignImageURL(ctx, series.BackdropPath, "backdrop", string(filter.ImageSizeFor(imagesize.SlotBackdrop)))
+		}
 	}
 
 	return detail, nil
@@ -3374,6 +3552,12 @@ func (s *DetailService) buildExtraWatchDetail(ctx context.Context, contentID str
 			detail.SeriesTitle = parent.Title
 		}
 		detail.Year = parent.Year
+		if !filter.OmitWatchArtwork {
+			detail.PosterThumbhash = parent.PosterThumbhash
+			detail.BackdropThumbhash = parent.BackdropThumbhash
+			detail.PosterURL = s.PresignImageURL(ctx, parent.PosterPath, "poster", string(filter.ImageSizeFor(imagesize.SlotPoster)))
+			detail.BackdropURL = s.PresignImageURL(ctx, parent.BackdropPath, "backdrop", string(filter.ImageSizeFor(imagesize.SlotBackdrop)))
+		}
 	}
 	return detail, nil
 }
@@ -4474,7 +4658,7 @@ func (s *DetailService) PresignURLsWithExpiry(ctx context.Context, paths []strin
 		}
 		resolverPaths = append(resolverPaths, path)
 	}
-	if s.imageResolver != nil {
+	if s.imageResolver != nil && len(resolverPaths) > 0 {
 		if resolver, ok := s.imageResolver.(expiringImageResolver); ok {
 			for path, value := range resolver.ResolveImageURLsWithExpiry(ctx, resolverPaths, variant) {
 				resolved[path] = value
@@ -4503,6 +4687,9 @@ func (s *DetailService) PresignURLsWithExpiry(ctx context.Context, paths []strin
 // the client-facing size contract. Anything else — an absent or unparseable
 // hint — keeps the historical mapping below unchanged.
 func sizeToVariant(size string) string {
+	if _, ok := imagesize.Size(size).TargetWidth(); ok {
+		return imagesize.PluginVariant(imagesize.Size(size))
+	}
 	if parsed, err := imagesize.Parse(size); err == nil && parsed != imagesize.Unset {
 		return imagesize.PluginVariant(parsed)
 	}
@@ -4551,7 +4738,7 @@ func cachedImageVariantPath(ctx context.Context, path, imageType, size string) s
 	if strings.Contains(path, "://") {
 		return path
 	}
-	variant := cachedImageVariantKeyFor(ctx, imageType, size)
+	variant := cachedImageVariantKeyFor(ctx, artworkkey.ImageTypeOf(path, imageType), size)
 	if variant == "" {
 		return path
 	}
@@ -4563,6 +4750,9 @@ func cachedImageVariantPath(ctx context.Context, path, imageType, size string) s
 // an explicit size always wins because it encodes display context the device
 // class cannot infer (rail thumbnails, downloads, etc.).
 func cachedImageVariantKeyFor(ctx context.Context, imageType, size string) string {
+	if _, ok := imagesize.Size(size).TargetWidth(); ok {
+		return cachedImageVariantKey(imageType, size)
+	}
 	if parsed, err := imagesize.Parse(size); err == nil && parsed != imagesize.Unset {
 		return cachedImageVariantKey(imageType, size)
 	}
@@ -4607,19 +4797,19 @@ func ImageTypeFromCachedPath(path string) string {
 }
 
 // BackdropVariantPath rewrites a cached "/original." image path to the
-// requested backdrop variant (e.g. "w1280" or "w1920"). Episode "backdrops"
-// are frequently the episode still, which the cache only generates at
-// w500/w300 — so requesting a backdrop width 404s. For still/poster/logo
-// paths this clamps to that type's largest cached variant instead. Full URLs,
-// plugin-prefixed paths, and non-"/original." paths pass through unchanged.
+// requested backdrop variant (e.g. "w1280" or "w1920"). A backdrop slot does not
+// always hold a backdrop: an episode's is frequently its still, whose ladder has
+// no backdrop widths, so requesting one would 404. Any other type gets the
+// widest rung of its own ladder that is no wider than the request (an episode
+// still in a w1920 slot gets w1280). Full URLs, plugin-prefixed paths, and
+// non-"/original." paths pass through unchanged.
 func BackdropVariantPath(path, desiredVariant string) string {
 	if path == "" || strings.Contains(path, "://") || !strings.Contains(path, "/original.") {
 		return path
 	}
 	variant := desiredVariant
-	switch imageType := imageTypeFromCachedPath(path); imageType {
-	case "still", "poster", "logo":
-		variant = cachedImageVariantKey(imageType, "")
+	if imageType := artworkkey.ImageTypeOf(path, artworkkey.ImageBackdrop); imageType != artworkkey.ImageBackdrop {
+		variant = widestRungWithin(imageType, desiredVariant)
 	}
 	if variant == "" {
 		return path
@@ -4627,6 +4817,24 @@ func BackdropVariantPath(path, desiredVariant string) string {
 	return strings.Replace(path, "/original.", "/"+variant+".", 1)
 }
 
+// widestRungWithin returns the widest rung of imageType's ladder that is no
+// wider than the width rung desired names, or the narrowest rung when every
+// rung is wider. A desired variant that names no width gets the type's
+// default.
+func widestRungWithin(imageType, desired string) string {
+	limit, ok := imagesize.VariantWidthPx(desired)
+	widths := artworkkey.VariantWidths(imageType)
+	if !ok || len(widths) == 0 {
+		return cachedImageVariantKey(imageType, "")
+	}
+	for _, width := range widths {
+		if width <= limit {
+			return "w" + strconv.Itoa(width)
+		}
+	}
+	return "w" + strconv.Itoa(widths[len(widths)-1])
+}
+
 // cachedImageVariantKey picks the cached artwork variant for an image type and
 // the size hint carried on the request.
 //
@@ -4637,6 +4845,9 @@ func BackdropVariantPath(path, desiredVariant string) string {
 // defaults below, which are retained verbatim as the record of what the server
 // returned before image_size existed.
 func cachedImageVariantKey(imageType, size string) string {
+	if _, ok := imagesize.Size(size).TargetWidth(); ok {
+		return imagesize.Variant(imageType, imagesize.Size(size))
+	}
 	if parsed, err := imagesize.Parse(size); err == nil && parsed != imagesize.Unset {
 		return imagesize.Variant(imageType, parsed)
 	}
diff --git a/internal/catalog/detail_audiobook_test.go b/internal/catalog/detail_audiobook_test.go
index 4e2f440ae6..6844e64cfa 100644
--- a/internal/catalog/detail_audiobook_test.go
+++ b/internal/catalog/detail_audiobook_test.go
@@ -88,7 +88,7 @@ func TestBuildEbookExtensionUsesAuthorsAndPublisherWithoutNarrators(t *testing.T
 		Studios:   []string{"Tor"},
 	}
 
-	extension := (&DetailService{}).buildEbookExtension(context.TODO(), item, crew, AccessFilter{})
+	extension := (&DetailService{}).buildEbookExtension(t.Context(), item, crew, AccessFilter{})
 
 	if extension == nil {
 		t.Fatal("buildEbookExtension returned nil")
diff --git a/internal/catalog/detail_extra_artwork.go b/internal/catalog/detail_extra_artwork.go
index 8c7b3aa5ea..ac32487ccb 100644
--- a/internal/catalog/detail_extra_artwork.go
+++ b/internal/catalog/detail_extra_artwork.go
@@ -5,6 +5,7 @@ import (
 	"log/slog"
 
 	"github.com/prairie-server/prairie-server/internal/artworkkey"
+	"github.com/prairie-server/prairie-server/internal/imagesize"
 	"github.com/prairie-server/prairie-server/internal/models"
 )
 
@@ -50,8 +51,9 @@ func (s *DetailService) presignExtraArtwork(ctx context.Context, detail *ItemDet
 // (presignExtraArtwork) and lists every backdrop URL in display order, the
 // primary (BackdropURL) first; batch reads skip that, since only single-item
 // detail returns the URLs. A backdrop still waiting for the image cache has no
-// path yet and is left out.
-func (s *DetailService) attachExtraBackdrops(ctx context.Context, details []*ItemDetail, size string, presign bool) {
+// path yet and is left out. Backdrops resolve at the backdrop slot's size and
+// the other artwork at the response-wide size.
+func (s *DetailService) attachExtraBackdrops(ctx context.Context, details []*ItemDetail, art imagesize.Request, presign bool) {
 	ids := make([]string, 0, len(details))
 	for _, detail := range details {
 		if hasItemBackdrops(detail) {
@@ -73,13 +75,13 @@ func (s *DetailService) attachExtraBackdrops(ctx context.Context, details []*Ite
 		if !presign {
 			continue
 		}
-		s.presignExtraArtwork(ctx, detail, size)
+		s.presignExtraArtwork(ctx, detail, string(art.Size))
 		var urls []string
 		if detail.BackdropURL != "" {
 			urls = append(urls, detail.BackdropURL)
 		}
 		for _, path := range detail.ExtraBackdropPaths {
-			if url := s.PresignImageURL(ctx, path, artworkkey.ImageBackdrop, size); url != "" {
+			if url := s.PresignImageURL(ctx, path, artworkkey.ImageBackdrop, string(art.For(imagesize.SlotBackdrop))); url != "" {
 				urls = append(urls, url)
 			}
 		}
diff --git a/internal/catalog/detail_extra_artwork_test.go b/internal/catalog/detail_extra_artwork_test.go
index 7cbd009025..d8761b96fa 100644
--- a/internal/catalog/detail_extra_artwork_test.go
+++ b/internal/catalog/detail_extra_artwork_test.go
@@ -5,6 +5,7 @@ import (
 	"slices"
 	"testing"
 
+	"github.com/prairie-server/prairie-server/internal/imagesize"
 	"github.com/prairie-server/prairie-server/internal/models"
 )
 
@@ -79,7 +80,7 @@ func TestAttachExtraBackdropsListsThePrimaryFirst(t *testing.T) {
 	series := &ItemDetail{ContentID: "series-1", Type: "series"}
 	bare := &ItemDetail{ContentID: "movie-2", Type: "movie"}
 	episode := &ItemDetail{ContentID: "movie-1", Type: "episode", BackdropURL: "https://cdn.example/series-backdrop"}
-	s.attachExtraBackdrops(context.Background(), []*ItemDetail{movie, series, bare, episode, nil}, "", true)
+	s.attachExtraBackdrops(context.Background(), []*ItemDetail{movie, series, bare, episode, nil}, imagesize.Request{}, true)
 
 	if want := []string{
 		"https://cdn.example/primary",
@@ -104,7 +105,7 @@ func TestAttachExtraBackdropsListsThePrimaryFirst(t *testing.T) {
 	// A batch read carries the paths without presigning anything.
 	batch := &ItemDetail{ContentID: "movie-1", Type: "movie", BackdropURL: "https://cdn.example/primary", BannerPath: "local/movies/movie-1/ee/banner/original.r5.webp"}
 	resolver.calls = 0
-	s.attachExtraBackdrops(context.Background(), []*ItemDetail{batch}, "", false)
+	s.attachExtraBackdrops(context.Background(), []*ItemDetail{batch}, imagesize.Request{}, false)
 	if resolver.calls != 0 || batch.BackdropURLs != nil || batch.BannerURL != "" || len(batch.ExtraBackdropPaths) != 2 {
 		t.Fatalf("batch: %d presigns, URLs %q, paths %q", resolver.calls, batch.BackdropURLs, batch.ExtraBackdropPaths)
 	}
@@ -119,3 +120,19 @@ func (r *countingResolver) ResolveImageURL(ctx context.Context, path, variant st
 	r.calls++
 	return r.echoImageResolver.ResolveImageURL(ctx, path, variant)
 }
+
+// backdrop_width governs backdrop_urls only; the banner, thumb, clear art and
+// disc art keep the response-wide size.
+func TestAttachExtraBackdropsKeepsExtendedArtOffTheBackdropWidth(t *testing.T) {
+	lister := fakeBackdropLister{"movie-1": {{Ordinal: 1, Path: "local/movies/movie-1/aa-1/backdrop/original.r1.webp"}}}
+	s := &DetailService{imageResolver: &countingResolver{}, backdropRepo: lister}
+	movie := &ItemDetail{ContentID: "movie-1", Type: "movie", BannerPath: "local/movies/movie-1/ee/banner/original.r5.webp"}
+	s.attachExtraBackdrops(context.Background(), []*ItemDetail{movie}, imagesize.Request{Widths: imagesize.Widths{Backdrop: 2688}}, true)
+
+	if want := []string{"https://cdn.example/local/movies/movie-1/aa-1/backdrop/original.r1.webp"}; !slices.Equal(movie.BackdropURLs, want) {
+		t.Fatalf("backdrop URLs = %q, want %q", movie.BackdropURLs, want)
+	}
+	if want := "https://cdn.example/local/movies/movie-1/ee/banner/w500.r5.webp"; movie.BannerURL != want {
+		t.Fatalf("banner URL = %q, want %q", movie.BannerURL, want)
+	}
+}
diff --git a/internal/catalog/detail_localization_query_test.go b/internal/catalog/detail_localization_query_test.go
index 01710d4ab5..e9ba91b217 100644
--- a/internal/catalog/detail_localization_query_test.go
+++ b/internal/catalog/detail_localization_query_test.go
@@ -6,6 +6,7 @@ import (
 	"reflect"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgxpool"
@@ -153,6 +154,10 @@ func TestBuildMediaItemDetailLocalizationErrors(t *testing.T) {
 	t.Run("advisory language error remains suppressed before required retry", func(t *testing.T) {
 		folder := &failingDetailFolder{delegate: NewFolderRepository(pool), err: errors.New("transient folder failure"), once: true}
 		service.folderRepo = folder
+		if _, err := service.PendingTranslationLanguageChecked(t.Context(), item, filter); err == nil {
+			t.Fatal("checked pending language hid a transient folder failure")
+		}
+		folder.calls = 0
 		detail, err := service.buildMediaItemDetail(t.Context(), item, item.ContentID, filter, nil)
 		if err != nil || detail == nil || detail.Title != item.Title || detail.PendingTranslationLanguage != "" || folder.calls != 2 {
 			t.Fatalf("detail=%#v error=%v folder calls=%d", detail, err, folder.calls)
@@ -164,6 +169,10 @@ func TestBuildMediaItemDetailLocalizationErrors(t *testing.T) {
 		if got := service.PendingTranslationLanguage(t.Context(), item, filter); got != "" {
 			t.Fatalf("pending language on failure = %q", got)
 		}
+		// A presentation library that no longer exists has nothing missing.
+		if got, err := service.PendingTranslationLanguageChecked(t.Context(), item, filter); got != "" || err != nil {
+			t.Fatalf("checked pending language for a missing library = %q, %v", got, err)
+		}
 		folder.calls = 0
 		_, err := service.buildMediaItemDetail(t.Context(), item, item.ContentID, filter, nil)
 		if !errors.Is(err, ErrItemNotFound) || folder.calls != 2 {
@@ -184,6 +193,9 @@ func TestBuildMediaItemDetailLocalizationErrors(t *testing.T) {
 		if got := service.PendingTranslationLanguage(t.Context(), item, filter); got != "" {
 			t.Fatalf("pending language on localization failure = %q", got)
 		}
+		if _, err := service.PendingTranslationLanguageChecked(t.Context(), item, filter); err == nil {
+			t.Fatal("checked pending language hid a localization failure")
+		}
 		*tracer = detailLocalizationTracer{}
 		_, err := service.buildMediaItemDetail(t.Context(), item, item.ContentID, filter, nil)
 		if err == nil || !strings.Contains(err.Error(), "localizing item detail") || tracer.localizations != 2 {
@@ -220,3 +232,28 @@ func BenchmarkBuildMediaItemDetailLocalization(b *testing.B) {
 		})
 	}
 }
+
+// The Jellyfin-compatible surface seeds an item's image tags from its stored
+// artwork paths, thumbhashes and modification time, as list rows do, so
+// detail carries them.
+func TestBuildMediaItemDetailCarriesImageTagSeeds(t *testing.T) {
+	service, _, _ := detailLocalizationFixture(t)
+	item := localizationDetailItem("translated", "Base overview")
+	item.PosterPath = "local/series/translated/aa/poster/original.r1.webp"
+	item.PosterThumbhash = "poster-th"
+	item.BackdropPath = "local/series/translated/aa/backdrop/original.r1.webp"
+	item.BackdropThumbhash = "backdrop-th"
+	item.LogoPath = "local/series/translated/aa/logo/original.r1.webp"
+	item.UpdatedAt = time.Date(2026, 10, 1, 12, 0, 0, 0, time.UTC)
+
+	detail, err := service.buildMediaItemDetail(t.Context(), item, item.ContentID, AccessFilter{}, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if detail.PosterPath != item.PosterPath || detail.PosterThumbhash != item.PosterThumbhash ||
+		detail.BackdropPath != item.BackdropPath || detail.BackdropThumbhash != item.BackdropThumbhash ||
+		detail.LogoPath != item.LogoPath || !detail.UpdatedAt.Equal(item.UpdatedAt) {
+		t.Fatalf("image seeds = poster (%q, %q) backdrop (%q, %q) logo %q updated %v; want the item's",
+			detail.PosterPath, detail.PosterThumbhash, detail.BackdropPath, detail.BackdropThumbhash, detail.LogoPath, detail.UpdatedAt)
+	}
+}
diff --git a/internal/catalog/detail_pending_translation_test.go b/internal/catalog/detail_pending_translation_test.go
new file mode 100644
index 0000000000..e3e745da12
--- /dev/null
+++ b/internal/catalog/detail_pending_translation_test.go
@@ -0,0 +1,124 @@
+package catalog
+
+import (
+	"os"
+	"testing"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/access"
+	"github.com/prairie-server/prairie-server/internal/models"
+)
+
+// pendingTranslationFixture holds French localizations in session-local
+// tables: the season overview and ep-1 are translated, ep-2 is not.
+func pendingTranslationFixture(t *testing.T) *DetailService {
+	t.Helper()
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	config, err := pgxpool.ParseConfig(dsn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	config.MaxConns = 1
+	pool, err := pgxpool.NewWithConfig(t.Context(), config)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(pool.Close)
+	_, err = pool.Exec(t.Context(), `
+		CREATE TEMP TABLE season_localizations (LIKE public.season_localizations INCLUDING DEFAULTS INCLUDING INDEXES);
+		CREATE TEMP TABLE episode_localizations (LIKE public.episode_localizations INCLUDING DEFAULTS INCLUDING INDEXES);
+		INSERT INTO season_localizations (season_content_id, language, title, overview, poster_path, poster_thumbhash)
+		VALUES ('season-1', 'fr', '', 'Saison.', '', '');
+		INSERT INTO episode_localizations (episode_content_id, language, title, overview)
+		VALUES ('ep-1', 'fr', '', 'Premier.');
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return &DetailService{
+		seasonLocRepo:  NewSeasonLocalizationRepository(pool),
+		episodeLocRepo: NewEpisodeLocalizationRepository(pool),
+	}
+}
+
+func TestPendingSeasonTranslationIncludesItsEpisodes(t *testing.T) {
+	svc := pendingTranslationFixture(t)
+	season := &models.Season{ContentID: "season-1", SeriesID: "show", SeasonNumber: 1, Overview: "Season.", DefaultMetadataLanguage: "en"}
+	french := AccessFilter{ProfilePreferredLanguage: "fr"}
+	episode := func(id string, number int) *models.Episode {
+		return &models.Episode{ContentID: id, SeriesID: "show", SeasonID: "season-1", SeasonNumber: 1, EpisodeNumber: number,
+			Overview: "Source text.", DefaultMetadataLanguage: "en"}
+	}
+	episodes := []*models.Episode{episode("ep-1", 1), episode("ep-2", 2)}
+
+	// The season overview is translated, but ep-2 is not.
+	if got := svc.pendingSeasonTranslationLanguage(t.Context(), season, french, episodes); got != "fr" {
+		t.Fatalf("pending = %q, want fr while an episode lacks a French overview", got)
+	}
+	if got := svc.pendingSeasonTranslationLanguage(t.Context(), season, french, episodes[:1]); got != "" {
+		t.Fatalf("pending = %q with every episode translated, want none", got)
+	}
+	// An English profile reads the source text; nothing is pending.
+	if got := svc.pendingSeasonTranslationLanguage(t.Context(), season, AccessFilter{ProfilePreferredLanguage: "en"}, episodes); got != "" {
+		t.Fatalf("pending = %q for the source language, want none", got)
+	}
+
+	localized, err := svc.LocalizeEpisodeModels(t.Context(), episodes, french)
+	if err != nil {
+		t.Fatal(err)
+	}
+	pending := map[string]string{}
+	for _, episode := range localized {
+		pending[episode.ContentID] = episode.PendingTranslationLanguage
+	}
+	if pending["ep-1"] != "" || pending["ep-2"] != "fr" {
+		t.Fatalf("episode pending = %v, want only ep-2 pending fr", pending)
+	}
+	for _, episode := range episodes {
+		if episode.PendingTranslationLanguage != "" {
+			t.Fatalf("LocalizeEpisodeModels mutated its input: %+v", episode)
+		}
+	}
+}
+
+// A failed parent-series read is an error for the checked pending variants,
+// which the on-view guard relies on, not "nothing missing". The advisory
+// methods the detail pages use still report nothing.
+func TestCheckedPendingTranslationReportsAFailedSeriesRead(t *testing.T) {
+	svc := pendingTranslationFixture(t)
+	config, err := pgxpool.ParseConfig(os.Getenv("PRAIRIE_TEST_DATABASE_URL"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	config.MaxConns = 1
+	pool, err := pgxpool.NewWithConfig(t.Context(), config)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(pool.Close)
+	if _, err := pool.Exec(t.Context(), `
+		CREATE TEMP TABLE media_items (LIKE public.media_items INCLUDING DEFAULTS);
+		ALTER TABLE pg_temp.media_items RENAME COLUMN content_id TO unavailable_content_id;
+	`); err != nil {
+		t.Fatal(err)
+	}
+	svc.itemRepo = NewItemRepository(pool)
+	original := AccessFilter{ProfilePreferredLanguage: access.OriginalMetadataLanguage}
+	season := &models.Season{ContentID: "season-1", SeriesID: "show", SeasonNumber: 1, Overview: "Season.", DefaultMetadataLanguage: "en"}
+	episode := &models.Episode{ContentID: "ep-2", SeriesID: "show", SeasonID: "season-1", SeasonNumber: 1, EpisodeNumber: 2,
+		Overview: "Source text.", DefaultMetadataLanguage: "en"}
+
+	if _, err := svc.PendingSeasonTranslationLanguageChecked(t.Context(), season, original); err == nil {
+		t.Fatal("season: checked pending language hid a failed series read")
+	}
+	if _, err := svc.PendingEpisodeTranslationLanguageChecked(t.Context(), episode, original); err == nil {
+		t.Fatal("episode: checked pending language hid a failed series read")
+	}
+	if got := svc.PendingSeasonTranslationLanguage(t.Context(), season, original); got != "" {
+		t.Fatalf("advisory season pending language = %q, want none on a failed read", got)
+	}
+}
diff --git a/internal/catalog/detail_watch_artwork_test.go b/internal/catalog/detail_watch_artwork_test.go
new file mode 100644
index 0000000000..8f5fd7a7ac
--- /dev/null
+++ b/internal/catalog/detail_watch_artwork_test.go
@@ -0,0 +1,124 @@
+package catalog
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+)
+
+// TestGetWatchDetailArtwork covers #803 through GetWatchDetail itself: a
+// movie carries its own poster and backdrop, an episode its still as the
+// poster and its series' backdrop, and a local extra its parent's artwork.
+// An item without artwork leaves the fields empty.
+func TestGetWatchDetailArtwork(t *testing.T) {
+	f := newVersionsFixture(t)
+	exec := func(sql string, args ...any) {
+		t.Helper()
+		if _, err := f.pool.Exec(t.Context(), sql, args...); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for _, kind := range []string{"movie", "series"} {
+		exec(`UPDATE media_items SET poster_path=$2, poster_thumbhash=$3, backdrop_path=$4, backdrop_thumbhash=$5 WHERE content_id=$1`,
+			f.ids[kind], "tmdb/"+kind+"/poster.jpg", kind+"-poster-hash", "tmdb/"+kind+"/backdrop.jpg", kind+"-backdrop-hash")
+	}
+	exec(`UPDATE episodes SET still_path=$2, still_thumbhash=$3 WHERE content_id=$1`, f.ids["episode"], "tmdb/episode/still.jpg", "episode-still-hash")
+
+	filter := AccessFilter{UserID: 1, ProfileID: "profile-1", ImageSize: "medium"}
+	presign := func(path, kind string) string {
+		return f.svc.PresignImageURL(t.Context(), path, kind, string(filter.ImageSize))
+	}
+	cases := []struct {
+		name, id                                 string
+		posterURL, posterHash, backURL, backHash string
+	}{
+		{"movie", f.ids["movie"], presign("tmdb/movie/poster.jpg", "poster"), "movie-poster-hash", presign("tmdb/movie/backdrop.jpg", "backdrop"), "movie-backdrop-hash"},
+		{"episode", f.ids["episode"], presign("tmdb/episode/still.jpg", "still"), "episode-still-hash", presign("tmdb/series/backdrop.jpg", "backdrop"), "series-backdrop-hash"},
+		{"extra", f.ids["extra"], presign("tmdb/movie/poster.jpg", "poster"), "movie-poster-hash", presign("tmdb/movie/backdrop.jpg", "backdrop"), "movie-backdrop-hash"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			detail, err := f.svc.GetWatchDetail(t.Context(), tc.id, filter)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !strings.HasPrefix(detail.PosterURL, "https://images.invalid/") || !strings.HasPrefix(detail.BackdropURL, "https://images.invalid/") {
+				t.Fatalf("artwork URLs not resolved through the image resolver: poster=%q backdrop=%q", detail.PosterURL, detail.BackdropURL)
+			}
+			if detail.PosterURL != tc.posterURL || detail.PosterThumbhash != tc.posterHash {
+				t.Fatalf("poster = %q/%q, want %q/%q", detail.PosterURL, detail.PosterThumbhash, tc.posterURL, tc.posterHash)
+			}
+			if detail.BackdropURL != tc.backURL || detail.BackdropThumbhash != tc.backHash {
+				t.Fatalf("backdrop = %q/%q, want %q/%q", detail.BackdropURL, detail.BackdropThumbhash, tc.backURL, tc.backHash)
+			}
+		})
+	}
+
+	t.Run("no artwork", func(t *testing.T) {
+		exec(`UPDATE media_items SET poster_path='', poster_thumbhash='', backdrop_path='', backdrop_thumbhash='' WHERE content_id=$1`, f.ids["movie"])
+		detail, err := f.svc.GetWatchDetail(t.Context(), f.ids["movie"], filter)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if detail.PosterURL != "" || detail.BackdropURL != "" || detail.PosterThumbhash != "" || detail.BackdropThumbhash != "" {
+			t.Fatalf("artwork for an item without any: poster=%q backdrop=%q", detail.PosterURL, detail.BackdropURL)
+		}
+	})
+}
+
+func TestWatchDetailLegacyJSONOmitsArtwork(t *testing.T) {
+	detail := WatchDetail{
+		ContentID: "movie:test", Title: "Test",
+		PosterURL: "https://images.invalid/poster.jpg", PosterThumbhash: "poster-hash",
+		BackdropURL: "https://images.invalid/backdrop.jpg", BackdropThumbhash: "backdrop-hash",
+	}
+	payload, err := json.Marshal(detail)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var body map[string]json.RawMessage
+	if err := json.Unmarshal(payload, &body); err != nil {
+		t.Fatal(err)
+	}
+	for _, key := range []string{"poster_url", "poster_thumbhash", "backdrop_url", "backdrop_thumbhash"} {
+		if _, exists := body[key]; exists {
+			t.Errorf("frozen v1 watch JSON includes %s", key)
+		}
+	}
+	if _, exists := body["content_id"]; !exists {
+		t.Fatal("watch JSON lost content_id")
+	}
+}
+
+func TestGetWatchDetailOmitsArtworkResolution(t *testing.T) {
+	f := newVersionsFixture(t)
+	for _, kind := range []string{"movie", "series"} {
+		if _, err := f.pool.Exec(t.Context(), `UPDATE media_items SET poster_path=$2, backdrop_path=$3 WHERE content_id=$1`,
+			f.ids[kind], "provider://poster", "provider://backdrop"); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if _, err := f.pool.Exec(t.Context(), `UPDATE episodes SET still_path=$2 WHERE content_id=$1`, f.ids["episode"], "provider://still"); err != nil {
+		t.Fatal(err)
+	}
+	for _, kind := range []string{"movie", "episode", "extra"} {
+		t.Run(kind, func(t *testing.T) {
+			f.images.calls.Store(0)
+			detail, err := f.svc.GetWatchDetail(t.Context(), f.ids[kind], AccessFilter{
+				UserID: 1, ProfileID: "profile-1", OmitWatchArtwork: true,
+			})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if calls := f.images.calls.Load(); calls != 0 {
+				t.Fatalf("source lookup made %d artwork resolver calls", calls)
+			}
+			if len(detail.Versions) == 0 {
+				t.Fatal("source lookup lost playable versions")
+			}
+			if detail.PosterURL != "" || detail.BackdropURL != "" {
+				t.Fatal("source lookup included artwork")
+			}
+		})
+	}
+}
diff --git a/internal/catalog/encrypted_settings_repo.go b/internal/catalog/encrypted_settings_repo.go
index c4ce5c30ee..3252ad9f56 100644
--- a/internal/catalog/encrypted_settings_repo.go
+++ b/internal/catalog/encrypted_settings_repo.go
@@ -94,8 +94,6 @@ var SensitiveSettingKeys = map[string]bool{
 
 	// Watch-sync OAuth client credentials. The client_id entries are low-value
 	// but kept as a harmless safe superset and to match existing redaction.
-	"watchsync.trakt.client_id":     true,
-	"watchsync.trakt.client_secret": true,
 	"watchsync.simkl.client_id":     true,
 	"watchsync.simkl.client_secret": true,
 
diff --git a/internal/catalog/encrypted_settings_repo_test.go b/internal/catalog/encrypted_settings_repo_test.go
index b391666388..4c6d5ca1cc 100644
--- a/internal/catalog/encrypted_settings_repo_test.go
+++ b/internal/catalog/encrypted_settings_repo_test.go
@@ -266,7 +266,7 @@ func TestSensitiveSettingKeys_Audited(t *testing.T) {
 		"tmdb.api_key",
 		"requests.radarr.api_key",
 		"requests.sonarr.api_key",
-		"watchsync.trakt.client_secret",
+		"watchsync.simkl.client_secret",
 		"email.smtp_password",
 		"discord.client_secret",
 		"discord.bot_token",
diff --git a/internal/catalog/image_size_test.go b/internal/catalog/image_size_test.go
index 71e928d5c6..c9943c39d9 100644
--- a/internal/catalog/image_size_test.go
+++ b/internal/catalog/image_size_test.go
@@ -3,6 +3,9 @@ package catalog
 import (
 	"context"
 	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/deviceclass"
+	"github.com/prairie-server/prairie-server/internal/imagesize"
 )
 
 // The literals below are the variants this package returned before the
@@ -59,7 +62,7 @@ func TestCachedImageVariantKeyMatchesPreImageSizeBehavior(t *testing.T) {
 // ladder has no w780/w1280 rung, so posters, stills and logos stop at w500.
 func TestCachedImageVariantKeyLarge(t *testing.T) {
 	want := map[string]string{
-		"backdrop": "w1920",
+		"backdrop": "w2560",
 		"logo":     "w500",
 		"poster":   "w500",
 		"still":    "w500",
@@ -111,8 +114,54 @@ func TestCachedImageVariantPathRewritesKey(t *testing.T) {
 		}
 	}
 
+	// The key's own image type picks the ladder: an episode still passed in a
+	// poster slot resolves to still rungs, not a poster rung it never had.
+	const still = "tvdb/series/73141/seasons/22/episodes/9/still/original.webp"
+	if got := cachedImageVariantPath(context.Background(), still, "poster", "large"); got != "tvdb/series/73141/seasons/22/episodes/9/still/w500.webp" {
+		t.Errorf("cachedImageVariantPath(context.Background(), still, poster, large) = %q, want the still ladder's w500", got)
+	}
+	if got := cachedImageVariantPath(context.Background(), still, "backdrop", ""); got != "tvdb/series/73141/seasons/22/episodes/9/still/w500.webp" {
+		t.Errorf("cachedImageVariantPath(context.Background(), still, backdrop, \"\") = %q, want the still default w500", got)
+	}
+
 	const pluginPath = "plugin://tmdb/poster/original.webp"
 	if got := cachedImageVariantPath(context.Background(), pluginPath, "poster", "large"); got != pluginPath {
 		t.Errorf("cachedImageVariantPath(plugin path) = %q, want it unchanged", got)
 	}
 }
+
+// A width size resolves on the key's own ladder: the narrowest rung at least
+// that wide, else the original.
+func TestCachedImageVariantPathForWidth(t *testing.T) {
+	for _, tc := range []struct {
+		path      string
+		imageType string
+		px        int
+		want      string
+	}{
+		{"tmdb/movies/1/backdrop/original.r1.webp", "backdrop", 2688, "tmdb/movies/1/backdrop/original.r1.webp"},
+		{"tmdb/movies/1/backdrop/original.r1.webp", "backdrop", 1344, "tmdb/movies/1/backdrop/w1920.r1.webp"},
+		{"tmdb/series/1/seasons/1/episodes/2/still/original.r1.webp", "backdrop", 1344, "tmdb/series/1/seasons/1/episodes/2/still/original.r1.webp"},
+		{"tmdb/series/1/seasons/1/episodes/2/still/original.r1.webp", "still", 480, "tmdb/series/1/seasons/1/episodes/2/still/w500.r1.webp"},
+		{"tmdb/series/1/seasons/1/episodes/2/still/original.r1.webp", "still", 720, "tmdb/series/1/seasons/1/episodes/2/still/original.r1.webp"},
+		{"tmdb/movies/1/poster/original.r1.webp", "poster", 352, "tmdb/movies/1/poster/w500.r1.webp"},
+		{"tmdb/movies/1/poster/original.r1.webp", "poster", 280, "tmdb/movies/1/poster/w300.r1.webp"},
+	} {
+		if got := cachedImageVariantPath(context.Background(), tc.path, tc.imageType, string(imagesize.Width(tc.px))); got != tc.want {
+			t.Errorf("cachedImageVariantPath(%q, %q, %dpx) = %q, want %q", tc.path, tc.imageType, tc.px, got, tc.want)
+		}
+	}
+}
+
+// An explicit width is a size hint, so the TV default (the w200 poster rung)
+// does not override it.
+func TestCachedImageVariantPathForWidthOnTV(t *testing.T) {
+	ctx := deviceclass.SetContext(context.Background(), deviceclass.TV)
+	const path = "tmdb/movies/1/poster/original.r1.webp"
+	if got := cachedImageVariantPath(ctx, path, "poster", string(imagesize.Width(280))); got != "tmdb/movies/1/poster/w300.r1.webp" {
+		t.Errorf("TV poster at 280px = %q, want w300", got)
+	}
+	if got := cachedImageVariantPath(ctx, path, "poster", ""); got != "tmdb/movies/1/poster/w200.r1.webp" {
+		t.Errorf("TV poster without a hint = %q, want w200", got)
+	}
+}
diff --git a/internal/catalog/image_variants_test.go b/internal/catalog/image_variants_test.go
index 300ae0afe5..165975694f 100644
--- a/internal/catalog/image_variants_test.go
+++ b/internal/catalog/image_variants_test.go
@@ -45,17 +45,29 @@ func TestBackdropVariantPath(t *testing.T) {
 			want:    "/tmdb/shows/1399/backdrop/w1920.jpg",
 		},
 		{
-			name:    "episode still clamps to w500 (no large variant exists)",
+			name:    "episode still in a w1280 slot gets its widest rung (w500)",
 			path:    "tvdb/series/73141/seasons/22/episodes/9/still/original.webp",
 			desired: "w1280",
 			want:    "tvdb/series/73141/seasons/22/episodes/9/still/w500.webp",
 		},
 		{
-			name:    "episode still clamps w1920 to w500",
+			name:    "episode still in a w1920 slot gets its widest rung",
 			path:    "tvdb/series/73141/seasons/22/episodes/9/still/original.webp",
 			desired: "w1920",
 			want:    "tvdb/series/73141/seasons/22/episodes/9/still/w500.webp",
 		},
+		{
+			name:    "episode still in a card slot keeps the card rung",
+			path:    "tvdb/series/73141/seasons/22/episodes/9/still/original.webp",
+			desired: "w300",
+			want:    "tvdb/series/73141/seasons/22/episodes/9/still/w300.webp",
+		},
+		{
+			name:    "poster in a w1920 slot gets its widest rung",
+			path:    "tmdb/shows/1399/poster/original.webp",
+			desired: "w1920",
+			want:    "tmdb/shows/1399/poster/w500.webp",
+		},
 		{
 			name:    "http url passes through",
 			path:    "https://images.example.com/backdrop/original.jpg",
diff --git a/internal/catalog/item_cards.go b/internal/catalog/item_cards.go
index 8ca518267e..7802dd4d75 100644
--- a/internal/catalog/item_cards.go
+++ b/internal/catalog/item_cards.go
@@ -4,6 +4,7 @@ import (
 	"context"
 
 	"github.com/prairie-server/prairie-server/internal/artworkkey"
+	"github.com/prairie-server/prairie-server/internal/imagesize"
 	"github.com/prairie-server/prairie-server/internal/lang"
 	"github.com/prairie-server/prairie-server/internal/models"
 )
@@ -60,33 +61,34 @@ func (s *DetailService) GetItemCardsByIDs(ctx context.Context, contentIDs []stri
 		return nil, err
 	}
 
-	// Every image on the page is resolved in one batch. Paths are normalized
-	// to the requested variant first so cached keys match the way the
-	// per-item path would have asked for them.
-	size := string(filter.ImageSize)
-	paths := make([]string, 0, len(visible)*3)
-	seen := make(map[string]struct{}, len(visible)*3)
-	add := func(path string) string {
+	// Every image on the page is resolved together (see ArtworkBatch). Paths
+	// are normalized to the requested variant first so cached keys match the
+	// way the per-item path would have asked for them.
+	var batch ArtworkBatch
+	hints := make(map[imagesize.Slot]string, 3)
+	for _, slot := range []imagesize.Slot{imagesize.SlotPoster, imagesize.SlotBackdrop, imagesize.SlotLogo} {
+		hints[slot] = sizeToVariant(string(filter.ImageSizeFor(slot)))
+	}
+	// add normalizes a path on its own ladder (imageType only when the key
+	// names none) at the size the client asked for that slot.
+	add := func(path, imageType string, slot imagesize.Slot) string {
 		if path == "" || path == "-" {
 			return ""
 		}
-		normalized := cachedImageVariantPath(ctx, path, imageTypeOrDefault(path, artworkkey.ImagePoster), size)
-		if _, ok := seen[normalized]; !ok {
-			seen[normalized] = struct{}{}
-			paths = append(paths, normalized)
-		}
+		normalized := cachedImageVariantPath(ctx, path, imageType, string(filter.ImageSizeFor(slot)))
+		batch.Add(normalized, hints[slot])
 		return normalized
 	}
 	type cardPaths struct{ poster, backdrop, logo string }
 	byID := make(map[string]cardPaths, len(visible))
 	for _, item := range visible {
 		byID[item.ContentID] = cardPaths{
-			poster:   add(item.PosterPath),
-			backdrop: addTyped(ctx, add, item.BackdropPath, artworkkey.ImageBackdrop, size),
-			logo:     addTyped(ctx, add, item.LogoPath, artworkkey.ImageLogo, size),
+			poster:   add(item.PosterPath, artworkkey.ImagePoster, imagesize.SlotPoster),
+			backdrop: add(item.BackdropPath, artworkkey.ImageBackdrop, imagesize.SlotBackdrop),
+			logo:     add(item.LogoPath, artworkkey.ImageLogo, imagesize.SlotLogo),
 		}
 	}
-	urls := s.PresignURLsWithExpiry(ctx, paths, sizeToVariant(size))
+	urls := batch.Resolve(ctx, s, sizeToVariant(string(filter.ImageSize)))
 
 	for _, item := range visible {
 		id := item.ContentID
@@ -121,9 +123,9 @@ func (s *DetailService) GetItemCardsByIDs(ctx context.Context, contentIDs []stri
 			SeasonCount:       localized.SeasonCount,
 			PosterThumbhash:   localized.PosterThumbhash,
 			BackdropThumbhash: localized.BackdropThumbhash,
-			PosterURL:         urls[p.poster].URL,
-			BackdropURL:       urls[p.backdrop].URL,
-			LogoURL:           urls[p.logo].URL,
+			PosterURL:         urls.Get(p.poster, hints[imagesize.SlotPoster]).URL,
+			BackdropURL:       urls.Get(p.backdrop, hints[imagesize.SlotBackdrop]).URL,
+			LogoURL:           urls.Get(p.logo, hints[imagesize.SlotLogo]).URL,
 			Versions:          []FileVersion{},
 			PlaybackVariants:  []PlaybackVariant{},
 			Subtitles:         []SubtitleInfo{},
@@ -131,22 +133,3 @@ func (s *DetailService) GetItemCardsByIDs(ctx context.Context, contentIDs []stri
 	}
 	return result, nil
 }
-
-// addTyped normalizes a non-poster path with its own ladder before adding it.
-func addTyped(ctx context.Context, add func(string) string, path, imageType, size string) string {
-	if path == "" || path == "-" {
-		return ""
-	}
-	// add() normalizes with the poster ladder; pre-normalize with the right
-	// type so the poster rewrite is a no-op on an already-variant path.
-	return add(cachedImageVariantPath(ctx, path, imageTypeOrDefault(path, imageType), size))
-}
-
-// imageTypeOrDefault reads the ladder off a cached key, falling back to the
-// slot's default for keys that do not encode one.
-func imageTypeOrDefault(path, fallback string) string {
-	if t := imageTypeFromCachedPath(path); t != "" {
-		return t
-	}
-	return fallback
-}
diff --git a/internal/catalog/item_repo.go b/internal/catalog/item_repo.go
index 914285cfe5..32de302b72 100644
--- a/internal/catalog/item_repo.go
+++ b/internal/catalog/item_repo.go
@@ -5,12 +5,13 @@ import (
 	"errors"
 	"fmt"
 	"log/slog"
+	"math"
 	"slices"
-	"sort"
 	"strconv"
 	"strings"
 	"time"
 	"unicode"
+	"unicode/utf8"
 
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgconn"
@@ -18,6 +19,7 @@ import (
 
 	"github.com/prairie-server/prairie-server/internal/access"
 	"github.com/prairie-server/prairie-server/internal/artworkkey"
+	"github.com/prairie-server/prairie-server/internal/contentid"
 	"github.com/prairie-server/prairie-server/internal/idgen"
 	"github.com/prairie-server/prairie-server/internal/models"
 	"github.com/prairie-server/prairie-server/internal/pathscope"
@@ -164,11 +166,21 @@ const fuzzyFallbackThreshold = 5
 // exceeds this, the overflow is logged and the total is reported as inexact.
 const fuzzyMaxResults = 50
 
-// fuzzyRerankMaxAliasesPerItem bounds the only extra metadata the in-process
-// typo reranker may read. Candidate rows are already capped by fuzzyMaxResults,
-// so this makes its worst case 50 items / 200 relevant aliases regardless of
-// total library size.
-const fuzzyRerankMaxAliasesPerItem = 4
+// fuzzyCandidatePool is how many trigram candidates, in trigram rank order, the
+// fallback scores before admitFuzzyRanks keeps the titles matching every word.
+// Whole-query trigram similarity favors short titles, so a long title matching
+// every word ranks low: among 664 candidates for "brekng bad" in a
+// 190,000-title catalog, "Snow Globe: A Breaking Bad Short" ranked 184th and
+// two Breaking Bad documentaries 496th and 497th. The trigram scan dominates the
+// query's cost; a larger LIMIT adds only row transfer and in-process scoring.
+const fuzzyCandidatePool = 500
+
+// fuzzyRerankAliasesPerOrder bounds the only extra metadata the in-process
+// typo reranker may read: per item, this many aliases by similarity and this
+// many by word coverage (see loadFuzzyRerankAliases). Candidate rows are
+// already capped by fuzzyCandidatePool, so its worst case is 500 items / 4,000
+// relevant aliases regardless of total library size.
+const fuzzyRerankAliasesPerOrder = 4
 
 const (
 	fuzzyRerankMaxQueryTokens = 16
@@ -181,7 +193,7 @@ const (
 // for the fuzzy query via SET LOCAL. The <<% operator's selectivity is
 // otherwise governed by a cluster-wide GUC a DBA (or another application) can
 // change, silently altering both match quality and scan cost per deployment —
-// and its server default (0.6) would reject ordinary one-edit typos
+// and its server default (0.5) would reject ordinary one-edit typos
 // ("avegners" vs "avengers" scores ~0.38), so pinning is load-bearing, not
 // just hygiene.
 const trgmWordSimilarityThreshold = 0.30
@@ -627,7 +639,9 @@ func (r *ItemRepository) upsert(ctx context.Context, execer itemExecer, item *mo
 }
 
 // writeItem inserts item and, when update is set, overwrites every mutable
-// field of an existing row. It reports whether a row was written.
+// field of an existing row. It reports whether a row was written. An update
+// that leaves the item matched also clears match_ignored_at, since an
+// admin's ignore only means something while the item is unmatched.
 func (r *ItemRepository) writeItem(ctx context.Context, execer itemExecer, item *models.MediaItem, update bool) (bool, error) {
 	if item.ContentID == "" {
 		return false, fmt.Errorf("refusing to write media item with empty content_id")
@@ -719,6 +733,7 @@ func (r *ItemRepository) writeItem(ctx context.Context, execer itemExecer, item
 			episode_metadata_incomplete = EXCLUDED.episode_metadata_incomplete,
 			episode_metadata_last_checked_at = EXCLUDED.episode_metadata_last_checked_at,
 			status = EXCLUDED.status,
+			match_ignored_at = CASE WHEN lower(trim(EXCLUDED.status)) = 'matched' THEN NULL ELSE media_items.match_ignored_at END,
 			content_rating_age = EXCLUDED.content_rating_age,
 			advisory_age = EXCLUDED.advisory_age,
 			advisory_source = EXCLUDED.advisory_source,
@@ -1041,48 +1056,133 @@ type ExternalIDLookup struct {
 	ByTVDB map[string]string
 }
 
+// Resolve picks the content_id a source entry names, trying its IDs in the
+// itemType's anchor precedence (contentid.AnchorPrecedence): TVDB → TMDB →
+// IMDb for a series, TMDB → IMDb → TVDB otherwise. It returns "" when no ID
+// matches or the lookup is nil.
+func (l *ExternalIDLookup) Resolve(itemType, tvdbID, tmdbID, imdbID string) string {
+	if l == nil {
+		return ""
+	}
+	for _, provider := range contentid.AnchorPrecedence(itemType) {
+		var id string
+		switch provider {
+		case contentid.ProviderTVDB:
+			id = lookupExternalID(l.ByTVDB, tvdbID)
+		case contentid.ProviderTMDB:
+			id = lookupExternalID(l.ByTMDB, tmdbID)
+		case contentid.ProviderIMDB:
+			id = lookupExternalID(l.ByIMDb, imdbID)
+		}
+		if id != "" {
+			return id
+		}
+	}
+	return ""
+}
+
+func lookupExternalID(byID map[string]string, id string) string {
+	if id == "" {
+		return ""
+	}
+	return byID[id]
+}
+
+// externalIDLookupChunk caps how many IDs of each provider one
+// GetByExternalIDs statement carries.
+const externalIDLookupChunk = 1000
+
 // GetByExternalIDs fetches media items matching any of the given external IDs
-// of the specified type, in a single query. Replaces N×3 GetByExternalID
-// calls in MDBList collection sync (audit 2026-05-01 §3.7).
+// of the specified type. Repeated IDs are looked up once, and each statement
+// carries at most externalIDLookupChunk IDs per provider, so a long list costs
+// a bounded number of bounded statements. Replaces N×3 GetByExternalID calls
+// in MDBList collection sync (audit 2026-05-01 §3.7).
 func (r *ItemRepository) GetByExternalIDs(ctx context.Context, batch ExternalIDBatch, itemType string) (*ExternalIDLookup, error) {
-	if len(batch.TMDBIDs) == 0 && len(batch.IMDbIDs) == 0 && len(batch.TVDBIDs) == 0 {
-		return &ExternalIDLookup{
-			ByTMDB: map[string]string{},
-			ByIMDb: map[string]string{},
-			ByTVDB: map[string]string{},
-		}, nil
+	out := &ExternalIDLookup{
+		ByTMDB: map[string]string{},
+		ByIMDb: map[string]string{},
+		ByTVDB: map[string]string{},
 	}
+	tmdbIDs, imdbIDs, tvdbIDs := uniqueExternalIDs(batch.TMDBIDs), uniqueExternalIDs(batch.IMDbIDs), uniqueExternalIDs(batch.TVDBIDs)
+	for start := 0; start < max(len(tmdbIDs), len(imdbIDs), len(tvdbIDs)); start += externalIDLookupChunk {
+		chunk := ExternalIDBatch{
+			TMDBIDs: externalIDChunk(tmdbIDs, start),
+			IMDbIDs: externalIDChunk(imdbIDs, start),
+			TVDBIDs: externalIDChunk(tvdbIDs, start),
+		}
+		if err := r.getByExternalIDsChunk(ctx, chunk, itemType, out); err != nil {
+			return nil, err
+		}
+	}
+	return out, nil
+}
+
+// getByExternalIDsChunk adds to out the best title for each ID in batch.
+// Rows arrive best first, so a shared ID keeps the title GetByExternalID
+// would pick. A row can carry another chunk's ID in a column it did not match
+// on; only IDs this chunk asked for are kept, so that ID is decided by its own
+// chunk's ordering.
+func (r *ItemRepository) getByExternalIDsChunk(ctx context.Context, batch ExternalIDBatch, itemType string, out *ExternalIDLookup) error {
 	sql, args := r.buildGetByExternalIDsSQL(batch, itemType)
 	rows, err := r.pool.Query(ctx, sql, args...)
 	if err != nil {
-		return nil, fmt.Errorf("fetching media items by external IDs: %w", err)
+		return fmt.Errorf("fetching media items by external IDs: %w", err)
 	}
 	defer rows.Close()
 
-	out := &ExternalIDLookup{
-		ByTMDB: map[string]string{},
-		ByIMDb: map[string]string{},
-		ByTVDB: map[string]string{},
+	tmdbAsked, imdbAsked, tvdbAsked := externalIDSet(batch.TMDBIDs), externalIDSet(batch.IMDbIDs), externalIDSet(batch.TVDBIDs)
+	keep := func(by map[string]string, asked map[string]struct{}, id, contentID string) {
+		if _, ok := asked[id]; !ok {
+			return
+		}
+		if _, taken := by[id]; !taken {
+			by[id] = contentID
+		}
 	}
 	for rows.Next() {
 		var contentID, tmdb, imdb, tvdb string
 		if err := rows.Scan(&contentID, &tmdb, &imdb, &tvdb); err != nil {
-			return nil, fmt.Errorf("scanning external-ID row: %w", err)
-		}
-		if tmdb != "" {
-			out.ByTMDB[tmdb] = contentID
-		}
-		if imdb != "" {
-			out.ByIMDb[imdb] = contentID
-		}
-		if tvdb != "" {
-			out.ByTVDB[tvdb] = contentID
+			return fmt.Errorf("scanning external-ID row: %w", err)
 		}
+		keep(out.ByTMDB, tmdbAsked, tmdb, contentID)
+		keep(out.ByIMDb, imdbAsked, imdb, contentID)
+		keep(out.ByTVDB, tvdbAsked, tvdb, contentID)
 	}
 	if err := rows.Err(); err != nil {
-		return nil, fmt.Errorf("iterating external-ID rows: %w", err)
+		return fmt.Errorf("iterating external-ID rows: %w", err)
 	}
-	return out, nil
+	return nil
+}
+
+// uniqueExternalIDs drops empty and repeated IDs, keeping first-seen order.
+func uniqueExternalIDs(ids []string) []string {
+	seen := make(map[string]struct{}, len(ids))
+	out := make([]string, 0, len(ids))
+	for _, id := range ids {
+		if _, dup := seen[id]; id == "" || dup {
+			continue
+		}
+		seen[id] = struct{}{}
+		out = append(out, id)
+	}
+	return out
+}
+
+// externalIDChunk returns the externalIDLookupChunk IDs starting at start, or
+// nil past the end.
+func externalIDChunk(ids []string, start int) []string {
+	if start >= len(ids) {
+		return nil
+	}
+	return ids[start:min(start+externalIDLookupChunk, len(ids))]
+}
+
+func externalIDSet(ids []string) map[string]struct{} {
+	set := make(map[string]struct{}, len(ids))
+	for _, id := range ids {
+		set[id] = struct{}{}
+	}
+	return set
 }
 
 // buildGetByExternalIDsSQL pins the exact SQL shape used by GetByExternalIDs:
@@ -1091,13 +1191,102 @@ func (r *ItemRepository) GetByExternalIDs(ctx context.Context, batch ExternalIDB
 // the column is NULL (imdb_id/tmdb_id/tvdb_id are nullable text on
 // media_items per migration 001).
 func (r *ItemRepository) buildGetByExternalIDsSQL(batch ExternalIDBatch, itemType string) (string, []any) {
-	sql := `SELECT content_id, COALESCE(tmdb_id, ''), COALESCE(imdb_id, ''), COALESCE(tvdb_id, '')
-            FROM media_items
-            WHERE (tmdb_id = ANY($1) OR imdb_id = ANY($2) OR tvdb_id = ANY($3))
-              AND type = $4`
+	// Titles match on their own ID columns and on their provider ID rows; a
+	// title can be known to a provider only through the latter. Rows arrive
+	// best first: direct columns before provider rows, then the order
+	// GetByExternalID prefers.
+	sql := `SELECT content_id, tmdb, imdb, tvdb FROM (
+                SELECT mi.content_id, COALESCE(mi.tmdb_id, '') AS tmdb, COALESCE(mi.imdb_id, '') AS imdb,
+                       COALESCE(mi.tvdb_id, '') AS tvdb, 0 AS source_rank, mi.status, mi.updated_at
+                FROM media_items mi
+                WHERE (mi.tmdb_id = ANY($1) OR mi.imdb_id = ANY($2) OR mi.tvdb_id = ANY($3))
+                  AND mi.type = $4
+                UNION ALL
+                SELECT mi.content_id,
+                       CASE WHEN mip.provider = 'tmdb' THEN mip.provider_id ELSE '' END,
+                       CASE WHEN mip.provider = 'imdb' THEN mip.provider_id ELSE '' END,
+                       CASE WHEN mip.provider = 'tvdb' THEN mip.provider_id ELSE '' END,
+                       1, mi.status, mi.updated_at
+                FROM media_item_provider_ids mip
+                JOIN media_items mi ON mi.content_id = mip.content_id AND mi.type = $4
+                WHERE mip.item_type = $4
+                  AND ((mip.provider = 'tmdb' AND mip.provider_id = ANY($1))
+                    OR (mip.provider = 'imdb' AND mip.provider_id = ANY($2))
+                    OR (mip.provider = 'tvdb' AND mip.provider_id = ANY($3)))
+            ) matches
+            ORDER BY
+                source_rank,
+                CASE lower(trim(status))
+                    WHEN 'matched' THEN 0
+                    WHEN 'pending' THEN 1
+                    WHEN 'unmatched' THEN 2
+                    ELSE 3
+                END,
+                updated_at DESC,
+                content_id ASC`
 	return sql, []any{batch.TMDBIDs, batch.IMDbIDs, batch.TVDBIDs, itemType}
 }
 
+// TitleWithoutTMDBID is a catalog title known by IMDb or TVDB ID but not by
+// TMDB ID.
+type TitleWithoutTMDBID struct {
+	ContentID string
+	IMDbID    string
+	TVDBID    string
+}
+
+// TitlesWithoutTMDBID returns up to limit titles of itemType that have no bare
+// numeric TMDB ID in their own columns or provider ID rows but do have an IMDb
+// or TVDB ID. Only these titles can match a TMDB entry through another
+// provider's ID. A TMDB ID stored in TMDB's "id-slug" URL form (see
+// sameTMDBID) never equals an entry's ID, so such a title is listed too.
+// Titles arrive in GetByExternalID's preference order, so when two of them
+// resolve to one TMDB ID the caller can keep the first.
+func (r *ItemRepository) TitlesWithoutTMDBID(ctx context.Context, itemType string, limit int) ([]TitleWithoutTMDBID, error) {
+	rows, err := r.pool.Query(ctx, `
+		SELECT mi.content_id,
+		       COALESCE(NULLIF(mi.imdb_id, ''), imdb.provider_id, ''),
+		       COALESCE(NULLIF(mi.tvdb_id, ''), tvdb.provider_id, '')
+		FROM media_items mi
+		LEFT JOIN media_item_provider_ids imdb ON imdb.content_id = mi.content_id AND imdb.provider = 'imdb'
+		LEFT JOIN media_item_provider_ids tvdb ON tvdb.content_id = mi.content_id AND tvdb.provider = 'tvdb'
+		WHERE mi.type = $1
+		  AND COALESCE(mi.tmdb_id, '') !~ '^[0-9]+$'
+		  AND NOT EXISTS (
+		      SELECT 1 FROM media_item_provider_ids tmdb
+		      WHERE tmdb.content_id = mi.content_id AND tmdb.provider = 'tmdb'
+		        AND tmdb.provider_id ~ '^[0-9]+$'
+		  )
+		  AND (COALESCE(NULLIF(mi.imdb_id, ''), imdb.provider_id, '') <> ''
+		       OR COALESCE(NULLIF(mi.tvdb_id, ''), tvdb.provider_id, '') <> '')
+		ORDER BY
+		    CASE lower(trim(mi.status))
+		        WHEN 'matched' THEN 0
+		        WHEN 'pending' THEN 1
+		        WHEN 'unmatched' THEN 2
+		        ELSE 3
+		    END,
+		    mi.updated_at DESC,
+		    mi.content_id ASC
+		LIMIT $2`, itemType, limit)
+	if err != nil {
+		return nil, fmt.Errorf("listing titles without a TMDB ID: %w", err)
+	}
+	defer rows.Close()
+	var out []TitleWithoutTMDBID
+	for rows.Next() {
+		var title TitleWithoutTMDBID
+		if err := rows.Scan(&title.ContentID, &title.IMDbID, &title.TVDBID); err != nil {
+			return nil, fmt.Errorf("scanning title without a TMDB ID: %w", err)
+		}
+		out = append(out, title)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("iterating titles without a TMDB ID: %w", err)
+	}
+	return out, nil
+}
+
 // GetByTitleYearType finds a media item by exact title, year, and type match.
 // Used for dedup when external IDs are not available.
 // Returns ErrItemNotFound if no match.
@@ -1148,6 +1337,9 @@ func (r *ItemRepository) Delete(ctx context.Context, contentID string) ([]string
 		}
 	}
 	imgRows.Close()
+	if err := imgRows.Err(); err != nil {
+		return nil, fmt.Errorf("collecting image paths before delete: %w", err)
+	}
 
 	tag, err := tx.Exec(ctx, "DELETE FROM media_items WHERE content_id = $1", contentID)
 	if err != nil {
@@ -1327,10 +1519,10 @@ func (r *ItemRepository) searchWithFuzzyFallback(
 	var fuzzyBlock []*models.MediaItem
 	fuzzyTruncated := false
 	if fuzzyLimit > 0 {
-		fuzzySQL, _, fuzzyArgs := r.buildFuzzySearchFromParsed(parsed, itemTypes, fuzzyLimit+1, 0, filter, false, contentIDsFromMediaItems(ftsBlock), minSimilarity)
+		fuzzySQL, _, fuzzyArgs := r.buildFuzzySearchFromParsed(parsed, itemTypes, fuzzyCandidatePool+1, 0, filter, false, contentIDsFromMediaItems(ftsBlock), minSimilarity)
 		if fuzzySQL != "" {
 			var err error
-			fuzzyBlock, fuzzyTruncated, err = r.execFuzzyBlock(ctx, searchTextFromParsed(parsed), fuzzySQL, fuzzyArgs, fuzzyLimit)
+			fuzzyBlock, fuzzyTruncated, err = r.execFuzzyBlock(ctx, searchTextFromParsed(parsed), fuzzySQL, fuzzyArgs, fuzzyLimit, len(ftsBlock) > 0)
 			if err != nil {
 				return nil, 0, false, includeTotal, err
 			}
@@ -1394,10 +1586,11 @@ func searchBlockHasExactTitle(items []*models.MediaItem, normalizedTitle string)
 
 // execFuzzyBlock runs the fuzzy data query inside a transaction that pins
 // pg_trgm.strict_word_similarity_threshold, so the <<% operator's selectivity
-// cannot drift with cluster configuration (its 0.6 server default would reject
-// ordinary typos outright). The query was built with LIMIT fuzzyLimit+1; the
-// extra row only signals truncation and is trimmed from the returned block.
-func (r *ItemRepository) execFuzzyBlock(ctx context.Context, searchText, dataSQL string, args []any, fuzzyLimit int) ([]*models.MediaItem, bool, error) {
+// cannot drift with cluster configuration (its 0.5 server default would reject
+// ordinary typos outright). The query was built with LIMIT fuzzyCandidatePool+1;
+// the extra row only signals truncation. The admitted candidates are trimmed to
+// fuzzyLimit. exactHits reports whether the FTS block found any results.
+func (r *ItemRepository) execFuzzyBlock(ctx context.Context, searchText, dataSQL string, args []any, fuzzyLimit int, exactHits bool) ([]*models.MediaItem, bool, error) {
 	tx, err := r.pool.Begin(ctx)
 	if err != nil {
 		return nil, false, fmt.Errorf("beginning fuzzy search tx: %w", err)
@@ -1411,29 +1604,37 @@ func (r *ItemRepository) execFuzzyBlock(ctx context.Context, searchText, dataSQL
 	if _, err := tx.Exec(ctx, fmt.Sprintf("SET LOCAL pg_trgm.strict_word_similarity_threshold = %g", trgmWordSimilarityThreshold)); err != nil {
 		return nil, false, fmt.Errorf("pinning trigram word-similarity threshold: %w", err)
 	}
-	block, _, truncated, _, err := r.execSearchBlock(ctx, tx, dataSQL, "", args, fuzzyLimit, 0, false)
+	block, _, truncated, _, err := r.execSearchBlock(ctx, tx, dataSQL, "", args, fuzzyCandidatePool, 0, false)
 	if err != nil {
 		return nil, false, err
 	}
-	if len(block) > 1 {
-		aliases, err := loadFuzzyRerankAliases(ctx, tx, searchText, block)
-		if err != nil {
-			return nil, false, err
-		}
-		if err := rerankFuzzyItems(ctx, searchText, block, aliases); err != nil {
-			return nil, false, err
-		}
+	aliases, err := loadFuzzyRerankAliases(ctx, tx, searchText, block)
+	if err != nil {
+		return nil, false, err
 	}
 	if err := tx.Commit(ctx); err != nil {
 		return nil, false, fmt.Errorf("committing fuzzy search tx: %w", err)
 	}
+	block, err = rerankFuzzyItems(ctx, searchText, block, aliases, exactHits)
+	if err != nil {
+		return nil, false, err
+	}
+	if len(block) > fuzzyLimit {
+		block, truncated = block[:fuzzyLimit], true
+	}
 	return block, truncated, nil
 }
 
 // loadFuzzyRerankAliases reads only aliases that passed the same indexed
 // strict-word predicate as the fuzzy candidate query. ROW_NUMBER applies the
 // cap per content ID; an item with pathological alias history cannot inflate
-// the in-process relevance workload.
+// the in-process relevance workload. Each item gets its most similar aliases,
+// which usually score best, and the aliases covering the most query words,
+// because admitFuzzyRanks drops an item whose loaded aliases miss a word.
+// Coverage sums each word's best strict word similarity, which neither word
+// order nor extra words lower. Similarity alone ranked "Harbor" and three
+// other short aliases above "Tales from the Lantern Keeper's Distant Northern
+// Harbor" for "lantrn harbor".
 func loadFuzzyRerankAliases(ctx context.Context, q searchQuerier, searchText string, items []*models.MediaItem) (map[string][]string, error) {
 	contentIDs := contentIDsFromMediaItems(items)
 	if len(contentIDs) == 0 {
@@ -1447,17 +1648,25 @@ func loadFuzzyRerankAliases(ctx context.Context, q searchQuerier, searchText str
 				ROW_NUMBER() OVER (
 					PARTITION BY mia.content_id
 					ORDER BY
-						0.65 * similarity(public.normalize_search_text($2), mia.normalized_title)
-							+ 0.35 * strict_word_similarity(public.normalize_search_text($2), mia.normalized_title) DESC,
+						0.65 * similarity($2, mia.normalized_title)
+							+ 0.35 * strict_word_similarity($2, mia.normalized_title) DESC,
 						mia.normalized_title ASC
-				) AS alias_rank
+				) AS similarity_rank,
+				ROW_NUMBER() OVER (
+					PARTITION BY mia.content_id
+					ORDER BY coverage.score DESC, mia.normalized_title ASC
+				) AS coverage_rank
 			FROM media_item_aliases mia
+			CROSS JOIN LATERAL (
+				SELECT sum(strict_word_similarity(word, mia.normalized_title)) AS score
+				FROM unnest(string_to_array($2, ' ')) AS word
+			) coverage
 			WHERE mia.content_id = ANY($1)
-			  AND public.normalize_search_text($2) <<% mia.normalized_title
+			  AND $2 <<% mia.normalized_title
 		)
 		SELECT content_id, normalized_title
 		FROM matched
-		WHERE alias_rank <= $3`, contentIDs, searchText, fuzzyRerankMaxAliasesPerItem)
+		WHERE similarity_rank <= $3 OR coverage_rank <= $3`, contentIDs, fuzzyCandidateText(searchText), fuzzyRerankAliasesPerOrder)
 	if err != nil {
 		return nil, fmt.Errorf("loading bounded fuzzy aliases: %w", err)
 	}
@@ -1481,8 +1690,16 @@ type fuzzyTitleScore struct {
 	exact         bool
 	contiguous    bool
 	matchedTokens int
-	editDistance  int
-	extraTokens   int
+	// missingWords counts required query words (see fuzzyRequiredWords) the
+	// title does not match within their typo allowance.
+	missingWords int
+	editDistance int
+	extraTokens  int
+}
+
+// unmatchedFuzzyTitleScore ranks below every scored title variant.
+func unmatchedFuzzyTitleScore() fuzzyTitleScore {
+	return fuzzyTitleScore{missingWords: math.MaxInt, editDistance: math.MaxInt, extraTokens: math.MaxInt}
 }
 
 type fuzzyRankedItem struct {
@@ -1491,61 +1708,168 @@ type fuzzyRankedItem struct {
 	order int
 }
 
-// rerankFuzzyItems is a deliberately tiny relevance layer over PostgreSQL's
+// rerankFuzzyItems orders typo candidates best first and returns only the ones
+// admitFuzzyRanks keeps. exactHits reports whether the exact FTS search
+// already found results for the query.
+func rerankFuzzyItems(ctx context.Context, searchText string, items []*models.MediaItem, aliases map[string][]string, exactHits bool) ([]*models.MediaItem, error) {
+	ranks, required, err := rankFuzzyItems(ctx, searchText, items, aliases)
+	if err != nil || required == 0 {
+		return items, err
+	}
+	ranks = admitFuzzyRanks(ranks, required, exactHits)
+	admitted := make([]*models.MediaItem, len(ranks))
+	for i, rank := range ranks {
+		admitted[i] = rank.item
+	}
+	return admitted, nil
+}
+
+// rankFuzzyItems is a deliberately tiny relevance layer over PostgreSQL's
 // indexed candidate set, not another search index. Its edit limits mirror the
-// auto-fuzziness policy used by Bleve (Apache-2.0): 0 edits for <=2 characters,
-// 1 for 3-5, and at most 2 for longer tokens. PostgreSQL still decides which
-// rows are candidates; this only prevents one strongly matching word from
-// outranking a phrase whose every token is a plausible typo correction.
-func rerankFuzzyItems(ctx context.Context, searchText string, items []*models.MediaItem, aliases map[string][]string) error {
+// auto-fuzziness policy used by Bleve (Apache-2.0) and Elasticsearch's
+// fuzziness AUTO: 0 edits for <=2 characters, 1 for 3-5, and at most 2 for
+// longer tokens. PostgreSQL still decides which rows are candidates; this ranks
+// a phrase whose every token is a plausible typo correction above titles that
+// share one strongly matching word. required counts the query's required
+// words; it is 0 when the query has no words or too many to score, and ranks
+// then keep PostgreSQL's order.
+func rankFuzzyItems(ctx context.Context, searchText string, items []*models.MediaItem, aliases map[string][]string) (ranks []fuzzyRankedItem, required int, err error) {
 	query := normalizeTitleForComparison(searchText)
 	queryTokens, ok := boundedFuzzyTokens(query, fuzzyRerankMaxQueryTokens)
-	if !ok || len(queryTokens) == 0 || len(items) < 2 {
-		return nil
+	scored := ok && len(queryTokens) > 0
+	if scored {
+		for _, word := range fuzzyRequiredWords(queryTokens) {
+			if word {
+				required++
+			}
+		}
 	}
 
-	ranked := make([]fuzzyRankedItem, 0, len(items))
+	ranks = make([]fuzzyRankedItem, 0, len(items))
 	for i, item := range items {
 		if err := ctx.Err(); err != nil {
-			return err
-		}
-		var variants []string
-		if item != nil {
-			variants = append(variants, aliases[item.ContentID]...)
+			return nil, 0, err
 		}
-		if item != nil && len(item.Title) <= fuzzyRerankMaxTitleBytes {
-			variants = append(variants, item.Title)
-		}
-		score := fuzzyTitleScore{editDistance: int(^uint(0) >> 1), extraTokens: int(^uint(0) >> 1)}
-		for _, variant := range variants {
-			candidate := scoreFuzzyTitleVariant(query, queryTokens, variant)
-			if fuzzyTitleScoreBetter(candidate, score) {
-				score = candidate
+		score := fuzzyTitleScore{}
+		if scored {
+			var variants []string
+			if item != nil {
+				variants = append(variants, aliases[item.ContentID]...)
+			}
+			if item != nil && len(item.Title) <= fuzzyRerankMaxTitleBytes {
+				variants = append(variants, item.Title)
+			}
+			score = unmatchedFuzzyTitleScore()
+			for _, variant := range variants {
+				candidate := scoreFuzzyTitleVariant(query, queryTokens, variant)
+				if fuzzyTitleScoreBetter(candidate, score) {
+					score = candidate
+				}
 			}
 		}
-		ranked = append(ranked, fuzzyRankedItem{item: item, score: score, order: i})
+		ranks = append(ranks, fuzzyRankedItem{item: item, score: score, order: i})
 	}
 
-	sort.SliceStable(ranked, func(i, j int) bool {
-		if fuzzyTitleScoreBetter(ranked[i].score, ranked[j].score) {
-			return true
+	slices.SortStableFunc(ranks, func(a, b fuzzyRankedItem) int {
+		if fuzzyTitleScoreBetter(a.score, b.score) {
+			return -1
 		}
-		if fuzzyTitleScoreBetter(ranked[j].score, ranked[i].score) {
-			return false
+		if fuzzyTitleScoreBetter(b.score, a.score) {
+			return 1
 		}
-		return ranked[i].order < ranked[j].order
+		return 0
 	})
-	for i := range ranked {
-		items[i] = ranked[i].item
+	return ranks, required, nil
+}
+
+// admitFuzzyRanks keeps the typo candidates a search engine would return:
+// titles that match every required query word within its typo allowance, as
+// Elasticsearch's AND operator and Meilisearch's "all" strategy require. Only
+// when no candidate matches every word and the exact search found nothing does
+// it relax to the candidates missing the fewest words, as Typesense's
+// drop_tokens_threshold does. Ranking alone left every partial match in the
+// results: "the god place" listed The Good Place and then each "The ... Place".
+// ranks and required come from rankFuzzyItems.
+func admitFuzzyRanks(ranks []fuzzyRankedItem, required int, exactHits bool) []fuzzyRankedItem {
+	if len(ranks) == 0 {
+		return ranks
+	}
+	fewest := ranks[0].score.missingWords
+	if fewest > 0 && (exactHits || fewest >= required) {
+		return ranks[:0]
+	}
+	end := 0
+	for end < len(ranks) && ranks[end].score.missingWords == fewest {
+		end++
+	}
+	return ranks[:end]
+}
+
+// fuzzyStopwords take no typo and need not appear in a typo match. "the" is
+// one edit from "she" and "tho", and a title may drop a leading article
+// ("Quiet Place" for "a quiet place"). They still count as matched words, so a
+// title containing them ranks higher. The list is English and short on purpose:
+// every entry is a word a title can omit without changing which work it names.
+var fuzzyStopwords = func() map[string]bool {
+	words := map[string]bool{}
+	for _, word := range strings.Fields("a an the of in on at to for by with from") {
+		words[word] = true
+	}
+	return words
+}()
+
+// fuzzyCandidateText is the text the trigram candidate search matches: the
+// normalized query without stopwords. Stopwords need not appear in a typo
+// match, and their trigrams occur in much of a catalog: in 191,307 titles,
+// "the godfathr" admitted 51,530 candidates and "godfathr" 456, which kept the
+// query near its deadline. When no other word has fuzzyMinTokenLen characters
+// ("from up"), the remaining words form too few trigrams to be selective, so
+// the whole query is matched as before.
+func fuzzyCandidateText(searchText string) string {
+	words := strings.Fields(normalizeTitleForComparison(searchText))
+	content := make([]string, 0, len(words))
+	selective := false
+	for _, word := range words {
+		if !fuzzyStopwords[word] {
+			content = append(content, word)
+			selective = selective || utf8.RuneCountInString(word) >= fuzzyMinTokenLen
+		}
+	}
+	if !selective {
+		return strings.Join(words, " ")
+	}
+	return strings.Join(content, " ")
+}
+
+func fuzzyTokenMaxEdits(token []rune) int {
+	if fuzzyStopwords[string(token)] {
+		return 0
 	}
-	return nil
+	return fuzzyAutoMaxEdits(len(token))
+}
+
+// fuzzyRequiredWords marks the query words a typo match must contain: every
+// word except stopwords, or every word when the query has only stopwords.
+func fuzzyRequiredWords(queryTokens [][]rune) []bool {
+	required := make([]bool, len(queryTokens))
+	content := false
+	for i, token := range queryTokens {
+		required[i] = !fuzzyStopwords[string(token)]
+		content = content || required[i]
+	}
+	if !content {
+		for i := range required {
+			required[i] = true
+		}
+	}
+	return required
 }
 
 func scoreFuzzyTitleVariant(query string, queryTokens [][]rune, rawTitle string) fuzzyTitleScore {
 	title := normalizeTitleForComparison(rawTitle)
 	titleTokens, ok := boundedFuzzyTokens(title, fuzzyRerankMaxTitleTokens)
 	if !ok || len(titleTokens) == 0 {
-		return fuzzyTitleScore{editDistance: int(^uint(0) >> 1), extraTokens: int(^uint(0) >> 1)}
+		return unmatchedFuzzyTitleScore()
 	}
 	// Compare without spaces so "Live Stream From Hell" is an exact match for
 	// "Livestream from Hell" and "spiderman" for "Spider-Man".
@@ -1557,14 +1881,17 @@ func scoreFuzzyTitleVariant(query string, queryTokens [][]rune, rawTitle string)
 	}
 	// A query word may also match two adjacent title words joined, and two
 	// adjacent query words joined may match one title word.
-	titleTerms := slices.Concat(titleTokens, joinAdjacentFuzzyTokens(titleTokens))
+	joinedTitleTokens := joinAdjacentFuzzyTokens(titleTokens)
+	titleTerms := slices.Concat(titleTokens, joinedTitleTokens)
 	matches := make([]fuzzyTokenMatch, len(queryTokens))
 	for i, token := range queryTokens {
-		matches[i] = bestFuzzyTokenMatch(token, titleTerms)
+		matches[i] = bestFuzzyTokenMatch(token, titleTokens, joinedTitleTokens)
 	}
+	matched := make([]bool, len(queryTokens))
 	for i := 0; i < len(queryTokens); i++ {
 		if i+1 < len(queryTokens) && (!matches[i].ok || !matches[i+1].ok) && fuzzyTokensJoinable(queryTokens[i], queryTokens[i+1]) {
 			if pair := bestFuzzyPairMatch(queryTokens[i], queryTokens[i+1], titleTerms); pair.ok {
+				matched[i], matched[i+1] = true, true
 				score.matchedTokens += 2
 				score.editDistance += pair.distance
 				i++
@@ -1572,27 +1899,62 @@ func scoreFuzzyTitleVariant(query string, queryTokens [][]rune, rawTitle string)
 			}
 		}
 		if matches[i].ok {
+			matched[i] = true
 			score.matchedTokens++
 		}
 		score.editDistance += matches[i].distance
 	}
+	if !score.exact && !spellsConsecutiveFuzzyTokens(titleTokens, compactQuery) {
+		for i, required := range fuzzyRequiredWords(queryTokens) {
+			if required && !matched[i] {
+				score.missingWords++
+			}
+		}
+	}
 	return score
 }
 
-type fuzzyTokenMatch struct {
-	distance int
-	ok       bool // distance is within the token's typo allowance
+// spellsConsecutiveFuzzyTokens reports whether compactQuery spells a run of
+// whole title words typed without spaces: "lordoftherings" for "The Lord of
+// the Rings". Word matching joins at most two words, so such a query would
+// otherwise miss every word of the title it names. The run must start and end
+// on word boundaries, so "heat" does not match inside "Theater".
+func spellsConsecutiveFuzzyTokens(titleTokens [][]rune, compactQuery string) bool {
+	for start := range titleTokens {
+		for end := start + 1; end <= len(titleTokens); end++ {
+			run := compactFuzzyTokens(titleTokens[start:end])
+			if run == compactQuery {
+				return true
+			}
+			if len(run) >= len(compactQuery) {
+				break
+			}
+		}
+	}
+	return false
 }
 
-func bestFuzzyTokenMatch(token []rune, terms [][]rune) fuzzyTokenMatch {
-	maxEdits := fuzzyAutoMaxEdits(len(token))
-	best := maxEdits + 1
-	for _, term := range terms {
-		if distance := boundedLevenshteinRunes(token, term, maxEdits); distance < best {
-			best = distance
+type fuzzyTokenMatch struct {
+	distance int  // ranking cost; maxEdits+1 when the word does not match
+	ok       bool // the word matches within its typo allowance
+}
+
+// bestFuzzyTokenMatch matches a query word against single title words and
+// adjacent title words joined. A joined match costs one extra edit, so a title
+// spelling the word as one ranks first: for "the ofice", "The Office" before
+// "The Clink of Ice".
+func bestFuzzyTokenMatch(token []rune, words, joined [][]rune) fuzzyTokenMatch {
+	maxEdits := fuzzyTokenMaxEdits(token)
+	best := fuzzyTokenMatch{distance: maxEdits + 1}
+	for penalty, terms := range [][][]rune{words, joined} {
+		for _, term := range terms {
+			distance := boundedLevenshteinRunes(token, term, maxEdits)
+			if distance <= maxEdits && (!best.ok || distance+penalty < best.distance) {
+				best = fuzzyTokenMatch{distance: distance + penalty, ok: true}
+			}
 		}
 	}
-	return fuzzyTokenMatch{distance: best, ok: best <= maxEdits}
+	return best
 }
 
 // bestFuzzyPairMatch matches two adjacent query words against one term split
@@ -1600,7 +1962,7 @@ func bestFuzzyTokenMatch(token []rune, terms [][]rune) fuzzyTokenMatch {
 // keeps a short word from being dropped: "ed wood" does not match "Wood", nor
 // "a spider" match "Spider".
 func bestFuzzyPairMatch(first, second []rune, terms [][]rune) fuzzyTokenMatch {
-	firstEdits, secondEdits := fuzzyAutoMaxEdits(len(first)), fuzzyAutoMaxEdits(len(second))
+	firstEdits, secondEdits := fuzzyTokenMaxEdits(first), fuzzyTokenMaxEdits(second)
 	best := firstEdits + secondEdits + 1
 	for _, term := range terms {
 		if absInt(len(term)-len(first)-len(second)) > firstEdits+secondEdits {
@@ -1655,6 +2017,9 @@ func fuzzyTitleScoreBetter(a, b fuzzyTitleScore) bool {
 	if a.exact != b.exact {
 		return a.exact
 	}
+	if a.missingWords != b.missingWords {
+		return a.missingWords < b.missingWords
+	}
 	if a.matchedTokens != b.matchedTokens {
 		return a.matchedTokens > b.matchedTokens
 	}
@@ -1954,8 +2319,9 @@ func appendSearchScopeFilters(itemTypes []string, filter AccessFilter, condition
 // block so a title matching both is not shown twice. minSimilarity > 0 adds an
 // explicit similarity floor above the base threshold — used when the FTS block
 // had real hits so augmentation only admits near-certain corrections. Argument
-// order: $1 searchText, then the similarity floor (if any), then the shared
-// scope placeholders, then the exclusion array, then limit/offset.
+// order: $1 searchText, $2 its fuzzyCandidateText, then the similarity floor
+// (if any), then the shared scope placeholders, then the exclusion array, then
+// limit/offset.
 func (r *ItemRepository) buildFuzzySearchSQL(query string, itemTypes []string, limit, offset int, filter AccessFilter, includeTotal bool, excludeContentIDs []string, minSimilarity float64) (dataSQL, countSQL string, args []any) {
 	return r.buildFuzzySearchFromParsed(parseSearchQuery(query), itemTypes, limit, offset, filter, includeTotal, excludeContentIDs, minSimilarity)
 }
@@ -1971,8 +2337,10 @@ func (r *ItemRepository) buildFuzzySearchCursorSQL(parsed parsedSearchQuery, ite
 		return "", "", nil
 	}
 
-	args = []any{searchText}
-	argIdx := 2
+	// Candidates and their trigram rank come from the query's content words
+	// ($2); the whole-title floor and tie-break compare the full query ($1).
+	args = []any{searchText, fuzzyCandidateText(searchText)}
+	argIdx := 3
 	// Strict word similarity (<<%) rather than full-string similarity (%): a
 	// typo of one word must still reach long titles ("avegners" → "Avengers:
 	// Endgame"), where full-string similarity is diluted by every extra trigram
@@ -2032,21 +2400,21 @@ func (r *ItemRepository) buildFuzzySearchCursorSQL(parsed parsedSearchQuery, ite
 			SELECT
 				mia.content_id,
 				MAX(
-					0.65 * similarity(public.normalize_search_text($1), mia.normalized_title)
-						+ 0.35 * strict_word_similarity(public.normalize_search_text($1), mia.normalized_title)
+					0.65 * similarity($2, mia.normalized_title)
+						+ 0.35 * strict_word_similarity($2, mia.normalized_title)
 				) AS fuzzy_rank,
 				MAX(similarity(public.normalize_search_text($1), mia.normalized_title)) AS fuzzy_full_rank
 			FROM media_item_aliases mia
-			WHERE public.normalize_search_text($1) <<%% mia.normalized_title
+			WHERE $2 <<%% mia.normalized_title
 			GROUP BY mia.content_id
 		), candidates AS (
 			SELECT
 				mi.content_id,
-				0.65 * similarity(public.normalize_search_text($1), mi.title_normalized)
-					+ 0.35 * strict_word_similarity(public.normalize_search_text($1), mi.title_normalized) AS fuzzy_rank,
+				0.65 * similarity($2, mi.title_normalized)
+					+ 0.35 * strict_word_similarity($2, mi.title_normalized) AS fuzzy_rank,
 				similarity(public.normalize_search_text($1), mi.title_normalized) AS fuzzy_full_rank
 			FROM media_items mi
-			WHERE public.normalize_search_text($1) <<%% mi.title_normalized
+			WHERE $2 <<%% mi.title_normalized
 			UNION ALL
 			SELECT content_id, fuzzy_rank, fuzzy_full_rank
 			FROM alias_candidates
@@ -2085,7 +2453,9 @@ func (r *ItemRepository) buildFuzzySearchCursorSQL(parsed parsedSearchQuery, ite
 // ListUnmatchedByFolderAndPathPrefix returns content IDs for unmatched-style
 // items that are linked to at least one present file within the given folder
 // subtree. This intentionally includes ambiguous items so a library scan can
-// revisit legacy scanner ambiguities after inference heuristics improve.
+// revisit legacy scanner ambiguities after inference heuristics improve. It
+// leaves out items an admin ignored: the matcher would skip them anyway, and
+// the scan would report each one as still unmatched.
 func (r *ItemRepository) buildListUnmatchedByFolderAndPathPrefixSQL(folderID int, pathPrefix string, limit int) (string, []any) {
 	query := `
 		SELECT mi.content_id
@@ -2100,6 +2470,7 @@ func (r *ItemRepository) buildListUnmatchedByFolderAndPathPrefixSQL(folderID int
 		WHERE mil.media_folder_id = $1
 		  AND folders.enabled = true
 		  AND mi.status IN ('unmatched', 'pending', 'ambiguous')
+		  AND mi.match_ignored_at IS NULL
 		  -- Manga chapters stay status='pending' by design: provider metadata
 		  -- lives on the type='manga' series item, so chapters are never
 		  -- matchable and must not feed the matcher's retry loop (mirrors the
@@ -2465,6 +2836,10 @@ func (r *ItemRepository) UpdateMetadataTx(ctx context.Context, tx pgx.Tx, conten
 	addString("air_time", upd.AirTime)
 	addNullableString("air_timezone", upd.AirTimezone)
 	addString("status", upd.Status)
+	if upd.Status != nil && strings.EqualFold(strings.TrimSpace(*upd.Status), "matched") {
+		// An admin's ignore only means something while the item is unmatched.
+		setClauses = append(setClauses, "match_ignored_at = NULL")
+	}
 	addString("show_status", upd.ShowStatus)
 	addString("imdb_id", upd.ImdbID)
 	addString("tmdb_id", upd.TmdbID)
@@ -2884,3 +3259,28 @@ func (r *ItemRepository) LookupExternalIDs(
 func pathPrefixLike(pathPrefix string) string {
 	return pathscope.PrefixLike(pathPrefix)
 }
+
+// LibraryIDsForItem returns the libraries a media item or episode belongs to,
+// in ID order. It reads the same memberships as GetItemsInLibrary, so every
+// library it lists is one where a library-scoped detail page of contentID
+// resolves.
+func (r *ItemRepository) LibraryIDsForItem(ctx context.Context, contentID string) ([]int, error) {
+	rows, err := r.pool.Query(ctx, `
+		SELECT media_folder_id FROM media_item_libraries WHERE content_id = $1
+		UNION
+		SELECT media_folder_id FROM episode_libraries WHERE episode_id = $1
+		ORDER BY media_folder_id`, contentID)
+	if err != nil {
+		return nil, fmt.Errorf("listing item libraries: %w", err)
+	}
+	defer rows.Close()
+	var ids []int
+	for rows.Next() {
+		var id int
+		if err := rows.Scan(&id); err != nil {
+			return nil, fmt.Errorf("scanning item library: %w", err)
+		}
+		ids = append(ids, id)
+	}
+	return ids, rows.Err()
+}
diff --git a/internal/catalog/item_repo_external_ids_db_test.go b/internal/catalog/item_repo_external_ids_db_test.go
new file mode 100644
index 0000000000..50fe97b6f0
--- /dev/null
+++ b/internal/catalog/item_repo_external_ids_db_test.go
@@ -0,0 +1,126 @@
+package catalog
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"testing"
+	"time"
+)
+
+// A title can be known to a provider only through its provider ID rows; the
+// batched lookup and the list of titles without a TMDB ID both read them.
+func TestExternalIDLookupsReadProviderIDRowsDB(t *testing.T) {
+	pool := collectionSortTestPool(t)
+	ctx := t.Context()
+	suffix := time.Now().UnixNano()
+
+	direct := fmt.Sprintf("ext-direct-%d", suffix)         // TMDB ID in its column
+	providerOnly := fmt.Sprintf("ext-provider-%d", suffix) // TMDB ID only in a provider row
+	orphan := fmt.Sprintf("ext-orphan-%d", suffix)         // IMDb ID only
+	slug := fmt.Sprintf("ext-slug-%d", suffix)             // TMDB ID in TMDB's id-slug URL form
+	noIDs := fmt.Sprintf("ext-none-%d", suffix)            // no external ID at all
+	directTMDB := fmt.Sprintf("97%d", suffix%10000000)
+	providerTMDB := fmt.Sprintf("98%d", suffix%10000000)
+	orphanIMDb := fmt.Sprintf("tt99%d", suffix%10000000)
+	slugIMDb := fmt.Sprintf("tt96%d", suffix%10000000)
+
+	for _, seed := range []struct{ id, tmdb, imdb string }{
+		{direct, directTMDB, ""},
+		{providerOnly, "", ""},
+		{orphan, "", orphanIMDb},
+		{slug, fmt.Sprintf("94%d-some-title", suffix%10000000), slugIMDb},
+		{noIDs, "", ""},
+	} {
+		if _, err := pool.Exec(ctx, `INSERT INTO media_items (content_id, type, title, sort_title, tmdb_id, imdb_id, genres) VALUES ($1,'movie',$1,$1,$2,$3,'{}'::text[])`, seed.id, seed.tmdb, seed.imdb); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if _, err := pool.Exec(ctx, `INSERT INTO media_item_provider_ids (content_id, provider, provider_id, item_type) VALUES ($1,'tmdb',$2,'movie')`, providerOnly, providerTMDB); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM media_items WHERE content_id = ANY($1)`, []string{direct, providerOnly, orphan, slug, noIDs})
+	})
+
+	repo := NewItemRepository(pool)
+	lookup, err := repo.GetByExternalIDs(ctx, ExternalIDBatch{TMDBIDs: []string{directTMDB, providerTMDB}}, "movie")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if lookup.ByTMDB[directTMDB] != direct || lookup.ByTMDB[providerTMDB] != providerOnly {
+		t.Fatalf("ByTMDB = %v, want %s→%s and %s→%s", lookup.ByTMDB, directTMDB, direct, providerTMDB, providerOnly)
+	}
+
+	// A long, repeating batch is looked up in chunks; an ID past the first
+	// chunk still resolves, and IDs of other providers resolve alongside.
+	long := make([]string, 0, 2*externalIDLookupChunk+3)
+	for i := range 2 * externalIDLookupChunk {
+		long = append(long, fmt.Sprintf("missing-%d-%d", suffix, i))
+	}
+	long = append(long, providerTMDB, directTMDB, providerTMDB)
+	lookup, err = repo.GetByExternalIDs(ctx, ExternalIDBatch{TMDBIDs: long, IMDbIDs: []string{orphanIMDb, orphanIMDb}}, "movie")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if lookup.ByTMDB[directTMDB] != direct || lookup.ByTMDB[providerTMDB] != providerOnly || lookup.ByIMDb[orphanIMDb] != orphan {
+		t.Fatalf("chunked lookup = %v / %v, want %s→%s, %s→%s and %s→%s", lookup.ByTMDB, lookup.ByIMDb, directTMDB, direct, providerTMDB, providerOnly, orphanIMDb, orphan)
+	}
+
+	titles, err := repo.TitlesWithoutTMDBID(ctx, "movie", 1_000_000)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var mine []string
+	for _, title := range titles {
+		switch title.ContentID {
+		case direct, providerOnly, noIDs, slug:
+			mine = append(mine, title.ContentID)
+		case orphan:
+			if title.IMDbID != orphanIMDb {
+				t.Fatalf("orphan listed with IMDb ID %q, want %q", title.IMDbID, orphanIMDb)
+			}
+			mine = append(mine, title.ContentID)
+		}
+	}
+	// A slug-form TMDB ID never equals an entry's bare ID, so that title
+	// still needs its IMDb ID to match.
+	slices.Sort(mine)
+	if want := []string{orphan, slug}; !slices.Equal(mine, want) {
+		t.Fatalf("titles without a TMDB ID among the seeds = %v, want %v", mine, want)
+	}
+}
+
+// Titles without a TMDB ID arrive best first, as GetByExternalID would pick
+// them, so a TMDB ID that two of them resolve to keeps the better one.
+func TestTitlesWithoutTMDBIDPreferMatchedTitlesDB(t *testing.T) {
+	pool := collectionSortTestPool(t)
+	ctx := t.Context()
+	suffix := time.Now().UnixNano()
+
+	pending := fmt.Sprintf("a-ext-pending-%d", suffix)
+	matched := fmt.Sprintf("z-ext-matched-%d", suffix)
+	imdb := fmt.Sprintf("tt95%d", suffix%10000000)
+	for _, seed := range []struct{ id, status string }{{pending, "pending"}, {matched, "matched"}} {
+		if _, err := pool.Exec(ctx, `INSERT INTO media_items (content_id, type, title, sort_title, imdb_id, status, genres) VALUES ($1,'movie',$1,$1,$2,$3,'{}'::text[])`, seed.id, imdb, seed.status); err != nil {
+			t.Fatal(err)
+		}
+	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM media_items WHERE content_id = ANY($1)`, []string{pending, matched})
+	})
+
+	titles, err := NewItemRepository(pool).TitlesWithoutTMDBID(ctx, "movie", 1_000_000)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var order []string
+	for _, title := range titles {
+		if title.ContentID == pending || title.ContentID == matched {
+			order = append(order, title.ContentID)
+		}
+	}
+	if want := []string{matched, pending}; !slices.Equal(order, want) {
+		t.Fatalf("order = %v, want %v", order, want)
+	}
+}
diff --git a/internal/catalog/item_repo_test.go b/internal/catalog/item_repo_test.go
index d63607f5a2..e1679202f6 100644
--- a/internal/catalog/item_repo_test.go
+++ b/internal/catalog/item_repo_test.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"slices"
 	"sort"
 	"strings"
 	"testing"
@@ -527,11 +528,11 @@ func TestItemRepo_BuildFuzzySearchSQL(t *testing.T) {
 
 	// <<%, not %: full-string similarity is diluted by long titles ("avegners"
 	// must reach "Avengers: Endgame"); the same gin_trgm_ops index serves both.
-	if !strings.Contains(dataSQL, "public.normalize_search_text($1) <<% mi.title_normalized") {
+	if !strings.Contains(dataSQL, "$2 <<% mi.title_normalized") {
 		t.Fatalf("expected strict-word-similarity arm against title_normalized; got:\n%s", dataSQL)
 	}
-	if !strings.Contains(dataSQL, "0.65 * similarity(public.normalize_search_text($1), mi.title_normalized)") ||
-		!strings.Contains(dataSQL, "+ 0.35 * strict_word_similarity(public.normalize_search_text($1), mi.title_normalized)") ||
+	if !strings.Contains(dataSQL, "0.65 * similarity($2, mi.title_normalized)") ||
+		!strings.Contains(dataSQL, "+ 0.35 * strict_word_similarity($2, mi.title_normalized)") ||
 		!strings.Contains(dataSQL, "AS fuzzy_rank") {
 		t.Fatalf("expected whole-title-weighted fuzzy ranking on title_normalized; got:\n%s", dataSQL)
 	}
@@ -566,12 +567,13 @@ func TestItemRepo_BuildFuzzySearchSQL(t *testing.T) {
 	if !strings.Contains(countSQL, "SELECT COUNT(*) FROM scored") {
 		t.Fatalf("expected count sibling over the scored CTE; got:\n%s", countSQL)
 	}
-	// Arg order: $1 searchText, $2 type, $3 exclusion array, $4 limit, $5 offset.
-	if len(args) != 5 {
-		t.Fatalf("expected 5 args, got %d: %#v", len(args), args)
+	// Arg order: $1 searchText, $2 candidate text, $3 type, $4 exclusion
+	// array, $5 limit, $6 offset.
+	if len(args) != 6 {
+		t.Fatalf("expected 6 args, got %d: %#v", len(args), args)
 	}
-	if args[0] != "avegners" {
-		t.Fatalf("expected $1=searchText; got %#v", args[0])
+	if args[0] != "avegners" || args[1] != "avegners" {
+		t.Fatalf("expected $1=searchText and $2=candidate text; got %#v", args[:2])
 	}
 	if args[len(args)-2] != 20 || args[len(args)-1] != 0 {
 		t.Fatalf("expected trailing limit/offset args; got %#v", args[len(args)-2:])
@@ -605,11 +607,11 @@ func TestItemRepo_BuildFuzzySearchSQL_SimilarityFloor(t *testing.T) {
 	// Whole-title similarity, not word similarity: the augment floor must not
 	// admit embedded prefix words ("coral" scores 0.5 word-similarity to
 	// "coraline").
-	if !strings.Contains(floorSQL, "cs.fuzzy_full_rank >= $2") {
-		t.Fatalf("expected explicit whole-title similarity floor predicate as $2; got:\n%s", floorSQL)
+	if !strings.Contains(floorSQL, "cs.fuzzy_full_rank >= $3") {
+		t.Fatalf("expected explicit whole-title similarity floor predicate as $3; got:\n%s", floorSQL)
 	}
-	if len(floorArgs) < 2 || floorArgs[1] != fuzzyAugmentSimilarityFloor {
-		t.Fatalf("expected $2 = fuzzyAugmentSimilarityFloor; got args %#v", floorArgs)
+	if len(floorArgs) < 3 || floorArgs[2] != fuzzyAugmentSimilarityFloor {
+		t.Fatalf("expected $3 = fuzzyAugmentSimilarityFloor; got args %#v", floorArgs)
 	}
 	// Trailing limit/offset must still close the arg list for the count sibling.
 	if floorArgs[len(floorArgs)-2] != 20 || floorArgs[len(floorArgs)-1] != 0 {
@@ -617,7 +619,7 @@ func TestItemRepo_BuildFuzzySearchSQL_SimilarityFloor(t *testing.T) {
 	}
 
 	baseSQL, _, baseArgs := repo.buildFuzzySearchSQL("avegners", []string{"movie"}, 20, 0, AccessFilter{}, true, nil, 0)
-	if strings.Contains(baseSQL, "cs.fuzzy_full_rank >= $2") {
+	if strings.Contains(baseSQL, "cs.fuzzy_full_rank >= $") {
 		t.Fatalf("zero floor must not add a similarity predicate; got:\n%s", baseSQL)
 	}
 	if len(baseArgs) != len(floorArgs)-1 {
@@ -883,22 +885,153 @@ func TestRerankFuzzyItemsUsesTokenEditCoverage(t *testing.T) {
 		{ContentID: "game", Title: "Game of Thrones"},
 		{ContentID: "last-watch", Title: "Game of Thrones: The Last Watch"},
 	}
-	if err := rerankFuzzyItems(context.Background(), "Gane of Throns", items, nil); err != nil { //nolint:misspell
+	got, err := rerankFuzzyItems(context.Background(), "Gane of Throns", items, nil, false)
+	if err != nil {
 		t.Fatalf("rerank: %v", err)
 	}
-	if items[0].ContentID != "game" {
-		t.Fatalf("first result = %q (%s), want Game of Thrones", items[0].Title, items[0].ContentID)
+	if ids := fuzzyItemIDs(got); !slices.Equal(ids, []string{"game", "last-watch"}) {
+		t.Fatalf("results = %v, want both Game of Thrones titles and no title missing a word", ids)
 	}
 
 	items = []*models.MediaItem{
 		{ContentID: "miss", Title: "Miss Potter"},
 		{ContentID: "harry", Title: "Harry Potter and the Order of the Phoenix"},
 	}
-	if err := rerankFuzzyItems(context.Background(), "Hary Poter", items, nil); err != nil { //nolint:misspell
+	got, err = rerankFuzzyItems(context.Background(), "Hary Poter", items, nil, false)
+	if err != nil {
 		t.Fatalf("rerank: %v", err)
 	}
-	if items[0].ContentID != "harry" {
-		t.Fatalf("first result = %q (%s), want Harry Potter title", items[0].Title, items[0].ContentID)
+	if ids := fuzzyItemIDs(got); !slices.Equal(ids, []string{"harry"}) {
+		t.Fatalf("results = %v, want only the Harry Potter title", ids)
+	}
+}
+
+func fuzzyItemIDs(items []*models.MediaItem) []string {
+	ids := make([]string, len(items))
+	for i, item := range items {
+		ids[i] = item.ContentID
+	}
+	return ids
+}
+
+func TestRerankFuzzyItemsRequiresEveryWord(t *testing.T) {
+	// The typo of "The Good Place" is the only title matching all three words.
+	// Each other title shares "the" and "place" and was listed after it.
+	items := []*models.MediaItem{
+		{ContentID: "hiding", Title: "The Hiding Place"},
+		{ContentID: "plant", Title: "The God Plant"},
+		{ContentID: "good", Title: "The Good Place"},
+		{ContentID: "palace", Title: "The Palace"},
+		{ContentID: "sun", Title: "A Place in the Sun"},
+	}
+	got, err := rerankFuzzyItems(context.Background(), "the god place", items, nil, false)
+	if err != nil {
+		t.Fatalf("rerank: %v", err)
+	}
+	if ids := fuzzyItemIDs(got); !slices.Equal(ids, []string{"good"}) {
+		t.Fatalf("results = %v, want only The Good Place", ids)
+	}
+
+	// With no title matching every word and no exact hit, the titles missing
+	// the fewest words remain.
+	got, err = rerankFuzzyItems(context.Background(), "the god place", items[:2], nil, false)
+	if err != nil {
+		t.Fatalf("rerank: %v", err)
+	}
+	if ids := fuzzyItemIDs(got); !slices.Equal(slices.Sorted(slices.Values(ids)), []string{"hiding", "plant"}) {
+		t.Fatalf("relaxed results = %v, want the two titles missing one word", ids)
+	}
+
+	// Exact search hits already answer the query; a partial typo match adds
+	// nothing.
+	got, err = rerankFuzzyItems(context.Background(), "the god place", items[:2], nil, true)
+	if err != nil {
+		t.Fatalf("rerank: %v", err)
+	}
+	if len(got) != 0 {
+		t.Fatalf("results beside exact hits = %v, want none", fuzzyItemIDs(got))
+	}
+
+	// A title matching only stopwords never qualifies.
+	got, err = rerankFuzzyItems(context.Background(), "the god place", []*models.MediaItem{{ContentID: "other", Title: "The Other"}}, nil, false)
+	if err != nil {
+		t.Fatalf("rerank: %v", err)
+	}
+	if len(got) != 0 {
+		t.Fatalf("stopword-only results = %v, want none", fuzzyItemIDs(got))
+	}
+}
+
+func TestRerankFuzzyItemsPrefersSingleWordMatches(t *testing.T) {
+	// "ofice" is exactly "of" + "ice" joined, but one edit from "office".
+	items := []*models.MediaItem{
+		{ContentID: "ice", Title: "The Clink of Ice"},
+		{ContentID: "office", Title: "The Office"},
+	}
+	got, err := rerankFuzzyItems(context.Background(), "the ofice", items, nil, false)
+	if err != nil {
+		t.Fatalf("rerank: %v", err)
+	}
+	if ids := fuzzyItemIDs(got); !slices.Equal(ids, []string{"office", "ice"}) {
+		t.Fatalf("results = %v, want The Office first", ids)
+	}
+}
+
+func TestScoreFuzzyTitleVariantRunTogetherWords(t *testing.T) {
+	for _, tc := range []struct {
+		query, title string
+		missing      int
+	}{
+		{"lordoftherings", "The Lord of the Rings: The Two Towers", 0},
+		{"gameofthrones", "Game of Thrones", 0},
+		// The run must start and end on word boundaries.
+		{"heat", "Theater Camp", 1},
+		{"ordofthe", "The Lord of the Rings", 1},
+	} {
+		tokens, _ := boundedFuzzyTokens(tc.query, fuzzyRerankMaxQueryTokens)
+		if got := scoreFuzzyTitleVariant(tc.query, tokens, tc.title).missingWords; got != tc.missing {
+			t.Errorf("%q vs %q missing %d words, want %d", tc.query, tc.title, got, tc.missing)
+		}
+	}
+}
+
+func TestFuzzyCandidateTextDropsStopwords(t *testing.T) {
+	for query, want := range map[string]string{
+		"The Godfathr":       "godfathr",
+		"Pirates of the Car": "pirates car",
+		"the in":             "the in",
+		"from up":            "from up",
+		"Spider-Man":         "spider man",
+	} {
+		if got := fuzzyCandidateText(query); got != want {
+			t.Errorf("fuzzyCandidateText(%q) = %q, want %q", query, got, want)
+		}
+	}
+}
+
+func TestScoreFuzzyTitleVariantStopwords(t *testing.T) {
+	for _, tc := range []struct {
+		query, title string
+		missing      int
+	}{
+		// A stopword need not appear in the title.
+		{"a quiet place", "Quiet Place", 0},
+		{"the good place", "Good Place", 0},
+		// A stopword takes no typo, so "she" does not stand in for "the".
+		{"the good place", "She Good Place", 0},
+		// A query of only stopwords requires each of them.
+		{"the in", "In", 1},
+		{"ed wood", "Wood", 1},
+	} {
+		tokens, _ := boundedFuzzyTokens(tc.query, fuzzyRerankMaxQueryTokens)
+		score := scoreFuzzyTitleVariant(tc.query, tokens, tc.title)
+		if score.missingWords != tc.missing {
+			t.Errorf("%q vs %q missing %d words, want %d", tc.query, tc.title, score.missingWords, tc.missing)
+		}
+	}
+	tokens, _ := boundedFuzzyTokens("the good place", fuzzyRerankMaxQueryTokens)
+	if got := scoreFuzzyTitleVariant("the good place", tokens, "She Good Place").matchedTokens; got != 2 {
+		t.Errorf("\"the\" matched \"she\": matched %d words, want 2", got)
 	}
 }
 
@@ -912,36 +1045,39 @@ func TestRerankFuzzyItemsIgnoresWordSpacing(t *testing.T) {
 		{ContentID: "liza", Title: "Liza: Warden from Hell"},
 		{ContentID: "film", Title: "Livestream from Hell"},
 	}
-	if err := rerankFuzzyItems(context.Background(), "Live Stream From Hell", items, nil); err != nil {
+	got, err := rerankFuzzyItems(context.Background(), "Live Stream From Hell", items, nil, false)
+	if err != nil {
 		t.Fatalf("rerank: %v", err)
 	}
-	if items[0].ContentID != "film" {
-		t.Fatalf("first result = %q (%s), want Livestream from Hell", items[0].Title, items[0].ContentID)
+	if ids := fuzzyItemIDs(got); !slices.Equal(ids, []string{"film"}) {
+		t.Fatalf("results = %v, want only Livestream from Hell", ids)
 	}
 
 	// A typo keeps the title from matching exactly, so the joined words
-	// "live stream" must match "livestream" to rank it first.
+	// "live stream" must match "livestream" to keep it.
 	items = []*models.MediaItem{
 		{ContentID: "volbeat", Title: "Volbeat - Live From Beyond Hell/Above Heaven"},
 		{ContentID: "heaven", Title: "Heaven & Hell: Live From Radio City Music Hall"},
 		{ContentID: "film", Title: "Livestream from Hell"},
 	}
-	if err := rerankFuzzyItems(context.Background(), "Live Stream From Hel", items, nil); err != nil { //nolint:misspell
+	got, err = rerankFuzzyItems(context.Background(), "Live Stream From Hel", items, nil, false)
+	if err != nil {
 		t.Fatalf("rerank: %v", err)
 	}
-	if items[0].ContentID != "film" {
-		t.Fatalf("first result = %q (%s), want Livestream from Hell", items[0].Title, items[0].ContentID)
+	if ids := fuzzyItemIDs(got); !slices.Equal(ids, []string{"film"}) {
+		t.Fatalf("results = %v, want only Livestream from Hell", ids)
 	}
 
 	items = []*models.MediaItem{
 		{ContentID: "compound", Title: "Livestream from Hell"},
 		{ContentID: "spaced", Title: "Live Stream from Hell"},
 	}
-	if err := rerankFuzzyItems(context.Background(), "Live Stream From Hell", items, nil); err != nil {
+	got, err = rerankFuzzyItems(context.Background(), "Live Stream From Hell", items, nil, false)
+	if err != nil {
 		t.Fatalf("rerank: %v", err)
 	}
-	if items[0].ContentID != "spaced" {
-		t.Fatalf("first result = %q (%s), want the title spelled as typed", items[0].Title, items[0].ContentID)
+	if ids := fuzzyItemIDs(got); !slices.Equal(ids, []string{"spaced", "compound"}) {
+		t.Fatalf("results = %v, want the title spelled as typed first", ids)
 	}
 
 	items = []*models.MediaItem{
@@ -949,11 +1085,12 @@ func TestRerankFuzzyItemsIgnoresWordSpacing(t *testing.T) {
 		{ContentID: "spider", Title: "Spider"},
 		{ContentID: "spiderman", Title: "Spider-Man: Homecoming"},
 	}
-	if err := rerankFuzzyItems(context.Background(), "spiderman homecoming", items, nil); err != nil {
+	got, err = rerankFuzzyItems(context.Background(), "spiderman homecoming", items, nil, false)
+	if err != nil {
 		t.Fatalf("rerank: %v", err)
 	}
-	if items[0].ContentID != "spiderman" {
-		t.Fatalf("first result = %q (%s), want Spider-Man: Homecoming", items[0].Title, items[0].ContentID)
+	if ids := fuzzyItemIDs(got); !slices.Equal(ids, []string{"spiderman"}) {
+		t.Fatalf("results = %v, want only Spider-Man: Homecoming", ids)
 	}
 }
 
@@ -987,11 +1124,12 @@ func TestRerankFuzzyItemsUsesBoundedAliases(t *testing.T) {
 	aliases := map[string][]string{
 		"localized": {"10 tokyo warriors"},
 	}
-	if err := rerankFuzzyItems(context.Background(), "Tokyo Warriros", items, aliases); err != nil { //nolint:misspell
+	got, err := rerankFuzzyItems(context.Background(), "Tokyo Warriros", items, aliases, false) //nolint:misspell // the misspelled query is the input under test
+	if err != nil {
 		t.Fatalf("rerank: %v", err)
 	}
-	if items[0].ContentID != "localized" {
-		t.Fatalf("first result = %q (%s), want alias-backed localized item", items[0].Title, items[0].ContentID)
+	if ids := fuzzyItemIDs(got); !slices.Equal(ids, []string{"localized"}) {
+		t.Fatalf("results = %v, want only the alias-backed localized item", ids)
 	}
 }
 
@@ -999,7 +1137,7 @@ func TestRerankFuzzyItemsHonorsCancellation(t *testing.T) {
 	ctx, cancel := context.WithCancel(context.Background())
 	cancel()
 	items := []*models.MediaItem{{ContentID: "one", Title: "One"}, {ContentID: "two", Title: "Two"}}
-	if err := rerankFuzzyItems(ctx, "three", items, nil); !errors.Is(err, context.Canceled) {
+	if _, err := rerankFuzzyItems(ctx, "three", items, nil, false); !errors.Is(err, context.Canceled) {
 		t.Fatalf("rerank error = %v, want context.Canceled", err)
 	}
 }
@@ -1039,7 +1177,7 @@ func BenchmarkRerankFuzzyItemsCappedCandidateSet(b *testing.B) {
 	for i := range items {
 		contentID := fmt.Sprintf("item-%d", i)
 		items[i] = &models.MediaItem{ContentID: contentID, Title: fmt.Sprintf("Related Fantasy Title %d", i)}
-		for alias := 0; alias < fuzzyRerankMaxAliasesPerItem; alias++ {
+		for alias := 0; alias < 2*fuzzyRerankAliasesPerOrder; alias++ {
 			aliases[contentID] = append(aliases[contentID], fmt.Sprintf("Alternate Fantasy Title %d %d", i, alias))
 		}
 	}
@@ -1049,7 +1187,7 @@ func BenchmarkRerankFuzzyItemsCappedCandidateSet(b *testing.B) {
 	b.ResetTimer()
 	for range b.N {
 		working := append([]*models.MediaItem(nil), items...)
-		if err := rerankFuzzyItems(context.Background(), "Gane of Throns", working, aliases); err != nil { //nolint:misspell
+		if _, err := rerankFuzzyItems(context.Background(), "Gane of Throns", working, aliases, false); err != nil {
 			b.Fatal(err)
 		}
 	}
diff --git a/internal/catalog/last_air_date_denorm_test.go b/internal/catalog/last_air_date_denorm_test.go
index 2f71382b7d..5d163e1d8e 100644
--- a/internal/catalog/last_air_date_denorm_test.go
+++ b/internal/catalog/last_air_date_denorm_test.go
@@ -67,7 +67,7 @@ func TestNoEpisodeDeletePath_ProtectsLastAirDateDenorm(t *testing.T) {
 	for _, root := range roots {
 		err := filepath.Walk(root, func(path string, info os.FileInfo, err error) error {
 			if err != nil {
-				return err
+				return nil //nolint:nilerr // skip unreadable paths in the checkout instead of aborting the source scan
 			}
 			if info.IsDir() {
 				// Skip vendor, node_modules, build artifacts, and the
@@ -93,7 +93,10 @@ func TestNoEpisodeDeletePath_ProtectsLastAirDateDenorm(t *testing.T) {
 				return nil
 			}
 			data, readErr := os.ReadFile(path)
-			if readErr == nil && deletePattern.Match(data) {
+			if readErr != nil {
+				return nil //nolint:nilerr // skip unreadable files, as the walk does for unreadable paths
+			}
+			if deletePattern.Match(data) {
 				hits = append(hits, rel)
 			}
 			return nil
diff --git a/internal/catalog/library_collection_membership_test.go b/internal/catalog/library_collection_membership_test.go
index 2b6e2ed4cd..7f857b851f 100644
--- a/internal/catalog/library_collection_membership_test.go
+++ b/internal/catalog/library_collection_membership_test.go
@@ -9,7 +9,7 @@ import (
 )
 
 func TestResolveLibraryCollectionMembershipReadsStoredItemsForNonSmartTypes(t *testing.T) {
-	for _, collectionType := range []string{"manual", "mdblist", "tmdb", "trakt"} {
+	for _, collectionType := range []string{"manual", "mdblist", "tmdb"} {
 		t.Run(collectionType, func(t *testing.T) {
 			// A query_definition on a non-smart collection does not make it
 			// live: its members are the stored items its writers maintain.
diff --git a/internal/catalog/library_collection_repo.go b/internal/catalog/library_collection_repo.go
index a620906742..07bf2e2dfb 100644
--- a/internal/catalog/library_collection_repo.go
+++ b/internal/catalog/library_collection_repo.go
@@ -377,10 +377,9 @@ func (r *LibraryCollectionRepository) ListAll(ctx context.Context, libraryID *in
 		args       []any
 		scopeJoin  string
 	)
-	argIdx := 1
 	if libraryID != nil {
-		scopeJoin = fmt.Sprintf(`JOIN library_collection_libraries scope_lcl
-			ON scope_lcl.collection_id = lc.id AND scope_lcl.library_id = $%d`, argIdx)
+		scopeJoin = `JOIN library_collection_libraries scope_lcl
+			ON scope_lcl.collection_id = lc.id AND scope_lcl.library_id = $1`
 		args = append(args, *libraryID)
 	} else {
 		scopeJoin = libraryCollectionScopeFallbackJoin
@@ -876,7 +875,7 @@ func (r *LibraryCollectionRepository) ListItems(ctx context.Context, collectionI
 
 // AddItem inserts or upserts a single item in a manual collection. The
 // caller is responsible for verifying the collection's type before invoking
-// this — synced collections (mdblist/tmdb/trakt) overwrite manual edits on
+// this — synced collections (mdblist/tmdb) overwrite manual edits on
 // their next sync.
 func (r *LibraryCollectionRepository) AddItem(ctx context.Context, collectionID, mediaItemID string, position int) error {
 	tx, err := r.pool.Begin(ctx)
@@ -1367,7 +1366,7 @@ func (r *LibraryCollectionRepository) ListDueForSync(ctx context.Context) ([]*mo
 		WHERE lc.sync_schedule IS NOT NULL
 		  AND lc.next_sync_at IS NOT NULL
 		  AND lc.next_sync_at <= NOW()
-		  AND lc.collection_type IN ('mdblist', 'tmdb', 'trakt')
+		  AND lc.collection_type IN ('mdblist', 'tmdb')
 		GROUP BY lc.id, scope_lcl.group_id, scope_lcl.sort_order
 		ORDER BY lc.next_sync_at ASC
 	`, libraryCollectionColumns, libraryCollectionScopeFallbackJoin)
diff --git a/internal/catalog/library_collection_service.go b/internal/catalog/library_collection_service.go
index deebd16227..50c52d4e21 100644
--- a/internal/catalog/library_collection_service.go
+++ b/internal/catalog/library_collection_service.go
@@ -7,7 +7,6 @@ import (
 	"fmt"
 	"log/slog"
 	"net/http"
-	"net/url"
 	"strings"
 	"sync"
 	"time"
@@ -27,18 +26,6 @@ type TMDBCollectionEntry struct {
 	TVDBID    int
 }
 
-// TraktCollectionEntry is a lightweight Trakt discovery result used by collection sync.
-type TraktCollectionEntry struct {
-	TraktID   int
-	TMDBID    int
-	TVDBID    int
-	IMDbID    string
-	MediaType string
-	Title     string
-	Year      int
-	Rank      int
-}
-
 // TMDBCollectionFetcher abstracts the TMDB preset API so the catalog package
 // does not import the tmdb package directly.
 type TMDBCollectionFetcher interface {
@@ -47,9 +34,9 @@ type TMDBCollectionFetcher interface {
 
 // TMDBCollectionByIDFetcher abstracts TMDB's /collection/{id} franchise/saga
 // endpoint. It returns the curated, ordered list of parts in a TMDB
-// collection (e.g. all MCU films in MCU collection 86311), already enriched
-// with external IDs so the matcher can fall back to IMDb / TVDB when the
-// local catalog doesn't carry a TMDB ID.
+// collection (e.g. all MCU films in MCU collection 86311). Entries carry only
+// their TMDB IDs; MatchTMDBEntries asks the fetcher for more when it needs
+// them.
 //
 // Implementations are expected to deal with pagination internally — TMDB
 // collection responses are single-page, so this is currently trivial.
@@ -82,27 +69,12 @@ type TMDBDiscoverFetcher interface {
 }
 
 // TMDBListFetcher abstracts TMDB's `/list/{id}` endpoint for public,
-// user-authored lists. Entries come back in list order, enriched with
-// external IDs like the other TMDB fetchers. A limit <= 0 reads the whole
-// list up to the fetcher's own cap.
+// user-authored lists. Entries come back in list order, carrying only their
+// TMDB IDs like the other TMDB fetchers. A limit <= 0 reads the whole list.
 type TMDBListFetcher interface {
 	GetList(ctx context.Context, id, limit int) ([]TMDBCollectionEntry, error)
 }
 
-// TraktCollectionFetcher abstracts the Trakt discovery API.
-type TraktCollectionFetcher interface {
-	GetCollectionPreset(ctx context.Context, preset, mediaType string, limit int, accessToken string) ([]TraktCollectionEntry, error)
-	// GetUserList fetches a user-authored Trakt list in list order. Public
-	// lists need no access token.
-	GetUserList(ctx context.Context, user, list string, limit int, accessToken string) ([]TraktCollectionEntry, error)
-}
-
-// TraktAccessTokenResolver returns a profile-scoped Trakt access token for
-// personalized recommendation collection sync.
-type TraktAccessTokenResolver interface {
-	ResolveTraktAccessToken(ctx context.Context, profileID string) (string, error)
-}
-
 // CollageGenerator composes and stores collection collages. Stored collages
 // are deleted through the artwork revision collector, never directly.
 type CollageGenerator interface {
@@ -144,12 +116,6 @@ type LibraryCollectionService struct {
 	// source mode (public user-authored lists).
 	TMDBLists TMDBListFetcher
 
-	// TraktCollections is nil when Trakt collection discovery is not configured.
-	TraktCollections TraktCollectionFetcher
-
-	// TraktTokenResolver is required for Trakt recommended collections.
-	TraktTokenResolver TraktAccessTokenResolver
-
 	// CollageGen is nil when S3/image processing is not configured.
 	CollageGen CollageGenerator
 
@@ -200,7 +166,7 @@ type libraryCollectionSourceConfig struct {
 
 	// Discover holds the TMDB /discover parameters for the `tmdb_discover`
 	// mode. The pointer lets the JSON omit the object entirely for non-
-	// discover modes so existing tmdb_preset / trakt_preset / mdblist_json
+	// discover modes so existing tmdb_preset / mdblist_json
 	// configs round-trip unchanged.
 	Discover *libraryCollectionDiscoverConfig `json:"discover,omitempty"`
 }
@@ -266,10 +232,6 @@ func (s *LibraryCollectionService) SyncCollectionWithOptions(ctx context.Context
 		run, err = s.syncTMDBDiscoverCollection(ctx, collection, source, opts)
 	case "tmdb_list":
 		run, err = s.syncTMDBListCollection(ctx, collection, source, opts)
-	case "trakt_preset":
-		run, err = s.syncTraktPresetCollection(ctx, collection, source, opts)
-	case "trakt_list":
-		run, err = s.syncTraktListCollection(ctx, collection, source, opts)
 	default:
 		return nil, fmt.Errorf("%w: %s", ErrLibraryCollectionSyncModeUnsupported, source.Mode)
 	}
@@ -298,8 +260,8 @@ func (s *LibraryCollectionService) syncMDBListCollection(ctx context.Context, co
 	if len(listURLs) == 0 {
 		return nil, fmt.Errorf("mdblist sync: url is required")
 	}
-	// Read only as far as the same fetch-multiplier bound used for TMDB and
-	// Trakt sources. MDBList lists can hold thousands of entries; without this,
+	// Read only as far as the same fetch-multiplier bound used for TMDB
+	// sources. MDBList lists can hold thousands of entries; without this,
 	// the two GetByExternalIDs IN arrays balloon to the full list size even
 	// when the user's limit is small.
 	fetchLimit := collectionutil.SourceFetchLimit(limit)
@@ -512,7 +474,7 @@ func (s *LibraryCollectionService) syncTMDBPresetCollection(ctx context.Context,
 		"count", len(results),
 	)
 
-	return s.completeTMDBEntrySync(ctx, collection, results, cfg.Limit, startedAt, opts, "preset")
+	return s.completeTMDBEntrySync(ctx, collection, s.TMDBCollections, results, cfg.Limit, startedAt, opts, "preset")
 }
 
 // syncTMDBFranchiseCollection populates a collection from TMDB's curated
@@ -561,7 +523,7 @@ func (s *LibraryCollectionService) syncTMDBFranchiseCollection(ctx context.Conte
 		"count", len(results),
 	)
 
-	return s.completeTMDBEntrySync(ctx, collection, results, cfg.Limit, startedAt, opts, "collection")
+	return s.completeTMDBEntrySync(ctx, collection, s.TMDBFranchises, results, cfg.Limit, startedAt, opts, "collection")
 }
 
 // validateTMDBDiscoverConfig returns a non-empty admin-facing failure message
@@ -630,7 +592,7 @@ func (s *LibraryCollectionService) syncTMDBDiscoverCollection(ctx context.Contex
 		"count", len(results),
 	)
 
-	return s.completeTMDBEntrySync(ctx, collection, results, cfg.Limit, startedAt, opts, "discover")
+	return s.completeTMDBEntrySync(ctx, collection, s.TMDBDiscovers, results, cfg.Limit, startedAt, opts, "discover")
 }
 
 // syncTMDBListCollection populates a collection from a public, user-authored
@@ -663,13 +625,20 @@ func (s *LibraryCollectionService) syncTMDBListCollection(ctx context.Context, c
 		"count", len(results),
 	)
 
-	return s.completeTMDBEntrySync(ctx, collection, results, cfg.Limit, startedAt, opts, "list")
+	return s.completeTMDBEntrySync(ctx, collection, s.TMDBLists, results, cfg.Limit, startedAt, opts, "list")
 }
 
-// completeTMDBEntrySync matches fetched TMDB entries against the collection's
-// libraries in source order and records the sync run. Shared by every TMDB
-// source mode; source names the mode in logs.
-func (s *LibraryCollectionService) completeTMDBEntrySync(ctx context.Context, collection *models.LibraryCollection, results []TMDBCollectionEntry, limit *int, startedAt time.Time, opts SyncCollectionOptions, source string) (*models.LibraryCollectionSyncRun, error) {
+// completeTMDBEntrySync matches the entries fetcher returned against the
+// collection's libraries in source order and records the sync. fetcher fills
+// in external IDs for entries their TMDB ID leaves unmatched; see
+// MatchTMDBEntries. Shared by every TMDB source mode; source names the mode in
+// logs.
+func (s *LibraryCollectionService) completeTMDBEntrySync(ctx context.Context, collection *models.LibraryCollection, fetcher any, results []TMDBCollectionEntry, limit *int, startedAt time.Time, opts SyncCollectionOptions, source string) (*models.LibraryCollectionSyncRun, error) {
+	contentIDs, err := s.matchTMDBEntriesInLibraries(ctx, collection.LibraryIDs, fetcher, results)
+	if err != nil {
+		return nil, err
+	}
+
 	matchedItems := make([]LibraryCollectionItemInput, 0, len(results))
 	seenContentIDs := make(map[string]int, len(results))
 	warnings := make([]string, 0)
@@ -680,11 +649,8 @@ func (s *LibraryCollectionService) completeTMDBEntrySync(ctx context.Context, co
 
 	for i, entry := range results {
 		scannedEntries = i + 1
-		item, err := s.resolveTMDBEntry(ctx, collection.LibraryIDs, entry)
-		if err != nil {
-			return nil, err
-		}
-		if item == nil {
+		contentID := contentIDs[i]
+		if contentID == "" {
 			slog.DebugContext(ctx, "TMDB sync: no match", "component", "catalog",
 				"source", source,
 				"rank", i+1,
@@ -697,21 +663,21 @@ func (s *LibraryCollectionService) completeTMDBEntrySync(ctx context.Context, co
 			unmatchedCount++
 			continue
 		}
-		if firstRank, exists := seenContentIDs[item.ContentID]; exists {
+		if firstRank, exists := seenContentIDs[contentID]; exists {
 			slog.DebugContext(ctx, "TMDB sync: duplicate match skipped", "component", "catalog",
 				"source", source,
 				"rank", i+1,
 				"title", entry.Title,
 				"type", entry.MediaType,
 				"tmdb_id", entry.ID,
-				"content_id", item.ContentID,
+				"content_id", contentID,
 				"first_rank", firstRank,
 			)
 			duplicateCount++
-			warnings = append(warnings, fmt.Sprintf("Duplicate TMDB entry for %s matched existing item %s", entry.Title, item.ContentID))
+			warnings = append(warnings, fmt.Sprintf("Duplicate TMDB entry for %s matched existing item %s", entry.Title, contentID))
 			continue
 		}
-		seenContentIDs[item.ContentID] = i + 1
+		seenContentIDs[contentID] = i + 1
 
 		slog.DebugContext(ctx, "TMDB sync: matched", "component", "catalog",
 			"source", source,
@@ -719,10 +685,10 @@ func (s *LibraryCollectionService) completeTMDBEntrySync(ctx context.Context, co
 			"title", entry.Title,
 			"type", entry.MediaType,
 			"tmdb_id", entry.ID,
-			"content_id", item.ContentID,
+			"content_id", contentID,
 		)
 		matchedItems = append(matchedItems, LibraryCollectionItemInput{
-			MediaItemID: item.ContentID,
+			MediaItemID: contentID,
 			Position:    len(matchedItems),
 			SourceRank:  i + 1,
 		})
@@ -742,35 +708,55 @@ func (s *LibraryCollectionService) completeTMDBEntrySync(ctx context.Context, co
 		"total", len(results),
 	)
 
-	if err := s.collections.ReplaceItems(ctx, collection.ID, matchedItems); err != nil {
+	return s.recordTMDBEntrySync(ctx, collection.ID, tmdbEntrySyncTally{
+		matched:      matchedItems,
+		warnings:     warnings,
+		unmatched:    unmatchedCount,
+		duplicates:   duplicateCount,
+		scanned:      scannedEntries,
+		limitReached: limitReached,
+	}, len(results), startedAt, opts)
+}
+
+// tmdbEntrySyncTally is what a TMDB sync found walking its entries.
+type tmdbEntrySyncTally struct {
+	matched      []LibraryCollectionItemInput
+	warnings     []string
+	unmatched    int
+	duplicates   int
+	scanned      int
+	limitReached bool
+}
+
+// recordTMDBEntrySync stores a TMDB sync's members and its run record out of
+// total fetched entries.
+func (s *LibraryCollectionService) recordTMDBEntrySync(ctx context.Context, collectionID string, tally tmdbEntrySyncTally, total int, startedAt time.Time, opts SyncCollectionOptions) (*models.LibraryCollectionSyncRun, error) {
+	if err := s.collections.ReplaceItems(ctx, collectionID, tally.matched); err != nil {
 		return nil, err
 	}
 
 	status := "success"
-	if len(warnings) > 0 {
+	if len(tally.warnings) > 0 {
 		status = "warning"
 	}
-	message := fmt.Sprintf("Matched %d of %d entries", len(matchedItems), len(results))
-	if limitReached {
-		message = fmt.Sprintf("%s (item limit reached after %d scanned)", message, scannedEntries)
-	}
-	if duplicateCount > 0 {
-		message = fmt.Sprintf("%s (%d duplicates skipped)", message, duplicateCount)
+	message := fmt.Sprintf("Matched %d of %d entries", len(tally.matched), total)
+	if tally.limitReached {
+		message = fmt.Sprintf("%s (item limit reached after %d scanned)", message, tally.scanned)
 	}
-	warningsJSON, err := json.Marshal(warnings)
-	if err != nil {
-		return nil, fmt.Errorf("marshaling sync warnings: %w", err)
+	if tally.duplicates > 0 {
+		message = fmt.Sprintf("%s (%d duplicates skipped)", message, tally.duplicates)
 	}
+	warningsJSON, _ := json.Marshal(tally.warnings)
 
 	completedAt := syncTimestamp()
 	run, err := s.collections.RecordSyncRun(ctx, RecordLibraryCollectionSyncRunInput{
-		CollectionID:   collection.ID,
+		CollectionID:   collectionID,
 		Status:         status,
 		Message:        message,
-		ItemsAdded:     len(matchedItems),
+		ItemsAdded:     len(tally.matched),
 		ItemsRemoved:   0,
-		ItemsMatched:   len(matchedItems),
-		ItemsUnmatched: unmatchedCount,
+		ItemsMatched:   len(tally.matched),
+		ItemsUnmatched: tally.unmatched,
 		Warnings:       warningsJSON,
 		StartedAt:      startedAt,
 		CompletedAt:    completedAt,
@@ -780,243 +766,9 @@ func (s *LibraryCollectionService) completeTMDBEntrySync(ctx context.Context, co
 	}
 
 	if !opts.SkipCollage {
-		s.MaybeGenerateCollage(ctx, collection.ID)
-	}
-
-	return run, nil
-}
-
-func (s *LibraryCollectionService) syncTraktPresetCollection(ctx context.Context, collection *models.LibraryCollection, cfg libraryCollectionSourceConfig, opts SyncCollectionOptions) (*models.LibraryCollectionSyncRun, error) {
-	startedAt := syncTimestamp()
-
-	if s.TraktCollections == nil {
-		return nil, fmt.Errorf("trakt preset sync requires configured Trakt access")
-	}
-
-	preset := strings.TrimSpace(cfg.Preset)
-	mediaType := strings.TrimSpace(cfg.MediaType)
-	if mediaType == "" {
-		mediaType = itemTypeMovie
-	}
-	if preset != "trending" && preset != "popular" && preset != "recommended" {
-		return nil, fmt.Errorf("unsupported Trakt preset: %s", preset)
-	}
-	if mediaType != itemTypeMovie && mediaType != "tv" {
-		return nil, fmt.Errorf("unsupported Trakt media type: %s", mediaType)
-	}
-
-	accessToken := ""
-	if preset == "recommended" {
-		profileID := strings.TrimSpace(cfg.ProfileID)
-		if profileID == "" {
-			return s.recordFailedCollectionSync(ctx, collection.ID, startedAt, "Trakt recommendations require a profile")
-		}
-		if s.TraktTokenResolver == nil {
-			slog.ErrorContext(ctx, "Trakt recommendations: token resolver not configured", "component", "catalog",
-				"collection_id", collection.ID,
-				"profile_id", profileID,
-			)
-			return s.recordFailedCollectionSync(ctx, collection.ID, startedAt, "Trakt recommendations: server is not configured for Trakt sync")
-		}
-		token, err := s.TraktTokenResolver.ResolveTraktAccessToken(ctx, profileID)
-		if err != nil {
-			slog.ErrorContext(ctx, "Trakt recommendations: failed to resolve access token", "component", "catalog",
-				"collection_id", collection.ID,
-				"profile_id", profileID,
-				"error", err,
-			)
-			return s.recordFailedCollectionSync(ctx, collection.ID, startedAt, fmt.Sprintf("Trakt recommendations: failed to resolve access token: %v", err))
-		}
-		accessToken = token
-	}
-
-	fetchLimit := collectionutil.SourceFetchLimit(cfg.Limit)
-	results, err := s.TraktCollections.GetCollectionPreset(ctx, preset, mediaType, fetchLimit, accessToken)
-	if err != nil {
-		return nil, fmt.Errorf("fetching Trakt preset: %w", err)
-	}
-
-	slog.InfoContext(ctx, "Trakt preset sync: fetched results", "component", "catalog",
-		"collection_id", collection.ID,
-		"preset", preset,
-		"media_type", mediaType,
-		"count", len(results),
-	)
-
-	return s.completeTraktEntrySync(ctx, collection, results, cfg.Limit, startedAt, opts)
-}
-
-// syncTraktListCollection populates a collection from a user-authored Trakt
-// list (issue #214). The list reference comes from cfg.URL, a trakt.tv list
-// URL like https://trakt.tv/users/{user}/lists/{slug}. Lists mix movies and
-// shows; matching and ordering reuse the preset pipeline.
-func (s *LibraryCollectionService) syncTraktListCollection(ctx context.Context, collection *models.LibraryCollection, cfg libraryCollectionSourceConfig, opts SyncCollectionOptions) (*models.LibraryCollectionSyncRun, error) {
-	startedAt := syncTimestamp()
-
-	if s.TraktCollections == nil {
-		return nil, fmt.Errorf("trakt list sync requires configured Trakt access")
-	}
-	listURL := strings.TrimSpace(cfg.ListURL)
-	if listURL == "" {
-		listURL = strings.TrimSpace(cfg.URL)
-	}
-	if listURL == "" {
-		listURL = strings.TrimSpace(collection.SourceURL)
-	}
-	user, list, err := ParseTraktListURL(listURL)
-	if err != nil {
-		return s.recordFailedCollectionSync(ctx, collection.ID, startedAt, err.Error())
-	}
-
-	fetchLimit := collectionutil.SourceFetchLimit(cfg.Limit)
-	results, err := s.TraktCollections.GetUserList(ctx, user, list, fetchLimit, "")
-	if err != nil {
-		return nil, fmt.Errorf("fetching Trakt list %s/%s: %w", user, list, err)
-	}
-
-	slog.InfoContext(ctx, "Trakt list sync: fetched results", "component", "catalog",
-		"collection_id", collection.ID,
-		"user", user,
-		"list", list,
-		"count", len(results),
-	)
-
-	return s.completeTraktEntrySync(ctx, collection, results, cfg.Limit, startedAt, opts)
-}
-
-// ParseTraktListURL extracts the user and list slug from a trakt.tv list URL
-// (https://trakt.tv/users/{user}/lists/{slug}[?...]) or a bare
-// "{user}/{slug}" shorthand.
-func ParseTraktListURL(raw string) (user, list string, err error) {
-	trimmed := strings.TrimSpace(raw)
-	if trimmed == "" {
-		return "", "", fmt.Errorf("trakt list sync: url is required")
-	}
-	badFormat := func() (string, string, error) {
-		return "", "", fmt.Errorf("trakt list sync: expected a URL like https://trakt.tv/users/{user}/lists/{list}, got %q", raw)
-	}
-	isURL := strings.Contains(trimmed, "://") || strings.Contains(strings.ToLower(trimmed), "trakt.tv")
-	if isURL {
-		normalized := trimmed
-		if !strings.Contains(normalized, "://") {
-			normalized = "https://" + normalized
-		}
-		parsed, parseErr := url.Parse(normalized)
-		if parseErr != nil {
-			return "", "", fmt.Errorf("trakt list sync: invalid url %q", raw)
-		}
-		host := strings.ToLower(parsed.Hostname())
-		if host != "trakt.tv" && host != "www.trakt.tv" {
-			return badFormat()
-		}
-		parts := strings.Split(strings.Trim(parsed.Path, "/"), "/")
-		if len(parts) != 4 || parts[0] != "users" || parts[2] != "lists" {
-			return badFormat()
-		}
-		user, list = parts[1], parts[3]
-	} else {
-		// Bare "{user}/{slug}" shorthand.
-		parts := strings.Split(strings.Trim(trimmed, "/"), "/")
-		if len(parts) != 2 {
-			return badFormat()
-		}
-		user, list = parts[0], parts[1]
-	}
-	if user == "" || list == "" {
-		return badFormat()
-	}
-	return user, list, nil
-}
-
-// completeTraktEntrySync matches fetched Trakt entries against the
-// collection's libraries and records the sync run. Shared by the preset and
-// user-list sources.
-func (s *LibraryCollectionService) completeTraktEntrySync(ctx context.Context, collection *models.LibraryCollection, results []TraktCollectionEntry, limit *int, startedAt time.Time, opts SyncCollectionOptions) (*models.LibraryCollectionSyncRun, error) {
-	matchedItems := make([]LibraryCollectionItemInput, 0, len(results))
-	seenContentIDs := make(map[string]int, len(results))
-	warnings := make([]string, 0)
-	unmatchedCount := 0
-	duplicateCount := 0
-	scannedEntries := 0
-	limitReached := false
-
-	for i, entry := range results {
-		scannedEntries = i + 1
-		item, err := s.resolveTraktEntry(ctx, collection.LibraryIDs, entry)
-		if err != nil {
-			return nil, err
-		}
-		if item == nil {
-			unmatchedCount++
-			continue
-		}
-		if firstRank, exists := seenContentIDs[item.ContentID]; exists {
-			duplicateCount++
-			warnings = append(warnings, fmt.Sprintf("Duplicate Trakt entry for %s matched existing item %s", entry.Title, item.ContentID))
-			slog.InfoContext(ctx, "Trakt preset sync: duplicate match skipped", "component", "catalog",
-				"rank", i+1,
-				"title", entry.Title,
-				"content_id", item.ContentID,
-				"first_rank", firstRank,
-			)
-			continue
-		}
-		seenContentIDs[item.ContentID] = i + 1
-		sourceRank := entry.Rank
-		if sourceRank <= 0 {
-			sourceRank = i + 1
-		}
-		matchedItems = append(matchedItems, LibraryCollectionItemInput{
-			MediaItemID: item.ContentID,
-			Position:    len(matchedItems),
-			SourceRank:  sourceRank,
-		})
-		if collectionutil.ItemLimitReached(len(matchedItems), limit) {
-			limitReached = true
-			break
-		}
-	}
-
-	if err := s.collections.ReplaceItems(ctx, collection.ID, matchedItems); err != nil {
-		return nil, err
-	}
-
-	status := "success"
-	if len(warnings) > 0 {
-		status = "warning"
-	}
-	message := fmt.Sprintf("Matched %d of %d entries", len(matchedItems), len(results))
-	if limitReached {
-		message = fmt.Sprintf("%s (item limit reached after %d scanned)", message, scannedEntries)
-	}
-	if duplicateCount > 0 {
-		message = fmt.Sprintf("%s (%d duplicates skipped)", message, duplicateCount)
-	}
-	warningsJSON, err := json.Marshal(warnings)
-	if err != nil {
-		return nil, fmt.Errorf("marshaling sync warnings: %w", err)
-	}
-
-	completedAt := syncTimestamp()
-	run, err := s.collections.RecordSyncRun(ctx, RecordLibraryCollectionSyncRunInput{
-		CollectionID:   collection.ID,
-		Status:         status,
-		Message:        message,
-		ItemsAdded:     len(matchedItems),
-		ItemsRemoved:   0,
-		ItemsMatched:   len(matchedItems),
-		ItemsUnmatched: unmatchedCount,
-		Warnings:       warningsJSON,
-		StartedAt:      startedAt,
-		CompletedAt:    completedAt,
-	})
-	if err != nil {
-		return nil, err
+		s.MaybeGenerateCollage(ctx, collectionID)
 	}
 
-	if !opts.SkipCollage {
-		s.MaybeGenerateCollage(ctx, collection.ID)
-	}
 	return run, nil
 }
 
@@ -1035,106 +787,30 @@ func (s *LibraryCollectionService) recordFailedCollectionSync(ctx context.Contex
 	})
 }
 
-// resolveTMDBEntry finds a media item in the library matching a TMDB preset entry.
-// It tries TMDB ID, IMDb ID, and TVDB ID (for TV shows) to maximize match rate.
-func (s *LibraryCollectionService) resolveTMDBEntry(ctx context.Context, libraryIDs []int, entry TMDBCollectionEntry) (*models.MediaItem, error) {
-	itemType := itemTypeMovie
-	if entry.MediaType == "tv" {
-		itemType = itemTypeSeries
-	}
-
-	tmdbID := ""
-	if entry.ID > 0 {
-		tmdbID = fmt.Sprintf("%d", entry.ID)
-	}
-	tvdbID := ""
-	if entry.TVDBID > 0 {
-		tvdbID = fmt.Sprintf("%d", entry.TVDBID)
-	}
-
-	item, err := s.items.GetByExternalID(ctx, tmdbID, entry.IMDbID, tvdbID, itemType)
-	if err != nil {
-		if !errors.Is(err, ErrItemNotFound) {
-			return nil, err
-		}
-		return nil, nil
-	}
-
-	membership, err := s.libraryItems.GetItemsInFolders(ctx, []string{item.ContentID}, libraryIDs)
-	if err != nil {
-		return nil, err
-	}
-	if !membership[item.ContentID] {
-		return nil, nil
-	}
-
-	return item, nil
-}
-
-// resolveTraktEntry finds a local item matching a Trakt discovery entry.
-func (s *LibraryCollectionService) resolveTraktEntry(ctx context.Context, libraryIDs []int, entry TraktCollectionEntry) (*models.MediaItem, error) {
-	itemType := itemTypeMovie
-	if entry.MediaType == "tv" {
-		itemType = itemTypeSeries
-	}
-	batch := ExternalIDBatch{}
-	if entry.TMDBID > 0 {
-		batch.TMDBIDs = []string{fmt.Sprintf("%d", entry.TMDBID)}
-	}
-	if entry.IMDbID != "" {
-		batch.IMDbIDs = []string{entry.IMDbID}
-	}
-	if entry.TVDBID > 0 && itemType == itemTypeSeries {
-		batch.TVDBIDs = []string{fmt.Sprintf("%d", entry.TVDBID)}
-	}
-	lookup, err := s.items.GetByExternalIDs(ctx, batch, itemType)
+// matchTMDBEntriesInLibraries returns, for each entry in order, the
+// content_id of the title it names in one of libraryIDs, or "" when it names
+// none there.
+func (s *LibraryCollectionService) matchTMDBEntriesInLibraries(ctx context.Context, libraryIDs []int, fetcher any, entries []TMDBCollectionEntry) ([]string, error) {
+	contentIDs, err := MatchTMDBEntries(ctx, s.items, fetcher, entries)
 	if err != nil {
 		return nil, err
 	}
-	candidates := traktCandidatesByPriority(lookup, entry, itemType)
-	if len(candidates) == 0 {
-		return nil, nil
+	matched := make([]string, 0, len(contentIDs))
+	for _, id := range contentIDs {
+		if id != "" {
+			matched = append(matched, id)
+		}
 	}
-
-	membership, err := s.libraryItems.GetItemsInFolders(ctx, candidates, libraryIDs)
+	inLibraries, err := s.libraryItems.GetItemsInFolders(ctx, matched, libraryIDs)
 	if err != nil {
 		return nil, err
 	}
-	for _, candidate := range candidates {
-		if membership[candidate] {
-			return s.items.GetByID(ctx, candidate)
-		}
-	}
-
-	return nil, nil
-}
-
-func traktCandidatesByPriority(lookup *ExternalIDLookup, entry TraktCollectionEntry, itemType string) []string {
-	if lookup == nil {
-		return nil
-	}
-	var candidates []string
-	seen := make(map[string]struct{}, 3)
-	add := func(id string) {
-		if id == "" {
-			return
+	for i, id := range contentIDs {
+		if !inLibraries[id] {
+			contentIDs[i] = ""
 		}
-		if _, ok := seen[id]; ok {
-			return
-		}
-		seen[id] = struct{}{}
-		candidates = append(candidates, id)
 	}
-	if itemType == itemTypeSeries && entry.TVDBID > 0 {
-		add(lookup.ByTVDB[fmt.Sprintf("%d", entry.TVDBID)])
-	}
-	if entry.TMDBID > 0 {
-		add(lookup.ByTMDB[fmt.Sprintf("%d", entry.TMDBID)])
-	}
-	if entry.IMDbID != "" {
-		add(lookup.ByIMDb[entry.IMDbID])
-	}
-	return candidates
+	return contentIDs, nil
 }
 
 func (s *LibraryCollectionService) fetchMDBListEntries(ctx context.Context, listURL string, maxEntries int) ([]mdblistEntry, error) {
diff --git a/internal/catalog/library_collection_service_test.go b/internal/catalog/library_collection_service_test.go
index 98ce7689a7..f705277c7d 100644
--- a/internal/catalog/library_collection_service_test.go
+++ b/internal/catalog/library_collection_service_test.go
@@ -81,28 +81,6 @@ func (f roundTripFunc) RoundTrip(r *http.Request) (*http.Response, error) {
 	return f(r)
 }
 
-func TestTraktCandidatesByPriority_ShowUsesTVDBBeforeTMDB(t *testing.T) {
-	lookup := &ExternalIDLookup{
-		ByTVDB: map[string]string{"100": "tvdb-hit"},
-		ByTMDB: map[string]string{"200": "tmdb-hit"},
-		ByIMDb: map[string]string{"tt300": "imdb-hit"},
-	}
-	candidates := traktCandidatesByPriority(lookup, TraktCollectionEntry{
-		TVDBID: 100,
-		TMDBID: 200,
-		IMDbID: "tt300",
-	}, "series")
-	want := []string{"tvdb-hit", "tmdb-hit", "imdb-hit"}
-	if len(candidates) != len(want) {
-		t.Fatalf("candidates = %v, want %v", candidates, want)
-	}
-	for i := range want {
-		if candidates[i] != want[i] {
-			t.Fatalf("candidates = %v, want %v", candidates, want)
-		}
-	}
-}
-
 // TestValidateTMDBFranchiseConfig pins the failure-message format that
 // surfaces to the admin in the sync_runs table when a placeholder template
 // is applied without filling in the real TMDB collection ID.
@@ -224,25 +202,3 @@ func TestValidateTMDBDiscoverConfig(t *testing.T) {
 		})
 	}
 }
-
-func TestTraktCandidatesByPriority_MovieUsesTMDBBeforeIMDb(t *testing.T) {
-	lookup := &ExternalIDLookup{
-		ByTVDB: map[string]string{"100": "tvdb-hit"},
-		ByTMDB: map[string]string{"200": "tmdb-hit"},
-		ByIMDb: map[string]string{"tt300": "imdb-hit"},
-	}
-	candidates := traktCandidatesByPriority(lookup, TraktCollectionEntry{
-		TVDBID: 100,
-		TMDBID: 200,
-		IMDbID: "tt300",
-	}, "movie")
-	want := []string{"tmdb-hit", "imdb-hit"}
-	if len(candidates) != len(want) {
-		t.Fatalf("candidates = %v, want %v", candidates, want)
-	}
-	for i := range want {
-		if candidates[i] != want[i] {
-			t.Fatalf("candidates = %v, want %v", candidates, want)
-		}
-	}
-}
diff --git a/internal/catalog/localization_ai_upsert_test.go b/internal/catalog/localization_ai_upsert_test.go
new file mode 100644
index 0000000000..9b59e790fe
--- /dev/null
+++ b/internal/catalog/localization_ai_upsert_test.go
@@ -0,0 +1,84 @@
+package catalog
+
+import (
+	"os"
+	"testing"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// AC4: AI writes fill empty fields and refresh earlier AI text, but never
+// replace provider or manual text.
+func TestAITranslationNeverOverwritesProviderOrManualText(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	config, err := pgxpool.ParseConfig(dsn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	config.MaxConns = 1
+	pool, err := pgxpool.NewWithConfig(t.Context(), config)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(pool.Close)
+	if _, err := pool.Exec(t.Context(), `
+		CREATE TEMP TABLE media_item_localizations (LIKE public.media_item_localizations INCLUDING DEFAULTS INCLUDING INDEXES);
+		CREATE TEMP TABLE season_localizations (LIKE public.season_localizations INCLUDING DEFAULTS INCLUDING INDEXES);
+		CREATE TEMP TABLE episode_localizations (LIKE public.episode_localizations INCLUDING DEFAULTS INCLUDING INDEXES);
+		INSERT INTO media_item_localizations (content_id, language, title, sort_title, overview, tagline, poster_path, poster_thumbhash,
+			backdrop_path, backdrop_thumbhash, logo_path, overview_source, tagline_source)
+		VALUES ('provider', 'de', '', '', 'Anbieter.', 'Von Hand.', '', '', '', '', '', 'provider', 'manual'),
+		       ('ai', 'de', '', '', 'Alt KI.', '', '', '', '', '', '', 'ai', 'provider');
+		INSERT INTO season_localizations (season_content_id, language, title, overview, poster_path, poster_thumbhash, overview_source)
+		VALUES ('season', 'de', '', 'Anbieter.', '', '', 'provider');
+		INSERT INTO episode_localizations (episode_content_id, language, title, overview, overview_source)
+		VALUES ('episode', 'de', '', 'Anbieter.', 'provider');
+	`); err != nil {
+		t.Fatal(err)
+	}
+	items := NewMediaItemLocalizationRepository(pool)
+	text := func(v string) *string { return &v }
+	for _, id := range []string{"provider", "ai"} {
+		if err := items.UpsertAITranslation(t.Context(), id, "de", text("Neu KI."), text("Neu KI.")); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := NewSeasonLocalizationRepository(pool).UpsertAIOverview(t.Context(), "season", "de", "Neu KI."); err != nil {
+		t.Fatal(err)
+	}
+	if err := NewEpisodeLocalizationRepository(pool).UpsertAIOverview(t.Context(), "episode", "de", "Neu KI."); err != nil {
+		t.Fatal(err)
+	}
+
+	provider, err := items.Get(t.Context(), "provider", "de")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if provider.Overview != "Anbieter." || provider.OverviewSource != "provider" || provider.Tagline != "Von Hand." || provider.TaglineSource != "manual" {
+		t.Errorf("provider/manual item = %+v, want both kept", provider)
+	}
+	ai, err := items.Get(t.Context(), "ai", "de")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if ai.Overview != "Neu KI." || ai.OverviewSource != "ai" || ai.Tagline != "Neu KI." || ai.TaglineSource != "ai" {
+		t.Errorf("ai item = %+v, want the AI overview refreshed and the empty tagline filled", ai)
+	}
+	season, err := NewSeasonLocalizationRepository(pool).Get(t.Context(), "season", "de")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if season.Overview != "Anbieter." || season.OverviewSource != "provider" {
+		t.Errorf("season = %+v, want the provider overview kept", season)
+	}
+	episode, err := NewEpisodeLocalizationRepository(pool).Get(t.Context(), "episode", "de")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if episode.Overview != "Anbieter." || episode.OverviewSource != "provider" {
+		t.Errorf("episode = %+v, want the provider overview kept", episode)
+	}
+}
diff --git a/internal/catalog/localization_repo.go b/internal/catalog/localization_repo.go
index ad7f0b4e3a..255ac868e4 100644
--- a/internal/catalog/localization_repo.go
+++ b/internal/catalog/localization_repo.go
@@ -85,12 +85,12 @@ func (r *MediaItemLocalizationRepository) Upsert(ctx context.Context, loc *model
 }
 
 // UpsertAITranslation writes AI-translated overview/tagline values. A nil
-// pointer leaves that field untouched. Per field, the write lands when the
-// existing value is empty or already AI-sourced; force additionally overwrites
-// provider values (the admin explicitly asked to re-translate). Manual values
-// are never overwritten. Rows created here carry empty titles/artwork — the
-// serving layer falls back to the base item for empty localized fields.
-func (r *MediaItemLocalizationRepository) UpsertAITranslation(ctx context.Context, contentID, language string, overview, tagline *string, force bool) error {
+// pointer leaves that field untouched. Per field, the write lands only when the
+// existing value is empty or already AI-sourced: provider and manual text is
+// never overwritten, not even by an explicit re-translation. Rows created here
+// carry empty titles/artwork — the serving layer falls back to the base item
+// for empty localized fields.
+func (r *MediaItemLocalizationRepository) UpsertAITranslation(ctx context.Context, contentID, language string, overview, tagline *string) error {
 	if contentID == "" || language == "" {
 		return fmt.Errorf("invalid media item AI localization")
 	}
@@ -115,29 +115,29 @@ func (r *MediaItemLocalizationRepository) UpsertAITranslation(ctx context.Contex
 			overview = CASE
 				WHEN $3::text IS NULL OR media_item_localizations.overview_source = 'manual'
 					THEN media_item_localizations.overview
-				WHEN $5 OR media_item_localizations.overview_source = 'ai' OR media_item_localizations.overview = ''
+				WHEN media_item_localizations.overview_source = 'ai' OR media_item_localizations.overview = ''
 					THEN EXCLUDED.overview
 				ELSE media_item_localizations.overview END,
 			overview_source = CASE
 				WHEN $3::text IS NULL OR media_item_localizations.overview_source = 'manual'
 					THEN media_item_localizations.overview_source
-				WHEN $5 OR media_item_localizations.overview_source = 'ai' OR media_item_localizations.overview = ''
+				WHEN media_item_localizations.overview_source = 'ai' OR media_item_localizations.overview = ''
 					THEN 'ai'
 				ELSE media_item_localizations.overview_source END,
 			tagline = CASE
 				WHEN $4::text IS NULL OR media_item_localizations.tagline_source = 'manual'
 					THEN media_item_localizations.tagline
-				WHEN $5 OR media_item_localizations.tagline_source = 'ai' OR media_item_localizations.tagline = ''
+				WHEN media_item_localizations.tagline_source = 'ai' OR media_item_localizations.tagline = ''
 					THEN EXCLUDED.tagline
 				ELSE media_item_localizations.tagline END,
 			tagline_source = CASE
 				WHEN $4::text IS NULL OR media_item_localizations.tagline_source = 'manual'
 					THEN media_item_localizations.tagline_source
-				WHEN $5 OR media_item_localizations.tagline_source = 'ai' OR media_item_localizations.tagline = ''
+				WHEN media_item_localizations.tagline_source = 'ai' OR media_item_localizations.tagline = ''
 					THEN 'ai'
 				ELSE media_item_localizations.tagline_source END,
 			updated_at = NOW()
-	`, contentID, language, overview, tagline, force)
+	`, contentID, language, overview, tagline)
 	if err != nil {
 		return fmt.Errorf("upserting media item AI localization: %w", err)
 	}
@@ -336,7 +336,7 @@ func (r *SeasonLocalizationRepository) BulkUpsert(ctx context.Context, localizat
 
 // UpsertAIOverview writes an AI-translated season overview (see
 // MediaItemLocalizationRepository.UpsertAITranslation for the precedence).
-func (r *SeasonLocalizationRepository) UpsertAIOverview(ctx context.Context, seasonContentID, language, overview string, force bool) error {
+func (r *SeasonLocalizationRepository) UpsertAIOverview(ctx context.Context, seasonContentID, language, overview string) error {
 	if seasonContentID == "" || language == "" {
 		return fmt.Errorf("invalid season AI localization")
 	}
@@ -348,17 +348,17 @@ func (r *SeasonLocalizationRepository) UpsertAIOverview(ctx context.Context, sea
 			overview = CASE
 				WHEN season_localizations.overview_source = 'manual'
 					THEN season_localizations.overview
-				WHEN $4 OR season_localizations.overview_source = 'ai' OR season_localizations.overview = ''
+				WHEN season_localizations.overview_source = 'ai' OR season_localizations.overview = ''
 					THEN EXCLUDED.overview
 				ELSE season_localizations.overview END,
 			overview_source = CASE
 				WHEN season_localizations.overview_source = 'manual'
 					THEN season_localizations.overview_source
-				WHEN $4 OR season_localizations.overview_source = 'ai' OR season_localizations.overview = ''
+				WHEN season_localizations.overview_source = 'ai' OR season_localizations.overview = ''
 					THEN 'ai'
 				ELSE season_localizations.overview_source END,
 			updated_at = NOW()
-	`, seasonContentID, language, overview, force)
+	`, seasonContentID, language, overview)
 	if err != nil {
 		return fmt.Errorf("upserting season AI localization: %w", err)
 	}
@@ -501,7 +501,7 @@ func (r *EpisodeLocalizationRepository) BulkUpsert(ctx context.Context, localiza
 
 // UpsertAIOverview writes an AI-translated episode overview (see
 // MediaItemLocalizationRepository.UpsertAITranslation for the precedence).
-func (r *EpisodeLocalizationRepository) UpsertAIOverview(ctx context.Context, episodeContentID, language, overview string, force bool) error {
+func (r *EpisodeLocalizationRepository) UpsertAIOverview(ctx context.Context, episodeContentID, language, overview string) error {
 	if episodeContentID == "" || language == "" {
 		return fmt.Errorf("invalid episode AI localization")
 	}
@@ -512,17 +512,17 @@ func (r *EpisodeLocalizationRepository) UpsertAIOverview(ctx context.Context, ep
 			overview = CASE
 				WHEN episode_localizations.overview_source = 'manual'
 					THEN episode_localizations.overview
-				WHEN $4 OR episode_localizations.overview_source = 'ai' OR episode_localizations.overview = ''
+				WHEN episode_localizations.overview_source = 'ai' OR episode_localizations.overview = ''
 					THEN EXCLUDED.overview
 				ELSE episode_localizations.overview END,
 			overview_source = CASE
 				WHEN episode_localizations.overview_source = 'manual'
 					THEN episode_localizations.overview_source
-				WHEN $4 OR episode_localizations.overview_source = 'ai' OR episode_localizations.overview = ''
+				WHEN episode_localizations.overview_source = 'ai' OR episode_localizations.overview = ''
 					THEN 'ai'
 				ELSE episode_localizations.overview_source END,
 			updated_at = NOW()
-	`, episodeContentID, language, overview, force)
+	`, episodeContentID, language, overview)
 	if err != nil {
 		return fmt.Errorf("upserting episode AI localization: %w", err)
 	}
diff --git a/internal/catalog/localize.go b/internal/catalog/localize.go
index 0cd1790633..f847755e20 100644
--- a/internal/catalog/localize.go
+++ b/internal/catalog/localize.go
@@ -11,6 +11,12 @@ import (
 // metadata because metadata already depends on catalog.
 const fieldImagesLocked = 10
 
+// Machine-translated field names, as MachineTranslatedFields reports them.
+const (
+	MachineTranslatedOverview = "overview"
+	MachineTranslatedTagline  = "tagline"
+)
+
 // applyItemLocalization merges a localization onto a clone of item. Only
 // non-empty localized fields override the base — localization rows are
 // legitimately partial (an AI translation carries only overview/tagline; a
@@ -23,6 +29,8 @@ func applyItemLocalization(item *models.MediaItem, loc *models.MediaItemLocaliza
 	if localized == nil || loc == nil {
 		return localized
 	}
+	// The markers describe this localization only, never a previous one.
+	localized.MachineTranslatedFields = nil
 	if loc.Title != "" {
 		localized.Title = loc.Title
 	}
@@ -31,9 +39,15 @@ func applyItemLocalization(item *models.MediaItem, loc *models.MediaItemLocaliza
 	}
 	if loc.Overview != "" {
 		localized.Overview = loc.Overview
+		if loc.OverviewSource == models.LocalizationSourceAI {
+			localized.MachineTranslatedFields = append(localized.MachineTranslatedFields, MachineTranslatedOverview)
+		}
 	}
 	if loc.Tagline != "" {
 		localized.Tagline = loc.Tagline
+		if loc.TaglineSource == models.LocalizationSourceAI {
+			localized.MachineTranslatedFields = append(localized.MachineTranslatedFields, MachineTranslatedTagline)
+		}
 	}
 	imagesLocked := slices.Contains(item.LockedFields, fieldImagesLocked)
 	if !imagesLocked && loc.PosterPath != "" && !artworkkey.IsLocal(item.PosterPath) {
@@ -60,11 +74,16 @@ func applySeasonLocalization(season *models.Season, loc *models.SeasonLocalizati
 	if localized == nil || loc == nil {
 		return localized
 	}
+	// The markers describe this localization only, never a previous one.
+	localized.MachineTranslatedFields = nil
 	if loc.Title != "" {
 		localized.Title = loc.Title
 	}
 	if loc.Overview != "" {
 		localized.Overview = loc.Overview
+		if loc.OverviewSource == models.LocalizationSourceAI {
+			localized.MachineTranslatedFields = append(localized.MachineTranslatedFields, MachineTranslatedOverview)
+		}
 	}
 	if !imagesLocked && loc.PosterPath != "" && !artworkkey.IsLocal(season.PosterPath) {
 		localized.PosterPath = loc.PosterPath
@@ -81,11 +100,16 @@ func applyEpisodeLocalization(episode *models.Episode, loc *models.EpisodeLocali
 	if localized == nil || loc == nil {
 		return localized
 	}
+	// The markers describe this localization only, never a previous one.
+	localized.MachineTranslatedFields = nil
 	if loc.Title != "" {
 		localized.Title = loc.Title
 	}
 	if loc.Overview != "" {
 		localized.Overview = loc.Overview
+		if loc.OverviewSource == models.LocalizationSourceAI {
+			localized.MachineTranslatedFields = append(localized.MachineTranslatedFields, MachineTranslatedOverview)
+		}
 	}
 	return localized
 }
diff --git a/internal/catalog/localize_test.go b/internal/catalog/localize_test.go
index fd18ae09d7..ab60c8a816 100644
--- a/internal/catalog/localize_test.go
+++ b/internal/catalog/localize_test.go
@@ -1,6 +1,7 @@
 package catalog
 
 import (
+	"slices"
 	"testing"
 
 	"github.com/prairie-server/prairie-server/internal/models"
@@ -180,6 +181,34 @@ func TestApplyEpisodeLocalizationPartialRow(t *testing.T) {
 	}
 }
 
+// Only fields an AI job wrote are marked; provider and manual text is not.
+func TestApplyLocalizationMarksMachineTranslatedFields(t *testing.T) {
+	item := applyItemLocalization(baseItem(), &models.MediaItemLocalization{
+		Overview: "Résumé IA.", OverviewSource: "ai",
+		Tagline: "Accroche fournisseur.", TaglineSource: "provider",
+	})
+	if !slices.Equal(item.MachineTranslatedFields, []string{MachineTranslatedOverview}) {
+		t.Errorf("item markers = %v, want [overview]", item.MachineTranslatedFields)
+	}
+	// An empty AI field falls back to the base text, which is not translated.
+	item = applyItemLocalization(baseItem(), &models.MediaItemLocalization{TaglineSource: "ai", OverviewSource: "manual", Overview: "Saisi."})
+	if len(item.MachineTranslatedFields) != 0 {
+		t.Errorf("item markers = %v, want none", item.MachineTranslatedFields)
+	}
+
+	season := applySeasonLocalization(&models.Season{Overview: "Base."}, &models.SeasonLocalization{Overview: "IA.", OverviewSource: "ai"}, false)
+	if !slices.Equal(season.MachineTranslatedFields, []string{MachineTranslatedOverview}) {
+		t.Errorf("season markers = %v, want [overview]", season.MachineTranslatedFields)
+	}
+
+	// Re-localizing an already localized model reports only the new row.
+	episode := applyEpisodeLocalization(&models.Episode{Overview: "Base."}, &models.EpisodeLocalization{Overview: "IA.", OverviewSource: "ai"})
+	episode = applyEpisodeLocalization(episode, &models.EpisodeLocalization{Overview: "Anbieter.", OverviewSource: "provider"})
+	if len(episode.MachineTranslatedFields) != 0 {
+		t.Errorf("episode markers = %v, want none", episode.MachineTranslatedFields)
+	}
+}
+
 func TestApplySeasonLocalizationKeepsLocalSidecarPoster(t *testing.T) {
 	season := &models.Season{
 		ContentID:        "s1",
diff --git a/internal/catalog/nextup_repo.go b/internal/catalog/nextup_repo.go
index 0947e44d75..b8c3755a90 100644
--- a/internal/catalog/nextup_repo.go
+++ b/internal/catalog/nextup_repo.go
@@ -4,6 +4,8 @@ import (
 	"context"
 	"fmt"
 	"log/slog"
+	"slices"
+	"strings"
 	"time"
 
 	"github.com/jackc/pgx/v5/pgxpool"
@@ -23,6 +25,11 @@ type NextUpQuery struct {
 	EnableResumable  bool       // include in-progress episodes
 	EnableRewatching bool       // accepted but deferred (no-op)
 	DateCutoff       *time.Time // only series with activity after this date
+	// RankByRelease orders results by ActivityAt, so a series whose next
+	// episode was released after the profile finished the previous one moves
+	// up (the profile's ui.next_up_new_releases_first). Off, results keep the
+	// completion-time order and ActivityAt equals CompletedAt.
+	RankByRelease bool
 
 	// droppedSeriesIDs are the profile's actively dropped series, which a
 	// global lookup excludes. ListNextUp loads them; a series-scoped lookup
@@ -38,7 +45,11 @@ type NextUpResult struct {
 	SeasonNumber  int
 	EpisodeNumber int
 	CompletedAt   time.Time // when the preceding episode was completed
-	IsResumable   bool      // true if this is an in-progress item (enableResumable)
+	// ActivityAt orders the results: CompletedAt, or the time this episode was
+	// released to the server when that came later. A series the profile had
+	// caught up on moves to the front when its next episode arrives.
+	ActivityAt  time.Time
+	IsResumable bool // true if this is an in-progress item (enableResumable)
 }
 
 // NextUpRepository queries for next unwatched episodes per series.
@@ -84,7 +95,7 @@ func (r *NextUpRepository) ListNextUp(ctx context.Context, q NextUpQuery) ([]Nex
 			var res NextUpResult
 			if err := rows.Scan(
 				&res.ContentID, &res.SeriesID, &res.SeriesTitle,
-				&res.SeasonNumber, &res.EpisodeNumber, &res.CompletedAt,
+				&res.SeasonNumber, &res.EpisodeNumber, &res.CompletedAt, &res.ActivityAt,
 			); err != nil {
 				return nil, fmt.Errorf("scanning next-up row: %w", err)
 			}
@@ -94,23 +105,42 @@ func (r *NextUpRepository) ListNextUp(ctx context.Context, q NextUpQuery) ([]Nex
 			return nil, fmt.Errorf("iterating next-up rows: %w", err)
 		}
 	} else {
-		remaining := limit
 		var cursor *nextUpWalkCursor
 		batchesRun := 0
 		exhausted := false
 
-		// Every batch resumes below the previous compound frontier, so appending
-		// batches preserves strictly descending (updated_at, media_item_id) order.
+		// The walk visits series by completion time and, by default, stops
+		// once it has limit rows, each batch asking only for the rows still
+		// missing. With RankByRelease, the first whole batches holding at
+		// least nextUpRankedCandidates rows are ranked by ActivityAt, so a
+		// newly released episode can lift its series to the front; a batch
+		// then keeps every walked series' row because trimming it by
+		// completion time could drop one. Rows from later batches, walked only
+		// for larger limits, follow in completion order without being lifted.
+		// The ranked set never depends on the limit, so every limit reads a
+		// prefix of one order and a Jellyfin client paging by raising the
+		// limit sees no row twice.
+		walkUntil := limit
+		if q.RankByRelease {
+			walkUntil = max(limit, nextUpRankedCandidates)
+		}
+		ranked := -1
 		for batch := 0; batch < nextUpAnchorMaxBatches; batch++ {
-			batchResults, frontier, err := r.listNextUpBatch(ctx, q, remaining, cursor)
+			batchLimit := walkUntil - len(results)
+			if q.RankByRelease {
+				batchLimit = nextUpAnchorMaxSeries
+			}
+			batchResults, frontier, err := r.listNextUpBatch(ctx, q, batchLimit, cursor)
 			if err != nil {
 				return nil, err
 			}
 			batchesRun++
 			results = append(results, batchResults...)
-			remaining -= len(batchResults)
+			if ranked < 0 && len(results) >= nextUpRankedCandidates {
+				ranked = len(results)
+			}
 
-			if remaining <= 0 {
+			if len(results) >= walkUntil {
 				exhausted = true
 				break
 			}
@@ -121,13 +151,23 @@ func (r *NextUpRepository) ListNextUp(ctx context.Context, q NextUpQuery) ([]Nex
 			cursor = &frontier.nextUpWalkCursor
 		}
 
-		if !exhausted && remaining > 0 {
+		if !exhausted {
 			slog.WarnContext(ctx, "next-up anchor walk hit batch cap; eligible series tail left unscanned",
 				"component", "catalog",
 				"profile_id", q.ProfileID,
 				"batches", batchesRun,
 				"results_found", len(results))
 		}
+
+		if q.RankByRelease {
+			if ranked < 0 {
+				ranked = len(results)
+			}
+			sortNextUpByActivity(results[:ranked])
+		}
+		if len(results) > limit {
+			results = results[:limit]
+		}
 	}
 
 	if q.EnableResumable {
@@ -159,6 +199,20 @@ func (r *NextUpRepository) ListNextUp(ctx context.Context, q NextUpQuery) ([]Nex
 	return results, nil
 }
 
+// sortNextUpByActivity orders next-up rows by ActivityAt, newest first, with
+// completion time and then series ID (one row per series) breaking ties.
+func sortNextUpByActivity(results []NextUpResult) {
+	slices.SortFunc(results, func(a, b NextUpResult) int {
+		if c := b.ActivityAt.Compare(a.ActivityAt); c != 0 {
+			return c
+		}
+		if c := b.CompletedAt.Compare(a.CompletedAt); c != 0 {
+			return c
+		}
+		return strings.Compare(a.SeriesID, b.SeriesID)
+	})
+}
+
 type nextUpWalkCursor struct {
 	updatedAt   time.Time
 	mediaItemID string
@@ -181,6 +235,15 @@ const nextUpAnchorMaxSeries = 96
 // as a runaway guard.
 const nextUpAnchorMaxBatches = 10
 
+// nextUpRankedCandidates is how many next-up rows a global call ranks by
+// ActivityAt, rounded up to whole walk batches, whatever its limit: the Home
+// row size. A series finished before all of them keeps its completion-time
+// place even when its next episode was just released — the bound the walk
+// exists for.
+const nextUpRankedCandidates = 100
+
+// listNextUpBatch walks one batch of up to nextUpAnchorMaxSeries series and
+// returns up to limit of their next-up rows, newest completion first.
 func (r *NextUpRepository) listNextUpBatch(
 	ctx context.Context,
 	q NextUpQuery,
@@ -200,7 +263,7 @@ func (r *NextUpRepository) listNextUpBatch(
 		currentFrontier := nextUpWalkFrontier{}
 		var contentID, seriesID, seriesTitle *string
 		var seasonNumber, episodeNumber *int
-		var completedAt *time.Time
+		var completedAt, activityAt *time.Time
 		if err := rows.Scan(
 			&currentFrontier.updatedAt,
 			&currentFrontier.mediaItemID,
@@ -212,6 +275,7 @@ func (r *NextUpRepository) listNextUpBatch(
 			&seasonNumber,
 			&episodeNumber,
 			&completedAt,
+			&activityAt,
 		); err != nil {
 			return nil, nil, fmt.Errorf("scanning next-up row: %w", err)
 		}
@@ -226,6 +290,7 @@ func (r *NextUpRepository) listNextUpBatch(
 			SeasonNumber:  *seasonNumber,
 			EpisodeNumber: *episodeNumber,
 			CompletedAt:   *completedAt,
+			ActivityAt:    *activityAt,
 		})
 	}
 	if err := rows.Err(); err != nil {
@@ -234,6 +299,47 @@ func (r *NextUpRepository) listNextUpBatch(
 	return results, frontier, nil
 }
 
+// nextUpReleaseLateral finds when a next-up episode was released to the
+// server: the released_at of its earliest episode_availability row in scope.
+// The notifications availability detector sets released_at to the row's
+// available_at only for an episode that arrived after its library's first
+// full scan and whose file is new, so initial scans, imported history, late
+// metadata matches and files that come back never move a series; an episode
+// that lands later does. A content-ID merge (prairie_rename_content_ids) can
+// give a row an earlier available_at from a row it absorbed, which is no
+// longer a release time, so the two must still match.
+const nextUpReleaseLateral = `LEFT JOIN LATERAL (
+			SELECT CASE WHEN ea.released_at = ea.available_at THEN ea.released_at END AS released_at
+			FROM episode_availability ea
+			WHERE ea.episode_id = next_ep.content_id%s
+			ORDER BY ea.available_at, ea.library_id
+			LIMIT 1
+		) released ON true`
+
+// nextUpReleaseScope limits release lookups to the libraries the request can
+// reach, so an episode that arrived where the viewer can't follow never moves
+// a series ahead of one they can watch.
+func nextUpReleaseScope(q NextUpQuery, argIdx int) (string, []interface{}) {
+	var requested []int
+	if q.LibraryID != nil {
+		requested = []int{*q.LibraryID}
+	} else {
+		requested = q.LibraryIDs
+	}
+	ids, none := q.AccessFilter.LibraryScope(requested)
+	if none {
+		ids = []int{}
+	}
+	switch {
+	case ids != nil:
+		return fmt.Sprintf(" AND ea.library_id = ANY($%d::int[])", argIdx), []interface{}{ids}
+	case len(q.AccessFilter.DisabledLibraryIDs) > 0:
+		return fmt.Sprintf(" AND NOT (ea.library_id = ANY($%d::int[]))", argIdx), []interface{}{q.AccessFilter.DisabledLibraryIDs}
+	default:
+		return "", nil
+	}
+}
+
 func buildListNextUpQuery(q NextUpQuery, limit int, cursor *nextUpWalkCursor) (string, []interface{}) {
 	args := []interface{}{q.UserID, q.ProfileID, limit}
 	argIdx := 4
@@ -275,6 +381,17 @@ func buildListNextUpQuery(q NextUpQuery, limit int, cursor *nextUpWalkCursor) (s
 		droppedFilter = fmt.Sprintf(`
 					  AND NOT (e.series_id = ANY($%d::text[]))`, argIdx)
 		args = append(args, q.droppedSeriesIDs)
+		argIdx++
+	}
+
+	// Without RankByRelease the release lookup is skipped and a row's
+	// activity is its completion time.
+	releaseLateral, activityExpr := "", "es.updated_at"
+	if q.RankByRelease {
+		releaseScope, releaseArgs := nextUpReleaseScope(q, argIdx)
+		args = append(args, releaseArgs...)
+		releaseLateral = fmt.Sprintf(nextUpReleaseLateral, releaseScope)
+		activityExpr = "GREATEST(es.updated_at, released.released_at)"
 	}
 
 	// When resumable items are disabled, suppress next-up only if the series has
@@ -463,7 +580,8 @@ func buildListNextUpQuery(q NextUpQuery, limit int, cursor *nextUpWalkCursor) (s
 			si.title,
 			next_ep.season_number,
 			next_ep.episode_number,
-			es.updated_at
+			es.updated_at,
+			%s
 		FROM %s es
 		JOIN media_items si ON si.content_id = es.series_id
 		JOIN LATERAL (
@@ -482,8 +600,9 @@ func buildListNextUpQuery(q NextUpQuery, limit int, cursor *nextUpWalkCursor) (s
 			ORDER BY e2.season_number, e2.episode_number
 			LIMIT 1
 		) next_ep ON true
+		%s
 		ORDER BY es.updated_at DESC
-		LIMIT $3`, completedEpisodesCTE, inProgressExclusion, sourceTable)
+		LIMIT $3`, completedEpisodesCTE, inProgressExclusion, activityExpr, sourceTable, releaseLateral)
 		return query, args
 	}
 
@@ -494,7 +613,8 @@ func buildListNextUpQuery(q NextUpQuery, limit int, cursor *nextUpWalkCursor) (s
 			si.title,
 			next_ep.season_number,
 			next_ep.episode_number,
-			es.updated_at AS completed_at
+			es.updated_at AS completed_at,
+			%s AS activity_at
 		FROM %s es
 		JOIN media_items si ON si.content_id = es.series_id
 		JOIN LATERAL (
@@ -513,8 +633,9 @@ func buildListNextUpQuery(q NextUpQuery, limit int, cursor *nextUpWalkCursor) (s
 			ORDER BY e2.season_number, e2.episode_number
 			LIMIT 1
 		) next_ep ON true
+		%s
 		ORDER BY es.updated_at DESC
-		LIMIT $3`, sourceTable)
+		LIMIT $3`, activityExpr, sourceTable, releaseLateral)
 
 	query := fmt.Sprintf(`
 		WITH %s
@@ -536,7 +657,8 @@ func buildListNextUpQuery(q NextUpQuery, limit int, cursor *nextUpWalkCursor) (s
 			r.title,
 			r.season_number,
 			r.episode_number,
-			r.completed_at
+			r.completed_at,
+			r.activity_at
 		FROM frontier f
 		LEFT JOIN (
 			%s
@@ -658,6 +780,7 @@ func (r *NextUpRepository) listResumableFirstEpisodes(ctx context.Context, q Nex
 		); err != nil {
 			return nil, fmt.Errorf("scanning resumable row: %w", err)
 		}
+		res.ActivityAt = res.CompletedAt
 		results = append(results, res)
 	}
 	return results, rows.Err()
diff --git a/internal/catalog/nextup_repo_test.go b/internal/catalog/nextup_repo_test.go
index b5effa7e37..de9dc9018d 100644
--- a/internal/catalog/nextup_repo_test.go
+++ b/internal/catalog/nextup_repo_test.go
@@ -799,3 +799,437 @@ func TestNextUpRepository_DroppedSeriesHiddenUntilWatchedAgain(t *testing.T) {
 	}
 	assertNextUpContentIDs(t, results, episodes[2], episodes[4])
 }
+
+func TestNextUpRepository_ReleasedEpisodeMovesCaughtUpSeriesForward(t *testing.T) {
+	pool := newNextUpTestPool(t)
+	ctx := context.Background()
+	prefix := fmt.Sprintf("nextup-released-%d", time.Now().UnixNano())
+	weekly, binge, rerun := prefix+"-weekly", prefix+"-binge", prefix+"-rerun"
+
+	userID, profileID, folderID := seedNextUpTestOwner(t, ctx, pool, prefix)
+	t.Cleanup(func() {
+		_, _ = pool.Exec(ctx, `DELETE FROM episode_availability WHERE library_id = $1`, folderID)
+		_, _ = pool.Exec(ctx, `DELETE FROM media_items WHERE content_id = ANY($1)`, []string{weekly, binge, rerun})
+	})
+	for _, id := range []string{weekly, binge, rerun} {
+		seedNextUpSeries(t, ctx, pool, id, id)
+	}
+	episodes := []string{weekly + "-1", weekly + "-2", binge + "-1", binge + "-2", rerun + "-1", rerun + "-2"}
+	seedNextUpEpisodes(t, ctx, pool, episodes, []string{weekly, weekly, binge, binge, rerun, rerun}, []int{1, 2, 1, 2, 1, 2})
+	seedNextUpFiles(t, ctx, pool, folderID, episodes)
+
+	now := time.Now().UTC().Truncate(time.Microsecond)
+	// The weekly show's next episode was released two hours ago, a week after
+	// the profile caught up. The binge's next episode was released before the
+	// profile finished the previous one. The rerun's was recorded silently.
+	seedNextUpAvailability(t, ctx, pool, folderID, episodes[1], weekly, 2, now.Add(-2*time.Hour), true)
+	seedNextUpAvailability(t, ctx, pool, folderID, episodes[3], binge, 2, now.Add(-5*24*time.Hour), true)
+	seedNextUpAvailability(t, ctx, pool, folderID, episodes[5], rerun, 2, now.Add(-time.Hour), false)
+	weeklyDone := now.Add(-8 * 24 * time.Hour)
+	bingeDone := now.Add(-time.Hour)
+	rerunDone := now.Add(-24 * time.Hour)
+	seedNextUpCompleted(t, ctx, pool, userID, profileID, map[string]time.Time{
+		episodes[0]: weeklyDone, episodes[2]: bingeDone, episodes[4]: rerunDone,
+	})
+
+	repo := NewNextUpRepository(pool, nextUpTestStoreProvider{})
+	results, err := repo.ListNextUp(ctx, NextUpQuery{UserID: userID, ProfileID: profileID, RankByRelease: true, Limit: 20})
+	if err != nil {
+		t.Fatalf("ListNextUp: %v", err)
+	}
+	assertNextUpOrder(t, results, episodes[3], episodes[1], episodes[5])
+	if got := results[1]; !got.ActivityAt.Equal(now.Add(-2*time.Hour)) || !got.CompletedAt.Equal(weeklyDone) {
+		t.Errorf("weekly ActivityAt=%v CompletedAt=%v, want release %v and completion %v", got.ActivityAt, got.CompletedAt, now.Add(-2*time.Hour), weeklyDone)
+	}
+	if got := results[0]; !got.ActivityAt.Equal(bingeDone) {
+		t.Errorf("binge ActivityAt=%v, want its completion %v", got.ActivityAt, bingeDone)
+	}
+
+	// Without the profile's opt-in, the order stays by completion time.
+	results, err = repo.ListNextUp(ctx, NextUpQuery{UserID: userID, ProfileID: profileID, Limit: 20})
+	if err != nil {
+		t.Fatalf("ListNextUp by completion: %v", err)
+	}
+	assertNextUpOrder(t, results, episodes[3], episodes[5], episodes[1])
+	for _, res := range results {
+		if !res.ActivityAt.Equal(res.CompletedAt) {
+			t.Errorf("%s ActivityAt=%v without RankByRelease, want its completion %v", res.ContentID, res.ActivityAt, res.CompletedAt)
+		}
+	}
+
+	// A limit below the candidate count keeps the released episode: the walk
+	// visits the rerun before the weekly show, but the order is by activity.
+	results, err = repo.ListNextUp(ctx, NextUpQuery{UserID: userID, ProfileID: profileID, RankByRelease: true, Limit: 2})
+	if err != nil {
+		t.Fatalf("ListNextUp limit 2: %v", err)
+	}
+	assertNextUpOrder(t, results, episodes[3], episodes[1])
+
+	// The series' own lookup reports the same activity time.
+	results, err = repo.ListNextUp(ctx, NextUpQuery{UserID: userID, ProfileID: profileID, RankByRelease: true, SeriesID: weekly, Limit: 1})
+	if err != nil {
+		t.Fatalf("ListNextUp scoped: %v", err)
+	}
+	assertNextUpOrder(t, results, episodes[1])
+	if !results[0].ActivityAt.Equal(now.Add(-2 * time.Hour)) {
+		t.Errorf("scoped ActivityAt=%v, want %v", results[0].ActivityAt, now.Add(-2*time.Hour))
+	}
+}
+
+func TestNextUpRepository_EarliestAvailabilityDecidesRelease(t *testing.T) {
+	pool := newNextUpTestPool(t)
+	ctx := context.Background()
+	prefix := fmt.Sprintf("nextup-earliest-%d", time.Now().UnixNano())
+	older, newer := prefix+"-older", prefix+"-newer"
+
+	userID, profileID, folderID := seedNextUpTestOwner(t, ctx, pool, prefix)
+	otherFolder := seedNextUpFolder(t, ctx, pool, prefix+" Other")
+	t.Cleanup(func() {
+		_, _ = pool.Exec(ctx, `DELETE FROM episode_availability WHERE library_id = ANY($1)`, []int{folderID, otherFolder})
+		_, _ = pool.Exec(ctx, `DELETE FROM media_items WHERE content_id = ANY($1)`, []string{older, newer})
+	})
+	seedNextUpSeries(t, ctx, pool, older, older)
+	seedNextUpSeries(t, ctx, pool, newer, newer)
+	episodes := []string{older + "-1", older + "-2", newer + "-1", newer + "-2"}
+	seedNextUpEpisodes(t, ctx, pool, episodes, []string{older, older, newer, newer}, []int{1, 2, 1, 2})
+	seedNextUpFiles(t, ctx, pool, folderID, episodes)
+
+	// The older series' next episode was already on the server, recorded
+	// silently, before a second library received it as a release: it is not
+	// news to a viewer who can reach both libraries.
+	now := time.Now().UTC().Truncate(time.Microsecond)
+	seedNextUpAvailability(t, ctx, pool, folderID, episodes[1], older, 2, now.Add(-90*24*time.Hour), false)
+	seedNextUpAvailability(t, ctx, pool, otherFolder, episodes[1], older, 2, now.Add(-time.Hour), true)
+	// The newer series' row absorbed an earlier row in a content-ID merge: its
+	// available_at is no longer the release time it carries.
+	seedNextUpAvailability(t, ctx, pool, folderID, episodes[3], newer, 2, now.Add(-90*24*time.Hour), false)
+	if _, err := pool.Exec(ctx, `UPDATE episode_availability SET released_at = $3 WHERE library_id = $1 AND episode_id = $2`,
+		folderID, episodes[3], now.Add(-time.Hour)); err != nil {
+		t.Fatalf("seed merged availability: %v", err)
+	}
+	seedNextUpCompleted(t, ctx, pool, userID, profileID, map[string]time.Time{
+		episodes[0]: now.Add(-300 * 24 * time.Hour),
+		episodes[2]: now.Add(-200 * 24 * time.Hour),
+	})
+
+	repo := NewNextUpRepository(pool, nextUpTestStoreProvider{})
+	results, err := repo.ListNextUp(ctx, NextUpQuery{UserID: userID, ProfileID: profileID, RankByRelease: true, Limit: 20})
+	if err != nil {
+		t.Fatalf("ListNextUp: %v", err)
+	}
+	assertNextUpOrder(t, results, episodes[3], episodes[1])
+	for _, res := range results {
+		if !res.ActivityAt.Equal(res.CompletedAt) {
+			t.Errorf("%s ActivityAt=%v, want its completion %v", res.ContentID, res.ActivityAt, res.CompletedAt)
+		}
+	}
+
+	// A viewer who can reach only the second library sees the release.
+	results, err = repo.ListNextUp(ctx, NextUpQuery{
+		UserID: userID, ProfileID: profileID, Limit: 20, RankByRelease: true,
+		AccessFilter: AccessFilter{AllowedLibraryIDs: []int{otherFolder}},
+	})
+	if err != nil {
+		t.Fatalf("ListNextUp other library: %v", err)
+	}
+	assertNextUpOrder(t, results, episodes[1], episodes[3])
+}
+
+func TestNextUpRepository_ReleaseOutsideScopeKeepsCompletionOrder(t *testing.T) {
+	pool := newNextUpTestPool(t)
+	ctx := context.Background()
+	prefix := fmt.Sprintf("nextup-release-scope-%d", time.Now().UnixNano())
+	visible, elsewhere := prefix+"-visible", prefix+"-elsewhere"
+
+	userID, profileID, folderID := seedNextUpTestOwner(t, ctx, pool, prefix)
+	otherFolder := seedNextUpFolder(t, ctx, pool, prefix+" Other")
+	t.Cleanup(func() {
+		_, _ = pool.Exec(ctx, `DELETE FROM episode_availability WHERE library_id = ANY($1)`, []int{folderID, otherFolder})
+		_, _ = pool.Exec(ctx, `DELETE FROM media_items WHERE content_id = ANY($1)`, []string{visible, elsewhere})
+	})
+	seedNextUpSeries(t, ctx, pool, visible, visible)
+	seedNextUpSeries(t, ctx, pool, elsewhere, elsewhere)
+	episodes := []string{visible + "-1", visible + "-2", elsewhere + "-1", elsewhere + "-2"}
+	seedNextUpEpisodes(t, ctx, pool, episodes, []string{visible, visible, elsewhere, elsewhere}, []int{1, 2, 1, 2})
+	seedNextUpFiles(t, ctx, pool, folderID, episodes[:3])
+	seedNextUpFiles(t, ctx, pool, otherFolder, episodes[3:])
+
+	now := time.Now().UTC().Truncate(time.Microsecond)
+	seedNextUpAvailability(t, ctx, pool, folderID, episodes[1], visible, 2, now.Add(-30*24*time.Hour), false)
+	// The other series' next episode was released an hour ago, in a library
+	// the request may not reach.
+	seedNextUpAvailability(t, ctx, pool, otherFolder, episodes[3], elsewhere, 2, now.Add(-time.Hour), true)
+	seedNextUpCompleted(t, ctx, pool, userID, profileID, map[string]time.Time{
+		episodes[0]: now.Add(-24 * time.Hour),
+		episodes[2]: now.Add(-10 * 24 * time.Hour),
+	})
+
+	repo := NewNextUpRepository(pool, nextUpTestStoreProvider{})
+	base := NextUpQuery{UserID: userID, ProfileID: profileID, RankByRelease: true, Limit: 20}
+	results, err := repo.ListNextUp(ctx, base)
+	if err != nil {
+		t.Fatalf("ListNextUp: %v", err)
+	}
+	assertNextUpOrder(t, results, episodes[3], episodes[1])
+
+	scoped := map[string]NextUpQuery{}
+	q := base
+	q.AccessFilter = AccessFilter{AllowedLibraryIDs: []int{folderID}}
+	scoped["access group"] = q
+	q = base
+	q.LibraryID = &folderID
+	scoped["section library"] = q
+	q = base
+	q.AccessFilter = AccessFilter{DisabledLibraryIDs: []int{otherFolder}}
+	scoped["disabled library"] = q
+	for name, q := range scoped {
+		results, err := repo.ListNextUp(ctx, q)
+		if err != nil {
+			t.Fatalf("%s: ListNextUp: %v", name, err)
+		}
+		assertNextUpOrder(t, results, episodes[1], episodes[3])
+	}
+}
+
+func TestNextUpRepository_SmallerLimitReadsPrefixOfLargerLimit(t *testing.T) {
+	pool := newNextUpTestPool(t)
+	ctx := context.Background()
+	prefix := fmt.Sprintf("nextup-prefix-%d", time.Now().UnixNano())
+	userID, profileID, folderID := seedNextUpTestOwner(t, ctx, pool, prefix)
+	t.Cleanup(func() {
+		_, _ = pool.Exec(ctx, `DELETE FROM episode_availability WHERE library_id = $1`, folderID)
+		_, _ = pool.Exec(ctx, `DELETE FROM media_items WHERE content_id LIKE $1`, prefix+"-%")
+	})
+
+	// A full first walk batch: two series with a next episode, then finished
+	// series with none. The returning series was finished before all of them,
+	// so the walk reaches it only in a later batch; its next episode was just
+	// released.
+	now := time.Now().UTC().Truncate(time.Microsecond)
+	if _, err := pool.Exec(ctx, `
+		INSERT INTO media_items (content_id, type, title, status, genres)
+		SELECT $1 || '-finished-' || n, 'series', 'Finished ' || n, 'matched', '{}'::text[]
+		FROM generate_series(1, $2) n;
+		`, prefix, nextUpAnchorMaxSeries); err != nil {
+		t.Fatalf("seed finished series: %v", err)
+	}
+	if _, err := pool.Exec(ctx, `
+		INSERT INTO episodes (content_id, series_id, season_number, episode_number, title)
+		SELECT $1 || '-finished-' || n || '-1', $1 || '-finished-' || n, 1, 1, 'Only'
+		FROM generate_series(1, $2) n`, prefix, nextUpAnchorMaxSeries); err != nil {
+		t.Fatalf("seed finished episodes: %v", err)
+	}
+	if _, err := pool.Exec(ctx, `
+		INSERT INTO user_watch_progress (user_id, profile_id, media_item_id, position_seconds, duration_seconds, completed, updated_at)
+		SELECT $1, $2, $3 || '-finished-' || n || '-1', 0, 1800, TRUE, $4::timestamptz - n * interval '1 minute'
+		FROM generate_series(1, $5) n`, userID, profileID, prefix, now.Add(-24*time.Hour), nextUpAnchorMaxSeries); err != nil {
+		t.Fatalf("seed finished progress: %v", err)
+	}
+
+	recentA, recentB, returning := prefix+"-recent-a", prefix+"-recent-b", prefix+"-returning"
+	for _, id := range []string{recentA, recentB, returning} {
+		seedNextUpSeries(t, ctx, pool, id, id)
+	}
+	episodes := []string{recentA + "-1", recentA + "-2", recentB + "-1", recentB + "-2", returning + "-1", returning + "-2"}
+	seedNextUpEpisodes(t, ctx, pool, episodes, []string{recentA, recentA, recentB, recentB, returning, returning}, []int{1, 2, 1, 2, 1, 2})
+	seedNextUpFiles(t, ctx, pool, folderID, episodes)
+	seedNextUpAvailability(t, ctx, pool, folderID, episodes[5], returning, 2, now.Add(-time.Hour), true)
+	seedNextUpCompleted(t, ctx, pool, userID, profileID, map[string]time.Time{
+		episodes[0]: now.Add(-2 * time.Hour),
+		episodes[2]: now.Add(-3 * time.Hour),
+		episodes[4]: now.Add(-400 * 24 * time.Hour),
+	})
+
+	repo := NewNextUpRepository(pool, nextUpTestStoreProvider{})
+	all, err := repo.ListNextUp(ctx, NextUpQuery{UserID: userID, ProfileID: profileID, RankByRelease: true, Limit: 3})
+	if err != nil {
+		t.Fatalf("ListNextUp limit 3: %v", err)
+	}
+	assertNextUpOrder(t, all, episodes[5], episodes[1], episodes[3])
+	first, err := repo.ListNextUp(ctx, NextUpQuery{UserID: userID, ProfileID: profileID, RankByRelease: true, Limit: 1})
+	if err != nil {
+		t.Fatalf("ListNextUp limit 1: %v", err)
+	}
+	assertNextUpOrder(t, first, episodes[5])
+}
+
+func TestNextUpRepository_PagesPastRankedCandidatesKeepOneOrder(t *testing.T) {
+	pool := newNextUpTestPool(t)
+	ctx := context.Background()
+	prefix := fmt.Sprintf("nextup-pages-%d", time.Now().UnixNano())
+	userID, profileID, folderID := seedNextUpTestOwner(t, ctx, pool, prefix)
+	t.Cleanup(func() {
+		_, _ = pool.Exec(ctx, `DELETE FROM episode_availability WHERE library_id = $1`, folderID)
+		_, _ = pool.Exec(ctx, `DELETE FROM media_items WHERE content_id LIKE $1`, prefix+"-%")
+	})
+
+	// Two full walk batches of series with a next episode, plus one series
+	// finished before all of them whose next episode was just released. It
+	// sits outside the ranked candidates, so every page keeps it last.
+	total := 2*nextUpAnchorMaxSeries + 1
+	now := time.Now().UTC().Truncate(time.Microsecond)
+	for _, stmt := range []string{
+		`INSERT INTO media_items (content_id, type, title, status, genres)
+		 SELECT $1 || '-s' || n, 'series', 'Series ' || n, 'matched', '{}'::text[] FROM generate_series(1, $2) n`,
+		`INSERT INTO episodes (content_id, series_id, season_number, episode_number, title)
+		 SELECT $1 || '-s' || n || '-e' || e, $1 || '-s' || n, 1, e, 'E' || e FROM generate_series(1, $2) n, generate_series(1, 2) e`,
+	} {
+		if _, err := pool.Exec(ctx, stmt, prefix, total); err != nil {
+			t.Fatalf("seed series: %v", err)
+		}
+	}
+	if _, err := pool.Exec(ctx, `
+		INSERT INTO media_files (episode_id, media_folder_id, file_path, duration)
+		SELECT $1 || '-s' || n || '-e2', $3, '/nextup-pages/' || $1 || '/' || n || '.mkv', 1800
+		FROM generate_series(1, $2) n`, prefix, total, folderID); err != nil {
+		t.Fatalf("seed files: %v", err)
+	}
+	if _, err := pool.Exec(ctx, `
+		INSERT INTO user_watch_progress (user_id, profile_id, media_item_id, position_seconds, duration_seconds, completed, updated_at)
+		SELECT $1, $2, $3 || '-s' || n || '-e1', 0, 1800, TRUE, $4::timestamptz - n * interval '1 minute'
+		FROM generate_series(1, $5) n`, userID, profileID, prefix, now.Add(-time.Hour), total); err != nil {
+		t.Fatalf("seed progress: %v", err)
+	}
+	oldest := fmt.Sprintf("%s-s%d", prefix, total)
+	seedNextUpAvailability(t, ctx, pool, folderID, oldest+"-e2", oldest, 2, now.Add(-time.Minute), true)
+
+	repo := NewNextUpRepository(pool, nextUpTestStoreProvider{})
+	all, err := repo.ListNextUp(ctx, NextUpQuery{UserID: userID, ProfileID: profileID, RankByRelease: true, Limit: total + 23})
+	if err != nil {
+		t.Fatalf("ListNextUp all: %v", err)
+	}
+	if len(all) != total || all[total-1].SeriesID != oldest {
+		t.Fatalf("ListNextUp returned %d rows ending with %s, want %d ending with %s", len(all), all[len(all)-1].SeriesID, total, oldest)
+	}
+	for limit := 24; limit < total; limit += 24 {
+		page, err := repo.ListNextUp(ctx, NextUpQuery{UserID: userID, ProfileID: profileID, RankByRelease: true, Limit: limit})
+		if err != nil {
+			t.Fatalf("ListNextUp limit %d: %v", limit, err)
+		}
+		for i := range page {
+			if page[i].ContentID != all[i].ContentID {
+				t.Fatalf("limit %d row %d = %s, want %s", limit, i, page[i].ContentID, all[i].ContentID)
+			}
+		}
+	}
+}
+
+func TestSortNextUpByActivity_BreaksTiesByCompletionThenSeries(t *testing.T) {
+	t.Parallel()
+
+	at := time.Date(2026, 10, 1, 12, 0, 0, 0, time.UTC)
+	results := []NextUpResult{
+		{SeriesID: "c", ActivityAt: at, CompletedAt: at.Add(-2 * time.Hour)},
+		{SeriesID: "b", ActivityAt: at, CompletedAt: at.Add(-time.Hour)},
+		{SeriesID: "z", ActivityAt: at.Add(-time.Minute), CompletedAt: at.Add(-time.Minute)},
+		{SeriesID: "a", ActivityAt: at, CompletedAt: at.Add(-2 * time.Hour)},
+		{SeriesID: "y", ActivityAt: at.Add(time.Minute), CompletedAt: at.Add(-48 * time.Hour)},
+	}
+	sortNextUpByActivity(results)
+	got := make([]string, len(results))
+	for i, res := range results {
+		got[i] = res.SeriesID
+	}
+	if want := "y b a c z"; strings.Join(got, " ") != want {
+		t.Fatalf("order = %q, want %q", strings.Join(got, " "), want)
+	}
+}
+
+func TestNextUpReleaseScope(t *testing.T) {
+	t.Parallel()
+
+	five := 5
+	cases := []struct {
+		name     string
+		q        NextUpQuery
+		wantCond string
+		wantArgs []interface{}
+	}{
+		{"unrestricted", NextUpQuery{}, "", nil},
+		{"disabled", NextUpQuery{AccessFilter: AccessFilter{DisabledLibraryIDs: []int{3}}},
+			" AND NOT (ea.library_id = ANY($9::int[]))", []interface{}{[]int{3}}},
+		{"allowed", NextUpQuery{AccessFilter: AccessFilter{AllowedLibraryIDs: []int{1, 2}, DisabledLibraryIDs: []int{2}}},
+			" AND ea.library_id = ANY($9::int[])", []interface{}{[]int{1}}},
+		{"section library", NextUpQuery{LibraryID: &five}, " AND ea.library_id = ANY($9::int[])", []interface{}{[]int{5}}},
+		{"no reachable library", NextUpQuery{LibraryIDs: []int{4}, AccessFilter: AccessFilter{AllowedLibraryIDs: []int{1}}},
+			" AND ea.library_id = ANY($9::int[])", []interface{}{[]int{}}},
+	}
+	for _, tc := range cases {
+		cond, args := nextUpReleaseScope(tc.q, 9)
+		if cond != tc.wantCond || fmt.Sprint(args) != fmt.Sprint(tc.wantArgs) {
+			t.Errorf("%s: got %q %v, want %q %v", tc.name, cond, args, tc.wantCond, tc.wantArgs)
+		}
+	}
+}
+
+func seedNextUpFolder(t *testing.T, ctx context.Context, pool *pgxpool.Pool, name string) int {
+	t.Helper()
+
+	var folderID int
+	if err := pool.QueryRow(ctx, `
+		INSERT INTO media_folders (type, name, enabled)
+		VALUES ('series', $1, TRUE)
+		RETURNING id
+	`, name).Scan(&folderID); err != nil {
+		t.Fatalf("seed media folder: %v", err)
+	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(ctx, `DELETE FROM media_files WHERE media_folder_id = $1`, folderID)
+		_, _ = pool.Exec(ctx, `DELETE FROM media_folders WHERE id = $1`, folderID)
+	})
+	return folderID
+}
+
+// seedNextUpAvailability records when a season-1 episode became available in
+// the library and, when released, that the availability detector counted it
+// as a release.
+func seedNextUpAvailability(
+	t *testing.T,
+	ctx context.Context,
+	pool *pgxpool.Pool,
+	folderID int,
+	episodeID, seriesID string,
+	episodeNumber int,
+	availableAt time.Time,
+	released bool,
+) {
+	t.Helper()
+
+	var releasedAt *time.Time
+	if released {
+		releasedAt = &availableAt
+	}
+	// episode_key folds season and episode as notifications.EpisodeKey does.
+	if _, err := pool.Exec(ctx, `
+		INSERT INTO episode_availability
+			(library_id, episode_id, series_id, season_number, episode_number, episode_key, available_at, released_at)
+		VALUES ($1, $2, $3, 1, $4, 1000000 + $4, $5, $6)
+	`, folderID, episodeID, seriesID, episodeNumber, availableAt, releasedAt); err != nil {
+		t.Fatalf("seed episode availability: %v", err)
+	}
+}
+
+func seedNextUpCompleted(t *testing.T, ctx context.Context, pool *pgxpool.Pool, userID int, profileID string, completedAt map[string]time.Time) {
+	t.Helper()
+
+	for episodeID, at := range completedAt {
+		if _, err := pool.Exec(ctx, `
+			INSERT INTO user_watch_progress (user_id, profile_id, media_item_id, position_seconds, duration_seconds, completed, updated_at)
+			VALUES ($1, $2, $3, 0, 1800, TRUE, $4)
+		`, userID, profileID, episodeID, at); err != nil {
+			t.Fatalf("seed completed progress: %v", err)
+		}
+	}
+}
+
+func assertNextUpOrder(t *testing.T, results []NextUpResult, want ...string) {
+	t.Helper()
+
+	got := make([]string, len(results))
+	for i, res := range results {
+		got[i] = res.ContentID
+	}
+	if strings.Join(got, ",") != strings.Join(want, ",") {
+		t.Fatalf("ListNextUp order = %v, want %v", got, want)
+	}
+}
diff --git a/internal/catalog/orphan_cleanup.go b/internal/catalog/orphan_cleanup.go
index d6a730b1fe..0d5ddf94e3 100644
--- a/internal/catalog/orphan_cleanup.go
+++ b/internal/catalog/orphan_cleanup.go
@@ -78,6 +78,10 @@ const orphanedMediaItemSafetyConditions = `NOT EXISTS (
 	SELECT 1 FROM public.user_dropped_series uds
 	WHERE uds.series_id = mi.content_id
   )
+  AND NOT EXISTS (
+	SELECT 1 FROM public.profile_series_notification_mutes psnm
+	WHERE psnm.series_id = mi.content_id
+  )
   AND NOT EXISTS (
 	SELECT 1 FROM public.user_audio_preferences uap
 	WHERE uap.series_id = mi.content_id
@@ -90,6 +94,10 @@ const orphanedMediaItemSafetyConditions = `NOT EXISTS (
 	SELECT 1 FROM public.user_ratings ur
 	WHERE ur.media_item_id = mi.content_id
   )
+  AND NOT EXISTS (
+	SELECT 1 FROM public.user_not_interested uni
+	WHERE uni.media_item_id = mi.content_id
+  )
   AND NOT EXISTS (
 	SELECT 1 FROM public.user_series_playback_preferences uspp
 	WHERE uspp.series_id = mi.content_id
diff --git a/internal/catalog/person_credit_batch_test.go b/internal/catalog/person_credit_batch_test.go
index 2940542422..642e976f69 100644
--- a/internal/catalog/person_credit_batch_test.go
+++ b/internal/catalog/person_credit_batch_test.go
@@ -104,7 +104,7 @@ func TestPersonCreditPhotoBatchPreservesCredits(t *testing.T) {
 					reference := &DetailService{imageResolver: &creditPhotoResolver{}}
 					want := make([]PersonCredit, len(people))
 					for i, person := range people {
-						photo := reference.PresignURL(t.Context(), person.PhotoPath, imagesize.PluginVariantFeatured)
+						photo := reference.PresignURL(t.Context(), cachedImageVariantPath(t.Context(), person.PhotoPath, "profile", ""), imagesize.PluginVariantLarge)
 						if size != imagesize.Unset {
 							photo = reference.PresignImageURL(t.Context(), person.PhotoPath, "profile", string(size))
 						}
diff --git a/internal/catalog/person_credit_image_test.go b/internal/catalog/person_credit_image_test.go
index 8300d07e7c..13b70d6c54 100644
--- a/internal/catalog/person_credit_image_test.go
+++ b/internal/catalog/person_credit_image_test.go
@@ -27,17 +27,18 @@ func personCreditPhoto(t *testing.T, size imagesize.Size) (*recordingCatalogImag
 	return resolver, credits[0]
 }
 
-// Without a requested size a headshot is presigned exactly as stored, which is
-// what this has always returned — rewriting the key here would change every
-// existing client's cast list.
-func TestPersonCreditPhotoUnsetUnchanged(t *testing.T) {
+// Without a requested size a cached headshot is the profile ladder's medium
+// rung, the w500 the people endpoints serve, never the stored original, which
+// can be up to 3840px tall. Plugin-backed photos get the large hint so
+// providers such as TMDB serve a headshot sharp enough for a high-density card.
+func TestPersonCreditPhotoUnsetIsMediumRung(t *testing.T) {
 	resolver, credit := personCreditPhoto(t, imagesize.Unset)
 
-	if resolver.path != testPhotoPath {
-		t.Errorf("resolved path = %q, want the stored key %q untouched", resolver.path, testPhotoPath)
+	if want := "tmdb/people/287/profile/w500.abc123.webp"; resolver.path != want {
+		t.Errorf("resolved path = %q, want %q", resolver.path, want)
 	}
-	if resolver.variant != "featured" {
-		t.Errorf("resolver variant = %q, want featured", resolver.variant)
+	if resolver.variant != "large" {
+		t.Errorf("resolver variant = %q, want large", resolver.variant)
 	}
 	if credit.PhotoURL == "" {
 		t.Error("PhotoURL is empty")
@@ -94,3 +95,23 @@ func TestPersonCreditPhotoSkipsMissingPaths(t *testing.T) {
 		}
 	}
 }
+
+// A photo width overrides image_size for headshots alone.
+func TestPersonCreditPhotoFollowsPhotoWidth(t *testing.T) {
+	resolver := &recordingCatalogImageResolver{}
+	detail := &DetailService{}
+	detail.SetImageResolver(resolver)
+	detail.personCredits(
+		context.Background(),
+		[]models.ItemPerson{{Person: models.Person{ID: 287, Name: "Brad Pitt", PhotoPath: testPhotoPath}}},
+		AccessFilter{ImageSize: imagesize.Large, ImageWidths: imagesize.Widths{Photo: 200, Backdrop: 2688}},
+	)
+	if want := "tmdb/people/287/profile/w200.abc123.webp"; resolver.path != want {
+		t.Errorf("resolved path = %q, want %q", resolver.path, want)
+	}
+	// A plugin's card headshot is softer than a cast card, so a width short of
+	// the original keeps the large hint.
+	if resolver.variant != imagesize.PluginVariantLarge {
+		t.Errorf("resolver variant = %q, want %q", resolver.variant, imagesize.PluginVariantLarge)
+	}
+}
diff --git a/internal/catalog/person_credit_plugin_test.go b/internal/catalog/person_credit_plugin_test.go
index 021ac20b99..044a285732 100644
--- a/internal/catalog/person_credit_plugin_test.go
+++ b/internal/catalog/person_credit_plugin_test.go
@@ -59,7 +59,11 @@ func pluginCreditPeople(count int, duplicates bool) []models.ItemPerson {
 }
 
 func TestPersonCreditPhotosThroughPluginResolver(t *testing.T) {
-	for _, size := range []imagesize.Size{imagesize.Unset, imagesize.Medium} {
+	for _, tc := range []struct {
+		size    imagesize.Size
+		variant string
+	}{{imagesize.Unset, "large"}, {imagesize.Medium, "featured"}} {
+		size := tc.size
 		t.Run(string(size), func(t *testing.T) {
 			resolver := metadata.NewPluginImageResolver()
 			t.Cleanup(resolver.Close)
@@ -82,7 +86,7 @@ func TestPersonCreditPhotosThroughPluginResolver(t *testing.T) {
 					if i == 99 {
 						path = "different.jpg"
 					}
-					if want := "https://example.invalid/featured/" + path; credit.PhotoURL != want {
+					if want := "https://example.invalid/" + tc.variant + "/" + path; credit.PhotoURL != want {
 						t.Fatalf("credit %d URL=%q, want %q", i, credit.PhotoURL, want)
 					}
 				}
diff --git a/internal/catalog/person_reindex_db_test.go b/internal/catalog/person_reindex_db_test.go
new file mode 100644
index 0000000000..59f02b739a
--- /dev/null
+++ b/internal/catalog/person_reindex_db_test.go
@@ -0,0 +1,204 @@
+package catalog
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// personWriteTracer records the statements a person write issues.
+type personWriteTracer struct {
+	mu      sync.Mutex
+	queries []string
+}
+
+func (t *personWriteTracer) TraceQueryStart(ctx context.Context, _ *pgx.Conn, data pgx.TraceQueryStartData) context.Context {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	t.queries = append(t.queries, data.SQL)
+	return ctx
+}
+
+func (*personWriteTracer) TraceQueryEnd(context.Context, *pgx.Conn, pgx.TraceQueryEndData) {}
+
+func (t *personWriteTracer) take() []string {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	queries := t.queries
+	t.queries = nil
+	return queries
+}
+
+func reindexedPersonItems(queries []string) bool {
+	for _, query := range queries {
+		if strings.Contains(query, "FROM item_people") {
+			return true
+		}
+	}
+	return false
+}
+
+// TestPersonWriteReindexesTitlesOnlyOnRenamePostgres pins that a person write
+// queues a search reindex of their titles only when it changes their name,
+// the only person field search documents carry. A lookup that fills in a bio
+// or photo used to reindex every title the person appears in.
+func TestPersonWriteReindexesTitlesOnlyOnRenamePostgres(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	config, err := pgxpool.ParseConfig(dsn)
+	if err != nil {
+		t.Fatalf("parse test database url: %v", err)
+	}
+	tracer := &personWriteTracer{}
+	config.ConnConfig.Tracer = tracer
+	config.MaxConns = 1
+	pool, err := pgxpool.NewWithConfig(ctx, config)
+	if err != nil {
+		t.Fatalf("connect test database: %v", err)
+	}
+	t.Cleanup(pool.Close)
+	repo := NewPersonRepository(pool)
+
+	personID := seedRefreshPerson(t, pool, "reindex")
+	contentID := fmt.Sprintf("person-reindex-movie-%d", time.Now().UnixNano())
+	if _, err := pool.Exec(ctx, `INSERT INTO media_items (content_id, type, title) VALUES ($1, 'movie', 'Reindex Movie')`, contentID); err != nil {
+		t.Fatalf("seed movie: %v", err)
+	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM media_items WHERE content_id = $1`, contentID)
+	})
+	if _, err := pool.Exec(ctx, `INSERT INTO item_people (id, content_id, person_id, kind) VALUES ($1, $2, $1, 1)`, personID, contentID); err != nil {
+		t.Fatalf("seed credit: %v", err)
+	}
+
+	person, err := repo.Get(ctx, personID)
+	if err != nil {
+		t.Fatalf("load person: %v", err)
+	}
+	tracer.take()
+
+	person.Bio = "A bio from a provider."
+	if _, err := repo.UpdateRefreshed(ctx, *person, PersonIdentityOf(*person)); err != nil {
+		t.Fatalf("refresh write keeping the name: %v", err)
+	}
+	if queries := tracer.take(); reindexedPersonItems(queries) {
+		t.Fatalf("a write keeping the name reindexed the person's titles: %q", queries)
+	}
+	if err := repo.Update(ctx, *person); err != nil {
+		t.Fatalf("repeat write: %v", err)
+	}
+	if queries := tracer.take(); reindexedPersonItems(queries) {
+		t.Fatalf("a repeat write reindexed the person's titles: %q", queries)
+	}
+
+	person.Name = "Reindex Renamed"
+	if err := repo.Update(ctx, *person); err != nil {
+		t.Fatalf("rename: %v", err)
+	}
+	if queries := tracer.take(); !reindexedPersonItems(queries) {
+		t.Fatalf("a rename did not reindex the person's titles: %q", queries)
+	}
+
+	stored, err := repo.Get(ctx, personID)
+	if err != nil {
+		t.Fatalf("reload person: %v", err)
+	}
+	if stored.Name != "Reindex Renamed" || stored.Bio != "A bio from a provider." {
+		t.Fatalf("stored person = name %q bio %q, want both writes kept", stored.Name, stored.Bio)
+	}
+}
+
+// TestPersonWriteWaitingOnARenameReindexesTitlesPostgres pins that a write
+// compares against the name it replaces, not the one its statement started
+// with: a refresh that waits on another transaction's rename, then writes the
+// old name back, is a rename too and reindexes the person's titles.
+func TestPersonWriteWaitingOnARenameReindexesTitlesPostgres(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	config, err := pgxpool.ParseConfig(dsn)
+	if err != nil {
+		t.Fatalf("parse test database url: %v", err)
+	}
+	tracer := &personWriteTracer{}
+	config.ConnConfig.Tracer = tracer
+	config.MaxConns = 1
+	pool, err := pgxpool.NewWithConfig(ctx, config)
+	if err != nil {
+		t.Fatalf("connect test database: %v", err)
+	}
+	t.Cleanup(pool.Close)
+	other, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatalf("connect second pool: %v", err)
+	}
+	t.Cleanup(other.Close)
+	repo := NewPersonRepository(pool)
+
+	personID := seedRefreshPerson(t, pool, "waiting")
+	person, err := repo.Get(ctx, personID)
+	if err != nil {
+		t.Fatalf("load person: %v", err)
+	}
+
+	rename, err := other.Begin(ctx)
+	if err != nil {
+		t.Fatalf("begin rename: %v", err)
+	}
+	defer func() { _ = rename.Rollback(ctx) }()
+	if _, err := rename.Exec(ctx, `UPDATE people SET name = 'Renamed Elsewhere' WHERE id = $1`, personID); err != nil {
+		t.Fatalf("rename: %v", err)
+	}
+
+	tracer.take()
+	person.Bio = "A bio from a provider."
+	done := make(chan error, 1)
+	go func() {
+		_, err := repo.UpdateRefreshed(ctx, *person, PersonIdentityOf(*person))
+		done <- err
+	}()
+	// Wait until the refresh write is blocked on the rename's row lock.
+	deadline := time.Now().Add(10 * time.Second)
+	for {
+		var waiting bool
+		if err := other.QueryRow(ctx, `
+			SELECT EXISTS (
+				SELECT 1 FROM pg_stat_activity
+				WHERE wait_event_type = 'Lock' AND query LIKE '%prior_name%'
+			)`).Scan(&waiting); err != nil {
+			t.Fatalf("check lock wait: %v", err)
+		}
+		if waiting {
+			break
+		}
+		if time.Now().After(deadline) {
+			t.Fatal("refresh write never waited on the rename")
+		}
+		select {
+		case err := <-done:
+			t.Fatalf("refresh write finished (err %v) before the rename committed", err)
+		case <-time.After(20 * time.Millisecond):
+		}
+	}
+	if err := rename.Commit(ctx); err != nil {
+		t.Fatalf("commit rename: %v", err)
+	}
+	if err := <-done; err != nil {
+		t.Fatalf("refresh write: %v", err)
+	}
+	if queries := tracer.take(); !reindexedPersonItems(queries) {
+		t.Fatalf("a write that undid a concurrent rename did not reindex: %q", queries)
+	}
+}
diff --git a/internal/catalog/person_repo.go b/internal/catalog/person_repo.go
index e14a8bb216..72040973e8 100644
--- a/internal/catalog/person_repo.go
+++ b/internal/catalog/person_repo.go
@@ -307,6 +307,9 @@ func (r *PersonRepository) BatchFindOrCreate(ctx context.Context, people []model
 			}
 		}
 		rows.Close()
+		if err := rows.Err(); err != nil {
+			return nil, fmt.Errorf("batch lookup by tmdb_id: %w", err)
+		}
 	}
 
 	// Phase 2: Batch lookup by imdb_id (remaining).
@@ -341,6 +344,9 @@ func (r *PersonRepository) BatchFindOrCreate(ctx context.Context, people []model
 			}
 		}
 		rows.Close()
+		if err := rows.Err(); err != nil {
+			return nil, fmt.Errorf("batch lookup by imdb_id: %w", err)
+		}
 	}
 
 	// Phase 3: Batch lookup by name (remaining). A name is not identity: only a
@@ -381,6 +387,9 @@ func (r *PersonRepository) BatchFindOrCreate(ctx context.Context, people []model
 			}
 		}
 		rows.Close()
+		if err := rows.Err(); err != nil {
+			return nil, fmt.Errorf("batch lookup by name: %w", err)
+		}
 	}
 
 	// Phase 4: Batch enrich found people. Item-credit data fills gaps and may
@@ -500,6 +509,9 @@ func (r *PersonRepository) BatchFindOrCreate(ctx context.Context, people []model
 			insertedSet[id] = true
 		}
 		rows.Close()
+		if err := rows.Err(); err != nil {
+			return nil, fmt.Errorf("batch insert people: %w", err)
+		}
 
 		// Assign IDs: either from successful insert or via re-query for race losers.
 		for j, ui := range newIndices {
@@ -828,8 +840,9 @@ func (r *PersonRepository) update(ctx context.Context, p models.Person, guard *P
 // missedPersonUpdate explains a person write that matched no row: the person
 // is gone (pgx.ErrNoRows), or, under a guard, their provider ids changed.
 // The guard itself is in the write's WHERE clause, so it is checked
-// atomically with the write and takes no lock ahead of the conflict
-// resolver's ordered ones.
+// atomically with the write. The write locks the person's row even when the
+// guard misses, but a miss only ends the transaction and nothing locks after
+// it, so that lock never sits ahead of the conflict resolver's ordered ones.
 func missedPersonUpdate(ctx context.Context, tx pgx.Tx, id int64, guard *PersonIdentity) error {
 	if guard == nil {
 		return pgx.ErrNoRows
@@ -844,8 +857,10 @@ func missedPersonUpdate(ctx context.Context, tx pgx.Tx, id int64, guard *PersonI
 	return pgx.ErrNoRows
 }
 
-// applyUpdate writes all non-key fields on a person and enqueues a search
-// reindex for the items they appear in, all in one transaction.
+// applyUpdate writes all non-key fields on a person and, when their name
+// changed, enqueues a search reindex for the items they appear in, all in one
+// transaction. Search documents carry only people's names, so a write that
+// keeps the name, such as a lookup filling in a bio or photo, leaves them be.
 func (r *PersonRepository) applyUpdate(ctx context.Context, p models.Person, guard *PersonIdentity) error {
 	tx, err := r.pool.Begin(ctx)
 	if err != nil {
@@ -853,7 +868,7 @@ func (r *PersonRepository) applyUpdate(ctx context.Context, p models.Person, gua
 	}
 	defer func() { _ = tx.Rollback(ctx) }()
 
-	affected, err := execPersonUpdate(ctx, tx, p, guard)
+	affected, renamed, err := execPersonUpdate(ctx, tx, p, guard)
 	if err != nil {
 		return err
 	}
@@ -862,8 +877,10 @@ func (r *PersonRepository) applyUpdate(ctx context.Context, p models.Person, gua
 		// concurrently), or its ids no longer match the guard.
 		return missedPersonUpdate(ctx, tx, p.ID, guard)
 	}
-	if err := reindexPersonItems(ctx, tx, p.ID); err != nil {
-		return err
+	if renamed {
+		if err := reindexPersonItems(ctx, tx, p.ID); err != nil {
+			return err
+		}
 	}
 	if err := tx.Commit(ctx); err != nil {
 		return fmt.Errorf("commit person update tx: %w", err)
@@ -887,7 +904,7 @@ func (r *PersonRepository) updateResolvingConflicts(ctx context.Context, p model
 
 	var affected int64
 	for attempt := 0; ; attempt++ {
-		affected, err = tryPersonUpdate(ctx, tx, p, guard)
+		affected, _, err = tryPersonUpdate(ctx, tx, p, guard)
 		if err == nil {
 			break
 		}
@@ -915,6 +932,9 @@ func (r *PersonRepository) updateResolvingConflicts(ctx context.Context, p model
 		// never the survivor's stored ids, so the guard holds across retries.
 		return PersonIdentity{}, missedPersonUpdate(ctx, tx, p.ID, guard)
 	}
+	// Always reindex here: a merge moves the other person's credits onto
+	// this one, which changes the names on those items whatever this
+	// person's own name did.
 	if err := reindexPersonItems(ctx, tx, p.ID); err != nil {
 		return PersonIdentity{}, err
 	}
@@ -924,19 +944,25 @@ func (r *PersonRepository) updateResolvingConflicts(ctx context.Context, p model
 	return PersonIdentityOf(p), nil
 }
 
-// execPersonUpdate writes all non-key person fields and returns the rows affected.
-// execPersonUpdate writes a person's fields. When their provider ids change,
-// the last lookup's outcome was about another identity: it is cleared and the
+// execPersonUpdate writes a person's fields and reports the rows affected and
+// whether the write changed their name. When their provider ids change, the
+// last lookup's outcome was about another identity: it is cleared and the
 // person is due now, so one the providers didn't know under the old id isn't
 // left out of the sweep for good. The attempt time stays, so the person isn't
 // taken for one never looked up. The SET list reads the row's old ids. With a
-// guard the write matches only while the row still has the guarded ids.
-func execPersonUpdate(ctx context.Context, tx pgx.Tx, p models.Person, guard *PersonIdentity) (int64, error) {
+// guard the write matches only while the row still has the guarded ids. The
+// prior row is read under FOR NO KEY UPDATE, the lock the UPDATE takes anyway,
+// so after waiting on a concurrent writer it holds the name this write
+// replaces, not the statement snapshot's.
+func execPersonUpdate(ctx context.Context, tx pgx.Tx, p models.Person, guard *PersonIdentity) (int64, bool, error) {
 	var g PersonIdentity
 	if guard != nil {
 		g = *guard
 	}
-	tag, err := tx.Exec(ctx, `
+	rows, err := tx.Query(ctx, `
+		WITH prior AS (
+			SELECT id AS prior_id, name AS prior_name FROM people WHERE id = $1 FOR NO KEY UPDATE
+		)
 		UPDATE people SET name=$2, sort_name=$3, bio=$4, birth_date=$5, death_date=$6,
 			birthplace=$7, homepage=$8, photo_path=$9, photo_source_path=$10, photo_thumbhash=$11,
 			tmdb_id=$12, imdb_id=$13, tvdb_id=$14, plex_guid=$15, updated_at=now(),
@@ -946,37 +972,43 @@ func execPersonUpdate(ctx context.Context, tx pgx.Tx, p models.Person, guard *Pe
 				THEN 0 ELSE metadata_refresh_failures END,
 			metadata_refresh_due_at = CASE WHEN (tmdb_id, imdb_id, tvdb_id) IS DISTINCT FROM ($12, $13, $14)
 				THEN NOW() ELSE metadata_refresh_due_at END
-		WHERE id = $1
+		FROM prior
+		WHERE id = prior_id
 			AND (NOT $16::boolean OR (tmdb_id IS NOT DISTINCT FROM $17
 				AND imdb_id IS NOT DISTINCT FROM $18
-				AND tvdb_id IS NOT DISTINCT FROM $19))`,
+				AND tvdb_id IS NOT DISTINCT FROM $19))
+		RETURNING prior_name IS DISTINCT FROM name`,
 		p.ID, p.Name, p.SortName, p.Bio, p.BirthDate, p.DeathDate,
 		p.Birthplace, p.Homepage, p.PhotoPath, p.PhotoSourcePath, p.PhotoThumbhash,
 		p.TmdbID, p.ImdbID, p.TvdbID, p.PlexGUID,
 		guard != nil, g.TmdbID, g.ImdbID, g.TvdbID,
 	)
 	if err != nil {
-		return 0, err
+		return 0, false, err
+	}
+	renamed, err := pgx.CollectRows(rows, pgx.RowTo[bool])
+	if err != nil {
+		return 0, false, err
 	}
-	return tag.RowsAffected(), nil
+	return int64(len(renamed)), len(renamed) > 0 && renamed[0], nil
 }
 
 // tryPersonUpdate runs execPersonUpdate inside a savepoint so a unique violation
 // rolls back only the attempt, leaving the surrounding transaction usable.
-func tryPersonUpdate(ctx context.Context, tx pgx.Tx, p models.Person, guard *PersonIdentity) (int64, error) {
+func tryPersonUpdate(ctx context.Context, tx pgx.Tx, p models.Person, guard *PersonIdentity) (int64, bool, error) {
 	sp, err := tx.Begin(ctx)
 	if err != nil {
-		return 0, fmt.Errorf("begin person update savepoint: %w", err)
+		return 0, false, fmt.Errorf("begin person update savepoint: %w", err)
 	}
-	affected, err := execPersonUpdate(ctx, sp, p, guard)
+	affected, renamed, err := execPersonUpdate(ctx, sp, p, guard)
 	if err != nil {
 		_ = sp.Rollback(ctx)
-		return 0, err
+		return 0, false, err
 	}
 	if err := sp.Commit(ctx); err != nil {
-		return 0, fmt.Errorf("release person update savepoint: %w", err)
+		return 0, false, fmt.Errorf("release person update savepoint: %w", err)
 	}
-	return affected, nil
+	return affected, renamed, nil
 }
 
 // reindexPersonItems enqueues a catalog-search reindex for every item the person
diff --git a/internal/catalog/personal_collection_collages_db_test.go b/internal/catalog/personal_collection_collages_db_test.go
index e20b2459e3..f929c64bfa 100644
--- a/internal/catalog/personal_collection_collages_db_test.go
+++ b/internal/catalog/personal_collection_collages_db_test.go
@@ -189,13 +189,13 @@ func TestPersonalCollectionCollagesFollowTheViewerDB(t *testing.T) {
 
 	t.Run("the owner's collage is its own", func(t *testing.T) {
 		ownerSources, _ := collages.ListSources(ctx, userID, []PersonalCollectionDefinition{manualDef}, unrestricted)
-		ownerRef := CollectionCollageRef{CollectionID: manual.ID, Key: CollectionCollageKey(ownerSources[manual.ID])}
+		ownerKey := CollectionCollageKey(ownerSources[manual.ID])
 		if err := prepareCollage(ctx, collages, userID, manualDef, unrestricted); err != nil {
 			t.Fatalf("prepare: %v", err)
 		}
 		got := collages.Posters(ctx, userID, []PersonalCollectionDefinition{manualDef}, unrestricted)[manual.ID]
-		if got.CollageKey != ownerRef.Key || got.CollageKey == kidRef.Key {
-			t.Fatalf("owner poster = %+v, want collage %s", got, ownerRef.Key)
+		if got.CollageKey != ownerKey || got.CollageKey == kidRef.Key {
+			t.Fatalf("owner poster = %+v, want collage %s", got, ownerKey)
 		}
 	})
 
diff --git a/internal/catalog/playable_targets_benchmark_test.go b/internal/catalog/playable_targets_benchmark_test.go
index 81ddf903c5..7cb174825c 100644
--- a/internal/catalog/playable_targets_benchmark_test.go
+++ b/internal/catalog/playable_targets_benchmark_test.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"reflect"
+	"slices"
 	"testing"
 	"time"
 
@@ -74,7 +75,7 @@ func BenchmarkPlayableTargetReadQueries(b *testing.B) {
 	}
 	b.Cleanup(func() {
 		ctx := context.Background()
-		_, _ = pool.Exec(ctx, `DELETE FROM media_items WHERE content_id = ANY($1)`, append(movieIDs, seriesID))
+		_, _ = pool.Exec(ctx, `DELETE FROM media_items WHERE content_id = ANY($1)`, slices.Concat(movieIDs, []string{seriesID}))
 		_, _ = pool.Exec(ctx, `DELETE FROM media_folders WHERE id = $1`, folderID)
 		_, _ = pool.Exec(ctx, `DELETE FROM users WHERE id = $1`, userID)
 	})
diff --git a/internal/catalog/provider_id_repo.go b/internal/catalog/provider_id_repo.go
index a6b50419be..83b363bbfb 100644
--- a/internal/catalog/provider_id_repo.go
+++ b/internal/catalog/provider_id_repo.go
@@ -239,15 +239,16 @@ func normalizeDurableProviderIDs(providerIDs map[string]string) []models.MediaIt
 	}
 
 	sort.Slice(entries, func(i, j int) bool {
-		leftRank, leftOK := preferredProviderIDOrder[strings.ToLower(entries[i].Provider)]
-		rightRank, rightOK := preferredProviderIDOrder[strings.ToLower(entries[j].Provider)]
+		left, right := strings.ToLower(entries[i].Provider), strings.ToLower(entries[j].Provider)
+		leftRank, leftOK := preferredProviderIDOrder[left]
+		rightRank, rightOK := preferredProviderIDOrder[right]
 		switch {
 		case leftOK && rightOK && leftRank != rightRank:
 			return leftRank < rightRank
 		case leftOK != rightOK:
 			return leftOK
-		case !strings.EqualFold(entries[i].Provider, entries[j].Provider):
-			return strings.ToLower(entries[i].Provider) < strings.ToLower(entries[j].Provider)
+		case left != right:
+			return left < right
 		default:
 			return entries[i].ProviderID < entries[j].ProviderID
 		}
diff --git a/internal/catalog/query_cursor.go b/internal/catalog/query_cursor.go
index 9818a57b9d..20a5c0e0a1 100644
--- a/internal/catalog/query_cursor.go
+++ b/internal/catalog/query_cursor.go
@@ -209,7 +209,7 @@ func (e *QueryExecutor) PreviewCursorPage(ctx context.Context, def QueryDefiniti
 		return QueryCursorPage{}, err
 	}
 	defer func() { _ = tx.Rollback(ctx) }()
-	rows, err := tx.Query(ctx, sql, args...)
+	rows, err := tx.Query(ctx, sql, args...) //nolint:rowserrcheck // scanItemsWithMangaCounts checks Err through the cursorRows wrapper
 	if err != nil {
 		return QueryCursorPage{}, fmt.Errorf("querying cursor page: %w", err)
 	}
diff --git a/internal/catalog/reattribute/notification_mute_move_db_test.go b/internal/catalog/reattribute/notification_mute_move_db_test.go
new file mode 100644
index 0000000000..ff477584ac
--- /dev/null
+++ b/internal/catalog/reattribute/notification_mute_move_db_test.go
@@ -0,0 +1,48 @@
+package reattribute
+
+import (
+	"context"
+	"fmt"
+	"testing"
+)
+
+// TestMovePairsMovesNotificationMutesDB checks that a whole-item move carries
+// a profile's notification mute to the destination series, and that a mute
+// the profile already holds there wins the collision.
+func TestMovePairsMovesNotificationMutesDB(t *testing.T) {
+	env := newTestEnv(t)
+	ctx := context.Background()
+	from := fmt.Sprintf("reattr-mute-from-%d", env.suffix)
+	to := fmt.Sprintf("reattr-mute-to-%d", env.suffix)
+	onlyFrom := fmt.Sprintf("reattr-mute-only-%d", env.suffix)
+	onlyTo := fmt.Sprintf("reattr-mute-only-to-%d", env.suffix)
+	if _, err := env.pool.Exec(ctx, `
+		INSERT INTO profile_series_notification_mutes (user_id, profile_id, series_id)
+		VALUES ($1, $2, $3), ($1, $2, $4), ($1, $2, $5)
+	`, env.userID, env.profileID, from, to, onlyFrom); err != nil {
+		t.Fatalf("seed mutes: %v", err)
+	}
+	t.Cleanup(func() {
+		_, _ = env.pool.Exec(ctx, `DELETE FROM profile_series_notification_mutes WHERE user_id = $1`, env.userID)
+	})
+
+	tx, err := env.pool.Begin(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = tx.Rollback(ctx) }()
+	var report Report
+	if err := movePairs(ctx, tx, []IDPair{{From: from, To: to}, {From: onlyFrom, To: onlyTo}}, &report); err != nil {
+		t.Fatal(err)
+	}
+	var left, moved int
+	if err := tx.QueryRow(ctx, `
+		SELECT count(*) FILTER (WHERE series_id = ANY($2)), count(*) FILTER (WHERE series_id = ANY($3))
+		FROM profile_series_notification_mutes WHERE user_id = $1`,
+		env.userID, []string{from, onlyFrom}, []string{to, onlyTo}).Scan(&left, &moved); err != nil {
+		t.Fatal(err)
+	}
+	if left != 0 || moved != 2 {
+		t.Fatalf("source mutes left = %d, destination mutes = %d; want 0 and 2", left, moved)
+	}
+}
diff --git a/internal/catalog/reattribute/reattribute.go b/internal/catalog/reattribute/reattribute.go
index e9e9c8c0f1..7085c09719 100644
--- a/internal/catalog/reattribute/reattribute.go
+++ b/internal/catalog/reattribute/reattribute.go
@@ -92,6 +92,13 @@ type Report struct {
 	AmbiguousHistory []AmbiguousHistoryRow `json:"ambiguous_history,omitempty"`
 }
 
+// MovedUserState reports whether the run moved any watch progress, history
+// or item-level intent (favorites, watchlist, ratings, ...), the state a
+// profile's recommendations are built from. A nil report moved nothing.
+func (r *Report) MovedUserState() bool {
+	return r != nil && r.ProgressMoved+r.ProgressConflicts+r.HistoryMoved+r.IntentMoved > 0
+}
+
 // AmbiguousHistoryRow identifies one history row left behind for lack of
 // decisive evidence.
 type AmbiguousHistoryRow struct {
@@ -167,6 +174,7 @@ var intentTables = []struct {
 	{"user_favorites", colMediaItemID, []string{colUserID, colProfileID}},
 	{"user_watchlist", colMediaItemID, []string{colUserID, colProfileID}},
 	{"user_ratings", colMediaItemID, []string{colUserID, colProfileID}},
+	{"user_not_interested", colMediaItemID, []string{colUserID, colProfileID}},
 	{"user_personal_collection_items", colMediaItemID, []string{colUserID, "collection_id", "sub_item_id"}},
 	{"library_collection_items", colMediaItemID, []string{"collection_id"}},
 	{"user_home_item_dismissals", colMediaItemID, []string{colUserID, colProfileID, "surface"}},
@@ -174,6 +182,7 @@ var intentTables = []struct {
 	{"user_audio_preferences", colSeriesID, []string{colUserID, colProfileID}},
 	{"user_subtitle_preferences", colSeriesID, []string{colUserID, colProfileID}},
 	{"user_series_playback_preferences", colSeriesID, []string{colUserID, colProfileID}},
+	{"profile_series_notification_mutes", colSeriesID, []string{colUserID, colProfileID}},
 }
 
 // movePairs moves ALL state rows for each (from,to) pair: the whole-item path
diff --git a/internal/catalog/recent_tv.go b/internal/catalog/recent_tv.go
index 2485fe36a9..6a306f891c 100644
--- a/internal/catalog/recent_tv.go
+++ b/internal/catalog/recent_tv.go
@@ -91,9 +91,10 @@ func recentTVFilterTypeScope(filterType string) (explicitSeries bool, tvEligible
 // ResolveRecentTVLibraryIDs decides whether a recently-added section is
 // exclusively TV-targeted and returns the effective visible TV libraries.
 // filterType is the section's configured filter_type: an explicit "series"
-// scope may include mixed libraries, an empty scope requires every requested
-// library to be a dedicated series library, and any other type is not TV
-// scoped at all because event grouping cannot honor it.
+// scope may include mixed libraries and TV libraries typed with an alias such
+// as "tv", an empty scope requires every requested library to be a dedicated
+// series library, and any other type is not TV scoped at all because event
+// grouping cannot honor it.
 func ResolveRecentTVLibraryIDs(
 	ctx context.Context,
 	pool *pgxpool.Pool,
@@ -156,7 +157,7 @@ func ResolveRecentTVLibraryIDs(
 
 	ids := make([]int, 0, len(byID))
 	for id, libraryType := range byID {
-		if libraryType == recentTVTypeSeries || (explicitSeries && libraryType == "mixed") {
+		if libraryType == recentTVTypeSeries || (explicitSeries && (librarykind.IsTV(libraryType) || librarykind.IsMixed(libraryType))) {
 			ids = append(ids, id)
 		}
 	}
diff --git a/internal/catalog/search_cursor.go b/internal/catalog/search_cursor.go
index c6d8560de9..df136882a0 100644
--- a/internal/catalog/search_cursor.go
+++ b/internal/catalog/search_cursor.go
@@ -3,7 +3,6 @@ package catalog
 import (
 	"context"
 	"fmt"
-	"slices"
 	"strconv"
 	"strings"
 
@@ -146,7 +145,7 @@ func (r *ItemRepository) searchFTSCursorRows(ctx context.Context, parsed parsedS
 		_ = tx.Rollback(rollbackCtx)
 	}()
 	if !includeTotal && options.exactSQL != "" {
-		rows, err := tx.Query(ctx, options.exactSQL, searchPlanArgs(options.exactArgs)...)
+		rows, err := tx.Query(ctx, options.exactSQL, searchPlanArgs(options.exactArgs)...) //nolint:rowserrcheck // scanItems checks Err through the cursorRows wrapper
 		if err != nil {
 			return nil, nil, 0, err
 		}
@@ -163,7 +162,7 @@ func (r *ItemRepository) searchFTSCursorRows(ctx context.Context, parsed parsedS
 			return items, wrapped.keys, 0, nil
 		}
 	}
-	rows, err := tx.Query(ctx, sql, searchPlanArgs(args)...)
+	rows, err := tx.Query(ctx, sql, searchPlanArgs(args)...) //nolint:rowserrcheck // scanItems checks Err through the cursorRows wrapper
 	if err != nil {
 		return nil, nil, 0, err
 	}
@@ -306,7 +305,7 @@ func (r *ItemRepository) combinedSearchCandidatesWithFTS(ctx context.Context, pa
 		floor = fuzzyAugmentSimilarityFloor
 	}
 	options := &searchCursorSQL{request: searchOptions(request)}
-	sql, _, args := r.buildFuzzySearchCursorSQL(parsed, itemTypes, fuzzyMaxResults+1, 0, filter, false, contentIDsFromMediaItems(fts), floor, options)
+	sql, _, args := r.buildFuzzySearchCursorSQL(parsed, itemTypes, fuzzyCandidatePool+1, 0, filter, false, contentIDsFromMediaItems(fts), floor, options)
 	if options.err != nil {
 		return nil, false, options.err
 	}
@@ -325,7 +324,7 @@ func (r *ItemRepository) combinedSearchCandidatesWithFTS(ctx context.Context, pa
 	if _, err := tx.Exec(ctx, fmt.Sprintf("SET LOCAL pg_trgm.strict_word_similarity_threshold = %g", trgmWordSimilarityThreshold)); err != nil {
 		return nil, false, err
 	}
-	rows, err := tx.Query(ctx, sql, searchPlanArgs(args)...)
+	rows, err := tx.Query(ctx, sql, searchPlanArgs(args)...) //nolint:rowserrcheck // scanItems checks Err through the cursorRows wrapper
 	if err != nil {
 		return nil, false, err
 	}
@@ -335,9 +334,9 @@ func (r *ItemRepository) combinedSearchCandidatesWithFTS(ctx context.Context, pa
 	if err != nil {
 		return nil, false, err
 	}
-	truncated := len(fuzzy) > fuzzyMaxResults
+	truncated := len(fuzzy) > fuzzyCandidatePool
 	if truncated {
-		fuzzy = fuzzy[:fuzzyMaxResults]
+		fuzzy = fuzzy[:fuzzyCandidatePool]
 	}
 	aliases, err := loadFuzzyRerankAliases(ctx, tx, searchTextFromParsed(parsed), fuzzy)
 	if err != nil {
@@ -346,43 +345,23 @@ func (r *ItemRepository) combinedSearchCandidatesWithFTS(ctx context.Context, pa
 	if err := tx.Commit(ctx); err != nil {
 		return nil, false, err
 	}
-	query := normalizeTitleForComparison(searchTextFromParsed(parsed))
-	tokens, validTokens := boundedFuzzyTokens(query, fuzzyRerankMaxQueryTokens)
-	ranks := make([]fuzzyRankedItem, len(fuzzy))
-	keysByID := map[string][]QueryCursorValue{}
-	for i, item := range fuzzy {
-		if err := ctx.Err(); err != nil {
-			return nil, false, err
-		}
-		score := fuzzyTitleScore{}
-		if validTokens && len(tokens) > 0 {
-			score = fuzzyTitleScore{editDistance: int(^uint(0) >> 1), extraTokens: int(^uint(0) >> 1)}
-			variants := append([]string(nil), aliases[item.ContentID]...)
-			if len(item.Title) <= fuzzyRerankMaxTitleBytes {
-				variants = append(variants, item.Title)
-			}
-			for _, variant := range variants {
-				candidate := scoreFuzzyTitleVariant(query, tokens, variant)
-				if fuzzyTitleScoreBetter(candidate, score) {
-					score = candidate
-				}
-			}
-		}
-		ranks[i] = fuzzyRankedItem{item: item, score: score, order: i}
-		keys := []QueryCursorValue{boolCursorValue(score.exact), numberCursorValue(score.matchedTokens), boolCursorValue(score.contiguous), numberCursorValue(score.editDistance), numberCursorValue(score.extraTokens)}
-		keysByID[item.ContentID] = append(keys, wrapped.keys[i].Keys...)
+	ranks, required, err := rankFuzzyItems(ctx, searchTextFromParsed(parsed), fuzzy, aliases)
+	if err != nil {
+		return nil, false, err
 	}
-	slices.SortStableFunc(ranks, func(a, b fuzzyRankedItem) int {
-		if fuzzyTitleScoreBetter(a.score, b.score) {
-			return -1
-		}
-		if fuzzyTitleScoreBetter(b.score, a.score) {
-			return 1
-		}
-		return 0
-	})
+	if required > 0 {
+		ranks = admitFuzzyRanks(ranks, required, len(fts) > 0)
+	}
+	if len(ranks) > fuzzyMaxResults {
+		ranks, truncated = ranks[:fuzzyMaxResults], true
+	}
+	// Admitted ranks share one missingWords value, so these keys order them
+	// exactly as fuzzyTitleScoreBetter does.
 	for _, rank := range ranks {
-		candidates = append(candidates, searchCandidate{item: rank.item, cursor: &SearchCursor{Mode: searchCursorCombined, Phase: searchCursorFuzzy, Keys: keysByID[rank.item.ContentID]}})
+		score := rank.score
+		keys := []QueryCursorValue{boolCursorValue(score.exact), numberCursorValue(score.matchedTokens), boolCursorValue(score.contiguous), numberCursorValue(score.editDistance), numberCursorValue(score.extraTokens)}
+		keys = append(keys, wrapped.keys[rank.order].Keys...)
+		candidates = append(candidates, searchCandidate{item: rank.item, cursor: &SearchCursor{Mode: searchCursorCombined, Phase: searchCursorFuzzy, Keys: keys}})
 	}
 	candidates, err = r.groupSearchCandidates(ctx, candidates, searchOptions(request).GroupByWork, searchOptions(request).Definition.Limit)
 	return candidates, truncated, err
diff --git a/internal/catalog/search_episode_exact.go b/internal/catalog/search_episode_exact.go
index 1fee9c65b7..6b43bbbba8 100644
--- a/internal/catalog/search_episode_exact.go
+++ b/internal/catalog/search_episode_exact.go
@@ -42,7 +42,7 @@ func buildEpisodeExactTierSQL(parsed parsedSearchQuery, filter AccessFilter, cur
 		if len(after.Keys) != len(searchFTSTerms()) {
 			return "", nil
 		}
-		for index, want := range [...]float64{1, 1, 0, 0, 0, 0} {
+		for index, want := range [...]float64{1, 2, 0, 0, 0, 0} {
 			if index == 4 {
 				continue
 			}
@@ -60,10 +60,12 @@ func buildEpisodeExactTierSQL(parsed parsedSearchQuery, filter AccessFilter, cur
 		}
 		index := len(args) + 1
 		args = append(args, after.Keys[4].Value, after.Keys[6].Value, after.Keys[7].Value)
-		// Compare the constant prefix score in PostgreSQL's real type, matching
+		// Compare the constant prefix score in PostgreSQL's float8 type, matching
 		// the rank and cursor text representation without a Go approximation.
 		conditions = append(conditions,
-			fmt.Sprintf("ts_rank_cd(setweight(to_tsvector('simple', $%d::text), 'A'), to_tsquery('simple', $2)) = $%d::real", exactIdx, index),
+			fmt.Sprintf("%s = $%d::float8", titlePrefixRankSQL(
+				titleWordsSQL([]string{fmt.Sprintf("$%d::text", exactIdx)}, exactIdx),
+				titleRankSQL(fmt.Sprintf("setweight(to_tsvector('simple', $%d::text), 'A')", exactIdx), titlePrefixQuery)), index),
 			fmt.Sprintf("(LOWER(ece.title), ece.episode_id) > ($%d::text, $%d::text)", index+1, index+2),
 		)
 	}
diff --git a/internal/catalog/search_episode_exact_db_test.go b/internal/catalog/search_episode_exact_db_test.go
index 3cf75cefa4..c1f5897bcc 100644
--- a/internal/catalog/search_episode_exact_db_test.go
+++ b/internal/catalog/search_episode_exact_db_test.go
@@ -75,13 +75,16 @@ func TestEpisodeExactTierCursorAndPlanPostgres(t *testing.T) {
 		CASE WHEN i<=30 THEN $3 WHEN i<=60 THEN $4 WHEN i=61 THEN 'Limited' ELSE 'Limited Adventure' END,
 		'','2024-01-01' FROM generate_series(1,90)i`, prefix, series, collisionOther, collisionTarget)
 	exec(`INSERT INTO episode_libraries(episode_id,media_folder_id) SELECT content_id,$2 FROM episodes WHERE series_id=$1 AND season_number=2`, series, library)
+	exec(`INSERT INTO episodes(content_id,series_id,season_number,episode_number,title,overview,air_date)
+		SELECT $1||'-short-'||lpad(i::text,4,'0'),$2,3,i,'Ice','','2024-01-01' FROM generate_series(1,60)i`, prefix, series)
+	exec(`INSERT INTO episode_libraries(episode_id,media_folder_id) SELECT content_id,$2 FROM episodes WHERE series_id=$1 AND season_number=3`, series, library)
 	exec(`ANALYZE episode_catalog_entries; ANALYZE episodes; ANALYZE media_items; ANALYZE media_item_libraries`)
 	repo := NewItemRepository(pool)
 	filter := AccessFilter{AllowedLibraryIDs: []int{library}}
 	parsed := parseSearchQuery("Star")
 	options := &searchCursorSQL{}
 	fullSQL, _, args := repo.buildMixedSearchCursorSQL(parsed, []string{"episode"}, 2000, 0, filter, false, options)
-	rows, err := pool.Query(ctx, fullSQL, args...)
+	rows, err := pool.Query(ctx, fullSQL, args...) //nolint:rowserrcheck // scanItems checks Err through the cursorRows wrapper
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -121,6 +124,21 @@ func TestEpisodeExactTierCursorAndPlanPostgres(t *testing.T) {
 	if !slices.Equal(got, contentIDsFromMediaItems(baseline)) || fastPages == 0 {
 		t.Fatalf("tier traversal=%d baseline=%d fast pages=%d", len(got), len(baseline), fastPages)
 	}
+	// A word under four characters has no prefix query; its continuation keys
+	// must still match the tier's constant scores.
+	after = nil
+	for page := range 3 {
+		tracer.exact.Store(0)
+		tracer.general.Store(0)
+		result, err := repo.SearchCursorPage(ctx, "Ice", []string{"episode"}, 17, after, filter, false)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if len(result.Items) != 17 || tracer.exact.Load() != 1 || tracer.general.Load() != 0 {
+			t.Fatalf("short title page %d: items=%d exact=%d general=%d", page, len(result.Items), tracer.exact.Load(), tracer.general.Load())
+		}
+		after = result.Next
+	}
 	for _, tc := range []struct {
 		name, query    string
 		types          []string
@@ -220,7 +238,11 @@ func TestEpisodeExactTierCursorAndPlanPostgres(t *testing.T) {
 	broadSQL, _, broadArgs := repo.buildMixedSearchCursorSQL(parseSearchQuery("Parentspill"), []string{"episode"}, 21, 0, filter, false, &searchCursorSQL{})
 	// Inspect the unchanged scored relation and page limit independently of
 	// hydration; disabling nested loops is only for the parent join spill.
-	broadSQL = broadSQL[:strings.Index(broadSQL, ", page AS (")] +
+	broadScored, _, ok := strings.Cut(broadSQL, ", page AS (")
+	if !ok {
+		t.Fatalf("broad search SQL has no page CTE:\n%s", broadSQL)
+	}
+	broadSQL = broadScored +
 		fmt.Sprintf(" SELECT content_id FROM scored WHERE $1::text IS NOT NULL ORDER BY %s LIMIT $%d", mixedSearchOrder(""), len(broadArgs))
 	if err := broadTx.QueryRow(ctx, "EXPLAIN (ANALYZE,BUFFERS,FORMAT JSON,TIMING OFF) "+broadSQL, broadArgs...).Scan(&plan); err != nil {
 		t.Fatal(err)
diff --git a/internal/catalog/search_indexer.go b/internal/catalog/search_indexer.go
index 1a2aca9065..4bd3eac6ff 100644
--- a/internal/catalog/search_indexer.go
+++ b/internal/catalog/search_indexer.go
@@ -78,6 +78,10 @@ type CatalogSearchIndexer struct {
 	settingsStore SettingsStore
 	runtime       *CatalogSearchSettings
 	events        *SearchIndexEventRepository
+	// models names the locked embedding model. Documents carry only vectors
+	// of that model, the ones the coverage gate counts and query vectors are
+	// compared with. Nil indexes every stored vector.
+	models CatalogSemanticModelProvider
 }
 
 func NewCatalogSearchIndexer(pool *pgxpool.Pool, settingsStore SettingsStore) *CatalogSearchIndexer {
@@ -103,6 +107,16 @@ func NewCatalogSearchIndexerFromSettings(pool *pgxpool.Pool, settingsStore Setti
 	}
 }
 
+// WithSemanticModelProvider indexes only vectors of the embedding model
+// models reports, the same provider the semantic coverage gate uses, and
+// returns the indexer.
+func (i *CatalogSearchIndexer) WithSemanticModelProvider(models CatalogSemanticModelProvider) *CatalogSearchIndexer {
+	if i != nil {
+		i.models = models
+	}
+	return i
+}
+
 func (i *CatalogSearchIndexer) ShouldSyncRun(ctx context.Context) (bool, error) {
 	settings, ok, err := i.loadMeilisearchRuntime(ctx)
 	if err != nil || !ok || settings.Provider != SearchProviderMeilisearch {
@@ -230,7 +244,7 @@ func (i *CatalogSearchIndexer) SyncOutbox(ctx context.Context, progress SearchIn
 	}
 	if len(events) == 0 {
 		stats.DocumentCount = state.DocumentCount
-		if vectorCount, err := countCatalogSearchVectorDocuments(ctx, i.pool, settings.IndexTypes, ""); err == nil {
+		if vectorCount, err := i.countIndexedVectors(ctx, settings.IndexTypes); err == nil {
 			stats.VectorDocCount = vectorCount
 		}
 		setSearchIndexTaskResult(progress, stats)
@@ -300,7 +314,7 @@ func (i *CatalogSearchIndexer) SyncOutbox(ctx context.Context, progress SearchIn
 		return stats, err
 	}
 	stats.DocumentCount = docCount
-	if vectorCount, err := countCatalogSearchVectorDocuments(ctx, i.pool, settings.IndexTypes, ""); err == nil {
+	if vectorCount, err := i.countIndexedVectors(ctx, settings.IndexTypes); err == nil {
 		stats.VectorDocCount = vectorCount
 	}
 	stats.LastProcessedID = maxID
@@ -504,7 +518,7 @@ func (i *CatalogSearchIndexer) rebuildLocked(
 		return stats, err
 	}
 	stats.DocumentCount = docCount
-	if vectorCount, err := countCatalogSearchVectorDocuments(ctx, i.pool, settings.IndexTypes, ""); err == nil {
+	if vectorCount, err := i.countIndexedVectors(ctx, settings.IndexTypes); err == nil {
 		stats.VectorDocCount = vectorCount
 	}
 	// Swap the state pointer BEFORE marking events processed. If the process
@@ -1042,7 +1056,11 @@ func (i *CatalogSearchIndexer) attachDocumentVectors(ctx context.Context, docs [
 	}
 	var vectors map[string][]float32
 	if len(ids) > 0 {
-		if vectors, err = loadCatalogSearchVectors(ctx, i.pool, ids); err != nil {
+		model, err := i.activeModel(ctx)
+		if err != nil {
+			return err
+		}
+		if vectors, err = loadCatalogSearchVectors(ctx, i.pool, ids, model); err != nil {
 			return err
 		}
 	}
@@ -1052,7 +1070,33 @@ func (i *CatalogSearchIndexer) attachDocumentVectors(ctx context.Context, docs [
 	return nil
 }
 
-func loadCatalogSearchVectors(ctx context.Context, pool *pgxpool.Pool, contentIDs []string) (map[string][]float32, error) {
+// activeModel returns the embedding model whose vectors documents carry, or
+// "" for every model.
+func (i *CatalogSearchIndexer) activeModel(ctx context.Context) (string, error) {
+	if i.models == nil {
+		return "", nil
+	}
+	model, err := i.models.ActiveEmbeddingModel(ctx)
+	if err != nil {
+		return "", fmt.Errorf("resolve active embedding model: %w", err)
+	}
+	return model, nil
+}
+
+// countIndexedVectors counts the documents of itemTypes that carry a vector,
+// the way attachDocumentVectors chooses them.
+func (i *CatalogSearchIndexer) countIndexedVectors(ctx context.Context, itemTypes []string) (int, error) {
+	model, err := i.activeModel(ctx)
+	if err != nil {
+		return 0, err
+	}
+	return countCatalogSearchVectorDocuments(ctx, i.pool, itemTypes, model)
+}
+
+// loadCatalogSearchVectors returns the stored vectors of contentIDs made by
+// model ("" => any model). An item whose vector came from another model is
+// absent, so its document opts out of semantic search until it is re-embedded.
+func loadCatalogSearchVectors(ctx context.Context, pool *pgxpool.Pool, contentIDs []string, model string) (map[string][]float32, error) {
 	contentIDs = compactNonEmptyStrings(contentIDs)
 	if pool == nil || len(contentIDs) == 0 {
 		return nil, nil
@@ -1061,7 +1105,8 @@ func loadCatalogSearchVectors(ctx context.Context, pool *pgxpool.Pool, contentID
 		SELECT media_item_id, embedding
 		FROM media_item_embeddings
 		WHERE media_item_id = ANY($1)
-	`, contentIDs)
+		  AND ($2 = '' OR model = $2)
+	`, contentIDs, model)
 	if err != nil {
 		return nil, fmt.Errorf("load catalog search vectors: %w", err)
 	}
diff --git a/internal/catalog/search_indexer_test.go b/internal/catalog/search_indexer_test.go
index 31c739bc5c..45d02de3bc 100644
--- a/internal/catalog/search_indexer_test.go
+++ b/internal/catalog/search_indexer_test.go
@@ -2,6 +2,7 @@ package catalog
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net/http"
 	"net/http/httptest"
@@ -391,6 +392,73 @@ func TestCountCatalogSearchVectorDocumentsModelCoverage(t *testing.T) {
 	}
 }
 
+// TestCatalogSearchDocumentsCarryOnlyTheActiveModelsVectors verifies that the
+// indexer sends a vector only for an item embedded by the locked model, the
+// rows the coverage gate counts, and opts the other item out explicitly.
+func TestCatalogSearchDocumentsCarryOnlyTheActiveModelsVectors(t *testing.T) {
+	ctx := context.Background()
+	pool := newSemanticCoverageTestPool(t)
+	prefix := fmt.Sprintf("idx-model-%d", time.Now().UnixNano())
+	current := prefix + "-current"
+	other := prefix + "-other"
+	cleanupSemanticCoverageItems(t, pool, prefix)
+	seedSemanticCoverageMediaItem(t, pool, current, "movie", "matched")
+	seedSemanticCoverageMediaItem(t, pool, other, "movie", "matched")
+	seedSemanticCoverageEmbedding(t, pool, current, "model-a")
+	seedSemanticCoverageEmbedding(t, pool, other, "model-b")
+	ids := []string{current, other}
+	types := []string{"movie"}
+
+	vectorsOf := func(indexer *CatalogSearchIndexer) map[string]bool {
+		t.Helper()
+		docs, err := indexer.LoadDocumentsByIDs(ctx, ids, types, DefaultMeilisearchEmbedder, true, false)
+		if err != nil {
+			t.Fatalf("LoadDocumentsByIDs(): %v", err)
+		}
+		has := map[string]bool{}
+		for _, doc := range docs {
+			vector, ok := doc.Vectors[DefaultMeilisearchEmbedder]
+			if !ok {
+				t.Fatalf("document %s has no _vectors entry for the embedder: %#v", doc.ContentID, doc.Vectors)
+			}
+			has[doc.ContentID] = len(vector) > 0
+		}
+		return has
+	}
+
+	lockedIndexer := NewCatalogSearchIndexer(pool, nil).WithSemanticModelProvider(constCoverageModels{model: "model-a"})
+	locked := vectorsOf(lockedIndexer)
+	if !locked[current] || locked[other] {
+		t.Fatalf("with model-a locked, vectors = %v; want only %s", locked, current)
+	}
+	// The indexer's vector count is the coverage numerator for the same model.
+	indexed, err := lockedIndexer.countIndexedVectors(ctx, types)
+	if err != nil {
+		t.Fatal(err)
+	}
+	coverage, err := catalogSemanticCoverageByType(ctx, pool, types, "model-a")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(coverage) != 1 || coverage[0].Vectorized != indexed || indexed < 1 {
+		t.Fatalf("indexer counts %d model-a vectors, coverage %+v", indexed, coverage)
+	}
+
+	// No lock yet: every stored vector is indexed, as before.
+	unlocked := vectorsOf(NewCatalogSearchIndexer(pool, nil).WithSemanticModelProvider(constCoverageModels{}))
+	if !unlocked[current] || !unlocked[other] {
+		t.Fatalf("with no lock, vectors = %v; want both", unlocked)
+	}
+
+	failing := NewCatalogSearchIndexer(pool, nil).WithSemanticModelProvider(&fakeCoverageModels{results: []struct {
+		model string
+		err   error
+	}{{"", errors.New("lock unavailable")}}})
+	if _, err := failing.LoadDocumentsByIDs(ctx, ids, types, DefaultMeilisearchEmbedder, true, false); err == nil {
+		t.Fatal("documents were built without knowing the active model")
+	}
+}
+
 // TestCatalogSemanticCoverageByTypeC1Guard verifies case (b) (the C1 regression
 // guard) and case (c): an unmatched, non-book item inflates neither numerator
 // nor denominator, while a matched item with no embedding row counts toward the
diff --git a/internal/catalog/search_meilisearch_provider.go b/internal/catalog/search_meilisearch_provider.go
index ce93d66889..585ef389ad 100644
--- a/internal/catalog/search_meilisearch_provider.go
+++ b/internal/catalog/search_meilisearch_provider.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"log/slog"
 	"net"
 	"net/http"
 	"sort"
@@ -14,6 +15,7 @@ import (
 
 	"github.com/prairie-server/prairie-server/internal/embeddingvectors"
 	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/recommendations/embeddings"
 )
 
 const (
@@ -26,6 +28,14 @@ const (
 	meilisearchCircuitCooldown         = 30 * time.Second
 	meilisearchQueryVectorCacheTTL     = 15 * time.Minute
 	meilisearchQueryVectorCacheMax     = 1024
+	// meilisearchQueryVectorTimeout bounds embedding one search query. The
+	// embedding client retries for minutes on a failing provider; a search
+	// falls back to keyword results instead of waiting for it.
+	meilisearchQueryVectorTimeout = 2 * time.Second
+	// meilisearchQueryVectorFailureCooldown is how long this node skips the
+	// embedding provider for search queries after a query failed to embed,
+	// so an outage does not cost every search the timeout.
+	meilisearchQueryVectorFailureCooldown = time.Minute
 	// meilisearchIndexStateCacheTTL bounds how long the provider serves the
 	// cached catalog_search_index_state row (and the informational pending
 	// count) before refetching. The state only changes on rebuild/sync, so this
@@ -87,6 +97,11 @@ type MeilisearchSearchProvider struct {
 	vecMu          sync.Mutex
 	vectorCache    map[string]cachedCatalogSearchQueryVector
 	vectorCacheSeq int64
+	// vectorFailedUntil ends the cooldown that follows a failed query
+	// embedding; until then queries skip the provider.
+	vectorFailedUntil time.Time
+	// vectorClock is the query-vector cache's clock; nil means time.Now.
+	vectorClock func() time.Time
 
 	// stateMu guards the cached index state + pending count (see
 	// meilisearchIndexStateCacheTTL).
@@ -491,7 +506,13 @@ func (p *MeilisearchSearchProvider) buildMeilisearchSearchRequest(ctx context.Co
 	}
 	vector, err := p.cachedQueryVector(ctx, req.Query)
 	if err != nil {
-		return searchReq, "semantic query embedding failed: " + err.Error()
+		// The reason reaches every searching user, so it never carries the
+		// provider error: that can quote endpoint URLs and response bodies.
+		// The failure that started a cooldown was logged already.
+		if !errors.Is(err, errQueryVectorCoolingDown) {
+			slog.WarnContext(ctx, "catalog search: semantic query embedding failed", "component", "catalog", "err", err)
+		}
+		return searchReq, semanticQueryEmbeddingFailedReason
 	}
 	if len(vector) == 0 {
 		return searchReq, "semantic query embedding returned no vector"
@@ -669,6 +690,25 @@ func catalogSearchQueryTerms(query string) []string {
 	return strings.Fields(normalized)
 }
 
+// semanticQueryEmbeddingFailedReason is the fallback reason searchers see
+// when their query could not be embedded, whatever the cause.
+const semanticQueryEmbeddingFailedReason = "semantic query embedding failed"
+
+// errQueryVectorCoolingDown reports a query not embedded because a recent
+// query failed to embed on this node.
+var errQueryVectorCoolingDown = errors.New("semantic query embedding is cooling down after a failure")
+
+func (p *MeilisearchSearchProvider) vectorNow() time.Time {
+	if p.vectorClock != nil {
+		return p.vectorClock()
+	}
+	return time.Now()
+}
+
+// cachedQueryVector embeds a search query, or returns its cached vector. The
+// provider gets meilisearchQueryVectorTimeout; when it fails, this node skips
+// it for meilisearchQueryVectorFailureCooldown and callers fall back to
+// keyword search.
 func (p *MeilisearchSearchProvider) cachedQueryVector(ctx context.Context, query string) ([]float32, error) {
 	if p == nil || p.config.Vectorizer == nil {
 		return nil, fmt.Errorf("semantic query vectorizer is unavailable")
@@ -678,7 +718,7 @@ func (p *MeilisearchSearchProvider) cachedQueryVector(ctx context.Context, query
 		return nil, nil
 	}
 	cacheKey := strings.ToLower(normalized)
-	now := time.Now()
+	now := p.vectorNow()
 
 	p.vecMu.Lock()
 	if cached, ok := p.vectorCache[cacheKey]; ok && now.Before(cached.expiresAt) {
@@ -686,14 +726,27 @@ func (p *MeilisearchSearchProvider) cachedQueryVector(ctx context.Context, query
 		p.vecMu.Unlock()
 		return vector, nil
 	}
+	if now.Before(p.vectorFailedUntil) {
+		p.vecMu.Unlock()
+		return nil, errQueryVectorCoolingDown
+	}
 	p.vecMu.Unlock()
 
-	vector, err := p.config.Vectorizer.EmbedSearchQuery(ctx, normalized)
-	if err != nil {
-		return nil, err
+	embedCtx, cancel := context.WithTimeout(ctx, meilisearchQueryVectorTimeout)
+	vector, err := p.config.Vectorizer.EmbedSearchQuery(embedCtx, normalized)
+	cancel()
+	if err == nil {
+		vector, err = embeddingvectors.EnsureCanonicalDimensions(vector)
 	}
-	vector, err = embeddingvectors.EnsureCanonicalDimensions(vector)
 	if err != nil {
+		// A caller that gave up, and a query the provider refused (such as
+		// an overlong search, including a local model's context-length
+		// 5xx), say nothing about the provider.
+		if ctx.Err() == nil && !embeddings.InputRefused(err) {
+			p.vecMu.Lock()
+			p.vectorFailedUntil = p.vectorNow().Add(meilisearchQueryVectorFailureCooldown)
+			p.vecMu.Unlock()
+		}
 		return nil, err
 	}
 
diff --git a/internal/catalog/search_optimization_db_test.go b/internal/catalog/search_optimization_db_test.go
index d235575aaf..552f4f3778 100644
--- a/internal/catalog/search_optimization_db_test.go
+++ b/internal/catalog/search_optimization_db_test.go
@@ -255,7 +255,7 @@ func TestSearchOptimizedAccuracyPostgres(t *testing.T) {
 				}
 				candidateUnion := regexp.MustCompile(`mi.content_id IN \(SELECT title_mi.content_id FROM media_items title_mi WHERE (?s:.*?) UNION SELECT alias_scores.content_id FROM alias_scores\)`)
 				baselineSQL := originalExpressions.Replace(candidateUnion.ReplaceAllStringFunc(dataSQL, func(string) string { return oldMatch }))
-				rows, err := pool.Query(ctx, baselineSQL, args...)
+				rows, err := pool.Query(ctx, baselineSQL, args...) //nolint:rowserrcheck // scanItems checks Err through the cursorRows wrapper
 				if err != nil {
 					t.Fatal(err)
 				}
@@ -270,7 +270,11 @@ func TestSearchOptimizedAccuracyPostgres(t *testing.T) {
 				if err := pool.QueryRow(ctx, countSQL, options.countArgs...).Scan(&total); err != nil {
 					t.Fatal(err)
 				}
-				scoredCount := baselineSQL[:strings.Index(baselineSQL, ", page AS (")] + " SELECT COUNT(*) FROM scored WHERE $1::text IS NOT NULL"
+				baselineScored, _, ok := strings.Cut(baselineSQL, ", page AS (")
+				if !ok {
+					t.Fatalf("baseline search SQL has no page CTE:\n%s", baselineSQL)
+				}
+				scoredCount := baselineScored + " SELECT COUNT(*) FROM scored WHERE $1::text IS NOT NULL"
 				if err := pool.QueryRow(ctx, scoredCount, options.countArgs...).Scan(&scoredTotal); err != nil {
 					t.Fatal(err)
 				}
diff --git a/internal/catalog/search_postgres_cursor_provider.go b/internal/catalog/search_postgres_cursor_provider.go
index 7bdf98ec31..7e2efa9ada 100644
--- a/internal/catalog/search_postgres_cursor_provider.go
+++ b/internal/catalog/search_postgres_cursor_provider.go
@@ -7,7 +7,10 @@ import (
 	"github.com/jackc/pgx/v5"
 )
 
-const postgresCursorConfig = "postgres-relevance-v1"
+// postgresCursorConfig names the meaning of the relevance keys a cursor
+// carries. Change it whenever a key's meaning changes, so a cursor issued
+// before the change is rejected rather than seeking with keys it cannot match.
+const postgresCursorConfig = "postgres-relevance-v2"
 
 func (p *PostgresSearchProvider) searchCursorPage(ctx context.Context, req CatalogSearchRequest) (*CatalogSearchResult, error) {
 	options := SearchCursorOptions{Definition: req.Definition, GroupByWork: req.GroupByWork}
diff --git a/internal/catalog/search_postgres_mixed.go b/internal/catalog/search_postgres_mixed.go
index 0442300f50..17bf47d0a3 100644
--- a/internal/catalog/search_postgres_mixed.go
+++ b/internal/catalog/search_postgres_mixed.go
@@ -91,6 +91,20 @@ func mixedSearchOrder(prefix string) string {
 	LOWER(%[1]stitle) ASC, %[1]scontent_id ASC`, prefix)
 }
 
+// titleRankNormalization divides ts_rank_cd by the document length (PostgreSQL
+// normalization flag 2), so among titles holding the query's words apart, the
+// shorter title ranks first. It also keeps a one-alias vector comparable with a
+// media title vector, which concatenates title, original title, and sort title.
+const titleRankNormalization = 2
+
+// titlePrefixQuery is the word-prefix title query bound to $2.
+const titlePrefixQuery = `to_tsquery('simple', $2)`
+
+// titleRankSQL ranks a simple title vector against a tsquery expression.
+func titleRankSQL(vector, tsquery string) string {
+	return fmt.Sprintf("ts_rank_cd(%s, %s, %d)", vector, tsquery, titleRankNormalization)
+}
+
 // yearSuffixedTitleSQL matches a title that is the query followed by the
 // item's own year. Providers disambiguate remakes and reboots that way, so
 // "Castle (2009)" is the exact title for a "Castle" search.
@@ -234,9 +248,10 @@ func (r *ItemRepository) buildMixedSearchCursorSQL(parsed parsedSearchQuery, ite
 
 	if includeMediaItems {
 		mediaAliasArms := mixedSearchAliasArms{
-			exactArm:      "COALESCE(search_alias.exact_title_match, 0) > 0",
-			contiguousArm: "COALESCE(search_alias.contiguous_title_match, 0) > 0",
-			prefixRank:    "COALESCE(search_alias.title_prefix_rank, 0)",
+			exactArm:        "COALESCE(search_alias.exact_title_match, 0) > 0",
+			contiguousRank:  "COALESCE(search_alias.contiguous_title_match, 0)",
+			prefixRank:      "COALESCE(search_alias.title_prefix_rank, 0)",
+			contiguousWords: "search_alias.contiguous_title_words",
 		}
 		titleBranches = append(titleBranches, buildMixedSearchCandidateBranch(
 			"mi.content_id", "mi.type", "mi.title", "mi.year",
@@ -410,9 +425,8 @@ func splitSearchItemTypes(itemTypes []string) (mediaTypes []string, includeEpiso
 }
 
 func searchTitleMatchCondition(titleVector string, extraArms ...string) string {
-	prefixQuery := `to_tsquery('simple', $2)`
 	arms := []string{
-		fmt.Sprintf(`($2 <> '' AND (%s) @@ %s)`, titleVector, prefixQuery),
+		fmt.Sprintf(`($2 <> '' AND (%s) @@ %s)`, titleVector, titlePrefixQuery),
 	}
 	arms = append(arms, extraArms...)
 	return "(" + strings.Join(arms, " OR ") + ")"
@@ -563,32 +577,77 @@ func mixedSearchAliasMatchCondition(lookup searchTitleLookup) string {
 // index-entry visits and pushed the plan over the JIT threshold.
 func buildMixedSearchAliasScoresCTE(lookup searchTitleLookup) string {
 	weightedAliasVector := `setweight(to_tsvector('simple', mia.normalized_title), 'A')`
-	prefixQuery := `to_tsquery('simple', $2)`
 	matchCondition := mixedSearchAliasMatchCondition(lookup)
 	return fmt.Sprintf(`alias_scores AS MATERIALIZED (
 		SELECT
 			mia.content_id,
-			MAX(CASE WHEN mia.normalized_title = $%d THEN 1 ELSE 0 END) AS exact_title_match,
-			MAX(CASE WHEN mia.normalized_title LIKE '%%' || $%d || '%%' THEN 1 ELSE 0 END) AS contiguous_title_match,
-			MAX(CASE WHEN $2 <> '' THEN ts_rank_cd(%s, %s) ELSE 0 END) AS title_prefix_rank
+			MAX(CASE WHEN mia.normalized_title = $%[1]d THEN 1 ELSE 0 END) AS exact_title_match,
+			MAX(%[2]s) AS contiguous_title_match,
+			MAX(CASE WHEN $2 <> '' THEN %[3]s ELSE 0 END) AS title_prefix_rank,
+			MIN(%[4]s) AS contiguous_title_words
 		FROM media_item_aliases mia
-		WHERE %s
+		WHERE %[5]s
 		GROUP BY mia.content_id
 	)`,
-		lookup.exactIdx, lookup.exactIdx,
-		weightedAliasVector, prefixQuery,
+		lookup.exactIdx,
+		titlePositionSQL([]string{"mia.normalized_title"}, lookup.exactIdx),
+		titleRankSQL(weightedAliasVector, titlePrefixQuery),
+		titleWordsSQL([]string{"mia.normalized_title"}, lookup.exactIdx),
 		matchCondition,
 	)
 }
 
+// titlePositionSQL scores where the normalized query ($exactIdx) appears in the
+// best of titles: 2 at the start, 1 elsewhere, 0 when absent. A title that
+// starts with the query is what a viewer typing it is most likely looking for:
+// "The Godfather Part II" for "the godfather" before "Paul Mooney: The
+// Godfather of Comedy". Normalized titles hold only letters, digits, and
+// spaces, so the query cannot carry a LIKE wildcard.
+func titlePositionSQL(titles []string, exactIdx int) string {
+	leading := make([]string, len(titles))
+	contiguous := make([]string, len(titles))
+	for i, title := range titles {
+		leading[i] = fmt.Sprintf("%s LIKE $%d || '%%'", title, exactIdx)
+		contiguous[i] = fmt.Sprintf("%s LIKE '%%' || $%d || '%%'", title, exactIdx)
+	}
+	return fmt.Sprintf("CASE WHEN %s THEN 2 WHEN %s THEN 1 ELSE 0 END",
+		strings.Join(leading, " OR "), strings.Join(contiguous, " OR "))
+}
+
+// titleWordsSQL counts the words of the shortest of titles containing the
+// normalized query ($exactIdx); it is NULL when none does.
+func titleWordsSQL(titles []string, exactIdx int) string {
+	counts := make([]string, len(titles))
+	for i, title := range titles {
+		counts[i] = fmt.Sprintf("CASE WHEN %[1]s LIKE '%%' || $%[2]d || '%%' THEN array_length(string_to_array(%[1]s, ' '), 1) END", title, exactIdx)
+	}
+	return fmt.Sprintf("CASE WHEN $%d <> '' THEN LEAST(%s) END", exactIdx, strings.Join(counts, ", "))
+}
+
+// titlePrefixRankSQL is title_prefix_rank: 0 without a prefix query ($2), so
+// short single words rank by the other keys. Otherwise it orders titles
+// containing the query by length alone: the shortest title containing it ranks
+// first. Cover density adds a cover for each repeat of a query word, so even
+// length-normalized it ranked the alias "The Godfather & the Lady" above "The
+// Godfather 2". Titles that only contain the query's words apart keep the
+// proximity rank.
+func titlePrefixRankSQL(words, rank string) string {
+	return fmt.Sprintf("(CASE WHEN $2 <> '' THEN COALESCE((1.0 / (1 + %s))::float8, %s) ELSE 0 END)::float8", words, rank)
+}
+
 // mixedSearchAliasArms carries the media branch's provider-alias extensions to
 // the per-branch ranking SELECT. Episodes have no aliases and pass nil.
 type mixedSearchAliasArms struct {
-	exactArm      string // OR'd into exact_title_match
-	contiguousArm string // OR'd into contiguous_title_match
-	prefixRank    string // GREATEST'd with title_prefix_rank
+	exactArm        string // OR'd into exact_title_match
+	contiguousRank  string // GREATEST'd with contiguous_title_match
+	prefixRank      string // GREATEST'd with the proximity rank in title_prefix_rank
+	contiguousWords string // LEAST'd with the shortest title containing the query
 }
 
+// buildMixedSearchCandidateBranch emits the ranks as float8: a cursor carries
+// each key as text and seeks with it cast to numeric, which PostgreSQL compares
+// with a real rank as float8, so a real key such as 1/3 never equals itself and
+// its ties are skipped on the next page. float8 text round-trips exactly.
 func buildMixedSearchCandidateBranch(
 	contentIDExpr, typeExpr, titleExpr, yearExpr, titleVector, overviewVector string,
 	exactTitleExprs []string,
@@ -601,23 +660,25 @@ func buildMixedSearchCandidateBranch(
 	distinctRows bool,
 ) string {
 	exactArms := make([]string, 0, len(exactTitleExprs)+1)
-	contiguousArms := make([]string, 0, len(exactTitleExprs)+1)
 	for _, expr := range exactTitleExprs {
 		exactArms = append(exactArms, fmt.Sprintf("%s = $%d", expr, exactIdx))
-		contiguousArms = append(contiguousArms, fmt.Sprintf("%s LIKE '%%' || $%d || '%%'", expr, exactIdx))
 	}
 	if yearSuffixedTitle != "" {
 		exactArms = append(exactArms, yearSuffixedTitleSQL(yearSuffixedTitle, yearExpr, exactIdx))
 	}
-	prefixQuery := `to_tsquery('simple', $2)`
-	prefixRankExpr := fmt.Sprintf("ts_rank_cd(%s, %s)", titleVector, prefixQuery)
+	positionExpr := titlePositionSQL(exactTitleExprs, exactIdx)
+	wordsExpr := titleWordsSQL(exactTitleExprs, exactIdx)
+	rankExpr := titleRankSQL(titleVector, titlePrefixQuery)
 	if aliasArms != nil {
-		// The shared alias_scores join supplies exact/contiguous flags and
-		// prefix rank for matched identities alongside the stored title vector.
+		// The shared alias_scores join supplies exact/position scores, word
+		// counts, and prefix rank for matched identities alongside the stored
+		// title vector.
 		exactArms = append(exactArms, aliasArms.exactArm)
-		contiguousArms = append(contiguousArms, aliasArms.contiguousArm)
-		prefixRankExpr = fmt.Sprintf("GREATEST(%s, %s)", prefixRankExpr, aliasArms.prefixRank)
+		positionExpr = fmt.Sprintf("GREATEST(%s, %s)", positionExpr, aliasArms.contiguousRank)
+		wordsExpr = fmt.Sprintf("LEAST(%s, %s)", wordsExpr, aliasArms.contiguousWords)
+		rankExpr = fmt.Sprintf("GREATEST(%s, %s)", rankExpr, aliasArms.prefixRank)
 	}
+	prefixRankExpr := titlePrefixRankSQL(wordsExpr, rankExpr)
 	overviewRankExpr := "0::real"
 	if rankOverview {
 		overviewRankExpr = fmt.Sprintf("ts_rank_cd(%s, websearch_to_tsquery('english', $1))", overviewVector)
@@ -632,20 +693,20 @@ func buildMixedSearchCandidateBranch(
 			%s AS type,
 			%s AS title,
 			CASE WHEN $%d <> '' AND (%s) THEN 1 ELSE 0 END AS exact_title_match,
-			CASE WHEN $%d <> '' AND (%s) THEN 1 ELSE 0 END AS contiguous_title_match,
+			CASE WHEN $%d <> '' THEN %s ELSE 0 END AS contiguous_title_match,
 			CASE WHEN $%d::int IS NOT NULL AND (%s) = $%d::int THEN 1 ELSE 0 END AS year_match,
-			CASE WHEN $2 <> '' THEN %s ELSE 0 END AS title_prefix_rank,
-			%s AS overview_rank,
-			CASE WHEN $%d <> '' THEN ts_rank_cd(%s, phraseto_tsquery('simple', public.normalize_search_text($%d))) ELSE 0 END AS phrase_rank
+			%s AS title_prefix_rank,
+			(%s)::float8 AS overview_rank,
+			(CASE WHEN $%d <> '' THEN %s ELSE 0 END)::float8 AS phrase_rank
 		FROM %s
 		WHERE %s`,
 		selectModifier, contentIDExpr, typeExpr, titleExpr,
 		exactIdx, strings.Join(exactArms, " OR "),
-		exactIdx, strings.Join(contiguousArms, " OR "),
+		exactIdx, positionExpr,
 		yearIdx, yearExpr, yearIdx,
 		prefixRankExpr,
 		overviewRankExpr,
-		phraseIdx, titleVector, phraseIdx,
+		phraseIdx, titleRankSQL(titleVector, fmt.Sprintf("phraseto_tsquery('simple', public.normalize_search_text($%d))", phraseIdx)),
 		fromClause, strings.Join(conditions, " AND "))
 }
 
diff --git a/internal/catalog/search_provider.go b/internal/catalog/search_provider.go
index c4774a9eb7..a0e473e736 100644
--- a/internal/catalog/search_provider.go
+++ b/internal/catalog/search_provider.go
@@ -395,7 +395,8 @@ type CatalogSearchSemanticStatus struct {
 
 // CatalogSearchTypeCoverage is the per-media-type slice of the semantic coverage
 // snapshot surfaced to admins: how many embed-eligible items exist, how many are
-// vectorized, the resulting ratio, and the hysteresis-latched readiness.
+// vectorized, the resulting ratio, and whether the ratio reaches the readiness
+// threshold.
 type CatalogSearchTypeCoverage struct {
 	Type          string  `json:"type"`
 	Eligible      int     `json:"eligible"`
diff --git a/internal/catalog/search_provider_test.go b/internal/catalog/search_provider_test.go
index ff794501d2..e935ab1a0f 100644
--- a/internal/catalog/search_provider_test.go
+++ b/internal/catalog/search_provider_test.go
@@ -599,7 +599,7 @@ func TestMeilisearchSearchRequestFallsBackWhenEmbeddingFails(t *testing.T) {
 			SemanticEnabled:  true,
 			SemanticRatio:    DefaultMeilisearchSemanticRatio,
 			Embedder:         DefaultMeilisearchEmbedder,
-			Vectorizer:       &fakeCatalogSearchVectorizer{err: errors.New("embedding offline")},
+			Vectorizer:       &fakeCatalogSearchVectorizer{err: errors.New(`Post "https://embed.example/v1?key=secret-key": dial tcp: connection refused`)},
 		},
 	}
 	req, fallback := provider.buildMeilisearchSearchRequest(context.Background(), CatalogSearchRequest{
@@ -608,8 +608,9 @@ func TestMeilisearchSearchRequestFallsBackWhenEmbeddingFails(t *testing.T) {
 	if req.Vector != nil || req.Hybrid != nil {
 		t.Fatalf("fallback request should be keyword-only: %#v", req)
 	}
-	if !strings.Contains(fallback, "semantic query embedding failed") {
-		t.Fatalf("fallback = %q, want semantic query failure", fallback)
+	// Every searching user sees the reason, so it must not quote the provider error.
+	if fallback != "semantic query embedding failed" {
+		t.Fatalf("fallback = %q, want the fixed semantic query failure reason", fallback)
 	}
 }
 
diff --git a/internal/catalog/search_query_vector_test.go b/internal/catalog/search_query_vector_test.go
new file mode 100644
index 0000000000..1b7fffbebc
--- /dev/null
+++ b/internal/catalog/search_query_vector_test.go
@@ -0,0 +1,194 @@
+package catalog
+
+import (
+	"context"
+	"errors"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/prairie-server/prairie-server/internal/recommendations/embeddings"
+)
+
+// funcVectorizer embeds queries with embed and counts the calls.
+type funcVectorizer struct {
+	mu    sync.Mutex
+	calls int
+	embed func(ctx context.Context, query string) ([]float32, error)
+}
+
+func (f *funcVectorizer) EmbedSearchQuery(ctx context.Context, query string) ([]float32, error) {
+	f.mu.Lock()
+	f.calls++
+	f.mu.Unlock()
+	return f.embed(ctx, query)
+}
+
+func (f *funcVectorizer) callCount() int {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return f.calls
+}
+
+// fakeClock is a settable clock for the query-vector cache.
+type fakeClock struct {
+	mu  sync.Mutex
+	now time.Time
+}
+
+func (c *fakeClock) Now() time.Time {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return c.now
+}
+
+func (c *fakeClock) advance(d time.Duration) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.now = c.now.Add(d)
+}
+
+func semanticTestProvider(vectorizer CatalogSearchQueryVectorizer, clock *fakeClock) *MeilisearchSearchProvider {
+	return &MeilisearchSearchProvider{
+		config: MeilisearchProviderConfig{
+			MatchingStrategy: DefaultMeilisearchMatchingStrategy,
+			SemanticEnabled:  true,
+			SemanticRatio:    DefaultMeilisearchSemanticRatio,
+			Embedder:         DefaultMeilisearchEmbedder,
+			Vectorizer:       vectorizer,
+		},
+		vectorClock: clock.Now,
+	}
+}
+
+// The provider gets a short deadline: a hung embedding call cannot hold a
+// search for the batch client's minutes of retries.
+func TestQueryVectorEmbeddingHasADeadline(t *testing.T) {
+	clock := &fakeClock{now: time.Unix(1_000_000, 0)}
+	var remaining time.Duration
+	vectorizer := &funcVectorizer{embed: func(ctx context.Context, _ string) ([]float32, error) {
+		deadline, ok := ctx.Deadline()
+		if !ok {
+			return nil, errors.New("no deadline")
+		}
+		remaining = time.Until(deadline)
+		return []float32{0.5, 0.25}, nil
+	}}
+	provider := semanticTestProvider(vectorizer, clock)
+
+	req, fallback := provider.buildMeilisearchSearchRequest(t.Context(), CatalogSearchRequest{Query: "quiet space horror"})
+	if fallback != "" || req.Hybrid == nil {
+		t.Fatalf("request = %#v, fallback %q; want a hybrid request", req, fallback)
+	}
+	if remaining <= 0 || remaining > meilisearchQueryVectorTimeout {
+		t.Fatalf("embedding deadline in %v, want at most %v", remaining, meilisearchQueryVectorTimeout)
+	}
+}
+
+// A provider that never answers costs one search the deadline, not more.
+func TestQueryVectorTimeoutFallsBackToKeyword(t *testing.T) {
+	clock := &fakeClock{now: time.Unix(1_000_000, 0)}
+	vectorizer := &funcVectorizer{embed: func(ctx context.Context, _ string) ([]float32, error) {
+		<-ctx.Done()
+		return nil, ctx.Err()
+	}}
+	provider := semanticTestProvider(vectorizer, clock)
+
+	started := time.Now()
+	req, fallback := provider.buildMeilisearchSearchRequest(t.Context(), CatalogSearchRequest{Query: "quiet space horror"})
+	if elapsed := time.Since(started); elapsed > meilisearchQueryVectorTimeout+time.Second {
+		t.Fatalf("search waited %v for the embedding provider", elapsed)
+	}
+	if fallback != "semantic query embedding failed" || req.Hybrid != nil || req.Vector != nil {
+		t.Fatalf("request = %#v, fallback %q; want keyword with the fixed reason", req, fallback)
+	}
+}
+
+// After a failure the node skips the provider for the cooldown, with the same
+// fallback reason, then tries again.
+func TestQueryVectorFailureCoolsDown(t *testing.T) {
+	clock := &fakeClock{now: time.Unix(1_000_000, 0)}
+	fail := true
+	vectorizer := &funcVectorizer{embed: func(context.Context, string) ([]float32, error) {
+		if fail {
+			return nil, errors.New(`Post "http://ollama:11434/v1/embeddings": connection refused`)
+		}
+		return []float32{0.5, 0.25}, nil
+	}}
+	provider := semanticTestProvider(vectorizer, clock)
+	search := func(query string) (meilisearchSearchRequest, string) {
+		t.Helper()
+		return provider.buildMeilisearchSearchRequest(t.Context(), CatalogSearchRequest{Query: query})
+	}
+
+	if _, fallback := search("quiet space horror"); fallback != "semantic query embedding failed" || vectorizer.callCount() != 1 {
+		t.Fatalf("first failure: fallback %q, calls %d", fallback, vectorizer.callCount())
+	}
+	fail = false
+	clock.advance(meilisearchQueryVectorFailureCooldown - time.Second)
+	if req, fallback := search("slow burn detective"); fallback != "semantic query embedding failed" || req.Hybrid != nil || vectorizer.callCount() != 1 {
+		t.Fatalf("during the cooldown: fallback %q, hybrid %v, calls %d; want keyword without a provider call", fallback, req.Hybrid != nil, vectorizer.callCount())
+	}
+	clock.advance(time.Second)
+	if req, fallback := search("slow burn detective"); fallback != "" || req.Hybrid == nil || vectorizer.callCount() != 2 {
+		t.Fatalf("after the cooldown: fallback %q, hybrid %v, calls %d; want a hybrid request", fallback, req.Hybrid != nil, vectorizer.callCount())
+	}
+	// A cached vector is served even during a later cooldown.
+	fail = true
+	if _, fallback := search("quiet space horror"); fallback == "" {
+		t.Fatal("an uncached query embedded while the provider fails")
+	}
+	if req, fallback := search("slow burn detective"); fallback != "" || req.Hybrid == nil || vectorizer.callCount() != 3 {
+		t.Fatalf("cached query during a cooldown: fallback %q, calls %d", fallback, vectorizer.callCount())
+	}
+}
+
+// A caller that gives up does not put the provider in a cooldown.
+func TestQueryVectorCanceledSearchDoesNotCoolDown(t *testing.T) {
+	clock := &fakeClock{now: time.Unix(1_000_000, 0)}
+	vectorizer := &funcVectorizer{embed: func(ctx context.Context, _ string) ([]float32, error) {
+		if err := ctx.Err(); err != nil {
+			return nil, err
+		}
+		return []float32{0.5, 0.25}, nil
+	}}
+	provider := semanticTestProvider(vectorizer, clock)
+
+	canceled, cancel := context.WithCancel(t.Context())
+	cancel()
+	if _, fallback := provider.buildMeilisearchSearchRequest(canceled, CatalogSearchRequest{Query: "quiet space horror"}); fallback == "" {
+		t.Fatal("a canceled search embedded its query")
+	}
+	if req, fallback := provider.buildMeilisearchSearchRequest(t.Context(), CatalogSearchRequest{Query: "quiet space horror"}); fallback != "" || req.Hybrid == nil {
+		t.Fatalf("next search after a canceled one: fallback %q", fallback)
+	}
+	if vectorizer.callCount() != 2 {
+		t.Fatalf("provider calls = %d, want 2", vectorizer.callCount())
+	}
+}
+
+// A query the provider refuses, such as an overlong search, says nothing
+// about the provider, so the next search still embeds its query. That holds
+// for a 4xx refusal and for the context-length 5xx a local model answers.
+func TestQueryVectorRefusedQueryDoesNotCoolDown(t *testing.T) {
+	for name, refusal := range map[string]error{
+		"rejected request": &embeddings.StatusError{API: "embedding", StatusCode: 400},
+		"context length":   &embeddings.StatusError{API: "embedding", StatusCode: 500, Body: "the input length exceeds the context length"},
+	} {
+		clock := &fakeClock{now: time.Unix(1_000_000, 0)}
+		vectorizer := &funcVectorizer{embed: func(_ context.Context, query string) ([]float32, error) {
+			if query == "an overlong refused search" {
+				return nil, refusal
+			}
+			return []float32{0.5, 0.25}, nil
+		}}
+		provider := semanticTestProvider(vectorizer, clock)
+
+		if _, fallback := provider.buildMeilisearchSearchRequest(t.Context(), CatalogSearchRequest{Query: "an overlong refused search"}); fallback == "" {
+			t.Fatalf("%s: a refused query was searched semantically", name)
+		}
+		if req, fallback := provider.buildMeilisearchSearchRequest(t.Context(), CatalogSearchRequest{Query: "quiet space horror"}); fallback != "" || req.Hybrid == nil {
+			t.Fatalf("%s: next search after a refused query: fallback %q", name, fallback)
+		}
+	}
+}
diff --git a/internal/catalog/search_relevance_db_test.go b/internal/catalog/search_relevance_db_test.go
new file mode 100644
index 0000000000..b96359057f
--- /dev/null
+++ b/internal/catalog/search_relevance_db_test.go
@@ -0,0 +1,191 @@
+package catalog
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// Search returns what a viewer typing the query is looking for, on the cursor
+// and offset paths alike. A typo match must contain every word of the query,
+// and a title starting with the query ranks above one that merely contains it.
+func TestSearchRelevancePostgres(t *testing.T) {
+	pool := searchOptimizationPool(t, nil)
+	ctx := t.Context()
+	library, id := seedSearchRelevanceFixture(t, pool)
+	places := []string{"good-place", "hiding-place", "dark-place", "secret-place", "palace", "place-in-the-sun"}
+
+	repo := NewItemRepository(pool)
+	filter := AccessFilter{AllowedLibraryIDs: []int{library}}
+	search := func(t *testing.T, query string) []string {
+		t.Helper()
+		page, err := repo.SearchCursorPage(ctx, query, nil, 50, nil, filter, true)
+		if err != nil {
+			t.Fatal(err)
+		}
+		items, _, err := repo.Search(ctx, query, nil, 50, 0, filter)
+		if err != nil {
+			t.Fatal(err)
+		}
+		cursor, offset := contentIDsFromMediaItems(page.Items), contentIDsFromMediaItems(items)
+		if !slices.Equal(cursor, offset) {
+			t.Fatalf("cursor results %v differ from offset results %v", cursor, offset)
+		}
+		return cursor
+	}
+	ids := func(names ...string) []string {
+		out := make([]string, len(names))
+		for i, name := range names {
+			out[i] = id(name)
+		}
+		return out
+	}
+
+	t.Run("typo matches need every word", func(t *testing.T) {
+		// No title contains "godd". The Good Place matches every word within
+		// one typo each; each "The ... Place" title lacks "god".
+		if got := search(t, "the godd place"); !slices.Equal(got, ids("good-place", "mystic")) &&
+			!slices.Equal(got, ids("mystic", "good-place")) {
+			t.Fatalf("results = %v, want only The Good Place and the alias matching every word", got)
+		}
+	})
+	t.Run("typo matches beside exact hits need every word", func(t *testing.T) {
+		got := search(t, "the god place")
+		if !slices.Equal(got, ids("mystic", "good-place")) {
+			t.Fatalf("results = %v, want the alias hit, then The Good Place", got)
+		}
+	})
+	t.Run("typo matches check the alias with every word", func(t *testing.T) {
+		got := search(t, "lantrn harbor")
+		if !slices.Equal(slices.Sorted(slices.Values(got)), slices.Sorted(slices.Values(ids("lantern-harbor", "harbor-tales")))) {
+			t.Fatalf("results = %v, want Lantern Harbor and the item whose long alias has every word", got)
+		}
+	})
+	t.Run("relaxes only when no title has every word", func(t *testing.T) {
+		// "hidden" is three edits from "hiding", so no title has every word;
+		// the titles matching "the" and "place" remain.
+		got := search(t, "the hidden place")
+		if !slices.Contains(got, id("hiding-place")) {
+			t.Fatalf("relaxed results = %v, want The Hiding Place among them", got)
+		}
+		for _, contentID := range got {
+			if !slices.Contains(ids(places...), contentID) && contentID != id("mystic") {
+				t.Fatalf("relaxed results = %v, include %s, which lacks \"place\"", got, contentID)
+			}
+		}
+	})
+	t.Run("leading titles rank above containing titles", func(t *testing.T) {
+		got := search(t, "the godfather")
+		if len(got) != 6 || got[0] != id("godfather") ||
+			!slices.Equal(slices.Sorted(slices.Values(got[1:4])), slices.Sorted(slices.Values(ids("godfather-2", "godfather-buck", "cupids")))) {
+			t.Fatalf("results = %v, want The Godfather, then the titles starting with it, then the titles containing it", got)
+		}
+		if slices.Index(got, id("godfather-buck")) > slices.Index(got, id("cupids")) {
+			t.Fatalf("results = %v, want the three-word title before the four-word alias", got)
+		}
+	})
+	t.Run("pages match one page", func(t *testing.T) {
+		// "The Godfather Part II" and the four-word alias tie at rank 1/5,
+		// which a real rank could not carry across a page boundary.
+		for _, query := range []string{"the godfather", "star wars", "the god place"} {
+			if got, want := searchPages(t, repo, query, filter), search(t, query); !slices.Equal(got, want) {
+				t.Fatalf("%q one row per page = %v, want %v", query, got, want)
+			}
+		}
+	})
+	t.Run("repeated words do not outrank shorter titles", func(t *testing.T) {
+		got := search(t, "star wars")
+		if !slices.Equal(got, ids("star-wars", "star-wars-rebels", "clone-wars", "star-wars-twice")) {
+			t.Fatalf("results = %v, want exact, then the shorter leading title, then the rest", got)
+		}
+	})
+}
+
+// searchPages collects a search one result per cursor page.
+func searchPages(t *testing.T, repo *ItemRepository, query string, filter AccessFilter) []string {
+	t.Helper()
+	var ids []string
+	var after *SearchCursor
+	for range 50 {
+		page, err := repo.SearchCursorPage(t.Context(), query, nil, 1, after, filter, false)
+		if err != nil {
+			t.Fatal(err)
+		}
+		ids = append(ids, contentIDsFromMediaItems(page.Items)...)
+		if page.Next == nil {
+			return ids
+		}
+		after = page.Next
+	}
+	t.Fatalf("%q did not finish paging", query)
+	return nil
+}
+
+// seedSearchRelevanceFixture adds the titles TestSearchRelevancePostgres
+// searches to a new library and returns it with the fixture's content ID for a
+// name.
+func seedSearchRelevanceFixture(t *testing.T, pool *pgxpool.Pool) (int, func(string) string) {
+	t.Helper()
+	ctx := t.Context()
+	prefix := fmt.Sprintf("search-relevance-%d", time.Now().UnixNano())
+	var library int
+	if err := pool.QueryRow(ctx, `INSERT INTO media_folders(type,name,enabled) VALUES('movie',$1,true) RETURNING id`, prefix).Scan(&library); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM media_items WHERE content_id LIKE $1`, prefix+"%")
+		_, _ = pool.Exec(context.Background(), `DELETE FROM media_folders WHERE id=$1`, library)
+	})
+	exec := func(sql string, args ...any) {
+		t.Helper()
+		if _, err := pool.Exec(ctx, sql, args...); err != nil {
+			t.Fatal(err)
+		}
+	}
+	id := func(name string) string { return prefix + "-" + name }
+	addAlias := func(name, title string) {
+		t.Helper()
+		exec(`INSERT INTO media_item_aliases(content_id,title,kind,provider) VALUES($1,$2,'alternate','fixture')`, id(name), title)
+	}
+	for _, item := range []struct{ name, kind, title, alias string }{
+		{"good-place", "series", "The Good Place", ""},
+		{"hiding-place", "movie", "The Hiding Place", ""},
+		{"dark-place", "movie", "The Dark Place", ""},
+		{"secret-place", "movie", "The Secret Place", ""},
+		{"palace", "movie", "The Palace", ""},
+		{"place-in-the-sun", "movie", "A Place in the Sun", ""},
+		{"god-plant", "movie", "The God Plant", ""},
+		// Every word of "the god place" appears in this alias, so the item is
+		// an exact FTS hit for the misspelled query.
+		{"mystic", "movie", "Mystic Land", "Kunlun Kingdom: The God's Secret Place"},
+		{"godfather", "movie", "The Godfather", ""},
+		{"godfather-2", "movie", "The Godfather Part II", ""},
+		{"godfather-buck", "movie", "The Godfather Buck", ""},
+		// The repeated "the" gives this alias two covers of "the godfather".
+		{"cupids", "movie", "Cauliflower Cupids", "The Godfather & the Lady"},
+		{"godfather-comedy", "movie", "Paul Mooney: The Godfather of Comedy", ""},
+		{"godfather-coda", "movie", "Mario Puzo's The Godfather, Coda: The Death of Michael Corleone", ""},
+		{"star-wars", "movie", "Star Wars", ""},
+		{"star-wars-rebels", "series", "Star Wars Rebels", ""},
+		{"clone-wars", "movie", "Star Wars: The Clone Wars", ""},
+		{"star-wars-twice", "movie", "From Star Wars to Star Wars", ""},
+		{"lantern-harbor", "movie", "Lantern Harbor", ""},
+		{"harbor-tales", "movie", "Northern Lights", "Tales from the Lantern Keeper's Distant Northern Harbor"},
+	} {
+		exec(`INSERT INTO media_items(content_id,type,title,year) VALUES($1,$2,$3,2000)`, id(item.name), item.kind, item.title)
+		exec(`INSERT INTO media_item_libraries(content_id,media_folder_id) VALUES($1,$2)`, id(item.name), library)
+		if item.alias != "" {
+			addAlias(item.name, item.alias)
+		}
+	}
+	// By whole-query similarity to "lantrn harbor", these short aliases outrank
+	// the item's long alias, the only one with both words.
+	for _, alias := range []string{"Harbor", "The Harbor", "Old Harbor", "Harbor Days"} {
+		addAlias("harbor-tales", alias)
+	}
+	return library, id
+}
diff --git a/internal/catalog/search_service.go b/internal/catalog/search_service.go
index 98991cf488..e652bdd570 100644
--- a/internal/catalog/search_service.go
+++ b/internal/catalog/search_service.go
@@ -240,7 +240,14 @@ func (s *CatalogSearchService) Status(ctx context.Context) CatalogSearchRuntimeS
 			}
 		}
 		if s.itemRepo != nil && s.itemRepo.pool != nil {
-			if vectorCount, err := countCatalogSearchVectorDocuments(ctx, s.itemRepo.pool, settings.IndexTypes, ""); err == nil {
+			// The indexer sends only the locked model's vectors; count those.
+			model := ""
+			if s.coverage != nil {
+				if snap := s.coverage.Snapshot(); snap != nil {
+					model = snap.Model
+				}
+			}
+			if vectorCount, err := countCatalogSearchVectorDocuments(ctx, s.itemRepo.pool, settings.IndexTypes, model); err == nil {
 				status.Index.VectorDocumentCount = vectorCount
 			}
 		}
diff --git a/internal/catalog/section_localization.go b/internal/catalog/section_localization.go
new file mode 100644
index 0000000000..207e2825aa
--- /dev/null
+++ b/internal/catalog/section_localization.go
@@ -0,0 +1,101 @@
+package catalog
+
+import (
+	"context"
+	"strings"
+
+	"github.com/prairie-server/prairie-server/internal/models"
+)
+
+// LocalizeSectionItems localizes home and library section cards for the
+// viewer in batches: movies, series and other media items through their item
+// localizations, episode cards through their episode localizations. It returns
+// clones in input order, because section items can come from a
+// process-global cache and must never carry one profile's text, plus the
+// language each card's description is still missing (the detail document's
+// pending_translation_language rule), keyed by content ID.
+func (s *DetailService) LocalizeSectionItems(ctx context.Context, items []*models.MediaItem, filter AccessFilter) ([]*models.MediaItem, map[string]string, error) {
+	localized := make([]*models.MediaItem, len(items))
+	pending := make(map[string]string)
+	var media []*models.MediaItem
+	var episodeIDs []string
+	for i, item := range items {
+		localized[i] = cloneMediaItem(item)
+		if item == nil || item.ContentID == "" {
+			continue
+		}
+		if item.Type == recentTVTypeEpisode {
+			episodeIDs = append(episodeIDs, item.ContentID)
+		} else {
+			media = append(media, item)
+		}
+	}
+
+	if len(media) > 0 && s.itemLocRepo != nil {
+		targets, locs, err := s.loadItemLocalizations(ctx, media, filter)
+		if err != nil {
+			return localized, pending, err
+		}
+		for i, item := range items {
+			if item == nil || item.Type == recentTVTypeEpisode {
+				continue
+			}
+			language, loc := targets[item.ContentID], locs[item.ContentID]
+			localized[i] = keepSectionArtwork(s.localizeItemModelWith(item, language, loc), item)
+			if language := pendingTranslationLanguageWith(item, language, loc); language != "" {
+				pending[item.ContentID] = language
+			}
+		}
+	}
+
+	if len(episodeIDs) > 0 && s.episodeRepo != nil && s.episodeLocRepo != nil {
+		episodes, err := s.episodeRepo.GetByIDs(ctx, episodeIDs)
+		if err != nil {
+			return localized, pending, err
+		}
+		localizedEpisodes, err := s.LocalizeEpisodeModels(ctx, episodes, filter)
+		if err != nil {
+			return localized, pending, err
+		}
+		byID := make(map[string]*models.Episode, len(localizedEpisodes))
+		for _, episode := range localizedEpisodes {
+			if episode != nil {
+				byID[episode.ContentID] = episode
+			}
+		}
+		for i, item := range items {
+			if item == nil || item.Type != recentTVTypeEpisode {
+				continue
+			}
+			episode := byID[item.ContentID]
+			if episode == nil {
+				continue
+			}
+			// An empty localized or base title keeps the card's own title.
+			if title := strings.TrimSpace(episode.Title); title != "" {
+				localized[i].Title = title
+			}
+			if strings.TrimSpace(episode.Overview) != "" {
+				localized[i].Overview = episode.Overview
+			}
+			localized[i].MachineTranslatedFields = episode.MachineTranslatedFields
+			if episode.PendingTranslationLanguage != "" {
+				pending[item.ContentID] = episode.PendingTranslationLanguage
+			}
+		}
+	}
+	return localized, pending, nil
+}
+
+// keepSectionArtwork restores the source artwork on a localized card. Section
+// image URLs are resolved from the cached source items, so a localized poster
+// or backdrop would pair those URLs with another image's thumbhash.
+func keepSectionArtwork(localized, item *models.MediaItem) *models.MediaItem {
+	if localized == nil || item == nil {
+		return localized
+	}
+	localized.PosterPath, localized.PosterSourcePath, localized.PosterThumbhash = item.PosterPath, item.PosterSourcePath, item.PosterThumbhash
+	localized.BackdropPath, localized.BackdropSourcePath, localized.BackdropThumbhash = item.BackdropPath, item.BackdropSourcePath, item.BackdropThumbhash
+	localized.LogoPath, localized.LogoSourcePath = item.LogoPath, item.LogoSourcePath
+	return localized
+}
diff --git a/internal/catalog/section_localization_test.go b/internal/catalog/section_localization_test.go
new file mode 100644
index 0000000000..ba804e1f15
--- /dev/null
+++ b/internal/catalog/section_localization_test.go
@@ -0,0 +1,127 @@
+package catalog
+
+import (
+	"context"
+	"os"
+	"slices"
+	"testing"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/models"
+)
+
+// Section cards are shared across profiles, so localization must return
+// per-viewer clones: translated text where a row exists, the source text and
+// a pending language where it does not, and episode cards through episode rows.
+func TestLocalizeSectionItems(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	config, err := pgxpool.ParseConfig(dsn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	config.MaxConns = 1
+	pool, err := pgxpool.NewWithConfig(t.Context(), config)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(pool.Close)
+	_, err = pool.Exec(t.Context(), `
+		CREATE TEMP TABLE media_item_localizations (LIKE public.media_item_localizations INCLUDING DEFAULTS INCLUDING INDEXES);
+		CREATE TEMP TABLE episodes (LIKE public.episodes INCLUDING DEFAULTS);
+		CREATE TEMP TABLE episode_localizations (LIKE public.episode_localizations INCLUDING DEFAULTS INCLUDING INDEXES);
+		INSERT INTO episodes (content_id, series_id, season_number, episode_number, title, overview)
+		VALUES ('ep-1', 'show', 1, 1, 'Pilot', 'Source episode.'),
+		       ('ep-2', 'show', 1, 2, 'Second', 'Untranslated episode.');
+		INSERT INTO episode_localizations (episode_content_id, language, title, overview, overview_source)
+		VALUES ('ep-1', 'de', 'Pilotfolge', 'KI-Folge.', 'ai');
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
+	itemLocs := NewMediaItemLocalizationRepository(pool)
+	if err := itemLocs.Upsert(t.Context(), &models.MediaItemLocalization{ContentID: "translated", Language: "de", Title: "Übersetzt", Overview: "Anbieter.", PosterPath: "posters/de.jpg", PosterThumbhash: "de-hash"}); err != nil {
+		t.Fatal(err)
+	}
+	svc := &DetailService{
+		itemLocRepo:    itemLocs,
+		episodeRepo:    NewEpisodeRepository(pool),
+		episodeLocRepo: NewEpisodeLocalizationRepository(pool),
+	}
+	movie := func(id string) *models.MediaItem {
+		return &models.MediaItem{ContentID: id, Type: "movie", Title: "Source " + id, Overview: "Source overview.", DefaultMetadataLanguage: "en", PosterPath: "posters/en.jpg", PosterThumbhash: "en-hash"}
+	}
+	items := []*models.MediaItem{
+		movie("translated"),
+		movie("missing"),
+		{ContentID: "ep-1", Type: "episode", Title: "Pilot", Overview: "Source episode."},
+		{ContentID: "ep-2", Type: "episode", Title: "Second", Overview: "Untranslated episode."},
+	}
+	// The same item in a second row with that row's own artwork, as Recently
+	// Added shows a manga series with its latest volume's cover.
+	otherRow := movie("translated")
+	otherRow.PosterPath, otherRow.PosterThumbhash = "posters/volume.jpg", "volume-hash"
+	items = append(items, otherRow)
+
+	localized, pending, err := svc.LocalizeSectionItems(t.Context(), items, AccessFilter{ProfilePreferredLanguage: "de"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := localized[0]; got.Title != "Übersetzt" || got.Overview != "Anbieter." || len(got.MachineTranslatedFields) != 0 {
+		t.Errorf("translated movie = %q / %q / %v", got.Title, got.Overview, got.MachineTranslatedFields)
+	}
+	if got := localized[1]; got.Overview != "Source overview." {
+		t.Errorf("untranslated movie overview = %q, want the source text", got.Overview)
+	}
+	if got := localized[2]; got.Title != "Pilotfolge" || got.Overview != "KI-Folge." || !slices.Equal(got.MachineTranslatedFields, []string{MachineTranslatedOverview}) {
+		t.Errorf("episode card = %q / %q / %v", got.Title, got.Overview, got.MachineTranslatedFields)
+	}
+	// Image URLs are resolved from the source items, so the card keeps the
+	// source artwork and its thumbhash.
+	if got := localized[0]; got.PosterPath != "posters/en.jpg" || got.PosterThumbhash != "en-hash" {
+		t.Errorf("translated movie artwork = %q / %q, want the source poster", got.PosterPath, got.PosterThumbhash)
+	}
+	if got := localized[4]; got.Title != "Übersetzt" || got.PosterPath != "posters/volume.jpg" || got.PosterThumbhash != "volume-hash" {
+		t.Errorf("second row's card = %q / %q / %q, want the translation with that row's own poster", got.Title, got.PosterPath, got.PosterThumbhash)
+	}
+	if len(pending) != 2 || pending["missing"] != "de" || pending["ep-2"] != "de" {
+		t.Errorf("pending = %v, want missing:de and ep-2:de", pending)
+	}
+	if items[0].Title != "Source translated" || items[2].Title != "Pilot" {
+		t.Errorf("shared section items were mutated: %+v %+v", items[0], items[2])
+	}
+
+	// A profile without a metadata language, in a German library, reads the
+	// library's language as a library-scoped detail page does.
+	svc.folderRepo = sectionFolders{7: "de"}
+	libraryID := 7
+	localized, pending, err = svc.LocalizeSectionItems(t.Context(), items, AccessFilter{PresentationLibraryID: &libraryID})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if localized[0].Title != "Übersetzt" || pending["missing"] != "de" {
+		t.Errorf("library view = %q, pending %v, want the German localization", localized[0].Title, pending)
+	}
+
+	// The source-language profile sees the cached items unchanged.
+	localized, pending, err = svc.LocalizeSectionItems(t.Context(), items, AccessFilter{ProfilePreferredLanguage: "en"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if localized[0].Title != "Source translated" || localized[2].Title != "Pilot" || len(pending) != 0 {
+		t.Errorf("english view = %q, %q, pending %v", localized[0].Title, localized[2].Title, pending)
+	}
+}
+
+type sectionFolders map[int]string
+
+func (f sectionFolders) GetByID(_ context.Context, id int) (*models.MediaFolder, error) {
+	language, ok := f[id]
+	if !ok {
+		return nil, ErrFolderNotFound
+	}
+	return &models.MediaFolder{ID: id, MetadataLanguage: language}, nil
+}
diff --git a/internal/catalog/semantic_coverage.go b/internal/catalog/semantic_coverage.go
index 508a45377f..f2ee7413a9 100644
--- a/internal/catalog/semantic_coverage.go
+++ b/internal/catalog/semantic_coverage.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"log/slog"
+	"slices"
 	"sync"
 	"sync/atomic"
 	"time"
@@ -12,13 +13,11 @@ import (
 )
 
 const (
-	// semanticCoverageEnableRatio is the per-type vector-coverage fraction at or
-	// above which semantic search becomes eligible for that type.
-	semanticCoverageEnableRatio = 0.90
-	// semanticCoverageDisableRatio is the per-type fraction below which semantic
-	// search is disabled for that type. The gap to the enable ratio is the
-	// hysteresis band that prevents flapping near the threshold.
-	semanticCoverageDisableRatio = 0.80
+	// semanticCoverageReadyRatio is the per-type vector-coverage fraction at or
+	// above which semantic search serves that type. It is a single threshold,
+	// not a latch, so every node decides the same from the same counts.
+	// Coverage changes in embedding-batch steps, so readiness does not flap.
+	semanticCoverageReadyRatio = 0.85
 	// semanticCoverageRefreshInterval is how often the background tracker
 	// recomputes the coverage snapshot.
 	semanticCoverageRefreshInterval = 2 * time.Minute
@@ -40,9 +39,9 @@ type coverageQuerier interface {
 //
 // Ratio and Ready are populated by computeCoverageSnapshot, not by the raw
 // catalogSemanticCoverageByType count query (which leaves them zero): Ratio is
-// Vectorized/Eligible, and Ready is the hysteresis-latched readiness decision
-// for the type. Carrying them on the same struct lets a published snapshot store
-// counts and the derived gate state together.
+// Vectorized/Eligible, and Ready is the readiness decision for the type.
+// Carrying them on the same struct lets a published snapshot store counts and
+// the derived gate state together.
 type catalogTypeCoverage struct {
 	Type       string
 	Eligible   int
@@ -109,19 +108,9 @@ func catalogSemanticCoverageByType(ctx context.Context, q coverageQuerier, itemT
 	if err != nil {
 		return nil, fmt.Errorf("query semantic coverage eligible counts: %w", err)
 	}
-	func() {
-		defer eligibleRows.Close()
-		for eligibleRows.Next() {
-			var mediaType string
-			var eligible int
-			if err = eligibleRows.Scan(&mediaType, &eligible); err != nil {
-				return
-			}
-			upsert(mediaType).Eligible = eligible
-		}
-		err = eligibleRows.Err()
-	}()
-	if err != nil {
+	if err := scanCoverageCounts(eligibleRows, func(mediaType string, eligible int) {
+		upsert(mediaType).Eligible = eligible
+	}); err != nil {
 		return nil, fmt.Errorf("scan semantic coverage eligible counts: %w", err)
 	}
 
@@ -129,19 +118,9 @@ func catalogSemanticCoverageByType(ctx context.Context, q coverageQuerier, itemT
 	if err != nil {
 		return nil, fmt.Errorf("query semantic coverage vectorized counts: %w", err)
 	}
-	func() {
-		defer vectorRows.Close()
-		for vectorRows.Next() {
-			var mediaType string
-			var vectorized int
-			if err = vectorRows.Scan(&mediaType, &vectorized); err != nil {
-				return
-			}
-			upsert(mediaType).Vectorized = vectorized
-		}
-		err = vectorRows.Err()
-	}()
-	if err != nil {
+	if err := scanCoverageCounts(vectorRows, func(mediaType string, vectorized int) {
+		upsert(mediaType).Vectorized = vectorized
+	}); err != nil {
 		return nil, fmt.Errorf("scan semantic coverage vectorized counts: %w", err)
 	}
 
@@ -152,6 +131,21 @@ func catalogSemanticCoverageByType(ctx context.Context, q coverageQuerier, itemT
 	return out, nil
 }
 
+// scanCoverageCounts reads (type, count) rows into set, closes rows, and
+// returns the scan or iteration error.
+func scanCoverageCounts(rows pgx.Rows, set func(mediaType string, count int)) error {
+	defer rows.Close()
+	for rows.Next() {
+		var mediaType string
+		var count int
+		if err := rows.Scan(&mediaType, &count); err != nil {
+			return err
+		}
+		set(mediaType, count)
+	}
+	return rows.Err()
+}
+
 // semanticCoverageSnapshot is an immutable, point-in-time view of per-type
 // vector coverage for a single embedding model. Every field, including the
 // PerType map and its values, is built fresh by computeCoverageSnapshot and is
@@ -164,17 +158,12 @@ type semanticCoverageSnapshot struct {
 	UpdatedAt time.Time
 }
 
-// computeCoverageSnapshot derives a fresh snapshot from raw per-type counts. It
-// applies hysteresis per type: at or above the enable ratio a type is ready;
-// below the disable ratio it is not; inside the band it holds the previous
-// snapshot's latch for that type (defaulting to not-ready when no prior latch
-// exists). A type with no eligible items is never ready. Overall is the global
-// vectorized/eligible fraction across the supplied types.
-//
-// prev supplies only the previous per-type Ready latches for band entries;
-// callers pass nil to start fresh (e.g. immediately after a model collapse) so a
-// stale latch can never carry into a new model.
-func computeCoverageSnapshot(types []catalogTypeCoverage, model string, prev *semanticCoverageSnapshot, now time.Time) *semanticCoverageSnapshot {
+// computeCoverageSnapshot derives a fresh snapshot from raw per-type counts. A
+// type is ready when it has eligible items and at least
+// semanticCoverageReadyRatio of them carry a current-model vector. The decision
+// depends only on the counts, so nodes refreshing from the same database agree.
+// Overall is the global vectorized/eligible fraction across the supplied types.
+func computeCoverageSnapshot(types []catalogTypeCoverage, model string, now time.Time) *semanticCoverageSnapshot {
 	per := make(map[string]catalogTypeCoverage, len(types))
 	sumEligible, sumVectorized := 0, 0
 	for _, c := range types {
@@ -182,22 +171,7 @@ func computeCoverageSnapshot(types []catalogTypeCoverage, model string, prev *se
 		if c.Eligible > 0 {
 			ratio = float64(c.Vectorized) / float64(c.Eligible)
 		}
-		ready := false
-		switch {
-		case c.Eligible == 0:
-			ready = false // no data to gate on
-		case ratio >= semanticCoverageEnableRatio:
-			ready = true
-		case ratio < semanticCoverageDisableRatio:
-			ready = false
-		default:
-			// Hysteresis band [disable, enable): hold the previous latch.
-			if prev != nil {
-				if pc, ok := prev.PerType[c.Type]; ok {
-					ready = pc.Ready
-				}
-			}
-		}
+		ready := c.Eligible > 0 && ratio >= semanticCoverageReadyRatio
 		per[c.Type] = catalogTypeCoverage{
 			Type:       c.Type,
 			Eligible:   c.Eligible,
@@ -264,8 +238,8 @@ func (t *semanticCoverageTracker) now() time.Time {
 // under mu and fails safe: if the active model cannot be resolved or the count
 // query errors, the last-good snapshot is retained (no zeroed snapshot is
 // published). When the active model changes, the prior snapshot is collapsed to
-// not-ready before recompute so stale per-type latches cannot leak across
-// models.
+// not-ready before recompute, so a failed recount cannot leave the old model's
+// readiness in place.
 func (t *semanticCoverageTracker) Refresh(ctx context.Context) error {
 	t.mu.Lock()
 	defer t.mu.Unlock()
@@ -292,16 +266,14 @@ func (t *semanticCoverageTracker) Refresh(ctx context.Context) error {
 		return nil
 	}
 
-	prev := t.snap.Load()
-	if prev != nil && prev.Model != model {
-		// Model changed: collapse immediately and drop stale latches so the
-		// recompute below cannot inherit readiness from the previous model.
+	if prev := t.snap.Load(); prev != nil && prev.Model != model {
+		// Model changed: collapse immediately so a failed recount below cannot
+		// leave the previous model's readiness published.
 		t.snap.Store(&semanticCoverageSnapshot{
 			PerType:   map[string]catalogTypeCoverage{},
 			Model:     model,
 			UpdatedAt: t.now(),
 		})
-		prev = nil
 	}
 
 	types, err := t.fetch(ctx, model)
@@ -311,16 +283,16 @@ func (t *semanticCoverageTracker) Refresh(ctx context.Context) error {
 		return err
 	}
 
-	t.snap.Store(computeCoverageSnapshot(types, model, prev, t.now()))
+	t.snap.Store(computeCoverageSnapshot(types, model, t.now()))
 	return nil
 }
 
 // CoverageReady reports whether semantic search may serve the requested item
 // types. It is lock-free and fail-safe: a not-yet-computed (nil/empty) snapshot
 // reports not-ready. An explicit scope is an AND over its types; the first
-// not-ready type's reason is returned. An empty scope requires every snapshot
-// type to be ready. Requested types absent from the snapshot (no eligible items)
-// are not gated; a scope consisting only of such types reports not-ready.
+// not-ready type's reason is returned. An empty scope requires every type with
+// eligible items to be ready. Types with no eligible items are not gated; a
+// scope consisting only of such types reports not-ready.
 func (t *semanticCoverageTracker) CoverageReady(itemTypes []string) (bool, string) {
 	s := t.snap.Load()
 	if s == nil || len(s.PerType) == 0 {
@@ -333,12 +305,14 @@ func (t *semanticCoverageTracker) CoverageReady(itemTypes []string) (bool, strin
 		for k := range s.PerType {
 			requested = append(requested, k)
 		}
+		// Map order is random; sorting keeps the reported type stable.
+		slices.Sort(requested)
 	}
 
 	anyPresent := false
 	for _, ty := range requested {
 		c, ok := s.PerType[ty]
-		if !ok {
+		if !ok || c.Eligible == 0 {
 			// No eligible items of this type: nothing to gate.
 			continue
 		}
diff --git a/internal/catalog/semantic_coverage_test.go b/internal/catalog/semantic_coverage_test.go
index f258c5b81c..1735827f58 100644
--- a/internal/catalog/semantic_coverage_test.go
+++ b/internal/catalog/semantic_coverage_test.go
@@ -8,6 +8,8 @@ import (
 	"sync/atomic"
 	"testing"
 	"time"
+
+	"github.com/jackc/pgx/v5"
 )
 
 // fakeCoverageModels is an in-memory CatalogSemanticModelProvider. It returns a
@@ -145,41 +147,58 @@ func TestCoverageRefreshModelErrorRetainsLastGood(t *testing.T) {
 	}
 }
 
-// TestComputeCoverageSnapshotHysteresis exercises the pure hysteresis helper
-// across the enable/disable band: 0.85 (nil prev) -> not ready, 0.92 -> ready,
-// 0.85 (prev ready) -> stays ready (latched), 0.79 -> not ready.
-func TestComputeCoverageSnapshotHysteresis(t *testing.T) {
+// TestComputeCoverageSnapshotThreshold verifies readiness is one threshold on
+// the ratio: a fresh snapshot and one computed after a ready snapshot answer
+// the same for the same counts, so nodes refreshing from one database agree.
+func TestComputeCoverageSnapshotThreshold(t *testing.T) {
 	now := time.Unix(0, 0)
-	step := func(prev *semanticCoverageSnapshot, vectorized int) *semanticCoverageSnapshot {
-		return computeCoverageSnapshot(
+	ready := func(vectorized int) bool {
+		s := computeCoverageSnapshot(
 			[]catalogTypeCoverage{{Type: "movie", Eligible: 100, Vectorized: vectorized}},
-			"m", prev, now,
+			"m", now,
 		)
-	}
-
-	s1 := step(nil, 85) // 0.85, band, nil prev -> not ready
-	if s1.PerType["movie"].Ready {
-		t.Fatalf("0.85 with nil prev should not be ready")
-	}
-
-	s2 := step(s1, 92) // 0.92 >= enable -> ready
-	if !s2.PerType["movie"].Ready {
-		t.Fatalf("0.92 should be ready")
-	}
-
-	s3 := step(s2, 85) // 0.85, band, prev ready -> stays ready
-	if !s3.PerType["movie"].Ready {
-		t.Fatalf("0.85 with ready prev should latch ready")
-	}
-
-	s4 := step(s3, 79) // 0.79 < disable -> not ready
-	if s4.PerType["movie"].Ready {
-		t.Fatalf("0.79 should drop ready below disable threshold")
-	}
-
-	// Sanity check the recorded ratio on a band entry.
-	if got := s3.PerType["movie"].Ratio; got < 0.849 || got > 0.851 {
-		t.Fatalf("ratio = %v, want ~0.85", got)
+		return s.PerType["movie"].Ready
+	}
+	for _, tc := range []struct {
+		vectorized int
+		want       bool
+	}{
+		{84, false},
+		{85, true},
+		{92, true},
+		{100, true},
+		{0, false},
+	} {
+		if got := ready(tc.vectorized); got != tc.want {
+			t.Errorf("ratio 0.%02d ready = %v, want %v", tc.vectorized, got, tc.want)
+		}
+	}
+
+	// A tracker that was ready before coverage dropped to 0.85 and one that
+	// just started report the same.
+	models := constCoverageModels{model: "m"}
+	var vectorized atomic.Int64
+	fetch := func(context.Context, string) ([]catalogTypeCoverage, error) {
+		return []catalogTypeCoverage{{Type: "movie", Eligible: 100, Vectorized: int(vectorized.Load())}}, nil
+	}
+	longRunning := &semanticCoverageTracker{fetch: fetch, models: models, clock: time.Now}
+	vectorized.Store(95)
+	if err := longRunning.Refresh(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	for _, v := range []int64{85, 84} {
+		vectorized.Store(v)
+		fresh := &semanticCoverageTracker{fetch: fetch, models: models, clock: time.Now}
+		for _, tr := range []*semanticCoverageTracker{longRunning, fresh} {
+			if err := tr.Refresh(context.Background()); err != nil {
+				t.Fatal(err)
+			}
+		}
+		a, _ := longRunning.CoverageReady(nil)
+		b, _ := fresh.CoverageReady(nil)
+		if a != b || a != (v >= 85) {
+			t.Fatalf("at %d%% the long-running tracker says %v and a fresh one %v", v, a, b)
+		}
 	}
 }
 
@@ -188,7 +207,7 @@ func TestComputeCoverageSnapshotHysteresis(t *testing.T) {
 func TestComputeCoverageSnapshotZeroEligibleNotReady(t *testing.T) {
 	s := computeCoverageSnapshot(
 		[]catalogTypeCoverage{{Type: "movie", Eligible: 0, Vectorized: 0}},
-		"m", nil, time.Unix(0, 0),
+		"m", time.Unix(0, 0),
 	)
 	c := s.PerType["movie"]
 	if c.Ready {
@@ -212,7 +231,7 @@ func TestCoverageReadyScopeAND(t *testing.T) {
 			{Type: "movie", Eligible: 100, Vectorized: 95},  // ready
 			{Type: "series", Eligible: 100, Vectorized: 50}, // not ready
 		},
-		"m", nil, now,
+		"m", now,
 	)
 	tr := &semanticCoverageTracker{fetch: fatalFetch(t), clock: time.Now}
 	tr.snap.Store(snap)
@@ -239,7 +258,7 @@ func TestCoverageReadyScopeAND(t *testing.T) {
 func TestCoverageReadyScopeUnknownTypeNotGated(t *testing.T) {
 	snap := computeCoverageSnapshot(
 		[]catalogTypeCoverage{{Type: "movie", Eligible: 100, Vectorized: 95}},
-		"m", nil, time.Unix(0, 0),
+		"m", time.Unix(0, 0),
 	)
 	tr := &semanticCoverageTracker{fetch: fatalFetch(t), clock: time.Now}
 	tr.snap.Store(snap)
@@ -257,22 +276,17 @@ func TestCoverageReadyScopeUnknownTypeNotGated(t *testing.T) {
 	}
 }
 
-// TestCoverageRefreshBandCollapseDropsLatch is the sharper collapse assertion:
-// it drives a band ratio (0.85) under the new model so readiness can only come
-// from a latch. Because the collapse zeroes prev, the new-model snapshot must be
-// not-ready even though the same type was ready under the old model.
-func TestCoverageRefreshBandCollapseDropsLatch(t *testing.T) {
+// TestCoverageRefreshModelCollapse verifies that when the active embedding model
+// changes the next Refresh publishes a snapshot for the new model.
+func TestCoverageRefreshModelCollapse(t *testing.T) {
 	models := &fakeCoverageModels{}
-	models.push("model-a", nil) // full coverage -> ready latch under A
-	models.push("model-b", nil) // band coverage under B
+	models.push("model-a", nil)
+	models.push("model-b", nil)
 
-	var vectorized atomic.Int64
-	vectorized.Store(100)
+	// fetch always reports full coverage; only the model identity changes.
 	tr := &semanticCoverageTracker{
 		fetch: func(_ context.Context, model string) ([]catalogTypeCoverage, error) {
-			return []catalogTypeCoverage{{
-				Type: "movie", Eligible: 100, Vectorized: int(vectorized.Load()),
-			}}, nil
+			return []catalogTypeCoverage{{Type: "movie", Eligible: 100, Vectorized: 100}}, nil
 		},
 		models: models,
 		clock:  time.Now,
@@ -281,20 +295,81 @@ func TestCoverageRefreshBandCollapseDropsLatch(t *testing.T) {
 	if err := tr.Refresh(context.Background()); err != nil {
 		t.Fatalf("Refresh(A) error: %v", err)
 	}
-	if !tr.Snapshot().PerType["movie"].Ready {
-		t.Fatalf("movie should be ready under model-a at full coverage")
+	a := tr.Snapshot()
+	if a.Model != "model-a" || !a.PerType["movie"].Ready {
+		t.Fatalf("after Refresh(A): model=%q ready=%v, want model-a ready", a.Model, a.PerType["movie"].Ready)
 	}
 
-	vectorized.Store(85) // band [0.80,0.90) under model-b
 	if err := tr.Refresh(context.Background()); err != nil {
 		t.Fatalf("Refresh(B) error: %v", err)
 	}
 	b := tr.Snapshot()
+	if b.Model != "model-b" {
+		t.Fatalf("after Refresh(B): model=%q, want model-b", b.Model)
+	}
+}
+
+// TestCoverageRefreshModelChangeWithFailedRecount verifies that a model change
+// whose recount fails leaves a not-ready snapshot for the new model, never the
+// previous model's readiness.
+func TestCoverageRefreshModelChangeWithFailedRecount(t *testing.T) {
+	models := &fakeCoverageModels{}
+	models.push("model-a", nil)
+	models.push("model-b", nil)
+
+	var fail atomic.Bool
+	tr := &semanticCoverageTracker{
+		fetch: func(_ context.Context, model string) ([]catalogTypeCoverage, error) {
+			if fail.Load() {
+				return nil, errors.New("count query failed")
+			}
+			return []catalogTypeCoverage{{Type: "movie", Eligible: 100, Vectorized: 100}}, nil
+		},
+		models: models,
+		clock:  time.Now,
+	}
+
+	if err := tr.Refresh(context.Background()); err != nil {
+		t.Fatalf("Refresh(A) error: %v", err)
+	}
+	if ready, _ := tr.CoverageReady(nil); !ready {
+		t.Fatalf("movie should be ready under model-a at full coverage")
+	}
+
+	fail.Store(true)
+	if err := tr.Refresh(context.Background()); err == nil {
+		t.Fatal("Refresh(B) should surface the count failure")
+	}
+	b := tr.Snapshot()
 	if b.Model != "model-b" {
 		t.Fatalf("snapshot model = %q, want model-b", b.Model)
 	}
-	if b.PerType["movie"].Ready {
-		t.Fatalf("band coverage under a new model must not inherit the old-model latch")
+	if ready, _ := tr.CoverageReady(nil); ready {
+		t.Fatalf("a failed recount under a new model must not keep the old model's readiness")
+	}
+}
+
+// TestCoverageReadyEmptyScopeGatesTypesWithItems verifies that an empty scope
+// is gated by every type that has eligible items, and only by those.
+func TestCoverageReadyEmptyScopeGatesTypesWithItems(t *testing.T) {
+	tr := &semanticCoverageTracker{fetch: fatalFetch(t), clock: time.Now}
+
+	// A type listed with no eligible items does not gate.
+	tr.snap.Store(computeCoverageSnapshot([]catalogTypeCoverage{
+		{Type: "movie", Eligible: 100, Vectorized: 95},
+		{Type: "ebook", Eligible: 0, Vectorized: 0},
+	}, "m", time.Unix(0, 0)))
+	if ready, reason := tr.CoverageReady(nil); !ready {
+		t.Fatalf("a type with no items blocked the empty scope: %q", reason)
+	}
+
+	// A small type that has items and too few vectors still gates.
+	tr.snap.Store(computeCoverageSnapshot([]catalogTypeCoverage{
+		{Type: "movie", Eligible: 100, Vectorized: 95},
+		{Type: "ebook", Eligible: 3, Vectorized: 0},
+	}, "m", time.Unix(0, 0)))
+	if ready, reason := tr.CoverageReady(nil); ready || !strings.Contains(reason, `"ebook"`) {
+		t.Fatalf("empty scope with an unready type = %v, %q", ready, reason)
 	}
 }
 
@@ -422,3 +497,45 @@ func TestNewSemanticCoverageTrackerCoverageDBSmoke(t *testing.T) {
 		t.Fatalf("vectorized %d exceeds eligible %d", cov.Vectorized, cov.Eligible)
 	}
 }
+
+// fakeCountRows yields (type, count) rows, then reports err from Err.
+type fakeCountRows struct {
+	pgx.Rows
+	rows   []catalogTypeCoverage
+	err    error
+	closed bool
+}
+
+func (r *fakeCountRows) Next() bool { return len(r.rows) > 0 }
+
+func (r *fakeCountRows) Scan(dest ...any) error {
+	mediaType, okType := dest[0].(*string)
+	count, okCount := dest[1].(*int)
+	if !okType || !okCount {
+		return errors.New("fakeCountRows: scan wants *string, *int")
+	}
+	*mediaType, *count = r.rows[0].Type, r.rows[0].Eligible
+	r.rows = r.rows[1:]
+	return nil
+}
+
+func (r *fakeCountRows) Err() error { return r.err }
+func (r *fakeCountRows) Close()     { r.closed = true }
+
+// TestScanCoverageCountsReportsIterationError pins that a query failing
+// mid-stream fails the count instead of returning the rows read so far.
+func TestScanCoverageCountsReportsIterationError(t *testing.T) {
+	streamErr := errors.New("connection reset")
+	rows := &fakeCountRows{rows: []catalogTypeCoverage{{Type: "movie", Eligible: 3}}, err: streamErr}
+	got := map[string]int{}
+	err := scanCoverageCounts(rows, func(mediaType string, count int) { got[mediaType] = count })
+	if !errors.Is(err, streamErr) {
+		t.Fatalf("err = %v, want %v", err, streamErr)
+	}
+	if got["movie"] != 3 {
+		t.Fatalf("counts = %v, want the row read before the failure", got)
+	}
+	if !rows.closed {
+		t.Fatal("rows were not closed")
+	}
+}
diff --git a/internal/catalog/tmdb_entry_match.go b/internal/catalog/tmdb_entry_match.go
new file mode 100644
index 0000000000..47d6c952d2
--- /dev/null
+++ b/internal/catalog/tmdb_entry_match.go
@@ -0,0 +1,169 @@
+package catalog
+
+import (
+	"context"
+	"strconv"
+)
+
+// TMDBExternalIDEnricher fills in, in place, the IMDb and TVDB IDs of TMDB
+// entries. A TMDB fetcher implements it when it can look them up.
+type TMDBExternalIDEnricher interface {
+	EnrichExternalIDs(ctx context.Context, entries []TMDBCollectionEntry) error
+}
+
+// TMDBIDFinder looks up the TMDB IDs of catalog titles known only by IMDb or
+// TVDB ID. A TMDB fetcher implements it when it can; each title is a TMDB
+// request. The result holds one ID per title, 0 when TMDB has none.
+type TMDBIDFinder interface {
+	FindTMDBIDs(ctx context.Context, itemType string, titles []TitleWithoutTMDBID) ([]int, error)
+}
+
+// ExternalIDResolver finds catalog titles by external ID in one batch per
+// title type. *ItemRepository satisfies it.
+type ExternalIDResolver interface {
+	GetByExternalIDs(ctx context.Context, batch ExternalIDBatch, itemType string) (*ExternalIDLookup, error)
+	TitlesWithoutTMDBID(ctx context.Context, itemType string, limit int) ([]TitleWithoutTMDBID, error)
+}
+
+// MatchTMDBEntries returns, for each entry in order, the content_id of the
+// catalog title it names, or "" when there is none. Entries other than movies
+// and TV shows never match.
+//
+// Entries match on the IDs they carry first, which for TMDB sources is the
+// TMDB ID alone. An entry left unmatched can still name a catalog title only
+// when that title has no usable TMDB ID of its own (see TitlesWithoutTMDBID),
+// so further TMDB requests are made only when the catalog holds such titles,
+// and then for whichever side is smaller: those titles (through fetcher's TMDBIDFinder) or the unmatched
+// entries (through its TMDBExternalIDEnricher, which writes the IMDb and TVDB
+// IDs it finds back into entries). Titles the catalog does not hold cost no
+// TMDB request.
+func MatchTMDBEntries(ctx context.Context, items ExternalIDResolver, fetcher any, entries []TMDBCollectionEntry) ([]string, error) {
+	contentIDs := make([]string, len(entries))
+	candidates := make([]int, 0, len(entries))
+	for i, entry := range entries {
+		if tmdbEntryItemType(entry) != "" {
+			candidates = append(candidates, i)
+		}
+	}
+	if err := matchTMDBEntryIndexes(ctx, items, entries, candidates, contentIDs); err != nil {
+		return nil, err
+	}
+	for _, itemType := range []string{playableTypeMovie, playableTypeSeries} {
+		var unmatched []int
+		for _, i := range candidates {
+			if contentIDs[i] == "" && entries[i].ID > 0 && tmdbEntryItemType(entries[i]) == itemType {
+				unmatched = append(unmatched, i)
+			}
+		}
+		if len(unmatched) == 0 {
+			continue
+		}
+		if err := matchUnmatchedTMDBEntries(ctx, items, fetcher, itemType, entries, unmatched, contentIDs); err != nil {
+			return nil, err
+		}
+	}
+	return contentIDs, nil
+}
+
+// matchUnmatchedTMDBEntries matches the listed entries of itemType, which
+// their TMDB IDs did not match, against the catalog's titles without a TMDB
+// ID.
+func matchUnmatchedTMDBEntries(ctx context.Context, items ExternalIDResolver, fetcher any, itemType string, entries []TMDBCollectionEntry, unmatched []int, contentIDs []string) error {
+	// One past the entries is enough to tell which side is smaller.
+	titles, err := items.TitlesWithoutTMDBID(ctx, itemType, len(unmatched)+1)
+	if err != nil || len(titles) == 0 {
+		return err
+	}
+	if finder, ok := fetcher.(TMDBIDFinder); ok && len(titles) <= len(unmatched) {
+		tmdbIDs, err := finder.FindTMDBIDs(ctx, itemType, titles)
+		if err != nil {
+			return err
+		}
+		byTMDB := make(map[int]string, len(titles))
+		for j, id := range tmdbIDs {
+			if _, taken := byTMDB[id]; id > 0 && !taken {
+				byTMDB[id] = titles[j].ContentID
+			}
+		}
+		for _, i := range unmatched {
+			contentIDs[i] = byTMDB[entries[i].ID]
+		}
+		return nil
+	}
+	enricher, ok := fetcher.(TMDBExternalIDEnricher)
+	if !ok {
+		return nil
+	}
+	subset := make([]TMDBCollectionEntry, len(unmatched))
+	for j, i := range unmatched {
+		subset[j] = entries[i]
+	}
+	if err := enricher.EnrichExternalIDs(ctx, subset); err != nil {
+		return err
+	}
+	for j, i := range unmatched {
+		entries[i].IMDbID, entries[i].TVDBID = subset[j].IMDbID, subset[j].TVDBID
+	}
+	return matchTMDBEntryIndexes(ctx, items, entries, unmatched, contentIDs)
+}
+
+// matchTMDBEntryIndexes resolves entries[i] for each listed index into
+// contentIDs[i], with one catalog lookup per title type.
+func matchTMDBEntryIndexes(ctx context.Context, items ExternalIDResolver, entries []TMDBCollectionEntry, indexes []int, contentIDs []string) error {
+	var movies, series ExternalIDBatch
+	for _, i := range indexes {
+		entry := entries[i]
+		batch := &movies
+		if tmdbEntryItemType(entry) == playableTypeSeries {
+			batch = &series
+		}
+		if entry.ID > 0 {
+			batch.TMDBIDs = append(batch.TMDBIDs, strconv.Itoa(entry.ID))
+		}
+		if entry.IMDbID != "" {
+			batch.IMDbIDs = append(batch.IMDbIDs, entry.IMDbID)
+		}
+		if entry.TVDBID > 0 {
+			batch.TVDBIDs = append(batch.TVDBIDs, strconv.Itoa(entry.TVDBID))
+		}
+	}
+	movieLookup, err := items.GetByExternalIDs(ctx, movies, playableTypeMovie)
+	if err != nil {
+		return err
+	}
+	seriesLookup, err := items.GetByExternalIDs(ctx, series, playableTypeSeries)
+	if err != nil {
+		return err
+	}
+	for _, i := range indexes {
+		entry := entries[i]
+		itemType := tmdbEntryItemType(entry)
+		lookup := movieLookup
+		if itemType == playableTypeSeries {
+			lookup = seriesLookup
+		}
+		var tmdbID, tvdbID string
+		if entry.ID > 0 {
+			tmdbID = strconv.Itoa(entry.ID)
+		}
+		if entry.TVDBID > 0 {
+			tvdbID = strconv.Itoa(entry.TVDBID)
+		}
+		contentIDs[i] = lookup.Resolve(itemType, tvdbID, tmdbID, entry.IMDbID)
+	}
+	return nil
+}
+
+// tmdbEntryItemType is the catalog title type a TMDB entry names: "movie" or
+// "series", or "" for anything else (TMDB's trending feed also lists people).
+// Franchise parts carry no media type and are movies.
+func tmdbEntryItemType(entry TMDBCollectionEntry) string {
+	switch entry.MediaType {
+	case playableTypeMovie, "":
+		return playableTypeMovie
+	case "tv":
+		return playableTypeSeries
+	default:
+		return ""
+	}
+}
diff --git a/internal/catalog/tmdb_entry_match_test.go b/internal/catalog/tmdb_entry_match_test.go
new file mode 100644
index 0000000000..ec9d2cc72c
--- /dev/null
+++ b/internal/catalog/tmdb_entry_match_test.go
@@ -0,0 +1,195 @@
+package catalog
+
+import (
+	"context"
+	"errors"
+	"slices"
+	"strconv"
+	"testing"
+)
+
+// fakeExternalIDResolver answers GetByExternalIDs from fixed maps per type and
+// lists withoutTMDB as the catalog's titles lacking a TMDB ID.
+type fakeExternalIDResolver struct {
+	byType      map[string]*ExternalIDLookup
+	withoutTMDB map[string][]TitleWithoutTMDBID
+	calls       int
+}
+
+func (f *fakeExternalIDResolver) GetByExternalIDs(_ context.Context, batch ExternalIDBatch, itemType string) (*ExternalIDLookup, error) {
+	f.calls++
+	out := &ExternalIDLookup{ByTMDB: map[string]string{}, ByIMDb: map[string]string{}, ByTVDB: map[string]string{}}
+	known := f.byType[itemType]
+	if known == nil {
+		return out, nil
+	}
+	for _, id := range batch.TMDBIDs {
+		if v := known.ByTMDB[id]; v != "" {
+			out.ByTMDB[id] = v
+		}
+	}
+	for _, id := range batch.IMDbIDs {
+		if v := known.ByIMDb[id]; v != "" {
+			out.ByIMDb[id] = v
+		}
+	}
+	for _, id := range batch.TVDBIDs {
+		if v := known.ByTVDB[id]; v != "" {
+			out.ByTVDB[id] = v
+		}
+	}
+	return out, nil
+}
+
+func (f *fakeExternalIDResolver) TitlesWithoutTMDBID(_ context.Context, itemType string, limit int) ([]TitleWithoutTMDBID, error) {
+	titles := f.withoutTMDB[itemType]
+	return titles[:min(limit, len(titles))], nil
+}
+
+// enrichingFetcher records the entries it enriches, giving each an IMDb ID of
+// "tt" plus its TMDB ID.
+type enrichingFetcher struct {
+	asked []int
+	err   error
+}
+
+func (f *enrichingFetcher) EnrichExternalIDs(_ context.Context, entries []TMDBCollectionEntry) error {
+	for i := range entries {
+		f.asked = append(f.asked, entries[i].ID)
+		entries[i].IMDbID = "tt" + strconv.Itoa(entries[i].ID)
+	}
+	return f.err
+}
+
+// findingFetcher also finds TMDB IDs for titles: IMDb "ttN" is TMDB N.
+type findingFetcher struct {
+	enrichingFetcher
+	found []string
+}
+
+func (f *findingFetcher) FindTMDBIDs(_ context.Context, _ string, titles []TitleWithoutTMDBID) ([]int, error) {
+	ids := make([]int, len(titles))
+	for i, title := range titles {
+		f.found = append(f.found, title.ContentID)
+		ids[i], _ = strconv.Atoi(title.IMDbID[2:])
+	}
+	return ids, nil
+}
+
+func TestMatchTMDBEntriesMakesNoTMDBRequestsWhenEveryTitleHasATMDBID(t *testing.T) {
+	items := &fakeExternalIDResolver{byType: map[string]*ExternalIDLookup{
+		"movie": {ByTMDB: map[string]string{"1": "movie-a"}},
+	}}
+	fetcher := &findingFetcher{}
+	entries := []TMDBCollectionEntry{{ID: 1, MediaType: "movie"}, {ID: 2, MediaType: "movie"}, {ID: 3, MediaType: "tv"}}
+
+	got, err := MatchTMDBEntries(t.Context(), items, fetcher, entries)
+	if err != nil {
+		t.Fatalf("MatchTMDBEntries: %v", err)
+	}
+	if !slices.Equal(got, []string{"movie-a", "", ""}) {
+		t.Fatalf("content IDs = %v", got)
+	}
+	if len(fetcher.asked) != 0 || len(fetcher.found) != 0 {
+		t.Fatalf("made TMDB requests (enriched %v, found %v) with no title lacking a TMDB ID", fetcher.asked, fetcher.found)
+	}
+}
+
+func TestMatchTMDBEntriesFindsTitlesWhenFewerThanUnmatchedEntries(t *testing.T) {
+	items := &fakeExternalIDResolver{
+		byType:      map[string]*ExternalIDLookup{"movie": {ByTMDB: map[string]string{"1": "movie-a"}}},
+		withoutTMDB: map[string][]TitleWithoutTMDBID{"movie": {{ContentID: "movie-b", IMDbID: "tt3"}}},
+	}
+	fetcher := &findingFetcher{}
+	entries := []TMDBCollectionEntry{
+		{ID: 1, MediaType: "movie"},
+		{ID: 2, MediaType: "movie"},
+		{ID: 3, MediaType: "movie"}, // the title the catalog holds by IMDb ID only
+		{ID: 4, MediaType: "movie"},
+		{ID: 5, MediaType: "person"},
+	}
+
+	got, err := MatchTMDBEntries(t.Context(), items, fetcher, entries)
+	if err != nil {
+		t.Fatalf("MatchTMDBEntries: %v", err)
+	}
+	if want := []string{"movie-a", "", "movie-b", "", ""}; !slices.Equal(got, want) {
+		t.Fatalf("content IDs = %v, want %v", got, want)
+	}
+	if !slices.Equal(fetcher.found, []string{"movie-b"}) || len(fetcher.asked) != 0 {
+		t.Fatalf("found %v and enriched %v; want one title found and no entry enriched", fetcher.found, fetcher.asked)
+	}
+}
+
+func TestMatchTMDBEntriesEnrichesEntriesWhenFewerThanTitlesWithoutTMDBID(t *testing.T) {
+	items := &fakeExternalIDResolver{
+		byType: map[string]*ExternalIDLookup{"movie": {ByIMDb: map[string]string{"tt2": "movie-b"}}},
+		withoutTMDB: map[string][]TitleWithoutTMDBID{"movie": {
+			{ContentID: "movie-b", IMDbID: "tt2"}, {ContentID: "movie-x", IMDbID: "tt8"}, {ContentID: "movie-y", IMDbID: "tt9"},
+		}},
+	}
+	fetcher := &findingFetcher{}
+	entries := []TMDBCollectionEntry{{ID: 2, MediaType: "movie"}, {ID: 4, MediaType: "movie"}}
+
+	got, err := MatchTMDBEntries(t.Context(), items, fetcher, entries)
+	if err != nil {
+		t.Fatalf("MatchTMDBEntries: %v", err)
+	}
+	if !slices.Equal(got, []string{"movie-b", ""}) {
+		t.Fatalf("content IDs = %v", got)
+	}
+	if !slices.Equal(fetcher.asked, []int{2, 4}) || len(fetcher.found) != 0 {
+		t.Fatalf("enriched %v and found %v; want the two entries enriched and no title found", fetcher.asked, fetcher.found)
+	}
+	if entries[0].IMDbID != "tt2" {
+		t.Fatalf("enriched IMDb ID not written back: %+v", entries[0])
+	}
+}
+
+func TestMatchTMDBEntriesWithoutFinderEnrichesUnmatchedEntries(t *testing.T) {
+	items := &fakeExternalIDResolver{
+		byType:      map[string]*ExternalIDLookup{"series": {ByIMDb: map[string]string{"tt7": "series-a"}}},
+		withoutTMDB: map[string][]TitleWithoutTMDBID{"series": {{ContentID: "series-a", IMDbID: "tt7"}}},
+	}
+	fetcher := &enrichingFetcher{}
+	got, err := MatchTMDBEntries(t.Context(), items, fetcher, []TMDBCollectionEntry{{ID: 7, MediaType: "tv"}, {ID: 8, MediaType: "tv"}})
+	if err != nil {
+		t.Fatalf("MatchTMDBEntries: %v", err)
+	}
+	if !slices.Equal(got, []string{"series-a", ""}) || !slices.Equal(fetcher.asked, []int{7, 8}) {
+		t.Fatalf("got %v after enriching %v", got, fetcher.asked)
+	}
+}
+
+func TestMatchTMDBEntriesReturnsEnrichmentError(t *testing.T) {
+	items := &fakeExternalIDResolver{withoutTMDB: map[string][]TitleWithoutTMDBID{"movie": {{ContentID: "m", IMDbID: "tt1"}, {ContentID: "n", IMDbID: "tt2"}}}}
+	fetcher := &enrichingFetcher{err: context.Canceled}
+	if _, err := MatchTMDBEntries(t.Context(), items, fetcher, []TMDBCollectionEntry{{ID: 1, MediaType: "movie"}}); !errors.Is(err, context.Canceled) {
+		t.Fatalf("error = %v, want context.Canceled", err)
+	}
+}
+
+func TestExternalIDLookupResolveFollowsAnchorPrecedence(t *testing.T) {
+	lookup := &ExternalIDLookup{
+		ByTMDB: map[string]string{"1": "by-tmdb"},
+		ByIMDb: map[string]string{"tt1": "by-imdb"},
+		ByTVDB: map[string]string{"9": "by-tvdb"},
+	}
+	for _, tc := range []struct {
+		itemType, tvdb, tmdb, imdb, want string
+	}{
+		{playableTypeSeries, "9", "1", "tt1", "by-tvdb"},
+		{playableTypeSeries, "", "1", "tt1", "by-tmdb"},
+		{playableTypeMovie, "9", "1", "tt1", "by-tmdb"},
+		{playableTypeMovie, "9", "", "tt1", "by-imdb"},
+		{playableTypeMovie, "9", "2", "tt2", "by-tvdb"},
+		{playableTypeMovie, "8", "2", "tt2", ""},
+	} {
+		if got := lookup.Resolve(tc.itemType, tc.tvdb, tc.tmdb, tc.imdb); got != tc.want {
+			t.Errorf("Resolve(%q, %q, %q, %q) = %q, want %q", tc.itemType, tc.tvdb, tc.tmdb, tc.imdb, got, tc.want)
+		}
+	}
+	if got := (*ExternalIDLookup)(nil).Resolve(playableTypeMovie, "9", "1", "tt1"); got != "" {
+		t.Errorf("nil lookup resolved %q", got)
+	}
+}
diff --git a/internal/catalog/trakt_list_url_test.go b/internal/catalog/trakt_list_url_test.go
deleted file mode 100644
index 1c34f44559..0000000000
--- a/internal/catalog/trakt_list_url_test.go
+++ /dev/null
@@ -1,42 +0,0 @@
-package catalog
-
-import "testing"
-
-func TestParseTraktListURL(t *testing.T) {
-	cases := []struct {
-		name    string
-		in      string
-		user    string
-		list    string
-		wantErr bool
-	}{
-		{"full url", "https://trakt.tv/users/jjjonesjr33/lists/saw-cinematic-universe-in-timeline-order", "jjjonesjr33", "saw-cinematic-universe-in-timeline-order", false},
-		{"www url", "https://www.trakt.tv/users/someone/lists/best-of", "someone", "best-of", false},
-		{"mixed-case host", "https://Trakt.TV/users/someone/lists/best-of", "someone", "best-of", false},
-		{"url with query", "https://trakt.tv/users/someone/lists/best-of?sort=rank,asc", "someone", "best-of", false},
-		{"no scheme", "trakt.tv/users/someone/lists/best-of", "someone", "best-of", false},
-		{"shorthand", "someone/best-of", "someone", "best-of", false},
-		{"trailing slash", "https://trakt.tv/users/someone/lists/best-of/", "someone", "best-of", false},
-		{"empty", "", "", "", true},
-		{"wrong host", "https://example.com/users/someone/lists/best-of", "", "", true},
-		{"not a list url", "https://trakt.tv/movies/trending", "", "", true},
-		{"missing slug", "https://trakt.tv/users/someone/lists/", "", "", true},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			user, list, err := ParseTraktListURL(tc.in)
-			if tc.wantErr {
-				if err == nil {
-					t.Fatalf("ParseTraktListURL(%q) = %q/%q, want error", tc.in, user, list)
-				}
-				return
-			}
-			if err != nil {
-				t.Fatalf("ParseTraktListURL(%q): %v", tc.in, err)
-			}
-			if user != tc.user || list != tc.list {
-				t.Fatalf("ParseTraktListURL(%q) = %q/%q, want %q/%q", tc.in, user, list, tc.user, tc.list)
-			}
-		})
-	}
-}
diff --git a/internal/catalogseed/service.go b/internal/catalogseed/service.go
index 75f31f0582..f0f24dc799 100644
--- a/internal/catalogseed/service.go
+++ b/internal/catalogseed/service.go
@@ -48,6 +48,10 @@ type Service struct {
 	pool       *pgxpool.Pool
 	personRepo *catalog.PersonRepository
 	recsRepo   *recommendations.Repo
+	// embeddingModel is the configured embedding model. Imports keep only
+	// bundle embeddings from the locked model, or from this one when no lock
+	// exists yet.
+	embeddingModel string
 }
 
 func NewService(pool *pgxpool.Pool, personRepo *catalog.PersonRepository, recsRepo *recommendations.Repo) *Service {
@@ -60,6 +64,16 @@ func NewService(pool *pgxpool.Pool, personRepo *catalog.PersonRepository, recsRe
 	return &Service{pool: pool, personRepo: personRepo, recsRepo: recsRepo}
 }
 
+// WithEmbeddingModel sets the configured embedding model and returns the
+// service. Without it, an import into an installation with no embedding lock
+// keeps none of the bundle's embeddings.
+func (s *Service) WithEmbeddingModel(model string) *Service {
+	if s != nil {
+		s.embeddingModel = strings.TrimSpace(model)
+	}
+	return s
+}
+
 func (s *Service) Export(ctx context.Context, opts ExportOptions) ([]byte, error) {
 	var raw bytes.Buffer
 	if _, err := s.ExportToWriter(ctx, &raw, opts, nil); err != nil {
@@ -138,6 +152,12 @@ func (s *Service) ImportWithProgress(ctx context.Context, data []byte, opts Impo
 	}
 
 	result := &ImportResult{}
+	embeddings, err := s.acceptedEmbeddings(ctx, tx, bundle.Embeddings)
+	if err != nil {
+		return nil, err
+	}
+	result.EmbeddingsSkipped = len(bundle.Embeddings) - len(embeddings)
+	currentWork += result.EmbeddingsSkipped
 	folderIDMap := make(map[int]int, len(libraries))
 	for _, library := range libraries {
 		localID, created, matched, importErr := importLibrary(ctx, tx, library, opts.ConflictMode == ConflictModeOverwrite)
@@ -214,13 +234,13 @@ func (s *Service) ImportWithProgress(ctx context.Context, data []byte, opts Impo
 		if err := s.replacePeople(ctx, tx, bundle.People, itemStates, ConflictModeOverwrite, result); err != nil {
 			return nil, err
 		}
-		if err := s.importEmbeddings(ctx, tx, bundle.Embeddings, true, result, func(processed int) {
+		if err := s.importEmbeddings(ctx, tx, embeddings, true, result, func(processed int) {
 			currentWork += processed
 			reportProgress("Importing embeddings", currentWork, totalWork)
 		}); err != nil {
 			return nil, err
 		}
-		if err := catalog.EnqueueSearchIndexUpserts(ctx, tx, catalogSeedSearchUpsertIDs(itemStates, bundle.Embeddings, nil, nil)); err != nil {
+		if err := catalog.EnqueueSearchIndexUpserts(ctx, tx, catalogSeedSearchUpsertIDs(itemStates, embeddings, nil, nil)); err != nil {
 			return nil, fmt.Errorf("enqueueing catalog search seed import updates: %w", err)
 		}
 		currentWork++
@@ -398,7 +418,7 @@ func (s *Service) ImportWithProgress(ctx context.Context, data []byte, opts Impo
 	if err := s.replacePeople(ctx, tx, bundle.People, itemStates, opts.ConflictMode, result); err != nil {
 		return nil, fmt.Errorf("replacing people: %w", err)
 	}
-	if err := s.importEmbeddings(ctx, tx, bundle.Embeddings, false, result, func(processed int) {
+	if err := s.importEmbeddings(ctx, tx, embeddings, false, result, func(processed int) {
 		currentWork += processed
 		reportProgress("Importing embeddings", currentWork, totalWork)
 	}); err != nil {
@@ -598,7 +618,7 @@ func (s *Service) ImportWithProgress(ctx context.Context, data []byte, opts Impo
 	}
 	result.LinksCreated = int(linksAffected)
 
-	if err := catalog.EnqueueSearchIndexUpserts(ctx, tx, catalogSeedSearchUpsertIDs(itemStates, bundle.Embeddings, bundle.Files, bundle.LibraryLinks)); err != nil {
+	if err := catalog.EnqueueSearchIndexUpserts(ctx, tx, catalogSeedSearchUpsertIDs(itemStates, embeddings, bundle.Files, bundle.LibraryLinks)); err != nil {
 		return nil, fmt.Errorf("enqueueing catalog search seed import updates: %w", err)
 	}
 	currentWork++
@@ -715,18 +735,18 @@ func itemToRecord(item *models.MediaItem) ItemRecord {
 func decodeBundle(data []byte) (*Bundle, error) {
 	gz, err := gzip.NewReader(bytes.NewReader(data))
 	if err != nil {
-		return nil, fmt.Errorf("%w: opening catalog seed bundle: %w", ErrInvalidBundle, err)
+		return nil, fmt.Errorf("%w: opening catalog seed bundle: %v", ErrInvalidBundle, err) //nolint:errorlint // the sentinel is the verdict on an uploaded bundle; the decode error is only reported
 	}
 	defer gz.Close()
 
 	payload, err := io.ReadAll(gz)
 	if err != nil {
-		return nil, fmt.Errorf("%w: reading catalog seed bundle: %w", ErrInvalidBundle, err)
+		return nil, fmt.Errorf("%w: reading catalog seed bundle: %v", ErrInvalidBundle, err) //nolint:errorlint // the sentinel is the verdict on an uploaded bundle; the decode error is only reported
 	}
 
 	var bundle Bundle
 	if err := json.Unmarshal(payload, &bundle); err != nil {
-		return nil, fmt.Errorf("%w: decoding catalog seed bundle: %w", ErrInvalidBundle, err)
+		return nil, fmt.Errorf("%w: decoding catalog seed bundle: %v", ErrInvalidBundle, err) //nolint:errorlint // the sentinel is the verdict on an uploaded bundle; the decode error is only reported
 	}
 	return &bundle, nil
 }
@@ -1035,6 +1055,46 @@ func (s *Service) replacePeople(ctx context.Context, tx pgx.Tx, people []PersonR
 	return nil
 }
 
+// acceptedEmbeddings returns the bundle embeddings from this installation's
+// embedding model: the locked model, read inside the import transaction, or
+// the configured model when nothing is locked yet. Vectors from another model
+// live in another space, and recommendations and search would compare them
+// with this model's vectors. The backfill embeds the skipped items instead.
+// The import never writes the lock: a bundle carries neither the base URL nor
+// the source dimensions a lock records.
+func (s *Service) acceptedEmbeddings(ctx context.Context, tx pgx.Tx, records []EmbeddingRecord) ([]EmbeddingRecord, error) {
+	if len(records) == 0 {
+		return records, nil
+	}
+	// Held until the import commits, so a reset cannot delete embeddings and
+	// the lock between this read and the inserts; a reset running now is
+	// waited for.
+	if _, err := tx.Exec(ctx, `SELECT pg_advisory_xact_lock_shared($1)`, recommendations.EmbeddingWritersLock); err != nil {
+		return nil, fmt.Errorf("waiting for an embeddings reset: %w", err)
+	}
+	model := s.embeddingModel
+	lock, err := recommendations.ReadEmbeddingLock(ctx, tx)
+	if err != nil {
+		return nil, fmt.Errorf("reading embedding lock for import: %w", err)
+	}
+	if lock != nil {
+		model = lock.Model
+	}
+	return embeddingsForModel(records, model), nil
+}
+
+// embeddingsForModel returns the records whose model is model. An empty model
+// matches nothing.
+func embeddingsForModel(records []EmbeddingRecord, model string) []EmbeddingRecord {
+	accepted := make([]EmbeddingRecord, 0, len(records))
+	for _, rec := range records {
+		if model != "" && rec.Model == model {
+			accepted = append(accepted, rec)
+		}
+	}
+	return accepted
+}
+
 // embeddingImportBatchSize is larger than the general batch size because
 // embeddings only have 4 columns (4 × 5000 = 20,000 params, well within the 65,535 limit).
 const embeddingImportBatchSize = 5000
diff --git a/internal/catalogseed/service_db_test.go b/internal/catalogseed/service_db_test.go
index 8113b1b608..c516cf29d4 100644
--- a/internal/catalogseed/service_db_test.go
+++ b/internal/catalogseed/service_db_test.go
@@ -1,13 +1,22 @@
 package catalogseed
 
 import (
+	"bytes"
+	"compress/gzip"
 	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
 	"testing"
 	"time"
 
+	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgxpool"
 
 	"github.com/prairie-server/prairie-server/internal/envutil"
+
+	"github.com/prairie-server/prairie-server/internal/config"
+	"github.com/prairie-server/prairie-server/internal/database"
 )
 
 func newCatalogSeedTestPool(t *testing.T) *pgxpool.Pool {
@@ -16,11 +25,12 @@ func newCatalogSeedTestPool(t *testing.T) *pgxpool.Pool {
 	if dsn == "" {
 		t.Skip("SILO_TEST_DATABASE_URL is not set")
 	}
-	pool, err := pgxpool.New(context.Background(), dsn)
+	// The application's pool, so embeddings move with its vector codecs.
+	pool, err := database.NewPool(context.Background(), config.DatabaseConfig{URL: dsn})
 	if err != nil {
 		t.Fatalf("connect test database: %v", err)
 	}
-	t.Cleanup(pool.Close)
+	t.Cleanup(func() { database.ClosePool(pool) })
 	return pool
 }
 
@@ -62,3 +72,172 @@ func TestBulkUpdatePeopleComparesIDsAsBigint(t *testing.T) {
 		t.Fatalf("tmdb_id = %q, want %q", tmdbID, "222")
 	}
 }
+
+// A seed bundle can carry vectors from another installation's embedding
+// model. Import leaves them out, keeps existing rows, and reports the skip.
+// The records' model is one no test ever locks, so the outcome does not depend
+// on the shared lock row other packages' tests change concurrently.
+func TestImportSkipsEmbeddingsFromAnotherModel(t *testing.T) {
+	ctx := context.Background()
+	pool := newCatalogSeedTestPool(t)
+	prefix := fmt.Sprintf("seed-emb-%d-", time.Now().UnixNano())
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM media_items WHERE content_id LIKE $1`, prefix+"%")
+	})
+	// Pending items are not embedding-eligible, so embedding tests running
+	// against the same database leave their vectors alone.
+	for _, id := range []string{"existing", "new"} {
+		if _, err := pool.Exec(ctx, `INSERT INTO media_items (content_id, type, title, status) VALUES ($1, 'movie', $1, 'pending')`, prefix+id); err != nil {
+			t.Fatal(err)
+		}
+	}
+	seedTestEmbedding(t, pool, prefix+"existing", "local-model", "existing")
+
+	vector := []float32{0.1, 0.2, 0.3, 0.4}
+	var data bytes.Buffer
+	writer := gzip.NewWriter(&data)
+	if err := json.NewEncoder(writer).Encode(Bundle{Manifest: Manifest{FormatVersion: CurrentBundleVersion}, Embeddings: []EmbeddingRecord{
+		{MediaItemID: prefix + "existing", Embedding: vector, Model: "seed-test-foreign-model", CanonicalText: "foreign text"},
+		{MediaItemID: prefix + "new", Embedding: vector, Model: "seed-test-foreign-model", CanonicalText: "foreign text"},
+	}}); err != nil {
+		t.Fatal(err)
+	}
+	if err := writer.Close(); err != nil {
+		t.Fatal(err)
+	}
+	result, err := NewService(pool, nil, nil).WithEmbeddingModel("seed-test-configured-model").
+		Import(ctx, data.Bytes(), ImportOptions{ConflictMode: ConflictModeOverwrite})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result.EmbeddingsImported != 0 || result.EmbeddingsSkipped != 2 {
+		t.Fatalf("import result = %+v", result)
+	}
+	if model, text, _ := testEmbedding(t, pool, prefix+"existing"); model != "local-model" || text != "existing" {
+		t.Fatalf("foreign record replaced the local vector: %q/%q", model, text)
+	}
+	if _, _, ok := testEmbedding(t, pool, prefix+"new"); ok {
+		t.Fatal("foreign record was stored")
+	}
+}
+
+// Import reads the embedding lock inside its transaction and keeps only the
+// locked model's records, or the configured model's when nothing is locked,
+// and never writes the lock. The test sets the lock in an uncommitted
+// transaction, so tests in other packages never see it.
+func TestAcceptedEmbeddingsFollowTheLockInTheImportTransaction(t *testing.T) {
+	ctx := context.Background()
+	pool := newCatalogSeedTestPool(t)
+	const lockKey = "recommendations.embedding_lock"
+	tx, err := pool.Begin(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = tx.Rollback(ctx) }()
+
+	prefix := fmt.Sprintf("seed-lock-%d-", time.Now().UnixNano())
+	for _, id := range []string{"same", "foreign", "configured"} {
+		if _, err := tx.Exec(ctx, `INSERT INTO media_items (content_id, type, title, status) VALUES ($1, 'movie', $1, 'pending')`, prefix+id); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if _, err := tx.Exec(ctx, `
+		INSERT INTO media_item_embeddings (media_item_id, embedding, model, canonical_text)
+		VALUES ($1, (SELECT array_agg(0.25::real) FROM generate_series(1, 3072))::vector, 'local-model', 'existing')`, prefix+"foreign"); err != nil {
+		t.Fatal(err)
+	}
+	lockValue := func() *string {
+		t.Helper()
+		var value *string
+		if err := tx.QueryRow(ctx, `SELECT value FROM server_settings WHERE key = $1`, lockKey).Scan(&value); err != nil && !errors.Is(err, pgx.ErrNoRows) {
+			t.Fatal(err)
+		}
+		return value
+	}
+	embedding := func(id string) (model, text string) {
+		t.Helper()
+		err := tx.QueryRow(ctx, `SELECT model, canonical_text FROM media_item_embeddings WHERE media_item_id = $1`, prefix+id).Scan(&model, &text)
+		if err != nil && !errors.Is(err, pgx.ErrNoRows) {
+			t.Fatal(err)
+		}
+		return model, text
+	}
+	service := NewService(pool, nil, nil).WithEmbeddingModel("configured-model")
+	importRecords := func(records ...EmbeddingRecord) (imported, skipped int) {
+		t.Helper()
+		accepted, err := service.acceptedEmbeddings(ctx, tx, records)
+		if err != nil {
+			t.Fatal(err)
+		}
+		result := &ImportResult{}
+		if err := service.importEmbeddings(ctx, tx, accepted, false, result, nil); err != nil {
+			t.Fatal(err)
+		}
+		return result.EmbeddingsImported, len(records) - len(accepted)
+	}
+	vector := []float32{0.1, 0.2, 0.3, 0.4}
+
+	// With a lock, its model decides, whatever the configured model says.
+	locked := `{"base_url":"http://embed.test","model":"local-model","source_dimensions":4,"storage_dimensions":3072}`
+	if _, err := tx.Exec(ctx, `
+		INSERT INTO server_settings (key, value) VALUES ($1, $2)
+		ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value`, lockKey, locked); err != nil {
+		t.Fatal(err)
+	}
+	imported, skipped := importRecords(
+		EmbeddingRecord{MediaItemID: prefix + "same", Embedding: vector, Model: "local-model", CanonicalText: "same text"},
+		EmbeddingRecord{MediaItemID: prefix + "foreign", Embedding: vector, Model: "gemini-embedding-001", CanonicalText: "foreign text"},
+		EmbeddingRecord{MediaItemID: prefix + "configured", Embedding: vector, Model: "configured-model", CanonicalText: "configured text"},
+	)
+	if imported != 1 || skipped != 2 {
+		t.Fatalf("locked import: imported %d, skipped %d", imported, skipped)
+	}
+	if model, text := embedding("same"); model != "local-model" || text != "same text" {
+		t.Fatalf("same-model record stored as %q/%q", model, text)
+	}
+	if model, text := embedding("foreign"); model != "local-model" || text != "existing" {
+		t.Fatalf("foreign record replaced the local vector: %q/%q", model, text)
+	}
+	if got := lockValue(); got == nil || *got != locked {
+		t.Fatalf("lock changed to %v", got)
+	}
+
+	// Without a lock, the configured model decides, and the lock stays unset.
+	if _, err := tx.Exec(ctx, `DELETE FROM server_settings WHERE key = $1`, lockKey); err != nil {
+		t.Fatal(err)
+	}
+	imported, skipped = importRecords(
+		EmbeddingRecord{MediaItemID: prefix + "configured", Embedding: vector, Model: "configured-model", CanonicalText: "configured text"},
+		EmbeddingRecord{MediaItemID: prefix + "foreign", Embedding: vector, Model: "local-model", CanonicalText: "other text"},
+	)
+	if imported != 1 || skipped != 1 {
+		t.Fatalf("unlocked import: imported %d, skipped %d", imported, skipped)
+	}
+	if model, _ := embedding("configured"); model != "configured-model" {
+		t.Fatalf("configured-model record stored as %q", model)
+	}
+	if got := lockValue(); got != nil {
+		t.Fatalf("import wrote the lock %q", *got)
+	}
+}
+
+func seedTestEmbedding(t *testing.T, pool *pgxpool.Pool, id, model, text string) {
+	t.Helper()
+	if _, err := pool.Exec(context.Background(), `
+		INSERT INTO media_item_embeddings (media_item_id, embedding, model, canonical_text)
+		VALUES ($1, (SELECT array_agg(0.25::real) FROM generate_series(1, 3072))::vector, $2, $3)`, id, model, text); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func testEmbedding(t *testing.T, pool *pgxpool.Pool, id string) (model, text string, ok bool) {
+	t.Helper()
+	err := pool.QueryRow(context.Background(), `SELECT model, canonical_text FROM media_item_embeddings WHERE media_item_id = $1`, id).Scan(&model, &text)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return "", "", false
+	}
+	if err != nil {
+		t.Fatal(err)
+	}
+	return model, text, true
+}
diff --git a/internal/catalogseed/service_test.go b/internal/catalogseed/service_test.go
index e4dba6f7a9..246d5783c0 100644
--- a/internal/catalogseed/service_test.go
+++ b/internal/catalogseed/service_test.go
@@ -106,3 +106,19 @@ func TestItemToRecordOmitsAnAbsentAdvisory(t *testing.T) {
 		}
 	}
 }
+
+func TestEmbeddingsForModelKeepsOnlyThatModel(t *testing.T) {
+	records := []EmbeddingRecord{
+		{MediaItemID: "movie-1", Model: "nomic-embed-text"},
+		{MediaItemID: "movie-2", Model: "gemini-embedding-001"},
+		{MediaItemID: "movie-3", Model: "nomic-embed-text"},
+		{MediaItemID: "movie-4", Model: ""},
+	}
+	got := embeddingsForModel(records, "nomic-embed-text")
+	if len(got) != 2 || got[0].MediaItemID != "movie-1" || got[1].MediaItemID != "movie-3" {
+		t.Fatalf("embeddingsForModel = %#v", got)
+	}
+	if got := embeddingsForModel(records, ""); len(got) != 0 {
+		t.Fatalf("an unknown model kept %#v", got)
+	}
+}
diff --git a/internal/catalogseed/types.go b/internal/catalogseed/types.go
index 99e56e41b0..dbf1a78fbb 100644
--- a/internal/catalogseed/types.go
+++ b/internal/catalogseed/types.go
@@ -318,6 +318,7 @@ type ImportResult struct {
 	LinksCreated       int      `json:"links_created"`
 	CreditsReplaced    int      `json:"credits_replaced"`
 	EmbeddingsImported int      `json:"embeddings_imported"`
+	EmbeddingsSkipped  int      `json:"embeddings_skipped"` // made by another embedding model
 	Skipped            int      `json:"skipped"`
 	UnmatchedRoots     []string `json:"unmatched_roots,omitempty"`
 }
diff --git a/internal/chapterthumbs/remote.go b/internal/chapterthumbs/remote.go
index cc0198eb31..cace2205b9 100644
--- a/internal/chapterthumbs/remote.go
+++ b/internal/chapterthumbs/remote.go
@@ -10,6 +10,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/prairie-server/prairie-server/internal/nodeauth"
 	"github.com/prairie-server/prairie-server/internal/telemetry"
 
 	"github.com/prairie-server/prairie-server/internal/nodepool"
@@ -77,7 +78,9 @@ func (e *httpRemoteFrameExtractor) ExtractFrame(
 		return nil, chapterThumbnailNodeUnavailableReason, fmt.Errorf("chapter thumbnail remote extract: build request: %w", err)
 	}
 	httpReq.Header.Set("Content-Type", "application/json")
-	httpReq.Header.Set("Authorization", "Bearer "+jwtSecret)
+	if err := nodeauth.Sign(httpReq, node.URL, jwtSecret); err != nil {
+		return nil, chapterThumbnailNodeUnavailableReason, fmt.Errorf("chapter thumbnail remote extract: sign request: %w", err)
+	}
 
 	client := e.client
 	if client == nil {
diff --git a/internal/chapterthumbs/remote_signing_test.go b/internal/chapterthumbs/remote_signing_test.go
new file mode 100644
index 0000000000..d9a0796cfd
--- /dev/null
+++ b/internal/chapterthumbs/remote_signing_test.go
@@ -0,0 +1,29 @@
+package chapterthumbs
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
+	"github.com/prairie-server/prairie-server/internal/nodepool"
+)
+
+func TestRemoteFrameExtractorSignsTheRequest(t *testing.T) {
+	const secret = "chapter-secret"
+	node := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/chapter-thumbnails/extract" || !nodeauthtest.Signed(r, secret) {
+			http.Error(w, "unauthorized", http.StatusUnauthorized)
+			return
+		}
+		w.Header().Set("Content-Type", "image/jpeg")
+		_, _ = w.Write([]byte("frame"))
+	}))
+	t.Cleanup(node.Close)
+
+	data, reason, err := (&httpRemoteFrameExtractor{}).ExtractFrame(t.Context(), &nodepool.Node{URL: node.URL}, secret,
+		RemoteExtractRequest{InputPath: "/media/movie.mkv", SeekSeconds: 12})
+	if err != nil || reason != "" || string(data) != "frame" {
+		t.Fatalf("ExtractFrame = %q, %q, %v; want the frame from a signed request", data, reason, err)
+	}
+}
diff --git a/internal/collections/templates/templates.go b/internal/collections/templates/templates.go
index bc674011c7..59944456b4 100644
--- a/internal/collections/templates/templates.go
+++ b/internal/collections/templates/templates.go
@@ -1,5 +1,5 @@
 // Package templates exposes a curated catalog of pre-configured Library
-// Collections. Each Template encapsulates a source provider (TMDB, Trakt,
+// Collections. Each Template encapsulates a source provider (TMDB,
 // MDBList) plus the parameters needed for the existing import endpoints, so
 // the admin UI can offer a one-click "create from template" flow analogous to
 // the section recipe gallery.
@@ -25,7 +25,6 @@ type Source string
 
 const (
 	SourceTMDB           Source = "tmdb"
-	SourceTrakt          Source = "trakt"
 	SourceMDBList        Source = "mdblist"
 	SourceTMDBDiscover   Source = "tmdb_discover"
 	SourceTMDBCollection Source = "tmdb_collection"
@@ -50,12 +49,6 @@ type TMDBSpec struct {
 	TimeWindow string `json:"time_window,omitempty"`
 }
 
-// TraktSpec is the Trakt-specific portion of a template.
-type TraktSpec struct {
-	Preset    string `json:"preset"`
-	MediaType string `json:"media_type"`
-}
-
 // MDBListSpec is the MDBList-specific portion of a template.
 type MDBListSpec struct {
 	URL string `json:"url"`
@@ -101,7 +94,7 @@ type TMDBDiscoverSpec struct {
 
 // Template is a single pre-configured collection blueprint.
 //
-// Exactly one of TMDB, Trakt, or MDBList is populated, matching Source. The
+// Exactly one source spec is populated, matching Source. The
 // admin UI hands the template's source-specific fields to the corresponding
 // import endpoint, allowing a one-click create flow.
 type Template struct {
@@ -120,7 +113,6 @@ type Template struct {
 	Featured            bool                `json:"featured,omitempty"`
 	Tags                []string            `json:"tags,omitempty"`
 	TMDB                *TMDBSpec           `json:"tmdb,omitempty"`
-	Trakt               *TraktSpec          `json:"trakt,omitempty"`
 	MDBList             *MDBListSpec        `json:"mdblist,omitempty"`
 	TMDBDiscover        *TMDBDiscoverSpec   `json:"tmdb_discover,omitempty"`
 	TMDBCollection      *TMDBCollectionSpec `json:"tmdb_collection,omitempty"`
diff --git a/internal/collections/templates/templates_test.go b/internal/collections/templates/templates_test.go
index 3f86ce0a09..a263bed4e1 100644
--- a/internal/collections/templates/templates_test.go
+++ b/internal/collections/templates/templates_test.go
@@ -273,10 +273,10 @@ func TestRegisterBundleRejectsProfileRequiredTemplates(t *testing.T) {
 		ID:              "recommended",
 		Title:           "Recommended",
 		Category:        CategoryEditorial,
-		Source:          SourceTrakt,
+		Source:          SourceTMDB,
 		MediaKind:       MediaMovie,
 		RequiresProfile: true,
-		Trakt:           &TraktSpec{Preset: "recommended", MediaType: "movie"},
+		TMDB:            &TMDBSpec{Preset: "popular", MediaType: "movie"},
 	})
 	defer func() {
 		if recover() == nil {
@@ -322,8 +322,8 @@ func TestRegisterValidatesTemplate(t *testing.T) {
 			name: "two source specs",
 			tmpl: Template{
 				ID: "x", Title: "x", Category: CategoryTrending, Source: SourceTMDB, MediaKind: MediaMovie,
-				TMDB:  &TMDBSpec{Preset: "popular", MediaType: "movie"},
-				Trakt: &TraktSpec{Preset: "popular", MediaType: "movie"},
+				TMDB:    &TMDBSpec{Preset: "popular", MediaType: "movie"},
+				MDBList: &MDBListSpec{URL: "https://example.com/list"},
 			},
 		},
 		{
@@ -335,12 +335,8 @@ func TestRegisterValidatesTemplate(t *testing.T) {
 			tmpl: Template{ID: "x", Title: "x", Category: CategoryInTheaters, Source: SourceTMDB, MediaKind: MediaTV, TMDB: &TMDBSpec{Preset: "now_playing", MediaType: "tv"}},
 		},
 		{
-			name: "trakt recommended without requires_profile",
-			tmpl: Template{ID: "x", Title: "x", Category: CategoryEditorial, Source: SourceTrakt, MediaKind: MediaMovie, Trakt: &TraktSpec{Preset: "recommended", MediaType: "movie"}},
-		},
-		{
-			name: "trakt recommended with bad media type",
-			tmpl: Template{ID: "x", Title: "x", Category: CategoryEditorial, Source: SourceTrakt, MediaKind: MediaMovie, RequiresProfile: true, Trakt: &TraktSpec{Preset: "recommended", MediaType: "all"}},
+			name: "retired trakt source",
+			tmpl: Template{ID: "x", Title: "x", Category: CategoryEditorial, Source: "trakt", MediaKind: MediaMovie},
 		},
 		{
 			name: "mdblist non-http URL",
@@ -576,14 +572,6 @@ func TestRegisterRejectsInvalidTMDBDiscover(t *testing.T) {
 				TMDB:         &TMDBSpec{Preset: "popular", MediaType: "movie"},
 			},
 		},
-		{
-			name: "discover with trakt spec",
-			tmpl: Template{
-				ID: "x", Title: "x", Category: CategoryPopular, Source: SourceTMDBDiscover, MediaKind: MediaMovie,
-				TMDBDiscover: validTMDBDiscoverSpec(),
-				Trakt:        &TraktSpec{Preset: "popular", MediaType: "movie"},
-			},
-		},
 		{
 			name: "discover with mdblist spec",
 			tmpl: Template{
diff --git a/internal/collections/templates/validate.go b/internal/collections/templates/validate.go
index 0c635e2a1f..e4088331f9 100644
--- a/internal/collections/templates/validate.go
+++ b/internal/collections/templates/validate.go
@@ -30,23 +30,15 @@ func validate(t Template) error {
 		if t.TMDB == nil {
 			return errors.New("tmdb spec is required for tmdb source")
 		}
-		if t.Trakt != nil || t.MDBList != nil || t.TMDBDiscover != nil || t.TMDBCollection != nil || t.TMDBList != nil {
+		if t.MDBList != nil || t.TMDBDiscover != nil || t.TMDBCollection != nil || t.TMDBList != nil {
 			return errors.New("only one source spec may be set")
 		}
 		return validateTMDB(*t.TMDB)
-	case SourceTrakt:
-		if t.Trakt == nil {
-			return errors.New("trakt spec is required for trakt source")
-		}
-		if t.TMDB != nil || t.MDBList != nil || t.TMDBDiscover != nil || t.TMDBCollection != nil || t.TMDBList != nil {
-			return errors.New("only one source spec may be set")
-		}
-		return validateTrakt(*t.Trakt, t.RequiresProfile)
 	case SourceMDBList:
 		if t.MDBList == nil {
 			return errors.New("mdblist spec is required for mdblist source")
 		}
-		if t.TMDB != nil || t.Trakt != nil || t.TMDBDiscover != nil || t.TMDBCollection != nil || t.TMDBList != nil {
+		if t.TMDB != nil || t.TMDBDiscover != nil || t.TMDBCollection != nil || t.TMDBList != nil {
 			return errors.New("only one source spec may be set")
 		}
 		return validateMDBList(*t.MDBList)
@@ -54,7 +46,7 @@ func validate(t Template) error {
 		if t.TMDBDiscover == nil {
 			return errors.New("tmdb_discover spec is required for tmdb_discover source")
 		}
-		if t.TMDB != nil || t.Trakt != nil || t.MDBList != nil || t.TMDBCollection != nil || t.TMDBList != nil {
+		if t.TMDB != nil || t.MDBList != nil || t.TMDBCollection != nil || t.TMDBList != nil {
 			return errors.New("only one source spec may be set")
 		}
 		return validateTMDBDiscover(*t.TMDBDiscover)
@@ -62,7 +54,7 @@ func validate(t Template) error {
 		if t.TMDBCollection == nil {
 			return errors.New("tmdb_collection spec is required for tmdb_collection source")
 		}
-		if t.TMDB != nil || t.Trakt != nil || t.MDBList != nil || t.TMDBDiscover != nil || t.TMDBList != nil {
+		if t.TMDB != nil || t.MDBList != nil || t.TMDBDiscover != nil || t.TMDBList != nil {
 			return errors.New("only one source spec may be set")
 		}
 		return validateTMDBCollection(*t.TMDBCollection)
@@ -70,7 +62,7 @@ func validate(t Template) error {
 		if t.TMDBList == nil {
 			return errors.New("tmdb_list spec is required for tmdb_list source")
 		}
-		if t.TMDB != nil || t.Trakt != nil || t.MDBList != nil || t.TMDBDiscover != nil || t.TMDBCollection != nil {
+		if t.TMDB != nil || t.MDBList != nil || t.TMDBDiscover != nil || t.TMDBCollection != nil {
 			return errors.New("only one source spec may be set")
 		}
 		return validateTMDBList(*t.TMDBList)
@@ -145,27 +137,6 @@ func validateTMDB(spec TMDBSpec) error {
 	return nil
 }
 
-func validateTrakt(spec TraktSpec, requiresProfile bool) error {
-	switch spec.Preset {
-	case "trending", "popular":
-		if requiresProfile {
-			return errors.New("trakt: trending/popular do not require a profile")
-		}
-	case "recommended":
-		if !requiresProfile {
-			return errors.New("trakt: recommended must set requires_profile=true")
-		}
-	default:
-		return fmt.Errorf("trakt: unsupported preset %q", spec.Preset)
-	}
-	switch spec.MediaType {
-	case mediaTypeMovie, "tv":
-	default:
-		return fmt.Errorf("trakt: media_type must be movie or tv (got %q)", spec.MediaType)
-	}
-	return nil
-}
-
 // tmdbDiscoverSortByValues enumerates the sort_by values TMDB documents for
 // /discover/movie and /discover/tv. Validation is intentionally lenient — we
 // accept the documented set rather than introspecting per-media-type quirks
diff --git a/internal/collectionutil/collectionutil.go b/internal/collectionutil/collectionutil.go
index 6500948e61..5c4f3a762b 100644
--- a/internal/collectionutil/collectionutil.go
+++ b/internal/collectionutil/collectionutil.go
@@ -2,6 +2,7 @@ package collectionutil
 
 import (
 	"errors"
+	"math"
 	"strings"
 )
 
@@ -10,27 +11,18 @@ var ErrOrderedIDsMismatch = errors.New("ordered_ids does not match the current s
 const (
 	collectionSourceFetchMultiplier = 4
 	collectionSourceFetchMin        = 100
-	collectionSourceFetchMax        = 500
 )
 
-// MaxExplicitItemLimit is the largest explicit per-collection item limit the
-// import APIs accept. Sync never scans more than collectionSourceFetchMax
-// source entries, so a larger explicit limit could never be satisfied anyway.
-// Mirrored by COLLECTION_MAX_ITEMS in web/src/lib/collectionTemplates.ts.
-const MaxExplicitItemLimit = collectionSourceFetchMax
-
+// SourceFetchLimit is how many source entries a sync reads for a collection
+// with an explicit item limit: a few times the limit, because some entries
+// don't match the catalog or the owner's access. It returns 0, meaning the
+// source's whole list, when the collection has no item limit or the scan
+// depth would overflow.
 func SourceFetchLimit(itemLimit *int) int {
-	if itemLimit == nil || *itemLimit <= 0 {
+	if itemLimit == nil || *itemLimit <= 0 || *itemLimit > math.MaxInt/collectionSourceFetchMultiplier {
 		return 0
 	}
-	limit := *itemLimit * collectionSourceFetchMultiplier
-	if limit < collectionSourceFetchMin {
-		limit = collectionSourceFetchMin
-	}
-	if limit > collectionSourceFetchMax {
-		limit = collectionSourceFetchMax
-	}
-	return limit
+	return max(*itemLimit*collectionSourceFetchMultiplier, collectionSourceFetchMin)
 }
 
 func ItemLimitReached(itemCount int, itemLimit *int) bool {
diff --git a/internal/collectionutil/collectionutil_test.go b/internal/collectionutil/collectionutil_test.go
new file mode 100644
index 0000000000..70a41e7b26
--- /dev/null
+++ b/internal/collectionutil/collectionutil_test.go
@@ -0,0 +1,29 @@
+package collectionutil
+
+import (
+	"math"
+	"testing"
+)
+
+func TestSourceFetchLimit(t *testing.T) {
+	intPtr := func(v int) *int { return &v }
+	cases := []struct {
+		name  string
+		limit *int
+		want  int
+	}{
+		{"no limit reads the whole source", nil, 0},
+		{"non-positive limit reads the whole source", intPtr(0), 0},
+		{"small limit scans the minimum", intPtr(10), 100},
+		{"limit scans four times as deep", intPtr(50), 200},
+		{"large limit is not capped", intPtr(10000), 40000},
+		{"overflowing scan reads the whole source", intPtr(math.MaxInt / 2), 0},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := SourceFetchLimit(tc.limit); got != tc.want {
+				t.Fatalf("SourceFetchLimit = %d, want %d", got, tc.want)
+			}
+		})
+	}
+}
diff --git a/internal/collectionutil/mdblist.go b/internal/collectionutil/mdblist.go
index 3ec639aa38..38c16a7e6d 100644
--- a/internal/collectionutil/mdblist.go
+++ b/internal/collectionutil/mdblist.go
@@ -140,6 +140,16 @@ const (
 // MDBListMaxEntries applies. rawURL may be the list page or its /json form and
 // is validated with CanonicalMDBListURL before any request is made.
 func FetchMDBListJSON[T any](ctx context.Context, client *http.Client, rawURL string, maxEntries int) ([]T, error) {
+	return FetchMDBListJSONQuery[T](ctx, client, rawURL, maxEntries, nil)
+}
+
+// MDBListIMDbPopularOrder asks the /json feed for the list in IMDb popularity
+// (MovieMeter) order, most popular first.
+var MDBListIMDbPopularOrder = url.Values{"sort": {"imdbpopular"}, "sortorder": {"asc"}}
+
+// FetchMDBListJSONQuery is FetchMDBListJSON with extra query parameters sent
+// on every page request, such as MDBListIMDbPopularOrder.
+func FetchMDBListJSONQuery[T any](ctx context.Context, client *http.Client, rawURL string, maxEntries int, extra url.Values) ([]T, error) {
 	listURL, err := CanonicalMDBListURL(rawURL)
 	if err != nil {
 		return nil, err
@@ -156,6 +166,9 @@ func FetchMDBListJSON[T any](ctx context.Context, client *http.Client, rawURL st
 	for len(entries) < maxEntries {
 		pageSize := min(mdblistJSONPageSize, maxEntries-len(entries))
 		query := parsed.Query()
+		for key, values := range extra {
+			query[key] = values
+		}
 		query.Set("limit", strconv.Itoa(pageSize))
 		query.Set("offset", strconv.Itoa(len(entries)))
 		parsed.RawQuery = query.Encode()
diff --git a/internal/config/admin_settings.go b/internal/config/admin_settings.go
index 058845a72d..47ad5cdc56 100644
--- a/internal/config/admin_settings.go
+++ b/internal/config/admin_settings.go
@@ -65,6 +65,13 @@ const (
 	AccessUnratedContentAllow = "allow"
 )
 
+// PlaybackKeyframePlaylistSettingKey serves copy-remux HLS as one complete
+// playlist planned from the source's keyframes, instead of FFmpeg's growing
+// one (#1466). It is off while restarts in the middle of such a stream are
+// still being built; a planned stream that has to restart starts again from
+// the beginning.
+const PlaybackKeyframePlaylistSettingKey = "playback.copy_keyframe_playlist"
+
 // CatalogExtraRatingSourcesSettingKey lists, comma-separated, the rating
 // sources clients show in addition to IMDb and TMDB, which are always shown:
 // sources metadata plugins declare, such as rt_critic. Empty, the
@@ -178,6 +185,14 @@ const MarkersDetectionWorkersSettingKey = "markers.detection_workers"
 // takes effect on restart.
 const ServerLANDiscoverySettingKey = "server.lan_discovery"
 
+// ServerLocalURLSettingKey is the API server's address on the local network,
+// for a deployment whose LAN advertisement cannot reach the network or names
+// the wrong port (Docker bridge networking). Signed-in clients read it from the
+// connections document and use it, over TLS pinned to the deployment key, while
+// they can reach it (docs/architecture/server-identity.md, "Local network TLS").
+// Read per request, so a change applies without restart.
+const ServerLocalURLSettingKey = "server.local_url"
+
 // External sign-in settings (docs/architecture/external-sign-in.md).
 const (
 	// AuthLocalPasswordLoginSettingKey turns local password sign-in on or off
@@ -274,6 +289,7 @@ var adminSettingDefaults = map[string]string{
 	"theme.catalog_url":         DefaultThemeCatalogURL,
 
 	ServerLANDiscoverySettingKey:              "true",
+	ServerLocalURLSettingKey:                  "",
 	AuthLocalPasswordLoginSettingKey:          "true",
 	AuthEmailAutoMatchSettingKey:              "false",
 	AuthProviderRecheckIntervalSettingKey:     "12h",
@@ -366,7 +382,6 @@ var adminSettingDefaults = map[string]string{
 	"jellyfin_compat.playback_session_ttl":    "6h",
 
 	"recommendations.enabled":                    "false",
-	"recommendations.embedding_provider":         "ollama",
 	"recommendations.embeddings_job_timeout":     "24h",
 	"recommendations.embedding_base_url":         "http://ollama:11434",
 	"recommendations.embedding_model":            "all-minilm",
@@ -479,6 +494,8 @@ var adminSettingDefaults = map[string]string{
 	"catalog.search.meilisearch.semantic_ratio":           "0.5",
 	"catalog.search.meilisearch.embedder":                 "silo_recommendations",
 	"catalog.search.meilisearch.binary_quantized":         "false",
+
+	PlaybackKeyframePlaylistSettingKey: "false",
 }
 
 var legacyAdminSettingFallbacks = []struct {
@@ -595,6 +612,7 @@ func NormalizeAdminSetting(key, raw string) (string, error) {
 
 	switch key {
 	case "metadata.cache_images", "metadata.pause_artwork_during_playback", "playback.transcode_enabled", PlaybackAllowHEVCEncodingSettingKey,
+		PlaybackKeyframePlaylistSettingKey,
 		ChapterThumbnailSoftwareToneMapSettingKey, PlaybackTranscodeHardwareToneMapSettingKey,
 		PlaybackTranscodeSoftwareToneMapSettingKey, CatalogScopeVersionsToLibrarySettingKey,
 		Allow4KTranscodeSettingKey, playback.TranscodeThrottleEnabledSettingKey, "audiobookshelf_compat.enabled",
@@ -849,6 +867,8 @@ func NormalizeAdminSetting(key, raw string) (string, error) {
 		"s3.public_endpoint", "s3.public_read_endpoint", "s3.private_endpoint",
 		"s3.user_db_endpoint", "catalog.search.meilisearch.url":
 		return normalizeAdminURL(key, value)
+	case ServerLocalURLSettingKey:
+		return normalizeLocalURL(value)
 	case "redis.url":
 		return NormalizeRedisURL(value)
 	case RedisDBSettingKey:
@@ -960,12 +980,8 @@ func ValidateAdminSettingsWithCapabilities(values map[string]string, capabilitie
 			return fmt.Errorf("email.from_address is required when email is enabled")
 		}
 	}
-	for _, provider := range []string{"trakt", "simkl"} {
-		clientID := strings.TrimSpace(effective["watchsync."+provider+".client_id"])
-		clientSecret := strings.TrimSpace(effective["watchsync."+provider+".client_secret"])
-		if (clientID == "") != (clientSecret == "") {
-			return fmt.Errorf("watchsync.%s client ID and client secret must be configured together", provider)
-		}
+	if (strings.TrimSpace(effective["watchsync.simkl.client_id"]) == "") != (strings.TrimSpace(effective["watchsync.simkl.client_secret"]) == "") {
+		return errors.New("watchsync.simkl client ID and client secret must be configured together")
 	}
 	if err := ValidateRedisRateLimitTransport(effective, capabilities.RedisBootstrapAvailable); err != nil {
 		return err
@@ -1278,6 +1294,23 @@ func normalizeAdminEnum(key, value string, allowed ...string) (string, error) {
 	return "", fmt.Errorf("%s must be one of: %s", key, strings.Join(allowed, ", "))
 }
 
+// normalizeLocalURL accepts an http(s) origin: clients reach the API at its
+// root, and the connections document publishes origins only.
+func normalizeLocalURL(value string) (string, error) {
+	normalized, err := normalizeAdminURL(ServerLocalURLSettingKey, value)
+	if err != nil || normalized == "" {
+		return normalized, err
+	}
+	parsed, err := url.Parse(normalized)
+	if err != nil {
+		return "", fmt.Errorf("%s must include a URL scheme and host", ServerLocalURLSettingKey)
+	}
+	if parsed.Path != "" || parsed.RawQuery != "" || parsed.Fragment != "" || parsed.User != nil {
+		return "", fmt.Errorf("%s must be a scheme, host and optional port, such as http://192.168.1.20:8080", ServerLocalURLSettingKey)
+	}
+	return normalized, nil
+}
+
 func normalizeAdminURL(key, value string) (string, error) {
 	if value == "" {
 		return "", nil
diff --git a/internal/config/admin_settings_test.go b/internal/config/admin_settings_test.go
index 8ebe5faaa1..1f5b4f80ad 100644
--- a/internal/config/admin_settings_test.go
+++ b/internal/config/admin_settings_test.go
@@ -486,7 +486,6 @@ func TestOpslogCaptureLevelAcceptsWarningAlias(t *testing.T) {
 func TestHiddenTierDefaultsAreExposed(t *testing.T) {
 	effective := EffectiveAdminSettings(nil)
 	want := map[string]string{
-		"recommendations.embedding_provider":     "ollama",
 		"recommendations.embeddings_job_timeout": "24h",
 		"policy.editor_enabled":                  "false",
 		"policy.eval_timeout_ms":                 "100",
@@ -540,3 +539,27 @@ func TestAuthProviderRecheckInterval(t *testing.T) {
 		}
 	}
 }
+
+func TestNormalizeAdminSettingLocalURLIsAnOrigin(t *testing.T) {
+	for raw, want := range map[string]string{
+		"":                            "",
+		" http://192.168.1.20:8080/ ": "http://192.168.1.20:8080",
+		"https://prairie.lan":         "https://prairie.lan",
+	} {
+		got, err := NormalizeAdminSetting(ServerLocalURLSettingKey, raw)
+		if err != nil || got != want {
+			t.Fatalf("NormalizeAdminSetting(%q) = %q, %v; want %q", raw, got, err, want)
+		}
+	}
+	for _, raw := range []string{
+		"192.168.1.20:8080",
+		"ftp://192.168.1.20",
+		"http://192.168.1.20:8080/prairie",
+		"http://192.168.1.20:8080/?x=1",
+		"http://user@192.168.1.20:8080",
+	} {
+		if got, err := NormalizeAdminSetting(ServerLocalURLSettingKey, raw); err == nil {
+			t.Fatalf("NormalizeAdminSetting(%q) = %q, want an error", raw, got)
+		}
+	}
+}
diff --git a/internal/config/admin_settings_unrated_test.go b/internal/config/admin_settings_unrated_test.go
index e21f560bca..acb35925db 100644
--- a/internal/config/admin_settings_unrated_test.go
+++ b/internal/config/admin_settings_unrated_test.go
@@ -92,13 +92,13 @@ func TestUnratedContentPolicyCachesSuccessfulReads(t *testing.T) {
 	}
 
 	reader.value = "hide"
-	now = now.Add(unratedContentCacheTTL)
+	now = now.Add(UnratedContentCacheTTL)
 	if policy.AllowUnratedContent(ctx) {
 		t.Fatal("want hide once the TTL has passed")
 	}
 
 	reader.err = errors.New("boom")
-	now = now.Add(unratedContentCacheTTL)
+	now = now.Add(UnratedContentCacheTTL)
 	if policy.AllowUnratedContent(ctx) {
 		t.Fatal("a failed read must keep the last value read successfully, which was hide")
 	}
@@ -127,14 +127,14 @@ func TestUnratedContentPolicyKeepsLastValueOnReadFailure(t *testing.T) {
 	}
 
 	reader.err = errors.New("boom")
-	now = now.Add(unratedContentCacheTTL)
+	now = now.Add(UnratedContentCacheTTL)
 	if !policy.AllowUnratedContent(ctx) {
 		t.Fatal("a failed read must keep the last value read successfully")
 	}
 
 	reader.err = nil
 	reader.value = "hide"
-	now = now.Add(unratedContentCacheTTL)
+	now = now.Add(UnratedContentCacheTTL)
 	if policy.AllowUnratedContent(ctx) {
 		t.Fatal("want hide once a read succeeds again")
 	}
diff --git a/internal/config/cached_setting_test.go b/internal/config/cached_setting_test.go
index 937ed8c006..a60d588f97 100644
--- a/internal/config/cached_setting_test.go
+++ b/internal/config/cached_setting_test.go
@@ -22,7 +22,7 @@ func TestCachedSettingFailedReadAnswersWithTheLatestCachedValue(t *testing.T) {
 		c.value, c.read = "fresh", true
 		c.mu.Unlock()
 		return "", errors.New("boom")
-	}}, "k", unratedContentCacheTTL, parse)
+	}}, "k", UnratedContentCacheTTL, parse)
 
 	if got := c.Get(context.Background()); got != "fresh" {
 		t.Fatalf("Get = %q, want the value the concurrent read cached", got)
@@ -49,7 +49,7 @@ func TestCachedSettingKeepsTheNewerOfTwoOverlappingReads(t *testing.T) {
 			return "old", nil
 		}
 		return "new", nil
-	}}, "k", unratedContentCacheTTL, parse)
+	}}, "k", UnratedContentCacheTTL, parse)
 
 	if got := c.Get(context.Background()); got != "new" {
 		t.Fatalf("older read answered %q, want the newer cached value", got)
diff --git a/internal/config/config.go b/internal/config/config.go
index 6ece5d832b..a7ccecf8f9 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -30,6 +30,9 @@ type ServerConfig struct {
 	// LANDiscovery advertises the API server on the local network with
 	// DNS-SD (see internal/landiscovery). Settings key server.lan_discovery.
 	LANDiscovery bool `yaml:"-"`
+	// LocalURL is the API server's local-network address for signed-in
+	// clients. Settings key server.local_url; empty when unset.
+	LocalURL string `yaml:"-"`
 }
 
 // DatabaseConfig holds the primary PostgreSQL connection settings.
@@ -199,6 +202,9 @@ type PlaybackConfig struct {
 	SubtitleSyncNodeCapacity int                   `yaml:"-"`
 	TranscodeEnabled         bool                  `yaml:"transcode_enabled"`
 	Routing                  PlaybackRoutingPolicy `yaml:"-"`
+	// KeyframePlaylist is playback.copy_keyframe_playlist: copy-remux HLS
+	// from one complete keyframe-planned playlist (#1466).
+	KeyframePlaylist bool `yaml:"-"`
 }
 
 // LiveTVConfig holds Live TV / OTA / DVR settings.
diff --git a/internal/config/db_loader.go b/internal/config/db_loader.go
index 2996704286..8ffb368536 100644
--- a/internal/config/db_loader.go
+++ b/internal/config/db_loader.go
@@ -224,6 +224,7 @@ func LoadFromDB(m map[string]string) (*Config, error) {
 	// config snapshot so the nodeconfig watcher hot-reloads the resolver.
 	cfg.ClientIP.TrustedProxies = stringOr(m, "clientip.trusted_proxies", "")
 	cfg.Server.PublicURL = stringOr(m, "server.public_url", "")
+	cfg.Server.LocalURL = stringOr(m, ServerLocalURLSettingKey, "")
 	lanDiscovery, err := boolOr(m, ServerLANDiscoverySettingKey, true)
 	if err != nil {
 		return nil, err
@@ -395,6 +396,11 @@ func LoadFromDB(m map[string]string) (*Config, error) {
 		return nil, fmt.Errorf("%s must be 0 or between 120 and 86400", playbackSegmentRetentionSettingKey)
 	}
 	cfg.Playback.SegmentRetentionSeconds = segmentRetentionSeconds
+	keyframePlaylist, err := boolOr(m, PlaybackKeyframePlaylistSettingKey, false)
+	if err != nil {
+		return nil, err
+	}
+	cfg.Playback.KeyframePlaylist = keyframePlaylist
 	cfg.Playback.HWAccel = stringOr(m, "playback.hw_accel", "auto")
 	cfg.Playback.HWDevice = stringOr(m, "playback.hw_device", "")
 	chapterThumbnailWorkers, err := intOr(m, "playback.chapter_thumbnail_workers", 1)
diff --git a/internal/config/restart_keys.go b/internal/config/restart_keys.go
index ecfe58baa5..4e45d3c953 100644
--- a/internal/config/restart_keys.go
+++ b/internal/config/restart_keys.go
@@ -67,10 +67,8 @@ var restartRequiredKeys = map[string]bool{
 	"matcher.enable_tv_series_root_queue":  true,
 	"matcher.enable_tv_series_group_queue": true,
 
-	// External API clients built once at startup. watchsync.trakt.client_id is
-	// deliberately absent: the collection adapter re-reads it from the settings
-	// repo before each upstream call (atomic setter on the shared client), and
-	// the watch-sync OAuth flows always read both credentials live.
+	// External API clients built once at startup. The watch-sync client
+	// credentials are deliberately absent: the OAuth flows read them live.
 	"tmdb.api_key": true,
 
 	// The LAN discovery responder starts once with the API listener.
diff --git a/internal/config/unrated_content.go b/internal/config/unrated_content.go
index 4f2c037679..a1cbc0cf83 100644
--- a/internal/config/unrated_content.go
+++ b/internal/config/unrated_content.go
@@ -11,14 +11,14 @@ type SettingReader interface {
 	Get(ctx context.Context, key string) (string, error)
 }
 
-// unratedContentCacheTTL bounds how long a node serves a cached
+// UnratedContentCacheTTL bounds how long a node serves a cached
 // access.unrated_content value. Every viewer scope resolution reads the
 // setting, so it is not worth a database round trip per request, while an
 // administrator's change still reaches every node within seconds.
-const unratedContentCacheTTL = 10 * time.Second
+const UnratedContentCacheTTL = 10 * time.Second
 
 // UnratedContentPolicy resolves AccessUnratedContentSettingKey for the viewer
-// scope resolvers, caching a successful read for unratedContentCacheTTL.
+// scope resolvers, caching a successful read for UnratedContentCacheTTL.
 type UnratedContentPolicy struct {
 	setting *CachedSetting[bool]
 }
@@ -26,7 +26,7 @@ type UnratedContentPolicy struct {
 // NewUnratedContentPolicy binds the policy to a server settings reader. A nil
 // reader keeps the default.
 func NewUnratedContentPolicy(settings SettingReader) *UnratedContentPolicy {
-	return &UnratedContentPolicy{setting: NewCachedSetting(settings, AccessUnratedContentSettingKey, unratedContentCacheTTL, func(value string) bool {
+	return &UnratedContentPolicy{setting: NewCachedSetting(settings, AccessUnratedContentSettingKey, UnratedContentCacheTTL, func(value string) bool {
 		return strings.EqualFold(strings.TrimSpace(value), AccessUnratedContentAllow)
 	})}
 }
diff --git a/internal/contentid/contentid.go b/internal/contentid/contentid.go
index 31c1dc3830..91091ce2f7 100644
--- a/internal/contentid/contentid.go
+++ b/internal/contentid/contentid.go
@@ -38,6 +38,7 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"regexp"
+	"slices"
 	"strconv"
 	"strings"
 
@@ -167,6 +168,16 @@ func ForMovie(ids ProviderIDs) (string, bool) {
 	return kindMovie + sep + provider + sep + id, true
 }
 
+// AnchorPrecedence returns the providers whose IDs anchor an item of itemType,
+// in the order ForMovie and ForSeries try them: TVDB first for a series,
+// TMDB first for anything else.
+func AnchorPrecedence(itemType string) []string {
+	if strings.EqualFold(strings.TrimSpace(itemType), kindSeries) {
+		return slices.Clone(seriesProviderPrecedence)
+	}
+	return slices.Clone(movieProviderPrecedence)
+}
+
 // ForSeries returns the deterministic content_id for a series, or ("", false)
 // if no provider anchor is present.
 func ForSeries(ids ProviderIDs) (string, bool) {
diff --git a/internal/contractledger/ledger_test.go b/internal/contractledger/ledger_test.go
index 1478dbecfc..88de0d6d6e 100644
--- a/internal/contractledger/ledger_test.go
+++ b/internal/contractledger/ledger_test.go
@@ -1128,8 +1128,17 @@ func TestRetrySafetyMismatchesFire(t *testing.T) {
 // applies to concurrency.
 var mutationWithoutLegacyRow = map[string]string{
 	"reportClientDiagnosticEvents":             "V2-only client diagnostic breadcrumbs: each batch is only written to the server log, never stored, and is never replayed; it replaces a v1 query-string beacon that was not a mutation route.",
+	"muteNotificationSeries":                   "V2-only mute of one series' new-episode notifications (v1 is frozen). Muting a muted series inserts no row, so a replay converges on the same mute.",
+	"unmuteNotificationSeries":                 "V2-only lift of a series mute (v1 is frozen). Unmuting a series that is not muted deletes nothing, so a replay converges.",
+	"markNotInterested":                        "V2-only Not interested mark (v1 is frozen). Marking a marked title changes no row and sends no notice, so a replay converges on the same mark.",
+	"unmarkNotInterested":                      "V2-only clearing of a Not interested mark (v1 is frozen). Clearing an absent mark changes no row and sends no notice, so a replay converges.",
+	"translateLibraryMetadata":                 "V2-only library prewarm of AI metadata translation (v1 is frozen). It coalesces on the library's active prewarm for the language; a replay after it finished starts another prewarm that finds only what is still missing, so nothing is translated twice.",
+	"cancelLibraryMetadataTranslation":         "V2-only cancellation of a library prewarm (v1 is frozen). Canceling a terminal job is a no-op, so a replay converges on the same state.",
 	"drainAdminNode":                           "V2-only transcode node drain (v1 is frozen): it sets the node's drain request, so a replay converges on the same request and placement state.",
 	"resumeAdminNode":                          "V2-only lift of a transcode node drain request (v1 is frozen): it clears the request, so a replay converges on the same state.",
+	"ignoreUnmatchedItem":                      "V2-only mark of an unmatched item as intentionally unmatched (v1 is frozen): it keeps the first time the mark was set, so a replay converges on the same mark.",
+	"unignoreUnmatchedItem":                    "V2-only clear of that mark, the inverse of ignoreUnmatchedItem. Clearing an unmarked item is a no-op, so a replay converges on no mark.",
+	"updateDevice":                             "V2-only rename of a profile's device entry (v1 is frozen): it sets or clears custom_name on one registry row, so a replay converges on the same name.",
 	"startAdminChatGPTLogin":                   "V2-only administrator ChatGPT sign-in: each request supersedes the pending attempt and creates fresh PKCE, state and nonce values, so an uncertain result must not be replayed automatically.",
 	"completeAdminChatGPTLogin":                "V2-only administrator ChatGPT sign-in completion: it consumes a single-use authorization code and pending attempt, so a replay is refused without exchanging the code twice.",
 	"selectAdminChatGPTAccount":                "V2-only administrator ChatGPT account selection: it changes the active account and cancels a pending sign-in, so replaying it after intervening account activity must not happen automatically.",
@@ -1168,8 +1177,9 @@ var mutationWithoutLegacyRow = map[string]string{
 	"queryCatalogLetters":                      "V2-only read-only letter index for an alphabetical jump bar (POST for the rule-group body, like queryCatalogItems). It counts titles and writes nothing, so a replay returns the same answer.",
 	"followRequestMedia":                       "V2-only title follow (Requests acceptance AC1/AC5): v1 had no way to follow a title someone else requested. The follow row is keyed by title and profile, so a replay converges on the same follow.",
 	"unfollowRequestMedia":                     "V2-only title unfollow, the inverse of followRequestMedia. Deleting an absent follow is a no-op, so a replay converges on no follow.",
-	"addWatchlistTitle":                        "V2-only watchlist entry for a title the library doesn't have: v1 had no such entries. The entry is keyed by title and profile, but the add can also create or follow a request and, for a title the library has, fires the library watchlist add's provider and refresh effects, so it is non-retryable like addToWatchlist.",
-	"deleteWatchlistTitle":                     "V2-only removal of a watchlist title entry, the inverse of addWatchlistTitle. An absent entry succeeds, but the removal can cancel a watchlist-made request and repeat the library watchlist removal's provider and refresh effects, so it is non-retryable like deleteWatchlistEntry.",
+	"clearResumePosition":                      "V2-only resume position reset (issue #2134; v1 is frozen). It sets the position to 0 and keeps watched state and history, so a delayed replay would also clear a position recorded after the first request; it is non-retryable like unmark.",
+	"addWatchlistTitle":                        "V2-only watchlist entry for a title the library doesn't have: v1 had no such entries. The entry is keyed by title and profile, but the add can also create or follow a request, so it is non-retryable.",
+	"deleteWatchlistTitle":                     "V2-only removal of a watchlist title entry, the inverse of addWatchlistTitle. An absent entry succeeds, but the removal can cancel a watchlist-made request, so it is non-retryable.",
 	"importAdminTMDBList":                      "V2-only administrator import of a public TMDB list: v1 had no TMDB list source. Like the other imports it creates a new collection per call and is non-retryable.",
 	"importTMDBListCollection":                 "V2-only personal import of a public TMDB list: v1 had no TMDB list source. Like the other imports it creates a new collection per call and is non-retryable.",
 	"createAdminUserPasswordReset":             "V2-only password reset link issue (issue #1442): v1 had no reset links. Each call replaces the account's single live link, so a replay only supersedes the previous link; it is non-retryable because an emailed link may already have been delivered.",
@@ -1203,6 +1213,7 @@ var mutationWithoutLegacyRow = map[string]string{
 	"updateWatchTogetherRoomSelectionMode":     "V2-only lobby mode switch: v1 fixes selection_mode at creation. Repeating the same mode is a no-op; the switch drops the staged item, which is the documented meaning of the value rather than a side effect of retrying.",
 	"regenerateAdminItemTrickplay":             "V2-only seek-bar preview regeneration: v1 had no trickplay. A replay while the files are queued or being made changes nothing, but a later replay makes the previews again, so it is non-retryable like redetectAdminItemMarkers.",
 	"queryWatchTogetherMemberState":            "V2-only POST-shaped read: the content id set (up to 200) exceeds what a query string carries. It changes no state; repeating it returns the current classification.",
+	"resetAdminRecommendationEmbeddings":       "V2-only embeddings reset: v1 had no way to clear the embedding lock. A replay right after success deletes nothing more, but a later replay also deletes what the embedding job built since, so it is non-retryable like the recommendation job triggers.",
 
 	"replaceAdminUserProfileSectionOverrides": "V2-only administrator edit of one profile's page layout: v1 could only change the caller's own profile. It runs the same full-replacement write as replaceProfileSectionOverrides, which is non-retryable because a save can start a trending refresh.",
 	"resetAdminUserProfileSectionOverrides":   "V2-only administrator reset of one profile's page layout: v1 reset only the caller's own profile or every profile at once. It runs the same delete as resetProfileSectionOverrides and is non-retryable like it.",
diff --git a/internal/ctxerr/ctxerr.go b/internal/ctxerr/ctxerr.go
new file mode 100644
index 0000000000..3de88f3bf8
--- /dev/null
+++ b/internal/ctxerr/ctxerr.go
@@ -0,0 +1,63 @@
+// Package ctxerr identifies errors that only report that a caller went away,
+// so request paths do not count or log them as server failures.
+package ctxerr
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+// IsCanceled reports whether err is a cancellation: context.Canceled, or the
+// gRPC Canceled status a plugin call returns when its caller's context ends.
+// Either may be wrapped. A deadline is not a cancellation.
+func IsCanceled(err error) bool {
+	if err == nil {
+		return false
+	}
+	return errors.Is(err, context.Canceled) || status.Code(err) == codes.Canceled
+}
+
+// Abandoned reports whether err only says that the caller of ctx went away:
+// ctx itself was canceled and every error err carries is a cancellation. A
+// real failure that lands after the caller left is not abandoned, even when
+// it is joined with the cancellation.
+func Abandoned(ctx context.Context, err error) bool {
+	return errors.Is(ctx.Err(), context.Canceled) && onlyCanceled(err)
+}
+
+// onlyCanceled reports whether err is a cancellation and carries nothing
+// else: each error joined into it must be one too.
+func onlyCanceled(err error) bool {
+	switch wrapped := err.(type) { //nolint:errorlint // walks the error tree itself
+	case interface{ Unwrap() []error }:
+		found := false
+		for _, inner := range wrapped.Unwrap() {
+			if inner == nil {
+				continue
+			}
+			if !onlyCanceled(inner) {
+				return false
+			}
+			found = true
+		}
+		return found
+	case interface{ Unwrap() error }:
+		if inner := wrapped.Unwrap(); inner != nil {
+			return onlyCanceled(inner)
+		}
+	}
+	return IsCanceled(err)
+}
+
+// LogLevel is level, or Debug when err only says that the caller of ctx went
+// away.
+func LogLevel(ctx context.Context, err error, level slog.Level) slog.Level {
+	if Abandoned(ctx, err) {
+		return slog.LevelDebug
+	}
+	return level
+}
diff --git a/internal/ctxerr/ctxerr_test.go b/internal/ctxerr/ctxerr_test.go
new file mode 100644
index 0000000000..c443db42a5
--- /dev/null
+++ b/internal/ctxerr/ctxerr_test.go
@@ -0,0 +1,66 @@
+package ctxerr
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"testing"
+
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+func TestIsCanceled(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		err  error
+		want bool
+	}{
+		{"nil", nil, false},
+		{"canceled", context.Canceled, true},
+		{"wrapped canceled", fmt.Errorf("loading paths for list: %w", context.Canceled), true},
+		{"joined canceled", errors.Join(errors.New("other"), context.Canceled), true},
+		{"grpc canceled", status.Error(codes.Canceled, "context canceled"), true},
+		{"wrapped grpc canceled", fmt.Errorf("marker provider: %w", status.Error(codes.Canceled, "context canceled")), true},
+		{"deadline", context.DeadlineExceeded, false},
+		{"grpc deadline", status.Error(codes.DeadlineExceeded, "context deadline exceeded"), false},
+		{"grpc unavailable", status.Error(codes.Unavailable, "connection refused"), false},
+		{"other", errors.New("query failed"), false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := IsCanceled(tc.err); got != tc.want {
+				t.Fatalf("IsCanceled(%v) = %v, want %v", tc.err, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestLogLevelNeedsTheCallerGone(t *testing.T) {
+	canceled, cancel := context.WithCancel(t.Context())
+	cancel()
+	expired, cancelExpired := context.WithTimeout(t.Context(), 0)
+	defer cancelExpired()
+	for _, tc := range []struct {
+		name string
+		ctx  context.Context
+		err  error
+		want slog.Level
+	}{
+		{"caller gone", canceled, fmt.Errorf("query: %w", context.Canceled), slog.LevelDebug},
+		{"plugin call after the caller left", canceled, status.Error(codes.Canceled, "context canceled"), slog.LevelDebug},
+		{"real failure after the caller left", canceled, errors.New("connection reset"), slog.LevelWarn},
+		{"wrapped plugin call after the caller left", canceled, fmt.Errorf("marker provider: %w", status.Error(codes.Canceled, "context canceled")), slog.LevelDebug},
+		{"joined cancellations", canceled, errors.Join(context.Canceled, status.Error(codes.Canceled, "context canceled")), slog.LevelDebug},
+		{"real failure joined with the cancellation", canceled, errors.Join(errors.New("query failed"), context.Canceled), slog.LevelWarn},
+		{"wrapped join with a real failure", canceled, fmt.Errorf("loading: %w", errors.Join(context.Canceled, errors.New("query failed"))), slog.LevelWarn},
+		{"cancellation while the caller waits", t.Context(), context.Canceled, slog.LevelWarn},
+		{"deadline", expired, context.DeadlineExceeded, slog.LevelWarn},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := LogLevel(tc.ctx, tc.err, slog.LevelWarn); got != tc.want {
+				t.Fatalf("LogLevel = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
diff --git a/internal/database/external_subtitle_name_backfill.go b/internal/database/external_subtitle_name_backfill.go
new file mode 100644
index 0000000000..f1b8446ee7
--- /dev/null
+++ b/internal/database/external_subtitle_name_backfill.go
@@ -0,0 +1,229 @@
+package database
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+	"strconv"
+
+	"github.com/pressly/goose/v3"
+
+	"github.com/prairie-server/prairie-server/internal/naming"
+)
+
+// externalSubtitleNameBackfillVersion sorts after every migration that shipped
+// before sidecar subtitle names were read for a language in any position and
+// for hearing-impaired words.
+const externalSubtitleNameBackfillVersion int64 = 20261014033149
+
+// externalSubtitleNameBackfillBatchSize bounds how many media_files rows with
+// sidecars one batch reads and rewrites.
+const externalSubtitleNameBackfillBatchSize = 5000
+
+// externalSubtitleNameBackfillMaxPasses bounds the convergence passes for the
+// same reason as subtitleLanguageBackfillMaxPasses.
+const externalSubtitleNameBackfillMaxPasses = 3
+
+// externalSubtitleNameBackfillMigration re-reads the language and
+// hearing-impaired flag of every stored sidecar subtitle from its file name,
+// with the naming.SidecarSubtitleTags rule the scanner now applies.
+//
+// A rescan does not do this on its own: the scanner rewrites a file's sidecars
+// only when the video or the set of sidecar paths changes. Without this
+// repair, "Movie.sdh.en.srt" in an existing library keeps the language "sdh"
+// and no hearing-impaired flag until its files change. A sidecar's language
+// and flags come only from its path, so re-reading them stores exactly what a
+// fresh scan of the same files would.
+//
+// Go rather than SQL because the rule checks each word against the registered
+// language list in golang.org/x/text. RunDB rather than RunTx so each batch
+// commits on its own.
+func externalSubtitleNameBackfillMigration() *goose.Migration {
+	m := goose.NewGoMigration(
+		externalSubtitleNameBackfillVersion,
+		&goose.GoFunc{RunDB: backfillExternalSubtitleNames},
+		// The values the earlier parser stored are not recorded, so there is
+		// nothing to restore.
+		&goose.GoFunc{RunDB: func(context.Context, *sql.DB) error { return nil }},
+	)
+	m.Source = fmt.Sprintf("%d_external_subtitle_name_backfill.go", externalSubtitleNameBackfillVersion)
+	return m
+}
+
+// backfillExternalSubtitleNames repeats the repair until a pass finds nothing
+// to repair, so rows an older writer stored mid-pass are picked up too.
+func backfillExternalSubtitleNames(ctx context.Context, db *sql.DB) error {
+	for pass := 1; pass <= externalSubtitleNameBackfillMaxPasses; pass++ {
+		stale, err := backfillExternalSubtitleNamesPass(ctx, db, pass)
+		if err != nil {
+			return err
+		}
+		if stale == 0 {
+			return nil
+		}
+	}
+	return fmt.Errorf("sidecar subtitle name repair still found stale rows after %d passes; retry after older writers stop", externalSubtitleNameBackfillMaxPasses)
+}
+
+type externalSubtitleNameRow struct {
+	id        int64
+	filePath  string
+	subtitles []byte
+}
+
+// externalSubtitleNameRepair is one row's rewrite. Stored is the value the
+// rewrite was computed from; the update applies only while it is unchanged.
+type externalSubtitleNameRepair struct {
+	ID       int64           `json:"id"`
+	Stored   json.RawMessage `json:"stored"`
+	Repaired json.RawMessage `json:"repaired"`
+}
+
+// backfillExternalSubtitleNamesPass repairs every row once and returns how many
+// rows needed a repair, including rows skipped because they changed after they
+// were read.
+func backfillExternalSubtitleNamesPass(ctx context.Context, db *sql.DB, pass int) (int64, error) {
+	var lastID, stale, changed int64
+	batches := 0
+	for {
+		rows, err := loadExternalSubtitleNameBatch(ctx, db, lastID)
+		if err != nil {
+			return 0, err
+		}
+		if len(rows) == 0 {
+			break
+		}
+		lastID = rows[len(rows)-1].id
+
+		var repairs []externalSubtitleNameRepair
+		for _, row := range rows {
+			repaired, ok, err := repairExternalSubtitleNames(row.filePath, row.subtitles)
+			if err != nil {
+				slog.WarnContext(ctx, "sidecar subtitle name repair: leaving a row it cannot decode untouched",
+					"media_file_id", row.id, "error", err)
+				continue
+			}
+			if ok {
+				repairs = append(repairs, externalSubtitleNameRepair{ID: row.id, Stored: row.subtitles, Repaired: repaired})
+			}
+		}
+		n, err := applyExternalSubtitleNameRepairs(ctx, db, repairs)
+		if err != nil {
+			return 0, err
+		}
+		stale += int64(len(repairs))
+		changed += n
+		batches++
+		if n > 0 {
+			slog.InfoContext(ctx, "sidecar subtitle name repair batch committed",
+				"pass", pass, "batch", batches, "through_media_file_id", lastID, "rows", n)
+		}
+	}
+	slog.InfoContext(ctx, "sidecar subtitle name repair pass finished",
+		"pass", pass, "batches", batches, "rows", changed, "skipped_changed_rows", stale-changed)
+	return stale, nil
+}
+
+// loadExternalSubtitleNameBatch returns the next rows after lastID that have at
+// least one stored sidecar.
+func loadExternalSubtitleNameBatch(ctx context.Context, db *sql.DB, lastID int64) ([]externalSubtitleNameRow, error) {
+	rows, err := db.QueryContext(ctx, `
+SELECT id, file_path, external_subtitles
+  FROM public.media_files
+ WHERE id > $1
+   AND jsonb_typeof(external_subtitles) = 'array'
+   AND external_subtitles <> '[]'::jsonb
+ ORDER BY id
+ LIMIT $2`, lastID, externalSubtitleNameBackfillBatchSize)
+	if err != nil {
+		return nil, fmt.Errorf("loading sidecar subtitles after media_files id %d: %w", lastID, err)
+	}
+	defer func() { _ = rows.Close() }()
+
+	var batch []externalSubtitleNameRow
+	for rows.Next() {
+		var row externalSubtitleNameRow
+		if err := rows.Scan(&row.id, &row.filePath, &row.subtitles); err != nil {
+			return nil, fmt.Errorf("scanning sidecar subtitles after media_files id %d: %w", lastID, err)
+		}
+		batch = append(batch, row)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("loading sidecar subtitles after media_files id %d: %w", lastID, err)
+	}
+	return batch, nil
+}
+
+// repairExternalSubtitleNames re-reads each sidecar's language and
+// hearing-impaired flag from its path and reports whether any changed. Every
+// other field is kept, as are elements without a path or whose name does not
+// belong to the video.
+func repairExternalSubtitleNames(videoPath string, stored []byte) ([]byte, bool, error) {
+	var elems []json.RawMessage
+	if err := json.Unmarshal(stored, &elems); err != nil {
+		return nil, false, err
+	}
+	changed := false
+	for i, raw := range elems {
+		var current struct {
+			Path            string `json:"path"`
+			Language        string `json:"language"`
+			HearingImpaired bool   `json:"hearing_impaired"`
+		}
+		var fields map[string]json.RawMessage
+		if json.Unmarshal(raw, &current) != nil || json.Unmarshal(raw, &fields) != nil || current.Path == "" {
+			continue
+		}
+		tags, ok := naming.SidecarSubtitleTags(videoPath, current.Path)
+		if !ok || (tags.Language == current.Language && tags.HearingImpaired == current.HearingImpaired) {
+			continue
+		}
+		language, err := json.Marshal(tags.Language)
+		if err != nil {
+			return nil, false, err
+		}
+		fields["language"] = language
+		fields["hearing_impaired"] = json.RawMessage(strconv.FormatBool(tags.HearingImpaired))
+		if elems[i], err = json.Marshal(fields); err != nil {
+			return nil, false, err
+		}
+		changed = true
+	}
+	if !changed {
+		return nil, false, nil
+	}
+	repaired, err := json.Marshal(elems)
+	if err != nil {
+		return nil, false, err
+	}
+	return repaired, true, nil
+}
+
+// applyExternalSubtitleNameRepairs writes a batch of rewrites in one statement.
+// A row whose sidecars changed since they were read is skipped; the next pass
+// reads it again.
+func applyExternalSubtitleNameRepairs(ctx context.Context, db *sql.DB, repairs []externalSubtitleNameRepair) (int64, error) {
+	if len(repairs) == 0 {
+		return 0, nil
+	}
+	payload, err := json.Marshal(repairs)
+	if err != nil {
+		return 0, fmt.Errorf("encoding sidecar subtitle repairs: %w", err)
+	}
+	result, err := db.ExecContext(ctx, `
+UPDATE public.media_files mf
+   SET external_subtitles = r.repaired
+  FROM jsonb_to_recordset($1::jsonb) AS r(id bigint, stored jsonb, repaired jsonb)
+ WHERE mf.id = r.id
+   AND mf.external_subtitles = r.stored`, string(payload))
+	if err != nil {
+		return 0, fmt.Errorf("writing sidecar subtitle repairs through media_files id %d: %w", repairs[len(repairs)-1].ID, err)
+	}
+	n, err := result.RowsAffected()
+	if err != nil {
+		return 0, fmt.Errorf("counting sidecar subtitle repairs: %w", err)
+	}
+	return n, nil
+}
diff --git a/internal/database/external_subtitle_name_backfill_test.go b/internal/database/external_subtitle_name_backfill_test.go
new file mode 100644
index 0000000000..4c78497660
--- /dev/null
+++ b/internal/database/external_subtitle_name_backfill_test.go
@@ -0,0 +1,203 @@
+package database
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+	"github.com/jackc/pgx/v5/stdlib"
+
+	"github.com/prairie-server/prairie-server/migrations"
+)
+
+func TestRepairExternalSubtitleNames(t *testing.T) {
+	stored := `[
+	  {"path":"/m/Movie.en.srt","language":"en","format":"srt","title":"Movie.en.srt","forced":false,"default":false,"hearing_impaired":false},
+	  {"path":"/m/Movie.sdh.en.srt","language":"sdh","format":"srt","title":"Movie.sdh.en.srt","forced":false},
+	  {"path":"/m/Movie.en.hi.srt","language":"en","format":"srt","title":"Movie.en.hi.srt"},
+	  {"path":"/m/Movie.ai.hr.srt","language":"ai","format":"srt","title":"Movie.ai.hr.srt","embedded_title":"kept"},
+	  {"path":"/m/Movie.hi.srt","language":"hi","format":"srt"},
+	  {"path":"/elsewhere/Other.sdh.srt","language":"sdh","format":"srt"},
+	  {"language":"sdh"}
+	]`
+	repaired, ok, err := repairExternalSubtitleNames("/m/Movie.mkv", []byte(stored))
+	if err != nil || !ok {
+		t.Fatalf("repairExternalSubtitleNames = ok %v, err %v; want a rewrite", ok, err)
+	}
+	var elems []map[string]any
+	if err := json.Unmarshal(repaired, &elems); err != nil {
+		t.Fatalf("decoding %s: %v", repaired, err)
+	}
+	want := []struct {
+		language any
+		hearing  any
+	}{
+		{"en", false},
+		{"en", true},
+		{"en", true},
+		{"hr", false},
+		// Hindi: "hi" is the only language word.
+		{"hi", nil},
+		// Not a sidecar of this video, and no path: left alone.
+		{"sdh", nil},
+		{"sdh", nil},
+	}
+	if len(elems) != len(want) {
+		t.Fatalf("element count = %d, want %d", len(elems), len(want))
+	}
+	for i, elem := range elems {
+		if elem["language"] != want[i].language || elem["hearing_impaired"] != want[i].hearing {
+			t.Errorf("element %d = language %v, hearing impaired %v; want %v, %v",
+				i, elem["language"], elem["hearing_impaired"], want[i].language, want[i].hearing)
+		}
+	}
+	if elems[3]["embedded_title"] != "kept" || elems[3]["title"] != "Movie.ai.hr.srt" || elems[3]["format"] != "srt" {
+		t.Errorf("repair lost sibling fields: %v", elems[3])
+	}
+
+	if _, ok, err := repairExternalSubtitleNames("/m/Movie.mkv", repaired); ok || err != nil {
+		t.Fatalf("second repair = ok %v, err %v; want nothing left to change", ok, err)
+	}
+	if _, _, err := repairExternalSubtitleNames("/m/Movie.mkv", []byte(`{"not":"an array"}`)); err == nil {
+		t.Fatal("repair of a non-array succeeded, want an error so the row is skipped")
+	}
+}
+
+// TestPostgresExternalSubtitleNameBackfill runs the real goose provider, which
+// registers the Go migration, then exercises the backfill directly over seeded
+// rows.
+func TestPostgresExternalSubtitleNameBackfill(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatalf("connect test database: %v", err)
+	}
+	t.Cleanup(pool.Close)
+	if err := RunMigrations(ctx, pool, migrations.FS, "sql"); err != nil {
+		t.Fatalf("initial migration: %v", err)
+	}
+
+	var folderID int
+	if err := pool.QueryRow(ctx,
+		`INSERT INTO media_folders (type, name, enabled) VALUES ('movie', $1, true) RETURNING id`,
+		fmt.Sprintf("external-subtitle-name-backfill-%d", time.Now().UnixNano())).Scan(&folderID); err != nil {
+		t.Fatalf("seed folder: %v", err)
+	}
+	t.Cleanup(func() { _, _ = pool.Exec(ctx, `DELETE FROM media_folders WHERE id = $1`, folderID) })
+
+	dir := fmt.Sprintf("/external-subtitle-name-backfill/%d", time.Now().UnixNano())
+	seed := func(name, external string) int {
+		t.Helper()
+		var id int
+		if err := pool.QueryRow(ctx, `
+INSERT INTO media_files (media_folder_id, file_path, base_type, file_size, external_subtitles)
+VALUES ($1, $2, 'movie', 0, $3::jsonb) RETURNING id`,
+			folderID, dir+"/"+name, external).Scan(&id); err != nil {
+			t.Fatalf("seed %s: %v", name, err)
+		}
+		return id
+	}
+	staleID := seed("Movie.mkv", fmt.Sprintf(`[
+	  {"path":"%[1]s/Movie.en.srt","language":"en","format":"srt","title":"Movie.en.srt","forced":false,"default":false,"hearing_impaired":false},
+	  {"path":"%[1]s/Movie.sdh.en.srt","language":"sdh","format":"srt","title":"Movie.sdh.en.srt","forced":false,"default":false,"hearing_impaired":false},
+	  {"path":"%[1]s/Movie.en.forced.sdh.srt","language":"en","format":"srt","title":"Movie.en.forced.sdh.srt","forced":true,"default":false,"hearing_impaired":false}
+	]`, dir))
+	currentID := seed("Current.mkv", fmt.Sprintf(`[
+	  {"path":"%[1]s/Current.en.sdh.srt","language":"en","format":"srt","title":"Current.en.sdh.srt","forced":false,"default":false,"hearing_impaired":true}
+	]`, dir))
+	emptyID := seed("Empty.mkv", `[]`)
+	t.Cleanup(func() {
+		_, _ = pool.Exec(ctx, `DELETE FROM media_files WHERE id = ANY($1)`, []int{staleID, currentID, emptyID})
+	})
+
+	// xmin changes whenever a row is updated, so an unchanged value proves the
+	// backfill left the row alone.
+	rowVersion := func(id int) string {
+		t.Helper()
+		var xmin string
+		if err := pool.QueryRow(ctx, `SELECT xmin::text FROM media_files WHERE id = $1`, id).Scan(&xmin); err != nil {
+			t.Fatalf("reading xmin of media file %d: %v", id, err)
+		}
+		return xmin
+	}
+	untouched := map[int]string{currentID: rowVersion(currentID), emptyID: rowVersion(emptyID)}
+
+	sqlDB := stdlib.OpenDBFromPool(pool)
+	t.Cleanup(func() { _ = sqlDB.Close() })
+	if err := backfillExternalSubtitleNames(ctx, sqlDB); err != nil {
+		t.Fatalf("backfillExternalSubtitleNames: %v", err)
+	}
+
+	read := func(id int) []map[string]any {
+		t.Helper()
+		var raw []byte
+		if err := pool.QueryRow(ctx, `SELECT external_subtitles FROM media_files WHERE id = $1`, id).Scan(&raw); err != nil {
+			t.Fatalf("reading media file %d: %v", id, err)
+		}
+		var elems []map[string]any
+		if err := json.Unmarshal(raw, &elems); err != nil {
+			t.Fatalf("decoding %s: %v", raw, err)
+		}
+		return elems
+	}
+
+	t.Run("stale sidecars take the scanner's reading", func(t *testing.T) {
+		elems := read(staleID)
+		want := []struct {
+			language        string
+			forced, hearing bool
+		}{{"en", false, false}, {"en", false, true}, {"en", true, true}}
+		if len(elems) != len(want) {
+			t.Fatalf("sidecar count = %d, want %d", len(elems), len(want))
+		}
+		for i, elem := range elems {
+			if elem["language"] != want[i].language || elem["forced"] != want[i].forced || elem["hearing_impaired"] != want[i].hearing {
+				t.Errorf("sidecar %d = %v, want language %q, forced %v, hearing impaired %v",
+					i, elem, want[i].language, want[i].forced, want[i].hearing)
+			}
+			if elem["format"] != "srt" || elem["default"] != false || elem["title"] == "" {
+				t.Errorf("sidecar %d lost sibling fields: %v", i, elem)
+			}
+		}
+	})
+
+	t.Run("rows already read correctly are not rewritten", func(t *testing.T) {
+		for id, before := range untouched {
+			if after := rowVersion(id); after != before {
+				t.Errorf("media file %d was rewritten: xmin %s -> %s", id, before, after)
+			}
+		}
+	})
+
+	t.Run("a row changed after it was read is left for the next pass", func(t *testing.T) {
+		before := rowVersion(staleID)
+		n, err := applyExternalSubtitleNameRepairs(ctx, sqlDB, []externalSubtitleNameRepair{
+			{ID: int64(staleID), Stored: json.RawMessage(`[]`), Repaired: json.RawMessage(`[]`)},
+		})
+		if err != nil || n != 0 {
+			t.Fatalf("repair from an out-of-date value wrote %d rows, err %v; want none", n, err)
+		}
+		if after := rowVersion(staleID); after != before {
+			t.Fatalf("media file %d was rewritten from an out-of-date value", staleID)
+		}
+	})
+
+	t.Run("a second run leaves repaired rows alone", func(t *testing.T) {
+		before := rowVersion(staleID)
+		if err := backfillExternalSubtitleNames(ctx, sqlDB); err != nil {
+			t.Fatalf("second backfillExternalSubtitleNames: %v", err)
+		}
+		if after := rowVersion(staleID); after != before {
+			t.Fatalf("media file %d was rewritten again: xmin %s -> %s", staleID, before, after)
+		}
+	})
+}
diff --git a/internal/database/invalid_index_rebuild.go b/internal/database/invalid_index_rebuild.go
index bbea42ca1f..9d91d776d5 100644
--- a/internal/database/invalid_index_rebuild.go
+++ b/internal/database/invalid_index_rebuild.go
@@ -56,24 +56,35 @@ func rebuildInvalidIndexes(ctx context.Context, db *sql.DB, schema string) error
 	quotedSchema := pgx.Identifier{schema}.Sanitize()
 	for _, index := range rebuiltConcurrentIndexes {
 		quotedName := pgx.Identifier{index.name}.Sanitize()
-		qualified := quotedSchema + "." + quotedName
-		var valid bool
-		if err := db.QueryRowContext(ctx,
-			`SELECT coalesce((SELECT indisvalid FROM pg_index WHERE indexrelid = to_regclass($1)), false)`,
-			qualified,
-		).Scan(&valid); err != nil {
-			return fmt.Errorf("checking index %s: %w", index.name, err)
-		}
-		if valid {
-			continue
-		}
-		if _, err := db.ExecContext(ctx, "DROP INDEX CONCURRENTLY IF EXISTS "+qualified); err != nil {
-			return fmt.Errorf("dropping invalid index %s: %w", index.name, err)
-		}
-		if _, err := db.ExecContext(ctx, fmt.Sprintf("CREATE INDEX CONCURRENTLY IF NOT EXISTS %s ON %s.%s",
-			quotedName, quotedSchema, index.definition)); err != nil {
-			return fmt.Errorf("rebuilding index %s: %w", index.name, err)
+		if err := ensureIndexConcurrently(ctx, db, quotedSchema+"."+quotedName, fmt.Sprintf(
+			"CREATE INDEX CONCURRENTLY IF NOT EXISTS %s ON %s.%s", quotedName, quotedSchema, index.definition)); err != nil {
+			return err
 		}
 	}
 	return nil
 }
+
+// ensureIndexConcurrently runs build, a CREATE INDEX CONCURRENTLY statement
+// for qualifiedName, unless a valid index of that name already exists. An
+// invalid copy an interrupted build left behind is dropped concurrently
+// first. A valid index is never dropped, so a retried migration keeps what an
+// earlier attempt built.
+func ensureIndexConcurrently(ctx context.Context, db *sql.DB, qualifiedName, build string) error {
+	var valid bool
+	if err := db.QueryRowContext(ctx,
+		`SELECT coalesce((SELECT indisvalid FROM pg_index WHERE indexrelid = to_regclass($1)), false)`,
+		qualifiedName,
+	).Scan(&valid); err != nil {
+		return fmt.Errorf("checking index %s: %w", qualifiedName, err)
+	}
+	if valid {
+		return nil
+	}
+	if _, err := db.ExecContext(ctx, "DROP INDEX CONCURRENTLY IF EXISTS "+qualifiedName); err != nil {
+		return fmt.Errorf("dropping invalid index %s: %w", qualifiedName, err)
+	}
+	if _, err := db.ExecContext(ctx, build); err != nil {
+		return fmt.Errorf("building index %s: %w", qualifiedName, err)
+	}
+	return nil
+}
diff --git a/internal/database/main_test.go b/internal/database/main_test.go
new file mode 100644
index 0000000000..20a5888efa
--- /dev/null
+++ b/internal/database/main_test.go
@@ -0,0 +1,23 @@
+package database
+
+import (
+	"fmt"
+	"os"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/database/queryattr"
+)
+
+func TestMain(m *testing.M) {
+	if err := os.Setenv("PRAIRIE_QUERY_ATTRIBUTION_ENABLED", "true"); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+	os.Exit(m.Run())
+}
+
+func TestPostgresAttributionInitializedBeforePool(t *testing.T) {
+	if !queryattr.Initialize() {
+		t.Fatal("attribution disabled before the first pool, want enabled fixture")
+	}
+}
diff --git a/internal/database/migrate.go b/internal/database/migrate.go
index a6684f54b7..9b7a92694c 100644
--- a/internal/database/migrate.go
+++ b/internal/database/migrate.go
@@ -69,7 +69,13 @@ func RunMigrations(ctx context.Context, pool *pgxpool.Pool, fsys fs.FS, dir stri
 	}
 	defer func() { _ = provider.Close() }()
 
-	return applyMigrationsLogged(ctx, provider, slog.Default(), migrationHeartbeatInterval)
+	if err := applyMigrationsLogged(ctx, provider, slog.Default(), migrationHeartbeatInterval); err != nil {
+		return err
+	}
+	// Connections look up the vector types when they open. On a new database
+	// the migrations create them, so reconnect for the binary codecs.
+	pool.Reset()
+	return nil
 }
 
 // MigrateDownTo rolls back every migration newer than version, newest first.
@@ -190,16 +196,19 @@ func newMigrationProvider(pool *pgxpool.Pool, fsys fs.FS, dir string) (*goose.Pr
 		// in Go packages shared with other write paths: the settings backfill
 		// validates every value against the contract and re-encodes it as
 		// typed JSON, the displayprefs move parses the legacy jellycompat
-		// keys, and the subtitle language backfill applies the scanner's
-		// lang.CompatibleTag — none expressible in SQL without duplicating
-		// those rules. The invalid index rebuild decides per index whether to
-		// drop and rebuild it concurrently, which SQL cannot do outside a
-		// transaction.
+		// keys, the subtitle language backfill applies the scanner's
+		// lang.CompatibleTag, and the sidecar subtitle name backfill applies
+		// the scanner's naming.SidecarSubtitleTags. None of these can be
+		// expressed in SQL without duplicating those rules. The invalid index rebuild and the
+		// push attempt key scope decide per index whether to drop and build it
+		// concurrently, which SQL cannot do outside a transaction.
 		goose.WithGoMigrations(
 			settingsBackfillMigration(),
 			displayPrefsMoveMigration(),
 			subtitleLanguageBackfillMigration(),
 			invalidIndexRebuildMigration(),
+			pushAttemptKeyScopeMigration(),
+			externalSubtitleNameBackfillMigration(),
 		),
 	)
 	if err != nil {
diff --git a/internal/database/migrate_progress_test.go b/internal/database/migrate_progress_test.go
index 5ebe7d0df3..5899f39295 100644
--- a/internal/database/migrate_progress_test.go
+++ b/internal/database/migrate_progress_test.go
@@ -351,14 +351,17 @@ func TestMigrationRollbackCandidatesListAppliedMigrationsAboveTheTarget(t *testi
 	}
 }
 
-// TestRegisteredGoMigrationsHaveNames covers the three Go migrations this
-// provider registers: goose leaves their source path empty, so without a name
-// their progress logs would carry name="".
+// TestRegisteredGoMigrationsHaveNames covers the Go migrations this provider
+// registers: goose leaves their source path empty, so without a name their
+// progress logs would carry name="".
 func TestRegisteredGoMigrationsHaveNames(t *testing.T) {
 	for _, m := range []*goose.Migration{
 		settingsBackfillMigration(),
 		displayPrefsMoveMigration(),
 		subtitleLanguageBackfillMigration(),
+		invalidIndexRebuildMigration(),
+		pushAttemptKeyScopeMigration(),
+		externalSubtitleNameBackfillMigration(),
 	} {
 		name := migrationName(&goose.Source{Type: goose.TypeGo, Path: m.Source, Version: m.Version})
 		if name == "" || name != m.Source {
diff --git a/internal/database/migration_command.go b/internal/database/migration_command.go
new file mode 100644
index 0000000000..1f0ab950f9
--- /dev/null
+++ b/internal/database/migration_command.go
@@ -0,0 +1,57 @@
+package database
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"io/fs"
+	"path/filepath"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/partman"
+)
+
+// MigrateOnly applies pending migrations, then ensures the audit-detail indexes.
+// Migration errors are returned unchanged; index errors include operation context.
+func MigrateOnly(ctx context.Context, pool *pgxpool.Pool, fsys fs.FS, dir string) error {
+	if err := RunMigrations(ctx, pool, fsys, dir); err != nil {
+		return err
+	}
+	// Parent audit indexes need concurrent builds on existing partitions.
+	if err := partman.NewManager(pool, "activity_log", partman.Weekly, 2).EnsureIndexes(ctx,
+		"activity_log_action_time_idx", "activity_log_target_time_idx"); err != nil {
+		return fmt.Errorf("ensure audit detail indexes: %w", err)
+	}
+	return nil
+}
+
+// PrintMigrationStatus reads migration statuses and writes their table to w.
+// It returns database and output errors to the caller.
+func PrintMigrationStatus(ctx context.Context, pool *pgxpool.Pool, fsys fs.FS, dir string, w io.Writer) error {
+	statuses, err := MigrationStatuses(ctx, pool, fsys, dir)
+	if err != nil {
+		return err
+	}
+	return printMigrationStatuses(w, statuses)
+}
+
+func printMigrationStatuses(output io.Writer, statuses []MigrationStatus) error {
+	if _, err := fmt.Fprintf(output, "%-8s %8s %-25s %s\n", "STATE", "VERSION", "APPLIED_AT", "MIGRATION"); err != nil {
+		return err
+	}
+	for _, status := range statuses {
+		appliedAt, source := "-", "-"
+		if !status.AppliedAt.IsZero() {
+			appliedAt = status.AppliedAt.UTC().Format(time.RFC3339)
+		}
+		if status.Source != "" {
+			source = filepath.Base(status.Source)
+		}
+		if _, err := fmt.Fprintf(output, "%-8s %8d %-25s %s\n", status.State, status.Version, appliedAt, source); err != nil {
+			return err
+		}
+	}
+	return nil
+}
diff --git a/internal/database/migration_command_test.go b/internal/database/migration_command_test.go
new file mode 100644
index 0000000000..8981cd16cd
--- /dev/null
+++ b/internal/database/migration_command_test.go
@@ -0,0 +1,54 @@
+package database
+
+import (
+	"bytes"
+	"errors"
+	"io"
+	"testing"
+	"time"
+)
+
+func TestPrintMigrationStatuses(t *testing.T) {
+	for _, tc := range []struct {
+		name     string
+		statuses []MigrationStatus
+		rows     string
+	}{
+		{name: "empty"},
+		{name: "applied and pending", statuses: []MigrationStatus{
+			{State: "applied", Version: 12, Source: "sql/012_example.sql", AppliedAt: time.Date(2026, 10, 15, 8, 0, 0, 0, time.FixedZone("test", 3600))},
+			{State: "pending", Version: 13},
+		}, rows: "applied        12 2026-10-15T07:00:00Z      012_example.sql\n" +
+			"pending        13 -                         -\n"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var output bytes.Buffer
+			if err := printMigrationStatuses(&output, tc.statuses); err != nil {
+				t.Fatalf("print status = %v, want success", err)
+			}
+			want := "STATE     VERSION APPLIED_AT                MIGRATION\n" + tc.rows
+			if output.String() != want {
+				t.Errorf("status output = %q, want %q", output.String(), want)
+			}
+		})
+	}
+}
+
+type failingMigrationWriter struct{ remaining int }
+
+func (w *failingMigrationWriter) Write(p []byte) (int, error) {
+	if w.remaining == 0 {
+		return 0, io.ErrClosedPipe
+	}
+	w.remaining--
+	return len(p), nil
+}
+
+func TestPrintMigrationStatusesOutputFailure(t *testing.T) {
+	for _, writes := range []int{0, 1} {
+		err := printMigrationStatuses(&failingMigrationWriter{remaining: writes}, []MigrationStatus{{Version: 1}})
+		if !errors.Is(err, io.ErrClosedPipe) {
+			t.Errorf("failure after %d writes = %v, want %v", writes, err, io.ErrClosedPipe)
+		}
+	}
+}
diff --git a/internal/database/pglock/pglock.go b/internal/database/pglock/pglock.go
index 6cf74e0035..d0f55ec0e0 100644
--- a/internal/database/pglock/pglock.go
+++ b/internal/database/pglock/pglock.go
@@ -142,6 +142,61 @@ func (l *Lock) AcquireAlso(ctx context.Context, key int64, wait time.Duration) (
 	return locked, nil
 }
 
+// Held reports whether l's session is still open. An error in AcquireAlso
+// or ReleaseAlso closes it, which drops every lock l held.
+func (l *Lock) Held() bool {
+	return l != nil && l.conn != nil
+}
+
+// Check runs a query on l's session and returns an error when the session
+// has closed, which released every lock l held. A failed query closes the
+// session, as in AcquireAlso, and Held then reports false.
+func (l *Lock) Check(ctx context.Context) error {
+	if l == nil || l.conn == nil {
+		return errors.New("checking advisory lock: no session holds a lock")
+	}
+	if _, err := l.conn.Exec(ctx, `SELECT 1`); err != nil {
+		conn := l.conn
+		l.conn = nil
+		_ = conn.Hijack().Close(context.WithoutCancel(ctx))
+		return fmt.Errorf("checking advisory lock session: %w", err)
+	}
+	return nil
+}
+
+// ReleaseAlso unlocks key, which AcquireAlso took on l's session, and keeps
+// l's other locks, so work that takes one key after another under a
+// longer-held lock does not hold them all to the end. When the unlock fails
+// or reports the key was not held, the session is closed, as in Release:
+// that drops l's other locks too, and Release becomes a no-op. A key l does
+// not hold, or a session already closed, is a no-op.
+func (l *Lock) ReleaseAlso(ctx context.Context, key int64) error {
+	if l == nil || l.conn == nil {
+		return nil
+	}
+	i := slices.Index(l.also, key)
+	if i < 0 {
+		return nil
+	}
+	l.also = slices.Delete(l.also, i, i+1)
+
+	releaseCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), releaseTimeout)
+	defer cancel()
+	var unlocked bool
+	err := l.conn.QueryRow(releaseCtx, `SELECT pg_advisory_unlock($1)`, key).Scan(&unlocked)
+	if err == nil && unlocked {
+		return nil
+	}
+	conn := l.conn
+	l.conn = nil
+	l.also = nil
+	_ = conn.Hijack().Close(context.WithoutCancel(ctx))
+	if err != nil {
+		return fmt.Errorf("releasing advisory lock %d: %w", key, err)
+	}
+	return fmt.Errorf("releasing advisory lock %d: lock was not held", key)
+}
+
 // Session is a database session that can begin a transaction: a pooled
 // connection, or a connection of its own.
 type Session interface {
diff --git a/internal/database/pglock/pglock_test.go b/internal/database/pglock/pglock_test.go
index 15a1a99079..40ce78c60d 100644
--- a/internal/database/pglock/pglock_test.go
+++ b/internal/database/pglock/pglock_test.go
@@ -368,3 +368,75 @@ func TestAcquireAlsoWithoutALockFails(t *testing.T) {
 		t.Fatalf("AcquireAlso on a nil Lock = (%v, %v), want an error", acquired, err)
 	}
 }
+
+func TestReleaseAlsoUnlocksOnlyThatKey(t *testing.T) {
+	pool := testPool(t)
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	lock, acquired, err := TryAcquire(ctx, pool, pglockTestKey)
+	if err != nil || !acquired {
+		t.Fatalf("TryAcquire = (%v, %v), want acquired", acquired, err)
+	}
+	defer func() { _ = lock.Release(ctx) }()
+	if acquired, err := lock.AcquireAlso(ctx, pglockOtherTestKey, 0); err != nil || !acquired {
+		t.Fatalf("AcquireAlso = (%v, %v), want acquired", acquired, err)
+	}
+	if err := lock.ReleaseAlso(ctx, pglockOtherTestKey); err != nil {
+		t.Fatalf("ReleaseAlso: %v", err)
+	}
+	if lockHeld(t, pool, pglockOtherTestKey) {
+		t.Fatal("the released key is still held")
+	}
+	if !lockHeld(t, pool, pglockTestKey) {
+		t.Fatal("ReleaseAlso dropped the lock's own key")
+	}
+	// A second release, or a key never taken, changes nothing.
+	if err := lock.ReleaseAlso(ctx, pglockOtherTestKey); err != nil {
+		t.Fatalf("second ReleaseAlso: %v", err)
+	}
+	// The key can be taken again on the same session, and Release unlocks
+	// everything still held.
+	if acquired, err := lock.AcquireAlso(ctx, pglockOtherTestKey, 0); err != nil || !acquired {
+		t.Fatalf("AcquireAlso again = (%v, %v), want acquired", acquired, err)
+	}
+	if err := lock.Release(ctx); err != nil {
+		t.Fatalf("Release: %v", err)
+	}
+	if lockHeld(t, pool, pglockTestKey) || lockHeld(t, pool, pglockOtherTestKey) {
+		t.Fatal("Release left a key held")
+	}
+}
+
+// A lock whose session dies fails Check and is no longer held, and
+// AcquireAlso on it fails.
+func TestHeldIsFalseAfterTheSessionDies(t *testing.T) {
+	pool := testPool(t)
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	lock, acquired, err := TryAcquire(ctx, pool, pglockTestKey)
+	if err != nil || !acquired {
+		t.Fatalf("TryAcquire = (%v, %v), want acquired", acquired, err)
+	}
+	defer func() { _ = lock.Release(ctx) }()
+	if !lock.Held() {
+		t.Fatal("Held = false for a fresh lock")
+	}
+	var pid int
+	if err := lock.conn.QueryRow(ctx, `SELECT pg_backend_pid()`).Scan(&pid); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := pool.Exec(ctx, `SELECT pg_terminate_backend($1)`, pid); err != nil {
+		t.Fatal(err)
+	}
+	if err := lock.Check(ctx); err == nil {
+		t.Fatal("Check succeeded on a dead session")
+	}
+	if lock.Held() {
+		t.Fatal("Held = true after the session died")
+	}
+	if _, err := lock.AcquireAlso(ctx, pglockOtherTestKey, 0); err == nil {
+		t.Fatal("AcquireAlso succeeded on a dead session")
+	}
+}
diff --git a/internal/database/postgres.go b/internal/database/postgres.go
index 3f96c529eb..1b8a313aca 100644
--- a/internal/database/postgres.go
+++ b/internal/database/postgres.go
@@ -7,6 +7,7 @@ import (
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgxpool"
 	"github.com/prairie-server/prairie-server/internal/config"
+	"github.com/prairie-server/prairie-server/internal/database/queryattr"
 	"github.com/prairie-server/prairie-server/internal/telemetry"
 )
 
@@ -32,9 +33,9 @@ func NewPoolForRole(ctx context.Context, cfg config.DatabaseConfig, role string)
 	if cfg.MaxConnections > 0 {
 		poolCfg.MaxConns = int32(cfg.MaxConnections)
 	}
-	poolCfg.AfterConnect = disableUnconfiguredJIT
+	poolCfg.AfterConnect = prepareConnection
 
-	poolCfg.ConnConfig.Tracer = postgresTracer{role: role}
+	poolCfg.ConnConfig.Tracer = postgresTracer{role: role, attribute: queryattr.Initialize()}
 	pool, err := pgxpool.NewWithConfig(ctx, poolCfg)
 	if err != nil {
 		return nil, fmt.Errorf("creating connection pool: %w", err)
@@ -49,6 +50,14 @@ func NewPoolForRole(ctx context.Context, cfg config.DatabaseConfig, role string)
 	return pool, nil
 }
 
+// prepareConnection sets up each new pool connection.
+func prepareConnection(ctx context.Context, conn *pgx.Conn) error {
+	if err := disableUnconfiguredJIT(ctx, conn); err != nil {
+		return err
+	}
+	return registerVectorTypes(ctx, conn)
+}
+
 // disableUnconfiguredJIT turns JIT off for the session unless something
 // already chose it: the server configuration, ALTER DATABASE or ROLE, or
 // DATABASE_URL, directly or through options. Prairie's queries are short reads the
diff --git a/internal/database/postgres_bench_test.go b/internal/database/postgres_bench_test.go
new file mode 100644
index 0000000000..2ccf088c5c
--- /dev/null
+++ b/internal/database/postgres_bench_test.go
@@ -0,0 +1,55 @@
+package database
+
+import (
+	"context"
+	"testing"
+
+	"github.com/jackc/pgx/v5"
+	"go.opentelemetry.io/otel"
+	sdktrace "go.opentelemetry.io/otel/sdk/trace"
+
+	"github.com/prairie-server/prairie-server/internal/database/queryattr"
+)
+
+func BenchmarkPostgresTracerQuery(b *testing.B) {
+	b.Setenv("PRAIRIE_QUERY_ATTRIBUTION_ENABLED", "true")
+	if !queryattr.Initialize() {
+		b.Fatal("attribution disabled, want enabled benchmark")
+	}
+	for _, scenario := range []struct {
+		name      string
+		attribute bool
+		sampler   sdktrace.Sampler
+	}{
+		{"coarse_only", false, sdktrace.NeverSample()},
+		{"unsampled", true, sdktrace.NeverSample()},
+		{"sampled", true, sdktrace.AlwaysSample()},
+	} {
+		b.Run(scenario.name, func(b *testing.B) {
+			provider := sdktrace.NewTracerProvider(sdktrace.WithSampler(scenario.sampler), sdktrace.WithSyncer(discardPostgresSpanExporter{}))
+			previous := otel.GetTracerProvider()
+			otel.SetTracerProvider(provider)
+			b.Cleanup(func() {
+				otel.SetTracerProvider(previous)
+				if err := provider.Shutdown(context.Background()); err != nil {
+					b.Errorf("shutdown tracer provider: %v", err)
+				}
+			})
+			tracer := postgresTracer{role: "checks", attribute: scenario.attribute}
+			ctx := context.Background()
+			data := pgx.TraceQueryStartData{SQL: "SELECT $1", Args: []any{1}}
+			b.ReportAllocs()
+			for b.Loop() {
+				query := tracer.TraceQueryStart(ctx, nil, data)
+				tracer.TraceQueryEnd(query, nil, pgx.TraceQueryEndData{})
+			}
+		})
+	}
+}
+
+type discardPostgresSpanExporter struct{}
+
+func (discardPostgresSpanExporter) ExportSpans(context.Context, []sdktrace.ReadOnlySpan) error {
+	return nil
+}
+func (discardPostgresSpanExporter) Shutdown(context.Context) error { return nil }
diff --git a/internal/database/postgres_metrics.go b/internal/database/postgres_metrics.go
index 8809bbb9ef..a01d9a96f9 100644
--- a/internal/database/postgres_metrics.go
+++ b/internal/database/postgres_metrics.go
@@ -4,19 +4,43 @@ import (
 	"context"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"weak"
 
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgxpool"
 	"github.com/prometheus/client_golang/prometheus"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/trace"
 
+	"github.com/prairie-server/prairie-server/internal/database/queryattr"
 	"github.com/prairie-server/prairie-server/internal/telemetry"
 )
 
 const postgresOperationOther = "other"
 
 type postgresTraceKey struct{ operation string }
-type postgresTracer struct{ role string }
+type postgresTracer struct {
+	role      string
+	attribute bool
+}
+
+type postgresTraceNode struct {
+	context.Context //nolint:containedctx // The trace node carries its parent context and owns operation state.
+	slot            string
+	finish          func(error)
+	// done makes completion run once: pgx v5.9.2 ends a batch twice after an
+	// early error (conn.go deferred end, then batch.go Close).
+	done atomic.Bool
+	op   queryattr.Op
+}
+
+func (n *postgresTraceNode) Value(key any) any {
+	if traceKey, ok := key.(postgresTraceKey); ok && traceKey.operation == n.slot {
+		return n
+	}
+	return n.Context.Value(key)
+}
 
 // The first token is deliberately allowlisted. Comments and CTEs are reported
 // as other/with; no SQL text, statement name, arguments or table names escape.
@@ -33,42 +57,65 @@ func queryOperation(sql string) string {
 	}
 }
 
-func (t postgresTracer) start(ctx context.Context, slot, operation string) context.Context {
+func (t postgresTracer) start(ctx context.Context, slot, operation string, op queryattr.Op) context.Context {
 	ctx, finish := telemetry.StartDependency(ctx, "postgres", t.role, operation)
-	return context.WithValue(ctx, postgresTraceKey{slot}, finish)
+	node := &postgresTraceNode{Context: ctx, slot: slot, finish: finish, op: op}
+	if span := trace.SpanFromContext(node); span.IsRecording() && op.Site() != "" {
+		span.SetAttributes(attribute.String("prairie.db.site", op.Site()), attribute.String("prairie.db.shape", op.Shape()))
+	}
+	return node
 }
 func endPostgres(ctx context.Context, slot string, err error) {
-	if finish, ok := ctx.Value(postgresTraceKey{slot}).(func(error)); ok {
-		finish(err)
+	node, ok := ctx.Value(postgresTraceKey{slot}).(*postgresTraceNode)
+	if !ok || !node.done.CompareAndSwap(false, true) {
+		return
 	}
+	node.finish(err)
+	node.op.End(ctx, err)
 }
 func (t postgresTracer) TraceQueryStart(ctx context.Context, _ *pgx.Conn, d pgx.TraceQueryStartData) context.Context {
-	return t.start(ctx, "query", queryOperation(d.SQL))
+	var op queryattr.Op
+	if t.attribute {
+		op = queryattr.Begin(ctx, queryattr.KindQuery, d.SQL, d.Args, 1)
+	}
+	return t.start(ctx, "query", queryOperation(d.SQL), op)
 }
 func (t postgresTracer) TraceQueryEnd(ctx context.Context, _ *pgx.Conn, d pgx.TraceQueryEndData) {
 	endPostgres(ctx, "query", d.Err)
 }
-func (t postgresTracer) TraceBatchStart(ctx context.Context, _ *pgx.Conn, _ pgx.TraceBatchStartData) context.Context {
-	return t.start(ctx, "batch", "batch")
+func (t postgresTracer) TraceBatchStart(ctx context.Context, _ *pgx.Conn, d pgx.TraceBatchStartData) context.Context {
+	var op queryattr.Op
+	if t.attribute {
+		op = queryattr.Begin(ctx, queryattr.KindBatch, "", nil, d.Batch.Len())
+	}
+	return t.start(ctx, "batch", "batch", op)
 }
 func (t postgresTracer) TraceBatchQuery(context.Context, *pgx.Conn, pgx.TraceBatchQueryData) {}
 func (t postgresTracer) TraceBatchEnd(ctx context.Context, _ *pgx.Conn, d pgx.TraceBatchEndData) {
 	endPostgres(ctx, "batch", d.Err)
 }
 func (t postgresTracer) TraceCopyFromStart(ctx context.Context, _ *pgx.Conn, _ pgx.TraceCopyFromStartData) context.Context {
-	return t.start(ctx, "copy", "copy")
+	var op queryattr.Op
+	if t.attribute {
+		op = queryattr.Begin(ctx, queryattr.KindCopy, "", nil, 1)
+	}
+	return t.start(ctx, "copy", "copy", op)
 }
 func (t postgresTracer) TraceCopyFromEnd(ctx context.Context, _ *pgx.Conn, d pgx.TraceCopyFromEndData) {
 	endPostgres(ctx, "copy", d.Err)
 }
 func (t postgresTracer) TraceConnectStart(ctx context.Context, _ pgx.TraceConnectStartData) context.Context {
-	return t.start(ctx, "connect", "connect")
+	return t.start(ctx, "connect", "connect", queryattr.Op{})
 }
 func (t postgresTracer) TraceConnectEnd(ctx context.Context, d pgx.TraceConnectEndData) {
 	endPostgres(ctx, "connect", d.Err)
 }
 func (t postgresTracer) TraceAcquireStart(ctx context.Context, _ *pgxpool.Pool, _ pgxpool.TraceAcquireStartData) context.Context {
-	return t.start(ctx, "acquire", "acquire")
+	var op queryattr.Op
+	if t.attribute {
+		op = queryattr.Begin(ctx, queryattr.KindAcquire, "", nil, 0)
+	}
+	return t.start(ctx, "acquire", "acquire", op)
 }
 func (t postgresTracer) TraceAcquireEnd(ctx context.Context, _ *pgxpool.Pool, d pgxpool.TraceAcquireEndData) {
 	endPostgres(ctx, "acquire", d.Err)
diff --git a/internal/database/postgres_metrics_test.go b/internal/database/postgres_metrics_test.go
index 235e6deaa4..f7dfab5856 100644
--- a/internal/database/postgres_metrics_test.go
+++ b/internal/database/postgres_metrics_test.go
@@ -2,15 +2,21 @@ package database
 
 import (
 	"context"
+	"errors"
+	"fmt"
+	"log/slog"
 	"strings"
 	"testing"
 	"time"
 
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/testutil"
+	"go.opentelemetry.io/otel/sdk/trace/tracetest"
 
 	"github.com/prairie-server/prairie-server/internal/config"
+	"github.com/prairie-server/prairie-server/internal/database/queryattr"
 	"github.com/prairie-server/prairie-server/internal/envutil"
 )
 
@@ -72,3 +78,181 @@ silo_postgres_pool_connections{role="checks",state="maximum"} 1
 		t.Fatalf("closed pool retained %d gauges", n)
 	}
 }
+
+func TestPostgresTracerAttributesOperations(t *testing.T) {
+	enablePostgresAttribution(t)
+	exporter := postgresSpanExporter(t)
+	tracer := postgresTracer{role: "checks", attribute: true}
+	ctx, request := queryattr.StartRequest(t.Context())
+	query := tracer.TraceQueryStart(ctx, nil, pgx.TraceQueryStartData{SQL: "SELECT $1", Args: []any{1}})
+	tracer.TraceQueryEnd(query, nil, pgx.TraceQueryEndData{})
+	batch := &pgx.Batch{}
+	batch.Queue("SELECT 1")
+	b := tracer.TraceBatchStart(ctx, nil, pgx.TraceBatchStartData{Batch: batch})
+	tracer.TraceBatchEnd(b, nil, pgx.TraceBatchEndData{})
+	c := tracer.TraceCopyFromStart(ctx, nil, pgx.TraceCopyFromStartData{})
+	tracer.TraceCopyFromEnd(c, nil, pgx.TraceCopyFromEndData{})
+	a := tracer.TraceAcquireStart(ctx, nil, pgxpool.TraceAcquireStartData{})
+	tracer.TraceAcquireEnd(a, nil, pgxpool.TraceAcquireEndData{Err: context.Canceled})
+	connect := tracer.TraceConnectStart(ctx, pgx.TraceConnectStartData{})
+	tracer.TraceConnectEnd(connect, pgx.TraceConnectEndData{})
+	attrs := postgresRequestAttrs(request)
+	if got := attrs["db_queries"]; got != uint64(3) {
+		t.Errorf("db_queries = %v, want 3", got)
+	}
+	if got, _ := attrs["db_acquire_wait_ns"].(uint64); got == 0 {
+		t.Error("db_acquire_wait_ns = 0, want positive failed-acquire wait")
+	}
+	spans := exporter.GetSpans()
+	if len(spans) != 5 {
+		t.Fatalf("ended spans = %d, want 5", len(spans))
+	}
+	for _, span := range spans {
+		attributed := span.Name != "postgres.acquire" && span.Name != "postgres.connect"
+		assertPostgresSpanAttribution(t, span, attributed)
+	}
+}
+
+func TestPostgresTracerDuplicateBatchEndCountsOnce(t *testing.T) {
+	enablePostgresAttribution(t)
+	for _, enabled := range []bool{false, true} {
+		t.Run(fmt.Sprintf("attribute=%t", enabled), func(t *testing.T) {
+			exporter := postgresSpanExporter(t)
+			logs := capturePostgresLogs(t)
+			flushPostgresSummary()
+			logs.Reset()
+			counter := postgresDependencyCounter(t, "batch", "error")
+			before := testutil.ToFloat64(counter)
+			ctx, request := queryattr.StartRequest(t.Context())
+			tracer := postgresTracer{role: "checks", attribute: enabled}
+			batch := &pgx.Batch{}
+			batch.Queue("SELECT 1")
+			b := tracer.TraceBatchStart(ctx, nil, pgx.TraceBatchStartData{Batch: batch})
+			end := pgx.TraceBatchEndData{Err: errors.New("batch failed")}
+			tracer.TraceBatchEnd(b, nil, end)
+			tracer.TraceBatchEnd(b, nil, end)
+			if delta := testutil.ToFloat64(counter) - before; delta != 1 {
+				t.Errorf("coarse batch ends = %g, want 1", delta)
+			}
+			spans := exporter.GetSpans()
+			if len(spans) != 1 {
+				t.Errorf("ended spans = %d, want 1", len(spans))
+			} else {
+				assertPostgresSpanAttribution(t, spans[0], enabled)
+			}
+			want := uint64(0)
+			if enabled {
+				want = 1
+			}
+			if got, present := postgresRequestAttrs(request)["db_queries"]; enabled {
+				if got != want {
+					t.Errorf("db_queries = %v, want %d", got, want)
+				}
+			} else if present {
+				t.Errorf("db_queries = %v, want field absent", got)
+			}
+			flushPostgresSummary()
+			if calls := postgresSummaryRowCalls(t, logs.Bytes(), "batch"); calls != want {
+				t.Errorf("unknown/batch row calls = %d, want %d", calls, want)
+			}
+		})
+	}
+}
+
+func TestPostgresTracerSurvivesPanickingLogSink(t *testing.T) {
+	enablePostgresAttribution(t)
+	exporter := postgresSpanExporter(t)
+	logs := capturePostgresLogs(t)
+	flushPostgresSummary()
+	logs.Reset()
+	counter := postgresDependencyCounter(t, "select", "success")
+	before := testutil.ToFloat64(counter)
+	tracer := postgresTracer{role: "checks", attribute: true}
+	ctx, request := queryattr.StartRequest(t.Context())
+	ctx = tracer.TraceQueryStart(ctx, nil, pgx.TraceQueryStartData{SQL: "SELECT $1", Args: make([]any, 1001)})
+	logger := slog.Default()
+	handler := &postgresPanicHandler{}
+	slog.SetDefault(slog.New(handler))
+	defer slog.SetDefault(logger)
+	tracer.TraceQueryEnd(ctx, nil, pgx.TraceQueryEndData{})
+	slog.SetDefault(logger)
+	if handler.calls != 1 {
+		t.Errorf("panicking sink calls = %d, want 1", handler.calls)
+	}
+	if delta := testutil.ToFloat64(counter) - before; delta != 1 {
+		t.Errorf("coarse query ends = %g, want 1", delta)
+	}
+	spans := exporter.GetSpans()
+	if len(spans) != 1 {
+		t.Fatalf("ended spans = %d, want 1", len(spans))
+	}
+	assertPostgresSpanAttribution(t, spans[0], true)
+	if got := postgresRequestAttrs(request)["db_queries"]; got != uint64(1) {
+		t.Errorf("db_queries = %v, want 1", got)
+	}
+	flushPostgresSummary()
+	if calls := postgresSummaryRowCalls(t, logs.Bytes(), ""); calls != 1 {
+		t.Errorf("unknown query row calls = %d, want 1", calls)
+	}
+}
+
+func postgresDependencyCounter(t *testing.T, operation, outcome string) prometheus.Counter {
+	t.Helper()
+	probe := prometheus.NewCounterVec(prometheus.CounterOpts{
+		Name: "silo_dependency_operations_total",
+		Help: "Dependency operations completed, including cancellation and timeout, by bounded category.",
+	}, []string{"dependency", "role", "operation", "outcome"})
+	var duplicate prometheus.AlreadyRegisteredError
+	if err := prometheus.DefaultRegisterer.Register(probe); !errors.As(err, &duplicate) {
+		if err == nil {
+			prometheus.DefaultRegisterer.Unregister(probe)
+		}
+		t.Fatalf("existing dependency collector lookup = %v, want AlreadyRegisteredError", err)
+	}
+	counter, ok := duplicate.ExistingCollector.(*prometheus.CounterVec)
+	if !ok {
+		t.Fatalf("dependency collector = %T, want *prometheus.CounterVec", duplicate.ExistingCollector)
+	}
+	return counter.WithLabelValues("postgres", "checks", operation, outcome)
+}
+
+func postgresRequestAttrs(request *queryattr.Request) map[string]any {
+	attrs := make(map[string]any)
+	for _, value := range request.LogAttrs() {
+		attr := value.(slog.Attr)
+		attrs[attr.Key] = attr.Value.Any()
+	}
+	return attrs
+}
+
+func assertPostgresSpanAttribution(t *testing.T, span tracetest.SpanStub, want bool) {
+	t.Helper()
+	attrs := make(map[string]string)
+	for _, attr := range span.Attributes {
+		attrs[string(attr.Key)] = attr.Value.AsString()
+	}
+	for _, key := range []string{"prairie.db.site", "prairie.db.shape"} {
+		value, present := attrs[key]
+		if present != want || (want && value == "") {
+			t.Errorf("span %s %s = %q (present=%t), want attributed=%t", span.Name, key, value, present, want)
+		}
+	}
+	if want && attrs["prairie.db.site"] != "unknown" {
+		t.Errorf("span %s site = %q, want unknown for database frames", span.Name, attrs["prairie.db.site"])
+	}
+	if want && (span.Name == "postgres.batch" || span.Name == "postgres.copy") {
+		if shape := strings.TrimPrefix(span.Name, "postgres."); attrs["prairie.db.shape"] != shape {
+			t.Errorf("span %s shape = %q, want %q", span.Name, attrs["prairie.db.shape"], shape)
+		}
+	}
+}
+
+type postgresPanicHandler struct{ calls int }
+
+func (*postgresPanicHandler) Enabled(context.Context, slog.Level) bool { return true }
+func (h *postgresPanicHandler) Handle(context.Context, slog.Record) error {
+	h.calls++
+	panic("log sink failed")
+}
+func (h *postgresPanicHandler) WithAttrs([]slog.Attr) slog.Handler { return h }
+func (h *postgresPanicHandler) WithGroup(string) slog.Handler      { return h }
diff --git a/internal/database/postgres_spans_test.go b/internal/database/postgres_spans_test.go
new file mode 100644
index 0000000000..637db16703
--- /dev/null
+++ b/internal/database/postgres_spans_test.go
@@ -0,0 +1,239 @@
+package database
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"log/slog"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
+	"github.com/prometheus/client_golang/prometheus"
+	dto "github.com/prometheus/client_model/go"
+	"go.opentelemetry.io/otel"
+	"go.opentelemetry.io/otel/attribute"
+	sdktrace "go.opentelemetry.io/otel/sdk/trace"
+	"go.opentelemetry.io/otel/sdk/trace/tracetest"
+
+	"github.com/prairie-server/prairie-server/internal/database/queryattr"
+)
+
+func TestQueryAttributionPrivacy(t *testing.T) {
+	enablePostgresAttribution(t)
+	exporter := postgresSpanExporter(t)
+	logs := capturePostgresLogs(t)
+	registry := prometheus.NewRegistry()
+	queryattr.RegisterMetrics(registry)
+	before := postgresSiteMetrics(t, registry)
+	tracer := postgresTracer{role: "checks", attribute: true}
+	ctx, request := queryattr.StartRequest(t.Context())
+	start := time.Now()
+
+	query := tracer.TraceQueryStart(ctx, nil, pgx.TraceQueryStartData{
+		SQL:  `SELECT 'PRIVATE_LITERAL', $$PRIVATE_DOLLAR$$, $1 FROM "PRIVATE_TABLE" /* PRIVATE_COMMENT */`,
+		Args: []any{"PRIVATE_ARGUMENT"},
+	})
+	tracer.TraceQueryEnd(query, nil, pgx.TraceQueryEndData{Err: errors.New("PRIVATE_ERROR")})
+	args := make([]string, 1001)
+	for i := range args {
+		args[i] = "PRIVATE_ARRAY_ELEMENT"
+	}
+	large := tracer.TraceQueryStart(ctx, nil, pgx.TraceQueryStartData{SQL: "SELECT $1", Args: []any{args}})
+	pgErr := &pgconn.PgError{Code: "23505", Message: "PRIVATE_MESSAGE", Detail: "PRIVATE_DETAIL", Hint: "PRIVATE_HINT"}
+	tracer.TraceQueryEnd(large, nil, pgx.TraceQueryEndData{Err: pgErr})
+	batch := &pgx.Batch{}
+	batch.Queue("SELECT 'PRIVATE_BATCH_SQL', $1", "PRIVATE_BATCH_ARGUMENT")
+	b := tracer.TraceBatchStart(ctx, nil, pgx.TraceBatchStartData{Batch: batch})
+	tracer.TraceBatchQuery(b, nil, pgx.TraceBatchQueryData{SQL: batch.QueuedQueries[0].SQL, Args: batch.QueuedQueries[0].Arguments, Err: pgErr})
+	tracer.TraceBatchEnd(b, nil, pgx.TraceBatchEndData{})
+	c := tracer.TraceCopyFromStart(ctx, nil, pgx.TraceCopyFromStartData{
+		TableName: pgx.Identifier{"PRIVATE_COPY_TABLE"}, ColumnNames: []string{"PRIVATE_COPY_COLUMN"},
+	})
+	tracer.TraceCopyFromEnd(c, nil, pgx.TraceCopyFromEndData{})
+	elapsed := time.Since(start).Seconds()
+	after := postgresSiteMetrics(t, registry)
+	if len(after) != 2 {
+		t.Errorf("attribution counter families = %d, want both queries and seconds", len(after))
+	}
+	if delta := after["prairie_postgres_queries_total"] - before["prairie_postgres_queries_total"]; delta != 4 {
+		t.Errorf("unknown queries delta = %g, want 4 completed operations", delta)
+	}
+	if delta := after["prairie_postgres_query_seconds_total"] - before["prairie_postgres_query_seconds_total"]; delta <= 0 || delta > elapsed {
+		t.Errorf("unknown seconds delta = %g, want > 0 and <= elapsed %g", delta, elapsed)
+	}
+
+	slog.InfoContext(ctx, "api request", request.LogAttrs()...)
+	flushPostgresSummary()
+	spans := exporter.GetSpans()
+	if len(spans) != 4 {
+		t.Errorf("ended spans = %d, want 4", len(spans))
+	}
+	for _, span := range spans {
+		assertPostgresSpanAttribution(t, span, true)
+	}
+	messages := make(map[string]int)
+	for _, line := range bytes.Split(bytes.TrimSpace(logs.Bytes()), []byte("\n")) {
+		var record map[string]any
+		if err := json.Unmarshal(line, &record); err != nil {
+			t.Fatalf("decode log line: %v", err)
+		}
+		message, _ := record["msg"].(string)
+		messages[message]++
+	}
+	if messages["api request"] != 1 || messages["slow or large database query"] < 1 || messages["database query summary"] != 1 {
+		t.Errorf("log messages = %v, want one request, at least one event, one summary", messages)
+	}
+	if hasPostgresPrivateSentinel(t, exporter.GetSpans()) {
+		t.Error("PRIVATE_ leak in encoded spans (names, attributes, events, or status)")
+	}
+	for name, gatherer := range map[string]prometheus.Gatherer{"private": registry, "default": prometheus.DefaultGatherer} {
+		families, err := gatherer.Gather()
+		if err != nil {
+			t.Fatalf("gather %s metrics: %v", name, err)
+		}
+		if hasPostgresPrivateSentinel(t, families) {
+			t.Errorf("PRIVATE_ leak in %s metrics", name)
+		}
+	}
+	if hasPostgresPrivateSentinel(t, logs.String()) {
+		t.Error("PRIVATE_ leak in emitted logs")
+	}
+
+	assertPostgresPrivacyControls(t, ctx, exporter, registry, logs)
+}
+
+// The same predicate must reject a real sentinel through each configured sink.
+func assertPostgresPrivacyControls(t *testing.T, ctx context.Context, exporter *tracetest.InMemoryExporter, registry *prometheus.Registry, logs *bytes.Buffer) {
+	t.Helper()
+	exporter.Reset()
+	_, control := otel.Tracer("privacy-control").Start(ctx, "PRIVATE_SPAN")
+	control.SetAttributes(attribute.String("control", "PRIVATE_ATTRIBUTE"))
+	control.End()
+	if !hasPostgresPrivateSentinel(t, exporter.GetSpans()) {
+		t.Error("privacy predicate accepted a planted span leak")
+	}
+	leak := prometheus.NewCounterVec(prometheus.CounterOpts{Name: "privacy_control_total", Help: "Privacy detector control."}, []string{"control"})
+	registry.MustRegister(leak)
+	leak.WithLabelValues("PRIVATE_LABEL").Inc()
+	families, err := registry.Gather()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !hasPostgresPrivateSentinel(t, families) {
+		t.Error("privacy predicate accepted a planted counter-label leak")
+	}
+	logs.Reset()
+	slog.InfoContext(ctx, "PRIVATE_LOG")
+	if !hasPostgresPrivateSentinel(t, logs.String()) {
+		t.Error("privacy predicate accepted a planted log leak")
+	}
+}
+
+func enablePostgresAttribution(t *testing.T) {
+	t.Helper()
+	t.Setenv("PRAIRIE_QUERY_ATTRIBUTION_ENABLED", "true")
+	if !queryattr.Initialize() {
+		t.Fatal("attribution disabled, want enabled fixture")
+	}
+}
+
+func postgresSpanExporter(t *testing.T) *tracetest.InMemoryExporter {
+	t.Helper()
+	exporter := tracetest.NewInMemoryExporter()
+	provider := sdktrace.NewTracerProvider(sdktrace.WithSampler(sdktrace.AlwaysSample()), sdktrace.WithSyncer(exporter))
+	previous := otel.GetTracerProvider()
+	otel.SetTracerProvider(provider)
+	t.Cleanup(func() {
+		otel.SetTracerProvider(previous)
+		if err := provider.Shutdown(context.Background()); err != nil {
+			t.Errorf("shutdown tracer provider: %v", err)
+		}
+	})
+	return exporter
+}
+
+func capturePostgresLogs(t *testing.T) *bytes.Buffer {
+	t.Helper()
+	logs := new(bytes.Buffer)
+	previous := slog.Default()
+	slog.SetDefault(slog.New(slog.NewJSONHandler(logs, nil)))
+	t.Cleanup(func() { slog.SetDefault(previous) })
+	return logs
+}
+
+func flushPostgresSummary() {
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	queryattr.RunSummary(ctx, "test-run", "test-build")
+}
+
+func postgresSummaryRowCalls(t *testing.T, data []byte, shape string) uint64 {
+	t.Helper()
+	var record struct {
+		TopCount map[string]struct {
+			Site  string `json:"site"`
+			Shape string `json:"shape"`
+			Calls uint64 `json:"calls"`
+		} `json:"top_count"`
+	}
+	if err := json.Unmarshal(bytes.TrimSpace(data), &record); err != nil {
+		t.Fatalf("decode summary: %v", err)
+	}
+	var calls uint64
+	for _, row := range record.TopCount {
+		if row.Site == "unknown" && (shape == "" || row.Shape == shape) {
+			calls += row.Calls
+		}
+	}
+	return calls
+}
+
+func postgresSiteMetrics(t *testing.T, gatherer prometheus.Gatherer) map[string]float64 {
+	t.Helper()
+	families, err := gatherer.Gather()
+	if err != nil {
+		t.Fatal(err)
+	}
+	values := make(map[string]float64)
+	for _, family := range families {
+		name := family.GetName()
+		if name != "prairie_postgres_queries_total" && name != "prairie_postgres_query_seconds_total" {
+			continue
+		}
+		if family.GetType() != dto.MetricType_COUNTER {
+			t.Errorf("%s type = %v, want COUNTER", name, family.GetType())
+		}
+		values[name] = 0
+		for _, metric := range family.GetMetric() {
+			labels := metric.GetLabel()
+			if len(labels) != 1 || labels[0].GetName() != "site" {
+				t.Errorf("%s labels = %v, want exactly site", name, labels)
+				continue
+			}
+			if labels[0].GetValue() == "unknown" {
+				values[name] = metric.GetCounter().GetValue()
+			}
+		}
+	}
+	// Empty CounterVec families are absent before the first operation.
+	if len(families) > 0 {
+		for _, name := range []string{"prairie_postgres_queries_total", "prairie_postgres_query_seconds_total"} {
+			if _, present := values[name]; !present {
+				t.Errorf("missing counter family %s", name)
+			}
+		}
+	}
+	return values
+}
+
+func hasPostgresPrivateSentinel(t *testing.T, value any) bool {
+	t.Helper()
+	encoded, err := json.Marshal(value)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return bytes.Contains(encoded, []byte("PRIVATE_"))
+}
diff --git a/internal/database/postgres_vector_test.go b/internal/database/postgres_vector_test.go
new file mode 100644
index 0000000000..fa4cedfa2d
--- /dev/null
+++ b/internal/database/postgres_vector_test.go
@@ -0,0 +1,169 @@
+package database
+
+import (
+	"context"
+	"fmt"
+	"net/url"
+	"os"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+	"github.com/pgvector/pgvector-go"
+
+	"github.com/prairie-server/prairie-server/internal/config"
+	"github.com/prairie-server/prairie-server/migrations"
+)
+
+// Pool connections move vectors in binary, every way Prairie's queries use them,
+// still connect to a database without the vector extension, and pick the
+// codecs up once the migrations create it. The test role needs CREATEDB.
+func TestNewPoolMovesVectorsInBinaryPostgres(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := t.Context()
+	pool, err := NewPoolForRole(ctx, config.DatabaseConfig{URL: dsn, MaxConnections: 1}, "application")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer ClosePool(pool)
+	want := pgvector.NewVector([]float32{0.5, -0.25, 0.001})
+
+	conn, err := pool.Acquire(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer conn.Release()
+	if _, err := conn.Exec(ctx, `CREATE TEMP TABLE vector_codec_test (id int PRIMARY KEY, embedding vector(3) NOT NULL)`); err != nil {
+		t.Fatal(err)
+	}
+	// Writes send pgvector.Vector values, as the embedding writers and the
+	// catalog seed import do.
+	if _, err := conn.Exec(ctx, `INSERT INTO vector_codec_test VALUES (1, $1), (2, $1)`, want); err != nil {
+		t.Fatal(err)
+	}
+
+	rows, err := conn.Query(ctx, `SELECT embedding FROM vector_codec_test ORDER BY id`)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if format := rows.FieldDescriptions()[0].Format; format != pgx.BinaryFormatCode {
+		rows.Close()
+		t.Fatalf("vector column format = %d, want binary", format)
+	}
+	got, err := pgx.CollectRows(rows, pgx.RowTo[pgvector.Vector])
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != 2 || !slices.Equal(got[0].Slice(), want.Slice()) || !slices.Equal(got[1].Slice(), want.Slice()) {
+		t.Fatalf("read back %v, want %v twice", got, want)
+	}
+
+	// Similarity queries pass the query embedding as a pgvector.HalfVector for
+	// their halfvec parameter, which goes in binary: 2 bytes a dimension.
+	halfvec, ok := conn.Conn().TypeMap().TypeForName("halfvec")
+	if !ok {
+		t.Fatal("halfvec is not registered")
+	}
+	encoded, err := conn.Conn().TypeMap().Encode(halfvec.OID, pgx.BinaryFormatCode, pgvector.NewHalfVector(want.Slice()), nil)
+	if err != nil || len(encoded) != 4+2*len(want.Slice()) {
+		t.Fatalf("binary halfvec parameter = %d bytes, %v; want %d", len(encoded), err, 4+2*len(want.Slice()))
+	}
+	var distance float64
+	if err := conn.QueryRow(ctx,
+		`SELECT embedding::halfvec(3) <=> $1::halfvec(3) FROM vector_codec_test WHERE id = 1`,
+		pgvector.NewHalfVector(want.Slice()),
+	).Scan(&distance); err != nil {
+		t.Fatal(err)
+	}
+	if distance > 1e-3 {
+		t.Fatalf("distance to itself = %v", distance)
+	}
+	half := pgvector.NewHalfVector([]float32{0.5, -0.25, 0.125})
+	var gotHalf pgvector.HalfVector
+	if err := conn.QueryRow(ctx, `SELECT $1::halfvec(3)`, half).Scan(&gotHalf); err != nil {
+		t.Fatal(err)
+	}
+	if !slices.Equal(gotHalf.Slice(), half.Slice()) {
+		t.Fatalf("halfvec read back %v, want %v", gotHalf, half)
+	}
+
+	// Taste profiles and clusters can hold a NULL embedding. Reading one into
+	// a vector is an error, as it was over text, not a panic in the decoder.
+	var null pgvector.Vector
+	if err := conn.QueryRow(ctx, `SELECT NULL::vector(3)`).Scan(&null); err == nil {
+		t.Fatal("scanning NULL into a vector succeeded")
+	}
+	var nullHalf pgvector.HalfVector
+	if err := conn.QueryRow(ctx, `SELECT NULL::halfvec(3)`).Scan(&nullHalf); err == nil {
+		t.Fatal("scanning NULL into a halfvec succeeded")
+	}
+	var optional *pgvector.Vector
+	if err := conn.QueryRow(ctx, `SELECT NULL::vector(3)`).Scan(&optional); err != nil || optional != nil {
+		t.Fatalf("scanning NULL into *pgvector.Vector = %v, %v; want nil", optional, err)
+	}
+
+	checkVectorCodecsOnNewDatabase(t, dsn)
+}
+
+// checkVectorCodecsOnNewDatabase checks that a pool connects to a new
+// database, which has no vector extension until its first migration, and that
+// every connection has the codecs once the migrations create it.
+func checkVectorCodecsOnNewDatabase(t *testing.T, dsn string) {
+	ctx := t.Context()
+	admin, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer admin.Close()
+	name := fmt.Sprintf("prairie_vector_%d", time.Now().UnixNano())
+	quoted := pgx.Identifier{name}.Sanitize()
+	if _, err := admin.Exec(ctx, "CREATE DATABASE "+quoted); err != nil {
+		t.Fatal(err)
+	}
+	defer func() {
+		if _, err := admin.Exec(context.Background(), "DROP DATABASE "+quoted+" WITH (FORCE)"); err != nil {
+			t.Error(err)
+		}
+	}()
+	u, err := url.Parse(dsn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	u.Path = "/" + name
+	empty, err := NewPoolForRole(ctx, config.DatabaseConfig{URL: u.String(), MaxConnections: 4}, "application")
+	if err != nil {
+		t.Fatalf("pool for a database without the vector extension: %v", err)
+	}
+	defer ClosePool(empty)
+	var installed bool
+	if err := empty.QueryRow(ctx, `SELECT to_regtype('vector') IS NOT NULL`).Scan(&installed); err != nil || installed {
+		t.Fatalf("new database has the vector type: %v, %v", installed, err)
+	}
+
+	// The first migration creates the extension. Every connection afterwards,
+	// including the one opened above, moves vectors in binary.
+	if err := RunMigrations(ctx, empty, migrations.FS, "sql"); err != nil {
+		t.Fatal(err)
+	}
+	var conns []*pgxpool.Conn
+	defer func() {
+		for _, c := range conns {
+			c.Release()
+		}
+	}()
+	for range empty.Config().MaxConns {
+		c, err := empty.Acquire(ctx)
+		if err != nil {
+			t.Fatal(err)
+		}
+		conns = append(conns, c)
+		if _, ok := c.Conn().TypeMap().TypeForName("vector"); !ok {
+			t.Fatalf("connection %d has no vector codec after migrating", len(conns))
+		}
+	}
+}
diff --git a/internal/database/push_attempt_key_migration.go b/internal/database/push_attempt_key_migration.go
new file mode 100644
index 0000000000..fcfc23cff1
--- /dev/null
+++ b/internal/database/push_attempt_key_migration.go
@@ -0,0 +1,79 @@
+package database
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/pressly/goose/v3"
+)
+
+// pushAttemptKeyScopeVersion first shipped as an SQL migration of the same
+// version; a deployment that applied that file skips this one.
+const pushAttemptKeyScopeVersion int64 = 20261012230946
+
+const (
+	// pushAttemptKey is the original at-most-once key over every attempt
+	// that names a delivery.
+	pushAttemptKey = "push_delivery_attempts_delivery_unique"
+	// pushAttemptDeliveryKey is the same key over delivery attempts only.
+	pushAttemptDeliveryKey = "push_delivery_attempts_delivery_trigger_unique"
+	pushAttemptKeyColumns  = "push_delivery_attempts (push_device_id, notification_delivery_id, attempt_number)"
+)
+
+// pushAttemptKeyScopeMigration scopes push_delivery_attempts' at-most-once key
+// to delivery attempts. An administrator test push carries the target
+// profile's newest notification, so a test attempt names a real delivery and
+// can share its (device, delivery, attempt number) with that delivery's own
+// attempt and with earlier tests. The key only ever guarded fanout's enqueue.
+//
+// A Go migration for the reason invalidIndexRebuildMigration is: a retry must
+// keep an index an earlier attempt built. goose records the version only after
+// every statement has run, so an attempt that dropped the old key but was not
+// recorded runs again, and dropping the replacement then would leave the table
+// with neither key while it was rebuilt.
+func pushAttemptKeyScopeMigration() *goose.Migration {
+	m := goose.NewGoMigration(
+		pushAttemptKeyScopeVersion,
+		&goose.GoFunc{RunDB: func(ctx context.Context, db *sql.DB) error {
+			return scopePushAttemptKey(ctx, db, "public")
+		}},
+		&goose.GoFunc{RunDB: func(ctx context.Context, db *sql.DB) error {
+			return widenPushAttemptKey(ctx, db, "public")
+		}},
+	)
+	m.Source = fmt.Sprintf("%d_scope_push_attempt_key_to_deliveries.go", pushAttemptKeyScopeVersion)
+	return m
+}
+
+// scopePushAttemptKey replaces the old key with the delivery-only one.
+func scopePushAttemptKey(ctx context.Context, db *sql.DB, schema string) error {
+	return swapPushAttemptKey(ctx, db, schema, pushAttemptDeliveryKey, "trigger_type = 'delivery'", pushAttemptKey)
+}
+
+// widenPushAttemptKey restores the old key. It cannot hold test attempts
+// beside a delivery's own, so they are detached from their deliveries first;
+// their history rows remain.
+func widenPushAttemptKey(ctx context.Context, db *sql.DB, schema string) error {
+	if _, err := db.ExecContext(ctx, `UPDATE `+pgx.Identifier{schema}.Sanitize()+`.push_delivery_attempts
+		SET notification_delivery_id = NULL
+		WHERE trigger_type = 'test' AND notification_delivery_id IS NOT NULL`); err != nil {
+		return fmt.Errorf("detaching test push attempts: %w", err)
+	}
+	return swapPushAttemptKey(ctx, db, schema, pushAttemptKey, "notification_delivery_id IS NOT NULL", pushAttemptDeliveryKey)
+}
+
+// swapPushAttemptKey builds the key named keep, over the rows predicate
+// selects, before dropping the key named drop, so fanout is never without one.
+func swapPushAttemptKey(ctx context.Context, db *sql.DB, schema, keep, predicate, drop string) error {
+	quotedSchema := pgx.Identifier{schema}.Sanitize()
+	if err := ensureIndexConcurrently(ctx, db, quotedSchema+"."+keep, fmt.Sprintf(
+		"CREATE UNIQUE INDEX CONCURRENTLY %s ON %s.%s WHERE %s", keep, quotedSchema, pushAttemptKeyColumns, predicate)); err != nil {
+		return err
+	}
+	if _, err := db.ExecContext(ctx, "DROP INDEX CONCURRENTLY IF EXISTS "+quotedSchema+"."+drop); err != nil {
+		return fmt.Errorf("dropping %s: %w", drop, err)
+	}
+	return nil
+}
diff --git a/internal/database/push_attempt_key_migration_test.go b/internal/database/push_attempt_key_migration_test.go
new file mode 100644
index 0000000000..77744311eb
--- /dev/null
+++ b/internal/database/push_attempt_key_migration_test.go
@@ -0,0 +1,111 @@
+package database
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
+	"github.com/jackc/pgx/v5/stdlib"
+)
+
+// goose records the push attempt key migration only after its last statement,
+// so a run that stopped there runs again. Each direction must recover an
+// interrupted build and, on a retry, keep the key it already built rather than
+// leave the table with neither key while rebuilding it.
+func TestPushAttemptKeyMigrationRetriesKeepTheBuiltKeyPostgres(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := t.Context()
+	config, err := pgx.ParseConfig(dsn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	db := stdlib.OpenDB(*config)
+	t.Cleanup(func() { _ = db.Close() })
+	schema := fmt.Sprintf("push_attempt_key_%d", time.Now().UnixNano())
+	exec := func(query string) {
+		t.Helper()
+		if _, err := db.ExecContext(ctx, query); err != nil {
+			t.Fatal(err)
+		}
+	}
+	exec("CREATE SCHEMA " + schema)
+	t.Cleanup(func() {
+		if _, err := db.ExecContext(context.Background(), "DROP SCHEMA "+schema+" CASCADE"); err != nil {
+			t.Error(err)
+		}
+	})
+	exec("CREATE TABLE " + schema + `.push_delivery_attempts (id text PRIMARY KEY, notification_delivery_id text,
+		push_device_id text NOT NULL, trigger_type text NOT NULL, attempt_number integer NOT NULL)`)
+	exec("INSERT INTO " + schema + ".push_delivery_attempts VALUES ('own', 'delivery-1', 'device', 'delivery', 1), ('other', 'delivery-2', 'device', 'delivery', 1)")
+	exec("CREATE UNIQUE INDEX " + pushAttemptKey + " ON " + schema + "." + pushAttemptKeyColumns + " WHERE notification_delivery_id IS NOT NULL")
+	// An earlier attempt stopped mid-build and left an invalid copy of the
+	// new key beside the old one.
+	_, err = db.ExecContext(ctx, "CREATE UNIQUE INDEX CONCURRENTLY "+pushAttemptDeliveryKey+" ON "+schema+".push_delivery_attempts (push_device_id)")
+	if pgErr, ok := errors.AsType[*pgconn.PgError](err); !ok || pgErr.Code != "23505" {
+		t.Fatalf("expected failed concurrent build, got %v", err)
+	}
+
+	type index struct {
+		oid        uint32
+		valid      bool
+		definition string
+	}
+	lookup := func(name string) index {
+		t.Helper()
+		var got index
+		if err := db.QueryRowContext(ctx, `SELECT coalesce(to_regclass($1)::oid, 0),
+			coalesce((SELECT indisvalid FROM pg_index WHERE indexrelid = to_regclass($1)), false),
+			coalesce(pg_get_indexdef(to_regclass($1)), '')`, schema+"."+name).Scan(&got.oid, &got.valid, &got.definition); err != nil {
+			t.Fatal(err)
+		}
+		return got
+	}
+	expect := func(step string, kept, gone, predicate string) index {
+		t.Helper()
+		key := lookup(kept)
+		if !key.valid || !strings.HasPrefix(key.definition, "CREATE UNIQUE INDEX") || !strings.Contains(key.definition, predicate) {
+			t.Fatalf("%s: %s = %+v, want a valid unique index %s", step, kept, key, predicate)
+		}
+		if lookup(gone).oid != 0 {
+			t.Fatalf("%s: %s still exists", step, gone)
+		}
+		return key
+	}
+
+	if err := scopePushAttemptKey(ctx, db, schema); err != nil {
+		t.Fatal(err)
+	}
+	scoped := expect("up", pushAttemptDeliveryKey, pushAttemptKey, "WHERE (trigger_type = 'delivery'::text)")
+	if err := scopePushAttemptKey(ctx, db, schema); err != nil {
+		t.Fatal(err)
+	}
+	if again := expect("up retry", pushAttemptDeliveryKey, pushAttemptKey, "trigger_type"); again.oid != scoped.oid {
+		t.Fatal("up retry rebuilt the key the first run built")
+	}
+
+	// A test attempt carrying a delivery shares the delivery's own key.
+	exec("INSERT INTO " + schema + ".push_delivery_attempts VALUES ('test', 'delivery-1', 'device', 'test', 1)")
+	if err := widenPushAttemptKey(ctx, db, schema); err != nil {
+		t.Fatal(err)
+	}
+	widened := expect("down", pushAttemptKey, pushAttemptDeliveryKey, "WHERE (notification_delivery_id IS NOT NULL)")
+	if err := widenPushAttemptKey(ctx, db, schema); err != nil {
+		t.Fatal(err)
+	}
+	if again := expect("down retry", pushAttemptKey, pushAttemptDeliveryKey, "notification_delivery_id IS NOT NULL"); again.oid != widened.oid {
+		t.Fatal("down retry rebuilt the key the first run built")
+	}
+	var detached bool
+	if err := db.QueryRowContext(ctx, "SELECT notification_delivery_id IS NULL FROM "+schema+".push_delivery_attempts WHERE id = 'test'").Scan(&detached); err != nil || !detached {
+		t.Fatalf("down kept the test attempt on its delivery (err %v)", err)
+	}
+}
diff --git a/internal/database/queryattr/bench_test.go b/internal/database/queryattr/bench_test.go
new file mode 100644
index 0000000000..348e7a6334
--- /dev/null
+++ b/internal/database/queryattr/bench_test.go
@@ -0,0 +1,340 @@
+package queryattr
+
+import (
+	"context"
+	"fmt"
+	"testing"
+)
+
+func BenchmarkOp(b *testing.B) {
+	old := enabled.Load()
+	b.Cleanup(func() { enabled.Store(old) })
+	ctx := context.Background()
+	for _, name := range []string{"off", "cached", "first_seen", "parallel", "largest_miss"} {
+		b.Run(name, func(b *testing.B) {
+			enabled.Store(name != "off")
+			sites.Clear()
+			pcs.Clear()
+			shapeCache.Clear()
+			shapeCacheSize.Store(0)
+			warm := Begin(ctx, KindQuery, "SELECT 1", nil, 1)
+			warm.End(ctx, nil)
+			b.ReportAllocs()
+			b.ResetTimer()
+			if name == "parallel" {
+				b.RunParallel(func(pb *testing.PB) {
+					for pb.Next() {
+						op := Begin(ctx, KindQuery, "SELECT 1", nil, 1)
+						op.End(ctx, nil)
+					}
+				})
+				return
+			}
+			for i := 0; i < b.N; i++ {
+				sql := "SELECT 1"
+				if name == "first_seen" {
+					sql = fmt.Sprintf("SELECT %d", i)
+				}
+				if name == "largest_miss" {
+					shapeCache.Clear()
+					shapeCacheSize.Store(0)
+					sql = largestSQL
+				}
+				op := Begin(ctx, KindQuery, sql, nil, 1)
+				op.End(ctx, nil)
+			}
+		})
+	}
+}
+
+// largestSQL is the expanded PostgreSQL statement from
+// metadata.(*ImageCacheJobRepository).enqueueArtworkRepair in
+// internal/metadata/image_cache_job_repo.go. Its 6,845-byte literal is the
+// longest pgx-bound SQL literal under internal/; the item-only branches and
+// non-provider schemes are expanded as at the production Query call.
+const largestSQL = `
+		WITH all_candidates AS (
+			SELECT
+				'poster'::text AS image_type,
+				'item'::text AS target_type,
+				mi.content_id AS target_content_id,
+				''::text AS target_language,
+				mi.content_id AS series_id,
+				mi.poster_source_path AS source_path,
+				mi.type AS content_type,
+				NULL::integer AS season_number,
+				NULL::integer AS episode_number,
+				mi.tmdb_id,
+				mi.tvdb_id,
+				mi.imdb_id
+			FROM media_items mi
+			WHERE mi.poster_source_path LIKE '%://%'
+			  AND lower(mi.poster_source_path) NOT LIKE ALL (ARRAY['s3://%', 'file://%', 'nfo+%', 'local://%', 'upload://%', 'generated://%'])
+			  AND ((cardinality($2::text[]) = 0 AND (mi.poster_path LIKE '%://%' OR coalesce(mi.poster_path, '') = '')) OR mi.poster_path = ANY($2))
+			UNION ALL
+			SELECT
+				'backdrop'::text,
+				'item'::text,
+				mi.content_id,
+				''::text,
+				mi.content_id,
+				mi.backdrop_source_path,
+				mi.type,
+				NULL::integer,
+				NULL::integer,
+				mi.tmdb_id,
+				mi.tvdb_id,
+				mi.imdb_id
+			FROM media_items mi
+			WHERE mi.backdrop_source_path LIKE '%://%'
+			  AND lower(mi.backdrop_source_path) NOT LIKE ALL (ARRAY['s3://%', 'file://%', 'nfo+%', 'local://%', 'upload://%', 'generated://%'])
+			  AND ((cardinality($2::text[]) = 0 AND (mi.backdrop_path LIKE '%://%' OR coalesce(mi.backdrop_path, '') = '')) OR mi.backdrop_path = ANY($2))
+			UNION ALL
+			SELECT
+				'logo'::text,
+				'item'::text,
+				mi.content_id,
+				''::text,
+				mi.content_id,
+				mi.logo_source_path,
+				mi.type,
+				NULL::integer,
+				NULL::integer,
+				mi.tmdb_id,
+				mi.tvdb_id,
+				mi.imdb_id
+			FROM media_items mi
+			WHERE mi.logo_source_path LIKE '%://%'
+			  AND lower(mi.logo_source_path) NOT LIKE ALL (ARRAY['s3://%', 'file://%', 'nfo+%', 'local://%', 'upload://%', 'generated://%'])
+			  AND ((cardinality($2::text[]) = 0 AND (mi.logo_path LIKE '%://%' OR coalesce(mi.logo_path, '') = '')) OR mi.logo_path = ANY($2))
+			UNION ALL
+			SELECT
+				'poster'::text,
+				'item_localization'::text,
+				loc.content_id,
+				loc.language,
+				loc.content_id,
+				loc.poster_source_path,
+				mi.type,
+				NULL::integer,
+				NULL::integer,
+				mi.tmdb_id,
+				mi.tvdb_id,
+				mi.imdb_id
+			FROM media_item_localizations loc
+			JOIN media_items mi ON mi.content_id = loc.content_id
+			WHERE loc.poster_source_path LIKE '%://%'
+			  AND lower(loc.poster_source_path) NOT LIKE ALL (ARRAY['s3://%', 'file://%', 'nfo+%', 'local://%', 'upload://%', 'generated://%'])
+			  AND ((cardinality($2::text[]) = 0 AND (loc.poster_path LIKE '%://%' OR coalesce(loc.poster_path, '') = '')) OR loc.poster_path = ANY($2))
+			UNION ALL
+			SELECT
+				'backdrop'::text,
+				'item_localization'::text,
+				loc.content_id,
+				loc.language,
+				loc.content_id,
+				loc.backdrop_source_path,
+				mi.type,
+				NULL::integer,
+				NULL::integer,
+				mi.tmdb_id,
+				mi.tvdb_id,
+				mi.imdb_id
+			FROM media_item_localizations loc
+			JOIN media_items mi ON mi.content_id = loc.content_id
+			WHERE loc.backdrop_source_path LIKE '%://%'
+			  AND lower(loc.backdrop_source_path) NOT LIKE ALL (ARRAY['s3://%', 'file://%', 'nfo+%', 'local://%', 'upload://%', 'generated://%'])
+			  AND ((cardinality($2::text[]) = 0 AND (loc.backdrop_path LIKE '%://%' OR coalesce(loc.backdrop_path, '') = '')) OR loc.backdrop_path = ANY($2))
+			UNION ALL
+			SELECT
+				'logo'::text,
+				'item_localization'::text,
+				loc.content_id,
+				loc.language,
+				loc.content_id,
+				loc.logo_source_path,
+				mi.type,
+				NULL::integer,
+				NULL::integer,
+				mi.tmdb_id,
+				mi.tvdb_id,
+				mi.imdb_id
+			FROM media_item_localizations loc
+			JOIN media_items mi ON mi.content_id = loc.content_id
+			WHERE loc.logo_source_path LIKE '%://%'
+			  AND lower(loc.logo_source_path) NOT LIKE ALL (ARRAY['s3://%', 'file://%', 'nfo+%', 'local://%', 'upload://%', 'generated://%'])
+			  AND ((cardinality($2::text[]) = 0 AND (loc.logo_path LIKE '%://%' OR coalesce(loc.logo_path, '') = '')) OR loc.logo_path = ANY($2))
+			UNION ALL
+			SELECT
+				'poster'::text,
+				'season'::text,
+				s.content_id AS target_content_id,
+				''::text AS target_language,
+				s.series_id,
+				s.poster_source_path AS source_path,
+				'series'::text AS content_type,
+				s.season_number,
+				NULL::integer AS episode_number,
+				mi.tmdb_id,
+				mi.tvdb_id,
+				mi.imdb_id
+			FROM seasons s
+			JOIN media_items mi ON mi.content_id = s.series_id
+			WHERE s.poster_source_path LIKE '%://%'
+			  AND lower(s.poster_source_path) NOT LIKE ALL (ARRAY['s3://%', 'file://%', 'nfo+%', 'local://%', 'upload://%', 'generated://%'])
+			  AND ((cardinality($2::text[]) = 0 AND (s.poster_path LIKE '%://%' OR coalesce(s.poster_path, '') = '')) OR s.poster_path = ANY($2))
+			UNION ALL
+			SELECT
+				'poster'::text,
+				'season_localization'::text,
+				s.content_id,
+				loc.language,
+				s.series_id,
+				loc.poster_source_path,
+				'series'::text,
+				s.season_number,
+				NULL::integer,
+				mi.tmdb_id,
+				mi.tvdb_id,
+				mi.imdb_id
+			FROM season_localizations loc
+			JOIN seasons s ON s.content_id = loc.season_content_id
+			JOIN media_items mi ON mi.content_id = s.series_id
+			WHERE loc.poster_source_path LIKE '%://%'
+			  AND lower(loc.poster_source_path) NOT LIKE ALL (ARRAY['s3://%', 'file://%', 'nfo+%', 'local://%', 'upload://%', 'generated://%'])
+			  AND ((cardinality($2::text[]) = 0 AND (loc.poster_path LIKE '%://%' OR coalesce(loc.poster_path, '') = '')) OR loc.poster_path = ANY($2))
+			UNION ALL
+			SELECT
+				'still'::text,
+				'episode'::text,
+				e.content_id,
+				''::text,
+				e.series_id,
+				e.still_source_path,
+				'series'::text,
+				e.season_number,
+				e.episode_number,
+				mi.tmdb_id,
+				mi.tvdb_id,
+				mi.imdb_id
+			FROM episodes e
+			JOIN media_items mi ON mi.content_id = e.series_id
+			WHERE e.still_source_path LIKE '%://%'
+			  AND lower(e.still_source_path) NOT LIKE ALL (ARRAY['s3://%', 'file://%', 'nfo+%', 'local://%', 'upload://%', 'generated://%'])
+			  AND ((cardinality($2::text[]) = 0 AND (e.still_path LIKE '%://%' OR coalesce(e.still_path, '') = '')) OR e.still_path = ANY($2))
+			UNION ALL
+			SELECT
+				'profile'::text,
+				'person'::text,
+				p.id::text,
+				''::text,
+				''::text,
+				p.photo_source_path,
+				'people'::text,
+				NULL::integer,
+				NULL::integer,
+				p.tmdb_id,
+				p.tvdb_id,
+				p.imdb_id
+			FROM people p
+			WHERE p.photo_source_path LIKE '%://%'
+			  AND lower(p.photo_source_path) NOT LIKE ALL (ARRAY['s3://%', 'file://%', 'nfo+%', 'local://%', 'upload://%', 'generated://%'])
+			  AND ((cardinality($2::text[]) = 0 AND (p.photo_path LIKE '%://%' OR coalesce(p.photo_path, '') = '')) OR p.photo_path = ANY($2))
+			UNION ALL
+			SELECT
+				'banner'::text,
+				'item'::text,
+				mi.content_id,
+				''::text,
+				mi.content_id,
+				mi.banner_source_path,
+				mi.type,
+				NULL::integer,
+				NULL::integer,
+				mi.tmdb_id,
+				mi.tvdb_id,
+				mi.imdb_id
+			FROM media_items mi
+			WHERE mi.banner_source_path LIKE '%://%'
+			  AND lower(mi.banner_source_path) NOT LIKE ALL (ARRAY['s3://%', 'file://%', 'nfo+%', 'local://%', 'upload://%', 'generated://%'])
+			  AND ((cardinality($2::text[]) = 0 AND (mi.banner_path LIKE '%://%' OR mi.banner_path = '')) OR (mi.banner_path = ANY($2) AND mi.banner_path <> ''))
+			UNION ALL
+			SELECT
+				'thumb'::text,
+				'item'::text,
+				mi.content_id,
+				''::text,
+				mi.content_id,
+				mi.thumb_source_path,
+				mi.type,
+				NULL::integer,
+				NULL::integer,
+				mi.tmdb_id,
+				mi.tvdb_id,
+				mi.imdb_id
+			FROM media_items mi
+			WHERE mi.thumb_source_path LIKE '%://%'
+			  AND lower(mi.thumb_source_path) NOT LIKE ALL (ARRAY['s3://%', 'file://%', 'nfo+%', 'local://%', 'upload://%', 'generated://%'])
+			  AND ((cardinality($2::text[]) = 0 AND (mi.thumb_path LIKE '%://%' OR mi.thumb_path = '')) OR (mi.thumb_path = ANY($2) AND mi.thumb_path <> ''))
+			UNION ALL
+			SELECT
+				'clearart'::text,
+				'item'::text,
+				mi.content_id,
+				''::text,
+				mi.content_id,
+				mi.clearart_source_path,
+				mi.type,
+				NULL::integer,
+				NULL::integer,
+				mi.tmdb_id,
+				mi.tvdb_id,
+				mi.imdb_id
+			FROM media_items mi
+			WHERE mi.clearart_source_path LIKE '%://%'
+			  AND lower(mi.clearart_source_path) NOT LIKE ALL (ARRAY['s3://%', 'file://%', 'nfo+%', 'local://%', 'upload://%', 'generated://%'])
+			  AND ((cardinality($2::text[]) = 0 AND (mi.clearart_path LIKE '%://%' OR mi.clearart_path = '')) OR (mi.clearart_path = ANY($2) AND mi.clearart_path <> ''))
+			UNION ALL
+			SELECT
+				'disc'::text,
+				'item'::text,
+				mi.content_id,
+				''::text,
+				mi.content_id,
+				mi.disc_source_path,
+				mi.type,
+				NULL::integer,
+				NULL::integer,
+				mi.tmdb_id,
+				mi.tvdb_id,
+				mi.imdb_id
+			FROM media_items mi
+			WHERE mi.disc_source_path LIKE '%://%'
+			  AND lower(mi.disc_source_path) NOT LIKE ALL (ARRAY['s3://%', 'file://%', 'nfo+%', 'local://%', 'upload://%', 'generated://%'])
+			  AND ((cardinality($2::text[]) = 0 AND (mi.disc_path LIKE '%://%' OR mi.disc_path = '')) OR (mi.disc_path = ANY($2) AND mi.disc_path <> ''))
+		),
+		candidates AS (
+			SELECT ac.*
+			FROM all_candidates ac
+			LEFT JOIN metadata_image_cache_jobs j
+			  ON j.target_type = ac.target_type
+			 AND j.target_content_id = ac.target_content_id
+			 AND j.image_type = ac.image_type
+			 AND j.target_language = ac.target_language
+			WHERE j.id IS NULL
+			   OR j.source_path IS DISTINCT FROM ac.source_path
+			   OR j.status = 'succeeded'
+			   OR (
+				   j.status = 'failed'
+				   AND j.next_attempt_at <= NOW()
+			   )
+			ORDER BY ac.target_type, ac.target_content_id, ac.target_language, ac.image_type
+			LIMIT $1
+		)
+		SELECT image_type, target_type, target_content_id, target_language, series_id, source_path,
+		       content_type, season_number, episode_number,
+		       COALESCE(tmdb_id, '') AS tmdb_id,
+		       COALESCE(tvdb_id, '') AS tvdb_id,
+		       COALESCE(imdb_id, '') AS imdb_id
+		FROM candidates
+	`
diff --git a/internal/database/queryattr/detach_test.go b/internal/database/queryattr/detach_test.go
new file mode 100644
index 0000000000..b05032f82c
--- /dev/null
+++ b/internal/database/queryattr/detach_test.go
@@ -0,0 +1,35 @@
+package queryattr
+
+import (
+	"context"
+	"testing"
+	"time"
+)
+
+func TestDetachHidesRequest(t *testing.T) {
+	setup(t)
+	type key struct{}
+	base, cancel := context.WithCancel(context.WithValue(context.Background(), key{}, "kept"))
+	defer cancel()
+	ctx, r := StartRequest(base)
+	detached := Detach(ctx)
+	op := namedOp(detached, "a", "x")
+	op.end(detached, nil, 1, time.Time{})
+	if attrs := r.LogAttrs(); len(attrs) != 0 {
+		t.Errorf("LogAttrs = %v, want no attributes after detached work", attrs)
+	}
+	if op.row.calls.Load() != 1 {
+		t.Errorf("row calls = %d, want 1", op.row.calls.Load())
+	}
+	_, fresh := StartRequest(detached)
+	if r == nil || fresh == nil || fresh == r {
+		t.Error("detached StartRequest must create a new request")
+	}
+	if detached.Value(key{}) != "kept" {
+		t.Error("Detach lost context value")
+	}
+	cancel()
+	if detached.Err() != context.Canceled {
+		t.Errorf("Detach Err = %v, want canceled", detached.Err())
+	}
+}
diff --git a/internal/database/queryattr/events.go b/internal/database/queryattr/events.go
new file mode 100644
index 0000000000..8156d5f54c
--- /dev/null
+++ b/internal/database/queryattr/events.go
@@ -0,0 +1,50 @@
+package queryattr
+
+import (
+	"context"
+	"log/slog"
+	"sync/atomic"
+	"time"
+
+	"golang.org/x/time/rate"
+
+	"github.com/prairie-server/prairie-server/internal/telemetry"
+)
+
+const (
+	eventInterval   = time.Second
+	eventBurst      = 10
+	eventCauseSlow  = "slow"
+	eventCauseLarge = "large"
+)
+
+var eventLimiter = rate.NewLimiter(rate.Every(eventInterval), eventBurst)
+var suppressedTotal, pending atomic.Uint64
+
+func (o *Op) event(ctx context.Context, err error, ns int64, now time.Time, inRequest bool) {
+	if o.quiet {
+		return
+	}
+	slow := ns > int64(100*time.Millisecond)
+	large := o.args > 1000 || o.maxArray > 1000 || o.kind == KindBatch && o.statements > 100
+	var cause string
+	switch {
+	case slow && large:
+		cause = eventCauseSlow + "," + eventCauseLarge
+	case slow:
+		cause = eventCauseSlow
+	case large:
+		cause = eventCauseLarge
+	default:
+		return
+	}
+	if !eventLimiter.AllowN(now, 1) {
+		suppressedTotal.Add(1)
+		pending.Add(1)
+		return
+	}
+	write(ctx, slog.LevelInfo, "slow or large database query",
+		slog.String("component", "database"), slog.String("cause", cause), slog.String(siteLabel, o.Site()), slog.String("shape", o.Shape()),
+		slog.Int64("ns", ns), slog.Int("statements", o.statements), slog.Int("args", o.args), slog.Int("max_array", o.maxArray),
+		slog.String("outcome", telemetry.Outcome(err)), slog.Bool("request", inRequest), slog.Uint64("suppressed", pending.Swap(0)))
+}
diff --git a/internal/database/queryattr/events_test.go b/internal/database/queryattr/events_test.go
new file mode 100644
index 0000000000..6892d60436
--- /dev/null
+++ b/internal/database/queryattr/events_test.go
@@ -0,0 +1,151 @@
+package queryattr
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgtype"
+	"golang.org/x/time/rate"
+)
+
+func resetEvents() {
+	eventLimiter = rate.NewLimiter(rate.Every(eventInterval), eventBurst)
+	suppressedTotal.Store(0)
+	pending.Store(0)
+}
+func TestEventThresholds(t *testing.T) {
+	cases := []struct {
+		name       string
+		ns         int64
+		args       []any
+		kind       Kind
+		statements int
+		cause      string
+	}{
+		{"slow_equal", int64(100 * time.Millisecond), nil, KindQuery, 1, ""},
+		{"slow_above", int64(100*time.Millisecond) + 1, nil, KindQuery, 1, "slow"},
+		{"args_equal", 1, make([]any, 1000), KindQuery, 1, ""}, {"args_above", 1, make([]any, 1001), KindQuery, 1, "large"},
+		{"array_equal", 1, []any{make([]int, 1000)}, KindQuery, 1, ""}, {"array_above", 1, []any{make([]int, 1001)}, KindQuery, 1, "large"},
+		{"batch_equal", 1, nil, KindBatch, 100, ""}, {"batch_above", 1, nil, KindBatch, 101, "large"},
+		{"both", int64(time.Second), make([]any, 1001), KindQuery, 1, "slow,large"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			setup(t)
+			resetEvents()
+			buf := capture(t)
+			ctx := context.Background()
+			op := Begin(ctx, tc.kind, "SELECT 1", tc.args, tc.statements)
+			op.end(ctx, nil, tc.ns, time.Unix(100, 0))
+			lines := logLines(t, buf)
+			want := 0
+			if tc.cause != "" {
+				want = 1
+			}
+			if len(lines) != want {
+				t.Fatalf("events = %d, want %d", len(lines), want)
+			}
+			if want == 1 {
+				requireAttr(t, lines[0], "cause", tc.cause)
+			}
+		})
+	}
+}
+func TestEventFields(t *testing.T) {
+	setup(t)
+	resetEvents()
+	buf := capture(t)
+	ctx, _ := StartRequest(context.Background())
+	op := Begin(ctx, KindQuery, "SELECT 1", []any{[]string{"value"}, pgtype.Int4{Int32: 1, Valid: true}}, 7)
+	op.end(ctx, context.Canceled, int64(100*time.Millisecond)+1, time.Unix(100, 0))
+	lines := logLines(t, buf)
+	if len(lines) != 1 {
+		t.Fatalf("events = %d, want 1", len(lines))
+	}
+	m := lines[0]
+	for k, v := range map[string]any{"msg": "slow or large database query", "level": "INFO", "component": "database", "cause": "slow", "max_array": float64(-1), "args": float64(2), "outcome": "canceled", "request": true, "statements": float64(1), "site": "unknown", "suppressed": float64(0)} {
+		requireAttr(t, m, k, v)
+	}
+	if shape, ok := m["shape"].(string); !ok || len(shape) != 16 {
+		t.Errorf("shape = %v, want 16 hex digits", m["shape"])
+	}
+	if len(m) != 14 {
+		t.Errorf("event keys = %d, want 14", len(m))
+	}
+}
+func TestEventSuppression(t *testing.T) {
+	setup(t)
+	resetEvents()
+	buf := capture(t)
+	now := time.Unix(100, 0)
+	s := summary{previous: now}
+	s.summarize(now)
+	buf.Reset()
+	ctx := context.Background()
+	for range 12 {
+		op := Begin(ctx, KindBatch, "", nil, 101)
+		op.end(ctx, nil, 1, now)
+	}
+	if got := len(logLines(t, buf)); got != 10 {
+		t.Errorf("initial events = %d, want 10", got)
+	}
+	op := Begin(ctx, KindBatch, "", nil, 101)
+	op.end(ctx, nil, 1, now.Add(time.Second))
+	s.summarize(now.Add(time.Second))
+	lines := logLines(t, buf)
+	if len(lines) != 12 {
+		t.Fatalf("lines = %d, want 11 events plus summary", len(lines))
+	}
+	requireAttr(t, lines[10], "suppressed", float64(2))
+	requireAttr(t, lines[11], "events_suppressed", float64(2))
+	buf.Reset()
+	s.summarize(now.Add(2 * time.Second))
+	lines = logLines(t, buf)
+	if len(lines) != 1 {
+		t.Fatalf("idle window lines = %d, want 1 summary", len(lines))
+	}
+	requireAttr(t, lines[0], "events_suppressed", float64(0))
+}
+
+func TestEventArgumentSizes(t *testing.T) {
+	for _, tc := range []struct {
+		name           string
+		args           []any
+		count, largest int
+	}{
+		{"pgx_options", []any{pgx.QueryExecModeDescribeExec, pgx.QueryResultFormats{pgx.BinaryFormatCode}, pgx.QueryResultFormatsByOID{23: pgx.BinaryFormatCode}, []string{"value"}}, 1, 1},
+		{"nested_slice", []any{[][]string{{"value"}}, []string{"a", "b"}}, 2, -1},
+		{"query_rewriter", []any{pgx.NamedArgs{"value": "private"}}, -1, -1},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			setup(t)
+			resetEvents()
+			buf := capture(t)
+			ctx := context.Background()
+			op := Begin(ctx, KindQuery, "SELECT 1", tc.args, 1)
+			op.end(ctx, nil, int64(time.Second), time.Unix(100, 0))
+			lines := logLines(t, buf)
+			if len(lines) != 1 {
+				t.Fatalf("events = %d, want 1", len(lines))
+			}
+			requireAttr(t, lines[0], "args", float64(tc.count))
+			requireAttr(t, lines[0], "max_array", float64(tc.largest))
+		})
+	}
+}
+func TestQuietWritesNoEvent(t *testing.T) {
+	setup(t)
+	resetEvents()
+	buf := capture(t)
+	ctx := Quiet(context.Background())
+	op := Begin(ctx, KindBatch, "", nil, 101)
+	op.end(ctx, nil, 1, time.Unix(100, 0))
+	if buf.Len() != 0 || suppressedTotal.Load() != 0 {
+		t.Error("quiet operation wrote or suppressed an event")
+	}
+	if op.row == nil || op.row.calls.Load() != 1 {
+		t.Error("quiet row calls must rise by one")
+	}
+}
diff --git a/internal/database/queryattr/metrics.go b/internal/database/queryattr/metrics.go
new file mode 100644
index 0000000000..7a0b82e31d
--- /dev/null
+++ b/internal/database/queryattr/metrics.go
@@ -0,0 +1,18 @@
+package queryattr
+
+import "github.com/prometheus/client_golang/prometheus"
+
+const siteLabel = "site"
+
+var queriesTotal = prometheus.NewCounterVec(prometheus.CounterOpts{
+	Name: "prairie_postgres_queries_total",
+	Help: "PostgreSQL operations completed, by the calling Prairie function and line.",
+}, []string{siteLabel})
+var querySecondsTotal = prometheus.NewCounterVec(prometheus.CounterOpts{
+	Name: "prairie_postgres_query_seconds_total",
+	Help: "Summed PostgreSQL operation time from start to end callback, by the calling Prairie function and line; not wall time.",
+}, []string{siteLabel})
+
+// RegisterMetrics registers the two site counters. It panics on duplicate or invalid registration.
+// Importing queryattr registers no collectors.
+func RegisterMetrics(reg prometheus.Registerer) { reg.MustRegister(queriesTotal, querySecondsTotal) }
diff --git a/internal/database/queryattr/metrics_test.go b/internal/database/queryattr/metrics_test.go
new file mode 100644
index 0000000000..f50f1b85dc
--- /dev/null
+++ b/internal/database/queryattr/metrics_test.go
@@ -0,0 +1,17 @@
+package queryattr
+
+import (
+	"testing"
+
+	"github.com/prometheus/client_golang/prometheus"
+)
+
+func TestImportRegistersNoMetrics(t *testing.T) {
+	for _, c := range []prometheus.Collector{queriesTotal, querySecondsTotal} {
+		if err := prometheus.DefaultRegisterer.Register(c); err != nil {
+			t.Errorf("collector already registered: %v", err)
+		} else {
+			t.Cleanup(func() { prometheus.DefaultRegisterer.Unregister(c) })
+		}
+	}
+}
diff --git a/internal/database/queryattr/off_test.go b/internal/database/queryattr/off_test.go
new file mode 100644
index 0000000000..ed8e39a218
--- /dev/null
+++ b/internal/database/queryattr/off_test.go
@@ -0,0 +1,40 @@
+package queryattr
+
+import (
+	"context"
+	"sync"
+	"testing"
+)
+
+func TestDisabledIsInert(t *testing.T) {
+	setup(t)
+	enabled.Store(false)
+	ctx := context.Background()
+	next, r := StartRequest(ctx)
+	if next != ctx || r != nil || r.LogAttrs() != nil {
+		t.Error("disabled StartRequest must return original context, nil request and attrs")
+	}
+	op := Begin(ctx, KindQuery, "SELECT 1", nil, 1)
+	op.End(ctx, nil)
+	if op.Site() != "" || op.Shape() != "" || Detach(ctx) != ctx || Quiet(ctx) != ctx {
+		t.Error("disabled attribution must be inert")
+	}
+	n := 0
+	sites.Range(func(_, _ any) bool { n++; return true })
+	if n != 0 {
+		t.Errorf("disabled sites = %d, want 0", n)
+	}
+}
+func TestInitializeDefaultsOff(t *testing.T) {
+	setup(t)
+	t.Setenv("PRAIRIE_QUERY_ATTRIBUTION_ENABLED", "")
+	initializeOnce = sync.Once{}
+	t.Cleanup(func() { initializeOnce = sync.Once{} })
+	if Initialize() {
+		t.Error("Initialize = true, want false with unset env")
+	}
+	t.Setenv("PRAIRIE_QUERY_ATTRIBUTION_ENABLED", "true")
+	if Initialize() {
+		t.Error("Initialize reread env after first call")
+	}
+}
diff --git a/internal/database/queryattr/op.go b/internal/database/queryattr/op.go
new file mode 100644
index 0000000000..2cd193b107
--- /dev/null
+++ b/internal/database/queryattr/op.go
@@ -0,0 +1,164 @@
+// Package queryattr attributes PostgreSQL operation costs without retaining SQL or values.
+package queryattr
+
+import (
+	"context"
+	"encoding/json"
+	"reflect"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+
+	"github.com/prairie-server/prairie-server/internal/envutil"
+)
+
+// Kind identifies one traced operation; acquire contributes only request wait time.
+type Kind uint8
+
+const (
+	KindQuery   Kind = iota + 1 // Query, QueryRow, Exec
+	KindBatch                   // SendBatch envelope
+	KindCopy                    // CopyFrom
+	KindAcquire                 // pool acquire: request wait only, no site
+)
+
+var enabled atomic.Bool
+var initializeOnce sync.Once
+
+// Initialize reads PRAIRIE_QUERY_ATTRIBUTION_ENABLED once and returns Enabled.
+// Attribution defaults off during the initial soak period.
+func Initialize() bool {
+	initializeOnce.Do(func() { enabled.Store(envutil.BoolDefault("PRAIRIE_QUERY_ATTRIBUTION_ENABLED", false)) })
+	return Enabled()
+}
+
+// Enabled reports whether initialization enabled attribution. It is false before Initialize.
+func Enabled() bool { return enabled.Load() }
+
+// Op retains only counts, identity, context markers, and start time for a traced operation.
+// The tracer owns exactly-once completion; an inert Op is safe to end.
+type Op struct {
+	row                        *row
+	request                    *Request
+	start                      time.Time
+	kind                       Kind
+	statements, args, maxArray int
+	quiet                      bool
+}
+
+// Begin starts attribution for kind. SQL is hashed only for queries, and args are
+// inspected only for sizes. Neither input is retained. statements counts queued
+// batch statements; queries and copies always report one. Off returns an inert Op.
+func Begin(ctx context.Context, kind Kind, sql string, args []any, statements int) Op {
+	if !Enabled() {
+		return Op{}
+	}
+	o := Op{request: requestFromContext(ctx), start: time.Now(), kind: kind, statements: statements}
+	if kind == KindAcquire {
+		return o
+	}
+	o.quiet, _ = ctx.Value(quietKey{}).(bool)
+	s := caller()
+	switch kind {
+	case KindBatch:
+		o.row = s.shapeRow("batch")
+		o.args = -1
+		o.maxArray = -1
+	case KindCopy:
+		o.row = s.shapeRow("copy")
+		o.statements = 1
+		o.args = -1
+		o.maxArray = -1
+	case KindQuery:
+		o.row = queryRow(s, sql)
+		o.statements = 1
+		o.args, o.maxArray = argumentSizes(args)
+	}
+	return o
+}
+
+// End completes this operation. Errors contribute only an allowlisted outcome and count.
+func (o *Op) End(ctx context.Context, err error) {
+	now := time.Now()
+	o.end(ctx, err, now.Sub(o.start).Nanoseconds(), now)
+}
+
+func (o *Op) end(ctx context.Context, err error, ns int64, now time.Time) {
+	if ns < 0 {
+		ns = 0
+	}
+	if o.kind == KindAcquire {
+		o.request.add(nil, uint64(ns))
+		return
+	}
+	if o.row == nil {
+		return
+	}
+	r := o.row
+	r.calls.Add(1)
+	r.ns.Add(uint64(ns))
+	if err != nil {
+		r.errors.Add(1)
+	}
+	r.site.queries.Inc()
+	r.site.seconds.Add(float64(ns) / float64(time.Second))
+	inRequest := o.request.add(r, uint64(ns))
+	o.event(ctx, err, ns, now, inRequest)
+}
+
+// Site returns the calling function and line, or "" for an inert or acquire operation.
+func (o *Op) Site() string {
+	if o.row == nil {
+		return ""
+	}
+	return o.row.site.name
+}
+
+// Shape returns the bounded SQL shape, or "" for an inert or acquire operation.
+func (o *Op) Shape() string {
+	if o.row == nil {
+		return ""
+	}
+	return o.row.shape
+}
+
+func argumentSizes(args []any) (count, largest int) {
+	options := true
+	for _, a := range args {
+		switch a.(type) {
+		case pgx.QueryExecMode, pgx.QueryResultFormats, pgx.QueryResultFormatsByOID:
+			if options {
+				continue
+			}
+		case pgx.QueryRewriter:
+			return -1, -1
+		}
+		options = false
+		count++
+		switch a.(type) {
+		case []byte, json.RawMessage:
+			continue
+		}
+		v := reflect.ValueOf(a)
+		if !v.IsValid() {
+			continue
+		}
+		typ := v.Type()
+		if typ.PkgPath() == "github.com/jackc/pgx/v5/pgtype" {
+			largest = -1
+			continue
+		}
+		if v.Kind() == reflect.Slice || v.Kind() == reflect.Array {
+			if typ.Elem().Kind() == reflect.Slice || typ.Elem().Kind() == reflect.Array {
+				largest = -1
+				continue
+			}
+			if largest >= 0 {
+				largest = max(largest, v.Len())
+			}
+		}
+	}
+	return count, largest
+}
diff --git a/internal/database/queryattr/output.go b/internal/database/queryattr/output.go
new file mode 100644
index 0000000000..89feac4d71
--- /dev/null
+++ b/internal/database/queryattr/output.go
@@ -0,0 +1,13 @@
+package queryattr
+
+import (
+	"context"
+	"log/slog"
+)
+
+// A failed observability sink cannot interrupt database completion or shutdown.
+func write(ctx context.Context, level slog.Level, msg string, attrs ...slog.Attr) {
+	defer func() { _ = recover() }()
+	//nolint:sloglint // This shared sink receives the fixed event and summary messages from its callers.
+	slog.Default().LogAttrs(ctx, level, msg, attrs...)
+}
diff --git a/internal/database/queryattr/output_test.go b/internal/database/queryattr/output_test.go
new file mode 100644
index 0000000000..872b2096ac
--- /dev/null
+++ b/internal/database/queryattr/output_test.go
@@ -0,0 +1,54 @@
+package queryattr
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"log/slog"
+	"strings"
+	"testing"
+	"time"
+)
+
+func capture(t *testing.T) *bytes.Buffer {
+	t.Helper()
+	var b bytes.Buffer
+	old := slog.Default()
+	slog.SetDefault(slog.New(slog.NewJSONHandler(&b, nil)))
+	t.Cleanup(func() { slog.SetDefault(old) })
+	return &b
+}
+func logLines(t *testing.T, b *bytes.Buffer) []map[string]any {
+	t.Helper()
+	var lines []map[string]any
+	for _, line := range strings.Split(strings.TrimSpace(b.String()), "\n") {
+		if line == "" {
+			continue
+		}
+		var m map[string]any
+		if err := json.Unmarshal([]byte(line), &m); err != nil {
+			t.Fatal(err)
+		}
+		lines = append(lines, m)
+	}
+	return lines
+}
+
+type panicHandler struct{ slog.Handler }
+
+func (panicHandler) Handle(context.Context, slog.Record) error { panic("sink failed") }
+func TestSummaryRecoversSinkPanic(t *testing.T) {
+	setup(t)
+	buf := capture(t)
+	handler := slog.Default().Handler()
+	slog.SetDefault(slog.New(panicHandler{handler}))
+	s := summary{previous: time.Unix(100, 0)}
+	s.summarize(time.Unix(101, 0))
+	slog.SetDefault(slog.New(handler))
+	s.summarize(time.Unix(102, 0))
+	lines := logLines(t, buf)
+	if len(lines) != 1 {
+		t.Fatalf("summary lines = %d, want 1", len(lines))
+	}
+	requireAttr(t, lines[0], "msg", "database query summary")
+}
diff --git a/internal/database/queryattr/request.go b/internal/database/queryattr/request.go
new file mode 100644
index 0000000000..e35fa6f357
--- /dev/null
+++ b/internal/database/queryattr/request.go
@@ -0,0 +1,132 @@
+package queryattr
+
+import (
+	"context"
+	"log/slog"
+	"sync"
+)
+
+const noQuery = "none"
+
+type requestKey struct{}
+type quietKey struct{}
+
+// Request accumulates completed operations until its first LogAttrs snapshot.
+// Concurrent completion and logging are safe; later completions leave the snapshot unchanged.
+type Request struct {
+	mu                       sync.Mutex
+	queries, ns, acquireWait uint64
+	slowest                  *row
+	slowestNS                uint64
+	counts                   map[*row]uint32
+	closed                   bool
+	attrs                    []any
+}
+
+// StartRequest reuses a request already in ctx, or returns a derived context and
+// a new request. Off returns ctx unchanged and a nil request.
+func StartRequest(ctx context.Context) (context.Context, *Request) {
+	if !Enabled() {
+		return ctx, nil
+	}
+	if r := requestFromContext(ctx); r != nil {
+		return ctx, r
+	}
+	r := new(Request)
+	return context.WithValue(ctx, requestKey{}, r), r
+}
+
+func requestFromContext(ctx context.Context) *Request {
+	r, _ := ctx.Value(requestKey{}).(*Request)
+	return r
+}
+
+func rowLess(a, b *row) bool {
+	return b == nil || a.site.name < b.site.name || a.site.name == b.site.name && a.shape < b.shape
+}
+
+func (r *Request) add(entry *row, ns uint64) bool {
+	if r == nil {
+		return false
+	}
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if r.closed {
+		return false
+	}
+	if entry == nil {
+		r.acquireWait += ns
+		return true
+	}
+	r.queries++
+	r.ns += ns
+	if r.slowest == nil || ns > r.slowestNS || ns == r.slowestNS && rowLess(entry, r.slowest) {
+		r.slowest = entry
+		r.slowestNS = ns
+	}
+	if r.counts == nil {
+		r.counts = make(map[*row]uint32)
+	}
+	r.counts[entry]++
+	return true
+}
+
+// LogAttrs closes the request and returns nine slog.Attr values in the log contract's
+// order, or nil if no operation and no acquire wait were recorded. It caches the
+// first snapshot, releases per-row counts, and is nil-safe.
+func (r *Request) LogAttrs() []any {
+	if r == nil {
+		return nil
+	}
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if r.closed {
+		return r.attrs
+	}
+	r.closed = true
+	if r.queries == 0 && r.acquireWait == 0 {
+		return nil
+	}
+	slowSite, slowShape, topSite, topShape := noQuery, noQuery, noQuery, noQuery
+	if r.slowest != nil {
+		slowSite = r.slowest.site.name
+		slowShape = r.slowest.shape
+	}
+	var top *row
+	var count uint32
+	for entry, n := range r.counts {
+		if top == nil || n > count || n == count && rowLess(entry, top) {
+			top = entry
+			count = n
+		}
+	}
+	if top != nil {
+		topSite = top.site.name
+		topShape = top.shape
+	}
+	r.counts = nil
+	r.attrs = []any{
+		slog.Uint64("db_queries", r.queries), slog.Uint64("db_query_ns", r.ns), slog.Uint64("db_acquire_wait_ns", r.acquireWait),
+		slog.String("db_slowest_site", slowSite), slog.String("db_slowest_shape", slowShape), slog.Uint64("db_slowest_ns", r.slowestNS),
+		slog.String("db_top_site", topSite), slog.String("db_top_shape", topShape), slog.Uint64("db_top_count", uint64(count)),
+	}
+	return r.attrs
+}
+
+// Detach hides request attribution while preserving cancellation, deadlines and
+// other values. StartRequest on the result creates a new request. Off returns ctx.
+func Detach(ctx context.Context) context.Context {
+	if !Enabled() {
+		return ctx
+	}
+	return context.WithValue(ctx, requestKey{}, (*Request)(nil))
+}
+
+// Quiet suppresses event output and suppression counts for operations begun under
+// ctx. Site counters, metrics and request totals remain active. Off returns ctx.
+func Quiet(ctx context.Context) context.Context {
+	if !Enabled() {
+		return ctx
+	}
+	return context.WithValue(ctx, quietKey{}, true)
+}
diff --git a/internal/database/queryattr/request_test.go b/internal/database/queryattr/request_test.go
new file mode 100644
index 0000000000..234286c927
--- /dev/null
+++ b/internal/database/queryattr/request_test.go
@@ -0,0 +1,147 @@
+package queryattr
+
+import (
+	"context"
+	"log/slog"
+	"reflect"
+	"sync"
+	"testing"
+	"time"
+)
+
+func setup(t *testing.T) {
+	t.Helper()
+	old := enabled.Load()
+	enabled.Store(true)
+	sites.Clear()
+	pcs.Clear()
+	shapeCache.Clear()
+	shapeCacheSize.Store(0)
+	t.Cleanup(func() { enabled.Store(old) })
+}
+func namedOp(ctx context.Context, siteName, shape string) Op {
+	op := Begin(ctx, KindQuery, "SELECT 1", nil, 1)
+	op.row = internSite(siteName).shapeRow(shape)
+	return op
+}
+func attrsMap(attrs []any) map[string]any {
+	m := make(map[string]any)
+	for _, a := range attrs {
+		attr := a.(slog.Attr)
+		m[attr.Key] = attr.Value.Any()
+	}
+	return m
+}
+func requireAttr(t *testing.T, m map[string]any, key string, want any) {
+	t.Helper()
+	if got := m[key]; !reflect.DeepEqual(got, want) {
+		t.Errorf("%s = %v (%T), want %v (%T)", key, got, got, want, want)
+	}
+}
+func TestRequestTotals(t *testing.T) {
+	for _, extra := range []int{0, 2} {
+		t.Run(string(rune('0'+extra)), func(t *testing.T) {
+			setup(t)
+			ctx, r := StartRequest(context.Background())
+			if r == nil {
+				t.Fatal("StartRequest returned nil, want request")
+			}
+			a := namedOp(ctx, "a", "x")
+			a.end(ctx, nil, 5, time.Time{})
+			b := namedOp(ctx, "b", "y")
+			b.end(ctx, nil, 7, time.Time{})
+			batch := namedOp(ctx, "b", "batch")
+			batch.kind = KindBatch
+			batch.end(ctx, nil, 7, time.Time{})
+			acquire := Begin(ctx, KindAcquire, "", nil, 0)
+			acquire.end(ctx, nil, 3, time.Time{})
+			for range extra {
+				op := namedOp(ctx, "a", "x")
+				op.end(ctx, nil, 1, time.Time{})
+			}
+			m := attrsMap(r.LogAttrs())
+			requireAttr(t, m, "db_queries", uint64(3+extra))
+			requireAttr(t, m, "db_query_ns", uint64(19+extra))
+			requireAttr(t, m, "db_acquire_wait_ns", uint64(3))
+			requireAttr(t, m, "db_slowest_site", "b")
+			requireAttr(t, m, "db_slowest_shape", "batch")
+			requireAttr(t, m, "db_slowest_ns", uint64(7))
+			requireAttr(t, m, "db_top_site", "a")
+			requireAttr(t, m, "db_top_shape", "x")
+			requireAttr(t, m, "db_top_count", uint64(1+extra))
+		})
+	}
+}
+func TestRequestNoQueryAttrs(t *testing.T) {
+	setup(t)
+	_, r := StartRequest(context.Background())
+	if attrs := r.LogAttrs(); attrs != nil {
+		t.Errorf("LogAttrs = %v, want nil for idle request", attrs)
+	}
+	if attrs := r.LogAttrs(); attrs != nil {
+		t.Errorf("second LogAttrs = %v, want nil for idle request", attrs)
+	}
+}
+func TestRequestAcquireOnlyValues(t *testing.T) {
+	setup(t)
+	ctx, r := StartRequest(context.Background())
+	acquire := Begin(ctx, KindAcquire, "", nil, 0)
+	acquire.end(ctx, nil, 3, time.Time{})
+	attrs := r.LogAttrs()
+	keys := []string{"db_queries", "db_query_ns", "db_acquire_wait_ns", "db_slowest_site", "db_slowest_shape", "db_slowest_ns", "db_top_site", "db_top_shape", "db_top_count"}
+	if len(attrs) != len(keys) {
+		t.Fatalf("attrs = %d, want 9", len(attrs))
+	}
+	m := attrsMap(attrs)
+	for i, k := range keys {
+		if attrs[i].(slog.Attr).Key != k {
+			t.Errorf("attr %d = %s, want %s", i, attrs[i].(slog.Attr).Key, k)
+		}
+		var want any = uint64(0)
+		if k == "db_slowest_site" || k == "db_slowest_shape" || k == "db_top_site" || k == "db_top_shape" {
+			want = "none"
+		}
+		if k == "db_acquire_wait_ns" {
+			want = uint64(3)
+		}
+		requireAttr(t, m, k, want)
+	}
+}
+func TestRequestEndAfterLogAttrs(t *testing.T) {
+	setup(t)
+	buf := capture(t)
+	resetEvents()
+	ctx, r := StartRequest(context.Background())
+	first := r.LogAttrs()
+	op := namedOp(ctx, "a", "x")
+	op.end(ctx, nil, int64(time.Second), time.Unix(100, 0))
+	if !reflect.DeepEqual(first, r.LogAttrs()) {
+		t.Error("LogAttrs changed after close")
+	}
+	if op.row.calls.Load() != 1 {
+		t.Errorf("row calls = %d, want 1", op.row.calls.Load())
+	}
+	lines := logLines(t, buf)
+	if len(lines) != 1 {
+		t.Fatalf("events = %d, want 1", len(lines))
+	}
+	requireAttr(t, lines[0], "request", false)
+}
+func TestStartRequestReuses(t *testing.T) {
+	setup(t)
+	ctx, r := StartRequest(context.Background())
+	again, r2 := StartRequest(ctx)
+	if r == nil || r2 != r || ctx != again {
+		t.Fatal("StartRequest must reuse the existing context and non-nil request")
+	}
+}
+func TestRequestParallelEnds(t *testing.T) {
+	setup(t)
+	ctx, r := StartRequest(context.Background())
+	var wg sync.WaitGroup
+	for range 64 {
+		wg.Go(func() { op := namedOp(ctx, "a", "x"); op.end(ctx, nil, 1, time.Time{}) })
+	}
+	wg.Wait()
+	requireAttr(t, attrsMap(r.LogAttrs()), "db_queries", uint64(64))
+}
diff --git a/internal/database/queryattr/shape.go b/internal/database/queryattr/shape.go
new file mode 100644
index 0000000000..a0567f9bcc
--- /dev/null
+++ b/internal/database/queryattr/shape.go
@@ -0,0 +1,68 @@
+package queryattr
+
+import (
+	"fmt"
+	"hash/fnv"
+	"hash/maphash"
+	"sync"
+	"sync/atomic"
+
+	"github.com/DataDog/go-sqllexer"
+)
+
+var shapeCache sync.Map
+var shapeCacheSize atomic.Uint64
+var shapeSeed = maphash.MakeSeed()
+var obfuscator = sqllexer.NewObfuscator(sqllexer.WithReplacePositionalParameter(true))
+var normalizer = sqllexer.NewNormalizer()
+
+type shapeKey struct {
+	site    *site
+	sqlHash uint64
+}
+
+// SQL and normalized text remain local to this function. Neither enters a cache or output.
+func queryRow(s *site, sql string) *row {
+	key := shapeKey{s, maphash.String(shapeSeed, sql)}
+	if cached, ok := shapeCache.Load(key); ok {
+		r, _ := cached.(*row)
+		return r
+	}
+	normalized, _, err := sqllexer.ObfuscateAndNormalize(sql, obfuscator, normalizer, sqllexer.WithDBMS(sqllexer.DBMSPostgres))
+	var r *row
+	if err == nil {
+		h := fnv.New64a()
+		_, _ = h.Write([]byte(normalized))
+		r = s.hashedRow(h.Sum64())
+	} else {
+		r = s.shapeRow(shapeOther)
+	}
+	actual, loaded := shapeCache.LoadOrStore(key, r)
+	if !loaded && shapeCacheSize.Add(1) >= 4096 {
+		shapeCache.Clear()
+		shapeCacheSize.Store(0)
+	}
+	stored, _ := actual.(*row)
+	return stored
+}
+
+func (s *site) hashedRow(hash uint64) *row {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	// At most eight shapes are scanned; formatting happens only when a row is created.
+	for _, r := range s.rows {
+		if len(r.shape) == 16 && r.hash == hash {
+			return r
+		}
+	}
+	count := len(s.rows)
+	if s.rows[shapeOther] != nil {
+		count--
+	}
+	if count >= 8 {
+		return s.shapeRowLocked(shapeOther)
+	}
+	r := s.shapeRowLocked(fmt.Sprintf("%016x", hash))
+	r.hash = hash
+	return r
+}
diff --git a/internal/database/queryattr/shape_test.go b/internal/database/queryattr/shape_test.go
new file mode 100644
index 0000000000..e5ec19d8c7
--- /dev/null
+++ b/internal/database/queryattr/shape_test.go
@@ -0,0 +1,116 @@
+package queryattr
+
+import (
+	"context"
+	"fmt"
+	"regexp"
+	"testing"
+	"time"
+)
+
+func TestShapeGrouping(t *testing.T) {
+	cases := []struct {
+		a, b string
+		same bool
+	}{
+		{"SELECT 1 WHERE a IN ($1,$2)", "SELECT 1 WHERE a IN ($1,$2,$3)", true},
+		{"SELECT 1 WHERE a = 5", "SELECT 1 WHERE a = 7", true},
+		{"SELECT 'a'", "SELECT 'b'", true},
+		{"SELECT 1 /* first */", "SELECT 1 /* second */", true},
+		{"SELECT 1 WHERE a", "SELECT 1 WHERE b", false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.a, func(t *testing.T) {
+			setup(t)
+			s := internSite("a")
+			a, b := queryRow(s, tc.a), queryRow(s, tc.b)
+			if (a.shape == b.shape) != tc.same {
+				t.Errorf("shapes = %q, %q, want same=%v", a.shape, b.shape, tc.same)
+			}
+			if !regexp.MustCompile(`^[0-9a-f]{16}$`).MatchString(a.shape) {
+				t.Errorf("shape = %q, want 16 lowercase hex digits", a.shape)
+			}
+		})
+	}
+}
+func TestShapeCapUsesOther(t *testing.T) {
+	setup(t)
+	s := internSite("a")
+	ctx := context.Background()
+	for i := range 10 {
+		r := queryRow(s, fmt.Sprintf("SELECT column%d FROM fixture", i))
+		op := Op{row: r, kind: KindQuery}
+		op.end(ctx, nil, 1, time.Time{})
+	}
+	if len(s.rows) != 9 {
+		t.Fatalf("rows = %d, want 9", len(s.rows))
+	}
+	other := s.rows["other"]
+	if other == nil || other.calls.Load() != 2 {
+		t.Error("other row must hold last two calls")
+	}
+	for shape := range s.rows {
+		if shape != "other" && !regexp.MustCompile(`^[0-9a-f]{16}$`).MatchString(shape) {
+			t.Errorf("unexpected shape %q", shape)
+		}
+	}
+}
+func TestShapeFixedKinds(t *testing.T) {
+	setup(t)
+	for _, tc := range []struct {
+		kind  Kind
+		shape string
+	}{{KindBatch, "batch"}, {KindCopy, "copy"}} {
+		op := Begin(context.Background(), tc.kind, "", nil, 1)
+		if op.Shape() != tc.shape {
+			t.Errorf("shape = %q, want %q", op.Shape(), tc.shape)
+		}
+	}
+}
+func TestShapeCacheClear(t *testing.T) {
+	setup(t)
+	s := internSite("a")
+	for i := range 4097 {
+		r := queryRow(s, fmt.Sprintf("SELECT %d", i))
+		op := Op{row: r, kind: KindQuery}
+		op.end(context.Background(), nil, 1, time.Time{})
+	}
+	if shapeCacheSize.Load() >= 4096 {
+		t.Errorf("cache size = %d, want below cap after clear", shapeCacheSize.Load())
+	}
+	n := 0
+	shapeCache.Range(func(_, _ any) bool { n++; return true })
+	if n == 0 || n >= 4096 {
+		t.Errorf("cache entries = %d, want 1..4095", n)
+	}
+	if len(s.rows) != 1 {
+		t.Fatalf("rows = %d, want 1", len(s.rows))
+	}
+	for _, r := range s.rows {
+		if r.calls.Load() != 4097 {
+			t.Errorf("row calls = %d, want 4097", r.calls.Load())
+		}
+	}
+}
+func TestFrameRule(t *testing.T) {
+	cases := []struct {
+		name, display string
+		skip          bool
+	}{
+		{modulePrefix + "internal/catalog.(*Repo).List", "catalog.(*Repo).List", false},
+		{"main.main", "main.main", false},
+		{modulePrefix + "internal/database.X", "database.X", true},
+		{modulePrefix + "internal/database/queryattr.X", "database/queryattr.X", true},
+		{"github.com/jackc/pgx/v5.X", "github.com/jackc/pgx/v5.X", true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := skipFunction(tc.name); got != tc.skip {
+				t.Errorf("skip = %v, want %v", got, tc.skip)
+			}
+			if got := displayName(tc.name); got != tc.display {
+				t.Errorf("display = %q, want %q", got, tc.display)
+			}
+		})
+	}
+}
diff --git a/internal/database/queryattr/site.go b/internal/database/queryattr/site.go
new file mode 100644
index 0000000000..93f71c662a
--- /dev/null
+++ b/internal/database/queryattr/site.go
@@ -0,0 +1,129 @@
+package queryattr
+
+import (
+	"runtime"
+	"strconv"
+	"strings"
+	"sync"
+	"sync/atomic"
+
+	"github.com/prometheus/client_golang/prometheus"
+)
+
+const modulePrefix = "github.com/prairie-server/prairie-server/"
+const shapeOther = "other"
+
+var sites sync.Map // site name -> *site; also summary membership
+var pcs sync.Map   // PC -> *site, including typed nil for skipped PCs
+
+type site struct {
+	name             string
+	mu               sync.Mutex
+	rows             map[string]*row
+	queries, seconds prometheus.Counter
+}
+
+type totals struct{ calls, ns, errors uint64 }
+
+type row struct {
+	site              *site
+	shape             string
+	hash              uint64
+	calls, ns, errors atomic.Uint64
+	previous          totals // Only the summary goroutine reads or writes previous.
+}
+
+func internSite(name string) *site {
+	if cached, ok := sites.Load(name); ok {
+		s, _ := cached.(*site)
+		return s
+	}
+	s := &site{name: name, rows: make(map[string]*row),
+		queries: queriesTotal.WithLabelValues(name), seconds: querySecondsTotal.WithLabelValues(name)}
+	actual, _ := sites.LoadOrStore(name, s)
+	interned, _ := actual.(*site)
+	return interned
+}
+
+func (s *site) shapeRow(shape string) *row {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.shapeRowLocked(shape)
+}
+
+func (s *site) shapeRowLocked(shape string) *row {
+	if r := s.rows[shape]; r != nil {
+		return r
+	}
+	count := len(s.rows)
+	if s.rows[shapeOther] != nil {
+		count--
+	}
+	if count >= 8 {
+		shape = shapeOther
+	}
+	if r := s.rows[shape]; r != nil {
+		return r
+	}
+	r := &row{site: s, shape: shape}
+	s.rows[shape] = r
+	return r
+}
+
+func displayName(name string) string {
+	return strings.TrimPrefix(strings.TrimPrefix(name, modulePrefix), "internal/")
+}
+
+func skipFunction(name string) bool {
+	return !strings.HasPrefix(name, modulePrefix) && !strings.HasPrefix(name, "main.") ||
+		strings.HasPrefix(name, modulePrefix+"internal/database")
+}
+
+// shortWalk covers the usual path from the tracer through pgx to the calling
+// site. runtime.Callers cost grows with the frames it unwinds; in a production
+// build the full walk measured about 10 µs per query, so it runs only when the
+// short one finds no site.
+const shortWalk = 8
+
+func caller() *site {
+	var stack [32]uintptr
+	n := runtime.Callers(3, stack[:shortWalk])
+	if s := firstSite(stack[:n]); s != nil {
+		return s
+	}
+	if n == shortWalk {
+		n = runtime.Callers(3, stack[:])
+		if s := firstSite(stack[shortWalk:n]); s != nil {
+			return s
+		}
+	}
+	return internSite("unknown")
+}
+
+func firstSite(stack []uintptr) *site {
+	for _, pc := range stack {
+		if cached, ok := pcs.Load(pc); ok {
+			if s, _ := cached.(*site); s != nil {
+				return s
+			}
+			continue
+		}
+		var s *site
+		frames := runtime.CallersFrames([]uintptr{pc})
+		for {
+			frame, more := frames.Next()
+			if !skipFunction(frame.Function) {
+				s = internSite(displayName(frame.Function) + ":" + strconv.Itoa(frame.Line))
+				break
+			}
+			if !more {
+				break
+			}
+		}
+		pcs.Store(pc, s)
+		if s != nil {
+			return s
+		}
+	}
+	return nil
+}
diff --git a/internal/database/queryattr/site_test.go b/internal/database/queryattr/site_test.go
new file mode 100644
index 0000000000..7785ff75c7
--- /dev/null
+++ b/internal/database/queryattr/site_test.go
@@ -0,0 +1,48 @@
+package queryattr
+
+import (
+	"runtime"
+	"strings"
+	"testing"
+)
+
+// callerThrough runs plant, then caller, depth frames below its first call. Its
+// own frames are database frames, so caller skips them.
+//
+//go:noinline
+func callerThrough(depth int, plant func()) *site {
+	if depth == 0 {
+		plant()
+		return caller()
+	}
+	return callerThrough(depth-1, plant)
+}
+
+func TestCallerWalksPastShortWindow(t *testing.T) {
+	t.Cleanup(func() { pcs.Clear() })
+	// The test frame sits at index depth of caller's walk: 2 is inside the short
+	// walk, 12 needs the full one.
+	for _, depth := range []int{2, 12} {
+		pcs.Clear()
+		marker := &site{name: "marker"}
+		planted := false
+		plant := func() {
+			var stack [64]uintptr
+			n := runtime.Callers(0, stack[:])
+			for _, pc := range stack[:n] {
+				if f := runtime.FuncForPC(pc - 1); f != nil && strings.HasSuffix(f.Name(), "."+t.Name()) {
+					pcs.Store(pc, marker) // the return address into this test, as caller sees it
+					planted = true
+					return
+				}
+			}
+		}
+		got := callerThrough(depth, plant)
+		if !planted {
+			t.Fatalf("depth %d: no frame for %s", depth, t.Name())
+		}
+		if got != marker {
+			t.Errorf("depth %d: caller = %v, want the planted test-frame site", depth, got)
+		}
+	}
+}
diff --git a/internal/database/queryattr/summary.go b/internal/database/queryattr/summary.go
new file mode 100644
index 0000000000..66b8b5bffc
--- /dev/null
+++ b/internal/database/queryattr/summary.go
@@ -0,0 +1,112 @@
+package queryattr
+
+import (
+	"cmp"
+	"context"
+	"log/slog"
+	"slices"
+	"strconv"
+	"time"
+)
+
+type summary struct {
+	run, build string
+	previous   time.Time
+	suppressed uint64
+}
+
+type deltaRow struct {
+	site, shape string
+	totals
+}
+
+// RunSummary writes a delta summary every 15 minutes and a final summary on
+// cancellation, then returns. One caller owns summary snapshots per process.
+// Off returns immediately. run and build identify the process and binary.
+func RunSummary(ctx context.Context, run, build string) {
+	if !Enabled() {
+		return
+	}
+	s := summary{run: run, build: build, previous: time.Now()}
+	ticker := time.NewTicker(15 * time.Minute)
+	defer ticker.Stop()
+	for {
+		select {
+		case now := <-ticker.C:
+			s.summarize(now)
+		case <-ctx.Done():
+			s.summarize(time.Now())
+			return
+		}
+	}
+}
+
+func (s *summary) summarize(now time.Time) {
+	var rows []deltaRow
+	var total totals
+	sites.Range(func(_, value any) bool {
+		site, _ := value.(*site)
+		site.mu.Lock()
+		entries := make([]*row, 0, len(site.rows))
+		for _, r := range site.rows {
+			entries = append(entries, r)
+		}
+		site.mu.Unlock()
+		for _, r := range entries {
+			current := totals{r.calls.Load(), r.ns.Load(), r.errors.Load()}
+			delta := totals{current.calls - r.previous.calls, current.ns - r.previous.ns, current.errors - r.previous.errors}
+			r.previous = current
+			if delta == (totals{}) {
+				continue
+			}
+			rows = append(rows, deltaRow{site.name, r.shape, delta})
+			total.calls += delta.calls
+			total.ns += delta.ns
+			total.errors += delta.errors
+		}
+		return true
+	})
+	suppressed := suppressedTotal.Load()
+	attrs := []slog.Attr{
+		slog.String("component", "database"), slog.String("run", s.run), slog.String("build", s.build), slog.Int64("interval_ns", now.Sub(s.previous).Nanoseconds()),
+		slog.Uint64("queries", total.calls), slog.Uint64("query_ns", total.ns), slog.Uint64("errors", total.errors), slog.Uint64("events_suppressed", suppressed-s.suppressed),
+	}
+	slices.SortFunc(rows, func(a, b deltaRow) int {
+		if n := cmp.Compare(b.ns, a.ns); n != 0 {
+			return n
+		}
+		if n := cmp.Compare(b.calls, a.calls); n != 0 {
+			return n
+		}
+		if n := cmp.Compare(a.site, b.site); n != 0 {
+			return n
+		}
+		return cmp.Compare(a.shape, b.shape)
+	})
+	attrs = append(attrs, rankList("top_time", rows))
+	slices.SortFunc(rows, func(a, b deltaRow) int {
+		if n := cmp.Compare(b.calls, a.calls); n != 0 {
+			return n
+		}
+		if n := cmp.Compare(b.ns, a.ns); n != 0 {
+			return n
+		}
+		if n := cmp.Compare(a.site, b.site); n != 0 {
+			return n
+		}
+		return cmp.Compare(a.shape, b.shape)
+	})
+	attrs = append(attrs, rankList("top_count", rows))
+	s.previous = now
+	s.suppressed = suppressed
+	write(context.Background(), slog.LevelInfo, "database query summary", attrs...)
+}
+
+func rankList(key string, rows []deltaRow) slog.Attr {
+	attrs := make([]slog.Attr, 0, min(len(rows), 10))
+	for i, r := range rows[:min(len(rows), 10)] {
+		attrs = append(attrs, slog.GroupAttrs(strconv.Itoa(i+1),
+			slog.String(siteLabel, r.site), slog.String("shape", r.shape), slog.Uint64("calls", r.calls), slog.Uint64("ns", r.ns), slog.Uint64("errors", r.errors)))
+	}
+	return slog.GroupAttrs(key, attrs...)
+}
diff --git a/internal/database/queryattr/summary_test.go b/internal/database/queryattr/summary_test.go
new file mode 100644
index 0000000000..3a0a1b6e13
--- /dev/null
+++ b/internal/database/queryattr/summary_test.go
@@ -0,0 +1,204 @@
+package queryattr
+
+import (
+	"context"
+	"fmt"
+	"reflect"
+	"sort"
+	"strconv"
+	"sync"
+	"testing"
+	"time"
+)
+
+func groupRows(t *testing.T, m map[string]any, key string) []map[string]any {
+	t.Helper()
+	if m[key] == nil {
+		return nil
+	}
+	g := m[key].(map[string]any)
+	rows := make([]map[string]any, 0, len(g))
+	for i := 1; i <= len(g); i++ {
+		rows = append(rows, g[strconv.Itoa(i)].(map[string]any))
+	}
+	return rows
+}
+func TestSummaryWindows(t *testing.T) {
+	setup(t)
+	resetEvents()
+	buf := capture(t)
+	now := time.Unix(100, 0)
+	s := summary{run: "run-id", build: "build-id", previous: now}
+	ctx := context.Background()
+	a := namedOp(ctx, "a", "x")
+	a.end(ctx, nil, 5, now)
+	a.end(ctx, nil, 2, now)
+	a.end(ctx, nil, 2, now)
+	b := namedOp(ctx, "b", "y")
+	b.end(ctx, context.Canceled, 7, now)
+	b.end(ctx, nil, 7, now)
+	c := namedOp(ctx, "a", "z")
+	c.end(ctx, nil, 7, now)
+	c.end(ctx, nil, 7, now)
+	for _, tc := range []struct {
+		site, shape string
+		durations   []int64
+	}{
+		{"c", "x", []int64{20}},
+		{"d", "x", []int64{2, 2, 2}},
+		{"a", "y", []int64{7, 7}},
+		{"e", "x", []int64{14}},
+	} {
+		op := namedOp(ctx, tc.site, tc.shape)
+		for _, ns := range tc.durations {
+			op.end(ctx, nil, ns, now)
+		}
+	}
+	s.summarize(now.Add(time.Second))
+	a.end(ctx, nil, 2, now)
+	a.end(ctx, nil, 3, now)
+	s.summarize(now.Add(3 * time.Second))
+	lines := logLines(t, buf)
+	if len(lines) != 2 {
+		t.Fatalf("summary lines = %d, want 2", len(lines))
+	}
+	for k, v := range map[string]any{"run": "run-id", "build": "build-id", "interval_ns": float64(time.Second), "queries": float64(14), "query_ns": float64(91), "errors": float64(1)} {
+		requireAttr(t, lines[0], k, v)
+	}
+	for key, order := range map[string][]string{
+		"top_time":  {"c/x", "a/y", "a/z", "b/y", "e/x", "a/x", "d/x"},
+		"top_count": {"a/x", "d/x", "a/y", "a/z", "b/y", "c/x", "e/x"},
+	} {
+		rows := groupRows(t, lines[0], key)
+		if len(rows) != len(order) {
+			t.Fatalf("%s rows = %d, want %d", key, len(rows), len(order))
+		}
+		for i, want := range order {
+			got := rows[i]["site"].(string) + "/" + rows[i]["shape"].(string)
+			if got != want {
+				t.Errorf("%s[%d] = %s, want %s", key, i, got, want)
+			}
+		}
+	}
+	for k, v := range map[string]any{"interval_ns": float64(2 * time.Second), "queries": float64(2), "query_ns": float64(5), "errors": float64(0)} {
+		requireAttr(t, lines[1], k, v)
+	}
+	rows := groupRows(t, lines[1], "top_count")
+	if len(rows) != 1 {
+		t.Fatalf("second rows = %d, want 1", len(rows))
+	}
+	requireAttr(t, rows[0], "site", "a")
+	requireAttr(t, rows[0], "calls", float64(2))
+}
+
+func TestSummaryTopTen(t *testing.T) {
+	setup(t)
+	resetEvents()
+	buf := capture(t)
+	now := time.Unix(100, 0)
+	s := summary{previous: now}
+	ctx := context.Background()
+	for i := range 12 {
+		op := namedOp(ctx, fmt.Sprintf("site%02d", i), "x")
+		op.end(ctx, nil, int64(i+1), now)
+	}
+	s.summarize(now.Add(time.Second))
+	lines := logLines(t, buf)
+	if len(lines) != 1 {
+		t.Fatalf("summary lines = %d, want 1", len(lines))
+	}
+	requireAttr(t, lines[0], "queries", float64(12))
+	requireAttr(t, lines[0], "query_ns", float64(78))
+	for _, key := range []string{"top_time", "top_count"} {
+		rows := groupRows(t, lines[0], key)
+		if len(rows) != 10 {
+			t.Fatalf("%s rows = %d, want 10", key, len(rows))
+		}
+		for i, row := range rows {
+			requireAttr(t, row, "site", fmt.Sprintf("site%02d", 11-i))
+		}
+	}
+}
+func TestSummaryKeys(t *testing.T) {
+	setup(t)
+	resetEvents()
+	buf := capture(t)
+	now := time.Unix(100, 0)
+	s := summary{previous: now}
+	op := namedOp(context.Background(), "a", "x")
+	op.end(context.Background(), nil, 1, now)
+	s.summarize(now.Add(time.Second))
+	lines := logLines(t, buf)
+	if len(lines) != 1 {
+		t.Fatalf("summary lines = %d, want 1", len(lines))
+	}
+	keys := func(m map[string]any) []string {
+		ks := make([]string, 0, len(m))
+		for k := range m {
+			ks = append(ks, k)
+		}
+		sort.Strings(ks)
+		return ks
+	}
+	want := []string{"time", "level", "msg", "component", "run", "build", "interval_ns", "queries", "query_ns", "errors", "events_suppressed", "top_time", "top_count"}
+	sort.Strings(want)
+	if got := keys(lines[0]); !reflect.DeepEqual(got, want) {
+		t.Errorf("summary keys = %v, want %v", got, want)
+	}
+	for _, key := range []string{"top_time", "top_count"} {
+		for _, r := range groupRows(t, lines[0], key) {
+			want := []string{"calls", "errors", "ns", "shape", "site"}
+			if got := keys(r); !reflect.DeepEqual(got, want) {
+				t.Errorf("row keys = %v, want %v", got, want)
+			}
+		}
+	}
+}
+func TestSummaryConcurrentSites(t *testing.T) {
+	setup(t)
+	resetEvents()
+	buf := capture(t)
+	now := time.Unix(100, 0)
+	s := summary{previous: now}
+	s.summarize(now)
+	var wg sync.WaitGroup
+	done := make(chan struct{})
+	start := make(chan struct{})
+	for i := range 4 {
+		wg.Go(func() {
+			<-start
+			for range 100 {
+				op := namedOp(context.Background(), fmt.Sprintf("site%d", i), "x")
+				op.end(context.Background(), nil, 1, now)
+			}
+		})
+	}
+	go func() { wg.Wait(); close(done) }()
+	close(start)
+loop:
+	for {
+		select {
+		case <-done:
+			break loop
+		default:
+			s.summarize(now.Add(time.Second))
+		}
+	}
+	s.summarize(now.Add(2 * time.Second))
+	counts := map[string]float64{}
+	var queries float64
+	for _, line := range logLines(t, buf) {
+		queries += line["queries"].(float64)
+		for _, r := range groupRows(t, line, "top_count") {
+			counts[r["site"].(string)] += r["calls"].(float64)
+		}
+	}
+	if queries != 400 {
+		t.Errorf("window queries = %v, want 400", queries)
+	}
+	for i := range 4 {
+		if got := counts[fmt.Sprintf("site%d", i)]; got != 100 {
+			t.Errorf("site%d calls = %v, want 100", i, got)
+		}
+	}
+}
diff --git a/internal/database/simplify_playback_authority_migration_test.go b/internal/database/simplify_playback_authority_migration_test.go
index 495c2e8c79..dc849fe276 100644
--- a/internal/database/simplify_playback_authority_migration_test.go
+++ b/internal/database/simplify_playback_authority_migration_test.go
@@ -25,6 +25,9 @@ func simplifyColumns(ctx context.Context, t *testing.T, pool *pgxpool.Pool, tabl
 		}
 		out[c] = true
 	}
+	if err := rows.Err(); err != nil {
+		t.Fatal(err)
+	}
 	return out
 }
 
@@ -43,6 +46,9 @@ func simplifyTables(ctx context.Context, t *testing.T, pool *pgxpool.Pool) map[s
 		}
 		out[c] = true
 	}
+	if err := rows.Err(); err != nil {
+		t.Fatal(err)
+	}
 	return out
 }
 
diff --git a/internal/database/vector_types.go b/internal/database/vector_types.go
new file mode 100644
index 0000000000..2bf82e01f2
--- /dev/null
+++ b/internal/database/vector_types.go
@@ -0,0 +1,60 @@
+package database
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgtype"
+	pgxvec "github.com/pgvector/pgvector-go/pgx"
+)
+
+// registerVectorTypes registers pgvector's binary codecs for vector and
+// halfvec, so vectors cross the wire in binary instead of decimal text that
+// Postgres formats and Go parses. A 3072-dimension embedding is about 12 KB in
+// binary and 39 KB as text. A halfvec parameter needs a pgvector.HalfVector to
+// go in binary. A database without the extension yet, such as a new one
+// before its first migration, keeps the text form.
+func registerVectorTypes(ctx context.Context, conn *pgx.Conn) error {
+	var vectorOID, halfvecOID *uint32
+	if err := conn.QueryRow(ctx,
+		`SELECT to_regtype('vector')::oid, to_regtype('halfvec')::oid`,
+		pgx.QueryExecModeSimpleProtocol,
+	).Scan(&vectorOID, &halfvecOID); err != nil {
+		return fmt.Errorf("looking up the vector types: %w", err)
+	}
+	types := conn.TypeMap()
+	if vectorOID != nil {
+		types.RegisterType(&pgtype.Type{Name: "vector", OID: *vectorOID, Codec: nullSafeVectorCodec{pgxvec.VectorCodec{}}})
+	}
+	if halfvecOID != nil {
+		types.RegisterType(&pgtype.Type{Name: "halfvec", OID: *halfvecOID, Codec: nullSafeVectorCodec{pgxvec.HalfVectorCodec{}}})
+	}
+	return nil
+}
+
+// nullSafeVectorCodec turns a NULL scanned into a pgvector value into an error.
+// pgvector-go's binary decoder reads the dimension header without checking the
+// length and panics on NULL; the text form it replaces returned an error.
+type nullSafeVectorCodec struct {
+	pgtype.Codec
+}
+
+func (c nullSafeVectorCodec) PlanScan(m *pgtype.Map, oid uint32, format int16, target any) pgtype.ScanPlan {
+	plan := c.Codec.PlanScan(m, oid, format, target)
+	if plan == nil {
+		return nil
+	}
+	return nullSafeScanPlan{plan}
+}
+
+type nullSafeScanPlan struct {
+	pgtype.ScanPlan
+}
+
+func (p nullSafeScanPlan) Scan(src []byte, dst any) error {
+	if src == nil {
+		return fmt.Errorf("cannot scan NULL into %T", dst)
+	}
+	return p.ScanPlan.Scan(src, dst)
+}
diff --git a/internal/diagnostics/bundle.go b/internal/diagnostics/bundle.go
index c02ae6ccf3..1975cbb0ea 100644
--- a/internal/diagnostics/bundle.go
+++ b/internal/diagnostics/bundle.go
@@ -75,7 +75,7 @@ func ValidateBundle(r io.Reader, limits BundleLimits) (BundleInfo, error) {
 		if errors.Is(err, ErrCompressedTooLarge) {
 			return BundleInfo{}, ErrCompressedTooLarge
 		}
-		return BundleInfo{}, fmt.Errorf("%w: open gzip: %w", ErrInvalidBundle, err)
+		return BundleInfo{}, fmt.Errorf("%w: open gzip: %v", ErrInvalidBundle, err) //nolint:errorlint // an upload read error (e.g. *http.MaxBytesError) must not outrank the invalid-bundle verdict
 	}
 	gz.Multistream(false)
 	gzipClosed := false
@@ -405,7 +405,7 @@ func classifyEntryContentError(err error) error {
 	case errors.Is(err, io.EOF), errors.Is(err, io.ErrUnexpectedEOF):
 		return fmt.Errorf("%w: truncated or empty JSON entry", ErrInvalidBundle)
 	default:
-		return fmt.Errorf("%w: %w", ErrInvalidBundle, err)
+		return fmt.Errorf("%w: %v", ErrInvalidBundle, err) //nolint:errorlint // an upload read error (e.g. *http.MaxBytesError) must not outrank the invalid-bundle verdict
 	}
 }
 
@@ -474,7 +474,7 @@ func classifyBundleReadError(err error) error {
 	if errors.Is(err, io.ErrUnexpectedEOF) {
 		return fmt.Errorf("%w: truncated archive", ErrInvalidBundle)
 	}
-	return fmt.Errorf("%w: %w", ErrInvalidBundle, err)
+	return fmt.Errorf("%w: %v", ErrInvalidBundle, err) //nolint:errorlint // an upload read error (e.g. *http.MaxBytesError) must not outrank the invalid-bundle verdict
 }
 
 type bundleUploadAbortError struct {
diff --git a/internal/diagnostics/repo.go b/internal/diagnostics/repo.go
index 0b30d72b8d..882d8ec55e 100644
--- a/internal/diagnostics/repo.go
+++ b/internal/diagnostics/repo.go
@@ -654,7 +654,7 @@ func encodeReportCursor(receivedAt time.Time, id string) string {
 func decodeReportCursor(cursor string) (time.Time, string, error) {
 	raw, err := base64.RawURLEncoding.DecodeString(cursor)
 	if err != nil {
-		return time.Time{}, "", fmt.Errorf("%w: decode: %w", ErrInvalidCursor, err)
+		return time.Time{}, "", fmt.Errorf("%w: decode: %v", ErrInvalidCursor, err) //nolint:errorlint // the sentinel is the verdict on a client cursor; the decode error is only reported
 	}
 	parts := strings.Split(string(raw), "|")
 	if len(parts) != 2 {
@@ -662,11 +662,11 @@ func decodeReportCursor(cursor string) (time.Time, string, error) {
 	}
 	nanos, err := strconv.ParseInt(parts[0], 10, 64)
 	if err != nil {
-		return time.Time{}, "", fmt.Errorf("%w: timestamp: %w", ErrInvalidCursor, err)
+		return time.Time{}, "", fmt.Errorf("%w: timestamp: %v", ErrInvalidCursor, err) //nolint:errorlint // the sentinel is the verdict on a client cursor; the decode error is only reported
 	}
 	id := parts[1]
 	if _, err := uuid.Parse(id); err != nil {
-		return time.Time{}, "", fmt.Errorf("%w: id: %w", ErrInvalidCursor, err)
+		return time.Time{}, "", fmt.Errorf("%w: id: %v", ErrInvalidCursor, err) //nolint:errorlint // the sentinel is the verdict on a client cursor; the decode error is only reported
 	}
 	return time.Unix(0, nanos).UTC(), id, nil
 }
diff --git a/internal/diagnostics/service.go b/internal/diagnostics/service.go
index 3cd8e579a7..358f88d299 100644
--- a/internal/diagnostics/service.go
+++ b/internal/diagnostics/service.go
@@ -173,7 +173,7 @@ func (s *Service) Ingest(ctx context.Context, userID int, profileID *string, man
 	manifest, err := contract.ValidateManifest(manifestJSON)
 	if err != nil {
 		s.logRejected(ctx, "", userID, "", "", int64(len(manifestJSON)), "invalid_manifest")
-		return IngestResult{}, fmt.Errorf("%w: invalid manifest: %w", ErrInvalidBundle, err)
+		return IngestResult{}, fmt.Errorf("%w: invalid manifest: %v", ErrInvalidBundle, err) //nolint:errorlint // the sentinel is the verdict on client input; the validation error is only reported
 	}
 	if manifest.Archive.Bytes > settings.MaxBundleBytes {
 		s.logRejected(ctx, "", userID, manifest.Report.Platform, manifest.Report.Type, manifest.Archive.Bytes, "too_large")
@@ -441,7 +441,7 @@ func classifyBundleUploadError(err error) error {
 	case errors.Is(err, ErrInvalidBundle),
 		errors.Is(err, ErrTooManyEntries),
 		errors.Is(err, ErrCompressionRatio):
-		return fmt.Errorf("%w: %w", ErrInvalidBundle, err)
+		return fmt.Errorf("%w: %v", ErrInvalidBundle, err) //nolint:errorlint // deliberately collapses entry-count and ratio errors into the invalid-bundle verdict
 	default:
 		return err
 	}
diff --git a/internal/downloadprepare/transport.go b/internal/downloadprepare/transport.go
index 9493402148..1af3086a49 100644
--- a/internal/downloadprepare/transport.go
+++ b/internal/downloadprepare/transport.go
@@ -21,6 +21,7 @@ import (
 	"time"
 
 	"github.com/prairie-server/prairie-server/internal/downloadstorage"
+	"github.com/prairie-server/prairie-server/internal/nodeauth"
 	"github.com/prairie-server/prairie-server/internal/playback"
 	"github.com/prairie-server/prairie-server/internal/tonemap"
 )
@@ -357,7 +358,7 @@ type RemotePreparer interface {
 	Delete(ctx context.Context, nodeURL, jwtSecret, artifactID string) error
 }
 
-// HTTPPreparer implements RemotePreparer over bearer-protected node APIs. A
+// HTTPPreparer implements RemotePreparer over signed node APIs. A
 // full-file prepare has no transport timeout; its caller owns cancellation.
 // Metadata and relay operations use a bounded response-header wait by default.
 type HTTPPreparer struct {
@@ -652,14 +653,22 @@ func (p HTTPPreparer) request(ctx context.Context, method, nodeURL, jwtSecret, p
 	if err != nil || (base.Scheme != "http" && base.Scheme != "https") || base.Host == "" {
 		return nil, fmt.Errorf("invalid node URL")
 	}
-	base.Path = strings.TrimRight(base.Path, "/") + path
+	// Sign against the same normalized node URL the request is built from:
+	// re-escaping or trimming only one of them would sign a path prefix the
+	// worker never sees.
+	base.Path = strings.TrimRight(base.Path, "/")
+	base.RawPath = ""
 	base.RawQuery = ""
 	base.Fragment = ""
+	signingBase := base.String()
+	base.Path += path
 	req, err := http.NewRequestWithContext(ctx, method, base.String(), body)
 	if err != nil {
 		return nil, fmt.Errorf("build request: %w", err)
 	}
-	req.Header.Set("Authorization", "Bearer "+jwtSecret)
+	if err := nodeauth.Sign(req, signingBase, jwtSecret); err != nil {
+		return nil, err
+	}
 	return req, nil
 }
 
diff --git a/internal/downloadprepare/transport_test.go b/internal/downloadprepare/transport_test.go
index 17a18e5ea1..1973a3a20a 100644
--- a/internal/downloadprepare/transport_test.go
+++ b/internal/downloadprepare/transport_test.go
@@ -11,6 +11,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 	"github.com/prairie-server/prairie-server/internal/playback"
 	"github.com/prairie-server/prairie-server/internal/tonemap"
 )
@@ -21,8 +22,8 @@ func TestHTTPPreparerSendsAuthenticatedRecipe(t *testing.T) {
 		if r.Method != http.MethodPost || r.URL.Path != "/downloads/prepare" {
 			t.Fatalf("request = %s %s", r.Method, r.URL.Path)
 		}
-		if auth := r.Header.Get("Authorization"); auth != "Bearer secret" {
-			t.Fatalf("Authorization = %q", auth)
+		if !nodeauthtest.Signed(r, "secret") {
+			t.Fatalf("request is not signed: Authorization = %q", r.Header.Get("Authorization"))
 		}
 		if err := json.NewDecoder(r.Body).Decode(&got); err != nil {
 			t.Fatal(err)
@@ -304,8 +305,8 @@ func TestHTTPPreparerManagesOpaqueArtifact(t *testing.T) {
 		if r.URL.Path != "/downloads/artifacts/artifact-1" {
 			t.Fatalf("path = %q", r.URL.Path)
 		}
-		if r.Header.Get("Authorization") != "Bearer secret" {
-			t.Fatalf("Authorization = %q", r.Header.Get("Authorization"))
+		if !nodeauthtest.Signed(r, "secret") {
+			t.Fatalf("request is not signed: Authorization = %q", r.Header.Get("Authorization"))
 		}
 		switch r.Method {
 		case http.MethodHead:
@@ -330,6 +331,35 @@ func TestHTTPPreparerManagesOpaqueArtifact(t *testing.T) {
 	}
 }
 
+// A node URL that request() normalizes (an escaped path prefix, surrounding
+// whitespace) must be signed in its normalized form, or the worker behind a
+// prefix-stripping reverse proxy refuses the request.
+func TestHTTPPreparerSignsNormalizedNodeURLPrefix(t *testing.T) {
+	worker := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if !nodeauthtest.Signed(r, "secret") {
+			http.Error(w, "unauthorized", http.StatusUnauthorized)
+			return
+		}
+		w.Header().Set("Content-Length", "42")
+	})
+	for _, tc := range []struct {
+		name, strip, prefix, pad string
+	}{
+		{name: "escaped prefix", strip: "/worker", prefix: "/%77orker"},
+		{name: "padded URL", strip: "/node1", prefix: "/node1", pad: " "},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			server := httptest.NewServer(http.StripPrefix(tc.strip, worker))
+			defer server.Close()
+			nodeURL := tc.pad + server.URL + tc.prefix + tc.pad
+			result, err := HTTPPreparer{}.Stat(t.Context(), nodeURL, "secret", "artifact-1")
+			if err != nil || result.FileSize != 42 {
+				t.Fatalf("Stat = (%+v, %v), want a signed request the worker accepts", result, err)
+			}
+		})
+	}
+}
+
 func TestHTTPPreparerStatRecoversToneMapAttestationFromHeaders(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Method != http.MethodHead {
@@ -534,7 +564,7 @@ func TestHTTPPreparerOpenAllowsContinuedBodyProgress(t *testing.T) {
 
 func TestHTTPPreparerProgress(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.Header.Get("Authorization") != "Bearer secret" {
+		if !nodeauthtest.Signed(r, "secret") {
 			http.Error(w, "unauthorized", http.StatusUnauthorized)
 			return
 		}
diff --git a/internal/downloads/artifact_repo_test.go b/internal/downloads/artifact_repo_test.go
index 3bf9d50322..61beeeaab3 100644
--- a/internal/downloads/artifact_repo_test.go
+++ b/internal/downloads/artifact_repo_test.go
@@ -1445,3 +1445,76 @@ func requeueForTest(t *testing.T, pool *pgxpool.Pool, id string) {
 		t.Fatal(err)
 	}
 }
+
+// A device that fetched the whole file can report completion after recovery
+// found the output missing, requeued the job, and returned the download to
+// preparing: the report waited out the server update that lost the file. The
+// device holds the bytes, so the report must land, and a job still waiting in
+// the queue must stop once no other download needs it.
+func TestLateCompletionAfterMissingOutputRequeue(t *testing.T) {
+	cases := []struct {
+		name         string
+		otherWaiting bool
+		claimed      bool
+		wantArtifact string
+	}{
+		{name: "only requester", wantArtifact: ArtifactExpired},
+		{name: "another device still waiting", otherWaiting: true, wantArtifact: ArtifactQueued},
+		// A running encode finishes into the cache rather than being stopped.
+		{name: "already claimed by a worker", claimed: true, wantArtifact: ArtifactRunning},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			f := seedManagedFixture(t)
+			ctx := context.Background()
+			repo := NewArtifactRepository(f.pool)
+			ready := readyArtifactForRecovery(t, repo, f.pool, f.fileID, "")
+			t.Cleanup(func() { _, _ = f.pool.Exec(ctx, `DELETE FROM download_artifacts WHERE id = $1`, ready.ID) })
+			fetched := linkManagedArtifactDownload(t, f, f.profileA, f.deviceA, ready.ID, StatusDownloading)
+			if tc.otherWaiting {
+				linkManagedArtifactDownload(t, f, f.profileB, f.deviceB, ready.ID, StatusReady)
+			}
+			finishedAt := time.Now().Add(-time.Minute).UTC().Truncate(time.Millisecond)
+
+			if _, got, err := repo.RecoverMissing(ctx, ready.ID, missingArtifactRetireGrace); err != nil || got != artifactRequeued {
+				t.Fatalf("RecoverMissing = (%v, %v), want requeued", got, err)
+			}
+			if tc.claimed {
+				if _, err := f.pool.Exec(ctx, `UPDATE download_artifacts SET status = 'running', lease_owner = 'worker', lease_expires_at = now() + interval '1 minute' WHERE id = $1`, ready.ID); err != nil {
+					t.Fatal(err)
+				}
+			}
+			service := &Service{repo: f.repo, artifacts: NewArtifactManager(repo, f.repo, nil, nil, "late-completion-test", nil, nil)}
+			// A late transfer-start report describes bytes the device no
+			// longer fetches; it must not move the row out of preparing.
+			if _, err := service.ReportStatus(ctx, f.userID, f.profileA, f.deviceA, fetched, StatusEvent{Status: StatusDownloading, UpdatedAt: finishedAt.Add(-time.Second), Revision: 1}); !errors.Is(err, ErrNotFound) {
+				t.Fatalf("late downloading report = %v, want ErrNotFound", err)
+			}
+			got, err := service.ReportStatus(ctx, f.userID, f.profileA, f.deviceA, fetched, StatusEvent{Status: StatusCompleted, UpdatedAt: finishedAt, Revision: 1})
+			if err != nil || got.Status != StatusCompleted || got.CompletedAt == nil || !got.CompletedAt.Equal(finishedAt) {
+				t.Fatalf("late completion = %+v (%v), want completed at %v", got, err, finishedAt)
+			}
+			row, err := repo.GetByID(ctx, ready.ID)
+			if err != nil || row.Status != tc.wantArtifact {
+				t.Fatalf("artifact after late completion = %+v (%v), want %s", row, err, tc.wantArtifact)
+			}
+		})
+	}
+}
+
+// linkManagedArtifactDownload links one managed download in the given status
+// to artifactID for the fixture's user on profile/device.
+func linkManagedArtifactDownload(t *testing.T, f managedFixture, profileID, deviceID, artifactID, status string) string {
+	t.Helper()
+	id := fmt.Sprintf("late-%d", time.Now().UnixNano())
+	now := time.Now()
+	if err := f.repo.Create(context.Background(), &Download{
+		ID: id, UserID: f.userID, ProfileID: profileID, DeviceID: deviceID,
+		MediaFileID: f.fileID, ContentID: f.contentID, Kind: KindQueued,
+		Status: status, Format: FormatTranscode, ArtifactID: artifactID, FileSize: 4242,
+		CreatedAt: now, UpdatedAt: now,
+	}); err != nil {
+		t.Fatalf("link managed download: %v", err)
+	}
+	return id
+}
diff --git a/internal/downloads/offline.go b/internal/downloads/offline.go
index 8576fb27cb..7c8e3cd0a5 100644
--- a/internal/downloads/offline.go
+++ b/internal/downloads/offline.go
@@ -16,8 +16,10 @@ import (
 	"github.com/go-chi/chi/v5/middleware"
 
 	"github.com/prairie-server/prairie-server/internal/artworkkey"
+	"github.com/prairie-server/prairie-server/internal/artworkurl"
 	"github.com/prairie-server/prairie-server/internal/blobstore"
 	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/netguard"
 	"github.com/prairie-server/prairie-server/internal/playback"
 	"github.com/prairie-server/prairie-server/internal/subtitles"
 )
@@ -197,16 +199,15 @@ func (e artworkStatusError) Error() string {
 var artworkStallTimeout = 30 * time.Second
 
 // artworkClient fetches artwork when the service has no client of its own.
+// Its netguard transport checks every address it dials, redirect hops
+// included, so a stored metadata-provider URL cannot reach the server's own
+// network; artworkurl.FetchContext trusts the artwork store's direct URLs.
 var artworkClient = &http.Client{Transport: artworkTransport()}
 
-func artworkTransport() *http.Transport {
-	base, ok := http.DefaultTransport.(*http.Transport)
-	if !ok {
-		base = &http.Transport{}
-	}
-	t := base.Clone()
-	t.ResponseHeaderTimeout = artworkStallTimeout
-	return t
+func artworkTransport() *netguard.Transport {
+	return netguard.NewTransport(func(t *http.Transport) {
+		t.ResponseHeaderTimeout = artworkStallTimeout
+	})
 }
 
 func (s *Service) artworkHTTPClient() *http.Client {
@@ -297,6 +298,7 @@ func (s *Service) openStoredArtwork(ctx context.Context, key string) (artworkIma
 }
 
 func (s *Service) fetchArtwork(ctx context.Context, imageURL string) (artworkImage, error) {
+	ctx = artworkurl.FetchContext(ctx, s.artworkStore, imageURL)
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, imageURL, nil)
 	if err != nil {
 		// Not wrapped: the parse error quotes the presigned URL.
@@ -314,6 +316,10 @@ func (s *Service) fetchArtwork(ctx context.Context, imageURL string) (artworkIma
 		if urlErr, ok := errors.AsType[*url.Error](err); ok {
 			err = urlErr.Err
 		}
+		if errors.Is(err, netguard.ErrPrivateDestination) || errors.Is(err, netguard.ErrBlockedDestination) {
+			// An address the guard refuses stays refused: not worth a retry.
+			return artworkImage{}, fmt.Errorf("fetching artwork: %w: %w", ErrAssetNotFound, err)
+		}
 		return artworkImage{}, fmt.Errorf("fetching artwork: %w: %w", ErrAssetUnavailable, err)
 	}
 	if resp.StatusCode == http.StatusTooManyRequests || resp.StatusCode >= http.StatusInternalServerError {
diff --git a/internal/downloads/offline_artwork_test.go b/internal/downloads/offline_artwork_test.go
index b948a21452..9ba756ac9b 100644
--- a/internal/downloads/offline_artwork_test.go
+++ b/internal/downloads/offline_artwork_test.go
@@ -10,12 +10,14 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"strings"
+	"sync/atomic"
 	"testing"
 	"time"
 
 	"github.com/prairie-server/prairie-server/internal/artworkurl"
 	"github.com/prairie-server/prairie-server/internal/blobstore"
 	"github.com/prairie-server/prairie-server/internal/blobstore/blobstoretest"
+	"github.com/prairie-server/prairie-server/internal/netguard"
 )
 
 func TestArtworkUpstreamFailuresAreRetryableAndOmitTheURL(t *testing.T) {
@@ -102,8 +104,27 @@ func TestOfflineDepsKeepTheArtworkTimeout(t *testing.T) {
 	}
 	// A deadline over the whole exchange would also count time spent writing
 	// to a slow client; only the store's own waits are bounded.
-	if artworkClient.Timeout != 0 || artworkClient.Transport.(*http.Transport).ResponseHeaderTimeout == 0 {
-		t.Fatal("artwork client timeouts changed")
+	if artworkClient.Timeout != 0 {
+		t.Fatal("artwork client has a whole-exchange deadline")
+	}
+
+	// The store must start answering within artworkStallTimeout.
+	release := make(chan struct{})
+	upstream := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) { <-release }))
+	defer upstream.Close()
+	defer close(release)
+	defer func(old time.Duration) { artworkStallTimeout = old }(artworkStallTimeout)
+	artworkStallTimeout = 50 * time.Millisecond
+	client := &http.Client{Transport: artworkTransport()}
+	req, err := http.NewRequestWithContext(netguard.WithPrivateAccess(t.Context()), http.MethodGet, upstream.URL, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if resp, err := client.Do(req); err == nil {
+		_ = resp.Body.Close()
+		t.Fatal("artwork fetch waited past the header timeout")
+	} else if !strings.Contains(err.Error(), "timeout awaiting response headers") {
+		t.Fatalf("artwork fetch error = %v, want a response header timeout", err)
 	}
 }
 
@@ -159,7 +180,8 @@ func TestArtworkSlowClientDoesNotTimeOutTheStore(t *testing.T) {
 		_, _ = w.Write(image)
 	}))
 	defer upstream.Close()
-	s := &Service{} // the production client
+	// The production client, reading an artwork store on loopback.
+	s := &Service{artworkStore: blobstoretest.NewDirect(upstream.URL)}
 	out := slowClientWriter{httptest.NewRecorder()}
 	if err := s.streamArtwork(context.Background(), out, nil, upstream.URL+"/backdrop.jpg"); err != nil || out.Body.Len() != len(image) {
 		t.Fatalf("err = %v, wrote %d of %d bytes", err, out.Body.Len(), len(image))
@@ -207,6 +229,29 @@ func TestArtworkStallBeforeFirstByteDropsImageHeaders(t *testing.T) {
 	}
 }
 
+// Artwork that is not on the artwork store, such as a metadata provider's URL
+// kept when caching it failed, may not reach the server's own network.
+func TestArtworkOffTheStoreStaysOffTheLocalNetwork(t *testing.T) {
+	var hits atomic.Int32
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		hits.Add(1)
+		_, _ = w.Write([]byte("internal response"))
+	}))
+	defer upstream.Close()
+	store := blobstoretest.NewDirect("http://storage.invalid")
+	s := &Service{artworkStore: store} // the production client
+
+	rec := httptest.NewRecorder()
+	err := s.streamArtwork(context.Background(), rec, nil, upstream.URL+"/poster.jpg")
+	// The refusal is permanent, so it is not reported as worth a retry.
+	if !errors.Is(err, ErrAssetNotFound) || errors.Is(err, ErrAssetUnavailable) || !errors.Is(err, netguard.ErrPrivateDestination) {
+		t.Fatalf("err = %v, want ErrAssetNotFound from netguard.ErrPrivateDestination", err)
+	}
+	if hits.Load() != 0 || rec.Body.Len() != 0 {
+		t.Fatalf("upstream hits = %d, body %q; want no request", hits.Load(), rec.Body.String())
+	}
+}
+
 // recordingRepair records the keys queued for artwork repair.
 type recordingRepair struct{ keys []string }
 
diff --git a/internal/downloads/preparations_test.go b/internal/downloads/preparations_test.go
index befda7769e..c449034c9c 100644
--- a/internal/downloads/preparations_test.go
+++ b/internal/downloads/preparations_test.go
@@ -308,6 +308,10 @@ func TestTerminalPreparationEventFollowsLinkedDownloadFailure(t *testing.T) {
 				}
 				statuses = append(statuses, status)
 			}
+			if err := rows.Err(); err != nil {
+				t.Errorf("read requesters: %v", err)
+				return
+			}
 			seen = append(seen, statuses)
 		})
 		return &seen
diff --git a/internal/downloads/remote_preparer_security_test.go b/internal/downloads/remote_preparer_security_test.go
index 9dffee5d44..d28f06239e 100644
--- a/internal/downloads/remote_preparer_security_test.go
+++ b/internal/downloads/remote_preparer_security_test.go
@@ -12,6 +12,7 @@ import (
 	"testing/synctest"
 
 	"github.com/prairie-server/prairie-server/internal/config"
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 	"github.com/prairie-server/prairie-server/internal/playback"
 	"github.com/prairie-server/prairie-server/internal/tonemap"
 )
@@ -27,9 +28,9 @@ func TestNodeAwarePreparerCapabilityProbeDoesNotForwardJWTOnRedirect(t *testing.
 	}))
 	defer redirectTarget.Close()
 
-	var sourceAuthorization atomic.Value
+	var sourceSigned atomic.Bool
 	source := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		sourceAuthorization.Store(r.Header.Get("Authorization"))
+		sourceSigned.Store(nodeauthtest.Signed(r, jwt))
 		http.Redirect(w, r, redirectTarget.URL+"/hw-capabilities", http.StatusFound)
 	}))
 	defer source.Close()
@@ -45,8 +46,8 @@ func TestNodeAwarePreparerCapabilityProbeDoesNotForwardJWTOnRedirect(t *testing.
 	preparer.probeClient = injectedClient
 
 	_, err := preparer.toneMapCapabilitiesForNode(context.Background(), source.URL)
-	if got, want := sourceAuthorization.Load(), "Bearer "+jwt; got != want {
-		t.Fatalf("source Authorization = %#v, want %q", got, want)
+	if !sourceSigned.Load() {
+		t.Fatal("source request was not signed with the shared secret")
 	}
 	if got := redirectTargetHits.Load(); got != 0 {
 		t.Fatalf("redirect target requests = %d, Authorization = %#v; want no redirect request", got, redirectTargetAuthorization.Load())
diff --git a/internal/downloads/remote_preparer_test.go b/internal/downloads/remote_preparer_test.go
index 2c53f4b7d8..4201060c4a 100644
--- a/internal/downloads/remote_preparer_test.go
+++ b/internal/downloads/remote_preparer_test.go
@@ -16,6 +16,7 @@ import (
 	"github.com/prairie-server/prairie-server/internal/config"
 	"github.com/prairie-server/prairie-server/internal/downloadprepare"
 	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 	"github.com/prairie-server/prairie-server/internal/nodepool"
 	"github.com/prairie-server/prairie-server/internal/playback"
 	"github.com/prairie-server/prairie-server/internal/tonemap"
@@ -790,8 +791,8 @@ func TestNodeAwarePreparerUsesTargetNodeProbeBudget(t *testing.T) {
 			w.WriteHeader(http.StatusNotFound)
 			return
 		}
-		if got, want := request.Header.Get("Authorization"), "Bearer secret"; got != want {
-			t.Errorf("Authorization = %q, want %q", got, want)
+		if !nodeauthtest.Signed(request, "secret") {
+			t.Errorf("request is not signed: Authorization = %q", request.Header.Get("Authorization"))
 			w.WriteHeader(http.StatusUnauthorized)
 			return
 		}
diff --git a/internal/downloads/repo.go b/internal/downloads/repo.go
index 70f1b85562..47a2048b58 100644
--- a/internal/downloads/repo.go
+++ b/internal/downloads/repo.go
@@ -81,7 +81,7 @@ func (r *Repository) WithUserQuotaLock(ctx context.Context, userID int, fn func(
 			return fmt.Errorf("acquiring download quota lock for user %d: %w", userID, err)
 		}
 		if acquired {
-			defer func() { _ = tx.Rollback(ctx) }()
+			defer func() { _ = tx.Rollback(ctx) }() //nolint:gocritic,revive // returns next; the lock transaction must outlive fn
 			return fn(ctx)
 		}
 		_ = tx.Rollback(ctx)
diff --git a/internal/downloads/service_remote_test.go b/internal/downloads/service_remote_test.go
index c73d639512..1f63619dfb 100644
--- a/internal/downloads/service_remote_test.go
+++ b/internal/downloads/service_remote_test.go
@@ -12,12 +12,13 @@ import (
 
 	"github.com/prairie-server/prairie-server/internal/config"
 	"github.com/prairie-server/prairie-server/internal/downloadprepare"
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 )
 
 func TestServiceRelaysRemoteArtifactOnEstablishedRoute(t *testing.T) {
 	const secret = "artifact-secret"
 	origin := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path != "/downloads/artifacts/artifact-1" || r.Header.Get("Authorization") != "Bearer "+secret {
+		if r.URL.Path != "/downloads/artifacts/artifact-1" || !nodeauthtest.Signed(r, secret) {
 			t.Errorf("origin request = %s %s auth=%q", r.Method, r.URL.Path, r.Header.Get("Authorization"))
 			http.Error(w, "unexpected origin request", http.StatusBadRequest)
 			return
diff --git a/internal/downloads/status_events.go b/internal/downloads/status_events.go
index 0c2fb98ef1..71fdea9f57 100644
--- a/internal/downloads/status_events.go
+++ b/internal/downloads/status_events.go
@@ -30,12 +30,27 @@ func (s *Service) ReportStatus(ctx context.Context, userID int, profileID, devic
 	d, err := s.repo.ReportStatus(ctx, userID, profileID, deviceID, id, event)
 	if err == nil && event.Status == StatusCompleted && s.artifacts != nil {
 		// A finished copy moves its prepared file from in use to cached and
-		// changes the device's row, so open storage views re-read.
+		// changes the device's row, so open storage views re-read. A late
+		// completion can also end the preparation it was waiting on.
 		s.artifacts.notifyStorageChanged(ctx)
+		if d.ArtifactID != "" {
+			s.artifacts.notifyPreparationChanged(ctx, d.ArtifactID)
+		}
 	}
 	return d, err
 }
 
+// expireUnneededQueuedJobSQL moves a job ($1) still waiting in the queue to
+// expired when no in-flight download needs its bytes. The row keeps the recipe
+// that finished downloads refer to. A job a worker may still hold, under its
+// own lease or the unowned one a pause leaves, finishes into the cache instead:
+// an expired row keeps its id and output path, so stopping a live encode could
+// race a later prepare-again.
+const expireUnneededQueuedJobSQL = `UPDATE download_artifacts a SET ` + expireArtifactAssignment + `, paused_at = NULL
+	WHERE a.id = $1 AND a.status IN ('queued', 'tone_map_queued', 'audio_v2_queued', 'tracks_v1_queued')
+	  AND a.lease_owner IS NULL AND (a.lease_expires_at IS NULL OR a.lease_expires_at <= now())
+	  AND NOT EXISTS (SELECT 1 FROM downloads d WHERE d.artifact_id = a.id AND ` + inFlightLinkPredicate + `)`
+
 // ReportStatus locks the existing lifecycle row. Late/equal events acknowledge
 // the current state; a report for replaced bytes cannot mutate the new revision.
 func (r *Repository) ReportStatus(ctx context.Context, userID int, profileID, deviceID, id string, event StatusEvent) (*Download, error) {
@@ -53,6 +68,16 @@ func (r *Repository) ReportStatus(ctx context.Context, userID int, profileID, de
 	}
 	switch current.Status {
 	case StatusReady, StatusDownloading, StatusCompleted:
+	case StatusPreparing:
+		// Recovery returns an in-flight download to preparing, at the same
+		// revision, when its prepared file goes missing. A device that fetched
+		// the whole file first still holds it, and its completion report can
+		// arrive after the reset, for example once the server update that lost
+		// the file is over. Only that report applies; a transfer-start report
+		// describes bytes the device can no longer fetch.
+		if event.Status != StatusCompleted {
+			return nil, ErrNotFound
+		}
 	default:
 		return nil, ErrNotFound
 	}
@@ -73,6 +98,12 @@ func (r *Repository) ReportStatus(ctx context.Context, userID int, profileID, de
 		if _, err := tx.Exec(ctx, `UPDATE download_artifacts SET last_used_at = now() WHERE id = $1`, updated.ArtifactID); err != nil {
 			return nil, fmt.Errorf("touching completed download's artifact: %w", err)
 		}
+		// A late completion may leave a requeued job that nobody waits for.
+		if current.Status == StatusPreparing {
+			if _, err := tx.Exec(ctx, expireUnneededQueuedJobSQL, updated.ArtifactID); err != nil {
+				return nil, fmt.Errorf("expiring unneeded preparation: %w", err)
+			}
+		}
 	}
 	if err := tx.Commit(ctx); err != nil {
 		return nil, err
diff --git a/internal/downloads/status_events_test.go b/internal/downloads/status_events_test.go
index 0ab657d235..b31d910d3d 100644
--- a/internal/downloads/status_events_test.go
+++ b/internal/downloads/status_events_test.go
@@ -150,10 +150,16 @@ func TestDownloadStatusEventsPostgres(t *testing.T) {
 	if _, err := repo.pool.Exec(t.Context(), `UPDATE downloads SET status='preparing' WHERE id='entry'`); err != nil {
 		t.Fatal(err)
 	}
+	// A preparing row takes only a completion: the device may have fetched the
+	// file before recovery reset the row. A transfer start cannot apply.
 	event.UpdatedAt = event.UpdatedAt.Add(time.Minute)
-	if _, err := service.ReportStatus(t.Context(), 1, "one", "device", "entry", event); !errors.Is(err, ErrNotFound) {
+	if _, err := service.ReportStatus(t.Context(), 1, "one", "device", "entry", StatusEvent{Status: StatusDownloading, UpdatedAt: event.UpdatedAt, Revision: 2}); !errors.Is(err, ErrNotFound) {
 		t.Fatal(err)
 	}
+	got, err = service.ReportStatus(t.Context(), 1, "one", "device", "entry", event)
+	if err != nil || got.Status != StatusCompleted {
+		t.Fatalf("completion of a preparing row: %+v %v", got, err)
+	}
 }
 
 func TestDownloadStatusEventValidation(t *testing.T) {
diff --git a/internal/downloads/storage_maintenance.go b/internal/downloads/storage_maintenance.go
index 64658f133a..42cbae8bc8 100644
--- a/internal/downloads/storage_maintenance.go
+++ b/internal/downloads/storage_maintenance.go
@@ -632,7 +632,8 @@ func (m *ArtifactManager) reconcileServer(ctx context.Context, remove bool, acto
 		return summary, nil
 	}
 	summary := sumUntracked(untracked)
-	return summary, m.repo.UpsertStorageSample(ctx, 0, m.owner, listing.Usage, &summary)
+	err = m.repo.UpsertStorageSample(ctx, 0, m.owner, listing.Usage, &summary)
+	return summary, err
 }
 
 // reconcileNode lists one node's artifact directory and records its untracked
@@ -656,7 +657,8 @@ func (m *ArtifactManager) reconcileNode(ctx context.Context, n *nodepool.Node, r
 	untracked := findUntracked(listing.Files, nodeArtifactFileName, tracked, time.Now())
 	if !remove {
 		summary := sumUntracked(untracked)
-		return summary, m.repo.UpsertStorageSample(ctx, n.ID, "", listing.Usage, &summary)
+		err = m.repo.UpsertStorageSample(ctx, n.ID, "", listing.Usage, &summary)
+		return summary, err
 	}
 	var removed, left []downloadstorage.File
 	deleted := make(map[string]bool)
diff --git a/internal/downloads/storage_test.go b/internal/downloads/storage_test.go
index 511fffbf8d..307d318b00 100644
--- a/internal/downloads/storage_test.go
+++ b/internal/downloads/storage_test.go
@@ -81,6 +81,9 @@ func eventReasons(t *testing.T, pool *pgxpool.Pool, artifactID string) []string
 		}
 		out = append(out, r)
 	}
+	if err := rows.Err(); err != nil {
+		t.Fatal(err)
+	}
 	return out
 }
 
diff --git a/internal/ebookconvert/cache.go b/internal/ebookconvert/cache.go
index 64a9c79071..08b0f1928a 100644
--- a/internal/ebookconvert/cache.go
+++ b/internal/ebookconvert/cache.go
@@ -145,7 +145,7 @@ func (c *Cache) GetOrConvert(ctx context.Context, srcPath string, key SourceKey)
 		// Convert to a temp file in the cache dir, then atomically rename in.
 		tmp, tmpErr := os.CreateTemp(c.opts.Dir, "converting-*.epub")
 		if tmpErr != nil {
-			return "", fmt.Errorf("%w: cache temp: %w", ErrConversionFailed, tmpErr)
+			return "", fmt.Errorf("%w: cache temp: %v", ErrConversionFailed, tmpErr) //nolint:errorlint // callers classify by the verdict sentinel; the filesystem error is only reported
 		}
 		tmpPath := tmp.Name()
 		_ = tmp.Close()
@@ -158,7 +158,7 @@ func (c *Cache) GetOrConvert(ctx context.Context, srcPath string, key SourceKey)
 		}
 		if renErr := os.Rename(tmpPath, dst); renErr != nil {
 			_ = os.Remove(tmpPath)
-			return "", fmt.Errorf("%w: cache rename: %w", ErrConversionFailed, renErr)
+			return "", fmt.Errorf("%w: cache rename: %v", ErrConversionFailed, renErr) //nolint:errorlint // callers classify by the verdict sentinel; the filesystem error is only reported
 		}
 		c.enforceBudget(dst)
 		return dst, nil
@@ -169,11 +169,7 @@ func (c *Cache) GetOrConvert(ctx context.Context, srcPath string, key SourceKey)
 		if res.Err != nil {
 			return "", res.Err
 		}
-		path, ok := res.Val.(string)
-		if !ok {
-			return "", fmt.Errorf("ebook convert cache: unexpected value type %T", res.Val)
-		}
-		return path, nil
+		return res.Val.(string), nil //nolint:errcheck,forcetypeassert // c.group's only DoChan closure returns a string
 	case <-ctx.Done():
 		return "", ctx.Err()
 	}
diff --git a/internal/ebooks/enrichment_queue_test.go b/internal/ebooks/enrichment_queue_test.go
index afd9a3aab9..92dbb8e5e9 100644
--- a/internal/ebooks/enrichment_queue_test.go
+++ b/internal/ebooks/enrichment_queue_test.go
@@ -217,6 +217,9 @@ func TestEnrichmentQueueReconcileMissingIsBoundedAndLaneSafe(t *testing.T) {
 		}
 	}
 	windowAt := strings.Index(query, "membership_candidates AS MATERIALIZED")
+	if windowAt < 0 {
+		t.Fatalf("reconcile query has no membership_candidates CTE:\n%s", query)
+	}
 	boundedQuery := query[windowAt:]
 	limitAt := strings.Index(boundedQuery, "LIMIT $3")
 	itemJoinAt := strings.Index(boundedQuery, "JOIN media_items mi")
diff --git a/internal/events/socket_ticket.go b/internal/events/socket_ticket.go
index c096a04b77..e988970020 100644
--- a/internal/events/socket_ticket.go
+++ b/internal/events/socket_ticket.go
@@ -29,6 +29,9 @@ type SocketIdentity struct {
 	ProfileToken       string    `json:"profile_token"`
 	AccessExpiresAt    time.Time `json:"access_expires_at"`
 	TicketExpiresAt    time.Time `json:"ticket_expires_at"`
+	// DeviceID is the minting request's X-Prairie-Device-Id, which the
+	// acting-admin decision reads as the HTTP admin gate does.
+	DeviceID string `json:"device_id,omitempty"`
 }
 
 var ErrSocketTicket = errors.New("invalid or unavailable realtime credential")
diff --git a/internal/historyimport/emby_client.go b/internal/historyimport/emby_client.go
index ec51c610e0..93ed8753eb 100644
--- a/internal/historyimport/emby_client.go
+++ b/internal/historyimport/emby_client.go
@@ -92,6 +92,17 @@ type embyItem struct {
 	} `json:"UserData"`
 }
 
+func (item embyItem) retainedSize() int64 {
+	size := sizeOf[embyItem]() + stringBytes(item.ID, item.Name, item.Type, item.SeriesName, item.SeriesID) + stringMapBytes(item.ProviderIDs)
+	if item.UserData.LastPlayedDate != nil {
+		size += sizeOf[time.Time]()
+	}
+	if item.UserData.UnplayedItemCount != nil {
+		size += sizeOf[int]()
+	}
+	return size
+}
+
 type embyLocalAuth struct {
 	BaseURL     string
 	UserID      string
@@ -253,6 +264,9 @@ func (c *EmbyClient) fetchItems(ctx context.Context, auth embyLocalAuth, endpoin
 		if err == nil {
 			err = budget.addItems(len(payload.Items))
 		}
+		if err == nil {
+			err = retainItems(ctx, payload.Items)
+		}
 		if err != nil {
 			return nil, fmt.Errorf("fetching Emby %s with filter %q: %w", endpoint, filter, err)
 		}
@@ -290,7 +304,11 @@ func (c *EmbyClient) FetchItemsByIDs(ctx context.Context, auth embyLocalAuth, id
 		if err != nil {
 			return nil, fmt.Errorf("fetching Emby items by ids: %w", err)
 		}
-		items = append(items, payload.Items...)
+		kept := keepRequested(payload.Items, chunk, func(item embyItem) string { return item.ID })
+		if err := retainItems(ctx, kept); err != nil {
+			return nil, fmt.Errorf("fetching Emby items by ids: %w", err)
+		}
+		items = append(items, kept...)
 	}
 	return items, nil
 }
@@ -334,7 +352,7 @@ func (c *EmbyClient) doJSONWithBudget(req *http.Request, out any, budget *listin
 		discardUpstreamBody(resp.Body)
 		return nil
 	}
-	return decodeUpstreamJSON(resp.Body, out, budget)
+	return decodeUpstreamJSON(req.Context(), resp.Body, out, budget)
 }
 
 type embyHTTPError struct {
diff --git a/internal/historyimport/jellyfin_client.go b/internal/historyimport/jellyfin_client.go
index 66eddf146a..dd01ec3c84 100644
--- a/internal/historyimport/jellyfin_client.go
+++ b/internal/historyimport/jellyfin_client.go
@@ -72,6 +72,14 @@ type jellyfinUserData struct {
 	IsFavorite            bool       `json:"IsFavorite"`
 }
 
+func (item jellyfinItem) retainedSize() int64 {
+	size := sizeOf[jellyfinItem]() + stringBytes(item.ID, item.Name, item.Type, item.SeriesName, item.SeriesID) + stringMapBytes(item.ProviderIDs)
+	if item.UserData.LastPlayedDate != nil {
+		size += sizeOf[time.Time]()
+	}
+	return size
+}
+
 type jellyfinLocalAuth struct{ BaseURL, UserID, AccessToken string }
 
 // jellyfinBaseURL normalizes a configured server address. Jellyfin answers
@@ -133,13 +141,14 @@ func (c *JellyfinClient) FetchItemsByIDs(ctx context.Context, auth jellyfinLocal
 	var allItems []jellyfinItem
 	for start := 0; start < len(ids); start += jellyfinIDChunkSize {
 		end := min(start+jellyfinIDChunkSize, len(ids))
+		chunk := ids[start:end]
 
 		query := url.Values{}
 		query.Set("UserId", auth.UserID)
 		query.Set("Recursive", "true")
 		query.Set("EnableUserData", "true")
 		query.Set("Fields", jellyfinItemFields)
-		query.Set("Ids", strings.Join(ids[start:end], ","))
+		query.Set("Ids", strings.Join(chunk, ","))
 		if strings.TrimSpace(includeItemTypes) != "" {
 			query.Set("IncludeItemTypes", includeItemTypes)
 		}
@@ -154,7 +163,11 @@ func (c *JellyfinClient) FetchItemsByIDs(ctx context.Context, auth jellyfinLocal
 		if err := c.doJSON(req, &payload); err != nil {
 			return nil, fmt.Errorf("fetching Jellyfin items by ids: %w", err)
 		}
-		allItems = append(allItems, payload.Items...)
+		items := keepRequested(payload.Items, chunk, func(item jellyfinItem) string { return item.ID })
+		if err := retainItems(ctx, items); err != nil {
+			return nil, fmt.Errorf("fetching Jellyfin items by ids: %w", err)
+		}
+		allItems = append(allItems, items...)
 	}
 	return allItems, nil
 }
@@ -213,6 +226,9 @@ func (c *JellyfinClient) fetchPagedItems(ctx context.Context, auth jellyfinLocal
 		if err := budget.addItems(len(payload.Items)); err != nil {
 			return nil, err
 		}
+		if err := retainItems(ctx, payload.Items); err != nil {
+			return nil, err
+		}
 
 		allItems = append(allItems, payload.Items...)
 		startIndex += len(payload.Items)
@@ -242,7 +258,7 @@ func (c *JellyfinClient) doJSONWithBudget(req *http.Request, out any, budget *li
 		body := readUpstreamErrorBody(resp.Body)
 		return &jellyfinHTTPError{StatusCode: resp.StatusCode, Body: strings.TrimSpace(string(body))}
 	}
-	return decodeUpstreamJSON(resp.Body, out, budget)
+	return decodeUpstreamJSON(req.Context(), resp.Body, out, budget)
 }
 
 type jellyfinHTTPError struct {
diff --git a/internal/historyimport/plex_client.go b/internal/historyimport/plex_client.go
index 44096f8dbf..332d9cb2ad 100644
--- a/internal/historyimport/plex_client.go
+++ b/internal/historyimport/plex_client.go
@@ -241,12 +241,24 @@ type PlexItem struct {
 	Guid                 PlexGuids `json:"Guid"`
 }
 
+func (item PlexItem) retainedSize() int64 {
+	return sizeOf[PlexItem]() + stringBytes(item.RatingKey, item.Key, item.Type, item.Title, item.GrandparentTitle, item.GrandparentRatingKey) + item.Guid.retainedSize()
+}
+
 type PlexGuid struct {
 	ID string `json:"id"`
 }
 
 type PlexGuids []PlexGuid
 
+func (g PlexGuids) retainedSize() int64 {
+	size := int64(len(g)) * sizeOf[PlexGuid]()
+	for _, guid := range g {
+		size += int64(len(guid.ID))
+	}
+	return size
+}
+
 func (g *PlexGuids) UnmarshalJSON(data []byte) error {
 	if string(data) == "null" {
 		*g = nil
@@ -343,6 +355,9 @@ func (c *PlexClient) fetchSectionItems(ctx context.Context, baseURL, token, sect
 		if err == nil {
 			err = budget.addItems(len(container.items()))
 		}
+		if err == nil {
+			err = retainItems(ctx, container.items())
+		}
 		if err != nil {
 			return nil, fmt.Errorf("fetching Plex section items (section %s, type %d, offset %d): %w", sectionKey, mediaType, offset, err)
 		}
@@ -392,6 +407,9 @@ func (c *PlexClient) FetchWatchlist(ctx context.Context, accountToken string) ([
 		if err == nil {
 			err = budget.addItems(len(container.items()))
 		}
+		if err == nil {
+			err = retainItems(ctx, container.items())
+		}
 		if err != nil {
 			return nil, nil, fmt.Errorf("fetching Plex watchlist (offset %d): %w", offset, err)
 		}
@@ -479,6 +497,9 @@ func (c *PlexClient) fetchWatchlistItemMetadata(ctx context.Context, base, accou
 	if len(items) == 0 {
 		return nil, nil
 	}
+	if err := retainItems(ctx, items[:1]); err != nil {
+		return nil, err
+	}
 	return &items[0], nil
 }
 
@@ -514,7 +535,11 @@ func (c *PlexClient) FetchMetadataBatch(ctx context.Context, baseURL, token stri
 	if err := c.doJSON(req, &container); err != nil {
 		return nil, fmt.Errorf("fetching Plex metadata for %s: %w", strings.Join(ratingKeys, ","), err)
 	}
-	return container.items(), nil
+	items := keepRequested(container.items(), ratingKeys, func(item PlexItem) string { return item.RatingKey })
+	if err := retainItems(ctx, items); err != nil {
+		return nil, fmt.Errorf("fetching Plex metadata for %s: %w", strings.Join(ratingKeys, ","), err)
+	}
+	return items, nil
 }
 
 // Authenticate exchanges Plex account credentials for an auth token via plex.tv.
@@ -571,7 +596,7 @@ func (c *PlexClient) doJSONWithBudget(req *http.Request, out any, budget *listin
 		discardUpstreamBody(resp.Body)
 		return nil
 	}
-	return decodeUpstreamJSON(resp.Body, out, budget)
+	return decodeUpstreamJSON(req.Context(), resp.Body, out, budget)
 }
 
 type plexHTTPError struct {
@@ -650,6 +675,10 @@ type PlexHistoryItem struct {
 	Guid                 PlexGuids `json:"Guid"`
 }
 
+func (item PlexHistoryItem) retainedSize() int64 {
+	return sizeOf[PlexHistoryItem]() + stringBytes(item.RatingKey, item.Key, item.Type, item.Title, item.GrandparentTitle, item.GrandparentKey, item.GrandparentRatingKey) + item.Guid.retainedSize()
+}
+
 // FetchUserHistory returns the complete watch history for a specific account on the
 // Plex Media Server. Requires an admin token.
 func (c *PlexClient) FetchUserHistory(ctx context.Context, baseURL, token, accountID string) ([]PlexHistoryItem, error) {
@@ -683,6 +712,9 @@ func (c *PlexClient) FetchUserHistory(ctx context.Context, baseURL, token, accou
 		if err == nil {
 			err = budget.addItems(len(container.MediaContainer.Metadata))
 		}
+		if err == nil {
+			err = retainItems(ctx, container.MediaContainer.Metadata)
+		}
 		if err != nil {
 			return nil, fmt.Errorf("fetching Plex user history (account %s, offset %d): %w", accountID, offset, err)
 		}
diff --git a/internal/historyimport/repo_admin.go b/internal/historyimport/repo_admin.go
index 0000bb0a1b..fa56b0f4df 100644
--- a/internal/historyimport/repo_admin.go
+++ b/internal/historyimport/repo_admin.go
@@ -194,16 +194,10 @@ func (r *Repository) ListAllRuns(ctx context.Context, sourceID *int, limit int)
 		limit = 200
 	}
 
-	var rows interface {
-		Close()
-		Next() bool
-		Scan(dest ...any) error
-		Err() error
-	}
-	var err error
-
+	var query string
+	var args []any
 	if sourceID != nil {
-		rows, err = r.pool.Query(ctx, `
+		query = `
 			SELECT r.id, r.user_id, r.profile_id, r.source_type, r.connection_mode, r.status,
 			       r.mapping_id,
 			       r.fetched, r.matched, r.unmatched, r.progress_updated, r.history_created, r.watchlist_added, r.favorites_imported, r.skipped,
@@ -213,9 +207,10 @@ func (r *Repository) ListAllRuns(ctx context.Context, sourceID *int, limit int)
 			LEFT JOIN history_import_user_mappings m ON r.mapping_id = m.id
 			WHERE COALESCE(r.dispatch_source_id,m.source_id) = $1
 			ORDER BY r.created_at DESC, r.id DESC
-			LIMIT $2`, *sourceID, limit)
+			LIMIT $2`
+		args = []any{*sourceID, limit}
 	} else {
-		rows, err = r.pool.Query(ctx, `
+		query = `
 			SELECT id, user_id, profile_id, source_type, connection_mode, status,
 			       mapping_id,
 			       fetched, matched, unmatched, progress_updated, history_created, watchlist_added, favorites_imported, skipped,
@@ -223,8 +218,10 @@ func (r *Repository) ListAllRuns(ctx context.Context, sourceID *int, limit int)
 			       created_at, started_at, completed_at, cancel_requested_at IS NOT NULL
 			FROM history_import_runs
 			ORDER BY created_at DESC, id DESC
-			LIMIT $1`, limit)
+			LIMIT $1`
+		args = []any{limit}
 	}
+	rows, err := r.pool.Query(ctx, query, args...)
 	if err != nil {
 		return nil, fmt.Errorf("listing all history import runs: %w", err)
 	}
@@ -253,16 +250,10 @@ func (r *Repository) GetRunByID(ctx context.Context, runID string) (*Run, error)
 }
 
 func (r *Repository) ListActiveRuns(ctx context.Context, sourceID *int) ([]Run, error) {
-	var rows interface {
-		Close()
-		Next() bool
-		Scan(dest ...any) error
-		Err() error
-	}
-	var err error
-
+	var query string
+	var args []any
 	if sourceID != nil {
-		rows, err = r.pool.Query(ctx, `
+		query = `
 			SELECT r.id, r.user_id, r.profile_id, r.source_type, r.connection_mode, r.status,
 			       r.mapping_id,
 			       r.fetched, r.matched, r.unmatched, r.progress_updated, r.history_created, r.watchlist_added, r.favorites_imported, r.skipped,
@@ -272,9 +263,10 @@ func (r *Repository) ListActiveRuns(ctx context.Context, sourceID *int) ([]Run,
 			LEFT JOIN history_import_user_mappings m ON r.mapping_id = m.id
 			WHERE COALESCE(r.dispatch_source_id,m.source_id) = $1
 			  AND r.status IN ($2, $3)
-			ORDER BY r.created_at DESC, r.id DESC`, *sourceID, RunStatusQueued, RunStatusRunning)
+			ORDER BY r.created_at DESC, r.id DESC`
+		args = []any{*sourceID, RunStatusQueued, RunStatusRunning}
 	} else {
-		rows, err = r.pool.Query(ctx, `
+		query = `
 			SELECT id, user_id, profile_id, source_type, connection_mode, status,
 			       mapping_id,
 			       fetched, matched, unmatched, progress_updated, history_created, watchlist_added, favorites_imported, skipped,
@@ -282,8 +274,10 @@ func (r *Repository) ListActiveRuns(ctx context.Context, sourceID *int) ([]Run,
 			       created_at, started_at, completed_at, cancel_requested_at IS NOT NULL
 			FROM history_import_runs
 			WHERE status IN ($1, $2)
-			ORDER BY created_at DESC, id DESC`, RunStatusQueued, RunStatusRunning)
+			ORDER BY created_at DESC, id DESC`
+		args = []any{RunStatusQueued, RunStatusRunning}
 	}
+	rows, err := r.pool.Query(ctx, query, args...)
 	if err != nil {
 		return nil, fmt.Errorf("listing active history import runs: %w", err)
 	}
@@ -372,14 +366,7 @@ func scanAdminRun(s adminRunScanner) (*Run, error) {
 	return scanRunWithMappingID(s)
 }
 
-type adminRunsRowSet interface {
-	Close()
-	Next() bool
-	Scan(dest ...any) error
-	Err() error
-}
-
-func scanAdminRuns(rows adminRunsRowSet) ([]Run, error) {
+func scanAdminRuns(rows pgx.Rows) ([]Run, error) {
 	var runs []Run
 	for rows.Next() {
 		run, err := scanRunWithMappingID(rows)
diff --git a/internal/historyimport/repo_test.go b/internal/historyimport/repo_test.go
index d590f8fc0d..73e0dee2b2 100644
--- a/internal/historyimport/repo_test.go
+++ b/internal/historyimport/repo_test.go
@@ -5,6 +5,7 @@ import (
 	"crypto/rand"
 	"encoding/json"
 	"fmt"
+	"strings"
 	"testing"
 	"time"
 
@@ -293,7 +294,7 @@ func TestSourceAdminTokenEncryptionUsesSourceAAD(t *testing.T) {
 	if err != nil {
 		t.Fatalf("encryptSourceAdminToken: %v", err)
 	}
-	if ciphertext == "admin-token" || bytes.Contains([]byte(ciphertext), []byte("admin-token")) {
+	if strings.Contains(ciphertext, "admin-token") {
 		t.Fatalf("encrypted admin token leaked plaintext: %q", ciphertext)
 	}
 	plaintext, err := repo.cipher.Decrypt(ciphertext, sourceAdminTokenAAD(42))
diff --git a/internal/historyimport/run_limits_test.go b/internal/historyimport/run_limits_test.go
new file mode 100644
index 0000000000..d799f70f6b
--- /dev/null
+++ b/internal/historyimport/run_limits_test.go
@@ -0,0 +1,409 @@
+package historyimport
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"runtime"
+	"slices"
+	"strconv"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/prairie-server/prairie-server/internal/userstore/pgstore"
+	"github.com/prairie-server/prairie-server/internal/watchstate"
+)
+
+// These tests drive whole personal import runs, from the queue through the
+// provider to Postgres, against fake Jellyfin, Emby, and Plex servers.
+
+const (
+	// limitsSeriesCount spreads the filler episodes over enough series that
+	// every ID lookup runs in several chunks.
+	limitsSeriesCount = 250
+	// limitsMatchedSeries is the series whose S01E01 exists in the catalog.
+	limitsMatchedSeries = 7
+	// limitsUnrequestedPerLookup is how many items a lookup answers with
+	// that nobody asked for.
+	limitsUnrequestedPerLookup = 500
+)
+
+// limitsPadding makes every listed item heavy with fields the importer skips.
+var limitsPadding = func() string {
+	var streams []string
+	for i := range 10 {
+		streams = append(streams, fmt.Sprintf(`{"Index":%d,"Type":"Subtitle","Codec":"srt","Language":"eng","DisplayTitle":"English","IsDefault":false,"IsForced":false,"IsExternal":true}`, i))
+	}
+	return `"Overview":"` + strings.Repeat("o", 4<<10) + `","MediaStreams":[` + strings.Join(streams, ",") + `]`
+}()
+
+// limitsObserved records the shape of the requests one fake upstream saw.
+type limitsObserved struct {
+	mu         sync.Mutex
+	maxPage    int
+	maxLookup  int
+	lookedUp   map[string]bool
+	listings   int
+	unexpected []string
+}
+
+func newLimitsObserved() *limitsObserved {
+	return &limitsObserved{lookedUp: map[string]bool{}}
+}
+
+func (o *limitsObserved) page(size int) {
+	o.mu.Lock()
+	defer o.mu.Unlock()
+	o.listings++
+	o.maxPage = max(o.maxPage, size)
+}
+
+func (o *limitsObserved) lookup(ids []string) {
+	o.mu.Lock()
+	defer o.mu.Unlock()
+	o.maxLookup = max(o.maxLookup, len(ids))
+	for _, id := range ids {
+		o.lookedUp[id] = true
+	}
+}
+
+func (o *limitsObserved) unexpectedRequest(r *http.Request) {
+	o.mu.Lock()
+	defer o.mu.Unlock()
+	o.unexpected = append(o.unexpected, r.Method+" "+r.URL.Path)
+}
+
+// pageOf returns items[start:start+limit] clamped to the slice.
+func pageOf(items []string, start, limit int) []string {
+	start = min(max(start, 0), len(items))
+	return items[start:min(start+limit, len(items))]
+}
+
+// limitsEpisodes returns n filler episodes plus the one episode that matches
+// the catalog, which comes last so it only arrives with the final page.
+func limitsEpisodes(n int, episode func(id, seriesID string, season, number int) string) []string {
+	items := make([]string, 0, n+1)
+	for i := range n {
+		items = append(items, episode(
+			"ep-"+strconv.Itoa(i), "series-"+strconv.Itoa(i%limitsSeriesCount), 5, i+1))
+	}
+	return append(items, episode("ep-matched", "series-"+strconv.Itoa(limitsMatchedSeries), 1, 1))
+}
+
+// limitsLookupAnswer answers an ID lookup with each requested item twice and
+// a batch of items nobody asked for.
+func limitsLookupAnswer(ids []string, item func(id string) string) string {
+	var parts []string
+	for _, id := range ids {
+		parts = append(parts, item(id), item(id))
+	}
+	for i := range limitsUnrequestedPerLookup {
+		parts = append(parts, item("unrequested-"+strconv.Itoa(i)))
+	}
+	return strings.Join(parts, ",")
+}
+
+func limitsSeriesTVDB(id string) string {
+	if id == "series-"+strconv.Itoa(limitsMatchedSeries) {
+		return "9000"
+	}
+	return "1" + strings.TrimPrefix(id, "series-")
+}
+
+func jellyfinLimitsEpisode(id, seriesID string, season, number int) string {
+	return fmt.Sprintf(`{"Id":%q,"Name":"Episode","Type":"Episode","SeriesId":%q,"SeriesName":"Show","ParentIndexNumber":%d,"IndexNumber":%d,"RunTimeTicks":1000000000,"UserData":{"Played":true,"PlayCount":1,"LastPlayedDate":"2026-09-02T00:00:00Z"},%s}`,
+		id, seriesID, season, number, limitsPadding)
+}
+
+const limitsMovie = `{"Id":"movie-1","Name":"Movie","Type":"Movie","ProviderIds":{"Imdb":"tt1234567"},"RunTimeTicks":1000000000,"UserData":{"Played":true,"PlayCount":1,"LastPlayedDate":"2026-09-01T00:00:00Z"}}`
+
+// embyJellyfinLimitsHandler serves the Emby and Jellyfin item APIs, which share
+// their wire format. played is the IsPlayed listing; lookups by Ids answer
+// with series ids that the matcher resolves.
+func embyJellyfinLimitsHandler(t *testing.T, observed *limitsObserved, pageSize int, played []string, playedBody []byte) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		query := r.URL.Query()
+		switch {
+		case strings.HasSuffix(r.URL.Path, "/Users/AuthenticateByName"):
+			_, _ = w.Write([]byte(`{"AccessToken":"server-token","User":{"Id":"external"}}`))
+		case query.Get("Ids") != "":
+			ids := strings.Split(query.Get("Ids"), ",")
+			observed.lookup(ids)
+			_, _ = w.Write([]byte(`{"Items":[` + limitsLookupAnswer(ids, func(id string) string {
+				return fmt.Sprintf(`{"Id":%q,"Name":"Show","Type":"Series","ProviderIds":{"Tvdb":%q},%s}`, id, limitsSeriesTVDB(id), limitsPadding)
+			}) + `]}`))
+		case query.Get("Filters") == "IsPlayed":
+			if playedBody != nil {
+				_, _ = w.Write(playedBody)
+				return
+			}
+			limit, err := strconv.Atoi(query.Get("Limit"))
+			if err != nil || limit > pageSize {
+				t.Errorf("played listing Limit = %q, want at most %d", query.Get("Limit"), pageSize)
+			}
+			start, _ := strconv.Atoi(query.Get("StartIndex"))
+			observed.page(limit)
+			_, _ = fmt.Fprintf(w, `{"TotalRecordCount":%d,"Items":[%s]}`, len(played), strings.Join(pageOf(played, start, limit), ","))
+		case strings.HasSuffix(r.URL.Path, "/Items") || strings.HasSuffix(r.URL.Path, "/Resume"):
+			// Favorites and resume positions are empty.
+			_, _ = w.Write([]byte(`{"TotalRecordCount":0,"Items":[]}`))
+		default:
+			observed.unexpectedRequest(r)
+			http.NotFound(w, r)
+		}
+	})
+}
+
+func plexLimitsEpisode(id, seriesID string, season, number int) string {
+	return fmt.Sprintf(`{"ratingKey":%q,"key":"/library/metadata/%s","type":"episode","title":"Episode","grandparentTitle":"Show","grandparentRatingKey":%q,"parentIndex":%d,"index":%d,"duration":100000,"viewCount":1,"lastViewedAt":1788307200,%s}`,
+		id, id, seriesID, season, number, limitsPadding)
+}
+
+const plexLimitsMovie = `{"ratingKey":"movie-1","type":"movie","title":"Movie","year":2026,"Guid":[{"id":"imdb://tt1234567"}],"duration":100000,"viewCount":1,"lastViewedAt":1788220800}`
+
+func plexLimitsHandler(t *testing.T, observed *limitsObserved, episodes []string, playedBody []byte) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		query := r.URL.Query()
+		switch {
+		case r.URL.Path == "/library/sections":
+			_, _ = w.Write([]byte(`{"MediaContainer":{"Directory":[{"key":"1","type":"movie","title":"Movies"},{"key":"2","type":"show","title":"Shows"}]}}`))
+		case r.URL.Path == "/library/sections/1/all" || r.URL.Path == "/library/sections/2/all":
+			if query.Get("inProgress") == "1" {
+				_, _ = w.Write([]byte(`{"MediaContainer":{"totalSize":0,"Metadata":[]}}`))
+				return
+			}
+			if r.URL.Path == "/library/sections/1/all" {
+				_, _ = w.Write([]byte(`{"MediaContainer":{"totalSize":1,"Metadata":[` + plexLimitsMovie + `]}}`))
+				return
+			}
+			if playedBody != nil {
+				_, _ = w.Write(playedBody)
+				return
+			}
+			limit, err := strconv.Atoi(query.Get("X-Plex-Container-Size"))
+			if err != nil || limit > plexPageSize {
+				t.Errorf("section page size = %q, want at most %d", query.Get("X-Plex-Container-Size"), plexPageSize)
+			}
+			start, _ := strconv.Atoi(query.Get("X-Plex-Container-Start"))
+			observed.page(limit)
+			_, _ = fmt.Fprintf(w, `{"MediaContainer":{"totalSize":%d,"Metadata":[%s]}}`, len(episodes), strings.Join(pageOf(episodes, start, limit), ","))
+		case strings.HasPrefix(r.URL.Path, "/library/metadata/"):
+			keys := strings.Split(strings.TrimPrefix(r.URL.Path, "/library/metadata/"), ",")
+			observed.lookup(keys)
+			_, _ = w.Write([]byte(`{"MediaContainer":{"Metadata":[` + limitsLookupAnswer(keys, func(key string) string {
+				return fmt.Sprintf(`{"ratingKey":%q,"type":"show","title":"Show","Guid":[{"id":"tvdb://%s"}],"Role":[{"tag":"Actor","role":"Role"}]}`, key, limitsSeriesTVDB(key))
+			}) + `]}}`))
+		default:
+			observed.unexpectedRequest(r)
+			http.NotFound(w, r)
+		}
+	})
+}
+
+// limitsRepository is the personal-run schema plus one movie and one episode
+// of a series in the catalog.
+func limitsRepository(t *testing.T) *Repository {
+	t.Helper()
+	repo := personalEffectRepository(t)
+	makeUserOneAdmin(t, repo)
+	if _, err := repo.pool.Exec(t.Context(), `INSERT INTO media_items VALUES('series','series','Show',2020,'matched',NULL,NULL,'9000');
+ CREATE TABLE episodes(content_id text PRIMARY KEY,series_id text,title text,season_number integer,episode_number integer,imdb_id text,tmdb_id text,tvdb_id text);
+ INSERT INTO episodes VALUES('episode','series','Pilot',1,1,NULL,NULL,NULL)`); err != nil {
+		t.Fatal(err)
+	}
+	return repo
+}
+
+// runLimitsImport queues one personal run with input and waits for it to end.
+func runLimitsImport(t *testing.T, repo *Repository, input CreateRunInput, discoverURL string) Run {
+	t.Helper()
+	ctx, stop := context.WithCancel(t.Context())
+	defer stop()
+	service := NewService(ctx, repo, pgstore.NewPostgresProvider(repo.pool))
+	service.SetLocalNetworkAccess(NewLocalNetworkAccess(nil, repo))
+	service.plex.discoverBaseURL = discoverURL
+	service.SetStableIdentityResolver(watchstate.NewStableIdentityResolver(startupIdentityItems{}, nil, startupIdentityProviders{}))
+	observed := make(chan Run, 64)
+	service.AddObserver(queueObserverFunc(func(run Run) {
+		select {
+		case observed <- run:
+		default:
+		}
+	}))
+	service.StartBackgroundWork()
+	input.ProfileID = "p"
+	run, err := service.CreateRun(t.Context(), 1, input)
+	if err != nil {
+		t.Fatal(err)
+	}
+	timeout := time.NewTimer(60 * time.Second)
+	defer timeout.Stop()
+	for {
+		select {
+		case got := <-observed:
+			if got.ID == run.ID && (got.Status == RunStatusCompleted || got.Status == RunStatusFailed || got.Status == RunStatusCancelled) {
+				return got
+			}
+		case <-timeout.C:
+			t.Fatal("import run never ended")
+		}
+	}
+}
+
+func limitsHistory(t *testing.T, repo *Repository) []string {
+	t.Helper()
+	rows, err := repo.pool.Query(t.Context(), `SELECT media_item_id||'@'||to_char(watched_at AT TIME ZONE 'UTC','YYYY-MM-DD') FROM user_watch_history WHERE user_id=1 AND profile_id='p' ORDER BY 1`)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer rows.Close()
+	var history []string
+	for rows.Next() {
+		var entry string
+		if err := rows.Scan(&entry); err != nil {
+			t.Fatal(err)
+		}
+		history = append(history, entry)
+	}
+	if err := rows.Err(); err != nil {
+		t.Fatal(err)
+	}
+	return history
+}
+
+type limitsSource struct {
+	name       string
+	pageSize   int
+	lookupSize int
+	// episodes is how many filler episodes the played listing holds.
+	episodes int
+	// expanding is a played listing within the byte limit that decodes into
+	// millions of values.
+	expanding []byte
+	// start serves played (or, when non-nil, playedBody) and returns the run
+	// input that imports from it.
+	start func(t *testing.T, repo *Repository, observed *limitsObserved, played []string, playedBody []byte) (CreateRunInput, string)
+}
+
+var limitsSources = []limitsSource{
+	{
+		name: "jellyfin", pageSize: jellyfinPageSize, lookupSize: jellyfinIDChunkSize, episodes: 3*jellyfinPageSize + 50,
+		expanding: expandingBody(`{"TotalRecordCount":1,"Items":[`, `{}`, `]}`),
+		start: func(t *testing.T, _ *Repository, observed *limitsObserved, played []string, playedBody []byte) (CreateRunInput, string) {
+			upstream := httptest.NewServer(embyJellyfinLimitsHandler(t, observed, jellyfinPageSize, played, playedBody))
+			t.Cleanup(upstream.Close)
+			return CreateRunInput{Source: SourceTypeJellyfin, JellyfinBaseURL: upstream.URL, JellyfinUsername: "user", JellyfinPassword: "password"}, ""
+		},
+	},
+	{
+		name: "emby", pageSize: embyPageSize, lookupSize: embyIDChunkSize, episodes: 2*embyPageSize + 100,
+		expanding: expandingBody(`{"TotalRecordCount":1,"Items":[`, `0`, `]}`),
+		start: func(t *testing.T, repo *Repository, observed *limitsObserved, played []string, playedBody []byte) (CreateRunInput, string) {
+			upstream := httptest.NewServer(embyJellyfinLimitsHandler(t, observed, embyPageSize, played, playedBody))
+			t.Cleanup(upstream.Close)
+			if _, err := repo.pool.Exec(t.Context(), `UPDATE history_import_sources SET base_url=$1,source_type='emby' WHERE id=1`, upstream.URL); err != nil {
+				t.Fatal(err)
+			}
+			return CreateRunInput{Source: SourceTypeEmby, SourceID: 1, Username: "user", Password: "password"}, ""
+		},
+	},
+	{
+		name: "plex", pageSize: plexPageSize, lookupSize: plexMetadataBatchSize, episodes: 2*plexPageSize + 100,
+		expanding: expandingBody(`{"MediaContainer":{"totalSize":1,"Metadata":[{"ratingKey":"1","type":"episode","Guid":[`, `{}`, `]}]}}`),
+		start: func(t *testing.T, _ *Repository, observed *limitsObserved, played []string, playedBody []byte) (CreateRunInput, string) {
+			upstream := httptest.NewServer(plexLimitsHandler(t, observed, played, playedBody))
+			t.Cleanup(upstream.Close)
+			discover := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+				w.Header().Set("Content-Type", "application/json")
+				_, _ = w.Write([]byte(`{"MediaContainer":{"totalSize":0,"Metadata":[]}}`))
+			}))
+			t.Cleanup(discover.Close)
+			return CreateRunInput{Source: SourceTypePlex, PlexBaseURL: upstream.URL, PlexToken: "server-token", PlexAccountToken: "account-token"}, discover.URL
+		},
+	},
+}
+
+// A large, heavy, but legitimate library imports completely: every page is
+// read at the client's page size, every series lookup is chunked and keeps
+// only what it asked for, and the right watch history reaches Postgres.
+func TestImportRunReadsLargeSourcesWithinLimits(t *testing.T) {
+	for _, source := range limitsSources {
+		t.Run(source.name, func(t *testing.T) {
+			repo := limitsRepository(t)
+			observed := newLimitsObserved()
+			var played []string
+			if source.name == "plex" {
+				played = limitsEpisodes(source.episodes, plexLimitsEpisode)
+			} else {
+				played = append(limitsEpisodes(source.episodes, jellyfinLimitsEpisode), limitsMovie)
+			}
+			input, discoverURL := source.start(t, repo, observed, played, nil)
+
+			run := runLimitsImport(t, repo, input, discoverURL)
+			if run.Status != RunStatusCompleted {
+				t.Fatalf("run = %s (%s), want completed", run.Status, run.ErrorMessage)
+			}
+			// Every filler episode, the matched episode, and the movie.
+			if want := source.episodes + 2; run.Fetched != want {
+				t.Fatalf("fetched = %d, want %d", run.Fetched, want)
+			}
+			if got, want := limitsHistory(t, repo), []string{"episode@2026-09-02", "movie@2026-09-01"}; !slices.Equal(got, want) {
+				t.Fatalf("history = %v, want %v", got, want)
+			}
+
+			observed.mu.Lock()
+			defer observed.mu.Unlock()
+			if len(observed.unexpected) > 0 {
+				t.Fatalf("unexpected requests: %v", observed.unexpected)
+			}
+			if wantPages := (len(played) + source.pageSize - 1) / source.pageSize; observed.listings < wantPages || observed.maxPage != source.pageSize {
+				t.Fatalf("listing pages = %d at most %d items, want %d of %d", observed.listings, observed.maxPage, wantPages, source.pageSize)
+			}
+			if observed.maxLookup != source.lookupSize {
+				t.Fatalf("largest lookup = %d ids, want chunks of %d", observed.maxLookup, source.lookupSize)
+			}
+			for i := range limitsSeriesCount {
+				if id := "series-" + strconv.Itoa(i); !observed.lookedUp[id] {
+					t.Fatalf("series %s was never looked up", id)
+				}
+			}
+		})
+	}
+}
+
+// A source whose played listing fits the byte limit but decodes into millions
+// of values fails the run with the size-limit message, writes nothing, and
+// does not make the server allocate the decoded listing. Not parallel,
+// because it measures allocations.
+func TestImportRunFailsOnExpandingSourceListing(t *testing.T) {
+	for _, source := range limitsSources {
+		t.Run(source.name, func(t *testing.T) {
+			repo := limitsRepository(t)
+			observed := newLimitsObserved()
+			input, discoverURL := source.start(t, repo, observed, nil, source.expanding)
+
+			var run Run
+			var before, after runtime.MemStats
+			runtime.GC()
+			runtime.ReadMemStats(&before)
+			run = runLimitsImport(t, repo, input, discoverURL)
+			runtime.ReadMemStats(&after)
+
+			if run.Status != RunStatusFailed || run.ErrorMessage != RunErrorSourceTooLarge {
+				t.Fatalf("run = %s (%q), want failed with %q", run.Status, run.ErrorMessage, RunErrorSourceTooLarge)
+			}
+			if history := limitsHistory(t, repo); len(history) != 0 {
+				t.Fatalf("history = %v, want none", history)
+			}
+			// Decoding the listing used to allocate several GiB.
+			if allocated := after.TotalAlloc - before.TotalAlloc; allocated > 256<<20 {
+				t.Fatalf("run allocated %d MiB for a %d MiB listing", allocated>>20, len(source.expanding)>>20)
+			}
+		})
+	}
+}
diff --git a/internal/historyimport/service.go b/internal/historyimport/service.go
index d372ace6c0..6b6c0101cf 100644
--- a/internal/historyimport/service.go
+++ b/internal/historyimport/service.go
@@ -19,6 +19,17 @@ import (
 	"github.com/prairie-server/prairie-server/internal/watchstate"
 )
 
+// signalsNotifyTimeout bounds reporting a run's signal changes, which happens
+// after the run's own context may have ended.
+const signalsNotifyTimeout = 10 * time.Second
+
+// SignalsChangedNotifier records that a profile's recommendation signals
+// changed, so its taste profile and cached recommendations get rebuilt.
+// *recommendations.Worker implements it.
+type SignalsChangedNotifier interface {
+	NotifySignalsChanged(ctx context.Context, userID int, profileID string)
+}
+
 // maxConcurrentRuns limits how many import runs execute simultaneously.
 // Additional runs stay queued until a slot opens. This prevents overwhelming
 // the external server and database when bulk-importing many users at once.
@@ -54,6 +65,10 @@ type Service struct {
 	nextUp      NextUpLister
 	// now dates the drops that pass writes; nil means time.Now.
 	now func() time.Time
+
+	// signals hears once per run that the profile's signals changed. Nil
+	// reports nothing.
+	signals SignalsChangedNotifier
 }
 
 func NewService(bgContext context.Context, repo *Repository, storeProvider userstore.UserStoreProvider) *Service {
@@ -90,6 +105,33 @@ func (s *Service) SetLocalNetworkAccess(access *LocalNetworkAccess) {
 	}
 }
 
+// SetSignalsChangedNotifier installs where a run reports that it changed the
+// importing profile's recommendation signals.
+func (s *Service) SetSignalsChangedNotifier(notifier SignalsChangedNotifier) {
+	if s != nil {
+		s.signals = notifier
+	}
+}
+
+// notifySignalsChanged reports a run's signal changes once it ends.
+func (s *Service) notifySignalsChanged(ctx context.Context, userID int, profileID string) {
+	if s.signals == nil {
+		return
+	}
+	notifyCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), signalsNotifyTimeout)
+	defer cancel()
+	s.signals.NotifySignalsChanged(notifyCtx, userID, profileID)
+}
+
+// runChangedSignals reports whether a run should report that it changed the
+// profile's recommendation signals: every completed run, and a failed run
+// that had already written progress, history, favorites or watchlist entries,
+// since records are written one by one.
+func runChangedSignals(completed bool, summary ExecutionSummary) bool {
+	return completed || summary.ProgressUpdated > 0 || summary.HistoryCreated > 0 ||
+		summary.FavoritesImported > 0 || summary.WatchlistAdded > 0
+}
+
 func (s *Service) SetStableIdentityResolver(identity *watchstate.StableIdentityResolver) {
 	if s == nil || s.watchState == nil {
 		return
@@ -336,6 +378,12 @@ func (s *Service) executeRunWithClaim(run *Run, provider Provider, claim RunClai
 		Warnings:         []string{},
 		UnmatchedSamples: []UnmatchedSample{},
 	}
+	completed := false
+	defer func() {
+		if runChangedSignals(completed, summary) {
+			s.notifySignalsChanged(ctx, run.UserID, run.ProfileID)
+		}
+	}()
 	if claim.Generation == 0 {
 		if err := s.repo.MarkRunStarted(ctx, run.ID); err != nil {
 			slog.Error("history import: failed to mark run started", "run_id", run.ID, "error", err)
@@ -358,7 +406,9 @@ func (s *Service) executeRunWithClaim(run *Run, provider Provider, claim RunClai
 		"connection_mode", run.ConnectionMode,
 	)
 
-	records, warnings, err := provider.Fetch(ctx)
+	// One budget covers every request the provider makes for this run, so a
+	// source cannot multiply the per-listing limits across lookups or sections.
+	records, warnings, err := provider.Fetch(withRunBudget(ctx))
 	if err != nil {
 		summary.Warnings = append(summary.Warnings, warnings...)
 		if cause := context.Cause(ctx); cause != nil {
@@ -455,20 +505,23 @@ func (s *Service) executeRunWithClaim(run *Run, provider Provider, claim RunClai
 			return
 		}
 		outcome, err := s.applyImportedWatch(ctx, run.UserID, run.ProfileID, match.MediaItemID, record)
+		// A write that landed counts even when a later step for the record
+		// failed, so a run that then fails still reports the signal change.
+		if outcome.ProgressWritten {
+			summary.ProgressUpdated++
+		}
+		if outcome.HistoryCreated {
+			summary.HistoryCreated++
+		}
 		if err != nil {
 			summary.Warnings = append(summary.Warnings, err.Error())
 		} else {
 			if record.Kind == KindEpisode {
 				importedEpisodes = append(importedEpisodes, newImportedEpisode(match.MediaItemID, record))
 			}
-			if outcome.ProgressWritten {
-				summary.ProgressUpdated++
-			} else {
+			if !outcome.ProgressWritten {
 				summary.Skipped++
 			}
-			if outcome.HistoryCreated {
-				summary.HistoryCreated++
-			}
 			if outcome.HiddenSuppressed {
 				hiddenSuppressed++
 				summary.Warnings, hiddenWarningAt = upsertHiddenHistoryWarning(
@@ -503,6 +556,7 @@ func (s *Service) executeRunWithClaim(run *Run, provider Provider, claim RunClai
 		s.failClaim(ctx, claim, summary, err)
 		return
 	}
+	completed = true
 	observation.Finish("success")
 	s.notifyRunByID(ctx, run.ID)
 	slog.Info(
diff --git a/internal/historyimport/signals_notify_test.go b/internal/historyimport/signals_notify_test.go
new file mode 100644
index 0000000000..11d0ac7121
--- /dev/null
+++ b/internal/historyimport/signals_notify_test.go
@@ -0,0 +1,104 @@
+package historyimport
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/prairie-server/prairie-server/internal/userstore/pgstore"
+)
+
+// recordingSignalsNotifier records each signal change notification as the
+// profile it named.
+type recordingSignalsNotifier struct{ profiles []string }
+
+func (n *recordingSignalsNotifier) NotifySignalsChanged(_ context.Context, _ int, profileID string) {
+	n.profiles = append(n.profiles, profileID)
+}
+
+func TestRunChangedSignals(t *testing.T) {
+	for name, tc := range map[string]struct {
+		completed bool
+		summary   ExecutionSummary
+		want      bool
+	}{
+		"completed with nothing written": {completed: true, want: true},
+		"failed after progress":          {summary: ExecutionSummary{ProgressUpdated: 1}, want: true},
+		"failed after history":           {summary: ExecutionSummary{HistoryCreated: 1}, want: true},
+		"failed after favorites":         {summary: ExecutionSummary{FavoritesImported: 1}, want: true},
+		"failed after watchlist":         {summary: ExecutionSummary{WatchlistAdded: 1}, want: true},
+		"failed having only matched":     {summary: ExecutionSummary{Fetched: 3, Matched: 2, Unmatched: 1, Skipped: 2}, want: false},
+	} {
+		t.Run(name, func(t *testing.T) {
+			if got := runChangedSignals(tc.completed, tc.summary); got != tc.want {
+				t.Fatalf("runChangedSignals = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
+
+type failingFetchProvider struct{}
+
+func (failingFetchProvider) Fetch(context.Context) ([]Record, []string, error) {
+	return nil, nil, errors.New("media server unreachable")
+}
+
+// A completed run reports one signal change for its profile, however many
+// records it wrote; a run that failed before writing anything reports none.
+func TestImportRunReportsSignalChangesOncePostgres(t *testing.T) {
+	ctx := trustLoopback(context.Background())
+	pool := newPlexWatchlistImportTestPool(t)
+	repo := NewRepository(pool, nil)
+	notifier := &recordingSignalsNotifier{}
+	service := &Service{
+		repo:         repo,
+		matcher:      NewMatcher(repo),
+		stores:       pgstore.NewPostgresProvider(pool),
+		bgContext:    ctx,
+		runSemaphore: make(chan struct{}, maxConcurrentRuns),
+		runCancels:   make(map[string]context.CancelFunc),
+	}
+	service.SetSignalsChangedNotifier(notifier)
+	if _, err := pool.Exec(ctx, `
+		INSERT INTO media_items (content_id, type, title, year, tmdb_id, status)
+		VALUES ('movie-438631', $1, 'Dune', 2021, '438631', 'matched'),
+		       ('movie-693134', $1, 'Dune: Part Two', 2024, '693134', 'matched')`, KindMovie); err != nil {
+		t.Fatalf("seed media items: %v", err)
+	}
+	newRun := func(id string) *Run {
+		t.Helper()
+		run, err := repo.CreateRun(ctx, Run{
+			ID: id, UserID: 42, ProfileID: "profile-1", SourceType: SourceTypePlex,
+			ConnectionMode: ConnectionModePlexOAuth, Status: RunStatusQueued,
+			Warnings: []string{}, UnmatchedSamples: []UnmatchedSample{},
+		})
+		if err != nil {
+			t.Fatalf("CreateRun: %v", err)
+		}
+		return run
+	}
+	at := time.Date(2026, time.July, 2, 12, 0, 0, 0, time.UTC)
+	records := []Record{
+		{Kind: KindMovie, Title: "Dune", Year: 2021, TMDBID: "438631", Watchlisted: true, UpdatedAt: at},
+		{Kind: KindMovie, Title: "Dune: Part Two", Year: 2024, TMDBID: "693134", Watchlisted: true, UpdatedAt: at},
+	}
+
+	completed := newRun("signals-completed-run")
+	service.executeRun(completed, staticWatchlistProvider{records: records})
+	if got, err := repo.GetRunForUser(ctx, 42, completed.ID); err != nil || got.Status != RunStatusCompleted || got.WatchlistAdded != 2 {
+		t.Fatalf("completed run = %+v, %v", got, err)
+	}
+	if len(notifier.profiles) != 1 || notifier.profiles[0] != "profile-1" {
+		t.Fatalf("notifications after a completed run = %v, want one for profile-1", notifier.profiles)
+	}
+
+	failed := newRun("signals-failed-run")
+	service.executeRun(failed, failingFetchProvider{})
+	if got, err := repo.GetRunForUser(ctx, 42, failed.ID); err != nil || got.Status != RunStatusFailed {
+		t.Fatalf("failed run = %+v, %v", got, err)
+	}
+	if len(notifier.profiles) != 1 {
+		t.Fatalf("notifications after a run that wrote nothing = %d, want none", len(notifier.profiles)-1)
+	}
+}
diff --git a/internal/historyimport/upstream_limits.go b/internal/historyimport/upstream_limits.go
index 14f7eb630f..986dfb353b 100644
--- a/internal/historyimport/upstream_limits.go
+++ b/internal/historyimport/upstream_limits.go
@@ -1,10 +1,13 @@
 package historyimport
 
 import (
+	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
+	"reflect"
+	"sync"
 )
 
 // Source servers are user-supplied, so every response an import reads is
@@ -23,6 +26,19 @@ const (
 	// keeps reporting more rows than it ever delivers is not.
 	maxListingItems = 500_000
 	maxListingPages = 5_000
+	// maxUpstreamResponseValues caps the JSON values (objects, arrays, and
+	// members or elements after the first) one response may open. Bytes alone
+	// do not bound decoding: 16 MiB of "{}," decodes into millions of structs.
+	// A full Plex page or metadata batch, cast lists included, is a few tens
+	// of thousands.
+	maxUpstreamResponseValues = 250_000
+	// maxRunBytes caps what one import run reads across every listing and
+	// lookup, so a source cannot multiply the listing limit by naming many
+	// sections or series.
+	maxRunBytes int64 = 2 << 30
+	// maxRunRetainedBytes caps the estimated memory of the items one import
+	// run keeps until it finishes: roughly 500,000 items with their ids.
+	maxRunRetainedBytes int64 = 256 << 20
 	// upstreamErrorBodyBytes caps how much of a non-2xx body is kept for
 	// diagnostics.
 	upstreamErrorBodyBytes = 2048
@@ -60,34 +76,168 @@ func (b *listingBudget) addItems(n int) error {
 	return nil
 }
 
-func (b *listingBudget) responseLimit() int64 {
-	if b == nil {
-		return maxUpstreamResponseBytes
+// runBudget tracks one import run across every request its provider makes:
+// listings, ID lookups, metadata sweeps, and every Plex section.
+type runBudget struct {
+	mu       sync.Mutex
+	bytes    int64
+	retained int64
+}
+
+type runBudgetKey struct{}
+
+// withRunBudget gives the requests made with ctx one shared run budget.
+// Requests without one apply only the response and listing limits.
+func withRunBudget(ctx context.Context) context.Context {
+	return context.WithValue(ctx, runBudgetKey{}, &runBudget{})
+}
+
+func runBudgetFrom(ctx context.Context) *runBudget {
+	budget, _ := ctx.Value(runBudgetKey{}).(*runBudget)
+	return budget
+}
+
+func (b *runBudget) remainingBytes() int64 {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return max(0, maxRunBytes-b.bytes)
+}
+
+func (b *runBudget) addBytes(n int64) {
+	b.mu.Lock()
+	b.bytes += n
+	b.mu.Unlock()
+}
+
+// retainedSizer estimates the memory a decoded source item holds.
+type retainedSizer interface {
+	retainedSize() int64
+}
+
+// retainItems charges items the run keeps against its retained-memory budget.
+// Callers charge what they keep, after dropping anything they did not ask for.
+func retainItems[T retainedSizer](ctx context.Context, items []T) error {
+	budget := runBudgetFrom(ctx)
+	if budget == nil {
+		return nil
+	}
+	var size int64
+	for i := range items {
+		size += items[i].retainedSize()
+	}
+	budget.mu.Lock()
+	defer budget.mu.Unlock()
+	budget.retained += size
+	if budget.retained > maxRunRetainedBytes {
+		return fmt.Errorf("%w: import keeps more than %d bytes of source items", ErrUpstreamResponseTooLarge, maxRunRetainedBytes)
+	}
+	return nil
+}
+
+// mapEntryOverhead approximates a map entry's storage beyond its key and
+// value bytes.
+const mapEntryOverhead = 48
+
+func sizeOf[T any]() int64 {
+	return int64(reflect.TypeFor[T]().Size())
+}
+
+func stringBytes(values ...string) int64 {
+	var n int64
+	for _, value := range values {
+		n += int64(len(value))
 	}
-	return max(0, min(maxUpstreamResponseBytes, maxListingBytes-b.bytes))
+	return n
+}
+
+func stringMapBytes(m map[string]string) int64 {
+	var n int64
+	for key, value := range m {
+		n += mapEntryOverhead + stringBytes(key, value)
+	}
+	return n
 }
 
 // decodeUpstreamJSON decodes one successful source response into out, reading
-// at most the response limit (and what remains of budget, when given). A body
-// past the limit fails with ErrUpstreamResponseTooLarge rather than decoding a
-// truncated value.
-func decodeUpstreamJSON(body io.Reader, out any, budget *listingBudget) error {
-	return decodeLimitedJSON(body, out, budget, budget.responseLimit())
+// at most the response limit, what remains of the listing budget when given,
+// and what remains of the run budget carried by ctx. A body past a limit fails
+// with ErrUpstreamResponseTooLarge rather than decoding a truncated value.
+func decodeUpstreamJSON(ctx context.Context, body io.Reader, out any, listing *listingBudget) error {
+	limit, scope, scopeLimit := maxUpstreamResponseBytes, "response", maxUpstreamResponseBytes
+	if listing != nil {
+		if remaining := max(0, maxListingBytes-listing.bytes); remaining < limit {
+			limit, scope, scopeLimit = remaining, "listing", maxListingBytes
+		}
+	}
+	run := runBudgetFrom(ctx)
+	if run != nil {
+		if remaining := run.remainingBytes(); remaining < limit {
+			limit, scope, scopeLimit = remaining, "import", maxRunBytes
+		}
+	}
+	read, err := decodeLimitedJSON(body, out, limit)
+	if listing != nil {
+		listing.bytes += read
+	}
+	if run != nil {
+		run.addBytes(read)
+	}
+	if errors.Is(err, errUpstreamBytesLimit) {
+		return fmt.Errorf("%w: %s exceeds %d bytes", ErrUpstreamResponseTooLarge, scope, scopeLimit)
+	}
+	return err
 }
 
-func decodeLimitedJSON(body io.Reader, out any, budget *listingBudget, limit int64) error {
+var errUpstreamBytesLimit = errors.New("byte limit reached")
+
+// decodeLimitedJSON decodes body into out, reading at most limit bytes and
+// maxUpstreamResponseValues JSON values. It returns the bytes read. The
+// decoder buffers a whole value before it unmarshals, so a body stopped by
+// either limit allocates nothing for its contents.
+func decodeLimitedJSON(body io.Reader, out any, limit int64) (int64, error) {
 	limited := &io.LimitedReader{R: body, N: limit + 1}
-	err := json.NewDecoder(limited).Decode(out)
-	if budget != nil {
-		budget.bytes += limit + 1 - limited.N
-	}
+	err := json.NewDecoder(&jsonValueCounter{r: limited, limit: maxUpstreamResponseValues}).Decode(out)
+	read := limit + 1 - limited.N
 	if limited.N <= 0 {
-		if budget != nil && limit < maxUpstreamResponseBytes {
-			return fmt.Errorf("%w: listing exceeds %d bytes", ErrUpstreamResponseTooLarge, maxListingBytes)
+		return read, errUpstreamBytesLimit
+	}
+	return read, err
+}
+
+// jsonValueCounter fails a read once the JSON passing through it opens more
+// than limit values. It counts '{', '[', and ',' outside strings, which is at
+// least one per array element or object member after the first.
+type jsonValueCounter struct {
+	r        io.Reader
+	limit    int
+	values   int
+	inString bool
+	escaped  bool
+}
+
+func (c *jsonValueCounter) Read(p []byte) (int, error) {
+	n, err := c.r.Read(p)
+	for _, b := range p[:n] {
+		switch {
+		case c.escaped:
+			c.escaped = false
+		case c.inString:
+			switch b {
+			case '\\':
+				c.escaped = true
+			case '"':
+				c.inString = false
+			}
+		case b == '"':
+			c.inString = true
+		case b == '{' || b == '[' || b == ',':
+			c.values++
 		}
-		return fmt.Errorf("%w: response exceeds %d bytes", ErrUpstreamResponseTooLarge, limit)
 	}
-	return err
+	if c.values > c.limit {
+		return 0, fmt.Errorf("%w: response exceeds %d JSON values", ErrUpstreamResponseTooLarge, c.limit)
+	}
+	return n, err
 }
 
 // discardUpstreamBody drains a body whose content is not needed, so the
@@ -101,3 +251,21 @@ func readUpstreamErrorBody(body io.Reader) []byte {
 	data, _ := io.ReadAll(io.LimitReader(body, upstreamErrorBodyBytes))
 	return data
 }
+
+// keepRequested returns the first item for each requested id, in response
+// order. A lookup by id keeps nothing else the source sends.
+func keepRequested[T any](items []T, ids []string, id func(T) string) []T {
+	pending := make(map[string]struct{}, len(ids))
+	for _, value := range ids {
+		pending[value] = struct{}{}
+	}
+	kept := make([]T, 0, min(len(items), len(ids)))
+	for _, item := range items {
+		key := id(item)
+		if _, ok := pending[key]; ok {
+			delete(pending, key)
+			kept = append(kept, item)
+		}
+	}
+	return kept
+}
diff --git a/internal/historyimport/upstream_limits_test.go b/internal/historyimport/upstream_limits_test.go
index 2419cccf12..52f3f90e35 100644
--- a/internal/historyimport/upstream_limits_test.go
+++ b/internal/historyimport/upstream_limits_test.go
@@ -17,16 +17,16 @@ func TestDecodeLimitedJSONRejectsBodiesPastTheLimit(t *testing.T) {
 	t.Parallel()
 
 	var out struct{ Name string }
-	if err := decodeLimitedJSON(strings.NewReader(`{"Name":"ok"}`), &out, nil, 64); err != nil || out.Name != "ok" {
+	if _, err := decodeLimitedJSON(strings.NewReader(`{"Name":"ok"}`), &out, 64); err != nil || out.Name != "ok" {
 		t.Fatalf("small body: err = %v, name = %q", err, out.Name)
 	}
 	body := `{"Name":"` + strings.Repeat("a", 100) + `"}`
-	if err := decodeLimitedJSON(strings.NewReader(body), &out, nil, 64); !errors.Is(err, ErrUpstreamResponseTooLarge) {
-		t.Fatalf("large body: err = %v, want ErrUpstreamResponseTooLarge", err)
+	if _, err := decodeLimitedJSON(strings.NewReader(body), &out, 64); !errors.Is(err, errUpstreamBytesLimit) {
+		t.Fatalf("large body: err = %v, want the byte limit", err)
 	}
 	// A body exactly at the limit is accepted.
 	exact := `{"Name":"` + strings.Repeat("b", 50) + `"}`
-	if err := decodeLimitedJSON(strings.NewReader(exact), &out, nil, int64(len(exact))); err != nil {
+	if _, err := decodeLimitedJSON(strings.NewReader(exact), &out, int64(len(exact))); err != nil {
 		t.Fatalf("body at the limit: err = %v", err)
 	}
 }
@@ -35,11 +35,8 @@ func TestListingBudgetCapsTotalBytes(t *testing.T) {
 	t.Parallel()
 
 	budget := listingBudget{bytes: maxListingBytes - 10}
-	if got := budget.responseLimit(); got != 10 {
-		t.Fatalf("responseLimit = %d, want the 10 bytes left", got)
-	}
 	var out struct{ Name string }
-	err := decodeUpstreamJSON(strings.NewReader(`{"Name":"more than ten bytes"}`), &out, &budget)
+	err := decodeUpstreamJSON(context.Background(), strings.NewReader(`{"Name":"more than ten bytes"}`), &out, &budget)
 	if !errors.Is(err, ErrUpstreamResponseTooLarge) || !strings.Contains(err.Error(), "listing exceeds") {
 		t.Fatalf("err = %v, want a listing size error", err)
 	}
diff --git a/internal/historyimport/upstream_memory_test.go b/internal/historyimport/upstream_memory_test.go
new file mode 100644
index 0000000000..da6bab50a9
--- /dev/null
+++ b/internal/historyimport/upstream_memory_test.go
@@ -0,0 +1,268 @@
+package historyimport
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"runtime"
+	"strconv"
+	"strings"
+	"testing"
+)
+
+// expandingBody returns a JSON body just under the response byte limit made
+// of prefix, repeated elements, and suffix. Tiny elements such as "{}" decode
+// into one struct each, so the body is small but its decoded form is not.
+func expandingBody(prefix, element, suffix string) []byte {
+	var body strings.Builder
+	body.WriteString(prefix)
+	budget := int(maxUpstreamResponseBytes) - len(prefix) - len(suffix) - len(element)
+	for i := 0; body.Len() < budget; i++ {
+		if i > 0 {
+			body.WriteByte(',')
+		}
+		body.WriteString(element)
+	}
+	body.WriteString(suffix)
+	return []byte(body.String())
+}
+
+func serveBody(t *testing.T, body []byte) *httptest.Server {
+	t.Helper()
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write(body)
+	}))
+	t.Cleanup(server.Close)
+	return server
+}
+
+// allocatedBytes reports the bytes fn allocates, including any goroutines
+// running meanwhile; the cases below differ from the old behavior by two
+// orders of magnitude, so that noise does not matter.
+func allocatedBytes(fn func()) uint64 {
+	var before, after runtime.MemStats
+	runtime.GC()
+	runtime.ReadMemStats(&before)
+	fn()
+	runtime.ReadMemStats(&after)
+	return after.TotalAlloc - before.TotalAlloc
+}
+
+// A body within the byte limit must not decode into millions of values: the
+// response fails before the decoder allocates for its contents. Not parallel,
+// because it measures allocations.
+func TestHistoryImportClientsBoundDecodedValues(t *testing.T) {
+	ctx := trustLoopback(context.Background())
+	cases := []struct {
+		name  string
+		body  []byte
+		fetch func(baseURL string) error
+	}{
+		{
+			// The case measured in #2382: 16 MiB of empty Jellyfin items.
+			name: "jellyfin empty items",
+			body: expandingBody(`{"Items":[`, `{}`, `]}`),
+			fetch: func(baseURL string) error {
+				auth := jellyfinLocalAuth{BaseURL: baseURL, UserID: "u", AccessToken: "t"}
+				_, err := newUnthrottledJellyfinClient().FetchItems(ctx, auth, "IsPlayed", jellyfinPlayableItemTypes)
+				return err
+			},
+		},
+		{
+			// Mismatched elements still grow the slice before the type error.
+			name: "emby scalar items",
+			body: expandingBody(`{"Items":[`, `0`, `]}`),
+			fetch: func(baseURL string) error {
+				client := NewEmbyClient()
+				client.limiter = nil
+				_, err := client.FetchItems(ctx, embyLocalAuth{BaseURL: baseURL, UserID: "u", AccessToken: "t"}, "IsPlayed")
+				return err
+			},
+		},
+		{
+			// One item passes the listing item cap; its nested Guid array
+			// carries the expansion.
+			name: "plex nested guids",
+			body: expandingBody(`{"MediaContainer":{"totalSize":1,"Metadata":[{"ratingKey":"1","Guid":[`, `{}`, `]}]}}`),
+			fetch: func(baseURL string) error {
+				_, err := newUnthrottledPlexClient().FetchUserHistory(ctx, baseURL, "t", "1")
+				return err
+			},
+		},
+		{
+			name: "jellyfin provider ids",
+			body: expandingBody(`{"Items":[{"Id":"1","ProviderIds":{`, `"":""`, `}}]}`),
+			fetch: func(baseURL string) error {
+				auth := jellyfinLocalAuth{BaseURL: baseURL, UserID: "u", AccessToken: "t"}
+				_, err := newUnthrottledJellyfinClient().FetchItemsByIDs(ctx, auth, []string{"1"}, "Series")
+				return err
+			},
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			server := serveBody(t, tc.body)
+			var err error
+			allocated := allocatedBytes(func() { err = tc.fetch(server.URL) })
+			if !errors.Is(err, ErrUpstreamResponseTooLarge) {
+				t.Fatalf("err = %v, want ErrUpstreamResponseTooLarge", err)
+			}
+			if allocated > 64<<20 {
+				t.Fatalf("decoding a %d-byte body allocated %d MiB", len(tc.body), allocated>>20)
+			}
+		})
+	}
+}
+
+// A real Plex metadata batch, with full cast and stream lists, stays well
+// under the value limit.
+func TestPlexMetadataBatchWithCastListsDecodes(t *testing.T) {
+	t.Parallel()
+
+	var body strings.Builder
+	body.WriteString(`{"MediaContainer":{"size":20,"Metadata":[`)
+	keys := make([]string, plexMetadataBatchSize)
+	for i := range plexMetadataBatchSize {
+		keys[i] = strconv.Itoa(i + 1)
+		if i > 0 {
+			body.WriteByte(',')
+		}
+		body.WriteString(`{"ratingKey":"` + keys[i] + `","type":"movie","title":"Movie","Guid":[{"id":"imdb://tt1"},{"id":"tmdb://1"}],"Role":[`)
+		for r := range 300 {
+			if r > 0 {
+				body.WriteByte(',')
+			}
+			body.WriteString(`{"id":1,"filter":"actor=1","tag":"Actor","tagKey":"k","role":"Role","thumb":"t"}`)
+		}
+		body.WriteString(`],"Media":[{"id":1,"Part":[{"id":1,"Stream":[`)
+		for s := range 40 {
+			if s > 0 {
+				body.WriteByte(',')
+			}
+			body.WriteString(`{"id":1,"streamType":3,"codec":"srt","index":1,"bitrate":1,"language":"English","languageTag":"en","languageCode":"eng","displayTitle":"English","extendedDisplayTitle":"English (SRT)","title":"t","selected":false,"forced":false,"key":"/k","format":"srt","default":false}`)
+		}
+		body.WriteString(`]}]}]}`)
+	}
+	body.WriteString(`]}}`)
+	server := serveBody(t, []byte(body.String()))
+
+	items, err := newUnthrottledPlexClient().FetchMetadataBatch(trustLoopback(context.Background()), server.URL, "t", keys)
+	if err != nil {
+		t.Fatalf("FetchMetadataBatch: %v", err)
+	}
+	if len(items) != plexMetadataBatchSize {
+		t.Fatalf("items = %d, want %d", len(items), plexMetadataBatchSize)
+	}
+}
+
+// Lookups by id keep one item per requested id and drop everything else the
+// source sends back.
+func TestHistoryImportLookupsKeepOnlyRequestedIDs(t *testing.T) {
+	t.Parallel()
+
+	ctx := trustLoopback(context.Background())
+	items := func(format string, requested, extra int) string {
+		var parts []string
+		for i := range requested {
+			entry := strings.ReplaceAll(format, "ID", "req-"+strconv.Itoa(i))
+			parts = append(parts, entry, entry)
+		}
+		for i := range extra {
+			parts = append(parts, strings.ReplaceAll(format, "ID", "extra-"+strconv.Itoa(i)))
+		}
+		return strings.Join(parts, ",")
+	}
+	ids := []string{"req-0", "req-1", "req-2"}
+
+	t.Run("jellyfin", func(t *testing.T) {
+		t.Parallel()
+		server := serveBody(t, []byte(`{"Items":[`+items(`{"Id":"ID","Type":"Series"}`, len(ids), 1000)+`]}`))
+		got, err := newUnthrottledJellyfinClient().FetchItemsByIDs(ctx, jellyfinLocalAuth{BaseURL: server.URL, UserID: "u", AccessToken: "t"}, ids, "Series")
+		if err != nil || len(got) != len(ids) {
+			t.Fatalf("items = %d, err = %v, want %d", len(got), err, len(ids))
+		}
+	})
+	t.Run("emby", func(t *testing.T) {
+		t.Parallel()
+		server := serveBody(t, []byte(`{"Items":[`+items(`{"Id":"ID","Type":"Series"}`, len(ids), 1000)+`]}`))
+		client := NewEmbyClient()
+		client.limiter = nil
+		got, err := client.FetchItemsByIDs(ctx, embyLocalAuth{BaseURL: server.URL, UserID: "u", AccessToken: "t"}, ids, "Series")
+		if err != nil || len(got) != len(ids) {
+			t.Fatalf("items = %d, err = %v, want %d", len(got), err, len(ids))
+		}
+	})
+	t.Run("plex", func(t *testing.T) {
+		t.Parallel()
+		server := serveBody(t, []byte(`{"MediaContainer":{"Metadata":[`+items(`{"ratingKey":"ID","type":"show"}`, len(ids), 1000)+`]}}`))
+		got, err := newUnthrottledPlexClient().FetchMetadataBatch(ctx, server.URL, "t", ids)
+		if err != nil || len(got) != len(ids) {
+			t.Fatalf("items = %d, err = %v, want %d", len(got), err, len(ids))
+		}
+	})
+}
+
+// The run budget spans every request of a run, including lookups that have
+// no listing budget of their own.
+func TestRunBudgetCoversLookups(t *testing.T) {
+	t.Parallel()
+
+	ctx := trustLoopback(context.Background())
+	server := serveBody(t, []byte(`{"Items":[{"Id":"1","Type":"Series","ProviderIds":{"Tvdb":"1"}}]}`))
+	auth := jellyfinLocalAuth{BaseURL: server.URL, UserID: "u", AccessToken: "t"}
+
+	t.Run("retained items", func(t *testing.T) {
+		t.Parallel()
+		runCtx := withRunBudget(ctx)
+		runBudgetFrom(runCtx).retained = maxRunRetainedBytes - 10
+		_, err := newUnthrottledJellyfinClient().FetchItemsByIDs(runCtx, auth, []string{"1"}, "Series")
+		if !errors.Is(err, ErrUpstreamResponseTooLarge) || !strings.Contains(err.Error(), "import keeps") {
+			t.Fatalf("err = %v, want the run retained-items limit", err)
+		}
+	})
+	t.Run("bytes", func(t *testing.T) {
+		t.Parallel()
+		runCtx := withRunBudget(ctx)
+		runBudgetFrom(runCtx).bytes = maxRunBytes - 10
+		_, err := newUnthrottledJellyfinClient().FetchItemsByIDs(runCtx, auth, []string{"1"}, "Series")
+		if !errors.Is(err, ErrUpstreamResponseTooLarge) || !strings.Contains(err.Error(), "import exceeds") {
+			t.Fatalf("err = %v, want the run byte limit", err)
+		}
+	})
+}
+
+// Every Plex section draws on the same run budget instead of a fresh one.
+func TestPlexSectionsShareRunBudget(t *testing.T) {
+	t.Parallel()
+
+	const sections = 4
+	page := `{"MediaContainer":{"totalSize":1,"Metadata":[{"ratingKey":"1","type":"movie","title":"Movie","viewCount":1,"Guid":[{"id":"imdb://tt1"}]}]}}`
+	var directory []string
+	for i := range sections {
+		directory = append(directory, `{"key":"`+strconv.Itoa(i)+`","type":"movie","title":"Movies"}`)
+	}
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		if r.URL.Path == "/library/sections" {
+			_, _ = w.Write([]byte(`{"MediaContainer":{"Directory":[` + strings.Join(directory, ",") + `]}}`))
+			return
+		}
+		_, _ = w.Write([]byte(page))
+	}))
+	t.Cleanup(server.Close)
+
+	runCtx := withRunBudget(trustLoopback(context.Background()))
+	if _, _, err := NewPlexServerProvider(newUnthrottledPlexClient(), []string{server.URL}, "t").Fetch(runCtx); err != nil {
+		t.Fatalf("Fetch: %v", err)
+	}
+	item := PlexItem{RatingKey: "1", Type: "movie", Title: "Movie", ViewCount: 1, Guid: PlexGuids{{ID: "imdb://tt1"}}}
+	// Watched and in-progress listings of every section each keep one item.
+	if got, want := runBudgetFrom(runCtx).retained, 2*sections*item.retainedSize(); got != want {
+		t.Fatalf("retained = %d, want %d across all sections", got, want)
+	}
+	if got := runBudgetFrom(runCtx).bytes; got < int64(2*sections*len(page)) {
+		t.Fatalf("bytes = %d, want every section listing counted", got)
+	}
+}
diff --git a/internal/imagecache/imagecache.go b/internal/imagecache/imagecache.go
index 815382624d..318da0fd7c 100644
--- a/internal/imagecache/imagecache.go
+++ b/internal/imagecache/imagecache.go
@@ -11,7 +11,6 @@ import (
 	"fmt"
 	"io"
 	"log/slog"
-	"net"
 	"net/http"
 	"net/netip"
 	"net/url"
@@ -105,11 +104,10 @@ type Cacher struct {
 	s3              ObjectPutter
 	revisionTracker ArtworkRevisionTracker
 	avifJobs        AVIFBackfillStore
-	httpClient      *http.Client
-	// trustedClient fetches for requests whose context carries
-	// netguard.WithPrivateAccess. Its netguard transport may reach the
-	// server's local network but still refuses blocked addresses.
-	trustedClient     *http.Client
+	// httpClient's netguard transport checks every address it dials,
+	// redirect hops included: public addresses only, or the local network
+	// too when the request context carries netguard.WithPrivateAccess.
+	httpClient        *http.Client
 	enforcePublicURLs bool
 
 	// AVIF backfill: WebP publishes first so the library is browsable; AVIF
@@ -125,8 +123,7 @@ type Cacher struct {
 func New(s3 ObjectPutter) *Cacher {
 	c := &Cacher{
 		s3:                s3,
-		httpClient:        newSecureHTTPClient(),
-		trustedClient:     newTrustedHTTPClient(),
+		httpClient:        newGuardedHTTPClient(),
 		enforcePublicURLs: true,
 	}
 	c.avifWorkers.Store(int32(avifBackfillConcurrency()))
@@ -768,14 +765,8 @@ func (c *Cacher) downloadImage(ctx context.Context, rawURL string) ([]byte, erro
 	if err != nil {
 		return nil, fmt.Errorf("parse URL: %w", err)
 	}
-	client := c.httpClient
 	if c.enforcePublicURLs {
-		if netguard.PrivateAccess(ctx) {
-			if err := validateImageURL(parsed); err != nil {
-				return nil, err
-			}
-			client = c.trustedClient
-		} else if err := validatePublicImageURL(parsed); err != nil {
+		if err := validateImageURLFor(ctx, parsed); err != nil {
 			return nil, err
 		}
 	}
@@ -787,8 +778,9 @@ func (c *Cacher) downloadImage(ctx context.Context, rawURL string) ([]byte, erro
 		return nil, fmt.Errorf("build request: %w", err)
 	}
 
+	client := c.httpClient
 	if client == nil {
-		client = newSecureHTTPClient()
+		client = newGuardedHTTPClient()
 	}
 	resp, err := client.Do(req)
 	if err != nil {
@@ -812,105 +804,38 @@ func (c *Cacher) downloadImage(ctx context.Context, rawURL string) ([]byte, erro
 	return data, nil
 }
 
-func newSecureHTTPClient() *http.Client {
-	transport := &http.Transport{
-		Proxy:               nil,
-		DialContext:         secureImageDialContext,
-		TLSHandshakeTimeout: 10 * time.Second,
-	}
-	return &http.Client{
-		Transport: transport,
-		CheckRedirect: func(req *http.Request, via []*http.Request) error {
-			if len(via) >= 10 {
-				return http.ErrUseLastResponse
-			}
-			return validatePublicImageURL(req.URL)
-		},
-	}
-}
-
-// newTrustedHTTPClient returns the client for trusted requests. The
-// netguard transport checks every address it dials, redirect hops included,
-// and uses its trusted pool because those requests carry
-// netguard.WithPrivateAccess.
-func newTrustedHTTPClient() *http.Client {
+// newGuardedHTTPClient returns the image download client. Its netguard
+// transport keeps trusted and untrusted requests in separate connection pools.
+func newGuardedHTTPClient() *http.Client {
 	return &http.Client{
 		Transport: netguard.NewTransport(),
 		CheckRedirect: func(req *http.Request, via []*http.Request) error {
 			if len(via) >= 10 {
 				return http.ErrUseLastResponse
 			}
-			return validateImageURL(req.URL)
+			return validateImageURLFor(req.Context(), req.URL)
 		},
 	}
 }
 
-func validateImageURL(u *url.URL) error {
+// validateImageURLFor checks u before it is requested. A literal IP host
+// gets an early netguard refusal; the transport checks every address it
+// dials, including hosts that resolve through DNS.
+func validateImageURLFor(ctx context.Context, u *url.URL) error {
 	if u == nil {
 		return fmt.Errorf("empty URL")
 	}
 	if u.Scheme != "http" && u.Scheme != "https" {
 		return fmt.Errorf("unsupported URL scheme %q", u.Scheme)
 	}
-	if u.Hostname() == "" {
-		return fmt.Errorf("URL host is required")
-	}
-	return nil
-}
-
-func validatePublicImageURL(u *url.URL) error {
-	if err := validateImageURL(u); err != nil {
-		return err
-	}
 	host := u.Hostname()
-	if addr, err := netip.ParseAddr(host); err == nil && !isPublicAddr(addr) {
-		return fmt.Errorf("private image host %q is not allowed", host)
-	}
-	return nil
-}
-
-func secureImageDialContext(ctx context.Context, network, address string) (net.Conn, error) {
-	host, port, err := net.SplitHostPort(address)
-	if err != nil {
-		return nil, err
-	}
-	addr, err := resolvePublicAddr(ctx, host)
-	if err != nil {
-		return nil, err
+	if host == "" {
+		return fmt.Errorf("URL host is required")
 	}
-	dialer := &net.Dialer{Timeout: downloadTimeout}
-	return dialer.DialContext(ctx, network, net.JoinHostPort(addr.String(), port))
-}
-
-func resolvePublicAddr(ctx context.Context, host string) (netip.Addr, error) {
 	if addr, err := netip.ParseAddr(host); err == nil {
-		if isPublicAddr(addr) {
-			return addr, nil
-		}
-		return netip.Addr{}, fmt.Errorf("private image host %q is not allowed", host)
-	}
-	ips, err := net.DefaultResolver.LookupIPAddr(ctx, host)
-	if err != nil {
-		return netip.Addr{}, fmt.Errorf("resolve image host %q: %w", host, err)
-	}
-	for _, ip := range ips {
-		addr, ok := netip.AddrFromSlice(ip.IP)
-		if ok && isPublicAddr(addr) {
-			return addr, nil
+		if err := netguard.CheckAddr(addr, netguard.PrivateAccess(ctx)); err != nil {
+			return fmt.Errorf("image host %q is not allowed: %w", host, err)
 		}
 	}
-	return netip.Addr{}, fmt.Errorf("image host %q did not resolve to a public address", host)
-}
-
-func isPublicAddr(addr netip.Addr) bool {
-	if addr.Is4In6() {
-		addr = addr.Unmap()
-	}
-	return addr.IsGlobalUnicast() &&
-		!addr.IsPrivate() &&
-		!addr.IsLoopback() &&
-		!addr.IsLinkLocalUnicast() &&
-		!addr.IsLinkLocalMulticast() &&
-		!addr.IsMulticast() &&
-		!addr.IsUnspecified()
+	return nil
 }
diff --git a/internal/imagecache/imagecache_test.go b/internal/imagecache/imagecache_test.go
index a311b4450e..7fd1bb09ec 100644
--- a/internal/imagecache/imagecache_test.go
+++ b/internal/imagecache/imagecache_test.go
@@ -24,6 +24,7 @@ import (
 
 	"github.com/prairie-server/prairie-server/internal/artworkkey"
 	"github.com/prairie-server/prairie-server/internal/blobstore"
+	"github.com/prairie-server/prairie-server/internal/imageutil"
 	"github.com/prairie-server/prairie-server/internal/metadata"
 	"github.com/prairie-server/prairie-server/internal/netguard"
 	"github.com/prairie-server/prairie-server/internal/s3client"
@@ -308,8 +309,62 @@ func TestCacheRefusesLocalNetworkSourceWithoutPrivateAccess(t *testing.T) {
 		ContentID:   "550",
 		ImageType:   metadata.ImagePoster,
 	})
-	if err == nil || !strings.Contains(err.Error(), "private image host") {
-		t.Fatalf("Cache error = %v, want private image host refusal", err)
+	if !errors.Is(err, netguard.ErrPrivateDestination) {
+		t.Fatalf("Cache error = %v, want netguard.ErrPrivateDestination", err)
+	}
+	if got := s3.keys(); len(got) != 0 {
+		t.Fatalf("uploaded keys = %v, want none", got)
+	}
+}
+
+// Provider artwork URLs are untrusted, so the cache refuses every address
+// netguard does not class as Public: CGNAT (Tailscale), cloud metadata, and
+// NAT64 forms of either. The context is already canceled, so an address the
+// check misses fails with context.Canceled instead of being dialed.
+func TestCacheRefusesNonPublicSourcesWithoutPrivateAccess(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	for _, host := range []string{
+		"100.64.1.1",
+		"100.101.102.103",
+		"100.100.100.200",
+		"198.18.0.1",
+		"0.1.2.3",
+		"[64:ff9b::a9fe:a9fe]",
+		"[64:ff9b::a00:5]",
+		"[::ffff:100.64.1.1]",
+	} {
+		t.Run(host, func(t *testing.T) {
+			s3 := &mockS3{bucket: "media"}
+			_, err := New(s3).Cache(ctx, CacheRequest{
+				SourceURL:   "http://" + host + "/poster.jpg",
+				ProviderID:  "tmdb",
+				ContentType: "movies",
+				ContentID:   "550",
+				ImageType:   metadata.ImagePoster,
+			})
+			if !errors.Is(err, netguard.ErrPrivateDestination) && !errors.Is(err, netguard.ErrBlockedDestination) {
+				t.Fatalf("Cache error = %v, want a netguard refusal", err)
+			}
+		})
+	}
+}
+
+// A host name passes the early literal-IP check, so the transport has to
+// refuse the private address it resolves to when it dials.
+func TestCacheRefusesHostResolvingToLocalNetworkWithoutPrivateAccess(t *testing.T) {
+	srv := startImageServer(t, makeTestJPEG(t), http.StatusOK)
+	s3 := &mockS3{bucket: "media"}
+
+	_, err := New(s3).Cache(context.Background(), CacheRequest{
+		SourceURL:   strings.Replace(srv.URL, "127.0.0.1", "localhost", 1) + "/poster.jpg",
+		ProviderID:  "tmdb",
+		ContentType: "movies",
+		ContentID:   "550",
+		ImageType:   metadata.ImagePoster,
+	})
+	if !errors.Is(err, netguard.ErrPrivateDestination) {
+		t.Fatalf("Cache error = %v, want netguard.ErrPrivateDestination", err)
 	}
 	if got := s3.keys(); len(got) != 0 {
 		t.Fatalf("uploaded keys = %v, want none", got)
@@ -594,17 +649,17 @@ func TestCache_Backdrop(t *testing.T) {
 	}
 
 	keys := s3.keys()
-	// Expect 4 WebP variants + 3 AVIF siblings (display ladder only).
-	if len(keys) != 7 {
-		t.Errorf("expected 7 uploaded objects (webp+display avif), got %d: %v", len(keys), keys)
+	// Expect 5 WebP variants + 4 AVIF siblings (display ladder only).
+	if len(keys) != 9 {
+		t.Errorf("expected 9 uploaded objects (webp+display avif), got %d: %v", len(keys), keys)
 	}
-	for _, variant := range []string{"original", "w1920", "w1280", "w300"} {
+	for _, variant := range []string{"original", "w2560", "w1920", "w1280", "w300"} {
 		want := result.VariantPaths[variant]
 		if !hasKey(keys, want) {
 			t.Errorf("missing S3 key %q in %v", want, keys)
 		}
 	}
-	for _, variant := range []string{"w1920", "w1280", "w300"} {
+	for _, variant := range []string{"w2560", "w1920", "w1280", "w300"} {
 		want := result.VariantPaths[variant]
 		if !hasKey(keys, artworkkey.WebPAVIFSibling(want)) {
 			t.Errorf("missing AVIF sibling for %q in %v", want, keys)
@@ -708,7 +763,7 @@ func TestCache_ConvertsSVGLogo(t *testing.T) {
 }
 
 func TestCache_CapsLargeOriginalVariant(t *testing.T) {
-	pngData := makeTestPNG(t, 2600, 900)
+	pngData := makeTestPNG(t, 4200, 900)
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Content-Type", "image/png")
 		_, _ = w.Write(pngData)
@@ -737,8 +792,8 @@ func TestCache_CapsLargeOriginalVariant(t *testing.T) {
 	if err != nil {
 		t.Fatalf("reading original.webp size: %v", err)
 	}
-	if cfg.Width > 1920 {
-		t.Fatalf("original.webp width = %d, want <= 1920", cfg.Width)
+	if cfg.Width != imageutil.MaxCachedOriginalDimension {
+		t.Fatalf("original.webp width = %d, want %d", cfg.Width, imageutil.MaxCachedOriginalDimension)
 	}
 	if len(original) >= 10*1024*1024 {
 		t.Fatalf("original.webp size = %d bytes, want < 10 MiB", len(original))
diff --git a/internal/imagesize/imagesize.go b/internal/imagesize/imagesize.go
index 796bec8972..fdfaec97a1 100644
--- a/internal/imagesize/imagesize.go
+++ b/internal/imagesize/imagesize.go
@@ -80,10 +80,16 @@ func FromRequest(r *http.Request) (Size, error) {
 // must keep resolving to the same key even if the ladder grows, so that an
 // absent parameter and an explicit medium agree.
 //
+// A Width size resolves to the narrowest rung at least that wide on the
+// image's own ladder, or the original.
+//
 // size must not be Unset — the caller decides what "no preference" means. Unset
 // is treated as Medium here so a missed check degrades to today's behavior
 // rather than to an empty key.
 func Variant(imageType string, size Size) string {
+	if px, ok := size.TargetWidth(); ok {
+		return variantForWidth(imageType, px)
+	}
 	widths := artworkkey.VariantWidths(imageType)
 	switch size {
 	case Original:
@@ -146,6 +152,9 @@ const (
 // failing — which is what lets the vocabulary grow additively instead of being
 // gated on a capability handshake.
 func PluginVariant(size Size) string {
+	if px, ok := size.TargetWidth(); ok {
+		return pluginVariantForWidth(px)
+	}
 	switch size {
 	case Small:
 		return PluginVariantCard
diff --git a/internal/imagesize/imagesize_test.go b/internal/imagesize/imagesize_test.go
index 5599117eac..619b6d19a2 100644
--- a/internal/imagesize/imagesize_test.go
+++ b/internal/imagesize/imagesize_test.go
@@ -86,7 +86,7 @@ func TestVariantMatrix(t *testing.T) {
 		"backdrop": {
 			Small:    "w300",
 			Medium:   "w1920",
-			Large:    "w1920",
+			Large:    "w2560",
 			Original: "original",
 		},
 		"logo": {
@@ -182,6 +182,7 @@ func TestNextLower(t *testing.T) {
 		{"still", "w500", "w300", true},
 		{"still", "w300", "", false},
 		{"logo", "w500", "", false},
+		{"backdrop", "w2560", "w1920", true},
 		{"backdrop", "w1920", "w1280", true},
 		{"backdrop", "w1280", "w300", true},
 		{"backdrop", "w300", "", false},
diff --git a/internal/imagesize/widths.go b/internal/imagesize/widths.go
new file mode 100644
index 0000000000..68dd044fbd
--- /dev/null
+++ b/internal/imagesize/widths.go
@@ -0,0 +1,183 @@
+package imagesize
+
+import (
+	"strconv"
+	"strings"
+
+	"github.com/prairie-server/prairie-server/internal/artworkkey"
+)
+
+// Slot is a family of response artwork fields a client can size on its own,
+// independently of the size the rest of the response uses. A slot is named
+// for the field, not the image in it: an episode's backdrop_url often carries
+// its still, and the backdrop width still governs it.
+type Slot uint8
+
+const (
+	// SlotPoster is every poster_url.
+	SlotPoster Slot = iota
+	// SlotBackdrop is every backdrop_url and backdrop_urls entry.
+	SlotBackdrop
+	// SlotLogo is every logo_url.
+	SlotLogo
+	// SlotStill is an episode row's still_url.
+	SlotStill
+	// SlotPhoto is a cast or crew member's photo_url.
+	SlotPhoto
+)
+
+// Slots lists every slot, in the order the API documents them.
+var Slots = []Slot{SlotPoster, SlotBackdrop, SlotLogo, SlotStill, SlotPhoto}
+
+// Name is the slot's name in the API, the prefix of its width parameter
+// (poster_width, ...).
+func (s Slot) Name() string {
+	switch s {
+	case SlotPoster:
+		return artworkkey.ImagePoster
+	case SlotBackdrop:
+		return artworkkey.ImageBackdrop
+	case SlotLogo:
+		return artworkkey.ImageLogo
+	case SlotStill:
+		return artworkkey.ImageStill
+	case SlotPhoto:
+		return "photo"
+	default:
+		return ""
+	}
+}
+
+// MaxTargetWidth bounds a requested slot width. Wider than any display Prairie
+// serves; anything past the widest rung resolves to the original anyway.
+const MaxTargetWidth = 7680
+
+// Widths are per-slot target widths in device pixels: how wide the client
+// draws the image. Zero means no preference for that slot.
+type Widths struct {
+	Poster   int
+	Backdrop int
+	Logo     int
+	Still    int
+	Photo    int
+}
+
+// IsZero reports whether no slot has a target width.
+func (w Widths) IsZero() bool {
+	return w == Widths{}
+}
+
+func (w Widths) of(slot Slot) int {
+	switch slot {
+	case SlotPoster:
+		return w.Poster
+	case SlotBackdrop:
+		return w.Backdrop
+	case SlotLogo:
+		return w.Logo
+	case SlotStill:
+		return w.Still
+	case SlotPhoto:
+		return w.Photo
+	default:
+		return 0
+	}
+}
+
+// Encode is a canonical, order-stable form of the widths for binding a
+// pagination cursor to the artwork the first page was resolved with. It is
+// empty when no slot has a width.
+func (w Widths) Encode() string {
+	var parts []string
+	for _, slot := range Slots {
+		if px := w.of(slot); px > 0 {
+			parts = append(parts, slot.Name()+"="+strconv.Itoa(px))
+		}
+	}
+	return strings.Join(parts, ",")
+}
+
+// Request is a client's artwork preference for one response: a size for every
+// image, and per-slot target widths that override it for their slot.
+type Request struct {
+	Size   Size
+	Widths Widths
+}
+
+// For returns the size to resolve a slot at: a target width when the client
+// gave the slot one, else the response-wide size (possibly Unset, which leaves
+// the caller's per-context default in place).
+func (r Request) For(slot Slot) Size {
+	if px := r.Widths.of(slot); px > 0 {
+		return Width(px)
+	}
+	return r.Size
+}
+
+// widthPrefix marks a Size that is a target width rather than a named size.
+const widthPrefix = "width:"
+
+// Width is a size that names a target width in device pixels instead of a
+// ladder position. It resolves to the narrowest rung of the image's own
+// ladder at least that wide, or the original when every rung is narrower. It
+// is server-internal: Parse never produces one, because clients send widths
+// through the per-slot width parameters, not image_size.
+func Width(px int) Size {
+	return Size(widthPrefix + strconv.Itoa(px))
+}
+
+// TargetWidth reports the width a Width size names.
+func (s Size) TargetWidth() (int, bool) {
+	raw, ok := strings.CutPrefix(string(s), widthPrefix)
+	if !ok {
+		return 0, false
+	}
+	px, err := strconv.Atoi(raw)
+	if err != nil || px <= 0 {
+		return 0, false
+	}
+	return px, true
+}
+
+// variantForWidth is the narrowest rung of imageType's ladder at least px
+// wide, or the original when every rung is narrower.
+func variantForWidth(imageType string, px int) string {
+	widths := artworkkey.VariantWidths(imageType)
+	for i := len(widths) - 1; i >= 0; i-- {
+		if widths[i] >= px {
+			return widthVariant(widths[i])
+		}
+	}
+	return artworkkey.OriginalVariant
+}
+
+// pluginVariantForWidth maps a target width onto the semantic hint plugin
+// resolvers understand. Plugins host images at their own sizes, so this is an
+// approximation by width class rather than a ladder lookup.
+func pluginVariantForWidth(px int) string {
+	switch {
+	case px <= 300:
+		return PluginVariantCard
+	case px <= 500:
+		return PluginVariantFeatured
+	case px <= 1280:
+		return PluginVariantLarge
+	default:
+		return PluginVariantOriginal
+	}
+}
+
+// PhotoPluginVariant is the plugin hint for a cast or crew headshot at size.
+// Without a size, and for any target width short of the original, it is the
+// large hint cast lists have always used: a plugin's smaller headshots (TMDB
+// serves 185px for both card and featured) are softer than a cast card on a
+// high-density screen. A named size maps as it does for any image.
+func PhotoPluginVariant(size Size) string {
+	if size == Unset {
+		return PluginVariantLarge
+	}
+	if px, ok := size.TargetWidth(); ok && pluginVariantForWidth(px) != PluginVariantOriginal {
+		return PluginVariantLarge
+	}
+	return PluginVariant(size)
+}
diff --git a/internal/imagesize/widths_test.go b/internal/imagesize/widths_test.go
new file mode 100644
index 0000000000..a148c948dc
--- /dev/null
+++ b/internal/imagesize/widths_test.go
@@ -0,0 +1,98 @@
+package imagesize
+
+import "testing"
+
+// A target width resolves to the narrowest rung of the image's own ladder at
+// least that wide, and to the original past the widest rung.
+func TestVariantForTargetWidth(t *testing.T) {
+	tests := []struct {
+		imageType string
+		px        int
+		want      string
+	}{
+		{"backdrop", 1344, "w1920"},
+		{"backdrop", 1000, "w1280"},
+		{"backdrop", 2560, "w2560"},
+		{"backdrop", 2688, "original"},
+		{"still", 1344, "original"},
+		{"still", 720, "original"},
+		{"still", 360, "w500"},
+		{"poster", 352, "w500"},
+		{"poster", 176, "w200"},
+		{"logo", 880, "original"},
+		{"logo", 1760, "original"},
+		{"profile", 400, "w500"},
+		{"profile", 200, "w200"},
+	}
+	for _, tt := range tests {
+		if got := Variant(tt.imageType, Width(tt.px)); got != tt.want {
+			t.Errorf("Variant(%q, Width(%d)) = %q, want %q", tt.imageType, tt.px, got, tt.want)
+		}
+	}
+}
+
+func TestRequestForSlot(t *testing.T) {
+	req := Request{Size: Medium, Widths: Widths{Backdrop: 2688, Logo: 1760}}
+	if got := req.For(SlotBackdrop); got != Width(2688) {
+		t.Errorf("backdrop = %q, want Width(2688)", got)
+	}
+	if got := req.For(SlotLogo); got != Width(1760) {
+		t.Errorf("logo = %q, want Width(1760)", got)
+	}
+	// A slot without a width keeps the response-wide size, Unset included.
+	if got := req.For(SlotPoster); got != Medium {
+		t.Errorf("poster = %q, want medium", got)
+	}
+	if got := (Request{}).For(SlotStill); got != Unset {
+		t.Errorf("empty request still = %q, want Unset", got)
+	}
+}
+
+// Clients choose widths through the slot parameters only; image_size never
+// accepts a width.
+func TestParseRejectsWidthSizes(t *testing.T) {
+	if _, err := Parse(string(Width(500))); err == nil {
+		t.Fatal("Parse accepted a width size")
+	}
+}
+
+func TestWidthsEncodeIsCanonical(t *testing.T) {
+	if got := (Widths{}).Encode(); got != "" {
+		t.Errorf("zero widths encode as %q, want empty", got)
+	}
+	if got, want := (Widths{Photo: 200, Backdrop: 1344}).Encode(), "backdrop=1344,photo=200"; got != want {
+		t.Errorf("Encode = %q, want %q", got, want)
+	}
+}
+
+func TestPluginVariantForWidth(t *testing.T) {
+	for px, want := range map[int]string{
+		200:  PluginVariantCard,
+		500:  PluginVariantFeatured,
+		1280: PluginVariantLarge,
+		2688: PluginVariantOriginal,
+	} {
+		if got := PluginVariant(Width(px)); got != want {
+			t.Errorf("PluginVariant(Width(%d)) = %q, want %q", px, got, want)
+		}
+	}
+}
+
+func TestPhotoPluginVariant(t *testing.T) {
+	for _, tc := range []struct {
+		size Size
+		want string
+	}{
+		{Unset, PluginVariantLarge},
+		{Width(200), PluginVariantLarge},
+		{Width(1280), PluginVariantLarge},
+		{Width(1281), PluginVariantOriginal},
+		{Small, PluginVariantCard},
+		{Medium, PluginVariantFeatured},
+		{Original, PluginVariantOriginal},
+	} {
+		if got := PhotoPluginVariant(tc.size); got != tc.want {
+			t.Errorf("PhotoPluginVariant(%q) = %q, want %q", tc.size, got, tc.want)
+		}
+	}
+}
diff --git a/internal/imageutil/imageutil.go b/internal/imageutil/imageutil.go
index e7c1ce9cc6..2d1dbc2aaf 100644
--- a/internal/imageutil/imageutil.go
+++ b/internal/imageutil/imageutil.go
@@ -66,9 +66,10 @@ func PixelDataUndecodable(data []byte) bool {
 }
 
 // MaxCachedOriginalDimension caps the longest edge of a cached "original"
-// variant. Provider artwork wider than this is downscaled on ingest, so a
-// client asking for the original size never receives more pixels than this.
-const MaxCachedOriginalDimension = 1920
+// variant at 4K. Provider artwork is rarely larger (TMDB backdrops top out at
+// 3840 wide, posters at 2000x3000), so the original keeps the provider's full
+// resolution; the cap bounds an outlier upload rather than everyday art.
+const MaxCachedOriginalDimension = 3840
 
 // Variant holds a named image variant (e.g. "original", "w500").
 // Data is the canonical WebP payload; AVIF and PNG are optional siblings.
diff --git a/internal/imageutil/variants_test.go b/internal/imageutil/variants_test.go
index bea79aa725..96681ec9a0 100644
--- a/internal/imageutil/variants_test.go
+++ b/internal/imageutil/variants_test.go
@@ -17,8 +17,8 @@ func TestGenerateVariantsPreservesEncodes(t *testing.T) {
 		{320, 180, [6][2]int{{320, 180}, {320, 180}, {320, 180}, {320, 180}, {320, 180}, {300, 169}}},
 		{500, 750, [6][2]int{{500, 750}, {500, 750}, {500, 750}, {500, 750}, {500, 750}, {300, 450}}},
 		{1920, 1080, [6][2]int{{1920, 1080}, {1920, 1080}, {780, 439}, {500, 281}, {500, 281}, {300, 169}}},
-		{500, 2400, [6][2]int{{400, 1920}, {500, 2400}, {500, 2400}, {500, 2400}, {500, 2400}, {300, 1440}}},
-		{2400, 1600, [6][2]int{{1920, 1280}, {1920, 1280}, {780, 520}, {500, 333}, {500, 333}, {300, 200}}},
+		{800, 4800, [6][2]int{{640, 3840}, {800, 4800}, {780, 4680}, {500, 3000}, {500, 3000}, {300, 1800}}},
+		{4000, 2000, [6][2]int{{3840, 1920}, {1920, 960}, {780, 390}, {500, 250}, {500, 250}, {300, 150}}},
 	} {
 		t.Run(fmt.Sprintf("%dx%d", tc.width, tc.height), func(t *testing.T) {
 			data := largeTestJPEG(t, tc.width, tc.height)
diff --git a/internal/intromarkers/analyzer.go b/internal/intromarkers/analyzer.go
index 994652026b..458179c31c 100644
--- a/internal/intromarkers/analyzer.go
+++ b/internal/intromarkers/analyzer.go
@@ -627,7 +627,7 @@ func (a *Analyzer) analyzeEpisode(ctx context.Context, episodeID string, kinds E
 	} else {
 		summary.ChromaprintSupported = false
 		summary.ChromaprintSupportMessage = err.Error()
-		return summary, nil
+		return summary, nil //nolint:nilerr // missing Chromaprint support is reported in the summary, as the library-wide run does
 	}
 
 	countGroupJobs(&summary, jobs)
diff --git a/internal/intromarkers/analyzer_movie.go b/internal/intromarkers/analyzer_movie.go
index d128416f40..d4f3225b80 100644
--- a/internal/intromarkers/analyzer_movie.go
+++ b/internal/intromarkers/analyzer_movie.go
@@ -242,6 +242,25 @@ func (a *Analyzer) analyzeMovie(ctx context.Context, candidate Candidate, tailRe
 			summary.MovieCreditsMarkersWritten++
 		}
 	}
+	// A silence pass killed at its deadline leaves the video start in place
+	// but does not settle the movie: the tail is recorded as failed, so the
+	// movie is analyzed again after its backoff instead of keeping the
+	// unrefined start for good.
+	if sampled && mediasample.Classify(silenceErr) == mediasample.ReasonTimeout {
+		summary.CreditsTailScanErrors++
+		spec := movieTailSpec(candidate)
+		if err := a.repo.RecordArtifactFailure(ctx, mediaartifact.Failure{
+			MediaFileID: candidate.FileID,
+			Key:         spec.key,
+			Identity:    spec.window.identity(candidate),
+			RecordedBy:  a.nodeName(),
+			Error:       silenceErr.Error(),
+			At:          time.Now().UTC(),
+		}); err != nil {
+			summary.Errors = append(summary.Errors, err.Error())
+		}
+		return summary
+	}
 	if sampled {
 		if err := a.storeCreditsTail(ctx, candidate, movieTailSpec(candidate), *tail); err != nil {
 			summary.Errors = append(summary.Errors, err.Error())
diff --git a/internal/intromarkers/analyzer_movie_test.go b/internal/intromarkers/analyzer_movie_test.go
index f591312dfc..be2c3ee96b 100644
--- a/internal/intromarkers/analyzer_movie_test.go
+++ b/internal/intromarkers/analyzer_movie_test.go
@@ -3,6 +3,7 @@ package intromarkers
 import (
 	"context"
 	"errors"
+	"fmt"
 	"log/slog"
 	"sync"
 	"testing"
@@ -20,8 +21,10 @@ type fakeMovieSampler struct {
 	preflight error
 	errs      map[int]error
 	silences  []mediasample.Interval
-	tails     []int
-	windows   []fingerprintWindow
+	// silenceErr fails every silence read.
+	silenceErr error
+	tails      []int
+	windows    []fingerprintWindow
 	// onSample runs on every tail pass.
 	onSample func()
 	// onSilences runs on every silence read.
@@ -57,12 +60,12 @@ func (f *fakeMovieSampler) SampleMovieTail(_ context.Context, candidate Candidat
 func (f *fakeMovieSampler) SampleMovieSilences(_ context.Context, _ Candidate, window fingerprintWindow) ([]mediasample.Interval, error) {
 	f.mu.Lock()
 	f.windows = append(f.windows, window)
-	onSilences, silences := f.onSilences, f.silences
+	onSilences, silences, err := f.onSilences, f.silences, f.silenceErr
 	f.mu.Unlock()
 	if onSilences != nil {
 		onSilences()
 	}
-	return silences, nil
+	return silences, err
 }
 
 func (f *fakeMovieSampler) tailCount() int {
@@ -175,6 +178,47 @@ func TestAnalyzeMovieStoresTheTailOnlyOnceCreditsAreSettled(t *testing.T) {
 	}
 }
 
+// A silence pass killed at its deadline keeps the video start but leaves
+// the movie unsettled: its tail is recorded as failed with a backoff, not
+// stored complete, so the scheduled run takes it up again. A silence pass
+// that fails for another reason still settles the movie.
+func TestAnalyzeMovieSilenceTimeoutLeavesTheMovieUnsettled(t *testing.T) {
+	movie := movieCandidate(10, 7200)
+	repo := &fakeIntroRepository{movieCandidates: []Candidate{movie}}
+	timeout := &mediasample.Error{Reason: mediasample.ReasonTimeout, Attempts: []mediasample.AttemptError{{
+		Decoder: "software", Reason: mediasample.ReasonTimeout, Err: context.DeadlineExceeded,
+	}}}
+	sampler := &fakeMovieSampler{silenceErr: fmt.Errorf("ffmpeg did not finish within its 2m12s deadline: %w", timeout)}
+	analyzer := movieAnalyzer(repo, sampler)
+
+	summary, err := analyzer.AnalyzeMovie(context.Background(), "movie")
+	if err != nil {
+		t.Fatalf("AnalyzeMovie: %v", err)
+	}
+	credits := creditsPatches(repo)
+	if summary.MovieCreditsMarkersWritten != 1 || summary.CreditsTailScanErrors != 1 || len(credits) != 1 || credits[0].Start != 6600 {
+		t.Fatalf("summary %+v, credits %+v; want the video start written", summary, credits)
+	}
+	artifact := repo.artifact(10, ArtifactKindCreditsTail)
+	if artifact.Status != mediaartifact.StatusFailed || artifact.RetryAfter == nil || artifact.Key != movieCreditsTailKey() {
+		t.Fatalf("movie tail artifact status %q, retry after %v; want failed with a backoff", artifact.Status, artifact.RetryAfter)
+	}
+
+	// Inside the backoff the movie's tail is not sampled again.
+	if _, err := analyzer.AnalyzeMovie(context.Background(), "movie"); err != nil || sampler.tailCount() != 1 {
+		t.Fatalf("AnalyzeMovie: %v, %d tail passes; want the backoff to hold", err, sampler.tailCount())
+	}
+
+	repo = &fakeIntroRepository{movieCandidates: []Candidate{movie}}
+	sampler = &fakeMovieSampler{silenceErr: errors.New("ffmpeg exit status 1")}
+	if _, err := movieAnalyzer(repo, sampler).AnalyzeMovie(context.Background(), "movie"); err != nil {
+		t.Fatalf("AnalyzeMovie: %v", err)
+	}
+	if artifact := repo.artifact(10, ArtifactKindCreditsTail); artifact.Status != mediaartifact.StatusComplete {
+		t.Fatalf("movie tail artifact status %q after a failed silence pass, want complete", artifact.Status)
+	}
+}
+
 // RunEpisodes, the pass a server without Chromaprint runs outside the
 // cluster lock, leaves movies to RunMovies under the lock.
 func TestRunEpisodesLeavesMovies(t *testing.T) {
diff --git a/internal/intromarkers/chromaprint.go b/internal/intromarkers/chromaprint.go
index 98de07fc3a..2857a97c92 100644
--- a/internal/intromarkers/chromaprint.go
+++ b/internal/intromarkers/chromaprint.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"log/slog"
+	"time"
 
 	"github.com/prairie-server/prairie-server/internal/mediasample"
 	"github.com/prairie-server/prairie-server/internal/processmetrics"
@@ -72,7 +73,7 @@ func (e *ChromaprintExtractor) extractWindow(ctx context.Context, candidate Cand
 	if window.empty() {
 		return nil, nil
 	}
-	result, err := analysisRunner(e.config).Run(ctx, fingerprintRequest(ctx, candidate, window))
+	result, err := runAnalysis(ctx, e.config, analysisRunner(e.config), fingerprintRequest(ctx, candidate, window))
 	if err != nil {
 		return nil, fmt.Errorf("extracting chromaprint for file %d: %w", candidate.FileID, err)
 	}
@@ -86,7 +87,67 @@ func backgroundAnalysis(ctx context.Context) bool {
 	return !mediasample.Interactive(ctx)
 }
 
-// analysisRunner runs intro detection's ffmpeg processes.
+// analysisRunner runs intro detection's ffmpeg processes. Its requests go
+// through runAnalysis, which gives them their deadlines.
 func analysisRunner(cfg Config) mediasample.Runner {
 	return mediasample.Runner{FFmpegPath: cfg.FFmpegPath, Workload: processmetrics.Analysis}
 }
+
+// Every attempt of an analysis run has a deadline that grows with the media
+// it reads: analysisDeadlineBase for starting ffmpeg, opening the input, and
+// seeking, plus the running time of the stretch it reads, so a 10-minute
+// intro window gets 12 minutes. Storage that can play a file reads it at
+// least as fast as it plays, and decoding the tail's keyframes in software
+// took under a minute for a 4K episode, so a run still going at its deadline
+// has almost always stalled. A host busy enough to starve background
+// decoding can also reach it; that run fails the same way and is tried
+// again later. The cap only keeps a pathological window inside what
+// mediasample accepts.
+const (
+	analysisDeadlineBase = 2 * time.Minute
+	maxAnalysisDeadline  = 6 * time.Hour
+)
+
+// analysisDeadline is the deadline of each attempt of req.
+func analysisDeadline(cfg Config, req mediasample.Request) time.Duration {
+	if cfg.attemptTimeout > 0 {
+		return cfg.attemptTimeout
+	}
+	span := time.Duration(sampledSeconds(req) * float64(time.Second)).Round(time.Second)
+	return min(analysisDeadlineBase+span, maxAnalysisDeadline)
+}
+
+// sampledSeconds is the stretch of media req reads, in seconds.
+func sampledSeconds(req mediasample.Request) float64 {
+	switch {
+	case req.Window != nil:
+		return max(req.Window.DurationSeconds, 0)
+	case req.Samples != nil && len(req.Samples.Seconds) > 1:
+		return req.Samples.Seconds[len(req.Samples.Seconds)-1] - req.Samples.Seconds[0]
+	}
+	return 0
+}
+
+// runAnalysis runs req on runner with each of its attempts, or its one
+// software attempt when it plans none, bounded by analysisDeadline. An
+// attempt still running at its deadline is killed and fails as
+// mediasample.ReasonTimeout, which is not permanent, so the file is analyzed
+// again on a later run. A tail pass whose hardware attempt times out tries
+// software on a deadline of its own.
+func runAnalysis(ctx context.Context, cfg Config, runner mediasample.Runner, req mediasample.Request) (mediasample.Result, error) {
+	deadline := analysisDeadline(cfg, req)
+	attempts := req.Attempts
+	if len(attempts) == 0 {
+		attempts = []mediasample.Attempt{{}}
+	}
+	req.Attempts = make([]mediasample.Attempt, len(attempts))
+	for i, attempt := range attempts {
+		attempt.TimeoutSeconds = deadline.Seconds()
+		req.Attempts[i] = attempt
+	}
+	result, err := runner.Run(ctx, req)
+	if mediasample.Classify(err) == mediasample.ReasonTimeout {
+		err = fmt.Errorf("ffmpeg did not finish within its %s deadline: %w", deadline, err)
+	}
+	return result, err
+}
diff --git a/internal/intromarkers/credits_movie.go b/internal/intromarkers/credits_movie.go
index 6d020b21b2..1854bdafa7 100644
--- a/internal/intromarkers/credits_movie.go
+++ b/internal/intromarkers/credits_movie.go
@@ -138,7 +138,7 @@ func (e *ChromaprintExtractor) SampleMovieTail(ctx context.Context, candidate Ca
 		return creditsTail{}, fmt.Errorf("file %d has no tail window", candidate.FileID)
 	}
 	req := movieTailRequest(ctx, candidate, window)
-	result, err := e.tailRunner(ctx, &req).Run(ctx, req)
+	result, err := runAnalysis(ctx, e.config, e.tailRunner(ctx, &req), req)
 	if err != nil {
 		return creditsTail{}, fmt.Errorf("sampling the movie tail of file %d: %w", candidate.FileID, err)
 	}
@@ -149,7 +149,7 @@ func (e *ChromaprintExtractor) SampleMovieTail(ctx context.Context, candidate Ca
 // SampleMovieSilences returns the silences in window of the candidate's
 // audio.
 func (e *ChromaprintExtractor) SampleMovieSilences(ctx context.Context, candidate Candidate, window fingerprintWindow) ([]mediasample.Interval, error) {
-	result, err := analysisRunner(e.config).Run(ctx, movieSilenceRequest(ctx, candidate, window))
+	result, err := runAnalysis(ctx, e.config, analysisRunner(e.config), movieSilenceRequest(ctx, candidate, window))
 	if err != nil {
 		return nil, fmt.Errorf("detecting movie credits silence for file %d: %w", candidate.FileID, err)
 	}
diff --git a/internal/intromarkers/credits_tail.go b/internal/intromarkers/credits_tail.go
index 5db21404b4..aa62e09e48 100644
--- a/internal/intromarkers/credits_tail.go
+++ b/internal/intromarkers/credits_tail.go
@@ -173,14 +173,14 @@ func (e *ChromaprintExtractor) SampleCreditsTail(ctx context.Context, candidate
 	}
 	req := creditsTailRequest(ctx, candidate, window, fingerprint)
 	runner := e.tailRunner(ctx, &req)
-	result, err := runner.Run(ctx, req)
+	result, err := runAnalysis(ctx, e.config, runner, req)
 	if err != nil && req.Audio != nil && req.Stats != nil && mediasample.Classify(err) == mediasample.ReasonNoStream {
 		// ffmpeg fails the whole run when any output lacks its stream, and
 		// probe metadata can name audio the file cannot give. Run the video
 		// alone: when that succeeds, the audio was missing and the tail has
 		// no silences or fingerprint.
 		req.Audio = nil
-		result, err = runner.Run(ctx, req)
+		result, err = runAnalysis(ctx, e.config, runner, req)
 	}
 	if err != nil {
 		return creditsTailSample{}, fmt.Errorf("sampling the credits tail of file %d: %w", candidate.FileID, err)
diff --git a/internal/intromarkers/credits_tail_test.go b/internal/intromarkers/credits_tail_test.go
index 5125f37ffc..ad9b2b03dd 100644
--- a/internal/intromarkers/credits_tail_test.go
+++ b/internal/intromarkers/credits_tail_test.go
@@ -5,6 +5,7 @@ import (
 	"math"
 	"os/exec"
 	"path/filepath"
+	"slices"
 	"testing"
 	"time"
 
@@ -25,7 +26,7 @@ func TestCreditsTailRequest(t *testing.T) {
 	}
 	wantStats := mediasample.StatsOutput{CropWidth: 0.9, CropHeight: 0.8, Width: 480, BlackThresholds: []int{20, 26, 32}}
 	if req.Stats == nil || req.Stats.CropWidth != wantStats.CropWidth || req.Stats.CropHeight != wantStats.CropHeight ||
-		req.Stats.Width != wantStats.Width || len(req.Stats.BlackThresholds) != 3 || req.Stats.BlackThresholds[0] != 20 || req.Stats.BlackThresholds[2] != 32 {
+		req.Stats.Width != wantStats.Width || !slices.Equal(req.Stats.BlackThresholds, wantStats.BlackThresholds) {
 		t.Fatalf("stats %+v", req.Stats)
 	}
 	if req.Audio == nil || !req.Audio.Fingerprint || *req.Audio.Silence != (mediasample.SilenceParams{NoiseDB: -50, MinSeconds: 0.5}) {
diff --git a/internal/intromarkers/deadline_test.go b/internal/intromarkers/deadline_test.go
new file mode 100644
index 0000000000..a9166a750b
--- /dev/null
+++ b/internal/intromarkers/deadline_test.go
@@ -0,0 +1,196 @@
+package intromarkers
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"log/slog"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/prairie-server/prairie-server/internal/mediasample"
+)
+
+// stalledFFmpeg writes a fake ffmpeg that never finishes, like one whose
+// read is stuck on its storage.
+func stalledFFmpeg(t *testing.T) string {
+	t.Helper()
+	return writeFakeFFmpeg(t, "exec sleep 30")
+}
+
+// finishesWithinDeadline runs f in the background and fails the test if it
+// is still running long after the runs' deadlines: without one, f waits out
+// the fake ffmpeg's 30-second sleep.
+func finishesWithinDeadline(t *testing.T, name string, f func()) {
+	t.Helper()
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+		f()
+	}()
+	select {
+	case <-done:
+	case <-time.After(15 * time.Second):
+		t.Fatalf("%s is still running past its ffmpeg deadline", name)
+	}
+}
+
+// Issue #581: a stalled ffmpeg held intro detection for half an hour. Every
+// run intro and credits detection makes now stops at its deadline and fails
+// as a timeout, which is not permanent.
+func TestAnalysisRunsStopAtTheirDeadline(t *testing.T) {
+	cfg := DefaultConfig(stalledFFmpeg(t))
+	cfg.attemptTimeout = 200 * time.Millisecond
+	extractor := NewChromaprintExtractor(cfg)
+	extractor.hardware.Set("none", "")
+	candidate := Candidate{FileID: 7, FilePath: "/media/show/e1.mkv", DurationSeconds: 1500, CodecVideo: "h264", CodecAudio: "aac"}
+	runs := []struct {
+		name string
+		run  func(context.Context) error
+	}{
+		{"intro fingerprint", func(ctx context.Context) error {
+			_, _, err := extractor.Extract(ctx, candidate)
+			return err
+		}},
+		{"credits fingerprint", func(ctx context.Context) error {
+			_, _, err := extractor.ExtractCredits(ctx, candidate)
+			return err
+		}},
+		{"credits tail", func(ctx context.Context) error {
+			_, err := extractor.SampleCreditsTail(ctx, candidate, true)
+			return err
+		}},
+		{"movie tail", func(ctx context.Context) error {
+			_, err := extractor.SampleMovieTail(ctx, candidate)
+			return err
+		}},
+		{"movie silences", func(ctx context.Context) error {
+			_, err := extractor.SampleMovieSilences(ctx, candidate, fingerprintWindow{Start: 1200, End: 1260})
+			return err
+		}},
+		{"silence refinement", func(ctx context.Context) error {
+			_, _, err := NewSilenceBoundaryRefiner(cfg).RefineChapterEnd(ctx, candidate, Segment{Start: 60, End: 120})
+			return err
+		}},
+	}
+	for _, tc := range runs {
+		var err error
+		finishesWithinDeadline(t, tc.name, func() { err = tc.run(t.Context()) })
+		if mediasample.Classify(err) != mediasample.ReasonTimeout || !strings.Contains(err.Error(), "did not finish within its 200ms deadline") {
+			t.Errorf("%s: error %v, want a timeout at the deadline", tc.name, err)
+		}
+	}
+
+	// A tail pass planned on hardware bounds its software attempt too.
+	extractor.hardware.Set("videotoolbox", "")
+	var err error
+	finishesWithinDeadline(t, "hardware credits tail", func() { _, err = extractor.SampleCreditsTail(t.Context(), candidate, false) })
+	var runErr *mediasample.Error
+	if !errors.As(err, &runErr) || len(runErr.Attempts) != 2 {
+		t.Fatalf("hardware credits tail error %v, want both attempts", err)
+	}
+	for _, attempt := range runErr.Attempts {
+		if attempt.Reason != mediasample.ReasonTimeout {
+			t.Errorf("%s attempt failed as %s, want a timeout", attempt.Decoder, attempt.Reason)
+		}
+	}
+}
+
+// A run's deadline is two minutes plus the running time of the media it
+// reads, on each of its attempts.
+func TestRunAnalysisDeadlineCoversEveryAttempt(t *testing.T) {
+	var remaining []time.Duration
+	runner := mediasample.Runner{FFmpegPath: "ffmpeg", HWAccel: "videotoolbox",
+		Exec: func(ctx context.Context, _ string, _ []string, _ io.Reader, _, _ io.Writer) error {
+			deadline, ok := ctx.Deadline()
+			if !ok {
+				remaining = append(remaining, 0)
+			} else {
+				remaining = append(remaining, time.Until(deadline))
+			}
+			return errors.New("exit status 1")
+		}}
+	candidate := Candidate{FileID: 7, FilePath: "/media/show/e1.mkv", DurationSeconds: 1500, CodecVideo: "h264", CodecAudio: "aac"}
+	req := creditsTailRequest(t.Context(), candidate, fingerprintWindow{Start: 1200, End: 1500}, false)
+	req.Attempts = hardwareAttempts("videotoolbox")
+	if _, err := runAnalysis(t.Context(), DefaultConfig("ffmpeg"), runner, req); err == nil {
+		t.Fatal("runAnalysis succeeded, want the fake's failure")
+	}
+	want := 7 * time.Minute
+	if len(remaining) != 2 {
+		t.Fatalf("ran %d attempts, want hardware then software", len(remaining))
+	}
+	for i, left := range remaining {
+		if left <= want-time.Minute || left > want {
+			t.Errorf("attempt %d had %s left, want about %s", i+1, left, want)
+		}
+	}
+}
+
+func TestAnalysisDeadline(t *testing.T) {
+	cfg := DefaultConfig("ffmpeg")
+	candidate := Candidate{FileID: 7, FilePath: "/media/show/e1.mkv", DurationSeconds: 1500}
+	cases := []struct {
+		name string
+		req  mediasample.Request
+		want time.Duration
+	}{
+		{"intro window", fingerprintRequest(t.Context(), candidate, headWindow(candidate, cfg)), 8*time.Minute + 15*time.Second},
+		// Samples every three seconds from 900 reach 1497.
+		{"movie tail samples", movieTailRequest(t.Context(), candidate, fingerprintWindow{Start: 900, End: 1500}), 11*time.Minute + 57*time.Second},
+		{"no window", mediasample.Request{}, analysisDeadlineBase},
+		{"capped", mediasample.Request{Window: &mediasample.Window{DurationSeconds: 48 * 3600}}, maxAnalysisDeadline},
+	}
+	for _, tc := range cases {
+		if got := analysisDeadline(cfg, tc.req); got != tc.want {
+			t.Errorf("%s: deadline %s, want %s", tc.name, got, tc.want)
+		}
+	}
+}
+
+// Issue #581: a stalled fingerprint run held its intro group, and the task,
+// until an administrator canceled it. The run now fails that file at its
+// deadline, the group finishes with the other files and is stored as
+// partial, and the log says why.
+func TestAnalyzeGroupFailsStalledFingerprintAndFinishes(t *testing.T) {
+	ffmpeg := writeFakeFFmpeg(t, `case "$*" in
+*stalled.mkv*) exec sleep 30 ;;
+esac
+printf '\001\000\000\000'`)
+	cfg := DefaultConfig(ffmpeg)
+	// The deadline also bounds the other files' runs, which start at
+	// background priority, so it leaves them room on a loaded CI host.
+	cfg.attemptTimeout = 5 * time.Second
+	var candidates []Candidate
+	for i, name := range []string{"e1.mkv", "stalled.mkv", "e3.mkv"} {
+		candidates = append(candidates, Candidate{
+			FileID: i + 1, FilePath: "/media/show/" + name, EpisodeID: name, SeasonID: "s1", MediaFolderID: 1, DurationSeconds: 1800,
+		})
+	}
+	repo := &fakeIntroRepository{}
+	var logs bytes.Buffer
+	analyzer := &Analyzer{repo: repo, extractor: NewChromaprintExtractor(cfg), config: cfg, logger: slog.New(slog.NewTextHandler(&logs, nil))}
+
+	var summary RunSummary
+	var err error
+	finishesWithinDeadline(t, "group analysis", func() {
+		summary, err = analyzer.analyzeGroup(t.Context(), candidateGroup{
+			SeasonID: "s1", MediaFolderID: 1, AnalysisGroupKey: candidates[0].AnalysisGroupKey(), Candidates: candidates,
+		}, analyzeGroupOptions{persistState: true})
+	})
+	if err != nil {
+		t.Fatalf("analyzeGroup: %v", err)
+	}
+	if summary.FingerprintExtractionErrors != 1 || summary.FingerprintsComputed != 2 {
+		t.Fatalf("extraction errors %d, computed %d; want the stalled file failed and the other two fingerprinted",
+			summary.FingerprintExtractionErrors, summary.FingerprintsComputed)
+	}
+	if len(repo.upsertedStates) != 1 || repo.upsertedStates[0].Status != seasonStatusPartial {
+		t.Fatalf("stored states = %+v, want one partial state", repo.upsertedStates)
+	}
+	if log := logs.String(); !strings.Contains(log, "file_id=2") || !strings.Contains(log, "did not finish within its 5s deadline") {
+		t.Fatalf("log does not name the stalled file's timeout:\n%s", log)
+	}
+}
diff --git a/internal/intromarkers/hwdecode.go b/internal/intromarkers/hwdecode.go
index f593b6504d..5e947ef988 100644
--- a/internal/intromarkers/hwdecode.go
+++ b/internal/intromarkers/hwdecode.go
@@ -9,8 +9,8 @@ import (
 
 // hardwareAttempts is the attempt plan of a tail pass on accel: hardware
 // first and software after a hardware failure when accel decodes in
-// hardware, and one software attempt otherwise. Like every analysis run,
-// neither has a timeout of its own.
+// hardware, and one software attempt otherwise. runAnalysis gives each its
+// deadline.
 func hardwareAttempts(accel string) []mediasample.Attempt {
 	if !mediasample.SupportsHardwareDecode(accel) {
 		return nil
diff --git a/internal/intromarkers/silence.go b/internal/intromarkers/silence.go
index 8c2275557a..0ca9d30027 100644
--- a/internal/intromarkers/silence.go
+++ b/internal/intromarkers/silence.go
@@ -38,7 +38,7 @@ func (r *SilenceBoundaryRefiner) RefineChapterEnd(ctx context.Context, candidate
 		return segment, false, nil
 	}
 
-	result, err := analysisRunner(cfg).Run(ctx, mediasample.Request{
+	result, err := runAnalysis(ctx, cfg, analysisRunner(cfg), mediasample.Request{
 		Input:  candidate.FilePath,
 		Window: &mediasample.Window{StartSeconds: windowStart, DurationSeconds: windowEnd - windowStart},
 		Audio: &mediasample.AudioOutput{Silence: &mediasample.SilenceParams{
diff --git a/internal/intromarkers/types.go b/internal/intromarkers/types.go
index edbf3823e5..2dfa5ed27d 100644
--- a/internal/intromarkers/types.go
+++ b/internal/intromarkers/types.go
@@ -73,6 +73,10 @@ type Config struct {
 	// artifact or hash.
 	HWAccel  string
 	HWDevice string
+
+	// attemptTimeout, when positive, replaces every analysis run's deadline
+	// (see analysisDeadline). Tests set it.
+	attemptTimeout time.Duration
 }
 
 // Intro duration bounds for a Chromaprint match. Twelve seconds keeps most
diff --git a/internal/jellycompat/auto_transcode_fallback_test.go b/internal/jellycompat/auto_transcode_fallback_test.go
index 44b4f5cc51..3eacf28eac 100644
--- a/internal/jellycompat/auto_transcode_fallback_test.go
+++ b/internal/jellycompat/auto_transcode_fallback_test.go
@@ -12,6 +12,7 @@ import (
 	"time"
 
 	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 	"github.com/prairie-server/prairie-server/internal/nodepool"
 	"github.com/prairie-server/prairie-server/internal/playback"
 	"github.com/prairie-server/prairie-server/internal/transcodenode"
@@ -163,6 +164,9 @@ func startCompatRemoteAutoTranscode(t *testing.T, report string, response transc
 			w.WriteHeader(http.StatusNotFound)
 			return
 		}
+		if !nodeauthtest.Signed(r, "secret") {
+			t.Error("remote transcode start was not signed with the shared secret")
+		}
 		if err := json.NewDecoder(r.Body).Decode(&remoteReq); err != nil {
 			t.Errorf("decode remote request: %v", err)
 		}
diff --git a/internal/jellycompat/batch_loaders.go b/internal/jellycompat/batch_loaders.go
index d2efc44820..d9f373ccde 100644
--- a/internal/jellycompat/batch_loaders.go
+++ b/internal/jellycompat/batch_loaders.go
@@ -357,6 +357,8 @@ func (h *ItemsHandler) fetchCompatEpisodeTargetsByContentIDs(ctx context.Context
 				BackdropURL:       compatPresignImage(h.detailSvc, ctx, seriesBackdrop, "backdrop", compatCardImageSize),
 				BackdropPath:      seriesBackdrop,
 				BackdropThumbhash: seriesBackdropTH,
+				LogoURL:           listItem.LogoURL,
+				LogoPath:          seriesLogoPath,
 				UpdatedAt:         seriesUpdatedAt,
 			},
 			SeasonID:   seasonID,
@@ -496,6 +498,8 @@ func (h *ItemsHandler) fetchCompatEpisodeTargetsByContentIDsFallback(ctx context
 				BackdropURL:       compatPresignImage(h.detailSvc, ctx, series.BackdropPath, "backdrop", compatCardImageSize),
 				BackdropPath:      series.BackdropPath,
 				BackdropThumbhash: series.BackdropThumbhash,
+				LogoURL:           listItem.LogoURL,
+				LogoPath:          series.LogoPath,
 				UpdatedAt:         series.UpdatedAt,
 			},
 			SeasonID: episode.SeasonID,
diff --git a/internal/jellycompat/batch_loaders_test.go b/internal/jellycompat/batch_loaders_test.go
index bb83939fad..e6999d8932 100644
--- a/internal/jellycompat/batch_loaders_test.go
+++ b/internal/jellycompat/batch_loaders_test.go
@@ -441,3 +441,28 @@ func TestFetchCompatEpisodeTargetsByContentIDs_ResolvesDurationOnlyWhenRequested
 		t.Fatalf("duration-enriched duration = %d, want 1500", got)
 	}
 }
+
+// The series logo travels with the other series artwork, so episodes can name
+// it as their ParentLogo.
+func TestFetchCompatEpisodeTargetsByContentIDsFallback_CarriesSeriesLogo(t *testing.T) {
+	itemRepo := &countingItemRepo{
+		itemsByID: map[string]*models.MediaItem{
+			"series-1": {ContentID: "series-1", Type: "series", Title: "Show", LogoPath: "series-1/logo.png"},
+		},
+	}
+	episodeRepo := &countingEpisodeRepo{
+		episodesByID: map[string]*models.Episode{
+			"ep-1": {ContentID: "ep-1", SeriesID: "series-1", Title: "Pilot"},
+		},
+	}
+	h := &ItemsHandler{itemRepo: itemRepo, episodeRepo: episodeRepo}
+
+	got, err := h.fetchCompatEpisodeTargetsByContentIDsFallback(context.Background(), &Session{}, []string{"ep-1"}, nil)
+	if err != nil {
+		t.Fatalf("fetchCompatEpisodeTargetsByContentIDsFallback returned error: %v", err)
+	}
+	images := got["ep-1"].SeriesImages
+	if images.LogoPath != "series-1/logo.png" || images.LogoURL == "" {
+		t.Fatalf("series logo not carried: path=%q url=%q", images.LogoPath, images.LogoURL)
+	}
+}
diff --git a/internal/jellycompat/browse_user_state_test.go b/internal/jellycompat/browse_user_state_test.go
index dbfa0395f1..0153e59957 100644
--- a/internal/jellycompat/browse_user_state_test.go
+++ b/internal/jellycompat/browse_user_state_test.go
@@ -25,7 +25,7 @@ func TestConfiguredBrowseStateSQLiteCountAndPage(t *testing.T) {
 		id := fmt.Sprintf("movie-%03d", i)
 		browse.items = append(browse.items, &models.MediaItem{ContentID: id, Type: "movie", Title: id})
 		if i%50 == 0 {
-			if err := store.AddFavorite(t.Context(), "p1", id); err != nil {
+			if _, err := store.AddFavorite(t.Context(), "p1", id); err != nil {
 				t.Fatal(err)
 			}
 			if err := store.SetProgressAt(t.Context(), "p1", id, 10, 100, false, now); err != nil {
@@ -184,7 +184,7 @@ func TestConfiguredParentEpisodesCountBeforePaging(t *testing.T) {
 					id := fmt.Sprintf("ep-%03d", i)
 					repo.all = append(repo.all, &models.Episode{ContentID: id, SeriesID: "series", SeasonID: "season", SeasonNumber: 2, EpisodeNumber: i + 1})
 					if i == 1 || i == 100 || i == 104 || i == 250 {
-						if err := store.AddFavorite(t.Context(), "p1", id); err != nil {
+						if _, err := store.AddFavorite(t.Context(), "p1", id); err != nil {
 							t.Fatal(err)
 						}
 					}
@@ -312,7 +312,7 @@ func TestConfiguredSeriesBrowseEnrichesSelectedPage(t *testing.T) {
 	store := newJellycompatUserStore(t)
 	now := time.Now().UTC()
 	for _, id := range []string{"done-first", "partial", "done-last"} {
-		if err := store.AddFavorite(t.Context(), "p1", id); err != nil {
+		if _, err := store.AddFavorite(t.Context(), "p1", id); err != nil {
 			t.Fatal(err)
 		}
 	}
diff --git a/internal/jellycompat/content_direct.go b/internal/jellycompat/content_direct.go
index 8c3afcadd8..d5341dbc3a 100644
--- a/internal/jellycompat/content_direct.go
+++ b/internal/jellycompat/content_direct.go
@@ -1467,6 +1467,22 @@ func itemDetailToUpstream(d *catalog.ItemDetail) upstreamItemDetail {
 		ClearArtPath:       d.ClearArtPath,
 		DiscPath:           d.DiscPath,
 		ExtraBackdropPaths: d.ExtraBackdropPaths,
+		// The stored paths seed the image tags alongside UpdatedAt; without
+		// them the timestamp alone would give every language's artwork, and
+		// every artwork update that leaves the item row alone, the same tag.
+		PosterPath:   d.PosterPath,
+		BackdropPath: d.BackdropPath,
+		LogoPath:     d.LogoPath,
+		UpdatedAt:    d.UpdatedAt,
+	}
+	// A thumbhash joins the seed only with its stored path. Episode and season
+	// details carry no paths, and a thumbhash alone would keep a replaced
+	// image's tag; without either their tags follow the presigned URL.
+	if d.PosterPath != "" {
+		detail.PosterThumbhash = d.PosterThumbhash
+	}
+	if d.BackdropPath != "" {
+		detail.BackdropThumbhash = d.BackdropThumbhash
 	}
 	if detail.Genres == nil {
 		detail.Genres = []string{}
diff --git a/internal/jellycompat/deviceprofile.go b/internal/jellycompat/deviceprofile.go
index e9d80cfd9f..bad960a931 100644
--- a/internal/jellycompat/deviceprofile.go
+++ b/internal/jellycompat/deviceprofile.go
@@ -270,9 +270,12 @@ func (p DeviceProfile) supportsVideoTranscodingOutput(version catalog.FileVersio
 	output.HDR = false
 	sourceVideo := compatPrimaryVideoTrack(version)
 	// Source codec levels, reference frames and HDR metadata do not describe
-	// the encoded stream. Profile and level depend on the chosen worker's
-	// encoder; leave them unknown so required conditions remain fail-closed.
-	// Full HDR encodes are separately gated on tone-map availability.
+	// the encoded stream. An H.264 encode states its profile and level (see
+	// h264EncodeFacts); its reference frames stay the encoder's choice (see
+	// encodeOutputConditionsMatch). An HEVC encode's profile, level and
+	// reference frames stay unknown, so required rules on them fail closed and
+	// an uncertain HEVC encode falls back to H.264. Full HDR encodes are
+	// separately gated on tone-map availability.
 	video := models.VideoTrack{
 		Codec: videoCodec, BitDepth: 8, VideoRangeType: compatRangeSDR,
 		Width: sourceVideo.Width, Height: sourceVideo.Height,
@@ -287,6 +290,9 @@ func (p DeviceProfile) supportsVideoTranscodingOutput(version catalog.FileVersio
 			video.Width = int(math.Round(float64(sourceVideo.Width)*float64(height)/float64(sourceVideo.Height)/2)) * 2
 		}
 	}
+	if videoCodec == compatTargetVideoCodec {
+		video.Profile, video.Level = h264EncodeFacts(video, videoBitrateKbps, version)
+	}
 	if videoBitrateKbps > 0 {
 		video.Bitrate = videoBitrateKbps * 1000
 		output.Bitrate = videoBitrateKbps + audioBitrateKbps
@@ -296,7 +302,12 @@ func (p DeviceProfile) supportsVideoTranscodingOutput(version catalog.FileVersio
 	audioIndex := len(output.VideoTracks)
 	// Both encoded outputs use HLS. Apply codec profiles scoped to its
 	// segment container, including Container=hls with SubContainer=mp4/ts.
-	if !p.codecProfileCompatibilityWithValues(output, &audioIndex, buildConditionValues(output, &audioIndex), container, true).supportsDirectPlay() {
+	outputValues := encodeOutputConditionValues(output, &audioIndex)
+	matchOutput := conditionsMatch
+	if videoCodec == compatTargetVideoCodec {
+		matchOutput = encodeOutputConditionsMatch
+	}
+	if !p.codecProfileCompatibilityWithMatcher(output, &audioIndex, outputValues, container, true, matchOutput).supportsDirectPlay() {
 		return false
 	}
 
@@ -314,7 +325,7 @@ func (p DeviceProfile) supportsVideoTranscodingOutput(version catalog.FileVersio
 		if maxChannels, _ := strconv.Atoi(profile.MaxAudioChannels); maxChannels > 0 && channels > maxChannels {
 			continue
 		}
-		if !conditionsMatch(profile.Conditions, buildConditionValues(output, &audioIndex)) {
+		if !matchOutput(profile.Conditions, outputValues) {
 			continue
 		}
 		if (requireExplicitProfile && strings.TrimSpace(profile.VideoCodec) == "") || !matchesCSV(profile.VideoCodec, videoCodec) {
@@ -331,6 +342,32 @@ func (p DeviceProfile) supportsVideoTranscodingOutput(version catalog.FileVersio
 	return false
 }
 
+// h264StreamingLevel is the level the streaming libx264 encode is pinned to
+// (playback.appendVideoArgs); other encoders pick a level from the stream.
+const h264StreamingLevel = 41
+
+// h264EncodeFacts states the profile and level of an H.264 encode of video,
+// whose frame size and rate are already the output's. Every H.264 encode
+// here is High profile (playback.H264EncodeProfile). The level is the one the
+// stream needs at the rate the encoder is configured with: a capped encode
+// sets its maximum rate to videoBitrateKbps (appendCappedVBRArgs), whatever
+// the source's rate; an uncapped encode has no rate ceiling and is estimated
+// at the source's H.264-equivalent rate. It is never below the 4.1 the
+// streaming libx264 encode is pinned to, so a rule checks the higher of the
+// two.
+func h264EncodeFacts(video models.VideoTrack, videoBitrateKbps int, source catalog.FileVersion) (profile string, level int) {
+	kbps := videoBitrateKbps
+	if kbps <= 0 {
+		kbps = playback.H264EquivalentKbps(source.Bitrate, source.CodecVideo)
+	}
+	// Not max: this package's max(value, fallback) returns any positive value.
+	level = playback.H264LevelFor(video.Width, video.Height, parseCompatFrameRate(video.FrameRate), kbps)
+	if level < h264StreamingLevel {
+		level = h264StreamingLevel
+	}
+	return playback.H264EncodeProfile, level
+}
+
 // SupportsHLSRemuxForAudioStream reports whether the client accepts the
 // source codecs in an HLS fragmented-MP4 stream. Codec-profile conditions are
 // evaluated against the sample entry Silo will write, not against an unknown
diff --git a/internal/jellycompat/deviceprofile_conditions.go b/internal/jellycompat/deviceprofile_conditions.go
index 9f7e8c92d8..60b2a7f676 100644
--- a/internal/jellycompat/deviceprofile_conditions.go
+++ b/internal/jellycompat/deviceprofile_conditions.go
@@ -307,6 +307,50 @@ func conditionsOnlyTargetAudio(conditions []ProfileCondition) bool {
 	return true
 }
 
+// encodeOutputConditionValues are the condition values of a planned encode.
+// Unlike a scanned file's, an encode's unknown reference-frame count gets no
+// FFmpeg 7 stand-in (see buildConditionValues): the encoder chooses it.
+func encodeOutputConditionValues(output catalog.FileVersion, audioStreamIndex *int) conditionValues {
+	values := buildConditionValues(output, audioStreamIndex)
+	if compatPrimaryVideoTrack(output).ReferenceFrames <= 0 {
+		delete(values, conditionPropertyRefFrames)
+	}
+	return values
+}
+
+// Normalized condition properties of the facts an encoder chooses.
+const (
+	conditionPropertyRefFrames    = "refframes"
+	conditionPropertyVideoProfile = "videoprofile"
+	conditionPropertyVideoLevel   = "videolevel"
+)
+
+// encodeOutputConditionsMatch matches conditions against a planned H.264
+// encode. Its reference frames are the encoder's choice and Prairie does not yet
+// pass a client's limit to the encoder, so, as Jellyfin's StreamBuilder treats
+// a RefFrames rule (ApplyTranscodingConditions), the rule is an encode target
+// rather than a refusal. The streaming libx264 presets use one reference
+// frame. An optional rule on the stated profile or level is an encode target
+// too: Jellyfin applies it the same way, and before the encode stated them it
+// passed as unknown, so a client that sends one with a high bitrate limit
+// keeps its transcode. Every other rule, and a required profile or level
+// rule, is checked as usual.
+func encodeOutputConditionsMatch(conditions []ProfileCondition, values conditionValues) bool {
+	for _, condition := range conditions {
+		property := normalizeConditionToken(condition.Property)
+		if _, known := values[property]; !known && property == conditionPropertyRefFrames {
+			continue
+		}
+		if !condition.IsRequired && (property == conditionPropertyVideoProfile || property == conditionPropertyVideoLevel) {
+			continue
+		}
+		if !conditionMatches(condition, values) {
+			return false
+		}
+	}
+	return true
+}
+
 func conditionsMatch(conditions []ProfileCondition, values conditionValues) bool {
 	for _, condition := range conditions {
 		if !conditionMatches(condition, values) {
@@ -357,9 +401,10 @@ func buildConditionValues(version catalog.FileVersion, audioStreamIndex *int) co
 		"isinterlaced":   {text: strconv.FormatBool(video.Interlaced)},
 	}
 
-	// Everything below is only inserted when Silo actually knows the value.
-	// An absent key falls through to conditionMatches' IsRequired handling,
-	// mirroring how Jellyfin's ConditionProcessor treats a null value.
+	// Everything below is only inserted when Prairie actually knows the value,
+	// except a scanned file's reference frames (see below). An absent key
+	// falls through to conditionMatches' IsRequired handling, mirroring how
+	// Jellyfin's ConditionProcessor treats a null value.
 	if strings.TrimSpace(video.Profile) != "" {
 		values["videoprofile"] = conditionValue{text: video.Profile}
 	}
@@ -368,6 +413,18 @@ func buildConditionValues(version catalog.FileVersion, audioStreamIndex *int) co
 	}
 	if refFrames := intConditionValue(video.ReferenceFrames); refFrames.hasNum {
 		values["refframes"] = refFrames
+	} else {
+		// FFmpeg 8.1 reports a stream's reference frames only while reading
+		// frames, so no scanned file carries a count (see mediaprobe.Stream).
+		// Under FFmpeg 7, ffprobe reported the decoder default of 1 for every
+		// file, Jellyfin recorded that 1, and clients tuned their rules to it:
+		// Moonfin requires RefFrames <= 4 from 1900 pixels wide. A planned
+		// encode does not get this stand-in (see encodeOutputConditionValues).
+		// Failing such a rule here would force an encode of every HD H.264
+		// file those clients direct play on Jellyfin, so evaluate it against
+		// the same 1. Reading max_num_ref_frames from the SPS at scan time
+		// would replace this with the real count.
+		values["refframes"] = intConditionValue(1)
 	}
 	if width := intConditionValue(video.Width); width.hasNum {
 		values["width"] = width
diff --git a/internal/jellycompat/deviceprofile_conditions_test.go b/internal/jellycompat/deviceprofile_conditions_test.go
index 2798334e9f..ba11acc345 100644
--- a/internal/jellycompat/deviceprofile_conditions_test.go
+++ b/internal/jellycompat/deviceprofile_conditions_test.go
@@ -546,10 +546,15 @@ func TestCodecProfileAVCRefFramesConstraint(t *testing.T) {
 	if !source.SupportsTranscoding {
 		t.Fatal("SupportsTranscoding = false for an optional unknown output value")
 	}
+	// A required limit is an encode target too: the encoder chooses the
+	// output's reference frames, as Jellyfin's StreamBuilder treats them.
 	profile.CodecProfiles[0].Conditions[0].IsRequired = true
 	source = (&PlaybackHandler{codec: NewResourceIDCodec()}).buildPlaybackSource("item", "play", version, profile, playbackInfoRequest{}, true)
-	if source.SupportsTranscoding {
-		t.Fatal("SupportsTranscoding = true for a required unknown output value")
+	if source.SupportsDirectPlay || source.SupportsDirectStream {
+		t.Fatalf("a known eight reference frames passed a required limit of four: direct=%v stream=%v", source.SupportsDirectPlay, source.SupportsDirectStream)
+	}
+	if !source.SupportsTranscoding {
+		t.Fatal("SupportsTranscoding = false for a required limit the encode meets")
 	}
 }
 
diff --git a/internal/jellycompat/dto.go b/internal/jellycompat/dto.go
index cd07af3e4c..51f0a24326 100644
--- a/internal/jellycompat/dto.go
+++ b/internal/jellycompat/dto.go
@@ -102,6 +102,8 @@ type baseItemDTO struct {
 	ParentBackdropItemID     string                                 `json:"ParentBackdropItemId,omitempty"`
 	ParentThumbImageTag      string                                 `json:"ParentThumbImageTag,omitempty"`
 	ParentThumbItemID        string                                 `json:"ParentThumbItemId,omitempty"`
+	ParentLogoItemID         string                                 `json:"ParentLogoItemId,omitempty"`
+	ParentLogoImageTag       string                                 `json:"ParentLogoImageTag,omitempty"`
 	ParentPrimaryImageItemID string                                 `json:"ParentPrimaryImageItemId,omitempty"`
 	ParentPrimaryImageTag    string                                 `json:"ParentPrimaryImageTag,omitempty"`
 	ParentID                 string                                 `json:"ParentId,omitempty"`
diff --git a/internal/jellycompat/handlers_collections_test.go b/internal/jellycompat/handlers_collections_test.go
index 0c7a44f98f..2aa6890f58 100644
--- a/internal/jellycompat/handlers_collections_test.go
+++ b/internal/jellycompat/handlers_collections_test.go
@@ -397,6 +397,11 @@ func TestHandleItems_SpecificIdsIncludeBoxSets(t *testing.T) {
 	if len(result.Items) != 1 || result.Items[0].Type != "BoxSet" || result.Items[0].Name != "Marvel" {
 		t.Fatalf("expected the BoxSet DTO for Ids= re-hydration, got %+v", result.Items)
 	}
+
+	repeated := performItemsRequest(t, h, "/Items?Ids="+url.QueryEscape(boxSetID)+"&Ids="+url.QueryEscape(boxSetID))
+	if len(repeated.Items) != 1 || repeated.TotalRecordCount != 1 {
+		t.Fatalf("expected a repeated BoxSet ID once, got %d items (total %d)", len(repeated.Items), repeated.TotalRecordCount)
+	}
 }
 
 func TestParseItemsQuery_BoxSetFlags(t *testing.T) {
@@ -534,6 +539,27 @@ func TestHandleItems_CollectionsViewRehydratedByIds(t *testing.T) {
 	}
 }
 
+// An Ids value that names nothing empties a Collections view browse too, and
+// a repeated Ids value can still name the view itself.
+func TestHandleItems_CollectionsViewWithUnmatchedIDs(t *testing.T) {
+	collections := &fakeCollectionSource{
+		collections: []*models.LibraryCollection{
+			{ID: "101", LibraryID: 1, Title: "Marvel", Visibility: "visible"},
+		},
+	}
+	h := newCollectionsTestHandler(collections, []upstreamUserLibrary{{ID: 1, Name: "Movies", Type: "movies"}}, nil)
+
+	empty := performItemsRequest(t, h, "/Items?ParentId="+collectionsViewID+"&Ids=not-an-id&IncludeItemTypes=BoxSet")
+	if empty.TotalRecordCount != 0 || len(empty.Items) != 0 {
+		t.Fatalf("expected no items for an unresolvable Ids, got %+v", empty.Items)
+	}
+
+	view := performItemsRequest(t, h, "/Items?Ids=not-an-id&Ids="+collectionsViewID+"&IncludeItemTypes=CollectionFolder")
+	if len(view.Items) != 1 || view.Items[0].ID != collectionsViewID {
+		t.Fatalf("expected the Collections view from a repeated Ids, got %+v", view.Items)
+	}
+}
+
 func TestHandleItems_CollectionsViewParentListsBoxSets(t *testing.T) {
 	t.Parallel()
 	collections := &fakeCollectionSource{
diff --git a/internal/jellycompat/handlers_displayprefs.go b/internal/jellycompat/handlers_displayprefs.go
index bab8f29723..e0f091d31f 100644
--- a/internal/jellycompat/handlers_displayprefs.go
+++ b/internal/jellycompat/handlers_displayprefs.go
@@ -257,7 +257,7 @@ func (h *DisplayPreferencesHandler) seedFromProfile(r *http.Request, session *Se
 }
 
 func profilePreferencesID(profileID, id string) string {
-	return fmt.Sprintf("profile:%d:%s:%s", len(profileID), profileID, id)
+	return userstore.ProfileDisplayPrefsID(profileID, id)
 }
 
 func validateOptionalUser(w http.ResponseWriter, r *http.Request, session *Session) bool {
diff --git a/internal/jellycompat/handlers_genres_test.go b/internal/jellycompat/handlers_genres_test.go
index d221606fb7..0dbc12f624 100644
--- a/internal/jellycompat/handlers_genres_test.go
+++ b/internal/jellycompat/handlers_genres_test.go
@@ -3,6 +3,7 @@ package jellycompat
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"net/http/httptest"
 	"net/url"
 	"testing"
@@ -63,3 +64,41 @@ func TestHandleGenreByName(t *testing.T) {
 		t.Fatalf("expected 404 for unknown genre, got %d", rec.Code)
 	}
 }
+
+// Jellyfin returns every genre when Limit is absent and none for Limit=0; the
+// default page size of 24 is for item browsing.
+func TestHandleGenresListsAllWithoutLimit(t *testing.T) {
+	genres := make([]string, 30)
+	for i := range genres {
+		genres[i] = fmt.Sprintf("Genre %02d", i)
+	}
+	h := &ItemsHandler{content: &genresContentService{genres: genres}, codec: NewResourceIDCodec()}
+	for _, tc := range []struct {
+		query     string
+		wantItems int
+		wantTotal int
+		wantFirst string
+	}{
+		{"", 30, 30, "Genre 00"},
+		{"?StartIndex=2", 28, 30, "Genre 02"},
+		{"?StartIndex=2&Limit=5", 5, 30, "Genre 02"},
+		{"?Limit=5", 5, 30, "Genre 00"},
+		{"?Limit=0", 0, 30, ""},
+	} {
+		req := httptest.NewRequest("GET", "/Genres"+tc.query, nil)
+		req = req.WithContext(context.WithValue(req.Context(), compatSessionKey, &Session{StreamAppUserID: 1, ProfileID: "p1"}))
+		rec := httptest.NewRecorder()
+		h.HandleGenres(rec, req)
+		var result queryResultDTO
+		if err := json.Unmarshal(rec.Body.Bytes(), &result); err != nil {
+			t.Fatalf("%q: %v: %s", tc.query, err, rec.Body.String())
+		}
+		first := ""
+		if len(result.Items) > 0 {
+			first = result.Items[0].Name
+		}
+		if len(result.Items) != tc.wantItems || result.TotalRecordCount != tc.wantTotal || first != tc.wantFirst {
+			t.Errorf("%q: items=%d total=%d first=%q, want %d, %d and %q", tc.query, len(result.Items), result.TotalRecordCount, first, tc.wantItems, tc.wantTotal, tc.wantFirst)
+		}
+	}
+}
diff --git a/internal/jellycompat/handlers_images.go b/internal/jellycompat/handlers_images.go
index 5f259093cf..240492e59d 100644
--- a/internal/jellycompat/handlers_images.go
+++ b/internal/jellycompat/handlers_images.go
@@ -15,8 +15,11 @@ import (
 	"github.com/jackc/pgx/v5"
 
 	"github.com/prairie-server/prairie-server/internal/artworkkey"
+	"github.com/prairie-server/prairie-server/internal/artworkurl"
+	"github.com/prairie-server/prairie-server/internal/blobstore"
 	"github.com/prairie-server/prairie-server/internal/catalog"
 	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/netguard"
 )
 
 // ImagesHandler serves Jellyfin-compatible image routes.
@@ -62,6 +65,9 @@ type ImagesHandler struct {
 	// served straight from the embedded frontend assets. Without it those paths
 	// have no fetchable origin on the compat surface.
 	frontendFS fs.FS
+	// artworkStore decides which proxied URLs may reach the local network;
+	// see Dependencies.ArtworkStore.
+	artworkStore blobstore.Store
 }
 
 type extraBackdropSource interface {
@@ -93,7 +99,7 @@ type imageFolderRepository interface {
 // NewImagesHandler creates a Jellyfin-compatible image route handler.
 func NewImagesHandler(content ContentService, codec *ResourceIDCodec, sessions *SessionStore, images *ImageCache, personRepo *catalog.PersonRepository, detailSvc *catalog.DetailService, itemRepo *catalog.ItemRepository, folderRepo *catalog.FolderRepository, seasonRepo *catalog.SeasonRepository, episodeRepo *catalog.EpisodeRepository, accessFilter AccessFilterResolver, posterSigner LibraryPosterPresigner, presignTTL time.Duration, imageTagSecret string, httpClient *http.Client) *ImagesHandler {
 	if httpClient == nil {
-		httpClient = http.DefaultClient
+		httpClient = newCompatImageClient()
 	}
 	// A nil concrete repository has to stay nil in the interface field, or the
 	// nil checks guarding the person route would see a non-nil interface holding
@@ -272,8 +278,8 @@ func (h *ImagesHandler) handlePersonImage(w http.ResponseWriter, r *http.Request
 		return
 	}
 	// Headshots ride the profile ladder ({500, 300}), not the poster ladder,
-	// which now carries a w780 rung. Resolving them as posters would name a
-	// profile/w780 key that is never generated — and the server-side ladder
+	// which carries wider rungs. Resolving them as posters would name a
+	// profile/w1000 key that is never generated — and the server-side ladder
 	// fallback deliberately skips profile, so nothing would rescue it.
 	resolvedImage := compatPresignImageWithExpiry(h.detailSvc, r.Context(), person.PhotoPath, artworkkey.ImageProfile, imageSize)
 	imageURL := resolvedImage.URL
@@ -809,7 +815,8 @@ func (h *ImagesHandler) proxyImageURL(w http.ResponseWriter, r *http.Request, im
 		return
 	}
 
-	req, err := http.NewRequestWithContext(r.Context(), http.MethodGet, target.String(), nil)
+	ctx := artworkurl.FetchContext(r.Context(), h.artworkStore, target.String())
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, target.String(), nil)
 	if err != nil {
 		writeError(w, http.StatusBadGateway, "UpstreamError", "Failed to load image")
 		return
@@ -818,7 +825,7 @@ func (h *ImagesHandler) proxyImageURL(w http.ResponseWriter, r *http.Request, im
 
 	client := h.httpClient
 	if client == nil {
-		client = http.DefaultClient
+		client = newCompatImageClient()
 	}
 	resp, err := client.Do(req)
 	if err != nil {
@@ -828,6 +835,14 @@ func (h *ImagesHandler) proxyImageURL(w http.ResponseWriter, r *http.Request, im
 	proxyImage(w, resp)
 }
 
+// newCompatImageClient returns the client proxied images are fetched with.
+// Its netguard transport checks every address it dials, redirect hops
+// included, so a stored metadata-provider URL cannot reach the server's own
+// network; artworkurl.FetchContext trusts the artwork store's direct URLs.
+func newCompatImageClient() *http.Client {
+	return netguard.NewClient(30 * time.Second)
+}
+
 func parseRemoteImageURL(imageURL string) (*url.URL, error) {
 	target, err := url.Parse(imageURL)
 	if err != nil || target.Scheme == "" || target.Host == "" ||
diff --git a/internal/jellycompat/handlers_items.go b/internal/jellycompat/handlers_items.go
index 7d0baa6af4..d1f2ea66e0 100644
--- a/internal/jellycompat/handlers_items.go
+++ b/internal/jellycompat/handlers_items.go
@@ -206,6 +206,13 @@ func (h *ItemsHandler) HandleItems(w http.ResponseWriter, r *http.Request) {
 	}
 
 	query := parseItemsQuery(r, h.codec)
+	if query.matchesNothing() {
+		// A genre, person, studio, or item filter whose IDs name nothing
+		// matches nothing, rather than falling back to an unfiltered browse
+		// or the Collections view's BoxSet list.
+		writeJSON(w, http.StatusOK, emptyQueryResult(query.startIndex))
+		return
+	}
 
 	// Browsing the synthetic Collections view lists its BoxSets. The view ID is
 	// a fixed Jellyfin sentinel (not a codec-encoded ID), so it is matched here
@@ -231,10 +238,6 @@ func (h *ItemsHandler) HandleItems(w http.ResponseWriter, r *http.Request) {
 	}
 
 	switch {
-	case query.unmatchedIDFilter:
-		// A genre or person filter whose IDs name nothing matches nothing,
-		// rather than falling back to an unfiltered browse.
-		writeJSON(w, http.StatusOK, emptyQueryResult(query.startIndex))
 	case len(query.specificIDs) > 0 || len(query.specificCollectionIDs) > 0 || idsRequestCollectionsView(r):
 		h.handleSpecificItems(w, r, session, query)
 	case query.parentCollectionID != "":
@@ -270,7 +273,7 @@ func (h *ItemsHandler) HandleItems(w http.ResponseWriter, r *http.Request) {
 		h.handleSearchItems(w, r, session, query)
 	case query.isFavorite:
 		h.handleFavoriteItems(w, r, session, query)
-	case query.parentLibraryID == 0 && len(query.itemTypes) == 0 && !query.recursive && !query.hasRootFilter:
+	case query.listsUserRootViews():
 		// No ParentId and no filter: return top-level library views.
 		// Jellyfin clients (e.g. Findroid "My Media") call GET /Items?userId=...
 		// and expect CollectionFolder items representing the user's libraries.
@@ -649,13 +652,17 @@ func (h *ItemsHandler) HandleSimilar(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	// Tier 1: embedding-based recommendations.
-	if h.recommender != nil {
-		scored, recErr := h.recommender.SimilarItems(r.Context(), contentID, limit)
-		if recErr == nil && len(scored) > 0 {
-			if h.writeSimilarFromScored(w, r, session, scored, limit) {
-				return
-			}
+	// Tier 1: embedding-based recommendations, anchored only on an item the
+	// viewer can see. A hidden anchor goes to the genre path, which answers
+	// it as an unknown item, so the list cannot show what a hidden title
+	// resembles.
+	if h.recommender != nil && h.similarAnchorVisible(r.Context(), session, contentID) {
+		scored, recErr := h.recommender.SimilarItems(r.Context(), session.StreamAppUserID, session.ProfileID, contentID, limit, h.resolveAccessFilter(r.Context(), session))
+		if recErr != nil {
+			slog.WarnContext(r.Context(), "jellycompat: similar items failed; falling back to genre", "component", "jellycompat",
+				"user_id", session.StreamAppUserID, "profile_id", session.ProfileID, "content_id", contentID, "error", recErr)
+		} else if len(scored) > 0 && h.writeSimilarFromScored(w, r, session, scored, limit) {
+			return
 		}
 	}
 
@@ -663,6 +670,24 @@ func (h *ItemsHandler) HandleSimilar(w http.ResponseWriter, r *http.Request) {
 	h.writeSimilarFromGenre(w, r, session, contentID, limit)
 }
 
+// similarAnchorVisible reports whether the session's viewer can see the
+// catalog item a Similar list is anchored on. A failed check counts as not
+// visible.
+func (h *ItemsHandler) similarAnchorVisible(ctx context.Context, session *Session, contentID string) bool {
+	items, err := h.loadCompatItemsByContentIDs(ctx, session, []string{contentID}, nil)
+	if err != nil {
+		slog.WarnContext(ctx, "jellycompat: similar anchor access check failed", "component", "jellycompat",
+			"user_id", session.StreamAppUserID, "profile_id", session.ProfileID, "content_id", contentID, "error", err)
+		return false
+	}
+	for _, item := range items {
+		if item.ContentID == contentID {
+			return true
+		}
+	}
+	return false
+}
+
 // writeSimilarFromScored converts recommender ScoredItem results into a Jellyfin query result.
 // It returns false when all scored candidates are filtered out so the caller can
 // fall back to the genre-based browse path.
@@ -674,6 +699,8 @@ func (h *ItemsHandler) writeSimilarFromScored(w http.ResponseWriter, r *http.Req
 
 	itemsByID, err := h.fetchCompatItemsByContentIDs(r.Context(), session, contentIDs, nil)
 	if err != nil {
+		slog.WarnContext(r.Context(), "jellycompat: similar items lookup failed", "component", "jellycompat",
+			"user_id", session.StreamAppUserID, "profile_id", session.ProfileID, "error", err)
 		writeJSON(w, http.StatusOK, queryResultDTO{Items: []baseItemDTO{}, TotalRecordCount: 0})
 		return true
 	}
@@ -713,6 +740,22 @@ func (h *ItemsHandler) writeSimilarFromScored(w http.ResponseWriter, r *http.Req
 }
 
 // writeSimilarFromGenre finds similar items by genre when the recommender is unavailable.
+// similarGenreFallbackWindow is how many genre titles the Similar fallback
+// first reads for a list of limit: three times the list and the anchor.
+func similarGenreFallbackWindow(limit int) int {
+	return 3*limit + 1
+}
+
+// similarGenreFallbackMaxRead bounds how deep the Similar fallback reads to
+// fill its list past the profile's Not interested titles.
+const similarGenreFallbackMaxRead = 400
+
+// notInterestedLister is the optional part of UserDataService that reads a
+// profile's Not interested marks. The direct service implements it.
+type notInterestedLister interface {
+	ListNotInterestedByMediaItems(ctx context.Context, session *Session, mediaItemIDs []string) (map[string]bool, error)
+}
+
 func (h *ItemsHandler) writeSimilarFromGenre(w http.ResponseWriter, r *http.Request, session *Session, contentID string, limit int) {
 	empty := queryResultDTO{Items: []baseItemDTO{}, TotalRecordCount: 0}
 
@@ -736,33 +779,55 @@ func (h *ItemsHandler) writeSimilarFromGenre(w http.ResponseWriter, r *http.Requ
 	params.Set("genre", genre)
 	params.Set("sort", "rating_tmdb")
 	params.Set("order", "desc")
-	params.Set("limit", strconv.Itoa(limit+1))
 
-	result, err := h.content.BrowseItems(r.Context(), session, params)
-	if err != nil {
-		writeJSON(w, http.StatusOK, empty)
-		return
-	}
+	// The anchor and the profile's Not interested titles are dropped, so the
+	// window starts deeper than the list and widens until the list fills,
+	// the genre runs out, or similarGenreFallbackMaxRead titles were read.
+	var items []baseItemDTO
+	var listItems []upstreamListItem
+	for window := similarGenreFallbackWindow(limit); ; window = min(window*4, similarGenreFallbackMaxRead) {
+		params.Set("limit", strconv.Itoa(window))
+		result, err := h.content.BrowseItems(r.Context(), session, params)
+		if err != nil {
+			writeJSON(w, http.StatusOK, empty)
+			return
+		}
 
-	browseIDs := make([]string, len(result.Items))
-	for i, li := range result.Items {
-		browseIDs[i] = li.ContentID
-	}
-	favorites, progress, _ := resolveUserStateForContentIDs(r.Context(), session, h.userData, browseIDs)
+		browseIDs := make([]string, len(result.Items))
+		for i, li := range result.Items {
+			browseIDs[i] = li.ContentID
+		}
+		// The list suggests titles, so the profile's Not interested marks
+		// stay out, as they do from the recommender's list. A list whose
+		// marks cannot be read is answered empty rather than showing them.
+		var marked map[string]bool
+		if lister, ok := h.userData.(notInterestedLister); ok {
+			if marked, err = lister.ListNotInterestedByMediaItems(r.Context(), session, browseIDs); err != nil {
+				slog.WarnContext(r.Context(), "jellycompat: similar fallback could not read Not interested marks", "component", "jellycompat",
+					"user_id", session.StreamAppUserID, "profile_id", session.ProfileID, "content_id", contentID, "error", err)
+				writeJSON(w, http.StatusOK, empty)
+				return
+			}
+		}
+		favorites, progress, _ := resolveUserStateForContentIDs(r.Context(), session, h.userData, browseIDs)
 
-	items := make([]baseItemDTO, 0, limit)
-	listItems := make([]upstreamListItem, 0, limit)
-	for _, li := range result.Items {
-		if li.ContentID == contentID {
-			continue
+		items = make([]baseItemDTO, 0, limit)
+		listItems = make([]upstreamListItem, 0, limit)
+		for _, li := range result.Items {
+			if li.ContentID == contentID || marked[li.ContentID] {
+				continue
+			}
+			dto := h.mapper.itemFromList(li, favorites[li.ContentID], progress[li.ContentID], nil)
+			dto.MediaType = ""
+			dto.LocationType = ""
+			dto.VideoType = ""
+			items = append(items, dto)
+			listItems = append(listItems, li)
+			if len(items) >= limit {
+				break
+			}
 		}
-		dto := h.mapper.itemFromList(li, favorites[li.ContentID], progress[li.ContentID], nil)
-		dto.MediaType = ""
-		dto.LocationType = ""
-		dto.VideoType = ""
-		items = append(items, dto)
-		listItems = append(listItems, li)
-		if len(items) >= limit {
+		if len(items) >= limit || len(result.Items) < window || window >= similarGenreFallbackMaxRead {
 			break
 		}
 	}
@@ -1654,7 +1719,15 @@ func (h *ItemsHandler) HandleGenres(w http.ResponseWriter, r *http.Request) {
 		})
 	}
 	total := len(items)
+	// Jellyfin returns every genre when Limit is absent and none for Limit=0;
+	// parseItemsQuery's default page size is for item browsing.
+	if query.limitDefaulted {
+		query.limit = total
+	}
 	items = slicePage(items, query.startIndex, query.limit)
+	if query.countOnly {
+		items = []baseItemDTO{}
+	}
 	if !query.enableTotalRecordCount {
 		total = 0
 	}
@@ -2262,6 +2335,7 @@ func (h *ItemsHandler) HandleNextUp(w http.ResponseWriter, r *http.Request) {
 	q := catalog.NextUpQuery{
 		UserID:          session.StreamAppUserID,
 		ProfileID:       session.ProfileID,
+		AccessFilter:    h.resolveAccessFilter(r.Context(), session),
 		Limit:           query.limit + query.startIndex, // fetch enough to paginate
 		EnableResumable: parseBool(qp.Get("enableResumable"), false),
 	}
@@ -2283,6 +2357,8 @@ func (h *ItemsHandler) HandleNextUp(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
+	q.RankByRelease = h.nextUpNewReleasesFirst(r.Context(), session)
+
 	results, err := h.nextUpRepo.ListNextUp(r.Context(), q)
 	if err != nil {
 		writeCompatUpstreamError(w, err)
@@ -2292,6 +2368,20 @@ func (h *ItemsHandler) HandleNextUp(w http.ResponseWriter, r *http.Request) {
 	h.writeNextUpResponse(w, r, session, results, query)
 }
 
+// nextUpNewReleasesFirst reads the profile's ui.next_up_new_releases_first,
+// so Jellyfin clients see Next Up in the order Prairie's Home uses. Without a
+// store, or when the read fails, it is the default, off.
+func (h *ItemsHandler) nextUpNewReleasesFirst(ctx context.Context, session *Session) bool {
+	if h.storeProvider == nil || session.ProfileID == "" {
+		return false
+	}
+	store, err := h.storeProvider.ForUser(ctx, session.StreamAppUserID)
+	if err != nil {
+		return false
+	}
+	return access.ResolveViewerPreferences(ctx, store, session.ProfileID).NextUpNewReleasesFirst
+}
+
 // writeNextUpResponse renders a slice of catalog.NextUpResult into the
 // NextUp response shape. Upcoming has its own premiere-date query.
 func (h *ItemsHandler) writeNextUpResponse(w http.ResponseWriter, r *http.Request, session *Session, results []catalog.NextUpResult, query itemsQuery) {
@@ -2856,7 +2946,13 @@ func (h *ItemsHandler) handleSearchItems(w http.ResponseWriter, r *http.Request,
 }
 
 func (h *ItemsHandler) handleSpecificItems(w http.ResponseWriter, r *http.Request, session *Session, query itemsQuery) {
+	// Jellyfin returns every named item when Limit is absent, so neither path
+	// below applies parseItemsQuery's default page size, which is for item
+	// browsing. The catalog browse still caps a page at compatBrowseMaxLimit.
 	if len(query.specificCollectionIDs) == 0 && !idsRequestCollectionsView(r) && (query.hasIntersectingFilters() || query.hasItemTypeFilter || query.isFavorite || query.isPlayed != nil || query.isResumable || query.searchTerm != "" || query.sortExplicit) {
+		if query.limitDefaulted {
+			query.limit = len(query.specificIDs)
+		}
 		h.handleBrowseItems(w, r, session, query)
 		return
 	}
@@ -2934,6 +3030,9 @@ func (h *ItemsHandler) handleSpecificItems(w http.ResponseWriter, r *http.Reques
 	if !query.enableTotalRecordCount {
 		total = 0
 	}
+	if query.limitDefaulted {
+		query.limit = len(items)
+	}
 	items = slicePage(items, query.startIndex, query.limit)
 	h.applyListFileFields(r.Context(), session, items, query)
 	applyItemsResponseOptions(items, query)
@@ -3454,6 +3553,7 @@ func (h *ItemsHandler) rememberCompatEpisodeImages(dto baseItemDTO, stillURL str
 	if dto.SeriesID != "" {
 		h.images.RememberSized(dto.SeriesID, imageTypePrimary, series.PosterURL, compatCardImageSize)
 		h.images.RememberSized(dto.SeriesID, "Backdrop", series.BackdropURL, compatCardImageSize)
+		h.images.RememberSized(dto.SeriesID, "Logo", series.LogoURL, compatCardImageSize)
 	}
 }
 
@@ -3774,6 +3874,8 @@ func (h *ItemsHandler) enrichEpisodeSeriesImages(ctx context.Context, session *S
 				BackdropURL:       detail.BackdropURL,
 				BackdropPath:      detail.BackdropPath,
 				BackdropThumbhash: detail.BackdropThumbhash,
+				LogoURL:           detail.LogoURL,
+				LogoPath:          detail.LogoPath,
 				UpdatedAt:         detail.UpdatedAt,
 			}
 			h.rememberDetailImages(*detail)
@@ -3904,6 +4006,10 @@ func applyItemsResponseOptions(items []baseItemDTO, query itemsQuery) {
 			dto.ParentThumbImageTag = ""
 			dto.ParentThumbItemID = ""
 		}
+		if !allowed("logo") {
+			dto.ParentLogoImageTag = ""
+			dto.ParentLogoItemID = ""
+		}
 		if imagesOff {
 			dto.ImageBlurHashes = nil
 		}
diff --git a/internal/jellycompat/handlers_items_test.go b/internal/jellycompat/handlers_items_test.go
index 21e4859a1d..edaa823d4f 100644
--- a/internal/jellycompat/handlers_items_test.go
+++ b/internal/jellycompat/handlers_items_test.go
@@ -283,6 +283,30 @@ func TestHandleEpisodes_AdjacentToUnknownReturnsEmptyPage(t *testing.T) {
 	}
 }
 
+// An Ids value that names a season is not an unresolvable Ids filter: a
+// series ParentId still lists that series' seasons.
+func TestHandleItems_SeriesParentWithSeasonIDsListsSeasons(t *testing.T) {
+	codec := NewResourceIDCodec()
+	contentSvc := &countingContentService{
+		seasons: []upstreamSeason{
+			{ContentID: "season-1", SeasonNumber: 1, Title: "Season 1", EpisodeCount: 10},
+		},
+	}
+	h := &ItemsHandler{
+		content:  contentSvc,
+		userData: &mockUserDataService{},
+		codec:    codec,
+		mapper:   newMapper(codec, &config.Config{}),
+		images:   NewImageCache(time.Hour, time.Now),
+	}
+
+	result := performItemsRequest(t, h, "/Users/test/Items?ParentId="+codec.EncodeStringID(EncodedIDItem, "series-1")+
+		"&Ids="+codec.EncodeStringID(EncodedIDSeason, "season-1")+"&IncludeItemTypes=Season")
+	if contentSvc.listSeasonsCalls != 1 || len(result.Items) != 1 {
+		t.Fatalf("ListSeasons calls = %d, items = %+v; want the series' season", contentSvc.listSeasonsCalls, result.Items)
+	}
+}
+
 func TestHandleItems_SeriesParentSeasonFilterReturnsPagedSeasons(t *testing.T) {
 	t.Parallel()
 	codec := NewResourceIDCodec()
@@ -498,6 +522,8 @@ func TestHandleItem_Episode_FetchesSeriesDetailForStableParentImageTags(t *testi
 			Title:       "Test Series",
 			PosterURL:   "/img/series-1-poster.jpg",
 			BackdropURL: "/img/series-1-backdrop.jpg",
+			LogoURL:     "/img/series-1-logo.png",
+			LogoPath:    "metadb://logo/series-1",
 		},
 	}
 
@@ -544,6 +570,11 @@ func TestHandleItem_Episode_FetchesSeriesDetailForStableParentImageTags(t *testi
 		item.ParentThumbImageTag != item.ParentBackdropImageTags[0] {
 		t.Fatalf("episode response lost parent backdrop identity or tag: %+v", item)
 	}
+	seriesLogoTag := h.mapper.itemFromDetail(*contentSvc.seriesDetail, false, nil).ImageTags["Logo"]
+	if item.ParentLogoItemID != encodedSeriesID || item.ParentLogoImageTag == "" || item.ParentLogoImageTag != seriesLogoTag {
+		t.Fatalf("episode response lost the series logo: id=%q tag=%q, want %q and the series Logo tag %q",
+			item.ParentLogoItemID, item.ParentLogoImageTag, encodedSeriesID, seriesLogoTag)
+	}
 }
 
 // TestRememberDetailImages_SeedsMediumWithoutTouchingSmall asserts that detail
diff --git a/internal/jellycompat/handlers_playback.go b/internal/jellycompat/handlers_playback.go
index 776bbf0327..aa5fab107e 100644
--- a/internal/jellycompat/handlers_playback.go
+++ b/internal/jellycompat/handlers_playback.go
@@ -2,7 +2,6 @@ package jellycompat
 
 import (
 	"context"
-	crand "crypto/rand"
 	"crypto/sha1"
 	"encoding/hex"
 	"encoding/json"
@@ -10,7 +9,6 @@ import (
 	"fmt"
 	"io"
 	"log/slog"
-	"math/rand/v2"
 	"net/http"
 	"net/url"
 	"os"
@@ -22,7 +20,9 @@ import (
 	"sync"
 	"time"
 
+	"github.com/prairie-server/prairie-server/internal/bandwidthprobe"
 	"github.com/prairie-server/prairie-server/internal/clientip"
+	"github.com/prairie-server/prairie-server/internal/nodeauth"
 	"github.com/prairie-server/prairie-server/internal/telemetry"
 	"github.com/prairie-server/prairie-server/internal/transcodeproxy"
 
@@ -329,8 +329,7 @@ type PlaybackHandler struct {
 	ScopeResolver           ScopeResolver
 	NodePlanner             nodepool.SessionPlanner
 	JWTSecret               string
-	profileStaler           profileStaler
-	profileRefreshRequester profileRefreshRequester
+	signalsNotifier         signalsChangedNotifier
 	FFmpegPath              string
 	HWAccel                 string
 	TranscodeDir            string
@@ -1459,6 +1458,7 @@ func (h *PlaybackHandler) buildProxyRedirectURL(
 		claims.PlayMethod = streamtoken.PlayMethodCopyFMP4Transcode
 		claims.CopyFMP4RecipeVersion = playback.CopyFMP4RecipeVersion
 		claims.CopyVideoMPEGTS = source.HLSRemuxMPEGTS
+		claims.KeyframePlaylist = source.KeyframePlaylist
 	}
 	if compatSession != nil {
 		claims.UserID = compatSession.StreamAppUserID
@@ -1760,6 +1760,7 @@ func (h *PlaybackHandler) startRemoteTranscodeWithToneMapMode(
 		reqBody.TargetCodecVideo = compatCopyCodec
 		reqBody.VideoSampleEntry, reqBody.VideoBitstreamFilter = compatCopyVideoRecipe(source, file.PrimaryDVProfile())
 		reqBody.CopyVideoMPEGTS = source.HLSRemuxMPEGTS
+		reqBody.KeyframePlaylist = source.KeyframePlaylist
 		reqBody.CopyFMP4RecipeVersion = playback.CopyFMP4RecipeVersion
 	}
 	if !compatHLSTranscodesAudio(source) {
@@ -1781,7 +1782,9 @@ func (h *PlaybackHandler) startRemoteTranscodeWithToneMapMode(
 			return transcodenode.TranscodeStartResponse{}, 0, false, fmt.Errorf("build transcode request: %w", logredact.SanitizeURLError(err))
 		}
 		httpReq.Header.Set("Content-Type", "application/json")
-		httpReq.Header.Set("Authorization", "Bearer "+h.JWTSecret)
+		if err := nodeauth.Sign(httpReq, transcodeNodeURL, h.JWTSecret); err != nil {
+			return transcodenode.TranscodeStartResponse{}, 0, false, fmt.Errorf("sign transcode request: %w", err)
+		}
 		resp, err := telemetry.DoTrustedNode(transcodeproxy.NodeClient(), httpReq, "transcode_start")
 		if err != nil {
 			nodepool.ReportConnectFailure(h.NodePlanner, transcodeNodeURL, err)
@@ -1908,6 +1911,10 @@ func (h *PlaybackHandler) startRemoteTranscodeWithToneMapMode(
 		h.tm.StopRemoteTranscode(upstreamSessionID, transcodeNodeURL)
 		return fmt.Errorf("%w: %w", errRemoteTranscodeStartFailed, err)
 	}
+	if err := transcodenode.ValidateKeyframePlaylistAttestation(reqBody, nodeResponse); err != nil {
+		h.tm.StopRemoteTranscode(upstreamSessionID, transcodeNodeURL)
+		return fmt.Errorf("%w: %w", errRemoteTranscodeStartFailed, err)
+	}
 	if reqBody.ToneMapMode != "" && nodeResponse.ToneMapMode != reqBody.ToneMapMode {
 		h.tm.StopRemoteTranscode(upstreamSessionID, transcodeNodeURL)
 		err := errors.New("remote transcode node did not confirm tone-map mode")
@@ -1973,6 +1980,7 @@ func (h *PlaybackHandler) startRemoteTranscodeWithToneMapMode(
 		VideoSampleEntry:       reqBody.VideoSampleEntry,
 		VideoBitstreamFilter:   reqBody.VideoBitstreamFilter,
 		CopyVideoMPEGTS:        reqBody.CopyVideoMPEGTS,
+		KeyframePlaylist:       reqBody.KeyframePlaylist,
 		SegmentDuration:        reqBody.SegmentDuration,
 		AudioTrackIndex:        reqBody.AudioTrackIndex,
 		SourceAudioChannels:    reqBody.SourceAudioChannels,
@@ -2167,7 +2175,7 @@ func (h *PlaybackHandler) HandleBitrateTest(w http.ResponseWriter, r *http.Reque
 	size := 102400
 	if raw := firstQueryValue(r.URL.Query(), "Size"); raw != "" {
 		value, err := strconv.Atoi(raw)
-		if err != nil || value < 1 || value > 100000000 {
+		if err != nil || value < 1 || value > bandwidthprobe.MaxSize {
 			writeError(w, http.StatusBadRequest, "BadRequest", "Size must be between 1 and 100000000")
 			return
 		}
@@ -2175,21 +2183,7 @@ func (h *PlaybackHandler) HandleBitrateTest(w http.ResponseWriter, r *http.Reque
 	}
 	w.Header().Set("Content-Length", strconv.Itoa(size))
 	w.WriteHeader(http.StatusOK)
-	// Random bytes, as Jellyfin sends: a compressing proxy would shrink a
-	// constant payload and inflate the measured bandwidth.
-	var seed [32]byte
-	_, _ = crand.Read(seed[:])
-	source := rand.NewChaCha8(seed)
-	block := make([]byte, min(size, 32768))
-	for size > 0 {
-		chunk := block[:min(size, len(block))]
-		_, _ = source.Read(chunk)
-		n, err := w.Write(chunk)
-		if err != nil || n == 0 {
-			return
-		}
-		size -= n
-	}
+	_ = bandwidthprobe.Write(w, size)
 }
 
 // HandlePlaybackInfo negotiates media sources for a Jellyfin item.
@@ -2365,6 +2359,9 @@ func (h *PlaybackHandler) HandlePlaybackInfo(w http.ResponseWriter, r *http.Requ
 		source.HLSRemuxMPEGTS = compatWebOSDVMPEGTS(r.UserAgent(), source)
 		applyCompatSubtitleDelivery(&source, profile, req.AlwaysBurnInSubtitleWhenTranscoding)
 		applyCompatDownloadedSubtitleDelivery(&source, profile, downloaded)
+		// Only a copy stream is served from a keyframe playlist; subtitle
+		// delivery above can turn a copy into a transcode.
+		source.KeyframePlaylist = compatHLSCopiesVideo(source) && h.PlaybackConfig != nil && h.PlaybackConfig().KeyframePlaylist
 		if source.SupportsTranscoding && !compatHLSCopiesVideo(source) && compatVersionRequiresToneMap(version) {
 			if !toneMapPolicyLoaded {
 				var policyErr error
@@ -2477,10 +2474,18 @@ func (h *PlaybackHandler) HandlePlaybackInfo(w http.ResponseWriter, r *http.Requ
 		newCaseInsensitiveQuery(r.URL.Query()).Get("DeviceId"),
 	)
 	clientDeviceID = stripCompatNUL(clientDeviceID)
+	// Cleaned and clamped like every other client identity, since the stream
+	// request that starts the native session may reuse these values.
+	negotiatedClient := playback.ClientInfo{
+		Name:    firstMediaBrowserAuthorizationValue(r, "Client"),
+		Version: firstMediaBrowserAuthorizationValue(r, "Version"),
+	}.Normalized()
 	h.playbackStore.PutNegotiated(PlaybackSession{
 		ID:                 playSessionID,
 		CompatToken:        session.Token,
 		ClientDeviceID:     clientDeviceID,
+		ClientName:         negotiatedClient.Name,
+		ClientVersion:      negotiatedClient.Version,
 		ClientIP:           clientip.FromContext(r.Context()),
 		ClientPeer:         requestPeerHost(r),
 		ItemID:             detail.ContentID,
@@ -3040,7 +3045,7 @@ var compatFallbackCodecRank = map[string]int{
 func preferredAudioStreamIndex(version catalog.FileVersion, profile DeviceProfile) *int {
 	defaultIdx := defaultAudioStreamIndex(version)
 	if defaultIdx == nil {
-		return defaultIdx
+		return nil
 	}
 
 	defaultTrackIdx := *defaultIdx - len(version.VideoTracks)
diff --git a/internal/jellycompat/handlers_recommendations.go b/internal/jellycompat/handlers_recommendations.go
index 9aa7b45a3e..7c0a17c6a6 100644
--- a/internal/jellycompat/handlers_recommendations.go
+++ b/internal/jellycompat/handlers_recommendations.go
@@ -1,13 +1,18 @@
 package jellycompat
 
 import (
+	"context"
+	"log/slog"
 	"net/http"
+	"slices"
 	"strconv"
+	"strings"
 
 	"github.com/google/uuid"
 
 	"github.com/prairie-server/prairie-server/internal/catalog"
 	"github.com/prairie-server/prairie-server/internal/config"
+	"github.com/prairie-server/prairie-server/internal/models"
 	"github.com/prairie-server/prairie-server/internal/recommendations"
 )
 
@@ -19,13 +24,57 @@ type recommendationDTO struct {
 	CategoryID         string        `json:"CategoryId"`
 }
 
+// RecommendationRowReader reads the recommendation rows cached for a profile,
+// filtered for the viewer. *recommendations.Reader implements it.
+type RecommendationRowReader interface {
+	// GetForYouPage returns the recommendations-page rows, main row first.
+	GetForYouPage(ctx context.Context, userID int, profileID string, limit int, filter catalog.AccessFilter) ([]recommendations.ForYouRow, error)
+	// GetBecauseYouWatchedRows returns Because You Watched rows, one per
+	// anchor, the most recent first.
+	GetBecauseYouWatchedRows(ctx context.Context, userID int, profileID string, maxRows, limit int, filter catalog.AccessFilter) ([]recommendations.ForYouRow, error)
+}
+
+// Jellyfin's recommendation types. Clients word a category's heading from its
+// type and BaselineItemName: jellyfin-web shows "Because you watched {0}" and
+// "Because you like {0}".
+const (
+	recommendationSimilarToRecentlyPlayed = "SimilarToRecentlyPlayed"
+	recommendationSimilarToLikedItem      = "SimilarToLikedItem"
+)
+
+// compatBecauseWatchedRows is how many Because You Watched categories a
+// response carries at most.
+const compatBecauseWatchedRows = 2
+
+// compatMaxCategories caps categoryLimit: the categories a response can hold
+// are a profile's Because You Watched rows and taste clusters.
+const compatMaxCategories = 20
+
+// compatRecommendationExcludedTypes are the recommendable media types
+// /Movies/Recommendations leaves out. Jellyfin answers it with movies only,
+// each category built from a movie the user played or liked, and clients
+// show it on a movie library's Suggestions tab.
+var compatRecommendationExcludedTypes = []string{compatSeriesType}
+
+// recommendationItemLoader loads catalog items with the viewer's access
+// applied. *catalog.ItemRepository implements it.
+type recommendationItemLoader interface {
+	GetByIDsWithAccess(ctx context.Context, contentIDs []string, access catalog.AccessFilter) ([]*models.MediaItem, error)
+}
+
 // RecommendationsHandler serves the Jellyfin Movies/Recommendations endpoint
-// using the Prairie recommendation engine.
+// from the same cached rows the native API reads, keeping only their movies
+// and, for a library ParentId, only that library's. Only rows a Jellyfin
+// heading describes truthfully are sent: Because You Watched rows anchored on
+// a movie as SimilarToRecentlyPlayed with the anchor's title, then
+// taste-cluster rows as SimilarToLikedItem with the cluster's genre label.
+// The main For You row, Similar Users and the server-wide rows have no item
+// or genre behind them and are left out.
 type RecommendationsHandler struct {
-	recommender  recommendations.Recommender
-	itemRepo     *catalog.ItemRepository
+	reader       RecommendationRowReader
+	items        recommendationItemLoader
+	durations    probedDurationSource
 	detailSvc    *catalog.DetailService
-	content      ContentService
 	userData     UserDataService
 	codec        *ResourceIDCodec
 	mapper       *mapper
@@ -34,25 +83,29 @@ type RecommendationsHandler struct {
 
 // NewRecommendationsHandler creates a new compat recommendations handler.
 func NewRecommendationsHandler(
-	recommender recommendations.Recommender,
+	reader RecommendationRowReader,
 	itemRepo *catalog.ItemRepository,
 	detailSvc *catalog.DetailService,
-	content ContentService,
 	userData UserDataService,
 	codec *ResourceIDCodec,
 	cfg *config.Config,
 	accessFilter AccessFilterResolver,
 ) *RecommendationsHandler {
-	return &RecommendationsHandler{
-		recommender:  recommender,
-		itemRepo:     itemRepo,
-		detailSvc:    detailSvc,
-		content:      content,
+	h := &RecommendationsHandler{
+		reader:       reader,
 		userData:     userData,
 		codec:        codec,
 		mapper:       newMapper(codec, cfg),
 		accessFilter: accessFilter,
 	}
+	if itemRepo != nil {
+		h.items = itemRepo
+	}
+	if detailSvc != nil {
+		h.durations = detailSvc
+		h.detailSvc = detailSvc
+	}
+	return h
 }
 
 // HandleRecommendations serves GET /Movies/Recommendations.
@@ -62,41 +115,79 @@ func (h *RecommendationsHandler) HandleRecommendations(w http.ResponseWriter, r
 		writeError(w, http.StatusUnauthorized, "Unauthorized", "Missing authentication token")
 		return
 	}
+	// The Because You Watched rows and the page rows each leave out what the
+	// profile watched; read that once.
+	r = r.WithContext(recommendations.WithWatchedSetMemo(r.Context()))
 
-	if h.recommender == nil || h.itemRepo == nil {
+	if h.reader == nil || h.items == nil {
 		writeJSON(w, http.StatusOK, []recommendationDTO{})
 		return
 	}
 
 	q := newCaseInsensitiveQuery(r.URL.Query())
 
+	// Both limits size allocations, so they are capped: a category cannot
+	// hold more titles than a row read returns, and a profile has few rows a
+	// category can describe.
 	categoryLimit := 5
 	if v := q.Get("categoryLimit"); v != "" {
 		if n, err := strconv.Atoi(v); err == nil && n > 0 {
-			categoryLimit = n
+			categoryLimit = min(n, compatMaxCategories)
 		}
 	}
 
 	itemLimit := 8
 	if v := q.Get("itemLimit"); v != "" {
 		if n, err := strconv.Atoi(v); err == nil && n > 0 {
-			itemLimit = n
+			itemLimit = min(n, recommendations.MaxRowReadLimit)
 		}
 	}
 
-	resp, err := h.recommender.ForYou(r.Context(), session.StreamAppUserID, session.ProfileID, itemLimit)
+	// The rows are read already filtered for the viewer and kept to movies,
+	// so a restricted profile still gets full rows of movies it can see, and
+	// a Because You Watched row anchored on a series finds no anchor and is
+	// left out. They are read with headroom for the titles an earlier
+	// category already shows.
+	filter := catalog.AccessFilter{UserID: session.StreamAppUserID, ProfileID: session.ProfileID}
+	if h.accessFilter != nil {
+		filter = h.accessFilter(r.Context(), session.StreamAppUserID, session.ProfileID)
+	}
+	filter.ExcludedMediaTypes = append(slices.Clone(filter.ExcludedMediaTypes), compatRecommendationExcludedTypes...)
+	// Clients pass the library they show suggestions for as ParentId. A
+	// parent that is not a library the viewer can browse has nothing to
+	// recommend.
+	if raw := strings.TrimSpace(q.Get("ParentId")); raw != "" {
+		libraryID, err := h.codec.DecodeIntID(EncodedIDLibrary, raw)
+		if err != nil || libraryID <= 0 || !narrowAccessToLibrary(&filter, int(libraryID)) {
+			writeJSON(w, http.StatusOK, []recommendationDTO{})
+			return
+		}
+	}
+	// Every anchor's row is read: one the response cannot show (a series, or a
+	// title outside ParentId) gives way to the next. Each row is read deep
+	// enough to fill its category after the categories before it took their
+	// titles, up to the most a row read returns.
+	// (The package's own max takes a fallback, so it is not used here.)
+	rowDepth := categoryLimit * itemLimit
+	if rowDepth < 2*itemLimit {
+		rowDepth = 2 * itemLimit
+	}
+	rowDepth = min(rowDepth, recommendations.MaxRowReadLimit)
+	rows, err := h.categoryRows(r.Context(), session, recommendations.BecauseYouWatchedAnchors, rowDepth, filter)
 	if err != nil {
-		writeJSON(w, http.StatusOK, []recommendationDTO{})
+		slog.WarnContext(r.Context(), "jellycompat: recommendation rows failed", "component", "jellycompat",
+			"user_id", session.StreamAppUserID, "profile_id", session.ProfileID, "error", err)
+		writeError(w, http.StatusInternalServerError, "ServerError", "Failed to load recommendations")
 		return
 	}
-	if resp == nil || len(resp.Rows) == 0 {
+	if len(rows) == 0 {
 		writeJSON(w, http.StatusOK, []recommendationDTO{})
 		return
 	}
 
 	// Collect all unique item IDs for batch fetch.
 	idSet := make(map[string]struct{})
-	for _, row := range resp.Rows {
+	for _, row := range rows {
 		for _, item := range row.Items {
 			idSet[item.MediaItemID] = struct{}{}
 		}
@@ -105,16 +196,23 @@ func (h *RecommendationsHandler) HandleRecommendations(w http.ResponseWriter, r
 	for id := range idSet {
 		contentIDs = append(contentIDs, id)
 	}
+	// The anchors are fetched with the items, under the same access.
+	fetchIDs := slices.Clone(contentIDs)
+	for _, row := range rows {
+		if row.AnchorItemID != "" {
+			fetchIDs = append(fetchIDs, row.AnchorItemID)
+		}
+	}
 
 	// Batch fetch media items, applying viewer access in the same query so we
-	// avoid a per-item EnsureAccessible fan-out (audit 2026-05-01 §3.3).
-	filter := catalog.AccessFilter{}
-	if h.accessFilter != nil {
-		filter = h.accessFilter(r.Context(), session.StreamAppUserID, session.ProfileID)
-	}
-	mediaItems, err := h.itemRepo.GetByIDsWithAccess(r.Context(), contentIDs, filter)
+	// avoid a per-item EnsureAccessible fan-out (audit 2026-05-01 §3.3). The
+	// rows were filtered already; this also applies the compat media-type
+	// exclusions.
+	mediaItems, err := h.items.GetByIDsWithAccess(r.Context(), fetchIDs, filter)
 	if err != nil {
-		writeJSON(w, http.StatusOK, []recommendationDTO{})
+		slog.WarnContext(r.Context(), "jellycompat: recommendation items failed", "component", "jellycompat",
+			"user_id", session.StreamAppUserID, "profile_id", session.ProfileID, "error", err)
+		writeError(w, http.StatusInternalServerError, "ServerError", "Failed to load recommendations")
 		return
 	}
 	itemsByID := make(map[string]upstreamListItem, len(mediaItems))
@@ -125,70 +223,127 @@ func (h *RecommendationsHandler) HandleRecommendations(w http.ResponseWriter, r
 	for _, item := range itemsByID {
 		listItems = append(listItems, item)
 	}
-	fillListItemDurations(r.Context(), h.detailSvc, listItems)
-	attachListExtraBackdrops(r.Context(), h.detailSvc, listItems)
+	fillListItemDurations(r.Context(), h.durations, listItems)
+	if h.detailSvc != nil {
+		attachListExtraBackdrops(r.Context(), h.detailSvc, listItems)
+	}
 	for _, item := range listItems {
 		itemsByID[item.ContentID] = item
 	}
 
 	favorites, progress, err := resolveUserStateForContentIDs(r.Context(), session, h.userData, contentIDs)
 	if err != nil {
+		slog.WarnContext(r.Context(), "jellycompat: recommendation user state failed; serving without it", "component", "jellycompat",
+			"user_id", session.StreamAppUserID, "profile_id", session.ProfileID, "error", err)
 		favorites = map[string]bool{}
 		progress = map[string]*upstreamProgress{}
 	}
 
-	// Build Jellyfin recommendation categories.
+	// Build Jellyfin recommendation categories. A title appears in the first
+	// category that has it.
 	result := make([]recommendationDTO, 0, categoryLimit)
-	for _, row := range resp.Rows {
+	shown := make(map[string]struct{})
+	watchedCategories := 0
+	for _, row := range rows {
 		if len(result) >= categoryLimit {
 			break
 		}
+		if row.AnchorItemID != "" && watchedCategories >= compatBecauseWatchedRows {
+			continue
+		}
+		category, ok := recommendationCategory(row, itemsByID)
+		if !ok {
+			continue
+		}
 
-		items := make([]baseItemDTO, 0, len(row.Items))
+		items := make([]baseItemDTO, 0, itemLimit)
 		for _, scored := range row.Items {
 			listItem, ok := itemsByID[scored.MediaItemID]
 			if !ok {
 				continue
 			}
+			if _, dup := shown[scored.MediaItemID]; dup {
+				continue
+			}
+			shown[scored.MediaItemID] = struct{}{}
 			items = append(items, h.mapper.itemFromList(listItem, favorites[scored.MediaItemID], progress[scored.MediaItemID], nil))
+			if len(items) >= itemLimit {
+				break
+			}
 		}
 		if len(items) == 0 {
 			continue
 		}
-
-		result = append(result, recommendationDTO{
-			Items:              items,
-			RecommendationType: mapRecommendationType(row.Type),
-			BaselineItemName:   row.Label,
-			CategoryID:         deterministicCategoryID(row.Type, row.ClusterIndex),
-		})
+		if row.AnchorItemID != "" {
+			watchedCategories++
+		}
+		category.Items = items
+		result = append(result, category)
 	}
 
 	writeJSON(w, http.StatusOK, result)
 }
 
-// mapRecommendationType converts our row types to Jellyfin RecommendationType values.
-func mapRecommendationType(rowType string) string {
-	switch rowType {
-	case "because_watched":
-		return "SimilarToRecentlyPlayed"
-	case "similar_users":
-		return "SimilarToLikedItem"
-	case "popular", "recently_added":
-		return "SimilarToRecentlyPlayed"
-	case "top_rated":
-		return "SimilarToLikedItem"
-	default:
-		// for_you clusters and genre samplers
-		return "SimilarToRecentlyPlayed"
+// clusterRowType is the type of a taste-cluster row on the recommendations
+// page.
+const clusterRowType = "cluster"
+
+// categoryRows returns the rows a Jellyfin category can describe truthfully,
+// in Jellyfin's order: Because You Watched rows first, each naming its
+// anchor, then the taste-cluster rows that carry a genre subject. It reads a
+// Because You Watched row for every anchor, up to maxRows, since an anchor
+// the response cannot show (a series, or a title outside ParentId) gives
+// way to the next.
+func (h *RecommendationsHandler) categoryRows(ctx context.Context, session *Session, maxRows, limit int, filter catalog.AccessFilter) ([]recommendations.ForYouRow, error) {
+	watched, err := h.reader.GetBecauseYouWatchedRows(ctx, session.StreamAppUserID, session.ProfileID, maxRows, limit, filter)
+	if err != nil {
+		return nil, err
+	}
+	page, err := h.reader.GetForYouPage(ctx, session.StreamAppUserID, session.ProfileID, limit, filter)
+	if err != nil {
+		return nil, err
+	}
+	rows := make([]recommendations.ForYouRow, 0, len(watched)+len(page))
+	for _, row := range watched {
+		if row.AnchorItemID != "" {
+			rows = append(rows, row)
+		}
 	}
+	for _, row := range page {
+		if row.Type == clusterRowType && row.Subject != "" {
+			rows = append(rows, row)
+		}
+	}
+	return rows, nil
 }
 
-// deterministicCategoryID generates a stable UUID for a recommendation category.
-func deterministicCategoryID(rowType string, clusterIdx int) string {
-	name := rowType
-	if clusterIdx > 0 {
-		name += ":" + strconv.Itoa(clusterIdx)
+// recommendationCategory is the heading of the category row becomes: a
+// Because You Watched row is SimilarToRecentlyPlayed with its anchor's title,
+// a taste-cluster row SimilarToLikedItem with its genre label. It reports
+// false for an anchor that was not loaded, one the viewer cannot see or the
+// response does not show, so the row is left out rather than shown under a
+// title the viewer may not know of or that is not a movie.
+func recommendationCategory(row recommendations.ForYouRow, itemsByID map[string]upstreamListItem) (recommendationDTO, bool) {
+	if row.AnchorItemID == "" {
+		return recommendationDTO{
+			RecommendationType: recommendationSimilarToLikedItem,
+			BaselineItemName:   row.Subject,
+			CategoryID:         deterministicCategoryID("cluster:" + strconv.Itoa(row.ClusterIndex)),
+		}, true
+	}
+	anchor, visible := itemsByID[row.AnchorItemID]
+	if !visible || anchor.Title == "" {
+		return recommendationDTO{}, false
 	}
+	return recommendationDTO{
+		RecommendationType: recommendationSimilarToRecentlyPlayed,
+		BaselineItemName:   anchor.Title,
+		CategoryID:         deterministicCategoryID("because_watched:" + row.AnchorItemID),
+	}, true
+}
+
+// deterministicCategoryID generates a stable UUID for the recommendation
+// category the name identifies.
+func deterministicCategoryID(name string) string {
 	return uuid.NewSHA1(uuid.NameSpaceOID, []byte(name)).String()
 }
diff --git a/internal/jellycompat/handlers_recommendations_test.go b/internal/jellycompat/handlers_recommendations_test.go
new file mode 100644
index 0000000000..3b0737e6b6
--- /dev/null
+++ b/internal/jellycompat/handlers_recommendations_test.go
@@ -0,0 +1,560 @@
+package jellycompat
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"slices"
+	"strconv"
+	"strings"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/recommendations"
+)
+
+// fakeRowReader answers fixed rows and records the reads.
+type fakeRowReader struct {
+	rows       []recommendations.ForYouRow
+	watched    []recommendations.ForYouRow
+	err        error
+	watchedErr error
+	gotLimit   int
+	gotFilter  catalog.AccessFilter
+	gotProfile string
+	gotWatched struct {
+		maxRows, limit int
+		filter         catalog.AccessFilter
+	}
+}
+
+func (f *fakeRowReader) GetForYouPage(_ context.Context, _ int, profileID string, limit int, filter catalog.AccessFilter) ([]recommendations.ForYouRow, error) {
+	f.gotLimit, f.gotFilter, f.gotProfile = limit, filter, profileID
+	return f.rows, f.err
+}
+
+func (f *fakeRowReader) GetBecauseYouWatchedRows(_ context.Context, _ int, _ string, maxRows, limit int, filter catalog.AccessFilter) ([]recommendations.ForYouRow, error) {
+	f.gotWatched.maxRows, f.gotWatched.limit, f.gotWatched.filter = maxRows, limit, filter
+	return f.watched, f.watchedErr
+}
+
+// fakeItemLoader loads every requested item except the hidden ones and
+// those of a type the filter excludes. An item missing from types is a movie.
+type fakeItemLoader struct {
+	gotFilter catalog.AccessFilter
+	gotIDs    []string
+	hidden    map[string]bool
+	types     map[string]string
+}
+
+func (f *fakeItemLoader) GetByIDsWithAccess(_ context.Context, ids []string, filter catalog.AccessFilter) ([]*models.MediaItem, error) {
+	f.gotFilter, f.gotIDs = filter, ids
+	items := make([]*models.MediaItem, 0, len(ids))
+	for _, id := range ids {
+		mediaType := f.types[id]
+		if mediaType == "" {
+			mediaType = "movie"
+		}
+		if !f.hidden[id] && !slices.Contains(filter.ExcludedMediaTypes, mediaType) {
+			items = append(items, &models.MediaItem{ContentID: id, Type: mediaType, Title: "Title " + id})
+		}
+	}
+	return items, nil
+}
+
+func recommendationsRequest(t *testing.T, query string) *http.Request {
+	t.Helper()
+	req := httptest.NewRequest(http.MethodGet, "/Movies/Recommendations"+query, nil)
+	session := &Session{StreamAppUserID: 7, ProfileID: "kid", PseudoUserID: uuid.New()}
+	return req.WithContext(context.WithValue(req.Context(), compatSessionKey, session))
+}
+
+func newTestRecommendationsHandler(reader RecommendationRowReader, items recommendationItemLoader, filter catalog.AccessFilter) *RecommendationsHandler {
+	h := NewRecommendationsHandler(reader, nil, nil, nil, NewResourceIDCodec(), nil,
+		func(context.Context, int, string) catalog.AccessFilter { return filter })
+	h.items = items
+	return h
+}
+
+func scoredRow(rowType, label string, ids ...string) recommendations.ForYouRow {
+	row := recommendations.ForYouRow{Type: rowType, Label: label}
+	for _, id := range ids {
+		row.Items = append(row.Items, recommendations.ScoredItem{MediaItemID: id})
+	}
+	return row
+}
+
+// clusterRow is a taste-cluster row about subject, as the Reader returns it.
+func clusterRow(index int, subject string, ids ...string) recommendations.ForYouRow {
+	row := scoredRow("cluster", "Because you enjoy "+subject, ids...)
+	row.ClusterIndex, row.Subject = index, subject
+	return row
+}
+
+// watchedRow is a Because You Watched row built from anchor.
+func watchedRow(anchor string, ids ...string) recommendations.ForYouRow {
+	row := scoredRow(recommendations.RecTypeBecauseWatched, "Because You Watched", ids...)
+	row.AnchorItemID = anchor
+	return row
+}
+
+func decodeCategories(t *testing.T, rec *httptest.ResponseRecorder) []recommendationDTO {
+	t.Helper()
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status = %d: %s", rec.Code, rec.Body.String())
+	}
+	var categories []recommendationDTO
+	if err := json.Unmarshal(rec.Body.Bytes(), &categories); err != nil {
+		t.Fatal(err)
+	}
+	return categories
+}
+
+// The categories come from the cached rows read with the session's access
+// filter, itemLimit titles each, so a restricted profile gets full rows of
+// what it can see.
+func TestCompatRecommendationsReadTheCachedRowsForTheViewer(t *testing.T) {
+	restricted := catalog.AccessFilter{UserID: 7, ProfileID: "kid", AllowedLibraryIDs: []int{4}}
+	reader := &fakeRowReader{
+		rows:    []recommendations.ForYouRow{clusterRow(0, "Animation", "kids-1", "kids-2")},
+		watched: []recommendations.ForYouRow{watchedRow("kids-anchor", "kids-3")},
+	}
+	items := &fakeItemLoader{}
+	h := newTestRecommendationsHandler(reader, items, restricted)
+
+	rec := httptest.NewRecorder()
+	h.HandleRecommendations(rec, recommendationsRequest(t, "?itemLimit=6&categoryLimit=5"))
+	categories := decodeCategories(t, rec)
+	if reader.gotLimit != 30 || reader.gotProfile != "kid" || !slices.Equal(reader.gotFilter.AllowedLibraryIDs, []int{4}) {
+		t.Fatalf("read limit=%d profile=%q filter=%+v, want categoryLimit × itemLimit, kid and the session filter", reader.gotLimit, reader.gotProfile, reader.gotFilter)
+	}
+	if reader.gotWatched.maxRows != recommendations.BecauseYouWatchedAnchors || reader.gotWatched.limit != 30 || !slices.Equal(reader.gotWatched.filter.AllowedLibraryIDs, []int{4}) {
+		t.Fatalf("because-watched read = %+v, want every anchor's row of categoryLimit × itemLimit under the session filter", reader.gotWatched)
+	}
+	if !slices.Equal(items.gotFilter.AllowedLibraryIDs, []int{4}) || !slices.Contains(items.gotIDs, "kids-anchor") {
+		t.Fatalf("hydration ids=%v filter=%+v, want the anchor fetched under the session filter", items.gotIDs, items.gotFilter)
+	}
+	if len(categories) != 2 || len(categories[0].Items) != 1 || len(categories[1].Items) != 2 {
+		t.Fatalf("categories = %s", rec.Body.String())
+	}
+	if categories[1].Items[0].Name != "Title kids-1" {
+		t.Fatalf("first cluster item = %+v, want kids-1 first", categories[1].Items[0])
+	}
+
+	// Each category holds at most itemLimit titles.
+	reader.rows = []recommendations.ForYouRow{clusterRow(0, "Animation", "a", "b", "c", "d")}
+	reader.watched = nil
+	rec = httptest.NewRecorder()
+	h.HandleRecommendations(rec, recommendationsRequest(t, "?itemLimit=3"))
+	if categories := decodeCategories(t, rec); len(categories) != 1 || len(categories[0].Items) != 3 {
+		t.Fatalf("categories = %s, want one of 3 items", rec.Body.String())
+	}
+}
+
+// Jellyfin clients head a category "Because you watched {BaselineItemName}"
+// or "Because you like {BaselineItemName}" by its type. Only rows those words
+// describe are sent: Because You Watched rows under their anchor's title,
+// first, then taste-cluster rows under their genre label. The main For You
+// row, an unlabeled cluster, Similar Users and the server-wide rows are left
+// out, as is a row whose anchor the viewer cannot see. A title shows once,
+// in the first category that has it, and each category has its own ID.
+func TestCompatRecommendationsSendOnlyTruthfulHeadings(t *testing.T) {
+	reader := &fakeRowReader{
+		rows: []recommendations.ForYouRow{
+			scoredRow("cluster", "For You", "main-1", "main-2"),
+			clusterRow(0, "Science Fiction & Thriller", "scifi-1", "shared"),
+			{Type: "cluster", Label: "Because you enjoy For You", ClusterIndex: 1, Items: []recommendations.ScoredItem{{MediaItemID: "unlabeled-1"}}},
+			clusterRow(2, "Comedy", "comedy-1"),
+			scoredRow("similar_users_liked", "Profiles Like You Enjoyed", "fans-1"),
+			scoredRow("popular", "Popular on This Server", "popular-1"),
+			scoredRow("recently_added", "Recently Added", "recent-1"),
+			scoredRow("top_rated", "Top Rated", "top-1"),
+			scoredRow("genre_sampler", "Top Drama", "drama-1"),
+		},
+		watched: []recommendations.ForYouRow{
+			watchedRow("anchor-visible", "watched-1", "shared"),
+			watchedRow("anchor-hidden", "hidden-anchor-1"),
+		},
+	}
+	items := &fakeItemLoader{hidden: map[string]bool{"anchor-hidden": true}}
+	rec := httptest.NewRecorder()
+	newTestRecommendationsHandler(reader, items, catalog.AccessFilter{}).HandleRecommendations(rec, recommendationsRequest(t, "?categoryLimit=10&itemLimit=20"))
+	categories := decodeCategories(t, rec)
+
+	type heading struct{ kind, baseline string }
+	var got []heading
+	ids := map[string]bool{}
+	var titles []string
+	for _, c := range categories {
+		got = append(got, heading{c.RecommendationType, c.BaselineItemName})
+		ids[c.CategoryID] = true
+		for _, item := range c.Items {
+			titles = append(titles, item.Name)
+		}
+	}
+	want := []heading{
+		{"SimilarToRecentlyPlayed", "Title anchor-visible"},
+		{"SimilarToLikedItem", "Science Fiction & Thriller"},
+		{"SimilarToLikedItem", "Comedy"},
+	}
+	if !slices.Equal(got, want) {
+		t.Fatalf("headings = %v, want %v", got, want)
+	}
+	if len(ids) != len(categories) {
+		t.Fatalf("category IDs repeat: %s", rec.Body.String())
+	}
+	wantTitles := []string{"Title watched-1", "Title shared", "Title scifi-1", "Title comedy-1"}
+	if !slices.Equal(titles, wantTitles) {
+		t.Fatalf("titles = %v, want %v", titles, wantTitles)
+	}
+}
+
+// Jellyfin answers /Movies/Recommendations with movies only, and clients ask
+// for it on a movie library's Suggestions tab with the library as ParentId.
+// The rows are read and hydrated with series excluded, so a category holds
+// only movies and a Because You Watched row anchored on a series gives way to
+// the next anchor, two such categories at most. A library ParentId narrows
+// every read to that library; any other parent, or a library the viewer
+// cannot browse, has nothing to recommend.
+func TestCompatRecommendationsServeMoviesOnly(t *testing.T) {
+	reader := &fakeRowReader{
+		rows: []recommendations.ForYouRow{clusterRow(0, "Drama", "series-1", "movie-1")},
+		watched: []recommendations.ForYouRow{
+			watchedRow("anchor-series", "movie-2"),
+			watchedRow("anchor-movie-a", "movie-3"),
+			watchedRow("anchor-movie-b", "movie-4"),
+			watchedRow("anchor-movie-c", "movie-5"),
+		},
+	}
+	items := &fakeItemLoader{types: map[string]string{"series-1": "series", "anchor-series": "series"}}
+	h := newTestRecommendationsHandler(reader, items, catalog.AccessFilter{UserID: 7, ProfileID: "kid", AllowedLibraryIDs: []int{1, 4}})
+
+	rec := httptest.NewRecorder()
+	h.HandleRecommendations(rec, recommendationsRequest(t, "?categoryLimit=10&itemLimit=20"))
+	categories := decodeCategories(t, rec)
+	for name, filter := range map[string]catalog.AccessFilter{"page": reader.gotFilter, "because watched": reader.gotWatched.filter, "hydration": items.gotFilter} {
+		if !slices.Contains(filter.ExcludedMediaTypes, "series") {
+			t.Fatalf("%s filter = %+v, want series excluded", name, filter)
+		}
+	}
+	if reader.gotWatched.maxRows != recommendations.BecauseYouWatchedAnchors {
+		t.Fatalf("because-watched rows read = %d, want every anchor", reader.gotWatched.maxRows)
+	}
+	var got []string
+	for _, c := range categories {
+		entry := c.RecommendationType + ":" + c.BaselineItemName
+		for _, item := range c.Items {
+			entry += " " + item.Name + "/" + item.Type
+		}
+		got = append(got, entry)
+	}
+	want := []string{
+		"SimilarToRecentlyPlayed:Title anchor-movie-a Title movie-3/Movie",
+		"SimilarToRecentlyPlayed:Title anchor-movie-b Title movie-4/Movie",
+		"SimilarToLikedItem:Drama Title movie-1/Movie",
+	}
+	if !slices.Equal(got, want) {
+		t.Fatalf("categories = %q, want %q", got, want)
+	}
+
+	// A category limit of one still reads past a series anchor.
+	rec = httptest.NewRecorder()
+	h.HandleRecommendations(rec, recommendationsRequest(t, "?categoryLimit=1"))
+	if one := decodeCategories(t, rec); len(one) != 1 || one[0].BaselineItemName != "Title anchor-movie-a" {
+		t.Fatalf("categoryLimit=1 categories = %+v, want the first movie anchor", one)
+	}
+
+	// A library ParentId narrows the rows and the hydration to the library.
+	rec = httptest.NewRecorder()
+	h.HandleRecommendations(rec, recommendationsRequest(t, "?ParentId="+h.codec.EncodeIntID(EncodedIDLibrary, 4)))
+	decodeCategories(t, rec)
+	for name, filter := range map[string]catalog.AccessFilter{"page": reader.gotFilter, "because watched": reader.gotWatched.filter, "hydration": items.gotFilter} {
+		if !slices.Equal(filter.AllowedLibraryIDs, []int{4}) || !slices.Contains(filter.ExcludedMediaTypes, "series") {
+			t.Fatalf("%s filter with ParentId = %+v, want library 4 and series excluded", name, filter)
+		}
+	}
+
+	// A library the viewer cannot browse, or a parent that is not a library,
+	// answers an empty list without reading any row.
+	for name, parent := range map[string]string{
+		"library out of reach": h.codec.EncodeIntID(EncodedIDLibrary, 9),
+		"an item":              h.codec.EncodeStringID(EncodedIDItem, "movie-1"),
+		"garbage":              "not-an-id",
+	} {
+		reader.gotProfile = ""
+		rec = httptest.NewRecorder()
+		h.HandleRecommendations(rec, recommendationsRequest(t, "?parentId="+parent))
+		if rec.Code != http.StatusOK || rec.Body.String() != "[]\n" || reader.gotProfile != "" {
+			t.Fatalf("ParentId %s: %d %q (read rows: %v), want 200 [] without a read", name, rec.Code, rec.Body.String(), reader.gotProfile != "")
+		}
+	}
+}
+
+// A new profile has only server-wide rows and no history, so there is no
+// category to send: the answer is an empty list, and the client shows its
+// own Latest and Resume rows.
+func TestCompatRecommendationsColdStartIsEmpty(t *testing.T) {
+	reader := &fakeRowReader{rows: []recommendations.ForYouRow{
+		scoredRow("popular", "Popular on This Server", "popular-1"),
+		scoredRow("recently_added", "Recently Added", "recent-1"),
+	}}
+	rec := httptest.NewRecorder()
+	newTestRecommendationsHandler(reader, &fakeItemLoader{}, catalog.AccessFilter{}).HandleRecommendations(rec, recommendationsRequest(t, ""))
+	if rec.Code != http.StatusOK || rec.Body.String() != "[]\n" {
+		t.Fatalf("cold start: %d %q, want 200 []", rec.Code, rec.Body.String())
+	}
+}
+
+func TestCompatRecommendationsEmptyAndFailedReads(t *testing.T) {
+	// Nothing cached: an empty list.
+	rec := httptest.NewRecorder()
+	newTestRecommendationsHandler(&fakeRowReader{}, &fakeItemLoader{}, catalog.AccessFilter{}).HandleRecommendations(rec, recommendationsRequest(t, ""))
+	if rec.Code != http.StatusOK || rec.Body.String() != "[]\n" {
+		t.Fatalf("empty cache: %d %q, want 200 []", rec.Code, rec.Body.String())
+	}
+
+	// Recommendations not wired: an empty list.
+	rec = httptest.NewRecorder()
+	newTestRecommendationsHandler(nil, &fakeItemLoader{}, catalog.AccessFilter{}).HandleRecommendations(rec, recommendationsRequest(t, ""))
+	if rec.Code != http.StatusOK || rec.Body.String() != "[]\n" {
+		t.Fatalf("no reader: %d %q, want 200 []", rec.Code, rec.Body.String())
+	}
+
+	// A failed read is an error, not an empty list.
+	for name, reader := range map[string]*fakeRowReader{
+		"page":                {err: errors.New("db down")},
+		"because you watched": {watchedErr: errors.New("db down")},
+	} {
+		rec = httptest.NewRecorder()
+		newTestRecommendationsHandler(reader, &fakeItemLoader{}, catalog.AccessFilter{}).HandleRecommendations(rec, recommendationsRequest(t, ""))
+		if rec.Code != http.StatusInternalServerError {
+			t.Fatalf("failed %s read: status %d, want 500", name, rec.Code)
+		}
+	}
+}
+
+type countingRecommender struct {
+	recommendations.Recommender
+	calls int
+}
+
+func (c *countingRecommender) SimilarItems(context.Context, int, string, string, int, catalog.AccessFilter) ([]recommendations.ScoredItem, error) {
+	c.calls++
+	return []recommendations.ScoredItem{{MediaItemID: "movie-neighbor"}}, nil
+}
+
+// A Similar list anchored on an item the viewer cannot see never asks the
+// recommender: it takes the genre path, which answers it as an unknown item.
+func TestCompatSimilarSkipsTheRecommenderForAHiddenAnchor(t *testing.T) {
+	codec := NewResourceIDCodec()
+	recommender := &countingRecommender{}
+	// No item repository: the anchor check finds nothing, as for an item
+	// outside the viewer's libraries.
+	h := &ItemsHandler{codec: codec, recommender: recommender, content: unavailableSessionContent{}}
+
+	req := httptest.NewRequest(http.MethodGet, "/Items/x/Similar", nil)
+	rctx := chi.NewRouteContext()
+	rctx.URLParams.Add("id", codec.EncodeStringID(EncodedIDItem, "movie-hidden"))
+	ctx := context.WithValue(req.Context(), chi.RouteCtxKey, rctx)
+	ctx = context.WithValue(ctx, compatSessionKey, &Session{StreamAppUserID: 7, ProfileID: "kid"})
+	rec := httptest.NewRecorder()
+	h.HandleSimilar(rec, req.WithContext(ctx))
+
+	if recommender.calls != 0 {
+		t.Fatalf("recommender ran %d times for a hidden anchor", recommender.calls)
+	}
+	var result queryResultDTO
+	if err := json.Unmarshal(rec.Body.Bytes(), &result); err != nil {
+		t.Fatal(err)
+	}
+	if rec.Code != http.StatusOK || len(result.Items) != 0 || result.TotalRecordCount != 0 {
+		t.Fatalf("response = %d %s, want an empty result", rec.Code, rec.Body.String())
+	}
+}
+
+// similarItemRepo loads the requested items the viewer may see, recording
+// the access filter of each load.
+type similarItemRepo struct {
+	itemRepoForBatchLoader
+	hidden  map[string]bool
+	filters []catalog.AccessFilter
+}
+
+func (r *similarItemRepo) GetByIDsWithAccess(_ context.Context, ids []string, filter catalog.AccessFilter) ([]*models.MediaItem, error) {
+	r.filters = append(r.filters, filter)
+	var items []*models.MediaItem
+	for _, id := range ids {
+		if !r.hidden[id] {
+			items = append(items, &models.MediaItem{ContentID: id, Type: "movie", Title: "Title " + id})
+		}
+	}
+	return items, nil
+}
+
+type fixedRecommender struct {
+	recommendations.Recommender
+	items    []recommendations.ScoredItem
+	gotLimit int
+}
+
+func (f *fixedRecommender) SimilarItems(_ context.Context, _ int, _, _ string, limit int, _ catalog.AccessFilter) ([]recommendations.ScoredItem, error) {
+	f.gotLimit = limit
+	return f.items, nil
+}
+
+// A Similar list anchored on a visible item comes from the recommender, in
+// its order, and holds only the titles the viewer may see.
+func TestCompatSimilarServesTheRecommenderAccessFiltered(t *testing.T) {
+	codec := NewResourceIDCodec()
+	recommender := &fixedRecommender{items: []recommendations.ScoredItem{
+		{MediaItemID: "movie-near"}, {MediaItemID: "movie-hidden"}, {MediaItemID: "movie-far"},
+	}}
+	repo := &similarItemRepo{hidden: map[string]bool{"movie-hidden": true}}
+	restricted := catalog.AccessFilter{UserID: 7, ProfileID: "kid", AllowedLibraryIDs: []int{4}}
+	h := &ItemsHandler{
+		codec:        codec,
+		mapper:       newMapper(codec, nil),
+		recommender:  recommender,
+		itemRepo:     repo,
+		content:      unavailableSessionContent{},
+		accessFilter: func(context.Context, int, string) catalog.AccessFilter { return restricted },
+	}
+
+	req := httptest.NewRequest(http.MethodGet, "/Items/x/Similar?Limit=5", nil)
+	rctx := chi.NewRouteContext()
+	rctx.URLParams.Add("id", codec.EncodeStringID(EncodedIDItem, "movie-anchor"))
+	ctx := context.WithValue(req.Context(), chi.RouteCtxKey, rctx)
+	ctx = context.WithValue(ctx, compatSessionKey, &Session{StreamAppUserID: 7, ProfileID: "kid"})
+	rec := httptest.NewRecorder()
+	h.HandleSimilar(rec, req.WithContext(ctx))
+
+	var result queryResultDTO
+	if err := json.Unmarshal(rec.Body.Bytes(), &result); err != nil {
+		t.Fatal(err)
+	}
+	var names []string
+	for _, item := range result.Items {
+		names = append(names, item.Name)
+	}
+	if rec.Code != http.StatusOK || !slices.Equal(names, []string{"Title movie-near", "Title movie-far"}) || result.TotalRecordCount != 2 {
+		t.Fatalf("response = %d %v (%d), want the two visible neighbors in order", rec.Code, names, result.TotalRecordCount)
+	}
+	if recommender.gotLimit != 5 {
+		t.Fatalf("recommender limit = %d, want 5", recommender.gotLimit)
+	}
+	// One load checks the anchor, one the neighbors; both under the session's access.
+	if len(repo.filters) != 2 {
+		t.Fatalf("item loads = %d, want 2", len(repo.filters))
+	}
+	for _, filter := range repo.filters {
+		if !slices.Equal(filter.AllowedLibraryIDs, []int{4}) || filter.ProfileID != "kid" {
+			t.Fatalf("load filter = %+v, want the session's", filter)
+		}
+	}
+}
+
+// Oversized limits are capped before they size anything: a category holds
+// at most a cached row's titles.
+func TestCompatRecommendationsCapTheirLimits(t *testing.T) {
+	reader := &fakeRowReader{rows: []recommendations.ForYouRow{clusterRow(0, "Drama", "movie-1")}}
+	h := newTestRecommendationsHandler(reader, &fakeItemLoader{}, catalog.AccessFilter{UserID: 7, ProfileID: "kid"})
+	rec := httptest.NewRecorder()
+	h.HandleRecommendations(rec, recommendationsRequest(t, "?itemLimit=1000000000&categoryLimit=1000000000"))
+	if rec.Code != http.StatusOK || reader.gotLimit != recommendations.MaxRowReadLimit {
+		t.Fatalf("status %d, read limit %d; want 200 and the most a row read returns", rec.Code, reader.gotLimit)
+	}
+}
+
+// genreFallbackContent answers a drama anchor and a page of dramas.
+type genreFallbackContent struct{ ContentService }
+
+func (genreFallbackContent) GetItemDetail(_ context.Context, _ *Session, id string, _ *int) (*upstreamItemDetail, error) {
+	return &upstreamItemDetail{ContentID: id, Type: "movie", Title: "Anchor", Genres: []string{"Drama"}}, nil
+}
+
+// genreFallbackDepth is how many marked dramas genreFallbackContent puts
+// between A and B.
+var genreFallbackDepth = 2
+
+// BrowseItems answers the first limit dramas, best first: A, then
+// genreFallbackDepth marked titles, then B and C.
+func (genreFallbackContent) BrowseItems(_ context.Context, _ *Session, params url.Values) (*upstreamBrowseResponse, error) {
+	all := []upstreamListItem{{ContentID: "movie-a", Type: "movie", Title: "A"}}
+	for i := range genreFallbackDepth {
+		all = append(all, upstreamListItem{ContentID: fmt.Sprintf("movie-marked-%d", i), Type: "movie", Title: "Marked"})
+	}
+	all = append(all,
+		upstreamListItem{ContentID: "movie-b", Type: "movie", Title: "B"},
+		upstreamListItem{ContentID: "movie-c", Type: "movie", Title: "C"},
+	)
+	limit, _ := strconv.Atoi(params.Get("limit"))
+	return &upstreamBrowseResponse{Items: all[:min(limit, len(all))]}, nil
+}
+
+// markingUserData reports movie-marked as marked Not interested, or fails.
+type markingUserData struct {
+	*mockUserDataService
+	err error
+}
+
+func (m markingUserData) ListNotInterestedByMediaItems(_ context.Context, _ *Session, ids []string) (map[string]bool, error) {
+	if m.err != nil {
+		return nil, m.err
+	}
+	marked := map[string]bool{}
+	for _, id := range ids {
+		if strings.HasPrefix(id, "movie-marked") {
+			marked[id] = true
+		}
+	}
+	return marked, nil
+}
+
+// The genre fallback, which serves whenever the recommender has nothing,
+// leaves out the profile's Not interested titles and still fills the list
+// from deeper in the genre, and answers nothing when it cannot read them
+// rather than showing them.
+func TestCompatSimilarGenreFallbackLeavesOutMarkedTitles(t *testing.T) {
+	codec := NewResourceIDCodec()
+	similar := func(userData UserDataService) []string {
+		h := &ItemsHandler{codec: codec, mapper: newMapper(codec, nil), content: genreFallbackContent{}, userData: userData}
+		req := httptest.NewRequest(http.MethodGet, "/Items/x/Similar?Limit=2", nil)
+		rctx := chi.NewRouteContext()
+		rctx.URLParams.Add("id", codec.EncodeStringID(EncodedIDItem, "movie-anchor"))
+		ctx := context.WithValue(req.Context(), chi.RouteCtxKey, rctx)
+		ctx = context.WithValue(ctx, compatSessionKey, &Session{StreamAppUserID: 7, ProfileID: "p1"})
+		rec := httptest.NewRecorder()
+		h.HandleSimilar(rec, req.WithContext(ctx))
+		var result queryResultDTO
+		if err := json.Unmarshal(rec.Body.Bytes(), &result); err != nil {
+			t.Fatal(err)
+		}
+		names := []string{}
+		for _, item := range result.Items {
+			names = append(names, item.Name)
+		}
+		return names
+	}
+	if got := similar(markingUserData{mockUserDataService: &mockUserDataService{}}); !slices.Equal(got, []string{"A", "B"}) {
+		t.Fatalf("similar = %v, want the unmarked dramas", got)
+	}
+	// Marks deeper than the first window: the list widens until it fills.
+	deep := genreFallbackDepth
+	genreFallbackDepth = 20
+	t.Cleanup(func() { genreFallbackDepth = deep })
+	if got := similar(markingUserData{mockUserDataService: &mockUserDataService{}}); !slices.Equal(got, []string{"A", "B"}) {
+		t.Fatalf("similar with many marks = %v, want the unmarked dramas", got)
+	}
+	genreFallbackDepth = deep
+	if got := similar(markingUserData{mockUserDataService: &mockUserDataService{}, err: errors.New("store down")}); len(got) != 0 {
+		t.Fatalf("similar = %v with marks unreadable, want nothing", got)
+	}
+}
diff --git a/internal/jellycompat/handlers_userdata.go b/internal/jellycompat/handlers_userdata.go
index 2ba54cd6bc..00f12fb7e8 100644
--- a/internal/jellycompat/handlers_userdata.go
+++ b/internal/jellycompat/handlers_userdata.go
@@ -14,6 +14,7 @@ import (
 	"github.com/prairie-server/prairie-server/internal/catalog"
 	"github.com/prairie-server/prairie-server/internal/config"
 	"github.com/prairie-server/prairie-server/internal/userstore"
+	"github.com/prairie-server/prairie-server/internal/watchstate"
 )
 
 // UserDataHandler serves Jellyfin favorites and played-state routes.
@@ -208,7 +209,7 @@ func (h *UserDataHandler) handlePlayedMutation(w http.ResponseWriter, r *http.Re
 		return
 	}
 
-	targets, err := h.resolvePlayedTargets(r, session, chi.URLParam(r, "itemId"))
+	targets, err := h.resolveMarkTargets(r, session, chi.URLParam(r, "itemId"), played)
 	if err != nil {
 		writeCompatUpstreamError(w, err)
 		return
@@ -244,48 +245,98 @@ func (h *UserDataHandler) handlePlayedMutation(w http.ResponseWriter, r *http.Re
 }
 
 func (h *UserDataHandler) resolvePlayedTargets(r *http.Request, session *Session, rawItemID string) ([]string, error) {
+	targets, _, err := h.resolvePlayedTargetsWithParent(r, session, rawItemID)
+	return targets, err
+}
+
+// resolveMarkTargets resolves the leaf items a played or unplayed mark writes.
+func (h *UserDataHandler) resolveMarkTargets(r *http.Request, session *Session, rawItemID string, played bool) ([]string, error) {
+	if played {
+		return h.resolvePlayedTargets(r, session, rawItemID)
+	}
+	return h.resolveUnplayedTargets(r, session, rawItemID)
+}
+
+// resolveUnplayedTargets is resolvePlayedTargets for an unplayed mark. A series
+// or season also clears its watched episodes that no longer have a library
+// file, which the episode listings leave out; otherwise their completed
+// progress keeps the series in Next Up.
+func (h *UserDataHandler) resolveUnplayedTargets(r *http.Request, session *Session, rawItemID string) ([]string, error) {
+	targets, parent, err := h.resolvePlayedTargetsWithParent(r, session, rawItemID)
+	if err != nil || parent.kind == "" {
+		return targets, err
+	}
+	resolver, ok := h.userData.(interface {
+		ParentUnplayedTargets(context.Context, *Session, string, string) ([]string, error)
+	})
+	if !ok {
+		return targets, nil
+	}
+	extra, err := resolver.ParentUnplayedTargets(r.Context(), session, parent.kind, parent.id)
+	if err != nil {
+		return nil, err
+	}
+	seen := make(map[string]struct{}, len(targets))
+	for _, target := range targets {
+		seen[target] = struct{}{}
+	}
+	return appendUniqueContentIDs(targets, seen, extra...), nil
+}
+
+// playedTargetNotFound answers a played mark on an unknown item.
+const playedTargetNotFound = "Item not found"
+
+// playedParent names the series or season a played mark expanded; kind is
+// empty for a movie or episode.
+type playedParent struct {
+	kind, id string
+}
+
+func (h *UserDataHandler) resolvePlayedTargetsWithParent(r *http.Request, session *Session, rawItemID string) ([]string, playedParent, error) {
 	if seasonID, err := h.codec.DecodeStringID(EncodedIDSeason, rawItemID); err == nil {
-		return h.resolvePlayedTargetsForSeason(r, session, seasonID)
+		targets, err := h.resolvePlayedTargetsForSeason(r, session, seasonID)
+		return targets, playedParent{kind: watchstate.ParentSeason, id: seasonID}, err
 	}
 
 	contentID, _, err := decodeItemOrMediaSourceID(r.Context(), h.codec, rawItemID)
 	if errors.Is(err, errMediaSourceOwnerNotFound) {
-		return nil, &HTTPError{StatusCode: http.StatusNotFound, Message: "Item not found"}
+		return nil, playedParent{}, &HTTPError{StatusCode: http.StatusNotFound, Message: playedTargetNotFound}
 	}
 	if err != nil {
-		return nil, err
+		return nil, playedParent{}, err
 	}
 	return h.resolvePlayedTargetsForItem(r, session, contentID)
 }
 
-func (h *UserDataHandler) resolvePlayedTargetsForItem(r *http.Request, session *Session, contentID string) ([]string, error) {
+func (h *UserDataHandler) resolvePlayedTargetsForItem(r *http.Request, session *Session, contentID string) ([]string, playedParent, error) {
 	detail, err := h.content.GetItemDetail(r.Context(), session, contentID, nil)
 	if err != nil {
-		return nil, err
+		return nil, playedParent{}, err
 	}
 
 	switch strings.ToLower(detail.Type) {
 	case itemTypeMovie, itemTypeEpisode:
-		return []string{detail.ContentID}, nil
+		return []string{detail.ContentID}, playedParent{}, nil
 	case "season":
-		return h.resolvePlayedTargetsForSeason(r, session, detail.ContentID)
+		targets, err := h.resolvePlayedTargetsForSeason(r, session, detail.ContentID)
+		return targets, playedParent{kind: watchstate.ParentSeason, id: detail.ContentID}, err
 	case itemTypeSeries:
 		seasons, err := h.content.ListSeasons(r.Context(), session, detail.ContentID, nil)
 		if err != nil {
-			return nil, err
+			return nil, playedParent{}, err
 		}
 		targets := make([]string, 0)
 		seen := make(map[string]struct{})
 		for _, season := range seasons {
 			episodes, err := h.content.ListEpisodes(r.Context(), session, detail.ContentID, season.SeasonNumber, nil)
 			if err != nil {
-				return nil, err
+				return nil, playedParent{}, err
 			}
 			targets = appendUniqueContentIDs(targets, seen, episodeContentIDs(episodes)...)
 		}
-		return targets, nil
+		return targets, playedParent{kind: watchstate.ParentSeries, id: detail.ContentID}, nil
 	default:
-		return nil, &HTTPError{StatusCode: http.StatusNotFound, Message: "Item not found"}
+		return nil, playedParent{}, &HTTPError{StatusCode: http.StatusNotFound, Message: playedTargetNotFound}
 	}
 }
 
@@ -374,7 +425,7 @@ func (h *UserDataHandler) HandleUpdateUserData(w http.ResponseWriter, r *http.Re
 			req.Played = new(*req.PlayCount > 0)
 		}
 		if req.Played != nil {
-			targets, err := h.resolvePlayedTargets(r, session, chi.URLParam(r, "itemId"))
+			targets, err := h.resolveMarkTargets(r, session, chi.URLParam(r, "itemId"), *req.Played)
 			if err != nil {
 				writeCompatUpstreamError(w, err)
 				return
diff --git a/internal/jellycompat/hevc_output_conditions_test.go b/internal/jellycompat/hevc_output_conditions_test.go
index bb8905f8ee..f67b0c08e3 100644
--- a/internal/jellycompat/hevc_output_conditions_test.go
+++ b/internal/jellycompat/hevc_output_conditions_test.go
@@ -32,6 +32,14 @@ func TestHEVCEncodingHonorsHLSCodecProfileConditions(t *testing.T) {
 			}},
 			wantCodec: "h264",
 		},
+		{
+			// An HEVC encode's reference frames are unknown and get no stand-in.
+			name: "required output reference frames are unknown",
+			codecProfile: CodecProfile{Type: "Video", Codec: "hevc", Container: "hls", SubContainer: "mp4", Conditions: []ProfileCondition{
+				{Condition: "LessThanEqual", Property: "RefFrames", Value: "4", IsRequired: true},
+			}},
+			wantCodec: "h264",
+		},
 		{
 			name: "HLS MP4 audio channel limit",
 			codecProfile: CodecProfile{Type: "VideoAudio", Codec: "aac", Container: "hls", SubContainer: "mp4", Conditions: []ProfileCondition{
diff --git a/internal/jellycompat/image_proxy_tags.go b/internal/jellycompat/image_proxy_tags.go
index 75a8b2eb41..c5910afb8d 100644
--- a/internal/jellycompat/image_proxy_tags.go
+++ b/internal/jellycompat/image_proxy_tags.go
@@ -168,7 +168,7 @@ func appendCompatImageProxyTags(codec *ResourceIDCodec, value any) bool {
 				changed = appendCompatImageProxyTagsInBlurHashes(child) || changed
 			case "BackdropImageTags", "ParentBackdropImageTags":
 				changed = appendCompatImageProxyTagsInSlice(child) || changed
-			case "PrimaryImageTag", "SeriesPrimaryImageTag", "ParentPrimaryImageTag", "ParentThumbImageTag", "BackdropImageTag", "ImageTag":
+			case "PrimaryImageTag", "SeriesPrimaryImageTag", "ParentPrimaryImageTag", "ParentThumbImageTag", "ParentLogoImageTag", "BackdropImageTag", "ImageTag":
 				if tag, ok := child.(string); ok && tag != "" {
 					typed[key] = compatImageProxyTag(tag)
 					changed = true
diff --git a/internal/jellycompat/image_proxy_tags_test.go b/internal/jellycompat/image_proxy_tags_test.go
index 6706f97ea4..f658aba385 100644
--- a/internal/jellycompat/image_proxy_tags_test.go
+++ b/internal/jellycompat/image_proxy_tags_test.go
@@ -20,6 +20,7 @@ func TestCompatImageProxyTagVariantMiddlewareSuffixesInfuseImageTags(t *testing.
 				SeriesPrimaryImageTag:   "series-tag",
 				ParentBackdropImageTags: []string{"parent-backdrop-tag"},
 				ParentThumbImageTag:     "parent-thumb-tag",
+				ParentLogoImageTag:      "parent-logo-tag",
 				ImageBlurHashes: map[string]map[string]string{
 					"Primary": {"primary-tag": "thumbhash"},
 				},
@@ -63,6 +64,9 @@ func TestCompatImageProxyTagVariantMiddlewareSuffixesInfuseImageTags(t *testing.
 	if item.ParentThumbImageTag != "parent-thumb-tag-p" {
 		t.Fatalf("parent thumb tag = %q, want parent-thumb-tag-p", item.ParentThumbImageTag)
 	}
+	if item.ParentLogoImageTag != "parent-logo-tag-p" {
+		t.Fatalf("parent logo tag = %q, want parent-logo-tag-p", item.ParentLogoImageTag)
+	}
 	if _, ok := item.ImageBlurHashes["Primary"]["primary-tag-p"]; !ok {
 		t.Fatalf("blurhash keys = %#v, want suffixed primary tag", item.ImageBlurHashes["Primary"])
 	}
diff --git a/internal/jellycompat/image_variants.go b/internal/jellycompat/image_variants.go
index eca0d498c1..a7d49dd43a 100644
--- a/internal/jellycompat/image_variants.go
+++ b/internal/jellycompat/image_variants.go
@@ -2,9 +2,12 @@ package jellycompat
 
 import (
 	"context"
+	"math"
 	"net/http"
+	"slices"
 	"strings"
 
+	"github.com/prairie-server/prairie-server/internal/artworkkey"
 	"github.com/prairie-server/prairie-server/internal/catalog"
 	"github.com/prairie-server/prairie-server/internal/imagesize"
 )
@@ -30,46 +33,165 @@ func compatPresignImageWithExpiry(detailSvc *catalog.DetailService, ctx context.
 	if detailSvc == nil {
 		return catalog.ResolvedImageURL{URL: path}
 	}
-	return detailSvc.PresignImageURLWithExpiry(ctx, path, imageType, size)
+	ladderType := artworkkey.ImageTypeOf(path, imageType)
+	return detailSvc.PresignImageURLWithExpiry(ctx, path, imageType, compatSizeFor(size, ladderType))
 }
 
+// compatRungTolerance is how much narrower than a request a rung may be and
+// still serve it. Scaling a rung up by a quarter costs little sharpness, while
+// the next rung is often twice as wide (w500 to w1000 posters), so a modest
+// shortfall beats doubling the bytes.
+const compatRungTolerance = 0.8
+
+// compatRequestImageSize maps Jellyfin's MaxWidth/MaxHeight/FillWidth/FillHeight
+// onto the native image sizes: the narrowest rung of the image type's ladder
+// that covers the requested box, within compatRungTolerance, or the original
+// when even the widest rung falls short. The ladder is keyed by width, so a
+// height becomes one through the type's aspect ratio (see compatTargetWidth).
+//
+// Which image serves a request is known only once the item resolves: Primary
+// is a poster, an episode still or a headshot, and an item without the
+// requested type can fall back to another (a series backdrop for a missing
+// episode still). Ladders and aspect ratios differ, so the value carries the
+// requested type's size and, after it, each ladder whose size differs, e.g.
+// "large;profile=original"; compatSizeFor picks the resolved image's own when
+// it is presigned. The value doubles as the route cache's size key, so two
+// requests share a cached URL only when they agree on every ladder.
 func compatRequestImageSize(r *http.Request, imageType string) string {
+	defaultSize := compatCardImageSize
+	if strings.EqualFold(imageType, compatBackdropImageType) {
+		defaultSize = compatMediumImageSize
+	}
 	if r == nil {
-		if strings.EqualFold(imageType, compatBackdropImageType) {
-			return compatMediumImageSize
+		return defaultSize
+	}
+
+	query := r.URL.Query()
+	param := func(name, alias string) int {
+		return parsePositiveInt(firstNonEmpty(query.Get(name), query.Get(alias)), 0)
+	}
+	box := compatImageBox{
+		maxWidth: param("MaxWidth", "maxWidth"), maxHeight: param("MaxHeight", "maxHeight"),
+		fillWidth: param("FillWidth", "fillWidth"), fillHeight: param("FillHeight", "fillHeight"),
+	}
+	if box == (compatImageBox{}) {
+		return defaultSize
+	}
+	own := compatLadderType(imageType)
+	ownSize := compatSizeOnLadder(own, box)
+	parts := []string{ownSize}
+	for _, ladder := range compatLadders {
+		// The requested type's own ladder never differs, so it is skipped here.
+		if size := compatSizeOnLadder(ladder, box); size != ownSize {
+			parts = append(parts, ladder+"="+size)
+		}
+	}
+	return strings.Join(parts, compatSizeSeparator)
+}
+
+// compatLadders are the artwork ladders a Jellyfin image request can resolve
+// on, in a fixed order so equal requests produce equal cache keys.
+var compatLadders = []string{
+	artworkkey.ImagePoster, artworkkey.ImageStill, artworkkey.ImageProfile,
+	artworkkey.ImageBackdrop, artworkkey.ImageLogo, artworkkey.ImageThumb,
+	artworkkey.ImageBanner, artworkkey.ImageClearArt, artworkkey.ImageDisc,
+}
+
+// compatSizeSeparator separates a request's own size from the per-ladder
+// sizes that differ from it.
+const compatSizeSeparator = ";"
+
+// compatImageBox is a Jellyfin image request's size parameters; zero is absent.
+type compatImageBox struct {
+	maxWidth, maxHeight, fillWidth, fillHeight int
+}
+
+// compatTargetWidth is the width an image of the given aspect ratio is drawn at
+// for box. The Max parameters bound the image, so with both it fits within
+// each and the smaller implied width wins. The Fill parameters are a box the
+// image covers, so the larger wins. Either kind alone is that one constraint.
+func compatTargetWidth(box compatImageBox, aspect float64) int {
+	implied := func(height int) int { return int(math.Ceil(float64(height) * aspect)) }
+	fit := box.maxWidth
+	if box.maxHeight > 0 && (fit == 0 || implied(box.maxHeight) < fit) {
+		fit = implied(box.maxHeight)
+	}
+	// slices.Max rather than max: this package shadows the builtin with a
+	// first-positive helper.
+	return slices.Max([]int{fit, box.fillWidth, implied(box.fillHeight)})
+}
+
+// compatCardRung is the card rung Jellyfin card boxes (~300px) are served
+// from. Prairie's poster and profile ladders (w500/w300/w200) end in a w200 TV
+// rung, so small names w200 there and the next named size, medium, is w500:
+// without this a 298x446 card would jump to w500.
+const compatCardRung = 300
+
+// compatSizeOnLadder is the narrowest of small, the card rung, medium and large
+// on ladderType that is at least compatRungTolerance of the width box asks
+// for, else the original. The card rung is only a candidate on a ladder whose
+// small rung is narrower than it.
+func compatSizeOnLadder(ladderType string, box compatImageBox) string {
+	width := compatTargetWidth(box, compatImageAspect(ladderType))
+	covers := func(rung int) bool { return float64(rung) >= compatRungTolerance*float64(width) }
+	small, ok := imagesize.VariantWidthPx(imagesize.Variant(ladderType, imagesize.Small))
+	if ok && covers(small) {
+		return string(imagesize.Small)
+	}
+	if ok && small < compatCardRung && slices.Contains(artworkkey.VariantWidths(ladderType), compatCardRung) && covers(compatCardRung) {
+		return string(imagesize.Width(compatCardRung))
+	}
+	for _, size := range []imagesize.Size{imagesize.Medium, imagesize.Large} {
+		rung, ok := imagesize.VariantWidthPx(imagesize.Variant(ladderType, size))
+		if ok && covers(rung) {
+			return string(size)
 		}
-		return compatCardImageSize
 	}
+	return compatOriginalImageSize
+}
 
-	maxWidth := parsePositiveInt(firstNonEmpty(r.URL.Query().Get("MaxWidth"), r.URL.Query().Get("maxWidth")), 0)
-	maxHeight := parsePositiveInt(firstNonEmpty(r.URL.Query().Get("MaxHeight"), r.URL.Query().Get("maxHeight")), 0)
-	fillWidth := parsePositiveInt(firstNonEmpty(r.URL.Query().Get("FillWidth"), r.URL.Query().Get("fillWidth")), 0)
-	fillHeight := parsePositiveInt(firstNonEmpty(r.URL.Query().Get("FillHeight"), r.URL.Query().Get("fillHeight")), 0)
-	maxDim := max(max(maxWidth, maxHeight), max(fillWidth, fillHeight))
-	// The large bucket names a width rung (w780 posters and stills), so only a
-	// width-ish constraint may promote into it: a portrait poster asked for at
-	// MaxHeight=900 would come back far taller than 900. The original bucket
-	// above deliberately keeps reading maxDim — it serves the stored original
-	// rather than a rung, so a height-only request there is merely generous.
-	maxWidthDim := max(maxWidth, fillWidth)
-
-	switch {
-	case maxDim <= 0:
-		if strings.EqualFold(imageType, compatBackdropImageType) {
-			return compatMediumImageSize
+// compatSizeFor is the size to presign an image on ladderType at, from a value
+// compatRequestImageSize produced: that ladder's size when it differs from the
+// requested type's, else the requested type's.
+func compatSizeFor(size, ladderType string) string {
+	own, others, ok := strings.Cut(size, compatSizeSeparator)
+	if !ok {
+		return size
+	}
+	for part := range strings.SplitSeq(others, compatSizeSeparator) {
+		if ladder, ladderSize, _ := strings.Cut(part, "="); ladder == ladderType {
+			return ladderSize
 		}
-		return compatCardImageSize
-	case maxDim <= 320:
-		return compatCardImageSize
-	case maxDim >= 1200:
-		return compatOriginalImageSize
-	case maxWidthDim >= 780:
-		// The ladder now carries a rung between the pre-existing default and
-		// the original (w780 posters and stills, w1280 logos), so a Jellyfin
-		// client asking for a large-but-not-full image gets one instead of
-		// being rounded down to the default.
-		return compatLargeImageSize
+	}
+	return own
+}
+
+// compatLadderType is the artwork ladder a Jellyfin image type is cached on.
+// Primary maps to the poster ladder; compatRequestImageSize also sizes every
+// request on the other ladders.
+func compatLadderType(imageType string) string {
+	switch lower := strings.ToLower(imageType); lower {
+	case artworkkey.ImageBackdrop, artworkkey.ImageLogo, artworkkey.ImageThumb,
+		artworkkey.ImageBanner, artworkkey.ImageDisc:
+		// Jellyfin names these the same as the cache does.
+		return lower
+	case "art":
+		return artworkkey.ImageClearArt
 	default:
-		return compatMediumImageSize
+		return artworkkey.ImagePoster
+	}
+}
+
+// compatImageAspect is a ladder type's typical width over height.
+func compatImageAspect(ladderType string) float64 {
+	switch ladderType {
+	case artworkkey.ImagePoster, artworkkey.ImageProfile:
+		return 2.0 / 3.0
+	case artworkkey.ImageBanner:
+		return 1000.0 / 185.0
+	case artworkkey.ImageDisc:
+		return 1
+	default: // backdrop, still, thumb, clear art, and logos, which are wider still
+		return 16.0 / 9.0
 	}
 }
diff --git a/internal/jellycompat/image_variants_test.go b/internal/jellycompat/image_variants_test.go
index 4b3c8e36a0..e89a2129ca 100644
--- a/internal/jellycompat/image_variants_test.go
+++ b/internal/jellycompat/image_variants_test.go
@@ -4,6 +4,8 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
 )
 
 func TestCompatRequestImageSize(t *testing.T) {
@@ -18,25 +20,35 @@ func TestCompatRequestImageSize(t *testing.T) {
 		{"no dimensions", "/Items/1/Images/Primary", "Primary", "small"},
 		{"no dimensions backdrop", "/Items/1/Images/Backdrop", "Backdrop", "medium"},
 		{"thumbnail width", "/Items/1/Images/Primary?MaxWidth=200", "Primary", "small"},
-		{"card boundary", "/Items/1/Images/Primary?FillWidth=320", "Primary", "small"},
-		{"between card and large", "/Items/1/Images/Primary?MaxWidth=600", "Primary", "medium"},
-		{"just below large", "/Items/1/Images/Primary?MaxWidth=779", "Primary", "medium"},
-		{"large boundary", "/Items/1/Images/Primary?MaxWidth=780", "Primary", "large"},
-		// The large bucket is a width rung, so a height-only constraint must not
-		// reach it: a portrait poster at MaxHeight=900 would come back far taller
-		// than the client asked for.
-		{"height only does not reach large", "/Items/1/Images/Primary?MaxHeight=900", "Primary", "medium"},
-		{"width reaches large", "/Items/1/Images/Primary?MaxWidth=900", "Primary", "large"},
-		{"fill width reaches large", "/Items/1/Images/Primary?FillWidth=900", "Primary", "large"},
-		{"fill height only does not reach large", "/Items/1/Images/Primary?FillHeight=900", "Primary", "medium"},
-		{"fill height only backdrop stays medium", "/Items/1/Images/Backdrop?FillHeight=1100", "Backdrop", "medium"},
-		{"large from fill width", "/Items/1/Images/Backdrop?FillWidth=1100", "Backdrop", "large"},
-		// The pre-existing original bucket keeps reading any dimension; it serves
-		// the stored original rather than a width rung.
-		{"height only still reaches original", "/Items/1/Images/Primary?MaxHeight=1200", "Primary", "original"},
-		{"just below original", "/Items/1/Images/Backdrop?MaxWidth=1199", "Backdrop", "large"},
-		{"original boundary", "/Items/1/Images/Backdrop?MaxWidth=1200", "Backdrop", "original"},
-		{"very large", "/Items/1/Images/Backdrop?MaxWidth=4000", "Backdrop", "original"},
+		// Prairie's poster small is the w200 TV rung; a card box past it lands
+		// on w300, not w500.
+		{"past the TV rung", "/Items/1/Images/Primary?FillWidth=251", "Primary", "width:300"},
+		{"card boundary", "/Items/1/Images/Primary?FillWidth=320", "Primary", "width:300"},
+		// A rung up to a fifth narrower than the request still serves it.
+		{"card rung within tolerance", "/Items/1/Images/Primary?FillWidth=375", "Primary", "width:300"},
+		{"past the card rung", "/Items/1/Images/Primary?FillWidth=376", "Primary", "medium"},
+		{"between card and medium", "/Items/1/Images/Primary?MaxWidth=600", "Primary", "medium"},
+		{"lowercase alias", "/Items/1/Images/Primary?maxWidth=600", "Primary", "medium"},
+		{"medium within tolerance", "/Items/1/Images/Primary?MaxWidth=625", "Primary", "medium"},
+		// A height becomes a width through the type's aspect ratio: a 900px
+		// tall poster is 600px wide, which the w500 rung serves.
+		{"poster height through aspect", "/Items/1/Images/Primary?MaxHeight=900", "Primary", "medium"},
+		{"poster fill height through aspect", "/Items/1/Images/Primary?FillHeight=900", "Primary", "medium"},
+		// Prairie's widest poster rung is w500 (large is medium's rung), so a
+		// request past it needs the original.
+		{"past the widest poster rung", "/Items/1/Images/Primary?MaxWidth=626", "Primary", "original"},
+		{"tall poster past the widest rung", "/Items/1/Images/Primary?MaxHeight=1200", "Primary", "original"},
+		{"backdrop height through aspect", "/Items/1/Images/Backdrop?FillHeight=1100", "Backdrop", "medium"},
+		{"mid-width backdrop stays medium", "/Items/1/Images/Backdrop?FillWidth=1100", "Backdrop", "medium"},
+		{"1080p backdrop box", "/Items/1/Images/Backdrop?MaxWidth=1920&MaxHeight=1080", "Backdrop", "medium"},
+		// Max bounds both ways, so a short box caps a wide request.
+		{"short box caps a wide backdrop", "/Items/1/Images/Backdrop?MaxWidth=3840&MaxHeight=720", "Backdrop", "medium"},
+		{"height binds beside a narrow width", "/Items/1/Images/Backdrop?FillWidth=300&FillHeight=1080", "Backdrop", "medium"},
+		{"1440p backdrop", "/Items/1/Images/Backdrop?MaxWidth=2560", "Backdrop", "large"},
+		{"4K backdrop", "/Items/1/Images/Backdrop?MaxWidth=3840", "Backdrop", "original"},
+		// A logo has only the w500 rung.
+		{"logo within its rung", "/Items/1/Images/Logo?MaxWidth=600", "Logo", "small"},
+		{"wide logo", "/Items/1/Images/Logo?MaxWidth=1000", "Logo", "original"},
 	}
 
 	for _, tt := range tests {
@@ -45,9 +57,68 @@ func TestCompatRequestImageSize(t *testing.T) {
 			if tt.query != "" {
 				req = httptest.NewRequest(http.MethodGet, tt.query, nil)
 			}
-			if got := compatRequestImageSize(req, tt.imageType); got != tt.want {
+			// These cases pin the size on the requested type's own ladder.
+			if got := compatSizeFor(compatRequestImageSize(req, tt.imageType), compatLadderType(tt.imageType)); got != tt.want {
 				t.Fatalf("compatRequestImageSize(%q, %q) = %q, want %q", tt.query, tt.imageType, got, tt.want)
 			}
 		})
 	}
 }
+
+// Which image serves a request is known only once the item resolves: Primary
+// is a poster, an episode still or a headshot, and an item without the
+// requested type falls back to another. Each resolves on its own ladder and
+// aspect ratio, so one request can need a different size for each.
+func TestCompatRequestImageSizePerLadder(t *testing.T) {
+	tests := []struct {
+		name      string
+		imageType string
+		query     string
+		want      map[string]string
+	}{
+		// Prairie's poster, still and headshot ladders top out at w500, so a
+		// 1200px request needs the original, where a backdrop's w1920 serves it.
+		{"wide headshot", "Primary", "?MaxWidth=1200", map[string]string{"poster": "original", "still": "original", "profile": "original", "backdrop": "medium"}},
+		// A 1200px-tall 16:9 still is 2134px wide, past its w500 rung.
+		{"tall still", "Primary", "?MaxHeight=1200", map[string]string{"poster": "original", "still": "original", "profile": "original", "backdrop": "medium"}},
+		{"card", "Primary", "?MaxWidth=200", map[string]string{"poster": "small", "still": "small", "profile": "small", "backdrop": "small"}},
+		{"no dimensions", "Primary", "", map[string]string{"poster": "small", "still": "small", "profile": "small", "backdrop": "small"}},
+		// A portrait card box bounds a 16:9 image by its width, but one
+		// covering it must be as wide as the box is tall at 16:9. A 298px poster
+		// or headshot card lands on the w300 card rung, above the w200 TV rung.
+		{"bounded by a portrait box", "Primary", "?MaxWidth=298&MaxHeight=446", map[string]string{"poster": "width:300", "still": "small", "profile": "width:300", "backdrop": "small"}},
+		{"covering a portrait box", "Primary", "?FillWidth=298&FillHeight=446", map[string]string{"poster": "width:300", "still": "original", "profile": "width:300", "backdrop": "medium"}},
+		// A backdrop request served by the item's poster sizes it as a poster.
+		{"backdrop falling back to a poster", "Backdrop", "?MaxWidth=1200", map[string]string{"backdrop": "medium", "poster": "original", "logo": "original"}},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := httptest.NewRequest(http.MethodGet, "/Items/1/Images/"+tt.imageType+tt.query, nil)
+			size := compatRequestImageSize(req, tt.imageType)
+			for ladder, want := range tt.want {
+				if got := compatSizeFor(size, ladder); got != want {
+					t.Errorf("%s: compatSizeFor(%q, %q) = %q, want %q", tt.query, size, ladder, got, want)
+				}
+			}
+		})
+	}
+}
+
+// The size is picked on the ladder of the key being presigned, whatever type
+// the request named.
+func TestCompatPresignSizesOnTheKeysOwnLadder(t *testing.T) {
+	resolver := &recordingImageResolver{}
+	detailSvc := &catalog.DetailService{}
+	detailSvc.SetImageResolver(resolver)
+	req := httptest.NewRequest(http.MethodGet, "/Items/1/Images/Backdrop?MaxWidth=1200", nil)
+	size := compatRequestImageSize(req, "Backdrop")
+
+	compatPresignImageWithExpiry(detailSvc, t.Context(), "tmdb/movies/1/poster/original.r1.webp", "poster", size)
+	if want := "tmdb/movies/1/poster/original.r1.webp"; resolver.path != want {
+		t.Errorf("fallback poster = %q, want %q", resolver.path, want)
+	}
+	compatPresignImageWithExpiry(detailSvc, t.Context(), "tmdb/movies/1/backdrop/original.r1.webp", "backdrop", size)
+	if want := "tmdb/movies/1/backdrop/w1920.r1.webp"; resolver.path != want {
+		t.Errorf("backdrop = %q, want %q", resolver.path, want)
+	}
+}
diff --git a/internal/jellycompat/images.go b/internal/jellycompat/images.go
index 698686cc5d..99f2c0d690 100644
--- a/internal/jellycompat/images.go
+++ b/internal/jellycompat/images.go
@@ -171,7 +171,7 @@ func zeroUUIDBytes(values []byte) bool {
 
 func withCompatImageProxyRouteRequest(r *http.Request) *http.Request {
 	if r == nil {
-		return r
+		return nil
 	}
 	return r.WithContext(context.WithValue(r.Context(), compatImageProxyRouteContextKey{}, true))
 }
diff --git a/internal/jellycompat/images_test.go b/internal/jellycompat/images_test.go
index 0bfe0ad486..8d47385e95 100644
--- a/internal/jellycompat/images_test.go
+++ b/internal/jellycompat/images_test.go
@@ -8,13 +8,14 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"strings"
+	"sync/atomic"
 	"testing"
 	"time"
 
 	"github.com/go-chi/chi/v5"
 
 	"github.com/jackc/pgx/v5"
-
+	"github.com/prairie-server/prairie-server/internal/blobstore/blobstoretest"
 	"github.com/prairie-server/prairie-server/internal/catalog"
 	"github.com/prairie-server/prairie-server/internal/config"
 	"github.com/prairie-server/prairie-server/internal/models"
@@ -342,6 +343,67 @@ func TestHandleItemImageProxyRouteIDUsesCanonicalItemAndProxy(t *testing.T) {
 	}
 }
 
+// A proxied poster may reach the server's local network only when it is a
+// direct URL to the artwork store. A metadata provider's URL, kept as the
+// poster when caching it failed, reaches public addresses only.
+func TestHandleItemImageProxyKeepsProviderURLsOffTheLocalNetwork(t *testing.T) {
+	var hits atomic.Int32
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		hits.Add(1)
+		w.Header().Set("Content-Type", "image/webp")
+		_, _ = w.Write([]byte("local-image"))
+	}))
+	defer upstream.Close()
+
+	for _, tc := range []struct {
+		name      string
+		storeBase string
+		wantCode  int
+		wantHits  int32
+	}{
+		{name: "provider URL", storeBase: "http://storage.invalid", wantCode: http.StatusBadGateway, wantHits: 0},
+		{name: "artwork store URL", storeBase: upstream.URL, wantCode: http.StatusOK, wantHits: 1},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			hits.Store(0)
+			codec := NewResourceIDCodec()
+			contentID := "movie-1"
+			routeID := codec.EncodeStringID(EncodedIDItem, contentID)
+			updatedAt := time.Date(2026, 5, 26, 12, 0, 0, 0, time.UTC)
+			item := &models.MediaItem{ContentID: contentID, PosterPath: upstream.URL + "/poster.webp", UpdatedAt: updatedAt}
+			cfg := &config.Config{Auth: config.AuthConfig{JWTSecret: "image-secret"}}
+			tag := newMapper(codec, cfg).itemFromList(upstreamListItem{
+				ContentID:  contentID,
+				Type:       "movie",
+				Title:      "Movie",
+				PosterURL:  item.PosterPath,
+				PosterPath: item.PosterPath,
+				UpdatedAt:  item.UpdatedAt,
+			}, false, nil, nil).ImageTags["Primary"]
+			h := &ImagesHandler{
+				codec:        codec,
+				images:       NewImageCache(time.Hour, func() time.Time { return updatedAt }),
+				itemRepo:     fakeImageItemRepo{item: item},
+				imageTags:    newImageTagSigner(cfg.Auth.JWTSecret),
+				httpClient:   newCompatImageClient(),
+				artworkStore: blobstoretest.NewDirect(tc.storeBase),
+			}
+
+			req := httptest.NewRequest(http.MethodGet, "/Items/"+routeID+"/Images/Primary?tag="+compatImageProxyTag(tag), nil)
+			req = withImageRouteParams(req, routeID, "Primary")
+			rec := httptest.NewRecorder()
+			h.HandleItemImage(rec, req)
+
+			if rec.Code != tc.wantCode || hits.Load() != tc.wantHits {
+				t.Fatalf("status = %d, upstream hits = %d, body = %q; want %d and %d hits", rec.Code, hits.Load(), rec.Body.String(), tc.wantCode, tc.wantHits)
+			}
+			if tc.wantCode != http.StatusOK && strings.Contains(rec.Body.String(), "local-image") {
+				t.Fatalf("body leaked the local response: %q", rec.Body.String())
+			}
+		})
+	}
+}
+
 func TestHandleItemImageServesItemWithUnsignedTagWhenSecretBlank(t *testing.T) {
 	codec := NewResourceIDCodec()
 	contentID := "movie-1"
@@ -788,11 +850,12 @@ func TestHandleUserImageHeadRequest(t *testing.T) {
 	}
 }
 
-// TestHandlePersonImageClampsLargeRequestToProfileLadder verifies a large-ish
-// person-image request resolves a w500 headshot. Profiles ride the {500, 300}
-// ladder, so resolving them as posters would name a profile/w780 key that is
-// never generated, and the server-side ladder fallback skips profile.
-func TestHandlePersonImageClampsLargeRequestToProfileLadder(t *testing.T) {
+// TestHandlePersonImageSizesOnProfileLadder verifies person images size on the
+// {500, 300} profile ladder. A 900px request is wider than its 500px rung, so
+// it gets the original; sizing it as a poster would pick large, a w500
+// headshot, and a poster-ladder rung would name a profile key that is never
+// generated, which the server-side ladder fallback does not rescue.
+func TestHandlePersonImageSizesOnProfileLadder(t *testing.T) {
 	codec := NewResourceIDCodec()
 	routeID := codec.EncodeIntID(EncodedIDPerson, 287)
 	photoPath := "tmdb/people/287/profile/original.abc123.webp"
@@ -815,10 +878,10 @@ func TestHandlePersonImageClampsLargeRequestToProfileLadder(t *testing.T) {
 
 	h.handlePersonImage(rec, req, &Session{}, routeID, "Primary", "", 287)
 
-	if got := compatRequestImageSize(req, "Primary"); got != compatLargeImageSize {
-		t.Fatalf("compatRequestImageSize = %q, want %q", got, compatLargeImageSize)
+	if got := compatSizeFor(compatRequestImageSize(req, "Primary"), "profile"); got != compatOriginalImageSize {
+		t.Fatalf("headshot size = %q, want %q", got, compatOriginalImageSize)
 	}
-	want := "tmdb/people/287/profile/w500.abc123.webp"
+	want := photoPath
 	if resolver.path != want {
 		t.Fatalf("resolved path = %q, want %q", resolver.path, want)
 	}
diff --git a/internal/jellycompat/jellyfin12_db_test.go b/internal/jellycompat/jellyfin12_db_test.go
index 6cad84a682..4a2101cd31 100644
--- a/internal/jellycompat/jellyfin12_db_test.go
+++ b/internal/jellycompat/jellyfin12_db_test.go
@@ -178,3 +178,39 @@ func TestEpisodeTargetSeasonPosterDB(t *testing.T) {
 		t.Fatalf("season without poster should carry no season images: %+v", second.SeasonImages)
 	}
 }
+
+// TestEpisodeTargetSeriesLogoDB: the SQL episode loader carries the series logo
+// with the series poster and backdrop, so episodes get a ParentLogo.
+func TestEpisodeTargetSeriesLogoDB(t *testing.T) {
+	pool, suffix := jellyfin12CompatPool(t)
+	withLogo := fmt.Sprintf("jf12-logo-series-%d", suffix)
+	noLogo := fmt.Sprintf("jf12-nologo-series-%d", suffix)
+	ep1 := fmt.Sprintf("jf12-logo-ep1-%d", suffix)
+	ep2 := fmt.Sprintf("jf12-logo-ep2-%d", suffix)
+	t.Cleanup(func() {
+		ctx := context.Background()
+		_, _ = pool.Exec(ctx, `DELETE FROM episodes WHERE series_id = ANY($1)`, []string{withLogo, noLogo})
+		_, _ = pool.Exec(ctx, `DELETE FROM media_items WHERE content_id = ANY($1)`, []string{withLogo, noLogo})
+	})
+	jellyfin12Exec(t, pool, `INSERT INTO media_items (content_id, type, title, poster_path, genres, content_rating, backdrop_path, logo_path, status) VALUES ($1, 'series', 'Show', 'series/poster.jpg', '{}', '', 'series/backdrop.jpg', 'series/logo.png', 'matched'), ($2, 'series', 'Other', 'other/poster.jpg', '{}', '', '', '', 'matched')`, withLogo, noLogo)
+	jellyfin12Exec(t, pool, `INSERT INTO episodes (content_id, series_id, season_number, episode_number, title, overview, runtime, still_path, imdb_id, tmdb_id, tvdb_id) VALUES ($1, $2, 1, 1, 'Pilot', '', 0, '', '', '', ''), ($3, $4, 1, 1, 'Other Pilot', '', 0, '', '', '', '')`, ep1, withLogo, ep2, noLogo)
+
+	codec := NewResourceIDCodec()
+	h := &ItemsHandler{codec: codec, browseRepo: catalog.NewBrowseRepository(pool), mapper: newMapper(codec, &config.Config{Auth: config.AuthConfig{JWTSecret: "secret"}})}
+	targets, err := h.fetchCompatEpisodeTargetsByContentIDs(context.Background(), &Session{}, []string{ep1, ep2}, nil)
+	if err != nil {
+		t.Fatalf("fetch targets: %v", err)
+	}
+	if got := targets[ep1].SeriesImages; got.LogoPath != "series/logo.png" || got.LogoURL == "" {
+		t.Fatalf("series logo not loaded: path=%q url=%q", got.LogoPath, got.LogoURL)
+	}
+	if got := targets[ep2].SeriesImages; got.LogoPath != "" || got.LogoURL != "" {
+		t.Fatalf("series without a logo should carry none: path=%q url=%q", got.LogoPath, got.LogoURL)
+	}
+
+	dto := baseItemDTO{ID: codec.EncodeStringID(EncodedIDItem, ep1), SeriesID: codec.EncodeStringID(EncodedIDItem, withLogo)}
+	h.applyCompatEpisodeTarget(&dto, targets[ep1])
+	if dto.ParentLogoItemID != dto.SeriesID || dto.ParentLogoImageTag == "" {
+		t.Fatalf("episode ParentLogo = %q %q, want the series id and a tag", dto.ParentLogoItemID, dto.ParentLogoImageTag)
+	}
+}
diff --git a/internal/jellycompat/language_filters_test.go b/internal/jellycompat/language_filters_test.go
index 636997e788..d6347b1d00 100644
--- a/internal/jellycompat/language_filters_test.go
+++ b/internal/jellycompat/language_filters_test.go
@@ -91,15 +91,17 @@ func TestHandleFilters2LanguageFacets(t *testing.T) {
 // views or ran a catalog browse.
 type rootRoutingContent struct {
 	countingContentService
-	browsed bool
+	browsed      bool
+	browseParams url.Values
 }
 
 func (*rootRoutingContent) ListUserLibraries(context.Context, *Session) ([]upstreamUserLibrary, error) {
 	return []upstreamUserLibrary{{ID: 3, Name: "Movies", Type: "movies"}}, nil
 }
 
-func (s *rootRoutingContent) BrowseItems(context.Context, *Session, url.Values) (*upstreamBrowseResponse, error) {
+func (s *rootRoutingContent) BrowseItems(_ context.Context, _ *Session, params url.Values) (*upstreamBrowseResponse, error) {
 	s.browsed = true
+	s.browseParams = params
 	return &upstreamBrowseResponse{}, nil
 }
 
@@ -127,6 +129,19 @@ func TestHandleItemsRootFiltersSearchRecursively(t *testing.T) {
 		{"Ids=not-an-id", views},
 		{"GenreIds=not-an-id", empty},
 		{"PersonIds=not-an-id", empty},
+		// Other filters must not drop an Ids filter that names nothing (#2264).
+		{"Ids=not-an-id&IncludeItemTypes=Movie&Recursive=true", empty},
+		{"Ids=00000000-0000-0000-0000-000000000001&IncludeItemTypes=Movie&Recursive=true", empty},
+		{"Ids=not-an-id,also-not-an-id&Recursive=true", empty},
+		{"Ids=not-an-id&IncludeItemTypes=Movie", empty},
+		{"Ids=not-an-id&MediaTypes=Video", empty},
+		{"Ids=not-an-id&IsFavorite=true", empty},
+		{"Ids=not-an-id&SearchTerm=alpha", empty},
+		{"Ids=not-an-id&Genres=Drama", empty},
+		{"GenreIds=not-an-id&IncludeItemTypes=Movie&Recursive=true", empty},
+		// A library view ID is not unresolvable; it routes as it always has.
+		{"Ids=" + EncodeNumericID(EncodedIDLibrary, 3).String() + "&IncludeItemTypes=CollectionFolder", views},
+		{"Ids=not-an-id&Ids=" + EncodeNumericID(EncodedIDLibrary, 3).String() + "&IncludeItemTypes=CollectionFolder", views},
 	}
 	for _, tc := range cases {
 		t.Run(tc.query, func(t *testing.T) {
@@ -150,3 +165,19 @@ func TestHandleItemsRootFiltersSearchRecursively(t *testing.T) {
 		})
 	}
 }
+
+// An Ids list that names some real items keeps only those; the values that
+// resolve nothing neither widen nor empty the result.
+func TestHandleItemsPartlyResolvableIDsKeepResolvedOnes(t *testing.T) {
+	codec := NewResourceIDCodec()
+	content := &rootRoutingContent{}
+	h := &ItemsHandler{content: content, userData: &mockUserDataService{}, codec: codec, mapper: newMapper(codec, &config.Config{}), images: NewImageCache(time.Hour, time.Now)}
+	known := codec.EncodeStringID(EncodedIDItem, "movie-1")
+	performItemsRequest(t, h, "/Items?Ids=not-an-id,"+known+"&IncludeItemTypes=Movie&Recursive=true")
+	if !content.browsed {
+		t.Fatal("expected a catalog browse constrained to the resolved ID")
+	}
+	if got := content.browseParams.Get("content_ids"); got != "movie-1" {
+		t.Fatalf("content_ids = %q, want %q", got, "movie-1")
+	}
+}
diff --git a/internal/jellycompat/logging.go b/internal/jellycompat/logging.go
index bd0c48c472..80b3560771 100644
--- a/internal/jellycompat/logging.go
+++ b/internal/jellycompat/logging.go
@@ -15,6 +15,7 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
 
+	"github.com/prairie-server/prairie-server/internal/database/queryattr"
 	"github.com/prairie-server/prairie-server/internal/httpstream"
 	"github.com/prairie-server/prairie-server/internal/logredact"
 )
@@ -74,6 +75,10 @@ func (w *statusResponseWriter) Unwrap() http.ResponseWriter {
 
 func requestLoggerMiddleware(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		ctx, db := queryattr.StartRequest(r.Context())
+		if db != nil {
+			r = r.WithContext(ctx)
+		}
 		start := time.Now()
 		ww := &statusResponseWriter{ResponseWriter: w}
 
@@ -84,7 +89,8 @@ func requestLoggerMiddleware(next http.Handler) http.Handler {
 			routePattern = routeCtx.RoutePattern()
 		}
 
-		slog.InfoContext(r.Context(), "jellycompat request", "component", "jellycompat",
+		attrs := []any{
+			"component", "jellycompat",
 			"request_id", middleware.GetReqID(r.Context()),
 			"method", r.Method,
 			"path", r.URL.Path,
@@ -97,7 +103,9 @@ func requestLoggerMiddleware(next http.Handler) http.Handler {
 			"user_agent", r.UserAgent(),
 			"content_length", r.ContentLength,
 			"auth_kind", authKind(r),
-		)
+		}
+		attrs = append(attrs, db.LogAttrs()...)
+		slog.InfoContext(r.Context(), "jellycompat request", attrs...)
 	})
 }
 
diff --git a/internal/jellycompat/logging_attribution_test.go b/internal/jellycompat/logging_attribution_test.go
new file mode 100644
index 0000000000..4d01539c7f
--- /dev/null
+++ b/internal/jellycompat/logging_attribution_test.go
@@ -0,0 +1,40 @@
+package jellycompat
+
+import (
+	"bytes"
+	"encoding/json"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/database/queryattr"
+)
+
+func TestRequestLoggerLogsDatabaseFields(t *testing.T) {
+	t.Setenv("PRAIRIE_QUERY_ATTRIBUTION_ENABLED", "true")
+	if !queryattr.Initialize() {
+		t.Fatal("query attribution is disabled")
+	}
+	var logs bytes.Buffer
+	previous := slog.Default()
+	slog.SetDefault(slog.New(slog.NewJSONHandler(&logs, nil)))
+	t.Cleanup(func() { slog.SetDefault(previous) })
+	h := requestLoggerMiddleware(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		op := queryattr.Begin(r.Context(), queryattr.KindQuery, "SELECT 1", nil, 1)
+		op.End(r.Context(), nil)
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	h.ServeHTTP(httptest.NewRecorder(), httptest.NewRequest(http.MethodGet, "/Items", nil))
+	var record map[string]any
+	if err := json.Unmarshal(logs.Bytes(), &record); err != nil {
+		t.Fatal(err)
+	}
+	if record["msg"] != "jellycompat request" || record["db_queries"] != float64(1) {
+		t.Errorf("request msg=%v db_queries=%v, want jellycompat request and 1", record["msg"], record["db_queries"])
+	}
+	if site, ok := record["db_slowest_site"].(string); !ok || !strings.HasPrefix(site, "jellycompat.TestRequestLoggerLogsDatabaseFields.func2:") {
+		t.Errorf("db_slowest_site = %v, want wrapped handler site", record["db_slowest_site"])
+	}
+}
diff --git a/internal/jellycompat/mapping.go b/internal/jellycompat/mapping.go
index 1d34cf4c0b..10f80af2f3 100644
--- a/internal/jellycompat/mapping.go
+++ b/internal/jellycompat/mapping.go
@@ -154,8 +154,8 @@ func (m *mapper) itemFromList(item upstreamListItem, isFavorite bool, progress *
 		dto.BackdropImageTags = tags
 	}
 	// Advertise the logo as Jellyfin does, so clients that check ImageTags
-	// know it exists. Episodes carry no logo of their own; theirs belongs to
-	// the series.
+	// know it exists. Episodes carry no logo of their own; applySeriesImages
+	// points their ParentLogoItemId at the series instead.
 	if item.LogoURL != "" && item.Type != "episode" {
 		dto.ImageTags["Logo"] = m.imageTagSigner.Tag(
 			imageTagSeed(item.ContentID, "Logo", compatCardImageSize, item.LogoPath, "", item.UpdatedAt),
@@ -475,11 +475,15 @@ type seriesImageSet struct {
 	BackdropURL       string
 	BackdropPath      string
 	BackdropThumbhash string
+	LogoURL           string
+	LogoPath          string
 	UpdatedAt         time.Time
 }
 
 // applySeriesImages sets series/parent image tags on an episode DTO so clients
-// can display the series poster and backdrop in Continue Watching / Next Up.
+// can display the series poster, backdrop and logo in Continue Watching / Next
+// Up and the player. Jellyfin points an episode's ParentLogoItemId at its
+// series; clients read the show logo from there, never from the episode.
 func (m *mapper) applySeriesImages(dto *baseItemDTO, series seriesImageSet) {
 	if dto.SeriesID == "" {
 		return
@@ -504,6 +508,15 @@ func (m *mapper) applySeriesImages(dto *baseItemDTO, series seriesImageSet) {
 		dto.ParentThumbImageTag = tag
 		dto.ParentThumbItemID = dto.SeriesID
 	}
+	if series.LogoURL != "" {
+		// Seeded as the series' own ImageTags["Logo"] is, so both name one
+		// cached image.
+		dto.ParentLogoItemID = dto.SeriesID
+		dto.ParentLogoImageTag = m.imageTagSigner.Tag(
+			imageTagSeed(series.ContentID, "Logo", compatCardImageSize, series.LogoPath, "", series.UpdatedAt),
+			series.LogoURL,
+		)
+	}
 }
 
 // applySeasonPrimaryImage points an episode's parent poster at its season,
diff --git a/internal/jellycompat/mapping_images_test.go b/internal/jellycompat/mapping_images_test.go
index 06593db1d5..9c6451ebf7 100644
--- a/internal/jellycompat/mapping_images_test.go
+++ b/internal/jellycompat/mapping_images_test.go
@@ -1,9 +1,11 @@
 package jellycompat
 
 import (
+	"context"
 	"testing"
 	"time"
 
+	"github.com/prairie-server/prairie-server/internal/catalog"
 	"github.com/prairie-server/prairie-server/internal/config"
 )
 
@@ -191,3 +193,211 @@ func TestApplySeriesImagesUsesCanonicalSeriesSeeds(t *testing.T) {
 		t.Fatalf("ParentThumbImageTag = %q, want %q", dto.ParentThumbImageTag, expectedBackdrop)
 	}
 }
+
+// An episode's show logo is found through ParentLogoItemId, as Jellyfin
+// sets it; clients never look for a logo on the episode itself.
+func TestApplySeriesImagesSetsParentLogo(t *testing.T) {
+	codec := NewResourceIDCodec()
+	secret := "logo-secret"
+	updatedAt := time.Date(2026, 10, 1, 12, 0, 0, 0, time.UTC)
+	seriesRouteID := codec.EncodeStringID(EncodedIDItem, "series:tvdb:75805")
+	dto := baseItemDTO{SeriesID: seriesRouteID}
+	series := seriesImageSet{
+		ContentID: "series:tvdb:75805",
+		LogoURL:   "/api/v2/artwork/tvdb/series/75805/logo/w500.abc.webp?exp=1&sig=x",
+		LogoPath:  "tvdb/series/75805/logo.png",
+		UpdatedAt: updatedAt,
+	}
+
+	newMapper(codec, &config.Config{
+		Auth: config.AuthConfig{JWTSecret: secret},
+	}).applySeriesImages(&dto, series)
+
+	want := newImageTagSigner(secret).Tag(
+		imageTagSeed(series.ContentID, "Logo", compatCardImageSize, series.LogoPath, "", updatedAt),
+		series.LogoURL,
+	)
+	if dto.ParentLogoItemID != seriesRouteID {
+		t.Fatalf("ParentLogoItemID = %q, want the series id %q", dto.ParentLogoItemID, seriesRouteID)
+	}
+	if dto.ParentLogoImageTag == "" || dto.ParentLogoImageTag != want {
+		t.Fatalf("ParentLogoImageTag = %q, want %q", dto.ParentLogoImageTag, want)
+	}
+
+	// The tag names the same image as the series' own ImageTags["Logo"].
+	seriesDTO := newMapper(codec, &config.Config{Auth: config.AuthConfig{JWTSecret: secret}}).itemFromList(upstreamListItem{
+		ContentID: series.ContentID, Type: "series", Title: "Show",
+		LogoURL: series.LogoURL, LogoPath: series.LogoPath, UpdatedAt: updatedAt,
+	}, false, nil, nil)
+	if seriesDTO.ImageTags["Logo"] != dto.ParentLogoImageTag {
+		t.Fatalf("series Logo tag %q differs from the episode's ParentLogoImageTag %q", seriesDTO.ImageTags["Logo"], dto.ParentLogoImageTag)
+	}
+
+	// A series without a logo leaves the episode without one.
+	bare := baseItemDTO{SeriesID: seriesRouteID}
+	newMapper(codec, &config.Config{Auth: config.AuthConfig{JWTSecret: secret}}).applySeriesImages(&bare, seriesImageSet{ContentID: series.ContentID})
+	if bare.ParentLogoItemID != "" || bare.ParentLogoImageTag != "" {
+		t.Fatalf("ParentLogo set without a series logo: %q %q", bare.ParentLogoItemID, bare.ParentLogoImageTag)
+	}
+}
+
+// List paths (Resume, Next Up, episode lists, collections) give episodes their
+// series artwork through applyCompatEpisodeTarget; the logo comes with it and
+// is remembered for the series image route.
+func TestApplyCompatEpisodeTargetCarriesSeriesLogo(t *testing.T) {
+	codec := NewResourceIDCodec()
+	images := NewImageCache(time.Hour, time.Now)
+	h := &ItemsHandler{codec: codec, mapper: newMapper(codec, &config.Config{}), images: images}
+	seriesRouteID := codec.EncodeStringID(EncodedIDItem, "series-1")
+	dto := baseItemDTO{ID: codec.EncodeStringID(EncodedIDItem, "ep-1"), SeriesID: seriesRouteID}
+	target := compatEpisodeTarget{SeriesImages: seriesImageSet{
+		ContentID: "series-1",
+		LogoURL:   "https://cdn.example.test/series-1-logo.png?sig=one",
+		LogoPath:  "metadb://logo/series-1",
+	}}
+
+	h.applyCompatEpisodeTarget(&dto, target)
+
+	if dto.ParentLogoItemID != seriesRouteID || dto.ParentLogoImageTag == "" {
+		t.Fatalf("ParentLogo = %q %q, want the series id and a tag", dto.ParentLogoItemID, dto.ParentLogoImageTag)
+	}
+	if got, ok := images.LookupSized(seriesRouteID, "Logo", "", compatCardImageSize); !ok || got != target.SeriesImages.LogoURL {
+		t.Fatalf("remembered series logo = %q, %v; want %q", got, ok, target.SeriesImages.LogoURL)
+	}
+}
+
+// ParentLogo follows the request's image controls like the other logo tags.
+func TestItemsResponseOptionsStripParentLogo(t *testing.T) {
+	withLogo := func() []baseItemDTO {
+		return []baseItemDTO{{ParentLogoItemID: "series-1", ParentLogoImageTag: "logo-tag"}}
+	}
+	zero := 0
+	cases := []struct {
+		name  string
+		query itemsQuery
+		keep  bool
+	}{
+		{"no controls", itemsQuery{}, true},
+		{"logo requested", itemsQuery{enableImageTypes: map[string]bool{"primary": true, "logo": true}}, true},
+		{"logo not requested", itemsQuery{enableImageTypes: map[string]bool{"primary": true, "backdrop": true}}, false},
+		{"images disabled", itemsQuery{disableImages: true}, false},
+		{"image type limit zero", itemsQuery{imageTypeLimit: &zero}, false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			items := withLogo()
+			applyItemsResponseOptions(items, tc.query)
+			kept := items[0].ParentLogoItemID != "" && items[0].ParentLogoImageTag != ""
+			cleared := items[0].ParentLogoItemID == "" && items[0].ParentLogoImageTag == ""
+			if tc.keep && !kept || !tc.keep && !cleared {
+				t.Fatalf("ParentLogo = %q %q, keep=%v", items[0].ParentLogoItemID, items[0].ParentLogoImageTag, tc.keep)
+			}
+		})
+	}
+}
+
+// Episode detail builds the series image set from the series' catalog detail.
+// Its ParentLogoImageTag must match the one lists give the same episode, and
+// must not change when the logo's presigned URL is signed again.
+func TestEpisodeDetailParentLogoMatchesListsAcrossPresigns(t *testing.T) {
+	codec := NewResourceIDCodec()
+	m := newMapper(codec, &config.Config{Auth: config.AuthConfig{JWTSecret: "logo-secret"}})
+	updatedAt := time.Date(2026, 10, 1, 12, 0, 0, 0, time.UTC)
+	seriesRouteID := codec.EncodeStringID(EncodedIDItem, "series-1")
+	const logoPath = "local/series/series-1/aa/logo/original.r1.webp"
+
+	detailTag := func(presignedURL string) string {
+		// The production content service hands enrichEpisodeSeriesImages a
+		// catalog detail converted by itemDetailToUpstream.
+		series := itemDetailToUpstream(&catalog.ItemDetail{
+			ContentID: "series-1", Type: "series", Title: "Show",
+			LogoURL: presignedURL, LogoPath: logoPath, UpdatedAt: updatedAt,
+		})
+		h := &ItemsHandler{content: &countingContentService{seriesDetail: &series}, codec: codec, mapper: m, images: NewImageCache(time.Hour, time.Now)}
+		dto := baseItemDTO{SeriesID: seriesRouteID}
+		h.enrichEpisodeSeriesImages(context.Background(), &Session{}, &dto, "series-1", map[string]seriesImageSet{})
+		return dto.ParentLogoImageTag
+	}
+	first := detailTag("https://cdn.example.test/logo.webp?exp=1&sig=a")
+	resigned := detailTag("https://cdn.example.test/logo.webp?exp=2&sig=b")
+	if first == "" || first != resigned {
+		t.Fatalf("detail ParentLogoImageTag changed with the presigned URL: %q then %q", first, resigned)
+	}
+
+	listDTO := baseItemDTO{SeriesID: seriesRouteID}
+	m.applySeriesImages(&listDTO, seriesImageSet{
+		ContentID: "series-1", LogoURL: "https://cdn.example.test/logo.webp?exp=3&sig=c", LogoPath: logoPath, UpdatedAt: updatedAt,
+	})
+	if listDTO.ParentLogoImageTag != first {
+		t.Fatalf("detail tag %q differs from the list tag %q for the same series logo", first, listDTO.ParentLogoImageTag)
+	}
+}
+
+// Movie and series detail tags are seeded from the stored artwork, as list
+// tags are. The update time alone must not decide them: a localization swaps
+// in another language's poster and backdrop without touching the item row,
+// and each language's artwork needs its own tag.
+func TestDetailImageTagsFollowLocalizedArtwork(t *testing.T) {
+	codec := NewResourceIDCodec()
+	m := newMapper(codec, &config.Config{Auth: config.AuthConfig{JWTSecret: "image-secret"}})
+	updatedAt := time.Date(2026, 10, 1, 12, 0, 0, 0, time.UTC)
+	detail := func(lang, url string) baseItemDTO {
+		return m.itemFromDetail(itemDetailToUpstream(&catalog.ItemDetail{
+			ContentID: "movie-1", Type: "movie", Title: "Movie", UpdatedAt: updatedAt,
+			PosterURL: "https://cdn.example.test/" + lang + "/poster.webp?" + url, PosterPath: "tmdb/" + lang + "/poster.jpg", PosterThumbhash: lang + "-poster",
+			BackdropURL: "https://cdn.example.test/" + lang + "/backdrop.webp?" + url, BackdropPath: "tmdb/" + lang + "/backdrop.jpg", BackdropThumbhash: lang + "-backdrop",
+		}), false, nil)
+	}
+	backdrop := func(dto baseItemDTO) string {
+		if len(dto.BackdropImageTags) == 0 {
+			return ""
+		}
+		return dto.BackdropImageTags[0]
+	}
+
+	english, french := detail("en", "sig=a"), detail("fr", "sig=a")
+	if english.ImageTags["Primary"] == "" || english.ImageTags["Primary"] == french.ImageTags["Primary"] {
+		t.Fatalf("English and French posters share Primary tag %q", english.ImageTags["Primary"])
+	}
+	if backdrop(english) == "" || backdrop(english) == backdrop(french) {
+		t.Fatalf("English and French backdrops share tag %q", backdrop(english))
+	}
+
+	// The same artwork keeps its tag when its URL is signed again.
+	if resigned := detail("en", "sig=b"); resigned.ImageTags["Primary"] != english.ImageTags["Primary"] || backdrop(resigned) != backdrop(english) {
+		t.Fatalf("detail tags changed with the presigned URL: primary %q -> %q", english.ImageTags["Primary"], resigned.ImageTags["Primary"])
+	}
+
+	// And it gets the tag a list row gives it.
+	list := m.itemFromList(upstreamListItem{
+		ContentID: "movie-1", Type: "movie", Title: "Movie", UpdatedAt: updatedAt,
+		PosterURL: "https://cdn.example.test/en/poster.webp?sig=c", PosterPath: "tmdb/en/poster.jpg", PosterThumbhash: "en-poster",
+		BackdropURL: "https://cdn.example.test/en/backdrop.webp?sig=c", BackdropPath: "tmdb/en/backdrop.jpg", BackdropThumbhash: "en-backdrop",
+	}, false, nil, nil)
+	if list.ImageTags["Primary"] != english.ImageTags["Primary"] || backdrop(list) != backdrop(english) {
+		t.Fatalf("detail tags (%q, %q) differ from list tags (%q, %q) for the same artwork",
+			english.ImageTags["Primary"], backdrop(english), list.ImageTags["Primary"], backdrop(list))
+	}
+}
+
+// Episode detail carries no stored still path, so a thumbhash alone must not
+// seed its tags: a replaced still with the same thumbhash would keep the old
+// tag. Its tags follow the presigned URL, as before.
+func TestEpisodeDetailTagsFollowURLWithoutStoredPath(t *testing.T) {
+	m := newMapper(NewResourceIDCodec(), &config.Config{Auth: config.AuthConfig{JWTSecret: "image-secret"}})
+	episode := func(still, backdrop string) baseItemDTO {
+		return m.itemFromDetail(itemDetailToUpstream(&catalog.ItemDetail{
+			ContentID: "ep-1", Type: "episode", Title: "Pilot",
+			PosterURL: still, PosterThumbhash: "same-still-th",
+			BackdropURL: backdrop, BackdropThumbhash: "same-backdrop-th",
+		}), false, nil)
+	}
+	before := episode("https://cdn.example.test/still-old.webp", "https://cdn.example.test/backdrop-old.webp")
+	after := episode("https://cdn.example.test/still-new.webp", "https://cdn.example.test/backdrop-new.webp")
+	if before.ImageTags["Primary"] == "" || before.ImageTags["Primary"] == after.ImageTags["Primary"] {
+		t.Fatalf("replaced still kept Primary tag %q", before.ImageTags["Primary"])
+	}
+	if len(before.BackdropImageTags) == 0 || len(after.BackdropImageTags) == 0 || before.BackdropImageTags[0] == after.BackdropImageTags[0] {
+		t.Fatalf("replaced backdrop kept its tag: %v -> %v", before.BackdropImageTags, after.BackdropImageTags)
+	}
+}
diff --git a/internal/jellycompat/moonfin_profile_test.go b/internal/jellycompat/moonfin_profile_test.go
new file mode 100644
index 0000000000..c8eb40a9b7
--- /dev/null
+++ b/internal/jellycompat/moonfin_profile_test.go
@@ -0,0 +1,68 @@
+package jellycompat
+
+import (
+	"encoding/json"
+	"os"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/models"
+)
+
+// moonfinIOSProfile is the DeviceProfile Moonfin for iOS 2.5.1 sends with
+// PlaybackInfo, as Prairie stored it. Every H.264 rule in it is IsRequired.
+func moonfinIOSProfile(t *testing.T) DeviceProfile {
+	t.Helper()
+	data, err := os.ReadFile("testdata/moonfin_ios_device_profile.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var profile DeviceProfile
+	if err := json.Unmarshal(data, &profile); err != nil {
+		t.Fatal(err)
+	}
+	return profile
+}
+
+// A 1080p H.264 file as FFmpeg 8.1 probes it: profile and level known,
+// reference frames unknown (ffprobe reports refs only when it reads frames).
+func moonfinH264Version() catalog.FileVersion {
+	return catalog.FileVersion{
+		FileID: 90516, Container: "mkv", CodecVideo: "h264", CodecAudio: "ac3", Resolution: "1080p", Bitrate: 12000,
+		VideoTracks: []models.VideoTrack{{Codec: "h264", Profile: "High", Level: 41, Width: 1920, Height: 804, BitDepth: 8}},
+		AudioTracks: []models.AudioTrack{{Codec: "ac3", Channels: 6, Default: true}},
+	}
+}
+
+// Moonfin's H.264 rules (a known VideoProfile; RefFrames <= 4 from 1900
+// pixels wide) used to refuse every H.264 encode, and with the source's
+// reference frames unreported, a 1080p H.264 file had no route at all:
+// PlaybackInfo answered 400 PlaybackUnavailable for every such title.
+func TestMoonfinIOSProfileCanTranscodeH264(t *testing.T) {
+	h := &PlaybackHandler{codec: NewResourceIDCodec()}
+	req := playbackInfoRequest{AudioStreamIndex: compatIntValuePtr(1), MaxStreamingBitrate: 120_000_000}
+	source := h.buildPlaybackSource("item", "play", moonfinH264Version(), moonfinIOSProfile(t), req, true)
+	if !source.SupportsTranscoding {
+		t.Errorf("SupportsTranscoding = false: the encode target can satisfy profile, level and reference-frame rules")
+	}
+}
+
+// FFmpeg 8.1 never reports reference frames, so Moonfin's required
+// RefFrames <= 4 rule evaluates against the 1 that FFmpeg 7 reported, and a
+// 1080p H.264 file Moonfin direct plays on Jellyfin direct plays here too.
+func TestMoonfinIOSProfileDirectPlaysH264WithUnreportedRefFrames(t *testing.T) {
+	h := &PlaybackHandler{codec: NewResourceIDCodec()}
+	req := playbackInfoRequest{AudioStreamIndex: compatIntValuePtr(1), MaxStreamingBitrate: 120_000_000}
+	source := h.buildPlaybackSource("item", "play", moonfinH264Version(), moonfinIOSProfile(t), req, true)
+	if !source.SupportsDirectPlay {
+		t.Errorf("SupportsDirectPlay = false for a file Moonfin direct plays on Jellyfin")
+	}
+
+	// A count the probe did report is still enforced.
+	version := moonfinH264Version()
+	version.VideoTracks[0].ReferenceFrames = 8
+	source = h.buildPlaybackSource("item", "play", version, moonfinIOSProfile(t), req, true)
+	if source.SupportsDirectPlay || !source.SupportsTranscoding {
+		t.Errorf("eight known reference frames: direct=%v transcoding=%v, want an encode", source.SupportsDirectPlay, source.SupportsTranscoding)
+	}
+}
diff --git a/internal/jellycompat/parent_unplayed_test.go b/internal/jellycompat/parent_unplayed_test.go
new file mode 100644
index 0000000000..e6295b0a27
--- /dev/null
+++ b/internal/jellycompat/parent_unplayed_test.go
@@ -0,0 +1,88 @@
+package jellycompat
+
+import (
+	"context"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/prairie-server/prairie-server/internal/config"
+	"github.com/prairie-server/prairie-server/internal/notifications"
+	"github.com/prairie-server/prairie-server/internal/watchstate"
+)
+
+// seasonContentService lists the season's episodes that have a library file,
+// as the catalog does.
+type seasonContentService struct {
+	stubContentService
+	onDisk []string
+}
+
+func (s *seasonContentService) ListEpisodesBySeasonID(context.Context, *Session, string, *int) ([]upstreamEpisode, error) {
+	episodes := make([]upstreamEpisode, 0, len(s.onDisk))
+	for _, id := range s.onDisk {
+		episodes = append(episodes, upstreamEpisode{ContentID: id})
+	}
+	return episodes, nil
+}
+
+type stubEpisodePartitioner struct {
+	withFile, fileless []string
+}
+
+func (p stubEpisodePartitioner) PartitionIDsBySeries(context.Context, string) ([]string, []string, error) {
+	return p.withFile, p.fileless, nil
+}
+
+func (p stubEpisodePartitioner) PartitionIDsBySeason(context.Context, string) ([]string, []string, error) {
+	return p.withFile, p.fileless, nil
+}
+
+// A Jellyfin client marking a season unplayed must also clear a watched
+// episode whose file was deleted; the episode listing leaves it out, and its
+// completed progress would keep the series in Next Up.
+func TestParentUnplayedClearsWatchedEpisodesWithoutFile(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		run  func(*UserDataHandler, *httptest.ResponseRecorder, string, *Session)
+	}{
+		{"mark unplayed", func(h *UserDataHandler, rec *httptest.ResponseRecorder, id string, session *Session) {
+			h.HandleMarkUnplayed(rec, viewerRequest("DELETE", "/", "", "itemId", id, session))
+		}},
+		{"update user data", func(h *UserDataHandler, rec *httptest.ResponseRecorder, id string, session *Session) {
+			h.HandleUpdateUserData(rec, viewerRequest("POST", "/", `{"Played":false}`, "itemId", id, session))
+		}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			store := newJellycompatUserStore(t)
+			provider := notifications.WrapUserStoreProvider(compatTestUserStoreProvider{store: store}, &notifications.System{})
+			service := &directUserDataService{
+				storeProvider: provider,
+				watchState:    watchstate.NewService(provider),
+				episodes:      stubEpisodePartitioner{withFile: []string{"on-disk"}, fileless: []string{"deleted", "metadata-only"}},
+			}
+			if err := service.watchState.RecordJellycompatMarkPlayedBatch(t.Context(), 1, "profile-1", []string{"on-disk", "deleted"}, time.Now().UTC().Add(-time.Hour)); err != nil {
+				t.Fatal(err)
+			}
+			codec := NewResourceIDCodec()
+			content := &seasonContentService{stubContentService: stubContentService{detail: &upstreamItemDetail{ContentID: "season-1", Type: "season"}}, onDisk: []string{"on-disk"}}
+			h := NewUserDataHandler(content, service, codec, &config.Config{})
+			session := &Session{StreamAppUserID: 1, ProfileID: "profile-1"}
+
+			rec := httptest.NewRecorder()
+			tc.run(h, rec, codec.EncodeStringID(EncodedIDSeason, "season-1"), session)
+			if rec.Code != 200 {
+				t.Fatalf("status %d: %s", rec.Code, rec.Body.String())
+			}
+			for _, id := range []string{"on-disk", "deleted"} {
+				progress, err := store.GetProgress(t.Context(), "profile-1", id)
+				if err != nil {
+					t.Fatal(err)
+				}
+				if progress != nil {
+					t.Fatalf("%s progress after unplayed = %+v, want cleared", id, progress)
+				}
+			}
+		})
+	}
+}
diff --git a/internal/jellycompat/person_image_tags_test.go b/internal/jellycompat/person_image_tags_test.go
index 542e83677e..13649875d0 100644
--- a/internal/jellycompat/person_image_tags_test.go
+++ b/internal/jellycompat/person_image_tags_test.go
@@ -95,11 +95,12 @@ func TestJellyfinWebPersonPhotoUsesSignedTag(t *testing.T) {
 		return rec
 	}
 
-	assertImageRedirect(t, request(routeID, castTag, ""), "https://cdn.example.test/tmdb/people/287/profile/w200.abc123.webp")
-	assertImageRedirect(t, request(otherRouteID, crewTag, ""), "https://cdn.example.test/tmdb/people/288/profile/w200.def456.webp")
+	assertImageRedirect(t, request(routeID, castTag, ""), "https://cdn.example.test/tmdb/people/287/profile/w300.abc123.webp")
+	assertImageRedirect(t, request(otherRouteID, crewTag, ""), "https://cdn.example.test/tmdb/people/288/profile/w300.def456.webp")
 	// A tag authorizes by itself, matching the item and collection image routes.
-	assertImageRedirect(t, request(routeID, castTag, "hidden"), "https://cdn.example.test/tmdb/people/287/profile/w200.abc123.webp")
-	if _, ok := h.images.LookupSized(personImageCacheRouteID(routeID, people[287].PhotoPath), "Primary", "", compatCardImageSize); !ok {
+	assertImageRedirect(t, request(routeID, castTag, "hidden"), "https://cdn.example.test/tmdb/people/287/profile/w300.abc123.webp")
+	warmed := compatRequestImageSize(httptest.NewRequest(http.MethodGet, "/?fillHeight=446&fillWidth=298", nil), "Primary")
+	if _, ok := h.images.LookupSized(personImageCacheRouteID(routeID, people[287].PhotoPath), "Primary", "", warmed); !ok {
 		t.Fatal("signed request did not warm the shared cache")
 	}
 
@@ -128,8 +129,8 @@ func TestJellyfinWebPersonPhotoUsesSignedTag(t *testing.T) {
 	}
 	// The new photo's tag must not be served the old photo from the warm cache.
 	newTag := persons.personToDTO(*people[287]).ImageTags["Primary"]
-	assertImageRedirect(t, request(routeID, newTag, ""), "https://cdn.example.test/tmdb/people/287/profile/w200.new789.webp")
-	assertImageRedirect(t, request(routeID, "", "visible"), "https://cdn.example.test/tmdb/people/287/profile/w200.new789.webp")
+	assertImageRedirect(t, request(routeID, newTag, ""), "https://cdn.example.test/tmdb/people/287/profile/w300.new789.webp")
+	assertImageRedirect(t, request(routeID, "", "visible"), "https://cdn.example.test/tmdb/people/287/profile/w300.new789.webp")
 
 	// Without a thumbhash the photo path alone must still rotate the tag.
 	people[288] = &models.Person{ID: 288, PhotoPath: "tmdb/people/288/profile/original.def456.webp", PhotoThumbhash: "-"}
diff --git a/internal/jellycompat/playback_client_name_test.go b/internal/jellycompat/playback_client_name_test.go
new file mode 100644
index 0000000000..907c9ea1dc
--- /dev/null
+++ b/internal/jellycompat/playback_client_name_test.go
@@ -0,0 +1,192 @@
+package jellycompat
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+	"unicode/utf8"
+
+	"github.com/go-chi/chi/v5"
+
+	"github.com/prairie-server/prairie-server/internal/playback"
+)
+
+// clientInfoRecordingManager records the client metadata a native session
+// would be started with.
+type clientInfoRecordingManager struct {
+	*testCompatSessionManager
+	started playback.ClientInfo
+}
+
+func (m *clientInfoRecordingManager) StartSessionWithContext(ctx context.Context, userID int, profileID string, fileID int, method playback.PlayMethod, transcodeAudio bool) (*playback.Session, error) {
+	m.started = playback.ClientInfoFromContext(ctx)
+	return m.StartSession(userID, profileID, fileID, method, transcodeAudio)
+}
+
+func TestHandlePlaybackInfoRecordsClientNameAndVersion(t *testing.T) {
+	handler, routeID := newSubtitleSelectionHandler(t)
+	result := postPlaybackInfoForDevice(t, handler, routeID, "web-device")
+
+	stored, ok := handler.playbackStore.Get(result.PlaySessionID)
+	if !ok {
+		t.Fatal("negotiated play session was not stored")
+	}
+	if stored.ClientName != "Jellyfin Web" || stored.ClientVersion != "10.11.6" {
+		t.Fatalf("client = %q %q, want Jellyfin Web 10.11.6", stored.ClientName, stored.ClientVersion)
+	}
+}
+
+// TestHandlePlaybackInfoCleansRecordedClient checks that the recorded name and
+// version are cleaned and clamped like any other client identity.
+func TestHandlePlaybackInfoCleansRecordedClient(t *testing.T) {
+	handler, routeID := newSubtitleSelectionHandler(t)
+	req := httptest.NewRequest(http.MethodPost, "/Items/"+routeID+"/PlaybackInfo", strings.NewReader(`{}`))
+	req.Header.Set("X-Emby-Authorization",
+		"MediaBrowser Client=\"Jellyfin\tWeb"+strings.Repeat("x", 300)+`", Device="Chrome", DeviceId="clean-device", Version=" 10.11.6 "`)
+	routeCtx := chi.NewRouteContext()
+	routeCtx.URLParams.Add("id", routeID)
+	req = req.WithContext(context.WithValue(req.Context(), chi.RouteCtxKey, routeCtx))
+	req = req.WithContext(context.WithValue(req.Context(), compatSessionKey, &Session{Token: "token-1"}))
+	recorder := httptest.NewRecorder()
+	handler.HandlePlaybackInfo(recorder, req)
+	if recorder.Code != http.StatusOK {
+		t.Fatalf("status = %d, body = %s", recorder.Code, recorder.Body.String())
+	}
+	var response playbackInfoResponseDTO
+	if err := json.Unmarshal(recorder.Body.Bytes(), &response); err != nil {
+		t.Fatalf("unmarshal response: %v", err)
+	}
+	stored, ok := handler.playbackStore.Get(response.PlaySessionID)
+	if !ok {
+		t.Fatal("negotiated play session was not stored")
+	}
+	if n := utf8.RuneCountInString(stored.ClientName); n != 128 || strings.ContainsRune(stored.ClientName, '\t') {
+		t.Fatalf("client name = %q (%d runes), want 128 runes without control characters", stored.ClientName, n)
+	}
+	if stored.ClientVersion != "10.11.6" {
+		t.Fatalf("client version = %q, want 10.11.6", stored.ClientVersion)
+	}
+}
+
+func TestEnsureUpstreamPlaybackNamesClientFromPlaybackInfo(t *testing.T) {
+	const webOSAgent = "Mozilla/5.0 (Web0S; Linux/SmartTV) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.79 Safari/537.36 WebAppManager"
+	tests := []struct {
+		name        string
+		request     playback.ClientInfo
+		wantName    string
+		wantVersion string
+	}{
+		{
+			name:        "stream request without a MediaBrowser header",
+			request:     playback.ClientInfo{UserAgent: webOSAgent, IsCompat: true},
+			wantName:    "Jellyfin Web",
+			wantVersion: "10.11.6",
+		},
+		{
+			name:        "stream request with its own MediaBrowser header",
+			request:     playback.ClientInfo{Name: "Findroid", Version: "0.15.0", IsCompat: true},
+			wantName:    "Findroid",
+			wantVersion: "0.15.0",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			handler, fake, _, _ := newReportLivenessHandler("", false)
+			mgr := &clientInfoRecordingManager{testCompatSessionManager: fake}
+			handler.sessionMgr = mgr
+			if err := handler.playbackStore.Update("play-1", func(current *PlaybackSession) error {
+				current.ClientName, current.ClientVersion = "Jellyfin Web", "10.11.6"
+				return nil
+			}); err != nil {
+				t.Fatalf("record negotiated client: %v", err)
+			}
+			playSession, _ := handler.playbackStore.Get("play-1")
+
+			ctx := playback.WithClientInfo(context.Background(), tt.request)
+			if _, err := handler.ensureUpstreamPlayback(ctx,
+				&Session{Token: "token-1", StreamAppUserID: 1, ProfileID: "profile-1"},
+				"play-1", playSession.MediaSources[0], "direct"); err != nil {
+				t.Fatalf("ensureUpstreamPlayback: %v", err)
+			}
+			if fake.startCalls != 1 {
+				t.Fatalf("StartSession calls = %d, want 1", fake.startCalls)
+			}
+			got := mgr.started
+			if got.Name != tt.wantName || got.Version != tt.wantVersion {
+				t.Fatalf("native session client = %q %q, want %q %q", got.Name, got.Version, tt.wantName, tt.wantVersion)
+			}
+			if got.UserAgent != tt.request.UserAgent || !got.IsCompat {
+				t.Fatalf("native session lost the request's user agent or compat flag: %+v", got)
+			}
+		})
+	}
+}
+
+// TestStaticStreamNamesClientFromPlaybackInfo follows one play from
+// PlaybackInfo to the stream request that starts its native session: the
+// stream request sends no MediaBrowser header, so the session takes the name
+// PlaybackInfo recorded.
+func TestStaticStreamNamesClientFromPlaybackInfo(t *testing.T) {
+	handler, routeID, _ := newStaticDirectPlayHandler(t)
+	handler.deviceProfiles = NewDeviceProfileStore(time.Hour, nil)
+	mgr := &clientInfoRecordingManager{testCompatSessionManager: handler.sessionMgr.(*testCompatSessionManager)}
+	handler.sessionMgr = mgr
+	result := postPlaybackInfoForDevice(t, handler, routeID, "web-device")
+	if len(result.MediaSources) == 0 {
+		t.Fatal("PlaybackInfo returned no media sources")
+	}
+
+	rec := serveStaticStream(handler, routeID,
+		"Static=true&MediaSourceId="+result.MediaSources[0].ID+"&PlaySessionId="+result.PlaySessionID)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("stream status = %d, body = %s", rec.Code, rec.Body.String())
+	}
+	if mgr.startCalls != 1 {
+		t.Fatalf("StartSession calls = %d, want 1", mgr.startCalls)
+	}
+	if got := mgr.started; got.Name != "Jellyfin Web" || got.Version != "10.11.6" {
+		t.Fatalf("native session client = %q %q, want Jellyfin Web 10.11.6", got.Name, got.Version)
+	}
+}
+
+func TestFillReconstructedClientInfo(t *testing.T) {
+	const agent = "Mozilla/5.0 (Web0S; Linux/SmartTV) Chrome/79.0"
+	request := playback.ClientInfo{Name: "Jellyfin Web", Version: "10.11.6", UserAgent: "request-agent", IsCompat: true}
+	tests := []struct {
+		name string
+		card playback.RecipeCard
+		want playback.RecipeCard
+	}{
+		{
+			name: "card with no client metadata",
+			card: playback.RecipeCard{},
+			want: playback.RecipeCard{ClientName: "Jellyfin Web", ClientVersion: "10.11.6", ClientUserAgent: "request-agent", IsJellyfinCompat: true},
+		},
+		{
+			name: "card named from the User-Agent alone",
+			card: playback.RecipeCard{ClientUserAgent: agent},
+			want: playback.RecipeCard{ClientName: "Jellyfin Web", ClientVersion: "10.11.6", ClientUserAgent: agent, IsJellyfinCompat: true},
+		},
+		{
+			name: "card that already names its client",
+			card: playback.RecipeCard{ClientName: "Findroid", ClientVersion: "0.15.0", ClientUserAgent: agent},
+			want: playback.RecipeCard{ClientName: "Findroid", ClientVersion: "0.15.0", ClientUserAgent: agent, IsJellyfinCompat: true},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			card := tt.card
+			fillReconstructedClientInfo(&card, request)
+			if card.ClientName != tt.want.ClientName || card.ClientVersion != tt.want.ClientVersion ||
+				card.ClientUserAgent != tt.want.ClientUserAgent || card.IsJellyfinCompat != tt.want.IsJellyfinCompat {
+				t.Fatalf("card client = %q %q %q compat=%v, want %q %q %q compat=%v",
+					card.ClientName, card.ClientVersion, card.ClientUserAgent, card.IsJellyfinCompat,
+					tt.want.ClientName, tt.want.ClientVersion, tt.want.ClientUserAgent, tt.want.IsJellyfinCompat)
+			}
+		})
+	}
+}
diff --git a/internal/jellycompat/playback_output_conditions_test.go b/internal/jellycompat/playback_output_conditions_test.go
index 72ce5c8705..167c77f645 100644
--- a/internal/jellycompat/playback_output_conditions_test.go
+++ b/internal/jellycompat/playback_output_conditions_test.go
@@ -84,8 +84,22 @@ func TestEncodedOutputConditionsDoNotUseSourceCodecFacts(t *testing.T) {
 		{"scaled width", ProfileCondition{Condition: "LessThanEqual", Property: "Width", Value: "1280", IsRequired: true}, 4000000, true},
 		{"scaled height", ProfileCondition{Condition: "LessThanEqual", Property: "Height", Value: "720", IsRequired: true}, 4000000, true},
 		{"known width exceeds constraint", ProfileCondition{Condition: "LessThanEqual", Property: "Width", Value: "1280", IsRequired: true}, 0, false},
-		{"required encoder level unknown", ProfileCondition{Condition: "LessThanEqual", Property: "VideoLevel", Value: "51", IsRequired: true}, 0, false},
-		{"required encoder profile unknown", ProfileCondition{Condition: "EqualsAny", Property: "VideoProfile", Value: "high|main|baseline", IsRequired: true}, 0, false},
+		// An H.264 encode is High profile at the level its frame size, rate and
+		// bitrate need, never below the streaming libx264 pin of 4.1; here 4.1.
+		{"required level the encode meets", ProfileCondition{Condition: "LessThanEqual", Property: "VideoLevel", Value: "51", IsRequired: true}, 0, true},
+		{"required level below the encode", ProfileCondition{Condition: "LessThanEqual", Property: "VideoLevel", Value: "40", IsRequired: true}, 0, false},
+		{"required profile the encode meets", ProfileCondition{Condition: "EqualsAny", Property: "VideoProfile", Value: "high|main|baseline", IsRequired: true}, 0, true},
+		{"required baseline profile", ProfileCondition{Condition: "Equals", Property: "VideoProfile", Value: "baseline", IsRequired: true}, 0, false},
+		// A 720p encode at 4 Mbps fits level 3.1, but libx264 writes 4.1.
+		{"required level below the libx264 pin", ProfileCondition{Condition: "LessThanEqual", Property: "VideoLevel", Value: "31", IsRequired: true}, 4000000, false},
+		// An optional profile or level rule is an encode target, as in Jellyfin.
+		// At 120 Mbps the encode is stated at level 5.1, above an optional 4.2.
+		{"optional level below the encode", ProfileCondition{Condition: "LessThanEqual", Property: "VideoLevel", Value: "42"}, 120_000_000, true},
+		{"optional baseline profile", ProfileCondition{Condition: "Equals", Property: "VideoProfile", Value: "baseline"}, 0, true},
+		// The encoder chooses reference frames, so a rule on them is an encode
+		// target either way, as in Jellyfin.
+		{"required reference frame limit", ProfileCondition{Condition: "LessThanEqual", Property: "RefFrames", Value: "4", IsRequired: true}, 0, true},
+		{"required reference frame minimum", ProfileCondition{Condition: "GreaterThanEqual", Property: "RefFrames", Value: "2", IsRequired: true}, 0, true},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			profile := DeviceProfile{
@@ -128,3 +142,64 @@ func TestPlaybackBitrateResolutionDoesNotUpscale(t *testing.T) {
 		})
 	}
 }
+
+// A transcoding profile's own RefFrames rule describes the same encode as a
+// codec profile's, so an H.264 encode treats it as an encode target too and
+// an HEVC encode fails it closed.
+func TestTranscodingProfileRefFramesRuleOnEncode(t *testing.T) {
+	version := catalog.FileVersion{
+		FileID: 42, Container: "mkv", CodecVideo: "vp9", CodecAudio: "aac", Bitrate: 8000, Resolution: "1080p",
+		VideoTracks: []models.VideoTrack{{Codec: "vp9", Width: 1920, Height: 1080}},
+		AudioTracks: []models.AudioTrack{{Codec: "aac", Channels: 2}},
+	}
+	refFrames := []ProfileCondition{{Condition: "LessThanEqual", Property: "RefFrames", Value: "4", IsRequired: true}}
+	h := &PlaybackHandler{codec: NewResourceIDCodec()}
+	req := playbackInfoRequest{EnableDirectPlay: new(false), AllowVideoStreamCopy: new(false)}
+
+	profile := DeviceProfile{TranscodingProfiles: []TranscodingProfile{
+		{Type: "Video", Protocol: "hls", Container: "ts", VideoCodec: "h264", AudioCodec: "aac", Conditions: refFrames},
+	}}
+	if source := h.buildPlaybackSource("item", "play", version, profile, req, true); !source.SupportsTranscoding {
+		t.Fatal("SupportsTranscoding = false for an H.264 encode under a transcoding profile's RefFrames rule")
+	}
+
+	profile = DeviceProfile{TranscodingProfiles: []TranscodingProfile{
+		{Type: "Video", Protocol: "hls", Container: "mp4", VideoCodec: "hevc", AudioCodec: "aac", Conditions: refFrames},
+		{Type: "Video", Protocol: "hls", Container: "ts", VideoCodec: "h264", AudioCodec: "aac"},
+	}}
+	if source := h.buildPlaybackSource("item", "play", version, profile, req, true, true); !source.SupportsTranscoding || source.TargetVideoCodec != "h264" {
+		t.Fatalf("transcoding=%v codec=%q, want an H.264 fallback from the HEVC profile's RefFrames rule", source.SupportsTranscoding, source.TargetVideoCodec)
+	}
+}
+
+// The streaming encoder's maximum rate is the requested cap, not the source's
+// rate, so a client's level rule is checked at the cap: a 4,000 kbps source
+// capped near 60,000 kbps needs level 5.0, above a required 4.1.
+func TestH264EncodeLevelUsesTheConfiguredRate(t *testing.T) {
+	version := catalog.FileVersion{
+		FileID: 42, Container: "mkv", CodecVideo: "h264", CodecAudio: "aac", Bitrate: 4000, Resolution: "1080p",
+		VideoTracks: []models.VideoTrack{{Codec: "h264", Profile: "High", Level: 40, Width: 1920, Height: 1080, FrameRate: "24"}},
+		AudioTracks: []models.AudioTrack{{Codec: "aac", Channels: 2}},
+	}
+	profile := DeviceProfile{
+		TranscodingProfiles: []TranscodingProfile{{Type: "Video", Protocol: "hls", Container: "ts", VideoCodec: "h264", AudioCodec: "aac"}},
+		CodecProfiles: []CodecProfile{{Type: "Video", Codec: "h264", Conditions: []ProfileCondition{
+			{Condition: "LessThanEqual", Property: "VideoLevel", Value: "41", IsRequired: true},
+		}}},
+	}
+	h := &PlaybackHandler{codec: NewResourceIDCodec()}
+	req := playbackInfoRequest{EnableDirectPlay: new(false), EnableDirectStream: new(false), MaxStreamingBitrate: 64_000_000}
+	source := h.buildPlaybackSource("item", "play", version, profile, req, true)
+	if source.TargetBitrateKbps < 60_000 {
+		t.Fatalf("target rate %d kbps, want a cap of at least 60,000", source.TargetBitrateKbps)
+	}
+	if source.SupportsTranscoding {
+		t.Fatalf("SupportsTranscoding = true: a %d kbps cap needs level 5.0, above the required 4.1", source.TargetBitrateKbps)
+	}
+
+	// Uncapped, the encode is estimated at the source's rate: level 4.0, so 4.1.
+	req.MaxStreamingBitrate = 0
+	if source := h.buildPlaybackSource("item", "play", version, profile, req, true); !source.SupportsTranscoding {
+		t.Fatal("SupportsTranscoding = false for an uncapped encode of a 4,000 kbps 1080p24 source")
+	}
+}
diff --git a/internal/jellycompat/playback_profile_refresh_test.go b/internal/jellycompat/playback_profile_refresh_test.go
index 8544c78c4b..ca6601eb24 100644
--- a/internal/jellycompat/playback_profile_refresh_test.go
+++ b/internal/jellycompat/playback_profile_refresh_test.go
@@ -10,17 +10,11 @@ import (
 )
 
 type countingCompatProfileRefresh struct {
-	staled    int
-	requested int
+	notified int
 }
 
-func (c *countingCompatProfileRefresh) MarkProfileStale(context.Context, int, string) error {
-	c.staled++
-	return nil
-}
-
-func (c *countingCompatProfileRefresh) RequestProfileRefresh(context.Context, int, string) {
-	c.requested++
+func (c *countingCompatProfileRefresh) NotifySignalsChanged(context.Context, int, string) {
+	c.notified++
 }
 
 // compatProfileRefreshPlay drives one Jellyfin play of the 3600s test source
@@ -40,8 +34,7 @@ func newCompatProfileRefreshPlay(t *testing.T) *compatProfileRefreshPlay {
 	mgr.sessions["upstream-1"].MediaFileID = 42
 	handler.storeProvider = compatTestUserStoreProvider{store: newJellycompatUserStore(t)}
 	refresh := &countingCompatProfileRefresh{}
-	handler.profileStaler = refresh
-	handler.profileRefreshRequester = refresh
+	handler.signalsNotifier = refresh
 	return &compatProfileRefreshPlay{t: t, handler: handler, sourceID: sourceID, refresh: refresh}
 }
 
@@ -74,8 +67,8 @@ func (p *compatProfileRefreshPlay) reportAt(stop bool, seconds int64) {
 
 func (p *compatProfileRefreshPlay) assertRefreshes(stage string, want int) {
 	p.t.Helper()
-	if p.refresh.staled != want || p.refresh.requested != want {
-		p.t.Fatalf("%s: stale marks = %d, refresh requests = %d, want %d each", stage, p.refresh.staled, p.refresh.requested, want)
+	if p.refresh.notified != want {
+		p.t.Fatalf("%s: signal change notifications = %d, want %d", stage, p.refresh.notified, want)
 	}
 }
 
diff --git a/internal/jellycompat/playback_sessions.go b/internal/jellycompat/playback_sessions.go
index 22742d933c..480712d0a3 100644
--- a/internal/jellycompat/playback_sessions.go
+++ b/internal/jellycompat/playback_sessions.go
@@ -27,6 +27,13 @@ type PlaybackSession struct {
 	// request for the same play before it starts either response; the newer
 	// negotiation replaces an older, still-unstarted one from the same device.
 	ClientDeviceID string
+	// ClientName and ClientVersion come from the MediaBrowser header of the
+	// PlaybackInfo request. Players that open the stream URL directly (a
+	// <video> element authenticated by api_key, or a client that sends no
+	// credentials) don't send that header, so the native session falls back
+	// to these; see withNegotiatedClientInfo.
+	ClientName    string
+	ClientVersion string
 	// ClientIP is the resolved address that negotiated this play. Static
 	// streams from clients that send no credentials (Jellyfin for Android TV,
 	// Findroid) are granted only to the same address; see FindStreamGrants.
@@ -126,6 +133,10 @@ type PlaybackMediaSource struct {
 	// clients whose Dolby Vision decoder requires MPEG-TS.
 	HLSRemux       bool
 	HLSRemuxMPEGTS bool
+	// KeyframePlaylist records, for the life of the play session, that an
+	// HLS copy stream is served from a keyframe-planned playlist
+	// (playback.copy_keyframe_playlist when the session started).
+	KeyframePlaylist bool
 	// DOVIVariant marks a copy remux of Dolby Vision without a compatible base
 	// layer (HEVC profile 5, AV1 profile 10) for a client whose device profile
 	// explicitly lists DOVI. As in Jellyfin 12, the fMP4 master playlist then
diff --git a/internal/jellycompat/profile_refresh.go b/internal/jellycompat/profile_refresh.go
index d7a970ee34..1f308e20ea 100644
--- a/internal/jellycompat/profile_refresh.go
+++ b/internal/jellycompat/profile_refresh.go
@@ -1,25 +1,16 @@
 package jellycompat
 
-import (
-	"context"
-	"log/slog"
-)
+import "context"
 
-type profileStaler interface {
-	MarkProfileStale(ctx context.Context, userID int, profileID string) error
+// signalsChangedNotifier records that a profile's recommendation signals
+// changed, so its taste profile and cached recommendations get rebuilt.
+// *recommendations.Worker implements it.
+type signalsChangedNotifier interface {
+	NotifySignalsChanged(ctx context.Context, userID int, profileID string)
 }
 
-type profileRefreshRequester interface {
-	RequestProfileRefresh(ctx context.Context, userID int, profileID string)
-}
-
-func triggerProfileRefresh(ctx context.Context, staler profileStaler, requester profileRefreshRequester, userID int, profileID string) {
-	if staler != nil {
-		if err := staler.MarkProfileStale(ctx, userID, profileID); err != nil {
-			slog.WarnContext(ctx, "failed to mark profile stale", "component", "jellycompat", "user_id", userID, "profile_id", profileID, "error", err)
-		}
-	}
-	if requester != nil {
-		requester.RequestProfileRefresh(ctx, userID, profileID)
+func notifySignalsChanged(ctx context.Context, notifier signalsChangedNotifier, userID int, profileID string) {
+	if notifier != nil {
+		notifier.NotifySignalsChanged(ctx, userID, profileID)
 	}
 }
diff --git a/internal/jellycompat/query.go b/internal/jellycompat/query.go
index 7190511364..114f080b62 100644
--- a/internal/jellycompat/query.go
+++ b/internal/jellycompat/query.go
@@ -54,7 +54,8 @@ type itemsQuery struct {
 	audioLanguages         []string
 	subtitleLanguages      []string
 	hasRootFilter          bool // a Jellyfin 12 HasFilters parameter was sent; see jellyfinRootFilterParams
-	unmatchedIDFilter      bool // GenreIds or PersonIds was sent but no value names a genre or person
+	unmatchedIDFilter      bool // GenreIds, PersonIds, or StudioIds was sent but no value names a genre, person, or studio
+	unmatchedItemIDs       bool // Ids was sent but no value names an item, collection, season, library view, or the Collections view
 	mediaTypes             []string
 	mediaTypesSet          map[string]bool
 	mediaTypesExplicit     bool
@@ -125,16 +126,29 @@ func parseItemsQuery(r *http.Request, codec *ResourceIDCodec) itemsQuery {
 		}
 	}
 
-	if ids := strings.TrimSpace(q.Get("Ids")); ids != "" {
-		parts := strings.SplitSeq(ids, ",")
-		for part := range parts {
-			raw := strings.TrimSpace(part)
+	// Every repeated Ids value counts, as in idsRequestCollectionsView.
+	if ids := splitCommaValues(q.Values("Ids")); len(ids) > 0 {
+		keepsRouting := false
+		for _, raw := range ids {
 			if decoded, err := decodeItemID(codec, raw); err == nil && decoded != "" {
 				result.specificIDs = append(result.specificIDs, decoded)
 			} else if collectionID, collErr := codec.DecodeStringID(EncodedIDCollection, raw); collErr == nil && collectionID != "" {
 				result.specificCollectionIDs = append(result.specificCollectionIDs, collectionID)
+			} else if _, libErr := codec.DecodeIntID(EncodedIDLibrary, raw); libErr == nil || isCollectionsViewID(raw) {
+				// A library or Collections view ID is routed as it was
+				// before unmatched Ids returned empty.
+				keepsRouting = true
+			} else if seasonID, seasonErr := codec.DecodeStringID(EncodedIDSeason, raw); seasonErr == nil && seasonID != "" {
+				// The Ids filter does not serve season IDs, so a request
+				// that names a season keeps its earlier routing too (a
+				// series ParentId still lists its seasons).
+				keepsRouting = true
 			}
 		}
+		// A repeated ID would otherwise come back twice.
+		result.specificIDs = normalizeContentIDs(result.specificIDs)
+		result.specificCollectionIDs = normalizeContentIDs(result.specificCollectionIDs)
+		result.unmatchedItemIDs = len(result.specificIDs) == 0 && len(result.specificCollectionIDs) == 0 && !keepsRouting
 	}
 	if genreIDs := strings.TrimSpace(firstNonEmpty(q.Get("GenreIds"), q.Get("GenreItems"))); genreIDs != "" {
 		matched := false
@@ -921,6 +935,23 @@ func (q itemsQuery) hasIntersectingFilters() bool {
 	return len(q.genres) > 0 || len(q.years) > 0 || q.hasCompatBrowseFilters() || q.genreName != "" || q.personID > 0 || q.requireBackdrop || len(q.audioLanguages) > 0 || len(q.subtitleLanguages) > 0 || q.maxOfficialRating != "" || q.namePrefix != "" || (q.searchTerm != "" && (q.isFavorite || q.isPlayed != nil || q.isResumable || q.sortExplicit)) || (q.isFavorite && (q.isPlayed != nil || q.isResumable)) || (q.isResumable && q.isPlayed != nil)
 }
 
+// matchesNothing reports whether an ID filter names nothing, so the request
+// returns an empty page rather than an unfiltered browse. An unresolvable Ids
+// with no other filter still lists the library views, as Jellyfin does for an
+// Ids value that is not a GUID.
+func (q itemsQuery) matchesNothing() bool {
+	return q.unmatchedIDFilter || (q.unmatchedItemIDs && !q.listsUserRootViews())
+}
+
+// listsUserRootViews reports whether a /Items request with no parent, type,
+// user-state, search, or Jellyfin 12 HasFilters parameter lists the user's
+// library views rather than searching the catalog.
+func (q itemsQuery) listsUserRootViews() bool {
+	return q.parentLibraryID == 0 && q.parentCollectionID == "" && q.parentSeasonID == "" && q.parentItemID == "" &&
+		!q.hasItemTypeFilter && len(q.itemTypes) == 0 && !q.recursive && !q.hasRootFilter &&
+		!q.hasMemberFilters()
+}
+
 // hasMemberFilters reports whether the request narrows results by catalog
 // fields, search, or user state.
 func (q itemsQuery) hasMemberFilters() bool {
diff --git a/internal/jellycompat/recommendations_backdrops_db_test.go b/internal/jellycompat/recommendations_backdrops_db_test.go
index 696156882c..2ceef75db2 100644
--- a/internal/jellycompat/recommendations_backdrops_db_test.go
+++ b/internal/jellycompat/recommendations_backdrops_db_test.go
@@ -13,15 +13,6 @@ import (
 	"github.com/prairie-server/prairie-server/internal/recommendations"
 )
 
-type fakeForYouRecommender struct {
-	recommendations.Recommender
-	rows []recommendations.ForYouRow
-}
-
-func (f fakeForYouRecommender) ForYou(context.Context, int, string, int) (*recommendations.ForYouResponse, error) {
-	return &recommendations.ForYouResponse{Rows: f.rows}, nil
-}
-
 // TestRecommendationsListEveryBackdropDB: /Movies/Recommendations lists a
 // movie's backdrops after the primary in BackdropImageTags, as the other list
 // paths do, so Backdrop/{index} names the same image everywhere.
@@ -39,10 +30,10 @@ func TestRecommendationsListEveryBackdropDB(t *testing.T) {
 	itemRepo := catalog.NewItemRepository(pool)
 	codec := NewResourceIDCodec()
 	h := NewRecommendationsHandler(
-		fakeForYouRecommender{rows: []recommendations.ForYouRow{{Type: "top_picks", Items: []recommendations.ScoredItem{{MediaItemID: movie}}}}},
+		&fakeRowReader{rows: []recommendations.ForYouRow{{Type: clusterRowType, Subject: "Drama", ClusterIndex: 1, Items: []recommendations.ScoredItem{{MediaItemID: movie}}}}},
 		itemRepo,
 		catalog.NewDetailService(itemRepo, catalog.NewEpisodeRepository(pool), catalog.NewSeasonRepository(pool), catalog.NewPersonRepository(pool), nil),
-		nil, &mockUserDataService{}, codec, &config.Config{}, nil,
+		&mockUserDataService{}, codec, &config.Config{}, nil,
 	)
 	req := httptest.NewRequest(http.MethodGet, "/Movies/Recommendations", nil)
 	req = req.WithContext(context.WithValue(req.Context(), compatSessionKey, &Session{Token: "token-1"}))
diff --git a/internal/jellycompat/remote_relay_transport_test.go b/internal/jellycompat/remote_relay_transport_test.go
index 76766c2960..943c5cb5e9 100644
--- a/internal/jellycompat/remote_relay_transport_test.go
+++ b/internal/jellycompat/remote_relay_transport_test.go
@@ -12,6 +12,7 @@ import (
 
 	"github.com/prometheus/client_golang/prometheus"
 
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 	"github.com/prairie-server/prairie-server/internal/transcodeproxy"
 )
 
@@ -25,12 +26,17 @@ func TestRemoteCompatRelayReusesNodeConnectionsAndRecordsDependencyMetrics(t *te
 		concurrency = 20
 		waves       = 5
 		upstream    = "remote-session"
+		secret      = "compat-relay-secret"
 	)
 	var dials, acks atomic.Int32
 	arrived := make(chan struct{})
 	release := make(chan struct{})
 	done := make(chan struct{})
 	node := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if !nodeauthtest.Signed(r, secret) {
+			http.Error(w, "unauthorized", http.StatusUnauthorized)
+			return
+		}
 		switch {
 		case r.Method == http.MethodPost:
 			acks.Add(1)
@@ -61,7 +67,7 @@ func TestRemoteCompatRelayReusesNodeConnectionsAndRecordsDependencyMetrics(t *te
 	t.Cleanup(node.Close)
 	t.Cleanup(func() { close(done) })
 
-	handler := &PlaybackHandler{JWTSecret: "compat-relay-secret"}
+	handler := &PlaybackHandler{JWTSecret: secret}
 	streamCallsBefore := nodeDependencyOperations(t, "stream")
 
 	if _, err := handler.fetchRemoteCompatManifest(t.Context(), node.URL, upstream); err != nil {
diff --git a/internal/jellycompat/router.go b/internal/jellycompat/router.go
index 283ffc0540..151e2fe4fe 100644
--- a/internal/jellycompat/router.go
+++ b/internal/jellycompat/router.go
@@ -21,7 +21,6 @@ import (
 	"github.com/prairie-server/prairie-server/internal/netaccess"
 	"github.com/prairie-server/prairie-server/internal/playback"
 	"github.com/prairie-server/prairie-server/internal/ratelimit"
-	"github.com/prairie-server/prairie-server/internal/recommendations"
 	"github.com/prairie-server/prairie-server/internal/sections"
 	"github.com/prairie-server/prairie-server/internal/subtitles"
 	"github.com/prairie-server/prairie-server/internal/themesongs"
@@ -167,9 +166,6 @@ func NewRouter(deps Dependencies) chi.Router {
 		}
 		return config.PlaybackConfig{Routing: config.DefaultPlaybackRoutingPolicy()}
 	}
-	if deps.DB != nil {
-		playbackHandler.profileStaler = recommendations.NewRepo(deps.DB)
-	}
 	playbackHandler.NodePlanner = deps.NodePlanner
 	playbackHandler.JWTSecret = deps.JWTSecret
 	// Compat transcode reconstruct is driven by the recipe carried in the durable
@@ -184,7 +180,9 @@ func NewRouter(deps Dependencies) chi.Router {
 	if deps.RegisterShutdownWork != nil {
 		deps.RegisterShutdownWork(cleanupDone)
 	}
-	playbackHandler.profileRefreshRequester = deps.RecWorker
+	if deps.RecWorker != nil {
+		playbackHandler.signalsNotifier = deps.RecWorker
+	}
 	playbackHandler.SettingsRepo = deps.SettingsRepo
 	playbackHandler.RecipeNodeStore = deps.RecipeNodeStore
 	itemsHandler.themeRouter = compatThemeRouter(deps, playbackHandler)
@@ -207,8 +205,9 @@ func NewRouter(deps Dependencies) chi.Router {
 	imagesHandler.collectionPosters = itemsHandler.collectionPosters
 	imagesHandler.keyAuth = adminAPIKeyAuth
 	imagesHandler.frontendFS = deps.FrontendFS
+	imagesHandler.artworkStore = deps.ArtworkStore
 	displayPrefsHandler := NewDisplayPreferencesHandler(deps.UserStoreProvider)
-	recsHandler := NewRecommendationsHandler(deps.Recommender, deps.ItemRepo, deps.DetailSvc, deps.ContentService, deps.UserDataService, deps.IDCodec, deps.Config, deps.AccessFilterFn)
+	recsHandler := NewRecommendationsHandler(deps.RecommendationReader, deps.ItemRepo, deps.DetailSvc, deps.UserDataService, deps.IDCodec, deps.Config, deps.AccessFilterFn)
 
 	r.Get("/System/Info/Public", systemHandler.HandlePublicInfo)
 	r.Get("/System/Info", systemHandler.HandleInfo)
@@ -550,7 +549,7 @@ func withDefaults(deps Dependencies) Dependencies {
 		}
 	}
 	if deps.HTTPClient == nil {
-		deps.HTTPClient = &http.Client{Timeout: 30 * time.Second}
+		deps.HTTPClient = newCompatImageClient()
 	}
 
 	// Build ContentService from repos if not provided
@@ -576,9 +575,9 @@ func withDefaults(deps Dependencies) Dependencies {
 
 	// Build UserDataService from store provider if not provided
 	if deps.UserDataService == nil && deps.UserStoreProvider != nil && deps.ItemRepo != nil {
-		var staler profileStaler
-		if deps.DB != nil {
-			staler = recommendations.NewRepo(deps.DB)
+		var signalsNotifier signalsChangedNotifier
+		if deps.RecWorker != nil {
+			signalsNotifier = deps.RecWorker
 		}
 		var pool *pgxpool.Pool
 		if deps.BrowseRepo != nil {
@@ -591,8 +590,7 @@ func withDefaults(deps Dependencies) Dependencies {
 			deps.ProviderIDRepo,
 			deps.DetailSvc,
 			catalog.NewContinueWatchingProgressFilter(pool),
-			staler,
-			deps.RecWorker,
+			signalsNotifier,
 			deps.WatchCompletionObserver,
 		)
 		svc.events = deps.UserStateEvents
diff --git a/internal/jellycompat/server.go b/internal/jellycompat/server.go
index 36856ca355..3e0f5982c8 100644
--- a/internal/jellycompat/server.go
+++ b/internal/jellycompat/server.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/prairie-server/prairie-server/internal/activitylog"
 	"github.com/prairie-server/prairie-server/internal/auth"
+	"github.com/prairie-server/prairie-server/internal/blobstore"
 	"github.com/prairie-server/prairie-server/internal/catalog"
 	"github.com/prairie-server/prairie-server/internal/clientip"
 	"github.com/prairie-server/prairie-server/internal/config"
@@ -84,7 +85,13 @@ type Dependencies struct {
 	// used to serve app-relative artwork such as bundled collection-template
 	// posters that have no remote origin. Optional.
 	FrontendFS fs.FS
+	// HTTPClient fetches images the compat image routes proxy. The default
+	// uses a netguard transport; see ArtworkStore.
 	HTTPClient *http.Client
+	// ArtworkStore is the artwork blob store. A proxied image URL may reach
+	// the server's local network only when it is a direct URL to this store
+	// (artworkurl.FetchContext); every other URL reaches public addresses only.
+	ArtworkStore blobstore.Store
 
 	// Direct service dependencies (replaces Client)
 	ContentService  ContentService
@@ -146,6 +153,9 @@ type Dependencies struct {
 	JWTSecret              string
 	Recommender            recommendations.Recommender
 	RecWorker              *recommendations.Worker
+	// RecommendationReader serves /Movies/Recommendations from the cached
+	// rows the native API reads; nil answers an empty list.
+	RecommendationReader RecommendationRowReader
 
 	// LiveTV is the native Prairie Live TV / OTA / DVR service. When set,
 	// LiveTv/* jellyfin routes are registered and UserViews includes Live TV.
diff --git a/internal/jellycompat/specific_items_filters_test.go b/internal/jellycompat/specific_items_filters_test.go
index 25a07ba78e..4d8d0604fe 100644
--- a/internal/jellycompat/specific_items_filters_test.go
+++ b/internal/jellycompat/specific_items_filters_test.go
@@ -133,3 +133,46 @@ func TestMixedSpecificIDsFilterAllSelectedPages(t *testing.T) {
 		t.Fatalf("membership: count=%d calls=%d err=%v", len(got), calls, err)
 	}
 }
+
+func TestSpecificIDsWithoutLimitReturnEveryNamedItem(t *testing.T) {
+	ids := make([]string, 30)
+	for i := range ids {
+		ids[i] = strconv.Itoa(i)
+	}
+	for _, tc := range []struct {
+		name, query string
+		wantCount   int
+		wantLimit   string // catalog browse limit; empty when the request must not browse
+	}{
+		{name: "by ID", wantCount: 30},
+		{name: "by ID with Limit", query: "&Limit=10", wantCount: 10},
+		{name: "by ID from StartIndex", query: "&StartIndex=24", wantCount: 6},
+		{name: "with type filter", query: "&IncludeItemTypes=Series", wantCount: 30, wantLimit: "30"},
+		{name: "with type filter and Limit", query: "&IncludeItemTypes=Series&Limit=10", wantCount: 10, wantLimit: "10"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			h := newCollectionsTestHandler(&fakeCollectionSource{}, nil, nil)
+			content := &mixedIDsContent{librariesContentService: h.content.(*librariesContentService)}
+			content.browse = func(p url.Values) (*upstreamBrowseResponse, error) {
+				if tc.wantLimit == "" || p.Get("limit") != tc.wantLimit {
+					t.Fatalf("browse limit=%q, want %q", p.Get("limit"), tc.wantLimit)
+				}
+				limit, _ := strconv.Atoi(p.Get("limit"))
+				result := &upstreamBrowseResponse{Total: len(ids)}
+				for _, id := range ids[:limit] {
+					result.Items = append(result.Items, upstreamListItem{ContentID: id, Type: "series"})
+				}
+				return result, nil
+			}
+			h.content = content
+			encoded := make([]string, len(ids))
+			for i, id := range ids {
+				encoded[i] = h.codec.EncodeStringID(EncodedIDItem, id)
+			}
+			result := performItemsRequest(t, h, "/Items?Ids="+url.QueryEscape(strings.Join(encoded, ","))+tc.query)
+			if len(result.Items) != tc.wantCount || result.TotalRecordCount != len(ids) {
+				t.Fatalf("items=%d total=%d, want %d/%d", len(result.Items), result.TotalRecordCount, tc.wantCount, len(ids))
+			}
+		})
+	}
+}
diff --git a/internal/jellycompat/streams.go b/internal/jellycompat/streams.go
index bac22eb938..0e41831e46 100644
--- a/internal/jellycompat/streams.go
+++ b/internal/jellycompat/streams.go
@@ -26,6 +26,7 @@ import (
 	"github.com/prairie-server/prairie-server/internal/httpstream"
 	"github.com/prairie-server/prairie-server/internal/models"
 	"github.com/prairie-server/prairie-server/internal/netaccess"
+	"github.com/prairie-server/prairie-server/internal/nodeauth"
 	"github.com/prairie-server/prairie-server/internal/nodepool"
 	"github.com/prairie-server/prairie-server/internal/noderouting"
 	"github.com/prairie-server/prairie-server/internal/playback"
@@ -381,6 +382,7 @@ func compatRecipeMatchesSource(recipe *playback.RecipeCard, source PlaybackMedia
 		recipe.AudioTrackIndex == compatAudioTrackIndexOrDefault(source) &&
 		recipe.SourceAudioChannels == compatHLSRecipeSourceAudioChannels(source) &&
 		recipe.CopyVideoMPEGTS == source.HLSRemuxMPEGTS &&
+		(!compatHLSCopiesVideo(source) || recipe.KeyframePlaylist == source.KeyframePlaylist) &&
 		recipe.SubtitleBurnIn == source.SubtitleBurnIn && (!source.SubtitleBurnIn || (recipe.SubtitleTrackIndex == source.SubtitleTrackIndex && recipe.SubtitleCodec == source.SubtitleCodec)) &&
 		(source.TargetBitrateKbps == 0 || recipe.TargetBitrateKbps == source.TargetBitrateKbps) &&
 		(source.TargetResolution == "" || recipe.TargetResolution == source.TargetResolution)
@@ -1349,7 +1351,9 @@ func (h *PlaybackHandler) fetchRemoteCompatManifest(ctx context.Context, nodeURL
 	if err != nil {
 		return nil, err
 	}
-	req.Header.Set("Authorization", "Bearer "+h.JWTSecret)
+	if err := nodeauth.Sign(req, nodeURL, h.JWTSecret); err != nil {
+		return nil, err
+	}
 	resp, err := telemetry.DoTrustedNode(transcodeproxy.NodeClient(), req, "stream")
 	if err != nil {
 		nodepool.ReportConnectFailure(h.NodePlanner, nodeURL, err)
@@ -1371,7 +1375,10 @@ func (h *PlaybackHandler) proxyRemoteCompatSegment(w http.ResponseWriter, r *htt
 		writeError(w, http.StatusInternalServerError, "ServerError", "Failed to build remote segment request")
 		return
 	}
-	req.Header.Set("Authorization", "Bearer "+h.JWTSecret)
+	if err := nodeauth.Sign(req, nodeURL, h.JWTSecret); err != nil {
+		writeError(w, http.StatusInternalServerError, "ServerError", "Failed to build remote segment request")
+		return
+	}
 	transcodeproxy.PrepareRequest(req, r)
 	resp, err := telemetry.DoTrustedNode(transcodeproxy.NodeClient(), req, "stream")
 	if err != nil {
@@ -1388,7 +1395,7 @@ func (h *PlaybackHandler) proxyRemoteCompatSegment(w http.ResponseWriter, r *htt
 		return
 	}
 	if generation != "" && r.Method == http.MethodGet && sw.CompletedFullResponse(transcodeproxy.FullRepresentationSize(resp)) {
-		if err := transcodeproxy.Acknowledge(r.Context(), transcodeproxy.NodeClient(), nodepool.NodeEndpoint(nodeURL, path), h.JWTSecret, generation); err != nil {
+		if err := transcodeproxy.Acknowledge(r.Context(), transcodeproxy.NodeClient(), nodepool.NodeEndpoint(nodeURL, ""), path, h.JWTSecret, generation); err != nil {
 			slog.WarnContext(r.Context(), "acknowledge Jellyfin-compatible transcode segment", "component", "jellycompat", "error", err, "playback_session_id", upstreamSessionID)
 		}
 	}
@@ -2350,7 +2357,6 @@ func (h *PlaybackHandler) handlePlaybackReport(w http.ResponseWriter, r *http.Re
 		}
 	}
 	audioTrackIndex := 0
-	var audioRestarted bool
 	// Jellyfin web/mobile clients send AudioStreamIndex on every progress
 	// report, not just on track changes. Restarting ffmpeg on each report
 	// (every ~10s) tears down segments the player is still appending and
@@ -2373,13 +2379,12 @@ func (h *PlaybackHandler) handlePlaybackReport(w http.ResponseWriter, r *http.Re
 			if resolvedAudioTrackIndex, ok := compatAudioTrackIndex(*updatedSource); ok {
 				audioTrackIndex = resolvedAudioTrackIndex
 			}
-			audioRestarted = restarted
 			slog.InfoContext(r.Context(), "jellycompat audio selection updated", "component", "jellycompat",
 				"play_session_id", playSession.ID,
 				"media_source_id", updatedSource.ID,
 				"audio_stream_index", selectedAudioStreamIndex,
 				"audio_track_index", audioTrackIndex,
-				"transcode_restarted", audioRestarted,
+				"transcode_restarted", restarted,
 			)
 		}
 	}
@@ -2444,7 +2449,7 @@ func (h *PlaybackHandler) handlePlaybackReport(w http.ResponseWriter, r *http.Re
 		}
 	}
 	if refreshTasteProfile && playSession.ItemID != "" {
-		triggerProfileRefresh(r.Context(), h.profileStaler, h.profileRefreshRequester, session.StreamAppUserID, session.ProfileID)
+		notifySignalsChanged(r.Context(), h.signalsNotifier, session.StreamAppUserID, session.ProfileID)
 	}
 	// ID-less players still supply a final resume sample on Stopped. Persist
 	// it above, but do not use an item/source match to tear down a play: a
@@ -2555,11 +2560,39 @@ func (h *PlaybackHandler) refreshPlaySession(current *PlaybackSession) *Playback
 	return current
 }
 
+// withNegotiatedClientInfo names the client from its PlaybackInfo request when
+// the stream request didn't send a MediaBrowser header, so the native session
+// isn't labeled from the User-Agent alone.
+func withNegotiatedClientInfo(ctx context.Context, playSession *PlaybackSession) context.Context {
+	info := playback.ClientInfoFromContext(ctx)
+	if info.Name != "" || playSession.ClientName == "" {
+		return ctx
+	}
+	info.Name, info.Version = playSession.ClientName, playSession.ClientVersion
+	return playback.WithClientInfo(ctx, info)
+}
+
+// fillReconstructedClientInfo labels a recipe card that is about to rebuild a
+// native session. Cards minted before client metadata was recorded (and the
+// direct/remux fallback cards built from scratch) carry none; the current
+// compat request identifies the client, so the reconstructed session keeps its
+// label and JF pill. A card minted from the User-Agent alone, by a binary that
+// didn't yet name the client from PlaybackInfo, still takes the name.
+func fillReconstructedClientInfo(card *playback.RecipeCard, info playback.ClientInfo) {
+	card.IsJellyfinCompat = info.IsCompat
+	if card.ClientName == "" && card.ClientUserAgent == "" {
+		card.ClientName, card.ClientVersion, card.ClientUserAgent = info.Name, info.Version, info.UserAgent
+	} else if card.ClientName == "" && info.Name != "" {
+		card.ClientName, card.ClientVersion = info.Name, info.Version
+	}
+}
+
 func (h *PlaybackHandler) ensureUpstreamPlayback(ctx context.Context, compatSession *Session, playSessionID string, source PlaybackMediaSource, method string) (*PlaybackSession, error) {
 	playSession, ok := h.playbackStore.Get(playSessionID)
 	if !ok {
 		return nil, ErrSessionNotFound
 	}
+	ctx = withNegotiatedClientInfo(ctx, playSession)
 	// Captured before any mutation: the CAS attach below verifies no concurrent
 	// request replaced the upstream session this request observed.
 	observedUpstreamID := playSession.UpstreamSessionID
@@ -2576,15 +2609,7 @@ func (h *PlaybackHandler) ensureUpstreamPlayback(ctx context.Context, compatSess
 			}
 			if h.tm != nil {
 				card := h.upstreamRecipeCard(playSession, compatSession, source, method)
-				// Cards minted before client metadata was recorded (and the
-				// direct/remux fallback cards built here from scratch) carry
-				// none; the current compat request identifies the client, so
-				// the reconstructed session keeps its label and JF pill.
-				info := playback.ClientInfoFromContext(ctx)
-				card.IsJellyfinCompat = info.IsCompat
-				if card.ClientName == "" && card.ClientUserAgent == "" {
-					card.ClientName, card.ClientVersion, card.ClientUserAgent = info.Name, info.Version, info.UserAgent
-				}
+				fillReconstructedClientInfo(&card, playback.ClientInfoFromContext(ctx))
 				if reconstructed := h.tm.ReconstructSession(ctx, playSession.UpstreamSessionID, compatSession.StreamAppUserID, card); reconstructed != nil {
 					if !playSession.ProgressPersistenceKnown ||
 						playSession.DisableProgressPersistence != reconstructed.DisableProgressPersistence {
@@ -2895,6 +2920,7 @@ func (h *PlaybackHandler) ensureTranscodeSessionWithToneMapMode(
 		opts.TargetCodecVideo = compatCopyCodec
 		opts.VideoSampleEntry, opts.VideoBitstreamFilter = compatCopyVideoRecipe(source, file.PrimaryDVProfile())
 		opts.CopyVideoMPEGTS = source.HLSRemuxMPEGTS
+		opts.KeyframePlaylist = source.KeyframePlaylist
 	}
 	if !compatHLSTranscodesAudio(source) {
 		opts.TargetCodecAudio = compatCopyCodec
@@ -3170,6 +3196,7 @@ func compatLiveTranscodeMatchesAudioSource(transcodeSession *playback.TranscodeS
 	return opts.AudioTrackIndex == compatAudioTrackIndexOrDefault(source) &&
 		opts.SourceAudioChannels == compatHLSRecipeSourceAudioChannels(source) &&
 		opts.CopyVideoMPEGTS == source.HLSRemuxMPEGTS &&
+		(!compatHLSCopiesVideo(source) || opts.KeyframePlaylist == source.KeyframePlaylist) &&
 		opts.SubtitleBurnIn == source.SubtitleBurnIn && (!source.SubtitleBurnIn || (opts.SubtitleTrackIndex == source.SubtitleTrackIndex && opts.SubtitleCodec == source.SubtitleCodec)) &&
 		(source.TargetBitrateKbps == 0 || opts.TargetBitrateKbps == source.TargetBitrateKbps) &&
 		(source.TargetResolution == "" || opts.TargetResolution == source.TargetResolution)
diff --git a/internal/jellycompat/streams_test.go b/internal/jellycompat/streams_test.go
index 4b5173b7a5..ae9b2dce3c 100644
--- a/internal/jellycompat/streams_test.go
+++ b/internal/jellycompat/streams_test.go
@@ -630,6 +630,55 @@ func TestBuildProxyRedirectURLCarriesMPEGTSForRemoteCopyRecipe(t *testing.T) {
 	}
 }
 
+// The keyframe playlist only applies to copy streams; an encoded stream's
+// recipe and live session must match whatever the flag says.
+func TestKeyframePlaylistOnlyComparedForCopyStreams(t *testing.T) {
+	encoded := testRemoteTranscodeSource()
+	encoded.KeyframePlaylist = true
+	recipe := playback.NewRecipeCard(7, "profile", encoded.FileID, "", playback.TranscodeOpts{
+		TargetCodecVideo: compatTargetVideoCodec,
+		TargetCodecAudio: compatTargetAudioCodec,
+		AudioTrackIndex:  compatAudioTrackIndexOrDefault(encoded),
+	})
+	if !compatRecipeMatchesSource(&recipe, encoded) {
+		t.Fatal("encoded source rejected its recipe over the keyframe playlist flag")
+	}
+
+	copySource := encoded
+	copySource.HLSRemux = true
+	copyRecipe := recipe
+	copyRecipe.TargetCodecVideo = compatCopyCodec
+	if compatRecipeMatchesSource(&copyRecipe, copySource) {
+		t.Fatal("copy source accepted a recipe without its keyframe playlist")
+	}
+	copyRecipe.KeyframePlaylist = true
+	if !compatRecipeMatchesSource(&copyRecipe, copySource) {
+		t.Fatal("copy source rejected its keyframe playlist recipe")
+	}
+}
+
+// A remote copy session rebuilt from the proxy token keeps the keyframe
+// playlist the client already has.
+func TestBuildProxyRedirectURLCarriesKeyframePlaylistForRemoteCopyRecipe(t *testing.T) {
+	h := &PlaybackHandler{JWTSecret: "test-secret"}
+	source := PlaybackMediaSource{HLSRemux: true, KeyframePlaylist: true}
+	redirectURL, err := h.buildProxyRedirectURL(
+		"play-1", "upstream-1", string(playback.PlayTranscode),
+		&models.MediaFile{FilePath: "/media/movie.mkv"}, source, nil, time.Time{},
+		"http://transcode-1", 0, &nodepool.Node{URL: "http://proxy-1"}, netaccess.Path{},
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	claims, err := streamtoken.Verify(proxyTokenFromRedirect(t, redirectURL, string(playback.PlayTranscode)), h.JWTSecret)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !claims.KeyframePlaylist {
+		t.Fatalf("copy proxy token omitted the keyframe playlist: %#v", claims)
+	}
+}
+
 func TestBuildProxyRedirectURLMarksToneMapForOldReaderRejection(t *testing.T) {
 	h := &PlaybackHandler{JWTSecret: "test-secret"}
 	source := PlaybackMediaSource{Version: catalog.FileVersion{HDR: true, VideoTracks: []models.VideoTrack{{VideoRangeType: "HDR10", ColorTransfer: "smpte2084"}}}}
diff --git a/internal/jellycompat/testdata/moonfin_ios_device_profile.json b/internal/jellycompat/testdata/moonfin_ios_device_profile.json
new file mode 100644
index 0000000000..e5ee9a6b98
--- /dev/null
+++ b/internal/jellycompat/testdata/moonfin_ios_device_profile.json
@@ -0,0 +1,459 @@
+{
+  "Name": "Moonfin iOS",
+  "CodecProfiles": [
+    {
+      "Type": "Video",
+      "Codec": "h264",
+      "Conditions": [
+        {
+          "Value": "none",
+          "Property": "VideoProfile",
+          "Condition": "NotEquals",
+          "IsRequired": true
+        }
+      ]
+    },
+    {
+      "Type": "Video",
+      "Codec": "h264",
+      "Conditions": [
+        {
+          "Value": "52",
+          "Property": "VideoLevel",
+          "Condition": "LessThanEqual",
+          "IsRequired": true
+        }
+      ],
+      "ApplyConditions": [
+        {
+          "Value": "high",
+          "Property": "VideoProfile",
+          "Condition": "Equals",
+          "IsRequired": true
+        }
+      ]
+    },
+    {
+      "Type": "Video",
+      "Codec": "h264",
+      "Conditions": [
+        {
+          "Value": "52",
+          "Property": "VideoLevel",
+          "Condition": "LessThanEqual",
+          "IsRequired": true
+        }
+      ],
+      "ApplyConditions": [
+        {
+          "Value": "main",
+          "Property": "VideoProfile",
+          "Condition": "Equals",
+          "IsRequired": true
+        }
+      ]
+    },
+    {
+      "Type": "Video",
+      "Codec": "h264",
+      "Conditions": [
+        {
+          "Value": "52",
+          "Property": "VideoLevel",
+          "Condition": "LessThanEqual",
+          "IsRequired": true
+        }
+      ],
+      "ApplyConditions": [
+        {
+          "Value": "baseline",
+          "Property": "VideoProfile",
+          "Condition": "Equals",
+          "IsRequired": true
+        }
+      ]
+    },
+    {
+      "Type": "Video",
+      "Codec": "h264",
+      "Conditions": [
+        {
+          "Value": "52",
+          "Property": "VideoLevel",
+          "Condition": "LessThanEqual",
+          "IsRequired": true
+        }
+      ],
+      "ApplyConditions": [
+        {
+          "Value": "constrained baseline",
+          "Property": "VideoProfile",
+          "Condition": "Equals",
+          "IsRequired": true
+        }
+      ]
+    },
+    {
+      "Type": "Video",
+      "Codec": "h264",
+      "Conditions": [
+        {
+          "Value": "52",
+          "Property": "VideoLevel",
+          "Condition": "LessThanEqual",
+          "IsRequired": true
+        }
+      ],
+      "ApplyConditions": [
+        {
+          "Value": "high 10",
+          "Property": "VideoProfile",
+          "Condition": "Equals",
+          "IsRequired": true
+        }
+      ]
+    },
+    {
+      "Type": "Video",
+      "Codec": "h264",
+      "Conditions": [
+        {
+          "Value": "12",
+          "Property": "RefFrames",
+          "Condition": "LessThanEqual",
+          "IsRequired": true
+        }
+      ],
+      "ApplyConditions": [
+        {
+          "Value": "1200",
+          "Property": "Width",
+          "Condition": "GreaterThanEqual",
+          "IsRequired": true
+        }
+      ]
+    },
+    {
+      "Type": "Video",
+      "Codec": "h264",
+      "Conditions": [
+        {
+          "Value": "4",
+          "Property": "RefFrames",
+          "Condition": "LessThanEqual",
+          "IsRequired": true
+        }
+      ],
+      "ApplyConditions": [
+        {
+          "Value": "1900",
+          "Property": "Width",
+          "Condition": "GreaterThanEqual",
+          "IsRequired": true
+        }
+      ]
+    },
+    {
+      "Type": "Video",
+      "Codec": "hevc",
+      "Conditions": [
+        {
+          "Value": "none",
+          "Property": "VideoProfile",
+          "Condition": "NotEquals",
+          "IsRequired": true
+        }
+      ]
+    },
+    {
+      "Type": "Video",
+      "Codec": "av1",
+      "Conditions": [
+        {
+          "Value": "none",
+          "Property": "VideoProfile",
+          "Condition": "NotEquals",
+          "IsRequired": true
+        }
+      ]
+    },
+    {
+      "Type": "Video",
+      "Codec": "vc1",
+      "Conditions": [
+        {
+          "Value": "none",
+          "Property": "VideoProfile",
+          "Condition": "NotEquals",
+          "IsRequired": true
+        }
+      ]
+    },
+    {
+      "Type": "Video",
+      "Codec": "mpeg4",
+      "Conditions": [
+        {
+          "Value": "none",
+          "Property": "VideoProfile",
+          "Condition": "Equals",
+          "IsRequired": true
+        }
+      ]
+    },
+    {
+      "Type": "Video",
+      "Codec": "h264",
+      "Conditions": [
+        {
+          "Value": "3840",
+          "Property": "Width",
+          "Condition": "LessThanEqual",
+          "IsRequired": true
+        },
+        {
+          "Value": "2160",
+          "Property": "Height",
+          "Condition": "LessThanEqual",
+          "IsRequired": true
+        }
+      ]
+    },
+    {
+      "Type": "Video",
+      "Codec": "hevc",
+      "Conditions": [
+        {
+          "Value": "3840",
+          "Property": "Width",
+          "Condition": "LessThanEqual",
+          "IsRequired": true
+        },
+        {
+          "Value": "2160",
+          "Property": "Height",
+          "Condition": "LessThanEqual",
+          "IsRequired": true
+        }
+      ]
+    },
+    {
+      "Type": "Video",
+      "Codec": "av1",
+      "Conditions": [
+        {
+          "Value": "3840",
+          "Property": "Width",
+          "Condition": "LessThanEqual",
+          "IsRequired": true
+        },
+        {
+          "Value": "2160",
+          "Property": "Height",
+          "Condition": "LessThanEqual",
+          "IsRequired": true
+        }
+      ]
+    },
+    {
+      "Type": "Video",
+      "Codec": "vc1",
+      "Conditions": [
+        {
+          "Value": "1920",
+          "Property": "Width",
+          "Condition": "LessThanEqual",
+          "IsRequired": true
+        },
+        {
+          "Value": "1080",
+          "Property": "Height",
+          "Condition": "LessThanEqual",
+          "IsRequired": true
+        }
+      ]
+    },
+    {
+      "Type": "Video",
+      "Codec": "av1",
+      "Conditions": [
+        {
+          "Value": "DOVI|DOVIWithHDR10Plus|DOVIWithHLG|DOVIWithSDR|DOVI_WITH_HDR10_PLUS|DOVI_WITH_HLG|DOVI_WITH_SDR",
+          "Property": "VideoRangeType",
+          "Condition": "NotEquals"
+        }
+      ],
+      "ApplyConditions": [
+        {
+          "Value": "DOVI|DOVIWithHDR10Plus|DOVIWithHLG|DOVIWithSDR|DOVI_WITH_HDR10_PLUS|DOVI_WITH_HLG|DOVI_WITH_SDR",
+          "Property": "VideoRangeType",
+          "Condition": "EqualsAny"
+        }
+      ]
+    },
+    {
+      "Type": "VideoAudio",
+      "Conditions": [
+        {
+          "Value": "8",
+          "Property": "AudioChannels",
+          "Condition": "LessThanEqual",
+          "IsRequired": true
+        }
+      ]
+    }
+  ],
+  "SubtitleProfiles": [
+    {
+      "Format": "vtt",
+      "Method": "Embed"
+    },
+    {
+      "Format": "vtt",
+      "Method": "External"
+    },
+    {
+      "Format": "vtt",
+      "Method": "Hls"
+    },
+    {
+      "Format": "webvtt",
+      "Method": "Embed"
+    },
+    {
+      "Format": "webvtt",
+      "Method": "External"
+    },
+    {
+      "Format": "webvtt",
+      "Method": "Hls"
+    },
+    {
+      "Format": "srt",
+      "Method": "Embed"
+    },
+    {
+      "Format": "srt",
+      "Method": "External"
+    },
+    {
+      "Format": "subrip",
+      "Method": "Embed"
+    },
+    {
+      "Format": "subrip",
+      "Method": "External"
+    },
+    {
+      "Format": "ttml",
+      "Method": "Embed"
+    },
+    {
+      "Format": "ttml",
+      "Method": "External"
+    },
+    {
+      "Format": "dvbsub",
+      "Method": "Embed"
+    },
+    {
+      "Format": "dvbsub",
+      "Method": "Encode"
+    },
+    {
+      "Format": "dvdsub",
+      "Method": "Embed"
+    },
+    {
+      "Format": "dvdsub",
+      "Method": "Encode"
+    },
+    {
+      "Format": "idx",
+      "Method": "Embed"
+    },
+    {
+      "Format": "idx",
+      "Method": "Encode"
+    },
+    {
+      "Format": "pgs",
+      "Method": "Embed"
+    },
+    {
+      "Format": "pgs",
+      "Method": "Encode"
+    },
+    {
+      "Format": "pgssub",
+      "Method": "Embed"
+    },
+    {
+      "Format": "pgssub",
+      "Method": "Encode"
+    },
+    {
+      "Format": "ass",
+      "Method": "Embed"
+    },
+    {
+      "Format": "ass",
+      "Method": "External"
+    },
+    {
+      "Format": "ass",
+      "Method": "Encode"
+    },
+    {
+      "Format": "ssa",
+      "Method": "Embed"
+    },
+    {
+      "Format": "ssa",
+      "Method": "External"
+    },
+    {
+      "Format": "ssa",
+      "Method": "Encode"
+    }
+  ],
+  "DirectPlayProfiles": [
+    {
+      "Type": "Video",
+      "Container": "asf,dash,hls,m4v,mkv,mov,mp4,ogm,ogv,ts,vob,webm,wmv,xvid",
+      "AudioCodec": "aac,aac_latm,ac3,alac,dca,dts,eac3,flac,mlp,mp2,mp3,opus,pcm_alaw,pcm_mulaw,pcm_s16le,pcm_s20le,pcm_s24le,truehd,vorbis",
+      "VideoCodec": "av1,h264,hevc,mpeg,mpeg2video,mpeg4,vc1,vp8,vp9"
+    },
+    {
+      "Type": "Audio",
+      "Container": "aac,ac3,alac,ape,dts,eac3,flac,m4a,m4b,mka,mp3,oga,ogg,opus,wav,wma",
+      "AudioCodec": "aac,aac_latm,ac3,alac,dca,dts,eac3,flac,mlp,mp2,mp3,opus,pcm_alaw,pcm_mulaw,pcm_s16le,pcm_s20le,pcm_s24le,truehd,vorbis"
+    }
+  ],
+  "MaxStreamingBitrate": 120000000,
+  "TranscodingProfiles": [
+    {
+      "Type": "Video",
+      "Context": "Streaming",
+      "Protocol": "hls",
+      "Container": "mp4",
+      "AudioCodec": "aac,ac3,eac3,alac,flac,opus",
+      "VideoCodec": "h264"
+    },
+    {
+      "Type": "Video",
+      "Context": "Streaming",
+      "Protocol": "hls",
+      "Container": "ts",
+      "AudioCodec": "aac,ac3,eac3",
+      "VideoCodec": "h264"
+    },
+    {
+      "Type": "Audio",
+      "Context": "Streaming",
+      "Protocol": "hls",
+      "Container": "ts",
+      "AudioCodec": "aac"
+    }
+  ]
+}
diff --git a/internal/jellycompat/userdata_direct.go b/internal/jellycompat/userdata_direct.go
index b6e524fc2b..5ac5938a91 100644
--- a/internal/jellycompat/userdata_direct.go
+++ b/internal/jellycompat/userdata_direct.go
@@ -13,15 +13,17 @@ import (
 
 // directUserDataService implements UserDataService using the user store directly.
 type directUserDataService struct {
-	storeProvider           userstore.UserStoreProvider
-	itemRepo                *catalog.ItemRepository
-	detailSvc               *catalog.DetailService
-	watchState              *watchstate.Service
-	resumeFilter            *catalog.ContinueWatchingProgressFilter
-	profileStaler           profileStaler
-	profileRefreshRequester profileRefreshRequester
+	storeProvider   userstore.UserStoreProvider
+	itemRepo        *catalog.ItemRepository
+	detailSvc       *catalog.DetailService
+	watchState      *watchstate.Service
+	resumeFilter    *catalog.ContinueWatchingProgressFilter
+	signalsNotifier signalsChangedNotifier
 	// events announces watched-state changes to other surfaces and replicas.
 	events UserStateEvents
+	// episodes expands a series or season unplayed mark to its episodes,
+	// including watched ones that no longer have a file.
+	episodes watchstate.EpisodePartitioner
 }
 
 func newDirectUserDataService(
@@ -31,21 +33,23 @@ func newDirectUserDataService(
 	providerIDRepo *catalog.ProviderIDRepository,
 	detailSvc *catalog.DetailService,
 	resumeFilter *catalog.ContinueWatchingProgressFilter,
-	staler profileStaler,
-	requester profileRefreshRequester,
+	signalsNotifier signalsChangedNotifier,
 	completionObserver watchstate.CompletionObserver,
 ) *directUserDataService {
-	return &directUserDataService{
+	svc := &directUserDataService{
 		storeProvider: storeProvider,
 		itemRepo:      itemRepo,
 		detailSvc:     detailSvc,
 		watchState: watchstate.NewService(storeProvider).
 			WithStableIdentityResolver(watchstate.NewStableIdentityResolver(itemRepo, episodeRepo, providerIDRepo)).
 			WithCompletionObserver(completionObserver),
-		resumeFilter:            resumeFilter,
-		profileStaler:           staler,
-		profileRefreshRequester: requester,
+		resumeFilter:    resumeFilter,
+		signalsNotifier: signalsNotifier,
 	}
+	if episodeRepo != nil {
+		svc.episodes = episodeRepo
+	}
+	return svc
 }
 
 func (s *directUserDataService) ListFavorites(ctx context.Context, session *Session, limit, offset int) ([]upstreamListItem, error) {
@@ -108,6 +112,20 @@ func (s *directUserDataService) ListFavorites(ctx context.Context, session *Sess
 	return result, nil
 }
 
+// ListNotInterestedByMediaItems reports which of mediaItemIDs the session's
+// profile marked Not interested.
+func (s *directUserDataService) ListNotInterestedByMediaItems(ctx context.Context, session *Session, mediaItemIDs []string) (map[string]bool, error) {
+	store, err := s.storeProvider.ForUser(ctx, session.StreamAppUserID)
+	if err != nil {
+		return nil, fmt.Errorf("open user store: %w", err)
+	}
+	result, err := store.ListNotInterestedByMediaItems(ctx, session.ProfileID, mediaItemIDs)
+	if err != nil {
+		return nil, fmt.Errorf("list not interested by media items: %w", err)
+	}
+	return result, nil
+}
+
 func (s *directUserDataService) ListFavoritesByMediaItems(ctx context.Context, session *Session, mediaItemIDs []string) (map[string]bool, error) {
 	store, err := s.storeProvider.ForUser(ctx, session.StreamAppUserID)
 	if err != nil {
@@ -142,10 +160,10 @@ func (s *directUserDataService) AddFavorite(ctx context.Context, session *Sessio
 	if err != nil {
 		return fmt.Errorf("open user store: %w", err)
 	}
-	if err := store.AddFavorite(ctx, session.ProfileID, contentID); err != nil {
+	if _, err := store.AddFavorite(ctx, session.ProfileID, contentID); err != nil {
 		return err
 	}
-	triggerProfileRefresh(ctx, s.profileStaler, s.profileRefreshRequester, session.StreamAppUserID, session.ProfileID)
+	notifySignalsChanged(ctx, s.signalsNotifier, session.StreamAppUserID, session.ProfileID)
 	return nil
 }
 
@@ -154,10 +172,10 @@ func (s *directUserDataService) RemoveFavorite(ctx context.Context, session *Ses
 	if err != nil {
 		return fmt.Errorf("open user store: %w", err)
 	}
-	if err := store.RemoveFavorite(ctx, session.ProfileID, contentID); err != nil {
+	if _, err := store.RemoveFavorite(ctx, session.ProfileID, contentID); err != nil {
 		return err
 	}
-	triggerProfileRefresh(ctx, s.profileStaler, s.profileRefreshRequester, session.StreamAppUserID, session.ProfileID)
+	notifySignalsChanged(ctx, s.signalsNotifier, session.StreamAppUserID, session.ProfileID)
 	return nil
 }
 
@@ -299,7 +317,7 @@ func (s *directUserDataService) MarkPlayed(ctx context.Context, session *Session
 	if err := s.watchState.RecordJellycompatMarkPlayed(ctx, session.StreamAppUserID, session.ProfileID, contentID, time.Now().UTC()); err != nil {
 		return err
 	}
-	triggerProfileRefresh(ctx, s.profileStaler, s.profileRefreshRequester, session.StreamAppUserID, session.ProfileID)
+	notifySignalsChanged(ctx, s.signalsNotifier, session.StreamAppUserID, session.ProfileID)
 	publishWatchedChange(ctx, s.events, session, []string{contentID}, true)
 	return nil
 }
@@ -314,7 +332,7 @@ func (s *directUserDataService) MarkPlayedBatch(ctx context.Context, session *Se
 	if err := s.watchState.RecordJellycompatMarkPlayedBatch(ctx, session.StreamAppUserID, session.ProfileID, contentIDs, time.Now().UTC()); err != nil {
 		return err
 	}
-	triggerProfileRefresh(ctx, s.profileStaler, s.profileRefreshRequester, session.StreamAppUserID, session.ProfileID)
+	notifySignalsChanged(ctx, s.signalsNotifier, session.StreamAppUserID, session.ProfileID)
 	publishWatchedChange(ctx, s.events, session, contentIDs, true)
 	return nil
 }
@@ -326,11 +344,21 @@ func (s *directUserDataService) MarkUnplayed(ctx context.Context, session *Sessi
 	if err := s.watchState.RecordJellycompatMarkUnplayed(ctx, session.StreamAppUserID, session.ProfileID, contentID); err != nil {
 		return err
 	}
-	triggerProfileRefresh(ctx, s.profileStaler, s.profileRefreshRequester, session.StreamAppUserID, session.ProfileID)
+	notifySignalsChanged(ctx, s.signalsNotifier, session.StreamAppUserID, session.ProfileID)
 	publishWatchedChange(ctx, s.events, session, []string{contentID}, false)
 	return nil
 }
 
+// ParentUnplayedTargets returns the episodes a series or season unplayed mark
+// must clear, including watched episodes whose file is gone; see
+// watchstate.Service.ParentUnwatchTargets.
+func (s *directUserDataService) ParentUnplayedTargets(ctx context.Context, session *Session, parentKind, parentID string) ([]string, error) {
+	if s.watchState == nil || s.episodes == nil {
+		return nil, nil
+	}
+	return s.watchState.ParentUnwatchTargets(ctx, session.StreamAppUserID, session.ProfileID, s.episodes, parentKind, parentID)
+}
+
 func (s *directUserDataService) MarkUnplayedBatch(ctx context.Context, session *Session, contentIDs []string) error {
 	if s.watchState == nil {
 		return fmt.Errorf("watch state service is not configured")
@@ -341,7 +369,7 @@ func (s *directUserDataService) MarkUnplayedBatch(ctx context.Context, session *
 	if err := s.watchState.RecordJellycompatMarkUnplayedBatch(ctx, session.StreamAppUserID, session.ProfileID, contentIDs); err != nil {
 		return err
 	}
-	triggerProfileRefresh(ctx, s.profileStaler, s.profileRefreshRequester, session.StreamAppUserID, session.ProfileID)
+	notifySignalsChanged(ctx, s.signalsNotifier, session.StreamAppUserID, session.ProfileID)
 	publishWatchedChange(ctx, s.events, session, contentIDs, false)
 	return nil
 }
@@ -373,7 +401,7 @@ func (s *directUserDataService) MarkPlayedBatchAt(ctx context.Context, session *
 	if err := s.watchState.RecordJellycompatMarkPlayedBatch(ctx, session.StreamAppUserID, session.ProfileID, ids, date); err != nil {
 		return err
 	}
-	triggerProfileRefresh(ctx, s.profileStaler, s.profileRefreshRequester, session.StreamAppUserID, session.ProfileID)
+	notifySignalsChanged(ctx, s.signalsNotifier, session.StreamAppUserID, session.ProfileID)
 	publishWatchedChange(ctx, s.events, session, ids, true)
 	return nil
 }
@@ -427,15 +455,15 @@ func (s *directUserDataService) UpdateUserData(ctx context.Context, session *Ses
 		}
 	} else if req.IsFavorite != nil {
 		if *req.IsFavorite {
-			err = store.AddFavorite(ctx, session.ProfileID, contentID)
+			_, err = store.AddFavorite(ctx, session.ProfileID, contentID)
 		} else {
-			err = store.RemoveFavorite(ctx, session.ProfileID, contentID)
+			_, err = store.RemoveFavorite(ctx, session.ProfileID, contentID)
 		}
 		if err != nil {
 			return err
 		}
 	}
-	triggerProfileRefresh(ctx, s.profileStaler, s.profileRefreshRequester, session.StreamAppUserID, session.ProfileID)
+	notifySignalsChanged(ctx, s.signalsNotifier, session.StreamAppUserID, session.ProfileID)
 	return nil
 }
 
@@ -456,6 +484,6 @@ func (s *directUserDataService) UpdateParentUserData(ctx context.Context, sessio
 	if err := s.watchState.RecordJellycompatParent(ctx, session.StreamAppUserID, session.ProfileID, parentID, targets, played, favorite); err != nil {
 		return err
 	}
-	triggerProfileRefresh(ctx, s.profileStaler, s.profileRefreshRequester, session.StreamAppUserID, session.ProfileID)
+	notifySignalsChanged(ctx, s.signalsNotifier, session.StreamAppUserID, session.ProfileID)
 	return nil
 }
diff --git a/internal/jellycompat/userdata_favorite_atomic_test.go b/internal/jellycompat/userdata_favorite_atomic_test.go
index 0360fcea5f..fc4fea31af 100644
--- a/internal/jellycompat/userdata_favorite_atomic_test.go
+++ b/internal/jellycompat/userdata_favorite_atomic_test.go
@@ -18,11 +18,11 @@ func (s atomicFavoriteOnlyStore) ApplyJellycompatProgress(ctx context.Context, p
 	}
 	return writer.ApplyJellycompatProgress(ctx, profile, edit)
 }
-func (atomicFavoriteOnlyStore) AddFavorite(context.Context, string, string) error {
-	return errors.New("separate favorite addition forbidden")
+func (atomicFavoriteOnlyStore) AddFavorite(context.Context, string, string) (bool, error) {
+	return false, errors.New("separate favorite addition forbidden")
 }
-func (atomicFavoriteOnlyStore) RemoveFavorite(context.Context, string, string) error {
-	return errors.New("separate favorite removal forbidden")
+func (atomicFavoriteOnlyStore) RemoveFavorite(context.Context, string, string) (bool, error) {
+	return false, errors.New("separate favorite removal forbidden")
 }
 
 func TestUserDataCombinedFavoriteUsesOneTransaction(t *testing.T) {
diff --git a/internal/jellycompat/userdata_parent_response_test.go b/internal/jellycompat/userdata_parent_response_test.go
index a918b366bc..f2f45d5e21 100644
--- a/internal/jellycompat/userdata_parent_response_test.go
+++ b/internal/jellycompat/userdata_parent_response_test.go
@@ -53,7 +53,7 @@ func TestParentUserDataResponsesRollUpChildren(t *testing.T) {
 				if err := store.SetProgressAt(t.Context(), session.ProfileID, "episode-1", 0, 100, true, time.Now()); err != nil {
 					t.Fatal(err)
 				}
-				if err := store.AddFavorite(t.Context(), session.ProfileID, kind); err != nil {
+				if _, err := store.AddFavorite(t.Context(), session.ProfileID, kind); err != nil {
 					t.Fatal(err)
 				}
 				run := func(handler http.HandlerFunc, body string, played bool, unplayed int, favorite bool) {
diff --git a/internal/lang/lang.go b/internal/lang/lang.go
index f2154ee671..7b61fd70d4 100644
--- a/internal/lang/lang.go
+++ b/internal/lang/lang.go
@@ -96,6 +96,23 @@ func CompatibleTag(value string) string {
 	return CanonicalTag(value)
 }
 
+// RegisteredTag is CompatibleTag limited to tags whose primary language subtag
+// is registered, for reading a language out of free-form names. Words that are
+// merely shaped like a language code, such as "cc" or "ai" in a file name,
+// return "". The registry includes every ISO 639-3 code, so many three-letter
+// words ("sub", "dub") still pass.
+func RegisteredTag(value string) string {
+	tag := CompatibleTag(value)
+	primary, _, _ := strings.Cut(tag, "-")
+	if primary == "" {
+		return ""
+	}
+	if _, err := language.ParseBase(primary); err != nil {
+		return ""
+	}
+	return tag
+}
+
 // bibliographicCodes holds the ISO 639-2/B codes that differ from the 639-2/T
 // form. Media filenames and older tags use either spelling.
 var bibliographicCodes = map[string]string{
diff --git a/internal/lang/lang_test.go b/internal/lang/lang_test.go
index 6b0147d5bb..090411e4e4 100644
--- a/internal/lang/lang_test.go
+++ b/internal/lang/lang_test.go
@@ -33,6 +33,23 @@ func TestPrimaryLanguage(t *testing.T) {
 	}
 }
 
+func TestRegisteredTag(t *testing.T) {
+	cases := map[string]string{
+		"": "", "en": "en", "EN": "en", "eng": "en", "ger": "de", "hi": "hi", "hr": "hr",
+		"Arabic": "ar", "english": "en", "pt-BR": "pt-BR", "pt_BR": "pt-BR", "zh-Hant": "zh-Hant",
+		"yue": "yue", "fil": "fil", "tl": "fil", "iw": "he",
+		// Shaped like a language code but not registered.
+		"ai": "", "cc": "", "xx": "", "pb": "", "x-private": "",
+		// Not shaped like a language code at all.
+		"forced": "", "commentary": "", "zzzz": "",
+	}
+	for in, want := range cases {
+		if got := RegisteredTag(in); got != want {
+			t.Errorf("RegisteredTag(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
 func TestISO6392(t *testing.T) {
 	for in, want := range map[string]string{"en": "eng", "eng": "eng", "pt-BR": "por", "zh-Hant": "zho", "fr": "fra", "fil": "fil", "": "", "und": "", "x-private": "", "unknown": ""} {
 		if got := ISO6392(in); got != want {
diff --git a/internal/lantls/identity.go b/internal/lantls/identity.go
new file mode 100644
index 0000000000..538987bce0
--- /dev/null
+++ b/internal/lantls/identity.go
@@ -0,0 +1,138 @@
+// Package lantls lets a signed-in client use the API server's local-network
+// address without a public certificate and without trusting that address on
+// its word. The API listener answers TLS and plain HTTP on the same port; the
+// TLS side presents a self-signed certificate whose key is derived from
+// SECRET_KEY, and the authenticated connections document publishes that key's
+// pin. A client learns the pin over the address it already trusts and accepts
+// a LAN address only when TLS there presents the same key
+// (docs/architecture/server-identity.md, "Local network TLS").
+//
+// The key is derived, not stored: every API process and replica of a
+// deployment shares SECRET_KEY and so presents the same key, nothing new lives
+// in the database, and a SECRET_KEY rotation replaces the key, which clients
+// pick up from the connections document the next time they read it.
+package lantls
+
+import (
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/hkdf"
+	"crypto/rand"
+	"crypto/sha256"
+	"crypto/tls"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/base64"
+	"fmt"
+	"math/big"
+	"time"
+
+	"github.com/prairie-server/prairie-server/internal/secret"
+)
+
+const (
+	// hkdfInfo domain-separates the TLS key from every other use of the
+	// master key (the data-encryption key uses "prairie/data-encryption/v1").
+	hkdfInfo = "prairie/lan-tls/v1"
+
+	// maxDeriveAttempts bounds the search for a P-256 scalar. A 32-byte HKDF
+	// output is out of range with probability below 2^-32, so a second
+	// attempt is already vanishingly rare.
+	maxDeriveAttempts = 16
+
+	// certificateLifetime only has to outlast any process: clients pin the
+	// key and never evaluate the certificate's dates or names.
+	certificateLifetime = 10 * 365 * 24 * time.Hour
+
+	// alpnHTTP1 is the only application protocol the listener offers.
+	alpnHTTP1 = "http/1.1"
+)
+
+// Identity is the deployment's local-network TLS identity: the derived key,
+// a self-signed certificate for it, and the pin clients compare against.
+type Identity struct {
+	certificate tls.Certificate
+	pin         string
+}
+
+// New derives the identity from the master key (the raw SECRET_KEY value).
+// The same master key always yields the same key and pin; the certificate
+// around it is minted per process and carries no meaning of its own.
+func New(masterKey []byte) (*Identity, error) {
+	if len(masterKey) < secret.MinMasterKeyLen {
+		return nil, fmt.Errorf("lantls: master key must be at least %d bytes, got %d", secret.MinMasterKeyLen, len(masterKey))
+	}
+	key, err := deriveKey(masterKey)
+	if err != nil {
+		return nil, err
+	}
+	serial, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 127))
+	if err != nil {
+		return nil, fmt.Errorf("lantls: certificate serial: %w", err)
+	}
+	now := time.Now()
+	template := &x509.Certificate{
+		SerialNumber:          serial,
+		Subject:               pkix.Name{CommonName: "Prairie local network"},
+		NotBefore:             now.Add(-24 * time.Hour),
+		NotAfter:              now.Add(certificateLifetime),
+		KeyUsage:              x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+		BasicConstraintsValid: true,
+	}
+	der, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
+	if err != nil {
+		return nil, fmt.Errorf("lantls: create certificate: %w", err)
+	}
+	leaf, err := x509.ParseCertificate(der)
+	if err != nil {
+		return nil, fmt.Errorf("lantls: parse certificate: %w", err)
+	}
+	return &Identity{
+		certificate: tls.Certificate{Certificate: [][]byte{der}, PrivateKey: key, Leaf: leaf},
+		pin:         Pin(leaf),
+	}, nil
+}
+
+// Pin is the value clients compare: the base64 SHA-256 of the certificate's
+// SubjectPublicKeyInfo, the same form HTTP public key pinning used.
+func Pin(certificate *x509.Certificate) string {
+	sum := sha256.Sum256(certificate.RawSubjectPublicKeyInfo)
+	return base64.StdEncoding.EncodeToString(sum[:])
+}
+
+// Pin returns the identity's pin.
+func (i *Identity) Pin() string { return i.pin }
+
+// Config is the server TLS configuration for the API listener. HTTP/1.1 only:
+// the listener hands connections to an http.Server through Serve, which does
+// not set up HTTP/2 for connections it did not accept through ServeTLS.
+func (i *Identity) Config() *tls.Config {
+	return &tls.Config{
+		Certificates: []tls.Certificate{i.certificate},
+		MinVersion:   tls.VersionTLS12,
+		NextProtos:   []string{alpnHTTP1},
+	}
+}
+
+// deriveKey turns HKDF output into a P-256 private key, moving to the next
+// counter in the rare case the output is not a valid scalar.
+func deriveKey(masterKey []byte) (*ecdsa.PrivateKey, error) {
+	var lastErr error
+	for attempt := range maxDeriveAttempts {
+		info := hkdfInfo
+		if attempt > 0 {
+			info = fmt.Sprintf("%s#%d", hkdfInfo, attempt)
+		}
+		scalar, err := hkdf.Key(sha256.New, masterKey, nil /* salt */, info, 32)
+		if err != nil {
+			return nil, fmt.Errorf("lantls: derive key: %w", err)
+		}
+		key, err := ecdsa.ParseRawPrivateKey(elliptic.P256(), scalar)
+		if err == nil {
+			return key, nil
+		}
+		lastErr = err
+	}
+	return nil, fmt.Errorf("lantls: derive key: no valid scalar after %d attempts: %w", maxDeriveAttempts, lastErr)
+}
diff --git a/internal/lantls/identity_test.go b/internal/lantls/identity_test.go
new file mode 100644
index 0000000000..e1b328b8bf
--- /dev/null
+++ b/internal/lantls/identity_test.go
@@ -0,0 +1,65 @@
+package lantls
+
+import (
+	"crypto/ecdsa"
+	"crypto/sha256"
+	"encoding/base64"
+	"strings"
+	"testing"
+)
+
+var testMasterKey = []byte(strings.Repeat("k", 48))
+
+func TestNewIsDeterministicPerMasterKey(t *testing.T) {
+	first, err := New(testMasterKey)
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	second, err := New(testMasterKey)
+	if err != nil {
+		t.Fatalf("New again: %v", err)
+	}
+	if first.Pin() != second.Pin() {
+		t.Fatalf("pin changed across processes with one SECRET_KEY: %q vs %q", first.Pin(), second.Pin())
+	}
+
+	other, err := New([]byte(strings.Repeat("r", 48)))
+	if err != nil {
+		t.Fatalf("New with another key: %v", err)
+	}
+	if other.Pin() == first.Pin() {
+		t.Fatal("a different SECRET_KEY must yield a different pin")
+	}
+}
+
+func TestPinIsTheCertificateSPKIHash(t *testing.T) {
+	identity, err := New(testMasterKey)
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	leaf := identity.certificate.Leaf
+	sum := sha256.Sum256(leaf.RawSubjectPublicKeyInfo)
+	if want := base64.StdEncoding.EncodeToString(sum[:]); identity.Pin() != want {
+		t.Fatalf("Pin = %q, want %q", identity.Pin(), want)
+	}
+	if _, ok := identity.certificate.PrivateKey.(*ecdsa.PrivateKey); !ok {
+		t.Fatalf("private key is %T, want *ecdsa.PrivateKey", identity.certificate.PrivateKey)
+	}
+}
+
+func TestNewRejectsShortMasterKey(t *testing.T) {
+	if _, err := New([]byte("short")); err == nil {
+		t.Fatal("New accepted a master key below the SECRET_KEY floor")
+	}
+}
+
+func TestConfigServesHTTP1Only(t *testing.T) {
+	identity, err := New(testMasterKey)
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	config := identity.Config()
+	if len(config.NextProtos) != 1 || config.NextProtos[0] != alpnHTTP1 {
+		t.Fatalf("NextProtos = %v, want [http/1.1]", config.NextProtos)
+	}
+}
diff --git a/internal/lantls/listener.go b/internal/lantls/listener.go
new file mode 100644
index 0000000000..3e654e28e2
--- /dev/null
+++ b/internal/lantls/listener.go
@@ -0,0 +1,242 @@
+package lantls
+
+import (
+	"crypto/tls"
+	"errors"
+	"io"
+	"net"
+	"sync"
+	"time"
+)
+
+// recordTypeHandshake is the first byte of every TLS connection (a handshake
+// record carrying the ClientHello). No HTTP/1.x request starts with it: a
+// request line starts with an ASCII method name.
+const recordTypeHandshake = 0x16
+
+// DefaultSniffTimeout is how long a new connection may stay silent before it
+// is handed on as plain HTTP. TLS clients send their ClientHello as soon as
+// they connect; a silent connection is a plain-HTTP client that connected
+// ahead of its first request, which the HTTP server's own timeouts then cover.
+const DefaultSniffTimeout = 5 * time.Second
+
+// Listener serves TLS and plain HTTP on one port. It accepts every connection
+// from the wrapped listener at once and reads the first byte in a goroutine of
+// its own, so a slow or silent client never holds up the next one. A TLS
+// connection is returned as a *tls.Conn (the HTTP server keys request.TLS,
+// and with it the request scheme, on that type); anything else is returned as
+// the plain connection with the byte it read put back.
+//
+// Close closes the wrapped listener and every connection still being
+// classified, so a server shutdown leaves nothing behind that the HTTP server
+// never saw.
+type Listener struct {
+	inner        net.Listener
+	config       *tls.Config
+	sniffTimeout time.Duration
+
+	ready chan net.Conn
+	// errs carries Accept errors from the wrapped listener. The acceptor stops
+	// after the first error that is not temporary and records it in stopErr.
+	errs      chan error
+	stopped   chan struct{}
+	stopErr   error
+	done      chan struct{}
+	closeOnce sync.Once
+	closeErr  error
+
+	mu      sync.Mutex
+	pending map[net.Conn]struct{}
+}
+
+// NewListener wraps inner. config is the TLS configuration for connections
+// that open with a TLS handshake; sniffTimeout <= 0 uses DefaultSniffTimeout.
+func NewListener(inner net.Listener, config *tls.Config, sniffTimeout time.Duration) *Listener {
+	if sniffTimeout <= 0 {
+		sniffTimeout = DefaultSniffTimeout
+	}
+	l := &Listener{
+		inner:        inner,
+		config:       config,
+		sniffTimeout: sniffTimeout,
+		ready:        make(chan net.Conn),
+		errs:         make(chan error),
+		stopped:      make(chan struct{}),
+		done:         make(chan struct{}),
+		pending:      make(map[net.Conn]struct{}),
+	}
+	go l.acceptLoop()
+	return l
+}
+
+// Accept returns the next classified connection. Once Close has run it
+// returns net.ErrClosed, even when a classified connection is waiting.
+func (l *Listener) Accept() (net.Conn, error) {
+	select {
+	case <-l.done:
+		return nil, net.ErrClosed
+	default:
+	}
+	select {
+	case conn := <-l.ready:
+		return conn, nil
+	case err := <-l.errs:
+		return nil, err
+	case <-l.done:
+		return nil, net.ErrClosed
+	case <-l.stopped:
+		return nil, l.stopErr
+	}
+}
+
+// Close closes the wrapped listener and every connection still being
+// classified. Safe to call more than once.
+func (l *Listener) Close() error {
+	l.closeOnce.Do(func() {
+		close(l.done)
+		l.closeErr = l.inner.Close()
+		l.mu.Lock()
+		for conn := range l.pending {
+			_ = conn.Close()
+		}
+		l.pending = nil
+		l.mu.Unlock()
+	})
+	return l.closeErr
+}
+
+// Addr is the wrapped listener's address.
+func (l *Listener) Addr() net.Addr { return l.inner.Addr() }
+
+func (l *Listener) acceptLoop() {
+	for {
+		conn, err := l.inner.Accept()
+		if err != nil {
+			if isTemporary(err) {
+				select {
+				case l.errs <- err:
+					continue
+				case <-l.done:
+					return
+				}
+			}
+			l.stopErr = err
+			close(l.stopped)
+			return
+		}
+		if !l.track(conn) {
+			_ = conn.Close()
+			return
+		}
+		go l.classify(conn)
+	}
+}
+
+// isTemporary reports an Accept error the HTTP server retries after a pause
+// (too many open files, for example) rather than one that ends serving.
+func isTemporary(err error) bool {
+	var ne interface{ Temporary() bool }
+	return errors.As(err, &ne) && ne.Temporary()
+}
+
+func (l *Listener) track(conn net.Conn) bool {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	if l.pending == nil {
+		return false
+	}
+	l.pending[conn] = struct{}{}
+	return true
+}
+
+// untrack reports whether the connection was still pending; false means
+// Close already closed it.
+func (l *Listener) untrack(conn net.Conn) bool {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	if l.pending == nil {
+		return false
+	}
+	delete(l.pending, conn)
+	return true
+}
+
+func (l *Listener) classify(conn net.Conn) {
+	classified, ok := l.sniff(conn)
+	if !l.untrack(conn) || !ok {
+		_ = conn.Close()
+		return
+	}
+	select {
+	case l.ready <- classified:
+	case <-l.done:
+		_ = classified.Close()
+	}
+}
+
+func (l *Listener) sniff(conn net.Conn) (net.Conn, bool) {
+	if err := conn.SetReadDeadline(time.Now().Add(l.sniffTimeout)); err != nil {
+		return nil, false
+	}
+	var first [1]byte
+	n, err := conn.Read(first[:])
+	if n == 0 {
+		var ne net.Error
+		if !errors.As(err, &ne) || !ne.Timeout() {
+			// Closed before saying anything; nothing to serve.
+			return nil, false
+		}
+		// Silent so far: a plain-HTTP client that connected early. Its
+		// request, when it comes, is read by the HTTP server.
+		if conn.SetReadDeadline(time.Time{}) != nil {
+			return nil, false
+		}
+		return conn, true
+	}
+	if conn.SetReadDeadline(time.Time{}) != nil {
+		return nil, false
+	}
+	replayed := &replayConn{Conn: conn, first: first[0], pending: true}
+	if first[0] == recordTypeHandshake {
+		return tls.Server(replayed, l.config), true
+	}
+	return replayed, true
+}
+
+// replayConn returns the byte the listener read to classify the connection
+// before reading on from the connection itself.
+type replayConn struct {
+	net.Conn
+	first   byte
+	pending bool
+}
+
+func (c *replayConn) Read(p []byte) (int, error) {
+	if !c.pending || len(p) == 0 {
+		return c.Conn.Read(p)
+	}
+	p[0] = c.first
+	c.pending = false
+	return 1, nil
+}
+
+// CloseWrite lets the HTTP server half-close a connection it answers without
+// reading the whole request (an early 413, say), as it does for a bare
+// *net.TCPConn: without the half-close the client can lose that response to a
+// reset.
+func (c *replayConn) CloseWrite() error {
+	if cw, ok := c.Conn.(interface{ CloseWrite() error }); ok {
+		return cw.CloseWrite()
+	}
+	return errors.ErrUnsupported
+}
+
+// ReadFrom keeps the HTTP server's sendfile path for responses: it writes to
+// the wrapped connection directly when that supports it (a *net.TCPConn does).
+// Writes never involve the replayed byte.
+func (c *replayConn) ReadFrom(r io.Reader) (int64, error) {
+	if rf, ok := c.Conn.(io.ReaderFrom); ok {
+		return rf.ReadFrom(r)
+	}
+	return io.Copy(c.Conn, r)
+}
diff --git a/internal/lantls/listener_test.go b/internal/lantls/listener_test.go
new file mode 100644
index 0000000000..6d3cb1e455
--- /dev/null
+++ b/internal/lantls/listener_test.go
@@ -0,0 +1,289 @@
+package lantls
+
+import (
+	"bufio"
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+)
+
+// serve runs an http.Server on a sniffing listener and returns its address.
+func serve(t *testing.T, identity *Identity, sniffTimeout time.Duration, handler http.Handler) (string, *http.Server, *Listener) {
+	t.Helper()
+	inner, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	srv := &http.Server{Handler: handler, ReadHeaderTimeout: 5 * time.Second}
+	listener := NewListener(inner, identity.Config(), sniffTimeout)
+	go func() { _ = srv.Serve(listener) }()
+	t.Cleanup(func() { _ = srv.Close() })
+	return inner.Addr().String(), srv, listener
+}
+
+// pendingCount is how many accepted connections are still being classified.
+func (l *Listener) pendingCount() int {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	return len(l.pending)
+}
+
+// waitFor polls cond until it holds or five seconds pass.
+func waitFor(t *testing.T, what string, cond func() bool) {
+	t.Helper()
+	deadline := time.Now().Add(5 * time.Second)
+	for !cond() {
+		if time.Now().After(deadline) {
+			t.Fatalf("timed out waiting for %s", what)
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+}
+
+// pinnedClient trusts only a certificate whose key matches pin, the way the
+// apps do. It offers h2 first, so a server that negotiated HTTP/2 over a
+// connection http.Server cannot speak it on would show up as a failure.
+func pinnedClient(pin string) *http.Client {
+	return &http.Client{
+		Timeout: 5 * time.Second,
+		Transport: &http.Transport{TLSClientConfig: &tls.Config{
+			NextProtos:         []string{"h2", alpnHTTP1},
+			InsecureSkipVerify: true, //nolint:gosec // VerifyPeerCertificate pins the key instead.
+			VerifyPeerCertificate: func(raw [][]byte, _ [][]*x509.Certificate) error {
+				if len(raw) == 0 {
+					return errors.New("no certificate")
+				}
+				leaf, err := x509.ParseCertificate(raw[0])
+				if err != nil {
+					return err
+				}
+				if Pin(leaf) != pin {
+					return errors.New("pin mismatch")
+				}
+				return nil
+			},
+		}},
+	}
+}
+
+func schemeHandler() http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.TLS != nil {
+			_, _ = fmt.Fprintf(w, "tls %s", r.TLS.NegotiatedProtocol)
+			return
+		}
+		_, _ = io.WriteString(w, "plain")
+	})
+}
+
+func get(t *testing.T, client *http.Client, url string) string {
+	t.Helper()
+	resp, err := client.Get(url)
+	if err != nil {
+		t.Fatalf("GET %s: %v", url, err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatalf("read %s: %v", url, err)
+	}
+	return string(body)
+}
+
+func newIdentity(t *testing.T) *Identity {
+	t.Helper()
+	identity, err := New(testMasterKey)
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	return identity
+}
+
+func TestListenerServesPlainAndTLSOnOnePort(t *testing.T) {
+	identity := newIdentity(t)
+	addr, _, _ := serve(t, identity, 0, schemeHandler())
+
+	if got := get(t, &http.Client{Timeout: 5 * time.Second}, "http://"+addr+"/"); got != "plain" {
+		t.Fatalf("plain request saw %q", got)
+	}
+	if got := get(t, pinnedClient(identity.Pin()), "https://"+addr+"/"); got != "tls "+alpnHTTP1 {
+		t.Fatalf("TLS request saw %q", got)
+	}
+}
+
+func TestListenerRejectsAnotherKey(t *testing.T) {
+	addr, _, _ := serve(t, newIdentity(t), 0, schemeHandler())
+	other, err := New([]byte(strings.Repeat("o", 48)))
+	if err != nil {
+		t.Fatalf("New: %v", err)
+	}
+	resp, err := pinnedClient(other.Pin()).Get("https://" + addr + "/")
+	if err == nil {
+		_ = resp.Body.Close()
+		t.Fatal("a client pinned to another deployment's key connected")
+	}
+}
+
+func TestSilentConnectionDoesNotHoldUpOthers(t *testing.T) {
+	identity := newIdentity(t)
+	addr, _, listener := serve(t, identity, 300*time.Millisecond, schemeHandler())
+
+	silent, err := net.Dial("tcp", addr)
+	if err != nil {
+		t.Fatalf("dial: %v", err)
+	}
+	defer func() { _ = silent.Close() }()
+	waitFor(t, "the silent connection to be accepted", func() bool { return listener.pendingCount() == 1 })
+
+	// Served while the silent connection is still being classified.
+	if got := get(t, &http.Client{Timeout: 5 * time.Second}, "http://"+addr+"/"); got != "plain" {
+		t.Fatalf("plain request saw %q", got)
+	}
+	if listener.pendingCount() != 1 {
+		t.Fatal("the silent connection was classified before the sniff window passed")
+	}
+
+	// Once the sniff window passes, the silent connection is plain HTTP and
+	// its late request is still served.
+	waitFor(t, "the silent connection to be handed on", func() bool { return listener.pendingCount() == 0 })
+	if _, err := io.WriteString(silent, "GET / HTTP/1.1\r\nHost: x\r\nConnection: close\r\n\r\n"); err != nil {
+		t.Fatalf("write late request: %v", err)
+	}
+	_ = silent.SetReadDeadline(time.Now().Add(5 * time.Second))
+	resp, err := http.ReadResponse(bufio.NewReader(silent), nil)
+	if err != nil {
+		t.Fatalf("late request: %v", err)
+	}
+	body, _ := io.ReadAll(resp.Body)
+	_ = resp.Body.Close()
+	if string(body) != "plain" {
+		t.Fatalf("late request saw %q", body)
+	}
+}
+
+func TestCloseDropsConnectionsStillBeingClassified(t *testing.T) {
+	identity := newIdentity(t)
+	addr, srv, listener := serve(t, identity, time.Minute, schemeHandler())
+
+	pending, err := net.Dial("tcp", addr)
+	if err != nil {
+		t.Fatalf("dial: %v", err)
+	}
+	defer func() { _ = pending.Close() }()
+	waitFor(t, "the connection to be accepted", func() bool { return listener.pendingCount() == 1 })
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	if err := srv.Shutdown(ctx); err != nil {
+		t.Fatalf("shutdown: %v", err)
+	}
+	_ = pending.SetReadDeadline(time.Now().Add(5 * time.Second))
+	_, err = pending.Read(make([]byte, 1))
+	var ne net.Error
+	switch {
+	case err == nil:
+		t.Fatal("a connection still being classified survived shutdown")
+	case errors.As(err, &ne) && ne.Timeout():
+		t.Fatal("a connection still being classified was left open after shutdown")
+	}
+}
+
+func TestHijackWorksOnBothKinds(t *testing.T) {
+	identity := newIdentity(t)
+	addr, _, _ := serve(t, identity, 0, http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		conn, rw, err := http.NewResponseController(w).Hijack()
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		defer func() { _ = conn.Close() }()
+		_, _ = rw.WriteString("HTTP/1.1 101 Switching Protocols\r\nUpgrade: echo\r\nConnection: Upgrade\r\n\r\n")
+		_ = rw.Flush()
+		line, _ := rw.ReadString('\n')
+		_, _ = rw.WriteString("echo " + line)
+		_ = rw.Flush()
+	}))
+
+	upgrade := func(conn net.Conn) {
+		t.Helper()
+		_ = conn.SetDeadline(time.Now().Add(5 * time.Second))
+		_, _ = io.WriteString(conn, "GET / HTTP/1.1\r\nHost: x\r\nUpgrade: echo\r\nConnection: Upgrade\r\n\r\n")
+		reader := bufio.NewReader(conn)
+		resp, err := http.ReadResponse(reader, nil)
+		if err != nil {
+			t.Fatalf("upgrade: %v", err)
+		}
+		_ = resp.Body.Close()
+		if resp.StatusCode != http.StatusSwitchingProtocols {
+			t.Fatalf("upgrade status = %d", resp.StatusCode)
+		}
+		_, _ = io.WriteString(conn, "hello\n")
+		line, err := reader.ReadString('\n')
+		if err != nil || line != "echo hello\n" {
+			t.Fatalf("echo = %q, %v", line, err)
+		}
+	}
+
+	plain, err := net.Dial("tcp", addr)
+	if err != nil {
+		t.Fatalf("dial: %v", err)
+	}
+	defer func() { _ = plain.Close() }()
+	upgrade(plain)
+
+	secure, err := tls.Dial("tcp", addr, pinnedClient(identity.Pin()).Transport.(*http.Transport).TLSClientConfig)
+	if err != nil {
+		t.Fatalf("tls dial: %v", err)
+	}
+	defer func() { _ = secure.Close() }()
+	upgrade(secure)
+}
+
+// The HTTP server finds sendfile and half-close on the connection's type.
+var _ interface {
+	io.ReaderFrom
+	CloseWrite() error
+} = (*replayConn)(nil)
+
+func TestReplayConnHalfCloses(t *testing.T) {
+	inner, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	defer func() { _ = inner.Close() }()
+	client, err := net.Dial("tcp", inner.Addr().String())
+	if err != nil {
+		t.Fatalf("dial: %v", err)
+	}
+	defer func() { _ = client.Close() }()
+	accepted, err := inner.Accept()
+	if err != nil {
+		t.Fatalf("accept: %v", err)
+	}
+	server := &replayConn{Conn: accepted}
+	defer func() { _ = server.Close() }()
+
+	if err := server.CloseWrite(); err != nil {
+		t.Fatalf("CloseWrite: %v", err)
+	}
+	_ = client.SetReadDeadline(time.Now().Add(5 * time.Second))
+	if _, err := client.Read(make([]byte, 1)); !errors.Is(err, io.EOF) {
+		t.Fatalf("client read after the half-close = %v, want EOF", err)
+	}
+	// Only the write side closed: the server still reads what the client sends.
+	if _, err := io.WriteString(client, "x"); err != nil {
+		t.Fatalf("client write: %v", err)
+	}
+	_ = server.SetReadDeadline(time.Now().Add(5 * time.Second))
+	if _, err := server.Read(make([]byte, 1)); err != nil {
+		t.Fatalf("server read after its half-close: %v", err)
+	}
+}
diff --git a/internal/librarymonitor/monitor.go b/internal/librarymonitor/monitor.go
index b12db8c48c..760a92240c 100644
--- a/internal/librarymonitor/monitor.go
+++ b/internal/librarymonitor/monitor.go
@@ -306,7 +306,7 @@ func setDefault(d *time.Duration, def time.Duration) {
 // blocks on the initial walks, which queue no scans.
 func (m *Monitor) Start(ctx context.Context) {
 	m.startOnce.Do(func() {
-		m.ctx, m.cancel = context.WithCancel(ctx)
+		m.ctx, m.cancel = context.WithCancel(ctx) //nolint:fatcontext // set once under startOnce, derived from the caller's ctx
 		go m.run(m.ctx)
 		go m.statusLoop(m.ctx)
 	})
diff --git a/internal/literaryworks/repository.go b/internal/literaryworks/repository.go
index a80d9d7174..88da7e903b 100644
--- a/internal/literaryworks/repository.go
+++ b/internal/literaryworks/repository.go
@@ -11,6 +11,7 @@ import (
 	"github.com/google/uuid"
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgxpool"
+
 	"github.com/prairie-server/prairie-server/internal/catalog"
 	"github.com/prairie-server/prairie-server/internal/models"
 )
@@ -175,25 +176,17 @@ func (r *Repository) GetFirstWorkIDForContentIDs(ctx context.Context, contentIDs
 }
 
 func (r *Repository) GetMatchItem(ctx context.Context, contentID string) (MatchItemWithWork, error) {
-	rows, err := r.queryMatchItems(ctx, `
+	items, err := r.listMatchItems(ctx, `
 		WHERE mi.content_id = $1
 		  AND mi.type IN ('ebook', 'audiobook')
 	`, contentID)
 	if err != nil {
 		return MatchItemWithWork{}, err
 	}
-	defer rows.Close()
-	if rows.Next() {
-		item, err := scanMatchItem(rows)
-		if err != nil {
-			return MatchItemWithWork{}, err
-		}
-		return item, rows.Err()
-	}
-	if err := rows.Err(); err != nil {
-		return MatchItemWithWork{}, err
+	if len(items) == 0 {
+		return MatchItemWithWork{}, ErrWorkNotFound
 	}
-	return MatchItemWithWork{}, ErrWorkNotFound
+	return items[0], nil
 }
 
 func (r *Repository) ListMatchCandidates(ctx context.Context, source MatchItem, limit int) ([]MatchItemWithWork, error) {
@@ -212,7 +205,7 @@ func (r *Repository) listMatchCandidatesPage(ctx context.Context, source MatchIt
 	}
 	// Two phases: pick candidate IDs with indexable base-table predicates, then
 	// hydrate only those rows. This keeps the per-row lateral aggregates in
-	// queryMatchItems off every opposite-format book and on the LIMIT rows we keep.
+	// listMatchItems off every opposite-format book and on the LIMIT rows we keep.
 	contentIDs, next, err := r.listMatchCandidateIDs(ctx, source, limit, after, autoWorkID)
 	if err != nil {
 		return nil, nil, err
@@ -220,23 +213,14 @@ func (r *Repository) listMatchCandidatesPage(ctx context.Context, source MatchIt
 	if len(contentIDs) == 0 {
 		return nil, nil, nil
 	}
-	rows, err := r.queryMatchItems(ctx, `
+	items, err := r.listMatchItems(ctx, `
 		WHERE mi.content_id = ANY($1)
 		ORDER BY mi.title ASC, mi.content_id ASC
 	`, contentIDs)
 	if err != nil {
 		return nil, nil, err
 	}
-	defer rows.Close()
-	var items []MatchItemWithWork
-	for rows.Next() {
-		item, err := scanMatchItem(rows)
-		if err != nil {
-			return nil, nil, err
-		}
-		items = append(items, item)
-	}
-	return items, next, rows.Err()
+	return items, next, nil
 }
 
 // listMatchCandidateIDs selects opposite-format candidate content IDs using only
@@ -384,11 +368,13 @@ func buildMatchCandidateQuery(source MatchItem, limit int, after *matchCandidate
 	return query, args
 }
 
-func (r *Repository) queryMatchItems(ctx context.Context, suffix string, args ...any) (pgx.Rows, error) {
+// listMatchItems returns the match projection of the media items selected by
+// suffix, a WHERE clause with optional ORDER BY bound to args.
+func (r *Repository) listMatchItems(ctx context.Context, suffix string, args ...any) ([]MatchItemWithWork, error) {
 	if r == nil || r.pool == nil {
 		return nil, fmt.Errorf("literary works repository requires a database pool")
 	}
-	return r.pool.Query(ctx, `
+	rows, err := r.pool.Query(ctx, `
 		SELECT mi.content_id,
 		       mi.type,
 		       mi.title,
@@ -426,6 +412,19 @@ func (r *Repository) queryMatchItems(ctx context.Context, suffix string, args ..
 			WHERE mip.content_id = mi.content_id
 		) provider_ids ON TRUE
 		`+suffix, args...)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []MatchItemWithWork
+	for rows.Next() {
+		item, err := scanMatchItem(rows)
+		if err != nil {
+			return nil, err
+		}
+		items = append(items, item)
+	}
+	return items, rows.Err()
 }
 
 func (r *Repository) GetWorkWithItems(ctx context.Context, workID string, filter catalog.AccessFilter) (*Work, []WorkItemDetail, error) {
diff --git a/internal/logredact/diagnostic.go b/internal/logredact/diagnostic.go
index e924976fa3..2b86658b6a 100644
--- a/internal/logredact/diagnostic.go
+++ b/internal/logredact/diagnostic.go
@@ -124,6 +124,58 @@ func looksLikeDiagnosticURL(value string) bool {
 	return true
 }
 
+// assignmentKey matches the key half of a key=value pair in free text. The
+// value is not part of the match, so a non-secret pair such as desc=api_key=x
+// cannot swallow the secret assignment that follows it.
+var assignmentKey = regexp.MustCompile(`[A-Za-z0-9_.-]+=`)
+
+// RedactSecretAssignments masks the value of every key=value pair in free text
+// whose key is secret-bearing (api_key=, access_token=, password=, ...). It is
+// for error text that crosses a boundary as a plain string, such as a gRPC
+// status description, where no structured URL is left to sanitize.
+func RedactSecretAssignments(text string) string {
+	if !strings.Contains(text, "=") {
+		return text
+	}
+	var out strings.Builder
+	last := 0
+	for _, m := range assignmentKey.FindAllStringIndex(text, -1) {
+		if m[0] < last || !diagnosticSecretKey(text[m[0]:m[1]-1]) {
+			continue
+		}
+		start, end := assignmentValue(text, m[1])
+		if start == end {
+			continue
+		}
+		out.WriteString(text[last:start])
+		out.WriteString(Placeholder)
+		last = end
+	}
+	if last == 0 {
+		return text
+	}
+	out.WriteString(text[last:])
+	return out.String()
+}
+
+// assignmentValue returns the bounds of the value that starts at i. A quoted
+// value runs to its closing quote; a bare one ends at whitespace, a query or
+// list separator, a quote or a closing bracket.
+func assignmentValue(text string, i int) (start, end int) {
+	if i < len(text) && (text[i] == '"' || text[i] == '\'') {
+		quote := text[i]
+		if j := strings.IndexByte(text[i+1:], quote); j >= 0 {
+			return i + 1, i + 1 + j
+		}
+		return i + 1, len(text)
+	}
+	end = i
+	for end < len(text) && !strings.ContainsRune(" \t\r\n&;,\"')]}>", rune(text[end])) {
+		end++
+	}
+	return i, end
+}
+
 // secretAssignmentPattern matches a key=value or key: value pair whose key
 // names a credential, anywhere in free text. Matching on the key alone means a
 // non-secret outer assignment (desc = api_key=SECRET) cannot hide a nested one.
diff --git a/internal/logredact/diagnostic_test.go b/internal/logredact/diagnostic_test.go
index 1661a6cbdc..fad94775ef 100644
--- a/internal/logredact/diagnostic_test.go
+++ b/internal/logredact/diagnostic_test.go
@@ -136,6 +136,22 @@ func TestSanitizeJSONRedactsURLFormsWithSpaces(t *testing.T) {
 	}
 }
 
+func TestRedactSecretAssignments(t *testing.T) {
+	for _, tc := range []struct{ in, want string }{
+		{"desc = api_key=s3cret rejected", "desc = api_key=[REDACTED] rejected"},
+		{"desc=api_key=s3cret", "desc=api_key=[REDACTED]"},
+		{`Get "https://h.example/x?Limit=5&access_token=s3cret": EOF`, `Get "https://h.example/x?Limit=5&access_token=[REDACTED]": EOF`},
+		{`password="two words" and X-Emby-Token='s3cret'`, `password="[REDACTED]" and X-Emby-Token='[REDACTED]'`},
+		{"Pw=s3cret;status=401", "Pw=[REDACTED];status=401"},
+		{"status=401 attempts=3", "status=401 attempts=3"},
+		{"api_key= empty", "api_key= empty"},
+	} {
+		if got := RedactSecretAssignments(tc.in); got != tc.want {
+			t.Errorf("RedactSecretAssignments(%q) = %q, want %q", tc.in, got, tc.want)
+		}
+	}
+}
+
 func TestSanitizeTextMasksCredentials(t *testing.T) {
 	for _, text := range []string{
 		"desc = api_key=SECRET",
diff --git a/internal/logredact/url.go b/internal/logredact/url.go
index cd33b1135c..a75bd00780 100644
--- a/internal/logredact/url.go
+++ b/internal/logredact/url.go
@@ -142,7 +142,51 @@ func sanitizeURLErrorChain(err error) error {
 	default:
 		outer = clone.Error()
 	}
-	return &sanitizedWrapperError{message: outer, cause: &clone}
+	return &sanitizedWrapperError{message: scrubRequestedURLs(outer, err), cause: &clone}
+}
+
+// scrubRequestedURLs replaces the raw URL of every *url.Error in err's tree
+// wherever it still appears in message. errors.As above only finds the first
+// URL error, so a second one under a joined cause, or a wrapper that repeats
+// the requested URL in its own text, would otherwise keep its credentials.
+func scrubRequestedURLs(message string, err error) string {
+	var raws []string
+	collectRequestedURLs(err, &raws, 0)
+	// Longest first, so a URL that prefixes another is not rewritten inside it.
+	sort.SliceStable(raws, func(a, b int) bool { return len(raws[a]) > len(raws[b]) })
+	for _, raw := range raws {
+		// Credentials can only sit in userinfo, query or fragment. Skipping
+		// other URLs keeps short or unusual values from rewriting plain text.
+		if !strings.ContainsAny(raw, "@?#") {
+			continue
+		}
+		clean := SanitizeURL(raw)
+		message = strings.ReplaceAll(message, strconv.Quote(raw), strconv.Quote(clean))
+		message = strings.ReplaceAll(message, raw, clean)
+	}
+	return message
+}
+
+func collectRequestedURLs(err error, raws *[]string, depth int) {
+	if err == nil || depth > 64 {
+		return
+	}
+	if urlErr, ok := err.(*url.Error); ok { //nolint:errorlint // walking the tree by hand
+		if urlErr == nil {
+			return
+		}
+		if urlErr.URL != "" {
+			*raws = append(*raws, urlErr.URL)
+		}
+	}
+	switch wrapped := err.(type) { //nolint:errorlint // walking the tree by hand
+	case interface{ Unwrap() []error }:
+		for _, child := range wrapped.Unwrap() {
+			collectRequestedURLs(child, raws, depth+1)
+		}
+	case interface{ Unwrap() error }:
+		collectRequestedURLs(wrapped.Unwrap(), raws, depth+1)
+	}
 }
 
 // sanitizeMultiURLError rebuilds a multi-error's message in place: each
@@ -178,6 +222,7 @@ func sanitizeMultiURLError(original error, components []error) error {
 	if !allPresent {
 		return errors.Join(sanitized...)
 	}
+	outer = scrubRequestedURLs(outer, original)
 	if outer == original.Error() {
 		return original
 	}
diff --git a/internal/logredact/url_test.go b/internal/logredact/url_test.go
index b356112813..f2026e9a6c 100644
--- a/internal/logredact/url_test.go
+++ b/internal/logredact/url_test.go
@@ -218,6 +218,43 @@ func TestSanitizeURLErrorReturnsOriginalWhenMultiMessageUnchanged(t *testing.T)
 	}
 }
 
+func TestSanitizeURLErrorSanitizesEveryJoinedURL(t *testing.T) {
+	err := fmt.Errorf("fetch: %w", errors.Join(
+		&url.Error{Op: "Get", URL: "https://operator:first-secret@a.example/v?token=first-token", Err: errors.New("timeout")},
+		&url.Error{Op: "Get", URL: "https://operator:second-secret@b.example/v?token=second-token", Err: errors.New("refused")},
+	))
+
+	message := SanitizeURLError(err).Error()
+	for _, secret := range []string{"operator", "first-secret", "first-token", "second-secret", "second-token"} {
+		if strings.Contains(message, secret) {
+			t.Fatalf("sanitized joined error contains %q: %q", secret, message)
+		}
+	}
+	for _, want := range []string{"fetch: ", "https://a.example/v", "timeout", "https://b.example/v", "refused"} {
+		if !strings.Contains(message, want) {
+			t.Fatalf("sanitized joined error lost %q: %q", want, message)
+		}
+	}
+}
+
+func TestSanitizeURLErrorSanitizesURLRepeatedByWrapper(t *testing.T) {
+	const raw = "https://cdn.example/v.mp4?token=query-secret"
+	cause := errors.New("timeout")
+	err := fmt.Errorf("GET %s failed: %w", raw, &url.Error{Op: "Get", URL: raw, Err: cause})
+
+	sanitized := SanitizeURLError(err)
+	message := sanitized.Error()
+	if strings.Contains(message, "query-secret") {
+		t.Fatalf("sanitized wrapper repeats the raw URL: %q", message)
+	}
+	if want := `GET https://cdn.example/v.mp4 failed: Get "https://cdn.example/v.mp4": timeout`; message != want {
+		t.Fatalf("sanitized wrapper = %q, want %q", message, want)
+	}
+	if !errors.Is(sanitized, cause) {
+		t.Fatalf("sanitized wrapper does not preserve its cause: %v", sanitized)
+	}
+}
+
 func TestSanitizeURLFailsClosedForMalformedInput(t *testing.T) {
 	const secret = "node-password"
 	got := SanitizeURL("https://operator:" + secret + "@node.example/\x00")
diff --git a/internal/logstream/drain.go b/internal/logstream/drain.go
index 778b97c966..9c3c70b485 100644
--- a/internal/logstream/drain.go
+++ b/internal/logstream/drain.go
@@ -9,6 +9,8 @@ import (
 	"time"
 
 	"github.com/jackc/pgx/v5/pgconn"
+
+	"github.com/prairie-server/prairie-server/internal/database/queryattr"
 )
 
 // Batch insert tuning. Variables so tests can shorten them.
@@ -147,7 +149,7 @@ func (d Drain[T]) persist(live, ctx context.Context, batch []T, stopping bool) {
 func (d Drain[T]) attempt(ctx context.Context, batch []T) error {
 	ctx, cancel := context.WithTimeout(ctx, insertTimeout)
 	defer cancel()
-	return d.Insert(ctx, batch)
+	return d.Insert(queryattr.Quiet(ctx), batch)
 }
 
 func (d Drain[T]) report(ctx context.Context, failure InsertFailure) {
diff --git a/internal/mail/layout.go b/internal/mail/layout.go
index 89d73b8d66..4d66a9def3 100644
--- a/internal/mail/layout.go
+++ b/internal/mail/layout.go
@@ -20,7 +20,7 @@ import (
 // clients, so the stacks lead with the brand font and degrade to common
 // system faces.
 const (
-	EmailFont     = "'Outfit','Avenir Next','Segoe UI',Helvetica,Arial,sans-serif"
+	EmailFont     = "'Plus Jakarta Sans','Avenir Next','Segoe UI',Helvetica,Arial,sans-serif"
 	EmailFontMono = "'SF Mono',SFMono-Regular,Menlo,Consolas,'Liberation Mono',monospace"
 
 	EmailColorCanvas = "#141417" // page background
diff --git a/internal/markers/contribute.go b/internal/markers/contribute.go
index 971b573abb..d9f48776eb 100644
--- a/internal/markers/contribute.go
+++ b/internal/markers/contribute.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"log/slog"
+	"slices"
 	"strconv"
 	"strings"
 	"time"
@@ -38,7 +39,8 @@ type ContributeOptions struct {
 	Segments []MarkerKind
 	// Auto marks a background run: a segment is only contributed when the
 	// provider has contribute_auto_local enabled and the segment is a local
-	// (scanner) intro at or above the provider's confidence threshold.
+	// (scanner) intro or credits at or above the provider's confidence
+	// threshold.
 	Auto bool
 }
 
@@ -102,6 +104,18 @@ func fileSegments(file *models.MediaFile) []segmentData {
 	}
 }
 
+// AutoContributedKinds lists the local segment kinds automatic contribution
+// shares, in the order a run shares them. The scanner detects intros and
+// credits; intros go first so a backlog of credits never holds back a new
+// episode's intro when a provider's daily limit ends the run.
+func AutoContributedKinds() []MarkerKind {
+	return []MarkerKind{MarkerKindIntro, MarkerKindCredits}
+}
+
+func autoContributedKind(kind MarkerKind) bool {
+	return slices.Contains(AutoContributedKinds(), kind)
+}
+
 func (s *ContributionService) submitters() []Submitter {
 	if s == nil || s.registry == nil {
 		return nil
@@ -188,7 +202,7 @@ func (s *ContributionService) contributeSegment(
 		return ContributionOutcome{}, false
 	}
 	if auto {
-		if !cfg.ContributeAutoLocal || source != models.MarkerSourceScanner || seg.kind != MarkerKindIntro {
+		if !cfg.ContributeAutoLocal || source != models.MarkerSourceScanner || !autoContributedKind(seg.kind) {
 			return ContributionOutcome{}, false
 		}
 		confidence := 0.0
@@ -207,9 +221,9 @@ func (s *ContributionService) contributeSegment(
 			Reason:   strings.Join(missing, ",") + " id required",
 		}, true
 	}
-	// Providers key episodes by show plus season and episode number; specials
-	// numbered season 0 and unnumbered episodes have no submittable target.
-	if ids.Kind == ItemKindEpisode && (ids.SeasonNumber <= 0 || ids.EpisodeNumber <= 0) {
+	// Providers key episodes by show plus season and episode number, so an
+	// unnumbered episode has no submittable target. Season 0 holds specials.
+	if ids.Kind == ItemKindEpisode && (ids.SeasonNumber < 0 || ids.EpisodeNumber <= 0) {
 		return ContributionOutcome{
 			Provider: providerID,
 			Segment:  seg.kind,
@@ -248,14 +262,17 @@ func (s *ContributionService) contributeSegment(
 	startDur := time.Duration(*seg.start * float64(time.Second))
 	endDur := time.Duration(*seg.end * float64(time.Second))
 	req := SubmissionRequest{
-		Kind:          ids.Kind,
-		ExternalIDs:   ids.AsRequestMap(),
-		SeasonNumber:  ids.SeasonNumber,
-		EpisodeNumber: ids.EpisodeNumber,
-		Segment:       seg.kind,
-		Start:         &startDur,
-		End:           &endDur,
-		Duration:      time.Duration(file.Duration) * time.Second,
+		Kind:               ids.Kind,
+		ExternalIDs:        ids.AsRequestMap(),
+		SeasonNumber:       ids.SeasonNumber,
+		EpisodeNumber:      ids.EpisodeNumber,
+		EpisodeExternalIDs: ids.Episode.AsRequestMap(),
+		EpisodeNumbering:   ids.EpisodeNumbering,
+		EpisodeTitle:       ids.EpisodeTitle,
+		Segment:            seg.kind,
+		Start:              &startDur,
+		End:                &endDur,
+		Duration:           time.Duration(file.Duration) * time.Second,
 	}
 
 	submitCtx, cancel := context.WithTimeout(ctx, contributionSubmitLimit)
@@ -330,8 +347,9 @@ func contributionTargetParts(ids ExternalIDs) []string {
 //
 // The item is identified by the first external ID the provider keys
 // submissions by, or else by TMDB, TVDB, then IMDb. The migration that
-// introduced the column, and the candidate query, derive the preference form
-// in SQL; the providers in use key by TMDB, where the two agree.
+// introduced the column, and the candidate query, derive the second form in
+// SQL, so the two agree for providers that declare no keyed IDs or key by
+// TMDB.
 func contributionTargetKey(ids ExternalIDs, keyedBy []string) string {
 	id := ""
 	values := ids.AsRequestMap()
diff --git a/internal/markers/contribute_test.go b/internal/markers/contribute_test.go
index 2e2b0b29be..97a802c75e 100644
--- a/internal/markers/contribute_test.go
+++ b/internal/markers/contribute_test.go
@@ -187,33 +187,46 @@ func TestContributeAutoGatesOnThresholdAndKind(t *testing.T) {
 	}
 }
 
-// Local credits detection writes scanner credits, but automatic contribution
-// stays intro-only: detected credits are submitted only on request.
-func TestContributeAutoSubmitsOnlyScannerIntros(t *testing.T) {
-	cfg := fakeConfig{"introdb": {Provider: "introdb", ContributeEnabled: true, ContributeAutoLocal: true, ContributeMinConfidence: 0.5}}
+// Automatic contribution shares the two kinds the scanner detects, intros and
+// credits, each against the provider's minimum confidence. Other local
+// segments are submitted only on request.
+func TestContributeAutoSubmitsScannerIntrosAndCredits(t *testing.T) {
+	cfg := fakeConfig{"introdb": {Provider: "introdb", ContributeEnabled: true, ContributeAutoLocal: true, ContributeMinConfidence: 0.9}}
 	file := newContribFile()
 	file.IntroStart, file.IntroEnd = floatPtr(0), floatPtr(60)
 	file.IntroMarkersSource = strPtr(models.MarkerSourceScanner)
-	file.IntroMarkersConfidence = floatPtr(0.9)
+	file.IntroMarkersConfidence = floatPtr(0.92)
 	file.CreditsStart, file.CreditsEnd = floatPtr(1500), floatPtr(1800)
 	file.CreditsMarkersSource = strPtr(models.MarkerSourceScanner)
 	file.CreditsMarkersConfidence = floatPtr(0.95)
 	file.CreditsMarkersAlgorithm = strPtr("credits-chapter:v1")
+	file.PreviewStart, file.PreviewEnd = floatPtr(1790), floatPtr(1800)
+	file.PreviewMarkersSource = strPtr(models.MarkerSourceScanner)
+	file.PreviewMarkersConfidence = floatPtr(0.99)
 
 	sub := &fakeSubmitter{id: "introdb"}
 	if _, err := newContribService(sub, cfg, &fakeRecorder{}).ContributeFile(context.Background(), file, ContributeOptions{Auto: true}); err != nil {
 		t.Fatalf("ContributeFile: %v", err)
 	}
-	if len(sub.submitted) != 1 || sub.submitted[0].Segment != MarkerKindIntro {
-		t.Fatalf("automatic contribution submitted %+v, want only the scanner intro", sub.submitted)
+	if len(sub.submitted) != 2 || sub.submitted[0].Segment != MarkerKindIntro || sub.submitted[1].Segment != MarkerKindCredits {
+		t.Fatalf("automatic contribution submitted %+v, want the scanner intro and credits", sub.submitted)
+	}
+
+	file.CreditsMarkersConfidence = floatPtr(0.85)
+	lowCredits := &fakeSubmitter{id: "introdb"}
+	if _, err := newContribService(lowCredits, cfg, &fakeRecorder{}).ContributeFile(context.Background(), file, ContributeOptions{Auto: true}); err != nil {
+		t.Fatalf("ContributeFile: %v", err)
+	}
+	if len(lowCredits.submitted) != 1 || lowCredits.submitted[0].Segment != MarkerKindIntro {
+		t.Fatalf("automatic contribution submitted %+v, want only the intro: the credits are below the minimum confidence", lowCredits.submitted)
 	}
 
 	onRequest := &fakeSubmitter{id: "introdb"}
 	if _, err := newContribService(onRequest, cfg, &fakeRecorder{}).ContributeFile(context.Background(), file, ContributeOptions{}); err != nil {
 		t.Fatalf("ContributeFile: %v", err)
 	}
-	if len(onRequest.submitted) != 2 {
-		t.Fatalf("contribution on request submitted %+v, want the intro and the credits", onRequest.submitted)
+	if len(onRequest.submitted) != 3 {
+		t.Fatalf("contribution on request submitted %+v, want the intro, the credits and the preview", onRequest.submitted)
 	}
 }
 
@@ -316,26 +329,53 @@ func TestContributeSettlesInvalidRefusal(t *testing.T) {
 	}
 }
 
-func TestContributeSkipsEpisodesWithoutSeasonAndEpisode(t *testing.T) {
-	sub := &fakeSubmitter{id: "introdb"}
-	file := newContribFile()
-	file.IntroStart, file.IntroEnd = floatPtr(0), floatPtr(60)
-	file.IntroMarkersSource = strPtr(models.MarkerSourceManual)
-	reg := NewRegistry(nil)
-	_ = reg.Register(sub)
-	resolver := fakeResolver{ids: ExternalIDs{Kind: ItemKindEpisode, TmdbID: "1234", SeasonNumber: 0, EpisodeNumber: 3}}
-	rec := &fakeRecorder{}
-	svc := NewContributionService(reg, resolver, fakeConfig{"introdb": {Provider: "introdb", ContributeEnabled: true}}, rec, nil)
-
-	outcomes, err := svc.ContributeFile(context.Background(), file, ContributeOptions{})
-	if err != nil {
-		t.Fatalf("ContributeFile: %v", err)
-	}
-	if len(sub.submitted) != 0 || len(rec.recorded) != 0 {
-		t.Fatalf("season 0 must not reach the provider or the ledger: submitted=%d recorded=%d", len(sub.submitted), len(rec.recorded))
+func TestContributeSubmitsSpecialsButSkipsUnnumberedEpisodes(t *testing.T) {
+	tests := []struct {
+		name            string
+		season, episode int
+		wantSubmitted   bool
+	}{
+		{name: "special", season: 0, episode: 3, wantSubmitted: true},
+		{name: "unnumbered episode", season: 1, episode: 0},
+		{name: "unknown season", season: -1, episode: 3},
 	}
-	if len(outcomes) != 1 || outcomes[0].Status != OutcomeStatusSkipped {
-		t.Fatalf("outcomes = %+v, want skipped", outcomes)
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			sub := &fakeSubmitter{id: "introdb"}
+			file := newContribFile()
+			file.IntroStart, file.IntroEnd = floatPtr(0), floatPtr(60)
+			file.IntroMarkersSource = strPtr(models.MarkerSourceManual)
+			reg := NewRegistry(nil)
+			_ = reg.Register(sub)
+			resolver := fakeResolver{ids: ExternalIDs{
+				Kind: ItemKindEpisode, TvdbID: "121361", SeasonNumber: tt.season, EpisodeNumber: tt.episode,
+				Episode: EpisodeIDs{TvdbID: "4242"}, EpisodeTitle: "Inside the Episode",
+			}}
+			rec := &fakeRecorder{}
+			svc := NewContributionService(reg, resolver, fakeConfig{"introdb": {Provider: "introdb", ContributeEnabled: true}}, rec, nil)
+
+			outcomes, err := svc.ContributeFile(context.Background(), file, ContributeOptions{})
+			if err != nil {
+				t.Fatalf("ContributeFile: %v", err)
+			}
+			if !tt.wantSubmitted {
+				if len(sub.submitted) != 0 || len(rec.recorded) != 0 {
+					t.Fatalf("must not reach the provider or the ledger: submitted=%d recorded=%d", len(sub.submitted), len(rec.recorded))
+				}
+				if len(outcomes) != 1 || outcomes[0].Status != OutcomeStatusSkipped {
+					t.Fatalf("outcomes = %+v, want skipped", outcomes)
+				}
+				return
+			}
+			if len(sub.submitted) != 1 {
+				t.Fatalf("submitted = %d, want 1 (outcomes %+v)", len(sub.submitted), outcomes)
+			}
+			got := sub.submitted[0]
+			if got.SeasonNumber != tt.season || got.EpisodeNumber != tt.episode ||
+				got.EpisodeExternalIDs[ExternalIDKeyTVDB] != "4242" || got.EpisodeTitle != "Inside the Episode" {
+				t.Fatalf("submission = %+v, want the special with its episode identity", got)
+			}
+		})
 	}
 }
 
diff --git a/internal/markers/contribution_repo.go b/internal/markers/contribution_repo.go
index 596f0261af..0be4509580 100644
--- a/internal/markers/contribution_repo.go
+++ b/internal/markers/contribution_repo.go
@@ -239,48 +239,58 @@ const episodeTargetKeySQL = `'episode|' ||
 		ELSE ''
 	END || '|' || e.season_number || '|' || e.episode_number`
 
-// CandidateLocalIntroFiles returns episode files carrying a local (scanner)
-// intro marker at or above minConfidence, highest confidence first. A file is
-// skipped while every listed provider holds a claim on its current target,
-// from this file or another version of the episode, that Claim would not hand
-// over; a claim on an older target, a stale in-flight claim, and an invalid
-// refusal due for its recheck leave the file eligible.
+// CandidateLocalMarkerFiles returns episode files carrying a local (scanner)
+// marker of kind, an intro or credits, at or above minConfidence, highest
+// confidence first. A file is skipped while every listed provider holds a
+// claim on its current target for that segment, from this file or another
+// version of the episode, that Claim would not hand over; a claim on an older
+// target, a stale in-flight claim, and an invalid refusal due for its recheck
+// leave the file eligible.
 // Paging is by keyset: pass the last candidate returned (nil for the first
 // page).
-func (s *ContributionStore) CandidateLocalIntroFiles(ctx context.Context, minConfidence float64, providers []string, after *ContributionCandidate, limit int) ([]ContributionCandidate, error) {
+func (s *ContributionStore) CandidateLocalMarkerFiles(ctx context.Context, kind MarkerKind, minConfidence float64, providers []string, after *ContributionCandidate, limit int) ([]ContributionCandidate, error) {
 	if s == nil || s.pool == nil || len(providers) == 0 {
 		return nil, nil
 	}
+	if !autoContributedKind(kind) {
+		return nil, fmt.Errorf("automatic contribution does not share %q markers", markerKindName(kind))
+	}
 	afterConfidence, afterID := 2.0, 0
 	if after != nil {
 		afterConfidence, afterID = after.Confidence, after.FileID
 	}
 	rows, err := s.pool.Query(ctx, `
-		SELECT mf.id, COALESCE(mf.intro_markers_confidence, 0) AS confidence
+		SELECT mf.id, seg.confidence
 		FROM media_files mf
 		JOIN episodes e ON e.content_id = mf.episode_id
 		LEFT JOIN media_items series ON series.content_id = e.series_id
-		WHERE mf.episode_id IS NOT NULL
-		  AND mf.intro_markers_source = $1
-		  AND mf.intro_start IS NOT NULL AND mf.intro_end IS NOT NULL
-		  AND COALESCE(mf.intro_markers_confidence, 0) >= $2
+		CROSS JOIN LATERAL (VALUES
+		    ('intro', mf.intro_markers_source, mf.intro_start, mf.intro_end, COALESCE(mf.intro_markers_confidence, 0)),
+		    ('credits', mf.credits_markers_source, mf.credits_start, mf.credits_end, COALESCE(mf.credits_markers_confidence, 0))
+		) AS seg(kind, source, start_s, end_s, confidence)
+		WHERE seg.kind = $11
+		  AND mf.episode_id IS NOT NULL
+		  AND seg.source = $1
+		  AND seg.start_s IS NOT NULL AND seg.end_s IS NOT NULL
+		  AND seg.confidence >= $2
 		  AND e.season_number > 0 AND e.episode_number > 0
-		  AND (COALESCE(mf.intro_markers_confidence, 0), -mf.id) < ($3::double precision, -$4::integer)
+		  AND (seg.confidence, -mf.id) < ($3::double precision, -$4::integer)
 		  AND (
 		      SELECT COUNT(DISTINCT mc.provider)
 		      FROM marker_contributions mc
-		      WHERE mc.segment_kind = 'intro'
+		      WHERE mc.segment_kind = seg.kind
 		        AND mc.claim_active
 		        AND mc.provider = ANY($5::text[])
 		        AND mc.target_key = `+episodeTargetKeySQL+`
 		        AND NOT (mc.status = $7 AND mc.updated_at < now() - ($8 * interval '1 second'))
 		        AND NOT (mc.status = $9 AND mc.updated_at < now() - ($10 * interval '1 second'))
 		  ) < cardinality($5::text[])
-		ORDER BY confidence DESC, mf.id
+		ORDER BY seg.confidence DESC, mf.id
 		LIMIT $6`,
 		models.MarkerSourceScanner, minConfidence, afterConfidence, afterID, providers, limit,
 		contributionStatusClaim, int64(contributionClaimLease/time.Second),
 		OutcomeStatusInvalid, int64(contributionInvalidRecheck/time.Second),
+		markerKindName(kind),
 	)
 	if err != nil {
 		return nil, fmt.Errorf("query contribution candidates: %w", err)
diff --git a/internal/markers/contribution_repo_test.go b/internal/markers/contribution_repo_test.go
index 585ca217a1..7946c8904b 100644
--- a/internal/markers/contribution_repo_test.go
+++ b/internal/markers/contribution_repo_test.go
@@ -3,6 +3,7 @@ package markers
 import (
 	"context"
 	"fmt"
+	"strings"
 	"sync"
 	"testing"
 	"time"
@@ -340,9 +341,9 @@ func TestContributionStoreCandidatesOrderByConfidenceAndSkipClaimed(t *testing.T
 		var got []int
 		var after *ContributionCandidate
 		for {
-			page, err := fixture.store.CandidateLocalIntroFiles(ctx, 0.9, providers, after, pageSize)
+			page, err := fixture.store.CandidateLocalMarkerFiles(ctx, MarkerKindIntro, 0.9, providers, after, pageSize)
 			if err != nil {
-				t.Fatalf("CandidateLocalIntroFiles: %v", err)
+				t.Fatalf("CandidateLocalMarkerFiles: %v", err)
 			}
 			if len(page) == 0 {
 				return got
@@ -368,3 +369,115 @@ func TestContributionStoreCandidatesOrderByConfidenceAndSkipClaimed(t *testing.T
 		t.Fatalf("candidates for two providers = %v, want the claimed file first", other)
 	}
 }
+
+func TestContributionStoreCandidatesIncludeLocalCredits(t *testing.T) {
+	fixture := newContributionStoreFixture(t)
+	ctx := context.Background()
+	seriesID := fmt.Sprintf("claim-test-credits-series-%d", fixture.suffix)
+	if _, err := fixture.pool.Exec(ctx, `
+		INSERT INTO media_items (content_id, type, title, status, genres, tmdb_id)
+		VALUES ($1, 'series', 'Claim Test Credits Series', 'matched', '{}'::text[], '4343')`, seriesID); err != nil {
+		t.Fatalf("seed series: %v", err)
+	}
+	t.Cleanup(func() {
+		_, _ = fixture.pool.Exec(ctx, `DELETE FROM media_items WHERE content_id = $1`, seriesID)
+	})
+
+	type seed struct {
+		episode                            int
+		introSource, creditsSource         *string
+		introConfidence, creditsConfidence float64
+	}
+	scanner, online := strPtr("scanner"), strPtr("online")
+	seeds := []seed{
+		{1, nil, scanner, 0, 0.97},        // credits only
+		{2, scanner, scanner, 0.50, 0.93}, // intro below the minimum, credits above it
+		{3, scanner, scanner, 0.99, 0.92}, // intro claimed below, credits open
+		{4, scanner, scanner, 0.96, 0.98}, // both claimed below
+		{5, nil, online, 0, 0.99},         // online credits are never shared
+		{6, nil, scanner, 0, 0.96},        // credits claimed below
+		{7, scanner, nil, 0.95, 0},        // intro only, as before
+	}
+	fileIDs := make([]int, len(seeds))
+	for i, sd := range seeds {
+		episodeID := fmt.Sprintf("%s-e%d", seriesID, sd.episode)
+		if _, err := fixture.pool.Exec(ctx, `
+			INSERT INTO episodes (content_id, series_id, season_number, episode_number, title)
+			VALUES ($1, $2, 1, $3, 'Ep')`, episodeID, seriesID, sd.episode); err != nil {
+			t.Fatalf("seed episode: %v", err)
+		}
+		if err := fixture.pool.QueryRow(ctx, `
+			INSERT INTO media_files (media_folder_id, file_path, episode_id,
+			                         intro_start, intro_end, intro_markers_source, intro_markers_confidence,
+			                         credits_start, credits_end, credits_markers_source, credits_markers_confidence)
+			VALUES ($1, $2, $3,
+			        CASE WHEN $4::text IS NULL THEN NULL ELSE 0 END, CASE WHEN $4::text IS NULL THEN NULL ELSE 60 END, $4::text, NULLIF($5::double precision, 0),
+			        CASE WHEN $6::text IS NULL THEN NULL ELSE 1500 END, CASE WHEN $6::text IS NULL THEN NULL ELSE 1800 END, $6::text, NULLIF($7::double precision, 0))
+			RETURNING id`, fixture.folderID, fmt.Sprintf("/claim-test/%d-credits-%d.mkv", fixture.suffix, i),
+			episodeID, sd.introSource, sd.introConfidence, sd.creditsSource, sd.creditsConfidence).Scan(&fileIDs[i]); err != nil {
+			t.Fatalf("seed candidate file: %v", err)
+		}
+	}
+	t.Cleanup(func() {
+		_, _ = fixture.pool.Exec(ctx, `DELETE FROM marker_contributions WHERE media_file_id = ANY($1)`, fileIDs)
+		_, _ = fixture.pool.Exec(ctx, `DELETE FROM media_files WHERE id = ANY($1)`, fileIDs)
+		_, _ = fixture.pool.Exec(ctx, `DELETE FROM episodes WHERE series_id = $1`, seriesID)
+	})
+
+	claim := func(i int, segment string) {
+		t.Helper()
+		row := fixture.row(fileIDs[i], fmt.Sprintf("credits-candidate-%d-%s", i, segment))
+		row.SegmentKind = segment
+		row.TargetKey = fmt.Sprintf("episode|tmdb:4343|1|%d", seeds[i].episode)
+		claimed, ok, err := fixture.store.Claim(ctx, row, contributionClaimLease)
+		if err != nil || !ok {
+			t.Fatalf("seed %s claim = (%v, %v)", segment, ok, err)
+		}
+		row.ID, row.ClaimToken, row.Status = claimed.ID, claimed.Token, SubmissionStatusPending
+		if err := fixture.store.Record(ctx, row); err != nil {
+			t.Fatalf("record seed claim: %v", err)
+		}
+	}
+	claim(2, "intro")
+	claim(3, "intro")
+	claim(3, "credits")
+	claim(5, "credits")
+
+	seeded := make(map[int]bool, len(fileIDs))
+	for _, id := range fileIDs {
+		seeded[id] = true
+	}
+	candidates := func(kind MarkerKind) string {
+		t.Helper()
+		var got []string
+		var after *ContributionCandidate
+		for {
+			page, err := fixture.store.CandidateLocalMarkerFiles(ctx, kind, 0.9, []string{fixture.provider}, after, 1)
+			if err != nil {
+				t.Fatalf("CandidateLocalMarkerFiles: %v", err)
+			}
+			if len(page) == 0 {
+				return strings.Join(got, " ")
+			}
+			for _, c := range page {
+				if seeded[c.FileID] {
+					got = append(got, fmt.Sprintf("%d@%.2f", c.FileID, c.Confidence))
+				}
+			}
+			after = &page[len(page)-1]
+		}
+	}
+
+	// Each pass orders by its own segment's confidence and checks only its
+	// own claims: the claimed intro of the third file leaves its credits open.
+	if got, want := candidates(MarkerKindIntro), fmt.Sprintf("%d@0.95", fileIDs[6]); got != want {
+		t.Fatalf("intro candidates = %s, want %s", got, want)
+	}
+	want := fmt.Sprintf("%d@0.97 %d@0.93 %d@0.92", fileIDs[0], fileIDs[1], fileIDs[2])
+	if got := candidates(MarkerKindCredits); got != want {
+		t.Fatalf("credits candidates = %s, want %s (done, online, and low-confidence credits excluded)", got, want)
+	}
+	if _, err := fixture.store.CandidateLocalMarkerFiles(ctx, MarkerKindPreview, 0.9, []string{fixture.provider}, nil, 1); err == nil {
+		t.Fatal("CandidateLocalMarkerFiles(preview) succeeded, want an error: automatic contribution shares intros and credits only")
+	}
+}
diff --git a/internal/markers/plugin_provider.go b/internal/markers/plugin_provider.go
index bd16e7b4d6..d153feb612 100644
--- a/internal/markers/plugin_provider.go
+++ b/internal/markers/plugin_provider.go
@@ -165,11 +165,14 @@ func (p *PluginProvider) FetchMarkers(ctx context.Context, req Request) (Result,
 		return Result{}, err
 	}
 	response, err := client.FetchMarkers(ctx, &pluginv1.FetchMarkersRequest{
-		ItemType:        itemTypeName(req.Kind),
-		ExternalIds:     externalIDsProto(req.ExternalIDs),
-		SeasonNumber:    int32(req.SeasonNumber),
-		EpisodeNumber:   int32(req.EpisodeNumber),
-		DurationSeconds: req.Duration.Seconds(),
+		ItemType:           itemTypeName(req.Kind),
+		ExternalIds:        externalIDsProto(req.ExternalIDs),
+		SeasonNumber:       int32(req.SeasonNumber),  //nolint:gosec // integer columns in the catalog
+		EpisodeNumber:      int32(req.EpisodeNumber), //nolint:gosec // integer columns in the catalog
+		DurationSeconds:    req.Duration.Seconds(),
+		EpisodeExternalIds: episodeExternalIDsProto(req.EpisodeExternalIDs),
+		EpisodeNumbering:   req.EpisodeNumbering,
+		EpisodeTitle:       req.EpisodeTitle,
 	})
 	if err != nil {
 		return Result{}, pluginProviderError(p.ID(), err)
@@ -207,12 +210,15 @@ func (p *PluginProvider) SubmitMarker(ctx context.Context, req SubmissionRequest
 		return SubmissionResult{}, err
 	}
 	body := &pluginv1.SubmitMarkerRequest{
-		ItemType:        itemTypeName(req.Kind),
-		ExternalIds:     externalIDsProto(req.ExternalIDs),
-		SeasonNumber:    int32(req.SeasonNumber),
-		EpisodeNumber:   int32(req.EpisodeNumber),
-		Segment:         markerKindName(req.Segment),
-		DurationSeconds: req.Duration.Seconds(),
+		ItemType:           itemTypeName(req.Kind),
+		ExternalIds:        externalIDsProto(req.ExternalIDs),
+		SeasonNumber:       int32(req.SeasonNumber),  //nolint:gosec // integer columns in the catalog
+		EpisodeNumber:      int32(req.EpisodeNumber), //nolint:gosec // integer columns in the catalog
+		Segment:            markerKindName(req.Segment),
+		DurationSeconds:    req.Duration.Seconds(),
+		EpisodeExternalIds: episodeExternalIDsProto(req.EpisodeExternalIDs),
+		EpisodeNumbering:   req.EpisodeNumbering,
+		EpisodeTitle:       req.EpisodeTitle,
 	}
 	if req.Start != nil {
 		start := req.Start.Seconds()
@@ -316,6 +322,15 @@ func externalIDsProto(ids map[string]string) *pluginv1.MarkerExternalIDs {
 	}
 }
 
+// episodeExternalIDsProto leaves the field unset for a movie or an episode
+// without its own IDs, as a host that predates the field would.
+func episodeExternalIDsProto(ids map[string]string) *pluginv1.MarkerExternalIDs {
+	if len(ids) == 0 {
+		return nil
+	}
+	return externalIDsProto(ids)
+}
+
 func itemTypeName(kind ItemKind) string {
 	switch kind {
 	case ItemKindEpisode:
diff --git a/internal/markers/plugin_provider_test.go b/internal/markers/plugin_provider_test.go
index 00e1e4ec03..7d29d5993e 100644
--- a/internal/markers/plugin_provider_test.go
+++ b/internal/markers/plugin_provider_test.go
@@ -67,11 +67,14 @@ func TestPluginProviderFetchMapsAllSegments(t *testing.T) {
 	}
 
 	res, err := provider.FetchMarkers(context.Background(), Request{
-		Kind:          ItemKindEpisode,
-		ExternalIDs:   map[string]string{ExternalIDKeyTVDB: "777"},
-		SeasonNumber:  1,
-		EpisodeNumber: 2,
-		Duration:      1800 * time.Second,
+		Kind:               ItemKindEpisode,
+		ExternalIDs:        map[string]string{ExternalIDKeyTVDB: "777"},
+		SeasonNumber:       1,
+		EpisodeNumber:      2,
+		EpisodeExternalIDs: map[string]string{ExternalIDKeyTVDB: "9001", ExternalIDKeyTMDB: "63"},
+		EpisodeNumbering:   "tvdb",
+		EpisodeTitle:       "Second Episode",
+		Duration:           1800 * time.Second,
 	})
 	if err != nil {
 		t.Fatalf("FetchMarkers: %v", err)
@@ -79,6 +82,10 @@ func TestPluginProviderFetchMapsAllSegments(t *testing.T) {
 	if client.fetchReq.GetItemType() != "episode" || client.fetchReq.GetExternalIds().GetTvdbId() != "777" {
 		t.Fatalf("fetch request = %+v", client.fetchReq)
 	}
+	if episode := client.fetchReq.GetEpisodeExternalIds(); episode.GetTvdbId() != "9001" || episode.GetTmdbId() != "63" ||
+		client.fetchReq.GetEpisodeTitle() != "Second Episode" || client.fetchReq.GetEpisodeNumbering() != "tvdb" {
+		t.Fatalf("fetch episode identity = %+v %q", episode, client.fetchReq.GetEpisodeTitle())
+	}
 	if res.SourceClass != models.MarkerSourcePlugin || res.ProviderID != "plugin:12:markers" {
 		t.Fatalf("result provenance = source %q provider %q", res.SourceClass, res.ProviderID)
 	}
@@ -129,6 +136,11 @@ func TestPluginProviderSubmitMapsRequest(t *testing.T) {
 	if client.submitReq.GetItemType() != "movie" || client.submitReq.GetExternalIds().GetImdbId() != "tt1" {
 		t.Fatalf("submit request identity = %+v", client.submitReq)
 	}
+	// A movie has no episode identity; the field stays unset as from an
+	// older host.
+	if client.submitReq.EpisodeExternalIds != nil || client.submitReq.GetEpisodeTitle() != "" {
+		t.Fatalf("movie submit carried episode identity: %+v", client.submitReq)
+	}
 	if client.submitReq.GetSegment() != "intro" || client.submitReq.GetStartSeconds() != 5 || client.submitReq.GetEndSeconds() != 30 {
 		t.Fatalf("submit request segment = %+v", client.submitReq)
 	}
diff --git a/internal/markers/population.go b/internal/markers/population.go
index a17b79010d..c10175b1cb 100644
--- a/internal/markers/population.go
+++ b/internal/markers/population.go
@@ -245,11 +245,14 @@ func (s *PopulationService) populate(ctx context.Context, file *models.MediaFile
 	}
 	identity := populationIdentity(file, ids, entries)
 	request := Request{
-		Kind:          ids.Kind,
-		ExternalIDs:   ids.AsRequestMap(),
-		SeasonNumber:  ids.SeasonNumber,
-		EpisodeNumber: ids.EpisodeNumber,
-		Duration:      time.Duration(file.Duration) * time.Second,
+		Kind:               ids.Kind,
+		ExternalIDs:        ids.AsRequestMap(),
+		SeasonNumber:       ids.SeasonNumber,
+		EpisodeNumber:      ids.EpisodeNumber,
+		EpisodeExternalIDs: ids.Episode.AsRequestMap(),
+		EpisodeNumbering:   ids.EpisodeNumbering,
+		EpisodeTitle:       ids.EpisodeTitle,
+		Duration:           time.Duration(file.Duration) * time.Second,
 	}
 	cached := make(map[string]Result)
 	if storage == OnlineStorageStored {
diff --git a/internal/markers/population_store_test.go b/internal/markers/population_store_test.go
index d0441fa944..bf42822826 100644
--- a/internal/markers/population_store_test.go
+++ b/internal/markers/population_store_test.go
@@ -259,8 +259,8 @@ func TestMarkerResolverUsesShowIDsAndPreservesSpecials(t *testing.T) {
 		_, _ = fixture.pool.Exec(context.Background(), `DELETE FROM episodes WHERE content_id=$1`, episodeID)
 		_, _ = fixture.pool.Exec(context.Background(), `DELETE FROM media_items WHERE content_id=$1`, seriesID)
 	})
-	if _, err := fixture.pool.Exec(ctx, `INSERT INTO episodes(content_id,series_id,season_number,episode_number,tmdb_id,imdb_id,tvdb_id,air_date)
-		VALUES($1,$2,0,2,'88','tt99','99','2026-09-30')`, episodeID, seriesID); err != nil {
+	if _, err := fixture.pool.Exec(ctx, `INSERT INTO episodes(content_id,series_id,season_number,episode_number,tmdb_id,imdb_id,tvdb_id,title,air_date)
+		VALUES($1,$2,0,2,'88','tt99','99',' Special Two ','2026-09-30')`, episodeID, seriesID); err != nil {
 		t.Fatal(err)
 	}
 	resolver := NewDBExternalIDResolver(fixture.pool)
@@ -271,6 +271,9 @@ func TestMarkerResolverUsesShowIDsAndPreservesSpecials(t *testing.T) {
 	if ids.TmdbID != "" || ids.TvdbID != "" || ids.ImdbID != "tt42" || ids.SeasonNumber != 0 || ids.EpisodeNumber != 2 {
 		t.Fatalf("episode identity leaked into show lookup: %+v", ids)
 	}
+	if ids.Episode != (EpisodeIDs{TmdbID: "88", ImdbID: "tt99", TvdbID: "99"}) || ids.EpisodeTitle != "Special Two" {
+		t.Fatalf("episode refinement = %+v %q, want the episode's own IDs and trimmed title", ids.Episode, ids.EpisodeTitle)
+	}
 	if !ids.Released.Equal(time.Date(2026, 9, 30, 0, 0, 0, 0, time.UTC)) {
 		t.Fatalf("released=%v, want the episode air date", ids.Released)
 	}
@@ -453,3 +456,90 @@ func (r requestRecorder) FetchMarkers(ctx context.Context, req Request) (Result,
 	*r.request = req
 	return r.populationProvider.FetchMarkers(ctx, req)
 }
+
+func TestMarkerResolverEpisodeNumberingFollowsLibraryChain(t *testing.T) {
+	fixture := newContributionStoreFixture(t)
+	ctx := t.Context()
+	seriesID := strconv.FormatInt(time.Now().UnixNano(), 10)
+	episodeID := strconv.FormatInt(time.Now().UnixNano()+1, 10)
+	if _, err := fixture.pool.Exec(ctx, `INSERT INTO media_items(content_id,type,title,tmdb_id,tvdb_id) VALUES($1,'series','Numbering fixture','70','80')`, seriesID); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := fixture.pool.Exec(ctx, `INSERT INTO episodes(content_id,series_id,season_number,episode_number,tmdb_id,tvdb_id)
+		VALUES($1,$2,1,3,'700','800')`, episodeID, seriesID); err != nil {
+		t.Fatal(err)
+	}
+	installations := map[string]int64{}
+	for _, capability := range []string{"tvdb", "tmdb"} {
+		var id int64
+		if err := fixture.pool.QueryRow(ctx, `INSERT INTO plugin_installations(plugin_id,version,install_path) VALUES($1,'1.0.0','/numbering-fixture') RETURNING id`,
+			fmt.Sprintf("numbering.%s.%d", capability, fixture.suffix)).Scan(&id); err != nil {
+			t.Fatal(err)
+		}
+		installations[capability] = id
+	}
+	t.Cleanup(func() {
+		ctx := context.Background()
+		_, _ = fixture.pool.Exec(ctx, `DELETE FROM library_provider_chains WHERE media_folder_id=$1`, fixture.folderID)
+		_, _ = fixture.pool.Exec(ctx, `DELETE FROM plugin_installations WHERE id = ANY($1)`, []int64{installations["tvdb"], installations["tmdb"]})
+		_, _ = fixture.pool.Exec(ctx, `DELETE FROM episodes WHERE content_id=$1`, episodeID)
+		_, _ = fixture.pool.Exec(ctx, `DELETE FROM media_items WHERE content_id=$1`, seriesID)
+	})
+	type link struct {
+		capability string
+		level      string
+		enabled    bool
+	}
+	setChain := func(t *testing.T, links ...link) {
+		t.Helper()
+		if _, err := fixture.pool.Exec(ctx, `DELETE FROM library_provider_chains WHERE media_folder_id=$1`, fixture.folderID); err != nil {
+			t.Fatal(err)
+		}
+		for priority, l := range links {
+			if _, err := fixture.pool.Exec(ctx, `INSERT INTO library_provider_chains(media_folder_id,priority,content_level,enabled,plugin_installation_id,capability_id)
+				VALUES($1,$2,$3,$4,$5,$6)`, fixture.folderID, priority, l.level, l.enabled, installations[l.capability], l.capability); err != nil {
+				t.Fatal(err)
+			}
+		}
+	}
+	resolver := NewDBExternalIDResolver(fixture.pool)
+	numbering := func(t *testing.T) string {
+		t.Helper()
+		ids, err := resolver.ResolveForFile(ctx, &models.MediaFile{ID: fixture.fileIDs[0], EpisodeID: episodeID})
+		if err != nil {
+			t.Fatal(err)
+		}
+		return ids.EpisodeNumbering
+	}
+
+	for _, tt := range []struct {
+		name  string
+		chain []link
+		want  string
+	}{
+		{name: "no chain", want: ""},
+		{name: "TVDB first", chain: []link{{"tvdb", "episode", true}, {"tmdb", "episode", true}}, want: "tvdb"},
+		{name: "TMDB first", chain: []link{{"tmdb", "episode", true}, {"tvdb", "episode", true}}, want: "tmdb"},
+		{name: "disabled TVDB is skipped", chain: []link{{"tvdb", "episode", false}, {"tmdb", "episode", true}}, want: "tmdb"},
+		{name: "legacy flat chain", chain: []link{{"tvdb", "", true}, {"tmdb", "", true}}, want: "tvdb"},
+		{name: "per-level chain wins over legacy", chain: []link{{"tvdb", "", true}, {"tmdb", "episode", true}}, want: "tmdb"},
+		{name: "other levels do not count", chain: []link{{"tvdb", "series", true}, {"tmdb", "episode", true}}, want: "tmdb"},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			setChain(t, tt.chain...)
+			if got := numbering(t); got != tt.want {
+				t.Fatalf("numbering = %q, want %q", got, tt.want)
+			}
+		})
+	}
+
+	t.Run("first provider the episode came from", func(t *testing.T) {
+		setChain(t, link{"tvdb", "episode", true}, link{"tmdb", "episode", true})
+		if _, err := fixture.pool.Exec(ctx, `UPDATE episodes SET tvdb_id='' WHERE content_id=$1`, episodeID); err != nil {
+			t.Fatal(err)
+		}
+		if got := numbering(t); got != "tmdb" {
+			t.Fatalf("numbering = %q, want tmdb for an episode TVDB did not supply", got)
+		}
+	})
+}
diff --git a/internal/markers/population_test.go b/internal/markers/population_test.go
index 46834228ab..86dc9bb27a 100644
--- a/internal/markers/population_test.go
+++ b/internal/markers/population_test.go
@@ -3,6 +3,7 @@ package markers
 import (
 	"bytes"
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"log/slog"
@@ -784,3 +785,30 @@ func TestPopulationHoldsAreCapped(t *testing.T) {
 		}
 	})
 }
+
+func TestPopulationIdentityTracksEpisodeIDsButNotTitle(t *testing.T) {
+	file := &models.MediaFile{ID: 7, Duration: 3600}
+	base := ExternalIDs{Kind: ItemKindEpisode, TvdbID: "121361", SeasonNumber: 1, EpisodeNumber: 1}
+	withoutEpisode := populationIdentity(file, base, nil)
+
+	retitled := base
+	retitled.EpisodeTitle = "Winter Is Coming"
+	if got := populationIdentity(file, retitled, nil); got != withoutEpisode {
+		t.Fatal("an episode title changed the lookup identity")
+	}
+	matched := base
+	matched.Episode = EpisodeIDs{TvdbID: "3254641"}
+	if got := populationIdentity(file, matched, nil); got == withoutEpisode {
+		t.Fatal("an episode TVDB ID left the lookup identity unchanged")
+	}
+	// An item without episode IDs, such as a movie, keeps the identity it had
+	// before the field existed, so upgrading does not invalidate its cached
+	// lookups.
+	payload, err := json.Marshal(base)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(string(payload), "Episode\"") {
+		t.Fatalf("identity payload %s names an empty episode", payload)
+	}
+}
diff --git a/internal/markers/resolver.go b/internal/markers/resolver.go
index 28a52913b0..0a0a77fbab 100644
--- a/internal/markers/resolver.go
+++ b/internal/markers/resolver.go
@@ -24,11 +24,32 @@ type ExternalIDs struct {
 	TvdbID        string
 	SeasonNumber  int
 	EpisodeNumber int
+	// Episode names the provider episode records the catalog matched at
+	// SeasonNumber/EpisodeNumber. It is part of the lookup identity because
+	// it can change which provider record a lookup addresses; it is omitted
+	// when empty, so a movie's identity predates the field.
+	Episode EpisodeIDs `json:",omitzero"`
+	// EpisodeNumbering is the external ID key ("tvdb" or "tmdb") of the
+	// provider whose numbering SeasonNumber/EpisodeNumber follow: the first in
+	// the library's episode chain that supplied this episode. Empty when no
+	// such provider supplied it.
+	EpisodeNumbering string `json:",omitempty"`
+	// EpisodeTitle is a hint providers may use to corroborate the episode.
+	// A retitled episode is still the same record, so it is not part of the
+	// lookup identity.
+	EpisodeTitle string `json:"-"`
 	// Released is the episode air date or movie release date, when known.
 	// It sets cache freshness and is not part of the lookup identity.
 	Released time.Time `json:"-"`
 }
 
+// EpisodeIDs holds an episode's own provider IDs, as opposed to its series'.
+type EpisodeIDs struct {
+	TmdbID string `json:",omitempty"`
+	ImdbID string `json:",omitempty"`
+	TvdbID string `json:",omitempty"`
+}
+
 // HasAnyID reports whether at least one usable external identifier is
 // present. Providers should refuse to issue requests when this is false.
 func (e ExternalIDs) HasAnyID() bool {
@@ -37,15 +58,25 @@ func (e ExternalIDs) HasAnyID() bool {
 
 // AsRequestMap exposes the external IDs in the Request.ExternalIDs shape.
 func (e ExternalIDs) AsRequestMap() map[string]string {
+	return requestIDMap(e.TmdbID, e.ImdbID, e.TvdbID)
+}
+
+// AsRequestMap exposes the episode IDs in the Request.EpisodeExternalIDs
+// shape.
+func (e EpisodeIDs) AsRequestMap() map[string]string {
+	return requestIDMap(e.TmdbID, e.ImdbID, e.TvdbID)
+}
+
+func requestIDMap(tmdbID, imdbID, tvdbID string) map[string]string {
 	out := make(map[string]string, 3)
-	if e.TmdbID != "" {
-		out[ExternalIDKeyTMDB] = e.TmdbID
+	if tmdbID != "" {
+		out[ExternalIDKeyTMDB] = tmdbID
 	}
-	if e.ImdbID != "" {
-		out[ExternalIDKeyIMDB] = e.ImdbID
+	if imdbID != "" {
+		out[ExternalIDKeyIMDB] = imdbID
 	}
-	if e.TvdbID != "" {
-		out[ExternalIDKeyTVDB] = e.TvdbID
+	if tvdbID != "" {
+		out[ExternalIDKeyTVDB] = tvdbID
 	}
 	return out
 }
@@ -82,12 +113,20 @@ func (r *DBExternalIDResolver) ResolveForFile(ctx context.Context, file *models.
 	contentID := strings.TrimSpace(file.ContentID)
 
 	if episodeID != "" {
-		// TheIntroDB indexes episode markers by show + season/episode, so we
-		// use series-level external IDs only. Episode IDs identify a different
-		// provider object and cannot substitute for an unmatched show. The episode row's
-		// season/episode numbers are authoritative; the media_files copy
+		// Marker providers index episodes by show + season/episode, so the
+		// series IDs are the identity. The episode's own IDs and title only
+		// refine it: they cannot substitute for an unmatched show. The episode
+		// row's season/episode numbers are authoritative; the media_files copy
 		// can drift during multi-version moves.
+		//
+		// Episode rows merge metadata providers' episodes by number, in the
+		// order of the library's episode chain, so the first provider in that
+		// chain whose ID the row carries is the one whose numbering it
+		// follows. The legacy flat chain applies when the library has no
+		// per-level chain, as metadata.ChainRepository.GetChain does.
 		var showTmdb, showImdb, showTvdb string
+		var episodeIDs EpisodeIDs
+		var title, numbering string
 		var season, episode int
 		var aired *time.Time
 		err := r.pool.QueryRow(ctx, `
@@ -96,12 +135,34 @@ func (r *DBExternalIDResolver) ResolveForFile(ctx context.Context, file *models.
 			       COALESCE(NULLIF(mi.tmdb_id, ''), ''),
 			       COALESCE(NULLIF(mi.imdb_id, ''), ''),
 			       COALESCE(NULLIF(mi.tvdb_id, ''), ''),
-			       e.air_date
+			       COALESCE(BTRIM(e.tmdb_id), ''),
+			       COALESCE(BTRIM(e.imdb_id), ''),
+			       COALESCE(BTRIM(e.tvdb_id), ''),
+			       COALESCE(BTRIM(e.title), ''),
+			       e.air_date,
+			       COALESCE((
+			           SELECT c.capability_id
+			           FROM library_provider_chains c
+			           JOIN plugin_installations pi ON pi.id = c.plugin_installation_id
+			           WHERE c.media_folder_id = (SELECT media_folder_id FROM media_files WHERE id = $2)
+			             AND c.capability_type = 'metadata_provider.v1'
+			             AND c.enabled AND pi.enabled
+			             AND c.content_level = CASE WHEN EXISTS (
+			                     SELECT 1 FROM library_provider_chains l
+			                     WHERE l.media_folder_id = c.media_folder_id AND l.content_level = 'episode'
+			                 ) THEN 'episode' ELSE '' END
+			             AND ((c.capability_id = 'tvdb' AND BTRIM(e.tvdb_id) <> '')
+			               OR (c.capability_id = 'tmdb' AND BTRIM(e.tmdb_id) <> ''))
+			           ORDER BY c.priority
+			           LIMIT 1
+			       ), '')
 			FROM episodes e
 			LEFT JOIN media_items mi ON mi.content_id = e.series_id
-			WHERE e.content_id = $1`, episodeID).Scan(
+			WHERE e.content_id = $1`, episodeID, file.ID).Scan(
 			&season, &episode,
-			&showTmdb, &showImdb, &showTvdb, &aired,
+			&showTmdb, &showImdb, &showTvdb,
+			&episodeIDs.TmdbID, &episodeIDs.ImdbID, &episodeIDs.TvdbID, &title,
+			&aired, &numbering,
 		)
 		if err != nil {
 			if errors.Is(err, pgx.ErrNoRows) {
@@ -116,13 +177,16 @@ func (r *DBExternalIDResolver) ResolveForFile(ctx context.Context, file *models.
 			episode = file.EpisodeNumber
 		}
 		return ExternalIDs{
-			Kind:          ItemKindEpisode,
-			TmdbID:        showTmdb,
-			ImdbID:        showImdb,
-			TvdbID:        showTvdb,
-			SeasonNumber:  season,
-			EpisodeNumber: episode,
-			Released:      dateOrZero(aired),
+			Kind:             ItemKindEpisode,
+			TmdbID:           showTmdb,
+			ImdbID:           showImdb,
+			TvdbID:           showTvdb,
+			SeasonNumber:     season,
+			EpisodeNumber:    episode,
+			Episode:          episodeIDs,
+			EpisodeNumbering: numbering,
+			EpisodeTitle:     title,
+			Released:         dateOrZero(aired),
 		}, nil
 	}
 
diff --git a/internal/markers/types.go b/internal/markers/types.go
index a6f6fe8d69..5ca436f23e 100644
--- a/internal/markers/types.go
+++ b/internal/markers/types.go
@@ -110,7 +110,13 @@ type Request struct {
 	ExternalIDs   map[string]string
 	SeasonNumber  int
 	EpisodeNumber int
-	Duration      time.Duration
+	// EpisodeExternalIDs, EpisodeNumbering, and EpisodeTitle describe the
+	// episode itself (see ExternalIDs); for an episode, ExternalIDs names its
+	// series. They are empty for movies.
+	EpisodeExternalIDs map[string]string
+	EpisodeNumbering   string
+	EpisodeTitle       string
+	Duration           time.Duration
 }
 
 type Result struct {
@@ -140,16 +146,20 @@ type Marker struct {
 
 // SubmissionRequest is a single-segment contribution to an online marker
 // source. Start is nil when the segment begins at the start of the file
-// (intro/recap); End is nil when it runs to the end (credits/preview).
+// (intro/recap); End is nil when it runs to the end (credits/preview). The
+// item fields follow Request.
 type SubmissionRequest struct {
-	Kind          ItemKind
-	ExternalIDs   map[string]string
-	SeasonNumber  int
-	EpisodeNumber int
-	Segment       MarkerKind
-	Start         *time.Duration
-	End           *time.Duration
-	Duration      time.Duration
+	Kind               ItemKind
+	ExternalIDs        map[string]string
+	SeasonNumber       int
+	EpisodeNumber      int
+	EpisodeExternalIDs map[string]string
+	EpisodeNumbering   string
+	EpisodeTitle       string
+	Segment            MarkerKind
+	Start              *time.Duration
+	End                *time.Duration
+	Duration           time.Duration
 }
 
 // SubmissionStatus values returned by a Submitter.
diff --git a/internal/mdblist/discovery.go b/internal/mdblist/discovery.go
index e92590445a..65f62e7b75 100644
--- a/internal/mdblist/discovery.go
+++ b/internal/mdblist/discovery.go
@@ -9,11 +9,14 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"net"
 	"net/http"
 	"net/url"
 	"strings"
 	"sync/atomic"
 	"time"
+
+	"github.com/prairie-server/prairie-server/internal/logredact"
 )
 
 const defaultBaseURL = "https://api.mdblist.com"
@@ -110,14 +113,17 @@ func (c *Client) fetchLists(ctx context.Context, path string, q url.Values) ([]L
 	if !c.Configured() {
 		return nil, ErrNotConfigured
 	}
+	// Redact the key this request sent: the setting can be replaced or
+	// cleared while it's in flight, and the error quotes the key it sent.
+	sentKey := q.Get("apikey")
 	u := c.baseURL + path + "?" + q.Encode()
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, u, nil)
 	if err != nil {
-		return nil, fmt.Errorf("creating mdblist request: %w", err)
+		return nil, fmt.Errorf("creating mdblist request: %w", sanitizeAPIKeyError(err, sentKey))
 	}
 	res, err := c.http.Do(req)
 	if err != nil {
-		return nil, fmt.Errorf("calling mdblist: %w", err)
+		return nil, fmt.Errorf("calling mdblist: %w", sanitizeAPIKeyError(err, sentKey))
 	}
 	defer res.Body.Close()
 	if res.StatusCode == http.StatusUnauthorized || res.StatusCode == http.StatusForbidden {
@@ -151,3 +157,106 @@ func canonicalListURL(user, slug string) string {
 	}
 	return fmt.Sprintf("https://mdblist.com/lists/%s/%s", user, slug)
 }
+
+// sanitizeAPIKeyError keeps the API key out of a request or transport
+// error. logredact masks the apikey parameter in any *url.Error; the key can
+// still appear elsewhere in the text (a transport or proxy quoting the whole
+// request URL), so any remaining raw or query-escaped form is masked too.
+func sanitizeAPIKeyError(err error, apiKey string) error {
+	if err == nil {
+		return nil
+	}
+	return maskAPIKeyError(logredact.SanitizeURLError(err), apiKey)
+}
+
+// maskAPIKeyError wraps err in a redactedError when its message holds the key.
+func maskAPIKeyError(err error, apiKey string) error {
+	if err == nil {
+		return nil
+	}
+	// Prairie: logredact.SanitizeURLError scrubs the outer message of a raw URL
+	// the transport quoted, so the key can survive only in a deeper cause. Mask
+	// whenever any link of the chain holds it, not just the outermost message.
+	if chainHoldsKey(err, apiKey) {
+		masked := redactedError{message: redactAPIKey(err.Error(), apiKey), cause: err, apiKey: apiKey}
+		// A *url.Error asks its Err directly whether it timed out, so a masked
+		// net.Error has to answer too.
+		if ne, ok := err.(net.Error); ok { //nolint:errorlint // url.Error asserts its Err directly, so only err itself counts.
+			return redactedNetError{redactedError: masked, net: ne}
+		}
+		return masked
+	}
+	return err
+}
+
+// chainHoldsKey reports whether err or any error it wraps quotes the key.
+func chainHoldsKey(err error, apiKey string) bool {
+	for e := err; e != nil; e = errors.Unwrap(e) {
+		if msg := e.Error(); redactAPIKey(msg, apiKey) != msg {
+			return true
+		}
+	}
+	return false
+}
+
+// redactedError carries a masked message. It has no Unwrap, so walking the
+// chain with errors.Unwrap cannot reach the unmasked text; errors.Is and
+// errors.As still see the cause, which keeps sentinel matching and net.Error
+// timeout classification working at any depth. What As hands out for a
+// *url.Error or net.Error target is masked too, as either would otherwise
+// quote the key in its own message. Any other target type gets the cause's
+// own value, unmasked: a caller extracting another error type must not log
+// its text.
+type redactedError struct {
+	message string
+	cause   error
+	apiKey  string
+}
+
+func (e redactedError) Error() string        { return e.message }
+func (e redactedError) Is(target error) bool { return errors.Is(e.cause, target) }
+
+func (e redactedError) As(target any) bool {
+	if !errors.As(e.cause, target) {
+		return false
+	}
+	switch found := target.(type) {
+	case **url.Error:
+		if *found != nil {
+			clone := **found
+			clone.URL = redactAPIKey(clone.URL, e.apiKey)
+			clone.Err = maskAPIKeyError(clone.Err, e.apiKey)
+			*found = &clone
+		}
+	case *net.Error:
+		if *found != nil && redactAPIKey((*found).Error(), e.apiKey) != (*found).Error() {
+			*found = redactedNetError{
+				redactedError: redactedError{message: redactAPIKey((*found).Error(), e.apiKey), cause: *found, apiKey: e.apiKey},
+				net:           *found,
+			}
+		}
+	}
+	return true
+}
+
+// redactedNetError is a net.Error with a masked message that still reports
+// the timeout it wraps.
+type redactedNetError struct {
+	redactedError
+	net net.Error
+}
+
+func (e redactedNetError) Timeout() bool   { return e.net.Timeout() }
+func (e redactedNetError) Temporary() bool { return e.net.Temporary() } //nolint:staticcheck // net.Error requires it.
+
+// redactAPIKey masks every occurrence of the API key, raw or query-escaped.
+func redactAPIKey(text, apiKey string) string {
+	if apiKey == "" {
+		return text
+	}
+	text = strings.ReplaceAll(text, apiKey, logredact.Placeholder)
+	if escaped := url.QueryEscape(apiKey); escaped != apiKey {
+		text = strings.ReplaceAll(text, escaped, logredact.Placeholder)
+	}
+	return text
+}
diff --git a/internal/mdblist/discovery_test.go b/internal/mdblist/discovery_test.go
index 4ee9ac8a84..d24377d9f7 100644
--- a/internal/mdblist/discovery_test.go
+++ b/internal/mdblist/discovery_test.go
@@ -3,10 +3,14 @@ package mdblist
 import (
 	"context"
 	"errors"
+	"fmt"
+	"net"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
 	"strings"
 	"testing"
+	"time"
 )
 
 func TestSearchAttachesAPIKeyAndQuery(t *testing.T) {
@@ -88,3 +92,135 @@ func TestSearchSurfacesUpstreamErrors(t *testing.T) {
 		t.Fatal("expected unauthorized error, got nil")
 	}
 }
+
+// assertErrorOmitsAPIKey fails when the key appears anywhere errors.Unwrap
+// can reach, not only in the top-level message. It never prints the key.
+func assertErrorOmitsAPIKey(t *testing.T, err error, apiKey string) {
+	t.Helper()
+	if err == nil {
+		t.Fatal("expected an error")
+	}
+	for e := err; e != nil; e = errors.Unwrap(e) {
+		if msg := e.Error(); strings.Contains(msg, apiKey) {
+			t.Fatalf("error chain leaks the API key: %q", strings.ReplaceAll(msg, apiKey, "[KEY]"))
+		}
+		// What errors.As hands out must be masked too.
+		var urlErr *url.Error
+		if errors.As(e, &urlErr) {
+			for _, text := range []string{urlErr.URL, urlErr.Error(), errorText(urlErr.Err)} {
+				if strings.Contains(text, apiKey) {
+					t.Fatalf("url.Error from errors.As leaks the API key: %q", strings.ReplaceAll(text, apiKey, "[KEY]"))
+				}
+			}
+		}
+		var netErr net.Error
+		if errors.As(e, &netErr) && strings.Contains(netErr.Error(), apiKey) {
+			t.Fatalf("net.Error from errors.As leaks the API key: %q", strings.ReplaceAll(netErr.Error(), apiKey, "[KEY]"))
+		}
+	}
+}
+
+func TestTransportErrorOmitsAPIKey(t *testing.T) {
+	secretKey := "super-secret-mdblist-key-12345"
+	c := NewClient(secretKey, &http.Client{})
+	c.baseURL = "http://127.0.0.1:0"
+
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+
+	_, err := c.Search(ctx, "test")
+	assertErrorOmitsAPIKey(t, err, secretKey)
+}
+
+// urlQuotingTransport fails every request with an error that quotes the full
+// request URL, as some transports and proxies do.
+type urlQuotingTransport struct{ cause error }
+
+func (t urlQuotingTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	return nil, fmt.Errorf("dial %s: %w", req.URL, t.cause)
+}
+
+// urlTimeoutError is a net.Error timeout whose message quotes the request
+// URL, key included, as a transport's own timeout error can.
+type urlTimeoutError struct{ url string }
+
+func (e urlTimeoutError) Error() string { return "read " + e.url + ": i/o timeout" }
+func (urlTimeoutError) Timeout() bool   { return true }
+func (urlTimeoutError) Temporary() bool { return true }
+
+type timeoutTransport struct{}
+
+func (timeoutTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	return nil, urlTimeoutError{url: req.URL.String()}
+}
+
+func TestTransportErrorRedactsAPIKeyInWrappedError(t *testing.T) {
+	secretKey := "super-secret-mdblist-key-12345"
+	cause := errors.New("connection refused")
+	c := NewClient(secretKey, &http.Client{Transport: urlQuotingTransport{cause: cause}})
+
+	_, err := c.Search(context.Background(), "test")
+	assertErrorOmitsAPIKey(t, err, secretKey)
+	// The transport quoted the URL in its own text; Prairie's logredact drops
+	// the apikey parameter there rather than printing a REDACTED marker.
+	if strings.Contains(err.Error(), "apikey=") {
+		t.Fatalf("expected the apikey parameter gone from the sanitized error: %q", strings.ReplaceAll(err.Error(), secretKey, "[KEY]"))
+	}
+	if !errors.Is(err, cause) {
+		t.Fatalf("sanitized error no longer matches its cause: %q", strings.ReplaceAll(err.Error(), secretKey, "[KEY]"))
+	}
+}
+
+// keyChangingTransport replaces the client's key while the request is in
+// flight, as a settings reload can, then fails with an error that quotes the
+// key the request sent outside any URL.
+type keyChangingTransport struct {
+	client *Client
+	newKey string
+}
+
+func (t keyChangingTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	t.client.SetAPIKey(t.newKey)
+	return nil, fmt.Errorf("proxy rejected apikey %s", req.URL.Query().Get("apikey"))
+}
+
+func TestTransportErrorRedactsTheKeySentAfterASettingsReload(t *testing.T) {
+	sentKey := "super-secret-mdblist-key-12345"
+	for name, newKey := range map[string]string{"replaced": "another-mdblist-key-67890", "cleared": ""} {
+		t.Run(name, func(t *testing.T) {
+			c := NewClient(sentKey, nil)
+			c.http = &http.Client{Transport: keyChangingTransport{client: c, newKey: newKey}}
+
+			_, err := c.Search(context.Background(), "test")
+			assertErrorOmitsAPIKey(t, err, sentKey)
+		})
+	}
+}
+
+func TestTransportErrorKeepsTimeoutClassification(t *testing.T) {
+	secretKey := "super-secret-mdblist-key-12345"
+	c := NewClient(secretKey, &http.Client{Transport: timeoutTransport{}})
+
+	_, err := c.Search(context.Background(), "test")
+	assertErrorOmitsAPIKey(t, err, secretKey)
+	var netErr net.Error
+	if !errors.As(err, &netErr) || !netErr.Timeout() {
+		t.Fatalf("sanitized error lost its timeout classification: %q", strings.ReplaceAll(err.Error(), secretKey, "[KEY]"))
+	}
+	// The *url.Error As hands out is masked, and still classifies its cause.
+	var urlErr *url.Error
+	if !errors.As(err, &urlErr) {
+		t.Fatalf("no *url.Error in %q", strings.ReplaceAll(err.Error(), secretKey, "[KEY]"))
+	}
+	assertErrorOmitsAPIKey(t, urlErr, secretKey)
+	if !urlErr.Timeout() || !urlErr.Temporary() { //nolint:staticcheck // Temporary is what's being preserved.
+		t.Fatalf("masked *url.Error: Timeout %v, Temporary %v; want both", urlErr.Timeout(), urlErr.Temporary()) //nolint:staticcheck // as above.
+	}
+}
+
+func errorText(err error) string {
+	if err == nil {
+		return ""
+	}
+	return err.Error()
+}
diff --git a/internal/mediasample/args.go b/internal/mediasample/args.go
index ef30708eb0..62bcdecc17 100644
--- a/internal/mediasample/args.go
+++ b/internal/mediasample/args.go
@@ -61,6 +61,9 @@ func buildArgs(req Request, attempt Attempt, hw hardwareDecode, inputStart float
 		if req.Stats == nil {
 			return nil, nil, errors.New("hardware decode needs a video output")
 		}
+		if !SupportsHardwareDecode(hw.Accel) {
+			return nil, nil, fmt.Errorf("hardware decode does not support %q", hw.Accel)
+		}
 		var err error
 		if decode, err = hardwareDecodeArgs(hw, true); err != nil {
 			return nil, nil, err
@@ -81,7 +84,7 @@ func buildArgs(req Request, attempt Attempt, hw hardwareDecode, inputStart float
 		return buildSamplesArgs(req, attempt, hw, append(args, decode...), inputStart)
 	}
 	if req.Window.KeyframesOnly {
-		args = append(args, "-skip_frame:v", "nokey")
+		args = append(args, skipFrameOption, keyframeSkipFrame)
 	}
 	args = append(args, decode...)
 	args = append(args,
@@ -156,12 +159,13 @@ func buildSamplesArgs(req Request, attempt Attempt, hw hardwareDecode, args []st
 }
 
 // buildSheetsArgs builds the arguments of a Sheets request whose video chain
-// is graph (see buildSheetsGraph). A Samples request reads its list as
-// buildSamplesArgs does and returns the list for stdin; a Window request,
-// which a Samples request becomes for inputs the list cannot seek in, decodes
-// the window's keyframes. Either way the frames go to stdout raw, and hardware
+// is graph (see buildSheetsGraph). A Samples request reads a list of entries
+// as buildSamplesArgs does, each lasting and its decoder skipping frames as
+// list says, and returns the list for stdin; a Window request, which a
+// Samples request becomes for inputs the list cannot seek in, decodes the
+// window's keyframes. Either way the frames go to stdout raw, and hardware
 // attempts leave VideoToolbox frames in system memory, as images do.
-func buildSheetsArgs(req Request, attempt Attempt, hw hardwareDecode, inputStart float64, graph, packetTimingPath string) ([]string, []byte, error) {
+func buildSheetsArgs(req Request, attempt Attempt, hw hardwareDecode, entries []listEntry, graph, packetTimingPath string, list sheetsList) ([]string, []byte, error) {
 	if (req.Window == nil) == (req.Samples == nil) || req.Sheets == nil {
 		return nil, nil, errors.New("sheets need exactly one sampling mode")
 	}
@@ -178,19 +182,26 @@ func buildSheetsArgs(req Request, attempt Attempt, hw hardwareDecode, inputStart
 		args = append(args, "-threads", threads, "-filter_threads", threads)
 	}
 	if req.Samples != nil {
-		list, err := buildConcatListSpan(req.Input, req.Samples.Seconds, inputStart, sheetSampleSpanSeconds)
+		concat, err := buildConcatListSpan(req.Input, entries, list.span)
 		if err != nil {
 			return nil, nil, err
 		}
 		args = append(args, decode...)
-		args = append(args, concatInputArgs...)
+		args = append(args, req.keyframeInputArgs(list.skip)...)
+		args = append(args, concatDemuxerArgs...)
 		args = append(args, "-i", concatListInput)
-		return append(args, sheetsOutputArgs(graph)...), list, nil
+		return append(args, sheetsOutputArgs(graph)...), concat, nil
 	}
 	// The window's duration bounds the input, not the output: an output -t
 	// drops frames after the filters logged them, and the log would no
 	// longer count the frames on stdout.
-	args = append(args, "-skip_frame:v", "nokey")
+	skip := keyframeSkipFrame
+	if req.Window.referencePictures {
+		// Non-keyframes are decoded only to keep the decoder's state; the
+		// graph still sees just the keyframes a keyframes-only read gives.
+		skip, graph = exactSkipFrame, "select=key,"+graph
+	}
+	args = append(args, req.keyframeInputArgs(skip)...)
 	args = append(args, decode...)
 	args = append(args,
 		"-ss", formatSeconds(req.Window.StartSeconds),
diff --git a/internal/mediasample/concat.go b/internal/mediasample/concat.go
index 3ec481dc13..4e4aa9b7e6 100644
--- a/internal/mediasample/concat.go
+++ b/internal/mediasample/concat.go
@@ -21,8 +21,9 @@ import (
 // Inpoints are container timestamps, while sample times, like window starts,
 // count from the start of the file, so each inpoint is the sample time plus
 // the input's start time (see probe.go). Only containers whose index lets
-// the demuxer seek to a keyframe are read this way; see runSamples for the
-// others.
+// the demuxer seek to a keyframe are read this way; see attemptRun.samples
+// for the others. A Sheets list over a Matroska input starts its entries at
+// the samples' keyframes instead (see keyframes.go).
 //
 // The list is read from pipe:0, so relative entries would resolve against
 // the pipe URL: each entry names the input as an explicit file: URL, and the
@@ -37,8 +38,15 @@ const sampleSpanSeconds = 0.04
 // sampleMetadataKey is the packet metadata entry naming a sample's time.
 const sampleMetadataKey = "sample"
 
-// concatInputArgs are the input options of a Samples request, before -i.
-var concatInputArgs = []string{"-skip_frame:v", "nokey", "-protocol_whitelist", "file,pipe", "-f", "concat", "-safe", "0"}
+// skipFrameOption sets which video frames the decoder skips.
+const skipFrameOption = "-skip_frame:v"
+
+// concatDemuxerArgs open a list input; concatInputArgs are the input options
+// of a Samples request, before -i.
+var (
+	concatDemuxerArgs = []string{"-protocol_whitelist", "file,pipe", "-f", "concat", "-safe", "0"}
+	concatInputArgs   = append([]string{skipFrameOption, keyframeSkipFrame}, concatDemuxerArgs...)
+)
 
 // concatListInput is the input a Samples request reads its list from.
 const concatListInput = "pipe:0"
@@ -52,29 +60,46 @@ const concatListInput = "pipe:0"
 // wins. Stats keep the span their cached analyses were computed with.
 const sheetSampleSpanSeconds = 0.5
 
+// listEntry is one entry of a list: the sample time its packets are tagged
+// with, and its inpoint in the container.
+type listEntry struct {
+	sample  float64
+	inpoint float64
+}
+
+// sampleEntries starts each sample's entry at its own time, offset by
+// inputStart, the input's container start time. A slightly negative start, as
+// some MP4 edit lists give, would put the first inpoints before the file;
+// they seek to its start anyway.
+func sampleEntries(seconds []float64, inputStart float64) []listEntry {
+	entries := make([]listEntry, len(seconds))
+	for i, at := range seconds {
+		entries[i] = listEntry{sample: at, inpoint: math.Max(0, at+inputStart)}
+	}
+	return entries
+}
+
 // buildConcatList returns the ffconcat list sampling input, whose container
 // timestamps start at inputStart, at each time, each entry lasting
 // sampleSpanSeconds.
 func buildConcatList(input string, seconds []float64, inputStart float64) ([]byte, error) {
-	return buildConcatListSpan(input, seconds, inputStart, sampleSpanSeconds)
+	return buildConcatListSpan(input, sampleEntries(seconds, inputStart), sampleSpanSeconds)
 }
 
-// buildConcatListSpan is buildConcatList with entries lasting span seconds.
-func buildConcatListSpan(input string, seconds []float64, inputStart, span float64) ([]byte, error) {
+// buildConcatListSpan returns the ffconcat list reading input's entries, each
+// lasting span seconds.
+func buildConcatListSpan(input string, entries []listEntry, span float64) ([]byte, error) {
 	quoted, err := concatPath(input)
 	if err != nil {
 		return nil, err
 	}
 	var list bytes.Buffer
 	list.WriteString("ffconcat version 1.0\n")
-	for _, at := range seconds {
-		// A slightly negative start, as some MP4 edit lists give, would put
-		// the first inpoints before the file; they seek to its start anyway.
-		inpoint := math.Max(0, at+inputStart)
+	for _, entry := range entries {
 		list.WriteString("file " + quoted + "\n")
-		list.WriteString("file_packet_meta " + sampleMetadataKey + " " + formatSampleSeconds(at) + "\n")
-		list.WriteString("inpoint " + formatSampleSeconds(inpoint) + "\n")
-		list.WriteString("outpoint " + formatSampleSeconds(inpoint+span) + "\n")
+		list.WriteString("file_packet_meta " + sampleMetadataKey + " " + formatSampleSeconds(entry.sample) + "\n")
+		list.WriteString("inpoint " + formatSampleSeconds(entry.inpoint) + "\n")
+		list.WriteString("outpoint " + formatSampleSeconds(entry.inpoint+span) + "\n")
 	}
 	return list.Bytes(), nil
 }
diff --git a/internal/mediasample/concat_test.go b/internal/mediasample/concat_test.go
index 6baf7c5f49..fdffa1b150 100644
--- a/internal/mediasample/concat_test.go
+++ b/internal/mediasample/concat_test.go
@@ -233,8 +233,8 @@ func TestInputHeaderParser(t *testing.T) {
 		log  string
 		want inputInfo
 	}{
-		"matroska with a start": {probeHeaderLog("matroska,webm", "11.400000"), inputInfo{Formats: []string{"matroska", "webm"}, StartSeconds: 11.4, AspectRatio: 16.0 / 9}},
-		"mp4 starting early":    {probeHeaderLog("mov,mp4,m4a,3gp,3g2,mj2", "-0.042000"), inputInfo{Formats: []string{"mov", "mp4", "m4a", "3gp", "3g2", "mj2"}, StartSeconds: -0.042, AspectRatio: 16.0 / 9}},
+		"matroska with a start": {probeHeaderLog("matroska,webm", "11.400000"), inputInfo{Formats: []string{"matroska", "webm"}, StartSeconds: 11.4, AspectRatio: 16.0 / 9, VideoCodec: "h264"}},
+		"mp4 starting early":    {probeHeaderLog("mov,mp4,m4a,3gp,3g2,mj2", "-0.042000"), inputInfo{Formats: []string{"mov", "mp4", "m4a", "3gp", "3g2", "mj2"}, StartSeconds: -0.042, AspectRatio: 16.0 / 9, VideoCodec: "h264"}},
 		"no start":              {"Input #0, avi, from 'a.avi':\n  Duration: N/A, bitrate: N/A\n", inputInfo{Formats: []string{"avi"}}},
 		"no header":             {"[in#0 @ 0x1] Error opening input: No such file or directory\n", inputInfo{}},
 	} {
diff --git a/internal/mediasample/ffmpeg_test.go b/internal/mediasample/ffmpeg_test.go
index e192d6316a..df1ba8c33e 100644
--- a/internal/mediasample/ffmpeg_test.go
+++ b/internal/mediasample/ffmpeg_test.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"image"
 	"image/jpeg"
+	"io"
 	"math"
 	"os/exec"
 	"path/filepath"
@@ -334,11 +335,12 @@ func TestRunSheetsWithRealFFmpeg(t *testing.T) {
 // seconds apart: 256 frames, a whole cycle of the 8-bit picture order count.
 // After each jump through a list the decoder computes the previous
 // keyframe's count again and drops the keyframe as a duplicate. With a
-// keyframe every 64 frames, the window that reads the samples again decodes
-// every keyframe, and every sample must show its scene. With a keyframe every
-// 256 frames the keyframes collide in the window too, since skipped pictures
-// do not advance the count, and the run must fail rather than repeat the
-// first scene.
+// keyframe every 64 frames, the repair that lists the lost samples again
+// decodes every keyframe. With a keyframe every 256 frames the keyframes
+// collide in the repair and in the keyframes-only window that reads the
+// samples again too, since skipped pictures do not advance the count, and
+// the window that decodes every reference picture finds them all. Either
+// way every sample must show its own scene, never an earlier one.
 func TestRunSheetsOpenGOPHEVCWithRealFFmpeg(t *testing.T) {
 	ffmpeg, caps := realFFmpeg(t)
 	grays := []int{20, 60, 100, 140, 180, 220}
@@ -370,17 +372,19 @@ func TestRunSheetsOpenGOPHEVCWithRealFFmpeg(t *testing.T) {
 			ctx, cancel := context.WithTimeout(t.Context(), time.Minute)
 			defer cancel()
 			result, err := Runner{FFmpegPath: ffmpeg, Workload: processmetrics.Trickplay}.Run(ctx, req)
-			if keyint == 256 {
-				if failure, ok := errors.AsType[*Error](err); !ok || failure.Reason != ReasonEmpty {
-					t.Fatalf("got frames %+v, error %v; want the run to fail as empty", result.SheetFrames, err)
-				}
-				return
-			}
 			if err != nil {
 				t.Fatalf("run: %v", err)
 			}
-			if len(result.Sheets) != 1 || result.SheetFrames != (SheetFrames{Decoded: 6}) {
-				t.Fatalf("got %d sheets, frames %+v; want 1 sheet of 6 decoded samples", len(result.Sheets), result.SheetFrames)
+			// With 64-frame GOPs the list loses the keyframes after its
+			// first jump, and the repair, which lists them again, finds
+			// every one. With 256-frame GOPs the reference-picture window
+			// decodes every sample's keyframe, so nothing is repaired.
+			want := SheetFrames{Decoded: 6, Refined: 5}
+			if keyint == 256 {
+				want = SheetFrames{Decoded: 6}
+			}
+			if len(result.Sheets) != 1 || result.SheetFrames != want {
+				t.Fatalf("got %d sheets, frames %+v; want 1 sheet, frames %+v", len(result.Sheets), result.SheetFrames, want)
 			}
 			img, err := jpeg.Decode(bytes.NewReader(result.Sheets[0].JPEG))
 			if err != nil {
@@ -451,6 +455,68 @@ func TestRunSheetsRejectsPrematureEOFWithRealFFmpeg(t *testing.T) {
 	}
 }
 
+// TestRunSheetsAVIKeyframeTimesWithRealFFmpeg reads six ten-second gray
+// scenes from AVI files with B-frames, whose packets carry no PTS, sampled
+// three seconds into each scene. MPEG-4 Part 2 (XviD) decodes with low
+// delay, so every cell shows its own scene. H.264 releases each keyframe two
+// GOPs late in a keyframes-only read, and its cells would show the scene
+// before, so the run must fail rather than publish them.
+func TestRunSheetsAVIKeyframeTimesWithRealFFmpeg(t *testing.T) {
+	ffmpeg, _ := realFFmpeg(t)
+	grays := []int{20, 60, 100, 140, 180, 220}
+	var sources, inputs []string
+	for i, gray := range grays {
+		sources = append(sources, "-f", "lavfi", "-i", fmt.Sprintf("color=c=0x%02x%02x%02x:s=640x266:r=24:d=10", gray, gray, gray))
+		inputs = append(inputs, fmt.Sprintf("[%d:v]", i))
+	}
+	for name, encoder := range map[string][]string{
+		// AVI's default encoder is MPEG-4 Part 2.
+		"xvid": {"-vtag", "XVID", "-bf", "2", "-q:v", "3"},
+		"h264": {"-c:v", "libx264", "-bf", "3", "-sc_threshold", "0"},
+	} {
+		t.Run(name, func(t *testing.T) {
+			clip := filepath.Join(t.TempDir(), "clip.avi")
+			args := append([]string{"-hide_banner", "-loglevel", "error"}, sources...)
+			args = append(args, "-filter_complex", strings.Join(inputs, "")+"concat=n=6:v=1:a=0,format=yuv420p[v]", "-map", "[v]",
+				"-g", "48", "-keyint_min", "48", "-threads", "1")
+			if output, err := exec.Command(ffmpeg, append(append(args, encoder...), clip)...).CombinedOutput(); err != nil {
+				t.Skipf("cannot generate the clip: %v: %s", err, output)
+			}
+			req := Request{
+				Input:   clip,
+				Samples: &Samples{Seconds: []float64{3, 13, 23, 33, 43, 53}, ReadThrough: true},
+				Sheets:  &SheetsOutput{TileWidth: 64, TileHeight: 26, Columns: 2, Rows: 2, Quality: 90},
+				Threads: 1,
+			}
+			ctx, cancel := context.WithTimeout(t.Context(), time.Minute)
+			defer cancel()
+			result, err := Runner{FFmpegPath: ffmpeg, Workload: processmetrics.Thumbnail}.Run(ctx, req)
+			if name == "h264" {
+				if err == nil {
+					t.Fatalf("published frames %+v, want the run to fail", result.SheetFrames)
+				}
+				return
+			}
+			if err != nil || len(result.Sheets) != 2 || result.SheetFrames != (SheetFrames{Decoded: 6}) {
+				t.Fatalf("frames %+v, %d sheets, error %v; want 6 decoded samples on 2 sheets", result.SheetFrames, len(result.Sheets), err)
+			}
+			for i, sheet := range result.Sheets {
+				img, err := jpeg.Decode(bytes.NewReader(sheet.JPEG))
+				if err != nil {
+					t.Fatalf("sheet %d: %v", i, err)
+				}
+				ycc := img.(*image.YCbCr)
+				for slot := range min(4, len(grays)-i*4) {
+					x, y := (slot%2)*64+32, (slot/2)*26+13
+					if got, want := int(ycc.Y[ycc.YOffset(x, y)]), grays[i*4+slot]; got < want-4 || got > want+4 {
+						t.Fatalf("sheet %d cell %d luma %d, want %d", i, slot, got, want)
+					}
+				}
+			}
+		})
+	}
+}
+
 // TestRunSheetsToneMapsHDRWithRealFFmpeg tiles a generated 10-bit PQ clip
 // with software tone mapping; the sheet must come out, not black.
 func TestRunSheetsToneMapsHDRWithRealFFmpeg(t *testing.T) {
@@ -495,3 +561,191 @@ func TestRunSheetsToneMapsHDRWithRealFFmpeg(t *testing.T) {
 		t.Fatalf("tone-mapped sheet has mean luma %d, want a visible picture", mean)
 	}
 }
+
+// TestRunSheetsRepairsLongGOPWithRealFFmpeg samples a clip whose brightness
+// follows the clock, with a keyframe every 25 seconds, ten seconds apart.
+// The list gives several samples the same keyframe, and the repair decodes
+// each of them at its own time, so every cell shows its sample's moment.
+func TestRunSheetsRepairsLongGOPWithRealFFmpeg(t *testing.T) {
+	ffmpeg, caps := realFFmpeg(t)
+	clip := filepath.Join(t.TempDir(), "long-gop.mkv")
+	args := []string{"-hide_banner", "-loglevel", "error", "-f", "lavfi", "-i", "nullsrc=s=64x36:r=24:d=60,geq=lum='clip(4*T\\,0\\,255)':cb=128:cr=128",
+		"-c:v", "libx264", "-threads", "1", "-g", "600", "-keyint_min", "600", "-sc_threshold", "0", "-bf", "2", clip}
+	if output, err := exec.Command(ffmpeg, args...).CombinedOutput(); err != nil {
+		t.Skipf("cannot encode the clip with libx264: %v: %s", err, output)
+	}
+	seconds := []float64{5, 15, 25, 35, 45, 55}
+	req := Request{
+		Input:   clip,
+		Samples: &Samples{Seconds: seconds},
+		Sheets:  &SheetsOutput{TileWidth: 64, TileHeight: 36, Columns: 3, Rows: 2, Quality: 90},
+		Threads: 1,
+	}
+	if err := caps.Require(req); err != nil {
+		t.Skipf("ffmpeg cannot sample sheets: %v", err)
+	}
+	ctx, cancel := context.WithTimeout(t.Context(), time.Minute)
+	defer cancel()
+	result, err := Runner{FFmpegPath: ffmpeg, Workload: processmetrics.Trickplay}.Run(ctx, req)
+	if err != nil {
+		t.Fatalf("run: %v", err)
+	}
+	// Keyframes at 0, 25, and 50 s serve the samples at 5, 25, and 55 s; the
+	// other three repeat them until repaired.
+	if result.SheetFrames != (SheetFrames{Decoded: 6, Refined: 3}) {
+		t.Fatalf("frames %+v, want 6 decoded, 3 of them repaired", result.SheetFrames)
+	}
+	img, err := jpeg.Decode(bytes.NewReader(result.Sheets[0].JPEG))
+	if err != nil {
+		t.Fatal(err)
+	}
+	ycc := img.(*image.YCbCr)
+	// The moment each cell shows: its own keyframe for the samples at 5, 25,
+	// and 55 s, and the repaired samples' own times.
+	shown := []float64{0, 15, 25, 35, 45, 50}
+	for cell, at := range shown {
+		x, y := (cell%3)*64+32, (cell/3)*36+18
+		// geq writes limited-range luma, which the sheet expands to full.
+		want := math.Max(0, (4*at-16)*255/219)
+		if got := float64(ycc.Y[ycc.YOffset(x, y)]); math.Abs(got-want) > 6 {
+			t.Errorf("cell %d: luma %g, want about %g, the frame at %g s", cell, got, want, at)
+		}
+	}
+}
+
+// TestRunSheetsSharedKeyframesWithRealFFmpeg samples six flat 10-second
+// shades in H.264 Matroska with one keyframe every 40 seconds, every 10
+// seconds from 5. The list starts entries at the keyframes at 0 and 40 s,
+// read from the Cues, and the four samples that share one show the cell
+// before until the repair decodes their own moment, so every cell shows its
+// sample's shade. A list of sample-time entries decodes the shared keyframe
+// from before each later entry's inpoint, where ffmpeg rewrites its time: the
+// third sample's cell then looks unlike the second's, is not repaired, and
+// keeps the first shade. A copy shifted to start at 11.4 s gives the same
+// cells.
+func TestRunSheetsSharedKeyframesWithRealFFmpeg(t *testing.T) {
+	ffmpeg, caps := realFFmpeg(t)
+	grays := []int{20, 60, 100, 140, 180, 220}
+	var sources []string
+	var inputs []string
+	for i, gray := range grays {
+		sources = append(sources, "-f", "lavfi", "-i", fmt.Sprintf("color=c=0x%02x%02x%02x:s=64x36:r=25:d=10", gray, gray, gray))
+		inputs = append(inputs, fmt.Sprintf("[%d:v]", i))
+	}
+	dir := t.TempDir()
+	clip := filepath.Join(dir, "long-gop.mkv")
+	args := append([]string{"-hide_banner", "-loglevel", "error"}, sources...)
+	args = append(args, "-filter_complex", strings.Join(inputs, "")+"concat=n=6:v=1:a=0,format=yuv420p[v]", "-map", "[v]",
+		"-c:v", "libx264", "-threads", "1", "-g", "1000", "-keyint_min", "1000", "-sc_threshold", "0", "-bf", "2", clip)
+	if output, err := exec.Command(ffmpeg, args...).CombinedOutput(); err != nil {
+		t.Skipf("cannot encode the clip with libx264: %v: %s", err, output)
+	}
+	shifted := filepath.Join(dir, "shifted.mkv")
+	if output, err := exec.Command(ffmpeg, "-hide_banner", "-loglevel", "error", "-i", clip, "-c", "copy", "-output_ts_offset", "11.4", shifted).CombinedOutput(); err != nil {
+		t.Skipf("cannot shift the clip: %v: %s", err, output)
+	}
+	for name, input := range map[string]string{"matroska": clip, "shifted": shifted} {
+		t.Run(name, func(t *testing.T) {
+			req := Request{
+				Input:   input,
+				Samples: &Samples{Seconds: secondsFrom(5, 10, 6)},
+				Sheets:  &SheetsOutput{TileWidth: 64, TileHeight: 36, Columns: 3, Rows: 2, Quality: 90},
+				Threads: 1,
+			}
+			if err := caps.Require(req); err != nil {
+				t.Skipf("ffmpeg cannot sample sheets: %v", err)
+			}
+			if keyframes := sheetKeyframes(t.Context(), req); len(keyframes) != 2 {
+				t.Fatalf("keyframes %v, want the two the Cues list", keyframes)
+			}
+			ctx, cancel := context.WithTimeout(t.Context(), time.Minute)
+			defer cancel()
+			result, err := Runner{FFmpegPath: ffmpeg, Workload: processmetrics.Trickplay}.Run(ctx, req)
+			if err != nil {
+				t.Fatalf("run: %v", err)
+			}
+			if result.SheetFrames != (SheetFrames{Decoded: 6, Refined: 4}) {
+				t.Fatalf("frames %+v, want 6 decoded, the 4 that share a keyframe repaired", result.SheetFrames)
+			}
+			img, err := jpeg.Decode(bytes.NewReader(result.Sheets[0].JPEG))
+			if err != nil {
+				t.Fatal(err)
+			}
+			ycc := img.(*image.YCbCr)
+			for cell, gray := range grays {
+				x, y := (cell%3)*64+32, (cell/3)*36+18
+				if got := int(ycc.Y[ycc.YOffset(x, y)]); got < gray-6 || got > gray+6 {
+					t.Errorf("cell %d luma %d, want %d", cell, got, gray)
+				}
+			}
+		})
+	}
+}
+
+// TestRunSheetsAbandonsReorderedKeyframesWithRealFFmpeg samples open-GOP
+// HEVC with a keyframe every 10 seconds, as x265 encodes by default, every 10
+// seconds. Jumping from keyframe to keyframe, the decoder derives picture
+// order counts that run backwards and passes on keyframes out of list order,
+// so the keyframe list is abandoned and the samples read from their own
+// times: the cells match a run without keyframe entries.
+func TestRunSheetsAbandonsReorderedKeyframesWithRealFFmpeg(t *testing.T) {
+	ffmpeg, caps := realFFmpeg(t)
+	grays := []int{20, 60, 100, 140, 180, 220}
+	var sources []string
+	var inputs []string
+	for i, gray := range grays {
+		sources = append(sources, "-f", "lavfi", "-i", fmt.Sprintf("color=c=0x%02x%02x%02x:s=128x72:r=25:d=10", gray, gray, gray))
+		inputs = append(inputs, fmt.Sprintf("[%d:v]", i))
+	}
+	clip := filepath.Join(t.TempDir(), "open-gop.mkv")
+	args := append([]string{"-hide_banner", "-loglevel", "error"}, sources...)
+	args = append(args, "-filter_complex", strings.Join(inputs, "")+"concat=n=6:v=1:a=0,format=yuv420p[v]", "-map", "[v]",
+		"-c:v", "libx265", "-preset", "ultrafast",
+		"-x265-params", "keyint=250:min-keyint=250:scenecut=0:open-gop=1:bframes=3:log2-max-poc-lsb=8:log-level=error", clip)
+	if output, err := exec.Command(ffmpeg, args...).CombinedOutput(); err != nil {
+		t.Skipf("cannot encode the clip with libx265: %v: %s", err, output)
+	}
+	req := Request{
+		Input:   clip,
+		Samples: &Samples{Seconds: secondsFrom(5, 10, 6)},
+		Sheets:  &SheetsOutput{TileWidth: 64, TileHeight: 36, Columns: 3, Rows: 2, Quality: 90},
+		Threads: 1,
+	}
+	if err := caps.Require(req); err != nil {
+		t.Skipf("ffmpeg cannot sample sheets: %v", err)
+	}
+	run := func(t *testing.T) (Result, []string) {
+		var lists []string
+		runner := Runner{FFmpegPath: ffmpeg, Exec: func(ctx context.Context, name string, args []string, stdin io.Reader, stdout, stderr io.Writer) error {
+			cmd := exec.CommandContext(ctx, name, args...)
+			if stdin != nil {
+				list, err := io.ReadAll(stdin)
+				if err != nil {
+					return err
+				}
+				lists = append(lists, string(list))
+				cmd.Stdin = bytes.NewReader(list)
+			}
+			cmd.Stdout, cmd.Stderr = stdout, stderr
+			return cmd.Run()
+		}}
+		ctx, cancel := context.WithTimeout(t.Context(), time.Minute)
+		defer cancel()
+		result, err := runner.Run(ctx, req)
+		if err != nil {
+			t.Fatalf("run: %v", err)
+		}
+		return result, lists
+	}
+	result, lists := run(t)
+	if len(lists) < 2 || !strings.Contains(lists[0], "inpoint 0\n") || !strings.Contains(lists[1], "inpoint 5\n") {
+		t.Fatalf("lists %q, want a keyframe list and then a sample-time list", lists)
+	}
+	previous := lookupKeyframes
+	lookupKeyframes = func(context.Context, string) []float64 { return nil }
+	t.Cleanup(func() { lookupKeyframes = previous })
+	want, _ := run(t)
+	if result.SheetFrames != want.SheetFrames || !bytes.Equal(result.Sheets[0].JPEG, want.Sheets[0].JPEG) {
+		t.Fatalf("frames %+v, want %+v and the same sheet as sample-time entries give", result.SheetFrames, want.SheetFrames)
+	}
+}
diff --git a/internal/mediasample/hwdecode.go b/internal/mediasample/hwdecode.go
index 7f2f693db6..1bf12b1dfe 100644
--- a/internal/mediasample/hwdecode.go
+++ b/internal/mediasample/hwdecode.go
@@ -8,15 +8,32 @@ import (
 
 // Hardware decode backends a hardware attempt can use, named as
 // playback.ResolveHWAccelWithFFmpegContext resolves the configured
-// accelerator. NVENC is not among them: nothing here decodes on CUDA.
+// accelerator. NVENC decodes on CUDA, and only Sheets outputs use it (see
+// SupportsHardwareSheets): the stats chains intro fingerprints are cached
+// from, and the images of chapter thumbnails, stay as they were.
 const (
 	hwAccelQSV          = "qsv"
 	hwAccelVAAPI        = "vaapi"
 	hwAccelVideoToolbox = "videotoolbox"
+	hwAccelNVENC        = "nvenc"
 )
 
-// hwaccelOption selects ffmpeg's hardware decoder.
-const hwaccelOption = "-hwaccel"
+// cudaDeviceAlias names the CUDA device a CUDA attempt declares, which its
+// decoder and filters share.
+const cudaDeviceAlias = "cu"
+
+// hwaccelOption selects ffmpeg's hardware decoder, and
+// hwaccelOutputFormatOption the frames it decodes into.
+// initHWDeviceOption declares a hardware device, and filterHWDeviceOption
+// names the one filters use. cudaHWAccel is the CUDA decoder and surface
+// format.
+const (
+	hwaccelOption             = "-hwaccel"
+	hwaccelOutputFormatOption = "-hwaccel_output_format"
+	initHWDeviceOption        = "-init_hw_device"
+	filterHWDeviceOption      = "-filter_hw_device"
+	cudaHWAccel               = "cuda"
+)
 
 // hwDownloadFilter copies a decoded VAAPI surface to system memory as 8-bit
 // 4:2:0.
@@ -40,10 +57,28 @@ func SupportsHardwareDecode(accel string) bool {
 	return accel == hwAccelQSV || accel == hwAccelVAAPI || accel == hwAccelVideoToolbox
 }
 
+// SupportsHardwareSheets reports whether hardware attempts of a Sheets
+// request can decode on the resolved accelerator accel: every accelerator
+// SupportsHardwareDecode names, and NVENC's CUDA decoder.
+func SupportsHardwareSheets(accel string) bool {
+	return SupportsHardwareDecode(accel) || accel == hwAccelNVENC
+}
+
+// supportsHardware reports whether a hardware attempt of req can decode on
+// accel.
+func (r Request) supportsHardware(accel string) bool {
+	if r.Sheets != nil {
+		return SupportsHardwareSheets(accel)
+	}
+	return SupportsHardwareDecode(accel)
+}
+
 // hardwareDecodeArgs returns the input options that decode on hw, which go
 // before the input's -ss and -i. QSV decodes through its VAAPI parent device,
 // so both leave VAAPI surfaces that filters must download (hwDownloadFilter)
-// or process on the GPU first. VideoToolbox decodes into system-memory frames
+// or process on the GPU first. NVENC decodes into CUDA surfaces on the CUDA
+// device hw.Device names (an index, or empty for the default), declared as
+// the filters' device too. VideoToolbox decodes into system-memory frames
 // that software filters apply to directly, unless vtSurfaces asks for its
 // surfaces, which filters must download (videoToolboxDownloadFilter).
 //
@@ -58,9 +93,9 @@ func hardwareDecodeArgs(hw hardwareDecode, vtSurfaces bool) ([]string, error) {
 		}
 		args := tonemap.QSVInitDeviceArgs(hw.Device)
 		return append(args,
-			"-filter_hw_device", "va",
+			filterHWDeviceOption, "va",
 			hwaccelOption, hwAccelVAAPI,
-			"-hwaccel_output_format", "vaapi",
+			hwaccelOutputFormatOption, "vaapi",
 		), nil
 	case hwAccelVAAPI:
 		if hw.Device == "" {
@@ -68,16 +103,27 @@ func hardwareDecodeArgs(hw hardwareDecode, vtSurfaces bool) ([]string, error) {
 		}
 		args := tonemap.VAAPIInitDeviceArgs("hw", hw.Device)
 		return append(args,
-			"-filter_hw_device", "hw",
+			filterHWDeviceOption, "hw",
 			hwaccelOption, hwAccelVAAPI,
-			"-hwaccel_output_format", "vaapi",
+			hwaccelOutputFormatOption, "vaapi",
 		), nil
 	case hwAccelVideoToolbox:
 		args := []string{hwaccelOption, hwAccelVideoToolbox}
 		if vtSurfaces {
-			args = append(args, "-hwaccel_output_format", "videotoolbox_vld")
+			args = append(args, hwaccelOutputFormatOption, "videotoolbox_vld")
 		}
 		return args, nil
+	case hwAccelNVENC:
+		device := cudaHWAccel + "=" + cudaDeviceAlias
+		if hw.Device != "" {
+			device += ":" + hw.Device
+		}
+		return []string{
+			initHWDeviceOption, device,
+			filterHWDeviceOption, cudaDeviceAlias,
+			hwaccelOption, cudaHWAccel,
+			hwaccelOutputFormatOption, cudaHWAccel,
+		}, nil
 	default:
 		return nil, fmt.Errorf("hardware decode does not support %q", hw.Accel)
 	}
@@ -88,3 +134,9 @@ func hardwareDecodeArgs(hw hardwareDecode, vtSurfaces bool) ([]string, error) {
 func framesInSystemMemory(accel string) bool {
 	return accel == hwAccelVideoToolbox
 }
+
+// usesRenderDevice reports whether accel opens a DRI render device, which a
+// hardware attempt must reserve before it starts.
+func usesRenderDevice(accel string) bool {
+	return accel == hwAccelQSV || accel == hwAccelVAAPI
+}
diff --git a/internal/mediasample/images.go b/internal/mediasample/images.go
index 2b9ffa8bc9..13edd936ee 100644
--- a/internal/mediasample/images.go
+++ b/internal/mediasample/images.go
@@ -28,6 +28,23 @@ type ToneMap struct {
 	// AllowSoftware lets an attempt tone map in software. Without it such an
 	// attempt fails as unsupported before ffmpeg starts.
 	AllowSoftware bool `json:"allow_software,omitempty"`
+	// Source is the base signal tonemap.ResolveSource classified the input's
+	// video as. Only Sheets take it. With it, every attempt, on a GPU too,
+	// converts in software with the chain playback converts that signal with
+	// in software (tonemap.SoftwareFilter): a Dolby Vision base only through
+	// tonemapx, which applies its RPU, an HLG source with the HLG transfer. It
+	// therefore needs AllowSoftware, and an attempt the binary has no filter
+	// for fails as unsupported before ffmpeg starts. Empty keeps the
+	// best-effort chains below, for sources whose catalog facts cannot
+	// classify them.
+	Source tonemap.SourceKind `json:"source,omitempty"`
+}
+
+func (t ToneMap) validate() error {
+	if t.Source != "" && !tonemap.ValidSourceKind(t.Source) {
+		return fmt.Errorf("tone-map source %q is not a known base signal", t.Source)
+	}
+	return nil
 }
 
 // Image is one decoded image.
@@ -79,13 +96,28 @@ func (r Request) imageToneMap() *ToneMap {
 // toneMapResolver picks the software tone-map chain at most once per run, when
 // the first attempt that needs it starts, so a hardware attempt that succeeds
 // never loads capabilities and a failed choice is not retried by the next
-// attempt.
+// attempt. A run whose request names its source's base signal picks that
+// signal's chain instead (see selectSourceToneMap).
 type toneMapResolver struct {
 	done    bool
 	filter  string
 	failure *AttemptError
 }
 
+// source returns the software chain that converts the base signal kind,
+// chosen once per run.
+func (t *toneMapResolver) source(ctx context.Context, r Runner, kind tonemap.SourceKind) (string, *AttemptError) {
+	if !t.done {
+		t.filter, t.failure = r.selectSourceToneMap(ctx, kind)
+		t.done = true
+	}
+	if t.failure != nil {
+		failure := *t.failure
+		return "", &failure
+	}
+	return t.filter, nil
+}
+
 func (t *toneMapResolver) resolve(ctx context.Context, r Runner) (string, *AttemptError) {
 	if !t.done {
 		t.filter, t.failure = r.selectSoftwareToneMap(ctx)
@@ -121,6 +153,34 @@ func (r Runner) selectSoftwareToneMap(ctx context.Context) (string, *AttemptErro
 	return "", &AttemptError{Reason: ReasonUnsupported, Err: errors.New("configured FFmpeg lacks the required tonemapx or tonemap filter")}
 }
 
+// selectSourceToneMap picks the chain playback converts the base signal kind
+// with in software (tonemap.SoftwareFilter), on a filter the binary lists:
+// Jellyfin's tonemapx, the only one that applies a Dolby Vision RPU, else the
+// standard tonemap filter's Hable curve for the standard signals. A base that
+// is already SDR needs no tone-map filter. Every chain needs zscale and
+// sidedata.
+func (r Runner) selectSourceToneMap(ctx context.Context, kind tonemap.SourceKind) (string, *AttemptError) {
+	load := r.Capabilities
+	if load == nil {
+		load = LoadCapabilities
+	}
+	caps, err := load(ctx, r.FFmpegPath)
+	if err != nil {
+		return "", &AttemptError{Reason: ReasonCapabilities, Err: err}
+	}
+	switch {
+	case !caps.HasFilter("zscale") || !caps.HasFilter("sidedata"):
+		return "", &AttemptError{Reason: ReasonUnsupported, Err: errors.New("configured FFmpeg lacks the required zscale or sidedata filter")}
+	case tonemap.IsSDRSource(kind):
+		return tonemap.SoftwareFilter(kind, ""), nil
+	case caps.HasFilter(tonemap.SoftwareFilterBT2390):
+		return tonemap.SoftwareFilter(kind, tonemap.SoftwareFilterBT2390), nil
+	case kind != tonemap.SourceDolbyVision && caps.HasFilter(tonemap.SoftwareFilterHable):
+		return tonemap.SoftwareFilter(kind, tonemap.SoftwareFilterHable), nil
+	}
+	return "", &AttemptError{Reason: ReasonUnsupported, Err: fmt.Errorf("configured FFmpeg has no tone-map filter that converts a %s source", kind)}
+}
+
 // softwareToneMapFilter settles, before ffmpeg starts, the software tone-map
 // chain an image or sheet attempt needs, or "" when it needs none.
 func (r Runner) softwareToneMapFilter(ctx context.Context, req Request, attempt Attempt, toneMap *toneMapResolver) (string, *AttemptError) {
@@ -162,6 +222,9 @@ func buildImageArgs(req Request, attempt Attempt, hw hardwareDecode, softwareTon
 		args = append(args, "-threads", strconv.Itoa(req.Threads))
 	}
 	if attempt.Hardware {
+		if !SupportsHardwareDecode(hw.Accel) {
+			return nil, fmt.Errorf("hardware decode does not support %q", hw.Accel)
+		}
 		decode, err := hardwareDecodeArgs(hw, false)
 		if err != nil {
 			return nil, err
diff --git a/internal/mediasample/keyframe_skip_test.go b/internal/mediasample/keyframe_skip_test.go
new file mode 100644
index 0000000000..fa8c573c52
--- /dev/null
+++ b/internal/mediasample/keyframe_skip_test.go
@@ -0,0 +1,53 @@
+package mediasample
+
+import (
+	"slices"
+	"strings"
+	"testing"
+)
+
+func TestKeyframeSkipFollowsProbedCodec(t *testing.T) {
+	for line, want := range map[string]string{
+		"  Stream #0:0: Video: mpeg2video (Main), yuv420p(tv, top first), 720x576 [SAR 64:45 DAR 16:9], 25 fps": exactSkipFrame,
+		"  Stream #0:0: Video: mpeg1video, yuv420p(tv), 352x240 [SAR 1:1 DAR 22:15], 29.97 fps":                 "",
+		"  Stream #0:0: Video: h264, yuv420p, 1920x1080 [SAR 1:1 DAR 16:9]":                                     "",
+		"  Stream #0:0(eng): Video: hevc (Main 10), yuv420p10le(tv, bt2020nc/bt2020/smpte2084), 3840x2160":      "",
+	} {
+		header := &inputHeaderParser{}
+		header.line("Input #0, matroska,webm, from '/media/a.mkv':")
+		header.line(line)
+		if got := keyframeSkipFor(header.info.VideoCodec); got != want {
+			t.Errorf("%q: codec %q, skip %q, want %q", line, header.info.VideoCodec, got, want)
+		}
+	}
+	if !keyframeLowDelayFor("mpeg4") || !keyframeLowDelayFor("msmpeg4v3") || keyframeLowDelayFor("h264") || keyframeLowDelayFor("hevc") {
+		t.Fatal("low delay should cover MPEG-4 Part 2 only")
+	}
+
+	req := sheetsRequest(secondsFrom(5, 10, 4), 2, 2)
+	req.skipFrame, req.lowDelay = exactSkipFrame, true
+	list, _, err := buildSheetsArgs(req, Attempt{}, hardwareDecode{}, sampleEntries(req.Samples.Seconds, 0), "GRAPH", "", sampledSheetsList)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(strings.Join(list, " "), "-skip_frame:v noref -flags:v +low_delay -protocol_whitelist") {
+		t.Fatalf("list args %q: want noref and low delay before the input", list)
+	}
+	exact, _, err := buildSheetsArgs(req, Attempt{}, hardwareDecode{}, sampleEntries(req.Samples.Seconds, 0), "GRAPH", "", sheetsList{span: 0.5, skip: exactSkipFrame})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if i := slices.Index(exact, skipFrameOption); i < 0 || exact[i+1] != exactSkipFrame {
+		t.Fatalf("repeat repair args %q: want its own -skip_frame kept", exact)
+	}
+	window := req
+	window.Samples = nil
+	window.Window = &Window{StartSeconds: 0, DurationSeconds: 40}
+	windowArgs, _, err := buildSheetsArgs(window, Attempt{}, hardwareDecode{}, nil, "GRAPH", "packets.framecrc", sampledSheetsList)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if i := slices.Index(windowArgs, skipFrameOption); i < 0 || windowArgs[i+1] != exactSkipFrame || !slices.Contains(windowArgs, "+low_delay") {
+		t.Fatalf("window args %q: want noref and low delay", windowArgs)
+	}
+}
diff --git a/internal/mediasample/keyframes.go b/internal/mediasample/keyframes.go
new file mode 100644
index 0000000000..b8b6b58326
--- /dev/null
+++ b/internal/mediasample/keyframes.go
@@ -0,0 +1,189 @@
+package mediasample
+
+import (
+	"context"
+	"io"
+	"math"
+	"os"
+	"sort"
+	"syscall"
+	"time"
+
+	"github.com/prairie-server/prairie-server/internal/playback/keyframes"
+)
+
+// A list entry that starts at its sample's time makes the concat demuxer seek
+// to the keyframe before it and read every packet of every stream, video and
+// all audio tracks, from that keyframe up to the sample, packets the decoder
+// then skips. With keyframes several seconds apart that is most of the file.
+// A Sheets list over a Matroska input instead starts each entry at the
+// sample's keyframe, read from the file's Cues: the index the demuxer's seek
+// uses, so the entry lands on the same keyframe and reads only it and the
+// entry's span. Every frame then lies at or after its entry's inpoint, so
+// its time places it back in the input exactly (see sourceSeconds).
+//
+// A sample whose keyframe is the previous sample's gets no entry: it would
+// only decode the frame the cell before shows, and the HEVC decoder drops a
+// keyframe sent twice in a row as a duplicate picture order count. Once the
+// list's frames are in, such a sample shows the previous cell's frame, with
+// its source time (see shareFrames), so the repair finds it repeating that
+// cell and decodes its own moment.
+//
+// Reading fewer packets changes what an HEVC or H.264 decoder knows when an
+// open-GOP keyframe arrives after a jump: it derives the keyframe's picture
+// order count from the last picture whose header it parsed, skipped ones
+// included. Across a gap longer than half the count's cycle (128 frames for
+// x265's default) the derived counts run backwards, and the decoder passes on
+// keyframes out of list order with rewritten times, or drops them as
+// duplicates. Sample-time entries leave shorter gaps and fare better, so a
+// keyframe list is abandoned, ffmpeg stopped, as soon as a frame comes from
+// an earlier entry than the one before it or the decoder drops a keyframe
+// (droppedKeyframe, which also covers H.264 keyframes whose reference
+// marking names skipped pictures), and the samples are read again from their
+// own times (see keyframeSheets). Closed-GOP keyframes start their counts afresh and never
+// trip it.
+//
+// Samples before the first keyframe, and every sample of an input without
+// usable Cues (other containers, a Matroska file without Cues or whose Cues
+// leave out keyframes, or a read that fails or takes longer than
+// keyframeLookupTimeout), start at their own time as before. MP4 inputs keep
+// sample-time entries even with an index: an entry that starts exactly at an
+// MP4 keyframe's time often seeks past it. Repairs always list sample times;
+// they read from the keyframe on by design.
+
+// keyframeLookupTimeout bounds the wait for a Sheets input's Cues. Reading
+// them takes milliseconds; a read still blocked after this, as on stalled
+// storage, is left behind and the run lists sample times.
+const keyframeLookupTimeout = 10 * time.Second
+
+// keyframeLookups bounds the lookups in flight across the process, including
+// those left behind blocked, and so the memory parsing Cues takes, a few
+// times their size up to keyframes.ReadMatroska's limit on them. A
+// lookup takes milliseconds, so a few slots serve any number of trickplay
+// workers. A run that finds every slot taken lists sample times without
+// reading the Cues.
+var keyframeLookups = make(chan struct{}, 4)
+
+// lookupKeyframes returns the video keyframe times of the Matroska file at
+// path, stopping between reads once ctx ends; tests replace it.
+var lookupKeyframes = matroskaKeyframes
+
+// sheetKeyframes returns the video keyframe times, on the container's
+// timeline, of a Sheets list request's input, or nil when it has none to
+// start entries at. Run calls it once, before any attempt and its timeout
+// start, and stops waiting when ctx ends or keyframeLookupTimeout passes.
+func sheetKeyframes(ctx context.Context, req Request) []float64 {
+	if req.Sheets == nil || req.Samples == nil || req.Samples.ReadThrough || ctx.Err() != nil {
+		return nil
+	}
+	select {
+	case keyframeLookups <- struct{}{}:
+	default:
+		return nil
+	}
+	ctx, cancel := context.WithTimeout(ctx, keyframeLookupTimeout)
+	defer cancel()
+	lookup := lookupKeyframes
+	found := make(chan []float64, 1)
+	go func() {
+		defer func() { <-keyframeLookups }()
+		found <- lookup(ctx, req.Input)
+	}()
+	select {
+	case keyframes := <-found:
+		// A lookup can finish just as the wait ends; the run has moved on.
+		if ctx.Err() != nil {
+			return nil
+		}
+		return keyframes
+	case <-ctx.Done():
+		return nil
+	}
+}
+
+// matroskaKeyframes reads the keyframe times of the Matroska file at path
+// from its Cues and a few clusters' block headers (keyframes.ReadMatroska),
+// or returns nil. The file opens without blocking, so a FIFO in its place
+// cannot hold the lookup, and only a regular file is read.
+func matroskaKeyframes(ctx context.Context, path string) []float64 {
+	file, err := os.OpenFile(path, os.O_RDONLY|syscall.O_NONBLOCK, 0)
+	if err != nil {
+		return nil
+	}
+	defer func() { _ = file.Close() }()
+	info, err := file.Stat()
+	if err != nil || !info.Mode().IsRegular() {
+		return nil
+	}
+	index, err := keyframes.ReadMatroska(contextReaderAt{ctx: ctx, r: file}, info.Size())
+	if err != nil {
+		return nil
+	}
+	return index.Keyframes
+}
+
+// contextReaderAt stops reading once ctx ends.
+type contextReaderAt struct {
+	ctx context.Context
+	r   io.ReaderAt
+}
+
+func (c contextReaderAt) ReadAt(p []byte, off int64) (int, error) {
+	if err := c.ctx.Err(); err != nil {
+		return 0, err
+	}
+	return c.r.ReadAt(p, off)
+}
+
+// listPlan is the list a Sheets run reads: its entries, the input start time
+// their inpoints are offset by, and for each sample the index of the entry
+// its frame comes from, or -1 for a sample that shows the previous sample's
+// frame.
+type listPlan struct {
+	inputStart float64
+	entries    []listEntry
+	entry      []int
+}
+
+// samplePlan starts every sample's entry at its own time.
+func samplePlan(seconds []float64, inputStart float64) listPlan {
+	plan := listPlan{inputStart: inputStart, entries: sampleEntries(seconds, inputStart), entry: make([]int, len(seconds))}
+	for i := range plan.entry {
+		plan.entry[i] = i
+	}
+	return plan
+}
+
+// keyframePlan starts each sample's entry at the last of keyframes at or
+// before the sample's inpoint, and leaves out a sample whose keyframe is the
+// previous sample's. A sample before the first keyframe starts at its own
+// time.
+func keyframePlan(seconds []float64, inputStart float64, keyframes []float64) listPlan {
+	plan := listPlan{inputStart: inputStart, entry: make([]int, len(seconds))}
+	previous := -1
+	for i, at := range seconds {
+		inpoint := math.Max(0, at+inputStart)
+		// The list writes inpoints in whole microseconds, so the seek lands
+		// on a keyframe up to that rounding after the exact time.
+		k := sort.SearchFloat64s(keyframes, math.Round(inpoint*1e6)/1e6+1e-9) - 1
+		if k >= 0 && k == previous {
+			plan.entry[i] = -1
+			continue
+		}
+		if k >= 0 {
+			inpoint = math.Max(0, ceilMicroseconds(keyframes[k]))
+		}
+		previous = k
+		plan.entry[i] = len(plan.entries)
+		plan.entries = append(plan.entries, listEntry{sample: at, inpoint: inpoint})
+	}
+	return plan
+}
+
+// ceilMicroseconds rounds a keyframe time up to the microseconds an inpoint
+// is written with, so the inpoint never falls before the keyframe and seeks
+// to the one before it. A time already whole in microseconds, as a Matroska
+// file's default millisecond timestamps are, stays as it is.
+func ceilMicroseconds(seconds float64) float64 {
+	return math.Ceil(seconds*1e6-1e-3) / 1e6
+}
diff --git a/internal/mediasample/keyframes_test.go b/internal/mediasample/keyframes_test.go
new file mode 100644
index 0000000000..d948122a1f
--- /dev/null
+++ b/internal/mediasample/keyframes_test.go
@@ -0,0 +1,364 @@
+package mediasample
+
+import (
+	"context"
+	"errors"
+	"io"
+	"math"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestKeyframePlan(t *testing.T) {
+	tests := []struct {
+		name       string
+		seconds    []float64
+		inputStart float64
+		keyframes  []float64
+		inpoints   []float64
+		entry      []int
+	}{
+		{
+			name:      "each sample its keyframe",
+			seconds:   []float64{5, 15, 25},
+			keyframes: []float64{0, 10.417, 20.833},
+			inpoints:  []float64{0, 10.417, 20.833},
+			entry:     []int{0, 1, 2},
+		},
+		{
+			name:      "samples sharing a keyframe",
+			seconds:   []float64{5, 15, 25, 35, 45, 55},
+			keyframes: []float64{0, 40},
+			inpoints:  []float64{0, 40},
+			entry:     []int{0, -1, -1, -1, 1, -1},
+		},
+		{
+			// A distinct keyframe keeps its entry even inside the span of the
+			// entry before.
+			name:      "keyframes closer than the span",
+			seconds:   []float64{2.5, 7.5},
+			keyframes: []float64{2.45, 2.55},
+			inpoints:  []float64{2.45, 2.55},
+			entry:     []int{0, 1},
+		},
+		{
+			name:      "a sample before the first keyframe",
+			seconds:   []float64{2.5, 7.5, 12.5},
+			keyframes: []float64{3, 13},
+			inpoints:  []float64{2.5, 3},
+			entry:     []int{0, 1, -1},
+		},
+		{
+			name:       "a container that starts late",
+			seconds:    []float64{5, 15},
+			inputStart: 11.4,
+			keyframes:  []float64{11.406, 21.823},
+			inpoints:   []float64{11.406, 21.823},
+			entry:      []int{0, 1},
+		},
+		{
+			// 10.4169996 is written as 10.417, where the seek lands on the
+			// keyframe at 10.417.
+			name:      "a keyframe within the list's rounding",
+			seconds:   []float64{10.4169996},
+			keyframes: []float64{0, 10.417},
+			inpoints:  []float64{10.417},
+			entry:     []int{0},
+		},
+		{
+			name:      "a keyframe at zero",
+			seconds:   []float64{5},
+			keyframes: []float64{0},
+			inpoints:  []float64{0},
+			entry:     []int{0},
+		},
+		{
+			name:      "a keyframe between microseconds",
+			seconds:   []float64{12},
+			keyframes: []float64{0, 10.4166666667},
+			inpoints:  []float64{10.416667},
+			entry:     []int{0},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			plan := keyframePlan(test.seconds, test.inputStart, test.keyframes)
+			var inpoints []float64
+			for _, entry := range plan.entries {
+				inpoints = append(inpoints, entry.inpoint)
+			}
+			if !slices.EqualFunc(inpoints, test.inpoints, func(a, b float64) bool { return math.Abs(a-b) < 1e-9 && !math.Signbit(a) }) || !slices.Equal(plan.entry, test.entry) {
+				t.Fatalf("inpoints %v entry %v, want %v %v", inpoints, plan.entry, test.inpoints, test.entry)
+			}
+			for i, entry := range plan.entry {
+				if entry >= 0 && plan.entries[entry].sample != test.seconds[i] {
+					t.Fatalf("entry %d is tagged %g, want sample %g", entry, plan.entries[entry].sample, test.seconds[i])
+				}
+			}
+		})
+	}
+}
+
+// stubKeyframes makes lookups return keyframes and counts them.
+func stubKeyframes(t *testing.T, keyframes []float64) *int {
+	t.Helper()
+	calls := 0
+	previous := lookupKeyframes
+	lookupKeyframes = func(context.Context, string) []float64 {
+		calls++
+		return keyframes
+	}
+	t.Cleanup(func() { lookupKeyframes = previous })
+	return &calls
+}
+
+func TestSheetKeyframesOnlyForSheetLists(t *testing.T) {
+	calls := stubKeyframes(t, []float64{0, 10})
+	req := sheetsRequest([]float64{5}, 1, 1)
+	if got := sheetKeyframes(t.Context(), req); !slices.Equal(got, []float64{0, 10}) {
+		t.Fatalf("keyframes %v, want the lookup's", got)
+	}
+	readThrough := req
+	readThrough.Samples = &Samples{Seconds: []float64{5}, ReadThrough: true}
+	stats := samplesRequest(5)
+	for _, req := range []Request{readThrough, stats} {
+		if got := sheetKeyframes(t.Context(), req); got != nil {
+			t.Fatalf("keyframes %v for %+v, want none", got, req)
+		}
+	}
+	if *calls != 1 {
+		t.Fatalf("%d lookups, want 1", *calls)
+	}
+}
+
+// TestSheetKeyframesStopsWaiting blocks a lookup, as stalled storage
+// would: a canceled run goes on without keyframes at once, and the lookup
+// sees its context end.
+func TestSheetKeyframesStopsWaiting(t *testing.T) {
+	entered, exited := make(chan struct{}), make(chan struct{})
+	previous := lookupKeyframes
+	lookupKeyframes = func(ctx context.Context, _ string) []float64 {
+		defer close(exited)
+		close(entered)
+		<-ctx.Done()
+		return []float64{0}
+	}
+	t.Cleanup(func() { lookupKeyframes = previous })
+	ctx, cancel := context.WithCancel(t.Context())
+	go func() {
+		<-entered
+		cancel()
+	}()
+	if got := sheetKeyframes(ctx, sheetsRequest([]float64{5}, 1, 1)); got != nil {
+		t.Fatalf("keyframes %v, want none", got)
+	}
+	<-exited
+}
+
+// TestSheetKeyframesLeavesACanceledRunAlone never touches the input of a
+// run canceled before it starts.
+func TestSheetKeyframesLeavesACanceledRunAlone(t *testing.T) {
+	calls := stubKeyframes(t, []float64{0})
+	ctx, cancel := context.WithCancel(t.Context())
+	cancel()
+	if got := sheetKeyframes(ctx, sheetsRequest([]float64{5}, 1, 1)); got != nil || *calls != 0 {
+		t.Fatalf("keyframes %v after %d lookups, want none", got, *calls)
+	}
+}
+
+// TestSheetKeyframesSkipsWhenLookupsAreFull holds every lookup slot, as
+// lookups left blocked would: a run lists sample times without another.
+func TestSheetKeyframesSkipsWhenLookupsAreFull(t *testing.T) {
+	calls := stubKeyframes(t, []float64{0})
+	for range cap(keyframeLookups) {
+		keyframeLookups <- struct{}{}
+	}
+	defer func() {
+		for range cap(keyframeLookups) {
+			<-keyframeLookups
+		}
+	}()
+	if got := sheetKeyframes(t.Context(), sheetsRequest([]float64{5}, 1, 1)); got != nil || *calls != 0 {
+		t.Fatalf("keyframes %v after %d lookups, want none", got, *calls)
+	}
+}
+
+func TestMatroskaKeyframesSkipsOtherFiles(t *testing.T) {
+	dir := t.TempDir()
+	text := filepath.Join(dir, "a.mp4")
+	if err := os.WriteFile(text, []byte("not a Matroska file"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	for _, path := range []string{text, filepath.Join(dir, "missing.mkv"), dir} {
+		if got := matroskaKeyframes(t.Context(), path); got != nil {
+			t.Fatalf("%s: keyframes %v, want none", filepath.Base(path), got)
+		}
+	}
+}
+
+// keyframeList stands in for ffmpeg like runSequence, and fails a run whose
+// context ended, as a stopped process does.
+func keyframeList(runs []*fakeSheets, fail map[int]error) (ExecFunc, *[][]string) {
+	exec, calls := runSequence(runs, fail)
+	return func(ctx context.Context, name string, args []string, stdin io.Reader, stdout, stderr io.Writer) error {
+		if err := exec(ctx, name, args, stdin, stdout, stderr); err != nil {
+			return err
+		}
+		return ctx.Err()
+	}, calls
+}
+
+// TestRunSheetsStartsMatroskaEntriesAtKeyframes lists six samples of a file
+// with keyframes at 0 and 40 s. The list starts two entries at those
+// keyframes; the samples sharing one show the cell before and are repaired
+// to their own moment. The software attempt after a failed hardware one
+// reuses the lookup.
+func TestRunSheetsStartsMatroskaEntriesAtKeyframes(t *testing.T) {
+	calls := stubKeyframes(t, []float64{0, 40})
+	hardware := &fakeSheets{format: "matroska,webm"}
+	// Entry k of a list whose entries last 0.5 s starts at 0.5k in the list.
+	list := &fakeSheets{frames: []fakeSheetFrame{at(10, 5, "0"), at(50, 45, "0.5")}}
+	// The repair's entries start at the samples' own times, after their
+	// keyframes, so its frames up to each sample come first.
+	repair := &fakeSheets{frames: []fakeSheetFrame{
+		at(11, 15, "-15"), at(20, 15, "-0.04"),
+		at(21, 25, "-0.5"), at(30, 25, "0.46"),
+		at(31, 35, "0.9"), at(40, 35, "1"),
+		at(51, 55, "-8"), at(60, 55, "1.5"),
+	}}
+	exec, runs := keyframeList([]*fakeSheets{hardware, list, repair}, map[int]error{0: errors.New("hardware decode failed")})
+	req := sheetsRequest(secondsFrom(5, 10, 6), 3, 2)
+	req.Attempts = []Attempt{{Hardware: true}, {}}
+	result, err := Runner{HWAccel: "vaapi", HWDevice: "/dev/dri/renderD128", Exec: exec}.Run(t.Context(), req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if *calls != 1 {
+		t.Fatalf("%d keyframe lookups, want 1 for the run", *calls)
+	}
+	want := "ffconcat version 1.0\n" +
+		"file 'file:/media/a.mkv'\nfile_packet_meta sample 5\ninpoint 0\noutpoint 0.5\n" +
+		"file 'file:/media/a.mkv'\nfile_packet_meta sample 45\ninpoint 40\noutpoint 40.5\n"
+	if len(hardware.lists) != 1 || hardware.lists[0] != want || len(list.lists) != 1 || list.lists[0] != want {
+		t.Fatalf("lists %q and %q, want each attempt to list %q", hardware.lists, list.lists, want)
+	}
+	if got := sheetLumas(t, result, 3, 2); !near(got[0], []int{10, 20, 30, 40, 50, 60}) {
+		t.Fatalf("cells %v, want each sample's own moment", got)
+	}
+	if result.SheetFrames != (SheetFrames{Decoded: 6, Refined: 4}) {
+		t.Fatalf("frames %+v, want 6 decoded, the 4 sharing a keyframe repaired", result.SheetFrames)
+	}
+	if n := len(*runs); n != 5 || !strings.Contains(strings.Join((*runs)[4], " "), "-skip_frame:v noref") || strings.Count(repair.lists[0], "file ") != 4 {
+		t.Fatalf("runs %q, repair lists %q; want probe, hardware list, probe, list, and one repair of the four", *runs, repair.lists)
+	}
+}
+
+// TestRunSheetsAbandonsAKeyframeList stops a keyframe list whose decoder
+// passes on a frame from an earlier entry, or drops a keyframe (HEVC's
+// duplicate picture order count, H.264's illegal short term buffer state),
+// and reads the samples from their own times instead.
+func TestRunSheetsAbandonsAKeyframeList(t *testing.T) {
+	for name, keyframeRun := range map[string]*fakeSheets{
+		"out of order": {format: "matroska,webm", frames: []fakeSheetFrame{at(30, 25, "1"), at(10, 5, "1.5"), at(20, 15, "2")}},
+		"duplicate": {format: "matroska,webm", frames: []fakeSheetFrame{at(10, 5, "0")}, editLog: func(log []string) []string {
+			return append([]string{"[hevc @ 0x55d0] Duplicate POC in a sequence: 256."}, log...)
+		}},
+		"illegal short term": {format: "matroska,webm", frames: []fakeSheetFrame{at(10, 5, "0")}, editLog: func(log []string) []string {
+			return append([]string{"[h264 @ 0x55d0] illegal short term buffer state detected"}, log...)
+		}},
+	} {
+		t.Run(name, func(t *testing.T) {
+			stubKeyframes(t, []float64{0, 10, 20})
+			sampleRun := &fakeSheets{frames: []fakeSheetFrame{at(10, 5, "-5"), at(20, 15, "-4.5"), at(30, 25, "-4")}}
+			exec, runs := keyframeList([]*fakeSheets{keyframeRun, sampleRun}, nil)
+			result, err := Runner{Exec: exec}.Run(t.Context(), sheetsRequest(secondsFrom(5, 10, 3), 3, 1))
+			if err != nil {
+				t.Fatal(err)
+			}
+			if got := sheetLumas(t, result, 3, 1); !near(got[0], []int{10, 20, 30}) || result.SheetFrames != (SheetFrames{Decoded: 3}) {
+				t.Fatalf("cells %v frames %+v, want the sample-time list's", got, result.SheetFrames)
+			}
+			want := "ffconcat version 1.0\n" +
+				"file 'file:/media/a.mkv'\nfile_packet_meta sample 5\ninpoint 5\noutpoint 5.5\n" +
+				"file 'file:/media/a.mkv'\nfile_packet_meta sample 15\ninpoint 15\noutpoint 15.5\n" +
+				"file 'file:/media/a.mkv'\nfile_packet_meta sample 25\ninpoint 25\noutpoint 25.5\n"
+			if len(*runs) != 3 || len(sampleRun.lists) != 1 || sampleRun.lists[0] != want {
+				t.Fatalf("runs %d, lists %q; want probe, keyframe list, sample-time list %q", len(*runs), sampleRun.lists, want)
+			}
+		})
+	}
+}
+
+// TestSheetsDiscardsAnAbandonedListAfterTheAttemptEnds abandons a keyframe
+// list whose ffmpeg exited cleanly after the attempt's time ran out, while
+// the caller still waits: its cells are not published, and the attempt fails
+// as timed out instead of reading the samples again.
+func TestSheetsDiscardsAnAbandonedListAfterTheAttemptEnds(t *testing.T) {
+	keyframeRun := &fakeSheets{frames: []fakeSheetFrame{at(30, 25, "1"), at(10, 5, "1.5"), at(20, 15, "2")}}
+	exec, calls := runSequence([]*fakeSheets{keyframeRun, {}, {}, {}}, nil)
+	// A deadline in the past ends the attempt at once; the fake ffmpeg
+	// still writes its frames and exits cleanly.
+	attemptCtx, cancel := context.WithDeadline(t.Context(), time.Now().Add(-time.Second))
+	defer cancel()
+	run := attemptRun{runner: Runner{Exec: exec}, ctx: t.Context(), attemptCtx: attemptCtx, decoder: softwareDecoder, keyframes: []float64{0, 10, 20}}
+	req := sheetsRequest(secondsFrom(5, 10, 3), 3, 1)
+	result, failure := run.sheets(req, req.Samples.Seconds, 0)
+	if failure == nil || failure.Reason != ReasonTimeout || len(result.Sheets) != 0 || len(*calls) != 1 {
+		t.Fatalf("frames %+v failure %v after %d runs, want the abandoned list alone, timed out without sheets", result.SheetFrames, failure, len(*calls))
+	}
+}
+
+// TestRunSheetsDuplicatesInAnAbandonedListDoNotReachTheWindow fails the
+// sample-time list as empty after the keyframe list was abandoned for a
+// duplicate: the duplicate belongs to the abandoned read, so the run fails
+// instead of reading the samples again as a window.
+func TestRunSheetsDuplicatesInAnAbandonedListDoNotReachTheWindow(t *testing.T) {
+	stubKeyframes(t, []float64{0, 10, 20})
+	keyframeRun := &fakeSheets{format: "matroska,webm", frames: []fakeSheetFrame{at(10, 5, "0")}, editLog: func(log []string) []string {
+		return append([]string{"[hevc @ 0x55d0] Duplicate POC in a sequence: 256."}, log...)
+	}}
+	empty := &fakeSheets{}
+	exec, runs := keyframeList([]*fakeSheets{keyframeRun, empty, empty, empty}, nil)
+	_, err := Runner{Exec: exec}.Run(t.Context(), sheetsRequest(secondsFrom(5, 10, 3), 3, 1))
+	if failure, ok := errors.AsType[*Error](err); !ok || failure.Reason != ReasonEmpty {
+		t.Fatalf("error %v, want the sample-time list's empty failure", err)
+	}
+	for _, args := range *runs {
+		if slices.Contains(args, "-ss") {
+			t.Fatalf("runs %q, want no window read", *runs)
+		}
+	}
+}
+
+func TestShareFramesCopiesTheCellBefore(t *testing.T) {
+	a := newSheetAssembler(SheetsOutput{TileWidth: testTileW, TileHeight: testTileH, Columns: 2, Rows: 2, Quality: 80}, []float64{5, 15, 25, 35}, true, 0, 0.5)
+	a.plan = keyframePlan(a.times, 0, []float64{0, 20})
+	// The keyframe at 0 opens the first entry; the one at 20 s never arrives.
+	a.place(sheetFrameMeta{seconds: 0, hasTime: true, sample: 5}, rawFrame(10))
+	a.shareFrames()
+	if !a.placed(1) || a.placed(2) || a.placed(3) || a.decoded != 2 || a.sources[1] != a.sources[0] {
+		t.Fatalf("placed %v %v %v, decoded %d, sources %v; want only the sample after the first copied", a.placed(1), a.placed(2), a.placed(3), a.decoded, a.sources)
+	}
+	missing, repeated := a.repairs()
+	if !slices.Equal(missing, []int{2, 3}) || !slices.Equal(repeated, []int{1}) {
+		t.Fatalf("missing %v repeated %v, want [2 3] and [1]", missing, repeated)
+	}
+}
+
+// TestSourceSecondsFollowsTheEntry places frames of a list that left out a
+// sample: the second entry, for the third sample, starts 0.5 s into the list
+// at its keyframe.
+func TestSourceSecondsFollowsTheEntry(t *testing.T) {
+	a := newSheetAssembler(SheetsOutput{TileWidth: 16, TileHeight: 16, Columns: 1, Rows: 1, Quality: 80}, []float64{5, 15, 25}, true, 0, 0.5)
+	a.plan = keyframePlan(a.times, 1.5, []float64{1.5, 23.5})
+	if got := a.sourceSeconds(sheetFrameMeta{seconds: 0.5, hasTime: true}, 2); math.Abs(got-22) > 1e-9 {
+		t.Fatalf("source %g, want 22, the keyframe's time from the start of the file", got)
+	}
+	if got := a.sourceSeconds(sheetFrameMeta{seconds: 0, hasTime: true}, 1); !math.IsNaN(got) {
+		t.Fatalf("source %g for a sample without an entry, want NaN", got)
+	}
+}
diff --git a/internal/mediasample/keyframes_unix_test.go b/internal/mediasample/keyframes_unix_test.go
new file mode 100644
index 0000000000..b4fcaadb5f
--- /dev/null
+++ b/internal/mediasample/keyframes_unix_test.go
@@ -0,0 +1,21 @@
+//go:build unix
+
+package mediasample
+
+import (
+	"path/filepath"
+	"syscall"
+	"testing"
+)
+
+// TestMatroskaKeyframesSkipsAFIFO names a FIFO without a writer, which
+// opening would block on.
+func TestMatroskaKeyframesSkipsAFIFO(t *testing.T) {
+	fifo := filepath.Join(t.TempDir(), "fifo.mkv")
+	if err := syscall.Mkfifo(fifo, 0o600); err != nil {
+		t.Skipf("mkfifo: %v", err)
+	}
+	if got := matroskaKeyframes(t.Context(), fifo); got != nil {
+		t.Fatalf("keyframes %v, want none", got)
+	}
+}
diff --git a/internal/mediasample/probe.go b/internal/mediasample/probe.go
index 35bf1f51b8..a54972f9cc 100644
--- a/internal/mediasample/probe.go
+++ b/internal/mediasample/probe.go
@@ -33,6 +33,9 @@ type inputInfo struct {
 	// geometry before ffmpeg applies its display matrix.
 	AspectRatio float64
 	Rotation    float64
+	// VideoCodec is the decoder's name for the first playable video, such
+	// as "h264" or "mpeg2video".
+	VideoCodec string
 }
 
 func (i inputInfo) displayAspect() float64 {
@@ -119,6 +122,10 @@ func (p *inputHeaderParser) videoGeometry(line string) {
 			return
 		}
 		p.videoSeen, p.videoSideData = true, true
+		if _, rest, ok := strings.Cut(trimmed, ": Video: "); ok {
+			codec, _, _ := strings.Cut(rest, " ")
+			p.info.VideoCodec = strings.TrimRight(codec, ",")
+		}
 		if size := videoSizePattern.FindStringSubmatch(trimmed); size != nil {
 			w, _ := strconv.ParseFloat(size[1], 64)
 			h, _ := strconv.ParseFloat(size[2], 64)
diff --git a/internal/mediasample/reason.go b/internal/mediasample/reason.go
index 7d8f2fd98c..23182559f2 100644
--- a/internal/mediasample/reason.go
+++ b/internal/mediasample/reason.go
@@ -133,6 +133,10 @@ var (
 		"unknown decoder",
 		"decoder not found",
 		"requested output format",
+		// A hardware decoder that cannot decode the stream: ffmpeg falls
+		// back to software frames, which the GPU chain then refuses.
+		"failed setup for format",
+		"doesn't support hardware accelerated",
 	}
 )
 
diff --git a/internal/mediasample/remote.go b/internal/mediasample/remote.go
index 61239be1f5..c1e344fb19 100644
--- a/internal/mediasample/remote.go
+++ b/internal/mediasample/remote.go
@@ -8,8 +8,10 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"strings"
 	"time"
 
+	"github.com/prairie-server/prairie-server/internal/nodeauth"
 	"github.com/prairie-server/prairie-server/internal/telemetry"
 )
 
@@ -88,7 +90,7 @@ type RemoteClient struct {
 }
 
 // Run sends req to the node route at endpoint (the node URL joined with
-// RemotePath) with the node bearer secret. A failure is a *RemoteError.
+// RemotePath), signed with the node secret. A failure is a *RemoteError.
 func (c RemoteClient) Run(ctx context.Context, endpoint, secret string, req Request) (Result, error) {
 	body, err := json.Marshal(req)
 	if err != nil {
@@ -99,7 +101,9 @@ func (c RemoteClient) Run(ctx context.Context, endpoint, secret string, req Requ
 		return Result{}, &RemoteError{Reason: ReasonNodeUnavailable, Err: err}
 	}
 	httpReq.Header.Set("Content-Type", "application/json")
-	httpReq.Header.Set("Authorization", "Bearer "+secret)
+	if err := nodeauth.Sign(httpReq, strings.TrimSuffix(endpoint, RemotePath), secret); err != nil {
+		return Result{}, &RemoteError{Reason: ReasonNodeUnavailable, Err: err}
+	}
 	resp, err := telemetry.DoTrustedNode(c.HTTP, httpReq, "media_sample")
 	if err != nil {
 		reason := ReasonNodeUnavailable
diff --git a/internal/mediasample/remote_signing_test.go b/internal/mediasample/remote_signing_test.go
new file mode 100644
index 0000000000..fb272c2556
--- /dev/null
+++ b/internal/mediasample/remote_signing_test.go
@@ -0,0 +1,27 @@
+package mediasample
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
+)
+
+func TestRemoteClientSignsTheRequest(t *testing.T) {
+	const secret = "sample-secret"
+	node := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != RemotePath || !nodeauthtest.Signed(r, secret) {
+			http.Error(w, "unauthorized", http.StatusUnauthorized)
+			return
+		}
+		_ = json.NewEncoder(w).Encode(Result{Decoder: softwareDecoder})
+	}))
+	t.Cleanup(node.Close)
+
+	result, err := RemoteClient{}.Run(t.Context(), node.URL+RemotePath, secret, Request{Input: "/media/movie.mkv"})
+	if err != nil || result.Decoder != softwareDecoder {
+		t.Fatalf("Run = %+v, %v; want the node's result for a signed request", result, err)
+	}
+}
diff --git a/internal/mediasample/request.go b/internal/mediasample/request.go
index 95790c79f5..b01cdeb1a1 100644
--- a/internal/mediasample/request.go
+++ b/internal/mediasample/request.go
@@ -48,6 +48,11 @@ type Request struct {
 	// the lowest CPU priority (nice 19) and in the idle I/O class; elsewhere it
 	// runs like any other request.
 	Background bool `json:"background,omitempty"`
+	// skipFrame replaces the keyframe -skip_frame value for a Sheets run
+	// once the input is probed, and lowDelay adds the decoder's low-delay
+	// mode; see keyframeSkipFor and keyframeLowDelayFor.
+	skipFrame string
+	lowDelay  bool
 }
 
 // Window is a contiguous span of the input, in media seconds.
@@ -57,6 +62,11 @@ type Window struct {
 	// KeyframesOnly decodes only video keyframes. It needs a video output
 	// (Stats); audio outputs still read every audio frame.
 	KeyframesOnly bool `json:"keyframes_only,omitempty"`
+	// referencePictures makes a Sheets window decode every reference
+	// picture and keep only the keyframes, so a decoder that drops
+	// keyframes over skipped pictures keeps its state whole. It is set only
+	// by the samples fallback, never sent to another node.
+	referencePictures bool
 }
 
 // Samples decodes, for each time, the video keyframe at or before it, and
@@ -198,6 +208,9 @@ func (r Request) Validate() error {
 		if err := r.Images.validate(); err != nil {
 			return err
 		}
+		if r.Images.ToneMap != nil && r.Images.ToneMap.Source != "" {
+			return errors.New("images keep their tone-map chains and take no source signal")
+		}
 	}
 	if r.Sheets != nil {
 		if r.Samples == nil || r.Stats != nil {
@@ -206,6 +219,16 @@ func (r Request) Validate() error {
 		if err := r.Sheets.validate(); err != nil {
 			return err
 		}
+		run := *r.Sheets
+		if run.UseInputAspect {
+			// The probe sets the tile height, and samples checks the run
+			// again with it before any tile is decoded. Until then, only a
+			// run too large at any height is refused.
+			run.TileHeight = minSheetTile
+		}
+		if err := run.validateRun(len(r.Samples.Seconds)); err != nil {
+			return err
+		}
 	}
 	if !r.hasOutput() {
 		return errors.New("request has no output")
@@ -374,3 +397,51 @@ func countSet(values ...bool) int {
 func finite(v float64) bool {
 	return !math.IsNaN(v) && !math.IsInf(v, 0)
 }
+
+// keyframeSkip returns skip, or for keyframeSkipFrame the probed codec's
+// own keyframe -skip_frame value (see keyframeSkipFor).
+func (r Request) keyframeSkip(skip string) string {
+	if skip == keyframeSkipFrame && r.skipFrame != "" {
+		return r.skipFrame
+	}
+	return skip
+}
+
+// keyframeInputArgs are the input options a Sheets run decodes with skip
+// under, before -i.
+func (r Request) keyframeInputArgs(skip string) []string {
+	args := []string{skipFrameOption, r.keyframeSkip(skip)}
+	if r.lowDelay {
+		args = append(args, "-flags:v", "+low_delay")
+	}
+	return args
+}
+
+// keyframeSkipFor returns the -skip_frame value that keeps codec's
+// keyframes, or "" for keyframeSkipFrame. Interlaced MPEG-2 often codes a
+// keyframe as an I field paired with a P field, which the decoder reports
+// as a P frame and "nokey" discards (one of 80 samples of a DVD-sourced
+// episode decoded). The MPEG-1/2 decoder honors only "noref" and "nokey"
+// ("nointra" acts as "noref"), so keeping the keyframe's P field means
+// decoding every P picture: about two and a half times the work of "nokey".
+// MPEG-1 has no field pictures, and "nokey" keeps its keyframes.
+func keyframeSkipFor(codec string) string {
+	if codec == "mpeg2video" {
+		return exactSkipFrame
+	}
+	return ""
+}
+
+// keyframeLowDelayFor reports whether codec's keyframes need the decoder's
+// low-delay mode. An MPEG-4 Part 2 decoder (XviD, DivX) holds each picture
+// back for B-frames that a keyframes-only read never sends, and releases it
+// with the next keyframe's time: every sample of a packed-bitstream AVI
+// showed the keyframe a whole GOP before its own, and the first had none.
+// Without B-frames to reorder, low delay hands each keyframe out at once.
+func keyframeLowDelayFor(codec string) bool {
+	switch codec {
+	case "mpeg4", "msmpeg4v1", "msmpeg4v2", "msmpeg4v3", "msmpeg4":
+		return true
+	}
+	return false
+}
diff --git a/internal/mediasample/run.go b/internal/mediasample/run.go
index 8488c815fc..a043730d14 100644
--- a/internal/mediasample/run.go
+++ b/internal/mediasample/run.go
@@ -10,6 +10,7 @@ import (
 	"os/exec"
 	"path/filepath"
 	"strings"
+	"sync/atomic"
 	"time"
 
 	"github.com/prairie-server/prairie-server/internal/playback"
@@ -34,7 +35,7 @@ type Runner struct {
 	// starts ffmpeg.
 	Exec ExecFunc
 	// Capabilities returns the binary's inventory when a run needs it, which
-	// only software tone mapping of images does so far. Nil means
+	// only software tone mapping of images and sheets does so far. Nil means
 	// LoadCapabilities; tests replace it.
 	Capabilities func(ctx context.Context, ffmpegPath string) (Capabilities, error)
 	// Fallback reports whether a run moves on to its next attempt after
@@ -118,8 +119,9 @@ func (r Runner) Run(ctx context.Context, req Request) (Result, error) {
 	}
 	failure := &Error{}
 	toneMap := &toneMapResolver{}
+	keyframes := sheetKeyframes(ctx, req)
 	for _, attempt := range req.attempts() {
-		result, attemptErr := r.runAttempt(ctx, req, attempt, toneMap)
+		result, attemptErr := r.runAttempt(ctx, req, attempt, toneMap, keyframes)
 		if attemptErr == nil {
 			return result, nil
 		}
@@ -132,7 +134,7 @@ func (r Runner) Run(ctx context.Context, req Request) (Result, error) {
 	return Result{}, failure
 }
 
-func (r Runner) runAttempt(ctx context.Context, req Request, attempt Attempt, toneMap *toneMapResolver) (Result, *AttemptError) {
+func (r Runner) runAttempt(ctx context.Context, req Request, attempt Attempt, toneMap *toneMapResolver, keyframes []float64) (Result, *AttemptError) {
 	decoder := softwareDecoder
 	if attempt.Hardware {
 		decoder = "hardware:" + r.HWAccel
@@ -140,7 +142,7 @@ func (r Runner) runAttempt(ctx context.Context, req Request, attempt Attempt, to
 	// A hardware attempt reserves its device, and an image or sheet attempt
 	// settles its filters, before its timeout starts, so neither eats into
 	// the decode's time.
-	hw, release, failure := r.reserveHardware(attempt)
+	hw, release, failure := r.reserveHardware(req, attempt)
 	if failure != nil {
 		failure.Decoder = decoder
 		return Result{}, failure
@@ -170,7 +172,7 @@ func (r Runner) runAttempt(ctx context.Context, req Request, attempt Attempt, to
 		attemptCtx, cancel = context.WithTimeout(ctx, time.Duration(attempt.TimeoutSeconds*float64(time.Second)))
 		defer cancel()
 	}
-	run := attemptRun{runner: r, ctx: ctx, attemptCtx: attemptCtx, attempt: attempt, hw: hw, decoder: decoder, sheetsGraph: sheetsGraph, toneMap: toneMap}
+	run := attemptRun{runner: r, ctx: ctx, attemptCtx: attemptCtx, attempt: attempt, hw: hw, decoder: decoder, sheetsGraph: sheetsGraph, toneMap: toneMap, keyframes: keyframes}
 	switch {
 	case req.At != nil:
 		return run.image(req, imageArgs)
@@ -181,19 +183,23 @@ func (r Runner) runAttempt(ctx context.Context, req Request, attempt Attempt, to
 }
 
 // reserveHardware returns the hardware attempt decodes on. A hardware
-// attempt reserves one render device through playback.AcquireHWDevice,
-// falling back to playback.PickRenderDevice, until release is called. A
-// multi-device HWDevice therefore resolves to one device per attempt, and the
-// reservation spans only this attempt. A hardware attempt the host cannot
-// run, such as VAAPI without a render device, fails as unsupported without
+// attempt reserves one device through playback.AcquireHWDevice, falling back
+// to playback.PickRenderDevice for an accelerator that opens a render device,
+// until release is called. A multi-device HWDevice therefore resolves to one
+// device per attempt, and the reservation spans only this attempt. A hardware
+// attempt the host cannot run, such as VAAPI without a render device, or req's
+// outputs cannot run on, such as stats on CUDA, fails as unsupported without
 // starting ffmpeg: that is no fault of the request or the file.
-func (r Runner) reserveHardware(attempt Attempt) (hardwareDecode, func(), *AttemptError) {
+func (r Runner) reserveHardware(req Request, attempt Attempt) (hardwareDecode, func(), *AttemptError) {
 	hw := hardwareDecode{Accel: r.HWAccel}
 	if !attempt.Hardware {
 		return hw, func() {}, nil
 	}
+	if !req.supportsHardware(r.HWAccel) {
+		return hardwareDecode{}, nil, &AttemptError{Reason: ReasonUnsupported, Err: fmt.Errorf("hardware decode does not support %q for this output", r.HWAccel)}
+	}
 	device, release := playback.AcquireHWDevice(r.HWDevice, r.HWAccel)
-	if device == "" {
+	if device == "" && usesRenderDevice(r.HWAccel) {
 		device = playback.PickRenderDevice("")
 	}
 	hw.Device = device
@@ -218,12 +224,17 @@ type attemptRun struct {
 	// sheetsGraph is the video chain of a Sheets request.
 	sheetsGraph string
 	toneMap     *toneMapResolver
+	// keyframes are the input's video keyframe times a Sheets list starts
+	// its entries at (see keyframes.go), nil for sample-time entries.
+	keyframes []float64
 }
 
 // samples runs a Samples request. Unless it reads through, it probes the
 // input first (see probe.go), then reads it through a concat list when its
 // container seeks to keyframes. Otherwise it reads one keyframes-only window
-// and picks the samples from its keyframes.
+// and picks the samples from its keyframes. Sheets always probe, since the
+// codec decides how their keyframes are decoded (see keyframeSkipFor and
+// keyframeLowDelayFor).
 //
 // Sheets read through a list that comes back empty because the decoder
 // dropped keyframes as duplicates are read again as that window. One decoder serves every
@@ -237,14 +248,24 @@ type attemptRun struct {
 // still fails.
 func (a attemptRun) samples(req Request) (Result, *AttemptError) {
 	var listFailure *AttemptError
-	if !req.Samples.ReadThrough || (req.Sheets != nil && req.Sheets.UseInputAspect) {
+	// illegalShortTerm records an H.264 list that discarded keyframes over
+	// skipped reference pictures. A keyframes-only window discards the same
+	// keyframes, so such a list goes straight to the reference-picture read.
+	illegalShortTerm := false
+	// Sheets always probe: the codec decides how keyframes are read (see
+	// keyframeSkipFor), even for a read-through window.
+	if !req.Samples.ReadThrough || req.Sheets != nil {
 		header := &inputHeaderParser{}
 		if failure := a.exec(req, probeArgs(req.Input), nil, nil, header.line); failure != nil {
 			return Result{}, failure
 		}
+		if req.Sheets != nil {
+			req.skipFrame = keyframeSkipFor(header.info.VideoCodec)
+			req.lowDelay = keyframeLowDelayFor(header.info.VideoCodec)
+		}
 		if req.Sheets != nil && req.Sheets.UseInputAspect {
 			out := req.Sheets.forDisplayAspect(header.info.displayAspect())
-			if err := out.validate(); err != nil {
+			if err := errors.Join(out.validate(), out.validateRun(len(req.Samples.Seconds))); err != nil {
 				return Result{}, &AttemptError{Decoder: a.decoder, Reason: ReasonArgs, Err: err}
 			}
 			req.Sheets = &out
@@ -260,7 +281,7 @@ func (a attemptRun) samples(req Request) (Result, *AttemptError) {
 				return a.decode(req, header.info.StartSeconds)
 			}
 			duplicates := false
-			result, failure := a.sheets(req, req.Samples.Seconds, header.info.StartSeconds, watchDuplicatePOC(&duplicates))
+			result, failure := a.sheets(req, req.Samples.Seconds, header.info.StartSeconds, watchDuplicatePOC(&duplicates), watchIllegalShortTerm(&illegalShortTerm))
 			if failure == nil || failure.Reason != ReasonEmpty || !duplicates {
 				return result, failure
 			}
@@ -272,18 +293,32 @@ func (a attemptRun) samples(req Request) (Result, *AttemptError) {
 	windowReq.Samples = nil
 	windowReq.Window = &window
 	if req.Sheets != nil {
+		if listFailure != nil && illegalShortTerm {
+			referenceWindow := window
+			referenceWindow.referencePictures = true
+			windowReq.Window = &referenceWindow
+		}
 		duplicates := false
 		result, failure := a.sheets(windowReq, req.Samples.Seconds, 0, watchDuplicatePOC(&duplicates))
+		// Keyframes a whole picture order count cycle apart collide in a
+		// window too, since skipped pictures do not advance the count, and
+		// H.264 keyframes that mark skipped pictures are discarded. Each
+		// sample after a dropped keyframe shows the keyframe before it and
+		// counts as filled, so a window that dropped a few still publishes,
+		// as a sequential keyframe read would. One that dropped more than
+		// maxDroppedKeyframeShare allows is read once more decoding every
+		// reference picture, which keeps the decoder's state whole at
+		// several times the cost.
+		if failure != nil && failure.Reason == ReasonEmpty && duplicates && !windowReq.Window.referencePictures {
+			referenceReq := windowReq
+			referenceWindow := window
+			referenceWindow.referencePictures = true
+			referenceReq.Window = &referenceWindow
+			result, failure = a.sheets(referenceReq, req.Samples.Seconds, 0)
+		}
 		if listFailure == nil {
 			return result, failure
 		}
-		// Keyframes a whole picture order count cycle apart collide in a
-		// window too, since skipped pictures do not advance the count. The
-		// window would then give later samples the last keyframe it kept and
-		// count them as decoded, so it fails instead.
-		if failure == nil && duplicates {
-			result, failure = Result{}, &AttemptError{Decoder: a.decoder, Reason: ReasonEmpty, Err: errors.New("ffmpeg dropped keyframes as duplicates in the window too")}
-		}
 		// A window that fails too reports its own failure, whose reason and
 		// log describe the latest read, and names the list's in its error.
 		if failure != nil {
@@ -358,18 +393,96 @@ func (a attemptRun) decode(req Request, inputStart float64) (Result, *AttemptErr
 // "Skipping invalid undecodable NALU" and do not send a list to the window.
 const duplicatePOCMessage = "Duplicate POC in a sequence"
 
+// illegalShortTermMessage is what ffmpeg's H.264 decoder logs when a
+// keyframe's reference marking names pictures a keyframes-only read skipped,
+// and it discards the keyframe. A keyframes-only window fails the same way;
+// decoding the reference pictures too keeps the marking whole.
+const illegalShortTermMessage = "illegal short term buffer state"
+
+// droppedKeyframe reports whether line is a decoder dropping a keyframe
+// over state a keyframes-only read did not keep: duplicatePOCMessage or
+// illegalShortTermMessage.
+func droppedKeyframe(line string) bool {
+	return strings.Contains(line, duplicatePOCMessage) || strings.Contains(line, illegalShortTermMessage)
+}
+
+// watchIllegalShortTerm returns a log handler that sets *seen once ffmpeg
+// logs illegalShortTermMessage.
+func watchIllegalShortTerm(seen *bool) func(string) {
+	return func(line string) {
+		*seen = *seen || strings.Contains(line, illegalShortTermMessage)
+	}
+}
+
 // watchDuplicatePOC returns a log handler that sets *seen once ffmpeg logs
-// duplicatePOCMessage.
+// a dropped keyframe (see droppedKeyframe).
 func watchDuplicatePOC(seen *bool) func(string) {
 	return func(line string) {
-		*seen = *seen || strings.Contains(line, duplicatePOCMessage)
+		*seen = *seen || droppedKeyframe(line)
 	}
 }
 
 // sheets runs a Sheets request for the sample times, reading req's list
-// (with inpoints offset by inputStart) or window, and tiles the frames.
-// logHandlers also read ffmpeg's log.
+// (with inpoints offset by inputStart) or window, repairs a list's weak cells
+// (see sheet_repair.go), and tiles the frames. logHandlers also read
+// ffmpeg's log, except what an abandoned keyframe list logs from the line
+// that abandons it on (see keyframeSheets).
 func (a attemptRun) sheets(req Request, times []float64, inputStart float64, logHandlers ...func(string)) (Result, *AttemptError) {
+	if req.Samples == nil {
+		return a.readSheets(req, times, listPlan{}, nil, logHandlers...)
+	}
+	if len(a.keyframes) > 0 {
+		if result, failure, ok := a.keyframeSheets(req, times, inputStart, logHandlers); ok {
+			return result, failure
+		}
+	}
+	return a.readSheets(req, times, samplePlan(times, inputStart), nil, logHandlers...)
+}
+
+// keyframeSheets reads req's list with entries starting at keyframes (see
+// keyframes.go). It stops ffmpeg and reports false, for the caller to read
+// the samples from their own times, as soon as the decoder passes on a frame
+// from an earlier entry than the frame before it or drops a keyframe (see
+// droppedKeyframe); logHandlers see none of the log from then on. An
+// abandoned read never counts: when the attempt has ended by then, it fails
+// as timed out or canceled.
+func (a attemptRun) keyframeSheets(req Request, times []float64, inputStart float64, logHandlers []func(string)) (Result, *AttemptError, bool) {
+	ctx, cancel := context.WithCancel(a.attemptCtx)
+	defer cancel()
+	var abandoned atomic.Bool
+	abandon := func() {
+		abandoned.Store(true)
+		cancel()
+	}
+	run := a
+	run.attemptCtx = ctx
+	result, failure := run.readSheets(req, times, keyframePlan(times, inputStart, a.keyframes), abandon, func(line string) {
+		if droppedKeyframe(line) {
+			abandon()
+		}
+		if abandoned.Load() {
+			return
+		}
+		for _, handler := range logHandlers {
+			handler(line)
+		}
+	})
+	if !abandoned.Load() {
+		return result, failure, true
+	}
+	switch {
+	case a.ctx.Err() != nil:
+		return Result{}, &AttemptError{Decoder: a.decoder, Reason: ReasonCanceled, Err: a.ctx.Err()}, true
+	case a.attemptCtx.Err() != nil:
+		return Result{}, &AttemptError{Decoder: a.decoder, Reason: ReasonTimeout, Err: a.attemptCtx.Err()}, true
+	}
+	return Result{}, nil, false
+}
+
+// readSheets runs one Sheets read: plan's list, or req's window when it has
+// no Samples. onDisorder, when set, is called once a list frame comes from an
+// earlier entry than the frame before it. logHandlers also read ffmpeg's log.
+func (a attemptRun) readSheets(req Request, times []float64, plan listPlan, onDisorder func(), logHandlers ...func(string)) (Result, *AttemptError) {
 	var packetTimingPath string
 	if req.Window != nil {
 		dir, err := os.MkdirTemp("", "prairie-sheets-*")
@@ -379,7 +492,7 @@ func (a attemptRun) sheets(req Request, times []float64, inputStart float64, log
 		defer func() { _ = os.RemoveAll(dir) }()
 		packetTimingPath = filepath.Join(dir, "packets.framecrc")
 	}
-	args, stdinBytes, err := buildSheetsArgs(req, a.attempt, a.hw, inputStart, a.sheetsGraph, packetTimingPath)
+	args, stdinBytes, err := buildSheetsArgs(req, a.attempt, a.hw, plan.entries, a.sheetsGraph, packetTimingPath, sampledSheetsList)
 	if err != nil {
 		return Result{}, &AttemptError{Decoder: a.decoder, Reason: ReasonArgs, Err: err}
 	}
@@ -387,7 +500,12 @@ func (a attemptRun) sheets(req Request, times []float64, inputStart float64, log
 	if req.Window != nil {
 		offset = req.Window.StartSeconds
 	}
-	assembler := newSheetAssembler(*req.Sheets, times, req.Samples != nil, offset)
+	assembler := newSheetAssembler(*req.Sheets, times, req.Samples != nil, offset, sampledSheetsList.span)
+	if req.Samples != nil {
+		assembler.plan = plan
+		assembler.onDisorder = onDisorder
+	}
+	assembler.dtsTiming = req.lowDelay
 	if failure := a.exec(req, args, stdinBytes, assembler, append(logHandlers, assembler.line)...); failure != nil {
 		return Result{}, failure
 	}
@@ -396,6 +514,17 @@ func (a attemptRun) sheets(req Request, times []float64, inputStart float64, log
 			return Result{}, &AttemptError{Decoder: a.decoder, Reason: ReasonOutput, Err: fmt.Errorf("read packet timing: %w", err)}
 		}
 	}
+	if failure := assembler.close(); failure != nil {
+		failure.Decoder = a.decoder
+		return Result{}, failure
+	}
+	if req.Samples != nil {
+		assembler.shareFrames()
+		a.repairSheets(req, assembler, plan.inputStart)
+		if err := a.ctx.Err(); err != nil {
+			return Result{}, &AttemptError{Decoder: a.decoder, Reason: ReasonCanceled, Err: err}
+		}
+	}
 	sheets, frames, failure := assembler.finish()
 	if failure != nil {
 		failure.Decoder = a.decoder
diff --git a/internal/mediasample/sheet_repair.go b/internal/mediasample/sheet_repair.go
new file mode 100644
index 0000000000..54e7282fda
--- /dev/null
+++ b/internal/mediasample/sheet_repair.go
@@ -0,0 +1,211 @@
+package mediasample
+
+import (
+	"context"
+	"math"
+	"time"
+)
+
+// A sampled list gives each sample the keyframe at or before its time. Two
+// kinds of cell come out of that run worse than the input allows, and a
+// repair reads their samples again, after the run and before the sheets are
+// encoded:
+//
+//   - Missing cells decoded no frame. The demuxer could not seek to a
+//     keyframe before the sample, as in a container that flags no keyframes
+//     (VC-1 in Matroska, whose I-frames only the decoder recognizes), or the
+//     HEVC decoder dropped the keyframe as a duplicate picture order count
+//     (see watchDuplicatePOC). The repair lists them again, keyframes only,
+//     each entry lasting until the next sample: the decoder starts afresh
+//     and finds the keyframe before the sample, or failing that the first
+//     one after it.
+//   - Repeated cells show the same moment as the cell before, because no
+//     keyframe lies between the two samples: a long GOP. Two cells whose
+//     frames lie within repeatShare of the time between their samples count,
+//     since an open-GOP keyframe can bring a leading picture just before it
+//     that one sample keeps and the next does not. The repair lists them
+//     again decoding every reference frame (-skip_frame noref) from the
+//     keyframe on, and keeps the last frame at or before the sample's time,
+//     so the cell shows its own moment instead of a repeat.
+//
+// Each repaired sample keeps its nearest frame: the last at or before its
+// time, else the first after it. A repair that fails or runs out of time
+// keeps the frames it already placed, which ffmpeg wrote and logged in
+// order, and changes nothing else; the run's own result stands. Repairs
+// share one time box, so a long-GOP 4K file decoded in software adds at most
+// repairBaseSeconds plus repairSecondsPerSample per sample to its attempt.
+const (
+	repairBaseSeconds      = 30
+	repairSecondsPerSample = 0.25
+	// repeatShare is how close, as a share of the time between their
+	// samples, two cells' frames lie when they show the same moment.
+	repeatShare = 0.1
+	// exactSkipFrame decodes the reference frames a repeated cell's moment
+	// may lie on, skipping the frames nothing else is predicted from.
+	exactSkipFrame = "noref"
+	// keyframeSkipFrame decodes only keyframes, as every list does.
+	keyframeSkipFrame = "nokey"
+)
+
+// sheetsList is how a Sheets list reads its samples: each entry lasts span
+// seconds, and the decoder skips frames as -skip_frame:v skip says.
+type sheetsList struct {
+	span float64
+	skip string
+}
+
+// sampledSheetsList is how the first run of a sampled list reads.
+var sampledSheetsList = sheetsList{span: sheetSampleSpanSeconds, skip: keyframeSkipFrame}
+
+// sheetCandidate is the frame a repair keeps for one sample so far.
+type sheetCandidate struct {
+	frame  []byte
+	source float64
+	// before marks a frame at or before the sample's time.
+	before bool
+}
+
+// offer keeps frame as cell's candidate when it lies nearer the sample's
+// time than the candidate so far: a frame at or before the time replaces any
+// earlier one, since frames arrive in presentation order, and a frame after
+// it only fills an empty candidate.
+func (a *sheetAssembler) offer(cell int, source float64, frame []byte) {
+	candidate := &a.candidates[cell]
+	before := !math.IsNaN(source) && source <= a.times[cell]+sampleMatchSeconds
+	if candidate.frame != nil && !before {
+		a.recycle(frame)
+		return
+	}
+	a.recycle(candidate.frame)
+	*candidate = sheetCandidate{frame: frame, source: source, before: before}
+}
+
+// repairs returns the cells of a closed sampled run worth a second read:
+// those without a frame, and those whose frame is the keyframe the cell
+// before already shows. A run that decoded nothing is repaired too: a
+// container that flags no keyframes can miss every short list entry.
+func (a *sheetAssembler) repairs() (missing, repeated []int) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	if !a.sampled {
+		return nil, nil
+	}
+	for cell := range a.times {
+		switch {
+		case !a.placed(cell):
+			missing = append(missing, cell)
+		case cell > 0 && a.placed(cell-1) && math.Abs(a.sources[cell]-a.sources[cell-1]) < repeatShare*(a.times[cell]-a.times[cell-1]):
+			repeated = append(repeated, cell)
+		}
+	}
+	return missing, repeated
+}
+
+// placed reports whether cell holds a frame of its own.
+func (a *sheetAssembler) placed(cell int) bool {
+	canvas := a.open[cell/a.perSheet]
+	return canvas != nil && canvas.set[cell%a.perSheet]
+}
+
+// adopt places the candidates a repair over cells collected. A missing cell
+// takes any candidate; a repeated cell only one at or before its time and
+// later than the frame it shows.
+func (a *sheetAssembler) adopt(cells []int, repair *sheetAssembler) {
+	repair.mu.Lock()
+	defer repair.mu.Unlock()
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	for i, cell := range cells {
+		candidate := repair.candidates[i]
+		if candidate.frame == nil {
+			continue
+		}
+		missing := !a.placed(cell)
+		if !missing && (!candidate.before || !(candidate.source > a.sources[cell]+sampleMatchSeconds)) {
+			continue
+		}
+		canvas := a.canvas(cell / a.perSheet)
+		slot := cell % a.perSheet
+		canvas.write(slot, candidate.frame)
+		canvas.set[slot] = true
+		a.sources[cell] = candidate.source
+		if missing {
+			a.decoded++
+		}
+		if !a.refinedCells[cell] {
+			a.refinedCells[cell] = true
+			a.refined++
+		}
+	}
+}
+
+// repairSheets runs the repairs a closed sampled run needs, within their
+// time box and the attempt's.
+func (a attemptRun) repairSheets(req Request, run *sheetAssembler, inputStart float64) {
+	missing, repeated := run.repairs()
+	if len(missing) == 0 && len(repeated) == 0 {
+		return
+	}
+	budget := time.Duration((repairBaseSeconds + repairSecondsPerSample*float64(len(run.times))) * float64(time.Second))
+	ctx, cancel := context.WithTimeout(a.attemptCtx, budget)
+	defer cancel()
+	repair := a
+	repair.attemptCtx = ctx
+	if len(missing) > 0 {
+		repair.repair(req, run, missing, inputStart, sheetsList{span: missingRepairSpan(run.times), skip: keyframeSkipFrame})
+		// A recovered cell can show the keyframe of the cell after it.
+		_, repeated = run.repairs()
+	}
+	if len(repeated) > 0 && ctx.Err() == nil {
+		repair.repair(req, run, repeated, inputStart, sheetsList{span: sheetSampleSpanSeconds, skip: exactSkipFrame})
+	}
+}
+
+// repair reads the samples of cells again as list says and adopts what it
+// finds. A read that ffmpeg finishes must line up with its log, as a run's
+// does; one cut short keeps the frames it placed, each written and logged in
+// order before the end.
+func (a attemptRun) repair(req Request, run *sheetAssembler, cells []int, inputStart float64, list sheetsList) {
+	times := make([]float64, len(cells))
+	for i, cell := range cells {
+		times[i] = run.times[cell]
+	}
+	repairReq := req
+	repairReq.Samples = &Samples{Seconds: times}
+	plan := samplePlan(times, inputStart)
+	args, stdinBytes, err := buildSheetsArgs(repairReq, a.attempt, a.hw, plan.entries, a.sheetsGraph, "", list)
+	if err != nil {
+		return
+	}
+	collector := newSheetAssembler(*req.Sheets, times, true, 0, list.span)
+	collector.plan = plan
+	collector.candidates = make([]sheetCandidate, len(times))
+	finished := a.exec(req, args, stdinBytes, collector, collector.line) == nil
+	if (finished && collector.close() != nil) || (!finished && collector.broken()) {
+		return
+	}
+	run.adopt(cells, collector)
+}
+
+// broken reports whether the frames seen so far stopped lining up with the
+// log.
+func (a *sheetAssembler) broken() bool {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	return a.err != nil
+}
+
+// missingRepairSpan is how long a missing sample's repair entry lasts: until
+// the next sample, the shortest gap between the run's samples, so a frame it
+// finds after the sample's time stays in the sample's own stretch. A run of
+// one sample takes a second.
+func missingRepairSpan(times []float64) float64 {
+	span := math.Inf(1)
+	for i := 1; i < len(times); i++ {
+		span = math.Min(span, times[i]-times[i-1])
+	}
+	if math.IsInf(span, 1) {
+		return 1
+	}
+	return math.Max(span, sheetSampleSpanSeconds)
+}
diff --git a/internal/mediasample/sheet_repair_test.go b/internal/mediasample/sheet_repair_test.go
new file mode 100644
index 0000000000..5dbb2c4cf1
--- /dev/null
+++ b/internal/mediasample/sheet_repair_test.go
@@ -0,0 +1,259 @@
+package mediasample
+
+import (
+	"context"
+	"errors"
+	"io"
+	"math"
+	"slices"
+	"strings"
+	"testing"
+)
+
+// at is a frame tagged for sample, logged at pts in the list's timeline.
+func at(luma byte, sample float64, pts string) fakeSheetFrame {
+	return fakeSheetFrame{luma: luma, sample: &sample, pts: pts}
+}
+
+// runSequence answers the probe and then each list run with the next fake,
+// returning err after the run whose index fails names.
+func runSequence(runs []*fakeSheets, fail map[int]error) (ExecFunc, *[][]string) {
+	var calls [][]string
+	next := 0
+	return func(ctx context.Context, name string, args []string, stdin io.Reader, stdout, stderr io.Writer) error {
+		calls = append(calls, args)
+		if !slices.Contains(args, "concat") {
+			return runs[0].exec(ctx, name, args, stdin, stdout, stderr)
+		}
+		run := next
+		next++
+		if err := runs[run].exec(ctx, name, args, stdin, stdout, stderr); err != nil {
+			return err
+		}
+		return fail[run]
+	}, &calls
+}
+
+// TestRunSheetsRepairsMissingSamples decodes two of four samples through the
+// list, as a container that flags no keyframes leaves a seek with none
+// before the sample. The repair lists the other two again, each entry
+// lasting until the next sample, and keeps the keyframe it finds after each
+// sample's time.
+func TestRunSheetsRepairsMissingSamples(t *testing.T) {
+	list := &fakeSheets{format: "matroska,webm", frames: []fakeSheetFrame{tagged(10, 5), tagged(30, 25)}}
+	repair := &fakeSheets{frames: []fakeSheetFrame{at(20, 15, "0.4"), at(40, 35, "10.2")}}
+	exec, calls := runSequence([]*fakeSheets{list, repair}, nil)
+	result, err := Runner{Exec: exec}.Run(t.Context(), sheetsRequest(secondsFrom(5, 10, 4), 2, 2))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := sheetLumas(t, result, 2, 2); !near(got[0], []int{10, 20, 30, 40}) {
+		t.Fatalf("cells %v, want every sample", got)
+	}
+	if result.SheetFrames != (SheetFrames{Decoded: 4, Refined: 2}) {
+		t.Fatalf("frames %+v, want 4 decoded, 2 of them repaired", result.SheetFrames)
+	}
+	if len(*calls) != 3 || !strings.Contains(strings.Join((*calls)[2], " "), "-skip_frame:v nokey") {
+		t.Fatalf("runs %q, want a probe, the list, and a keyframes-only repair", *calls)
+	}
+	want := "ffconcat version 1.0\n" +
+		"file 'file:/media/a.mkv'\nfile_packet_meta sample 15\ninpoint 15\noutpoint 25\n" +
+		"file 'file:/media/a.mkv'\nfile_packet_meta sample 35\ninpoint 35\noutpoint 45\n"
+	if len(repair.lists) != 1 || repair.lists[0] != want {
+		t.Fatalf("repair list %q, want %q", repair.lists, want)
+	}
+}
+
+// TestRunSheetsRepairsRepeatedKeyframes gives the first two samples the same
+// keyframe, at 2 s, as a GOP longer than the interval does. The repair lists
+// the second sample again decoding reference frames, and the cell takes the
+// last frame at or before its time rather than the one after it.
+func TestRunSheetsRepairsRepeatedKeyframes(t *testing.T) {
+	// A frame for sample k of a list whose entries last 0.5 s has the input
+	// time pts - 0.5k + sample.
+	list := &fakeSheets{format: "matroska,webm", frames: []fakeSheetFrame{at(10, 5, "-3"), at(11, 15, "-12.5"), at(30, 25, "-4")}}
+	repair := &fakeSheets{frames: []fakeSheetFrame{at(11, 15, "-13"), at(20, 15, "-1"), at(21, 15, "0.2")}}
+	exec, calls := runSequence([]*fakeSheets{list, repair}, nil)
+	result, err := Runner{Exec: exec}.Run(t.Context(), sheetsRequest(secondsFrom(5, 10, 3), 3, 1))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := sheetLumas(t, result, 3, 1); !near(got[0], []int{10, 20, 30}) {
+		t.Fatalf("cells %v, want the second sample's own moment", got)
+	}
+	if result.SheetFrames != (SheetFrames{Decoded: 3, Refined: 1}) {
+		t.Fatalf("frames %+v, want 3 decoded, 1 of them repaired", result.SheetFrames)
+	}
+	if len(*calls) != 3 || !strings.Contains(strings.Join((*calls)[2], " "), "-skip_frame:v noref") || strings.Count(repair.lists[0], "file ") != 1 {
+		t.Fatalf("runs %q, lists %q; want one reference-frame repair of the second sample", *calls, repair.lists)
+	}
+}
+
+// TestRunSheetsRepairFindsTheInputStart reads each list input's start time
+// from its header: ffmpeg shifts every frame by it, and without it the
+// repair would take frames just before the sample's time for frames after it.
+func TestRunSheetsRepairFindsTheInputStart(t *testing.T) {
+	// The input time of a frame for sample k is pts - 0.3 - 0.5k + sample.
+	list := &fakeSheets{format: "matroska,webm", listStart: -0.3, frames: []fakeSheetFrame{at(10, 5, "-2.7"), at(11, 15, "-12.2"), at(30, 25, "-3.7")}}
+	repair := &fakeSheets{listStart: -0.3, frames: []fakeSheetFrame{at(20, 15, "0.25"), at(21, 15, "0.29"), at(22, 15, "0.5")}}
+	exec, _ := runSequence([]*fakeSheets{list, repair}, nil)
+	result, err := Runner{Exec: exec}.Run(t.Context(), sheetsRequest(secondsFrom(5, 10, 3), 3, 1))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := sheetLumas(t, result, 3, 1); !near(got[0], []int{10, 21, 30}) {
+		t.Fatalf("cells %v, want the last frame before 15 s", got)
+	}
+}
+
+// TestRunSheetsKeepsWhatAnInterruptedRepairPlaced ends the repair with an
+// error after its first frame, as its time box would. The frame it placed
+// stands, the other sample shows its neighbor, and the run succeeds.
+func TestRunSheetsKeepsWhatAnInterruptedRepairPlaced(t *testing.T) {
+	list := &fakeSheets{format: "matroska,webm", frames: []fakeSheetFrame{tagged(10, 5), tagged(30, 25), tagged(50, 45), tagged(60, 55), tagged(70, 65), tagged(80, 75), tagged(90, 85), tagged(100, 95)}}
+	repair := &fakeSheets{frames: []fakeSheetFrame{at(20, 15, "0.4")}}
+	exec, _ := runSequence([]*fakeSheets{list, repair}, map[int]error{1: context.DeadlineExceeded})
+	result, err := Runner{Exec: exec}.Run(t.Context(), sheetsRequest(secondsFrom(5, 10, 10), 5, 2))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := sheetLumas(t, result, 5, 2); !near(got[0], []int{10, 20, 30, 30, 50, 60, 70, 80, 90, 100}) {
+		t.Fatalf("cells %v", got)
+	}
+	if result.SheetFrames != (SheetFrames{Decoded: 9, Filled: 1, Refined: 1}) {
+		t.Fatalf("frames %+v, want 9 decoded with 1 repaired and 1 filled", result.SheetFrames)
+	}
+}
+
+// TestRunSheetsIgnoresABrokenRepair changes nothing when the repair's frames
+// do not line up with its log.
+func TestRunSheetsIgnoresABrokenRepair(t *testing.T) {
+	seconds := secondsFrom(5, 10, 11)
+	var frames []fakeSheetFrame
+	for i, at := range seconds {
+		if i != 1 {
+			frames = append(frames, tagged(byte(10*(i+1)), at))
+		}
+	}
+	list := &fakeSheets{format: "matroska,webm", frames: frames}
+	repair := &fakeSheets{frames: []fakeSheetFrame{at(200, 15, "0.4")}, extraStdout: rawFrame(1)}
+	exec, _ := runSequence([]*fakeSheets{list, repair}, nil)
+	result, err := Runner{Exec: exec}.Run(t.Context(), sheetsRequest(seconds, 6, 2))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := sheetLumas(t, result, 6, 2); got[0][1] > 13 {
+		t.Fatalf("cells %v, want the missing sample filled from its neighbor", got)
+	}
+	if result.SheetFrames.Refined != 0 || result.SheetFrames.Filled != 1 {
+		t.Fatalf("frames %+v, want the broken repair ignored", result.SheetFrames)
+	}
+}
+
+// TestRunSheetsCanceledDuringRepairFails ends the run as canceled when the
+// caller cancels while a repair runs.
+func TestRunSheetsCanceledDuringRepairFails(t *testing.T) {
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+	list := &fakeSheets{format: "matroska,webm", frames: []fakeSheetFrame{tagged(10, 5)}}
+	inner, _ := runSequence([]*fakeSheets{list, {}}, nil)
+	runs := 0
+	exec := func(ctx context.Context, name string, args []string, stdin io.Reader, stdout, stderr io.Writer) error {
+		if slices.Contains(args, "concat") {
+			runs++
+			if runs == 2 {
+				cancel()
+				return ctx.Err()
+			}
+		}
+		return inner(ctx, name, args, stdin, stdout, stderr)
+	}
+	_, err := Runner{Exec: exec}.Run(ctx, sheetsRequest([]float64{5, 15}, 2, 1))
+	if failure, ok := errors.AsType[*Error](err); !ok || failure.Reason != ReasonCanceled {
+		t.Fatalf("error %v, want canceled", err)
+	}
+}
+
+// TestRunSheetsAcceptsAGraphReinit restarts the filter's frame counter at
+// zero halfway, as a hardware decoder that renews its surfaces makes ffmpeg
+// rebuild the graph. The frames still line up with the log.
+func TestRunSheetsAcceptsAGraphReinit(t *testing.T) {
+	fake := &fakeSheets{format: "matroska,webm", frames: []fakeSheetFrame{tagged(10, 5), tagged(20, 15), tagged(30, 25), tagged(40, 35)},
+		editLog: func(log []string) []string {
+			log[4] = strings.Replace(log[4], "frame:2", "frame:0", 1)
+			log[6] = strings.Replace(log[6], "frame:3", "frame:1", 1)
+			return log
+		}}
+	result, err := Runner{Exec: fake.exec}.Run(t.Context(), sheetsRequest(secondsFrom(5, 10, 4), 2, 2))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := sheetLumas(t, result, 2, 2); !near(got[0], []int{10, 20, 30, 40}) {
+		t.Fatalf("cells %v", got)
+	}
+}
+
+func TestMissingRepairSpan(t *testing.T) {
+	for _, tt := range []struct {
+		times []float64
+		want  float64
+	}{
+		{[]float64{5}, 1},
+		{[]float64{5, 15, 25, 34}, 9},
+		{[]float64{5, 5.2}, sheetSampleSpanSeconds},
+	} {
+		if got := missingRepairSpan(tt.times); got != tt.want {
+			t.Errorf("missingRepairSpan(%v) = %g, want %g", tt.times, got, tt.want)
+		}
+	}
+}
+
+// TestRunSheetsRepairsAListThatDecodedNothing repairs a list whose short
+// entries all missed a keyframe, as one over a container that flags none can.
+func TestRunSheetsRepairsAListThatDecodedNothing(t *testing.T) {
+	list := &fakeSheets{format: "matroska,webm", frames: []fakeSheetFrame{{luma: 9, pts: "0"}}}
+	repair := &fakeSheets{frames: []fakeSheetFrame{at(10, 5, "0.2"), at(20, 15, "10.2"), at(30, 25, "20.2"), at(40, 35, "30.2")}}
+	exec, _ := runSequence([]*fakeSheets{list, repair}, nil)
+	result, err := Runner{Exec: exec}.Run(t.Context(), sheetsRequest(secondsFrom(5, 10, 4), 2, 2))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := sheetLumas(t, result, 2, 2); !near(got[0], []int{10, 20, 30, 40}) || result.SheetFrames != (SheetFrames{Decoded: 4, Refined: 4}) {
+		t.Fatalf("cells %v, frames %+v; want every sample from the repair", got, result.SheetFrames)
+	}
+}
+
+// TestRunSheetsRepairsARecoveredRepeat recovers the second sample's missing
+// cell with the keyframe the first cell shows, then decodes it at its own
+// time. The cell counts as repaired once.
+func TestRunSheetsRepairsARecoveredRepeat(t *testing.T) {
+	list := &fakeSheets{format: "matroska,webm", frames: []fakeSheetFrame{at(10, 5, "-3"), at(30, 25, "-4")}}
+	missing := &fakeSheets{frames: []fakeSheetFrame{at(11, 15, "-13")}}
+	exact := &fakeSheets{frames: []fakeSheetFrame{at(11, 15, "-13"), at(20, 15, "-1")}}
+	exec, calls := runSequence([]*fakeSheets{list, missing, exact}, nil)
+	result, err := Runner{Exec: exec}.Run(t.Context(), sheetsRequest(secondsFrom(5, 10, 3), 3, 1))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := sheetLumas(t, result, 3, 1); !near(got[0], []int{10, 20, 30}) || result.SheetFrames != (SheetFrames{Decoded: 3, Refined: 1}) {
+		t.Fatalf("cells %v, frames %+v; want the second sample's own moment, repaired once", got, result.SheetFrames)
+	}
+	if len(*calls) != 4 || !strings.Contains(strings.Join((*calls)[3], " "), "-skip_frame:v noref") {
+		t.Fatalf("runs %q, want a probe, the list, a keyframe repair, and a reference-frame repair", *calls)
+	}
+}
+
+// TestSourceSecondsFollowsAClampedInpoint places a frame back in the input
+// when the container starts before zero and an early sample's inpoint is
+// clamped there: the same keyframe gives both samples the same time.
+func TestSourceSecondsFollowsAClampedInpoint(t *testing.T) {
+	a := newSheetAssembler(SheetsOutput{TileWidth: 16, TileHeight: 16, Columns: 1, Rows: 1, Quality: 80}, []float64{0, 0.1}, true, 0, 0.5)
+	a.plan = samplePlan(a.times, -0.042)
+	// The keyframe at container time 0 (input time 0.042) opens both entries:
+	// the first at its clamped inpoint 0, the second 0.058 before its inpoint.
+	first := a.sourceSeconds(sheetFrameMeta{seconds: 0, hasTime: true}, 0)
+	second := a.sourceSeconds(sheetFrameMeta{seconds: 0.5 - 0.058, hasTime: true}, 1)
+	if math.Abs(first-0.042) > 1e-9 || math.Abs(second-0.042) > 1e-9 {
+		t.Fatalf("source times %g and %g, want both 0.042", first, second)
+	}
+}
diff --git a/internal/mediasample/sheets.go b/internal/mediasample/sheets.go
index 5764caa8a0..c5f6e1bcd2 100644
--- a/internal/mediasample/sheets.go
+++ b/internal/mediasample/sheets.go
@@ -6,6 +6,8 @@ import (
 	"fmt"
 	"math"
 	"strings"
+
+	"github.com/prairie-server/prairie-server/internal/tonemap"
 )
 
 // SheetsOutput asks for the sampled frames tiled into JPEG sprite sheets,
@@ -54,6 +56,10 @@ type SheetFrames struct {
 	Decoded int `json:"decoded"`
 	// Filled cells had no frame of their own and show a neighbor's.
 	Filled int `json:"filled"`
+	// Refined cells show a frame a repair found (see sheet_repair.go): one
+	// the first read missed, or one nearer the sample's time than the
+	// keyframe the previous cell already shows. They count as decoded too.
+	Refined int `json:"refined,omitzero"`
 }
 
 // Bounds of a SheetsOutput. A sheet of the widest tiles in the largest grid
@@ -65,6 +71,10 @@ const (
 	maxSheetPixels  = 16384
 	maxFilledShare  = 0.1
 	sheetMetadataID = "sheets"
+	// maxSheetsRunPixels bounds the tile pixels of one run, which holds
+	// every tile it decodes, about 1.5 bytes a pixel, until its repairs are
+	// done. Callers chunk longer files into several runs.
+	maxSheetsRunPixels = 64 << 20
 )
 
 func (o SheetsOutput) validate() error {
@@ -82,6 +92,19 @@ func (o SheetsOutput) validate() error {
 	if o.Quality < 1 || o.Quality > 100 {
 		return fmt.Errorf("sheet quality %d is outside 1..100", o.Quality)
 	}
+	if o.ToneMap != nil {
+		return o.ToneMap.validate()
+	}
+	return nil
+}
+
+// validateRun checks that the sheets of samples fit maxSheetsRunPixels.
+func (o SheetsOutput) validateRun(samples int) error {
+	perSheet := o.Columns * o.Rows
+	sheets := (samples + perSheet - 1) / perSheet
+	if pixels := int64(sheets) * int64(perSheet) * int64(o.TileWidth) * int64(o.TileHeight); pixels > maxSheetsRunPixels {
+		return fmt.Errorf("%d sheets of %dx%d tiles of %dx%d exceed %d pixels in one run", sheets, o.Columns, o.Rows, o.TileWidth, o.TileHeight, maxSheetsRunPixels)
+	}
 	return nil
 }
 
@@ -98,45 +121,79 @@ const sheetFullRange = "out_range=full:out_color_matrix=bt601"
 // sheetPixelFormat is the format of the raw frames a Sheets run writes.
 const sheetPixelFormat = "yuv420p"
 
-// buildSheetsGraph returns the video filter chain of a Sheets output for
-// frames decoded on accel (empty for software). softwareToneMap is the
-// software tone-map chain, needed when the attempt tone maps in software.
+// gpuScaleFactor is how many times a tile's size a GPU scales frames to
+// before they are downloaded and scaled the rest of the way in software. The
+// GPU scalers sample a few source pixels per output pixel, so a direct 4K to
+// 300-pixel scale aliases (SSIM 0.94 against an area scale of the same
+// frames); scaling to four tiles' size on the GPU and by area after keeps it
+// at 0.999 while downloading a fraction of the frame.
+const gpuScaleFactor = 4
+
+// sheetsToneMap is how a sheet attempt converts an HDR source. kind is the
+// source's base signal when the request named one (ToneMap.Source). software
+// is the software chain for scaled frames: kind's chain, or the best-effort
+// chain when the request named no kind.
+type sheetsToneMap struct {
+	kind     tonemap.SourceKind
+	software string
+}
+
+// buildSheetsGraph returns the video chain of a Sheets output for frames
+// decoded on accel (empty for software), converting HDR as toneMap says when
+// the output asks for tone mapping.
 //
 // Software and VideoToolbox frames are scaled first, tone mapped if asked,
 // and converted once:
 //
 //	scale=W:H:flags=area:out_range=full:out_color_matrix=bt601,format=yuv420p
-//	scale=W:H:flags=area,<tone map>,scale=out_range=full:out_color_matrix=bt601,format=yuv420p
+//	scale=W:H:flags=area,<software tone map>,scale=out_range=full:out_color_matrix=bt601,format=yuv420p
 //
-// VAAPI surfaces, which QSV decodes into too, are tone mapped on the GPU,
-// which needs the source's HDR metadata and so comes first, scaled there, and
-// downloaded:
+// GPU surfaces (VAAPI, which QSV decodes into too, and CUDA) are scaled on the
+// GPU to gpuScaleFactor tiles, downloaded, and then take the same chain. An
+// HDR source whose base signal the request named downloads as 10-bit P010,
+// so it is tone mapped in software, on thumbnail-sized frames, exactly as on
+// a software attempt: the GPU tone mappers disagree with it and with one
+// another (Intel's VAAPI tone mapper crushes PQ midtones and garbles HLG,
+// AMD's refuses HDR, neither applies a Dolby Vision RPU), and the frames are
+// too small for the cost to matter. A VAAPI attempt without a named signal
+// keeps the best-effort GPU tone map images use; CUDA has none.
 //
-//	[<vaapi tone map>,]scale_vaapi=w=W:h=H:format=nv12,hwdownload,format=nv12,scale=…,format=yuv420p
+//	scale_vaapi=w=min(iw\,4W):h=min(ih\,4H):format=nv12,hwdownload,format=nv12,scale=W:H:flags=area:out_range=full:…
+//	scale_cuda=w=min(iw\,4W):h=min(ih\,4H):interp_algo=bilinear:format=p010,hwdownload,format=p010le,scale=W:H:flags=area,<software tone map>,scale=out_range=full:…
 //
 // Every chain ends by giving each frame a "sample" entry of -1 unless its
 // packet already carries one, so metadata=print logs every frame and the
 // log lines up with the raw frames on stdout (see sheets_join.go).
-func buildSheetsGraph(out SheetsOutput, accel, softwareToneMap string) (string, error) {
-	toneMap := out.ToneMap != nil
-	scale := fmt.Sprintf("scale=%d:%d:flags=area", out.TileWidth, out.TileHeight)
-	convert := "format=" + sheetPixelFormat
+func buildSheetsGraph(out SheetsOutput, accel string, toneMap sheetsToneMap) (string, error) {
+	hdr := out.ToneMap != nil
+	gpuToneMaps := false
 	var filters []string
-	switch {
-	case accel != "" && !framesInSystemMemory(accel):
-		if toneMap {
+	if accel != "" && !framesInSystemMemory(accel) {
+		format, download := "nv12", hwDownloadFilter
+		switch {
+		case !hdr:
+		case toneMap.kind != "":
+			format, download = "p010", "hwdownload,format=p010le"
+		case accel == hwAccelNVENC:
+			return "", errors.New("CUDA sheets need the source's base signal to tone map")
+		default:
 			filters = append(filters, vaapiToneMap)
+			gpuToneMaps = true
 		}
-		filters = append(filters,
-			fmt.Sprintf("scale_vaapi=w=%d:h=%d:format=nv12", out.TileWidth, out.TileHeight),
-			hwDownloadFilter,
-			"scale="+sheetFullRange, convert)
-	case toneMap:
-		if softwareToneMap == "" {
+		filters = append(filters, gpuScaleFilter(out, accel, format), download)
+	}
+	software := ""
+	if hdr && !gpuToneMaps {
+		if toneMap.software == "" {
 			return "", errors.New("HDR sheets require a software tone-map filter")
 		}
-		filters = append(filters, scale, softwareToneMap, "scale="+sheetFullRange, convert)
-	default:
+		software = toneMap.software
+	}
+	scale := fmt.Sprintf("scale=%d:%d:flags=area", out.TileWidth, out.TileHeight)
+	convert := "format=" + sheetPixelFormat
+	if software != "" {
+		filters = append(filters, scale, software, "scale="+sheetFullRange, convert)
+	} else {
 		filters = append(filters, scale+":"+sheetFullRange, convert)
 	}
 	filters = append(filters,
@@ -145,18 +202,52 @@ func buildSheetsGraph(out SheetsOutput, accel, softwareToneMap string) (string,
 	return strings.Join(filters, ","), nil
 }
 
-// prepareSheets settles the video chain of a sheet attempt before ffmpeg
-// starts, choosing the software tone-map chain if the attempt needs one.
-func (r Runner) prepareSheets(ctx context.Context, req Request, attempt Attempt, toneMap *toneMapResolver) (string, *AttemptError) {
-	softwareToneMap, failure := r.softwareToneMapFilter(ctx, req, attempt, toneMap)
-	if failure != nil {
-		return "", failure
+// gpuScaleFilter scales GPU surfaces of accel to gpuScaleFactor times the
+// tile, or the frame's own size if that is smaller, into format, ready for
+// hwdownload. The commas inside min() are escaped from the graph parser.
+func gpuScaleFilter(out SheetsOutput, accel, format string) string {
+	w := fmt.Sprintf("min(iw\\,%d)", gpuScaleFactor*out.TileWidth)
+	h := fmt.Sprintf("min(ih\\,%d)", gpuScaleFactor*out.TileHeight)
+	if accel == hwAccelNVENC {
+		return "scale_cuda=w=" + w + ":h=" + h + ":interp_algo=bilinear:format=" + format
 	}
+	return "scale_vaapi=w=" + w + ":h=" + h + ":format=" + format
+}
+
+// prepareSheets settles the video chain of a sheet attempt before ffmpeg
+// starts. A request naming its source's base signal takes that signal's
+// software chain on every attempt (see buildSheetsGraph), which needs
+// software tone mapping allowed and a filter the binary lists for the
+// signal; without them the attempt fails as unsupported, so a Dolby Vision
+// base makes no sheets rather than green and magenta ones. Otherwise an
+// attempt takes the best-effort chain, which CUDA lacks.
+func (r Runner) prepareSheets(ctx context.Context, req Request, attempt Attempt, resolver *toneMapResolver) (string, *AttemptError) {
 	accel := ""
 	if attempt.Hardware {
 		accel = r.HWAccel
 	}
-	graph, err := buildSheetsGraph(*req.Sheets, accel, softwareToneMap)
+	toneMap := sheetsToneMap{}
+	switch out := req.Sheets.ToneMap; {
+	case out == nil:
+	case out.Source != "":
+		if !out.AllowSoftware {
+			return "", &AttemptError{Reason: ReasonUnsupported, Err: errors.New("software HDR tone mapping is disabled")}
+		}
+		software, failure := resolver.source(ctx, r, out.Source)
+		if failure != nil {
+			return "", failure
+		}
+		toneMap = sheetsToneMap{kind: out.Source, software: software}
+	case accel == hwAccelNVENC:
+		return "", &AttemptError{Reason: ReasonUnsupported, Err: errors.New("CUDA sheets need the source's base signal to tone map")}
+	default:
+		software, failure := r.softwareToneMapFilter(ctx, req, attempt, resolver)
+		if failure != nil {
+			return "", failure
+		}
+		toneMap.software = software
+	}
+	graph, err := buildSheetsGraph(*req.Sheets, accel, toneMap)
 	if err != nil {
 		return "", &AttemptError{Reason: ReasonArgs, Err: err}
 	}
diff --git a/internal/mediasample/sheets_join.go b/internal/mediasample/sheets_join.go
index 7522dcc36a..da739e7d81 100644
--- a/internal/mediasample/sheets_join.go
+++ b/internal/mediasample/sheets_join.go
@@ -30,15 +30,24 @@ import (
 // waited for a log line would stall ffmpeg's exit, and a stand-in Exec that
 // writes all of stdout before its log would deadlock.
 //
+// A filter graph reinit, as a hardware decoder that renews its surfaces
+// causes mid-run, restarts the counter at zero. The old graph has passed on
+// every frame it logged, so the frames still line up and the count goes on.
+//
 // Where a frame goes:
 //
 //   - Sampled lists: the cell of the sample its tag names. A sample that
 //     decodes more than one frame (a keyframe within its short span, or an
 //     all-intra source) keeps the first, which is the frame at or before the
-//     sample time. Untagged frames are dropped.
+//     sample time. Untagged frames are dropped. Each frame's time also
+//     places it back in the input (sourceSeconds), which a repair reads. A
+//     sample a keyframe list left out shows the cell before (shareFrames).
 //   - Windows (containers the list cannot seek in, and ReadThrough): each
 //     sample takes the last frame at or before its time, as
 //     pickSampleFrames does for statistics.
+//   - Repairs (see sheet_repair.go): a list over some samples whose frames
+//     are collected as candidates, each sample keeping the frame nearest its
+//     time, and replace what the first run placed.
 //
 // A cell without a frame of its own shows the previous cell's frame, and
 // cells before the first frame show the first; the grid never shifts. A run
@@ -47,15 +56,25 @@ import (
 // than a sheet worth keeping, and a hardware attempt then falls back to
 // software.
 //
-// Sheets are encoded as soon as no later frame can land in them: frames
-// arrive in sample order, so once a frame lands two sheets further on, the
-// earlier sheet is done. At most three canvases are held at a time.
+// Sheets are encoded once the run and its repairs are done, since a repair
+// may replace any cell; a run's sheets are bounded by its caller's chunking.
 
 // maxQueuedFrameBytes bounds the raw frames held while their log lines are
 // behind. The log normally leads, so this only trips when the log parser
 // has stopped keeping up at all.
 const maxQueuedFrameBytes = 64 << 20
 
+// keyframeMatchSeconds absorbs the rounding between a keyframe packet's
+// time and its decoded frame's, which keyframes seconds apart never reach.
+const keyframeMatchSeconds = 0.01
+
+// maxDroppedKeyframeShare replaces maxFilledShare for a window whose
+// decoder dropped keyframes over skipped pictures (see droppedKeyframe):
+// such a file is whole, and a sample showing the keyframe a few seconds
+// before its own is a usable preview. A list keeps maxFilledShare, so too
+// many drops still send it to the window.
+const maxDroppedKeyframeShare = 0.15
+
 // sheetFramePattern matches the frame line of the sheets metadata filter:
 // "frame:12   pts:1550   pts_time:1.55". pts_time is "NOPTS" for a frame
 // without a time.
@@ -83,11 +102,31 @@ type sheetAssembler struct {
 	sampled bool
 	cells   map[int64]int
 	offset  float64
+	// A sampled list's entries each last span seconds, and plan says where
+	// each starts and which entry each sample's frame comes from. header
+	// reads the list input's start time, by which ffmpeg shifted every
+	// frame's time; with these, sourceSeconds finds a frame's time in the
+	// input. sources holds that time for each cell's frame, NaN when it is
+	// unknown.
+	span    float64
+	plan    listPlan
+	header  inputHeaderParser
+	sources []float64
+	// onDisorder, when set, is called once a frame comes from an earlier
+	// list entry than the frame before it, lastEntry's (see keyframeSheets).
+	onDisorder func()
+	lastEntry  int
+	// candidates, when set, collects each sample's nearest frame for a
+	// repair instead of tiling.
+	candidates []sheetCandidate
 
 	logContext string
 	current    *sheetFrameMeta
-	logged     int64
-	metas      []sheetFrameMeta
+	// counter is the frame number the filter logs next; logged counts
+	// every frame logged, across graph reinits.
+	counter int64
+	logged  int64
+	metas   []sheetFrameMeta
 
 	partial     []byte
 	queued      [][]byte
@@ -102,22 +141,37 @@ type sheetAssembler struct {
 	packetTimeBase float64
 	packetEnd      float64
 	hasPacketTime  bool
+	// dtsTiming lets a packet without a PTS count by its DTS; see
+	// packetLine.
+	dtsTiming bool
+	// A window whose decoder dropped keyframes (see droppedKeyframe) gives
+	// the samples after each dropped keyframe an earlier one. The times of
+	// the frames decoded and of the keyframe packets read find those
+	// samples, which then count as filled. A keyframe packet without a time
+	// leaves them unknown (untimedKey).
+	droppedKeyframes bool
+	untimedKey       bool
+	frameTimes       []float64
+	keyTimes         []float64
 
 	open      map[int]*sheetCanvas
-	furthest  int
 	finalized int
 	carry     []byte
 	sheets    []Sheet
 	decoded   int
 	filled    int
+	// refined counts the cells a repair replaced, each once.
+	refined      int
+	refinedCells map[int]bool
 
 	err error
 }
 
 // newSheetAssembler returns an assembler for the frames of times. A sampled
-// run places frames by their sample tag; a window run by their time plus
-// offset.
-func newSheetAssembler(out SheetsOutput, times []float64, sampled bool, offset float64) *sheetAssembler {
+// run places frames by their sample tag, its list entries lasting span
+// seconds and starting at each sample's time unless the caller sets another
+// plan; a window run places them by their time plus offset.
+func newSheetAssembler(out SheetsOutput, times []float64, sampled bool, offset, span float64) *sheetAssembler {
 	a := &sheetAssembler{
 		out:        out,
 		times:      times,
@@ -125,14 +179,18 @@ func newSheetAssembler(out SheetsOutput, times []float64, sampled bool, offset f
 		perSheet:   out.Columns * out.Rows,
 		sampled:    sampled,
 		offset:     offset,
+		span:       span,
 		logContext: "[" + filterMetadata + "@" + sheetMetadataID + " @ ",
 		open:       map[int]*sheetCanvas{},
-		furthest:   -1,
 	}
 	if sampled {
 		a.cells = make(map[int64]int, len(times))
+		a.refinedCells = map[int]bool{}
+		a.sources = make([]float64, len(times))
+		a.plan = samplePlan(times, 0)
 		for i, at := range times {
 			a.cells[sampleKey(at)] = i
+			a.sources[i] = math.NaN()
 		}
 	}
 	return a
@@ -173,10 +231,22 @@ func (a *sheetAssembler) Write(p []byte) (int, error) {
 	return n, nil
 }
 
-// line takes one log line, keeping those of the sheets metadata filter.
+// line takes one log line, keeping the input header and the lines of the
+// sheets metadata filter.
 func (a *sheetAssembler) line(line string) {
+	if droppedKeyframe(line) {
+		a.mu.Lock()
+		a.droppedKeyframes = true
+		a.mu.Unlock()
+		return
+	}
 	message, ok := filterMessage(line, a.logContext)
 	if !ok {
+		if a.sampled {
+			a.mu.Lock()
+			a.header.line(line)
+			a.mu.Unlock()
+		}
 		return
 	}
 	a.mu.Lock()
@@ -186,13 +256,14 @@ func (a *sheetAssembler) line(line string) {
 	}
 	if match := sheetFramePattern.FindStringSubmatch(message); match != nil {
 		index, err := strconv.ParseInt(match[1], 10, 64)
-		if err != nil || index != a.logged {
-			// A counter that skips or restarts, as after a filter graph
-			// reinit, no longer counts the frames on stdout.
+		// A counter that skips, or restarts anywhere but at zero, no longer
+		// counts the frames on stdout.
+		if err != nil || (index != a.counter && index != 0) {
 			a.err = fmt.Errorf("ffmpeg logged frame %s after %d frames", match[1], a.logged)
 			return
 		}
-		meta := sheetFrameMeta{index: index}
+		a.counter = index + 1
+		meta := sheetFrameMeta{index: a.logged}
 		if seconds, err := strconv.ParseFloat(match[2], 64); err == nil && finite(seconds) {
 			meta.seconds, meta.hasTime = seconds, true
 		}
@@ -239,6 +310,15 @@ func (a *sheetAssembler) readPacketTiming(path string) error {
 // packetLine reads the framecrc stream-copy output: "#tb 0: 1/1000",
 // followed by "0, DTS, PTS, duration, size, checksum[, flags]". PTS and
 // duration count in that time base and are relative to the window start.
+// With dtsTiming, a packet without a PTS falls back to its DTS:
+// packed-bitstream XviD in AVI carries no PTS on any packet, and a DTS never
+// runs ahead of the PTS it stands in for, so the fallback cannot stretch a
+// reordered stream's extent. Without a PTS the decoder stamps each frame
+// with the DTS of the packet that released it, so the fallback is set only
+// for a decoder in low-delay mode, which releases each keyframe as it
+// arrives. A reordering decoder, such as H.264 with B-frames, releases a
+// keyframes-only read's keyframes a GOP or more late; its DTS-only windows
+// keep failing rather than publish every cell at an earlier keyframe.
 func (a *sheetAssembler) packetLine(line string) {
 	if raw, ok := strings.CutPrefix(line, "#tb 0: "); ok {
 		numerator, denominator, ok := strings.Cut(raw, "/")
@@ -259,16 +339,70 @@ func (a *sheetAssembler) packetLine(line string) {
 		a.err = errors.New("ffmpeg reported packet timing without a time base")
 		return
 	}
-	pts, errPTS := strconv.ParseInt(strings.TrimSpace(fields[2]), 10, 64)
+	pts, hasPTS := packetTimestamp(fields[2])
+	if !hasPTS && a.dtsTiming {
+		pts, hasPTS = packetTimestamp(fields[1])
+	}
 	duration, errDuration := strconv.ParseInt(strings.TrimSpace(fields[3]), 10, 64)
-	// framecrc prints AV_NOPTS_VALUE as the minimum int64, rather than NOPTS.
-	if errPTS == nil && pts != math.MinInt64 && errDuration == nil && duration >= 0 {
+	if hasPTS && errDuration == nil && duration >= 0 {
 		end := a.offset + (float64(pts)+float64(duration))*a.packetTimeBase
 		if finite(end) {
 			a.packetEnd = max(a.packetEnd, end)
 			a.hasPacketTime = true
 		}
 	}
+	if packetIsKey(fields[5]) {
+		if at := a.offset + float64(pts)*a.packetTimeBase; hasPTS && finite(at) {
+			a.keyTimes = append(a.keyTimes, at)
+		} else {
+			a.untimedKey = true
+		}
+	}
+}
+
+// packetIsKey reads the flags framecrc appends after the checksum. It
+// prints them only when they differ from a plain keyframe's.
+func packetIsKey(rest string) bool {
+	_, raw, ok := strings.Cut(rest, "F=0x")
+	if !ok {
+		return true
+	}
+	// Side data, when the packet has any, follows the flags.
+	raw, _, _ = strings.Cut(raw, ",")
+	flags, err := strconv.ParseUint(strings.TrimSpace(raw), 16, 64)
+	return err == nil && flags&1 != 0
+}
+
+// staleSamples counts the samples that hold a frame but not their own
+// keyframe, the last keyframe packet at or before the sample. A sample
+// without any frame is counted when its sheet is finalized.
+func (a *sheetAssembler) staleSamples() int {
+	keys := slices.Clone(a.keyTimes)
+	slices.Sort(keys)
+	frames := slices.Clone(a.frameTimes)
+	slices.Sort(frames)
+	stale, next := 0, 0
+	for cell, at := range a.times {
+		for next < len(keys) && keys[next] <= at+sampleMatchSeconds {
+			next++
+		}
+		if next == 0 || !a.placed(cell) {
+			continue
+		}
+		key := keys[next-1]
+		i, _ := slices.BinarySearch(frames, key-keyframeMatchSeconds)
+		if i == len(frames) || frames[i] > key+keyframeMatchSeconds {
+			stale++
+		}
+	}
+	return stale
+}
+
+// packetTimestamp parses a framecrc DTS or PTS field. framecrc prints
+// AV_NOPTS_VALUE as the minimum int64, rather than NOPTS.
+func packetTimestamp(field string) (int64, bool) {
+	ts, err := strconv.ParseInt(strings.TrimSpace(field), 10, 64)
+	return ts, err == nil && ts != math.MinInt64
 }
 
 // drain places every frame whose log lines are in.
@@ -285,8 +419,26 @@ func (a *sheetAssembler) drain() {
 func (a *sheetAssembler) place(meta sheetFrameMeta, frame []byte) {
 	if a.sampled {
 		cell, ok := a.cells[sampleKey(meta.sample)]
-		if meta.sample >= 0 && ok && a.setCell(cell, frame) {
+		if meta.sample < 0 || !ok {
+			a.recycle(frame)
+			return
+		}
+		if a.onDisorder != nil {
+			if entry := a.plan.entry[cell]; entry < a.lastEntry {
+				a.onDisorder()
+				a.onDisorder = nil
+			} else {
+				a.lastEntry = entry
+			}
+		}
+		source := a.sourceSeconds(meta, cell)
+		if a.candidates != nil {
+			a.offer(cell, source, frame)
+			return
+		}
+		if a.setCell(cell, frame) {
 			a.decoded++
+			a.sources[cell] = source
 		}
 		a.recycle(frame)
 		return
@@ -296,6 +448,7 @@ func (a *sheetAssembler) place(meta sheetFrameMeta, frame []byte) {
 		return
 	}
 	at := a.offset + meta.seconds
+	a.frameTimes = append(a.frameTimes, at)
 	a.assignWindow(at - sampleMatchSeconds)
 	a.recycle(a.prev)
 	a.prev = frame
@@ -311,24 +464,49 @@ func (a *sheetAssembler) assignWindow(limit float64) {
 	}
 }
 
+// sourceSeconds is the input time, counted from the start of the file as
+// sample times are, of a sampled list's frame for cell, NaN when the frame
+// has no time. The entry cell's frame comes from starts span seconds into
+// the list for each entry before it, and at its inpoint in the container
+// (see buildConcatListSpan), and ffmpeg shifted every frame by the list
+// input's start time.
+func (a *sheetAssembler) sourceSeconds(meta sheetFrameMeta, cell int) float64 {
+	entry := a.plan.entry[cell]
+	if !meta.hasTime || entry < 0 {
+		return math.NaN()
+	}
+	return meta.seconds + a.header.info.StartSeconds - float64(entry)*a.span + a.plan.entries[entry].inpoint - a.plan.inputStart
+}
+
+// shareFrames gives each sample the list left out (see keyframePlan) the
+// frame and source time of the cell before it, which decoding the keyframe
+// they share again would have given it. A sample after a cell without a
+// frame stays without one, for the repair to find.
+func (a *sheetAssembler) shareFrames() {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	for cell, entry := range a.plan.entry {
+		if entry >= 0 || cell == 0 || !a.placed(cell-1) {
+			continue
+		}
+		frame := a.canvas((cell - 1) / a.perSheet).read((cell - 1) % a.perSheet)
+		if a.setCell(cell, frame) {
+			a.decoded++
+			a.sources[cell] = a.sources[cell-1]
+		}
+	}
+}
+
 // setCell copies frame into cell unless the cell already holds one, and
-// reports whether it did. Frames for a sheet already encoded are dropped.
+// reports whether it did.
 func (a *sheetAssembler) setCell(cell int, frame []byte) bool {
-	sheet := cell / a.perSheet
-	if sheet < a.finalized {
-		return false
-	}
-	canvas := a.canvas(sheet)
+	canvas := a.canvas(cell / a.perSheet)
 	slot := cell % a.perSheet
 	if canvas.set[slot] {
 		return false
 	}
 	canvas.write(slot, frame)
 	canvas.set[slot] = true
-	if sheet > a.furthest {
-		a.furthest = sheet
-		a.finalizeThrough(sheet - 1)
-	}
 	return true
 }
 
@@ -387,13 +565,13 @@ func (a *sheetAssembler) finalize(sheet int) {
 	a.sheets = append(a.sheets, Sheet{Index: sheet, Thumbnails: count, JPEG: encoded.Bytes()})
 }
 
-// finish checks the run's frames against its log, assigns what the window
-// placement still holds, and encodes the remaining sheets.
-func (a *sheetAssembler) finish() ([]Sheet, SheetFrames, *AttemptError) {
+// close checks the run's frames against its log once ffmpeg has exited and
+// assigns what the window placement still holds.
+func (a *sheetAssembler) close() *AttemptError {
 	a.mu.Lock()
 	defer a.mu.Unlock()
-	fail := func(reason Reason, err error) ([]Sheet, SheetFrames, *AttemptError) {
-		return nil, SheetFrames{}, &AttemptError{Reason: reason, Err: err}
+	fail := func(reason Reason, err error) *AttemptError {
+		return &AttemptError{Reason: reason, Err: err}
 	}
 	switch {
 	case a.err != nil:
@@ -408,19 +586,39 @@ func (a *sheetAssembler) finish() ([]Sheet, SheetFrames, *AttemptError) {
 			return fail(ReasonOutput, errors.New("ffmpeg reported no usable packet timing for the sampled window"))
 		}
 		a.assignWindow(a.packetEnd + sampleMatchSeconds)
+		if a.droppedKeyframes {
+			a.filled += a.staleSamples()
+		}
+	}
+	return nil
+}
+
+// finish encodes the sheets of a closed run and its repairs.
+func (a *sheetAssembler) finish() ([]Sheet, SheetFrames, *AttemptError) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	fail := func(reason Reason, err error) ([]Sheet, SheetFrames, *AttemptError) {
+		return nil, SheetFrames{}, &AttemptError{Reason: reason, Err: err}
 	}
 	if a.decoded == 0 {
 		return fail(ReasonEmpty, errors.New("ffmpeg decoded no frame for any sample"))
 	}
+	if a.droppedKeyframes && a.untimedKey && !a.sampled {
+		return fail(ReasonEmpty, errors.New("ffmpeg dropped keyframes in a window with an untimed keyframe packet"))
+	}
 	sheets := (len(a.times) + a.perSheet - 1) / a.perSheet
 	a.finalizeThrough(sheets)
 	if a.err != nil {
 		return fail(ReasonOutput, a.err)
 	}
-	if limit := max(1, int(maxFilledShare*float64(len(a.times)))); a.filled > limit {
+	share := maxFilledShare
+	if a.droppedKeyframes && !a.sampled {
+		share = maxDroppedKeyframeShare
+	}
+	if limit := max(1, int(share*float64(len(a.times)))); a.filled > limit {
 		return fail(ReasonEmpty, fmt.Errorf("ffmpeg decoded frames for only %d of %d samples", len(a.times)-a.filled, len(a.times)))
 	}
-	return a.sheets, SheetFrames{Decoded: len(a.times) - a.filled, Filled: a.filled}, nil
+	return a.sheets, SheetFrames{Decoded: len(a.times) - a.filled, Filled: a.filled, Refined: a.refined}, nil
 }
 
 func (a *sheetAssembler) frameBuffer() []byte {
diff --git a/internal/mediasample/sheets_test.go b/internal/mediasample/sheets_test.go
index 98f9e9a633..7a2a71ce5d 100644
--- a/internal/mediasample/sheets_test.go
+++ b/internal/mediasample/sheets_test.go
@@ -16,6 +16,8 @@ import (
 	"slices"
 	"strings"
 	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/tonemap"
 )
 
 // The tile size the unit tests use: small, even, and not square.
@@ -71,6 +73,51 @@ func TestSheetsRequestValidation(t *testing.T) {
 	}
 }
 
+// TestSheetsRequestBoundsARunsPixels refuses a run whose tiles would not fit
+// maxSheetsRunPixels, since a run holds every tile until it finishes.
+func TestSheetsRequestBoundsARunsPixels(t *testing.T) {
+	huge := Request{Input: "/media/a.mkv", Samples: &Samples{Seconds: secondsFrom(5, 10, 10000)},
+		Sheets: &SheetsOutput{TileWidth: 1920, TileHeight: 1920, Columns: 1, Rows: 1, Quality: 80}}
+	if err := huge.Validate(); err == nil || !strings.Contains(err.Error(), "pixels in one run") {
+		t.Fatalf("error %v, want the run's pixels refused", err)
+	}
+	// Trickplay's largest chunk: 11 sheets of 10x8 tiles of 300x126.
+	chunk := Request{Input: "/media/a.mkv", Samples: &Samples{Seconds: secondsFrom(5, 10, 880)},
+		Sheets: &SheetsOutput{TileWidth: 300, TileHeight: 126, Columns: 10, Rows: 8, Quality: 80}}
+	if err := chunk.Validate(); err != nil {
+		t.Fatalf("trickplay chunk refused: %v", err)
+	}
+	// A height the probe will replace does not count against the run: a
+	// rotated file's catalog height can exceed the height it decodes at.
+	rotated := chunk
+	rotated.Sheets = &SheetsOutput{TileWidth: 300, TileHeight: 1920, Columns: 10, Rows: 8, Quality: 80, UseInputAspect: true}
+	if err := rotated.Validate(); err != nil {
+		t.Fatalf("run with a probed height refused before probing: %v", err)
+	}
+	rotated.Sheets.UseInputAspect = false
+	if err := rotated.Validate(); err == nil {
+		t.Fatal("run of tall tiles with a fixed height: want it refused")
+	}
+}
+
+// TestRunSheetsBoundsTheProbedRun refuses a run whose probed tile height
+// makes it too large, before ffmpeg decodes anything.
+func TestRunSheetsBoundsTheProbedRun(t *testing.T) {
+	req := Request{Input: "/media/a.mkv", Samples: &Samples{Seconds: secondsFrom(5, 10, 880)},
+		Sheets: &SheetsOutput{TileWidth: 300, TileHeight: 16, Columns: 10, Rows: 8, Quality: 80, UseInputAspect: true}}
+	var calls [][]string
+	runner := Runner{Exec: func(_ context.Context, _ string, args []string, _ io.Reader, _, stderr io.Writer) error {
+		calls = append(calls, args)
+		// A portrait picture: 300-pixel tiles 534 pixels high.
+		_, _ = io.WriteString(stderr, "Input #0, matroska,webm, from '/media/a.mkv':\n  Duration: 02:00:00.00, start: 0.000000, bitrate: 900 kb/s\n  Stream #0:0: Video: hevc (Main), yuv420p(tv), 1080x1920, SAR 1:1 DAR 9:16\n")
+		return nil
+	}}
+	_, err := runner.Run(t.Context(), req)
+	if failure, ok := errors.AsType[*Error](err); !ok || failure.Reason != ReasonArgs || len(calls) != 1 {
+		t.Fatalf("error %v after %d runs, want the probed run refused as args after the probe", err, len(calls))
+	}
+}
+
 func TestSheetsRequestRoundTripsThroughJSON(t *testing.T) {
 	req := sheetsRequest([]float64{5, 15}, 10, 10)
 	req.Samples.ReadThrough = true
@@ -95,24 +142,35 @@ func TestBuildSheetsGraph(t *testing.T) {
 	hdr := out
 	hdr.ToneMap = &ToneMap{AllowSoftware: true}
 	tail := ",metadata=mode=add:key=sample:value=-1,metadata@sheets=print"
+	vaapiScale := `scale_vaapi=w=min(iw\,1280):h=min(ih\,536):format=nv12,hwdownload,format=nv12,`
+	vaapi10 := `scale_vaapi=w=min(iw\,1280):h=min(ih\,536):format=p010,hwdownload,format=p010le,`
+	cudaScale := `scale_cuda=w=min(iw\,1280):h=min(ih\,536):interp_algo=bilinear:format=nv12,hwdownload,format=nv12,`
+	cuda10 := `scale_cuda=w=min(iw\,1280):h=min(ih\,536):interp_algo=bilinear:format=p010,hwdownload,format=p010le,`
+	areaFull := "scale=320:134:flags=area:out_range=full:out_color_matrix=bt601,format=yuv420p"
+	dv := tonemap.SoftwareFilter(tonemap.SourceDolbyVision, tonemap.SoftwareFilterBT2390)
+	hlg := tonemap.SoftwareFilter(tonemap.SourceHLG, tonemap.SoftwareFilterBT2390)
+	toneMapped := func(chain string) string {
+		return "scale=320:134:flags=area," + chain + ",scale=out_range=full:out_color_matrix=bt601,format=yuv420p"
+	}
 	tests := []struct {
-		name, accel, softwareToneMap string
-		out                          SheetsOutput
-		want                         string
+		name, accel string
+		toneMap     sheetsToneMap
+		out         SheetsOutput
+		want        string
 	}{
-		{"software", "", "", out,
-			"scale=320:134:flags=area:out_range=full:out_color_matrix=bt601,format=yuv420p" + tail},
-		{"software HDR", "", softwareToneMapBT2390, hdr,
-			"scale=320:134:flags=area," + softwareToneMapBT2390 + ",scale=out_range=full:out_color_matrix=bt601,format=yuv420p" + tail},
-		{"vaapi", "vaapi", "", out,
-			"scale_vaapi=w=320:h=134:format=nv12,hwdownload,format=nv12,scale=out_range=full:out_color_matrix=bt601,format=yuv420p" + tail},
-		{"qsv HDR", "qsv", "", hdr,
-			vaapiToneMap + ",scale_vaapi=w=320:h=134:format=nv12,hwdownload,format=nv12,scale=out_range=full:out_color_matrix=bt601,format=yuv420p" + tail},
-		{"videotoolbox HDR", "videotoolbox", softwareToneMapHable, hdr,
-			"scale=320:134:flags=area," + softwareToneMapHable + ",scale=out_range=full:out_color_matrix=bt601,format=yuv420p" + tail},
+		{"software", "", sheetsToneMap{}, out, areaFull + tail},
+		{"software HDR", "", sheetsToneMap{software: softwareToneMapBT2390}, hdr, toneMapped(softwareToneMapBT2390) + tail},
+		{"software Dolby Vision", "", sheetsToneMap{kind: tonemap.SourceDolbyVision, software: dv}, hdr, toneMapped(dv) + tail},
+		{"vaapi", "vaapi", sheetsToneMap{}, out, vaapiScale + areaFull + tail},
+		{"qsv HDR best effort", "qsv", sheetsToneMap{}, hdr, vaapiToneMap + "," + vaapiScale + areaFull + tail},
+		{"vaapi HLG", "vaapi", sheetsToneMap{kind: tonemap.SourceHLG, software: hlg}, hdr, vaapi10 + toneMapped(hlg) + tail},
+		{"qsv Dolby Vision", "qsv", sheetsToneMap{kind: tonemap.SourceDolbyVision, software: dv}, hdr, vaapi10 + toneMapped(dv) + tail},
+		{"cuda", "nvenc", sheetsToneMap{}, out, cudaScale + areaFull + tail},
+		{"cuda Dolby Vision", "nvenc", sheetsToneMap{kind: tonemap.SourceDolbyVision, software: dv}, hdr, cuda10 + toneMapped(dv) + tail},
+		{"videotoolbox HDR", "videotoolbox", sheetsToneMap{software: softwareToneMapHable}, hdr, toneMapped(softwareToneMapHable) + tail},
 	}
 	for _, tt := range tests {
-		got, err := buildSheetsGraph(tt.out, tt.accel, tt.softwareToneMap)
+		got, err := buildSheetsGraph(tt.out, tt.accel, tt.toneMap)
 		if err != nil {
 			t.Fatalf("%s: %v", tt.name, err)
 		}
@@ -120,9 +178,15 @@ func TestBuildSheetsGraph(t *testing.T) {
 			t.Errorf("%s:\n got %s\nwant %s", tt.name, got, tt.want)
 		}
 	}
-	if _, err := buildSheetsGraph(hdr, "", ""); err == nil {
+	if _, err := buildSheetsGraph(hdr, "", sheetsToneMap{}); err == nil {
 		t.Error("software HDR without a tone-map chain: want an error")
 	}
+	if _, err := buildSheetsGraph(hdr, "nvenc", sheetsToneMap{}); err == nil {
+		t.Error("CUDA HDR without a source signal: want an error")
+	}
+	if _, err := buildSheetsGraph(hdr, "vaapi", sheetsToneMap{kind: tonemap.SourcePQ}); err == nil {
+		t.Error("GPU HDR with a source signal but no software chain: want an error")
+	}
 	if vaapiToneMapDownload != vaapiToneMap+",hwdownload,format=nv12" {
 		t.Errorf("image tone-map chain changed: %s", vaapiToneMapDownload)
 	}
@@ -133,7 +197,7 @@ func TestBuildSheetsArgs(t *testing.T) {
 	req.Threads = 2
 	output := []string{"-map", "0:V:0", "-an", "-sn", "-dn", "-vf", "GRAPH", "-fps_mode", "passthrough", "-pix_fmt", "yuv420p", "-f", "rawvideo", "pipe:1"}
 
-	args, list, err := buildSheetsArgs(req, Attempt{Hardware: true}, hardwareDecode{Accel: "vaapi", Device: "/dev/dri/renderD128"}, 11.4, "GRAPH", "")
+	args, list, err := buildSheetsArgs(req, Attempt{Hardware: true}, hardwareDecode{Accel: "vaapi", Device: "/dev/dri/renderD128"}, sampleEntries(req.Samples.Seconds, 11.4), "GRAPH", "", sampledSheetsList)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -154,7 +218,7 @@ func TestBuildSheetsArgs(t *testing.T) {
 	window := req
 	window.Samples = nil
 	window.Window = &Window{StartSeconds: 0, DurationSeconds: 15.04, KeyframesOnly: true}
-	args, list, err = buildSheetsArgs(window, Attempt{}, hardwareDecode{}, 0, "GRAPH", "packets.framecrc")
+	args, list, err = buildSheetsArgs(window, Attempt{}, hardwareDecode{}, nil, "GRAPH", "packets.framecrc", sampledSheetsList)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -199,14 +263,29 @@ type fakeSheets struct {
 	editLog     func([]string) []string
 	calls       [][]string
 	packetEnd   float64
+	// keyPackets are keyframe packet times the timing log reports before
+	// its last packet, whether or not frames decoded them. NaN is a
+	// keyframe packet without a time.
+	keyPackets []float64
+	// listStart is the start time a list run's input header reports, and
+	// lists the ffconcat lists the runs read.
+	listStart float64
+	lists     []string
 }
 
-func (f *fakeSheets) exec(_ context.Context, _ string, args []string, _ io.Reader, stdout, stderr io.Writer) error {
+func (f *fakeSheets) exec(_ context.Context, _ string, args []string, stdin io.Reader, stdout, stderr io.Writer) error {
 	f.calls = append(f.calls, args)
 	if slices.Contains(args, "copy") && !slices.Contains(args, "framecrc") {
 		_, _ = fmt.Fprintf(stderr, "Input #0, %s, from '/media/a.mkv':\n  Duration: 00:02:00.00, start: 0.000000, bitrate: 900 kb/s\n", f.format)
 		return nil
 	}
+	if slices.Contains(args, "concat") {
+		if stdin != nil {
+			list, _ := io.ReadAll(stdin)
+			f.lists = append(f.lists, string(list))
+		}
+		_, _ = fmt.Fprintf(stderr, "Input #0, concat, from 'pipe:0':\n  Duration: N/A, start: %f, bitrate: N/A\n", f.listStart)
+	}
 	var log []string
 	for i, frame := range f.frames {
 		log = append(log, fmt.Sprintf("[metadata@sheets @ 0x55d0] frame:%-4d pts:%-7s pts_time:%s", i, frame.pts, frame.pts))
@@ -220,7 +299,16 @@ func (f *fakeSheets) exec(_ context.Context, _ string, args []string, _ io.Reade
 		var timing string
 		if f.packetEnd > 0 {
 			end := int64(math.Round(f.packetEnd * 1000))
-			timing = fmt.Sprintf("#tb 0: 1/1000\n0, %d, %d, 1, 1, 0x00000000\n", end-1, end-1)
+			timing = "#tb 0: 1/1000\n"
+			for _, key := range f.keyPackets {
+				if math.IsNaN(key) {
+					timing += fmt.Sprintf("0, %d, %d, 1, 1, 0x00000000\n", int64(math.MinInt64), int64(math.MinInt64))
+					continue
+				}
+				at := int64(math.Round(key * 1000))
+				timing += fmt.Sprintf("0, %d, %d, 1, 1, 0x00000000\n0, %d, %d, 1, 1, 0x00000000, F=0x0\n", at, at, at+1, at+1)
+			}
+			timing += fmt.Sprintf("0, %d, %d, 1, 1, 0x00000000\n", end-1, end-1)
 		}
 		if err := os.WriteFile(args[i+1], []byte(timing), 0o600); err != nil {
 			return err
@@ -368,7 +456,8 @@ func TestRunSheetsFillsMissingSamples(t *testing.T) {
 }
 
 // TestRunSheetsRereadsSparseListAsWindow decodes one of four samples through
-// the list. When the HEVC decoder logged dropping keyframes as duplicates, as
+// the list, and none of the other three through the repair that lists them
+// again. When the HEVC decoder logged dropping keyframes as duplicates, as
 // it does for open-GOP keyframes after each jump, the attempt reads the
 // samples again as a keyframes-only window; otherwise, including for pictures
 // dropped as merely undecodable, the list's failure stands. A window whose
@@ -377,41 +466,61 @@ func TestRunSheetsRereadsSparseListAsWindow(t *testing.T) {
 	logDuplicates := func(log []string) []string {
 		return append(log, "[hevc @ 0x55d0] Duplicate POC in a sequence: 48.", "[hevc @ 0x55d0] Skipping invalid undecodable NALU: 21")
 	}
+	logIllegal := func(log []string) []string {
+		return append(log, "[h264 @ 0x55d0] illegal short term buffer state detected")
+	}
 	logUndecodable := func(log []string) []string {
 		return append(log, "[hevc @ 0x55d0] Skipping invalid undecodable NALU: 21")
 	}
 	keyframes := []fakeSheetFrame{timed(10, "4"), timed(20, "14"), timed(30, "24"), timed(40, "34")}
+	keys := []float64{4, 14, 24, 34}
 	tests := map[string]struct {
 		editLog       func([]string) []string
 		window        []fakeSheetFrame
 		windowEditLog func([]string) []string
-		runs          int
-		want          Reason
+		windowKeys    []float64
+		reference     []fakeSheetFrame
+		refEditLog    func([]string) []string
+		// runs after the probe, the list and its repair, in order.
+		runs   []string
+		filled int
+		want   Reason
 	}{
-		"duplicate keyframes":   {editLog: logDuplicates, window: keyframes, runs: 3},
-		"no drops logged":       {window: keyframes, runs: 2, want: ReasonEmpty},
-		"damaged pictures":      {editLog: logUndecodable, window: keyframes, runs: 2, want: ReasonEmpty},
-		"window empty too":      {editLog: logDuplicates, runs: 3, want: ReasonEmpty},
-		"window duplicates too": {editLog: logDuplicates, window: keyframes, windowEditLog: logDuplicates, runs: 3, want: ReasonEmpty},
+		"duplicate keyframes":   {editLog: logDuplicates, window: keyframes, runs: []string{"window"}},
+		"no drops logged":       {window: keyframes, want: ReasonEmpty},
+		"damaged pictures":      {editLog: logUndecodable, window: keyframes, want: ReasonEmpty},
+		"window empty too":      {editLog: logDuplicates, runs: []string{"window"}, want: ReasonEmpty},
+		"window drops a few":    {editLog: logDuplicates, window: keyframes[:3], windowEditLog: logDuplicates, windowKeys: keys, runs: []string{"window"}, filled: 1},
+		"window drops too many": {editLog: logDuplicates, window: keyframes[:1], windowEditLog: logDuplicates, windowKeys: keys, reference: keyframes, runs: []string{"window", "reference"}},
+		"h264 illegal state":    {editLog: logIllegal, window: keyframes[:1], windowEditLog: logIllegal, windowKeys: keys, reference: keyframes, runs: []string{"reference"}},
+		"untimed key dropped":   {editLog: logDuplicates, window: keyframes[:3], windowEditLog: logDuplicates, windowKeys: []float64{4, 14, 24, math.NaN()}, reference: keyframes, runs: []string{"window", "reference"}},
+		"reference fails too":   {editLog: logDuplicates, window: keyframes[:1], windowEditLog: logDuplicates, windowKeys: keys, reference: keyframes[:1], refEditLog: logDuplicates, runs: []string{"window", "reference"}, want: ReasonEmpty},
 	}
 	for name, tt := range tests {
 		list := &fakeSheets{format: "matroska,webm", frames: []fakeSheetFrame{tagged(10, 5)}, editLog: tt.editLog}
-		window := &fakeSheets{format: "matroska,webm", frames: tt.window, packetEnd: 36, editLog: tt.windowEditLog}
+		window := &fakeSheets{format: "matroska,webm", frames: tt.window, packetEnd: 36, editLog: tt.windowEditLog, keyPackets: tt.windowKeys}
+		reference := &fakeSheets{format: "matroska,webm", frames: tt.reference, packetEnd: 36, editLog: tt.refEditLog, keyPackets: tt.windowKeys}
 		var calls [][]string
+		var runs []string
 		runner := Runner{Exec: func(ctx context.Context, name string, args []string, stdin io.Reader, stdout, stderr io.Writer) error {
 			calls = append(calls, args)
-			if slices.Contains(args, "concat") {
+			switch {
+			case slices.Contains(args, "concat") || len(calls) == 1:
 				return list.exec(ctx, name, args, stdin, stdout, stderr)
+			case slices.Contains(args, exactSkipFrame):
+				runs = append(runs, "reference")
+				return reference.exec(ctx, name, args, stdin, stdout, stderr)
 			}
+			runs = append(runs, "window")
 			return window.exec(ctx, name, args, stdin, stdout, stderr)
 		}}
 		result, err := runner.Run(t.Context(), sheetsRequest(secondsFrom(5, 10, 4), 2, 2))
-		if len(calls) != tt.runs || !slices.Contains(calls[1], "concat") || (tt.runs == 3 && !slices.Contains(calls[2], "framecrc")) {
-			t.Fatalf("%s: runs %q, want a probe, a list run, and %d more", name, calls, tt.runs-2)
+		if !slices.Contains(calls[1], "concat") || !slices.Contains(calls[2], "concat") || !slices.Equal(runs, tt.runs) {
+			t.Fatalf("%s: runs after the list and its repair %q, want %q", name, runs, tt.runs)
 		}
 		if tt.want != "" {
 			failure, ok := errors.AsType[*Error](err)
-			if !ok || failure.Reason != tt.want || (tt.runs == 3 && !strings.Contains(err.Error(), "after the list run")) {
+			if !ok || failure.Reason != tt.want || (len(tt.runs) > 0 && !strings.Contains(err.Error(), "after the list run")) {
 				t.Fatalf("%s: error %v, want %s naming the list run", name, err, tt.want)
 			}
 			continue
@@ -419,8 +528,12 @@ func TestRunSheetsRereadsSparseListAsWindow(t *testing.T) {
 		if err != nil {
 			t.Fatalf("%s: %v", name, err)
 		}
-		if got := sheetLumas(t, result, 2, 2); !near(got[0], []int{10, 20, 30, 40}) || result.SheetFrames != (SheetFrames{Decoded: 4}) {
-			t.Fatalf("%s: cells %v, frames %+v; want every sample from the window", name, got, result.SheetFrames)
+		want := []int{10, 20, 30, 40}
+		if tt.filled > 0 {
+			want[3] = 30
+		}
+		if got := sheetLumas(t, result, 2, 2); !near(got[0], want) || result.SheetFrames != (SheetFrames{Decoded: 4 - tt.filled, Filled: tt.filled}) {
+			t.Fatalf("%s: cells %v, frames %+v; want cells %v with %d filled", name, got, result.SheetFrames, want, tt.filled)
 		}
 	}
 }
@@ -442,8 +555,9 @@ func TestRunSheetsReadsWindowsByTime(t *testing.T) {
 		if got := sheetLumas(t, result, 2, 2); !near(got[0], []int{10, 10, 60, 70}) {
 			t.Fatalf("%s: cells %v", name, got[0])
 		}
+		// Both probe first: sheets pick their keyframe options from the codec.
 		runs := len(fake.calls)
-		if (name == "read through") != (runs == 1) || slices.Contains(fake.calls[runs-1], "concat") {
+		if runs != 2 || slices.Contains(fake.calls[runs-1], "concat") {
 			t.Fatalf("%s: runs %q", name, fake.calls)
 		}
 	}
@@ -484,17 +598,23 @@ func TestSheetPacketTimingKeepsPresentationExtent(t *testing.T) {
 		end     float64
 		hasTime bool
 		wantErr bool
+		// dts is the assembler's dtsTiming.
+		dts bool
 	}{
-		{"reordered PTS", []string{"#tb 0: 1/90000", "0, 0, 180000, 45000, 1, 0x0", "0, 45000, 45000, 45000, 1, 0x0"}, 14.5, true, false},
-		{"missing numeric PTS", []string{"#tb 0: 1/1000", "0, 0, -9223372036854775808, 1000, 1, 0x0"}, 0, false, false},
-		{"missing text PTS", []string{"#tb 0: 1/1000", "0, 0, NOPTS, 1000, 1, 0x0"}, 0, false, false},
-		{"negative duration", []string{"#tb 0: 1/1000", "0, 0, 1000, -1, 1, 0x0"}, 0, false, false},
-		{"invalid time base", []string{"#tb 0: 1/0"}, 0, false, true},
-		{"packet before time base", []string{"0, 0, 1000, 1000, 1, 0x0"}, 0, false, true},
+		{"reordered PTS", []string{"#tb 0: 1/90000", "0, 0, 180000, 45000, 1, 0x0", "0, 45000, 45000, 45000, 1, 0x0"}, 14.5, true, false, false},
+		{"missing numeric PTS uses DTS", []string{"#tb 0: 1/1000", "0, 0, -9223372036854775808, 1000, 1, 0x0"}, 13, true, false, true},
+		{"missing text PTS uses DTS", []string{"#tb 0: 1/1000", "0, 0, NOPTS, 1000, 1, 0x0"}, 13, true, false, true},
+		{"packed XviD without PTS", []string{"#tb 0: 1/25", "0, 0, -9223372036854775808, 1, 23436, 0x0", "0, 1, -9223372036854775808, 1, 11203, 0x0", "0, 2, -9223372036854775808, 1, 6, 0x0"}, 12.12, true, false, true},
+		{"DTS does not stretch PTS extent", []string{"#tb 0: 1/90000", "0, 0, 180000, 45000, 1, 0x0", "0, 45000, NOPTS, 45000, 1, 0x0"}, 14.5, true, false, true},
+		{"missing PTS without low delay", []string{"#tb 0: 1/1000", "0, 0, -9223372036854775808, 1000, 1, 0x0", "0, 1000, NOPTS, 1000, 1, 0x0"}, 0, false, false, false},
+		{"missing PTS and DTS", []string{"#tb 0: 1/1000", "0, -9223372036854775808, -9223372036854775808, 1000, 1, 0x0"}, 0, false, false, true},
+		{"negative duration", []string{"#tb 0: 1/1000", "0, 0, 1000, -1, 1, 0x0"}, 0, false, false, false},
+		{"invalid time base", []string{"#tb 0: 1/0"}, 0, false, true, false},
+		{"packet before time base", []string{"0, 0, 1000, 1000, 1, 0x0"}, 0, false, true, false},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			a := &sheetAssembler{offset: 12}
+			a := &sheetAssembler{offset: 12, dtsTiming: tt.dts}
 			for _, line := range tt.lines {
 				a.packetLine(line)
 			}
@@ -515,6 +635,10 @@ func TestRunSheetsRemovesPacketTimingAfterAttempt(t *testing.T) {
 			fake := &fakeSheets{frames: []fakeSheetFrame{timed(10, "0")}, packetEnd: 8}
 			var path string
 			runner := Runner{Exec: func(ctx context.Context, binary string, args []string, stdin io.Reader, stdout, stderr io.Writer) error {
+				if !slices.Contains(args, "framecrc") {
+					// The probe that picks the codec's keyframe options.
+					return fake.exec(ctx, binary, args, stdin, stdout, stderr)
+				}
 				path = args[slices.Index(args, "framecrc")+1]
 				dir, err := os.Stat(filepath.Dir(path))
 				if err != nil || dir.Mode().Perm() != 0o700 {
@@ -571,8 +695,12 @@ func TestRunSheetsRejectsBrokenOutput(t *testing.T) {
 		"log without frame": {&fakeSheets{frames: frames(), editLog: func(log []string) []string {
 			return append(log, "[metadata@sheets @ 0x55d0] frame:4    pts:0       pts_time:0", "[metadata@sheets @ 0x55d0] sample=5")
 		}}, ReasonOutput},
-		"counter restarts": {&fakeSheets{frames: frames(), editLog: func(log []string) []string {
-			log[6] = strings.Replace(log[6], "frame:3", "frame:0", 1)
+		"counter skips": {&fakeSheets{frames: frames(), editLog: func(log []string) []string {
+			log[6] = strings.Replace(log[6], "frame:3", "frame:4", 1)
+			return log
+		}}, ReasonOutput},
+		"counter restarts past zero": {&fakeSheets{frames: frames(), editLog: func(log []string) []string {
+			log[6] = strings.Replace(log[6], "frame:3", "frame:1", 1)
 			return log
 		}}, ReasonOutput},
 		"no sample line": {&fakeSheets{frames: frames(), editLog: func(log []string) []string {
@@ -613,3 +741,44 @@ func TestRunSheetsHardwareFallsBack(t *testing.T) {
 		t.Fatalf("decoder %s, want the software attempt after a sparse hardware one", result.Decoder)
 	}
 }
+
+func TestSheetPacketIsKey(t *testing.T) {
+	for rest, want := range map[string]bool{
+		" 0x00000000":                      true,
+		" 0x00000000, F=0x0":               false,
+		" 0x00000000, F=0x3":               true,
+		" 0x00000000, F=0x2":               false,
+		" 0x00000000, F=0x5, S=1, 8, 0xab": true,
+		" 0x00000000, F=0xzz":              false,
+	} {
+		if got := packetIsKey(rest); got != want {
+			t.Errorf("packetIsKey(%q) = %t, want %t", rest, got, want)
+		}
+	}
+}
+
+// TestSheetWindowCountsAnEmptyStaleSampleOnce counts a sample that dropped
+// its keyframe and has no earlier frame once, when its sheet is finalized,
+// not again as stale: 2 of 20 samples stay within the 15% a window that
+// dropped keyframes may fill, where counting them twice would not.
+func TestSheetWindowCountsAnEmptyStaleSampleOnce(t *testing.T) {
+	logDuplicates := func(log []string) []string {
+		return append(log, "[hevc @ 0x55d0] Duplicate POC in a sequence: 48.")
+	}
+	req := sheetsRequest(secondsFrom(1, 2, 20), 5, 4)
+	req.Samples.ReadThrough = true
+	keys := []float64{0.5}
+	var frames []fakeSheetFrame
+	for at := 4; at <= 38; at += 2 {
+		keys = append(keys, float64(at))
+		frames = append(frames, timed(byte(at), fmt.Sprint(at)))
+	}
+	fake := &fakeSheets{format: "mpegts", frames: frames, packetEnd: 40, keyPackets: keys, editLog: logDuplicates}
+	result, err := Runner{Exec: fake.exec}.Run(t.Context(), req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result.SheetFrames != (SheetFrames{Decoded: 18, Filled: 2}) {
+		t.Fatalf("frames %+v, want the two samples before the first frame filled once each", result.SheetFrames)
+	}
+}
diff --git a/internal/mediasample/sheets_tonemap_test.go b/internal/mediasample/sheets_tonemap_test.go
new file mode 100644
index 0000000000..269c90f345
--- /dev/null
+++ b/internal/mediasample/sheets_tonemap_test.go
@@ -0,0 +1,228 @@
+package mediasample
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"slices"
+	"strings"
+	"sync/atomic"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/tonemap"
+)
+
+// jellyfinFilters and stockFilters are the tone-map filters a Jellyfin FFmpeg
+// and a stock FFmpeg list.
+var (
+	jellyfinFilters = []string{"zscale", "sidedata", "tonemapx", "tonemap"}
+	stockFilters    = []string{"zscale", "sidedata", "tonemap"}
+)
+
+func hdrSheetsRequest(source tonemap.SourceKind, attempts ...Attempt) Request {
+	req := sheetsRequest(secondsFrom(5, 10, 4), 2, 2)
+	req.Sheets.ToneMap = &ToneMap{AllowSoftware: true, Source: source}
+	req.Attempts = attempts
+	return req
+}
+
+func fourFrames() *fakeSheets {
+	return &fakeSheets{format: "matroska,webm", frames: []fakeSheetFrame{tagged(10, 5), tagged(20, 15), tagged(30, 25), tagged(40, 35)}}
+}
+
+// graphOf returns the -vf argument of a run.
+func graphOf(args []string) string {
+	if i := slices.Index(args, "-vf"); i >= 0 {
+		return args[i+1]
+	}
+	return ""
+}
+
+func TestRunSheetsToneMapsDolbyVisionWithTheRPU(t *testing.T) {
+	dv := tonemap.SoftwareFilter(tonemap.SourceDolbyVision, tonemap.SoftwareFilterBT2390)
+	for _, accel := range []string{"", "vaapi", "qsv", "nvenc", "videotoolbox"} {
+		var loads atomic.Int32
+		fake := fourFrames()
+		runner := Runner{FFmpegPath: "ffmpeg", HWAccel: accel, HWDevice: "/dev/dri/renderD128", Exec: fake.exec,
+			Capabilities: listingCapabilities(&loads, nil, jellyfinFilters...)}
+		attempts := []Attempt{{}}
+		if accel != "" {
+			attempts = []Attempt{{Hardware: true}, {}}
+		}
+		result, err := runner.Run(t.Context(), hdrSheetsRequest(tonemap.SourceDolbyVision, attempts...))
+		if err != nil {
+			t.Fatalf("%q: %v", accel, err)
+		}
+		graph := graphOf(fake.calls[1])
+		if !strings.Contains(graph, "scale=24:16:flags=area,"+dv+",") || !strings.Contains(graph, "apply_dovi=1") {
+			t.Errorf("%q: graph %s, want the scaled frames tone mapped with the RPU", accel, graph)
+		}
+		gpu := accel == "vaapi" || accel == "qsv" || accel == "nvenc"
+		if gpu != strings.Contains(graph, "hwdownload,format=p010le,") {
+			t.Errorf("%q: graph %s; GPU frames download as P010 and nothing else does", accel, graph)
+		}
+		if strings.Contains(graph, "tonemap_vaapi") || strings.Contains(graph, "tonemap_cuda") || strings.Contains(graph, "opencl") {
+			t.Errorf("%q: graph %s tone maps on the GPU", accel, graph)
+		}
+		want := "software"
+		if accel != "" {
+			want = "hardware:" + accel
+		}
+		if result.Decoder != want || loads.Load() != 1 {
+			t.Errorf("%q: decoder %s after %d capability loads", accel, result.Decoder, loads.Load())
+		}
+	}
+}
+
+func TestRunSheetsToneMapsHLGWithItsTransfer(t *testing.T) {
+	var loads atomic.Int32
+	fake := fourFrames()
+	runner := Runner{HWAccel: "vaapi", HWDevice: "/dev/dri/renderD128", Exec: fake.exec, Capabilities: listingCapabilities(&loads, nil, stockFilters...)}
+	result, err := runner.Run(t.Context(), hdrSheetsRequest(tonemap.SourceHLG, Attempt{Hardware: true}, Attempt{}))
+	if err != nil {
+		t.Fatal(err)
+	}
+	graph := graphOf(fake.calls[1])
+	if result.Decoder != "hardware:vaapi" || !strings.Contains(graph, tonemap.SoftwareFilter(tonemap.SourceHLG, tonemap.SoftwareFilterHable)) ||
+		!strings.Contains(graph, "color_trc=arib-std-b67") || strings.Contains(graph, "procamp_vaapi") {
+		t.Fatalf("decoder %s, graph %s; want the HLG chain after a VAAPI decode", result.Decoder, graph)
+	}
+}
+
+func TestRunSheetsDecodesOnCUDA(t *testing.T) {
+	var loads atomic.Int32
+	fake := fourFrames()
+	runner := Runner{HWAccel: "nvenc", HWDevice: "1", Exec: fake.exec, Capabilities: listingCapabilities(&loads, nil, jellyfinFilters...)}
+	result, err := runner.Run(t.Context(), hdrSheetsRequest(tonemap.SourcePQ, Attempt{Hardware: true}, Attempt{}))
+	if err != nil {
+		t.Fatal(err)
+	}
+	args := fake.calls[1]
+	decode := []string{"-init_hw_device", "cuda=cu:1", "-filter_hw_device", "cu", "-hwaccel", "cuda", "-hwaccel_output_format", "cuda"}
+	if result.Decoder != "hardware:nvenc" || !slices.Equal(args[4:12], decode) || !strings.Contains(graphOf(args), "scale_cuda=") {
+		t.Fatalf("decoder %s, args %q; want CUDA decode on device 1", result.Decoder, args)
+	}
+	// Without a source signal there is no CUDA chain: software tone maps.
+	fake = fourFrames()
+	runner = Runner{HWAccel: "nvenc", Exec: fake.exec, Capabilities: listingCapabilities(&loads, nil, jellyfinFilters...)}
+	result, err = runner.Run(t.Context(), hdrSheetsRequest("", Attempt{Hardware: true}, Attempt{}))
+	if err != nil || result.Decoder != "software" || len(fake.calls) != 2 {
+		t.Fatalf("decoder %s, runs %d, error %v; want software only", result.Decoder, len(fake.calls), err)
+	}
+}
+
+// TestRunRefusesCUDAForStatsAndImages keeps the outputs whose chains assume
+// VAAPI surfaces off CUDA: their hardware attempts fail as unsupported
+// without starting ffmpeg.
+func TestRunRefusesCUDAForStatsAndImages(t *testing.T) {
+	for name, req := range map[string]Request{
+		"stats":  creditsTailRequest(),
+		"images": imageRequest(nil),
+	} {
+		var started atomic.Int32
+		runner := Runner{HWAccel: "nvenc", Exec: func(context.Context, string, []string, io.Reader, io.Writer, io.Writer) error {
+			started.Add(1)
+			return nil
+		}}
+		req.Attempts = []Attempt{{Hardware: true}}
+		_, err := runner.Run(t.Context(), req)
+		if failure, ok := errors.AsType[*Error](err); !ok || failure.Reason != ReasonUnsupported || started.Load() != 0 {
+			t.Errorf("%s: error %v after %d processes, want unsupported before ffmpeg", name, err, started.Load())
+		}
+	}
+}
+
+func TestRunSheetsWithoutASourceToneMap(t *testing.T) {
+	tests := map[string]struct {
+		filters []string
+		loadErr error
+		allow   bool
+		want    Reason
+	}{
+		"Dolby Vision without tonemapx": {filters: stockFilters, allow: true, want: ReasonUnsupported},
+		"no sidedata":                   {filters: []string{"zscale", "tonemapx"}, allow: true, want: ReasonUnsupported},
+		"software not allowed":          {filters: jellyfinFilters, want: ReasonUnsupported},
+		"listing failed":                {loadErr: errors.New("ffmpeg -filters timed out"), allow: true, want: ReasonCapabilities},
+	}
+	for name, tt := range tests {
+		var loads atomic.Int32
+		fake := fourFrames()
+		runner := Runner{HWAccel: "vaapi", HWDevice: "/dev/dri/renderD128", Exec: fake.exec, Capabilities: listingCapabilities(&loads, tt.loadErr, tt.filters...)}
+		req := hdrSheetsRequest(tonemap.SourceDolbyVision, Attempt{Hardware: true}, Attempt{})
+		req.Sheets.ToneMap.AllowSoftware = tt.allow
+		_, err := runner.Run(t.Context(), req)
+		wantLoads := int32(1)
+		if !tt.allow {
+			wantLoads = 0
+		}
+		if failure, ok := errors.AsType[*Error](err); !ok || failure.Reason != tt.want || len(fake.calls) != 0 || loads.Load() != wantLoads {
+			t.Errorf("%s: error %v after %d processes and %d loads, want %s before ffmpeg", name, err, len(fake.calls), loads.Load(), tt.want)
+		}
+	}
+}
+
+func TestSelectSourceToneMap(t *testing.T) {
+	tests := []struct {
+		kind    tonemap.SourceKind
+		filters []string
+		want    string
+	}{
+		{tonemap.SourcePQ, jellyfinFilters, tonemap.SoftwareFilter(tonemap.SourcePQ, tonemap.SoftwareFilterBT2390)},
+		{tonemap.SourcePQ, stockFilters, tonemap.SoftwareFilter(tonemap.SourcePQ, tonemap.SoftwareFilterHable)},
+		{tonemap.SourceDolbyVision, jellyfinFilters, tonemap.SoftwareFilter(tonemap.SourceDolbyVision, tonemap.SoftwareFilterBT2390)},
+		{tonemap.SourceDolbyVision, stockFilters, ""},
+		{tonemap.SourceSDRBT2020, []string{"zscale", "sidedata"}, tonemap.SoftwareFilter(tonemap.SourceSDRBT2020, "")},
+	}
+	for _, tt := range tests {
+		var loads atomic.Int32
+		runner := Runner{Capabilities: listingCapabilities(&loads, nil, tt.filters...)}
+		got, failure := runner.selectSourceToneMap(t.Context(), tt.kind)
+		if got != tt.want || (tt.want == "") != (failure != nil) {
+			t.Errorf("%s with %v: chain %q, failure %v; want %q", tt.kind, tt.filters, got, failure, tt.want)
+		}
+	}
+}
+
+func TestToneMapSourceValidation(t *testing.T) {
+	req := hdrSheetsRequest(tonemap.SourceHLG)
+	if err := req.Validate(); err != nil {
+		t.Fatalf("valid request rejected: %v", err)
+	}
+	encoded, err := json.Marshal(req)
+	if err != nil || !strings.Contains(string(encoded), `"source":"hlg"`) {
+		t.Fatalf("encoded %s, error %v", encoded, err)
+	}
+	var decoded Request
+	if err := json.Unmarshal(encoded, &decoded); err != nil || decoded.Sheets.ToneMap.Source != tonemap.SourceHLG {
+		t.Fatalf("decoded %+v, error %v", decoded.Sheets.ToneMap, err)
+	}
+	req.Sheets.ToneMap.Source = "hdr12"
+	if err := req.Validate(); err == nil {
+		t.Error("unknown source: want a validation error")
+	}
+	image := imageRequest(&ToneMap{AllowSoftware: true, Source: tonemap.SourcePQ})
+	if err := image.Validate(); err == nil {
+		t.Error("image with a source: want a validation error")
+	}
+}
+
+func TestSupportsHardwareSheets(t *testing.T) {
+	for accel, want := range map[string]bool{"qsv": true, "vaapi": true, "videotoolbox": true, "nvenc": true, "none": false, "": false} {
+		if got := SupportsHardwareSheets(accel); got != want {
+			t.Errorf("SupportsHardwareSheets(%q) = %t, want %t", accel, got, want)
+		}
+	}
+}
+
+func TestHardwareDecoderRefusalIsUnsupported(t *testing.T) {
+	for _, log := range []string{
+		"[mpeg4 @ 0x5] Failed setup for format vaapi: hwaccel initialisation returned error.",
+		"[h264 @ 0x5] Your platform doesn't support hardware accelerated H264 decoding.",
+	} {
+		failure := AttemptError{Reason: ReasonExit, Err: errors.New("exit status 218"), StderrTail: log}
+		if got := failure.Cause(); got != ReasonUnsupported {
+			t.Errorf("%q: cause %s, want unsupported", log, got)
+		}
+	}
+}
diff --git a/internal/metadata/anchored_identity_repair.go b/internal/metadata/anchored_identity_repair.go
index 5da5c1dd6d..01e8666b90 100644
--- a/internal/metadata/anchored_identity_repair.go
+++ b/internal/metadata/anchored_identity_repair.go
@@ -541,6 +541,7 @@ func (s *MetadataService) repairAnchoredIdentityMismatchGroup(
 	if err := tx.Commit(ctx); err != nil {
 		return false, fmt.Errorf("committing anchored identity repair: %w", err)
 	}
+	MarkRecommendationsStale(ctx, s.recsStaler, MovedStateTargets(moveResult.Reattribution, anchor.TargetContent, moveResult.EpisodePairs)...)
 
 	slog.InfoContext(ctx, "metadata: repaired provider-anchored root ownership",
 		"component", "metadata",
diff --git a/internal/metadata/artwork_delivery.go b/internal/metadata/artwork_delivery.go
index 7cc9a4d86d..47a80df2ef 100644
--- a/internal/metadata/artwork_delivery.go
+++ b/internal/metadata/artwork_delivery.go
@@ -32,6 +32,12 @@ func NewArtworkDeliveryStore(pool *pgxpool.Pool, scope string, external bool) *A
 	return &ArtworkDeliveryStore{pool: pool, scope: scope, external: external}
 }
 
+// ExternalDelivery reports whether reads go through an external endpoint that
+// can lag behind a storage write, so every key needs the verified manifest.
+func (s *ArtworkDeliveryStore) ExternalDelivery() bool {
+	return s.external
+}
+
 func (s *ArtworkDeliveryStore) ArtworkAvailability(ctx context.Context, paths []string) (map[string]ArtworkAvailability, error) {
 	// Publication clears delivery_checked_at but keeps the stale verdict's keys.
 	rows, err := s.pool.Query(ctx, `SELECT original_path,
diff --git a/internal/metadata/artwork_delivery_test.go b/internal/metadata/artwork_delivery_test.go
index f10a429e8f..8f8ef7a905 100644
--- a/internal/metadata/artwork_delivery_test.go
+++ b/internal/metadata/artwork_delivery_test.go
@@ -14,9 +14,11 @@ import (
 
 	"github.com/jackc/pgx/v5/pgxpool"
 
+	"github.com/prairie-server/prairie-server/internal/artworkkey"
 	"github.com/prairie-server/prairie-server/internal/blobstore"
 	"github.com/prairie-server/prairie-server/internal/catalog"
 	"github.com/prairie-server/prairie-server/internal/envutil"
+	"github.com/prairie-server/prairie-server/internal/imagesize"
 )
 
 type deliveryTestChecker struct {
@@ -69,7 +71,7 @@ func TestArtworkDeliveryPublicationAndReconciliation(t *testing.T) {
 	}
 	t.Cleanup(pool.Close)
 	original := fmt.Sprintf("tmdb/movies/delivery-%d/poster/original.rev.webp", time.Now().UnixNano())
-	large, medium := variantKey(original, "w780"), variantKey(original, "w500")
+	large, medium := variantKey(original, posterLargeRung), variantKey(original, "w500")
 	keys := []string{original, large, medium}
 	t.Cleanup(func() {
 		_, _ = pool.Exec(context.Background(), `DELETE FROM artwork_revision_gc_candidates WHERE original_path=$1`, original)
@@ -298,6 +300,10 @@ func artworkDeliveryTestPool(t *testing.T) *pgxpool.Pool {
 	return pool
 }
 
+// posterLargeRung is the widest poster rung, the one the latest ladder version
+// added and the one an unverified delivery must not advertise.
+var posterLargeRung = imagesize.Variant(artworkkey.ImagePoster, imagesize.Large)
+
 // Production stalled here: an unavailable verdict recorded just before a
 // successful re-upload kept suppressing the artwork, and the queued recheck sat
 // behind every overdue routine check. A re-upload must restore a URL without a
@@ -307,7 +313,7 @@ func TestArtworkDeliveryRecoversRepublishedArtworkBehindBacklog(t *testing.T) {
 	ctx := t.Context()
 	prefix := fmt.Sprintf("tmdb/movies/delivery-backlog-%d", time.Now().UnixNano())
 	original := prefix + "/target/poster/original.rev.webp"
-	large, medium := variantKey(original, "w780"), variantKey(original, "w500")
+	large, medium := variantKey(original, posterLargeRung), variantKey(original, "w500")
 	keys := []string{original, large, medium}
 	t.Cleanup(func() {
 		_, _ = pool.Exec(context.Background(), `DELETE FROM artwork_revision_gc_candidates WHERE original_path LIKE $1`, prefix+"/%")
@@ -404,7 +410,7 @@ func TestArtworkDeliveryStaleVerdictKeepsSurvivingVariants(t *testing.T) {
 	pool := artworkDeliveryTestPool(t)
 	ctx := t.Context()
 	original := fmt.Sprintf("tmdb/movies/delivery-stale-%d/poster/original.rev.webp", time.Now().UnixNano())
-	large, medium := variantKey(original, "w780"), variantKey(original, "w500")
+	large, medium := variantKey(original, posterLargeRung), variantKey(original, "w500")
 	keys := []string{original, large, medium}
 	t.Cleanup(func() {
 		_, _ = pool.Exec(context.Background(), `DELETE FROM artwork_revision_gc_candidates WHERE original_path=$1`, original)
@@ -436,11 +442,39 @@ func TestArtworkDeliveryStaleVerdictKeepsSurvivingVariants(t *testing.T) {
 	}
 }
 
+// Local storage and direct S3 never verify delivery, but a ladder change still
+// leaves existing revisions without the new widest rung until the backfill
+// regenerates them. Their reader answers from the publication manifest alone,
+// so a client asking for that rung gets the widest one the revision published.
+func TestArtworkPublicationSelectsPublishedRungWithoutExternalDelivery(t *testing.T) {
+	pool := artworkDeliveryTestPool(t)
+	ctx := t.Context()
+	original := fmt.Sprintf("tmdb/movies/delivery-local-%d/poster/original.rev.webp", time.Now().UnixNano())
+	large, previousLarge := variantKey(original, posterLargeRung), variantKey(original, "w780")
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM artwork_revision_gc_candidates WHERE original_path=$1`, original)
+	})
+	// The revision predates the current ladder: it has the previous ladder's
+	// widest rung, not the current one.
+	if err := catalog.NewArtworkRevisionTracker(pool).TrackArtworkRevision(ctx, original, "poster",
+		[]string{original, previousLarge, variantKey(original, "w500"), variantKey(original, "w300")}); err != nil {
+		t.Fatal(err)
+	}
+
+	resolver := NewPluginImageResolver()
+	t.Cleanup(resolver.Close)
+	resolver.SetArtworkResolver(noProbeStore{t})
+	resolver.SetArtworkAvailabilityReader(NewArtworkDeliveryStore(pool, "local|delivery-local", false))
+	if got := resolver.ResolveImageURL(ctx, large, "large"); got != "https://images.example/"+previousLarge {
+		t.Fatalf("resolved %q, want the widest published rung %s", got, previousLarge)
+	}
+}
+
 func TestArtworkDeliveryBacksOffIncompleteVerdicts(t *testing.T) {
 	pool := artworkDeliveryTestPool(t)
 	ctx := t.Context()
 	original := fmt.Sprintf("tmdb/movies/delivery-backoff-%d/poster/original.rev.webp", time.Now().UnixNano())
-	large, medium := variantKey(original, "w780"), variantKey(original, "w500")
+	large, medium := variantKey(original, posterLargeRung), variantKey(original, "w500")
 	keys := []string{original, large, medium}
 	t.Cleanup(func() {
 		_, _ = pool.Exec(context.Background(), `DELETE FROM artwork_revision_gc_candidates WHERE original_path=$1`, original)
diff --git a/internal/metadata/artwork_reference_plan_db_test.go b/internal/metadata/artwork_reference_plan_db_test.go
index bdb67e920f..739ada398a 100644
--- a/internal/metadata/artwork_reference_plan_db_test.go
+++ b/internal/metadata/artwork_reference_plan_db_test.go
@@ -45,6 +45,9 @@ func TestArtworkReferenceChecksUsePathIndexesDB(t *testing.T) {
 			indexes = append(indexes, name)
 		}
 		rows.Close()
+		if err := rows.Err(); err != nil {
+			t.Fatalf("%s: list indexes: %v", surface.name, err)
+		}
 		if len(indexes) == 0 {
 			continue
 		}
@@ -66,6 +69,9 @@ func TestArtworkReferenceChecksUsePathIndexesDB(t *testing.T) {
 			plan.WriteString(line + "\n")
 		}
 		planRows.Close()
+		if err := planRows.Err(); err != nil {
+			t.Fatalf("%s: explain: %v", surface.name, err)
+		}
 		if _, err := tx.Exec(ctx, `DEALLOCATE artwork_reference_check`); err != nil {
 			t.Fatal(err)
 		}
diff --git a/internal/metadata/artwork_release.go b/internal/metadata/artwork_release.go
new file mode 100644
index 0000000000..35a3aedc51
--- /dev/null
+++ b/internal/metadata/artwork_release.go
@@ -0,0 +1,431 @@
+package metadata
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+	"slices"
+	"strings"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/database/pglock"
+)
+
+// While metadata.cache_images is off, clients load item artwork straight from
+// the providers. Turning it off stops new copies, and refreshes stop keeping
+// stored ones, but artwork stored earlier would stay served until each item
+// happened to be refreshed. StoredArtworkReleaser moves it back:
+//
+//   - A slot serving a stored copy of provider artwork serves its provider
+//     source again. The revision GC removes the displaced copy later, as for
+//     any replaced artwork; nothing here deletes files.
+//   - A matched item whose poster, backdrop or logo serves a copy with no
+//     provider source (a local sidecar, an image URL an NFO names, or an old
+//     copy saved without its source), that waits on a local copy that will
+//     now never be made, or that keeps extra backdrops, which are local art
+//     only, gets refresh debt. The scheduled refresh then fills the slot from
+//     the providers; until then, and for good when no provider has an image,
+//     the item keeps what it serves. An item refreshed or tried within the
+//     last week is left until the week is up, so artwork no provider has
+//     costs at most a refresh a week.
+//
+// Items with locked artwork keep everything. Banner, landscape thumb, clear
+// art and disc art come only from local files, so their stored copies stay.
+// Movies and series only: book libraries are beta and store their covers on
+// their own terms.
+//
+// The pass is idempotent and runs daily while caching is off, so a copy a job
+// still in flight publishes after a pass, or a node that had not reloaded the
+// setting yet, is undone by the next pass. It pages only through rows with
+// something to do. Every write re-checks the stored setting, so a pass still
+// running when caching comes back on changes nothing more.
+type StoredArtworkReleaser struct {
+	pool     *pgxpool.Pool
+	debts    *RefreshDebtRepository
+	pageSize int
+	// lock takes the pass's cluster-wide lock; acquired is false when
+	// another server holds it.
+	lock func(ctx context.Context) (release func(), acquired bool, err error)
+}
+
+// StoredArtworkReleaseStats summarizes one pass.
+type StoredArtworkReleaseStats struct {
+	// Released counts rows that went back to their provider source.
+	Released int `json:"released"`
+	// RefreshesQueued counts items given refresh debt.
+	RefreshesQueued int `json:"refreshes_queued"`
+	// Skipped is set when another server holds the pass.
+	Skipped bool `json:"skipped"`
+}
+
+// storedArtworkReleaseAdvisoryLock keeps one pass running across servers.
+const storedArtworkReleaseAdvisoryLock int64 = 0x53494C4F52454C53 // "PRAIRIERELS"
+
+const (
+	storedArtworkReleasePageSize = 1000
+	// storedArtworkReleaseRefreshAge is how long an item's last refresh holds
+	// off new refresh debt for its artwork.
+	storedArtworkReleaseRefreshAge = 7 * 24 * time.Hour
+	// storedArtworkReleaseDebtPriority is the default debt band.
+	storedArtworkReleaseDebtPriority = 100
+)
+
+// cachingOffSQL holds when the stored metadata.cache_images is off. It
+// mirrors the setting's parsing: strconv.ParseBool, and on when unset.
+const cachingOffSQL = `lower(coalesce((SELECT value FROM server_settings WHERE key = 'metadata.cache_images'), '')) IN ('0', 'f', 'false')`
+
+// imagesLockedSQL holds when the media_items row aliased alias has FieldImages
+// locked.
+func imagesLockedSQL(alias string) string {
+	return fmt.Sprintf("%d = ANY(%s.locked_fields)", int(FieldImages), alias)
+}
+
+func storedCopySQL(pathCol string) string {
+	return fmt.Sprintf(`(coalesce(%[1]s, '') NOT IN ('', '-') AND %[1]s NOT LIKE '%%://%%')`, pathCol)
+}
+
+func providerSourceSQL(sourceCol string) string {
+	return fmt.Sprintf(`(coalesce(%[1]s, '') LIKE '%%://%%' AND lower(%[1]s) NOT LIKE ALL (%[2]s))`, sourceCol, nonProviderImageSchemesSQL)
+}
+
+func localSourceSQL(sourceCol string) string {
+	return fmt.Sprintf(`(lower(coalesce(%[1]s, '')) LIKE 'file://%%' OR lower(coalesce(%[1]s, '')) LIKE 'nfo+%%')`, sourceCol)
+}
+
+// releasableSQL holds when a slot serves a stored copy of provider artwork.
+func releasableSQL(pathCol, sourceCol string) string {
+	return "(" + storedCopySQL(pathCol) + " AND " + providerSourceSQL(sourceCol) + ")"
+}
+
+// sourcelessCopySQL holds when a slot serves a stored copy saved without its
+// source, as copies made before source columns existed were.
+func sourcelessCopySQL(pathCol, sourceCol string) string {
+	return "(" + storedCopySQL(pathCol) + " AND coalesce(" + sourceCol + ", '') = '')"
+}
+
+// needsProviderArtworkSQL holds when only a refresh can give a slot provider
+// artwork: it serves a copy with no provider source, or it is empty and waits
+// on a local copy.
+func needsProviderArtworkSQL(pathCol, sourceCol string) string {
+	return fmt.Sprintf("((%s AND NOT %s) OR (coalesce(%s, '') = '' AND %s))",
+		storedCopySQL(pathCol), providerSourceSQL(sourceCol), pathCol, localSourceSQL(sourceCol))
+}
+
+// releaseSet returns SET assignments that release each slot of the row
+// aliased alias that qualifies. The slot keeps its thumbhash: clients show it
+// as a placeholder, and the provider image it now serves is the one the copy
+// was made from, or, when a refresh moved the source on, a newer pick that
+// replaces the placeholder as soon as it loads.
+//
+// With clearSourceless, a stored copy with no source at all is cleared: a
+// localization row's empty slot falls back to the item's or season's own
+// artwork, which this pass and refreshes already move to the providers.
+func releaseSet(alias string, slots []artworkReleaseSlot, clearSourceless bool) string {
+	parts := make([]string, 0, len(slots)+1)
+	for _, slot := range slots {
+		path, source := alias+"."+slot.path, alias+"."+slot.source
+		clear := ""
+		if clearSourceless {
+			clear = fmt.Sprintf(" WHEN %s THEN ''", sourcelessCopySQL(path, source))
+		}
+		parts = append(parts, fmt.Sprintf("%s = CASE WHEN %s THEN %s%s ELSE %s END", slot.path, releasableSQL(path, source), source, clear, path))
+	}
+	parts = append(parts, "updated_at = NOW()")
+	return strings.Join(parts, ", ")
+}
+
+func anyReleasable(alias string, slots []artworkReleaseSlot, clearSourceless bool) string {
+	conds := make([]string, 0, 2*len(slots))
+	for _, slot := range slots {
+		path, source := alias+"."+slot.path, alias+"."+slot.source
+		conds = append(conds, releasableSQL(path, source))
+		if clearSourceless {
+			conds = append(conds, sourcelessCopySQL(path, source))
+		}
+	}
+	return "(" + strings.Join(conds, " OR ") + ")"
+}
+
+type artworkReleaseSlot struct{ path, source string }
+
+// releaseSlot names a slot's columns from their base name.
+func releaseSlot(base string) artworkReleaseSlot {
+	return artworkReleaseSlot{path: base + "_path", source: base + "_source_path"}
+}
+
+var (
+	itemLocalizationReleaseSlots = []artworkReleaseSlot{
+		releaseSlot("poster"), releaseSlot("backdrop"), releaseSlot("logo"),
+	}
+	itemReleaseSlots = append(slices.Clone(itemLocalizationReleaseSlots),
+		releaseSlot("banner"), releaseSlot("thumb"), releaseSlot("clearart"), releaseSlot("disc"))
+	seasonReleaseSlots  = []artworkReleaseSlot{releaseSlot("poster")}
+	episodeReleaseSlots = []artworkReleaseSlot{releaseSlot("still")}
+)
+
+const (
+	releaseItemOwnerSQL   = "mi.content_id = t.content_id"
+	releaseSeriesOwnerSQL = "mi.content_id = t.series_id"
+
+	releaseItemLocalizationsTable = "media_item_localizations"
+	releaseEpisodesTable          = "episodes"
+)
+
+// artworkReleaseTable is one table the pass pages through by content_id.
+// owner joins the media_items row mi, whose type and lock decide, to a row t.
+type artworkReleaseTable struct {
+	table, owner string
+	slots        []artworkReleaseSlot
+	// localized, when set, is the table of t's localizations, keyed to t by
+	// localizedKey; every language's row is updated.
+	localized, localizedKey string
+	// needsRefresh, when set, selects the rows t that only a refresh can give
+	// provider artwork.
+	needsRefresh string
+}
+
+// candidateSQL holds for a row t with a slot to release or that only a
+// refresh can fix. Paging only through such rows keeps a pass with nothing to
+// do to one ordered read of each table.
+func (t artworkReleaseTable) candidateSQL() string {
+	cond := anyReleasable("t", t.slots, false)
+	if t.localized != "" {
+		cond = fmt.Sprintf("EXISTS (SELECT 1 FROM %s l WHERE l.%s = t.content_id AND %s)",
+			t.localized, t.localizedKey, anyReleasable("l", t.slots, true))
+	}
+	if t.needsRefresh != "" {
+		cond = "(" + cond + " OR " + t.needsRefresh + ")"
+	}
+	return cond
+}
+
+func (t artworkReleaseTable) name() string {
+	if t.localized != "" {
+		return t.localized
+	}
+	return t.table
+}
+
+func storedArtworkReleaseTables() []artworkReleaseTable {
+	needs := func(slots ...artworkReleaseSlot) string {
+		conds := make([]string, len(slots))
+		for i, slot := range slots {
+			conds[i] = needsProviderArtworkSQL("t."+slot.path, "t."+slot.source)
+		}
+		return strings.Join(conds, " OR ")
+	}
+	const items, seasons = "media_items", "seasons"
+	return []artworkReleaseTable{
+		{
+			table: items, owner: releaseItemOwnerSQL, slots: itemReleaseSlots,
+			needsRefresh: "(" + needs(itemLocalizationReleaseSlots...) +
+				" OR EXISTS (SELECT 1 FROM media_item_backdrops b WHERE b.content_id = t.content_id)" +
+				// Storage recovery clears a missing copy it cannot re-download
+				// to empty slot and source and nulls last_refreshed.
+				" OR (t.last_refreshed IS NULL AND (" + emptySlotSQL("t", itemLocalizationReleaseSlots) + ")))",
+		},
+		{
+			table: items, owner: releaseItemOwnerSQL, slots: itemLocalizationReleaseSlots,
+			localized: releaseItemLocalizationsTable, localizedKey: "content_id",
+		},
+		{table: seasons, owner: releaseSeriesOwnerSQL, slots: seasonReleaseSlots, needsRefresh: needs(seasonReleaseSlots...)},
+		{
+			table: seasons, owner: releaseSeriesOwnerSQL, slots: seasonReleaseSlots,
+			localized: "season_localizations", localizedKey: "season_content_id",
+		},
+		{table: releaseEpisodesTable, owner: releaseSeriesOwnerSQL, slots: episodeReleaseSlots, needsRefresh: needs(episodeReleaseSlots...)},
+	}
+}
+
+// emptySlotSQL holds when any slot of the row aliased alias has neither a path
+// nor a source.
+func emptySlotSQL(alias string, slots []artworkReleaseSlot) string {
+	conds := make([]string, len(slots))
+	for i, slot := range slots {
+		conds[i] = fmt.Sprintf("(coalesce(%[1]s.%[2]s, '') = '' AND coalesce(%[1]s.%[3]s, '') = '')", alias, slot.path, slot.source)
+	}
+	return strings.Join(conds, " OR ")
+}
+
+// NewStoredArtworkReleaser returns nil without a database.
+func NewStoredArtworkReleaser(pool *pgxpool.Pool) *StoredArtworkReleaser {
+	if pool == nil {
+		return nil
+	}
+	return &StoredArtworkReleaser{
+		pool:     pool,
+		debts:    NewRefreshDebtRepository(pool),
+		pageSize: storedArtworkReleasePageSize,
+		lock: func(ctx context.Context) (func(), bool, error) {
+			lock, acquired, err := pglock.TryAcquire(ctx, pool, storedArtworkReleaseAdvisoryLock)
+			if err != nil || !acquired {
+				return nil, false, err
+			}
+			return func() {
+				if err := lock.Release(context.WithoutCancel(ctx)); err != nil {
+					slog.WarnContext(ctx, "stored artwork release: releasing lock failed", "component", "metadata", "error", err)
+				}
+			}, true, nil
+		},
+	}
+}
+
+// CachingOff reports whether the stored metadata.cache_images is off.
+func (r *StoredArtworkReleaser) CachingOff(ctx context.Context) (bool, error) {
+	if r == nil {
+		return false, nil
+	}
+	var off bool
+	if err := r.pool.QueryRow(ctx, "SELECT "+cachingOffSQL).Scan(&off); err != nil {
+		return false, fmt.Errorf("reading metadata.cache_images: %w", err)
+	}
+	return off, nil
+}
+
+// Run makes one pass over every table. It returns early, with what it did,
+// once caching is back on.
+func (r *StoredArtworkReleaser) Run(ctx context.Context) (StoredArtworkReleaseStats, error) {
+	var stats StoredArtworkReleaseStats
+	if r == nil {
+		return stats, nil
+	}
+	release, acquired, err := r.lock(ctx)
+	if err != nil {
+		return stats, fmt.Errorf("stored artwork release: acquiring lock: %w", err)
+	}
+	if !acquired {
+		stats.Skipped = true
+		return stats, nil
+	}
+	defer release()
+
+	for _, table := range storedArtworkReleaseTables() {
+		if err := r.releaseTable(ctx, table, &stats); err != nil {
+			return stats, err
+		}
+	}
+	return stats, nil
+}
+
+func (r *StoredArtworkReleaser) releaseTable(ctx context.Context, table artworkReleaseTable, stats *StoredArtworkReleaseStats) error {
+	cursor := ""
+	for {
+		if off, err := r.CachingOff(ctx); err != nil || !off {
+			return err
+		}
+		keys, err := r.queryStrings(ctx,
+			"SELECT content_id FROM "+table.table+" t WHERE content_id > $1 AND "+table.candidateSQL()+
+				" ORDER BY content_id LIMIT $2",
+			cursor, r.pageSize)
+		if err != nil {
+			return fmt.Errorf("stored artwork release: paging %s: %w", table.name(), err)
+		}
+		if len(keys) == 0 {
+			return nil
+		}
+		cursor = keys[len(keys)-1]
+
+		released, err := r.releasePage(ctx, table, keys)
+		if err != nil {
+			return err
+		}
+		stats.Released += released
+		if table.needsRefresh != "" {
+			queued, err := r.queueRefreshes(ctx, table, keys)
+			if err != nil {
+				return err
+			}
+			stats.RefreshesQueued += queued
+		}
+		if len(keys) < r.pageSize {
+			return nil
+		}
+	}
+}
+
+// ownerScopeSQL limits rows to unlocked movies and series, while caching is
+// off.
+func ownerScopeSQL(table artworkReleaseTable) string {
+	return fmt.Sprintf(`EXISTS (SELECT 1 FROM media_items mi WHERE %s AND mi.type IN ('movie', 'series') AND NOT %s) AND %s`,
+		table.owner, imagesLockedSQL("mi"), cachingOffSQL)
+}
+
+// releasePage releases a page's slots. An Edit Metadata selection writes the
+// artwork and locks it in one transaction, and an UPDATE that waited on that
+// row would judge the lock from the snapshot it started with and release the
+// selection. So the page's rows are locked first, in the order a selection
+// takes them (the target row, then the item it locks), each in a statement of
+// its own, and the UPDATE then reads the committed lock. A deadlock with
+// another writer retries the page.
+func (r *StoredArtworkReleaser) releasePage(ctx context.Context, table artworkReleaseTable, keys []string) (released int, err error) {
+	var query string
+	if table.localized != "" {
+		query = fmt.Sprintf(`
+			UPDATE %[1]s l SET %[2]s
+			FROM %[3]s t
+			WHERE t.content_id = ANY($1) AND l.%[4]s = t.content_id
+			  AND %[5]s AND %[6]s`,
+			table.localized, releaseSet("l", table.slots, true), table.table, table.localizedKey,
+			anyReleasable("l", table.slots, true), ownerScopeSQL(table))
+	} else {
+		query = fmt.Sprintf(`
+			UPDATE %[1]s t SET %[2]s
+			WHERE t.content_id = ANY($1) AND %[3]s AND %[4]s`,
+			table.table, releaseSet("t", table.slots, false), anyReleasable("t", table.slots, false), ownerScopeSQL(table))
+	}
+	err = retryOnDeadlock(ctx, func() error {
+		return pgx.BeginFunc(ctx, r.pool, func(tx pgx.Tx) error {
+			for _, lock := range []string{
+				fmt.Sprintf(`SELECT 1 FROM %s t WHERE t.content_id = ANY($1) ORDER BY t.content_id FOR UPDATE`, table.table),
+				fmt.Sprintf(`
+					SELECT 1 FROM media_items mi
+					WHERE EXISTS (SELECT 1 FROM %s t WHERE t.content_id = ANY($1) AND %s)
+					ORDER BY mi.content_id
+					FOR SHARE`, table.table, table.owner),
+			} {
+				if _, err := tx.Exec(ctx, lock, keys); err != nil {
+					return err
+				}
+			}
+			tag, err := tx.Exec(ctx, query, keys)
+			released = int(tag.RowsAffected())
+			return err
+		})
+	})
+	if err != nil {
+		return 0, fmt.Errorf("stored artwork release: releasing %s: %w", table.name(), err)
+	}
+	return released, nil
+}
+
+func (r *StoredArtworkReleaser) queryStrings(ctx context.Context, sql string, args ...any) ([]string, error) {
+	rows, err := r.pool.Query(ctx, sql, args...)
+	if err != nil {
+		return nil, err
+	}
+	return pgx.CollectRows(rows, pgx.RowTo[string])
+}
+
+func (r *StoredArtworkReleaser) queueRefreshes(ctx context.Context, table artworkReleaseTable, keys []string) (int, error) {
+	ids, err := r.queryStrings(ctx, fmt.Sprintf(`
+		SELECT DISTINCT mi.content_id
+		FROM %[1]s t
+		JOIN media_items mi ON %[2]s
+		WHERE t.content_id = ANY($1) AND %[3]s
+		  AND mi.type IN ('movie', 'series') AND mi.status = 'matched' AND NOT %[4]s
+		  AND (mi.last_refreshed IS NULL OR mi.last_refreshed < NOW() - $2::interval)
+		  AND %[5]s`,
+		table.table, table.owner, table.needsRefresh, imagesLockedSQL("mi"), cachingOffSQL),
+		keys, intervalLiteral(storedArtworkReleaseRefreshAge))
+	if err != nil {
+		return 0, fmt.Errorf("stored artwork release: finding %s to refresh: %w", table.name(), err)
+	}
+	if err := r.debts.RequestDueMany(ctx, RefreshTargetItem, ids, storedArtworkReleaseDebtPriority,
+		RefreshDebtReasonProviderArtwork, time.Now().UTC(), storedArtworkReleaseRefreshAge); err != nil {
+		return 0, err
+	}
+	return len(ids), nil
+}
diff --git a/internal/metadata/artwork_release_db_test.go b/internal/metadata/artwork_release_db_test.go
new file mode 100644
index 0000000000..9c7c4636be
--- /dev/null
+++ b/internal/metadata/artwork_release_db_test.go
@@ -0,0 +1,275 @@
+package metadata
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// storedArtworkReleaseTestPool isolates the release in a schema of its own
+// with the tables and columns it reads, so it neither sees nor writes the
+// shared test database's catalog and setting.
+func storedArtworkReleaseTestPool(t *testing.T) *pgxpool.Pool {
+	t.Helper()
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	schema := fmt.Sprintf("artwork_release_test_%d", time.Now().UnixNano())
+	admin, err := pgxpool.New(t.Context(), dsn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(admin.Close)
+	if _, err := admin.Exec(t.Context(), "CREATE SCHEMA "+schema); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _, _ = admin.Exec(context.Background(), "DROP SCHEMA "+schema+" CASCADE") })
+	config, err := pgxpool.ParseConfig(dsn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	config.ConnConfig.RuntimeParams["search_path"] = schema
+	config.MaxConns = 4
+	pool, err := pgxpool.NewWithConfig(t.Context(), config)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(pool.Close)
+	if _, err := pool.Exec(t.Context(), `
+	CREATE TABLE server_settings (key TEXT PRIMARY KEY, value TEXT NOT NULL);
+	CREATE TABLE media_items (
+		content_id TEXT PRIMARY KEY, type TEXT NOT NULL, status TEXT NOT NULL DEFAULT 'matched', locked_fields INTEGER[] NOT NULL DEFAULT '{}',
+		last_refreshed TIMESTAMPTZ,
+		poster_path TEXT DEFAULT '', poster_source_path TEXT DEFAULT '', poster_thumbhash TEXT DEFAULT '',
+		backdrop_path TEXT DEFAULT '', backdrop_source_path TEXT DEFAULT '', backdrop_thumbhash TEXT DEFAULT '',
+		logo_path TEXT DEFAULT '', logo_source_path TEXT DEFAULT '',
+		banner_path TEXT DEFAULT '', banner_source_path TEXT DEFAULT '', banner_thumbhash TEXT DEFAULT '',
+		thumb_path TEXT DEFAULT '', thumb_source_path TEXT DEFAULT '', thumb_thumbhash TEXT DEFAULT '',
+		clearart_path TEXT DEFAULT '', clearart_source_path TEXT DEFAULT '',
+		disc_path TEXT DEFAULT '', disc_source_path TEXT DEFAULT '',
+		updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+	);
+	CREATE TABLE media_item_localizations (
+		content_id TEXT NOT NULL, language TEXT NOT NULL,
+		poster_path TEXT DEFAULT '', poster_source_path TEXT DEFAULT '', poster_thumbhash TEXT DEFAULT '',
+		backdrop_path TEXT DEFAULT '', backdrop_source_path TEXT DEFAULT '', backdrop_thumbhash TEXT DEFAULT '',
+		logo_path TEXT DEFAULT '', logo_source_path TEXT DEFAULT '',
+		updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(), PRIMARY KEY (content_id, language)
+	);
+	CREATE TABLE media_item_backdrops (content_id TEXT NOT NULL, path TEXT DEFAULT '');
+	CREATE TABLE seasons (
+		content_id TEXT PRIMARY KEY, series_id TEXT NOT NULL,
+		poster_path TEXT DEFAULT '', poster_source_path TEXT DEFAULT '', poster_thumbhash TEXT DEFAULT '',
+		updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+	);
+	CREATE TABLE season_localizations (
+		season_content_id TEXT NOT NULL, language TEXT NOT NULL,
+		poster_path TEXT DEFAULT '', poster_source_path TEXT DEFAULT '', poster_thumbhash TEXT DEFAULT '',
+		updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(), PRIMARY KEY (season_content_id, language)
+	);
+	CREATE TABLE episodes (
+		content_id TEXT PRIMARY KEY, series_id TEXT NOT NULL,
+		still_path TEXT DEFAULT '', still_source_path TEXT DEFAULT '', still_thumbhash TEXT DEFAULT '',
+		updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+	);
+	CREATE TABLE metadata_refresh_debt (
+		target_type TEXT NOT NULL, content_id TEXT NOT NULL,
+		priority INTEGER NOT NULL DEFAULT 0, reason_mask BIGINT NOT NULL DEFAULT 0,
+		next_refresh_at TIMESTAMPTZ NOT NULL, claimed_at TIMESTAMPTZ,
+		lease_expires_at TIMESTAMPTZ, last_attempt_at TIMESTAMPTZ, last_success_at TIMESTAMPTZ,
+		attempt_count INTEGER NOT NULL DEFAULT 0, last_error TEXT NOT NULL DEFAULT '',
+		updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(), PRIMARY KEY (target_type, content_id)
+	)`); err != nil {
+		t.Fatal(err)
+	}
+	return pool
+}
+
+func newTestStoredArtworkReleaser(pool *pgxpool.Pool) *StoredArtworkReleaser {
+	r := NewStoredArtworkReleaser(pool)
+	// Small pages exercise paging; the advisory lock is cluster-wide, and
+	// other tests' passes must not skip this one.
+	r.pageSize = 2
+	r.lock = func(context.Context) (func(), bool, error) { return func() {}, true, nil }
+	return r
+}
+
+// With caching off, a pass points every stored copy of provider artwork on an
+// unlocked movie or series back at its provider source, keeping its
+// thumbhash; copies with no provider source stay and their matched item gets
+// refresh debt (unless refreshed this week); locked items and books are
+// untouched; a second pass changes nothing; and with caching on a pass does
+// nothing.
+func TestStoredArtworkReleaseDB(t *testing.T) {
+	pool := storedArtworkReleaseTestPool(t)
+	ctx := t.Context()
+	exec := func(sql string, args ...any) {
+		t.Helper()
+		if _, err := pool.Exec(ctx, sql, args...); err != nil {
+			t.Fatalf("%s: %v", sql, err)
+		}
+	}
+	const (
+		stored = "tmdb/movies/1/poster/original.r1.webp"
+		source = "tmdb://poster/p.jpg"
+		local  = "local/movies/1/backdrop/original.r1.webp"
+	)
+	exec(`INSERT INTO server_settings VALUES ('metadata.cache_images', 'true')`)
+	// movie-a: stored provider poster, stored local backdrop, never refreshed.
+	exec(`INSERT INTO media_items (content_id, type, poster_path, poster_source_path, poster_thumbhash,
+		backdrop_path, backdrop_source_path, backdrop_thumbhash) VALUES
+		('movie-a', 'movie', $1, $2, 'hash', $3, 'file:///m/a/fanart.jpg?v=1-1', 'bhash')`, stored, source, local)
+	// movie-b: locked artwork; movie-c: an audiobook; movie-d: refreshed today
+	// with a stored local poster; movie-e: extra backdrops only.
+	exec(`INSERT INTO media_items (content_id, type, locked_fields, poster_path, poster_source_path) VALUES
+		('movie-b', 'movie', '{10}', $1, $2), ('book-c', 'audiobook', '{}', $1, $2)`, stored, source)
+	exec(`INSERT INTO media_items (content_id, type, last_refreshed, poster_path, poster_source_path) VALUES
+		('movie-d', 'movie', NOW(), $1, 'file:///m/d/poster.jpg?v=1-1'), ('movie-e', 'movie', NOW() - interval '30 days', '', '')`, local)
+	exec(`INSERT INTO media_item_backdrops VALUES ('movie-e', 'local/x')`)
+	// movie-f: unmatched, with a stored local poster: no provider can help.
+	exec(`INSERT INTO media_items (content_id, type, status, poster_path, poster_source_path) VALUES
+		('movie-f', 'movie', 'unmatched', $1, 'file:///m/f/poster.jpg?v=1-1')`, local)
+	exec(`INSERT INTO media_item_localizations (content_id, language, poster_path, poster_source_path, poster_thumbhash)
+		VALUES ('movie-a', 'fr', $1, 'tmdb://poster/fr.jpg', 'frhash'), ('movie-b', 'fr', $1, 'tmdb://poster/fr.jpg', 'frhash'),
+		('movie-a', 'de', $1, '', 'dehash')`, stored)
+	// movie-g: a storage recovery cleared its logo, which had no source.
+	exec(`INSERT INTO media_items (content_id, type, last_refreshed, poster_path, poster_source_path, backdrop_path, backdrop_source_path)
+		VALUES ('movie-g', 'movie', NULL, 'tmdb://poster/g.jpg', 'tmdb://poster/g.jpg', 'tmdb://backdrop/g.jpg', 'tmdb://backdrop/g.jpg')`)
+	exec(`INSERT INTO media_items (content_id, type) VALUES ('series-s', 'series')`)
+	exec(`INSERT INTO seasons (content_id, series_id, poster_path, poster_source_path) VALUES ('season-1', 'series-s', $1, 'tvdb://s1.jpg')`, stored)
+	exec(`INSERT INTO season_localizations (season_content_id, language, poster_path, poster_source_path) VALUES ('season-1', 'de', $1, 'tvdb://s1de.jpg')`, stored)
+	exec(`INSERT INTO episodes (content_id, series_id, still_path, still_source_path) VALUES
+		('episode-1', 'series-s', $1, 'https://img.example/e1.jpg'), ('episode-2', 'series-s', $1, 'file:///m/s/e2-thumb.jpg?v=1-1')`, stored)
+
+	r := newTestStoredArtworkReleaser(pool)
+	stats, err := r.Run(ctx)
+	if err != nil || stats.Released != 0 || stats.RefreshesQueued != 0 {
+		t.Fatalf("caching on: stats = %+v, err = %v; want nothing done", stats, err)
+	}
+
+	exec(`UPDATE server_settings SET value = 'false'`)
+	stats, err = r.Run(ctx)
+	if err != nil {
+		t.Fatalf("Run: %v", err)
+	}
+	// movie-a, its fr and de localizations, season-1, its de localization,
+	// episode-1.
+	if stats.Released != 6 {
+		t.Errorf("released = %d, want 6", stats.Released)
+	}
+	text := func(sql string, args ...any) string {
+		t.Helper()
+		var v string
+		if err := pool.QueryRow(ctx, sql, args...).Scan(&v); err != nil {
+			t.Fatalf("%s: %v", sql, err)
+		}
+		return v
+	}
+	for name, got := range map[string][2]string{
+		"movie-a poster":        {text(`SELECT poster_path || '|' || poster_thumbhash FROM media_items WHERE content_id = 'movie-a'`), source + "|hash"},
+		"movie-a backdrop":      {text(`SELECT backdrop_path || '|' || backdrop_thumbhash FROM media_items WHERE content_id = 'movie-a'`), local + "|bhash"},
+		"movie-a fr poster":     {text(`SELECT poster_path || '|' || poster_thumbhash FROM media_item_localizations WHERE content_id = 'movie-a' AND language = 'fr'`), "tmdb://poster/fr.jpg|frhash"},
+		"movie-a de poster":     {text(`SELECT poster_path FROM media_item_localizations WHERE content_id = 'movie-a' AND language = 'de'`), ""},
+		"movie-b poster":        {text(`SELECT poster_path FROM media_items WHERE content_id = 'movie-b'`), stored},
+		"movie-b fr poster":     {text(`SELECT poster_path FROM media_item_localizations WHERE content_id = 'movie-b'`), stored},
+		"book-c poster":         {text(`SELECT poster_path FROM media_items WHERE content_id = 'book-c'`), stored},
+		"season-1 poster":       {text(`SELECT poster_path FROM seasons`), "tvdb://s1.jpg"},
+		"season-1 de poster":    {text(`SELECT poster_path FROM season_localizations`), "tvdb://s1de.jpg"},
+		"episode-1 still":       {text(`SELECT still_path FROM episodes WHERE content_id = 'episode-1'`), "https://img.example/e1.jpg"},
+		"episode-2 local still": {text(`SELECT still_path FROM episodes WHERE content_id = 'episode-2'`), stored},
+	} {
+		if got[0] != got[1] {
+			t.Errorf("%s = %q, want %q", name, got[0], got[1])
+		}
+	}
+	// movie-a (local backdrop), movie-e (extra backdrops), movie-g (cleared
+	// logo) and series-s (local still); not movie-d, refreshed today, nor
+	// movie-f, unmatched.
+	debts := text(`SELECT string_agg(content_id || ':' || reason_mask, ',' ORDER BY content_id) FROM metadata_refresh_debt WHERE target_type = 'item'`)
+	if want := "movie-a:64,movie-e:64,movie-g:64,series-s:64"; debts != want {
+		t.Errorf("refresh debt = %q, want %q", debts, want)
+	}
+
+	stats, err = r.Run(ctx)
+	if err != nil || stats.Released != 0 {
+		t.Fatalf("second pass: stats = %+v, err = %v; want nothing released", stats, err)
+	}
+
+	// A copy published after a pass, while caching is back on, stays.
+	exec(`UPDATE server_settings SET value = 'true'`)
+	exec(`UPDATE media_items SET poster_path = $1 WHERE content_id = 'movie-a'`, stored)
+	if _, err := r.Run(ctx); err != nil {
+		t.Fatalf("Run with caching on: %v", err)
+	}
+	if got := text(`SELECT poster_path FROM media_items WHERE content_id = 'movie-a'`); got != stored {
+		t.Errorf("movie-a poster with caching on = %q, want the stored copy kept", got)
+	}
+}
+
+// A release that has to wait for an Edit Metadata selection in progress reads
+// the lock the selection commits, so the selected copy stays.
+func TestStoredArtworkReleaseWaitsForSelectionLockDB(t *testing.T) {
+	pool := storedArtworkReleaseTestPool(t)
+	ctx := t.Context()
+	const selected = "tmdb/movies/1/poster/original.manual.webp"
+	if _, err := pool.Exec(ctx, `INSERT INTO server_settings VALUES ('metadata.cache_images', 'false');
+		INSERT INTO media_items (content_id, type, poster_path, poster_source_path)
+		VALUES ('movie-a', 'movie', 'tmdb/movies/1/poster/original.auto.webp', 'tmdb://poster/auto.jpg')`); err != nil {
+		t.Fatal(err)
+	}
+	// The selection, as PublishArtworkSelection writes it: the target row
+	// first, then the lock, in one transaction.
+	selection, err := pool.Begin(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = selection.Rollback(context.Background()) }()
+	if _, err := selection.Exec(ctx, `SELECT 1 FROM media_items WHERE content_id = 'movie-a' FOR UPDATE`); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := selection.Exec(ctx, `UPDATE media_items SET poster_path = $1, poster_source_path = 'tmdb://poster/manual.jpg',
+		locked_fields = array_append(locked_fields, 10) WHERE content_id = 'movie-a'`, selected); err != nil {
+		t.Fatal(err)
+	}
+
+	r := newTestStoredArtworkReleaser(pool)
+	done := make(chan error, 1)
+	go func() {
+		_, err := r.releasePage(context.Background(), storedArtworkReleaseTables()[0], []string{"movie-a"})
+		done <- err
+	}()
+	// Wait until the release is blocked on the selection's row lock.
+	for {
+		var waiting bool
+		if err := pool.QueryRow(ctx, `SELECT EXISTS (SELECT 1 FROM pg_stat_activity
+			WHERE datname = current_database() AND wait_event_type = 'Lock' AND query LIKE '%media_items t %')`).Scan(&waiting); err != nil {
+			t.Fatal(err)
+		}
+		if waiting {
+			break
+		}
+		select {
+		case err := <-done:
+			t.Fatalf("release finished before the selection committed: %v", err)
+		case <-time.After(10 * time.Millisecond):
+		}
+	}
+	if err := selection.Commit(ctx); err != nil {
+		t.Fatal(err)
+	}
+	if err := <-done; err != nil {
+		t.Fatalf("releasePage: %v", err)
+	}
+	var got string
+	if err := pool.QueryRow(ctx, `SELECT poster_path FROM media_items WHERE content_id = 'movie-a'`).Scan(&got); err != nil {
+		t.Fatal(err)
+	}
+	if got != selected {
+		t.Fatalf("poster = %q, want the locked selection %q kept", got, selected)
+	}
+}
diff --git a/internal/metadata/artwork_storage_sweep.go b/internal/metadata/artwork_storage_sweep.go
index e1c49e910e..c32829248b 100644
--- a/internal/metadata/artwork_storage_sweep.go
+++ b/internal/metadata/artwork_storage_sweep.go
@@ -358,6 +358,12 @@ func (s *ArtworkStorageSweeper) SweepPrefix(ctx context.Context, prefix, token s
 			deleted, delErr := s.store.Delete(ctx, doomed)
 			stats.Deleted += deleted
 			if delErr != nil {
+				// Move the cursor past this page anyway. The objects stay
+				// unreferenced, so the next pass over this prefix retries them;
+				// resuming at this page would fail on the same objects every
+				// run and never reach the rest of the prefix or the ones after.
+				stats.NextToken = next
+				stats.PrefixDone = next == ""
 				return stats, fmt.Errorf("artwork storage sweep: delete: %w", delErr)
 			}
 			if deleted != len(doomed) {
diff --git a/internal/metadata/artwork_storage_sweep_test.go b/internal/metadata/artwork_storage_sweep_test.go
index 6912318c10..14440f33dd 100644
--- a/internal/metadata/artwork_storage_sweep_test.go
+++ b/internal/metadata/artwork_storage_sweep_test.go
@@ -90,13 +90,17 @@ func TestArtworkSweepAnomalyGuardThresholds(t *testing.T) {
 // fakeArtworkStorage records what the sweep asked it to delete so the
 // destructive path can be asserted rather than inferred.
 type fakeArtworkStorage struct {
-	pages   [][]blobstore.ObjectInfo
-	tokens  []string
-	deleted []string
-	calls   int
+	pages     [][]blobstore.ObjectInfo
+	tokens    []string
+	deleted   []string
+	calls     int
+	deleteErr error
 }
 
 func (f *fakeArtworkStorage) Delete(_ context.Context, keys []string) (int, error) {
+	if f.deleteErr != nil {
+		return 0, f.deleteErr
+	}
 	f.deleted = append(f.deleted, keys...)
 	return len(keys), nil
 }
@@ -420,3 +424,25 @@ func TestSweepConsultsTheGCScheduleOnlyForLopsidedPages(t *testing.T) {
 		t.Fatalf("deleted %d, left_to_gc %d; want 50 and 0", len(storage.deleted), stats.LeftToGC)
 	}
 }
+
+// An object the store keeps refusing to delete must not pin the cursor: the
+// task resumes at NextToken, so a cursor left at the failing page would fail
+// there on every run and never sweep the rest of the prefix.
+func TestSweepMovesPastAPageWhoseDeleteFails(t *testing.T) {
+	t.Parallel()
+	storage := &fakeArtworkStorage{
+		pages: [][]blobstore.ObjectInfo{
+			ageingObjects("local", 4, 72*time.Hour),
+			ageingObjects("local", 4, 72*time.Hour),
+		},
+		tokens:    []string{"t1", ""},
+		deleteErr: errors.New("access denied"),
+	}
+	stats, err := sweepWithoutDatabase(t, storage, map[string]struct{}{}, 2)
+	if err == nil {
+		t.Fatal("a failed delete must be reported")
+	}
+	if stats.NextToken != "t1" || stats.PrefixDone {
+		t.Fatalf("next token = %q, prefix done = %v; want the page after the failed one", stats.NextToken, stats.PrefixDone)
+	}
+}
diff --git a/internal/metadata/episode_completeness.go b/internal/metadata/episode_completeness.go
index ff0df74a1b..1a49529869 100644
--- a/internal/metadata/episode_completeness.go
+++ b/internal/metadata/episode_completeness.go
@@ -1,36 +1,15 @@
 package metadata
 
 import (
-	"regexp"
 	"strings"
 	"time"
 
 	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/titleutil"
 )
 
 const EpisodeRecentStillWindow = 45 * 24 * time.Hour
 
-var (
-	episodePlaceholderTitlePattern = regexp.MustCompile(`(?i)^(tba|tbd|episode\s+\d+)$`)
-	episodeProvisionalTitlePattern = regexp.MustCompile(`(?i)^(tba|tbd)$`)
-)
-
-func IsEpisodePlaceholderTitle(title string) bool {
-	title = strings.TrimSpace(title)
-	if title == "" {
-		return false
-	}
-	return episodePlaceholderTitlePattern.MatchString(title)
-}
-
-func isEpisodeProvisionalTitle(title string) bool {
-	title = strings.TrimSpace(title)
-	if title == "" {
-		return false
-	}
-	return episodeProvisionalTitlePattern.MatchString(title)
-}
-
 func episodeHasProviderMatch(ep *models.Episode) bool {
 	if ep == nil || strings.EqualFold(strings.TrimSpace(ep.MetadataSource), "scanner_fallback") {
 		return false
@@ -40,30 +19,6 @@ func episodeHasProviderMatch(ep *models.Episode) bool {
 		strings.TrimSpace(ep.ImdbID) != ""
 }
 
-func EpisodeHasIncompleteMetadata(ep *models.Episode, now time.Time) bool {
-	if ep == nil {
-		return false
-	}
-	if strings.TrimSpace(ep.Title) == "" {
-		return true
-	}
-	if IsEpisodePlaceholderTitle(ep.Title) {
-		return true
-	}
-	if strings.TrimSpace(ep.Overview) == "" {
-		return true
-	}
-	if strings.EqualFold(strings.TrimSpace(ep.MetadataSource), "scanner_fallback") {
-		return true
-	}
-	if ep.AirDate != nil &&
-		!ep.AirDate.Before(now.Add(-EpisodeRecentStillWindow)) &&
-		strings.TrimSpace(ep.StillPath) == "" {
-		return true
-	}
-	return false
-}
-
 // EpisodeHasActionableMetadataDebt returns true when another provider refresh
 // can reasonably be expected to improve the episode metadata.
 func EpisodeHasActionableMetadataDebt(ep *models.Episode, now time.Time) bool {
@@ -79,12 +34,13 @@ func EpisodeHasActionableMetadataDebt(ep *models.Episode, now time.Time) bool {
 	if !episodeHasProviderMatch(ep) {
 		return true
 	}
-	if isEpisodeProvisionalTitle(ep.Title) {
+	recentOrUndated := ep.AirDate == nil || !ep.AirDate.Before(now.Add(-EpisodeRecentStillWindow))
+	// "TBA"/"TBD" is only a likely placeholder while the episode is undated or
+	// recent; an older provider-matched episode can genuinely carry that title.
+	if recentOrUndated && titleutil.IsProvisionalEpisodeTitle(ep.Title) {
 		return true
 	}
-	if ep.AirDate != nil &&
-		!ep.AirDate.Before(now.Add(-EpisodeRecentStillWindow)) &&
-		strings.TrimSpace(ep.StillPath) == "" {
+	if ep.AirDate != nil && recentOrUndated && strings.TrimSpace(ep.StillPath) == "" {
 		return true
 	}
 	return false
diff --git a/internal/metadata/episode_completeness_test.go b/internal/metadata/episode_completeness_test.go
index da5c861c81..7866412000 100644
--- a/internal/metadata/episode_completeness_test.go
+++ b/internal/metadata/episode_completeness_test.go
@@ -7,57 +7,6 @@ import (
 	"github.com/prairie-server/prairie-server/internal/models"
 )
 
-func TestIsEpisodePlaceholderTitle(t *testing.T) {
-	cases := map[string]bool{
-		"":           false,
-		"Pilot":      false,
-		"TBA":        true,
-		"tbd":        true,
-		"Episode 12": true,
-	}
-
-	for title, want := range cases {
-		if got := IsEpisodePlaceholderTitle(title); got != want {
-			t.Fatalf("title %q placeholder=%v want %v", title, got, want)
-		}
-	}
-}
-
-func TestEpisodeHasIncompleteMetadata(t *testing.T) {
-	now := time.Date(2026, 4, 14, 12, 0, 0, 0, time.UTC)
-
-	complete := &models.Episode{
-		Title:          "Pilot",
-		Overview:       "Overview",
-		StillPath:      "s3://still.jpg",
-		MetadataSource: "provider",
-	}
-	if EpisodeHasIncompleteMetadata(complete, now) {
-		t.Fatal("expected complete episode to be treated as complete")
-	}
-
-	recent := now.Add(-7 * 24 * time.Hour)
-	incomplete := &models.Episode{
-		Title:          "Episode 2",
-		Overview:       "",
-		AirDate:        &recent,
-		MetadataSource: "scanner_fallback",
-	}
-	if !EpisodeHasIncompleteMetadata(incomplete, now) {
-		t.Fatal("expected fallback placeholder episode to be treated as incomplete")
-	}
-
-	providerNumbered := &models.Episode{
-		Title:          "Episode 1",
-		Overview:       "Provider overview",
-		TmdbID:         "3812334",
-		MetadataSource: "provider",
-	}
-	if !EpisodeHasIncompleteMetadata(providerNumbered, now) {
-		t.Fatal("expected provider numbered title to remain quality-incomplete")
-	}
-}
-
 func TestEpisodeHasActionableMetadataDebt(t *testing.T) {
 	now := time.Date(2026, 4, 14, 12, 0, 0, 0, time.UTC)
 	recent := now.Add(-7 * 24 * time.Hour)
@@ -96,6 +45,49 @@ func TestEpisodeHasActionableMetadataDebt(t *testing.T) {
 			},
 			want: true,
 		},
+		{
+			name: "old provider episode with real TBD title",
+			ep: &models.Episode{
+				Title:          "TBD",
+				Overview:       "Provider overview",
+				TmdbID:         "3812334",
+				StillPath:      "s3://still.jpg",
+				AirDate:        &old,
+				MetadataSource: "provider",
+			},
+			want: false,
+		},
+		{
+			name: "old provider episode with lowercase tba title",
+			ep: &models.Episode{
+				Title:          "tba",
+				TmdbID:         "3812334",
+				AirDate:        &old,
+				MetadataSource: "provider",
+			},
+			want: false,
+		},
+		{
+			name: "recent provider TBD episode",
+			ep: &models.Episode{
+				Title:          "TBD",
+				TmdbID:         "3812334",
+				StillPath:      "s3://still.jpg",
+				AirDate:        &recent,
+				MetadataSource: "provider",
+			},
+			want: true,
+		},
+		{
+			name: "old scanner fallback TBD title",
+			ep: &models.Episode{
+				Title:          "TBD",
+				TmdbID:         "3812334",
+				AirDate:        &old,
+				MetadataSource: "scanner_fallback",
+			},
+			want: true,
+		},
 		{
 			name: "scanner fallback numbered title",
 			ep: &models.Episode{
diff --git a/internal/metadata/export_test.go b/internal/metadata/export_test.go
new file mode 100644
index 0000000000..1c6d408d1d
--- /dev/null
+++ b/internal/metadata/export_test.go
@@ -0,0 +1,13 @@
+package metadata
+
+import "context"
+
+// MatchWithProvidersForTest makes Process match against providers instead of
+// the installed plugin chain, so tests outside the package can run the real
+// scan and match path with stub providers.
+func MatchWithProvidersForTest(s *MetadataService, language string, providers ...Provider) {
+	s.hooks.process = func(ctx context.Context, req ProcessRequest) (*ProcessResult, error) {
+		req.Language = language
+		return s.ProcessWithProviders(ctx, req, providers)
+	}
+}
diff --git a/internal/metadata/fallback_unification_test.go b/internal/metadata/fallback_unification_test.go
index 077d9149ed..889a60df66 100644
--- a/internal/metadata/fallback_unification_test.go
+++ b/internal/metadata/fallback_unification_test.go
@@ -941,7 +941,7 @@ func TestBuildItemLocalizationRecord_PreservesExistingWhenRefreshIsBlank(t *test
 		LogoPath:          "s3://logo.png",
 	}
 
-	loc := buildItemLocalizationRecord(existing, "series-1", "fr", "series", &MetadataResult{}, nil, MergeReplaceUnlocked, "fr", false)
+	loc := buildItemLocalizationRecord(existing, "series-1", "fr", "series", &MetadataResult{}, nil, MergeReplaceUnlocked, "fr", false, true)
 
 	if *loc != *existing {
 		t.Fatalf("localization = %#v, want %#v", loc, existing)
@@ -958,7 +958,7 @@ func TestBuildSeasonLocalizationRecord_PreservesExistingPosterOnBlankRefresh(t *
 		PosterThumbhash: "season-thumb",
 	}
 
-	loc := buildSeasonLocalizationRecord(existing, "season-1", "fr", SeasonResult{}, MergeReplaceUnlocked)
+	loc := buildSeasonLocalizationRecord(existing, "season-1", "fr", SeasonResult{}, MergeReplaceUnlocked, true)
 
 	if *loc != *existing {
 		t.Fatalf("localization = %#v, want %#v", loc, existing)
@@ -1110,3 +1110,46 @@ func TestPersonRefreshWithProviders_RefreshesWhenAttemptWriteFails(t *testing.T)
 		t.Fatalf("bio = %q, want %q", person.Bio, "Refreshed anyway")
 	}
 }
+
+// A refresh must not carry AI text forward: the provider upsert would label
+// it provider. Blank AI fields go out empty, which keeps the stored AI text
+// and source; provider text replaces AI text in either merge mode.
+func TestBuildLocalizationRecordsDoNotCarryAITextForward(t *testing.T) {
+	for _, mode := range []MergeMode{MergeFillEmpty, MergeReplaceUnlocked} {
+		season := buildSeasonLocalizationRecord(&models.SeasonLocalization{
+			Overview: "Apercu IA", OverviewSource: models.LocalizationSourceAI,
+		}, "season-1", "fr", SeasonResult{}, mode, true)
+
+		if season.Overview != "" {
+			t.Errorf("mode %v: season overview = %q, want empty", mode, season.Overview)
+		}
+
+		episode := buildEpisodeLocalizationRecord(&models.EpisodeLocalization{
+			Overview: "Apercu IA", OverviewSource: models.LocalizationSourceAI,
+		}, "episode-1", "fr", EpisodeResult{Overview: "Apercu fournisseur"}, mode)
+		if episode.Overview != "Apercu fournisseur" {
+			t.Errorf("mode %v: episode overview = %q, want provider overview", mode, episode.Overview)
+		}
+
+		kept := buildEpisodeLocalizationRecord(&models.EpisodeLocalization{
+			Overview: "Saisi", OverviewSource: models.LocalizationSourceManual,
+		}, "episode-1", "fr", EpisodeResult{}, mode)
+		if kept.Overview != "Saisi" {
+			t.Errorf("mode %v: manual overview = %q, want it carried forward", mode, kept.Overview)
+		}
+	}
+}
+
+// A refresh in a non-canonical language hands the item builder the
+// canonical-language result, so a scheduled refresh must keep the stored AI
+// translation rather than fill it with canonical text.
+func TestBuildItemLocalizationRecordKeepsAITextOnFillEmptyRefresh(t *testing.T) {
+	item := buildItemLocalizationRecord(&models.MediaItemLocalization{
+		Overview: "Apercu IA", OverviewSource: models.LocalizationSourceAI,
+		Tagline: "Phrase IA", TaglineSource: models.LocalizationSourceAI,
+	}, "series-1", "fr", "series", &MetadataResult{Overview: "English overview", Tagline: "English tagline"}, nil, MergeFillEmpty, "fr", false, true)
+
+	if item.Overview != "Apercu IA" || item.Tagline != "Phrase IA" {
+		t.Fatalf("overview/tagline = %q/%q, want the AI translation kept", item.Overview, item.Tagline)
+	}
+}
diff --git a/internal/metadata/identify_series_reanchor_db_test.go b/internal/metadata/identify_series_reanchor_db_test.go
index ad93400411..3148839973 100644
--- a/internal/metadata/identify_series_reanchor_db_test.go
+++ b/internal/metadata/identify_series_reanchor_db_test.go
@@ -181,6 +181,9 @@ func TestIdentify_CorrectedSeriesMovesWithItsChildren(t *testing.T) {
 		progress[id] = position
 	}
 	rows.Close()
+	if err := rows.Err(); err != nil {
+		t.Fatal(err)
+	}
 	if want := map[string]float64{newEpisode1: 500, newEpisode4: 900}; fmt.Sprint(progress) != fmt.Sprint(want) {
 		t.Errorf("progress = %v, want %v", progress, want)
 	}
@@ -297,6 +300,9 @@ func TestIdentify_CorrectionOntoExistingSeriesMovesUnpairedEpisodeState(t *testi
 		progress[id] = position
 	}
 	rows.Close()
+	if err := rows.Err(); err != nil {
+		t.Fatal(err)
+	}
 	if want := map[string]float64{newPaired: 100, newUnpaired: 200}; fmt.Sprint(progress) != fmt.Sprint(want) {
 		t.Errorf("progress = %v, want %v", progress, want)
 	}
diff --git a/internal/metadata/identify_sticky_db_test.go b/internal/metadata/identify_sticky_db_test.go
index b9fa1e89d7..867e4ca06f 100644
--- a/internal/metadata/identify_sticky_db_test.go
+++ b/internal/metadata/identify_sticky_db_test.go
@@ -165,12 +165,11 @@ func TestIdentifyRenameLeavesTheMarkToTheIdentityWritePostgres(t *testing.T) {
 // owns the chosen IDs, and only on it: the generic merge may keep the item
 // being identified, which still has its old IDs.
 func TestIdentifyConflictMergeMarksTheSurvivorPostgres(t *testing.T) {
-	t.Skip("duplicate merges fail at the personal collection step until #2299 is fixed")
 	pool := chainBuiltinTestPool(t)
 	ctx := context.Background()
 	t.Run("into the owner", func(t *testing.T) {
 		checkIdentifyMoveMarks(t, pool, true, func(from, to, _ string, markIdentity bool) error {
-			_, err := canonicalizeProviderIDDuplicateInto(ctx, pool, from, to, true, markIdentity)
+			_, err := canonicalizeProviderIDDuplicateInto(ctx, pool, nil, from, to, true, markIdentity)
 			return err
 		})
 	})
@@ -185,7 +184,7 @@ func TestIdentifyConflictMergeMarksTheSurvivorPostgres(t *testing.T) {
 				t.Fatalf("seed %s: %v", id, err)
 			}
 		}
-		survivor, err := canonicalizeProviderIDDuplicate(ctx, pool, from, to, true, true)
+		survivor, err := canonicalizeProviderIDDuplicate(ctx, pool, nil, from, to, true, true)
 		if err != nil {
 			t.Fatalf("merge: %v", err)
 		}
diff --git a/internal/metadata/image_cache_enqueue_test.go b/internal/metadata/image_cache_enqueue_test.go
index 5748d4cda6..97b6aedce6 100644
--- a/internal/metadata/image_cache_enqueue_test.go
+++ b/internal/metadata/image_cache_enqueue_test.go
@@ -28,8 +28,8 @@ func TestPreserveCachedArtworkKeepsCachedPathWhenSourceMatches(t *testing.T) {
 		"",
 		"tvdb/series/1/seasons/1/episodes/1/still/original.webp",
 		"tvdb://banners/episodes/1.jpg",
-		"thumb",
-	)
+		"thumb", true)
+
 	if path != "tvdb/series/1/seasons/1/episodes/1/still/original.webp" {
 		t.Fatalf("path = %q", path)
 	}
@@ -41,6 +41,20 @@ func TestPreserveCachedArtworkKeepsCachedPathWhenSourceMatches(t *testing.T) {
 	}
 }
 
+// With caching off and the artwork unlocked (keepStored false), a provider
+// path replaces a stored copy; with nothing offered the slot keeps it.
+func TestPreserveCachedArtworkReleasesStoredCopyWhenNotKept(t *testing.T) {
+	const stored = "tvdb/series/1/seasons/1/episodes/1/still/original.webp"
+	path, thumb, source := preserveCachedArtwork("tvdb://banners/episodes/2.jpg", "new", stored, "tvdb://banners/episodes/1.jpg", "old", false)
+	if path != "tvdb://banners/episodes/2.jpg" || thumb != "new" || source != path {
+		t.Fatalf("got %q/%q/%q, want the provider path served", path, thumb, source)
+	}
+	path, thumb, source = preserveCachedArtwork("", "", stored, "file:///m/thumb.jpg", "old", false)
+	if path != stored || thumb != "old" || source != "file:///m/thumb.jpg" {
+		t.Fatalf("got %q/%q/%q, want the stored copy kept when nothing is offered", path, thumb, source)
+	}
+}
+
 func TestPersistSeasonsAndEpisodesPersistsSourceBeforeEnqueue(t *testing.T) {
 	const seriesID = "series-tvdb-123"
 	service, _, seasonRepo, episodeRepo := newSeasonEpisodeServiceForTest(seriesID)
@@ -106,8 +120,8 @@ func TestPreserveCachedArtworkRecordsNewProviderSource(t *testing.T) {
 		"",
 		"tvdb/series/1/seasons/1/episodes/1/still/original.webp",
 		"tvdb://banners/episodes/old.jpg",
-		"old-thumb",
-	)
+		"old-thumb", true)
+
 	if path != "tvdb/series/1/seasons/1/episodes/1/still/original.webp" {
 		t.Fatalf("cached path should remain visible until worker succeeds, got %q", path)
 	}
diff --git a/internal/metadata/image_cache_job_repo.go b/internal/metadata/image_cache_job_repo.go
index 416af56d6f..bba69894e9 100644
--- a/internal/metadata/image_cache_job_repo.go
+++ b/internal/metadata/image_cache_job_repo.go
@@ -521,10 +521,10 @@ func (r *ImageCacheJobRepository) ClaimDue(ctx context.Context, workerID string,
 	if err := r.recoverExpiredRunning(ctx, ""); err != nil {
 		return nil, err
 	}
-	return r.claimDue(ctx, workerID, "", false, limit)
+	return r.claimDue(ctx, workerID, "", limit)
 }
 
-func (r *ImageCacheJobRepository) retryTargetNow(ctx context.Context, targetContentID string, localOnly bool) error {
+func (r *ImageCacheJobRepository) retryTargetNow(ctx context.Context, targetContentID string) error {
 	if r == nil || r.pool == nil {
 		return nil
 	}
@@ -558,9 +558,6 @@ func (r *ImageCacheJobRepository) retryTargetNow(ctx context.Context, targetCont
 		  AND status IN ('queued', 'failed')
 		  AND (status = 'failed' OR next_attempt_at > NOW() OR starts_with(last_error, $2))
 		  AND NOT ` + heldLocalDiscoverySQL
-	if localOnly {
-		query += " AND " + localImageCacheSourceSQL
-	}
 	_, err := r.pool.Exec(ctx, query, targetContentID, localImageStorageUnavailable)
 	if err != nil {
 		return fmt.Errorf("retrying target metadata image cache jobs: %w", err)
@@ -568,15 +565,15 @@ func (r *ImageCacheJobRepository) retryTargetNow(ctx context.Context, targetCont
 	return nil
 }
 
-func (r *ImageCacheJobRepository) claimDueForTarget(ctx context.Context, workerID, targetContentID string, localOnly bool, limit int) ([]*models.MetadataImageCacheJob, error) {
+func (r *ImageCacheJobRepository) claimDueForTarget(ctx context.Context, workerID, targetContentID string, limit int) ([]*models.MetadataImageCacheJob, error) {
 	targetContentID = strings.TrimSpace(targetContentID)
 	if targetContentID == "" {
 		return nil, nil
 	}
-	return r.claimDue(ctx, workerID, targetContentID, localOnly, limit)
+	return r.claimDue(ctx, workerID, targetContentID, limit)
 }
 
-func (r *ImageCacheJobRepository) targetHasRunningJobs(ctx context.Context, targetContentID string, localOnly bool) (bool, error) {
+func (r *ImageCacheJobRepository) targetHasRunningJobs(ctx context.Context, targetContentID string) (bool, error) {
 	if r == nil || r.pool == nil {
 		return false, nil
 	}
@@ -590,9 +587,6 @@ func (r *ImageCacheJobRepository) targetHasRunningJobs(ctx context.Context, targ
 			FROM metadata_image_cache_jobs
 			WHERE ` + imageCacheTargetScope("$1") + `
 			  AND status = 'running'`
-	if localOnly {
-		query += " AND " + localImageCacheSourceSQL
-	}
 	var running bool
 	if err := r.pool.QueryRow(ctx, query+")", targetContentID).Scan(&running); err != nil {
 		return false, fmt.Errorf("checking running metadata image cache jobs: %w", err)
@@ -600,9 +594,8 @@ func (r *ImageCacheJobRepository) targetHasRunningJobs(ctx context.Context, targ
 	return running, nil
 }
 
-// claimDue claims due queued jobs, optionally only those for one target scope
-// and only local file:// sources.
-func (r *ImageCacheJobRepository) claimDue(ctx context.Context, workerID, targetContentID string, localOnly bool, limit int) ([]*models.MetadataImageCacheJob, error) {
+// claimDue claims due queued jobs, optionally only those for one target scope.
+func (r *ImageCacheJobRepository) claimDue(ctx context.Context, workerID, targetContentID string, limit int) ([]*models.MetadataImageCacheJob, error) {
 	if r == nil || r.pool == nil || limit <= 0 {
 		return nil, nil
 	}
@@ -610,7 +603,7 @@ func (r *ImageCacheJobRepository) claimDue(ctx context.Context, workerID, target
 	if targetContentID != "" {
 		args = append(args, targetContentID)
 	}
-	rows, err := r.pool.Query(ctx, claimDueQuery(targetContentID != "", localOnly), args...)
+	rows, err := r.pool.Query(ctx, claimDueQuery(targetContentID != ""), args...)
 	if err != nil {
 		return nil, fmt.Errorf("claiming metadata image cache jobs: %w", err)
 	}
@@ -619,7 +612,7 @@ func (r *ImageCacheJobRepository) claimDue(ctx context.Context, workerID, target
 
 // claimDueQuery claims up to $1 due jobs for worker $2, within target scope
 // $3 when targeted.
-func claimDueQuery(targeted, localOnly bool) string {
+func claimDueQuery(targeted bool) string {
 	due := "next_attempt_at <= NOW()"
 	if targeted {
 		// A refresh's own discoveries are its to copy now, hold or not.
@@ -635,9 +628,6 @@ func claimDueQuery(targeted, localOnly bool) string {
 	if targeted {
 		query += " AND " + imageCacheTargetScope("$3")
 	}
-	if localOnly {
-		query += " AND " + localImageCacheSourceSQL
-	}
 	return query + `
 			ORDER BY next_attempt_at ASC, id ASC
 			LIMIT $1
@@ -1285,14 +1275,16 @@ func ladderMissingRungSQL(pathColumn, rungPattern string) string {
 // ladderCandidateRowsSQL is the set of cached artwork still missing the rung its
 // image type gained at the current artworkkey.LadderVersion.
 //
-// Only poster, still, and logo appear: those are the types whose ladder changed.
-// Re-downloading backdrops and headshots would spend the same bandwidth to
-// produce byte-identical objects. Revisit this list together with
-// artworkkey.VariantWidths and ladderTypesWithAddedRung.
+// Only poster, still, backdrop, and logo appear: those are the types whose
+// ladder has changed. Re-downloading headshots and the extended item artwork
+// would spend the same bandwidth to produce byte-identical rungs. Revisit this
+// list together with artworkkey.VariantWidths and ladderTypesWithAddedRung.
 func ladderCandidateRowsSQL() string {
 	return strings.NewReplacer(
 		"@recachableSchemes", ladderRecachableSchemesSQL,
-		"@wideRung", ladderRungLiteral(ImageCacheImagePoster),
+		"@posterRung", ladderRungLiteral(ImageCacheImagePoster),
+		"@stillRung", ladderRungLiteral(ImageCacheImageStill),
+		"@backdropRung", ladderRungLiteral(ImageCacheImageBackdrop),
 		"@logoRung", ladderRungLiteral(ImageCacheImageLogo),
 	).Replace(`
 			SELECT
@@ -1313,7 +1305,7 @@ func ladderCandidateRowsSQL() string {
 			  AND lower(mi.poster_source_path) NOT LIKE ALL (@recachableSchemes)
 			  AND coalesce(mi.poster_path, '') <> ''
 			  AND mi.poster_path NOT LIKE '%://%'
-			  AND ` + ladderMissingRungSQL("mi.poster_path", "@wideRung") + `
+			  AND ` + ladderMissingRungSQL("mi.poster_path", "@posterRung") + `
 			UNION ALL
 			SELECT
 				'logo'::text,
@@ -1354,7 +1346,7 @@ func ladderCandidateRowsSQL() string {
 			  AND lower(loc.poster_source_path) NOT LIKE ALL (@recachableSchemes)
 			  AND coalesce(loc.poster_path, '') <> ''
 			  AND loc.poster_path NOT LIKE '%://%'
-			  AND ` + ladderMissingRungSQL("loc.poster_path", "@wideRung") + `
+			  AND ` + ladderMissingRungSQL("loc.poster_path", "@posterRung") + `
 			UNION ALL
 			SELECT
 				'logo'::text,
@@ -1396,7 +1388,7 @@ func ladderCandidateRowsSQL() string {
 			  AND lower(s.poster_source_path) NOT LIKE ALL (@recachableSchemes)
 			  AND coalesce(s.poster_path, '') <> ''
 			  AND s.poster_path NOT LIKE '%://%'
-			  AND ` + ladderMissingRungSQL("s.poster_path", "@wideRung") + `
+			  AND ` + ladderMissingRungSQL("s.poster_path", "@posterRung") + `
 			UNION ALL
 			SELECT
 				'poster'::text,
@@ -1418,7 +1410,7 @@ func ladderCandidateRowsSQL() string {
 			  AND lower(loc.poster_source_path) NOT LIKE ALL (@recachableSchemes)
 			  AND coalesce(loc.poster_path, '') <> ''
 			  AND loc.poster_path NOT LIKE '%://%'
-			  AND ` + ladderMissingRungSQL("loc.poster_path", "@wideRung") + `
+			  AND ` + ladderMissingRungSQL("loc.poster_path", "@posterRung") + `
 			UNION ALL
 			SELECT
 				'still'::text,
@@ -1439,7 +1431,69 @@ func ladderCandidateRowsSQL() string {
 			  AND lower(e.still_source_path) NOT LIKE ALL (@recachableSchemes)
 			  AND coalesce(e.still_path, '') <> ''
 			  AND e.still_path NOT LIKE '%://%'
-			  AND ` + ladderMissingRungSQL("e.still_path", "@wideRung") + `
+			  AND ` + ladderMissingRungSQL("e.still_path", "@stillRung") + `
+			UNION ALL
+			SELECT
+				'backdrop'::text,
+				'item'::text,
+				mi.content_id,
+				''::text,
+				mi.content_id,
+				mi.backdrop_source_path,
+				mi.type,
+				NULL::integer,
+				NULL::integer,
+				mi.tmdb_id,
+				mi.tvdb_id,
+				mi.imdb_id
+			FROM media_items mi
+			WHERE mi.backdrop_source_path LIKE '%://%'
+			  AND lower(mi.backdrop_source_path) NOT LIKE ALL (@recachableSchemes)
+			  AND coalesce(mi.backdrop_path, '') <> ''
+			  AND mi.backdrop_path NOT LIKE '%://%'
+			  AND ` + ladderMissingRungSQL("mi.backdrop_path", "@backdropRung") + `
+			UNION ALL
+			SELECT
+				'backdrop'::text,
+				'item_localization'::text,
+				loc.content_id,
+				loc.language,
+				loc.content_id,
+				loc.backdrop_source_path,
+				mi.type,
+				NULL::integer,
+				NULL::integer,
+				mi.tmdb_id,
+				mi.tvdb_id,
+				mi.imdb_id
+			FROM media_item_localizations loc
+			JOIN media_items mi ON mi.content_id = loc.content_id
+			WHERE loc.backdrop_source_path LIKE '%://%'
+			  AND lower(loc.backdrop_source_path) NOT LIKE ALL (@recachableSchemes)
+			  AND coalesce(loc.backdrop_path, '') <> ''
+			  AND loc.backdrop_path NOT LIKE '%://%'
+			  AND ` + ladderMissingRungSQL("loc.backdrop_path", "@backdropRung") + `
+			UNION ALL
+			SELECT
+				'backdrop'::text,
+				'item_backdrop'::text,
+				b.id::text,
+				''::text,
+				b.content_id,
+				b.source_path,
+				mi.type,
+				NULL::integer,
+				NULL::integer,
+				mi.tmdb_id,
+				mi.tvdb_id,
+				mi.imdb_id
+			FROM media_item_backdrops b
+			JOIN media_items mi ON mi.content_id = b.content_id
+			WHERE b.source_path LIKE '%://%'
+			  AND lower(b.source_path) NOT LIKE ALL (@recachableSchemes)
+			  AND coalesce(b.path, '') <> ''
+			  AND b.path NOT LIKE '%://%'
+			  AND ` + ladderMissingRungSQL("b.path", "@backdropRung") + `
 `)
 }
 
diff --git a/internal/metadata/image_cache_local_jobs.go b/internal/metadata/image_cache_local_jobs.go
index 23da293900..3b8d8b90d8 100644
--- a/internal/metadata/image_cache_local_jobs.go
+++ b/internal/metadata/image_cache_local_jobs.go
@@ -16,8 +16,7 @@ import (
 
 const (
 	// localImageCacheSourceSQL matches jobs whose source is a local sidecar
-	// file (LocalImageSourceURL writes the scheme in lower case). It matches
-	// the predicate of metadata_image_cache_jobs_local_due_idx.
+	// file (LocalImageSourceURL writes the scheme in lower case).
 	localImageCacheSourceSQL = "source_path LIKE 'file://%'"
 
 	// heldLocalDiscoverySQL matches a local job queued by a discovery and not
@@ -45,19 +44,6 @@ const (
 	localImageStorageUnavailable = "local image storage not mounted on this server"
 )
 
-// ClaimDueLocal claims due jobs with local file:// sources only. Draining uses
-// it while metadata.cache_images is off: that setting stops remote downloads,
-// but local art is always copied.
-func (r *ImageCacheJobRepository) ClaimDueLocal(ctx context.Context, workerID string, limit int) ([]*models.MetadataImageCacheJob, error) {
-	if r == nil || r.pool == nil || limit <= 0 {
-		return nil, nil
-	}
-	if err := r.recoverExpiredRunning(ctx, ""); err != nil {
-		return nil, err
-	}
-	return r.claimDue(ctx, workerID, "", true, limit)
-}
-
 // enqueueHeldLocalJobs queues discovered local artwork behind
 // localArtworkDiscoveryHold, so background drains on other servers leave it to
 // the discovering process (claimQueuedLocalJob ignores the hold). It returns
@@ -167,6 +153,10 @@ func (r *ImageCacheJobRepository) targetHasDeferredLocalJobs(ctx context.Context
 // local artwork for its discovering process.
 var errNoLocalArtworkQueue = errors.New("metadata image cache does not support local artwork discovery")
 
+// errLocalArtworkCachingOff refuses a discovery copy while
+// metadata.cache_images is off.
+var errLocalArtworkCachingOff = errors.New("metadata image caching is off")
+
 // localArtworkJobStore is the queue surface the local artwork copier needs.
 // ImageCacheJobRepository implements it; lightweight fakes may not.
 type localArtworkJobStore interface {
@@ -180,15 +170,8 @@ type imageCacheJobDeferrer interface {
 	DeferClaimed(ctx context.Context, id int64, lockedBy string, errText string, delay, repeatDelay time.Duration) error
 }
 
-// localImageCacheJobClaimer is implemented by job stores that can claim only
-// local jobs, which draining uses while remote caching is off.
-type localImageCacheJobClaimer interface {
-	ClaimDueLocal(ctx context.Context, workerID string, limit int) ([]*models.MetadataImageCacheJob, error)
-}
-
 // isLocalSidecarSource reports whether source names a sidecar file (file://):
-// the artwork copied on discovery, and whatever metadata.cache_images says.
-// It matches localImageCacheSourceSQL.
+// the artwork copied on discovery. It matches localImageCacheSourceSQL.
 func isLocalSidecarSource(source string) bool {
 	return strings.HasPrefix(strings.TrimSpace(source), "file://")
 }
diff --git a/internal/metadata/image_cache_processor.go b/internal/metadata/image_cache_processor.go
index fd5e489ecf..ac5f511657 100644
--- a/internal/metadata/image_cache_processor.go
+++ b/internal/metadata/image_cache_processor.go
@@ -1,6 +1,7 @@
 package metadata
 
 import (
+	"cmp"
 	"context"
 	"crypto/sha256"
 	"encoding/hex"
@@ -97,9 +98,9 @@ type imageCacheLadderBackfiller interface {
 }
 
 type targetImageCacheJobStore interface {
-	retryTargetNow(ctx context.Context, targetContentID string, localOnly bool) error
-	claimDueForTarget(ctx context.Context, workerID, targetContentID string, localOnly bool, limit int) ([]*models.MetadataImageCacheJob, error)
-	targetHasRunningJobs(ctx context.Context, targetContentID string, localOnly bool) (bool, error)
+	retryTargetNow(ctx context.Context, targetContentID string) error
+	claimDueForTarget(ctx context.Context, workerID, targetContentID string, limit int) ([]*models.MetadataImageCacheJob, error)
+	targetHasRunningJobs(ctx context.Context, targetContentID string) (bool, error)
 	targetHasDeferredLocalJobs(ctx context.Context, targetContentID string) (bool, error)
 }
 
@@ -186,8 +187,9 @@ type ImageCacheProcessor struct {
 	// discovery copies (SetWorkerBudget).
 	workBudget imageWorkBudget
 
-	// enabled mirrors metadata.cache_images. It governs remote artwork only:
-	// local sidecar art is copied whatever its value.
+	// enabled mirrors metadata.cache_images. While it is off nothing is
+	// cached, remote or local: clients load artwork straight from the
+	// providers.
 	enabled atomic.Bool
 
 	// idleWaitTimeout bounds how long CacheTargetArtwork waits on jobs held by
@@ -224,11 +226,11 @@ func (p *ImageCacheProcessor) SetImagePrefixDeleter(deleter ImagePrefixDeleter)
 	p.prefixDeleter = deleter
 }
 
-// SetEnabled toggles caching of remote artwork. When disabled the processor
-// begins no new discovery, remote claims, or downloads; a job already in flight
-// may finish. This honors metadata.cache_images so merely configuring object
-// storage does not download the whole catalog. Local sidecar artwork is copied
-// either way: without a copy it cannot be served at all.
+// SetEnabled toggles artwork caching. When disabled the processor begins no
+// new discovery, claims, downloads, or local copies; a job already in flight
+// may finish, and the stored-artwork release sweep undoes what it publishes.
+// This honors metadata.cache_images so merely configuring object storage does
+// not download the whole catalog.
 func (p *ImageCacheProcessor) SetEnabled(enabled bool) {
 	if p == nil {
 		return
@@ -326,13 +328,8 @@ func (p *ImageCacheProcessor) RunOnce(ctx context.Context, workerID string, clai
 	if p == nil || p.jobs == nil || p.cacher == nil {
 		return stats, nil
 	}
-	claim := p.jobs.ClaimDue
 	if !p.enabled.Load() {
-		local, ok := p.jobs.(localImageCacheJobClaimer)
-		if !ok {
-			return stats, nil
-		}
-		claim = local.ClaimDueLocal
+		return stats, nil
 	}
 	if claimLimit <= 0 {
 		claimLimit = 100
@@ -342,7 +339,7 @@ func (p *ImageCacheProcessor) RunOnce(ctx context.Context, workerID string, clai
 	}
 
 	claimStarted := time.Now()
-	jobs, err := claim(ctx, workerID, claimLimit)
+	jobs, err := p.jobs.ClaimDue(ctx, workerID, claimLimit)
 	if err != nil {
 		return stats, err
 	}
@@ -356,17 +353,9 @@ func (p *ImageCacheProcessor) RunOnce(ctx context.Context, workerID string, clai
 }
 
 // ArtworkCachingEnabled reports whether the processor caches anything. Callers
-// use it to decide whether to advertise an artwork step at all. Local sidecar
-// art is always copied once the processor is wired, so this holds even while
-// metadata.cache_images keeps remote artwork uncached.
+// use it to decide whether to advertise an artwork step at all.
 func (p *ImageCacheProcessor) ArtworkCachingEnabled() bool {
-	return p != nil && p.jobs != nil && p.cacher != nil
-}
-
-// mayProcess reports whether a claimed job may start: remote artwork only
-// while caching is enabled, local sidecar files always.
-func (p *ImageCacheProcessor) mayProcess(job *models.MetadataImageCacheJob) bool {
-	return p.enabled.Load() || (job != nil && isLocalSidecarSource(job.SourcePath))
+	return p != nil && p.jobs != nil && p.cacher != nil && p.enabled.Load()
 }
 
 // CacheTargetArtwork processes only the artwork queued for a manually
@@ -376,7 +365,7 @@ func (p *ImageCacheProcessor) mayProcess(job *models.MetadataImageCacheJob) bool
 // refresh does not report success before the cached paths have been updated;
 // past that it returns ErrTargetArtworkPending and lets the queue finish. It
 // does the same when a job was left for a server that can see its library
-// root. While metadata.cache_images is off it handles local artwork only.
+// root. While metadata.cache_images is off it does nothing.
 func (p *ImageCacheProcessor) CacheTargetArtwork(ctx context.Context, targetContentID string) error {
 	if !p.ArtworkCachingEnabled() {
 		return nil
@@ -394,7 +383,7 @@ func (p *ImageCacheProcessor) CacheTargetArtwork(ctx context.Context, targetCont
 	// earlier failure becomes due now. Repeating it on every poll would clear
 	// backoff that background workers set on sibling jobs and would turn the
 	// wait below into a write-heavy hot loop.
-	if err := store.retryTargetNow(ctx, targetContentID, !p.enabled.Load()); err != nil {
+	if err := store.retryTargetNow(ctx, targetContentID); err != nil {
 		return err
 	}
 
@@ -408,11 +397,13 @@ func (p *ImageCacheProcessor) CacheTargetArtwork(ctx context.Context, targetCont
 	failed := 0
 	pending := false
 	for {
-		// Re-read each round: once caching is turned off, remote jobs must not
-		// be claimed only to be handed straight back.
-		localOnly := !p.enabled.Load()
+		// Re-read each round: once caching is turned off, jobs must not be
+		// claimed only to be handed straight back.
+		if !p.enabled.Load() {
+			return nil
+		}
 		claimStarted := time.Now()
-		jobs, err := store.claimDueForTarget(ctx, workerID, targetContentID, localOnly, immediateImageCacheClaimLimit)
+		jobs, err := store.claimDueForTarget(ctx, workerID, targetContentID, immediateImageCacheClaimLimit)
 		if err != nil {
 			return err
 		}
@@ -439,7 +430,7 @@ func (p *ImageCacheProcessor) CacheTargetArtwork(ctx context.Context, targetCont
 			continue
 		}
 
-		running, err := store.targetHasRunningJobs(ctx, targetContentID, localOnly)
+		running, err := store.targetHasRunningJobs(ctx, targetContentID)
 		if err != nil {
 			return err
 		}
@@ -518,9 +509,9 @@ func (p *ImageCacheProcessor) runClaimedJobs(ctx context.Context, workerID strin
 	defer cancelStart()
 loop:
 	for i, job := range jobs {
-		// Disabling caching mid-run stops remote jobs from starting; local
-		// jobs carry on (see SetEnabled).
-		if !p.mayProcess(job) {
+		// Disabling caching mid-run stops jobs from starting (see
+		// SetEnabled).
+		if !p.enabled.Load() {
 			unstarted = append(unstarted, job.ID)
 			continue
 		}
@@ -545,7 +536,7 @@ loop:
 			leaveFrom(i)
 			break loop
 		}
-		if !p.mayProcess(job) {
+		if !p.enabled.Load() {
 			release()
 			<-sem
 			unstarted = append(unstarted, job.ID)
@@ -739,13 +730,13 @@ func (p *ImageCacheProcessor) runUntilIdle(ctx context.Context, workerID string,
 	if p.jobs == nil || p.cacher == nil {
 		return total, nil
 	}
-	// With caching off, draining still copies local artwork (RunOnce claims
-	// local jobs only); the provider-artwork backfill does not run.
+	// With caching off the provider-artwork backfill does not run, and
+	// draining claims nothing (RunOnce).
 	if discover && !p.enabled.Load() {
 		return total, ErrImageCachingDisabled
 	}
-	// The backlog counts every queued job; with caching off most of them are
-	// remote jobs this run will not touch, so it reports no denominator.
+	// The backlog counts every queued job; with caching off this run touches
+	// none of them, so it reports no denominator.
 	if p.enabled.Load() {
 		total.Backlog = p.sampleBacklog(ctx)
 	}
@@ -1077,29 +1068,14 @@ func (p *ImageCacheProcessor) processLocalOne(ctx context.Context, job *models.M
 		return imageCacheProcessResult{outcome: AVIFBackfillStatusFailed}
 	}
 	if !localImagePathWithinRoots(localPath, roots) {
-		p.markFailed(ctx, job, "local image path outside library roots: "+localPath)
-		return imageCacheProcessResult{outcome: AVIFBackfillStatusFailed}
-	}
-	// The lexical check above cannot see through symlinks. Resolve the path and
-	// roots and re-confine so an intermediate directory symlink planted inside a
-	// root (e.g. a link pointing out of the library) cannot pull an out-of-root
-	// file into the cache. EvalSymlinks resolves both sides, so a legitimately
-	// symlinked root still matches. This is a confinement GATE only: the read
-	// below still uses the logical path so readLocalImageFile's Lstat keeps
-	// rejecting a symlinked leaf. A not-yet-existent path (ErrNotExist) falls
-	// through to the reader, which classifies it as the stable "missing" failure.
-	// Either failure first asks whether this server has the file's storage
-	// mounted at all; when it does not, the job waits for one that does
-	// (deferLocalJobWithoutStorage).
-	if _, err := localImagePathResolvedWithinRoots(localPath, roots); err != nil && !errors.Is(err, fs.ErrNotExist) {
-		if p.deferLocalJobWithoutStorage(ctx, job, localPath, roots) {
-			return imageCacheProcessResult{outcome: imageCacheOutcomeDeferred}
-		}
-		p.markFailed(ctx, job, "local image path outside library roots: "+localPath)
+		p.markFailed(ctx, job, localImageOutsideRootsError(localPath).Error())
 		return imageCacheProcessResult{outcome: AVIFBackfillStatusFailed}
 	}
-
-	data, err := readLocalImageFile(localPath)
+	// readConfinedLocalImage re-confines the path through symlinks and reads it
+	// through an opened library root. A failure there first asks whether this
+	// server has the file's storage mounted at all; when it does not, the job
+	// waits for one that does (deferLocalJobWithoutStorage).
+	data, err := readConfinedLocalImage(localPath, roots)
 	if err != nil {
 		if p.deferLocalJobWithoutStorage(ctx, job, localPath, roots) {
 			return imageCacheProcessResult{outcome: imageCacheOutcomeDeferred}
@@ -1167,6 +1143,115 @@ func (p *ImageCacheProcessor) processLocalOne(ctx context.Context, job *models.M
 	return processResult
 }
 
+// readConfinedLocalImage reads the sidecar image at localPath (a cleaned
+// logical path, without the file:// scheme or fingerprint) after confining it
+// to roots. Its error texts are the stable local failures
+// isStableProviderImageFailure matches.
+func readConfinedLocalImage(localPath string, roots []string) ([]byte, error) {
+	if !localImagePathWithinRoots(localPath, roots) {
+		return nil, localImageOutsideRootsError(localPath)
+	}
+	// Open every library root before resolving anything. All reads go through
+	// one of these handles, so a root or an intermediate directory replaced
+	// after this point cannot redirect the read outside the library.
+	opened := openLibraryRoots(roots)
+	defer closeLibraryRoots(opened)
+	// The lexical check above cannot see through symlinks. Resolve the path and
+	// roots and re-confine so an intermediate directory symlink planted inside a
+	// root (e.g. a link pointing out of the library) cannot pull an out-of-root
+	// file into the cache. EvalSymlinks resolves both sides, so a legitimately
+	// symlinked root still matches. A not-yet-existent path (ErrNotExist) is the
+	// stable "missing" failure.
+	resolvedPath, resolvedRoot, err := localImagePathResolvedWithinRoots(localPath, roots)
+	if errors.Is(err, fs.ErrNotExist) {
+		return nil, fmt.Errorf("local image missing: %s", localPath)
+	}
+	if err != nil {
+		return nil, localImageOutsideRootsError(localPath)
+	}
+	// The resolved root must be one of the directories opened above; a root
+	// replaced in between resolves somewhere else and is refused.
+	root, err := openedLibraryRootFor(opened, resolvedRoot)
+	if err != nil {
+		// A root that could not be opened or stat'ed is a read failure, not a
+		// path outside the library: keep it off the stable-failure texts so a
+		// transient error (EMFILE, EIO, a mount hiccup) is retried normally.
+		if errors.Is(err, fs.ErrPermission) {
+			return nil, fmt.Errorf("local image forbidden: %s", localPath)
+		}
+		return nil, fmt.Errorf("local image read failed: library root: %w", err)
+	}
+	rel, relErr := filepath.Rel(resolvedRoot, resolvedPath)
+	if root == nil || relErr != nil || !filepath.IsLocal(rel) {
+		return nil, localImageOutsideRootsError(localPath)
+	}
+	return readLocalImageFile(localPath, root, rel)
+}
+
+// openedLibraryRoot is a library root opened before the image path is
+// resolved, or the error that kept it from opening.
+type openedLibraryRoot struct {
+	path   string
+	handle *os.Root
+	err    error
+}
+
+// openLibraryRoots opens each library root that exists as an os.Root. A root
+// that exists but fails to open keeps its error.
+func openLibraryRoots(roots []string) []openedLibraryRoot {
+	opened := make([]openedLibraryRoot, 0, len(roots))
+	for _, root := range roots {
+		root = filepath.Clean(strings.TrimSpace(root))
+		if root == "" || root == "." || !filepath.IsAbs(root) {
+			continue
+		}
+		handle, err := os.OpenRoot(root)
+		if errors.Is(err, fs.ErrNotExist) {
+			continue
+		}
+		opened = append(opened, openedLibraryRoot{path: root, handle: handle, err: err})
+	}
+	return opened
+}
+
+func closeLibraryRoots(opened []openedLibraryRoot) {
+	for _, root := range opened {
+		if root.handle != nil {
+			_ = root.handle.Close()
+		}
+	}
+}
+
+// openedLibraryRootFor returns the opened root that is the same directory as
+// resolvedRoot. It returns nil and no error when no opened root is that
+// directory, which means the path left the library. An error means the
+// matching root failed to open, or a directory could not be stat'ed, so
+// nothing is known about confinement.
+func openedLibraryRootFor(opened []openedLibraryRoot, resolvedRoot string) (*os.Root, error) {
+	current, err := os.Stat(resolvedRoot)
+	if err != nil {
+		return nil, err
+	}
+	var failure error
+	for _, root := range opened {
+		if root.handle == nil {
+			if info, err := os.Stat(root.path); err == nil && os.SameFile(info, current) && failure == nil {
+				failure = root.err
+			}
+			continue
+		}
+		info, err := root.handle.Stat(".")
+		if err != nil {
+			failure = cmp.Or(failure, err)
+			continue
+		}
+		if os.SameFile(info, current) {
+			return root.handle, nil
+		}
+	}
+	return nil, failure
+}
+
 // deleteStaleLocalPrefix removes the previous hashed local/ image prefix
 // after a re-cache stored the artwork under a different key.
 func (p *ImageCacheProcessor) deleteStaleLocalPrefix(ctx context.Context, previousCachedPath, cachedPath string) {
@@ -1194,17 +1279,23 @@ func (p *ImageCacheProcessor) deleteStaleLocalPrefix(ctx context.Context, previo
 // when a fully symlink-resolved path escapes every resolved library root.
 var errLocalImageOutsideRoots = errors.New("local image path outside library roots")
 
+// localImageOutsideRootsError is the stable failure text for a path outside
+// the library roots, which isStableProviderImageFailure matches.
+func localImageOutsideRootsError(path string) error {
+	return errors.New(errLocalImageOutsideRoots.Error() + ": " + path)
+}
+
 // localImagePathResolvedWithinRoots resolves symlinks on both the path and the
-// library roots and returns the real path when it stays within a real root.
+// library roots and returns the real path and the real root containing it.
 // This closes the gap the lexical check leaves open — an intermediate directory
 // symlink planted inside a root that points outside it. Resolving both sides
 // keeps a legitimately symlinked root valid. A path that does not exist yet
 // surfaces as fs.ErrNotExist for the caller to treat as a stable "missing"
 // failure via the reader; any other resolution failure fails closed.
-func localImagePathResolvedWithinRoots(path string, roots []string) (string, error) {
+func localImagePathResolvedWithinRoots(path string, roots []string) (string, string, error) {
 	resolvedPath, err := filepath.EvalSymlinks(path)
 	if err != nil {
-		return "", err
+		return "", "", err
 	}
 	for _, root := range roots {
 		resolvedRoot, err := filepath.EvalSymlinks(strings.TrimSpace(root))
@@ -1212,10 +1303,10 @@ func localImagePathResolvedWithinRoots(path string, roots []string) (string, err
 			continue
 		}
 		if localImagePathWithinRoots(resolvedPath, []string{resolvedRoot}) {
-			return resolvedPath, nil
+			return resolvedPath, resolvedRoot, nil
 		}
 	}
-	return "", errLocalImageOutsideRoots
+	return "", "", errLocalImageOutsideRoots
 }
 
 // localImagePathWithinRoots confines path (already cleaned, logical) to the
@@ -1243,11 +1334,13 @@ func localImagePathWithinRoots(path string, roots []string) bool {
 	return false
 }
 
-// readLocalImageFile reads a sidecar image with the same guards as discovery:
-// Lstat rejects symlinked leaves and non-regular files, the opened handle is
-// fstat-re-checked, and reads cap at MaxArtworkSourceBytes. ENOENT/EPERM
-// map to the stable-failure texts matched by isStableProviderImageFailure.
-func readLocalImageFile(path string) ([]byte, error) {
+// readLocalImageFile reads rel inside root with the same guards as discovery.
+// path is the logical path, used for the leaf check and in error texts: Lstat
+// on it rejects symlinked leaves and non-regular files, the handle opened
+// through root is fstat-re-checked against it, and reads cap at
+// MaxArtworkSourceBytes. ENOENT/EPERM map to the stable-failure texts
+// matched by isStableProviderImageFailure.
+func readLocalImageFile(path string, root *os.Root, rel string) ([]byte, error) {
 	classify := func(err error) error {
 		switch {
 		case errors.Is(err, fs.ErrNotExist):
@@ -1268,7 +1361,10 @@ func readLocalImageFile(path string) ([]byte, error) {
 	if info.Size() > MaxArtworkSourceBytes {
 		return nil, fmt.Errorf("local image exceeds %d byte limit: %s", MaxArtworkSourceBytes, path)
 	}
-	file, err := os.Open(path)
+	// Open through the root handle: it refuses any path that leaves the root,
+	// including through a directory swapped for a symlink after resolution,
+	// so confinement holds at the open itself.
+	file, err := root.Open(rel)
 	if err != nil {
 		return nil, classify(err)
 	}
@@ -1277,10 +1373,8 @@ func readLocalImageFile(path string) ([]byte, error) {
 	if err != nil {
 		return nil, classify(err)
 	}
-	// Close the symlink-swap window: os.Open follows symlinks, so a leaf swapped
-	// to a symlink between the Lstat above and this Open would be followed to its
-	// target. Reject unless the opened handle is the exact file Lstat inspected,
-	// so an out-of-root target can never be pulled into the public cache.
+	// Reject unless the opened handle is the exact file the Lstat above
+	// inspected, so a leaf swapped between the two cannot be read instead.
 	if !os.SameFile(info, stat) {
 		return nil, fmt.Errorf("local image is not a regular file: %s", path)
 	}
diff --git a/internal/metadata/image_cache_processor_local_test.go b/internal/metadata/image_cache_processor_local_test.go
index 8678cd0ab4..caac62977d 100644
--- a/internal/metadata/image_cache_processor_local_test.go
+++ b/internal/metadata/image_cache_processor_local_test.go
@@ -482,3 +482,152 @@ func TestProcessLocalPersonPhotoConfinedToTitleRoots(t *testing.T) {
 		t.Errorf("person update = %+v", people)
 	}
 }
+
+// A directory swapped for a symlink to outside the library after the path was
+// resolved must not let the read follow it out: the open goes through the
+// root handle taken before resolution.
+func TestReadLocalImageFileRefusesDirectorySwappedAfterResolution(t *testing.T) {
+	root := t.TempDir()
+	outside := t.TempDir()
+	showDir := filepath.Join(root, "Show")
+	if err := os.Mkdir(showDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	posterPath := writeLocalPoster(t, showDir)
+	if err := os.WriteFile(filepath.Join(outside, "poster.jpg"), []byte("outside-bytes"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	opened := openLibraryRoots([]string{root})
+	defer closeLibraryRoots(opened)
+	resolvedPath, resolvedRoot, err := localImagePathResolvedWithinRoots(posterPath, []string{root})
+	if err != nil {
+		t.Fatalf("resolve: %v", err)
+	}
+	handle, _ := openedLibraryRootFor(opened, resolvedRoot)
+	rel, err := filepath.Rel(resolvedRoot, resolvedPath)
+	if handle == nil || err != nil {
+		t.Fatalf("pinned root %v, rel error %v", handle, err)
+	}
+	// Swap the show directory for a link out of the library.
+	if err := os.Rename(showDir, filepath.Join(root, "Show.moved")); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(outside, showDir); err != nil {
+		t.Skipf("symlinks unavailable: %v", err)
+	}
+
+	data, err := readLocalImageFile(posterPath, handle, rel)
+	if err == nil || strings.Contains(string(data), "outside") {
+		t.Fatalf("read %q (err %v) through a swapped directory, want an error", data, err)
+	}
+}
+
+// A library root replaced by a link out of the library after Prairie opened it
+// cannot redirect the read, whether the swap lands before or after the image
+// path is resolved.
+func TestReadConfinedLocalImageRefusesRootSwappedAfterOpening(t *testing.T) {
+	setup := func(t *testing.T) (root, posterPath, outside string) {
+		t.Helper()
+		base := t.TempDir()
+		root = filepath.Join(base, "library")
+		outside = filepath.Join(base, "outside")
+		for dir, content := range map[string]string{root: "poster-bytes", outside: "outside-bytes"} {
+			if err := os.MkdirAll(filepath.Join(dir, "Show"), 0o755); err != nil {
+				t.Fatal(err)
+			}
+			if err := os.WriteFile(filepath.Join(dir, "Show", "poster.jpg"), []byte(content), 0o644); err != nil {
+				t.Fatal(err)
+			}
+		}
+		return root, filepath.Join(root, "Show", "poster.jpg"), outside
+	}
+	swapRoot := func(t *testing.T, root, outside string) {
+		t.Helper()
+		if err := os.Rename(root, root+".moved"); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.Symlink(outside, root); err != nil {
+			t.Skipf("symlinks unavailable: %v", err)
+		}
+	}
+
+	t.Run("swapped before resolution", func(t *testing.T) {
+		root, posterPath, outside := setup(t)
+		opened := openLibraryRoots([]string{root})
+		defer closeLibraryRoots(opened)
+		swapRoot(t, root, outside)
+
+		_, resolvedRoot, err := localImagePathResolvedWithinRoots(posterPath, []string{root})
+		if err != nil {
+			t.Fatalf("resolve: %v", err)
+		}
+		if handle, _ := openedLibraryRootFor(opened, resolvedRoot); handle != nil {
+			t.Fatal("the replacement root matched the root opened before the swap")
+		}
+	})
+
+	t.Run("swapped after resolution", func(t *testing.T) {
+		root, posterPath, outside := setup(t)
+		opened := openLibraryRoots([]string{root})
+		defer closeLibraryRoots(opened)
+		resolvedPath, resolvedRoot, err := localImagePathResolvedWithinRoots(posterPath, []string{root})
+		if err != nil {
+			t.Fatalf("resolve: %v", err)
+		}
+		handle, _ := openedLibraryRootFor(opened, resolvedRoot)
+		rel, err := filepath.Rel(resolvedRoot, resolvedPath)
+		if handle == nil || err != nil {
+			t.Fatalf("pinned root %v, rel error %v", handle, err)
+		}
+		swapRoot(t, root, outside)
+
+		data, err := readLocalImageFile(posterPath, handle, rel)
+		if err == nil || strings.Contains(string(data), "outside") {
+			t.Fatalf("read %q (err %v) after the root was swapped, want an error", data, err)
+		}
+	})
+}
+
+// A root the process cannot open is a read failure, not a path outside the
+// library, so it never gets the stable out-of-roots classification.
+func TestReadConfinedLocalImageReportsUnopenableRoot(t *testing.T) {
+	if os.Geteuid() == 0 {
+		t.Skip("root ignores directory permissions")
+	}
+	root := filepath.Join(t.TempDir(), "library")
+	showDir := filepath.Join(root, "Show")
+	if err := os.MkdirAll(showDir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	posterPath := writeLocalPoster(t, showDir)
+	// Traverse-only: the poster is reachable, but the root cannot be opened.
+	if err := os.Chmod(root, 0o111); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = os.Chmod(root, 0o755) })
+
+	_, err := readConfinedLocalImage(posterPath, []string{root})
+	if err == nil || !strings.Contains(err.Error(), "local image forbidden") {
+		t.Fatalf("err = %v, want the forbidden failure", err)
+	}
+}
+
+// A library root that cannot be stat'ed after the path resolved says nothing
+// about confinement, so it is a retryable read failure, not the stable
+// out-of-roots one; a resolved root that is none of the opened roots is.
+func TestOpenedLibraryRootForSeparatesStatFailuresFromEscapes(t *testing.T) {
+	root := t.TempDir()
+	opened := openLibraryRoots([]string{root})
+	defer closeLibraryRoots(opened)
+
+	if handle, err := openedLibraryRootFor(opened, filepath.Join(root, "gone")); handle != nil || err == nil {
+		t.Fatalf("missing resolved root = (%v, %v), want an error", handle, err)
+	}
+	if handle, err := openedLibraryRootFor(opened, t.TempDir()); handle != nil || err != nil {
+		t.Fatalf("other directory = (%v, %v), want no root and no error", handle, err)
+	}
+	if handle, err := openedLibraryRootFor(opened, root); handle == nil || err != nil {
+		t.Fatalf("the root itself = (%v, %v), want its handle", handle, err)
+	}
+}
diff --git a/internal/metadata/image_cache_processor_test.go b/internal/metadata/image_cache_processor_test.go
index efb75470b9..9c5ca0d4a7 100644
--- a/internal/metadata/image_cache_processor_test.go
+++ b/internal/metadata/image_cache_processor_test.go
@@ -31,7 +31,6 @@ type targetImageCacheJobs struct {
 	runningResults []bool
 	runningCalls   int
 	alwaysRunning  bool
-	localOnly      bool
 	// deferredElsewhere answers targetHasDeferredLocalJobs.
 	deferredElsewhere bool
 }
@@ -40,16 +39,14 @@ func (f *targetImageCacheJobs) targetHasDeferredLocalJobs(context.Context, strin
 	return f.deferredElsewhere, nil
 }
 
-func (f *targetImageCacheJobs) retryTargetNow(_ context.Context, targetContentID string, localOnly bool) error {
+func (f *targetImageCacheJobs) retryTargetNow(_ context.Context, targetContentID string) error {
 	f.retriedTarget = targetContentID
-	f.localOnly = localOnly
 	f.retryCalls++
 	return nil
 }
 
-func (f *targetImageCacheJobs) claimDueForTarget(_ context.Context, _ string, targetContentID string, localOnly bool, _ int) ([]*models.MetadataImageCacheJob, error) {
+func (f *targetImageCacheJobs) claimDueForTarget(_ context.Context, _ string, targetContentID string, _ int) ([]*models.MetadataImageCacheJob, error) {
 	f.claimedTarget = targetContentID
-	f.localOnly = f.localOnly && localOnly
 	var jobs []*models.MetadataImageCacheJob
 	if f.targetCalls < len(f.targetClaims) {
 		jobs = f.targetClaims[f.targetCalls]
@@ -58,7 +55,7 @@ func (f *targetImageCacheJobs) claimDueForTarget(_ context.Context, _ string, ta
 	return jobs, nil
 }
 
-func (f *targetImageCacheJobs) targetHasRunningJobs(_ context.Context, _ string, _ bool) (bool, error) {
+func (f *targetImageCacheJobs) targetHasRunningJobs(context.Context, string) (bool, error) {
 	running := f.alwaysRunning
 	if f.runningCalls < len(f.runningResults) {
 		running = f.runningResults[f.runningCalls]
diff --git a/internal/metadata/image_ladder_backfill_db_test.go b/internal/metadata/image_ladder_backfill_db_test.go
new file mode 100644
index 0000000000..a72b59a19b
--- /dev/null
+++ b/internal/metadata/image_ladder_backfill_db_test.go
@@ -0,0 +1,142 @@
+package metadata
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"strconv"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/artworkkey"
+)
+
+// TestLadderBackfillCandidatesDB runs the ladder backfill candidate query
+// against the migrated schema. Every cached backdrop surface (the item, its
+// localization, and an extra backdrop) stays a candidate while its manifest
+// predates the backdrop's widest rung, and drops out once the manifest lists
+// it.
+func TestLadderBackfillCandidatesDB(t *testing.T) {
+	pool := imageCacheQueueTestPool(t)
+
+	// EXPLAIN plans every UNION arm, so a column the schema lacks fails here.
+	if _, err := pool.Exec(t.Context(), "EXPLAIN "+ladderCandidateRowsSQL()); err != nil {
+		t.Fatalf("EXPLAIN ladder candidates: %v", err)
+	}
+
+	contentID := fmt.Sprintf("zz-ladder-backfill-%d", time.Now().UnixNano())
+	originals, extraID := seedLadderBackdrops(t, pool, contentID)
+	all := []string{ImageCacheTargetItem, ImageCacheTargetItemBackdrop, ImageCacheTargetItemLocalization}
+
+	if got := ladderBackdropCandidates(t, pool, contentID, extraID); !slices.Equal(got, all) {
+		t.Fatalf("without manifests, candidates = %v, want %v", got, all)
+	}
+
+	// Artwork cached under the previous ladder has every rung but the new one.
+	recordLadderManifests(t, pool, originals, []string{"original", "w1920", "w1280", "w300"})
+	if got := ladderBackdropCandidates(t, pool, contentID, extraID); !slices.Equal(got, all) {
+		t.Fatalf("with previous-ladder manifests, candidates = %v, want %v", got, all)
+	}
+
+	recordLadderManifests(t, pool, originals, artworkkey.VariantNames(artworkkey.ImageBackdrop))
+	if got := ladderBackdropCandidates(t, pool, contentID, extraID); len(got) != 0 {
+		t.Fatalf("with current-ladder manifests, candidates = %v, want none", got)
+	}
+}
+
+// seedLadderBackdrops caches a provider backdrop on the item, its German
+// localization, and one extra backdrop row, returning each surface's original
+// key and the extra backdrop's row ID.
+func seedLadderBackdrops(t *testing.T, pool *pgxpool.Pool, contentID string) (map[string]string, int64) {
+	t.Helper()
+	ctx := t.Context()
+	base := "tmdb/movies/" + contentID
+	originals := map[string]string{
+		ImageCacheTargetItem:             base + "/backdrop/original.r1.webp",
+		ImageCacheTargetItemLocalization: base + "/localizations/de/backdrop/original.r2.webp",
+		ImageCacheTargetItemBackdrop:     base + "/x1/backdrop/original.r3.webp",
+	}
+	cleanup := func() {
+		bg := context.Background()
+		_, _ = pool.Exec(bg, `DELETE FROM media_item_localizations WHERE content_id = $1`, contentID)
+		_, _ = pool.Exec(bg, `DELETE FROM media_items WHERE content_id = $1`, contentID)
+		_, _ = pool.Exec(bg, `DELETE FROM artwork_revision_gc_candidates WHERE original_path LIKE $1 || '%'`, base)
+	}
+	cleanup()
+	t.Cleanup(cleanup)
+
+	if _, err := pool.Exec(ctx, `
+		INSERT INTO media_items (content_id, type, title, tmdb_id, backdrop_source_path, backdrop_path)
+		VALUES ($1, 'movie', 'Ladder backfill', '1', 'https://image.tmdb.org/t/p/original/item.jpg', $2)
+	`, contentID, originals[ImageCacheTargetItem]); err != nil {
+		t.Fatalf("seed media item: %v", err)
+	}
+	if _, err := pool.Exec(ctx, `
+		INSERT INTO media_item_localizations (content_id, language, backdrop_source_path, backdrop_path)
+		VALUES ($1, 'de', 'https://image.tmdb.org/t/p/original/de.jpg', $2)
+	`, contentID, originals[ImageCacheTargetItemLocalization]); err != nil {
+		t.Fatalf("seed localization: %v", err)
+	}
+	var extraID int64
+	if err := pool.QueryRow(ctx, `
+		INSERT INTO media_item_backdrops (content_id, ordinal, source_path, path)
+		VALUES ($1, 1, 'https://image.tmdb.org/t/p/original/extra.jpg', $2)
+		RETURNING id
+	`, contentID, originals[ImageCacheTargetItemBackdrop]).Scan(&extraID); err != nil {
+		t.Fatalf("seed extra backdrop: %v", err)
+	}
+	return originals, extraID
+}
+
+// ladderBackdropCandidates returns the target types of the item's backdrop
+// ladder candidates, sorted, checking that the extra backdrop is targeted by
+// its row ID.
+func ladderBackdropCandidates(t *testing.T, pool *pgxpool.Pool, contentID string, extraID int64) []string {
+	t.Helper()
+	rows, err := pool.Query(t.Context(), `
+		SELECT c.target_type, c.target_content_id
+		FROM (`+ladderCandidateRowsSQL()+`) c
+		WHERE c.image_type = 'backdrop' AND c.series_id = $1
+		ORDER BY c.target_type
+	`, contentID)
+	if err != nil {
+		t.Fatalf("query ladder candidates: %v", err)
+	}
+	defer rows.Close()
+	var got []string
+	for rows.Next() {
+		var targetType, targetID string
+		if err := rows.Scan(&targetType, &targetID); err != nil {
+			t.Fatalf("scan ladder candidate: %v", err)
+		}
+		if targetType == ImageCacheTargetItemBackdrop && targetID != strconv.FormatInt(extraID, 10) {
+			t.Fatalf("extra backdrop target_content_id = %q, want its row id %d", targetID, extraID)
+		}
+		got = append(got, targetType)
+	}
+	if err := rows.Err(); err != nil {
+		t.Fatalf("iterate ladder candidates: %v", err)
+	}
+	return got
+}
+
+// recordLadderManifests records a revision manifest listing variants for each
+// original, as the cacher does after a successful upload.
+func recordLadderManifests(t *testing.T, pool *pgxpool.Pool, originals map[string]string, variants []string) {
+	t.Helper()
+	for _, original := range originals {
+		keys := make([]string, 0, len(variants))
+		for _, variant := range variants {
+			keys = append(keys, artworkkey.Variant(original, variant))
+		}
+		if _, err := pool.Exec(t.Context(), `
+			INSERT INTO artwork_revision_gc_candidates (original_path, image_type, object_keys, not_before)
+			VALUES ($1, 'backdrop', $2, NOW())
+			ON CONFLICT (original_path) DO UPDATE SET object_keys = EXCLUDED.object_keys
+		`, original, keys); err != nil {
+			t.Fatalf("record manifest for %s: %v", original, err)
+		}
+	}
+}
diff --git a/internal/metadata/image_ladder_backfill_state_repo_db_test.go b/internal/metadata/image_ladder_backfill_state_repo_db_test.go
index d7382a2dc3..fb1e9c634e 100644
--- a/internal/metadata/image_ladder_backfill_state_repo_db_test.go
+++ b/internal/metadata/image_ladder_backfill_state_repo_db_test.go
@@ -48,8 +48,8 @@ func seedLadderFenceFixture(t *testing.T, pool *pgxpool.Pool) ladderFenceFixture
 		) VALUES
 			($1, 'poster', ARRAY[$1, $2], NOW() + interval '1 day', NULL),
 			($3, 'poster', ARRAY[$3, $4], NOW() + interval '1 day', NULL)
-	`, fixture.widePath, fmt.Sprintf("tmdb/movies/ladder-fence-%d/poster/w780.wide.webp", suffix),
-		fixture.oldPath, fmt.Sprintf("tmdb/movies/ladder-fence-%d/poster/w500.old.webp", suffix)); err != nil {
+	`, fixture.widePath, fmt.Sprintf("tmdb/movies/ladder-fence-%d/poster/w1000.wide.webp", suffix),
+		fixture.oldPath, fmt.Sprintf("tmdb/movies/ladder-fence-%d/poster/w780.old.webp", suffix)); err != nil {
 		t.Fatalf("seed ladder fence manifests: %v", err)
 	}
 	if _, err := pool.Exec(ctx, `
@@ -80,12 +80,12 @@ func TestImageLadderBackfillFinalConfirmationRejectsLateOldArtwork(t *testing.T)
 	if _, err := pool.Exec(ctx, `UPDATE media_items SET poster_path = $1 WHERE content_id = $2`, fixture.oldPath, fixture.contentID); err != nil {
 		t.Fatalf("publish old-ladder artwork: %v", err)
 	}
-	confirmed, err := NewImageLadderBackfillStateRepository(pool).ConfirmBackfilled(ctx, 2)
+	confirmed, err := NewImageLadderBackfillStateRepository(pool).ConfirmBackfilled(ctx, 3)
 	if err != nil {
 		t.Fatalf("ConfirmBackfilled: %v", err)
 	}
 	if confirmed {
-		t.Fatal("confirmed ladder v2 while the published artwork lacks its new rung")
+		t.Fatal("confirmed ladder v3 while the published artwork lacks its new rung")
 	}
 
 	state, err := NewImageLadderBackfillStateRepository(pool).Get(ctx)
@@ -108,7 +108,7 @@ func TestImageLadderBackfillLateOldArtworkReopensCompletedVersion(t *testing.T)
 	// to block this test before it reaches the behavior under test.
 	if _, err := pool.Exec(ctx, `
 		UPDATE image_ladder_backfill_state
-		SET backfilled_version = 2, updated_at = NOW()
+		SET backfilled_version = 3, updated_at = NOW()
 		WHERE id = 1
 	`); err != nil {
 		t.Fatalf("establish completed ladder state: %v", err)
@@ -121,10 +121,91 @@ func TestImageLadderBackfillLateOldArtworkReopensCompletedVersion(t *testing.T)
 	if err != nil {
 		t.Fatalf("Get: %v", err)
 	}
-	if state.BackfilledVersion != 1 {
-		t.Fatalf("backfilled version = %d, want reopened v1", state.BackfilledVersion)
+	if state.BackfilledVersion != 2 {
+		t.Fatalf("backfilled version = %d, want reopened v2", state.BackfilledVersion)
 	}
 	if !state.LastAttemptAt.IsZero() {
 		t.Fatalf("last attempt = %v, want late publication to clear pacing", state.LastAttemptAt)
 	}
 }
+
+// Artwork published on the current ladder must leave a finished backfill
+// alone; a fence still checking an older ladder's rung would reopen it on
+// every newly cached image.
+func TestImageLadderBackfillCurrentArtworkKeepsCompletedVersion(t *testing.T) {
+	pool := imageCacheQueueTestPool(t)
+	fixture := seedLadderFenceFixture(t, pool)
+	ctx := context.Background()
+
+	if _, err := pool.Exec(ctx, `
+		UPDATE image_ladder_backfill_state
+		SET backfilled_version = 3, updated_at = NOW()
+		WHERE id = 1
+	`); err != nil {
+		t.Fatalf("establish completed ladder state: %v", err)
+	}
+	// Republish the current-ladder poster under a fresh path so the trigger
+	// sees a changed cached path.
+	fresh := fixture.widePath + ".fresh"
+	if _, err := pool.Exec(ctx, `
+		INSERT INTO artwork_revision_gc_candidates (original_path, image_type, object_keys, not_before, next_attempt_at)
+		SELECT $1, image_type, array_append(object_keys, $1), not_before, next_attempt_at
+		FROM artwork_revision_gc_candidates WHERE original_path = $2
+	`, fresh, fixture.widePath); err != nil {
+		t.Fatalf("seed fresh manifest: %v", err)
+	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM artwork_revision_gc_candidates WHERE original_path = $1`, fresh)
+	})
+	if _, err := pool.Exec(ctx, `UPDATE media_items SET poster_path = $1 WHERE content_id = $2`, fresh, fixture.contentID); err != nil {
+		t.Fatalf("publish current-ladder artwork: %v", err)
+	}
+
+	state, err := NewImageLadderBackfillStateRepository(pool).Get(ctx)
+	if err != nil {
+		t.Fatalf("Get: %v", err)
+	}
+	if state.BackfilledVersion != 3 {
+		t.Fatalf("backfilled version = %d, want v3 kept", state.BackfilledVersion)
+	}
+}
+
+// Extra backdrops are cached on the backdrop ladder too, so one published
+// without the rung the current ladder added reopens a finished backfill.
+func TestImageLadderBackfillLateOldBackdropReopensCompletedVersion(t *testing.T) {
+	pool := imageCacheQueueTestPool(t)
+	fixture := seedLadderFenceFixture(t, pool)
+	ctx := context.Background()
+
+	oldBackdrop := fmt.Sprintf("tmdb/movies/%s/backdrop/original.old.webp", fixture.contentID)
+	if _, err := pool.Exec(ctx, `
+		INSERT INTO artwork_revision_gc_candidates (original_path, image_type, object_keys, not_before, next_attempt_at)
+		VALUES ($1, 'backdrop', ARRAY[$1, $2], NOW() + interval '1 day', NULL)
+	`, oldBackdrop, fmt.Sprintf("tmdb/movies/%s/backdrop/w1920.old.webp", fixture.contentID)); err != nil {
+		t.Fatalf("seed old backdrop manifest: %v", err)
+	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM artwork_revision_gc_candidates WHERE original_path = $1`, oldBackdrop)
+	})
+	if _, err := pool.Exec(ctx, `
+		UPDATE image_ladder_backfill_state
+		SET backfilled_version = 3, updated_at = NOW()
+		WHERE id = 1
+	`); err != nil {
+		t.Fatalf("establish completed ladder state: %v", err)
+	}
+	if _, err := pool.Exec(ctx, `
+		INSERT INTO media_item_backdrops (content_id, ordinal, path, source_path)
+		VALUES ($1, 1, $2, 'https://example.invalid/backdrop.jpg')
+	`, fixture.contentID, oldBackdrop); err != nil {
+		t.Fatalf("publish late old-ladder backdrop: %v", err)
+	}
+
+	state, err := NewImageLadderBackfillStateRepository(pool).Get(ctx)
+	if err != nil {
+		t.Fatalf("Get: %v", err)
+	}
+	if state.BackfilledVersion != 2 {
+		t.Fatalf("backfilled version = %d, want reopened v2", state.BackfilledVersion)
+	}
+}
diff --git a/internal/metadata/image_ladder_backfill_test.go b/internal/metadata/image_ladder_backfill_test.go
index 54469c570d..2f1869ed1a 100644
--- a/internal/metadata/image_ladder_backfill_test.go
+++ b/internal/metadata/image_ladder_backfill_test.go
@@ -233,10 +233,11 @@ func TestLadderRungLiteralMatchesBothKeyForms(t *testing.T) {
 		imageType string
 		want      string
 	}{
-		// Prairie's ladder tops out at w500 for all three types.
+		// Prairie's ladder tops out at w500 for posters, stills and logos; backdrops add w2560.
 		{ImageCacheImagePoster, "'%/w500.%'"},
 		{ImageCacheImageStill, "'%/w500.%'"},
 		{ImageCacheImageLogo, "'%/w500.%'"},
+		{ImageCacheImageBackdrop, "'%/w2560.%'"},
 	}
 	for _, tt := range tests {
 		if got := ladderRungLiteral(tt.imageType); got != tt.want {
diff --git a/internal/metadata/image_ladder_fallback.go b/internal/metadata/image_ladder_fallback.go
index c80125c132..e2d5d3b597 100644
--- a/internal/metadata/image_ladder_fallback.go
+++ b/internal/metadata/image_ladder_fallback.go
@@ -40,10 +40,15 @@ type ArtworkAvailabilityReader interface {
 // serve every default-size poster smaller than it needs to be. Prairie's own
 // added rung (the w200 TV poster) sits at the bottom of the ladder, which this
 // step-down never concerns.
-var ladderTypesWithAddedRung = map[string]bool{}
+//
+// Backdrops did gain a widest rung (w2560, adopted from upstream), so only
+// they step down.
+var ladderTypesWithAddedRung = map[string]bool{
+	ImageCacheImageBackdrop: true,
+}
 
 // keyVariant extracts the variant name from a cached artwork key, e.g.
-// "tmdb/movies/550/poster/w780.abc123.webp" -> "w780".
+// "tmdb/movies/550/poster/w500.abc123.webp" -> "w500".
 func keyVariant(key string) string {
 	name := path.Base(strings.TrimSpace(key))
 	name = strings.TrimSuffix(name, path.Ext(name))
@@ -66,9 +71,12 @@ func variantKey(key, variant string) string {
 
 // resolvePublishedLadderKeys performs one catalog lookup and local selection.
 // Neither cold caches nor missing manifests cause storage or delivery probes.
-// Without a reader (local storage, direct S3) every key resolves to itself:
-// publication is atomic there, and a key that is nevertheless missing gets a
-// 404 that enqueues repair rather than a silently demoted rung.
+// Without a reader every key resolves to itself.
+//
+// Where delivery cannot lag behind a write (local storage, direct S3), a
+// published revision has every rung its ladder version generated, so only a
+// rung a later ladder version added can be missing; only those keys are
+// looked up, and everything else resolves to itself without a query.
 func resolvePublishedLadderKeys(ctx context.Context, reader ArtworkAvailabilityReader, entries []resolveEntry) map[string]string {
 	if reader == nil {
 		resolved := make(map[string]string, len(entries))
@@ -77,9 +85,13 @@ func resolvePublishedLadderKeys(ctx context.Context, reader ArtworkAvailabilityR
 		}
 		return resolved
 	}
+	lookupAll := readsExternalDelivery(reader)
 	originals := make([]string, 0, len(entries))
 	for _, entry := range entries {
-		if catalog.ImageTypeFromCachedPath(entry.originalPath) != "" {
+		if catalog.ImageTypeFromCachedPath(entry.originalPath) == "" {
+			continue
+		}
+		if lookupAll || isAddedRung(entry.originalPath) {
 			originals = append(originals, variantKey(entry.originalPath, artworkkey.OriginalVariant))
 		}
 	}
@@ -100,22 +112,45 @@ func resolvePublishedLadderKeys(ctx context.Context, reader ArtworkAvailabilityR
 	return resolved
 }
 
+// readsExternalDelivery reports whether reader serves a backend whose delivery
+// can lag behind a write. A reader that cannot say is treated as external, so
+// every key is looked up.
+func readsExternalDelivery(reader ArtworkAvailabilityReader) bool {
+	if r, ok := reader.(interface{ ExternalDelivery() bool }); ok {
+		return r.ExternalDelivery()
+	}
+	return true
+}
+
+// isAddedRung reports whether key names a rung wider than its type's medium
+// rung on a type whose ladder grew: the rungs artwork cached under an earlier
+// ladder version may lack. Medium is pinned to the pre-image_size default, so
+// every ladder version generated it and everything narrower.
+func isAddedRung(key string) bool {
+	imageType := catalog.ImageTypeFromCachedPath(key)
+	if !ladderTypesWithAddedRung[imageType] {
+		return false
+	}
+	return clampToEstablishedRung(imageType, key) != key
+}
+
 func selectPublishedVariant(key string, state ArtworkAvailability, known bool) string {
 	imageType := catalog.ImageTypeFromCachedPath(key)
 	if imageType == "" {
 		return key
 	}
-	if !known || (state.External && !state.Verified) {
-		// An unverified external path is not proof the newly added size works,
-		// unless an earlier verdict in this scope already delivered it.
-		if ladderTypesWithAddedRung[imageType] && keyVariant(key) == imagesize.Variant(imageType, imagesize.Large) &&
-			!slices.Contains(state.Deliverable, key) {
-			if lower, ok := imagesize.NextLower(imageType, keyVariant(key)); ok {
-				key = variantKey(key, lower)
-			}
+	if !known {
+		if ladderTypesWithAddedRung[imageType] {
+			key = clampToEstablishedRung(imageType, key)
 		}
-		if !known {
-			return key
+		return key
+	}
+	// An unverified external path is not proof the newly added size works,
+	// unless an earlier verdict in this scope already delivered it.
+	if state.External && !state.Verified && ladderTypesWithAddedRung[imageType] &&
+		keyVariant(key) == imagesize.Variant(imageType, imagesize.Large) && !slices.Contains(state.Deliverable, key) {
+		if lower, ok := imagesize.NextLower(imageType, keyVariant(key)); ok {
+			key = variantKey(key, lower)
 		}
 	}
 	keys := state.Published
@@ -126,15 +161,8 @@ func selectPublishedVariant(key string, state ArtworkAvailability, known bool) s
 	if keyVariant(key) == artworkkey.OriginalVariant && !slices.Contains(keys, key) {
 		candidate = variantKey(key, imagesize.Variant(imageType, imagesize.Large))
 	}
-	for {
-		if slices.Contains(keys, candidate) {
-			return candidate
-		}
-		lower, ok := imagesize.NextLower(imageType, keyVariant(candidate))
-		if !ok {
-			break
-		}
-		candidate = variantKey(key, lower)
+	if published := widestPublishedWithin(key, candidate, keys); published != "" {
+		return published
 	}
 	original := variantKey(key, artworkkey.OriginalVariant)
 	if slices.Contains(keys, original) {
@@ -144,6 +172,42 @@ func selectPublishedVariant(key string, state ArtworkAvailability, known bool) s
 	return ""
 }
 
+// widestPublishedWithin is the widest width rung of key's revision in keys that
+// is no wider than candidate's. It can be a rung an earlier ladder version
+// generated, such as a w780 poster the backfill has not regenerated at w1000
+// yet. It is empty when keys hold no such rung.
+func widestPublishedWithin(key, candidate string, keys []string) string {
+	limit, ok := imagesize.VariantWidthPx(keyVariant(candidate))
+	if !ok {
+		return ""
+	}
+	best, bestWidth := "", 0
+	for _, published := range keys {
+		variant := keyVariant(published)
+		width, ok := imagesize.VariantWidthPx(variant)
+		if !ok || width > limit || width <= bestWidth || variantKey(key, variant) != published {
+			continue
+		}
+		best, bestWidth = published, width
+	}
+	return best
+}
+
+// clampToEstablishedRung rewrites a width rung wider than the type's medium
+// rung down to medium, the widest rung artwork cached before revision
+// manifests carries. The original and narrower rungs pass through.
+func clampToEstablishedRung(imageType, key string) string {
+	width, ok := imagesize.VariantWidthPx(keyVariant(key))
+	if !ok {
+		return key
+	}
+	medium := imagesize.Variant(imageType, imagesize.Medium)
+	if mediumWidth, ok := imagesize.VariantWidthPx(medium); ok && width > mediumWidth {
+		return variantKey(key, medium)
+	}
+	return key
+}
+
 func minURLExpiry(a, b time.Time) time.Time {
 	if a.Before(b) {
 		return a
diff --git a/internal/metadata/image_ladder_fallback_test.go b/internal/metadata/image_ladder_fallback_test.go
index bdf2dd1eb7..906aa35599 100644
--- a/internal/metadata/image_ladder_fallback_test.go
+++ b/internal/metadata/image_ladder_fallback_test.go
@@ -3,6 +3,7 @@ package metadata
 import (
 	"context"
 	"fmt"
+	"slices"
 	"strings"
 	"testing"
 
@@ -79,6 +80,10 @@ func TestSelectPublishedVariant(t *testing.T) {
 		{"legacy", ArtworkAvailability{}, false, key},
 		{"published", ArtworkAvailability{Published: []string{key, original}}, true, key},
 		{"missing large", ArtworkAvailability{Published: []string{small, original}}, true, small},
+		// A revision's widest published rung that fits serves, even one the
+		// current ladder no longer generates.
+		{"retired rung that fits", ArtworkAvailability{Published: []string{variantKey(key, "w400"), small, original}}, true, variantKey(key, "w400")},
+		{"previous ladder's rung too wide", ArtworkAvailability{Published: []string{variantKey(key, "w1280"), medium, original}}, true, medium},
 		{"original only", ArtworkAvailability{Published: []string{original}}, true, original},
 		{"delivery verified", ArtworkAvailability{Published: []string{key, medium, original}, External: true, Verified: true, Deliverable: []string{key}}, true, key},
 		{"delivery missing", ArtworkAvailability{Published: []string{key, medium, original}, External: true, Verified: true, Deliverable: []string{medium}}, true, medium},
@@ -93,6 +98,26 @@ func TestSelectPublishedVariant(t *testing.T) {
 	}
 }
 
+// Artwork without a manifest was cached before the ladder grew, so any rung
+// above the type's medium clamps to medium. On Prairie only the backdrop ladder
+// grew (w2560); posters, stills and logos top out at the w500 they always had.
+func TestLegacyArtworkClampsToEstablishedRung(t *testing.T) {
+	for _, tc := range []struct{ key, want string }{
+		{"tmdb/movies/1/poster/w500.webp", "tmdb/movies/1/poster/w500.webp"},
+		{"tmdb/movies/1/poster/w300.webp", "tmdb/movies/1/poster/w300.webp"},
+		{"tmdb/series/1/seasons/1/episodes/1/still/w500.webp", "tmdb/series/1/seasons/1/episodes/1/still/w500.webp"},
+		{"tmdb/movies/1/backdrop/w2560.webp", "tmdb/movies/1/backdrop/w1920.webp"},
+		{"tmdb/movies/1/backdrop/w1280.webp", "tmdb/movies/1/backdrop/w1280.webp"},
+		{"tmdb/movies/1/logo/w500.webp", "tmdb/movies/1/logo/w500.webp"},
+		{"tmdb/movies/1/backdrop/original.webp", "tmdb/movies/1/backdrop/original.webp"},
+		{"tmdb/movies/1/profile/w500.webp", "tmdb/movies/1/profile/w500.webp"},
+	} {
+		if got := selectPublishedVariant(tc.key, ArtworkAvailability{}, false); got != tc.want {
+			t.Errorf("selectPublishedVariant(%q, legacy) = %q, want %q", tc.key, got, tc.want)
+		}
+	}
+}
+
 func TestVariantKeyRebuild(t *testing.T) {
 	tests := []struct {
 		key     string
@@ -140,13 +165,55 @@ func TestOriginalArtworkFallsBackToResizedVariant(t *testing.T) {
 }
 
 func TestStoredKeysResolveDirectlyWithoutAvailabilityReader(t *testing.T) {
-	// Local storage and direct S3 publish atomically, so the catalog trusts
-	// the manifest key it holds and asks for exactly that object.
+	// Without publication metadata the catalog asks for exactly the key it
+	// holds.
 	resolver := NewPluginImageResolver()
 	t.Cleanup(resolver.Close)
 	resolver.SetArtworkResolver(noProbeStore{t})
-	key := "tmdb/series/1/seasons/3/poster/w780.rev.webp"
+	key := "tmdb/series/1/seasons/3/poster/" + posterLargeRung + ".rev.webp"
 	if got := resolver.ResolveImageURL(t.Context(), key, "large"); got != "https://images.example/"+key {
 		t.Fatalf("stored key was rewritten: %s", got)
 	}
 }
+
+type recordingAvailability struct {
+	external bool
+	states   map[string]ArtworkAvailability
+	asked    []string
+}
+
+func (r *recordingAvailability) ArtworkAvailability(_ context.Context, paths []string) (map[string]ArtworkAvailability, error) {
+	r.asked = append(r.asked, paths...)
+	return r.states, nil
+}
+
+func (r *recordingAvailability) ExternalDelivery() bool { return r.external }
+
+// Where delivery cannot lag behind a write, only a rung a ladder change added
+// can be missing from a published revision, so established rungs resolve
+// without a lookup and only the added rung consults the manifest.
+func TestNonExternalReaderLooksUpOnlyAddedRungs(t *testing.T) {
+	// Prairie's only grown ladder is the backdrop's (w2560).
+	medium := "tmdb/movies/1/backdrop/w1920.rev.webp"
+	large := "tmdb/movies/2/backdrop/w2560.rev.webp"
+	reader := &recordingAvailability{states: map[string]ArtworkAvailability{
+		variantKey(large, "original"): {Published: []string{variantKey(large, "w1920"), variantKey(large, "original")}},
+	}}
+	got := resolvePublishedLadderKeys(t.Context(), reader, []resolveEntry{{originalPath: medium}, {originalPath: large}})
+	if !slices.Equal(reader.asked, []string{variantKey(large, "original")}) {
+		t.Fatalf("looked up %v, want only the added rung's revision", reader.asked)
+	}
+	if got[medium] != medium {
+		t.Errorf("established rung resolved to %q, want itself", got[medium])
+	}
+	if want := variantKey(large, "w1920"); got[large] != want {
+		t.Errorf("added rung resolved to %q, want the published %q", got[large], want)
+	}
+
+	// External delivery can lag behind any write, so every key is looked up.
+	external := &recordingAvailability{external: true}
+	resolvePublishedLadderKeys(t.Context(), external, []resolveEntry{{originalPath: medium}, {originalPath: large}})
+	if len(external.asked) != 2 {
+		t.Fatalf("external reader looked up %v, want both revisions", external.asked)
+	}
+}
diff --git a/internal/metadata/image_resolver.go b/internal/metadata/image_resolver.go
index b75b6ad7cf..56786863cb 100644
--- a/internal/metadata/image_resolver.go
+++ b/internal/metadata/image_resolver.go
@@ -149,12 +149,12 @@ func (r *PluginImageResolver) SetArtworkResolver(resolver artworkurl.Resolver) {
 	r.urlCache.InvalidatePrefix("")
 }
 
-// SetArtworkAvailabilityReader supplies durable publication/delivery metadata
-// for external delivery, where a read endpoint can lag behind a storage write.
-// Without a reader the resolver trusts the key it is given: local storage
-// publishes atomically and direct S3 reads see the object as soon as the
-// upload returns. Catalog reads never use the storage client to discover
-// availability.
+// SetArtworkAvailabilityReader supplies durable publication/delivery metadata.
+// Every backend's catalog reads use it to pick a rung the revision actually
+// published, which matters after a ladder change; external delivery, where a
+// read endpoint can lag behind a storage write, also gets verified keys.
+// Without a reader the resolver trusts the key it is given. Catalog reads
+// never use the storage client to discover availability.
 func (r *PluginImageResolver) SetArtworkAvailabilityReader(reader ArtworkAvailabilityReader) {
 	r.mu.Lock()
 	r.artworkAvailability = reader
diff --git a/internal/metadata/item_extra_artwork.go b/internal/metadata/item_extra_artwork.go
index d5bbd8c5ce..e147585587 100644
--- a/internal/metadata/item_extra_artwork.go
+++ b/internal/metadata/item_extra_artwork.go
@@ -211,7 +211,13 @@ func (s *MetadataService) syncItemExtraBackdrops(ctx context.Context, retention
 		return err
 	}
 	rows := stored[item.ContentID]
-	if planned := planExtraBackdrops(retention, item, rows, images); !sameItemBackdrops(rows, planned) {
+	// Extra backdrops are local art only. With caching off the item keeps
+	// none, unless its artwork is locked.
+	var planned []models.ItemBackdrop
+	if s.autoCacheImages.Load() || artworkLocked(item) {
+		planned = planExtraBackdrops(retention, item, rows, images)
+	}
+	if !sameItemBackdrops(rows, planned) {
 		rows, err = s.itemBackdropRepo.Replace(ctx, item.ContentID, planned)
 		if err != nil {
 			slog.WarnContext(ctx, "metadata: storing item backdrops failed", "component", "metadata",
diff --git a/internal/metadata/item_extra_artwork_backfill_db_test.go b/internal/metadata/item_extra_artwork_backfill_db_test.go
index cde9c67f2d..fe8c2bd525 100644
--- a/internal/metadata/item_extra_artwork_backfill_db_test.go
+++ b/internal/metadata/item_extra_artwork_backfill_db_test.go
@@ -56,6 +56,9 @@ func TestItemOnlyArtworkBackfillAndRepairDB(t *testing.T) {
 			}
 			jobs[imageType] = source
 		}
+		if err := rows.Err(); err != nil {
+			t.Fatalf("list jobs: %v", err)
+		}
 		return jobs
 	}
 
diff --git a/internal/metadata/item_extra_artwork_test.go b/internal/metadata/item_extra_artwork_test.go
index 3fb952f694..fb76035797 100644
--- a/internal/metadata/item_extra_artwork_test.go
+++ b/internal/metadata/item_extra_artwork_test.go
@@ -143,7 +143,7 @@ func TestPendingItemOnlyArtworkKeepsItsSource(t *testing.T) {
 		item := &models.MediaItem{}
 		carryItemOnlyArtwork(item, existing)
 		applyBestImages(item, nil, MergeFillEmpty, "en")
-		prepareItemImagesForQueue(item, existing)
+		prepareItemImagesForQueue(item, existing, true)
 		if item.BannerSourcePath != pending || item.BannerPath != "" {
 			t.Fatalf("banner = %q from %q, want the pending source kept", item.BannerPath, item.BannerSourcePath)
 		}
@@ -155,7 +155,7 @@ func TestPendingItemOnlyArtworkKeepsItsSource(t *testing.T) {
 		const remote = "https://img.example/de-poster.jpg"
 		existing := &models.MediaItem{PosterSourcePath: remote}
 		item := &models.MediaItem{PosterSourcePath: remote}
-		prepareItemImagesForQueue(item, existing)
+		prepareItemImagesForQueue(item, existing, true)
 		if item.PosterSourcePath != "" {
 			t.Fatalf("poster source = %q, want it cleared", item.PosterSourcePath)
 		}
@@ -532,6 +532,20 @@ func TestSyncItemExtraBackdropsStoresRowsAndQueuesJobs(t *testing.T) {
 			t.Fatalf("cached row requeued: %+v", in)
 		}
 	}
+
+	// Extra backdrops are local art only: with caching off the item keeps
+	// none, unless its artwork is locked.
+	service.SetAutoCacheImages(false)
+	locked := *item
+	locked.LockedFields = []int{int(FieldImages)}
+	_ = service.syncItemExtraBackdrops(ctx, itemRetention(ctx), &locked, nil, nil)
+	if len(repo.rows["movie-1"]) != 2 {
+		t.Fatalf("locked item rows with caching off = %+v, want both kept", repo.rows["movie-1"])
+	}
+	_ = service.syncItemExtraBackdrops(ctx, itemRetention(ctx), item, nil, images)
+	if len(repo.rows["movie-1"]) != 0 {
+		t.Fatalf("rows with caching off = %+v, want none", repo.rows["movie-1"])
+	}
 }
 
 func TestMergeAndPersistKeepsExtraArtworkThroughLocalizationWrite(t *testing.T) {
diff --git a/internal/metadata/local_artwork_copy.go b/internal/metadata/local_artwork_copy.go
index 3eb0e504aa..5c511e2dc1 100644
--- a/internal/metadata/local_artwork_copy.go
+++ b/internal/metadata/local_artwork_copy.go
@@ -18,7 +18,8 @@ import (
 )
 
 // Local sidecar artwork is copied into the artwork store by the process that
-// discovered it. Only api and integrated processes run metadata refreshes and
+// discovered it, while metadata.cache_images is on; with it off no local art is
+// selected or copied. Only api and integrated processes run metadata refreshes and
 // the image cache, and a refresh can only discover a sidecar it can read, so
 // the discovering process is one that sees the library mount. The queue keeps
 // each job for retries, which any server may claim.
@@ -68,6 +69,11 @@ func (p *ImageCacheProcessor) CopyLocalArtwork(ctx context.Context, inputs []Enq
 	if p == nil || p.cacher == nil {
 		return errNoLocalArtworkQueue
 	}
+	if !p.enabled.Load() {
+		// The caller queues the artwork instead; a drain copies it once
+		// caching is on.
+		return errLocalArtworkCachingOff
+	}
 	store, ok := p.jobs.(localArtworkJobStore)
 	if !ok {
 		return errNoLocalArtworkQueue
@@ -131,6 +137,10 @@ func (p *ImageCacheProcessor) copyDiscoveredLocalArtwork(store localArtworkJobSt
 		return
 	}
 	defer release()
+	if !p.enabled.Load() {
+		// Caching went off while the slot waited; the job stays queued.
+		return
+	}
 	ctx, cancel := context.WithTimeout(context.Background(), ImageCacheJobTimeout)
 	defer cancel()
 	// A token per claim: when a refresh replaces the slot's source while an
@@ -202,7 +212,7 @@ func nearestExistingFolderListsEntries(ctx context.Context, dir string, roots []
 		probe := rootcheck.ProbeWithTimeout(ctx, dir, rootcheck.DefaultProbeTimeout)
 		switch {
 		case probe.Reachable:
-			if _, err := localImagePathResolvedWithinRoots(dir, roots); errors.Is(err, errLocalImageOutsideRoots) {
+			if _, _, err := localImagePathResolvedWithinRoots(dir, roots); errors.Is(err, errLocalImageOutsideRoots) {
 				return true
 			}
 			return !probe.Empty
diff --git a/internal/metadata/local_artwork_copy_db_test.go b/internal/metadata/local_artwork_copy_db_test.go
index a4f5ba907c..4e148e0e2a 100644
--- a/internal/metadata/local_artwork_copy_db_test.go
+++ b/internal/metadata/local_artwork_copy_db_test.go
@@ -245,11 +245,11 @@ func TestLocalArtworkCopiedOnDiscoveryDB(t *testing.T) {
 
 		// A manual refresh of the target does not make it due for other
 		// drains, but claims it itself.
-		if err := repo.retryTargetNow(ctx, seriesID, false); err != nil {
+		if err := repo.retryTargetNow(ctx, seriesID); err != nil {
 			t.Fatalf("retryTargetNow: %v", err)
 		}
 		assertHeld(t, "after a manual refresh's retry")
-		jobs, err := repo.claimDueForTarget(ctx, "refreshing-server", seriesID, false, 10)
+		jobs, err := repo.claimDueForTarget(ctx, "refreshing-server", seriesID, 10)
 		if err != nil || len(jobs) != 1 {
 			t.Fatalf("refresh claim = %d jobs, %v; want the held job", len(jobs), err)
 		}
@@ -353,8 +353,6 @@ func TestLocalArtworkCopiedOnDiscoveryDB(t *testing.T) {
 
 	t.Run("copied by the discovering process", func(t *testing.T) {
 		p, targets, cacher := newLocalArtworkDBProcessor(pool, []string{root})
-		// Remote caching off changes nothing for local art.
-		p.SetEnabled(false)
 		if err := p.CopyLocalArtwork(ctx, inputs); err != nil {
 			t.Fatalf("CopyLocalArtwork: %v", err)
 		}
@@ -418,7 +416,7 @@ func TestLocalArtworkRetriesWithoutLibraryRootDB(t *testing.T) {
 		`, contentID); err != nil {
 			t.Fatalf("make job due: %v", err)
 		}
-		jobs, err := repo.claimDueForTarget(ctx, "mountless-server", contentID, false, 1)
+		jobs, err := repo.claimDueForTarget(ctx, "mountless-server", contentID, 1)
 		if err != nil || len(jobs) != 1 {
 			t.Fatalf("claim = %d jobs, %v; want 1", len(jobs), err)
 		}
@@ -499,7 +497,7 @@ func TestLocalArtworkRetriesWithoutLibraryRootDB(t *testing.T) {
 		// A manual refresh starts the deferral over, so refreshing on this
 		// server does not push the job to the long delay; also when the
 		// deferral had already run out.
-		if err := repo.retryTargetNow(ctx, contentID, false); err != nil {
+		if err := repo.retryTargetNow(ctx, contentID); err != nil {
 			t.Fatalf("retryTargetNow: %v", err)
 		}
 		assertDeferred(t, claimAndProcess(t, contentID, []string{root}))
@@ -508,7 +506,7 @@ func TestLocalArtworkRetriesWithoutLibraryRootDB(t *testing.T) {
 		`, contentID); err != nil {
 			t.Fatalf("let the deferral run out: %v", err)
 		}
-		if err := repo.retryTargetNow(ctx, contentID, false); err != nil {
+		if err := repo.retryTargetNow(ctx, contentID); err != nil {
 			t.Fatalf("retryTargetNow: %v", err)
 		}
 		assertDeferred(t, claimAndProcess(t, contentID, []string{root}))
@@ -557,42 +555,3 @@ func TestLocalArtworkRetriesWithoutLibraryRootDB(t *testing.T) {
 		assertStableFailure(t, run(t, []string{root}, "file://"+filepath.Join(root, "Art", "poster.jpg")+"?v=12-1700000000"), "local image missing")
 	})
 }
-
-// TestLocalImageCacheClaimUsesLocalDueIndexDB pins the plan of the drain's
-// local-only claim, which runs while metadata.cache_images is off. Remote jobs
-// queued before caching was turned off stay due and unclaimed; the partial
-// index keeps the claim from reading them on every drain.
-func TestLocalImageCacheClaimUsesLocalDueIndexDB(t *testing.T) {
-	pool := imageCacheQueueTestPool(t)
-	ctx := t.Context()
-	tx, err := pool.Begin(ctx)
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer func() { _ = tx.Rollback(ctx) }()
-	prefix := fmt.Sprintf("local-due-plan-%d", time.Now().UnixNano())
-	if _, err := tx.Exec(ctx, `
-		INSERT INTO metadata_image_cache_jobs (
-			target_type, target_content_id, target_language, series_id, source_path,
-			provider_id, provider_content_id, content_type, image_type, status,
-			attempt_count, next_attempt_at, locked_by, last_error, created_at, updated_at
-		)
-		SELECT 'item', $1 || '-' || g, '', $1 || '-' || g,
-			CASE WHEN g % 1000 = 0 THEN 'file:///media/' || g || '/poster.jpg' ELSE 'https://img.example/' || g || '.jpg' END,
-			'tmdb', g::text, 'movie', 'poster', 'queued', 0, NOW() - interval '1 minute', '', '', NOW(), NOW()
-		FROM generate_series(1, 20000) g
-	`, prefix); err != nil {
-		t.Fatalf("seed queue: %v", err)
-	}
-	if _, err := tx.Exec(ctx, `ANALYZE metadata_image_cache_jobs`); err != nil {
-		t.Fatalf("analyze: %v", err)
-	}
-	results, err := tx.Conn().PgConn().Exec(ctx, `EXPLAIN (GENERIC_PLAN, FORMAT JSON) `+claimDueQuery(false, true)).ReadAll()
-	if err != nil || len(results) != 1 || len(results[0].Rows) != 1 {
-		t.Fatalf("explain local claim: %v", err)
-	}
-	raw := string(results[0].Rows[0][0])
-	if !strings.Contains(raw, `"Index Name": "metadata_image_cache_jobs_local_due_idx"`) {
-		t.Fatalf("local claim does not use metadata_image_cache_jobs_local_due_idx: %s", raw)
-	}
-}
diff --git a/internal/metadata/local_artwork_copy_test.go b/internal/metadata/local_artwork_copy_test.go
index ac90a78eb3..4a8a122823 100644
--- a/internal/metadata/local_artwork_copy_test.go
+++ b/internal/metadata/local_artwork_copy_test.go
@@ -14,31 +14,24 @@ import (
 	"github.com/prairie-server/prairie-server/internal/rootcheck"
 )
 
-// localClaimingImageCacheJobs records which claim a drain used.
-type localClaimingImageCacheJobs struct {
+// claimCountingImageCacheJobs counts drain claims.
+type claimCountingImageCacheJobs struct {
 	fakeLocalImageCacheJobs
-	claimCalls      int
-	localClaimCalls int
+	claimCalls int
 }
 
-func (f *localClaimingImageCacheJobs) ClaimDue(ctx context.Context, workerID string, limit int) ([]*models.MetadataImageCacheJob, error) {
+func (f *claimCountingImageCacheJobs) ClaimDue(ctx context.Context, workerID string, limit int) ([]*models.MetadataImageCacheJob, error) {
 	f.claimCalls++
 	return f.fakeLocalImageCacheJobs.ClaimDue(ctx, workerID, limit)
 }
 
-func (f *localClaimingImageCacheJobs) ClaimDueLocal(ctx context.Context, workerID string, limit int) ([]*models.MetadataImageCacheJob, error) {
-	f.localClaimCalls++
-	claimed := f.claimed
-	f.claimed = nil
-	return claimed, nil
-}
-
-// With metadata.cache_images off, draining still copies local artwork: it
-// claims local jobs only, and the provider-artwork backfill stays refused.
-func TestImageCacheProcessorDrainsLocalArtworkWithCachingOff(t *testing.T) {
+// With metadata.cache_images off, draining caches nothing, local artwork
+// included: it claims no jobs, and the provider-artwork backfill stays
+// refused.
+func TestImageCacheProcessorDrainsNothingWithCachingOff(t *testing.T) {
 	root := t.TempDir()
 	job := localArtworkJob("file://" + writeLocalPoster(t, root))
-	jobs := &localClaimingImageCacheJobs{fakeLocalImageCacheJobs: fakeLocalImageCacheJobs{
+	jobs := &claimCountingImageCacheJobs{fakeLocalImageCacheJobs: fakeLocalImageCacheJobs{
 		fakeImageCacheJobs: fakeImageCacheJobs{claimed: []*models.MetadataImageCacheJob{job}},
 	}}
 	items := &fakeItemArtworkUpdater{updated: true}
@@ -50,23 +43,20 @@ func TestImageCacheProcessorDrainsLocalArtworkWithCachingOff(t *testing.T) {
 	if err != nil {
 		t.Fatalf("DrainUntilIdle: %v", err)
 	}
-	if jobs.claimCalls != 0 || jobs.localClaimCalls == 0 {
-		t.Fatalf("claims all=%d local=%d, want local claims only", jobs.claimCalls, jobs.localClaimCalls)
+	if jobs.claimCalls != 0 || stats.Claimed != 0 || items.cachedPath != "" {
+		t.Fatalf("claims=%d stats=%+v cached=%q, want nothing claimed or copied", jobs.claimCalls, stats, items.cachedPath)
 	}
-	if stats.Succeeded != 1 || jobs.succeededID != job.ID || items.cachedPath == "" {
-		t.Fatalf("stats=%+v succeeded=%d cached=%q, want the local poster copied", stats, jobs.succeededID, items.cachedPath)
-	}
-	if !p.ArtworkCachingEnabled() {
-		t.Fatal("ArtworkCachingEnabled = false, want true: local artwork is cached with caching off")
+	if p.ArtworkCachingEnabled() {
+		t.Fatal("ArtworkCachingEnabled = true, want false with caching off")
 	}
 	if _, err := p.RunUntilIdle(context.Background(), "w1", 10, 1, 0, nil); !errors.Is(err, ErrImageCachingDisabled) {
 		t.Fatalf("backfill error = %v, want ErrImageCachingDisabled", err)
 	}
 }
 
-// Disabling caching while a claimed page is in flight stops remote jobs from
-// starting but lets local jobs finish.
-func TestImageCacheProcessorKeepsLocalJobsWhenCachingTurnsOff(t *testing.T) {
+// Disabling caching while a claimed page is in flight stops every job from
+// starting, local ones too; they go back to the queue.
+func TestImageCacheProcessorRequeuesClaimedJobsWhenCachingTurnsOff(t *testing.T) {
 	root := t.TempDir()
 	local := localArtworkJob("file://" + writeLocalPoster(t, root))
 	remote := &models.MetadataImageCacheJob{
@@ -79,25 +69,24 @@ func TestImageCacheProcessorKeepsLocalJobsWhenCachingTurnsOff(t *testing.T) {
 	p.SetEnabled(false)
 
 	stats := p.processClaimedJobs(context.Background(), "w1", []*models.MetadataImageCacheJob{remote, local}, 1, time.Now())
-	if stats.Succeeded != 1 || jobs.succeededID != local.ID {
-		t.Fatalf("stats=%+v succeeded=%d, want the local job processed", stats, jobs.succeededID)
+	if stats.Succeeded != 0 || jobs.succeededID != 0 {
+		t.Fatalf("stats=%+v succeeded=%d, want nothing processed", stats, jobs.succeededID)
 	}
-	if len(jobs.requeuedIDs) != 1 || jobs.requeuedIDs[0] != remote.ID {
-		t.Fatalf("requeued = %v, want the remote job %d", jobs.requeuedIDs, remote.ID)
+	if !slices.Equal(jobs.requeuedIDs, []int64{remote.ID, local.ID}) {
+		t.Fatalf("requeued = %v, want both jobs %d and %d", jobs.requeuedIDs, remote.ID, local.ID)
 	}
 }
 
-// A manual refresh with caching off still waits for its local artwork, and
-// asks the queue for local jobs only.
-func TestCacheTargetArtworkHandlesLocalOnlyWithCachingOff(t *testing.T) {
-	jobs := &targetImageCacheJobs{localOnly: true}
+// A manual refresh with caching off caches nothing and does not wait.
+func TestCacheTargetArtworkDoesNothingWithCachingOff(t *testing.T) {
+	jobs := &targetImageCacheJobs{}
 	p := NewImageCacheProcessor(jobs, &fakeImageCacher{}, &fakeImageResolver{}, nil, nil)
 	p.SetEnabled(false)
 	if err := p.CacheTargetArtwork(context.Background(), "movie-1"); err != nil {
 		t.Fatalf("CacheTargetArtwork: %v", err)
 	}
-	if jobs.retryCalls != 1 || jobs.targetCalls == 0 || !jobs.localOnly {
-		t.Fatalf("retry=%d claims=%d localOnly=%v, want one local-only retry and claim", jobs.retryCalls, jobs.targetCalls, jobs.localOnly)
+	if jobs.retryCalls != 0 || jobs.targetCalls != 0 {
+		t.Fatalf("retry=%d claims=%d, want no queue access", jobs.retryCalls, jobs.targetCalls)
 	}
 }
 
@@ -158,9 +147,9 @@ func TestCacheTargetArtworkNotPendingOnceADeferredJobIsCopied(t *testing.T) {
 	}
 }
 
-// A pending image URL an NFO names is not kept with caching off, even while
-// the NFO is unreadable: only the image cache could fetch it, so the slot
-// takes the provider poster. With caching on it is kept.
+// A pending image URL an NFO names is not kept with caching off: only the
+// image cache could fetch it, so the slot takes the provider poster. With
+// caching on it is kept while the NFO is unreadable.
 func TestPendingNFONamedURLNotKeptWithCachingOff(t *testing.T) {
 	const (
 		contentID    = "movie:tmdb:7"
@@ -179,7 +168,11 @@ func TestPendingNFONamedURLNotKeptWithCachingOff(t *testing.T) {
 			h := newTestHarness()
 			h.service.SetImageCacheJobEnqueuer(&recordingImageCacheJobEnqueuer{})
 			h.service.SetAutoCacheImages(tc.caching)
-			ctx := withLocalMetadataUnreadable(withLocalArtworkSearched(context.Background(), localArtworkItem), localArtworkItem)
+			// A refresh searches local artwork only while it is usable.
+			ctx := context.Background()
+			if tc.caching {
+				ctx = withLocalMetadataUnreadable(withLocalArtworkSearched(ctx, localArtworkItem), localArtworkItem)
+			}
 			if err := h.itemRepo.Upsert(ctx, &models.MediaItem{
 				ContentID: contentID, Type: "movie", Title: "Film", Status: "matched", TmdbID: "7",
 				PosterSourcePath: nfoPoster,
@@ -282,11 +275,11 @@ func (failingLocalArtworkCopier) CopyLocalArtwork(context.Context, []EnqueueImag
 }
 
 // When the copier cannot take the artwork, the refresh queues it instead, so
-// any server's drain still copies it; with caching off nothing remote is
-// queued alongside it.
+// any server's drain still copies it.
 func TestLocalArtworkFallsBackToQueueWhenCopierFails(t *testing.T) {
 	jobs := &capturingImageJobEnqueuer{}
 	s := &MetadataService{imageCacheJobs: jobs}
+	s.SetAutoCacheImages(true)
 	s.SetLocalArtworkCopier(failingLocalArtworkCopier{})
 	if err := s.enqueueImageCacheJobs(context.Background(), "item", "movie-1", []EnqueueImageCacheJobInput{
 		{TargetType: ImageCacheTargetItem, TargetContentID: "movie-1", ImageType: ImageCacheImagePoster, SourcePath: "file:///media/Film/poster.jpg"},
@@ -294,8 +287,8 @@ func TestLocalArtworkFallsBackToQueueWhenCopierFails(t *testing.T) {
 	}); err != nil {
 		t.Fatalf("enqueueImageCacheJobs: %v", err)
 	}
-	if len(jobs.inputs) != 1 || jobs.inputs[0].ImageType != ImageCacheImagePoster {
-		t.Fatalf("queued = %#v, want only the local poster", jobs.inputs)
+	if len(jobs.inputs) != 2 || jobs.inputs[0].ImageType != ImageCacheImagePoster {
+		t.Fatalf("queued = %#v, want the local poster and the remote backdrop", jobs.inputs)
 	}
 }
 
@@ -311,6 +304,7 @@ func TestOnlyVisibleLocalArtworkGoesToTheCopier(t *testing.T) {
 	jobs := &capturingImageJobEnqueuer{}
 	copier := &recordingLocalArtworkCopier{}
 	s := &MetadataService{imageCacheJobs: jobs}
+	s.SetAutoCacheImages(true)
 	s.SetLocalArtworkCopier(copier)
 	if err := s.enqueueImageCacheJobs(context.Background(), "item", "movie-1", []EnqueueImageCacheJobInput{
 		{TargetType: ImageCacheTargetItem, TargetContentID: "movie-1", ImageType: ImageCacheImagePoster, SourcePath: seen},
@@ -700,6 +694,18 @@ func TestCacheTargetArtworkReturnsCancellation(t *testing.T) {
 	}
 }
 
+// disablingTargetImageCacheJobs runs afterClaim once a target page is claimed.
+type disablingTargetImageCacheJobs struct {
+	targetImageCacheJobs
+	afterClaim func()
+}
+
+func (f *disablingTargetImageCacheJobs) claimDueForTarget(ctx context.Context, workerID, targetContentID string, limit int) ([]*models.MetadataImageCacheJob, error) {
+	jobs, err := f.targetImageCacheJobs.claimDueForTarget(ctx, workerID, targetContentID, limit)
+	f.afterClaim()
+	return jobs, err
+}
+
 // A manual refresh whose claimed page makes no progress leaves it to the
 // background drain and reports the artwork as pending, rather than claiming
 // the same jobs again.
@@ -709,10 +715,11 @@ func TestCacheTargetArtworkStopsWhenAPageMakesNoProgress(t *testing.T) {
 		ProviderID: "tmdb", ProviderContentID: "1", ContentType: "movies", ImageType: ImageCacheImagePoster,
 	}
 	page := []*models.MetadataImageCacheJob{remote}
-	jobs := &targetImageCacheJobs{targetClaims: [][]*models.MetadataImageCacheJob{page, page, page}}
+	jobs := &disablingTargetImageCacheJobs{targetImageCacheJobs: targetImageCacheJobs{targetClaims: [][]*models.MetadataImageCacheJob{page, page, page}}}
 	p := NewImageCacheProcessor(jobs, &fakeImageCacher{}, &fakeImageResolver{}, nil, nil)
-	// Remote jobs do not start while caching is off, so the page goes back.
-	p.SetEnabled(false)
+	// Caching goes off once the page is claimed, so no job starts and the
+	// page goes back.
+	jobs.afterClaim = func() { p.SetEnabled(false) }
 	if err := p.CacheTargetArtwork(context.Background(), "movie-1"); !errors.Is(err, ErrTargetArtworkPending) {
 		t.Fatalf("CacheTargetArtwork error = %v, want ErrTargetArtworkPending", err)
 	}
@@ -745,6 +752,7 @@ func TestRefreshWithoutTheMountKeepsPendingLocalArtwork(t *testing.T) {
 			h := newTestHarness()
 			enqueuer := &recordingImageCacheJobEnqueuer{}
 			h.service.SetImageCacheJobEnqueuer(enqueuer)
+			h.service.SetAutoCacheImages(true)
 			ctx := withLocalArtworkSearched(context.Background(), localArtworkItem)
 			if err := h.itemRepo.Upsert(ctx, &models.MediaItem{
 				ContentID: contentID, Type: "movie", Title: "Film", Status: "matched", TmdbID: "7",
@@ -807,6 +815,7 @@ func TestItemLeftOnItsStandInKeepsPendingLocalSource(t *testing.T) {
 			h := newTestHarness()
 			enqueuer := &recordingImageCacheJobEnqueuer{}
 			h.service.SetImageCacheJobEnqueuer(enqueuer)
+			h.service.SetAutoCacheImages(true)
 			ctx := context.Background()
 			if tc.searched {
 				ctx = withLocalArtworkSearched(ctx, localArtworkItem)
@@ -931,3 +940,46 @@ func TestPersistSeasonsAndEpisodesWithoutTheMountKeepsPendingLocalArtwork(t *tes
 		})
 	}
 }
+
+// With caching off a fill-empty refresh replaces a stored copy only with a
+// provider image; a slot nothing fills keeps its copy, a stored clear-art
+// logo included, rather than being emptied.
+func TestCachingOffKeepsStoredArtworkNoProviderFills(t *testing.T) {
+	const (
+		contentID    = "movie:tmdb:7"
+		storedPoster = "tmdb/movies/7/poster/original.r1.webp"
+		storedLogo   = "tmdb/movies/7/logo/original.r1.webp"
+		remotePoster = "tmdb://remote-poster.jpg"
+	)
+	h := newTestHarness()
+	h.service.SetImageCacheJobEnqueuer(&recordingImageCacheJobEnqueuer{})
+	ctx := context.Background()
+	if err := h.itemRepo.Upsert(ctx, &models.MediaItem{
+		ContentID: contentID, Type: "movie", Title: "Film", Status: "matched", TmdbID: "7",
+		PosterPath: storedPoster, PosterSourcePath: "file:///m/Film/poster.jpg?v=1-1",
+		LogoPath: storedLogo, LogoSourcePath: "https://img.example/clearart/film.png",
+		Studios: []string{}, Networks: []string{}, Countries: []string{}, Genres: []string{},
+	}); err != nil {
+		t.Fatalf("upsert existing item: %v", err)
+	}
+	providerRepo := newFakeProviderIDRepo()
+	providerRepo.set(contentID, &models.MediaItemProviderID{ContentID: contentID, ItemType: "movie", Provider: "tmdb", ProviderID: "7"})
+	h.service.providerIDRepo = providerRepo
+
+	if _, err := h.service.mergeAndPersist(ctx, ProcessRequest{ContentID: contentID, Mode: ModeScheduledRefresh, Language: "en"},
+		&MetadataResult{HasMetadata: true, Title: "Film", ProviderIDs: map[string]string{"tmdb": "7"}},
+		[]RemoteImage{{Type: ImagePoster, URL: remotePoster, ProviderID: "tmdb", Language: "en"}},
+		nil, nil, "movie"); err != nil {
+		t.Fatalf("mergeAndPersist: %v", err)
+	}
+	got, err := h.itemRepo.GetByID(ctx, contentID)
+	if err != nil {
+		t.Fatalf("load item: %v", err)
+	}
+	if got.PosterPath != remotePoster || got.PosterSourcePath != remotePoster {
+		t.Errorf("poster = %q/%q, want the unrated provider poster for both", got.PosterPath, got.PosterSourcePath)
+	}
+	if got.LogoPath != storedLogo {
+		t.Errorf("logo = %q, want the stored copy kept", got.LogoPath)
+	}
+}
diff --git a/internal/metadata/local_artwork_nfo_url_test.go b/internal/metadata/local_artwork_nfo_url_test.go
index bb5f906425..f412296641 100644
--- a/internal/metadata/local_artwork_nfo_url_test.go
+++ b/internal/metadata/local_artwork_nfo_url_test.go
@@ -9,11 +9,11 @@ import (
 	"github.com/prairie-server/prairie-server/internal/metadata/nfo"
 )
 
-// With Keep provider artwork off, an image URL an NFO names is not used: only
-// the image cache's download may fetch it. The slot takes the remote
-// provider's artwork, served directly, while local files, a sidecar or one the
-// NFO names, still win their slots.
-func TestNFONamedURLNeedsImageCaching(t *testing.T) {
+// With Keep provider artwork off, no local artwork is used: not a sidecar, not
+// a file the NFO names, and not an image URL it names. The slots take the
+// remote provider's artwork, served directly, or stay empty when no provider
+// has any, and nothing is queued.
+func TestLocalArtworkNeedsImageCaching(t *testing.T) {
 	dir := filepath.Join(t.TempDir(), "Movies", "Art Film (2001)")
 	movie := filepath.Join(dir, "Art Film (2001).mkv")
 	writeFixtureFile(t, movie, "video")
@@ -53,19 +53,18 @@ func TestNFONamedURLNeedsImageCaching(t *testing.T) {
 	if err != nil {
 		t.Fatalf("item: %v", err)
 	}
-	if want := filepath.Join(dir, "poster.jpg"); localSourceFile(t, item.PosterSourcePath) != want {
-		t.Errorf("poster source = %q, want the sidecar %q", item.PosterSourcePath, want)
-	}
-	if want := filepath.Join(dir, "art", "backdrop.jpg"); localSourceFile(t, item.BackdropSourcePath) != want {
-		t.Errorf("backdrop source = %q, want the NFO-named file %q", item.BackdropSourcePath, want)
+	if item.PosterPath != "" || item.PosterSourcePath != "" || item.BackdropPath != "" || item.BackdropSourcePath != "" {
+		t.Errorf("poster = %q/%q, backdrop = %q/%q; want both empty, as no provider has any",
+			item.PosterPath, item.PosterSourcePath, item.BackdropPath, item.BackdropSourcePath)
 	}
 	if item.LogoSourcePath != "https://image.tmdb.org/logo.png" || item.LogoPath != "https://image.tmdb.org/logo.png" {
 		t.Errorf("logo = path %q source %q, want the provider's logo served directly", item.LogoPath, item.LogoSourcePath)
 	}
-	for _, job := range x.EnqueuedImageJobs() {
-		if job.SourcePath == "nfo+https://img.example.org/nfo-logo.png" {
-			t.Errorf("queued the NFO-named URL with caching off: %+v", job)
-		}
+	if item.Title != "Art Film" {
+		t.Errorf("title = %q, want the NFO title", item.Title)
+	}
+	if jobs := x.EnqueuedImageJobs(); len(jobs) != 0 {
+		t.Errorf("queued %+v, want nothing with caching off", jobs)
 	}
 }
 
diff --git a/internal/metadata/local_artwork_picker.go b/internal/metadata/local_artwork_picker.go
new file mode 100644
index 0000000000..d61678a265
--- /dev/null
+++ b/internal/metadata/local_artwork_picker.go
@@ -0,0 +1,210 @@
+package metadata
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"log/slog"
+	"slices"
+
+	"github.com/prairie-server/prairie-server/internal/imageutil"
+	"github.com/prairie-server/prairie-server/internal/logredact"
+)
+
+// localArtworkPreviewWidth matches the "card" width the admin picker shows
+// provider choices at.
+const localArtworkPreviewWidth = 300
+
+// LocalImageProviderID labels local sidecar choices in the admin image list
+// and keys their failures in its provider errors.
+const LocalImageProviderID = imageCacheLocalProviderID
+
+// localArtworkCapabilityID is the built-in provider that discovers sidecar
+// artwork next to an item's files.
+const localArtworkCapabilityID = "nfo"
+
+// pickableLocalImageTypes are the image types an admin can apply to a movie
+// or series. Discovery also finds banners, thumbs, clear art and disc art,
+// which the picker cannot apply, so it does not offer or preview them.
+var pickableLocalImageTypes = []ImageType{ImagePoster, ImageBackdrop, ImageLogo}
+
+// ErrLocalImageNotOffered rejects a local image the item's own discovery did
+// not return, so the apply endpoint cannot be used to read arbitrary files.
+var ErrLocalImageNotOffered = errors.New("local image is not one of the item's local images")
+
+// IsLocalImageSource reports whether an image URL names a local sidecar file
+// (file://). An image URL an NFO names (nfo+http(s)://) is not one: it has no
+// file to preview or copy.
+func IsLocalImageSource(url string) bool {
+	_, ok := localImageSourceFilePath(url)
+	return ok
+}
+
+// FetchItemImagesWithLocal is FetchItemImages plus the item's local sidecar
+// artwork. Local choices come only from Prairie's own sidecar discovery, run
+// whether or not the library's metadata chain uses the NFO provider: a
+// file:// URL from any provider in the chain is dropped, so a provider cannot
+// get an arbitrary library file offered as this item's artwork.
+func (s *MetadataService) FetchItemImagesWithLocal(ctx context.Context, providerIDs map[string]string, contentType string, language string, folderID int, contentID string) ([]RemoteImage, map[string]string, error) {
+	images, providerErrors, err := s.FetchItemImages(ctx, providerIDs, contentType, language, folderID)
+	if err != nil {
+		// Sidecar discovery does not use the chain, so a chain failure still
+		// lists the item's local artwork and reports the failure.
+		slog.WarnContext(ctx, "metadata: image provider chain unavailable for picker", "component", "metadata", "folder_id", folderID, "error", logredact.SanitizeText(err.Error()))
+		images, providerErrors = nil, map[string]string{"chain": "Image provider chain unavailable"}
+	}
+	images = slices.DeleteFunc(images, func(image RemoteImage) bool {
+		return isLocalImageSourcePath(image.URL)
+	})
+	local, err := s.localItemImages(ctx, contentType, folderID, contentID)
+	if err != nil {
+		// The error can carry paths and provider text, so the listing only says
+		// which source failed, and the log keeps the text with any credential
+		// assignments masked.
+		slog.WarnContext(ctx, "metadata: local artwork discovery failed for picker", "component", "metadata", "folder_id", folderID, "content_id", contentID, "error", logredact.SanitizeText(err.Error()))
+		if providerErrors == nil {
+			providerErrors = map[string]string{}
+		}
+		providerErrors[LocalImageProviderID] = "Local artwork discovery failed"
+	}
+	return append(images, local...), providerErrors, nil
+}
+
+// localItemImages runs sidecar discovery for an item with its media files and
+// sidecar directories, finding the same poster, backdrop and logo files a
+// refresh would use. It keeps sidecar files only: an image URL an NFO names
+// has no file to preview or copy here.
+func (s *MetadataService) localItemImages(ctx context.Context, contentType string, folderID int, contentID string) ([]RemoteImage, error) {
+	discovery := s.localImageProvider
+	if discovery == nil {
+		provider, ok := builtinProvider(localArtworkCapabilityID)
+		if !ok {
+			return nil, nil
+		}
+		if discovery, ok = provider.(ImageProvider); !ok {
+			return nil, nil
+		}
+	}
+	// A failure to read the item's files is reported rather than read as an
+	// item without sidecars.
+	localCtx, err := s.loadLocalProviderContext(ctx, contentID, folderID)
+	if err != nil {
+		return nil, err
+	}
+	if localCtx.representativeFilePath == "" && len(localCtx.primarySidecarSearchPaths) == 0 {
+		return nil, nil
+	}
+	images, err := discovery.GetImages(ctx, ImageRequest{
+		ContentType:               contentType,
+		RepresentativeFilePath:    localCtx.representativeFilePath,
+		AllGroupFilePaths:         localCtx.allGroupFilePaths,
+		PrimarySidecarSearchPaths: localCtx.primarySidecarSearchPaths,
+	})
+	if err != nil {
+		return nil, err
+	}
+	return slices.DeleteFunc(images, func(image RemoteImage) bool {
+		return !IsLocalImageSource(image.URL) || !slices.Contains(pickableLocalImageTypes, image.Type)
+	}), nil
+}
+
+// LocalImagePreview returns a small WebP data URI of a local sidecar image for
+// the admin picker. The file is read under the same library-root confinement,
+// symlink and size checks as background caching.
+func (s *MetadataService) LocalImagePreview(ctx context.Context, contentID string, sourceURL string) (string, error) {
+	data, err := s.readLocalSidecar(ctx, contentID, sourceURL)
+	if err != nil {
+		return "", err
+	}
+	preview, err := imageutil.EncodeWebPWidth(data, localArtworkPreviewWidth)
+	if err != nil {
+		return "", err
+	}
+	return "data:image/webp;base64," + base64.StdEncoding.EncodeToString(preview), nil
+}
+
+// readLocalSidecar reads a file:// sidecar source of contentID, without its
+// fingerprint, under the library-root confinement of readConfinedLocalImage.
+func (s *MetadataService) readLocalSidecar(ctx context.Context, contentID, source string) ([]byte, error) {
+	if s.libraryRoots == nil {
+		return nil, errors.New("missing library root resolver for local artwork")
+	}
+	localPath, ok := localImageSourceFilePath(source)
+	if !ok {
+		return nil, fmt.Errorf("not a local image source: %q", source)
+	}
+	roots, err := s.libraryRoots.LibraryRootsForContent(ctx, contentID)
+	if err != nil {
+		return nil, fmt.Errorf("resolving library roots: %w", err)
+	}
+	return readConfinedLocalImage(localPath, roots)
+}
+
+// ApplyLocalItemImageRequest describes a local sidecar image an admin chose
+// for a movie or series.
+type ApplyLocalItemImageRequest struct {
+	ContentID   string
+	ContentType string // "movie" or "series"
+	FolderID    int
+	ImageType   ImageType
+	SourceURL   string // a file:// choice returned by FetchItemImagesWithLocal
+}
+
+// ApplyLocalItemImage caches a local sidecar image the item's own discovery
+// offers. It stores the image under the same local/ key a refresh would use,
+// so a later refresh of the same file finds it already cached.
+func (s *MetadataService) ApplyLocalItemImage(ctx context.Context, req ApplyLocalItemImageRequest) (*ApplyItemImageResult, error) {
+	byteCacher, ok := s.imageCacher.(ImageByteCacher)
+	if !ok {
+		return nil, fmt.Errorf("image caching does not support local artwork")
+	}
+	if !isLocalImageSourcePath(req.SourceURL) {
+		return nil, ErrLocalImageNotOffered
+	}
+	images, err := s.localItemImages(ctx, req.ContentType, req.FolderID, req.ContentID)
+	if err != nil {
+		return nil, err
+	}
+	offered := false
+	for _, image := range images {
+		if image.URL == req.SourceURL && image.Type == req.ImageType {
+			offered = true
+			break
+		}
+	}
+	if !offered {
+		return nil, ErrLocalImageNotOffered
+	}
+
+	data, err := s.readLocalSidecar(ctx, req.ContentID, req.SourceURL)
+	if err != nil {
+		return nil, err
+	}
+	digest := sha256.Sum256(data)
+	result, err := byteCacher.CacheImageBytes(ctx, data, CacheImageRequest{
+		SourceURL:        req.SourceURL,
+		ProviderID:       imageCacheLocalProviderID,
+		ContentType:      imageCacheContentType(req.ContentType),
+		ContentID:        req.ContentID,
+		ImageType:        req.ImageType,
+		KeyDiscriminator: hex.EncodeToString(digest[:4]),
+	})
+	if err != nil {
+		return nil, fmt.Errorf("caching image: %w", err)
+	}
+	if result == nil {
+		return nil, errors.New("image cache returned no result")
+	}
+	storedPath := CachedImageOriginalPath(result)
+	if storedPath == "" {
+		return nil, errors.New("image cache returned empty stored path")
+	}
+	return &ApplyItemImageResult{
+		StoredPath: storedPath,
+		Revision:   result.Revision,
+		Thumbhash:  result.Thumbhash,
+	}, nil
+}
diff --git a/internal/metadata/local_artwork_picker_test.go b/internal/metadata/local_artwork_picker_test.go
new file mode 100644
index 0000000000..ab304abba5
--- /dev/null
+++ b/internal/metadata/local_artwork_picker_test.go
@@ -0,0 +1,401 @@
+package metadata
+
+import (
+	"bytes"
+	"cmp"
+	"context"
+	"encoding/base64"
+	"errors"
+	"image"
+	"image/color"
+	"image/png"
+	"log/slog"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/models"
+)
+
+// recordingImageProvider returns fixed images and records each request.
+type recordingImageProvider struct {
+	slug     string
+	images   []RemoteImage
+	err      error
+	requests []ImageRequest
+}
+
+func (p *recordingImageProvider) Slug() string       { return cmp.Or(p.slug, "nfo") }
+func (p *recordingImageProvider) Name() string       { return p.Slug() }
+func (p *recordingImageProvider) ForTypes() []string { return []string{"series"} }
+func (p *recordingImageProvider) GetImages(_ context.Context, req ImageRequest) ([]RemoteImage, error) {
+	p.requests = append(p.requests, req)
+	return p.images, p.err
+}
+
+const (
+	localSeriesEpisodePath = "/media/Other/Show/Season 1/Show S01E01.mkv"
+	localMoviePath         = "/media/Movies/Film/Film.mkv"
+)
+
+// newLocalPickerServiceForTest wires local as the sidecar discovery and remote
+// as the library's whole provider chain, with one media file for each of
+// "local-series-1" and "movie-1".
+func newLocalPickerServiceForTest(local ImageProvider, remote Provider, roots []string) (*MetadataService, *fakeByteImageCacher) {
+	if remote == nil {
+		remote = &recordingImageProvider{slug: "tmdb"}
+	}
+	cacher := &fakeByteImageCacher{thumbhash: "th-local"}
+	service := &MetadataService{chainCache: map[string]chainCacheEntry{
+		"7:series": {providers: []Provider{remote}, expiresAt: time.Now().Add(time.Hour)},
+		"7:movie":  {providers: []Provider{remote}, expiresAt: time.Now().Add(time.Hour)},
+	}}
+	service.localImageProvider = local
+	files := newFakeFileRepo()
+	files.contentIDs[1] = "local-series-1"
+	files.contentIDs[2] = "movie-1"
+	files.groupFiles["series"] = []*models.MediaFile{{ID: 1, FilePath: localSeriesEpisodePath, MediaFolderID: 7}}
+	files.groupFiles["movie"] = []*models.MediaFile{{ID: 2, FilePath: localMoviePath, MediaFolderID: 7}}
+	service.fileRepo = files
+	service.SetImageCacher(cacher)
+	service.SetLibraryRootResolver(&fakeLibraryRootResolver{roots: roots})
+	return service, cacher
+}
+
+func localApplyRequest(sourceURL string, imageType ImageType) ApplyLocalItemImageRequest {
+	return ApplyLocalItemImageRequest{
+		ContentID:   "local-series-1",
+		ContentType: "series",
+		FolderID:    7,
+		ImageType:   imageType,
+		SourceURL:   sourceURL,
+	}
+}
+
+// An offered local image is cached under the same local/ key a refresh of
+// that file would use, so a later refresh finds it already cached.
+func TestApplyLocalItemImageCachesOfferedFile(t *testing.T) {
+	root := t.TempDir()
+	source := "file://" + writeLocalPoster(t, root)
+	provider := &recordingImageProvider{images: []RemoteImage{{ProviderID: "nfo", URL: source, Type: ImagePoster}}}
+	service, cacher := newLocalPickerServiceForTest(provider, nil, []string{root})
+
+	result, err := service.ApplyLocalItemImage(context.Background(), localApplyRequest(source, ImagePoster))
+	if err != nil {
+		t.Fatalf("ApplyLocalItemImage: %v", err)
+	}
+	if len(cacher.bytesReq) != 1 {
+		t.Fatalf("CacheImageBytes calls = %d, want 1", len(cacher.bytesReq))
+	}
+	req := cacher.bytesReq[0]
+	if req.ProviderID != "local" || req.ContentType != "series" || req.ContentID != "local-series-1" || req.SourceURL != source || len(req.KeyDiscriminator) != 8 {
+		t.Fatalf("cache request = %+v, want the refresh path's local key", req)
+	}
+	want := "local/series/local-series-1/" + req.KeyDiscriminator + "/poster/original.webp"
+	if result.StoredPath != want || result.Thumbhash != "th-local" {
+		t.Fatalf("result = %+v, want stored path %q", result, want)
+	}
+}
+
+// The apply endpoint accepts a file:// URL from the request, so it must only
+// read files the item's own discovery offered, for the type it offered them.
+func TestApplyLocalItemImageRejectsFilesNotOffered(t *testing.T) {
+	root := t.TempDir()
+	offered := "file://" + writeLocalPoster(t, root)
+	other := filepath.Join(root, "other.jpg")
+	if err := os.WriteFile(other, []byte("other-bytes"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	provider := &recordingImageProvider{images: []RemoteImage{{ProviderID: "nfo", URL: offered, Type: ImagePoster}}}
+	service, cacher := newLocalPickerServiceForTest(provider, nil, []string{root})
+
+	for name, req := range map[string]ApplyLocalItemImageRequest{
+		"file not offered":     localApplyRequest("file://"+other, ImagePoster),
+		"offered as poster":    localApplyRequest(offered, ImageBackdrop),
+		"remote source":        localApplyRequest("https://image.example/poster.jpg", ImagePoster),
+		"relative file scheme": localApplyRequest("file://../poster.jpg", ImagePoster),
+	} {
+		if _, err := service.ApplyLocalItemImage(context.Background(), req); !errors.Is(err, ErrLocalImageNotOffered) {
+			t.Errorf("%s: err = %v, want ErrLocalImageNotOffered", name, err)
+		}
+	}
+	if len(cacher.bytesReq) != 0 {
+		t.Fatalf("cached %d images, want none", len(cacher.bytesReq))
+	}
+}
+
+// Discovery offering a file does not bypass the library-root confinement.
+func TestApplyLocalItemImageRejectsOfferedFileOutsideRoots(t *testing.T) {
+	root := t.TempDir()
+	outside := "file://" + writeLocalPoster(t, t.TempDir())
+	provider := &recordingImageProvider{images: []RemoteImage{{ProviderID: "nfo", URL: outside, Type: ImagePoster}}}
+	service, cacher := newLocalPickerServiceForTest(provider, nil, []string{root})
+
+	_, err := service.ApplyLocalItemImage(context.Background(), localApplyRequest(outside, ImagePoster))
+	if err == nil || !strings.Contains(err.Error(), "outside library roots") {
+		t.Fatalf("err = %v, want outside library roots", err)
+	}
+	if len(cacher.bytesReq) != 0 {
+		t.Fatalf("cached %d images, want none", len(cacher.bytesReq))
+	}
+}
+
+func TestLocalImagePreviewReturnsWebPDataURI(t *testing.T) {
+	root := t.TempDir()
+	poster := filepath.Join(root, "poster.png")
+	img := image.NewNRGBA(image.Rect(0, 0, 600, 900))
+	for y := range 900 {
+		for x := range 600 {
+			img.Set(x, y, color.NRGBA{R: uint8(x), G: uint8(y), B: 90, A: 255})
+		}
+	}
+	var buf bytes.Buffer
+	if err := png.Encode(&buf, img); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(poster, buf.Bytes(), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	service, _ := newLocalPickerServiceForTest(&recordingImageProvider{}, nil, []string{root})
+
+	preview, err := service.LocalImagePreview(context.Background(), "local-series-1", "file://"+poster)
+	if err != nil {
+		t.Fatalf("LocalImagePreview: %v", err)
+	}
+	encoded, ok := strings.CutPrefix(preview, "data:image/webp;base64,")
+	if !ok {
+		t.Fatalf("preview = %.40q..., want a WebP data URI", preview)
+	}
+	data, err := base64.StdEncoding.DecodeString(encoded)
+	if err != nil || len(data) < 12 || string(data[8:12]) != "WEBP" {
+		t.Fatalf("preview is not WebP (err %v)", err)
+	}
+
+	if _, err := service.LocalImagePreview(context.Background(), "local-series-1", "file://"+writeLocalPoster(t, t.TempDir())); err == nil {
+		t.Fatal("preview of a file outside the library roots succeeded")
+	}
+}
+
+// Local choices come only from sidecar discovery, which gets the item's file
+// context even when the library's chain does not use the NFO provider. A
+// file:// URL from a chain provider is neither listed nor applyable.
+func TestFetchItemImagesWithLocalTrustsOnlySidecarDiscovery(t *testing.T) {
+	root := t.TempDir()
+	poster := "file://" + writeLocalPoster(t, root)
+	elsewhere := filepath.Join(root, "elsewhere.jpg")
+	if err := os.WriteFile(elsewhere, []byte("elsewhere-bytes"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	local := &recordingImageProvider{images: []RemoteImage{{ProviderID: "nfo", URL: poster, Type: ImagePoster}}}
+	remote := &recordingImageProvider{slug: "tmdb", images: []RemoteImage{
+		{ProviderID: "tmdb", URL: "https://image.example/poster.jpg", Type: ImagePoster, Rating: 7},
+		{ProviderID: "tmdb", URL: "file://" + elsewhere, Type: ImagePoster, Rating: 9},
+	}}
+	service, cacher := newLocalPickerServiceForTest(local, remote, []string{root})
+
+	images, _, err := service.FetchItemImagesWithLocal(context.Background(), map[string]string{"tmdb": "1"}, "series", "en", 7, "local-series-1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var urls []string
+	for _, image := range images {
+		urls = append(urls, image.URL)
+	}
+	if want := []string{"https://image.example/poster.jpg", poster}; !slices.Equal(urls, want) {
+		t.Fatalf("images = %v, want %v", urls, want)
+	}
+	if len(local.requests) != 1 || local.requests[0].RepresentativeFilePath != localSeriesEpisodePath {
+		t.Fatalf("sidecar discovery requests = %+v, want the item's media file", local.requests)
+	}
+	if len(remote.requests) != 1 || remote.requests[0].RepresentativeFilePath != "" || len(remote.requests[0].PrimarySidecarSearchPaths) != 0 {
+		t.Fatalf("chain requests = %+v, want no local context", remote.requests)
+	}
+
+	_, err = service.ApplyLocalItemImage(context.Background(), localApplyRequest("file://"+elsewhere, ImagePoster))
+	if !errors.Is(err, ErrLocalImageNotOffered) || len(cacher.bytesReq) != 0 {
+		t.Fatalf("apply of a chain provider's file = %v (cached %d), want ErrLocalImageNotOffered", err, len(cacher.bytesReq))
+	}
+}
+
+// Movies use the plural content type in their cache key, like the refresh
+// path's enqueueItemImages does.
+func TestApplyLocalItemImageUsesTheRefreshKeyForMovies(t *testing.T) {
+	root := t.TempDir()
+	source := "file://" + writeLocalPoster(t, root)
+	provider := &recordingImageProvider{images: []RemoteImage{{ProviderID: "nfo", URL: source, Type: ImagePoster}}}
+	service, cacher := newLocalPickerServiceForTest(provider, nil, []string{root})
+	req := localApplyRequest(source, ImagePoster)
+	req.ContentID, req.ContentType = "movie-1", "movie"
+
+	result, err := service.ApplyLocalItemImage(context.Background(), req)
+	if err != nil {
+		t.Fatalf("ApplyLocalItemImage: %v", err)
+	}
+	if len(provider.requests) != 1 || provider.requests[0].RepresentativeFilePath != localMoviePath {
+		t.Fatalf("sidecar discovery requests = %+v, want the movie's file", provider.requests)
+	}
+	cacheReq := cacher.bytesReq[0]
+	want := "local/movies/movie-1/" + cacheReq.KeyDiscriminator + "/poster/original.webp"
+	if cacheReq.ContentType != "movies" || result.StoredPath != want {
+		t.Fatalf("content type %q, stored path %q, want movies and %q", cacheReq.ContentType, result.StoredPath, want)
+	}
+}
+
+// A directory symlink inside the library that points outside it cannot pull
+// an outside file in, even when discovery offers the linked path.
+func TestApplyLocalItemImageRejectsSymlinkedDirectoryEscape(t *testing.T) {
+	root := t.TempDir()
+	outside := t.TempDir()
+	writeLocalPoster(t, outside)
+	if err := os.Symlink(outside, filepath.Join(root, "linked")); err != nil {
+		t.Skipf("symlinks unavailable: %v", err)
+	}
+	source := "file://" + filepath.Join(root, "linked", "poster.jpg")
+	provider := &recordingImageProvider{images: []RemoteImage{{ProviderID: "nfo", URL: source, Type: ImagePoster}}}
+	service, cacher := newLocalPickerServiceForTest(provider, nil, []string{root})
+
+	_, err := service.ApplyLocalItemImage(context.Background(), localApplyRequest(source, ImagePoster))
+	if err == nil || !strings.Contains(err.Error(), "outside library roots") {
+		t.Fatalf("err = %v, want outside library roots", err)
+	}
+	if len(cacher.bytesReq) != 0 {
+		t.Fatalf("cached %d images, want none", len(cacher.bytesReq))
+	}
+}
+
+type countingObservedLocationRepo struct {
+	gets int
+}
+
+func (r *countingObservedLocationRepo) Get(context.Context, int, string) (*models.ObservedMediaLocation, error) {
+	r.gets++
+	return &models.ObservedMediaLocation{ContentGroupCount: 1}, nil
+}
+
+// The picker lists a series' local artwork on every page and again on apply,
+// so the sidecar directory check runs once per distinct observed root rather
+// than once per episode file.
+func TestDirectorySidecarSearchPathsChecksEachRootOnce(t *testing.T) {
+	locations := &countingObservedLocationRepo{}
+	service := &MetadataService{observedLocationRepo: locations}
+	files := make([]*models.MediaFile, 0, 301)
+	for i := range 300 {
+		files = append(files, &models.MediaFile{ID: i + 1, MediaFolderID: 7, ObservedRootPath: "/media/Other/Show", ContentGroupKey: "show"})
+	}
+	files = append(files, &models.MediaFile{ID: 301, MediaFolderID: 7, ObservedRootPath: "/media/Other/Show Extras", ContentGroupKey: "show"})
+
+	paths := service.directorySidecarSearchPathsForFiles(context.Background(), files)
+	if locations.gets != 2 {
+		t.Fatalf("observed location lookups = %d, want one per distinct root (2)", locations.gets)
+	}
+	if len(paths) != 2 || paths[0] != "/media/Other/Show" || paths[1] != "/media/Other/Show Extras" {
+		t.Fatalf("paths = %v", paths)
+	}
+}
+
+// Sidecar discovery does not depend on the provider chain, so a chain that
+// fails to resolve still lists the item's local artwork and reports the
+// failure instead of failing the whole listing.
+func TestFetchItemImagesWithLocalSurvivesChainFailure(t *testing.T) {
+	root := t.TempDir()
+	poster := "file://" + writeLocalPoster(t, root)
+	local := &recordingImageProvider{images: []RemoteImage{{ProviderID: "nfo", URL: poster, Type: ImagePoster}}}
+	service, _ := newLocalPickerServiceForTest(local, nil, []string{root})
+	pool, err := pgxpool.New(context.Background(), "postgres://prairie@127.0.0.1:1/prairie?connect_timeout=1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(pool.Close)
+	service.chainRepo = NewChainRepository(pool)
+	service.chainCache = map[string]chainCacheEntry{}
+
+	images, providerErrors, err := service.FetchItemImagesWithLocal(context.Background(), nil, "series", "en", 7, "local-series-1")
+	if err != nil {
+		t.Fatalf("FetchItemImagesWithLocal: %v", err)
+	}
+	if len(images) != 1 || images[0].URL != poster {
+		t.Fatalf("images = %+v, want only the local poster", images)
+	}
+	if got := providerErrors["chain"]; got != "Image provider chain unavailable" {
+		t.Fatalf("provider errors = %v, want the fixed chain failure message", providerErrors)
+	}
+}
+
+// A discovery failure is reported by source only. Its error text can carry
+// paths or provider details, so it stays in the log and out of the listing.
+func TestFetchItemImagesWithLocalReportsDiscoveryFailureWithoutItsText(t *testing.T) {
+	local := &recordingImageProvider{err: errors.New("nfo read failed: desc = api_key=secret-value /media/Other/Show/tvshow.nfo")}
+	service, _ := newLocalPickerServiceForTest(local, nil, []string{t.TempDir()})
+
+	_, providerErrors, err := service.FetchItemImagesWithLocal(context.Background(), map[string]string{"tmdb": "1"}, "series", "en", 7, "local-series-1")
+	if err != nil {
+		t.Fatalf("FetchItemImagesWithLocal: %v", err)
+	}
+	got := providerErrors[imageCacheLocalProviderID]
+	if got != "Local artwork discovery failed" {
+		t.Fatalf("provider errors = %v, want the fixed local failure message", providerErrors)
+	}
+	if strings.Contains(got, "api_key") || strings.Contains(got, "/media/") {
+		t.Fatalf("local failure message %q leaks the underlying error", got)
+	}
+}
+
+// The discovery failure is still logged for the admin, with credential
+// assignments masked, including one nested inside another assignment.
+func TestFetchItemImagesWithLocalLogsDiscoveryFailureWithoutSecrets(t *testing.T) {
+	var logs bytes.Buffer
+	previous := slog.Default()
+	slog.SetDefault(slog.New(slog.NewTextHandler(&logs, nil)))
+	t.Cleanup(func() { slog.SetDefault(previous) })
+
+	local := &recordingImageProvider{err: errors.New("nfo read failed: desc = api_key=secret-value")}
+	service, _ := newLocalPickerServiceForTest(local, nil, []string{t.TempDir()})
+	if _, _, err := service.FetchItemImagesWithLocal(context.Background(), map[string]string{"tmdb": "1"}, "series", "en", 7, "local-series-1"); err != nil {
+		t.Fatalf("FetchItemImagesWithLocal: %v", err)
+	}
+	out := logs.String()
+	if !strings.Contains(out, "local artwork discovery failed") || !strings.Contains(out, "nfo read failed") {
+		t.Fatalf("log = %q, want the discovery failure with its context", out)
+	}
+	if strings.Contains(out, "secret-value") {
+		t.Fatalf("log = %q, leaks the api_key value", out)
+	}
+}
+
+// Discovery returns fingerprinted sidecar sources, image URLs an NFO names,
+// and slots the picker cannot apply. Only sidecar files of an applicable type
+// are offered, and an offered fingerprinted source applies.
+func TestFetchItemImagesWithLocalOffersApplicableSidecarFiles(t *testing.T) {
+	root := t.TempDir()
+	poster := fingerprintedSource(t, writeLocalPoster(t, root))
+	banner := filepath.Join(root, "banner.jpg")
+	if err := os.WriteFile(banner, []byte("banner-bytes"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	local := &recordingImageProvider{images: []RemoteImage{
+		{ProviderID: "nfo", URL: poster, Type: ImagePoster},
+		{ProviderID: "nfo", URL: fingerprintedSource(t, banner), Type: ImageBanner},
+		{ProviderID: "nfo", URL: LocalMetadataURLSource("https://image.example/fanart.jpg"), Type: ImageBackdrop},
+	}}
+	service, cacher := newLocalPickerServiceForTest(local, nil, []string{root})
+
+	images, providerErrors, err := service.FetchItemImagesWithLocal(context.Background(), nil, "series", "en", 7, "local-series-1")
+	if err != nil || len(providerErrors) != 0 {
+		t.Fatalf("FetchItemImagesWithLocal: err %v, provider errors %v", err, providerErrors)
+	}
+	if len(images) != 1 || images[0].URL != poster {
+		t.Fatalf("images = %+v, want only the fingerprinted poster", images)
+	}
+
+	if _, err := service.ApplyLocalItemImage(context.Background(), localApplyRequest(poster, ImagePoster)); err != nil {
+		t.Fatalf("ApplyLocalItemImage: %v", err)
+	}
+	if len(cacher.bytesReq) != 1 || cacher.bytesReq[0].SourceURL != poster {
+		t.Fatalf("cache requests = %+v, want the fingerprinted poster", cacher.bytesReq)
+	}
+}
diff --git a/internal/metadata/local_artwork_precedence.go b/internal/metadata/local_artwork_precedence.go
index af6533c7af..f7cbd2e2be 100644
--- a/internal/metadata/local_artwork_precedence.go
+++ b/internal/metadata/local_artwork_precedence.go
@@ -123,11 +123,6 @@ type localArtworkRetention struct {
 	// probes memoizes folder probes, so the episodes of one season folder
 	// cost one probe. Retentions made with atLevel share it.
 	probes map[string]rootcheck.Result
-	// usable, when set, rejects local sources this refresh may not use (an
-	// image URL an NFO names while caching is off, see
-	// MetadataService.localMetadataURLUsable); such a source is never kept.
-	// Searched levels already imply that local artwork is usable at all.
-	usable func(source string) bool
 }
 
 func newLocalArtworkRetention(ctx context.Context, contentID string, level localArtworkLevel) *localArtworkRetention {
@@ -160,7 +155,6 @@ func (r *localArtworkRetention) keep(imageType ImageType, incoming, existingSour
 	}
 	if !r.searched ||
 		!isLocalImageSourcePath(existingSource) ||
-		(r.usable != nil && !r.usable(existingSource)) ||
 		!isRemoteImageSourcePath(incoming) ||
 		gone(existingSource) {
 		return false
diff --git a/internal/metadata/local_artwork_precedence_test.go b/internal/metadata/local_artwork_precedence_test.go
index 3cdfd44a7a..61d7344641 100644
--- a/internal/metadata/local_artwork_precedence_test.go
+++ b/internal/metadata/local_artwork_precedence_test.go
@@ -160,6 +160,8 @@ func TestMergeAndPersistKeepsCachedLocalArtworkUntilSidecarIsGone(t *testing.T)
 			t.Run(fmt.Sprintf("mode %d/%s", mode, tc.name), func(t *testing.T) {
 				localSource := "file://" + tc.layout(t, t.TempDir()) + "?v=12-1"
 				h := newTestHarness()
+				h.service.SetImageCacheJobEnqueuer(&recordingImageCacheJobEnqueuer{})
+				h.service.SetAutoCacheImages(true)
 				ctx := withLocalArtworkSearched(context.Background(), localArtworkItem)
 				if err := h.itemRepo.Upsert(ctx, &models.MediaItem{
 					ContentID:        contentID,
diff --git a/internal/metadata/local_image_source_test.go b/internal/metadata/local_image_source_test.go
index 8d65eb1988..347f4e9944 100644
--- a/internal/metadata/local_image_source_test.go
+++ b/internal/metadata/local_image_source_test.go
@@ -44,8 +44,8 @@ func TestPreserveCachedArtworkRoutesLocalSource(t *testing.T) {
 	// No prior cached art: the file:// source must never land in *_path; the
 	// pre-cache window keeps the path empty until the cache job completes.
 	path, thumb, source := preserveCachedArtwork(
-		"file:///media/movies/Film/poster.jpg", "", "", "", "",
-	)
+		"file:///media/movies/Film/poster.jpg", "", "", "", "", true)
+
 	if path != "" {
 		t.Fatalf("path = %q, want empty during pre-cache window", path)
 	}
@@ -59,8 +59,8 @@ func TestPreserveCachedArtworkRoutesLocalSource(t *testing.T) {
 	// Prior cached art keeps serving while the local source waits to cache.
 	path, thumb, source = preserveCachedArtwork(
 		"file:///media/movies/Film/poster.jpg", "",
-		"tmdb/movies/550/poster/original.webp", "https://image.tmdb.org/a.jpg", "th",
-	)
+		"tmdb/movies/550/poster/original.webp", "https://image.tmdb.org/a.jpg", "th", true)
+
 	if path != "tmdb/movies/550/poster/original.webp" {
 		t.Fatalf("path = %q, want prior cached key", path)
 	}
@@ -78,7 +78,7 @@ func TestPrepareItemImagesForQueueRoutesLocalSource(t *testing.T) {
 		Type:       "movie",
 		PosterPath: "file:///media/movies/Film/poster.jpg",
 	}
-	prepareItemImagesForQueue(item, nil)
+	prepareItemImagesForQueue(item, nil, true)
 	if item.PosterPath != "" {
 		t.Fatalf("PosterPath = %q, want empty during pre-cache window", item.PosterPath)
 	}
@@ -359,7 +359,7 @@ func TestApplyBestImagesClearsClearArtLogoOnManualRefresh(t *testing.T) {
 	applyBestImages(&item, []RemoteImage{
 		{ProviderID: "tvdb", URL: "tvdb://banners/v4/series/81189/clearart/611b4e1126ff1.png", Type: ImageLogo, Language: "en", Rating: 10},
 	}, MergeReplaceUnlocked, "en")
-	prepareItemImagesForQueue(&item, existing)
+	prepareItemImagesForQueue(&item, existing, true)
 
 	if item.LogoPath != "" || item.LogoSourcePath != "" {
 		t.Fatalf("clear-art logo survived manual refresh: path=%q source=%q", item.LogoPath, item.LogoSourcePath)
@@ -377,7 +377,7 @@ func TestApplyBestImagesReplacesClearArtLogoWithTVDBClearLogo(t *testing.T) {
 		applyBestImages(&item, []RemoteImage{
 			{ProviderID: "tvdb", URL: tvdbClearLogoURL, Type: ImageLogo, Language: "en", Rating: 10},
 		}, mode, "en")
-		prepareItemImagesForQueue(&item, existing)
+		prepareItemImagesForQueue(&item, existing, true)
 
 		// The cached path stays served until the cache job publishes the new source.
 		if item.LogoPath != existing.LogoPath || item.LogoSourcePath != tvdbClearLogoURL {
@@ -394,7 +394,7 @@ func TestApplyBestImagesKeepsTVDBClearLogoWhenRefreshOffersNoLogo(t *testing.T)
 	item := *existing
 
 	applyBestImages(&item, nil, MergeReplaceUnlocked, "en")
-	prepareItemImagesForQueue(&item, existing)
+	prepareItemImagesForQueue(&item, existing, true)
 
 	if item.LogoPath != existing.LogoPath || item.LogoSourcePath != existing.LogoSourcePath {
 		t.Fatalf("logo = path %q source %q, want cached TVDB ClearLogo kept", item.LogoPath, item.LogoSourcePath)
@@ -427,8 +427,8 @@ func TestBuildItemLocalizationRecordSkipsLocalCandidates(t *testing.T) {
 		},
 		MergeFillEmpty,
 		"de",
-		false,
-	)
+		false, true)
+
 	if loc.PosterPath != "" || loc.PosterSourcePath != "" {
 		t.Fatalf("localization picked up local candidate: path=%q source=%q", loc.PosterPath, loc.PosterSourcePath)
 	}
@@ -591,7 +591,7 @@ func TestApplyBestImagesKeepsLockedClearArtLogoOnManualRefresh(t *testing.T) {
 	applyBestImages(item, []RemoteImage{
 		{ProviderID: "tvdb", URL: "tvdb://banners/v4/series/81189/clearart/611b4e1126ff1.png", Type: ImageLogo, Rating: 9},
 	}, MergeReplaceUnlocked, "en")
-	prepareItemImagesForQueue(item, &existing)
+	prepareItemImagesForQueue(item, &existing, true)
 	if item.LogoPath != existing.LogoPath || item.LogoSourcePath != existing.LogoSourcePath {
 		t.Fatalf("locked logo = path %q source %q, want admin selection kept", item.LogoPath, item.LogoSourcePath)
 	}
diff --git a/internal/metadata/local_metadata_sources_test.go b/internal/metadata/local_metadata_sources_test.go
index 378ac80f03..a920588590 100644
--- a/internal/metadata/local_metadata_sources_test.go
+++ b/internal/metadata/local_metadata_sources_test.go
@@ -44,7 +44,7 @@ func TestLocalMetadataURLSourceRouting(t *testing.T) {
 	if served != "" || source != nfoPosterSource {
 		t.Errorf("splitProviderImagePath = %q, %q; want only the source", served, source)
 	}
-	path, _, source := preserveCachedArtwork(nfoPosterSource, "", "tmdb/movies/1/poster/original.webp", "https://image.tmdb.org/p.jpg", "th")
+	path, _, source := preserveCachedArtwork(nfoPosterSource, "", "tmdb/movies/1/poster/original.webp", "https://image.tmdb.org/p.jpg", "th", true)
 	if path != "tmdb/movies/1/poster/original.webp" || source != nfoPosterSource {
 		t.Errorf("preserveCachedArtwork = %q from %q; want the cached copy kept until the NFO's lands", path, source)
 	}
diff --git a/internal/metadata/local_person_photos.go b/internal/metadata/local_person_photos.go
index ddec50ba7f..eebcb87aa4 100644
--- a/internal/metadata/local_person_photos.go
+++ b/internal/metadata/local_person_photos.go
@@ -36,7 +36,7 @@ func (s *MetadataService) applyLocalPersonPhotos(ctx context.Context, contentID
 	if s == nil || s.personRepo == nil || !s.localArtworkUsable() {
 		return
 	}
-	inputs := localPersonPhotoJobs(ctx, s.personRepo, contentID, usableLocalPersonPhotos(people, s.localSourceUsable))
+	inputs := localPersonPhotoJobs(ctx, s.personRepo, contentID, people)
 	_ = s.enqueueImageCacheJobs(ctx, "person", contentID, inputs)
 }
 
@@ -142,22 +142,3 @@ func sameLocalPhotoFolder(a, b string) bool {
 
 // personImageContentType is the image cache's content type for people.
 const personImageContentType = "people"
-
-// usableLocalPersonPhotos returns people with each local photo source usable
-// rejects cleared, copying the slice only when it changes one.
-func usableLocalPersonPhotos(people []models.ItemPerson, usable func(string) bool) []models.ItemPerson {
-	var out []models.ItemPerson
-	for i, p := range people {
-		if p.LocalPhotoSource == "" || usable(p.LocalPhotoSource) {
-			continue
-		}
-		if out == nil {
-			out = slices.Clone(people)
-		}
-		out[i].LocalPhotoSource = ""
-	}
-	if out == nil {
-		return people
-	}
-	return out
-}
diff --git a/internal/metadata/local_person_photos_test.go b/internal/metadata/local_person_photos_test.go
index 66ea5a076a..a8288d2100 100644
--- a/internal/metadata/local_person_photos_test.go
+++ b/internal/metadata/local_person_photos_test.go
@@ -172,28 +172,17 @@ func TestApplyLocalPersonPhotosNeedsImageCache(t *testing.T) {
 	})
 }
 
-// With metadata.cache_images off, a photo URL an NFO names is dropped, since
-// only the image cache may fetch it, while a sidecar photo stays; the
-// caller's slice is left as it was.
-func TestUsableLocalPersonPhotosWithCachingOff(t *testing.T) {
+// With metadata.cache_images off, local photos are not used at all, sidecar
+// or NFO-named: clients load provider artwork straight from the providers.
+// The zero repository would panic if it were read.
+func TestApplyLocalPersonPhotosSkippedWithCachingOff(t *testing.T) {
 	t.Parallel()
 
-	service := &MetadataService{imageCacheJobs: &capturingImageJobEnqueuer{}}
-	people := []models.ItemPerson{
+	service := &MetadataService{personRepo: &catalog.PersonRepository{}, imageCacheJobs: &capturingImageJobEnqueuer{}}
+	service.applyLocalPersonPhotos(context.Background(), "movie-1", []models.ItemPerson{
 		{Person: models.Person{ID: 1}, LocalPhotoSource: "file:///media/Film/.actors/Lead.jpg"},
 		{Person: models.Person{ID: 2}, LocalPhotoSource: "nfo+https://img.example.org/support.jpg"},
-	}
-	got := usableLocalPersonPhotos(people, service.localSourceUsable)
-	if got[0].LocalPhotoSource == "" || got[1].LocalPhotoSource != "" {
-		t.Fatalf("photos = %q, %q; want the sidecar kept and the NFO URL dropped", got[0].LocalPhotoSource, got[1].LocalPhotoSource)
-	}
-	if people[1].LocalPhotoSource == "" {
-		t.Fatal("changed the caller's slice")
-	}
-	service.SetAutoCacheImages(true)
-	if got := usableLocalPersonPhotos(people, service.localSourceUsable); got[1].LocalPhotoSource == "" {
-		t.Fatal("dropped the NFO URL with caching on")
-	}
+	})
 }
 
 // The NFO photo a credit names survives the merge with a remote provider's
diff --git a/internal/metadata/local_reapply.go b/internal/metadata/local_reapply.go
index 85179376b1..a7cf53430f 100644
--- a/internal/metadata/local_reapply.go
+++ b/internal/metadata/local_reapply.go
@@ -74,7 +74,7 @@ func (s *MetadataService) reapplyLocalItem(
 				return localReapplyNone, nil, fmt.Errorf("%s images: %w", provider.Slug(), err)
 			}
 			for _, image := range found {
-				if isLocalImageSourcePath(image.URL) && s.localSourceUsable(image.URL) {
+				if isLocalImageSourcePath(image.URL) {
 					images = append(images, image)
 				}
 			}
@@ -242,7 +242,9 @@ func (s *MetadataService) reapplyLocalSeriesChildren(
 			if err != nil {
 				return fmt.Errorf("%s seasons: %w", provider.Slug(), err)
 			}
-			dropLocalSeasonArtwork(seasons, s.localSourceUsable)
+			if !s.localArtworkUsable() {
+				dropLocalSeasonArtwork(seasons)
+			}
 			for _, season := range seasons {
 				if _, ok := seasonDirs[season.SeasonNumber]; ok {
 					accumulateSeasonResults(seasonResults, []SeasonResult{season})
@@ -275,7 +277,9 @@ func (s *MetadataService) reapplyLocalSeriesChildren(
 			if err != nil {
 				return fmt.Errorf("%s episodes: %w", provider.Slug(), err)
 			}
-			dropLocalEpisodeArtwork(episodes, s.localSourceUsable)
+			if !s.localArtworkUsable() {
+				dropLocalEpisodeArtwork(episodes)
+			}
 			for _, episode := range episodes {
 				if _, ok := episodeFiles[episode.EpisodeNumber]; ok && episode.SeasonNumber == seasonNumber {
 					accumulateEpisodeResults(episodeResults, []EpisodeResult{episode})
diff --git a/internal/metadata/match_ignore.go b/internal/metadata/match_ignore.go
new file mode 100644
index 0000000000..7217b71da7
--- /dev/null
+++ b/internal/metadata/match_ignore.go
@@ -0,0 +1,42 @@
+package metadata
+
+import (
+	"context"
+	"fmt"
+	"strings"
+)
+
+// matchIgnored reports whether an admin marked contentID as intentionally
+// unmatched (media_items.match_ignored_at), for an item a provider does not
+// list. While the item is still provisional, automatic matching leaves it
+// alone the way it leaves an unmatched split target alone: Identify still
+// works, and the item upsert clears the mark once the item is matched.
+func (s *MetadataService) matchIgnored(ctx context.Context, contentID string) (bool, error) {
+	contentID = strings.TrimSpace(contentID)
+	if s == nil || s.dbPool == nil || contentID == "" {
+		return false, nil
+	}
+	var ignored bool
+	if err := s.dbPool.QueryRow(ctx, `
+		SELECT EXISTS (
+			SELECT 1
+			FROM media_items
+			WHERE content_id = $1
+			  AND match_ignored_at IS NOT NULL
+			  AND lower(trim(status)) IN ('pending', 'unmatched', 'ambiguous')
+		)
+	`, contentID).Scan(&ignored); err != nil {
+		return false, fmt.Errorf("checking match ignore for %s: %w", contentID, err)
+	}
+	return ignored, nil
+}
+
+// pinnedUnmatched reports whether an admin left contentID unmatched on
+// purpose, by ignoring it or by an unmatched split, so automatic matching
+// must leave it alone.
+func (s *MetadataService) pinnedUnmatched(ctx context.Context, contentID string) (bool, error) {
+	if ignored, err := s.matchIgnored(ctx, contentID); err != nil || ignored {
+		return ignored, err
+	}
+	return s.pinnedUnmatchedBySplit(ctx, contentID)
+}
diff --git a/internal/metadata/match_ignore_test.go b/internal/metadata/match_ignore_test.go
new file mode 100644
index 0000000000..9a72ef18bd
--- /dev/null
+++ b/internal/metadata/match_ignore_test.go
@@ -0,0 +1,260 @@
+package metadata
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+)
+
+// TestProcessLeavesIgnoredItemUnmatchedDB covers issue #2392: automatic
+// matching skips an item an admin marked as intentionally unmatched in every
+// mode a scan, the matcher queues or a refresh use, while the item is
+// provisional.
+func TestProcessLeavesIgnoredItemUnmatchedDB(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatalf("connect test database: %v", err)
+	}
+	t.Cleanup(pool.Close)
+
+	contentID := fmt.Sprintf("local-match-ignore-%d", time.Now().UnixNano())
+	t.Cleanup(func() {
+		_, _ = pool.Exec(ctx, `DELETE FROM media_items WHERE content_id = $1`, contentID)
+	})
+	if _, err := pool.Exec(ctx, `
+		INSERT INTO media_items (content_id, type, title, status, genres, poster_path, backdrop_path, logo_path, match_ignored_at)
+		VALUES ($1, 'movie', 'Bonus Disc', 'unmatched', '{}'::text[], '', '', '', NOW())
+	`, contentID); err != nil {
+		t.Fatalf("seed item: %v", err)
+	}
+	svc := &MetadataService{dbPool: pool}
+	expect := func(step string, want bool) {
+		t.Helper()
+		got, err := svc.matchIgnored(ctx, contentID)
+		if err != nil {
+			t.Fatalf("%s: %v", step, err)
+		}
+		if got != want {
+			t.Fatalf("%s: ignored = %v, want %v", step, got, want)
+		}
+	}
+
+	expect("ignored unmatched item", true)
+	for _, mode := range []RefreshMode{ModeInitialMatch, ModeScheduledRefresh, ModeManualRefresh} {
+		result, err := svc.Process(ctx, ProcessRequest{ContentID: contentID, Mode: mode})
+		if err != nil {
+			t.Fatalf("Process mode %d: %v", mode, err)
+		}
+		if result == nil || !result.Pinned || result.Updated || result.ContentID != contentID {
+			t.Fatalf("Process mode %d result = %+v, want pinned and not updated", mode, result)
+		}
+	}
+
+	if _, err := pool.Exec(ctx, `UPDATE media_items SET status = 'matched' WHERE content_id = $1`, contentID); err != nil {
+		t.Fatalf("match item: %v", err)
+	}
+	expect("a matched item", false)
+	if _, err := pool.Exec(ctx, `UPDATE media_items SET status = 'unmatched', match_ignored_at = NULL WHERE content_id = $1`, contentID); err != nil {
+		t.Fatalf("clear mark: %v", err)
+	}
+	expect("an unmatched item without the mark", false)
+}
+
+// TestMatchQueuesSkipIgnoredItemsDB covers the matcher queues for issue
+// #2392: neither queues the files of an ignored movie or series, a sync
+// drops rows they already had, and clearing the mark queues them again.
+func TestMatchQueuesSkipIgnoredItemsDB(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatalf("connect test database: %v", err)
+	}
+	t.Cleanup(pool.Close)
+
+	suffix := time.Now().UnixNano()
+	exec := func(query string, args ...any) {
+		t.Helper()
+		if _, err := pool.Exec(ctx, query, args...); err != nil {
+			t.Fatalf("%s: %v", query, err)
+		}
+	}
+	count := func(query string, args ...any) int {
+		t.Helper()
+		var n int
+		if err := pool.QueryRow(ctx, query, args...).Scan(&n); err != nil {
+			t.Fatalf("%s: %v", query, err)
+		}
+		return n
+	}
+	seed := func(folderType, itemType string) (folderID int, contentID, root string, fileIDs []int) {
+		t.Helper()
+		if err := pool.QueryRow(ctx, `INSERT INTO media_folders (type, name, enabled) VALUES ($1, $2, true) RETURNING id`,
+			folderType, fmt.Sprintf("Match ignore %s %d", folderType, suffix)).Scan(&folderID); err != nil {
+			t.Fatalf("seed folder: %v", err)
+		}
+		contentID = fmt.Sprintf("local-match-ignore-%s-%d", itemType, suffix)
+		root = fmt.Sprintf("/match-ignore-%d/%s/Title (2003)", suffix, itemType)
+		t.Cleanup(func() {
+			_, _ = pool.Exec(ctx, `DELETE FROM media_files WHERE media_folder_id = $1`, folderID)
+			_, _ = pool.Exec(ctx, `DELETE FROM media_items WHERE content_id = $1`, contentID)
+			_, _ = pool.Exec(ctx, `DELETE FROM media_folders WHERE id = $1`, folderID)
+		})
+		exec(`INSERT INTO media_items (content_id, type, title, status, genres, poster_path, backdrop_path, logo_path, match_ignored_at)
+			VALUES ($1, $2, 'Title', 'unmatched', '{}'::text[], '', '', '', NOW())`, contentID, itemType)
+		names := []string{"Title (2003).mkv"}
+		if itemType == "series" {
+			names = []string{"Season 01/S01E01.mkv", "Season 01/S01E02.mkv"}
+		}
+		for _, name := range names {
+			var id int
+			if err := pool.QueryRow(ctx, `
+				INSERT INTO media_files (content_id, media_folder_id, file_path, observed_root_path, file_size, base_type)
+				VALUES ($1, $2, $3, $4, 1024, $5) RETURNING id
+			`, contentID, folderID, root+"/"+name, root, itemType).Scan(&id); err != nil {
+				t.Fatalf("seed file: %v", err)
+			}
+			fileIDs = append(fileIDs, id)
+		}
+		return folderID, contentID, root, fileIDs
+	}
+
+	movieFolder, movieID, _, movieFiles := seed("movies", "movie")
+	seriesFolder, seriesID, seriesRoot, _ := seed("series", "series")
+	movies := NewMovieMatchQueueRepository(pool, nil)
+	series := NewSeriesRootMatchQueueRepository(pool)
+	enqueue := func(step string) {
+		t.Helper()
+		if err := movies.EnqueueMovieFile(ctx, movieFiles[0]); err != nil {
+			t.Fatalf("%s: enqueue movie: %v", step, err)
+		}
+		if err := series.EnqueueSeriesRoot(ctx, seriesFolder, seriesRoot); err != nil {
+			t.Fatalf("%s: enqueue series root: %v", step, err)
+		}
+	}
+	sync := func(step string) {
+		t.Helper()
+		if err := movies.SyncForFolder(ctx, movieFolder); err != nil {
+			t.Fatalf("%s: sync movies: %v", step, err)
+		}
+		if err := series.SyncForFolder(ctx, seriesFolder); err != nil {
+			t.Fatalf("%s: sync series: %v", step, err)
+		}
+	}
+	queued := func() (int, int) {
+		t.Helper()
+		return count(`SELECT COUNT(*) FROM movie_match_queue WHERE media_folder_id = $1`, movieFolder),
+			count(`SELECT COUNT(*) FROM series_root_match_queue WHERE media_folder_id = $1`, seriesFolder)
+	}
+	setIgnored := func(ignored bool) {
+		t.Helper()
+		exec(`UPDATE media_items SET match_ignored_at = CASE WHEN $2 THEN NOW() END WHERE content_id = ANY($1)`, []string{movieID, seriesID}, ignored)
+	}
+
+	enqueue("ignored")
+	sync("ignored")
+	if m, s := queued(); m != 0 || s != 0 {
+		t.Fatalf("ignored items queued: movie rows = %d, series rows = %d, want none", m, s)
+	}
+
+	setIgnored(false)
+	enqueue("not ignored")
+	if m, s := queued(); m != 1 || s != 1 {
+		t.Fatalf("not ignored: movie rows = %d, series rows = %d, want one each", m, s)
+	}
+
+	// Rows queued before the mark, even parked ones asked to rerun, drain on
+	// the next sync.
+	exec(`UPDATE movie_match_queue SET state = 'parked', parked_at = NOW(), rerun_requested = true WHERE media_folder_id = $1`, movieFolder)
+	exec(`UPDATE series_root_match_queue SET state = 'parked', parked_at = NOW(), rerun_requested = true WHERE media_folder_id = $1`, seriesFolder)
+	setIgnored(true)
+	sync("ignored again")
+	if m, s := queued(); m != 0 || s != 0 {
+		t.Fatalf("after ignoring queued items: movie rows = %d, series rows = %d, want none", m, s)
+	}
+}
+
+// TestRefreshLeavesIgnoredItemAloneDB covers the refresh paths for issue
+// #2392: a refresh of an ignored item is a completed no-op rather than a
+// failure, and a season or episode refresh of an ignored series stops
+// before it searches a provider.
+func TestRefreshLeavesIgnoredItemAloneDB(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatalf("connect test database: %v", err)
+	}
+	t.Cleanup(pool.Close)
+
+	suffix := time.Now().UnixNano()
+	movieID := fmt.Sprintf("local-refresh-ignore-movie-%d", suffix)
+	seriesID := fmt.Sprintf("local-refresh-ignore-series-%d", suffix)
+	t.Cleanup(func() {
+		_, _ = pool.Exec(ctx, `DELETE FROM metadata_refresh_debt WHERE content_id = ANY($1)`, []string{movieID, seriesID})
+		_, _ = pool.Exec(ctx, `DELETE FROM media_items WHERE content_id = ANY($1)`, []string{movieID, seriesID})
+	})
+	for _, row := range []struct{ id, typ string }{{movieID, "movie"}, {seriesID, "series"}} {
+		if _, err := pool.Exec(ctx, `
+			INSERT INTO media_items (content_id, type, title, status, genres, poster_path, backdrop_path, logo_path, match_ignored_at)
+			VALUES ($1, $2, 'Bonus Disc', 'unmatched', '{}'::text[], '', '', '', NOW())
+		`, row.id, row.typ); err != nil {
+			t.Fatalf("seed item: %v", err)
+		}
+	}
+	// A scheduled refresh claimed the movie's debt row: the pinned refresh
+	// must settle it, or the row is claimed again once its lease lapses.
+	if _, err := pool.Exec(ctx, `
+		INSERT INTO metadata_refresh_debt (target_type, content_id, next_refresh_at, claimed_at, lease_expires_at, attempt_count)
+		VALUES ('item', $1, NOW() - interval '1 minute', NOW(), NOW() + interval '15 minutes', 1)
+	`, movieID); err != nil {
+		t.Fatalf("seed refresh debt: %v", err)
+	}
+	svc := &MetadataService{
+		dbPool:          pool,
+		itemRepo:        catalog.NewItemRepository(pool),
+		seasonRepo:      catalog.NewSeasonRepository(pool),
+		episodeRepo:     catalog.NewEpisodeRepository(pool),
+		refreshDebtRepo: NewRefreshDebtRepository(pool),
+	}
+
+	if err := svc.refreshItemTarget(ctx, movieID, 0, ModeManualRefresh, false); err != nil {
+		t.Fatalf("refresh of an ignored movie = %v, want no error", err)
+	}
+	var failures int
+	if err := pool.QueryRow(ctx, `SELECT refresh_failures FROM media_items WHERE content_id = $1`, movieID).Scan(&failures); err != nil {
+		t.Fatalf("read refresh failures: %v", err)
+	}
+	if failures != 0 {
+		t.Fatalf("refresh of an ignored movie recorded %d failures, want 0", failures)
+	}
+	var debtRows int
+	if err := pool.QueryRow(ctx, `SELECT COUNT(*) FROM metadata_refresh_debt WHERE content_id = $1`, movieID).Scan(&debtRows); err != nil {
+		t.Fatalf("read refresh debt: %v", err)
+	}
+	if debtRows != 0 {
+		t.Fatalf("refresh of an ignored movie left %d refresh debt rows, want the claimed row settled", debtRows)
+	}
+
+	if err := svc.refreshSeriesChildTarget(ctx, seriesID, 1, 1, 0, ModeManualRefresh); !errors.Is(err, ErrMetadataNotFound) {
+		t.Fatalf("episode refresh of an ignored series = %v, want ErrMetadataNotFound", err)
+	}
+}
diff --git a/internal/metadata/merge_embeddings_test.go b/internal/metadata/merge_embeddings_test.go
new file mode 100644
index 0000000000..88e19520c3
--- /dev/null
+++ b/internal/metadata/merge_embeddings_test.go
@@ -0,0 +1,80 @@
+package metadata
+
+import (
+	"context"
+	"errors"
+	"os"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// A merge into a target with no embedding keeps the source's, like the
+// provider-ID merge, so the target stays in similarity results until the
+// backfill re-embeds it. A target's own embedding wins.
+func TestMergeKeepsTheSourceEmbeddingPostgres(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := t.Context()
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(pool.Close)
+
+	prefix := "merge-emb-" + uuid.NewString()[:8] + "-"
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM media_items WHERE content_id LIKE $1`, prefix+"%")
+	})
+	// Pending items are not embedding-eligible, so embedding tests running
+	// against the same database leave their vectors alone.
+	for _, id := range []string{"source", "bare-target", "other-source", "embedded-target"} {
+		if _, err := pool.Exec(ctx, `INSERT INTO media_items(content_id, type, title, status) VALUES($1, 'movie', $1, 'pending')`, prefix+id); err != nil {
+			t.Fatal(err)
+		}
+	}
+	embed := func(id, model, text string) {
+		t.Helper()
+		if _, err := pool.Exec(ctx, `
+			INSERT INTO media_item_embeddings (media_item_id, embedding, model, canonical_text)
+			VALUES ($1, (SELECT array_agg(0.5::real) FROM generate_series(1, 3072))::vector, $2, $3)`, prefix+id, model, text); err != nil {
+			t.Fatal(err)
+		}
+	}
+	embedding := func(id string) (model, text string, ok bool) {
+		t.Helper()
+		err := pool.QueryRow(ctx, `SELECT model, canonical_text FROM media_item_embeddings WHERE media_item_id = $1`, prefix+id).Scan(&model, &text)
+		if errors.Is(err, pgx.ErrNoRows) {
+			return "", "", false
+		}
+		if err != nil {
+			t.Fatal(err)
+		}
+		return model, text, true
+	}
+	embed("source", "model-a", "source text")
+	embed("other-source", "model-a", "other source text")
+	embed("embedded-target", "model-a", "target text")
+
+	s := &MetadataService{dbPool: pool}
+	if err := s.rebindItemToExistingItem(ctx, prefix+"source", prefix+"bare-target", true); err != nil {
+		t.Fatal(err)
+	}
+	if model, text, ok := embedding("bare-target"); !ok || model != "model-a" || text != "source text" {
+		t.Fatalf("target embedding after the merge = %q/%q (present %v), want the source's", model, text, ok)
+	}
+	if _, _, ok := embedding("source"); ok {
+		t.Fatal("the merged-away source still has an embedding")
+	}
+
+	if err := s.rebindItemToExistingItem(ctx, prefix+"other-source", prefix+"embedded-target", true); err != nil {
+		t.Fatal(err)
+	}
+	if _, text, ok := embedding("embedded-target"); !ok || text != "target text" {
+		t.Fatalf("target embedding after the merge = %q (present %v), want the target's own", text, ok)
+	}
+}
diff --git a/internal/metadata/merge_items.go b/internal/metadata/merge_items.go
index 8b17d7f5ee..c69de84c1b 100644
--- a/internal/metadata/merge_items.go
+++ b/internal/metadata/merge_items.go
@@ -3,9 +3,63 @@ package metadata
 import (
 	"context"
 	"fmt"
+	"log/slog"
 	"strings"
+	"time"
+
+	"github.com/prairie-server/prairie-server/internal/catalog/reattribute"
 )
 
+// recommendationStaleTimeout bounds marking recommendations stale after a
+// merge or split, which runs after the request's own context may have ended.
+const recommendationStaleTimeout = 10 * time.Second
+
+// RecommendationStaler marks stale the recommendations of every profile whose
+// user state points at the given items, so the stale sweep rebuilds them.
+// *recommendations.Repo implements it.
+type RecommendationStaler interface {
+	MarkProfilesStaleForItems(ctx context.Context, itemIDs []string) (int64, error)
+}
+
+// SetRecommendationStaler installs what marks recommendations stale after a
+// merge, split or duplicate repair moves user state onto an item. Without it
+// those profiles wait for the nightly recommendation jobs.
+func (s *MetadataService) SetRecommendationStaler(staler RecommendationStaler) {
+	if s != nil {
+		s.recsStaler = staler
+	}
+}
+
+// MarkRecommendationsStale marks stale the profiles whose user state now
+// points at itemIDs. Call it after the transaction that moved the state
+// committed. A failure only delays the rebuild to the nightly jobs, so it is
+// logged rather than returned.
+func MarkRecommendationsStale(ctx context.Context, staler RecommendationStaler, itemIDs ...string) {
+	if staler == nil || len(itemIDs) == 0 {
+		return
+	}
+	markCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), recommendationStaleTimeout)
+	defer cancel()
+	if _, err := staler.MarkProfilesStaleForItems(markCtx, itemIDs); err != nil {
+		slog.WarnContext(ctx, "marking recommendations stale after moving user state failed", "component", "metadata", "item_ids", itemIDs, "error", err)
+	}
+}
+
+// MovedStateTargets lists the items a reattribution moved user state onto:
+// the target item and the target episodes of each moved episode. It is empty
+// when nothing moved.
+func MovedStateTargets(report *reattribute.Report, targetID string, episodePairs []reattribute.IDPair) []string {
+	if !report.MovedUserState() {
+		return nil
+	}
+	ids := make([]string, 0, 1+len(episodePairs))
+	ids = append(ids, targetID)
+	for _, pair := range episodePairs {
+		ids = append(ids, pair.To)
+	}
+	return ids
+}
+
 // MergeItems merges the item at fromContentID into toContentID: files, library
 // memberships, provider ids, and all per-user state (via the shared
 // reattribution engine inside rebindItemToExistingItem) move to the target and
diff --git a/internal/metadata/merge_recommendations_test.go b/internal/metadata/merge_recommendations_test.go
new file mode 100644
index 0000000000..e8c9775b5a
--- /dev/null
+++ b/internal/metadata/merge_recommendations_test.go
@@ -0,0 +1,108 @@
+package metadata
+
+import (
+	"context"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/catalog/reattribute"
+	"github.com/prairie-server/prairie-server/internal/recommendations"
+)
+
+// A merge that moves a profile's watch state onto the surviving item marks
+// that profile's recommendations stale; a merge that moves no user state
+// marks none.
+func TestMergeMarksMovedProfilesStalePostgres(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := t.Context()
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(pool.Close)
+
+	prefix := "merge-recs-" + uuid.NewString()[:8] + "-"
+	var userID int
+	if err := pool.QueryRow(ctx, `INSERT INTO users(username, role) VALUES($1, 'user') RETURNING id`, prefix+"user").Scan(&userID); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM users WHERE id = $1`, userID)
+		_, _ = pool.Exec(context.Background(), `DELETE FROM media_items WHERE content_id LIKE $1`, prefix+"%")
+	})
+	for _, item := range []struct{ id, status string }{
+		{"admin-source", "matched"}, {"admin-target", "matched"},
+		{"empty-source", "matched"}, {"empty-target", "matched"},
+	} {
+		if _, err := pool.Exec(ctx, `INSERT INTO media_items(content_id, type, title, status) VALUES($1, 'movie', $1, $2)`, prefix+item.id, item.status); err != nil {
+			t.Fatal(err)
+		}
+	}
+	var dims int
+	if err := pool.QueryRow(ctx, `
+		SELECT atttypmod FROM pg_attribute
+		WHERE attrelid = 'public.user_taste_profiles'::regclass AND attname = 'embedding'`).Scan(&dims); err != nil {
+		t.Fatal(err)
+	}
+	recs := recommendations.NewRepo(pool)
+	for _, profile := range []string{"admin-merge", "untouched"} {
+		if err := recs.UpsertTasteProfile(ctx, userID, profile, make([]float32, dims), map[string]int{}, "", time.Now().Add(-time.Hour)); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if _, err := pool.Exec(ctx, `INSERT INTO user_watch_progress(user_id, profile_id, media_item_id, completed) VALUES($1, 'admin-merge', $2, true)`, userID, prefix+"admin-source"); err != nil {
+		t.Fatal(err)
+	}
+	stale := func() map[string]bool {
+		t.Helper()
+		profiles, err := recs.GetStaleProfiles(ctx, 10000)
+		if err != nil {
+			t.Fatal(err)
+		}
+		got := map[string]bool{}
+		for _, p := range profiles {
+			if p.UserID == userID {
+				got[p.ProfileID] = true
+			}
+		}
+		return got
+	}
+
+	s := &MetadataService{dbPool: pool}
+	s.SetRecommendationStaler(recs)
+	if err := s.rebindItemToExistingItem(ctx, prefix+"empty-source", prefix+"empty-target", true); err != nil {
+		t.Fatal(err)
+	}
+	if got := stale(); len(got) != 0 {
+		t.Fatalf("stale after a merge that moved no user state = %v, want none", got)
+	}
+	if err := s.rebindItemToExistingItem(ctx, prefix+"admin-source", prefix+"admin-target", true); err != nil {
+		t.Fatal(err)
+	}
+	if got := stale(); len(got) != 1 || !got["admin-merge"] {
+		t.Fatalf("stale after the merge = %v, want only admin-merge", got)
+	}
+}
+
+func TestMovedStateTargets(t *testing.T) {
+	pairs := []reattribute.IDPair{{From: "old-e1", To: "new-e1"}}
+	if got := MovedStateTargets(&reattribute.Report{HistoryMoved: 1}, "target", pairs); len(got) != 2 || got[0] != "target" || got[1] != "new-e1" {
+		t.Fatalf("targets after a move = %v, want the target and its moved episode", got)
+	}
+	for name, report := range map[string]*reattribute.Report{
+		"nil":                    nil,
+		"only downloads moved":   {Downloads: 3, PlaybackSessionLog: 2},
+		"only ambiguous history": {HistoryAmbiguous: 1, HistoryStayed: 4},
+	} {
+		if got := MovedStateTargets(report, "target", pairs); len(got) != 0 {
+			t.Fatalf("%s: targets = %v, want none", name, got)
+		}
+	}
+}
diff --git a/internal/metadata/movie_match_queue_repo.go b/internal/metadata/movie_match_queue_repo.go
index d3e45ed298..4ed70a993e 100644
--- a/internal/metadata/movie_match_queue_repo.go
+++ b/internal/metadata/movie_match_queue_repo.go
@@ -46,8 +46,11 @@ func requirePositiveMovieQueueID(label string, value int) error {
 //
 // Files beneath a root skipped as misplaced series are excluded durably:
 // their content_id is never set, so without the exclusion every library sync
-// would re-enqueue them only for the worker to skip them again.
+// would re-enqueue them only for the worker to skip them again. Files of an
+// item an admin ignored are excluded the same way, even for a requested
+// rerun, so syncs drop their rows instead of keeping them pending or parked.
 const movieQueueFileBaseEligibleCond = `folders.enabled = true
+	  AND mi.match_ignored_at IS NULL
 	  AND (
 		lower(trim(folders.type)) IN ('movie', 'movies') OR
 		(lower(trim(folders.type)) = 'mixed' AND lower(trim(mf.base_type)) = 'movie')
diff --git a/internal/metadata/nfo/lookup.go b/internal/metadata/nfo/lookup.go
index 579001d58d..ecae65102e 100644
--- a/internal/metadata/nfo/lookup.go
+++ b/internal/metadata/nfo/lookup.go
@@ -45,7 +45,7 @@ const maxCacheEntries = 256
 // and a one- or two-digit number), at the start of the name or after a
 // separator. Group 1 is the title, group 2 the part number, and group 3 the
 // text after the token, which Kodi keeps in the stack name.
-var stackPartRe = regexp.MustCompile(`(?i)^(.*?)(?:^|[ _.-]+)(?:cd|disc|part|pt)[ _.-]*(\d{1,2})([ _.-].*)?$`)
+var stackPartRe = regexp.MustCompile(`(?i)^(.*?)(?:^|[ _.-]+)(?:cd|disc|part|pt)[ _.-]*(\d{1,2})([ _.-].*)?$`) //nolint:gocritic // the inner ^ matches a part token at the start of the name
 
 // stackPart splits a stacked part's base name into the name its parts share
 // (Movie-cd1 → Movie, CD1.Feature → Feature) and its part number, or returns
diff --git a/internal/metadata/nfo_series_depth_test.go b/internal/metadata/nfo_series_depth_test.go
index 18c6ad5f5d..dc706244de 100644
--- a/internal/metadata/nfo_series_depth_test.go
+++ b/internal/metadata/nfo_series_depth_test.go
@@ -498,13 +498,16 @@ func TestSeriesWithoutSeasonOrEpisodeNFOs_UnchangedFallback(t *testing.T) {
 	}
 }
 
-// Local sidecar art is copied into artwork storage whatever
-// metadata.cache_images says: the setting governs downloading remote artwork,
-// and without a copy local art cannot be served at all. A refresh hands every
-// local slot (item, season, episode) to the discovering process's copier and
-// queues nothing else for it. Until a copy lands, a slot with nothing cached
-// serves the best remote image; once it lands, local wins again.
-func TestLocalArtworkCopiedWhateverImageCaching(t *testing.T) {
+// Local sidecar art is used only while metadata.cache_images is on. With it
+// on, a refresh hands every local slot (item, season, episode) to the
+// discovering process's copier and queues nothing else for it; until a copy
+// lands, a slot with nothing cached serves the best remote image, and once it
+// lands, local wins. With it off, the refresh ignores local art and serves the
+// remote images, and turning it off after the copies landed moves each slot a
+// provider fills back to the provider image, even through a fill-empty refresh
+// with an unrated poster; a slot no provider fills (the backdrop here) keeps
+// its copy. NFO text applies either way.
+func TestLocalArtworkUsedOnlyWithImageCaching(t *testing.T) {
 	const (
 		remotePoster = "https://img.example/series-poster.jpg"
 		remoteSeason = "https://img.example/season-1.jpg"
@@ -571,6 +574,29 @@ func TestLocalArtworkCopiedWhateverImageCaching(t *testing.T) {
 
 			refresh(metadata.ModeInitialMatch)
 			item, season, episode := slots()
+			if item.Overview != "90-day home fitness program." {
+				t.Errorf("item overview = %q, want the NFO plot", item.Overview)
+			}
+			if !cacheImages {
+				for name, got := range map[string][2]string{
+					"item poster":   {item.PosterPath, item.PosterSourcePath},
+					"item backdrop": {item.BackdropPath, item.BackdropSourcePath},
+					"season poster": {season.PosterPath, season.PosterSourcePath},
+					"episode still": {episode.StillPath, episode.StillSourcePath},
+				} {
+					want := map[string]string{"item poster": remotePoster, "season poster": remoteSeason, "episode still": remoteStill}[name]
+					if got[0] != want || got[1] != want {
+						t.Errorf("%s path/source = %q/%q, want the remote image %q for both", name, got[0], got[1], want)
+					}
+				}
+				if copies := x.LocalArtworkCopies(); len(copies) != 0 {
+					t.Errorf("copier got %#v, want nothing with caching off", copies)
+				}
+				if jobs := x.EnqueuedImageJobs(); len(jobs) != 0 {
+					t.Errorf("queued %#v, want nothing with caching off", jobs)
+				}
+				return
+			}
 			for name, source := range map[string]string{
 				"item poster":   item.PosterSourcePath,
 				"item backdrop": item.BackdropSourcePath,
@@ -628,6 +654,27 @@ func TestLocalArtworkCopiedWhateverImageCaching(t *testing.T) {
 					t.Errorf("%s path after the copy = %q, want the cached local copy", name, path)
 				}
 			}
+			localBackdrop := item.BackdropPath
+
+			// Turning caching off: a fill-empty refresh hands each slot a
+			// provider fills to the provider, unrated or not.
+			x.Service().SetAutoCacheImages(false)
+			remote.images[0].Rating = 0
+			refresh(metadata.ModeScheduledRefresh)
+			item, season, episode = slots()
+			for name, got := range map[string][2]string{
+				"item poster":          {item.PosterPath, remotePoster},
+				"item poster source":   {item.PosterSourcePath, remotePoster},
+				"season poster":        {season.PosterPath, remoteSeason},
+				"season poster source": {season.PosterSourcePath, remoteSeason},
+				"episode still":        {episode.StillPath, remoteStill},
+				"episode still source": {episode.StillSourcePath, remoteStill},
+				"item backdrop":        {item.BackdropPath, localBackdrop},
+			} {
+				if got[0] != got[1] {
+					t.Errorf("%s path with caching off = %q, want %q", name, got[0], got[1])
+				}
+			}
 		})
 	}
 }
diff --git a/internal/metadata/people_resolution_test.go b/internal/metadata/people_resolution_test.go
new file mode 100644
index 0000000000..7ec26de50e
--- /dev/null
+++ b/internal/metadata/people_resolution_test.go
@@ -0,0 +1,69 @@
+package metadata
+
+import (
+	"context"
+	"errors"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/models"
+)
+
+// stubPersonRepo resolves every credit to ids, or fails with err.
+type stubPersonRepo struct {
+	ids []int64
+	err error
+}
+
+func (r stubPersonRepo) BatchFindOrCreate(_ context.Context, people []models.Person) ([]int64, error) {
+	if r.err != nil {
+		return nil, r.err
+	}
+	return r.ids[:len(people)], nil
+}
+
+func (stubPersonRepo) PhotoStates(context.Context, []int64) (map[int64]catalog.PersonPhotoState, error) {
+	return nil, nil
+}
+
+func (stubPersonRepo) ClaimPhotoSources(context.Context, []catalog.PersonPhotoSourceClaim) ([]int64, error) {
+	return nil, nil
+}
+
+// A refresh whose people cannot be resolved keeps the stored cast instead of
+// replacing it with the credits that already had IDs (none, for fresh
+// provider credits).
+func TestMergeAndPersistKeepsPeopleWhenResolutionFails(t *testing.T) {
+	for _, tc := range []struct {
+		name        string
+		repo        stubPersonRepo
+		wantReplace bool
+	}{
+		{"resolved", stubPersonRepo{ids: []int64{42}}, true},
+		{"resolution failed", stubPersonRepo{err: errors.New("person lookup cut short")}, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			h := newTestHarness()
+			h.service.personRepo = tc.repo
+			ctx := t.Context()
+			if err := h.itemRepo.Upsert(ctx, &models.MediaItem{ContentID: "movie-cast", Type: "movie", Title: "Film", Year: 2020}); err != nil {
+				t.Fatal(err)
+			}
+			result := &MetadataResult{
+				HasMetadata: true, Title: "Film", Year: 2020, ProviderIDs: map[string]string{},
+				People: []models.ItemPerson{{Person: models.Person{Name: "Lead Actor"}, Kind: models.PersonKindActor, Character: "Hero"}},
+			}
+			if _, err := h.service.mergeAndPersist(ctx, ProcessRequest{ContentID: "movie-cast", Mode: ModeScheduledRefresh, Language: "en"},
+				result, nil, nil, nil, "movie"); err != nil {
+				t.Fatalf("mergeAndPersist: %v", err)
+			}
+			got, replaced := h.itemRepo.replacedPeople["movie-cast"]
+			if replaced != tc.wantReplace {
+				t.Fatalf("ReplacePeople called = %v, want %v (people %+v)", replaced, tc.wantReplace, got)
+			}
+			if tc.wantReplace && (len(got) != 1 || got[0].ID != 42) {
+				t.Fatalf("replaced people = %+v, want the one credit with ID 42", got)
+			}
+		})
+	}
+}
diff --git a/internal/metadata/person_refresh.go b/internal/metadata/person_refresh.go
index 488da00958..e3779b0b49 100644
--- a/internal/metadata/person_refresh.go
+++ b/internal/metadata/person_refresh.go
@@ -301,6 +301,7 @@ func (s *PersonRefreshService) refreshPerson(
 			person.PhotoPath,
 			person.PhotoSourcePath,
 			person.PhotoThumbhash,
+			true,
 		)
 	}
 
diff --git a/internal/metadata/provider_id_integrity.go b/internal/metadata/provider_id_integrity.go
index f786a20db7..12b73ac167 100644
--- a/internal/metadata/provider_id_integrity.go
+++ b/internal/metadata/provider_id_integrity.go
@@ -29,13 +29,23 @@ type ProviderIDIntegrityStats struct {
 }
 
 type ProviderIDIntegrityRepairer struct {
-	pool *pgxpool.Pool
+	pool       *pgxpool.Pool
+	recsStaler RecommendationStaler
 }
 
 func NewProviderIDIntegrityRepairer(pool *pgxpool.Pool) *ProviderIDIntegrityRepairer {
 	return &ProviderIDIntegrityRepairer{pool: pool}
 }
 
+// WithRecommendationStaler installs what marks recommendations stale after a
+// repair merges a duplicate item, and returns the repairer.
+func (r *ProviderIDIntegrityRepairer) WithRecommendationStaler(staler RecommendationStaler) *ProviderIDIntegrityRepairer {
+	if r != nil {
+		r.recsStaler = staler
+	}
+	return r
+}
+
 func (r *ProviderIDIntegrityRepairer) Run(ctx context.Context, batchSize int) (ProviderIDIntegrityStats, error) {
 	var stats ProviderIDIntegrityStats
 	if r == nil || r.pool == nil {
@@ -236,12 +246,12 @@ func (r *ProviderIDIntegrityRepairer) repairDriftRow(ctx context.Context, row pr
 		}
 		return "provisional_conflict", nil
 	case isConfirmedOwnershipStatus(owner.Status) && isProvisionalOwnershipStatus(row.Status):
-		if _, err := canonicalizeProviderIDDuplicateInto(ctx, r.pool, row.ContentID, owner.ContentID, false, false); err != nil {
+		if _, err := canonicalizeProviderIDDuplicateInto(ctx, r.pool, r.recsStaler, row.ContentID, owner.ContentID, false, false); err != nil {
 			return "", err
 		}
 		return "matched_canonicalization", nil
 	case isConfirmedOwnershipStatus(owner.Status) && isConfirmedOwnershipStatus(row.Status):
-		if _, err := canonicalizeProviderIDDuplicate(ctx, r.pool, row.ContentID, owner.ContentID, true, false); err != nil {
+		if _, err := canonicalizeProviderIDDuplicate(ctx, r.pool, r.recsStaler, row.ContentID, owner.ContentID, true, false); err != nil {
 			return "", err
 		}
 		return "matched_canonicalization", nil
@@ -364,7 +374,7 @@ func (s *MetadataService) canonicalizeProviderIDDuplicate(
 	if s == nil || s.dbPool == nil {
 		return "", nil
 	}
-	return canonicalizeProviderIDDuplicate(ctx, s.dbPool, leftContentID, rightContentID, allowMatchedSource, markIdentity)
+	return canonicalizeProviderIDDuplicate(ctx, s.dbPool, s.recsStaler, leftContentID, rightContentID, allowMatchedSource, markIdentity)
 }
 
 // clearProvisionalProviderIDsLocked removes provider ID rows for an item only
@@ -404,15 +414,17 @@ func clearProvisionalProviderIDsLocked(ctx context.Context, pool *pgxpool.Pool,
 }
 
 // canonicalizeProviderIDDuplicate merges two items that share a provider ID
-// onto the one chooseCanonicalProviderOwner picks. With markIdentity (an
-// Identify of leftContentID that hit the conflict with rightContentID, the
-// owner of the chosen IDs) the merge records the choice when it keeps
-// rightContentID: that item holds the chosen IDs. When it keeps
+// onto the one chooseCanonicalProviderOwner picks, then marks stale through
+// staler the recommendations of profiles whose state moved with it. With
+// markIdentity (an Identify of leftContentID that hit the conflict with
+// rightContentID, the owner of the chosen IDs) the merge records the choice
+// when it keeps rightContentID: that item holds the chosen IDs. When it keeps
 // leftContentID, which still has its old IDs, the identity write that follows
 // marks it.
 func canonicalizeProviderIDDuplicate(
 	ctx context.Context,
 	pool *pgxpool.Pool,
+	staler RecommendationStaler,
 	leftContentID string,
 	rightContentID string,
 	allowMatchedSource bool,
@@ -456,16 +468,20 @@ func canonicalizeProviderIDDuplicate(
 	if err := tx.Commit(ctx); err != nil {
 		return "", fmt.Errorf("commit provider-id canonicalization: %w", err)
 	}
+	MarkRecommendationsStale(ctx, staler, canonical.ContentID)
 	return canonical.ContentID, nil
 }
 
 // canonicalizeProviderIDDuplicateInto merges sourceID onto canonicalID, the
-// item that owns the shared provider IDs. With markIdentity (an Identify that
-// hit the conflict) the merge also records the choice on canonicalID, so the
-// mark commits with the chosen IDs even if the identity write after it fails.
+// item that owns the shared provider IDs, then marks stale through staler the
+// recommendations of profiles whose state moved with it. With markIdentity
+// (an Identify that hit the conflict) the merge also records the choice on
+// canonicalID, so the mark commits with the chosen IDs even if the identity
+// write after it fails.
 func canonicalizeProviderIDDuplicateInto(
 	ctx context.Context,
 	pool *pgxpool.Pool,
+	staler RecommendationStaler,
 	sourceID string,
 	canonicalID string,
 	allowMatchedSource bool,
@@ -544,6 +560,7 @@ func canonicalizeProviderIDDuplicateInto(
 	if err := tx.Commit(ctx); err != nil {
 		return "", fmt.Errorf("commit provider-id canonicalization: %w", err)
 	}
+	MarkRecommendationsStale(ctx, staler, canonicalID)
 	return canonicalID, nil
 }
 
@@ -656,12 +673,15 @@ func mergeStepArgs(sql, sourceID, canonicalID string) []any {
 }
 
 var mediaItemMergeSteps = []mediaItemMergeStep{
+	// A provider ID is unique per (provider, provider_id, item_type), so the
+	// source row itself blocks inserting a copy for the canonical item. Move
+	// the rows for providers the canonical item has no ID for instead; the
+	// canonical item keeps its own ID for the rest.
 	{"merge provider ids", `
-			INSERT INTO media_item_provider_ids (content_id, item_type, provider, provider_id, created_at, updated_at)
-			SELECT $2, item_type, provider, provider_id, created_at, NOW()
-			FROM media_item_provider_ids
+			UPDATE media_item_provider_ids
+			SET content_id = $2, updated_at = NOW()
 			WHERE content_id = $1
-			ON CONFLICT DO NOTHING`},
+			  AND provider NOT IN (SELECT provider FROM media_item_provider_ids WHERE content_id = $2)`},
 	{"drop source provider ids", `DELETE FROM media_item_provider_ids WHERE content_id = $1`},
 	{"merge legacy provider columns", `
 			UPDATE media_items dest
@@ -698,12 +718,12 @@ var mediaItemMergeSteps = []mediaItemMergeStep{
 			    updated_at = NOW()`},
 	{"delete source collection items", `DELETE FROM library_collection_items WHERE media_item_id = $1`},
 	{"merge personal collection items", `
-			INSERT INTO user_personal_collection_items (user_id, collection_id, media_item_id, position, added_at)
-			SELECT user_id, collection_id, $2, MIN(position), MIN(added_at)
+			INSERT INTO user_personal_collection_items (user_id, collection_id, media_item_id, sub_item_id, position, added_at)
+			SELECT user_id, collection_id, $2, sub_item_id, MIN(position), MIN(added_at)
 			FROM user_personal_collection_items
 			WHERE media_item_id = $1
-			GROUP BY user_id, collection_id
-			ON CONFLICT (user_id, collection_id, media_item_id) DO UPDATE
+			GROUP BY user_id, collection_id, sub_item_id
+			ON CONFLICT (user_id, collection_id, media_item_id, sub_item_id) DO UPDATE
 			SET position = LEAST(user_personal_collection_items.position, EXCLUDED.position),
 			    added_at = LEAST(user_personal_collection_items.added_at, EXCLUDED.added_at)`},
 	{"delete source personal collection items", `DELETE FROM user_personal_collection_items WHERE media_item_id = $1`},
@@ -725,6 +745,15 @@ var mediaItemMergeSteps = []mediaItemMergeStep{
 			ON CONFLICT (user_id, profile_id, media_item_id) DO UPDATE
 			SET added_at = LEAST(user_watchlist.added_at, EXCLUDED.added_at)`},
 	{"delete source watchlist", `DELETE FROM user_watchlist WHERE media_item_id = $1`},
+	{"merge not interested", `
+			INSERT INTO user_not_interested (user_id, profile_id, media_item_id, added_at)
+			SELECT user_id, profile_id, $2, MIN(added_at)
+			FROM user_not_interested
+			WHERE media_item_id = $1
+			GROUP BY user_id, profile_id
+			ON CONFLICT (user_id, profile_id, media_item_id) DO UPDATE
+			SET added_at = LEAST(user_not_interested.added_at, EXCLUDED.added_at)`},
+	{"delete source not interested", `DELETE FROM user_not_interested WHERE media_item_id = $1`},
 	{"merge ratings", `
 			INSERT INTO user_ratings (user_id, profile_id, media_item_id, rating, rated_at)
 			SELECT DISTINCT ON (user_id, profile_id) user_id, profile_id, $2, rating, rated_at
@@ -768,6 +797,7 @@ var mediaItemMergeSteps = []mediaItemMergeStep{
 			    progress = CASE WHEN EXCLUDED.updated_at >= ebook_reader_progress.updated_at THEN EXCLUDED.progress ELSE ebook_reader_progress.progress END,
 			    updated_at = GREATEST(ebook_reader_progress.updated_at, EXCLUDED.updated_at)`},
 	{"delete source ebook reader progress", `DELETE FROM ebook_reader_progress WHERE content_id = $1`},
+	{"move ebook reader annotations", `UPDATE ebook_reader_annotations SET content_id = $2 WHERE content_id = $1`},
 	{"move history", `UPDATE user_watch_history SET media_item_id = $2 WHERE media_item_id = $1`},
 	{"merge hidden history", `
 			INSERT INTO user_history_hidden_items (user_id, profile_id, media_item_id, hidden_before, updated_at)
@@ -828,11 +858,11 @@ var mediaItemMergeSteps = []mediaItemMergeStep{
 	{"delete source embeddings", `DELETE FROM media_item_embeddings WHERE media_item_id = $1`},
 	{"merge item localizations", `
 			INSERT INTO media_item_localizations (
-				content_id, language, title, sort_title, overview, tagline, poster_path, poster_thumbhash,
-				backdrop_path, backdrop_thumbhash, logo_path, created_at, updated_at
+				content_id, language, title, sort_title, overview, overview_source, tagline, tagline_source,
+				poster_path, poster_thumbhash, backdrop_path, backdrop_thumbhash, logo_path, created_at, updated_at
 			)
-			SELECT $2, language, title, sort_title, overview, tagline, poster_path, poster_thumbhash,
-			       backdrop_path, backdrop_thumbhash, logo_path, created_at, NOW()
+			SELECT $2, language, title, sort_title, overview, overview_source, tagline, tagline_source,
+			       poster_path, poster_thumbhash, backdrop_path, backdrop_thumbhash, logo_path, created_at, NOW()
 			FROM media_item_localizations
 			WHERE content_id = $1
 			ON CONFLICT (content_id, language) DO NOTHING`},
@@ -941,6 +971,15 @@ var mediaItemMergeSteps = []mediaItemMergeStep{
 			ON CONFLICT (user_id, profile_id, series_id) DO UPDATE
 			SET dropped_at = GREATEST(user_dropped_series.dropped_at, EXCLUDED.dropped_at)`},
 	{"delete source dropped series", `DELETE FROM user_dropped_series WHERE series_id = $1`},
+	// A notification mute follows its series; the earlier mute's time is kept.
+	{"merge notification mutes", `
+			INSERT INTO profile_series_notification_mutes (user_id, profile_id, series_id, muted_at)
+			SELECT user_id, profile_id, $2, muted_at
+			FROM profile_series_notification_mutes
+			WHERE series_id = $1
+			ON CONFLICT (user_id, profile_id, series_id) DO UPDATE
+			SET muted_at = LEAST(profile_series_notification_mutes.muted_at, EXCLUDED.muted_at)`},
+	{"delete source notification mutes", `DELETE FROM profile_series_notification_mutes WHERE series_id = $1`},
 	{"merge watch provider dropped items", `
 			INSERT INTO watch_provider_dropped_items (connection_id, provider_account_id, series_id, provider_item_key, remote_seen, updated_at)
 			SELECT connection_id, provider_account_id, $2, '', false, NOW()
diff --git a/internal/metadata/provider_id_integrity_db_test.go b/internal/metadata/provider_id_integrity_db_test.go
index ca1d736c13..11ba1ab740 100644
--- a/internal/metadata/provider_id_integrity_db_test.go
+++ b/internal/metadata/provider_id_integrity_db_test.go
@@ -1,10 +1,15 @@
 package metadata
 
 import (
+	"context"
+	"os"
+	"reflect"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5"
 
 	"github.com/prairie-server/prairie-server/internal/webhooksync/webhooksynctest"
 )
@@ -36,3 +41,226 @@ func TestSyncMergeStepsAfterPlexTableDropPostgres(t *testing.T) {
 		t.Fatalf("webhook state = %s, %v", id, position)
 	}
 }
+
+// beginMergeTestTx opens a transaction on PRAIRIE_TEST_DATABASE_URL that rolls
+// back when the test ends, and seeds a movie source and canonical item.
+func beginMergeTestTx(t *testing.T) (tx pgx.Tx, source, canonical string) {
+	t.Helper()
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	conn, err := pgx.Connect(t.Context(), dsn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = conn.Close(context.Background()) })
+	tx, err = conn.Begin(t.Context())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = tx.Rollback(context.Background()) })
+	suffix := uuid.NewString()
+	source, canonical = "merge-test-source-"+suffix, "merge-test-canonical-"+suffix
+	if _, err := tx.Exec(t.Context(), `INSERT INTO media_items(content_id,type,title,status) VALUES ($1,'movie','Source','pending'), ($2,'movie','Canonical','pending')`, source, canonical); err != nil {
+		t.Fatal(err)
+	}
+	return tx, source, canonical
+}
+
+// The whole merge runs every step against the migrated schema, so a conflict
+// target that no longer matches a table's key fails here instead of in
+// production.
+func TestCanonicalizeMediaItemReferencesWithoutCollectionRowsPostgres(t *testing.T) {
+	tx, source, canonical := beginMergeTestTx(t)
+	if err := canonicalizeMediaItemReferencesTx(t.Context(), tx, source, canonical); err != nil {
+		t.Fatalf("merge: %v", err)
+	}
+}
+
+func TestCanonicalizeMediaItemReferencesMergesPersonalCollectionItemsPostgres(t *testing.T) {
+	tx, source, canonical := beginMergeTestTx(t)
+	var userID int
+	if err := tx.QueryRow(t.Context(), `INSERT INTO users(username,role) VALUES($1,'user') RETURNING id`, "merge-test-"+uuid.NewString()).Scan(&userID); err != nil {
+		t.Fatal(err)
+	}
+	early := time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)
+	late := early.Add(24 * time.Hour)
+	// "shared" holds both items as whole-item entries, and the canonical item
+	// also as an episode entry. "moved" holds only the source item, as a
+	// whole-item entry and an episode entry.
+	seed := []struct {
+		collection, item, sub string
+		position              int
+		addedAt               time.Time
+	}{
+		{"shared", source, "", 2, early},
+		{"shared", canonical, "", 5, late},
+		{"shared", canonical, "ep-1", 7, late},
+		{"shared", source, "ep-2", 8, early},
+		{"moved", source, "", 3, late},
+		{"moved", source, "ep-1", 4, early},
+	}
+	for _, row := range seed {
+		if _, err := tx.Exec(t.Context(), `INSERT INTO user_personal_collection_items(user_id,collection_id,media_item_id,sub_item_id,position,added_at) VALUES($1,$2,$3,$4,$5,$6)`,
+			userID, row.collection, row.item, row.sub, row.position, row.addedAt); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	if err := canonicalizeMediaItemReferencesTx(t.Context(), tx, source, canonical); err != nil {
+		t.Fatalf("merge: %v", err)
+	}
+
+	rows, err := tx.Query(t.Context(), `
+		SELECT collection_id, media_item_id, sub_item_id, position, added_at
+		FROM user_personal_collection_items
+		WHERE user_id = $1
+		ORDER BY collection_id, sub_item_id`, userID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	type item struct {
+		collection, item, sub string
+		position              int
+		addedAt               time.Time
+	}
+	got, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (item, error) {
+		var it item
+		err := row.Scan(&it.collection, &it.item, &it.sub, &it.position, &it.addedAt)
+		it.addedAt = it.addedAt.UTC()
+		return it, err
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []item{
+		{"moved", canonical, "", 3, late},
+		{"moved", canonical, "ep-1", 4, early},
+		{"shared", canonical, "", 2, early},
+		{"shared", canonical, "ep-1", 7, late},
+		{"shared", canonical, "ep-2", 8, early},
+	}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("collection items after merge:\n got %+v\nwant %+v", got, want)
+	}
+}
+
+// A merge keeps the source's provider IDs for providers the canonical item has
+// no ID for, and keeps the canonical item's own ID for the rest.
+func TestCanonicalizeMediaItemReferencesMovesProviderIDsPostgres(t *testing.T) {
+	tx, source, canonical := beginMergeTestTx(t)
+	suffix := uuid.NewString()
+	seed := []struct{ item, provider, id string }{
+		{source, "tmdb", "src-tmdb-" + suffix},
+		{source, "imdb", "src-imdb-" + suffix},
+		{canonical, "tmdb", "canon-tmdb-" + suffix},
+	}
+	for _, row := range seed {
+		if _, err := tx.Exec(t.Context(), `INSERT INTO media_item_provider_ids(content_id,item_type,provider,provider_id) VALUES($1,'movie',$2,$3)`,
+			row.item, row.provider, row.id); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	if err := canonicalizeMediaItemReferencesTx(t.Context(), tx, source, canonical); err != nil {
+		t.Fatalf("merge: %v", err)
+	}
+
+	rows, err := tx.Query(t.Context(), `
+		SELECT content_id || ' ' || provider || ' ' || provider_id
+		FROM media_item_provider_ids
+		WHERE content_id = ANY($1::text[])
+		ORDER BY provider`, []string{source, canonical})
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, err := pgx.CollectRows(rows, pgx.RowTo[string])
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []string{
+		canonical + " imdb src-imdb-" + suffix,
+		canonical + " tmdb canon-tmdb-" + suffix,
+	}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("provider IDs after merge:\n got %q\nwant %q", got, want)
+	}
+}
+
+// Deleting the source item cascades to its ebook annotations, so the merge
+// must move them first.
+func TestCanonicalizeMediaItemReferencesMovesEbookAnnotationsPostgres(t *testing.T) {
+	tx, source, canonical := beginMergeTestTx(t)
+	var userID int
+	if err := tx.QueryRow(t.Context(), `INSERT INTO users(username,role) VALUES($1,'user') RETURNING id`, "merge-test-"+uuid.NewString()).Scan(&userID); err != nil {
+		t.Fatal(err)
+	}
+	annotationID := "merge-test-annotation-" + uuid.NewString()
+	if _, err := tx.Exec(t.Context(), `INSERT INTO ebook_reader_annotations(id,user_id,profile_id,content_id,kind,location) VALUES($1,$2,'p1',$3,'bookmark','loc-1')`,
+		annotationID, userID, source); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := canonicalizeMediaItemReferencesTx(t.Context(), tx, source, canonical); err != nil {
+		t.Fatalf("merge: %v", err)
+	}
+	if _, err := tx.Exec(t.Context(), `DELETE FROM media_items WHERE content_id = $1`, source); err != nil {
+		t.Fatal(err)
+	}
+
+	var owner string
+	if err := tx.QueryRow(t.Context(), `SELECT content_id FROM ebook_reader_annotations WHERE id = $1`, annotationID).Scan(&owner); err != nil {
+		t.Fatalf("annotation after merge: %v", err)
+	}
+	if owner != canonical {
+		t.Fatalf("annotation belongs to %s, want %s", owner, canonical)
+	}
+}
+
+// A notification mute follows its series through a merge: a profile that
+// muted both keeps one mute with the earlier time, and a profile that muted
+// only the source is muted on the canonical item.
+func TestCanonicalizeMediaItemReferencesMergesNotificationMutesPostgres(t *testing.T) {
+	tx, source, canonical := beginMergeTestTx(t)
+	var userID int
+	if err := tx.QueryRow(t.Context(), `INSERT INTO users(username,role) VALUES($1,'user') RETURNING id`, "merge-test-"+uuid.NewString()).Scan(&userID); err != nil {
+		t.Fatal(err)
+	}
+	early := time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)
+	late := early.Add(24 * time.Hour)
+	if _, err := tx.Exec(t.Context(), `
+		INSERT INTO profile_series_notification_mutes (user_id, profile_id, series_id, muted_at)
+		VALUES ($1, 'both', $2, $4), ($1, 'both', $3, $5), ($1, 'source-only', $2, $5)`,
+		userID, source, canonical, early, late); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := canonicalizeMediaItemReferencesTx(t.Context(), tx, source, canonical); err != nil {
+		t.Fatalf("merge: %v", err)
+	}
+
+	rows, err := tx.Query(t.Context(), `
+		SELECT profile_id, series_id, muted_at FROM profile_series_notification_mutes
+		WHERE user_id = $1 ORDER BY profile_id`, userID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	type mute struct {
+		profile, series string
+		at              time.Time
+	}
+	got, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (mute, error) {
+		var m mute
+		err := row.Scan(&m.profile, &m.series, &m.at)
+		m.at = m.at.UTC()
+		return m, err
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []mute{{"both", canonical, early}, {"source-only", canonical, late}}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("mutes after merge:\n got %+v\nwant %+v", got, want)
+	}
+}
diff --git a/internal/metadata/provider_id_integrity_test.go b/internal/metadata/provider_id_integrity_test.go
index 9d44d69856..90ccddd367 100644
--- a/internal/metadata/provider_id_integrity_test.go
+++ b/internal/metadata/provider_id_integrity_test.go
@@ -199,3 +199,21 @@ func TestBothCandidatesHaveContentDetectsRealUserData(t *testing.T) {
 		t.Fatal("did not expect both-content when both sides are skeletons")
 	}
 }
+
+// Merged localizations keep their provenance; without the source columns the
+// copies take the column default and AI text becomes provider text.
+func TestMergeStepsKeepLocalizationProvenance(t *testing.T) {
+	for _, step := range mediaItemMergeSteps {
+		stepSQL := normalizeMergeStepSQL(step.sql)
+		if !strings.Contains(stepSQL, "INSERT INTO media_item_localizations") {
+			continue
+		}
+		for _, column := range []string{"overview_source", "tagline_source"} {
+			if strings.Count(stepSQL, column) != 2 {
+				t.Errorf("%s must copy %s into the canonical item: %s", step.name, column, stepSQL)
+			}
+		}
+		return
+	}
+	t.Fatal("media item merge steps must merge media_item_localizations")
+}
diff --git a/internal/metadata/provider_id_owner_test.go b/internal/metadata/provider_id_owner_test.go
new file mode 100644
index 0000000000..5ff11b374b
--- /dev/null
+++ b/internal/metadata/provider_id_owner_test.go
@@ -0,0 +1,133 @@
+package metadata
+
+import (
+	"context"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/models"
+)
+
+func TestIdentityProviderIDsContradict(t *testing.T) {
+	for _, tc := range []struct {
+		name     string
+		itemType string
+		a, b     map[string]string
+		want     bool
+	}{
+		{"different TMDB, shared TVDB (#2263)", "movie",
+			map[string]string{"tmdb": "125249", "imdb": "tt0035665", "tvdb": "66484"},
+			map[string]string{"tmdb": "43506", "imdb": "tt0035664", "tvdb": "66484"}, true},
+		{"different IMDb, shared TVDB, one TMDB", "movie",
+			map[string]string{"imdb": "tt0035665", "tvdb": "66484"},
+			map[string]string{"tmdb": "43506", "imdb": "tt0035664", "tvdb": "66484"}, true},
+		{"same IMDb, different TVDB", "movie",
+			map[string]string{"imdb": "tt1", "tvdb": "7"},
+			map[string]string{"imdb": "tt1", "tvdb": "8"}, false},
+		{"same TMDB, remapped TVDB", "movie",
+			map[string]string{"tmdb": "949", "tvdb": "2002"},
+			map[string]string{"tmdb": "949", "tvdb": "1001"}, false},
+		{"only TVDB shared and different", "movie",
+			map[string]string{"tvdb": "1", "tmdb": "5"},
+			map[string]string{"tvdb": "2", "imdb": "tt1"}, true},
+		{"only IMDb shared and equal", "movie",
+			map[string]string{"tmdb": "1", "imdb": "tt1"},
+			map[string]string{"tvdb": "9", "imdb": "tt1"}, false},
+		{"TMDB in its slug URL form", "movie",
+			map[string]string{"tmdb": "1931", "imdb": "tt1"},
+			map[string]string{"tmdb": "1931-disney-s-adventures-of-the-gummi-bears", "imdb": "tt2"}, false},
+		{"different TMDB, one in slug form", "movie",
+			map[string]string{"tmdb": "19310"},
+			map[string]string{"tmdb": "1931-disney-s-adventures-of-the-gummi-bears"}, true},
+		{"nothing shared", "movie", map[string]string{"tmdb": "1"}, map[string]string{"tvdb": "2"}, false},
+		{"series: same TVDB, remapped TMDB", "series",
+			map[string]string{"tvdb": "368611", "tmdb": "92749", "imdb": "tt10234724"},
+			map[string]string{"tvdb": "368611", "tmdb": "92750", "imdb": "tt10234724"}, false},
+		{"series: different TVDB, shared TMDB", "series",
+			map[string]string{"tvdb": "1", "tmdb": "5"},
+			map[string]string{"tvdb": "2", "tmdb": "5"}, true},
+		{"series: no TVDB on one side, different TMDB", "series",
+			map[string]string{"tmdb": "5", "imdb": "tt1"},
+			map[string]string{"tvdb": "2", "tmdb": "6", "imdb": "tt1"}, true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := identityProviderIDsContradict(tc.itemType, tc.a, tc.b); got != tc.want {
+				t.Fatalf("identityProviderIDsContradict = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
+
+// A series anchors on TVDB, so a copy matched with a corrected TMDB mapping
+// still finds the series it shares a TVDB ID with, even one first anchored on
+// TMDB. A movie with the same IDs is a different title.
+func TestFindExistingByProviderIDsDecidesSeriesOnTVDB(t *testing.T) {
+	h := newTestHarness()
+	ctx := context.Background()
+	providerRepo := newFakeProviderIDRepo()
+	for _, item := range []*models.MediaItem{
+		{ContentID: "series-tmdb-92749", Type: "series", Title: "Moon Knight", Status: "matched"},
+		{ContentID: "movie-tmdb-92749", Type: "movie", Title: "Moon Knight", Status: "matched"},
+	} {
+		item.Studios, item.Networks, item.Countries, item.Genres = []string{}, []string{}, []string{}, []string{}
+		if err := h.itemRepo.Upsert(ctx, item); err != nil {
+			t.Fatalf("upsert %s: %v", item.ContentID, err)
+		}
+		providerRepo.set(item.ContentID,
+			&models.MediaItemProviderID{ContentID: item.ContentID, ItemType: item.Type, Provider: "tmdb", ProviderID: "92750"},
+			&models.MediaItemProviderID{ContentID: item.ContentID, ItemType: item.Type, Provider: "tvdb", ProviderID: "368611"})
+	}
+	h.service.providerIDRepo = providerRepo
+	ids := map[string]string{"tvdb": "368611", "tmdb": "92749"}
+
+	series, err := h.service.findExistingByProviderIDs(ctx, ids, "series", "")
+	if err != nil {
+		t.Fatalf("findExistingByProviderIDs series: %v", err)
+	}
+	if series == nil || series.ContentID != "series-tmdb-92749" {
+		t.Fatalf("series owner = %#v, want series-tmdb-92749", series)
+	}
+	movie, err := h.service.findExistingByProviderIDs(ctx, ids, "movie", "")
+	if err != nil {
+		t.Fatalf("findExistingByProviderIDs movie: %v", err)
+	}
+	if movie != nil {
+		t.Fatalf("movie owner = %s, want none: its TMDB ID differs", movie.ContentID)
+	}
+}
+
+// The scanner's tag lookup can hit a different series first (TMDB before
+// TVDB) and refuse it. The matched series at the tags' own content ID is then
+// linked, not reset to a provisional skeleton.
+func TestCreateOrFindSkeleton_RefusedTagHitKeepsMatchedAnchor(t *testing.T) {
+	h := newTestHarness()
+	ctx := t.Context()
+	for _, item := range []*models.MediaItem{
+		{ContentID: "series-tvdb-1", Type: "series", Title: "Neighbor Show", Status: "matched", TmdbID: "5", TvdbID: "1"},
+		{ContentID: "series-tvdb-2", Type: "series", Title: "Example Show", Status: "matched", TmdbID: "6"},
+	} {
+		item.Studios, item.Networks, item.Countries, item.Genres = []string{}, []string{}, []string{}, []string{}
+		if err := h.itemRepo.Upsert(ctx, item); err != nil {
+			t.Fatalf("upsert %s: %v", item.ContentID, err)
+		}
+	}
+	root := "/tv/Example Show [tmdbid-5][tvdbid-2]"
+	file := &models.MediaFile{
+		ID: 1, MediaFolderID: 10, FilePath: root + "/Season 01/Example Show - S01E01.mkv",
+		BaseTitle: "Example Show", BaseType: "series", ObservedRootPath: root, CanonicalRootPath: root,
+	}
+
+	skeleton, err := h.service.createOrFindSkeleton(ctx, file, 10, "/tv")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if skeleton.ContentID != "series-tvdb-2" || skeleton.IsNew {
+		t.Fatalf("skeleton = %s (new %v), want the existing series-tvdb-2", skeleton.ContentID, skeleton.IsNew)
+	}
+	item, err := h.itemRepo.GetByID(ctx, "series-tvdb-2")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if item.Status != "matched" || item.Title != "Example Show" {
+		t.Fatalf("series-tvdb-2 is %q %q, want the matched Example Show", item.Status, item.Title)
+	}
+}
diff --git a/internal/metadata/refresh_debt.go b/internal/metadata/refresh_debt.go
index b70595e10b..4aedebc0a3 100644
--- a/internal/metadata/refresh_debt.go
+++ b/internal/metadata/refresh_debt.go
@@ -23,6 +23,12 @@ const (
 	// real debt) and nothing recomputes it, so the next successful refresh
 	// clears it like any resolved reason.
 	RefreshDebtReasonTrailersRequested int64 = 32
+	// RefreshDebtReasonProviderArtwork marks an item the stored-artwork
+	// release (StoredArtworkReleaser) queued while metadata.cache_images is
+	// off, so the refresh fills artwork only a provider can supply. Like
+	// trailers_requested it carries no priority case and nothing recomputes
+	// it: the next successful refresh clears it.
+	RefreshDebtReasonProviderArtwork int64 = 64
 )
 
 const (
@@ -155,6 +161,27 @@ func nextRefreshAtForDebt(reasonMask int64, attemptCount int, now time.Time) tim
 	return now.Add(nextRefreshDelay(reasonMask, attemptCount))
 }
 
+// nextRefreshAtForEpisodeDebt is nextRefreshAtForDebt for debt held by
+// episodes. A recent episode can owe debt only because it is recent (a TBA/TBD
+// title or a missing still), so the row is due again no later than the moment
+// the first of them leaves EpisodeRecentStillWindow. Without that, terminal
+// parking would hold the debt for up to 90 days after the rule stops applying.
+func nextRefreshAtForEpisodeDebt(reasonMask int64, attemptCount int, now time.Time, episodes ...*models.Episode) time.Time {
+	next := nextRefreshAtForDebt(reasonMask, attemptCount, now)
+	for _, ep := range episodes {
+		if ep == nil || ep.AirDate == nil {
+			continue
+		}
+		// The window still covers an air date exactly EpisodeRecentStillWindow
+		// old, so wake just after it closes.
+		windowEnd := ep.AirDate.Add(EpisodeRecentStillWindow + time.Minute)
+		if windowEnd.After(now) && windowEnd.Before(next) {
+			next = windowEnd
+		}
+	}
+	return next
+}
+
 // logRefreshDebtTerminal emits a one-time notice when an episode-incomplete debt row first
 // crosses into the terminal give-up state, so the demotion is observable in logs rather
 // than silent. Logging on the exact transition attempt keeps it to a single line per row,
diff --git a/internal/metadata/refresh_debt_repo.go b/internal/metadata/refresh_debt_repo.go
index 9b8457f038..536c324229 100644
--- a/internal/metadata/refresh_debt_repo.go
+++ b/internal/metadata/refresh_debt_repo.go
@@ -191,13 +191,32 @@ func (r *RefreshDebtRepository) RequestDue(
 	reasonMask int64,
 	nextRefreshAt time.Time,
 	cooldown time.Duration,
+) error {
+	return r.RequestDueMany(ctx, targetType, []string{contentID}, priority, reasonMask, nextRefreshAt, cooldown)
+}
+
+// RequestDueMany is RequestDue for several targets of one type, in one
+// statement.
+func (r *RefreshDebtRepository) RequestDueMany(
+	ctx context.Context,
+	targetType string,
+	contentIDs []string,
+	priority int,
+	reasonMask int64,
+	nextRefreshAt time.Time,
+	cooldown time.Duration,
 ) error {
 	if err := r.requireConfigured(); err != nil {
 		return err
 	}
 	targetType = NormalizeRefreshTargetType(targetType)
-	contentID = strings.TrimSpace(contentID)
-	if targetType == "" || contentID == "" || reasonMask == 0 {
+	ids := make([]string, 0, len(contentIDs))
+	for _, id := range contentIDs {
+		if id = strings.TrimSpace(id); id != "" {
+			ids = append(ids, id)
+		}
+	}
+	if targetType == "" || len(ids) == 0 || reasonMask == 0 {
 		return nil
 	}
 	if cooldown < 0 {
@@ -212,7 +231,9 @@ func (r *RefreshDebtRepository) RequestDue(
 			reason_mask,
 			next_refresh_at,
 			updated_at
-		) VALUES ($1, $2, $3, $4, $5, NOW())
+		)
+		SELECT DISTINCT $1, id, $3::integer, $4::bigint, $5::timestamptz, NOW()
+		FROM unnest($2::text[]) AS id
 		ON CONFLICT (target_type, content_id) DO UPDATE SET
 			priority = GREATEST(metadata_refresh_debt.priority, EXCLUDED.priority),
 			reason_mask = metadata_refresh_debt.reason_mask | EXCLUDED.reason_mask,
@@ -229,7 +250,7 @@ func (r *RefreshDebtRepository) RequestDue(
 				ELSE LEAST(metadata_refresh_debt.next_refresh_at, EXCLUDED.next_refresh_at)
 			END,
 			updated_at = NOW()
-	`, targetType, contentID, priority, reasonMask, nextRefreshAt.UTC(), intervalLiteral(cooldown))
+	`, targetType, ids, priority, reasonMask, nextRefreshAt.UTC(), intervalLiteral(cooldown))
 	if err != nil {
 		return fmt.Errorf("requesting due metadata refresh debt: %w", err)
 	}
@@ -580,6 +601,7 @@ func (r *RefreshDebtRepository) GetMetrics(ctx context.Context, sampleLimit int)
 		{reason: "refresh_failure", mask: RefreshDebtReasonRefreshFailure},
 		{reason: "core_metadata_incomplete", mask: RefreshDebtReasonCoreMetadataIncomplete},
 		{reason: "trailers_requested", mask: RefreshDebtReasonTrailersRequested},
+		{reason: "provider_artwork", mask: RefreshDebtReasonProviderArtwork},
 	}
 	for _, def := range reasonDefs {
 		var count int
diff --git a/internal/metadata/series_queue_override_test.go b/internal/metadata/series_queue_override_test.go
index caaec3bf04..7a2978d273 100644
--- a/internal/metadata/series_queue_override_test.go
+++ b/internal/metadata/series_queue_override_test.go
@@ -75,8 +75,11 @@ func TestSeriesQueueManualIdentityRequiresCompleteGroupCoverage(t *testing.T) {
 // that share a group key on separate items may be different shows.
 func TestSeriesQueuePassesGroupOverrideForLinkedProvisionalRoot(t *testing.T) {
 	const (
-		root      = "/tv/Example Show (2013)/Season"
-		otherRoot = "/tv/Other Show (2015)/Season"
+		// Show folders literally named Season, the one layout that still
+		// parses to the "Season" group after a bare Season folder inside a
+		// show folder became a season folder.
+		root      = "/tv/Season"
+		otherRoot = "/tv2/Season"
 		groupKey  = "v1|series|season|0000"
 	)
 	file := func(id int, root, name, contentID, key string) *models.MediaFile {
@@ -121,7 +124,7 @@ func TestSeriesQueuePassesGroupOverrideForLinkedProvisionalRoot(t *testing.T) {
 	} {
 		t.Run(tt.name, func(t *testing.T) {
 			h := newTestHarness()
-			h.service.folderRepo = &fakeWorkerFolderRepo{folders: map[int]*models.MediaFolder{10: {ID: 10, Type: "series", Enabled: true, Paths: []string{"/tv"}}}}
+			h.service.folderRepo = &fakeWorkerFolderRepo{folders: map[int]*models.MediaFolder{10: {ID: 10, Type: "series", Enabled: true, Paths: []string{"/tv", "/tv2"}}}}
 			files := []*models.MediaFile{
 				file(1, root, "Example Show - S01E01.mkv", "local-stray", groupKey),
 				file(2, root, "Example Show - S01E02.mkv", "local-stray", groupKey),
diff --git a/internal/metadata/series_root_match_queue_repo.go b/internal/metadata/series_root_match_queue_repo.go
index 6bc10f0808..033ed6afdc 100644
--- a/internal/metadata/series_root_match_queue_repo.go
+++ b/internal/metadata/series_root_match_queue_repo.go
@@ -55,6 +55,11 @@ func (r *SeriesRootMatchQueueRepository) CleanupLegacySeriesGroupQueue(ctx conte
 	return int(tag.RowsAffected()), nil
 }
 
+// EnqueueSeriesRoot queues the root for matching while any present file under
+// it still needs a match, and drops its queue row otherwise. Every eligibility
+// check in this file leaves out files of an item an admin ignored
+// (media_items.match_ignored_at), so their roots leave the queue and are never
+// claimed, even for a requested rerun.
 func (r *SeriesRootMatchQueueRepository) EnqueueSeriesRoot(ctx context.Context, folderID int, observedRootPath string) error {
 	if err := r.requireConfigured(); err != nil {
 		return err
@@ -91,6 +96,7 @@ func (r *SeriesRootMatchQueueRepository) EnqueueSeriesRoot(ctx context.Context,
 			  )
 			  AND mf.missing_since IS NULL AND mf.extra_id IS NULL
 			  AND mf.observed_root_path <> ''
+			  AND mi.match_ignored_at IS NULL
 			  AND (
 				mf.content_id IS NULL OR mf.content_id = '' OR
 				lower(trim(COALESCE(mi.status, ''))) IN ('pending', 'unmatched', 'ambiguous')
@@ -151,6 +157,7 @@ func (r *SeriesRootMatchQueueRepository) EnqueueSeriesRoot(ctx context.Context,
 			  )
 			  AND mf.missing_since IS NULL AND mf.extra_id IS NULL
 			  AND mf.observed_root_path <> ''
+			  AND mi.match_ignored_at IS NULL
 			  AND (q.rerun_requested OR q.lease_forced_rerun OR (
 				mf.content_id IS NULL OR mf.content_id = '' OR
 				lower(trim(COALESCE(mi.status, ''))) IN ('pending', 'unmatched', 'ambiguous')
@@ -198,6 +205,7 @@ func (r *SeriesRootMatchQueueRepository) SyncForFolder(ctx context.Context, fold
 			  AND mf.missing_since IS NULL AND mf.extra_id IS NULL
 			  AND mf.observed_root_path IS NOT NULL
 			  AND mf.observed_root_path <> ''
+			  AND mi.match_ignored_at IS NULL
 			  AND (
 				mf.content_id IS NULL OR mf.content_id = '' OR
 				lower(trim(COALESCE(mi.status, ''))) IN ('pending', 'unmatched', 'ambiguous')
@@ -257,6 +265,7 @@ func (r *SeriesRootMatchQueueRepository) SyncForFolder(ctx context.Context, fold
 			  )
 			  AND mf.missing_since IS NULL AND mf.extra_id IS NULL
 			  AND mf.observed_root_path <> ''
+			  AND mi.match_ignored_at IS NULL
 			  AND (q.rerun_requested OR q.lease_forced_rerun OR (
 				mf.content_id IS NULL OR mf.content_id = '' OR
 				lower(trim(COALESCE(mi.status, ''))) IN ('pending', 'unmatched', 'ambiguous')
@@ -313,6 +322,7 @@ func (r *SeriesRootMatchQueueRepository) SyncInScope(ctx context.Context, folder
 				mf.file_path = $2 OR mf.file_path LIKE $3 ESCAPE '\' OR
 				mf.observed_root_path = $2 OR mf.observed_root_path LIKE $3 ESCAPE '\'
 			  )
+			  AND mi.match_ignored_at IS NULL
 			  AND (
 				mf.content_id IS NULL OR mf.content_id = '' OR
 				lower(trim(COALESCE(mi.status, ''))) IN ('pending', 'unmatched', 'ambiguous')
@@ -386,6 +396,7 @@ func (r *SeriesRootMatchQueueRepository) SyncInScope(ctx context.Context, folder
 			  )
 			  AND mf.missing_since IS NULL AND mf.extra_id IS NULL
 			  AND mf.observed_root_path <> ''
+			  AND mi.match_ignored_at IS NULL
 			  AND (q.rerun_requested OR q.lease_forced_rerun OR (
 				mf.content_id IS NULL OR mf.content_id = '' OR
 				lower(trim(COALESCE(mi.status, ''))) IN ('pending', 'unmatched', 'ambiguous')
@@ -432,6 +443,7 @@ func (r *SeriesRootMatchQueueRepository) Claim(ctx context.Context, limit int) (
 				  )
 				  AND mf.missing_since IS NULL AND mf.extra_id IS NULL
 				  AND mf.observed_root_path <> ''
+				  AND mi.match_ignored_at IS NULL
 				  AND (q.rerun_requested OR q.lease_forced_rerun OR (
 					mf.content_id IS NULL OR mf.content_id = '' OR
 					lower(trim(COALESCE(mi.status, ''))) IN ('pending', 'unmatched', 'ambiguous')
@@ -549,6 +561,7 @@ func (r *SeriesRootMatchQueueRepository) ClaimByFolderAndPathPrefix(
 				  )
 				  AND mf.missing_since IS NULL AND mf.extra_id IS NULL
 				  AND mf.observed_root_path <> ''
+				  AND mi.match_ignored_at IS NULL
 				  AND (q.rerun_requested OR q.lease_forced_rerun OR (
 					mf.content_id IS NULL OR mf.content_id = '' OR
 					lower(trim(COALESCE(mi.status, ''))) IN ('pending', 'unmatched', 'ambiguous')
@@ -757,6 +770,34 @@ func (r *SeriesRootMatchQueueRepository) RetryNowByFolder(ctx context.Context, f
 	return int(tag.RowsAffected()), nil
 }
 
+// WakeRoot returns one root's parked or backed-off row to pending so the
+// worker claims it again. Unlike RetryNowByFolder it requests no rerun, so
+// files under the root that are already matched stay out of the attempt. A
+// root without a queued row is left alone.
+func (r *SeriesRootMatchQueueRepository) WakeRoot(ctx context.Context, folderID int, observedRootPath string) error {
+	if err := r.requireConfigured(); err != nil {
+		return err
+	}
+	if err := requirePositiveSeriesQueueID("folder id", folderID); err != nil {
+		return err
+	}
+	if strings.TrimSpace(observedRootPath) == "" {
+		return errors.New("observed root path is required")
+	}
+	if _, err := r.pool.Exec(ctx, `
+		UPDATE series_root_match_queue
+		SET state = 'pending',
+			available_at = CASE WHEN lease_token = '' THEN NOW() ELSE available_at END,
+			deterministic_attempt_count = 0,
+			failure_kind = '', failure_detail = '{}'::jsonb, last_error = '', parked_at = NULL,
+			updated_at = NOW()
+		WHERE media_folder_id = $1 AND observed_root_path = $2
+	`, folderID, filepath.Clean(observedRootPath)); err != nil {
+		return fmt.Errorf("waking series root queue row: %w", err)
+	}
+	return nil
+}
+
 func (r *SeriesRootMatchQueueRepository) WakeForChangedInputs(ctx context.Context) (int, error) {
 	if err := r.requireConfigured(); err != nil {
 		return 0, err
diff --git a/internal/metadata/service.go b/internal/metadata/service.go
index 4724e44b5b..915d50779b 100644
--- a/internal/metadata/service.go
+++ b/internal/metadata/service.go
@@ -23,6 +23,7 @@ import (
 	"github.com/prairie-server/prairie-server/internal/catalog"
 	"github.com/prairie-server/prairie-server/internal/catalog/reattribute"
 	"github.com/prairie-server/prairie-server/internal/contentid"
+	"github.com/prairie-server/prairie-server/internal/database/queryattr"
 	"github.com/prairie-server/prairie-server/internal/idgen"
 	"github.com/prairie-server/prairie-server/internal/lang"
 	"github.com/prairie-server/prairie-server/internal/models"
@@ -78,6 +79,13 @@ type metadataItemRepo interface {
 	ListUnmatchedByFolderAndPathPrefix(ctx context.Context, folderID int, pathPrefix string, limit int) ([]string, error)
 }
 
+// metadataPersonRepo resolves credited people and claims their local photos.
+// The concrete *catalog.PersonRepository satisfies this interface.
+type metadataPersonRepo interface {
+	localPersonPhotoRepo
+	BatchFindOrCreate(ctx context.Context, people []models.Person) ([]int64, error)
+}
+
 type metadataItemDeleteRepo interface {
 	Delete(ctx context.Context, contentID string) ([]string, error)
 }
@@ -441,7 +449,7 @@ type MetadataService struct {
 	seasonLocalizationRepo  metadataSeasonLocalizationRepo
 	episodeLocalizationRepo metadataEpisodeLocalizationRepo
 	autoTranslator          AutoTranslator // optional; set via SetAutoTranslator
-	personRepo              *catalog.PersonRepository
+	personRepo              metadataPersonRepo
 	videoRepo               metadataVideoRepo
 	enrichmentState         enrichmentStateStore
 	ratingSourceRepo        metadataRatingSourceRepo
@@ -457,6 +465,7 @@ type MetadataService struct {
 	observedLocationRepo    metadataObservedLocationRepo
 	localSidecars           localSidecarStore
 	dbPool                  *pgxpool.Pool
+	recsStaler              RecommendationStaler
 
 	dedupLocks      keyedDedupLocks
 	onDemandRefresh keyedRefreshSet
@@ -466,8 +475,11 @@ type MetadataService struct {
 	imageCacher     ImageCacher
 	imageCacheJobs  ImageCacheJobEnqueuer
 	localArtwork    LocalArtworkCopier
-	autoCacheImages atomic.Bool // hot-reloaded from metadata.cache_images
-	imageResolver   interface {
+	libraryRoots    LibraryRootResolver
+	// localImageProvider overrides the built-in sidecar discovery in tests.
+	localImageProvider ImageProvider
+	autoCacheImages    atomic.Bool // hot-reloaded from metadata.cache_images
+	imageResolver      interface {
 		ResolveImageURL(ctx context.Context, path string, variant string) string
 	}
 
@@ -562,7 +574,7 @@ func NewMetadataService(
 		groupOverrideRepo = scanner.NewMediaGroupOverrideRepository(pool)
 		observedLocationRepo = scanner.NewObservedLocationRepository(pool)
 	}
-	return &MetadataService{
+	svc := &MetadataService{
 		chainRepo:               chainRepo,
 		pluginResolver:          pluginResolver,
 		enabledChecker:          enabledChecker,
@@ -577,7 +589,6 @@ func NewMetadataService(
 		itemAliasRepo:           itemAliasRepo,
 		seasonLocalizationRepo:  seasonLocalizationRepo,
 		episodeLocalizationRepo: episodeLocalizationRepo,
-		personRepo:              personRepo,
 		videoRepo:               videoRepo,
 		ratingSourceRepo:        ratingSourceRepo,
 		fileRepo:                fileRepo,
@@ -595,6 +606,11 @@ func NewMetadataService(
 		chainCache:              make(map[string]chainCacheEntry),
 		chainCacheTTL:           60 * time.Second,
 	}
+	// A nil *PersonRepository stored in the interface would pass s.personRepo != nil.
+	if personRepo != nil {
+		svc.personRepo = personRepo
+	}
+	return svc
 }
 
 // SetImageCacher enables S3 image caching during metadata persistence.
@@ -612,10 +628,16 @@ func (s *MetadataService) SetImageCacheJobEnqueuer(enqueuer ImageCacheJobEnqueue
 	s.imageCacheJobs = enqueuer
 }
 
-// SetAutoCacheImages controls whether refresh pipelines automatically cache
-// provider images into object storage. Explicit admin image applies still use
-// the configured image cacher when available, and local sidecar artwork is
-// copied either way. Safe for concurrent use.
+// SetLibraryRootResolver sets the resolver that confines local sidecar artwork
+// reads for the admin image picker to the item's library roots.
+func (s *MetadataService) SetLibraryRootResolver(resolver LibraryRootResolver) {
+	s.libraryRoots = resolver
+}
+
+// SetAutoCacheImages controls whether refresh pipelines cache artwork into
+// object storage and select local artwork at all (metadata.cache_images).
+// Explicit admin image applies still use the configured image cacher when
+// available. Safe for concurrent use.
 func (s *MetadataService) SetAutoCacheImages(enabled bool) {
 	s.autoCacheImages.Store(enabled)
 }
@@ -671,7 +693,7 @@ func (s *MetadataService) Process(ctx context.Context, req ProcessRequest) (*Pro
 	}
 
 	if req.Mode != ModeIdentify {
-		pinned, err := s.pinnedUnmatchedBySplit(ctx, req.ContentID)
+		pinned, err := s.pinnedUnmatched(ctx, req.ContentID)
 		if err != nil {
 			return nil, err
 		}
@@ -771,7 +793,7 @@ func (s *MetadataService) maybeAutoTranslate(ctx context.Context, folderID int,
 	if strings.EqualFold(strings.TrimSpace(item.DefaultMetadataLanguage), library) {
 		return
 	}
-	go s.autoTranslator.AutoEnqueue(context.WithoutCancel(ctx), contentID, library)
+	go s.autoTranslator.AutoEnqueue(queryattr.Detach(context.WithoutCancel(ctx)), contentID, library)
 }
 
 // adoptableFolderLanguage reports whether a folder-scoped refresh should
@@ -1194,14 +1216,28 @@ func (s *MetadataService) collectDirectorySidecarSearchPaths(files []*models.Med
 	if len(files) == 0 {
 		return nil, nil
 	}
+	// Every episode of a series usually shares one observed root, so check
+	// each distinct root and group once rather than once per file.
+	type observedRootKey struct {
+		folderID        int
+		root            string
+		groupKeyVersion int
+		contentGroupKey string
+	}
+	checkedRoots := make(map[observedRootKey]bool)
 	paths := make([]string, 0, len(files))
 	for _, file := range files {
 		if file == nil || file.ObservedRootPath == "" {
 			continue
 		}
-		ok, err := usable(file)
-		if err != nil {
-			return nil, err
+		key := observedRootKey{file.MediaFolderID, file.ObservedRootPath, file.GroupKeyVersion, file.ContentGroupKey}
+		ok, checked := checkedRoots[key]
+		if !checked {
+			var err error
+			if ok, err = usable(file); err != nil {
+				return nil, err
+			}
+			checkedRoots[key] = ok
 		}
 		if ok {
 			paths = append(paths, file.ObservedRootPath)
@@ -2138,7 +2174,9 @@ func (s *MetadataService) processInternal(ctx context.Context, req ProcessReques
 		}
 		allImages = append(allImages, images...)
 	}
-	allImages = withoutUnusableLocalImages(allImages, s.localSourceUsable)
+	if !s.localArtworkUsable() {
+		allImages = withoutLocalImages(allImages)
+	}
 
 	// Phase 4a: Seasons — resolve with "season" content level.
 	var allSeasons []SeasonResult
@@ -2199,7 +2237,9 @@ func (s *MetadataService) processInternal(ctx context.Context, req ProcessReques
 				// A fill-empty pass keeps the seasons the local provider could read.
 				localMetadataUnreadable |= localArtworkSeason
 			}
-			dropLocalSeasonArtwork(seasons, s.localSourceUsable)
+			if !s.localArtworkUsable() {
+				dropLocalSeasonArtwork(seasons)
+			}
 			if isIdentityHinter {
 				localArtworkSearched |= localArtworkSeason
 			}
@@ -2267,7 +2307,9 @@ func (s *MetadataService) processInternal(ctx context.Context, req ProcessReques
 						// A fill-empty pass keeps the episodes the local provider could read.
 						localMetadataUnreadable |= localArtworkEpisode
 					}
-					dropLocalEpisodeArtwork(episodes, s.localSourceUsable)
+					if !s.localArtworkUsable() {
+						dropLocalEpisodeArtwork(episodes)
+					}
 					if isIdentityHinter {
 						localArtworkSearched |= localArtworkEpisode
 					}
@@ -2872,6 +2914,9 @@ func (s *MetadataService) mergeAndPersist(
 	if existingItem != nil {
 		item.LockedFields = existingItem.LockedFields
 	}
+	// Stored artwork copies stay unless caching is off and the artwork is
+	// unlocked; clients then load provider artwork straight from providers.
+	keepStored := s.autoCacheImages.Load() || artworkLocked(item)
 
 	// An enrichment write carries no artwork, and the image handling below
 	// would read the missing images as "no artwork": it would drop artwork
@@ -2886,15 +2931,25 @@ func (s *MetadataService) mergeAndPersist(
 	var localArt *localArtworkRetention
 	if handleArtwork {
 		localArt = newLocalArtworkRetention(ctx, contentID, localArtworkItem)
-		localArt.usable = s.localMetadataURLUsable
 		imageMode := mergeMode
 		if req.localReapply {
 			// Local images always apply; fill-empty keeps the rest of the
 			// stored artwork, which no remote provider was asked about.
 			imageMode = MergeFillEmpty
 		}
+		var stored storedItemArtwork
+		if !keepStored {
+			// With caching off a stored copy gives way to any provider image,
+			// rated or not; fill-empty would keep it over an unrated one.
+			stored = clearStoredItemArtwork(item)
+		}
 		applyBestImages(item, images, imageMode, req.Language)
-		keepUnconfirmedLocalItemArtwork(localArt, item, existingItem)
+		stored.restoreUnfilled(item)
+		if s.localArtworkUsable() || artworkLocked(item) {
+			// With local art unusable a pending local source is dropped too,
+			// so the slot's source is the provider image it serves.
+			keepUnconfirmedLocalItemArtwork(localArt, item, existingItem)
+		}
 		item.PosterThumbhash = mergedImageThumbhash(
 			existingImagePath(existingItem, ImagePoster),
 			existingImageThumbhash(existingItem, ImagePoster),
@@ -2910,7 +2965,7 @@ func (s *MetadataService) mergeAndPersist(
 	}
 
 	if handleArtwork {
-		prepareItemImagesForQueue(item, existingItem)
+		prepareItemImagesForQueue(item, existingItem, keepStored)
 		dropGoneItemOnlyArtwork(localArt, item, images)
 		applyLocalArtworkFallback(item, images, req.Language)
 	}
@@ -2966,6 +3021,7 @@ func (s *MetadataService) mergeAndPersist(
 		loc := buildItemLocalizationRecord(
 			existingLoc, contentID, req.Language, contentType, accumulator, images, mergeMode, req.Language,
 			isFieldLocked(locked, FieldName),
+			keepStored,
 		)
 		if err := s.itemLocalizationRepo.Upsert(ctx, loc); err != nil {
 			return nil, fmt.Errorf("upserting item localization: %w", err)
@@ -2989,30 +3045,32 @@ func (s *MetadataService) mergeAndPersist(
 				// A failed local re-apply is retried by the next check.
 				return nil, fmt.Errorf("finding people: %w", err)
 			}
-			slog.WarnContext(ctx, "metadata: batch find/create people failed", "component", "metadata", "error", err)
+			// Keep the stored cast: no credit got an ID, so replacing it now
+			// would store only the credits that already had one, often none.
+			slog.WarnContext(ctx, "metadata: batch find/create people failed; keeping stored people", "component", "metadata", "content_id", contentID, "error", err)
 		} else {
 			for i := range item.People {
 				item.People[i].ID = personIDs[i]
 			}
-		}
-		// Filter out entries where FindOrCreate failed (Person.ID stayed 0).
-		valid := item.People[:0]
-		for _, p := range item.People {
-			if p.ID != 0 {
-				valid = append(valid, p)
+			// Filter out entries where FindOrCreate failed (Person.ID stayed 0).
+			valid := item.People[:0]
+			for _, p := range item.People {
+				if p.ID != 0 {
+					valid = append(valid, p)
+				}
 			}
-		}
-		if req.localReapply && len(valid) != len(item.People) {
-			// A partial cast would replace the stored one.
-			return nil, fmt.Errorf("resolving people: %d of %d unresolved", len(item.People)-len(valid), len(item.People))
-		}
-		if err := s.itemRepo.ReplacePeople(ctx, contentID, valid); err != nil {
-			if req.localReapply {
-				return nil, fmt.Errorf("replacing people: %w", err)
+			if req.localReapply && len(valid) != len(item.People) {
+				// A partial cast would replace the stored one.
+				return nil, fmt.Errorf("resolving people: %d of %d unresolved", len(item.People)-len(valid), len(item.People))
+			}
+			if err := s.itemRepo.ReplacePeople(ctx, contentID, valid); err != nil {
+				if req.localReapply {
+					return nil, fmt.Errorf("replacing people: %w", err)
+				}
+				slog.WarnContext(ctx, "metadata: failed to replace people", "component", "metadata", "content_id", contentID, "error", err)
 			}
-			slog.WarnContext(ctx, "metadata: failed to replace people", "component", "metadata", "content_id", contentID, "error", err)
+			s.applyLocalPersonPhotos(ctx, contentID, valid)
 		}
-		s.applyLocalPersonPhotos(ctx, contentID, valid)
 	}
 
 	// Persist remote videos (trailers etc.), filtered by the library's
@@ -3144,7 +3202,7 @@ func (s *MetadataService) persistItemAndProviderIDsTx(
 		return "", fmt.Errorf("persisting provider IDs for %s: %w", contentID, err)
 	}
 
-	reboundTo, recoverErr := s.recoverProviderIDConflict(ctx, contentID, providerIDs, contentType, true, identityChosen)
+	reboundTo, dropped, recoverErr := s.recoverProviderIDConflict(ctx, contentID, providerIDs, contentType, true, identityChosen)
 	if recoverErr != nil {
 		return "", fmt.Errorf("recovering provider ID conflict for %s: %w", contentID, recoverErr)
 	}
@@ -3152,12 +3210,34 @@ func (s *MetadataService) persistItemAndProviderIDsTx(
 		return "", fmt.Errorf("persisting provider IDs for %s: %w", contentID, err)
 	}
 	item.ContentID = reboundTo
+	clearDroppedIdentityColumns(item, dropped)
 	if retryErr := s.persistItemAndProviderIDsOnceTx(ctx, itemRepo, providerRepo, item, providerIDs, identityChosen); retryErr != nil {
 		return "", fmt.Errorf("persisting provider IDs after conflict recovery for %s: %w", reboundTo, retryErr)
 	}
 	return reboundTo, nil
 }
 
+// clearDroppedIdentityColumns blanks the item's TMDB, TVDB and IMDb columns
+// that still hold an ID conflict recovery removed from its provider IDs.
+func clearDroppedIdentityColumns(item *models.MediaItem, dropped map[string]string) {
+	for key, value := range dropped {
+		var column *string
+		switch key {
+		case "tmdb":
+			column = &item.TmdbID
+		case "tvdb":
+			column = &item.TvdbID
+		case "imdb":
+			column = &item.ImdbID
+		default:
+			continue
+		}
+		if *column == value {
+			*column = ""
+		}
+	}
+}
+
 func (s *MetadataService) persistItemAndProviderIDsOnceTx(
 	ctx context.Context,
 	itemRepo *catalog.ItemRepository,
@@ -3214,7 +3294,7 @@ func (s *MetadataService) persistItemAndProviderIDsLegacy(
 	}
 	if err := s.providerIDRepo.ReplaceByContentID(ctx, contentID, providerIDs); err != nil {
 		if isProviderIDUniqueConflict(err) {
-			reboundTo, reboundErr := s.recoverProviderIDConflict(ctx, contentID, providerIDs, contentType, true, false)
+			reboundTo, dropped, reboundErr := s.recoverProviderIDConflict(ctx, contentID, providerIDs, contentType, true, false)
 			if reboundErr != nil {
 				return "", fmt.Errorf("recovering provider ID conflict for %s: %w", contentID, reboundErr)
 			}
@@ -3222,6 +3302,7 @@ func (s *MetadataService) persistItemAndProviderIDsLegacy(
 				return "", fmt.Errorf("persisting provider IDs for %s: %w", contentID, err)
 			}
 			item.ContentID = reboundTo
+			clearDroppedIdentityColumns(item, dropped)
 			if err := s.itemRepo.Upsert(ctx, item); err != nil {
 				return "", fmt.Errorf("updating rebound item after provider conflict: %w", err)
 			}
@@ -3250,6 +3331,17 @@ func (s *MetadataService) refreshItemTarget(ctx context.Context, contentID strin
 		s.recordRefreshFailure(ctx, contentID, err, incrementDebtAttempt)
 		return err
 	}
+	if result != nil && result.Pinned {
+		// An admin left the item unmatched on purpose: there is nothing to
+		// refresh, and that is not a failure. Settle its debt row as a
+		// successful refresh would, or a claimed row keeps coming back.
+		if syncErr := s.syncRefreshDebtForItem(ctx, contentID); syncErr != nil {
+			slog.WarnContext(ctx, "metadata: failed to sync refresh debt after a pinned item refresh", "component", "metadata",
+				"content_id", contentID,
+				"error", syncErr)
+		}
+		return nil
+	}
 	if result == nil || !result.Updated {
 		s.recordRefreshFailure(ctx, contentID, ErrMetadataNotFound, incrementDebtAttempt)
 		return ErrMetadataNotFound
@@ -4019,6 +4111,20 @@ func (s *MetadataService) syncRefreshDebtForItem(ctx context.Context, contentID
 		return err
 	}
 	now := time.Now().UTC()
+	// A series row that keeps episode debt must wake when its episodes' recent
+	// window closes, like the season and episode rows that hold the same debt.
+	var actionable []*models.Episode
+	if hasRefreshDebtReason(reasonMask, RefreshDebtReasonEpisodeIncomplete) && s.episodeRepo != nil {
+		episodes, err := s.episodeRepo.ListBySeries(ctx, contentID)
+		if err != nil {
+			return err
+		}
+		for _, episode := range episodes {
+			if EpisodeHasActionableMetadataDebt(episode, now) {
+				actionable = append(actionable, episode)
+			}
+		}
+	}
 	logRefreshDebtTerminal(RefreshTargetItem, contentID, reasonMask, attemptCount,
 		refreshAttemptCounted(ctx, RefreshTargetItem, contentID))
 	return s.refreshDebtRepo.MarkSuccess(
@@ -4026,7 +4132,7 @@ func (s *MetadataService) syncRefreshDebtForItem(ctx context.Context, contentID
 		contentID,
 		effectiveRefreshDebtPriority(reasonMask, attemptCount),
 		reasonMask,
-		nextRefreshAtForDebt(reasonMask, attemptCount, now),
+		nextRefreshAtForEpisodeDebt(reasonMask, attemptCount, now, actionable...),
 	)
 }
 
@@ -4059,10 +4165,11 @@ func (s *MetadataService) syncRefreshDebtForSeason(ctx context.Context, seasonID
 	}
 	reasonMask := int64(0)
 	now := time.Now().UTC()
+	var actionable []*models.Episode
 	for _, episode := range episodes {
 		if EpisodeHasActionableMetadataDebt(episode, now) {
 			reasonMask = RefreshDebtReasonEpisodeIncomplete
-			break
+			actionable = append(actionable, episode)
 		}
 	}
 	if reasonMask == 0 {
@@ -4080,7 +4187,7 @@ func (s *MetadataService) syncRefreshDebtForSeason(ctx context.Context, seasonID
 		seasonID,
 		effectiveRefreshDebtPriority(reasonMask, attemptCount),
 		reasonMask,
-		nextRefreshAtForDebt(reasonMask, attemptCount, now),
+		nextRefreshAtForEpisodeDebt(reasonMask, attemptCount, now, actionable...),
 	)
 }
 
@@ -4115,7 +4222,7 @@ func (s *MetadataService) syncRefreshDebtForEpisode(ctx context.Context, episode
 		episodeID,
 		effectiveRefreshDebtPriority(reasonMask, attemptCount),
 		reasonMask,
-		nextRefreshAtForDebt(reasonMask, attemptCount, now),
+		nextRefreshAtForEpisodeDebt(reasonMask, attemptCount, now, episode),
 	)
 }
 
@@ -4322,6 +4429,13 @@ func (s *MetadataService) refreshSeriesChildTarget(
 	if !strings.EqualFold(strings.TrimSpace(series.Type), "series") {
 		return ErrMetadataNotFound
 	}
+	// A season or episode refresh searches providers for the series too, so
+	// it must not run for a series an admin ignored.
+	if ignored, err := s.matchIgnored(ctx, seriesID); err != nil {
+		return err
+	} else if ignored {
+		return ErrMetadataNotFound
+	}
 
 	languages, err := s.resolveProcessLanguages(ctx, ProcessRequest{
 		ContentID: seriesID,
@@ -4518,7 +4632,9 @@ func (s *MetadataService) fetchTargetSeasonResults(ctx context.Context, provider
 				"provider", p.Slug(), "season", seasonNumber, "error", err)
 			continue
 		}
-		dropLocalSeasonArtwork(seasons, s.localSourceUsable)
+		if !s.localArtworkUsable() {
+			dropLocalSeasonArtwork(seasons)
+		}
 		if _, local := p.(IdentityHintProvider); local {
 			searched |= localArtworkSeason
 		}
@@ -4568,7 +4684,9 @@ func (s *MetadataService) fetchTargetEpisodeResults(ctx context.Context, provide
 				"provider", p.Slug(), "season", seasonNumber, "error", err)
 			continue
 		}
-		dropLocalEpisodeArtwork(episodes, s.localSourceUsable)
+		if !s.localArtworkUsable() {
+			dropLocalEpisodeArtwork(episodes)
+		}
 		if _, local := p.(IdentityHintProvider); local {
 			searched |= localArtworkEpisode
 		}
@@ -4590,16 +4708,14 @@ func (s *MetadataService) enqueueSeriesChildImages(ctx context.Context, seriesID
 }
 
 func (s *MetadataService) enqueueImageCacheJobs(ctx context.Context, targetKind, targetID string, inputs []EnqueueImageCacheJobInput) error {
-	if s == nil || s.imageCacheJobs == nil || len(inputs) == 0 {
+	// Caching off stores nothing: clients load artwork straight from the
+	// providers, and refreshes select no local artwork.
+	if s == nil || s.imageCacheJobs == nil || len(inputs) == 0 || !s.autoCacheImages.Load() {
 		return nil
 	}
 	enqueueCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 30*time.Second)
 	defer cancel()
 	inputs = s.copyLocalArtwork(enqueueCtx, targetKind, targetID, inputs)
-	if !s.autoCacheImages.Load() {
-		// Caching off stops remote downloads; local artwork is still queued.
-		inputs, _ = splitLocalImageCacheInputs(inputs)
-	}
 	if len(inputs) == 0 {
 		return nil
 	}
@@ -4669,68 +4785,42 @@ func isLocalImageSourcePath(path string) bool {
 	return strings.HasPrefix(lower, "file://") || isLocalMetadataURLSource(lower)
 }
 
-// localArtworkUsable reports whether refreshes may select local sidecar
-// artwork. A file:// source is never served directly: only an image-cache job
-// copies it into artwork storage. Without the queue (no artwork store wired), a
-// chosen local image would leave the slot empty instead of falling back to
-// provider artwork, so refreshes ignore local art altogether.
-// metadata.cache_images does not matter: it governs remote downloads, and
-// local art is copied either way.
+// localArtworkUsable reports whether refreshes may select local artwork: a
+// sidecar file (file://) or an image URL an NFO names (nfo+http(s)://). Neither
+// is served directly; only an image-cache job copies it into artwork storage.
+// With metadata.cache_images off nothing is copied, because clients load
+// artwork straight from the providers, and without the queue (no artwork store
+// wired) a chosen local image would leave the slot empty instead of falling
+// back to provider artwork. Either way refreshes ignore local art altogether.
 func (s *MetadataService) localArtworkUsable() bool {
-	return s != nil && s.imageCacheJobs != nil
-}
-
-// localSourceUsable reports whether a refresh may select a local artwork
-// source: a sidecar file whenever local artwork is usable, and an image URL an
-// NFO names only while metadata.cache_images is on. Such a URL is never served
-// directly, and the image cache's download is the only path that fetches it,
-// so with caching off it would leave the slot empty instead of falling back to
-// provider artwork.
-func (s *MetadataService) localSourceUsable(source string) bool {
-	return s.localArtworkUsable() && s.localMetadataURLUsable(source)
+	return s != nil && s.autoCacheImages.Load() && s.imageCacheJobs != nil
 }
 
-// localMetadataURLUsable reports whether source may be used when it is an
-// image URL an NFO names: only while metadata.cache_images is on. Any other
-// source passes.
-func (s *MetadataService) localMetadataURLUsable(source string) bool {
-	if _, nfoURL := localMetadataImageURL(source); nfoURL {
-		return s.autoCacheImages.Load()
-	}
-	return true
-}
-
-// withoutUnusableLocalImages returns images minus the local candidates usable
-// rejects. It returns images itself when it rejects none.
-func withoutUnusableLocalImages(images []RemoteImage, usable func(string) bool) []RemoteImage {
-	unusable := func(img RemoteImage) bool { return isLocalImageSourcePath(img.URL) && !usable(img.URL) }
-	if !slices.ContainsFunc(images, unusable) {
+// withoutLocalImages returns images minus local candidates. It returns images
+// itself when none are local.
+func withoutLocalImages(images []RemoteImage) []RemoteImage {
+	local := func(img RemoteImage) bool { return isLocalImageSourcePath(img.URL) }
+	if !slices.ContainsFunc(images, local) {
 		return images
 	}
-	return slices.DeleteFunc(slices.Clone(images), unusable)
+	return slices.DeleteFunc(slices.Clone(images), local)
 }
 
-// withoutLocalImages returns images minus local sidecar candidates. It returns
-// images itself when none are local.
-func withoutLocalImages(images []RemoteImage) []RemoteImage {
-	return withoutUnusableLocalImages(images, func(string) bool { return false })
-}
-
-// dropLocalSeasonArtwork clears the local posters usable rejects so a later
-// provider in the chain can fill the slot.
-func dropLocalSeasonArtwork(seasons []SeasonResult, usable func(string) bool) {
+// dropLocalSeasonArtwork clears local posters so a later provider in the chain
+// can fill the slot.
+func dropLocalSeasonArtwork(seasons []SeasonResult) {
 	for i := range seasons {
-		if isLocalImageSourcePath(seasons[i].PosterPath) && !usable(seasons[i].PosterPath) {
+		if isLocalImageSourcePath(seasons[i].PosterPath) {
 			seasons[i].PosterPath = ""
 		}
 	}
 }
 
-// dropLocalEpisodeArtwork clears the local stills usable rejects so a later
-// provider in the chain can fill the slot.
-func dropLocalEpisodeArtwork(episodes []EpisodeResult, usable func(string) bool) {
+// dropLocalEpisodeArtwork clears local stills so a later provider in the chain
+// can fill the slot.
+func dropLocalEpisodeArtwork(episodes []EpisodeResult) {
 	for i := range episodes {
-		if isLocalImageSourcePath(episodes[i].StillPath) && !usable(episodes[i].StillPath) {
+		if isLocalImageSourcePath(episodes[i].StillPath) {
 			episodes[i].StillPath = ""
 		}
 	}
@@ -4771,7 +4861,12 @@ func splitProviderImagePath(path string) (servedPath, sourcePath string) {
 	return path, providerImageSourcePath(path)
 }
 
-func preserveCachedArtwork(providerPath, providerThumbhash, existingCachedPath, existingSourcePath, existingThumbhash string) (string, string, string) {
+// preserveCachedArtwork merges a slot's provider path with what the slot
+// stores. keepStored is false while metadata.cache_images is off and the
+// slot's artwork is not locked: clients then load provider artwork straight
+// from the providers, so a provider path replaces a stored copy instead of
+// only becoming its source.
+func preserveCachedArtwork(providerPath, providerThumbhash, existingCachedPath, existingSourcePath, existingThumbhash string, keepStored bool) (string, string, string) {
 	// A local file:// source must never land in the served *_path column: it
 	// routes into *_source_path and, during the pre-cache window, the path
 	// keeps the prior cached key or remote stand-in (or stays empty) until the
@@ -4792,10 +4887,7 @@ func preserveCachedArtwork(providerPath, providerThumbhash, existingCachedPath,
 		}
 		return providerPath, providerThumbhash, ""
 	}
-	if isCachedImagePath(existingCachedPath) && existingSourcePath == providerPath {
-		return existingCachedPath, existingThumbhash, providerPath
-	}
-	if isCachedImagePath(existingCachedPath) {
+	if keepStored && isCachedImagePath(existingCachedPath) {
 		return existingCachedPath, existingThumbhash, providerPath
 	}
 	return providerPath, providerThumbhash, providerPath
@@ -4902,6 +4994,17 @@ func flattenEpisodeResults(accumulator map[episodeResultKey]*EpisodeResult) []Ep
 	return results
 }
 
+// dropAIText clears localized text an AI translation wrote before provider
+// text is merged in, so provider text replaces it in either merge mode. With
+// no provider text the field goes out empty, and the localization repository
+// keeps the stored AI text and its ai source; carrying it forward would label
+// it provider.
+func dropAIText(value *string, source string) {
+	if source == models.LocalizationSourceAI {
+		*value = ""
+	}
+}
+
 func buildItemLocalizationRecord(
 	existing *models.MediaItemLocalization,
 	contentID string,
@@ -4912,6 +5015,7 @@ func buildItemLocalizationRecord(
 	mergeMode MergeMode,
 	preferredLanguage string,
 	titleLocked bool,
+	keepStored bool,
 ) *models.MediaItemLocalization {
 	loc := &models.MediaItemLocalization{
 		ContentID: contentID,
@@ -4921,6 +5025,9 @@ func buildItemLocalizationRecord(
 		*loc = *existing
 		loc.ContentID = contentID
 		loc.Language = language
+		// AI text is not dropped here, unlike seasons and episodes: a refresh
+		// in a non-canonical language passes the canonical-language result as
+		// accumulator, so a dropped field would fill with canonical text.
 	}
 
 	mergeScalar(&loc.Title, accumulator.Title, mergeMode)
@@ -4953,7 +5060,7 @@ func buildItemLocalizationRecord(
 	// Local sidecar art is language-neutral: it must not duplicate into every
 	// localization row, so local candidates only compete at the item level.
 	applyBestImages(locItem, withoutLocalImages(images), mergeMode, preferredLanguage)
-	prepareItemImagesForQueue(locItem, existingLocItem)
+	prepareItemImagesForQueue(locItem, existingLocItem, keepStored)
 
 	loc.PosterPath = locItem.PosterPath
 	loc.PosterSourcePath = locItem.PosterSourcePath
@@ -4975,6 +5082,7 @@ func buildSeasonLocalizationRecord(
 	language string,
 	season SeasonResult,
 	mergeMode MergeMode,
+	keepStored bool,
 ) *models.SeasonLocalization {
 	loc := &models.SeasonLocalization{
 		SeasonContentID: seasonContentID,
@@ -4984,6 +5092,7 @@ func buildSeasonLocalizationRecord(
 		*loc = *existing
 		loc.SeasonContentID = seasonContentID
 		loc.Language = language
+		dropAIText(&loc.Overview, loc.OverviewSource)
 	}
 
 	previousPosterPath := loc.PosterPath
@@ -5010,6 +5119,7 @@ func buildSeasonLocalizationRecord(
 		previousPosterPath,
 		previousPosterSourcePath,
 		previousPosterThumbhash,
+		keepStored,
 	)
 
 	return loc
@@ -5030,6 +5140,7 @@ func buildEpisodeLocalizationRecord(
 		*loc = *existing
 		loc.EpisodeContentID = episodeContentID
 		loc.Language = language
+		dropAIText(&loc.Overview, loc.OverviewSource)
 	}
 
 	mergeScalar(&loc.Title, episode.Title, mergeMode)
@@ -5303,7 +5414,6 @@ func (s *MetadataService) persistSeasonAndEpisodeRows(
 	imagesLocked := artworkLocked(series)
 	imageJobs := make([]EnqueueImageCacheJobInput, 0, len(seasons)+len(episodes))
 	seasonArtwork := newLocalArtworkRetention(ctx, seriesID, localArtworkSeason)
-	seasonArtwork.usable = s.localMetadataURLUsable
 	episodeArtwork := seasonArtwork.atLevel(localArtworkEpisode)
 	fallbackProvider := primaryProviderID(providerIDs)
 	keyAttribution := func(sourcePath string) (string, string) {
@@ -5463,6 +5573,7 @@ func (s *MetadataService) persistSeasonAndEpisodeRows(
 				existingSeason.PosterPath,
 				existingSeason.PosterSourcePath,
 				existingSeason.PosterThumbhash,
+				s.autoCacheImages.Load(),
 			)
 			if imagesLocked && existingSeason.PosterPath != "" {
 				nextPath = existingSeason.PosterPath
@@ -5546,6 +5657,7 @@ func (s *MetadataService) persistSeasonAndEpisodeRows(
 				language,
 				write.provider,
 				mergeMode,
+				s.autoCacheImages.Load() || imagesLocked,
 			)
 			if err := s.seasonLocalizationRepo.Upsert(ctx, loc); err != nil {
 				slog.WarnContext(ctx, "metadata: failed to upsert season localization", "component", "metadata",
@@ -5601,6 +5713,7 @@ func (s *MetadataService) persistSeasonAndEpisodeRows(
 					language,
 					write.provider,
 					mergeMode,
+					s.autoCacheImages.Load() || imagesLocked,
 				)
 			}
 			localizationIndexes := make(map[*models.SeasonLocalization]int, len(localizations))
@@ -5875,6 +5988,7 @@ func (s *MetadataService) persistSeasonAndEpisodeRows(
 					existingEpisode.StillPath,
 					existingEpisode.StillSourcePath,
 					existingEpisode.StillThumbhash,
+					s.autoCacheImages.Load(),
 				)
 				if imagesLocked && existingEpisode.StillPath != "" {
 					nextPath = existingEpisode.StillPath
@@ -6793,7 +6907,7 @@ func (s *MetadataService) syncVisibleEpisodeRefreshDebt(ctx context.Context, epi
 		episode.ContentID,
 		effectiveRefreshDebtPriority(reasonMask, attemptCount),
 		reasonMask,
-		nextRefreshAtForDebt(reasonMask, attemptCount, now.UTC()),
+		nextRefreshAtForEpisodeDebt(reasonMask, attemptCount, now.UTC(), episode),
 	)
 }
 
@@ -6845,28 +6959,37 @@ func fallbackEpisodeTitle(episodeNum int) string {
 	return fmt.Sprintf("Episode %d", episodeNum)
 }
 
-// findExistingByProviderIDs checks if an item with matching provider IDs exists.
+// findExistingByProviderIDs returns the item that owns one of ids and is the
+// same title, or nil. An item that shares one ID but contradicts ids on
+// identity (identityProviderIDsContradict) is a different title: provider
+// cross-ID mappings are community-edited and can list one TVDB or IMDb ID on
+// two neighboring titles, and merging on that would fold a tagged movie into
+// another (issue #2263).
 func (s *MetadataService) findExistingByProviderIDs(
 	ctx context.Context,
 	ids map[string]string,
 	itemType string,
 	excludeContentID string,
 ) (*models.MediaItem, error) {
+	item, _, err := s.findProviderIDOwner(ctx, ids, itemType, excludeContentID)
+	return item, err
+}
+
+// findProviderIDOwner is findExistingByProviderIDs that also reports the keys
+// of ids whose owner it refused as a different title, with that owner.
+func (s *MetadataService) findProviderIDOwner(
+	ctx context.Context,
+	ids map[string]string,
+	itemType string,
+	excludeContentID string,
+) (*models.MediaItem, map[string]*models.MediaItem, error) {
 	if s == nil || s.itemRepo == nil {
-		return nil, nil
+		return nil, nil, nil
 	}
-	if s != nil && s.providerIDRepo != nil {
-		contentID, err := s.providerIDRepo.FindContentIDByProviderIDs(ctx, ids, itemType, excludeContentID)
-		if err != nil {
-			return nil, err
-		}
-		if contentID != "" {
-			item, err := s.itemRepo.GetByID(ctx, contentID)
-			if err != nil {
-				return nil, err
-			}
-			return item, nil
-		}
+	contested := make(map[string]*models.MediaItem)
+	owner, err := s.findDurableProviderIDOwner(ctx, ids, itemType, excludeContentID, contested)
+	if err != nil || owner != nil {
+		return owner, contested, err
 	}
 
 	tmdbID := ids["tmdb"]
@@ -6875,14 +6998,134 @@ func (s *MetadataService) findExistingByProviderIDs(
 	if tmdbID != "" || imdbID != "" || tvdbID != "" {
 		if item, err := s.itemRepo.GetByExternalID(ctx, tmdbID, imdbID, tvdbID, itemType); err == nil {
 			if excludeContentID != "" && item.ContentID == excludeContentID {
-				return nil, nil
+				return nil, contested, nil
 			}
+			if identityProviderIDsContradict(itemType, ids, itemIdentityProviderIDs(item, nil)) {
+				return nil, contested, nil
+			}
+			return item, contested, nil
+		}
+	}
+	return nil, contested, nil
+}
+
+// findDurableProviderIDOwner returns the first owner of one of ids in the
+// provider-ID repository that is the same title, looking up one owner per ID
+// in the repository's priority order so a refused owner of one ID does not
+// hide the right owner of another. It records each refused key in contested.
+func (s *MetadataService) findDurableProviderIDOwner(
+	ctx context.Context,
+	ids map[string]string,
+	itemType string,
+	excludeContentID string,
+	contested map[string]*models.MediaItem,
+) (*models.MediaItem, error) {
+	if s.providerIDRepo == nil {
+		return nil, nil
+	}
+	refused := make(map[string]*models.MediaItem)
+	for _, key := range providerIDLookupKeys(ids) {
+		contentID, err := s.providerIDRepo.FindContentIDByProviderIDs(ctx, map[string]string{key: ids[key]}, itemType, excludeContentID)
+		if err != nil {
+			return nil, err
+		}
+		if contentID == "" {
+			continue
+		}
+		if owner := refused[contentID]; owner != nil {
+			contested[key] = owner
+			continue
+		}
+		item, err := s.itemRepo.GetByID(ctx, contentID)
+		if err != nil {
+			return nil, err
+		}
+		same, err := s.sameTitleAs(ctx, item, ids, itemType)
+		if err != nil {
+			return nil, err
+		}
+		if same {
 			return item, nil
 		}
+		refused[contentID] = item
+		contested[key] = item
 	}
 	return nil, nil
 }
 
+// sameTitleAs reports whether item, with its stored provider IDs, agrees with
+// ids on identity (identityProviderIDsContradict).
+func (s *MetadataService) sameTitleAs(ctx context.Context, item *models.MediaItem, ids map[string]string, itemType string) (bool, error) {
+	stored, err := s.loadDurableProviderIDs(ctx, item.ContentID)
+	if err != nil {
+		return false, err
+	}
+	return !identityProviderIDsContradict(itemType, ids, itemIdentityProviderIDs(item, stored)), nil
+}
+
+// providerIDLookupKeys returns the durable keys of ids with a value, TMDB,
+// TVDB and IMDb first, as the provider-ID repository ranks them.
+func providerIDLookupKeys(ids map[string]string) []string {
+	keys := make([]string, 0, len(ids))
+	for key, value := range ids {
+		if strings.TrimSpace(value) == "" || isEphemeralProviderIDKey(key) {
+			continue
+		}
+		keys = append(keys, key)
+	}
+	slices.SortFunc(keys, func(a, b string) int {
+		rankA, rankB := slices.Index(trustedSearchIDKeys, a), slices.Index(trustedSearchIDKeys, b)
+		switch {
+		case rankA >= 0 && rankB >= 0:
+			return rankA - rankB
+		case rankA >= 0:
+			return -1
+		case rankB >= 0:
+			return 1
+		}
+		return strings.Compare(a, b)
+	})
+	return keys
+}
+
+// itemIdentityProviderIDs returns an item's identity IDs: its stored provider
+// ID rows, with its TMDB, TVDB and IMDb columns filling any row it lacks.
+func itemIdentityProviderIDs(item *models.MediaItem, stored map[string]string) map[string]string {
+	out := storedIdentityProviderIDs(item)
+	if out == nil {
+		out = make(map[string]string, len(trustedSearchIDKeys))
+	}
+	for _, key := range trustedSearchIDKeys {
+		if value := strings.TrimSpace(stored[key]); value != "" {
+			out[key] = value
+		}
+	}
+	return out
+}
+
+// identityProviderIDsContradict reports whether two ID sets of itemType name
+// different titles: they disagree on the first ID both carry, in the order
+// the type's content IDs anchor (contentid.AnchorPrecedence). For a movie
+// that is TMDB, IMDb, then TVDB, whose movie mappings are the cross-IDs
+// providers most often get wrong; for a series it is TVDB, TMDB, then IMDb.
+// Later IDs do not decide, so a movie whose TVDB mapping changed since it was
+// matched still matches on its TMDB ID, and a series whose TMDB mapping
+// changed still matches on its TVDB ID. A stored TMDB ID in TMDB's "id-slug"
+// URL form is the same ID as its number.
+func identityProviderIDsContradict(itemType string, a, b map[string]string) bool {
+	for _, key := range contentid.AnchorPrecedence(itemType) {
+		left, right := strings.TrimSpace(a[key]), strings.TrimSpace(b[key])
+		if key == "tmdb" {
+			left, right = catalog.NormalizeTMDBID(left), catalog.NormalizeTMDBID(right)
+		}
+		if left == "" || right == "" {
+			continue
+		}
+		return !strings.EqualFold(left, right)
+	}
+	return false
+}
+
 // skeletonResult carries the outcome of skeleton creation plus parsed hints so
 // the caller can seed them into the enrichment pipeline.
 type skeletonResult struct {
@@ -7430,6 +7673,25 @@ func (s *MetadataService) createOrFindSkeleton(ctx context.Context, file *models
 				existing = nil
 			}
 		}
+		if existing != nil {
+			// A wrong provider cross-ID can put one tagged ID on a different
+			// title (issue #2263), so the item must also agree with the tags
+			// on identity.
+			tagged := map[string]string{"tmdb": effectiveExternalIDs.TmdbID, "imdb": effectiveExternalIDs.ImdbID, "tvdb": effectiveExternalIDs.TvdbID}
+			same, sameErr := s.sameTitleAs(ctx, existing, tagged, res.Type)
+			if sameErr != nil {
+				return nil, fmt.Errorf("loading provider IDs of existing external-id item: %w", sameErr)
+			}
+			if !same {
+				// The lookup can pass over a matched item at the tags' own
+				// content ID; link to it rather than reset it to a skeleton.
+				existing = nil
+				anchored, deriveErr := deriveLogicalContentID(res.Type, contentid.ProviderIDs{Tmdb: res.TmdbID, Imdb: res.ImdbID, Tvdb: res.TvdbID}, "")
+				if deriveErr == nil && contentid.IsProviderAnchored(anchored) {
+					existing, _ = s.confirmedOwnershipItem(ctx, anchored)
+				}
+			}
+		}
 		if existing != nil {
 			if isConfirmedOwnershipStatus(existing.Status) {
 				if _, linkErr := s.claimGroupAndRelink(ctx, folderID, groupKeyVersion, contentGroupKey, contentRootPath, existing.ContentID); linkErr != nil {
@@ -7878,6 +8140,11 @@ func (s *MetadataService) rebindItemByProviderIDsLocked(
 	return existing.ContentID, nil
 }
 
+// recoverProviderIDConflict resolves a provider-ID unique conflict when
+// persisting sourceContentID: it merges the source onto the item that owns
+// its IDs and is the same title, or makes room for the source. It returns the
+// content ID to persist under, "" when the conflict stands, and the IDs it
+// removed from providerIDs.
 func (s *MetadataService) recoverProviderIDConflict(
 	ctx context.Context,
 	sourceContentID string,
@@ -7885,11 +8152,45 @@ func (s *MetadataService) recoverProviderIDConflict(
 	itemType string,
 	allowMatchedSource bool,
 	markIdentity bool,
-) (string, error) {
-	existing, err := s.findExistingByProviderIDs(ctx, providerIDs, itemType, sourceContentID)
+) (string, map[string]string, error) {
+	existing, contested, err := s.findProviderIDOwner(ctx, providerIDs, itemType, sourceContentID)
 	if err != nil {
-		return "", fmt.Errorf("finding existing item for provider conflict recovery: %w", err)
+		return "", nil, fmt.Errorf("finding existing item for provider conflict recovery: %w", err)
+	}
+	// A matched title keeps an ID that the source shares with it while
+	// contradicting it on identity; the source is persisted without that ID.
+	// An unconfirmed owner gives its IDs up below, as it always has.
+	dropped := make(map[string]string)
+	for key, owner := range contested {
+		if isConfirmedOwnershipStatus(owner.Status) {
+			dropped[key] = providerIDs[key]
+			delete(providerIDs, key)
+			slog.WarnContext(ctx, "metadata: left a provider ID with the other title that holds it", "component", "metadata",
+				"content_id", sourceContentID,
+				"provider", key,
+				"provider_id", dropped[key],
+				"owner_content_id", owner.ContentID,
+			)
+		} else if existing == nil {
+			existing = owner
+		}
 	}
+	reboundTo, err := s.recoverProviderIDConflictWith(ctx, existing, sourceContentID, providerIDs, itemType, allowMatchedSource, markIdentity)
+	if reboundTo == "" && err == nil && len(dropped) > 0 {
+		reboundTo = sourceContentID
+	}
+	return reboundTo, dropped, err
+}
+
+func (s *MetadataService) recoverProviderIDConflictWith(
+	ctx context.Context,
+	existing *models.MediaItem,
+	sourceContentID string,
+	providerIDs map[string]string,
+	itemType string,
+	allowMatchedSource bool,
+	markIdentity bool,
+) (string, error) {
 	if existing == nil || existing.ContentID == "" || existing.ContentID == sourceContentID {
 		return "", nil
 	}
@@ -7912,7 +8213,7 @@ func (s *MetadataService) recoverProviderIDConflict(
 			return "", fmt.Errorf("loading source status for provider conflict recovery: %w", statusErr)
 		}
 		if isProvisionalOwnershipStatus(sourceStatus) && isConfirmedOwnershipStatus(existing.Status) {
-			canonicalID, err := canonicalizeProviderIDDuplicateInto(ctx, s.dbPool, sourceContentID, existing.ContentID, false, markIdentity)
+			canonicalID, err := canonicalizeProviderIDDuplicateInto(ctx, s.dbPool, s.recsStaler, sourceContentID, existing.ContentID, false, markIdentity)
 			if err != nil {
 				return "", err
 			}
@@ -8028,6 +8329,21 @@ func (s *MetadataService) rebindItemOnto(ctx context.Context, fromContentID, toC
 			`,
 			args: []any{fromContentID, toContentID},
 		},
+		// A target with no embedding keeps the source's until the backfill
+		// re-embeds it from the target's own text, as the provider-ID merge
+		// does. The source's row goes with the source item (ON DELETE
+		// CASCADE), and stays when the source item survives.
+		{
+			name: "merge embeddings",
+			sql: `
+				INSERT INTO media_item_embeddings (media_item_id, embedding, model, canonical_text, created_at, updated_at)
+				SELECT $2, embedding, model, canonical_text, created_at, updated_at
+				FROM media_item_embeddings
+				WHERE media_item_id = $1
+				ON CONFLICT (media_item_id) DO NOTHING
+			`,
+			args: []any{fromContentID, toContentID},
+		},
 		{
 			// An admin's Identify choice survives the merge (identify_sticky.go).
 			name: "keep identity choice",
@@ -8060,12 +8376,13 @@ func (s *MetadataService) rebindItemOnto(ctx context.Context, fromContentID, toC
 	if err != nil {
 		return err
 	}
-	if _, err := reattribute.Run(ctx, tx, reattribute.Options{
+	report, err := reattribute.Run(ctx, tx, reattribute.Options{
 		FromContentID: fromContentID,
 		ToContentID:   toContentID,
 		WholeItem:     true,
 		EpisodePairs:  episodePairs,
-	}); err != nil {
+	})
+	if err != nil {
 		return fmt.Errorf("reattributing user state %s -> %s: %w", fromContentID, toContentID, err)
 	}
 
@@ -8090,6 +8407,7 @@ func (s *MetadataService) rebindItemOnto(ctx context.Context, fromContentID, toC
 	if err := tx.Commit(ctx); err != nil {
 		return fmt.Errorf("commit skeleton rebind transaction: %w", err)
 	}
+	MarkRecommendationsStale(ctx, s.recsStaler, MovedStateTargets(report, toContentID, episodePairs)...)
 	return nil
 }
 
@@ -8831,7 +9149,39 @@ func keepStoredArtwork(item, existing *models.MediaItem) {
 	}
 }
 
-func prepareItemImagesForQueue(item, existing *models.MediaItem) {
+// storedItemArtwork holds the stored poster, backdrop and logo copies
+// clearStoredItemArtwork emptied.
+type storedItemArtwork struct{ poster, backdrop, logo string }
+
+func (s *storedItemArtwork) slots(item *models.MediaItem) [3][2]*string {
+	return [3][2]*string{{&item.PosterPath, &s.poster}, {&item.BackdropPath, &s.backdrop}, {&item.LogoPath, &s.logo}}
+}
+
+// clearStoredItemArtwork empties the poster, backdrop and logo slots that
+// serve a stored copy, so applyBestImages fills them with any provider image.
+func clearStoredItemArtwork(item *models.MediaItem) storedItemArtwork {
+	var stored storedItemArtwork
+	for _, slot := range stored.slots(item) {
+		if isCachedImagePath(*slot[0]) {
+			*slot[1], *slot[0] = *slot[0], ""
+		}
+	}
+	return stored
+}
+
+// restoreUnfilled gives each slot no provider image filled its stored copy
+// back, so the rest of the merge sees it as if it had never been cleared.
+func (s storedItemArtwork) restoreUnfilled(item *models.MediaItem) {
+	for _, slot := range s.slots(item) {
+		if *slot[0] == "" && *slot[1] != "" {
+			*slot[0] = *slot[1]
+		}
+	}
+}
+
+// keepStored is preserveCachedArtwork's: false while metadata.cache_images is
+// off and the item's artwork is not locked.
+func prepareItemImagesForQueue(item, existing *models.MediaItem, keepStored bool) {
 	for _, field := range itemArtworkFields(item) {
 		// applyBestImages intentionally clears a clear-art logo on a manual
 		// refresh when no wordmark replacement exists. Do not let the
@@ -8867,6 +9217,7 @@ func prepareItemImagesForQueue(item, existing *models.MediaItem) {
 			existingPath,
 			existingSource,
 			existingThumbhash,
+			keepStored,
 		)
 		*field.path = nextPath
 		*field.source = nextSource
@@ -9134,8 +9485,7 @@ func primaryProviderID(ids map[string]string) string {
 // providerIDs should come from the parent MediaItem (for seasons/episodes,
 // the caller resolves up to the series item). contentType is "movie" or "series".
 func (s *MetadataService) FetchItemImages(ctx context.Context, providerIDs map[string]string, contentType string, language string, folderID int) ([]RemoteImage, map[string]string, error) {
-	contentLevel := contentType
-	chain, err := s.resolveChainCached(ctx, folderID, contentLevel)
+	chain, err := s.resolveChainCached(ctx, folderID, contentType)
 	if err != nil {
 		return nil, nil, fmt.Errorf("resolving provider chain: %w", err)
 	}
diff --git a/internal/metadata/service_test.go b/internal/metadata/service_test.go
index 53bd2c7a83..cc89d852c8 100644
--- a/internal/metadata/service_test.go
+++ b/internal/metadata/service_test.go
@@ -33,6 +33,9 @@ type fakeItemRepo struct {
 	mu    sync.Mutex
 	items map[string]*models.MediaItem
 
+	// replacedPeople records each ReplacePeople call by content ID.
+	replacedPeople map[string][]models.ItemPerson
+
 	// Trailer refresh cooldown state (metadataTrailerRefreshRepo).
 	trailersRequestedAt    map[string]time.Time
 	trailersRequestedAtErr error
@@ -178,7 +181,13 @@ func (r *fakeItemRepo) IncrementRefreshFailure(_ context.Context, contentID stri
 	return nil
 }
 
-func (r *fakeItemRepo) ReplacePeople(_ context.Context, _ string, _ []models.ItemPerson) error {
+func (r *fakeItemRepo) ReplacePeople(_ context.Context, contentID string, people []models.ItemPerson) error {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	if r.replacedPeople == nil {
+		r.replacedPeople = make(map[string][]models.ItemPerson)
+	}
+	r.replacedPeople[contentID] = append([]models.ItemPerson(nil), people...)
 	return nil
 }
 
@@ -1298,6 +1307,91 @@ func TestSyncRefreshDebtForItemPreservesRequestedEpisodeDebt(t *testing.T) {
 	}
 }
 
+func TestSyncRefreshDebtForItemWakesTerminalEpisodeDebtWhenRecentWindowCloses(t *testing.T) {
+	seed := func(t *testing.T, episode *models.Episode) (*testHarness, *fakeRefreshDebtRepo) {
+		t.Helper()
+		h := newTestHarness()
+		episodes := newFakeEpisodeRepo()
+		debts := newFakeRefreshDebtRepo()
+		h.service.episodeRepo = episodes
+		h.service.refreshDebtRepo = debts
+		rating := 7.5
+		h.itemRepo.items["series-1"] = &models.MediaItem{
+			ContentID:                 "series-1",
+			Type:                      "series",
+			Status:                    "matched",
+			Overview:                  "Complete",
+			PosterPath:                testPosterPath,
+			BackdropPath:              testBackdropPath,
+			RatingTMDB:                &rating,
+			EpisodeMetadataIncomplete: true,
+		}
+		if err := episodes.Upsert(context.Background(), episode); err != nil {
+			t.Fatalf("seed episode: %v", err)
+		}
+		debts.debts["series-1"] = &models.MetadataRefreshDebt{
+			TargetType:   RefreshTargetItem,
+			ContentID:    "series-1",
+			ReasonMask:   RefreshDebtReasonEpisodeIncomplete,
+			AttemptCount: refreshDebtEpisodeTerminalAttempts,
+		}
+		return h, debts
+	}
+	syncDebt := func(t *testing.T, h *testHarness, debts *fakeRefreshDebtRepo) *models.MetadataRefreshDebt {
+		t.Helper()
+		if err := h.service.syncRefreshDebtForItem(context.Background(), "series-1"); err != nil {
+			t.Fatalf("syncRefreshDebtForItem: %v", err)
+		}
+		debt, err := debts.Get(context.Background(), "series-1")
+		if err != nil {
+			t.Fatalf("Get debt: %v", err)
+		}
+		if debt.ReasonMask != RefreshDebtReasonEpisodeIncomplete {
+			t.Fatalf("reason mask = %d, want only episode incomplete", debt.ReasonMask)
+		}
+		return debt
+	}
+
+	t.Run("recent TBD episode caps the terminal delay", func(t *testing.T) {
+		aired := time.Now().UTC().Add(-10 * 24 * time.Hour).Truncate(24 * time.Hour)
+		h, debts := seed(t, &models.Episode{
+			ContentID:      "episode-recent-tbd",
+			SeriesID:       "series-1",
+			SeasonID:       "season-1",
+			SeasonNumber:   1,
+			EpisodeNumber:  1,
+			Title:          "TBD",
+			StillPath:      "s3://still.jpg",
+			AirDate:        &aired,
+			TmdbID:         "3812334",
+			MetadataSource: "provider",
+		})
+
+		debt := syncDebt(t, h, debts)
+		if want := aired.Add(EpisodeRecentStillWindow + time.Minute); !debt.NextRefreshAt.Equal(want) {
+			t.Fatalf("next refresh = %v, want %v (window close, not the %v terminal delay)", debt.NextRefreshAt, want, refreshDebtTerminalDelay)
+		}
+	})
+
+	t.Run("old fallback episode keeps the terminal delay", func(t *testing.T) {
+		h, debts := seed(t, &models.Episode{
+			ContentID:      "episode-fallback",
+			SeriesID:       "series-1",
+			SeasonID:       "season-1",
+			SeasonNumber:   1,
+			EpisodeNumber:  2,
+			Title:          "Episode 2",
+			MetadataSource: "scanner_fallback",
+		})
+
+		before := time.Now().UTC()
+		debt := syncDebt(t, h, debts)
+		if debt.NextRefreshAt.Before(before.Add(refreshDebtTerminalDelay)) {
+			t.Fatalf("next refresh = %v, want the %v terminal delay", debt.NextRefreshAt, refreshDebtTerminalDelay)
+		}
+	})
+}
+
 func TestSyncRefreshDebtForItemClearsDebtAfterSecondaryTMDBRejected(t *testing.T) {
 	h := newTestHarness()
 	ctx := context.Background()
@@ -1511,6 +1605,119 @@ func TestRefreshSeriesEpisodeMetadataStateUsesActionableDebt(t *testing.T) {
 			t.Fatalf("fallback debt reason mask = %d, want episode incomplete", debt.ReasonMask)
 		}
 	})
+
+	t.Run("old provider TBD episode clears while fallback episode keeps debt", func(t *testing.T) {
+		h := newTestHarness()
+		ctx := context.Background()
+		episodes := newFakeEpisodeRepo()
+		debts := newFakeRefreshDebtRepo()
+		h.service.episodeRepo = episodes
+		h.service.refreshDebtRepo = debts
+		h.itemRepo.items["series-mixed"] = &models.MediaItem{
+			ContentID:                 "series-mixed",
+			Type:                      "series",
+			EpisodeMetadataIncomplete: true,
+		}
+		old := now.Add(-400 * 24 * time.Hour)
+		for _, ep := range []*models.Episode{
+			{
+				ContentID:      "episode-tbd",
+				SeriesID:       "series-mixed",
+				SeasonID:       "season-mixed",
+				SeasonNumber:   1,
+				EpisodeNumber:  1,
+				Title:          "TBD",
+				Overview:       "Provider overview",
+				StillPath:      "s3://still.jpg",
+				AirDate:        &old,
+				TmdbID:         "3812334",
+				MetadataSource: "provider",
+			},
+			{
+				ContentID:      "episode-fallback",
+				SeriesID:       "series-mixed",
+				SeasonID:       "season-mixed",
+				SeasonNumber:   1,
+				EpisodeNumber:  2,
+				Title:          "Episode 2",
+				MetadataSource: "scanner_fallback",
+			},
+		} {
+			if err := episodes.Upsert(ctx, ep); err != nil {
+				t.Fatalf("seed %s: %v", ep.ContentID, err)
+			}
+		}
+		debts.debts[fakeRefreshDebtKey(RefreshTargetEpisode, "episode-tbd")] = &models.MetadataRefreshDebt{
+			TargetType:   RefreshTargetEpisode,
+			ContentID:    "episode-tbd",
+			ReasonMask:   RefreshDebtReasonEpisodeIncomplete,
+			AttemptCount: refreshDebtEpisodeTerminalAttempts,
+		}
+
+		h.service.refreshSeriesEpisodeMetadataState(ctx, "series-mixed", now)
+
+		if _, err := debts.GetTarget(ctx, RefreshTargetEpisode, "episode-tbd"); !errors.Is(err, ErrRefreshDebtNotFound) {
+			t.Fatalf("real TBD episode debt after refresh = %v, want ErrRefreshDebtNotFound", err)
+		}
+		debt, err := debts.GetTarget(ctx, RefreshTargetEpisode, "episode-fallback")
+		if err != nil || !hasRefreshDebtReason(debt.ReasonMask, RefreshDebtReasonEpisodeIncomplete) {
+			t.Fatalf("fallback episode debt = %+v, %v; want episode incomplete", debt, err)
+		}
+		item, err := h.itemRepo.GetByID(ctx, "series-mixed")
+		if err != nil {
+			t.Fatalf("GetByID: %v", err)
+		}
+		if !item.EpisodeMetadataIncomplete {
+			t.Fatal("expected the fallback episode to keep the series incomplete flag")
+		}
+	})
+
+	t.Run("terminal recent TBD debt wakes when the recent window closes", func(t *testing.T) {
+		h := newTestHarness()
+		ctx := context.Background()
+		episodes := newFakeEpisodeRepo()
+		debts := newFakeRefreshDebtRepo()
+		h.service.episodeRepo = episodes
+		h.service.refreshDebtRepo = debts
+		h.itemRepo.items["series-recent"] = &models.MediaItem{ContentID: "series-recent", Type: "series"}
+		aired := now.Add(-10 * 24 * time.Hour)
+		if err := episodes.Upsert(ctx, &models.Episode{
+			ContentID:      "episode-recent-tbd",
+			SeriesID:       "series-recent",
+			SeasonID:       "season-recent",
+			SeasonNumber:   1,
+			EpisodeNumber:  1,
+			Title:          "TBD",
+			StillPath:      "s3://still.jpg",
+			AirDate:        &aired,
+			TmdbID:         "3812334",
+			MetadataSource: "provider",
+		}); err != nil {
+			t.Fatalf("seed recent TBD episode: %v", err)
+		}
+		debts.debts[fakeRefreshDebtKey(RefreshTargetEpisode, "episode-recent-tbd")] = &models.MetadataRefreshDebt{
+			TargetType:   RefreshTargetEpisode,
+			ContentID:    "episode-recent-tbd",
+			ReasonMask:   RefreshDebtReasonEpisodeIncomplete,
+			AttemptCount: refreshDebtEpisodeTerminalAttempts,
+		}
+
+		h.service.refreshSeriesEpisodeMetadataState(ctx, "series-recent", now)
+
+		debt, err := debts.GetTarget(ctx, RefreshTargetEpisode, "episode-recent-tbd")
+		if err != nil {
+			t.Fatalf("GetTarget recent TBD debt: %v", err)
+		}
+		want := aired.Add(EpisodeRecentStillWindow + time.Minute)
+		if !debt.NextRefreshAt.Equal(want) {
+			t.Fatalf("next refresh = %v, want %v (window close, not the %v terminal delay)", debt.NextRefreshAt, want, refreshDebtTerminalDelay)
+		}
+		if EpisodeHasActionableMetadataDebt(&models.Episode{
+			Title: "TBD", StillPath: "s3://still.jpg", AirDate: &aired, TmdbID: "3812334", MetadataSource: "provider",
+		}, want) {
+			t.Fatal("recent TBD episode still owes debt when the debt row wakes")
+		}
+	})
 }
 
 func TestRequestStaleMetadataRefreshStartsOnDemandRefreshOnce(t *testing.T) {
diff --git a/internal/metadata/tagged_folder_merge_db_test.go b/internal/metadata/tagged_folder_merge_db_test.go
new file mode 100644
index 0000000000..5123ec76c3
--- /dev/null
+++ b/internal/metadata/tagged_folder_merge_db_test.go
@@ -0,0 +1,429 @@
+package metadata_test
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/catalog/filesplit"
+	"github.com/prairie-server/prairie-server/internal/catalog/reattribute"
+	"github.com/prairie-server/prairie-server/internal/contentid"
+	"github.com/prairie-server/prairie-server/internal/libraryingest"
+	"github.com/prairie-server/prairie-server/internal/metadata"
+	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/scanner"
+)
+
+// catalogMovie is one title the stub TMDB knows.
+type catalogMovie struct {
+	tmdb, imdb, tvdb, title string
+	year                    int
+}
+
+func (m catalogMovie) ids() map[string]string {
+	ids := map[string]string{"tmdb": m.tmdb, "imdb": m.imdb}
+	if m.tvdb != "" {
+		ids["tvdb"] = m.tvdb
+	}
+	return ids
+}
+
+// stubTMDB answers like the TMDB plugin: a search with a TMDB, IMDb or TVDB ID
+// looks that ID up, and only a search without one falls back to the title.
+// Its title search is loose the way TMDB's is: every title of the year that
+// shares a word with the query comes back.
+type stubTMDB struct {
+	mu     sync.Mutex
+	movies []catalogMovie
+}
+
+func (p *stubTMDB) Slug() string       { return "tmdb" }
+func (p *stubTMDB) Name() string       { return "The Movie Database" }
+func (p *stubTMDB) ForTypes() []string { return []string{"movie"} }
+
+func (p *stubTMDB) find(ids map[string]string) (catalogMovie, bool) {
+	for _, key := range []string{"tmdb", "imdb", "tvdb"} {
+		value := ids[key]
+		if value == "" {
+			continue
+		}
+		for _, movie := range p.movies {
+			if movie.ids()[key] == value {
+				return movie, true
+			}
+		}
+		return catalogMovie{}, false
+	}
+	return catalogMovie{}, false
+}
+
+func (p *stubTMDB) Search(_ context.Context, query metadata.SearchQuery) ([]metadata.SearchResult, error) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	result := func(m catalogMovie) metadata.SearchResult {
+		return metadata.SearchResult{Name: m.title, Year: m.year, ProviderIDs: m.ids(), Provider: "tmdb"}
+	}
+	if query.ProviderIDs["tmdb"] != "" || query.ProviderIDs["imdb"] != "" || query.ProviderIDs["tvdb"] != "" {
+		if movie, ok := p.find(query.ProviderIDs); ok {
+			return []metadata.SearchResult{result(movie)}, nil
+		}
+		return nil, nil
+	}
+	var out []metadata.SearchResult
+	words := strings.Fields(strings.ToLower(query.Title))
+	for _, movie := range p.movies {
+		if query.Year != 0 && (movie.year < query.Year-1 || movie.year > query.Year+1) {
+			continue
+		}
+		for _, word := range words {
+			if strings.Contains(strings.ToLower(movie.title), word) {
+				out = append(out, result(movie))
+				break
+			}
+		}
+	}
+	return out, nil
+}
+
+func (p *stubTMDB) GetMetadata(_ context.Context, req metadata.MetadataRequest) (*metadata.MetadataResult, error) {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	movie, ok := p.find(req.ProviderIDs)
+	if !ok {
+		return &metadata.MetadataResult{}, nil
+	}
+	return &metadata.MetadataResult{
+		HasMetadata: true,
+		Title:       movie.title,
+		Year:        movie.year,
+		ReleaseDate: fmt.Sprintf("%d-06-01", movie.year),
+		ProviderIDs: movie.ids(),
+	}, nil
+}
+
+// ingestHarness runs the production scan → classify → match path for movie
+// libraries against Postgres: the scanner, the movie match queue, the match
+// worker and the library ingest executor that drives them.
+type ingestHarness struct {
+	pool     *pgxpool.Pool
+	folders  *catalog.FolderRepository
+	executor *libraryingest.Executor
+}
+
+func newIngestHarness(t *testing.T, providers ...metadata.Provider) *ingestHarness {
+	t.Helper()
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	pool, err := pgxpool.New(context.Background(), dsn)
+	if err != nil {
+		t.Fatalf("connect test database: %v", err)
+	}
+	t.Cleanup(pool.Close)
+
+	files := scanner.NewFileRepository(pool)
+	folders := catalog.NewFolderRepository(pool)
+	skipped := metadata.NewSkippedRootRepository(pool)
+	service := metadata.NewMetadataService(nil, nil, nil,
+		catalog.NewItemRepository(pool), catalog.NewProviderIDRepository(pool),
+		catalog.NewEpisodeRepository(pool), catalog.NewSeasonRepository(pool),
+		catalog.NewLibraryItemRepository(pool), folders,
+		nil, files, skipped, nil, catalog.NewRootClaimRepository(pool))
+	service.SetLibraryRootResolver(folders)
+	metadata.MatchWithProvidersForTest(service, "en", providers...)
+
+	movieQueue := metadata.NewMovieMatchQueueRepository(pool, files)
+	worker := metadata.NewMatchWorker(service, files, 2, 10, time.Hour)
+	worker.SetMovieFileClaimer(movieQueue)
+
+	scan := scanner.NewScanner(files, "", nil, 1, false, 0)
+	scan.SetMetadataQueueProducer(metadata.NewMatchQueueCoordinator(movieQueue, metadata.NewSeriesRootMatchQueueRepository(pool)))
+	scan.SetMovieQueueSyncer(movieQueue)
+
+	return &ingestHarness{
+		pool:     pool,
+		folders:  folders,
+		executor: libraryingest.NewExecutor(scan, worker, folders, skipped, nil, nil),
+	}
+}
+
+// movieLibrary creates a movie library over root and removes it, with every
+// item its files reached, when the test ends.
+func (h *ingestHarness) movieLibrary(t *testing.T, root string) *models.MediaFolder {
+	t.Helper()
+	ctx := context.Background()
+	if err := os.MkdirAll(root, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	folder, err := h.folders.Create(ctx, catalog.CreateFolderInput{
+		Name:  fmt.Sprintf("Tagged merge %d", time.Now().UnixNano()),
+		Type:  "movies",
+		Paths: []string{root},
+	})
+	if err != nil {
+		t.Fatalf("create library: %v", err)
+	}
+	t.Cleanup(func() {
+		cleanup := context.Background()
+		_, _ = h.pool.Exec(cleanup, `
+			DELETE FROM media_items WHERE content_id IN (
+				SELECT content_id FROM media_files WHERE media_folder_id = $1 AND content_id IS NOT NULL
+				UNION SELECT content_id FROM media_item_libraries WHERE media_folder_id = $1)`, folder.ID)
+		_, _ = h.pool.Exec(cleanup, `DELETE FROM media_folders WHERE id = $1`, folder.ID)
+	})
+	return folder
+}
+
+func (h *ingestHarness) ingest(t *testing.T, folder *models.MediaFolder) {
+	t.Helper()
+	if _, err := h.executor.IngestFolder(t.Context(), folder); err != nil {
+		t.Fatalf("ingest library %d: %v", folder.ID, err)
+	}
+}
+
+// fileItem is the item a file belongs to.
+type fileItem struct {
+	contentID, status, tmdb, imdb, tvdb string
+}
+
+func (h *ingestHarness) itemOf(t *testing.T, path string) fileItem {
+	t.Helper()
+	var cid, status, tmdb, imdb, tvdb *string
+	if err := h.pool.QueryRow(t.Context(), `
+		SELECT mf.content_id, mi.status, mi.tmdb_id, mi.imdb_id, mi.tvdb_id
+		FROM media_files mf LEFT JOIN media_items mi ON mi.content_id = mf.content_id
+		WHERE mf.file_path = $1`, path).Scan(&cid, &status, &tmdb, &imdb, &tvdb); err != nil {
+		t.Fatalf("load file %s: %v", path, err)
+	}
+	deref := func(s *string) string {
+		if s == nil {
+			return ""
+		}
+		return *s
+	}
+	return fileItem{deref(cid), deref(status), deref(tmdb), deref(imdb), deref(tvdb)}
+}
+
+// expectMatched fails unless the file belongs to the matched item of movie.
+func (h *ingestHarness) expectMatched(t *testing.T, path string, movie catalogMovie) fileItem {
+	t.Helper()
+	got := h.itemOf(t, path)
+	want := "movie-tmdb-" + movie.tmdb
+	if got.contentID != want || got.status != "matched" || got.tmdb != movie.tmdb || got.imdb != movie.imdb {
+		t.Errorf("%s is on %+v, want matched %s (tmdb %s, imdb %s)", filepath.Base(path), got, want, movie.tmdb, movie.imdb)
+	}
+	return got
+}
+
+func writeMovieFile(t *testing.T, dir, name string) string {
+	t.Helper()
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(dir, name)
+	if err := os.WriteFile(path, []byte("video "+name), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	return path
+}
+
+// The movies from issue #2263. Each pair has its own TMDB and IMDb IDs, but
+// the provider data lists one TVDB ID for both movies of the pair: community
+// cross-ID mappings get neighboring titles wrong. Which provider supplied
+// the shared ID on the reporter's server is unknown; any provider can.
+var (
+	bataan       = catalogMovie{tmdb: "43506", imdb: "tt0035664", tvdb: "66484", title: "Bataan", year: 1943}
+	batman       = catalogMovie{tmdb: "125249", imdb: "tt0035665", tvdb: "66484", title: "Batman", year: 1943}
+	monk         = catalogMovie{tmdb: "595980", imdb: "tt1864420", tvdb: "357111", title: "Monk", year: 1968}
+	monkInEurope = catalogMovie{tmdb: "595983", imdb: "tt1864421", tvdb: "357111", title: "Monk in Europe", year: 1968}
+)
+
+func taggedName(m catalogMovie) string {
+	return fmt.Sprintf("%s (%d) [imdb-%s][tmdb-%s]", m.title, m.year, m.imdb, m.tmdb)
+}
+
+// TestScanKeepsTaggedMovieFoldersApartDB covers issue #2263 end to end: a
+// movie folder tagged with its own TMDB and IMDb IDs becomes its own matched
+// movie and is never merged into another movie whose IDs differ from its tags,
+// whether that movie is in another library from an earlier scan or is new in
+// the same scan. The TVDB ID both movies of a pair claim stays with the movie
+// that held it first.
+func TestScanKeepsTaggedMovieFoldersApartDB(t *testing.T) {
+	tmdb := &stubTMDB{movies: []catalogMovie{bataan, batman, monk, monkInEurope}}
+	h := newIngestHarness(t, tmdb)
+	root := t.TempDir()
+
+	notRated := h.movieLibrary(t, filepath.Join(root, "Movies-NotRated"))
+	bataanFile := writeMovieFile(t, filepath.Join(notRated.Paths[0], taggedName(bataan)), taggedName(bataan)+".mkv")
+	h.ingest(t, notRated)
+	h.expectMatched(t, bataanFile, bataan)
+
+	movies := h.movieLibrary(t, filepath.Join(root, "Archive"))
+	batmanFile := writeMovieFile(t, filepath.Join(movies.Paths[0], taggedName(batman)),
+		taggedName(batman)+"[DVD][AC3 2.0][x264].mkv")
+	monkFile := writeMovieFile(t, filepath.Join(movies.Paths[0], taggedName(monk)), taggedName(monk)+".mkv")
+	monkInEuropeFile := writeMovieFile(t, filepath.Join(movies.Paths[0], taggedName(monkInEurope)), taggedName(monkInEurope)+".mkv")
+	h.ingest(t, movies)
+
+	if got := h.expectMatched(t, bataanFile, bataan); got.tvdb != bataan.tvdb {
+		t.Errorf("Bataan has TVDB %q, want %s", got.tvdb, bataan.tvdb)
+	}
+	if got := h.expectMatched(t, batmanFile, batman); got.tvdb != "" {
+		t.Errorf("Batman has TVDB %q, which belongs to Bataan", got.tvdb)
+	}
+	monkItem := h.expectMatched(t, monkFile, monk)
+	monkInEuropeItem := h.expectMatched(t, monkInEuropeFile, monkInEurope)
+	if (monkItem.tvdb == monk.tvdb) == (monkInEuropeItem.tvdb == monk.tvdb) {
+		t.Errorf("Monk has TVDB %q and Monk in Europe %q, want exactly one with %s",
+			monkItem.tvdb, monkInEuropeItem.tvdb, monk.tvdb)
+	}
+	for _, path := range []string{bataanFile, batmanFile, monkFile, monkInEuropeFile} {
+		var siblings int
+		if err := h.pool.QueryRow(t.Context(), `
+			SELECT COUNT(*) FROM media_files WHERE content_id = (SELECT content_id FROM media_files WHERE file_path = $1)`,
+			path).Scan(&siblings); err != nil {
+			t.Fatal(err)
+		}
+		if siblings != 1 {
+			t.Errorf("%s shares its movie with %d other files, want none", filepath.Base(path), siblings-1)
+		}
+	}
+}
+
+// TestScanStillMergesCopiesOfOneMovieDB is the other side of #2263: copies of
+// one movie in different libraries still become versions of one item, tagged
+// or not, including after the provider changed the movie's TVDB mapping since
+// the first copy matched.
+func TestScanStillMergesCopiesOfOneMovieDB(t *testing.T) {
+	heat := catalogMovie{tmdb: "949", imdb: "tt0113277", tvdb: "1001", title: "Heat", year: 1995}
+	tmdb := &stubTMDB{movies: []catalogMovie{heat, {tmdb: "11", imdb: "tt0076759", title: "Heat Wave", year: 1995}}}
+	h := newIngestHarness(t, tmdb)
+	root := t.TempDir()
+
+	first := h.movieLibrary(t, filepath.Join(root, "Movies"))
+	taggedFile := writeMovieFile(t, filepath.Join(first.Paths[0], taggedName(heat)), taggedName(heat)+".mkv")
+	h.ingest(t, first)
+	h.expectMatched(t, taggedFile, heat)
+
+	second := h.movieLibrary(t, filepath.Join(root, "Movies-4K"))
+	untaggedFile := writeMovieFile(t, filepath.Join(second.Paths[0], "Heat (1995)"), "Heat (1995) 2160p.mkv")
+	h.ingest(t, second)
+	h.expectMatched(t, untaggedFile, heat)
+
+	tmdb.mu.Lock()
+	tmdb.movies[0].tvdb = "2002"
+	tmdb.mu.Unlock()
+	third := h.movieLibrary(t, filepath.Join(root, "Movies-Remux"))
+	remappedFile := writeMovieFile(t, filepath.Join(third.Paths[0], "Heat (1995)"), "Heat (1995) Remux.mkv")
+	h.ingest(t, third)
+	h.expectMatched(t, remappedFile, heat)
+}
+
+// TestRescanAfterSplitKeepsTaggedMovieApartDB covers the reproduction in
+// #2263: a tagged movie that an earlier build merged into another movie is
+// split back out as unmatched, and the rescan the split runs matches it as its
+// own movie instead of merging it again.
+func TestRescanAfterSplitKeepsTaggedMovieApartDB(t *testing.T) {
+	tmdb := &stubTMDB{movies: []catalogMovie{bataan, batman}}
+	h := newIngestHarness(t, tmdb)
+	ctx := t.Context()
+	root := t.TempDir()
+
+	notRated := h.movieLibrary(t, filepath.Join(root, "Movies-NotRated"))
+	bataanFile := writeMovieFile(t, filepath.Join(notRated.Paths[0], taggedName(bataan)), taggedName(bataan)+".mkv")
+	h.ingest(t, notRated)
+	movies := h.movieLibrary(t, filepath.Join(root, "Archive"))
+	batmanDir := filepath.Join(movies.Paths[0], taggedName(batman))
+	batmanFile := writeMovieFile(t, batmanDir, taggedName(batman)+"[DVD][AC3 2.0][x264].mkv")
+	h.ingest(t, movies)
+
+	// The state an earlier build's merge left: Batman's file is a version of
+	// Bataan, and Batman has no item.
+	exec := func(query string, args ...any) {
+		t.Helper()
+		if _, err := h.pool.Exec(ctx, query, args...); err != nil {
+			t.Fatalf("%s: %v", query, err)
+		}
+	}
+	exec(`UPDATE media_files SET content_id = $1 WHERE file_path = $2`, "movie-tmdb-"+bataan.tmdb, batmanFile)
+	exec(`DELETE FROM media_items WHERE content_id = $1`, "movie-tmdb-"+batman.tmdb)
+	exec(`INSERT INTO media_item_libraries (content_id, media_folder_id) VALUES ($1, $2) ON CONFLICT DO NOTHING`,
+		"movie-tmdb-"+bataan.tmdb, movies.ID)
+
+	// Split it out as unmatched, as POST /admin/items/{id}/split does with
+	// target.unmatched and no override.
+	var file filesplit.File
+	if err := h.pool.QueryRow(ctx, `
+		SELECT id, content_id, media_folder_id, file_path, COALESCE(canonical_root_path, ''), COALESCE(observed_root_path, ''),
+		       group_key_version, COALESCE(content_group_key, ''), COALESCE(base_type, '')
+		FROM media_files WHERE file_path = $1`, batmanFile).Scan(&file.ID, &file.ContentID, &file.MediaFolderID, &file.FilePath,
+		&file.CanonicalRootPath, &file.ObservedRootPath, &file.GroupKeyVersion, &file.ContentGroupKey, &file.BaseType); err != nil {
+		t.Fatalf("load Batman file: %v", err)
+	}
+	local := contentid.ForLocal(batmanFile)
+	tx, err := h.pool.Begin(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = tx.Rollback(ctx) }()
+	if _, err := tx.Exec(ctx, `INSERT INTO media_items (content_id, type, title, year, status) VALUES ($1, 'movie', 'Bataan', 1943, 'unmatched')`, local); err != nil {
+		t.Fatalf("create split target: %v", err)
+	}
+	if _, err := tx.Exec(ctx, `INSERT INTO media_item_libraries (content_id, media_folder_id) VALUES ($1, $2)`, local, movies.ID); err != nil {
+		t.Fatalf("split target library: %v", err)
+	}
+	if _, err := filesplit.Move(ctx, tx, filesplit.Options{
+		FromContentID: "movie-tmdb-" + bataan.tmdb, ToContentID: local, ItemType: "movie",
+		Files: []filesplit.File{file}, HistoryMode: reattribute.HistoryModeKeep,
+	}); err != nil {
+		t.Fatalf("split: %v", err)
+	}
+	if err := tx.Commit(ctx); err != nil {
+		t.Fatal(err)
+	}
+	if got := h.itemOf(t, batmanFile); got.contentID != local {
+		t.Fatalf("split left Batman's file on %q, want %s", got.contentID, local)
+	}
+
+	if _, err := h.executor.IngestSubtree(ctx, movies, batmanDir); err != nil {
+		t.Fatalf("rescan the split root: %v", err)
+	}
+	h.expectMatched(t, batmanFile, batman)
+	h.expectMatched(t, bataanFile, bataan)
+}
+
+// TestScanKeepsTaggedMovieApartFromTitleWithItsTaggedIDDB covers the scan's
+// tag lookup for #2263: the provider lists Batman's IMDb ID on Bataan, so
+// Bataan's IMDb column holds the ID Batman's folder is tagged with. The
+// folder's TMDB tag contradicts Bataan, so Batman still becomes its own movie
+// instead of a version of Bataan.
+func TestScanKeepsTaggedMovieApartFromTitleWithItsTaggedIDDB(t *testing.T) {
+	wrongBataan := catalogMovie{tmdb: bataan.tmdb, imdb: batman.imdb, title: bataan.title, year: bataan.year}
+	tmdb := &stubTMDB{movies: []catalogMovie{wrongBataan, batman}}
+	h := newIngestHarness(t, tmdb)
+	root := t.TempDir()
+
+	notRated := h.movieLibrary(t, filepath.Join(root, "Movies-NotRated"))
+	bataanName := fmt.Sprintf("Bataan (1943) [tmdb-%s]", bataan.tmdb)
+	bataanFile := writeMovieFile(t, filepath.Join(notRated.Paths[0], bataanName), bataanName+".mkv")
+	h.ingest(t, notRated)
+	h.expectMatched(t, bataanFile, wrongBataan)
+
+	movies := h.movieLibrary(t, filepath.Join(root, "Archive"))
+	batmanFile := writeMovieFile(t, filepath.Join(movies.Paths[0], taggedName(batman)), taggedName(batman)+".mkv")
+	h.ingest(t, movies)
+
+	if got := h.itemOf(t, batmanFile); got.contentID != "movie-tmdb-"+batman.tmdb || got.status != "matched" {
+		t.Errorf("Batman is on %+v, want matched movie-tmdb-%s", got, batman.tmdb)
+	}
+	h.expectMatched(t, bataanFile, wrongBataan)
+}
diff --git a/internal/metadata/tmdb/client.go b/internal/metadata/tmdb/client.go
index dd25cf3369..b7411afc08 100644
--- a/internal/metadata/tmdb/client.go
+++ b/internal/metadata/tmdb/client.go
@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"math"
 	"net/http"
 	"net/url"
 	"slices"
@@ -14,6 +15,7 @@ import (
 	"strings"
 	"time"
 
+	"golang.org/x/sync/errgroup"
 	"golang.org/x/sync/singleflight"
 	"golang.org/x/time/rate"
 
@@ -26,7 +28,7 @@ const (
 	projectAPIKey              = "4ef0d7355d9ffb5151e987764708ce96"
 	maxRetries                 = 3
 	maxResponseBody            = 1 << 20 // 1 MB
-	maxCollectionPresetResults = 500
+	maxCollectionPresetResults = maxPages * 20
 	defaultResponseCacheTTL    = 2 * time.Hour
 	// certificationCacheTTL is deliberately much longer than the shared
 	// response TTL: a certification is assigned at release and effectively
@@ -43,6 +45,10 @@ const (
 	mediaDetailCacheTTL = 2 * time.Minute
 )
 
+// maxPages is TMDB's own ceiling on its paged feeds (trending, popular,
+// discover): it answers no page past 500, at 20 results a page.
+const maxPages = 500
+
 // Client is an HTTP client for the TMDB collection preset API surface.
 type Client struct {
 	httpClient           *http.Client
@@ -52,6 +58,7 @@ type Client struct {
 	discoverSectionCache *cache.TTLCache[*MediaPage]
 	discoverPageCache    *cache.TTLCache[*MediaPage]
 	externalIDCache      *cache.TTLCache[*ExternalIDs]
+	findCache            *cache.TTLCache[*[]MediaResult]
 	certificationCache   *cache.TTLCache[string]
 	mediaDetailCache     *cache.TTLCache[*MediaDetail]
 	cacheGroup           singleflight.Group
@@ -78,6 +85,7 @@ func NewClient(apiKey string, rateLimit int) *Client {
 		discoverSectionCache: cache.NewTTLCache[*MediaPage](),
 		discoverPageCache:    cache.NewTTLCache[*MediaPage](),
 		externalIDCache:      cache.NewTTLCache[*ExternalIDs](),
+		findCache:            cache.NewTTLCache[*[]MediaResult](),
 		certificationCache:   cache.NewTTLCache[string](),
 		mediaDetailCache:     cache.NewTTLCache[*MediaDetail](),
 		responseCacheTTL:     defaultResponseCacheTTL,
@@ -103,6 +111,9 @@ func (c *Client) Close() {
 	if c.externalIDCache != nil {
 		c.externalIDCache.Close()
 	}
+	if c.findCache != nil {
+		c.findCache.Close()
+	}
 	if c.certificationCache != nil {
 		c.certificationCache.Close()
 	}
@@ -500,7 +511,7 @@ func (c *Client) GetCollectionPreset(ctx context.Context, preset, mediaType, tim
 	}
 
 	results := make([]CollectionResult, 0, limit)
-	for page := 1; len(results) < limit; page++ {
+	for page := 1; len(results) < limit && page <= maxPages; page++ {
 		path := fmt.Sprintf("%s?page=%d", basePath, page)
 		done := false
 
@@ -628,7 +639,7 @@ func (c *Client) Discover(ctx context.Context, mediaType string, params Discover
 	}
 
 	results := make([]CollectionResult, 0, limit)
-	for page := 1; len(results) < limit; page++ {
+	for page := 1; len(results) < limit && page <= maxPages; page++ {
 		query := baseQuery + "&page=" + strconv.Itoa(page)
 		path := basePath + "?" + query
 
@@ -857,44 +868,83 @@ func (c *Client) GetCollection(ctx context.Context, id int) (*Collection, error)
 // order. Lists mix movies and TV shows; entries of any other media type are
 // skipped. The endpoint pages 20 entries at a time, so reading stops at the
 // list's last page or once limit entries are collected. A limit <= 0 reads
-// the whole list, capped like the presets at maxCollectionPresetResults.
+// the whole list.
 func (c *Client) GetList(ctx context.Context, id, limit int) ([]CollectionResult, error) {
 	if id <= 0 {
 		return nil, fmt.Errorf("tmdb: list id must be > 0 (got %d)", id)
 	}
-	if limit <= 0 || limit > maxCollectionPresetResults {
-		limit = maxCollectionPresetResults
+	if limit <= 0 {
+		limit = math.MaxInt
 	}
 
-	results := make([]CollectionResult, 0, min(limit, 100))
-	for page := 1; len(results) < limit; page++ {
-		var resp listResponse
-		if err := c.doGet(ctx, fmt.Sprintf("/list/%d?page=%d", id, page), &resp); err != nil {
+	first, err := c.getListPage(ctx, id, 1)
+	if err != nil {
+		return nil, err
+	}
+	results := appendListItems(make([]CollectionResult, 0, min(limit, 100)), first.Items)
+	// Later pages load a few at a time; the client's rate limit sets the
+	// pace, and results keep list order.
+	for next := 2; next <= first.TotalPages && len(results) < limit; {
+		// A page holds at most listPageSize entries; ask for no more pages
+		// than the remaining limit can use.
+		needed := (limit-len(results)-1)/listPageSize + 1
+		pages := make([]listResponse, min(listPageFetches, first.TotalPages-next+1, needed))
+		g, gctx := errgroup.WithContext(ctx)
+		for i := range pages {
+			g.Go(func() error {
+				page, err := c.getListPage(gctx, id, next+i)
+				pages[i] = page
+				return err
+			})
+		}
+		if err := g.Wait(); err != nil {
 			return nil, err
 		}
-		for _, item := range resp.Items {
-			if item.MediaType != "movie" && item.MediaType != "tv" {
-				continue
+		next += len(pages)
+		for _, page := range pages {
+			if len(page.Items) == 0 {
+				return truncateResults(results, limit), nil
 			}
-			title := item.Title
-			if title == "" {
-				title = item.Name
-			}
-			results = append(results, CollectionResult{
-				ID:        item.ID,
-				MediaType: item.MediaType,
-				Title:     title,
-			})
+			results = appendListItems(results, page.Items)
 		}
-		if page >= resp.TotalPages || len(resp.Items) == 0 {
-			break
+	}
+	return truncateResults(results, limit), nil
+}
+
+// listPageFetches bounds the list pages GetList requests at once;
+// listPageSize is the most entries TMDB puts on one list page.
+const (
+	listPageFetches = 8
+	listPageSize    = 20
+)
+
+func (c *Client) getListPage(ctx context.Context, id, page int) (listResponse, error) {
+	var resp listResponse
+	err := c.doGet(ctx, fmt.Sprintf("/list/%d?page=%d", id, page), &resp)
+	return resp, err
+}
+
+// appendListItems appends a list page's movies and TV shows; lists can also
+// hold people, which are skipped.
+func appendListItems(results []CollectionResult, items []TrendingResult) []CollectionResult {
+	for _, item := range items {
+		if item.MediaType != "movie" && item.MediaType != "tv" {
+			continue
 		}
+		title := item.Title
+		if title == "" {
+			title = item.Name
+		}
+		results = append(results, CollectionResult{ID: item.ID, MediaType: item.MediaType, Title: title})
 	}
+	return results
+}
 
+func truncateResults(results []CollectionResult, limit int) []CollectionResult {
 	if len(results) > limit {
-		results = results[:limit]
+		return results[:limit]
 	}
-	return results, nil
+	return results
 }
 
 // GetMediaDetail fetches a single TMDB movie or series with credits, external
@@ -1623,18 +1673,87 @@ const (
 // ID, with Silo-facing media types ("movie", "series"); no result is an empty
 // slice, not an error. Results are not cached: callers use it to recover a
 // title whose TMDB ID stopped resolving, which is rare and wants a fresh
-// answer.
+// answer. Repeated matching uses FindByExternalIDCached.
 func (c *Client) FindByExternalID(ctx context.Context, source, externalID string) ([]MediaResult, error) {
+	path, err := findPath(source, externalID)
+	if err != nil {
+		return nil, err
+	}
+	return c.fetchFind(ctx, path)
+}
+
+// FindByExternalIDCached is FindByExternalID for lookups that recur, such as
+// matching every sync's list entries against the same catalog titles. It
+// serves a cached answer for the response cache TTL, and concurrent lookups of
+// one ID share a single request.
+func (c *Client) FindByExternalIDCached(ctx context.Context, source, externalID string) ([]MediaResult, error) {
+	path, err := findPath(source, externalID)
+	if err != nil {
+		return nil, err
+	}
+	cacheKey := "find:" + path
+	if c.findCache != nil {
+		if cached, ok := c.findCache.Get(cacheKey); ok {
+			return slices.Clone(*cached), nil
+		}
+	}
+	// The fetch below outlives its caller, so a caller that has already
+	// stopped must not start one; a canceled sync would otherwise leave a
+	// detached request behind for every title it had left.
+	if err := ctx.Err(); err != nil {
+		return nil, err
+	}
+	// DoChan + select, as in cachedCertification: the shared fetch runs
+	// detached with its own bound, so one caller's cancellation cannot fail
+	// another sync's lookup, and each caller still stops waiting on its own
+	// cancellation.
+	resultCh := c.cacheGroup.DoChan(cacheKey, func() (any, error) {
+		if c.findCache != nil {
+			if cached, ok := c.findCache.Get(cacheKey); ok {
+				return *cached, nil
+			}
+		}
+		fetchCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), sharedFetchTimeout)
+		defer cancel()
+		results, err := c.fetchFind(fetchCtx, path)
+		if err != nil {
+			return nil, err
+		}
+		if c.findCache != nil && c.responseCacheTTL > 0 {
+			cached := slices.Clone(results)
+			c.findCache.Set(cacheKey, &cached, c.responseCacheTTL)
+		}
+		return results, nil
+	})
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	case result := <-resultCh:
+		if result.Err != nil {
+			return nil, result.Err
+		}
+		results, ok := result.Val.([]MediaResult)
+		if !ok {
+			return nil, errors.New("tmdb: invalid cached find response")
+		}
+		return slices.Clone(results), nil
+	}
+}
+
+func findPath(source, externalID string) (string, error) {
 	externalID = strings.TrimSpace(externalID)
 	if externalID == "" {
-		return nil, fmt.Errorf("tmdb: external id must not be empty")
+		return "", errors.New("tmdb: external id must not be empty")
 	}
 	switch source {
 	case ExternalSourceIMDb, ExternalSourceTVDB:
 	default:
-		return nil, fmt.Errorf("tmdb: invalid external source %q", source)
+		return "", fmt.Errorf("tmdb: invalid external source %q", source)
 	}
-	path := "/find/" + url.PathEscape(externalID) + "?external_source=" + url.QueryEscape(source)
+	return "/find/" + url.PathEscape(externalID) + "?external_source=" + url.QueryEscape(source), nil
+}
+
+func (c *Client) fetchFind(ctx context.Context, path string) ([]MediaResult, error) {
 	var resp findResponse
 	if err := c.doGet(ctx, path, &resp); err != nil {
 		return nil, err
diff --git a/internal/metadata/tmdb/client_test.go b/internal/metadata/tmdb/client_test.go
index 225671f41b..75331c778e 100644
--- a/internal/metadata/tmdb/client_test.go
+++ b/internal/metadata/tmdb/client_test.go
@@ -4,11 +4,13 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"math"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
 	"reflect"
 	"slices"
+	"strconv"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -1389,6 +1391,99 @@ func TestGetListPagesMixedEntriesInListOrder(t *testing.T) {
 	}
 }
 
+// A list is read to its last page however long it is; collections have no
+// item cap of their own.
+func TestGetListReadsWholeLongList(t *testing.T) {
+	const pageCount = 30 // 600 entries, past the old 500-entry cap
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		page, _ := strconv.Atoi(r.URL.Query().Get("page"))
+		items := make([]map[string]any, 20)
+		for i := range items {
+			items[i] = map[string]any{"id": page*100 + i, "media_type": "movie", "title": "Movie"}
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(map[string]any{"page": page, "total_pages": pageCount, "items": items})
+	}))
+	defer server.Close()
+
+	client := NewClient("test-key", 1000)
+	client.SetBaseURL(server.URL)
+
+	got, err := client.GetList(context.Background(), 310, 0)
+	if err != nil {
+		t.Fatalf("GetList: %v", err)
+	}
+	if len(got) != pageCount*20 {
+		t.Fatalf("GetList returned %d entries, want %d", len(got), pageCount*20)
+	}
+	// Pages load concurrently but keep list order.
+	for i, entry := range got {
+		if want := (i/20+1)*100 + i%20; entry.ID != want {
+			t.Fatalf("entry %d has ID %d, want %d", i, entry.ID, want)
+		}
+	}
+}
+
+// A limit stops GetList from requesting pages it cannot use.
+func TestGetListRequestsOnlyPagesTheLimitNeeds(t *testing.T) {
+	var requests atomic.Int64
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		requests.Add(1)
+		page, _ := strconv.Atoi(r.URL.Query().Get("page"))
+		items := make([]map[string]any, 20)
+		for i := range items {
+			items[i] = map[string]any{"id": page*100 + i, "media_type": "movie", "title": "Movie"}
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(map[string]any{"page": page, "total_pages": 50, "items": items})
+	}))
+	defer server.Close()
+
+	client := NewClient("test-key", 1000)
+	client.SetBaseURL(server.URL)
+
+	got, err := client.GetList(context.Background(), 310, 45)
+	if err != nil {
+		t.Fatalf("GetList: %v", err)
+	}
+	if len(got) != 45 || requests.Load() != 3 {
+		t.Fatalf("GetList(limit=45) returned %d entries from %d pages, want 45 from 3", len(got), requests.Load())
+	}
+}
+
+// TMDB answers no page past 500 of its paged feeds, so a preset stops there
+// even when the limit asks for more and short pages leave it below the limit.
+func TestGetCollectionPresetStopsAtTMDBPageCeiling(t *testing.T) {
+	var lastPage atomic.Int64
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		page, _ := strconv.Atoi(r.URL.Query().Get("page"))
+		if page > maxPages {
+			w.WriteHeader(http.StatusBadRequest)
+			return
+		}
+		lastPage.Store(int64(page))
+		results := make([]map[string]any, 19)
+		for i := range results {
+			results[i] = map[string]any{"id": page*100 + i, "media_type": "movie", "title": "Movie"}
+		}
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(map[string]any{"page": page, "total_pages": 1000, "results": results})
+	}))
+	defer server.Close()
+
+	client := NewClient("test-key", 100000)
+	client.SetBaseURL(server.URL)
+
+	got, err := client.GetCollectionPreset(context.Background(), "trending", "all", "week", math.MaxInt)
+	if err != nil {
+		t.Fatalf("GetCollectionPreset: %v", err)
+	}
+	if len(got) != maxPages*19 || lastPage.Load() != maxPages {
+		t.Fatalf("GetCollectionPreset returned %d entries through page %d, want %d through page %d",
+			len(got), lastPage.Load(), maxPages*19, maxPages)
+	}
+}
+
 func TestGetListRejectsNonPositiveID(t *testing.T) {
 	client := NewClient("test-key", 1000)
 	if _, err := client.GetList(context.Background(), 0, 10); err == nil {
@@ -1679,3 +1774,70 @@ func TestFindByExternalID(t *testing.T) {
 		t.Fatal("empty id should fail before any request")
 	}
 }
+
+// Recurring matching reuses one /find answer; recovery still asks TMDB again.
+func TestFindByExternalIDCached(t *testing.T) {
+	var requests atomic.Int32
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		requests.Add(1)
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"movie_results":[{"id":550,"title":"Fight Club"}],"tv_results":[]}`))
+	}))
+	defer server.Close()
+
+	client := NewClient("test-key", 1000)
+	defer client.Close()
+	client.SetBaseURL(server.URL)
+
+	for range 3 {
+		results, err := client.FindByExternalIDCached(t.Context(), ExternalSourceIMDb, "tt0137523")
+		if err != nil || len(results) != 1 || results[0].ID != 550 {
+			t.Fatalf("cached find = %+v, %v", results, err)
+		}
+		results[0].ID = 0 // a caller's edit must not reach the cache
+	}
+	if got := requests.Load(); got != 1 {
+		t.Fatalf("cached finds made %d requests, want 1", got)
+	}
+	if _, err := client.FindByExternalID(t.Context(), ExternalSourceIMDb, "tt0137523"); err != nil {
+		t.Fatal(err)
+	}
+	if got := requests.Load(); got != 2 {
+		t.Fatalf("uncached find made %d requests in total, want 2", got)
+	}
+	if _, err := client.FindByExternalIDCached(t.Context(), "facebook_id", "x"); err == nil {
+		t.Fatal("unsupported source should fail before any request")
+	}
+}
+
+// A canceled sync must not leave a detached /find request behind for each
+// title it had left to look up.
+func TestFindByExternalIDCachedCanceledCallerSendsNoRequest(t *testing.T) {
+	var requests atomic.Int32
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		requests.Add(1)
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"movie_results":[],"tv_results":[]}`))
+	}))
+	defer server.Close()
+
+	client := NewClient("test-key", 1000)
+	defer client.Close()
+	client.SetBaseURL(server.URL)
+
+	ctx, cancel := context.WithCancel(t.Context())
+	cancel()
+	for i := range 20 {
+		if _, err := client.FindByExternalIDCached(ctx, ExternalSourceIMDb, "tt"+strconv.Itoa(i)); !errors.Is(err, context.Canceled) {
+			t.Fatalf("canceled find err = %v, want context.Canceled", err)
+		}
+	}
+	// A fetch that had started would finish against this local server well
+	// within the uncached find below, which waits for its own response.
+	if _, err := client.FindByExternalID(t.Context(), ExternalSourceIMDb, "tt9999999"); err != nil {
+		t.Fatal(err)
+	}
+	if got := requests.Load(); got != 1 {
+		t.Fatalf("server saw %d requests, want only the uncached find", got)
+	}
+}
diff --git a/internal/metadata/trakt/client.go b/internal/metadata/trakt/client.go
deleted file mode 100644
index 3c061f348e..0000000000
--- a/internal/metadata/trakt/client.go
+++ /dev/null
@@ -1,384 +0,0 @@
-package trakt
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"net/http"
-	"net/url"
-	"strconv"
-	"strings"
-	"sync/atomic"
-	"time"
-
-	"golang.org/x/time/rate"
-
-	"github.com/prairie-server/prairie-server/internal/buildinfo"
-)
-
-const (
-	defaultBaseURL             = "https://api.trakt.tv"
-	maxRetries                 = 3
-	maxResponseBody            = 2 << 20
-	maxCollectionPresetResults = 500
-	defaultCollectionPageLimit = 20
-	defaultCollectionRateLimit = 5
-	traktAPIVersion            = "2"
-	// Trakt's recommendation endpoints take a limit but no page, and cap the
-	// limit at 100.
-	maxRecommendationResults = 100
-)
-
-// Client is an HTTP client for Trakt collection/discovery feeds.
-type Client struct {
-	httpClient *http.Client
-	// clientID is swapped atomically so a saved credential change reaches a
-	// long-lived client without rebuilding it — and therefore without a
-	// server restart. See SetClientID.
-	clientID atomic.Pointer[string]
-	baseURL  string
-	limiter  *rate.Limiter
-}
-
-// NewClient creates a Trakt client. clientID is required by Trakt for API
-// calls, but may be empty here when the caller keeps it current through
-// SetClientID.
-func NewClient(clientID string, rateLimit int) *Client {
-	if rateLimit <= 0 {
-		rateLimit = defaultCollectionRateLimit
-	}
-	c := &Client{
-		httpClient: &http.Client{Timeout: 20 * time.Second},
-		baseURL:    defaultBaseURL,
-		limiter:    rate.NewLimiter(rate.Limit(rateLimit), rateLimit),
-	}
-	c.SetClientID(clientID)
-	return c
-}
-
-// SetClientID replaces the app client ID sent on subsequent requests. Safe to
-// call while requests are in flight, which is what lets a new
-// watchsync.trakt.client_id apply without restarting the server.
-func (c *Client) SetClientID(clientID string) {
-	trimmed := strings.TrimSpace(clientID)
-	c.clientID.Store(&trimmed)
-}
-
-// ClientID returns the app client ID currently in use.
-func (c *Client) ClientID() string {
-	if current := c.clientID.Load(); current != nil {
-		return *current
-	}
-	return ""
-}
-
-// SetBaseURL overrides the API base URL. Used by tests.
-func (c *Client) SetBaseURL(raw string) {
-	c.baseURL = strings.TrimRight(raw, "/")
-}
-
-// GetCollectionPreset fetches a normalized Trakt discovery feed.
-func (c *Client) GetCollectionPreset(ctx context.Context, preset, mediaType string, limit int, accessToken string) ([]CollectionEntry, error) {
-	path, err := collectionPresetPath(preset, mediaType)
-	if err != nil {
-		return nil, err
-	}
-	if preset == "recommended" && strings.TrimSpace(accessToken) == "" {
-		return nil, errors.New("trakt: recommended preset requires access token")
-	}
-	if limit <= 0 {
-		limit = defaultCollectionPageLimit
-	}
-	if limit > maxCollectionPresetResults {
-		limit = maxCollectionPresetResults
-	}
-	if preset == "recommended" {
-		return c.getRecommendations(ctx, path, mediaType, min(limit, maxRecommendationResults), accessToken)
-	}
-
-	results := make([]CollectionEntry, 0, limit)
-	for page := 1; len(results) < limit; page++ {
-		pageLimit := limit - len(results)
-		if pageLimit > defaultCollectionPageLimit {
-			pageLimit = defaultCollectionPageLimit
-		}
-		reqPath := fmt.Sprintf("%s?page=%d&limit=%d", path, page, pageLimit)
-
-		var pageEntries []CollectionEntry
-		switch preset {
-		case "trending":
-			pageEntries, err = c.getTrending(ctx, reqPath, mediaType, accessToken)
-		case "popular":
-			pageEntries, err = c.getMediaList(ctx, reqPath, mediaType, accessToken)
-		default:
-			err = fmt.Errorf("trakt: invalid preset %q", preset)
-		}
-		if err != nil {
-			return nil, err
-		}
-		for i := range pageEntries {
-			pageEntries[i].Rank = len(results) + i + 1
-		}
-		results = append(results, pageEntries...)
-		if len(pageEntries) < pageLimit {
-			break
-		}
-	}
-	if len(results) > limit {
-		results = results[:limit]
-	}
-	return results, nil
-}
-
-func collectionPresetPath(preset, mediaType string) (string, error) {
-	if mediaType != "movie" && mediaType != "tv" {
-		return "", fmt.Errorf("trakt: media_type must be movie or tv")
-	}
-	switch preset {
-	case "trending", "popular":
-		if mediaType == "movie" {
-			return "/movies/" + preset, nil
-		}
-		return "/shows/" + preset, nil
-	case "recommended":
-		if mediaType == "movie" {
-			return "/recommendations/movies", nil
-		}
-		return "/recommendations/shows", nil
-	default:
-		return "", fmt.Errorf("trakt: preset must be trending, popular, or recommended")
-	}
-}
-
-// GetUserList fetches the items of a user-authored Trakt list
-// (/users/{user}/lists/{list}/items), preserving list order. Lists mix
-// movies and shows; unknown item types (people, episodes, seasons) are
-// skipped. Public lists need only the app client id; accessToken is passed
-// through for the owner's private lists.
-func (c *Client) GetUserList(ctx context.Context, user, list string, limit int, accessToken string) ([]CollectionEntry, error) {
-	user = strings.TrimSpace(user)
-	list = strings.TrimSpace(list)
-	if user == "" || list == "" {
-		return nil, errors.New("trakt: user list requires user and list slug")
-	}
-	if limit <= 0 {
-		limit = defaultCollectionPageLimit
-	}
-	if limit > maxCollectionPresetResults {
-		limit = maxCollectionPresetResults
-	}
-
-	basePath := fmt.Sprintf("/users/%s/lists/%s/items", url.PathEscape(user), url.PathEscape(list))
-	results := make([]CollectionEntry, 0, limit)
-	for page := 1; len(results) < limit; page++ {
-		pageLimit := limit - len(results)
-		if pageLimit > defaultCollectionPageLimit {
-			pageLimit = defaultCollectionPageLimit
-		}
-		var resp []struct {
-			Rank  int         `json:"rank"`
-			Type  string      `json:"type"`
-			Movie *traktMedia `json:"movie"`
-			Show  *traktMedia `json:"show"`
-		}
-		reqPath := fmt.Sprintf("%s?page=%d&limit=%d", basePath, page, pageLimit)
-		if err := c.doGet(ctx, reqPath, accessToken, &resp); err != nil {
-			return nil, err
-		}
-		if len(resp) == 0 {
-			break
-		}
-		for _, row := range resp {
-			var entry CollectionEntry
-			switch {
-			case row.Type == "movie" && row.Movie != nil:
-				entry = row.Movie.entry("movie")
-			case row.Type == "show" && row.Show != nil:
-				entry = row.Show.entry("tv")
-			default:
-				continue
-			}
-			entry.Rank = row.Rank
-			results = append(results, entry)
-			if len(results) >= limit {
-				break
-			}
-		}
-		if len(resp) < pageLimit {
-			break
-		}
-	}
-	return results, nil
-}
-
-func (c *Client) getTrending(ctx context.Context, path, mediaType, accessToken string) ([]CollectionEntry, error) {
-	if mediaType == "movie" {
-		var resp []struct {
-			Movie traktMedia `json:"movie"`
-		}
-		if err := c.doGet(ctx, path, accessToken, &resp); err != nil {
-			return nil, err
-		}
-		entries := make([]CollectionEntry, 0, len(resp))
-		for _, row := range resp {
-			entries = append(entries, row.Movie.entry("movie"))
-		}
-		return entries, nil
-	}
-
-	var resp []struct {
-		Show traktMedia `json:"show"`
-	}
-	if err := c.doGet(ctx, path, accessToken, &resp); err != nil {
-		return nil, err
-	}
-	entries := make([]CollectionEntry, 0, len(resp))
-	for _, row := range resp {
-		entries = append(entries, row.Show.entry("tv"))
-	}
-	return entries, nil
-}
-
-// getRecommendations fetches the ranked list in one request, because the
-// endpoint has no page parameter to walk.
-func (c *Client) getRecommendations(ctx context.Context, path, mediaType string, limit int, accessToken string) ([]CollectionEntry, error) {
-	entries, err := c.getMediaList(ctx, fmt.Sprintf("%s?limit=%d", path, limit), mediaType, accessToken)
-	if err != nil {
-		return nil, err
-	}
-	for i := range entries {
-		entries[i].Rank = i + 1
-	}
-	return entries, nil
-}
-
-func (c *Client) getMediaList(ctx context.Context, path, mediaType, accessToken string) ([]CollectionEntry, error) {
-	var resp []traktMedia
-	if err := c.doGet(ctx, path, accessToken, &resp); err != nil {
-		return nil, err
-	}
-	entries := make([]CollectionEntry, 0, len(resp))
-	for _, row := range resp {
-		entries = append(entries, row.entry(mediaType))
-	}
-	return entries, nil
-}
-
-func (c *Client) doGet(ctx context.Context, path string, accessToken string, dest any) error {
-	// Read once so every retry of this request uses one client ID even if a
-	// credential change lands mid-flight.
-	clientID := c.ClientID()
-	if clientID == "" {
-		return errors.New("trakt: client id is required")
-	}
-	if err := c.limiter.Wait(ctx); err != nil {
-		return err
-	}
-
-	reqURL := c.baseURL + path
-	for attempt := 0; attempt <= maxRetries; attempt++ {
-		req, err := http.NewRequestWithContext(ctx, http.MethodGet, reqURL, nil)
-		if err != nil {
-			return fmt.Errorf("trakt: create request: %w", err)
-		}
-		req.Header.Set("Content-Type", "application/json")
-		req.Header.Set("Accept", "application/json")
-		req.Header.Set("trakt-api-version", traktAPIVersion)
-		req.Header.Set("trakt-api-key", clientID)
-		req.Header.Set("User-Agent", buildinfo.UserAgent())
-		if strings.TrimSpace(accessToken) != "" {
-			req.Header.Set("Authorization", "Bearer "+strings.TrimSpace(accessToken))
-		}
-
-		resp, err := c.httpClient.Do(req)
-		if err != nil {
-			return fmt.Errorf("trakt: request failed: %w", err)
-		}
-
-		if resp.StatusCode == http.StatusTooManyRequests {
-			resp.Body.Close()
-			if attempt < maxRetries {
-				if err := sleepContext(ctx, retryAfterOrDefault(resp, attempt)); err != nil {
-					return err
-				}
-				continue
-			}
-			return fmt.Errorf("trakt: rate limited after %d retries", maxRetries)
-		}
-		if resp.StatusCode >= 500 {
-			resp.Body.Close()
-			if attempt < maxRetries {
-				if err := sleepContext(ctx, time.Duration(1<<attempt)*time.Second); err != nil {
-					return err
-				}
-				continue
-			}
-			return fmt.Errorf("trakt: server error %d after %d retries", resp.StatusCode, maxRetries)
-		}
-		if resp.StatusCode >= 400 {
-			body, _ := io.ReadAll(io.LimitReader(resp.Body, maxResponseBody))
-			resp.Body.Close()
-			return fmt.Errorf("trakt: HTTP %d: %s", resp.StatusCode, strings.TrimSpace(string(body)))
-		}
-
-		decodeErr := json.NewDecoder(io.LimitReader(resp.Body, maxResponseBody)).Decode(dest)
-		resp.Body.Close()
-		if decodeErr != nil {
-			return fmt.Errorf("trakt: decode response: %w", decodeErr)
-		}
-		return nil
-	}
-	return fmt.Errorf("trakt: max retries exceeded")
-}
-
-func sleepContext(ctx context.Context, d time.Duration) error {
-	timer := time.NewTimer(d)
-	defer timer.Stop()
-	select {
-	case <-timer.C:
-		return nil
-	case <-ctx.Done():
-		return ctx.Err()
-	}
-}
-
-func retryAfterOrDefault(resp *http.Response, attempt int) time.Duration {
-	if val := resp.Header.Get("Retry-After"); val != "" {
-		if secs, err := strconv.Atoi(val); err == nil && secs > 0 {
-			return time.Duration(secs) * time.Second
-		}
-		if when, err := http.ParseTime(val); err == nil {
-			if d := time.Until(when); d > 0 {
-				return d
-			}
-		}
-	}
-	return time.Duration(1<<attempt) * time.Second
-}
-
-type traktMedia struct {
-	Title string   `json:"title"`
-	Year  int      `json:"year"`
-	IDs   traktIDs `json:"ids"`
-}
-
-type traktIDs struct {
-	Trakt int    `json:"trakt"`
-	TMDB  int    `json:"tmdb"`
-	TVDB  int    `json:"tvdb"`
-	IMDb  string `json:"imdb"`
-}
-
-func (m traktMedia) entry(mediaType string) CollectionEntry {
-	return CollectionEntry{
-		TraktID:   m.IDs.Trakt,
-		TMDBID:    m.IDs.TMDB,
-		TVDBID:    m.IDs.TVDB,
-		IMDbID:    strings.TrimSpace(m.IDs.IMDb),
-		MediaType: mediaType,
-		Title:     m.Title,
-		Year:      m.Year,
-	}
-}
diff --git a/internal/metadata/trakt/client_test.go b/internal/metadata/trakt/client_test.go
deleted file mode 100644
index 23918a1a1a..0000000000
--- a/internal/metadata/trakt/client_test.go
+++ /dev/null
@@ -1,169 +0,0 @@
-package trakt
-
-import (
-	"context"
-	"encoding/json"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-	"testing/synctest"
-	"time"
-)
-
-func TestGetCollectionPresetTrendingSendsHeadersAndDecodesMovies(t *testing.T) {
-	var gotAPIKey, gotVersion, gotUserAgent string
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotAPIKey = r.Header.Get("trakt-api-key")
-		gotVersion = r.Header.Get("trakt-api-version")
-		gotUserAgent = r.Header.Get("User-Agent")
-		if r.URL.Path != "/movies/trending" {
-			t.Fatalf("path = %s, want /movies/trending", r.URL.Path)
-		}
-		writeJSON(t, w, []map[string]any{{
-			"watchers": 3,
-			"movie": map[string]any{
-				"title": "The Matrix",
-				"year":  1999,
-				"ids": map[string]any{
-					"trakt": 1,
-					"tmdb":  603,
-					"imdb":  "tt0133093",
-				},
-			},
-		}})
-	}))
-	defer server.Close()
-
-	client := NewClient("client-id", 1000)
-	client.SetBaseURL(server.URL)
-
-	results, err := client.GetCollectionPreset(context.Background(), "trending", "movie", 1, "")
-	if err != nil {
-		t.Fatalf("GetCollectionPreset: %v", err)
-	}
-	if gotAPIKey != "client-id" || gotVersion != "2" {
-		t.Fatalf("headers api=%q version=%q", gotAPIKey, gotVersion)
-	}
-	// Trakt may block requests without an identifying User-Agent.
-	if !strings.HasPrefix(gotUserAgent, "Prairie/") {
-		t.Fatalf("User-Agent = %q, want Prairie/<build>", gotUserAgent)
-	}
-	if len(results) != 1 || results[0].Title != "The Matrix" || results[0].TMDBID != 603 || results[0].IMDbID != "tt0133093" {
-		t.Fatalf("results = %+v", results)
-	}
-}
-
-// Recommendations take a limit of at most 100 and no page, so the preset asks
-// once instead of walking pages.
-func TestGetCollectionPresetRecommendedUsesBearerToken(t *testing.T) {
-	var queries []string
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		queries = append(queries, r.URL.RawQuery)
-		if r.URL.Path != "/recommendations/shows" {
-			t.Fatalf("path = %s, want /recommendations/shows", r.URL.Path)
-		}
-		if got := r.Header.Get("Authorization"); got != "Bearer token" {
-			t.Fatalf("Authorization = %q", got)
-		}
-		writeJSON(t, w, []map[string]any{{
-			"title": "The Expanse",
-			"year":  2015,
-			"ids": map[string]any{
-				"trakt": 2,
-				"tvdb":  280619,
-				"tmdb":  63639,
-				"imdb":  "tt3230854",
-			},
-		}})
-	}))
-	defer server.Close()
-
-	client := NewClient("client-id", 1000)
-	client.SetBaseURL(server.URL)
-
-	results, err := client.GetCollectionPreset(context.Background(), "recommended", "tv", 250, "token")
-	if err != nil {
-		t.Fatalf("GetCollectionPreset: %v", err)
-	}
-	if len(queries) != 1 || queries[0] != "limit=100" {
-		t.Fatalf("queries = %q, want one request with limit=100", queries)
-	}
-	if len(results) != 1 || results[0].MediaType != "tv" || results[0].TVDBID != 280619 || results[0].Rank != 1 {
-		t.Fatalf("results = %+v", results)
-	}
-}
-
-func TestGetCollectionPresetRejectsRecommendedWithoutToken(t *testing.T) {
-	client := NewClient("client-id", 1000)
-	if _, err := client.GetCollectionPreset(context.Background(), "recommended", "movie", 1, ""); err == nil {
-		t.Fatal("expected error")
-	}
-}
-
-type retryTransport func(*http.Request) (*http.Response, error)
-
-func (f retryTransport) RoundTrip(r *http.Request) (*http.Response, error) { return f(r) }
-
-func TestGetCollectionPresetRetriesRateLimit(t *testing.T) {
-	synctest.Test(t, func(t *testing.T) {
-		attempts := 0
-		client := NewClient("client-id", 1000)
-		client.httpClient = &http.Client{Transport: retryTransport(func(*http.Request) (*http.Response, error) {
-			attempts++
-			if attempts == 1 {
-				return &http.Response{StatusCode: http.StatusTooManyRequests, Header: http.Header{"Retry-After": {"1"}}, Body: http.NoBody}, nil
-			}
-			return &http.Response{StatusCode: http.StatusOK, Header: make(http.Header), Body: io.NopCloser(strings.NewReader(`[{"title":"Popular","year":2026,"ids":{"trakt":3,"tmdb":10}}]`))}, nil
-		})}
-		started := time.Now()
-		results, err := client.GetCollectionPreset(t.Context(), "popular", "movie", 1, "")
-		if err != nil {
-			t.Fatalf("GetCollectionPreset: %v", err)
-		}
-		if attempts != 2 || len(results) != 1 {
-			t.Fatalf("attempts=%d results=%+v", attempts, results)
-		}
-		if elapsed := time.Since(started); elapsed < time.Second {
-			t.Fatalf("retry waited %s, want at least the Retry-After second", elapsed)
-		}
-	})
-}
-
-// A saved credential change has to reach a client that was built at startup;
-// this is what lets watchsync.trakt.client_id stay out of the restart registry.
-func TestSetClientIDAppliesToLaterRequests(t *testing.T) {
-	var gotAPIKey string
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		gotAPIKey = r.Header.Get("trakt-api-key")
-		writeJSON(t, w, []map[string]any{})
-	}))
-	defer server.Close()
-
-	client := NewClient("", 1000)
-	client.SetBaseURL(server.URL)
-
-	if _, err := client.GetCollectionPreset(context.Background(), "popular", "movie", 1, ""); err == nil {
-		t.Fatal("expected an error while no client id is configured")
-	}
-
-	client.SetClientID("  rotated-client-id  ")
-	if got := client.ClientID(); got != "rotated-client-id" {
-		t.Fatalf("ClientID() = %q, want trimmed rotated-client-id", got)
-	}
-	if _, err := client.GetCollectionPreset(context.Background(), "popular", "movie", 1, ""); err != nil {
-		t.Fatalf("GetCollectionPreset after SetClientID: %v", err)
-	}
-	if gotAPIKey != "rotated-client-id" {
-		t.Fatalf("trakt-api-key = %q, want rotated-client-id", gotAPIKey)
-	}
-}
-
-func writeJSON(t *testing.T, w http.ResponseWriter, v any) {
-	t.Helper()
-	w.Header().Set("Content-Type", "application/json")
-	if err := json.NewEncoder(w).Encode(v); err != nil {
-		t.Fatalf("encode response: %v", err)
-	}
-}
diff --git a/internal/metadata/trakt/types.go b/internal/metadata/trakt/types.go
deleted file mode 100644
index 1f5cfb81c1..0000000000
--- a/internal/metadata/trakt/types.go
+++ /dev/null
@@ -1,13 +0,0 @@
-package trakt
-
-// CollectionEntry is a normalized Trakt collection/discovery result.
-type CollectionEntry struct {
-	TraktID   int
-	TMDBID    int
-	TVDBID    int
-	IMDbID    string
-	MediaType string
-	Title     string
-	Year      int
-	Rank      int
-}
diff --git a/internal/metadata/trakt/user_list_test.go b/internal/metadata/trakt/user_list_test.go
deleted file mode 100644
index c26169c48a..0000000000
--- a/internal/metadata/trakt/user_list_test.go
+++ /dev/null
@@ -1,72 +0,0 @@
-package trakt
-
-import (
-	"context"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-)
-
-func TestGetUserListDecodesMixedTypesInListOrder(t *testing.T) {
-	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path != "/users/jjjonesjr33/lists/saw-timeline/items" {
-			t.Fatalf("path = %s, want /users/jjjonesjr33/lists/saw-timeline/items", r.URL.Path)
-		}
-		writeJSON(t, w, []map[string]any{
-			{
-				"rank": 1,
-				"type": "movie",
-				"movie": map[string]any{
-					"title": "Saw",
-					"year":  2004,
-					"ids":   map[string]any{"trakt": 10, "tmdb": 176, "imdb": "tt0387564"},
-				},
-			},
-			{
-				"rank": 2,
-				"type": "show",
-				"show": map[string]any{
-					"title": "Saw: The Series",
-					"year":  2024,
-					"ids":   map[string]any{"trakt": 11, "tvdb": 999001},
-				},
-			},
-			// Unknown types (person, episode, season) are skipped, not fatal.
-			{
-				"rank": 3,
-				"type": "person",
-			},
-		})
-	}))
-	defer server.Close()
-
-	client := NewClient("client-id", 1000)
-	client.SetBaseURL(server.URL)
-
-	results, err := client.GetUserList(context.Background(), "jjjonesjr33", "saw-timeline", 10, "")
-	if err != nil {
-		t.Fatalf("GetUserList: %v", err)
-	}
-	if len(results) != 2 {
-		t.Fatalf("results = %d, want 2 (unknown types skipped)", len(results))
-	}
-	if results[0].MediaType != "movie" || results[0].TMDBID != 176 || results[0].Title != "Saw" {
-		t.Fatalf("first entry = %+v, want the Saw movie", results[0])
-	}
-	if results[1].MediaType != "tv" || results[1].TVDBID != 999001 {
-		t.Fatalf("second entry = %+v, want the show mapped to media type tv", results[1])
-	}
-	if results[0].Rank != 1 || results[1].Rank != 2 {
-		t.Fatalf("ranks = %d,%d, want list order preserved", results[0].Rank, results[1].Rank)
-	}
-}
-
-func TestGetUserListRequiresUserAndSlug(t *testing.T) {
-	client := NewClient("client-id", 1000)
-	if _, err := client.GetUserList(context.Background(), "", "slug", 10, ""); err == nil {
-		t.Fatal("empty user must error")
-	}
-	if _, err := client.GetUserList(context.Background(), "user", "", 10, ""); err == nil {
-		t.Fatal("empty list slug must error")
-	}
-}
diff --git a/internal/metadata/translation/connection_test.go b/internal/metadata/translation/connection_test.go
index 152c1b8ba2..386ea494d3 100644
--- a/internal/metadata/translation/connection_test.go
+++ b/internal/metadata/translation/connection_test.go
@@ -61,7 +61,7 @@ func TestMetadataJobUsesEnqueueProviderAcrossQueuedAndBatchedWork(t *testing.T)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if job.Model != "selected-model" || job.IdempotencyKey != idempotencyKey(TargetItem, "series1", "fr", job.Model) {
+	if job.Model != "selected-model" || job.IdempotencyKey != idempotencyKey(TargetItem, "series1", "fr", job.Model, true, false) {
 		t.Fatal("recorded model did not use live selection")
 	}
 	current.Store(new(llm.Config{BaseURL: "https://later.example.test", ChatModel: "changed-while-queued"}))
diff --git a/internal/metadata/translation/job.go b/internal/metadata/translation/job.go
index b0f0829cbb..f6685394c1 100644
--- a/internal/metadata/translation/job.go
+++ b/internal/metadata/translation/job.go
@@ -13,6 +13,8 @@ import (
 	"encoding/hex"
 	"errors"
 	"fmt"
+	"strconv"
+	"strings"
 	"time"
 
 	"github.com/prairie-server/prairie-server/internal/ai/jobrunner"
@@ -35,11 +37,37 @@ type TargetKind string
 const (
 	// TargetItem covers a movie or series; for series, IncludeChildren expands
 	// the job to every season and episode overview.
-	TargetItem    TargetKind = "item"
+	TargetItem TargetKind = "item"
+	// TargetSeason covers one season; IncludeChildren adds the overviews of
+	// that season's episodes.
 	TargetSeason  TargetKind = "season"
 	TargetEpisode TargetKind = "episode"
+	// TargetLibrary prewarms every item of a library (with its seasons and
+	// episodes) that misses a localization; ContentID is LibraryContentID.
+	TargetLibrary TargetKind = "library"
 )
 
+const libraryContentIDPrefix = "library:"
+
+// LibraryContentID is the content_id a library prewarm job is stored under.
+// The prefix keeps it apart from catalog content IDs.
+func LibraryContentID(libraryID int) string {
+	return libraryContentIDPrefix + strconv.Itoa(libraryID)
+}
+
+// ParseLibraryContentID returns the library ID of a LibraryContentID.
+func ParseLibraryContentID(contentID string) (int, bool) {
+	raw, ok := strings.CutPrefix(contentID, libraryContentIDPrefix)
+	if !ok {
+		return 0, false
+	}
+	id, err := strconv.Atoi(raw)
+	if err != nil || id <= 0 {
+		return 0, false
+	}
+	return id, true
+}
+
 // JobStatus is the lifecycle state of a job, shared with the other AI job
 // services via jobrunner.
 type JobStatus = jobrunner.Status
@@ -75,8 +103,8 @@ type JobRequest struct {
 	ContentID       string
 	TargetLanguage  string
 	IncludeChildren bool
-	// Force re-translates fields that already have a provider or AI value.
-	// Manual values are never overwritten regardless.
+	// Force re-translates fields an earlier AI translation filled. Provider
+	// and manual values are never overwritten regardless.
 	Force       bool
 	RequestedBy *int
 }
@@ -114,6 +142,9 @@ type ChildText struct {
 	SeasonNumber  int
 	EpisodeNumber int
 	Overview      string
+	// DefaultLanguage is the language Overview is written in; a child already
+	// in the target language is never sent for translation.
+	DefaultLanguage string
 }
 
 // ContentReader loads the base-row text a job translates. Implementations
@@ -122,6 +153,8 @@ type ContentReader interface {
 	ItemText(ctx context.Context, contentID string) (*ItemText, error)
 	SeasonTexts(ctx context.Context, seriesID string) ([]ChildText, error)
 	EpisodeTexts(ctx context.Context, seriesID string) ([]ChildText, error)
+	// SeasonEpisodeTexts loads one season's episodes.
+	SeasonEpisodeTexts(ctx context.Context, seasonContentID string) ([]ChildText, error)
 	// SeasonByID / EpisodeByID also return the parent series content ID.
 	SeasonByID(ctx context.Context, contentID string) (*ChildText, string, error)
 	EpisodeByID(ctx context.Context, contentID string) (*ChildText, string, error)
@@ -129,11 +162,45 @@ type ContentReader interface {
 	// episode overviews) that have source text but no localized value for the
 	// language — the auto-translate trigger condition.
 	CountMissingFields(ctx context.Context, itemContentID, language string) (int, error)
+	// LibraryItemsMissing lists, in title order, the library's items whose
+	// own or children's descriptions have source text in another language and
+	// no localized value for language.
+	LibraryItemsMissing(ctx context.Context, libraryID int, language string) ([]string, error)
 }
 
 // idempotencyKey derives the dedup key for a job. Two requests for the same
-// target, language, and model collapse to one in-flight job.
-func idempotencyKey(kind TargetKind, contentID, targetLang, model string) string {
+// target, language, model, scope, and force flag collapse to one in-flight job.
+func idempotencyKey(kind TargetKind, contentID, targetLang, model string, includeChildren, force bool) string {
+	sum := sha256.Sum256(fmt.Appendf(nil, "%s|%s|%s|%s|%t|%t", kind, contentID, targetLang, model, includeChildren, force))
+	return hex.EncodeToString(sum[:])
+}
+
+// legacyIdempotencyKey is the key format before scope and force were part of
+// it. Active jobs a previous release created still carry it until they finish.
+func legacyIdempotencyKey(kind TargetKind, contentID, targetLang, model string) string {
 	sum := sha256.Sum256(fmt.Appendf(nil, "%s|%s|%s|%s", kind, contentID, targetLang, model))
 	return hex.EncodeToString(sum[:])
 }
+
+// covers reports whether an active job does at least the work req asks for.
+func (j *Job) covers(req JobRequest) bool {
+	return (j.IncludeChildren || !req.IncludeChildren) && (j.Force || !req.Force)
+}
+
+// coveringKeys lists the keys of every job that would do at least the work of
+// a request: the same target with the same or wider scope, forced or not when
+// the request is not forced. A forced request is only covered by a forced job,
+// because a plain job skips fields that already have a value.
+func coveringKeys(kind TargetKind, contentID, targetLang, model string, includeChildren, force bool) []string {
+	keys := []string{idempotencyKey(kind, contentID, targetLang, model, includeChildren, force)}
+	if !includeChildren {
+		keys = append(keys, idempotencyKey(kind, contentID, targetLang, model, true, force))
+	}
+	if !force {
+		keys = append(keys, idempotencyKey(kind, contentID, targetLang, model, includeChildren, true))
+		if !includeChildren {
+			keys = append(keys, idempotencyKey(kind, contentID, targetLang, model, true, true))
+		}
+	}
+	return keys
+}
diff --git a/internal/metadata/translation/pgrepo.go b/internal/metadata/translation/pgrepo.go
index 5491ba204c..528c89adb3 100644
--- a/internal/metadata/translation/pgrepo.go
+++ b/internal/metadata/translation/pgrepo.go
@@ -142,12 +142,20 @@ func (r *PgRepository) FailJob(ctx context.Context, id int64, status JobStatus,
 	return nil
 }
 
+// Heartbeat keeps an active job alive. A job that is no longer pending or
+// running (canceled from another node, or reaped) reports
+// jobrunner.ErrJobTerminal, so the node still running it stops spending
+// provider calls on a job nobody waits for.
 func (r *PgRepository) Heartbeat(ctx context.Context, id int64) error {
-	_, err := r.pool.Exec(ctx,
-		`UPDATE metadata_translation_jobs SET heartbeat_at = now() WHERE id = $1`, id)
+	tag, err := r.pool.Exec(ctx,
+		`UPDATE metadata_translation_jobs SET heartbeat_at = now()
+		WHERE id = $1 AND status IN ('pending', 'running')`, id)
 	if err != nil {
 		return fmt.Errorf("heartbeat metadata translation job: %w", err)
 	}
+	if tag.RowsAffected() == 0 {
+		return jobrunner.ErrJobTerminal
+	}
 	return nil
 }
 
@@ -180,7 +188,7 @@ func (r *PgRepository) ItemText(ctx context.Context, contentID string) (*ItemTex
 
 func (r *PgRepository) SeasonTexts(ctx context.Context, seriesID string) ([]ChildText, error) {
 	rows, err := r.pool.Query(ctx,
-		`SELECT content_id, season_number, COALESCE(overview, '')
+		`SELECT content_id, season_number, COALESCE(overview, ''), COALESCE(default_metadata_language, '')
 		FROM seasons WHERE series_id = $1 ORDER BY season_number`, seriesID)
 	if err != nil {
 		return nil, fmt.Errorf("load season texts: %w", err)
@@ -189,7 +197,7 @@ func (r *PgRepository) SeasonTexts(ctx context.Context, seriesID string) ([]Chil
 	var out []ChildText
 	for rows.Next() {
 		var c ChildText
-		if err := rows.Scan(&c.ContentID, &c.SeasonNumber, &c.Overview); err != nil {
+		if err := rows.Scan(&c.ContentID, &c.SeasonNumber, &c.Overview, &c.DefaultLanguage); err != nil {
 			return nil, fmt.Errorf("scan season text: %w", err)
 		}
 		out = append(out, c)
@@ -197,10 +205,27 @@ func (r *PgRepository) SeasonTexts(ctx context.Context, seriesID string) ([]Chil
 	return out, rows.Err()
 }
 
+const episodeTextColumns = `content_id, season_number, episode_number, COALESCE(overview, ''),
+	COALESCE(default_metadata_language, '')`
+
 func (r *PgRepository) EpisodeTexts(ctx context.Context, seriesID string) ([]ChildText, error) {
-	rows, err := r.pool.Query(ctx,
-		`SELECT content_id, season_number, episode_number, COALESCE(overview, '')
+	return r.episodeTexts(ctx, `SELECT `+episodeTextColumns+`
 		FROM episodes WHERE series_id = $1 ORDER BY season_number, episode_number`, seriesID)
+}
+
+// SeasonEpisodeTexts loads the episodes a season page lists: only that
+// season, and only episodes in a library (the catalog's season listing
+// filters the same way), so a season job never reads a long-running show's
+// other seasons or a partly collected season's provider-only episodes.
+func (r *PgRepository) SeasonEpisodeTexts(ctx context.Context, seasonContentID string) ([]ChildText, error) {
+	return r.episodeTexts(ctx, `SELECT `+episodeTextColumns+`
+		FROM episodes WHERE season_id = $1
+		  AND EXISTS (SELECT 1 FROM episode_libraries el WHERE el.episode_id = episodes.content_id)
+		ORDER BY episode_number`, seasonContentID)
+}
+
+func (r *PgRepository) episodeTexts(ctx context.Context, query string, arg string) ([]ChildText, error) {
+	rows, err := r.pool.Query(ctx, query, arg)
 	if err != nil {
 		return nil, fmt.Errorf("load episode texts: %w", err)
 	}
@@ -208,7 +233,7 @@ func (r *PgRepository) EpisodeTexts(ctx context.Context, seriesID string) ([]Chi
 	var out []ChildText
 	for rows.Next() {
 		var c ChildText
-		if err := rows.Scan(&c.ContentID, &c.SeasonNumber, &c.EpisodeNumber, &c.Overview); err != nil {
+		if err := rows.Scan(&c.ContentID, &c.SeasonNumber, &c.EpisodeNumber, &c.Overview, &c.DefaultLanguage); err != nil {
 			return nil, fmt.Errorf("scan episode text: %w", err)
 		}
 		out = append(out, c)
@@ -220,9 +245,9 @@ func (r *PgRepository) SeasonByID(ctx context.Context, contentID string) (*Child
 	var c ChildText
 	var seriesID string
 	err := r.pool.QueryRow(ctx,
-		`SELECT content_id, series_id, season_number, COALESCE(overview, '')
+		`SELECT content_id, series_id, season_number, COALESCE(overview, ''), COALESCE(default_metadata_language, '')
 		FROM seasons WHERE content_id = $1`, contentID).
-		Scan(&c.ContentID, &seriesID, &c.SeasonNumber, &c.Overview)
+		Scan(&c.ContentID, &seriesID, &c.SeasonNumber, &c.Overview, &c.DefaultLanguage)
 	if errors.Is(err, pgx.ErrNoRows) {
 		return nil, "", nil
 	}
@@ -236,9 +261,10 @@ func (r *PgRepository) EpisodeByID(ctx context.Context, contentID string) (*Chil
 	var c ChildText
 	var seriesID string
 	err := r.pool.QueryRow(ctx,
-		`SELECT content_id, series_id, season_number, episode_number, COALESCE(overview, '')
+		`SELECT content_id, series_id, season_number, episode_number, COALESCE(overview, ''),
+			COALESCE(default_metadata_language, '')
 		FROM episodes WHERE content_id = $1`, contentID).
-		Scan(&c.ContentID, &seriesID, &c.SeasonNumber, &c.EpisodeNumber, &c.Overview)
+		Scan(&c.ContentID, &seriesID, &c.SeasonNumber, &c.EpisodeNumber, &c.Overview, &c.DefaultLanguage)
 	if errors.Is(err, pgx.ErrNoRows) {
 		return nil, "", nil
 	}
@@ -249,8 +275,11 @@ func (r *PgRepository) EpisodeByID(ctx context.Context, contentID string) (*Chil
 }
 
 // CountMissingFields counts base fields with source text but no localized
-// value for the language. One round-trip; used to gate the auto-translate
-// enqueue so repeat refreshes of fully translated items are free.
+// value for the language. Seasons and episodes already written in the
+// language are not missing: jobs skip them (sameLanguage), and counting them
+// would keep the gate open forever. One round-trip; used to gate the
+// auto-translate enqueue so repeat refreshes of fully translated items are
+// free.
 func (r *PgRepository) CountMissingFields(ctx context.Context, itemContentID, language string) (int, error) {
 	var missing int
 	err := r.pool.QueryRow(ctx, `
@@ -266,14 +295,62 @@ func (r *PgRepository) CountMissingFields(ctx context.Context, itemContentID, la
 		+	(SELECT count(*) FROM seasons s
 				LEFT JOIN season_localizations sl ON sl.season_content_id = s.content_id AND sl.language = $2
 			 WHERE s.series_id = $1
-			   AND COALESCE(s.overview, '') <> '' AND COALESCE(sl.overview, '') = '')
+			   AND COALESCE(s.overview, '') <> '' AND COALESCE(sl.overview, '') = ''
+			   AND lower(btrim(COALESCE(s.default_metadata_language, ''))) <> lower($2))
 		+	(SELECT count(*) FROM episodes e
 				LEFT JOIN episode_localizations el ON el.episode_content_id = e.content_id AND el.language = $2
 			 WHERE e.series_id = $1
-			   AND COALESCE(e.overview, '') <> '' AND COALESCE(el.overview, '') = '')
+			   AND COALESCE(e.overview, '') <> '' AND COALESCE(el.overview, '') = ''
+			   AND lower(btrim(COALESCE(e.default_metadata_language, ''))) <> lower($2))
 	`, itemContentID, language).Scan(&missing)
 	if err != nil {
 		return 0, fmt.Errorf("count missing localization fields: %w", err)
 	}
 	return missing, nil
 }
+
+// LibraryItemsMissing lists the library's items with at least one
+// translatable field missing for language: an item overview or tagline, a
+// season overview, or an episode overview that has source text in another
+// language and no localized value. Each row's own language decides, so a
+// series in the target language still qualifies for its other-language
+// episodes.
+func (r *PgRepository) LibraryItemsMissing(ctx context.Context, libraryID int, language string) ([]string, error) {
+	rows, err := r.pool.Query(ctx, `
+		SELECT mi.content_id
+		FROM media_items mi
+		JOIN media_item_libraries mil ON mil.content_id = mi.content_id AND mil.media_folder_id = $1
+		LEFT JOIN media_item_localizations l ON l.content_id = mi.content_id AND l.language = $2
+		WHERE (
+				lower(btrim(COALESCE(mi.default_metadata_language, ''))) <> lower($2)
+				AND ((COALESCE(mi.overview, '') <> '' AND COALESCE(l.overview, '') = '')
+				  OR (COALESCE(mi.tagline, '') <> '' AND COALESCE(l.tagline, '') = ''))
+			)
+			OR EXISTS (
+				SELECT 1 FROM seasons s
+				LEFT JOIN season_localizations sl ON sl.season_content_id = s.content_id AND sl.language = $2
+				WHERE s.series_id = mi.content_id
+				  AND lower(btrim(COALESCE(s.default_metadata_language, ''))) <> lower($2)
+				  AND COALESCE(s.overview, '') <> '' AND COALESCE(sl.overview, '') = '')
+			OR EXISTS (
+				SELECT 1 FROM episodes e
+				LEFT JOIN episode_localizations el ON el.episode_content_id = e.content_id AND el.language = $2
+				WHERE e.series_id = mi.content_id
+				  AND lower(btrim(COALESCE(e.default_metadata_language, ''))) <> lower($2)
+				  AND COALESCE(e.overview, '') <> '' AND COALESCE(el.overview, '') = '')
+		ORDER BY COALESCE(NULLIF(mi.sort_title, ''), mi.title), mi.content_id
+	`, libraryID, language)
+	if err != nil {
+		return nil, fmt.Errorf("list library items missing localization: %w", err)
+	}
+	defer rows.Close()
+	var ids []string
+	for rows.Next() {
+		var id string
+		if err := rows.Scan(&id); err != nil {
+			return nil, fmt.Errorf("scan library item: %w", err)
+		}
+		ids = append(ids, id)
+	}
+	return ids, rows.Err()
+}
diff --git a/internal/metadata/translation/pgrepo_db_test.go b/internal/metadata/translation/pgrepo_db_test.go
new file mode 100644
index 0000000000..373cc25f2f
--- /dev/null
+++ b/internal/metadata/translation/pgrepo_db_test.go
@@ -0,0 +1,80 @@
+package translation
+
+import (
+	"os"
+	"testing"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// seasonFixture holds one English series in session-local tables. Season 1
+// lists ep-1 (English) and ep-2 (French source text); ep-3 is a provider-only
+// episode with no library membership, which the season page does not list.
+func seasonFixture(t *testing.T) *PgRepository {
+	t.Helper()
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	config, err := pgxpool.ParseConfig(dsn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	config.MaxConns = 1 // temp tables are per session
+	pool, err := pgxpool.NewWithConfig(t.Context(), config)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(pool.Close)
+	_, err = pool.Exec(t.Context(), `
+		CREATE TEMP TABLE media_items (LIKE public.media_items INCLUDING DEFAULTS);
+		CREATE TEMP TABLE media_item_localizations (LIKE public.media_item_localizations INCLUDING DEFAULTS);
+		CREATE TEMP TABLE seasons (LIKE public.seasons INCLUDING DEFAULTS);
+		CREATE TEMP TABLE season_localizations (LIKE public.season_localizations INCLUDING DEFAULTS);
+		CREATE TEMP TABLE episodes (LIKE public.episodes INCLUDING DEFAULTS);
+		CREATE TEMP TABLE episode_localizations (LIKE public.episode_localizations INCLUDING DEFAULTS);
+		CREATE TEMP TABLE episode_libraries (LIKE public.episode_libraries INCLUDING DEFAULTS);
+		INSERT INTO media_items (content_id, type, title, default_metadata_language)
+		VALUES ('show', 'series', 'Show', 'en');
+		INSERT INTO seasons (content_id, series_id, season_number, overview, default_metadata_language)
+		VALUES ('season-1', 'show', 1, '', 'en');
+		INSERT INTO episodes (content_id, series_id, season_id, season_number, episode_number, overview, default_metadata_language)
+		VALUES ('ep-1', 'show', 'season-1', 1, 1, 'English text.', 'en'),
+		       ('ep-2', 'show', 'season-1', 1, 2, 'Texte français.', 'FR'),
+		       ('ep-3', 'show', 'season-1', 1, 3, 'Not collected.', 'en');
+		INSERT INTO episode_libraries (episode_id, media_folder_id) VALUES ('ep-1', 1), ('ep-2', 1);
+	`)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return NewPgRepository(pool)
+}
+
+func TestSeasonEpisodeTextsListsOnlyEpisodesInALibrary(t *testing.T) {
+	repo := seasonFixture(t)
+	texts, err := repo.SeasonEpisodeTexts(t.Context(), "season-1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var ids []string
+	for _, text := range texts {
+		ids = append(ids, text.ContentID)
+	}
+	if len(ids) != 2 || ids[0] != "ep-1" || ids[1] != "ep-2" {
+		t.Fatalf("season episode texts = %v, want [ep-1 ep-2] without the uncollected ep-3", ids)
+	}
+}
+
+func TestCountMissingFieldsSkipsChildrenAlreadyInTheLanguage(t *testing.T) {
+	repo := seasonFixture(t)
+	// ep-1 and ep-3 need French; ep-2 is already written in French, and a
+	// job would skip it, so counting it would keep the auto-translate gate
+	// open forever.
+	missing, err := repo.CountMissingFields(t.Context(), "show", "fr")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if missing != 2 {
+		t.Fatalf("missing = %d, want 2 (ep-1 and ep-3)", missing)
+	}
+}
diff --git a/internal/metadata/translation/service.go b/internal/metadata/translation/service.go
index 6c7a5f4a3f..48825e2644 100644
--- a/internal/metadata/translation/service.go
+++ b/internal/metadata/translation/service.go
@@ -15,6 +15,7 @@ import (
 	"github.com/prairie-server/prairie-server/internal/ai/jobrunner"
 	"github.com/prairie-server/prairie-server/internal/ai/llm"
 	aitranslate "github.com/prairie-server/prairie-server/internal/ai/translate"
+	"github.com/prairie-server/prairie-server/internal/models"
 	"github.com/prairie-server/prairie-server/internal/subtitles"
 )
 
@@ -125,36 +126,24 @@ func (s *Service) translationConfig(ctx context.Context) (Config, *llm.Config) {
 // reaper that keeps doing so. Call once at startup.
 func (s *Service) Recover() { s.runner.Recover() }
 
-// Enqueue validates and queues a job, returning immediately. If an identical
-// job is already pending or running, that job is returned instead of a new one.
+// Enqueue validates and queues a job, returning immediately. If a pending or
+// running job already covers the request (same target and language, same or
+// wider scope, and forced whenever the request is), that job is returned
+// instead of a new one.
 func (s *Service) Enqueue(ctx context.Context, req JobRequest) (*Job, error) {
 	cfg, textConfig := s.translationConfig(ctx)
 	if !cfg.Ready() {
 		return nil, ErrNotConfigured
 	}
-	if req.TargetKind == "" {
-		req.TargetKind = TargetItem
-	}
-	switch req.TargetKind {
-	case TargetItem, TargetSeason, TargetEpisode:
-	default:
-		return nil, fmt.Errorf("%w: unsupported target kind %q", ErrInvalidRequest, req.TargetKind)
-	}
-	if strings.TrimSpace(req.ContentID) == "" {
-		return nil, fmt.Errorf("%w: content id is required", ErrInvalidRequest)
-	}
-	target, err := subtitles.NormalizeLanguageCode(req.TargetLanguage)
+	model := cfg.ChatModel
+	req, existing, err := s.coveringJob(ctx, req, model)
 	if err != nil {
-		return nil, fmt.Errorf("%w: invalid target language %q", ErrInvalidRequest, req.TargetLanguage)
-	}
-	req.TargetLanguage = target
-
-	key := idempotencyKey(req.TargetKind, req.ContentID, req.TargetLanguage, cfg.ChatModel)
-	if existing, err := s.repo.GetActiveJobByIdempotencyKey(ctx, key); err != nil {
 		return nil, err
-	} else if existing != nil {
+	}
+	if existing != nil {
 		return existing, nil
 	}
+	key := idempotencyKey(req.TargetKind, req.ContentID, req.TargetLanguage, model, req.IncludeChildren, req.Force)
 
 	job := &Job{
 		TargetKind:      req.TargetKind,
@@ -162,7 +151,7 @@ func (s *Service) Enqueue(ctx context.Context, req JobRequest) (*Job, error) {
 		IncludeChildren: req.IncludeChildren,
 		TargetLanguage:  req.TargetLanguage,
 		Engine:          "openai",
-		Model:           cfg.ChatModel,
+		Model:           model,
 		Status:          jobrunner.StatusPending,
 		ProgressMessage: "Queued",
 		Force:           req.Force,
@@ -216,12 +205,83 @@ func (s *Service) AutoEnqueue(ctx context.Context, itemContentID, language strin
 	}
 }
 
+// EnqueueLibrary queues the prewarm of every item in a library that still
+// misses a localization for language. An identical active prewarm is reused.
+func (s *Service) EnqueueLibrary(ctx context.Context, libraryID int, language string, requestedBy *int) (*Job, error) {
+	return s.Enqueue(ctx, JobRequest{
+		TargetKind:     TargetLibrary,
+		ContentID:      LibraryContentID(libraryID),
+		TargetLanguage: language,
+		RequestedBy:    requestedBy,
+	})
+}
+
 // OnViewMode exposes the viewer-triggered translation mode for status probes.
 func (s *Service) OnViewMode(ctx context.Context) string {
 	cfg, _ := s.translationConfig(ctx)
 	return cfg.OnViewMode()
 }
 
+// coveringJob normalizes req and returns it with the pending or running job
+// that already does at least its work (same target and language, same or
+// wider scope, and forced whenever req is), or nil when none does.
+func (s *Service) coveringJob(ctx context.Context, req JobRequest, model string) (JobRequest, *Job, error) {
+	if req.TargetKind == "" {
+		req.TargetKind = TargetItem
+	}
+	switch req.TargetKind {
+	case TargetItem, TargetSeason, TargetEpisode:
+	case TargetLibrary:
+		if _, ok := ParseLibraryContentID(req.ContentID); !ok {
+			return req, nil, fmt.Errorf("%w: invalid library target %q", ErrInvalidRequest, req.ContentID)
+		}
+		// A prewarm only fills gaps; replacing existing text is an item action.
+		req.Force = false
+		req.IncludeChildren = true
+	default:
+		return req, nil, fmt.Errorf("%w: unsupported target kind %q", ErrInvalidRequest, req.TargetKind)
+	}
+	if strings.TrimSpace(req.ContentID) == "" {
+		return req, nil, fmt.Errorf("%w: content id is required", ErrInvalidRequest)
+	}
+	target, err := subtitles.NormalizeLanguageCode(req.TargetLanguage)
+	if err != nil {
+		return req, nil, fmt.Errorf("%w: invalid target language %q", ErrInvalidRequest, req.TargetLanguage)
+	}
+	req.TargetLanguage = target
+
+	if req.TargetKind == TargetEpisode {
+		// An episode has no children.
+		req.IncludeChildren = false
+	}
+	if req.TargetKind == TargetItem && req.IncludeChildren {
+		// Only a series has children; normalizing keeps a movie request
+		// with and without the flag on one job.
+		item, err := s.content.ItemText(ctx, req.ContentID)
+		if err != nil {
+			return req, nil, err
+		}
+		if item != nil && item.Type != "series" {
+			req.IncludeChildren = false
+		}
+	}
+	// A job a previous release queued carries the old key format; reuse it
+	// when its stored flags cover this request.
+	if existing, err := s.repo.GetActiveJobByIdempotencyKey(ctx, legacyIdempotencyKey(req.TargetKind, req.ContentID, req.TargetLanguage, model)); err != nil {
+		return req, nil, err
+	} else if existing != nil && existing.covers(req) {
+		return req, existing, nil
+	}
+	for _, covering := range coveringKeys(req.TargetKind, req.ContentID, req.TargetLanguage, model, req.IncludeChildren, req.Force) {
+		if existing, err := s.repo.GetActiveJobByIdempotencyKey(ctx, covering); err != nil {
+			return req, nil, err
+		} else if existing != nil {
+			return req, existing, nil
+		}
+	}
+	return req, nil, nil
+}
+
 // RequestOnView is the viewer-triggered enqueue path (detail-page button or
 // auto-on-view). On top of the normal pipeline it suppresses retries for a
 // cooldown window after a failed job for the same target+language: ordinary
@@ -262,13 +322,35 @@ func (s *Service) RequestOnView(ctx context.Context, targetKind TargetKind, cont
 		break // most recent job for this language decides; older history is irrelevant
 	}
 
-	return s.Enqueue(ctx, JobRequest{
+	return s.Enqueue(ctx, onViewRequest(targetKind, contentID, target, requestedBy))
+}
+
+// onViewRequest is the job a viewer-triggered request asks for. A view
+// translates what that page shows: a movie or series its own description, a
+// season its overview and its episode list, an episode itself. A series page
+// therefore never translates a whole long-running show; each season is
+// translated when someone opens it.
+func onViewRequest(targetKind TargetKind, contentID, targetLanguage string, requestedBy *int) JobRequest {
+	return JobRequest{
 		TargetKind:      targetKind,
 		ContentID:       contentID,
-		TargetLanguage:  target,
-		IncludeChildren: targetKind == TargetItem,
+		TargetLanguage:  targetLanguage,
+		IncludeChildren: targetKind == TargetSeason,
 		RequestedBy:     requestedBy,
-	})
+	}
+}
+
+// ActiveOnViewJob returns the pending or running job RequestOnView would
+// join for the target and language, or nil when there is none. A caller
+// retrying after a lost response gets that job back even after its first
+// batch has filled the text the request was for.
+func (s *Service) ActiveOnViewJob(ctx context.Context, targetKind TargetKind, contentID, targetLanguage string) (*Job, error) {
+	if targetKind == "" {
+		targetKind = TargetItem
+	}
+	cfg, _ := s.translationConfig(ctx)
+	_, existing, err := s.coveringJob(ctx, onViewRequest(targetKind, contentID, targetLanguage, nil), cfg.ChatModel)
+	return existing, err
 }
 
 // GetJob returns a job by ID.
@@ -343,6 +425,11 @@ func (s *Service) run(ctx context.Context, job *Job) {
 		}
 	}()
 
+	if job.TargetKind == TargetLibrary {
+		s.runLibrary(ctx, job)
+		return
+	}
+
 	if err := s.repo.UpdateProgress(ctx, job.ID, jobrunner.StatusRunning, 0, "Loading content", 0, 0); err != nil {
 		s.logger.WarnContext(ctx, "failed to mark metadata translation job running", "job", job.ID, "error", err)
 	}
@@ -363,9 +450,27 @@ func (s *Service) run(ctx context.Context, job *Job) {
 	if err := s.repo.UpdateProgress(ctx, job.ID, jobrunner.StatusRunning, 0.05, "Translating", 0, total); err != nil {
 		s.logger.WarnContext(ctx, "failed to update metadata translation job", "job", job.ID, "error", err)
 	}
+	done, err := s.translateFields(ctx, job, fields, meta, func(done, batchDone, batchTotal int) {
+		progress := 0.05 + 0.9*float64(batchDone)/float64(batchTotal)
+		_ = s.repo.UpdateProgress(context.WithoutCancel(ctx), job.ID, jobrunner.StatusRunning, progress, "Translating", done, total)
+	})
+	if err != nil {
+		s.finishWithError(ctx, job, err)
+		return
+	}
+
+	if err := s.repo.CompleteJob(context.WithoutCancel(ctx), job.ID, "", done, total); err != nil {
+		s.logger.WarnContext(ctx, "failed to complete metadata translation job", "job", job.ID, "error", err)
+	}
+}
 
-	segments := make([]aitranslate.Segment, total)
-	byID := make(map[string]field, total)
+// translateFields translates fields in batches and persists each batch as it
+// lands, so a cancellation keeps completed fields. onBatch reports the fields
+// persisted so far and the batch position. It returns the persisted count and
+// the first persist or model error.
+func (s *Service) translateFields(ctx context.Context, job *Job, fields []field, meta jobMeta, onBatch func(done, batchDone, batchTotal int)) (int, error) {
+	segments := make([]aitranslate.Segment, len(fields))
+	byID := make(map[string]field, len(fields))
 	for i, f := range fields {
 		segments[i] = aitranslate.Segment{ID: f.segmentID(), Text: f.text}
 		byID[f.segmentID()] = f
@@ -374,9 +479,8 @@ func (s *Service) run(ctx context.Context, job *Job) {
 	srcName := aitranslate.LanguageDisplayName(meta.srcLanguage)
 	tgtName := aitranslate.LanguageDisplayName(job.TargetLanguage)
 
-	// Persist per batch so a cancellation keeps completed fields. A persist
-	// failure cancels the remaining batches via persistCtx instead of burning
-	// model calls whose output cannot be stored.
+	// A persist failure cancels the remaining batches via persistCtx instead
+	// of burning model calls whose output cannot be stored.
 	persistCtx, cancelPersist := context.WithCancel(ctx)
 	defer cancelPersist()
 	var persistMu sync.Mutex
@@ -409,22 +513,120 @@ func (s *Service) run(ctx context.Context, job *Job) {
 			}
 			done++
 		}
-		progress := 0.05 + 0.9*float64(batchDone)/float64(batchTotal)
-		_ = s.repo.UpdateProgress(storeCtx, job.ID, jobrunner.StatusRunning, progress, "Translating", done, total)
+		if onBatch != nil {
+			onBatch(done, batchDone, batchTotal)
+		}
 	})
 
 	persistMu.Lock()
 	failure := persistErr
 	persistMu.Unlock()
-	if failure == nil && translateErr != nil {
+	if failure == nil {
 		failure = translateErr
 	}
-	if failure != nil {
-		s.finishWithError(ctx, job, failure)
+	return done, failure
+}
+
+// libraryMaxFailuresInRow is how many items in a row may fail before a
+// library prewarm gives up on the provider.
+const libraryMaxFailuresInRow = 3
+
+// runLibrary prewarms a library: it walks the library's items that still
+// miss a localization for the language and translates each one with its
+// seasons and episodes, one item at a time. It gives its AI slot back between
+// items so queued on-view and subtitle jobs are not held up for the whole
+// walk. Progress counts items. It never forces, so provider, manual and
+// earlier AI values stay. An item that fails is skipped; several failures in a
+// row stop the job, since then the provider itself is failing. Re-running
+// after a failure or restart resumes with the items that are still missing.
+func (s *Service) runLibrary(ctx context.Context, job *Job) {
+	libraryID, ok := ParseLibraryContentID(job.ContentID)
+	if !ok {
+		s.finishWithError(ctx, job, fmt.Errorf("%w: invalid library target %q", ErrInvalidRequest, job.ContentID))
+		return
+	}
+	if err := s.repo.UpdateProgress(ctx, job.ID, jobrunner.StatusRunning, 0, "Finding items to translate", 0, 0); err != nil {
+		s.logger.WarnContext(ctx, "failed to mark metadata translation job running", "job", job.ID, "error", err)
+	}
+	itemIDs, err := s.content.LibraryItemsMissing(ctx, libraryID, job.TargetLanguage)
+	if err != nil {
+		s.finishWithError(ctx, job, fmt.Errorf("list library items: %w", err))
+		return
+	}
+	total := len(itemIDs)
+	if total == 0 {
+		if err := s.repo.CompleteJob(context.WithoutCancel(ctx), job.ID, "Nothing to translate", 0, 0); err != nil {
+			s.logger.WarnContext(ctx, "failed to complete metadata translation job", "job", job.ID, "error", err)
+		}
 		return
 	}
 
-	if err := s.repo.CompleteJob(context.WithoutCancel(ctx), job.ID, "", done, total); err != nil {
+	fieldsDone, failed, failedInRow := 0, 0, 0
+	for i, itemID := range itemIDs {
+		if err := ctx.Err(); err != nil {
+			s.finishWithError(ctx, job, err)
+			return
+		}
+		// A cancel sent to another node only marks the row; stop here rather
+		// than wait for the next heartbeat to notice.
+		if current, err := s.repo.GetJob(ctx, job.ID); err == nil && current != nil && current.Status.Terminal() {
+			s.logger.InfoContext(ctx, "metadata translation library job stopped", "job", job.ID, "status", current.Status)
+			return
+		}
+		if i > 0 {
+			if err := jobrunner.Yield(ctx); err != nil {
+				s.finishWithError(ctx, job, err)
+				return
+			}
+		}
+		message := fmt.Sprintf("Translating item %d of %d", i+1, total)
+		_ = s.repo.UpdateProgress(context.WithoutCancel(ctx), job.ID, jobrunner.StatusRunning, float64(i)/float64(total), message, i, total)
+
+		item := Job{
+			TargetKind:      TargetItem,
+			ContentID:       itemID,
+			IncludeChildren: true,
+			TargetLanguage:  job.TargetLanguage,
+		}
+		fields, meta, err := s.collectFields(ctx, &item)
+		if errors.Is(err, ErrInvalidRequest) {
+			continue // removed since the walk started
+		}
+		if err != nil {
+			s.finishWithError(ctx, job, err)
+			return
+		}
+		if len(fields) == 0 {
+			continue
+		}
+		done, err := s.translateFields(ctx, &item, fields, meta, nil)
+		fieldsDone += done
+		if err != nil {
+			if ctx.Err() != nil {
+				s.finishWithError(ctx, job, err)
+				return
+			}
+			// One item's text can fail on its own (an unusable model answer,
+			// or the item removed mid-run); skip it so it cannot block every
+			// later re-run. Failures in a row mean the provider is down; stop
+			// rather than spend the remaining budget on errors.
+			failed++
+			failedInRow++
+			if failedInRow >= libraryMaxFailuresInRow {
+				s.finishWithError(ctx, job, fmt.Errorf("item %s: %w", itemID, err))
+				return
+			}
+			s.logger.WarnContext(ctx, "metadata translation library item failed", "job", job.ID, "content_id", itemID, "error", err)
+			continue
+		}
+		failedInRow = 0
+	}
+
+	message := fmt.Sprintf("Translated %d descriptions across %d items", fieldsDone, total)
+	if failed > 0 {
+		message += fmt.Sprintf("; %d of them failed and can be retried", failed)
+	}
+	if err := s.repo.CompleteJob(context.WithoutCancel(ctx), job.ID, message, total, total); err != nil {
 		s.logger.WarnContext(ctx, "failed to complete metadata translation job", "job", job.ID, "error", err)
 	}
 }
@@ -437,13 +639,13 @@ func (s *Service) persistField(ctx context.Context, job *Job, f field, text stri
 	switch f.kind {
 	case TargetItem:
 		if f.isTagline {
-			return s.locs.UpsertItemAI(ctx, f.contentID, job.TargetLanguage, nil, &text, job.Force)
+			return s.locs.UpsertItemAI(ctx, f.contentID, job.TargetLanguage, nil, &text)
 		}
-		return s.locs.UpsertItemAI(ctx, f.contentID, job.TargetLanguage, &text, nil, job.Force)
+		return s.locs.UpsertItemAI(ctx, f.contentID, job.TargetLanguage, &text, nil)
 	case TargetSeason:
-		return s.locs.UpsertSeasonAI(ctx, f.contentID, job.TargetLanguage, text, job.Force)
+		return s.locs.UpsertSeasonAI(ctx, f.contentID, job.TargetLanguage, text)
 	case TargetEpisode:
-		return s.locs.UpsertEpisodeAI(ctx, f.contentID, job.TargetLanguage, text, job.Force)
+		return s.locs.UpsertEpisodeAI(ctx, f.contentID, job.TargetLanguage, text)
 	default:
 		return fmt.Errorf("unknown field kind %q", f.kind)
 	}
@@ -457,8 +659,8 @@ type jobMeta struct {
 }
 
 // collectFields expands the job target into translatable fields, dropping any
-// field whose localized value is already filled (unless force, which still
-// respects manual provenance).
+// field whose localized value is already filled, unless the job is forced and
+// an earlier AI translation wrote it (see translatableField).
 func (s *Service) collectFields(ctx context.Context, job *Job) ([]field, jobMeta, error) {
 	var meta jobMeta
 
@@ -503,7 +705,18 @@ func (s *Service) collectFields(ctx context.Context, job *Job) ([]field, jobMeta
 			return nil, meta, err
 		}
 		fields, err := s.filterSeasons(ctx, job, []ChildText{*season})
-		return fields, meta, err
+		if err != nil || !job.IncludeChildren {
+			return fields, meta, err
+		}
+		seasonEpisodes, err := s.content.SeasonEpisodeTexts(ctx, season.ContentID)
+		if err != nil {
+			return nil, meta, fmt.Errorf("load episodes: %w", err)
+		}
+		episodeFields, err := s.filterEpisodes(ctx, job, seasonEpisodes)
+		if err != nil {
+			return nil, meta, err
+		}
+		return append(fields, episodeFields...), meta, nil
 
 	case TargetEpisode:
 		episode, seriesID, err := s.content.EpisodeByID(ctx, job.ContentID)
@@ -538,25 +751,36 @@ func (s *Service) parentMeta(ctx context.Context, job *Job, seriesID string) (jo
 	return meta, nil
 }
 
+// sameLanguage reports whether text in language a already reads as language
+// b. It matches the catalog's pending check (case-insensitive, whole tag), so
+// a field the catalog reports as missing is never skipped here. An unknown
+// source language never matches.
+func sameLanguage(a, b string) bool {
+	a = strings.TrimSpace(a)
+	return a != "" && strings.EqualFold(a, strings.TrimSpace(b))
+}
+
 // translatableField reports whether a field with base text and an existing
 // localized value/source should be translated. Empty base text never
-// translates; filled localizations are skipped unless force; manual values
-// are skipped even with force (the SQL layer guards them too — skipping here
-// saves the model call).
+// translates, and a manual field never does, even when empty: the repository
+// keeps manual values, so the model call would be wasted. Otherwise an empty
+// localized value translates, and a filled one only when an earlier AI
+// translation wrote it and the job is forced.
 func translatableField(baseText, locValue, locSource string, force bool) bool {
-	if strings.TrimSpace(baseText) == "" {
+	if strings.TrimSpace(baseText) == "" || locSource == models.LocalizationSourceManual {
 		return false
 	}
-	if locSource == "manual" {
-		return false
+	if locValue == "" {
+		return true
 	}
-	if locValue != "" && !force {
-		return false
-	}
-	return true
+	return force && locSource == models.LocalizationSourceAI
 }
 
 func (s *Service) itemFields(ctx context.Context, job *Job, item *ItemText) ([]field, error) {
+	// Text already in the target language needs no translation.
+	if sameLanguage(item.DefaultLanguage, job.TargetLanguage) {
+		return nil, nil
+	}
 	loc, err := s.locs.ItemLocalization(ctx, item.ContentID, job.TargetLanguage)
 	if err != nil {
 		return nil, fmt.Errorf("load item localization: %w", err)
@@ -613,6 +837,9 @@ func (s *Service) filterSeasons(ctx context.Context, job *Job, seasons []ChildTe
 		if loc := locs[season.ContentID]; loc != nil {
 			locOverview, locSource = loc.Overview, loc.OverviewSource
 		}
+		if sameLanguage(season.DefaultLanguage, job.TargetLanguage) {
+			continue
+		}
 		if translatableField(season.Overview, locOverview, locSource, job.Force) {
 			fields = append(fields, field{kind: TargetSeason, contentID: season.ContentID, text: season.Overview})
 		}
@@ -635,6 +862,9 @@ func (s *Service) filterEpisodes(ctx context.Context, job *Job, episodes []Child
 		if loc := locs[episode.ContentID]; loc != nil {
 			locOverview, locSource = loc.Overview, loc.OverviewSource
 		}
+		if sameLanguage(episode.DefaultLanguage, job.TargetLanguage) {
+			continue
+		}
 		if translatableField(episode.Overview, locOverview, locSource, job.Force) {
 			fields = append(fields, field{kind: TargetEpisode, contentID: episode.ContentID, text: episode.Overview})
 		}
diff --git a/internal/metadata/translation/service_test.go b/internal/metadata/translation/service_test.go
index 9277215734..4e8fde01fa 100644
--- a/internal/metadata/translation/service_test.go
+++ b/internal/metadata/translation/service_test.go
@@ -7,7 +7,9 @@ import (
 	"fmt"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"testing"
+	"testing/synctest"
 	"time"
 
 	"github.com/prairie-server/prairie-server/internal/ai/jobrunner"
@@ -119,19 +121,44 @@ func (r *fakeRepo) job(id int64) Job {
 }
 
 type fakeContent struct {
-	item     *ItemText
-	seasons  []ChildText
-	episodes []ChildText
-	missing  int
+	item         *ItemText
+	seasons      []ChildText
+	episodes     []ChildText
+	missing      int
+	itemErr      error
+	libraryItems []string
 }
 
-func (c *fakeContent) ItemText(context.Context, string) (*ItemText, error) { return c.item, nil }
+func (c *fakeContent) ItemText(_ context.Context, contentID string) (*ItemText, error) {
+	if c.itemErr != nil {
+		return nil, c.itemErr
+	}
+	if c.item == nil || contentID != c.item.ContentID {
+		return nil, nil
+	}
+	return c.item, nil
+}
 func (c *fakeContent) SeasonTexts(context.Context, string) ([]ChildText, error) {
 	return c.seasons, nil
 }
 func (c *fakeContent) EpisodeTexts(context.Context, string) ([]ChildText, error) {
 	return c.episodes, nil
 }
+func (c *fakeContent) SeasonEpisodeTexts(_ context.Context, seasonID string) ([]ChildText, error) {
+	number := -1
+	for _, season := range c.seasons {
+		if season.ContentID == seasonID {
+			number = season.SeasonNumber
+		}
+	}
+	var out []ChildText
+	for _, episode := range c.episodes {
+		if episode.SeasonNumber == number {
+			out = append(out, episode)
+		}
+	}
+	return out, nil
+}
 func (c *fakeContent) SeasonByID(context.Context, string) (*ChildText, string, error) {
 	if len(c.seasons) == 0 {
 		return nil, "", nil
@@ -147,13 +174,16 @@ func (c *fakeContent) EpisodeByID(context.Context, string) (*ChildText, string,
 func (c *fakeContent) CountMissingFields(context.Context, string, string) (int, error) {
 	return c.missing, nil
 }
+func (c *fakeContent) LibraryItemsMissing(context.Context, int, string) ([]string, error) {
+	return c.libraryItems, nil
+}
 
 type aiWrite struct {
 	kind      TargetKind
 	contentID string
+	language  string
 	overview  string
 	tagline   string
-	force     bool
 }
 
 type fakeLocs struct {
@@ -183,13 +213,13 @@ func (l *fakeLocs) EpisodeLocalizations(context.Context, []string, string) (map[
 	return l.episodeLocs, nil
 }
 
-func (l *fakeLocs) UpsertItemAI(_ context.Context, contentID, _ string, overview, tagline *string, force bool) error {
+func (l *fakeLocs) UpsertItemAI(_ context.Context, contentID, language string, overview, tagline *string) error {
 	l.mu.Lock()
 	defer l.mu.Unlock()
 	if l.failOnUpsert {
 		return fmt.Errorf("boom")
 	}
-	w := aiWrite{kind: TargetItem, contentID: contentID, force: force}
+	w := aiWrite{kind: TargetItem, contentID: contentID, language: language}
 	if overview != nil {
 		w.overview = *overview
 	}
@@ -200,23 +230,23 @@ func (l *fakeLocs) UpsertItemAI(_ context.Context, contentID, _ string, overview
 	return nil
 }
 
-func (l *fakeLocs) UpsertSeasonAI(_ context.Context, contentID, _ string, overview string, force bool) error {
+func (l *fakeLocs) UpsertSeasonAI(_ context.Context, contentID, language string, overview string) error {
 	l.mu.Lock()
 	defer l.mu.Unlock()
 	if l.failOnUpsert {
 		return fmt.Errorf("boom")
 	}
-	l.writes = append(l.writes, aiWrite{kind: TargetSeason, contentID: contentID, overview: overview, force: force})
+	l.writes = append(l.writes, aiWrite{kind: TargetSeason, contentID: contentID, language: language, overview: overview})
 	return nil
 }
 
-func (l *fakeLocs) UpsertEpisodeAI(_ context.Context, contentID, _ string, overview string, force bool) error {
+func (l *fakeLocs) UpsertEpisodeAI(_ context.Context, contentID, language string, overview string) error {
 	l.mu.Lock()
 	defer l.mu.Unlock()
 	if l.failOnUpsert {
 		return fmt.Errorf("boom")
 	}
-	l.writes = append(l.writes, aiWrite{kind: TargetEpisode, contentID: contentID, overview: overview, force: force})
+	l.writes = append(l.writes, aiWrite{kind: TargetEpisode, contentID: contentID, language: language, overview: overview})
 	return nil
 }
 
@@ -373,13 +403,18 @@ func TestSkipIfFilledShortCircuitsWithoutModelCalls(t *testing.T) {
 	}
 }
 
-func TestForceRetranslatesProviderAndAIButNeverManual(t *testing.T) {
+// AC4: a forced re-translation refreshes earlier AI text only. Provider and
+// manual text is never replaced.
+func TestForceRetranslatesAIButNeverProviderOrManual(t *testing.T) {
 	repo, content, chat := newFakeRepo(), seriesContent(), &upperChat{}
 	locs := &fakeLocs{
 		itemLoc: &models.MediaItemLocalization{
 			Overview: "Vieux.", OverviewSource: "provider",
 			Tagline: "Manuel.", TaglineSource: "manual",
 		},
+		seasonLocs: map[string]*models.SeasonLocalization{
+			"sea1": {Overview: "Fournisseur.", OverviewSource: "provider"},
+		},
 		episodeLocs: map[string]*models.EpisodeLocalization{
 			"ep1": {Overview: "IA.", OverviewSource: "ai"},
 			"ep2": {Overview: "Manuel.", OverviewSource: "manual"},
@@ -396,25 +431,12 @@ func TestForceRetranslatesProviderAndAIButNeverManual(t *testing.T) {
 	waitDone(t, repo)
 
 	final := repo.job(job.ID)
-	// item overview (provider, forced) + sea1 + ep1 (ai, forced) = 3;
-	// tagline and ep2 are manual and stay untouched even with force.
-	if final.FieldsTotal != 3 {
-		t.Fatalf("fields_total = %d, want 3", final.FieldsTotal)
-	}
-	if final.Status != jobrunner.StatusCompleted || final.FieldsDone != 3 {
-		t.Fatalf("completed job = %+v, want 3 fields done", final)
+	if final.Status != jobrunner.StatusCompleted || final.FieldsTotal != 1 || final.FieldsDone != 1 {
+		t.Fatalf("job = %+v, want only the AI episode overview translated", final)
 	}
 	writes := locs.allWrites()
-	if len(writes) != 3 {
-		t.Fatalf("writes = %+v, want 3", writes)
-	}
-	for _, w := range writes {
-		if !w.force {
-			t.Errorf("write without force flag: %+v", w)
-		}
-		if w.tagline != "" || w.contentID == "ep2" {
-			t.Errorf("manual field was translated: %+v", w)
-		}
+	if len(writes) != 1 || writes[0].kind != TargetEpisode || writes[0].contentID != "ep1" {
+		t.Fatalf("writes = %+v, want only ep1", writes)
 	}
 }
 
@@ -461,6 +483,46 @@ func TestEnqueueDeduplicatesActiveJobs(t *testing.T) {
 	<-sem // release so cleanup can proceed
 }
 
+func TestEnqueueDedupeRespectsScopeAndForce(t *testing.T) {
+	repo, content, locs, chat := newFakeRepo(), seriesContent(), &fakeLocs{}, &upperChat{}
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+	sem := jobrunner.NewSemaphore(1)
+	sem <- struct{}{} // keep every job queued
+	t.Cleanup(func() { <-sem })
+	cfg := Config{Enabled: true, Configured: true, ChatModel: "test-model"}
+	svc := NewService(ctx, cfg, repo, content, locs, chat.fn, sem, nil)
+	enqueue := func(children, force bool) *Job {
+		t.Helper()
+		job, err := svc.Enqueue(context.Background(), JobRequest{ContentID: "series1", TargetLanguage: "fr", IncludeChildren: children, Force: force})
+		if err != nil {
+			t.Fatalf("Enqueue(children=%t, force=%t): %v", children, force, err)
+		}
+		return job
+	}
+
+	plain := enqueue(true, false)
+	// An admin re-translate must not be swallowed by a running plain job: the
+	// plain job skips fields that already have a value.
+	forced := enqueue(true, true)
+	if forced.ID == plain.ID || !forced.Force {
+		t.Fatalf("forced request reused job %+v, want a new forced job", forced)
+	}
+	// Narrower or unforced requests are covered by what is already running.
+	if got := enqueue(false, false); got.ID != plain.ID && got.ID != forced.ID {
+		t.Errorf("item-only request created job %d, want an existing covering job", got.ID)
+	}
+	if got := enqueue(false, true); got.ID != forced.ID {
+		t.Errorf("forced item-only request got job %d, want forced job %d", got.ID, forced.ID)
+	}
+	if got := enqueue(true, false); got.ID != plain.ID {
+		t.Errorf("repeat plain request got job %d, want %d", got.ID, plain.ID)
+	}
+	if len(repo.jobs) != 2 {
+		t.Errorf("jobs = %d, want 2", len(repo.jobs))
+	}
+}
+
 func TestAutoEnqueueSkipsWhenNothingMissing(t *testing.T) {
 	repo, content, locs, chat := newFakeRepo(), seriesContent(), &fakeLocs{}, &upperChat{}
 	content.missing = 0
@@ -553,6 +615,8 @@ func TestRequestOnViewCooldownAndGating(t *testing.T) {
 
 func TestRequestOnViewUsesRequestedTargetKind(t *testing.T) {
 	repo, content, locs, chat := newFakeRepo(), seriesContent(), &fakeLocs{}, &upperChat{}
+	// An episode of another season must stay out of a season job.
+	content.episodes = append(content.episodes, ChildText{ContentID: "ep3", SeasonNumber: 2, EpisodeNumber: 1, Overview: "Other season."})
 	svc := testService(t, repo, content, locs, chat)
 
 	seasonJob, err := svc.RequestOnView(context.Background(), TargetSeason, "sea1", "fr", nil)
@@ -560,30 +624,388 @@ func TestRequestOnViewUsesRequestedTargetKind(t *testing.T) {
 		t.Fatalf("RequestOnView season: %v", err)
 	}
 	waitDone(t, repo)
-	if final := repo.job(seasonJob.ID); final.TargetKind != TargetSeason || final.IncludeChildren {
-		t.Fatalf("season job = %+v, want target season without children", final)
+	if final := repo.job(seasonJob.ID); final.TargetKind != TargetSeason || !final.IncludeChildren || final.FieldsDone != 3 {
+		t.Fatalf("season job = %+v, want target season with its 2 episodes (3 fields)", final)
 	}
 
-	episodeJob, err := svc.RequestOnView(context.Background(), TargetEpisode, "ep1", "fr", nil)
+	episodeJob, err := svc.RequestOnView(context.Background(), TargetEpisode, "ep1", "de", nil)
 	if err != nil {
 		t.Fatalf("RequestOnView episode: %v", err)
 	}
 	waitDone(t, repo)
-	if final := repo.job(episodeJob.ID); final.TargetKind != TargetEpisode || final.IncludeChildren {
+	if final := repo.job(episodeJob.ID); final.TargetKind != TargetEpisode || final.IncludeChildren || final.FieldsDone != 1 {
 		t.Fatalf("episode job = %+v, want target episode without children", final)
 	}
 
-	writes := locs.allWrites()
-	var sawSeason, sawEpisode bool
-	for _, write := range writes {
-		if write.kind == TargetSeason && write.contentID == "sea1" && write.overview == "SEASON ONE." {
-			sawSeason = true
+	// A series page translates only the series' own description.
+	seriesJob, err := svc.RequestOnView(context.Background(), TargetItem, "series1", "it", nil)
+	if err != nil {
+		t.Fatalf("RequestOnView series: %v", err)
+	}
+	waitDone(t, repo)
+	if final := repo.job(seriesJob.ID); final.IncludeChildren || final.FieldsDone != 2 {
+		t.Fatalf("series job = %+v, want overview and tagline only", final)
+	}
+
+	written := map[string]bool{}
+	for _, write := range locs.allWrites() {
+		written[string(write.kind)+":"+write.contentID+":"+write.language] = true
+	}
+	for _, want := range []string{"season:sea1:fr", "episode:ep1:fr", "episode:ep2:fr", "episode:ep1:de", "item:series1:it"} {
+		if !written[want] {
+			t.Errorf("missing write %s; got %v", want, written)
+		}
+	}
+	for _, unwanted := range []string{"episode:ep3:fr", "season:sea1:it", "episode:ep1:it"} {
+		if written[unwanted] {
+			t.Errorf("unexpected write %s", unwanted)
+		}
+	}
+}
+
+// A season job never sends an episode that is already in the target language,
+// such as a French-source episode in a season otherwise in English. The match
+// is the catalog's (whole tag), so a fr-CA episode is still translated to fr.
+func TestSeasonJobSkipsEpisodesAlreadyInTheTargetLanguage(t *testing.T) {
+	repo, content, locs, chat := newFakeRepo(), seriesContent(), &fakeLocs{}, &upperChat{}
+	content.episodes[1].DefaultLanguage = "FR"
+	content.episodes[0].DefaultLanguage = "fr-CA"
+	svc := testService(t, repo, content, locs, chat)
+
+	job, err := svc.RequestOnView(context.Background(), TargetSeason, "sea1", "fr", nil)
+	if err != nil {
+		t.Fatalf("RequestOnView: %v", err)
+	}
+	waitDone(t, repo)
+	if final := repo.job(job.ID); final.FieldsDone != 2 {
+		t.Fatalf("fields = %d, want the season and the fr-CA ep1 only", final.FieldsDone)
+	}
+	for _, write := range locs.allWrites() {
+		if write.contentID == "ep2" {
+			t.Fatalf("translated an episode already in French: %+v", write)
+		}
+	}
+}
+
+func TestLibraryPrewarmTranslatesEachMissingItem(t *testing.T) {
+	repo, content, locs, chat := newFakeRepo(), seriesContent(), &fakeLocs{}, &upperChat{}
+	// "removed" disappeared after the walk listed it and is skipped.
+	content.libraryItems = []string{"removed", "series1"}
+	svc := testService(t, repo, content, locs, chat)
+
+	job, err := svc.EnqueueLibrary(context.Background(), 7, "fr", nil)
+	if err != nil {
+		t.Fatalf("EnqueueLibrary: %v", err)
+	}
+	if job.TargetKind != TargetLibrary || job.ContentID != "library:7" || job.Force || !job.IncludeChildren {
+		t.Fatalf("job = %+v, want an unforced library job for library:7", job)
+	}
+	waitDone(t, repo)
+
+	final := repo.job(job.ID)
+	if final.Status != jobrunner.StatusCompleted || final.FieldsDone != 2 || final.FieldsTotal != 2 {
+		t.Fatalf("final = %+v, want completed with 2 of 2 items", final)
+	}
+	// The series' overview and tagline, season 1, and both episodes.
+	if got := len(locs.allWrites()); got != 5 {
+		t.Fatalf("writes = %d (%+v), want 5", got, locs.allWrites())
+	}
+	// A repeat while nothing is running starts a new job; a prewarm request
+	// cannot ask for force.
+	if _, err := svc.Enqueue(context.Background(), JobRequest{TargetKind: TargetLibrary, ContentID: "library:x", TargetLanguage: "fr"}); err == nil {
+		t.Fatal("Enqueue accepted an invalid library target")
+	}
+	forced, err := svc.Enqueue(context.Background(), JobRequest{TargetKind: TargetLibrary, ContentID: "library:7", TargetLanguage: "de", Force: true})
+	if err != nil {
+		t.Fatalf("Enqueue: %v", err)
+	}
+	if forced.Force {
+		t.Fatalf("library job kept force: %+v", forced)
+	}
+	waitDone(t, repo)
+}
+
+func TestLibraryPrewarmStopsOnProviderFailure(t *testing.T) {
+	repo, content, locs := newFakeRepo(), seriesContent(), &fakeLocs{}
+	content.libraryItems = []string{"series1", "series1", "series1", "series1"}
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+	var calls atomic.Int32
+	failing := func(context.Context, string, string) (string, error) {
+		calls.Add(1)
+		return "", fmt.Errorf("quota exceeded")
+	}
+	cfg := Config{Enabled: true, Configured: true, ChatModel: "test-model"}
+	svc := NewService(ctx, cfg, repo, content, locs, failing, jobrunner.NewSemaphore(1), nil)
+
+	job, err := svc.EnqueueLibrary(context.Background(), 7, "fr", nil)
+	if err != nil {
+		t.Fatalf("EnqueueLibrary: %v", err)
+	}
+	waitDone(t, repo)
+	final := repo.job(job.ID)
+	if final.Status != jobrunner.StatusFailed || !strings.Contains(final.ErrorMessage, "quota exceeded") {
+		t.Fatalf("final = %+v, want failed with the provider error", final)
+	}
+	if got := calls.Load(); got != libraryMaxFailuresInRow {
+		t.Fatalf("provider calls = %d, want the job to stop after %d failed items in a row", got, libraryMaxFailuresInRow)
+	}
+	if len(locs.allWrites()) != 0 {
+		t.Fatalf("writes = %+v, want none", locs.allWrites())
+	}
+}
+
+// An item the model cannot translate is skipped, so it cannot block the rest
+// of the library on every re-run.
+func TestLibraryPrewarmSkipsAFailingItem(t *testing.T) {
+	repo, content, locs := newFakeRepo(), seriesContent(), &fakeLocs{}
+	content.libraryItems = []string{"series1", "series1", "series1"}
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+	var calls atomic.Int32
+	chat := func(ctx context.Context, system, user string) (string, error) {
+		if calls.Add(1) == 1 {
+			return "", fmt.Errorf("content refused")
+		}
+		return (&upperChat{}).fn(ctx, system, user)
+	}
+	cfg := Config{Enabled: true, Configured: true, ChatModel: "test-model"}
+	svc := NewService(ctx, cfg, repo, content, locs, chat, jobrunner.NewSemaphore(1), nil)
+
+	job, err := svc.EnqueueLibrary(context.Background(), 7, "fr", nil)
+	if err != nil {
+		t.Fatalf("EnqueueLibrary: %v", err)
+	}
+	waitDone(t, repo)
+	final := repo.job(job.ID)
+	if final.Status != jobrunner.StatusCompleted || final.FieldsDone != 3 || final.FieldsTotal != 3 {
+		t.Fatalf("final = %+v, want completed with 3 of 3 items", final)
+	}
+	if !strings.Contains(final.ProgressMessage, "1 of them failed") {
+		t.Fatalf("message = %q, want it to report the failed item", final.ProgressMessage)
+	}
+	if len(locs.allWrites()) == 0 {
+		t.Fatal("the items after the failing one were not translated")
+	}
+}
+
+// Between items a prewarm hands its AI slot to a job queued behind it.
+func TestLibraryPrewarmYieldsItsSlotBetweenItems(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		repo, content, locs := newFakeRepo(), seriesContent(), &fakeLocs{}
+		content.libraryItems = []string{"series1", "series1"}
+		ctx, cancel := context.WithCancel(context.Background())
+		defer cancel()
+		release := make(chan struct{})
+		var calls atomic.Int32
+		chat := func(ctx context.Context, system, user string) (string, error) {
+			if calls.Add(1) == 1 {
+				<-release
+			}
+			return (&upperChat{}).fn(ctx, system, user)
 		}
-		if write.kind == TargetEpisode && write.contentID == "ep1" && write.overview == "PILOT EPISODE." {
-			sawEpisode = true
+		cfg := Config{Enabled: true, Configured: true, ChatModel: "test-model"}
+		sem := jobrunner.NewSemaphore(1)
+		svc := NewService(ctx, cfg, repo, content, locs, chat, sem, nil)
+		if _, err := svc.EnqueueLibrary(context.Background(), 7, "fr", nil); err != nil {
+			t.Fatalf("EnqueueLibrary: %v", err)
 		}
+		synctest.Wait() // the prewarm holds the slot, translating its first item
+
+		// Another job queues for the only slot while the first item translates.
+		admitted := make(chan struct{})
+		go func() {
+			sem <- struct{}{}
+			close(admitted)
+		}()
+		synctest.Wait()
+		close(release)
+		synctest.Wait()
+		select {
+		case <-admitted:
+		default:
+			t.Fatal("the queued job did not get the slot between items")
+		}
+		if got := calls.Load(); got != 1 {
+			t.Fatalf("provider calls = %d, want the queued job admitted before the second item", got)
+		}
+		<-sem
+		waitDone(t, repo)
+		if got := calls.Load(); got != 2 {
+			t.Fatalf("provider calls = %d, want the second item translated after the other job", got)
+		}
+	})
+}
+
+// A cancel recorded by another node stops the prewarm before its next item.
+func TestLibraryPrewarmStopsWhenCanceledElsewhere(t *testing.T) {
+	repo, content, locs := newFakeRepo(), seriesContent(), &fakeLocs{}
+	content.libraryItems = []string{"series1", "series1", "series1"}
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+	var calls atomic.Int32
+	jobIDs := make(chan int64, 1)
+	started := make(chan struct{})
+	var jobID int64
+	chat := func(_ context.Context, _ string, user string) (string, error) {
+		if calls.Add(1) == 1 {
+			defer close(started)
+			jobID = <-jobIDs
+			// The first item is in flight when another node cancels the job.
+			repo.mu.Lock()
+			repo.jobs[jobID].Status = jobrunner.StatusCancelled
+			repo.mu.Unlock()
+		}
+		return (&upperChat{}).fn(ctx, "", user)
+	}
+	cfg := Config{Enabled: true, Configured: true, ChatModel: "test-model"}
+	sem := jobrunner.NewSemaphore(1)
+	sem <- struct{}{} // hold the job until its ID is known
+	svc := NewService(ctx, cfg, repo, content, locs, chat, sem, nil)
+	job, err := svc.EnqueueLibrary(context.Background(), 7, "fr", nil)
+	if err != nil {
+		t.Fatalf("EnqueueLibrary: %v", err)
+	}
+	jobIDs <- job.ID
+	<-sem
+	select {
+	case <-started:
+	case <-time.After(5 * time.Second):
+		t.Fatal("the prewarm never called the provider")
 	}
-	if !sawSeason || !sawEpisode {
-		t.Fatalf("missing target-kind writes: %+v", writes)
+
+	// The runner frees its slot when the job returns.
+	select {
+	case sem <- struct{}{}:
+	case <-time.After(5 * time.Second):
+		t.Fatal("the canceled prewarm kept running")
+	}
+	if got := calls.Load(); got != 1 {
+		t.Fatalf("provider calls = %d, want the prewarm to stop after the item in flight", got)
+	}
+	if got := repo.job(job.ID).Status; got != jobrunner.StatusCancelled {
+		t.Fatalf("status = %s, want it left canceled", got)
+	}
+}
+
+// An active job from the previous key format is reused when it covers the
+// request, so a rolling deploy does not start duplicate work.
+func TestEnqueueReusesALegacyKeyJobThatCoversTheRequest(t *testing.T) {
+	repo, content, locs, chat := newFakeRepo(), seriesContent(), &fakeLocs{}, &upperChat{}
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+	sem := jobrunner.NewSemaphore(1)
+	sem <- struct{}{}
+	t.Cleanup(func() { <-sem })
+	svc := NewService(ctx, Config{Enabled: true, Configured: true, ChatModel: "test-model"}, repo, content, locs, chat.fn, sem, nil)
+	legacy := &Job{TargetKind: TargetItem, ContentID: "series1", TargetLanguage: "fr", IncludeChildren: true,
+		Status: jobrunner.StatusRunning, IdempotencyKey: legacyIdempotencyKey(TargetItem, "series1", "fr", "test-model")}
+	if err := repo.InsertJob(context.Background(), legacy); err != nil {
+		t.Fatal(err)
+	}
+	got, err := svc.Enqueue(context.Background(), JobRequest{ContentID: "series1", TargetLanguage: "fr", IncludeChildren: true})
+	if err != nil || got.ID != legacy.ID {
+		t.Fatalf("plain request got %+v (%v), want legacy job %d", got, err, legacy.ID)
+	}
+	forced, err := svc.Enqueue(context.Background(), JobRequest{ContentID: "series1", TargetLanguage: "fr", IncludeChildren: true, Force: true})
+	if err != nil || forced.ID == legacy.ID {
+		t.Fatalf("forced request got %+v (%v), want a new job", forced, err)
+	}
+}
+
+// For a movie the children flag means nothing, so requests with and without
+// it share one job.
+func TestEnqueueTreatsMovieChildrenFlagAsTheSameJob(t *testing.T) {
+	repo, locs, chat := newFakeRepo(), &fakeLocs{}, &upperChat{}
+	content := &fakeContent{item: &ItemText{ContentID: "movie1", Type: "movie", Title: "M", Overview: "An overview."}}
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+	sem := jobrunner.NewSemaphore(1)
+	sem <- struct{}{}
+	t.Cleanup(func() { <-sem })
+	svc := NewService(ctx, Config{Enabled: true, Configured: true, ChatModel: "test-model"}, repo, content, locs, chat.fn, sem, nil)
+	first, err := svc.Enqueue(context.Background(), JobRequest{ContentID: "movie1", TargetLanguage: "fr"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, err := svc.Enqueue(context.Background(), JobRequest{ContentID: "movie1", TargetLanguage: "fr", IncludeChildren: true})
+	if err != nil || second.ID != first.ID {
+		t.Fatalf("movie request with children got %+v (%v), want job %d", second, err, first.ID)
+	}
+}
+
+// A failed item lookup must not queue a job under an unnormalized key.
+func TestEnqueueReturnsTheItemLookupError(t *testing.T) {
+	repo, locs, chat := newFakeRepo(), &fakeLocs{}, &upperChat{}
+	lookupErr := errors.New("item lookup failed")
+	content := &fakeContent{itemErr: lookupErr}
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+	sem := jobrunner.NewSemaphore(1)
+	sem <- struct{}{}
+	t.Cleanup(func() { <-sem })
+	svc := NewService(ctx, Config{Enabled: true, Configured: true, ChatModel: "test-model"}, repo, content, locs, chat.fn, sem, nil)
+	job, err := svc.Enqueue(context.Background(), JobRequest{ContentID: "movie1", TargetLanguage: "fr", IncludeChildren: true})
+	if !errors.Is(err, lookupErr) || job != nil {
+		t.Fatalf("Enqueue = %+v, %v; want the item lookup error", job, err)
+	}
+}
+
+func TestEnqueueTreatsEpisodeChildrenFlagAsTheSameJob(t *testing.T) {
+	repo, locs, chat := newFakeRepo(), &fakeLocs{}, &upperChat{}
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+	sem := jobrunner.NewSemaphore(1)
+	sem <- struct{}{}
+	t.Cleanup(func() { <-sem })
+	svc := NewService(ctx, Config{Enabled: true, Configured: true, ChatModel: "test-model"}, repo, &fakeContent{}, locs, chat.fn, sem, nil)
+	first, err := svc.Enqueue(context.Background(), JobRequest{TargetKind: TargetEpisode, ContentID: "ep1", TargetLanguage: "fr"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, err := svc.Enqueue(context.Background(), JobRequest{TargetKind: TargetEpisode, ContentID: "ep1", TargetLanguage: "fr", IncludeChildren: true})
+	if err != nil || second.ID != first.ID {
+		t.Fatalf("episode request with children got %+v (%v), want job %d", second, err, first.ID)
+	}
+}
+
+// A series-only on-view job must not swallow a later full-series request.
+func TestEnqueueStartsAFullSeriesJobWhileASeriesOnlyJobRuns(t *testing.T) {
+	repo, content, locs, chat := newFakeRepo(), seriesContent(), &fakeLocs{}, &upperChat{}
+	ctx, cancel := context.WithCancel(context.Background())
+	t.Cleanup(cancel)
+	sem := jobrunner.NewSemaphore(1)
+	sem <- struct{}{} // keep every job queued
+	t.Cleanup(func() { <-sem })
+	svc := NewService(ctx, Config{Enabled: true, Configured: true, ChatModel: "test-model"}, repo, content, locs, chat.fn, sem, nil)
+	narrow, err := svc.Enqueue(context.Background(), JobRequest{ContentID: "series1", TargetLanguage: "fr"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	full, err := svc.Enqueue(context.Background(), JobRequest{ContentID: "series1", TargetLanguage: "fr", IncludeChildren: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if full.ID == narrow.ID || !full.IncludeChildren {
+		t.Fatalf("full-series request got %+v, want a new job with children", full)
+	}
+}
+
+func TestTranslatableField(t *testing.T) {
+	cases := []struct {
+		name, base, value, source string
+		force, want               bool
+	}{
+		{"empty provider field fills", "Text.", "", "provider", false, true},
+		{"empty manual field stays, the repository keeps manual values", "Text.", "", "manual", true, false},
+		{"provider text stays even when forced", "Text.", "Anbieter.", "provider", true, false},
+		{"AI text refreshes when forced", "Text.", "KI.", "ai", true, true},
+		{"AI text stays unforced", "Text.", "KI.", "ai", false, false},
+		{"no source text", "", "", "", true, false},
+	}
+	for _, tc := range cases {
+		if got := translatableField(tc.base, tc.value, tc.source, tc.force); got != tc.want {
+			t.Errorf("%s: got %t, want %t", tc.name, got, tc.want)
+		}
 	}
 }
diff --git a/internal/metadata/translation/store.go b/internal/metadata/translation/store.go
index c08e49892b..ca9107fad4 100644
--- a/internal/metadata/translation/store.go
+++ b/internal/metadata/translation/store.go
@@ -13,9 +13,9 @@ type LocalizationStore interface {
 	ItemLocalization(ctx context.Context, contentID, language string) (*models.MediaItemLocalization, error)
 	SeasonLocalizations(ctx context.Context, ids []string, language string) (map[string]*models.SeasonLocalization, error)
 	EpisodeLocalizations(ctx context.Context, ids []string, language string) (map[string]*models.EpisodeLocalization, error)
-	UpsertItemAI(ctx context.Context, contentID, language string, overview, tagline *string, force bool) error
-	UpsertSeasonAI(ctx context.Context, contentID, language, overview string, force bool) error
-	UpsertEpisodeAI(ctx context.Context, contentID, language, overview string, force bool) error
+	UpsertItemAI(ctx context.Context, contentID, language string, overview, tagline *string) error
+	UpsertSeasonAI(ctx context.Context, contentID, language, overview string) error
+	UpsertEpisodeAI(ctx context.Context, contentID, language, overview string) error
 }
 
 // CatalogLocalizationStore adapts the catalog localization repositories to
@@ -38,14 +38,14 @@ func (s *CatalogLocalizationStore) EpisodeLocalizations(ctx context.Context, ids
 	return s.Episodes.GetByEpisodeIDs(ctx, ids, language)
 }
 
-func (s *CatalogLocalizationStore) UpsertItemAI(ctx context.Context, contentID, language string, overview, tagline *string, force bool) error {
-	return s.Items.UpsertAITranslation(ctx, contentID, language, overview, tagline, force)
+func (s *CatalogLocalizationStore) UpsertItemAI(ctx context.Context, contentID, language string, overview, tagline *string) error {
+	return s.Items.UpsertAITranslation(ctx, contentID, language, overview, tagline)
 }
 
-func (s *CatalogLocalizationStore) UpsertSeasonAI(ctx context.Context, contentID, language, overview string, force bool) error {
-	return s.Seasons.UpsertAIOverview(ctx, contentID, language, overview, force)
+func (s *CatalogLocalizationStore) UpsertSeasonAI(ctx context.Context, contentID, language, overview string) error {
+	return s.Seasons.UpsertAIOverview(ctx, contentID, language, overview)
 }
 
-func (s *CatalogLocalizationStore) UpsertEpisodeAI(ctx context.Context, contentID, language, overview string, force bool) error {
-	return s.Episodes.UpsertAIOverview(ctx, contentID, language, overview, force)
+func (s *CatalogLocalizationStore) UpsertEpisodeAI(ctx context.Context, contentID, language, overview string) error {
+	return s.Episodes.UpsertAIOverview(ctx, contentID, language, overview)
 }
diff --git a/internal/metadata/types.go b/internal/metadata/types.go
index ddd5602717..d8d7d3f382 100644
--- a/internal/metadata/types.go
+++ b/internal/metadata/types.go
@@ -101,8 +101,9 @@ type ProcessResult struct {
 	IsNew     bool // True if this was an initial match (new item created)
 	Updated   bool // True if any fields were changed
 	Decision  *MatchDecision
-	// Pinned reports that automatic matching skipped an item an admin split
-	// left unmatched on purpose. It is a completed outcome, not a failure.
+	// Pinned reports that automatic matching skipped an item an admin left
+	// unmatched on purpose, by ignoring it or by splitting it off unmatched.
+	// It is a completed outcome, not a failure.
 	Pinned bool
 }
 
diff --git a/internal/metadata/worker.go b/internal/metadata/worker.go
index ee02238a59..6ba8a095c0 100644
--- a/internal/metadata/worker.go
+++ b/internal/metadata/worker.go
@@ -874,8 +874,8 @@ func (w *MatchWorker) processQueuedMovieFile(ctx context.Context, job models.Mov
 			w.logStatusUpdateFailure(ctx, skeleton.ContentID, "unmatched", "content_id", skeleton.ContentID, "file_id", file.ID, "path", file.FilePath)
 			return false
 		} else if result == nil || !result.Pinned {
-			// A pinned result is an unmatched split target: nothing matched or
-			// changed, and the job is complete.
+			// A pinned result is an item an admin left unmatched: nothing
+			// matched or changed, and the job is complete.
 			w.publishCatalogItemChanged(ctx, file.MediaFolderID, resultContentID(result, skeleton.ContentID), "metadata_updated")
 		}
 	}
@@ -1073,7 +1073,7 @@ func (w *MatchWorker) applyQueuedGroupOverride(ctx context.Context, file *models
 	if override == nil || !isProvisionalOwnershipStatus(skeleton.ItemStatus) {
 		return false, nil
 	}
-	if pinned, err := w.service.pinnedUnmatchedBySplit(ctx, skeleton.ContentID); err != nil || pinned {
+	if pinned, err := w.service.pinnedUnmatched(ctx, skeleton.ContentID); err != nil || pinned {
 		return false, err
 	}
 	owned, err := w.itemOwnsContentGroup(ctx, file)
@@ -1537,12 +1537,12 @@ func (w *MatchWorker) processSeriesRoot(ctx context.Context, job models.SeriesRo
 	return len(groupFiles), nil
 }
 
-// synthesizePinnedSeriesEpisodes gives an unmatched split target the same
-// file-derived episodes an automatic match failure would, so its episodes stay
-// browsable while it waits for an admin to identify it.
+// synthesizePinnedSeriesEpisodes gives a series an admin left unmatched (an
+// ignored item or an unmatched split target) the same file-derived episodes
+// an automatic match failure would, so its episodes stay browsable.
 func (w *MatchWorker) synthesizePinnedSeriesEpisodes(ctx context.Context, contentID string) {
 	if err := w.service.SynthesizeFallbackEpisodes(ctx, contentID); err != nil {
-		slog.WarnContext(ctx, "metadata: fallback episode synthesis failed for unmatched split target", "component", "metadata",
+		slog.WarnContext(ctx, "metadata: fallback episode synthesis failed for a series left unmatched", "component", "metadata",
 			"content_id", contentID, "error", err)
 	}
 }
diff --git a/internal/models/media.go b/internal/models/media.go
index fed0bc701e..ab348faf55 100644
--- a/internal/models/media.go
+++ b/internal/models/media.go
@@ -716,6 +716,10 @@ type MediaItem struct {
 	// PlayContentID is transient presentation metadata populated by resolvers
 	// whose displayed item differs from the leaf item that should play.
 	PlayContentID string
+	// MachineTranslatedFields is transient presentation metadata set by
+	// localization: the fields ("overview", "tagline") whose localized text
+	// came from AI translation rather than a provider or a person.
+	MachineTranslatedFields []string `json:"-"`
 	// PosterIsEpisodeStill and BackdropIsEpisodeStill are transient provenance
 	// set by the query that picks an episode card's artwork: true when the
 	// path is the episode's own still, false for season or series artwork, nil
@@ -775,6 +779,8 @@ type Season struct {
 	MetadataSource          string
 	CreatedAt               time.Time
 	UpdatedAt               time.Time
+	// MachineTranslatedFields is transient; see MediaItem.
+	MachineTranslatedFields []string `json:"-"`
 }
 
 // Episode represents a row in the episodes table.
@@ -802,6 +808,12 @@ type Episode struct {
 	MetadataSource          string
 	CreatedAt               time.Time
 	UpdatedAt               time.Time
+	// MachineTranslatedFields is transient; see MediaItem.
+	MachineTranslatedFields []string `json:"-"`
+	// PendingTranslationLanguage is transient presentation metadata set by
+	// batch localization: the viewer's language this episode's description is
+	// missing, so an episode list can start on-view translation.
+	PendingTranslationLanguage string `json:"-"`
 }
 
 // MediaItemRoot represents a row in the media_item_roots table.
@@ -840,8 +852,8 @@ type EpisodeLibrary struct {
 
 // Localization field provenance values. Precedence when writing:
 // manual beats provider beats ai — a provider refresh may overwrite an AI
-// translation but never a manual edit, and AI never overwrites either
-// (except provider, when the admin explicitly forces a re-translation).
+// translation but never a manual edit, and AI never overwrites either, not
+// even when the admin forces a re-translation.
 const (
 	LocalizationSourceProvider = "provider"
 	LocalizationSourceAI       = "ai"
diff --git a/internal/models/user.go b/internal/models/user.go
index ee35048d52..0abc10a46e 100644
--- a/internal/models/user.go
+++ b/internal/models/user.go
@@ -31,7 +31,7 @@ type User struct {
 	MaxLocalStreamBitrateKbps  *int  // nil = inherit; 0 = explicit unlimited
 	TranscodeAllowed           *bool // nil = inherit
 	AudioTranscodeAllowed      *bool // nil = inherit
-	MaxProfiles                int
+	MaxProfiles                *int  // nil = inherit; at least 1
 	DownloadAllowed            *bool // nil = inherit
 	DownloadTranscodeAllowed   *bool // nil = inherit
 	RequestsAllowed            *bool // nil = inherit
@@ -76,7 +76,7 @@ type CreateUserInput struct {
 	MaxLocalStreamBitrateKbps  *int
 	TranscodeAllowed           *bool
 	AudioTranscodeAllowed      *bool
-	MaxProfiles                *int // nil = use DB default (5); minimum 1
+	MaxProfiles                *int // minimum 1
 	DownloadAllowed            *bool
 	DownloadTranscodeAllowed   *bool
 	RequestsAllowed            *bool
@@ -125,7 +125,7 @@ type UpdateUserInput struct {
 	MaxLocalStreamBitrateKbps  Optional[int]
 	TranscodeAllowed           Optional[bool]
 	AudioTranscodeAllowed      Optional[bool]
-	MaxProfiles                *int
+	MaxProfiles                Optional[int]
 	DownloadAllowed            Optional[bool]
 	DownloadTranscodeAllowed   Optional[bool]
 	RequestsAllowed            Optional[bool]
diff --git a/internal/naming/filename.go b/internal/naming/filename.go
index de9fc0bccc..cbd9edd341 100644
--- a/internal/naming/filename.go
+++ b/internal/naming/filename.go
@@ -67,7 +67,7 @@ func ResolvePathContext(filePath string, libraryType string, libraryRoots ...str
 	}
 
 	allowNumericSeasonDirs := ctx.HasEpisodePattern || normalizedLibraryType == "series"
-	ctx.HasSeasonStructure, _ = detectSeasonStructure(directories, nameNoExt, allowNumericSeasonDirs, libraryRoot != "")
+	ctx.HasSeasonStructure, _ = detectSeasonStructure(directories, nameNoExt, episode.seriesTitle, allowNumericSeasonDirs, libraryRoot != "")
 	ctx.HasMovieFolderEvidence = filepath.Clean(parentDir) != libraryRoot && detectInferMovieFolderEvidence(parentBase, nameNoExt, ctx.HasSeasonStructure)
 
 	switch normalizedLibraryType {
@@ -95,7 +95,7 @@ func ResolvePathContext(filePath string, libraryType string, libraryRoots ...str
 			ctx.HasAirDatePattern = true
 		}
 
-		if root, ok := deriveSeriesRoot(normalized, ctx.HasEpisodePattern, normalizedLibraryType == "series", libraryRoot); ok {
+		if root, ok := deriveSeriesRoot(normalized, episode.seriesTitle, ctx.HasEpisodePattern, normalizedLibraryType == "series", libraryRoot); ok {
 			ctx.RootPath = root.RootPath
 			if filepath.Clean(ctx.RootPath) != libraryRoot {
 				ctx.Title, ctx.Year, rootSeason, rootSeasonKnown = parseSeriesFolderIdentity(root.FolderName)
@@ -273,8 +273,21 @@ func parseAirDate(name string) (string, bool) {
 
 // detectSeasonStructure walks parts from the file upward. configuredRoot
 // reports that parts start directly in a configured library folder; fileStem
-// is the file name without extension.
-func detectSeasonStructure(parts []string, fileStem string, allowNumeric, configuredRoot bool) (bool, int) {
+// is the file name without extension and fileTitle the series title parsed
+// from it, if any.
+func detectSeasonStructure(parts []string, fileStem, fileTitle string, allowNumeric, configuredRoot bool) (bool, int) {
+	found, number, _ := scanSeasonStructure(parts, fileStem, fileTitle, allowNumeric, configuredRoot)
+	return found, number
+}
+
+// scanSeasonStructure is detectSeasonStructure that also reports whether the
+// match carries a season number. numbered is false when the match is a bare
+// season folder such as "Season": that folder counts as season structure but
+// has no number. A bare folder only counts as the file's immediate parent, the
+// same place deriveSeriesRoot accepts it, and a numbered season folder above
+// it takes precedence.
+func scanSeasonStructure(parts []string, fileStem, fileTitle string, allowNumeric, configuredRoot bool) (found bool, number int, numbered bool) {
+	bare := false
 	for i := len(parts) - 1; i >= 0; i-- {
 		parent := ""
 		if i > 0 {
@@ -283,15 +296,18 @@ func detectSeasonStructure(parts []string, fileStem string, allowNumeric, config
 		numericSeason := allowNumeric && (i != 0 || !configuredRoot)
 		topLevel := configuredRoot && i == 0 && mayBeShowFolder(parts[i], fileStem)
 		if number, ok := seasonDirectoryNumber(parts[i], parent, numericSeason, topLevel); ok {
-			return true, number
+			return true, number, true
+		}
+		if i == len(parts)-1 && numericSeason && i > 0 && isBareSeasonFolder(parts[i], fileTitle) {
+			bare = true
 		}
 	}
-	return false, 0
+	return bare, 0, false
 }
 
 func firstSeasonNumber(parts []string, fileStem string, allowNumeric, configuredRoot bool) (int, bool) {
-	found, seasonNum := detectSeasonStructure(parts, fileStem, allowNumeric, configuredRoot)
-	return seasonNum, found
+	_, seasonNum, numbered := scanSeasonStructure(parts, fileStem, "", allowNumeric, configuredRoot)
+	return seasonNum, numbered
 }
 
 func hasExplicitFolderIDs(name string) bool {
@@ -324,9 +340,12 @@ func collapseWhitespace(value string) string {
 	return strings.Join(strings.Fields(value), " ")
 }
 
-func deriveSeriesRoot(filePath string, hasEpisodePattern bool, forceParent bool, libraryRoot string) (*SeriesRoot, bool) {
+// deriveSeriesRoot finds the show folder above filePath. fileTitle is the
+// series title parsed from the file name, if any.
+func deriveSeriesRoot(filePath, fileTitle string, hasEpisodePattern bool, forceParent bool, libraryRoot string) (*SeriesRoot, bool) {
 	parentDir := path.Dir(filePath)
 	fileStem := strings.TrimSuffix(path.Base(filePath), path.Ext(filePath))
+	bareSeason := ""
 	for current := parentDir; current != "." && current != "/" && current != ""; current = path.Dir(current) {
 		if libraryRoot != "" && filepath.Clean(current) == libraryRoot {
 			break
@@ -335,8 +354,26 @@ func deriveSeriesRoot(filePath string, hasEpisodePattern bool, forceParent bool,
 		inLibraryFolder := libraryRoot != "" && filepath.Clean(path.Dir(current)) == libraryRoot
 		allowNumeric := (hasEpisodePattern || forceParent) && !inLibraryFolder
 		topLevel := inLibraryFolder && mayBeShowFolder(segment, fileStem)
-		if _, ok := seasonDirectoryNumber(segment, path.Base(path.Dir(current)), allowNumeric, topLevel); ok {
+		_, isSeason := seasonDirectoryNumber(segment, path.Base(path.Dir(current)), allowNumeric, topLevel)
+		// A bare "Season" folder only marks the season level when it holds the
+		// file directly. Higher up it is more likely a category folder or a
+		// show that happens to be named Season. A file whose own title is the
+		// folder name marks that folder as the show. Keep walking in case it sits
+		// inside a numbered season folder, which then decides the show root.
+		if !isSeason && allowNumeric && current == parentDir && isBareSeasonFolder(segment, fileTitle) {
+			bareSeason = current
+			continue
+		}
+		if isSeason {
 			rootPath := path.Dir(current)
+			// Specials or Extras inside a season folder belong to the same show
+			// as the episodes beside them.
+			if specialsDirRe.MatchString(strings.TrimSpace(segment)) &&
+				(libraryRoot == "" || filepath.Clean(path.Dir(rootPath)) != libraryRoot) &&
+				specialsInSeasonFolder(path.Base(rootPath), path.Base(path.Dir(rootPath)), fileTitle,
+					current == parentDir && (hasEpisodePattern || forceParent)) {
+				rootPath = path.Dir(rootPath)
+			}
 			if rootPath == "." || rootPath == "/" || rootPath == "" {
 				return nil, false
 			}
@@ -347,6 +384,16 @@ func deriveSeriesRoot(filePath string, hasEpisodePattern bool, forceParent bool,
 		}
 	}
 
+	if bareSeason != "" {
+		if rootPath := path.Dir(bareSeason); rootPath != "." && rootPath != "/" && rootPath != "" {
+			return &SeriesRoot{
+				RootPath:   rootPath,
+				FolderName: path.Base(rootPath),
+			}, true
+		}
+		return nil, false
+	}
+
 	if hasEpisodePattern || forceParent {
 		if parentDir == "." || parentDir == "/" || parentDir == "" {
 			return nil, false
@@ -360,6 +407,37 @@ func deriveSeriesRoot(filePath string, hasEpisodePattern bool, forceParent bool,
 	return nil, false
 }
 
+// specialsInSeasonFolder reports whether segment, the folder that holds a
+// Specials/ or Extras/ folder, is a season folder. Only a plain season name
+// counts: a bare number, another Specials/Extras label, provider IDs, a season
+// word followed by more title ("Series 7 Documentary"), or the title the file
+// itself carries is the show's own name (24, Extras), not a season. A bare
+// number counts when the file's title names the folder above it instead. A bare
+// "Season" folder counts only when bareAllowed: the Specials/Extras folder
+// holds the file directly and the file carries an episode code (or the
+// library is a series library).
+func specialsInSeasonFolder(segment, parent, fileTitle string, bareAllowed bool) bool {
+	if specialsDirRe.MatchString(strings.TrimSpace(segment)) || ParseFolderIDs(segment) != nil {
+		return false
+	}
+	// A file whose own title is the folder name marks that folder as the show.
+	if fileTitle != "" && normalizeComparableTitle(fileTitle) == normalizeComparableTitle(segment) {
+		return false
+	}
+	if _, ok := seasonDirectoryNumber(segment, parent, false, true); ok {
+		return true
+	}
+	// A bare number is a season when the file's own title names the show
+	// folder above it (Show/02/Specials/Show S00E01.mkv).
+	if fileTitle != "" && numericSeasonDirRe.MatchString(strings.TrimSpace(segment)) {
+		parentTitle, _ := parseTitleYearCandidate(parent)
+		if normalizeComparableTitle(fileTitle) == normalizeComparableTitle(parentTitle) {
+			return true
+		}
+	}
+	return bareAllowed && isBareSeasonFolder(segment, fileTitle)
+}
+
 func deriveMovieRoot(filePath, libraryRoot string) (*CanonicalRoot, bool) {
 	baseName := path.Base(filePath)
 	nameNoExt := strings.TrimSuffix(baseName, filepath.Ext(baseName))
diff --git a/internal/naming/library_root_identity_test.go b/internal/naming/library_root_identity_test.go
index 8b7161ede9..ad2bc3f25d 100644
--- a/internal/naming/library_root_identity_test.go
+++ b/internal/naming/library_root_identity_test.go
@@ -164,3 +164,175 @@ func TestConfiguredRootDistinguishesNumericShowsFromSeasons(t *testing.T) {
 		})
 	}
 }
+
+func TestBareSeasonFolderJoinsParentShow(t *testing.T) {
+	show := "/media/tv/Example Show (2013) {tvdb-123456}"
+	paths := []string{
+		show + "/Season/Example Show - S01E01.mkv",
+		show + "/Season 2/Example Show - S02E01.mkv",
+		show + "/Staffel/Example Show - S03E01.mkv",
+		show + "/Saison/Example Show - S04E01.mkv",
+		// Decomposed spelling, as macOS file systems store it.
+		show + "/Sa\u0308song/Example Show - S05E01.mkv",
+		show + "/Season/Specials/Example Show - S00E01.mkv",
+		show + "/Season/Extras/Example Show - S00E02.mkv",
+	}
+	_, assignments := InferRootAssignments(paths, "series", 1, nil, "/media/tv")
+	for _, p := range paths {
+		assignment := assignments[p]
+		if assignment.RootPath != show {
+			t.Errorf("%s: root %q, want %q", p, assignment.RootPath, show)
+		}
+		group := InferGroupIdentity(p, "series", assignment)
+		if group.BaseTitle != "Example Show" || group.TvdbID != "123456" {
+			t.Errorf("%s: identity %+v", p, group)
+		}
+	}
+}
+
+func TestSpecialsInsideASeasonFolderJoinTheShow(t *testing.T) {
+	for _, tc := range []struct {
+		path, root, title string
+		season, episode   int
+	}{
+		{"/tv/Show/Season 01/Extras/Show S01E05 Deleted.mkv", "/tv/Show", "Show", 1, 5},
+		{"/tv/Show/Season 01/Specials/Show S00E05.mkv", "/tv/Show", "Show", 0, 5},
+		{"/tv/Show/S01/Extras/Show S01E06.mkv", "/tv/Show", "Show", 1, 6},
+		{"/tv/Drama/24/Season 01/Specials/24 S00E01.mkv", "/tv/Drama/24", "24", 0, 1},
+		// A bare number or a Specials/Extras label holding the folder is the
+		// show's own title, not a season.
+		{"/tv/Drama/1883/Specials/1883 S00E01.mkv", "/tv/Drama/1883", "1883", 0, 1},
+		{"/tv/Drama/24/Extras/24 S00E02.mkv", "/tv/Drama/24", "24", 0, 2},
+		{"/tv/Extras/Specials/Extras S00E01.mkv", "/tv/Extras", "Extras", 0, 1},
+		{"/tv/Comedy/Extras/Specials/Extras S00E01.mkv", "/tv/Comedy/Extras", "Extras", 0, 1},
+		// A show whose name starts like a season keeps its specials.
+		{"/tv/Documentaries/Series 7 Documentary (2024) {tvdb-123456}/Specials/Series 7 Documentary S00E01.mkv", "/tv/Documentaries/Series 7 Documentary (2024) {tvdb-123456}", "Series 7 Documentary", 0, 1},
+		{"/tv/Documentaries/Series 7 Documentary/Specials/Series 7 Documentary S00E01.mkv", "/tv/Documentaries/Series 7 Documentary", "Series 7 Documentary", 0, 1},
+		{"/tv/Drama/Season 2/Specials/Season 2 S00E01.mkv", "/tv/Drama/Season 2", "Season 2", 0, 1},
+		{"/tv/Show/02/Specials/Show S00E01.mkv", "/tv/Show", "Show", 0, 1},
+		{"/tv/Show (2020)/02/Specials/Show S00E02.mkv", "/tv/Show (2020)", "Show", 0, 2},
+		// A season folder directly in the library folder is not lifted to it.
+		{"/tv/Season 01/Specials/Show S00E01.mkv", "/tv/Season 01", "Season 01", 0, 1},
+	} {
+		ctx := ResolvePathContext(tc.path, "series", "/tv")
+		if ctx.RootPath != tc.root || ctx.Title != tc.title || ctx.SeasonNum != tc.season || ctx.EpisodeNum != tc.episode {
+			t.Errorf("ResolvePathContext(%q) = root %q title %q S%02dE%02d, want root %q title %q S%02dE%02d",
+				tc.path, ctx.RootPath, ctx.Title, ctx.SeasonNum, ctx.EpisodeNum, tc.root, tc.title, tc.season, tc.episode)
+		}
+	}
+}
+
+func TestBareSeasonLabelsExcludeCategoryFolders(t *testing.T) {
+	for _, name := range []string{"Season", "season", "Staffel", "Temporada"} {
+		if !isBareSeasonDirectory(name) {
+			t.Errorf("%q should be a bare season folder", name)
+		}
+	}
+	for _, name := range []string{"Series", "S", "Seasons", "Season 2", "Show"} {
+		if isBareSeasonDirectory(name) {
+			t.Errorf("%q should not be a bare season folder", name)
+		}
+	}
+}
+
+func TestBareSeasonFolderAtLibraryRootIsNotLifted(t *testing.T) {
+	filePath := "/media/tv/Season/Example Show - S01E01.mkv"
+	_, assignments := InferRootAssignments([]string{filePath}, "series", 1, nil, "/media/tv")
+	if got := assignments[filePath].RootPath; got == "/media/tv" {
+		t.Errorf("bare season folder at library root lifted to the library root: %q", got)
+	}
+}
+
+func TestBareSeasonFolderOnlyCountsAsImmediateParent(t *testing.T) {
+	cases := map[string]string{
+		"/tv/Genres/Season/Shows/Example Show/Example.Show.S01E01.mkv": "/tv/Genres/Season/Shows/Example Show",
+		"/tv/Season/Example.Show.S01E01.mkv":                           "/tv/Season",
+	}
+	for filePath, want := range cases {
+		root, ok := deriveSeriesRoot(filePath, "Example Show", true, false, "/tv")
+		if !ok || root.RootPath != want {
+			t.Errorf("%s: root %+v ok=%v, want %q", filePath, root, ok, want)
+		}
+	}
+	// A show named "Season" with a numbered season folder keeps its own name.
+	root, ok := deriveSeriesRoot("/tv/Season/Season 1/Season.S01E01.mkv", "Season", true, false, "/tv")
+	if !ok || root.RootPath != "/tv/Season" {
+		t.Errorf("show named Season: root %+v ok=%v", root, ok)
+	}
+}
+
+func TestBareSeasonFolderIsSeasonStructureEvidence(t *testing.T) {
+	filePath := "/tv/Example Show/Season/Example.Show.S01E01.mkv"
+	ctx := ResolvePathContext(filePath, "series", "/tv")
+	if !ctx.HasSeasonStructure {
+		t.Errorf("ResolvePathContext: HasSeasonStructure=false for bare season folder")
+	}
+	if ctx.RootPath != "/tv/Example Show" {
+		t.Errorf("ResolvePathContext root %q", ctx.RootPath)
+	}
+	evidence := extractPathEvidence(filePath, "series", "/tv")
+	if !evidence.HasSeasonStructure {
+		t.Errorf("extractPathEvidence: HasSeasonStructure=false for bare season folder")
+	}
+	if _, ok := firstSeasonNumber([]string{"Example Show", "Season"}, "Example.Show.S01E01", true, true); ok {
+		t.Errorf("bare season folder must not supply a season number")
+	}
+	// A bare folder higher up is not season structure.
+	if found, _ := detectSeasonStructure([]string{"Genres", "Season", "Shows", "Example Show"}, "Example.Show.S01E01", "Example Show", true, true); found {
+		t.Errorf("ancestor bare season folder counted as season structure")
+	}
+	_, assignments := InferRootAssignments([]string{filePath}, "series", 1, nil, "/tv")
+	group := InferGroupIdentity(filePath, "series", assignments[filePath])
+	if group.Confidence != "high" {
+		t.Errorf("group confidence %q, want high", group.Confidence)
+	}
+}
+
+func TestBareSeasonFolderInsideNumberedSeasonKeepsShow(t *testing.T) {
+	shows := []string{"/media/tv/Example Show (2013) {tvdb-123456}", "/media/tv/Other Show (2015) {tvdb-654321}"}
+	paths := []string{
+		shows[0] + "/Season 2/Season/Example Show - S02E01.mkv",
+		shows[1] + "/Season 2/Season/Other Show - S02E01.mkv",
+	}
+	_, assignments := InferRootAssignments(paths, "series", 1, nil, "/media/tv")
+	keys := map[string]bool{}
+	for i, p := range paths {
+		assignment := assignments[p]
+		if assignment.RootPath != shows[i] {
+			t.Errorf("%s: root %q, want %q", p, assignment.RootPath, shows[i])
+		}
+		group := InferGroupIdentity(p, "series", assignment)
+		if group.TvdbID == "" || keys[group.ContentGroupKey] {
+			t.Errorf("%s: identity %+v", p, group)
+		}
+		keys[group.ContentGroupKey] = true
+	}
+	if number, ok := firstSeasonNumber([]string{"Example Show", "Season 2", "Season"}, "Example Show - S02E01", true, true); !ok || number != 2 {
+		t.Errorf("season number %d ok=%v, want 2 from the numbered ancestor", number, ok)
+	}
+}
+
+func TestShowNamedSeasonUnderCategoryFolderKeepsItsFolder(t *testing.T) {
+	for _, name := range []string{"Season.S01E01.mkv", "Season.E03.mkv", "Season - 03.mkv", "Season.103.mkv"} {
+		filePath := "/tv/Genres/Season/" + name
+		ctx := ResolvePathContext(filePath, "series", "/tv")
+		if ctx.RootPath != "/tv/Genres/Season" || ctx.Title != "Season" {
+			t.Errorf("%s: ResolvePathContext root %q title %q, want /tv/Genres/Season and Season", name, ctx.RootPath, ctx.Title)
+		}
+		if ctx.HasSeasonStructure {
+			t.Errorf("%s: ResolvePathContext: a show folder named Season counted as season structure", name)
+		}
+		if evidence := extractPathEvidence(filePath, "series", "/tv"); evidence.HasSeasonStructure {
+			t.Errorf("%s: extractPathEvidence: a show folder named Season counted as season structure", name)
+		}
+		_, assignments := InferRootAssignments([]string{filePath}, "series", 1, nil, "/tv")
+		if got := assignments[filePath].RootPath; got != "/tv/Genres/Season" {
+			t.Errorf("%s: InferRootAssignments root %q, want /tv/Genres/Season", name, got)
+		}
+	}
+	// Another show's file in a bare Season folder still lifts to that show.
+	other := "/tv/Genres/Example Show/Season/Example.Show.S01E01.mkv"
+	if got := ResolvePathContext(other, "series", "/tv").RootPath; got != "/tv/Genres/Example Show" {
+		t.Errorf("bare season folder root %q, want /tv/Genres/Example Show", got)
+	}
+}
diff --git a/internal/naming/root_inference.go b/internal/naming/root_inference.go
index 868c244c1f..179473c32c 100644
--- a/internal/naming/root_inference.go
+++ b/internal/naming/root_inference.go
@@ -283,8 +283,8 @@ func extractPathEvidence(filePath string, libraryType string, libraryRoots ...st
 
 	seriesLibrary := normalizeInferLibraryType(libraryType) == seriesContentType
 	allowNumericSeason := seriesLibrary && (libraryRoot == "" || len(dirParts) > 1)
-	_, hasEpisodePattern := parseEpisodeToken(nameNoExt, dirParts, libraryRoot != "", allowNumericSeason, seriesLibrary)
-	hasSeasonStructure, _ := detectSeasonStructure(dirParts, nameNoExt, hasEpisodePattern || seriesLibrary, libraryRoot != "")
+	episode, hasEpisodePattern := parseEpisodeToken(nameNoExt, dirParts, libraryRoot != "", allowNumericSeason, seriesLibrary)
+	hasSeasonStructure, _ := detectSeasonStructure(dirParts, nameNoExt, episode.seriesTitle, hasEpisodePattern || seriesLibrary, libraryRoot != "")
 	parentTitle, parentYear, parentTrusted := parseInferFolderTitleYear(parentBase)
 	if parentDir == libraryRoot {
 		parentTitle, parentYear, parentTrusted = "", 0, false
@@ -383,7 +383,7 @@ func normalizeInferLibraryType(value string) string {
 }
 
 func detectInferSeasonStructure(parts []string, allowNumeric bool) bool {
-	found, _ := detectSeasonStructure(parts, "", allowNumeric, false)
+	found, _ := detectSeasonStructure(parts, "", "", allowNumeric, false)
 	return found
 }
 
diff --git a/internal/naming/season.go b/internal/naming/season.go
index 9af77f3707..5cd7a40f22 100644
--- a/internal/naming/season.go
+++ b/internal/naming/season.go
@@ -10,7 +10,12 @@ import (
 // seasonDirectoryLabels name a season level. Accented labels also accept the
 // decomposed spelling (a letter plus a combining accent) that macOS file
 // systems and shares commonly store.
-const seasonDirectoryLabels = `season|staffel|stagione|sæson|temporada|kausi|s(?:ä|a\x{308})song|seizoen|seasong|sezon|sezona|sez(?:ó|o\x{301})na|sezonul|saison|시즌|シーズン|сезон|s|` + wordSeasonDirectoryLabels
+const seasonDirectoryLabels = bareSeasonDirectoryLabels + `|s|` + wordSeasonDirectoryLabels
+
+// bareSeasonDirectoryLabels also name a season level with no number, as in a
+// folder called just Season. The one-letter S and the word labels below are
+// left out so category folders such as Series are not taken for seasons.
+const bareSeasonDirectoryLabels = `season|staffel|stagione|sæson|temporada|kausi|s(?:ä|a\x{308})song|seizoen|seasong|sezon|sezona|sez(?:ó|o\x{301})na|sezonul|saison|시즌|シーズン|сезон`
 
 // wordSeasonDirectoryLabels also begin ordinary titles (Series 7 Documentary).
 // A folder directly in the library folder is usually the show, so there a bare
@@ -24,8 +29,27 @@ var (
 	reversedSeasonDirectoryRe  = regexp.MustCompile(`(?i)^(\d{1,4})(st|nd|rd|th)?[ ._-]+(` + seasonDirectoryLabels + `)(?:$|[ ._\-\[\]])`)
 	wordSeasonDirectoryLabelRe = regexp.MustCompile(`(?i)^(?:` + wordSeasonDirectoryLabels + `)$`)
 	seasonYearPrefixRe         = regexp.MustCompile(`^(?:19|20)\d{2}(?:$|[^0-9])`)
+	bareSeasonDirectoryRe      = regexp.MustCompile(`(?i)^(?:` + bareSeasonDirectoryLabels + `)$`)
 )
 
+// isBareSeasonDirectory reports whether segment is a season label with no
+// number, such as "Season". It is not a season number: the episode numbers in
+// the file names still decide the season.
+func isBareSeasonDirectory(segment string) bool {
+	return bareSeasonDirectoryRe.MatchString(strings.TrimSpace(segment))
+}
+
+// isBareSeasonFolder is isBareSeasonDirectory for a folder that holds a file
+// whose own series title is fileTitle. When that title is the folder name, as
+// in Season/Season.S01E01.mkv, the folder is a show named "Season", not a
+// season level.
+func isBareSeasonFolder(segment, fileTitle string) bool {
+	if !isBareSeasonDirectory(segment) {
+		return false
+	}
+	return fileTitle == "" || normalizeComparableTitle(segment) != normalizeComparableTitle(fileTitle)
+}
+
 // seasonLabelStandsAlone reports whether a bare season label in a folder
 // directly in the library folder names a season, given the text after its
 // number (or, in the number-first form, after the label): only years,
diff --git a/internal/naming/subtitle.go b/internal/naming/subtitle.go
new file mode 100644
index 0000000000..d335b550f4
--- /dev/null
+++ b/internal/naming/subtitle.go
@@ -0,0 +1,105 @@
+package naming
+
+import (
+	"path/filepath"
+	"strings"
+
+	"github.com/prairie-server/prairie-server/internal/lang"
+)
+
+// SubtitleTags is what a sidecar subtitle's file name says about the track.
+type SubtitleTags struct {
+	Language        string
+	Forced          bool
+	HearingImpaired bool
+}
+
+// SubtitleSuffix returns the part of a sidecar subtitle's name between the
+// video's name and the subtitle extension, both given without extensions:
+// ".en.sdh" for "Movie.en.sdh" next to "Movie". ok is false when the sidecar
+// does not belong to the video; its name must equal the video's or continue
+// with a dot, so "MovieExtra" does not match "Movie".
+func SubtitleSuffix(videoBase, subtitleBase string) (suffix string, ok bool) {
+	suffix, ok = strings.CutPrefix(subtitleBase, videoBase)
+	if !ok || (suffix != "" && !strings.HasPrefix(suffix, ".")) {
+		return "", false
+	}
+	return suffix, true
+}
+
+// SidecarSubtitleTags reads the tags of the sidecar at subtitlePath as a
+// subtitle for the video at videoPath. ok is false when the names do not
+// match, as SubtitleSuffix decides.
+func SidecarSubtitleTags(videoPath, subtitlePath string) (SubtitleTags, bool) {
+	videoBase := filepath.Base(videoPath)
+	subtitleBase := filepath.Base(subtitlePath)
+	suffix, ok := SubtitleSuffix(
+		strings.TrimSuffix(videoBase, filepath.Ext(videoBase)),
+		strings.TrimSuffix(subtitleBase, filepath.Ext(subtitleBase)))
+	if !ok {
+		return SubtitleTags{}, false
+	}
+	return ParseSubtitleSuffix(suffix), true
+}
+
+// ParseSubtitleSuffix reads the dot-separated words of a sidecar suffix such
+// as ".en.sdh". The words can come in any order:
+//
+//   - "forced" marks a forced track, and "sdh" or "cc" a hearing-impaired one.
+//     "sdh" is also the ISO 639-3 code for Southern Kurdish; as in Jellyfin
+//     and Plex, the flag wins.
+//   - The language is the first word that names a registered language, so
+//     ".ai.hr" and ".hr.ai" are both Croatian. A language with a two-letter
+//     ISO 639-1 code wins over one that has only a three-letter code, because
+//     many short words in file names ("sub", "dub", "mkv") are also ISO 639-3
+//     codes: ".sub.en" is English, while ".yue" alone is still Cantonese.
+//   - "hi" is Hindi when no other word names a two-letter-code language, and
+//     otherwise marks the track hearing-impaired, the rule Jellyfin uses.
+func ParseSubtitleSuffix(suffix string) SubtitleTags {
+	var tags SubtitleTags
+	var threeLetterOnly string
+	hiWords := 0
+	for _, word := range strings.Split(suffix, ".") {
+		switch strings.ToLower(strings.TrimSpace(word)) {
+		case "":
+			continue
+		case "forced":
+			tags.Forced = true
+		case "sdh", "cc":
+			tags.HearingImpaired = true
+		case "hi":
+			hiWords++
+		default:
+			tag := lang.RegisteredTag(word)
+			switch {
+			case tag == "":
+			case hasTwoLetterCode(word, tag):
+				if tags.Language == "" {
+					tags.Language = tag
+				}
+			case threeLetterOnly == "":
+				threeLetterOnly = tag
+			}
+		}
+	}
+	if tags.Language == "" && hiWords > 0 {
+		tags.Language = "hi"
+		hiWords--
+	}
+	if tags.Language == "" {
+		tags.Language = threeLetterOnly
+	}
+	if hiWords > 0 {
+		tags.HearingImpaired = true
+	}
+	return tags
+}
+
+// hasTwoLetterCode reports whether word, read as tag, names a language with an
+// ISO 639-1 code. The word's own spelling counts too: the deprecated "tl" is a
+// two-letter code even though it canonicalizes to "fil".
+func hasTwoLetterCode(word, tag string) bool {
+	primary, _, _ := strings.Cut(tag, "-")
+	written, _, _ := strings.Cut(strings.ReplaceAll(strings.TrimSpace(word), "_", "-"), "-")
+	return len(primary) == 2 || len(written) == 2
+}
diff --git a/internal/naming/subtitle_test.go b/internal/naming/subtitle_test.go
new file mode 100644
index 0000000000..a44a753a46
--- /dev/null
+++ b/internal/naming/subtitle_test.go
@@ -0,0 +1,26 @@
+package naming
+
+import "testing"
+
+func TestSidecarSubtitleTags(t *testing.T) {
+	tests := []struct {
+		video, subtitle string
+		want            SubtitleTags
+		ok              bool
+	}{
+		{"/m/Movie (2020).mkv", "/m/Movie (2020).srt", SubtitleTags{}, true},
+		{"/m/Movie (2020).mkv", "/m/Movie (2020).sdh.en.SRT", SubtitleTags{Language: "en", HearingImpaired: true}, true},
+		{"/m/Movie.Name.2020.mkv", "/m/Movie.Name.2020.hr.ai.srt", SubtitleTags{Language: "hr"}, true},
+		{"/m/Movie.part2.mkv", "/m/Movie.part2.fr.forced.ass", SubtitleTags{Language: "fr", Forced: true}, true},
+		{"/m/Movie.mkv", "/m/MovieExtra.srt", SubtitleTags{}, false},
+		{"/m/Movie.mkv", "/m/Other.en.srt", SubtitleTags{}, false},
+	}
+	for _, tc := range tests {
+		t.Run(tc.subtitle, func(t *testing.T) {
+			got, ok := SidecarSubtitleTags(tc.video, tc.subtitle)
+			if got != tc.want || ok != tc.ok {
+				t.Fatalf("SidecarSubtitleTags(%q, %q) = %+v, %v; want %+v, %v", tc.video, tc.subtitle, got, ok, tc.want, tc.ok)
+			}
+		})
+	}
+}
diff --git a/internal/netguard/netguard.go b/internal/netguard/netguard.go
index 90f02dde99..6fe572add7 100644
--- a/internal/netguard/netguard.go
+++ b/internal/netguard/netguard.go
@@ -228,9 +228,16 @@ type Transport struct {
 
 // NewTransport returns a Transport whose dialers check every address they
 // connect to, which covers redirects and DNS answers that change after a
-// URL was checked.
-func NewTransport() *Transport {
-	return &Transport{public: newGuardedTransport(false), private: newGuardedTransport(true)}
+// URL was checked. Each configure function adjusts both pools, for settings
+// such as a response header timeout; it must not replace the dialer or set a
+// proxy.
+func NewTransport(configure ...func(*http.Transport)) *Transport {
+	t := &Transport{public: newGuardedTransport(false), private: newGuardedTransport(true)}
+	for _, fn := range configure {
+		fn(t.public)
+		fn(t.private)
+	}
+	return t
 }
 
 func (t *Transport) RoundTrip(req *http.Request) (*http.Response, error) {
diff --git a/internal/nodeauth/nodeauth.go b/internal/nodeauth/nodeauth.go
new file mode 100644
index 0000000000..e3f23af090
--- /dev/null
+++ b/internal/nodeauth/nodeauth.go
@@ -0,0 +1,317 @@
+// Package nodeauth authenticates the internal HTTP calls that API servers and
+// proxies make to Prairie workers (proxies and transcode nodes).
+//
+// The shared auth.jwt_secret never crosses the wire: it also signs login,
+// profile, and stream tokens, so a copy captured from a worker link could mint
+// them. Each request instead carries an HMAC-SHA256 over its method, path,
+// query, a timestamp, and the SHA-256 of its body. The MAC key is derived from
+// the shared secret with HKDF under a label nothing else uses, so it cannot
+// sign or verify any other token.
+//
+// See docs/architecture/worker-http-protocol.md#authentication.
+package nodeauth
+
+import (
+	"bytes"
+	"crypto/hkdf"
+	"crypto/hmac"
+	"crypto/sha256"
+	"crypto/subtle"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"strconv"
+	"strings"
+	"sync/atomic"
+	"time"
+)
+
+// Scheme is the Authorization scheme of a signed worker request.
+const Scheme = "Prairie-Node-HMAC-SHA256"
+
+const (
+	// maxSkew is how far a signed request's timestamp may be from the
+	// receiver's clock, in either direction.
+	maxSkew = 30 * time.Second
+	// maxBodyBytes bounds the body a receiver buffers to check its hash.
+	// Worker request bodies are small JSON documents.
+	maxBodyBytes = 1 << 20
+
+	// keyLabel is the HKDF info string for the MAC key. Changing it, or
+	// reusing it for another purpose, breaks the key separation.
+	keyLabel = "prairie/node-request-auth/v1"
+	// canonicalVersion opens the signed string so a later format cannot be
+	// confused with this one.
+	canonicalVersion = "prairie-node-request-v1"
+)
+
+var (
+	// ErrNoSecret reports that the receiver has no shared secret configured,
+	// so it can verify nothing.
+	ErrNoSecret = errors.New("node auth: shared secret is not configured")
+	// ErrUnauthorized reports a missing, malformed, expired, or wrong
+	// credential.
+	ErrUnauthorized = errors.New("node auth: unauthorized")
+)
+
+var emptyBodyHash = sha256.Sum256(nil)
+
+// Sign authenticates req for the Prairie worker registered at nodeURL. Call it
+// once the URL and body are final and just before sending: the signature
+// expires after maxSkew. A body without GetBody is read into memory and
+// replaced.
+//
+// The signature covers the request path relative to nodeURL, which is the
+// path the worker serves: a reverse proxy that puts the worker under a path
+// prefix strips that prefix before the worker sees it.
+//
+// Without a secret, Sign leaves req unsigned and the worker refuses it. Every
+// server generates the secret at startup, so this happens only in tests.
+func Sign(req *http.Request, nodeURL, secret string) error {
+	return sign(req, nodeURL, secret, time.Now())
+}
+
+func sign(req *http.Request, nodeURL, secret string, now time.Time) error {
+	if secret == "" {
+		return nil
+	}
+	bodyHash, err := outgoingBodyHash(req)
+	if err != nil {
+		return fmt.Errorf("node auth: hash request body: %w", err)
+	}
+	timestamp := strconv.FormatInt(now.Unix(), 10)
+	body := hex.EncodeToString(bodyHash)
+	mac, err := requestMAC(secret, timestamp, req.Method, workerPath(req.URL, nodeURL), req.URL.RawQuery, body)
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Authorization", Scheme+" t="+timestamp+",b="+body+",sig="+hex.EncodeToString(mac))
+	return nil
+}
+
+// Verify checks that r came from a holder of the shared secret. It checks the
+// MAC before reading any body, so a caller without the secret cannot make the
+// worker buffer one. A signed body (at most maxBodyBytes) is then read to
+// check its hash and left readable for the handler.
+//
+// Verify also accepts the legacy "Bearer <secret>" credential so API servers
+// and proxies from the previous release keep working while a deployment
+// upgrades. Remove that branch in the release after the one that introduced
+// signed requests, with the tests marked for removal with it; every sender
+// already signs.
+func Verify(r *http.Request, secret string) error {
+	return verify(r, secret, time.Now())
+}
+
+func verify(r *http.Request, secret string, now time.Time) error {
+	if secret == "" {
+		return ErrNoSecret
+	}
+	scheme, params, _ := strings.Cut(r.Header.Get("Authorization"), " ")
+	switch {
+	case strings.EqualFold(scheme, Scheme):
+		return verifySigned(r, secret, params, now)
+	case strings.EqualFold(scheme, "Bearer"):
+		if subtle.ConstantTimeCompare([]byte(params), []byte(secret)) != 1 {
+			return ErrUnauthorized
+		}
+		if suppressed, ok := legacyBearerLog.allow(); ok {
+			slog.WarnContext(r.Context(), "accepted a legacy bearer credential from an older Prairie API server or proxy; upgrade it, because the next release accepts only signed requests",
+				"component", "nodeauth", "remote_addr", r.RemoteAddr, "suppressed", suppressed)
+		}
+		return nil
+	}
+	return ErrUnauthorized
+}
+
+func verifySigned(r *http.Request, secret, params string, now time.Time) error {
+	fields, ok := parseParams(params)
+	if !ok {
+		return ErrUnauthorized
+	}
+	seconds, err := strconv.ParseInt(fields.timestamp, 10, 64)
+	if err != nil {
+		return ErrUnauthorized
+	}
+	got, err := hex.DecodeString(fields.signature)
+	if err != nil || len(got) != sha256.Size {
+		return ErrUnauthorized
+	}
+	bodyHash, err := hex.DecodeString(fields.body)
+	if err != nil || len(bodyHash) != sha256.Size {
+		return ErrUnauthorized
+	}
+	want, err := requestMAC(secret, fields.timestamp, r.Method, r.URL.EscapedPath(), r.URL.RawQuery, fields.body)
+	if err != nil {
+		return ErrUnauthorized
+	}
+	if !hmac.Equal(got, want) {
+		if suppressed, ok := badSignatureLog.allow(); ok {
+			slog.WarnContext(r.Context(), "refused a node request with an invalid signature; check that the sender uses this worker's secret and that nothing in front of the worker rewrites the request path or query",
+				"component", "nodeauth", "remote_addr", r.RemoteAddr, "suppressed", suppressed)
+		}
+		return ErrUnauthorized
+	}
+	// The MAC covers the timestamp, so a valid signature outside the window
+	// means the clocks disagree (or an old request was replayed).
+	if skew := now.Sub(time.Unix(seconds, 0)); skew > maxSkew || skew < -maxSkew {
+		if suppressed, ok := staleLog.allow(); ok {
+			slog.WarnContext(r.Context(), "refused a signed node request outside the 30-second window; check that this worker's clock agrees with its API servers and proxies",
+				"component", "nodeauth", "remote_addr", r.RemoteAddr, "offset_seconds", int64(skew.Seconds()), "suppressed", suppressed)
+		}
+		return ErrUnauthorized
+	}
+	if !bodyMatches(r, bodyHash) {
+		if suppressed, ok := badBodyLog.allow(); ok {
+			slog.WarnContext(r.Context(), "refused a signed node request whose body does not match its signature; check that nothing in front of the worker changes request bodies",
+				"component", "nodeauth", "remote_addr", r.RemoteAddr, "suppressed", suppressed)
+		}
+		return ErrUnauthorized
+	}
+	return nil
+}
+
+type signedParams struct {
+	timestamp, body, signature string
+}
+
+// parseParams reads "t=<unix seconds>,b=<hex body SHA-256>,sig=<hex>" in any
+// order.
+func parseParams(params string) (signedParams, bool) {
+	var fields signedParams
+	for part := range strings.SplitSeq(params, ",") {
+		name, value, found := strings.Cut(strings.TrimSpace(part), "=")
+		if !found {
+			return signedParams{}, false
+		}
+		switch name {
+		case "t":
+			fields.timestamp = value
+		case "b":
+			fields.body = value
+		case "sig":
+			fields.signature = value
+		}
+	}
+	return fields, fields.timestamp != "" && fields.body != "" && fields.signature != ""
+}
+
+// workerPath is target's escaped path without the path prefix of nodeURL, if
+// it has one.
+func workerPath(target *url.URL, nodeURL string) string {
+	path := target.EscapedPath()
+	base, err := url.Parse(nodeURL)
+	if err != nil {
+		return path
+	}
+	if prefix := strings.TrimRight(base.EscapedPath(), "/"); prefix != "" && strings.HasPrefix(path, prefix+"/") {
+		return path[len(prefix):]
+	}
+	return path
+}
+
+// requestMAC signs the canonical form of one request. An empty path is the
+// root, which is what a client puts on the wire for it.
+func requestMAC(secret, timestamp, method, path, rawQuery, bodyHash string) ([]byte, error) {
+	key, err := hkdf.Key(sha256.New, []byte(secret), nil, keyLabel, sha256.Size)
+	if err != nil {
+		return nil, fmt.Errorf("node auth: derive key: %w", err)
+	}
+	if path == "" {
+		path = "/"
+	}
+	mac := hmac.New(sha256.New, key)
+	_, _ = io.WriteString(mac, strings.Join([]string{
+		canonicalVersion, timestamp, method, path, rawQuery, bodyHash,
+	}, "\n"))
+	return mac.Sum(nil), nil
+}
+
+func outgoingBodyHash(req *http.Request) ([]byte, error) {
+	if req.Body == nil || req.Body == http.NoBody {
+		return emptyBodyHash[:], nil
+	}
+	if req.GetBody != nil {
+		body, err := req.GetBody()
+		if err != nil {
+			return nil, err
+		}
+		defer func() { _ = body.Close() }()
+		hash := sha256.New()
+		if _, err := io.Copy(hash, body); err != nil {
+			return nil, err
+		}
+		return hash.Sum(nil), nil
+	}
+	data, err := io.ReadAll(req.Body)
+	_ = req.Body.Close()
+	if err != nil {
+		return nil, err
+	}
+	req.Body = io.NopCloser(bytes.NewReader(data))
+	req.GetBody = func() (io.ReadCloser, error) { return io.NopCloser(bytes.NewReader(data)), nil }
+	req.ContentLength = int64(len(data))
+	sum := sha256.Sum256(data)
+	return sum[:], nil
+}
+
+// bodyMatches reads r's body, at most maxBodyBytes, compares its hash with
+// the signed one, and leaves the body readable for the handler.
+func bodyMatches(r *http.Request, want []byte) bool {
+	if r.Body == nil || r.Body == http.NoBody {
+		return hmac.Equal(want, emptyBodyHash[:])
+	}
+	if r.ContentLength > maxBodyBytes {
+		return false
+	}
+	data, err := io.ReadAll(io.LimitReader(r.Body, maxBodyBytes+1))
+	if err != nil || len(data) > maxBodyBytes {
+		return false
+	}
+	r.Body = io.NopCloser(bytes.NewReader(data))
+	sum := sha256.Sum256(data)
+	return hmac.Equal(want, sum[:])
+}
+
+// logThrottle limits one kind of warning to a line per interval per process:
+// segment relays and capability probes would otherwise log on every request.
+// Each line counts the warnings suppressed since the previous one, so a
+// stranger's junk request cannot hide a run of genuine refusals.
+type logThrottle struct {
+	last       atomic.Int64
+	suppressed atomic.Int64
+}
+
+const logInterval = 10 * time.Minute
+
+var legacyBearerLog, badSignatureLog, staleLog, badBodyLog logThrottle
+
+// processStart anchors the throttles to Go's monotonic clock, which wall-clock
+// corrections do not move, so a clock fix neither silences nor re-opens them.
+var processStart = time.Now()
+
+// allow reports whether a warning may be logged now; if so it records the
+// time and returns the number suppressed since the last one.
+func (l *logThrottle) allow() (suppressed int64, ok bool) {
+	return l.allowAt(time.Since(processStart))
+}
+
+// allowAt is allow at elapsed time since processStart. A concurrent caller
+// that sampled an earlier time than the last recorded one counts as inside the
+// interval.
+func (l *logThrottle) allowAt(elapsed time.Duration) (suppressed int64, ok bool) {
+	last := l.last.Load()
+	if last != 0 && elapsed-time.Duration(last) < logInterval {
+		l.suppressed.Add(1)
+		return 0, false
+	}
+	if !l.last.CompareAndSwap(last, max(int64(elapsed), 1)) {
+		l.suppressed.Add(1)
+		return 0, false
+	}
+	return l.suppressed.Swap(0), true
+}
diff --git a/internal/nodeauth/nodeauth_test.go b/internal/nodeauth/nodeauth_test.go
new file mode 100644
index 0000000000..3af44dd7b7
--- /dev/null
+++ b/internal/nodeauth/nodeauth_test.go
@@ -0,0 +1,384 @@
+package nodeauth
+
+import (
+	"bytes"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+)
+
+const testSecret = "shared-secret-for-tests"
+
+var testNow = time.Unix(1_760_000_000, 0)
+
+// signedServerRequest signs a client request, then rebuilds it the way a
+// server receives it: from the request line and body bytes on the wire.
+func signedServerRequest(t *testing.T, method, target string, body []byte, signedAt time.Time) *http.Request {
+	t.Helper()
+	var reader io.Reader
+	if body != nil {
+		reader = bytes.NewReader(body)
+	}
+	client, err := http.NewRequest(method, target, reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := sign(client, "http://node.test", testSecret, signedAt); err != nil {
+		t.Fatalf("sign: %v", err)
+	}
+	server := httptest.NewRequest(method, client.URL.RequestURI(), bytes.NewReader(body))
+	server.Header.Set("Authorization", client.Header.Get("Authorization"))
+	return server
+}
+
+func TestSignNeverSendsTheSecret(t *testing.T) {
+	req, err := http.NewRequest(http.MethodGet, "http://node.test/hw-capabilities", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := Sign(req, "http://node.test", testSecret); err != nil {
+		t.Fatal(err)
+	}
+	auth := req.Header.Get("Authorization")
+	if !strings.HasPrefix(auth, Scheme+" ") {
+		t.Fatalf("Authorization = %q, want %s scheme", auth, Scheme)
+	}
+	if strings.Contains(auth, testSecret) {
+		t.Fatal("Authorization carries the shared secret")
+	}
+}
+
+func TestVerifyAcceptsSignedRequests(t *testing.T) {
+	for _, tc := range []struct {
+		name, method, target string
+		body                 []byte
+	}{
+		{"get", http.MethodGet, "http://node.test/transcode/abc/segment/3.m4s", nil},
+		{"query", http.MethodGet, "http://node.test/transcode/abc/master.m3u8?source_timeline=1&x=a%20b", nil},
+		{"escaped path", http.MethodDelete, "http://node.test/downloads/artifacts/a%2Fb", nil},
+		{"root", http.MethodGet, "http://node.test", nil},
+		{"body", http.MethodPost, "http://node.test/transcode/start", []byte(`{"session_id":"abc"}`)},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			r := signedServerRequest(t, tc.method, tc.target, tc.body, testNow)
+			if err := verify(r, testSecret, testNow); err != nil {
+				t.Fatalf("verify: %v", err)
+			}
+			got, err := io.ReadAll(r.Body)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !bytes.Equal(got, tc.body) {
+				t.Fatalf("handler body = %q, want %q", got, tc.body)
+			}
+		})
+	}
+}
+
+func TestVerifyRejectsAlteredRequests(t *testing.T) {
+	body := []byte(`{"session_id":"abc"}`)
+	for _, tc := range []struct {
+		name  string
+		alter func(r *http.Request)
+	}{
+		{"method", func(r *http.Request) { r.Method = http.MethodPut }},
+		{"path", func(r *http.Request) { r.URL.Path = "/transcode/other" }},
+		{"query", func(r *http.Request) { r.URL.RawQuery = "x=1" }},
+		{"body", func(r *http.Request) { r.Body = io.NopCloser(strings.NewReader(`{"session_id":"xyz"}`)) }},
+		{"signature", func(r *http.Request) {
+			r.Header.Set("Authorization", strings.Replace(r.Header.Get("Authorization"), "sig=", "sig=00", 1))
+		}},
+		{"timestamp", func(r *http.Request) {
+			r.Header.Set("Authorization", strings.Replace(r.Header.Get("Authorization"), "t=1760000000", "t=1760000001", 1))
+		}},
+		{"claimed body hash", func(r *http.Request) {
+			// A correct hash of a different body, with the original signature.
+			other := sha256.Sum256([]byte(`{"session_id":"xyz"}`))
+			auth := r.Header.Get("Authorization")
+			start := strings.Index(auth, "b=") + len("b=")
+			r.Header.Set("Authorization", auth[:start]+hex.EncodeToString(other[:])+auth[start+64:])
+			r.Body = io.NopCloser(strings.NewReader(`{"session_id":"xyz"}`))
+		}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			r := signedServerRequest(t, http.MethodPost, "http://node.test/transcode/start", body, testNow)
+			tc.alter(r)
+			if err := verify(r, testSecret, testNow); !errors.Is(err, ErrUnauthorized) {
+				t.Fatalf("verify = %v, want ErrUnauthorized", err)
+			}
+		})
+	}
+}
+
+func TestVerifyEnforcesTheValidityWindow(t *testing.T) {
+	for _, tc := range []struct {
+		name   string
+		offset time.Duration
+		ok     bool
+	}{
+		{"within past", -maxSkew, true},
+		{"within future", maxSkew, true},
+		{"too old", -maxSkew - time.Second, false},
+		{"too far ahead", maxSkew + time.Second, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			r := signedServerRequest(t, http.MethodGet, "http://node.test/status", nil, testNow.Add(tc.offset))
+			err := verify(r, testSecret, testNow)
+			if tc.ok && err != nil {
+				t.Fatalf("verify: %v", err)
+			}
+			if !tc.ok && !errors.Is(err, ErrUnauthorized) {
+				t.Fatalf("verify = %v, want ErrUnauthorized", err)
+			}
+		})
+	}
+}
+
+func TestVerifyRejectsAnotherSecret(t *testing.T) {
+	r := signedServerRequest(t, http.MethodGet, "http://node.test/status", nil, testNow)
+	if err := verify(r, "a-different-secret", testNow); !errors.Is(err, ErrUnauthorized) {
+		t.Fatalf("verify = %v, want ErrUnauthorized", err)
+	}
+}
+
+func TestVerifyRejectsOversizedBodies(t *testing.T) {
+	body := bytes.Repeat([]byte("x"), maxBodyBytes+1)
+	r := signedServerRequest(t, http.MethodPost, "http://node.test/transcode/start", body, testNow)
+	if err := verify(r, testSecret, testNow); !errors.Is(err, ErrUnauthorized) {
+		t.Fatalf("verify = %v, want ErrUnauthorized", err)
+	}
+}
+
+// A caller without the secret must not be able to make the worker read, let
+// alone buffer, a request body.
+func TestVerifyChecksTheSignatureBeforeReadingTheBody(t *testing.T) {
+	body := &countingReader{}
+	r := httptest.NewRequest(http.MethodPost, "/admin/reload-config", body)
+	r.Header.Set("Authorization", Scheme+" t=1760000000,b="+hex.EncodeToString(emptyBodyHash[:])+",sig="+strings.Repeat("00", 32))
+	if err := verify(r, testSecret, testNow); !errors.Is(err, ErrUnauthorized) {
+		t.Fatalf("verify = %v, want ErrUnauthorized", err)
+	}
+	if body.read != 0 {
+		t.Fatalf("read %d body bytes before the signature was checked", body.read)
+	}
+}
+
+type countingReader struct{ read int }
+
+func (c *countingReader) Read(p []byte) (int, error) {
+	n := min(len(p), 1<<10)
+	c.read += n
+	return n, nil
+}
+
+func TestVerifyRequiresACredential(t *testing.T) {
+	for _, auth := range []string{
+		"",
+		"Bearer",
+		"Bearer ",
+		"Bearer wrong",
+		Scheme,
+		Scheme + " t=1760000000",
+		Scheme + " sig=00",
+		Scheme + " t=1760000000,sig=" + strings.Repeat("00", 32),
+		Scheme + " t=now,b=" + hex.EncodeToString(emptyBodyHash[:]) + ",sig=" + strings.Repeat("00", 32),
+		Scheme + " t=1760000000,b=" + hex.EncodeToString(emptyBodyHash[:]) + ",sig=zz",
+		Scheme + " t=1760000000,b=00,sig=" + strings.Repeat("00", 32),
+		"Basic " + testSecret,
+	} {
+		r := httptest.NewRequest(http.MethodGet, "/status", nil)
+		if auth != "" {
+			r.Header.Set("Authorization", auth)
+		}
+		if err := verify(r, testSecret, testNow); !errors.Is(err, ErrUnauthorized) {
+			t.Errorf("Authorization %q: verify = %v, want ErrUnauthorized", auth, err)
+		}
+	}
+}
+
+func TestNoSecretSignsAndVerifiesNothing(t *testing.T) {
+	req := httptest.NewRequest(http.MethodGet, "/status", nil)
+	if err := Sign(req, "http://node.test", ""); err != nil || req.Header.Get("Authorization") != "" {
+		t.Fatalf("Sign = %v with Authorization %q, want an unsigned request", err, req.Header.Get("Authorization"))
+	}
+	req.Header.Set("Authorization", "Bearer ")
+	if err := Verify(req, ""); !errors.Is(err, ErrNoSecret) {
+		t.Fatalf("Verify = %v, want ErrNoSecret", err)
+	}
+}
+
+// The legacy bearer keeps older API servers and proxies working during a
+// rolling upgrade. Remove with the legacy bearer in Verify.
+func TestVerifyAcceptsTheLegacyBearerForOneRelease(t *testing.T) {
+	r := httptest.NewRequest(http.MethodGet, "/status", nil)
+	r.Header.Set("Authorization", "Bearer "+testSecret)
+	if err := verify(r, testSecret, testNow); err != nil {
+		t.Fatalf("verify: %v", err)
+	}
+}
+
+// The MAC key must not be the shared secret itself, or a signature would be
+// an HMAC under the key that also signs login and stream tokens.
+func TestMACKeyIsDerivedFromTheSecret(t *testing.T) {
+	got, err := requestMAC(testSecret, "1760000000", http.MethodGet, "/status", "", hex.EncodeToString(emptyBodyHash[:]))
+	if err != nil {
+		t.Fatal(err)
+	}
+	direct := hmac.New(sha256.New, []byte(testSecret))
+	_, _ = io.WriteString(direct, strings.Join([]string{canonicalVersion, "1760000000", http.MethodGet, "/status", "", "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"}, "\n"))
+	if hmac.Equal(got, direct.Sum(nil)) {
+		t.Fatal("MAC uses the shared secret directly")
+	}
+}
+
+func TestSignKeepsUnrewindableBodiesReadable(t *testing.T) {
+	body := `{"artifact_id":"a"}`
+	req, err := http.NewRequest(http.MethodPost, "http://node.test/downloads/prepare", io.NopCloser(strings.NewReader(body)))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if req.GetBody != nil {
+		t.Fatal("test needs a body without GetBody")
+	}
+	if err := sign(req, "http://node.test", testSecret, testNow); err != nil {
+		t.Fatal(err)
+	}
+	got, err := io.ReadAll(req.Body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(got) != body || req.ContentLength != int64(len(body)) {
+		t.Fatalf("body = %q (length %d), want %q", got, req.ContentLength, body)
+	}
+}
+
+// TestSignedRequestRoundTrip sends a signed request over a real connection, so
+// the path, query, and body are the bytes a server actually receives.
+func TestSignedRequestRoundTrip(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if err := Verify(r, testSecret); err != nil {
+			http.Error(w, "unauthorized", http.StatusUnauthorized)
+			return
+		}
+		body, _ := io.ReadAll(r.Body)
+		_, _ = w.Write(body)
+	}))
+	defer server.Close()
+
+	req, err := http.NewRequestWithContext(t.Context(), http.MethodPost, server.URL+"/transcode/a%20b/segment/1.ts/downloaded?generation=x%2By", strings.NewReader("payload"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := Sign(req, server.URL, testSecret); err != nil {
+		t.Fatal(err)
+	}
+	resp, err := server.Client().Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	got, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode != http.StatusOK || string(got) != "payload" {
+		t.Fatalf("status %d body %q, want 200 payload", resp.StatusCode, got)
+	}
+}
+
+func TestLogThrottleCountsSuppressedWarnings(t *testing.T) {
+	var throttle logThrottle
+	start := time.Hour
+	if suppressed, ok := throttle.allowAt(start); !ok || suppressed != 0 {
+		t.Fatalf("first warning: allow = %d, %v; want 0, true", suppressed, ok)
+	}
+	for range 3 {
+		if _, ok := throttle.allowAt(start + time.Minute); ok {
+			t.Fatal("a warning inside the interval was allowed")
+		}
+	}
+	// A concurrent caller that sampled the time before the last warning was
+	// recorded is inside the interval too, and must not move it backwards.
+	if _, ok := throttle.allowAt(start - time.Millisecond); ok {
+		t.Fatal("an out-of-order earlier sample was allowed")
+	}
+	if suppressed, ok := throttle.allowAt(start + logInterval); !ok || suppressed != 4 {
+		t.Fatalf("after the interval: allow = %d, %v; want 4, true", suppressed, ok)
+	}
+}
+
+// A worker registered under a path prefix that its reverse proxy strips
+// serves, and verifies, the path without the prefix.
+func TestSignedPathIsRelativeToTheNodeURL(t *testing.T) {
+	for _, tc := range []struct {
+		name, nodeURL, target, workerSees string
+	}{
+		{"no prefix", "http://gateway.test", "http://gateway.test/transcode/abc/master.m3u8?x=1", "/transcode/abc/master.m3u8?x=1"},
+		{"prefix", "http://gateway.test/node1", "http://gateway.test/node1/transcode/abc/master.m3u8?x=1", "/transcode/abc/master.m3u8?x=1"},
+		{"prefix with trailing slash", "http://gateway.test/node1/", "http://gateway.test/node1/status", "/status"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			client, err := http.NewRequest(http.MethodGet, tc.target, nil)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if err := sign(client, tc.nodeURL, testSecret, testNow); err != nil {
+				t.Fatal(err)
+			}
+			worker := httptest.NewRequest(http.MethodGet, tc.workerSees, nil)
+			worker.Header.Set("Authorization", client.Header.Get("Authorization"))
+			if err := verify(worker, testSecret, testNow); err != nil {
+				t.Fatalf("verify: %v", err)
+			}
+		})
+	}
+	// The prefix is not a wildcard: a different route still fails.
+	client, err := http.NewRequest(http.MethodGet, "http://gateway.test/node1/status", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := sign(client, "http://gateway.test/node1", testSecret, testNow); err != nil {
+		t.Fatal(err)
+	}
+	worker := httptest.NewRequest(http.MethodGet, "/hw-capabilities", nil)
+	worker.Header.Set("Authorization", client.Header.Get("Authorization"))
+	if err := verify(worker, testSecret, testNow); !errors.Is(err, ErrUnauthorized) {
+		t.Fatalf("verify = %v, want ErrUnauthorized", err)
+	}
+}
+
+// A worker behind a reverse proxy that strips the path prefix of its
+// registered URL still verifies the request, over a real connection.
+func TestSignedRequestThroughAPrefixStrippingProxy(t *testing.T) {
+	worker := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if err := Verify(r, testSecret); err != nil {
+			http.Error(w, "unauthorized", http.StatusUnauthorized)
+			return
+		}
+		_, _ = io.WriteString(w, r.URL.Path)
+	})
+	server := httptest.NewServer(http.StripPrefix("/node1", worker))
+	defer server.Close()
+
+	nodeURL := server.URL + "/node1"
+	req, err := http.NewRequestWithContext(t.Context(), http.MethodPost, nodeURL+"/transcode/start", strings.NewReader(`{"session_id":"abc"}`))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := Sign(req, nodeURL, testSecret); err != nil {
+		t.Fatal(err)
+	}
+	resp, err := server.Client().Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	got, _ := io.ReadAll(resp.Body)
+	if resp.StatusCode != http.StatusOK || string(got) != "/transcode/start" {
+		t.Fatalf("status %d body %q, want 200 /transcode/start", resp.StatusCode, got)
+	}
+}
diff --git a/internal/nodeauth/nodeauthtest/nodeauthtest.go b/internal/nodeauth/nodeauthtest/nodeauthtest.go
new file mode 100644
index 0000000000..d6fb89a82e
--- /dev/null
+++ b/internal/nodeauth/nodeauthtest/nodeauthtest.go
@@ -0,0 +1,27 @@
+// Package nodeauthtest checks worker request signatures in tests.
+package nodeauthtest
+
+import (
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/nodeauth"
+)
+
+// Signed reports whether r carries a valid node signature for secret. Unlike
+// nodeauth.Verify it refuses the legacy bearer, so a sender that goes back to
+// sending the shared secret fails the test. It reads and restores r.Body.
+func Signed(r *http.Request, secret string) bool {
+	return strings.HasPrefix(r.Header.Get("Authorization"), nodeauth.Scheme+" ") &&
+		nodeauth.Verify(r, secret) == nil
+}
+
+// Sign signs a request for a worker handler under test. Set the URL and body
+// first: the signature covers them.
+func Sign(t testing.TB, r *http.Request, secret string) {
+	t.Helper()
+	if err := nodeauth.Sign(r, "", secret); err != nil {
+		t.Fatalf("sign worker request: %v", err)
+	}
+}
diff --git a/internal/nodepool/health.go b/internal/nodepool/health.go
index 71e977579d..487940956f 100644
--- a/internal/nodepool/health.go
+++ b/internal/nodepool/health.go
@@ -377,7 +377,7 @@ func (hc *HealthChecker) hooks() (CapabilityFetcher, func(nodeURL string)) {
 // Start runs health checks in a background goroutine. Stops when ctx is cancelled.
 func (hc *HealthChecker) Start(ctx context.Context) {
 	hc.mu.Lock()
-	hc.ctx = ctx
+	hc.ctx = ctx //nolint:fatcontext // stores the caller's ctx as is; nothing derives from hc.ctx here
 	hc.mu.Unlock()
 	go func() {
 		hc.checkAll(ctx)
diff --git a/internal/nodepool/mark_unreachable_test.go b/internal/nodepool/mark_unreachable_test.go
new file mode 100644
index 0000000000..46aa4c08d0
--- /dev/null
+++ b/internal/nodepool/mark_unreachable_test.go
@@ -0,0 +1,56 @@
+package nodepool
+
+import "testing"
+
+func TestMarkTranscodeNodeUnreachableStopsSelectionUntilHealthRecovers(t *testing.T) {
+	f := newFixture(nil, []*Node{
+		transcodeNode(1, "http://dead:8080/", nil, 0),
+		transcodeNode(2, "http://alive:8080", nil, 5),
+	})
+
+	if !f.planner.MarkTranscodeNodeUnreachable("http://dead:8080") {
+		t.Fatal("marking a healthy node reported no change")
+	}
+	if f.planner.MarkTranscodeNodeUnreachable("http://dead:8080") {
+		t.Fatal("marking an already unhealthy node reported a change")
+	}
+	if f.planner.TranscodeNodeHealthy("http://dead:8080") {
+		t.Fatal("marked node still reported healthy")
+	}
+	// The dead node carries fewer jobs, so only the mark keeps it from winning.
+	plan := f.planner.PlanTranscodeSessionWithLocalEgress("session-1", "", nil)
+	if plan.TranscodeNode == nil || plan.TranscodeNode.ID != 2 {
+		t.Fatalf("selected %+v, want the reachable node", plan.TranscodeNode)
+	}
+
+	// The next health sweep is authoritative: a node that answers again is
+	// selectable again without any other intervention.
+	f.transcodes.ApplyHealth(1, "http://dead:8080/", true, 0, 0, "", nil, nil, f.now)
+	if !f.planner.TranscodeNodeHealthy("http://dead:8080") {
+		t.Fatal("a healthy sweep result did not clear the mark")
+	}
+	if f.planner.MarkTranscodeNodeUnreachable("http://unknown:8080") {
+		t.Fatal("marking an unpooled node reported a change")
+	}
+}
+
+// A move that lost its session to a replan releases only its own
+// reservation: the replan's reservation, stored under the same session id,
+// stands even when it charges the same node.
+func TestReleaseReservationKeepsANewerReservationOnTheSameNode(t *testing.T) {
+	f := newFixture(nil, []*Node{transcodeNode(1, "http://only:8080", nil, 0)})
+	move := f.planner.PlanTranscodeSessionWithLocalEgress("session-1", "", nil)
+	replan := f.planner.PlanTranscodeSessionWithLocalEgress("session-1", "", nil)
+	if move.TranscodeNode == nil || replan.TranscodeNode == nil || move.TranscodeNode.ID != replan.TranscodeNode.ID {
+		t.Fatalf("selections %+v and %+v, want the same node twice", move.TranscodeNode, replan.TranscodeNode)
+	}
+	f.planner.ReleaseReservation("session-1", move.Reservation)
+	if f.planner.reserved["session-1"] != replan.Reservation.held {
+		t.Fatal("releasing the replaced reservation dropped the replan's")
+	}
+	f.planner.ReleaseReservation("session-1", replan.Reservation)
+	if _, ok := f.planner.reserved["session-1"]; ok {
+		t.Fatal("releasing the current reservation kept it")
+	}
+	f.planner.ReleaseReservation("session-1", Reservation{})
+}
diff --git a/internal/nodepool/planner.go b/internal/nodepool/planner.go
index a60280cf9c..f5780107d1 100644
--- a/internal/nodepool/planner.go
+++ b/internal/nodepool/planner.go
@@ -14,6 +14,16 @@ import (
 type Plan struct {
 	TranscodeNode *Node
 	ProxyNode     *Node
+	// Reservation is the capacity reservation this selection made, if any.
+	Reservation Reservation
+}
+
+// Reservation identifies one reservation a selection made. A later selection
+// for the same session replaces the stored reservation with a new one, so a
+// caller that gives back what it reserved releases only its own, even when the
+// newer reservation charges the same node. The zero value identifies none.
+type Reservation struct {
+	held *reservation
 }
 
 // RouteRequest describes the exact node topology a higher-level routing
@@ -27,6 +37,11 @@ type RouteRequest struct {
 	NeedsProxy           bool
 	TranscodeEligible    func(*Node) bool
 	ProxyEligible        func(*Node) bool
+	// Unreachable holds the URLs of nodes the caller found not answering
+	// during this request. They count as unhealthy, so they are never selected
+	// and they degrade their co-location group just as a failed health check
+	// would, without waiting for the next sweep.
+	Unreachable map[string]struct{}
 }
 
 // RoutePlanner selects and provisionally reserves exactly the nodes requested
@@ -317,6 +332,7 @@ func (p *Planner) PlanSessionWith(sessionID, currentTranscodeURL string, needsTr
 			res.kbps = estBitrateKbps
 		}
 		p.reserved[sessionID] = res
+		plan.Reservation = Reservation{held: res}
 	}
 	return plan
 }
@@ -352,6 +368,21 @@ func (p *Planner) PlanRoute(request RouteRequest) Plan {
 	// eligibility restricts what may be selected, not co-location semantics.
 	// Shared-GPU load is summed over the same full pool, for the same reason.
 	groupHealthy := groupHealth(proxies, pooledTranscodes)
+	if len(request.Unreachable) > 0 {
+		for _, nodes := range [][]*Node{proxies, pooledTranscodes} {
+			for _, n := range nodes {
+				if _, down := request.Unreachable[n.URL]; down && n.Group != nil {
+					groupHealthy[*n.Group] = false
+				}
+			}
+		}
+		reachable := func(n *Node) bool {
+			_, down := request.Unreachable[n.URL]
+			return !down
+		}
+		proxies = filterNodes(proxies, reachable)
+		transcodes = filterNodes(transcodes, reachable)
+	}
 
 	var plan Plan
 	if request.TranscodeEligible != nil {
@@ -388,6 +419,7 @@ func (p *Planner) PlanRoute(request RouteRequest) Plan {
 			res.kbps = request.EstimatedBitrateKbps
 		}
 		p.reserved[request.SessionID] = res
+		plan.Reservation = Reservation{held: res}
 	}
 	return plan
 }
@@ -466,6 +498,21 @@ func (p *Planner) ReleaseSession(sessionID string) {
 	p.mu.Unlock()
 }
 
+// ReleaseReservation removes a session's reservation only while it is still
+// the one held identifies. A caller that reserved a node and then lost the
+// session to a concurrent replan uses it: the replan's selection replaced the
+// reservation under the same session id, and that one must stand.
+func (p *Planner) ReleaseReservation(sessionID string, held Reservation) {
+	if p == nil || held.held == nil {
+		return
+	}
+	p.mu.Lock()
+	defer p.mu.Unlock()
+	if p.reserved[sessionID] == held.held {
+		delete(p.reserved, sessionID)
+	}
+}
+
 // ReleaseSessionProxy drops only the proxy half of a session's reservation,
 // leaving its transcode node charged. A start that selected both nodes but ends
 // up publishing a URL the proxy does not serve (its egress grant could not be
diff --git a/internal/nodepool/planner_test.go b/internal/nodepool/planner_test.go
index a7c34719b9..8ffc49f0d2 100644
--- a/internal/nodepool/planner_test.go
+++ b/internal/nodepool/planner_test.go
@@ -1103,3 +1103,53 @@ func TestClientURLPrefersThePublicURL(t *testing.T) {
 		}
 	}
 }
+
+// A node the caller found unreachable counts as unhealthy for the request: it
+// is not selected and it degrades its group, so a group whose only proxy died
+// moves the route to another group instead of crossing LANs.
+func TestPlanRouteUnreachableNodeDegradesItsGroup(t *testing.T) {
+	deadProxyA := map[string]struct{}{"http://proxy-a": {}}
+	f := newFixture(
+		[]*Node{proxyNode(1, "http://proxy-a", strPtr("rack-a")), proxyNode(2, "http://proxy-b", strPtr("rack-b"))},
+		[]*Node{
+			transcodeNode(3, "http://tc-a", strPtr("rack-a"), 0),
+			transcodeNode(4, "http://tc-b", strPtr("rack-b"), 0),
+		},
+	)
+	plan := f.planner.PlanRoute(RouteRequest{
+		SessionID: "s1", CurrentTranscodeURL: "http://tc-a",
+		NeedsTranscode: true, NeedsProxy: true, Unreachable: deadProxyA,
+	})
+	if plan.TranscodeNode == nil || plan.TranscodeNode.URL != "http://tc-b" ||
+		plan.ProxyNode == nil || plan.ProxyNode.URL != "http://proxy-b" {
+		t.Fatalf("plan = %+v / %+v, want rack-b's tc-b and proxy-b", plan.TranscodeNode, plan.ProxyNode)
+	}
+
+	// With only rack-a and an ungrouped proxy, tc-a is never paired with the
+	// ungrouped proxy while its own group's proxy is down.
+	g := newFixture(
+		[]*Node{proxyNode(1, "http://proxy-a", strPtr("rack-a")), proxyNode(2, "http://proxy-1", nil)},
+		[]*Node{transcodeNode(3, "http://tc-a", strPtr("rack-a"), 0)},
+	)
+	plan = g.planner.PlanRoute(RouteRequest{
+		SessionID: "s2", CurrentTranscodeURL: "http://tc-a",
+		NeedsTranscode: true, NeedsProxy: true, Unreachable: deadProxyA,
+	})
+	if plan.TranscodeNode != nil || plan.ProxyNode != nil {
+		t.Fatalf("plan = %+v / %+v, want no proxy route for rack-a without its proxy", plan.TranscodeNode, plan.ProxyNode)
+	}
+
+	// An unreachable transcode node degrades its group on the API-egress route too.
+	h := newFixture(nil, []*Node{
+		transcodeNode(3, "http://tc-a1", strPtr("rack-a"), 0),
+		transcodeNode(4, "http://tc-a2", strPtr("rack-a"), 0),
+		transcodeNode(5, "http://tc-1", nil, 3),
+	})
+	plan = h.planner.PlanRoute(RouteRequest{
+		SessionID: "s3", CurrentTranscodeURL: "http://tc-a1",
+		NeedsTranscode: true, Unreachable: map[string]struct{}{"http://tc-a1": {}},
+	})
+	if plan.TranscodeNode == nil || plan.TranscodeNode.URL != "http://tc-1" {
+		t.Fatalf("plan = %+v, want ungrouped tc-1 while rack-a is degraded", plan.TranscodeNode)
+	}
+}
diff --git a/internal/nodepool/unreachable_test.go b/internal/nodepool/unreachable_test.go
index 43e70624c6..7d566265b3 100644
--- a/internal/nodepool/unreachable_test.go
+++ b/internal/nodepool/unreachable_test.go
@@ -217,7 +217,7 @@ func TestRecheckStopsWithTheCheckerContext(t *testing.T) {
 	f.checker.recheckInterval = time.Hour
 	ctx, cancel := context.WithCancel(context.Background())
 	f.checker.mu.Lock()
-	f.checker.ctx = ctx
+	f.checker.ctx = ctx //nolint:fatcontext // installs the test's ctx once, as Start would
 	f.checker.mu.Unlock()
 
 	f.planner.MarkTranscodeNodeUnreachable(nodeURL)
diff --git a/internal/noderecipe/store.go b/internal/noderecipe/store.go
index f3aae3c4d9..3b3dce58e8 100644
--- a/internal/noderecipe/store.go
+++ b/internal/noderecipe/store.go
@@ -26,9 +26,16 @@
 // authorized_media_origins_v1 the plan hands the client a credential-free proxy
 // URL, so the proxy has no token to serve from — central writes the session's
 // recipe here at plan time and the proxy reads it after authenticating the
-// caller's own login session. NewStore and NewProxyGrantStore are the two key
-// spaces. Proxy grants deliberately do not participate in the transcode-node
-// authority generation.
+// caller's own login session. Proxy grants deliberately do not participate in
+// the transcode-node authority generation.
+//
+// A third key space keeps the API's own recovery copy: a session recipe. A
+// header-authenticated session's URLs carry no token, so the API process that
+// started it is the only holder of its recipe, and a restart (or another API
+// replica) would find nothing to rebuild the playback session from. Central
+// writes the committed card under the playback session id and reads it back on
+// a miss, for the session's authenticated owner only. NewStore,
+// NewProxyGrantStore and NewSessionRecipeStore are the three key spaces.
 package noderecipe
 
 import (
@@ -56,6 +63,13 @@ const KeyPrefix = "prairie:noderecipe:"
 // node roles, and a lookup in one must never resolve the other's entry.
 const ProxyGrantKeyPrefix = "silo:proxygrant:"
 
+// SessionRecipeKeyPrefix namespaces the API's own recovery copy of a
+// header-authenticated session's recipe: prairie:sessionrecipe:<playbackSessionID>.
+// Separate from both other key spaces: a node recipe is keyed by transport id
+// for a node to rebuild ffmpeg, a proxy grant authorizes a proxy to serve, and
+// this one only lets the API rebuild its playback session.
+const SessionRecipeKeyPrefix = "prairie:sessionrecipe:"
+
 // nodeAuthorityGenerationKeyPrefix namespaces the per-node Redis timestamp
 // generation that force reload advances to revoke every outstanding node
 // recipe, including a progressive-remux URL with no request yet.
@@ -159,8 +173,8 @@ return now_ms
 `)
 
 // Store is the Redis-backed recipe store shared by central (writer) and the
-// nodes (readers). One instance owns exactly one key prefix; see NewStore and
-// NewProxyGrantStore for the two uses.
+// nodes (readers). One instance owns exactly one key prefix; see NewStore,
+// NewProxyGrantStore and NewSessionRecipeStore for the three uses.
 type Store struct {
 	rdb    *redis.Client
 	prefix string
@@ -181,6 +195,13 @@ func NewProxyGrantStore(rdb *redis.Client, ttl time.Duration) *Store {
 	return newStore(rdb, ProxyGrantKeyPrefix, ttl)
 }
 
+// NewSessionRecipeStore wraps a Redis client for the session-recipe key space:
+// the card the API rebuilds a header-authenticated playback session from after
+// a restart. Same nil-safety and TTL as NewStore.
+func NewSessionRecipeStore(rdb *redis.Client, ttl time.Duration) *Store {
+	return newStore(rdb, SessionRecipeKeyPrefix, ttl)
+}
+
 func newStore(rdb *redis.Client, prefix string, ttl time.Duration) *Store {
 	if ttl <= 0 {
 		ttl = DefaultTTL
@@ -266,43 +287,53 @@ func (s *Store) PutTTL(ctx context.Context, sessionID string, card playback.Reci
 // error yields (nil, false) — because an absent recipe legitimately means the
 // node cannot reconstruct and should 404, never rebuild from a bad recipe.
 func (s *Store) Get(ctx context.Context, sessionID string) (*playback.RecipeCard, bool) {
+	card, ok, _ := s.Lookup(ctx, sessionID)
+	return card, ok
+}
+
+// Lookup is Get with the read failure kept. A genuine miss, a card that no
+// longer decodes, and one whose node authority was revoked are all (nil, false,
+// nil); an error means Redis could not be read, which a caller that must not
+// mistake an outage for a missing session can answer as retryable.
+func (s *Store) Lookup(ctx context.Context, sessionID string) (*playback.RecipeCard, bool, error) {
 	if s == nil || s.rdb == nil || sessionID == "" {
-		return nil, false
+		return nil, false, nil
 	}
 	data, generation, stamped, err := s.loadStoredCard(ctx, sessionID)
 	if err != nil {
-		if !errors.Is(err, redis.Nil) {
-			slog.WarnContext(ctx, "load node recipe failed", "component", "noderecipe", "key_prefix", s.prefix, "error", err, "playback_session_id", sessionID)
+		if errors.Is(err, redis.Nil) {
+			return nil, false, nil
 		}
-		return nil, false
+		slog.WarnContext(ctx, "load node recipe failed", "component", "noderecipe", "key_prefix", s.prefix, "error", err, "playback_session_id", sessionID)
+		return nil, false, err
 	}
 	card, ok := unmarshalCard(data)
 	if !ok {
 		slog.WarnContext(ctx, "decode node recipe failed", "component", "noderecipe", "key_prefix", s.prefix, "playback_session_id", sessionID)
-		return nil, false
+		return nil, false, nil
 	}
 	if authorityKey := nodeAuthorityGenerationKeyForCard(card); s.prefix == KeyPrefix && authorityKey != "" {
 		if stamped {
 			currentGeneration, generationErr := s.currentNodeAuthorityGeneration(ctx, authorityKey)
 			if generationErr != nil {
 				slog.WarnContext(ctx, "load node authority generation failed", "component", "noderecipe", "error", generationErr, "playback_session_id", sessionID)
-				return nil, false
+				return nil, false, generationErr
 			}
 			if generation != currentGeneration {
-				return nil, false
+				return nil, false, nil
 			}
 		} else {
 			valid, validationErr := s.legacyRecipeIssuedAfterRevocation(ctx, sessionID, data, authorityKey)
 			if validationErr != nil {
 				slog.WarnContext(ctx, "validate legacy node recipe authority failed", "component", "noderecipe", "error", validationErr, "playback_session_id", sessionID)
-				return nil, false
+				return nil, false, validationErr
 			}
 			if !valid {
-				return nil, false
+				return nil, false, nil
 			}
 		}
 	}
-	return &card, true
+	return &card, true, nil
 }
 
 func (s *Store) loadStoredCard(ctx context.Context, sessionID string) ([]byte, int64, bool, error) {
diff --git a/internal/noderecipe/store_test.go b/internal/noderecipe/store_test.go
index 05e87f6899..d0f10efdf8 100644
--- a/internal/noderecipe/store_test.go
+++ b/internal/noderecipe/store_test.go
@@ -124,6 +124,29 @@ func TestProxyGrantStoreIsolatesItsKeySpace(t *testing.T) {
 	if grants.ttl != DefaultTTL {
 		t.Fatalf("proxy grant ttl = %v, want %v", grants.ttl, DefaultTTL)
 	}
+	sessions := NewSessionRecipeStore(nil, 0)
+	if got := sessions.key("abc"); got != "prairie:sessionrecipe:abc" {
+		t.Fatalf("session recipe key(abc) = %q, want prairie:sessionrecipe:abc", got)
+	}
+	if sessions.key("abc") == grants.key("abc") || sessions.key("abc") == NewStore(nil, 0).key("abc") {
+		t.Fatal("session recipes share a key with another key space")
+	}
+}
+
+// The session-recipe reader must tell a Redis outage from a missing session:
+// answering an outage as "gone" makes a client tear its playback down. Get
+// keeps failing closed for the node and proxy readers.
+func TestLookupReportsAnUnreachableRedis(t *testing.T) {
+	client := redis.NewClient(&redis.Options{Addr: "127.0.0.1:1", DialTimeout: 200 * time.Millisecond, MaxRetries: -1})
+	t.Cleanup(func() { _ = client.Close() })
+	store := NewSessionRecipeStore(client, time.Minute)
+
+	if card, ok, err := store.Lookup(context.Background(), "sid"); err == nil || ok || card != nil {
+		t.Fatalf("Lookup against unreachable Redis = (%v, %v, %v), want an error", card, ok, err)
+	}
+	if card, ok := store.Get(context.Background(), "sid"); ok || card != nil {
+		t.Fatalf("Get against unreachable Redis = (%v, %v), want a miss", card, ok)
+	}
 }
 
 // A disabled store accepts writes it cannot serve, so callers that publish a
diff --git a/internal/noderouting/resolver.go b/internal/noderouting/resolver.go
index 7071f246b6..dd92aa6959 100644
--- a/internal/noderouting/resolver.go
+++ b/internal/noderouting/resolver.go
@@ -119,6 +119,9 @@ type ResolveRequest struct {
 	ProxyEligible          func(*nodepool.Node) bool
 	ProxyExecutionEligible func(*nodepool.Node) bool
 	ExcludedShapeIDs       map[string]struct{}
+	// UnreachableNodes are node URLs the caller found not answering; see
+	// nodepool.RouteRequest.Unreachable.
+	UnreachableNodes map[string]struct{}
 }
 
 type Outcome string
@@ -182,6 +185,7 @@ func Resolve(planner nodepool.RoutePlanner, request ResolveRequest) (Decision, e
 			NeedsProxy:           shape.NeedsProxyNode(),
 			TranscodeEligible:    request.TranscodeEligible,
 			ProxyEligible:        proxyEligible,
+			Unreachable:          request.UnreachableNodes,
 		})
 		if shape.NeedsTranscodeNode() != (plan.TranscodeNode != nil) ||
 			shape.NeedsProxyNode() != (plan.ProxyNode != nil) {
diff --git a/internal/notifications/account_scope_db_test.go b/internal/notifications/account_scope_db_test.go
new file mode 100644
index 0000000000..1dea7b1778
--- /dev/null
+++ b/internal/notifications/account_scope_db_test.go
@@ -0,0 +1,203 @@
+package notifications
+
+import (
+	"fmt"
+	"slices"
+	"testing"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// TestSameProfileIDOnTwoAccounts covers two accounts that each have a profile
+// named "default", as every account from before profiles does, following the
+// same series in the same library. Each keeps its own interest row and
+// switches, gets its own delivery and sees only its own inbox, and one
+// account's recompute or profile deletion leaves the other's state alone.
+func TestSameProfileIDOnTwoAccounts(t *testing.T) {
+	pool := inboxPageDB(t)
+	ctx := t.Context()
+	c := seedAccessCatalog(t, pool)
+	seedFanoutEvent(t, pool, c, nil)
+	interests := NewInterestRepository(pool)
+	preferences := NewPreferencesRepository(pool)
+	deliveries := NewDeliveryRepository(pool)
+	s := &System{Interests: interests, Preferences: preferences, Deliveries: deliveries}
+
+	// Account 2 writes second, with different flags; before rows were keyed by
+	// account, its write took over account 1's row.
+	for _, row := range []SeriesInterest{
+		{UserID: 1, ProfileID: "default", LibraryID: c.library, SeriesID: c.series, Favorite: true},
+		{UserID: 2, ProfileID: "default", LibraryID: c.library, SeriesID: c.series, Favorite: true, Watchlist: true},
+	} {
+		if err := interests.UpsertRows(ctx, []SeriesInterest{row}); err != nil {
+			t.Fatalf("UpsertRows account %d: %v", row.UserID, err)
+		}
+	}
+	if got := interestOwners(t, pool); !slices.Equal(got, []string{"1/default", "2/default"}) {
+		t.Fatalf("interest rows = %v, want one per account", got)
+	}
+	for _, userID := range []int{1, 2} {
+		series, err := interests.ListSeriesForProfile(ctx, userID, "default")
+		if err != nil || !slices.Equal(series, []string{c.series}) {
+			t.Fatalf("ListSeriesForProfile(%d) = %v, %v", userID, series, err)
+		}
+	}
+
+	worker := newAccessFanoutWorker(pool, scopeByProfile{"default": {}})
+	for range 2 { // the second pass finds the event processed and adds nothing
+		if _, err := worker.processBatch(ctx); err != nil {
+			t.Fatalf("processBatch: %v", err)
+		}
+	}
+	if got := accountRecipients(t, pool, "event-1"); !slices.Equal(got, []string{"1/default", "2/default"}) {
+		t.Fatalf("event-1 recipients = %v, want both accounts' default profiles", got)
+	}
+	var cursors int
+	if err := pool.QueryRow(ctx, `
+		SELECT count(*) FROM profile_series_interest WHERE last_notified_episode_key IS NOT NULL`,
+	).Scan(&cursors); err != nil || cursors != 2 {
+		t.Fatalf("notified cursors moved on %d rows (%v), want both", cursors, err)
+	}
+
+	checkInboxPerAccount(t, deliveries)
+	checkSwitchesPerAccount(t, pool, c, worker, preferences)
+
+	// Account 1's recompute drops its rows; account 2's stay.
+	if err := interests.DeleteStaleForProfileSeries(ctx, 1, "default", c.series, []int{}); err != nil {
+		t.Fatalf("DeleteStaleForProfileSeries: %v", err)
+	}
+	if got := interestOwners(t, pool); !slices.Equal(got, []string{"2/default"}) {
+		t.Fatalf("interest rows after account 1's recompute = %v, want account 2's", got)
+	}
+
+	// Deleting account 2's profile leaves account 1's deliveries and
+	// switches alone.
+	if err := s.PurgeProfile(ctx, 2, "default"); err != nil {
+		t.Fatalf("PurgeProfile: %v", err)
+	}
+	if got := interestOwners(t, pool); len(got) != 0 {
+		t.Fatalf("interest rows after purge = %v, want none", got)
+	}
+	if got := accountRecipients(t, pool, "event-1"); !slices.Equal(got, []string{"1/default"}) {
+		t.Fatalf("event-1 deliveries after purge = %v, want account 1's", got)
+	}
+	if prefs, err := preferences.Get(ctx, 1, "default"); err != nil || prefs.Enabled {
+		t.Fatalf("account 1 preferences after account 2's purge = %+v, %v; want notifications off", prefs, err)
+	}
+}
+
+// TestSameProfileIDFanoutTargets covers channel targets when both accounts'
+// "default" profiles follow the series: each account gets its own delivery,
+// and each delivery queues attempts for its own account's webhook, web push
+// subscription, and Apple push device only.
+func TestSameProfileIDFanoutTargets(t *testing.T) {
+	pool := inboxPageDB(t)
+	ctx := t.Context()
+	c := seedAccessCatalog(t, pool)
+	seedFanoutEvent(t, pool, c, nil)
+	seedTwoAccountTargets(t, pool)
+	if _, err := pool.Exec(ctx, `INSERT INTO profile_series_interest (user_id, profile_id, library_id, series_id, favorite)
+		VALUES (1, 'default', $1, $2, true), (2, 'default', $1, $2, true)`, c.library, c.series); err != nil {
+		t.Fatalf("seed interest: %v", err)
+	}
+
+	worker := newAccessFanoutWorker(pool, scopeByProfile{"default": {}})
+	worker.settings = NewSettings(mapSettingReader{SettingFanoutSettleSeconds: "0", SettingWebhooksEnabled: "true"})
+	worker.SetWebhookOutbox(NewWebhookRepository(pool), newProfileRateLimiter())
+	worker.SetWebPushOutbox(NewWebPushRepository(pool))
+	worker.SetPushOutbox(NewPushDeviceRepository(pool))
+	if _, err := worker.processBatch(ctx); err != nil {
+		t.Fatalf("processBatch: %v", err)
+	}
+	if got := accountRecipients(t, pool, "event-1"); !slices.Equal(got, []string{"1/default", "2/default"}) {
+		t.Fatalf("event-1 recipients = %v, want both accounts' default profiles", got)
+	}
+	for _, account := range []string{"1", "2"} {
+		want := []string{"browser-" + account, "hook-" + account, "phone-" + account}
+		if got := attemptTargets(t, pool, `d.release_event_id = 'event-1' AND d.user_id = `+account); !slices.Equal(got, want) {
+			t.Fatalf("account %s attempts = %v, want %v", account, got, want)
+		}
+	}
+}
+
+// checkInboxPerAccount: each account's "default" profile lists, counts, and
+// reads only its own delivery of event-1.
+func checkInboxPerAccount(t *testing.T, deliveries *DeliveryRepository) {
+	t.Helper()
+	ctx := t.Context()
+	for _, userID := range []int{1, 2} {
+		rows, err := deliveries.ListInbox(ctx, userID, "default", false, 10, nil)
+		if err != nil || len(rows) != 1 || rows[0].UserID != userID {
+			t.Fatalf("ListInbox(%d) = %+v, %v; want only its own delivery", userID, rows, err)
+		}
+	}
+	if marked, err := deliveries.MarkAllRead(ctx, 1, "default"); err != nil || marked != 1 {
+		t.Fatalf("MarkAllRead(1) = %d, %v; want 1", marked, err)
+	}
+	for userID, want := range map[int]int{1: 0, 2: 1} {
+		if count, err := deliveries.UnreadCount(ctx, userID, "default"); err != nil || count != want {
+			t.Fatalf("UnreadCount(%d) = %d, %v; want %d", userID, count, err, want)
+		}
+	}
+}
+
+// checkSwitchesPerAccount: account 1 turns notifications off; account 2's
+// switches are untouched and only account 2 hears about the next episode.
+func checkSwitchesPerAccount(t *testing.T, pool *pgxpool.Pool, c accessCatalog, worker *FanoutWorker, preferences *PreferencesRepository) {
+	t.Helper()
+	ctx := t.Context()
+	if _, err := preferences.Patch(ctx, 1, "default", PreferencePatch{Enabled: new(false)}); err != nil {
+		t.Fatalf("Patch: %v", err)
+	}
+	for userID, want := range map[int]bool{1: false, 2: true} {
+		if prefs, err := preferences.Get(ctx, userID, "default"); err != nil || prefs.Enabled != want {
+			t.Fatalf("Get(%d).Enabled = %v, %v; want %v", userID, prefs.Enabled, err, want)
+		}
+	}
+	seedNextEpisode(t, pool, c, "event-2", 3)
+	if _, err := worker.processBatch(ctx); err != nil {
+		t.Fatalf("processBatch event-2: %v", err)
+	}
+	if got := accountRecipients(t, pool, "event-2"); !slices.Equal(got, []string{"2/default"}) {
+		t.Fatalf("event-2 recipients = %v, want account 2 only", got)
+	}
+}
+
+// interestOwners lists the interest rows as account/profile.
+func interestOwners(t *testing.T, pool *pgxpool.Pool) []string {
+	t.Helper()
+	rows, err := pool.Query(t.Context(), `
+		SELECT user_id::text || '/' || profile_id FROM profile_series_interest ORDER BY 1`)
+	if err != nil {
+		t.Fatalf("query interest: %v", err)
+	}
+	got, err := pgx.CollectRows(rows, pgx.RowTo[string])
+	if err != nil {
+		t.Fatalf("read interest: %v", err)
+	}
+	return got
+}
+
+// seedNextEpisode adds episode 1x<number> of the catalog's series and its
+// release event.
+func seedNextEpisode(t *testing.T, pool *pgxpool.Pool, c accessCatalog, eventID string, number int) {
+	t.Helper()
+	key := EpisodeKey(1, number)
+	episodeID := fmt.Sprintf("%s-e%d", c.series, number)
+	for _, stmt := range []struct {
+		sql  string
+		args []any
+	}{
+		{`INSERT INTO episodes (content_id, series_id, season_id, season_number, episode_number, title)
+			VALUES ($1, $2, $2 || '-s1', 1, $3, 'E')`, []any{episodeID, c.series, number}},
+		{`INSERT INTO release_events (id, library_id, series_id, episode_id, season_number, episode_number,
+			episode_key, available_at, dedupe_key)
+			VALUES ($1, $2, $3, $4, 1, $5, $6, now(), $7)`,
+			[]any{eventID, c.library, c.series, episodeID, number, key, EpisodeDedupeKey(c.library, c.series, key)}},
+	} {
+		if _, err := pool.Exec(t.Context(), stmt.sql, stmt.args...); err != nil {
+			t.Fatalf("seed episode %d: %v", number, err)
+		}
+	}
+}
diff --git a/internal/notifications/android_push_ordering_test.go b/internal/notifications/android_push_ordering_test.go
index fe4092bcdc..e2b4c44220 100644
--- a/internal/notifications/android_push_ordering_test.go
+++ b/internal/notifications/android_push_ordering_test.go
@@ -116,7 +116,7 @@ func TestOrderedAndroidPushFencesBridgeAndBootstrap(t *testing.T) {
 	if _, err := repo.UpsertFCM(ctx, legacy, cipher); !errors.Is(err, ErrPushLegacyWriter) {
 		t.Fatalf("legacy register=%v", err)
 	}
-	if err := repo.DeleteByProfileDevice(ctx, cmd.ProfileID, cmd.DeviceID); !errors.Is(err, ErrPushLegacyWriter) {
+	if err := repo.DeleteByProfileDevice(ctx, cmd.UserID, cmd.ProfileID, cmd.DeviceID); !errors.Is(err, ErrPushLegacyWriter) {
 		t.Fatalf("legacy remove=%v", err)
 	}
 	cmd.Generation = 2
diff --git a/internal/notifications/apple_push_finalization_test.go b/internal/notifications/apple_push_finalization_test.go
index 52cad70f77..7f2208f8a6 100644
--- a/internal/notifications/apple_push_finalization_test.go
+++ b/internal/notifications/apple_push_finalization_test.go
@@ -38,7 +38,7 @@ func TestApplePushFinalizationRollbackAndReplay(t *testing.T) {
 	if err != nil || observed != replay || observed.Enabled {
 		t.Fatal("finalizer lost disabled outcome", err)
 	}
-	if err = repo.DeleteAllForProfile(ctx, cmd.ProfileID); err != nil {
+	if err = repo.DeleteAllForProfile(ctx, cmd.UserID, cmd.ProfileID); err != nil {
 		t.Fatal(err)
 	}
 	_, err = repo.ApplyApplePushAndFinalize(ctx, cmd, cipher, func(r ApplePushReceipt) error { observed = r; return nil })
diff --git a/internal/notifications/apple_push_ordering_test.go b/internal/notifications/apple_push_ordering_test.go
index 04fa395cb1..5860e9e24d 100644
--- a/internal/notifications/apple_push_ordering_test.go
+++ b/internal/notifications/apple_push_ordering_test.go
@@ -56,7 +56,7 @@ func TestOrderedApplePushReplayAndCurrentRow(t *testing.T) {
 	if e != nil || !current.Enabled || current.APNsEnvironment != cmd.APNsEnvironment {
 		t.Fatalf("current=%+v err=%v", current, e)
 	}
-	if err = repo.DeleteAllForProfile(ctx, cmd.ProfileID); err != nil {
+	if err = repo.DeleteAllForProfile(ctx, cmd.UserID, cmd.ProfileID); err != nil {
 		t.Fatal(err)
 	}
 	removed, e := repo.ApplyApplePush(ctx, cmd, cipher)
@@ -98,7 +98,7 @@ func TestOrderedApplePushConflictsAndBridge(t *testing.T) {
 	if _, err := repo.UpsertApple(ctx, appleLegacyCommand(cmd), cipher); !errors.Is(err, ErrPushLegacyWriter) {
 		t.Fatalf("bridge=%v", err)
 	}
-	if err := repo.DeleteByProfileDevice(ctx, cmd.ProfileID, cmd.DeviceID); !errors.Is(err, ErrPushLegacyWriter) {
+	if err := repo.DeleteByProfileDevice(ctx, cmd.UserID, cmd.ProfileID, cmd.DeviceID); !errors.Is(err, ErrPushLegacyWriter) {
 		t.Fatalf("bridge delete=%v", err)
 	}
 	wrong := cmd
diff --git a/internal/notifications/delivery_repo.go b/internal/notifications/delivery_repo.go
index 836fcbd01a..60d8b88481 100644
--- a/internal/notifications/delivery_repo.go
+++ b/internal/notifications/delivery_repo.go
@@ -202,9 +202,9 @@ func (r *DeliveryRepository) LockInboxProfiles(ctx context.Context, tx pgx.Tx, p
 }
 
 // ListInbox returns inbox rows newest-first for the profile.
-func (r *DeliveryRepository) ListInbox(ctx context.Context, profileID string, unreadOnly bool, limit int, before *Cursor) ([]DeliveryRow, error) {
-	conditions := []string{"d.profile_id = $1"}
-	args := []any{profileID}
+func (r *DeliveryRepository) ListInbox(ctx context.Context, userID int, profileID string, unreadOnly bool, limit int, before *Cursor) ([]DeliveryRow, error) {
+	conditions := []string{"d.user_id = $1 AND d.profile_id = $2"}
+	args := []any{userID, profileID}
 	if unreadOnly {
 		conditions = append(conditions, "d.read_at IS NULL")
 	}
@@ -226,14 +226,14 @@ func (r *DeliveryRepository) ListInbox(ctx context.Context, profileID string, un
 // ListSync returns rows ascending from the cursor for forward sync (the
 // mobile wake-fetch endpoint). A nil cursor returns the most recent page
 // (still ascending) so first-time callers get a cursor to persist.
-func (r *DeliveryRepository) ListSync(ctx context.Context, profileID string, since *Cursor, limit int) ([]DeliveryRow, error) {
+func (r *DeliveryRepository) ListSync(ctx context.Context, userID int, profileID string, since *Cursor, limit int) ([]DeliveryRow, error) {
 	if since != nil {
 		rows, err := r.pool.Query(ctx,
 			deliveryRowSelect+`
-			WHERE d.profile_id = $1 AND (d.created_at, d.id) > ($2, $3)
+			WHERE d.user_id = $1 AND d.profile_id = $2 AND (d.created_at, d.id) > ($3, $4)
 			ORDER BY d.created_at ASC, d.id ASC
-			LIMIT $4`,
-			profileID, since.CreatedAt, since.ID, limit)
+			LIMIT $5`,
+			userID, profileID, since.CreatedAt, since.ID, limit)
 		if err != nil {
 			return nil, fmt.Errorf("list sync: %w", err)
 		}
@@ -242,11 +242,11 @@ func (r *DeliveryRepository) ListSync(ctx context.Context, profileID string, sin
 	// No cursor: most recent page, returned in ascending order.
 	rows, err := r.pool.Query(ctx, `
 		SELECT * FROM (`+deliveryRowSelect+`
-			WHERE d.profile_id = $1
+			WHERE d.user_id = $1 AND d.profile_id = $2
 			ORDER BY d.created_at DESC, d.id DESC
-			LIMIT $2
+			LIMIT $3
 		) recent ORDER BY recent.created_at ASC, recent.id ASC`,
-		profileID, limit)
+		userID, profileID, limit)
 	if err != nil {
 		return nil, fmt.Errorf("list sync: %w", err)
 	}
@@ -254,9 +254,9 @@ func (r *DeliveryRepository) ListSync(ctx context.Context, profileID string, sin
 }
 
 // GetByID returns one delivery scoped to the profile; (nil, nil) when absent.
-func (r *DeliveryRepository) GetByID(ctx context.Context, profileID, id string) (*DeliveryRow, error) {
+func (r *DeliveryRepository) GetByID(ctx context.Context, userID int, profileID, id string) (*DeliveryRow, error) {
 	rows, err := r.pool.Query(ctx,
-		deliveryRowSelect+` WHERE d.profile_id = $1 AND d.id = $2`, profileID, id)
+		deliveryRowSelect+` WHERE d.user_id = $1 AND d.profile_id = $2 AND d.id = $3`, userID, profileID, id)
 	if err != nil {
 		return nil, fmt.Errorf("get delivery: %w", err)
 	}
@@ -349,10 +349,10 @@ func (r *DeliveryRepository) HasTransactionalForUserSince(ctx context.Context, u
 // watermark, ascending. A non-zero until excludes rows created at or after it
 // (digest window upper edge). Runs inside the channel worker's claim
 // transaction so the rows read are the rows the advanced watermark covers.
-func (r *DeliveryRepository) ListForProfileSince(ctx context.Context, tx pgx.Tx, profileID string, since Cursor, until time.Time, limit int) ([]DeliveryRow, error) {
+func (r *DeliveryRepository) ListForProfileSince(ctx context.Context, tx pgx.Tx, userID int, profileID string, since Cursor, until time.Time, limit int) ([]DeliveryRow, error) {
 	query := deliveryRowSelect + `
-		WHERE d.profile_id = $1 AND (d.created_at, d.id) > ($2, $3)`
-	args := []any{profileID, since.CreatedAt, since.ID}
+		WHERE d.user_id = $1 AND d.profile_id = $2 AND (d.created_at, d.id) > ($3, $4)`
+	args := []any{userID, profileID, since.CreatedAt, since.ID}
 	if !until.IsZero() {
 		args = append(args, until)
 		query += fmt.Sprintf(" AND d.created_at < $%d", len(args))
@@ -369,14 +369,14 @@ func (r *DeliveryRepository) ListForProfileSince(ctx context.Context, tx pgx.Tx,
 // HasForProfileSince reports whether the profile has any delivery newer than
 // the given watermark. Cheap pre-check (index-only) so account-channel sweeps
 // do not open a claim transaction for idle profiles every pass.
-func (r *DeliveryRepository) HasForProfileSince(ctx context.Context, profileID string, since Cursor) (bool, error) {
+func (r *DeliveryRepository) HasForProfileSince(ctx context.Context, userID int, profileID string, since Cursor) (bool, error) {
 	var exists bool
 	err := r.pool.QueryRow(ctx, `
 		SELECT EXISTS (
 			SELECT 1 FROM notification_deliveries
-			WHERE profile_id = $1 AND (created_at, id) > ($2, $3)
+			WHERE user_id = $1 AND profile_id = $2 AND (created_at, id) > ($3, $4)
 		)`,
-		profileID, since.CreatedAt, since.ID,
+		userID, profileID, since.CreatedAt, since.ID,
 	).Scan(&exists)
 	if err != nil {
 		return false, fmt.Errorf("check profile deliveries since watermark: %w", err)
@@ -387,14 +387,14 @@ func (r *DeliveryRepository) HasForProfileSince(ctx context.Context, profileID s
 // HasTransactionalForProfileSince reports whether the profile has any
 // transactional delivery (digest-bypassing request-status notice; see
 // transactionalDeliveryTypes) newer than the given watermark.
-func (r *DeliveryRepository) HasTransactionalForProfileSince(ctx context.Context, profileID string, since Cursor) (bool, error) {
+func (r *DeliveryRepository) HasTransactionalForProfileSince(ctx context.Context, userID int, profileID string, since Cursor) (bool, error) {
 	var exists bool
 	err := r.pool.QueryRow(ctx, `
 		SELECT EXISTS (
 			SELECT 1 FROM notification_deliveries
-			WHERE profile_id = $1 AND (created_at, id) > ($2, $3) AND type = ANY($4)
+			WHERE user_id = $1 AND profile_id = $2 AND (created_at, id) > ($3, $4) AND type = ANY($5)
 		)`,
-		profileID, since.CreatedAt, since.ID, transactionalDeliveryTypes,
+		userID, profileID, since.CreatedAt, since.ID, transactionalDeliveryTypes,
 	).Scan(&exists)
 	if err != nil {
 		return false, fmt.Errorf("check profile transactional deliveries since watermark: %w", err)
@@ -403,13 +403,13 @@ func (r *DeliveryRepository) HasTransactionalForProfileSince(ctx context.Context
 }
 
 // RecentUnread returns the newest unread rows for the websocket snapshot.
-func (r *DeliveryRepository) RecentUnread(ctx context.Context, profileID string, limit int) ([]DeliveryRow, error) {
+func (r *DeliveryRepository) RecentUnread(ctx context.Context, userID int, profileID string, limit int) ([]DeliveryRow, error) {
 	rows, err := r.pool.Query(ctx,
 		deliveryRowSelect+`
-		WHERE d.profile_id = $1 AND d.read_at IS NULL
+		WHERE d.user_id = $1 AND d.profile_id = $2 AND d.read_at IS NULL
 		ORDER BY d.created_at DESC, d.id DESC
-		LIMIT $2`,
-		profileID, limit)
+		LIMIT $3`,
+		userID, profileID, limit)
 	if err != nil {
 		return nil, fmt.Errorf("recent unread: %w", err)
 	}
@@ -417,23 +417,23 @@ func (r *DeliveryRepository) RecentUnread(ctx context.Context, profileID string,
 }
 
 // UnreadCount returns the unread badge count for the profile.
-func (r *DeliveryRepository) UnreadCount(ctx context.Context, profileID string) (int, error) {
+func (r *DeliveryRepository) UnreadCount(ctx context.Context, userID int, profileID string) (int, error) {
 	var count int
 	err := r.pool.QueryRow(ctx,
-		`SELECT count(*) FROM notification_deliveries WHERE profile_id = $1 AND read_at IS NULL`,
-		profileID,
+		`SELECT count(*) FROM notification_deliveries WHERE user_id = $1 AND profile_id = $2 AND read_at IS NULL`,
+		userID, profileID,
 	).Scan(&count)
 	return count, err
 }
 
 // MarkRead marks one delivery read. Idempotent; reports whether the row
 // transitioned from unread to read.
-func (r *DeliveryRepository) MarkRead(ctx context.Context, profileID, id string) (bool, error) {
+func (r *DeliveryRepository) MarkRead(ctx context.Context, userID int, profileID, id string) (bool, error) {
 	tag, err := r.pool.Exec(ctx, `
 		UPDATE notification_deliveries
 		SET read_at = now()
-		WHERE profile_id = $1 AND id = $2 AND read_at IS NULL`,
-		profileID, id)
+		WHERE user_id = $1 AND profile_id = $2 AND id = $3 AND read_at IS NULL`,
+		userID, profileID, id)
 	if err != nil {
 		return false, err
 	}
@@ -442,22 +442,22 @@ func (r *DeliveryRepository) MarkRead(ctx context.Context, profileID, id string)
 
 // Exists reports whether a delivery belongs to the profile (used to make
 // mark-read idempotent without leaking other profiles' IDs).
-func (r *DeliveryRepository) Exists(ctx context.Context, profileID, id string) (bool, error) {
+func (r *DeliveryRepository) Exists(ctx context.Context, userID int, profileID, id string) (bool, error) {
 	var exists bool
 	err := r.pool.QueryRow(ctx,
-		`SELECT EXISTS (SELECT 1 FROM notification_deliveries WHERE profile_id = $1 AND id = $2)`,
-		profileID, id,
+		`SELECT EXISTS (SELECT 1 FROM notification_deliveries WHERE user_id = $1 AND profile_id = $2 AND id = $3)`,
+		userID, profileID, id,
 	).Scan(&exists)
 	return exists, err
 }
 
 // MarkAllRead marks every unread delivery read for the profile.
-func (r *DeliveryRepository) MarkAllRead(ctx context.Context, profileID string) (int64, error) {
+func (r *DeliveryRepository) MarkAllRead(ctx context.Context, userID int, profileID string) (int64, error) {
 	tag, err := r.pool.Exec(ctx, `
 		UPDATE notification_deliveries
 		SET read_at = now()
-		WHERE profile_id = $1 AND read_at IS NULL`,
-		profileID)
+		WHERE user_id = $1 AND profile_id = $2 AND read_at IS NULL`,
+		userID, profileID)
 	if err != nil {
 		return 0, err
 	}
@@ -466,9 +466,9 @@ func (r *DeliveryRepository) MarkAllRead(ctx context.Context, profileID string)
 
 // DeleteAllForProfile removes every delivery for a deleted profile (profiles
 // may live outside Postgres, so no cascade).
-func (r *DeliveryRepository) DeleteAllForProfile(ctx context.Context, profileID string) error {
+func (r *DeliveryRepository) DeleteAllForProfile(ctx context.Context, userID int, profileID string) error {
 	_, err := r.pool.Exec(ctx,
-		`DELETE FROM notification_deliveries WHERE profile_id = $1`, profileID)
+		`DELETE FROM notification_deliveries WHERE user_id = $1 AND profile_id = $2`, userID, profileID)
 	return err
 }
 
diff --git a/internal/notifications/destination_accounts_db_test.go b/internal/notifications/destination_accounts_db_test.go
new file mode 100644
index 0000000000..703e5fa672
--- /dev/null
+++ b/internal/notifications/destination_accounts_db_test.go
@@ -0,0 +1,180 @@
+package notifications
+
+import (
+	"errors"
+	"net/http"
+	"slices"
+	"testing"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// TestChannelTargetsStayOnTheDeliveryAccount covers profile IDs that repeat
+// across accounts: accounts 1 and 2 each have a "default" profile with a
+// webhook, a web push subscription, and an Apple push device, and only
+// account 2's follows the series. The episode delivery for account 2's
+// "default", and an operational notice for it, queue attempts for account 2's
+// targets only.
+func TestChannelTargetsStayOnTheDeliveryAccount(t *testing.T) {
+	pool := inboxPageDB(t)
+	ctx := t.Context()
+	c := seedAccessCatalog(t, pool)
+	seedFanoutEvent(t, pool, c, nil)
+	seedTwoAccountTargets(t, pool)
+	if _, err := pool.Exec(ctx, `INSERT INTO profile_series_interest (user_id, profile_id, library_id, series_id, favorite)
+		VALUES (2, 'default', $1, $2, true)`, c.library, c.series); err != nil {
+		t.Fatalf("seed interest: %v", err)
+	}
+
+	settings := NewSettings(mapSettingReader{SettingFanoutSettleSeconds: "0", SettingWebhooksEnabled: "true"})
+	worker := newAccessFanoutWorker(pool, scopeByProfile{"default": {}})
+	worker.settings = settings
+	worker.SetWebhookOutbox(NewWebhookRepository(pool), newProfileRateLimiter())
+	worker.SetWebPushOutbox(NewWebPushRepository(pool))
+	worker.SetPushOutbox(NewPushDeviceRepository(pool))
+	if _, err := worker.processBatch(ctx); err != nil {
+		t.Fatalf("processBatch: %v", err)
+	}
+	if got := accountRecipients(t, pool, "event-1"); !slices.Equal(got, []string{"2/default"}) {
+		t.Fatalf("event-1 recipients = %v, want account 2's default", got)
+	}
+	want := []string{"browser-2", "hook-2", "phone-2"}
+	if got := attemptTargets(t, pool, `d.release_event_id = 'event-1'`); !slices.Equal(got, want) {
+		t.Fatalf("episode attempts = %v, want %v", got, want)
+	}
+
+	system := newAccessSystem(pool, scopeByProfile{"default": {}})
+	system.Settings = settings
+	system.webhookRepo = NewWebhookRepository(pool)
+	system.webPushRepo = NewWebPushRepository(pool)
+	system.pushDeviceRepo = NewPushDeviceRepository(pool)
+	notice, err := system.DispatchOperational(ctx, Delivery{
+		ID: "notice-1", UserID: 2, ProfileID: "default",
+		Type: DeliveryTypeWebhookAutoDisabled, ReasonFlags: []byte(`{}`),
+	}, OperationalDispatch{WebhookFilter: func(Webhook) bool { return true }})
+	if err != nil || notice == nil {
+		t.Fatalf("DispatchOperational = %+v, %v; want a delivery", notice, err)
+	}
+	if got := attemptTargets(t, pool, `d.id = 'notice-1'`); !slices.Equal(got, want) {
+		t.Fatalf("operational attempts = %v, want %v", got, want)
+	}
+}
+
+// TestSendersSkipAnotherAccountsTargets covers attempts already queued for a
+// target on another account: a build that matched targets on profile ID
+// alone queued them, or the browser or device was registered to another
+// account's profile with the same ID before the send. Each sender fails such
+// an attempt without contacting the target.
+func TestSendersSkipAnotherAccountsTargets(t *testing.T) {
+	pool := inboxPageDB(t)
+	ctx := t.Context()
+	seedTwoAccountTargets(t, pool)
+	for _, stmt := range []string{
+		`INSERT INTO notification_deliveries (id, user_id, profile_id, type, reason_flags)
+			VALUES ('delivery-2', 2, 'default', 'webhook.auto_disabled', '{}')`,
+		`INSERT INTO webhook_delivery_attempts (id, notification_delivery_id, webhook_id, attempt_number, outcome)
+			VALUES ('hook-attempt', 'delivery-2', 'hook-1', 0, 'pending')`,
+		`INSERT INTO web_push_delivery_attempts (id, notification_delivery_id, subscription_id, attempt_number, outcome)
+			VALUES ('browser-attempt', 'delivery-2', 'browser-1', 0, 'pending')`,
+		`INSERT INTO push_delivery_attempts (id, notification_delivery_id, push_device_id, trigger_type, provider, platform, attempt_number, outcome)
+			VALUES ('phone-attempt', 'delivery-2', 'phone-1', 'delivery', 'prairie_relay', 'apple', 0, 'pending')`,
+	} {
+		if _, err := pool.Exec(ctx, stmt); err != nil {
+			t.Fatalf("seed attempts: %v", err)
+		}
+	}
+
+	refuse := &http.Client{Transport: relayRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		t.Errorf("sent %s %s for another account's target", req.Method, req.URL)
+		return nil, errors.New("refused")
+	})}
+	settings := NewSettings(mapSettingReader{SettingWebhooksEnabled: "true"})
+	deliveries := NewDeliveryRepository(pool)
+
+	webhooks := newWebhookSender(NewWebhookRepository(pool), deliveries, nil, settings)
+	webhooks.client = refuse
+	webhooks.processAttempt(ctx, DeliveryAttempt{ID: "hook-attempt", NotificationDeliveryID: "delivery-2", TargetID: "hook-1"})
+
+	webPush := newWebPushSender(NewWebPushRepository(pool), deliveries, nil, settings)
+	webPush.client = refuse
+	webPush.processAttempt(ctx, DeliveryAttempt{ID: "browser-attempt", NotificationDeliveryID: "delivery-2", TargetID: "browser-1"})
+
+	push := newPushSender(NewPushDeviceRepository(pool), deliveries, nil, settings)
+	push.client = refuse
+	deliveryID := "delivery-2"
+	push.processAttempt(ctx, PushDeliveryAttempt{ID: "phone-attempt", NotificationDeliveryID: &deliveryID, PushDeviceID: "phone-1"})
+
+	rows, err := pool.Query(ctx, `
+		SELECT id || ' ' || outcome FROM webhook_delivery_attempts
+		UNION ALL SELECT id || ' ' || outcome FROM web_push_delivery_attempts
+		UNION ALL SELECT id || ' ' || outcome FROM push_delivery_attempts
+		ORDER BY 1`)
+	if err != nil {
+		t.Fatalf("query attempts: %v", err)
+	}
+	got, err := pgx.CollectRows(rows, pgx.RowTo[string])
+	if err != nil {
+		t.Fatalf("read attempts: %v", err)
+	}
+	if want := []string{"browser-attempt failed", "hook-attempt failed", "phone-attempt failed"}; !slices.Equal(got, want) {
+		t.Fatalf("attempts = %v, want %v", got, want)
+	}
+}
+
+// seedTwoAccountTargets creates the channel target and attempt tables in the
+// test schema and gives accounts 1 and 2 each a "default" profile with one
+// webhook, web push subscription, and Apple push device, suffixed -1 and -2.
+func seedTwoAccountTargets(t *testing.T, pool *pgxpool.Pool) {
+	t.Helper()
+	ctx := t.Context()
+	exec := func(sql string, args ...any) {
+		t.Helper()
+		if _, err := pool.Exec(ctx, sql, args...); err != nil {
+			t.Fatalf("seed targets: %v", err)
+		}
+	}
+	exec(`
+		CREATE TABLE notification_webhooks (LIKE public.notification_webhooks INCLUDING ALL);
+		CREATE TABLE webhook_delivery_attempts (LIKE public.webhook_delivery_attempts INCLUDING ALL);
+		CREATE TABLE web_push_subscriptions (LIKE public.web_push_subscriptions INCLUDING ALL);
+		CREATE TABLE web_push_delivery_attempts (LIKE public.web_push_delivery_attempts INCLUDING ALL);
+		CREATE TABLE push_devices (LIKE public.push_devices INCLUDING ALL);
+		CREATE TABLE push_delivery_attempts (LIKE public.push_delivery_attempts INCLUDING ALL)`)
+	// The webhook and push device keys are unique per profile ID, so the two
+	// accounts' targets carry different names and device IDs.
+	for _, account := range []string{"1", "2"} {
+		exec(`INSERT INTO notification_webhooks (id, user_id, profile_id, name, type, url_ciphertext, url_host)
+			VALUES ('hook-' || $1, $1::int, 'default', 'hook-' || $1, 'discord', 'ciphertext', 'example.test')`, account)
+		exec(`INSERT INTO web_push_subscriptions (id, user_id, profile_id, endpoint, p256dh, auth)
+			VALUES ('browser-' || $1, $1::int, 'default', 'https://push.example.test/' || $1, 'key', 'auth')`, account)
+		exec(`INSERT INTO push_devices (id, user_id, profile_id, device_id, platform, provider, apns_environment,
+				apns_topic, apns_token_ciphertext, apns_token_hash, server_device_id)
+			VALUES ('phone-' || $1, $1::int, 'default', 'phone-' || $1, 'apple', 'prairie_relay', 'sandbox',
+				'topic', 'ciphertext', 'hash-' || $1, 'server-phone-' || $1)`, account)
+	}
+}
+
+// attemptTargets lists the webhook, web push, and Apple push targets queued
+// for the deliveries matching where (over notification_deliveries d).
+func attemptTargets(t *testing.T, pool *pgxpool.Pool, where string) []string {
+	t.Helper()
+	rows, err := pool.Query(t.Context(), `
+		SELECT a.webhook_id FROM webhook_delivery_attempts a
+			JOIN notification_deliveries d ON d.id = a.notification_delivery_id WHERE `+where+`
+		UNION ALL
+		SELECT a.subscription_id FROM web_push_delivery_attempts a
+			JOIN notification_deliveries d ON d.id = a.notification_delivery_id WHERE `+where+`
+		UNION ALL
+		SELECT a.push_device_id FROM push_delivery_attempts a
+			JOIN notification_deliveries d ON d.id = a.notification_delivery_id WHERE `+where+`
+		ORDER BY 1`)
+	if err != nil {
+		t.Fatalf("query attempts: %v", err)
+	}
+	targets, err := pgx.CollectRows(rows, pgx.RowTo[string])
+	if err != nil {
+		t.Fatalf("read attempts: %v", err)
+	}
+	return targets
+}
diff --git a/internal/notifications/destination_management_db_test.go b/internal/notifications/destination_management_db_test.go
new file mode 100644
index 0000000000..b9a5eddb01
--- /dev/null
+++ b/internal/notifications/destination_management_db_test.go
@@ -0,0 +1,320 @@
+package notifications
+
+import (
+	"errors"
+	"os"
+	"slices"
+	"strings"
+	"testing"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// Profile IDs are unique only within an account: every account from before
+// profiles has a profile "default". These tests give two accounts a profile
+// with the same ID and check that one never sees or changes the other's
+// notification destinations.
+
+const (
+	accountA = 1
+	accountB = 2
+	sharedID = "default"
+)
+
+// destinationAccountsDB returns a pool on a fresh schema holding the
+// destination tables. notification_webhooks is built from its original
+// migration plus the name-scope migration, so the test sees the production
+// constraint name; the rest are copies of the current public tables.
+func destinationAccountsDB(t *testing.T) *pgxpool.Pool {
+	t.Helper()
+	pool := schemaDB(t, "notification_dest_")
+	ctx := t.Context()
+	data, err := os.ReadFile("../../migrations/sql/20260611120000_notification_webhooks.sql")
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, ddl, ok := strings.Cut(string(data), "CREATE TABLE public.notification_webhooks (")
+	if !ok {
+		t.Fatal("missing table declaration")
+	}
+	ddl, _, ok = strings.Cut(ddl, "\n);")
+	if !ok {
+		t.Fatal("missing table terminator")
+	}
+	if _, err = pool.Exec(ctx, "CREATE TABLE notification_webhooks ("+ddl+"\n);"+`
+		ALTER TABLE notification_webhooks ADD COLUMN notify_requests boolean NOT NULL DEFAULT false, ADD COLUMN revision bigint NOT NULL DEFAULT 1;
+		CREATE TABLE web_push_subscriptions (LIKE public.web_push_subscriptions INCLUDING ALL);
+		CREATE TABLE web_push_delivery_attempts (LIKE public.web_push_delivery_attempts INCLUDING ALL);
+		CREATE TABLE push_devices (LIKE public.push_devices INCLUDING ALL);
+		CREATE TABLE android_push_installations (LIKE public.android_push_installations INCLUDING ALL);
+		CREATE TABLE apple_push_installations (LIKE public.apple_push_installations INCLUDING ALL);
+		CREATE TABLE notification_deliveries (LIKE public.notification_deliveries INCLUDING ALL);
+		CREATE TABLE notification_preferences (LIKE public.notification_preferences INCLUDING ALL);
+		CREATE TABLE notification_email_prefs (LIKE public.notification_email_prefs INCLUDING ALL);
+		CREATE TABLE profile_series_interest (LIKE public.profile_series_interest INCLUDING ALL);
+		CREATE TABLE profile_series_notification_mutes (LIKE public.profile_series_notification_mutes INCLUDING ALL)`); err != nil {
+		t.Fatal(err)
+	}
+	up, _ := webhookNameMigration(t)
+	if _, err = pool.Exec(ctx, up); err != nil {
+		t.Fatal(err)
+	}
+	return pool
+}
+
+// webhookNameMigration returns the name-scope migration's Up and Down SQL,
+// unqualified so they apply to the test schema.
+func webhookNameMigration(t *testing.T) (string, string) {
+	t.Helper()
+	data, err := os.ReadFile("../../migrations/sql/20261016163853_scope_webhook_names_to_account.sql")
+	if err != nil {
+		t.Fatal(err)
+	}
+	up, down, ok := strings.Cut(strings.ReplaceAll(string(data), "public.", ""), "-- +goose Down")
+	if !ok {
+		t.Fatal("missing Down section")
+	}
+	return up, down
+}
+
+func seedAccountWebhook(t *testing.T, repo *WebhookRepository, user int, id, name string, limit int) error {
+	t.Helper()
+	return repo.InsertWithLimit(t.Context(), Webhook{
+		ID: id, UserID: user, ProfileID: sharedID, Name: name, Type: WebhookTypeGeneric,
+		URLCiphertext: "url-cipher", URLHost: "example.test", SigningSecretCiphertext: new("secret-cipher"), Enabled: true,
+	}, limit)
+}
+
+func webhookIDs(hooks []Webhook) []string {
+	ids := make([]string, 0, len(hooks))
+	for _, hook := range hooks {
+		ids = append(ids, hook.ID)
+	}
+	return ids
+}
+
+func TestWebhookManagementStaysOnTheAccount(t *testing.T) {
+	pool := destinationAccountsDB(t)
+	ctx := t.Context()
+	repo := NewWebhookRepository(pool)
+	if err := seedAccountWebhook(t, repo, accountB, "b-hook", "Alerts", 1); err != nil {
+		t.Fatalf("account B insert: %v", err)
+	}
+	// Account A's profile is under its own cap of one and may reuse the name.
+	if err := seedAccountWebhook(t, repo, accountA, "a-hook", "Alerts", 1); err != nil {
+		t.Fatalf("account A insert with B's name, at B's cap: %v", err)
+	}
+	if err := seedAccountWebhook(t, repo, accountA, "a-hook-2", "Alerts", 2); !errors.Is(err, ErrWebhookNameTaken) {
+		t.Fatalf("duplicate name on one account = %v, want ErrWebhookNameTaken", err)
+	}
+	if err := seedAccountWebhook(t, repo, accountA, "a-hook-2", "Other", 1); !errors.Is(err, ErrWebhookLimit) {
+		t.Fatalf("over the cap = %v, want ErrWebhookLimit", err)
+	}
+
+	listed, err := repo.ListByProfile(ctx, accountA, sharedID)
+	if err != nil || !slices.Equal(webhookIDs(listed), []string{"a-hook"}) {
+		t.Fatalf("ListByProfile(A) = %v %v, want only a-hook", webhookIDs(listed), err)
+	}
+	page, err := repo.ListPage(ctx, accountA, sharedID, 10, nil)
+	if err != nil || !slices.Equal(webhookIDs(page), []string{"a-hook"}) {
+		t.Fatalf("ListPage(A) = %v %v, want only a-hook", webhookIDs(page), err)
+	}
+	if hook, err := repo.GetByID(ctx, accountA, sharedID, "b-hook"); err != nil || hook != nil {
+		t.Fatalf("GetByID(A, b-hook) = %+v %v, want none", hook, err)
+	}
+	if _, err := repo.UpdateGuarded(ctx, accountA, sharedID, "b-hook", func(*Webhook) error {
+		t.Error("account B's webhook reached account A's editor")
+		return nil
+	}); !errors.Is(err, ErrWebhookNotFound) {
+		t.Fatalf("UpdateGuarded(A, b-hook) = %v, want ErrWebhookNotFound", err)
+	}
+	if err := repo.ReplaceSigningSecret(ctx, accountA, sharedID, "b-hook", "a-secret"); !errors.Is(err, ErrWebhookNotFound) {
+		t.Fatalf("ReplaceSigningSecret(A, b-hook) = %v, want ErrWebhookNotFound", err)
+	}
+	if err := repo.DeleteGuarded(ctx, accountA, sharedID, "b-hook", func(int64) error { return nil }); !errors.Is(err, ErrWebhookNotFound) {
+		t.Fatalf("DeleteGuarded(A, b-hook) = %v, want ErrWebhookNotFound", err)
+	}
+	// The bridge delete is idempotent: it succeeds and removes nothing.
+	if err := repo.Delete(ctx, accountA, sharedID, "b-hook"); err != nil {
+		t.Fatalf("Delete(A, b-hook): %v", err)
+	}
+	hook, err := repo.GetByID(ctx, accountB, sharedID, "b-hook")
+	if err != nil || hook == nil || *hook.SigningSecretCiphertext != "secret-cipher" {
+		t.Fatalf("account B's webhook after A's calls = %+v %v, want it unchanged", hook, err)
+	}
+
+	// Renaming into a name the same account profile holds is still refused.
+	if err := seedAccountWebhook(t, repo, accountB, "b-hook-2", "Other", 2); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := repo.UpdateGuarded(ctx, accountB, sharedID, "b-hook-2", func(h *Webhook) error {
+		h.Name = "Alerts"
+		return nil
+	}); !errors.Is(err, ErrWebhookNameTaken) {
+		t.Fatalf("rename onto a taken name = %v, want ErrWebhookNameTaken", err)
+	}
+
+	// Down restores the profile-ID-wide constraint; with both accounts
+	// holding "Alerts" it fails and leaves the table as it was.
+	_, down := webhookNameMigration(t)
+	if _, err := pool.Exec(ctx, down); err == nil {
+		t.Fatal("Down succeeded although two accounts share a webhook name")
+	}
+	if err := seedAccountWebhook(t, repo, accountB, "b-hook-3", "Alerts", 3); !errors.Is(err, ErrWebhookNameTaken) {
+		t.Fatalf("after the failed Down, duplicate = %v, want ErrWebhookNameTaken", err)
+	}
+}
+
+func TestWebPushManagementStaysOnTheAccount(t *testing.T) {
+	pool := destinationAccountsDB(t)
+	ctx := t.Context()
+	repo := NewWebPushRepository(pool)
+	for _, sub := range []WebPushSubscription{
+		{ID: "a-sub", UserID: accountA, ProfileID: sharedID, Endpoint: "https://push.example.test/a", P256dh: "key", Auth: "auth"},
+		{ID: "b-sub", UserID: accountB, ProfileID: sharedID, Endpoint: "https://push.example.test/b", P256dh: "key", Auth: "auth"},
+	} {
+		if _, err := repo.Upsert(ctx, sub); err != nil {
+			t.Fatal(err)
+		}
+	}
+	listed, err := repo.ListByProfile(ctx, accountA, sharedID)
+	if err != nil || len(listed) != 1 || listed[0].ID != "a-sub" {
+		t.Fatalf("ListByProfile(A) = %+v %v, want only a-sub", listed, err)
+	}
+	page, err := repo.ListPage(ctx, accountA, sharedID, 10, nil)
+	if err != nil || len(page) != 1 || page[0].ID != "a-sub" {
+		t.Fatalf("ListPage(A) = %+v %v, want only a-sub", page, err)
+	}
+	service := &WebPushService{repo: repo}
+	if err := service.Unsubscribe(ctx, accountA, sharedID, "b-sub", ""); err != nil {
+		t.Fatalf("Unsubscribe(A, b-sub): %v", err)
+	}
+	if got, err := repo.ListByProfile(ctx, accountB, sharedID); err != nil || len(got) != 1 || got[0].ID != "b-sub" {
+		t.Fatalf("account B after A's delete = %+v %v, want b-sub kept", got, err)
+	}
+
+	// Account A signs in on the browser that holds B's endpoint. The row moves
+	// to A and B's undelivered attempts are canceled, not sent to A.
+	if _, err := pool.Exec(ctx, `INSERT INTO web_push_delivery_attempts (id, notification_delivery_id, subscription_id, attempt_number, outcome)
+		VALUES ('b-pending', 'b-delivery', 'b-sub', 1, 'pending'), ('b-done', 'b-delivery-old', 'b-sub', 1, 'delivered')`); err != nil {
+		t.Fatal(err)
+	}
+	moved, err := repo.Upsert(ctx, WebPushSubscription{ID: "new-id", UserID: accountA, ProfileID: sharedID, Endpoint: "https://push.example.test/b", P256dh: "key2", Auth: "auth2"})
+	if err != nil || moved.ID != "b-sub" || moved.UserID != accountA {
+		t.Fatalf("reassign = %+v %v", moved, err)
+	}
+	rows, err := pool.Query(ctx, `SELECT id FROM web_push_delivery_attempts ORDER BY id`)
+	if err != nil {
+		t.Fatal(err)
+	}
+	left, err := pgx.CollectRows(rows, pgx.RowTo[string])
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !slices.Equal(left, []string{"b-done"}) {
+		t.Fatalf("attempts after reassignment = %v, want only the delivered one", left)
+	}
+}
+
+func TestLegacyPushRegistrationStaysOnTheAccount(t *testing.T) {
+	pool := destinationAccountsDB(t)
+	ctx := t.Context()
+	repo := NewPushDeviceRepository(pool)
+	cipher := testPushCipher(t)
+	register := func(user int, device string) *PushDevice {
+		t.Helper()
+		registration, err := normalizeApplePushRegistration(ApplePushRegistrationInput{
+			DeviceID: device, APNsToken: strings.Repeat("a", 64), APNsEnvironment: APNsEnvironmentProd,
+			APNsTopic: ApplePushTopicPrairie, PushMode: PushModePrivatePush,
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+		registration.UserID, registration.ProfileID = user, sharedID
+		row, err := repo.UpsertApple(ctx, registration, cipher)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return row
+	}
+	owners := func(device string) []int {
+		t.Helper()
+		rows, err := pool.Query(ctx, `SELECT user_id FROM push_devices WHERE device_id = $1 ORDER BY user_id`, device)
+		if err != nil {
+			t.Fatal(err)
+		}
+		out, err := pgx.CollectRows(rows, pgx.RowTo[int])
+		if err != nil {
+			t.Fatal(err)
+		}
+		return out
+	}
+
+	first := register(accountA, "shared-phone")
+	// Account B signs in on the same install: A's registration (and the
+	// attempts that cascade with it) goes, B gets a new row.
+	second := register(accountB, "shared-phone")
+	if second.ID == first.ID || !slices.Equal(owners("shared-phone"), []int{accountB}) {
+		t.Fatalf("after B registers: row %s (A's was %s), owners %v; want a new row for B only", second.ID, first.ID, owners("shared-phone"))
+	}
+	if err := repo.DeleteByProfileDevice(ctx, accountA, sharedID, "shared-phone"); err != nil {
+		t.Fatal(err)
+	}
+	if !slices.Equal(owners("shared-phone"), []int{accountB}) {
+		t.Fatalf("account A's unregister removed account B's registration: %v", owners("shared-phone"))
+	}
+	service := NewPushDeviceService(repo, cipher)
+	if err := service.Unregister(ctx, accountB, sharedID, "shared-phone"); err != nil {
+		t.Fatal(err)
+	}
+	if got := owners("shared-phone"); len(got) != 0 {
+		t.Fatalf("account B's unregister left %v", got)
+	}
+}
+
+func TestPurgeProfileKeepsAnotherAccountsSameIDProfile(t *testing.T) {
+	pool := destinationAccountsDB(t)
+	ctx := t.Context()
+	hooks := NewWebhookRepository(pool)
+	pushes := NewWebPushRepository(pool)
+	devices := NewPushDeviceRepository(pool)
+	if err := seedAccountWebhook(t, hooks, accountA, "a-hook", "Alerts", 10); err != nil {
+		t.Fatal(err)
+	}
+	if err := seedAccountWebhook(t, hooks, accountB, "b-hook", "Alerts", 10); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := pool.Exec(ctx, `
+		INSERT INTO web_push_subscriptions (id, user_id, profile_id, endpoint, p256dh, auth)
+			VALUES ('sub-1', 1, 'default', 'https://push.example.test/1', 'k', 'a'), ('sub-2', 2, 'default', 'https://push.example.test/2', 'k', 'a');
+		INSERT INTO push_devices (id, user_id, profile_id, device_id, platform, provider, apns_environment, apns_topic, apns_token_ciphertext, apns_token_hash, server_device_id)
+			VALUES ('dev-1', 1, 'default', 'phone-1', 'apple', 'prairie_relay', 'production', 'topic', 'c', 'h1', 's1'),
+			       ('dev-2', 2, 'default', 'phone-2', 'apple', 'prairie_relay', 'production', 'topic', 'c', 'h2', 's2');
+		INSERT INTO notification_deliveries (id, user_id, profile_id, type, reason_flags)
+			VALUES ('del-1', 1, 'default', 'request.approved', '{}'), ('del-2', 2, 'default', 'request.approved', '{}');
+		INSERT INTO notification_email_prefs (profile_id, user_id) VALUES ('default', 2)`); err != nil {
+		t.Fatal(err)
+	}
+	s := &System{
+		Interests:      NewInterestRepository(pool),
+		Deliveries:     NewDeliveryRepository(pool),
+		Preferences:    NewPreferencesRepository(pool),
+		EmailPrefs:     NewEmailPrefsRepository(pool),
+		webhookRepo:    hooks,
+		webPushRepo:    pushes,
+		pushDeviceRepo: devices,
+	}
+	if err := s.PurgeProfile(ctx, accountA, sharedID); err != nil {
+		t.Fatalf("PurgeProfile(A): %v", err)
+	}
+	for _, table := range []string{"notification_webhooks", "web_push_subscriptions", "push_devices", "notification_deliveries", "notification_email_prefs"} {
+		var a, b int
+		if err := pool.QueryRow(ctx, `SELECT count(*) FILTER (WHERE user_id = 1), count(*) FILTER (WHERE user_id = 2) FROM `+table).Scan(&a, &b); err != nil {
+			t.Fatal(err)
+		}
+		if a != 0 || b != 1 {
+			t.Errorf("%s after purging account A's profile: A=%d B=%d, want A=0 B=1", table, a, b)
+		}
+	}
+}
diff --git a/internal/notifications/destination_pages_test.go b/internal/notifications/destination_pages_test.go
index e4d20a9b19..f66184e612 100644
--- a/internal/notifications/destination_pages_test.go
+++ b/internal/notifications/destination_pages_test.go
@@ -50,8 +50,8 @@ func TestNotificationDestinationPages(t *testing.T) {
 	}
 	if _, err = pool.Exec(ctx, `ALTER TABLE notification_webhooks ADD COLUMN notify_requests boolean NOT NULL DEFAULT false, ADD COLUMN revision bigint NOT NULL DEFAULT 1;
  ALTER TABLE notification_server_channels ADD COLUMN notify_new_audiobooks boolean NOT NULL DEFAULT true, ADD COLUMN notify_new_ebooks boolean NOT NULL DEFAULT true;
- INSERT INTO web_push_subscriptions (id,user_id,profile_id,endpoint,p256dh,auth,created_at) SELECT id,1,profile,'https://push.example.test/'||id,'key','auth','2026-09-01T00:00:00Z'::timestamptz FROM (VALUES ('01','owner'),('02','owner'),('03','owner'),('00','other')) AS v(id,profile);
- INSERT INTO notification_webhooks (id,user_id,profile_id,name,type,url_ciphertext,url_host,signing_secret_ciphertext,created_at) SELECT id,1,profile,id,'generic','ciphertext','example.test','secret','2026-09-01T00:00:00Z'::timestamptz FROM (VALUES ('01','owner'),('02','owner'),('03','owner'),('00','other')) AS v(id,profile);
+ INSERT INTO web_push_subscriptions (id,user_id,profile_id,endpoint,p256dh,auth,created_at) SELECT id,account,profile,'https://push.example.test/'||id,'key','auth','2026-09-01T00:00:00Z'::timestamptz FROM (VALUES ('01',1,'owner'),('02',1,'owner'),('03',1,'owner'),('00',1,'other'),('04',2,'owner')) AS v(id,account,profile);
+ INSERT INTO notification_webhooks (id,user_id,profile_id,name,type,url_ciphertext,url_host,signing_secret_ciphertext,created_at) SELECT id,account,profile,id,'generic','ciphertext','example.test','secret','2026-09-01T00:00:00Z'::timestamptz FROM (VALUES ('01',1,'owner'),('02',1,'owner'),('03',1,'owner'),('00',1,'other'),('04',2,'owner')) AS v(id,account,profile);
  INSERT INTO notification_server_channels (id,name,type,url_ciphertext,url_host,signing_secret_ciphertext,created_by_user_id,created_at) SELECT id,id,'generic','ciphertext','example.test','secret',1,'2026-09-01T00:00:00Z'::timestamptz FROM (VALUES ('01'),('02'),('03')) AS v(id);`); err != nil {
 		t.Fatal(err)
 	}
@@ -67,11 +67,11 @@ func TestNotificationDestinationPages(t *testing.T) {
 	pushes := NewWebPushRepository(pool)
 	hooks := NewWebhookRepository(pool)
 	channels := NewServerChannelRepository(pool)
-	a, err := pushes.ListPage(ctx, "owner", 2, nil)
+	a, err := pushes.ListPage(ctx, 1, "owner", 2, nil)
 	if err != nil || len(a) != 2 || a[0].ID != "01" || a[1].ID != "02" {
 		t.Fatalf("push page: %+v %v", a, err)
 	}
-	b, err := hooks.ListPage(ctx, "owner", 2, nil)
+	b, err := hooks.ListPage(ctx, 1, "owner", 2, nil)
 	if err != nil || len(b) != 2 || b[0].ID != "01" || b[1].ID != "02" {
 		t.Fatalf("webhook page: %+v %v", b, err)
 	}
@@ -79,15 +79,17 @@ func TestNotificationDestinationPages(t *testing.T) {
 	if err != nil || len(c) != 2 || c[0].ID != "01" || c[1].ID != "02" {
 		t.Fatalf("channel page: %+v %v", c, err)
 	}
+	// Row 04 belongs to a profile with the same ID on another account: it is
+	// never on account 1's pages.
 	// Cursor continuation must not depend on the boundary row still existing.
 	if _, err = pool.Exec(ctx, `DELETE FROM web_push_subscriptions WHERE id='02'; DELETE FROM notification_webhooks WHERE id='02'; DELETE FROM notification_server_channels WHERE id='02'`); err != nil {
 		t.Fatal(err)
 	}
-	a, err = pushes.ListPage(ctx, "owner", 2, key)
+	a, err = pushes.ListPage(ctx, 1, "owner", 2, key)
 	if err != nil || len(a) != 1 || a[0].ID != "03" {
 		t.Fatalf("push continuation: %+v %v", a, err)
 	}
-	b, err = hooks.ListPage(ctx, "owner", 2, key)
+	b, err = hooks.ListPage(ctx, 1, "owner", 2, key)
 	if err != nil || len(b) != 1 || b[0].ID != "03" {
 		t.Fatalf("webhook continuation: %+v %v", b, err)
 	}
diff --git a/internal/notifications/destination_test_sends_test.go b/internal/notifications/destination_test_sends_test.go
index 93f784d79f..65ae2fd5a2 100644
--- a/internal/notifications/destination_test_sends_test.go
+++ b/internal/notifications/destination_test_sends_test.go
@@ -92,7 +92,7 @@ func TestNotificationDestinationTestSends(t *testing.T) {
 	settings := NewSettings(mapSettingReader{SettingWebhooksEnabled: "true"})
 	hooks := NewWebhookRepository(pool)
 	channels := NewServerChannelRepository(pool)
-	hookBefore, err := hooks.GetByID(ctx, "owner", "hook")
+	hookBefore, err := hooks.GetByID(ctx, 1, "owner", "hook")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -103,7 +103,7 @@ func TestNotificationDestinationTestSends(t *testing.T) {
 	webhookSvc := newWebhookService(hooks, cipher, settings, &webhookSender{cipher: cipher, client: client})
 	channelSvc := newServerChannelService(channels, cipher, settings, &serverChannelSender{cipher: cipher, client: client})
 	for _, send := range []func() (*WebhookTestResult, error){
-		func() (*WebhookTestResult, error) { return webhookSvc.Test(ctx, "owner", "hook") },
+		func() (*WebhookTestResult, error) { return webhookSvc.Test(ctx, 1, "owner", "hook") },
 		func() (*WebhookTestResult, error) { return channelSvc.Test(ctx, "channel") },
 	} {
 		before := calls
@@ -112,10 +112,14 @@ func TestNotificationDestinationTestSends(t *testing.T) {
 			t.Fatalf("send: %+v %v calls=%d", result, err, calls)
 		}
 	}
-	if _, err = webhookSvc.Test(ctx, "other", "hook"); !errors.Is(err, ErrWebhookNotFound) || calls != 2 {
+	if _, err = webhookSvc.Test(ctx, 1, "other", "hook"); !errors.Is(err, ErrWebhookNotFound) || calls != 2 {
 		t.Fatalf("cross-profile send: %v calls=%d", err, calls)
 	}
-	hookAfter, err := hooks.GetByID(ctx, "owner", "hook")
+	// A profile with the same ID on another account is another owner.
+	if _, err = webhookSvc.Test(ctx, 2, "owner", "hook"); !errors.Is(err, ErrWebhookNotFound) || calls != 2 {
+		t.Fatalf("cross-account send: %v calls=%d", err, calls)
+	}
+	hookAfter, err := hooks.GetByID(ctx, 1, "owner", "hook")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/internal/notifications/display.go b/internal/notifications/display.go
index b71f6a4f24..d5ced4ed16 100644
--- a/internal/notifications/display.go
+++ b/internal/notifications/display.go
@@ -3,6 +3,8 @@ package notifications
 import (
 	"fmt"
 	"strings"
+
+	"github.com/prairie-server/prairie-server/internal/titleutil"
 )
 
 // NotificationDisplay is the compact, user-facing display metadata clients use
@@ -95,25 +97,31 @@ func BuildNotificationDisplay(row DeliveryRow) NotificationDisplay {
 	return display
 }
 
+// episodeDisplayTitle leads with the series name alone: native notifications
+// give the title one line, and any fixed wording around the name pushes it
+// past the cut. The episode details go in the body, which wraps.
 func episodeDisplayTitle(row DeliveryRow) string {
-	code := episodeDisplayCode(row)
-	switch {
-	case row.SeriesTitle != "" && code != "":
-		return fmt.Sprintf("The latest episode of %s %s just dropped!", row.SeriesTitle, code)
-	case row.SeriesTitle != "":
-		return "The latest episode of " + row.SeriesTitle + " just dropped!"
-	case code != "":
-		return "New episode " + code + " available"
-	default:
-		return "New episode available"
+	if row.SeriesTitle != "" {
+		return row.SeriesTitle
 	}
+	return "New episode available"
 }
 
+// episodeDisplayBody reads "New episode · S02E01 · Hello, Ms. Cobel", dropping
+// the parts that are missing. A placeholder title such as "TBA" says nothing
+// the episode code doesn't, so it is left out.
 func episodeDisplayBody(row DeliveryRow) string {
-	if row.EpisodeTitle != "" {
-		return row.EpisodeTitle
+	parts := make([]string, 0, 3)
+	if row.SeriesTitle != "" {
+		parts = append(parts, "New episode")
+	}
+	if code := episodeDisplayCode(row); code != "" {
+		parts = append(parts, code)
+	}
+	if title := strings.TrimSpace(row.EpisodeTitle); title != "" && !titleutil.IsProvisionalEpisodeTitle(title) {
+		parts = append(parts, title)
 	}
-	return episodeDisplayCode(row)
+	return strings.Join(parts, " · ")
 }
 
 func episodeDisplayCode(row DeliveryRow) string {
diff --git a/internal/notifications/email_digest.go b/internal/notifications/email_digest.go
index 9d6cbdb6df..ee4c49ff7a 100644
--- a/internal/notifications/email_digest.go
+++ b/internal/notifications/email_digest.go
@@ -32,7 +32,7 @@ type emailChannel struct {
 
 // The assertion also keeps staticcheck's unused-analysis aware that the
 // adapter methods are consumed through the generic engine interface.
-var _ accountChannel[string] = (*emailChannel)(nil)
+var _ accountChannel[profileKey] = (*emailChannel)(nil)
 
 func (c *emailChannel) name() string { return "email" }
 
@@ -48,46 +48,46 @@ func (c *emailChannel) digestHour(ctx context.Context) int {
 	return c.settings.EmailDigestHour(ctx)
 }
 
-func (c *emailChannel) listRecipients(ctx context.Context) ([]accountRecipient[string], error) {
+func (c *emailChannel) listRecipients(ctx context.Context) ([]accountRecipient[profileKey], error) {
 	return c.prefs.ListActiveRecipients(ctx)
 }
 
-func (c *emailChannel) hasPendingSince(ctx context.Context, profileID string, since Cursor) (bool, error) {
-	return c.deliveries.HasForProfileSince(ctx, profileID, since)
+func (c *emailChannel) hasPendingSince(ctx context.Context, key profileKey, since Cursor) (bool, error) {
+	return c.deliveries.HasForProfileSince(ctx, key.userID, key.profileID, since)
 }
 
-func (c *emailChannel) hasTransactionalPendingSince(ctx context.Context, profileID string, since Cursor) (bool, error) {
-	return c.deliveries.HasTransactionalForProfileSince(ctx, profileID, since)
+func (c *emailChannel) hasTransactionalPendingSince(ctx context.Context, key profileKey, since Cursor) (bool, error) {
+	return c.deliveries.HasTransactionalForProfileSince(ctx, key.userID, key.profileID, since)
 }
 
-func (c *emailChannel) listSince(ctx context.Context, tx pgx.Tx, profileID string, since Cursor, until time.Time, limit int) ([]DeliveryRow, error) {
-	return c.deliveries.ListForProfileSince(ctx, tx, profileID, since, until, limit)
+func (c *emailChannel) listSince(ctx context.Context, tx pgx.Tx, key profileKey, since Cursor, until time.Time, limit int) ([]DeliveryRow, error) {
+	return c.deliveries.ListForProfileSince(ctx, tx, key.userID, key.profileID, since, until, limit)
 }
 
-func (c *emailChannel) claim(ctx context.Context, tx pgx.Tx, profileID string) (*accountRecipient[string], error) {
-	return c.prefs.claimForUpdate(ctx, tx, profileID)
+func (c *emailChannel) claim(ctx context.Context, tx pgx.Tx, key profileKey) (*accountRecipient[profileKey], error) {
+	return c.prefs.claimForUpdate(ctx, tx, key)
 }
 
-func (c *emailChannel) markSent(ctx context.Context, tx pgx.Tx, profileID string, watermark Cursor, digestAt *time.Time) error {
-	return c.prefs.markSent(ctx, tx, profileID, watermark, digestAt)
+func (c *emailChannel) markSent(ctx context.Context, tx pgx.Tx, key profileKey, watermark Cursor, digestAt *time.Time) error {
+	return c.prefs.markSent(ctx, tx, key, watermark, digestAt)
 }
 
-func (c *emailChannel) markFailure(ctx context.Context, tx pgx.Tx, profileID string, _ error) error {
-	return c.prefs.markFailure(ctx, tx, profileID)
+func (c *emailChannel) markFailure(ctx context.Context, tx pgx.Tx, key profileKey, _ error) error {
+	return c.prefs.markFailure(ctx, tx, key)
 }
 
 // send composes and sends one profile's pending notifications. The
 // destination is re-read under the claim so a mid-pass address removal fails
 // cleanly instead of sending to a stale recipient.
-func (c *emailChannel) send(ctx context.Context, tx pgx.Tx, profileID string, mode string, rows []DeliveryRow) (sendErr error) {
+func (c *emailChannel) send(ctx context.Context, tx pgx.Tx, key profileKey, mode string, rows []DeliveryRow) (sendErr error) {
 	ctx, finishObservation := telemetry.StartDependency(ctx, "notifications", "worker", "email")
 	defer func() { finishObservation(deliveryObservationError(ctx, sendErr == nil)) }()
-	email, userID, unsubscribeToken, err := c.prefs.destinationForSend(ctx, tx, profileID)
+	email, unsubscribeToken, err := c.prefs.destinationForSend(ctx, tx, key)
 	if err != nil {
 		return err
 	}
 	if email == "" {
-		return fmt.Errorf("profile %s has no usable email address", profileID)
+		return fmt.Errorf("profile %s has no usable email address", key)
 	}
 	// The token is minted lazily, under the claim lock, right before the
 	// first email that embeds it — this is the only mint point.
@@ -96,7 +96,7 @@ func (c *emailChannel) send(ctx context.Context, tx pgx.Tx, profileID string, mo
 		if err != nil {
 			return err
 		}
-		if err := c.prefs.setUnsubscribeToken(ctx, tx, profileID, unsubscribeToken); err != nil {
+		if err := c.prefs.setUnsubscribeToken(ctx, tx, key, unsubscribeToken); err != nil {
 			return err
 		}
 	}
@@ -108,7 +108,7 @@ func (c *emailChannel) send(ctx context.Context, tx pgx.Tx, profileID string, mo
 		UnsubscribeURL: emailUnsubscribeURL(baseURL, unsubscribeToken),
 	}
 	if c.profileName != nil {
-		opts.ProfileName = c.profileName(ctx, userID, profileID)
+		opts.ProfileName = c.profileName(ctx, key.userID, key.profileID)
 	}
 
 	content := composeNotificationEmail(mode, rows, opts)
diff --git a/internal/notifications/email_prefs_repo.go b/internal/notifications/email_prefs_repo.go
index 91ff49b2e3..784a9bbda0 100644
--- a/internal/notifications/email_prefs_repo.go
+++ b/internal/notifications/email_prefs_repo.go
@@ -387,10 +387,11 @@ func (r *EmailPrefsRepository) UnsubscribeByToken(ctx context.Context, token str
 	return tag.RowsAffected() > 0, nil
 }
 
-// DeleteForProfile purges the profile's email prefs (profile deletion).
-func (r *EmailPrefsRepository) DeleteForProfile(ctx context.Context, profileID string) error {
+// DeleteForProfile purges the account profile's email prefs (profile
+// deletion).
+func (r *EmailPrefsRepository) DeleteForProfile(ctx context.Context, userID int, profileID string) error {
 	_, err := r.pool.Exec(ctx,
-		`DELETE FROM notification_email_prefs WHERE profile_id = $1`, profileID)
+		`DELETE FROM notification_email_prefs WHERE user_id = $1 AND profile_id = $2`, userID, profileID)
 	if err != nil {
 		return fmt.Errorf("delete email prefs: %w", err)
 	}
@@ -398,24 +399,24 @@ func (r *EmailPrefsRepository) DeleteForProfile(ctx context.Context, profileID s
 }
 
 // ListActiveRecipients returns every profile with email notifications on and
-// a verified destination address. Disabled or deleted accounts drop out of
-// the join.
-func (r *EmailPrefsRepository) ListActiveRecipients(ctx context.Context) ([]accountRecipient[string], error) {
+// a verified destination address, keyed by the row's account and profile.
+// Disabled or deleted accounts drop out of the join.
+func (r *EmailPrefsRepository) ListActiveRecipients(ctx context.Context) ([]accountRecipient[profileKey], error) {
 	rows, err := r.pool.Query(ctx, `
-		SELECT p.profile_id, p.mode, p.watermark_created_at, p.watermark_id,
+		SELECT p.user_id, p.profile_id, p.mode, p.watermark_created_at, p.watermark_id,
 		       p.last_digest_at, p.last_attempt_at, p.consecutive_failures
 		FROM notification_email_prefs p
 		JOIN users u ON u.id = p.user_id AND u.enabled
 		WHERE p.mode <> 'off' AND p.custom_email <> ''
-		ORDER BY p.profile_id`)
+		ORDER BY p.user_id, p.profile_id`)
 	if err != nil {
 		return nil, fmt.Errorf("list email recipients: %w", err)
 	}
 	defer rows.Close()
-	out := make([]accountRecipient[string], 0, 8)
+	out := make([]accountRecipient[profileKey], 0, 8)
 	for rows.Next() {
-		var rec accountRecipient[string]
-		if err := rows.Scan(&rec.Key, &rec.Mode, &rec.WatermarkCreatedAt, &rec.WatermarkID,
+		var rec accountRecipient[profileKey]
+		if err := rows.Scan(&rec.Key.userID, &rec.Key.profileID, &rec.Mode, &rec.WatermarkCreatedAt, &rec.WatermarkID,
 			&rec.LastDigestAt, &rec.LastAttemptAt, &rec.ConsecutiveFailures); err != nil {
 			return nil, fmt.Errorf("scan email recipient: %w", err)
 		}
@@ -428,15 +429,15 @@ func (r *EmailPrefsRepository) ListActiveRecipients(ctx context.Context) ([]acco
 // SKIP LOCKED makes concurrent nodes pass over each other's in-flight
 // profiles instead of double-sending; (nil, nil) means another node holds
 // the row.
-func (r *EmailPrefsRepository) claimForUpdate(ctx context.Context, tx pgx.Tx, profileID string) (*accountRecipient[string], error) {
-	rec := accountRecipient[string]{Key: profileID}
+func (r *EmailPrefsRepository) claimForUpdate(ctx context.Context, tx pgx.Tx, key profileKey) (*accountRecipient[profileKey], error) {
+	rec := accountRecipient[profileKey]{Key: key}
 	err := tx.QueryRow(ctx, `
 		SELECT mode, watermark_created_at, watermark_id, last_digest_at,
 		       last_attempt_at, consecutive_failures
 		FROM notification_email_prefs
-		WHERE profile_id = $1
+		WHERE user_id = $1 AND profile_id = $2
 		FOR UPDATE SKIP LOCKED`,
-		profileID,
+		key.userID, key.profileID,
 	).Scan(&rec.Mode, &rec.WatermarkCreatedAt, &rec.WatermarkID,
 		&rec.LastDigestAt, &rec.LastAttemptAt, &rec.ConsecutiveFailures)
 	if errors.Is(err, pgx.ErrNoRows) {
@@ -449,33 +450,33 @@ func (r *EmailPrefsRepository) claimForUpdate(ctx context.Context, tx pgx.Tx, pr
 }
 
 // destinationForSend resolves where the locked profile's email goes — its
-// verified address — plus the row's owner and unsubscribe token. Read under
-// the claim so a mid-pass address removal fails cleanly instead of sending
-// to a stale recipient.
-func (r *EmailPrefsRepository) destinationForSend(ctx context.Context, tx pgx.Tx, profileID string) (email string, userID int, unsubscribeToken string, err error) {
+// verified address — plus its unsubscribe token. Read under the claim so a
+// mid-pass address removal fails cleanly instead of sending to a stale
+// recipient.
+func (r *EmailPrefsRepository) destinationForSend(ctx context.Context, tx pgx.Tx, key profileKey) (email string, unsubscribeToken string, err error) {
 	err = tx.QueryRow(ctx, `
-		SELECT p.custom_email, p.user_id, p.unsubscribe_token
+		SELECT p.custom_email, p.unsubscribe_token
 		FROM notification_email_prefs p
 		JOIN users u ON u.id = p.user_id AND u.enabled
-		WHERE p.profile_id = $1`,
-		profileID,
-	).Scan(&email, &userID, &unsubscribeToken)
+		WHERE p.user_id = $1 AND p.profile_id = $2`,
+		key.userID, key.profileID,
+	).Scan(&email, &unsubscribeToken)
 	if errors.Is(err, pgx.ErrNoRows) {
-		return "", 0, "", fmt.Errorf("profile %s has no usable account", profileID)
+		return "", "", fmt.Errorf("profile %s has no usable account", key)
 	}
 	if err != nil {
-		return "", 0, "", fmt.Errorf("resolve email destination: %w", err)
+		return "", "", fmt.Errorf("resolve email destination: %w", err)
 	}
-	return email, userID, unsubscribeToken, nil
+	return email, unsubscribeToken, nil
 }
 
 // setUnsubscribeToken backfills a missing unsubscribe token under the claim
 // lock (rows migrated from the account-level table start without one).
-func (r *EmailPrefsRepository) setUnsubscribeToken(ctx context.Context, tx pgx.Tx, profileID, token string) error {
+func (r *EmailPrefsRepository) setUnsubscribeToken(ctx context.Context, tx pgx.Tx, key profileKey, token string) error {
 	_, err := tx.Exec(ctx, `
-		UPDATE notification_email_prefs SET unsubscribe_token = $2, updated_at = now()
-		WHERE profile_id = $1 AND unsubscribe_token = ''`,
-		profileID, token)
+		UPDATE notification_email_prefs SET unsubscribe_token = $3, updated_at = now()
+		WHERE user_id = $1 AND profile_id = $2 AND unsubscribe_token = ''`,
+		key.userID, key.profileID, token)
 	if err != nil {
 		return fmt.Errorf("set unsubscribe token: %w", err)
 	}
@@ -485,17 +486,17 @@ func (r *EmailPrefsRepository) setUnsubscribeToken(ctx context.Context, tx pgx.T
 // markSent advances the watermark past everything the email covered and
 // resets failure backoff. digestAt is non-nil for digest sends (including
 // empty digests, so eligibility stops re-checking until tomorrow).
-func (r *EmailPrefsRepository) markSent(ctx context.Context, tx pgx.Tx, profileID string, watermark Cursor, digestAt *time.Time) error {
+func (r *EmailPrefsRepository) markSent(ctx context.Context, tx pgx.Tx, key profileKey, watermark Cursor, digestAt *time.Time) error {
 	_, err := tx.Exec(ctx, `
 		UPDATE notification_email_prefs SET
-			watermark_created_at = $2,
-			watermark_id = $3,
-			last_digest_at = COALESCE($4, last_digest_at),
+			watermark_created_at = $3,
+			watermark_id = $4,
+			last_digest_at = COALESCE($5, last_digest_at),
 			last_attempt_at = now(),
 			consecutive_failures = 0,
 			updated_at = now()
-		WHERE profile_id = $1`,
-		profileID, watermark.CreatedAt, watermark.ID, digestAt)
+		WHERE user_id = $1 AND profile_id = $2`,
+		key.userID, key.profileID, watermark.CreatedAt, watermark.ID, digestAt)
 	if err != nil {
 		return fmt.Errorf("mark email sent: %w", err)
 	}
@@ -504,14 +505,14 @@ func (r *EmailPrefsRepository) markSent(ctx context.Context, tx pgx.Tx, profileI
 
 // markFailure records a failed send for backoff; the watermark stays put so
 // the next eligible pass retries the same items.
-func (r *EmailPrefsRepository) markFailure(ctx context.Context, tx pgx.Tx, profileID string) error {
+func (r *EmailPrefsRepository) markFailure(ctx context.Context, tx pgx.Tx, key profileKey) error {
 	_, err := tx.Exec(ctx, `
 		UPDATE notification_email_prefs SET
 			last_attempt_at = now(),
 			consecutive_failures = consecutive_failures + 1,
 			updated_at = now()
-		WHERE profile_id = $1`,
-		profileID)
+		WHERE user_id = $1 AND profile_id = $2`,
+		key.userID, key.profileID)
 	if err != nil {
 		return fmt.Errorf("mark email failure: %w", err)
 	}
diff --git a/internal/notifications/email_verification_dispatch_test.go b/internal/notifications/email_verification_dispatch_test.go
index 5e62fff5fa..ffae54f3c1 100644
--- a/internal/notifications/email_verification_dispatch_test.go
+++ b/internal/notifications/email_verification_dispatch_test.go
@@ -235,7 +235,7 @@ func TestEmailVerificationDispatchAuthorizesUnderClaim(t *testing.T) {
 			}
 		}},
 		{"deleted", func(in EmailVerificationIntent) {
-			if err := repo.DeleteForProfile(ctx, in.ProfileID); err != nil {
+			if err := repo.DeleteForProfile(ctx, in.UserID, in.ProfileID); err != nil {
 				t.Fatal(err)
 			}
 		}},
diff --git a/internal/notifications/episode_key.go b/internal/notifications/episode_key.go
index 29b07f9c3e..bdc94c1202 100644
--- a/internal/notifications/episode_key.go
+++ b/internal/notifications/episode_key.go
@@ -23,6 +23,11 @@ func EpisodeKey(seasonNumber, episodeNumber int) int {
 	return seasonNumber*episodeKeySeasonMultiplier + episodeNumber
 }
 
+// SplitEpisodeKey is the inverse of EpisodeKey.
+func SplitEpisodeKey(key int) (seasonNumber, episodeNumber int) {
+	return key / episodeKeySeasonMultiplier, key % episodeKeySeasonMultiplier
+}
+
 // ValidEpisodeOrdinals reports whether the ordinals can be folded into an
 // episode key that fits in an int4 without collisions.
 func ValidEpisodeOrdinals(seasonNumber, episodeNumber int) bool {
diff --git a/internal/notifications/fanout_logic.go b/internal/notifications/fanout_logic.go
index 5a6003386b..eedb5b6ac1 100644
--- a/internal/notifications/fanout_logic.go
+++ b/internal/notifications/fanout_logic.go
@@ -22,14 +22,25 @@ func EvaluateRecipient(interest SeriesInterest, prefs Preferences, episodeKey in
 	if interest.LastNotifiedEpisodeKey != nil && *interest.LastNotifiedEpisodeKey >= episodeKey {
 		return ReasonFlags{}, false
 	}
-	flags := ReasonFlags{
+	flags := ActiveReasons(interest, prefs)
+	flags.NextUp = flags.NextUp && episodeKey >= *interest.NextExpectedEpisodeKey
+	return flags, flags.Any()
+}
+
+// ActiveReasons is the part of the eligibility rules that does not depend on
+// a release event: the interest reasons the profile's preferences let notify.
+// A Next Up reason counts only once the row knows the episode it waits for;
+// EvaluateRecipient then matches it against each event's episode key.
+func ActiveReasons(interest SeriesInterest, prefs Preferences) ReasonFlags {
+	if !prefs.Enabled {
+		return ReasonFlags{}
+	}
+	return ReasonFlags{
 		Favorite:         interest.Favorite && prefs.NotifyFavorites,
 		Watchlist:        interest.Watchlist && prefs.NotifyWatchlist,
 		ContinueWatching: interest.ContinueWatching && prefs.NotifyContinueWatching,
-		NextUp: interest.NextUpCandidate && prefs.NotifyNextUp &&
-			interest.NextExpectedEpisodeKey != nil && episodeKey >= *interest.NextExpectedEpisodeKey,
+		NextUp:           interest.NextUpCandidate && prefs.NotifyNextUp && interest.NextExpectedEpisodeKey != nil,
 	}
-	return flags, flags.Any()
 }
 
 // PartitionEventsByKind splits claimed events into episode events (which fan
diff --git a/internal/notifications/fanout_logic_test.go b/internal/notifications/fanout_logic_test.go
index db54d63556..e79bfdde4b 100644
--- a/internal/notifications/fanout_logic_test.go
+++ b/internal/notifications/fanout_logic_test.go
@@ -2,6 +2,7 @@ package notifications
 
 import (
 	"context"
+	"strings"
 	"testing"
 	"time"
 )
@@ -43,7 +44,7 @@ func TestValidEpisodeOrdinals(t *testing.T) {
 }
 
 func TestEvaluateRecipientReasons(t *testing.T) {
-	prefs := DefaultPreferences("p1")
+	prefs := DefaultPreferences(1, "p1")
 	episodeKey := EpisodeKey(2, 5)
 
 	t.Run("favorite matches", func(t *testing.T) {
@@ -94,12 +95,12 @@ func TestEvaluateRecipientReasons(t *testing.T) {
 	})
 
 	t.Run("preferences are a hard gate", func(t *testing.T) {
-		disabled := DefaultPreferences("p1")
+		disabled := DefaultPreferences(1, "p1")
 		disabled.NotifyFavorites = false
 		if _, ok := EvaluateRecipient(SeriesInterest{Favorite: true}, disabled, episodeKey); ok {
 			t.Fatal("disabled reason must not produce a delivery")
 		}
-		killSwitch := DefaultPreferences("p1")
+		killSwitch := DefaultPreferences(1, "p1")
 		killSwitch.Enabled = false
 		interest := SeriesInterest{Favorite: true, Watchlist: true, ContinueWatching: true}
 		if _, ok := EvaluateRecipient(interest, killSwitch, episodeKey); ok {
@@ -108,6 +109,45 @@ func TestEvaluateRecipientReasons(t *testing.T) {
 	})
 }
 
+func TestSplitEpisodeKeyInvertsEpisodeKey(t *testing.T) {
+	for _, c := range [][2]int{{0, 0}, {1, 2}, {2, 999999}, {12, 10500}} {
+		if season, episode := SplitEpisodeKey(EpisodeKey(c[0], c[1])); season != c[0] || episode != c[1] {
+			t.Errorf("SplitEpisodeKey(EpisodeKey(%d, %d)) = %d, %d", c[0], c[1], season, episode)
+		}
+	}
+}
+
+func TestReasonFlagsHas(t *testing.T) {
+	f := ReasonFlags{Watchlist: true, NextUp: true}
+	for reason, want := range map[string]bool{ReasonFavorite: false, ReasonWatchlist: true, ReasonContinueWatching: false, ReasonNextUp: true, "other": false} {
+		if got := f.Has(reason); got != want {
+			t.Errorf("Has(%q) = %v, want %v", reason, got, want)
+		}
+	}
+}
+
+// ActiveReasons is the event-independent half of EvaluateRecipient: the
+// reasons preferences let notify, with Next Up needing a known episode.
+func TestActiveReasons(t *testing.T) {
+	key := EpisodeKey(1, 4)
+	all := SeriesInterest{Favorite: true, Watchlist: true, ContinueWatching: true, NextUpCandidate: true, NextExpectedEpisodeKey: &key}
+	prefs := DefaultPreferences(1, "p")
+	if got := ActiveReasons(all, prefs); got != (ReasonFlags{Favorite: true, Watchlist: true, ContinueWatching: true, NextUp: true}) {
+		t.Errorf("all enabled = %+v", got)
+	}
+	prefs.NotifyWatchlist = false
+	if got := ActiveReasons(all, prefs); got.Watchlist || !got.Favorite {
+		t.Errorf("watchlist off = %+v", got)
+	}
+	if got := ActiveReasons(SeriesInterest{NextUpCandidate: true}, prefs); got.Any() {
+		t.Errorf("next up without an expected episode = %+v", got)
+	}
+	prefs.Enabled = false
+	if got := ActiveReasons(all, prefs); got.Any() {
+		t.Errorf("disabled = %+v", got)
+	}
+}
+
 func TestApplyBurstCap(t *testing.T) {
 	event := func(library int, series string, key int) ReleaseEvent {
 		return ReleaseEvent{
@@ -194,20 +234,32 @@ func TestMemoryTicketStore(t *testing.T) {
 	store := NewTicketStore(nil)
 	ctx := context.Background()
 
-	ticket, ttl, err := store.Mint(ctx, 7, "profile-1")
+	minted := Ticket{UserID: 7, ProfileID: "profile-1", ProfileToken: "proof"}
+	ticket, ttl, err := store.Mint(ctx, minted)
 	if err != nil || ticket == "" || ttl <= 0 {
 		t.Fatalf("mint failed: %q %v %v", ticket, ttl, err)
 	}
 
-	userID, profileID, ok := store.Consume(ctx, ticket)
-	if !ok || userID != 7 || profileID != "profile-1" {
-		t.Fatalf("consume returned %d %q %v", userID, profileID, ok)
+	binding, ok := store.Consume(ctx, ticket)
+	if !ok || binding != minted {
+		t.Fatalf("consume returned %+v %v", binding, ok)
 	}
 
-	if _, _, ok := store.Consume(ctx, ticket); ok {
+	if _, ok := store.Consume(ctx, ticket); ok {
 		t.Fatal("tickets must be single-use")
 	}
-	if _, _, ok := store.Consume(ctx, "unknown"); ok {
+	if _, ok := store.Consume(ctx, "unknown"); ok {
 		t.Fatal("unknown tickets must be rejected")
 	}
+
+	// A token no signed one could be is not kept: the viewer gate does not
+	// read X-Profile-Token for a profile without a PIN.
+	oversized := Ticket{UserID: 7, ProfileID: "profile-1", ProfileToken: strings.Repeat("x", maxTicketProofBytes+1)}
+	ticket, _, err = store.Mint(ctx, oversized)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if binding, ok := store.Consume(ctx, ticket); !ok || binding != (Ticket{UserID: 7, ProfileID: "profile-1"}) {
+		t.Fatalf("oversized proof consumed as %+v %v", binding, ok)
+	}
 }
diff --git a/internal/notifications/fanout_snapshot_test.go b/internal/notifications/fanout_snapshot_test.go
index 6f20da29b2..0d49db728d 100644
--- a/internal/notifications/fanout_snapshot_test.go
+++ b/internal/notifications/fanout_snapshot_test.go
@@ -3,13 +3,15 @@ package notifications
 import "testing"
 
 func TestCapturedFanoutCandidatesPreserveCursorAdvances(t *testing.T) {
-	captured := map[string]struct{}{"captured": {}}
+	captured := map[profileKey]struct{}{{1, "captured"}: {}}
 	refreshed := []SeriesInterest{
-		{ProfileID: "new-profile", Favorite: true},
-		{ProfileID: "captured", Favorite: true, LastNotifiedEpisodeKey: new(20)},
+		{UserID: 1, ProfileID: "new-profile", Favorite: true},
+		{UserID: 1, ProfileID: "captured", Favorite: true, LastNotifiedEpisodeKey: new(20)},
+		// The same profile ID on another account was not captured.
+		{UserID: 2, ProfileID: "captured", Favorite: true},
 	}
 	candidates := capturedFanoutCandidates(refreshed, captured)
-	if len(candidates) != 1 || candidates[0].ProfileID != "captured" {
+	if len(candidates) != 1 || candidates[0].UserID != 1 || candidates[0].ProfileID != "captured" {
 		t.Fatalf("refreshed recipients escaped captured profile set: %+v", candidates)
 	}
 	prefs := Preferences{Enabled: true, NotifyFavorites: true}
@@ -24,7 +26,7 @@ func TestCapturedFanoutCandidatesPreserveCursorAdvances(t *testing.T) {
 }
 
 func TestCapturedFanoutCandidatesDoNotRestoreRemovedInterest(t *testing.T) {
-	candidates := capturedFanoutCandidates([]SeriesInterest{{ProfileID: "new-profile", Favorite: true}}, map[string]struct{}{"removed": {}})
+	candidates := capturedFanoutCandidates([]SeriesInterest{{UserID: 1, ProfileID: "new-profile", Favorite: true}}, map[profileKey]struct{}{{1, "removed"}: {}})
 	if len(candidates) != 0 {
 		t.Fatalf("new or removed interest entered batch: %+v", candidates)
 	}
diff --git a/internal/notifications/fanout_worker.go b/internal/notifications/fanout_worker.go
index 34ee45fa43..78974e417e 100644
--- a/internal/notifications/fanout_worker.go
+++ b/internal/notifications/fanout_worker.go
@@ -223,20 +223,20 @@ func (w *FanoutWorker) processBatch(ctx context.Context) (processed int, runErr
 	// under the locks would not close the gap before commit. A delivery
 	// created in that gap is like one created just before the change.
 	recipients := newRecipientAccess(w.scopes)
-	candidatesByEvent := make(map[string]map[string]struct{}, len(fanout))
+	candidatesByEvent := make(map[string]map[profileKey]struct{}, len(fanout))
 	profiles := make(map[string]struct{})
 	for _, event := range fanout {
 		candidates, err := w.interests.ListActiveBySeries(ctx, tx, event.LibraryID, event.SeriesID)
 		if err != nil {
 			return 0, err
 		}
-		prefs, err := w.preferences.GetMany(ctx, tx, candidateProfileIDs(candidates))
+		prefs, err := w.preferences.GetMany(ctx, tx, candidateProfiles(candidates))
 		if err != nil {
 			return 0, err
 		}
-		captured := make(map[string]struct{}, len(candidates))
+		captured := make(map[profileKey]struct{}, len(candidates))
 		for _, candidate := range candidates {
-			if _, eligible := EvaluateRecipient(candidate, prefs[candidate.ProfileID], event.EpisodeKey); !eligible {
+			if _, eligible := EvaluateRecipient(candidate, prefs[candidate.key()], event.EpisodeKey); !eligible {
 				continue
 			}
 			allowed, err := recipients.canOpen(ctx, tx, candidate.UserID, candidate.ProfileID, event.EpisodeID, event.LibraryID)
@@ -246,7 +246,7 @@ func (w *FanoutWorker) processBatch(ctx context.Context) (processed int, runErr
 			if !allowed {
 				continue
 			}
-			captured[candidate.ProfileID] = struct{}{}
+			captured[candidate.key()] = struct{}{}
 			profiles[candidate.ProfileID] = struct{}{}
 		}
 		candidatesByEvent[event.ID] = captured
@@ -300,7 +300,7 @@ func (w *FanoutWorker) processBatch(ctx context.Context) (processed int, runErr
 // fanOutEvent resolves recipients for one release event and inserts
 // deliveries. Returns dispatch payloads for the rows actually inserted and
 // the candidate recipient count.
-func (w *FanoutWorker) fanOutEvent(ctx context.Context, tx pgx.Tx, event ReleaseEvent, capturedProfiles map[string]struct{}) ([]DeliveryRow, int, error) {
+func (w *FanoutWorker) fanOutEvent(ctx context.Context, tx pgx.Tx, event ReleaseEvent, capturedProfiles map[profileKey]struct{}) ([]DeliveryRow, int, error) {
 	candidates, err := w.interests.ListActiveBySeries(ctx, tx, event.LibraryID, event.SeriesID)
 	if err != nil {
 		return nil, 0, err
@@ -313,15 +313,15 @@ func (w *FanoutWorker) fanOutEvent(ctx context.Context, tx pgx.Tx, event Release
 		return nil, 0, nil
 	}
 
-	prefs, err := w.preferences.GetMany(ctx, tx, candidateProfileIDs(candidates))
+	prefs, err := w.preferences.GetMany(ctx, tx, candidateProfiles(candidates))
 	if err != nil {
 		return nil, 0, err
 	}
 
-	pending := make(map[string]pendingDelivery, len(candidates))
+	pending := make(map[profileKey]pendingDelivery, len(candidates))
 	toInsert := make([]Delivery, 0, len(candidates))
 	for _, candidate := range candidates {
-		flags, eligible := EvaluateRecipient(candidate, prefs[candidate.ProfileID], event.EpisodeKey)
+		flags, eligible := EvaluateRecipient(candidate, prefs[candidate.key()], event.EpisodeKey)
 		if !eligible {
 			continue
 		}
@@ -344,7 +344,7 @@ func (w *FanoutWorker) fanOutEvent(ctx context.Context, tx pgx.Tx, event Release
 			Type:           DeliveryTypeEpisodeAvailable,
 			ReasonFlags:    flagsJSON,
 		}
-		pending[candidate.ProfileID] = pendingDelivery{delivery: delivery, flags: flags}
+		pending[candidate.key()] = pendingDelivery{delivery: delivery, flags: flags}
 		toInsert = append(toInsert, delivery)
 	}
 	if len(toInsert) == 0 {
@@ -368,9 +368,9 @@ func (w *FanoutWorker) fanOutEvent(ctx context.Context, tx pgx.Tx, event Release
 		return nil, 0, err
 	}
 
-	notifiedProfiles := make([]string, 0, len(inserted))
+	notifiedProfiles := make([]profileKey, 0, len(inserted))
 	for _, row := range inserted {
-		notifiedProfiles = append(notifiedProfiles, row.ProfileID)
+		notifiedProfiles = append(notifiedProfiles, row.key())
 	}
 	if err := w.interests.GuardedSetLastNotified(ctx, tx, event.LibraryID, event.SeriesID, event.EpisodeKey, notifiedProfiles); err != nil {
 		return nil, 0, err
@@ -382,7 +382,7 @@ func (w *FanoutWorker) fanOutEvent(ctx context.Context, tx pgx.Tx, event Release
 	}
 	dispatchRows := make([]DeliveryRow, 0, len(inserted))
 	for _, row := range inserted {
-		entry, ok := pending[row.ProfileID]
+		entry, ok := pending[row.key()]
 		if !ok {
 			continue
 		}
@@ -412,6 +412,23 @@ type pendingDelivery struct {
 	flags    ReasonFlags
 }
 
+// insertedProfileKeys lists the distinct account/profile pairs of the
+// inserted deliveries. Channel targets are looked up by both: profile IDs
+// repeat across accounts, and one account's delivery must not reach another
+// account's devices or webhooks.
+func insertedProfileKeys(inserted []InsertedDelivery) []profileKey {
+	seen := make(map[profileKey]struct{}, len(inserted))
+	keys := make([]profileKey, 0, len(inserted))
+	for _, row := range inserted {
+		key := row.key()
+		if _, ok := seen[key]; !ok {
+			seen[key] = struct{}{}
+			keys = append(keys, key)
+		}
+	}
+	return keys
+}
+
 // enqueuePushOutbox inserts pending push attempt rows for each newly inserted
 // delivery and enabled private-push device on every admin-enabled platform
 // (Apple and Android).
@@ -423,21 +440,13 @@ func (w *FanoutWorker) enqueuePushOutbox(ctx context.Context, tx pgx.Tx, inserte
 	if len(platforms) == 0 {
 		return nil
 	}
-	profileSet := make(map[string]struct{}, len(inserted))
-	profileIDs := make([]string, 0, len(inserted))
-	for _, row := range inserted {
-		if _, ok := profileSet[row.ProfileID]; !ok {
-			profileSet[row.ProfileID] = struct{}{}
-			profileIDs = append(profileIDs, row.ProfileID)
-		}
-	}
-	devicesByProfile, err := w.pushDevices.ListEnabledPushByProfiles(ctx, tx, profileIDs, platforms)
+	devicesByProfile, err := w.pushDevices.ListEnabledPushByProfiles(ctx, tx, insertedProfileKeys(inserted), platforms)
 	if err != nil {
 		return err
 	}
 	attempts := make([]PushDeliveryAttempt, 0, len(inserted))
 	for _, row := range inserted {
-		attempts = append(attempts, newPushDeliveryAttempts(row.ID, devicesByProfile[row.ProfileID])...)
+		attempts = append(attempts, newPushDeliveryAttempts(row.ID, devicesByProfile[row.key()])...)
 	}
 	return w.pushDevices.EnqueuePushAttempts(ctx, tx, attempts)
 }
@@ -450,21 +459,13 @@ func (w *FanoutWorker) enqueueWebPushOutbox(ctx context.Context, tx pgx.Tx, inse
 	if w.webPush == nil || len(inserted) == 0 || !w.settings.WebPushEnabled(ctx) {
 		return nil
 	}
-	profileSet := make(map[string]struct{}, len(inserted))
-	profileIDs := make([]string, 0, len(inserted))
-	for _, row := range inserted {
-		if _, ok := profileSet[row.ProfileID]; !ok {
-			profileSet[row.ProfileID] = struct{}{}
-			profileIDs = append(profileIDs, row.ProfileID)
-		}
-	}
-	subsByProfile, err := w.webPush.ListEnabledByProfiles(ctx, tx, profileIDs)
+	subsByProfile, err := w.webPush.ListEnabledByProfiles(ctx, tx, insertedProfileKeys(inserted))
 	if err != nil {
 		return err
 	}
 	attempts := make([]DeliveryAttempt, 0, len(inserted))
 	for _, row := range inserted {
-		for _, sub := range subsByProfile[row.ProfileID] {
+		for _, sub := range subsByProfile[row.key()] {
 			attempts = append(attempts, DeliveryAttempt{
 				ID:                     ulid.Make().String(),
 				NotificationDeliveryID: row.ID,
@@ -479,19 +480,11 @@ func (w *FanoutWorker) enqueueWebPushOutbox(ctx context.Context, tx pgx.Tx, inse
 // inserted delivery, inside the fanout transaction. Two filters apply:
 // per-webhook reason flags, and the per-profile delivery rate limit
 // (over-limit notifications stay in the inbox; webhooks just don't fire).
-func (w *FanoutWorker) enqueueWebhookOutbox(ctx context.Context, tx pgx.Tx, inserted []InsertedDelivery, pending map[string]pendingDelivery) error {
+func (w *FanoutWorker) enqueueWebhookOutbox(ctx context.Context, tx pgx.Tx, inserted []InsertedDelivery, pending map[profileKey]pendingDelivery) error {
 	if w.webhooks == nil || len(inserted) == 0 || !w.settings.WebhooksEnabled(ctx) {
 		return nil
 	}
-	profileSet := make(map[string]struct{}, len(inserted))
-	profileIDs := make([]string, 0, len(inserted))
-	for _, row := range inserted {
-		if _, ok := profileSet[row.ProfileID]; !ok {
-			profileSet[row.ProfileID] = struct{}{}
-			profileIDs = append(profileIDs, row.ProfileID)
-		}
-	}
-	hooksByProfile, err := w.webhooks.ListEnabledByProfiles(ctx, tx, profileIDs)
+	hooksByProfile, err := w.webhooks.ListEnabledByProfiles(ctx, tx, insertedProfileKeys(inserted))
 	if err != nil {
 		return err
 	}
@@ -500,15 +493,16 @@ func (w *FanoutWorker) enqueueWebhookOutbox(ctx context.Context, tx pgx.Tx, inse
 	attempts := make([]DeliveryAttempt, 0, len(inserted))
 	rateLimited := 0
 	for _, row := range inserted {
-		entry, ok := pending[row.ProfileID]
+		key := row.key()
+		entry, ok := pending[key]
 		if !ok {
 			continue
 		}
-		for _, hook := range hooksByProfile[row.ProfileID] {
+		for _, hook := range hooksByProfile[key] {
 			if !hook.MatchesReasons(entry.flags) {
 				continue
 			}
-			if w.rateLimiter != nil && !w.rateLimiter.Allow(row.ProfileID, rateLimit) {
+			if w.rateLimiter != nil && !w.rateLimiter.Allow(key, rateLimit) {
 				rateLimited++
 				continue
 			}
@@ -564,21 +558,21 @@ func eventIDs(events []ReleaseEvent) []string {
 	return ids
 }
 
-func candidateProfileIDs(candidates []SeriesInterest) []string {
-	ids := make([]string, 0, len(candidates))
+func candidateProfiles(candidates []SeriesInterest) []profileKey {
+	keys := make([]profileKey, 0, len(candidates))
 	for _, candidate := range candidates {
-		ids = append(ids, candidate.ProfileID)
+		keys = append(keys, candidate.key())
 	}
-	return ids
+	return keys
 }
 
 // capturedFanoutCandidates retains refreshed state without admitting profiles
 // whose inbox locks were not included in the transaction-wide acquisition,
 // which also leaves out every candidate that was ineligible or failed the
 // access check when the batch was captured.
-func capturedFanoutCandidates(candidates []SeriesInterest, captured map[string]struct{}) []SeriesInterest {
+func capturedFanoutCandidates(candidates []SeriesInterest, captured map[profileKey]struct{}) []SeriesInterest {
 	return slices.DeleteFunc(candidates, func(candidate SeriesInterest) bool {
-		_, ok := captured[candidate.ProfileID]
+		_, ok := captured[candidate.key()]
 		return !ok
 	})
 }
diff --git a/internal/notifications/home_hides_test.go b/internal/notifications/home_hides_test.go
index c03789ace2..6c043dac48 100644
--- a/internal/notifications/home_hides_test.go
+++ b/internal/notifications/home_hides_test.go
@@ -501,7 +501,7 @@ func TestRecomputeSeriesFollowsHomeRemovalsPostgres(t *testing.T) {
 	}
 	setProgress(episodes[0], true, watchedAt)
 	setProgress(episodes[1], false, watchedAt)
-	if err := store.AddFavorite(ctx, profileID, seriesID); err != nil {
+	if _, err := store.AddFavorite(ctx, profileID, seriesID); err != nil {
 		t.Fatalf("AddFavorite: %v", err)
 	}
 
diff --git a/internal/notifications/inbox_pages.go b/internal/notifications/inbox_pages.go
index 2e508d2ce8..2fe7d4cd55 100644
--- a/internal/notifications/inbox_pages.go
+++ b/internal/notifications/inbox_pages.go
@@ -10,16 +10,16 @@ import (
 
 // InboxCutoff captures the newest committed delivery currently visible to this
 // profile. An empty cursor describes an empty inbox and remains a no-op cutoff.
-func (r *DeliveryRepository) InboxCutoff(ctx context.Context, profileID string) (Cursor, error) {
+func (r *DeliveryRepository) InboxCutoff(ctx context.Context, userID int, profileID string) (Cursor, error) {
 	var cursor Cursor
-	err := r.pool.QueryRow(ctx, `SELECT created_at,id FROM notification_deliveries WHERE profile_id=$1 ORDER BY created_at DESC,id DESC LIMIT 1`, profileID).Scan(&cursor.CreatedAt, &cursor.ID)
+	err := r.pool.QueryRow(ctx, `SELECT created_at,id FROM notification_deliveries WHERE user_id = $1 AND profile_id = $2 ORDER BY created_at DESC,id DESC LIMIT 1`, userID, profileID).Scan(&cursor.CreatedAt, &cursor.ID)
 	if errors.Is(err, pgx.ErrNoRows) {
 		return Cursor{}, nil
 	}
 	return cursor, err
 }
 
-func (r *DeliveryRepository) ListInboxWindow(ctx context.Context, profileID string, unread bool, limit int, before *Cursor, through Cursor) ([]DeliveryRow, bool, error) {
+func (r *DeliveryRepository) ListInboxWindow(ctx context.Context, userID int, profileID string, unread bool, limit int, before *Cursor, through Cursor) ([]DeliveryRow, bool, error) {
 	limit = max(1, min(limit, 200))
 	if through.ID == "" {
 		return []DeliveryRow{}, false, nil
@@ -30,7 +30,7 @@ func (r *DeliveryRepository) ListInboxWindow(ctx context.Context, profileID stri
 		beforeTime = before.CreatedAt
 		beforeID = before.ID
 	}
-	rows, err := r.pool.Query(ctx, deliveryRowSelect+` WHERE d.profile_id=$1 AND (NOT $2 OR d.read_at IS NULL) AND (d.created_at,d.id)<=($3,$4) AND ($5::timestamptz IS NULL OR (d.created_at,d.id)<($5,$6)) ORDER BY d.created_at DESC,d.id DESC LIMIT $7`, profileID, unread, through.CreatedAt, through.ID, beforeTime, beforeID, limit+1)
+	rows, err := r.pool.Query(ctx, deliveryRowSelect+` WHERE d.user_id = $1 AND d.profile_id = $2 AND (NOT $3 OR d.read_at IS NULL) AND (d.created_at,d.id)<=($4,$5) AND ($6::timestamptz IS NULL OR (d.created_at,d.id)<($6,$7)) ORDER BY d.created_at DESC,d.id DESC LIMIT $8`, userID, profileID, unread, through.CreatedAt, through.ID, beforeTime, beforeID, limit+1)
 	if err != nil {
 		return nil, false, err
 	}
@@ -46,11 +46,11 @@ func (r *DeliveryRepository) ListInboxWindow(ctx context.Context, profileID stri
 }
 
 // MarkReadThrough never expands the target when the same command is retried.
-func (r *DeliveryRepository) MarkReadThrough(ctx context.Context, profileID string, through Cursor) (int64, error) {
+func (r *DeliveryRepository) MarkReadThrough(ctx context.Context, userID int, profileID string, through Cursor) (int64, error) {
 	if through.ID == "" {
 		return 0, nil
 	}
-	tag, err := r.pool.Exec(ctx, `UPDATE notification_deliveries SET read_at=now() WHERE profile_id=$1 AND read_at IS NULL AND (created_at,id)<=($2,$3)`, profileID, through.CreatedAt, through.ID)
+	tag, err := r.pool.Exec(ctx, `UPDATE notification_deliveries SET read_at=now() WHERE user_id = $1 AND profile_id = $2 AND read_at IS NULL AND (created_at,id)<=($3,$4)`, userID, profileID, through.CreatedAt, through.ID)
 	if err != nil {
 		return 0, fmt.Errorf("mark notification cutoff read: %w", err)
 	}
@@ -66,8 +66,8 @@ type PreferencePatch struct {
 	NotifyNextUp           *bool
 }
 
-func (r *PreferencesRepository) Patch(ctx context.Context, profileID string, p PreferencePatch) (Preferences, error) {
-	prefs := DefaultPreferences(profileID)
-	err := r.pool.QueryRow(ctx, `INSERT INTO notification_preferences(profile_id,enabled,notify_favorites,notify_watchlist,notify_continue_watching,notify_next_up,updated_at) VALUES($1,COALESCE($2,true),COALESCE($3,true),COALESCE($4,true),COALESCE($5,true),COALESCE($6,true),now()) ON CONFLICT(profile_id) DO UPDATE SET enabled=COALESCE($2,notification_preferences.enabled),notify_favorites=COALESCE($3,notification_preferences.notify_favorites),notify_watchlist=COALESCE($4,notification_preferences.notify_watchlist),notify_continue_watching=COALESCE($5,notification_preferences.notify_continue_watching),notify_next_up=COALESCE($6,notification_preferences.notify_next_up),updated_at=now() RETURNING enabled,notify_favorites,notify_watchlist,notify_continue_watching,notify_next_up,updated_at`, profileID, p.Enabled, p.NotifyFavorites, p.NotifyWatchlist, p.NotifyContinueWatching, p.NotifyNextUp).Scan(&prefs.Enabled, &prefs.NotifyFavorites, &prefs.NotifyWatchlist, &prefs.NotifyContinueWatching, &prefs.NotifyNextUp, &prefs.UpdatedAt)
+func (r *PreferencesRepository) Patch(ctx context.Context, userID int, profileID string, p PreferencePatch) (Preferences, error) {
+	prefs := DefaultPreferences(userID, profileID)
+	err := r.pool.QueryRow(ctx, `INSERT INTO notification_preferences(user_id,profile_id,enabled,notify_favorites,notify_watchlist,notify_continue_watching,notify_next_up,updated_at) VALUES($1,$2,COALESCE($3,true),COALESCE($4,true),COALESCE($5,true),COALESCE($6,true),COALESCE($7,true),now()) ON CONFLICT(user_id,profile_id) DO UPDATE SET enabled=COALESCE($3,notification_preferences.enabled),notify_favorites=COALESCE($4,notification_preferences.notify_favorites),notify_watchlist=COALESCE($5,notification_preferences.notify_watchlist),notify_continue_watching=COALESCE($6,notification_preferences.notify_continue_watching),notify_next_up=COALESCE($7,notification_preferences.notify_next_up),updated_at=now() RETURNING enabled,notify_favorites,notify_watchlist,notify_continue_watching,notify_next_up,updated_at`, userID, profileID, p.Enabled, p.NotifyFavorites, p.NotifyWatchlist, p.NotifyContinueWatching, p.NotifyNextUp).Scan(&prefs.Enabled, &prefs.NotifyFavorites, &prefs.NotifyWatchlist, &prefs.NotifyContinueWatching, &prefs.NotifyNextUp, &prefs.UpdatedAt)
 	return prefs, err
 }
diff --git a/internal/notifications/inbox_pages_test.go b/internal/notifications/inbox_pages_test.go
index 63ff9d989f..4716548732 100644
--- a/internal/notifications/inbox_pages_test.go
+++ b/internal/notifications/inbox_pages_test.go
@@ -17,6 +17,36 @@ import (
 )
 
 func inboxPageDB(t *testing.T) *pgxpool.Pool {
+	t.Helper()
+	p := schemaDB(t, "notification_inbox_")
+	if _, err := p.Exec(t.Context(), `CREATE TABLE notification_deliveries (LIKE public.notification_deliveries INCLUDING ALL); CREATE TABLE notification_preferences (LIKE public.notification_preferences INCLUDING ALL)`); err != nil {
+		t.Fatal(err)
+	}
+	// LIKE does not copy triggers. Apply the actual migration in this schema so
+	// concurrency tests exercise the production ordering boundary.
+	migration, err := os.ReadFile("../../migrations/sql/20260906014006_serialize_notification_inbox_order.sql")
+	if err != nil {
+		t.Fatal(err)
+	}
+	up, _, _ := strings.Cut(string(migration), "-- +goose Down")
+	tx, err := p.Begin(t.Context())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = tx.Rollback(context.WithoutCancel(t.Context())) }()
+	if _, err := tx.Exec(t.Context(), up); err != nil {
+		t.Fatal(err)
+	}
+	if err := tx.Commit(t.Context()); err != nil {
+		t.Fatal(err)
+	}
+	return p
+}
+
+// schemaDB connects to the test database with a fresh schema, dropped after
+// the test, first on the search path: tables a test creates there shadow
+// public's, and the rest of the schema stays visible.
+func schemaDB(t *testing.T, prefix string) *pgxpool.Pool {
 	t.Helper()
 	dsn := envutil.Getenv("SILO_TEST_DATABASE_URL")
 	if dsn == "" {
@@ -26,7 +56,7 @@ func inboxPageDB(t *testing.T) *pgxpool.Pool {
 	if err != nil {
 		t.Fatal(err)
 	}
-	schema := "notification_inbox_" + strings.ReplaceAll(uuid.NewString(), "-", "")
+	schema := prefix + strings.ReplaceAll(uuid.NewString(), "-", "")
 	quoted := pgx.Identifier{schema}.Sanitize()
 	if _, err = admin.Exec(t.Context(), "CREATE SCHEMA "+quoted); err != nil {
 		t.Fatal(err)
@@ -46,27 +76,6 @@ func inboxPageDB(t *testing.T) *pgxpool.Pool {
 		t.Fatal(err)
 	}
 	t.Cleanup(p.Close)
-	if _, err = p.Exec(t.Context(), `CREATE TABLE notification_deliveries (LIKE public.notification_deliveries INCLUDING ALL); CREATE TABLE notification_preferences (LIKE public.notification_preferences INCLUDING ALL)`); err != nil {
-		t.Fatal(err)
-	}
-	// LIKE does not copy triggers. Apply the actual migration in this schema so
-	// concurrency tests exercise the production ordering boundary.
-	migration, err := os.ReadFile("../../migrations/sql/20260906014006_serialize_notification_inbox_order.sql")
-	if err != nil {
-		t.Fatal(err)
-	}
-	up, _, _ := strings.Cut(string(migration), "-- +goose Down")
-	tx, err := p.Begin(t.Context())
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer func() { _ = tx.Rollback(context.WithoutCancel(t.Context())) }()
-	if _, err := tx.Exec(t.Context(), up); err != nil {
-		t.Fatal(err)
-	}
-	if err := tx.Commit(t.Context()); err != nil {
-		t.Fatal(err)
-	}
 	return p
 }
 func TestNotificationInboxCutoffReplayAndTies(t *testing.T) {
@@ -94,21 +103,21 @@ func TestNotificationInboxCutoffReplayAndTies(t *testing.T) {
 		t.Fatal(err)
 	}
 	insert(uuid.NewString(), other, stamp)
-	cutoff, err := r.InboxCutoff(ctx, profile)
+	cutoff, err := r.InboxCutoff(ctx, 1, profile)
 	if err != nil || cutoff.ID != high {
 		t.Fatalf("%+v %v", cutoff, err)
 	}
-	first, more, err := r.ListInboxWindow(ctx, profile, false, 1, nil, cutoff)
+	first, more, err := r.ListInboxWindow(ctx, 1, profile, false, 1, nil, cutoff)
 	if err != nil || len(first) != 1 || !more || first[0].ID != high {
 		t.Fatalf("%+v %v %v", first, more, err)
 	}
 	insert(fresh, profile, stamp.Add(time.Microsecond))
-	second, more, err := r.ListInboxWindow(ctx, profile, false, 1, &Cursor{CreatedAt: first[0].CreatedAt, ID: first[0].ID}, cutoff)
+	second, more, err := r.ListInboxWindow(ctx, 1, profile, false, 1, &Cursor{CreatedAt: first[0].CreatedAt, ID: first[0].ID}, cutoff)
 	if err != nil || len(second) != 1 || more || second[0].ID != low {
 		t.Fatalf("%+v %v %v", second, more, err)
 	}
 	for n := range 2 {
-		changed, err := r.MarkReadThrough(ctx, profile, cutoff)
+		changed, err := r.MarkReadThrough(ctx, 1, profile, cutoff)
 		if err != nil || changed != int64(2*(1-n)) {
 			t.Fatalf("changed=%d err=%v", changed, err)
 		}
@@ -117,16 +126,16 @@ func TestNotificationInboxCutoffReplayAndTies(t *testing.T) {
 		profile string
 		want    int
 	}{{profile, 1}, {other, 1}} {
-		count, err := r.UnreadCount(ctx, check.profile)
+		count, err := r.UnreadCount(ctx, 1, check.profile)
 		if err != nil || count != check.want {
 			t.Fatalf("count=%d err=%v", count, err)
 		}
 	}
-	empty, err := r.InboxCutoff(ctx, uuid.NewString())
+	empty, err := r.InboxCutoff(ctx, 1, uuid.NewString())
 	if err != nil || empty.ID != "" {
 		t.Fatal(empty, err)
 	}
-	if changed, err := r.MarkReadThrough(ctx, profile, empty); err != nil || changed != 0 {
+	if changed, err := r.MarkReadThrough(ctx, 1, profile, empty); err != nil || changed != 0 {
 		t.Fatal(changed, err)
 	}
 }
@@ -137,7 +146,7 @@ func TestNotificationPreferencePatchConcurrentFields(t *testing.T) {
 	var wg sync.WaitGroup
 	errs := make(chan error, 2)
 	for _, patch := range []PreferencePatch{{Enabled: new(false)}, {NotifyFavorites: new(false)}} {
-		wg.Go(func() { _, err := r.Patch(t.Context(), profile, patch); errs <- err })
+		wg.Go(func() { _, err := r.Patch(t.Context(), 1, profile, patch); errs <- err })
 	}
 	wg.Wait()
 	close(errs)
@@ -146,7 +155,7 @@ func TestNotificationPreferencePatchConcurrentFields(t *testing.T) {
 			t.Fatal(err)
 		}
 	}
-	value, err := r.Get(t.Context(), profile)
+	value, err := r.Get(t.Context(), 1, profile)
 	if err != nil || value.Enabled || value.NotifyFavorites || !value.NotifyWatchlist || !value.NotifyNextUp {
 		t.Fatalf("%+v %v", value, err)
 	}
@@ -179,7 +188,7 @@ func TestNotificationInboxEarlierTransactionCommitsAfterCheckpoint(t *testing.T)
 	if err := later.Commit(ctx); err != nil {
 		t.Fatal(err)
 	}
-	cutoff, err := r.InboxCutoff(ctx, profile)
+	cutoff, err := r.InboxCutoff(ctx, 1, profile)
 	if err != nil || cutoff.ID != b[0].ID {
 		t.Fatal(cutoff, err)
 	}
@@ -193,21 +202,21 @@ func TestNotificationInboxEarlierTransactionCommitsAfterCheckpoint(t *testing.T)
 	if !a[0].CreatedAt.After(cutoff.CreatedAt) {
 		t.Fatalf("late commit %v behind cutoff %v (transaction began %v)", a[0].CreatedAt, cutoff.CreatedAt, started)
 	}
-	rows, err := r.ListSync(ctx, profile, &cutoff, 10)
+	rows, err := r.ListSync(ctx, 1, profile, &cutoff, 10)
 	if err != nil || len(rows) != 1 || rows[0].ID != a[0].ID {
 		t.Fatalf("sync omitted late commit: %+v %v", rows, err)
 	}
-	window, more, err := r.ListInboxWindow(ctx, profile, false, 10, nil, cutoff)
+	window, more, err := r.ListInboxWindow(ctx, 1, profile, false, 10, nil, cutoff)
 	if err != nil || more || len(window) != 1 || window[0].ID != b[0].ID {
 		t.Fatalf("snapshot expanded: %+v %v %v", window, more, err)
 	}
 	for _, want := range []int64{1, 0} {
-		changed, err := r.MarkReadThrough(ctx, profile, cutoff)
+		changed, err := r.MarkReadThrough(ctx, 1, profile, cutoff)
 		if err != nil || changed != want {
 			t.Fatal(changed, err)
 		}
 	}
-	count, err := r.UnreadCount(ctx, profile)
+	count, err := r.UnreadCount(ctx, 1, profile)
 	if err != nil || count != 1 {
 		t.Fatalf("late commit marked read: %d %v", count, err)
 	}
@@ -258,7 +267,7 @@ func TestNotificationInboxWriterWaitsForCommit(t *testing.T) {
 			runtime.Gosched()
 		}
 	}
-	cutoff, err := r.InboxCutoff(ctx, profile)
+	cutoff, err := r.InboxCutoff(ctx, 1, profile)
 	if err != nil || cutoff.ID != "" {
 		t.Fatal(cutoff, err)
 	}
@@ -268,11 +277,11 @@ func TestNotificationInboxWriterWaitsForCommit(t *testing.T) {
 	if err := <-done; err != nil {
 		t.Fatal(err)
 	}
-	rows, err := r.ListSync(ctx, profile, nil, 10)
+	rows, err := r.ListSync(ctx, 1, profile, nil, 10)
 	if err != nil || len(rows) != 2 || rows[0].ID != a[0].ID || !rows[1].CreatedAt.After(rows[0].CreatedAt) {
 		t.Fatalf("commit ordering: %+v %v", rows, err)
 	}
-	if changed, err := r.MarkReadThrough(ctx, profile, cutoff); err != nil || changed != 0 {
+	if changed, err := r.MarkReadThrough(ctx, 1, profile, cutoff); err != nil || changed != 0 {
 		t.Fatal(changed, err)
 	}
 }
@@ -303,7 +312,7 @@ func TestNotificationInboxClockSurvivesRetentionAndBackwardClock(t *testing.T) {
 			t.Fatalf("timestamp regressed: %v <= %v", rows[0].CreatedAt, future)
 		}
 		future = rows[0].CreatedAt
-		if err := r.DeleteAllForProfile(ctx, profile); err != nil {
+		if err := r.DeleteAllForProfile(ctx, 1, profile); err != nil {
 			t.Fatal(err)
 		}
 	}
diff --git a/internal/notifications/interest_hooks.go b/internal/notifications/interest_hooks.go
index a2685eee39..33ca335a0c 100644
--- a/internal/notifications/interest_hooks.go
+++ b/internal/notifications/interest_hooks.go
@@ -347,14 +347,14 @@ func (s *interestTrackingStore) queueOnTransition(profileID, mediaItemID string,
 	}
 }
 
-// --- Favorites & watchlist: every mutation queues (user-action frequency).
+// --- Favorites & watchlist: a mutation that changed a row queues.
 
-func (s *interestTrackingStore) AddFavorite(ctx context.Context, profileID, mediaItemID string) error {
-	err := s.UserStore.AddFavorite(ctx, profileID, mediaItemID)
-	if err == nil {
+func (s *interestTrackingStore) AddFavorite(ctx context.Context, profileID, mediaItemID string) (bool, error) {
+	changed, err := s.UserStore.AddFavorite(ctx, profileID, mediaItemID)
+	if err == nil && changed {
 		s.updater.QueueItemMutation(s.userID, profileID, mediaItemID)
 	}
-	return err
+	return changed, err
 }
 
 func (s *interestTrackingStore) AddFavoriteAt(ctx context.Context, profileID, mediaItemID string, addedAt time.Time) (bool, error) {
@@ -365,20 +365,20 @@ func (s *interestTrackingStore) AddFavoriteAt(ctx context.Context, profileID, me
 	return inserted, err
 }
 
-func (s *interestTrackingStore) RemoveFavorite(ctx context.Context, profileID, mediaItemID string) error {
-	err := s.UserStore.RemoveFavorite(ctx, profileID, mediaItemID)
-	if err == nil {
+func (s *interestTrackingStore) RemoveFavorite(ctx context.Context, profileID, mediaItemID string) (bool, error) {
+	changed, err := s.UserStore.RemoveFavorite(ctx, profileID, mediaItemID)
+	if err == nil && changed {
 		s.updater.QueueItemMutation(s.userID, profileID, mediaItemID)
 	}
-	return err
+	return changed, err
 }
 
-func (s *interestTrackingStore) AddToWatchlist(ctx context.Context, profileID, mediaItemID string) error {
-	err := s.UserStore.AddToWatchlist(ctx, profileID, mediaItemID)
-	if err == nil {
+func (s *interestTrackingStore) AddToWatchlist(ctx context.Context, profileID, mediaItemID string) (bool, error) {
+	changed, err := s.UserStore.AddToWatchlist(ctx, profileID, mediaItemID)
+	if err == nil && changed {
 		s.updater.QueueItemMutation(s.userID, profileID, mediaItemID)
 	}
-	return err
+	return changed, err
 }
 
 // AddToWatchlistAt is the add that keeps an earlier added_at: watch-provider
@@ -392,12 +392,12 @@ func (s *interestTrackingStore) AddToWatchlistAt(ctx context.Context, profileID,
 	return inserted, err
 }
 
-func (s *interestTrackingStore) RemoveFromWatchlist(ctx context.Context, profileID, mediaItemID string) error {
-	err := s.UserStore.RemoveFromWatchlist(ctx, profileID, mediaItemID)
-	if err == nil {
+func (s *interestTrackingStore) RemoveFromWatchlist(ctx context.Context, profileID, mediaItemID string) (bool, error) {
+	changed, err := s.UserStore.RemoveFromWatchlist(ctx, profileID, mediaItemID)
+	if err == nil && changed {
 		s.updater.QueueItemMutation(s.userID, profileID, mediaItemID)
 	}
-	return err
+	return changed, err
 }
 
 // --- Home dismissals: a card removed from Continue Watching or Next Up stops
@@ -506,6 +506,14 @@ func (s *interestTrackingStore) ClearProgress(ctx context.Context, profileID, me
 	return err
 }
 
+func (s *interestTrackingStore) ClearResumePosition(ctx context.Context, profileID, mediaItemID string, at time.Time) (bool, error) {
+	cleared, err := s.UserStore.ClearResumePosition(ctx, profileID, mediaItemID, at)
+	if err == nil && cleared {
+		s.updater.QueueItemMutation(s.userID, profileID, mediaItemID)
+	}
+	return cleared, err
+}
+
 func (s *interestTrackingStore) ClearProgressBatch(ctx context.Context, profileID string, mediaItemIDs []string, updatedAt time.Time) error {
 	err := s.UserStore.ClearProgressBatch(ctx, profileID, mediaItemIDs, updatedAt)
 	if err == nil {
@@ -637,7 +645,7 @@ func (s *interestTrackingStore) DeleteProfile(ctx context.Context, id string) er
 	if err == nil {
 		purgeCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 30*time.Second)
 		defer cancel()
-		if purgeErr := s.system.PurgeProfile(purgeCtx, id); purgeErr != nil {
+		if purgeErr := s.system.PurgeProfile(purgeCtx, s.userID, id); purgeErr != nil {
 			slog.WarnContext(ctx, "notifications: profile purge failed", "component", "notifications", "profile_id", id, "error", purgeErr)
 		}
 	}
diff --git a/internal/notifications/interest_hooks_test.go b/internal/notifications/interest_hooks_test.go
index 1ab5b575ab..f89c260ded 100644
--- a/internal/notifications/interest_hooks_test.go
+++ b/internal/notifications/interest_hooks_test.go
@@ -558,7 +558,7 @@ func TestInterestTrackingStoreConditionalCapabilities(t *testing.T) {
 			if err := wrapped.CreateProfile(ctx, userstore.Profile{ID: "p1", Name: "Test"}); err != nil {
 				t.Fatal(err)
 			}
-			if err := wrapped.AddFavorite(ctx, "p1", "series-1"); err != nil {
+			if _, err := wrapped.AddFavorite(ctx, "p1", "series-1"); err != nil {
 				t.Fatal(err)
 			}
 			if _, queued := updater.pending[interestMutation{userID: 7, profileID: "p1", itemID: "series-1"}]; !queued {
diff --git a/internal/notifications/interest_repo.go b/internal/notifications/interest_repo.go
index 9bc3ebf035..41558441e9 100644
--- a/internal/notifications/interest_repo.go
+++ b/internal/notifications/interest_repo.go
@@ -21,15 +21,20 @@ func NewInterestRepository(pool *pgxpool.Pool) *InterestRepository {
 
 // ListActiveBySeries loads candidate recipients for one (library, series).
 // This is the hot fanout query; it uses the partial active-interest index.
+// Profiles that muted the series are left out in the same query, so a mute
+// costs fanout no per-recipient read.
 func (r *InterestRepository) ListActiveBySeries(ctx context.Context, tx pgx.Tx, libraryID int, seriesID string) ([]SeriesInterest, error) {
 	rows, err := tx.Query(ctx, `
-		SELECT user_id, profile_id, library_id, series_id,
-		       favorite, watchlist, continue_watching, next_up_candidate,
-		       last_completed_episode_key, next_expected_episode_key, last_notified_episode_key,
-		       updated_at
-		FROM profile_series_interest
-		WHERE library_id = $1 AND series_id = $2
-		  AND (favorite OR watchlist OR continue_watching OR next_up_candidate)`,
+		SELECT psi.user_id, psi.profile_id, psi.library_id, psi.series_id,
+		       psi.favorite, psi.watchlist, psi.continue_watching, psi.next_up_candidate,
+		       psi.last_completed_episode_key, psi.next_expected_episode_key, psi.last_notified_episode_key,
+		       psi.updated_at
+		FROM profile_series_interest psi
+		WHERE psi.library_id = $1 AND psi.series_id = $2
+		  AND (psi.favorite OR psi.watchlist OR psi.continue_watching OR psi.next_up_candidate)
+		  AND NOT EXISTS (
+			SELECT 1 FROM profile_series_notification_mutes m
+			WHERE m.series_id = psi.series_id AND m.user_id = psi.user_id AND m.profile_id = psi.profile_id)`,
 		libraryID, seriesID)
 	if err != nil {
 		return nil, fmt.Errorf("list series interest: %w", err)
@@ -81,8 +86,7 @@ func (r *InterestRepository) UpsertRows(ctx context.Context, interests []SeriesI
 		)
 	}
 	sb.WriteString(`
-		ON CONFLICT (profile_id, library_id, series_id) DO UPDATE SET
-			user_id = EXCLUDED.user_id,
+		ON CONFLICT (user_id, profile_id, library_id, series_id) DO UPDATE SET
 			favorite = EXCLUDED.favorite,
 			watchlist = EXCLUDED.watchlist,
 			continue_watching = EXCLUDED.continue_watching,
@@ -107,14 +111,14 @@ func (r *InterestRepository) UpsertRows(ctx context.Context, interests []SeriesI
 }
 
 // DeleteStaleForProfileSeries removes interest rows for libraries the profile
-// can no longer see (or the series no longer belongs to). keepLibraryIDs is
-// the freshly computed target set; an empty set deletes all rows for the
-// (profile, series) pair.
-func (r *InterestRepository) DeleteStaleForProfileSeries(ctx context.Context, profileID, seriesID string, keepLibraryIDs []int) error {
+// on userID's account can no longer see (or the series no longer belongs to).
+// keepLibraryIDs is the freshly computed target set; an empty set deletes all
+// rows for the (profile, series) pair.
+func (r *InterestRepository) DeleteStaleForProfileSeries(ctx context.Context, userID int, profileID, seriesID string, keepLibraryIDs []int) error {
 	_, err := r.pool.Exec(ctx, `
 		DELETE FROM profile_series_interest
-		WHERE profile_id = $1 AND series_id = $2 AND NOT (library_id = ANY($3))`,
-		profileID, seriesID, keepLibraryIDs)
+		WHERE user_id = $1 AND profile_id = $2 AND series_id = $3 AND NOT (library_id = ANY($4))`,
+		userID, profileID, seriesID, keepLibraryIDs)
 	if err != nil {
 		return fmt.Errorf("delete stale series interest: %w", err)
 	}
@@ -122,13 +126,14 @@ func (r *InterestRepository) DeleteStaleForProfileSeries(ctx context.Context, pr
 }
 
 // ListSeriesForProfile returns the distinct series that currently have
-// interest rows for the profile. The rebuild pass recomputes these alongside
-// the series resolved from live sources so rows whose sources were removed
-// while the live updater was down get cleaned up instead of lingering.
-func (r *InterestRepository) ListSeriesForProfile(ctx context.Context, profileID string) ([]string, error) {
+// interest rows for the profile on userID's account. The rebuild pass
+// recomputes these alongside the series resolved from live sources so rows
+// whose sources were removed while the live updater was down get cleaned up
+// instead of lingering.
+func (r *InterestRepository) ListSeriesForProfile(ctx context.Context, userID int, profileID string) ([]string, error) {
 	rows, err := r.pool.Query(ctx,
-		`SELECT DISTINCT series_id FROM profile_series_interest WHERE profile_id = $1`,
-		profileID)
+		`SELECT DISTINCT series_id FROM profile_series_interest WHERE user_id = $1 AND profile_id = $2`,
+		userID, profileID)
 	if err != nil {
 		return nil, fmt.Errorf("list profile interest series: %w", err)
 	}
@@ -145,30 +150,33 @@ func (r *InterestRepository) ListSeriesForProfile(ctx context.Context, profileID
 }
 
 // GuardedSetLastNotified raises last_notified_episode_key for the given
-// profiles. The < guard makes concurrent workers handling adjacent release
-// events safe: the higher key wins regardless of commit order.
-func (r *InterestRepository) GuardedSetLastNotified(ctx context.Context, tx pgx.Tx, libraryID int, seriesID string, episodeKey int, profileIDs []string) error {
-	if len(profileIDs) == 0 {
+// account profiles. The < guard makes concurrent workers handling adjacent
+// release events safe: the higher key wins regardless of commit order.
+func (r *InterestRepository) GuardedSetLastNotified(ctx context.Context, tx pgx.Tx, libraryID int, seriesID string, episodeKey int, profiles []profileKey) error {
+	if len(profiles) == 0 {
 		return nil
 	}
+	userIDs, profileIDs := profileKeyArrays(profiles)
 	_, err := tx.Exec(ctx, `
-		UPDATE profile_series_interest
+		UPDATE profile_series_interest psi
 		SET last_notified_episode_key = $1
-		WHERE library_id = $2 AND series_id = $3 AND profile_id = ANY($4)
-		  AND (last_notified_episode_key IS NULL OR last_notified_episode_key < $1)`,
-		episodeKey, libraryID, seriesID, profileIDs)
+		FROM unnest($4::integer[], $5::text[]) AS notified(user_id, profile_id)
+		WHERE psi.library_id = $2 AND psi.series_id = $3
+		  AND psi.user_id = notified.user_id AND psi.profile_id = notified.profile_id
+		  AND (psi.last_notified_episode_key IS NULL OR psi.last_notified_episode_key < $1)`,
+		episodeKey, libraryID, seriesID, userIDs, profileIDs)
 	if err != nil {
 		return fmt.Errorf("update last notified episode key: %w", err)
 	}
 	return nil
 }
 
-// DeleteAllForProfile removes every interest row for a deleted profile.
-// Profiles may live in per-user SQLite stores, so this cleanup cannot rely on
-// a Postgres cascade.
-func (r *InterestRepository) DeleteAllForProfile(ctx context.Context, profileID string) error {
+// DeleteAllForProfile removes every interest row for a deleted profile on
+// userID's account. Profiles may live in per-user SQLite stores, so this
+// cleanup cannot rely on a Postgres cascade.
+func (r *InterestRepository) DeleteAllForProfile(ctx context.Context, userID int, profileID string) error {
 	_, err := r.pool.Exec(ctx,
-		`DELETE FROM profile_series_interest WHERE profile_id = $1`, profileID)
+		`DELETE FROM profile_series_interest WHERE user_id = $1 AND profile_id = $2`, userID, profileID)
 	return err
 }
 
diff --git a/internal/notifications/interest_updater.go b/internal/notifications/interest_updater.go
index ec93544b45..44cae3f0bf 100644
--- a/internal/notifications/interest_updater.go
+++ b/internal/notifications/interest_updater.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"log/slog"
+	"strconv"
 	"sync"
 	"time"
 
@@ -64,11 +65,31 @@ type InterestUpdater struct {
 	homeChanged map[profileKey]time.Time
 }
 
+// profileKey names one profile on one account. A profile id alone is not
+// unique: every account from before profiles has a profile named "default".
 type profileKey struct {
 	userID    int
 	profileID string
 }
 
+// String renders the key as account/profile for logs and errors.
+func (k profileKey) String() string { return strconv.Itoa(k.userID) + "/" + k.profileID }
+
+// LogValue logs the key as account/profile in every slog handler; the JSON
+// handler would otherwise encode the unexported fields as {}.
+func (k profileKey) LogValue() slog.Value { return slog.StringValue(k.String()) }
+
+// profileKeyArrays splits keys into the parallel account and profile arrays a
+// query matches with (user_id, profile_id) IN (SELECT * FROM unnest($1::int[], $2::text[])).
+func profileKeyArrays(keys []profileKey) ([]int, []string) {
+	userIDs := make([]int, len(keys))
+	profileIDs := make([]string, len(keys))
+	for i, key := range keys {
+		userIDs[i], profileIDs[i] = key.userID, key.profileID
+	}
+	return userIDs, profileIDs
+}
+
 // NewInterestUpdater creates an InterestUpdater.
 func NewInterestUpdater(
 	pool *pgxpool.Pool,
@@ -495,7 +516,7 @@ func (u *InterestUpdater) RecomputeSeries(ctx context.Context, userID int, profi
 
 	if !flags.HasAnyInterest() && lastCompleted == nil {
 		// Nothing can ever notify: drop all rows for the pair.
-		return u.interests.DeleteStaleForProfileSeries(ctx, profileID, seriesID, []int{})
+		return u.interests.DeleteStaleForProfileSeries(ctx, userID, profileID, seriesID, []int{})
 	}
 
 	libraryIDs, err := u.visibleSeriesLibraries(ctx, userID, profileID, seriesID)
@@ -503,7 +524,7 @@ func (u *InterestUpdater) RecomputeSeries(ctx context.Context, userID int, profi
 		return err
 	}
 	if len(libraryIDs) == 0 {
-		return u.interests.DeleteStaleForProfileSeries(ctx, profileID, seriesID, []int{})
+		return u.interests.DeleteStaleForProfileSeries(ctx, userID, profileID, seriesID, []int{})
 	}
 
 	rows := make([]SeriesInterest, 0, len(libraryIDs))
@@ -515,7 +536,7 @@ func (u *InterestUpdater) RecomputeSeries(ctx context.Context, userID int, profi
 	if err := u.interests.UpsertRows(ctx, rows); err != nil {
 		return err
 	}
-	return u.interests.DeleteStaleForProfileSeries(ctx, profileID, seriesID, libraryIDs)
+	return u.interests.DeleteStaleForProfileSeries(ctx, userID, profileID, seriesID, libraryIDs)
 }
 
 // loadSeriesStructure returns the series' episode keys (content_id ->
diff --git a/internal/notifications/notified_series.go b/internal/notifications/notified_series.go
new file mode 100644
index 0000000000..2c980b42dd
--- /dev/null
+++ b/internal/notifications/notified_series.go
@@ -0,0 +1,147 @@
+package notifications
+
+import (
+	"cmp"
+	"context"
+	"fmt"
+	"slices"
+	"strings"
+	"time"
+)
+
+// NotifiedSeries is one series a profile has a reason to hear about, or
+// muted: the interest rows of every library the series is in, merged, with the
+// profile's preferences applied.
+type NotifiedSeries struct {
+	SeriesID string
+	SeriesSortFields
+	// Reasons are the profile's relationships to the series.
+	Reasons ReasonFlags
+	// Active are the Reasons the profile's preferences let notify. A series
+	// with none notifies nobody until a preference changes.
+	Active ReasonFlags
+	// NextExpectedEpisodeKey is the episode an active Next Up reason waits
+	// for; nil without one.
+	NextExpectedEpisodeKey *int
+	// Muted is set when the profile muted the series: it notifies nobody
+	// whatever its Active reasons, which still say what would notify once
+	// the profile unmutes.
+	Muted bool
+}
+
+// Notifies reports whether a new episode of the series can notify the
+// profile: it has an active reason and is not muted.
+func (s NotifiedSeries) Notifies() bool {
+	return !s.Muted && s.Active.Any()
+}
+
+// SeriesSortFields are the catalog fields the notified-series list is
+// searched and sorted by.
+type SeriesSortFields struct {
+	// SortKey is the default order: the case-folded sort title, else the title.
+	SortKey string
+	Title   string
+	// Year is 0 when the catalog has none.
+	Year    int
+	AddedAt time.Time
+	// LatestEpisodeAddedAt is when the series last gained an episode; nil
+	// before its first.
+	LatestEpisodeAddedAt *time.Time
+}
+
+// ListNotifiedSeries answers every series with an interest reason for the
+// profile on userID's account, and every series it muted, ordered by SortKey then SeriesID. The
+// interest index and mutes are the ones fanout reads, so the list names
+// exactly the series a new episode would be evaluated for. It does not judge
+// catalog access; callers filter the series the profile may not open, as
+// fanout does per delivery.
+func (s *System) ListNotifiedSeries(ctx context.Context, userID int, profileID string) ([]NotifiedSeries, error) {
+	prefs, err := s.Preferences.Get(ctx, userID, profileID)
+	if err != nil {
+		return nil, err
+	}
+	interests, err := s.Interests.listMergedForProfile(ctx, userID, profileID)
+	if err != nil {
+		return nil, err
+	}
+	out := make([]NotifiedSeries, 0, len(interests))
+	for _, row := range interests {
+		active := ActiveReasons(row.SeriesInterest, prefs)
+		series := NotifiedSeries{
+			SeriesID:         row.SeriesID,
+			SeriesSortFields: row.SeriesSortFields,
+			Reasons: ReasonFlags{
+				Favorite:         row.Favorite,
+				Watchlist:        row.Watchlist,
+				ContinueWatching: row.ContinueWatching,
+				NextUp:           row.NextUpCandidate,
+			},
+			Active: active,
+			Muted:  row.Muted,
+		}
+		if active.NextUp {
+			series.NextExpectedEpisodeKey = row.NextExpectedEpisodeKey
+		}
+		out = append(out, series)
+	}
+	slices.SortFunc(out, func(a, b NotifiedSeries) int {
+		return cmp.Or(strings.Compare(a.SortKey, b.SortKey), strings.Compare(a.SeriesID, b.SeriesID))
+	})
+	return out, nil
+}
+
+// mergedInterest is one series' interest rows folded across libraries.
+type mergedInterest struct {
+	SeriesInterest
+	SeriesSortFields
+	Muted bool
+}
+
+// listMergedForProfile loads the profile's active interest rows, one per
+// series, and its muted series: a series in several libraries has a row in
+// each, and any row's reason counts. Next Up waits for the earliest expected
+// episode among the rows that carry it. A muted series with no reason has a
+// row with none. Series the catalog no longer has are skipped. Rows are read
+// for the profile on userID's account only, since profile IDs such as the
+// legacy "default" repeat across accounts.
+func (r *InterestRepository) listMergedForProfile(ctx context.Context, userID int, profileID string) ([]mergedInterest, error) {
+	rows, err := r.pool.Query(ctx, `
+		WITH interest AS (
+			SELECT series_id,
+			       bool_or(favorite) AS favorite, bool_or(watchlist) AS watchlist,
+			       bool_or(continue_watching) AS continue_watching,
+			       bool_or(next_up_candidate) AS next_up_candidate,
+			       min(next_expected_episode_key) FILTER (WHERE next_up_candidate) AS next_expected_episode_key
+			FROM profile_series_interest
+			WHERE user_id = $2 AND profile_id = $1
+			  AND (favorite OR watchlist OR continue_watching OR next_up_candidate)
+			GROUP BY series_id
+		), muted AS (
+			SELECT series_id FROM profile_series_notification_mutes WHERE user_id = $2 AND profile_id = $1
+		)
+		SELECT mi.content_id,
+		       COALESCE(i.favorite, false), COALESCE(i.watchlist, false),
+		       COALESCE(i.continue_watching, false), COALESCE(i.next_up_candidate, false),
+		       i.next_expected_episode_key, m.series_id IS NOT NULL,
+		       lower(COALESCE(NULLIF(mi.sort_title, ''), mi.title)), mi.title,
+		       COALESCE(mi.year, 0), mi.created_at, mi.latest_episode_added_at
+		FROM interest i
+		FULL JOIN muted m ON m.series_id = i.series_id
+		JOIN media_items mi ON mi.content_id = COALESCE(i.series_id, m.series_id)`,
+		profileID, userID)
+	if err != nil {
+		return nil, fmt.Errorf("list profile series interest: %w", err)
+	}
+	defer rows.Close()
+	out := make([]mergedInterest, 0, 32)
+	for rows.Next() {
+		row := mergedInterest{SeriesInterest: SeriesInterest{UserID: userID, ProfileID: profileID}}
+		if err := rows.Scan(&row.SeriesID, &row.Favorite, &row.Watchlist,
+			&row.ContinueWatching, &row.NextUpCandidate, &row.NextExpectedEpisodeKey, &row.Muted,
+			&row.SortKey, &row.Title, &row.Year, &row.AddedAt, &row.LatestEpisodeAddedAt); err != nil {
+			return nil, fmt.Errorf("scan profile series interest: %w", err)
+		}
+		out = append(out, row)
+	}
+	return out, rows.Err()
+}
diff --git a/internal/notifications/notified_series_db_test.go b/internal/notifications/notified_series_db_test.go
new file mode 100644
index 0000000000..364b255578
--- /dev/null
+++ b/internal/notifications/notified_series_db_test.go
@@ -0,0 +1,85 @@
+package notifications
+
+import (
+	"testing"
+	"time"
+)
+
+// TestListNotifiedSeriesMergesLibrariesAndAppliesPreferences covers the
+// notified-series list over the fanout index: a series in two libraries is one
+// entry with both libraries' reasons, an inert row and a series the catalog no
+// longer has are left out, entries sort by sort title then title, and a reason
+// the profile turned off stays listed but inactive.
+func TestListNotifiedSeriesMergesLibrariesAndAppliesPreferences(t *testing.T) {
+	pool := schemaDB(t, "notified_series_")
+	ctx := t.Context()
+	if _, err := pool.Exec(ctx, `
+		CREATE TABLE profile_series_interest (LIKE public.profile_series_interest INCLUDING ALL);
+		CREATE TABLE media_items (LIKE public.media_items INCLUDING ALL);
+		CREATE TABLE notification_preferences (LIKE public.notification_preferences INCLUDING ALL);
+		CREATE TABLE profile_series_notification_mutes (LIKE public.profile_series_notification_mutes INCLUDING ALL)`); err != nil {
+		t.Fatalf("create tables: %v", err)
+	}
+	nextUp, laterNextUp := EpisodeKey(2, 3), EpisodeKey(2, 5)
+	for _, stmt := range []struct {
+		sql  string
+		args []any
+	}{
+		{`INSERT INTO media_items (content_id, type, title, sort_title, genres, year, latest_episode_added_at) VALUES
+			('series:bear', 'series', 'The Bear', 'Bear', '{}', 2022, '2026-03-04T05:06:07Z'),
+			('series:andor', 'series', 'Andor', '', '{}', 0, NULL),
+			('series:inert', 'series', 'Inert', '', '{}', 0, NULL)`, nil},
+		{`INSERT INTO profile_series_interest (user_id, profile_id, library_id, series_id, favorite, watchlist, next_up_candidate, next_expected_episode_key) VALUES
+			(1, 'p1', 1, 'series:bear', true, false, false, NULL),
+			(1, 'p1', 2, 'series:bear', false, false, true, $1),
+			(1, 'p1', 3, 'series:bear', false, false, true, $2),
+			(1, 'p1', 1, 'series:andor', false, true, false, NULL),
+			(1, 'p1', 1, 'series:inert', false, false, false, $1),
+			(1, 'p1', 1, 'series:gone', true, false, false, NULL),
+			(1, 'p2', 1, 'series:andor', true, false, false, NULL)`, []any{nextUp, laterNextUp}},
+		{`INSERT INTO notification_preferences (user_id, profile_id, enabled, notify_favorites, notify_watchlist, notify_continue_watching, notify_next_up)
+			VALUES (1, 'p1', true, true, false, true, true)`, nil},
+	} {
+		if _, err := pool.Exec(ctx, stmt.sql, stmt.args...); err != nil {
+			t.Fatalf("seed: %v", err)
+		}
+	}
+	s := &System{Interests: NewInterestRepository(pool), Preferences: NewPreferencesRepository(pool)}
+
+	got, err := s.ListNotifiedSeries(ctx, 1, "p1")
+	if err != nil {
+		t.Fatalf("ListNotifiedSeries: %v", err)
+	}
+	if len(got) != 2 || got[0].SeriesID != "series:andor" || got[1].SeriesID != "series:bear" {
+		t.Fatalf("series = %+v, want andor then bear", got)
+	}
+	andor, bear := got[0], got[1]
+	if andor.Reasons != (ReasonFlags{Watchlist: true}) || andor.Active.Any() || andor.NextExpectedEpisodeKey != nil {
+		t.Errorf("andor = %+v, want an inactive watchlist entry", andor)
+	}
+	if bear.Reasons != (ReasonFlags{Favorite: true, NextUp: true}) || bear.Active != bear.Reasons {
+		t.Errorf("bear = %+v, want active favorite and next up", bear)
+	}
+	if bear.Title != "The Bear" || bear.Year != 2022 || bear.AddedAt.IsZero() ||
+		bear.LatestEpisodeAddedAt == nil || !bear.LatestEpisodeAddedAt.Equal(time.Date(2026, 3, 4, 5, 6, 7, 0, time.UTC)) {
+		t.Errorf("bear catalog fields = %+v", bear.SeriesSortFields)
+	}
+	if andor.Year != 0 || andor.LatestEpisodeAddedAt != nil {
+		t.Errorf("andor catalog fields = %+v, want no year or latest episode", andor.SeriesSortFields)
+	}
+	if bear.NextExpectedEpisodeKey == nil || *bear.NextExpectedEpisodeKey != nextUp {
+		t.Errorf("bear waits for %v, want the earliest expected episode %d", bear.NextExpectedEpisodeKey, nextUp)
+	}
+
+	// Turning notifications off silences every reason but lists the same series.
+	if _, err := pool.Exec(ctx, `UPDATE notification_preferences SET enabled = false WHERE profile_id = 'p1'`); err != nil {
+		t.Fatal(err)
+	}
+	got, err = s.ListNotifiedSeries(ctx, 1, "p1")
+	if err != nil {
+		t.Fatalf("ListNotifiedSeries: %v", err)
+	}
+	if len(got) != 2 || got[0].Active.Any() || got[1].Active.Any() || got[1].NextExpectedEpisodeKey != nil {
+		t.Fatalf("disabled = %+v, want both listed and inactive", got)
+	}
+}
diff --git a/internal/notifications/operational_dispatch.go b/internal/notifications/operational_dispatch.go
index ef4c57fd12..292fd5b0a8 100644
--- a/internal/notifications/operational_dispatch.go
+++ b/internal/notifications/operational_dispatch.go
@@ -3,7 +3,6 @@ package notifications
 import (
 	"context"
 	"fmt"
-	"slices"
 
 	"github.com/oklog/ulid/v2"
 )
@@ -67,15 +66,16 @@ func (s *System) DispatchOperational(ctx context.Context, delivery Delivery, opt
 		return nil, nil
 	}
 	row := inserted[0]
+	owner := profileKey{delivery.UserID, delivery.ProfileID}
 
 	if opts.WebhookFilter != nil && s.webhookRepo != nil && s.Settings.WebhooksEnabled(ctx) {
-		hooksByProfile, err := s.webhookRepo.ListEnabledByProfiles(ctx, tx, []string{delivery.ProfileID})
+		hooksByProfile, err := s.webhookRepo.ListEnabledByProfiles(ctx, tx, []profileKey{owner})
 		if err != nil {
 			return nil, err
 		}
 		attempts := make([]DeliveryAttempt, 0, 2)
-		for _, hook := range hooksByProfile[delivery.ProfileID] {
-			if hook.UserID != delivery.UserID || !opts.WebhookFilter(hook) {
+		for _, hook := range hooksByProfile[owner] {
+			if !opts.WebhookFilter(hook) {
 				continue
 			}
 			attempts = append(attempts, DeliveryAttempt{
@@ -89,15 +89,12 @@ func (s *System) DispatchOperational(ctx context.Context, delivery Delivery, opt
 		}
 	}
 	if s.webPushRepo != nil && s.Settings.WebPushEnabled(ctx) {
-		subsByProfile, err := s.webPushRepo.ListEnabledByProfiles(ctx, tx, []string{delivery.ProfileID})
+		subsByProfile, err := s.webPushRepo.ListEnabledByProfiles(ctx, tx, []profileKey{owner})
 		if err != nil {
 			return nil, err
 		}
 		attempts := make([]DeliveryAttempt, 0, 2)
-		for _, sub := range subsByProfile[delivery.ProfileID] {
-			if sub.UserID != delivery.UserID {
-				continue
-			}
+		for _, sub := range subsByProfile[owner] {
 			attempts = append(attempts, DeliveryAttempt{
 				ID:                     ulid.Make().String(),
 				NotificationDeliveryID: row.ID,
@@ -110,14 +107,11 @@ func (s *System) DispatchOperational(ctx context.Context, delivery Delivery, opt
 	}
 	if s.pushDeviceRepo != nil {
 		if platforms := s.Settings.EnabledPushPlatforms(ctx); len(platforms) > 0 {
-			devicesByProfile, err := s.pushDeviceRepo.ListEnabledPushByProfiles(ctx, tx, []string{delivery.ProfileID}, platforms)
+			devicesByProfile, err := s.pushDeviceRepo.ListEnabledPushByProfiles(ctx, tx, []profileKey{owner}, platforms)
 			if err != nil {
 				return nil, err
 			}
-			devices := slices.DeleteFunc(devicesByProfile[delivery.ProfileID], func(device PushDevice) bool {
-				return device.UserID != delivery.UserID
-			})
-			attempts := newPushDeliveryAttempts(row.ID, devices)
+			attempts := newPushDeliveryAttempts(row.ID, devicesByProfile[owner])
 			if err := s.pushDeviceRepo.EnqueuePushAttempts(ctx, tx, attempts); err != nil {
 				return nil, err
 			}
diff --git a/internal/notifications/preferences_repo.go b/internal/notifications/preferences_repo.go
index 2d1b1b390d..81d264a386 100644
--- a/internal/notifications/preferences_repo.go
+++ b/internal/notifications/preferences_repo.go
@@ -19,15 +19,15 @@ func NewPreferencesRepository(pool *pgxpool.Pool) *PreferencesRepository {
 	return &PreferencesRepository{pool: pool}
 }
 
-// Get returns the profile's preferences, defaulting missing rows to
-// all-enabled.
-func (r *PreferencesRepository) Get(ctx context.Context, profileID string) (Preferences, error) {
-	prefs := DefaultPreferences(profileID)
+// Get returns the preferences of the profile on userID's account, defaulting
+// a missing row to all-enabled.
+func (r *PreferencesRepository) Get(ctx context.Context, userID int, profileID string) (Preferences, error) {
+	prefs := DefaultPreferences(userID, profileID)
 	err := r.pool.QueryRow(ctx, `
 		SELECT enabled, notify_favorites, notify_watchlist, notify_continue_watching, notify_next_up, updated_at
 		FROM notification_preferences
-		WHERE profile_id = $1`,
-		profileID,
+		WHERE user_id = $1 AND profile_id = $2`,
+		userID, profileID,
 	).Scan(&prefs.Enabled, &prefs.NotifyFavorites, &prefs.NotifyWatchlist,
 		&prefs.NotifyContinueWatching, &prefs.NotifyNextUp, &prefs.UpdatedAt)
 	if errors.Is(err, pgx.ErrNoRows) {
@@ -39,50 +39,54 @@ func (r *PreferencesRepository) Get(ctx context.Context, profileID string) (Pref
 	return prefs, nil
 }
 
-// GetMany returns preferences for the given profiles, defaulting missing rows
-// to all-enabled. Used by the fanout worker.
-func (r *PreferencesRepository) GetMany(ctx context.Context, tx pgx.Tx, profileIDs []string) (map[string]Preferences, error) {
-	out := make(map[string]Preferences, len(profileIDs))
-	for _, profileID := range profileIDs {
-		out[profileID] = DefaultPreferences(profileID)
+// GetMany returns preferences for the given account profiles, defaulting
+// missing rows to all-enabled. Used by the fanout worker.
+func (r *PreferencesRepository) GetMany(ctx context.Context, tx pgx.Tx, profiles []profileKey) (map[profileKey]Preferences, error) {
+	out := make(map[profileKey]Preferences, len(profiles))
+	for _, profile := range profiles {
+		out[profile] = DefaultPreferences(profile.userID, profile.profileID)
 	}
-	if len(profileIDs) == 0 {
+	if len(profiles) == 0 {
 		return out, nil
 	}
+	userIDs, profileIDs := profileKeyArrays(profiles)
 	rows, err := tx.Query(ctx, `
-		SELECT profile_id, enabled, notify_favorites, notify_watchlist, notify_continue_watching, notify_next_up, updated_at
-		FROM notification_preferences
-		WHERE profile_id = ANY($1)`,
-		profileIDs)
+		SELECT p.user_id, p.profile_id, p.enabled, p.notify_favorites, p.notify_watchlist,
+		       p.notify_continue_watching, p.notify_next_up, p.updated_at
+		FROM notification_preferences p
+		JOIN unnest($1::integer[], $2::text[]) AS wanted(user_id, profile_id)
+		  ON wanted.user_id = p.user_id AND wanted.profile_id = p.profile_id`,
+		userIDs, profileIDs)
 	if err != nil {
 		return nil, fmt.Errorf("get notification preferences batch: %w", err)
 	}
 	defer rows.Close()
 	for rows.Next() {
 		var prefs Preferences
-		if err := rows.Scan(&prefs.ProfileID, &prefs.Enabled, &prefs.NotifyFavorites,
+		if err := rows.Scan(&prefs.UserID, &prefs.ProfileID, &prefs.Enabled, &prefs.NotifyFavorites,
 			&prefs.NotifyWatchlist, &prefs.NotifyContinueWatching, &prefs.NotifyNextUp, &prefs.UpdatedAt); err != nil {
 			return nil, fmt.Errorf("scan notification preferences: %w", err)
 		}
-		out[prefs.ProfileID] = prefs
+		out[profileKey{prefs.UserID, prefs.ProfileID}] = prefs
 	}
 	return out, rows.Err()
 }
 
-// Upsert writes the profile's preferences. Idempotent.
+// Upsert writes the preferences of the profile on prefs.UserID's account.
+// Idempotent.
 func (r *PreferencesRepository) Upsert(ctx context.Context, prefs Preferences) error {
 	_, err := r.pool.Exec(ctx, `
 		INSERT INTO notification_preferences
-			(profile_id, enabled, notify_favorites, notify_watchlist, notify_continue_watching, notify_next_up, updated_at)
-		VALUES ($1, $2, $3, $4, $5, $6, now())
-		ON CONFLICT (profile_id) DO UPDATE SET
+			(user_id, profile_id, enabled, notify_favorites, notify_watchlist, notify_continue_watching, notify_next_up, updated_at)
+		VALUES ($1, $2, $3, $4, $5, $6, $7, now())
+		ON CONFLICT (user_id, profile_id) DO UPDATE SET
 			enabled = EXCLUDED.enabled,
 			notify_favorites = EXCLUDED.notify_favorites,
 			notify_watchlist = EXCLUDED.notify_watchlist,
 			notify_continue_watching = EXCLUDED.notify_continue_watching,
 			notify_next_up = EXCLUDED.notify_next_up,
 			updated_at = now()`,
-		prefs.ProfileID, prefs.Enabled, prefs.NotifyFavorites,
+		prefs.UserID, prefs.ProfileID, prefs.Enabled, prefs.NotifyFavorites,
 		prefs.NotifyWatchlist, prefs.NotifyContinueWatching, prefs.NotifyNextUp)
 	if err != nil {
 		return fmt.Errorf("upsert notification preferences: %w", err)
@@ -90,9 +94,10 @@ func (r *PreferencesRepository) Upsert(ctx context.Context, prefs Preferences) e
 	return nil
 }
 
-// DeleteForProfile removes a deleted profile's preference row.
-func (r *PreferencesRepository) DeleteForProfile(ctx context.Context, profileID string) error {
+// DeleteForProfile removes the preference row of a deleted profile on
+// userID's account.
+func (r *PreferencesRepository) DeleteForProfile(ctx context.Context, userID int, profileID string) error {
 	_, err := r.pool.Exec(ctx,
-		`DELETE FROM notification_preferences WHERE profile_id = $1`, profileID)
+		`DELETE FROM notification_preferences WHERE user_id = $1 AND profile_id = $2`, userID, profileID)
 	return err
 }
diff --git a/internal/notifications/push_delivery.go b/internal/notifications/push_delivery.go
index e8a4b9470f..6b63f64a57 100644
--- a/internal/notifications/push_delivery.go
+++ b/internal/notifications/push_delivery.go
@@ -101,20 +101,22 @@ func scanPushDeliveryAttempts(rows pgx.Rows) ([]PushDeliveryAttempt, error) {
 }
 
 // ListEnabledPushByProfiles loads delivery-eligible push devices for the
-// admin-enabled platforms, keyed by profile.
-func (r *PushDeviceRepository) ListEnabledPushByProfiles(ctx context.Context, tx pgx.Tx, profileIDs, platforms []string) (map[string][]PushDevice, error) {
-	out := make(map[string][]PushDevice, len(profileIDs))
-	if len(profileIDs) == 0 || len(platforms) == 0 {
+// admin-enabled platforms, keyed by account and profile: profile IDs repeat
+// across accounts.
+func (r *PushDeviceRepository) ListEnabledPushByProfiles(ctx context.Context, tx pgx.Tx, profiles []profileKey, platforms []string) (map[profileKey][]PushDevice, error) {
+	out := make(map[profileKey][]PushDevice, len(profiles))
+	if len(profiles) == 0 || len(platforms) == 0 {
 		return out, nil
 	}
+	userIDs, profileIDs := profileKeyArrays(profiles)
 	rows, err := tx.Query(ctx, `SELECT `+pushDeviceColumns+`
 		FROM push_devices
-		WHERE profile_id = ANY($1)
-		  AND platform = ANY($2)
-		  AND provider = $3
-		  AND push_mode = $4
+		WHERE (user_id, profile_id) IN (SELECT * FROM unnest($1::int[], $2::text[]))
+		  AND platform = ANY($3)
+		  AND provider = $4
+		  AND push_mode = $5
 		  AND enabled`,
-		profileIDs, platforms, PushProviderPrairieRelay, PushModePrivatePush)
+		userIDs, profileIDs, platforms, PushProviderPrairieRelay, PushModePrivatePush)
 	if err != nil {
 		return nil, fmt.Errorf("list enabled push devices: %w", err)
 	}
@@ -124,7 +126,8 @@ func (r *PushDeviceRepository) ListEnabledPushByProfiles(ctx context.Context, tx
 		if err != nil {
 			return nil, fmt.Errorf("scan enabled push device: %w", err)
 		}
-		out[device.ProfileID] = append(out[device.ProfileID], *device)
+		key := profileKey{device.UserID, device.ProfileID}
+		out[key] = append(out[key], *device)
 	}
 	return out, rows.Err()
 }
@@ -166,7 +169,10 @@ func (r *PushDeviceRepository) EnqueuePushAttempts(ctx context.Context, tx pgx.T
 }
 
 // EnqueueTestAttempt creates a pending diagnostic attempt for one enabled
-// device on the given platform.
+// device on the given platform. The attempt carries the device profile's
+// newest notification, so the device fetches and shows that notification's
+// real text exactly as for an ordinary push. A profile with no notification
+// yet gets a bare test whose push the device can only show as generic text.
 func (r *PushDeviceRepository) EnqueueTestAttempt(ctx context.Context, platform, profileID, serverDeviceID string) (*PushDeliveryAttempt, *PushDevice, error) {
 	if r == nil || r.pool == nil {
 		return nil, nil, ErrPushDeliveryUnavailable
@@ -204,12 +210,26 @@ func (r *PushDeviceRepository) EnqueueTestAttempt(ctx context.Context, platform,
 		return nil, nil, fmt.Errorf("select push test device: %w", err)
 	}
 
+	// Profile IDs are unique only within an account, so match the device's
+	// account too. The key-share lock keeps the row from being deleted
+	// before the attempt references it.
+	var deliveryID *string
+	err = tx.QueryRow(ctx, `
+		SELECT id FROM notification_deliveries
+		WHERE user_id = $1 AND profile_id = $2
+		ORDER BY created_at DESC, id DESC
+		LIMIT 1
+		FOR KEY SHARE`, device.UserID, device.ProfileID).Scan(&deliveryID)
+	if err != nil && !errors.Is(err, pgx.ErrNoRows) {
+		return nil, nil, fmt.Errorf("select push test delivery: %w", err)
+	}
+
 	attemptID := ulid.Make().String()
 	rows, err := tx.Query(ctx, `
 		INSERT INTO push_delivery_attempts
 			(id, notification_delivery_id, push_device_id, trigger_type, provider, platform, attempt_number, outcome)
-		VALUES ($1, NULL, $2, $3, $4, $5, 0, $6)`+pushAttemptReturning,
-		attemptID, device.ID, PushTriggerTest, PushProviderPrairieRelay, platform, PushOutcomePending)
+		VALUES ($1, $2, $3, $4, $5, $6, 0, $7)`+pushAttemptReturning,
+		attemptID, deliveryID, device.ID, PushTriggerTest, PushProviderPrairieRelay, platform, PushOutcomePending)
 	if err != nil {
 		return nil, nil, fmt.Errorf("insert push test attempt: %w", err)
 	}
@@ -259,15 +279,18 @@ func (r *PushDeviceRepository) getPushDeviceByID(ctx context.Context, id string)
 	return device, nil
 }
 
+// ClaimPendingPushForDelivery claims the delivery's own pending attempts for
+// immediate dispatch. An administrator test that carries the delivery stays
+// with the request that enqueued it.
 func (r *PushDeviceRepository) ClaimPendingPushForDelivery(ctx context.Context, deliveryID string) ([]PushDeliveryAttempt, error) {
 	return r.claimPushAttempts(ctx, `
 		UPDATE push_delivery_attempts SET outcome = 'retrying', next_retry_at = now() + $2, updated_at = now()
 		WHERE id IN (
 			SELECT id FROM push_delivery_attempts
-			WHERE notification_delivery_id = $1 AND outcome = 'pending'
+			WHERE notification_delivery_id = $1 AND trigger_type = $3 AND outcome = 'pending'
 			FOR UPDATE SKIP LOCKED
 		)`+pushAttemptReturning,
-		deliveryID, webhookClaimLease)
+		deliveryID, webhookClaimLease, PushTriggerDelivery)
 }
 
 func (r *PushDeviceRepository) ClaimPushAttemptByID(ctx context.Context, attemptID string) ([]PushDeliveryAttempt, error) {
diff --git a/internal/notifications/push_devices.go b/internal/notifications/push_devices.go
index bceb480268..eca609300e 100644
--- a/internal/notifications/push_devices.go
+++ b/internal/notifications/push_devices.go
@@ -101,7 +101,7 @@ type FCMPushDeviceRegistration struct {
 type PushDeviceStore interface {
 	UpsertApple(ctx context.Context, registration ApplePushDeviceRegistration, cipher *secret.Cipher) (*PushDevice, error)
 	UpsertFCM(ctx context.Context, registration FCMPushDeviceRegistration, cipher *secret.Cipher) (*PushDevice, error)
-	DeleteByProfileDevice(ctx context.Context, profileID, deviceID string) error
+	DeleteByProfileDevice(ctx context.Context, userID int, profileID, deviceID string) error
 }
 
 type PushDeviceRepository struct {
@@ -166,8 +166,8 @@ func (s *PushDeviceService) RegisterFCM(ctx context.Context, userID int, profile
 }
 
 // Unregister removes every registration this device install holds for the
-// profile, regardless of platform.
-func (s *PushDeviceService) Unregister(ctx context.Context, profileID, deviceID string) error {
+// account profile, regardless of platform.
+func (s *PushDeviceService) Unregister(ctx context.Context, userID int, profileID, deviceID string) error {
 	if !s.Available() {
 		return ErrPushDeviceUnavailable
 	}
@@ -176,7 +176,7 @@ func (s *PushDeviceService) Unregister(ctx context.Context, profileID, deviceID
 	if profileID == "" || deviceID == "" {
 		return fmt.Errorf("%w: profile_id and device_id are required", ErrPushDeviceInvalid)
 	}
-	return s.store.DeleteByProfileDevice(ctx, profileID, deviceID)
+	return s.store.DeleteByProfileDevice(ctx, userID, profileID, deviceID)
 }
 
 func normalizeApplePushRegistration(input ApplePushRegistrationInput) (ApplePushDeviceRegistration, error) {
@@ -325,13 +325,14 @@ func (r *PushDeviceRepository) UpsertApple(ctx context.Context, registration App
 		return nil, ErrPushLegacyWriter
 	}
 
-	// A device install registers for the profile it is currently signed into.
-	// Purge the same install's registrations under other profiles (attempts
-	// cascade with them) so a profile switch on a shared device doesn't leave
-	// the previous profile's notifications flowing to it.
+	// A device install registers for the account profile it is currently
+	// signed into. Purge the same install's registrations under other account
+	// profiles (attempts cascade with them) so a profile or account switch on a
+	// shared device doesn't leave the previous owner's notifications flowing to
+	// it. A same-ID profile on another account is another owner.
 	if _, err := tx.Exec(ctx,
-		`DELETE FROM push_devices WHERE device_id = $1 AND platform = $2 AND profile_id <> $3`,
-		registration.DeviceID, PushPlatformApple, registration.ProfileID); err != nil {
+		`DELETE FROM push_devices WHERE device_id = $1 AND platform = $2 AND (user_id <> $3 OR profile_id <> $4)`,
+		registration.DeviceID, PushPlatformApple, registration.UserID, registration.ProfileID); err != nil {
 		return nil, fmt.Errorf("purge reassigned push device: %w", err)
 	}
 
@@ -391,10 +392,10 @@ func (r *PushDeviceRepository) UpsertFCM(ctx context.Context, registration FCMPu
 	}
 
 	// Same profile-switch cleanup as UpsertApple: one install notifies one
-	// profile at a time.
+	// account profile at a time.
 	if _, err := tx.Exec(ctx,
-		`DELETE FROM push_devices WHERE device_id = $1 AND platform = $2 AND profile_id <> $3`,
-		registration.DeviceID, PushPlatformAndroid, registration.ProfileID); err != nil {
+		`DELETE FROM push_devices WHERE device_id = $1 AND platform = $2 AND (user_id <> $3 OR profile_id <> $4)`,
+		registration.DeviceID, PushPlatformAndroid, registration.UserID, registration.ProfileID); err != nil {
 		return nil, fmt.Errorf("purge reassigned push device: %w", err)
 	}
 
@@ -434,18 +435,18 @@ func (r *PushDeviceRepository) UpsertFCM(ctx context.Context, registration FCMPu
 	return device, nil
 }
 
-// DeleteAllForProfile removes push registrations for a deleted profile.
-func (r *PushDeviceRepository) DeleteAllForProfile(ctx context.Context, profileID string) error {
+// DeleteAllForProfile removes push registrations for a deleted account profile.
+func (r *PushDeviceRepository) DeleteAllForProfile(ctx context.Context, userID int, profileID string) error {
 	if r == nil || r.pool == nil {
 		return nil
 	}
-	_, err := r.pool.Exec(ctx, `DELETE FROM push_devices WHERE profile_id = $1`, profileID)
+	_, err := r.pool.Exec(ctx, `DELETE FROM push_devices WHERE user_id = $1 AND profile_id = $2`, userID, profileID)
 	return err
 }
 
-// DeleteByProfileDevice removes one install's registrations for a profile
-// across every platform (attempts cascade with the device rows).
-func (r *PushDeviceRepository) DeleteByProfileDevice(ctx context.Context, profileID, deviceID string) error {
+// DeleteByProfileDevice removes one install's registrations for an account
+// profile across every platform (attempts cascade with the device rows).
+func (r *PushDeviceRepository) DeleteByProfileDevice(ctx context.Context, userID int, profileID, deviceID string) error {
 	if r == nil || r.pool == nil {
 		return ErrPushDeviceUnavailable
 	}
@@ -469,7 +470,7 @@ func (r *PushDeviceRepository) DeleteByProfileDevice(ctx context.Context, profil
 	if generation > 0 {
 		return ErrPushLegacyWriter
 	}
-	if _, err = tx.Exec(ctx, `DELETE FROM push_devices WHERE profile_id=$1 AND device_id=$2`, profileID, deviceID); err != nil {
+	if _, err = tx.Exec(ctx, `DELETE FROM push_devices WHERE user_id=$1 AND profile_id=$2 AND device_id=$3`, userID, profileID, deviceID); err != nil {
 		return err
 	}
 	return tx.Commit(ctx)
diff --git a/internal/notifications/push_devices_test.go b/internal/notifications/push_devices_test.go
index 0aed17acfa..48045d587d 100644
--- a/internal/notifications/push_devices_test.go
+++ b/internal/notifications/push_devices_test.go
@@ -3,6 +3,7 @@ package notifications
 import (
 	"context"
 	"errors"
+	"fmt"
 	"os"
 	"strings"
 	"testing"
@@ -57,8 +58,8 @@ func (f *fakePushDeviceStore) UpsertFCM(ctx context.Context, registration FCMPus
 	}, nil
 }
 
-func (f *fakePushDeviceStore) DeleteByProfileDevice(ctx context.Context, profileID, deviceID string) error {
-	f.deleted = append(f.deleted, profileID+"/"+deviceID)
+func (f *fakePushDeviceStore) DeleteByProfileDevice(ctx context.Context, userID int, profileID, deviceID string) error {
+	f.deleted = append(f.deleted, fmt.Sprintf("%d/%s/%s", userID, profileID, deviceID))
 	return f.err
 }
 
diff --git a/internal/notifications/push_sender.go b/internal/notifications/push_sender.go
index 6160545cce..f59bf102b4 100644
--- a/internal/notifications/push_sender.go
+++ b/internal/notifications/push_sender.go
@@ -36,6 +36,15 @@ const (
 	pushRelayMaxRetryAfter  = 23 * time.Hour
 	relayAppleSendPath      = "/v1/apple/send"
 	relayFcmSendPath        = "/v1/fcm/send"
+	relayModePrivateAlert   = "private_alert"
+
+	// relayCodeIdempotencyKeyReuse is the relay's 422 code for a retry whose
+	// payload differs from the one recorded under its idempotency key.
+	relayCodeIdempotencyKeyReuse = "idempotency_key_reuse"
+
+	// relayTargetRecheck is how long sends to a relay that rejected the push
+	// target fields omit them before trying again.
+	relayTargetRecheck = time.Hour
 
 	// relayReplacementCooldown bounds automatic re-registration after the
 	// relay rejects a capability.
@@ -95,6 +104,15 @@ func terminalDeviceRejection(platform string, status int, code, message string)
 	return terminalAPNsDeviceRejection(status, code, message)
 }
 
+// pushRelayTarget names the deployment and profile a push belongs to, so a
+// device signed into several servers or profiles fetches its display data
+// from the right one. Both are omitted when the server identity cannot be
+// read, and for a relay that predates them.
+type pushRelayTarget struct {
+	ServerID  string `json:"server_id,omitempty"`
+	ProfileID string `json:"profile_id,omitempty"`
+}
+
 type pushRelayAppleRequest struct {
 	Token          string  `json:"token"`
 	Environment    string  `json:"environment"`
@@ -103,6 +121,7 @@ type pushRelayAppleRequest struct {
 	ServerDeviceID string  `json:"server_device_id"`
 	DeliveryID     string  `json:"delivery_id"`
 	CollapseID     *string `json:"collapse_id,omitempty"`
+	pushRelayTarget
 }
 
 type pushRelayAppleResponse struct {
@@ -119,6 +138,7 @@ type pushRelayFcmRequest struct {
 	ServerDeviceID string  `json:"server_device_id"`
 	DeliveryID     string  `json:"delivery_id"`
 	CollapseID     *string `json:"collapse_id,omitempty"`
+	pushRelayTarget
 }
 
 type pushRelayErrorResponse struct {
@@ -148,11 +168,18 @@ type pushSender struct {
 	logger              *slog.Logger
 	developmentRelayURL string
 	now                 func() time.Time
+	// serverID reads the deployment identity getServerIdentity reports.
+	serverID func(context.Context) (string, error)
 
 	// renewMu serializes credential renewal and replacement in this process;
 	// lastRelayReplacement is guarded by it.
 	renewMu              sync.Mutex
 	lastRelayReplacement time.Time
+
+	// targetMu guards relayWithoutTarget: per relay base URL, the time until
+	// which sends omit the push target fields that relay rejected.
+	targetMu           sync.Mutex
+	relayWithoutTarget map[string]time.Time
 }
 
 func newPushSender(devices *PushDeviceRepository, deliveries *DeliveryRepository, cipher *secret.Cipher, settings *Settings) *pushSender {
@@ -169,6 +196,7 @@ func newPushSender(devices *PushDeviceRepository, deliveries *DeliveryRepository
 		logger:              slog.Default().With("component", "notifications.apple_push"),
 		developmentRelayURL: envutil.FirstNonEmpty("PRAIRIE_PUSH_RELAY_DEVELOPMENT_URL"),
 		now:                 time.Now,
+		relayWithoutTarget:  map[string]time.Time{},
 	}
 }
 
@@ -204,7 +232,9 @@ func (s *pushSender) processAttempt(ctx context.Context, attempt PushDeliveryAtt
 		if row == nil {
 			return s.finalize(ctx, attempt, PushOutcomeFailed, "delivery_missing", "delivery row missing", nil, "", nil)
 		}
-		if row.ProfileID != device.ProfileID {
+		// A device re-registered under another profile, or under one with the
+		// same ID on another account, no longer gets the old owner's delivery.
+		if row.UserID != device.UserID || row.ProfileID != device.ProfileID {
 			return s.finalize(ctx, attempt, PushOutcomeFailed, "device_reassigned", "push device reassigned", nil, "", nil)
 		}
 	}
@@ -263,20 +293,55 @@ func (s *pushSender) send(ctx context.Context, attempt PushDeliveryAttempt, devi
 	if err != nil {
 		return pushSendResult{HTTPStatus: http.StatusServiceUnavailable, Message: err.Error(), UpstreamReason: "relay_credential_unavailable"}
 	}
-	result = s.sendWithCapability(ctx, attempt, device, token, credential.RelayURL, credential.APIKey)
-	if result.HTTPStatus != http.StatusUnauthorized {
-		return result
+	target, identityKnown := s.relayTarget(ctx, device)
+	result = s.sendWithCapability(ctx, attempt, device, token, target, credential.RelayURL, credential.APIKey)
+	if result.HTTPStatus == http.StatusUnauthorized {
+		recovered, err := s.recoverRelayCredential(ctx, credential, result.UpstreamReason)
+		if err != nil {
+			if result.UpstreamReason == relayCodeDeploymentDisabled {
+				return result
+			}
+			return pushSendResult{HTTPStatus: http.StatusServiceUnavailable, Message: err.Error(), UpstreamReason: "relay_credential_unavailable"}
+		}
+		result = s.sendWithCapability(ctx, attempt, device, token, target, recovered.RelayURL, recovered.APIKey)
+	}
+	if !identityKnown && relayRecordedOtherTarget(result) {
+		// The relay may have recorded this attempt with the target the failed
+		// identity lookup could not name, so a later retry can still match it.
+		return pushSendResult{HTTPStatus: http.StatusServiceUnavailable, Message: "server identity unavailable", UpstreamReason: "server_identity_unavailable"}
 	}
-	recovered, err := s.recoverRelayCredential(ctx, credential, result.UpstreamReason)
+	return result
+}
+
+// relayTarget names this deployment and the device's profile. A delivery's
+// profile is the device's: processAttempt refuses a reassigned device. The
+// target is all or nothing, and each part must meet the relay's 1-128
+// character rule: the relay answers an empty or oversized one with 400
+// invalid_field, which would fail every push. Without a target the push still
+// goes out and the device falls back to its active server and profile, as it
+// does for an older server. identityKnown is false only when the identity
+// lookup failed, so a later send may name a target this one could not.
+func (s *pushSender) relayTarget(ctx context.Context, device *PushDevice) (target pushRelayTarget, identityKnown bool) {
+	if s.serverID == nil {
+		return pushRelayTarget{}, true
+	}
+	serverID, err := s.serverID(ctx)
 	if err != nil {
-		if result.UpstreamReason == relayCodeDeploymentDisabled {
-			return result
+		if ctx.Err() == nil {
+			s.logger.WarnContext(ctx, "push sent without its server identity", "error", err)
 		}
-		return pushSendResult{HTTPStatus: http.StatusServiceUnavailable, Message: err.Error(), UpstreamReason: "relay_credential_unavailable"}
+		return pushRelayTarget{}, false
+	}
+	if !relayTargetID(serverID) || !relayTargetID(device.ProfileID) {
+		return pushRelayTarget{}, true
 	}
-	return s.sendWithCapability(ctx, attempt, device, token, recovered.RelayURL, recovered.APIKey)
+	return pushRelayTarget{ServerID: serverID, ProfileID: device.ProfileID}, true
 }
 
+// relayTargetID applies the relay's opaque-ID length rule in bytes, which is
+// never fewer than the UTF-16 units the relay counts.
+func relayTargetID(id string) bool { return id != "" && len(id) <= 128 }
+
 func (s *pushSender) prepareRelayCredential(ctx context.Context) (PushRelayCredential, error) {
 	s.renewMu.Lock()
 	defer s.renewMu.Unlock()
@@ -450,7 +515,74 @@ func relayCredentialRejection(err error) (string, bool) {
 	return relayErr.Code, true
 }
 
-func (s *pushSender) sendWithCapability(ctx context.Context, attempt PushDeliveryAttempt, device *PushDevice, token, relayURL, apiKey string) pushSendResult {
+// sendWithCapability posts one attempt to the relay. A relay that predates
+// the push target fields rejects them before it records the idempotency key,
+// so the attempt is resent once without them under the same key, and later
+// sends to that relay omit them for relayTargetRecheck.
+//
+// Only that rejection (400 unexpected_field naming a target field) may mark a
+// relay as lacking them.
+//
+// The fields are part of the relay's idempotency hash, and nothing records
+// which choice an attempt was first sent with: an earlier server version,
+// another replica, or a send inside relayTargetRecheck may have made the
+// other one. The relay answers a retry that differs with 422
+// idempotency_key_reuse, so the attempt is resent once with the other choice,
+// which the relay replays or resumes instead of delivering again.
+func (s *pushSender) sendWithCapability(ctx context.Context, attempt PushDeliveryAttempt, device *PushDevice, token string, target pushRelayTarget, relayURL, apiKey string) pushSendResult {
+	sent := target
+	if sent != (pushRelayTarget{}) && s.relayLacksTarget(relayURL) {
+		sent = pushRelayTarget{}
+	}
+	result := s.postRelay(ctx, attempt, device, token, sent, relayURL, apiKey)
+	switch {
+	case sent != (pushRelayTarget{}) && relayRejectedTarget(result):
+		s.markRelayLacksTarget(relayURL)
+		s.logger.InfoContext(ctx, "push relay does not accept server_id and profile_id yet; sending without them")
+		return s.postRelay(ctx, attempt, device, token, pushRelayTarget{}, relayURL, apiKey)
+	case target != (pushRelayTarget{}) && relayRecordedOtherTarget(result):
+		other := pushRelayTarget{}
+		if sent == (pushRelayTarget{}) {
+			other = target
+		}
+		// A relay that refuses the fields never recorded them, so its answer
+		// says nothing about the payload the 422 was about.
+		if retry := s.postRelay(ctx, attempt, device, token, other, relayURL, apiKey); !relayRejectedTarget(retry) {
+			return retry
+		}
+	}
+	return result
+}
+
+func (s *pushSender) markRelayLacksTarget(relayURL string) {
+	s.targetMu.Lock()
+	defer s.targetMu.Unlock()
+	s.relayWithoutTarget[relayURL] = s.now().Add(relayTargetRecheck)
+}
+
+func (s *pushSender) relayLacksTarget(relayURL string) bool {
+	s.targetMu.Lock()
+	defer s.targetMu.Unlock()
+	return s.now().Before(s.relayWithoutTarget[relayURL])
+}
+
+// relayRejectedTarget recognizes an older relay's strict-field rejection of
+// a push target field. Every other 400 keeps its ordinary handling.
+func relayRejectedTarget(result pushSendResult) bool {
+	if result.HTTPStatus != http.StatusBadRequest || result.UpstreamReason != "unexpected_field" {
+		return false
+	}
+	field := strings.TrimSpace(strings.TrimPrefix(result.Message, "unexpected field:"))
+	return field == "server_id" || field == "profile_id"
+}
+
+// relayRecordedOtherTarget recognizes the relay refusing a retry whose payload
+// differs from the one it recorded under the attempt's idempotency key.
+func relayRecordedOtherTarget(result pushSendResult) bool {
+	return result.HTTPStatus == http.StatusUnprocessableEntity && result.UpstreamReason == relayCodeIdempotencyKeyReuse
+}
+
+func (s *pushSender) postRelay(ctx context.Context, attempt PushDeliveryAttempt, device *PushDevice, token string, target pushRelayTarget, relayURL, apiKey string) pushSendResult {
 	deliveryID := attempt.ID
 	if attempt.NotificationDeliveryID != nil {
 		deliveryID = *attempt.NotificationDeliveryID
@@ -458,22 +590,24 @@ func (s *pushSender) sendWithCapability(ctx context.Context, attempt PushDeliver
 	collapseID := deliveryID
 	sendPath := relayAppleSendPath
 	var payload any = pushRelayAppleRequest{
-		Token:          token,
-		Environment:    device.APNsEnvironment,
-		Topic:          device.APNsTopic,
-		Mode:           "private_alert",
-		ServerDeviceID: device.ServerDeviceID,
-		DeliveryID:     deliveryID,
-		CollapseID:     &collapseID,
+		Token:           token,
+		Environment:     device.APNsEnvironment,
+		Topic:           device.APNsTopic,
+		Mode:            relayModePrivateAlert,
+		ServerDeviceID:  device.ServerDeviceID,
+		DeliveryID:      deliveryID,
+		CollapseID:      &collapseID,
+		pushRelayTarget: target,
 	}
 	if device.Platform == PushPlatformAndroid {
 		sendPath = relayFcmSendPath
 		payload = pushRelayFcmRequest{
-			Token:          token,
-			Mode:           "private_alert",
-			ServerDeviceID: device.ServerDeviceID,
-			DeliveryID:     deliveryID,
-			CollapseID:     &collapseID,
+			Token:           token,
+			Mode:            relayModePrivateAlert,
+			ServerDeviceID:  device.ServerDeviceID,
+			DeliveryID:      deliveryID,
+			CollapseID:      &collapseID,
+			pushRelayTarget: target,
 		}
 	}
 	body, err := json.Marshal(payload)
@@ -581,6 +715,9 @@ type ApplePushTestResult struct {
 	AttemptID      string
 	PushDeviceID   string
 	ServerDeviceID string
+	// DeliveryID is the notification the test carried; empty when the
+	// profile had none.
+	DeliveryID     string
 	Outcome        string
 	RelayRequestID string
 	UpstreamStatus *int
@@ -634,6 +771,9 @@ func (s *System) sendPushTest(ctx context.Context, platform, profileID, serverDe
 		Outcome:        updated.Outcome,
 		UpstreamStatus: updated.UpstreamStatus,
 	}
+	if updated.NotificationDeliveryID != nil {
+		result.DeliveryID = *updated.NotificationDeliveryID
+	}
 	if updated.RelayRequestID != nil {
 		result.RelayRequestID = *updated.RelayRequestID
 	}
diff --git a/internal/notifications/push_sender_test.go b/internal/notifications/push_sender_test.go
index ad2b896238..24e1da31d3 100644
--- a/internal/notifications/push_sender_test.go
+++ b/internal/notifications/push_sender_test.go
@@ -6,6 +6,7 @@ import (
 	"errors"
 	"net/http"
 	"net/http/httptest"
+	"slices"
 	"strings"
 	"testing"
 	"time"
@@ -249,6 +250,180 @@ func TestPushSenderSendMapsRelayTerminalFCMRejection(t *testing.T) {
 	}
 }
 
+// Every push names the deployment and profile it belongs to, so a device
+// signed into several servers or profiles fetches display data from the right
+// one. The relay rejects an empty field, so a target it cannot complete is
+// left out whole.
+func TestPushSenderNamesTheServerAndProfileOfEachPush(t *testing.T) {
+	deliveryID := "delivery-1"
+	identity := func(context.Context) (string, error) { return "server-1", nil }
+	for _, tc := range []struct {
+		name     string
+		attempt  PushDeliveryAttempt
+		device   PushDevice
+		serverID func(context.Context) (string, error)
+		path     string
+		named    bool
+	}{
+		{name: "apple delivery", attempt: PushDeliveryAttempt{ID: "attempt-1", NotificationDeliveryID: &deliveryID},
+			device:   PushDevice{ProfileID: "profile-1", APNsEnvironment: APNsEnvironmentSandbox, APNsTopic: ApplePushTopicPrairie, ServerDeviceID: "server-device-1"},
+			serverID: identity, path: relayAppleSendPath, named: true},
+		{name: "android test push", attempt: PushDeliveryAttempt{ID: "attempt-2"},
+			device:   PushDevice{Platform: PushPlatformAndroid, ProfileID: "profile-1", ServerDeviceID: "server-device-2"},
+			serverID: identity, path: relayFcmSendPath, named: true},
+		{name: "identity unreadable", attempt: PushDeliveryAttempt{ID: "attempt-3"},
+			device:   PushDevice{Platform: PushPlatformAndroid, ProfileID: "profile-1", ServerDeviceID: "server-device-3"},
+			serverID: func(context.Context) (string, error) { return "", errors.New("settings store down") }, path: relayFcmSendPath},
+		{name: "profile missing", attempt: PushDeliveryAttempt{ID: "attempt-4"},
+			device:   PushDevice{APNsEnvironment: APNsEnvironmentSandbox, APNsTopic: ApplePushTopicPrairie, ServerDeviceID: "server-device-4"},
+			serverID: identity, path: relayAppleSendPath},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var body map[string]any
+			server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if r.URL.Path != tc.path {
+					t.Errorf("path = %q, want %q", r.URL.Path, tc.path)
+				}
+				if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+					t.Errorf("decode request body: %v", err)
+				}
+				_, _ = w.Write([]byte(`{"request_id":"relay-request","status":"accepted"}`))
+			}))
+			defer server.Close()
+			sender := newPushSender(nil, nil, nil, NewSettings(mapSettingReader{
+				SettingPushRelayURL:    server.URL,
+				SettingPushRelayAPIKey: "relay-key",
+			}))
+			sender.client = server.Client()
+			sender.developmentRelayURL = server.URL
+			sender.serverID = tc.serverID
+
+			result := sender.send(context.Background(), tc.attempt, &tc.device, strings.Repeat("a", 64))
+			if !result.OK {
+				t.Fatalf("result = %+v", result)
+			}
+			serverID, hasServer := body["server_id"]
+			profileID, hasProfile := body["profile_id"]
+			if tc.named && (serverID != "server-1" || profileID != "profile-1") {
+				t.Fatalf("relay body = %v, want server-1 and profile-1", body)
+			}
+			if !tc.named && (hasServer || hasProfile) {
+				t.Fatalf("relay body = %v, want neither server_id nor profile_id", body)
+			}
+		})
+	}
+}
+
+// A relay that predates server_id and profile_id rejects them as unexpected
+// before recording the idempotency key. The attempt is resent without them
+// under the same key, and later sends to that relay leave them out until the
+// recheck window passes. Any other unexpected field keeps its ordinary failure.
+func TestPushSenderResendsWithoutTargetToARelayThatPredatesIt(t *testing.T) {
+	type sent struct {
+		key      string
+		targeted bool
+	}
+	var requests []sent
+	rejectField := "server_id"
+	now := time.Date(2026, 10, 12, 9, 0, 0, 0, time.UTC)
+	sender := newPushSender(nil, nil, nil, NewSettings(mapSettingStore{}))
+	sender.now = func() time.Time { return now }
+	sender.client = &http.Client{Transport: relayRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		var body map[string]any
+		if err := json.NewDecoder(req.Body).Decode(&body); err != nil {
+			t.Errorf("decode request body: %v", err)
+		}
+		_, targeted := body["server_id"]
+		requests = append(requests, sent{key: req.Header.Get("Idempotency-Key"), targeted: targeted})
+		if targeted {
+			return relayResponse(http.StatusBadRequest, `{"error":{"code":"unexpected_field","message":"unexpected field: `+rejectField+`"}}`), nil
+		}
+		return relayResponse(http.StatusOK, `{"request_id":"relay-request","status":"accepted"}`), nil
+	})}
+	device := &PushDevice{Platform: PushPlatformAndroid, ProfileID: "profile-1", ServerDeviceID: "server-device-1"}
+	target := pushRelayTarget{ServerID: "server-1", ProfileID: "profile-1"}
+	send := func(attemptID string) pushSendResult {
+		requests = nil
+		return sender.sendWithCapability(context.Background(), PushDeliveryAttempt{ID: attemptID}, device, strings.Repeat("F", 140), target, DefaultPushRelayURL, "capability")
+	}
+
+	if result := send("attempt-1"); !result.OK {
+		t.Fatalf("fallback result = %+v", result)
+	}
+	if want := []sent{{"attempt-1", true}, {"attempt-1", false}}; !slices.Equal(requests, want) {
+		t.Fatalf("first send requests = %+v, want %+v", requests, want)
+	}
+	if result := send("attempt-2"); !result.OK || !slices.Equal(requests, []sent{{"attempt-2", false}}) {
+		t.Fatalf("remembered relay: result = %+v, requests = %+v", result, requests)
+	}
+	now = now.Add(relayTargetRecheck)
+	if result := send("attempt-3"); !result.OK || len(requests) != 2 || !requests[0].targeted {
+		t.Fatalf("after recheck: result = %+v, requests = %+v", result, requests)
+	}
+
+	now = now.Add(relayTargetRecheck)
+	rejectField = "collapse_id"
+	result := send("attempt-4")
+	if result.OK || result.HTTPStatus != http.StatusBadRequest || result.UpstreamReason != "unexpected_field" || len(requests) != 1 {
+		t.Fatalf("other unexpected field: result = %+v, requests = %+v", result, requests)
+	}
+}
+
+func TestPushSenderRetriesAnAttemptWithTheTargetChoiceTheRelayRecorded(t *testing.T) {
+	type sent struct {
+		key      string
+		targeted bool
+	}
+	var requests []sent
+	recorded := map[string]bool{}
+	now := time.Date(2026, 10, 12, 9, 0, 0, 0, time.UTC)
+	sender := newPushSender(nil, nil, nil, NewSettings(mapSettingStore{}))
+	sender.now = func() time.Time { return now }
+	sender.client = &http.Client{Transport: relayRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		var body map[string]any
+		if err := json.NewDecoder(req.Body).Decode(&body); err != nil {
+			t.Errorf("decode request body: %v", err)
+		}
+		key := req.Header.Get("Idempotency-Key")
+		_, targeted := body["server_id"]
+		requests = append(requests, sent{key: key, targeted: targeted})
+		if first, ok := recorded[key]; ok && first != targeted {
+			return relayResponse(http.StatusUnprocessableEntity, `{"error":{"code":"idempotency_key_reuse","message":"Idempotency-Key was reused with a different payload"}}`), nil
+		}
+		recorded[key] = targeted
+		return relayResponse(http.StatusOK, `{"request_id":"relay-request","status":"accepted"}`), nil
+	})}
+	device := &PushDevice{Platform: PushPlatformApple, ProfileID: "profile-1", ServerDeviceID: "server-device-1"}
+	target := pushRelayTarget{ServerID: "server-1", ProfileID: "profile-1"}
+	send := func(attemptID string, target pushRelayTarget) pushSendResult {
+		requests = nil
+		return sender.sendWithCapability(context.Background(), PushDeliveryAttempt{ID: attemptID}, device, strings.Repeat("a", 64), target, DefaultPushRelayURL, "capability")
+	}
+
+	// First sent without the fields, by an earlier server version or while the
+	// relay was remembered as lacking them; retried with them.
+	recorded["attempt-1"] = false
+	if result := send("attempt-1", target); !result.OK || !slices.Equal(requests, []sent{{"attempt-1", true}, {"attempt-1", false}}) {
+		t.Fatalf("recorded without target: result = %+v, requests = %+v", result, requests)
+	}
+
+	// First sent with them; retried while this process remembers the relay as
+	// lacking them.
+	recorded["attempt-2"] = true
+	sender.markRelayLacksTarget(DefaultPushRelayURL)
+	if result := send("attempt-2", target); !result.OK || !slices.Equal(requests, []sent{{"attempt-2", false}, {"attempt-2", true}}) {
+		t.Fatalf("recorded with target: result = %+v, requests = %+v", result, requests)
+	}
+
+	// Without a target of its own the server has no other choice to offer.
+	// send keeps such an attempt retryable when only the identity lookup failed.
+	recorded["attempt-3"] = true
+	result := send("attempt-3", pushRelayTarget{})
+	if result.OK || result.HTTPStatus != http.StatusUnprocessableEntity || result.UpstreamReason != relayCodeIdempotencyKeyReuse || len(requests) != 1 {
+		t.Fatalf("no target: result = %+v, requests = %+v", result, requests)
+	}
+}
+
 func TestTerminalFCMDeviceRejectionReasons(t *testing.T) {
 	if !terminalFCMDeviceRejection(http.StatusUnprocessableEntity, "fcm_rejected",
 		"FCM rejected the notification: UNREGISTERED") {
@@ -506,8 +681,8 @@ func TestPushSenderMapsRelayIdempotencyStatesWithStableKey(t *testing.T) {
 				APNsTopic:       ApplePushTopicPrairie,
 				ServerDeviceID:  "server-device-stable",
 			}
-			first := sender.sendWithCapability(context.Background(), attempt, device, strings.Repeat("a", 64), DefaultPushRelayURL, "capability")
-			second := sender.sendWithCapability(context.Background(), attempt, device, strings.Repeat("a", 64), DefaultPushRelayURL, "capability")
+			first := sender.sendWithCapability(context.Background(), attempt, device, strings.Repeat("a", 64), pushRelayTarget{}, DefaultPushRelayURL, "capability")
+			second := sender.sendWithCapability(context.Background(), attempt, device, strings.Repeat("a", 64), pushRelayTarget{}, DefaultPushRelayURL, "capability")
 			if first.HTTPStatus != tc.status || first.UpstreamReason != tc.code {
 				t.Fatalf("result = %+v", first)
 			}
@@ -781,3 +956,31 @@ func TestPushSenderKeepsCredentialRegisteredWhileParking(t *testing.T) {
 		t.Fatalf("stored state = %#v, want the administrator's credential kept", store.values)
 	}
 }
+
+func TestPushSenderRetriesLaterWhenAFailedIdentityLookupMismatchesTheRecordedAttempt(t *testing.T) {
+	server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusUnprocessableEntity)
+		_, _ = w.Write([]byte(`{"error":{"code":"idempotency_key_reuse","message":"Idempotency-Key was reused with a different payload"}}`))
+	}))
+	defer server.Close()
+	sender := newPushSender(nil, nil, nil, NewSettings(mapSettingReader{
+		SettingPushRelayURL:    server.URL,
+		SettingPushRelayAPIKey: "relay-key",
+	}))
+	sender.client = server.Client()
+	sender.developmentRelayURL = server.URL
+	device := &PushDevice{Platform: PushPlatformAndroid, ProfileID: "profile-1", ServerDeviceID: "server-device-1"}
+	send := func() pushSendResult {
+		return sender.send(context.Background(), PushDeliveryAttempt{ID: "attempt-1"}, device, strings.Repeat("a", 64))
+	}
+
+	sender.serverID = func(context.Context) (string, error) { return "", errors.New("settings store down") }
+	if result := send(); result.HTTPStatus != http.StatusServiceUnavailable || result.UpstreamReason != "server_identity_unavailable" || !retryableHTTPStatus(result.HTTPStatus) {
+		t.Fatalf("identity lookup failed: result = %+v, want a retryable server_identity_unavailable", result)
+	}
+
+	sender.serverID = nil
+	if result := send(); result.HTTPStatus != http.StatusUnprocessableEntity || result.UpstreamReason != relayCodeIdempotencyKeyReuse {
+		t.Fatalf("no identity configured: result = %+v, want the relay's 422", result)
+	}
+}
diff --git a/internal/notifications/push_test_send_db_test.go b/internal/notifications/push_test_send_db_test.go
new file mode 100644
index 0000000000..ff92f1976f
--- /dev/null
+++ b/internal/notifications/push_test_send_db_test.go
@@ -0,0 +1,149 @@
+package notifications
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// An administrator test push carries the device profile's newest
+// notification, so the device fetches and shows that notification's real
+// text. Profile IDs repeat across accounts, so neither another account's
+// same-named profile nor a sibling profile lends its notification, and a
+// profile with no notification keeps a bare test. Dispatching that
+// notification must leave a pending test to the request that enqueued it.
+// Repeating the test beside the delivery's own attempt must not collide on the
+// attempt key, and none of it touches the inbox.
+func TestSendPushTestCarriesTheProfilesNewestNotification(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatalf("connect test database: %v", err)
+	}
+	t.Cleanup(pool.Close)
+
+	prefix := fmt.Sprintf("testpush-%d", time.Now().UnixNano())
+	var accounts []int
+	t.Cleanup(func() {
+		cleanup := context.Background()
+		_, _ = pool.Exec(cleanup, `DELETE FROM push_devices WHERE user_id = ANY($1)`, accounts)
+		_, _ = pool.Exec(cleanup, `DELETE FROM notification_deliveries WHERE user_id = ANY($1)`, accounts)
+		_, _ = pool.Exec(cleanup, `DELETE FROM users WHERE id = ANY($1)`, accounts)
+	})
+	for _, name := range []string{"account", "other-account"} {
+		var id int
+		username := prefix + "-" + name
+		if err := pool.QueryRow(ctx, `INSERT INTO users (username, email, password_hash, role) VALUES ($1, $2, '', 'user') RETURNING id`,
+			username, username+"@example.test").Scan(&id); err != nil {
+			t.Fatalf("seed account: %v", err)
+		}
+		accounts = append(accounts, id)
+	}
+	account, otherAccount := accounts[0], accounts[1]
+	exec := func(sql string, args ...any) {
+		t.Helper()
+		if _, err := pool.Exec(ctx, sql, args...); err != nil {
+			t.Fatalf("seed: %v", err)
+		}
+	}
+
+	const profile = "default"
+	quietProfile := prefix + "-quiet"
+	newest := prefix + "-newest"
+	base := time.Now().Add(-time.Hour).UTC()
+	for i, delivery := range []struct {
+		id      string
+		account int
+		profile string
+	}{
+		{prefix + "-older", account, profile},
+		{newest, account, profile},
+		{prefix + "-other-account", otherAccount, profile},
+		{prefix + "-sibling", account, prefix + "-sibling"},
+	} {
+		exec(`INSERT INTO notification_deliveries (id, user_id, profile_id, type, reason_flags, created_at)
+			VALUES ($1, $2, $3, 'webhook.auto_disabled', '{}', $4)`,
+			delivery.id, delivery.account, delivery.profile, base.Add(time.Duration(i)*time.Minute))
+	}
+
+	cipher := testPushCipher(t)
+	repo := NewPushDeviceRepository(pool)
+	register := func(profile, device, token string) *PushDevice {
+		t.Helper()
+		registered, err := repo.UpsertApple(ctx, ApplePushDeviceRegistration{
+			UserID: account, ProfileID: profile, DeviceID: prefix + "-" + device, APNsToken: token,
+			APNsEnvironment: APNsEnvironmentSandbox, APNsTopic: ApplePushTopicPrairie, PushMode: PushModePrivatePush,
+		}, cipher)
+		if err != nil {
+			t.Fatalf("register %s: %v", device, err)
+		}
+		return registered
+	}
+	phone := register(profile, "phone", strings.Repeat("a", 64))
+	quietPhone := register(quietProfile, "quiet-phone", strings.Repeat("b", 64))
+	// The delivery's own first attempt holds attempt number 1 for the phone.
+	exec(`INSERT INTO push_delivery_attempts (id, notification_delivery_id, push_device_id, trigger_type, provider, platform, attempt_number, outcome)
+		VALUES ($1, $2, $3, 'delivery', 'prairie_relay', 'apple', 1, 'delivered')`, prefix+"-own", newest, phone.ID)
+
+	var relayed []map[string]any
+	settings := NewSettings(mapSettingReader{SettingPushRelayURL: DefaultPushRelayURL, SettingPushRelayAPIKey: "relay-key"})
+	sender := newPushSender(repo, NewDeliveryRepository(pool), cipher, settings)
+	sender.client = &http.Client{Transport: relayRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+		var body map[string]any
+		if err := json.NewDecoder(req.Body).Decode(&body); err != nil {
+			t.Errorf("decode relay body: %v", err)
+		}
+		relayed = append(relayed, body)
+		return relayResponse(http.StatusOK, `{"request_id":"relay-request","status":"accepted"}`), nil
+	})}
+	system := &System{Settings: settings, pushDeviceRepo: repo, pushSender: sender}
+
+	pending, _, err := repo.EnqueueTestAttempt(ctx, PushPlatformApple, profile, phone.ServerDeviceID)
+	if err != nil {
+		t.Fatalf("enqueue test: %v", err)
+	}
+	if dispatched, err := repo.ClaimPendingPushForDelivery(ctx, newest); err != nil || len(dispatched) != 0 {
+		t.Fatalf("delivery dispatch claimed %+v (err %v); the pending test belongs to its request", dispatched, err)
+	}
+	if claimed, err := repo.ClaimPushAttemptByID(ctx, pending.ID); err != nil || len(claimed) != 1 {
+		t.Fatalf("test claim = %+v (err %v), want the pending test", claimed, err)
+	}
+
+	for range 2 {
+		result, err := system.SendApplePushTest(ctx, profile, phone.ServerDeviceID)
+		if err != nil {
+			t.Fatalf("send test: %v", err)
+		}
+		body := relayed[len(relayed)-1]
+		if result.Outcome != PushOutcomeDelivered || result.DeliveryID != newest || body["delivery_id"] != newest || body["collapse_id"] != newest {
+			t.Fatalf("result = %+v, relay body = %v; want delivered carrying %s", result, body, newest)
+		}
+	}
+
+	result, err := system.SendApplePushTest(ctx, quietProfile, quietPhone.ServerDeviceID)
+	if err != nil {
+		t.Fatalf("send bare test: %v", err)
+	}
+	if body := relayed[len(relayed)-1]; result.Outcome != PushOutcomeDelivered || result.DeliveryID != "" || body["delivery_id"] != result.AttemptID {
+		t.Fatalf("bare test result = %+v, relay body = %v", result, body)
+	}
+
+	var rows, read int
+	if err := pool.QueryRow(ctx, `SELECT count(*), count(read_at) FROM notification_deliveries WHERE user_id = ANY($1)`, accounts).Scan(&rows, &read); err != nil {
+		t.Fatal(err)
+	}
+	if rows != 4 || read != 0 {
+		t.Fatalf("inbox rows = %d with %d read; test pushes must not touch the inbox", rows, read)
+	}
+}
diff --git a/internal/notifications/recipient_access_db_test.go b/internal/notifications/recipient_access_db_test.go
index e3bc5d2a0f..7b05549dc0 100644
--- a/internal/notifications/recipient_access_db_test.go
+++ b/internal/notifications/recipient_access_db_test.go
@@ -196,7 +196,7 @@ func TestFanoutResolvesOnlyEligibleRecipients(t *testing.T) {
 	pool := inboxPageDB(t)
 	c := seedAccessCatalog(t, pool)
 	seedFanoutEvent(t, pool, c, []string{"open", "muted"})
-	muted := DefaultPreferences("muted")
+	muted := DefaultPreferences(1, "muted")
 	muted.Enabled = false
 	if err := NewPreferencesRepository(pool).Upsert(t.Context(), muted); err != nil {
 		t.Fatalf("mute profile: %v", err)
@@ -305,7 +305,8 @@ func TestDispatchOperationalResolvesBeforeHoldingConnection(t *testing.T) {
 	}
 }
 
-// seedFanoutEvent creates the fanout tables in the test schema, an interest
+// seedFanoutEvent creates the fanout tables in the test schema (series mutes
+// included, empty), an interest
 // row on account 1 favoriting c's series for each profile, and release event
 // "event-1" for c's episode. It returns the episode key.
 func seedFanoutEvent(t *testing.T, pool *pgxpool.Pool, c accessCatalog, profiles []string) int {
@@ -313,7 +314,8 @@ func seedFanoutEvent(t *testing.T, pool *pgxpool.Pool, c accessCatalog, profiles
 	ctx := t.Context()
 	if _, err := pool.Exec(ctx, `
 		CREATE TABLE release_events (LIKE public.release_events INCLUDING ALL);
-		CREATE TABLE profile_series_interest (LIKE public.profile_series_interest INCLUDING ALL)`); err != nil {
+		CREATE TABLE profile_series_interest (LIKE public.profile_series_interest INCLUDING ALL);
+		CREATE TABLE profile_series_notification_mutes (LIKE public.profile_series_notification_mutes INCLUDING ALL)`); err != nil {
 		t.Fatalf("create fanout tables: %v", err)
 	}
 	for _, profile := range profiles {
diff --git a/internal/notifications/release_repo.go b/internal/notifications/release_repo.go
index 18a0368f9f..e2a5cdb304 100644
--- a/internal/notifications/release_repo.go
+++ b/internal/notifications/release_repo.go
@@ -333,9 +333,11 @@ type newAvailability struct {
 	AvailableAt   time.Time
 }
 
-// recordAvailability runs the availability insert and the optional release
-// event insert in one short transaction, so an event is never created without
-// its availability fact.
+// recordAvailability runs the availability insert, marks the inserted rows
+// that are releases, and inserts the optional release events in one short
+// transaction, so an event is never created without its availability fact.
+// Rows are marked released whenever the library is seeded, whether or not
+// release events are enabled: Next Up orders by released_at too.
 func (r *ReleaseRepository) recordAvailability(ctx context.Context, libraryID int, emitEvents bool, query string, args []any) (int, int, error) {
 	tx, err := r.pool.Begin(ctx)
 	if err != nil {
@@ -362,25 +364,17 @@ func (r *ReleaseRepository) recordAvailability(ctx context.Context, libraryID in
 	}
 
 	events := 0
-	if emitEvents && len(inserted) > 0 {
-		ids := make([]string, len(inserted))
-		for i, row := range inserted {
-			ids[i] = row.EpisodeID
-		}
-		addedEarlier, err := episodesAddedBeforeWindow(ctx, tx, libraryID, ids)
+	if len(inserted) > 0 {
+		releases, err := markReleasedAvailability(ctx, tx, libraryID, emitEvents, inserted)
 		if err != nil {
 			return 0, 0, err
 		}
-		releases := make([]newAvailability, 0, len(inserted))
-		for _, row := range inserted {
-			if _, ok := addedEarlier[row.EpisodeID]; !ok {
-				releases = append(releases, row)
+		if emitEvents {
+			events, err = insertReleaseEvents(ctx, tx, libraryID, releases)
+			if err != nil {
+				return 0, 0, err
 			}
 		}
-		events, err = insertReleaseEvents(ctx, tx, libraryID, releases)
-		if err != nil {
-			return 0, 0, err
-		}
 	}
 
 	if err := tx.Commit(ctx); err != nil {
@@ -389,6 +383,52 @@ func (r *ReleaseRepository) recordAvailability(ctx context.Context, libraryID in
 	return len(inserted), events, nil
 }
 
+// markReleasedAvailability sets released_at on the newly inserted rows that
+// are releases and returns them. Nothing is a release until the library's
+// first full scan has seeded it, and an episode whose file was added before
+// newReleaseWindow is a late match, not news. A caller emitting events has
+// already found the library seeded; otherwise the seed state is read here,
+// since releases are marked even while release events are off.
+func markReleasedAvailability(ctx context.Context, tx pgx.Tx, libraryID int, seeded bool, inserted []newAvailability) ([]newAvailability, error) {
+	if !seeded {
+		if err := tx.QueryRow(ctx,
+			`SELECT EXISTS (SELECT 1 FROM notification_library_seed_state WHERE library_id = $1)`,
+			libraryID,
+		).Scan(&seeded); err != nil {
+			return nil, fmt.Errorf("read library seed state: %w", err)
+		}
+	}
+	if !seeded {
+		return nil, nil
+	}
+	ids := make([]string, len(inserted))
+	for i, row := range inserted {
+		ids[i] = row.EpisodeID
+	}
+	addedEarlier, err := episodesAddedBeforeWindow(ctx, tx, libraryID, ids)
+	if err != nil {
+		return nil, err
+	}
+	releases := make([]newAvailability, 0, len(inserted))
+	releasedIDs := make([]string, 0, len(inserted))
+	for _, row := range inserted {
+		if _, ok := addedEarlier[row.EpisodeID]; !ok {
+			releases = append(releases, row)
+			releasedIDs = append(releasedIDs, row.EpisodeID)
+		}
+	}
+	if len(releasedIDs) == 0 {
+		return nil, nil
+	}
+	if _, err := tx.Exec(ctx, `
+		UPDATE episode_availability SET released_at = available_at
+		WHERE library_id = $1 AND episode_id = ANY($2)`,
+		libraryID, releasedIDs); err != nil {
+		return nil, fmt.Errorf("mark released availability: %w", err)
+	}
+	return releases, nil
+}
+
 // episodesAddedBeforeWindow returns the episodes whose library membership
 // began before newReleaseWindow. episode_libraries.first_seen_at is the
 // catalog's added time: the scanner takes it from the earliest linked file,
diff --git a/internal/notifications/release_repo_db_test.go b/internal/notifications/release_repo_db_test.go
index c3e63ddfd8..b77eac0ae7 100644
--- a/internal/notifications/release_repo_db_test.go
+++ b/internal/notifications/release_repo_db_test.go
@@ -7,6 +7,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgxpool"
 
 	"github.com/prairie-server/prairie-server/internal/envutil"
@@ -80,6 +81,9 @@ func (f releaseFixture) eventTargets(t *testing.T) []string {
 		}
 		ids = append(ids, id)
 	}
+	if err := rows.Err(); err != nil {
+		t.Fatalf("list release events: %v", err)
+	}
 	slices.Sort(ids)
 	return ids
 }
@@ -113,6 +117,67 @@ func TestEpisodeReleasesSkipEpisodesAddedLongAgo(t *testing.T) {
 	if got := f.eventTargets(t); !slices.Equal(got, want) {
 		t.Fatalf("release events for %v, want %v", got, want)
 	}
+	if got := f.releasedEpisodes(t); !slices.Equal(got, want) {
+		t.Fatalf("released_at set for %v, want %v", got, want)
+	}
+}
+
+func (f releaseFixture) releasedEpisodes(t *testing.T) []string {
+	t.Helper()
+	rows, err := f.pool.Query(context.Background(), `
+		SELECT episode_id FROM episode_availability
+		WHERE library_id = $1 AND released_at = available_at
+		ORDER BY episode_id`, f.libraryID)
+	if err != nil {
+		t.Fatalf("list released availability: %v", err)
+	}
+	ids, err := pgx.CollectRows(rows, pgx.RowTo[string])
+	if err != nil {
+		t.Fatalf("scan released availability: %v", err)
+	}
+	return ids
+}
+
+// TestEpisodeAvailabilityRecordsReleaseTime checks the released_at decision
+// Next Up orders by: set for a new episode in a seeded library even while
+// release events are off, and left empty for a late match and for any episode
+// recorded before the library is seeded.
+func TestEpisodeAvailabilityRecordsReleaseTime(t *testing.T) {
+	f := newReleaseFixture(t, "series")
+	ctx := context.Background()
+	series := f.prefix + "-series"
+	seeding, lateMatch, justAdded := f.prefix+"-e1", f.prefix+"-e2", f.prefix+"-e3"
+	f.exec(t, `INSERT INTO media_items (content_id, type, title, genres) VALUES ($1, 'series', 'Series', '{}')`, series)
+	f.exec(t, `INSERT INTO seasons (content_id, series_id, season_number) VALUES ($1 || '-s1', $1, 1)`, series)
+	f.exec(t, `INSERT INTO episodes (content_id, series_id, season_id, season_number, episode_number, title)
+		VALUES ($1, $4, $4 || '-s1', 1, 1, 'E1'), ($2, $4, $4 || '-s1', 1, 2, 'E2'), ($3, $4, $4 || '-s1', 1, 3, 'E3')`,
+		seeding, lateMatch, justAdded, series)
+	t.Cleanup(func() {
+		_, _ = f.pool.Exec(context.Background(), `DELETE FROM notification_library_seed_state WHERE library_id = $1`, f.libraryID)
+	})
+
+	// The library's first full scan records its back catalog silently, even
+	// an episode whose file is new.
+	f.exec(t, `INSERT INTO episode_libraries (episode_id, media_folder_id, first_seen_at) VALUES ($1, $2, now())`,
+		seeding, f.libraryID)
+	if _, _, err := f.repo.RecordAvailabilityForLibrary(ctx, f.libraryID, false); err != nil {
+		t.Fatalf("seeding scan: %v", err)
+	}
+	if err := f.repo.MarkLibrarySeeded(ctx, f.libraryID); err != nil {
+		t.Fatalf("MarkLibrarySeeded: %v", err)
+	}
+
+	// Later scans, with release events off: an old file matched late and a
+	// new episode.
+	f.exec(t, `INSERT INTO episode_libraries (episode_id, media_folder_id, first_seen_at)
+		VALUES ($1, $3, now() - interval '30 days'), ($2, $3, now())`, lateMatch, justAdded, f.libraryID)
+	if _, events, err := f.repo.RecordAvailabilityForLibrary(ctx, f.libraryID, false); err != nil || events != 0 {
+		t.Fatalf("RecordAvailabilityForLibrary = %d events, %v; want 0, nil", events, err)
+	}
+
+	if got, want := f.releasedEpisodes(t), []string{justAdded}; !slices.Equal(got, want) {
+		t.Fatalf("released_at set for %v, want %v", got, want)
+	}
 }
 
 // TestMovieReleasesSkipMoviesAddedLongAgo applies the same rule to flat
diff --git a/internal/notifications/release_types.go b/internal/notifications/release_types.go
index c2787c6cbc..9886c7294e 100644
--- a/internal/notifications/release_types.go
+++ b/internal/notifications/release_types.go
@@ -84,6 +84,8 @@ type SeriesInterest struct {
 	UpdatedAt               time.Time
 }
 
+func (i SeriesInterest) key() profileKey { return profileKey{i.UserID, i.ProfileID} }
+
 // HasAnyInterest reports whether at least one interest flag is set.
 func (i SeriesInterest) HasAnyInterest() bool {
 	return i.Favorite || i.Watchlist || i.ContinueWatching || i.NextUpCandidate
@@ -98,6 +100,29 @@ type ReasonFlags struct {
 	NextUp           bool `json:"next_up"`
 }
 
+// The reason names, as ReasonFlags' JSON keys spell them.
+const (
+	ReasonFavorite         = "favorite"
+	ReasonWatchlist        = "watchlist"
+	ReasonContinueWatching = "continue_watching"
+	ReasonNextUp           = "next_up"
+)
+
+// Has reports whether the named reason is set; an unknown name never is.
+func (f ReasonFlags) Has(reason string) bool {
+	switch reason {
+	case ReasonFavorite:
+		return f.Favorite
+	case ReasonWatchlist:
+		return f.Watchlist
+	case ReasonContinueWatching:
+		return f.ContinueWatching
+	case ReasonNextUp:
+		return f.NextUp
+	}
+	return false
+}
+
 // Any reports whether at least one reason matched.
 func (f ReasonFlags) Any() bool {
 	return f.Favorite || f.Watchlist || f.ContinueWatching || f.NextUp
@@ -106,6 +131,7 @@ func (f ReasonFlags) Any() bool {
 // Preferences are the per-profile notification controls. Missing rows default
 // to all-enabled.
 type Preferences struct {
+	UserID                 int       `json:"-"`
 	ProfileID              string    `json:"profile_id"`
 	Enabled                bool      `json:"enabled"`
 	NotifyFavorites        bool      `json:"notify_favorites"`
@@ -115,9 +141,11 @@ type Preferences struct {
 	UpdatedAt              time.Time `json:"-"`
 }
 
-// DefaultPreferences returns the all-enabled defaults for a profile.
-func DefaultPreferences(profileID string) Preferences {
+// DefaultPreferences returns the all-enabled defaults for the profile on
+// userID's account.
+func DefaultPreferences(userID int, profileID string) Preferences {
 	return Preferences{
+		UserID:                 userID,
 		ProfileID:              profileID,
 		Enabled:                true,
 		NotifyFavorites:        true,
@@ -189,3 +217,5 @@ type InsertedDelivery struct {
 	ProfileID string
 	CreatedAt time.Time
 }
+
+func (d InsertedDelivery) key() profileKey { return profileKey{d.UserID, d.ProfileID} }
diff --git a/internal/notifications/request_notifier.go b/internal/notifications/request_notifier.go
index 2716cfe101..3e4fd7f7da 100644
--- a/internal/notifications/request_notifier.go
+++ b/internal/notifications/request_notifier.go
@@ -82,16 +82,15 @@ type RequestFulfillmentNotifier struct {
 // unexported methods keep *System its only production implementation.
 type fulfillmentBackend interface {
 	PostServerChannelRequestEvent(ctx context.Context, event string, info RequestEventInfo)
-	notificationsEnabled(ctx context.Context, profileID string) (bool, error)
+	notificationsEnabled(ctx context.Context, userID int, profileID string) (bool, error)
 	fulfilledDelivered(ctx context.Context, recipient requests.Follower, requestID string) (bool, error)
 	dispatchFulfilled(ctx context.Context, delivery Delivery) error
 }
 
-// notificationsEnabled reads the profile's master toggle. Notification
-// preferences are keyed by profile id alone, so two accounts' legacy
-// "default" profiles share one row, as they do for every notification type.
-func (s *System) notificationsEnabled(ctx context.Context, profileID string) (bool, error) {
-	prefs, err := s.Preferences.Get(ctx, profileID)
+// notificationsEnabled reads the master toggle of the profile on userID's
+// account.
+func (s *System) notificationsEnabled(ctx context.Context, userID int, profileID string) (bool, error) {
+	prefs, err := s.Preferences.Get(ctx, userID, profileID)
 	if err != nil {
 		return false, err
 	}
@@ -176,7 +175,7 @@ func (n *RequestFulfillmentNotifier) notifyFulfilledProfile(ctx context.Context,
 	if err != nil || delivered {
 		return err
 	}
-	enabled, err := n.backend.notificationsEnabled(ctx, recipient.ProfileID)
+	enabled, err := n.backend.notificationsEnabled(ctx, recipient.UserID, recipient.ProfileID)
 	if err != nil {
 		return err
 	}
@@ -290,7 +289,7 @@ func (s *System) dispatchRequestLifecycle(ctx context.Context, req requests.Requ
 	if req.RequestedByProfileID == "" || req.RequestedByUserID <= 0 {
 		return nil // requests without attribution have no recipient
 	}
-	prefs, err := s.Preferences.Get(ctx, req.RequestedByProfileID)
+	prefs, err := s.Preferences.Get(ctx, req.RequestedByUserID, req.RequestedByProfileID)
 	if err != nil {
 		return err
 	}
diff --git a/internal/notifications/request_notifier_test.go b/internal/notifications/request_notifier_test.go
index 778daaece2..2ee1cf1a04 100644
--- a/internal/notifications/request_notifier_test.go
+++ b/internal/notifications/request_notifier_test.go
@@ -18,7 +18,7 @@ func (f *fakeFulfillmentBackend) PostServerChannelRequestEvent(context.Context,
 	f.channelPost++
 }
 
-func (f *fakeFulfillmentBackend) notificationsEnabled(_ context.Context, profileID string) (bool, error) {
+func (f *fakeFulfillmentBackend) notificationsEnabled(_ context.Context, _ int, profileID string) (bool, error) {
 	return !f.disabled[profileID], nil
 }
 
diff --git a/internal/notifications/series_mutes.go b/internal/notifications/series_mutes.go
new file mode 100644
index 0000000000..a219f9802e
--- /dev/null
+++ b/internal/notifications/series_mutes.go
@@ -0,0 +1,72 @@
+package notifications
+
+import (
+	"context"
+	"errors"
+	"fmt"
+)
+
+// ErrSeriesNotFound reports a mute of an ID the catalog has no series for.
+var ErrSeriesNotFound = errors.New("series not found")
+
+// A muted series sends its profile no new-episode notification, whatever
+// interest reasons it has, until the profile unmutes it. The mute lives in
+// its own table rather than on the interest rows: those are recomputed per
+// library and pruned when the reasons go, and a mute must outlast both.
+// Fanout leaves muted profiles out where it chooses recipients
+// (ListActiveBySeries), so no delivery exists for any channel to send.
+
+// MuteSeries mutes the series for the profile. Muting a series already muted
+// changes nothing. It returns ErrSeriesNotFound when the catalog has no
+// series with that ID; catalog access is the caller's check.
+func (s *System) MuteSeries(ctx context.Context, userID int, profileID, seriesID string) error {
+	return s.Interests.muteSeries(ctx, userID, profileID, seriesID)
+}
+
+// UnmuteSeries lifts the profile's mute of the series. Unmuting a series that
+// is not muted changes nothing. Fanout reads the mute when it evaluates a
+// release, so an episode it evaluated while the series was muted stays
+// unannounced, and one still waiting for fanout at unmute is announced.
+func (s *System) UnmuteSeries(ctx context.Context, userID int, profileID, seriesID string) error {
+	return s.Interests.unmuteSeries(ctx, userID, profileID, seriesID)
+}
+
+func (r *InterestRepository) muteSeries(ctx context.Context, userID int, profileID, seriesID string) error {
+	var found bool
+	err := r.pool.QueryRow(ctx, `
+		WITH series AS (
+			SELECT content_id FROM media_items WHERE content_id = $3 AND type = 'series'
+		), muted AS (
+			INSERT INTO profile_series_notification_mutes (user_id, profile_id, series_id)
+			SELECT $1, $2, content_id FROM series
+			ON CONFLICT (user_id, profile_id, series_id) DO NOTHING
+		)
+		SELECT EXISTS (SELECT 1 FROM series)`,
+		userID, profileID, seriesID).Scan(&found)
+	if err != nil {
+		return fmt.Errorf("mute series: %w", err)
+	}
+	if !found {
+		return ErrSeriesNotFound
+	}
+	return nil
+}
+
+func (r *InterestRepository) unmuteSeries(ctx context.Context, userID int, profileID, seriesID string) error {
+	if _, err := r.pool.Exec(ctx,
+		`DELETE FROM profile_series_notification_mutes WHERE user_id = $1 AND profile_id = $2 AND series_id = $3`,
+		userID, profileID, seriesID); err != nil {
+		return fmt.Errorf("unmute series: %w", err)
+	}
+	return nil
+}
+
+// deleteMutesForProfile removes a deleted profile's mutes.
+func (r *InterestRepository) deleteMutesForProfile(ctx context.Context, userID int, profileID string) error {
+	if _, err := r.pool.Exec(ctx,
+		`DELETE FROM profile_series_notification_mutes WHERE user_id = $1 AND profile_id = $2`,
+		userID, profileID); err != nil {
+		return fmt.Errorf("delete series mutes: %w", err)
+	}
+	return nil
+}
diff --git a/internal/notifications/series_mutes_db_test.go b/internal/notifications/series_mutes_db_test.go
new file mode 100644
index 0000000000..31f45ca31e
--- /dev/null
+++ b/internal/notifications/series_mutes_db_test.go
@@ -0,0 +1,208 @@
+package notifications
+
+import (
+	"errors"
+	"slices"
+	"testing"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// TestFanoutSkipsProfilesThatMutedTheSeries covers the series mute at fanout:
+// a profile that muted the series gets no delivery, so no channel sees the
+// episode, and its notification cursor stays put. A refused mute changes
+// nothing, and neither does the mute for a profile with the same ID on another
+// account. The mute leaves the interest row as it was, and once the profile
+// unmutes, the next episode notifies it again.
+func TestFanoutSkipsProfilesThatMutedTheSeries(t *testing.T) {
+	pool := inboxPageDB(t)
+	ctx := t.Context()
+	c := seedAccessCatalog(t, pool)
+	seedFanoutEvent(t, pool, c, []string{"open", "muted", "other-muted"})
+	interests := NewInterestRepository(pool)
+	s := &System{Interests: interests}
+	if err := s.MuteSeries(ctx, 1, "muted", c.series); err != nil {
+		t.Fatalf("MuteSeries: %v", err)
+	}
+	// A profile on account 2 with the same ID as account 1's "open" mutes the
+	// series; account 1's "open" is still notified.
+	if err := s.MuteSeries(ctx, 2, "open", c.series); err != nil {
+		t.Fatalf("MuteSeries account 2: %v", err)
+	}
+	// A mute of an ID that is no series: refused, and fanout is unaffected.
+	if err := s.MuteSeries(ctx, 1, "other-muted", c.episode); !errors.Is(err, ErrSeriesNotFound) {
+		t.Fatalf("mute an episode = %v, want ErrSeriesNotFound", err)
+	}
+
+	worker := newAccessFanoutWorker(pool, scopeByProfile{"open": {}, "muted": {}, "other-muted": {}})
+	if _, err := worker.processBatch(ctx); err != nil {
+		t.Fatalf("processBatch: %v", err)
+	}
+	if got := accountRecipients(t, pool, "event-1"); !slices.Equal(got, []string{"1/open", "1/other-muted"}) {
+		t.Fatalf("event-1 recipients = %v, want account 1's open and other-muted", got)
+	}
+	var favorite, cursorMoved bool
+	if err := pool.QueryRow(ctx, `
+		SELECT favorite, last_notified_episode_key IS NOT NULL FROM profile_series_interest WHERE user_id = 1 AND profile_id = 'muted'`,
+	).Scan(&favorite, &cursorMoved); err != nil {
+		t.Fatalf("read muted interest: %v", err)
+	}
+	if !favorite || cursorMoved {
+		t.Fatalf("muted interest favorite = %v, cursor moved = %v; want the row unchanged", favorite, cursorMoved)
+	}
+
+	if err := s.UnmuteSeries(ctx, 1, "muted", c.series); err != nil {
+		t.Fatalf("UnmuteSeries: %v", err)
+	}
+	nextKey := EpisodeKey(1, 3)
+	for _, stmt := range []struct {
+		sql  string
+		args []any
+	}{
+		{`INSERT INTO episodes (content_id, series_id, season_id, season_number, episode_number, title)
+			VALUES ($1 || '-e3', $1, $1 || '-s1', 1, 3, 'E3')`, []any{c.series}},
+		{`INSERT INTO release_events (id, library_id, series_id, episode_id, season_number, episode_number,
+			episode_key, available_at, dedupe_key)
+			VALUES ('event-2', $1, $2, $2 || '-e3', 1, 3, $3, now(), $4)`,
+			[]any{c.library, c.series, nextKey, EpisodeDedupeKey(c.library, c.series, nextKey)}},
+	} {
+		if _, err := pool.Exec(ctx, stmt.sql, stmt.args...); err != nil {
+			t.Fatalf("seed next episode: %v", err)
+		}
+	}
+	if _, err := worker.processBatch(ctx); err != nil {
+		t.Fatalf("processBatch after unmute: %v", err)
+	}
+	if got := accountRecipients(t, pool, "event-2"); !slices.Equal(got, []string{"1/muted", "1/open", "1/other-muted"}) {
+		t.Fatalf("event-2 recipients = %v, want every profile once unmuted", got)
+	}
+}
+
+// accountRecipients lists a release event's deliveries as account/profile.
+func accountRecipients(t *testing.T, pool *pgxpool.Pool, eventID string) []string {
+	t.Helper()
+	rows, err := pool.Query(t.Context(), `
+		SELECT user_id::text || '/' || profile_id FROM notification_deliveries
+		WHERE release_event_id = $1 ORDER BY 1`, eventID)
+	if err != nil {
+		t.Fatalf("query deliveries: %v", err)
+	}
+	got, err := pgx.CollectRows(rows, pgx.RowTo[string])
+	if err != nil {
+		t.Fatalf("read deliveries: %v", err)
+	}
+	return got
+}
+
+// seedSeriesMutes creates the list's tables in a test schema with two series
+// and a movie, the Bear as a favorite of p1 and p2 on account 1 and, through
+// another library, of p1 on account 2, and account 1 p1's mutes of both
+// series, each written twice.
+func seedSeriesMutes(t *testing.T) (*pgxpool.Pool, *System) {
+	t.Helper()
+	pool := schemaDB(t, "series_mutes_")
+	ctx := t.Context()
+	for _, stmt := range []string{
+		`CREATE TABLE profile_series_interest (LIKE public.profile_series_interest INCLUDING ALL)`,
+		`CREATE TABLE media_items (LIKE public.media_items INCLUDING ALL)`,
+		`CREATE TABLE notification_preferences (LIKE public.notification_preferences INCLUDING ALL)`,
+		`CREATE TABLE profile_series_notification_mutes (LIKE public.profile_series_notification_mutes INCLUDING ALL)`,
+		`INSERT INTO media_items (content_id, type, title, sort_title, genres, year) VALUES
+			('series:bear', 'series', 'The Bear', '', '{}', 2022),
+			('series:andor', 'series', 'Andor', '', '{}', 2022),
+			('movie:heat', 'movie', 'Heat', '', '{}', 1995)`,
+		`INSERT INTO profile_series_interest (user_id, profile_id, library_id, series_id, favorite) VALUES
+			(1, 'p1', 1, 'series:bear', true),
+			(1, 'p2', 1, 'series:bear', true),
+			(2, 'p1', 2, 'series:bear', true)`,
+	} {
+		if _, err := pool.Exec(ctx, stmt); err != nil {
+			t.Fatalf("seed: %v", err)
+		}
+	}
+	s := &System{Interests: NewInterestRepository(pool), Preferences: NewPreferencesRepository(pool)}
+	for range 2 {
+		for _, id := range []string{"series:bear", "series:andor"} {
+			if err := s.MuteSeries(ctx, 1, "p1", id); err != nil {
+				t.Fatalf("MuteSeries(%s): %v", id, err)
+			}
+		}
+	}
+	return pool, s
+}
+
+// TestSeriesMutesList covers the mute store and the notified-series list:
+// muting is per profile and account and idempotent, only series can be muted, a muted
+// series is listed muted with its active reasons kept and does not notify,
+// and a muted series with no reason is still listed so it can be unmuted.
+func TestSeriesMutesList(t *testing.T) {
+	_, s := seedSeriesMutes(t)
+	ctx := t.Context()
+	for _, id := range []string{"movie:heat", "series:gone"} {
+		if err := s.MuteSeries(ctx, 1, "p1", id); !errors.Is(err, ErrSeriesNotFound) {
+			t.Fatalf("MuteSeries(%s) = %v, want ErrSeriesNotFound", id, err)
+		}
+	}
+	got, err := s.ListNotifiedSeries(ctx, 1, "p1")
+	if err != nil {
+		t.Fatalf("ListNotifiedSeries: %v", err)
+	}
+	if len(got) != 2 || got[0].SeriesID != "series:andor" || got[1].SeriesID != "series:bear" {
+		t.Fatalf("p1 series = %+v, want andor then bear", got)
+	}
+	andor, bear := got[0], got[1]
+	if !andor.Muted || andor.Reasons.Any() || andor.Notifies() || andor.Title != "Andor" {
+		t.Errorf("andor = %+v, want a muted entry with no reason", andor)
+	}
+	if !bear.Muted || !bear.Active.Favorite || bear.Notifies() {
+		t.Errorf("bear = %+v, want muted with its favorite still active", bear)
+	}
+	for _, profile := range []struct {
+		userID int
+		id     string
+	}{{1, "p2"}, {2, "p1"}} {
+		other, err := s.ListNotifiedSeries(ctx, profile.userID, profile.id)
+		if err != nil {
+			t.Fatalf("ListNotifiedSeries %d/%s: %v", profile.userID, profile.id, err)
+		}
+		if len(other) != 1 || other[0].Muted || !other[0].Notifies() {
+			t.Fatalf("%d/%s series = %+v, want bear notifying: a mute is per profile and account", profile.userID, profile.id, other)
+		}
+	}
+}
+
+// TestSeriesMutesUnmuteAndPurge covers lifting a mute, which is idempotent and
+// drops a series with no reason from the list, and the removal of a deleted
+// profile's mutes, which leaves a same-ID profile on another account alone.
+func TestSeriesMutesUnmuteAndPurge(t *testing.T) {
+	pool, s := seedSeriesMutes(t)
+	ctx := t.Context()
+	for range 2 {
+		if err := s.UnmuteSeries(ctx, 1, "p1", "series:andor"); err != nil {
+			t.Fatalf("UnmuteSeries: %v", err)
+		}
+	}
+	got, err := s.ListNotifiedSeries(ctx, 1, "p1")
+	if err != nil {
+		t.Fatalf("ListNotifiedSeries: %v", err)
+	}
+	if len(got) != 1 || got[0].SeriesID != "series:bear" || !got[0].Muted {
+		t.Fatalf("after unmute = %+v, want only bear, still muted", got)
+	}
+	// Account 2's p1 mutes too; deleting account 1's p1 leaves it.
+	if err := s.MuteSeries(ctx, 2, "p1", "series:bear"); err != nil {
+		t.Fatalf("MuteSeries account 2: %v", err)
+	}
+	if err := s.Interests.deleteMutesForProfile(ctx, 1, "p1"); err != nil {
+		t.Fatalf("deleteMutesForProfile: %v", err)
+	}
+	rows, err := pool.Query(ctx, `SELECT user_id::text || '/' || profile_id || '/' || series_id FROM profile_series_notification_mutes`)
+	if err != nil {
+		t.Fatal(err)
+	}
+	left, err := pgx.CollectRows(rows, pgx.RowTo[string])
+	if err != nil || !slices.Equal(left, []string{"2/p1/series:bear"}) {
+		t.Fatalf("mutes left = %v (%v), want only account 2's", left, err)
+	}
+}
diff --git a/internal/notifications/system.go b/internal/notifications/system.go
index 6fe4ea67cf..a8bb86f0fa 100644
--- a/internal/notifications/system.go
+++ b/internal/notifications/system.go
@@ -14,11 +14,13 @@ import (
 	"github.com/jackc/pgx/v5/pgxpool"
 	"github.com/redis/go-redis/v9"
 
+	"github.com/prairie-server/prairie-server/internal/catalog"
 	"github.com/prairie-server/prairie-server/internal/discord"
 	evt "github.com/prairie-server/prairie-server/internal/events"
 	"github.com/prairie-server/prairie-server/internal/mail"
 	"github.com/prairie-server/prairie-server/internal/models"
 	"github.com/prairie-server/prairie-server/internal/secret"
+	"github.com/prairie-server/prairie-server/internal/serveridentity"
 	"github.com/prairie-server/prairie-server/internal/userstore"
 )
 
@@ -72,7 +74,7 @@ type System struct {
 	mailSender                mail.Sender
 	emailBrand                *mail.BrandLoader
 	emailVerificationDispatch *emailVerificationDispatcher
-	emailWorker               *accountChannelWorker[string]
+	emailWorker               *accountChannelWorker[profileKey]
 	discordWorker             *accountChannelWorker[int]
 	discordClient             *discord.Client
 	// publicURL is the server's externally reachable base URL, used as the
@@ -152,6 +154,10 @@ func NewSystem(
 		pushDeviceRepo = NewPushDeviceRepository(pool)
 		pushDeviceService = NewPushDeviceService(pushDeviceRepo, cipher)
 		pushSenderInst = newPushSender(pushDeviceRepo, deliveries, cipher, settings)
+		// Pushes name the identity getServerIdentity reports, read through the
+		// raw settings repo as it is: a SECRET_KEY rotation must not change
+		// who the server is.
+		pushSenderInst.serverID = serveridentity.New(catalog.NewServerSettingsRepo(pool)).ServerID
 		pushDispatcher = newPushDispatcher(pushSenderInst)
 		dispatchers = append(dispatchers, pushDispatcher)
 	}
@@ -186,7 +192,7 @@ func NewSystem(
 	// keeps no outbox: its dispatcher only nudges the watermark sweep.
 	var emailPrefs *EmailPrefsRepository
 	var emailChannelInst *emailChannel
-	var emailWorker *accountChannelWorker[string]
+	var emailWorker *accountChannelWorker[profileKey]
 	if mailSender != nil {
 		emailPrefs = NewEmailPrefsRepository(pool)
 		emailChannelInst = &emailChannel{
@@ -443,37 +449,42 @@ func (s *System) Wait() {
 
 // PurgeProfile removes all notification state for a deleted profile.
 // Profiles may live in per-user SQLite stores, so Postgres cascades cannot
-// cover this.
-func (s *System) PurgeProfile(ctx context.Context, profileID string) error {
+// cover this. Interest rows, series mutes, deliveries, preferences,
+// destinations, and email prefs are removed for the profile on userID's
+// account only.
+func (s *System) PurgeProfile(ctx context.Context, userID int, profileID string) error {
 	if s == nil || profileID == "" {
 		return nil
 	}
-	if err := s.Interests.DeleteAllForProfile(ctx, profileID); err != nil {
+	if err := s.Interests.DeleteAllForProfile(ctx, userID, profileID); err != nil {
 		return fmt.Errorf("purge interest rows: %w", err)
 	}
-	if err := s.Deliveries.DeleteAllForProfile(ctx, profileID); err != nil {
+	if err := s.Interests.deleteMutesForProfile(ctx, userID, profileID); err != nil {
+		return fmt.Errorf("purge series mutes: %w", err)
+	}
+	if err := s.Deliveries.DeleteAllForProfile(ctx, userID, profileID); err != nil {
 		return fmt.Errorf("purge deliveries: %w", err)
 	}
-	if err := s.Preferences.DeleteForProfile(ctx, profileID); err != nil {
+	if err := s.Preferences.DeleteForProfile(ctx, userID, profileID); err != nil {
 		return fmt.Errorf("purge preferences: %w", err)
 	}
 	if s.webhookRepo != nil {
-		if err := s.webhookRepo.DeleteAllForProfile(ctx, profileID); err != nil {
+		if err := s.webhookRepo.DeleteAllForProfile(ctx, userID, profileID); err != nil {
 			return fmt.Errorf("purge webhooks: %w", err)
 		}
 	}
 	if s.webPushRepo != nil {
-		if err := s.webPushRepo.DeleteAllForProfile(ctx, profileID); err != nil {
+		if err := s.webPushRepo.DeleteAllForProfile(ctx, userID, profileID); err != nil {
 			return fmt.Errorf("purge web push subscriptions: %w", err)
 		}
 	}
 	if s.pushDeviceRepo != nil {
-		if err := s.pushDeviceRepo.DeleteAllForProfile(ctx, profileID); err != nil {
+		if err := s.pushDeviceRepo.DeleteAllForProfile(ctx, userID, profileID); err != nil {
 			return fmt.Errorf("purge push devices: %w", err)
 		}
 	}
 	if s.EmailPrefs != nil {
-		if err := s.EmailPrefs.DeleteForProfile(ctx, profileID); err != nil {
+		if err := s.EmailPrefs.DeleteForProfile(ctx, userID, profileID); err != nil {
 			return fmt.Errorf("purge email prefs: %w", err)
 		}
 	}
@@ -723,7 +734,7 @@ func (s *System) rebuildProfileInterest(ctx context.Context, store userstore.Use
 	if err != nil {
 		return err
 	}
-	existing, err := s.Interests.ListSeriesForProfile(ctx, profileID)
+	existing, err := s.Interests.ListSeriesForProfile(ctx, userID, profileID)
 	if err != nil {
 		return err
 	}
diff --git a/internal/notifications/webhook_guard_test.go b/internal/notifications/webhook_guard_test.go
index 2643972d8b..1034b3fe11 100644
--- a/internal/notifications/webhook_guard_test.go
+++ b/internal/notifications/webhook_guard_test.go
@@ -42,7 +42,7 @@ func TestWebhookGuardedDeletePG(t *testing.T) {
 		t.Fatal(err)
 	}
 	defer scoped.Close()
-	if _, err = scoped.Exec(ctx, `CREATE TABLE notification_webhooks (id text PRIMARY KEY, profile_id text NOT NULL, name text NOT NULL, updated_at timestamptz NOT NULL DEFAULT now()); CREATE TABLE attempts(id text PRIMARY KEY, webhook_id text REFERENCES notification_webhooks(id) ON DELETE CASCADE)`); err != nil {
+	if _, err = scoped.Exec(ctx, `CREATE TABLE notification_webhooks (id text PRIMARY KEY, user_id integer NOT NULL DEFAULT 1, profile_id text NOT NULL, name text NOT NULL, updated_at timestamptz NOT NULL DEFAULT now()); CREATE TABLE attempts(id text PRIMARY KEY, webhook_id text REFERENCES notification_webhooks(id) ON DELETE CASCADE)`); err != nil {
 		t.Fatal(err)
 	}
 	migration, err := os.ReadFile("../../migrations/sql/20260906145619_webhook_conditional_revision.sql")
@@ -80,7 +80,7 @@ func TestWebhookGuardedDeletePG(t *testing.T) {
 	repo := NewWebhookRepository(scoped)
 	result := make(chan error, 1)
 	go func() {
-		result <- repo.DeleteGuarded(ctx, "owner", "row", func(current int64) error {
+		result <- repo.DeleteGuarded(ctx, 1, "owner", "row", func(current int64) error {
 			if current != original {
 				return stale
 			}
@@ -112,10 +112,13 @@ func TestWebhookGuardedDeletePG(t *testing.T) {
 	if err = scoped.QueryRow(ctx, `SELECT count(*) FROM attempts`).Scan(&attempts); err != nil || attempts != 1 {
 		t.Fatal("stale delete changed attempts")
 	}
-	if err = repo.DeleteGuarded(ctx, "other", "row", func(int64) error { t.Error("foreign precondition evaluated"); return nil }); !errors.Is(err, ErrWebhookNotFound) {
+	if err = repo.DeleteGuarded(ctx, 2, "owner", "row", func(int64) error { t.Error("other account's precondition evaluated"); return nil }); !errors.Is(err, ErrWebhookNotFound) {
+		t.Fatalf("other account: %v", err)
+	}
+	if err = repo.DeleteGuarded(ctx, 1, "other", "row", func(int64) error { t.Error("foreign precondition evaluated"); return nil }); !errors.Is(err, ErrWebhookNotFound) {
 		t.Fatalf("foreign: %v", err)
 	}
-	if err = repo.DeleteGuarded(ctx, "owner", "row", func(current int64) error {
+	if err = repo.DeleteGuarded(ctx, 1, "owner", "row", func(current int64) error {
 		if current != second {
 			return stale
 		}
@@ -126,7 +129,7 @@ func TestWebhookGuardedDeletePG(t *testing.T) {
 	if err = scoped.QueryRow(ctx, `SELECT count(*) FROM attempts`).Scan(&attempts); err != nil || attempts != 0 {
 		t.Fatal("attempts did not cascade")
 	}
-	if err = repo.DeleteGuarded(ctx, "owner", "row", func(int64) error { return nil }); !errors.Is(err, ErrWebhookNotFound) {
+	if err = repo.DeleteGuarded(ctx, 1, "owner", "row", func(int64) error { return nil }); !errors.Is(err, ErrWebhookNotFound) {
 		t.Fatalf("missing: %v", err)
 	}
 	if _, err = scoped.Exec(ctx, `INSERT INTO notification_webhooks(id,profile_id,name,revision) VALUES ('row','owner','recreated',1)`); err != nil {
diff --git a/internal/notifications/webhook_logic_test.go b/internal/notifications/webhook_logic_test.go
index b92ba5e3d2..c24c793472 100644
--- a/internal/notifications/webhook_logic_test.go
+++ b/internal/notifications/webhook_logic_test.go
@@ -39,7 +39,7 @@ func TestWebhookCreateAndTestBlockedWhenDisabled(t *testing.T) {
 	if _, _, err := service.Create(ctx, 1, "profile", WebhookInput{Name: &name, URL: &url}); !errors.Is(err, ErrWebhooksDisabled) {
 		t.Fatalf("Create error = %v, want ErrWebhooksDisabled", err)
 	}
-	if _, err := service.Test(ctx, "profile", "hook-id"); !errors.Is(err, ErrWebhooksDisabled) {
+	if _, err := service.Test(ctx, 1, "profile", "hook-id"); !errors.Is(err, ErrWebhooksDisabled) {
 		t.Fatalf("Test error = %v, want ErrWebhooksDisabled", err)
 	}
 }
@@ -681,14 +681,17 @@ func TestWebhookMatchesReasons(t *testing.T) {
 func TestProfileRateLimiter(t *testing.T) {
 	limiter := newProfileRateLimiter()
 	for i := 0; i < 3; i++ {
-		if !limiter.Allow("p1", 3) {
+		if !limiter.Allow(profileKey{1, "p1"}, 3) {
 			t.Fatalf("delivery %d must be allowed", i+1)
 		}
 	}
-	if limiter.Allow("p1", 3) {
+	if limiter.Allow(profileKey{1, "p1"}, 3) {
 		t.Fatal("4th delivery within the window must be limited")
 	}
-	if !limiter.Allow("p2", 3) {
+	if !limiter.Allow(profileKey{1, "p2"}, 3) {
 		t.Fatal("limits must be per-profile")
 	}
+	if !limiter.Allow(profileKey{2, "p1"}, 3) {
+		t.Fatal("a profile with the same ID on another account must have its own limit")
+	}
 }
diff --git a/internal/notifications/webhook_repo.go b/internal/notifications/webhook_repo.go
index dbb7024d4a..c750d311fa 100644
--- a/internal/notifications/webhook_repo.go
+++ b/internal/notifications/webhook_repo.go
@@ -61,11 +61,13 @@ func scanWebhooks(rows pgx.Rows) ([]Webhook, error) {
 	return hooks, rows.Err()
 }
 
-// ListByProfile returns all of a profile's webhooks for the listing endpoint.
-func (r *WebhookRepository) ListByProfile(ctx context.Context, profileID string) ([]Webhook, error) {
+// ListByProfile returns all of an account profile's webhooks for the listing
+// endpoint. Profile IDs repeat across accounts, so every management query
+// matches the account too.
+func (r *WebhookRepository) ListByProfile(ctx context.Context, userID int, profileID string) ([]Webhook, error) {
 	rows, err := r.pool.Query(ctx,
-		`SELECT `+webhookColumns+` FROM notification_webhooks WHERE profile_id = $1 ORDER BY created_at`,
-		profileID)
+		`SELECT `+webhookColumns+` FROM notification_webhooks WHERE user_id = $1 AND profile_id = $2 ORDER BY created_at`,
+		userID, profileID)
 	if err != nil {
 		return nil, fmt.Errorf("list webhooks: %w", err)
 	}
@@ -73,15 +75,18 @@ func (r *WebhookRepository) ListByProfile(ctx context.Context, profileID string)
 }
 
 // ListEnabledByProfiles loads enabled webhooks for a set of profiles, keyed
-// by profile. Used by the fanout outbox enqueue inside its transaction.
-func (r *WebhookRepository) ListEnabledByProfiles(ctx context.Context, tx pgx.Tx, profileIDs []string) (map[string][]Webhook, error) {
-	out := make(map[string][]Webhook, len(profileIDs))
-	if len(profileIDs) == 0 {
+// by account and profile: profile IDs repeat across accounts. Used by the
+// outbox enqueue inside the delivery's transaction.
+func (r *WebhookRepository) ListEnabledByProfiles(ctx context.Context, tx pgx.Tx, profiles []profileKey) (map[profileKey][]Webhook, error) {
+	out := make(map[profileKey][]Webhook, len(profiles))
+	if len(profiles) == 0 {
 		return out, nil
 	}
+	userIDs, profileIDs := profileKeyArrays(profiles)
 	rows, err := tx.Query(ctx,
-		`SELECT `+webhookColumns+` FROM notification_webhooks WHERE profile_id = ANY($1) AND enabled`,
-		profileIDs)
+		`SELECT `+webhookColumns+` FROM notification_webhooks
+		WHERE (user_id, profile_id) IN (SELECT * FROM unnest($1::int[], $2::text[])) AND enabled`,
+		userIDs, profileIDs)
 	if err != nil {
 		return nil, fmt.Errorf("list enabled webhooks: %w", err)
 	}
@@ -90,16 +95,18 @@ func (r *WebhookRepository) ListEnabledByProfiles(ctx context.Context, tx pgx.Tx
 		return nil, err
 	}
 	for _, hook := range hooks {
-		out[hook.ProfileID] = append(out[hook.ProfileID], hook)
+		key := profileKey{hook.UserID, hook.ProfileID}
+		out[key] = append(out[key], hook)
 	}
 	return out, nil
 }
 
-// GetByID returns one webhook scoped to the profile; (nil, nil) when absent.
-func (r *WebhookRepository) GetByID(ctx context.Context, profileID, id string) (*Webhook, error) {
+// GetByID returns one webhook scoped to the account profile; (nil, nil) when
+// absent.
+func (r *WebhookRepository) GetByID(ctx context.Context, userID int, profileID, id string) (*Webhook, error) {
 	hook, err := scanWebhook(r.pool.QueryRow(ctx,
-		`SELECT `+webhookColumns+` FROM notification_webhooks WHERE profile_id = $1 AND id = $2`,
-		profileID, id))
+		`SELECT `+webhookColumns+` FROM notification_webhooks WHERE user_id = $1 AND profile_id = $2 AND id = $3`,
+		userID, profileID, id))
 	if errors.Is(err, pgx.ErrNoRows) {
 		return nil, nil
 	}
@@ -122,12 +129,12 @@ func (r *WebhookRepository) getByIDUnscoped(ctx context.Context, id string) (*We
 	return hook, nil
 }
 
-// ErrWebhookNameTaken is returned when a profile already has a webhook with
-// the requested name.
+// ErrWebhookNameTaken is returned when the account profile already has a
+// webhook with the requested name.
 var ErrWebhookNameTaken = errors.New("a webhook with this name already exists")
 
 // isWebhookNameViolation reports whether err is the unique violation on the
-// per-profile webhook name constraint, via the typed pgx error (string
+// webhook name constraint, unique per (user_id, profile_id), via the typed pgx error (string
 // matching on error text would break if message formatting changes).
 func isWebhookNameViolation(err error) bool {
 	var pgErr *pgconn.PgError
@@ -136,10 +143,11 @@ func isWebhookNameViolation(err error) bool {
 		pgErr.ConstraintName == "notification_webhooks_profile_name_key"
 }
 
-// InsertWithLimit persists a new webhook unless the profile is already at
-// maxPerProfile. The count and insert run under a per-profile advisory
-// transaction lock so concurrent creates cannot both pass the check and push
-// the profile past its cap.
+// InsertWithLimit persists a new webhook unless the account profile is
+// already at maxPerProfile. The count and insert run under a per-profile-ID
+// advisory transaction lock so concurrent creates cannot both pass the check
+// and push the profile past its cap. The lock is coarser than the count (it
+// also serializes a same-ID profile on another account), which is harmless.
 func (r *WebhookRepository) InsertWithLimit(ctx context.Context, hook Webhook, maxPerProfile int) error {
 	tx, err := r.pool.Begin(ctx)
 	if err != nil {
@@ -154,7 +162,7 @@ func (r *WebhookRepository) InsertWithLimit(ctx context.Context, hook Webhook, m
 	}
 	var count int
 	if err := tx.QueryRow(ctx,
-		`SELECT count(*) FROM notification_webhooks WHERE profile_id = $1`, hook.ProfileID,
+		`SELECT count(*) FROM notification_webhooks WHERE user_id = $1 AND profile_id = $2`, hook.UserID, hook.ProfileID,
 	).Scan(&count); err != nil {
 		return fmt.Errorf("count webhooks: %w", err)
 	}
@@ -211,17 +219,17 @@ func (r *WebhookRepository) Update(ctx context.Context, hook Webhook) error {
 	return nil
 }
 
-// Delete removes a profile's webhook; attempts cascade. Idempotent.
-func (r *WebhookRepository) Delete(ctx context.Context, profileID, id string) error {
+// Delete removes an account profile's webhook; attempts cascade. Idempotent.
+func (r *WebhookRepository) Delete(ctx context.Context, userID int, profileID, id string) error {
 	_, err := r.pool.Exec(ctx,
-		`DELETE FROM notification_webhooks WHERE profile_id = $1 AND id = $2`, profileID, id)
+		`DELETE FROM notification_webhooks WHERE user_id = $1 AND profile_id = $2 AND id = $3`, userID, profileID, id)
 	return err
 }
 
-// DeleteAllForProfile removes a deleted profile's webhooks.
-func (r *WebhookRepository) DeleteAllForProfile(ctx context.Context, profileID string) error {
+// DeleteAllForProfile removes a deleted account profile's webhooks.
+func (r *WebhookRepository) DeleteAllForProfile(ctx context.Context, userID int, profileID string) error {
 	_, err := r.pool.Exec(ctx,
-		`DELETE FROM notification_webhooks WHERE profile_id = $1`, profileID)
+		`DELETE FROM notification_webhooks WHERE user_id = $1 AND profile_id = $2`, userID, profileID)
 	return err
 }
 
@@ -399,11 +407,11 @@ func (r *WebhookRepository) DeleteOldAttempts(ctx context.Context, now time.Time
 
 // ListPage returns at most limit records in stable creation order. Callers may
 // request one lookahead row; this read does not alter delivery state.
-func (r *WebhookRepository) ListPage(ctx context.Context, profile string, limit int, after *Cursor) ([]Webhook, error) {
-	query := `SELECT ` + webhookColumns + ` FROM notification_webhooks WHERE profile_id = $1`
-	args := []any{profile}
+func (r *WebhookRepository) ListPage(ctx context.Context, userID int, profile string, limit int, after *Cursor) ([]Webhook, error) {
+	query := `SELECT ` + webhookColumns + ` FROM notification_webhooks WHERE user_id = $1 AND profile_id = $2`
+	args := []any{userID, profile}
 	if after != nil {
-		query += ` AND (created_at, id) > ($2, $3)`
+		query += ` AND (created_at, id) > ($3, $4)`
 		args = append(args, after.CreatedAt, after.ID)
 	}
 	query += fmt.Sprintf(" ORDER BY created_at, id LIMIT $%d", len(args)+1)
@@ -417,14 +425,14 @@ func (r *WebhookRepository) ListPage(ctx context.Context, profile string, limit
 
 // DeleteGuarded holds the row lock across precondition evaluation and deletion.
 // The revision trigger covers bridge, configuration and provider writers too.
-func (r *WebhookRepository) DeleteGuarded(ctx context.Context, profile, id string, check func(int64) error) error {
+func (r *WebhookRepository) DeleteGuarded(ctx context.Context, userID int, profile, id string, check func(int64) error) error {
 	tx, err := r.pool.Begin(ctx)
 	if err != nil {
 		return err
 	}
 	defer func() { _ = tx.Rollback(ctx) }()
 	var revision int64
-	err = tx.QueryRow(ctx, `SELECT revision FROM notification_webhooks WHERE profile_id=$1 AND id=$2 FOR UPDATE`, profile, id).Scan(&revision)
+	err = tx.QueryRow(ctx, `SELECT revision FROM notification_webhooks WHERE user_id=$1 AND profile_id=$2 AND id=$3 FOR UPDATE`, userID, profile, id).Scan(&revision)
 	if errors.Is(err, pgx.ErrNoRows) {
 		return ErrWebhookNotFound
 	}
@@ -434,15 +442,15 @@ func (r *WebhookRepository) DeleteGuarded(ctx context.Context, profile, id strin
 	if err = check(revision); err != nil {
 		return err
 	}
-	if _, err = tx.Exec(ctx, `DELETE FROM notification_webhooks WHERE profile_id=$1 AND id=$2`, profile, id); err != nil {
+	if _, err = tx.Exec(ctx, `DELETE FROM notification_webhooks WHERE user_id=$1 AND profile_id=$2 AND id=$3`, userID, profile, id); err != nil {
 		return err
 	}
 	return tx.Commit(ctx)
 }
 
 // ReplaceSigningSecret changes no configuration or provider bookkeeping fields.
-func (r *WebhookRepository) ReplaceSigningSecret(ctx context.Context, profile, id, ciphertext string) error {
-	tag, err := r.pool.Exec(ctx, `UPDATE notification_webhooks SET signing_secret_ciphertext=$3, updated_at=now() WHERE profile_id=$1 AND id=$2 AND type='generic'`, profile, id, ciphertext)
+func (r *WebhookRepository) ReplaceSigningSecret(ctx context.Context, userID int, profile, id, ciphertext string) error {
+	tag, err := r.pool.Exec(ctx, `UPDATE notification_webhooks SET signing_secret_ciphertext=$4, updated_at=now() WHERE user_id=$1 AND profile_id=$2 AND id=$3 AND type='generic'`, userID, profile, id, ciphertext)
 	if err != nil {
 		return err
 	}
@@ -454,13 +462,13 @@ func (r *WebhookRepository) ReplaceSigningSecret(ctx context.Context, profile, i
 
 // UpdateGuarded reads, validates and updates configuration under the same row lock.
 // Secret/type and provider outcome columns are never copied from an editor.
-func (r *WebhookRepository) UpdateGuarded(ctx context.Context, profile, id string, apply func(*Webhook) error) (*Webhook, error) {
+func (r *WebhookRepository) UpdateGuarded(ctx context.Context, userID int, profile, id string, apply func(*Webhook) error) (*Webhook, error) {
 	tx, err := r.pool.Begin(ctx)
 	if err != nil {
 		return nil, err
 	}
 	defer func() { _ = tx.Rollback(ctx) }()
-	hook, err := scanWebhook(tx.QueryRow(ctx, `SELECT `+webhookColumns+` FROM notification_webhooks WHERE profile_id=$1 AND id=$2 FOR UPDATE`, profile, id))
+	hook, err := scanWebhook(tx.QueryRow(ctx, `SELECT `+webhookColumns+` FROM notification_webhooks WHERE user_id=$1 AND profile_id=$2 AND id=$3 FOR UPDATE`, userID, profile, id))
 	if errors.Is(err, pgx.ErrNoRows) {
 		return nil, ErrWebhookNotFound
 	}
@@ -471,12 +479,12 @@ func (r *WebhookRepository) UpdateGuarded(ctx context.Context, profile, id strin
 		return nil, err
 	}
 	row, err := scanWebhook(tx.QueryRow(ctx, `UPDATE notification_webhooks SET
- name=$3, url_ciphertext=$4, url_host=$5, enabled=$6,
- notify_favorites=$7, notify_watchlist=$8, notify_continue_watching=$9,
- notify_next_up=$10, notify_requests=$11, consecutive_failures=$12,
- disabled_reason=$13, updated_at=now()
- WHERE profile_id=$1 AND id=$2 RETURNING `+webhookColumns,
-		profile, id, hook.Name, hook.URLCiphertext, hook.URLHost, hook.Enabled,
+ name=$4, url_ciphertext=$5, url_host=$6, enabled=$7,
+ notify_favorites=$8, notify_watchlist=$9, notify_continue_watching=$10,
+ notify_next_up=$11, notify_requests=$12, consecutive_failures=$13,
+ disabled_reason=$14, updated_at=now()
+ WHERE user_id=$1 AND profile_id=$2 AND id=$3 RETURNING `+webhookColumns,
+		userID, profile, id, hook.Name, hook.URLCiphertext, hook.URLHost, hook.Enabled,
 		hook.NotifyFavorites, hook.NotifyWatchlist, hook.NotifyContinueWatching,
 		hook.NotifyNextUp, hook.NotifyRequests, hook.ConsecutiveFailures, hook.DisabledReason))
 	if isWebhookNameViolation(err) {
diff --git a/internal/notifications/webhook_rotation_test.go b/internal/notifications/webhook_rotation_test.go
index 49c86bf42f..a2fc8d731d 100644
--- a/internal/notifications/webhook_rotation_test.go
+++ b/internal/notifications/webhook_rotation_test.go
@@ -51,20 +51,20 @@ func TestWebhookSecretRotationPG(t *testing.T) {
 	if _, err = pool.Exec(ctx, `UPDATE notification_webhooks SET name='newer-config',notify_requests=true,consecutive_failures=9 WHERE id='row'`); err != nil {
 		t.Fatal(err)
 	}
-	if err = repo.ReplaceSigningSecret(ctx, "owner", "row", "replacement-cipher"); err != nil {
+	if err = repo.ReplaceSigningSecret(ctx, 1, "owner", "row", "replacement-cipher"); err != nil {
 		t.Fatal(err)
 	}
-	row, err := repo.GetByID(ctx, "owner", "row")
+	row, err := repo.GetByID(ctx, 1, "owner", "row")
 	if err != nil {
 		t.Fatal(err)
 	}
 	if row.Name != "newer-config" || row.Enabled || !row.NotifyRequests || row.ConsecutiveFailures != 9 || row.URLCiphertext != "url-cipher" || row.SigningSecretCiphertext == nil || *row.SigningSecretCiphertext != "replacement-cipher" {
 		t.Fatalf("rotation changed unrelated state: %+v", row)
 	}
-	if err = repo.ReplaceSigningSecret(ctx, "foreign", "row", "foreign"); !errors.Is(err, ErrWebhookNotFound) {
+	if err = repo.ReplaceSigningSecret(ctx, 1, "foreign", "row", "foreign"); !errors.Is(err, ErrWebhookNotFound) {
 		t.Fatalf("foreign: %v", err)
 	}
-	if err = repo.ReplaceSigningSecret(ctx, "owner", "missing", "missing"); !errors.Is(err, ErrWebhookNotFound) {
+	if err = repo.ReplaceSigningSecret(ctx, 1, "owner", "missing", "missing"); !errors.Is(err, ErrWebhookNotFound) {
 		t.Fatalf("missing: %v", err)
 	}
 	cipher, err := secret.New([]byte("01234567890123456789012345678901"))
@@ -72,11 +72,11 @@ func TestWebhookSecretRotationPG(t *testing.T) {
 		t.Fatal(err)
 	}
 	svc := &WebhookService{repo: repo, cipher: cipher}
-	value, err := svc.RotateSecretV2(ctx, "owner", "row")
+	value, err := svc.RotateSecretV2(ctx, 1, "owner", "row")
 	if err != nil || value == "" {
 		t.Fatalf("rotate: %v", err)
 	}
-	row, err = repo.GetByID(ctx, "owner", "row")
+	row, err = repo.GetByID(ctx, 1, "owner", "row")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -84,16 +84,23 @@ func TestWebhookSecretRotationPG(t *testing.T) {
 	if err != nil || decoded != value {
 		t.Fatal("stored secret did not match receipt")
 	}
-	if _, err = svc.RotateSecretV2(ctx, "owner", "discord"); !errors.Is(err, ErrWebhookInvalid) {
+	if _, err = svc.RotateSecretV2(ctx, 1, "owner", "discord"); !errors.Is(err, ErrWebhookInvalid) {
 		t.Fatalf("discord: %v", err)
 	}
-	if _, err = svc.RotateSecretV2(ctx, "other", "row"); !errors.Is(err, ErrWebhookNotFound) {
+	if _, err = svc.RotateSecretV2(ctx, 1, "other", "row"); !errors.Is(err, ErrWebhookNotFound) {
 		t.Fatalf("other: %v", err)
 	}
-	if err = repo.Delete(ctx, "owner", "row"); err != nil {
+	// A profile with the same ID on another account can't rotate it.
+	if _, err = svc.RotateSecretV2(ctx, 2, "owner", "row"); !errors.Is(err, ErrWebhookNotFound) {
+		t.Fatalf("other account: %v", err)
+	}
+	if err = repo.ReplaceSigningSecret(ctx, 2, "owner", "row", "other-account"); !errors.Is(err, ErrWebhookNotFound) {
+		t.Fatalf("other account replace: %v", err)
+	}
+	if err = repo.Delete(ctx, 1, "owner", "row"); err != nil {
 		t.Fatal(err)
 	}
-	if err = repo.ReplaceSigningSecret(ctx, "owner", "row", "after-deletion"); !errors.Is(err, ErrWebhookNotFound) {
+	if err = repo.ReplaceSigningSecret(ctx, 1, "owner", "row", "after-deletion"); !errors.Is(err, ErrWebhookNotFound) {
 		t.Fatalf("deleted row success: %v", err)
 	}
 }
diff --git a/internal/notifications/webhook_sender.go b/internal/notifications/webhook_sender.go
index b0a3a63fb8..554b96fd81 100644
--- a/internal/notifications/webhook_sender.go
+++ b/internal/notifications/webhook_sender.go
@@ -195,6 +195,13 @@ func (s *webhookSender) processAttempt(ctx context.Context, attempt DeliveryAtte
 			attempt.AttemptNumber+1, nil, "delivery row missing", nil)
 		return
 	}
+	if row.UserID != hook.UserID || row.ProfileID != hook.ProfileID {
+		// Queued for another account's profile with the same ID by a build
+		// that matched targets on profile ID alone.
+		_ = s.webhooks.FinalizeAttempt(ctx, attempt.ID, WebhookOutcomeFailed,
+			attempt.AttemptNumber+1, nil, "webhook belongs to another profile", nil)
+		return
+	}
 
 	result := s.send(ctx, hook, *row, false)
 	attemptNumber := attempt.AttemptNumber + 1
@@ -309,22 +316,22 @@ func (s *webhookSender) disableWebhook(ctx context.Context, hook *Webhook, resul
 // node-exclusive (SKIP LOCKED), so one node owns a given event's enqueue.
 type profileRateLimiter struct {
 	mu      sync.Mutex
-	windows map[string][]time.Time
+	windows map[profileKey][]time.Time
 }
 
 func newProfileRateLimiter() *profileRateLimiter {
-	return &profileRateLimiter{windows: make(map[string][]time.Time)}
+	return &profileRateLimiter{windows: make(map[profileKey][]time.Time)}
 }
 
 // Allow reports whether the profile is under the per-minute limit and counts
 // the delivery when it is.
-func (l *profileRateLimiter) Allow(profileID string, limit int) bool {
+func (l *profileRateLimiter) Allow(profile profileKey, limit int) bool {
 	now := time.Now()
 	cutoff := now.Add(-time.Minute)
 	l.mu.Lock()
 	defer l.mu.Unlock()
 
-	window := l.windows[profileID]
+	window := l.windows[profile]
 	kept := window[:0]
 	for _, ts := range window {
 		if ts.After(cutoff) {
@@ -332,9 +339,9 @@ func (l *profileRateLimiter) Allow(profileID string, limit int) bool {
 		}
 	}
 	if len(kept) >= limit {
-		l.windows[profileID] = kept
+		l.windows[profile] = kept
 		return false
 	}
-	l.windows[profileID] = append(kept, now)
+	l.windows[profile] = append(kept, now)
 	return true
 }
diff --git a/internal/notifications/webhook_service.go b/internal/notifications/webhook_service.go
index 1b21b34351..413b1a5336 100644
--- a/internal/notifications/webhook_service.go
+++ b/internal/notifications/webhook_service.go
@@ -109,15 +109,15 @@ func newSigningSecret() (string, error) {
 	return base64.StdEncoding.EncodeToString(raw), nil
 }
 
-// List returns the profile's webhooks (ciphertext fields are for internal
-// use; the handler view must expose url_host only).
-func (s *WebhookService) List(ctx context.Context, profileID string) ([]Webhook, error) {
-	return s.repo.ListByProfile(ctx, profileID)
+// List returns the account profile's webhooks (ciphertext fields are for
+// internal use; the handler view must expose url_host only).
+func (s *WebhookService) List(ctx context.Context, userID int, profileID string) ([]Webhook, error) {
+	return s.repo.ListByProfile(ctx, userID, profileID)
 }
 
-// Get returns one webhook scoped to the profile.
-func (s *WebhookService) Get(ctx context.Context, profileID, id string) (*Webhook, error) {
-	return s.repo.GetByID(ctx, profileID, id)
+// Get returns one webhook scoped to the account profile.
+func (s *WebhookService) Get(ctx context.Context, userID int, profileID, id string) (*Webhook, error) {
+	return s.repo.GetByID(ctx, userID, profileID, id)
 }
 
 // Create validates and persists a new webhook. For generic webhooks the
@@ -198,8 +198,8 @@ func (s *WebhookService) Create(ctx context.Context, userID int, profileID strin
 // Update applies the provided fields. A URL change re-validates the
 // destination and resets the failure streak; re-enabling clears the
 // auto-disable reason.
-func (s *WebhookService) Update(ctx context.Context, profileID, id string, input WebhookInput) (*Webhook, error) {
-	hook, err := s.repo.GetByID(ctx, profileID, id)
+func (s *WebhookService) Update(ctx context.Context, userID int, profileID, id string, input WebhookInput) (*Webhook, error) {
+	hook, err := s.repo.GetByID(ctx, userID, profileID, id)
 	if err != nil {
 		return nil, err
 	}
@@ -221,15 +221,15 @@ func (s *WebhookService) Update(ctx context.Context, profileID, id string, input
 }
 
 // Delete removes a webhook. Idempotent.
-func (s *WebhookService) Delete(ctx context.Context, profileID, id string) error {
-	return s.repo.Delete(ctx, profileID, id)
+func (s *WebhookService) Delete(ctx context.Context, userID int, profileID, id string) error {
+	return s.repo.Delete(ctx, userID, profileID, id)
 }
 
 // RotateSecret generates and stores a new signing secret for a generic
 // webhook, returning it exactly once. The previous secret is gone
 // immediately; there is no dual-acceptance window.
-func (s *WebhookService) RotateSecret(ctx context.Context, profileID, id string) (string, error) {
-	hook, err := s.repo.GetByID(ctx, profileID, id)
+func (s *WebhookService) RotateSecret(ctx context.Context, userID int, profileID, id string) (string, error) {
+	hook, err := s.repo.GetByID(ctx, userID, profileID, id)
 	if err != nil {
 		return "", err
 	}
@@ -274,13 +274,13 @@ func (r webhookSendResult) testResult() *WebhookTestResult {
 
 // Test synchronously POSTs a clearly marked sample payload. Test sends never
 // touch webhook_delivery_attempts or the failure counters.
-func (s *WebhookService) Test(ctx context.Context, profileID, id string) (*WebhookTestResult, error) {
+func (s *WebhookService) Test(ctx context.Context, userID int, profileID, id string) (*WebhookTestResult, error) {
 	// Test sends are outbound traffic; the channel gate covers them too
 	// (regular delivery is already gated at enqueue and dispatch).
 	if !s.settings.WebhooksEnabled(ctx) {
 		return nil, ErrWebhooksDisabled
 	}
-	hook, err := s.repo.GetByID(ctx, profileID, id)
+	hook, err := s.repo.GetByID(ctx, userID, profileID, id)
 	if err != nil {
 		return nil, err
 	}
@@ -322,17 +322,17 @@ func boolOrDefault(value *bool, fallback bool) bool {
 	return *value
 }
 
-func (s *WebhookService) ListPage(ctx context.Context, profile string, limit int, after *Cursor) ([]Webhook, error) {
-	return s.repo.ListPage(ctx, profile, limit, after)
+func (s *WebhookService) ListPage(ctx context.Context, userID int, profile string, limit int, after *Cursor) ([]Webhook, error) {
+	return s.repo.ListPage(ctx, userID, profile, limit, after)
 }
 
-func (s *WebhookService) DeleteGuarded(ctx context.Context, profile, id string, check func(int64) error) error {
-	return s.repo.DeleteGuarded(ctx, profile, id, check)
+func (s *WebhookService) DeleteGuarded(ctx context.Context, userID int, profile, id string, check func(int64) error) error {
+	return s.repo.DeleteGuarded(ctx, userID, profile, id, check)
 }
 
 // RotateSecretV2 avoids copying a stale configuration snapshot back into storage.
-func (s *WebhookService) RotateSecretV2(ctx context.Context, profile, id string) (string, error) {
-	hook, err := s.repo.GetByID(ctx, profile, id)
+func (s *WebhookService) RotateSecretV2(ctx context.Context, userID int, profile, id string) (string, error) {
+	hook, err := s.repo.GetByID(ctx, userID, profile, id)
 	if err != nil {
 		return "", err
 	}
@@ -350,7 +350,7 @@ func (s *WebhookService) RotateSecretV2(ctx context.Context, profile, id string)
 	if err != nil {
 		return "", fmt.Errorf("encrypt signing secret: %w", err)
 	}
-	if err = s.repo.ReplaceSigningSecret(ctx, profile, id, ciphertext); err != nil {
+	if err = s.repo.ReplaceSigningSecret(ctx, userID, profile, id, ciphertext); err != nil {
 		return "", err
 	}
 	return value, nil
@@ -408,8 +408,8 @@ func (s *WebhookService) applyWebhookInput(ctx context.Context, hook *Webhook, i
 	return nil
 }
 
-func (s *WebhookService) UpdateGuarded(ctx context.Context, profile, id string, input WebhookInput, check func(int64) error) (*Webhook, error) {
-	row, err := s.repo.UpdateGuarded(ctx, profile, id, func(hook *Webhook) error {
+func (s *WebhookService) UpdateGuarded(ctx context.Context, userID int, profile, id string, input WebhookInput, check func(int64) error) (*Webhook, error) {
+	row, err := s.repo.UpdateGuarded(ctx, userID, profile, id, func(hook *Webhook) error {
 		if err := check(hook.Revision); err != nil {
 			return err
 		}
diff --git a/internal/notifications/webhook_update_test.go b/internal/notifications/webhook_update_test.go
index 8ee557428e..9fba389460 100644
--- a/internal/notifications/webhook_update_test.go
+++ b/internal/notifications/webhook_update_test.go
@@ -69,7 +69,7 @@ func TestWebhookGuardedUpdatePG(t *testing.T) {
 		t.Fatal(err)
 	}
 	repo := NewWebhookRepository(scoped)
-	original, err := repo.GetByID(ctx, "owner", "row")
+	original, err := repo.GetByID(ctx, 1, "owner", "row")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -84,7 +84,7 @@ func TestWebhookGuardedUpdatePG(t *testing.T) {
 	stale := errors.New("stale original validator")
 	result := make(chan error, 1)
 	go func() {
-		_, e := repo.UpdateGuarded(ctx, "owner", "row", func(row *Webhook) error {
+		_, e := repo.UpdateGuarded(ctx, 1, "owner", "row", func(row *Webhook) error {
 			if row.Revision != original.Revision {
 				return stale
 			}
@@ -109,7 +109,7 @@ func TestWebhookGuardedUpdatePG(t *testing.T) {
 	if err = <-result; !errors.Is(err, stale) {
 		t.Fatalf("stale update: %v", err)
 	}
-	current, err := repo.GetByID(ctx, "owner", "row")
+	current, err := repo.GetByID(ctx, 1, "owner", "row")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -117,7 +117,7 @@ func TestWebhookGuardedUpdatePG(t *testing.T) {
 		t.Fatal("stale update overwrote concurrent state")
 	}
 	svc := &WebhookService{repo: repo}
-	updated, err := svc.UpdateGuarded(ctx, "owner", "row", WebhookInput{Name: new("renamed")}, func(rev int64) error {
+	updated, err := svc.UpdateGuarded(ctx, 1, "owner", "row", WebhookInput{Name: new("renamed")}, func(rev int64) error {
 		if rev != current.Revision {
 			return stale
 		}
@@ -129,7 +129,7 @@ func TestWebhookGuardedUpdatePG(t *testing.T) {
 	if updated.Revision <= current.Revision || updated.Name != "renamed" || *updated.SigningSecretCiphertext != "new-secret" || updated.Enabled || updated.ConsecutiveFailures != 9 {
 		t.Fatal("configuration update lost state or returned stale revision")
 	}
-	_, err = svc.UpdateGuarded(ctx, "owner", "row", WebhookInput{Name: new("again")}, func(rev int64) error {
+	_, err = svc.UpdateGuarded(ctx, 1, "owner", "row", WebhookInput{Name: new("again")}, func(rev int64) error {
 		if rev != current.Revision {
 			return stale
 		}
@@ -138,21 +138,25 @@ func TestWebhookGuardedUpdatePG(t *testing.T) {
 	if !errors.Is(err, stale) {
 		t.Fatalf("replay: %v", err)
 	}
-	enabled, err := svc.UpdateGuarded(ctx, "owner", "row", WebhookInput{Enabled: new(true)}, func(int64) error { return nil })
+	enabled, err := svc.UpdateGuarded(ctx, 1, "owner", "row", WebhookInput{Enabled: new(true)}, func(int64) error { return nil })
 	if err != nil || !enabled.Enabled || enabled.ConsecutiveFailures != 0 || enabled.DisabledReason != nil {
 		t.Fatalf("reenable: %v", err)
 	}
-	for _, scope := range []struct{ profile, id string }{{"foreign", "row"}, {"owner", "missing"}} {
-		_, err = repo.UpdateGuarded(ctx, scope.profile, scope.id, func(*Webhook) error { t.Error("hidden precondition invoked"); return nil })
+	// Another profile, the same profile ID on another account, a missing row.
+	for _, scope := range []struct {
+		user        int
+		profile, id string
+	}{{1, "foreign", "row"}, {2, "owner", "row"}, {1, "owner", "missing"}} {
+		_, err = repo.UpdateGuarded(ctx, scope.user, scope.profile, scope.id, func(*Webhook) error { t.Error("hidden precondition invoked"); return nil })
 		if !errors.Is(err, ErrWebhookNotFound) {
 			t.Fatalf("hidden: %v", err)
 		}
 	}
-	_, err = svc.UpdateGuarded(ctx, "owner", "row", WebhookInput{Name: new(" ")}, func(int64) error { return nil })
+	_, err = svc.UpdateGuarded(ctx, 1, "owner", "row", WebhookInput{Name: new(" ")}, func(int64) error { return nil })
 	if !errors.Is(err, ErrWebhookInvalid) {
 		t.Fatalf("invalid: %v", err)
 	}
-	after, err := repo.GetByID(ctx, "owner", "row")
+	after, err := repo.GetByID(ctx, 1, "owner", "row")
 	if err != nil || after.Revision != enabled.Revision {
 		t.Fatal("invalid update was stored")
 	}
diff --git a/internal/notifications/webpush_logic_test.go b/internal/notifications/webpush_logic_test.go
index dfc4c0a86a..5756a46d11 100644
--- a/internal/notifications/webpush_logic_test.go
+++ b/internal/notifications/webpush_logic_test.go
@@ -18,10 +18,10 @@ func TestBuildWebPushPayload(t *testing.T) {
 		if err := json.Unmarshal(raw, &payload); err != nil {
 			t.Fatal(err)
 		}
-		if payload.Title != "The latest episode of Severance S02E01 just dropped!" {
+		if payload.Title != "Severance" {
 			t.Fatalf("unexpected title %q", payload.Title)
 		}
-		if payload.Body != "Hello, Ms. Cobel" {
+		if payload.Body != "New episode · S02E01 · Hello, Ms. Cobel" {
 			t.Fatalf("unexpected body %q", payload.Body)
 		}
 		if payload.URL != "/item/episode-456" {
@@ -102,8 +102,8 @@ func TestBuildNotificationDisplay(t *testing.T) {
 	t.Run("episode available", func(t *testing.T) {
 		display := BuildNotificationDisplay(webhookTestRow())
 		if display.DeliveryID != "01DELIVERY" ||
-			display.Title != "The latest episode of Severance S02E01 just dropped!" ||
-			display.Body != "Hello, Ms. Cobel" ||
+			display.Title != "Severance" ||
+			display.Body != "New episode · S02E01 · Hello, Ms. Cobel" ||
 			display.ThreadID != "series:series-123" ||
 			display.Category != "episode_available" ||
 			display.URL != "/item/episode-456" {
@@ -111,6 +111,42 @@ func TestBuildNotificationDisplay(t *testing.T) {
 		}
 	})
 
+	t.Run("episode body drops placeholder titles and missing parts", func(t *testing.T) {
+		season, episode := 10, 1
+		cases := []struct {
+			name      string
+			row       DeliveryRow
+			wantTitle string
+			wantBody  string
+		}{
+			{
+				name:      "placeholder episode title",
+				row:       DeliveryRow{SeriesTitle: "9-1-1", EpisodeTitle: "TBA", SeasonNumber: &season, EpisodeNumber: &episode},
+				wantTitle: "9-1-1",
+				wantBody:  "New episode · S10E01",
+			},
+			{
+				name:      "no episode numbers",
+				row:       DeliveryRow{SeriesTitle: "9-1-1", EpisodeTitle: "Pilot"},
+				wantTitle: "9-1-1",
+				wantBody:  "New episode · Pilot",
+			},
+			{
+				name:      "no series title",
+				row:       DeliveryRow{EpisodeTitle: "Pilot", SeasonNumber: &season, EpisodeNumber: &episode},
+				wantTitle: "New episode available",
+				wantBody:  "S10E01 · Pilot",
+			},
+		}
+		for _, tc := range cases {
+			tc.row.Type = DeliveryTypeEpisodeAvailable
+			display := BuildNotificationDisplay(tc.row)
+			if display.Title != tc.wantTitle || display.Body != tc.wantBody {
+				t.Errorf("%s: title %q body %q, want %q / %q", tc.name, display.Title, display.Body, tc.wantTitle, tc.wantBody)
+			}
+		}
+	})
+
 	t.Run("request declined", func(t *testing.T) {
 		row := requestDeclinedTestRow()
 		display := BuildNotificationDisplay(row)
diff --git a/internal/notifications/webpush_repo.go b/internal/notifications/webpush_repo.go
index 429435e7ae..a856adebdf 100644
--- a/internal/notifications/webpush_repo.go
+++ b/internal/notifications/webpush_repo.go
@@ -85,14 +85,16 @@ func (r *WebPushRepository) Upsert(ctx context.Context, sub WebPushSubscription)
 	// Reassignment keeps the row id, so undelivered attempts enqueued for the
 	// previous owner would otherwise be sent to the new owner's browser once
 	// the retry worker reclaims them. Cancel them before the ownership flips.
+	// The owner is the account profile: a same-ID profile on another account
+	// is a different owner.
 	if _, err := tx.Exec(ctx, `
 		DELETE FROM web_push_delivery_attempts
 		WHERE outcome IN ('pending', 'retrying')
 		  AND subscription_id IN (
 			SELECT id FROM web_push_subscriptions
-			WHERE endpoint = $1 AND profile_id <> $2
+			WHERE endpoint = $1 AND (user_id <> $2 OR profile_id <> $3)
 		  )`,
-		sub.Endpoint, sub.ProfileID); err != nil {
+		sub.Endpoint, sub.UserID, sub.ProfileID); err != nil {
 		return nil, fmt.Errorf("purge reassigned web push attempts: %w", err)
 	}
 
@@ -121,27 +123,32 @@ func (r *WebPushRepository) Upsert(ctx context.Context, sub WebPushSubscription)
 	return saved, nil
 }
 
-// ListByProfile returns a profile's subscriptions for the settings UI.
-func (r *WebPushRepository) ListByProfile(ctx context.Context, profileID string) ([]WebPushSubscription, error) {
+// ListByProfile returns an account profile's subscriptions for the settings
+// UI. Profile IDs repeat across accounts, so management queries match the
+// account too.
+func (r *WebPushRepository) ListByProfile(ctx context.Context, userID int, profileID string) ([]WebPushSubscription, error) {
 	rows, err := r.pool.Query(ctx,
-		`SELECT `+webPushColumns+` FROM web_push_subscriptions WHERE profile_id = $1 ORDER BY created_at`,
-		profileID)
+		`SELECT `+webPushColumns+` FROM web_push_subscriptions WHERE user_id = $1 AND profile_id = $2 ORDER BY created_at`,
+		userID, profileID)
 	if err != nil {
 		return nil, fmt.Errorf("list web push subscriptions: %w", err)
 	}
 	return scanWebPushSubscriptions(rows)
 }
 
-// ListEnabledByProfiles loads enabled subscriptions keyed by profile, inside
-// the fanout transaction (outbox enqueue).
-func (r *WebPushRepository) ListEnabledByProfiles(ctx context.Context, tx pgx.Tx, profileIDs []string) (map[string][]WebPushSubscription, error) {
-	out := make(map[string][]WebPushSubscription, len(profileIDs))
-	if len(profileIDs) == 0 {
+// ListEnabledByProfiles loads enabled subscriptions keyed by account and
+// profile (profile IDs repeat across accounts), inside the delivery's
+// transaction (outbox enqueue).
+func (r *WebPushRepository) ListEnabledByProfiles(ctx context.Context, tx pgx.Tx, profiles []profileKey) (map[profileKey][]WebPushSubscription, error) {
+	out := make(map[profileKey][]WebPushSubscription, len(profiles))
+	if len(profiles) == 0 {
 		return out, nil
 	}
+	userIDs, profileIDs := profileKeyArrays(profiles)
 	rows, err := tx.Query(ctx,
-		`SELECT `+webPushColumns+` FROM web_push_subscriptions WHERE profile_id = ANY($1) AND enabled`,
-		profileIDs)
+		`SELECT `+webPushColumns+` FROM web_push_subscriptions
+		WHERE (user_id, profile_id) IN (SELECT * FROM unnest($1::int[], $2::text[])) AND enabled`,
+		userIDs, profileIDs)
 	if err != nil {
 		return nil, fmt.Errorf("list enabled web push subscriptions: %w", err)
 	}
@@ -150,7 +157,8 @@ func (r *WebPushRepository) ListEnabledByProfiles(ctx context.Context, tx pgx.Tx
 		return nil, err
 	}
 	for _, sub := range subs {
-		out[sub.ProfileID] = append(out[sub.ProfileID], sub)
+		key := profileKey{sub.UserID, sub.ProfileID}
+		out[key] = append(out[key], sub)
 	}
 	return out, nil
 }
@@ -167,10 +175,10 @@ func (r *WebPushRepository) getByIDUnscoped(ctx context.Context, id string) (*We
 	return sub, nil
 }
 
-// Delete removes one subscription scoped to the profile. Idempotent.
-func (r *WebPushRepository) Delete(ctx context.Context, profileID, id string) error {
+// Delete removes one subscription scoped to the account profile. Idempotent.
+func (r *WebPushRepository) Delete(ctx context.Context, userID int, profileID, id string) error {
 	_, err := r.pool.Exec(ctx,
-		`DELETE FROM web_push_subscriptions WHERE profile_id = $1 AND id = $2`, profileID, id)
+		`DELETE FROM web_push_subscriptions WHERE user_id = $1 AND profile_id = $2 AND id = $3`, userID, profileID, id)
 	return err
 }
 
@@ -193,10 +201,10 @@ func (r *WebPushRepository) deleteGone(ctx context.Context, id string) error {
 	return err
 }
 
-// DeleteAllForProfile removes a deleted profile's subscriptions.
-func (r *WebPushRepository) DeleteAllForProfile(ctx context.Context, profileID string) error {
+// DeleteAllForProfile removes a deleted account profile's subscriptions.
+func (r *WebPushRepository) DeleteAllForProfile(ctx context.Context, userID int, profileID string) error {
 	_, err := r.pool.Exec(ctx,
-		`DELETE FROM web_push_subscriptions WHERE profile_id = $1`, profileID)
+		`DELETE FROM web_push_subscriptions WHERE user_id = $1 AND profile_id = $2`, userID, profileID)
 	return err
 }
 
@@ -320,11 +328,11 @@ func (r *WebPushRepository) DeleteOldAttempts(ctx context.Context, now time.Time
 
 // ListPage returns at most limit records in stable creation order. Callers may
 // request one lookahead row; this read does not alter delivery state.
-func (r *WebPushRepository) ListPage(ctx context.Context, profile string, limit int, after *Cursor) ([]WebPushSubscription, error) {
-	query := `SELECT ` + webPushColumns + ` FROM web_push_subscriptions WHERE profile_id = $1`
-	args := []any{profile}
+func (r *WebPushRepository) ListPage(ctx context.Context, userID int, profile string, limit int, after *Cursor) ([]WebPushSubscription, error) {
+	query := `SELECT ` + webPushColumns + ` FROM web_push_subscriptions WHERE user_id = $1 AND profile_id = $2`
+	args := []any{userID, profile}
 	if after != nil {
-		query += ` AND (created_at, id) > ($2, $3)`
+		query += ` AND (created_at, id) > ($3, $4)`
 		args = append(args, after.CreatedAt, after.ID)
 	}
 	query += fmt.Sprintf(" ORDER BY created_at, id LIMIT $%d", len(args)+1)
diff --git a/internal/notifications/webpush_sender.go b/internal/notifications/webpush_sender.go
index a4b7f3072c..16d456e65d 100644
--- a/internal/notifications/webpush_sender.go
+++ b/internal/notifications/webpush_sender.go
@@ -129,9 +129,10 @@ func (s *webPushSender) processAttempt(ctx context.Context, attempt DeliveryAtte
 			attempt.AttemptNumber+1, nil, "delivery row missing", nil)
 		return
 	}
-	if row.ProfileID != sub.ProfileID {
-		// The endpoint was reassigned to a different profile between enqueue
-		// and dispatch; this delivery belongs to the previous owner.
+	if row.UserID != sub.UserID || row.ProfileID != sub.ProfileID {
+		// The endpoint was reassigned to a different profile, possibly one
+		// with the same ID on another account, between enqueue and dispatch;
+		// this delivery belongs to the previous owner.
 		_ = s.subscriptions.FinalizeAttempt(ctx, attempt.ID, WebhookOutcomeFailed,
 			attempt.AttemptNumber+1, nil, "subscription reassigned", nil)
 		return
diff --git a/internal/notifications/webpush_service.go b/internal/notifications/webpush_service.go
index e501c7d32a..7e142f6a9b 100644
--- a/internal/notifications/webpush_service.go
+++ b/internal/notifications/webpush_service.go
@@ -177,17 +177,17 @@ func (s *WebPushService) Subscribe(ctx context.Context, userID int, profileID, e
 	})
 }
 
-// List returns the profile's subscriptions.
-func (s *WebPushService) List(ctx context.Context, profileID string) ([]WebPushSubscription, error) {
-	return s.repo.ListByProfile(ctx, profileID)
+// List returns the account profile's subscriptions.
+func (s *WebPushService) List(ctx context.Context, userID int, profileID string) ([]WebPushSubscription, error) {
+	return s.repo.ListByProfile(ctx, userID, profileID)
 }
 
-// Unsubscribe removes a subscription by id (profile-scoped, settings UI) or
-// by endpoint (user-scoped: the browser owns the endpoint and Subscribe may
-// have reassigned it to a sibling profile). Idempotent.
+// Unsubscribe removes a subscription by id (scoped to the account profile,
+// settings UI) or by endpoint (user-scoped: the browser owns the endpoint and
+// Subscribe may have reassigned it to a sibling profile). Idempotent.
 func (s *WebPushService) Unsubscribe(ctx context.Context, userID int, profileID, id, endpoint string) error {
 	if id != "" {
-		return s.repo.Delete(ctx, profileID, id)
+		return s.repo.Delete(ctx, userID, profileID, id)
 	}
 	if endpoint != "" {
 		return s.repo.DeleteByEndpoint(ctx, userID, endpoint)
@@ -195,6 +195,6 @@ func (s *WebPushService) Unsubscribe(ctx context.Context, userID int, profileID,
 	return fmt.Errorf("%w: an id or endpoint is required", ErrWebPushInvalid)
 }
 
-func (s *WebPushService) ListPage(ctx context.Context, profile string, limit int, after *Cursor) ([]WebPushSubscription, error) {
-	return s.repo.ListPage(ctx, profile, limit, after)
+func (s *WebPushService) ListPage(ctx context.Context, userID int, profile string, limit int, after *Cursor) ([]WebPushSubscription, error) {
+	return s.repo.ListPage(ctx, userID, profile, limit, after)
 }
diff --git a/internal/notifications/ws_ticket.go b/internal/notifications/ws_ticket.go
index 7e9eb28106..6a45e1453b 100644
--- a/internal/notifications/ws_ticket.go
+++ b/internal/notifications/ws_ticket.go
@@ -20,13 +20,36 @@ import (
 // after minting is harmless where a logged profile token would not be.
 const TicketTTL = 30 * time.Second
 
-// TicketStore mints and consumes single-use websocket handshake tickets
-// bound to a (user, profile).
+// Ticket is what a websocket handshake ticket is bound to: the user, the
+// profile it was minted for, and that profile's PIN proof (its profile token,
+// "" for a profile without a PIN). The proof stays server-side; the socket
+// re-verifies it for as long as the connection relies on the profile.
+type Ticket struct {
+	UserID       int
+	ProfileID    string
+	ProfileToken string
+}
+
+// maxTicketProofBytes is well above any signed profile token. The viewer gate
+// does not read X-Profile-Token for a profile without a PIN, so the mint
+// would otherwise keep whatever the caller sent.
+const maxTicketProofBytes = 4 << 10
+
+// bounded drops a profile token no signed one could be. A PIN-locked profile
+// then fails its proof check, which closes rather than opens access.
+func (t Ticket) bounded() Ticket {
+	if len(t.ProfileToken) > maxTicketProofBytes {
+		t.ProfileToken = ""
+	}
+	return t
+}
+
+// TicketStore mints and consumes single-use websocket handshake tickets.
 type TicketStore interface {
-	Mint(ctx context.Context, userID int, profileID string) (ticket string, ttl time.Duration, err error)
+	Mint(ctx context.Context, binding Ticket) (ticket string, ttl time.Duration, err error)
 	// Consume validates and invalidates a ticket. ok is false for missing,
 	// expired, or already-used tickets.
-	Consume(ctx context.Context, ticket string) (userID int, profileID string, ok bool)
+	Consume(ctx context.Context, ticket string) (binding Ticket, ok bool)
 }
 
 // NewTicketStore returns a Redis-backed store when a Redis client is
@@ -47,8 +70,7 @@ func newTicketValue() (string, error) {
 }
 
 type memoryTicket struct {
-	userID    int
-	profileID string
+	binding   Ticket
 	expiresAt time.Time
 }
 
@@ -57,7 +79,7 @@ type memoryTicketStore struct {
 	tickets map[string]memoryTicket
 }
 
-func (s *memoryTicketStore) Mint(_ context.Context, userID int, profileID string) (string, time.Duration, error) {
+func (s *memoryTicketStore) Mint(_ context.Context, binding Ticket) (string, time.Duration, error) {
 	ticket, err := newTicketValue()
 	if err != nil {
 		return "", 0, err
@@ -71,26 +93,25 @@ func (s *memoryTicketStore) Mint(_ context.Context, userID int, profileID string
 		}
 	}
 	s.tickets[ticket] = memoryTicket{
-		userID:    userID,
-		profileID: profileID,
+		binding:   binding.bounded(),
 		expiresAt: now.Add(TicketTTL),
 	}
 	s.mu.Unlock()
 	return ticket, TicketTTL, nil
 }
 
-func (s *memoryTicketStore) Consume(_ context.Context, ticket string) (int, string, bool) {
+func (s *memoryTicketStore) Consume(_ context.Context, ticket string) (Ticket, bool) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	entry, ok := s.tickets[ticket]
 	if !ok {
-		return 0, "", false
+		return Ticket{}, false
 	}
 	delete(s.tickets, ticket) // single-use
 	if time.Now().After(entry.expiresAt) {
-		return 0, "", false
+		return Ticket{}, false
 	}
-	return entry.userID, entry.profileID, true
+	return entry.binding, true
 }
 
 type redisTicketStore struct {
@@ -99,30 +120,56 @@ type redisTicketStore struct {
 
 const redisTicketPrefix = "prairie:events:ws-ticket:"
 
-func (s *redisTicketStore) Mint(ctx context.Context, userID int, profileID string) (string, time.Duration, error) {
+// redisTicketProofPrefix keys a ticket's profile token. The ticket key keeps
+// the "userID|profileID" value every release reads, so a node from before the
+// proof was kept still consumes a ticket minted by a newer one during a
+// rolling deploy. The proof lives outside redisTicketPrefix: the caller
+// chooses the token, so a proof key any ticket string could name would be
+// read as a binding to whatever "userID|profileID" the caller sent, by this
+// release and by older ones.
+const redisTicketProofPrefix = "prairie:events:ws-ticket-proof:"
+
+func (s *redisTicketStore) Mint(ctx context.Context, binding Ticket) (string, time.Duration, error) {
 	ticket, err := newTicketValue()
 	if err != nil {
 		return "", 0, err
 	}
-	value := strconv.Itoa(userID) + "|" + profileID
-	if err := s.client.Set(ctx, redisTicketPrefix+ticket, value, TicketTTL).Err(); err != nil {
+	binding = binding.bounded()
+	pipe := s.client.TxPipeline()
+	pipe.Set(ctx, redisTicketPrefix+ticket, strconv.Itoa(binding.UserID)+"|"+binding.ProfileID, TicketTTL)
+	if binding.ProfileToken != "" {
+		pipe.Set(ctx, redisTicketProofPrefix+ticket, binding.ProfileToken, TicketTTL)
+	}
+	if _, err := pipe.Exec(ctx); err != nil {
 		return "", 0, fmt.Errorf("store ticket: %w", err)
 	}
 	return ticket, TicketTTL, nil
 }
 
-func (s *redisTicketStore) Consume(ctx context.Context, ticket string) (int, string, bool) {
-	value, err := s.client.GetDel(ctx, redisTicketPrefix+ticket).Result()
+// Consume reads a ticket without a proof key (a profile without a PIN, or a
+// ticket an older node minted) as one without PIN proof.
+func (s *redisTicketStore) Consume(ctx context.Context, ticket string) (Ticket, bool) {
+	pipe := s.client.TxPipeline()
+	valueCmd := pipe.GetDel(ctx, redisTicketPrefix+ticket)
+	proofCmd := pipe.GetDel(ctx, redisTicketProofPrefix+ticket)
+	// Exec reports a missing key as an error; each command's own result says
+	// which key it was.
+	_, _ = pipe.Exec(ctx)
+	value, err := valueCmd.Result()
 	if err != nil {
-		return 0, "", false
+		return Ticket{}, false
 	}
 	parts := strings.SplitN(value, "|", 2)
 	if len(parts) != 2 {
-		return 0, "", false
+		return Ticket{}, false
 	}
 	userID, err := strconv.Atoi(parts[0])
 	if err != nil || userID <= 0 {
-		return 0, "", false
+		return Ticket{}, false
+	}
+	binding := Ticket{UserID: userID, ProfileID: parts[1]}
+	if proof, err := proofCmd.Result(); err == nil {
+		binding.ProfileToken = proof
 	}
-	return userID, parts[1], true
+	return binding, true
 }
diff --git a/internal/notifications/ws_ticket_test.go b/internal/notifications/ws_ticket_test.go
new file mode 100644
index 0000000000..b131ec6a6d
--- /dev/null
+++ b/internal/notifications/ws_ticket_test.go
@@ -0,0 +1,86 @@
+package notifications
+
+import (
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/redis/go-redis/v9"
+)
+
+// The Redis store keeps the profile token beside the ticket, leaving the
+// ticket value in the format older nodes read, and consumes a ticket an older
+// node minted as one without PIN proof.
+func TestRedisTicketStoreKeepsProfileToken(t *testing.T) {
+	endpoint := os.Getenv("PRAIRIE_TEST_REDIS_URL")
+	if endpoint == "" {
+		t.Skip("PRAIRIE_TEST_REDIS_URL required for the Redis ticket store")
+	}
+	opts, err := redis.ParseURL(endpoint)
+	if err != nil {
+		t.Fatal(err)
+	}
+	client := redis.NewClient(opts)
+	t.Cleanup(func() { _ = client.Close() })
+	store := NewTicketStore(client)
+
+	minted := Ticket{UserID: 7, ProfileID: "profile-1", ProfileToken: "proof"}
+	ticket, _, err := store.Mint(t.Context(), minted)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if value, err := client.Get(t.Context(), redisTicketPrefix+ticket).Result(); err != nil || value != "7|profile-1" {
+		t.Fatalf("ticket value = %q, %v; want the format older nodes read", value, err)
+	}
+	if binding, ok := store.Consume(t.Context(), ticket); !ok || binding != minted {
+		t.Fatalf("consume returned %+v %v", binding, ok)
+	}
+	if _, ok := store.Consume(t.Context(), ticket); ok {
+		t.Fatal("tickets must be single-use")
+	}
+
+	if err := client.Set(t.Context(), redisTicketPrefix+"legacy-fixture", "7|profile-1", TicketTTL).Err(); err != nil {
+		t.Fatal(err)
+	}
+	if binding, ok := store.Consume(t.Context(), "legacy-fixture"); !ok || binding != (Ticket{UserID: 7, ProfileID: "profile-1"}) {
+		t.Fatalf("legacy value consumed as %+v %v", binding, ok)
+	}
+}
+
+// A ticket's proof is never addressable as a ticket: the caller chooses the
+// profile token, so a proof key read as "userID|profileID" would bind any
+// profile on the account without its PIN, on this node or an older one.
+func TestRedisTicketStoreProofIsNotATicket(t *testing.T) {
+	endpoint := os.Getenv("PRAIRIE_TEST_REDIS_URL")
+	if endpoint == "" {
+		t.Skip("PRAIRIE_TEST_REDIS_URL required for the Redis ticket store")
+	}
+	opts, err := redis.ParseURL(endpoint)
+	if err != nil {
+		t.Fatal(err)
+	}
+	client := redis.NewClient(opts)
+	t.Cleanup(func() { _ = client.Close() })
+	store := NewTicketStore(client)
+
+	ticket, _, err := store.Mint(t.Context(), Ticket{UserID: 7, ProfileID: "open-profile", ProfileToken: "7|locked-profile"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	keys, err := client.Keys(t.Context(), redisTicketPrefix+ticket+"*").Result()
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, key := range keys {
+		suffix := strings.TrimPrefix(key, redisTicketPrefix)
+		if suffix == ticket {
+			continue
+		}
+		if binding, ok := store.Consume(t.Context(), suffix); ok {
+			t.Fatalf("consumed %q as a ticket bound to %+v", suffix, binding)
+		}
+	}
+	if binding, ok := store.Consume(t.Context(), ticket); !ok || binding.ProfileID != "open-profile" || binding.ProfileToken != "7|locked-profile" {
+		t.Fatalf("consume returned %+v %v", binding, ok)
+	}
+}
diff --git a/internal/opslog/handler.go b/internal/opslog/handler.go
index 2a4e7bafef..a0e1031feb 100644
--- a/internal/opslog/handler.go
+++ b/internal/opslog/handler.go
@@ -5,6 +5,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"log/slog"
+	"reflect"
 	"strings"
 	"time"
 
@@ -173,12 +174,38 @@ func attrValue(v slog.Value) any {
 	case slog.KindTime:
 		return v.Time().UTC().Format(time.RFC3339Nano)
 	case slog.KindAny:
+		// Error types from errors.New and fmt.Errorf have no exported fields
+		// and would encode as {}, hiding the failure cause. Record the text,
+		// as the console handler does.
+		if err, ok := v.Any().(error); ok && err != nil {
+			return errorText(err)
+		}
 		return snapshot(v.Any())
 	default:
 		return v.String()
 	}
 }
 
+// errorText records an error's message for the stored entry. Requested URLs
+// inside the chain are sanitized with logredact.SanitizeURLError, the same
+// helper transport errors pass through elsewhere, so signed stream URLs and
+// query-string tokens are not written to the database. Secret key=value pairs
+// left in plain text, such as a plugin's gRPC status description, are masked
+// with logredact.RedactSecretAssignments. A typed-nil pointer
+// that satisfies error is recorded as a placeholder instead of calling Error
+// on a nil receiver, and a panicking Error method is contained.
+func errorText(err error) (text string) {
+	if rv := reflect.ValueOf(err); rv.Kind() == reflect.Pointer && rv.IsNil() {
+		return fmt.Sprintf("<nil %T>", err)
+	}
+	defer func() {
+		if r := recover(); r != nil {
+			text = fmt.Sprintf("<%T: Error panicked>", err)
+		}
+	}()
+	return logredact.RedactSecretAssignments(logredact.SanitizeURLError(err).Error())
+}
+
 // snapshot encodes a value the caller still owns, such as a map, slice or
 // pointer. The consumer encodes Attrs on its own goroutine seconds later, or
 // longer while Postgres is down, and a caller that changed a logged map in the
diff --git a/internal/opslog/handler_test.go b/internal/opslog/handler_test.go
index 67edadd423..5c42920b6f 100644
--- a/internal/opslog/handler_test.go
+++ b/internal/opslog/handler_test.go
@@ -4,7 +4,10 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"log/slog"
+	"net/url"
+	"strings"
 	"testing"
 )
 
@@ -32,7 +35,7 @@ func TestHandlerSnapshotsValuesTheCallerOwns(t *testing.T) {
 		t.Fatal(err)
 	}
 	// encoding/json sorts map keys, so the encoding is stable.
-	want := `{"counts":{"movies":1},"error":{},"ids":[1,2],"static":{"movies":1},"status":200}`
+	want := `{"counts":{"movies":1},"error":"boom","ids":[1,2],"static":{"movies":1},"status":200}`
 	if string(got) != want {
 		t.Fatalf("attrs = %s, want %s", got, want)
 	}
@@ -57,3 +60,89 @@ func TestHandlerKeepsAValueItCannotEncode(t *testing.T) {
 		t.Fatalf("attrs[status] = %#v, want 200", entry.Attrs["status"])
 	}
 }
+
+// TestHandlerRecordsErrorText checks that an error attr is stored as its
+// text. Errors from errors.New and fmt.Errorf have no exported fields, so a
+// JSON encode would store {} and hide why the logged operation failed.
+func TestHandlerRecordsErrorText(t *testing.T) {
+	t.Parallel()
+	writer := &recordingWriter{}
+	logger := slog.New(NewHandler(slog.DiscardHandler, writer, slog.LevelInfo, "node-a"))
+
+	wrapped := fmt.Errorf("loading overlay summaries: %w", errors.New("connection refused"))
+	logger.With("static_err", errors.New("static")).ErrorContext(context.Background(), "probe: error", "error", wrapped)
+
+	writer.mu.Lock()
+	entry := writer.entries[0]
+	writer.mu.Unlock()
+	if got := entry.Attrs["error"]; got != "loading overlay summaries: connection refused" {
+		t.Fatalf("attrs[error] = %#v, want the error text", got)
+	}
+	if got := entry.Attrs["static_err"]; got != "static" {
+		t.Fatalf("attrs[static_err] = %#v, want the error text", got)
+	}
+}
+
+type nilPtrErr struct{ msg string }
+
+func (e *nilPtrErr) Error() string { return e.msg }
+
+// TestHandlerRecordsTypedNilError checks that a nil pointer satisfying error
+// is recorded instead of panicking when Error dereferences the receiver.
+func TestHandlerRecordsTypedNilError(t *testing.T) {
+	t.Parallel()
+	writer := &recordingWriter{}
+	logger := slog.New(NewHandler(slog.DiscardHandler, writer, slog.LevelInfo, "node-a"))
+
+	var err *nilPtrErr
+	logger.ErrorContext(context.Background(), "probe: error", "error", err)
+
+	writer.mu.Lock()
+	entry := writer.entries[0]
+	writer.mu.Unlock()
+	if got := entry.Attrs["error"]; got != "<nil *opslog.nilPtrErr>" {
+		t.Fatalf("attrs[error] = %#v, want a nil placeholder", got)
+	}
+}
+
+// TestHandlerSanitizesErrorURLs checks that a requested URL inside an error
+// chain loses its query string and credentials before it is stored.
+func TestHandlerSanitizesErrorURLs(t *testing.T) {
+	t.Parallel()
+	writer := &recordingWriter{}
+	logger := slog.New(NewHandler(slog.DiscardHandler, writer, slog.LevelInfo, "node-a"))
+
+	urlErr := &url.Error{Op: "Get", URL: "https://user:pass@cdn.example/v.mp4?token=s3cret&sig=abc", Err: errors.New("timeout")}
+	logger.ErrorContext(context.Background(), "probe: error", "error", fmt.Errorf("fetch stream: %w", urlErr))
+
+	writer.mu.Lock()
+	entry := writer.entries[0]
+	writer.mu.Unlock()
+	got, _ := entry.Attrs["error"].(string)
+	if strings.Contains(got, "s3cret") || strings.Contains(got, "pass") || strings.Contains(got, "sig=") {
+		t.Fatalf("attrs[error] = %q leaks a secret", got)
+	}
+	if !strings.Contains(got, "fetch stream") || !strings.Contains(got, "timeout") {
+		t.Fatalf("attrs[error] = %q, want the wrapper and cause kept", got)
+	}
+}
+
+// TestHandlerRedactsSecretAssignmentsInErrorText checks that a secret
+// key=value pair in plain error text, as a plugin's gRPC status description
+// carries it, is masked before the entry is stored.
+func TestHandlerRedactsSecretAssignmentsInErrorText(t *testing.T) {
+	t.Parallel()
+	writer := &recordingWriter{}
+	logger := slog.New(NewHandler(slog.DiscardHandler, writer, slog.LevelInfo, "node-a"))
+
+	err := errors.New("rpc error: code = Unauthenticated desc = api_key=FAKE_FIXTURE_SECRET rejected")
+	logger.ErrorContext(context.Background(), "probe: error", "error", fmt.Errorf("metadata lookup: %w", err))
+
+	writer.mu.Lock()
+	entry := writer.entries[0]
+	writer.mu.Unlock()
+	got, _ := entry.Attrs["error"].(string)
+	if want := "metadata lookup: rpc error: code = Unauthenticated desc = api_key=[REDACTED] rejected"; got != want {
+		t.Fatalf("attrs[error] = %q, want %q", got, want)
+	}
+}
diff --git a/internal/overlays/summary.go b/internal/overlays/summary.go
index b321950995..d0ad960bca 100644
--- a/internal/overlays/summary.go
+++ b/internal/overlays/summary.go
@@ -170,13 +170,14 @@ func hdrTypeFromTracks(tracks []models.VideoTrack) string {
 }
 
 func normalizeAudio(file *models.MediaFile) string {
-	defaultCandidates := make([]string, 0, 3)
-	candidates := make([]string, 0, len(file.AudioTracks)*3+1)
+	defaultCandidates := make([]string, 0, 4)
+	candidates := make([]string, 0, len(file.AudioTracks)*4+1)
 	for _, track := range file.AudioTracks {
+		atmos := atmosProfile(track.Profile)
 		if track.Default {
-			defaultCandidates = append(defaultCandidates, track.Title, track.EmbeddedTitle, track.Codec)
+			defaultCandidates = append(defaultCandidates, atmos, track.Title, track.EmbeddedTitle, track.Codec)
 		}
-		candidates = append(candidates, track.Title, track.EmbeddedTitle, track.Codec)
+		candidates = append(candidates, atmos, track.Title, track.EmbeddedTitle, track.Codec)
 	}
 	if len(defaultCandidates) > 0 {
 		defaultCandidates = append(defaultCandidates, file.CodecAudio)
@@ -193,6 +194,19 @@ func normalizeAudio(file *models.MediaFile) string {
 	return normalizeAudioCandidates([]string{file.CodecAudio})
 }
 
+// atmosProfile returns an FFprobe audio profile that names Atmos ("Dolby
+// Digital Plus + Dolby Atmos", "Dolby TrueHD + Dolby Atmos"), or "". The
+// stored codec of an Atmos track is plain eac3 or truehd, and the scanner
+// fills an untagged title with the codec's long name, so the profile is
+// checked before the title. Other profiles are ignored so they cannot change
+// the remaining badges.
+func atmosProfile(profile string) string {
+	if strings.Contains(strings.ToLower(profile), "atmos") {
+		return profile
+	}
+	return ""
+}
+
 func normalizeAudioCandidates(candidates []string) string {
 	for _, candidate := range candidates {
 		lower := strings.ToLower(strings.TrimSpace(candidate))
diff --git a/internal/overlays/summary_test.go b/internal/overlays/summary_test.go
index b8ab4e4f31..ae1ce65e7e 100644
--- a/internal/overlays/summary_test.go
+++ b/internal/overlays/summary_test.go
@@ -401,3 +401,30 @@ func TestBuildSummaryAggregatesNewFields(t *testing.T) {
 		t.Error("MultiSub = false, want true")
 	}
 }
+
+// The stored codec of an Atmos track is plain eac3 or truehd, so with no
+// "Atmos" in the title only the FFprobe profile identifies it.
+func TestNormalizeAudioReadsAtmosFromProfile(t *testing.T) {
+	tests := []struct {
+		name   string
+		tracks []models.AudioTrack
+		want   string
+	}{
+		// Untagged tracks get the codec's long name as their title.
+		{name: "E-AC-3 Atmos", tracks: []models.AudioTrack{{Codec: "eac3", Title: "ATSC A/52B (AC-3, E-AC-3)", Profile: "Dolby Digital Plus + Dolby Atmos", Default: true}}, want: "Atmos"},
+		{name: "TrueHD Atmos", tracks: []models.AudioTrack{{Codec: "truehd", Title: "TrueHD 7.1", Profile: "Dolby TrueHD + Dolby Atmos", Default: true}}, want: "Atmos"},
+		{name: "plain E-AC-3", tracks: []models.AudioTrack{{Codec: "eac3", Title: "ATSC A/52B (AC-3, E-AC-3)", Default: true}}, want: "EAC3"},
+		{name: "DTS profile keeps the codec badge", tracks: []models.AudioTrack{{Codec: "dts", Title: "DCA (DTS Coherent Acoustics)", Profile: "DTS-HD MA", Default: true}}, want: "DTS"},
+		{name: "default track wins over a later Atmos track", tracks: []models.AudioTrack{
+			{Codec: "eac3", Title: "ATSC A/52B (AC-3, E-AC-3)", Default: true},
+			{Codec: "truehd", Title: "TrueHD", Profile: "Dolby TrueHD + Dolby Atmos"},
+		}, want: "EAC3"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := normalizeAudio(&models.MediaFile{AudioTracks: tt.tracks}); got != tt.want {
+				t.Fatalf("normalizeAudio() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
diff --git a/internal/playback/copy_keyframe_plan.go b/internal/playback/copy_keyframe_plan.go
new file mode 100644
index 0000000000..70ad284578
--- /dev/null
+++ b/internal/playback/copy_keyframe_plan.go
@@ -0,0 +1,243 @@
+package playback
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log"
+	"math"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/prairie-server/prairie-server/internal/playback/keyframes"
+)
+
+// copySegmentPlan is a copy-video session's complete segment list, worked out
+// from the source's keyframe index before FFmpeg starts (#1466). The session
+// serves it as a VOD playlist instead of FFmpeg's growing one, so a player
+// never sees a partial playlist: Safari's native HLS can fall back to one and
+// stop mid-stream.
+//
+// FFmpeg's HLS muxer, run from the start of the file, cuts copied video at
+// the planned keyframes (keyframes.PlanSegments), so its seg_NNNNN files are
+// the planned segments. A seek restart would cut at different keyframes, so
+// a planned session restarts from the beginning instead (see restart).
+type copySegmentPlan struct {
+	durations []float64
+}
+
+// loadKeyframeIndex reads a source's keyframe index, and
+// loadVerifiedKeyframeIndex waits for its full check, stopping when ctx is
+// done; tests replace both.
+var (
+	loadKeyframeIndex         = keyframes.Load
+	loadVerifiedKeyframeIndex = keyframes.LoadVerified
+)
+
+// planCopySegments returns the segment plan for a session, or nil when the
+// session keeps FFmpeg's real playlist: the setting is off, the video isn't
+// copied, the stream doesn't start at the beginning, or the source has no
+// keyframe index.
+func planCopySegments(ctx context.Context, opts TranscodeOpts) *copySegmentPlan {
+	if !opts.KeyframePlaylist ||
+		!strings.EqualFold(opts.TargetCodecVideo, "copy") ||
+		opts.SeekSeconds > 0 || opts.StartSegmentNumber > 0 ||
+		!CanGenerateSyntheticManifest(opts.TotalDuration, opts.SegmentDuration) {
+		return nil
+	}
+	load := loadKeyframeIndex
+	if opts.Reconstructed {
+		load = func(path string) (keyframes.Index, error) { return loadVerifiedKeyframeIndex(ctx, path) }
+		// A rebuilt session that lost its plan record (a clean shutdown
+		// removes the output directory) may already have served the planned
+		// playlist. The plan follows from the verified index alone, so wait
+		// for the check here rather than fall back to FFmpeg's playlist,
+		// which a player holding the planned one can't follow. Once the
+		// check has run, the index is cached. The check stops if the
+		// rebuild's request goes away (see resolveCopyPlan).
+	}
+	idx, err := load(opts.InputPath)
+	if err != nil {
+		if !errors.Is(err, keyframes.ErrNoIndex) {
+			log.Printf("playback: read keyframe index for %s: %v; using FFmpeg's playlist", opts.SessionID, err)
+		}
+		return nil
+	}
+	segmentSeconds := float64(opts.SegmentDuration)
+	if segmentSeconds <= 0 {
+		segmentSeconds = defaultSegmentDuration
+	}
+	starts := keyframes.PlanSegments(idx.Keyframes, segmentSeconds)
+	if len(starts) == 0 || len(starts) > maxSyntheticManifestSegments {
+		return nil
+	}
+	// FFmpeg's last segment ends with the copied video, even when an audio
+	// or subtitle track runs on: the container's duration can be longer.
+	if idx.VideoEnd <= idx.Keyframes[len(idx.Keyframes)-1] {
+		// The video's end is unknown, so the plan can't describe the last
+		// segment.
+		return nil
+	}
+	durations := keyframes.SegmentDurations(starts, idx.VideoEnd)
+	return &copySegmentPlan{durations: durations}
+}
+
+// copyPlanRecordFile keeps a session's planning decision in its output
+// directory, which a session rebuilt from its recipe reuses.
+const copyPlanRecordFile = "keyframe-plan.json"
+
+type copyPlanRecord struct {
+	Planned   bool      `json:"planned"`
+	Durations []float64 `json:"durations,omitempty"`
+}
+
+// resolveCopyPlan returns the plan a session serves. The first start decides
+// and records the decision; a rebuilt session follows the record, so it
+// serves the playlist its player already has. Deciding afresh could differ:
+// a file's index that was still being checked may be verified by then.
+//
+// The record lives in the output directory, which a clean shutdown removes.
+// A rebuilt session without one plans again from the verified index (see
+// planCopySegments), which gives the same plan as the first start. If that
+// start had fallen back to FFmpeg's playlist, the rebuilt session now plans:
+// a planned session copies from the beginning, where FFmpeg cuts the same
+// segments, so the player's earlier segments still match.
+func resolveCopyPlan(ctx context.Context, opts TranscodeOpts) *copySegmentPlan {
+	if !opts.KeyframePlaylist || opts.OutputDir == "" {
+		return planCopySegments(ctx, opts)
+	}
+	path := filepath.Join(opts.OutputDir, copyPlanRecordFile)
+	if data, err := os.ReadFile(path); err == nil {
+		var rec copyPlanRecord
+		if err := json.Unmarshal(data, &rec); err == nil {
+			if !rec.Planned {
+				return nil
+			}
+			if plan := rec.plan(); plan != nil {
+				return plan
+			}
+		}
+		log.Printf("playback: session %s has an unreadable keyframe plan record; using FFmpeg's playlist", opts.SessionID)
+		return nil
+	}
+
+	// Record the decision whatever the start's fate: StartTranscode launches
+	// FFmpeg even if its caller has gone, and that session serves this
+	// playlist.
+	plan := planCopySegments(ctx, opts)
+	if plan == nil && opts.Reconstructed && ctx.Err() != nil {
+		// The rebuild's request went away during the keyframe check. Its
+		// outcome says nothing about the file, so don't record it:
+		// StartTranscode abandons this rebuild, and the next one plans.
+		return nil
+	}
+	rec := copyPlanRecord{Planned: plan != nil}
+	if plan != nil {
+		rec.Durations = plan.durations
+	}
+	data, err := json.Marshal(rec)
+	if err == nil {
+		tmp := path + ".tmp"
+		if err = os.WriteFile(tmp, data, 0o644); err == nil {
+			err = os.Rename(tmp, path)
+		}
+	}
+	if err != nil {
+		// Without a record a rebuilt session can't promise the same
+		// playlist, so don't serve a planned one.
+		log.Printf("playback: record keyframe plan for %s: %v; using FFmpeg's playlist", opts.SessionID, err)
+		return nil
+	}
+	return plan
+}
+
+// plan rebuilds a recorded plan, or nil if the record is inconsistent.
+func (r copyPlanRecord) plan() *copySegmentPlan {
+	if len(r.Durations) == 0 {
+		return nil
+	}
+	for _, d := range r.Durations {
+		if !(d > 0) || math.IsInf(d, 0) {
+			return nil
+		}
+	}
+	return &copySegmentPlan{durations: r.Durations}
+}
+
+// plannedSegmentWait is how long a request for a segment FFmpeg hasn't
+// reached yet waits. A planned stream doesn't seek-restart forward, so a far
+// seek waits for FFmpeg to copy up to it; stream copy runs many times faster
+// than playback, and a missing segment can end Safari's native playback.
+const plannedSegmentWait = 30 * time.Second
+
+// plannedSegmentRecoveryDecision handles a missing segment in a planned
+// session. One FFmpeg hasn't reached is waited for, and recorded as the
+// player's position so the throttler doesn't hold FFmpeg back from it. One
+// that is gone (pruned behind the player) or will never come (FFmpeg stopped)
+// regenerates the stream from the beginning.
+func (s *TranscodeSession) plannedSegmentRecoveryDecision(segNum int, decision SegmentRecoveryDecision) SegmentRecoveryDecision {
+	progress := decision.Progress
+	switch {
+	case progress.Restarting:
+		decision.Wait = true
+		decision.WaitTimeout = activeSegmentWait
+		decision.RestartOnTimeout = false
+		decision.Reason = segmentReasonRestarting
+	case progress.Running && segNum > progress.ProducedHead:
+		s.mu.Lock()
+		if segNum > s.lastRequestedSegment {
+			s.lastRequestedSegment = segNum
+		}
+		s.mu.Unlock()
+		decision.Wait = true
+		decision.WaitTimeout = plannedSegmentWait
+		decision.RestartOnTimeout = false
+		decision.Reason = "planned_segment_ahead"
+	default:
+		decision.Wait = false
+		decision.RestartOnTimeout = true
+		decision.Reason = "planned_segment_regenerate"
+	}
+	return decision
+}
+
+// manifest returns the plan as a complete VOD playlist for the session's
+// segment files, in the same shape as GenerateFullManifest.
+func (p *copySegmentPlan) manifest(opts TranscodeOpts, segPrefix, rawQuery string) []byte {
+	queryDefinition, suffix, queryVersion := syntheticManifestQuery(len(p.durations), rawQuery)
+	segExt := hlsSegmentExtension(opts)
+	fmp4 := videoUsesFMP4(opts)
+	hlsVersion := 3
+	if fmp4 {
+		hlsVersion = 7
+	}
+	hlsVersion = max(hlsVersion, queryVersion)
+
+	// EXT-X-TARGETDURATION must cover every segment's rounded duration. A
+	// keyframe gap longer than the segment length makes a longer segment.
+	target := 1
+	for _, d := range p.durations {
+		target = max(target, int(math.Round(d)))
+	}
+
+	var buf bytes.Buffer
+	buf.WriteString("#EXTM3U\n")
+	fmt.Fprintf(&buf, "#EXT-X-VERSION:%d\n", hlsVersion)
+	buf.WriteString(queryDefinition)
+	fmt.Fprintf(&buf, "#EXT-X-TARGETDURATION:%d\n", target)
+	buf.WriteString("#EXT-X-MEDIA-SEQUENCE:0\n")
+	buf.WriteString("#EXT-X-PLAYLIST-TYPE:VOD\n")
+	if fmp4 {
+		fmt.Fprintf(&buf, "#EXT-X-MAP:URI=\"%sinit.mp4%s\"\n", segPrefix, suffix)
+	}
+	for i, d := range p.durations {
+		fmt.Fprintf(&buf, "#EXTINF:%.6f,\n", d)
+		fmt.Fprintf(&buf, "%sseg_%05d%s%s\n", segPrefix, i, segExt, suffix)
+	}
+	buf.WriteString("#EXT-X-ENDLIST\n")
+	return buf.Bytes()
+}
diff --git a/internal/playback/copy_keyframe_plan_test.go b/internal/playback/copy_keyframe_plan_test.go
new file mode 100644
index 0000000000..afe35d699d
--- /dev/null
+++ b/internal/playback/copy_keyframe_plan_test.go
@@ -0,0 +1,415 @@
+package playback
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"errors"
+	"math"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"slices"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/prairie-server/prairie-server/internal/playback/keyframes"
+)
+
+func stubKeyframeIndex(t *testing.T, idx keyframes.Index, err error) {
+	t.Helper()
+	previous := loadKeyframeIndex
+	loadKeyframeIndex = func(string) (keyframes.Index, error) { return idx, err }
+	t.Cleanup(func() { loadKeyframeIndex = previous })
+}
+
+func plannedOpts() TranscodeOpts {
+	return TranscodeOpts{
+		InputPath:        "/media/episode.mkv",
+		SessionID:        "planned",
+		TargetCodecVideo: "copy",
+		TargetCodecAudio: "copy",
+		SegmentDuration:  2,
+		TotalDuration:    10,
+		KeyframePlaylist: true,
+	}
+}
+
+func TestPlanCopySegments(t *testing.T) {
+	// The container runs to 12s, but FFmpeg's last segment ends with the
+	// video at 10s.
+	stubKeyframeIndex(t, keyframes.Index{Keyframes: []float64{0, 1, 2.6, 7.0, 7.4, 9.0}, Duration: 12, VideoEnd: 10}, nil)
+
+	plan := planCopySegments(t.Context(), plannedOpts())
+	if plan == nil {
+		t.Fatal("no plan for an eligible session")
+	}
+	// Starts 0, 2.6, 7.0, 7.4 (catching up after the long gap), 9.0; the
+	// last segment runs to the video's end.
+	want := []float64{2.6, 4.4, 0.4, 1.6, 1.0}
+	if len(plan.durations) != len(want) {
+		t.Fatalf("durations = %v, want %v", plan.durations, want)
+	}
+	for i := range want {
+		if math.Abs(plan.durations[i]-want[i]) > 1e-9 {
+			t.Fatalf("durations = %v, want %v", plan.durations, want)
+		}
+	}
+}
+
+// A source whose timestamps start later than zero plans the same segments.
+func TestPlanCopySegmentsForALaterStart(t *testing.T) {
+	stubKeyframeIndex(t, keyframes.Index{Keyframes: []float64{7, 8, 9.6, 14.0, 14.4, 16.0}, VideoEnd: 17}, nil)
+	plan := planCopySegments(t.Context(), plannedOpts())
+	if plan == nil {
+		t.Fatal("no plan for a source starting at 7s")
+	}
+	want := []float64{2.6, 4.4, 0.4, 1.6, 1.0}
+	for i := range want {
+		if math.Abs(plan.durations[i]-want[i]) > 1e-9 {
+			t.Fatalf("durations = %v, want %v", plan.durations, want)
+		}
+	}
+}
+
+func TestPlanCopySegmentsKeepsFFmpegPlaylist(t *testing.T) {
+	stubKeyframeIndex(t, keyframes.Index{Keyframes: []float64{0, 2, 4, 6, 8}, VideoEnd: 10}, nil)
+	for name, change := range map[string]func(*TranscodeOpts){
+		"setting off":       func(o *TranscodeOpts) { o.KeyframePlaylist = false },
+		"encoded video":     func(o *TranscodeOpts) { o.TargetCodecVideo = "h264" },
+		"starts at a seek":  func(o *TranscodeOpts) { o.SeekSeconds = 4 },
+		"starts mid-stream": func(o *TranscodeOpts) { o.StartSegmentNumber = 2 },
+		"unknown duration":  func(o *TranscodeOpts) { o.TotalDuration = 0 },
+	} {
+		t.Run(name, func(t *testing.T) {
+			opts := plannedOpts()
+			change(&opts)
+			if plan := planCopySegments(t.Context(), opts); plan != nil {
+				t.Fatalf("plan = %v, want none", plan.durations)
+			}
+		})
+	}
+
+	t.Run("unknown video end", func(t *testing.T) {
+		stubKeyframeIndex(t, keyframes.Index{Keyframes: []float64{0, 2, 4, 6, 8}}, nil)
+		if plan := planCopySegments(t.Context(), plannedOpts()); plan != nil {
+			t.Fatalf("plan = %v, want none", plan.durations)
+		}
+	})
+	t.Run("no index", func(t *testing.T) {
+		stubKeyframeIndex(t, keyframes.Index{}, keyframes.ErrNoIndex)
+		if plan := planCopySegments(t.Context(), plannedOpts()); plan != nil {
+			t.Fatalf("plan = %v, want none", plan.durations)
+		}
+	})
+	t.Run("unreadable source", func(t *testing.T) {
+		stubKeyframeIndex(t, keyframes.Index{}, errors.New("permission denied"))
+		if plan := planCopySegments(t.Context(), plannedOpts()); plan != nil {
+			t.Fatalf("plan = %v, want none", plan.durations)
+		}
+	})
+}
+
+// A session rebuilt from its recipe serves the playlist its player has, even
+// if the file's index became available since it started.
+func TestResolveCopyPlanFollowsTheRecordedDecision(t *testing.T) {
+	opts := plannedOpts()
+	opts.OutputDir = t.TempDir()
+
+	stubKeyframeIndex(t, keyframes.Index{}, keyframes.ErrUnverified)
+	if plan := resolveCopyPlan(t.Context(), opts); plan != nil {
+		t.Fatal("planned while the index is being checked")
+	}
+	verified := keyframes.Index{Keyframes: []float64{0, 1, 2.6, 7.0, 7.4, 9.0}, VideoEnd: 10}
+	stubKeyframeIndex(t, verified, nil)
+	if plan := resolveCopyPlan(t.Context(), opts); plan != nil {
+		t.Fatal("a rebuilt session switched to a keyframe playlist")
+	}
+
+	planned := plannedOpts()
+	planned.OutputDir = t.TempDir()
+	first := resolveCopyPlan(t.Context(), planned)
+	if first == nil {
+		t.Fatal("no plan with a verified index")
+	}
+	// The record stands in for the index, which a cold process may not have
+	// verified yet.
+	stubKeyframeIndex(t, keyframes.Index{}, keyframes.ErrUnverified)
+	again := resolveCopyPlan(t.Context(), planned)
+	if again == nil || !slices.Equal(again.durations, first.durations) {
+		t.Fatalf("rebuilt plan = %+v, want the recorded %+v", again, first)
+	}
+}
+
+// A clean shutdown removes the output directory and its plan record. The
+// rebuilt session plans again from the verified index, waiting for the check
+// a cold process hasn't run yet, and gets the same plan.
+func TestResolveCopyPlanReplansAfterTheRecordIsGone(t *testing.T) {
+	verified := keyframes.Index{Keyframes: []float64{0, 1, 2.6, 7.0, 7.4, 9.0}, VideoEnd: 10}
+	stubKeyframeIndex(t, verified, nil)
+	first := plannedOpts()
+	first.OutputDir = t.TempDir()
+	original := resolveCopyPlan(t.Context(), first)
+	if original == nil {
+		t.Fatal("no plan with a verified index")
+	}
+
+	// A cold process: the cache has no result yet, and the full check gives
+	// the same index.
+	stubKeyframeIndex(t, keyframes.Index{}, keyframes.ErrUnverified)
+	previous := loadVerifiedKeyframeIndex
+	verifiedLoads := 0
+	loadVerifiedKeyframeIndex = func(context.Context, string) (keyframes.Index, error) { verifiedLoads++; return verified, nil }
+	t.Cleanup(func() { loadVerifiedKeyframeIndex = previous })
+
+	rebuilt := plannedOpts()
+	rebuilt.OutputDir = t.TempDir()
+	rebuilt.Reconstructed = true
+	again := resolveCopyPlan(t.Context(), rebuilt)
+	if again == nil || !slices.Equal(again.durations, original.durations) || verifiedLoads != 1 {
+		t.Fatalf("rebuilt plan = %+v after %d verified loads, want the original %+v", again, verifiedLoads, original)
+	}
+
+	// A first start still doesn't wait for the check.
+	fresh := plannedOpts()
+	fresh.OutputDir = t.TempDir()
+	if plan := resolveCopyPlan(t.Context(), fresh); plan != nil || verifiedLoads != 1 {
+		t.Fatalf("a first start planned (%v) or waited for the check (%d loads)", plan != nil, verifiedLoads)
+	}
+}
+
+// A rebuild whose request goes away during the keyframe check records nothing,
+// so the next rebuild plans instead of following a fallback.
+func TestResolveCopyPlanLeavesNoRecordWhenTheRebuildIsCanceled(t *testing.T) {
+	verified := keyframes.Index{Keyframes: []float64{0, 1, 2.6, 7.0, 7.4, 9.0}, VideoEnd: 10}
+	stubKeyframeIndex(t, keyframes.Index{}, keyframes.ErrUnverified)
+	previous := loadVerifiedKeyframeIndex
+	loadVerifiedKeyframeIndex = func(ctx context.Context, _ string) (keyframes.Index, error) {
+		if err := ctx.Err(); err != nil {
+			return keyframes.Index{}, err
+		}
+		return verified, nil
+	}
+	t.Cleanup(func() { loadVerifiedKeyframeIndex = previous })
+
+	rebuilt := plannedOpts()
+	rebuilt.OutputDir = t.TempDir()
+	rebuilt.Reconstructed = true
+	gone, cancel := context.WithCancel(t.Context())
+	cancel()
+	if plan := resolveCopyPlan(gone, rebuilt); plan != nil {
+		t.Fatal("planned without the keyframe check")
+	}
+	if _, err := os.Stat(filepath.Join(rebuilt.OutputDir, copyPlanRecordFile)); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("a canceled rebuild left a plan record: %v", err)
+	}
+	if plan := resolveCopyPlan(t.Context(), rebuilt); plan == nil {
+		t.Fatal("the next rebuild didn't plan")
+	}
+}
+
+func TestCopySegmentPlanManifest(t *testing.T) {
+	plan := &copySegmentPlan{durations: []float64{2.6, 5.2, 0.4}}
+	got := string(plan.manifest(plannedOpts(), "segment/", "token=abc"))
+	want := "#EXTM3U\n" +
+		"#EXT-X-VERSION:7\n" +
+		// The 5.2s segment, from a long keyframe gap, sets the target.
+		"#EXT-X-TARGETDURATION:5\n" +
+		"#EXT-X-MEDIA-SEQUENCE:0\n" +
+		"#EXT-X-PLAYLIST-TYPE:VOD\n" +
+		"#EXT-X-MAP:URI=\"segment/init.mp4?token=abc\"\n" +
+		"#EXTINF:2.600000,\nsegment/seg_00000.m4s?token=abc\n" +
+		"#EXTINF:5.200000,\nsegment/seg_00001.m4s?token=abc\n" +
+		"#EXTINF:0.400000,\nsegment/seg_00002.m4s?token=abc\n" +
+		"#EXT-X-ENDLIST\n"
+	if got != want {
+		t.Fatalf("manifest:\n%s\nwant:\n%s", got, want)
+	}
+}
+
+func TestPlannedSessionServesPlanForEveryManifest(t *testing.T) {
+	plan := &copySegmentPlan{durations: []float64{2, 2, 1}}
+	s := &TranscodeSession{opts: plannedOpts(), copyPlan: plan}
+	want := plan.manifest(s.opts, "", "")
+	for name, build := range map[string]func(string, string) ([]byte, error){
+		"playback":       s.BuildPlaybackManifest,
+		"source aligned": s.BuildSourceAlignedPlaybackManifest,
+	} {
+		got, err := build("", "")
+		if err != nil || !bytes.Equal(got, want) {
+			t.Fatalf("%s manifest = %q, %v; want the plan", name, got, err)
+		}
+	}
+}
+
+func TestPlannedSegmentRecoveryDecision(t *testing.T) {
+	s := &TranscodeSession{opts: plannedOpts(), copyPlan: &copySegmentPlan{durations: []float64{2}}, lastRequestedSegment: 3}
+	decide := func(segNum int, progress SegmentProgress) SegmentRecoveryDecision {
+		return s.plannedSegmentRecoveryDecision(segNum, SegmentRecoveryDecision{RestartOnTimeout: true, Progress: progress})
+	}
+
+	// A segment FFmpeg hasn't reached is waited for, never seek-restarted,
+	// and becomes the throttler's target.
+	ahead := decide(400, SegmentProgress{Running: true, ProducedHead: 20})
+	if !ahead.Wait || ahead.RestartOnTimeout || ahead.WaitTimeout != plannedSegmentWait {
+		t.Fatalf("segment ahead: %+v, want a %s wait without restart", ahead, plannedSegmentWait)
+	}
+	if got := s.LastRequestedSegment(); got != 400 {
+		t.Fatalf("last requested segment = %d, want 400", got)
+	}
+
+	for name, progress := range map[string]SegmentProgress{
+		"pruned behind the head": {Running: true, ProducedHead: 500},
+		"FFmpeg stopped":         {Running: false, ProducedHead: 20},
+	} {
+		got := decide(10, progress)
+		if got.Wait || !got.RestartOnTimeout {
+			t.Fatalf("%s: %+v, want a restart", name, got)
+		}
+	}
+
+	restarting := decide(10, SegmentProgress{Restarting: true})
+	if !restarting.Wait || restarting.RestartOnTimeout {
+		t.Fatalf("restarting: %+v, want a wait", restarting)
+	}
+}
+
+func TestPlannedSegmentRecoveryTargetRestartsFromTheBeginning(t *testing.T) {
+	s := &TranscodeSession{opts: plannedOpts(), copyPlan: &copySegmentPlan{durations: []float64{2}}}
+	target, ok, err := s.ResolveSegmentRecoveryTarget(context.Background(), 40)
+	if err != nil || !ok {
+		t.Fatalf("ResolveSegmentRecoveryTarget = %v, %v", ok, err)
+	}
+	if target.SeekSeconds != 0 || target.StreamOriginSeconds != 0 || !target.CopySeekAnchorResolved {
+		t.Fatalf("target = %+v, want the beginning", target)
+	}
+}
+
+// A planned session's FFmpeg must write exactly the segments its playlist
+// lists, from the start and after a restart.
+func TestPlannedCopySessionMatchesFFmpeg(t *testing.T) {
+	if testing.Short() {
+		t.Skip("real FFmpeg integration test")
+	}
+	ffmpeg, err := exec.LookPath("ffmpeg")
+	if err != nil {
+		t.Skip("ffmpeg is not installed")
+	}
+	ctx, cancel := context.WithTimeout(t.Context(), 2*time.Minute)
+	defer cancel()
+
+	dir := t.TempDir()
+	source := filepath.Join(dir, "irregular.mkv")
+	// A second audio track the session doesn't select runs 20s past the
+	// video, so the container's duration does too.
+	out, err := exec.CommandContext(ctx, ffmpeg, "-v", "error",
+		"-f", "lavfi", "-i", "testsrc2=size=96x54:rate=25:duration=40",
+		"-f", "lavfi", "-i", "sine=frequency=440:sample_rate=48000:duration=40",
+		"-f", "lavfi", "-i", "sine=frequency=660:sample_rate=48000:duration=60",
+		"-map", "0", "-map", "1", "-map", "2",
+		"-c:v", "libx264", "-preset", "ultrafast", "-g", "1000", "-bf", "2",
+		"-sc_threshold", "0", "-force_key_frames", "0,0.9,2.2,2.6,5.2,7.2,7.6,8.9,12.6,13,15,17.6,18.5,25,26.1,31,33.3,38",
+		"-c:a", "aac", source).CombinedOutput()
+	if err != nil {
+		t.Skipf("ffmpeg can't make the test file (%v): %s", err, out)
+	}
+
+	// Planned sessions use a fully checked index; check it now rather than
+	// in the background.
+	if _, err := keyframes.LoadVerified(t.Context(), source); err != nil {
+		t.Fatal(err)
+	}
+	opts := TranscodeOpts{
+		InputPath:        source,
+		OutputDir:        filepath.Join(dir, "out"),
+		SessionID:        "planned-integration",
+		SourceVideoCodec: "h264",
+		TargetCodecVideo: "copy",
+		TargetCodecAudio: "copy",
+		SegmentDuration:  2,
+		TotalDuration:    60,
+		KeyframePlaylist: true,
+		FFmpegPath:       ffmpeg,
+		HWAccel:          HWAccelNone,
+	}
+	s, err := StartTranscode(ctx, opts)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = s.Close() })
+	if s.copyPlan == nil {
+		t.Fatal("no plan for a Matroska source with Cues")
+	}
+	manifest, err := s.BuildPlaybackManifest("", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	planned := extinfDurations(t, manifest)
+
+	checkWritten := func(label string) {
+		t.Helper()
+		select {
+		case <-s.Done():
+		case <-ctx.Done():
+			t.Fatalf("%s: FFmpeg didn't finish", label)
+		}
+		written, err := os.ReadFile(filepath.Join(opts.OutputDir, "stream.m3u8"))
+		if err != nil {
+			t.Fatal(err)
+		}
+		got := extinfDurations(t, written)
+		if len(got) != len(planned) {
+			t.Fatalf("%s: FFmpeg wrote %d segments %v, playlist lists %d %v", label, len(got), got, len(planned), planned)
+		}
+		for i := range got {
+			tolerance := 0.002
+			if i == len(got)-1 {
+				// FFmpeg measures the last segment to a late packet,
+				// within a frame of the video's end.
+				tolerance = 0.041
+			}
+			if math.Abs(got[i]-planned[i]) > tolerance {
+				t.Fatalf("%s: segment %d is %.3fs, playlist says %.3fs", label, i, got[i], planned[i])
+			}
+		}
+		// Per-segment tolerances could hide drift that adds up.
+		var wrote, listed float64
+		for i := range got {
+			wrote += got[i]
+			listed += planned[i]
+		}
+		if math.Abs(wrote-listed) > 0.041 {
+			t.Fatalf("%s: FFmpeg wrote %.3fs in all, the playlist lists %.3fs", label, wrote, listed)
+		}
+	}
+	checkWritten("from the start")
+
+	if _, ok, err := s.RestartSegment(ctx, 9); err != nil || !ok {
+		t.Fatalf("RestartSegment = %v, %v", ok, err)
+	}
+	if o := s.Opts(); o.SeekSeconds != 0 || o.StartSegmentNumber != 0 {
+		t.Fatalf("restart seek %.3f at segment %d, want the beginning", o.SeekSeconds, o.StartSegmentNumber)
+	}
+	if got := s.LastRequestedSegment(); got != 9 {
+		t.Fatalf("last requested segment after restart = %d, want 9", got)
+	}
+	checkWritten("after a restart")
+}
+
+func extinfDurations(t *testing.T, playlist []byte) []float64 {
+	t.Helper()
+	var durations []float64
+	scanner := bufio.NewScanner(bytes.NewReader(playlist))
+	for scanner.Scan() {
+		if v, ok := strings.CutPrefix(scanner.Text(), "#EXTINF:"); ok {
+			d, err := strconv.ParseFloat(strings.TrimSuffix(v, ","), 64)
+			if err != nil {
+				t.Fatal(err)
+			}
+			durations = append(durations, d)
+		}
+	}
+	return durations
+}
diff --git a/internal/playback/copy_manifest_origin.go b/internal/playback/copy_manifest_origin.go
index 8e85e2cc33..b37dd9b8bd 100644
--- a/internal/playback/copy_manifest_origin.go
+++ b/internal/playback/copy_manifest_origin.go
@@ -2,12 +2,13 @@ package playback
 
 import (
 	"context"
+	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"math"
 	"os"
 	"os/exec"
-	"path/filepath"
 	"strconv"
 	"strings"
 	"time"
@@ -89,26 +90,58 @@ func (s *TranscodeSession) copyManifestOrigin(opts TranscodeOpts, generation uin
 	return origin, nil
 }
 
+// hlsInitSegmentName is the fMP4 initialization segment FFmpeg's HLS muxer
+// writes beside the media segments.
+const hlsInitSegmentName = "init.mp4"
+
 // fMP4 retains packet timestamps without MPEG-TS wraparound. Callers calibrate
 // the mux offset against the first fragment before mapping onto source time.
-// Feed only the generated init and requested fragment, so a live playlist cannot
-// advance between observation and probing. No source file or remote URI opens.
 func probeCopyFragmentOrigin(ctx context.Context, opts TranscodeOpts, outputDir string, number int) (float64, error) {
-	init, err := os.Open(filepath.Join(outputDir, "init.mp4"))
+	origin, err := probeSegmentVideoPTS(ctx, opts, outputDir, number)
 	if err != nil {
-		return 0, fmt.Errorf("open copy init: %w", err)
+		return 0, err
 	}
-	defer func() { _ = init.Close() }()
-	fragment, err := os.Open(filepath.Join(outputDir, fmt.Sprintf("seg_%05d.m4s", number)))
+	if origin < 0 {
+		return 0, errors.New("copy fragment has no valid source timestamp")
+	}
+	return origin, nil
+}
+
+// probeSegmentVideoPTS reads the presentation time of the first video packet
+// in one produced HLS segment. Feed only the generated init and the requested
+// segment, so a live playlist cannot advance between observation and probing.
+// No source file or remote URI opens. MPEG-TS times are 33-bit and ffprobe may
+// report them signed; callers that compare them must allow for wraparound.
+func probeSegmentVideoPTS(ctx context.Context, opts TranscodeOpts, outputDir string, number int) (float64, error) {
+	root, err := os.OpenRoot(outputDir)
 	if err != nil {
-		return 0, fmt.Errorf("open copy fragment: %w", err)
+		return 0, fmt.Errorf("open segment directory: %w", err)
+	}
+	defer func() { _ = root.Close() }()
+	names := []string{segmentFilename(number, opts)}
+	if videoUsesFMP4(opts) {
+		names = []string{hlsInitSegmentName, names[0]}
+	}
+	inputs := make([]io.Reader, 0, len(names))
+	files := make([]*os.File, 0, len(names))
+	defer func() {
+		for _, file := range files {
+			_ = file.Close()
+		}
+	}()
+	for _, name := range names {
+		file, err := root.Open(name)
+		if err != nil {
+			return 0, fmt.Errorf("open segment: %w", err)
+		}
+		files = append(files, file)
+		inputs = append(inputs, file)
 	}
-	defer func() { _ = fragment.Close() }()
 	cmd := exec.CommandContext(ctx, ffprobePathFromFFmpeg(ResolveFFmpegPath(opts.FFmpegPath)),
 		"-v", "error", "-probesize", "5000000", "-analyzeduration", "3000000",
 		"-select_streams", "v:0", "-read_intervals", "%+#1", "-show_entries", "packet=pts_time",
-		"-of", "csv=p=0", "-i", "pipe:0")
-	cmd.Stdin = io.MultiReader(init, fragment)
+		"-of", "json", "-i", "pipe:0")
+	cmd.Stdin = io.MultiReader(inputs...)
 	stdout, err := cmd.StdoutPipe()
 	if err != nil {
 		return 0, err
@@ -125,15 +158,25 @@ func probeCopyFragmentOrigin(ctx context.Context, opts TranscodeOpts, outputDir
 		return 0, readErr
 	}
 	if len(data) > 4096 {
-		return 0, fmt.Errorf("copy fragment timestamp output exceeds limit")
+		return 0, errors.New("segment timestamp output exceeds limit")
 	}
 	if waitErr != nil {
-		return 0, fmt.Errorf("probe copy fragment timestamp: %w", waitErr)
+		return 0, fmt.Errorf("probe segment timestamp: %w", waitErr)
 	}
-	value := strings.TrimSpace(string(data))
-	origin, err := strconv.ParseFloat(value, 64)
-	if err != nil || math.IsNaN(origin) || math.IsInf(origin, 0) || origin < 0 {
-		return 0, fmt.Errorf("copy fragment has no valid source timestamp")
+	var report struct {
+		Packets []struct {
+			PTS string `json:"pts_time"`
+		} `json:"packets"`
 	}
-	return origin, nil
+	if err := json.Unmarshal(data, &report); err != nil {
+		return 0, fmt.Errorf("parse segment timestamp: %w", err)
+	}
+	if len(report.Packets) == 0 {
+		return 0, errors.New("segment has no video timestamp")
+	}
+	pts, err := strconv.ParseFloat(strings.TrimSpace(report.Packets[0].PTS), 64)
+	if err != nil || math.IsNaN(pts) || math.IsInf(pts, 0) {
+		return 0, errors.New("segment has no valid video timestamp")
+	}
+	return pts, nil
 }
diff --git a/internal/playback/executable_recipe_v3.go b/internal/playback/executable_recipe_v3.go
index 9c3f093368..8f4678a0c8 100644
--- a/internal/playback/executable_recipe_v3.go
+++ b/internal/playback/executable_recipe_v3.go
@@ -52,12 +52,17 @@ type ExecutableRecipeV3 struct {
 	ExternalSubtitlePath string `json:"external_subtitle_path,omitempty"`
 	EmbeddedStreamIndex  int    `json:"embedded_stream_index,omitempty"`
 	DownloadedSubtitleID int    `json:"downloaded_subtitle_id,omitempty"`
+	// SubtitleRendition emits the selected subtitle as the transcode's HLS
+	// subtitle rendition. It needs version 4 so a binary that predates it
+	// rejects the recipe instead of reopening the transport without one.
+	SubtitleRendition bool `json:"subtitle_rendition,omitempty"`
 }
 
 const (
-	executableRecipeVersionLegacyV3      = 1
-	executableRecipeVersionV3            = 2
-	executableRecipeVersionSourceAudioV3 = 3
+	executableRecipeVersionLegacyV3            = 1
+	executableRecipeVersionV3                  = 2
+	executableRecipeVersionSourceAudioV3       = 3
+	executableRecipeVersionSubtitleRenditionV3 = 4
 )
 
 // FreezeExecutableRecipeV3 captures the byte-affecting facts from a planner result.
@@ -103,6 +108,7 @@ func FreezeExecutableRecipeV3(result PlannerResultV3) ExecutableRecipeV3 {
 		SubtitleBurnIn:                result.SubtitleBurnIn,
 		SubtitleCodec:                 result.SubtitleCodec,
 		DownloadedSubtitleID:          result.DownloadedSubtitleID,
+		SubtitleRendition:             result.SubtitleRendition,
 	}
 	if recipe.hasVersion2Fields() {
 		recipe.Version = executableRecipeVersionV3
@@ -110,6 +116,9 @@ func FreezeExecutableRecipeV3(result PlannerResultV3) ExecutableRecipeV3 {
 	if recipe.hasVersion3Fields() {
 		recipe.Version = executableRecipeVersionSourceAudioV3
 	}
+	if recipe.hasVersion4Fields() {
+		recipe.Version = executableRecipeVersionSubtitleRenditionV3
+	}
 	return recipe
 }
 
@@ -130,13 +139,21 @@ func (r ExecutableRecipeV3) hasVersion3Fields() bool {
 	return r.SourceAudioChannels != 0
 }
 
+func (r ExecutableRecipeV3) hasVersion4Fields() bool {
+	return r.SubtitleRendition
+}
+
 // Valid reports whether an executable recipe is complete and internally consistent.
 func (r ExecutableRecipeV3) Valid() bool {
-	if (r.Version != executableRecipeVersionLegacyV3 && r.Version != executableRecipeVersionV3 && r.Version != executableRecipeVersionSourceAudioV3) || r.PlanID == "" || r.SourceAudioChannels < 0 {
+	if r.Version < executableRecipeVersionLegacyV3 || r.Version > executableRecipeVersionSubtitleRenditionV3 || r.PlanID == "" || r.SourceAudioChannels < 0 {
 		return false
 	}
 	if (r.Version == executableRecipeVersionLegacyV3 && r.hasVersion2Fields()) ||
-		(r.Version < executableRecipeVersionSourceAudioV3 && r.hasVersion3Fields()) {
+		(r.Version < executableRecipeVersionSourceAudioV3 && r.hasVersion3Fields()) ||
+		(r.Version < executableRecipeVersionSubtitleRenditionV3 && r.hasVersion4Fields()) {
+		return false
+	}
+	if r.SubtitleRendition && (r.PlayMethod != PlayTranscode || r.SubtitleBurnIn || r.SubtitleTransportTrackIndex < 0) {
 		return false
 	}
 	hasToneMapField := r.ToneMapPolicy != "" || r.ToneMapMode != "" || r.ToneMapSourceKind != "" || r.ToneMapRecipeVersion != "" || r.ToneMapPreflightRequired || !r.ToneMapSourceRevision.IsZero()
@@ -194,6 +211,7 @@ func (r ExecutableRecipeV3) PlannerResult(plan *PlanV3) PlannerResultV3 {
 		SubtitleTransportTrackIndex: r.SubtitleTransportTrackIndex,
 		SubtitleBurnIn:              r.SubtitleBurnIn,
 		SubtitleCodec:               r.SubtitleCodec,
+		SubtitleRendition:           r.SubtitleRendition,
 		DownloadedSubtitleID:        r.DownloadedSubtitleID,
 	}
 }
diff --git a/internal/playback/hevc_transcode_v3_test.go b/internal/playback/hevc_transcode_v3_test.go
index f38678ebc6..4e3f3949d3 100644
--- a/internal/playback/hevc_transcode_v3_test.go
+++ b/internal/playback/hevc_transcode_v3_test.go
@@ -61,8 +61,7 @@ func TestPlanPlaybackV3HEVCOutputKeepsTheSourceBitrateBound(t *testing.T) {
 		input.RequestedFile, input.EffectiveFile = &file, &file
 		input.Settings.Allow4KTranscode = true
 		input.Request.QualityPreference = "auto"
-		estimate := 10_000
-		input.Request.BandwidthEstimateKbps = &estimate
+		input.Request.Capabilities.MaxResolution = "1080p"
 		return input
 	}
 	check := func(name string, result PlannerResultV3, wantCodec string, wantBitrate int) {
@@ -153,8 +152,8 @@ func TestPlanPlaybackV3H264TargetStaysWithinTheDecoderBitrate(t *testing.T) {
 		input.Request.Capabilities.VideoDecode = append(input.Request.Capabilities.VideoDecode,
 			VideoDecodeCapabilityV3{Codec: "h264", Profiles: []string{"High"}, BitDepths: []int{8}, MaxWidth: 1920, MaxHeight: 1080, MaxFrameRate: 60, MaxBitrateKbps: 5_000, Hardware: true})
 		input.Request.QualityPreference = "auto"
-		estimate := 7_000
-		input.Request.BandwidthEstimateKbps = &estimate
+		capKbps := 7_000
+		input.Request.BandwidthCapKbps = &capKbps
 		result := PlanPlaybackV3(input)
 		if result.Plan == nil || result.TargetVideoCodec != tc.wantCodec || result.TargetBitrateKbps != tc.wantBitrate {
 			t.Fatalf("HEVC %v: %s codec %q bitrate %d, want %s at %d", tc.allowHEVC, ExplainPlannerResultV3(result), result.TargetVideoCodec, result.TargetBitrateKbps, tc.wantCodec, tc.wantBitrate)
@@ -177,8 +176,8 @@ func TestPlanPlaybackV3H264TargetStepsDownToTheDecoderSize(t *testing.T) {
 		input.Request.Capabilities.VideoDecode = append(input.Request.Capabilities.VideoDecode,
 			VideoDecodeCapabilityV3{Codec: "h264", Profiles: []string{"High"}, BitDepths: []int{8}, MaxWidth: decoderWidth, MaxHeight: decoderHeight, MaxFrameRate: 60, Hardware: true})
 		input.Request.QualityPreference = "auto"
-		estimate := 7_000
-		input.Request.BandwidthEstimateKbps = &estimate
+		capKbps := 7_000
+		input.Request.BandwidthCapKbps = &capKbps
 		return input
 	}
 	check := func(name string, result PlannerResultV3, codec, res string, width, bitrate int) {
@@ -200,7 +199,7 @@ func TestPlanPlaybackV3H264TargetStepsDownToTheDecoderSize(t *testing.T) {
 	check("a 1280x962 decoder", PlanPlaybackV3(input(false)), "h264", "720p", 1280, 2_000)
 
 	// A same-size codec conversion is fitted too: a 5 Mbps 1080p HEVC source
-	// fits the estimate, but an H.264-only client with a 720p decoder needs
+	// fits the cap, but an H.264-only client with a 720p decoder needs
 	// an H.264 encode it can take.
 	decoderWidth, decoderHeight = 1280, 720
 	conversion := input(false)
@@ -221,8 +220,8 @@ func TestPlanPlaybackV3H264TargetStepsDownToTheDecoderSize(t *testing.T) {
 		{Codec: "h264", Profiles: []string{"High"}, BitDepths: []int{8}, MaxWidth: 1920, MaxHeight: 1080, MaxFrameRate: 30, Hardware: true},
 		{Codec: "h264", Profiles: []string{"High"}, BitDepths: []int{8}, MaxWidth: 1280, MaxHeight: 720, MaxFrameRate: 60, Hardware: true},
 	}
-	estimate := 9_000
-	fast.Request.BandwidthEstimateKbps = &estimate
+	capKbps := 9_000
+	fast.Request.BandwidthCapKbps = &capKbps
 	check("a 60 fps source", PlanPlaybackV3(fast), "h264", "720p", 1280, 2_000)
 
 	// The decoder is checked against the even frame the encoder writes: a
@@ -248,13 +247,17 @@ func TestPlanPlaybackV3H264TargetStepsDownToTheDecoderSize(t *testing.T) {
 		{Codec: "h264", Profiles: []string{"High"}, BitDepths: []int{8}, MaxWidth: 3840, MaxHeight: 2160, MaxFrameRate: 60, MaxBitrateKbps: 1_000, Hardware: true},
 		{Codec: "h264", Profiles: []string{"High"}, BitDepths: []int{8}, MaxWidth: 1920, MaxHeight: 1080, MaxFrameRate: 60, MaxBitrateKbps: 20_000, Hardware: true},
 	}
-	check("a slow 4K decoder beside a fast 1080p one", PlanPlaybackV3(slow), "h264", "1080p", 1920, 5_600)
+	check("a slow 4K decoder beside a fast 1080p one", PlanPlaybackV3(slow), "h264", "1080p", 1920, 6_000)
 
 	// Hardware decoders win only when one takes the source's frame rate; an
 	// opted-in software decoder that does is used instead.
+	// The source sits over the cap, so it is re-encoded at a size the cap's
+	// budget earns for 60 fps.
 	software := input(false)
-	software.RequestedFile, software.EffectiveFile = &fastFile, &fastFile
-	software.Request.BandwidthEstimateKbps = &estimate
+	softwareFile := fastFile
+	softwareFile.VideoTracks = []models.VideoTrack{{Codec: "h264", Profile: "High", Width: 1920, Height: 1080, FrameRate: "60/1", Bitrate: 12_000, BitDepth: 8, VideoRange: "SDR"}}
+	software.RequestedFile, software.EffectiveFile = &softwareFile, &softwareFile
+	software.Request.BandwidthCapKbps = &capKbps
 	software.Request.ClientFeatures = append(software.Request.ClientFeatures, FeatureSoftwareVideoDecodeV3)
 	software.Request.Capabilities.VideoDecode = []VideoDecodeCapabilityV3{
 		{Codec: "h264", Profiles: []string{"High"}, BitDepths: []int{8}, MaxWidth: 1920, MaxHeight: 1080, MaxFrameRate: 30, Hardware: true},
@@ -282,8 +285,8 @@ func TestPlanPlaybackV3H264TargetStepsDownToTheDecoderSize(t *testing.T) {
 	wide.Request.Capabilities.VideoDecode = []VideoDecodeCapabilityV3{
 		{Codec: "h264", Profiles: []string{"High"}, BitDepths: []int{8}, MaxWidth: 3840, MaxHeight: 2160, MaxFrameRate: 60, MaxBitrateKbps: 15_000, Hardware: true},
 	}
-	wideEstimate := 10_000
-	wide.Request.BandwidthEstimateKbps = &wideEstimate
+	wideCap := 10_000
+	wide.Request.BandwidthCapKbps = &wideCap
 	check("a 2560x1080 conversion under a 15 Mbps decoder", PlanPlaybackV3(wide), "h264", "1080p", 2560, 5_000)
 }
 
diff --git a/internal/playback/keyframes/cache.go b/internal/playback/keyframes/cache.go
new file mode 100644
index 0000000000..76b80706d4
--- /dev/null
+++ b/internal/playback/keyframes/cache.go
@@ -0,0 +1,237 @@
+package keyframes
+
+import (
+	"container/list"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"io/fs"
+	"log/slog"
+	"os"
+	"sync"
+	"time"
+)
+
+// ErrUnverified means the file's index passed the quick check and is being
+// checked against every cluster in the background; until that finishes it
+// isn't used. It is reported as ErrNoIndex.
+var ErrUnverified = fmt.Errorf("%w: keyframe index not verified yet", ErrNoIndex)
+
+const (
+	// maxCachedFiles bounds the process-wide result cache. An index is a few
+	// kilobytes to a few hundred, one float per keyframe.
+	maxCachedFiles = 256
+	// maxQueuedChecks bounds the full checks waiting or running. A file that
+	// finds the queue full is checked on a later playback.
+	maxQueuedChecks = 16
+)
+
+type cacheKey struct {
+	path    string
+	size    int64
+	modTime time.Time
+}
+
+type cacheEntry struct {
+	key   cacheKey
+	index Index
+	err   error
+}
+
+// indexCache holds checked results, including files without a usable index,
+// so a later playback or a second viewer doesn't read the file again. An
+// entry is keyed by the file's size and modification time, so a replaced file
+// is read afresh. Checks in progress are tracked apart from the results, so
+// evicting results never loses track of one.
+var indexCache = struct {
+	sync.Mutex
+	order    *list.List
+	entries  map[cacheKey]*list.Element
+	inFlight map[cacheKey]struct{}
+}{order: list.New(), entries: map[cacheKey]*list.Element{}, inFlight: map[cacheKey]struct{}{}}
+
+// verifySlots runs one full check at a time: each reads every block header
+// of a file.
+var verifySlots = make(chan struct{}, 1)
+
+// Load returns the keyframe index of the media file at path once it has been
+// checked against every cluster. The first call for a file runs the quick
+// check and, if it passes, queues the full check in the background and
+// returns ErrUnverified; calls after it finishes get the result from the
+// cache. A file without a usable index, including any that isn't Matroska or
+// WebM or is malformed, gets ErrNoIndex.
+func Load(path string) (Index, error) {
+	return load(context.Background(), path, false)
+}
+
+// LoadVerified is Load that runs the full check itself instead of in the
+// background. The check stops when ctx is done, and a stopped check isn't
+// cached.
+func LoadVerified(ctx context.Context, path string) (Index, error) {
+	return load(ctx, path, true)
+}
+
+func load(ctx context.Context, path string, wait bool) (Index, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return Index{}, err
+	}
+	defer func() { _ = f.Close() }()
+	info, err := f.Stat()
+	if err != nil {
+		return Index{}, err
+	}
+	key := cacheKey{path: path, size: info.Size(), modTime: info.ModTime()}
+
+	if idx, err, ok := cached(key); ok && (!wait || !errors.Is(err, ErrUnverified)) {
+		return idx, err
+	}
+
+	if wait {
+		idx, err := VerifyMatroska(contextReaderAt{ctx: ctx, r: f}, info.Size())
+		if err != nil && transient(err) {
+			return Index{}, err
+		}
+		idx, err = settle(idx, err)
+		store(key, idx, err)
+		return idx, err
+	}
+
+	if idx, err := ReadMatroska(f, info.Size()); err != nil {
+		if transient(err) {
+			return Index{}, err
+		}
+		idx, err = settle(idx, err)
+		store(key, idx, err)
+		return idx, err
+	}
+	if startCheck(key) {
+		go verifyInBackground(key)
+		return Index{}, ErrUnverified
+	}
+	// Not queued: a check may have finished since the lookup above, so
+	// return its result rather than ErrUnverified.
+	if idx, err, ok := cached(key); ok {
+		return idx, err
+	}
+	return Index{}, ErrUnverified
+}
+
+// transient reports an error reading the file, which says nothing lasting
+// about it: a later playback tries again. Anything else describes the file.
+func transient(err error) bool {
+	return errors.As(err, new(*fs.PathError)) || errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded)
+}
+
+// contextReaderAt stops a full check once its caller has gone: every read
+// fails with the context's error.
+type contextReaderAt struct {
+	ctx context.Context
+	r   io.ReaderAt
+}
+
+func (c contextReaderAt) ReadAt(p []byte, off int64) (int, error) {
+	if err := c.ctx.Err(); err != nil {
+		return 0, err
+	}
+	return c.r.ReadAt(p, off)
+}
+
+// settle turns a lasting failure into ErrNoIndex: the file isn't Matroska, is
+// malformed, or has no complete index.
+func settle(idx Index, err error) (Index, error) {
+	if err == nil || errors.Is(err, ErrNoIndex) {
+		return idx, err
+	}
+	return Index{}, fmt.Errorf("%w: %w", ErrNoIndex, err)
+}
+
+// startCheck records a full check for key, unless one is already queued or
+// the queue is full.
+func startCheck(key cacheKey) bool {
+	indexCache.Lock()
+	defer indexCache.Unlock()
+	if _, ok := indexCache.inFlight[key]; ok || len(indexCache.inFlight) >= maxQueuedChecks {
+		return false
+	}
+	if _, ok := indexCache.entries[key]; ok {
+		return false // a check finished meanwhile
+	}
+	indexCache.inFlight[key] = struct{}{}
+	return true
+}
+
+func verifyInBackground(key cacheKey) {
+	verifySlots <- struct{}{}
+	defer func() { <-verifySlots }()
+
+	idx, err := func() (Index, error) {
+		f, err := os.Open(key.path)
+		if err != nil {
+			return Index{}, err
+		}
+		defer func() { _ = f.Close() }()
+		info, err := f.Stat()
+		if err != nil {
+			return Index{}, err
+		}
+		if info.Size() != key.size || !info.ModTime().Equal(key.modTime) {
+			return Index{}, &fs.PathError{Op: "verify", Path: key.path, Err: errors.New("file changed during the check")}
+		}
+		return VerifyMatroska(f, info.Size())
+	}()
+
+	if err != nil && transient(err) {
+		slog.Warn("keyframe index: check file", "component", "playback", "path", key.path, "error", err)
+		indexCache.Lock()
+		delete(indexCache.inFlight, key) // a later playback tries again
+		indexCache.Unlock()
+		return
+	}
+	idx, err = settle(idx, err)
+	// Publish the result and end the check together, so no Load sees
+	// neither and queues the file again.
+	indexCache.Lock()
+	storeLocked(key, idx, err)
+	delete(indexCache.inFlight, key)
+	indexCache.Unlock()
+}
+
+func cached(key cacheKey) (Index, error, bool) {
+	indexCache.Lock()
+	defer indexCache.Unlock()
+	if _, ok := indexCache.inFlight[key]; ok {
+		return Index{}, ErrUnverified, true
+	}
+	el, ok := indexCache.entries[key]
+	if !ok {
+		return Index{}, nil, false
+	}
+	indexCache.order.MoveToFront(el)
+	entry, _ := el.Value.(*cacheEntry)
+	return entry.index, entry.err, true
+}
+
+func store(key cacheKey, idx Index, err error) {
+	indexCache.Lock()
+	defer indexCache.Unlock()
+	storeLocked(key, idx, err)
+}
+
+func storeLocked(key cacheKey, idx Index, err error) {
+	if el, ok := indexCache.entries[key]; ok {
+		entry, _ := el.Value.(*cacheEntry)
+		entry.index, entry.err = idx, err
+		indexCache.order.MoveToFront(el)
+		return
+	}
+	indexCache.entries[key] = indexCache.order.PushFront(&cacheEntry{key: key, index: idx, err: err})
+	for indexCache.order.Len() > maxCachedFiles {
+		oldest := indexCache.order.Back()
+		indexCache.order.Remove(oldest)
+		if entry, ok := oldest.Value.(*cacheEntry); ok {
+			delete(indexCache.entries, entry.key)
+		}
+	}
+}
diff --git a/internal/playback/keyframes/cache_test.go b/internal/playback/keyframes/cache_test.go
new file mode 100644
index 0000000000..aee0d61611
--- /dev/null
+++ b/internal/playback/keyframes/cache_test.go
@@ -0,0 +1,133 @@
+package keyframes
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"slices"
+	"testing"
+	"time"
+)
+
+func TestLoadCachesUntilTheFileChanges(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "a.mkv")
+	contents := file(layout{})
+	if err := os.WriteFile(path, contents, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	stamp := time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC)
+	if err := os.Chtimes(path, stamp, stamp); err != nil {
+		t.Fatal(err)
+	}
+	got, err := LoadVerified(t.Context(), path)
+	wantIndex(t, got, err)
+
+	// Same size and time with different bytes: still the cached index.
+	damaged := slices.Clone(contents)
+	for i := range damaged[:8] {
+		damaged[i] = 0
+	}
+	if err := os.WriteFile(path, damaged, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chtimes(path, stamp, stamp); err != nil {
+		t.Fatal(err)
+	}
+	got, err = Load(path)
+	wantIndex(t, got, err)
+
+	// A new modification time reads the file again.
+	later := stamp.Add(time.Hour)
+	if err := os.Chtimes(path, later, later); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Load(path); !errors.Is(err, ErrNoIndex) {
+		t.Fatalf("err = %v, want ErrNoIndex for the changed file", err)
+	}
+}
+
+func TestLoadReportsOtherFilesAsUnindexed(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "a.mp4")
+	if err := os.WriteFile(path, []byte("\x00\x00\x00\x18ftypisom\x00\x00\x02\x00isomiso2"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Load(path); !errors.Is(err, ErrNoIndex) {
+		t.Fatalf("err = %v, want ErrNoIndex", err)
+	}
+	if _, err := Load(filepath.Join(t.TempDir(), "missing.mkv")); err == nil || errors.Is(err, ErrNoIndex) {
+		t.Fatalf("missing file err = %v, want a read error", err)
+	}
+}
+
+// The first Load starts the full check and doesn't use the index until it
+// passes.
+func TestLoadVerifiesInTheBackground(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "b.mkv")
+	if err := os.WriteFile(path, file(layout{}), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Load(path); !errors.Is(err, ErrUnverified) || !errors.Is(err, ErrNoIndex) {
+		t.Fatalf("first Load err = %v, want ErrUnverified (an ErrNoIndex)", err)
+	}
+	deadline := time.Now().Add(5 * time.Second)
+	for {
+		got, err := Load(path)
+		if !errors.Is(err, ErrUnverified) {
+			wantIndex(t, got, err)
+			return
+		}
+		if time.Now().After(deadline) {
+			t.Fatal("the background check didn't finish")
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+}
+
+// A malformed file is a lasting fact, cached like a missing index, not
+// checked again on every playback.
+func TestLoadCachesMalformedFiles(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "broken.mkv")
+	// Cues pointing at an element that isn't a cluster: with the Cues first,
+	// cluster B ends the file.
+	contents := file(layout{cuesFirst: true})
+	broken := slices.Clone(contents)
+	copy(broken[len(broken)-len(clusterB):], bytes.Repeat([]byte{0xEC}, 8)) // overwrite cluster B's header with Void
+	if err := os.WriteFile(path, broken, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	stamp := time.Date(2026, 2, 1, 0, 0, 0, 0, time.UTC)
+	if err := os.Chtimes(path, stamp, stamp); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := LoadVerified(t.Context(), path); !errors.Is(err, ErrNoIndex) {
+		t.Fatalf("malformed file err = %v, want ErrNoIndex", err)
+	}
+	// Repaired in place with the same size and time: still the cached result.
+	if err := os.WriteFile(path, contents, 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chtimes(path, stamp, stamp); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Load(path); !errors.Is(err, ErrNoIndex) || errors.Is(err, ErrUnverified) {
+		t.Fatalf("second load err = %v, want the cached ErrNoIndex", err)
+	}
+}
+
+// A full check whose caller has gone stops with the caller's error, which
+// isn't cached: the next check reads the file.
+func TestLoadVerifiedStopsWhenCanceled(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "canceled.mkv")
+	if err := os.WriteFile(path, file(layout{}), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	gone, cancel := context.WithCancel(t.Context())
+	cancel()
+	if _, err := LoadVerified(gone, path); !errors.Is(err, context.Canceled) || errors.Is(err, ErrNoIndex) {
+		t.Fatalf("canceled check: err = %v, want context.Canceled and not ErrNoIndex", err)
+	}
+	got, err := LoadVerified(t.Context(), path)
+	wantIndex(t, got, err)
+}
diff --git a/internal/playback/keyframes/coverage.go b/internal/playback/keyframes/coverage.go
new file mode 100644
index 0000000000..2372133899
--- /dev/null
+++ b/internal/playback/keyframes/coverage.go
@@ -0,0 +1,336 @@
+package keyframes
+
+import (
+	"encoding/binary"
+	"fmt"
+	"io"
+	"math"
+	"slices"
+)
+
+// ErrIncompleteIndex means the file's Cues leave out some video keyframes.
+// Matroska recommends a cue for every video keyframe but doesn't require
+// one, and a plan built on a partial list would cut segments where FFmpeg
+// doesn't. It is reported as ErrNoIndex.
+var ErrIncompleteIndex = fmt.Errorf("%w: cues leave out video keyframes", ErrNoIndex)
+
+const (
+	idCueClusterPosition = 0xF1
+	idClusterTimestamp   = 0xE7
+	idSimpleBlock        = 0xA3
+	idBlockGroup         = 0xA0
+	idBlock              = 0xA1
+	idReferenceBlock     = 0xFB
+	idBlockDuration      = 0x9B
+
+	// coverageSamples is how many cued clusters, spread through the file, have
+	// their keyframes checked against the Cues, each with the cluster after
+	// it. Muxers that cue sparsely leave keyframes out of most clusters, or
+	// cue only some clusters, so a few samples catch them while reading only
+	// block headers.
+	coverageSamples = 4
+	// maxClusterChildren bounds the elements read from one cluster.
+	maxClusterChildren = 20_000
+)
+
+// checkCueCoverage reads the video keyframes of a few clusters spread
+// through the segment, and of the cluster after each, and reports
+// ErrIncompleteIndex if any keyframe has no cue. ticks and clusters are the
+// sorted, unique cue times and cluster positions (cuePoints).
+func checkCueCoverage(r io.ReaderAt, segStart, segEnd int64, video uint64, ticks []uint64, clusters []int64) error {
+	if len(clusters) == 0 {
+		// CueClusterPosition is mandatory; without it the Cues can't be
+		// checked, so they aren't trusted.
+		return ErrIncompleteIndex
+	}
+
+	samples := min(coverageSamples, len(clusters))
+	for i := range samples {
+		at := segStart + clusters[i*(len(clusters)-1)/max(samples-1, 1)]
+		// The sampled cluster, then the one after it, which a muxer that
+		// cues only some clusters leaves without any cue.
+		for range 2 {
+			keys, next, err := clusterKeyframes(r, at, segEnd, video, nil)
+			if err != nil {
+				return fmt.Errorf("keyframes: check cluster at %d: %w", at, err)
+			}
+			for _, k := range keys {
+				if _, ok := slices.BinarySearch(ticks, k); !ok {
+					return ErrIncompleteIndex
+				}
+			}
+			if id, _, _, err := readElementHeader(r, next); next >= segEnd || err != nil || id != idCluster {
+				break
+			}
+			at = next
+		}
+	}
+	return nil
+}
+
+// clusterKeyframes returns the timestamps, in ticks, of the video track's
+// keyframes in the cluster at off, and where the next element starts. It
+// reads element headers and the first bytes of each block, never the frames.
+func clusterKeyframes(r io.ReaderAt, off, segEnd int64, video uint64, last *videoEnd) ([]uint64, int64, error) {
+	id, size, headerLen, err := readElementHeader(r, off)
+	if err != nil {
+		return nil, 0, err
+	}
+	if id != idCluster {
+		return nil, 0, fmt.Errorf("cue points at element %#x, not a cluster", id)
+	}
+	end := segEnd
+	if size != unknownSize && off+headerLen+size < end {
+		end = off + headerLen + size
+	}
+
+	var (
+		clusterTicks uint64
+		haveTicks    bool
+		keys         []int64
+		latest       videoEnd // relative to the cluster
+	)
+	at := off + headerLen
+	n := 0
+	for ; at < end && n < maxClusterChildren; n++ {
+		id, size, headerLen, err := readElementHeader(r, at)
+		if err != nil {
+			if isShortRead(err) {
+				break
+			}
+			return nil, 0, err
+		}
+		// An unknown-size cluster ends where the next top-level element
+		// starts.
+		if id == idCluster || id == idCues || size == unknownSize {
+			end = at
+			break
+		}
+		data := at + headerLen
+		switch id {
+		case idClusterTimestamp:
+			b, err := readElementData(r, data, size, 8)
+			if err != nil {
+				return nil, 0, err
+			}
+			clusterTicks, haveTicks = readUint(b), true
+		case idSimpleBlock:
+			track, rel, flags, err := readBlockHeader(r, data, size)
+			if err != nil {
+				return nil, 0, err
+			}
+			if track == video {
+				latest.add(rel, 0)
+				if flags&0x80 != 0 {
+					keys = append(keys, rel)
+				}
+			}
+		case idBlockGroup:
+			track, rel, key, duration, err := readBlockGroup(r, data, size)
+			if err != nil {
+				return nil, 0, err
+			}
+			if track == video {
+				latest.add(rel, duration)
+				if key {
+					keys = append(keys, rel)
+				}
+			}
+		}
+		at = data + size
+	}
+	if n == maxClusterChildren && at < end {
+		// Not every block was read, so the cluster can't vouch for the Cues.
+		return nil, 0, ErrIncompleteIndex
+	}
+	if !haveTicks {
+		return nil, 0, fmt.Errorf("cluster at %d has no timestamp", off)
+	}
+	if last != nil {
+		if latest.n > 0 {
+			last.add(int64(clusterTicks)+latest.last, latest.lastDuration)
+		}
+		if latest.n > 1 {
+			last.add(int64(clusterTicks)+latest.prev, 0)
+		}
+	}
+	ticks := make([]uint64, 0, len(keys))
+	for _, rel := range keys {
+		if t := int64(clusterTicks) + rel; t >= 0 {
+			ticks = append(ticks, uint64(t))
+		}
+	}
+	return ticks, end, nil
+}
+
+// readBlockHeader reads a (Simple)Block's track number, timestamp relative
+// to its cluster, and flags.
+func readBlockHeader(r io.ReaderAt, off, size int64) (track uint64, rel int64, flags byte, err error) {
+	var buf [12]byte
+	n := min(int64(len(buf)), size)
+	if _, err := r.ReadAt(buf[:n], off); err != nil {
+		return 0, 0, 0, err
+	}
+	track, trackLen, ok := readVint(buf[:n], false)
+	if !ok || int64(trackLen+3) > n {
+		return 0, 0, 0, fmt.Errorf("short block header at %d", off)
+	}
+	rel = int64(int16(binary.BigEndian.Uint16(buf[trackLen:])))
+	return track, rel, buf[trackLen+2], nil
+}
+
+// readBlockGroup reads a BlockGroup's block header, whether it is a keyframe
+// (a block without a ReferenceBlock references no other frame), and its
+// BlockDuration in ticks, or 0 when it has none.
+func readBlockGroup(r io.ReaderAt, off, size int64) (track uint64, rel int64, key bool, duration int64, err error) {
+	end := off + size
+	key = true
+	haveBlock := false
+	for at := off; at < end; {
+		id, childSize, headerLen, err := readElementHeader(r, at)
+		if err != nil {
+			return 0, 0, false, 0, err
+		}
+		if childSize == unknownSize {
+			return 0, 0, false, 0, fmt.Errorf("unknown-size element in block group at %d", at)
+		}
+		switch id {
+		case idBlock:
+			track, rel, _, err = readBlockHeader(r, at+headerLen, childSize)
+			if err != nil {
+				return 0, 0, false, 0, err
+			}
+			haveBlock = true
+		case idReferenceBlock:
+			key = false
+		case idBlockDuration:
+			b, err := readElementData(r, at+headerLen, childSize, 8)
+			if err != nil {
+				return 0, 0, false, 0, err
+			}
+			if d := readUint(b); d <= math.MaxInt64 {
+				duration = int64(d)
+			}
+		}
+		at += headerLen + childSize
+	}
+	if !haveBlock {
+		return 0, 0, false, 0, nil
+	}
+	return track, rel, key, duration, nil
+}
+
+// VerifyMatroska reads a Matroska file's index like ReadMatroska and then
+// checks it against every cluster: each video keyframe must have a cue, and
+// each video cue must be a keyframe. Only then does the index list exactly
+// the keyframes FFmpeg cuts at. It reads every block's header, which on a
+// large file can take as long as reading the file, so callers run it once per
+// file in the background (see Load).
+func VerifyMatroska(r io.ReaderAt, size int64) (Index, error) {
+	m, err := readMatroska(r, size)
+	if err != nil {
+		return Index{}, err
+	}
+	end, err := verifyAllClusters(r, m)
+	if err != nil {
+		return Index{}, err
+	}
+	m.VideoEnd = end.seconds(m.timescale, m.frameSeconds)
+	return m.Index, nil
+}
+
+// videoEnd keeps the two latest distinct timestamps of a track's frames, and
+// the latest frame's own duration when its block gives one.
+type videoEnd struct {
+	last, prev   int64
+	lastDuration int64 // in ticks; 0 when the block doesn't say
+	n            int   // how many of last and prev are set
+}
+
+// add records a frame at t ticks; duration is its BlockDuration, or 0.
+func (v *videoEnd) add(t, duration int64) {
+	switch {
+	case v.n > 0 && t == v.last:
+		// Blocks sharing the last timestamp end with the longest.
+		v.lastDuration = max(v.lastDuration, duration)
+		return
+	case v.n > 1 && t == v.prev:
+		return
+	case v.n == 0 || t > v.last:
+		v.prev, v.last, v.lastDuration = v.last, t, duration
+	case v.n == 1 || t > v.prev:
+		v.prev = t
+	default:
+		return
+	}
+	v.n = min(v.n+1, 2)
+}
+
+// seconds returns when the last frame ends: its timestamp plus its block's
+// duration, else the track's default frame duration, else the gap to the
+// frame before. It returns 0 when that can't be worked out.
+func (v videoEnd) seconds(timescale int64, frame float64) float64 {
+	if v.n == 0 {
+		return 0
+	}
+	scale := float64(timescale) / 1e9
+	if v.lastDuration > 0 {
+		frame = float64(v.lastDuration) * scale
+	}
+	if frame <= 0 {
+		if v.n < 2 {
+			return 0
+		}
+		frame = float64(v.last-v.prev) * scale
+	}
+	return float64(v.last)*scale + frame
+}
+
+func verifyAllClusters(r io.ReaderAt, m matroskaIndex) (videoEnd, error) {
+	var end videoEnd
+	// found marks the cues whose keyframe has been seen.
+	found := make([]bool, len(m.ticks))
+	nFound := 0
+	for at := m.segStart; at < m.segEnd; {
+		id, size, headerLen, err := readElementHeader(r, at)
+		if err != nil {
+			if isShortRead(err) {
+				break
+			}
+			return end, err
+		}
+		if id == idCluster {
+			keys, next, err := clusterKeyframes(r, at, m.segEnd, m.video, &end)
+			if err != nil {
+				return end, err
+			}
+			for _, k := range keys {
+				i, ok := slices.BinarySearch(m.ticks, k)
+				if !ok {
+					return end, ErrIncompleteIndex
+				}
+				if !found[i] {
+					found[i] = true
+					nFound++
+				}
+			}
+			if next <= at {
+				return end, ErrIncompleteIndex
+			}
+			at = next
+			continue
+		}
+		if size == unknownSize {
+			// An unknown-size element other than a cluster can't be
+			// skipped, so the rest of the file can't be checked.
+			return end, ErrIncompleteIndex
+		}
+		at += headerLen + size
+	}
+	if nFound != len(m.ticks) {
+		// A cue on a frame that isn't a keyframe would put a planned
+		// boundary where FFmpeg can't cut.
+		return end, ErrIncompleteIndex
+	}
+	return end, nil
+}
diff --git a/internal/playback/keyframes/ffmpeg_test.go b/internal/playback/keyframes/ffmpeg_test.go
new file mode 100644
index 0000000000..38e378c5c1
--- /dev/null
+++ b/internal/playback/keyframes/ffmpeg_test.go
@@ -0,0 +1,269 @@
+package keyframes
+
+import (
+	"bufio"
+	"encoding/json"
+	"math"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+)
+
+// These tests check the reader and planner against FFmpeg itself, on a file
+// with irregular keyframes. They skip when ffmpeg or ffprobe isn't installed.
+
+func requireFFmpeg(t *testing.T) (ffmpeg, ffprobe string) {
+	t.Helper()
+	ffmpeg, err := exec.LookPath("ffmpeg")
+	if err != nil {
+		t.Skip("ffmpeg not installed")
+	}
+	ffprobe, err = exec.LookPath("ffprobe")
+	if err != nil {
+		t.Skip("ffprobe not installed")
+	}
+	return ffmpeg, ffprobe
+}
+
+// irregularKeyframes are the forced keyframe times of the test file, with
+// gaps both shorter and longer than the 2s segment length.
+var irregularKeyframes = []float64{0, 0.9, 2.2, 2.6, 5.2, 7.2, 7.6, 8.9, 12.6, 13.0, 15.0, 17.6, 18.5}
+
+func makeTestMKV(t *testing.T, ffmpeg string) string {
+	t.Helper()
+	times := make([]string, len(irregularKeyframes))
+	for i, k := range irregularKeyframes {
+		times[i] = strconv.FormatFloat(k, 'f', -1, 64)
+	}
+	path := filepath.Join(t.TempDir(), "in.mkv")
+	out, err := exec.Command(ffmpeg, "-hide_banner", "-loglevel", "error", "-y",
+		"-f", "lavfi", "-i", "testsrc2=size=160x90:rate=25",
+		"-f", "lavfi", "-i", "sine=frequency=440:sample_rate=48000",
+		"-t", "20", "-c:v", "libx264", "-preset", "ultrafast",
+		"-g", "1000", "-sc_threshold", "0", "-bf", "0",
+		"-force_key_frames", strings.Join(times, ","),
+		"-c:a", "aac", path).CombinedOutput()
+	if err != nil {
+		t.Skipf("ffmpeg can't make the test file (%v): %s", err, out)
+	}
+	return path
+}
+
+func readIndex(t *testing.T, path string) Index {
+	t.Helper()
+	f, err := os.Open(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = f.Close() }()
+	info, err := f.Stat()
+	if err != nil {
+		t.Fatal(err)
+	}
+	idx, err := ReadMatroska(f, info.Size())
+	if err != nil {
+		t.Fatal(err)
+	}
+	return idx
+}
+
+func TestReadMatroskaMatchesFFprobe(t *testing.T) {
+	ffmpeg, ffprobe := requireFFmpeg(t)
+	path := makeTestMKV(t, ffmpeg)
+
+	out, err := exec.Command(ffprobe, "-v", "error", "-select_streams", "v:0",
+		"-show_entries", "packet=pts_time,flags", "-of", "json", path).Output()
+	if err != nil {
+		t.Fatal(err)
+	}
+	var probe struct {
+		Packets []struct {
+			PTS   string `json:"pts_time"`
+			Flags string `json:"flags"`
+		} `json:"packets"`
+	}
+	if err := json.Unmarshal(out, &probe); err != nil {
+		t.Fatal(err)
+	}
+	var want []float64
+	for _, p := range probe.Packets {
+		if strings.Contains(p.Flags, "K") {
+			v, _ := strconv.ParseFloat(p.PTS, 64)
+			want = append(want, v)
+		}
+	}
+
+	got := readIndex(t, path).Keyframes
+	f, err := os.Open(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = f.Close() }()
+	info, err := f.Stat()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := VerifyMatroska(f, info.Size()); err != nil {
+		t.Fatalf("FFmpeg's Cues failed the full check: %v", err)
+	}
+	if len(got) != len(want) {
+		t.Fatalf("keyframes = %v, ffprobe = %v", got, want)
+	}
+	for i := range want {
+		if math.Abs(got[i]-want[i]) > 0.001 {
+			t.Fatalf("keyframes = %v, ffprobe = %v", got, want)
+		}
+	}
+}
+
+// The plan must match the segments FFmpeg's HLS muxer writes for copied
+// video, or the complete playlist would list durations the segments don't
+// have.
+func TestPlanSegmentsMatchesFFmpegHLS(t *testing.T) {
+	ffmpeg, _ := requireFFmpeg(t)
+	// Regular 2s keyframes on a timeline that starts at 0.28s land exactly
+	// on every target, which float error in the planner must not skip.
+	// A second audio track FFmpeg doesn't select runs 10s past the video, so
+	// the container's duration does too; the plan must still end with the
+	// video.
+	regular := filepath.Join(t.TempDir(), "regular.mkv")
+	if out, err := exec.Command(ffmpeg, "-hide_banner", "-loglevel", "error", "-y",
+		"-f", "lavfi", "-i", "testsrc2=size=160x90:rate=25:duration=10",
+		"-f", "lavfi", "-i", "sine=frequency=440:sample_rate=48000:duration=10",
+		"-f", "lavfi", "-i", "sine=frequency=660:sample_rate=48000:duration=20",
+		"-map", "0", "-map", "1", "-map", "2",
+		"-c:v", "libx264", "-preset", "ultrafast",
+		"-g", "50", "-sc_threshold", "0", "-bf", "0",
+		"-c:a", "aac", "-output_ts_offset", "0.28", regular).CombinedOutput(); err != nil {
+		t.Skipf("ffmpeg can't make the test file (%v): %s", err, out)
+	}
+	for name, path := range map[string]string{"irregular": makeTestMKV(t, ffmpeg), "regular with an offset": regular} {
+		t.Run(name, func(t *testing.T) { checkPlanMatchesFFmpegHLS(t, ffmpeg, path) })
+	}
+}
+
+func checkPlanMatchesFFmpegHLS(t *testing.T, ffmpeg, path string) {
+	dir := t.TempDir()
+	out, err := exec.Command(ffmpeg, "-hide_banner", "-loglevel", "error",
+		"-i", path, "-map", "0:v:0", "-map", "0:a:0",
+		"-copyts", "-avoid_negative_ts", "make_non_negative", "-start_at_zero",
+		"-c:v", "copy", "-c:a", "copy",
+		"-f", "hls", "-hls_time", "2", "-hls_list_size", "0",
+		"-hls_segment_type", "fmp4",
+		"-hls_segment_filename", filepath.Join(dir, "seg_%05d.m4s"),
+		filepath.Join(dir, "stream.m3u8")).CombinedOutput()
+	if err != nil {
+		t.Fatalf("ffmpeg: %v: %s", err, out)
+	}
+	written := playlistDurations(t, filepath.Join(dir, "stream.m3u8"))
+
+	// Plan as a session does: from the verified index, to the video's end.
+	f, err := os.Open(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = f.Close() }()
+	info, err := f.Stat()
+	if err != nil {
+		t.Fatal(err)
+	}
+	idx, err := VerifyMatroska(f, info.Size())
+	if err != nil {
+		t.Fatal(err)
+	}
+	planned := SegmentDurations(PlanSegments(idx.Keyframes, 2), idx.VideoEnd)
+	if len(planned) != len(written) {
+		t.Fatalf("planned %d segments %v, FFmpeg wrote %d %v", len(planned), planned, len(written), written)
+	}
+	var plannedTotal, writtenTotal float64
+	for i := range written {
+		tolerance := 0.002
+		if i == len(written)-1 {
+			// FFmpeg measures the last segment to a late packet, within a
+			// frame of the video's end.
+			tolerance = 0.041
+		}
+		if math.Abs(planned[i]-written[i]) > tolerance {
+			t.Fatalf("segment %d: planned %.3fs, FFmpeg wrote %.3fs (planned %v, written %v)",
+				i, planned[i], written[i], planned, written)
+		}
+		plannedTotal += planned[i]
+		writtenTotal += written[i]
+	}
+	// Per-segment tolerances could hide drift that adds up.
+	if math.Abs(plannedTotal-writtenTotal) > 0.041 {
+		t.Fatalf("planned %.3fs in all, FFmpeg wrote %.3fs", plannedTotal, writtenTotal)
+	}
+}
+
+func playlistDurations(t *testing.T, path string) []float64 {
+	t.Helper()
+	f, err := os.Open(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = f.Close() }()
+	var durations []float64
+	scanner := bufio.NewScanner(f)
+	for scanner.Scan() {
+		line := scanner.Text()
+		if v, ok := strings.CutPrefix(line, "#EXTINF:"); ok {
+			d, err := strconv.ParseFloat(strings.TrimSuffix(v, ","), 64)
+			if err != nil {
+				t.Fatalf("parse %q: %v", line, err)
+			}
+			durations = append(durations, d)
+		}
+	}
+	return durations
+}
+
+// VerifyMatroska's video end is where ffprobe's last video frame ends, and
+// a longer audio track doesn't move it.
+func TestVerifyMatroskaVideoEndMatchesFFprobe(t *testing.T) {
+	ffmpeg, ffprobe := requireFFmpeg(t)
+	path := filepath.Join(t.TempDir(), "longer-audio.mkv")
+	out, err := exec.Command(ffmpeg, "-hide_banner", "-loglevel", "error", "-y",
+		"-f", "lavfi", "-i", "testsrc2=size=160x90:rate=30000/1001:duration=9.5",
+		"-f", "lavfi", "-i", "sine=frequency=440:sample_rate=48000:duration=15",
+		"-c:v", "libx264", "-preset", "ultrafast", "-g", "60", "-bf", "2",
+		"-c:a", "aac", path).CombinedOutput()
+	if err != nil {
+		t.Skipf("ffmpeg can't make the test file (%v): %s", err, out)
+	}
+	out, err = exec.Command(ffprobe, "-v", "error", "-select_streams", "v:0",
+		"-show_entries", "packet=pts_time,duration_time", "-of", "csv=p=0", path).Output()
+	if err != nil {
+		t.Fatal(err)
+	}
+	var want float64
+	for line := range strings.FieldsSeq(string(out)) {
+		pts, duration, _ := strings.Cut(strings.TrimSuffix(line, ","), ",")
+		p, err1 := strconv.ParseFloat(pts, 64)
+		d, err2 := strconv.ParseFloat(duration, 64)
+		if err1 != nil || err2 != nil {
+			t.Fatalf("ffprobe packet %q", line)
+		}
+		want = max(want, p+d)
+	}
+
+	f, err := os.Open(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = f.Close() }()
+	info, err := f.Stat()
+	if err != nil {
+		t.Fatal(err)
+	}
+	idx, err := VerifyMatroska(f, info.Size())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if math.Abs(idx.VideoEnd-want) > 0.001 || idx.Duration < 14 {
+		t.Fatalf("video end %.3fs (container %.3fs), ffprobe's last frame ends at %.3fs", idx.VideoEnd, idx.Duration, want)
+	}
+}
diff --git a/internal/playback/keyframes/matroska.go b/internal/playback/keyframes/matroska.go
new file mode 100644
index 0000000000..6b22233e95
--- /dev/null
+++ b/internal/playback/keyframes/matroska.go
@@ -0,0 +1,564 @@
+// Package keyframes reads a media file's video keyframe times from its
+// container index, without reading the media itself, and plans HLS segment
+// boundaries on them.
+package keyframes
+
+import (
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"io"
+	"math"
+	"slices"
+)
+
+// ErrNoIndex means the file has no usable keyframe index: no Cues, or none
+// for its video track.
+var ErrNoIndex = errors.New("keyframes: no keyframe index")
+
+// notMatroskaError reports a file that isn't Matroska or WebM: a stable fact
+// about the file, unlike a read failure.
+type notMatroskaError struct{}
+
+func (notMatroskaError) Error() string { return "keyframes: not a Matroska file" }
+
+func isShortRead(err error) bool {
+	return errors.Is(err, io.EOF) || errors.Is(err, io.ErrUnexpectedEOF)
+}
+
+// Index is a file's video keyframe times, in seconds on the container's
+// timeline, ascending and without duplicates.
+type Index struct {
+	Keyframes []float64
+	// Duration is the container's duration in seconds, or 0 when unknown.
+	Duration float64
+	// VideoEnd is when the video track's last frame ends, in seconds on the
+	// same timeline as Keyframes, or 0 when unknown. Only VerifyMatroska,
+	// which reads every block, sets it. Other tracks can run longer, so it
+	// can be earlier than Duration.
+	VideoEnd float64
+}
+
+// idTrackTimestampScale is a track's deprecated extra timestamp scale.
+const idTrackTimestampScale = 0x23314F
+
+// Matroska element IDs, from the Matroska specification.
+const (
+	idEBML                  = 0x1A45DFA3
+	idSegment               = 0x18538067
+	idSeekHead              = 0x114D9B74
+	idSeek                  = 0x4DBB
+	idSeekID                = 0x53AB
+	idSeekPosition          = 0x53AC
+	idInfo                  = 0x1549A966
+	idTimestampScale        = 0x2AD7B1
+	idDuration              = 0x4489
+	idTracks                = 0x1654AE6B
+	idTrackEntry            = 0xAE
+	idTrackNumber           = 0xD7
+	idTrackType             = 0x83
+	idDefaultDuration       = 0x23E383
+	idCues                  = 0x1C53BB6B
+	idCuePoint              = 0xBB
+	idCueTime               = 0xB3
+	idCueTrackPos           = 0xB7
+	idCueTrack              = 0xF7
+	idCluster               = 0x1F43B675
+	trackTypeVideo          = 1
+	defaultTimescale        = 1_000_000 // nanoseconds per timestamp tick
+	unknownSize       int64 = -1
+)
+
+// Upper bounds on what the reader loads into memory; anything larger is
+// treated as a damaged file. The metadata elements are small. FFmpeg writes
+// a video cue point in 17 to 24 bytes, so a film with a keyframe every few
+// seconds has Cues well under a megabyte, and 16 MiB holds about 700,000
+// points: every frame of 8 hours at 24 fps, or of 3 hours at 60 fps.
+// Reading Cues costs at most about three times their size (cuePoints), so
+// the limit also bounds what a crafted file can cost.
+const (
+	maxCuesSize     = 16 << 20
+	maxMetadataSize = 16 << 20
+)
+
+// ReadMatroska returns the keyframe index of a Matroska or WebM file from its
+// Cues element. It reads the header, the seek head, segment info, tracks and
+// cues, following the seek head to Cues stored after the clusters. As a quick
+// check it reads the block headers of a few clusters (checkCueCoverage);
+// VerifyMatroska checks them all.
+func ReadMatroska(r io.ReaderAt, size int64) (Index, error) {
+	m, err := readMatroska(r, size)
+	return m.Index, err
+}
+
+// matroskaIndex is an Index with what checking it against the clusters
+// needs (VerifyMatroska).
+type matroskaIndex struct {
+	Index
+	segStart, segEnd int64
+	video            uint64
+	// ticks holds the video cue times, sorted and without duplicates.
+	ticks     []uint64
+	timescale int64
+	// frameSeconds is the video track's default frame duration, or 0.
+	frameSeconds float64
+}
+
+func readMatroska(r io.ReaderAt, size int64) (matroskaIndex, error) {
+	id, dataSize, headerLen, err := readElementHeader(r, 0)
+	if err != nil {
+		if isShortRead(err) {
+			// Empty, or not starting with an EBML element at all.
+			return matroskaIndex{}, notMatroskaError{}
+		}
+		return matroskaIndex{}, fmt.Errorf("keyframes: read EBML header: %w", err)
+	}
+	if id != idEBML {
+		return matroskaIndex{}, notMatroskaError{}
+	}
+	pos := headerLen + dataSize
+
+	id, segSize, headerLen, err := readElementHeader(r, pos)
+	if err != nil {
+		if isShortRead(err) {
+			return matroskaIndex{}, notMatroskaError{}
+		}
+		return matroskaIndex{}, fmt.Errorf("keyframes: read segment: %w", err)
+	}
+	if id != idSegment {
+		return matroskaIndex{}, notMatroskaError{}
+	}
+	segStart := pos + headerLen
+	segEnd := size
+	if segSize != unknownSize && segStart+segSize < segEnd {
+		segEnd = segStart + segSize
+	}
+
+	var (
+		timescale int64 = defaultTimescale
+		duration  float64
+		video     uint64
+		frameNS   uint64
+		cuesAt    int64 = -1
+		infoAt    int64 = -1
+		tracksAt  int64 = -1
+		cues      []byte
+		haveInfo  bool
+		haveTrack bool
+	)
+	for at := segStart; at < segEnd; {
+		id, dataSize, headerLen, err := readElementHeader(r, at)
+		if err != nil {
+			if errors.Is(err, io.EOF) || errors.Is(err, io.ErrUnexpectedEOF) {
+				break
+			}
+			return matroskaIndex{}, fmt.Errorf("keyframes: read element at %d: %w", at, err)
+		}
+		dataAt := at + headerLen
+		switch id {
+		case idSeekHead:
+			data, err := readElementData(r, dataAt, dataSize, maxMetadataSize)
+			if err != nil {
+				return matroskaIndex{}, err
+			}
+			if p, ok := seekPosition(data, idCues); ok {
+				cuesAt = segStart + p
+			}
+			if p, ok := seekPosition(data, idInfo); ok {
+				infoAt = segStart + p
+			}
+			if p, ok := seekPosition(data, idTracks); ok {
+				tracksAt = segStart + p
+			}
+		case idInfo:
+			data, err := readElementData(r, dataAt, dataSize, maxMetadataSize)
+			if err != nil {
+				return matroskaIndex{}, err
+			}
+			var ok bool
+			if timescale, duration, ok = parseInfo(data); !ok {
+				return matroskaIndex{}, ErrNoIndex
+			}
+			haveInfo = true
+		case idTracks:
+			data, err := readElementData(r, dataAt, dataSize, maxMetadataSize)
+			if err != nil {
+				return matroskaIndex{}, err
+			}
+			var scaled bool
+			video, frameNS, scaled, haveTrack = firstVideoTrack(data)
+			if scaled {
+				// The track's timestamps are scaled again, a deprecated
+				// feature the times here don't apply; don't plan from them.
+				return matroskaIndex{}, ErrNoIndex
+			}
+		case idCues:
+			cues, err = readElementData(r, dataAt, dataSize, maxCuesSize)
+			if err != nil {
+				return matroskaIndex{}, err
+			}
+		}
+		if cues != nil && haveInfo && haveTrack {
+			break
+		}
+		// Clusters hold the media. Stop the linear scan at the first one and
+		// jump to the Cues the seek head points at, if they come later.
+		if id == idCluster || dataSize == unknownSize {
+			break
+		}
+		at = dataAt + dataSize
+	}
+
+	if cues == nil && cuesAt >= 0 {
+		id, dataSize, headerLen, err := readElementHeader(r, cuesAt)
+		if err != nil {
+			return matroskaIndex{}, fmt.Errorf("keyframes: read cues at %d: %w", cuesAt, err)
+		}
+		if id != idCues {
+			return matroskaIndex{}, fmt.Errorf("keyframes: seek head points at element %#x, not Cues", id)
+		}
+		cues, err = readElementData(r, cuesAt+headerLen, dataSize, maxCuesSize)
+		if err != nil {
+			return matroskaIndex{}, err
+		}
+	}
+	// Info and Tracks may also come after the clusters, found through the
+	// seek head. Info's timestamp scale converts every cue time, so an index
+	// without it isn't trusted.
+	if !haveInfo && infoAt >= 0 {
+		data, err := readSeekTarget(r, infoAt, idInfo)
+		if err != nil {
+			return matroskaIndex{}, err
+		}
+		var ok bool
+		if timescale, duration, ok = parseInfo(data); !ok {
+			return matroskaIndex{}, ErrNoIndex
+		}
+		haveInfo = true
+	}
+	if !haveTrack && tracksAt >= 0 {
+		data, err := readSeekTarget(r, tracksAt, idTracks)
+		if err != nil {
+			return matroskaIndex{}, err
+		}
+		var scaled bool
+		video, frameNS, scaled, haveTrack = firstVideoTrack(data)
+		if scaled {
+			return matroskaIndex{}, ErrNoIndex
+		}
+	}
+	if cues == nil || !haveTrack || !haveInfo {
+		return matroskaIndex{}, ErrNoIndex
+	}
+
+	ticks, clusters, complete := cuePoints(cues, video)
+	if !complete || len(ticks) == 0 {
+		// A malformed cue point ends the list early; the points read so
+		// far would leave out later keyframes.
+		return matroskaIndex{}, ErrNoIndex
+	}
+	if err := checkCueCoverage(r, segStart, segEnd, video, ticks, clusters); err != nil {
+		return matroskaIndex{}, err
+	}
+	idx := Index{Keyframes: make([]float64, len(ticks))}
+	for i, t := range ticks {
+		idx.Keyframes[i] = float64(t) * float64(timescale) / 1e9
+	}
+	if duration > 0 {
+		idx.Duration = duration * float64(timescale) / 1e9
+	}
+	return matroskaIndex{
+		Index: idx, segStart: segStart, segEnd: segEnd, video: video, ticks: ticks,
+		timescale: timescale, frameSeconds: float64(frameNS) / 1e9,
+	}, nil
+}
+
+// readElementHeader reads an element's ID and data size at off, returning the
+// header's length. A data size of unknownSize means the element runs to the
+// end of its parent.
+func readElementHeader(r io.ReaderAt, off int64) (id uint64, size int64, headerLen int64, err error) {
+	var buf [12]byte
+	n, err := r.ReadAt(buf[:], off)
+	if n == 0 {
+		if err == nil {
+			err = io.EOF
+		}
+		return 0, 0, 0, err
+	}
+	b := buf[:n]
+	id, idLen, ok := readVint(b, true)
+	if !ok {
+		return 0, 0, 0, io.ErrUnexpectedEOF
+	}
+	raw, sizeLen, ok := readVint(b[idLen:], false)
+	if !ok {
+		return 0, 0, 0, io.ErrUnexpectedEOF
+	}
+	size = int64(raw)
+	if raw == (uint64(1)<<(7*sizeLen))-1 {
+		size = unknownSize
+	}
+	return id, size, int64(idLen + sizeLen), nil
+}
+
+func readElementData(r io.ReaderAt, off, size, limit int64) ([]byte, error) {
+	if size == unknownSize || size < 0 || size > limit {
+		return nil, fmt.Errorf("keyframes: element at %d has unsupported size %d", off, size)
+	}
+	data := make([]byte, size)
+	if _, err := r.ReadAt(data, off); err != nil {
+		return nil, fmt.Errorf("keyframes: read element at %d: %w", off, err)
+	}
+	return data, nil
+}
+
+// readVint reads an EBML variable-length integer. IDs keep their length
+// marker bit; sizes drop it.
+func readVint(b []byte, keepMarker bool) (value uint64, length int, ok bool) {
+	if len(b) == 0 || b[0] == 0 {
+		return 0, 0, false
+	}
+	length = 1
+	for mask := byte(0x80); b[0]&mask == 0; mask >>= 1 {
+		length++
+	}
+	if length > 8 || len(b) < length {
+		return 0, 0, false
+	}
+	value = uint64(b[0])
+	if !keepMarker {
+		value &= uint64(0xFF >> length)
+	}
+	for _, c := range b[1:length] {
+		value = value<<8 | uint64(c)
+	}
+	return value, length, true
+}
+
+// readSeekTarget reads the element a seek head points at, which must be want.
+func readSeekTarget(r io.ReaderAt, at int64, want uint64) ([]byte, error) {
+	id, dataSize, headerLen, err := readElementHeader(r, at)
+	if err != nil {
+		return nil, fmt.Errorf("keyframes: read element at %d: %w", at, err)
+	}
+	if id != want {
+		return nil, fmt.Errorf("keyframes: seek head points at element %#x, not %#x", id, want)
+	}
+	return readElementData(r, at+headerLen, dataSize, maxMetadataSize)
+}
+
+// childrenComplete is children, reporting whether every child was well
+// formed: false when malformed data stopped the walk early.
+func childrenComplete(data []byte, fn func(id uint64, payload []byte)) bool {
+	for len(data) > 0 {
+		id, idLen, ok := readVint(data, true)
+		if !ok {
+			return false
+		}
+		raw, sizeLen, ok := readVint(data[idLen:], false)
+		if !ok {
+			return false
+		}
+		start := idLen + sizeLen
+		if raw > uint64(len(data)-start) {
+			return false
+		}
+		end := start + int(raw)
+		fn(id, data[start:end])
+		data = data[end:]
+	}
+	return true
+}
+
+// children calls fn for each child element in a master element's data. It
+// stops at the first malformed child.
+func children(data []byte, fn func(id uint64, payload []byte)) {
+	for len(data) > 0 {
+		id, idLen, ok := readVint(data, true)
+		if !ok {
+			return
+		}
+		raw, sizeLen, ok := readVint(data[idLen:], false)
+		if !ok {
+			return
+		}
+		start := idLen + sizeLen
+		if raw > uint64(len(data)-start) {
+			return
+		}
+		end := start + int(raw)
+		fn(id, data[start:end])
+		data = data[end:]
+	}
+}
+
+func readUint(b []byte) uint64 {
+	var v uint64
+	for _, c := range b {
+		v = v<<8 | uint64(c)
+	}
+	return v
+}
+
+func readFloat(b []byte) float64 {
+	switch len(b) {
+	case 4:
+		return float64(math.Float32frombits(binary.BigEndian.Uint32(b)))
+	case 8:
+		return math.Float64frombits(binary.BigEndian.Uint64(b))
+	}
+	return 0
+}
+
+func seekPosition(seekHead []byte, target uint64) (int64, bool) {
+	var (
+		pos   int64
+		found bool
+	)
+	children(seekHead, func(id uint64, seek []byte) {
+		if id != idSeek || found {
+			return
+		}
+		var seekID uint64
+		var seekPos int64 = -1
+		children(seek, func(id uint64, v []byte) {
+			switch id {
+			case idSeekID:
+				seekID = readUint(v)
+			case idSeekPosition:
+				seekPos = int64(readUint(v))
+			}
+		})
+		if seekID == target && seekPos >= 0 {
+			pos, found = seekPos, true
+		}
+	})
+	return pos, found
+}
+
+// parseInfo reads Info's timestamp scale, defaulting when it is absent, and
+// duration. ok is false for an explicit scale Matroska doesn't allow (zero)
+// or that doesn't fit: cue times scaled by a guess would plan wrong segments.
+func parseInfo(info []byte) (timescale int64, duration float64, ok bool) {
+	timescale, ok = defaultTimescale, true
+	children(info, func(id uint64, v []byte) {
+		switch id {
+		case idTimestampScale:
+			if s := int64(readUint(v)); s > 0 {
+				timescale = s
+			} else {
+				ok = false
+			}
+		case idDuration:
+			duration = readFloat(v)
+		}
+	})
+	return timescale, duration, ok
+}
+
+func firstVideoTrack(tracks []byte) (number, frameNS uint64, scaled, found bool) {
+	children(tracks, func(id uint64, entry []byte) {
+		if id != idTrackEntry || found {
+			return
+		}
+		var n, kind, frame uint64
+		trackScale := 1.0
+		children(entry, func(id uint64, v []byte) {
+			switch id {
+			case idTrackNumber:
+				n = readUint(v)
+			case idTrackType:
+				kind = readUint(v)
+			case idDefaultDuration:
+				frame = readUint(v)
+			case idTrackTimestampScale:
+				trackScale = readFloat(v)
+			}
+		})
+		if kind == trackTypeVideo && n > 0 {
+			number, frameNS, scaled, found = n, frame, trackScale != 1, true
+		}
+	})
+	return number, frameNS, scaled, found
+}
+
+// cuePoints returns the times, in ticks, of the cue points that index the
+// video track, and the positions of the clusters holding them, relative to
+// the segment's data; both are sorted and without duplicates. Matroska
+// muxers index video keyframes, so the times are keyframe times; whether
+// every keyframe has one is checked separately (checkCueCoverage).
+// It reports false when a malformed cue point stopped the walk early.
+//
+// A crafted Cues element can hold over a million points, so it counts them
+// first and allocates each list once, at its final length.
+func cuePoints(cues []byte, video uint64) (ticks []uint64, clusters []int64, ok bool) {
+	var nTicks, nClusters int
+	if !walkCuePoints(cues, video, func(_ uint64, cluster int64) {
+		nTicks++
+		if cluster >= 0 {
+			nClusters++
+		}
+	}) {
+		return nil, nil, false
+	}
+	ticks = make([]uint64, 0, nTicks)
+	clusters = make([]int64, 0, nClusters)
+	walkCuePoints(cues, video, func(t uint64, cluster int64) {
+		ticks = append(ticks, t)
+		if cluster >= 0 {
+			clusters = append(clusters, cluster)
+		}
+	})
+	slices.Sort(ticks)
+	slices.Sort(clusters)
+	return slices.Compact(ticks), slices.Compact(clusters), true
+}
+
+// walkCuePoints calls fn for each cue point that indexes the video track,
+// with the position of the cluster holding it (negative when the cue doesn't
+// say). It reports false when a malformed cue point stopped the walk early.
+func walkCuePoints(cues []byte, video uint64, fn func(ticks uint64, cluster int64)) bool {
+	complete := true
+	complete = childrenComplete(cues, func(id uint64, point []byte) {
+		if id != idCuePoint {
+			return
+		}
+		var (
+			t       uint64
+			hasTime bool
+			isVideo bool
+			cluster int64 = -1
+		)
+		if !childrenComplete(point, func(id uint64, v []byte) {
+			switch id {
+			case idCueTime:
+				t, hasTime = readUint(v), true
+			case idCueTrackPos:
+				var (
+					track uint64
+					pos   int64 = -1
+				)
+				// Malformed data here could hide the video track's entry.
+				if !childrenComplete(v, func(id uint64, v []byte) {
+					switch id {
+					case idCueTrack:
+						track = readUint(v)
+					case idCueClusterPosition:
+						pos = int64(readUint(v))
+					}
+				}) {
+					complete = false
+				}
+				if track == video {
+					isVideo, cluster = true, pos
+				}
+			}
+		}) {
+			complete = false
+		}
+		if hasTime && isVideo {
+			fn(t, cluster)
+		}
+	}) && complete
+	return complete
+}
diff --git a/internal/playback/keyframes/matroska_test.go b/internal/playback/keyframes/matroska_test.go
new file mode 100644
index 0000000000..b3c018a3d0
--- /dev/null
+++ b/internal/playback/keyframes/matroska_test.go
@@ -0,0 +1,525 @@
+package keyframes
+
+import (
+	"bytes"
+	"encoding/binary"
+	"errors"
+	"math"
+	"runtime"
+	"slices"
+	"testing"
+)
+
+// el encodes one EBML element with an 8-byte size, so an element's length
+// never depends on its values and cluster positions can be computed up front.
+func el(id uint64, parts ...[]byte) []byte {
+	data := bytes.Join(parts, nil)
+	var out []byte
+	switch {
+	case id > 0xFFFFFF:
+		out = append(out, byte(id>>24), byte(id>>16), byte(id>>8), byte(id))
+	case id > 0xFFFF:
+		out = append(out, byte(id>>16), byte(id>>8), byte(id))
+	case id > 0xFF:
+		out = append(out, byte(id>>8), byte(id))
+	default:
+		out = append(out, byte(id))
+	}
+	var size [8]byte
+	binary.BigEndian.PutUint64(size[:], uint64(len(data)))
+	size[0] = 0x01
+	return append(append(out, size[:]...), data...)
+}
+
+func uintEl(id, v uint64) []byte {
+	var b [8]byte
+	binary.BigEndian.PutUint64(b[:], v)
+	return el(id, b[:])
+}
+
+func floatEl(id uint64, v float64) []byte {
+	var b [8]byte
+	binary.BigEndian.PutUint64(b[:], math.Float64bits(v))
+	return el(id, b[:])
+}
+
+const (
+	audioTrack = 1
+	videoTrack = 2
+)
+
+// block encodes a SimpleBlock at a timestamp relative to its cluster.
+func block(track uint64, rel int16, key bool) []byte {
+	var flags byte
+	if key {
+		flags = 0x80
+	}
+	var ts [2]byte
+	binary.BigEndian.PutUint16(ts[:], uint16(rel))
+	return el(idSimpleBlock, []byte{0x80 | byte(track)}, ts[:], []byte{flags}, bytes.Repeat([]byte{0xAA}, 16))
+}
+
+// groupBlock encodes a BlockGroup; a referencing block is not a keyframe.
+func groupBlock(track uint64, rel int16, references bool) []byte {
+	var ts [2]byte
+	binary.BigEndian.PutUint16(ts[:], uint16(rel))
+	parts := [][]byte{el(idBlock, []byte{0x80 | byte(track)}, ts[:], []byte{0}, bytes.Repeat([]byte{0xBB}, 16))}
+	if references {
+		parts = append(parts, uintEl(idReferenceBlock, 40))
+	}
+	return el(idBlockGroup, parts...)
+}
+
+func cluster(ticks uint64, blocks ...[]byte) []byte {
+	return el(idCluster, append([][]byte{uintEl(idClusterTimestamp, ticks)}, blocks...)...)
+}
+
+var (
+	ebmlHeader = el(idEBML, el(0x4282, []byte("matroska")))
+	info       = el(idInfo, uintEl(idTimestampScale, 1_000_000), floatEl(idDuration, 12_500))
+	tracks     = el(idTracks,
+		el(idTrackEntry, uintEl(idTrackNumber, audioTrack), uintEl(idTrackType, 2)),
+		el(idTrackEntry, uintEl(idTrackNumber, videoTrack), uintEl(idTrackType, trackTypeVideo)),
+	)
+	// Video keyframes at 0, 2.216s (a BlockGroup) and 4.218s; non-keyframes
+	// and audio between them.
+	clusterA = cluster(0,
+		block(videoTrack, 0, true),
+		block(audioTrack, 10, true),
+		block(videoTrack, 40, false),
+		groupBlock(videoTrack, 80, true),
+		groupBlock(videoTrack, 2216, false),
+	)
+	clusterB = cluster(4218,
+		block(videoTrack, 0, true),
+		block(videoTrack, 40, false),
+	)
+)
+
+type layout struct {
+	cuesFirst   bool    // Cues before the clusters, found by the linear scan
+	unknownSize bool    // a live-style segment with no size
+	dropCue     *uint64 // a video keyframe left out of the Cues
+	noPositions bool
+	padding     int // extra duplicate cue points, to grow the Cues
+}
+
+// file builds a Matroska file whose Cues index the fixture's keyframes, plus
+// an audio cue and a duplicate, pointing at the clusters that hold them.
+func file(l layout) []byte {
+	seekHead := func(pos uint64) []byte {
+		return el(idSeekHead, el(idSeek, uintEl(idSeekID, idCues), uintEl(idSeekPosition, pos)))
+	}
+	head := slices.Concat(seekHead(0), info, tracks)
+	cuesLen := len(cuesFor(l, 0, 0))
+	posA := uint64(len(head))
+	if l.cuesFirst {
+		posA += uint64(cuesLen)
+	}
+	posB := posA + uint64(len(clusterA))
+	cues := cuesFor(l, posA, posB)
+
+	var body []byte
+	if l.cuesFirst {
+		body = slices.Concat(seekHead(uint64(len(head))), info, tracks, cues, clusterA, clusterB)
+	} else {
+		body = slices.Concat(seekHead(posB+uint64(len(clusterB))), info, tracks, clusterA, clusterB, cues)
+	}
+	if l.unknownSize {
+		return slices.Concat(ebmlHeader, []byte{0x18, 0x53, 0x80, 0x67, 0x01, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF}, body)
+	}
+	return slices.Concat(ebmlHeader, el(idSegment, body))
+}
+
+func cuesFor(l layout, posA, posB uint64) []byte {
+	point := func(ticks, track, pos uint64) []byte {
+		if l.dropCue != nil && ticks == *l.dropCue && track == videoTrack {
+			return nil
+		}
+		trackPos := [][]byte{uintEl(idCueTrack, track)}
+		if !l.noPositions {
+			trackPos = append(trackPos, uintEl(idCueClusterPosition, pos))
+		}
+		return el(idCuePoint, uintEl(idCueTime, ticks), el(idCueTrackPos, trackPos...))
+	}
+	points := [][]byte{
+		point(4218, videoTrack, posB),
+		point(0, videoTrack, posA),
+		point(10, audioTrack, posA), // audio: not a video keyframe
+		point(2216, videoTrack, posA),
+		point(2216, videoTrack, posA), // duplicate
+	}
+	for range l.padding {
+		points = append(points, point(2216, videoTrack, posA))
+	}
+	return el(idCues, points...)
+}
+
+func ptr[T any](v T) *T { return &v }
+
+func read(f []byte) (Index, error) {
+	return ReadMatroska(bytes.NewReader(f), int64(len(f)))
+}
+
+func wantIndex(t *testing.T, got Index, err error) {
+	t.Helper()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if want := []float64{0, 2.216, 4.218}; !slices.Equal(got.Keyframes, want) {
+		t.Fatalf("keyframes = %v, want %v", got.Keyframes, want)
+	}
+	if got.Duration != 12.5 {
+		t.Fatalf("duration = %v, want 12.5", got.Duration)
+	}
+}
+
+func TestReadMatroskaCuesBeforeClusters(t *testing.T) {
+	got, err := read(file(layout{cuesFirst: true}))
+	wantIndex(t, got, err)
+}
+
+// Most muxers write the Cues after the clusters and point to them from the
+// seek head; the reader follows it instead of reading the clusters.
+func TestReadMatroskaCuesAfterClustersThroughSeekHead(t *testing.T) {
+	got, err := read(file(layout{}))
+	wantIndex(t, got, err)
+}
+
+// Info may come after the clusters too. Its timestamp scale, here 2ms per
+// tick, must still convert the cue times.
+func TestReadMatroskaInfoAfterClustersThroughSeekHead(t *testing.T) {
+	scaledInfo := el(idInfo, uintEl(idTimestampScale, 2_000_000), floatEl(idDuration, 6_250))
+	seekHead := func(cuesPos, infoPos uint64) []byte {
+		return el(idSeekHead,
+			el(idSeek, uintEl(idSeekID, idCues), uintEl(idSeekPosition, cuesPos)),
+			el(idSeek, uintEl(idSeekID, idInfo), uintEl(idSeekPosition, infoPos)))
+	}
+	posA := uint64(len(seekHead(0, 0)) + len(tracks))
+	posB := posA + uint64(len(clusterA))
+	cues := cuesFor(layout{}, posA, posB)
+	cuesPos := posB + uint64(len(clusterB))
+	infoPos := cuesPos + uint64(len(cues))
+	segment := el(idSegment, seekHead(cuesPos, infoPos), tracks, clusterA, clusterB, cues, scaledInfo)
+	got, err := read(slices.Concat(ebmlHeader, segment))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if want := []float64{0, 4.432, 8.436}; !slices.Equal(got.Keyframes, want) || got.Duration != 12.5 {
+		t.Fatalf("keyframes %v, duration %v; want %v and 12.5", got.Keyframes, got.Duration, want)
+	}
+}
+
+// Tracks may come after the clusters too, found through the seek head.
+func TestReadMatroskaTracksAfterClustersThroughSeekHead(t *testing.T) {
+	seekHead := func(cuesPos, tracksPos uint64) []byte {
+		return el(idSeekHead,
+			el(idSeek, uintEl(idSeekID, idCues), uintEl(idSeekPosition, cuesPos)),
+			el(idSeek, uintEl(idSeekID, idTracks), uintEl(idSeekPosition, tracksPos)))
+	}
+	posA := uint64(len(seekHead(0, 0)) + len(info))
+	posB := posA + uint64(len(clusterA))
+	cues := cuesFor(layout{}, posA, posB)
+	cuesPos := posB + uint64(len(clusterB))
+	tracksPos := cuesPos + uint64(len(cues))
+	segment := el(idSegment, seekHead(cuesPos, tracksPos), info, clusterA, clusterB, cues, tracks)
+	got, err := read(slices.Concat(ebmlHeader, segment))
+	wantIndex(t, got, err)
+}
+
+// Malformed data in a cue point makes the index incomplete, even when the
+// points read around it happen to cover every keyframe: here the broken one
+// is a duplicate.
+func TestReadMatroskaRejectsMalformedCues(t *testing.T) {
+	seekHead := func(pos uint64) []byte {
+		return el(idSeekHead, el(idSeek, uintEl(idSeekID, idCues), uintEl(idSeekPosition, pos)))
+	}
+	posA := uint64(len(seekHead(0)) + len(info) + len(tracks))
+	posB := posA + uint64(len(clusterA))
+	payload := cuesFor(layout{}, posA, posB)[12:] // past the Cues ID and its 8-byte size
+	// A duplicate cue point whose track position holds a cut-off CueTrack.
+	truncatedTrack := el(idCuePoint, uintEl(idCueTime, 2216),
+		el(idCueTrackPos, uintEl(idCueTrack, videoTrack)[:5], uintEl(idCueClusterPosition, posA)))
+	for name, malformed := range map[string][]byte{
+		"truncated cue point":      el(idCues, payload[:len(payload)-3]),
+		"truncated track position": el(idCues, payload, truncatedTrack),
+	} {
+		t.Run(name, func(t *testing.T) {
+			segment := el(idSegment, seekHead(posB+uint64(len(clusterB))), info, tracks, clusterA, clusterB, malformed)
+			_, err := read(slices.Concat(ebmlHeader, segment))
+			if !errors.Is(err, ErrNoIndex) {
+				t.Fatalf("err = %v, want ErrNoIndex", err)
+			}
+		})
+	}
+}
+
+func TestReadMatroskaUnknownSizeSegment(t *testing.T) {
+	got, err := read(file(layout{unknownSize: true}))
+	wantIndex(t, got, err)
+}
+
+// A plan built on Cues that skip keyframes would cut segments where FFmpeg
+// doesn't, so such a file has no usable index.
+func TestReadMatroskaRejectsCuesMissingKeyframes(t *testing.T) {
+	for name, l := range map[string]layout{
+		"keyframe without a cue (Block)":       {dropCue: ptr(uint64(2216))},
+		"keyframe without a cue (SimpleBlock)": {dropCue: ptr(uint64(4218)), cuesFirst: true},
+		"cues without cluster positions":       {noPositions: true},
+	} {
+		t.Run(name, func(t *testing.T) {
+			_, err := read(file(l))
+			if !errors.Is(err, ErrIncompleteIndex) || !errors.Is(err, ErrNoIndex) {
+				t.Fatalf("err = %v, want ErrIncompleteIndex (an ErrNoIndex)", err)
+			}
+		})
+	}
+}
+
+func TestReadMatroskaWithoutIndex(t *testing.T) {
+	audioOnlyTracks := el(idTracks, el(idTrackEntry, uintEl(idTrackNumber, audioTrack), uintEl(idTrackType, 2)))
+	for name, segment := range map[string][]byte{
+		"no cues":        el(idSegment, info, tracks, clusterA),
+		"no video cue":   el(idSegment, info, tracks, el(idCues, el(idCuePoint, uintEl(idCueTime, 0), el(idCueTrackPos, uintEl(idCueTrack, audioTrack))))),
+		"no video track": el(idSegment, info, audioOnlyTracks, clusterA),
+		// Without Info the cue times can't be converted.
+		"no info": el(idSegment, tracks, cuesFor(layout{}, 0, 0), clusterA),
+		// An explicit zero scale isn't the default; Matroska requires at least 1.
+		"zero timestamp scale": el(idSegment, el(idInfo, uintEl(idTimestampScale, 0), floatEl(idDuration, 12_500)), tracks, cuesFor(layout{}, 0, 0), clusterA),
+	} {
+		t.Run(name, func(t *testing.T) {
+			_, err := read(slices.Concat(ebmlHeader, segment))
+			if !errors.Is(err, ErrNoIndex) {
+				t.Fatalf("err = %v, want ErrNoIndex", err)
+			}
+		})
+	}
+}
+
+func TestReadMatroskaRejectsOtherFiles(t *testing.T) {
+	for name, f := range map[string][]byte{
+		"empty":     nil,
+		"mp4":       []byte("\x00\x00\x00\x18ftypisom\x00\x00\x02\x00isomiso2"),
+		"truncated": ebmlHeader[:5],
+	} {
+		t.Run(name, func(t *testing.T) {
+			if _, err := read(f); err == nil {
+				t.Fatal("read succeeded, want an error")
+			}
+		})
+	}
+}
+
+// cuesLimit is the largest Cues element the reader loads (maxCuesSize).
+const cuesLimit = 16 << 20
+
+// A Cues element larger than the reader loads is a damaged file, not a
+// multi-gigabyte allocation.
+func TestReadMatroskaRejectsOversizedCues(t *testing.T) {
+	huge := []byte{0x1C, 0x53, 0xBB, 0x6B, 0x01, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00}
+	// An unknown-size segment, so the reader reaches the Cues header.
+	f := slices.Concat(
+		ebmlHeader,
+		[]byte{0x18, 0x53, 0x80, 0x67, 0x01, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF},
+		info, tracks, huge,
+	)
+	if _, err := read(f); err == nil || errors.Is(err, ErrNoIndex) {
+		t.Fatalf("err = %v, want a size error", err)
+	}
+
+	// Well-formed Cues just under the limit read; one more point is refused.
+	const header = 12 // a 4-byte ID and an 8-byte size (el)
+	pointLen := len(cuesFor(layout{padding: 1}, 0, 0)) - len(cuesFor(layout{}, 0, 0))
+	under := layout{cuesFirst: true}
+	under.padding = (cuesLimit - (len(cuesFor(under, 0, 0)) - header)) / pointLen
+	got, err := read(file(under))
+	wantIndex(t, got, err)
+	over := under
+	over.padding++
+	if size := len(cuesFor(over, 0, 0)) - header; size <= cuesLimit {
+		t.Fatalf("fixture Cues are %d bytes, want over %d", size, cuesLimit)
+	}
+	if _, err := read(file(over)); err == nil || errors.Is(err, ErrNoIndex) {
+		t.Fatalf("err = %v, want a size error", err)
+	}
+}
+
+// Cues packed with small cue points, each with its own time and cluster
+// position, cost a small multiple of their size: a crafted file can't make
+// one read cost hundreds of megabytes.
+func TestReadMatroskaCuesCostBoundedMemory(t *testing.T) {
+	var points bytes.Buffer
+	for i := range (cuesLimit - 16) / 17 {
+		points.Write([]byte{
+			byte(idCuePoint), 0x8F,
+			byte(idCueTime), 0x83, byte(i >> 16), byte(i >> 8), byte(i),
+			byte(idCueTrackPos), 0x88,
+			byte(idCueTrack), 0x81, videoTrack,
+			byte(idCueClusterPosition), 0x83, byte(i >> 16), byte(i >> 8), byte(i),
+		})
+	}
+	cues := el(idCues, points.Bytes())
+	f := slices.Concat(ebmlHeader, el(idSegment, slices.Concat(info, tracks, cues)))
+
+	var before, after runtime.MemStats
+	runtime.ReadMemStats(&before)
+	_, _ = read(f) // the cue positions don't hold clusters; only the cost matters
+	runtime.ReadMemStats(&after)
+	if got, limit := after.TotalAlloc-before.TotalAlloc, uint64(4*len(cues)); got > limit {
+		t.Fatalf("reading %d bytes of Cues allocated %d bytes, want at most %d", len(cues), got, limit)
+	}
+}
+
+// manyClusters builds a file with ten clusters, each holding two video
+// keyframes, and Cues for all of them except dropTicks. The sampled check
+// reads clusters 0, 3, 6 and 9 and the ones after them; cluster 2 is only
+// read by the full check.
+func manyClusters(dropTicks uint64, extraCue uint64) []byte {
+	head := slices.Concat(info, tracks)
+	var clusters [][]byte
+	for c := range 10 {
+		base := uint64(c) * 4000
+		clusters = append(clusters, cluster(base, block(videoTrack, 0, true), block(videoTrack, 40, false), block(videoTrack, 2000, true)))
+	}
+	cuesFor := func(positions []uint64) []byte {
+		var points [][]byte
+		point := func(ticks, pos uint64) []byte {
+			return el(idCuePoint, uintEl(idCueTime, ticks),
+				el(idCueTrackPos, uintEl(idCueTrack, videoTrack), uintEl(idCueClusterPosition, pos)))
+		}
+		for c := range 10 {
+			for _, rel := range []uint64{0, 2000} {
+				if ticks := uint64(c)*4000 + rel; ticks != dropTicks {
+					points = append(points, point(ticks, positions[c]))
+				}
+			}
+		}
+		if extraCue != 0 {
+			points = append(points, point(extraCue, positions[extraCue/4000]))
+		}
+		return el(idCues, points...)
+	}
+	// The Cues come before the clusters; their length doesn't depend on the
+	// positions they hold.
+	positions := make([]uint64, 10)
+	pos := uint64(len(head) + len(cuesFor(positions)))
+	for c, cl := range clusters {
+		positions[c] = pos
+		pos += uint64(len(cl))
+	}
+	body := slices.Concat(head, cuesFor(positions), slices.Concat(clusters...))
+	return slices.Concat(ebmlHeader, el(idSegment, body))
+}
+
+func verify(f []byte) (Index, error) {
+	return VerifyMatroska(bytes.NewReader(f), int64(len(f)))
+}
+
+func TestVerifyMatroskaChecksEveryCluster(t *testing.T) {
+	complete := manyClusters(1<<62, 0)
+	if idx, err := verify(complete); err != nil || len(idx.Keyframes) != 20 {
+		t.Fatalf("complete cues: %d keyframes, %v; want 20 and no error", len(idx.Keyframes), err)
+	}
+
+	// A keyframe in cluster 2 without a cue gets past the sampled check but
+	// not the full one.
+	missing := manyClusters(2*4000+2000, 0)
+	if _, err := read(missing); err != nil {
+		t.Fatalf("sampled check: %v, want it to miss cluster 2", err)
+	}
+	if _, err := verify(missing); !errors.Is(err, ErrIncompleteIndex) {
+		t.Fatalf("full check err = %v, want ErrIncompleteIndex", err)
+	}
+
+	// A cue on a frame that isn't a keyframe would plan a boundary FFmpeg
+	// can't cut at.
+	if _, err := verify(manyClusters(1<<62, 2*4000+40)); !errors.Is(err, ErrIncompleteIndex) {
+		t.Fatalf("cue on a non-keyframe err = %v, want ErrIncompleteIndex", err)
+	}
+}
+
+func TestVideoEndSeconds(t *testing.T) {
+	var end videoEnd
+	if got := end.seconds(defaultTimescale, 0.04); got != 0 {
+		t.Fatalf("no frames: %v, want 0", got)
+	}
+	end.add(0, 0)
+	if got := end.seconds(defaultTimescale, 0); got != 0 {
+		t.Fatalf("one frame without a frame duration: %v, want 0", got)
+	}
+	// Presentation order differs from storage order with B-frames.
+	for _, ms := range []int64{120, 80, 40, 100, 120} {
+		end.add(ms, 0)
+	}
+	if got := end.seconds(defaultTimescale, 0); math.Abs(got-0.14) > 1e-9 {
+		t.Fatalf("from the last gap: %v, want 0.14", got)
+	}
+	if got := end.seconds(defaultTimescale, 0.033); math.Abs(got-0.153) > 1e-9 {
+		t.Fatalf("from the frame duration: %v, want 0.153", got)
+	}
+	// The last frame's own BlockDuration wins over both.
+	end.add(120, 70)
+	if got := end.seconds(defaultTimescale, 0.033); math.Abs(got-0.19) > 1e-9 {
+		t.Fatalf("from the block duration: %v, want 0.19", got)
+	}
+	// Blocks sharing the last timestamp end with the longest, in either order.
+	for _, durations := range [][2]int64{{70, 30}, {30, 70}} {
+		var shared videoEnd
+		shared.add(80, 0)
+		shared.add(120, durations[0])
+		shared.add(120, durations[1])
+		if got := shared.seconds(defaultTimescale, 0.033); math.Abs(got-0.19) > 1e-9 {
+			t.Fatalf("blocks of %v ms at the end: %v, want 0.19", durations, got)
+		}
+	}
+	// A later frame without one goes back to the track's duration.
+	end.add(160, 0)
+	if got := end.seconds(defaultTimescale, 0.033); math.Abs(got-0.193) > 1e-9 {
+		t.Fatalf("after a later frame: %v, want 0.193", got)
+	}
+}
+
+func TestReadBlockGroupDuration(t *testing.T) {
+	var ts [2]byte
+	binary.BigEndian.PutUint16(ts[:], 40)
+	group := el(idBlockGroup,
+		el(idBlock, []byte{0x80 | byte(videoTrack)}, ts[:], []byte{0}, bytes.Repeat([]byte{0xBB}, 16)),
+		uintEl(idBlockDuration, 70))
+	r := bytes.NewReader(group)
+	_, size, headerLen, err := readElementHeader(r, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	track, rel, key, duration, err := readBlockGroup(r, headerLen, size)
+	if err != nil || track != videoTrack || rel != 40 || !key || duration != 70 {
+		t.Fatalf("readBlockGroup = %d, %d, %v, %d, %v; want video at 40, a keyframe of 70 ticks", track, rel, key, duration, err)
+	}
+}
+
+// The fixture's last video frame is at 4.258s, 40ms after the one before.
+func TestVerifyMatroskaVideoEnd(t *testing.T) {
+	idx, err := verify(file(layout{}))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if math.Abs(idx.VideoEnd-4.298) > 1e-9 {
+		t.Fatalf("VideoEnd = %v, want 4.298", idx.VideoEnd)
+	}
+}
+
+// A video track whose timestamps carry a TrackTimestampScale isn't planned
+// from: the reader's times don't apply it.
+func TestFirstVideoTrackReportsATrackTimestampScale(t *testing.T) {
+	entry := func(scale ...[]byte) []byte {
+		return el(idTrackEntry, append([][]byte{uintEl(idTrackNumber, videoTrack), uintEl(idTrackType, trackTypeVideo)}, scale...)...)
+	}
+	if _, _, scaled, found := firstVideoTrack(entry()); !found || scaled {
+		t.Fatalf("unscaled track: scaled=%v found=%v", scaled, found)
+	}
+	if _, _, scaled, found := firstVideoTrack(entry(floatEl(idTrackTimestampScale, 1))); !found || scaled {
+		t.Fatalf("scale 1: scaled=%v found=%v", scaled, found)
+	}
+	if _, _, scaled, found := firstVideoTrack(entry(floatEl(idTrackTimestampScale, 2))); !found || !scaled {
+		t.Fatalf("scale 2: scaled=%v found=%v", scaled, found)
+	}
+}
diff --git a/internal/playback/keyframes/plan.go b/internal/playback/keyframes/plan.go
new file mode 100644
index 0000000000..75df2fc4ae
--- /dev/null
+++ b/internal/playback/keyframes/plan.go
@@ -0,0 +1,53 @@
+package keyframes
+
+// PlanSegments returns the start time of each HLS segment for a stream copied
+// from a file with these keyframes, cut the way FFmpeg's HLS muxer cuts
+// copied video: a segment ends at the first keyframe at or after its target,
+// and each cut moves the target on by segmentSeconds. Targets count from the
+// first keyframe, where FFmpeg's output starts. Jellyfin's
+// DynamicHlsPlaylistGenerator.ComputeSegments uses the same rule.
+//
+// When keyframes are further apart than segmentSeconds the targets fall
+// behind, and the following keyframes each start a segment until they catch
+// up, as FFmpeg's muxer does.
+func PlanSegments(keyframes []float64, segmentSeconds float64) []float64 {
+	if len(keyframes) == 0 || segmentSeconds <= 0 {
+		return nil
+	}
+	starts := []float64{keyframes[0]}
+	// Targets are measured from the first keyframe, and a keyframe within
+	// targetSlack of one counts as reaching it: FFmpeg compares integer
+	// timestamps, where a keyframe exactly on a target reaches it, but a
+	// nonzero origin leaves float error ("2.28 - 0.28" isn't quite 2).
+	target := segmentSeconds
+	for _, k := range keyframes[1:] {
+		if k-keyframes[0] >= target-targetSlack {
+			starts = append(starts, k)
+			target += segmentSeconds
+		}
+	}
+	return starts
+}
+
+// targetSlack is the float error PlanSegments allows when comparing a
+// keyframe with a target: a microsecond, FFmpeg's finest time base and well
+// under any frame's duration.
+const targetSlack = 1e-6
+
+// SegmentDurations returns each planned segment's duration: up to the next
+// segment's start, and for the last one up to the media's end. A last segment
+// that would be empty or negative, from an end before the last start, is
+// given zero.
+func SegmentDurations(starts []float64, end float64) []float64 {
+	durations := make([]float64, len(starts))
+	for i, start := range starts {
+		next := end
+		if i+1 < len(starts) {
+			next = starts[i+1]
+		}
+		if next > start {
+			durations[i] = next - start
+		}
+	}
+	return durations
+}
diff --git a/internal/playback/keyframes/plan_test.go b/internal/playback/keyframes/plan_test.go
new file mode 100644
index 0000000000..023b151e89
--- /dev/null
+++ b/internal/playback/keyframes/plan_test.go
@@ -0,0 +1,48 @@
+package keyframes
+
+import (
+	"slices"
+	"testing"
+)
+
+func TestPlanSegments(t *testing.T) {
+	for _, tc := range []struct {
+		name      string
+		keyframes []float64
+		want      []float64
+	}{
+		{name: "no keyframes", keyframes: nil, want: nil},
+		{name: "one keyframe", keyframes: []float64{0}, want: []float64{0}},
+		// Regular 1s keyframes: one segment every 2s.
+		{name: "regular", keyframes: []float64{0, 1, 2, 3, 4, 5, 6}, want: []float64{0, 2, 4, 6}},
+		// A keyframe after the target ends the segment there.
+		{name: "late keyframe", keyframes: []float64{0, 1.3, 2.6, 3.9, 5.2}, want: []float64{0, 2.6, 5.2}},
+		// After a long gap the targets lag behind, and the next keyframes each
+		// start a segment until they catch up, as FFmpeg's muxer does.
+		{name: "catching up", keyframes: []float64{0, 7.0, 7.4, 7.8, 9.9}, want: []float64{0, 7.0, 7.4, 7.8, 9.9}},
+		// Targets count from the first keyframe, where FFmpeg's output starts.
+		{name: "late start", keyframes: []float64{0.5, 1.5, 2.5, 3.5}, want: []float64{0.5, 2.5}},
+		// A keyframe exactly on a target cuts there, though a nonzero origin
+		// leaves float error in the subtraction.
+		{name: "exact targets after a nonzero origin", keyframes: []float64{0.28, 2.28, 4.28, 6.28, 8.28}, want: []float64{0.28, 2.28, 4.28, 6.28, 8.28}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := PlanSegments(tc.keyframes, 2); !slices.Equal(got, tc.want) {
+				t.Fatalf("PlanSegments = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestSegmentDurations(t *testing.T) {
+	got := SegmentDurations([]float64{0, 2.6, 5.2}, 6)
+	want := []float64{2.6, 2.6, 0.8}
+	for i := range want {
+		if diff := got[i] - want[i]; diff > 1e-9 || diff < -1e-9 {
+			t.Fatalf("SegmentDurations = %v, want %v", got, want)
+		}
+	}
+	if got := SegmentDurations([]float64{0, 5}, 4); got[1] != 0 {
+		t.Fatalf("last duration past the end = %v, want 0", got[1])
+	}
+}
diff --git a/internal/playback/plan_key_v3.go b/internal/playback/plan_key_v3.go
index b024014d97..4d8030f12e 100644
--- a/internal/playback/plan_key_v3.go
+++ b/internal/playback/plan_key_v3.go
@@ -35,6 +35,7 @@ func DeterministicPlanIDV3(attemptID string, requestedFileID, effectiveFileID in
 		strings.Join(transformations, ","),
 	}
 	parts = appendEmbeddedSubtitleIdentityV3(parts, plan.Subtitle.Embedded)
+	parts = appendHLSSubtitleRenditionIdentityV3(parts, plan.Subtitle.HLSRendition)
 	parts = appendVideoSampleEntryIdentityV3(parts, plan.EffectiveRecipe.VideoSampleEntry)
 	parts = appendQuirkIdentityV3(parts, plan)
 	parts = append(parts, PlanRecipeVersionV3)
@@ -66,6 +67,7 @@ func PlanAttemptKeyV3(plan PlanV3, outputContextID string, localMutations []stri
 		strings.Join(transformations, ","),
 	}
 	parts = appendEmbeddedSubtitleIdentityV3(parts, plan.Subtitle.Embedded)
+	parts = appendHLSSubtitleRenditionIdentityV3(parts, plan.Subtitle.HLSRendition)
 	parts = appendVideoSampleEntryIdentityV3(parts, plan.EffectiveRecipe.VideoSampleEntry)
 	parts = appendQuirkIdentityV3(parts, plan)
 	parts = append(parts,
@@ -119,3 +121,13 @@ func appendEmbeddedSubtitleIdentityV3(parts []string, embedded *EmbeddedSubtitle
 	}
 	return append(parts, "embedded_subtitle="+strconv.Itoa(embedded.StreamIndex)+":"+embedded.ContainerTrackID)
 }
+
+// appendHLSSubtitleRenditionIdentityV3 keeps a rendition plan distinct from
+// the sidecar plan for the same track, so a failed rendition can fall back.
+// Plans without one keep their historical identity.
+func appendHLSSubtitleRenditionIdentityV3(parts []string, rendition *HLSSubtitleRenditionV3) []string {
+	if rendition == nil {
+		return parts
+	}
+	return append(parts, "hls_subtitle_rendition="+rendition.GroupID+":"+rendition.Format)
+}
diff --git a/internal/playback/plan_v3.go b/internal/playback/plan_v3.go
index 7cce33ebf4..a43fe05c5d 100644
--- a/internal/playback/plan_v3.go
+++ b/internal/playback/plan_v3.go
@@ -82,10 +82,14 @@ type PlannerInputV3 struct {
 	// planner, tests). Lazy for the same reason as the HLS registries: it shells out
 	// to ffmpeg, so it is consulted only once every cheap eligibility gate
 	// has already passed and a strip route is genuinely on the table.
-	DVRPUStrippable     func() bool
-	Now                 time.Time
-	AttemptedKeys       []string
-	AdditionalSubtitles []SubtitleInventoryEntryV3
+	DVRPUStrippable func() bool
+	// SubtitleRenditionExecutable reports whether some policy-eligible HLS
+	// video executor can emit an HLS subtitle rendition. Nil means none can.
+	// Lazy for the same reason as the HLS registries.
+	SubtitleRenditionExecutable func() bool
+	Now                         time.Time
+	AttemptedKeys               []string
+	AdditionalSubtitles         []SubtitleInventoryEntryV3
 }
 
 // SourceExecutionMetadataV3 is the immutable source probe snapshot used to
@@ -172,6 +176,9 @@ type PlannerResultV3 struct {
 	SubtitleTransportTrackIndex int
 	SubtitleBurnIn              bool
 	SubtitleCodec               string
+	// SubtitleRendition emits the selected subtitle as the transcode's HLS
+	// subtitle rendition (Plan.Subtitle.HLSRendition).
+	SubtitleRendition bool
 	// DownloadedSubtitleID comes from the same inventory snapshot used for
 	// planning. Freezing must not re-list a mutable ordinal inventory after the
 	// route has already been accepted.
@@ -426,7 +433,7 @@ func PlanPlaybackV3(input PlannerInputV3) (result PlannerResultV3) {
 	}
 
 	// Automatic quality reductions (device resolution limit, bandwidth
-	// estimate/cap, metered fallback) are best-effort. When the only reason to
+	// estimate or cap) are best-effort. When the only reason to
 	// transcode is such a reduction, a validated source-preserving route
 	// exists, and the transcode itself cannot execute (HDR sources have no
 	// validated reduced-quality recipe yet, or the client/server lacks the
@@ -1281,10 +1288,24 @@ func planVideoTranscodeV3(input PlannerInputV3, base PlanV3, source SourceDescri
 		}
 		finalizePlanIdentityV3(&plan, input.Request.PlaybackAttemptID, input.Request.ClientPlaybackContext.Output.OutputContextID)
 	}
+	subtitleRendition := false
+	if hlsSubtitleRenditionEligibleV3(input, subtitle, targetVideoCodec) {
+		applyHLSSubtitleRenditionV3(&plan)
+		finalizePlanIdentityV3(&plan, input.Request.PlaybackAttemptID, input.Request.ClientPlaybackContext.Output.OutputContextID)
+		subtitleRendition = true
+		// A rendition that already failed falls back to the sidecar rather
+		// than exhausting the route: the two are different recipes.
+		if planAttemptedV3(plan, input.Request.ClientPlaybackContext.Output.OutputContextID, input.AttemptedKeys) {
+			applySubtitleDecisionV3(&plan, subtitle.Decision)
+			plan.Claims.Subtitles = subtitle.Claims
+			finalizePlanIdentityV3(&plan, input.Request.PlaybackAttemptID, input.Request.ClientPlaybackContext.Output.OutputContextID)
+			subtitleRendition = false
+		}
+	}
 	if planAttemptedV3(plan, input.Request.ClientPlaybackContext.Output.OutputContextID, input.AttemptedKeys) {
 		return terminalPlannerResultV3("adaptation_exhausted", "All compatible playback recipes have already failed for this output route.", false)
 	}
-	return PlannerResultV3{Plan: &plan, PlayMethod: PlayTranscode, TranscodeAudio: true, TargetVideoCodec: targetVideoCodec, TargetAudioCodec: "aac", SourceAudioChannels: stereoDownmixSourceChannelsV3(source.AudioChannels, targetAudioChannels, true), TargetAudioChannels: targetAudioChannels, TargetAudioBitrateKbps: targetAudioBitrateKbps, TargetResolution: quality.Label, TargetBitrateKbps: quality.BitrateKbps, SubtitleTrackIndex: subtitle.SelectedIndex, SubtitleTransportTrackIndex: subtitle.TransportIndex, SubtitleBurnIn: subtitle.RequiresBurn, SubtitleCodec: subtitle.Codec, DownloadedSubtitleID: subtitle.DownloadedSubtitleID, ToneMapPolicy: toneMapPolicy, ToneMapMode: toneMapMode, ToneMapSourceKind: toneMapSourceKind, ToneMapRecipeVersion: toneMapRecipeVersionV3(toneMapOK), ToneMapPreflightRequired: toneMapResolution.PreflightRequired, ToneMapSourceRevision: toneMapRevision}
+	return PlannerResultV3{SubtitleRendition: subtitleRendition, Plan: &plan, PlayMethod: PlayTranscode, TranscodeAudio: true, TargetVideoCodec: targetVideoCodec, TargetAudioCodec: "aac", SourceAudioChannels: stereoDownmixSourceChannelsV3(source.AudioChannels, targetAudioChannels, true), TargetAudioChannels: targetAudioChannels, TargetAudioBitrateKbps: targetAudioBitrateKbps, TargetResolution: quality.Label, TargetBitrateKbps: quality.BitrateKbps, SubtitleTrackIndex: subtitle.SelectedIndex, SubtitleTransportTrackIndex: subtitle.TransportIndex, SubtitleBurnIn: subtitle.RequiresBurn, SubtitleCodec: subtitle.Codec, DownloadedSubtitleID: subtitle.DownloadedSubtitleID, ToneMapPolicy: toneMapPolicy, ToneMapMode: toneMapMode, ToneMapSourceKind: toneMapSourceKind, ToneMapRecipeVersion: toneMapRecipeVersionV3(toneMapOK), ToneMapPreflightRequired: toneMapResolution.PreflightRequired, ToneMapSourceRevision: toneMapRevision}
 }
 
 // h264BoundedQualityV3 fits a transcode target to the client's attested
@@ -1460,6 +1481,44 @@ func hlsHEVCOutputSupportedV3(request StartRequestV3, quality QualityResultV3, s
 	return ok
 }
 
+// hlsSubtitleRenditionEligibleV3 reports whether a server_transcode_hls plan
+// carries its selected subtitle as an HLS subtitle rendition instead of a
+// sidecar. The track must be an embedded text track the policy already shows
+// as text, the client must have negotiated the feature, an executor must be
+// able to emit it, and the transcode must use the synthetic fixed-grid
+// playlist the rendition's segments align to. A rendition is WebVTT, so ASS
+// keeps its sidecar when the client requires authored fidelity.
+func hlsSubtitleRenditionEligibleV3(input PlannerInputV3, subtitle SubtitlePolicyResultV3, targetVideoCodec string) bool {
+	if !HasFeatureV3(input.Request.ClientFeatures, FeatureHLSSubtitleRenditionsV3) ||
+		input.SubtitleRenditionExecutable == nil || input.EffectiveFile == nil {
+		return false
+	}
+	if subtitle.RequiresBurn || subtitle.Source != SubtitleSourceEmbeddedV3 || subtitle.SelectedIndex < 0 || subtitle.TransportIndex < 0 ||
+		subtitle.Decision.Embedded != nil || !SubtitleRenditionCodecSupported(subtitle.Codec) {
+		return false
+	}
+	if subtitle.Decision.Mode != SubtitleRenderV3 && subtitle.Decision.Mode != SubtitleConvertV3 ||
+		IsASS(subtitle.Codec) && input.Request.SubtitleFidelityPreference == SubtitleFidelityPreserveV3 {
+		return false
+	}
+	return SubtitleRenditionExecutable(targetVideoCodec, float64(input.EffectiveFile.Duration), DefaultSegmentDuration) &&
+		input.SubtitleRenditionExecutable()
+}
+
+// applyHLSSubtitleRenditionV3 moves the plan's selected subtitle into its HLS
+// presentation. The inventory keeps every sidecar URL, so a later selection
+// of another track still has one.
+func applyHLSSubtitleRenditionV3(plan *PlanV3) {
+	plan.Subtitle.Artifact = nil
+	plan.Subtitle.HLSRendition = &HLSSubtitleRenditionV3{
+		GroupID:  SubtitleRenditionGroupID,
+		Name:     SubtitleRenditionName,
+		Format:   SubtitleFormatVTTV3,
+		MIMEType: SubtitleMIMEVTTV3,
+	}
+	plan.Claims.Subtitles = SubtitleClaimsV3{Reason: "server_hls_subtitle_rendition"}
+}
+
 // applySubtitleDecisionV3 changes the delivery-specific subtitle policy without
 // discarding the source inventory already frozen onto the base plan. Adapted
 // routes still address the same combined ordinal space as original_http; only
@@ -1554,14 +1613,18 @@ type QualityResultV3 struct {
 
 // ResolveQualityPolicyV3 selects the delivery quality for a plan.
 //
-// bandwidth_cap_kbps is a hard delivery ceiling and is honored in every
-// quality mode: source-preserving delivery is degraded when the source bitrate
-// exceeds the cap, fixed rungs are lowered when their ladder bitrate exceeds
-// it, and "auto" folds the cap into bandwidth-based rung selection. A metered
-// connection with neither a cap nor a bandwidth estimate limits auto
-// selection to the conservative 720p rung — the rung auto would pick for a
-// mid-range bandwidth estimate — instead of assuming the link can sustain the
-// original stream.
+// "auto" is best-effort direct play: it preserves the source unless the
+// device's maximum resolution rules it out or the source's bitrate exceeds the
+// budget of a measured bandwidth estimate. A source that fits the budget is sent
+// as-is at any resolution; only one the link cannot carry drops to the class
+// the estimate earns. Without an estimate auto assumes the link can carry the
+// source; metered is ignored, since clients apply their own cellular quality.
+// A fixed rung or plain resolution never reads the estimate.
+//
+// bandwidth_cap_kbps is a hard delivery ceiling honored in every quality mode:
+// a source whose bitrate exceeds it is re-encoded at the cap's rung, and a
+// fixed rung whose ladder bitrate exceeds it is lowered. A source that fits
+// under the cap is still sent as-is.
 func ResolveQualityPolicyV3(request StartRequestV3, source SourceDescriptorV3) QualityResultV3 {
 	quality, changed := NormalizeQualityV3(request.QualityPreference)
 	var warnings []DegradationWarningV3
@@ -1572,11 +1635,6 @@ func ResolveQualityPolicyV3(request StartRequestV3, source SourceDescriptorV3) Q
 	// The cap is a hard ceiling, so a video source whose bitrate is unknown
 	// cannot be shown to fit it, as with the server cap.
 	capExceededBySource := capKbps > 0 && (source.BitrateKbps > capKbps || source.BitrateKbps <= 0 && source.VideoCodec != "")
-	if quality == QualityOriginalV3 && !capExceededBySource {
-		result := originalQualityResultV3(source)
-		result.Warnings = warnings
-		return result
-	}
 	if rung, ok := ladderRungForLabelV3(quality); ok {
 		return compoundRungQualityResultV3(rung, source, capKbps, warnings)
 	}
@@ -1584,61 +1642,40 @@ func ResolveQualityPolicyV3(request StartRequestV3, source SourceDescriptorV3) Q
 	reason := "quality_auto_source"
 	explicitRung := false
 	capApplied := false
-	// budgetKbps is the share of a bandwidth estimate or cap that automatic
-	// quality plans for; the encode never targets more than it. A source over
-	// the estimate's budget is re-encoded at its own size rather than sent
-	// as-is; a cap keeps its own source rule below.
+	// budgetKbps is the share of a bandwidth estimate automatic quality plans
+	// for when the source exceeds it; the encode never targets more.
 	budgetKbps := 0
 	overEstimate := false
-	// classLimit is the tallest class the preference, device, bandwidth or
-	// cap allows, before the source's own height bounds targetHeight; 0 is
-	// no limit. It keeps a cropped source in the class it earned.
+	// classLimit is the tallest class the preference, device, estimate or cap
+	// allows, before the source's own height bounds targetHeight; 0 is no
+	// limit. It keeps a cropped source in the class it earned.
 	var classLimit int
-	switch {
-	case quality == QualityOriginalV3:
-		// Only reached when the source bitrate exceeds the cap: the cap is a
-		// hard ceiling and outranks the original preference.
-		targetHeight = streamLadderClassV3(capKbps, source)
-		classLimit = targetHeight
-		capApplied = true
-	case quality != "auto":
+	if quality != QualityAutoV3 {
 		targetHeight, _ = strconv.Atoi(strings.TrimSuffix(quality, "p"))
 		classLimit = targetHeight
 		reason = "quality_fixed_rung"
 		explicitRung = true
-	default:
+	} else {
 		maxHeight := resolutionHeightV3(request.Capabilities.MaxResolution)
 		if maxHeight > 0 && (targetHeight == 0 || maxHeight < targetHeight) {
 			targetHeight = maxHeight
 			reason = "quality_device_limit"
 		}
 		classLimit = maxHeight
-		bandwidth := optionalValueV3(request.BandwidthEstimateKbps)
-		fromEstimate := bandwidth > 0
-		if capKbps > 0 && (bandwidth == 0 || capKbps < bandwidth) {
-			bandwidth = capKbps
-			fromEstimate = false
-		}
-		if bandwidth > 0 {
-			earned := streamLadderClassV3(bandwidth, source)
+	}
+	if quality == QualityAutoV3 {
+		earned, budget, overSource := estimateLimitV3(optionalValueV3(request.BandwidthEstimateKbps), targetHeight, classLimit, source)
+		// A source the link can carry plays as-is. An encode the link forces,
+		// or one the device already requires, stays within the estimate.
+		deviceEncode := source.Height > 0 && targetHeight < source.Height
+		if budget > 0 && (overSource || deviceEncode) {
 			targetHeight = minPositiveV3(targetHeight, earned)
 			classLimit = minPositiveV3(classLimit, earned)
-			budgetKbps = streamBudgetKbpsV3(bandwidth)
-			// A source of unknown bitrate counts as needing the full bitrate
-			// of the class it would be sent at, so it goes as-is only when the
-			// budget covers that.
-			sourceKbps := source.BitrateKbps
-			if sourceKbps <= 0 {
-				sourceKbps = ladderClassBitrateKbpsV3(streamClassV3(minPositiveV3(targetHeight, source.Height), classLimit, source))
-			}
-			overEstimate = fromEstimate && sourceKbps > budgetKbps
+			budgetKbps = budget
+		}
+		if overSource {
+			overEstimate = true
 			reason = "quality_bandwidth_limit"
-		} else if request.Metered {
-			classLimit = minPositiveV3(classLimit, 720)
-			if capped := minPositiveV3(targetHeight, 720); capped != targetHeight {
-				targetHeight = capped
-				reason = "quality_metered_limit"
-			}
 		}
 	}
 	if targetHeight <= 0 {
@@ -1651,7 +1688,7 @@ func ResolveQualityPolicyV3(request StartRequestV3, source SourceDescriptorV3) Q
 	// preserve the source is forced down when the source bitrate exceeds the
 	// cap, and a transcode rung whose ladder bitrate exceeds the cap drops to
 	// the cap's rung.
-	if capKbps > 0 && !capApplied {
+	if capKbps > 0 {
 		wouldPreserve := source.Height > 0 && targetHeight >= source.Height
 		if (wouldPreserve && capExceededBySource) || (!wouldPreserve && ladderClassBitrateKbpsV3(targetHeight) > capKbps) {
 			capApplied = true
@@ -1715,6 +1752,23 @@ func ResolveQualityPolicyV3(request StartRequestV3, source SourceDescriptorV3) Q
 	return result
 }
 
+// estimateLimitV3 reads a measured bandwidth estimate for automatic quality:
+// the ladder class it earns, the 80% budget an encode stays within, and
+// whether the source's bitrate exceeds that budget. A source of unknown
+// bitrate counts as needing the full bitrate of the class it would be sent at.
+// Without an estimate it returns zeros.
+func estimateLimitV3(estimateKbps, targetHeight, classLimit int, source SourceDescriptorV3) (earned, budget int, overSource bool) {
+	if estimateKbps <= 0 {
+		return 0, 0, false
+	}
+	sourceKbps := source.BitrateKbps
+	if sourceKbps <= 0 {
+		sourceKbps = ladderClassBitrateKbpsV3(streamClassV3(minPositiveV3(targetHeight, source.Height), classLimit, source))
+	}
+	budget = streamBudgetKbpsV3(estimateKbps)
+	return streamLadderClassV3(estimateKbps, source), budget, sourceKbps > budget
+}
+
 // compoundRungQualityResultV3 resolves one explicit menu step. Its resolution
 // class never changes under a bandwidth cap; only the bitrate is clamped. For
 // cinema-aspect sources (for example 3840x1540 UHD), a same-class rung keeps
diff --git a/internal/playback/prepare_file.go b/internal/playback/prepare_file.go
index 9e6261f201..586c1de586 100644
--- a/internal/playback/prepare_file.go
+++ b/internal/playback/prepare_file.go
@@ -241,6 +241,18 @@ func h264LevelFor(width, height int, frameRate float64, kbps int) int {
 	return 60
 }
 
+// H264LevelFor is h264LevelFor for callers outside this package.
+func H264LevelFor(width, height int, frameRate float64, kbps int) int {
+	return h264LevelFor(width, height, frameRate, kbps)
+}
+
+// H264EquivalentKbps is the rate an H.264 encode of a source at sourceKbps in
+// sourceCodec needs for the same quality (sourceEquivalentKbps), or 0 when
+// the source's rate is unknown.
+func H264EquivalentKbps(sourceKbps int, sourceCodec string) int {
+	return sourceEquivalentKbps(SourceDescriptorV3{BitrateKbps: sourceKbps, VideoCodec: sourceCodec}, transcodeCodecH264)
+}
+
 // h264LevelBitrateKbps is the highest cap whose rate and doubled buffer fit
 // the given level; 0 for an unknown level.
 func h264LevelBitrateKbps(idc int) int {
@@ -255,6 +267,9 @@ func h264LevelBitrateKbps(idc int) int {
 // h264HighProfileV3 is the profile every H.264 encode here produces.
 const h264HighProfileV3 = "high"
 
+// H264EncodeProfile is h264HighProfileV3 for callers outside this package.
+const H264EncodeProfile = h264HighProfileV3
+
 // downloadDecoder is the decoder bound a download encode must fit. Zero
 // fields are unbounded.
 type downloadDecoder struct {
diff --git a/internal/playback/protocol_v3.go b/internal/playback/protocol_v3.go
index a4a612a234..25b346a1fd 100644
--- a/internal/playback/protocol_v3.go
+++ b/internal/playback/protocol_v3.go
@@ -83,12 +83,27 @@ const (
 	// of the WebVTT conversion, which cannot carry every SRT feature. Embedded
 	// SRT tracks keep their existing delivery. It exists only on /api/v2 (see
 	// NativeServerFeaturesV3).
-	FeatureMarkerThumbnailsV3  = "marker_thumbnails_v1"
-	FeatureSubripSidecarV3     = "subrip_sidecar_v1"
-	PlanRecipeVersionV3        = "v3.4"
-	ClientDV7ToDV81V3          = "client_dv7_to_dv81"
-	ClientDV7ToHDR10V3         = "client_dv7_to_hdr10"
-	ClientDVTransformVersionV3 = "1"
+	FeatureMarkerThumbnailsV3 = "marker_thumbnails_v1"
+	FeatureSubripSidecarV3    = "subrip_sidecar_v1"
+	// FeatureHLSSubtitleRenditionsV3 is the client's statement that it plays
+	// a subtitle carried as a WebVTT SUBTITLES rendition of the plan's HLS
+	// stream (subtitle.hls_rendition) instead of a sidecar artifact. Only a
+	// server_transcode_hls plan uses it, for an embedded text track. It
+	// exists only on /api/v2 (see NativeServerFeaturesV3).
+	FeatureHLSSubtitleRenditionsV3 = "hls_subtitle_renditions_v1"
+	// FailureSubtitleHLSRenditionFailedV3 is the failure_recovery
+	// classification a client sends when the plan's subtitle rendition never
+	// became selectable in its player. The server stops offering renditions
+	// for the rest of the attempt, as subtitle_embedded_failed does for
+	// native embedded selection.
+	FailureSubtitleHLSRenditionFailedV3 = "subtitle_hls_rendition_failed"
+	// FailureSubtitleEmbeddedFailedV3 is the failure_recovery classification
+	// for a native embedded selection the player could not mount.
+	FailureSubtitleEmbeddedFailedV3 = "subtitle_embedded_failed"
+	PlanRecipeVersionV3             = "v3.4"
+	ClientDV7ToDV81V3               = "client_dv7_to_dv81"
+	ClientDV7ToHDR10V3              = "client_dv7_to_hdr10"
+	ClientDVTransformVersionV3      = "1"
 	// ClaimClientManagedDynamicRangeV3 is scoped to the original_http
 	// delivery. A client that advertises it accepts responsibility for mapping
 	// any source dynamic range it declares decodable onto the active output;
@@ -127,6 +142,13 @@ const (
 	TransportFeaturePreparedTracksV1 = "prepared_tracks_v1"
 	// A transcode node that makes trickplay sheets (POST /trickplay/extract).
 	TransportFeatureTrickplayExtractV1 = "trickplay_extract_v1"
+	// A trickplay node that converts HDR with the tone-map source signal a
+	// request names, decodes on CUDA, and repairs missing and repeated cells.
+	// API servers that send the signal only use nodes that advertise it.
+	TransportFeatureTrickplayExtractV2 = "trickplay_extract_v2"
+	// A transcode node that emits and serves an HLS WebVTT subtitle rendition
+	// (TranscodeOpts.SubtitleRendition).
+	TransportFeatureHLSSubtitleRenditionV1 = "hls_subtitle_rendition_v1"
 )
 
 // Degradation warning codes reported by playback plans.
@@ -152,6 +174,15 @@ func SubtitleTrackUnavailableWarningV3() DegradationWarningV3 {
 	return DegradationWarningV3{Code: DegradationWarningSubtitleTrackUnavailableV3, Message: "The selected subtitle track is not on this file; starting without it."}
 }
 
+// SubtitleNotShownWarningV3 reports a selected subtitle that is on the file
+// but cannot be shown with any route the file can take (a bitmap burn-in an
+// HDR source cannot be re-encoded for, say), so playback continues without
+// it. The code is the one SubtitleTrackUnavailableWarningV3 uses: clients
+// handle both the same way.
+func SubtitleNotShownWarningV3() DegradationWarningV3 {
+	return DegradationWarningV3{Code: DegradationWarningSubtitleTrackUnavailableV3, Message: "The selected subtitle cannot be shown on this file; playing without it."}
+}
+
 // ServerFeaturesV3 returns the complete feature set advertised by protocol-v3
 // capability and decision responses. A fresh slice prevents callers from
 // mutating the shared contract.
@@ -186,7 +217,7 @@ func ServerFeaturesV3() []string {
 // advertises and honors only on /api/v2. They postdate the /api/v1 freeze, so
 // the frozen surface neither advertises nor negotiates them.
 func NativeServerFeaturesV3() []string {
-	return append(ServerFeaturesV3(), FeatureSubripSidecarV3, FeatureMarkerThumbnailsV3)
+	return append(ServerFeaturesV3(), FeatureSubripSidecarV3, FeatureMarkerThumbnailsV3, FeatureHLSSubtitleRenditionsV3)
 }
 
 // WithoutFeatureV3 returns features with every spelling of feature removed.
@@ -892,10 +923,25 @@ type EmbeddedSubtitleV3 struct {
 	ContainerTrackID string `json:"container_track_id,omitempty"`
 }
 
+// HLSSubtitleRenditionV3 places the selected subtitle inside the plan's HLS
+// presentation: the stream URL is a multivariant playlist whose SUBTITLES
+// group GroupID holds the track as one WebVTT rendition named Name, segmented
+// on the video's own timeline.
+type HLSSubtitleRenditionV3 struct {
+	GroupID  string `json:"group_id"`
+	Name     string `json:"name"`
+	Format   string `json:"format"`
+	MIMEType string `json:"mime_type"`
+}
+
 type SubtitleDecisionV3 struct {
 	Embedded *EmbeddedSubtitleV3 `json:"embedded,omitempty"`
-	Mode     SubtitleModeV3      `json:"mode"`
-	TrackID  string              `json:"track_id,omitempty"`
+	// HLSRendition is the selected track carried in the HLS stream itself,
+	// mutually exclusive with Embedded and Artifact. It is published only to
+	// clients that negotiated hls_subtitle_renditions_v1.
+	HLSRendition *HLSSubtitleRenditionV3 `json:"hls_rendition,omitempty"`
+	Mode         SubtitleModeV3          `json:"mode"`
+	TrackID      string                  `json:"track_id,omitempty"`
 	// Artifact is the selected sidecar, mutually exclusive with Embedded. It exists only under
 	// SubtitleRenderV3 and SubtitleConvertV3; SubtitleOffV3 and
 	// SubtitleBurnInV3 have no client-fetchable artifact and must publish none,
@@ -929,12 +975,16 @@ type DegradationWarningV3 struct {
 	Message string `json:"message"`
 }
 
-// QualityOriginalV3 is the quality preference that pins the source ladder
-// rung: the plan must preserve the source's own height and bitrate rather than
-// pick a transcode rung. Distinct from OriginalLanguageSentinel, which selects
-// a track's original language.
+// QualityOriginalV3 labels the source entry of the frozen v1 quality menu.
+// As a quality preference it is a legacy alias of "auto", which already
+// preserves the source whenever the device can play it. Distinct from
+// OriginalLanguageSentinel, which selects a track's original language.
 const QualityOriginalV3 = "original"
 
+// QualityAutoV3 is the default quality preference: preserve the source unless
+// the device, a bandwidth cap, or the server rules it out.
+const QualityAutoV3 = "auto"
+
 // Compound ladder rung labels pin a bitrate as well as a resolution class.
 // The plain resolution labels remain valid for stored/default preferences;
 // menu selections use these explicit variants so every visible entry has
@@ -953,8 +1003,9 @@ const (
 
 // AvailableQualityV3 is one server-ladder rung valid for this source and
 // client, published on the plan so clients can render a quality menu without
-// owning a bitrate table. The QualityOriginalV3 entry preserves the source;
-// DisplayName gives compound rungs their human-facing High/Medium/Low label.
+// owning a bitrate table. The QualityOriginalV3 entry preserves the source
+// and is published on v1 only; DisplayName gives compound rungs their
+// human-facing High/Medium/Low label.
 type AvailableQualityV3 struct {
 	Label           string `json:"label"`
 	DisplayName     string `json:"display_name,omitempty"`
@@ -1078,10 +1129,8 @@ func (r *StartRequestV3) NormalizeAndValidate() ([]DegradationWarningV3, error)
 
 func NormalizeQualityV3(value string) (string, bool) {
 	switch strings.ToLower(strings.TrimSpace(value)) {
-	case "", "auto":
-		return "auto", false
-	case QualityOriginalV3, "source", "max":
-		return QualityOriginalV3, false
+	case "", QualityAutoV3, QualityOriginalV3, "source", "max":
+		return QualityAutoV3, false
 	case resolution2160p, "4k", "uhd":
 		return resolution2160p, false
 	case resolution1080p, "fhd":
@@ -1456,10 +1505,14 @@ func HasFeatureV3(features []string, wanted string) bool {
 //   - subrip_sidecar_v1 picks the representation of every SRT sidecar URL.
 //     Switching it mid-attempt would publish one track under two URLs, and a
 //     seek reanchor must reproduce the frozen plan's artifact exactly.
+//   - hls_subtitle_renditions_v1 decides whether the transcode's stream URL
+//     is a multivariant playlist carrying the subtitle or a media playlist
+//     beside a sidecar. A reused HLS transport keeps the shape it was built
+//     with, so the attempt has to keep the same answer.
 //
 // Stop/start is the explicit boundary for changing any of them.
 func AttemptStickyFeaturesV3() []string {
-	return []string{FeatureHeaderAuthenticatedMediaV3, FeatureAuthorizedMediaOriginsV3, FeatureSoftwareVideoDecodeV3, FeatureSubripSidecarV3, FeatureMarkerThumbnailsV3}
+	return []string{FeatureHeaderAuthenticatedMediaV3, FeatureAuthorizedMediaOriginsV3, FeatureSoftwareVideoDecodeV3, FeatureSubripSidecarV3, FeatureMarkerThumbnailsV3, FeatureHLSSubtitleRenditionsV3}
 }
 
 // PinAttemptStickyFeaturesV3 returns requested with every attempt-sticky
diff --git a/internal/playback/protocol_v3_test.go b/internal/playback/protocol_v3_test.go
index 62939cab28..be9ecf2571 100644
--- a/internal/playback/protocol_v3_test.go
+++ b/internal/playback/protocol_v3_test.go
@@ -2244,31 +2244,6 @@ func TestResolveQualityPolicyV3HonorsBandwidthCapInAllModes(t *testing.T) {
 	}
 }
 
-func TestResolveQualityPolicyV3MeteredWithoutEvidencePrefersConservativeRung(t *testing.T) {
-	source := SourceDescriptorV3{Width: 3840, Height: 2160, BitrateKbps: 20_000}
-	req := validStartRequestV3()
-	req.QualityPreference = "auto"
-	req.Metered = true
-	result := ResolveQualityPolicyV3(req, source)
-	if result.Height != 720 || !result.RequiresTranscode || result.Reason != "quality_metered_limit" || result.ExplicitRung {
-		t.Fatalf("metered auto = %#v", result)
-	}
-
-	estimate := 30_000
-	req.BandwidthEstimateKbps = &estimate
-	result = ResolveQualityPolicyV3(req, source)
-	if !result.PreservesSource || result.Reason != "quality_bandwidth_limit" {
-		t.Fatalf("metered with estimate = %#v", result)
-	}
-
-	req.BandwidthEstimateKbps = nil
-	req.Metered = false
-	result = ResolveQualityPolicyV3(req, source)
-	if !result.PreservesSource || result.RequiresTranscode {
-		t.Fatalf("unmetered auto = %#v", result)
-	}
-}
-
 func TestPlanPlaybackV3HDRDeviceCapFallsBackToOriginalQuality(t *testing.T) {
 	file := detailedFixtureFileV3()
 	req := validStartRequestV3()
diff --git a/internal/playback/quality_ladder_test.go b/internal/playback/quality_ladder_test.go
index cea8e9f833..97dc057685 100644
--- a/internal/playback/quality_ladder_test.go
+++ b/internal/playback/quality_ladder_test.go
@@ -271,9 +271,128 @@ func TestResolveDownloadTranscodeTargetWithoutAttestedDecoder(t *testing.T) {
 	}
 }
 
-// Automatic streaming quality reads the same ladder as download presets,
-// keeping a fifth of the bandwidth estimate as headroom.
-func TestResolveQualityPolicyV3AutoUsesTheLadder(t *testing.T) {
+// Auto is best-effort direct play: without a measured estimate, or on a
+// metered link alone, it assumes the link can carry the source.
+func TestResolveQualityPolicyV3AutoWithoutAnEstimatePlaysTheSource(t *testing.T) {
+	uhd := SourceDescriptorV3{Width: 3840, Height: 2160, BitrateKbps: 40_000, FrameRate: 23.976}
+	req := validStartRequestV3()
+	req.QualityPreference = "auto"
+	req.Metered = true
+	got := ResolveQualityPolicyV3(req, uhd)
+	if !got.PreservesSource || got.RequiresTranscode || got.Reason != "quality_auto_source" {
+		t.Fatalf("auto on a metered link without an estimate = %#v, want the source", got)
+	}
+}
+
+// A source whose bitrate fits the estimate's budget is sent as-is at any
+// resolution: the estimate only lowers a source the link cannot carry.
+func TestResolveQualityPolicyV3AutoSendsASourceThatFitsTheEstimate(t *testing.T) {
+	for _, tc := range []struct {
+		name     string
+		source   SourceDescriptorV3
+		estimate int
+	}{
+		{"a 3 Mbps 1080p film on 6 Mbps", SourceDescriptorV3{Width: 1920, Height: 1080, BitrateKbps: 3_000, VideoCodec: "h264", FrameRate: 24}, 6_000},
+		{"a 3 Mbps HEVC 4K film on 10 Mbps", SourceDescriptorV3{Width: 3840, Height: 2160, BitrateKbps: 3_000, VideoCodec: "hevc", FrameRate: 24}, 10_000},
+		{"a 15 Mbps 4K film on 20 Mbps", SourceDescriptorV3{Width: 3840, Height: 2160, BitrateKbps: 15_000, VideoCodec: "hevc", FrameRate: 24}, 20_000},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			req := validStartRequestV3()
+			req.QualityPreference = "auto"
+			req.BandwidthEstimateKbps = &tc.estimate
+			got := ResolveQualityPolicyV3(req, tc.source)
+			if !got.PreservesSource || got.RequiresTranscode || got.Reason != "quality_auto_source" {
+				t.Fatalf("auto = %#v, want the source as-is", got)
+			}
+		})
+	}
+}
+
+// A fixed resolution is the viewer's explicit choice and never reads the
+// estimate.
+func TestResolveQualityPolicyV3FixedResolutionIgnoresTheEstimate(t *testing.T) {
+	req := validStartRequestV3()
+	req.QualityPreference = "1080p"
+	estimate := 2_000
+	req.BandwidthEstimateKbps = &estimate
+	got := ResolveQualityPolicyV3(req, SourceDescriptorV3{Width: 1920, Height: 1080, BitrateKbps: 30_000, VideoCodec: "h264", FrameRate: 24})
+	if !got.PreservesSource || got.RequiresTranscode {
+		t.Fatalf("1080p preference on a 2 Mbps estimate = %#v, want the 30 Mbps source as-is", got)
+	}
+}
+
+// "original" and its spellings are legacy aliases of auto.
+func TestResolveQualityPolicyV3OriginalIsAuto(t *testing.T) {
+	uhd := SourceDescriptorV3{Width: 3840, Height: 2160, BitrateKbps: 40_000, FrameRate: 23.976}
+	for _, preference := range []string{"original", " Original ", "source", "max"} {
+		if got, changed := NormalizeQualityV3(preference); got != "auto" || changed {
+			t.Fatalf("NormalizeQualityV3(%q) = %q, %v, want auto without a warning", preference, got, changed)
+		}
+		req := validStartRequestV3()
+		req.QualityPreference = preference
+		req.Capabilities.MaxResolution = "1080p"
+		got := ResolveQualityPolicyV3(req, uhd)
+		if got.Height != 1080 || !got.RequiresTranscode || got.Reason != "quality_device_limit" {
+			t.Fatalf("%q under a 1080p device = %#v, want the device limit auto applies", preference, got)
+		}
+	}
+}
+
+// Under a bitrate cap, automatic quality sends a source that fits the cap
+// as-is and re-encodes one over it at the ladder class the cap's budget earns,
+// keeping a fifth of the cap as headroom when choosing the class.
+func TestResolveQualityPolicyV3AutoUsesTheLadderUnderACap(t *testing.T) {
+	fitsCap := SourceDescriptorV3{Width: 1920, Height: 1080, BitrateKbps: 3_000, FrameRate: 24}
+	req := validStartRequestV3()
+	req.QualityPreference = "auto"
+	capKbps := 6_000
+	req.BandwidthCapKbps = &capKbps
+	if got := ResolveQualityPolicyV3(req, fitsCap); !got.PreservesSource || got.RequiresTranscode {
+		t.Fatalf("a source under the cap = %#v, want it preserved", got)
+	}
+
+	uhd := SourceDescriptorV3{Width: 3840, Height: 2160, BitrateKbps: 40_000, FrameRate: 23.976}
+	scope := SourceDescriptorV3{Width: 3840, Height: 1600, BitrateKbps: 30_000, FrameRate: 23.976}
+	uhd60 := SourceDescriptorV3{Width: 3840, Height: 2160, BitrateKbps: 40_000, FrameRate: 60}
+	for _, tc := range []struct {
+		name        string
+		source      SourceDescriptorV3
+		capKbps     int
+		wantW       int
+		wantH       int
+		wantLabel   string
+		wantBitrate int
+	}{
+		{"7 Mbps reaches 1080p", uhd, 7_000, 1920, 1080, "1080p", 6_000},
+		{"10 Mbps encodes 1080p at the class bitrate", uhd, 10_000, 1920, 1080, "1080p", 6_000},
+		{"4 Mbps is 720p", uhd, 4_000, 1280, 720, "720p", 2_000},
+		{"2 Mbps is 540p", uhd, 2_000, 960, 540, "540p", 1_800},
+		{"1 Mbps is 480p", uhd, 1_000, 854, 480, "480p", 1_000},
+		{"scope keeps its shape", scope, 10_000, 1920, 800, "800p", 6_000},
+		{"60 fps drops a class", uhd60, 7_000, 1280, 720, "720p", 2_000},
+		{"a source over the cap is re-encoded at its own size", SourceDescriptorV3{Width: 1920, Height: 1080, BitrateKbps: 8_000, FrameRate: 24}, 7_000, 1920, 1080, "1080p", 6_000},
+		{"a cropped source over the cap keeps its size and class", SourceDescriptorV3{Width: 1920, Height: 800, BitrateKbps: 8_000, FrameRate: 24}, 7_000, 1920, 800, "800p", 6_000},
+		{"a 4:3 source over the cap keeps its size", SourceDescriptorV3{Width: 1280, Height: 960, BitrateKbps: 8_000, FrameRate: 24}, 7_000, 1280, 960, "960p", 6_000},
+		{"a 720p source over the cap keeps the 720p bitrate", SourceDescriptorV3{Width: 1280, Height: 720, BitrateKbps: 8_000, FrameRate: 24}, 7_000, 1280, 720, "720p", 2_000},
+		{"an odd source frame is re-encoded at an even size", SourceDescriptorV3{Width: 1920, Height: 1079, BitrateKbps: 8_000, FrameRate: 24}, 7_000, 1918, 1078, "1078p", 6_000},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			req := validStartRequestV3()
+			req.QualityPreference = "auto"
+			req.BandwidthCapKbps = &tc.capKbps
+			got := ResolveQualityPolicyV3(req, tc.source)
+			if got.Width != tc.wantW || got.Height != tc.wantH || got.Label != tc.wantLabel || got.BitrateKbps != tc.wantBitrate || !got.RequiresTranscode {
+				t.Fatalf("auto under a %d kbps cap = %dx%d %q %d kbps (transcode %v), want %dx%d %q %d kbps",
+					tc.capKbps, got.Width, got.Height, got.Label, got.BitrateKbps, got.RequiresTranscode, tc.wantW, tc.wantH, tc.wantLabel, tc.wantBitrate)
+			}
+		})
+	}
+}
+
+// Automatic streaming quality reads the same ladder as download presets for a
+// source over the estimate's budget, keeping a fifth of the estimate as
+// headroom.
+func TestResolveQualityPolicyV3AutoUsesTheLadderForAnEstimate(t *testing.T) {
 	fitsBudget := SourceDescriptorV3{Width: 1920, Height: 1080, BitrateKbps: 5_000, FrameRate: 24}
 	req := validStartRequestV3()
 	req.QualityPreference = "auto"
@@ -307,7 +426,6 @@ func TestResolveQualityPolicyV3AutoUsesTheLadder(t *testing.T) {
 		{"a 4:3 source over the budget keeps its size", SourceDescriptorV3{Width: 1280, Height: 960, BitrateKbps: 8_000, FrameRate: 24}, 7_000, 1280, 960, "960p", 5_600},
 		{"a 720p source over the budget keeps the 720p bitrate", SourceDescriptorV3{Width: 1280, Height: 720, BitrateKbps: 8_000, FrameRate: 24}, 7_000, 1280, 720, "720p", 2_000},
 		{"an odd source frame is re-encoded at an even size", SourceDescriptorV3{Width: 1920, Height: 1079, BitrateKbps: 8_000, FrameRate: 24}, 7_000, 1918, 1078, "1078p", 5_600},
-		{"a scaled transcode never exceeds the source's bitrate", SourceDescriptorV3{Width: 3840, Height: 2160, VideoCodec: "hevc", BitrateKbps: 3_000, FrameRate: 24}, 10_000, 1920, 1080, "1080p", 5_000},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			req := validStartRequestV3()
@@ -322,21 +440,6 @@ func TestResolveQualityPolicyV3AutoUsesTheLadder(t *testing.T) {
 	}
 }
 
-// An original-quality route that still transcodes keeps the source frame.
-func TestOriginalQualityResultKeepsTheSourceHeight(t *testing.T) {
-	got := originalQualityResultV3(SourceDescriptorV3{Width: 3840, Height: 1600})
-	if got.Label != "1600p" || resolutionToScale(got.Label) != "scale=-2:1600" {
-		t.Fatalf("original label = %q (scale %q), want 1600p", got.Label, resolutionToScale(got.Label))
-	}
-	if got := originalQualityResultV3(SourceDescriptorV3{}); got.Label != "" {
-		t.Fatalf("unknown source height label = %q, want no scale", got.Label)
-	}
-	// An odd height still scales, to the even height 4:2:0 output needs.
-	if got := originalQualityResultV3(SourceDescriptorV3{Width: 1920, Height: 1081}); got.Label != "1080p" || resolutionToScale(got.Label) != "scale=-2:1080" || got.Width != 1918 || got.Height != 1080 {
-		t.Fatalf("odd source = %q %dx%d (scale %q), want 1080p 1918x1080", got.Label, got.Width, got.Height, resolutionToScale(got.Label))
-	}
-}
-
 // A source of unknown bitrate is sent as-is only when the estimate's budget
 // covers its class's full bitrate; otherwise it is re-encoded at its own size.
 func TestResolveQualityPolicyV3AutoUnknownSourceBitrate(t *testing.T) {
@@ -367,6 +470,32 @@ func TestResolveQualityPolicyV3AutoUnknownSourceBitrate(t *testing.T) {
 	}
 }
 
+// A scaled transcode never asks for more bits than the whole source used.
+func TestResolveQualityPolicyV3ScaledTranscodeStaysUnderTheSourceBitrate(t *testing.T) {
+	req := validStartRequestV3()
+	req.QualityPreference = "auto"
+	req.Capabilities.MaxResolution = "1080p"
+	got := ResolveQualityPolicyV3(req, SourceDescriptorV3{Width: 3840, Height: 2160, VideoCodec: "hevc", BitrateKbps: 3_000, FrameRate: 24})
+	if got.Height != 1080 || got.BitrateKbps != 5_000 || !got.RequiresTranscode {
+		t.Fatalf("a 3 Mbps HEVC 4K source on a 1080p device = %dp at %d kbps (transcode %v), want 1080p at 5000 kbps", got.Height, got.BitrateKbps, got.RequiresTranscode)
+	}
+}
+
+// An original-quality route that still transcodes keeps the source frame.
+func TestOriginalQualityResultKeepsTheSourceHeight(t *testing.T) {
+	got := originalQualityResultV3(SourceDescriptorV3{Width: 3840, Height: 1600})
+	if got.Label != "1600p" || resolutionToScale(got.Label) != "scale=-2:1600" {
+		t.Fatalf("original label = %q (scale %q), want 1600p", got.Label, resolutionToScale(got.Label))
+	}
+	if got := originalQualityResultV3(SourceDescriptorV3{}); got.Label != "" {
+		t.Fatalf("unknown source height label = %q, want no scale", got.Label)
+	}
+	// An odd height still scales, to the even height 4:2:0 output needs.
+	if got := originalQualityResultV3(SourceDescriptorV3{Width: 1920, Height: 1081}); got.Label != "1080p" || resolutionToScale(got.Label) != "scale=-2:1080" || got.Width != 1918 || got.Height != 1080 {
+		t.Fatalf("odd source = %q %dx%d (scale %q), want 1080p 1918x1080", got.Label, got.Width, got.Height, resolutionToScale(got.Label))
+	}
+}
+
 // A bandwidth cap is a hard ceiling: a source of unknown bitrate cannot be
 // shown to fit it, so it is re-encoded under the cap even when its class fits.
 func TestResolveQualityPolicyV3CapWithUnknownSourceBitrate(t *testing.T) {
@@ -403,3 +532,98 @@ func TestLadderClassForSize(t *testing.T) {
 		}
 	}
 }
+
+func TestH264EquivalentKbps(t *testing.T) {
+	for _, tc := range []struct {
+		name     string
+		srcKbps  int
+		srcCodec string
+		want     int
+	}{
+		{"an H.264 source keeps its rate", 12000, "h264", 12000},
+		{"an HEVC source counts at its H.264-equivalent rate", 12000, "hevc", 20000},
+		{"an unknown source rate", 0, "h264", 0},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := H264EquivalentKbps(tc.srcKbps, tc.srcCodec); got != tc.want {
+				t.Errorf("H264EquivalentKbps(%d, %q) = %d, want %d", tc.srcKbps, tc.srcCodec, got, tc.want)
+			}
+		})
+	}
+}
+
+// Auto and an explicit resolution direct play whenever the device and the
+// viewer's limits allow: the original file goes out byte for byte, and only a
+// source the measured link cannot carry, or one above the chosen resolution,
+// is converted.
+func TestPlanPlaybackV3DirectPlaysWhateverTheLimitsAllow(t *testing.T) {
+	remux1080 := &models.MediaFile{ID: 42, FilePath: "/media/remux.mkv", Container: "mkv", CodecVideo: "h264", CodecAudio: "aac", Resolution: "1080p", Bitrate: 30_000, AudioChannels: 2,
+		VideoTracks: []models.VideoTrack{{Codec: "h264", Profile: "High", Level: 41, Width: 1920, Height: 1080, FrameRate: "24000/1001", Bitrate: 30_000, BitDepth: 8, VideoRange: "SDR"}},
+		AudioTracks: []models.AudioTrack{{Codec: "aac", Channels: 2, Layout: "stereo"}}}
+	web4K := &models.MediaFile{ID: 43, FilePath: "/media/web.mkv", Container: "mkv", CodecVideo: "hevc", CodecAudio: "aac", Resolution: "2160p", Bitrate: 15_000, AudioChannels: 2,
+		VideoTracks: []models.VideoTrack{{Codec: "hevc", Profile: "Main", Level: 150, Width: 3840, Height: 2160, FrameRate: "24000/1001", Bitrate: 15_000, BitDepth: 8, VideoRange: "SDR"}},
+		AudioTracks: []models.AudioTrack{{Codec: "aac", Channels: 2, Layout: "stereo"}}}
+	for _, tc := range []struct {
+		name       string
+		file       *models.MediaFile
+		quality    string
+		estimate   int
+		capKbps    int
+		wantDirect bool
+		wantHeight int
+	}{
+		{name: "auto without an estimate", file: remux1080, quality: "auto", wantDirect: true},
+		{name: "auto on a link that carries the source", file: remux1080, quality: "auto", estimate: 50_000, wantDirect: true},
+		{name: "auto on a link that cannot", file: remux1080, quality: "auto", estimate: 8_000, wantHeight: 1080},
+		{name: "auto under a cap the source fits", file: remux1080, quality: "auto", capKbps: 40_000, wantDirect: true},
+		{name: "the legacy original preference", file: web4K, quality: "original", wantDirect: true},
+		{name: "1080p ignores a low estimate", file: remux1080, quality: "1080p", estimate: 2_000, wantDirect: true},
+		{name: "4K ignores a low estimate", file: web4K, quality: "2160p", estimate: 2_000, wantDirect: true},
+		{name: "1080p converts a 4K source", file: web4K, quality: "1080p", wantHeight: 1080},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			req := validStartRequestV3()
+			req.FileID = tc.file.ID
+			req.QualityPreference = tc.quality
+			req.Capabilities.CodecsVideo = []string{"h264", "hevc"}
+			req.Capabilities.VideoDecode = []VideoDecodeCapabilityV3{
+				{Codec: "h264", Profiles: []string{"high"}, Levels: []int{51}, BitDepths: []int{8}, MaxWidth: 3840, MaxHeight: 2160, MaxFrameRate: 60, MaxBitrateKbps: 100_000, Hardware: true},
+				{Codec: "hevc", Profiles: []string{"main"}, Levels: []int{153}, BitDepths: []int{8}, MaxWidth: 3840, MaxHeight: 2160, MaxFrameRate: 60, MaxBitrateKbps: 100_000, Hardware: true},
+			}
+			if tc.estimate > 0 {
+				req.BandwidthEstimateKbps = &tc.estimate
+			}
+			if tc.capKbps > 0 {
+				req.BandwidthCapKbps = &tc.capKbps
+			}
+			result := PlanPlaybackV3(PlannerInputV3{Request: req, RequestedFile: tc.file, EffectiveFile: tc.file, Settings: PlannerSettingsV3{TranscodeEnabled: true, Allow4KTranscode: true}, Registry: testTransformationRegistryV3()})
+			if result.Plan == nil {
+				t.Fatalf("no plan: %s", ExplainPlannerResultV3(result))
+			}
+			if tc.wantDirect {
+				if result.Plan.Delivery != DeliveryOriginalHTTPV3 {
+					t.Fatalf("delivery = %s, want the original file: %s", result.Plan.Delivery, ExplainPlannerResultV3(result))
+				}
+				return
+			}
+			if result.Plan.Delivery != DeliveryTranscodeHLSV3 || result.Plan.EffectiveRecipe.Height == nil || *result.Plan.EffectiveRecipe.Height != tc.wantHeight {
+				t.Fatalf("plan = %s, want a %dp transcode", ExplainPlannerResultV3(result), tc.wantHeight)
+			}
+		})
+	}
+}
+
+// An encode the device already requires stays within a measured estimate even
+// though the source itself would fit it: a 3 Mbps HEVC 4K source on a 1080p
+// device and a 4 Mbps link drops to the class the estimate earns.
+func TestResolveQualityPolicyV3DeviceEncodeStaysWithinTheEstimate(t *testing.T) {
+	req := validStartRequestV3()
+	req.QualityPreference = "auto"
+	req.Capabilities.MaxResolution = "1080p"
+	estimate := 4_000
+	req.BandwidthEstimateKbps = &estimate
+	got := ResolveQualityPolicyV3(req, SourceDescriptorV3{Width: 3840, Height: 2160, VideoCodec: "hevc", BitrateKbps: 3_000, FrameRate: 24})
+	if !got.RequiresTranscode || got.Height != 720 || got.BitrateKbps > 3_200 {
+		t.Fatalf("device-limited encode on a 4 Mbps link = %dp at %d kbps (transcode %v), want 720p within 3200 kbps", got.Height, got.BitrateKbps, got.RequiresTranscode)
+	}
+}
diff --git a/internal/playback/recipecard.go b/internal/playback/recipecard.go
index 2bfa2607de..68b5299730 100644
--- a/internal/playback/recipecard.go
+++ b/internal/playback/recipecard.go
@@ -65,6 +65,21 @@ type RecipeCard struct {
 	ClientUserAgent  string `json:"client_user_agent,omitempty"`
 	IsJellyfinCompat bool   `json:"is_jellyfin_compat,omitempty"`
 
+	// Header-authenticated recovery. A session that negotiated
+	// header_authenticated_media_v1 publishes no stream token, so the API keeps
+	// its recipe server-side instead (see noderecipe.NewSessionRecipeStore).
+	// These fields exist only on that stored copy and are never projected into
+	// stream-token claims. PlanID binds the card to the v3 plan it was committed
+	// under, so a card a later replan failed to overwrite cannot rebuild a
+	// superseded transport. RequireMediaAuthorization carries the mode onto the
+	// rebuilt session, whose UUID must stay a route identifier rather than a
+	// bearer. RequestedMediaFileID and DisableProgressPersistence are the live
+	// session's when the card is written, so the rebuilt session keeps them.
+	PlanID                     string `json:"plan_id,omitempty"`
+	RequireMediaAuthorization  bool   `json:"require_media_authorization,omitempty"`
+	RequestedMediaFileID       int    `json:"requested_media_file_id,omitempty"`
+	DisableProgressPersistence bool   `json:"disable_progress_persistence,omitempty"`
+
 	// Encode parameters — mirror of the byte-affecting TranscodeOpts fields.
 	// Direct cards leave them zero; remux cards use the audio targets when the
 	// selected stream must be converted.
@@ -97,6 +112,7 @@ type RecipeCard struct {
 	VideoBitstreamFilter       string                 `json:"video_bitstream_filter,omitempty"`
 	VideoSampleEntry           string                 `json:"video_sample_entry,omitempty"`
 	CopyVideoMPEGTS            bool                   `json:"copy_video_mpegts,omitempty"`
+	KeyframePlaylist           bool                   `json:"keyframe_playlist,omitempty"`
 	SeekSeconds                float64                `json:"seek_seconds"`
 	StreamOriginSeconds        float64                `json:"stream_origin_seconds,omitempty"`
 	CopySeekAnchorResolved     bool                   `json:"copy_seek_anchor_resolved,omitempty"`
@@ -113,6 +129,7 @@ type RecipeCard struct {
 	SubtitleTrackIndex         int                    `json:"subtitle_track_index"`
 	SubtitleBurnIn             bool                   `json:"subtitle_burn_in,omitempty"`
 	SubtitleCodec              string                 `json:"subtitle_codec,omitempty"`
+	SubtitleRendition          bool                   `json:"subtitle_rendition,omitempty"`
 	AudioTrackIndex            int                    `json:"audio_track_index"`
 	TargetBitrateKbps          int                    `json:"target_bitrate_kbps,omitempty"`
 	TotalDuration              float64                `json:"total_duration"`
@@ -201,6 +218,7 @@ func NewRecipeCard(userID int, profileID string, mediaFileID int, transcodeNodeU
 		VideoBitstreamFilter:       opts.VideoBitstreamFilter,
 		VideoSampleEntry:           opts.VideoSampleEntry,
 		CopyVideoMPEGTS:            opts.CopyVideoMPEGTS,
+		KeyframePlaylist:           opts.KeyframePlaylist,
 		SeekSeconds:                opts.SeekSeconds,
 		StreamOriginSeconds:        opts.StreamOriginSeconds,
 		CopySeekAnchorResolved:     opts.CopySeekAnchorResolved,
@@ -217,6 +235,7 @@ func NewRecipeCard(userID int, profileID string, mediaFileID int, transcodeNodeU
 		SubtitleTrackIndex:         opts.SubtitleTrackIndex,
 		SubtitleBurnIn:             opts.SubtitleBurnIn,
 		SubtitleCodec:              opts.SubtitleCodec,
+		SubtitleRendition:          opts.SubtitleRendition,
 		AudioTrackIndex:            opts.AudioTrackIndex,
 		TargetBitrateKbps:          opts.TargetBitrateKbps,
 		TotalDuration:              opts.TotalDuration,
@@ -303,6 +322,7 @@ func (c RecipeCard) TranscodeOpts(outputDir, ffmpegPath string, logSink FFmpegLo
 		VideoBitstreamFilter:       c.VideoBitstreamFilter,
 		VideoSampleEntry:           c.VideoSampleEntry,
 		CopyVideoMPEGTS:            c.CopyVideoMPEGTS,
+		KeyframePlaylist:           c.KeyframePlaylist,
 		SeekSeconds:                c.SeekSeconds,
 		StreamOriginSeconds:        c.StreamOriginSeconds,
 		CopySeekAnchorResolved:     c.CopySeekAnchorResolved,
@@ -320,6 +340,7 @@ func (c RecipeCard) TranscodeOpts(outputDir, ffmpegPath string, logSink FFmpegLo
 		SubtitleTrackIndex:         c.SubtitleTrackIndex,
 		SubtitleBurnIn:             c.SubtitleBurnIn,
 		SubtitleCodec:              c.SubtitleCodec,
+		SubtitleRendition:          c.SubtitleRendition,
 		AudioTrackIndex:            c.AudioTrackIndex,
 		TargetBitrateKbps:          c.TargetBitrateKbps,
 		TotalDuration:              c.TotalDuration,
@@ -415,6 +436,7 @@ func (c RecipeCard) ToClaims() streamtoken.Claims {
 		VideoBitstreamFilter:       c.VideoBitstreamFilter,
 		VideoSampleEntry:           c.VideoSampleEntry,
 		CopyVideoMPEGTS:            c.CopyVideoMPEGTS,
+		KeyframePlaylist:           c.KeyframePlaylist,
 		SeekSeconds:                c.SeekSeconds,
 		StreamOriginSeconds:        c.StreamOriginSeconds,
 		CopySeekAnchorResolved:     c.CopySeekAnchorResolved,
@@ -423,6 +445,7 @@ func (c RecipeCard) ToClaims() streamtoken.Claims {
 		SubtitleTrackIndex:         c.SubtitleTrackIndex,
 		SubtitleBurnIn:             c.SubtitleBurnIn,
 		SubtitleCodec:              c.SubtitleCodec,
+		SubtitleRendition:          c.SubtitleRendition,
 		TargetBitrateKbps:          c.TargetBitrateKbps,
 		TotalDuration:              c.TotalDuration,
 		FastStart:                  c.FastStart,
@@ -501,6 +524,7 @@ func RecipeCardFromClaims(c *streamtoken.Claims) RecipeCard {
 		VideoBitstreamFilter:          c.VideoBitstreamFilter,
 		VideoSampleEntry:              c.VideoSampleEntry,
 		CopyVideoMPEGTS:               c.CopyVideoMPEGTS,
+		KeyframePlaylist:              c.KeyframePlaylist,
 		SeekSeconds:                   c.SeekSeconds,
 		StreamOriginSeconds:           c.StreamOriginSeconds,
 		CopySeekAnchorResolved:        c.CopySeekAnchorResolved,
@@ -514,6 +538,7 @@ func RecipeCardFromClaims(c *streamtoken.Claims) RecipeCard {
 		SubtitleTrackIndex:            c.SubtitleTrackIndex,
 		SubtitleBurnIn:                c.SubtitleBurnIn,
 		SubtitleCodec:                 c.SubtitleCodec,
+		SubtitleRendition:             c.SubtitleRendition,
 		AudioTrackIndex:               c.AudioTrackIndex,
 		TargetBitrateKbps:             c.TargetBitrateKbps,
 		TotalDuration:                 c.TotalDuration,
diff --git a/internal/playback/recipecard_test.go b/internal/playback/recipecard_test.go
index cdaa863f2a..0ad752760b 100644
--- a/internal/playback/recipecard_test.go
+++ b/internal/playback/recipecard_test.go
@@ -159,6 +159,19 @@ func TestRecipeCardPreservesCopyVideoMPEGTS(t *testing.T) {
 	}
 }
 
+// A rebuilt session must keep serving the keyframe playlist the player has.
+func TestRecipeCardPreservesKeyframePlaylist(t *testing.T) {
+	card := NewRecipeCard(42, "profile-1", 77, "", TranscodeOpts{
+		SessionID: "planned", TargetCodecVideo: "copy", TargetCodecAudio: "copy", KeyframePlaylist: true,
+	})
+	if !card.TranscodeOpts(t.TempDir(), "/usr/bin/ffmpeg", nil).KeyframePlaylist {
+		t.Fatal("stored recipe lost the keyframe playlist")
+	}
+	if back := RecipeCardFromClaims(ptr(card.ToClaims())); !back.KeyframePlaylist {
+		t.Fatal("stream-token recipe lost the keyframe playlist")
+	}
+}
+
 func TestRecipeCardNetworkRouteSurvivesRecovery(t *testing.T) {
 	for _, provider := range []*string{nil, new(""), new("tailscale")} {
 		card := NewDirectRecipeCard("network-route", 42, "profile-1", 77)
diff --git a/internal/playback/remote_delete_signing_test.go b/internal/playback/remote_delete_signing_test.go
new file mode 100644
index 0000000000..5f9115ad8b
--- /dev/null
+++ b/internal/playback/remote_delete_signing_test.go
@@ -0,0 +1,31 @@
+package playback
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
+)
+
+func TestDeleteRemoteTranscodeSignsTheRequest(t *testing.T) {
+	const secret = "delete-secret"
+	var signed atomic.Bool
+	node := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method == http.MethodDelete && r.URL.Path == "/transcode/session-1" {
+			signed.Store(nodeauthtest.Signed(r, secret))
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}))
+	t.Cleanup(node.Close)
+
+	manager := NewTranscodeManager()
+	manager.JWTSecretFn = func() string { return secret }
+	if err := manager.deleteRemoteTranscode(t.Context(), "session-1", node.URL); err != nil {
+		t.Fatalf("deleteRemoteTranscode: %v", err)
+	}
+	if !signed.Load() {
+		t.Fatal("remote DELETE was not signed with the shared secret")
+	}
+}
diff --git a/internal/playback/session.go b/internal/playback/session.go
index 58f57ff606..6c7a9bc1ed 100644
--- a/internal/playback/session.go
+++ b/internal/playback/session.go
@@ -51,9 +51,9 @@ type Session struct {
 	IsJellyfinCompat              bool   // immutable origin identity for Jellyfin compatibility sessions
 	// RequireMediaAuthorization distinguishes v3 transports whose session ID is
 	// only a route identifier from legacy HLS transports where that UUID also
-	// acts as the bearer capability. It is live-session state by design: secure
-	// transports carry no reconstruction token and start a fresh attempt after
-	// an API restart.
+	// acts as the bearer capability. Secure transports carry no reconstruction
+	// token; a session rebuilt from the API's server-side recovery card gets the
+	// flag back from that card (RecipeCard.RequireMediaAuthorization).
 	RequireMediaAuthorization bool
 
 	TranscodeNodeURL     string // URL of assigned transcode node (empty = local/integrated)
@@ -114,6 +114,12 @@ type Session struct {
 	activeTransportCount       int
 	replacementPlayMethod      PlayMethod
 	streamRevision             uint64
+	// confirmedPauseSequence fences progress already accepted when a realtime
+	// pause state was confirmed; replaying it must not undo that confirmation.
+	confirmedPauseSequence int64
+	// positionSequence is the latest accepted progress sequence the live
+	// position reflects or supersedes (a sample, or a seek planned after it).
+	positionSequence int64
 	// remoteTransport marks a session whose media bytes are served by another
 	// node, so this server never sees the transport request that would
 	// otherwise keep it alive. See SetRemoteTransport.
@@ -201,8 +207,14 @@ type SessionReplacement struct {
 	EffectiveMediaFileID int
 	StreamState          SessionStreamState
 	PositionSeconds      *float64
-	IsPaused             bool
-	PreservePaused       bool
+	// PositionSequence is the latest accepted progress sequence when the
+	// replacement was planned; PositionSeconds supersedes samples up to it.
+	// A sample another replica accepts after that read but before the
+	// replacement applies still counts as newer, so a realtime confirmation
+	// may show its pre-seek position until the player's next report.
+	PositionSequence int64
+	IsPaused         bool
+	PreservePaused   bool
 }
 
 // SessionReplacementRollback is an opaque compare-and-swap token returned by
@@ -215,6 +227,7 @@ type SessionReplacementRollback struct {
 	previousStreamState          SessionStreamState
 	previousPosition             float64
 	previousPaused               bool
+	previousPositionSequence     int64
 	restoreProgress              bool
 	previousReplacementMethod    PlayMethod
 }
@@ -974,6 +987,16 @@ func transcodingDisabledError(requiresVideoTranscode, requiresAudioTranscode boo
 
 // UpdateProgress updates the playback position and pause state for a session.
 func (m *SessionManager) UpdateProgress(sessionID string, position float64, isPaused bool) error {
+	return m.updateProgress(sessionID, position, isPaused, -1)
+}
+
+// UpdateProgressSample keeps a confirmed pause state when an already accepted
+// sequenced sample is replayed. Position and activity still persist normally.
+func (m *SessionManager) UpdateProgressSample(sessionID string, sample ProgressSampleV3) error {
+	return m.updateProgress(sessionID, sample.Position, sample.IsPaused, sample.Sequence)
+}
+
+func (m *SessionManager) updateProgress(sessionID string, position float64, isPaused bool, sequence int64) error {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 
@@ -983,13 +1006,48 @@ func (m *SessionManager) UpdateProgress(sessionID string, position float64, isPa
 	}
 
 	s.Position = position
-	s.IsPaused = isPaused
+	s.positionSequence = max(s.positionSequence, sequence)
+	if sequence < 0 || sequence > s.confirmedPauseSequence {
+		s.IsPaused = isPaused
+	}
 	s.StopReported = false
 	s.streamRevision++
 	m.touchSessionLocked(s)
 	return nil
 }
 
+// SetPaused records the pause state the player confirmed for a remote pause
+// or resume. A non-nil latest is the latest accepted progress, which another
+// replica may have accepted without this live session seeing it; its position
+// replaces the live one unless the live position already reflects it or a
+// later seek. It reports whether the pause state changed.
+func (m *SessionManager) SetPaused(sessionID string, paused bool, acceptedSequence int64, latest *ProgressSampleV3) (bool, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	s, ok := m.sessions[sessionID]
+	if !ok {
+		return false, ErrSessionNotFound
+	}
+	s.confirmedPauseSequence = max(s.confirmedPauseSequence, acceptedSequence)
+	moved := false
+	if latest != nil && latest.Sequence > s.positionSequence {
+		s.positionSequence = latest.Sequence
+		moved = s.Position != latest.Position
+		s.Position = latest.Position
+	}
+	if s.IsPaused == paused {
+		if moved {
+			s.streamRevision++
+		}
+		return false, nil
+	}
+	s.IsPaused = paused
+	s.streamRevision++
+	m.touchSessionLocked(s)
+	return true, nil
+}
+
 // MarkStopReported records that a client reported this session stopped
 // without an ID that could end it. It does not count as activity and leaves
 // pause state alone; see Session.StopReported.
@@ -1271,6 +1329,7 @@ func (m *SessionManager) applyReplacementLocked(
 	if replacement.PositionSeconds != nil {
 		rollback.previousPosition = s.Position
 		rollback.previousPaused = s.IsPaused
+		rollback.previousPositionSequence = s.positionSequence
 		rollback.restoreProgress = true
 	}
 
@@ -1281,6 +1340,7 @@ func (m *SessionManager) applyReplacementLocked(
 	applySessionStreamStateLocked(s, replacement.StreamState)
 	if replacement.PositionSeconds != nil {
 		s.Position = *replacement.PositionSeconds
+		s.positionSequence = max(s.positionSequence, replacement.PositionSequence)
 		if !replacement.PreservePaused {
 			s.IsPaused = replacement.IsPaused
 		}
@@ -1311,6 +1371,7 @@ func (m *SessionManager) RollbackReplacement(sessionID string, rollback SessionR
 	if rollback.restoreProgress {
 		s.Position = rollback.previousPosition
 		s.IsPaused = rollback.previousPaused
+		s.positionSequence = rollback.previousPositionSequence
 	}
 	s.replacementPlayMethod = rollback.previousReplacementMethod
 	s.streamRevision++
@@ -1415,6 +1476,57 @@ func (m *SessionManager) SetTranscodeRoute(sessionID string, route TranscodeRout
 	return nil
 }
 
+// TranscodeExecutorMove is the new executor for a running transcode whose
+// previous executor stopped answering. The transport identity, the egress, and
+// every byte-affecting field stay as they were: only where FFmpeg runs changes.
+type TranscodeExecutorMove struct {
+	// NodeURL is the transcode node now running the transport, or empty when
+	// this API process runs it.
+	NodeURL string
+	// Execution and ExecutionNodeID are the routing vocabulary for the new
+	// executor. They are applied only to a session that already carries a
+	// committed routing assignment.
+	Execution       string
+	ExecutionNodeID int
+	// TranscodeHWAccel is the encoder backend the new executor reported. Empty
+	// keeps the previous value.
+	TranscodeHWAccel string
+}
+
+// MoveTranscodeExecutor re-points a live transcode at a new executor only while
+// the session still serves expected. It reports false, changing nothing, when a
+// replan or another move already replaced that route, so a stale move can never
+// overwrite a newer one. The check covers this process only: the moved route
+// is not shared with other API processes, and a session rebuilt from its
+// stream token still names the old node.
+func (m *SessionManager) MoveTranscodeExecutor(sessionID string, expected TranscodeRoute, move TranscodeExecutorMove) (bool, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	s, ok := m.sessions[sessionID]
+	if !ok {
+		return false, ErrSessionNotFound
+	}
+	if s.TranscodeNodeURL != expected.NodeURL || s.TranscodeTransportID != expected.TransportID {
+		return false, nil
+	}
+	s.TranscodeNodeURL = move.NodeURL
+	// A session without a routing assignment predates node routing. Writing
+	// only the execution half would read as a partially committed route, which
+	// the serve paths refuse.
+	if s.RoutingWorkload != "" {
+		s.RoutingExecution = move.Execution
+		s.RoutingExecutionNodeID = move.ExecutionNodeID
+		s.RoutingExecutionNodeURL = move.NodeURL
+	}
+	if move.TranscodeHWAccel != "" {
+		s.TranscodeHWAccel = move.TranscodeHWAccel
+	}
+	s.streamRevision++
+	m.touchSessionLocked(s)
+	return true, nil
+}
+
 // SetRealtimeConnection marks whether a realtime control connection is active for a session.
 func (m *SessionManager) SetRealtimeConnection(sessionID string, connected bool) error {
 	m.mu.Lock()
diff --git a/internal/playback/session_test.go b/internal/playback/session_test.go
index f4ce4494b2..622c3a8707 100644
--- a/internal/playback/session_test.go
+++ b/internal/playback/session_test.go
@@ -1387,3 +1387,126 @@ func TestUpdateStreamStateClearsRemuxDVModeOnRouteSet(t *testing.T) {
 		t.Fatalf("RemuxDVMode after route-set update = %q, want cleared", got.RemuxDVMode)
 	}
 }
+
+func TestSessionManagerSetPausedReportsChanges(t *testing.T) {
+	m := playback.NewSessionManager(0, 0)
+	s, err := m.StartSession(1, "profile-1", 100, playback.PlayDirect, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := m.UpdateProgress(s.ID, 42, false); err != nil {
+		t.Fatal(err)
+	}
+	if changed, err := m.SetPaused(s.ID, true, 0, nil); err != nil || !changed {
+		t.Fatalf("pause = %v, %v", changed, err)
+	}
+	if changed, err := m.SetPaused(s.ID, true, 0, nil); err != nil || changed {
+		t.Fatalf("repeat pause = %v, %v", changed, err)
+	}
+	current, err := m.GetSession(s.ID)
+	if err != nil || !current.IsPaused || current.Position != 42 {
+		t.Fatalf("session = %+v, %v", current, err)
+	}
+	if _, err := m.SetPaused("missing", true, 0, nil); !errors.Is(err, playback.ErrSessionNotFound) {
+		t.Fatalf("missing session err = %v", err)
+	}
+}
+
+func TestSessionManagerConfirmedPauseFencesOnlyAcceptedSamples(t *testing.T) {
+	m := playback.NewSessionManager(0, 0)
+	s, err := m.StartSession(1, "profile-1", 100, playback.PlayDirect, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := m.SetPaused(s.ID, true, 1, nil); err != nil {
+		t.Fatal(err)
+	}
+	// Even a confirmation of the same state advances the fence.
+	if changed, err := m.SetPaused(s.ID, true, 2, nil); err != nil || changed {
+		t.Fatalf("same-state confirmation = %v, %v", changed, err)
+	}
+	if err := m.UpdateProgressSample(s.ID, playback.ProgressSampleV3{Sequence: 2, Position: 42}); err != nil {
+		t.Fatal(err)
+	}
+	current, err := m.GetSession(s.ID)
+	if err != nil || !current.IsPaused || current.Position != 42 {
+		t.Fatalf("accepted sample replay = %+v, %v", current, err)
+	}
+	if err := m.UpdateProgressSample(s.ID, playback.ProgressSampleV3{Sequence: 3, Position: 43}); err != nil {
+		t.Fatal(err)
+	}
+	// An older/default sequence cannot weaken the earlier fence.
+	if _, err := m.SetPaused(s.ID, false, 0, nil); err != nil {
+		t.Fatal(err)
+	}
+	if err := m.UpdateProgressSample(s.ID, playback.ProgressSampleV3{Sequence: 2, Position: 44, IsPaused: true}); err != nil {
+		t.Fatal(err)
+	}
+	current, err = m.GetSession(s.ID)
+	if err != nil || current.IsPaused || current.Position != 44 {
+		t.Fatalf("newer progress and retained fence = %+v, %v", current, err)
+	}
+}
+
+// A seek planned after accepted progress supersedes it: a confirmation that
+// offers that same sample must not move the live position back.
+func TestSessionManagerConfirmedPauseKeepsLaterSeekPosition(t *testing.T) {
+	m := playback.NewSessionManager(0, 0)
+	s, err := m.StartSession(1, "profile-1", 100, playback.PlayDirect, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := m.UpdateProgressSample(s.ID, playback.ProgressSampleV3{Sequence: 1, Position: 30}); err != nil {
+		t.Fatal(err)
+	}
+	// Another replica accepted sequence 2; the seek was planned after it.
+	seek := 321.0
+	rollback, err := m.ApplyReplacement(s.ID, playback.SessionReplacement{EffectiveMediaFileID: 100, PositionSeconds: &seek, PositionSequence: 2, PreservePaused: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := m.SetPaused(s.ID, true, 2, &playback.ProgressSampleV3{Sequence: 2, Position: 31}); err != nil {
+		t.Fatal(err)
+	}
+	current, err := m.GetSession(s.ID)
+	if err != nil || !current.IsPaused || current.Position != 321 {
+		t.Fatalf("after superseded sample = %+v, %v; want paused at seek position 321", current, err)
+	}
+	if err := m.RollbackReplacement(s.ID, rollback); !errors.Is(err, playback.ErrSessionReplacementSuperseded) {
+		t.Fatalf("rollback after confirmation err = %v, want superseded", err)
+	}
+	if _, err := m.SetPaused(s.ID, false, 3, &playback.ProgressSampleV3{Sequence: 3, Position: 325}); err != nil {
+		t.Fatal(err)
+	}
+	current, err = m.GetSession(s.ID)
+	if err != nil || current.IsPaused || current.Position != 325 {
+		t.Fatalf("after newer sample = %+v, %v; want playing at 325", current, err)
+	}
+}
+
+func TestSessionManagerReplacementRollbackRestoresPositionSequence(t *testing.T) {
+	m := playback.NewSessionManager(0, 0)
+	s, err := m.StartSession(1, "profile-1", 100, playback.PlayDirect, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := m.UpdateProgressSample(s.ID, playback.ProgressSampleV3{Sequence: 1, Position: 30}); err != nil {
+		t.Fatal(err)
+	}
+	seek := 321.0
+	rollback, err := m.ApplyReplacement(s.ID, playback.SessionReplacement{EffectiveMediaFileID: 100, PositionSeconds: &seek, PositionSequence: 2})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := m.RollbackReplacement(s.ID, rollback); err != nil {
+		t.Fatal(err)
+	}
+	// With the seek rolled back, sequence 2 is newer than the live position.
+	if _, err := m.SetPaused(s.ID, true, 2, &playback.ProgressSampleV3{Sequence: 2, Position: 31}); err != nil {
+		t.Fatal(err)
+	}
+	current, err := m.GetSession(s.ID)
+	if err != nil || current.Position != 31 {
+		t.Fatalf("after rollback = %+v, %v; want replica position 31", current, err)
+	}
+}
diff --git a/internal/playback/subtitle_cache.go b/internal/playback/subtitle_cache.go
index 57792881dc..fc875178d3 100644
--- a/internal/playback/subtitle_cache.go
+++ b/internal/playback/subtitle_cache.go
@@ -235,6 +235,9 @@ func (c *SubtitleCache) serveWindowedSUP(w http.ResponseWriter, r *http.Request,
 			"input", opts.InputPath, "track", opts.TrackIndex, "cache_entry", cachedPath)
 		opts.InputPath = cachedPath
 		opts.InputIsExtractedSup = true
+		if firstCue, err := readSupFirstCue(cachedPath); err == nil {
+			opts = windowFromCachedSup(opts, firstCue)
+		}
 	} else {
 		c.WarmInBackground(opts, extract)
 	}
@@ -372,6 +375,19 @@ func (c *SubtitleCache) LookupText(inputPath string, trackIndex int, format stri
 	return data, err == nil
 }
 
+// LookupWebVTT returns the complete WebVTT rendition native playback cached
+// for a text track (ServeExtract stores SubRip and forced-VTT extracts under
+// the vtt key), so another reader can reuse it instead of demuxing the source.
+func (c *SubtitleCache) LookupWebVTT(inputPath string, trackIndex int) ([]byte, bool) {
+	f, _, ok := c.lookup(inputPath, trackIndex, SubtitleFormatVTTV3)
+	if !ok {
+		return nil, false
+	}
+	defer func() { _ = f.Close() }()
+	data, err := io.ReadAll(f)
+	return data, err == nil
+}
+
 // ExtractText reuses a complete cached text track or extracts it once for this
 // request. The fill captures source identity before extraction, so a replaced
 // source cannot publish an old extract under the new file's cache key.
@@ -383,10 +399,38 @@ func (c *SubtitleCache) ExtractText(ctx context.Context, inputPath string, track
 	if format == "" {
 		return nil, fmt.Errorf("unsupported cached subtitle format")
 	}
+	// Share another request's extraction rather than demuxing the source a
+	// second time: look the track up, else reserve the fill, else wait for
+	// whoever holds it and look again. A fill that commits between a busy
+	// reservation and the wait is found by the next lookup, and one that
+	// commits during the last wait by the lookup after the loop. The rounds
+	// are bounded, so a cache that can't take a fill (disabled, unwritable)
+	// falls through to extracting without one.
+	var fill *SubtitleCacheFill
+	for round := 0; round < textFillRounds && fill == nil; round++ {
+		if data, ok := c.LookupText(inputPath, trackIndex, format); ok {
+			return data, nil
+		}
+		if fill = c.beginFill(inputPath, trackIndex, format); fill != nil {
+			break
+		}
+		if afterBusyTextFill != nil {
+			afterBusyTextFill()
+		}
+		c.waitForTextFill(ctx, inputPath, TextSubtitleTrack{Ordinal: trackIndex, Format: format})
+		if err := ctx.Err(); err != nil {
+			return nil, err
+		}
+	}
+	// Another filler may have committed since the last lookup: between it
+	// and this reservation, or during the last round's wait. Reuse its entry
+	// rather than extracting again.
 	if data, ok := c.LookupText(inputPath, trackIndex, format); ok {
+		if fill != nil {
+			fill.Discard()
+		}
 		return data, nil
 	}
-	fill := c.beginFill(inputPath, trackIndex, format)
 	data, err := extract(ctx)
 	if err != nil {
 		if fill != nil {
@@ -404,6 +448,18 @@ func (c *SubtitleCache) ExtractText(ctx context.Context, inputPath string, track
 	return data, nil
 }
 
+// textFillRounds bounds ExtractText's lookup, reserve and wait rounds.
+const textFillRounds = 3
+
+// afterBusyTextFill runs when ExtractText finds another fill in progress,
+// before it waits; tests use it to finish that fill in between.
+var afterBusyTextFill func()
+
+// afterTextFillWaitCapture runs once waitForTextFill holds an in-flight
+// fill's done channel, before it blocks on it; tests use it to act while a
+// request is waiting.
+var afterTextFillWaitCapture func()
+
 func normalizeCachedTextSubtitleFormat(format string) string {
 	switch strings.ToLower(strings.TrimPrefix(strings.TrimSpace(format), ".")) {
 	case subtitleFormatSRT, subtitleCodecSubRip:
diff --git a/internal/playback/subtitle_cache_inflight_test.go b/internal/playback/subtitle_cache_inflight_test.go
new file mode 100644
index 0000000000..4ec15a3431
--- /dev/null
+++ b/internal/playback/subtitle_cache_inflight_test.go
@@ -0,0 +1,152 @@
+package playback
+
+import (
+	"context"
+	"io"
+	"os"
+	"path/filepath"
+	"sync"
+	"sync/atomic"
+	"testing"
+)
+
+// TestExtractTextSharesInFlightFill: a request for a track another request is
+// already extracting waits for that fill instead of demuxing the source again.
+func TestExtractTextSharesInFlightFill(t *testing.T) {
+	dir := t.TempDir()
+	source := filepath.Join(dir, "movie.mkv")
+	if err := os.WriteFile(source, []byte("source"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	cache := NewSubtitleCache(func() string { return filepath.Join(dir, "transcode") })
+	var calls atomic.Int32
+	started := make(chan struct{})
+	release := make(chan struct{})
+	extract := func(context.Context) ([]byte, error) {
+		if calls.Add(1) == 1 {
+			close(started)
+			<-release
+		}
+		return []byte("1\n00:00:01,000 --> 00:00:02,000\nhello\n"), nil
+	}
+
+	var wg sync.WaitGroup
+	results := make([][]byte, 2)
+	errs := make([]error, 2)
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		results[0], errs[0] = cache.ExtractText(context.Background(), source, 0, "srt", extract)
+	}()
+	<-started
+	// Release the first extraction only once the second request is waiting
+	// on it, so the test exercises the shared fill, not a later cache hit.
+	busy := make(chan struct{})
+	var busyOnce sync.Once
+	afterTextFillWaitCapture = func() { busyOnce.Do(func() { close(busy) }) }
+	t.Cleanup(func() { afterTextFillWaitCapture = nil })
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		results[1], errs[1] = cache.ExtractText(context.Background(), source, 0, "srt", extract)
+	}()
+	<-busy
+	close(release)
+	wg.Wait()
+
+	for i := range errs {
+		if errs[i] != nil {
+			t.Fatalf("request %d: %v", i, errs[i])
+		}
+		if string(results[i]) != string(results[0]) {
+			t.Fatalf("request %d read %q, want %q", i, results[i], results[0])
+		}
+	}
+	if got := calls.Load(); got != 1 {
+		t.Fatalf("extract ran %d times, want 1", got)
+	}
+}
+
+// A fill that commits after ExtractText finds it in progress, but before
+// ExtractText waits for it, is still reused: the next lookup finds it, and
+// the source isn't demuxed again.
+func TestExtractTextReusesAFillThatCommitsBeforeTheWait(t *testing.T) {
+	cache, source := newTestCache(t)
+	holder := cache.beginFill(source, 0, "srt")
+	if holder == nil {
+		t.Fatal("couldn't reserve the fill")
+	}
+	if _, err := holder.Tee(io.Discard).Write([]byte("SHARED")); err != nil {
+		t.Fatal(err)
+	}
+	afterBusyTextFill = func() {
+		afterBusyTextFill = nil
+		if err := holder.Commit(); err != nil {
+			t.Error(err)
+		}
+	}
+	t.Cleanup(func() { afterBusyTextFill = nil })
+
+	extracts := 0
+	data, err := cache.ExtractText(t.Context(), source, 0, "srt", func(context.Context) ([]byte, error) {
+		extracts++
+		return []byte("AGAIN"), nil
+	})
+	if err != nil || string(data) != "SHARED" || extracts != 0 {
+		t.Fatalf("ExtractText = %q, %v after %d extracts; want the committed fill and none", data, err, extracts)
+	}
+}
+
+// A fill that commits during the last round's wait is reused too: the rounds
+// run out with no reservation, and the lookup after them finds the entry.
+func TestExtractTextReusesAFillThatCommitsDuringTheLastWait(t *testing.T) {
+	cache, source := newTestCache(t)
+	reserve := func() *SubtitleCacheFill {
+		holder := cache.beginFill(source, 0, "srt")
+		if holder == nil {
+			t.Fatal("couldn't reserve the fill")
+		}
+		if _, err := holder.Tee(io.Discard).Write([]byte("SHARED")); err != nil {
+			t.Fatal(err)
+		}
+		return holder
+	}
+	holder := reserve()
+	waits := 0
+	afterTextFillWaitCapture = func() {
+		waits++
+		if waits < textFillRounds {
+			// Each earlier filler gives up and another takes over.
+			holder.Discard()
+			holder = reserve()
+			return
+		}
+		if err := holder.Commit(); err != nil {
+			t.Error(err)
+		}
+	}
+	t.Cleanup(func() { afterTextFillWaitCapture = nil })
+
+	extracts := 0
+	data, err := cache.ExtractText(t.Context(), source, 0, "srt", func(context.Context) ([]byte, error) {
+		extracts++
+		return []byte("AGAIN"), nil
+	})
+	if err != nil || string(data) != "SHARED" || extracts != 0 || waits != textFillRounds {
+		t.Fatalf("ExtractText = %q, %v after %d extracts and %d waits; want the committed fill, no extract, %d waits",
+			data, err, extracts, waits, textFillRounds)
+	}
+}
+
+// Without a cache directory there's no fill to share: ExtractText extracts.
+func TestExtractTextWithoutACacheExtracts(t *testing.T) {
+	cache := NewSubtitleCache(func() string { return "" })
+	extracts := 0
+	data, err := cache.ExtractText(t.Context(), "/media/movie.mkv", 0, "srt", func(context.Context) ([]byte, error) {
+		extracts++
+		return []byte("DATA"), nil
+	})
+	if err != nil || string(data) != "DATA" || extracts != 1 {
+		t.Fatalf("ExtractText = %q, %v after %d extracts; want one extract", data, err, extracts)
+	}
+}
diff --git a/internal/playback/subtitle_cache_window_integration_test.go b/internal/playback/subtitle_cache_window_integration_test.go
new file mode 100644
index 0000000000..be5a54de34
--- /dev/null
+++ b/internal/playback/subtitle_cache_window_integration_test.go
@@ -0,0 +1,182 @@
+package playback
+
+import (
+	"bytes"
+	"context"
+	"encoding/binary"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"slices"
+	"testing"
+	"time"
+)
+
+// A window cut from a cached full-track .sup must hold the cues of that window
+// at their stored times. The cached file's start time is its first cue, so an
+// extract that lets ffmpeg offset the seek by it (or rebase onto it) starts
+// late or comes out early by that much.
+func TestStreamExtractArgs_CachedSupWindowsRealFFmpeg(t *testing.T) {
+	if testing.Short() {
+		t.Skip("real FFmpeg integration test")
+	}
+	ffmpeg, err := exec.LookPath("ffmpeg")
+	if err != nil {
+		t.Skip("ffmpeg is not installed")
+	}
+	// One cue every 10 s from 40 s to 400 s, as an unseeked full extract
+	// writes them: on the playback timeline, first cue well after zero.
+	var cues []float64
+	for at := 40.0; at <= 400; at += 10 {
+		cues = append(cues, at)
+	}
+	cached := filepath.Join(t.TempDir(), "track.sup")
+	if err := os.WriteFile(cached, testSupStream(cues, 0), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	// Each window is [seek, seek+60): the end is exclusive.
+	for _, tc := range []struct {
+		name string
+		seek float64
+	}{
+		{name: "from the start", seek: 0},
+		{name: "before the first cue", seek: 35},
+		{name: "onto the first cue", seek: 40},
+		{name: "after a seek", seek: 95},
+		{name: "a seek onto a cue", seek: 100},
+		{name: "an extend window", seek: 355},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			ctx, cancel := context.WithTimeout(t.Context(), time.Minute)
+			defer cancel()
+			firstCue, err := readSupFirstCue(cached)
+			if err != nil {
+				t.Fatal(err)
+			}
+			args := streamExtractArgs(windowFromCachedSup(StreamExtractOpts{
+				InputPath:           cached,
+				SourceCodec:         "hdmv_pgs_subtitle",
+				SeekSeconds:         tc.seek,
+				DurationSeconds:     60,
+				AllowWindow:         true,
+				InputIsExtractedSup: true,
+			}, firstCue))
+			var stdout, stderr bytes.Buffer
+			cmd := exec.CommandContext(ctx, ffmpeg, args...)
+			cmd.Stdout, cmd.Stderr = &stdout, &stderr
+			if err := cmd.Run(); err != nil {
+				t.Fatalf("ffmpeg %v: %v\n%s", args, err, stderr.String())
+			}
+			var want []float64
+			for _, at := range cues {
+				if at >= tc.seek && at < tc.seek+60 {
+					want = append(want, at)
+				}
+			}
+			got := testSupPresentationTimes(stdout.Bytes())
+			if !slices.Equal(got, want) {
+				t.Fatalf("window at %gs held cues %v, want %v; args %v", tc.seek, got, want, args)
+			}
+		})
+	}
+}
+
+// testSupStream builds a PGS elementary stream with one small display set per
+// cue time (presentation, palette, object, end). With a decodeLead, every
+// segment is decoded that many seconds before the cue and the palette, object
+// and end segments are also stamped then, as in a Blu-ray transport stream.
+func testSupStream(cues []float64, decodeLead float64) []byte {
+	var out bytes.Buffer
+	var dts uint32
+	segment := func(kind byte, pts uint32, body []byte) {
+		header := make([]byte, 13)
+		header[0], header[1] = 'P', 'G'
+		binary.BigEndian.PutUint32(header[2:], pts)
+		binary.BigEndian.PutUint32(header[6:], dts)
+		header[10] = kind
+		binary.BigEndian.PutUint16(header[11:], uint16(len(body)))
+		out.Write(header)
+		out.Write(body)
+	}
+	for i, at := range cues {
+		pts := uint32(at * 90000)
+		if decodeLead > 0 {
+			dts = uint32((at - decodeLead) * 90000)
+		}
+		segment(0x16, pts, []byte{
+			0x07, 0x80, 0x04, 0x38, 0x10, // 1920x1080, frame rate
+			byte(i >> 8), byte(i), 0x80, 0x00, 0x00, 0x01, // number, epoch start, palette 0, one object
+			0x00, 0x00, 0x00, 0x00, 0x00, 0x64, 0x03, 0x84, // object 0, window 0, at 100,900
+		})
+		if decodeLead > 0 {
+			pts = dts
+		}
+		segment(0x14, pts, []byte{0x00, 0x00, 0x01, 0xeb, 0x80, 0x80, 0xff})
+		// Two lines of 1024 pixels in color 1.
+		rle := []byte{0x00, 0xc4, 0x00, 0x01, 0x00, 0x00, 0x00, 0xc4, 0x00, 0x01, 0x00, 0x00}
+		object := []byte{0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, byte(len(rle) + 4)} // id 0, first and last
+		object = binary.BigEndian.AppendUint16(object, 1024)
+		object = binary.BigEndian.AppendUint16(object, 2)
+		segment(0x15, pts, append(object, rle...))
+		segment(0x80, pts, nil)
+	}
+	return out.Bytes()
+}
+
+// testSupPresentationTimes lists the presentation segments' times, in seconds.
+func testSupPresentationTimes(data []byte) []float64 {
+	var times []float64
+	for offset := 0; offset+13 <= len(data); {
+		size := int(binary.BigEndian.Uint16(data[offset+11:]))
+		if data[offset+10] == 0x16 {
+			times = append(times, float64(binary.BigEndian.Uint32(data[offset+2:]))/90000)
+		}
+		offset += 13 + size
+	}
+	return times
+}
+
+// A cache made from a Blu-ray transport stream keeps each segment's own
+// timestamps, and a display set is decoded ahead of the time it shows. A
+// window starting at or just before a cue must still read that whole set.
+func TestStreamExtractArgs_CachedSupDecodedAheadRealFFmpeg(t *testing.T) {
+	if testing.Short() {
+		t.Skip("real FFmpeg integration test")
+	}
+	ffmpeg, err := exec.LookPath("ffmpeg")
+	if err != nil {
+		t.Skip("ffmpeg is not installed")
+	}
+	var cues []float64
+	for at := 40.0; at <= 400; at += 10 {
+		cues = append(cues, at)
+	}
+	cached := filepath.Join(t.TempDir(), "track.sup")
+	if err := os.WriteFile(cached, testSupStream(cues, 0.6), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	for _, seek := range []float64{100, 99.7} {
+		ctx, cancel := context.WithTimeout(t.Context(), time.Minute)
+		args := streamExtractArgs(StreamExtractOpts{
+			InputPath:           cached,
+			SourceCodec:         "hdmv_pgs_subtitle",
+			SeekSeconds:         seek,
+			DurationSeconds:     60,
+			AllowWindow:         true,
+			InputIsExtractedSup: true,
+		})
+		var stdout, stderr bytes.Buffer
+		cmd := exec.CommandContext(ctx, ffmpeg, args...)
+		cmd.Stdout, cmd.Stderr = &stdout, &stderr
+		err := cmd.Run()
+		cancel()
+		if err != nil {
+			t.Fatalf("ffmpeg %v: %v\n%s", args, err, stderr.String())
+		}
+		got := testSupPresentationTimes(stdout.Bytes())
+		if len(got) == 0 || got[0] > 100 {
+			t.Fatalf("window at %gs held cues %v, want them to start with the 100 s cue; args %v", seek, got, args)
+		}
+	}
+}
diff --git a/internal/playback/subtitle_rendition.go b/internal/playback/subtitle_rendition.go
new file mode 100644
index 0000000000..41cf055aac
--- /dev/null
+++ b/internal/playback/subtitle_rendition.go
@@ -0,0 +1,658 @@
+package playback
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"math"
+	"net/http"
+	"os"
+	"path/filepath"
+	"slices"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// An HLS subtitle rendition delivers the selected embedded text track inside
+// the transcode's own presentation instead of as a whole-file sidecar.
+//
+// The transcode's ffmpeg process writes the track as one continuous WebVTT
+// file per generation (a second output beside the HLS mux, cues on the same
+// -copyts source clock as the video). The server cuts that file into segments
+// on the synthetic playlist's fixed grid: subtitle segment N carries every
+// cue overlapping the source time its video segment covers, and its
+// X-TIMESTAMP-MAP ties cue time zero to the video segments' timestamp origin.
+// That source time is O + (N-K)*d for a generation that starts at segment K,
+// where O is the generation's first video frame: the source clock need not
+// start at zero, and an input seek counts from the container's start rather
+// than the video's. O is read from the generation's own first segment.
+// Demuxing the subtitle as part of the transcode means a cue is on disk once
+// the video covering it is, so a subtitle segment is never slower than the
+// video segment it accompanies.
+//
+// The rendition is served through the existing master.m3u8 and segment/
+// routes, so every relay (API, proxy token and grant routes, node) carries it
+// unchanged: master.m3u8 becomes a multivariant playlist whose variant and
+// subtitle playlists are master.m3u8 again, selected by SubtitleRenditionQueryParam.
+
+// SubtitleRenditionQueryParam selects a playlist of a session that publishes
+// a subtitle rendition. Absent, master.m3u8 answers the multivariant playlist.
+const SubtitleRenditionQueryParam = "prairie_rendition"
+
+const (
+	subtitleRenditionVideo     = "video"
+	subtitleRenditionSubtitles = "subtitles"
+	// SubtitleRenditionGroupID is the EXT-X-MEDIA GROUP-ID the variant names
+	// in its SUBTITLES attribute.
+	SubtitleRenditionGroupID = "subs"
+	// SubtitleRenditionName is the rendition's NAME. The plan's inventory
+	// already describes the track; the playlist only has to be valid.
+	SubtitleRenditionName   = "Subtitles"
+	subtitleSegmentPrefix   = "sub_"
+	subtitleSegmentExt      = ".vtt"
+	subtitleCuePollInterval = 100 * time.Millisecond
+	// subtitleOriginProbeTimeout bounds one observation of a generation's
+	// origin; it reads a single local segment.
+	subtitleOriginProbeTimeout = 5 * time.Second
+	// subtitleOriginRetryAfter spaces out observations of a generation's
+	// origin after one fails, so a missing ffprobe or unreadable segment costs
+	// one subprocess per interval rather than one per subtitle request.
+	subtitleOriginRetryAfter = 5 * time.Second
+	// subtitleSegmentProductionWait bounds the wait for a segment the live
+	// generation is about to produce, matching what its video segment gets
+	// after a seek restart. An empty answer is final for a VOD player, so a
+	// cue produced a moment later would never be shown.
+	subtitleSegmentProductionWait = 30 * time.Second
+	// The multivariant playlist needs a BANDWIDTH even for an uncapped
+	// encode; a single variant only uses it as a startup hint.
+	subtitleRenditionDefaultVideoKbps = 8000
+	subtitleRenditionDefaultAudioKbps = 192
+)
+
+// SubtitleRenditionCodecSupported reports whether ffmpeg can write a source
+// subtitle codec as WebVTT text: every text codec except CEA-608 captions,
+// which travel inside the video stream rather than as a subtitle stream.
+func SubtitleRenditionCodecSupported(codec string) bool {
+	return isTextSubtitleV3(codec) && !strings.Contains(normalizeCodecV3(codec), "608")
+}
+
+// SubtitleRenditionExecutable reports whether a transcode with these facts can
+// carry a subtitle rendition: an encoded (not copied) video whose playlist is
+// the synthetic fixed-grid VOD playlist the subtitle segments align to.
+func SubtitleRenditionExecutable(targetVideoCodec string, totalDuration float64, segmentDuration int) bool {
+	if segmentDuration <= 0 {
+		segmentDuration = defaultSegmentDuration
+	}
+	return !strings.EqualFold(targetVideoCodec, "copy") && totalDuration > 0 &&
+		CanGenerateSyntheticManifest(totalDuration, segmentDuration)
+}
+
+// subtitleRenditionActive is the single gate shared by the ffmpeg output, the
+// playlists, and segment serving, so they cannot disagree about a recipe.
+func subtitleRenditionActive(opts TranscodeOpts) bool {
+	return opts.SubtitleRendition && opts.SubtitleTrackIndex >= 0 && !opts.SubtitleBurnIn &&
+		SubtitleRenditionCodecSupported(opts.SubtitleCodec) &&
+		SubtitleRenditionExecutable(opts.TargetCodecVideo, opts.TotalDuration, opts.SegmentDuration)
+}
+
+func subtitleCueFileName(generation uint64) string {
+	return fmt.Sprintf("subtitles_%d.vtt", generation)
+}
+
+// appendSubtitleRenditionOutputArgs adds the WebVTT cue output after the HLS
+// output. -flush_packets writes every cue as soon as it is demuxed, which is
+// what lets a subtitle segment be served once the video around it exists.
+// -y lets it replace a cue file of the same name: a reconstructed session
+// reuses its predecessor's output directory and numbers generations from 0
+// again, and without -y ffmpeg would wait at its overwrite prompt on the open
+// stdin pipe instead of transcoding.
+func appendSubtitleRenditionOutputArgs(args []string, opts TranscodeOpts) []string {
+	if !subtitleRenditionActive(opts) {
+		return args
+	}
+	cueFile := opts.subtitleCueFile
+	if cueFile == "" {
+		cueFile = subtitleCueFileName(0)
+	}
+	return append(args,
+		"-y",
+		"-map", fmt.Sprintf("0:s:%d", opts.SubtitleTrackIndex),
+		"-c:s", "webvtt",
+		"-flush_packets", "1",
+		"-f", "webvtt",
+		filepath.Join(opts.OutputDir, cueFile),
+	)
+}
+
+// subtitleCueSpan is one ffmpeg generation's cue file and the segments it has
+// demuxed past. A seek restart starts a new span; older spans stay readable so
+// a backward seek into output an earlier generation produced keeps its cues.
+type subtitleCueSpan struct {
+	file  string
+	start int
+	// end is the last segment the generation finished, or -1 while it is the
+	// live generation, whose progress is read from its own playlist.
+	end int
+	// origin is the cue-clock time, in seconds, at which segment start begins:
+	// the first video frame the generation produced, less the mux shift the
+	// X-TIMESTAMP-MAP declares. Valid when originKnown.
+	origin      float64
+	originKnown bool
+	// originFailedAt is when the last observation of origin failed.
+	originFailedAt time.Time
+}
+
+// startSubtitleSpanLocked records the generation that was just spawned.
+// Callers hold s.mu.
+func (s *TranscodeSession) startSubtitleSpanLocked(opts TranscodeOpts) {
+	if !subtitleRenditionActive(opts) || opts.subtitleCueFile == "" {
+		return
+	}
+	s.subtitleSpans = append(s.subtitleSpans, subtitleCueSpan{file: opts.subtitleCueFile, start: opts.StartSegmentNumber, end: -1})
+}
+
+// closeSubtitleSpan freezes the live span at the last segment its process
+// finished. It runs after that process has exited and before a replacement
+// can write a playlist, so the playlist still belongs to the closed span.
+func (s *TranscodeSession) closeSubtitleSpan() {
+	head, ok := s.liveProducedHead()
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	for i := range s.subtitleSpans {
+		if s.subtitleSpans[i].end >= 0 {
+			continue
+		}
+		if !ok || head < s.subtitleSpans[i].start {
+			s.subtitleSpans = append(s.subtitleSpans[:i], s.subtitleSpans[i+1:]...)
+			return
+		}
+		s.subtitleSpans[i].end = head
+		return
+	}
+}
+
+// liveProducedHead returns the last segment the current generation's own
+// playlist lists. FFmpeg adds an entry only after the segment is complete, and
+// a playlist an earlier generation left behind is not this process's progress.
+func (s *TranscodeSession) liveProducedHead() (int, bool) {
+	s.mu.Lock()
+	inherited := s.inheritedManifest
+	s.mu.Unlock()
+	data, info, err := readManifestFile(filepath.Join(s.outputDir, "stream.m3u8"))
+	if err != nil || inherited != nil && sameManifestFile(info, inherited) {
+		return 0, false
+	}
+	head, found := -1, false
+	for line := range bytes.SplitSeq(data, []byte("\n")) {
+		segNum, parseErr := ParseSegmentNumber(filepath.Base(string(bytes.TrimSpace(line))))
+		if parseErr == nil && segNum > head {
+			head, found = segNum, true
+		}
+	}
+	return head, found
+}
+
+// liveSubtitleFileLocked names the live generation's cue file, or "" between
+// a restart closing one span and starting the next. Callers hold s.mu.
+func (s *TranscodeSession) liveSubtitleFileLocked() string {
+	if n := len(s.subtitleSpans); n > 0 && s.subtitleSpans[n-1].end < 0 {
+		return s.subtitleSpans[n-1].file
+	}
+	return ""
+}
+
+// subtitleSegmentSource finds the newest generation whose cue file (a name in
+// the output directory) already holds every cue of segment segNum. waitable
+// reports that a running or restarting process may still produce it, and
+// imminent that it is about to: a restart is under way, or the live generation
+// started at or before segNum and its output is within reach of it, the window
+// in which a video request waits rather than restarts.
+func (s *TranscodeSession) subtitleSegmentSource(segNum int) (file string, ready, waitable, imminent bool) {
+	s.mu.Lock()
+	sampledLive := s.liveSubtitleFileLocked()
+	s.mu.Unlock()
+	liveHead, liveOK := s.liveProducedHead()
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.liveSubtitleFileLocked() != sampledLive {
+		// A restart replaced the live generation while its playlist was
+		// read: that head was the previous process's progress, not this one's.
+		liveOK = false
+	}
+	running := s.running
+	exited := !running && s.restarting == nil
+	waitable = running || s.restarting != nil
+	imminent = s.restarting != nil
+	for i := len(s.subtitleSpans) - 1; i >= 0; i-- {
+		span := s.subtitleSpans[i]
+		if segNum < span.start {
+			continue
+		}
+		if span.end < 0 && running {
+			head := span.start - 1
+			if liveOK {
+				head = max(head, liveHead)
+			}
+			imminent = imminent || segNum <= head+maxSequentialMissingSegments+1
+		}
+		covered := span.end >= 0 && segNum <= span.end
+		if span.end < 0 && liveOK {
+			// A running process has demuxed past a segment once the next one
+			// is complete. When it has exited, every listed segment is final.
+			covered = segNum < liveHead || exited && segNum <= liveHead
+		}
+		if covered {
+			return span.file, true, waitable, imminent
+		}
+	}
+	return "", false, waitable, imminent
+}
+
+// SubtitleSegmentVTT returns subtitle segment segNum. A segment whose cues are
+// not on disk yet is waited for while ffmpeg produces it, then answered as a
+// valid empty WebVTT document: a missing rendition segment must never hold up
+// player readiness the way a whole-file sidecar extraction did. The wait is
+// brief unless the live generation is about to reach the segment, when it is
+// as long as the matching video segment's.
+func (s *TranscodeSession) SubtitleSegmentVTT(ctx context.Context, segNum int) ([]byte, error) {
+	opts := s.Opts()
+	started := time.Now()
+	deadline := started.Add(segmentWaitTimeout(opts.SegmentDuration))
+	for {
+		file, ready, waitable, imminent := s.subtitleSegmentSource(segNum)
+		if imminent {
+			deadline = started.Add(subtitleSegmentProductionWait)
+		}
+		if ready {
+			data, err := s.readOutputFile(file)
+			if err == nil {
+				window := s.subtitleSegmentWindow(ctx, file, segNum, renditionSegmentDuration(opts))
+				return subtitleSegmentDocument(opts, segNum, window, data), nil
+			}
+			if !os.IsNotExist(err) {
+				return nil, fmt.Errorf("read subtitle cues: %w", err)
+			}
+		}
+		if !waitable || !time.Now().Before(deadline) {
+			return subtitleSegmentDocument(opts, segNum, subtitleCueWindow{}, nil), nil
+		}
+		timer := time.NewTimer(subtitleCuePollInterval)
+		select {
+		case <-ctx.Done():
+			timer.Stop()
+			return nil, ctx.Err()
+		case <-timer.C:
+		}
+	}
+}
+
+// subtitleCueWindow places a subtitle segment's window on the cue clock, in
+// seconds: it starts offset after origin, where the generation's first video
+// segment starts. An observed origin comes from MPEG-TS or fMP4 video
+// timestamps; without one, origin is zero and the window is the fixed grid,
+// which is right for the common source whose clock starts at zero.
+type subtitleCueWindow struct {
+	origin, offset float64
+	observed       bool
+}
+
+// subtitleSegmentWindow returns the window of segment segNum of the
+// generation that wrote cue file.
+func (s *TranscodeSession) subtitleSegmentWindow(ctx context.Context, file string, segNum int, segDur int) subtitleCueWindow {
+	start, origin, ok := s.subtitleSpanOrigin(ctx, file, segNum)
+	if !ok {
+		return subtitleCueWindow{offset: float64(segNum * segDur)}
+	}
+	return subtitleCueWindow{origin: origin, offset: float64((segNum - start) * segDur), observed: true}
+}
+
+// subtitleSpanOrigin returns the start segment and observed origin of the span
+// that wrote cue file. The origin is read once from the generation's first
+// video segment, or from segNum when retention already pruned the first.
+// A segment is read only while it is still the one that generation wrote: no
+// restart is under way, and no later generation has rewritten it.
+// Observations run one at a time per session, outside s.mu, and each span
+// keeps its result, so concurrent requests share one ffprobe run.
+func (s *TranscodeSession) subtitleSpanOrigin(ctx context.Context, file string, segNum int) (int, float64, bool) {
+	// lookup returns the span that wrote file, the session's options, and the
+	// segments of that span that may be read now; -1 marks one that may not.
+	lookup := func() (span subtitleCueSpan, opts TranscodeOpts, first, fallback int) {
+		s.mu.Lock()
+		defer s.mu.Unlock()
+		i := slices.IndexFunc(s.subtitleSpans, func(candidate subtitleCueSpan) bool { return candidate.file == file })
+		if i < 0 {
+			return subtitleCueSpan{}, TranscodeOpts{}, -1, -1
+		}
+		span, opts, first, fallback = s.subtitleSpans[i], s.opts, -1, -1
+		if span.originKnown || s.restarting != nil ||
+			!span.originFailedAt.IsZero() && time.Since(span.originFailedAt) < subtitleOriginRetryAfter {
+			return span, opts, -1, -1
+		}
+		if !s.subtitleSegmentRewrittenLocked(i, span.start) {
+			first = span.start
+		}
+		if segNum > span.start && !s.subtitleSegmentRewrittenLocked(i, segNum) {
+			fallback = segNum
+		}
+		return span, opts, first, fallback
+	}
+	span, _, first, fallback := lookup()
+	if first < 0 && fallback < 0 {
+		return span.start, span.origin, span.originKnown
+	}
+	s.subtitleOriginMu.Lock()
+	defer s.subtitleOriginMu.Unlock()
+	span, opts, first, fallback := lookup()
+	if first < 0 && fallback < 0 {
+		return span.start, span.origin, span.originKnown
+	}
+
+	// The observation outlives the request that started it: concurrent
+	// requests wait on it, and its result is kept for the generation.
+	probeCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), subtitleOriginProbeTimeout)
+	observed, err := first, os.ErrNotExist
+	var pts float64
+	if first >= 0 {
+		pts, err = probeSegmentVideoPTS(probeCtx, opts, s.outputDir, first)
+	}
+	if errors.Is(err, os.ErrNotExist) && fallback >= 0 {
+		observed = fallback
+		pts, err = probeSegmentVideoPTS(probeCtx, opts, s.outputDir, fallback)
+	}
+	cancel()
+	origin := pts - float64(subtitleSegmentPTSOffset90k(opts))/90_000 -
+		float64((observed-span.start)*renditionSegmentDuration(opts))
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	i := slices.IndexFunc(s.subtitleSpans, func(candidate subtitleCueSpan) bool {
+		return candidate.file == file && candidate.start == span.start
+	})
+	if i < 0 || s.restarting != nil || s.subtitleSegmentRewrittenLocked(i, observed) {
+		// A restart began while the segment was read; it may not have been
+		// this generation's any more.
+		return span.start, 0, false
+	}
+	if err != nil {
+		s.subtitleSpans[i].originFailedAt = time.Now()
+		return span.start, 0, false
+	}
+	s.subtitleSpans[i].origin, s.subtitleSpans[i].originKnown = origin, true
+	return span.start, origin, true
+}
+
+// subtitleSegmentRewrittenLocked reports whether a generation after span i
+// has replaced segment: a restart deletes its predecessors' output from its
+// own start onward. Callers hold s.mu.
+func (s *TranscodeSession) subtitleSegmentRewrittenLocked(i, segment int) bool {
+	for _, later := range s.subtitleSpans[i+1:] {
+		if later.start <= segment {
+			return true
+		}
+	}
+	return false
+}
+
+// readOutputFile reads a file the session's FFmpeg wrote, confined to its
+// output directory.
+func (s *TranscodeSession) readOutputFile(name string) ([]byte, error) {
+	root, err := os.OpenRoot(s.outputDir)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = root.Close() }()
+	return root.ReadFile(name)
+}
+
+// ServeSubtitleSegment writes subtitle segment segNum.
+func (s *TranscodeSession) ServeSubtitleSegment(w http.ResponseWriter, r *http.Request, segNum int) {
+	body, err := s.SubtitleSegmentVTT(r.Context(), segNum)
+	if err != nil && r.Context().Err() != nil {
+		return
+	}
+	if err != nil {
+		http.Error(w, "subtitle segment unavailable", http.StatusInternalServerError)
+		return
+	}
+	w.Header().Set("Content-Type", "text/vtt; charset=utf-8")
+	w.Header().Set("Cache-Control", "no-store, max-age=0")
+	w.Header().Set("Pragma", "no-cache")
+	w.Header().Set("Content-Length", strconv.Itoa(len(body)))
+	w.WriteHeader(http.StatusOK)
+	if r.Method != http.MethodHead {
+		_, _ = w.Write(body)
+	}
+}
+
+// subtitleSegmentPTSOffset90k is the shift the video segments add to the
+// source clock (see HLSMPEGTSTimestampOffset90k); fMP4 keeps the source clock.
+func subtitleSegmentPTSOffset90k(opts TranscodeOpts) int64 {
+	if HLSOutputContainer(opts) == OutputContainerMPEGTS {
+		return HLSMPEGTSTimestampOffset90k
+	}
+	return 0
+}
+
+// renditionSegmentDuration is the session's segment duration in seconds.
+func renditionSegmentDuration(opts TranscodeOpts) int {
+	if opts.SegmentDuration <= 0 {
+		return defaultSegmentDuration
+	}
+	return opts.SegmentDuration
+}
+
+const (
+	// subtitleCueClockWrap90k is the MPEG-TS timestamp range.
+	subtitleCueClockWrap90k = int64(1) << 33
+	// subtitleEpochCueLead90k is how long before a generation's origin its
+	// first cue may start: a cue already showing at a seek point is written
+	// with its own start time.
+	subtitleEpochCueLead90k = int64(60 * 60 * 90_000)
+)
+
+// subtitleWindowEpoch moves a generation's origin observed from MPEG-TS video,
+// whose timestamps wrap at 2^33 ticks (about 26.5 h), onto the cue clock,
+// which does not wrap: a source whose clock passes the rollover (a broadcast
+// capture) keeps counting in its cue file while its video segments start
+// over. A generation starts no later than its first cue, give or take a cue
+// already showing, so the origin takes the latest epoch that keeps it there,
+// however long the first cue takes to arrive. The epoch is the origin's, so
+// every window of the generation keeps it.
+func subtitleWindowEpoch(origin90k, firstCue90k int64) int64 {
+	if ahead := firstCue90k + subtitleEpochCueLead90k - origin90k; ahead >= subtitleCueClockWrap90k {
+		origin90k += ahead / subtitleCueClockWrap90k * subtitleCueClockWrap90k
+	}
+	return origin90k
+}
+
+// subtitleRenditionCue is one complete cue of a generation's cue file.
+type subtitleRenditionCue struct {
+	from, to int64 // milliseconds
+	text     string
+}
+
+// parseSubtitleRenditionCues reads the complete cues of a cue file, skipping
+// the one ffmpeg may still be writing.
+func parseSubtitleRenditionCues(cues []byte) []subtitleRenditionCue {
+	text := strings.ReplaceAll(string(cues), "\r\n", "\n")
+	if !strings.HasSuffix(text, "\n") {
+		// The final cue is still being written.
+		if cut := strings.LastIndex(text, "\n\n"); cut >= 0 {
+			text = text[:cut]
+		} else {
+			text = ""
+		}
+	}
+	var parsed []subtitleRenditionCue
+	for block := range strings.SplitSeq(text, "\n\n") {
+		block = strings.Trim(block, "\n")
+		lines := strings.Split(block, "\n")
+		for i, line := range lines {
+			left, right, found := strings.Cut(line, " --> ")
+			if !found {
+				continue
+			}
+			fields := strings.Fields(right)
+			if len(fields) == 0 || i == len(lines)-1 {
+				break
+			}
+			from, err := subtitleCueTimestampMS(left)
+			if err != nil {
+				break
+			}
+			to, err := subtitleCueTimestampMS(fields[0])
+			if err != nil {
+				break
+			}
+			parsed = append(parsed, subtitleRenditionCue{from: from, to: to, text: strings.Join(lines[i:], "\n")})
+			break
+		}
+	}
+	return parsed
+}
+
+// subtitleSegmentDocument cuts one segment out of a generation's cue file:
+// every cue overlapping the window's d seconds. Cues keep their absolute
+// source times and settings; a cue that spans segments is repeated in each,
+// as HLS expects, and players de-duplicate it.
+func subtitleSegmentDocument(opts TranscodeOpts, segNum int, window subtitleCueWindow, cues []byte) []byte {
+	segDur := renditionSegmentDuration(opts)
+	parsed := parseSubtitleRenditionCues(cues)
+	origin90k := int64(math.Round(window.origin * 90_000))
+	if window.observed && HLSOutputContainer(opts) == OutputContainerMPEGTS && len(parsed) > 0 {
+		origin90k = subtitleWindowEpoch(origin90k, parsed[0].from*90)
+	}
+	start90k := origin90k + int64(math.Round(window.offset*90_000))
+	end90k := start90k + int64(segDur)*90_000
+	if segNum >= syntheticSegmentCount(opts.TotalDuration, segDur)-1 {
+		end90k = math.MaxInt64
+	}
+
+	var out bytes.Buffer
+	out.WriteString("WEBVTT\n")
+	fmt.Fprintf(&out, "X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:%d\n", subtitleSegmentPTSOffset90k(opts)%(1<<33))
+	for _, cue := range parsed {
+		if cue.to*90 <= start90k || cue.from*90 >= end90k {
+			continue
+		}
+		out.WriteByte('\n')
+		out.WriteString(cue.text)
+		out.WriteByte('\n')
+	}
+	return out.Bytes()
+}
+
+// subtitleCueTimestampMS parses a WebVTT [HH:]MM:SS.mmm timestamp.
+func subtitleCueTimestampMS(value string) (int64, error) {
+	parts := strings.Split(strings.TrimSpace(value), ":")
+	if len(parts) != 2 && len(parts) != 3 {
+		return 0, fmt.Errorf("invalid cue timestamp %q", value)
+	}
+	ms := int64(0)
+	for i, part := range parts {
+		if i == len(parts)-1 {
+			seconds, err := strconv.ParseFloat(part, 64)
+			if err != nil || seconds < 0 {
+				return 0, fmt.Errorf("invalid cue timestamp %q", value)
+			}
+			return ms*60_000 + int64(math.Round(seconds*1000)), nil
+		}
+		unit, err := strconv.ParseInt(part, 10, 64)
+		if err != nil || unit < 0 {
+			return 0, fmt.Errorf("invalid cue timestamp %q", value)
+		}
+		ms = ms*60 + unit
+	}
+	return ms, nil
+}
+
+// ParseSubtitleSegmentNumber reports the segment number of a subtitle
+// rendition segment name (sub_00012.vtt).
+func ParseSubtitleSegmentNumber(name string) (int, bool) {
+	name = filepath.Base(name)
+	if !strings.HasPrefix(name, subtitleSegmentPrefix) || !strings.HasSuffix(name, subtitleSegmentExt) {
+		return 0, false
+	}
+	digits := strings.TrimSuffix(strings.TrimPrefix(name, subtitleSegmentPrefix), subtitleSegmentExt)
+	if digits == "" || strings.Trim(digits, "0123456789") != "" {
+		return 0, false
+	}
+	segNum, err := strconv.Atoi(digits)
+	if err != nil {
+		return 0, false
+	}
+	return segNum, true
+}
+
+// HasSubtitleRendition reports whether this session publishes a subtitle
+// rendition, so master.m3u8 is a multivariant playlist.
+func (s *TranscodeSession) HasSubtitleRendition() bool {
+	return s.copyPlan == nil && subtitleRenditionActive(s.Opts())
+}
+
+// buildSubtitleRenditionPlaylist answers master.m3u8 for a session with a
+// subtitle rendition: the multivariant playlist, or the variant or subtitle
+// media playlist it points at.
+func (s *TranscodeSession) buildSubtitleRenditionPlaylist(segPrefix, rawQuery string) []byte {
+	rendition, query := splitSubtitleRenditionQuery(rawQuery)
+	switch rendition {
+	case subtitleRenditionVideo:
+		return s.GenerateFullManifest(segPrefix, query)
+	case subtitleRenditionSubtitles:
+		return s.generateSyntheticPlaylist(segPrefix, query, subtitleSegmentPrefix, subtitleSegmentExt, false)
+	default:
+		return subtitleRenditionMultivariantPlaylist(s.Opts(), query)
+	}
+}
+
+// subtitleRenditionMultivariantPlaylist lists the transcode as one variant
+// whose SUBTITLES group holds the selected track. Both URIs are master.m3u8
+// relative to itself, so the playlist works behind every relay path.
+func subtitleRenditionMultivariantPlaylist(opts TranscodeOpts, query string) []byte {
+	uri := func(rendition string) string {
+		value := "master.m3u8?" + SubtitleRenditionQueryParam + "=" + rendition
+		if query != "" {
+			value += "&" + query
+		}
+		return value
+	}
+	videoKbps := opts.TargetBitrateKbps
+	if videoKbps <= 0 {
+		videoKbps = subtitleRenditionDefaultVideoKbps
+	}
+	audioKbps := opts.TargetAudioBitrateKbps
+	if audioKbps <= 0 {
+		audioKbps = subtitleRenditionDefaultAudioKbps
+	}
+
+	var buf bytes.Buffer
+	buf.WriteString("#EXTM3U\n")
+	buf.WriteString("#EXT-X-VERSION:3\n")
+	buf.WriteString("#EXT-X-INDEPENDENT-SEGMENTS\n")
+	fmt.Fprintf(&buf, "#EXT-X-MEDIA:TYPE=SUBTITLES,GROUP-ID=%q,NAME=%q,DEFAULT=YES,AUTOSELECT=YES,FORCED=NO,URI=%q\n",
+		SubtitleRenditionGroupID, SubtitleRenditionName, uri(subtitleRenditionSubtitles))
+	fmt.Fprintf(&buf, "#EXT-X-STREAM-INF:BANDWIDTH=%d,SUBTITLES=%q\n", (videoKbps+audioKbps)*1000, SubtitleRenditionGroupID)
+	buf.WriteString(uri(subtitleRenditionVideo) + "\n")
+	return buf.Bytes()
+}
+
+// splitSubtitleRenditionQuery removes SubtitleRenditionQueryParam from a raw
+// query, keeping every other parameter byte-for-byte.
+func splitSubtitleRenditionQuery(rawQuery string) (rendition, rest string) {
+	if rawQuery == "" {
+		return "", ""
+	}
+	kept := make([]string, 0, strings.Count(rawQuery, "&")+1)
+	for part := range strings.SplitSeq(rawQuery, "&") {
+		if key, value, _ := strings.Cut(part, "="); key == SubtitleRenditionQueryParam {
+			rendition = value
+			continue
+		}
+		if part != "" {
+			kept = append(kept, part)
+		}
+	}
+	return rendition, strings.Join(kept, "&")
+}
diff --git a/internal/playback/subtitle_rendition_test.go b/internal/playback/subtitle_rendition_test.go
new file mode 100644
index 0000000000..cf75296dcc
--- /dev/null
+++ b/internal/playback/subtitle_rendition_test.go
@@ -0,0 +1,959 @@
+package playback
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"math"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"slices"
+	"strconv"
+	"strings"
+	"syscall"
+	"testing"
+	"time"
+
+	"github.com/prairie-server/prairie-server/internal/models"
+)
+
+func subtitleRenditionTestOpts(dir string) TranscodeOpts {
+	return TranscodeOpts{
+		InputPath: "/media/movie.mkv", OutputDir: dir, TargetCodecVideo: "h264", TargetCodecAudio: "aac",
+		HWAccel: HWAccelNone, SegmentDuration: 2, TotalDuration: 60,
+		SubtitleTrackIndex: 3, SubtitleCodec: "subrip", SubtitleRendition: true,
+	}
+}
+
+func TestBuildFFmpegArgsAppendsSubtitleRenditionOutput(t *testing.T) {
+	dir := t.TempDir()
+	opts := subtitleRenditionTestOpts(dir)
+	opts.SeekSeconds = 20
+	opts.StartSegmentNumber = 10
+	opts.subtitleCueFile = subtitleCueFileName(2)
+	args := buildFFmpegArgs(opts)
+
+	manifest := slices.Index(args, filepath.Join(dir, "stream.m3u8"))
+	if manifest < 0 {
+		t.Fatalf("HLS output missing: %v", args)
+	}
+	// The HLS output itself stays subtitle-free; the cue output follows it so
+	// its options cannot leak into the HLS mux.
+	if !slices.Contains(args[:manifest], "-sn") {
+		t.Fatalf("HLS output must keep -sn: %v", args)
+	}
+	want := []string{"-y", "-map", "0:s:3", "-c:s", "webvtt", "-flush_packets", "1", "-f", "webvtt", filepath.Join(dir, "subtitles_2.vtt")}
+	if got := args[manifest+1:]; !slices.Equal(got, want) {
+		t.Fatalf("cue output = %v, want %v", got, want)
+	}
+	for _, shared := range []string{"-copyts", "-ss"} {
+		if !slices.Contains(args[:manifest], shared) {
+			t.Fatalf("cue output must share %s with the HLS output: %v", shared, args)
+		}
+	}
+}
+
+func TestSubtitleRenditionInactiveOutsideItsRecipe(t *testing.T) {
+	for _, tc := range []struct {
+		name   string
+		mutate func(*TranscodeOpts)
+	}{
+		{"not requested", func(o *TranscodeOpts) { o.SubtitleRendition = false }},
+		{"no track", func(o *TranscodeOpts) { o.SubtitleTrackIndex = -1 }},
+		{"burn in", func(o *TranscodeOpts) { o.SubtitleBurnIn = true }},
+		{"bitmap", func(o *TranscodeOpts) { o.SubtitleCodec = "hdmv_pgs_subtitle" }},
+		{"copy video", func(o *TranscodeOpts) { o.TargetCodecVideo = "copy" }},
+		{"unknown duration", func(o *TranscodeOpts) { o.TotalDuration = 0 }},
+		{"oversized playlist", func(o *TranscodeOpts) { o.TotalDuration = float64(maxSyntheticManifestSegments*2 + 10) }},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			opts := subtitleRenditionTestOpts(t.TempDir())
+			tc.mutate(&opts)
+			if subtitleRenditionActive(opts) {
+				t.Fatal("rendition must be inactive")
+			}
+			if args := strings.Join(buildFFmpegArgs(opts), " "); strings.Contains(args, "webvtt") {
+				t.Fatalf("inactive rendition still emitted a cue output: %s", args)
+			}
+			session := &TranscodeSession{outputDir: opts.OutputDir, opts: opts}
+			if session.HasSubtitleRendition() {
+				t.Fatal("inactive rendition published a multivariant playlist")
+			}
+		})
+	}
+}
+
+func TestBuildPlaybackManifestPublishesSubtitleRendition(t *testing.T) {
+	opts := subtitleRenditionTestOpts(t.TempDir())
+	opts.TotalDuration = 9
+	opts.TargetBitrateKbps = 4000
+	opts.TargetAudioBitrateKbps = 128
+	session := &TranscodeSession{outputDir: opts.OutputDir, opts: opts}
+
+	master, err := session.BuildPlaybackManifest("segment/", "st=abc")
+	if err != nil {
+		t.Fatal(err)
+	}
+	wantMaster := strings.Join([]string{
+		"#EXTM3U",
+		"#EXT-X-VERSION:3",
+		"#EXT-X-INDEPENDENT-SEGMENTS",
+		`#EXT-X-MEDIA:TYPE=SUBTITLES,GROUP-ID="subs",NAME="Subtitles",DEFAULT=YES,AUTOSELECT=YES,FORCED=NO,URI="master.m3u8?prairie_rendition=subtitles&st=abc"`,
+		`#EXT-X-STREAM-INF:BANDWIDTH=4128000,SUBTITLES="subs"`,
+		"master.m3u8?prairie_rendition=video&st=abc",
+		"",
+	}, "\n")
+	if string(master) != wantMaster {
+		t.Fatalf("multivariant playlist:\n%s\nwant:\n%s", master, wantMaster)
+	}
+
+	video, err := session.BuildPlaybackManifest("segment/", "prairie_rendition=video&st=abc")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if want := session.GenerateFullManifest("segment/", "st=abc"); string(video) != string(want) {
+		t.Fatalf("video variant must be the unchanged synthetic playlist:\n%s\nwant:\n%s", video, want)
+	}
+
+	subtitles, err := session.BuildPlaybackManifest("segment/", "st=abc&prairie_rendition=subtitles")
+	if err != nil {
+		t.Fatal(err)
+	}
+	wantSubtitles := strings.Join([]string{
+		"#EXTM3U",
+		"#EXT-X-VERSION:3",
+		"#EXT-X-TARGETDURATION:2",
+		"#EXT-X-MEDIA-SEQUENCE:0",
+		// No PLAYLIST-TYPE:VOD line: Prairie drops it for Tizen (see transcode.go).
+		"#EXTINF:2.000000,", "segment/sub_00000.vtt?st=abc",
+		"#EXTINF:2.000000,", "segment/sub_00001.vtt?st=abc",
+		"#EXTINF:2.000000,", "segment/sub_00002.vtt?st=abc",
+		"#EXTINF:2.000000,", "segment/sub_00003.vtt?st=abc",
+		"#EXTINF:1.000000,", "segment/sub_00004.vtt?st=abc",
+		"#EXT-X-ENDLIST",
+		"",
+	}, "\n")
+	if string(subtitles) != wantSubtitles {
+		t.Fatalf("subtitle playlist:\n%s\nwant:\n%s", subtitles, wantSubtitles)
+	}
+	videoTimeline, err := parseManifestTimeline(video)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(videoTimeline.entries) != 5 {
+		t.Fatalf("video playlist lists %d segments, subtitle playlist 5", len(videoTimeline.entries))
+	}
+}
+
+func TestBuildPlaybackManifestRenditionWithoutQuery(t *testing.T) {
+	session := &TranscodeSession{opts: subtitleRenditionTestOpts(t.TempDir())}
+	master, err := session.BuildPlaybackManifest("segment/", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, want := range []string{`URI="master.m3u8?prairie_rendition=subtitles"`, "\nmaster.m3u8?prairie_rendition=video\n", "BANDWIDTH=8192000"} {
+		if !strings.Contains(string(master), want) {
+			t.Fatalf("multivariant playlist missing %q:\n%s", want, master)
+		}
+	}
+}
+
+func TestAppendManifestQueryParamCoversSubtitleRendition(t *testing.T) {
+	session := &TranscodeSession{opts: subtitleRenditionTestOpts(t.TempDir())}
+	master, err := session.BuildPlaybackManifest("segment/", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := string(AppendManifestQueryParam(master, "st", "tok"))
+	for _, want := range []string{`URI="master.m3u8?prairie_rendition=subtitles&st=tok"`, "\nmaster.m3u8?prairie_rendition=video&st=tok\n"} {
+		if !strings.Contains(got, want) {
+			t.Fatalf("relay token missing from %q:\n%s", want, got)
+		}
+	}
+}
+
+func TestSubtitleSegmentNamesStayOutOfTheVideoPipeline(t *testing.T) {
+	if n, ok := ParseSubtitleSegmentNumber("sub_00012.vtt"); !ok || n != 12 {
+		t.Fatalf("ParseSubtitleSegmentNumber = %d, %v", n, ok)
+	}
+	for _, name := range []string{"seg_00012.ts", "sub_.vtt", "sub_00012.ts", "sub_-1.vtt", "subtitles_0.vtt"} {
+		if _, ok := ParseSubtitleSegmentNumber(name); ok {
+			t.Fatalf("%q parsed as a subtitle segment", name)
+		}
+	}
+	// Segment acknowledgement, pruning, and restart all key off
+	// ParseSegmentNumber; a subtitle segment must never look like media.
+	if _, err := ParseSegmentNumber("sub_00012.vtt"); err == nil {
+		t.Fatal("subtitle segment parsed as a media segment")
+	}
+}
+
+const subtitleRenditionCues = `WEBVTT
+
+00:01.000 --> 00:03.500
+First cue
+
+00:21.000 --> 00:25.000 align:start position:10%
+After the gap,
+spans segments
+
+01:00:40.500 --> 01:00:41.500
+Late cue
+`
+
+func TestSubtitleSegmentDocumentCutsTheFixedGrid(t *testing.T) {
+	opts := subtitleRenditionTestOpts("")
+	opts.TotalDuration = 2 * 60 * 60
+	cues := []byte(subtitleRenditionCues)
+	header := "WEBVTT\nX-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000\n"
+	spanning := "\n00:21.000 --> 00:25.000 align:start position:10%\nAfter the gap,\nspans segments\n"
+	for _, tc := range []struct {
+		segment int
+		want    string
+	}{
+		{0, header + "\n00:01.000 --> 00:03.500\nFirst cue\n"},
+		{1, header + "\n00:01.000 --> 00:03.500\nFirst cue\n"},
+		{2, header},
+		{10, header + spanning},
+		{11, header + spanning},
+		{12, header + spanning},
+		{13, header},
+		{1820, header + "\n01:00:40.500 --> 01:00:41.500\nLate cue\n"},
+	} {
+		if got := string(subtitleSegmentDocument(opts, tc.segment, subtitleCueWindow{offset: float64(tc.segment * 2)}, cues)); got != tc.want {
+			t.Errorf("segment %d:\n%q\nwant\n%q", tc.segment, got, tc.want)
+		}
+	}
+}
+
+func TestSubtitleSegmentDocumentTimestampMapFollowsTheContainer(t *testing.T) {
+	opts := subtitleRenditionTestOpts("")
+	opts.TargetCodecVideo = transcodeCodecHEVC
+	if got := string(subtitleSegmentDocument(opts, 0, subtitleCueWindow{}, nil)); got != "WEBVTT\nX-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:0\n" {
+		t.Fatalf("fMP4 segments keep the source clock: %q", got)
+	}
+}
+
+func TestSubtitleSegmentDocumentKeepsCuesPastTheLastBoundary(t *testing.T) {
+	opts := subtitleRenditionTestOpts("")
+	opts.TotalDuration = 21
+	// The last listed segment (10) covers the remainder and anything a
+	// slightly longer real stream carries past the probed duration.
+	got := string(subtitleSegmentDocument(opts, 10, subtitleCueWindow{offset: 20}, []byte(subtitleRenditionCues)))
+	if !strings.Contains(got, "Late cue") || !strings.Contains(got, "After the gap") {
+		t.Fatalf("last segment dropped trailing cues: %q", got)
+	}
+}
+
+func TestSubtitleSegmentDocumentSkipsACueStillBeingWritten(t *testing.T) {
+	opts := subtitleRenditionTestOpts("")
+	partial := []byte("WEBVTT\n\n00:01.000 --> 00:03.500\nFirst cue\n\n00:02.000 --> 00:0")
+	got := string(subtitleSegmentDocument(opts, 1, subtitleCueWindow{offset: 2}, partial))
+	if strings.Count(got, "-->") != 1 || !strings.Contains(got, "First cue") {
+		t.Fatalf("partial cue leaked into the segment: %q", got)
+	}
+}
+
+func TestSubtitleSegmentDocumentFollowsTheObservedOrigin(t *testing.T) {
+	opts := subtitleRenditionTestOpts("")
+	opts.TotalDuration = 2 * 60 * 60
+	cues := []byte(subtitleRenditionCues)
+	// A source whose clock starts at 7 s: video segment N starts at 7+2N, so
+	// the cue at 21-25 s belongs in segments 7 and 8, not 10-12.
+	for segment, want := range map[int]bool{6: false, 7: true, 8: true, 9: false, 10: false, 11: false, 12: false} {
+		got := string(subtitleSegmentDocument(opts, segment, subtitleCueWindow{origin: 7, offset: float64(segment * 2), observed: true}, cues))
+		if strings.Contains(got, "After the gap") != want {
+			t.Errorf("segment %d carries the 21 s cue=%v, want %v: %q", segment, !want, want, got)
+		}
+	}
+}
+
+func TestSubtitleSegmentDocumentFollowsTheCueClockAcrossTheMPEGTSRollover(t *testing.T) {
+	opts := subtitleRenditionTestOpts("")
+	opts.TotalDuration = 2 * 60 * 60
+	wrap := float64(subtitleCueClockWrap90k) / 90_000
+	// A broadcast capture whose clock starts 2 s before the 33-bit rollover:
+	// its cue file keeps counting past 95443.7 s while the MPEG-TS video
+	// segments start over, so the observed origin sits an epoch below the cues.
+	cues := []byte("WEBVTT\n\n26:30:41.500 --> 26:30:42.000\nBefore the rollover\n\n26:30:44.000 --> 26:30:45.000\nPast the rollover\n")
+	origin := 95441.0 - wrap // segment 0 starts at source 95441 s
+	for segment, want := range map[int]string{0: "Before the rollover", 1: "Past the rollover"} {
+		got := string(subtitleSegmentDocument(opts, segment, subtitleCueWindow{origin: origin, offset: float64(segment * 2), observed: true}, cues))
+		if !strings.Contains(got, want) || strings.Count(got, "-->") != 1 {
+			t.Errorf("segment %d: %q, want only %q", segment, got, want)
+		}
+	}
+	// ffprobe can report the same time as a signed 33-bit value.
+	if got := string(subtitleSegmentDocument(opts, 1, subtitleCueWindow{origin: origin - wrap, offset: 2, observed: true}, cues)); !strings.Contains(got, "Past the rollover") {
+		t.Errorf("signed observation: %q", got)
+	}
+	// fMP4 timestamps do not wrap, so the same arithmetic must not alias.
+	opts.TargetCodecVideo = transcodeCodecHEVC
+	if got := string(subtitleSegmentDocument(opts, 1, subtitleCueWindow{origin: origin, offset: 2, observed: true}, cues)); strings.Contains(got, "rollover") {
+		t.Errorf("fMP4 window aliased across an epoch: %q", got)
+	}
+	// A long capture keeps its origin's epoch more than half a range later:
+	// segment 24000 starts 48000 s after the origin, at source 143441 s.
+	opts.TargetCodecVideo = transcodeCodecH264
+	opts.TotalDuration = 60_000
+	late := []byte(string(cues) + "\n39:50:41.500 --> 39:50:42.000\nThirteen hours later\n")
+	window := subtitleCueWindow{origin: origin, offset: 48_000, observed: true}
+	if got := string(subtitleSegmentDocument(opts, 24_000, window, late)); !strings.Contains(got, "Thirteen hours later") || strings.Count(got, "-->") != 1 {
+		t.Errorf("segment 24000 lost the origin's epoch: %q", got)
+	}
+}
+
+func TestSubtitleWindowEpochKeepsLongZeroClockStreams(t *testing.T) {
+	// A 20 h MPEG-TS stream from a zero clock never reaches the rollover; its
+	// late windows must not be pulled an epoch back toward the first cue.
+	if got := subtitleWindowEpoch(72_000*90_000, 90_000); got != 72_000*90_000 {
+		t.Fatalf("window moved to %d", got)
+	}
+	// A window slightly below zero (a lifted first frame) stays there.
+	if got := subtitleWindowEpoch(-90_000, 0); got != -90_000 {
+		t.Fatalf("window moved to %d", got)
+	}
+	// A zero-clock stream whose first cue comes 14 h in is still one epoch.
+	if got := subtitleWindowEpoch(0, 14*60*60*90_000); got != 0 {
+		t.Fatalf("origin moved to %d", got)
+	}
+	// An origin observed just below the rollover's wrap, with its cue just
+	// before the rollover, moves up one epoch.
+	if got := subtitleWindowEpoch(-3*90_000, 95_441*90_000); got != subtitleCueClockWrap90k-3*90_000 {
+		t.Fatalf("origin moved to %d", got)
+	}
+}
+
+// fakeSubtitleFFprobe installs an ffmpeg/ffprobe pair whose ffprobe counts its
+// runs and reports the given first video PTS, or fails when pts is empty.
+// When gated, it writes to the FIFO "started" and then reads "release" before
+// answering, so a test can act while an observation is in flight.
+func fakeSubtitleFFprobe(t *testing.T, pts string, gated bool) (ffmpegPath, dir string) {
+	t.Helper()
+	dir = t.TempDir()
+	script := "#!/bin/sh\necho run >> " + filepath.Join(dir, "runs") + "\n"
+	if gated {
+		for _, fifo := range []string{"started", "release"} {
+			if err := syscall.Mkfifo(filepath.Join(dir, fifo), 0o600); err != nil {
+				t.Skipf("mkfifo: %v", err)
+			}
+		}
+		script += "echo started > " + filepath.Join(dir, "started") + "\nread _ < " + filepath.Join(dir, "release") + "\n"
+	}
+	if pts == "" {
+		script += "exit 1\n"
+	} else {
+		script += "cat >/dev/null\necho '{\"packets\":[{\"pts_time\":\"" + pts + "\"}]}'\n"
+	}
+	for name, body := range map[string]string{"ffmpeg": "#!/bin/sh\nexit 1\n", "ffprobe": script} {
+		if err := os.WriteFile(filepath.Join(dir, name), []byte(body), 0o755); err != nil {
+			t.Fatal(err)
+		}
+	}
+	return filepath.Join(dir, "ffmpeg"), dir
+}
+
+func fakeSubtitleFFprobeRuns(t *testing.T, dir string) int {
+	t.Helper()
+	data, err := os.ReadFile(filepath.Join(dir, "runs"))
+	if os.IsNotExist(err) {
+		return 0
+	}
+	if err != nil {
+		t.Fatal(err)
+	}
+	return strings.Count(string(data), "run")
+}
+
+func subtitleOriginTestSession(t *testing.T, ffmpegPath string, start int) *TranscodeSession {
+	t.Helper()
+	dir := t.TempDir()
+	opts := subtitleRenditionTestOpts(dir)
+	opts.FFmpegPath = ffmpegPath
+	opts.StartSegmentNumber = start
+	opts.subtitleCueFile = subtitleCueFileName(0)
+	if err := os.WriteFile(filepath.Join(dir, fmt.Sprintf("seg_%05d.ts", start)), []byte("ts"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	session := &TranscodeSession{outputDir: dir, opts: opts, running: true}
+	session.startSubtitleSpanLocked(opts)
+	return session
+}
+
+func TestSubtitleSpanOriginIsObservedOncePerGeneration(t *testing.T) {
+	ffmpegPath, fake := fakeSubtitleFFprobe(t, "27.000000", false)
+	session := subtitleOriginTestSession(t, ffmpegPath, 10)
+	opts := session.Opts()
+
+	results := make(chan float64, 8)
+	for range 8 {
+		go func() {
+			window := session.subtitleSegmentWindow(t.Context(), opts.subtitleCueFile, 12, 2)
+			results <- window.origin + window.offset
+		}()
+	}
+	for range 8 {
+		// Segment 10 starts at source 17 s (27 s less the 10 s MPEG-TS shift).
+		if got := <-results; got != 21 {
+			t.Fatalf("window start = %v, want 21", got)
+		}
+	}
+	if runs := fakeSubtitleFFprobeRuns(t, fake); runs != 1 {
+		t.Fatalf("ffprobe ran %d times for one generation", runs)
+	}
+}
+
+func TestSubtitleSpanOriginBacksOffAfterAFailure(t *testing.T) {
+	ffmpegPath, fake := fakeSubtitleFFprobe(t, "", false)
+	session := subtitleOriginTestSession(t, ffmpegPath, 0)
+	opts := session.Opts()
+	for range 3 {
+		if got := session.subtitleSegmentWindow(t.Context(), opts.subtitleCueFile, 3, 2); got.observed || got.offset != 6 {
+			t.Fatalf("unobserved origin must fall back to the fixed grid: %v", got)
+		}
+	}
+	if runs := fakeSubtitleFFprobeRuns(t, fake); runs != 1 {
+		t.Fatalf("a failed observation was retried %d times within the backoff", runs-1)
+	}
+}
+
+func TestSubtitleSpanOriginDiscardsAnObservationARestartOverlapped(t *testing.T) {
+	ffmpegPath, fake := fakeSubtitleFFprobe(t, "27.000000", true)
+	session := subtitleOriginTestSession(t, ffmpegPath, 10)
+	opts := session.Opts()
+
+	done := make(chan float64, 1)
+	go func() {
+		window := session.subtitleSegmentWindow(t.Context(), opts.subtitleCueFile, 12, 2)
+		done <- window.origin + window.offset
+	}()
+	// Opening the FIFO waits for the fake ffprobe to start.
+	if _, err := os.ReadFile(filepath.Join(fake, "started")); err != nil {
+		t.Fatal(err)
+	}
+	// A backward seek restart replaces the generation while its first segment
+	// is read: the new generation rewrites output from segment 4 onward.
+	writeSubtitleRenditionPlaylist(t, session.outputDir, 10, 14)
+	session.closeSubtitleSpan()
+	next := opts
+	next.StartSegmentNumber = 4
+	next.subtitleCueFile = subtitleCueFileName(1)
+	session.mu.Lock()
+	session.startSubtitleSpanLocked(next)
+	session.mu.Unlock()
+	if err := os.WriteFile(filepath.Join(fake, "release"), []byte("go\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if got := <-done; got != 24 {
+		t.Fatalf("overlapped observation must fall back to the fixed grid: %v", got)
+	}
+	session.mu.Lock()
+	defer session.mu.Unlock()
+	if len(session.subtitleSpans) != 2 {
+		t.Fatalf("spans = %#v", session.subtitleSpans)
+	}
+	for _, span := range session.subtitleSpans {
+		if span.originKnown || !span.originFailedAt.IsZero() {
+			t.Fatalf("span %q kept the result of a read across a restart: %#v", span.file, span)
+		}
+	}
+}
+
+// A forward seek leaves the earlier generation's output in place, so a backward
+// seek into it later still gets that generation's own origin.
+func TestSubtitleSpanOriginObservesAnEarlierGenerationItsSuccessorKept(t *testing.T) {
+	ffmpegPath, fake := fakeSubtitleFFprobe(t, "27.000000", false)
+	session := subtitleOriginTestSession(t, ffmpegPath, 10)
+	opts := session.Opts()
+	writeSubtitleRenditionPlaylist(t, session.outputDir, 10, 14)
+	session.closeSubtitleSpan()
+	next := opts
+	next.StartSegmentNumber = 900
+	next.subtitleCueFile = subtitleCueFileName(1)
+	session.mu.Lock()
+	session.startSubtitleSpanLocked(next)
+	session.mu.Unlock()
+
+	if got := session.subtitleSegmentWindow(t.Context(), opts.subtitleCueFile, 12, 2); got.origin+got.offset != 21 {
+		t.Fatalf("earlier generation's window = %+v, want a start at 21", got)
+	}
+	if runs := fakeSubtitleFFprobeRuns(t, fake); runs != 1 {
+		t.Fatalf("ffprobe ran %d times", runs)
+	}
+}
+
+func writeSubtitleRenditionPlaylist(t *testing.T, dir string, first, last int) {
+	t.Helper()
+	if err := writeSubtitleRenditionPlaylistFile(dir, first, last); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// writeSubtitleRenditionPlaylistFile is the goroutine-safe form: it reports
+// the error instead of failing the test.
+func writeSubtitleRenditionPlaylistFile(dir string, first, last int) error {
+	lines := []string{"#EXTM3U", "#EXT-X-VERSION:3", "#EXT-X-TARGETDURATION:2", "#EXT-X-MEDIA-SEQUENCE:" + strconv.Itoa(first)}
+	for segment := first; segment <= last; segment++ {
+		lines = append(lines, "#EXTINF:2.000000,", fmt.Sprintf("seg_%05d.ts", segment))
+	}
+	return os.WriteFile(filepath.Join(dir, "stream.m3u8"), []byte(strings.Join(lines, "\n")+"\n"), 0o644)
+}
+
+func TestSubtitleSegmentVTTServesOnlyDemuxedSegments(t *testing.T) {
+	dir := t.TempDir()
+	opts := subtitleRenditionTestOpts(dir)
+	opts.subtitleCueFile = subtitleCueFileName(0)
+	if err := os.WriteFile(filepath.Join(dir, opts.subtitleCueFile), []byte(subtitleRenditionCues), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	writeSubtitleRenditionPlaylist(t, dir, 10, 12)
+	opts.StartSegmentNumber = 10
+	session := &TranscodeSession{outputDir: dir, opts: opts, running: true}
+	session.startSubtitleSpanLocked(opts)
+
+	got, err := session.SubtitleSegmentVTT(t.Context(), 11)
+	if err != nil || !strings.Contains(string(got), "After the gap") {
+		t.Fatalf("segment behind the produced head: %q, %v", got, err)
+	}
+
+	// Segment 12 is the newest the process finished: its next segment is not
+	// written, so later cues may still be in flight.
+	if _, ready, _, imminent := session.subtitleSegmentSource(12); ready || !imminent {
+		t.Fatalf("live-edge segment ready=%v imminent=%v, want a long wait for production", ready, imminent)
+	}
+	// A segment far past the produced output waits briefly and ends in a
+	// valid empty document rather than an error.
+	session.opts.SegmentDuration = 1 // shortest bounded wait
+	start := time.Now()
+	got, err = session.SubtitleSegmentVTT(t.Context(), 40)
+	if err != nil || strings.Contains(string(got), "-->") || !strings.HasPrefix(string(got), "WEBVTT\nX-TIMESTAMP-MAP=") {
+		t.Fatalf("far segment: %q, %v", got, err)
+	}
+	if waited := time.Since(start); waited < minSegmentWait || waited > maxSegmentWait+time.Second {
+		t.Fatalf("far-segment wait took %v", waited)
+	}
+
+	// Before the generation's start, nothing covers the segment.
+	session.mu.Lock()
+	session.running = false
+	session.mu.Unlock()
+	start = time.Now()
+	got, err = session.SubtitleSegmentVTT(t.Context(), 9)
+	if err != nil || strings.Contains(string(got), "-->") || time.Since(start) > time.Second {
+		t.Fatalf("uncovered segment of a stopped session must answer at once: %q, %v", got, err)
+	}
+
+	// A process that exited cleanly finished every segment it listed.
+	got, err = session.SubtitleSegmentVTT(t.Context(), 12)
+	if err != nil || !strings.HasPrefix(string(got), "WEBVTT") {
+		t.Fatalf("finished segment: %q, %v", got, err)
+	}
+}
+
+func TestSubtitleSegmentVTTWakesWhenProductionCatchesUp(t *testing.T) {
+	dir := t.TempDir()
+	opts := subtitleRenditionTestOpts(dir)
+	opts.subtitleCueFile = subtitleCueFileName(0)
+	if err := os.WriteFile(filepath.Join(dir, opts.subtitleCueFile), []byte(subtitleRenditionCues), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	writeSubtitleRenditionPlaylist(t, dir, 0, 10)
+	session := &TranscodeSession{outputDir: dir, opts: opts, running: true}
+	session.startSubtitleSpanLocked(opts)
+
+	produced := make(chan error, 1)
+	go func() {
+		//nolint:forbidigo // Simulates FFmpeg finishing a segment while the request is already waiting.
+		time.Sleep(3 * subtitleCuePollInterval)
+		produced <- writeSubtitleRenditionPlaylistFile(dir, 0, 12)
+	}()
+	got, err := session.SubtitleSegmentVTT(t.Context(), 11)
+	if writeErr := <-produced; writeErr != nil {
+		t.Fatal(writeErr)
+	}
+	if err != nil || !strings.Contains(string(got), "After the gap") {
+		t.Fatalf("waited segment: %q, %v", got, err)
+	}
+}
+
+// After a seek restart on slow storage the new generation can take longer than
+// the short wait to reach the segment the player asks for first. An empty
+// answer would be final for a VOD player, so a segment the live generation is
+// about to produce waits as long as its video segment does.
+func TestSubtitleSegmentVTTWaitsOutASlowRestart(t *testing.T) {
+	dir := t.TempDir()
+	opts := subtitleRenditionTestOpts(dir)
+	opts.SegmentDuration = 1 // the short wait is its minimum; cue 00:21 is in segment 21
+	opts.StartSegmentNumber = 20
+	opts.subtitleCueFile = subtitleCueFileName(0)
+	if err := os.WriteFile(filepath.Join(dir, opts.subtitleCueFile), []byte(subtitleRenditionCues), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	session := &TranscodeSession{outputDir: dir, opts: opts, running: true}
+	session.startSubtitleSpanLocked(opts)
+
+	produced := make(chan error, 1)
+	go func() {
+		//nolint:forbidigo // Simulates a restarted FFmpeg reaching the segment after the short wait.
+		time.Sleep(minSegmentWait + time.Second)
+		produced <- writeSubtitleRenditionPlaylistFile(dir, 20, 22)
+	}()
+	got, err := session.SubtitleSegmentVTT(t.Context(), 21)
+	if writeErr := <-produced; writeErr != nil {
+		t.Fatal(writeErr)
+	}
+	if err != nil || !strings.Contains(string(got), "After the gap") {
+		t.Fatalf("segment after a slow restart: %q, %v", got, err)
+	}
+}
+
+func TestSubtitleSegmentVTTIgnoresAnInheritedPlaylist(t *testing.T) {
+	dir := t.TempDir()
+	opts := subtitleRenditionTestOpts(dir)
+	opts.subtitleCueFile = subtitleCueFileName(0)
+	if err := os.WriteFile(filepath.Join(dir, opts.subtitleCueFile), []byte(subtitleRenditionCues), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	writeSubtitleRenditionPlaylist(t, dir, 0, 20)
+	session := &TranscodeSession{outputDir: dir, opts: opts, inheritedManifest: statManifest(dir)}
+	session.startSubtitleSpanLocked(opts)
+	got, err := session.SubtitleSegmentVTT(t.Context(), 11)
+	if err != nil || strings.Contains(string(got), "-->") {
+		t.Fatalf("an earlier generation's playlist is not this process's progress: %q, %v", got, err)
+	}
+}
+
+func TestSubtitleSpansKeepEarlierGenerationsReadable(t *testing.T) {
+	dir := t.TempDir()
+	opts := subtitleRenditionTestOpts(dir)
+	opts.subtitleCueFile = subtitleCueFileName(0)
+	if err := os.WriteFile(filepath.Join(dir, opts.subtitleCueFile), []byte(subtitleRenditionCues), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	writeSubtitleRenditionPlaylist(t, dir, 0, 14)
+	session := &TranscodeSession{outputDir: dir, opts: opts}
+	session.startSubtitleSpanLocked(opts)
+
+	// A seek restart at segment 900 closes generation 0 at its head.
+	session.closeSubtitleSpan()
+	next := opts
+	next.StartSegmentNumber = 900
+	next.subtitleCueFile = subtitleCueFileName(1)
+	if err := os.WriteFile(filepath.Join(dir, next.subtitleCueFile), []byte("WEBVTT\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	writeSubtitleRenditionPlaylist(t, dir, 900, 901)
+	session.mu.Lock()
+	session.running = true
+	session.opts = next
+	session.startSubtitleSpanLocked(next)
+	session.mu.Unlock()
+
+	if want := []subtitleCueSpan{{file: "subtitles_0.vtt", start: 0, end: 14}, {file: "subtitles_1.vtt", start: 900, end: -1}}; !slices.Equal(session.subtitleSpans, want) {
+		t.Fatalf("spans = %#v, want %#v", session.subtitleSpans, want)
+	}
+	// A backward seek into generation 0's output still has its cues; the
+	// boundary segment it finished last is included.
+	got, err := session.SubtitleSegmentVTT(t.Context(), 12)
+	if err != nil || !strings.Contains(string(got), "After the gap") {
+		t.Fatalf("earlier generation's segment: %q, %v", got, err)
+	}
+	if file, ready, _, _ := session.subtitleSegmentSource(14); !ready || file != "subtitles_0.vtt" {
+		t.Fatalf("closed span must cover its head: %q, %v", file, ready)
+	}
+	if _, ready, _, _ := session.subtitleSegmentSource(15); ready {
+		t.Fatal("segment past the closed span's head must not be served from it")
+	}
+	if file, ready, _, _ := session.subtitleSegmentSource(900); !ready || file != "subtitles_1.vtt" {
+		t.Fatalf("live generation must serve its own segments: %q, %v", file, ready)
+	}
+}
+
+func TestSplitSubtitleRenditionQueryKeepsOtherParametersVerbatim(t *testing.T) {
+	rendition, rest := splitSubtitleRenditionQuery("a=1&prairie_rendition=video&st=x%2By&b")
+	if rendition != subtitleRenditionVideo || rest != "a=1&st=x%2By&b" {
+		t.Fatalf("got %q, %q", rendition, rest)
+	}
+}
+
+// TestSubtitleRenditionAlignsWithRealFFmpegSegments runs the transcode's own
+// command line and checks the contract the player relies on: the cue output
+// carries source-clock cues, and the segment X-TIMESTAMP-MAP maps them onto
+// the video segments' actual timestamps after a seek restart.
+// The cue file keeps the source clock, so a cue belongs in the subtitle
+// segment whose video FFmpeg actually produced at that source time. That only
+// equals [N*d, (N+1)*d) when the source clock starts at zero: a container can
+// start later, and its video can start after its audio, in which case the
+// first generation's grid follows the video while a seek's follows the
+// container.
+func TestSubtitleRenditionAlignsWithRealFFmpegSegments(t *testing.T) {
+	if testing.Short() {
+		t.Skip("real FFmpeg integration test")
+	}
+	ffmpeg, err := exec.LookPath("ffmpeg")
+	if err != nil {
+		t.Skip("ffmpeg is not installed")
+	}
+	ffprobe := ffprobePathFromFFmpeg(ffmpeg)
+	if _, err := exec.LookPath(ffprobe); err != nil {
+		t.Skip("ffprobe is not installed")
+	}
+	ctx, cancel := context.WithTimeout(t.Context(), 4*time.Minute)
+	defer cancel()
+	run := func(t *testing.T, binary string, args ...string) []byte {
+		t.Helper()
+		output, err := exec.CommandContext(ctx, binary, args...).CombinedOutput()
+		if err != nil {
+			t.Fatalf("%s: %v\n%s", filepath.Base(binary), err, output)
+		}
+		return output
+	}
+	work := t.TempDir()
+	srt := filepath.Join(work, "subs.srt")
+	if err := os.WriteFile(srt, []byte("1\n00:00:01,000 --> 00:00:02,500\nEarly\n\n2\n00:00:21,000 --> 00:00:25,000\nAcross segments\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	base := filepath.Join(work, "base.mkv")
+	run(t, ffmpeg, "-v", "error", "-f", "lavfi", "-i", "testsrc2=size=64x64:rate=24",
+		"-f", "lavfi", "-i", "sine=frequency=440:sample_rate=48000", "-i", srt, "-t", "30",
+		"-map", "0", "-map", "1", "-map", "2", "-c:v", "ffv1", "-c:a", "pcm_s16le", "-c:s", "srt", base)
+	// source shifts the video and the audio and subtitles of base.mkv.
+	source := func(t *testing.T, name string, videoStart, otherStart int) string {
+		t.Helper()
+		path := filepath.Join(work, name+".mkv")
+		if _, err := os.Stat(path); err == nil {
+			return path
+		}
+		run(t, ffmpeg, "-v", "error",
+			"-itsoffset", strconv.Itoa(videoStart), "-i", base, "-itsoffset", strconv.Itoa(otherStart), "-i", base,
+			"-map", "0:v", "-map", "1:a", "-map", "1:s", "-c", "copy", path)
+		return path
+	}
+	encoders := string(run(t, ffmpeg, "-hide_banner", "-encoders"))
+
+	for _, container := range []struct {
+		name, video string
+		offset90k   int64
+	}{
+		{"mpegts", transcodeCodecH264, HLSMPEGTSTimestampOffset90k},
+		{"fmp4", transcodeCodecHEVC, 0},
+	} {
+		for _, src := range []struct {
+			name                   string
+			videoStart, otherStart int
+		}{
+			{"zero", 0, 0},
+			{"offset", 7, 7},
+			{"video-after-audio", 7, 3},
+		} {
+			for _, generation := range []struct {
+				name  string
+				seek  float64
+				first int
+			}{
+				{"start", 0, 0},
+				{"seek", 20, 10},
+			} {
+				t.Run(container.name+"/"+src.name+"/"+generation.name, func(t *testing.T) {
+					if container.video == transcodeCodecHEVC && !strings.Contains(encoders, "libx265") {
+						t.Skip("libx265 is unavailable")
+					}
+					dir := t.TempDir()
+					opts := TranscodeOpts{
+						InputPath: source(t, src.name, src.videoStart, src.otherStart), OutputDir: dir, FFmpegPath: ffmpeg, HWAccel: HWAccelNone,
+						SourceVideoCodec: "ffv1", TargetCodecVideo: container.video, TargetCodecAudio: "aac",
+						SeekSeconds: generation.seek, StartSegmentNumber: generation.first, SegmentDuration: 2, TotalDuration: 30,
+						SubtitleTrackIndex: 0, SubtitleCodec: "subrip", SubtitleRendition: true,
+						subtitleCueFile: subtitleCueFileName(0),
+					}
+					if container.video == transcodeCodecHEVC {
+						opts.VideoSampleEntry = VideoSampleEntryHVC1
+					}
+					// A reconstructed session reuses its predecessor's directory and
+					// cue file name; ffmpeg must replace the file, not stop to ask.
+					if err := os.WriteFile(filepath.Join(dir, opts.subtitleCueFile), []byte("WEBVTT\n\n00:21.000 --> 00:22.000\nStale\n"), 0o644); err != nil {
+						t.Fatal(err)
+					}
+					run(t, ffmpeg, buildFFmpegArgs(opts)...)
+
+					// The source time each produced video segment starts at: its first
+					// video frame, less the shift the timestamp map declares.
+					var starts []float64
+					for segment := generation.first; ; segment++ {
+						name := filepath.Join(dir, fmt.Sprintf("seg_%05d.ts", segment))
+						input := []string{"-i", name}
+						if container.video == transcodeCodecHEVC {
+							name = filepath.Join(dir, fmt.Sprintf("seg_%05d.m4s", segment))
+							input = []string{"-i", "concat:" + filepath.Join(dir, "init.mp4") + "|" + name}
+						}
+						if _, err := os.Stat(name); err != nil {
+							break
+						}
+						var report struct {
+							Packets []struct {
+								PTS string `json:"pts_time"`
+							} `json:"packets"`
+						}
+						output := run(t, ffprobe, append([]string{"-v", "error", "-select_streams", "v:0", "-show_entries", "packet=pts_time", "-of", "json"}, input...)...)
+						if err := json.Unmarshal(output, &report); err != nil {
+							t.Fatal(err)
+						}
+						first := math.Inf(1)
+						for _, packet := range report.Packets {
+							if pts, err := strconv.ParseFloat(packet.PTS, 64); err == nil {
+								first = math.Min(first, pts)
+							}
+						}
+						starts = append(starts, first-float64(container.offset90k)/90_000)
+					}
+					if len(starts) < 3 {
+						t.Fatalf("produced %d segments", len(starts))
+					}
+
+					session := &TranscodeSession{outputDir: dir, opts: opts}
+					session.startSubtitleSpanLocked(opts)
+					cues := []struct {
+						text     string
+						from, to float64
+					}{
+						{"Early", float64(src.otherStart) + 1, float64(src.otherStart) + 2.5},
+						{"Across segments", float64(src.otherStart) + 21, float64(src.otherStart) + 25},
+					}
+					wantMap := fmt.Sprintf("X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:%d\n", container.offset90k)
+					for i, start := range starts {
+						segment := generation.first + i
+						end := start + 2
+						if i+1 < len(starts) {
+							end = starts[i+1]
+						}
+						document, err := session.SubtitleSegmentVTT(ctx, segment)
+						if err != nil {
+							t.Fatal(err)
+						}
+						text := string(document)
+						if !strings.HasPrefix(text, "WEBVTT\n"+wantMap) || strings.Contains(text, "Stale") {
+							t.Fatalf("segment %d:\n%s", segment, text)
+						}
+						for _, cue := range cues {
+							want := cue.from < end && cue.to > start
+							if got := strings.Contains(text, cue.text); got != want {
+								t.Errorf("segment %d covers source [%.3f, %.3f): cue %q [%.1f, %.1f) present=%v, want %v\n%s",
+									segment, start, end, cue.text, cue.from, cue.to, got, want, text)
+							}
+						}
+					}
+				})
+			}
+		}
+	}
+}
+
+func subtitleRenditionPlannerInputV3(t *testing.T, codec string, fidelity SubtitleFidelityV3) PlannerInputV3 {
+	t.Helper()
+	file := detailedFixtureFileV3()
+	file.Duration = 6480
+	file.VideoTracks[0].VideoRange = "SDR"
+	file.VideoTracks[0].VideoRangeType = "SDR"
+	file.VideoTracks[0].ColorTransfer = "bt709"
+	file.SubtitleTracks = []models.SubtitleTrack{{Index: 3, Codec: codec, Language: "eng"}}
+	req := validStartRequestV3()
+	req.QualityPreference = "1080p"
+	req.SubtitleFidelityPreference = fidelity
+	req.Capabilities.VideoDecode = []VideoDecodeCapabilityV3{{Codec: "hevc", Profiles: []string{"main 10"}, Levels: []int{153}, BitDepths: []int{10}, MaxWidth: 3840, MaxHeight: 2160, MaxFrameRate: 60, MaxBitrateKbps: 80_000, Hardware: true}}
+	hls := req.ClientPlaybackContext.Deliveries[DeliveryClassHLSV3]
+	hls.Subtitles = DeliverySubtitleCapabilitiesV3{SidecarText: true, EmbeddedText: true}
+	req.ClientPlaybackContext.Deliveries[DeliveryClassHLSV3] = hls
+	index := 0
+	req.SubtitleTrackIndex = &index
+	req.SubtitleTrackID = TrackIDV3(file.ID, "subtitle", index)
+	req.ClientFeatures = append(req.ClientFeatures, FeatureHLSSubtitleRenditionsV3)
+	return PlannerInputV3{
+		Request: req, RequestedFile: file, EffectiveFile: file, AudioTrackIndex: 0,
+		Settings: PlannerSettingsV3{TranscodeEnabled: true, Allow4KTranscode: true}, Registry: testTransformationRegistryV3(),
+		SubtitleRenditionExecutable: func() bool { return true },
+	}
+}
+
+func TestPlanPlaybackV3CarriesEmbeddedTextAsHLSSubtitleRendition(t *testing.T) {
+	input := subtitleRenditionPlannerInputV3(t, "subrip", SubtitleFidelityCompatibleV3)
+	result := PlanPlaybackV3(input)
+	if result.Plan == nil || result.Plan.Delivery != DeliveryTranscodeHLSV3 {
+		t.Fatalf("want a transcode, got %s", ExplainPlannerResultV3(result))
+	}
+	want := &HLSSubtitleRenditionV3{GroupID: "subs", Name: "Subtitles", Format: "vtt", MIMEType: "text/vtt"}
+	subtitle := result.Plan.Subtitle
+	if !result.SubtitleRendition || subtitle.HLSRendition == nil || *subtitle.HLSRendition != *want ||
+		subtitle.Artifact != nil || subtitle.Embedded != nil || subtitle.Mode != SubtitleRenderV3 || subtitle.TrackID != input.Request.SubtitleTrackID {
+		t.Fatalf("subtitle decision = %#v (rendition %v)", subtitle, result.SubtitleRendition)
+	}
+	if result.SubtitleTransportTrackIndex != 0 || result.SubtitleBurnIn || result.Plan.Claims.Subtitles.Reason != "server_hls_subtitle_rendition" {
+		t.Fatalf("recipe = %#v", result)
+	}
+	recipe := FreezeExecutableRecipeV3(result)
+	if !recipe.SubtitleRendition || recipe.Version != executableRecipeVersionSubtitleRenditionV3 || !recipe.ValidFor(*result.Plan) ||
+		!recipe.PlannerResult(result.Plan).SubtitleRendition {
+		t.Fatalf("frozen recipe lost the rendition: %#v", recipe)
+	}
+
+	// A failed rendition falls back to the sidecar plan instead of exhausting
+	// the route.
+	retry := input
+	retry.AttemptedKeys = []string{result.Plan.PlanAttemptKey}
+	fallback := PlanPlaybackV3(retry)
+	if fallback.Plan == nil || fallback.SubtitleRendition || fallback.Plan.Subtitle.HLSRendition != nil ||
+		fallback.Plan.Delivery != DeliveryTranscodeHLSV3 || fallback.Plan.PlanAttemptKey == result.Plan.PlanAttemptKey {
+		t.Fatalf("rendition retry = %s", ExplainPlannerResultV3(fallback))
+	}
+}
+
+func TestPlanPlaybackV3KeepsSidecarWithoutHLSSubtitleRendition(t *testing.T) {
+	for _, tc := range []struct {
+		name     string
+		codec    string
+		fidelity SubtitleFidelityV3
+		mutate   func(*PlannerInputV3)
+	}{
+		{"client did not negotiate", "subrip", SubtitleFidelityCompatibleV3, func(in *PlannerInputV3) {
+			in.Request.ClientFeatures = WithoutFeatureV3(in.Request.ClientFeatures, FeatureHLSSubtitleRenditionsV3)
+		}},
+		{"no capable executor", "subrip", SubtitleFidelityCompatibleV3, func(in *PlannerInputV3) {
+			in.SubtitleRenditionExecutable = func() bool { return false }
+		}},
+		{"unknown duration", "subrip", SubtitleFidelityCompatibleV3, func(in *PlannerInputV3) { in.EffectiveFile.Duration = 0 }},
+		{"ASS keeps its styling", "ass", SubtitleFidelityPreserveV3, func(in *PlannerInputV3) {
+			hls := in.Request.ClientPlaybackContext.Deliveries[DeliveryClassHLSV3]
+			hls.Subtitles.ASSStyling, hls.Subtitles.FontAttachments = true, true
+			in.Request.ClientPlaybackContext.Deliveries[DeliveryClassHLSV3] = hls
+		}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			input := subtitleRenditionPlannerInputV3(t, tc.codec, tc.fidelity)
+			tc.mutate(&input)
+			result := PlanPlaybackV3(input)
+			if result.Plan == nil || result.Plan.Delivery != DeliveryTranscodeHLSV3 {
+				t.Fatalf("want a transcode, got %s", ExplainPlannerResultV3(result))
+			}
+			if result.SubtitleRendition || result.Plan.Subtitle.HLSRendition != nil {
+				t.Fatalf("unexpected rendition: %#v", result.Plan.Subtitle)
+			}
+		})
+	}
+}
+
+func TestPlanPlaybackV3ConvertsASSIntoHLSSubtitleRendition(t *testing.T) {
+	result := PlanPlaybackV3(subtitleRenditionPlannerInputV3(t, "ass", SubtitleFidelityCompatibleV3))
+	if result.Plan == nil || !result.SubtitleRendition || result.Plan.Subtitle.HLSRendition == nil {
+		t.Fatalf("ASS that is converted anyway can use the rendition: %s", ExplainPlannerResultV3(result))
+	}
+}
+
+func TestRecipeCardCarriesSubtitleRendition(t *testing.T) {
+	opts := subtitleRenditionTestOpts(t.TempDir())
+	card := NewRecipeCard(1, "profile", 42, "", opts)
+	claims := card.ToClaims()
+	if !card.SubtitleRendition || !claims.SubtitleRendition || !RecipeCardFromClaims(&claims).SubtitleRendition ||
+		!card.TranscodeOpts(opts.OutputDir, "", nil).SubtitleRendition {
+		t.Fatal("subtitle rendition lost between recipe card, claims, and options")
+	}
+}
diff --git a/internal/playback/subtitle_stream.go b/internal/playback/subtitle_stream.go
index d06101cd22..9cc0ba77ba 100644
--- a/internal/playback/subtitle_stream.go
+++ b/internal/playback/subtitle_stream.go
@@ -2,12 +2,14 @@ package playback
 
 import (
 	"context"
+	"encoding/binary"
 	"errors"
 	"fmt"
 	"io"
 	"log/slog"
 	"net/http"
 	"net/url"
+	"os"
 	"os/exec"
 	"strconv"
 	"strings"
@@ -49,16 +51,15 @@ type StreamExtractOpts struct {
 	// renderer receives the complete script and event timeline.
 	AllowWindow bool
 	// InputIsExtractedSup marks InputPath as a cached full-track .sup
-	// elementary stream (a previous full extract, produced with -copyts so
-	// its timestamps are absolute source PTS) rather than the original
+	// elementary stream (a previous unseeked full extract, so its
+	// timestamps are on the playback timeline) rather than the original
 	// media container. The input format is forced with `-f sup` — the
 	// headerless stream is probeable via its "PG" magic, but an explicit
 	// format is robust against probe-size edge cases — and the stream
 	// mapping is forced to `0:s:0`: a .sup holds exactly one stream, so
 	// TrackIndex (which names the ordinal in the *original* container) no
-	// longer applies. Seeking such an input with -copyts re-emits the same
-	// absolute timestamps, so windowed output is byte-compatible with a
-	// window cut from the original file.
+	// longer applies. Seeking such an input with -copyts re-emits its
+	// stored timestamps.
 	InputIsExtractedSup bool
 	// FFmpegPath overrides the ffmpeg binary lookup.
 	FFmpegPath string
@@ -136,6 +137,48 @@ func StreamExtractSubtitle(ctx context.Context, opts StreamExtractOpts) error {
 	return nil
 }
 
+// cachedSupSeekSlack is how far before a window's start an extract from a
+// cached .sup seeks, so a display set at the start is read whole. Its
+// segments are separate packets, and in a cache made from a Blu-ray transport
+// stream they keep their own timestamps, decoded ahead of the time the set
+// shows (a full-plane object decodes in about 0.13 s). The extra lead-in only
+// adds earlier screens, or part of one, which a PGS decoder merges or drops.
+const cachedSupSeekSlack = 2.0
+
+// windowFromCachedSup adapts a windowed extract whose input is a cached .sup
+// whose first cue is at firstCue seconds. ffmpeg cannot seek to a point
+// before a file's first packet: it reports the failed seek, carries on, and
+// loses the first display set's presentation segment. A window that starts
+// at or before the first cue reads from the start instead and ends where it
+// would have; nothing before the first cue exists to leave out.
+func windowFromCachedSup(opts StreamExtractOpts, firstCue float64) StreamExtractOpts {
+	if opts.SeekSeconds > 0 && opts.SeekSeconds-cachedSupSeekSlack <= firstCue {
+		if opts.DurationSeconds > 0 {
+			opts.DurationSeconds += opts.SeekSeconds
+		}
+		opts.SeekSeconds = 0
+	}
+	return opts
+}
+
+// readSupFirstCue returns the time, in seconds, of the first segment in a
+// .sup file.
+func readSupFirstCue(path string) (float64, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return 0, err
+	}
+	defer func() { _ = f.Close() }()
+	header := make([]byte, 13)
+	if _, err := io.ReadFull(f, header); err != nil {
+		return 0, err
+	}
+	if header[0] != 'P' || header[1] != 'G' {
+		return 0, errors.New("not a .sup stream")
+	}
+	return float64(binary.BigEndian.Uint32(header[2:6])) / 90000, nil
+}
+
 // streamExtractArgs builds the ffmpeg argument list for a streaming
 // subtitle extract.
 func streamExtractArgs(opts StreamExtractOpts) []string {
@@ -152,13 +195,23 @@ func streamExtractArgs(opts StreamExtractOpts) []string {
 	// stream exactly once and consumes it whole needs the complete track
 	// from offset 0 — windowing would silently drop every cue outside
 	// the window. Clients that manage their own sliding window opt in
-	// via AllowWindow; -copyts below keeps the windowed output on
-	// absolute source timestamps so cues stay in sync. The same logic
+	// via AllowWindow; -copyts below keeps the windowed output on the
+	// playback timeline so cues stay in sync. The same logic
 	// governs the -t duration cap below.
 	windowable := !IsASS(opts.SourceCodec) && (!IsPGS(opts.SourceCodec) || opts.AllowWindow)
 	seekApplied := opts.SeekSeconds > 0 && windowable
 	if seekApplied {
-		args = append(args, "-ss", strconv.FormatFloat(opts.SeekSeconds, 'f', 3, 64))
+		seek := opts.SeekSeconds
+		if opts.InputIsExtractedSup {
+			seek = max(0, seek-cachedSupSeekSlack)
+		}
+		args = append(args, "-ss", strconv.FormatFloat(seek, 'f', 3, 64))
+		// ffmpeg offsets an input seek by the input's start time. A cached
+		// .sup's start time is its first cue, so the seek has to be taken
+		// as an absolute timestamp or the window starts that much late.
+		if opts.InputIsExtractedSup {
+			args = append(args, "-seek_timestamp", "1")
+		}
 	}
 
 	// A cached .sup input has no container magic worth probing and exactly
@@ -174,17 +227,30 @@ func streamExtractArgs(opts StreamExtractOpts) []string {
 		"-c:s", outCodec,
 	)
 
-	// When we seek the input, preserve the absolute source timestamps
-	// in the output. Without this ffmpeg rebases cues to start at 0,
-	// which makes every cue play `opts.SeekSeconds` earlier than it
-	// should — the symptom is subtitles that look "out of sync" with
-	// the video the player is showing at the same media time.
-	if seekApplied {
+	// When we seek the input, keep the cues on the source timeline.
+	// Without -copyts ffmpeg rebases cues to start at 0, which makes
+	// every cue play `opts.SeekSeconds` earlier than it should — the
+	// symptom is subtitles that look "out of sync" with the video the
+	// player is showing at the same media time.
+	//
+	// The playback timeline starts at the container start, which is how
+	// an unseeked extract comes out (ffmpeg subtracts the input start
+	// time). -start_at_zero makes a seeked extract subtract it too, so
+	// windows taken after a seek stay on the same clock as the first one
+	// instead of running late by the container's start time (seconds
+	// for TS remuxes). A cached .sup was already rebased when it was
+	// extracted, and its own start time is its first cue, so it keeps its
+	// timestamps as they are, seeked or not; rebasing it would pull every
+	// cue early by the first cue's time.
+	switch {
+	case opts.InputIsExtractedSup:
 		args = append(args, "-copyts", "-avoid_negative_ts", "disabled")
+	case seekApplied:
+		args = append(args, "-copyts", "-start_at_zero", "-avoid_negative_ts", "disabled")
 	}
 	// Input -t does not bound subtitle-only output: ffmpeg keeps demuxing
-	// and emitting cues to EOF. Limit the output instead, using the absolute
-	// window end because -copyts preserves the source timeline after a seek.
+	// and emitting cues to EOF. Limit the output instead, using the window's
+	// end on the playback timeline, which -copyts keeps after a seek.
 	// Using only the duration here would end resumed windows too early (or
 	// emit no cues when the seek already exceeds that duration).
 	if opts.DurationSeconds > 0 && windowable {
diff --git a/internal/playback/subtitle_stream_test.go b/internal/playback/subtitle_stream_test.go
index e2dec056f0..6cf3240fc8 100644
--- a/internal/playback/subtitle_stream_test.go
+++ b/internal/playback/subtitle_stream_test.go
@@ -34,7 +34,50 @@ func TestStreamExtractSubtitleBoundsWindow(t *testing.T) {
 	if got := output.String(); !strings.Contains(got, "Inside window") ||
 		!strings.Contains(got, "13:20.000 --> 13:25.000") ||
 		strings.Contains(got, "Before window") || strings.Contains(got, "After window") {
-		t.Fatalf("expected only the in-window cue at its absolute timestamp, got %q", got)
+		t.Fatalf("expected only the in-window cue at its source timestamp, got %q", got)
+	}
+}
+
+// The playback timeline starts at the container start. A window cut after a
+// seek must put each cue where the unseeked extract does, even when the
+// container's first timestamp is not zero (TS remuxes), or subtitles run late
+// by that start time after every seek.
+func TestStreamExtractSubtitleSeekKeepsContainerRelativeTimeline(t *testing.T) {
+	bin, err := exec.LookPath("ffmpeg")
+	if err != nil {
+		t.Skip("ffmpeg is required to verify subtitle window timestamps")
+	}
+	dir := t.TempDir()
+	srt := filepath.Join(dir, "captions.srt")
+	if err := os.WriteFile(srt, []byte("1\n00:00:40,000 --> 00:00:42,000\nForty seconds in\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	source := filepath.Join(dir, "offset.mkv")
+	mux := exec.CommandContext(t.Context(), bin, "-hide_banner", "-loglevel", "error",
+		"-f", "lavfi", "-i", "color=c=black:s=64x64:r=5:d=60", "-i", srt,
+		"-map", "0:v", "-map", "1:s", "-c:v", "mpeg4", "-c:s", "srt",
+		"-output_ts_offset", "30", source)
+	if out, err := mux.CombinedOutput(); err != nil {
+		t.Fatalf("build fixture: %v: %s", err, out)
+	}
+
+	extract := func(seek float64) string {
+		t.Helper()
+		var output bytes.Buffer
+		if err := StreamExtractSubtitle(t.Context(), StreamExtractOpts{
+			InputPath: source, SourceCodec: "subrip", SeekSeconds: seek, DurationSeconds: 600,
+			FFmpegPath: bin, Writer: &output,
+		}); err != nil {
+			t.Fatal(err)
+		}
+		return output.String()
+	}
+	const cue = "00:40.000 --> 00:42.000"
+	if got := extract(0); !strings.Contains(got, cue) {
+		t.Fatalf("unseeked extract should place the cue at %s, got %q", cue, got)
+	}
+	if got := extract(35); !strings.Contains(got, cue) {
+		t.Fatalf("seeked window should place the cue at %s like the unseeked extract, got %q", cue, got)
 	}
 }
 
@@ -134,7 +177,7 @@ func TestStreamExtractArgs_WholeTrackCodecsIgnoreWindow(t *testing.T) {
 }
 
 // A client that opts in via AllowWindow gets a seeked, duration-capped PGS
-// extract with -copyts preserving absolute source timestamps — the -ss must
+// extract with -copyts keeping cues on the playback timeline — the -ss must
 // be an input option (before -i) so ffmpeg uses the container index.
 func TestStreamExtractArgs_WindowedPGS(t *testing.T) {
 	args := streamExtractArgs(StreamExtractOpts{
@@ -170,7 +213,7 @@ func TestStreamExtractArgs_WindowedPGS(t *testing.T) {
 // sup demuxer (the elementary stream has no container header to probe from
 // arbitrary offsets), remap to the file's sole stream regardless of the
 // original container's track ordinal, and still seek/window with -copyts so
-// the cached stream's absolute timestamps survive into the output.
+// the cached stream's stored timestamps survive into the output.
 func TestStreamExtractArgs_ExtractedSupInput(t *testing.T) {
 	args := streamExtractArgs(StreamExtractOpts{
 		InputPath:           "/transcode/subtitle-cache/abc-s3-1-2.sup",
@@ -192,7 +235,9 @@ func TestStreamExtractArgs_ExtractedSupInput(t *testing.T) {
 	if strings.Contains(joined, "0:s:3") {
 		t.Fatalf("original container track ordinal must not leak into sup input mapping: %s", joined)
 	}
-	if !strings.Contains(joined, "-ss 1200.000") || !strings.Contains(joined, "-to 4800.000") {
+	// The seek starts early so a display set at the window start is read
+	// whole; the end is unchanged.
+	if !strings.Contains(joined, "-ss 1198.000") || !strings.Contains(joined, "-to 4800.000") {
 		t.Fatalf("cached sup extract must still window the input: %s", joined)
 	}
 	ssIdx := slices.Index(args, "-ss")
@@ -201,11 +246,43 @@ func TestStreamExtractArgs_ExtractedSupInput(t *testing.T) {
 		t.Fatalf("-ss must be an input option (before -i): %s", joined)
 	}
 	if !strings.Contains(joined, "-copyts") {
-		t.Fatalf("cached sup extract must preserve absolute timestamps: %s", joined)
+		t.Fatalf("cached sup extract must preserve its stored timestamps: %s", joined)
+	}
+	// The cached .sup is already on the playback timeline and its start time
+	// is its first cue; rebasing it would pull every cue early by that much.
+	if slices.Contains(args, "-start_at_zero") {
+		t.Fatalf("cached sup extract must not rebase its timestamps: %s", joined)
 	}
 	if !strings.Contains(joined, "-c:s copy") || !strings.Contains(joined, "-f sup pipe:1") {
 		t.Fatalf("cached sup extract should copy into a sup stream: %s", joined)
 	}
+	// ffmpeg offsets an input seek by the input's start time, which for a
+	// cached .sup is its first cue; the seek must be absolute instead.
+	if tsIdx := slices.Index(args, "-seek_timestamp"); tsIdx < 0 || tsIdx > inIdx || args[tsIdx+1] != "1" {
+		t.Fatalf("cached sup seek must be an absolute timestamp (-seek_timestamp 1 before -i): %s", joined)
+	}
+}
+
+// An unseeked window from a cached .sup keeps its stored timestamps too:
+// without -copyts ffmpeg rebases the stream onto its first cue.
+func TestStreamExtractArgs_ExtractedSupInputFromStart(t *testing.T) {
+	args := streamExtractArgs(StreamExtractOpts{
+		InputPath:           "/transcode/subtitle-cache/abc-s3-1-2.sup",
+		SourceCodec:         "hdmv_pgs_subtitle",
+		DurationSeconds:     600,
+		AllowWindow:         true,
+		InputIsExtractedSup: true,
+	})
+	joined := strings.Join(args, " ")
+	if !slices.Contains(args, "-copyts") || slices.Contains(args, "-start_at_zero") {
+		t.Fatalf("cached sup extract must keep its stored timestamps: %s", joined)
+	}
+	if slices.Contains(args, "-ss") || slices.Contains(args, "-seek_timestamp") {
+		t.Fatalf("an extract from the start must not seek: %s", joined)
+	}
+	if !strings.Contains(joined, "-to 600.000") {
+		t.Fatalf("the window still ends at its duration: %s", joined)
+	}
 }
 
 // AllowWindow must not truncate the script consumed by an ASS renderer that
@@ -299,3 +376,43 @@ func TestStreamExtractArgs_PGSProducesSup(t *testing.T) {
 		t.Fatalf("PGS extract should copy into a sup stream: %s", joined)
 	}
 }
+
+// A window from a cached .sup that starts at or before the first cue cannot
+// be seeked (ffmpeg fails the seek and loses the first presentation
+// segment), so it reads from the start and keeps its absolute end.
+func TestWindowFromCachedSup(t *testing.T) {
+	for _, tc := range []struct {
+		name              string
+		seek, duration    float64
+		wantSeek, wantDur float64
+	}{
+		{name: "before the first cue", seek: 35, duration: 60, wantSeek: 0, wantDur: 95},
+		{name: "onto the first cue", seek: 40, duration: 60, wantSeek: 0, wantDur: 100},
+		{name: "after the first cue", seek: 95, duration: 60, wantSeek: 95, wantDur: 60},
+		{name: "from the start", seek: 0, duration: 60, wantSeek: 0, wantDur: 60},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			got := windowFromCachedSup(StreamExtractOpts{SeekSeconds: tc.seek, DurationSeconds: tc.duration}, 40)
+			if got.SeekSeconds != tc.wantSeek || got.DurationSeconds != tc.wantDur {
+				t.Fatalf("got seek %v duration %v, want %v %v", got.SeekSeconds, got.DurationSeconds, tc.wantSeek, tc.wantDur)
+			}
+		})
+	}
+}
+
+func TestReadSupFirstCue(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "track.sup")
+	if err := os.WriteFile(path, testSupStream([]float64{91.88, 100}, 0), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	got, err := readSupFirstCue(path)
+	if err != nil || got != 91.88 {
+		t.Fatalf("readSupFirstCue = %v, %v; want 91.88", got, err)
+	}
+	if err := os.WriteFile(path, []byte("not a sup stream"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := readSupFirstCue(path); err == nil {
+		t.Fatal("a file without the PG magic should be refused")
+	}
+}
diff --git a/internal/playback/subtitle_text_batch.go b/internal/playback/subtitle_text_batch.go
index 34c96c6889..7d61130d43 100644
--- a/internal/playback/subtitle_text_batch.go
+++ b/internal/playback/subtitle_text_batch.go
@@ -271,6 +271,9 @@ func (c *SubtitleCache) waitForTextFill(ctx context.Context, inputPath string, t
 	if done == nil {
 		return false
 	}
+	if afterTextFillWaitCapture != nil {
+		afterTextFillWaitCapture()
+	}
 	select {
 	case <-done:
 		return true
diff --git a/internal/playback/testdata/protocol_v3/conformance_matrix.json b/internal/playback/testdata/protocol_v3/conformance_matrix.json
index da5c79b23e..2581eb97e4 100644
--- a/internal/playback/testdata/protocol_v3/conformance_matrix.json
+++ b/internal/playback/testdata/protocol_v3/conformance_matrix.json
@@ -174,7 +174,7 @@
       "expected": {
         "outcome": "playable",
         "delivery": "server_transcode_hls",
-        "decision_reason": "quality_original",
+        "decision_reason": "quality_auto_source",
         "plan_id": "plan:176744988a004fd5f2230c221961c41a",
         "plan_attempt_key": "v3:d1ecc0d9511b83b8",
         "selected_tracks": {
diff --git a/internal/playback/testdata/protocol_v3/hls-subtitle-rendition-decision_response.json b/internal/playback/testdata/protocol_v3/hls-subtitle-rendition-decision_response.json
new file mode 100644
index 0000000000..e050c9b2ba
--- /dev/null
+++ b/internal/playback/testdata/protocol_v3/hls-subtitle-rendition-decision_response.json
@@ -0,0 +1,211 @@
+{
+  "protocol_version": 3,
+  "server_features": [
+    "playback_plan_v3",
+    "server_remote_stream_bitrate_policy_v1",
+    "server_local_stream_bitrate_policy_v1",
+    "neutral_playback_v3_contract_v1",
+    "embedded_subtitles_v1",
+    "layout_aware_passthrough",
+    "playback_route_diagnostics",
+    "device_quirks_v1",
+    "seek_reanchor_v1",
+    "output_change_v1",
+    "output_display_evidence_v1",
+    "direct_stream_resume_v1",
+    "header_authenticated_media_v1",
+    "authorized_media_origins_v1",
+    "software_video_decode_v1",
+    "plan_invalidated_v1",
+    "plan_source_duration_v1",
+    "subrip_sidecar_v1",
+    "marker_thumbnails_v1",
+    "hls_subtitle_renditions_v1"
+  ],
+  "outcome": "playable",
+  "session_id": "11111111-1111-4111-8111-111111111111",
+  "playback_plan": {
+    "protocol_version": 3,
+    "plan_id": "plan:a2bfe37d35d5f2cff351991b5fcbf627",
+    "plan_attempt_key": "v3:cd7f226dafc35c0a",
+    "session_id": "11111111-1111-4111-8111-111111111111",
+    "expires_at": "2030-01-01T00:00:00Z",
+    "delivery": "server_transcode_hls",
+    "stream": {
+      "url": "/playback/transcode/11111111-1111-4111-8111-111111111111/master.m3u8",
+      "protocol": "hls",
+      "container": "hls",
+      "mime_type": "application/vnd.apple.mpegurl",
+      "headers": {},
+      "header_refresh": "none"
+    },
+    "timeline": {
+      "source_start_seconds": 12.5,
+      "stream_origin_seconds": 0,
+      "player_start_seconds": 12.5,
+      "timeline_offset_seconds": 0,
+      "can_seek_anywhere": true,
+      "seek_restoration": "player_position"
+    },
+    "selected_tracks": {
+      "audio": {
+        "id": "file:42:audio:0",
+        "index": 0
+      },
+      "subtitle": {
+        "id": "file:42:subtitle:0",
+        "index": 0
+      }
+    },
+    "effective_recipe": {
+      "video_codec": "h264",
+      "audio_codec": "aac",
+      "width": 1280,
+      "height": 720,
+      "frame_rate": 23.976023976023978,
+      "bitrate_kbps": 2000,
+      "dynamic_range": "sdr",
+      "audio_channels": 2,
+      "audio_layout": "stereo"
+    },
+    "claims": {
+      "video": {
+        "hdr10": false,
+        "hdr10_plus": false,
+        "hlg": false,
+        "dolby_vision": false
+      },
+      "audio": {
+        "codec": "aac",
+        "passthrough": false,
+        "atmos_preserved": false,
+        "reason": "server_audio_adaptation"
+      },
+      "subtitles": {
+        "ass_styling_preserved": false,
+        "bitmap_overlay": false,
+        "bitmap_sidecar": false,
+        "reason": "server_hls_subtitle_rendition"
+      }
+    },
+    "subtitle": {
+      "hls_rendition": {
+        "group_id": "subs",
+        "name": "Subtitles",
+        "format": "vtt",
+        "mime_type": "text/vtt"
+      },
+      "mode": "render",
+      "track_id": "file:42:subtitle:0",
+      "inventory": [
+        {
+          "track_id": "file:42:subtitle:0",
+          "combined_index": 0,
+          "source": "embedded",
+          "codec": "subrip",
+          "language": "eng",
+          "label": "English",
+          "forced": false,
+          "default": false,
+          "hearing_impaired": false,
+          "delivery": "sidecar",
+          "url": "/stream/11111111-1111-4111-8111-111111111111/subtitles/0.vtt?file_id=42\u0026embedded_stream_index=3"
+        }
+      ]
+    },
+    "transformations": [
+      {
+        "name": "video_to_h264",
+        "executor": "server",
+        "recipe_version": "2",
+        "validated_claims": [
+          "h264_decode"
+        ]
+      },
+      {
+        "name": "audio_to_aac",
+        "executor": "server",
+        "recipe_version": "4",
+        "validated_claims": [
+          "audio_decode"
+        ]
+      }
+    ],
+    "applied_quirks": [],
+    "runtime_corrections": [],
+    "available_qualities": [
+      {
+        "label": "original",
+        "height": 1080,
+        "bitrate_kbps": 8000,
+        "preserves_source": true
+      },
+      {
+        "label": "1080p-medium",
+        "display_name": "1080p Medium",
+        "height": 1080,
+        "bitrate_kbps": 6000,
+        "preserves_source": false
+      },
+      {
+        "label": "1080p-low",
+        "display_name": "1080p Low",
+        "height": 1080,
+        "bitrate_kbps": 3000,
+        "preserves_source": false
+      },
+      {
+        "label": "720p-high",
+        "display_name": "720p High",
+        "height": 720,
+        "bitrate_kbps": 4000,
+        "preserves_source": false
+      },
+      {
+        "label": "720p-medium",
+        "display_name": "720p Medium",
+        "height": 720,
+        "bitrate_kbps": 2000,
+        "preserves_source": false
+      },
+      {
+        "label": "720p-low",
+        "display_name": "720p Low",
+        "height": 720,
+        "bitrate_kbps": 1500,
+        "preserves_source": false
+      },
+      {
+        "label": "480p",
+        "display_name": "480p",
+        "height": 480,
+        "bitrate_kbps": 1500,
+        "preserves_source": false
+      }
+    ],
+    "degradation_warnings": [],
+    "decision_reason": "quality_fixed_rung",
+    "requested_media_file_id": 42,
+    "effective_media_file_id": 42,
+    "source": {
+      "media_file_id": 42,
+      "duration_seconds": 7200,
+      "container": "mp4",
+      "video_codec": "h264",
+      "video_profile": "high",
+      "video_level": 41,
+      "bit_depth": 8,
+      "width": 1920,
+      "height": 1080,
+      "frame_rate": 23.976023976023978,
+      "bitrate_kbps": 8000,
+      "dynamic_range": "sdr",
+      "hdr10_plus": false,
+      "dv_enhancement_layer": "none",
+      "audio_codec": "aac",
+      "audio_channels": 2,
+      "audio_layout": "stereo"
+    },
+    "subtitle_fidelity_policy": "allow_simplified_rendering"
+  }
+}
diff --git a/internal/playback/transcode.go b/internal/playback/transcode.go
index daaca448e2..e0da51044e 100644
--- a/internal/playback/transcode.go
+++ b/internal/playback/transcode.go
@@ -20,6 +20,7 @@ import (
 	"time"
 
 	"github.com/google/uuid"
+
 	"github.com/prairie-server/prairie-server/internal/mediaprobe"
 	"github.com/prairie-server/prairie-server/internal/models"
 	"github.com/prairie-server/prairie-server/internal/processmetrics"
@@ -52,7 +53,16 @@ type TranscodeOpts struct {
 	// CopyVideoMPEGTS packages copied video in MPEG-TS instead of fMP4. It is
 	// durable because the segment extension and bytes must survive restarts.
 	CopyVideoMPEGTS bool
-	SeekSeconds     float64
+	// KeyframePlaylist serves a copy-video stream that starts at the
+	// beginning as one complete VOD playlist planned from the source's
+	// keyframe index, instead of FFmpeg's growing playlist (#1466). It is
+	// durable because a reconstructed session must keep serving the playlist
+	// the player already has.
+	KeyframePlaylist bool
+	// Reconstructed marks a session rebuilt from its recipe after its server
+	// or node lost it. It isn't durable: each rebuild sets it.
+	Reconstructed bool
+	SeekSeconds   float64
 	// StreamOriginSeconds is the keyframe timestamp at which a copy-video
 	// stream actually begins. SeekSeconds remains the client-requested -ss so
 	// FFmpeg performs exactly one demuxer seek; this origin keeps response and
@@ -130,6 +140,14 @@ type TranscodeOpts struct {
 	// filter_complex pipeline; text codecs use the libass subtitles filter.
 	// Empty preserves the legacy text path for callers minted before the field.
 	SubtitleCodec string
+	// SubtitleRendition emits the selected embedded text track
+	// (SubtitleTrackIndex, never burned in) from this same ffmpeg process as
+	// the WebVTT subtitle rendition of the synthetic HLS playlist. See
+	// subtitle_rendition.go.
+	SubtitleRendition bool
+	// subtitleCueFile is the per-generation cue file the rendition output
+	// writes. Process-local: every start and restart derives its own.
+	subtitleCueFile string
 	// PreparedTracks selects the multi-track stream layout of a prepared
 	// download (PrepareFile only). Nil keeps the legacy single-audio,
 	// subtitle-free layout that older artifacts were encoded with.
@@ -283,6 +301,15 @@ type TranscodeSession struct {
 	// reacquires this same device rather than re-running selection, so a restart
 	// keeps its GPU affinity and stays visible in per-device reporting.
 	hwWorkloadDevice string
+	// copyPlan is the planned segment list served instead of FFmpeg's
+	// playlist, or nil. It is fixed when the session starts.
+	copyPlan *copySegmentPlan
+	// subtitleSpans lists each generation's subtitle rendition cue file,
+	// oldest first. Guarded by mu.
+	subtitleSpans []subtitleCueSpan
+	// subtitleOriginMu serializes observations of a span's origin, so
+	// concurrent subtitle requests share one ffprobe run.
+	subtitleOriginMu sync.Mutex
 }
 
 // NewTranscodeSessionForTest exposes only the output directory needed by tests
@@ -330,6 +357,9 @@ type SegmentRecoveryDecision struct {
 	Progress         SegmentProgress
 }
 
+// segmentReasonRestarting is the recovery reason while a restart is in flight.
+const segmentReasonRestarting = "transcode_restarting"
+
 // defaultSegmentDuration is the segment length when not specified. Short
 // segments (2s) allow the player to start quickly while still maintaining
 // efficient HTTP delivery. This matches the approach used by Plex.
@@ -449,6 +479,16 @@ func StartTranscode(ctx context.Context, opts TranscodeOpts) (*TranscodeSession,
 		releaseHWDevice()
 		return nil, err
 	}
+	copyPlan := resolveCopyPlan(ctx, opts)
+	if copyPlan == nil && opts.Reconstructed && opts.KeyframePlaylist && ctx.Err() != nil {
+		// Rebuilding without the plan would serve FFmpeg's playlist to a
+		// player that may hold the planned one; a later request rebuilds.
+		releaseHWDevice()
+		return nil, fmt.Errorf("plan rebuilt keyframe playlist: %w", ctx.Err())
+	}
+	if copyPlan != nil {
+		log.Printf("playback: session %s serves a %d-segment keyframe playlist", opts.SessionID, len(copyPlan.durations))
+	}
 
 	// The synchronous source guard above is bounded by the caller's startup
 	// context. Once it succeeds, keep the established behavior where the
@@ -457,6 +497,9 @@ func StartTranscode(ctx context.Context, opts TranscodeOpts) (*TranscodeSession,
 	if !opts.manifestWindowPinned {
 		opts.PinManifestWindowStart(opts.ManifestWindowStartSegment())
 	}
+	if subtitleRenditionActive(opts) {
+		opts.subtitleCueFile = subtitleCueFileName(0)
+	}
 	s := &TranscodeSession{
 		cancel:               cancel,
 		opts:                 opts,
@@ -470,6 +513,7 @@ func StartTranscode(ctx context.Context, opts TranscodeOpts) (*TranscodeSession,
 		lastPruneHighWater:   opts.StartSegmentNumber - 1,
 		segmentIncarnation:   uuid.NewString(),
 		hwWorkloadDevice:     hwWorkloadDevice,
+		copyPlan:             copyPlan,
 	}
 
 	args := buildFFmpegArgs(opts)
@@ -507,6 +551,7 @@ func StartTranscode(ctx context.Context, opts TranscodeOpts) (*TranscodeSession,
 	s.stdinPipe = stdinPipe
 	s.generationStartedAt = startedAt
 	s.inheritedManifest = inheritedManifest
+	s.startSubtitleSpanLocked(opts)
 	s.logFFmpegEvent(ctx, "ffmpeg process started", "")
 
 	// Monitor ffmpeg in background. The process-specific reservation is released
@@ -945,6 +990,7 @@ func buildFFmpegArgs(opts TranscodeOpts) []string {
 		args = append(args, "-start_number", fmt.Sprintf("%d", opts.StartSegmentNumber))
 	}
 	args = append(args, manifestPath)
+	args = appendSubtitleRenditionOutputArgs(args, opts)
 
 	return args
 }
@@ -1502,7 +1548,8 @@ func toneMapScaleFilter(opts TranscodeOpts) string {
 	case tonemap.ModeHardware:
 		switch opts.HWAccel {
 		case transcodeHWQSV:
-			return softwareToneMapUploadFilter(opts) + tonemap.QSVFilter(opts.ToneMapSourceKind) + "," + qsvToneMapScaleFilter(opts.TargetResolution) + "," + tonemap.HDRMetadataRemovalFilter()
+			height, _ := scaleTargetHeight(opts.TargetResolution)
+			return softwareToneMapUploadFilter(opts) + tonemap.QSVFilter(opts.ToneMapSourceKind, height) + "," + tonemap.QSVInteropFilter() + "," + tonemap.HDRMetadataRemovalFilter()
 		case transcodeHWVAAPI:
 			return softwareToneMapUploadFilter(opts) + tonemap.VAAPIFilter(opts.ToneMapSourceKind) + "," + vaapiScaleFilter(opts.TargetResolution) + "," + tonemap.HDRMetadataRemovalFilter()
 		case transcodeHWNVENC:
@@ -1540,7 +1587,7 @@ func toneMappedTextSubtitleFilter(opts TranscodeOpts) string {
 	}
 	switch opts.HWAccel {
 	case transcodeHWQSV:
-		return softwareToneMapUploadFilter(opts) + tonemap.QSVFilter(opts.ToneMapSourceKind) + ",hwdownload,format=nv12," + cpuTail + ",format=nv12,hwupload,hwmap=derive_device=qsv:mode=read+write,format=qsv," + tonemap.HDRMetadataRemovalFilter()
+		return softwareToneMapUploadFilter(opts) + tonemap.QSVFilter(opts.ToneMapSourceKind, 0) + ",hwdownload,format=nv12," + cpuTail + ",format=nv12,hwupload,hwmap=derive_device=qsv:mode=read+write,format=qsv," + tonemap.HDRMetadataRemovalFilter()
 	case transcodeHWVAAPI:
 		return softwareToneMapUploadFilter(opts) + tonemap.VAAPIFilter(opts.ToneMapSourceKind) + ",hwdownload,format=nv12," + cpuTail + ",format=nv12,hwupload," + tonemap.HDRMetadataRemovalFilter()
 	case transcodeHWNVENC:
@@ -1572,9 +1619,13 @@ func appendToneMappedBitmapSubtitleArgs(args []string, opts TranscodeOpts) []str
 
 	switch opts.HWAccel {
 	case transcodeHWQSV:
-		graph = "[0:v:0]" + softwareToneMapUploadFilter(opts) + tonemap.QSVFilter(opts.ToneMapSourceKind) + "[vmain];" +
-			subInput + "format=bgra,hwupload[sub];[vmain][sub]overlay_vaapi=eof_action=pass," +
-			qsvToneMapScaleFilter(opts.TargetResolution) + "," + tonemap.HDRMetadataRemovalFilter() + "[vout]"
+		if tonemap.IsSDRSource(opts.ToneMapSourceKind) {
+			graph = "[0:v:0]" + softwareToneMapUploadFilter(opts) + tonemap.QSVFilter(opts.ToneMapSourceKind, 0) + "[vmain];" +
+				subInput + "format=bgra,hwupload[sub];[vmain][sub]overlay_vaapi=eof_action=pass," +
+				qsvToneMapScaleFilter(opts.TargetResolution) + "," + tonemap.HDRMetadataRemovalFilter() + "[vout]"
+		} else {
+			graph = "[0:v:0]" + softwareToneMapUploadFilter(opts) + qsvOpenCLBitmapSubtitleGraph(opts, subInput)
+		}
 	case transcodeHWVAAPI:
 		graph = "[0:v:0]" + softwareToneMapUploadFilter(opts) + tonemap.VAAPIFilter(opts.ToneMapSourceKind) + "[vmain];" +
 			subInput + "format=bgra,hwupload[sub];[vmain][sub]overlay_vaapi=eof_action=pass," +
@@ -1600,6 +1651,28 @@ func appendToneMappedBitmapSubtitleArgs(args []string, opts TranscodeOpts) []str
 	return append(args, "-filter_complex", graph)
 }
 
+// qsvOpenCLBitmapSubtitleGraph composites a bitmap subtitle onto an HDR frame
+// while it is still on the OpenCL device after tone mapping, then scales it
+// there. overlay_vaapi reading the tone-mapped surface corrupts frames the
+// same way a scale_vaapi does (see tonemap.QSVFilter). The subtitle goes on at
+// the source resolution before the scale, as with overlay_vaapi, and its RGB
+// frames are converted with the BT.709 matrix of the tone-mapped frame.
+//
+// scale_opencl, overlay_opencl's eof_action and YUVA overlays, and a shared
+// OpenCL device for both hwupload and hwmap come from Jellyfin FFmpeg, which
+// the QSV tone-map path already requires for tonemap_opencl's bt2390 curve.
+// The QSV probe's listing gate checks that both filters exist.
+func qsvOpenCLBitmapSubtitleGraph(opts TranscodeOpts, subInput string) string {
+	scale := ""
+	if height, ok := scaleTargetHeight(opts.TargetResolution); ok {
+		scale = fmt.Sprintf("scale_opencl=w=-2:h=%d,", height)
+	}
+	return tonemap.QSVOpenCLToneMapFilter(opts.ToneMapSourceKind, 0) + "[vmain];" +
+		subInput + "scale=out_color_matrix=bt709:out_range=tv,format=yuva420p,hwupload=derive_device=opencl[sub];" +
+		"[vmain][sub]overlay_opencl=eof_action=pass," + scale +
+		tonemap.QSVOpenCLReturnFilter() + "," + tonemap.QSVInteropFilter() + "," + tonemap.HDRMetadataRemovalFilter() + "[vout]"
+}
+
 // softwareToneMapUploadFilter moves CPU-decoded frames onto the configured
 // Intel or VAAPI device before invoking the selected hardware tone-map graph.
 func softwareToneMapUploadFilter(opts TranscodeOpts) string {
@@ -2248,6 +2321,12 @@ func (s *TranscodeSession) waitForManifest(ctx context.Context, timeout time.Dur
 // longer media uses FFmpeg's real sliding playlist.
 func (s *TranscodeSession) BuildPlaybackManifest(segPrefix, rawQuery string) ([]byte, error) {
 	opts := s.Opts()
+	if s.copyPlan != nil {
+		return s.copyPlan.manifest(opts, segPrefix, rawQuery), nil
+	}
+	if s.HasSubtitleRendition() {
+		return s.buildSubtitleRenditionPlaylist(segPrefix, rawQuery), nil
+	}
 	if strings.EqualFold(opts.TargetCodecVideo, "copy") ||
 		!CanGenerateSyntheticManifest(opts.TotalDuration, opts.SegmentDuration) {
 		// Copy-video, unknown-duration, or oversized sessions must use FFmpeg's
@@ -2328,6 +2407,11 @@ const SourceTimelineQueryParam = "source_timeline"
 // first produced segment retains its source-time position. Synthetic manifests
 // already cover the full source timeline and need no adjustment.
 func (s *TranscodeSession) BuildSourceAlignedPlaybackManifest(segPrefix, rawQuery string) ([]byte, error) {
+	if s.copyPlan != nil {
+		// A planned playlist starts at the source's beginning and doesn't
+		// depend on FFmpeg's progress or restarts.
+		return s.BuildPlaybackManifest(segPrefix, rawQuery)
+	}
 	s.mu.Lock()
 	opts, generation, restarting := s.opts, s.segmentGeneration, s.restarting != nil
 	s.mu.Unlock()
@@ -2814,6 +2898,9 @@ func (s *TranscodeSession) SegmentRecoveryDecision(segNum int, now time.Time) Se
 		RestartOnTimeout: true,
 		Progress:         progress,
 	}
+	if s.copyPlan != nil {
+		return s.plannedSegmentRecoveryDecision(segNum, decision)
+	}
 
 	switch {
 	// Restarting must be checked before Running: the restart window runs
@@ -2825,7 +2912,7 @@ func (s *TranscodeSession) SegmentRecoveryDecision(segNum int, now time.Time) Se
 		decision.Wait = true
 		decision.WaitTimeout = activeSegmentWait
 		decision.RestartOnTimeout = false
-		decision.Reason = "transcode_restarting"
+		decision.Reason = segmentReasonRestarting
 	case segNum < encodedWindowStart:
 		// Below an encoded session's window. Players that ignore playlist
 		// start tags (notably Tizen AVPlay) probe the playlist head, and a
@@ -2921,6 +3008,26 @@ func (o TranscodeOpts) ManifestWindowStartSegment() int {
 // segPrefix is prepended to each segment filename (e.g. "segment/") and
 // rawQuery is appended as a query string (e.g. auth tokens).
 func (s *TranscodeSession) GenerateFullManifest(segPrefix, rawQuery string) []byte {
+	segExt := hlsSegmentExtension(s.Opts())
+	return s.generateSyntheticPlaylist(segPrefix, rawQuery, "seg_", segExt, segExt == ".m4s")
+}
+
+// syntheticSegmentCount is the number of fixed-duration segments the
+// synthetic playlist lists for the media.
+func syntheticSegmentCount(totalDuration float64, segmentDuration int) int {
+	if segmentDuration <= 0 {
+		segmentDuration = defaultSegmentDuration
+	}
+	if totalDuration <= 0 {
+		totalDuration = float64(segmentDuration) // fallback: single segment
+	}
+	return max(1, int(math.Ceil(totalDuration/float64(segmentDuration))))
+}
+
+// generateSyntheticPlaylist lists every fixed-duration segment of the media
+// under namePrefix%05d+ext. The video playlist and the subtitle rendition
+// playlist share it, so both carry exactly the same segment timeline.
+func (s *TranscodeSession) generateSyntheticPlaylist(segPrefix, rawQuery, namePrefix, segExt string, initMap bool) []byte {
 	opts := s.Opts()
 	totalDur := opts.TotalDuration
 	segDur := opts.SegmentDuration
@@ -2931,17 +3038,13 @@ func (s *TranscodeSession) GenerateFullManifest(segPrefix, rawQuery string) []by
 		totalDur = float64(segDur) // fallback: single segment
 	}
 
-	segCount := int(math.Ceil(totalDur / float64(segDur)))
-	if segCount < 1 {
-		segCount = 1
-	}
+	segCount := syntheticSegmentCount(totalDur, segDur)
 	startSeg := min(opts.ManifestWindowStartSegment(), segCount-1)
 
 	queryDefinition, suffix, queryVersion := syntheticManifestQuery(segCount-startSeg, rawQuery)
 
-	segExt := hlsSegmentExtension(opts)
 	hlsVersion := 3
-	if segExt == ".m4s" {
+	if initMap {
 		hlsVersion = 7
 	}
 	if queryVersion > hlsVersion {
@@ -2960,7 +3063,7 @@ func (s *TranscodeSession) GenerateFullManifest(segPrefix, rawQuery string) []by
 	// its prefixes inline rather than through RewriteManifestPaths, so the
 	// defensive strip there does not cover it.
 
-	if segExt == ".m4s" {
+	if initMap {
 		_, _ = fmt.Fprintf(&buf, "#EXT-X-MAP:URI=\"%sinit.mp4%s\"\n", segPrefix, suffix)
 	}
 
@@ -2974,7 +3077,7 @@ func (s *TranscodeSession) GenerateFullManifest(segPrefix, rawQuery string) []by
 			}
 		}
 		_, _ = fmt.Fprintf(&buf, "#EXTINF:%.6f,\n", dur)
-		_, _ = fmt.Fprintf(&buf, "%sseg_%05d%s%s\n", segPrefix, i, segExt, suffix)
+		_, _ = fmt.Fprintf(&buf, "%s%s%05d%s%s\n", segPrefix, namePrefix, i, segExt, suffix)
 	}
 
 	buf.WriteString("#EXT-X-ENDLIST\n")
@@ -3189,7 +3292,7 @@ func (s *TranscodeSession) cleanStaleSegments(startSegment int) {
 			os.Remove(filepath.Join(s.outputDir, name))
 			continue
 		}
-		if name == "init.mp4" {
+		if name == hlsInitSegmentName {
 			continue
 		}
 		segNum, parseErr := ParseSegmentNumber(name)
@@ -3358,6 +3461,15 @@ func (s *TranscodeSession) restart(
 	if done != nil {
 		<-done
 	}
+	s.closeSubtitleSpan()
+
+	// A planned stream's segments only match its playlist when FFmpeg cuts
+	// them from the beginning, so it always restarts there. The requested
+	// segment stays the throttler's target, so FFmpeg runs on to reach it.
+	requestedSegment := startSegment
+	if s.copyPlan != nil {
+		seekSeconds, startSegment, streamOriginSeconds, copySeekAnchorResolved = 0, 0, 0, true
+	}
 
 	s.mu.Lock()
 	s.running = false
@@ -3397,6 +3509,11 @@ func (s *TranscodeSession) restart(
 		opts.CopySeekAnchorResolved = copySeekAnchorResolved
 	}
 	opts.FastStart = false // seek-restarts use veryfast for better quality
+	if subtitleRenditionActive(opts) {
+		s.mu.Lock()
+		opts.subtitleCueFile = subtitleCueFileName(s.segmentGeneration)
+		s.mu.Unlock()
+	}
 
 	// Old segments are only reusable when this generation emits the same recipe
 	// as the previous one; otherwise they, and the manifest describing them,
@@ -3469,10 +3586,11 @@ func (s *TranscodeSession) restart(
 	s.running = true
 	s.restarting = nil
 	s.stdinPipe = stdinPipe
-	s.lastRequestedSegment = startSegment
+	s.lastRequestedSegment = requestedSegment
 	s.lastCompletedSegment = startSegment - 1
 	s.generationStartedAt = startedAt
 	s.inheritedManifest = inheritedManifest
+	s.startSubtitleSpanLocked(opts)
 	s.done = make(chan struct{})
 	hook := s.restartHook
 	s.mu.Unlock()
@@ -3680,10 +3798,10 @@ func rewriteMapURI(line []byte, segPrefix, suffix string) ([]byte, error) {
 }
 
 // AppendManifestQueryParam appends a single "key=value" query parameter to every
-// segment and #EXT-X-MAP init URI in an HLS media playlist, preserving any query
-// the URI already carries (using "?" or "&" as appropriate). The value is
-// appended verbatim — callers must supply a URL-safe value (a signed stream token
-// is base64url and safe). A manifest without a valid #EXTM3U header is returned
+// segment, variant, #EXT-X-MAP init, and #EXT-X-MEDIA rendition URI in an HLS
+// playlist, preserving any query the URI already carries (using "?" or "&" as
+// appropriate). The value is appended verbatim — callers must supply a URL-safe
+// value (a signed stream token is base64url and safe). A manifest without a valid #EXTM3U header is returned
 // unchanged so a non-manifest body is never corrupted.
 //
 // It exists for the API proxy boundary: a transcode node builds its manifest from
@@ -3703,7 +3821,9 @@ func AppendManifestQueryParam(manifest []byte, key, value string) []byte {
 		if len(trimmed) == 0 {
 			continue
 		}
-		if bytes.HasPrefix(trimmed, []byte("#EXT-X-MAP:")) {
+		// A multivariant playlist's subtitle rendition carries its playlist
+		// URI as an attribute, exactly like an init segment.
+		if bytes.HasPrefix(trimmed, []byte("#EXT-X-MAP:")) || bytes.HasPrefix(trimmed, []byte("#EXT-X-MEDIA:")) {
 			lines[i] = appendMapURIQueryParam(trimmed, param)
 			continue
 		}
@@ -3882,6 +4002,10 @@ type SegmentRecoveryTarget struct {
 // ResolveSegmentRecoveryTarget preserves the existing manifest's
 // URI-to-source-time mapping across a missing-segment restart.
 func (s *TranscodeSession) ResolveSegmentRecoveryTarget(ctx context.Context, segNum int) (SegmentRecoveryTarget, bool, error) {
+	if s.copyPlan != nil {
+		// restart regenerates a planned stream from the beginning.
+		return SegmentRecoveryTarget{StartSegmentNumber: segNum, CopySeekAnchorResolved: true}, true, nil
+	}
 	seekSeconds, ok, err := s.RestartSeekTarget(segNum)
 	if err != nil || !ok {
 		return SegmentRecoveryTarget{}, ok, err
diff --git a/internal/playback/transcode_args_test.go b/internal/playback/transcode_args_test.go
index 82ae63e353..33f48b79ec 100644
--- a/internal/playback/transcode_args_test.go
+++ b/internal/playback/transcode_args_test.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"slices"
 	"strings"
 	"testing"
 	"time"
@@ -241,6 +242,94 @@ func TestHardwareToneMapRemovesMetadataAfterHardwareFormatConversion(t *testing.
 	}
 }
 
+// TestQSVToneMapScalesBeforeOpenCL keeps every VAAPI resize ahead of the
+// OpenCL tone mapper on the subtitle-free graph, for hardware and software
+// decode. Only the passthrough interop may follow the tone mapper; a
+// scale_vaapi that reads the tone-mapped surface corrupts frames.
+func TestQSVToneMapScalesBeforeOpenCL(t *testing.T) {
+	for _, kind := range []tonemap.SourceKind{tonemap.SourcePQ, tonemap.SourceHLG, tonemap.SourceDolbyVision} {
+		for _, softwareDecode := range []bool{false, true} {
+			t.Run(fmt.Sprintf("%s software decode %t", kind, softwareDecode), func(t *testing.T) {
+				graph := strings.Join(buildFFmpegArgs(TranscodeOpts{
+					InputPath: "/media/hdr.mkv", OutputDir: t.TempDir(), TargetCodecVideo: "h264", TargetCodecAudio: "aac",
+					TargetResolution: "1080p", HWAccel: transcodeHWQSV, SoftwareVideoDecode: softwareDecode, SourceVideoBitDepth: 10,
+					ToneMapPolicy: tonemap.PolicyHardwareOnly, ToneMapMode: tonemap.ModeHardware, ToneMapSourceKind: kind,
+					ToneMapFilter: tonemap.HardwareFilterOpenCL, ToneMapRecipeVersion: TransformationHDRToSDRToneMapRecipeVersionV3,
+				}), " ")
+				resize := strings.Index(graph, "scale_vaapi=w=-2:h=1080:format=p010")
+				toneMap := strings.Index(graph, tonemap.HardwareFilterOpenCL)
+				if resize < 0 || toneMap < resize {
+					t.Fatalf("QSV graph does not resize before tone mapping: %s", graph)
+				}
+				tail := "reverse=1:extra_hw_frames=16,format=vaapi," + tonemap.QSVInteropFilter() + ",sidedata="
+				if !strings.Contains(graph[toneMap:], tail) || strings.Contains(graph[toneMap:], "scale_vaapi=w=") {
+					t.Fatalf("QSV graph processes the tone-mapped surface before the encoder: %s", graph)
+				}
+			})
+		}
+	}
+}
+
+// TestQSVToneMapBitmapSubtitlesCompositeOnOpenCL keeps bitmap burn-in for HDR
+// sources on the OpenCL device after tone mapping: overlay_vaapi or a
+// scale_vaapi reading the tone-mapped surface corrupts frames. SDR bases never
+// reach OpenCL and keep overlay_vaapi.
+func TestQSVToneMapBitmapSubtitlesCompositeOnOpenCL(t *testing.T) {
+	graphFor := func(kind tonemap.SourceKind, resolution string, softwareDecode bool) string {
+		args := buildFFmpegArgs(TranscodeOpts{
+			InputPath: "/media/hdr.mkv", OutputDir: t.TempDir(), TargetCodecVideo: "h264", TargetCodecAudio: "aac",
+			TargetResolution: resolution, HWAccel: transcodeHWQSV, SoftwareVideoDecode: softwareDecode, SourceVideoBitDepth: 10,
+			ToneMapPolicy: tonemap.PolicyHardwareOnly, ToneMapMode: tonemap.ModeHardware, ToneMapSourceKind: kind,
+			ToneMapFilter: tonemap.HardwareFilterOpenCL, ToneMapRecipeVersion: TransformationHDRToSDRToneMapRecipeVersionV3,
+			SubtitleBurnIn: true, SubtitleTrackIndex: 0, SubtitleCodec: "hdmv_pgs_subtitle",
+		})
+		return args[slices.Index(args, "-filter_complex")+1]
+	}
+
+	want := "[0:v:0]" + tonemap.QSVOpenCLToneMapFilter(tonemap.SourcePQ, 0) + "[vmain];" +
+		"[0:s:0]scale=out_color_matrix=bt709:out_range=tv,format=yuva420p,hwupload=derive_device=opencl[sub];" +
+		"[vmain][sub]overlay_opencl=eof_action=pass,scale_opencl=w=-2:h=1080," +
+		tonemap.QSVOpenCLReturnFilter() + "," + tonemap.QSVInteropFilter() + "," + tonemap.HDRMetadataRemovalFilter() + "[vout]"
+	if got := graphFor(tonemap.SourcePQ, "1080p", false); got != want {
+		t.Fatalf("QSV HDR bitmap burn-in graph:\n got %s\nwant %s", got, want)
+	}
+
+	for _, kind := range []tonemap.SourceKind{tonemap.SourcePQ, tonemap.SourceHLG, tonemap.SourceDolbyVision} {
+		for _, resolution := range []string{"1080p", ""} {
+			for _, softwareDecode := range []bool{false, true} {
+				t.Run(fmt.Sprintf("%s %q software decode %t", kind, resolution, softwareDecode), func(t *testing.T) {
+					graph := graphFor(kind, resolution, softwareDecode)
+					if strings.HasPrefix(graph, "[0:v:0]format=p010le,hwupload,") != softwareDecode {
+						t.Fatalf("software-decode upload prefix is wrong: %s", graph)
+					}
+					toneMap := strings.Index(graph, tonemap.HardwareFilterOpenCL)
+					if toneMap < 0 || strings.Contains(graph, "overlay_vaapi") || strings.Contains(graph[toneMap:], "scale_vaapi=w=") {
+						t.Fatalf("a VAAPI filter processes the tone-mapped surface: %s", graph)
+					}
+					steps := []string{"overlay_opencl=eof_action=pass,", tonemap.QSVOpenCLReturnFilter() + "," + tonemap.QSVInteropFilter() + ","}
+					if resolution != "" {
+						steps = []string{"overlay_opencl=eof_action=pass,", "scale_opencl=w=-2:h=1080,", tonemap.QSVOpenCLReturnFilter() + "," + tonemap.QSVInteropFilter() + ","}
+					} else if strings.Contains(graph, "scale_opencl") {
+						t.Fatalf("unscaled graph resizes on OpenCL: %s", graph)
+					}
+					last := toneMap
+					for _, step := range steps {
+						index := strings.Index(graph, step)
+						if index <= last {
+							t.Fatalf("%q is missing or out of order: %s", step, graph)
+						}
+						last = index
+					}
+				})
+			}
+		}
+	}
+
+	if graph := graphFor(tonemap.SourceSDRBT2020, "1080p", false); !strings.Contains(graph, "overlay_vaapi=eof_action=pass") {
+		t.Fatalf("SDR base layer bitmap burn-in does not use overlay_vaapi: %s", graph)
+	}
+}
+
 // TestToneMapGraphOrdersTextAndBitmapSubtitles verifies subtitle composition follows color conversion.
 func TestToneMapGraphOrdersTextAndBitmapSubtitles(t *testing.T) {
 	base := TranscodeOpts{
@@ -329,7 +418,7 @@ func TestDolbyVisionBaseGraphsApplyTheRPU(t *testing.T) {
 		filter  string
 		want    string
 	}{
-		{name: "software", mode: tonemap.ModeSoftware, hwAccel: "none", filter: tonemap.SoftwareFilterBT2390, want: "tonemapx=tonemap=bt2390:apply_dovi=1"},
+		{name: "software", mode: tonemap.ModeSoftware, hwAccel: "none", filter: tonemap.SoftwareFilterBT2390, want: "tonemapx=tonemap=bt2390:peak=100:apply_dovi=1"},
 		{name: "QSV", mode: tonemap.ModeHardware, hwAccel: "qsv", filter: tonemap.HardwareFilterOpenCL, want: "tonemap_opencl=format=nv12:p=bt709:t=bt709:m=bt709:tonemap=bt2390:peak=100:desat=0:apply_dovi=1"},
 		{name: "NVENC", mode: tonemap.ModeHardware, hwAccel: "nvenc", filter: tonemap.HardwareFilterCUDA, want: "tonemap_cuda=tonemap=bt2390:format=nv12:p=bt709:t=bt709:m=bt709:r=tv:apply_dovi=1"},
 	}
diff --git a/internal/playback/transcode_manager.go b/internal/playback/transcode_manager.go
index 55bf04b9f3..a1662190c1 100644
--- a/internal/playback/transcode_manager.go
+++ b/internal/playback/transcode_manager.go
@@ -15,6 +15,7 @@ import (
 
 	"golang.org/x/sync/singleflight"
 
+	"github.com/prairie-server/prairie-server/internal/nodeauth"
 	"github.com/prairie-server/prairie-server/internal/nodepool"
 	"github.com/prairie-server/prairie-server/internal/tonemap"
 )
@@ -65,7 +66,8 @@ type TranscodeManager struct {
 	Config func() TranscodeRuntimeConfig
 	// LogSinkFn returns the ffmpeg log sink for reconstructed processes.
 	LogSinkFn func() FFmpegLogSink
-	// JWTSecretFn returns the bearer used for remote transcode-node DELETEs.
+	// JWTSecretFn returns the shared secret that signs remote transcode-node
+	// DELETEs.
 	JWTSecretFn func() string
 	// OnFFmpegCrash is invoked when a reconstructed/local ffmpeg exits with an
 	// error so the embedding handler can tear down the playback session (keeping
@@ -110,6 +112,10 @@ type TranscodeManager struct {
 	// reconstruct, just not all in the same instant. Lazily sized on first use.
 	reconstructSemOnce sync.Once
 	reconstructSem     chan struct{}
+	// rehomeGroup single-flights moving a session's transcode off an executor
+	// that stopped answering, so every request that finds the node dead waits
+	// on one move instead of each starting its own replacement.
+	rehomeGroup singleflight.Group
 
 	// lifecycleMu guards lifecycleLocks, the per-session mutexes that serialize
 	// every path which spawns ffmpeg into a session's output directory (fresh
@@ -188,6 +194,56 @@ func (m *TranscodeManager) acquireReconstructSlot(ctx context.Context) (func(),
 	}
 }
 
+// WithReconstructSlot runs fn while holding one of the slots that pace
+// transcode reconstruction. Work that starts an FFmpeg process on another node
+// on a session's behalf takes the same slot as a local reconstruct, so a dead
+// node with many sessions is replaced at the same pace as a restart wave. It
+// returns the context error when ctx ends before a slot frees up.
+func (m *TranscodeManager) WithReconstructSlot(ctx context.Context, fn func() error) error {
+	release, ok := m.acquireReconstructSlot(ctx)
+	if !ok {
+		return ctx.Err()
+	}
+	defer release()
+	return fn()
+}
+
+// TranscodeRehomeTimeout bounds one move of a transcode off an unreachable
+// executor, including the wait for a reconstruct slot and the new executor's
+// first manifest. The move is detached from the request that triggered it,
+// because every concurrent request for the session waits on the same move.
+const TranscodeRehomeTimeout = 2 * time.Minute
+
+// RehomeTranscode runs move once for all concurrent callers of the same
+// session. move receives a context detached from any single request and bounded
+// by TranscodeRehomeTimeout. A caller whose own context ends stops waiting
+// without canceling the move the others are waiting on.
+func (m *TranscodeManager) RehomeTranscode(ctx context.Context, sessionID string, move func(context.Context) error) error {
+	if m == nil || sessionID == "" {
+		return errors.New("transcode rehome unavailable")
+	}
+	detached := context.WithoutCancel(ctx)
+	results := m.rehomeGroup.DoChan(sessionID, func() (interface{}, error) {
+		moveCtx, cancel := context.WithTimeout(detached, TranscodeRehomeTimeout)
+		defer cancel()
+		return nil, move(moveCtx)
+	})
+	select {
+	case result := <-results:
+		return result.Err
+	case <-ctx.Done():
+		return ctx.Err()
+	}
+}
+
+// ReconstructResumePoint reports where a rebuilt transcode should start for a
+// client fetching requestedSegment. Every reconstruction uses this rule — after
+// a restart, on a restarted node, or on a new executor — so segment numbers and
+// timestamps continue the same way on each.
+func ReconstructResumePoint(card RecipeCard, requestedSegment int) (segment int, seekSeconds float64, ok bool) {
+	return fastResumeSeek(card, requestedSegment)
+}
+
 // GetTranscodeSession returns the live in-memory transcode session for sessionID,
 // or nil if none is registered.
 func (m *TranscodeManager) GetTranscodeSession(sessionID string) *TranscodeSession {
@@ -433,10 +489,9 @@ const (
 // manager type.
 //
 // card is the reconstruction recipe the caller decoded from the verified stream
-// token the client presented (nil when the request carried no usable token).
-// Under token-carried reconstruction it is the sole descriptor source — there is
-// no shared per-session store to fall back on — so a not-found session with a nil
-// card is a genuine miss.
+// token the client presented, or, for a header-authenticated session, the API's
+// validated server-side recovery card (nil when neither exists). It is the sole
+// descriptor source, so a not-found session with a nil card is a genuine miss.
 func (m *TranscodeManager) LoadOrReconstructSession(ctx context.Context, getSession func(string) (*Session, error), sessionID string, requestUserID int, card *RecipeCard) (*Session, SessionLoadStatus) {
 	session, status, _ := m.LoadOrReconstructSessionDetail(ctx, getSession, sessionID, requestUserID, card)
 	return session, status
@@ -735,6 +790,11 @@ func (m *TranscodeManager) reconstructSession(ctx context.Context, sessionID str
 		SubtitleTrackIndex: card.SubtitleTrackIndex,
 		SubtitleBurnIn:     card.SubtitleBurnIn,
 		SegmentDuration:    card.SegmentDuration,
+		// Only a server-side card for a header-authenticated session sets these;
+		// a token's claims never do, so token reconstruction is unchanged.
+		RequireMediaAuthorization:  card.RequireMediaAuthorization,
+		RequestedMediaFileID:       card.RequestedMediaFileID,
+		DisableProgressPersistence: card.DisableProgressPersistence,
 	}
 	if card.IsTranscodeRecipe() {
 		s.OutputContainer = HLSOutputContainer(card.TranscodeOpts("", "", nil))
@@ -895,6 +955,7 @@ func (m *TranscodeManager) doReconstructTranscode(ctx context.Context, sessionID
 	cfg := m.runtimeConfig()
 	outputDir := reconstructionOutputDir(cfg.TranscodeDir, sessionID, card.OutputSubdir)
 	opts := card.TranscodeOpts(outputDir, cfg.FFmpegPath, m.logSink())
+	opts.Reconstructed = true
 	// Recipe cards preserve the original launch tuning, but a reconstruction is
 	// not a fresh generation: restore the conservative manifest lead so recovery
 	// never exposes a hardware encoder after only one fragment.
@@ -1176,7 +1237,9 @@ func (m *TranscodeManager) deleteRemoteTranscode(ctx context.Context, sessionID,
 	if err != nil {
 		return fmt.Errorf("build remote transcode delete request: %w", err)
 	}
-	req.Header.Set("Authorization", "Bearer "+m.jwtSecret())
+	if err := nodeauth.Sign(req, transcodeNodeURL, m.jwtSecret()); err != nil {
+		return fmt.Errorf("sign remote transcode delete: %w", err)
+	}
 
 	resp, err := remoteTranscodeControlClient.Do(req)
 	if err != nil {
diff --git a/internal/playback/transcode_rehome_test.go b/internal/playback/transcode_rehome_test.go
new file mode 100644
index 0000000000..bcd8d9f7ee
--- /dev/null
+++ b/internal/playback/transcode_rehome_test.go
@@ -0,0 +1,138 @@
+package playback
+
+import (
+	"context"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+func TestMoveTranscodeExecutorOnlyReplacesTheExpectedRoute(t *testing.T) {
+	manager := NewSessionManager(0, 0)
+	session, err := manager.StartSession(1, "profile-1", 42, PlayTranscode, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	dead := TranscodeRoute{NodeURL: "http://dead:8080", TransportID: "transport-1"}
+	if err := manager.SetTranscodeRoute(session.ID, dead); err != nil {
+		t.Fatal(err)
+	}
+	if err := manager.SetNodeRoutingAssignment(session.ID, NodeRoutingAssignment{
+		Workload: "video_transcode", Execution: "transcode", ExecutionNodeID: 1,
+		ExecutionNodeURL: dead.NodeURL, Egress: "api",
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	stale := TranscodeRoute{NodeURL: dead.NodeURL, TransportID: "older-transport"}
+	moved, err := manager.MoveTranscodeExecutor(session.ID, stale, TranscodeExecutorMove{NodeURL: "http://other:8080"})
+	if err != nil || moved {
+		t.Fatalf("move against a superseded route = %v, %v; want no change", moved, err)
+	}
+
+	moved, err = manager.MoveTranscodeExecutor(session.ID, dead, TranscodeExecutorMove{
+		NodeURL: "http://alive:8080", Execution: "transcode", ExecutionNodeID: 2, TranscodeHWAccel: "vaapi",
+	})
+	if err != nil || !moved {
+		t.Fatalf("move = %v, %v", moved, err)
+	}
+	got, _ := manager.GetSession(session.ID)
+	if got.TranscodeNodeURL != "http://alive:8080" || got.TranscodeTransportID != "transport-1" {
+		t.Fatalf("route = %q/%q, want the new node and the same transport", got.TranscodeNodeURL, got.TranscodeTransportID)
+	}
+	if got.RoutingExecutionNodeID != 2 || got.RoutingExecutionNodeURL != "http://alive:8080" || got.RoutingEgress != "api" {
+		t.Fatalf("routing = %+v", got)
+	}
+	if got.TranscodeHWAccel != "vaapi" {
+		t.Fatalf("hw accel = %q", got.TranscodeHWAccel)
+	}
+}
+
+func TestMoveTranscodeExecutorLeavesLegacyRoutingUnassigned(t *testing.T) {
+	manager := NewSessionManager(0, 0)
+	session, err := manager.StartSession(1, "profile-1", 42, PlayTranscode, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	dead := TranscodeRoute{NodeURL: "http://dead:8080"}
+	if err := manager.SetTranscodeRoute(session.ID, dead); err != nil {
+		t.Fatal(err)
+	}
+	moved, err := manager.MoveTranscodeExecutor(session.ID, dead, TranscodeExecutorMove{Execution: "api"})
+	if err != nil || !moved {
+		t.Fatalf("move = %v, %v", moved, err)
+	}
+	got, _ := manager.GetSession(session.ID)
+	// Writing only the execution half would read as a partially committed
+	// route, which the serve paths refuse.
+	if got.TranscodeNodeURL != "" || got.RoutingExecution != "" {
+		t.Fatalf("node %q execution %q, want a local legacy session with no routing", got.TranscodeNodeURL, got.RoutingExecution)
+	}
+}
+
+// TestRehomeTranscodeJoinsAnInFlightMove pins that a caller arriving while a
+// move for the same session runs waits on it rather than starting another, and
+// that a caller who gives up stops waiting without disturbing it.
+func TestRehomeTranscodeJoinsAnInFlightMove(t *testing.T) {
+	m := NewTranscodeManager()
+	var runs atomic.Int32
+	entered := make(chan struct{})
+	release := make(chan struct{})
+	move := func(context.Context) error {
+		if runs.Add(1) == 1 {
+			close(entered)
+		}
+		<-release
+		return nil
+	}
+
+	var wg sync.WaitGroup
+	leaderErr := make(chan error, 1)
+	wg.Go(func() { leaderErr <- m.RehomeTranscode(context.Background(), "session-1", move) })
+	<-entered
+
+	// The leader is parked inside move, so this caller can only join it: a
+	// second run would have to wait for release, which has not happened.
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	if err := m.RehomeTranscode(ctx, "session-1", move); err == nil {
+		t.Fatal("a canceled caller did not stop waiting")
+	}
+	if got := runs.Load(); got != 1 {
+		t.Fatalf("moves = %d while one was in flight, want 1", got)
+	}
+
+	close(release)
+	wg.Wait()
+	if err := <-leaderErr; err != nil {
+		t.Fatalf("leader error: %v", err)
+	}
+}
+
+func TestRehomeTranscodeMoveOutlivesTheLeadingRequest(t *testing.T) {
+	m := NewTranscodeManager()
+	ctx, cancel := context.WithCancel(context.Background())
+	started := make(chan struct{})
+	check := make(chan struct{})
+	moveCtxErr := make(chan error, 1)
+	var deadline time.Time
+	go func() {
+		_ = m.RehomeTranscode(ctx, "session-1", func(moveCtx context.Context) error {
+			deadline, _ = moveCtx.Deadline()
+			close(started)
+			<-check
+			moveCtxErr <- moveCtx.Err()
+			return nil
+		})
+	}()
+	<-started
+	cancel()
+	close(check)
+	if err := <-moveCtxErr; err != nil {
+		t.Fatalf("the move was canceled with its leading request: %v", err)
+	}
+	if deadline.IsZero() {
+		t.Fatal("the move has no time bound of its own")
+	}
+}
diff --git a/internal/pluginhost/client.go b/internal/pluginhost/client.go
index 60b076a03e..579c5a693d 100644
--- a/internal/pluginhost/client.go
+++ b/internal/pluginhost/client.go
@@ -107,19 +107,17 @@ func newClient(installationID int, rpc *sdkruntime.Client, manifest *pluginv1.Pl
 		capabilities[capabilityKey(capability.GetType(), capability.GetId())] = capability
 	}
 
-	cloned, _ := proto.Clone(manifest).(*pluginv1.PluginManifest)
 	return &Client{
 		installationID: installationID,
 		startSeq:       startSeq,
-		manifest:       cloned,
+		manifest:       proto.CloneOf(manifest),
 		rpc:            rpc,
 		capabilities:   capabilities,
 	}
 }
 
 func (c *Client) Manifest() *pluginv1.PluginManifest {
-	cloned, _ := proto.Clone(c.manifest).(*pluginv1.PluginManifest)
-	return cloned
+	return proto.CloneOf(c.manifest)
 }
 
 func (c *Client) Capabilities() []*pluginv1.CapabilityDescriptor {
@@ -128,8 +126,7 @@ func (c *Client) Capabilities() []*pluginv1.CapabilityDescriptor {
 
 	result := make([]*pluginv1.CapabilityDescriptor, 0, len(c.capabilities))
 	for _, capability := range c.capabilities {
-		cloned, _ := proto.Clone(capability).(*pluginv1.CapabilityDescriptor)
-		result = append(result, cloned)
+		result = append(result, proto.CloneOf(capability))
 	}
 	return result
 }
@@ -154,6 +151,12 @@ func (c *Client) ImageResolver(capabilityID string) (*ImageResolverClient, error
 	}, nil
 }
 
+// NewMarkerProviderClient wraps a marker provider connection with the default
+// call timeout, for callers that hold the gRPC client directly.
+func NewMarkerProviderClient(client pluginv1.MarkerProviderClient) *MarkerProviderClient {
+	return &MarkerProviderClient{client: client, timeout: DefaultMarkerProviderTimeout}
+}
+
 func (c *Client) MarkerProvider(capabilityID string) (*MarkerProviderClient, error) {
 	if err := c.requireCapability("marker_provider.v1", capabilityID); err != nil {
 		return nil, err
diff --git a/internal/plugins/auto_update.go b/internal/plugins/auto_update.go
index 2c02198437..c4533c15bd 100644
--- a/internal/plugins/auto_update.go
+++ b/internal/plugins/auto_update.go
@@ -9,6 +9,7 @@ import (
 	"strconv"
 	"strings"
 
+	"github.com/prairie-server/prairie-server/internal/logredact"
 	"github.com/prairie-server/prairie-server/internal/pluginhost"
 )
 
@@ -165,7 +166,8 @@ func (s *AutoUpdateService) SetRequiredPlugins(required func(context.Context) ([
 }
 
 // Check runs a plugin update pass. It can be used by startup, scheduled tasks,
-// and manual admin actions.
+// and manual admin actions. Each per-plugin failure is logged and recorded in
+// the summary; only failures that stop the whole pass are returned.
 func (s *AutoUpdateService) Check(ctx context.Context, opts AutoUpdateOptions) (AutoUpdateSummary, error) {
 	var summary AutoUpdateSummary
 
@@ -219,7 +221,7 @@ func (s *AutoUpdateService) Check(ctx context.Context, opts AutoUpdateOptions) (
 		}
 		outcome, err := s.handleExistingPlugin(ctx, existing, entry)
 		if err != nil {
-			summary.recordFailure("process plugin update %s: %v", existing.PluginID, err)
+			summary.recordFailuref("process plugin update %s: %v", existing.PluginID, err)
 			continue
 		}
 		switch outcome {
@@ -242,7 +244,7 @@ func (s *AutoUpdateService) Check(ctx context.Context, opts AutoUpdateOptions) (
 			}
 			installedDefault, err := s.handleNewPlugin(ctx, pluginID, entry)
 			if err != nil {
-				summary.recordFailure("auto-install default plugin %s: %v", pluginID, err)
+				summary.recordFailuref("auto-install default plugin %s: %v", pluginID, err)
 			} else if installedDefault {
 				summary.DefaultPluginsInstalled++
 			}
@@ -260,6 +262,10 @@ func (s *AutoUpdateService) Check(ctx context.Context, opts AutoUpdateOptions) (
 		s.notifyChanged(ctx)
 	}
 
+	for _, failure := range summary.Failures {
+		s.logger.WarnContext(ctx, "plugin auto-update operation failed", "error", failure)
+	}
+
 	return summary, nil
 }
 
@@ -278,16 +284,11 @@ func (s *AutoUpdateService) notifyChanged(ctx context.Context) {
 // installed plugins according to their update policy. All errors are logged
 // rather than returned so that startup is never blocked.
 func (s *AutoUpdateService) Run(ctx context.Context) error {
-	summary, err := s.Check(ctx, AutoUpdateOptions{
+	if _, err := s.Check(ctx, AutoUpdateOptions{
 		SeedDefaultRepository: true,
 		AutoInstallDefaults:   true,
-	})
-	if err != nil {
+	}); err != nil {
 		s.logger.WarnContext(ctx, "failed to run plugin auto-update", "error", err)
-		return nil
-	}
-	for _, failure := range summary.Failures {
-		s.logger.WarnContext(ctx, "plugin auto-update operation failed", "error", failure)
 	}
 	return nil
 }
@@ -348,7 +349,7 @@ func (s *AutoUpdateService) pluginsToAutoInstall(ctx context.Context, opts AutoU
 	}
 	required, err := s.requiredPlugins(ctx)
 	if err != nil {
-		summary.recordFailure("list required plugins: %v", err)
+		summary.recordFailuref("list required plugins: %v", err)
 		return pluginIDs
 	}
 	for _, pluginID := range required {
@@ -523,7 +524,11 @@ const (
 	autoUpdateOutcomeNotified
 )
 
-func (s *AutoUpdateSummary) recordFailure(format string, args ...any) {
+// recordFailuref masks credential assignments and URL userinfo before storing
+// the message: failures reach the server log, the task's result data, and the
+// task error shown to admins, and their text can carry repository or plugin
+// diagnostics.
+func (s *AutoUpdateSummary) recordFailuref(format string, args ...any) {
 	s.FailedOperations++
-	s.Failures = append(s.Failures, fmt.Sprintf(format, args...))
+	s.Failures = append(s.Failures, logredact.SanitizeText(fmt.Sprintf(format, args...)))
 }
diff --git a/internal/plugins/auto_update_defaults_test.go b/internal/plugins/auto_update_defaults_test.go
index b6c967e197..0d855245f3 100644
--- a/internal/plugins/auto_update_defaults_test.go
+++ b/internal/plugins/auto_update_defaults_test.go
@@ -1,8 +1,11 @@
 package plugins
 
 import (
+	"bytes"
 	"context"
 	"errors"
+	"log/slog"
+	"strings"
 	"testing"
 
 	pluginv1 "github.com/prairie-server/prairie-plugin-sdk/pkg/pluginproto/prairie/plugin/v1"
@@ -107,7 +110,9 @@ func TestAutoUpdateKeepsInstallingDefaultsWhenRequiredPluginsFail(t *testing.T)
 		resolved: &ResolvedCatalogInstall{RepositoryID: 7, ArchiveURL: "https://plugins.example.test/theintrodb", Checksum: "test-checksum"},
 	}
 	installer := &fakeAutoUpdateInstaller{}
-	service := NewAutoUpdateService(&fakeAutoUpdateRepositories{}, &fakeAutoUpdateInstallations{}, catalog, installer, nil, nil, nil)
+	var logs bytes.Buffer
+	logger := slog.New(slog.NewTextHandler(&logs, nil))
+	service := NewAutoUpdateService(&fakeAutoUpdateRepositories{}, &fakeAutoUpdateInstallations{}, catalog, installer, nil, logger, nil)
 	service.SetRequiredPlugins(func(context.Context) ([]string, error) {
 		return nil, errors.New("database unavailable")
 	})
@@ -118,6 +123,9 @@ func TestAutoUpdateKeepsInstallingDefaultsWhenRequiredPluginsFail(t *testing.T)
 	if summary.FailedOperations != 1 {
 		t.Fatalf("failed operations = %d, want the required-plugin lookup recorded", summary.FailedOperations)
 	}
+	if !strings.Contains(logs.String(), "database unavailable") {
+		t.Fatalf("logs = %q, want the failure logged by every Check caller", logs.String())
+	}
 	if summary.DefaultPluginsInstalled != 1 || len(installer.binary) != 1 {
 		t.Fatalf("default installs = %d, binary requests = %d, want 1 each", summary.DefaultPluginsInstalled, len(installer.binary))
 	}
@@ -147,3 +155,22 @@ func TestAutoUpdateInstallsRequiredPluginsOnLaterChecks(t *testing.T) {
 		t.Fatalf("installs = %d, resolved = %+v, want only the required Simkl plugin", summary.DefaultPluginsInstalled, catalog.resolveRequests)
 	}
 }
+
+// Failure text reaches logs, task result data, and the task error, so a
+// credential assignment nested in a diagnostic must be masked before it is
+// recorded.
+func TestAutoUpdateSummaryMasksCredentialsInFailures(t *testing.T) {
+	var summary AutoUpdateSummary
+	summary.recordFailuref("process plugin update %s: %v", "silo.example",
+		errors.New("rpc error: code = Unauthenticated desc = api_key=sk-live-123 rejected"))
+	if summary.FailedOperations != 1 || len(summary.Failures) != 1 {
+		t.Fatalf("summary = %+v, want one recorded failure", summary)
+	}
+	got := summary.Failures[0]
+	if strings.Contains(got, "sk-live-123") {
+		t.Fatalf("failure = %q, want the api key masked", got)
+	}
+	if !strings.Contains(got, "silo.example") || !strings.Contains(got, "Unauthenticated") {
+		t.Fatalf("failure = %q, want the plugin and reason kept", got)
+	}
+}
diff --git a/internal/plugins/catalog_service.go b/internal/plugins/catalog_service.go
index b234a5df3d..e95e780979 100644
--- a/internal/plugins/catalog_service.go
+++ b/internal/plugins/catalog_service.go
@@ -103,7 +103,7 @@ type CatalogService struct {
 func NewCatalogService(repositories *RepositoryStore, opts CatalogServiceOptions) *CatalogService {
 	httpClient := opts.HTTPClient
 	if httpClient == nil {
-		httpClient = http.DefaultClient
+		httpClient = newPackageFetchClient(defaultPackageFetchTimeouts)
 	}
 
 	apiVersion := opts.PrairieAPIVersion
diff --git a/internal/plugins/installer.go b/internal/plugins/installer.go
index 773ae89c4f..11ac7685cc 100644
--- a/internal/plugins/installer.go
+++ b/internal/plugins/installer.go
@@ -72,7 +72,7 @@ type Installer struct {
 func NewInstaller(installations installationStore, opts InstallerOptions) *Installer {
 	httpClient := opts.HTTPClient
 	if httpClient == nil {
-		httpClient = http.DefaultClient
+		httpClient = newPackageFetchClient(defaultPackageFetchTimeouts)
 	}
 	baseDir := opts.BaseDir
 	if baseDir == "" {
diff --git a/internal/plugins/lazy_start.go b/internal/plugins/lazy_start.go
new file mode 100644
index 0000000000..a9731328b4
--- /dev/null
+++ b/internal/plugins/lazy_start.go
@@ -0,0 +1,62 @@
+package plugins
+
+import (
+	"sync"
+
+	"github.com/prairie-server/prairie-server/internal/logredact"
+)
+
+// lazyStartFailures remembers, per installation, why the last launch of a
+// lazily started (non-resident) plugin failed on this host. Resident plugins
+// report failures through the supervisor; a lazy plugin has no supervisor,
+// so without this record a plugin whose process cannot start would read as
+// merely stopped. Like the supervisor's entries it is in-memory and per host,
+// and it is tied to the release and runtime generation that failed: a later
+// successful start clears it, and an update, reinstall, config save or
+// restart makes it stale. The zero value is ready to use.
+type lazyStartFailures struct {
+	mu       sync.Mutex
+	failures map[int]lazyStartFailure
+}
+
+type lazyStartFailure struct {
+	message           string
+	version           string
+	installPath       string
+	runtimeGeneration int64
+}
+
+func (f *lazyStartFailures) record(installation *Installation, err error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.failures == nil {
+		f.failures = make(map[int]lazyStartFailure)
+	}
+	f.failures[installation.ID] = lazyStartFailure{
+		// Launch errors can carry plugin-controlled diagnostics; mask any
+		// credential assignment before the admin API shows the text.
+		message:           logredact.SanitizeText(err.Error()),
+		version:           installation.Version,
+		installPath:       installation.InstallPath,
+		runtimeGeneration: installation.RuntimeGeneration,
+	}
+}
+
+func (f *lazyStartFailures) clear(installationID int) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	delete(f.failures, installationID)
+}
+
+// lastError returns the recorded failure while installation is still the
+// release and runtime generation that failed.
+func (f *lazyStartFailures) lastError(installation *Installation) (string, bool) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	failure, ok := f.failures[installation.ID]
+	if !ok || failure.version != installation.Version || failure.installPath != installation.InstallPath ||
+		failure.runtimeGeneration != installation.RuntimeGeneration {
+		return "", false
+	}
+	return failure.message, true
+}
diff --git a/internal/plugins/lazy_start_test.go b/internal/plugins/lazy_start_test.go
new file mode 100644
index 0000000000..73d0654880
--- /dev/null
+++ b/internal/plugins/lazy_start_test.go
@@ -0,0 +1,174 @@
+package plugins
+
+import (
+	"context"
+	"errors"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	pluginv1 "github.com/prairie-server/prairie-plugin-sdk/pkg/pluginproto/prairie/plugin/v1"
+	"github.com/prairie-server/prairie-plugin-sdk/pkg/pluginsdk/capability"
+)
+
+func newLazyStartService(t *testing.T) (*Service, *countingHerdHost, *Installation) {
+	t.Helper()
+	manifest := testPluginManifest(t, "prairie.metadb", "0.0.36")
+	installation := &Installation{
+		ID: 7, PluginID: manifest.GetPluginId(), Version: manifest.GetVersion(),
+		InstallPath: writeInstalledPluginManifest(t, manifest), Enabled: true,
+	}
+	store := newFakeServiceInstallationStore(installation)
+	host := &countingHerdHost{startResult: &fakePluginClient{manifest: manifest}}
+	return &Service{installations: store, host: host}, host, installation
+}
+
+func TestRuntimeStateOfReportsFailedLazyStartUntilALaterStartSucceeds(t *testing.T) {
+	service, host, installation := newLazyStartService(t)
+	ctx := context.Background()
+
+	if got := service.RuntimeStateOf(installation); got.State != ResidentStopped || got.LastError != "" {
+		t.Fatalf("RuntimeStateOf before any start = %+v, want stopped", got)
+	}
+
+	host.startErr = errors.New("start plugin process: exit status 2")
+	if _, err := service.ensureClient(ctx, 7); err == nil {
+		t.Fatal("ensureClient succeeded, want the start error")
+	}
+	got := service.RuntimeStateOf(installation)
+	if got.Resident || got.State != ResidentFailed || got.LastError != "start plugin process: exit status 2" {
+		t.Fatalf("RuntimeStateOf after failed start = %+v, want failed with the start error", got)
+	}
+	// The ID-only view other callers use is unchanged.
+	if got := service.RuntimeState(7); got.State != ResidentStopped {
+		t.Fatalf("RuntimeState after failed start = %+v, want stopped", got)
+	}
+
+	host.startErr = nil
+	if _, err := service.ensureClient(ctx, 7); err != nil {
+		t.Fatalf("ensureClient after recovery: %v", err)
+	}
+	if got := service.RuntimeStateOf(installation); got.State != ResidentRunning || got.LastError != "" {
+		t.Fatalf("RuntimeStateOf after successful start = %+v, want running without error", got)
+	}
+
+	// A stopped process after a successful start reads stopped, not failed.
+	if err := service.Stop(7); err != nil {
+		t.Fatal(err)
+	}
+	if got := service.RuntimeStateOf(installation); got.State != ResidentStopped || got.LastError != "" {
+		t.Fatalf("RuntimeStateOf after stop = %+v, want stopped", got)
+	}
+}
+
+// An update, reinstall, config save or restart changes the installation the
+// failure was recorded for; the failure no longer describes it.
+func TestFailedLazyStartGoesStaleWhenTheInstallationChanges(t *testing.T) {
+	service, host, installation := newLazyStartService(t)
+
+	host.startErr = errors.New("boom")
+	if _, err := service.ensureClient(context.Background(), 7); err == nil {
+		t.Fatal("ensureClient succeeded, want the start error")
+	}
+	if got := service.RuntimeStateOf(installation); got.State != ResidentFailed {
+		t.Fatalf("RuntimeStateOf after failed start = %+v, want failed", got)
+	}
+
+	updated := *installation
+	updated.Version = "0.0.37"
+	reconfigured := *installation
+	reconfigured.RuntimeGeneration++
+	for name, changed := range map[string]*Installation{"new release": &updated, "new runtime generation": &reconfigured} {
+		if got := service.RuntimeStateOf(changed); got.State != ResidentStopped || got.LastError != "" {
+			t.Fatalf("RuntimeStateOf for %s = %+v, want stopped", name, got)
+		}
+	}
+}
+
+func TestRestartInstallationClearsFailedLazyStart(t *testing.T) {
+	service, host, installation := newLazyStartService(t)
+	ctx := context.Background()
+
+	host.startErr = errors.New("boom")
+	if _, err := service.ensureClient(ctx, 7); err == nil {
+		t.Fatal("ensureClient succeeded, want the start error")
+	}
+	if err := service.RestartInstallation(ctx, 7); err != nil {
+		t.Fatalf("RestartInstallation: %v", err)
+	}
+	if got := service.RuntimeStateOf(installation); got.State != ResidentStopped || got.LastError != "" {
+		t.Fatalf("RuntimeStateOf after restart = %+v, want stopped without error", got)
+	}
+}
+
+func TestSupervisedStartIsNotRecordedAsLazyFailure(t *testing.T) {
+	manifest := testPluginManifest(t, "prairie.vpn", "1.0.0")
+	manifest.Capabilities = append(manifest.Capabilities, &pluginv1.CapabilityDescriptor{
+		Type: capability.NetworkAccessProvider, Id: "vpn", DisplayName: "VPN",
+	})
+	installation := &Installation{
+		ID: 7, PluginID: manifest.GetPluginId(), Version: manifest.GetVersion(),
+		InstallPath: writeInstalledPluginManifest(t, manifest), Enabled: true,
+	}
+	host := &countingHerdHost{startErr: errors.New("boom")}
+	service := &Service{installations: newFakeServiceInstallationStore(installation), host: host}
+
+	if _, err := service.start(context.Background(), 7, true); err == nil {
+		t.Fatal("start succeeded, want the start error")
+	}
+	if got := service.RuntimeStateOf(installation); got.State != ResidentStopped || got.LastError != "" {
+		t.Fatalf("RuntimeStateOf after supervised start failure = %+v, want stopped", got)
+	}
+}
+
+// The exported Start (used to restore a plugin after a failed uninstall) may
+// launch residents, but a non-resident it fails to launch is still recorded.
+func TestExportedStartRecordsNonResidentFailure(t *testing.T) {
+	service, host, installation := newLazyStartService(t)
+
+	host.startErr = errors.New("boom")
+	if _, err := service.Start(context.Background(), 7); err == nil {
+		t.Fatal("Start succeeded, want the start error")
+	}
+	if got := service.RuntimeStateOf(installation); got.State != ResidentFailed || got.LastError != "boom" {
+		t.Fatalf("RuntimeStateOf after failed Start = %+v, want failed", got)
+	}
+}
+
+// A launch that fails on a cached snapshot while an update commits records
+// the failure against the release it tried, so the updated row, which has not
+// been tried, does not read failed.
+func TestFailedLazyStartIsRecordedAgainstTheTriedSnapshot(t *testing.T) {
+	service, _, installation := newLazyStartService(t)
+	tried := *installation
+	tried.InstallPath = filepath.Join(t.TempDir(), "missing", "plugin")
+	service.installationCache = map[int]*Installation{7: &tried}
+
+	updated := *installation
+	updated.Version = "0.0.37"
+	service.installations = newFakeServiceInstallationStore(&updated)
+
+	if _, err := service.ensureClient(context.Background(), 7); err == nil {
+		t.Fatal("ensureClient succeeded, want the manifest load error")
+	}
+	if got := service.RuntimeStateOf(&tried); got.State != ResidentFailed {
+		t.Fatalf("RuntimeStateOf for the tried release = %+v, want failed", got)
+	}
+	if got := service.RuntimeStateOf(&updated); got.State != ResidentStopped || got.LastError != "" {
+		t.Fatalf("RuntimeStateOf for the updated release = %+v, want stopped", got)
+	}
+}
+
+func TestFailedLazyStartMasksCredentialsInLastError(t *testing.T) {
+	service, host, installation := newLazyStartService(t)
+
+	host.startErr = errors.New("rpc error: code = Unauthenticated desc = api_key=sk-live-123")
+	if _, err := service.ensureClient(context.Background(), 7); err == nil {
+		t.Fatal("ensureClient succeeded, want the start error")
+	}
+	got := service.RuntimeStateOf(installation)
+	if got.State != ResidentFailed || strings.Contains(got.LastError, "sk-live-123") ||
+		!strings.Contains(got.LastError, "Unauthenticated") {
+		t.Fatalf("RuntimeStateOf = %+v, want failed with the api key masked", got)
+	}
+}
diff --git a/internal/plugins/package_error.go b/internal/plugins/package_error.go
index 41a0176a65..54277ef528 100644
--- a/internal/plugins/package_error.go
+++ b/internal/plugins/package_error.go
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"time"
 )
 
 // PackageError is an install or update refused because of the plugin package
@@ -52,9 +53,16 @@ func AsPackageError(err error) (*PackageError, bool) {
 // download. subject names it for the admin, such as "the plugin". An
 // unreachable host, 429, 5xx or a cut-off body is a transient PackageError;
 // an address that isn't a valid http or https link, or any other status, is
-// a permanent one. A canceled ctx returns its own error, not a PackageError.
+// a permanent one. A body that sends nothing for packageFetchReadIdleTimeout
+// counts as cut off. A canceled ctx returns its own error, not a PackageError.
 func fetchPackageResource(ctx context.Context, client *http.Client, rawURL, subject string) ([]byte, error) {
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, rawURL, nil)
+	return fetchPackageResourceWithIdle(ctx, client, rawURL, subject, packageFetchReadIdleTimeout)
+}
+
+func fetchPackageResourceWithIdle(ctx context.Context, client *http.Client, rawURL, subject string, readIdle time.Duration) ([]byte, error) {
+	fetchCtx, cancel := context.WithCancelCause(ctx)
+	defer cancel(nil)
+	req, err := http.NewRequestWithContext(fetchCtx, http.MethodGet, rawURL, nil)
 	if err != nil {
 		return nil, invalidPackageAddressError(fmt.Errorf("build request for %q: %w", rawURL, err), subject)
 	}
@@ -79,11 +87,16 @@ func fetchPackageResource(ctx context.Context, client *http.Client, rawURL, subj
 		}
 		return nil, packageError(statusErr, "Prairie couldn't download %s: its host answered HTTP %d.", subject, resp.StatusCode)
 	}
-	data, err := io.ReadAll(resp.Body)
+	body := newIdleTimeoutReader(resp.Body, readIdle, cancel)
+	defer body.stop()
+	data, err := io.ReadAll(body)
 	if err != nil {
 		if ctx.Err() != nil {
 			return nil, fmt.Errorf("read %q: %w", rawURL, ctx.Err())
 		}
+		if cause := context.Cause(fetchCtx); errors.Is(cause, errPackageReadStalled) {
+			err = cause
+		}
 		return nil, transientPackageError(fmt.Errorf("read %q: %w", rawURL, err), "The download of %s was interrupted. Try again.", subject)
 	}
 	return data, nil
diff --git a/internal/plugins/package_fetch.go b/internal/plugins/package_fetch.go
new file mode 100644
index 0000000000..f8de37d4b1
--- /dev/null
+++ b/internal/plugins/package_fetch.go
@@ -0,0 +1,88 @@
+package plugins
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net"
+	"net/http"
+	"time"
+)
+
+// Plugin catalogs, checksum files and packages are fetched without a
+// whole-request deadline, because a package can be up to 256 MiB and a slow
+// but healthy download must still finish. Each phase that can hang is bounded
+// instead: connecting, the TLS handshake, waiting for response headers, and
+// any single wait for more of the body.
+const (
+	packageFetchDialTimeout           = 10 * time.Second
+	packageFetchTLSHandshakeTimeout   = 10 * time.Second
+	packageFetchResponseHeaderTimeout = 30 * time.Second
+	packageFetchReadIdleTimeout       = 60 * time.Second
+	// packageFetchMaxRead caps one Read of the body. An HTTP/1.1 chunked body
+	// keeps reading from the connection until the caller's buffer is full, and
+	// io.ReadAll's buffer grows to megabytes, so without a cap one Read could
+	// wait on megabytes of a healthy download. With it, a body counts as
+	// stalled only when it sends less than this within the idle timeout.
+	packageFetchMaxRead = 32 << 10
+)
+
+// errPackageReadStalled is the cause recorded when one capped Read of a body
+// waits longer than the read-idle timeout.
+var errPackageReadStalled = errors.New("download stalled: too little data received within the idle timeout")
+
+// packageFetchTimeouts bounds the transport phases of a package fetch.
+type packageFetchTimeouts struct {
+	dial           time.Duration
+	tlsHandshake   time.Duration
+	responseHeader time.Duration
+}
+
+var defaultPackageFetchTimeouts = packageFetchTimeouts{
+	dial:           packageFetchDialTimeout,
+	tlsHandshake:   packageFetchTLSHandshakeTimeout,
+	responseHeader: packageFetchResponseHeaderTimeout,
+}
+
+// newPackageFetchClient returns the client used when the catalog service or
+// installer is given none. It keeps the default transport's proxy and
+// connection-pool settings and redirect handling.
+func newPackageFetchClient(timeouts packageFetchTimeouts) *http.Client {
+	base, ok := http.DefaultTransport.(*http.Transport)
+	if !ok {
+		base = &http.Transport{Proxy: http.ProxyFromEnvironment}
+	}
+	transport := base.Clone()
+	transport.DialContext = (&net.Dialer{Timeout: timeouts.dial, KeepAlive: 30 * time.Second}).DialContext
+	transport.TLSHandshakeTimeout = timeouts.tlsHandshake
+	transport.ResponseHeaderTimeout = timeouts.responseHeader
+	return &http.Client{Transport: transport}
+}
+
+// idleTimeoutReader cancels the fetch when one Read waits longer than idle.
+// Only time blocked in Read counts, and each Read asks for at most
+// packageFetchMaxRead bytes, so a body is cut off only when it sends less than
+// that within idle (about 546 B/s at the default 60s), however steadily.
+type idleTimeoutReader struct {
+	r     io.Reader
+	idle  time.Duration
+	timer *time.Timer
+}
+
+func newIdleTimeoutReader(r io.Reader, idle time.Duration, cancel context.CancelCauseFunc) *idleTimeoutReader {
+	timer := time.AfterFunc(idle, func() { cancel(errPackageReadStalled) })
+	timer.Stop()
+	return &idleTimeoutReader{r: r, idle: idle, timer: timer}
+}
+
+func (r *idleTimeoutReader) Read(p []byte) (int, error) {
+	if len(p) > packageFetchMaxRead {
+		p = p[:packageFetchMaxRead]
+	}
+	r.timer.Reset(r.idle)
+	n, err := r.r.Read(p)
+	r.timer.Stop()
+	return n, err
+}
+
+func (r *idleTimeoutReader) stop() { r.timer.Stop() }
diff --git a/internal/plugins/package_fetch_test.go b/internal/plugins/package_fetch_test.go
new file mode 100644
index 0000000000..36dc33a6a5
--- /dev/null
+++ b/internal/plugins/package_fetch_test.go
@@ -0,0 +1,223 @@
+package plugins
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+)
+
+// fetchDeadline is how long a test waits for a fetch that should give up on
+// its own. It only guards against a hang; the fetch fails long before it.
+const fetchDeadline = 10 * time.Second
+
+var shortPackageFetchTimeouts = packageFetchTimeouts{
+	dial:           time.Second,
+	tlsHandshake:   time.Second,
+	responseHeader: 100 * time.Millisecond,
+}
+
+// stallingServer runs handler, which may block on release until the test ends.
+func stallingServer(t *testing.T, handler func(w http.ResponseWriter, r *http.Request, release <-chan struct{})) *httptest.Server {
+	t.Helper()
+	release := make(chan struct{})
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		handler(w, r, release)
+	}))
+	t.Cleanup(server.Close)
+	t.Cleanup(func() { close(release) })
+	return server
+}
+
+func fetchWithDeadline(t *testing.T, fetch func() ([]byte, error)) ([]byte, error) {
+	t.Helper()
+	type result struct {
+		data []byte
+		err  error
+	}
+	done := make(chan result, 1)
+	go func() {
+		data, err := fetch()
+		done <- result{data, err}
+	}()
+	select {
+	case r := <-done:
+		return r.data, r.err
+	case <-time.After(fetchDeadline):
+		t.Fatalf("fetch did not finish within %s", fetchDeadline)
+		return nil, nil
+	}
+}
+
+func TestPackageFetchDefaultClientHasTimeouts(t *testing.T) {
+	for name, client := range map[string]*http.Client{
+		"catalog":   NewCatalogService(nil, CatalogServiceOptions{}).httpClient,
+		"installer": NewInstaller(nil, InstallerOptions{}).httpClient,
+	} {
+		transport, ok := client.Transport.(*http.Transport)
+		if !ok {
+			t.Fatalf("%s client transport = %T, want *http.Transport", name, client.Transport)
+		}
+		if transport.ResponseHeaderTimeout != packageFetchResponseHeaderTimeout ||
+			transport.TLSHandshakeTimeout != packageFetchTLSHandshakeTimeout {
+			t.Fatalf("%s transport timeouts = header %s, tls %s", name, transport.ResponseHeaderTimeout, transport.TLSHandshakeTimeout)
+		}
+		if client.Timeout != 0 {
+			t.Fatalf("%s client has a whole-request timeout %s; slow downloads would be cut off", name, client.Timeout)
+		}
+	}
+}
+
+// A host that accepts the connection and never answers is reported as
+// unreachable instead of holding the fetch open.
+func TestFetchPackageResourceTimesOutWaitingForHeaders(t *testing.T) {
+	server := stallingServer(t, func(_ http.ResponseWriter, r *http.Request, release <-chan struct{}) {
+		select {
+		case <-release:
+		case <-r.Context().Done():
+		}
+	})
+	client := newPackageFetchClient(shortPackageFetchTimeouts)
+	_, err := fetchWithDeadline(t, func() ([]byte, error) {
+		return fetchPackageResource(context.Background(), client, server.URL, "the plugin")
+	})
+	requirePackageError(t, err, "couldn't reach the host for the plugin")
+	requireTransient(t, err, true)
+}
+
+// A host that sends headers and then stops sending the body is treated as an
+// interrupted download.
+func TestFetchPackageResourceTimesOutStalledBody(t *testing.T) {
+	server := stallingServer(t, func(w http.ResponseWriter, r *http.Request, release <-chan struct{}) {
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte("partial"))
+		w.(http.Flusher).Flush()
+		select {
+		case <-release:
+		case <-r.Context().Done():
+		}
+	})
+	client := newPackageFetchClient(shortPackageFetchTimeouts)
+	_, err := fetchWithDeadline(t, func() ([]byte, error) {
+		return fetchPackageResourceWithIdle(context.Background(), client, server.URL, "the plugin", 100*time.Millisecond)
+	})
+	requirePackageError(t, err, "download of the plugin was interrupted")
+	requireTransient(t, err, true)
+	if !errors.Is(err, errPackageReadStalled) {
+		t.Fatalf("stalled body error = %v, want errPackageReadStalled", err)
+	}
+}
+
+// Only a wait for data counts against the idle timeout: a body that takes
+// longer than the timeout in total but keeps sending still completes.
+func TestFetchPackageResourceAllowsSlowProgressingBody(t *testing.T) {
+	const (
+		idle   = 500 * time.Millisecond
+		chunks = 20
+		gap    = 50 * time.Millisecond
+	)
+	server := stallingServer(t, func(w http.ResponseWriter, _ *http.Request, _ <-chan struct{}) {
+		w.WriteHeader(http.StatusOK)
+		for range chunks {
+			_, _ = w.Write([]byte("x"))
+			w.(http.Flusher).Flush()
+			time.Sleep(gap)
+		}
+	})
+	client := newPackageFetchClient(shortPackageFetchTimeouts)
+	start := time.Now()
+	data, err := fetchWithDeadline(t, func() ([]byte, error) {
+		return fetchPackageResourceWithIdle(context.Background(), client, server.URL, "the plugin", idle)
+	})
+	if err != nil {
+		t.Fatalf("slow download failed: %v", err)
+	}
+	if !bytes.Equal(data, bytes.Repeat([]byte("x"), chunks)) {
+		t.Fatalf("slow download = %q", data)
+	}
+	if elapsed := time.Since(start); elapsed <= idle {
+		t.Fatalf("download took %s, want longer than the %s idle timeout for the test to mean anything", elapsed, idle)
+	}
+}
+
+// Canceling the caller's context during a stalled body still returns the
+// caller's cancellation, not a stall.
+func TestFetchPackageResourceCancelDuringStalledBody(t *testing.T) {
+	bodyStarted := make(chan struct{})
+	server := stallingServer(t, func(w http.ResponseWriter, r *http.Request, release <-chan struct{}) {
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte("partial"))
+		w.(http.Flusher).Flush()
+		close(bodyStarted)
+		select {
+		case <-release:
+		case <-r.Context().Done():
+		}
+	})
+	client := newPackageFetchClient(shortPackageFetchTimeouts)
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	go func() {
+		<-bodyStarted
+		cancel()
+	}()
+	_, err := fetchWithDeadline(t, func() ([]byte, error) {
+		return fetchPackageResourceWithIdle(ctx, client, server.URL, "the plugin", time.Hour)
+	})
+	if _, ok := AsPackageError(err); ok || !errors.Is(err, context.Canceled) {
+		t.Fatalf("canceled fetch = %v, want context.Canceled and no PackageError", err)
+	}
+}
+
+// A large package sent as one HTTP/1.1 chunk arrives in many socket reads
+// inside a single body Read. A steady download must not count as stalled
+// just because io.ReadAll asks for a large buffer.
+func TestFetchPackageResourceAllowsSlowSingleChunkBody(t *testing.T) {
+	const (
+		idle  = 100 * time.Millisecond
+		total = 2 << 20
+		piece = 16 << 10
+		gap   = 10 * time.Millisecond
+	)
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = listener.Close() })
+	go func() {
+		conn, err := listener.Accept()
+		if err != nil {
+			return
+		}
+		defer func() { _ = conn.Close() }()
+		if _, err := http.ReadRequest(bufio.NewReader(conn)); err != nil {
+			return
+		}
+		_, _ = fmt.Fprintf(conn, "HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked\r\nConnection: close\r\n\r\n%x\r\n", total)
+		data := bytes.Repeat([]byte("x"), piece)
+		for sent := 0; sent < total; sent += piece {
+			if _, err := conn.Write(data); err != nil {
+				return
+			}
+			time.Sleep(gap)
+		}
+		_, _ = io.WriteString(conn, "\r\n0\r\n\r\n")
+	}()
+	client := newPackageFetchClient(shortPackageFetchTimeouts)
+	data, err := fetchWithDeadline(t, func() ([]byte, error) {
+		return fetchPackageResourceWithIdle(context.Background(), client, "http://"+listener.Addr().String(), "the plugin", idle)
+	})
+	if err != nil {
+		t.Fatalf("steady single-chunk download failed: %v", err)
+	}
+	if len(data) != total {
+		t.Fatalf("downloaded %d bytes, want %d", len(data), total)
+	}
+}
diff --git a/internal/plugins/preload_enabled_test.go b/internal/plugins/preload_enabled_test.go
new file mode 100644
index 0000000000..b2296e18f8
--- /dev/null
+++ b/internal/plugins/preload_enabled_test.go
@@ -0,0 +1,30 @@
+package plugins
+
+import (
+	"context"
+	"errors"
+	"testing"
+)
+
+// One enabled plugin that no longer loads must not keep the server from
+// starting: a fresh node loads every plugin from its stored archive.
+func TestPreloadEnabledContinuesPastPluginThatFailsToLoad(t *testing.T) {
+	store := newFakeServiceInstallationStore(&Installation{
+		ID:          1,
+		PluginID:    "test.broken",
+		Kind:        KindPlugin,
+		Enabled:     true,
+		InstallPath: t.TempDir() + "/missing/plugin",
+	})
+	svc := &Service{installations: store}
+
+	if err := svc.PreloadEnabled(context.Background()); err != nil {
+		t.Fatalf("PreloadEnabled = %v, want nil with the broken plugin skipped", err)
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	if err := svc.PreloadEnabled(ctx); !errors.Is(err, context.Canceled) {
+		t.Fatalf("PreloadEnabled(canceled) = %v, want context.Canceled", err)
+	}
+}
diff --git a/internal/plugins/request_router_test.go b/internal/plugins/request_router_test.go
index dfc308ab43..09ec34cd0b 100644
--- a/internal/plugins/request_router_test.go
+++ b/internal/plugins/request_router_test.go
@@ -9,14 +9,16 @@ import (
 	"github.com/prairie-server/prairie-plugin-sdk/pkg/pluginsdk/capability"
 )
 
-// The host reads supports_seasons and reports_download_progress from the
-// capability metadata stored from the manifest, the way install records it.
+// The host reads supports_seasons, reports_download_progress and
+// api_key_optional from the capability metadata stored from the manifest, the
+// way install records it.
 func TestRequestRouterDescriptorReadsStoredManifestFlag(t *testing.T) {
 	records, err := CapabilityRecordsFromManifest(&pluginv1.PluginManifest{
 		Capabilities: []*pluginv1.CapabilityDescriptor{
 			{Type: capability.RequestRouter, Id: "arr", RequestRouter: &pluginv1.RequestRouterDescriptor{SupportsSeasons: true}},
 			{Type: capability.RequestRouter, Id: "legacy"},
 			{Type: capability.RequestRouter, Id: "progress", RequestRouter: &pluginv1.RequestRouterDescriptor{SupportsSeasons: true, ReportsDownloadProgress: true}},
+			{Type: capability.RequestRouter, Id: "keyless", RequestRouter: &pluginv1.RequestRouterDescriptor{ApiKeyOptional: true}},
 		},
 	})
 	if err != nil {
@@ -29,14 +31,16 @@ func TestRequestRouterDescriptorReadsStoredManifestFlag(t *testing.T) {
 	service := &Service{installations: store}
 
 	for _, tc := range []struct {
-		capabilityID string
-		want         bool
-		wantProgress bool
+		capabilityID    string
+		want            bool
+		wantProgress    bool
+		wantKeyOptional bool
 	}{
-		{"arr", true, false},      // built before reports_download_progress existed
-		{"legacy", false, false},  // built before the descriptor existed
-		{"missing", false, false}, // not declared at all
-		{"progress", true, true},
+		{"arr", true, false, false},      // built before reports_download_progress existed
+		{"legacy", false, false, false},  // built before the descriptor existed
+		{"missing", false, false, false}, // not declared at all
+		{"progress", true, true, false},
+		{"keyless", false, false, true},
 	} {
 		got, err := service.RequestRouterDescriptor(context.Background(), 5, tc.capabilityID)
 		if err != nil {
@@ -48,6 +52,9 @@ func TestRequestRouterDescriptorReadsStoredManifestFlag(t *testing.T) {
 		if got.GetReportsDownloadProgress() != tc.wantProgress {
 			t.Errorf("%s: reports_download_progress = %v, want %v", tc.capabilityID, got.GetReportsDownloadProgress(), tc.wantProgress)
 		}
+		if got.GetApiKeyOptional() != tc.wantKeyOptional {
+			t.Errorf("%s: api_key_optional = %v, want %v", tc.capabilityID, got.GetApiKeyOptional(), tc.wantKeyOptional)
+		}
 	}
 }
 
diff --git a/internal/plugins/resident.go b/internal/plugins/resident.go
index ae1a257800..9714bf97fb 100644
--- a/internal/plugins/resident.go
+++ b/internal/plugins/resident.go
@@ -31,8 +31,9 @@ const (
 // RuntimeState is the admin-visible view of one installation's process.
 // Resident is true for installations the supervisor owns (started at boot,
 // restarted on crash); the other fields describe the supervisor's machine.
-// For a lazily started plugin State is running or stopped and the counters
-// stay zero.
+// For a lazily started plugin State is running or stopped, or failed from
+// RuntimeStateOf when its last launch on this host failed (LastError says
+// why); the counters stay zero.
 type RuntimeState struct {
 	Resident      bool
 	State         ResidentState
@@ -293,7 +294,7 @@ func (r *ResidentSupervisor) Enable(ctx context.Context) {
 	}
 	r.mu.Lock()
 	r.armed = true
-	r.ctx = context.WithoutCancel(ctx)
+	r.ctx = context.WithoutCancel(ctx) //nolint:fatcontext // derived from the caller's ctx, never from r.ctx
 	r.mu.Unlock()
 	r.Reconcile(ctx)
 }
@@ -800,6 +801,22 @@ func (s *Service) RuntimeState(installationID int) RuntimeState {
 	return state
 }
 
+// RuntimeStateOf is RuntimeState for the admin API. A lazily started plugin
+// that is not running also reads failed when its last launch on this host
+// failed for the installation's current release and runtime generation,
+// with LastError saying why.
+func (s *Service) RuntimeStateOf(installation *Installation) RuntimeState {
+	state := s.RuntimeState(installation.ID)
+	if s == nil || state.Resident || state.State != ResidentStopped {
+		return state
+	}
+	if message, failed := s.lazyStartFailures.lastError(installation); failed {
+		state.State = ResidentFailed
+		state.LastError = message
+	}
+	return state
+}
+
 // RestartInstallation stops the installation's process and, for a resident,
 // starts it again immediately with a fresh failure budget. A non-resident
 // plugin is only stopped; its next RPC launches it lazily.
@@ -845,6 +862,9 @@ func (s *Service) RestartInstallation(ctx context.Context, installationID int) e
 	if !errors.Is(err, ErrNotResident) {
 		return err
 	}
+	// Like a resident's fresh failure budget, an administrator restart clears
+	// a lazy plugin's recorded start failure; its next use launches it again.
+	s.lazyStartFailures.clear(installationID)
 	if s.host == nil {
 		return nil
 	}
diff --git a/internal/plugins/service.go b/internal/plugins/service.go
index a1c199ed32..995c4c6f84 100644
--- a/internal/plugins/service.go
+++ b/internal/plugins/service.go
@@ -22,6 +22,7 @@ import (
 	"google.golang.org/protobuf/types/known/structpb"
 
 	pluginv1 "github.com/prairie-server/prairie-plugin-sdk/pkg/pluginproto/prairie/plugin/v1"
+
 	"github.com/prairie-server/prairie-server/internal/cache"
 	"github.com/prairie-server/prairie-server/internal/pluginhost"
 )
@@ -91,6 +92,9 @@ type Service struct {
 	launchGroup      singleflight.Group
 	runtimeRefreshMu sync.RWMutex
 	resident         *ResidentSupervisor
+	// lazyStartFailures records failed launches of non-resident plugins for
+	// the admin runtime state; see RuntimeState.
+	lazyStartFailures lazyStartFailures
 	// lifecycleBus, when set by PublishLifecycleChanges, carries every
 	// lifecycle change to the proxy nodes running the same installations.
 	lifecycleBus cache.EventBus
@@ -511,13 +515,14 @@ func (s *Service) PreloadEnabled(ctx context.Context) error {
 		if installation == nil {
 			continue
 		}
-		// Builtin installations have no archive or binary; skip them explicitly
-		// instead of leaning on the tolerated ErrArchiveNotFound branch below
-		// (any other load error here is fatal to startup).
+		// Builtin installations have no archive or binary.
 		if installation.IsBuiltin() {
 			continue
 		}
 		if _, err := s.ensureLoadedInstallation(ctx, installation); err != nil {
+			if ctxErr := ctx.Err(); ctxErr != nil {
+				return ctxErr
+			}
 			if errors.Is(err, ErrArchiveNotFound) {
 				slog.WarnContext(ctx,
 					"plugin preload skipped: archive not found for enabled installation", "component", "plugins",
@@ -527,7 +532,17 @@ func (s *Service) PreloadEnabled(ctx context.Context) error {
 				)
 				continue
 			}
-			return fmt.Errorf("preload plugin installation %d: %w", installation.ID, err)
+			// One plugin whose stored archive no longer verifies must not
+			// keep the server from starting; a fresh node loads every plugin
+			// from its archive, so a fatal error here would crash-loop it.
+			// The plugin stays unavailable and its RPCs report the same error.
+			slog.ErrorContext(ctx,
+				"plugin preload failed; continuing without it", "component", "plugins",
+				"installation_id", installation.ID,
+				"plugin_id", installation.PluginID,
+				"version", installation.Version,
+				"error", err,
+			)
 		}
 	}
 	s.OnLifecycleChange(ctx)
@@ -540,12 +555,37 @@ func (s *Service) Start(ctx context.Context, installationID int) (pluginClient,
 	return s.start(ctx, installationID, true)
 }
 
-func (s *Service) start(ctx context.Context, installationID int, allowResident bool) (pluginClient, error) {
-	installation, manifest, err := s.ensureInstallationCache(ctx, installationID, true)
+func (s *Service) start(ctx context.Context, installationID int, allowResident bool) (client pluginClient, err error) {
+	installation, err := s.loadInstallation(ctx, installationID, true)
+	if err != nil {
+		// No launch was attempted: a disabled, missing or unreadable row says
+		// nothing about whether the plugin can start.
+		return nil, err
+	}
+	// Record why a lazy launch failed, including an archive or config that
+	// cannot be loaded, so the admin API can show a plugin that cannot start.
+	// The failure is tied to the snapshot that was tried, not re-read, so an
+	// update that lands mid-launch is not marked failed. The supervisor
+	// reports failures of the resident plugins it launches itself; a refused
+	// resident says nothing about the plugin.
+	var manifest *pluginv1.PluginManifest
+	refusedResident := false
+	defer func() {
+		supervised := allowResident && (manifest == nil || isResidentManifest(manifest))
+		switch {
+		case err == nil:
+			s.lazyStartFailures.clear(installationID)
+		case !supervised && !refusedResident:
+			s.lazyStartFailures.record(installation, err)
+		}
+	}()
+	manifest, err = s.ensureLoadedInstallation(ctx, installation)
 	if err != nil {
+		manifest = nil
 		return nil, err
 	}
 	if !allowResident && isResidentManifest(manifest) {
+		refusedResident = true
 		return nil, fmt.Errorf("%w: resident plugin installation %d requires supervision", pluginhost.ErrPluginUnhealthy, installationID)
 	}
 	configEntries, err := s.globalConfigEntries(ctx, installation.ID)
@@ -852,9 +892,10 @@ func (s *Service) ensureClientForStart(ctx context.Context, installationID int,
 	if err != nil {
 		return nil, err
 	}
+	// A Host that reports success without a client leaves v nil.
 	client, ok := v.(pluginClient)
 	if !ok {
-		return nil, fmt.Errorf("plugin client type assertion failed for installation %d", installationID)
+		return nil, fmt.Errorf("%w: plugin installation %d started without a client", pluginhost.ErrPluginUnhealthy, installationID)
 	}
 	return client, nil
 }
diff --git a/internal/plugins/service_connection.go b/internal/plugins/service_connection.go
index 3fcde35504..0ec4857168 100644
--- a/internal/plugins/service_connection.go
+++ b/internal/plugins/service_connection.go
@@ -9,6 +9,8 @@ import (
 	"strings"
 	"time"
 
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/types/known/structpb"
 
 	pluginv1 "github.com/prairie-server/prairie-plugin-sdk/pkg/pluginproto/prairie/plugin/v1"
@@ -18,6 +20,12 @@ import (
 
 var ErrConnectionTestUnsupported = errors.New("plugin connection test unsupported")
 
+// Capability types a connection check can probe.
+const (
+	metadataProviderCapability = "metadata_provider.v1"
+	markerProviderCapability   = "marker_provider.v1"
+)
+
 type ConnectionTestError struct {
 	Message string
 	Cause   error
@@ -42,11 +50,14 @@ func runPluginConnectionCheck(
 	client pluginClient,
 	manifest *pluginv1.PluginManifest,
 ) error {
-	capabilityID, err := metadataProviderConnectionCheckCapabilityID(manifest)
+	capability, err := connectionCheckCapability(manifest)
 	if err != nil {
 		return err
 	}
-	capability := metadataProviderConnectionCheckCapability(manifest, capabilityID)
+	capabilityID := capability.GetId()
+	if capability.GetType() == markerProviderCapability {
+		return runMarkerProviderConnectionCheck(ctx, client, capabilityID)
+	}
 	if !metadataProviderSupportsConnectionProbe(capability, "movie") {
 		slog.DebugContext(ctx,
 			"skipping metadata provider connection check for unsupported probe type", "component", "plugins",
@@ -120,7 +131,7 @@ func (s *Service) TestGlobalConfigWithClears(
 	if err != nil {
 		return err
 	}
-	if _, err := metadataProviderConnectionCheckCapabilityID(manifest); err != nil {
+	if _, err := connectionCheckCapability(manifest); err != nil {
 		return err
 	}
 
@@ -272,26 +283,47 @@ func cloneConfigMap(value map[string]any) map[string]any {
 	return cloned
 }
 
-func metadataProviderConnectionCheckCapabilityID(manifest *pluginv1.PluginManifest) (string, error) {
-	for _, capability := range manifest.GetCapabilities() {
-		if capability.GetType() != "metadata_provider.v1" {
-			continue
+// connectionCheckCapability picks the capability a connection check probes: the
+// plugin's first metadata provider, or else its first marker provider.
+func connectionCheckCapability(manifest *pluginv1.PluginManifest) (*pluginv1.CapabilityDescriptor, error) {
+	for _, capabilityType := range []string{metadataProviderCapability, markerProviderCapability} {
+		for _, capability := range manifest.GetCapabilities() {
+			if capability.GetType() == capabilityType {
+				return capability, nil
+			}
 		}
-		return capability.GetId(), nil
 	}
-	return "", &ConnectionTestError{
-		Message: "Connection checks are not supported for this plugin yet.",
+	return nil, &ConnectionTestError{
+		Message: connectionCheckUnsupportedMessage,
 		Cause:   ErrConnectionTestUnsupported,
 	}
 }
 
-func metadataProviderConnectionCheckCapability(
-	manifest *pluginv1.PluginManifest,
-	capabilityID string,
-) *pluginv1.CapabilityDescriptor {
-	for _, capability := range manifest.GetCapabilities() {
-		if capability.GetType() == "metadata_provider.v1" && capability.GetId() == capabilityID {
-			return capability
+const connectionCheckUnsupportedMessage = "Connection checks are not supported for this plugin yet."
+
+// runMarkerProviderConnectionCheck asks a marker provider for its account
+// statistics, which need the provider's credentials, so a success shows that
+// the staged settings authenticate. A provider without statistics has no
+// check to run.
+func runMarkerProviderConnectionCheck(ctx context.Context, client pluginClient, capabilityID string) error {
+	markerClient, err := client.MarkerProvider(capabilityID)
+	if err != nil {
+		return &ConnectionTestError{
+			Message: fmt.Sprintf("Failed to initialize the marker provider: %v", err),
+			Cause:   err,
+		}
+	}
+
+	probeCtx, cancel := context.WithTimeout(ctx, 20*time.Second)
+	defer cancel()
+
+	if _, err := markerClient.GetMarkerProviderStats(probeCtx, &pluginv1.GetMarkerProviderStatsRequest{}); err != nil {
+		if status.Code(err) == codes.Unimplemented {
+			return &ConnectionTestError{Message: connectionCheckUnsupportedMessage, Cause: ErrConnectionTestUnsupported}
+		}
+		return &ConnectionTestError{
+			Message: "Connection check failed: " + status.Convert(err).Message(),
+			Cause:   err,
 		}
 	}
 	return nil
diff --git a/internal/plugins/service_connection_test.go b/internal/plugins/service_connection_test.go
index ece05d6a95..6c9e14a7be 100644
--- a/internal/plugins/service_connection_test.go
+++ b/internal/plugins/service_connection_test.go
@@ -8,8 +8,14 @@ import (
 	"testing"
 	"time"
 
-	pluginv1 "github.com/prairie-server/prairie-plugin-sdk/pkg/pluginproto/prairie/plugin/v1"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/types/known/structpb"
+
+	pluginv1 "github.com/prairie-server/prairie-plugin-sdk/pkg/pluginproto/prairie/plugin/v1"
+
+	"github.com/prairie-server/prairie-server/internal/pluginhost"
 )
 
 type fakeServiceConfigStore struct {
@@ -791,6 +797,82 @@ func TestServiceTestGlobalConfigStopsTemporaryInstanceOnProbeFailure(t *testing.
 	}
 }
 
+// fakeMarkerStats answers GetMarkerProviderStats for marker connection checks.
+type fakeMarkerStats struct {
+	pluginv1.MarkerProviderClient
+	err   error
+	calls int
+}
+
+func (f *fakeMarkerStats) GetMarkerProviderStats(context.Context, *pluginv1.GetMarkerProviderStatsRequest, ...grpc.CallOption) (*pluginv1.MarkerProviderStatsResponse, error) {
+	f.calls++
+	if f.err != nil {
+		return nil, f.err
+	}
+	return &pluginv1.MarkerProviderStatsResponse{Total: 3}, nil
+}
+
+func TestServiceTestGlobalConfigChecksMarkerProviderAccount(t *testing.T) {
+	for _, tt := range []struct {
+		name        string
+		statsErr    error
+		wantMessage string
+	}{
+		{name: "accepted key"},
+		{
+			name:        "rejected key",
+			statsErr:    status.Error(codes.Unknown, "introdb: stats HTTP 401: Invalid or expired token"),
+			wantMessage: "Connection check failed: introdb: stats HTTP 401: Invalid or expired token",
+		},
+		{
+			name:        "provider without account statistics",
+			statsErr:    status.Error(codes.Unimplemented, "method GetMarkerProviderStats not implemented"),
+			wantMessage: "Connection checks are not supported for this plugin yet.",
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			manifest := connectionTestManifest(t, "prairie.theintrodb", "0.2.0")
+			manifest.Capabilities = []*pluginv1.CapabilityDescriptor{{
+				Type: "marker_provider.v1", Id: "introdb", DisplayName: "TheIntroDB",
+			}}
+			installPath := writeInstalledPluginManifest(t, manifest)
+			stats := &fakeMarkerStats{err: tt.statsErr}
+			host := &fakeServiceHost{startResult: &fakePluginClient{
+				manifest:       manifest,
+				markerProvider: pluginhost.NewMarkerProviderClient(stats),
+			}}
+			service := &Service{
+				installations: newFakeServiceInstallationStore(&Installation{
+					ID:          4,
+					PluginID:    manifest.GetPluginId(),
+					Version:     manifest.GetVersion(),
+					InstallPath: installPath,
+					Enabled:     true,
+				}),
+				host: host,
+			}
+
+			err := service.TestGlobalConfig(context.Background(), 4, "connection", map[string]any{"api_key": "draft"})
+			if tt.wantMessage == "" {
+				if err != nil {
+					t.Fatalf("TestGlobalConfig() error = %v, want success", err)
+				}
+			} else {
+				var connectionErr *ConnectionTestError
+				if !errors.As(err, &connectionErr) || connectionErr.Error() != tt.wantMessage {
+					t.Fatalf("TestGlobalConfig() error = %v, want message %q", err, tt.wantMessage)
+				}
+			}
+			if stats.calls != 1 {
+				t.Fatalf("stats calls = %d, want 1", stats.calls)
+			}
+			if len(host.started) != 1 || len(host.stopped) != 1 || host.stopped[0] != host.started[0].InstallationID {
+				t.Fatalf("temporary instance: started=%v stopped=%v", host.started, host.stopped)
+			}
+		})
+	}
+}
+
 func connectionTestManifest(t *testing.T, pluginID, version string) *pluginv1.PluginManifest {
 	t.Helper()
 
diff --git a/internal/plugins/service_hot_reload_test.go b/internal/plugins/service_hot_reload_test.go
index 8fc48367e3..5fb159d89d 100644
--- a/internal/plugins/service_hot_reload_test.go
+++ b/internal/plugins/service_hot_reload_test.go
@@ -152,6 +152,7 @@ type fakePluginClient struct {
 	manifest              *pluginv1.PluginManifest
 	metadataProviderCalls int
 	metadataProviderErr   error
+	markerProvider        *pluginhost.MarkerProviderClient
 }
 
 func (f *fakePluginClient) Manifest() *pluginv1.PluginManifest {
@@ -168,7 +169,7 @@ func (f *fakePluginClient) ImageResolver(string) (*pluginhost.ImageResolverClien
 }
 
 func (f *fakePluginClient) MarkerProvider(string) (*pluginhost.MarkerProviderClient, error) {
-	return nil, nil
+	return f.markerProvider, nil
 }
 
 func (f *fakePluginClient) MediaAnalyzer(string) (*pluginhost.MediaAnalyzerClient, error) {
diff --git a/internal/plugins/service_singleflight_test.go b/internal/plugins/service_singleflight_test.go
index 1269fac5e1..5696f79b94 100644
--- a/internal/plugins/service_singleflight_test.go
+++ b/internal/plugins/service_singleflight_test.go
@@ -2,6 +2,7 @@ package plugins
 
 import (
 	"context"
+	"errors"
 	"sync"
 	"testing"
 	"time"
@@ -244,6 +245,28 @@ func TestEnsureClientLaunchIsolatedFromLeaderCancellation(t *testing.T) {
 	}
 }
 
+// TestEnsureClientLaunchWithoutClientFails pins that a Host reporting a
+// successful start with no client fails the caller instead of panicking on
+// the shared launch result.
+func TestEnsureClientLaunchWithoutClientFails(t *testing.T) {
+	manifest := testPluginManifest(t, "prairie.metadb", "0.0.36")
+	installPath := writeInstalledPluginManifest(t, manifest)
+	store := newFakeServiceInstallationStore(&Installation{
+		ID: 7, PluginID: manifest.GetPluginId(), Version: manifest.GetVersion(),
+		InstallPath: installPath, Enabled: true,
+	})
+	host := &countingHerdHost{} // Start returns (nil, nil)
+	service := &Service{installations: store, host: host}
+
+	client, err := service.ensureClient(context.Background(), 7)
+	if !errors.Is(err, pluginhost.ErrPluginUnhealthy) {
+		t.Fatalf("ensureClient err = %v, want ErrPluginUnhealthy", err)
+	}
+	if client != nil {
+		t.Fatalf("ensureClient client = %#v, want nil", client)
+	}
+}
+
 func TestEnsureClientFailedLaunchPropagatesToAllCallers(t *testing.T) {
 	manifest := testPluginManifest(t, "prairie.metadb", "0.0.36")
 	installPath := writeInstalledPluginManifest(t, manifest)
diff --git a/internal/policy/document_mutations_test.go b/internal/policy/document_mutations_test.go
index 2be3c078b6..6a9e0a02dd 100644
--- a/internal/policy/document_mutations_test.go
+++ b/internal/policy/document_mutations_test.go
@@ -312,11 +312,22 @@ func TestDocumentServiceCommittedApplyFailure(t *testing.T) {
 			if failure == "local reload" {
 				runtimeStore.pool.Close()
 			}
+			applied := 0
+			system.OnChangeApplied(func(context.Context, int64) { applied++ })
 			service := NewDocumentService(store, system)
 			result, err := service.Activate(ctx, document.ID, version.ID, document.Revision)
 			if err != nil || !result.Persisted || result.Generation != 2 || result.Document.ActiveVersionID == nil {
 				t.Fatalf("committed result lost: %+v %v", result, err)
 			}
+			// The hook runs once this node has loaded the change; a failed
+			// reload has not, and a later event or poll reload runs it.
+			want := 1
+			if failure == "local reload" {
+				want = 0
+			}
+			if applied != want {
+				t.Fatalf("change hook ran %d times, want %d", applied, want)
+			}
 			if result.Application.PublishErr == nil {
 				t.Fatal("publication failure omitted")
 			}
diff --git a/internal/policy/system.go b/internal/policy/system.go
index 777b8d9b4b..ef8ef464b2 100644
--- a/internal/policy/system.go
+++ b/internal/policy/system.go
@@ -30,6 +30,14 @@ type System struct {
 	cancel   context.CancelFunc
 	reloadCh chan struct{}
 	wg       sync.WaitGroup
+	// reloadMu serializes reloads, so each loads the store's snapshot after
+	// the previous one applied and the loaded generation never goes back.
+	reloadMu sync.Mutex
+
+	// changeApplied runs after this node loads a newer policy generation;
+	// announcedGeneration is the newest one it ran for, or the boot load's.
+	changeApplied       func(ctx context.Context, generation int64)
+	announcedGeneration int64
 
 	// bootDegradedReason is set when the initial engine could not load the
 	// full stored policy (store unreachable or custom bundle failed) and is
@@ -125,6 +133,7 @@ func (s *System) Start(ctx context.Context) error {
 	}
 	s.engine = engine
 	s.bootDegradedReason = bootDegradedReason
+	s.announcedGeneration = engine.Revision()
 	s.pdp = NewPDP(engine, WithDecisionLogger(s.decisionLogger))
 	s.cancel = cancel
 	s.mu.Unlock()
@@ -285,6 +294,20 @@ func (s *System) SetEvalTimeout(timeout time.Duration) {
 	}
 }
 
+// Current reports whether this node serves the policy generation the store
+// holds now. It is false between a change's commit and this node's reload of
+// it. A nil System, which has no store, is always current.
+func (s *System) Current(ctx context.Context) (bool, error) {
+	if s == nil || s.store == nil {
+		return true, nil
+	}
+	stored, err := s.store.Generation(ctx)
+	if err != nil {
+		return false, fmt.Errorf("read policy generation: %w", err)
+	}
+	return s.Generation() == stored, nil
+}
+
 // ApplyStatus describes how a policy change was applied: whether this node's
 // engine reloaded to the stored generation and whether peers were notified.
 type ApplyStatus struct {
@@ -323,6 +346,21 @@ func (s *System) NotifyChanged(ctx context.Context) error {
 	return s.ApplyChanged(ctx).Err()
 }
 
+// OnChangeApplied registers fn to run, with the generation loaded, each time
+// this node loads a newer policy generation than it had, whichever reload
+// loaded it: the synchronous one after a local change, or a later event or
+// poll reload, which also covers a local reload that failed. Every node runs
+// fn after it applies the change; fn can use the generation to act once
+// across nodes. The boot load does not run fn.
+func (s *System) OnChangeApplied(fn func(ctx context.Context, generation int64)) {
+	if s == nil {
+		return
+	}
+	s.mu.Lock()
+	s.changeApplied = fn
+	s.mu.Unlock()
+}
+
 // ApplyChanged reloads this node synchronously, publishes a cross-node
 // invalidation event, and reports per-step outcomes so callers can distinguish
 // "persisted" from "live". The last known-good engine remains active on reload
@@ -381,25 +419,50 @@ func (s *System) engineOptions(extra ...EngineOption) []EngineOption {
 }
 
 func (s *System) reloadFromStore(ctx context.Context) error {
-	sources, generation, err := s.loadSnapshot(ctx)
+	generation, announce, err := s.reloadSerialized(ctx)
 	if err != nil {
 		return err
 	}
+	s.mu.RLock()
+	changeApplied := s.changeApplied
+	s.mu.RUnlock()
+	if announce && changeApplied != nil {
+		changeApplied(ctx, generation)
+	}
+	return nil
+}
+
+// reloadSerialized loads the store's current policy into the engine, one
+// reload at a time: overlapping reloads could otherwise apply an older
+// snapshot after a newer one. It returns the generation loaded and reports
+// whether it is newer than any announced before.
+func (s *System) reloadSerialized(ctx context.Context) (generation int64, announce bool, err error) {
+	s.reloadMu.Lock()
+	defer s.reloadMu.Unlock()
+	sources, generation, err := s.loadSnapshot(ctx)
+	if err != nil {
+		return 0, false, err
+	}
 
 	s.mu.RLock()
 	engine := s.engine
 	s.mu.RUnlock()
 	if engine == nil {
-		return errors.New("policy system is not started")
+		return 0, false, errors.New("policy system is not started")
 	}
 	if err := engine.Reload(ctx, sources, generation); err != nil {
-		return err
+		return 0, false, err
 	}
 	s.mu.Lock()
 	s.bootDegradedReason = ""
+	// Two reloads of one generation announce it once.
+	announce = generation > s.announcedGeneration
+	if announce {
+		s.announcedGeneration = generation
+	}
 	s.mu.Unlock()
 	s.logger.InfoContext(ctx, "policy engine reloaded", "generation", generation)
-	return nil
+	return generation, announce, nil
 }
 
 func (s *System) loadSnapshot(ctx context.Context) (map[string]ActiveSource, int64, error) {
diff --git a/internal/policy/system_test.go b/internal/policy/system_test.go
index 51d640414d..62be8265f4 100644
--- a/internal/policy/system_test.go
+++ b/internal/policy/system_test.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"log/slog"
 	"sync"
+	"sync/atomic"
 	"testing"
 	"time"
 
@@ -20,12 +21,21 @@ func TestSystemCrossNodeConvergenceEventAndPoll(t *testing.T) {
 	eventBus := newPolicyTestEventBus()
 	systemA := newStartedPolicySystem(t, ctx, storeA, eventBus, time.Hour)
 	systemB := newStartedPolicySystem(t, ctx, storeB, eventBus, time.Hour)
+	var appliedA, appliedB atomic.Int32
+	systemA.OnChangeApplied(func(context.Context, int64) { appliedA.Add(1) })
+	systemB.OnChangeApplied(func(context.Context, int64) { appliedB.Add(1) })
 
 	documentID, generation := activatePolicyVersion(t, ctx, storeA, 0, "sha-event")
 	if err := systemA.NotifyChanged(ctx); err != nil {
 		t.Fatalf("NotifyChanged(event) error: %v", err)
 	}
 	waitForPolicyRevision(t, systemB, generation)
+	// Each node announces the change once it has applied it; the origin's
+	// own event reload of the same generation does not announce it again.
+	waitForChangeApplied(t, &appliedB, 1)
+	if n := appliedA.Load(); n != 1 {
+		t.Fatalf("origin announced the change %d times, want 1", n)
+	}
 
 	systemA.Stop()
 	systemB.Stop()
@@ -36,12 +46,69 @@ func TestSystemCrossNodeConvergenceEventAndPoll(t *testing.T) {
 	pollSystemB := newStartedPolicySystem(t, ctx, storeB, droppingBus, 20*time.Millisecond)
 	defer pollSystemA.Stop()
 	defer pollSystemB.Stop()
+	var appliedPollB atomic.Int32
+	pollSystemB.OnChangeApplied(func(context.Context, int64) { appliedPollB.Add(1) })
 
 	_, generation = activatePolicyVersion(t, ctx, storeA, documentID, "sha-poll")
 	if err := pollSystemA.NotifyChanged(ctx); err != nil {
 		t.Fatalf("NotifyChanged(poll) error: %v", err)
 	}
 	waitForPolicyRevision(t, pollSystemB, generation)
+	waitForChangeApplied(t, &appliedPollB, 1)
+}
+
+// A change committed without a successful local reload, as when the origin's
+// synchronous reload fails, is announced by the poll reload that loads it, and
+// only once however many reloads load it again.
+func TestSystemAnnouncesAChangeLoadedByALaterReload(t *testing.T) {
+	ctx := context.Background()
+	_, store := newPolicyStoreTest(t, ctx)
+	system := newStartedPolicySystem(t, ctx, store, &cache.NoopEventBus{}, time.Hour)
+	defer system.Stop()
+	var applied atomic.Int32
+	var announced atomic.Int64
+	system.OnChangeApplied(func(_ context.Context, generation int64) {
+		applied.Add(1)
+		announced.Store(generation)
+	})
+
+	_, generation := activatePolicyVersion(t, ctx, store, 0, "sha-recovery")
+	// Until this node reloads, it does not serve the stored generation.
+	if current, err := system.Current(ctx); err != nil || current {
+		t.Fatalf("Current before the reload = %v, %v; want false", current, err)
+	}
+	system.reloadIfGenerationChanged(ctx)
+	if system.Generation() != generation || applied.Load() != 1 || announced.Load() != generation {
+		t.Fatalf("after the poll reload: generation %d (want %d), hook ran %d times (want 1) with generation %d", system.Generation(), generation, applied.Load(), announced.Load())
+	}
+	if current, err := system.Current(ctx); err != nil || !current {
+		t.Fatalf("Current after the reload = %v, %v; want true", current, err)
+	}
+	if err := system.reloadFromStore(ctx); err != nil {
+		t.Fatal(err)
+	}
+	if n := applied.Load(); n != 1 {
+		t.Fatalf("a second reload of the same generation ran the hook again: %d times", n)
+	}
+}
+
+// waitForChangeApplied waits until the change hook counted by applied has run
+// want times.
+func waitForChangeApplied(t *testing.T, applied *atomic.Int32, want int32) {
+	t.Helper()
+	deadline := time.After(3 * time.Second)
+	ticker := time.NewTicker(10 * time.Millisecond)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-deadline:
+			t.Fatalf("change hook ran %d times, want %d", applied.Load(), want)
+		case <-ticker.C:
+			if applied.Load() == want {
+				return
+			}
+		}
+	}
 }
 
 func TestSystemDegradedBootUsesVendorPolicy(t *testing.T) {
diff --git a/internal/policy/viewer_resolver.go b/internal/policy/viewer_resolver.go
index 5daca897a8..740bdb63cc 100644
--- a/internal/policy/viewer_resolver.go
+++ b/internal/policy/viewer_resolver.go
@@ -195,6 +195,7 @@ func (r *ViewerResolver) ResolveFacts(ctx context.Context, input access.ResolveI
 		PreferredMetadataLanguage:  decision.PreferredMetadataLanguage,
 		MetadataLanguageOverrides:  preferences.MetadataLanguageOverrides,
 		NextUpMode:                 preferences.NextUpMode,
+		NextUpNewReleasesFirst:     preferences.NextUpNewReleasesFirst,
 		PreferencesDegraded:        preferences.Degraded,
 		PolicyRevision:             user.AccessPolicyRevision,
 		// The policy output is tighten-only (merged_profile_verified), so a
diff --git a/internal/proxy/capability_snapshot_test.go b/internal/proxy/capability_snapshot_test.go
index 35d8d1038c..3358d1a057 100644
--- a/internal/proxy/capability_snapshot_test.go
+++ b/internal/proxy/capability_snapshot_test.go
@@ -12,6 +12,7 @@ import (
 	"testing"
 
 	"github.com/prairie-server/prairie-server/internal/config"
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 	"github.com/prairie-server/prairie-server/internal/nodeconfig"
 	"github.com/prairie-server/prairie-server/internal/playback"
 )
@@ -62,7 +63,7 @@ func TestProxyCapabilitiesPublishCapabilityHash(t *testing.T) {
 	server := newCapabilityProxyServer(t, secret)
 
 	request := httptest.NewRequest(http.MethodGet, "/hw-capabilities", nil)
-	request.Header.Set("Authorization", "Bearer "+secret)
+	nodeauthtest.Sign(t, request, secret)
 	recorder := httptest.NewRecorder()
 	server.Handler().ServeHTTP(recorder, request)
 
@@ -106,7 +107,7 @@ func TestProxyCapabilitiesRejectsIncompleteProbeWithoutPublishing(t *testing.T)
 	canceled, cancel := context.WithCancel(context.Background())
 	cancel()
 	request := httptest.NewRequest(http.MethodGet, "/hw-capabilities", nil).WithContext(canceled)
-	request.Header.Set("Authorization", "Bearer "+secret)
+	nodeauthtest.Sign(t, request, secret)
 	recorder := httptest.NewRecorder()
 	server.Handler().ServeHTTP(recorder, request)
 
@@ -190,7 +191,7 @@ func newCapabilityProxyServerRecordingFFmpeg(t *testing.T, secret string, aacAva
 func fetchProxyCapabilities(t *testing.T, server *Server, secret string) playback.HWAccelInfo {
 	t.Helper()
 	request := httptest.NewRequest(http.MethodGet, "/hw-capabilities", nil)
-	request.Header.Set("Authorization", "Bearer "+secret)
+	nodeauthtest.Sign(t, request, secret)
 	recorder := httptest.NewRecorder()
 	server.Handler().ServeHTTP(recorder, request)
 	if recorder.Code != http.StatusOK {
diff --git a/internal/proxy/download_protocol_test.go b/internal/proxy/download_protocol_test.go
index 67340ab2b5..74c561a9d0 100644
--- a/internal/proxy/download_protocol_test.go
+++ b/internal/proxy/download_protocol_test.go
@@ -8,6 +8,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 	"github.com/prairie-server/prairie-server/internal/streamtoken"
 )
 
@@ -24,7 +25,7 @@ func TestDownloadProtocolRemoteStatusAndHead(t *testing.T) {
 	} {
 		t.Run(tc.method+strconv.Itoa(tc.origin), func(t *testing.T) {
 			origin := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				if r.Method != tc.method || r.Header.Get("Authorization") != "Bearer "+secret || r.Header.Get("If-Match") != "fixture" {
+				if r.Method != tc.method || !nodeauthtest.Signed(r, secret) || r.Header.Get("If-Match") != "fixture" {
 					t.Error("origin request changed")
 				}
 				w.Header().Set("Content-Type", "application/x-worker-fixture")
diff --git a/internal/proxy/download_test.go b/internal/proxy/download_test.go
index 896079a762..6ad5f19269 100644
--- a/internal/proxy/download_test.go
+++ b/internal/proxy/download_test.go
@@ -13,6 +13,7 @@ import (
 
 	"github.com/prairie-server/prairie-server/internal/config"
 	"github.com/prairie-server/prairie-server/internal/downloadprepare"
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 	"github.com/prairie-server/prairie-server/internal/nodeconfig"
 	"github.com/prairie-server/prairie-server/internal/streamtoken"
 )
@@ -82,8 +83,8 @@ func TestProxyDownloadRelaysNodeLocalArtifactRange(t *testing.T) {
 			http.Error(w, "unexpected path", http.StatusBadRequest)
 			return
 		}
-		if auth := r.Header.Get("Authorization"); auth != "Bearer "+secret {
-			t.Errorf("origin Authorization = %q", auth)
+		if !nodeauthtest.Signed(r, secret) {
+			t.Errorf("origin request is not signed: Authorization = %q", r.Header.Get("Authorization"))
 			http.Error(w, "unexpected authorization", http.StatusBadRequest)
 			return
 		}
diff --git a/internal/proxy/mediagrant_test.go b/internal/proxy/mediagrant_test.go
index 3b43cb8629..efb4f74824 100644
--- a/internal/proxy/mediagrant_test.go
+++ b/internal/proxy/mediagrant_test.go
@@ -14,6 +14,7 @@ import (
 	"github.com/prairie-server/prairie-server/internal/auth"
 	"github.com/prairie-server/prairie-server/internal/config"
 	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 	"github.com/prairie-server/prairie-server/internal/nodeconfig"
 	"github.com/prairie-server/prairie-server/internal/noderouting"
 	"github.com/prairie-server/prairie-server/internal/nodesessions"
@@ -268,10 +269,11 @@ func TestProxyGrantRoutesEnforceCommittedProxyEgress(t *testing.T) {
 // A transcode grant is relayed to the node exactly like the token route, with
 // the node-facing token minted here — never handed to the client.
 func TestProxyGrantTranscodeRelaysToTheNodeWithAProxyMintedToken(t *testing.T) {
-	var forwarded, authorization, relayPath string
+	var forwarded, relayPath string
+	var signed bool
 	node := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		forwarded = r.Header.Get("X-Prairie-Stream-Token")
-		authorization = r.Header.Get("Authorization")
+		signed = nodeauthtest.Signed(r, grantTestSecret)
 		relayPath = r.URL.Path
 		w.Header().Set("Content-Type", "application/vnd.apple.mpegurl")
 		_, _ = w.Write([]byte("#EXTM3U\nsegment/seg_00001.m4s\n"))
@@ -299,8 +301,8 @@ func TestProxyGrantTranscodeRelaysToTheNodeWithAProxyMintedToken(t *testing.T) {
 	if relayPath != "/transcode/session-hls-plan-a/master.m3u8" {
 		t.Fatalf("relay path = %q, want the plan-scoped transport manifest", relayPath)
 	}
-	if authorization != "Bearer "+grantTestSecret {
-		t.Fatalf("node authorization = %q", authorization)
+	if !signed {
+		t.Fatal("node request was not signed with the shared secret")
 	}
 	claims, err := streamtoken.Verify(forwarded, grantTestSecret)
 	if err != nil {
diff --git a/internal/proxy/network_access_test.go b/internal/proxy/network_access_test.go
index 771b55e0e2..9785b8107e 100644
--- a/internal/proxy/network_access_test.go
+++ b/internal/proxy/network_access_test.go
@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"github.com/prairie-server/prairie-server/internal/netaccess"
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 )
 
 // fakeProviderHost stands in for the plugin service: one provider, "stub",
@@ -68,7 +69,7 @@ func networkAccessRequest(t *testing.T, server *Server, method, path, secret str
 	t.Helper()
 	request := httptest.NewRequest(method, path, nil)
 	if secret != "" {
-		request.Header.Set("Authorization", "Bearer "+secret)
+		nodeauthtest.Sign(t, request, secret)
 	}
 	recorder := httptest.NewRecorder()
 	server.Handler().ServeHTTP(recorder, request)
@@ -216,7 +217,7 @@ func TestProxyNetworkAccessProviderStatusDoesNotWaitForOtherProviders(t *testing
 	go func() {
 		defer close(slowDone)
 		request := httptest.NewRequest(http.MethodGet, "/network-access/slow/status", nil).WithContext(ctx)
-		request.Header.Set("Authorization", "Bearer "+secret)
+		nodeauthtest.Sign(t, request, secret)
 		router.ServeHTTP(httptest.NewRecorder(), request)
 	}()
 	select {
@@ -225,7 +226,7 @@ func TestProxyNetworkAccessProviderStatusDoesNotWaitForOtherProviders(t *testing
 		t.Fatal("slow provider status was not requested")
 	}
 	request := httptest.NewRequest(http.MethodGet, "/network-access/stub/status", nil)
-	request.Header.Set("Authorization", "Bearer "+secret)
+	nodeauthtest.Sign(t, request, secret)
 	recorder := httptest.NewRecorder()
 	router.ServeHTTP(recorder, request)
 	if recorder.Code != http.StatusOK {
diff --git a/internal/proxy/node_auth_test.go b/internal/proxy/node_auth_test.go
new file mode 100644
index 0000000000..c8a004ea36
--- /dev/null
+++ b/internal/proxy/node_auth_test.go
@@ -0,0 +1,42 @@
+package proxy
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
+)
+
+// The proxy's admin routes admit only signed requests, plus the previous
+// release's bearer while a deployment upgrades.
+func TestProxyAdminRoutesRequireASignature(t *testing.T) {
+	const secret = "proxy-admin-secret"
+	server := newCapabilityProxyServer(t, secret)
+	status := func(r *http.Request) int {
+		recorder := httptest.NewRecorder()
+		server.Handler().ServeHTTP(recorder, r)
+		return recorder.Code
+	}
+
+	signed := httptest.NewRequest(http.MethodGet, "/status", nil)
+	nodeauthtest.Sign(t, signed, secret)
+	if code := status(signed); code != http.StatusOK {
+		t.Fatalf("signed request: status %d, want 200", code)
+	}
+	if code := status(httptest.NewRequest(http.MethodGet, "/status", nil)); code != http.StatusUnauthorized {
+		t.Fatalf("unsigned request: status %d, want 401", code)
+	}
+	wrong := httptest.NewRequest(http.MethodGet, "/status", nil)
+	wrong.Header.Set("Authorization", "Bearer not-the-secret")
+	if code := status(wrong); code != http.StatusUnauthorized {
+		t.Fatalf("wrong bearer: status %d, want 401", code)
+	}
+
+	// Remove with the legacy bearer in nodeauth.Verify.
+	legacy := httptest.NewRequest(http.MethodGet, "/status", nil)
+	legacy.Header.Set("Authorization", "Bearer "+secret)
+	if code := status(legacy); code != http.StatusOK {
+		t.Fatalf("legacy bearer during the upgrade window: status %d, want 200", code)
+	}
+}
diff --git a/internal/proxy/reprobe_test.go b/internal/proxy/reprobe_test.go
index 3e11fa7759..ba0186296e 100644
--- a/internal/proxy/reprobe_test.go
+++ b/internal/proxy/reprobe_test.go
@@ -6,6 +6,8 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 )
 
 // A proxy runs ffmpeg for remux recipes, so it gets the same escape hatch a
@@ -19,7 +21,7 @@ func TestProxyReprobeCapabilitiesRecomputesAndStoresHash(t *testing.T) {
 	server.storeCapabilityHash("sha256:stale")
 
 	request := httptest.NewRequest(http.MethodPost, "/admin/reprobe-capabilities", nil)
-	request.Header.Set("Authorization", "Bearer "+secret)
+	nodeauthtest.Sign(t, request, secret)
 	recorder := httptest.NewRecorder()
 	server.Handler().ServeHTTP(recorder, request)
 
@@ -52,7 +54,7 @@ func TestProxyReprobeCapabilitiesKeepsHashOnIncompleteProbe(t *testing.T) {
 	canceled, cancel := context.WithCancel(context.Background())
 	cancel()
 	request := httptest.NewRequest(http.MethodPost, "/admin/reprobe-capabilities", nil).WithContext(canceled)
-	request.Header.Set("Authorization", "Bearer "+secret)
+	nodeauthtest.Sign(t, request, secret)
 	recorder := httptest.NewRecorder()
 	server.Handler().ServeHTTP(recorder, request)
 
@@ -87,7 +89,7 @@ func TestProxyReprobeCapabilitiesRefusedWhileProbesAreRunning(t *testing.T) {
 	server.countProbesInFlight = func() int { return 1 }
 
 	request := httptest.NewRequest(http.MethodPost, "/admin/reprobe-capabilities", nil)
-	request.Header.Set("Authorization", "Bearer "+secret)
+	nodeauthtest.Sign(t, request, secret)
 	recorder := httptest.NewRecorder()
 	server.Handler().ServeHTTP(recorder, request)
 
diff --git a/internal/api/handlers/transcode_segment_head_test.go b/internal/proxy/segment_head_test.go
similarity index 58%
rename from internal/api/handlers/transcode_segment_head_test.go
rename to internal/proxy/segment_head_test.go
index caf29da8db..566c00376d 100644
--- a/internal/api/handlers/transcode_segment_head_test.go
+++ b/internal/proxy/segment_head_test.go
@@ -1,32 +1,31 @@
-package handlers
+package proxy
 
 import (
 	"net/http"
 	"net/http/httptest"
 	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/streamtoken"
 )
 
-// A HEAD probe must not drag the segment body across the node boundary. The
-// proxy used to hardcode GET upstream, so an existence check pulled a whole
-// multi-megabyte segment only for net/http to discard it on the way out.
+// A HEAD probe must not drag the segment body across the node boundary: the
+// proxy forwards the request method rather than hardcoding GET upstream.
 func TestProxyToTranscodeNodeForwardsRequestMethod(t *testing.T) {
 	for _, method := range []string{http.MethodGet, http.MethodHead} {
 		t.Run(method, func(t *testing.T) {
 			var upstreamMethod string
-			var upstreamBodyWritten int
 			node := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 				upstreamMethod = r.Method
 				w.Header().Set("Content-Type", "video/iso.segment")
-				n, _ := w.Write([]byte("segment-bytes"))
-				upstreamBodyWritten = n
+				_, _ = w.Write([]byte("segment-bytes"))
 			}))
 			defer node.Close()
 
-			h := &PlaybackHandler{}
+			server := newCompletionTestProxy(node.Client())
+			claims := &streamtoken.Claims{SessionID: "public", TranscodeNode: node.URL}
 			rec := httptest.NewRecorder()
-			req := httptest.NewRequest(method, "/api/v1/playback/transcode/s1/segment/seg_00000.m4s", nil)
-
-			h.proxyToTranscodeNode(rec, req, node.URL, "/transcode/s1/segment/seg_00000.m4s")
+			req := httptest.NewRequest(method, "/stream/transcode/token/segment/seg_00000.m4s", nil)
+			server.proxyToTranscodeNode(rec, req, claims, "/transcode/s1/segment/seg_00000.m4s", "")
 
 			if upstreamMethod != method {
 				t.Errorf("upstream method = %q, want %q", upstreamMethod, method)
@@ -34,11 +33,6 @@ func TestProxyToTranscodeNodeForwardsRequestMethod(t *testing.T) {
 			if rec.Code != http.StatusOK {
 				t.Errorf("status = %d, want 200", rec.Code)
 			}
-			if method == http.MethodHead && upstreamBodyWritten != 0 {
-				// The node's own server suppresses the body for HEAD; what matters
-				// here is that we asked for HEAD rather than GET.
-				t.Logf("node reported %d body bytes for HEAD", upstreamBodyWritten)
-			}
 		})
 	}
 }
@@ -55,11 +49,11 @@ func TestProxyToTranscodeNodePassesThroughMethodNotAllowed(t *testing.T) {
 	}))
 	defer node.Close()
 
-	h := &PlaybackHandler{}
+	server := newCompletionTestProxy(node.Client())
+	claims := &streamtoken.Claims{SessionID: "public", TranscodeNode: node.URL}
 	rec := httptest.NewRecorder()
-	req := httptest.NewRequest(http.MethodHead, "/api/v1/playback/transcode/s1/segment/seg_00000.m4s", nil)
-
-	h.proxyToTranscodeNode(rec, req, node.URL, "/transcode/s1/segment/seg_00000.m4s")
+	req := httptest.NewRequest(http.MethodHead, "/stream/transcode/token/segment/seg_00000.m4s", nil)
+	server.proxyToTranscodeNode(rec, req, claims, "/transcode/s1/segment/seg_00000.m4s", "")
 
 	if rec.Code != http.StatusMethodNotAllowed {
 		t.Fatalf("status = %d, want 405 passed through", rec.Code)
diff --git a/internal/proxy/server.go b/internal/proxy/server.go
index b0c403a4d4..a4a6a5a0cb 100644
--- a/internal/proxy/server.go
+++ b/internal/proxy/server.go
@@ -29,6 +29,7 @@ import (
 	"github.com/prairie-server/prairie-server/internal/downloads"
 	"github.com/prairie-server/prairie-server/internal/httpstream"
 	"github.com/prairie-server/prairie-server/internal/netaccess"
+	"github.com/prairie-server/prairie-server/internal/nodeauth"
 	"github.com/prairie-server/prairie-server/internal/nodeconfig"
 	"github.com/prairie-server/prairie-server/internal/nodemetrics"
 	"github.com/prairie-server/prairie-server/internal/noderouting"
@@ -99,7 +100,7 @@ type Server struct {
 	// (SetNetworkAccessStatus), which leaves the health field absent — the same
 	// as a build that predates it.
 	networkAccess NetworkAccessStatusSource
-	// networkAccessHost drives the provider instances for the bearer
+	// networkAccessHost drives the provider instances for the signed
 	// network-access routes; nil answers 503 there. See network_access.go.
 	networkAccessHost NetworkAccessProviderHost
 	// ingressTokens validates the X-Prairie-Ingress-Token a provider plugin
@@ -265,7 +266,7 @@ func (s *Server) router() chi.Router {
 		MaxAge: 86400,
 	}))
 	r.Get("/api/v1/health", s.handleHealth)
-	// Unauthenticated, matching the API listener's own /metrics posture: a
+	// Unauthenticated, matching the main server's dedicated metrics listener: a
 	// scrape target that needs a credential is a scrape target that goes
 	// unmonitored, and the exposure is host resource counters, not media.
 	r.Method(http.MethodGet, "/metrics", promhttp.Handler())
@@ -297,7 +298,7 @@ func (s *Server) router() chi.Router {
 		r.Get("/downloads/file/{token}", observeProxy(s.telemetry, http.MethodGet, "/downloads/file/{token}", s.handleDownloadFile))
 	})
 
-	// Admin routes — bearer-auth protected.
+	// Admin routes — callers must sign each request (nodeauth).
 	r.Group(func(r chi.Router) {
 		r.Use(s.requireBearer)
 		r.Get("/hw-capabilities", s.handleHWCapabilities)
@@ -306,7 +307,7 @@ func (s *Server) router() chi.Router {
 		r.Post("/admin/reprobe-capabilities", s.handleReprobeCapabilities)
 		r.Get("/status", s.handleStatus)
 		// Network access providers running beside this proxy; the API fans its
-		// admin status/connect/disconnect out to these with the node bearer.
+		// admin status/connect/disconnect out to these with signed requests.
 		r.Get("/network-access/status", s.handleNetworkAccessStatus)
 		r.Get("/network-access/{provider}/status", s.handleNetworkAccessProviderStatus)
 		r.Post("/network-access/{provider}/connect", s.handleNetworkAccessConnect)
@@ -560,13 +561,14 @@ func (s *Server) StartMetricsSampler(ctx context.Context) {
 	s.metrics.Start(ctx)
 }
 
-// requireBearer checks Authorization: Bearer {secret} for admin endpoints.
+// requireBearer admits only API servers to the admin endpoints: it checks the
+// request's node signature (see nodeauth). The name predates signing and is
+// kept because the route inventory classifies by it.
 func (s *Server) requireBearer(next http.Handler) http.Handler {
 	next = telemetry.TrustedHTTPHandler("worker", next)
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		cfg := s.watcher.Config()
-		auth := r.Header.Get("Authorization")
-		if !strings.HasPrefix(auth, "Bearer ") || strings.TrimPrefix(auth, "Bearer ") != cfg.Auth.JWTSecret {
+		if nodeauth.Verify(r, cfg.Auth.JWTSecret) != nil {
 			http.Error(w, "unauthorized", http.StatusUnauthorized)
 			return
 		}
@@ -1159,7 +1161,10 @@ func (s *Server) proxyToTranscodeNode(w http.ResponseWriter, r *http.Request, cl
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
-	req.Header.Set("Authorization", "Bearer "+cfg.Auth.JWTSecret)
+	if err := nodeauth.Sign(req, claims.TranscodeNode, cfg.Auth.JWTSecret); err != nil {
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
 	if isSegmentRoute {
 		transcodeproxy.PrepareRequest(req, r)
 	}
@@ -1189,7 +1194,7 @@ func (s *Server) proxyToTranscodeNode(w http.ResponseWriter, r *http.Request, cl
 	}
 	if isMediaSegment && generation != "" && r.Method == http.MethodGet &&
 		sw.CompletedFullResponse(transcodeproxy.FullRepresentationSize(resp)) {
-		if ackErr := transcodeproxy.Acknowledge(r.Context(), s.httpClient, claims.TranscodeNode+path, cfg.Auth.JWTSecret, generation); ackErr != nil {
+		if ackErr := transcodeproxy.Acknowledge(r.Context(), s.httpClient, claims.TranscodeNode, path, cfg.Auth.JWTSecret, generation); ackErr != nil {
 			slog.WarnContext(r.Context(), "acknowledge transcode segment completion", "component", "proxy", "error", ackErr, "playback_session_id", claims.SessionID)
 		}
 	}
diff --git a/internal/proxy/streaming_protocol_test.go b/internal/proxy/streaming_protocol_test.go
index d422a5b50f..3348c11df5 100644
--- a/internal/proxy/streaming_protocol_test.go
+++ b/internal/proxy/streaming_protocol_test.go
@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"github.com/prairie-server/prairie-server/internal/clientip"
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 	"github.com/prairie-server/prairie-server/internal/streamtoken"
 	"github.com/prairie-server/prairie-server/internal/transcodeproxy"
 )
@@ -22,7 +23,7 @@ func TestStreamingProtocolOriginResponses(t *testing.T) {
 	} {
 		t.Run(tc.method+tc.suffix, func(t *testing.T) {
 			origin := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				if r.Method != tc.method || r.URL.Path != "/transcode/transport/"+tc.suffix || r.URL.RawQuery != "opaque=1" || r.Header.Get("Authorization") != "Bearer "+secret || r.Header.Get("X-Prairie-Stream-Token") == "" {
+				if r.Method != tc.method || r.URL.Path != "/transcode/transport/"+tc.suffix || r.URL.RawQuery != "opaque=1" || !nodeauthtest.Signed(r, secret) || r.Header.Get("X-Prairie-Stream-Token") == "" {
 					t.Error("relay identity/query lost")
 				}
 				segment := strings.HasPrefix(tc.suffix, "segment/")
diff --git a/internal/proxy/theme_audio_test.go b/internal/proxy/theme_audio_test.go
index 8a922e2df5..f45241914d 100644
--- a/internal/proxy/theme_audio_test.go
+++ b/internal/proxy/theme_audio_test.go
@@ -5,10 +5,10 @@ import (
 	"net/http/httptest"
 	"os"
 	"path/filepath"
-	"strings"
 	"testing"
 	"time"
 
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 	"github.com/prairie-server/prairie-server/internal/noderouting"
 	"github.com/prairie-server/prairie-server/internal/playback"
 	"github.com/prairie-server/prairie-server/internal/streamtoken"
@@ -115,8 +115,10 @@ func TestThemeConversionHeadAndRelay(t *testing.T) {
 	const secret = "proxy-theme-relay-secret"
 	path, size, modified := writeThemeAudio(t)
 	var relayed *http.Request
+	var relayedSigned bool
 	node := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		relayed = r.Clone(r.Context())
+		relayedSigned = nodeauthtest.Signed(r, secret)
 		w.Header().Set("Content-Type", playback.AudioOnlyRemuxMIMEV3)
 		_, _ = w.Write([]byte("converted"))
 	}))
@@ -152,7 +154,7 @@ func TestThemeConversionHeadAndRelay(t *testing.T) {
 		t.Fatalf("relayed conversion = %d %q", got.status, got.body)
 	}
 	if relayed == nil || relayed.URL.Path != "/remux/theme-transport" || relayed.URL.Query().Get("seek") != "4" ||
-		relayed.Header.Get("X-Prairie-Stream-Token") != relayToken || !strings.HasPrefix(relayed.Header.Get("Authorization"), "Bearer ") {
+		relayed.Header.Get("X-Prairie-Stream-Token") != relayToken || !relayedSigned {
 		t.Fatalf("relayed request = %+v", relayed)
 	}
 
diff --git a/internal/ratelimit/memory.go b/internal/ratelimit/memory.go
index f043c6a8e4..5180adb19c 100644
--- a/internal/ratelimit/memory.go
+++ b/internal/ratelimit/memory.go
@@ -38,8 +38,11 @@ func NewMemoryLimiter() *MemoryLimiter {
 }
 
 func (ml *MemoryLimiter) Allow(_ context.Context, key string, limit Rate) AllowResult {
+	return ml.allowAt(key, limit, time.Now())
+}
+
+func (ml *MemoryLimiter) allowAt(key string, limit Rate, now time.Time) AllowResult {
 	entry := ml.getOrCreate(key, limit)
-	now := time.Now()
 	entry.touch()
 
 	// Check per-second limiter via Reserve
@@ -55,12 +58,23 @@ func (ml *MemoryLimiter) Allow(_ context.Context, key string, limit Rate) AllowR
 	}
 	if delay := secRes.DelayFrom(now); delay > 0 {
 		secRes.CancelAt(now)
+		resetAt := now.Add(time.Second).Truncate(time.Second)
+		// An empty per-minute bucket would refuse the retry too, so wait for both.
+		if minDelay := tokenDelay(entry.perMinute, now); minDelay > delay {
+			delay = minDelay
+			// Round up: X-RateLimit-Reset carries whole seconds. Rounding the
+			// time, not the delay, keeps a saturated delay from overflowing.
+			resetAt = now.Add(delay)
+			if whole := resetAt.Truncate(time.Second); whole.Before(resetAt) {
+				resetAt = whole.Add(time.Second)
+			}
+		}
 		return AllowResult{
 			Allowed:    false,
 			RetryAfter: delay,
 			Limit:      int(limit.RequestsPerSecond),
 			Remaining:  0,
-			ResetAt:    now.Add(time.Second).Truncate(time.Second),
+			ResetAt:    resetAt,
 		}
 	}
 
@@ -97,6 +111,21 @@ func (ml *MemoryLimiter) Allow(_ context.Context, key string, limit Rate) AllowR
 	}
 }
 
+// tokenDelay returns how long lim needs to hold a whole token at t, without
+// taking one.
+func tokenDelay(lim *rate.Limiter, t time.Time) time.Duration {
+	missing := 1 - lim.TokensAt(t)
+	perSecond := float64(lim.Limit())
+	if missing <= 0 || perSecond <= 0 {
+		return 0
+	}
+	delay := math.Ceil(missing / perSecond * float64(time.Second))
+	if delay >= float64(math.MaxInt64) {
+		return rate.InfDuration
+	}
+	return time.Duration(delay)
+}
+
 func (ml *MemoryLimiter) getOrCreate(key string, limit Rate) *memoryEntry {
 	if val, ok := ml.entries.Load(key); ok {
 		entry, ok := val.(*memoryEntry)
diff --git a/internal/ratelimit/memory_test.go b/internal/ratelimit/memory_test.go
new file mode 100644
index 0000000000..ddadb9f24f
--- /dev/null
+++ b/internal/ratelimit/memory_test.go
@@ -0,0 +1,101 @@
+package ratelimit
+
+import (
+	"testing"
+	"time"
+
+	"golang.org/x/time/rate"
+)
+
+func TestMemoryLimiterRetryAfterCoversEmptyMinuteBucket(t *testing.T) {
+	ml := NewMemoryLimiter()
+	t.Cleanup(ml.Close)
+
+	limit := Rate{RequestsPerSecond: 1, RequestsPerMinute: 2, Burst: 2}
+	now := time.Unix(1_800_000_000, 0)
+
+	for i := range 2 {
+		if res := ml.allowAt("client", limit, now); !res.Allowed {
+			t.Fatalf("request %d refused, want allowed", i+1)
+		}
+	}
+
+	// Both buckets are now empty. Refuse a few retries at the same instant to
+	// show a refused request takes no tokens.
+	var refused AllowResult
+	for range 3 {
+		refused = ml.allowAt("client", limit, now)
+		if refused.Allowed {
+			t.Fatal("request allowed with both buckets empty")
+		}
+	}
+	if refused.RetryAfter < 30*time.Second {
+		t.Fatalf("retry after = %s, want at least the minute bucket's 30s", refused.RetryAfter)
+	}
+	if res := ml.allowAt("client", limit, now.Add(refused.RetryAfter)); !res.Allowed {
+		t.Fatalf("request after retry after refused again with retry after %s", res.RetryAfter)
+	}
+
+	// X-RateLimit-Reset carries whole seconds; a client waiting for it from
+	// mid-second must get through too.
+	ml.Clear()
+	now = now.Add(400 * time.Millisecond)
+	for range 3 {
+		refused = ml.allowAt("client", limit, now)
+	}
+	if refused.Allowed {
+		t.Fatal("request allowed with both buckets empty")
+	}
+	reset := time.Unix(refused.ResetAt.Unix(), 0)
+	if reset.Before(now.Add(refused.RetryAfter)) {
+		t.Fatalf("reset at %s is before %s", reset, now.Add(refused.RetryAfter))
+	}
+	if res := ml.allowAt("client", limit, reset); !res.Allowed {
+		t.Fatalf("request at reset refused again with retry after %s", res.RetryAfter)
+	}
+}
+
+func TestMemoryLimiterRetryAfterKeepsSecondWaitWhenMinuteHasRoom(t *testing.T) {
+	ml := NewMemoryLimiter()
+	t.Cleanup(ml.Close)
+
+	limit := Rate{RequestsPerSecond: 1, RequestsPerMinute: 60, Burst: 1}
+	now := time.Unix(1_800_000_000, 0)
+
+	if res := ml.allowAt("client", limit, now); !res.Allowed {
+		t.Fatal("first request refused, want allowed")
+	}
+	refused := ml.allowAt("client", limit, now)
+	if refused.Allowed {
+		t.Fatal("second request allowed, want refused by the per-second bucket")
+	}
+	if refused.RetryAfter != time.Second {
+		t.Fatalf("retry after = %s, want 1s", refused.RetryAfter)
+	}
+	if res := ml.allowAt("client", limit, now.Add(refused.RetryAfter)); !res.Allowed {
+		t.Fatalf("request after retry after refused again with retry after %s", res.RetryAfter)
+	}
+}
+
+func TestMemoryLimiterRetryAfterSaturatesForTinyMinuteRate(t *testing.T) {
+	ml := NewMemoryLimiter()
+	t.Cleanup(ml.Close)
+
+	// A minute bucket this slow needs longer than a Duration can hold.
+	limit := Rate{RequestsPerSecond: 1, RequestsPerMinute: 1e-12, Burst: 1}
+	now := time.Unix(1_800_000_000, 0).Add(400 * time.Millisecond)
+
+	if res := ml.allowAt("client", limit, now); !res.Allowed {
+		t.Fatal("first request refused, want allowed")
+	}
+	refused := ml.allowAt("client", limit, now)
+	if refused.Allowed {
+		t.Fatal("second request allowed, want refused")
+	}
+	if refused.RetryAfter != rate.InfDuration {
+		t.Fatalf("retry after = %s, want rate.InfDuration", refused.RetryAfter)
+	}
+	if refused.ResetAt.Before(now) {
+		t.Fatalf("reset at %s is before now %s", refused.ResetAt, now)
+	}
+}
diff --git a/internal/ratelimit/middleware.go b/internal/ratelimit/middleware.go
index b6f6c283e9..038e7b09e9 100644
--- a/internal/ratelimit/middleware.go
+++ b/internal/ratelimit/middleware.go
@@ -130,15 +130,11 @@ func (mw *Middleware) handler(next http.Handler, reject RejectBodyWriter) http.H
 			return
 		}
 
-		// Check global limiter (per-second only — spec says no per-minute global limit).
-		// Setting RequestsPerMinute = RPS*60 makes the per-minute limiter a mathematical
-		// no-op: it never triggers before the per-second limiter does.
-		globalRate := globalRateFor(cfg)
-		globalResult := mw.global.Allow(r.Context(), "global", globalRate)
-		if !globalResult.Allowed {
-			writeRateLimitResponse(w, globalResult, reject)
-			return
-		}
+		// The narrower per-IP and per-key budgets run before the shared
+		// global one, as in AuthEndpointHandler, so a client over its own
+		// limit cannot spend server-wide capacity and get unrelated clients
+		// rejected. A request the global check then rejects keeps the
+		// narrower tokens it spent; that only charges the client that sent it.
 
 		// Check per-IP limiter
 		if clientIP := clientip.FromContext(r.Context()); clientIP != "" {
@@ -185,6 +181,15 @@ func (mw *Middleware) handler(next http.Handler, reject RejectBodyWriter) http.H
 			}
 		}
 
+		// Check global limiter (per-second only — spec says no per-minute global limit).
+		// Setting RequestsPerMinute = RPS*60 makes the per-minute limiter a mathematical
+		// no-op: it never triggers before the per-second limiter does.
+		globalResult := mw.global.Allow(r.Context(), "global", globalRateFor(cfg))
+		if !globalResult.Allowed {
+			writeRateLimitResponse(w, globalResult, reject)
+			return
+		}
+
 		next.ServeHTTP(w, r)
 	})
 }
diff --git a/internal/ratelimit/middleware_test.go b/internal/ratelimit/middleware_test.go
index aad3d87292..1c851307ea 100644
--- a/internal/ratelimit/middleware_test.go
+++ b/internal/ratelimit/middleware_test.go
@@ -8,7 +8,10 @@ import (
 	"testing"
 	"time"
 
+	"github.com/prairie-server/prairie-server/internal/auth"
 	"github.com/prairie-server/prairie-server/internal/clientip"
+
+	apimw "github.com/prairie-server/prairie-server/internal/api/middleware"
 )
 
 type recordingLimiter struct {
@@ -81,6 +84,92 @@ func TestAuthEndpointHandlerDoesNotConsumeGlobalBudgetForRejectedClient(t *testi
 	}
 }
 
+// A client over its own per-IP limit must not drain the shared global budget:
+// with a two-request global burst and a one-request per-IP burst, client A's
+// rejected retries used to spend the global tokens and get client B rejected.
+// The custom writer covers the Jellyfin listener, which shares this limiter.
+func TestHandlerRejectedClientDoesNotDrainGlobalBudget(t *testing.T) {
+	writers := map[string]func(*Middleware) func(http.Handler) http.Handler{
+		"native": func(mw *Middleware) func(http.Handler) http.Handler { return mw.Handler },
+		"custom reject body": func(mw *Middleware) func(http.Handler) http.Handler {
+			return mw.HandlerWithRejectBody(func(w http.ResponseWriter, _ int) {
+				w.WriteHeader(http.StatusTooManyRequests)
+			})
+		},
+	}
+	for name, wrap := range writers {
+		t.Run(name, func(t *testing.T) {
+			perKey := NewMemoryLimiter()
+			t.Cleanup(perKey.Close)
+			global := NewMemoryLimiter()
+			t.Cleanup(global.Close)
+			mw := NewMiddleware(perKey, global, nil, true)
+			cfg := DefaultConfig()
+			cfg.GlobalReqPerSecond = 2 // burst of 2, refills one token every 500ms
+			cfg.IPReqPerSecond = 0.001
+			cfg.IPReqPerMinute = 0.06
+			cfg.IPBurst = 1
+			mw.cfg = cfg
+
+			served := map[string]int{}
+			handler := wrap(mw)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				served[clientip.FromContext(r.Context())]++
+				w.WriteHeader(http.StatusNoContent)
+			}))
+			send := func(ip string) int {
+				req := httptest.NewRequest(http.MethodGet, "/api/v1/items", nil)
+				req = req.WithContext(clientip.SetContext(req.Context(), ip))
+				rec := httptest.NewRecorder()
+				handler.ServeHTTP(rec, req)
+				return rec.Code
+			}
+
+			const clientA, clientB = "203.0.113.10", "203.0.113.20"
+			if code := send(clientA); code != http.StatusNoContent {
+				t.Fatalf("client A first request = %d, want 204", code)
+			}
+			for i := range 5 {
+				if code := send(clientA); code != http.StatusTooManyRequests {
+					t.Fatalf("client A retry %d = %d, want 429", i, code)
+				}
+			}
+			if code := send(clientB); code != http.StatusNoContent {
+				t.Fatalf("client B = %d, want 204: client A's rejected requests drained the global budget", code)
+			}
+			if served[clientA] != 1 || served[clientB] != 1 {
+				t.Fatalf("served = %#v, want one request each", served)
+			}
+		})
+	}
+}
+
+func TestHandlerDoesNotConsumeGlobalBudgetForRejectedClient(t *testing.T) {
+	for _, deniedKey := range []string{"ip:203.0.113.10", "key:7"} {
+		t.Run(deniedKey, func(t *testing.T) {
+			perKey := &recordingLimiter{denied: map[string]bool{deniedKey: true}}
+			global := &recordingLimiter{}
+			mw := NewMiddleware(perKey, global, nil, true)
+			mw.cfg = DefaultConfig()
+			handler := mw.Handler(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {
+				t.Fatal("next handler called for rejected request")
+			}))
+			req := httptest.NewRequest(http.MethodGet, "/api/v1/items", nil)
+			ctx := clientip.SetContext(req.Context(), "203.0.113.10")
+			ctx = apimw.SetClaims(ctx, &auth.Claims{TokenType: auth.TokenTypeAPIKey, APIKeyID: 7})
+			rec := httptest.NewRecorder()
+
+			handler.ServeHTTP(rec, req.WithContext(ctx))
+
+			if rec.Code != http.StatusTooManyRequests {
+				t.Fatalf("response = %d, want 429", rec.Code)
+			}
+			if len(global.keys) != 0 {
+				t.Fatalf("global limiter keys = %#v, want no consumed budget", global.keys)
+			}
+		})
+	}
+}
+
 func TestGlobalRateSupportsFractionalRequestsPerSecond(t *testing.T) {
 	rate := globalRateFor(Config{GlobalReqPerSecond: 0.5})
 	if rate.Burst != 1 {
diff --git a/internal/ratelimit/redis.go b/internal/ratelimit/redis.go
index b524ec5d2d..fe29db80e5 100644
--- a/internal/ratelimit/redis.go
+++ b/internal/ratelimit/redis.go
@@ -112,11 +112,7 @@ func (rl *RedisLimiter) Allow(ctx context.Context, key string, limit Rate) Allow
 	secTTL := time.Duration(result[5]) * time.Second
 
 	if !allowed {
-		// Determine which limit was hit for RetryAfter
-		retryAfter := secTTL
-		if secCount < secLimit && minCount >= minLimit {
-			retryAfter = time.Duration(60-(now.Unix()%60)) * time.Second
-		}
+		retryAfter := redisRetryAfter(now, minCount, minLimit, secTTL)
 		return AllowResult{
 			Allowed:    false,
 			RetryAfter: retryAfter,
@@ -142,6 +138,17 @@ func (rl *RedisLimiter) Allow(ctx context.Context, key string, limit Rate) Allow
 	}
 }
 
+// redisRetryAfter returns how long a refused request has to wait. Both window
+// keys roll over on wall-clock boundaries, so a full minute window outlasts the
+// second window and its remainder covers both; a client honoring Retry-After
+// is not refused again.
+func redisRetryAfter(now time.Time, minCount, minLimit int, secTTL time.Duration) time.Duration {
+	if minCount >= minLimit {
+		return time.Duration(60-(now.Unix()%60)) * time.Second
+	}
+	return secTTL
+}
+
 func (rl *RedisLimiter) Close() {
 	// Redis client lifecycle managed externally
 }
diff --git a/internal/ratelimit/redis_test.go b/internal/ratelimit/redis_test.go
index 473eda6024..9ecd7373c4 100644
--- a/internal/ratelimit/redis_test.go
+++ b/internal/ratelimit/redis_test.go
@@ -1,6 +1,14 @@
 package ratelimit
 
-import "testing"
+import (
+	"context"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/redis/go-redis/v9"
+)
 
 func TestRedisWindowLimitsHonorBurst(t *testing.T) {
 	sec, minute, effective := redisWindowLimits(Rate{
@@ -23,3 +31,78 @@ func TestRedisWindowLimitsKeepMinuteOnlyRatesUsable(t *testing.T) {
 		t.Fatalf("limits = (%d, %d), want burst 6 and minute 10", sec, minute)
 	}
 }
+
+func TestRedisRetryAfterWaitsForAFullMinuteWindow(t *testing.T) {
+	minuteStart := time.Unix(1_800_000_000-1_800_000_000%60, 0)
+	const secTTL = 2 * time.Second
+
+	tests := []struct {
+		name     string
+		second   int
+		minCount int
+		want     time.Duration
+	}{
+		{name: "minute window has room", second: 10, minCount: 20, want: secTTL},
+		{name: "minute window full", second: 10, minCount: 30, want: 50 * time.Second},
+		// The second key's cleanup TTL outlives the window; both roll over at the minute.
+		{name: "minute window full in its last second", second: 59, minCount: 30, want: time.Second},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			now := minuteStart.Add(time.Duration(tt.second) * time.Second)
+			got := redisRetryAfter(now, tt.minCount, 30, secTTL)
+			if got != tt.want {
+				t.Fatalf("retry after = %s, want %s", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestRedisLimiterRetryAfterWhenBothWindowsFull(t *testing.T) {
+	raw := os.Getenv("PRAIRIE_TEST_REDIS_URL")
+	if raw == "" {
+		t.Skip("PRAIRIE_TEST_REDIS_URL not set")
+	}
+	opts, err := redis.ParseURL(raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	client := redis.NewClient(opts)
+	t.Cleanup(func() { _ = client.Close() })
+
+	limiter := NewRedisLimiter(client)
+	// Burst 10, 10 a minute: one burst fills both windows in the same second.
+	rate := Rate{RequestsPerSecond: 10.0 / 60.0, RequestsPerMinute: 10, Burst: 10}
+	ctx := context.WithoutCancel(t.Context())
+
+	// A burst that crosses a minute boundary lands in two minute windows, so
+	// try again with a fresh key when that happens.
+	for attempt := 0; attempt < 3; attempt++ {
+		key := "test:" + uuid.NewString()
+		t.Cleanup(func() {
+			if keys, _ := client.Keys(ctx, "prairie:ratelimit:"+key+":*").Result(); len(keys) > 0 {
+				_ = client.Del(ctx, keys...).Err()
+			}
+		})
+		startMinute := time.Now().Unix() / 60
+		var refused AllowResult
+		for range rate.Burst + 1 {
+			if refused = limiter.Allow(ctx, key, rate); !refused.Allowed {
+				break
+			}
+		}
+		now := time.Now()
+		if now.Unix()/60 != startMinute {
+			continue
+		}
+		if refused.Allowed {
+			t.Fatal("limiter never refused a request")
+		}
+		untilMinute := time.Duration(60-now.Unix()%60) * time.Second
+		if refused.RetryAfter < untilMinute {
+			t.Fatalf("retry after = %s, want the minute window's remaining %s", refused.RetryAfter, untilMinute)
+		}
+		return
+	}
+	t.Fatal("every attempt crossed a minute boundary")
+}
diff --git a/internal/recommendations/access_postgres_test.go b/internal/recommendations/access_postgres_test.go
new file mode 100644
index 0000000000..108ecab719
--- /dev/null
+++ b/internal/recommendations/access_postgres_test.go
@@ -0,0 +1,431 @@
+package recommendations
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/access"
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/config"
+	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/userstore/pgstore"
+)
+
+// accessFixture is a catalog of two libraries: kids titles rated G and adult
+// titles rated R. Every title is an embedded movie near one axis, the adult
+// titles nearer the anchor than any kids title, so an unrestricted ranking
+// fills its first places with adult titles.
+type accessFixture struct {
+	anchor           string
+	kids, adults     []string
+	kidsLib, adultLb int
+	axis             int
+}
+
+func newAccessFixture(t *testing.T, pool *pgxpool.Pool, prefix string, axis int) accessFixture {
+	t.Helper()
+	ctx := t.Context()
+	cleanupRecoMediaItems(t, pool, prefix)
+	repo := NewRepo(pool)
+	f := accessFixture{anchor: prefix + "anchor", axis: axis}
+	folder := func(name string) int {
+		var id int
+		if err := pool.QueryRow(ctx, `INSERT INTO media_folders (type, name, enabled) VALUES ('movies', $1, true) RETURNING id`, prefix+name).Scan(&id); err != nil {
+			t.Fatalf("insert library: %v", err)
+		}
+		t.Cleanup(func() { _, _ = pool.Exec(context.Background(), `DELETE FROM media_folders WHERE id = $1`, id) })
+		return id
+	}
+	f.kidsLib, f.adultLb = folder("kids"), folder("adults")
+
+	seed := func(id string, library int, rating string, age int, distance float32) {
+		seedRecoMediaItem(t, pool, id, "movie", "matched")
+		if _, err := pool.Exec(ctx, `UPDATE media_items SET content_rating = $2, content_rating_age = $3, poster_path = '/poster.jpg' WHERE content_id = $1`, id, rating, age); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := pool.Exec(ctx, `INSERT INTO media_item_libraries (content_id, media_folder_id) VALUES ($1, $2)`, id, library); err != nil {
+			t.Fatal(err)
+		}
+		if err := repo.UpsertEmbedding(ctx, id, axisVector(axis, map[int]float32{axis + 1: distance}), "test-model", id); err != nil {
+			t.Fatal(err)
+		}
+	}
+	seed(f.anchor, f.kidsLib, "G", 0, 0)
+	for i := range 12 {
+		id := fmt.Sprintf("%sadult-%02d", prefix, i)
+		seed(id, f.adultLb, "R", 17, 0.01+float32(i)*0.001)
+		f.adults = append(f.adults, id)
+	}
+	for i := range 8 {
+		id := fmt.Sprintf("%skids-%02d", prefix, i)
+		seed(id, f.kidsLib, "G", 0, 0.2+float32(i)*0.01)
+		f.kids = append(f.kids, id)
+	}
+	return f
+}
+
+// prefixed keeps the IDs that belong to this test, whatever else the shared
+// test database holds.
+func prefixed(items []ScoredItem, prefix string) []string {
+	var ids []string
+	for _, item := range items {
+		if strings.HasPrefix(item.MediaItemID, prefix) {
+			ids = append(ids, item.MediaItemID)
+		}
+	}
+	return ids
+}
+
+// A restricted viewer's similar titles are chosen among the titles it can
+// see, so its rows are full rather than filtered down after the fact.
+func TestFindSimilarAppliesAccessLimitsInSQLPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	const prefix = "tfindsim-access-"
+	f := newAccessFixture(t, pool, prefix, 2300)
+	repo := NewRepo(pool)
+	embedding := axisVector(f.axis, nil)
+
+	open, err := repo.FindSimilar(ctx, embedding, []string{f.anchor}, "movie", 5, catalog.AccessFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := prefixed(open, prefix); len(got) != 5 || !slices.Equal(got, f.adults[:5]) {
+		t.Fatalf("unrestricted = %v, want the five nearest adult titles", got)
+	}
+
+	for name, filter := range map[string]catalog.AccessFilter{
+		"allowed library": {AllowedLibraryIDs: []int{f.kidsLib}},
+		"hidden library":  {DisabledLibraryIDs: []int{f.adultLb}},
+		"rating ceiling":  {MaturityLimits: access.MaturityLimits{MaxContentRating: "PG"}},
+	} {
+		items, err := repo.FindSimilar(ctx, embedding, []string{f.anchor}, "movie", 5, filter)
+		if err != nil {
+			t.Fatalf("%s: %v", name, err)
+		}
+		got := prefixed(items, prefix)
+		if !slices.Equal(got, f.kids[:5]) {
+			t.Fatalf("%s: similar = %v, want the five nearest kids titles", name, got)
+		}
+	}
+
+	none, err := repo.FindSimilar(ctx, embedding, nil, "movie", 5, catalog.AccessFilter{AllowedLibraryIDs: []int{}})
+	if err != nil || len(none) != 0 {
+		t.Fatalf("no allowed library: %v, %v; want nothing", none, err)
+	}
+
+	// Because You Watched ranks the same way, so the restricted row is full.
+	engine := NewEngine(pool, catalog.NewRatingsRepo(pool), catalog.NewItemRepository(pool), nil, nil, config.RecommendationsConfig{DiversityLambda: 1})
+	row, err := engine.becauseYouWatched(ctx, engine.rowBuilder(), f.anchor, 5, map[string]struct{}{}, catalog.AccessFilter{AllowedLibraryIDs: []int{f.kidsLib}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := prefixed(row, prefix); len(got) != 5 || slices.ContainsFunc(got, func(id string) bool { return slices.Contains(f.adults, id) }) {
+		t.Fatalf("because you watched = %v, want five kids titles", got)
+	}
+}
+
+// The taste-seed picker pages only titles the profile can pick.
+func TestTasteSeedCandidatesHonourAccessPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	const prefix = "ttasteseed-access-"
+	f := newAccessFixture(t, pool, prefix, 2350)
+	repo := NewRepo(pool)
+	kids := append([]string{f.anchor}, f.kids...)
+
+	page, err := repo.GetTasteSeedCandidates(ctx, catalog.AccessFilter{AllowedLibraryIDs: []int{f.kidsLib}}, 5, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(page) != 5 || slices.ContainsFunc(page, func(id string) bool { return !slices.Contains(kids, id) }) {
+		t.Fatalf("allowed-library page = %v, want a full page of kids titles", page)
+	}
+
+	for name, filter := range map[string]catalog.AccessFilter{
+		"hidden library": {DisabledLibraryIDs: []int{f.adultLb}},
+		"G/PG ceiling":   {MaturityLimits: access.MaturityLimits{MaxContentRating: "PG"}},
+	} {
+		all, err := repo.GetTasteSeedCandidates(ctx, filter, 100000, 0)
+		if err != nil {
+			t.Fatalf("%s: %v", name, err)
+		}
+		for _, id := range f.adults {
+			if slices.Contains(all, id) {
+				t.Fatalf("%s: picker offers %s", name, id)
+			}
+		}
+		for _, id := range kids {
+			if !slices.Contains(all, id) {
+				t.Fatalf("%s: picker is missing %s", name, id)
+			}
+		}
+	}
+
+	none, err := repo.GetTasteSeedCandidates(ctx, catalog.AccessFilter{AllowedLibraryIDs: []int{}}, 5, 0)
+	if err != nil || len(none) != 0 {
+		t.Fatalf("no allowed library: %v, %v; want nothing", none, err)
+	}
+}
+
+// Rows are built under the scope the API resolves: an account in an access
+// group limited to the kids library gets the kids library only, which the
+// profile's own settings do not show.
+func TestProfileAccessFilterMatchesTheResolverPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	const prefix = "tscope-group-"
+	f := newAccessFixture(t, pool, prefix, 2400)
+	userID, profileID := newTasteTestAccount(t, pool, prefix)
+
+	groups := access.NewGroupStore(pool)
+	group, err := groups.Create(ctx, access.CreateGroupInput{Name: prefix + time.Now().Format(time.RFC3339Nano), LibraryIDs: []int{f.kidsLib}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _, _ = pool.Exec(context.Background(), `DELETE FROM access_groups WHERE id = $1`, group.ID) })
+	if _, err := pool.Exec(ctx, `UPDATE users SET access_group_id = $2 WHERE id = $1`, userID, group.ID); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := pool.Exec(ctx, `UPDATE user_profiles SET max_content_rating = 'PG' WHERE user_id = $1 AND id = $2`, userID, profileID); err != nil {
+		t.Fatal(err)
+	}
+
+	provider := pgstore.NewPostgresProvider(pool)
+	account := &models.User{ID: userID, Role: models.RoleUser, AccessGroupID: &group.ID}
+	resolver := access.NewResolver(fixedUsers{account}, provider, nil, groups)
+	engine := NewEngine(pool, nil, nil, nil, provider, config.RecommendationsConfig{})
+
+	withoutResolver, err := engine.profileAccessFilter(ctx, userID, profileID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if withoutResolver.AllowedLibraryIDs != nil {
+		t.Fatalf("profile-only filter = %v; the access group is invisible to it", withoutResolver.AllowedLibraryIDs)
+	}
+
+	filter, err := engine.WithScopeResolver(resolver).profileAccessFilter(ctx, userID, profileID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	scope, err := resolver.Resolve(ctx, access.ResolveInput{UserID: userID, ProfileID: profileID, SkipPINVerification: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !slices.Equal(filter.AllowedLibraryIDs, []int{f.kidsLib}) || !slices.Equal(filter.AllowedLibraryIDs, scope.AllowedLibraryIDs) {
+		t.Fatalf("build filter libraries = %v, scope = %v; want the group's [%d]", filter.AllowedLibraryIDs, scope.AllowedLibraryIDs, f.kidsLib)
+	}
+	if filter.MaturityLimits != scope.MaturityLimits || filter.MaxContentRating != "PG" {
+		t.Fatalf("build filter maturity = %+v, scope = %+v", filter.MaturityLimits, scope.MaturityLimits)
+	}
+}
+
+// fixedUsers serves one account to the resolver.
+type fixedUsers struct{ user *models.User }
+
+func (f fixedUsers) GetByID(context.Context, int) (*models.User, error) { return f.user, nil }
+
+// The access filter's excluded media types apply when rows are filtered for
+// the viewer, so the Jellyfin surface, which excludes audiobooks and podcasts,
+// gets rows of titles it can show rather than rows it trims to nothing.
+func TestFilterAccessibleItemIDsAppliesExcludedMediaTypesPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	const prefix = "tfilter-excluded-"
+	cleanupRecoMediaItems(t, pool, prefix)
+	movie, audiobook := prefix+"movie", prefix+"audiobook"
+	seedRecoMediaItem(t, pool, movie, "movie", "matched")
+	seedRecoMediaItem(t, pool, audiobook, "audiobook", "matched")
+	repo := NewRepo(pool)
+
+	all, err := repo.FilterAccessibleItemIDs(ctx, []string{movie, audiobook}, catalog.AccessFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(all) != 2 {
+		t.Fatalf("unrestricted filter kept %v, want both titles", all)
+	}
+	visible, err := repo.FilterAccessibleItemIDs(ctx, []string{movie, audiobook}, catalog.AccessFilter{ExcludedMediaTypes: []string{"audiobook", "podcast"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := visible[movie]; !ok || len(visible) != 1 {
+		t.Fatalf("filter excluding audiobooks kept %v, want only the movie", visible)
+	}
+
+	// The content scope applies as on every catalog read: the allow-list
+	// (empty allows nothing) and the name prefix.
+	for name, tc := range map[string]struct {
+		filter catalog.AccessFilter
+		want   int
+	}{
+		"allow-list":       {catalog.AccessFilter{AllowedContentIDs: []string{movie}}, 1},
+		"empty allow-list": {catalog.AccessFilter{AllowedContentIDs: []string{}}, 0},
+		"name prefix":      {catalog.AccessFilter{NamePrefix: prefix + "aud"}, 1},
+	} {
+		kept, err := repo.FilterAccessibleItemIDs(ctx, []string{movie, audiobook}, tc.filter)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if len(kept) != tc.want {
+			t.Fatalf("%s: kept %v, want %d", name, kept, tc.want)
+		}
+	}
+}
+
+// An access change that reaches whole accounts marks every profile on them
+// stale and leaves other accounts alone.
+func TestMarkAccountsStalePostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	repo := NewRepo(pool)
+	changed, first := newTasteTestAccount(t, pool, "tmark-accounts-changed-")
+	second := "second-" + first
+	if _, err := pool.Exec(ctx, `INSERT INTO user_profiles(id, user_id, name) VALUES($1, $2, 'second')`, second, changed); err != nil {
+		t.Fatal(err)
+	}
+	other, otherProfile := newTasteTestAccount(t, pool, "tmark-accounts-other-")
+	now := time.Now()
+	for _, p := range []struct {
+		userID  int
+		profile string
+	}{{changed, first}, {changed, second}, {other, otherProfile}} {
+		if err := repo.UpsertTasteProfile(ctx, p.userID, p.profile, axisVector(2450, nil), map[string]int{"favorited": 1}, "", now); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	marked, err := repo.MarkAccountsStale(ctx, []int{changed})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if marked != 2 {
+		t.Fatalf("marked %d profiles, want both on the changed account", marked)
+	}
+	if n := countRows(t, pool, `SELECT count(*) FROM user_taste_profiles WHERE user_id = $1 AND stale_at IS NOT NULL`, other); n != 0 {
+		t.Fatalf("other account has %d stale profiles, want 0", n)
+	}
+
+	// A policy change reaches every account.
+	if _, err := repo.MarkAllProfilesStale(ctx); err != nil {
+		t.Fatal(err)
+	}
+	if n := countRows(t, pool, `SELECT count(*) FROM user_taste_profiles WHERE user_id = $1 AND stale_at IS NOT NULL`, other); n != 1 {
+		t.Fatalf("other account has %d stale profiles after a policy change, want 1", n)
+	}
+}
+
+// Deleting a profile removes its ratings and recommendation state with it,
+// and leaves its account's other profiles alone, on the Postgres store and
+// through the purge a store outside Postgres relies on.
+func TestDeletingAProfilePurgesItsRecommendationRowsPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	repo := NewRepo(pool)
+	const prefix = "tpurge-profile-"
+	cleanupRecoMediaItems(t, pool, prefix)
+	seedRecoMediaItem(t, pool, prefix+"movie", "movie", "matched")
+	userID, kept := newTasteTestAccount(t, pool, prefix)
+	viaStore, viaPurge := "store-"+kept, "purge-"+kept
+	now := time.Now()
+	expires := cacheExpiry(now)
+
+	for _, profile := range []string{kept, viaStore, viaPurge} {
+		if profile != kept {
+			if _, err := pool.Exec(ctx, `INSERT INTO user_profiles(id, user_id, name) VALUES($1, $2, $1)`, profile, userID); err != nil {
+				t.Fatal(err)
+			}
+		}
+		if _, err := pool.Exec(ctx, `INSERT INTO user_ratings(user_id, profile_id, media_item_id, rating) VALUES($1, $2, $3, 5)`, userID, profile, prefix+"movie"); err != nil {
+			t.Fatal(err)
+		}
+		if err := repo.UpsertTasteProfile(ctx, userID, profile, axisVector(2500, nil), map[string]int{"rated_5": 1}, "", now); err != nil {
+			t.Fatal(err)
+		}
+		if err := repo.UpsertTasteClusters(ctx, userID, profile, []TasteCluster{{ClusterIdx: 0, Embedding: axisVector(2500, nil), Label: "Test", MemberCount: 1, TotalWeight: 1}}); err != nil {
+			t.Fatal(err)
+		}
+		if err := repo.UpsertRecommendationCache(ctx, userID, profile, RecTypeForYouMain, "", []ScoredItem{{MediaItemID: prefix + "movie"}}, expires); err != nil {
+			t.Fatal(err)
+		}
+	}
+	// The tables PurgeProfile clears, one row each per seeded profile.
+	tables := []string{"user_ratings", "user_taste_profiles", "user_taste_clusters", "recommendation_cache"}
+	rowsOf := func(profile string) int {
+		t.Helper()
+		total := 0
+		for _, table := range tables {
+			total += countRows(t, pool, fmt.Sprintf(`SELECT count(*) FROM %s WHERE user_id = $1 AND profile_id = $2`, table), userID, profile)
+		}
+		return total
+	}
+
+	store, err := pgstore.NewPostgresProvider(pool).ForUser(ctx, userID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := store.DeleteProfile(ctx, viaStore); err != nil {
+		t.Fatal(err)
+	}
+	if err := repo.PurgeProfile(ctx, userID, viaPurge); err != nil {
+		t.Fatal(err)
+	}
+	if n := rowsOf(viaStore); n != 0 {
+		t.Fatalf("profile deleted on the Postgres store keeps %d rows", n)
+	}
+	if n := rowsOf(viaPurge); n != 0 {
+		t.Fatalf("purged profile keeps %d rows", n)
+	}
+	if n := rowsOf(kept); n != len(tables) {
+		t.Fatalf("remaining profile has %d rows, want one in each of %d tables", n, len(tables))
+	}
+}
+
+// The Reader filters cached rows with the viewer's access filter, which
+// carries the media types its surface never serves: Jellyfin compatibility
+// reads its movie-only recommendations with series excluded, and the rows
+// must fill with movies rather than lose their series after the read.
+func TestFilterItemIDsHonoursExcludedMediaTypesPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	const prefix = "tfilter-excluded-types-"
+	cleanupRecoMediaItems(t, pool, prefix)
+	movie, series, book := prefix+"movie", prefix+"series", prefix+"audiobook"
+	seedRecoMediaItem(t, pool, movie, "movie", "matched")
+	seedRecoMediaItem(t, pool, series, "series", "matched")
+	seedRecoMediaItem(t, pool, book, "audiobook", "matched")
+	repo := NewRepo(pool)
+	ids := []string{movie, series, book}
+
+	for _, tc := range []struct {
+		name          string
+		recommendable bool
+		excluded      []string
+		want          []string
+	}{
+		{name: "recommendable", recommendable: true, want: []string{movie, series}},
+		{name: "recommendable without series", recommendable: true, excluded: []string{"audiobook", "series"}, want: []string{movie}},
+		{name: "accessible", want: []string{book, movie, series}},
+		{name: "accessible without series", excluded: []string{"series"}, want: []string{book, movie}},
+	} {
+		filter := catalog.AccessFilter{ExcludedMediaTypes: tc.excluded}
+		read := repo.FilterAccessibleItemIDs
+		if tc.recommendable {
+			read = repo.FilterRecommendableItemIDs
+		}
+		got, err := read(ctx, ids, filter)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if ids := slices.Sorted(maps.Keys(got)); !slices.Equal(ids, tc.want) {
+			t.Fatalf("%s: %v, want %v", tc.name, ids, tc.want)
+		}
+	}
+}
diff --git a/internal/recommendations/access_scope_test.go b/internal/recommendations/access_scope_test.go
new file mode 100644
index 0000000000..faf1e361c0
--- /dev/null
+++ b/internal/recommendations/access_scope_test.go
@@ -0,0 +1,198 @@
+package recommendations
+
+import (
+	"context"
+	"errors"
+	"slices"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/prairie-server/prairie-server/internal/access"
+	"github.com/prairie-server/prairie-server/internal/userstore"
+)
+
+type fakeScopeResolver struct {
+	scope access.Scope
+	err   error
+	got   []access.ResolveInput
+}
+
+func (f *fakeScopeResolver) Resolve(_ context.Context, input access.ResolveInput) (access.Scope, error) {
+	f.got = append(f.got, input)
+	return f.scope, f.err
+}
+
+// The build filter is the request filter: the resolved scope's libraries,
+// hidden libraries and maturity limits, resolved without a PIN check.
+func TestProfileAccessFilterUsesTheResolvedScope(t *testing.T) {
+	resolver := &fakeScopeResolver{scope: access.Scope{
+		AllowedLibraryIDs:  []int{3, 8},
+		DisabledLibraryIDs: []int{5},
+		MaturityLimits: access.MaturityLimits{
+			MaxContentRating:    "PG",
+			AllowUnratedContent: true,
+			MaxAdvisoryAge:      10,
+			RequireAdvisoryAge:  true,
+		},
+		MaxPlaybackQuality: "720p",
+	}}
+	// The store says something else; the resolver wins.
+	store := &fakeSignalStore{profile: nil}
+	engine := (&Engine{storeProvider: fakeSignalProvider{store: store}}).WithScopeResolver(resolver)
+
+	filter, err := engine.profileAccessFilter(context.Background(), 7, "p1")
+	if err != nil {
+		t.Fatalf("profileAccessFilter: %v", err)
+	}
+	if len(resolver.got) != 1 || resolver.got[0] != (access.ResolveInput{UserID: 7, ProfileID: "p1", SkipPINVerification: true}) {
+		t.Fatalf("resolve input = %+v, want user 7 profile p1 without a PIN check", resolver.got)
+	}
+	if filter.UserID != 7 || filter.ProfileID != "p1" {
+		t.Fatalf("filter identity = %d/%q", filter.UserID, filter.ProfileID)
+	}
+	if !slices.Equal(filter.AllowedLibraryIDs, []int{3, 8}) || !slices.Equal(filter.DisabledLibraryIDs, []int{5}) {
+		t.Fatalf("libraries = allowed %v disabled %v, want [3 8] and [5]", filter.AllowedLibraryIDs, filter.DisabledLibraryIDs)
+	}
+	if filter.MaturityLimits != resolver.scope.MaturityLimits {
+		t.Fatalf("maturity limits = %+v, want %+v", filter.MaturityLimits, resolver.scope.MaturityLimits)
+	}
+	if filter.MaxPlaybackQuality != "" {
+		t.Fatalf("MaxPlaybackQuality = %q; playback limits do not shape recommendations", filter.MaxPlaybackQuality)
+	}
+}
+
+// A profile whose scope cannot be resolved gets no rows built under a guessed
+// scope: the build stops and counts a failure, so the refresh is retried and
+// the cached rows stay. A profile that no longer exists is skipped quietly.
+func TestCacheUserRowsSkipsAProfileWhoseScopeIsUnknown(t *testing.T) {
+	for _, tc := range []struct {
+		name       string
+		err        error
+		wantFailed int
+	}{
+		{name: "resolve error", err: errors.New("access group store down"), wantFailed: 1},
+		{name: "deleted profile", err: access.ErrProfileNotFound, wantFailed: 0},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			resolver := &fakeScopeResolver{err: tc.err}
+			w := newJobTestWorker(&fakeLocker{}, nil)
+			w.engine = (&Engine{}).WithScopeResolver(resolver)
+
+			// A nil repo proves nothing is read or written past the scope.
+			built := w.cacheUserRows(context.Background(), nil, 7, "p1", cacheExpiry(time.Now()))
+			if built.failed != tc.wantFailed || built.cached != 0 {
+				t.Fatalf("build = %+v, want %d failed and nothing cached", built, tc.wantFailed)
+			}
+		})
+	}
+}
+
+// Without a resolver the build falls back to the profile's own limits and
+// fails closed: an unreadable profile is an error, not an unrestricted scope,
+// and restrictions with no library allowed admit none.
+func TestProfileAccessFilterFallbackFailsClosed(t *testing.T) {
+	engine := &Engine{storeProvider: fakeSignalProvider{store: &fakeSignalStore{}}}
+	if _, err := engine.profileAccessFilter(context.Background(), 7, "gone"); !errors.Is(err, access.ErrProfileNotFound) {
+		t.Fatalf("missing profile: err = %v, want ErrProfileNotFound", err)
+	}
+
+	restricted := &userstore.Profile{ID: "p1", LibraryRestrictionsEnabled: true}
+	engine = &Engine{storeProvider: fakeSignalProvider{store: &fakeSignalStore{profile: restricted}}}
+	filter, err := engine.profileAccessFilter(context.Background(), 7, "p1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if filter.AllowedLibraryIDs == nil || len(filter.AllowedLibraryIDs) != 0 {
+		t.Fatalf("AllowedLibraryIDs = %#v, want an empty allow-list", filter.AllowedLibraryIDs)
+	}
+}
+
+type recordingAccountsMarker struct {
+	mu          sync.Mutex
+	got         [][]int
+	generations []int64
+	all         int
+}
+
+func (m *recordingAccountsMarker) MarkAccountsStale(_ context.Context, userIDs []int) (int64, error) {
+	m.got = append(m.got, userIDs)
+	return int64(len(userIDs)), nil
+}
+
+func (m *recordingAccountsMarker) MarkAllProfilesStale(context.Context) (int64, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.all++
+	return 0, nil
+}
+
+func (m *recordingAccountsMarker) allMarks() int {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	return m.all
+}
+
+func (m *recordingAccountsMarker) MarkAllProfilesStaleForPolicy(_ context.Context, generation int64) (int64, error) {
+	m.generations = append(m.generations, generation)
+	return 0, nil
+}
+
+// An account-wide access change marks the accounts' profiles stale in one
+// call and queues nothing: the stale sweep rebuilds them, however many there
+// are.
+func TestNotifyAccountsScopeChangedMarksWithoutRefreshing(t *testing.T) {
+	w, _ := newRefreshTestWorker()
+	marker := &recordingAccountsMarker{}
+	w.accountsMarker = marker
+
+	w.NotifyAccountsScopeChanged(t.Context(), []int{3, 4})
+	if len(marker.got) != 1 || !slices.Equal(marker.got[0], []int{3, 4}) {
+		t.Fatalf("marks = %v, want one for accounts [3 4]", marker.got)
+	}
+	assertNothingQueued(t, w, "after an account scope change")
+
+	var nilWorker *Worker
+	nilWorker.NotifyAccountsScopeChanged(t.Context(), []int{3}) // recommendations disabled
+}
+
+// A change to access.unrated_content marks every profile stale at once, and
+// again after the other servers' cached copy of the setting has expired.
+func TestNotifyUnratedContentChangedMarksTwice(t *testing.T) {
+	w, _ := newRefreshTestWorker()
+	marker := &recordingAccountsMarker{}
+	w.accountsMarker = marker
+
+	w.NotifyUnratedContentChanged(t.Context(), 10*time.Millisecond)
+	if n := marker.allMarks(); n != 1 {
+		t.Fatalf("marks right after the change = %d, want 1", n)
+	}
+	deadline := time.Now().Add(5 * time.Second)
+	for marker.allMarks() < 2 {
+		if time.Now().After(deadline) {
+			t.Fatal("no second mark after the settle delay")
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+	assertNothingQueued(t, w, "after an unrated content change")
+
+	var nilWorker *Worker
+	nilWorker.NotifyUnratedContentChanged(t.Context(), time.Millisecond) // recommendations disabled
+}
+
+// A policy change marks every profile stale, for its generation, in one
+// call and queues nothing.
+func TestNotifyPolicyChangedMarksEveryProfileWithoutRefreshing(t *testing.T) {
+	w, _ := newRefreshTestWorker()
+	marker := &recordingAccountsMarker{}
+	w.accountsMarker = marker
+
+	w.NotifyPolicyChanged(t.Context(), 9)
+	if !slices.Equal(marker.generations, []int64{9}) {
+		t.Fatalf("whole-server marks = %v, want one for generation 9", marker.generations)
+	}
+	assertNothingQueued(t, w, "after a policy change")
+
+	var nilWorker *Worker
+	nilWorker.NotifyPolicyChanged(t.Context(), 9) // recommendations disabled
+}
diff --git a/internal/recommendations/accuracy_test.go b/internal/recommendations/accuracy_test.go
index ef2e092cec..d1f7b0ffe7 100644
--- a/internal/recommendations/accuracy_test.go
+++ b/internal/recommendations/accuracy_test.go
@@ -1,233 +1,214 @@
 package recommendations
 
 import (
+	"fmt"
+	"math"
 	"slices"
 	"testing"
+	"time"
 
 	"github.com/prairie-server/prairie-server/internal/config"
 )
 
-func TestApplyGenreCapCountsAllGenres(t *testing.T) {
-	items := []ScoredItem{
-		{MediaItemID: "a", Score: 1.0},
-		{MediaItemID: "b", Score: 0.9},
-		{MediaItemID: "c", Score: 0.8},
-		{MediaItemID: "d", Score: 0.7},
-	}
-	genres := map[string][]string{
-		"a": {"Action", "Drama"},
-		"b": {"Action", "Comedy"},
-		"c": {"Action", "Thriller"},
-		"d": {"Comedy"},
+// The genre pass keeps MMR's order: an over-represented genre's later items
+// move out of the served window, the window fills from the other genres in
+// order, and the rest of the row keeps its order with nothing removed.
+func TestApplyGenreCapDemotesWithinTheServedWindow(t *testing.T) {
+	row := make([]ScoredItem, 60)
+	genres := map[string][]string{}
+	for i := range row {
+		id := fmt.Sprintf("i%02d", i)
+		row[i] = ScoredItem{MediaItemID: id, Score: 1 - float64(i)/100}
+		switch {
+		case i < 30 && i%2 == 0:
+			genres[id] = []string{"Thriller", "Crime"}
+		case i < 30:
+			genres[id] = []string{"Thriller"}
+		case i%2 == 0:
+			genres[id] = []string{"Drama"}
+		default:
+			genres[id] = []string{"Comedy", "Comedy"}
+		}
 	}
 
-	capped := applyGenreCap(items, genres, 0.67)
+	got := mmrItemIDs(applyGenreCap(row, genres))
 
-	if len(capped) != 3 {
-		t.Fatalf("expected 3 capped items, got %d", len(capped))
-	}
-	for _, item := range capped {
-		if item.MediaItemID == "c" {
-			t.Fatalf("expected lowest-scored Action item to be removed, got %#v", capped)
+	var want []string
+	for _, span := range [][2]int{{0, 10}, {30, 40}, {10, 30}, {40, 60}} {
+		for i := span[0]; i < span[1]; i++ {
+			want = append(want, fmt.Sprintf("i%02d", i))
 		}
 	}
-}
-
-func TestHNSWEfSearchStaysWithinPgvectorRange(t *testing.T) {
-	tests := []struct {
-		name           string
-		candidateLimit int
-		want           int
-	}{
-		{name: "raises small scans", candidateLimit: 40, want: minHNSWEfSearch},
-		{name: "keeps exact floor", candidateLimit: minHNSWEfSearch, want: minHNSWEfSearch},
-		{name: "keeps larger scans", candidateLimit: 900, want: 900},
-		{name: "keeps pgvector maximum", candidateLimit: maxHNSWEfSearch, want: maxHNSWEfSearch},
-		{name: "caps just above maximum", candidateLimit: maxHNSWEfSearch + 1, want: maxHNSWEfSearch},
-		{name: "caps genre discover pool", candidateLimit: 1200, want: maxHNSWEfSearch},
-		{name: "caps largest ANN limit", candidateLimit: 2000, want: maxHNSWEfSearch},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if got := hnswEfSearch(tt.candidateLimit); got != tt.want {
-				t.Fatalf("hnswEfSearch(%d) = %d, want %d", tt.candidateLimit, got, tt.want)
-			}
-		})
+	if !slices.Equal(got, want) {
+		t.Fatalf("applyGenreCap = %v, want %v", got, want)
 	}
 }
 
-func TestApplyMediaTypeFloorAddsAvailableSupplementalType(t *testing.T) {
-	items := []ScoredItem{
-		{MediaItemID: "s1", Score: 1.00},
-		{MediaItemID: "s2", Score: 0.99},
-		{MediaItemID: "s3", Score: 0.98},
-		{MediaItemID: "s4", Score: 0.97},
-		{MediaItemID: "s5", Score: 0.96},
-		{MediaItemID: "s6", Score: 0.95},
-		{MediaItemID: "s7", Score: 0.94},
-		{MediaItemID: "s8", Score: 0.93},
-		{MediaItemID: "s9", Score: 0.92},
-		{MediaItemID: "s10", Score: 0.91},
-	}
-	candidates := append([]ScoredItem(nil), items...)
-	candidates = append(candidates,
-		ScoredItem{MediaItemID: "m1", Score: 0.90},
-		ScoredItem{MediaItemID: "m2", Score: 0.89},
-	)
-	mediaTypes := map[string]string{
-		"s1": "series", "s2": "series", "s3": "series", "s4": "series", "s5": "series",
-		"s6": "series", "s7": "series", "s8": "series", "s9": "series", "s10": "series",
-		"m1": "movie", "m2": "movie",
-	}
-
-	mixed := applyMediaTypeFloor(items, candidates, mediaTypes)
-
-	if got := len(mixed); got != len(items) {
-		t.Fatalf("expected result length to stay %d, got %d", len(items), got)
-	}
-	if got := countMediaType(mixed, mediaTypes, "movie"); got != 2 {
-		t.Fatalf("expected 2 movies from supplemental candidates, got %d in %#v", got, mixed)
-	}
-	if slices.ContainsFunc(mixed, func(item ScoredItem) bool { return item.MediaItemID == "s10" }) {
-		t.Fatalf("expected lowest-ranked series tail item to be replaced, got %#v", mixed)
+// A row with nothing else to offer keeps its order and length: the window
+// fills with the over-represented genre instead of coming up short.
+func TestApplyGenreCapFillsFromTheSkippedItems(t *testing.T) {
+	row := make([]ScoredItem, 30)
+	genres := map[string][]string{}
+	for i := range row {
+		id := fmt.Sprintf("i%02d", i)
+		row[i] = ScoredItem{MediaItemID: id}
+		genres[id] = []string{"Science Fiction", "Drama"}
 	}
-}
 
-func TestApplyMediaTypeFloorAddsAvailableAudiobooks(t *testing.T) {
-	items := []ScoredItem{
-		{MediaItemID: "m1", Score: 1.00},
-		{MediaItemID: "m2", Score: 0.99},
-		{MediaItemID: "m3", Score: 0.98},
-		{MediaItemID: "m4", Score: 0.97},
-		{MediaItemID: "m5", Score: 0.96},
-		{MediaItemID: "m6", Score: 0.95},
-		{MediaItemID: "m7", Score: 0.94},
-		{MediaItemID: "m8", Score: 0.93},
-		{MediaItemID: "m9", Score: 0.92},
-		{MediaItemID: "m10", Score: 0.91},
-	}
-	candidates := append([]ScoredItem(nil), items...)
-	candidates = append(candidates,
-		ScoredItem{MediaItemID: "a1", Score: 0.90},
-		ScoredItem{MediaItemID: "a2", Score: 0.89},
-	)
-	mediaTypes := map[string]string{
-		"m1": "movie", "m2": "movie", "m3": "movie", "m4": "movie", "m5": "movie",
-		"m6": "movie", "m7": "movie", "m8": "movie", "m9": "movie", "m10": "movie",
-		"a1": "audiobook", "a2": "audiobook",
-	}
-
-	mixed := applyMediaTypeFloor(items, candidates, mediaTypes)
-
-	if got := countMediaType(mixed, mediaTypes, "audiobook"); got != 2 {
-		t.Fatalf("expected 2 audiobooks from supplemental candidates, got %d in %#v", got, mixed)
+	if got := applyGenreCap(row, genres); !slices.Equal(mmrItemIDs(got), mmrItemIDs(row)) {
+		t.Fatalf("applyGenreCap = %v, want the row unchanged", mmrItemIDs(got))
 	}
 }
 
-func TestApplyMediaTypeFloorNoopsWithoutSupplementalType(t *testing.T) {
-	items := []ScoredItem{
-		{MediaItemID: "s1", Score: 1.00},
-		{MediaItemID: "s2", Score: 0.99},
-		{MediaItemID: "s3", Score: 0.98},
-		{MediaItemID: "s4", Score: 0.97},
-		{MediaItemID: "s5", Score: 0.96},
-	}
-	mediaTypes := map[string]string{
-		"s1": "series", "s2": "series", "s3": "series", "s4": "series", "s5": "series",
+// Items without genre data are never counted against a genre's places.
+func TestApplyGenreCapIgnoresItemsWithoutGenres(t *testing.T) {
+	row := make([]ScoredItem, 30)
+	genres := map[string][]string{}
+	for i := range row {
+		id := fmt.Sprintf("i%02d", i)
+		row[i] = ScoredItem{MediaItemID: id}
+		if i < 15 {
+			genres[id] = []string{"Thriller"}
+		}
 	}
 
-	mixed := applyMediaTypeFloor(items, items, mediaTypes)
+	got := mmrItemIDs(applyGenreCap(row, genres))
 
-	if !slices.EqualFunc(mixed, items, func(a, b ScoredItem) bool {
-		return a.MediaItemID == b.MediaItemID && a.Score == b.Score
-	}) {
-		t.Fatalf("expected unchanged result without supplemental type, got %#v", mixed)
+	var want []string
+	for _, span := range [][2]int{{0, 10}, {15, 25}, {10, 15}, {25, 30}} {
+		for i := span[0]; i < span[1]; i++ {
+			want = append(want, fmt.Sprintf("i%02d", i))
+		}
+	}
+	if !slices.Equal(got, want) {
+		t.Fatalf("applyGenreCap = %v, want %v", got, want)
 	}
 }
 
-func TestApplyMediaTypeFloorIncludesEbookSupplement(t *testing.T) {
-	items := []ScoredItem{
-		{MediaItemID: "s1", Score: 1.00},
-		{MediaItemID: "s2", Score: 0.99},
-		{MediaItemID: "s3", Score: 0.98},
-		{MediaItemID: "s4", Score: 0.97},
-		{MediaItemID: "s5", Score: 0.96},
-	}
-	candidates := append([]ScoredItem(nil), items...)
-	candidates = append(candidates, ScoredItem{MediaItemID: "e1", Score: 0.95})
-	mediaTypes := map[string]string{
-		"s1": "series",
-		"s2": "series",
-		"s3": "series",
-		"s4": "series",
-		"s5": "series",
-		"e1": "ebook",
+// typedRow returns n items of mediaType named prefix00, prefix01, …, scored
+// from top down, and records their type.
+func typedRow(prefix, mediaType string, n int, top float64, types map[string]string) []ScoredItem {
+	items := make([]ScoredItem, n)
+	for i := range items {
+		id := fmt.Sprintf("%s%02d", prefix, i)
+		items[i] = ScoredItem{MediaItemID: id, Score: top - float64(i)/1000}
+		types[id] = mediaType
 	}
+	return items
+}
+
+// A movie-only row gets the pool's best series after its served window, in
+// place of its last movies, so a TV library section scoping the row still
+// fills; the served window does not change.
+func TestPlaceTypeSupplementsFillsOnlyTheTail(t *testing.T) {
+	types := map[string]string{}
+	row := typedRow("m", "movie", CacheCandidateLimit, 0.9, types)
+	series := typedRow("s", "series", 20, 0.5, types)
+	pool := append(append([]ScoredItem(nil), row...), series...)
 
-	mixed := applyMediaTypeFloor(items, candidates, mediaTypes)
+	got := placeTypeSupplements(row, pool, types)
 
-	if got := countMediaType(mixed, mediaTypes, "ebook"); got != 1 {
-		t.Fatalf("expected 1 ebook from supplemental candidates, got %d in %#v", got, mixed)
+	if len(got) != len(row) {
+		t.Fatalf("row length = %d, want %d", len(got), len(row))
+	}
+	floor := mediaTypeFloor(len(row))
+	want := append(mmrItemIDs(row[:len(row)-floor]), mmrItemIDs(series[:floor])...)
+	if !slices.Equal(mmrItemIDs(got), want) {
+		t.Fatalf("placeTypeSupplements = %v, want %v", mmrItemIDs(got), want)
 	}
 }
 
-func TestApplyGenreCapDoesNotCollapseConcentratedRows(t *testing.T) {
-	items := []ScoredItem{
-		{MediaItemID: "a", Score: 1.0},
-		{MediaItemID: "b", Score: 0.9},
-		{MediaItemID: "c", Score: 0.8},
-		{MediaItemID: "d", Score: 0.7},
-		{MediaItemID: "e", Score: 0.6},
-		{MediaItemID: "f", Score: 0.5},
+// Room is made only from types above the floor, so a type's supplements
+// never push its own titles at the row's end back out. Only
+// recommendableMediaTypes are supplemented: the pool's audiobooks stay out.
+func TestPlaceTypeSupplementsKeepsOtherTypesAtTheirFloor(t *testing.T) {
+	types := map[string]string{}
+	row := append(typedRow("s", "series", 50, 0.9, types), typedRow("m", "movie", 10, 0.8, types)...)
+	movies := typedRow("n", "movie", 5, 0.5, types)
+	books := typedRow("a", "audiobook", 15, 0.4, types)
+	pool := append(append(append([]ScoredItem(nil), row...), movies...), books...)
+
+	got := placeTypeSupplements(row, pool, types)
+
+	floor := mediaTypeFloor(len(row))
+	if !slices.Equal(mmrItemIDs(got[:ServedRowSize]), mmrItemIDs(row[:ServedRowSize])) {
+		t.Fatalf("served window changed: %v", mmrItemIDs(got[:ServedRowSize]))
+	}
+	for mediaType, want := range map[string]int{"movie": floor, "series": len(row) - floor, "audiobook": 0} {
+		if n := countMediaType(got, types, mediaType); n != want {
+			t.Fatalf("%s count = %d, want %d in %v", mediaType, n, want, mmrItemIDs(got))
+		}
 	}
-	genres := map[string][]string{
-		"a": {"Science Fiction", "Drama"},
-		"b": {"Science Fiction", "Drama"},
-		"c": {"Science Fiction", "Drama"},
-		"d": {"Science Fiction", "Drama"},
-		"e": {"Science Fiction", "Drama"},
-		"f": {"Science Fiction", "Drama"},
+	for _, id := range mmrItemIDs(row[50:]) {
+		if !slices.Contains(mmrItemIDs(got), id) {
+			t.Fatalf("row %v lost movie %s", mmrItemIDs(got), id)
+		}
 	}
+}
 
-	capped := applyGenreCap(items, genres, 0.4)
-
-	if len(capped) != 3 {
-		t.Fatalf("got %d capped items, want retained half of concentrated row", len(capped))
+// A row no longer than the served window, or a pool with no other type,
+// stays as it is.
+func TestPlaceTypeSupplementsNoops(t *testing.T) {
+	types := map[string]string{}
+	short := typedRow("m", "movie", ServedRowSize, 0.9, types)
+	series := typedRow("s", "series", 20, 0.5, types)
+	if got := placeTypeSupplements(short, append(short, series...), types); !slices.Equal(mmrItemIDs(got), mmrItemIDs(short)) {
+		t.Fatalf("short row = %v, want unchanged", mmrItemIDs(got))
 	}
-	if capped[0].MediaItemID != "a" || capped[1].MediaItemID != "b" || capped[2].MediaItemID != "c" {
-		t.Fatalf("unexpected capped items: %#v", capped)
+	row := typedRow("x", "movie", CacheCandidateLimit, 0.9, types)
+	if got := placeTypeSupplements(row, row, types); !slices.Equal(mmrItemIDs(got), mmrItemIDs(row)) {
+		t.Fatalf("single-type row = %v, want unchanged", mmrItemIDs(got))
 	}
 }
 
 func TestCollaborativeSupportAggregatesAcrossPeers(t *testing.T) {
-	candidates := map[string]collaborativeCandidate{}
+	candidates := collaborativeCandidates([]peerLikes{
+		{userID: 1, similarity: 1, weights: map[string]float64{"shared": 0.4, "single": 0.6}},
+		{userID: 2, similarity: 1, weights: map[string]float64{"shared": 0.3, "single-other": 0.6}},
+	})
 
-	addCollaborativeSupport(candidates, "shared", 0.4)
-	addCollaborativeSupport(candidates, "shared", 0.3)
-	addCollaborativeSupport(candidates, "single", 0.6)
-
-	if candidates["shared"].score <= candidates["single"].score {
-		t.Fatalf("shared score = %f, single score = %f; expected aggregated shared support to win", candidates["shared"].score, candidates["single"].score)
+	shared, ok := candidates["shared"]
+	if !ok {
+		t.Fatalf("candidates = %#v, want the title two accounts liked", candidates)
+	}
+	if math.Abs(shared.score-0.7) > 1e-9 {
+		t.Fatalf("shared score = %f, want the peers' scores summed", shared.score)
 	}
-	if candidates["shared"].support != 2 {
-		t.Fatalf("shared support = %d, want 2", candidates["shared"].support)
+	if len(shared.accounts) != 2 {
+		t.Fatalf("shared accounts = %d, want 2", len(shared.accounts))
 	}
 }
 
-func TestCowatchMatrixTreatsProfilesAsDistinctWatchers(t *testing.T) {
-	watchers := map[string][]string{
-		"a": {"1:p1", "1:p2"},
-		"b": {"1:p1", "1:p2"},
+// Profiles are distinct watchers in the Jaccard score, but the shared-watcher
+// floor counts accounts, so one household's profiles cannot make a pair other
+// households see.
+func TestCowatchMatrixCountsSharedWatchersByAccount(t *testing.T) {
+	oneHousehold := map[string][]string{
+		"a": {"1:p1", "1:p2", "1:p3"},
+		"b": {"1:p1", "1:p2", "1:p3"},
+	}
+	pairs, err := computeCowatchMatrix(t.Context(), oneHousehold, 2, 2, 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(pairs) != 0 {
+		t.Fatalf("one account's profiles made pairs: %#v", pairs)
 	}
 
-	pairs := computeCowatchMatrix(watchers, 2, 2, 10)
+	twoHouseholds := map[string][]string{
+		"a": {"1:p1", "1:p2", "2:p1"},
+		"b": {"1:p1", "1:p2", "2:p1"},
+	}
+	pairs, err = computeCowatchMatrix(t.Context(), twoHouseholds, 2, 2, 10)
+	if err != nil {
+		t.Fatal(err)
+	}
 	if len(pairs) != 2 {
 		t.Fatalf("got %d co-watch pairs, want 2: %#v", len(pairs), pairs)
 	}
 	for _, pair := range pairs {
-		if pair.CowatchCount != 2 {
-			t.Fatalf("cowatch count = %d, want two profile identities: %#v", pair.CowatchCount, pair)
+		if pair.CowatchCount != 3 {
+			t.Fatalf("cowatch count = %d, want three profile identities: %#v", pair.CowatchCount, pair)
 		}
 	}
 }
@@ -267,12 +248,12 @@ func TestCompatiblePeerContentRatingsComparesAgeCeilings(t *testing.T) {
 
 func TestMMRLambdaUsesConfiguredGlobalOverride(t *testing.T) {
 	engine := &Engine{cfg: config.RecommendationsConfig{DiversityLambda: 0.25}}
-	if got := engine.mmrLambda(0.8); got != 0.25 {
+	if got := engine.mmrLambda(); got != 0.25 {
 		t.Fatalf("mmrLambda = %f, want configured override", got)
 	}
 
 	engine.cfg.DiversityLambda = 1.2
-	if got := engine.mmrLambda(0.8); got != 0.8 {
+	if got := engine.mmrLambda(); got != defaultMMRLambda {
 		t.Fatalf("mmrLambda = %f, want fallback default for invalid override", got)
 	}
 }
@@ -320,22 +301,27 @@ func TestBuildTasteClustersDeterministic(t *testing.T) {
 	}
 }
 
-func TestDeduplicateThenTrimKeepsBackfillCandidates(t *testing.T) {
+func TestDeduplicateKeepsBackfillCandidates(t *testing.T) {
 	seen := map[string]struct{}{"already-seen": {}}
 	items := []ScoredItem{
 		{MediaItemID: "already-seen", Score: 1.0},
 		{MediaItemID: "next-best", Score: 0.9},
 		{MediaItemID: "backfill", Score: 0.8},
+		{MediaItemID: "not-shown", Score: 0.7},
 	}
 
-	row := ForYouRow{Items: deduplicateItems(items, seen)}
-	rows := trimRows([]ForYouRow{row}, 2)
+	kept := deduplicateItems(items, seen, 2)
 
-	if len(rows[0].Items) != 2 {
-		t.Fatalf("got %d items, want 2", len(rows[0].Items))
+	if len(kept) != 2 || kept[0].MediaItemID != "next-best" || kept[1].MediaItemID != "backfill" {
+		t.Fatalf("unexpected retained items: %#v", kept)
+	}
+	// Only shown items are spent: the row's third survivor stays free for a
+	// later row.
+	if _, spent := seen["not-shown"]; spent {
+		t.Fatal("an item past the row's limit was marked seen")
 	}
-	if rows[0].Items[0].MediaItemID != "next-best" || rows[0].Items[1].MediaItemID != "backfill" {
-		t.Fatalf("unexpected retained items: %#v", rows[0].Items)
+	if later := deduplicateItems([]ScoredItem{{MediaItemID: "backfill"}, {MediaItemID: "not-shown"}}, seen, 2); len(later) != 1 || later[0].MediaItemID != "not-shown" {
+		t.Fatalf("later row kept %#v, want only not-shown", later)
 	}
 }
 
@@ -347,3 +333,115 @@ func clusterTestItem(id string, embedding []float32, weight float64, genre strin
 		genres:    []string{genre},
 	}
 }
+
+// The recency boost multiplies a new title's score by up to
+// RecencyBoostMultiplier, less the older it is, and keeps the pool's order;
+// old, undated and negatively scored titles keep their scores.
+func TestApplyRecencyBoostKeepsOrder(t *testing.T) {
+	now := time.Date(2026, 10, 1, 0, 0, 0, 0, time.UTC)
+	items := []ScoredItem{
+		{MediaItemID: "old", Score: 0.9}, {MediaItemID: "new", Score: 0.8}, {MediaItemID: "undated", Score: 0.7},
+		{MediaItemID: "week-old", Score: 0.6}, {MediaItemID: "old-2", Score: 0.5}, {MediaItemID: "old-3", Score: 0.4},
+		{MediaItemID: "old-4", Score: 0.3}, {MediaItemID: "new-negative", Score: -0.1},
+	}
+	added := map[string]time.Time{
+		"old": now.AddDate(-1, 0, 0), "new": now, "week-old": now.AddDate(0, 0, -RecencyBoostDays/2),
+		"old-2": now.AddDate(0, 0, -RecencyBoostDays), "old-3": now.AddDate(-1, 0, 0), "old-4": now.AddDate(-1, 0, 0),
+		"new-negative": now,
+	}
+	// Four more old titles keep the new ones at a quarter of the pool.
+	for i := range 4 {
+		id := fmt.Sprintf("old-%d", 5+i)
+		items = append(items, ScoredItem{MediaItemID: id, Score: 0.2})
+		added[id] = now.AddDate(-1, 0, 0)
+	}
+
+	got := applyRecencyBoost(items, added, now)
+
+	if !slices.Equal(mmrItemIDs(got), mmrItemIDs(items)) {
+		t.Fatalf("order = %v, want %v", mmrItemIDs(got), mmrItemIDs(items))
+	}
+	if want := 0.8 * RecencyBoostMultiplier; math.Abs(got[1].Score-want) > 1e-9 {
+		t.Fatalf("new title score = %f, want %f", got[1].Score, want)
+	}
+	if want := 0.6 * (1 + (RecencyBoostMultiplier-1)/2); math.Abs(got[3].Score-want) > 1e-9 {
+		t.Fatalf("half-window title score = %f, want %f", got[3].Score, want)
+	}
+	for _, i := range []int{0, 2, 4, 5, 6, 7, 8, 9, 10, 11} {
+		if got[i].Score != items[i].Score {
+			t.Fatalf("%s score = %f, want it unchanged at %f", items[i].MediaItemID, got[i].Score, items[i].Score)
+		}
+	}
+	if items[1].Score != 0.8 {
+		t.Fatalf("input changed: %v", items)
+	}
+}
+
+// A pool with more than a quarter of its titles inside the window, such as
+// a freshly imported library, keeps every score: boosting it would rank by
+// scan order.
+func TestApplyRecencyBoostSkipsBulkImports(t *testing.T) {
+	now := time.Date(2026, 10, 1, 0, 0, 0, 0, time.UTC)
+	items := scoredRun("item", 8)
+	added := map[string]time.Time{}
+	for i, item := range items {
+		added[item.MediaItemID] = now.AddDate(-1, 0, 0)
+		if i < 3 {
+			added[item.MediaItemID] = now.AddDate(0, 0, -i)
+		}
+	}
+	if got := applyRecencyBoost(items, added, now); !slices.Equal(got, items) {
+		t.Fatalf("3 of 8 new: scores %v, want them unchanged", got)
+	}
+	added[items[2].MediaItemID] = now.AddDate(-1, 0, 0)
+	if got := applyRecencyBoost(items, added, now); got[0].Score == items[0].Score || got[2].Score != items[2].Score {
+		t.Fatalf("2 of 8 new: scores %v, want only the new titles boosted", got)
+	}
+}
+
+// Applied before selection, the boost lets a new title just below the
+// selection margin into the row, while a new title far below it stays out.
+func TestRecencyBoostLiftsNearMissesIntoTheRow(t *testing.T) {
+	now := time.Date(2026, 10, 1, 0, 0, 0, 0, time.UTC)
+	var pool []ScoredItem
+	added := map[string]time.Time{}
+	for i := range 40 {
+		id := fmt.Sprintf("old-%02d", i)
+		pool = append(pool, ScoredItem{MediaItemID: id, Score: 0.80 - 0.005*float64(i)})
+		added[id] = now.AddDate(-1, 0, 0)
+	}
+	// The row takes 20: the margin is old-19 at 0.705.
+	pool = append(pool, ScoredItem{MediaItemID: "new-near", Score: 0.69}, ScoredItem{MediaItemID: "new-far", Score: 0.55})
+	added["new-near"], added["new-far"] = now, now
+
+	pick := func(items []ScoredItem) []string {
+		return mmrItemIDs(applyMMR(items, nil, defaultMMRLambda, ServedRowSize))
+	}
+	if got := pick(pool); slices.Contains(got, "new-near") {
+		t.Fatalf("without the boost the row %v holds new-near", got)
+	}
+	got := pick(applyRecencyBoost(pool, added, now))
+	if !slices.Contains(got, "new-near") || slices.Contains(got, "new-far") {
+		t.Fatalf("boosted row %v, want new-near in and new-far out", got)
+	}
+}
+
+// A row shorter than the served window caps a genre at half of that row:
+// ten Action titles and two others in a 12-title row serve both others
+// among the first seven.
+func TestApplyGenreCapScalesToAShortRow(t *testing.T) {
+	row := make([]ScoredItem, 12)
+	genres := map[string][]string{}
+	for i := range row {
+		id := fmt.Sprintf("i%02d", i)
+		row[i] = ScoredItem{MediaItemID: id}
+		genres[id] = []string{"Action"}
+	}
+	genres["i10"], genres["i11"] = []string{"Drama"}, []string{"Comedy"}
+
+	got := mmrItemIDs(applyGenreCap(row, genres))
+	want := []string{"i00", "i01", "i02", "i03", "i04", "i05", "i10", "i11", "i06", "i07", "i08", "i09"}
+	if !slices.Equal(got, want) {
+		t.Fatalf("applyGenreCap = %v, want %v", got, want)
+	}
+}
diff --git a/internal/recommendations/anchors.go b/internal/recommendations/anchors.go
new file mode 100644
index 0000000000..33aad30527
--- /dev/null
+++ b/internal/recommendations/anchors.go
@@ -0,0 +1,277 @@
+package recommendations
+
+import (
+	"cmp"
+	"context"
+	"fmt"
+	"slices"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+)
+
+// A profile with several interests gets a main row composed per interest. One
+// query around the averaged taste vector hands most of the row to the
+// heaviest interest, or to titles between the interests; anchoring on each
+// taste cluster gives every interest its share of the row.
+const (
+	// minAnchorTitles is how many positive titles a profile needs before its
+	// clusters anchor the main row. Under it the profile has one cluster.
+	minAnchorTitles = 10
+	// anchorMinSlots is the fewest slots an anchor gets when the row has room
+	// for that many per anchor.
+	anchorMinSlots = 3
+	// anchorPoolFactor is how many candidates an anchor's query fetches per
+	// slot, for MMR to choose from.
+	anchorPoolFactor = 3
+)
+
+// mainRowAnchor is one interest the main row is composed from.
+type mainRowAnchor struct {
+	embedding []float32
+	weight    float64
+}
+
+// mainRowAnchors returns the anchors of a profile's main row: its clusters,
+// heaviest first. A profile under minAnchorTitles positive titles, or with
+// fewer than two clusters, gets none: its main row comes from the averaged
+// vector.
+//
+// Clusters are not merged by how close their centroids are. A centroid
+// averages away its titles' differences, so the more titles two clusters
+// hold, the closer their centroids sit, whatever their genres:
+// buildTasteClusters already decides which titles are one interest, against
+// the profile's own spread.
+func mainRowAnchors(clusters []TasteCluster) []mainRowAnchor {
+	titles := 0
+	var anchors []mainRowAnchor
+	for _, c := range clustersHeaviestFirst(clusters) {
+		titles += c.MemberCount
+		if len(c.Embedding) == 0 || c.TotalWeight <= 0 {
+			continue
+		}
+		anchors = append(anchors, mainRowAnchor{embedding: c.Embedding, weight: c.TotalWeight})
+	}
+	if titles < minAnchorTitles || len(anchors) < 2 {
+		return nil
+	}
+	return anchors
+}
+
+// allocateAnchorSlots splits limit slots across anchors in proportion to
+// their weights, by largest remainder, then lifts any anchor below
+// min(anchorMinSlots, limit/len(weights)) to that minimum with slots from the
+// anchors holding the most.
+func allocateAnchorSlots(weights []float64, limit int) []int {
+	n := len(weights)
+	slots := make([]int, n)
+	if n == 0 || limit <= 0 {
+		return slots
+	}
+	var total float64
+	for _, w := range weights {
+		total += w
+	}
+	remainders := make([]float64, n)
+	given := 0
+	for i, w := range weights {
+		exact := float64(limit) / float64(n)
+		if total > 0 {
+			exact = float64(limit) * w / total
+		}
+		slots[i] = int(exact)
+		remainders[i] = exact - float64(slots[i])
+		given += slots[i]
+	}
+	order := make([]int, n)
+	for i := range order {
+		order[i] = i
+	}
+	slices.SortStableFunc(order, func(a, b int) int { return cmp.Compare(remainders[b], remainders[a]) })
+	for k := 0; given < limit; k++ {
+		slots[order[k%n]]++
+		given++
+	}
+
+	minSlots := min(anchorMinSlots, limit/n)
+	for i := range slots {
+		for slots[i] < minSlots {
+			donor := -1
+			for j := range slots {
+				if slots[j] > minSlots && (donor < 0 || slots[j] > slots[donor]) {
+					donor = j
+				}
+			}
+			if donor < 0 {
+				break
+			}
+			slots[donor]--
+			slots[i]++
+		}
+	}
+	return slots
+}
+
+// interleaveAnchors merges the anchors' ranked lists into one row of at most
+// limit items by smooth weighted round-robin over their slots, so every prefix
+// of the row holds each anchor's share. An item another anchor already placed
+// is skipped. An anchor that runs out before filling its slots leaves them to
+// the others, which then continue past their own slots in the same rotation.
+func interleaveAnchors(lists [][]ScoredItem, slots []int, limit int) []ScoredItem {
+	n := len(lists)
+	next := make([]int, n)
+	placed := make([]int, n)
+	seen := make(map[string]struct{}, limit)
+	row := make([]ScoredItem, 0, limit)
+
+	take := func(i int) bool {
+		for next[i] < len(lists[i]) {
+			item := lists[i][next[i]]
+			next[i]++
+			if _, dup := seen[item.MediaItemID]; dup {
+				continue
+			}
+			seen[item.MediaItemID] = struct{}{}
+			row = append(row, item)
+			placed[i]++
+			return true
+		}
+		return false
+	}
+
+	// The first pass fills each anchor's slots; the second hands the slots an
+	// anchor could not fill to the anchors with items left.
+	for _, withinSlots := range []bool{true, false} {
+		active := make([]bool, n)
+		current := make([]int, n)
+		for i := range active {
+			active[i] = slots[i] > 0 && (!withinSlots || placed[i] < slots[i])
+		}
+		for len(row) < limit {
+			pick, total := -1, 0
+			for i := range n {
+				if !active[i] {
+					continue
+				}
+				current[i] += slots[i]
+				total += slots[i]
+				if pick < 0 || current[i] > current[pick] {
+					pick = i
+				}
+			}
+			if pick < 0 {
+				break
+			}
+			current[pick] -= total
+			if !take(pick) || (withinSlots && placed[pick] >= slots[pick]) {
+				active[pick] = false
+			}
+		}
+	}
+	return row
+}
+
+// anchoredRow composes a main row of up to limit items from anchors. Each
+// anchor fetches anchorPoolFactor candidates per slot with no genre filter,
+// MMR ranks them, and interleaveAnchors merges the anchors' rankings. It
+// returns the row and every candidate fetched. An anchor whose candidates or
+// embeddings cannot be read fails the row: the others would take its slots,
+// and a row missing an interest would be cached as if it were whole.
+//
+// When the profile's turned-away titles take anchors out of the row (see
+// shrinkAvertedAnchors), the anchors left fetch again for the slots they
+// gained, so the row keeps its length. allAverted reports that every anchor
+// left: the profile turned away each of its interests, and the row is empty.
+func (b rowBuilder) anchoredRow(ctx context.Context, anchors []mainRowAnchor, limit int, excludeIDs []string, filter catalog.AccessFilter) (row, pool []ScoredItem, allAverted bool, err error) {
+	weights := make([]float64, len(anchors))
+	for i, a := range anchors {
+		weights[i] = a.weight
+	}
+	slots := allocateAnchorSlots(weights, limit)
+	lists := make([][]ScoredItem, len(anchors))
+	shares := make([]float64, len(anchors))
+	fetched := make([]int, len(anchors))
+	for i := range anchors {
+		fetched[i] = anchorPoolFactor * slots[i]
+		if lists[i], shares[i], err = b.anchorList(ctx, anchors[i], i, fetched[i], excludeIDs, filter); err != nil {
+			return nil, nil, false, err
+		}
+	}
+	// A refill widens an anchor's pool, which moves the median its share is
+	// measured against (see aversion.apply), so the split is taken again
+	// until no anchor gains slots it has not fetched for. Fetches only grow,
+	// up to anchorPoolFactor×limit each, so this ends.
+	for {
+		kept, keptSlots := shrinkAvertedAnchors(weights, shares, slots, limit)
+		if len(kept) == 0 {
+			return nil, nil, true, nil
+		}
+		refilled := false
+		for k, i := range kept {
+			if n := anchorPoolFactor * keptSlots[k]; n > fetched[i] {
+				fetched[i] = n
+				if lists[i], shares[i], err = b.anchorList(ctx, anchors[i], i, n, excludeIDs, filter); err != nil {
+					return nil, nil, false, err
+				}
+				refilled = true
+			}
+		}
+		if refilled {
+			continue
+		}
+		keptLists := make([][]ScoredItem, len(kept))
+		for k, i := range kept {
+			keptLists[k] = lists[i]
+			// An anchor that leaves the row leaves the pool too, so type
+			// supplements cannot bring its titles back.
+			pool = mergeScoredCandidates(pool, lists[i])
+		}
+		return interleaveAnchors(keptLists, keptSlots, limit), pool, false, nil
+	}
+}
+
+// anchorList fetches n candidates around anchor a (the i-th), ranks them
+// against the profile's turned-away titles and by MMR, and returns the
+// ranking with the share of the anchor's interest the turned-away titles
+// leave. MMR's ranking is greedy, so its first items are the anchor's picks;
+// the rest stand in when another anchor runs out.
+func (b rowBuilder) anchorList(ctx context.Context, a mainRowAnchor, i, n int, excludeIDs []string, filter catalog.AccessFilter) ([]ScoredItem, float64, error) {
+	candidates, _, err := b.store.FindTasteProfileCandidates(ctx, a.embedding, excludeIDs, nil, n, filter)
+	if err != nil {
+		return nil, 0, fmt.Errorf("main row anchor %d candidates: %w", i, err)
+	}
+	if len(candidates) == 0 {
+		return nil, 1, nil
+	}
+	candidates = b.withRecencyBoost(ctx, b.withQualityPrior(ctx, candidates, 0))
+	embMap, err := b.store.GetBatchEmbeddings(ctx, scoredItemIDs(candidates))
+	if err != nil {
+		return nil, 0, fmt.Errorf("main row anchor %d embeddings: %w", i, err)
+	}
+	candidates, averse := b.withAversion(candidates, embMap, a.embedding)
+	return applyMMR(candidates, embMap, b.lambda, len(candidates)), averse.interestShare(a.weight), nil
+}
+
+// shrinkAvertedAnchors re-splits the row's slots after the profile's
+// turned-away titles shrank some anchors' shares (see aversion.apply): each
+// anchor's weight is scaled by its share, and an anchor whose share fell
+// under aversionInterestFloor leaves the row. It returns the indexes of the
+// anchors kept and their slots; with every share whole, every anchor and
+// its slots unchanged.
+func shrinkAvertedAnchors(weights, shares []float64, slots []int, limit int) (kept, keptSlots []int) {
+	kept = make([]int, 0, len(weights))
+	if !slices.ContainsFunc(shares, func(s float64) bool { return s < 1 }) {
+		for i := range weights {
+			kept = append(kept, i)
+		}
+		return kept, slots
+	}
+	keptWeights := make([]float64, 0, len(weights))
+	for i, share := range shares {
+		if share < aversionInterestFloor {
+			continue
+		}
+		kept = append(kept, i)
+		keptWeights = append(keptWeights, weights[i]*share)
+	}
+	return kept, allocateAnchorSlots(keptWeights, limit)
+}
diff --git a/internal/recommendations/anchors_test.go b/internal/recommendations/anchors_test.go
new file mode 100644
index 0000000000..bfa273b2dd
--- /dev/null
+++ b/internal/recommendations/anchors_test.go
@@ -0,0 +1,224 @@
+package recommendations
+
+import (
+	"fmt"
+	"math"
+	"slices"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+)
+
+// Slots follow the anchors' weights, always add up to the row, and give no
+// anchor fewer than min(anchorMinSlots, limit/anchors).
+func TestAllocateAnchorSlots(t *testing.T) {
+	for _, tc := range []struct {
+		name    string
+		weights []float64
+		limit   int
+		want    []int
+	}{
+		{"two near-even interests", []float64{0.52, 0.48}, 60, []int{31, 29}},
+		{"a heavy and a light interest", []float64{0.68, 0.32}, 60, []int{41, 19}},
+		{"a light interest lifted to the minimum", []float64{0.6, 0.38, 0.02}, 60, []int{34, 23, 3}},
+		{"the minimum shrinks with the row", []float64{0.9, 0.05, 0.05}, 8, []int{4, 2, 2}},
+		{"no weight splits evenly", []float64{0, 0}, 5, []int{3, 2}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := allocateAnchorSlots(tc.weights, tc.limit); !slices.Equal(got, tc.want) {
+				t.Fatalf("allocateAnchorSlots(%v, %d) = %v, want %v", tc.weights, tc.limit, got, tc.want)
+			}
+		})
+	}
+}
+
+// anchorList returns n items named prefix0, prefix1, … .
+func anchorList(prefix string, n int) []ScoredItem {
+	items := make([]ScoredItem, n)
+	for i := range items {
+		items[i] = ScoredItem{MediaItemID: fmt.Sprintf("%s%d", prefix, i)}
+	}
+	return items
+}
+
+// Every prefix of the interleaved row holds each anchor's share of its slots,
+// to within one item.
+func TestInterleaveAnchorsKeepsSharesInEveryPrefix(t *testing.T) {
+	slots := []int{35, 22, 3}
+	lists := [][]ScoredItem{anchorList("a", 105), anchorList("b", 66), anchorList("c", 9)}
+
+	row := interleaveAnchors(lists, slots, 60)
+
+	if len(row) != 60 {
+		t.Fatalf("row length = %d, want 60", len(row))
+	}
+	counts := map[byte]int{}
+	for n, item := range row {
+		counts[item.MediaItemID[0]]++
+		for i, prefix := range []byte("abc") {
+			ideal := float64(slots[i]) * float64(n+1) / 60
+			if math.Abs(float64(counts[prefix])-ideal) > 1 {
+				t.Fatalf("after %d items anchor %c holds %d, want %.1f±1", n+1, prefix, counts[prefix], ideal)
+			}
+		}
+	}
+	for i, prefix := range []byte("abc") {
+		if counts[prefix] != slots[i] {
+			t.Fatalf("anchor %c holds %d, want its %d slots", prefix, counts[prefix], slots[i])
+		}
+	}
+}
+
+// A title two anchors share is placed once, and an anchor that runs out
+// leaves its slots to the others instead of shortening the row.
+func TestInterleaveAnchorsDedupesAndPassesUnusedSlots(t *testing.T) {
+	shared := ScoredItem{MediaItemID: "shared"}
+	lists := [][]ScoredItem{
+		append([]ScoredItem{shared}, anchorList("a", 20)...),
+		append([]ScoredItem{shared}, anchorList("b", 2)...),
+	}
+
+	row := interleaveAnchors(lists, []int{5, 5}, 10)
+
+	ids := mmrItemIDs(row)
+	if len(ids) != 10 {
+		t.Fatalf("row = %v, want 10 items", ids)
+	}
+	seen := map[string]bool{}
+	for _, id := range ids {
+		if seen[id] {
+			t.Fatalf("row = %v repeats %s", ids, id)
+		}
+		seen[id] = true
+	}
+	if !seen["b0"] || !seen["b1"] {
+		t.Fatalf("row = %v, want both of b's own titles", ids)
+	}
+}
+
+func anchorCluster(idx int, vec []float32, members int, weight float64) TasteCluster {
+	return TasteCluster{ClusterIdx: idx, Embedding: vec, MemberCount: members, TotalWeight: weight}
+}
+
+// Clusters anchor the main row only for a profile with enough titles and at
+// least two clusters. Every cluster is its own anchor, heaviest first, even
+// one whose centroid lies near another's: buildTasteClusters has already
+// decided which titles are one interest.
+func TestMainRowAnchors(t *testing.T) {
+	horror, romance := []float32{1, 0, 0}, []float32{0, 1, 0}
+	nearHorror := []float32{0.95, 0.05, 0.2}
+
+	anchors := mainRowAnchors([]TasteCluster{
+		anchorCluster(0, horror, 8, 4),
+		anchorCluster(1, romance, 6, 5),
+		anchorCluster(2, nearHorror, 4, 2),
+	})
+	var weights []float64
+	for _, a := range anchors {
+		weights = append(weights, a.weight)
+	}
+	if !slices.Equal(weights, []float64{5, 4, 2}) {
+		t.Fatalf("anchor weights = %v, want romance 5, horror 4, near-horror 2", weights)
+	}
+	if !slices.Equal(anchors[1].embedding, horror) || !slices.Equal(anchors[2].embedding, nearHorror) {
+		t.Fatalf("anchors = %+v, want each cluster's own centroid", anchors)
+	}
+
+	for name, clusters := range map[string][]TasteCluster{
+		"under ten titles": {anchorCluster(0, horror, 5, 4), anchorCluster(1, romance, 4, 3)},
+		"one cluster":      {anchorCluster(0, horror, 30, 9)},
+	} {
+		if got := mainRowAnchors(clusters); got != nil {
+			t.Fatalf("%s: anchors = %+v, want none", name, got)
+		}
+	}
+}
+
+// Every title the main row can serve, its first 30 under the daily
+// rotation, leaves the cluster rows; a row left thin is emptied, and one that
+// shared nothing is kept as it was.
+func TestWithoutMainRowItems(t *testing.T) {
+	main := anchorList("m", CacheCandidateLimit)
+	reach := rotationReach(ServedRowSize)
+	overlapping := append(slices.Clone(main[:5]), anchorList("x", 12)...)
+	drawable := append(slices.Clone(main[ServedRowSize:reach]), anchorList("v", 12)...)
+	thin := append(slices.Clone(main[5:15]), anchorList("y", 9)...)
+	separate := anchorList("z", 4)
+	tailOnly := append(anchorList("w", 3), main[reach:]...)
+
+	rows := withoutMainRowItems([]ForYouRow{
+		{ClusterIndex: 0, Items: overlapping},
+		{ClusterIndex: 1, Items: thin},
+		{ClusterIndex: 2, Items: separate},
+		{ClusterIndex: 3, Items: tailOnly},
+		{ClusterIndex: 4, Items: drawable},
+	}, main)
+
+	if got := mmrItemIDs(rows[0].Items); !slices.Equal(got, mmrItemIDs(anchorList("x", 12))) {
+		t.Fatalf("overlapping row = %v, want its own 12 titles", got)
+	}
+	if got := mmrItemIDs(rows[4].Items); !slices.Equal(got, mmrItemIDs(anchorList("v", 12))) {
+		t.Fatalf("row sharing the rotation's draw ranks = %v, want its own 12 titles", got)
+	}
+	if rows[1].Items == nil || len(rows[1].Items) != 0 {
+		t.Fatalf("thin row = %#v, want it cached empty", rows[1].Items)
+	}
+	if len(rows[2].Items) != 4 || len(rows[3].Items) != len(tailOnly) {
+		t.Fatalf("rows sharing nothing served = %d and %d items, want them whole", len(rows[2].Items), len(rows[3].Items))
+	}
+}
+
+// A cluster row cached empty was built: reads skip it without asking for a
+// refresh, while a cluster with no cached row still asks.
+func TestReaderSkipsClusterRowsCachedEmpty(t *testing.T) {
+	refresher := &countingReadRefresher{}
+	repo := &fakeReaderRepo{
+		meta: &TasteProfileMeta{SignalCounts: map[string]int{"watch_high": ColdStartFullPersonalized}},
+		clusters: []TasteCluster{
+			{ClusterIdx: 0, Label: "Drama", TotalWeight: 3},
+			{ClusterIdx: 1, Label: "Comedy", TotalWeight: 2},
+		},
+		personal: map[string][]ScoredItem{
+			RecTypeForYouMain + "|":                {{MediaItemID: "main"}},
+			RecTypeForYouClusterPrefix + "0" + "|": {},
+			RecTypeForYouClusterPrefix + "1" + "|": {{MediaItemID: "comedy"}},
+		},
+	}
+	r := &Reader{repo: repo, refresh: refresher, signals: NewSignalReader(&fakeSignalRepo{}, fakeSignalProvider{store: &fakeSignalStore{}})}
+	ctx := t.Context()
+
+	page, err := r.GetForYouPage(ctx, 7, "p1", 20, catalog.AccessFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if labels := rowLabels(page); !slices.Equal(labels, []string{"For You", clusterTitle("Comedy")}) {
+		t.Fatalf("rows = %v, want the main row and the Comedy cluster", labels)
+	}
+	row, err := r.SectionTasteMatchRow(ctx, 7, "p1", "", catalog.AccessFilter{})
+	if err != nil || row == nil || row.ClusterIndex != 1 {
+		t.Fatalf("taste match = %+v, %v; want the Comedy cluster", row, err)
+	}
+	if refresher.calls != 0 {
+		t.Fatalf("refreshes = %d, want none for a row cached empty", refresher.calls)
+	}
+
+	delete(repo.personal, RecTypeForYouClusterPrefix+"0|")
+	if _, err := r.GetForYouPage(ctx, 7, "p1", 20, catalog.AccessFilter{}); err != nil {
+		t.Fatal(err)
+	}
+	if refresher.calls != 1 {
+		t.Fatalf("refreshes = %d, want one for a missing cluster row", refresher.calls)
+	}
+}
+
+// A list anchored on an item keeps its co-watch neighbors to the item's
+// media type, as its embedding candidates are: a movie's Because You Watched
+// row takes no series its viewers also watched.
+func TestCowatchNeighborsKeepTheSourceType(t *testing.T) {
+	if got := cowatchMediaTypes("movie", recommendableMediaTypes); !slices.Equal(got, []string{"movie"}) {
+		t.Fatalf("movie source keeps %v, want movies only", got)
+	}
+	if got := cowatchMediaTypes("", recommendableMediaTypes); !slices.Equal(got, recommendableMediaTypes) {
+		t.Fatalf("unknown source keeps %v, want %v", got, recommendableMediaTypes)
+	}
+}
diff --git a/internal/recommendations/aversion.go b/internal/recommendations/aversion.go
new file mode 100644
index 0000000000..aab4f5821a
--- /dev/null
+++ b/internal/recommendations/aversion.go
@@ -0,0 +1,293 @@
+package recommendations
+
+import (
+	"context"
+	"fmt"
+	"math"
+	"slices"
+	"strings"
+	"time"
+)
+
+// Titles a profile turned away, by marking them Not interested or rating them
+// 1–2 stars, teach its rows without entering the taste vector (see
+// positiveTasteItems). They act on two levels, each measured against the row
+// being built, so the rules hold whatever range of cosines an embedding model
+// gives:
+//
+//   - A turned-away title at the heart of the row, as near the row's query
+//     as its median candidate, pushes down the candidates that sit nearest
+//     it of all the row's: a sequel or near copy goes far down, its
+//     genre-mates barely move. Several such titles add up, so a run of marks
+//     in one area reaches the area.
+//   - Each such title counts against the row's interest the way the
+//     interest's own titles count for it: enough of them shrink the
+//     interest's share of the main row, then drop its row.
+const (
+	// aversionWeightMark and aversionWeightRatedLow are how strongly a fresh
+	// mark and a fresh 1–2 star rating count.
+	aversionWeightMark     = 1.0
+	aversionWeightRatedLow = 0.6
+	// aversionMarkHalfLifeDays is how fast a mark's push fades. The marked
+	// title itself stays out of every row however old the mark is.
+	aversionMarkHalfLifeDays = 365
+	// aversionReachQuantile and aversionReachSD bound the push: only the
+	// candidates nearer a turned-away title than that share of the row's
+	// candidates are pushed, and one aversionReachSD standard deviations of
+	// the row's similarities to the title nearer still gets the title's whole
+	// weight. Measuring within the row keeps a minority genre in a mixed row
+	// from being pushed as a block.
+	aversionReachQuantile = 0.9
+	aversionReachSD       = 2.0
+	// aversionPenaltySD is the largest push, in standard deviations of the
+	// pool's scores. It is several times qualityPriorWeight: the profile
+	// said so itself.
+	aversionPenaltySD = 2.0
+	// aversionInterestTitles is how many fully weighted titles of an
+	// interest one fresh mark at its heart outweighs; aversionInterestFloor
+	// is the share of its weight under which the interest's own row is
+	// dropped.
+	aversionInterestTitles = 4.0
+	aversionInterestFloor  = 0.3
+	// aversionMaxTitles is how many turned-away titles, newest first, a
+	// build reads.
+	aversionMaxTitles = 200
+)
+
+// aversionTitle is one turned-away title: its embedding and its weight now.
+type aversionTitle struct {
+	embedding []float32
+	weight    float64
+}
+
+// aversion is the turned-away titles one row build ranks against. A nil
+// aversion, or one with no titles, changes nothing.
+type aversion struct {
+	titles []aversionTitle
+}
+
+func (a *aversion) empty() bool {
+	return a == nil || len(a.titles) == 0
+}
+
+// size is how many turned-away titles the aversion holds.
+func (a *aversion) size() int {
+	if a == nil {
+		return 0
+	}
+	return len(a.titles)
+}
+
+// aversionResult is what applying an aversion to one pool found.
+type aversionResult struct {
+	// penalized is how many candidates were pushed down.
+	penalized int
+	// central is the summed weight of the turned-away titles at the heart
+	// of the row's interest.
+	central float64
+}
+
+// interestShare is the share of an interest of the given weight left after
+// res's turned-away titles at its heart: 1 when there are none.
+func (res aversionResult) interestShare(weight float64) float64 {
+	if res.central <= 0 {
+		return 1
+	}
+	if weight <= 0 {
+		return 0
+	}
+	return weight / (weight + aversionInterestTitles*res.central)
+}
+
+// apply lowers each candidate's Score by its aversion and returns the pool,
+// in its order, with what it found. query is what the pool was fetched
+// around: a taste vector, cluster centroid or source title. A pool without a
+// query, or whose candidates lack embeddings, is returned unchanged.
+func (a *aversion) apply(pool []ScoredItem, embeddings map[string][]float32, query []float32) ([]ScoredItem, aversionResult) {
+	var res aversionResult
+	if a.empty() || len(pool) == 0 || len(query) == 0 {
+		return pool, res
+	}
+	type candidate struct {
+		index int
+		emb   []float32
+	}
+	candidates := make([]candidate, 0, len(pool))
+	querySims := make([]float64, 0, len(pool))
+	for i, item := range pool {
+		emb := embeddings[item.MediaItemID]
+		if emb == nil {
+			continue
+		}
+		candidates = append(candidates, candidate{i, emb})
+		querySims = append(querySims, cosineSimilarity(query, emb))
+	}
+	if len(candidates) < 2 {
+		return pool, res
+	}
+	median := quantile(querySims, 0.5)
+
+	// keep[i] is 1 minus the aversion of candidates[i] so far.
+	keep := make([]float64, len(candidates))
+	for i := range keep {
+		keep[i] = 1
+	}
+	sims := make([]float64, len(candidates))
+	for _, title := range a.titles {
+		// A title less near the row's query than its median candidate is
+		// not one the row is about, and says nothing about it.
+		if cosineSimilarity(title.embedding, query) < median {
+			continue
+		}
+		res.central += title.weight
+		for i, c := range candidates {
+			sims[i] = cosineSimilarity(c.emb, title.embedding)
+		}
+		_, sd := meanSD(sims)
+		if sd == 0 {
+			continue
+		}
+		start := quantile(sims, aversionReachQuantile)
+		for i := range candidates {
+			reach := min(1, max(0, (sims[i]-start)/(aversionReachSD*sd)))
+			keep[i] *= 1 - reach*title.weight
+		}
+	}
+
+	scores := make([]float64, len(pool))
+	for i, item := range pool {
+		scores[i] = item.Score
+	}
+	_, scoreSD := meanSD(scores)
+	if scoreSD == 0 {
+		// Equal scores: push by a tenth of the score, so a turned-away
+		// neighbor still falls behind its peers.
+		scoreSD = math.Abs(scores[0]) / 10
+	}
+	out := slices.Clone(pool)
+	for i, c := range candidates {
+		if averse := 1 - keep[i]; averse > 0 {
+			out[c.index].Score -= aversionPenaltySD * scoreSD * averse
+			res.penalized++
+		}
+	}
+	return out, res
+}
+
+// quantile returns the q-quantile of values, which must not be empty, by
+// linear interpolation between the nearest ranks.
+func quantile(values []float64, q float64) float64 {
+	sorted := slices.Sorted(slices.Values(values))
+	pos := q * float64(len(sorted)-1)
+	lo := int(pos)
+	if lo >= len(sorted)-1 {
+		return sorted[len(sorted)-1]
+	}
+	return sorted[lo] + (pos-float64(lo))*(sorted[lo+1]-sorted[lo])
+}
+
+// loadAversion reads the turned-away titles the profile's rows are built
+// against at now.
+func (e *Engine) loadAversion(ctx context.Context, userID int, profileID string, now time.Time) (*aversion, error) {
+	marks, err := e.signalReader().NotInterestedMarks(ctx, userID, profileID)
+	if err != nil {
+		return nil, err
+	}
+	marked := make([]datedTitle, len(marks))
+	for i, m := range marks {
+		marked[i] = datedTitle{m.MediaItemID, m.MarkedAt}
+	}
+	var low []datedTitle
+	if e.ratingsRepo != nil {
+		ratings, err := e.ratingsRepo.ListAll(ctx, userID, profileID)
+		if err != nil {
+			return nil, fmt.Errorf("list ratings: %w", err)
+		}
+		var ids []string
+		for _, r := range ratings {
+			if r.Rating <= DislikedRatingMax {
+				ids = append(ids, r.MediaItemID)
+			}
+		}
+		canonical, err := e.repo.ResolveCanonicalItemIDs(ctx, ids)
+		if err != nil {
+			return nil, fmt.Errorf("resolve low-rated item IDs: %w", err)
+		}
+		for _, r := range ratings {
+			if r.Rating > DislikedRatingMax {
+				continue
+			}
+			id := r.MediaItemID
+			if c := canonical[id]; c != "" {
+				id = c
+			}
+			low = append(low, datedTitle{id, r.RatedAt})
+		}
+	}
+	halfLife := e.cfg.TasteDecayHalfLifeDays
+	if halfLife == 0 {
+		halfLife = 180
+	}
+	return buildAversion(ctx, e.repo, marked, low, now, halfLife)
+}
+
+// aversionEmbeddings reads turned-away titles' embeddings. *Repo implements
+// it.
+type aversionEmbeddings interface {
+	GetBatchEmbeddings(ctx context.Context, itemIDs []string) (map[string][]float32, error)
+}
+
+// datedTitle is a canonical title and when the profile turned it away.
+type datedTitle struct {
+	id string
+	at time.Time
+}
+
+// buildAversion weighs the profile's turned-away titles at now: its Not
+// interested marks and its 1–2 star ratings, newest first, at most
+// aversionMaxTitles, each decayed by its age. A title both marked and rated
+// low counts once, as the heavier. Titles without an embedding are left out.
+func buildAversion(ctx context.Context, store aversionEmbeddings, marks, lowRatings []datedTitle, now time.Time, ratingHalfLifeDays float64) (*aversion, error) {
+	type weighed struct {
+		at     time.Time
+		weight float64
+	}
+	byID := make(map[string]weighed, len(marks)+len(lowRatings))
+	add := func(id string, at time.Time, weight float64) {
+		if prev, ok := byID[id]; ok && prev.weight >= weight {
+			return
+		}
+		byID[id] = weighed{at, weight}
+	}
+	for _, m := range marks {
+		add(m.id, m.at, aversionWeightMark*timeDecay(m.at, now, aversionMarkHalfLifeDays))
+	}
+	for _, r := range lowRatings {
+		add(r.id, r.at, aversionWeightRatedLow*timeDecay(r.at, now, ratingHalfLifeDays))
+	}
+	if len(byID) == 0 {
+		return &aversion{}, nil
+	}
+	ids := make([]string, 0, len(byID))
+	for id := range byID {
+		ids = append(ids, id)
+	}
+	slices.SortFunc(ids, func(x, y string) int {
+		if c := byID[y].at.Compare(byID[x].at); c != 0 {
+			return c
+		}
+		return strings.Compare(x, y)
+	})
+	ids = ids[:min(len(ids), aversionMaxTitles)]
+	embeddings, err := store.GetBatchEmbeddings(ctx, ids)
+	if err != nil {
+		return nil, fmt.Errorf("turned-away title embeddings: %w", err)
+	}
+	a := &aversion{titles: make([]aversionTitle, 0, len(ids))}
+	for _, id := range ids {
+		if emb := embeddings[id]; emb != nil {
+			a.titles = append(a.titles, aversionTitle{embedding: emb, weight: byID[id].weight})
+		}
+	}
+	return a, nil
+}
diff --git a/internal/recommendations/aversion_test.go b/internal/recommendations/aversion_test.go
new file mode 100644
index 0000000000..ec99badeb7
--- /dev/null
+++ b/internal/recommendations/aversion_test.go
@@ -0,0 +1,296 @@
+package recommendations
+
+import (
+	"math"
+	"math/rand/v2"
+	"reflect"
+	"slices"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+)
+
+// avertedRows builds persona p's main and cluster rows the way the cache
+// build does, with turnedAway added to the titles every row leaves out and
+// ranked against, and near ranked against as turned-away titles that are not
+// in the catalog. Every turned-away title has full weight. With neither, the
+// rows are ranked against an empty aversion.
+func avertedRows(t *testing.T, c *toyCatalog, p persona, turnedAway []string, near ...[]float32) personaRows {
+	t.Helper()
+	b, store, exclude := personaBuilder(t, c, p, func(*toyStore) {})
+	exclude = append(exclude, turnedAway...)
+	av := &aversion{}
+	for _, id := range turnedAway {
+		av.titles = append(av.titles, aversionTitle{embedding: c.byID[id].vec, weight: 1})
+	}
+	for _, emb := range near {
+		av.titles = append(av.titles, aversionTitle{embedding: emb, weight: 1})
+	}
+	b.aversion = av
+	return buildRows(t, b, store, p, c, exclude)
+}
+
+// excludedRows builds persona p's rows with excluded left out and nothing
+// ranked against: what the rows would be if marks only hid their titles.
+func excludedRows(t *testing.T, c *toyCatalog, p persona, excluded []string) personaRows {
+	t.Helper()
+	b, store, exclude := personaBuilder(t, c, p, func(*toyStore) {})
+	return buildRows(t, b, store, p, c, append(exclude, excluded...))
+}
+
+func buildRows(t *testing.T, b rowBuilder, store *toyStore, p persona, c *toyCatalog, exclude []string) personaRows {
+	t.Helper()
+	ctx := t.Context()
+	main, err := b.mainRow(ctx, 1, "p", CacheCandidateLimit, exclude, catalog.AccessFilter{})
+	if err != nil || main == nil {
+		t.Fatalf("%s: main row: %v, %v", p.name, main, err)
+	}
+	clusters, _, err := b.clusterRows(ctx, 1, "p", CacheCandidateLimit, exclude, catalog.AccessFilter{})
+	if err != nil {
+		t.Fatalf("%s: cluster rows: %v", p.name, err)
+	}
+	return personaRows{persona: p, catalog: c, store: store, exclude: exclude, main: main.Items, clusters: clusters}
+}
+
+// nearCopy returns vec nudged by a little noise and renormalized: a sequel
+// or remake of the title, as an embedding model sees it.
+func nearCopy(vec []float32, seed uint64) []float32 {
+	rng := rand.New(rand.NewPCG(seed, 1))
+	out := make([]float32, len(vec))
+	var norm float64
+	for i, v := range vec {
+		x := float64(v) + 0.03*rng.NormFloat64()
+		out[i] = float32(x)
+		norm += x * x
+	}
+	norm = math.Sqrt(norm)
+	for i := range out {
+		out[i] = float32(float64(out[i]) / norm)
+	}
+	return out
+}
+
+// primaryGenre returns the ids of items whose primary genre is genre.
+func primaryGenre(c *toyCatalog, items []ScoredItem, genre string) []string {
+	var ids []string
+	for _, item := range items {
+		if c.byID[item.MediaItemID].genres[0] == genre {
+			ids = append(ids, item.MediaItemID)
+		}
+	}
+	return ids
+}
+
+// A profile that turned nothing away gets exactly the rows it got before
+// turned-away titles were ranked against.
+func TestAversionWithoutTitlesChangesNothing(t *testing.T) {
+	c := newToyCatalog()
+	for key, p := range relevancePersonas(c) {
+		before := buildPersonaRows(t, c, p)
+		after := avertedRows(t, c, p, nil)
+		if !reflect.DeepEqual(before.main, after.main) || !reflect.DeepEqual(before.clusters, after.clusters) {
+			t.Fatalf("persona %s: rows changed with no turned-away titles", key)
+		}
+	}
+}
+
+// One mark sends a near copy of the title, a sequel, out of the served
+// window. Its closest neighbors may trade places with others of their genre,
+// but the window's genre mix moves by at most one title a genre, and the row
+// keeps its length.
+func TestAversionPushesANearCopyOutOfTheServedWindow(t *testing.T) {
+	c := newToyCatalog()
+	a := relevancePersonas(c)["A"]
+	before := buildPersonaRows(t, c, a)
+	window := served(before.main)
+	for i, item := range window[:5] {
+		sequelOf := item.MediaItemID
+		after := avertedRows(t, c, a, nil, nearCopy(c.byID[sequelOf].vec, uint64(i+1)))
+		got := served(after.main)
+		if slices.Contains(scoredItemIDs(got), sequelOf) {
+			t.Fatalf("a near copy of %s was marked, but it is still served", sequelOf)
+		}
+		for _, g := range toyGenres {
+			if was, now := before.tasteCount(window, g.name), after.tasteCount(got, g.name); now < was-1 || now > was+1 {
+				t.Fatalf("marking a near copy of %s moved %s from %d to %d served titles", sequelOf, g.name, was, now)
+			}
+		}
+		if len(after.main) != len(before.main) {
+			t.Fatalf("marking a near copy of %s left a row of %d, was %d", sequelOf, len(after.main), len(before.main))
+		}
+	}
+}
+
+// A single mark costs its genre at most a couple of slots: it says "not this
+// title", not "not this genre". Marks in one area add up, shrinking the
+// area's share of the window step by step without shortening the row.
+func TestAversionMarksInOneAreaAddUp(t *testing.T) {
+	c := newToyCatalog()
+	a := relevancePersonas(c)["A"]
+	thrillers := primaryGenre(c, buildPersonaRows(t, c, a).main, gThriller)
+	if len(thrillers) < 12 {
+		t.Fatalf("persona A's main row holds %d thrillers, want 12 to mark", len(thrillers))
+	}
+	share := func(r personaRows) float64 { return r.share(served(r.main), gThriller) }
+
+	one := thrillers[:1]
+	if hidden, ranked := share(excludedRows(t, c, a, one)), share(avertedRows(t, c, a, one)); hidden-ranked > 0.1 {
+		t.Fatalf("one thriller mark took thrillers from %.2f to %.2f of the served window", hidden, ranked)
+	}
+
+	previous := 1.0
+	for _, n := range []int{1, 4, 8, 12} {
+		marked := thrillers[:n]
+		r := avertedRows(t, c, a, marked)
+		if got := share(r); got > previous {
+			t.Fatalf("%d thriller marks serve more thrillers (%.2f) than fewer marks did (%.2f)", n, got, previous)
+		} else {
+			previous = got
+		}
+		if len(r.main) != CacheCandidateLimit {
+			t.Fatalf("%d marks left a main row of %d, want %d", n, len(r.main), CacheCandidateLimit)
+		}
+	}
+	marked := thrillers[:8]
+	if hidden, ranked := share(excludedRows(t, c, a, marked)), share(avertedRows(t, c, a, marked)); hidden-ranked < 0.15 {
+		t.Fatalf("eight thriller marks took thrillers only from %.2f to %.2f of the served window", hidden, ranked)
+	}
+}
+
+// Marks at the heart of a small interest drop its own row and its share of
+// the main row; a large interest the profile mostly kept watching keeps its
+// row through as many marks.
+func TestAversionDropsAnInterestTurnedAway(t *testing.T) {
+	c := newToyCatalog()
+	a := relevancePersonas(c)["A"]
+	before := buildPersonaRows(t, c, a)
+	smallest, largest := -1, -1
+	for i, cl := range before.store.clusters {
+		if smallest < 0 || cl.TotalWeight < before.store.clusters[smallest].TotalWeight {
+			smallest = i
+		}
+		if largest < 0 || cl.TotalWeight > before.store.clusters[largest].TotalWeight {
+			largest = i
+		}
+	}
+	rowOf := func(r personaRows, idx int) []ScoredItem {
+		for _, row := range r.clusters {
+			if row.ClusterIndex == before.store.clusters[idx].ClusterIdx {
+				return row.Items
+			}
+		}
+		t.Fatalf("no row for cluster %d", idx)
+		return nil
+	}
+	small := scoredItemIDs(rowOf(before, smallest))[:4]
+	after := avertedRows(t, c, a, small)
+	if got := rowOf(after, smallest); len(got) != 0 {
+		t.Fatalf("four marks at the heart of the smallest interest (weight %.1f) left its row with %d items",
+			before.store.clusters[smallest].TotalWeight, len(got))
+	}
+	if len(after.main) != CacheCandidateLimit {
+		t.Fatalf("main row of %d, want %d", len(after.main), CacheCandidateLimit)
+	}
+
+	large := scoredItemIDs(rowOf(before, largest))[:4]
+	if got := rowOf(avertedRows(t, c, a, large), largest); len(got) == 0 {
+		t.Fatalf("four marks dropped the largest interest's row (weight %.1f)", before.store.clusters[largest].TotalWeight)
+	}
+}
+
+// A turned-away title no row would offer leaves every row as hiding it
+// alone would.
+func TestAversionIgnoresTitlesTheRowsWouldNotOffer(t *testing.T) {
+	c := newToyCatalog()
+	kid := relevancePersonas(c)["C"]
+	horror := c.pick(gHorror, "movie", 0, 3)
+	hidden, ranked := excludedRows(t, c, kid, horror), avertedRows(t, c, kid, horror)
+	if !reflect.DeepEqual(hidden.main, ranked.main) || !reflect.DeepEqual(hidden.clusters, ranked.clusters) {
+		t.Fatal("horror marks moved a kid's animation rows")
+	}
+}
+
+// interestShare weighs the turned-away titles at an interest's heart against
+// the interest's own weight.
+func TestAversionInterestShare(t *testing.T) {
+	for _, tc := range []struct {
+		central, weight, want float64
+	}{
+		{0, 10, 1},
+		{1, 4, 0.5},
+		{2, 4, 1.0 / 3},
+		{1, 0, 0},
+	} {
+		if got := (aversionResult{central: tc.central}).interestShare(tc.weight); math.Abs(got-tc.want) > 1e-9 {
+			t.Fatalf("interestShare(central %v, weight %v) = %v, want %v", tc.central, tc.weight, got, tc.want)
+		}
+	}
+}
+
+// clusterRowIDs returns the item IDs of persona p's cluster rows, by cluster
+// index, as built with no turned-away titles.
+func clusterRowIDs(r personaRows) map[int][]string {
+	out := map[int][]string{}
+	for _, row := range r.clusters {
+		out[row.ClusterIndex] = scoredItemIDs(row.Items)
+	}
+	return out
+}
+
+// When marks drop a dominant interest, the small interest left fetches again
+// for the slots it gained: the main row keeps its length rather than ending
+// where the small interest's first, small fetch ran out.
+func TestAversionRefillsTheMainRowAfterDroppingAnInterest(t *testing.T) {
+	c := newToyCatalog()
+	a := relevancePersonas(c)["A"]
+	before := buildPersonaRows(t, c, a)
+	clusters := clustersHeaviestFirst(before.store.clusters)
+	heavy, light := clusters[0], clusters[len(clusters)-1]
+	anchors := []mainRowAnchor{
+		{embedding: heavy.Embedding, weight: 9},
+		{embedding: light.Embedding, weight: 1},
+	}
+	if slots := allocateAnchorSlots([]float64{9, 1}, CacheCandidateLimit); anchorPoolFactor*slots[1] >= CacheCandidateLimit {
+		t.Fatalf("slots %v leave the light anchor a full row of candidates; the test needs it short", slots)
+	}
+	b, _, exclude := personaBuilder(t, c, a, func(*toyStore) {})
+	marked := clusterRowIDs(before)[heavy.ClusterIdx][:20]
+	b.aversion = &aversion{}
+	for _, id := range marked {
+		b.aversion.titles = append(b.aversion.titles, aversionTitle{embedding: c.byID[id].vec, weight: 1})
+	}
+	row, _, allAverted, err := b.anchoredRow(t.Context(), anchors, CacheCandidateLimit, append(exclude, marked...), catalog.AccessFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if allAverted {
+		t.Fatal("the light interest was turned away too; the test needs it kept")
+	}
+	if len(row) != CacheCandidateLimit {
+		t.Fatalf("composed row of %d after dropping the dominant interest, want %d", len(row), CacheCandidateLimit)
+	}
+}
+
+// A profile that turned away every interest gets a main row built empty,
+// rather than a row around its averaged taste that would serve those
+// interests again.
+func TestAversionDropsTheMainRowWhenEveryInterestIsTurnedAway(t *testing.T) {
+	c := newToyCatalog()
+	a := relevancePersonas(c)["A"]
+	var marked []string
+	for _, ids := range clusterRowIDs(buildPersonaRows(t, c, a)) {
+		marked = append(marked, ids[:min(len(ids), 25)]...)
+	}
+	b, _, exclude := personaBuilder(t, c, a, func(*toyStore) {})
+	b.aversion = &aversion{}
+	for _, id := range marked {
+		b.aversion.titles = append(b.aversion.titles, aversionTitle{embedding: c.byID[id].vec, weight: 1})
+	}
+	main, err := b.mainRow(t.Context(), 1, "p", CacheCandidateLimit, append(exclude, marked...), catalog.AccessFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if main == nil || len(main.Items) != 0 {
+		t.Fatalf("main row %v after every interest was turned away, want one built empty", main)
+	}
+}
diff --git a/internal/recommendations/cluster.go b/internal/recommendations/cluster.go
index 8c45d7d54b..1901ee24c1 100644
--- a/internal/recommendations/cluster.go
+++ b/internal/recommendations/cluster.go
@@ -1,8 +1,10 @@
 package recommendations
 
 import (
+	"cmp"
 	"math"
 	"math/rand"
+	"slices"
 	"sort"
 	"strings"
 	"time"
@@ -23,25 +25,62 @@ const kmeansMaxIterations = 50
 // kmeansConvergenceThreshold is the minimum centroid movement to continue iterating.
 const kmeansConvergenceThreshold = 1e-6
 
-// kmeansMinClusterSize is the minimum number of members a cluster must have
-// before it gets merged into a neighbor.
+// kmeansMinClusterSize is the fewest titles a taste cluster holds; a smaller
+// one is merged into a neighbor.
 const kmeansMinClusterSize = 3
 
+// kmeansMaxClusters is the most taste clusters a profile gets.
+const kmeansMaxClusters = 5
+
+// A single k-means++ seeding can settle on a poor partition: two seeds in one
+// interest leave a sliver cluster that merging then folds away, and with it
+// every other interest. Each cluster count is tried with up to kmeansRestarts
+// seedings, as many as kmeansRestartBudget titles allow, so a profile of 200
+// titles costs about what one of 1,500 always did, and one of 800 or more
+// runs once.
+const (
+	kmeansRestarts      = 8
+	kmeansRestartBudget = 800
+)
+
+// kmeansMinSilhouette is the silhouette a partition into more clusters than
+// determinClusterCount gives must reach to be chosen. Distinct interests in
+// real profiles score 0.13 to 0.22; one interest cut into parts scores under
+// 0.08, where the best count changes with any new title.
+const kmeansMinSilhouette = 0.1
+
 // kmeansCluster partitions items into k groups using k-means with k-means++
-// initialization. Centroids are computed as weighted averages using each item's
-// signal weight and are L2-normalized after each update. Returns a slice of
-// length len(items) mapping each item index to its assigned cluster index.
+// initialization, seeded by kmeansSeed. Returns a slice of length len(items)
+// mapping each item index to its assigned cluster index.
 func kmeansCluster(items []clusterItem, k int) []int {
+	assignments, _ := kmeansRun(items, k, kmeansSeed(items, k))
+	return assignments
+}
+
+// kmeansRestartSeed is the seed of restart r of k-means over items; restart 0
+// uses kmeansSeed itself.
+func kmeansRestartSeed(items []clusterItem, k, r int) int64 {
+	return kmeansSeed(items, k) ^ int64(r)*0x5851f42d4c957f2d
+}
+
+// kmeansRun partitions items into k groups using k-means with k-means++
+// initialization from seed. Centroids are computed as weighted averages using
+// each item's signal weight and are L2-normalized after each update. Returns a
+// slice of length len(items) mapping each item index to its assigned cluster
+// index, and the partition's inertia: the sum of the items' squared distances
+// to their centroids. It leaves weights out, so a choice between partitions
+// by inertia does not change as the weights decay.
+func kmeansRun(items []clusterItem, k int, seed int64) ([]int, float64) {
 	n := len(items)
 	if n == 0 || k <= 0 {
-		return nil
+		return nil, 0
 	}
 	if k > n {
 		k = n
 	}
 
 	dims := len(items[0].embedding)
-	rng := rand.New(rand.NewSource(kmeansSeed(items, k)))
+	rng := rand.New(rand.NewSource(seed))
 
 	// --- k-means++ initialization ---
 	// Select the first centroid uniformly at random.
@@ -140,6 +179,7 @@ func kmeansCluster(items []clusterItem, k int) []int {
 	}
 
 	// Final assignment pass to ensure consistency with final centroids.
+	inertia := 0.0
 	for i := range items {
 		bestCluster := 0
 		bestDist := math.MaxFloat64
@@ -151,11 +191,15 @@ func kmeansCluster(items []clusterItem, k int) []int {
 			}
 		}
 		assignments[i] = bestCluster
+		inertia += bestDist
 	}
 
-	return assignments
+	return assignments, inertia
 }
 
+// kmeansSeed derives the k-means seed from k and the item IDs only. Weights
+// decay with time, so seeding from them reshuffled the clusters on every
+// rebuild even when the profile's titles had not changed.
 func kmeansSeed(items []clusterItem, k int) int64 {
 	seed := int64(1469598103934665603)
 	seed = seed*1099511628211 + int64(k)
@@ -164,7 +208,8 @@ func kmeansSeed(items []clusterItem, k int) int64 {
 			seed ^= int64(b)
 			seed *= 1099511628211
 		}
-		seed ^= int64(math.Float64bits(item.weight))
+		// Separate IDs, so "ab","c" and "a","bc" seed differently.
+		seed ^= 0xff
 		seed *= 1099511628211
 	}
 	if seed == 0 {
@@ -270,6 +315,137 @@ func mergSmallClusters(items []clusterItem, assignments []int, k int) []int {
 	return compactAssignments(assignments)
 }
 
+// clusterAssignments partitions items into taste clusters. A profile under 10
+// titles has one. A larger one gets determinClusterCount clusters, or more,
+// up to kmeansMaxClusters, when a partition into more scores a higher
+// silhouette and at least kmeansMinSilhouette. The silhouette compares each
+// title's distance to its own cluster with its distance to the nearest other,
+// so it judges interests against the profile's own spread: a third interest
+// of three titles gets a cluster of its own, while one interest is not cut up
+// for the sake of a count. Each count's partition is its best seeding (see
+// bestSeeding). When determinClusterCount's count has none, and no larger
+// count qualifies, that count's first seeding has its small clusters merged.
+func clusterAssignments(items []clusterItem) []int {
+	n := len(items)
+	minK := determinClusterCount(n)
+	if minK <= 1 {
+		return make([]int, n)
+	}
+	maxK := max(minK, min(kmeansMaxClusters, n/kmeansMinClusterSize))
+	restarts := max(1, min(kmeansRestarts, kmeansRestartBudget/n))
+
+	var best, fallback []int
+	bestScore := math.Inf(-1)
+	var distances [][]float64
+	for k := minK; k <= maxK; k++ {
+		assignments, first := bestSeeding(items, k, restarts)
+		if k == minK {
+			fallback = first
+		}
+		if assignments == nil {
+			continue
+		}
+		if minK == maxK {
+			return compactAssignments(assignments)
+		}
+		// Only profiles under 200 titles get here: from 200,
+		// determinClusterCount is already kmeansMaxClusters, so minK == maxK
+		// above. The n x n matrix stays under 200 x 200.
+		if distances == nil {
+			distances = cosineDistances(items)
+		}
+		score := silhouette(distances, assignments)
+		if k > minK && score < kmeansMinSilhouette {
+			continue
+		}
+		if score > bestScore {
+			best, bestScore = assignments, score
+		}
+	}
+	if best == nil {
+		return mergSmallClusters(items, fallback, minK)
+	}
+	return compactAssignments(best)
+}
+
+// bestSeeding partitions items into k clusters with restarts k-means++
+// seedings and returns the partition with the lowest inertia whose clusters
+// all hold kmeansMinClusterSize items, or nil when no seeding gives one, and
+// the first seeding's partition, which is kmeansCluster's.
+func bestSeeding(items []clusterItem, k, restarts int) (best, first []int) {
+	bestInertia := math.Inf(1)
+	for r := range restarts {
+		assignments, inertia := kmeansRun(items, k, kmeansRestartSeed(items, k, r))
+		if r == 0 {
+			first = assignments
+		}
+		if inertia < bestInertia && clustersHoldMinimum(assignments, k) {
+			best, bestInertia = assignments, inertia
+		}
+	}
+	return best, first
+}
+
+// clustersHoldMinimum reports whether each of the k clusters of assignments
+// holds at least kmeansMinClusterSize items.
+func clustersHoldMinimum(assignments []int, k int) bool {
+	return !slices.ContainsFunc(clusterSizes(assignments, k), func(size int) bool { return size < kmeansMinClusterSize })
+}
+
+// clusterSizes counts the items assignments puts in each of k clusters.
+func clusterSizes(assignments []int, k int) []int {
+	sizes := make([]int, k)
+	for _, c := range assignments {
+		sizes[c]++
+	}
+	return sizes
+}
+
+// cosineDistances returns the cosine distance, 1 - cosine similarity, between
+// every pair of items.
+func cosineDistances(items []clusterItem) [][]float64 {
+	d := make([][]float64, len(items))
+	for i := range d {
+		d[i] = make([]float64, len(items))
+	}
+	for i := range items {
+		for j := i + 1; j < len(items); j++ {
+			dist := 1 - cosineSimilarity(items[i].embedding, items[j].embedding)
+			d[i][j], d[j][i] = dist, dist
+		}
+	}
+	return d
+}
+
+// silhouette is the mean silhouette of a partition, from -1 to 1: for each
+// item, how much nearer it is, on average, to its own cluster's other members
+// than to the members of the nearest other cluster.
+func silhouette(distances [][]float64, assignments []int) float64 {
+	k := slices.Max(assignments) + 1
+	sizes := clusterSizes(assignments, k)
+	total := 0.0
+	for i, own := range assignments {
+		if sizes[own] < 2 {
+			continue // a lone member scores 0
+		}
+		sums := make([]float64, k)
+		for j, c := range assignments {
+			sums[c] += distances[i][j]
+		}
+		within := sums[own] / float64(sizes[own]-1)
+		nearest := math.Inf(1)
+		for c := range k {
+			if c != own && sizes[c] > 0 {
+				nearest = min(nearest, sums[c]/float64(sizes[c]))
+			}
+		}
+		if spread := max(within, nearest); spread > 0 {
+			total += (nearest - within) / spread
+		}
+	}
+	return total / float64(len(assignments))
+}
+
 // compactAssignments remaps cluster indices to be contiguous starting from 0.
 func compactAssignments(assignments []int) []int {
 	seen := make(map[int]int)
@@ -305,14 +481,8 @@ func buildTasteClusters(items []clusterItem) []TasteCluster {
 		return nil
 	}
 
-	// Step 1: Determine how many clusters to target.
-	k := determinClusterCount(len(valid))
-
-	// Step 2: Run k-means clustering.
-	assignments := kmeansCluster(valid, k)
-
-	// Step 3: Merge clusters that are too small.
-	assignments = mergSmallClusters(valid, assignments, k)
+	// Steps 1-3: Choose the cluster count and partition the items.
+	assignments := clusterAssignments(valid)
 
 	// Step 4: Build the output TasteCluster for each cluster.
 	clusterMap := make(map[int][]int) // cluster index -> item indices
@@ -327,6 +497,15 @@ func buildTasteClusters(items []clusterItem) []TasteCluster {
 	}
 	sort.Ints(clusterIndices)
 
+	// The profile's own genre mix is the baseline a cluster's label is
+	// measured against.
+	profileGenres := make(map[string]int)
+	for _, item := range valid {
+		for _, g := range distinctGenres(item.genres) {
+			profileGenres[g]++
+		}
+	}
+
 	clusters := make([]TasteCluster, 0, len(clusterIndices))
 	for _, ci := range clusterIndices {
 		memberIndices := clusterMap[ci]
@@ -335,9 +514,11 @@ func buildTasteClusters(items []clusterItem) []TasteCluster {
 		vecs := make([][]float32, len(memberIndices))
 		weights := make([]float64, len(memberIndices))
 		genreCounts := make(map[string]int)
+		members := make([]clusterItem, len(memberIndices))
 		totalWeight := 0.0
 
 		for j, idx := range memberIndices {
+			members[j] = valid[idx]
 			vecs[j] = valid[idx].embedding
 			weights[j] = valid[idx].weight
 			totalWeight += valid[idx].weight
@@ -352,8 +533,7 @@ func buildTasteClusters(items []clusterItem) []TasteCluster {
 		// Determine dominant genres (top 3 by frequency).
 		dominantGenres := topNGenres(genreCounts, 3)
 
-		// Build a human-readable label from the dominant genres.
-		label := buildClusterLabel(dominantGenres)
+		label := clusterLabel(members, profileGenres, len(valid))
 
 		clusters = append(clusters, TasteCluster{
 			ClusterIdx:     ci,
@@ -400,13 +580,123 @@ func topNGenres(counts map[string]int, n int) []string {
 	return result
 }
 
-// buildClusterLabel creates a display label by joining genre names with " & ".
-// Returns "Mixed" if no genres are available.
-func buildClusterLabel(genres []string) string {
-	if len(genres) == 0 {
-		return "Mixed"
+// clustersHeaviestFirst returns a copy of clusters ordered by total weight,
+// heaviest first, ties by cluster index.
+func clustersHeaviestFirst(clusters []TasteCluster) []TasteCluster {
+	sorted := slices.Clone(clusters)
+	slices.SortStableFunc(sorted, func(a, b TasteCluster) int {
+		if c := cmp.Compare(b.TotalWeight, a.TotalWeight); c != 0 {
+			return c
+		}
+		return cmp.Compare(a.ClusterIdx, b.ClusterIdx)
+	})
+	return sorted
+}
+
+// A cluster's label names what sets it apart from the profile's other
+// interests, not merely what is common: Drama runs through most taste
+// clusters, so the most frequent genres would name nearly every cluster the
+// same. The thresholds were tuned on synthetic profiles.
+const (
+	// labelMinShare is the fewest of a cluster's members, as a share, that
+	// must carry a distinctive genre.
+	labelMinShare = 0.40
+	// labelMinLift is how many times more often the cluster's members must
+	// carry a distinctive genre than the profile's titles do.
+	labelMinLift = 1.5
+	// labelMaxGenres is the most genres a label names.
+	labelMaxGenres = 2
+	// clusterLabelSeparator joins a label's genres. It is not " & ", which
+	// TMDB genres such as "Sci-Fi & Fantasy" already contain.
+	clusterLabelSeparator = ", "
+)
+
+// clusterLabel labels the cluster of members against a profile whose
+// profileTitles titles carry each genre profileGenres times. It names the
+// cluster's distinctive genres, those at least labelMinShare of the members
+// carry and carry at least labelMinLift times as often as the profile's
+// titles do, the most distinctive first, and the cluster's most common
+// genre, which its row's titles mostly carry, in at most labelMaxGenres
+// genres. Every genre named is on at least labelMinShare of the members, so
+// the row largely carries it. A cluster with no distinctive genre,
+// such as a profile's only cluster, is labeled by its most common genre
+// alone, and one whose most common genre is on fewer members, or whose
+// members carry no genres, gets "".
+func clusterLabel(members []clusterItem, profileGenres map[string]int, profileTitles int) string {
+	counts := make(map[string]int)
+	weights := make(map[string]float64)
+	for _, m := range members {
+		for _, g := range distinctGenres(m.genres) {
+			counts[g]++
+			weights[g] += m.weight
+		}
+	}
+	if len(counts) == 0 {
+		return ""
+	}
+	// The most common genre; a tie goes to the genre of the heavier titles,
+	// which pull the cluster's centroid, and its row, toward them.
+	moreCommon := func(g, than string) bool {
+		switch {
+		case counts[g] != counts[than]:
+			return counts[g] > counts[than]
+		case weights[g] != weights[than]:
+			return weights[g] > weights[than]
+		default:
+			return g < than
+		}
+	}
+	common := ""
+	for g := range counts {
+		if common == "" || moreCommon(g, common) {
+			common = g
+		}
+	}
+
+	type candidate struct {
+		genre       string
+		share, lift float64
+	}
+	var distinctive []candidate
+	for g, n := range counts {
+		share := float64(n) / float64(len(members))
+		base := float64(profileGenres[g]) / float64(max(profileTitles, 1))
+		if share < labelMinShare || base <= 0 {
+			continue
+		}
+		if lift := share / base; lift >= labelMinLift {
+			distinctive = append(distinctive, candidate{g, share, lift})
+		}
+	}
+	sort.Slice(distinctive, func(i, j int) bool {
+		a, b := distinctive[i], distinctive[j]
+		if a.lift != b.lift {
+			return a.lift > b.lift
+		}
+		if a.share != b.share {
+			return a.share > b.share
+		}
+		return a.genre < b.genre
+	})
+
+	// The most common genre and the most distinctive others, in order of
+	// distinction; the most common genre goes last when it is not
+	// distinctive.
+	genres := make([]string, 0, labelMaxGenres)
+	others := 0
+	for _, c := range distinctive {
+		switch {
+		case c.genre == common:
+			genres = append(genres, c.genre)
+		case others < labelMaxGenres-1:
+			genres = append(genres, c.genre)
+			others++
+		}
+	}
+	if !slices.Contains(genres, common) && float64(counts[common])/float64(len(members)) >= labelMinShare {
+		genres = append(genres, common)
 	}
-	return strings.Join(genres, " & ")
+	return strings.Join(genres, clusterLabelSeparator)
 }
 
 // --- Vector math helpers ---
diff --git a/internal/recommendations/cluster_test.go b/internal/recommendations/cluster_test.go
new file mode 100644
index 0000000000..90efb4efbb
--- /dev/null
+++ b/internal/recommendations/cluster_test.go
@@ -0,0 +1,269 @@
+package recommendations
+
+import (
+	"fmt"
+	"maps"
+	"math"
+	"math/rand/v2"
+	"slices"
+	"strings"
+	"testing"
+)
+
+// tasteItems returns two well-separated groups of items whose weights are
+// scaled per item by weight(i), the way time decay changes them between
+// rebuilds.
+func tasteItems(weight func(i int) float64) []clusterItem {
+	var items []clusterItem
+	for i := range 8 {
+		f := float32(i) * 0.01
+		items = append(items,
+			clusterTestItem("a"+string(rune('0'+i)), []float32{1 - f, f, 0}, weight(i), "Action"),
+			clusterTestItem("d"+string(rune('0'+i)), []float32{0, 1 - f, f}, weight(i+8), "Drama"),
+			clusterTestItem("h"+string(rune('0'+i)), []float32{f, 0, 1 - f}, weight(i+16), "Horror"),
+		)
+	}
+	slices.SortFunc(items, func(a, b clusterItem) int {
+		if a.itemID < b.itemID {
+			return -1
+		}
+		return 1
+	})
+	return items
+}
+
+func TestKmeansSeedIgnoresWeights(t *testing.T) {
+	today := tasteItems(func(i int) float64 { return 1 + float64(i)*0.1 })
+	tomorrow := tasteItems(func(i int) float64 { return (1 + float64(i)*0.1) * (0.5 + float64(i%5)*0.07) })
+	k := determinClusterCount(len(today))
+
+	if kmeansSeed(today, k) != kmeansSeed(tomorrow, k) {
+		t.Fatal("decayed weights changed the k-means seed")
+	}
+	if got, want := kmeansCluster(tomorrow, k), kmeansCluster(today, k); !slices.Equal(got, want) {
+		t.Fatalf("assignments changed with weights: %v vs %v", got, want)
+	}
+	first, second := buildTasteClusters(today), buildTasteClusters(tomorrow)
+	if len(first) != len(second) {
+		t.Fatalf("cluster count changed with weights: %d vs %d", len(first), len(second))
+	}
+	for i := range first {
+		if first[i].ClusterIdx != second[i].ClusterIdx || first[i].Label != second[i].Label || first[i].MemberCount != second[i].MemberCount {
+			t.Fatalf("cluster %d changed with weights: %+v vs %+v", i, first[i], second[i])
+		}
+	}
+
+	// A new title is a different profile and may reshuffle the clusters.
+	added := append(slices.Clone(today), clusterTestItem("z9", []float32{1, 0, 0}, 1, "Action"))
+	if kmeansSeed(added, k) == kmeansSeed(today, k) {
+		t.Fatal("adding a title left the seed unchanged")
+	}
+	// IDs are delimited, so concatenations that match do not collide.
+	ab := []clusterItem{{itemID: "ab"}, {itemID: "c"}}
+	bc := []clusterItem{{itemID: "a"}, {itemID: "bc"}}
+	if kmeansSeed(ab, 2) == kmeansSeed(bc, 2) {
+		t.Fatal("different ID lists produced the same seed")
+	}
+}
+
+// A cluster's label names the genres that set it apart from the profile,
+// most distinctive first, with its most common genre among them when most of
+// the cluster carries it, at most two, joined with ", ".
+func TestClusterLabelNamesWhatSetsAClusterApart(t *testing.T) {
+	titles := func(n int, weight float64, genres ...string) []clusterItem {
+		out := make([]clusterItem, n)
+		for i := range out {
+			out[i] = clusterItem{itemID: fmt.Sprint(i), weight: weight, genres: genres}
+		}
+		return out
+	}
+	join := func(groups ...[]clusterItem) []clusterItem { return slices.Concat(groups...) }
+	profileOf := func(items []clusterItem) (map[string]int, int) {
+		counts := map[string]int{}
+		for _, item := range items {
+			for _, g := range distinctGenres(item.genres) {
+				counts[g]++
+			}
+		}
+		return counts, len(items)
+	}
+
+	// A thriller profile split into a horror side and a drama side: Thriller
+	// is on every title, so it sets neither cluster apart but names both.
+	horror := join(titles(8, 1, "Thriller", "Horror"), titles(2, 1, "Thriller"))
+	drama := join(titles(6, 1, "Thriller", "Drama"), titles(4, 1, "Thriller", "Crime"))
+	profile, n := profileOf(join(horror, drama))
+	for _, tc := range []struct {
+		name    string
+		members []clusterItem
+		want    string
+	}{
+		{"distinctive genre with the common one", horror, "Horror, Thriller"},
+		// Drama and Crime are both twice as common there as in the profile;
+		// Drama, on more of the cluster, takes the one place beside Thriller.
+		{"most distinctive first", drama, "Drama, Thriller"},
+		{"the profile's only cluster", join(horror, drama), "Thriller"},
+		{"no genres", titles(3, 1), ""},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := clusterLabel(tc.members, profile, n); got != tc.want {
+				t.Fatalf("label = %q, want %q", got, tc.want)
+			}
+		})
+	}
+
+	// A TMDB genre containing "&" stays one genre in the label.
+	scifi := titles(5, 1, "Sci-Fi & Fantasy", "Drama")
+	profile, n = profileOf(join(scifi, titles(15, 1, "Drama")))
+	if got := clusterLabel(scifi, profile, n); got != "Sci-Fi & Fantasy, Drama" {
+		t.Fatalf("label = %q, want \"Sci-Fi & Fantasy, Drama\"", got)
+	}
+
+	// A genre on under 40% of the cluster is not named, however rare it is
+	// elsewhere.
+	western := join(titles(2, 1, "Horror", "Western"), titles(4, 1, "Horror"))
+	profile, n = profileOf(join(western, titles(14, 1, "Drama")))
+	if got := clusterLabel(western, profile, n); got != "Horror" {
+		t.Fatalf("label = %q, want Horror", got)
+	}
+
+	// A cluster whose genres are each on under 40% of it is not named after
+	// one of them: the row would mostly not carry it.
+	scattered := join(titles(2, 1, "Comedy"), titles(2, 1, "Horror"), titles(2, 1, "Drama"), titles(2, 1, "Crime"), titles(2, 1, "Western"), titles(2, 1, "War"))
+	profile, n = profileOf(scattered)
+	if got := clusterLabel(scattered, profile, n); got != "" {
+		t.Fatalf("label = %q, want none for a cluster no genre describes", got)
+	}
+
+	// A tie for the most common genre goes to the heavier titles, which pull
+	// the row toward them, not to the first name.
+	tied := join(titles(3, 0.1, "Comedy"), titles(3, 0.9, "Crime"))
+	profile, n = profileOf(tied)
+	if got := clusterLabel(tied, profile, n); got != "Crime" {
+		t.Fatalf("label = %q, want Crime", got)
+	}
+}
+
+// interestTitles returns n titles of interest, all carrying genre: unit
+// vectors that share a common direction, their interest's own direction and
+// per-title noise, so titles of one interest score a cosine near 0.75 and
+// titles of different interests near 0.45, the way real title embeddings sit
+// closer within a genre than across genres.
+func interestTitles(rng *rand.Rand, interest, n int, genre string) []clusterItem {
+	const interests, noiseDims = 8, 32
+	items := make([]clusterItem, n)
+	for i := range items {
+		vec := make([]float32, 1+interests+noiseDims)
+		vec[0] = 1
+		vec[1+interest] = 0.8
+		var noiseNorm float64
+		noise := make([]float64, noiseDims)
+		for d := range noise {
+			noise[d] = rng.NormFloat64()
+			noiseNorm += noise[d] * noise[d]
+		}
+		for d := range noise {
+			vec[1+interests+d] = float32(0.7 * noise[d] / math.Sqrt(noiseNorm))
+		}
+		var norm float64
+		for _, v := range vec {
+			norm += float64(v) * float64(v)
+		}
+		for d := range vec {
+			vec[d] /= float32(math.Sqrt(norm))
+		}
+		items[i] = clusterTestItem(fmt.Sprintf("%s-%02d", genre, i), vec, 0.8, genre)
+	}
+	return items
+}
+
+// clusterGenres returns, per cluster of assignments, the sorted genres of its
+// members, one entry per member.
+func clusterGenres(items []clusterItem, assignments []int) [][]string {
+	var out [][]string
+	for i, c := range assignments {
+		for len(out) <= c {
+			out = append(out, nil)
+		}
+		out[c] = append(out[c], items[i].genres[0])
+	}
+	for _, g := range out {
+		slices.Sort(g)
+	}
+	slices.SortFunc(out, func(a, b []string) int { return strings.Compare(strings.Join(a, ","), strings.Join(b, ",")) })
+	return out
+}
+
+// A profile's interests each get a cluster: two interests of 8 and 6 titles
+// stay two clusters, and a third interest of three titles joins as a cluster
+// of its own instead of folding the profile into one.
+func TestBuildTasteClustersGivesEachInterestItsCluster(t *testing.T) {
+	rng := rand.New(rand.NewPCG(1145, 3))
+	horror := interestTitles(rng, 0, 8, "Horror")
+	romance := interestTitles(rng, 1, 6, "Romance")
+	western := interestTitles(rng, 2, 3, "Western")
+
+	for _, tc := range []struct {
+		name  string
+		items []clusterItem
+		want  map[string]int
+	}{
+		{"two interests", slices.Concat(horror, romance), map[string]int{"Horror": 8, "Romance": 6}},
+		{"a third interest of three titles", slices.Concat(horror, romance, western), map[string]int{"Horror": 8, "Romance": 6, "Western": 3}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			got := map[string]int{}
+			for _, c := range buildTasteClusters(tc.items) {
+				got[c.Label] = c.MemberCount
+			}
+			if !maps.Equal(got, tc.want) {
+				t.Fatalf("clusters by label = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
+
+// Profiles of two or three interests of 3 to 9 titles, with 10 to 19 titles
+// in all, get exactly their interests as clusters, whichever seeding k-means
+// starts from.
+func TestClusterAssignmentsRecoversInterests(t *testing.T) {
+	rng := rand.New(rand.NewPCG(20261004, 1))
+	checked := 0
+	for range 200 {
+		var items []clusterItem
+		var want [][]string
+		for interest := range 2 + rng.IntN(2) {
+			genre := fmt.Sprintf("g%d", interest)
+			titles := interestTitles(rng, interest, 3+rng.IntN(7), genre)
+			items = append(items, titles...)
+			group := make([]string, len(titles))
+			for i := range group {
+				group[i] = genre
+			}
+			want = append(want, group)
+		}
+		if n := len(items); n < 10 || n >= 20 {
+			continue
+		}
+		checked++
+		slices.SortFunc(want, func(a, b []string) int { return strings.Compare(strings.Join(a, ","), strings.Join(b, ",")) })
+		got := clusterGenres(items, clusterAssignments(items))
+		if !slices.EqualFunc(got, want, slices.Equal) {
+			t.Fatalf("profile of %d titles: clusters %v, want %v", len(items), got, want)
+		}
+	}
+	if checked < 50 {
+		t.Fatalf("checked %d profiles, want at least 50", checked)
+	}
+}
+
+// The fallback partition is the first seeding bestSeeding already ran,
+// kmeansCluster's, so no seeding is run twice.
+func TestBestSeedingReturnsTheFirstSeeding(t *testing.T) {
+	items := tasteItems(func(i int) float64 { return 1 + float64(i)*0.1 })
+	k := determinClusterCount(len(items))
+	_, first := bestSeeding(items, k, 3)
+	if want := kmeansCluster(items, k); !slices.Equal(first, want) {
+		t.Fatalf("first seeding = %v, want kmeansCluster's %v", first, want)
+	}
+}
diff --git a/internal/recommendations/coldstart.go b/internal/recommendations/coldstart.go
index a2b86c8f73..1439a413f9 100644
--- a/internal/recommendations/coldstart.go
+++ b/internal/recommendations/coldstart.go
@@ -1,40 +1,96 @@
 package recommendations
 
 import (
+	"slices"
 	"sort"
 	"time"
 )
 
-// coldStartLevel returns the cold-start graduation level based on positive
-// signal count. Higher levels indicate more personalization is appropriate.
+// coldStartLevel returns the cold-start graduation level for a number of
+// positive titles. Higher levels indicate more personalization is
+// appropriate.
 //
-//	0 signals → level 0 (100% non-personalized)
-//	1-4       → level 1 (non-personalized + one personal row)
-//	5-14      → level 2 (50/50 mix)
-//	15+       → level 3 (fully personalized)
-func coldStartLevel(positiveSignalCount int) int {
+//	0 titles → level 0 (global rows only)
+//	1-2      → level 1 (global rows, then one personal row)
+//	3-9      → level 2 (personal and global rows interleaved, personal first)
+//	10+      → level 3 (personal rows first)
+func coldStartLevel(positiveTitles int) int {
 	switch {
-	case positiveSignalCount >= ColdStartFullPersonalized:
+	case positiveTitles >= ColdStartFullPersonalized:
 		return 3
-	case positiveSignalCount >= ColdStartMixed:
+	case positiveTitles >= ColdStartMixed:
 		return 2
-	case positiveSignalCount >= ColdStartMinimal:
+	case positiveTitles >= ColdStartMinimal:
 		return 1
 	default:
 		return 0
 	}
 }
 
+// signal_counts kinds. A 1-2 star rating (rated_low), a title abandoned
+// below lowProgressThreshold (watch_low) and a Not interested mark
+// (not_interested) record a dislike; a 3-star rating carries no weight of its
+// own (see ratingSignal).
+const (
+	signalKindRated5        = "rated_5"
+	signalKindRated4        = "rated_4"
+	signalKindRated3        = "rated_3"
+	signalKindRatedLow      = "rated_low"
+	signalKindWatchLow      = "watch_low"
+	signalKindNotInterested = "not_interested"
+)
+
+// signalCountPositiveTitles is the signal_counts entry a taste refresh writes
+// with the number of titles behind the profile's taste vector that count
+// toward its level: canonical titles with an embedding and a positive weight,
+// each once however many signals it has, leaving out titles that are only on
+// the watchlist (see countsTowardLevel). It is not a kind of signal, so the
+// taste-profile summary leaves it out (summarySignalCounts).
+const signalCountPositiveTitles = "positive_titles"
+
+// coldStartLevelOf returns the cold-start level of a profile from its taste
+// profile metadata. A profile with no taste profile is level 0. The level
+// comes from the profile's positive titles; a row stored before refreshes
+// recorded them, which has no signalCountPositiveTitles entry, falls back to
+// its positive signal count until its next refresh.
+func coldStartLevelOf(meta *TasteProfileMeta) int {
+	if meta == nil {
+		return 0
+	}
+	if titles, ok := meta.SignalCounts[signalCountPositiveTitles]; ok {
+		return coldStartLevel(titles)
+	}
+	return coldStartLevel(positiveSignalCount(meta))
+}
+
+// positiveSignalCount sums a profile's positive signal counts: every kind
+// but the dislikes and 3-star ratings. A profile with none has nothing a
+// refresh could build a taste vector from.
+func positiveSignalCount(meta *TasteProfileMeta) int {
+	if meta == nil {
+		return 0
+	}
+	positive := 0
+	for kind, count := range meta.SignalCounts {
+		switch kind {
+		case signalKindRatedLow, signalKindWatchLow, signalKindNotInterested, signalKindRated3, signalCountPositiveTitles:
+			continue
+		}
+		positive += count
+	}
+	return positive
+}
+
 // buildColdStartRows builds the set of non-personalized recommendation rows
 // used during cold-start (and appended to warm profiles for discovery).
 // Rows with empty item slices are omitted.
-func buildColdStartRows(popular, recentlyAdded, topRated []ScoredItem, genreSamplers map[string][]ScoredItem) []ForYouRow {
+func buildColdStartRows(popular, recentlyAdded []ScoredItem, genreSamplers map[string][]ScoredItem) []ForYouRow {
 	var rows []ForYouRow
 
 	if len(popular) > 0 {
 		rows = append(rows, ForYouRow{
 			Type:  RecTypePopular,
-			Label: "Popular on This Server",
+			Label: popularLabel,
 			Items: popular,
 		})
 	}
@@ -42,19 +98,11 @@ func buildColdStartRows(popular, recentlyAdded, topRated []ScoredItem, genreSamp
 	if len(recentlyAdded) > 0 {
 		rows = append(rows, ForYouRow{
 			Type:  RecTypeRecentlyAdded,
-			Label: "Recently Added",
+			Label: recentlyAddedLabel,
 			Items: recentlyAdded,
 		})
 	}
 
-	if len(topRated) > 0 {
-		rows = append(rows, ForYouRow{
-			Type:  RecTypeTopRated,
-			Label: "Top Rated",
-			Items: topRated,
-		})
-	}
-
 	// Sort genre names for deterministic row order.
 	genres := make([]string, 0, len(genreSamplers))
 	for g := range genreSamplers {
@@ -66,8 +114,8 @@ func buildColdStartRows(popular, recentlyAdded, topRated []ScoredItem, genreSamp
 		items := genreSamplers[genre]
 		if len(items) > 0 {
 			rows = append(rows, ForYouRow{
-				Type:  "genre_sampler",
-				Label: "Top " + genre,
+				Type:  genreSamplerRowType,
+				Label: genreRowLabel(genre),
 				Items: items,
 			})
 		}
@@ -121,42 +169,50 @@ func mergePersonalizedAndColdStart(personalRows, coldStartRows []ForYouRow, leve
 	}
 }
 
-// applyRecencyBoost multiplies the score of recently added items by a boost
-// factor that decays linearly from RecencyBoostMultiplier to 1.0 over
-// RecencyBoostDays. Items not present in addedDates or older than the window
-// are left unchanged. The returned slice is a new copy sorted by descending
-// boosted score.
+// recencyBoostMaxShare is the largest share of a candidate pool added within
+// RecencyBoostDays that still gets the recency boost. On a freshly imported
+// library nearly every title is new, and boosting would rank by scan order.
+const recencyBoostMaxShare = 0.25
+
+// applyRecencyBoost multiplies the positive score of each recently added
+// candidate by a factor that decays linearly from RecencyBoostMultiplier to
+// 1.0 over RecencyBoostDays, so a new title near the selection margin makes
+// the row. It is applied to a candidate pool before MMR selects from it, and
+// returns a new slice in the order of items. Items without an added date or
+// older than the window keep their scores, and a pool with more than
+// recencyBoostMaxShare of its items inside the window keeps every score.
+//
+// The added date is the title's own, so a new season or episode of a series
+// does not count as new, and the boost cannot help a title the candidate
+// query did not retrieve.
 func applyRecencyBoost(items []ScoredItem, addedDates map[string]time.Time, now time.Time) []ScoredItem {
 	boostWindow := time.Duration(RecencyBoostDays) * 24 * time.Hour
+	boosted := slices.Clone(items)
 
-	boosted := make([]ScoredItem, len(items))
+	// fractions[i] is how much of the window item i has left, 0 for an item
+	// outside it.
+	fractions := make([]float64, len(items))
+	recent := 0
 	for i, item := range items {
-		boosted[i] = item
-
 		addedAt, ok := addedDates[item.MediaItemID]
 		if !ok {
 			continue
 		}
-
-		age := now.Sub(addedAt)
-		if age < 0 {
-			// Added in the future (clock skew) — apply full boost.
-			age = 0
-		}
+		// An item added in the future (clock skew) gets the full boost.
+		age := max(now.Sub(addedAt), 0)
 		if age >= boostWindow {
 			continue
 		}
-
-		// Linear decay: fraction goes from 1.0 (just added) to 0.0 (at window edge).
-		fraction := 1.0 - float64(age)/float64(boostWindow)
-		// Multiplier ranges from RecencyBoostMultiplier down to 1.0.
-		multiplier := 1.0 + (RecencyBoostMultiplier-1.0)*fraction
-		boosted[i].Score *= multiplier
+		fractions[i] = 1.0 - float64(age)/float64(boostWindow)
+		recent++
+	}
+	if float64(recent) > recencyBoostMaxShare*float64(len(items)) {
+		return boosted
+	}
+	for i := range boosted {
+		if fractions[i] > 0 && boosted[i].Score > 0 {
+			boosted[i].Score *= 1.0 + (RecencyBoostMultiplier-1.0)*fractions[i]
+		}
 	}
-
-	sort.Slice(boosted, func(i, j int) bool {
-		return boosted[i].Score > boosted[j].Score
-	})
-
 	return boosted
 }
diff --git a/internal/recommendations/coldstart_test.go b/internal/recommendations/coldstart_test.go
new file mode 100644
index 0000000000..3d913742c3
--- /dev/null
+++ b/internal/recommendations/coldstart_test.go
@@ -0,0 +1,72 @@
+package recommendations
+
+import (
+	"slices"
+	"testing"
+)
+
+// Levels count positive titles: 1-2 stay cold-first, 3 (the taste-seed
+// picker's minimum) put the profile's own row first, 10 make it fully
+// personalized.
+func TestColdStartLevelBoundaries(t *testing.T) {
+	for titles, want := range map[int]int{0: 0, 1: 1, 2: 1, 3: 2, 9: 2, 10: 3, 40: 3} {
+		if got := coldStartLevel(titles); got != want {
+			t.Errorf("coldStartLevel(%d) = %d, want %d", titles, got, want)
+		}
+	}
+}
+
+// coldStartLevelOf uses the positive titles a refresh recorded, alone, and
+// falls back to the positive signal count for a row stored before refreshes
+// recorded them.
+func TestColdStartLevelOfCountsPositiveTitles(t *testing.T) {
+	for _, tc := range []struct {
+		name   string
+		counts map[string]int
+		want   int
+	}{
+		{"three taste-seed picks", map[string]int{"favorited": 3, signalCountPositiveTitles: 3}, 2},
+		{"one title rated, favorited and finished", map[string]int{"rated_5": 1, "favorited": 1, "watch_high": 1, signalCountPositiveTitles: 1}, 1},
+		{"one long series", map[string]int{"watch_high": 1, "rewatch": 1, signalCountPositiveTitles: 1}, 1},
+		{"watchlist only", map[string]int{"watchlist": 3, signalCountPositiveTitles: 0}, 0},
+		{"positive signals awaiting embeddings", map[string]int{"favorited": 5, signalCountPositiveTitles: 0}, 0},
+		{"ten titles", map[string]int{"watch_high": 7, "rated_4": 3, signalCountPositiveTitles: 10}, 3},
+		{"legacy row", map[string]int{"favorited": 2, "watch_high": 1, "watch_low": 4}, 2},
+		{"legacy row of dislikes and 3-star ratings", map[string]int{"rated_low": 2, "watch_low": 3, "rated_3": 4}, 0},
+		{"legacy row past the top threshold", map[string]int{"watch_high": ColdStartFullPersonalized}, 3},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := coldStartLevelOf(&TasteProfileMeta{SignalCounts: tc.counts}); got != tc.want {
+				t.Fatalf("level = %d, want %d", got, tc.want)
+			}
+		})
+	}
+	if got := coldStartLevelOf(nil); got != 0 {
+		t.Fatalf("level without a taste profile = %d, want 0", got)
+	}
+}
+
+// Level 0 serves global rows only, level 1 global rows then one personal
+// row, level 2 alternates starting with a personal row, and level 3 puts
+// every personal row first.
+func TestMergePersonalizedAndColdStartOrderByLevel(t *testing.T) {
+	rows := func(labels ...string) []ForYouRow {
+		out := make([]ForYouRow, len(labels))
+		for i, label := range labels {
+			out[i] = ForYouRow{Label: label}
+		}
+		return out
+	}
+	personal := rows("main", "cluster-0", "cluster-1")
+	cold := rows("popular", "recent")
+	for level, want := range map[int][]string{
+		0: {"popular", "recent"},
+		1: {"popular", "recent", "main"},
+		2: {"main", "popular", "cluster-0", "recent", "cluster-1"},
+		3: {"main", "cluster-0", "cluster-1", "popular", "recent"},
+	} {
+		if got := rowLabels(mergePersonalizedAndColdStart(personal, cold, level)); !slices.Equal(got, want) {
+			t.Errorf("level %d rows = %v, want %v", level, got, want)
+		}
+	}
+}
diff --git a/internal/recommendations/collaborative.go b/internal/recommendations/collaborative.go
index 3a8f8d4e6f..f4cf85ba2e 100644
--- a/internal/recommendations/collaborative.go
+++ b/internal/recommendations/collaborative.go
@@ -4,25 +4,121 @@ import (
 	"context"
 	"fmt"
 	"sort"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+)
+
+// The Similar Users row is built from other accounts' ratings and favorites,
+// so it is a privacy boundary as much as a ranking: with too few accounts
+// behind it, the row would show what one other household liked. Like the
+// co-watch minimum (itemWatchersQuery), both floors count distinct login
+// accounts, never profiles, so one household's profiles cannot meet them.
+const (
+	// minSimilarUsersPeerAccounts is how many other accounts the similar
+	// profiles must span before the row is built at all.
+	minSimilarUsersPeerAccounts = 3
+	// minSimilarUsersItemAccounts is how many of those accounts must have
+	// liked a title before the row may recommend it.
+	minSimilarUsersItemAccounts = 2
+
+	// similarUsersPeerProfiles is how many similar profiles the row reads
+	// likes from, and similarUsersPeersPerAccount how many of them one
+	// account may hold. similarUsersCandidateProfiles nearest profiles are
+	// read so that a household of near-identical profiles cannot fill the
+	// peers and leave the row under its account floor.
+	similarUsersPeerProfiles      = 10
+	similarUsersPeersPerAccount   = 2
+	similarUsersCandidateProfiles = 40
 )
 
+// peersAcrossAccounts keeps, in similarity order, up to limit profiles with
+// at most perAccount from any one account.
+func peersAcrossAccounts(candidates []UserSimilarity, limit, perAccount int) []UserSimilarity {
+	taken := make(map[int]int, len(candidates))
+	peers := make([]UserSimilarity, 0, min(limit, len(candidates)))
+	for _, c := range candidates {
+		if len(peers) == limit {
+			break
+		}
+		if taken[c.UserID] >= perAccount {
+			continue
+		}
+		taken[c.UserID]++
+		peers = append(peers, c)
+	}
+	return peers
+}
+
 type collaborativeCandidate struct {
-	score   float64
-	support int
+	score float64
+	// accounts holds the accounts whose profiles liked the title.
+	accounts map[int]struct{}
 }
 
-func addCollaborativeSupport(candidates map[string]collaborativeCandidate, itemID string, score float64) {
-	candidate := candidates[itemID]
-	candidate.score += score
-	candidate.support++
-	candidates[itemID] = candidate
+// peerLikes is one similar profile's liked titles and their signal weights.
+type peerLikes struct {
+	userID     int
+	similarity float64
+	weights    map[string]float64
+}
+
+// distinctAccounts counts the accounts the similar profiles belong to.
+func distinctAccounts(peers []UserSimilarity) int {
+	accounts := make(map[int]struct{}, len(peers))
+	for _, p := range peers {
+		accounts[p.UserID] = struct{}{}
+	}
+	return len(accounts)
+}
+
+// collaborativeCandidates sums each liked title's similarity-weighted score
+// over the peers and keeps the titles liked on at least
+// minSimilarUsersItemAccounts accounts.
+func collaborativeCandidates(peers []peerLikes) map[string]collaborativeCandidate {
+	candidates := make(map[string]collaborativeCandidate)
+	for _, peer := range peers {
+		for itemID, weight := range peer.weights {
+			candidate := candidates[itemID]
+			if candidate.accounts == nil {
+				candidate.accounts = make(map[int]struct{}, 1)
+			}
+			candidate.score += peer.similarity * weight
+			candidate.accounts[peer.userID] = struct{}{}
+			candidates[itemID] = candidate
+		}
+	}
+	for itemID, candidate := range candidates {
+		if len(candidate.accounts) < minSimilarUsersItemAccounts {
+			delete(candidates, itemID)
+		}
+	}
+	return candidates
 }
 
 // SimilarUsersLiked returns items highly rated or favorited by users with
 // similar taste profiles. Scores are weighted by the similarity of each peer
-// user to the requesting user. Items already rated or watched by the target
-// user are filtered out. Applies MMR re-ranking for diversity.
-func (e *Engine) SimilarUsersLiked(ctx context.Context, userID int, profileID string, limit int) ([]ScoredItem, error) {
+// user to the requesting user. Items the target profile already rated, those
+// in its recommendation exclusion set, those filter does not admit and those
+// not of recommendableMediaTypes are filtered out before ranking, which also
+// ranks against the profile's turned-away titles. Applies MMR re-ranking for
+// diversity. Below the account floors it returns an empty list.
+func (e *Engine) SimilarUsersLiked(ctx context.Context, userID int, profileID string, limit int, filter catalog.AccessFilter) ([]ScoredItem, error) {
+	excluded, err := e.recommendationExclusionSet(ctx, userID, profileID)
+	if err != nil {
+		return nil, fmt.Errorf("get recommendation exclusions for user %d profile %s: %w", userID, profileID, err)
+	}
+	builder := e.rowBuilder()
+	if builder.aversion, err = e.loadAversion(ctx, userID, profileID, builder.now); err != nil {
+		return nil, fmt.Errorf("get turned-away titles for user %d profile %s: %w", userID, profileID, err)
+	}
+	return e.similarUsersLiked(ctx, builder, userID, profileID, limit, excluded, filter)
+}
+
+// similarUsersLiked is SimilarUsersLiked with the exclusion set given, ranked
+// by builder, whose aversion it applies around the profile's taste vector. It
+// answers an empty, non-nil list when the row has nothing to show, so a
+// cached row records that it was built.
+func (e *Engine) similarUsersLiked(ctx context.Context, builder rowBuilder, userID int, profileID string, limit int, excluded map[string]struct{}, filter catalog.AccessFilter) ([]ScoredItem, error) {
 	meta, err := e.repo.GetTasteProfileMeta(ctx, userID, profileID)
 	if err != nil {
 		return nil, fmt.Errorf("get taste profile meta for user %d profile %s: %w", userID, profileID, err)
@@ -32,18 +128,17 @@ func (e *Engine) SimilarUsersLiked(ctx context.Context, userID int, profileID st
 		maxContentRating = meta.MaxContentRating
 	}
 
-	similarUsers, err := e.repo.FindSimilarUsers(ctx, userID, profileID, maxContentRating, 10)
+	nearest, err := e.repo.FindSimilarUsers(ctx, userID, profileID, maxContentRating, similarUsersCandidateProfiles)
 	if err != nil {
 		return nil, fmt.Errorf("find similar users for user %d profile %s: %w", userID, profileID, err)
 	}
-	if len(similarUsers) == 0 {
-		return nil, nil
+	similarUsers := peersAcrossAccounts(nearest, similarUsersPeerProfiles, similarUsersPeersPerAccount)
+	if distinctAccounts(similarUsers) < minSimilarUsersPeerAccounts {
+		return []ScoredItem{}, nil
 	}
 
-	candidates := make(map[string]collaborativeCandidate)
-
+	peers := make([]peerLikes, 0, len(similarUsers))
 	for _, su := range similarUsers {
-		similarity := su.Score
 		peerWeights := make(map[string]float64)
 
 		// Collect highly-rated items (4–5 stars) from this similar user.
@@ -85,13 +180,12 @@ func (e *Engine) SimilarUsersLiked(ctx context.Context, userID int, profileID st
 			}
 		}
 
-		for itemID, weight := range peerWeights {
-			addCollaborativeSupport(candidates, itemID, similarity*weight)
-		}
+		peers = append(peers, peerLikes{userID: su.UserID, similarity: su.Score, weights: peerWeights})
 	}
 
+	candidates := collaborativeCandidates(peers)
 	if len(candidates) == 0 {
-		return nil, nil
+		return []ScoredItem{}, nil
 	}
 
 	// Build list of candidate item IDs for filtering.
@@ -106,26 +200,38 @@ func (e *Engine) SimilarUsersLiked(ctx context.Context, userID int, profileID st
 		return nil, fmt.Errorf("list rated items for filtering: %w", err)
 	}
 
-	// Build scored result list, excluding already-rated or already-watched items.
+	// Leave out what the viewer cannot see, and titles not of
+	// recommendableMediaTypes, before ranking, so those titles do not take
+	// the row's places.
+	accessible, err := e.repo.FilterRecommendableItemIDs(ctx, candidateIDs, filter)
+	if err != nil {
+		return nil, fmt.Errorf("filter accessible similar-users candidates: %w", err)
+	}
+
+	// Build scored result list, excluding already-rated, excluded,
+	// inaccessible and unrecommendable items.
 	results := make([]ScoredItem, 0, len(candidates))
 	supportCounts := make(map[string]int, len(candidates))
 	for id, candidate := range candidates {
 		if _, rated := ratedMap[id]; rated {
 			continue
 		}
-		supportCounts[id] = candidate.support
+		if _, ok := accessible[id]; !ok {
+			continue
+		}
+		if _, skip := excluded[id]; skip {
+			continue
+		}
+		supportCounts[id] = len(candidate.accounts)
 		results = append(results, ScoredItem{
 			MediaItemID: id,
 			Score:       candidate.score,
 			Reason:      "similar_users_liked",
 		})
 	}
-
-	watchedSet, err := e.watchedItemIDSet(ctx, userID, profileID)
-	if err != nil {
-		return nil, fmt.Errorf("get watched items for user %d profile %s: %w", userID, profileID, err)
+	if len(results) == 0 {
+		return []ScoredItem{}, nil
 	}
-	results = excludeScoredItems(results, watchedSet)
 
 	// Sort by score descending.
 	sort.Slice(results, func(i, j int) bool {
@@ -147,16 +253,25 @@ func (e *Engine) SimilarUsersLiked(ctx context.Context, userID int, profileID st
 	for i, item := range results {
 		resultIDs[i] = item.MediaItemID
 	}
-	embMap, _ := e.repo.GetBatchEmbeddings(ctx, resultIDs)
-	results = applyMMR(results, embMap, e.mmrLambda(LambdaSimilarUsers), limit)
-
-	// Apply genre cap to "Similar Users Liked" for cross-genre diversity.
-	genres, _ := e.repo.GetItemGenres(ctx, resultIDs)
-	results = applyGenreCap(results, genres, GenreCapPercent)
-
-	if len(results) > limit {
-		results = results[:limit]
+	embMap, err := e.repo.GetBatchEmbeddings(ctx, resultIDs)
+	if err != nil {
+		if !builder.aversion.empty() {
+			// Without embeddings the row could not rank against the
+			// profile's turned-away titles.
+			return nil, fmt.Errorf("similar users embeddings: %w", err)
+		}
+		embMap = nil
+	}
+	if !builder.aversion.empty() {
+		taste, err := e.repo.GetTasteProfile(ctx, userID, profileID)
+		if err != nil {
+			return nil, fmt.Errorf("get taste profile for user %d profile %s: %w", userID, profileID, err)
+		}
+		results, _ = builder.withAversion(results, embMap, taste)
 	}
+	results = applyMMR(results, embMap, builder.lambda, limit)
 
-	return results, nil
+	// Keep any one genre from taking over the served window.
+	genres, _ := e.repo.GetItemAllGenres(ctx, resultIDs)
+	return applyGenreCap(results, genres), nil
 }
diff --git a/internal/recommendations/collaborative_test.go b/internal/recommendations/collaborative_test.go
new file mode 100644
index 0000000000..ce9082f6cf
--- /dev/null
+++ b/internal/recommendations/collaborative_test.go
@@ -0,0 +1,63 @@
+package recommendations
+
+import (
+	"maps"
+	"slices"
+	"testing"
+)
+
+// Peers are profiles; the floor counts the accounts behind them, so one
+// household with many profiles cannot carry the row.
+func TestSimilarUsersPeerFloorCountsAccounts(t *testing.T) {
+	household := []UserSimilarity{{UserID: 2, ProfileID: "a"}, {UserID: 2, ProfileID: "b"}, {UserID: 2, ProfileID: "c"}, {UserID: 3, ProfileID: "a"}}
+	if got := distinctAccounts(household); got != 2 || got >= minSimilarUsersPeerAccounts {
+		t.Fatalf("distinctAccounts = %d, want 2, below the floor of %d", got, minSimilarUsersPeerAccounts)
+	}
+	three := append(household, UserSimilarity{UserID: 4, ProfileID: "a"})
+	if got := distinctAccounts(three); got != minSimilarUsersPeerAccounts {
+		t.Fatalf("distinctAccounts = %d, want %d", got, minSimilarUsersPeerAccounts)
+	}
+}
+
+// Two households of near-identical profiles at the top of the similarity
+// order cannot fill the peers: each account keeps at most
+// similarUsersPeersPerAccount, so a third account below them still makes the
+// floor. The order and the limit hold.
+func TestPeersAcrossAccountsSpreadsHouseholds(t *testing.T) {
+	var candidates []UserSimilarity
+	for _, account := range []int{2, 3} {
+		for _, p := range []string{"a", "b", "c", "d", "e"} {
+			candidates = append(candidates, UserSimilarity{UserID: account, ProfileID: p})
+		}
+	}
+	candidates = append(candidates, UserSimilarity{UserID: 4, ProfileID: "a"}, UserSimilarity{UserID: 5, ProfileID: "a"})
+
+	peers := peersAcrossAccounts(candidates, 5, 2)
+	want := []UserSimilarity{{UserID: 2, ProfileID: "a"}, {UserID: 2, ProfileID: "b"}, {UserID: 3, ProfileID: "a"}, {UserID: 3, ProfileID: "b"}, {UserID: 4, ProfileID: "a"}}
+	if !slices.Equal(peers, want) {
+		t.Fatalf("peers = %v, want %v", peers, want)
+	}
+	if got := distinctAccounts(peers); got < minSimilarUsersPeerAccounts {
+		t.Fatalf("peers span %d accounts, under the floor of %d", got, minSimilarUsersPeerAccounts)
+	}
+	// The first ten candidates, the old read, span only two accounts.
+	if got := distinctAccounts(candidates[:10]); got >= minSimilarUsersPeerAccounts {
+		t.Fatalf("fixture: the first ten candidates span %d accounts", got)
+	}
+}
+
+// A title one account liked, however many of its profiles liked it, never
+// reaches the row; one liked on two accounts does.
+func TestCollaborativeCandidatesNeedTwoAccounts(t *testing.T) {
+	candidates := collaborativeCandidates([]peerLikes{
+		{userID: 2, similarity: 0.9, weights: map[string]float64{"one-household": 1, "shared": 0.7}},
+		{userID: 2, similarity: 0.8, weights: map[string]float64{"one-household": 1}},
+		{userID: 3, similarity: 0.7, weights: map[string]float64{"shared": 1, "single": 1}},
+		{userID: 4, similarity: 0.6, weights: map[string]float64{"other-single": 1}},
+	})
+
+	got := slices.Sorted(maps.Keys(candidates))
+	if !slices.Equal(got, []string{"shared"}) {
+		t.Fatalf("candidates = %v, want only the title two accounts liked", got)
+	}
+}
diff --git a/internal/recommendations/cowatch.go b/internal/recommendations/cowatch.go
index a1e3054e9a..fd8f6420af 100644
--- a/internal/recommendations/cowatch.go
+++ b/internal/recommendations/cowatch.go
@@ -1,6 +1,11 @@
 package recommendations
 
-import "sort"
+import (
+	"container/heap"
+	"context"
+	"sort"
+	"strings"
+)
 
 // Default co-watch matrix parameters.
 const (
@@ -11,11 +16,20 @@ const (
 )
 
 // computeCowatchMatrix builds a co-watch similarity matrix from per-item watcher
-// lists. For every pair of items that each have at least minWatchers viewers,
-// it computes the Jaccard similarity of their watcher sets. Pairs with fewer
-// than minShared shared watchers are discarded. For each item only the topN
-// most similar neighbors (by Jaccard score) are retained.
-func computeCowatchMatrix(watchers map[string][]string, minWatchers, minShared, topN int) []CowatchPair {
+// lists. Watchers are profile identities, "userID:profileID". For every pair
+// of items that each have at least minWatchers viewers, it computes the
+// Jaccard similarity of their watcher sets. Pairs whose shared watchers come
+// from fewer than minShared accounts are discarded: the profiles of one
+// household would otherwise make a pair that reveals what that household
+// watches to every other account. For each item only the topN
+// most similar neighbors (by Jaccard score, then similar item ID) are
+// retained, and only those are held while scanning. It stops with ctx's error
+// when ctx ends.
+func computeCowatchMatrix(ctx context.Context, watchers map[string][]string, minWatchers, minShared, topN int) ([]CowatchPair, error) {
+	if topN <= 0 {
+		return nil, nil
+	}
+
 	// Collect item IDs that meet the minimum-watchers threshold.
 	eligible := make([]string, 0, len(watchers))
 	for itemID, users := range watchers {
@@ -37,16 +51,25 @@ func computeCowatchMatrix(watchers map[string][]string, minWatchers, minShared,
 		watcherSets[itemID] = set
 	}
 
-	// Per-item neighbor lists, keyed by itemID.
-	type neighbor struct {
-		similarID string
-		score     float64
-		shared    int
+	// Per-item best neighbors, keyed by itemID.
+	neighbors := make(map[string]*cowatchNeighbors, len(eligible))
+	keep := func(itemID string, n cowatchNeighbor) {
+		kept := neighbors[itemID]
+		if kept == nil {
+			kept = &cowatchNeighbors{}
+			neighbors[itemID] = kept
+		}
+		kept.offer(n, topN)
 	}
-	neighbors := make(map[string][]neighbor, len(eligible))
+
+	// sharedAccounts collects the accounts of one pair's shared watchers.
+	sharedAccounts := make(map[string]struct{})
 
 	// Compare every pair once (i < j), then record from both sides.
 	for i := 0; i < len(eligible); i++ {
+		if err := ctx.Err(); err != nil {
+			return nil, err
+		}
 		a := eligible[i]
 		setA := watcherSets[a]
 
@@ -61,13 +84,15 @@ func computeCowatchMatrix(watchers map[string][]string, minWatchers, minShared,
 			if len(setA) > len(setB) {
 				small, big = setB, setA
 			}
+			clear(sharedAccounts)
 			for uid := range small {
 				if _, ok := big[uid]; ok {
 					shared++
+					sharedAccounts[watcherAccount(uid)] = struct{}{}
 				}
 			}
 
-			if shared < minShared {
+			if len(sharedAccounts) < minShared {
 				continue
 			}
 
@@ -77,32 +102,21 @@ func computeCowatchMatrix(watchers map[string][]string, minWatchers, minShared,
 			}
 			jaccard := float64(shared) / float64(union)
 
-			neighbors[a] = append(neighbors[a], neighbor{similarID: b, score: jaccard, shared: shared})
-			neighbors[b] = append(neighbors[b], neighbor{similarID: a, score: jaccard, shared: shared})
+			keep(a, cowatchNeighbor{similarID: b, score: jaccard, shared: shared})
+			keep(b, cowatchNeighbor{similarID: a, score: jaccard, shared: shared})
 		}
 	}
 
-	// For each item, keep only the topN neighbors by Jaccard score descending.
+	// Emit each item's neighbors best first.
 	var result []CowatchPair
 	for _, itemID := range eligible {
-		nbrs := neighbors[itemID]
-		if len(nbrs) == 0 {
+		kept := neighbors[itemID]
+		if kept == nil {
 			continue
 		}
-
-		sort.Slice(nbrs, func(i, j int) bool {
-			if nbrs[i].score != nbrs[j].score {
-				return nbrs[i].score > nbrs[j].score
-			}
-			return nbrs[i].similarID < nbrs[j].similarID
-		})
-
-		limit := topN
-		if limit > len(nbrs) {
-			limit = len(nbrs)
-		}
-
-		for _, n := range nbrs[:limit] {
+		nbrs := *kept
+		sort.Slice(nbrs, func(i, j int) bool { return nbrs[i].ranksAbove(nbrs[j]) })
+		for _, n := range nbrs {
 			result = append(result, CowatchPair{
 				ItemID:        itemID,
 				SimilarItemID: n.similarID,
@@ -112,7 +126,61 @@ func computeCowatchMatrix(watchers map[string][]string, minWatchers, minShared,
 		}
 	}
 
-	return result
+	return result, nil
+}
+
+// watcherAccount returns the account part of a "userID:profileID" watcher.
+func watcherAccount(watcher string) string {
+	account, _, _ := strings.Cut(watcher, ":")
+	return account
+}
+
+// cowatchNeighbor is one co-watched item and its similarity to another.
+type cowatchNeighbor struct {
+	similarID string
+	score     float64
+	shared    int
+}
+
+// ranksAbove orders neighbors by Jaccard score, highest first, then by
+// similar item ID. An item sees each neighbor once, so the order is total.
+func (n cowatchNeighbor) ranksAbove(other cowatchNeighbor) bool {
+	if n.score != other.score {
+		return n.score > other.score
+	}
+	return n.similarID < other.similarID
+}
+
+// cowatchNeighbors keeps an item's best neighbors as a heap whose root is
+// the lowest-ranked one kept, so a better neighbor replaces it in O(log n).
+type cowatchNeighbors []cowatchNeighbor
+
+func (h cowatchNeighbors) Len() int           { return len(h) }
+func (h cowatchNeighbors) Less(i, j int) bool { return h[j].ranksAbove(h[i]) }
+func (h cowatchNeighbors) Swap(i, j int)      { h[i], h[j] = h[j], h[i] }
+func (h *cowatchNeighbors) Push(x any) {
+	if n, ok := x.(cowatchNeighbor); ok {
+		*h = append(*h, n)
+	}
+}
+func (h *cowatchNeighbors) Pop() any {
+	old := *h
+	last := old[len(old)-1]
+	*h = old[:len(old)-1]
+	return last
+}
+
+// offer keeps n if fewer than limit neighbors are kept or n ranks above the
+// lowest kept one, which it then replaces.
+func (h *cowatchNeighbors) offer(n cowatchNeighbor, limit int) {
+	if h.Len() < limit {
+		heap.Push(h, n)
+		return
+	}
+	if n.ranksAbove((*h)[0]) {
+		(*h)[0] = n
+		heap.Fix(h, 0)
+	}
 }
 
 // blendScores merges embedding-based item scores with co-watch Jaccard scores
@@ -162,6 +230,3 @@ func blendScores(embeddingItems []ScoredItem, cowatchItems map[string]float64, e
 
 	return result
 }
-
-// jaccardSimilarity computes the Jaccard index between two string slices,
-// defined as |intersection| / |union|. Returns 0 if both slices are empty.
diff --git a/internal/recommendations/cowatch_test.go b/internal/recommendations/cowatch_test.go
new file mode 100644
index 0000000000..cd08ba43f4
--- /dev/null
+++ b/internal/recommendations/cowatch_test.go
@@ -0,0 +1,143 @@
+package recommendations
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"math/rand/v2"
+	"reflect"
+	"sort"
+	"testing"
+)
+
+// computeCowatchMatrixUnbounded is computeCowatchMatrix before it bounded each
+// item's neighbors while scanning: it collects every qualifying pair, then
+// sorts and cuts each item's list to topN. It is the oracle the bounded
+// version must match exactly.
+func computeCowatchMatrixUnbounded(watchers map[string][]string, minWatchers, minShared, topN int) []CowatchPair {
+	eligible := make([]string, 0, len(watchers))
+	for itemID, users := range watchers {
+		if len(users) >= minWatchers {
+			eligible = append(eligible, itemID)
+		}
+	}
+	sort.Strings(eligible)
+
+	watcherSets := make(map[string]map[string]struct{}, len(eligible))
+	for _, itemID := range eligible {
+		set := make(map[string]struct{}, len(watchers[itemID]))
+		for _, uid := range watchers[itemID] {
+			set[uid] = struct{}{}
+		}
+		watcherSets[itemID] = set
+	}
+
+	type neighbor struct {
+		similarID string
+		score     float64
+		shared    int
+	}
+	neighbors := make(map[string][]neighbor, len(eligible))
+	for i := 0; i < len(eligible); i++ {
+		a := eligible[i]
+		setA := watcherSets[a]
+		for j := i + 1; j < len(eligible); j++ {
+			b := eligible[j]
+			setB := watcherSets[b]
+			shared := 0
+			small, big := setA, setB
+			if len(setA) > len(setB) {
+				small, big = setB, setA
+			}
+			for uid := range small {
+				if _, ok := big[uid]; ok {
+					shared++
+				}
+			}
+			if shared < minShared {
+				continue
+			}
+			union := len(setA) + len(setB) - shared
+			if union == 0 {
+				continue
+			}
+			jaccard := float64(shared) / float64(union)
+			neighbors[a] = append(neighbors[a], neighbor{similarID: b, score: jaccard, shared: shared})
+			neighbors[b] = append(neighbors[b], neighbor{similarID: a, score: jaccard, shared: shared})
+		}
+	}
+
+	var result []CowatchPair
+	for _, itemID := range eligible {
+		nbrs := neighbors[itemID]
+		if len(nbrs) == 0 {
+			continue
+		}
+		sort.Slice(nbrs, func(i, j int) bool {
+			if nbrs[i].score != nbrs[j].score {
+				return nbrs[i].score > nbrs[j].score
+			}
+			return nbrs[i].similarID < nbrs[j].similarID
+		})
+		limit := min(topN, len(nbrs))
+		for _, n := range nbrs[:limit] {
+			result = append(result, CowatchPair{
+				ItemID:        itemID,
+				SimilarItemID: n.similarID,
+				JaccardScore:  n.score,
+				CowatchCount:  n.shared,
+			})
+		}
+	}
+	return result
+}
+
+// The bounded matrix keeps exactly the neighbors the unbounded one keeps,
+// in the same order, including Jaccard ties broken by similar item ID.
+func TestCowatchMatrixMatchesUnboundedOracle(t *testing.T) {
+	rng := rand.New(rand.NewPCG(20261003, 53))
+	for trial := range 200 {
+		items := 2 + rng.IntN(70)
+		population := 3 + rng.IntN(25)
+		watchers := make(map[string][]string, items)
+		for i := range items {
+			// Small watcher pools make identical sets, and so tied scores, common.
+			pool := population
+			if rng.IntN(3) == 0 {
+				pool = min(population, 6)
+			}
+			var list []string
+			for w := range pool {
+				if rng.IntN(3) > 0 {
+					list = append(list, fmt.Sprintf("%d:p", w))
+				}
+			}
+			watchers[fmt.Sprintf("item-%02d", i)] = list
+		}
+		minWatchers := 1 + rng.IntN(5)
+		minShared := 1 + rng.IntN(4)
+		topN := 1 + rng.IntN(12)
+
+		want := computeCowatchMatrixUnbounded(watchers, minWatchers, minShared, topN)
+		got, err := computeCowatchMatrix(t.Context(), watchers, minWatchers, minShared, topN)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if !reflect.DeepEqual(got, want) {
+			t.Fatalf("trial %d (items=%d minWatchers=%d minShared=%d topN=%d):\n got %v\nwant %v", trial, items, minWatchers, minShared, topN, got, want)
+		}
+	}
+}
+
+func TestCowatchMatrixStopsWhenContextEnds(t *testing.T) {
+	watchers := map[string][]string{
+		"a": {"1:p", "2:p", "3:p"},
+		"b": {"1:p", "2:p", "3:p"},
+	}
+	ctx, cancel := context.WithCancel(t.Context())
+	cancel()
+	pairs, err := computeCowatchMatrix(ctx, watchers, 1, 1, 10)
+	if !errors.Is(err, context.Canceled) || pairs != nil {
+		t.Fatalf("pairs=%v err=%v, want context.Canceled and no pairs", pairs, err)
+	}
+}
diff --git a/internal/recommendations/defaultrows_postgres_test.go b/internal/recommendations/defaultrows_postgres_test.go
new file mode 100644
index 0000000000..659bb0b7ff
--- /dev/null
+++ b/internal/recommendations/defaultrows_postgres_test.go
@@ -0,0 +1,782 @@
+package recommendations
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"maps"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/access"
+	"github.com/prairie-server/prairie-server/internal/catalog"
+)
+
+// newTestLibrary creates a movies library that the test removes afterwards.
+func newTestLibrary(t *testing.T, pool *pgxpool.Pool, name string) int {
+	t.Helper()
+	var id int
+	if err := pool.QueryRow(t.Context(), `INSERT INTO media_folders (type, name, enabled) VALUES ('movies', $1, true) RETURNING id`, name).Scan(&id); err != nil {
+		t.Fatalf("insert library: %v", err)
+	}
+	t.Cleanup(func() { _, _ = pool.Exec(context.Background(), `DELETE FROM media_folders WHERE id = $1`, id) })
+	return id
+}
+
+// seedTitle seeds a matched title in library (none when 0) and applies set,
+// an UPDATE SET list over its media_items row. It returns the content ID.
+func seedTitle(t *testing.T, pool *pgxpool.Pool, id, mediaType string, library int, set string) string {
+	t.Helper()
+	seedRecoMediaItem(t, pool, id, mediaType, "matched")
+	if set != "" {
+		if _, err := pool.Exec(t.Context(), `UPDATE media_items SET `+set+` WHERE content_id = $1`, id); err != nil {
+			t.Fatalf("update %s: %v", id, err)
+		}
+	}
+	if library != 0 {
+		if _, err := pool.Exec(t.Context(), `INSERT INTO media_item_libraries (content_id, media_folder_id) VALUES ($1, $2)`, id, library); err != nil {
+			t.Fatalf("library of %s: %v", id, err)
+		}
+	}
+	return id
+}
+
+// watch records a completed watch of itemID by a profile, ago before now.
+func watch(t *testing.T, pool *pgxpool.Pool, userID int, profileID, itemID string, ago time.Duration) {
+	t.Helper()
+	if _, err := pool.Exec(t.Context(), `INSERT INTO user_watch_progress (user_id, profile_id, media_item_id, completed, updated_at) VALUES ($1, $2, $3, true, NOW() - make_interval(secs => $4))`, userID, profileID, itemID, ago.Seconds()); err != nil {
+		t.Fatalf("watch %s: %v", itemID, err)
+	}
+}
+
+// addProfile adds a second profile to an account.
+func addProfile(t *testing.T, pool *pgxpool.Pool, userID int, profileID string) string {
+	t.Helper()
+	if _, err := pool.Exec(t.Context(), `INSERT INTO user_profiles (id, user_id, name) VALUES ($1, $2, $1)`, profileID, userID); err != nil {
+		t.Fatalf("insert profile: %v", err)
+	}
+	return profileID
+}
+
+func itemIDs(items []ScoredItem) []string {
+	ids := make([]string, len(items))
+	for i, item := range items {
+		ids[i] = item.MediaItemID
+	}
+	return ids
+}
+
+func listDefault(t *testing.T, repo *Repo, filter catalog.AccessFilter, kind string, exclude []string, limit int) []string {
+	t.Helper()
+	items, err := repo.ListDefaultRowItems(t.Context(), filter, kind, exclude, limit)
+	if err != nil {
+		t.Fatalf("%s: %v", kind, err)
+	}
+	return itemIDs(items)
+}
+
+// Highly Rated holds the matched movies and series the viewer can see with a
+// catalog rating of 7.0 or more, IMDb-backed titles before TMDB-only ones and
+// an implausible TMDB rating not trusted, under the viewer's access.
+func TestHighlyRatedRowPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	const prefix = "tdefault-rated-"
+	cleanupRecoMediaItems(t, pool, prefix)
+	repo := NewRepo(pool)
+	open, adult := newTestLibrary(t, pool, prefix+"open"), newTestLibrary(t, pool, prefix+"adult")
+	const kids = "content_rating = 'G', content_rating_age = 0, "
+
+	adultBest := seedTitle(t, pool, prefix+"adult-90", "movie", adult, "content_rating = 'R', content_rating_age = 17, rating_imdb = 9.0")
+	best := seedTitle(t, pool, prefix+"imdb-85", "movie", open, kids+"rating_imdb = 8.5")
+	low := seedTitle(t, pool, prefix+"imdb-72", "movie", open, kids+"rating_imdb = 7.2")
+	tmdbOnly := seedTitle(t, pool, prefix+"tmdb-80", "movie", open, kids+"rating_tmdb = 8.0")
+	seedTitle(t, pool, prefix+"tmdb-98", "movie", open, kids+"rating_tmdb = 9.8")
+	seedTitle(t, pool, prefix+"imdb-65", "movie", open, kids+"rating_imdb = 6.5")
+	series := seedTitle(t, pool, prefix+"series-88", "series", open, kids+"rating_imdb = 8.8")
+	seedTitle(t, pool, prefix+"ebook-95", "ebook", open, kids+"rating_imdb = 9.5")
+	seedTitle(t, pool, prefix+"audiobook-95", "audiobook", open, kids+"rating_imdb = 9.5")
+	seedTitle(t, pool, prefix+"unmatched-97", "movie", open, kids+"rating_imdb = 9.7, status = 'unmatched'")
+
+	both := catalog.AccessFilter{AllowedLibraryIDs: []int{open, adult}}
+	got := listDefault(t, repo, both, RecTypeTopRated, nil, 60)
+	// Movies outnumber series six to one in what the viewer can see, so the
+	// one series comes after the movies.
+	if want := []string{adultBest, best, low, tmdbOnly, series}; !slices.Equal(got, want) {
+		t.Fatalf("highly rated = %v, want %v", got, want)
+	}
+	types, err := repo.GetItemMediaTypes(t.Context(), got)
+	if err != nil {
+		t.Fatal(err)
+	}
+	offered := map[string]bool{}
+	for _, mediaType := range types {
+		offered[mediaType] = true
+	}
+	for _, mediaType := range recommendableMediaTypes {
+		if !offered[mediaType] {
+			t.Fatalf("highly rated offers no %s: %v", mediaType, types)
+		}
+	}
+
+	kidsOnly := []string{best, low, tmdbOnly, series}
+	for name, filter := range map[string]catalog.AccessFilter{
+		"allowed library": {AllowedLibraryIDs: []int{open}},
+		"hidden library":  {AllowedLibraryIDs: []int{open, adult}, DisabledLibraryIDs: []int{adult}},
+		"G/PG ceiling":    {AllowedLibraryIDs: []int{open, adult}, MaturityLimits: access.MaturityLimits{MaxContentRating: "PG"}},
+	} {
+		if got := listDefault(t, repo, filter, RecTypeTopRated, nil, 60); !slices.Equal(got, kidsOnly) {
+			t.Fatalf("%s: highly rated = %v, want %v", name, got, kidsOnly)
+		}
+	}
+
+	if got := listDefault(t, repo, both, RecTypeTopRated, []string{adultBest, low}, 60); !slices.Equal(got, []string{best, tmdbOnly, series}) {
+		t.Fatalf("with exclusions = %v", got)
+	}
+	if got := listDefault(t, repo, both, RecTypeTopRated, nil, 2); !slices.Equal(got, []string{adultBest, best}) {
+		t.Fatalf("limit 2 = %v", got)
+	}
+	allowed := catalog.AccessFilter{AllowedLibraryIDs: []int{open, adult}, AllowedContentIDs: []string{series, low}}
+	if got := listDefault(t, repo, allowed, RecTypeTopRated, nil, 60); !slices.Equal(got, []string{series, low}) {
+		t.Fatalf("allowed content = %v", got)
+	}
+	for name, filter := range map[string]catalog.AccessFilter{
+		"no library": {AllowedLibraryIDs: []int{}},
+		"no content": {AllowedContentIDs: []string{}},
+	} {
+		if got := listDefault(t, repo, filter, RecTypeTopRated, nil, 60); len(got) != 0 {
+			t.Fatalf("%s: %v, want nothing", name, got)
+		}
+	}
+}
+
+// A library of nine movies and three series gives series about a quarter of
+// Highly Rated even when every series outrates every movie.
+func TestHighlyRatedRowBalancesMediaTypesPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	const prefix = "tdefault-balance-"
+	cleanupRecoMediaItems(t, pool, prefix)
+	repo := NewRepo(pool)
+	lib := newTestLibrary(t, pool, prefix+"lib")
+	series := map[string]bool{}
+	for i := range 9 {
+		seedTitle(t, pool, fmt.Sprintf("%smovie-%d", prefix, i), "movie", lib, fmt.Sprintf("rating_imdb = %.1f", 7.0+float64(i)/10))
+	}
+	for i := range 3 {
+		series[seedTitle(t, pool, fmt.Sprintf("%sseries-%d", prefix, i), "series", lib, fmt.Sprintf("rating_imdb = %.1f", 9.0+float64(i)/10))] = true
+	}
+
+	got := listDefault(t, repo, catalog.AccessFilter{AllowedLibraryIDs: []int{lib}}, RecTypeTopRated, nil, 60)
+	if len(got) != 12 {
+		t.Fatalf("highly rated = %v, want all 12 titles", got)
+	}
+	seriesIn := func(n int) int {
+		count := 0
+		for _, id := range got[:n] {
+			if series[id] {
+				count++
+			}
+		}
+		return count
+	}
+	if seriesIn(4) != 1 || seriesIn(8) != 2 {
+		t.Fatalf("series in the first 4 = %d and 8 = %d, want 1 and 2: %v", seriesIn(4), seriesIn(8), got)
+	}
+}
+
+// Recently Added orders matched movies and series by when a title, or a
+// series' latest episode, was added, and breaks ties by content ID. The live
+// row and the cached global row share that order and have no window; the
+// live /recently-added endpoint still honors its days.
+func TestRecentlyAddedRowPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	const prefix = "tdefault-recent-"
+	cleanupRecoMediaItems(t, pool, prefix)
+	repo := NewRepo(pool)
+	lib := newTestLibrary(t, pool, prefix+"lib")
+	added := func(daysAgo int) string {
+		return fmt.Sprintf("created_at = NOW() - INTERVAL '%d days'", daysAgo)
+	}
+	old := seedTitle(t, pool, prefix+"old", "movie", lib, added(400))
+	mid := seedTitle(t, pool, prefix+"mid", "movie", lib, added(20))
+	series := seedTitle(t, pool, prefix+"series", "series", lib, added(300)+", latest_episode_added_at = NOW() - INTERVAL '1 day'")
+	newest := seedTitle(t, pool, prefix+"new", "movie", lib, added(2))
+	tieA := seedTitle(t, pool, prefix+"tie-a", "movie", lib, "created_at = TIMESTAMPTZ '2026-09-28 12:00:00Z'")
+	tieB := seedTitle(t, pool, prefix+"tie-b", "movie", lib, "created_at = TIMESTAMPTZ '2026-09-28 12:00:00Z'")
+	seedTitle(t, pool, prefix+"ebook", "ebook", lib, added(0))
+	seedTitle(t, pool, prefix+"unmatched", "movie", lib, added(0)+", status = 'unmatched'")
+
+	live := listDefault(t, repo, catalog.AccessFilter{AllowedLibraryIDs: []int{lib}}, RecTypeRecentlyAdded, nil, 60)
+	// The tied pair's fixed date sorts it among the others by how long ago
+	// the test runs; only its own order is asserted.
+	without := slices.DeleteFunc(slices.Clone(live), func(id string) bool { return id == tieA || id == tieB })
+	if want := []string{series, newest, mid, old}; !slices.Equal(without, want) {
+		t.Fatalf("recently added = %v, want %v around the tied pair", live, want)
+	}
+	if a, b := slices.Index(live, tieA), slices.Index(live, tieB); a < 0 || b != a+1 {
+		t.Fatalf("recently added = %v, want %s directly before %s", live, tieA, tieB)
+	}
+
+	cachedRow := func(days int) []string {
+		t.Helper()
+		items, err := repo.GetRecentlyAddedItems(t.Context(), days, 100000)
+		if err != nil {
+			t.Fatal(err)
+		}
+		var ids []string
+		for _, item := range items {
+			if strings.HasPrefix(item.MediaItemID, prefix) {
+				ids = append(ids, item.MediaItemID)
+			}
+		}
+		return ids
+	}
+	if got := cachedRow(0); !slices.Equal(got, live) {
+		t.Fatalf("cached row = %v, want the live row's order %v", got, live)
+	}
+	// An explicit window keeps titles, or series episodes, added within it.
+	windowed := cachedRow(14)
+	if slices.Contains(windowed, old) || slices.Contains(windowed, mid) || !slices.Contains(windowed, series) || !slices.Contains(windowed, newest) {
+		t.Fatalf("14-day row = %v, want the series and the 2-day-old title, not the 20- and 400-day-old ones", windowed)
+	}
+}
+
+// The cached Popular row counts login accounts, not profiles, over a 90-day
+// window, and offers only matched movies and series.
+func TestPopularNeedsACrowdOfAccountsPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	const prefix = "tpopular-crowd-"
+	cleanupRecoMediaItems(t, pool, prefix)
+	repo := NewRepo(pool)
+	userA, a1 := newTasteTestAccount(t, pool, prefix+"a")
+	a2 := addProfile(t, pool, userA, "second-"+a1)
+	userB, b1 := newTasteTestAccount(t, pool, prefix+"b")
+	userC, c1 := newTasteTestAccount(t, pool, prefix+"c")
+
+	three := seedTitle(t, pool, prefix+"three", "movie", 0, "")
+	sharedRecent := seedTitle(t, pool, prefix+"shared-recent", "series", 0, "")
+	sharedOlder := seedTitle(t, pool, prefix+"shared-older", "movie", 0, "")
+	household := seedTitle(t, pool, prefix+"household", "movie", 0, "")
+	stale := seedTitle(t, pool, prefix+"stale", "movie", 0, "")
+	book := seedTitle(t, pool, prefix+"audiobook", "audiobook", 0, "")
+	unmatched := seedTitle(t, pool, prefix+"unmatched", "movie", 0, "status = 'unmatched'")
+
+	for _, w := range []struct {
+		user    int
+		profile string
+		item    string
+		ago     time.Duration
+	}{
+		{userA, a1, three, 3 * time.Hour}, {userB, b1, three, 3 * time.Hour}, {userC, c1, three, 3 * time.Hour},
+		{userA, a1, sharedRecent, time.Hour}, {userB, b1, sharedRecent, time.Hour},
+		{userA, a1, sharedOlder, 48 * time.Hour}, {userB, b1, sharedOlder, 48 * time.Hour},
+		{userA, a1, household, 0}, {userA, a2, household, 0},
+		{userA, a1, stale, 100 * 24 * time.Hour}, {userB, b1, stale, 100 * 24 * time.Hour},
+		{userA, a1, book, 0}, {userB, b1, book, 0},
+		{userA, a1, unmatched, 0}, {userB, b1, unmatched, 0},
+	} {
+		watch(t, pool, w.user, w.profile, w.item, w.ago)
+	}
+
+	popular := func(minAccounts int) ([]string, []float64) {
+		t.Helper()
+		items, err := repo.GetPopularItems(t.Context(), 90, minAccounts, 100000)
+		if err != nil {
+			t.Fatal(err)
+		}
+		var ids []string
+		var scores []float64
+		for _, item := range items {
+			if strings.HasPrefix(item.MediaItemID, prefix) {
+				ids = append(ids, item.MediaItemID)
+				scores = append(scores, item.Score)
+			}
+		}
+		return ids, scores
+	}
+	ids, scores := popular(crowdMinAccounts)
+	if want := []string{three, sharedRecent, sharedOlder}; !slices.Equal(ids, want) {
+		t.Fatalf("popular = %v, want %v", ids, want)
+	}
+	if !slices.Equal(scores, []float64{3, 2, 2}) {
+		t.Fatalf("scores = %v, want account counts", scores)
+	}
+	// The live endpoint keeps a floor of one account: two profiles of one
+	// household are still one account.
+	if ids, scores := popular(1); !slices.Equal(ids, []string{three, sharedRecent, sharedOlder, household}) || scores[3] != 1 {
+		t.Fatalf("popular from one account = %v %v", ids, scores)
+	}
+}
+
+// Genres rank by how many accounts watched them, once at least two did, then
+// by how many movies and series they hold; book genres do not count.
+func TestTopGenresRankByCrowdThenCatalogPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	const prefix = "tgenres-menu-"
+	cleanupRecoMediaItems(t, pool, prefix)
+	repo := NewRepo(pool)
+	userA, a1 := newTasteTestAccount(t, pool, prefix+"a")
+	a2 := addProfile(t, pool, userA, "second-"+a1)
+	userB, b1 := newTasteTestAccount(t, pool, prefix+"b")
+	crowd, household, big, books := prefix+"Crowd", prefix+"Household", prefix+"Big", prefix+"Books"
+	genre := func(name string) string { return fmt.Sprintf("genres = ARRAY['%s']", name) }
+
+	crowdTitle := seedTitle(t, pool, prefix+"crowd", "movie", 0, genre(crowd))
+	watch(t, pool, userA, a1, crowdTitle, 0)
+	watch(t, pool, userB, b1, crowdTitle, 0)
+	for i := range 3 {
+		id := seedTitle(t, pool, fmt.Sprintf("%shousehold-%d", prefix, i), "series", 0, genre(household))
+		watch(t, pool, userA, a1, id, 0)
+		watch(t, pool, userA, a2, id, 0)
+	}
+	for i := range 5 {
+		seedTitle(t, pool, fmt.Sprintf("%sbig-%d", prefix, i), "movie", 0, genre(big))
+	}
+	for i := range 8 {
+		id := seedTitle(t, pool, fmt.Sprintf("%sbook-%d", prefix, i), "ebook", 0, genre(books))
+		watch(t, pool, userA, a1, id, 0)
+		watch(t, pool, userB, b1, id, 0)
+	}
+
+	all, err := repo.GetTopGenres(t.Context(), 100000)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var got []string
+	for _, g := range all {
+		if strings.HasPrefix(g, prefix) {
+			got = append(got, g)
+		}
+	}
+	// One household's viewing does not lift its genre above a larger one.
+	if want := []string{crowd, big, household}; !slices.Equal(got, want) {
+		t.Fatalf("top genres = %v, want %v", got, want)
+	}
+}
+
+// A genre row ranks its titles by rating reliability and rating, then by
+// how many accounts watched them, then newest first; one household's
+// viewing does not count, and books are left out.
+func TestGenreSamplerIsRatingLedPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	const prefix = "tgenres-sampler-"
+	cleanupRecoMediaItems(t, pool, prefix)
+	repo := NewRepo(pool)
+	userA, a1 := newTasteTestAccount(t, pool, prefix+"a")
+	a2 := addProfile(t, pool, userA, "second-"+a1)
+	userB, b1 := newTasteTestAccount(t, pool, prefix+"b")
+	g := prefix + "Genre"
+	in := fmt.Sprintf("genres = ARRAY['%s'], ", g)
+
+	best := seedTitle(t, pool, prefix+"imdb-80", "movie", 0, in+"rating_imdb = 8.0")
+	crowd := seedTitle(t, pool, prefix+"crowd", "movie", 0, in+"rating_imdb = 7.0, year = 2000")
+	household := seedTitle(t, pool, prefix+"household", "series", 0, in+"rating_imdb = 7.0, year = 2000")
+	newer := seedTitle(t, pool, prefix+"newer", "movie", 0, in+"rating_imdb = 7.0, year = 2020")
+	older := seedTitle(t, pool, prefix+"older", "movie", 0, in+"rating_imdb = 7.0, year = 2010")
+	tmdb := seedTitle(t, pool, prefix+"tmdb-85", "movie", 0, in+"rating_tmdb = 8.5")
+	untrusted := seedTitle(t, pool, prefix+"tmdb-99", "movie", 0, in+"rating_tmdb = 9.9")
+	seedTitle(t, pool, prefix+"ebook", "ebook", 0, in+"rating_imdb = 9.0")
+	watch(t, pool, userA, a1, crowd, 0)
+	watch(t, pool, userB, b1, crowd, 0)
+	watch(t, pool, userA, a1, household, 0)
+	watch(t, pool, userA, a2, household, 0)
+
+	items, err := repo.GetGenreSamplerItems(t.Context(), g, 60)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if want := []string{best, crowd, newer, older, household, tmdb, untrusted}; !slices.Equal(itemIDs(items), want) {
+		t.Fatalf("genre row = %v, want %v", itemIDs(items), want)
+	}
+	if items[0].Score != 8.0 {
+		t.Fatalf("score = %v, want the catalog rating", items[0].Score)
+	}
+}
+
+// The picker's best 600 candidates come first, interleaved by first genre;
+// paging then continues through the rest in rank order, every candidate
+// exactly once, and only recommendable media types are offered.
+func TestTasteSeedPickerInterleavesGenresPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	const prefix = "ttasteseed-rounds-"
+	cleanupRecoMediaItems(t, pool, prefix)
+	repo := NewRepo(pool)
+	lib := newTestLibrary(t, pool, prefix+"lib")
+
+	// Movies rank in index order behind one series: movies 0-399 are Alpha,
+	// 400-599 Beta and 600-639 Gamma.
+	if _, err := pool.Exec(ctx, `
+		INSERT INTO media_items (content_id, type, title, status, poster_path, rating_imdb, genres)
+		SELECT $1 || lpad(i::text, 4, '0'), 'movie', 'm' || i, 'matched', '/p.jpg', 9.0 - i * 0.001,
+		       ARRAY[CASE WHEN i < 400 THEN 'Alpha' WHEN i < 600 THEN 'Beta' ELSE 'Gamma' END]
+		FROM generate_series(0, 639) AS i`, prefix+"movie-"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := pool.Exec(ctx, `INSERT INTO media_item_libraries (content_id, media_folder_id) SELECT content_id, $2 FROM media_items WHERE content_id LIKE $1`, prefix+"movie-%", lib); err != nil {
+		t.Fatal(err)
+	}
+	movie := func(i int) string { return fmt.Sprintf("%smovie-%04d", prefix, i) }
+	series := seedTitle(t, pool, prefix+"series", "series", lib, "poster_path = '/p.jpg', rating_imdb = 9.5, genres = ARRAY['Alpha']")
+	for _, mediaType := range []string{"ebook", "audiobook"} {
+		seedTitle(t, pool, prefix+mediaType, mediaType, lib, "poster_path = '/p.jpg', rating_imdb = 9.9, genres = ARRAY['Books']")
+	}
+	filter := catalog.AccessFilter{AllowedLibraryIDs: []int{lib}}
+
+	page, err := repo.GetTasteSeedCandidates(ctx, filter, 6, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Alpha's best (the series), Beta's best, then each genre's next.
+	if want := []string{series, movie(400), movie(0), movie(401), movie(1), movie(402)}; !slices.Equal(page, want) {
+		t.Fatalf("page 1 = %v, want %v", page, want)
+	}
+
+	var all []string
+	for offset := 0; ; offset += 100 {
+		page, err := repo.GetTasteSeedCandidates(ctx, filter, 100, offset)
+		if err != nil {
+			t.Fatal(err)
+		}
+		all = append(all, page...)
+		if len(page) < 100 {
+			break
+		}
+	}
+	if len(all) != 641 {
+		t.Fatalf("paged %d candidates, want the 640 movies and the series", len(all))
+	}
+	seen := map[string]bool{}
+	for _, id := range all {
+		if seen[id] {
+			t.Fatalf("%s paged twice", id)
+		}
+		seen[id] = true
+	}
+	// The series and movies 0-598 fill the base; movies 599 and on were not
+	// interleaved and follow in rank order.
+	for i, id := range all[600:] {
+		if id != movie(599+i) {
+			t.Fatalf("candidate %d = %s, want %s", 600+i, id, movie(599+i))
+		}
+	}
+	types, err := repo.GetItemMediaTypes(ctx, all)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for id, mediaType := range types {
+		if !slices.Contains(recommendableMediaTypes, mediaType) {
+			t.Fatalf("picker offered %s, a %s", id, mediaType)
+		}
+	}
+}
+
+// The default rows are queried for each viewer at read time: a restricted
+// profile gets titles it can see, each profile loses only what it watched,
+// and the rows show with recommendations disabled (no refresher) on a server
+// that has cached nothing, without writing to the cache.
+func TestDefaultRowsServeEachViewerLivePostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	const prefix = "tdefault-viewer-"
+	cleanupRecoMediaItems(t, pool, prefix)
+	open, adult := newTestLibrary(t, pool, prefix+"open"), newTestLibrary(t, pool, prefix+"adult")
+	userID, grownUp := newTasteTestAccount(t, pool, prefix)
+	kid := addProfile(t, pool, userID, "kid-"+grownUp)
+	const kids = "content_rating = 'G', content_rating_age = 0, "
+
+	adultTitle := seedTitle(t, pool, prefix+"adult", "movie", adult, "content_rating = 'R', content_rating_age = 17, rating_imdb = 9.0")
+	watchedByGrownUp := seedTitle(t, pool, prefix+"family-88", "movie", open, kids+"rating_imdb = 8.8")
+	family := seedTitle(t, pool, prefix+"family-85", "movie", open, kids+"rating_imdb = 8.5")
+	// Unrated, so only Recently Added holds it.
+	seedTitle(t, pool, prefix+"unrated", "movie", open, strings.TrimSuffix(kids, ", "))
+	watch(t, pool, userID, grownUp, watchedByGrownUp, 0)
+
+	grownUpFilter := catalog.AccessFilter{UserID: userID, ProfileID: grownUp, AllowedLibraryIDs: []int{open, adult}}
+	kidFilter := catalog.AccessFilter{UserID: userID, ProfileID: kid, AllowedLibraryIDs: []int{open}, MaturityLimits: access.MaturityLimits{MaxContentRating: "PG"}}
+	cacheRows := func() int {
+		return countRows(t, pool, `SELECT count(*) FROM recommendation_cache WHERE rec_type = $1 OR user_id = $2`, RecTypeTopRated, userID)
+	}
+	before := cacheRows()
+
+	r := NewReader(NewRepo(pool), nil, nil, nil)
+	section := func(profile string, filter catalog.AccessFilter) []string {
+		t.Helper()
+		row, err := r.GetSection(ctx, userID, profile, SectionKindTopRated, "", 60, filter)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if row == nil || row.Type != RecTypeTopRated || row.Label != highlyRatedLabel {
+			t.Fatalf("section = %+v", row)
+		}
+		return itemIDs(row.Items)
+	}
+	if got := section(grownUp, grownUpFilter); !slices.Equal(got, []string{adultTitle, family}) {
+		t.Fatalf("grown-up highly rated = %v", got)
+	}
+	if got := section(kid, kidFilter); !slices.Equal(got, []string{watchedByGrownUp, family}) {
+		t.Fatalf("kid highly rated = %v", got)
+	}
+
+	rows, err := r.GetDiscoverRows(ctx, userID, kid, 20, kidFilter)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var labels []string
+	for _, row := range rows {
+		labels = append(labels, row.Label)
+		for _, item := range row.Items {
+			if item.MediaItemID == adultTitle {
+				t.Fatalf("kid's %q row shows the adult title", row.Label)
+			}
+		}
+	}
+	if !slices.Contains(labels, highlyRatedLabel) || !slices.Contains(labels, recentlyAddedLabel) {
+		t.Fatalf("kid's discover rows = %v, want both default rows", labels)
+	}
+	if after := cacheRows(); after != before {
+		t.Fatalf("reads wrote %d cache rows", after-before)
+	}
+}
+
+// Each default row reads every media type from its own index, newest or best
+// rated first, rather than scanning and sorting the catalog; a read then
+// costs the same however many titles the server holds. Sequential scans and
+// sorts are disabled only in this transaction because the test catalog is too
+// small to favor an index naturally; only the type indexes supply the order
+// without a sort.
+func TestDefaultRowQueriesWalkTypeIndexesPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	tx, err := pool.Begin(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = tx.Rollback(ctx) }()
+	for _, setting := range []string{"enable_seqscan", "enable_sort"} {
+		if _, err := tx.Exec(ctx, "SET LOCAL "+setting+" = off"); err != nil {
+			t.Fatal(err)
+		}
+	}
+	filter := catalog.AccessFilter{AllowedLibraryIDs: []int{1, 2}, MaturityLimits: access.MaturityLimits{MaxContentRating: "PG-13"}}
+	exclude := []string{"watched-1", "watched-2"}
+	for kind, index := range map[string]string{
+		RecTypeRecentlyAdded: "idx_media_items_type_added_at",
+		RecTypeTopRated:      "idx_media_items_type_catalog_rank",
+	} {
+		query, args := defaultRowQuery(filter, kind, exclude, []int64{9, 3}, 60)
+		var plan []byte
+		if err := tx.QueryRow(ctx, "EXPLAIN (FORMAT JSON) "+query, args...).Scan(&plan); err != nil {
+			t.Fatalf("%s: %v", kind, err)
+		}
+		var nodes []map[string]any
+		if err := json.Unmarshal(plan, &nodes); err != nil {
+			t.Fatalf("%s: plan: %v", kind, err)
+		}
+		reads := mediaItemsReads(nodes[0]["Plan"].(map[string]any))
+		if len(reads) == 0 {
+			t.Fatalf("%s reads no media_items: %s", kind, plan)
+		}
+		for _, read := range reads {
+			if read != "Index Scan "+index {
+				t.Fatalf("%s reads media_items by %q, want an index scan of %s: %s", kind, read, index, plan)
+			}
+		}
+	}
+}
+
+// mediaItemsReads lists how a plan reads media_items: each scan's node type
+// and index, prefixed "Sort > " when a sort sits between the scan and the
+// limit above it, which means the index did not supply the order.
+func mediaItemsReads(node map[string]any) []string {
+	return mediaItemsReadsUnder(node, false)
+}
+
+func mediaItemsReadsUnder(node map[string]any, sorted bool) []string {
+	switch node["Node Type"] {
+	case "Limit":
+		sorted = false
+	case "Sort", "Incremental Sort":
+		sorted = true
+	}
+	var reads []string
+	if node["Relation Name"] == "media_items" {
+		index, _ := node["Index Name"].(string)
+		read := strings.TrimSpace(fmt.Sprintf("%v %s", node["Node Type"], index))
+		if sorted {
+			read = "Sort > " + read
+		}
+		reads = append(reads, read)
+	}
+	children, _ := node["Plans"].([]any)
+	for _, child := range children {
+		reads = append(reads, mediaItemsReadsUnder(child.(map[string]any), sorted)...)
+	}
+	return reads
+}
+
+// Highly Rated reuses an access scope's title counts for a while instead of
+// counting the catalog on every read; another scope is counted on its own.
+func TestHighlyRatedReusesTitleCountsPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	const prefix = "tdefault-counts-"
+	cleanupRecoMediaItems(t, pool, prefix)
+	repo := NewRepo(pool)
+	lib, other := newTestLibrary(t, pool, prefix+"lib"), newTestLibrary(t, pool, prefix+"other")
+	seedTitle(t, pool, prefix+"movie-1", "movie", lib, "")
+	seedTitle(t, pool, prefix+"series-1", "series", lib, "")
+	scope := catalog.AccessFilter{AllowedLibraryIDs: []int{lib}}
+	counts := func(filter catalog.AccessFilter) []int64 {
+		t.Helper()
+		return repo.titleCounts.get(t.Context(), filter, repo.countTitlesByType)
+	}
+	if got := counts(scope); !slices.Equal(got, []int64{1, 1}) {
+		t.Fatalf("counts = %v, want one movie and one series", got)
+	}
+	seedTitle(t, pool, prefix+"movie-2", "movie", lib, "")
+	seedTitle(t, pool, prefix+"movie-3", "movie", other, "")
+	if got := counts(scope); !slices.Equal(got, []int64{1, 1}) {
+		t.Fatalf("counts = %v, want the scope's earlier counts", got)
+	}
+	if got := counts(catalog.AccessFilter{AllowedLibraryIDs: []int{lib, other}}); !slices.Equal(got, []int64{3, 1}) {
+		t.Fatalf("another scope's counts = %v, want 3 movies and 1 series", got)
+	}
+}
+
+// Rating-led rows put notable titles (a logo and at least five keywords)
+// first and do not trust an IMDb rating of 9.6 or more or a TMDB rating of
+// 9.5 or more: in a large catalog those are an obscure title's handful of
+// votes or a TMDB score copied into the IMDb field. Highly Rated, the genre
+// rows and the quality prior read the same ratings.
+func TestCatalogRankLeadsWithNotableTrustedRatingsPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	const prefix = "tdefault-rank-"
+	cleanupRecoMediaItems(t, pool, prefix)
+	repo := NewRepo(pool)
+	lib := newTestLibrary(t, pool, prefix+"lib")
+	genre := prefix + "Genre"
+	in := fmt.Sprintf("genres = ARRAY['%s'], ", genre)
+	const notable = "logo_path = '/logo.png', keywords = ARRAY['a', 'b', 'c', 'd', 'e'], "
+
+	copied := seedTitle(t, pool, prefix+"copied-10", "movie", lib, in+"rating_imdb = 10, rating_tmdb = 10")
+	inflated := seedTitle(t, pool, prefix+"imdb-98", "movie", lib, in+"rating_imdb = 9.8, rating_tmdb = 8.0")
+	obscure := seedTitle(t, pool, prefix+"obscure-92", "movie", lib, in+"rating_imdb = 9.2")
+	classic := seedTitle(t, pool, prefix+"classic-93", "movie", lib, in+notable+"rating_imdb = 9.3")
+	known := seedTitle(t, pool, prefix+"known-80", "movie", lib, in+notable+"rating_imdb = 8.0")
+	fewKeywords := seedTitle(t, pool, prefix+"four-keywords-90", "movie", lib, in+"logo_path = '/logo.png', keywords = ARRAY['a', 'b', 'c', 'd'], rating_imdb = 9.0")
+
+	// Notable first, then a trusted IMDb rating, then a trusted TMDB one;
+	// the copied 10 has no trusted rating at all.
+	want := []string{classic, known, obscure, fewKeywords, inflated}
+	if got := listDefault(t, repo, catalog.AccessFilter{AllowedLibraryIDs: []int{lib}}, RecTypeTopRated, nil, 60); !slices.Equal(got, want) {
+		t.Fatalf("highly rated = %v, want %v", got, want)
+	}
+	items, err := repo.GetGenreSamplerItems(t.Context(), genre, 60)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := itemIDs(items); !slices.Equal(got, append(slices.Clone(want), copied)) {
+		t.Fatalf("genre row = %v, want %v then the untrusted title", got, want)
+	}
+	quality, err := repo.GetItemQualityRatings(t.Context(), []string{copied, inflated, obscure})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if wantQuality := map[string]float64{inflated: 8.0, obscure: 9.2}; !maps.Equal(quality, wantQuality) {
+		t.Fatalf("quality ratings = %v, want %v", quality, wantQuality)
+	}
+}
+
+// A type counted as empty a moment ago, whose titles arrive before the count
+// expires, still reads: Highly Rated never divides by a zero count.
+func TestHighlyRatedReadsPastAStaleZeroCountPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	const prefix = "tdefault-zero-"
+	cleanupRecoMediaItems(t, pool, prefix)
+	repo := NewRepo(pool)
+	lib := newTestLibrary(t, pool, prefix+"lib")
+	movie := seedTitle(t, pool, prefix+"movie", "movie", lib, "rating_imdb = 8.0")
+	scope := catalog.AccessFilter{AllowedLibraryIDs: []int{lib}}
+	if got := listDefault(t, repo, scope, RecTypeTopRated, nil, 60); !slices.Equal(got, []string{movie}) {
+		t.Fatalf("highly rated = %v, want the movie", got)
+	}
+	series := seedTitle(t, pool, prefix+"series", "series", lib, "rating_imdb = 9.0")
+	if got := listDefault(t, repo, scope, RecTypeTopRated, nil, 60); !slices.Contains(got, series) || !slices.Contains(got, movie) {
+		t.Fatalf("highly rated = %v, want the movie and the new series", got)
+	}
+}
+
+// A profile that rated an episode has judged its series: the live default
+// rows, which hold series, leave the series out as the rows the worker builds
+// do, and a title rated directly leaves too.
+func TestDefaultRowsLeaveOutASeriesRatedThroughAnEpisodePostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	const prefix = "tdefault-rated-episode-"
+	cleanupRecoMediaItems(t, pool, prefix)
+	lib := newTestLibrary(t, pool, prefix+"lib")
+	userID, profile := newTasteTestAccount(t, pool, prefix)
+
+	series := seedTitle(t, pool, prefix+"series-90", "series", lib, "rating_imdb = 9.0")
+	episode := prefix + "series-90-s1e1"
+	if _, err := pool.Exec(ctx, `INSERT INTO episodes(content_id, series_id, season_number, episode_number, title) VALUES ($1, $2, 1, 1, 'Pilot')`, episode, series); err != nil {
+		t.Fatal(err)
+	}
+	ratedMovie := seedTitle(t, pool, prefix+"movie-88", "movie", lib, "rating_imdb = 8.8")
+	other := seedTitle(t, pool, prefix+"movie-80", "movie", lib, "rating_imdb = 8.0")
+	if _, err := pool.Exec(ctx, `INSERT INTO user_ratings(user_id, profile_id, media_item_id, rating) VALUES ($1, $2, $3, 5), ($1, $2, $4, 4)`, userID, profile, episode, ratedMovie); err != nil {
+		t.Fatal(err)
+	}
+
+	r := NewReader(NewRepo(pool), nil, nil, nil)
+	filter := catalog.AccessFilter{UserID: userID, ProfileID: profile, AllowedLibraryIDs: []int{lib}}
+	row, err := r.GetSection(ctx, userID, profile, SectionKindTopRated, "", 60, filter)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if row == nil || !slices.Equal(itemIDs(row.Items), []string{other}) {
+		t.Fatalf("highly rated = %+v, want only the title the profile has not rated", row)
+	}
+}
+
+// A cached row holding a series leaves it out once the profile rates one of
+// its episodes, before the refresh the rating asks for rebuilds the row.
+func TestCachedRowsLeaveOutASeriesRatedThroughAnEpisodePostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	const prefix = "tcached-rated-episode-"
+	cleanupRecoMediaItems(t, pool, prefix)
+	lib := newTestLibrary(t, pool, prefix+"lib")
+	userID, profile := newTasteTestAccount(t, pool, prefix)
+
+	series := seedTitle(t, pool, prefix+"series", "series", lib, "rating_imdb = 8.0")
+	episode := prefix + "series-s1e1"
+	if _, err := pool.Exec(ctx, `INSERT INTO episodes(content_id, series_id, season_number, episode_number, title) VALUES ($1, $2, 1, 1, 'Pilot')`, episode, series); err != nil {
+		t.Fatal(err)
+	}
+	other := seedTitle(t, pool, prefix+"movie", "movie", lib, "rating_imdb = 7.0")
+	repo := NewRepo(pool)
+	if err := repo.UpsertTasteProfile(ctx, userID, profile, axisVector(2500, nil), map[string]int{"rated_5": 1}, "", time.Now()); err != nil {
+		t.Fatal(err)
+	}
+	expires := time.Now().Add(time.Hour).Format(time.RFC3339)
+	if err := repo.UpsertRecommendationCache(ctx, userID, profile, RecTypeForYouMain, "", []ScoredItem{{MediaItemID: series, Score: 2}, {MediaItemID: other, Score: 1}}, expires); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := pool.Exec(ctx, `INSERT INTO user_ratings(user_id, profile_id, media_item_id, rating) VALUES ($1, $2, $3, 5)`, userID, profile, episode); err != nil {
+		t.Fatal(err)
+	}
+
+	r := NewReader(repo, catalog.NewRatingsRepo(pool), nil, nil)
+	filter := catalog.AccessFilter{UserID: userID, ProfileID: profile, AllowedLibraryIDs: []int{lib}}
+	row, err := r.GetForYouMain(ctx, userID, profile, 20, filter)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if row == nil || !slices.Equal(itemIDs(row.Items), []string{other}) {
+		t.Fatalf("main row = %+v, want only the title whose series the profile has not rated", row)
+	}
+}
diff --git a/internal/recommendations/diversity.go b/internal/recommendations/diversity.go
index 9472dac8b2..f32360d659 100644
--- a/internal/recommendations/diversity.go
+++ b/internal/recommendations/diversity.go
@@ -2,11 +2,9 @@ package recommendations
 
 import (
 	"math"
-	"sort"
+	"slices"
 )
 
-const minGenreCapRetainedFraction = 0.5
-
 // applyMMR re-ranks candidates using Maximal Marginal Relevance to balance
 // relevance against diversity. It selects up to limit items from candidates,
 // choosing each successive item to maximize:
@@ -14,6 +12,10 @@ const minGenreCapRetainedFraction = 0.5
 //	score = λ × normalizedRelevance - (1-λ) × maxSimilarityToSelected
 //
 // Candidates without an entry in embeddings are scored by relevance alone.
+//
+// Each remaining candidate keeps its highest similarity to the picks so far,
+// updated against only the newest pick, so a call costs O(n·k) cosines for n
+// candidates and k picks rather than O(n·k²).
 func applyMMR(candidates []ScoredItem, embeddings map[string][]float32, lambda float64, limit int) []ScoredItem {
 	if len(candidates) == 0 || limit <= 0 {
 		return nil
@@ -33,14 +35,35 @@ func applyMMR(candidates []ScoredItem, embeddings map[string][]float32, lambda f
 		maxScore = 1 // avoid division by zero
 	}
 
-	// Track which candidates remain available and which have been selected.
+	// remaining holds the candidates still available; maxSim[i] is
+	// remaining[i]'s highest similarity to a pick with an embedding. Picks
+	// remove their entry from both slices together.
 	remaining := make([]int, len(candidates))
 	for i := range remaining {
 		remaining[i] = i
 	}
-
+	maxSim := make([]float64, len(candidates))
 	selected := make([]ScoredItem, 0, limit)
-	selectedEmbeddings := make([][]float32, 0, limit)
+
+	take := func(at int) {
+		pick := candidates[remaining[at]]
+		selected = append(selected, pick)
+		remaining = append(remaining[:at], remaining[at+1:]...)
+		maxSim = append(maxSim[:at], maxSim[at+1:]...)
+		pickEmb, ok := embeddings[pick.MediaItemID]
+		if !ok {
+			return
+		}
+		for i, ri := range remaining {
+			candidateEmb := embeddings[candidates[ri].MediaItemID]
+			if candidateEmb == nil {
+				continue
+			}
+			if sim := cosineSimilarity(candidateEmb, pickEmb); sim > maxSim[i] {
+				maxSim[i] = sim
+			}
+		}
+	}
 
 	// First pick: highest relevance score.
 	bestIdx := 0
@@ -49,12 +72,7 @@ func applyMMR(candidates []ScoredItem, embeddings map[string][]float32, lambda f
 			bestIdx = i
 		}
 	}
-	first := remaining[bestIdx]
-	selected = append(selected, candidates[first])
-	if emb, ok := embeddings[candidates[first].MediaItemID]; ok {
-		selectedEmbeddings = append(selectedEmbeddings, emb)
-	}
-	remaining = append(remaining[:bestIdx], remaining[bestIdx+1:]...)
+	take(bestIdx)
 
 	// Subsequent picks via MMR scoring.
 	for len(selected) < limit && len(remaining) > 0 {
@@ -63,24 +81,13 @@ func applyMMR(candidates []ScoredItem, embeddings map[string][]float32, lambda f
 
 		for i, ri := range remaining {
 			normalizedRelevance := candidates[ri].Score / maxScore
-			candidateEmb := embeddings[candidates[ri].MediaItemID]
-
-			var maxSim float64
-			if candidateEmb != nil && len(selectedEmbeddings) > 0 {
-				for _, selEmb := range selectedEmbeddings {
-					sim := cosineSimilarity(candidateEmb, selEmb)
-					if sim > maxSim {
-						maxSim = sim
-					}
-				}
-			}
 
 			var mmrScore float64
-			if candidateEmb == nil {
+			if embeddings[candidates[ri].MediaItemID] == nil {
 				// No embedding available — use relevance only.
 				mmrScore = normalizedRelevance
 			} else {
-				mmrScore = lambda*normalizedRelevance - (1-lambda)*maxSim
+				mmrScore = lambda*normalizedRelevance - (1-lambda)*maxSim[i]
 			}
 
 			if mmrScore > bestMMRScore {
@@ -89,101 +96,60 @@ func applyMMR(candidates []ScoredItem, embeddings map[string][]float32, lambda f
 			}
 		}
 
-		pick := remaining[bestMMRIdx]
-		selected = append(selected, candidates[pick])
-		if emb, ok := embeddings[candidates[pick].MediaItemID]; ok {
-			selectedEmbeddings = append(selectedEmbeddings, emb)
-		}
-		remaining = append(remaining[:bestMMRIdx], remaining[bestMMRIdx+1:]...)
+		take(bestMMRIdx)
 	}
 
 	return selected
 }
 
-// applyGenreCap enforces that no single genre exceeds maxPct of the result set.
-// When a genre is over-represented, the lowest-scored items from that genre are
-// removed until the genre falls within the cap.
-func applyGenreCap(items []ScoredItem, genres map[string][]string, maxPct float64) []ScoredItem {
-	if len(items) == 0 || maxPct <= 0 || maxPct >= 1 {
-		return items
-	}
-	minRetained := int(math.Ceil(float64(len(items)) * minGenreCapRetainedFraction))
-	if minRetained < 1 {
-		minRetained = 1
-	}
-
-	// Sort a copy by score descending so removals take lowest-scored first.
-	sorted := make([]ScoredItem, len(items))
-	copy(sorted, items)
-	sort.Slice(sorted, func(i, j int) bool {
-		if sorted[i].Score != sorted[j].Score {
-			return sorted[i].Score > sorted[j].Score
+// servedGenreShare is the largest share of the served window one genre may
+// hold while the row has items of other genres to offer.
+const servedGenreShare = 0.5
+
+// applyGenreCap reorders a row ranked by MMR to keep any one genre to
+// servedGenreShare of its served window, its first ServedRowSize positions or
+// the whole row when shorter. It is greedy and keeps relevance order: it walks
+// the row in order, an item enters the window only if none of its genres
+// already holds that many places there, and the items it passes over fill the
+// window's remaining places, in order, when the row runs out of others. It
+// never revisits a title it let in, so with multi-genre titles a genre can
+// exceed the share even when another choice of titles would meet it; the
+// higher-ranked titles win. Everything after the window keeps its order, and
+// no item is removed. Items without genre data are never counted.
+func applyGenreCap(items []ScoredItem, genres map[string][]string) []ScoredItem {
+	window := min(len(items), ServedRowSize)
+	maxPerGenre := max(1, int(servedGenreShare*float64(window)))
+	counts := make(map[string]int)
+	out := make([]ScoredItem, 0, len(items))
+	var skipped []ScoredItem
+	next := 0
+	for ; next < len(items) && len(out) < window; next++ {
+		item := items[next]
+		itemGenres := distinctGenres(genres[item.MediaItemID])
+		if slices.ContainsFunc(itemGenres, func(g string) bool { return counts[g] >= maxPerGenre }) {
+			skipped = append(skipped, item)
+			continue
 		}
-		return sorted[i].MediaItemID < sorted[j].MediaItemID
-	})
-
-	// Iteratively remove until all genres are within cap. Re-check after each
-	// removal because the total count changes.
-	for {
-		// Count items per genre.
-		genreCounts := make(map[string]int)
-		for _, item := range sorted {
-			for _, genre := range genres[item.MediaItemID] {
-				if genre != "" {
-					genreCounts[genre]++
-				}
-			}
-		}
-
-		// Find a genre that exceeds the cap.
-		total := len(sorted)
-		maxAllowed := int(math.Floor(maxPct * float64(total)))
-		if maxAllowed < 1 {
-			maxAllowed = 1
-		}
-
-		overGenre := ""
-		for g, count := range genreCounts {
-			if count > maxAllowed {
-				if overGenre == "" ||
-					count > genreCounts[overGenre] ||
-					(count == genreCounts[overGenre] && g < overGenre) {
-					overGenre = g
-				}
-			}
-		}
-		if overGenre == "" {
-			break // all genres within cap
-		}
-		if len(sorted) <= minRetained {
-			break
-		}
-
-		// Remove the lowest-scored item of the over-represented genre.
-		// Items are sorted descending, so scan from the end.
-		removed := false
-		for i := len(sorted) - 1; i >= 0; i-- {
-			if itemHasGenre(genres[sorted[i].MediaItemID], overGenre) {
-				sorted = append(sorted[:i], sorted[i+1:]...)
-				removed = true
-				break
-			}
-		}
-		if !removed {
-			break
+		for _, g := range itemGenres {
+			counts[g]++
 		}
+		out = append(out, item)
 	}
-
-	return sorted
+	// The skipped items fill the window first, then precede the untouched
+	// rest, which they came before.
+	out = append(out, skipped...)
+	return append(out, items[next:]...)
 }
 
-func itemHasGenre(genres []string, target string) bool {
-	for _, genre := range genres {
-		if genre == target {
-			return true
+// distinctGenres returns genres without blanks and repeats.
+func distinctGenres(genres []string) []string {
+	out := make([]string, 0, len(genres))
+	for _, g := range genres {
+		if g != "" && !slices.Contains(out, g) {
+			out = append(out, g)
 		}
 	}
-	return false
+	return out
 }
 
 // cosineSimilarity computes the cosine similarity between two float32 vectors.
diff --git a/internal/recommendations/diversity_test.go b/internal/recommendations/diversity_test.go
new file mode 100644
index 0000000000..35a504d39a
--- /dev/null
+++ b/internal/recommendations/diversity_test.go
@@ -0,0 +1,155 @@
+package recommendations
+
+import (
+	"fmt"
+	"math"
+	"math/rand/v2"
+	"reflect"
+	"testing"
+)
+
+// applyMMRQuadratic is applyMMR before it kept a running maximum similarity
+// per candidate: every round re-scores each remaining candidate against every
+// pick so far. It is the oracle the incremental version must match exactly.
+func applyMMRQuadratic(candidates []ScoredItem, embeddings map[string][]float32, lambda float64, limit int) []ScoredItem {
+	if len(candidates) == 0 || limit <= 0 {
+		return nil
+	}
+	if limit > len(candidates) {
+		limit = len(candidates)
+	}
+
+	maxScore := candidates[0].Score
+	for _, c := range candidates[1:] {
+		if c.Score > maxScore {
+			maxScore = c.Score
+		}
+	}
+	if maxScore == 0 {
+		maxScore = 1
+	}
+
+	remaining := make([]int, len(candidates))
+	for i := range remaining {
+		remaining[i] = i
+	}
+
+	selected := make([]ScoredItem, 0, limit)
+	selectedEmbeddings := make([][]float32, 0, limit)
+
+	bestIdx := 0
+	for i, ri := range remaining {
+		if candidates[ri].Score > candidates[remaining[bestIdx]].Score {
+			bestIdx = i
+		}
+	}
+	first := remaining[bestIdx]
+	selected = append(selected, candidates[first])
+	if emb, ok := embeddings[candidates[first].MediaItemID]; ok {
+		selectedEmbeddings = append(selectedEmbeddings, emb)
+	}
+	remaining = append(remaining[:bestIdx], remaining[bestIdx+1:]...)
+
+	for len(selected) < limit && len(remaining) > 0 {
+		bestMMRIdx := -1
+		bestMMRScore := math.Inf(-1)
+
+		for i, ri := range remaining {
+			normalizedRelevance := candidates[ri].Score / maxScore
+			candidateEmb := embeddings[candidates[ri].MediaItemID]
+
+			var maxSim float64
+			if candidateEmb != nil && len(selectedEmbeddings) > 0 {
+				for _, selEmb := range selectedEmbeddings {
+					sim := cosineSimilarity(candidateEmb, selEmb)
+					if sim > maxSim {
+						maxSim = sim
+					}
+				}
+			}
+
+			var mmrScore float64
+			if candidateEmb == nil {
+				mmrScore = normalizedRelevance
+			} else {
+				mmrScore = lambda*normalizedRelevance - (1-lambda)*maxSim
+			}
+
+			if mmrScore > bestMMRScore {
+				bestMMRScore = mmrScore
+				bestMMRIdx = i
+			}
+		}
+
+		pick := remaining[bestMMRIdx]
+		selected = append(selected, candidates[pick])
+		if emb, ok := embeddings[candidates[pick].MediaItemID]; ok {
+			selectedEmbeddings = append(selectedEmbeddings, emb)
+		}
+		remaining = append(remaining[:bestMMRIdx], remaining[bestMMRIdx+1:]...)
+	}
+
+	return selected
+}
+
+// The incremental applyMMR picks exactly what the quadratic version picks, in
+// the same order, over random pools that include tied scores, candidates
+// without an embedding, nil and empty embeddings, and every lambda edge.
+func TestApplyMMRMatchesQuadraticOracle(t *testing.T) {
+	rng := rand.New(rand.NewPCG(20261003, 47))
+	for trial := range 400 {
+		n := 1 + rng.IntN(90)
+		dims := 1 + rng.IntN(12)
+		candidates := make([]ScoredItem, n)
+		embeddings := make(map[string][]float32, n)
+		for i := range candidates {
+			id := fmt.Sprintf("item-%03d", i)
+			score := rng.Float64()
+			if rng.IntN(5) == 0 {
+				// Coarse scores make ties common.
+				score = float64(rng.IntN(4)) / 4
+			}
+			candidates[i] = ScoredItem{MediaItemID: id, Score: score}
+			switch rng.IntN(10) {
+			case 0:
+				// No embedding: scored by relevance alone.
+			case 1:
+				embeddings[id] = nil
+			case 2:
+				embeddings[id] = []float32{}
+			default:
+				vec := make([]float32, dims)
+				for d := range vec {
+					vec[d] = float32(rng.NormFloat64())
+				}
+				if rng.IntN(8) == 0 && i > 0 {
+					// A near-duplicate of an earlier vector.
+					copy(vec, embeddings[candidates[rng.IntN(i)].MediaItemID])
+				}
+				embeddings[id] = vec
+			}
+		}
+		if rng.IntN(20) == 0 {
+			// All-zero relevance takes the division-by-zero guard.
+			for i := range candidates {
+				candidates[i].Score = 0
+			}
+		}
+		lambda := []float64{0, 0.3, 0.5, 0.7, 1, rng.Float64()}[rng.IntN(6)]
+		limit := rng.IntN(n + 5)
+
+		want := applyMMRQuadratic(candidates, embeddings, lambda, limit)
+		got := applyMMR(candidates, embeddings, lambda, limit)
+		if !reflect.DeepEqual(got, want) {
+			t.Fatalf("trial %d (n=%d limit=%d lambda=%v): applyMMR = %v, want %v", trial, n, limit, lambda, mmrItemIDs(got), mmrItemIDs(want))
+		}
+	}
+}
+
+func mmrItemIDs(items []ScoredItem) []string {
+	out := make([]string, len(items))
+	for i, item := range items {
+		out[i] = item.MediaItemID
+	}
+	return out
+}
diff --git a/internal/recommendations/embed_all_test.go b/internal/recommendations/embed_all_test.go
index c86c7b06f6..a7fd3fc95b 100644
--- a/internal/recommendations/embed_all_test.go
+++ b/internal/recommendations/embed_all_test.go
@@ -2,6 +2,7 @@ package recommendations
 
 import (
 	"context"
+	"slices"
 	"strings"
 	"testing"
 
@@ -76,7 +77,8 @@ func newEmbedAllTestEngine(t *testing.T, pool *pgxpool.Pool, fake embedder, mode
 			EmbeddingModel:   model,
 			EmbeddingBaseURL: "http://embed.test",
 		},
-		pool: pool,
+		pool:          pool,
+		refusedEmbeds: newRefusedEmbedInputs(),
 	}
 }
 
@@ -118,14 +120,14 @@ func TestEmbedAllCheapPassDrainsBeforeTextStalePass(t *testing.T) {
 	fake := &recordingEmbedder{}
 	e := newEmbedAllTestEngine(t, pool, fake, currentModel)
 
-	n, err := e.EmbedAll(ctx)
+	counts, err := e.EmbedAll(ctx)
 	if err != nil {
 		t.Fatalf("EmbedAll: %v", err)
 	}
 
 	// All three should have been (re)embedded: 2 cheap + 1 text-stale.
-	if n < 3 {
-		t.Fatalf("EmbedAll embedded %d items, want >= 3 (2 cheap + 1 text-stale)", n)
+	if counts.Embedded < 3 {
+		t.Fatalf("EmbedAll embedded %d items, want >= 3 (2 cheap + 1 text-stale)", counts.Embedded)
 	}
 
 	// End state: every row now carries the current model and matching text.
@@ -180,15 +182,17 @@ func TestEmbedAllSkipsAlreadyCurrentItems(t *testing.T) {
 	fake := &recordingEmbedder{}
 	e := newEmbedAllTestEngine(t, pool, fake, currentModel)
 
-	n, err := e.EmbedAll(ctx)
+	counts, err := e.EmbedAll(ctx)
 	if err != nil {
 		t.Fatalf("EmbedAll: %v", err)
 	}
-	if n != 0 {
-		t.Fatalf("EmbedAll re-embedded %d up-to-date items, want 0", n)
+	if counts.Embedded != 0 {
+		t.Fatalf("EmbedAll re-embedded %d up-to-date items, want 0", counts.Embedded)
 	}
-	if len(fake.calls) != 0 {
-		t.Fatalf("embedder was called %d times for an up-to-date item, want 0: %v", len(fake.calls), fake.texts)
+	// With no lock, the run embeds only the probe text, to write the lock for
+	// the stored vector (see lockImportedEmbeddings); the item is not resent.
+	if !slices.Equal(fake.texts, []string{embedProbeText}) {
+		t.Fatalf("embedder got %v for an up-to-date item, want only the probe text", fake.texts)
 	}
 }
 
diff --git a/internal/recommendations/embed_backfill.go b/internal/recommendations/embed_backfill.go
new file mode 100644
index 0000000000..9a2c5d4432
--- /dev/null
+++ b/internal/recommendations/embed_backfill.go
@@ -0,0 +1,793 @@
+package recommendations
+
+import (
+	"context"
+	"crypto/sha256"
+	"errors"
+	"fmt"
+	"log/slog"
+	"strings"
+	"sync"
+	"time"
+	"unicode/utf8"
+
+	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/recommendations/embeddings"
+)
+
+const (
+	// embeddingBackfillBatchSize is how many items one embedding API call
+	// carries.
+	embeddingBackfillBatchSize = 10
+
+	// embeddingTextStaleQuotaPerRun bounds how many text-stale items the
+	// text-staleness pass re-embeds in one run. It is also the page size of
+	// that pass's candidate scan.
+	embeddingTextStaleQuotaPerRun = 200
+
+	// maxConsecutiveEmbedFailures ends a run once this many items in a row
+	// fail to embed one at a time: the provider is down, not the items. Inputs
+	// the provider refuses do not count.
+	maxConsecutiveEmbedFailures = 3
+
+	// embedProbeText is embedded when a run's first refused input comes
+	// before anything is stored, and again after maxRefusalsBeforeProbe
+	// inputs in a row are refused, to tell refused inputs from a provider
+	// that refuses every input. The admin connection check sends the same
+	// text.
+	embedProbeText = "prairie connection test"
+
+	// maxRefusalsBeforeProbe is how many inputs in a row the provider may
+	// refuse, with nothing stored and no probe in between, before the run
+	// probes it again: a provider whose key is revoked mid-run (Gemini
+	// answers a bad key with 400) looks like it refuses each input.
+	maxRefusalsBeforeProbe = 3
+
+	// An item whose text the provider rejects is retried shortened to
+	// embedRetryRunes, then to embedRetryShortRunes, when the text is longer
+	// than embedRetryRunes. Local models with a short input window (Ollama,
+	// TEI) reject long texts instead of truncating them.
+	embedRetryRunes      = 600
+	embedRetryShortRunes = 300
+)
+
+// EmbedCounts counts the items one embedding run handled.
+type EmbedCounts struct {
+	// Embedded counts the items whose vector was stored.
+	Embedded int `json:"embedded"`
+	// Truncated counts the embedded items the provider accepted only after
+	// their text was shortened.
+	Truncated int `json:"truncated"`
+	// Failed counts items whose embed call or write failed. The next run
+	// retries them.
+	Failed int `json:"failed"`
+	// Skipped counts items whose input the provider refused, as too long or
+	// invalid, at every length tried. Items the catch-up pass holds back
+	// because the provider refused the same text earlier are not counted.
+	Skipped int `json:"skipped"`
+}
+
+// EmbedAll embeds items that are missing embeddings or have stale canonical
+// text, in two passes:
+//
+//   - Pass 1 (cheap): drain every missing or model-stale item via the
+//     ItemsNeedingEmbedding cursor. This query is a single LEFT JOIN with no
+//     item_people LATERAL joins, so active backfill (lots of brand-new items)
+//     stays cheap. The cursor advances past each page, so an item that fails to
+//     embed or store is retried on the next run rather than stalling the page.
+//   - Pass 2 (expensive): only once Pass 1 has drained, page through
+//     ListEmbeddingTextCandidates for items embedded with the current model
+//     whose canonical text has drifted (for example a cast change), until
+//     embeddingTextStaleQuotaPerRun of them are confirmed in Go or the scan
+//     ends. Detecting drift rebuilds each row's text in SQL with the
+//     item_people LATERAL joins, which is why Pass 1 goes first.
+//
+// Coverage-first tradeoff: when Pass 1 does not drain (a provider limit or the
+// deadline stops it), Pass 2 is skipped, so new items get covered before
+// text-changed ones are refreshed.
+//
+// A run that attempted items and stored none of them returns an error, unless
+// the provider only refused their inputs.
+func (e *Engine) EmbedAll(ctx context.Context) (EmbedCounts, error) {
+	return e.embed(ctx, nil, true)
+}
+
+// EmbedMissing runs Pass 1 of EmbedAll only: it embeds items that have no
+// embedding or one from another model. The worker runs it every few minutes,
+// so newly matched items get embeddings without waiting for the nightly run.
+// It skips items whose unchanged text the provider refused since this
+// server's last EmbedAll.
+func (e *Engine) EmbedMissing(ctx context.Context) (EmbedCounts, error) {
+	return e.embed(ctx, nil, false)
+}
+
+// embed runs EmbedAll, or EmbedMissing without includeTextStale. With held,
+// the embeddings job's cluster lock, the run stops with errJobLockLost before
+// storing vectors once held's session has closed: another server's run or an
+// embeddings reset may hold the lock by then.
+func (e *Engine) embed(ctx context.Context, held clusterLock, includeTextStale bool) (EmbedCounts, error) {
+	b := e.newBackfill()
+	b.held = held
+	err := b.run(ctx, includeTextStale)
+	return b.counts, err
+}
+
+// NeedsEmbedding reports whether any item has no embedding or one from
+// another model.
+func (e *Engine) NeedsEmbedding(ctx context.Context) (bool, error) {
+	ids, err := e.repo.ItemsNeedingEmbedding(ctx, e.cfg.EmbeddingModel, "", 1)
+	if err != nil {
+		return false, err
+	}
+	return len(ids) > 0, nil
+}
+
+func (e *Engine) newBackfill() *embedBackfill {
+	return &embedBackfill{
+		db:      e.repo,
+		client:  e.embClient,
+		baseURL: e.cfg.EmbeddingBaseURL,
+		model:   e.cfg.EmbeddingModel,
+		load:    e.loadEmbeddingItems,
+		refused: e.refusedEmbeds,
+		// Favorites, watchlist and progress in a store outside Postgres are
+		// out of the stale mark's reach, so stored items mark every profile.
+		signalsOutsidePostgres: e.signalReader().storeIsSeparate(),
+	}
+}
+
+// refusedEmbedInputs records the items whose embedding text the provider
+// refused at every length, with a hash of that text. Pass 1 skips an item
+// while its text still hashes the same, so the catch-up pass does not resend
+// a refused text every few minutes. EmbedAll clears the record first and
+// retries them all, and so does any run that finds a different embedding
+// lock than the record was made under, such as none after an embeddings
+// reset. The record is held in memory: each server's Engine keeps its own,
+// and a restart clears it. A nil record remembers nothing.
+type refusedEmbedInputs struct {
+	mu    sync.Mutex
+	texts map[string][sha256.Size]byte
+	// lock is the embedding lock the record was made under; nil for none.
+	lock *EmbeddingLock
+}
+
+func newRefusedEmbedInputs() *refusedEmbedInputs {
+	return &refusedEmbedInputs{texts: map[string][sha256.Size]byte{}}
+}
+
+func (r *refusedEmbedInputs) add(itemID, text string) {
+	if r == nil {
+		return
+	}
+	hash := sha256.Sum256([]byte(text))
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	r.texts[itemID] = hash
+}
+
+// has reports whether the provider refused itemID with this text.
+func (r *refusedEmbedInputs) has(itemID, text string) bool {
+	if r == nil {
+		return false
+	}
+	r.mu.Lock()
+	hash, ok := r.texts[itemID]
+	r.mu.Unlock()
+	return ok && hash == sha256.Sum256([]byte(text))
+}
+
+func (r *refusedEmbedInputs) remove(itemID string) {
+	if r == nil {
+		return
+	}
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	delete(r.texts, itemID)
+}
+
+// useLock clears the record when lock differs from the one it was made
+// under: an embeddings reset, or a model change, makes every refusal worth
+// retrying. lock is nil when none is stored.
+func (r *refusedEmbedInputs) useLock(lock *EmbeddingLock) {
+	if r == nil {
+		return
+	}
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	sameLock := r.lock == nil && lock == nil || r.lock != nil && lock != nil && *r.lock == *lock
+	if sameLock {
+		return
+	}
+	clear(r.texts)
+	r.lock = nil
+	if lock != nil {
+		saved := *lock
+		r.lock = &saved
+	}
+}
+
+func (r *refusedEmbedInputs) reset() {
+	if r == nil {
+		return
+	}
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	clear(r.texts)
+}
+
+// loadEmbeddingItems loads items with their cast and crew, which the
+// embedding text includes.
+func (e *Engine) loadEmbeddingItems(ctx context.Context, ids []string) ([]*models.MediaItem, error) {
+	items, err := e.itemRepo.GetByIDs(ctx, ids)
+	if err != nil {
+		return nil, err
+	}
+	peopleMap, err := e.personRepo.ListForItems(ctx, ids)
+	if err != nil {
+		slog.WarnContext(ctx, "failed to hydrate item people for embeddings", "component", "recommendations", "error", err)
+		return items, nil
+	}
+	for _, item := range items {
+		if people, ok := peopleMap[item.ContentID]; ok {
+			item.People = people
+		}
+	}
+	return items, nil
+}
+
+// embeddingStore is the part of Repo the embedding backfill uses.
+type embeddingStore interface {
+	embeddingLockReader
+	SetEmbeddingLock(ctx context.Context, lock EmbeddingLock) error
+	ItemsNeedingEmbedding(ctx context.Context, currentModel, afterID string, limit int) ([]string, error)
+	ListEmbeddingTextCandidates(ctx context.Context, afterID, currentModel string, limit int) ([]EmbeddingTextCandidate, error)
+	UpsertEmbedding(ctx context.Context, itemID string, embedding []float32, model, canonicalText string) error
+	MarkProfilesStaleForItems(ctx context.Context, itemIDs []string) (int64, error)
+	MarkAllProfilesStale(ctx context.Context) (int64, error)
+	HasEmbeddingsFromModel(ctx context.Context, model string) (bool, error)
+}
+
+const (
+	// signalsStaleBatch is how many stored items a run collects before it
+	// marks the profiles with signals on them stale. Each mark checks every
+	// taste profile, so it runs per batch rather than per embedding chunk.
+	signalsStaleBatch = 500
+	// signalsStaleTimeout bounds one of those marks.
+	signalsStaleTimeout = time.Minute
+)
+
+type embeddingLockReader interface {
+	GetEmbeddingLock(ctx context.Context) (*EmbeddingLock, error)
+}
+
+// embedBackfill is one embedding run. It is not safe for concurrent use.
+type embedBackfill struct {
+	db      embeddingStore
+	client  embedder
+	baseURL string
+	model   string
+	// load returns the items to embed, with the people their text names.
+	load func(ctx context.Context, ids []string) ([]*models.MediaItem, error)
+	// refused records the inputs the provider refused, across runs.
+	refused *refusedEmbedInputs
+	// signalsOutsidePostgres is set when profiles' favorites, watchlist and
+	// progress live in a user store outside Postgres, where the item-based
+	// stale mark cannot see them.
+	signalsOutsidePostgres bool
+	// held is the embeddings job's cluster lock, or nil for a run outside the
+	// job.
+	held clusterLock
+
+	counts EmbedCounts
+	// lock is the embedding lock once this run has read or written it.
+	lock *EmbeddingLock
+	// consecutiveFailures counts the items in a row whose single-item embed
+	// failed for a reason other than a refused input.
+	consecutiveFailures int
+	// lastErr is the newest per-item failure other than a refused input.
+	lastErr error
+	// probed records that the provider embedded embedProbeText in this run.
+	probed bool
+	// unconfirmed lists the items refused since the last stored vector or
+	// successful probe. A failed probe shows the provider was down for them,
+	// so they are counted as failures and not remembered as refused.
+	unconfirmed []string
+	// stored lists the items stored since profiles with signals on them were
+	// last marked stale. With signalsOutsidePostgres it keeps only the first,
+	// since the mark covers every profile whatever was stored.
+	stored []string
+}
+
+func (b *embedBackfill) run(ctx context.Context, includeTextStale bool) error {
+	lock, err := checkEmbeddingLockConfig(ctx, b.db, b.baseURL, b.model)
+	if err != nil {
+		return err
+	}
+	b.refused.useLock(lock)
+	// The vectors stored are committed, however the run ends.
+	defer b.markSignalsStale(context.WithoutCancel(ctx))
+	if includeTextStale {
+		// The full run retries every input refused since the last one.
+		b.refused.reset()
+	}
+	if err := b.embedMissing(ctx); err != nil {
+		return err
+	}
+	if includeTextStale {
+		if err := b.embedTextStale(ctx); err != nil {
+			return err
+		}
+	}
+	if err := b.lockImportedEmbeddings(ctx); err != nil {
+		return err
+	}
+	if b.counts.Embedded == 0 && b.lastErr != nil {
+		return fmt.Errorf("embedding run stored none of the %d items it tried: %w", b.counts.Failed+b.counts.Skipped, b.lastErr)
+	}
+	return nil
+}
+
+// embedMissing is Pass 1: items with no embedding or one from another model.
+func (b *embedBackfill) embedMissing(ctx context.Context) error {
+	afterID := ""
+	for {
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+		ids, err := b.db.ItemsNeedingEmbedding(ctx, b.model, afterID, embeddingBackfillBatchSize)
+		if err != nil {
+			return err
+		}
+		if len(ids) == 0 {
+			return nil
+		}
+		afterID = ids[len(ids)-1]
+
+		items, err := b.load(ctx, ids)
+		if err != nil {
+			return fmt.Errorf("get items for embedding: %w", err)
+		}
+		toEmbed := make([]*models.MediaItem, 0, len(items))
+		texts := make([]string, 0, len(items))
+		for _, item := range items {
+			text := embeddings.BuildEmbeddingText(item)
+			if b.refused.has(item.ContentID, text) {
+				continue
+			}
+			toEmbed = append(toEmbed, item)
+			texts = append(texts, text)
+		}
+		if err := b.embedBatch(ctx, toEmbed, texts); err != nil {
+			return err
+		}
+	}
+}
+
+// embedTextStale is Pass 2: items embedded with the current model whose
+// canonical text no longer matches BuildEmbeddingText. The SQL copy of the
+// text builder can disagree with Go, so each page is re-checked in Go and the
+// scan moves past the rows it skips; rows that only look stale in SQL cannot
+// hold back the real ones behind them.
+func (b *embedBackfill) embedTextStale(ctx context.Context) error {
+	quota := embeddingTextStaleQuotaPerRun
+	afterID := ""
+	for quota > 0 {
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+		candidates, err := b.db.ListEmbeddingTextCandidates(ctx, afterID, b.model, embeddingTextStaleQuotaPerRun)
+		if err != nil {
+			return err
+		}
+		if len(candidates) == 0 {
+			return nil
+		}
+		afterID = candidates[len(candidates)-1].MediaItemID
+
+		ids := make([]string, 0, len(candidates))
+		stored := make(map[string]EmbeddingTextCandidate, len(candidates))
+		for _, candidate := range candidates {
+			ids = append(ids, candidate.MediaItemID)
+			stored[candidate.MediaItemID] = candidate
+		}
+		items, err := b.load(ctx, ids)
+		if err != nil {
+			return fmt.Errorf("get items for embedding: %w", err)
+		}
+		staleItems := make([]*models.MediaItem, 0, len(items))
+		staleTexts := make([]string, 0, len(items))
+		for _, item := range items {
+			text := embeddings.BuildEmbeddingText(item)
+			candidate := stored[item.ContentID]
+			if embeddingTextNeedsRefresh(candidate.Model, candidate.CanonicalText, text, b.model) {
+				staleItems = append(staleItems, item)
+				staleTexts = append(staleTexts, text)
+			}
+		}
+		if len(staleItems) > quota {
+			staleItems, staleTexts = staleItems[:quota], staleTexts[:quota]
+		}
+		if err := b.embedBatch(ctx, staleItems, staleTexts); err != nil {
+			return err
+		}
+		// An item the provider refused uses none of the quota: the walk moves
+		// past it, so refused items at the front cannot starve the rest.
+		for i, item := range staleItems {
+			if !b.refused.has(item.ContentID, staleTexts[i]) {
+				quota--
+			}
+		}
+		if len(candidates) < embeddingTextStaleQuotaPerRun {
+			return nil
+		}
+	}
+	return nil
+}
+
+func embeddingTextNeedsRefresh(storedModel, storedCanonicalText, generatedCanonicalText, currentModel string) bool {
+	return storedModel != currentModel || storedCanonicalText != generatedCanonicalText
+}
+
+// embedBatch embeds and stores items (parallel items/texts slices), in calls
+// of embeddingBackfillBatchSize. A failed batch call falls back to one call
+// per item, so one item the provider rejects does not block the rest.
+//
+// It returns an error that ends the run when the provider will not serve it
+// (a limit, rejected credentials, an unreachable host, repeated failures, or
+// a refusal of every input), when a vector cannot be stored under the
+// embedding lock, or when ctx ends. Other per-item failures are counted and
+// the item is retried next run; an item whose input the provider refused is
+// recorded in b.refused instead.
+func (b *embedBackfill) embedBatch(ctx context.Context, items []*models.MediaItem, texts []string) error {
+	for start := 0; start < len(items); start += embeddingBackfillBatchSize {
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+		// Marking every profile each batch would keep them all stale, and
+		// rebuilt by the sweep, for the whole run, so that mark waits for
+		// the run's end.
+		if len(b.stored) >= signalsStaleBatch && !b.signalsOutsidePostgres {
+			b.markSignalsStale(ctx)
+		}
+		end := min(start+embeddingBackfillBatchSize, len(items))
+		chunkItems, chunkTexts := items[start:end], texts[start:end]
+
+		vectors, err := b.client.Embed(ctx, chunkTexts)
+		if err == nil && len(vectors) != len(chunkTexts) {
+			err = fmt.Errorf("embedding API returned %d vectors for %d inputs", len(vectors), len(chunkTexts))
+		}
+		if err != nil {
+			if stop := runStopError(ctx, err); stop != nil {
+				return stop
+			}
+			slog.WarnContext(ctx, "batch embed failed, falling back to single-item mode", "component", "recommendations", "error", err, "batch_size", len(chunkItems))
+			if err := b.embedEach(ctx, chunkItems, chunkTexts); err != nil {
+				return err
+			}
+			continue
+		}
+
+		b.consecutiveFailures = 0
+		if err := b.checkHeld(ctx); err != nil {
+			return err
+		}
+		for i, item := range chunkItems {
+			if _, err := b.save(ctx, item, vectors[i], chunkTexts[i]); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+
+// checkHeld returns errJobLockLost once the session holding b.held has
+// closed. A run without a held lock is never stopped.
+func (b *embedBackfill) checkHeld(ctx context.Context) error {
+	if b.held == nil {
+		return nil
+	}
+	return b.held.Check(ctx)
+}
+
+// markSignalsStale marks stale the taste profiles with signals on the items
+// stored since the last call. A refresh that ran before those items had
+// vectors left them out of the taste vector, and an embeddings reset leaves
+// every profile without one; the stale sweep rebuilds them. With signals in a
+// user store outside Postgres, which a single small installation uses, it
+// marks every profile, once when the run ends. A failure is logged: the
+// nightly taste run rebuilds every profile anyway.
+func (b *embedBackfill) markSignalsStale(ctx context.Context) {
+	if len(b.stored) == 0 {
+		return
+	}
+	ids := b.stored
+	b.stored = nil
+	ctx, cancel := context.WithTimeout(ctx, signalsStaleTimeout)
+	defer cancel()
+	var marked int64
+	var err error
+	if b.signalsOutsidePostgres {
+		marked, err = b.db.MarkAllProfilesStale(ctx)
+	} else {
+		marked, err = b.db.MarkProfilesStaleForItems(ctx, ids)
+	}
+	if err != nil {
+		slog.WarnContext(ctx, "marking profiles stale after storing embeddings failed", "component", "recommendations", "items", len(ids), "error", err)
+		return
+	}
+	if marked > 0 {
+		slog.InfoContext(ctx, "embeddings stored: taste profiles marked stale", "component", "recommendations", "items", len(ids), "profiles", marked)
+	}
+}
+
+// embedEach embeds and stores items one call at a time.
+func (b *embedBackfill) embedEach(ctx context.Context, items []*models.MediaItem, texts []string) error {
+	for i, item := range items {
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+		vector, limit, err := b.embedOne(ctx, texts[i])
+		if err != nil {
+			if stop := runStopError(ctx, err); stop != nil {
+				return stop
+			}
+			// A refused input says nothing about the provider: it is skipped
+			// and is not a failure, so permanently refused items at the head
+			// of the backlog cannot stop every run. That includes the 5xx a
+			// local model answers an over-long input with, which the
+			// shortened retries also got.
+			if embeddings.InputRefused(err) {
+				b.counts.Skipped++
+				b.refused.add(item.ContentID, texts[i])
+				b.unconfirmed = append(b.unconfirmed, item.ContentID)
+				if err := b.checkProviderAcceptsInput(ctx); err != nil {
+					return err
+				}
+				slog.WarnContext(ctx, "skipping item, provider refused its text", "component", "recommendations", "item_id", item.ContentID, "error", err)
+				continue
+			}
+			b.lastErr = err
+			b.counts.Failed++
+			b.consecutiveFailures++
+			slog.WarnContext(ctx, "skipping item, embed failed", "component", "recommendations", "item_id", item.ContentID, "error", err)
+			if b.consecutiveFailures >= maxConsecutiveEmbedFailures {
+				return providerUnavailable(err)
+			}
+			// The batch call already failed; when the first item alone fails
+			// too and nothing has been stored, the provider may not be
+			// working. Embedding embedProbeText tells an outage from an item
+			// the provider cannot embed, which would otherwise end every run
+			// at the head of the backlog.
+			if i == 0 && b.counts.Embedded == 0 && !b.probed {
+				if _, probeErr := b.embedText(ctx, embedProbeText); probeErr != nil {
+					if stop := runStopError(ctx, probeErr); stop != nil {
+						return stop
+					}
+					return providerUnavailable(err)
+				}
+				b.probed = true
+			}
+			continue
+		}
+
+		b.consecutiveFailures = 0
+		// Store the full text, not the shortened one: Pass 2 compares the
+		// stored text with the full text and would otherwise re-embed the
+		// item on every run.
+		if err := b.checkHeld(ctx); err != nil {
+			return err
+		}
+		saved, err := b.save(ctx, item, vector, texts[i])
+		if err != nil {
+			return err
+		}
+		if saved && limit > 0 {
+			b.counts.Truncated++
+			slog.WarnContext(ctx, "embedded item from shortened text", "component", "recommendations", "item_id", item.ContentID, "runes", utf8.RuneCountInString(texts[i]), "limit", limit)
+		}
+	}
+	return nil
+}
+
+// embedOne embeds one text. When the provider rejects it and the text is
+// longer than embedRetryRunes, it retries with the text shortened to
+// embedRetryRunes, then embedRetryShortRunes. limit is the length that
+// succeeded, or 0 for the full text.
+func (b *embedBackfill) embedOne(ctx context.Context, text string) (vector []float32, limit int, err error) {
+	vector, err = b.embedText(ctx, text)
+	// Only a refused input is worth sending shortened; after any other
+	// failure a shortened vector would be stored under the full text and
+	// never refreshed.
+	if err == nil || !embeddings.InputRefused(err) || runStopError(ctx, err) != nil || utf8.RuneCountInString(text) <= embedRetryRunes {
+		return vector, 0, err
+	}
+	for _, runes := range []int{embedRetryRunes, embedRetryShortRunes} {
+		vector, err = b.embedText(ctx, embeddings.TruncateRunes(text, runes))
+		if err == nil {
+			return vector, runes, nil
+		}
+		if !embeddings.InputRefused(err) || runStopError(ctx, err) != nil {
+			break
+		}
+	}
+	return nil, 0, err
+}
+
+func (b *embedBackfill) embedText(ctx context.Context, text string) ([]float32, error) {
+	vectors, err := b.client.Embed(ctx, []string{text})
+	if err != nil {
+		return nil, err
+	}
+	if len(vectors) != 1 {
+		return nil, fmt.Errorf("embedding API returned %d vectors for 1 input", len(vectors))
+	}
+	return vectors[0], nil
+}
+
+// checkProviderAcceptsInput is called after a refused input. It embeds
+// embedProbeText when the run has stored nothing and not probed yet, or when
+// maxRefusalsBeforeProbe inputs in a row were refused since the last stored
+// vector or probe. When the probe fails too, the provider refuses every
+// input (Gemini answers a bad API key with 400): the unconfirmed refusals
+// become failures, retried next run, and the returned error ends the run.
+func (b *embedBackfill) checkProviderAcceptsInput(ctx context.Context) error {
+	firstCheck := !b.probed && b.counts.Embedded == 0
+	if !firstCheck && len(b.unconfirmed) < maxRefusalsBeforeProbe {
+		return nil
+	}
+	if _, err := b.embedText(ctx, embedProbeText); err != nil {
+		for _, itemID := range b.unconfirmed {
+			b.refused.remove(itemID)
+		}
+		b.counts.Skipped -= len(b.unconfirmed)
+		b.counts.Failed += len(b.unconfirmed)
+		b.unconfirmed = nil
+		if stop := runStopError(ctx, err); stop != nil {
+			return stop
+		}
+		return providerUnavailable(err)
+	}
+	b.probed = true
+	b.unconfirmed = nil
+	return nil
+}
+
+// save stores one item's vector with canonicalText. It returns an error, which
+// ends the run, when the vector does not fit the embedding lock. A failed
+// write is counted and logged, and saved is false.
+func (b *embedBackfill) save(ctx context.Context, item *models.MediaItem, vector []float32, canonicalText string) (saved bool, err error) {
+	if err := b.ensureLock(ctx, vector); err != nil {
+		return false, fmt.Errorf("embed item %s: %w", item.ContentID, err)
+	}
+	if err := b.db.UpsertEmbedding(ctx, item.ContentID, vector, b.model, canonicalText); err != nil {
+		b.counts.Failed++
+		b.lastErr = err
+		slog.WarnContext(ctx, "skipping item, store failed", "component", "recommendations", "item_id", item.ContentID, "error", err)
+		return false, nil
+	}
+	b.counts.Embedded++
+	if !b.signalsOutsidePostgres || len(b.stored) == 0 {
+		b.stored = append(b.stored, item.ContentID)
+	}
+	b.unconfirmed = nil
+	return true, nil
+}
+
+// lockImportedEmbeddings writes the embedding lock for vectors a catalog
+// import stored. The import never writes it, since a bundle records neither
+// the base URL nor the source dimensions, and once every item has a vector no
+// run stores one to write it from, so semantic search, which follows the
+// locked model, would stay off. It embeds embedProbeText once to learn the
+// configured provider's dimensions. A run that stored a vector, or found a
+// lock, has nothing to do.
+func (b *embedBackfill) lockImportedEmbeddings(ctx context.Context) error {
+	if b.lock != nil || b.counts.Embedded > 0 {
+		return nil
+	}
+	lock, err := b.db.GetEmbeddingLock(ctx)
+	if err != nil {
+		return fmt.Errorf("load embedding lock: %w", err)
+	}
+	if lock != nil {
+		b.lock = lock
+		return nil
+	}
+	imported, err := b.db.HasEmbeddingsFromModel(ctx, b.model)
+	if err != nil || !imported {
+		return err
+	}
+	vector, err := b.embedText(ctx, embedProbeText)
+	if err != nil {
+		if stop := runStopError(ctx, err); stop != nil {
+			return stop
+		}
+		return providerUnavailable(err)
+	}
+	return b.ensureLock(ctx, vector)
+}
+
+// ensureLock checks vector against the embedding lock, writing the lock from
+// it when none exists. A vector that cannot be stored never writes the lock,
+// so a model with unusable output cannot pin the installation to itself.
+func (b *embedBackfill) ensureLock(ctx context.Context, vector []float32) error {
+	if err := checkStorableVector(vector); err != nil {
+		return err
+	}
+	if b.lock == nil {
+		lock, err := b.db.GetEmbeddingLock(ctx)
+		if err != nil {
+			return fmt.Errorf("load embedding lock: %w", err)
+		}
+		if lock == nil {
+			lock = &EmbeddingLock{
+				BaseURL:           b.baseURL,
+				Model:             b.model,
+				SourceDimensions:  len(vector),
+				StorageDimensions: CanonicalEmbeddingDimensions,
+			}
+			if err := b.db.SetEmbeddingLock(ctx, *lock); err != nil {
+				return err
+			}
+		}
+		b.lock = lock
+	}
+	return b.lock.Validate(b.baseURL, b.model, len(vector))
+}
+
+// checkStorableVector rejects a vector the embeddings table cannot hold.
+func checkStorableVector(vector []float32) error {
+	switch n := len(vector); {
+	case n == 0:
+		return errors.New("embedding model returned an empty vector")
+	case n > CanonicalEmbeddingDimensions:
+		return fmt.Errorf("embedding model returns %d dimensions; Prairie stores at most %d", n, CanonicalEmbeddingDimensions)
+	}
+	return nil
+}
+
+// checkEmbeddingLockConfig fails when an embedding lock exists for another
+// base URL or model.
+func checkEmbeddingLockConfig(ctx context.Context, store embeddingLockReader, baseURL, model string) (*EmbeddingLock, error) {
+	lock, err := store.GetEmbeddingLock(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("load embedding lock: %w", err)
+	}
+	if lock == nil {
+		return nil, nil
+	}
+	return lock, lock.ValidateConfig(baseURL, model)
+}
+
+// runStopError returns the error that ends the run after a failed embed call,
+// or nil when the run can go on without that call.
+func runStopError(ctx context.Context, err error) error {
+	if ctxErr := ctx.Err(); ctxErr != nil {
+		return ctxErr
+	}
+	// A provider limit will not improve by splitting the batch.
+	if isQuotaError(err) {
+		return fmt.Errorf("embedding batch stopped: %w", err)
+	}
+	if embeddings.Unavailable(err) {
+		return providerUnavailable(err)
+	}
+	return nil
+}
+
+func providerUnavailable(err error) error {
+	return fmt.Errorf("embedding provider unavailable: %w", err)
+}
+
+// isQuotaError identifies provider limits that should stop this backfill run:
+// a spent quota, a rate limit that outlasted the retries, or a retry delay too
+// long to wait for.
+func isQuotaError(err error) bool {
+	var limitErr *embeddings.RateLimitError
+	if errors.As(err, &limitErr) {
+		return true
+	}
+	msg := err.Error()
+	return strings.Contains(msg, "insufficient_quota") ||
+		strings.Contains(msg, "exceeded your current quota") ||
+		strings.Contains(msg, "billing")
+}
diff --git a/internal/recommendations/embed_backfill_test.go b/internal/recommendations/embed_backfill_test.go
new file mode 100644
index 0000000000..97b53fa8d2
--- /dev/null
+++ b/internal/recommendations/embed_backfill_test.go
@@ -0,0 +1,892 @@
+package recommendations
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"slices"
+	"sort"
+	"strings"
+	"syscall"
+	"testing"
+	"unicode/utf8"
+
+	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/recommendations/embeddings"
+)
+
+type quotaTestEmbedder func(context.Context, []string) ([][]float32, error)
+
+func (f quotaTestEmbedder) Embed(ctx context.Context, texts []string) ([][]float32, error) {
+	return f(ctx, texts)
+}
+
+const backfillTestModel = "test-model"
+
+type storedTestEmbedding struct {
+	model, text string
+	dims        int
+}
+
+// fakeEmbeddingStore is an in-memory embeddingStore.
+type fakeEmbeddingStore struct {
+	lock       *EmbeddingLock
+	lockWrites int
+	// missing lists, sorted, the items Pass 1 finds until they are stored.
+	missing []string
+	// candidates lists, sorted by ID, the rows the Pass 2 SQL flags.
+	candidates []EmbeddingTextCandidate
+	// pages records the afterID of each Pass 2 page request.
+	pages     []string
+	stored    map[string]storedTestEmbedding
+	upsertErr error
+	// marked records each MarkProfilesStaleForItems call's items.
+	marked [][]string
+	// markedAll counts MarkAllProfilesStale calls.
+	markedAll int
+}
+
+func (f *fakeEmbeddingStore) HasEmbeddingsFromModel(_ context.Context, model string) (bool, error) {
+	for _, e := range f.stored {
+		if e.model == model {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+func (f *fakeEmbeddingStore) MarkAllProfilesStale(context.Context) (int64, error) {
+	f.markedAll++
+	return 1, nil
+}
+
+func (f *fakeEmbeddingStore) MarkProfilesStaleForItems(_ context.Context, itemIDs []string) (int64, error) {
+	f.marked = append(f.marked, slices.Clone(itemIDs))
+	return int64(len(itemIDs)), nil
+}
+
+func newFakeEmbeddingStore(missing ...string) *fakeEmbeddingStore {
+	sort.Strings(missing)
+	return &fakeEmbeddingStore{missing: missing, stored: map[string]storedTestEmbedding{}}
+}
+
+func (f *fakeEmbeddingStore) GetEmbeddingLock(context.Context) (*EmbeddingLock, error) {
+	if f.lock == nil {
+		return nil, nil
+	}
+	lock := *f.lock
+	return &lock, nil
+}
+
+func (f *fakeEmbeddingStore) SetEmbeddingLock(_ context.Context, lock EmbeddingLock) error {
+	f.lockWrites++
+	f.lock = &lock
+	return nil
+}
+
+func (f *fakeEmbeddingStore) ItemsNeedingEmbedding(_ context.Context, _, afterID string, limit int) ([]string, error) {
+	var ids []string
+	for _, id := range f.missing {
+		if _, ok := f.stored[id]; ok {
+			continue
+		}
+		if id > afterID && len(ids) < limit {
+			ids = append(ids, id)
+		}
+	}
+	return ids, nil
+}
+
+func (f *fakeEmbeddingStore) ListEmbeddingTextCandidates(_ context.Context, afterID, _ string, limit int) ([]EmbeddingTextCandidate, error) {
+	f.pages = append(f.pages, afterID)
+	var page []EmbeddingTextCandidate
+	for _, c := range f.candidates {
+		if c.MediaItemID > afterID && len(page) < limit {
+			page = append(page, c)
+		}
+	}
+	return page, nil
+}
+
+func (f *fakeEmbeddingStore) UpsertEmbedding(_ context.Context, itemID string, embedding []float32, model, canonicalText string) error {
+	if f.upsertErr != nil {
+		return f.upsertErr
+	}
+	f.stored[itemID] = storedTestEmbedding{model: model, text: canonicalText, dims: len(embedding)}
+	return nil
+}
+
+// testItem is the item the fake loader returns for id: a movie titled id,
+// whose embedding text is id, unless overviews names a long text for it.
+func testItem(id string, overviews map[string]string) *models.MediaItem {
+	item := &models.MediaItem{ContentID: id, Type: "movie", Title: id}
+	if overview, ok := overviews[id]; ok {
+		item.Genres = []string{"Drama"}
+		item.Overview = overview
+	}
+	return item
+}
+
+func newTestBackfill(store *fakeEmbeddingStore, client embedder, overviews map[string]string) *embedBackfill {
+	return &embedBackfill{
+		db:      store,
+		client:  client,
+		baseURL: "http://embed.test",
+		model:   backfillTestModel,
+		load: func(_ context.Context, ids []string) ([]*models.MediaItem, error) {
+			items := make([]*models.MediaItem, 0, len(ids))
+			for _, id := range ids {
+				items = append(items, testItem(id, overviews))
+			}
+			return items, nil
+		},
+		refused: newRefusedEmbedInputs(),
+	}
+}
+
+func testVector(dims int) []float32 {
+	vector := make([]float32, dims)
+	vector[0] = 1
+	return vector
+}
+
+// vectorsOf returns an embedder that answers every text with a dims-wide
+// vector and counts its calls.
+func vectorsOf(dims int, calls *int) quotaTestEmbedder {
+	return func(_ context.Context, texts []string) ([][]float32, error) {
+		*calls++
+		out := make([][]float32, len(texts))
+		for i := range texts {
+			out[i] = testVector(dims)
+		}
+		return out, nil
+	}
+}
+
+func testIDs(prefix string, n int) []string {
+	ids := make([]string, n)
+	for i := range ids {
+		ids[i] = fmt.Sprintf("%s%04d", prefix, i)
+	}
+	return ids
+}
+
+func TestEmbedBatchStopsOnProviderLimit(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		err  error
+	}{
+		{"daily quota", &embeddings.RateLimitError{DailyQuota: true}},
+		{"quota exhausted", &embeddings.RateLimitError{QuotaExhausted: true}},
+		{"temporary retries exhausted", &embeddings.RateLimitError{}},
+		{"excessive retry delay", &embeddings.RateLimitError{RetryDeferred: true}},
+		{"wrapped limit", fmt.Errorf("wrapped: %w", &embeddings.RateLimitError{})},
+		{"OpenAI quota text", errors.New("embedding API returned 429: insufficient_quota")},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			calls := 0
+			b := newTestBackfill(newFakeEmbeddingStore(), quotaTestEmbedder(func(context.Context, []string) ([][]float32, error) {
+				calls++
+				return nil, tc.err
+			}), nil)
+			items := []*models.MediaItem{{ContentID: "test-one"}, {ContentID: "test-two"}}
+			err := b.embedBatch(context.Background(), items, []string{"one", "two"})
+			if calls != 1 || b.counts.Embedded != 0 || !errors.Is(err, tc.err) {
+				t.Fatalf("batch stop: calls=%d counts=%+v error=%v", calls, b.counts, err)
+			}
+			if strings.Contains(err.Error(), "check billing") {
+				t.Fatal("batch added an unsupported billing diagnosis")
+			}
+		})
+	}
+}
+
+func TestEmbedBatchStopsFallbackOnProviderLimit(t *testing.T) {
+	calls := 0
+	limitErr := &embeddings.RateLimitError{DailyQuota: true}
+	b := newTestBackfill(newFakeEmbeddingStore(), quotaTestEmbedder(func(context.Context, []string) ([][]float32, error) {
+		calls++
+		if calls == 1 {
+			return nil, errors.New("batch input too large")
+		}
+		return nil, limitErr
+	}), nil)
+	items := []*models.MediaItem{{ContentID: "test-one"}, {ContentID: "test-two"}}
+	err := b.embedBatch(context.Background(), items, []string{"one", "two"})
+	if !errors.Is(err, limitErr) || calls != 2 || b.counts.Embedded != 0 {
+		t.Fatalf("fallback stop: calls=%d counts=%+v error=%v", calls, b.counts, err)
+	}
+}
+
+// A model whose vectors the table cannot hold must never become the locked
+// model: the run fails and writes neither the lock nor any row.
+func TestBackfillUnstorableVectorWritesNoLock(t *testing.T) {
+	for _, dims := range []int{0, CanonicalEmbeddingDimensions + 1, 4096} {
+		t.Run(fmt.Sprint(dims), func(t *testing.T) {
+			calls := 0
+			store := newFakeEmbeddingStore(testIDs("item-", 3)...)
+			b := newTestBackfill(store, quotaTestEmbedder(func(_ context.Context, texts []string) ([][]float32, error) {
+				calls++
+				out := make([][]float32, len(texts))
+				for i := range out {
+					out[i] = make([]float32, dims)
+				}
+				return out, nil
+			}), nil)
+			err := b.run(context.Background(), true)
+			if err == nil || store.lockWrites != 0 || store.lock != nil || len(store.stored) != 0 {
+				t.Fatalf("unstorable %d-d vectors: error=%v lock writes=%d stored=%d", dims, err, store.lockWrites, len(store.stored))
+			}
+			if dims > 0 && !strings.Contains(err.Error(), fmt.Sprintf("returns %d dimensions; Prairie stores at most %d", dims, CanonicalEmbeddingDimensions)) {
+				t.Fatalf("error = %v, want the model's dimensions named", err)
+			}
+		})
+	}
+}
+
+func TestBackfillWritesTheLockFromTheFirstStorableVector(t *testing.T) {
+	calls := 0
+	store := newFakeEmbeddingStore(testIDs("item-", 25)...)
+	b := newTestBackfill(store, vectorsOf(768, &calls), nil)
+	if err := b.run(context.Background(), true); err != nil {
+		t.Fatal(err)
+	}
+	if store.lockWrites != 1 || store.lock.SourceDimensions != 768 || store.lock.Model != backfillTestModel || b.counts.Embedded != 25 || calls != 3 {
+		t.Fatalf("lock=%+v writes=%d counts=%+v calls=%d", store.lock, store.lockWrites, b.counts, calls)
+	}
+}
+
+// The profiles with signals on stored items are marked stale, in batches of
+// signalsStaleBatch items and once more for the rest when the run ends: a
+// refresh that ran before the items had vectors left them out.
+func TestBackfillMarksProfilesStaleForStoredItems(t *testing.T) {
+	calls := 0
+	store := newFakeEmbeddingStore(testIDs("item-", 2*signalsStaleBatch+200)...)
+	b := newTestBackfill(store, vectorsOf(768, &calls), nil)
+	if err := b.run(context.Background(), true); err != nil {
+		t.Fatal(err)
+	}
+	marked := 0
+	for _, ids := range store.marked {
+		marked += len(ids)
+	}
+	if len(store.marked) != 3 || marked != b.counts.Embedded || marked != 2*signalsStaleBatch+200 || store.markedAll != 0 {
+		t.Fatalf("marks = %d calls for %d items (%d whole-server), want 3 calls for every one of the %d stored", len(store.marked), marked, store.markedAll, b.counts.Embedded)
+	}
+
+	// With signals in a user store outside Postgres, the item-based mark
+	// cannot see them, so the run marks every profile instead, once at its
+	// end however many batches it stored.
+	outside := newFakeEmbeddingStore(testIDs("item-", 2*signalsStaleBatch+25)...)
+	b = newTestBackfill(outside, vectorsOf(768, &calls), nil)
+	b.signalsOutsidePostgres = true
+	if err := b.run(context.Background(), true); err != nil {
+		t.Fatal(err)
+	}
+	if outside.markedAll != 1 || len(outside.marked) != 0 {
+		t.Fatalf("store outside Postgres: %d whole-server marks and %d item marks, want one whole-server mark", outside.markedAll, len(outside.marked))
+	}
+}
+
+// Vectors a catalog import stored carry no lock, and with every item embedded
+// no run stores one to write it from. A run that finds them and no lock embeds
+// the probe text once and writes the lock; without them it writes none.
+func TestBackfillLocksImportedEmbeddings(t *testing.T) {
+	calls := 0
+	store := newFakeEmbeddingStore()
+	store.stored["imported"] = storedTestEmbedding{model: backfillTestModel, text: "imported"}
+	b := newTestBackfill(store, vectorsOf(768, &calls), nil)
+	if err := b.run(context.Background(), true); err != nil {
+		t.Fatal(err)
+	}
+	if calls != 1 || store.lockWrites != 1 || store.lock.Model != backfillTestModel || store.lock.SourceDimensions != 768 {
+		t.Fatalf("calls=%d lock writes=%d lock=%+v; want one probe and a lock for the imported model", calls, store.lockWrites, store.lock)
+	}
+
+	calls = 0
+	empty := newFakeEmbeddingStore()
+	b = newTestBackfill(empty, vectorsOf(768, &calls), nil)
+	if err := b.run(context.Background(), true); err != nil {
+		t.Fatal(err)
+	}
+	if calls != 0 || empty.lockWrites != 0 {
+		t.Fatalf("no imported vectors: calls=%d lock writes=%d, want none", calls, empty.lockWrites)
+	}
+}
+
+// A provider that answers 200 with a malformed body fails the run before any
+// lock or row is written: the batch, its first item and the probe all fail.
+func TestBackfillMalformedResponsesFailTheRun(t *testing.T) {
+	for name, entry := range map[string]func(index int) string{
+		"no data":      nil,
+		"null vectors": func(index int) string { return fmt.Sprintf(`{"embedding":null,"index":%d}`, index) },
+		"one short": func(index int) string {
+			if index == 0 {
+				return ""
+			}
+			return fmt.Sprintf(`{"embedding":[0.5,0.5],"index":%d}`, index)
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			requests := 0
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				requests++
+				var req struct {
+					Input []string `json:"input"`
+				}
+				_ = json.NewDecoder(r.Body).Decode(&req)
+				var entries []string
+				for i := range req.Input {
+					if entry != nil {
+						if e := entry(i); e != "" {
+							entries = append(entries, e)
+						}
+					}
+				}
+				_, _ = fmt.Fprintf(w, `{"data":[%s]}`, strings.Join(entries, ","))
+			}))
+			defer srv.Close()
+
+			store := newFakeEmbeddingStore(testIDs("item-", 5)...)
+			b := newTestBackfill(store, embeddings.NewClient(embeddings.ClientConfig{BaseURL: srv.URL, Model: backfillTestModel}), nil)
+			err := b.run(context.Background(), true)
+			if err == nil || !strings.Contains(err.Error(), "embedding provider unavailable") {
+				t.Fatalf("error = %v, want the run to fail", err)
+			}
+			if store.lock != nil || len(store.stored) != 0 || requests != 3 {
+				t.Fatalf("lock=%+v stored=%d requests=%d", store.lock, len(store.stored), requests)
+			}
+		})
+	}
+}
+
+func TestBackfillFailsFastWhenTheProviderIsUnavailable(t *testing.T) {
+	for name, providerErr := range map[string]error{
+		"unauthorized":       &embeddings.StatusError{API: "embedding", StatusCode: 401, Body: "bad key"},
+		"forbidden":          &embeddings.StatusError{API: "embedding", StatusCode: 403},
+		"connection refused": fmt.Errorf("embedding request failed: %w", &net.OpError{Op: "dial", Net: "tcp", Err: syscall.ECONNREFUSED}),
+	} {
+		t.Run(name, func(t *testing.T) {
+			calls := 0
+			store := newFakeEmbeddingStore(testIDs("item-", 30)...)
+			b := newTestBackfill(store, quotaTestEmbedder(func(context.Context, []string) ([][]float32, error) {
+				calls++
+				return nil, providerErr
+			}), nil)
+			err := b.run(context.Background(), true)
+			if calls != 1 || !errors.Is(err, providerErr) || !strings.HasPrefix(err.Error(), "embedding provider unavailable: ") {
+				t.Fatalf("calls=%d error=%v", calls, err)
+			}
+		})
+	}
+}
+
+func TestBackfillStopsWhenFallbackItemsKeepFailing(t *testing.T) {
+	broken := errors.New("embedding API returned 500: model crashed")
+
+	t.Run("first item fails with nothing stored", func(t *testing.T) {
+		calls := 0
+		store := newFakeEmbeddingStore(testIDs("item-", 30)...)
+		b := newTestBackfill(store, quotaTestEmbedder(func(context.Context, []string) ([][]float32, error) {
+			calls++
+			return nil, broken
+		}), nil)
+		err := b.run(context.Background(), true)
+		// The batch, the first item, then the probe.
+		if calls != 3 || !errors.Is(err, broken) || !strings.Contains(err.Error(), "embedding provider unavailable") {
+			t.Fatalf("calls=%d counts=%+v error=%v", calls, b.counts, err)
+		}
+	})
+
+	t.Run("a first item the provider cannot embed does not stop the run", func(t *testing.T) {
+		// "item-0000" always fails with an error that is not a refusal;
+		// every run starts from it, so ending the run there would leave the
+		// items after it unembedded forever.
+		store := newFakeEmbeddingStore(testIDs("item-", 10)...)
+		b := newTestBackfill(store, quotaTestEmbedder(func(_ context.Context, texts []string) ([][]float32, error) {
+			if slices.Contains(texts, "item-0000") {
+				return nil, broken
+			}
+			out := make([][]float32, len(texts))
+			for i := range out {
+				out[i] = testVector(8)
+			}
+			return out, nil
+		}), nil)
+		if err := b.run(context.Background(), true); err != nil {
+			t.Fatal(err)
+		}
+		if b.counts.Embedded != 9 || b.counts.Failed != 1 {
+			t.Fatalf("counts=%+v, want the nine other items embedded", b.counts)
+		}
+	})
+
+	t.Run("three in a row", func(t *testing.T) {
+		calls := 0
+		store := newFakeEmbeddingStore(testIDs("item-", 30)...)
+		b := newTestBackfill(store, quotaTestEmbedder(func(_ context.Context, texts []string) ([][]float32, error) {
+			calls++
+			// The batch and every item after the first fail.
+			if len(texts) > 1 || texts[0] != "item-0000" {
+				return nil, broken
+			}
+			return [][]float32{testVector(8)}, nil
+		}), nil)
+		err := b.run(context.Background(), true)
+		if calls != 5 || b.counts.Embedded != 1 || b.counts.Failed != 3 || !errors.Is(err, broken) || !strings.Contains(err.Error(), "embedding provider unavailable") {
+			t.Fatalf("calls=%d counts=%+v error=%v", calls, b.counts, err)
+		}
+	})
+
+	t.Run("an occasional bad item does not stop the run", func(t *testing.T) {
+		store := newFakeEmbeddingStore(testIDs("item-", 20)...)
+		b := newTestBackfill(store, quotaTestEmbedder(func(_ context.Context, texts []string) ([][]float32, error) {
+			for _, text := range texts {
+				if text == "item-0003" || text == "item-0012" {
+					return nil, &embeddings.StatusError{API: "embedding", StatusCode: 400, Body: "invalid input"}
+				}
+			}
+			out := make([][]float32, len(texts))
+			for i := range out {
+				out[i] = testVector(8)
+			}
+			return out, nil
+		}), nil)
+		if err := b.run(context.Background(), true); err != nil {
+			t.Fatal(err)
+		}
+		if b.counts.Embedded != 18 || b.counts.Skipped != 2 || b.counts.Failed != 0 {
+			t.Fatalf("counts=%+v", b.counts)
+		}
+	})
+}
+
+var testRefusal = &embeddings.StatusError{API: "embedding", StatusCode: 400, Body: "invalid input"}
+
+// refusingEmbedder answers a call with testRefusal when bad reports one of
+// its texts, and counts its calls.
+func refusingEmbedder(bad func(text string) bool, calls *int) quotaTestEmbedder {
+	return func(_ context.Context, texts []string) ([][]float32, error) {
+		*calls++
+		for _, text := range texts {
+			if bad(text) {
+				return nil, testRefusal
+			}
+		}
+		out := make([][]float32, len(texts))
+		for i := range out {
+			out[i] = testVector(8)
+		}
+		return out, nil
+	}
+}
+
+// A refused input says nothing about the provider: it is skipped and never
+// counts as a failure, so refused items at the head of the backlog cannot
+// stop every run. A provider that refuses every input (Gemini answers a bad
+// key with 400) still stops the run, because it refuses the probe text too.
+func TestBackfillSkipsRefusedInputs(t *testing.T) {
+	t.Run("refused items at the head of the backlog", func(t *testing.T) {
+		calls := 0
+		ids := testIDs("item-", 30)
+		bad := map[string]bool{}
+		for _, id := range ids[:maxConsecutiveEmbedFailures+1] {
+			bad[id] = true
+		}
+		store := newFakeEmbeddingStore(ids...)
+		b := newTestBackfill(store, refusingEmbedder(func(text string) bool { return bad[text] }, &calls), nil)
+		if err := b.run(context.Background(), false); err != nil {
+			t.Fatal(err)
+		}
+		// The first batch falls back to single calls, with a probe after
+		// the first refusal and another after three more in a row; the
+		// other two batches succeed.
+		if b.counts.Embedded != 26 || b.counts.Skipped != 4 || b.counts.Failed != 0 || calls != 15 {
+			t.Fatalf("counts=%+v calls=%d", b.counts, calls)
+		}
+		for id := range bad {
+			if _, ok := store.stored[id]; ok || !b.refused.has(id, id) {
+				t.Fatalf("refused %s: stored=%v recorded=%v", id, ok, b.refused.has(id, id))
+			}
+		}
+	})
+
+	t.Run("a provider that refuses every input stops the run", func(t *testing.T) {
+		calls := 0
+		b := newTestBackfill(newFakeEmbeddingStore(testIDs("item-", 30)...), refusingEmbedder(func(string) bool { return true }, &calls), nil)
+		err := b.run(context.Background(), false)
+		// The batch, the first item, and the probe.
+		if calls != 3 || b.counts.Failed != 1 || b.counts.Skipped != 0 || !errors.Is(err, testRefusal) || !strings.HasPrefix(err.Error(), "embedding provider unavailable: ") {
+			t.Fatalf("calls=%d counts=%+v error=%v", calls, b.counts, err)
+		}
+		// The item is not recorded as refused, so the next run tries it again.
+		if b.refused.has("item-0000", "item-0000") {
+			t.Fatal("recorded an item the provider was down for")
+		}
+	})
+
+	t.Run("a key revoked mid-run stops the run", func(t *testing.T) {
+		calls := 0
+		// The provider answers the first batch, then refuses everything.
+		b := newTestBackfill(newFakeEmbeddingStore(testIDs("item-", 30)...), refusingEmbedder(func(string) bool { return calls > 1 }, &calls), nil)
+		err := b.run(context.Background(), false)
+		// The first batch, the second batch, three items refused one at a
+		// time, then the probe.
+		if calls != 6 || !errors.Is(err, testRefusal) || !strings.HasPrefix(err.Error(), "embedding provider unavailable: ") {
+			t.Fatalf("calls=%d error=%v", calls, err)
+		}
+		// The three items the provider refused while it was down are
+		// failures to retry, not refused inputs the catch-up holds back.
+		if b.counts.Embedded != 10 || b.counts.Skipped != 0 || b.counts.Failed != maxRefusalsBeforeProbe {
+			t.Fatalf("counts=%+v", b.counts)
+		}
+		for _, id := range testIDs("item-", 30)[10:13] {
+			if b.refused.has(id, id) {
+				t.Fatalf("recorded %s as refused", id)
+			}
+		}
+	})
+}
+
+// When only refused items are left, the catch-up pass completes, then holds
+// them back until their text changes or a full run retries them, so it does
+// not resend them or record a run every 15 minutes.
+func TestEmbedMissingHoldsBackRefusedInputs(t *testing.T) {
+	calls := 0
+	store := newFakeEmbeddingStore("bad-1", "bad-2")
+	client := refusingEmbedder(func(text string) bool { return text == "bad-1" || text == "bad-2" }, &calls)
+	refused := newRefusedEmbedInputs()
+	run := func(full bool, overviews map[string]string) (EmbedCounts, error) {
+		calls = 0
+		b := newTestBackfill(store, client, overviews)
+		b.refused = refused
+		err := b.run(context.Background(), full)
+		return b.counts, err
+	}
+
+	counts, err := run(false, nil)
+	// The batch, each item alone, and one probe.
+	if err != nil || counts.Skipped != 2 || counts.Embedded != 0 || calls != 4 {
+		t.Fatalf("first pass: counts=%+v calls=%d error=%v", counts, calls, err)
+	}
+	if isIdleRun(newEmbeddingsResult(counts, err, true), err) {
+		t.Fatal("the first pass that refused items is not recorded")
+	}
+
+	counts, err = run(false, nil)
+	if err != nil || counts != (EmbedCounts{}) || calls != 0 || !isIdleRun(newEmbeddingsResult(counts, err, true), err) {
+		t.Fatalf("second pass: counts=%+v calls=%d error=%v", counts, calls, err)
+	}
+
+	counts, err = run(false, map[string]string{"bad-1": "A corrected overview."})
+	if err != nil || counts.Embedded != 1 || counts.Skipped != 0 || calls != 1 {
+		t.Fatalf("pass after bad-1's text changed: counts=%+v calls=%d error=%v", counts, calls, err)
+	}
+
+	counts, err = run(true, nil)
+	if err != nil || counts.Skipped != 1 || counts.Embedded != 0 || calls != 3 {
+		t.Fatalf("full run: counts=%+v calls=%d error=%v", counts, calls, err)
+	}
+	if counts, err = run(false, nil); err != nil || calls != 0 {
+		t.Fatalf("pass after the full run: counts=%+v calls=%d error=%v", counts, calls, err)
+	}
+}
+
+// An embeddings reset deletes the lock on every server, and each server's
+// record of refused inputs was made under the old lock, so the next catch-up
+// pass on any server retries them instead of holding them back until the
+// nightly run.
+func TestEmbedMissingRetriesRefusedInputsAfterTheLockChanges(t *testing.T) {
+	calls := 0
+	store := newFakeEmbeddingStore("bad-1")
+	store.lock = &EmbeddingLock{BaseURL: "http://embed.test", Model: backfillTestModel, SourceDimensions: 8, StorageDimensions: CanonicalEmbeddingDimensions}
+	client := refusingEmbedder(func(text string) bool { return text == "bad-1" }, &calls)
+	refused := newRefusedEmbedInputs()
+	run := func() EmbedCounts {
+		t.Helper()
+		calls = 0
+		b := newTestBackfill(store, client, nil)
+		b.refused = refused
+		if err := b.run(context.Background(), false); err != nil {
+			t.Fatal(err)
+		}
+		return b.counts
+	}
+
+	if counts := run(); counts.Skipped != 1 {
+		t.Fatalf("first pass: counts=%+v", counts)
+	}
+	if counts := run(); counts.Skipped != 0 || calls != 0 {
+		t.Fatalf("second pass under the same lock: counts=%+v calls=%d; want bad-1 held back", counts, calls)
+	}
+	store.lock = nil // an embeddings reset on another server
+	if counts := run(); counts.Skipped != 1 || calls == 0 {
+		t.Fatalf("pass after the reset: counts=%+v calls=%d; want bad-1 retried", counts, calls)
+	}
+}
+
+func TestBackfillRunThatStoresNothingFails(t *testing.T) {
+	calls := 0
+	store := newFakeEmbeddingStore(testIDs("item-", 12)...)
+	store.upsertErr = errors.New("database is read-only")
+	b := newTestBackfill(store, vectorsOf(8, &calls), nil)
+	err := b.run(context.Background(), true)
+	if !errors.Is(err, store.upsertErr) || !strings.Contains(err.Error(), "stored none of the 12 items") || b.counts.Failed != 12 {
+		t.Fatalf("counts=%+v error=%v", b.counts, err)
+	}
+
+	empty := newTestBackfill(newFakeEmbeddingStore(), vectorsOf(8, &calls), nil)
+	if err := empty.run(context.Background(), true); err != nil {
+		t.Fatalf("a run with nothing to do failed: %v", err)
+	}
+}
+
+// overLengthEmbedder rejects any input longer than limit runes the way the
+// given error does, and records every input length it is sent.
+func overLengthEmbedder(limit int, reject error, lengths *[]int) quotaTestEmbedder {
+	return func(_ context.Context, texts []string) ([][]float32, error) {
+		out := make([][]float32, len(texts))
+		for i, text := range texts {
+			*lengths = append(*lengths, utf8.RuneCountInString(text))
+			if utf8.RuneCountInString(text) > limit {
+				return nil, reject
+			}
+			out[i] = testVector(8)
+		}
+		return out, nil
+	}
+}
+
+func TestBackfillRetriesLongTextsShortened(t *testing.T) {
+	overview := strings.Repeat("é", 1000)
+	overviews := map[string]string{"long": overview}
+	fullText := embeddings.BuildEmbeddingText(testItem("long", overviews))
+
+	for _, tc := range []struct {
+		name    string
+		limit   int
+		reject  error
+		lengths []int
+	}{
+		{"accepted at 600 runes", 700, errors.New("embedding API returned 500: input length exceeds the context length"), []int{utf8.RuneCountInString(fullText), 600}},
+		{"accepted at 300 runes", 400, &embeddings.StatusError{API: "embedding", StatusCode: 413}, []int{utf8.RuneCountInString(fullText), 600, 300}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var lengths []int
+			store := newFakeEmbeddingStore("long")
+			b := newTestBackfill(store, overLengthEmbedder(tc.limit, tc.reject, &lengths), overviews)
+			if err := b.run(context.Background(), false); err != nil {
+				t.Fatal(err)
+			}
+			// The first length is the failed batch call.
+			if got := fmt.Sprint(lengths[1:]); got != fmt.Sprint(tc.lengths) {
+				t.Fatalf("single-item input lengths = %s, want %v", got, tc.lengths)
+			}
+			stored := store.stored["long"]
+			if b.counts.Embedded != 1 || b.counts.Truncated != 1 || stored.text != fullText {
+				t.Fatalf("counts=%+v stored text has %d runes, want the full %d", b.counts, utf8.RuneCountInString(stored.text), utf8.RuneCountInString(fullText))
+			}
+			// The next text-staleness check sees the item as current.
+			if embeddingTextNeedsRefresh(stored.model, stored.text, embeddings.BuildEmbeddingText(testItem("long", overviews)), backfillTestModel) {
+				t.Fatal("an item embedded from shortened text looks stale to the next run")
+			}
+		})
+	}
+
+	// A local model's context-length 5xx at every length is a refused input,
+	// not a provider failure, even for the first item of a run: the probe
+	// text passes, so the item is skipped and remembered and the run goes on.
+	t.Run("context length at every length, first item", func(t *testing.T) {
+		var lengths []int
+		store := newFakeEmbeddingStore("long", "z-ok")
+		reject := errors.New("embedding API returned 500: input length exceeds the context length")
+		b := newTestBackfill(store, overLengthEmbedder(100, reject, &lengths), overviews)
+		if err := b.run(context.Background(), false); err != nil {
+			t.Fatalf("run stopped on a refused input: %v", err)
+		}
+		if b.counts.Skipped != 1 || b.counts.Embedded != 1 || b.counts.Failed != 0 || !b.refused.has("long", fullText) {
+			t.Fatalf("counts=%+v refused recorded=%v", b.counts, b.refused.has("long", fullText))
+		}
+	})
+
+	t.Run("rejected at every length", func(t *testing.T) {
+		var lengths []int
+		// "a-ok" sorts first, so the run has stored an item when "long"
+		// fails.
+		store := newFakeEmbeddingStore("a-ok", "long")
+		reject := &embeddings.StatusError{API: "embedding", StatusCode: 400, Body: "too long"}
+		b := newTestBackfill(store, overLengthEmbedder(100, reject, &lengths), overviews)
+		if err := b.run(context.Background(), false); err != nil {
+			t.Fatal(err)
+		}
+		// The batch call sends both texts, then "a-ok" alone, then "long"
+		// at full length, 600 and 300 runes.
+		if b.counts.Skipped != 1 || b.counts.Embedded != 1 || b.counts.Failed != 0 || len(lengths) != 6 {
+			t.Fatalf("counts=%+v lengths=%v", b.counts, lengths)
+		}
+	})
+
+	t.Run("short texts and failures other than length are not retried shortened", func(t *testing.T) {
+		for name, err := range map[string]error{
+			"short text":         errors.New("embedding API returned 500: crashed"),
+			"limit":              &embeddings.RateLimitError{},
+			"server error":       &embeddings.StatusError{API: "embedding", StatusCode: 503, Body: "unavailable"},
+			"malformed response": errors.New("embedding API returned 0 vectors for 1 input"),
+		} {
+			calls := 0
+			text := fullText
+			if name == "short text" {
+				text = "short"
+			}
+			b := newTestBackfill(newFakeEmbeddingStore(), quotaTestEmbedder(func(context.Context, []string) ([][]float32, error) {
+				calls++
+				return nil, err
+			}), nil)
+			if _, _, got := b.embedOne(context.Background(), text); !errors.Is(got, err) || calls != 1 {
+				t.Fatalf("%s: calls=%d error=%v", name, calls, got)
+			}
+		}
+	})
+}
+
+// Rows that only look stale in SQL must not hold back real stale rows behind
+// them, and the run re-embeds at most the per-run quota.
+func TestBackfillTextStalePassPagesPastFalsePositives(t *testing.T) {
+	for _, tc := range []struct {
+		name                 string
+		falsePositives, real int
+		wantEmbedded         int
+		wantPages            int
+	}{
+		// 420 false positives fill two full pages and part of a third.
+		{"real rows behind 420 false positives", 420, 30, 30, 3},
+		// The quota fills on the third page, so no fourth page is read.
+		{"quota stops the scan", 300, 250, embeddingTextStaleQuotaPerRun, 3},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			store := newFakeEmbeddingStore()
+			for _, id := range testIDs("a-false-", tc.falsePositives) {
+				// The stored text equals the Go text: SQL drift flagged it.
+				store.candidates = append(store.candidates, EmbeddingTextCandidate{MediaItemID: id, Model: backfillTestModel, CanonicalText: id})
+			}
+			for _, id := range testIDs("b-real-", tc.real) {
+				store.candidates = append(store.candidates, EmbeddingTextCandidate{MediaItemID: id, Model: backfillTestModel, CanonicalText: "old text"})
+			}
+			calls := 0
+			b := newTestBackfill(store, vectorsOf(8, &calls), nil)
+			if err := b.run(context.Background(), true); err != nil {
+				t.Fatal(err)
+			}
+			if b.counts.Embedded != tc.wantEmbedded || len(store.pages) != tc.wantPages {
+				t.Fatalf("embedded %d over %d pages (%v), want %d over %d", b.counts.Embedded, len(store.pages), store.pages, tc.wantEmbedded, tc.wantPages)
+			}
+			for id := range store.stored {
+				if !strings.HasPrefix(id, "b-real-") {
+					t.Fatalf("re-embedded %s, which is current", id)
+				}
+			}
+			if store.pages[0] != "" || store.pages[1] != store.candidates[embeddingTextStaleQuotaPerRun-1].MediaItemID {
+				t.Fatalf("page cursors = %v", store.pages)
+			}
+		})
+	}
+}
+
+// Stale rows the provider refuses use none of the text-refresh quota, so a
+// full quota of them at the front of the walk cannot keep a later stale row
+// from being re-embedded.
+func TestBackfillTextStalePassWalksPastRefusedRows(t *testing.T) {
+	store := newFakeEmbeddingStore()
+	bad := map[string]bool{}
+	for _, id := range testIDs("a-refused-", embeddingTextStaleQuotaPerRun) {
+		bad[id] = true
+		store.candidates = append(store.candidates, EmbeddingTextCandidate{MediaItemID: id, Model: backfillTestModel, CanonicalText: "old text"})
+	}
+	store.candidates = append(store.candidates, EmbeddingTextCandidate{MediaItemID: "b-stale", Model: backfillTestModel, CanonicalText: "old text"})
+	calls := 0
+	b := newTestBackfill(store, refusingEmbedder(func(text string) bool { return bad[text] }, &calls), nil)
+	if err := b.run(context.Background(), true); err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := store.stored["b-stale"]; !ok || b.counts.Embedded != 1 || b.counts.Skipped != embeddingTextStaleQuotaPerRun {
+		t.Fatalf("counts=%+v, stored b-stale=%v; want the stale row re-embedded past the refused ones", b.counts, ok)
+	}
+}
+
+func TestEmbedMissingSkipsTheTextStalePass(t *testing.T) {
+	calls := 0
+	store := newFakeEmbeddingStore("missing")
+	store.candidates = []EmbeddingTextCandidate{{MediaItemID: "stale", Model: backfillTestModel, CanonicalText: "old"}}
+	b := newTestBackfill(store, vectorsOf(8, &calls), nil)
+	if err := b.run(context.Background(), false); err != nil {
+		t.Fatal(err)
+	}
+	if len(store.pages) != 0 || b.counts.Embedded != 1 {
+		t.Fatalf("pages=%v counts=%+v", store.pages, b.counts)
+	}
+}
+
+func TestBackfillStopsOnALockForAnotherModel(t *testing.T) {
+	calls := 0
+	store := newFakeEmbeddingStore("item")
+	store.lock = &EmbeddingLock{BaseURL: "http://embed.test", Model: "other-model", SourceDimensions: 8}
+	b := newTestBackfill(store, vectorsOf(8, &calls), nil)
+	err := b.run(context.Background(), true)
+	if err == nil || !strings.Contains(err.Error(), "reset required") || calls != 0 {
+		t.Fatalf("calls=%d error=%v", calls, err)
+	}
+}
+
+// lostAfterLock is a clusterLock whose session closes after its first checks
+// calls to Check.
+type lostAfterLock struct {
+	fakeClusterLock
+	checks *int
+}
+
+func (l lostAfterLock) Check(context.Context) error {
+	if *l.checks <= 0 {
+		return errJobLockLost
+	}
+	*l.checks--
+	return nil
+}
+
+// A run whose cluster lock session closes stores nothing more: an embeddings
+// reset or another server's run may hold the lock by then.
+func TestBackfillStopsStoringWhenItsLockIsLost(t *testing.T) {
+	t.Run("batches", func(t *testing.T) {
+		calls, checks := 0, 1
+		store := newFakeEmbeddingStore(testIDs("item-", 25)...)
+		b := newTestBackfill(store, vectorsOf(768, &calls), nil)
+		b.held = lostAfterLock{checks: &checks}
+		if err := b.run(context.Background(), true); !errors.Is(err, errJobLockLost) {
+			t.Fatalf("run error = %v, want errJobLockLost", err)
+		}
+		if b.counts.Embedded != embeddingBackfillBatchSize || calls != 2 {
+			t.Fatalf("counts=%+v calls=%d, want one batch stored and the second dropped", b.counts, calls)
+		}
+	})
+	t.Run("one item at a time", func(t *testing.T) {
+		checks := 1
+		store := newFakeEmbeddingStore(testIDs("item-", 3)...)
+		var client quotaTestEmbedder = func(_ context.Context, texts []string) ([][]float32, error) {
+			if len(texts) > 1 {
+				return nil, errors.New("batch refused")
+			}
+			return [][]float32{testVector(768)}, nil
+		}
+		b := newTestBackfill(store, client, nil)
+		b.held = lostAfterLock{checks: &checks}
+		if err := b.run(context.Background(), true); !errors.Is(err, errJobLockLost) {
+			t.Fatalf("run error = %v, want errJobLockLost", err)
+		}
+		if b.counts.Embedded != 1 {
+			t.Fatalf("counts=%+v, want only the first item stored", b.counts)
+		}
+	})
+}
diff --git a/internal/recommendations/embed_text_postgres_test.go b/internal/recommendations/embed_text_postgres_test.go
new file mode 100644
index 0000000000..9ea3e73fb9
--- /dev/null
+++ b/internal/recommendations/embed_text_postgres_test.go
@@ -0,0 +1,114 @@
+package recommendations
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/recommendations/embeddings"
+)
+
+// The SQL copy of the embedding text must order people who share a
+// sort_order the way Go's byte-wise sortItemPeople does. Otherwise the text
+// scan flags the item as stale on every run and Go skips it every time.
+func TestEmbeddingTextSQLMatchesGoForTiedPeoplePostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := context.Background()
+	const (
+		prefix = "w1a-collate-"
+		model  = "collate-test-model"
+	)
+	cleanupRecoMediaItems(t, pool, prefix)
+	itemID := prefix + "1"
+	seedRecoMediaItemTitled(t, pool, itemID, "movie", "matched", "Collation Test")
+
+	// Each pair sorts one way byte by byte and the other way under a
+	// language collation such as en_US.UTF-8.
+	credits := []struct {
+		name, character string
+		kind            models.PersonKind
+	}{
+		{"Walker", "Pilot", models.PersonKindActor},
+		{"van Dien", "Rico", models.PersonKindActor},
+		{"DeVito", "", models.PersonKindDirector},
+		{"Dean", "", models.PersonKindDirector},
+		{"Fred", "", models.PersonKindWriter},
+		{"Émile", "", models.PersonKindWriter},
+	}
+	base := time.Now().UnixNano()
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM people WHERE id >= $1 AND id < $2`, base, base+int64(len(credits)))
+	})
+	for i, credit := range credits {
+		id := base + int64(i)
+		if _, err := pool.Exec(ctx, `INSERT INTO people (id, name) VALUES ($1, $2)`, id, credit.name); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := pool.Exec(ctx, `
+			INSERT INTO item_people (id, content_id, person_id, kind, character, sort_order)
+			VALUES ($1, $2, $1, $3, $4, 0)`, id, itemID, credit.kind, credit.character); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	var sortsLikeBytes bool
+	if err := pool.QueryRow(ctx, `SELECT 'DeVito' < 'Dean'`).Scan(&sortsLikeBytes); err != nil {
+		t.Fatal(err)
+	}
+	if sortsLikeBytes {
+		t.Log("the database collation sorts like bytes, so this run does not exercise the tie-break")
+	}
+
+	items, err := catalog.NewItemRepository(pool).GetByIDs(ctx, []string{itemID})
+	if err != nil || len(items) != 1 {
+		t.Fatalf("load item: %v", err)
+	}
+	people, err := catalog.NewPersonRepository(pool).ListForItems(ctx, []string{itemID})
+	if err != nil {
+		t.Fatal(err)
+	}
+	items[0].People = people[itemID]
+	goText := embeddings.BuildEmbeddingText(items[0])
+	for _, want := range []string{"Cast: Walker as Pilot, van Dien as Rico", "Directed by DeVito, Dean", "Written by Fred, Émile"} {
+		if !strings.Contains(goText, want) {
+			t.Fatalf("Go text %q lacks %q", goText, want)
+		}
+	}
+	seedRecoEmbedding(t, pool, itemID, model, goText)
+
+	repo := NewRepo(pool)
+	flagged := func() bool {
+		t.Helper()
+		candidates, err := repo.ListEmbeddingTextCandidates(ctx, prefix, model, 1000)
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, c := range candidates {
+			if c.MediaItemID == itemID {
+				return true
+			}
+		}
+		return false
+	}
+	if flagged() {
+		t.Fatalf("the SQL text differs from the Go text %q", goText)
+	}
+
+	// A real change is still found.
+	if _, err := pool.Exec(ctx, `UPDATE media_item_embeddings SET canonical_text = 'stale' WHERE media_item_id = $1`, itemID); err != nil {
+		t.Fatal(err)
+	}
+	if !flagged() {
+		t.Fatal("a text-stale item was not flagged")
+	}
+	// Rows from another model are Pass 1's, not the text scan's.
+	if _, err := pool.Exec(ctx, `UPDATE media_item_embeddings SET model = 'other-model' WHERE media_item_id = $1`, itemID); err != nil {
+		t.Fatal(err)
+	}
+	if flagged() {
+		t.Fatal("the text scan returned a row embedded with another model")
+	}
+}
diff --git a/internal/recommendations/embedding_reset.go b/internal/recommendations/embedding_reset.go
new file mode 100644
index 0000000000..1cbcdb3495
--- /dev/null
+++ b/internal/recommendations/embedding_reset.go
@@ -0,0 +1,257 @@
+package recommendations
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/config"
+)
+
+// EmbeddingLockSettingKey is the server setting that stores the embedding
+// lock.
+const EmbeddingLockSettingKey = embeddingLockSettingKey
+
+// ErrStaleSweepRunning reports an embeddings reset refused because a server
+// is refreshing stale profiles, which read embeddings and write taste
+// profiles.
+var ErrStaleSweepRunning = errors.New("stale profile sweep is running")
+
+// ErrCatalogImportRunning reports an embeddings reset refused because a
+// catalog import that carries embeddings is running: it read the embedding
+// lock before the reset and would insert vectors after it.
+var ErrCatalogImportRunning = errors.New("catalog import with embeddings is running")
+
+// EmbeddingWritersLock is the advisory lock key an embeddings reset takes
+// exclusively and a catalog import that carries embeddings takes shared, each
+// for its transaction, so an import's embeddings and the lock it read them
+// against land entirely before or entirely after a reset.
+const EmbeddingWritersLock int64 = 0x53494C4F52525354 // "PRAIRIERRST"
+
+// ErrEmbeddingSettingsPendingRestart reports an embeddings reset refused
+// because the saved embedding model or base URL is not the one this server
+// runs with: a reset now would let this server re-embed with the old model
+// and lock it again before the restart applies the new one.
+var ErrEmbeddingSettingsPendingRestart = errors.New("saved embedding settings take effect after a restart")
+
+// SavedConfig loads the recommendation settings as they are saved now, which
+// the server runs with after its next restart.
+type SavedConfig func(context.Context) (config.RecommendationsConfig, error)
+
+// WithSavedConfig lets ResetEmbeddings refuse while saved embedding settings
+// wait for a restart, and returns the worker.
+func (w *Worker) WithSavedConfig(load SavedConfig) *Worker {
+	if w != nil {
+		w.savedConfig = load
+	}
+	return w
+}
+
+// checkEmbeddingSettingsActive returns ErrEmbeddingSettingsPendingRestart
+// when the saved embedding model or base URL differs from the running one.
+func (w *Worker) checkEmbeddingSettingsActive(ctx context.Context) error {
+	if w.savedConfig == nil || w.engine == nil {
+		return nil
+	}
+	saved, err := w.savedConfig(ctx)
+	if err != nil {
+		return fmt.Errorf("load saved embedding settings: %w", err)
+	}
+	running := w.engine.cfg
+	if saved.EmbeddingModel != running.EmbeddingModel || saved.EmbeddingBaseURL != running.EmbeddingBaseURL {
+		return ErrEmbeddingSettingsPendingRestart
+	}
+	return nil
+}
+
+// resetEmbeddingsTimeout bounds the reset transaction.
+const resetEmbeddingsTimeout = 2 * time.Minute
+
+// EmbeddingsReset counts the rows an embeddings reset deleted.
+type EmbeddingsReset struct {
+	Embeddings    int64
+	TasteProfiles int64
+	TasteClusters int64
+	CachedRows    int64
+}
+
+// ResetEmbeddings deletes the embedding lock, every item embedding, every
+// taste cluster and every profile's cached rows, and clears every taste
+// profile's vector, in one transaction, so the next embedding run starts a new embedding space with
+// whatever model the server is configured for. Global rows (popular, recently
+// added, top rated, genre samplers) do not use embeddings and stay.
+//
+// The reset holds the claims of every job that reads or writes those rows
+// (embeddings, taste profiles, the cache) and the stale sweep's lock, so none
+// of them interleaves with it on any server; co-watch pairs do not depend on
+// embeddings. A busy job or sweep refuses the reset with ErrJobRunning,
+// ErrJobRunningElsewhere or ErrStaleSweepRunning, a catalog import carrying
+// embeddings refuses it with ErrCatalogImportRunning, and saved embedding
+// settings that wait for a restart refuse it with
+// ErrEmbeddingSettingsPendingRestart. A profile refresh already
+// running when the reset commits can still write one taste profile built from
+// the old embeddings; the profile's next refresh after re-embedding replaces
+// it.
+//
+// Every item that lost its embedding gets a search index upsert, so its
+// search document drops the old vector on the next index sync.
+func (w *Worker) ResetEmbeddings(ctx context.Context) (EmbeddingsReset, error) {
+	if err := w.checkEmbeddingSettingsActive(ctx); err != nil {
+		return EmbeddingsReset{}, err
+	}
+	// One connection holds every claim's cluster lock and the sweep's.
+	held, release, err := w.claimJobs(JobEmbeddings, JobTasteProfiles, JobRecommendations)
+	if err != nil {
+		return EmbeddingsReset{}, err
+	}
+	defer release()
+
+	lockCtx, cancel := context.WithTimeout(ctx, jobLockTimeout)
+	unlock, acquired, err := held.TryAlso(lockCtx, staleSweepLock)
+	cancel()
+	if err != nil {
+		return EmbeddingsReset{}, fmt.Errorf("take stale sweep lock: %w", err)
+	}
+	if !acquired {
+		return EmbeddingsReset{}, ErrStaleSweepRunning
+	}
+	defer unlock()
+
+	ctx, cancel = context.WithTimeout(ctx, resetEmbeddingsTimeout)
+	defer cancel()
+	res, err := w.engine.repo.ResetEmbeddings(ctx)
+	if err != nil {
+		return EmbeddingsReset{}, err
+	}
+	slog.InfoContext(ctx, "recommendation embeddings reset", "component", "recommendations",
+		"embeddings", res.Embeddings, "taste_profiles", res.TasteProfiles, "taste_clusters", res.TasteClusters, "cached_rows", res.CachedRows)
+	return res, nil
+}
+
+// ResetEmbeddings deletes the embedding lock, every item embedding, taste
+// cluster and per-profile cache row, and clears every taste profile's vector,
+// in one transaction, and queues a search index upsert for every item that had an embedding.
+func (r *Repo) ResetEmbeddings(ctx context.Context) (EmbeddingsReset, error) {
+	var res EmbeddingsReset
+	tx, err := r.pool.Begin(ctx)
+	if err != nil {
+		return res, fmt.Errorf("begin embeddings reset: %w", err)
+	}
+	defer func() { _ = tx.Rollback(ctx) }()
+
+	var locked bool
+	if err := tx.QueryRow(ctx, `SELECT pg_try_advisory_xact_lock($1)`, EmbeddingWritersLock).Scan(&locked); err != nil {
+		return res, fmt.Errorf("take embedding writers lock: %w", err)
+	}
+	if !locked {
+		return res, ErrCatalogImportRunning
+	}
+
+	if _, err := tx.Exec(ctx, `DELETE FROM server_settings WHERE key = $1`, embeddingLockSettingKey); err != nil {
+		return res, fmt.Errorf("delete embedding lock: %w", err)
+	}
+	rows, err := tx.Query(ctx, `DELETE FROM media_item_embeddings RETURNING media_item_id`)
+	if err != nil {
+		return res, fmt.Errorf("delete embeddings: %w", err)
+	}
+	itemIDs, err := pgx.CollectRows(rows, pgx.RowTo[string])
+	if err != nil {
+		return res, fmt.Errorf("delete embeddings: %w", err)
+	}
+	res.Embeddings = int64(len(itemIDs))
+
+	for _, step := range []struct {
+		what  string
+		query string
+		count *int64
+	}{
+		{"taste clusters", `DELETE FROM user_taste_clusters`, &res.TasteClusters},
+		// Taste rows keep their signal counts and lose only their vectors:
+		// when the embedding job stores their titles' vectors again it marks
+		// these rows stale, and the stale sweep rebuilds them. A deleted row
+		// would wait for the nightly taste run.
+		{"taste profiles", `UPDATE user_taste_profiles SET embedding = NULL WHERE embedding IS NOT NULL`, &res.TasteProfiles},
+		// Global rows have no user and do not use embeddings.
+		{"cached rows", `DELETE FROM recommendation_cache WHERE user_id IS NOT NULL`, &res.CachedRows},
+	} {
+		tag, err := tx.Exec(ctx, step.query)
+		if err != nil {
+			return res, fmt.Errorf("reset %s: %w", step.what, err)
+		}
+		*step.count = tag.RowsAffected()
+	}
+
+	if err := catalog.EnqueueSearchIndexUpserts(ctx, tx, itemIDs); err != nil {
+		return res, fmt.Errorf("queue search index updates: %w", err)
+	}
+	if err := tx.Commit(ctx); err != nil {
+		return res, fmt.Errorf("commit embeddings reset: %w", err)
+	}
+	return res, nil
+}
+
+// EmbeddingLockConflict explains why the stored embedding lock rejects the
+// embedding configuration this server runs, or returns "" when it does not or
+// no lock is stored.
+func (w *Worker) EmbeddingLockConflict(ctx context.Context) (string, error) {
+	lock, err := w.engine.repo.GetEmbeddingLock(ctx)
+	if err != nil || lock == nil {
+		return "", err
+	}
+	return DescribeEmbeddingLockConflict(*lock, w.engine.cfg.EmbeddingBaseURL, w.engine.cfg.EmbeddingModel, 0), nil
+}
+
+// DescribeEmbeddingLockConflict explains why lock rejects an embedding
+// configuration whose model returns sourceDimensions (0 when unknown), or
+// returns "" when it does not. A lock recording vectors Prairie cannot store is a
+// conflict for every configuration. The text never quotes a base URL, which
+// can carry credentials.
+func DescribeEmbeddingLockConflict(lock EmbeddingLock, baseURL, model string, sourceDimensions int) string {
+	err := lock.ValidateConfig(baseURL, model)
+	if err == nil && sourceDimensions > 0 {
+		err = lock.Validate(baseURL, model, sourceDimensions)
+	}
+	// Stored vectors of another width conflict whatever the model returns,
+	// so this needs no probe of the provider.
+	if err == nil && lock.StorageDimensions != 0 && lock.StorageDimensions != CanonicalEmbeddingDimensions {
+		return fmt.Sprintf("Embeddings were stored at %d dimensions; this server stores %d. Reset embeddings.", lock.StorageDimensions, CanonicalEmbeddingDimensions)
+	}
+	if err != nil {
+		switch {
+		case lock.BaseURL != "" && lock.BaseURL != baseURL:
+			return "Embeddings were created with a different provider base URL. Reset embeddings before switching providers."
+		case lock.Model != "" && lock.Model != model:
+			return fmt.Sprintf("Embeddings were created with model %q, not %q. Reset embeddings before switching models.", lock.Model, model)
+		case lock.SourceDimensions != 0 && lock.SourceDimensions != sourceDimensions:
+			return fmt.Sprintf("Embeddings were created with %d-dimension vectors, but the model now returns %d. Reset embeddings before switching models.", lock.SourceDimensions, sourceDimensions)
+		default:
+			return fmt.Sprintf("Embeddings were stored at %d dimensions; this server stores %d. Reset embeddings.", lock.StorageDimensions, CanonicalEmbeddingDimensions)
+		}
+	}
+	if lock.SourceDimensions <= 0 || lock.SourceDimensions > CanonicalEmbeddingDimensions {
+		return fmt.Sprintf("The embedding lock records %d-dimension vectors; Prairie stores 1 to %d. Reset embeddings and use a model that returns at most %d dimensions.",
+			lock.SourceDimensions, CanonicalEmbeddingDimensions, CanonicalEmbeddingDimensions)
+	}
+	return ""
+}
+
+// CacheRefreshedAt returns when the newest cached row was written, or nil
+// when nothing is cached.
+func (w *Worker) CacheRefreshedAt(ctx context.Context) (*time.Time, error) {
+	return w.engine.repo.CacheRefreshedAt(ctx)
+}
+
+// CacheRefreshedAt returns the newest cache row's write time, or nil when the
+// cache is empty.
+func (r *Repo) CacheRefreshedAt(ctx context.Context) (*time.Time, error) {
+	var at *time.Time
+	if err := r.pool.QueryRow(ctx, `SELECT MAX(created_at) FROM recommendation_cache`).Scan(&at); err != nil {
+		return nil, fmt.Errorf("read cache refresh time: %w", err)
+	}
+	return at, nil
+}
diff --git a/internal/recommendations/embedding_reset_test.go b/internal/recommendations/embedding_reset_test.go
new file mode 100644
index 0000000000..e5047f3955
--- /dev/null
+++ b/internal/recommendations/embedding_reset_test.go
@@ -0,0 +1,437 @@
+package recommendations
+
+import (
+	"context"
+	"errors"
+	"slices"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/config"
+)
+
+// keyedLocker refuses the keys another server holds and grants the rest.
+type keyedLocker struct {
+	mu       sync.Mutex
+	held     map[int64]bool
+	keys     []int64
+	released int
+}
+
+func (l *keyedLocker) TryLock(_ context.Context, key int64) (clusterLock, bool, error) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	l.keys = append(l.keys, key)
+	if l.held[key] {
+		return nil, false, nil
+	}
+	return fakeClusterLock{take: l.TryLock, release: func() {
+		l.mu.Lock()
+		defer l.mu.Unlock()
+		l.released++
+	}}, true, nil
+}
+
+func (l *keyedLocker) snapshot() (keys []int64, released int) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	return slices.Clone(l.keys), l.released
+}
+
+func assertNothingRunning(t *testing.T, w *Worker) {
+	t.Helper()
+	for _, name := range []JobName{JobEmbeddings, JobTasteProfiles, JobCowatch, JobRecommendations} {
+		if w.IsRunning(name) {
+			t.Fatalf("%s is still marked running", name)
+		}
+	}
+}
+
+func TestResetEmbeddingsRefusesWhileAJobRunsHere(t *testing.T) {
+	locker := &keyedLocker{}
+	w := newJobTestWorker(locker, nil)
+	// No engine: a reset that went ahead would dereference it.
+	w.setRunning(JobTasteProfiles, true)
+
+	_, err := w.ResetEmbeddings(t.Context())
+	if !errors.Is(err, ErrJobRunning) {
+		t.Fatalf("reset while taste profiles run = %v, want ErrJobRunning", err)
+	}
+	keys, released := locker.snapshot()
+	if !slices.Equal(keys, []int64{embeddingsJobLock}) || released != 1 {
+		t.Fatalf("locks taken %#x, released %d; want only the embeddings lock, released", keys, released)
+	}
+	if w.IsRunning(JobEmbeddings) || !w.IsRunning(JobTasteProfiles) {
+		t.Fatal("the reset kept a claim, or dropped the running job's flag")
+	}
+}
+
+func TestResetEmbeddingsRefusesWhileAnotherServerRunsAJob(t *testing.T) {
+	locker := &keyedLocker{held: map[int64]bool{cacheJobLock: true}}
+	w := newJobTestWorker(locker, nil)
+
+	_, err := w.ResetEmbeddings(t.Context())
+	if !errors.Is(err, ErrJobRunningElsewhere) {
+		t.Fatalf("reset while another server caches = %v, want ErrJobRunningElsewhere", err)
+	}
+	keys, released := locker.snapshot()
+	if !slices.Equal(keys, []int64{embeddingsJobLock, tasteProfilesJobLock, cacheJobLock}) || released != 2 {
+		t.Fatalf("locks taken %#x, released %d", keys, released)
+	}
+	assertNothingRunning(t, w)
+}
+
+func TestResetEmbeddingsRefusesWhileProfilesAreSwept(t *testing.T) {
+	locker := &keyedLocker{held: map[int64]bool{staleSweepLock: true}}
+	w := newJobTestWorker(locker, nil)
+
+	_, err := w.ResetEmbeddings(t.Context())
+	if !errors.Is(err, ErrStaleSweepRunning) {
+		t.Fatalf("reset during a stale sweep = %v, want ErrStaleSweepRunning", err)
+	}
+	keys, released := locker.snapshot()
+	if !slices.Equal(keys, []int64{embeddingsJobLock, tasteProfilesJobLock, cacheJobLock, staleSweepLock}) || released != 3 {
+		t.Fatalf("locks taken %#x, released %d", keys, released)
+	}
+	assertNothingRunning(t, w)
+}
+
+// Saved embedding settings that wait for a restart refuse a reset before it
+// claims anything: this server would re-embed with the old model and lock it
+// again. Matching settings let the reset go on to its claims.
+func TestResetEmbeddingsRefusesWhileSavedSettingsWaitForARestart(t *testing.T) {
+	running := config.RecommendationsConfig{EmbeddingModel: "old", EmbeddingBaseURL: "http://embed:11434"}
+	for _, tc := range []struct {
+		name  string
+		saved config.RecommendationsConfig
+		want  error
+	}{
+		{"new model", config.RecommendationsConfig{EmbeddingModel: "new", EmbeddingBaseURL: running.EmbeddingBaseURL}, ErrEmbeddingSettingsPendingRestart},
+		{"new base URL", config.RecommendationsConfig{EmbeddingModel: running.EmbeddingModel, EmbeddingBaseURL: "http://other:11434"}, ErrEmbeddingSettingsPendingRestart},
+		{"active", running, ErrStaleSweepRunning},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			locker := &keyedLocker{held: map[int64]bool{staleSweepLock: true}}
+			w := newJobTestWorker(locker, nil)
+			w.engine = &Engine{cfg: running}
+			w.WithSavedConfig(func(context.Context) (config.RecommendationsConfig, error) { return tc.saved, nil })
+
+			_, err := w.ResetEmbeddings(t.Context())
+			if !errors.Is(err, tc.want) {
+				t.Fatalf("reset = %v, want %v", err, tc.want)
+			}
+			if keys, _ := locker.snapshot(); errors.Is(tc.want, ErrEmbeddingSettingsPendingRestart) && len(keys) != 0 {
+				t.Fatalf("a refused reset took locks %#x", keys)
+			}
+			assertNothingRunning(t, w)
+		})
+	}
+}
+
+func TestResetEmbeddingsHoldsEveryClaimWhileItRuns(t *testing.T) {
+	locker := &keyedLocker{}
+	w := newJobTestWorker(locker, nil)
+	w.engine = closedPoolEngine(t)
+
+	_, err := w.ResetEmbeddings(t.Context())
+	if err == nil || errors.Is(err, ErrJobRunning) || errors.Is(err, ErrJobRunningElsewhere) || errors.Is(err, ErrStaleSweepRunning) {
+		t.Fatalf("reset against a failing database = %v, want a database error", err)
+	}
+	keys, released := locker.snapshot()
+	if !slices.Equal(keys, []int64{embeddingsJobLock, tasteProfilesJobLock, cacheJobLock, staleSweepLock}) || released != 4 {
+		t.Fatalf("locks taken %#x, released %d", keys, released)
+	}
+	assertNothingRunning(t, w)
+	// A cron run of any of those jobs can start again afterwards.
+	if err := w.runJob(job{name: JobEmbeddings, timeout: time.Minute, run: func(context.Context, clusterLock) (jobResult, error) {
+		return embeddingsResult{}, nil
+	}}, false); err != nil {
+		t.Fatalf("embeddings after the reset: %v", err)
+	}
+}
+
+func TestDescribeEmbeddingLockConflict(t *testing.T) {
+	lock := EmbeddingLock{BaseURL: "https://user:pw@embed.example", Model: "model-a", SourceDimensions: 768, StorageDimensions: CanonicalEmbeddingDimensions}
+	for _, tc := range []struct {
+		name    string
+		lock    EmbeddingLock
+		baseURL string
+		model   string
+		dims    int
+		want    string
+	}{
+		{"matching", lock, lock.BaseURL, "model-a", 768, ""},
+		{"matching, dimensions unknown", lock, lock.BaseURL, "model-a", 0, ""},
+		{"other base URL", lock, "http://other", "model-a", 768, "different provider base URL"},
+		{"other model", lock, lock.BaseURL, "model-b", 768, `model "model-a", not "model-b"`},
+		{"other dimensions", lock, lock.BaseURL, "model-a", 1024, "768-dimension vectors, but the model now returns 1024"},
+		{"unstorable lock", EmbeddingLock{BaseURL: "http://ollama", Model: "qwen3-embedding:latest", SourceDimensions: 4096}, "http://ollama", "qwen3-embedding:latest", 0, "records 4096-dimension vectors; Prairie stores 1 to 3072"},
+		{"zero-dimension lock", EmbeddingLock{BaseURL: "http://ollama", Model: "m"}, "http://ollama", "m", 0, "records 0-dimension vectors"},
+		{"other storage", EmbeddingLock{Model: "m", SourceDimensions: 768, StorageDimensions: 1536}, "", "m", 768, "stored at 1536 dimensions"},
+		{"other storage, dimensions unknown", EmbeddingLock{Model: "m", SourceDimensions: 768, StorageDimensions: 1536}, "", "m", 0, "stored at 1536 dimensions"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			got := DescribeEmbeddingLockConflict(tc.lock, tc.baseURL, tc.model, tc.dims)
+			if tc.want == "" && got != "" || !strings.Contains(got, tc.want) {
+				t.Fatalf("conflict = %q, want %q", got, tc.want)
+			}
+			if strings.Contains(got, "pw@") || strings.Contains(got, "embed.example") || strings.Contains(got, "http://other") {
+				t.Fatalf("conflict quotes a base URL: %q", got)
+			}
+		})
+	}
+}
+
+func TestEmbeddingLockConflictUsesTheRunningConfigPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	snapshotEmbeddingLock(t, pool)
+	ctx := t.Context()
+	w := newJobTestWorker(&keyedLocker{}, nil)
+	w.engine = &Engine{repo: NewRepo(pool)}
+	w.engine.cfg.EmbeddingBaseURL = "http://ollama:11434"
+	w.engine.cfg.EmbeddingModel = "model-b"
+
+	if _, err := pool.Exec(ctx, `DELETE FROM server_settings WHERE key = $1`, embeddingLockSettingKey); err != nil {
+		t.Fatal(err)
+	}
+	if conflict, err := w.EmbeddingLockConflict(ctx); err != nil || conflict != "" {
+		t.Fatalf("no lock: %q, %v", conflict, err)
+	}
+	if err := w.engine.repo.SetEmbeddingLock(ctx, EmbeddingLock{BaseURL: "http://ollama:11434", Model: "model-a", SourceDimensions: 768}); err != nil {
+		t.Fatal(err)
+	}
+	if conflict, err := w.EmbeddingLockConflict(ctx); err != nil || !strings.Contains(conflict, `"model-a", not "model-b"`) {
+		t.Fatalf("other model: %q, %v", conflict, err)
+	}
+}
+
+// resetFixture seeds two embedded items, a lock, a profile's taste profile,
+// cluster and cached rows, and a global cached row.
+type resetFixture struct {
+	itemIDs    []string
+	userID     int
+	globalType string
+}
+
+func seedResetFixture(t *testing.T, ctx context.Context, repo *Repo) resetFixture {
+	t.Helper()
+	pool := repo.pool
+	f := resetFixture{globalType: "test_global_" + uuid.NewString()}
+	for i := range 2 {
+		id := "reset-" + uuid.NewString()
+		seedRecoMediaItemTitled(t, pool, id, "movie", "matched", "Reset Fixture "+id)
+		f.itemIDs = append(f.itemIDs, id)
+		vector := make([]float32, 8)
+		vector[i] = 1
+		if err := repo.UpsertEmbedding(ctx, id, vector, "model-a", "text"); err != nil {
+			t.Fatalf("seed embedding: %v", err)
+		}
+	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM media_items WHERE content_id = ANY($1)`, f.itemIDs)
+		_, _ = pool.Exec(context.Background(), `DELETE FROM catalog_search_index_events WHERE content_id = ANY($1)`, f.itemIDs)
+	})
+	if err := repo.SetEmbeddingLock(ctx, EmbeddingLock{BaseURL: "http://ollama", Model: "model-a", SourceDimensions: 8}); err != nil {
+		t.Fatal(err)
+	}
+	if err := pool.QueryRow(ctx, `INSERT INTO users (username, role) VALUES ($1, 'user') RETURNING id`,
+		"embeddings-reset-"+uuid.NewString()).Scan(&f.userID); err != nil {
+		t.Fatalf("insert user: %v", err)
+	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM users WHERE id = $1`, f.userID)
+	})
+	taste := make([]float32, CanonicalEmbeddingDimensions)
+	taste[0] = 1
+	if err := repo.UpsertTasteProfile(ctx, f.userID, "p", taste, map[string]int{"watched": 2}, "", time.Now()); err != nil {
+		t.Fatalf("seed taste profile: %v", err)
+	}
+	if err := repo.UpsertTasteClusters(ctx, f.userID, "p", []TasteCluster{{ClusterIdx: 0, Embedding: taste, Label: "Drama", MemberCount: 2, TotalWeight: 1}}); err != nil {
+		t.Fatalf("seed taste clusters: %v", err)
+	}
+	items := []ScoredItem{{MediaItemID: f.itemIDs[0], Score: 1}}
+	expires := cacheExpiry(time.Now())
+	if err := repo.UpsertRecommendationCache(ctx, f.userID, "p", RecTypeForYouMain, "", items, expires); err != nil {
+		t.Fatal(err)
+	}
+	if err := repo.UpsertRecommendationCache(ctx, GlobalCacheUserID, GlobalCacheProfileID, f.globalType, "", items, expires); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM recommendation_cache WHERE user_id IS NULL AND rec_type = $1`, f.globalType)
+	})
+	return f
+}
+
+// useMeilisearchProvider makes search index writes queue events for the
+// test's duration.
+func useMeilisearchProvider(t *testing.T, ctx context.Context, repo *Repo) {
+	t.Helper()
+	var original *string
+	_ = repo.pool.QueryRow(ctx, `SELECT value FROM server_settings WHERE key = $1`, catalog.SearchSettingProvider).Scan(&original)
+	t.Cleanup(func() {
+		if original == nil {
+			_, _ = repo.pool.Exec(context.Background(), `DELETE FROM server_settings WHERE key = $1`, catalog.SearchSettingProvider)
+			return
+		}
+		_, _ = repo.pool.Exec(context.Background(), `UPDATE server_settings SET value = $2 WHERE key = $1`, catalog.SearchSettingProvider, *original)
+	})
+	if _, err := repo.pool.Exec(ctx, `
+		INSERT INTO server_settings (key, value) VALUES ($1, $2)
+		ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value`, catalog.SearchSettingProvider, catalog.SearchProviderMeilisearch); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// The reset deletes every embedding, the lock, taste profiles, clusters and
+// per-profile cache rows together, keeps global rows, and queues a search
+// update for every item that lost its vector.
+func TestResetEmbeddingsPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	snapshotEmbeddingLock(t, pool)
+	ctx := t.Context()
+	repo := NewRepo(pool)
+	f := seedResetFixture(t, ctx, repo)
+	useMeilisearchProvider(t, ctx, repo)
+	var lastEvent int64
+	if err := pool.QueryRow(ctx, `SELECT COALESCE(MAX(id), 0) FROM catalog_search_index_events`).Scan(&lastEvent); err != nil {
+		t.Fatal(err)
+	}
+	before := countRows(t, repo.pool, `SELECT COUNT(*) FROM media_item_embeddings`)
+
+	res, err := repo.ResetEmbeddings(ctx)
+	if err != nil {
+		t.Fatalf("reset: %v", err)
+	}
+	if res.Embeddings != int64(before) || res.TasteProfiles < 1 || res.TasteClusters < 1 || res.CachedRows < 1 {
+		t.Fatalf("reset counts = %+v, want %d embeddings and the seeded taste and cache rows", res, before)
+	}
+	if lock, err := repo.GetEmbeddingLock(ctx); err != nil || lock != nil {
+		t.Fatalf("lock after reset = %+v, %v", lock, err)
+	}
+	for _, table := range []string{"media_item_embeddings", "user_taste_clusters"} {
+		if n := countRows(t, repo.pool, `SELECT COUNT(*) FROM `+table); n != 0 {
+			t.Fatalf("%s has %d rows after reset", table, n)
+		}
+	}
+	// Taste rows stay, without vectors, for the embedding job to mark stale.
+	if n := countRows(t, repo.pool, `SELECT COUNT(*) FROM user_taste_profiles WHERE embedding IS NOT NULL`); n != 0 {
+		t.Fatalf("%d taste profiles keep a vector after reset", n)
+	}
+	if n := countRows(t, repo.pool, `SELECT COUNT(*) FROM user_taste_profiles WHERE user_id = $1`, f.userID); n == 0 {
+		t.Fatal("reset deleted the profile's taste row; the embedding job could not mark it stale")
+	}
+	if n := countRows(t, repo.pool, `SELECT COUNT(*) FROM recommendation_cache WHERE user_id IS NOT NULL`); n != 0 {
+		t.Fatalf("%d per-profile cache rows after reset", n)
+	}
+	if n := countRows(t, repo.pool, `SELECT COUNT(*) FROM recommendation_cache WHERE user_id IS NULL AND rec_type = $1`, f.globalType); n != 1 {
+		t.Fatalf("global cache row count after reset = %d, want 1", n)
+	}
+	if n := countRows(t, repo.pool, `
+		SELECT COUNT(DISTINCT content_id) FROM catalog_search_index_events
+		WHERE id > $1 AND action = 'upsert' AND content_id = ANY($2)`, lastEvent, f.itemIDs); n != len(f.itemIDs) {
+		t.Fatalf("search upserts queued for %d of %d reset items", n, len(f.itemIDs))
+	}
+}
+
+// A failure inside the reset leaves everything as it was.
+func TestResetEmbeddingsRollsBackPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	snapshotEmbeddingLock(t, pool)
+	ctx := t.Context()
+	repo := NewRepo(pool)
+	f := seedResetFixture(t, ctx, repo)
+
+	// The last delete fails, after the lock, embeddings and taste rows are
+	// already deleted inside the transaction.
+	fn := "test_fail_reset_" + strings.ReplaceAll(uuid.NewString(), "-", "")
+	if _, err := pool.Exec(ctx, `CREATE FUNCTION `+fn+`() RETURNS trigger LANGUAGE plpgsql AS $$ BEGIN RAISE EXCEPTION 'reset blocked by test'; END $$`); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := pool.Exec(ctx, `CREATE TRIGGER `+fn+` BEFORE DELETE ON recommendation_cache FOR EACH STATEMENT EXECUTE FUNCTION `+fn+`()`); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DROP TRIGGER IF EXISTS `+fn+` ON recommendation_cache`)
+		_, _ = pool.Exec(context.Background(), `DROP FUNCTION IF EXISTS `+fn+`()`)
+	})
+
+	if _, err := repo.ResetEmbeddings(ctx); err == nil || !strings.Contains(err.Error(), "reset blocked by test") {
+		t.Fatalf("reset = %v, want the injected failure", err)
+	}
+	if lock, err := repo.GetEmbeddingLock(ctx); err != nil || lock == nil || lock.Model != "model-a" {
+		t.Fatalf("lock after a failed reset = %+v, %v", lock, err)
+	}
+	if n := countRows(t, repo.pool, `SELECT COUNT(*) FROM media_item_embeddings WHERE media_item_id = ANY($1)`, f.itemIDs); n != len(f.itemIDs) {
+		t.Fatalf("%d of %d embeddings left after a failed reset", n, len(f.itemIDs))
+	}
+	for _, table := range []string{"user_taste_profiles", "user_taste_clusters", "recommendation_cache"} {
+		if n := countRows(t, repo.pool, `SELECT COUNT(*) FROM `+table+` WHERE user_id = $1`, f.userID); n == 0 {
+			t.Fatalf("%s lost the profile's rows in a failed reset", table)
+		}
+	}
+}
+
+// A reset refuses while a catalog import carrying embeddings holds the
+// embedding writers lock: the import read the embedding lock before the reset
+// and would insert vectors after it. Nothing is deleted.
+func TestResetEmbeddingsRefusesDuringACatalogImportPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	snapshotEmbeddingLock(t, pool)
+	ctx := t.Context()
+	repo := NewRepo(pool)
+	f := seedResetFixture(t, ctx, repo)
+
+	importTx, err := pool.Begin(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = importTx.Rollback(context.Background()) }()
+	if _, err := importTx.Exec(ctx, `SELECT pg_advisory_xact_lock_shared($1)`, EmbeddingWritersLock); err != nil {
+		t.Fatal(err)
+	}
+
+	if _, err := repo.ResetEmbeddings(ctx); !errors.Is(err, ErrCatalogImportRunning) {
+		t.Fatalf("reset during an import = %v, want ErrCatalogImportRunning", err)
+	}
+	if lock, err := repo.GetEmbeddingLock(ctx); err != nil || lock == nil || lock.Model != "model-a" {
+		t.Fatalf("lock after a refused reset = %+v, %v", lock, err)
+	}
+	if n := countRows(t, repo.pool, `SELECT COUNT(*) FROM media_item_embeddings WHERE media_item_id = ANY($1)`, f.itemIDs); n != len(f.itemIDs) {
+		t.Fatalf("%d of %d embeddings left after a refused reset", n, len(f.itemIDs))
+	}
+
+	// Once the import commits, the reset goes ahead.
+	if err := importTx.Commit(ctx); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := repo.ResetEmbeddings(ctx); err != nil {
+		t.Fatalf("reset after the import = %v", err)
+	}
+}
+
+func TestCacheRefreshedAtPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	repo := NewRepo(pool)
+	recType := "test_global_" + uuid.NewString()
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM recommendation_cache WHERE user_id IS NULL AND rec_type = $1`, recType)
+	})
+	if err := repo.UpsertRecommendationCache(ctx, GlobalCacheUserID, GlobalCacheProfileID, recType, "", []ScoredItem{{MediaItemID: "x", Score: 1}}, cacheExpiry(time.Now())); err != nil {
+		t.Fatal(err)
+	}
+	var written time.Time
+	if err := pool.QueryRow(ctx, `SELECT created_at FROM recommendation_cache WHERE user_id IS NULL AND rec_type = $1`, recType).Scan(&written); err != nil {
+		t.Fatal(err)
+	}
+	at, err := repo.CacheRefreshedAt(ctx)
+	if err != nil || at == nil || at.Before(written) {
+		t.Fatalf("cache refreshed at = %v, %v; want at least %v", at, err, written)
+	}
+}
diff --git a/internal/recommendations/embeddings/client.go b/internal/recommendations/embeddings/client.go
index 6564121088..3ce8f9e351 100644
--- a/internal/recommendations/embeddings/client.go
+++ b/internal/recommendations/embeddings/client.go
@@ -4,13 +4,17 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"log/slog"
+	"net"
 	"net/http"
 	"strconv"
 	"strings"
 	"time"
+
+	"github.com/prairie-server/prairie-server/internal/logredact"
 )
 
 // ClientConfig holds embedding client configuration.
@@ -29,8 +33,13 @@ type Client struct {
 // NewClient creates a new embedding client.
 func NewClient(cfg ClientConfig) *Client {
 	return &Client{
-		cfg:        cfg,
-		httpClient: &http.Client{Timeout: 10 * time.Minute},
+		cfg: cfg,
+		// A redirect is answered as the response, not followed: Go forwards
+		// headers it does not know to be credentials, such as Gemini's
+		// x-goog-api-key, to the redirect's host.
+		httpClient: &http.Client{Timeout: 10 * time.Minute, CheckRedirect: func(*http.Request, []*http.Request) error {
+			return http.ErrUseLastResponse
+		}},
 	}
 }
 
@@ -49,7 +58,9 @@ type embeddingRequest struct {
 type embeddingResponse struct {
 	Data []struct {
 		Embedding []float32 `json:"embedding"`
-		Index     int       `json:"index"`
+		// Index is nil when the server omits it; the entry's position is
+		// used instead.
+		Index *int `json:"index"`
 	} `json:"data"`
 }
 
@@ -78,28 +89,104 @@ type geminiEmbedResponse struct {
 	} `json:"embeddings"`
 }
 
-const maxGeminiRetryDelay = 60 * time.Second
+// maxRetryDelay caps how long one retry waits after a 429. A provider that
+// asks for longer ends the run instead.
+const maxRetryDelay = 60 * time.Second
 
-// RateLimitError reports a Gemini limit that should stop the current backfill
-// rather than fan out into requests for individual items.
+// RateLimitError reports a provider limit that should stop the current
+// backfill rather than fan out into requests for individual items.
 type RateLimitError struct {
-	DailyQuota    bool
+	// DailyQuota marks a spent daily quota (Gemini).
+	DailyQuota bool
+	// QuotaExhausted marks an account with no quota left (OpenAI's
+	// insufficient_quota).
+	QuotaExhausted bool
+	// RetryDeferred marks a provider that asked to wait longer than
+	// maxRetryDelay before the next request.
 	RetryDeferred bool
 }
 
 func (e *RateLimitError) Error() string {
 	if e.DailyQuota {
-		return "gemini embedding API daily quota exhausted; retry after the quota resets or review limits in Google AI Studio"
+		return "embedding API daily quota exhausted; retry after the quota resets or review the provider's limits"
+	}
+	if e.QuotaExhausted {
+		return "embedding API quota exhausted (insufficient_quota); review the provider account's plan and limits"
 	}
 	if e.RetryDeferred {
-		return "gemini embedding API rate limited; requested retry delay is too long for this run; try again later"
+		return "embedding API rate limited; requested retry delay is too long for this run; try again later"
 	}
-	return "gemini embedding API rate limit persisted after retries; try again later"
+	return "embedding API rate limit persisted after retries; try again later"
+}
+
+// StatusError is an HTTP error response from the embedding API.
+type StatusError struct {
+	// API names the endpoint family in the message: "embedding" or
+	// "gemini embedding".
+	API        string
+	StatusCode int
+	Body       string
+}
+
+// Error quotes the provider's response body with credential assignments
+// masked: it reaches logs, job results and search diagnostics.
+func (e *StatusError) Error() string {
+	return fmt.Sprintf("%s API returned %d: %s", e.API, e.StatusCode, logredact.SanitizeText(e.Body))
+}
+
+// Unavailable reports whether err shows that the provider cannot serve any
+// request until its configuration changes or its host comes back: it
+// rejected the credentials or does not know the endpoint or model (401, 403,
+// 404), or its host could not be resolved or dialed. Retrying the request or
+// sending smaller ones will not help.
+func Unavailable(err error) bool {
+	var statusErr *StatusError
+	if errors.As(err, &statusErr) {
+		switch statusErr.StatusCode {
+		case http.StatusUnauthorized, http.StatusForbidden, http.StatusNotFound:
+			return true
+		}
+		return false
+	}
+	return isConnectError(err)
+}
+
+// InputRefused reports whether the provider refused this input rather than
+// failing for every request: a rejected request (InputRejected), or the 5xx a
+// local model such as Ollama answers an input longer than its context with.
+// The input may succeed shortened; other inputs are not affected.
+func InputRefused(err error) bool {
+	return InputRejected(err) || (err != nil && strings.Contains(strings.ToLower(err.Error()), "context length"))
+}
+
+// InputRejected reports whether the provider refused the request's input,
+// for example as too long or malformed: a 4xx response other than the
+// Unavailable ones, 408 and 429.
+func InputRejected(err error) bool {
+	var statusErr *StatusError
+	if !errors.As(err, &statusErr) || Unavailable(err) {
+		return false
+	}
+	code := statusErr.StatusCode
+	return code >= 400 && code < 500 && code != http.StatusRequestTimeout && code != http.StatusTooManyRequests
+}
+
+// isConnectError reports a failure to resolve or dial the provider's host.
+func isConnectError(err error) bool {
+	var dnsErr *net.DNSError
+	if errors.As(err, &dnsErr) {
+		return true
+	}
+	var opErr *net.OpError
+	return errors.As(err, &opErr) && opErr.Op == "dial"
 }
 
 // Embed generates embeddings for the given texts.
-// Returns one []float32 per input text, in the same order.
-// Retries on transient errors (5xx) and temporary rate limits with backoff.
+// Returns one non-empty []float32 per input text, in the same order, or an
+// error when the response does not hold exactly that.
+// Retries transport errors, 5xx responses and short rate limits with backoff;
+// an unreachable host, a rejected request and a long or persistent rate limit
+// fail without retrying.
 func (c *Client) Embed(ctx context.Context, texts []string) ([][]float32, error) {
 	if c.isGemini() {
 		return c.embedGemini(ctx, texts)
@@ -134,8 +221,12 @@ func (c *Client) embedOpenAI(ctx context.Context, texts []string) ([][]float32,
 
 		resp, err = c.httpClient.Do(httpReq)
 		if err != nil {
-			if attempt < maxAttempts-1 {
-				time.Sleep(time.Duration(attempt+1) * time.Second)
+			// A host that cannot be resolved or dialed will not answer a
+			// retry a few seconds later either.
+			if attempt < maxAttempts-1 && !isConnectError(err) {
+				if err := waitForRetry(ctx, time.Duration(attempt+1)*time.Second); err != nil {
+					return nil, err
+				}
 				continue
 			}
 			return nil, fmt.Errorf("embedding request failed: %w", err)
@@ -149,29 +240,39 @@ func (c *Client) embedOpenAI(ctx context.Context, texts []string) ([][]float32,
 		respBody, _ := io.ReadAll(resp.Body)
 		resp.Body.Close()
 
-		// Rate limited — wait using Retry-After header or exponential backoff.
 		if resp.StatusCode == http.StatusTooManyRequests {
+			if isInsufficientQuota(respBody) {
+				// No wait restores a spent account quota.
+				return nil, &RateLimitError{QuotaExhausted: true}
+			}
 			if attempt >= maxAttempts-1 {
-				return nil, fmt.Errorf("embedding API returned %d: %s", resp.StatusCode, string(respBody))
+				return nil, &RateLimitError{}
 			}
 			wait := rateLimitBackoff(resp, attempt)
+			if wait > maxRetryDelay {
+				if err := ctx.Err(); err != nil {
+					return nil, err
+				}
+				// End this run rather than retry before the provider's minimum delay.
+				return nil, &RateLimitError{RetryDeferred: true}
+			}
 			slog.WarnContext(ctx, "rate limited by embedding API, waiting", "component", "recommendations", "attempt", attempt+1, "wait", wait)
-			select {
-			case <-ctx.Done():
-				return nil, ctx.Err()
-			case <-time.After(wait):
+			if err := waitForRetry(ctx, wait); err != nil {
+				return nil, err
 			}
 			continue
 		}
 
 		// Server error — retry with backoff.
 		if resp.StatusCode >= 500 && attempt < maxAttempts-1 {
-			time.Sleep(time.Duration(attempt+1) * time.Second)
+			if err := waitForRetry(ctx, time.Duration(attempt+1)*time.Second); err != nil {
+				return nil, err
+			}
 			continue
 		}
 
 		// Non-retryable error (4xx except 429).
-		return nil, fmt.Errorf("embedding API returned %d: %s", resp.StatusCode, string(respBody))
+		return nil, &StatusError{API: "embedding", StatusCode: resp.StatusCode, Body: string(respBody)}
 	}
 	defer resp.Body.Close()
 
@@ -180,11 +281,24 @@ func (c *Client) embedOpenAI(ctx context.Context, texts []string) ([][]float32,
 		return nil, fmt.Errorf("decode embedding response: %w", err)
 	}
 
+	if len(embResp.Data) != len(texts) {
+		return nil, fmt.Errorf("embedding API returned %d vectors for %d inputs", len(embResp.Data), len(texts))
+	}
 	results := make([][]float32, len(texts))
-	for _, d := range embResp.Data {
-		if d.Index < len(results) {
-			results[d.Index] = d.Embedding
+	filled := make([]bool, len(texts))
+	for i, d := range embResp.Data {
+		index := i
+		if d.Index != nil {
+			index = *d.Index
+		}
+		if index < 0 || index >= len(results) || filled[index] {
+			return nil, fmt.Errorf("embedding API returned an invalid or repeated index %d for %d inputs", index, len(texts))
 		}
+		results[index] = d.Embedding
+		filled[index] = true
+	}
+	if err := checkVectors(results); err != nil {
+		return nil, err
 	}
 	return results, nil
 }
@@ -206,7 +320,9 @@ func (c *Client) embedGemini(ctx context.Context, texts []string) ([][]float32,
 		return nil, fmt.Errorf("marshal gemini embedding request: %w", err)
 	}
 
-	url := fmt.Sprintf("%s/v1beta/%s:batchEmbedContents?key=%s", c.cfg.BaseURL, modelRef, c.cfg.APIKey)
+	// The key travels in a header: a URL query parameter would surface in
+	// transport errors, which quote the request URL.
+	url := fmt.Sprintf("%s/v1beta/%s:batchEmbedContents", c.cfg.BaseURL, modelRef)
 
 	maxAttempts := 6
 	var resp *http.Response
@@ -216,10 +332,11 @@ func (c *Client) embedGemini(ctx context.Context, texts []string) ([][]float32,
 			return nil, fmt.Errorf("create request: %w", reqErr)
 		}
 		httpReq.Header.Set("Content-Type", "application/json")
+		httpReq.Header.Set("x-goog-api-key", c.cfg.APIKey)
 
 		resp, err = c.httpClient.Do(httpReq)
 		if err != nil {
-			if attempt < maxAttempts-1 {
+			if attempt < maxAttempts-1 && !isConnectError(err) {
 				if err := waitForRetry(ctx, time.Duration(attempt+1)*time.Second); err != nil {
 					return nil, err
 				}
@@ -244,7 +361,7 @@ func (c *Client) embedGemini(ctx context.Context, texts []string) ([][]float32,
 			if wait <= 0 {
 				wait = rateLimitBackoff(resp, attempt)
 			}
-			if wait > maxGeminiRetryDelay {
+			if wait > maxRetryDelay {
 				if err := ctx.Err(); err != nil {
 					return nil, err
 				}
@@ -266,7 +383,7 @@ func (c *Client) embedGemini(ctx context.Context, texts []string) ([][]float32,
 			continue
 		}
 
-		return nil, fmt.Errorf("gemini embedding API returned %d: %s", resp.StatusCode, string(respBody))
+		return nil, &StatusError{API: "gemini embedding", StatusCode: resp.StatusCode, Body: string(respBody)}
 	}
 	defer resp.Body.Close()
 
@@ -275,15 +392,45 @@ func (c *Client) embedGemini(ctx context.Context, texts []string) ([][]float32,
 		return nil, fmt.Errorf("decode gemini embedding response: %w", err)
 	}
 
+	if len(gresp.Embeddings) != len(texts) {
+		return nil, fmt.Errorf("gemini embedding API returned %d vectors for %d inputs", len(gresp.Embeddings), len(texts))
+	}
 	results := make([][]float32, len(texts))
 	for i, emb := range gresp.Embeddings {
-		if i < len(results) {
-			results[i] = emb.Values
-		}
+		results[i] = emb.Values
+	}
+	if err := checkVectors(results); err != nil {
+		return nil, err
 	}
 	return results, nil
 }
 
+// checkVectors rejects a response with an empty vector, which would
+// otherwise be stored as all zeros.
+func checkVectors(vectors [][]float32) error {
+	for i, vector := range vectors {
+		if len(vector) == 0 {
+			return fmt.Errorf("embedding API returned an empty vector for input %d", i)
+		}
+	}
+	return nil
+}
+
+// isInsufficientQuota reports an OpenAI-style 429 body whose error code or
+// type is insufficient_quota.
+func isInsufficientQuota(body []byte) bool {
+	var payload struct {
+		Error struct {
+			Code string `json:"code"`
+			Type string `json:"type"`
+		} `json:"error"`
+	}
+	if json.Unmarshal(body, &payload) != nil {
+		return false
+	}
+	return payload.Error.Code == "insufficient_quota" || payload.Error.Type == "insufficient_quota"
+}
+
 // rateLimitBackoff returns how long to wait after a 429 response.
 // Uses the Retry-After header if present, otherwise exponential backoff.
 func rateLimitBackoff(resp *http.Response, attempt int) time.Duration {
diff --git a/internal/recommendations/embeddings/client_test.go b/internal/recommendations/embeddings/client_test.go
index 1e2ca4782a..49aa72ba17 100644
--- a/internal/recommendations/embeddings/client_test.go
+++ b/internal/recommendations/embeddings/client_test.go
@@ -4,9 +4,12 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"io"
+	"net"
 	"net/http"
 	"strings"
+	"syscall"
 	"testing"
 	"testing/synctest"
 	"time"
@@ -231,3 +234,320 @@ func TestGeminiRetryRespectsContext(t *testing.T) {
 		}
 	})
 }
+
+func TestGeminiSendsAPIKeyOutsideTheURL(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		var requests []*http.Request
+		c := geminiTestClient(func(r *http.Request) (*http.Response, error) {
+			requests = append(requests, r)
+			return nil, errors.New("connection refused")
+		})
+		_, err := c.Embed(context.Background(), []string{"synthetic item"})
+		if err == nil {
+			t.Fatal("Embed succeeded through a failing transport")
+		}
+		// Transport errors quote the request URL, so the key must not be in it.
+		if strings.Contains(err.Error(), "test-key") {
+			t.Fatalf("error exposes the API key: %v", err)
+		}
+		if len(requests) == 0 {
+			t.Fatal("no request reached the transport")
+		}
+		for _, r := range requests {
+			if r.URL.Query().Has("key") {
+				t.Fatalf("request URL carries the key: %s", r.URL)
+			}
+			if got := r.Header.Get("x-goog-api-key"); got != "test-key" {
+				t.Fatalf("x-goog-api-key = %q, want the configured key", got)
+			}
+		}
+	})
+}
+
+func TestGeminiDoesNotFollowRedirectsWithTheAPIKey(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		var elsewhere []*http.Request
+		c := geminiTestClient(func(r *http.Request) (*http.Response, error) {
+			if r.URL.Host != "generativelanguage.googleapis.com" {
+				elsewhere = append(elsewhere, r)
+				return embeddingHTTPResponse(http.StatusOK, `{"embeddings":[{"values":[0.5]}]}`, ""), nil
+			}
+			resp := embeddingHTTPResponse(http.StatusTemporaryRedirect, "", "")
+			resp.Header.Set("Location", "https://collector.example/v1beta/embed")
+			return resp, nil
+		})
+		if _, err := c.Embed(context.Background(), []string{"synthetic item"}); err == nil {
+			t.Fatal("Embed succeeded through a redirect")
+		}
+		// Go forwards headers it does not treat as credentials to the
+		// redirect's host, and x-goog-api-key is one of them.
+		if len(elsewhere) != 0 {
+			t.Fatalf("followed the redirect to %s with x-goog-api-key %q", elsewhere[0].URL, elsewhere[0].Header.Get("x-goog-api-key"))
+		}
+	})
+}
+
+func openAITestClient(transport embeddingTransport) *Client {
+	c := NewClient(ClientConfig{BaseURL: "http://embed.test", Model: "test-model"})
+	c.httpClient.Transport = transport
+	return c
+}
+
+func TestEmbedRejectsMalformedResponses(t *testing.T) {
+	for _, tc := range []struct {
+		name, base, body string
+		inputs           int
+	}{
+		{"openai no data", "http://embed.test", `{"data":[]}`, 1},
+		{"openai null vector", "http://embed.test", `{"data":[{"embedding":null,"index":0}]}`, 1},
+		{"openai empty vector", "http://embed.test", `{"data":[{"embedding":[],"index":0}]}`, 1},
+		{"openai fewer vectors", "http://embed.test", `{"data":[{"embedding":[1,2],"index":0}]}`, 2},
+		{"openai repeated index", "http://embed.test", `{"data":[{"embedding":[1],"index":0},{"embedding":[2],"index":0}]}`, 2},
+		{"openai index out of range", "http://embed.test", `{"data":[{"embedding":[1],"index":3}]}`, 1},
+		{"gemini no embeddings", "https://generativelanguage.googleapis.com", `{"embeddings":[]}`, 1},
+		{"gemini empty values", "https://generativelanguage.googleapis.com", `{"embeddings":[{"values":[]}]}`, 1},
+		{"gemini fewer vectors", "https://generativelanguage.googleapis.com", `{"embeddings":[{"values":[1]}]}`, 2},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			c := NewClient(ClientConfig{BaseURL: tc.base, Model: "test-model", APIKey: "test-key"})
+			c.httpClient.Transport = embeddingTransport(func(*http.Request) (*http.Response, error) {
+				return embeddingHTTPResponse(200, tc.body, ""), nil
+			})
+			vectors, err := c.Embed(context.Background(), make([]string, tc.inputs))
+			if err == nil || vectors != nil {
+				t.Fatalf("malformed response accepted: vectors=%v error=%v", vectors, err)
+			}
+		})
+	}
+}
+
+func TestEmbedOrdersOpenAIVectorsByIndex(t *testing.T) {
+	for name, body := range map[string]string{
+		"by index":      `{"data":[{"embedding":[2],"index":1},{"embedding":[1],"index":0}]}`,
+		"index omitted": `{"data":[{"embedding":[1]},{"embedding":[2]}]}`,
+	} {
+		t.Run(name, func(t *testing.T) {
+			c := openAITestClient(func(*http.Request) (*http.Response, error) {
+				return embeddingHTTPResponse(200, body, ""), nil
+			})
+			vectors, err := c.Embed(context.Background(), []string{"a", "b"})
+			if err != nil || len(vectors) != 2 || vectors[0][0] != 1 || vectors[1][0] != 2 {
+				t.Fatalf("vectors=%v error=%v", vectors, err)
+			}
+		})
+	}
+}
+
+func TestEmbedFailsFastWhenTheProviderIsUnavailable(t *testing.T) {
+	dial := &net.OpError{Op: "dial", Net: "tcp", Err: syscall.ECONNREFUSED}
+	dns := &net.DNSError{Err: "no such host", Name: "ollama", IsNotFound: true}
+	for _, base := range []string{"http://embed.test", "https://generativelanguage.googleapis.com"} {
+		for _, tc := range []struct {
+			name   string
+			status int
+			err    error
+		}{
+			{name: "unauthorized", status: 401},
+			{name: "forbidden", status: 403},
+			{name: "unknown model", status: 404},
+			{name: "connection refused", err: dial},
+			{name: "unknown host", err: dns},
+		} {
+			t.Run(base+" "+tc.name, func(t *testing.T) {
+				synctest.Test(t, func(t *testing.T) {
+					c := NewClient(ClientConfig{BaseURL: base, Model: "test-model", APIKey: "test-key"})
+					calls := 0
+					c.httpClient.Transport = embeddingTransport(func(*http.Request) (*http.Response, error) {
+						calls++
+						if tc.err != nil {
+							return nil, tc.err
+						}
+						return embeddingHTTPResponse(tc.status, `{"error":"synthetic"}`, ""), nil
+					})
+					start := time.Now()
+					_, err := c.Embed(context.Background(), []string{"synthetic item"})
+					if calls != 1 || time.Since(start) != 0 {
+						t.Fatalf("requests=%d elapsed=%s, want one request and no wait", calls, time.Since(start))
+					}
+					if !Unavailable(err) || InputRejected(err) {
+						t.Fatalf("error = %v, want an unavailable provider", err)
+					}
+				})
+			})
+		}
+	}
+}
+
+func TestEmbedClassifiesAClosedPortAsUnavailable(t *testing.T) {
+	listener, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	addr := listener.Addr().String()
+	if err := listener.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	c := NewClient(ClientConfig{BaseURL: "http://" + addr, Model: "test-model"})
+	_, err = c.Embed(context.Background(), []string{"synthetic item"})
+	if !Unavailable(err) {
+		t.Fatalf("error = %v, want an unavailable provider", err)
+	}
+}
+
+func TestInputRejected(t *testing.T) {
+	for status, want := range map[int]bool{400: true, 413: true, 422: true, 401: false, 404: false, 408: false, 429: false, 500: false} {
+		err := fmt.Errorf("wrapped: %w", &StatusError{API: "embedding", StatusCode: status})
+		if got := InputRejected(err); got != want {
+			t.Errorf("InputRejected(%d) = %v, want %v", status, got, want)
+		}
+	}
+	if InputRejected(errors.New("embedding API returned 400: plain text")) {
+		t.Error("an untyped error counts as a rejected input")
+	}
+}
+
+// A refused input is a rejected request or a local model's context-length
+// 5xx; other server errors are not.
+func TestInputRefused(t *testing.T) {
+	for name, tc := range map[string]struct {
+		err  error
+		want bool
+	}{
+		"rejected request": {&StatusError{API: "test provider", StatusCode: 400}, true},
+		"context length":   {fmt.Errorf("wrapped: %w", &StatusError{API: "test provider", StatusCode: 500, Body: "input length exceeds the Context Length"}), true},
+		"server error":     {&StatusError{API: "test provider", StatusCode: 503, Body: "overloaded"}, false},
+		"unauthorized":     {&StatusError{API: "test provider", StatusCode: 401}, false},
+		"nil":              {nil, false},
+	} {
+		if got := InputRefused(tc.err); got != tc.want {
+			t.Errorf("%s: InputRefused = %v, want %v", name, got, tc.want)
+		}
+	}
+}
+
+func TestOpenAIServerErrorsRetryWithBackoff(t *testing.T) {
+	synctest.Test(t, func(t *testing.T) {
+		calls := 0
+		c := openAITestClient(func(*http.Request) (*http.Response, error) {
+			calls++
+			return embeddingHTTPResponse(503, "overloaded", ""), nil
+		})
+		start := time.Now()
+		_, err := c.Embed(context.Background(), []string{"synthetic item"})
+		var statusErr *StatusError
+		if calls != 6 || time.Since(start) != 15*time.Second || !errors.As(err, &statusErr) || statusErr.StatusCode != 503 {
+			t.Fatalf("server errors: calls=%d elapsed=%s error=%v", calls, time.Since(start), err)
+		}
+		if err.Error() != "embedding API returned 503: overloaded" {
+			t.Fatalf("error text = %q", err)
+		}
+	})
+}
+
+func TestOpenAIRateLimitPolicy(t *testing.T) {
+	quotaBody := `{"error":{"message":"You exceeded your current quota","type":"insufficient_quota","code":"insufficient_quota"}}`
+	for _, tc := range []struct {
+		name       string
+		body       string
+		retryAfter string
+		calls      int
+		wait       time.Duration
+		check      func(*RateLimitError) bool
+		message    string
+	}{
+		{
+			name: "insufficient quota stops at once", body: quotaBody, calls: 1,
+			check:   func(e *RateLimitError) bool { return e.QuotaExhausted },
+			message: "quota exhausted",
+		},
+		{
+			name: "retry after above the cap", body: `{}`, retryAfter: "3600", calls: 1,
+			check:   func(e *RateLimitError) bool { return e.RetryDeferred },
+			message: "retry delay is too long",
+		},
+		{
+			name: "persistent rate limit", body: `{}`, calls: 6, wait: 190 * time.Second,
+			check:   func(e *RateLimitError) bool { return !e.RetryDeferred && !e.QuotaExhausted && !e.DailyQuota },
+			message: "rate limit persisted",
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			synctest.Test(t, func(t *testing.T) {
+				calls := 0
+				c := openAITestClient(func(*http.Request) (*http.Response, error) {
+					calls++
+					return embeddingHTTPResponse(429, tc.body, tc.retryAfter), nil
+				})
+				start := time.Now()
+				_, err := c.Embed(context.Background(), []string{"synthetic item"})
+				if calls != tc.calls || time.Since(start) != tc.wait {
+					t.Fatalf("requests=%d elapsed=%s, want %d and %s", calls, time.Since(start), tc.calls, tc.wait)
+				}
+				var limitErr *RateLimitError
+				if !errors.As(err, &limitErr) || !tc.check(limitErr) || !strings.Contains(err.Error(), tc.message) {
+					t.Fatalf("error = %#v (%v)", limitErr, err)
+				}
+				if strings.Contains(err.Error(), "gemini") {
+					t.Fatalf("error names another provider: %v", err)
+				}
+			})
+		})
+	}
+
+	synctest.Test(t, func(t *testing.T) {
+		calls := 0
+		c := openAITestClient(func(*http.Request) (*http.Response, error) {
+			calls++
+			if calls == 1 {
+				return embeddingHTTPResponse(429, `{}`, "3"), nil
+			}
+			return embeddingHTTPResponse(200, `{"data":[{"embedding":[1,2,3],"index":0}]}`, ""), nil
+		})
+		start := time.Now()
+		vectors, err := c.Embed(context.Background(), []string{"synthetic item"})
+		if err != nil || calls != 2 || len(vectors) != 1 || time.Since(start) != 3*time.Second {
+			t.Fatalf("temporary limit: calls=%d elapsed=%s vectors=%v error=%v", calls, time.Since(start), vectors, err)
+		}
+	})
+}
+
+func TestOpenAIRetryRespectsContext(t *testing.T) {
+	for _, status := range []int{0, 429, 503} {
+		t.Run(http.StatusText(status), func(t *testing.T) {
+			synctest.Test(t, func(t *testing.T) {
+				ctx, cancel := context.WithCancel(context.Background())
+				defer cancel()
+				calls := 0
+				c := openAITestClient(func(*http.Request) (*http.Response, error) {
+					calls++
+					cancel()
+					if status == 0 {
+						return nil, errors.New("synthetic transport failure")
+					}
+					return embeddingHTTPResponse(status, `{}`, "30"), nil
+				})
+				start := time.Now()
+				_, err := c.Embed(ctx, []string{"synthetic item"})
+				if !errors.Is(err, context.Canceled) || calls != 1 || time.Since(start) != 0 {
+					t.Fatalf("context cancellation: calls=%d elapsed=%s error=%v", calls, time.Since(start), err)
+				}
+			})
+		})
+	}
+}
+
+// A provider's error body reaches logs, job results and search diagnostics,
+// so a credential it echoes is masked; the rest of the body stays.
+func TestStatusErrorMasksCredentialsInTheBody(t *testing.T) {
+	for _, body := range []string{
+		`{"error":{"message":"bad request","details":"api_key=sk-live-123"}}`,
+		// A secret assignment nested inside another diagnostic value.
+		`{"error":{"message":"bad request","details":"rpc error: code = Unauthenticated desc = api_key=sk-live-123 rejected"}}`,
+	} {
+		got := (&StatusError{API: "test provider", StatusCode: 400, Body: body}).Error()
+		if strings.Contains(got, "sk-live-123") || !strings.Contains(got, "bad request") || !strings.Contains(got, "400") {
+			t.Fatalf("Error() = %q, want the key masked and the rest kept", got)
+		}
+	}
+}
diff --git a/internal/recommendations/embeddings/text.go b/internal/recommendations/embeddings/text.go
index c7606a33b1..721ad06526 100644
--- a/internal/recommendations/embeddings/text.go
+++ b/internal/recommendations/embeddings/text.go
@@ -13,7 +13,8 @@ const (
 	maxKeywords      = 5
 )
 
-func truncateRunes(s string, limit int) string {
+// TruncateRunes returns s cut to at most limit runes.
+func TruncateRunes(s string, limit int) string {
 	if limit <= 0 {
 		return ""
 	}
@@ -39,12 +40,12 @@ func BuildEmbeddingText(item *models.MediaItem) string {
 	typeName := mediaTypeLabel(item.Type)
 
 	if len(item.Genres) > 0 && item.Overview != "" {
-		overview := truncateRunes(item.Overview, maxOverviewRunes)
+		overview := TruncateRunes(item.Overview, maxOverviewRunes)
 		parts = append(parts, fmt.Sprintf("%s %s about %s", strings.Join(item.Genres, ", "), typeName, overview))
 	} else if len(item.Genres) > 0 {
 		parts = append(parts, fmt.Sprintf("%s %s", strings.Join(item.Genres, ", "), typeName))
 	} else if item.Overview != "" {
-		overview := truncateRunes(item.Overview, maxOverviewRunes)
+		overview := TruncateRunes(item.Overview, maxOverviewRunes)
 		parts = append(parts, fmt.Sprintf("%s. %s", typeName, overview))
 	}
 
diff --git a/internal/recommendations/engine.go b/internal/recommendations/engine.go
index db243293af..76c9fc3418 100644
--- a/internal/recommendations/engine.go
+++ b/internal/recommendations/engine.go
@@ -2,6 +2,8 @@ package recommendations
 
 import (
 	"context"
+	"fmt"
+	"time"
 
 	"github.com/jackc/pgx/v5/pgxpool"
 
@@ -20,6 +22,14 @@ type embedder interface {
 	Embed(ctx context.Context, texts []string) ([][]float32, error)
 }
 
+// ScopeResolver resolves a viewer's effective access scope: the account's
+// and its access group's libraries, the profile's restrictions and hidden
+// libraries, and its maturity limits. *access.Resolver and
+// *policy.ViewerResolver implement it.
+type ScopeResolver interface {
+	Resolve(ctx context.Context, input access.ResolveInput) (access.Scope, error)
+}
+
 // Engine implements the Recommender interface.
 type Engine struct {
 	repo          *Repo
@@ -32,6 +42,21 @@ type Engine struct {
 	cfg           config.RecommendationsConfig
 	pool          *pgxpool.Pool
 	unrated       access.UnratedContentPolicy
+	scopes        ScopeResolver
+	// refusedEmbeds are the inputs the embedding provider refused; see
+	// refusedEmbedInputs.
+	refusedEmbeds *refusedEmbedInputs
+}
+
+// WithScopeResolver installs the resolver the API resolves request scopes
+// with, and returns the engine. Cached rows are then built under the scope a
+// read filters them by. Without it the build falls back to the profile's own
+// restrictions, missing access groups and hidden libraries.
+func (e *Engine) WithScopeResolver(resolver ScopeResolver) *Engine {
+	if e != nil {
+		e.scopes = resolver
+	}
+	return e
 }
 
 // WithUnratedContentPolicy installs the reader for access.unrated_content and
@@ -45,6 +70,17 @@ func (e *Engine) WithUnratedContentPolicy(policy access.UnratedContentPolicy) *E
 	return e
 }
 
+// WithUserStoreOutsidePostgres records whether the user store keeps watch
+// progress, favorites and watchlist outside Postgres (the SQLite backend), and
+// returns the engine. The nightly taste job then finds those profiles through
+// the store, and signal checks read the store instead of the Postgres tables.
+func (e *Engine) WithUserStoreOutsidePostgres(outside bool) *Engine {
+	if e != nil && e.signals != nil {
+		e.signals.storeOutsidePostgres = outside
+	}
+	return e
+}
+
 // NewEngine creates a new recommendation Engine.
 func NewEngine(
 	pool *pgxpool.Pool,
@@ -72,6 +108,7 @@ func NewEngine(
 		embClient:     embeddings.NewClient(embCfg),
 		cfg:           cfg,
 		pool:          pool,
+		refusedEmbeds: newRefusedEmbedInputs(),
 	}
 }
 
@@ -88,8 +125,14 @@ func (e *Engine) ActiveEmbeddingModel(ctx context.Context) (string, error) {
 	return lock.Model, nil
 }
 
-func (e *Engine) watchedItemIDSet(ctx context.Context, userID int, profileID string) (map[string]struct{}, error) {
-	return e.signalReader().WatchedItemIDSet(ctx, userID, profileID)
+// recommendationExclusionSet is SignalReader.BuildExclusionSet: the titles
+// the rows the engine builds leave out.
+func (e *Engine) recommendationExclusionSet(ctx context.Context, userID int, profileID string) (map[string]struct{}, error) {
+	var ratings ratedItemLister
+	if e.ratingsRepo != nil {
+		ratings = e.ratingsRepo
+	}
+	return e.signalReader().BuildExclusionSet(ctx, ratings, userID, profileID, time.Now())
 }
 
 func (e *Engine) signalReader() *SignalReader {
@@ -99,29 +142,63 @@ func (e *Engine) signalReader() *SignalReader {
 	return NewSignalReader(e.repo, e.storeProvider)
 }
 
-func (e *Engine) mmrLambda(defaultLambda float64) float64 {
+// defaultMMRLambda is the relevance/diversity trade-off used when the
+// configured DiversityLambda is outside [0, 1].
+const defaultMMRLambda = 0.7
+
+// mmrLambda returns the configured MMR lambda, or defaultMMRLambda when it is
+// not a valid weight.
+func (e *Engine) mmrLambda() float64 {
 	if e == nil {
-		return defaultLambda
+		return defaultMMRLambda
 	}
 	if e.cfg.DiversityLambda >= 0 && e.cfg.DiversityLambda <= 1 {
 		return e.cfg.DiversityLambda
 	}
-	return defaultLambda
+	return defaultMMRLambda
 }
 
-func (e *Engine) profileAccessFilter(ctx context.Context, userID int, profileID string) catalog.AccessFilter {
+// profileAccessFilter returns the access filter a profile's cached rows are
+// built under. With a ScopeResolver it is the filter the API derives from the
+// profile's resolved scope (handlers.accessFilterFromScope), PIN verification
+// skipped. An error means the scope is unknown and nothing may be cached for
+// the profile; access.ErrProfileNotFound means the profile no longer exists.
+func (e *Engine) profileAccessFilter(ctx context.Context, userID int, profileID string) (catalog.AccessFilter, error) {
 	filter := catalog.AccessFilter{UserID: userID, ProfileID: profileID}
-	if e == nil || e.storeProvider == nil || profileID == "" {
-		return filter
+	if e == nil || profileID == "" {
+		return filter, nil
+	}
+	if e.scopes != nil {
+		scope, err := e.scopes.Resolve(ctx, access.ResolveInput{
+			UserID:              userID,
+			ProfileID:           profileID,
+			SkipPINVerification: true,
+		})
+		if err != nil {
+			return catalog.AccessFilter{}, fmt.Errorf("resolve access scope for user %d profile %s: %w", userID, profileID, err)
+		}
+		filter.AllowedLibraryIDs = scope.AllowedLibraryIDs
+		filter.DisabledLibraryIDs = scope.DisabledLibraryIDs
+		filter.MaturityLimits = scope.MaturityLimits
+		return filter, nil
+	}
+	if e.storeProvider == nil {
+		return filter, nil
 	}
 
 	store, err := e.storeProvider.ForUser(ctx, userID)
-	if err != nil || store == nil {
-		return filter
+	if err != nil {
+		return catalog.AccessFilter{}, fmt.Errorf("open user store for user %d: %w", userID, err)
+	}
+	if store == nil {
+		return catalog.AccessFilter{}, fmt.Errorf("open user store for user %d: no store", userID)
 	}
 	profile, err := store.GetProfile(ctx, profileID)
-	if err != nil || profile == nil {
-		return filter
+	if err != nil {
+		return catalog.AccessFilter{}, fmt.Errorf("load profile %s: %w", profileID, err)
+	}
+	if profile == nil {
+		return catalog.AccessFilter{}, access.ErrProfileNotFound
 	}
 
 	filter.MaxContentRating = profile.MaxContentRating
@@ -134,9 +211,32 @@ func (e *Engine) profileAccessFilter(ctx context.Context, userID int, profileID
 		filter.AllowUnratedContent = e.unrated.AllowUnratedContent(ctx)
 	}
 	if profile.LibraryRestrictionsEnabled {
-		filter.AllowedLibraryIDs = append([]int(nil), profile.AllowedLibraryIDs...)
+		filter.AllowedLibraryIDs = append([]int{}, profile.AllowedLibraryIDs...)
+	}
+	return filter, nil
+}
+
+// storeProfiles lists the IDs of an account's profiles from the user store.
+func (e *Engine) storeProfiles(ctx context.Context, userID int) ([]string, error) {
+	if e.storeProvider == nil {
+		return nil, nil
+	}
+	store, err := e.storeProvider.ForUser(ctx, userID)
+	if err != nil {
+		return nil, fmt.Errorf("open user store for user %d: %w", userID, err)
+	}
+	if store == nil {
+		return nil, nil
+	}
+	profiles, err := store.ListProfiles(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("list profiles for user %d: %w", userID, err)
+	}
+	ids := make([]string, 0, len(profiles))
+	for _, p := range profiles {
+		ids = append(ids, p.ID)
 	}
-	return filter
+	return ids, nil
 }
 
 func scoredItemIDsFromSet(set map[string]struct{}) []string {
diff --git a/internal/recommendations/engine_test.go b/internal/recommendations/engine_test.go
index 2232cfecf6..8ac7dbe80f 100644
--- a/internal/recommendations/engine_test.go
+++ b/internal/recommendations/engine_test.go
@@ -7,6 +7,8 @@ import (
 	"github.com/jackc/pgx/v5/pgxpool"
 
 	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/config"
+	"github.com/prairie-server/prairie-server/internal/database"
 	"github.com/prairie-server/prairie-server/internal/envutil"
 )
 
@@ -29,11 +31,12 @@ func newEngineTestPool(t *testing.T) *pgxpool.Pool {
 		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
 	}
 	ctx := context.Background()
-	pool, err := pgxpool.New(ctx, dsn)
+	// The application's pool, so queries run with its vector codecs.
+	pool, err := database.NewPool(ctx, config.DatabaseConfig{URL: dsn})
 	if err != nil {
 		t.Fatalf("connect test database: %v", err)
 	}
-	t.Cleanup(pool.Close)
+	t.Cleanup(func() { database.ClosePool(pool) })
 	var tableName *string
 	if err := pool.QueryRow(ctx, `SELECT to_regclass('public.server_settings')::text`).Scan(&tableName); err != nil {
 		t.Fatalf("check server_settings table: %v", err)
diff --git a/internal/recommendations/hnsw_ef_search_db_test.go b/internal/recommendations/hnsw_ef_search_db_test.go
index 2c943d6bdd..19a60a8e06 100644
--- a/internal/recommendations/hnsw_ef_search_db_test.go
+++ b/internal/recommendations/hnsw_ef_search_db_test.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os"
 	"slices"
+	"strconv"
 	"testing"
 
 	"github.com/jackc/pgx/v5"
@@ -15,8 +16,9 @@ import (
 
 // TestFindTasteProfileCandidatesWithGenresAboveEfSearchMaximumDB covers the
 // Watch Tonight discover path: a genre filter multiplies the candidate pool by
-// five, so a pool of 240 asks pgvector for 1200 ANN candidates, above the
-// largest hnsw.ef_search it accepts.
+// five, so a pool of 240 asks pgvector for 1200 ANN candidates, more than the
+// largest hnsw.ef_search it accepts. The scan runs with a fixed
+// hnsw.ef_search and iterative scans, whatever its LIMIT.
 func TestFindTasteProfileCandidatesWithGenresAboveEfSearchMaximumDB(t *testing.T) {
 	newEngineTestPool(t) // skips without a migrated database
 	ctx := t.Context()
@@ -60,7 +62,20 @@ func TestFindTasteProfileCandidatesWithGenresAboveEfSearchMaximumDB(t *testing.T
 		embedding[i] = float32(i%2 + 1)
 	}
 	const watchTonightGenrePool = 240
-	items, genres, err := NewRepo(pool).FindTasteProfileCandidates(ctx, embedding, nil, []string{"Drama"}, watchTonightGenrePool, catalog.AccessFilter{})
+	repo := NewRepo(pool)
+	if err := repo.withHNSWCandidateScan(ctx, func(tx pgx.Tx) error {
+		var efSearch, iterativeScan string
+		if err := tx.QueryRow(ctx, `SELECT current_setting('hnsw.ef_search'), current_setting('hnsw.iterative_scan')`).Scan(&efSearch, &iterativeScan); err != nil {
+			return err
+		}
+		if efSearch != strconv.Itoa(hnswEfSearch) || iterativeScan != "relaxed_order" {
+			t.Errorf("candidate scan runs with ef_search=%s iterative_scan=%s", efSearch, iterativeScan)
+		}
+		return nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+	items, genres, err := repo.FindTasteProfileCandidates(ctx, embedding, nil, []string{"Drama"}, watchTonightGenrePool, catalog.AccessFilter{})
 	if err != nil {
 		t.Fatalf("FindTasteProfileCandidates with genres and limit %d: %v", watchTonightGenrePool, err)
 	}
diff --git a/internal/recommendations/jobs.go b/internal/recommendations/jobs.go
new file mode 100644
index 0000000000..8dc825ea3d
--- /dev/null
+++ b/internal/recommendations/jobs.go
@@ -0,0 +1,438 @@
+package recommendations
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"strings"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/database/pglock"
+	"github.com/prairie-server/prairie-server/internal/taskmanager"
+	"github.com/prairie-server/prairie-server/internal/telemetry"
+	"github.com/prairie-server/prairie-server/internal/workmetrics"
+)
+
+// Every API node runs a Worker, so each job also takes a cluster-wide
+// advisory lock: one node runs it while the others skip. The keys spell their
+// names in ASCII, like the repository's other advisory lock keys.
+const (
+	embeddingsJobLock    int64 = 0x53494C4F52454D42 // "PRAIRIEREMB"
+	tasteProfilesJobLock int64 = 0x53494C4F52545354 // "PRAIRIERTST"
+	cowatchJobLock       int64 = 0x53494C4F52435754 // "PRAIRIERCWT"
+	cacheJobLock         int64 = 0x53494C4F52434143 // "PRAIRIERCAC"
+	// staleSweepLock lets one node sweep stale profiles at a time.
+	staleSweepLock int64 = 0x53494C4F5253544C // "PRAIRIERSTL"
+)
+
+var jobLockKeys = map[JobName]int64{
+	JobEmbeddings:      embeddingsJobLock,
+	JobTasteProfiles:   tasteProfilesJobLock,
+	JobCowatch:         cowatchJobLock,
+	JobRecommendations: cacheJobLock,
+}
+
+// Each job's runs are rows in the task manager's execution history under
+// these keys. No task is registered under them, so the admin task list does
+// not show them; history retention prunes them like any other key.
+const (
+	embeddingsTaskKey    = "recommendations.embeddings"
+	tasteProfilesTaskKey = "recommendations.taste_profiles"
+	cowatchTaskKey       = "recommendations.cowatch"
+	cacheTaskKey         = "recommendations.cache"
+)
+
+var jobTaskKeys = map[JobName]string{
+	JobEmbeddings:      embeddingsTaskKey,
+	JobTasteProfiles:   tasteProfilesTaskKey,
+	JobCowatch:         cowatchTaskKey,
+	JobRecommendations: cacheTaskKey,
+}
+
+// Partial runs do part of a job under its claim between full runs: the
+// embedding catch-up pass and the startup build of the global rows. They are
+// recorded under keys of their own, so a frequent partial run never hides the
+// outcome of the last full one.
+const (
+	embeddingsCatchUpTaskKey = "recommendations.embeddings.catch_up"
+	globalRowsTaskKey        = "recommendations.cache.global_rows"
+)
+
+// staleSweepTaskKey records stale sweeps that refreshed or failed at
+// least one profile.
+const staleSweepTaskKey = "recommendations.stale_sweep"
+
+var partialJobTaskKeys = map[JobName]string{
+	JobEmbeddings:      embeddingsCatchUpTaskKey,
+	JobRecommendations: globalRowsTaskKey,
+}
+
+// Run statuses, from the task manager's execution history vocabulary.
+const (
+	runStatusCompleted = "completed"
+	runStatusFailed    = "failed"
+)
+
+const (
+	// jobLockTimeout bounds taking a job's cluster lock, or checking its
+	// session, not the job.
+	jobLockTimeout = 10 * time.Second
+	// jobHistoryTimeout bounds recording a run, which happens after the job's
+	// own deadline may have passed.
+	jobHistoryTimeout = 10 * time.Second
+	// cacheTTL outlives the daily cache job by two hours, so the rows one run
+	// writes stay readable until the next run has rebuilt them.
+	cacheTTL = 26 * time.Hour
+)
+
+// ErrJobRunning reports a job that is already running on this server.
+var ErrJobRunning = errors.New("job is already running")
+
+// ErrJobRunningElsewhere reports a job whose cluster lock another server holds.
+var ErrJobRunningElsewhere = errors.New("job is already running on another server")
+
+// cacheExpiry is the expires_at for cache rows written by work that started at
+// start.
+func cacheExpiry(start time.Time) string {
+	return start.Add(cacheTTL).Format(time.RFC3339)
+}
+
+// jobLocker takes a cluster-wide lock without waiting. acquired is false when
+// another server holds it.
+type jobLocker interface {
+	TryLock(ctx context.Context, key int64) (lock clusterLock, acquired bool, err error)
+}
+
+// clusterLock is a cluster-wide lock this server holds. Each lock pins one
+// database connection, so work guarded by a second lock while it holds one
+// (a job taking each profile's lock, an embeddings reset taking several jobs')
+// takes it with TryAlso, on the same connection.
+type clusterLock interface {
+	// TryAlso takes key on the lock's own session without waiting.
+	// acquired is false when another server holds key. release unlocks key
+	// alone; Release unlocks it too when release was not called.
+	TryAlso(ctx context.Context, key int64) (release func(), acquired bool, err error)
+	// Check returns errJobLockLost once the lock's session has closed, which
+	// released every key the lock held.
+	Check(ctx context.Context) error
+	// Release unlocks every key the lock holds.
+	Release()
+}
+
+type pgJobLocker struct{ pool *pgxpool.Pool }
+
+func (l pgJobLocker) TryLock(ctx context.Context, key int64) (clusterLock, bool, error) {
+	lock, acquired, err := pglock.TryAcquire(ctx, l.pool, key)
+	if err != nil || !acquired {
+		return nil, false, err
+	}
+	return pgClusterLock{lock: lock, key: key}, true, nil
+}
+
+type pgClusterLock struct {
+	lock *pglock.Lock
+	key  int64
+}
+
+// errJobLockLost reports that the session holding a job's cluster lock
+// closed, which released the lock: another server may start the job, so the
+// run stops.
+var errJobLockLost = errors.New("recommendation job lost its cluster lock")
+
+func (l pgClusterLock) TryAlso(ctx context.Context, key int64) (func(), bool, error) {
+	acquired, err := l.lock.AcquireAlso(ctx, key, 0)
+	if err != nil && !l.lock.Held() {
+		return nil, false, fmt.Errorf("%w: %w", errJobLockLost, err)
+	}
+	if err != nil || !acquired {
+		return nil, false, err
+	}
+	return func() {
+		releaseCtx := context.WithoutCancel(ctx)
+		if err := l.lock.ReleaseAlso(releaseCtx, key); err != nil {
+			slog.WarnContext(releaseCtx, "releasing recommendation lock failed", "component", "recommendations", "lock", key, "error", err)
+		}
+	}, true, nil
+}
+
+// Check gives the probe jobLockTimeout, not the job's deadline: a session
+// whose connection stopped answering would otherwise hold the job, and its
+// claim, until the deadline.
+func (l pgClusterLock) Check(ctx context.Context) error {
+	checkCtx, cancel := context.WithTimeout(ctx, jobLockTimeout)
+	defer cancel()
+	if err := l.lock.Check(checkCtx); err != nil {
+		if ctxErr := ctx.Err(); ctxErr != nil {
+			return ctxErr
+		}
+		return fmt.Errorf("%w: %w", errJobLockLost, err)
+	}
+	return nil
+}
+
+func (l pgClusterLock) Release() {
+	if err := l.lock.Release(context.Background()); err != nil {
+		slog.Warn("releasing recommendation job lock failed", "component", "recommendations", "lock", l.key, "error", err)
+	}
+}
+
+// JobHistory stores one row per finished job run. The task manager's
+// execution repository satisfies it.
+type JobHistory interface {
+	Insert(ctx context.Context, result taskmanager.ExecutionResult) error
+	GetLatest(ctx context.Context, taskKey string) (*taskmanager.ExecutionResult, error)
+}
+
+// WithJobHistory records every finished job run in history and returns the
+// worker. Without it runs are only logged.
+func (w *Worker) WithJobHistory(history JobHistory) *Worker {
+	if w != nil {
+		w.history = history
+	}
+	return w
+}
+
+// JobRuns holds a job's newest recorded full and partial runs. Each is nil
+// until one is recorded.
+type JobRuns struct {
+	Full    *taskmanager.ExecutionResult
+	Partial *taskmanager.ExecutionResult
+}
+
+// LastRuns returns the newest recorded runs of each job. Jobs with no
+// recorded run are absent, and the map is empty when no history is wired.
+func (w *Worker) LastRuns(ctx context.Context) (map[JobName]JobRuns, error) {
+	runs := make(map[JobName]JobRuns, len(jobTaskKeys))
+	if w == nil || w.history == nil {
+		return runs, nil
+	}
+	for name, key := range jobTaskKeys {
+		var r JobRuns
+		var err error
+		if r.Full, err = w.history.GetLatest(ctx, key); err != nil {
+			return nil, fmt.Errorf("read last %s run: %w", jobLabel(name), err)
+		}
+		if partialKey, ok := partialJobTaskKeys[name]; ok {
+			if r.Partial, err = w.history.GetLatest(ctx, partialKey); err != nil {
+				return nil, fmt.Errorf("read last partial %s run: %w", jobLabel(name), err)
+			}
+		}
+		if r.Full != nil || r.Partial != nil {
+			runs[name] = r
+		}
+	}
+	return runs, nil
+}
+
+// StaleSweepStatus is the stale sweep's backlog and its newest recorded run.
+type StaleSweepStatus struct {
+	// Pending counts the profiles marked stale and not yet refreshed.
+	Pending int
+	// LastRun is nil until a sweep refreshes or fails a profile.
+	LastRun *taskmanager.ExecutionResult
+}
+
+// StaleSweep reports the stale sweep's backlog and its newest recorded run.
+func (w *Worker) StaleSweep(ctx context.Context) (StaleSweepStatus, error) {
+	var status StaleSweepStatus
+	var err error
+	if status.Pending, err = w.engine.repo.StaleProfileCount(ctx); err != nil {
+		return status, err
+	}
+	if w.history != nil {
+		if status.LastRun, err = w.history.GetLatest(ctx, staleSweepTaskKey); err != nil {
+			return status, fmt.Errorf("read last stale sweep: %w", err)
+		}
+	}
+	return status, nil
+}
+
+// jobResult is the summary a job body returns. It is logged and stored as the
+// run's result data.
+type jobResult interface {
+	// failures counts the parts of the run that failed without stopping it.
+	failures() int
+}
+
+// idleResult is a jobResult that can tell when its run found nothing to do.
+type idleResult interface {
+	jobResult
+	idle() bool
+}
+
+type job struct {
+	name    JobName
+	timeout time.Duration
+	// run does the work. held is the job's cluster lock, through which
+	// the work takes any further lock.
+	run func(ctx context.Context, held clusterLock) (jobResult, error)
+	// partial marks a run that does part of the job between full runs; it
+	// is recorded under the job's partial task key.
+	partial bool
+	// quietWhenIdle logs the job at Debug and leaves a run out of history
+	// when it succeeds and its result reports nothing done. Frequent
+	// catch-up runs use it so history holds only runs that did something.
+	quietWhenIdle bool
+}
+
+// isIdleRun reports a successful run whose result says it did nothing.
+func isIdleRun(result jobResult, err error) bool {
+	idle, ok := result.(idleResult)
+	return err == nil && ok && idle.idle()
+}
+
+func jobLabel(name JobName) string {
+	return strings.ReplaceAll(string(name), "_", " ")
+}
+
+// runJob claims j for this process and for the cluster, then runs it: in a new
+// goroutine when background is set (manual triggers), otherwise in the
+// caller's goroutine (cron). The claim happens before runJob returns either
+// way, so a caller learns about a busy job through ErrJobRunning or
+// ErrJobRunningElsewhere. Runs skipped that way are not recorded.
+func (w *Worker) runJob(j job, background bool) error {
+	held, release, err := w.claimJobs(j.name)
+	if err != nil {
+		return err
+	}
+	if background {
+		go func() {
+			defer release()
+			w.executeJob(j, held)
+		}()
+		return nil
+	}
+	defer release()
+	w.executeJob(j, held)
+	return nil
+}
+
+// runScheduled runs a cron job, logging instead of returning a busy job.
+func (w *Worker) runScheduled(name JobName) {
+	err := w.runJob(w.jobFor(name), false)
+	switch {
+	case err == nil:
+	case errors.Is(err, ErrJobRunningElsewhere):
+		slog.Info("recommendation job is running on another server; skipping scheduled run", "component", "recommendations", "job", name)
+	case errors.Is(err, ErrJobRunning):
+		slog.Warn("recommendation job already running; skipping scheduled run", "component", "recommendations", "job", name)
+	default:
+		slog.Error("recommendation job could not start", "component", "recommendations", "job", name, "error", err)
+	}
+}
+
+// claimJobs claims the named jobs for this process and for the cluster and
+// returns the first job's cluster lock, which holds the others' too, and one
+// function that releases them all. When a claim fails it releases the ones it
+// took.
+func (w *Worker) claimJobs(names ...JobName) (held clusterLock, release func(), err error) {
+	var releases []func()
+	release = func() {
+		for i := len(releases) - 1; i >= 0; i-- {
+			releases[i]()
+		}
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), jobLockTimeout)
+	defer cancel()
+	for _, name := range names {
+		if !w.tryStart(name) {
+			release()
+			return nil, nil, fmt.Errorf("%s %w", jobLabel(name), ErrJobRunning)
+		}
+		releases = append(releases, func() { w.setRunning(name, false) })
+		var unlock func()
+		var acquired bool
+		if held == nil {
+			held, acquired, err = w.locker.TryLock(ctx, jobLockKeys[name])
+			if acquired {
+				unlock = held.Release
+			}
+		} else {
+			unlock, acquired, err = held.TryAlso(ctx, jobLockKeys[name])
+		}
+		if err != nil {
+			release()
+			return nil, nil, fmt.Errorf("take %s job lock: %w", jobLabel(name), err)
+		}
+		if !acquired {
+			release()
+			return nil, nil, fmt.Errorf("%s %w", jobLabel(name), ErrJobRunningElsewhere)
+		}
+		releases = append(releases, unlock)
+	}
+	return held, release, nil
+}
+
+func (w *Worker) executeJob(j job, held clusterLock) {
+	ctx, cancel := context.WithTimeout(context.Background(), j.timeout)
+	defer cancel()
+	ctx, observation := workmetrics.Start(ctx, "recommendations", time.Time{})
+	defer workmetrics.Profile(ctx)()
+
+	startLevel := slog.LevelInfo
+	if j.quietWhenIdle {
+		startLevel = slog.LevelDebug
+	}
+	slog.Log(ctx, startLevel, "recommendation job started", "component", "recommendations", "job", j.name, "timeout", j.timeout)
+	started := time.Now()
+	result, err := j.run(ctx, held)
+	completed := time.Now()
+	observation.Finish(telemetry.Outcome(err))
+
+	var resultData json.RawMessage
+	if result != nil {
+		data, marshalErr := json.Marshal(result)
+		if marshalErr != nil {
+			slog.WarnContext(ctx, "encoding recommendation job result failed", "component", "recommendations", "job", j.name, "error", marshalErr)
+		} else {
+			resultData = data
+		}
+	}
+
+	attrs := []any{"component", "recommendations", "job", j.name, "duration", completed.Sub(started), "result", string(resultData)}
+	switch {
+	case j.quietWhenIdle && isIdleRun(result, err):
+		slog.DebugContext(ctx, "recommendation job found nothing to do", attrs...)
+		return
+	case err != nil:
+		slog.ErrorContext(ctx, "recommendation job failed", append(attrs, "error", err)...)
+	case result != nil && result.failures() > 0:
+		slog.WarnContext(ctx, "recommendation job completed with errors", attrs...)
+	default:
+		slog.InfoContext(ctx, "recommendation job completed", attrs...)
+	}
+
+	taskKey := jobTaskKeys[j.name]
+	if j.partial {
+		taskKey = partialJobTaskKeys[j.name]
+	}
+	w.recordRun(taskKey, started, completed, resultData, err)
+}
+
+// recordRun stores one finished run under taskKey.
+func (w *Worker) recordRun(taskKey string, started, completed time.Time, resultData json.RawMessage, runErr error) {
+	if w.history == nil {
+		return
+	}
+	run := taskmanager.ExecutionResult{
+		TaskKey:     taskKey,
+		StartedAt:   started,
+		CompletedAt: completed,
+		Status:      runStatusCompleted,
+		ResultData:  resultData,
+		DurationMs:  completed.Sub(started).Milliseconds(),
+	}
+	if runErr != nil {
+		run.Status = runStatusFailed
+		run.ErrorMessage = runErr.Error()
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), jobHistoryTimeout)
+	defer cancel()
+	if err := w.history.Insert(ctx, run); err != nil {
+		slog.WarnContext(ctx, "recording recommendation job run failed", "component", "recommendations", "task_key", taskKey, "error", err)
+	}
+}
diff --git a/internal/recommendations/personal.go b/internal/recommendations/personal.go
index dd8657832f..3b5e31e7e1 100644
--- a/internal/recommendations/personal.go
+++ b/internal/recommendations/personal.go
@@ -3,6 +3,7 @@ package recommendations
 import (
 	"context"
 	"fmt"
+	"log/slog"
 	"sort"
 	"time"
 
@@ -11,85 +12,57 @@ import (
 
 const aggregateMediaTypeFloorDivisor = 5
 
-var aggregateSupplementMediaTypes = []string{"movie", "series", "audiobook", "ebook"}
-
-// ForYou returns personalised recommendations grouped by taste clusters.
-// For cold-start users, non-personalized rows are returned.
-func (e *Engine) ForYou(ctx context.Context, userID int, profileID string, limit int) (*ForYouResponse, error) {
-	// Check signal count to determine cold-start level.
-	meta, err := e.repo.GetTasteProfileMeta(ctx, userID, profileID)
-	if err != nil {
-		return nil, fmt.Errorf("get taste profile meta: %w", err)
-	}
-
-	positiveSignals := 0
-	if meta != nil {
-		for k, v := range meta.SignalCounts {
-			switch k {
-			case "rated_low", "watch_low":
-				// negative signals don't count
-			default:
-				positiveSignals += v
-			}
-		}
-	}
-
-	level := coldStartLevel(positiveSignals)
-
-	// Build cold-start rows (always available).
-	coldStartRows, err := e.buildColdStartRows(ctx)
-	if err != nil {
-		return nil, fmt.Errorf("build cold start rows: %w", err)
-	}
-
-	watchedSet, err := e.watchedItemIDSet(ctx, userID, profileID)
-	if err != nil {
-		return nil, fmt.Errorf("get watched item IDs: %w", err)
-	}
-	watchedIDs := scoredItemIDsFromSet(watchedSet)
-	coldStartRows = excludeWatchedRows(coldStartRows, watchedSet)
-
-	// If no taste profile at all, return cold-start only.
-	if meta == nil || level == 0 {
-		return &ForYouResponse{Rows: coldStartRows}, nil
-	}
-
-	// Build personalized rows from taste clusters.
-	liveFilter := catalog.AccessFilter{UserID: userID, ProfileID: profileID}
-	personalRows, err := e.buildClusterRows(ctx, userID, profileID, limit, watchedIDs, liveFilter)
-	if err != nil {
-		return nil, fmt.Errorf("build cluster rows: %w", err)
-	}
-
-	aggregatedRow, err := e.buildAggregatedRow(ctx, userID, profileID, limit, watchedIDs, liveFilter)
-	if err != nil {
-		return nil, fmt.Errorf("build aggregated row: %w", err)
-	}
-	personalRows = combinePersonalRows(aggregatedRow, personalRows)
+// rowStore is the part of *Repo that builds a profile's personal rows.
+type rowStore interface {
+	GetTasteProfile(ctx context.Context, userID int, profileID string) ([]float32, error)
+	GetTasteClusters(ctx context.Context, userID int, profileID string) ([]TasteCluster, error)
+	FindTasteProfileCandidates(ctx context.Context, embedding []float32, excludeIDs []string, genres []string, limit int, filter catalog.AccessFilter) ([]ScoredItem, map[string][]string, error)
+	FindTasteProfileCandidatesByMediaType(ctx context.Context, embedding []float32, excludeIDs []string, genres []string, limit int, filter catalog.AccessFilter, mediaType string) ([]ScoredItem, map[string][]string, error)
+	GetBatchEmbeddings(ctx context.Context, itemIDs []string) (map[string][]float32, error)
+	GetItemMediaTypes(ctx context.Context, itemIDs []string) (map[string]string, error)
+	GetItemAddedDates(ctx context.Context, itemIDs []string) (map[string]time.Time, error)
+	PresentMediaTypes(ctx context.Context, mediaTypes []string, filter catalog.AccessFilter) (map[string]struct{}, error)
+	GetItemQualityRatings(ctx context.Context, itemIDs []string) (map[string]float64, error)
+}
 
-	merged := mergePersonalizedAndColdStart(personalRows, coldStartRows, level)
-	return &ForYouResponse{Rows: merged}, nil
+// rowBuilder builds a profile's main and cluster rows.
+type rowBuilder struct {
+	store  rowStore
+	lambda float64
+	now    time.Time
+	// aversion is the titles the profile turned away, which the rows rank
+	// against (see aversion.apply); nil for none.
+	aversion *aversion
+	// penalized, when set, counts the candidates the aversion pushed down.
+	penalized *int
 }
 
-func combinePersonalRows(aggregated *ForYouRow, clusterRows []ForYouRow) []ForYouRow {
-	if aggregated == nil {
-		return clusterRows
+// withAversion applies the builder's aversion to a pool fetched around
+// query, before MMR ranks it.
+func (b rowBuilder) withAversion(pool []ScoredItem, embeddings map[string][]float32, query []float32) ([]ScoredItem, aversionResult) {
+	pool, res := b.aversion.apply(pool, embeddings, query)
+	if b.penalized != nil {
+		*b.penalized += res.penalized
 	}
+	return pool, res
+}
 
-	rows := make([]ForYouRow, 0, len(clusterRows)+1)
-	rows = append(rows, *aggregated)
-	rows = append(rows, clusterRows...)
-	return rows
+// rowBuilder returns the builder for the rows cached now.
+func (e *Engine) rowBuilder() rowBuilder {
+	return rowBuilder{store: e.repo, lambda: e.mmrLambda(), now: time.Now()}
 }
 
-// buildClusterRows generates per-cluster recommendation rows.
-func (e *Engine) buildClusterRows(ctx context.Context, userID int, profileID string, limit int, excludeIDs []string, filter catalog.AccessFilter) ([]ForYouRow, error) {
-	clusters, err := e.repo.GetTasteClusters(ctx, userID, profileID)
+// clusterRows generates per-cluster recommendation rows. A cluster whose
+// candidates or their embeddings cannot be read is logged and skipped;
+// failed counts them. A cluster
+// with no candidates gets a row without items, so its cached row is dropped.
+func (b rowBuilder) clusterRows(ctx context.Context, userID int, profileID string, limit int, excludeIDs []string, filter catalog.AccessFilter) (rows []ForYouRow, failed int, err error) {
+	clusters, err := b.store.GetTasteClusters(ctx, userID, profileID)
 	if err != nil {
-		return nil, fmt.Errorf("get taste clusters: %w", err)
+		return nil, 0, fmt.Errorf("get taste clusters: %w", err)
 	}
 	if len(clusters) == 0 {
-		return nil, nil
+		return nil, 0, nil
 	}
 
 	// Calculate total weight across all clusters for proportional allocation.
@@ -98,7 +71,6 @@ func (e *Engine) buildClusterRows(ctx context.Context, userID int, profileID str
 		totalWeight += c.TotalWeight
 	}
 
-	var rows []ForYouRow
 	for _, c := range clusters {
 		if len(c.Embedding) == 0 {
 			continue
@@ -113,198 +85,296 @@ func (e *Engine) buildClusterRows(ctx context.Context, userID int, profileID str
 		if clusterLimit < 3 {
 			clusterLimit = 3
 		}
+		// The cache takes the main row's served window out of the row (see
+		// withoutMainRowItems), so it gets that many places more.
+		clusterLimit = min(limit, clusterLimit+ServedRowSize)
 
 		// Fetch after access and genre constraints so filtered-out items do not
 		// consume the candidate headroom before MMR.
-		candidates, _, err := e.repo.FindTasteProfileCandidates(ctx, c.Embedding, excludeIDs, c.DominantGenres, clusterLimit*3, filter)
+		candidates, _, err := b.store.FindTasteProfileCandidates(ctx, c.Embedding, excludeIDs, c.DominantGenres, clusterLimit*3, filter)
 		if err != nil {
+			failed++
+			slog.WarnContext(ctx, "cluster recommendation candidates failed", "component", "recommendations",
+				"user_id", userID, "profile_id", profileID, "cluster_idx", c.ClusterIdx, "error", err)
 			continue
 		}
 		if len(candidates) == 0 {
+			rows = append(rows, ForYouRow{Type: clusterRowType, Label: clusterTitle(c.Label), ClusterIndex: c.ClusterIdx})
 			continue
 		}
-
-		// Apply MMR re-ranking.
-		candidateIDs := make([]string, len(candidates))
-		for i, item := range candidates {
-			candidateIDs[i] = item.MediaItemID
+		candidates = b.withRecencyBoost(ctx, b.withQualityPrior(ctx, candidates, qualityMinSmallPool))
+		embMap, err := b.store.GetBatchEmbeddings(ctx, scoredItemIDs(candidates))
+		if err != nil {
+			// Ranked without embeddings, MMR could not spread the row.
+			failed++
+			slog.WarnContext(ctx, "cluster recommendation embeddings failed", "component", "recommendations",
+				"user_id", userID, "profile_id", profileID, "cluster_idx", c.ClusterIdx, "error", err)
+			continue
 		}
-
-		embMap, _ := e.repo.GetBatchEmbeddings(ctx, candidateIDs)
-		reranked := applyMMR(candidates, embMap, e.mmrLambda(LambdaGenreRow), clusterLimit)
-
-		// Apply recency boost.
-		addedDates, _ := e.repo.GetItemAddedDates(ctx, candidateIDs)
-		reranked = applyRecencyBoost(reranked, addedDates, time.Now())
-
-		label := c.Label
-		if label == "" {
-			label = "For You"
+		candidates, averse := b.withAversion(candidates, embMap, c.Embedding)
+		if averse.interestShare(c.TotalWeight) < aversionInterestFloor {
+			// The profile turned away enough of this interest's titles that
+			// it no longer gets a row of its own.
+			rows = append(rows, ForYouRow{Type: clusterRowType, Label: clusterTitle(c.Label), ClusterIndex: c.ClusterIdx})
+			continue
 		}
+		reranked := applyMMR(candidates, embMap, b.lambda, clusterLimit)
 
-		reason := "Because you enjoy " + label
+		// Every item carries the row title, so a reader can title the cached
+		// row from the build that produced it (see clusterRow).
+		title := clusterTitle(c.Label)
 		for i := range reranked {
-			reranked[i].Reason = reason
+			reranked[i].Reason = title
 		}
 
 		rows = append(rows, ForYouRow{
-			Type:         "cluster",
-			Label:        reason,
+			Type:         clusterRowType,
+			Label:        title,
 			ClusterIndex: c.ClusterIdx,
 			Items:        reranked,
 		})
 	}
 
-	return rows, nil
+	return rows, failed, nil
 }
 
-// buildAggregatedRow builds a single "For You" row from the aggregated taste profile.
-func (e *Engine) buildAggregatedRow(ctx context.Context, userID int, profileID string, limit int, excludeIDs []string, filter catalog.AccessFilter) (*ForYouRow, error) {
-	embedding, err := e.repo.GetTasteProfile(ctx, userID, profileID)
+// withRecencyBoost applies applyRecencyBoost to a candidate pool with its
+// candidates' added dates. A pool whose dates cannot be read keeps its
+// scores.
+func (b rowBuilder) withRecencyBoost(ctx context.Context, pool []ScoredItem) []ScoredItem {
+	if len(pool) == 0 {
+		return pool
+	}
+	added, err := b.store.GetItemAddedDates(ctx, scoredItemIDs(pool))
 	if err != nil {
-		return nil, fmt.Errorf("get taste profile: %w", err)
+		slog.WarnContext(ctx, "candidate added dates failed; candidates keep their scores", "component", "recommendations", "error", err)
+		return pool
 	}
-	if embedding == nil {
-		return nil, nil
+	return applyRecencyBoost(pool, added, b.now)
+}
+
+// minClusterRowItems is the fewest items a cluster row keeps once the main
+// row's served items are taken out of it; a thinner row is cached empty.
+const minClusterRowItems = 10
+
+// withoutMainRowItems takes every title the main row can serve, its first
+// rotationReach(ServedRowSize) under the daily rotation, out of each cluster
+// row, so the main row and a cluster row built from the same interest do not
+// show the same titles. A row this leaves with fewer than minClusterRowItems
+// is emptied; a row it takes nothing from is kept whole.
+func withoutMainRowItems(rows []ForYouRow, main []ScoredItem) []ForYouRow {
+	reach := rotationReach(ServedRowSize)
+	served := make(map[string]struct{}, reach)
+	for _, item := range main[:min(len(main), reach)] {
+		served[item.MediaItemID] = struct{}{}
+	}
+	for i, row := range rows {
+		kept := make([]ScoredItem, 0, len(row.Items))
+		for _, item := range row.Items {
+			if _, ok := served[item.MediaItemID]; !ok {
+				kept = append(kept, item)
+			}
+		}
+		if len(kept) == len(row.Items) {
+			continue
+		}
+		if len(kept) < minClusterRowItems {
+			kept = []ScoredItem{}
+		}
+		rows[i].Items = kept
 	}
+	return rows
+}
 
-	candidates, genreMap, err := e.repo.FindTasteProfileCandidates(ctx, embedding, excludeIDs, nil, limit*3, filter)
+// mainRow builds the "For You" row of a profile with a taste profile. A
+// profile with several interests gets a row composed per interest (see
+// mainRowAnchors), whose every prefix holds each interest's share by weight;
+// any other, or one whose anchors find nothing, a row of the candidates
+// nearest its averaged taste vector, ranked by MMR, whose served window the
+// genre pass then shapes. A profile that turned away every one of its
+// interests gets a main row with no items (see anchoredRow). The genre pass leaves a
+// composed row alone: capping
+// a genre at half the window would cut an interest heavier than half the
+// profile below its share. Type supplements fill the rest of either row.
+func (b rowBuilder) mainRow(ctx context.Context, userID int, profileID string, limit int, excludeIDs []string, filter catalog.AccessFilter) (*ForYouRow, error) {
+	embedding, err := b.store.GetTasteProfile(ctx, userID, profileID)
 	if err != nil {
-		return nil, fmt.Errorf("find similar for aggregated: %w", err)
+		return nil, fmt.Errorf("get taste profile: %w", err)
 	}
-	if len(candidates) == 0 {
+	if embedding == nil {
 		return nil, nil
 	}
-
-	candidates, genreMap, mediaTypes := e.addAggregateMediaTypeSupplements(ctx, embedding, excludeIDs, filter, candidates, genreMap, limit)
-	candidateIDs := make([]string, len(candidates))
-	for i, item := range candidates {
-		candidateIDs[i] = item.MediaItemID
+	clusters, err := b.store.GetTasteClusters(ctx, userID, profileID)
+	if err != nil {
+		return nil, fmt.Errorf("get taste clusters: %w", err)
 	}
 
-	embMap, _ := e.repo.GetBatchEmbeddings(ctx, candidateIDs)
-	reranked := applyMMR(candidates, embMap, e.mmrLambda(LambdaForYou), limit)
-
-	// Apply genre cap on the main For You row.
-	reranked = applyGenreCap(reranked, genreMap, GenreCapPercent)
-	reranked = applyMediaTypeFloor(reranked, candidates, mediaTypes)
+	var row, pool []ScoredItem
+	if anchors := mainRowAnchors(clusters); len(anchors) > 0 {
+		var allAverted bool
+		if row, pool, allAverted, err = b.anchoredRow(ctx, anchors, limit, excludeIDs, filter); err != nil {
+			return nil, err
+		}
+		if allAverted {
+			// The profile turned away every interest; a row around the
+			// averaged taste vector would serve them all again. The empty
+			// row is cached, so reads know it was built.
+			return &ForYouRow{Type: clusterRowType, Label: ForYouLabel, Items: []ScoredItem{}}, nil
+		}
+	}
+	if len(row) == 0 {
+		var genreMap map[string][]string
+		pool, genreMap, err = b.store.FindTasteProfileCandidates(ctx, embedding, excludeIDs, nil, limit*3, filter)
+		if err != nil {
+			return nil, fmt.Errorf("find similar for aggregated: %w", err)
+		}
+		pool = b.withRecencyBoost(ctx, b.withQualityPrior(ctx, pool, 0))
+		embMap, err := b.store.GetBatchEmbeddings(ctx, scoredItemIDs(pool))
+		if err != nil {
+			return nil, fmt.Errorf("main row embeddings: %w", err)
+		}
+		pool, _ = b.withAversion(pool, embMap, embedding)
+		row = applyGenreCap(applyMMR(pool, embMap, b.lambda, limit), genreMap)
+	}
+	if len(row) == 0 {
+		return nil, nil
+	}
+	row = b.addTypeSupplements(ctx, embedding, excludeIDs, filter, pool, row, limit)
 
-	for i := range reranked {
-		reranked[i].Reason = "Personalized for you"
+	for i := range row {
+		row[i].Reason = "Personalized for you"
 	}
 
 	return &ForYouRow{
-		Type:  "cluster",
-		Label: "For You",
-		Items: reranked,
+		Type:  clusterRowType,
+		Label: ForYouLabel,
+		Items: row,
 	}, nil
 }
 
-func (e *Engine) addAggregateMediaTypeSupplements(
+// addTypeSupplements gives row at least mediaTypeFloor(len(row)) items of
+// each media type the viewer can see, so a library section, which scopes the
+// whole cached row to its libraries, still fills. The extra items come from
+// pool, the candidates the row was ranked from, and from a per-type candidate
+// query for a type pool is short of; placeTypeSupplements puts them after the
+// served window. A type the viewer has no titles of is not queried.
+func (b rowBuilder) addTypeSupplements(
 	ctx context.Context,
 	embedding []float32,
 	excludeIDs []string,
 	filter catalog.AccessFilter,
-	candidates []ScoredItem,
-	genreMap map[string][]string,
+	pool []ScoredItem,
+	row []ScoredItem,
 	limit int,
-) ([]ScoredItem, map[string][]string, map[string]string) {
-	mediaTypes, err := e.repo.GetItemMediaTypes(ctx, scoredItemIDs(candidates))
+) []ScoredItem {
+	if len(row) <= ServedRowSize {
+		return row
+	}
+	mediaTypes, err := b.store.GetItemMediaTypes(ctx, scoredItemIDs(pool))
 	if err != nil {
-		return candidates, genreMap, map[string]string{}
+		slog.WarnContext(ctx, "main row media types failed; row left without type supplements", "component", "recommendations", "error", err)
+		return row
 	}
 
-	floor := mediaTypeFloor(limit)
-	changed := false
-	for _, mediaType := range aggregateSupplementMediaTypes {
-		if countMediaType(candidates, mediaTypes, mediaType) >= floor {
-			continue
+	floor := mediaTypeFloor(len(row))
+	var short []string
+	for _, mediaType := range recommendableMediaTypes {
+		if countMediaType(pool, mediaTypes, mediaType) < floor {
+			short = append(short, mediaType)
 		}
-
-		extra, extraGenres, err := e.repo.FindTasteProfileCandidatesByMediaType(ctx, embedding, excludeIDs, nil, limit, filter, mediaType)
-		if err != nil || len(extra) == 0 {
-			continue
-		}
-		candidates = mergeScoredCandidates(candidates, extra)
-		for id, genres := range extraGenres {
-			genreMap[id] = genres
-		}
-		changed = true
 	}
-
-	if changed {
-		if refreshed, err := e.repo.GetItemMediaTypes(ctx, scoredItemIDs(candidates)); err == nil {
-			mediaTypes = refreshed
+	if len(short) > 0 {
+		present, err := b.store.PresentMediaTypes(ctx, short, filter)
+		if err != nil {
+			slog.WarnContext(ctx, "main row media type check failed; querying every short type", "component", "recommendations", "error", err)
+			present = make(map[string]struct{}, len(short))
+			for _, mediaType := range short {
+				present[mediaType] = struct{}{}
+			}
 		}
-	}
-	return candidates, genreMap, mediaTypes
-}
-
-func applyMediaTypeFloor(items []ScoredItem, candidates []ScoredItem, mediaTypes map[string]string) []ScoredItem {
-	if len(items) == 0 || len(candidates) == 0 || len(mediaTypes) == 0 {
-		return items
-	}
-
-	floor := mediaTypeFloor(len(items))
-	for _, mediaType := range aggregateSupplementMediaTypes {
-		if countMediaType(candidates, mediaTypes, mediaType) == 0 {
-			continue
+		for _, mediaType := range short {
+			if _, ok := present[mediaType]; !ok {
+				continue
+			}
+			extra, _, err := b.store.FindTasteProfileCandidatesByMediaType(ctx, embedding, excludeIDs, nil, limit, filter, mediaType)
+			if err != nil {
+				slog.WarnContext(ctx, "main row type supplement failed", "component", "recommendations", "media_type", mediaType, "error", err)
+				continue
+			}
+			extra = b.withQualityPrior(ctx, extra, 0)
+			if !b.aversion.empty() {
+				// Supplements rank against the turned-away titles like the
+				// rest of the row; a type whose embeddings cannot be read is
+				// not supplemented rather than supplemented unranked.
+				embMap, err := b.store.GetBatchEmbeddings(ctx, scoredItemIDs(extra))
+				if err != nil {
+					slog.WarnContext(ctx, "main row type supplement embeddings failed", "component", "recommendations", "media_type", mediaType, "error", err)
+					continue
+				}
+				extra, _ = b.withAversion(extra, embMap, embedding)
+			}
+			pool = mergeScoredCandidates(pool, extra)
+			for _, item := range extra {
+				mediaTypes[item.MediaItemID] = mediaType
+			}
 		}
-		items = ensureMediaTypeFloor(items, candidates, mediaTypes, mediaType, floor)
 	}
-	return items
+	return placeTypeSupplements(row, pool, mediaTypes)
 }
 
-func ensureMediaTypeFloor(items []ScoredItem, candidates []ScoredItem, mediaTypes map[string]string, mediaType string, floor int) []ScoredItem {
-	if floor <= 0 || countMediaType(items, mediaTypes, mediaType) >= floor {
-		return items
-	}
-
-	selected := make(map[string]struct{}, len(items))
-	for _, item := range items {
-		selected[item.MediaItemID] = struct{}{}
-	}
-
-	needed := floor - countMediaType(items, mediaTypes, mediaType)
-	replacements := make([]ScoredItem, 0, needed)
-	for _, candidate := range candidates {
-		if len(replacements) >= needed {
-			break
-		}
-		if mediaTypes[candidate.MediaItemID] != mediaType {
-			continue
-		}
-		if _, ok := selected[candidate.MediaItemID]; ok {
-			continue
+// placeTypeSupplements raises each media type pool offers to at least
+// mediaTypeFloor(len(row)) items of row. The type's best candidates not yet in
+// the row join its end, and as many items leave the part after the served
+// window, last first, from types holding more than the floor. The served
+// window and the order of every item kept are unchanged.
+func placeTypeSupplements(row, pool []ScoredItem, mediaTypes map[string]string) []ScoredItem {
+	if len(row) <= ServedRowSize {
+		return row
+	}
+	floor := mediaTypeFloor(len(row))
+	counts := make(map[string]int)
+	inRow := make(map[string]struct{}, len(row))
+	for _, item := range row {
+		counts[mediaTypes[item.MediaItemID]]++
+		inRow[item.MediaItemID] = struct{}{}
+	}
+
+	var added []ScoredItem
+	for _, mediaType := range recommendableMediaTypes {
+		for _, candidate := range pool {
+			if counts[mediaType] >= floor {
+				break
+			}
+			if mediaTypes[candidate.MediaItemID] != mediaType {
+				continue
+			}
+			if _, ok := inRow[candidate.MediaItemID]; ok {
+				continue
+			}
+			added = append(added, candidate)
+			inRow[candidate.MediaItemID] = struct{}{}
+			counts[mediaType]++
 		}
-		replacements = append(replacements, candidate)
-		selected[candidate.MediaItemID] = struct{}{}
 	}
-	if len(replacements) == 0 {
-		return items
+	if len(added) == 0 {
+		return row
 	}
 
-	remove := make(map[string]struct{}, len(replacements))
-	for i := len(items) - 1; i >= 0 && len(remove) < len(replacements); i-- {
-		if mediaTypes[items[i].MediaItemID] == mediaType {
-			continue
+	drop := make(map[int]struct{}, len(added))
+	for i := len(row) - 1; i >= ServedRowSize && len(drop) < len(added); i-- {
+		if mediaType := mediaTypes[row[i].MediaItemID]; counts[mediaType] > floor {
+			drop[i] = struct{}{}
+			counts[mediaType]--
 		}
-		remove[items[i].MediaItemID] = struct{}{}
-	}
-	if len(remove) < len(replacements) {
-		return items
 	}
 
-	mixed := make([]ScoredItem, 0, len(items))
-	for _, item := range items {
-		if _, ok := remove[item.MediaItemID]; ok {
-			continue
+	out := make([]ScoredItem, 0, len(row))
+	for i, item := range row {
+		if _, ok := drop[i]; !ok {
+			out = append(out, item)
 		}
-		mixed = append(mixed, item)
 	}
-	mixed = append(mixed, replacements...)
-	sortScoredItems(mixed)
-	return mixed
+	return append(out, added[:len(drop)]...)
 }
 
 func mediaTypeFloor(limit int) int {
@@ -366,27 +436,25 @@ func sortScoredItems(items []ScoredItem) {
 	})
 }
 
-// buildColdStartRows generates non-personalized rows.
-func (e *Engine) buildColdStartRows(ctx context.Context) ([]ForYouRow, error) {
-	popular, _ := e.repo.GetPopularItems(ctx, 30, 20)
-	recentlyAdded, _ := e.repo.GetRecentlyAddedItems(ctx, 14, 20)
-	topRated, _ := e.repo.GetTopRatedItems(ctx, 5, 20)
-
-	genreSamplers := make(map[string][]ScoredItem)
-	topGenres, _ := e.repo.GetTopGenres(ctx, 5)
-	for _, genre := range topGenres {
-		items, _ := e.repo.GetGenreSamplerItems(ctx, genre, 20)
-		if len(items) > 0 {
-			genreSamplers[genre] = items
-		}
+// BecauseYouWatched returns items similar to a specific item the user has
+// watched. Blends embedding similarity (70%) with co-watch data (30%). Titles
+// in the profile's recommendation exclusion set, and those filter does not
+// admit, are left out before ranking.
+func (e *Engine) BecauseYouWatched(ctx context.Context, userID int, profileID string, sourceItemID string, limit int, filter catalog.AccessFilter) ([]ScoredItem, error) {
+	excluded, err := e.recommendationExclusionSet(ctx, userID, profileID)
+	if err != nil {
+		return nil, fmt.Errorf("get recommendation exclusions: %w", err)
 	}
-
-	return buildColdStartRows(popular, recentlyAdded, topRated, genreSamplers), nil
+	builder := e.rowBuilder()
+	if builder.aversion, err = e.loadAversion(ctx, userID, profileID, builder.now); err != nil {
+		return nil, fmt.Errorf("get turned-away titles: %w", err)
+	}
+	return e.becauseYouWatched(ctx, builder, sourceItemID, limit, excluded, filter)
 }
 
-// BecauseYouWatched returns items similar to a specific item the user has
-// watched. Blends embedding similarity (70%) with co-watch data (30%).
-func (e *Engine) BecauseYouWatched(ctx context.Context, userID int, profileID string, sourceItemID string, limit int) ([]ScoredItem, error) {
+// becauseYouWatched is BecauseYouWatched with the exclusion set given, ranked
+// by builder, whose aversion it applies.
+func (e *Engine) becauseYouWatched(ctx context.Context, builder rowBuilder, sourceItemID string, limit int, excluded map[string]struct{}, filter catalog.AccessFilter) ([]ScoredItem, error) {
 	embedding, err := e.repo.GetEmbedding(ctx, sourceItemID)
 	if err != nil {
 		return nil, fmt.Errorf("get embedding for item %s: %w", sourceItemID, err)
@@ -403,29 +471,46 @@ func (e *Engine) BecauseYouWatched(ctx context.Context, userID int, profileID st
 		sourceType = sourceMeta.Type
 	}
 
-	// Get embedding-based candidates (3x for MMR).
-	embCandidates, err := e.repo.FindSimilar(ctx, embedding, []string{sourceItemID}, sourceType, limit*3)
+	// Get embedding-based candidates (3x for MMR). Excluded titles and those
+	// the viewer cannot see are left out in the query, so they do not take
+	// the candidates' places.
+	excludeIDs := append([]string{sourceItemID}, scoredItemIDsFromSet(excluded)...)
+	embCandidates, err := e.repo.FindSimilar(ctx, embedding, excludeIDs, sourceType, limit*3, filter)
 	if err != nil {
 		return nil, fmt.Errorf("find similar for because watched: %w", err)
 	}
 
-	// Get co-watch neighbors.
+	// Get co-watch neighbors the viewer can see, of the source item's media
+	// type like the embedding candidates: co-watch counts ebook reading too,
+	// and a movie's row would otherwise take series its viewers also watched.
 	cowatchPairs, _ := e.repo.GetCowatchNeighbors(ctx, sourceItemID, limit*3)
-	cowatchMap := make(map[string]float64, len(cowatchPairs))
-	for _, p := range cowatchPairs {
-		cowatchMap[p.SimilarItemID] = p.JaccardScore
+	cowatchMap, err := e.cowatchScores(ctx, cowatchPairs, filter, cowatchMediaTypes(sourceType, recommendableMediaTypes))
+	if err != nil {
+		return nil, fmt.Errorf("filter co-watch neighbors for because watched: %w", err)
 	}
 
-	// Blend scores.
+	// Blend scores, then drop excluded titles before MMR so they do not take
+	// the row's places.
 	blended := blendScores(embCandidates, cowatchMap, 0.7, 0.3)
+	blended = excludeScoredItems(blended, excluded)
+	blended = builder.withQualityPrior(ctx, blended, qualityMinSmallPool)
 
 	// Apply MMR re-ranking.
 	candidateIDs := make([]string, len(blended))
 	for i, item := range blended {
 		candidateIDs[i] = item.MediaItemID
 	}
-	embMap, _ := e.repo.GetBatchEmbeddings(ctx, candidateIDs)
-	result := applyMMR(blended, embMap, e.mmrLambda(LambdaBecauseWatched), limit)
+	embMap, err := e.repo.GetBatchEmbeddings(ctx, candidateIDs)
+	if err != nil {
+		if !builder.aversion.empty() {
+			// Without embeddings the row could not rank against the
+			// profile's turned-away titles.
+			return nil, fmt.Errorf("because watched embeddings: %w", err)
+		}
+		embMap = nil
+	}
+	blended, _ = builder.withAversion(blended, embMap, embedding)
+	result := applyMMR(blended, embMap, builder.lambda, limit)
 
 	for i := range result {
 		if result[i].Reason == "" {
@@ -433,26 +518,40 @@ func (e *Engine) BecauseYouWatched(ctx context.Context, userID int, profileID st
 		}
 	}
 
-	watchedSet, err := e.watchedItemIDSet(ctx, userID, profileID)
-	if err != nil {
-		return nil, fmt.Errorf("get watched item IDs: %w", err)
-	}
-
-	return excludeScoredItems(result, watchedSet), nil
+	return result, nil
 }
 
-func excludeWatchedRows(rows []ForYouRow, watchedSet map[string]struct{}) []ForYouRow {
-	if len(rows) == 0 || len(watchedSet) == 0 {
-		return rows
+// cowatchMediaTypes is the media types a list anchored on an item of
+// sourceType keeps its co-watch neighbors to: the source's own, or
+// unknownSource when the source's type is unknown.
+func cowatchMediaTypes(sourceType string, unknownSource []string) []string {
+	if sourceType == "" {
+		return unknownSource
 	}
+	return []string{sourceType}
+}
 
-	filteredRows := make([]ForYouRow, 0, len(rows))
-	for _, row := range rows {
-		row.Items = excludeScoredItems(row.Items, watchedSet)
-		if len(row.Items) == 0 {
-			continue
+// cowatchScores maps each co-watch neighbor filter admits, and whose media
+// type is one of mediaTypes, to its Jaccard score. Co-watch neighbors bypass
+// the access and type predicates of the embedding query, so they are checked
+// here.
+func (e *Engine) cowatchScores(ctx context.Context, pairs []CowatchPair, filter catalog.AccessFilter, mediaTypes []string) (map[string]float64, error) {
+	scores := make(map[string]float64, len(pairs))
+	if len(pairs) == 0 {
+		return scores, nil
+	}
+	ids := make([]string, len(pairs))
+	for i, p := range pairs {
+		ids[i] = p.SimilarItemID
+	}
+	accessible, err := e.repo.filterItemIDs(ctx, ids, filter, mediaTypes)
+	if err != nil {
+		return nil, err
+	}
+	for _, p := range pairs {
+		if _, ok := accessible[p.SimilarItemID]; ok {
+			scores[p.SimilarItemID] = p.JaccardScore
 		}
-		filteredRows = append(filteredRows, row)
 	}
-	return filteredRows
+	return scores, nil
 }
diff --git a/internal/recommendations/quality.go b/internal/recommendations/quality.go
new file mode 100644
index 0000000000..1e53a5ea56
--- /dev/null
+++ b/internal/recommendations/quality.go
@@ -0,0 +1,113 @@
+package recommendations
+
+import (
+	"context"
+	"log/slog"
+	"math"
+)
+
+// The quality prior lets a title's public rating break near-ties in
+// similarity, so a well-rated title ranks ahead of a poorly rated plot
+// neighbor. It is scale-free: the nudge is measured in the pool's own spread
+// of scores, which varies several-fold between embedding models, and ratings
+// are compared only within one media type, because series rate higher than
+// movies.
+const (
+	// qualityPriorWeight is the largest nudge, in standard deviations of the
+	// pool's scores. Raising it would start to push a profile away from
+	// genres that rate low on average.
+	qualityPriorWeight = 0.5
+	// qualityMinRated is the fewest rated candidates of a media type the
+	// prior needs to standardize that type's ratings.
+	qualityMinRated = 10
+	// qualityMinSmallPool is the smallest cluster or Because You Watched pool
+	// the prior applies to; smaller pools give noisy statistics.
+	qualityMinSmallPool = 30
+)
+
+// applyQualityPrior sets each candidate's Score to
+//
+//	score + qualityPriorWeight × sd(scores) × clamp(z, −1, 1)
+//
+// where z is the candidate's rating standardized among the pool's rated
+// candidates of the same media type. A candidate without a rating, or of a
+// type with fewer than qualityMinRated rated candidates or no spread in
+// ratings, keeps its score. Score is then a relevance score, not a raw
+// cosine. The candidates keep their order.
+func applyQualityPrior(candidates []ScoredItem, ratings map[string]float64, mediaTypes map[string]string) []ScoredItem {
+	if len(candidates) == 0 || len(ratings) == 0 {
+		return candidates
+	}
+	scores := make([]float64, len(candidates))
+	byType := make(map[string][]float64)
+	for i, c := range candidates {
+		scores[i] = c.Score
+		if rating, ok := ratings[c.MediaItemID]; ok {
+			mediaType := mediaTypes[c.MediaItemID]
+			byType[mediaType] = append(byType[mediaType], rating)
+		}
+	}
+	_, scoreSD := meanSD(scores)
+	if scoreSD == 0 {
+		return candidates
+	}
+	type stats struct{ mean, sd float64 }
+	typeStats := make(map[string]stats, len(byType))
+	for mediaType, values := range byType {
+		if len(values) < qualityMinRated {
+			continue
+		}
+		if mean, sd := meanSD(values); sd > 0 {
+			typeStats[mediaType] = stats{mean, sd}
+		}
+	}
+
+	out := make([]ScoredItem, len(candidates))
+	for i, c := range candidates {
+		out[i] = c
+		rating, rated := ratings[c.MediaItemID]
+		s, ok := typeStats[mediaTypes[c.MediaItemID]]
+		if !rated || !ok {
+			continue
+		}
+		z := max(-1, min(1, (rating-s.mean)/s.sd))
+		out[i].Score += qualityPriorWeight * scoreSD * z
+	}
+	return out
+}
+
+// meanSD returns the mean and population standard deviation of values.
+func meanSD(values []float64) (mean, sd float64) {
+	if len(values) == 0 {
+		return 0, 0
+	}
+	for _, v := range values {
+		mean += v
+	}
+	mean /= float64(len(values))
+	for _, v := range values {
+		sd += (v - mean) * (v - mean)
+	}
+	return mean, math.Sqrt(sd / float64(len(values)))
+}
+
+// withQualityPrior applies applyQualityPrior to pool when it holds at least
+// minPool candidates, reading the ratings and media types it needs. A pool
+// whose reads fail keeps its scores.
+func (b rowBuilder) withQualityPrior(ctx context.Context, pool []ScoredItem, minPool int) []ScoredItem {
+	if len(pool) == 0 || len(pool) < minPool {
+		return pool
+	}
+	ids := scoredItemIDs(pool)
+	ratings, err := b.store.GetItemQualityRatings(ctx, ids)
+	if err != nil {
+		slog.WarnContext(ctx, "quality ratings failed; candidates keep their similarity scores", "component", "recommendations", "error", err)
+		return pool
+	}
+	mediaTypes, err := b.store.GetItemMediaTypes(ctx, ids)
+	if err != nil {
+		slog.WarnContext(ctx, "candidate media types failed; candidates keep their similarity scores", "component", "recommendations", "error", err)
+		return pool
+	}
+	return applyQualityPrior(pool, ratings, mediaTypes)
+}
diff --git a/internal/recommendations/quality_test.go b/internal/recommendations/quality_test.go
new file mode 100644
index 0000000000..54cc86f1ea
--- /dev/null
+++ b/internal/recommendations/quality_test.go
@@ -0,0 +1,117 @@
+package recommendations
+
+import (
+	"fmt"
+	"math"
+	"slices"
+	"testing"
+)
+
+// qualityPool returns n candidates of mediaType, scored 0.80, 0.79, …, with
+// ratings from rating(i); a rating of 0 leaves the candidate unrated.
+func qualityPool(prefix, mediaType string, n int, rating func(int) float64, ratings map[string]float64, types map[string]string) []ScoredItem {
+	items := make([]ScoredItem, n)
+	for i := range items {
+		id := fmt.Sprintf("%s%02d", prefix, i)
+		items[i] = ScoredItem{MediaItemID: id, Score: 0.8 - float64(i)/100}
+		types[id] = mediaType
+		if r := rating(i); r > 0 {
+			ratings[id] = r
+		}
+	}
+	return items
+}
+
+func scoreSD(items []ScoredItem) float64 {
+	scores := make([]float64, len(items))
+	for i, item := range items {
+		scores[i] = item.Score
+	}
+	_, sd := meanSD(scores)
+	return sd
+}
+
+// The nudge is at most qualityPriorWeight standard deviations of the pool's
+// scores, a missing rating is neutral, and the candidates keep their order.
+func TestApplyQualityPriorIsBoundedAndNeutralWithoutARating(t *testing.T) {
+	ratings, types := map[string]float64{}, map[string]string{}
+	pool := qualityPool("m", "movie", 20, func(i int) float64 { return 5 + float64(i%5) }, ratings, types)
+	ratings["m00"] = 100 // far outside the pool: clamped to z = 1
+	delete(ratings, "m01")
+
+	got := applyQualityPrior(pool, ratings, types)
+
+	if !slices.Equal(mmrItemIDs(got), mmrItemIDs(pool)) {
+		t.Fatalf("order = %v, want unchanged", mmrItemIDs(got))
+	}
+	bound := qualityPriorWeight * scoreSD(pool)
+	for i := range got {
+		if shift := got[i].Score - pool[i].Score; math.Abs(shift) > bound+1e-12 {
+			t.Fatalf("%s moved %f, beyond the bound %f", got[i].MediaItemID, shift, bound)
+		}
+	}
+	if shift := got[0].Score - pool[0].Score; math.Abs(shift-bound) > 1e-12 {
+		t.Fatalf("outlier moved %f, want the full bound %f", shift, bound)
+	}
+	if got[1].Score != pool[1].Score {
+		t.Fatalf("unrated candidate moved from %f to %f", pool[1].Score, got[1].Score)
+	}
+}
+
+// Ratings are compared within a media type, so series, which rate higher,
+// gain nothing on movies as a group.
+func TestApplyQualityPriorStandardizesPerMediaType(t *testing.T) {
+	ratings, types := map[string]float64{}, map[string]string{}
+	movies := qualityPool("m", "movie", 20, func(i int) float64 { return 5.5 + float64(i%4)/2 }, ratings, types)
+	series := qualityPool("s", "series", 20, func(i int) float64 { return 7.5 + float64(i%4)/2 }, ratings, types)
+	pool := append(slices.Clone(movies), series...)
+
+	got := applyQualityPrior(pool, ratings, types)
+
+	var movieShift, seriesShift float64
+	for i := range got {
+		shift := got[i].Score - pool[i].Score
+		if types[got[i].MediaItemID] == "series" {
+			seriesShift += shift
+		} else {
+			movieShift += shift
+		}
+	}
+	if math.Abs(movieShift) > 1e-9 || math.Abs(seriesShift) > 1e-9 {
+		t.Fatalf("total shift movies %f, series %f; want each type to net zero", movieShift, seriesShift)
+	}
+}
+
+// A type with too few rated candidates or no spread in ratings, and a pool
+// with no spread in scores, are left alone.
+func TestApplyQualityPriorSkipsThinOrFlatStatistics(t *testing.T) {
+	for name, build := range map[string]func(map[string]float64, map[string]string) []ScoredItem{
+		"few rated": func(r map[string]float64, ty map[string]string) []ScoredItem {
+			return qualityPool("m", "movie", 30, func(i int) float64 {
+				if i < qualityMinRated-1 {
+					return float64(4 + i)
+				}
+				return 0
+			}, r, ty)
+		},
+		"equal ratings": func(r map[string]float64, ty map[string]string) []ScoredItem {
+			return qualityPool("m", "movie", 30, func(int) float64 { return 7 }, r, ty)
+		},
+		"equal scores": func(r map[string]float64, ty map[string]string) []ScoredItem {
+			pool := qualityPool("m", "movie", 30, func(i int) float64 { return float64(3 + i%6) }, r, ty)
+			for i := range pool {
+				pool[i].Score = 0.5
+			}
+			return pool
+		},
+	} {
+		ratings, types := map[string]float64{}, map[string]string{}
+		pool := build(ratings, types)
+		got := applyQualityPrior(pool, ratings, types)
+		for i := range got {
+			if got[i].Score != pool[i].Score {
+				t.Fatalf("%s: %s moved from %f to %f", name, got[i].MediaItemID, pool[i].Score, got[i].Score)
+			}
+		}
+	}
+}
diff --git a/internal/recommendations/ranking_postgres_test.go b/internal/recommendations/ranking_postgres_test.go
new file mode 100644
index 0000000000..0f09cbe395
--- /dev/null
+++ b/internal/recommendations/ranking_postgres_test.go
@@ -0,0 +1,182 @@
+package recommendations
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/access"
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/config"
+	"github.com/prairie-server/prairie-server/internal/userstore/pgstore"
+)
+
+// rankingLibrary inserts a library of kind, removed when the test ends.
+func rankingLibrary(t *testing.T, pool *pgxpool.Pool, name, kind string) int {
+	t.Helper()
+	var id int
+	if err := pool.QueryRow(t.Context(), `INSERT INTO media_folders (type, name, enabled) VALUES ($1, $2, true) RETURNING id`, kind, name).Scan(&id); err != nil {
+		t.Fatalf("insert library: %v", err)
+	}
+	t.Cleanup(func() { _, _ = pool.Exec(context.Background(), `DELETE FROM media_folders WHERE id = $1`, id) })
+	return id
+}
+
+// seedRankedItem inserts a title in library with a content rating, and an
+// embedding when vec is not nil.
+func seedRankedItem(t *testing.T, pool *pgxpool.Pool, id, mediaType, status string, library int, rating string, age int, vec []float32) {
+	t.Helper()
+	ctx := t.Context()
+	seedRecoMediaItem(t, pool, id, mediaType, status)
+	if _, err := pool.Exec(ctx, `UPDATE media_items SET content_rating = $2, content_rating_age = $3 WHERE content_id = $1`, id, rating, age); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := pool.Exec(ctx, `INSERT INTO media_item_libraries (content_id, media_folder_id) VALUES ($1, $2)`, id, library); err != nil {
+		t.Fatal(err)
+	}
+	if vec != nil {
+		if err := NewRepo(pool).UpsertEmbedding(ctx, id, vec, "test-model", id); err != nil {
+			t.Fatal(err)
+		}
+	}
+}
+
+// A media type counts as present only with a matched, embedded title the
+// viewer's libraries and maturity limits admit.
+func TestPresentMediaTypesPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	const prefix = "tpresent-types-"
+	cleanupRecoMediaItems(t, pool, prefix)
+	repo := NewRepo(pool)
+	movies := rankingLibrary(t, pool, prefix+"movies", "movies")
+	shows := rankingLibrary(t, pool, prefix+"shows", "series")
+	vec := axisVector(2600, nil)
+	seedRankedItem(t, pool, prefix+"movie", "movie", "matched", movies, "G", 0, vec)
+	seedRankedItem(t, pool, prefix+"series-without-embedding", "series", "matched", shows, "G", 0, nil)
+	seedRankedItem(t, pool, prefix+"series-unmatched", "series", "unmatched", shows, "G", 0, vec)
+
+	types := []string{"movie", "series", "audiobook"}
+	check := func(name string, filter catalog.AccessFilter, want ...string) {
+		t.Helper()
+		got, err := repo.PresentMediaTypes(ctx, types, filter)
+		if err != nil {
+			t.Fatalf("%s: %v", name, err)
+		}
+		if keys := slices.Sorted(maps.Keys(got)); !slices.Equal(keys, want) {
+			t.Fatalf("%s: present = %v, want %v", name, keys, want)
+		}
+	}
+	ours := catalog.AccessFilter{AllowedLibraryIDs: []int{movies, shows}}
+	check("no usable series", ours, "movie")
+
+	seedRankedItem(t, pool, prefix+"series-adult", "series", "matched", shows, "R", 17, vec)
+	check("an embedded matched series", ours, "movie", "series")
+	check("series above the rating ceiling", catalog.AccessFilter{AllowedLibraryIDs: ours.AllowedLibraryIDs, MaturityLimits: access.MaturityLimits{MaxContentRating: "PG"}}, "movie")
+	check("TV library only", catalog.AccessFilter{AllowedLibraryIDs: []int{shows}}, "series")
+	check("TV library hidden", catalog.AccessFilter{AllowedLibraryIDs: ours.AllowedLibraryIDs, DisabledLibraryIDs: []int{shows}}, "movie")
+	check("no library allowed", catalog.AccessFilter{AllowedLibraryIDs: []int{}})
+}
+
+// The quality rating is IMDb's, else TMDB's below 9.5; a title with neither
+// has none.
+func TestGetItemQualityRatingsPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	const prefix = "tquality-ratings-"
+	cleanupRecoMediaItems(t, pool, prefix)
+	for id, ratings := range map[string][2]any{
+		"both":      {7.1, 8.0},
+		"tmdb-only": {nil, 6.4},
+		"tmdb-high": {nil, 9.8},
+		"none":      {nil, nil},
+	} {
+		seedRecoMediaItem(t, pool, prefix+id, "movie", "matched")
+		if _, err := pool.Exec(ctx, `UPDATE media_items SET rating_imdb = $2, rating_tmdb = $3 WHERE content_id = $1`, prefix+id, ratings[0], ratings[1]); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	got, err := NewRepo(pool).GetItemQualityRatings(ctx, []string{prefix + "both", prefix + "tmdb-only", prefix + "tmdb-high", prefix + "none", prefix + "missing"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := map[string]float64{prefix + "both": 7.1, prefix + "tmdb-only": 6.4}
+	if !maps.Equal(got, want) {
+		t.Fatalf("ratings = %v, want %v", got, want)
+	}
+}
+
+// A movie lover's main row is all movies near its taste, yet the TV
+// library's "Recommended for You", which reads the whole cached row and keeps
+// that library's titles, still gets at least mediaTypeFloor series: the cache
+// build places the best series after the served window.
+func TestTVLibrarySectionFillsFromTheMainRowTailPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	const prefix = "ttv-section-"
+	cleanupRecoMediaItems(t, pool, prefix)
+	userID, profile := newTasteTestAccount(t, pool, prefix)
+	movies := rankingLibrary(t, pool, prefix+"movies", "movies")
+	shows := rankingLibrary(t, pool, prefix+"shows", "series")
+
+	// More movies near the taste than the main row's candidate query reads,
+	// so its candidates hold no series; the series sit further away.
+	const axis = 2700
+	for i := range CacheCandidateLimit*3 + 10 {
+		seedRankedItem(t, pool, fmt.Sprintf("%smovie-%03d", prefix, i), "movie", "matched", movies, "G", 0,
+			axisVector(axis, map[int]float32{axis + 1 + i: 0.15}))
+	}
+	for i := range 20 {
+		seedRankedItem(t, pool, fmt.Sprintf("%sseries-%02d", prefix, i), "series", "matched", shows, "G", 0,
+			axisVector(axis, map[int]float32{2950: 1.5, 2951 + i: 0.1}))
+	}
+	repo := NewRepo(pool)
+	taste := axisVector(axis, nil)
+	now := time.Now()
+	if err := repo.UpsertTasteProfile(ctx, userID, profile, taste, map[string]int{"watch_high": 30}, "", now); err != nil {
+		t.Fatal(err)
+	}
+	if err := repo.UpsertTasteClusters(ctx, userID, profile, []TasteCluster{{ClusterIdx: 0, Embedding: taste, Label: "Test", MemberCount: 30, TotalWeight: 20}}); err != nil {
+		t.Fatal(err)
+	}
+
+	provider := pgstore.NewPostgresProvider(pool)
+	engine := NewEngine(pool, catalog.NewRatingsRepo(pool), catalog.NewItemRepository(pool), nil, provider, config.RecommendationsConfig{DiversityLambda: 0.7})
+	w := newJobTestWorker(&fakeLocker{}, nil)
+	w.engine = engine
+	if built := w.cacheUserRows(ctx, engine.repo, userID, profile, cacheExpiry(now)); built.failed != 0 {
+		t.Fatalf("cache build = %+v, want no failures", built)
+	}
+
+	main, err := repo.GetRecommendationCache(ctx, userID, profile, RecTypeForYouMain, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(main) != CacheCandidateLimit {
+		t.Fatalf("main row has %d items, want %d", len(main), CacheCandidateLimit)
+	}
+	for _, item := range main[:ServedRowSize] {
+		if !strings.HasPrefix(item.MediaItemID, prefix+"movie-") {
+			t.Fatalf("served window holds %s, want only the nearest movies", item.MediaItemID)
+		}
+	}
+
+	reader := NewReader(repo, catalog.NewRatingsRepo(pool), nil, provider)
+	row, err := reader.SectionForYouMain(ctx, userID, profile, catalog.AccessFilter{UserID: userID, ProfileID: profile, AllowedLibraryIDs: []int{shows}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if row == nil {
+		t.Fatal("TV library row is empty")
+	}
+	if series := prefixed(row.Items, prefix+"series-"); len(series) < mediaTypeFloor(CacheCandidateLimit) {
+		t.Fatalf("TV library row holds %d series %v, want at least %d", len(series), series, mediaTypeFloor(CacheCandidateLimit))
+	}
+}
diff --git a/internal/recommendations/reader.go b/internal/recommendations/reader.go
index bc594f5c65..e14b6ebdea 100644
--- a/internal/recommendations/reader.go
+++ b/internal/recommendations/reader.go
@@ -1,11 +1,14 @@
 package recommendations
 
 import (
+	"cmp"
 	"context"
 	"fmt"
 	"log/slog"
+	"slices"
 	"sort"
 	"strconv"
+	"strings"
 	"time"
 
 	"github.com/prairie-server/prairie-server/internal/catalog"
@@ -24,40 +27,133 @@ const (
 	SectionKindGenre         = "genre"
 )
 
-// ProfileRefreshRequester queues a profile-scoped refresh without blocking the caller.
-type ProfileRefreshRequester interface {
-	RequestProfileRefresh(ctx context.Context, userID int, profileID string)
+// ReadRefreshRequester queues a refresh for a profile whose cached rows a read
+// found missing, without blocking the caller. *Worker limits these to one per
+// profile per interval, because a row that came out empty looks the same to a
+// read as a row that was never built.
+type ReadRefreshRequester interface {
+	RequestReadRefresh(ctx context.Context, userID int, profileID string)
+	// ReadRefreshDue reports whether RequestReadRefresh would queue a
+	// refresh for the profile now.
+	ReadRefreshDue(userID int, profileID string) bool
+}
+
+// readerRepo is the part of *Repo the Reader reads.
+type readerRepo interface {
+	GetTasteProfileMeta(ctx context.Context, userID int, profileID string) (*TasteProfileMeta, error)
+	GetTasteClusterMeta(ctx context.Context, userID int, profileID string) ([]TasteCluster, error)
+	GetRecommendationCache(ctx context.Context, userID int, profileID, recType, sourceItemID string) ([]ScoredItem, error)
+	ListCachedGenreSamplers(ctx context.Context) (map[string][]ScoredItem, error)
+	TopGenre(ctx context.Context) (string, error)
+	FilterRecommendableItemIDs(ctx context.Context, itemIDs []string, filter catalog.AccessFilter) (map[string]struct{}, error)
+	ListDefaultRowItems(ctx context.Context, filter catalog.AccessFilter, kind string, exclude []string, limit int) ([]ScoredItem, error)
+	ListRatedItemIDs(ctx context.Context, userID int, profileID string) ([]string, error)
 }
 
 // Reader assembles recommendation rows from cache-backed data sources.
 type Reader struct {
-	repo        *Repo
-	ratingsRepo *catalog.RatingsRepo
-	refresh     ProfileRefreshRequester
+	repo readerRepo
+	// ratingsRepo reads the profile's ratings; nil leaves rated titles in.
+	ratingsRepo itemRatingReader
+	refresh     ReadRefreshRequester
 	signals     *SignalReader
+	// now is the clock personal rows are rotated by; nil is time.Now. A
+	// rotation lasts one UTC day.
+	now func() time.Time
+	// personalOff serves no personal rows (see WithPersonalRows).
+	personalOff bool
 }
 
 // NewReader creates a cache-backed recommendations reader.
-func NewReader(repo *Repo, ratingsRepo *catalog.RatingsRepo, refresh ProfileRefreshRequester, storeProvider userstore.UserStoreProvider) *Reader {
+func NewReader(repo *Repo, ratingsRepo *catalog.RatingsRepo, refresh ReadRefreshRequester, storeProvider userstore.UserStoreProvider) *Reader {
 	return &Reader{
 		repo:        repo,
-		ratingsRepo: ratingsRepo,
+		ratingsRepo: ratingReader(ratingsRepo),
 		refresh:     refresh,
 		signals:     NewSignalReader(repo, storeProvider),
 	}
 }
 
+// ratingReader is repo as an itemRatingReader, nil when repo is nil.
+func ratingReader(repo *catalog.RatingsRepo) itemRatingReader {
+	if repo == nil {
+		return nil
+	}
+	return repo
+}
+
+// WithUserStoreOutsidePostgres records whether the user store keeps watch
+// progress, favorites and watchlist outside Postgres (the SQLite backend), and
+// returns the reader. Signal checks then read the store.
+func (r *Reader) WithUserStoreOutsidePostgres(outside bool) *Reader {
+	if r != nil && r.signals != nil {
+		r.signals.storeOutsidePostgres = outside
+	}
+	return r
+}
+
+// WithPersonalRows sets whether the reader serves personal rows (the main
+// For You row, cluster rows, Because You Watched and Similar Users) and
+// returns it. Recommendations are disabled without them: reads then serve
+// the global and default rows only, ignoring personal rows still cached from
+// before.
+func (r *Reader) WithPersonalRows(enabled bool) *Reader {
+	if r != nil {
+		r.personalOff = !enabled
+	}
+	return r
+}
+
+// today is the time a read's rotation is for; its UTC date picks the day.
+func (r *Reader) today() time.Time {
+	if r.now != nil {
+		return r.now()
+	}
+	return time.Now()
+}
+
+// requestRefresh asks for the profile's cached rows to be rebuilt.
+func (r *Reader) requestRefresh(ctx context.Context, userID int, profileID string) {
+	if r.refresh != nil {
+		r.refresh.RequestReadRefresh(ctx, userID, profileID)
+	}
+}
+
+// requestRefreshIfSignals asks for a refresh of a profile that has no taste
+// profile yet, when it has signals to build one from. Its first refresh
+// request lives in one server's memory and can be lost; this lets a later
+// read recover it. A profile with nothing to build from asks for nothing,
+// and the signals are checked only when a refresh would be let through.
+func (r *Reader) requestRefreshIfSignals(ctx context.Context, userID int, profileID string) {
+	if r.refresh == nil || !r.refresh.ReadRefreshDue(userID, profileID) {
+		return
+	}
+	has, err := r.signalReader().HasSignals(ctx, userID, profileID)
+	if err != nil {
+		slog.WarnContext(ctx, "checking a profile's recommendation signals failed", "component", "recommendations", "user_id", userID, "profile_id", profileID, "error", err)
+		return
+	}
+	if has {
+		r.refresh.RequestReadRefresh(ctx, userID, profileID)
+	}
+}
+
 func (r *Reader) signalReader() *SignalReader {
 	if r.signals != nil {
 		return r.signals
 	}
-	return NewSignalReader(r.repo, nil)
+	repo, _ := r.repo.(signalRepo)
+	return NewSignalReader(repo, nil)
 }
 
 // GetForYouMain returns the first row the recommendations page should display.
 func (r *Reader) GetForYouMain(ctx context.Context, userID int, profileID string, limit int, filter catalog.AccessFilter) (*ForYouRow, error) {
-	limit = normalizeRecommendationLimit(limit)
-	rows, _, err := r.getForYouPageRows(ctx, userID, profileID, filter)
+	return r.forYouMain(ctx, userID, profileID, normalizeRecommendationLimit(limit), filter)
+}
+
+// forYouMain returns the page's first row trimmed to limit.
+func (r *Reader) forYouMain(ctx context.Context, userID int, profileID string, limit int, filter catalog.AccessFilter) (*ForYouRow, error) {
+	rows, err := r.getForYouPageRows(ctx, userID, profileID, filter)
 	if err != nil {
 		return nil, err
 	}
@@ -71,7 +167,7 @@ func (r *Reader) GetForYouMain(ctx context.Context, userID int, profileID string
 // GetForYouRows returns the remaining recommendations-page rows after the main row.
 func (r *Reader) GetForYouRows(ctx context.Context, userID int, profileID string, limit int, filter catalog.AccessFilter) ([]ForYouRow, error) {
 	limit = normalizeRecommendationLimit(limit)
-	rows, _, err := r.getForYouPageRows(ctx, userID, profileID, filter)
+	rows, err := r.getForYouPageRows(ctx, userID, profileID, filter)
 	if err != nil {
 		return nil, err
 	}
@@ -82,24 +178,43 @@ func (r *Reader) GetForYouRows(ctx context.Context, userID int, profileID string
 	return rows[1:], nil
 }
 
+// GetForYouPage returns every recommendations-page row, the main row first.
+// It is GetForYouMain and GetForYouRows in one read.
+func (r *Reader) GetForYouPage(ctx context.Context, userID int, profileID string, limit int, filter catalog.AccessFilter) ([]ForYouRow, error) {
+	limit = normalizeRecommendationLimit(limit)
+	rows, err := r.getForYouPageRows(ctx, userID, profileID, filter)
+	if err != nil {
+		return nil, err
+	}
+	return trimRows(rows, limit), nil
+}
+
 // GetSimilarUsersLiked returns the cached collaborative row for the profile.
 func (r *Reader) GetSimilarUsersLiked(ctx context.Context, userID int, profileID string, limit int, filter catalog.AccessFilter) ([]ScoredItem, error) {
-	limit = normalizeRecommendationLimit(limit)
+	return r.similarUsersLiked(ctx, userID, profileID, normalizeRecommendationLimit(limit), filter)
+}
 
+func (r *Reader) similarUsersLiked(ctx context.Context, userID int, profileID string, limit int, filter catalog.AccessFilter) ([]ScoredItem, error) {
+	if r.personalOff {
+		return []ScoredItem{}, nil
+	}
 	items, err := r.repo.GetRecommendationCache(ctx, userID, profileID, RecTypeSimilarUsersLiked, "")
 	if err != nil {
 		return nil, err
 	}
+	if items == nil {
+		// No row is cached. A built row may be empty (too few peer accounts),
+		// and rebuilding it would not change that.
+		r.requestRefresh(ctx, userID, profileID)
+		return []ScoredItem{}, nil
+	}
 	if len(items) == 0 {
-		if r.refresh != nil {
-			r.refresh.RequestProfileRefresh(ctx, userID, profileID)
-		}
 		return []ScoredItem{}, nil
 	}
 
 	rows, err := r.filterRows(ctx, userID, profileID, []ForYouRow{{
-		Type:  "similar_users_liked",
-		Label: "Fans Like You Also Enjoyed",
+		Type:  RecTypeSimilarUsersLiked,
+		Label: similarUsersLabel,
 		Items: items,
 	}}, filter)
 	if err != nil {
@@ -112,68 +227,195 @@ func (r *Reader) GetSimilarUsersLiked(ctx context.Context, userID int, profileID
 	return rows[0].Items, nil
 }
 
-// GetBecauseYouWatched returns a cached because-you-watched row, using the
-// requested source item when provided or the most recent completed items when not.
-func (r *Reader) GetBecauseYouWatched(ctx context.Context, userID int, profileID, sourceItemID string, limit int, filter catalog.AccessFilter) ([]ScoredItem, error) {
-	items, _, err := r.GetBecauseYouWatchedWithSource(ctx, userID, profileID, sourceItemID, limit, filter)
-	return items, err
+// Section reads serve home and library sections. Each returns a row's whole
+// candidate pool, every cached candidate left after filtering (at most
+// CacheCandidateLimit), rather than a page of the public limit: the section
+// scopes the row to its libraries and trims it to its own item limit
+// afterwards, and trimming first would leave a library's row short or empty.
+
+// SectionForYouMain is GetForYouMain's row for a home or library section.
+func (r *Reader) SectionForYouMain(ctx context.Context, userID int, profileID string, filter catalog.AccessFilter) (*ForYouRow, error) {
+	return r.forYouMain(ctx, userID, profileID, CacheCandidateLimit, filter)
 }
 
-// GetBecauseYouWatchedWithSource preserves the exact anchor used for the returned
-// recommendations. A caller must access-check the anchor before displaying it.
-func (r *Reader) GetBecauseYouWatchedWithSource(ctx context.Context, userID int, profileID, sourceItemID string, limit int, filter catalog.AccessFilter) ([]ScoredItem, string, error) {
-	limit = normalizeRecommendationLimit(limit)
+// SectionForYouFill returns what a library's For You section serves after
+// the main row's titles in that library. The main row ranks every title the
+// profile can see, so a library holding a small share of them can be left
+// with few or none, while a taste cluster or a watched title of the profile
+// sits in it. The fill is the profile's other personal rows in one list: the
+// taste-cluster rows, heaviest cluster first, then the Because You Watched
+// rows of its anchors (see anchorItemIDs), most recent first, then Similar
+// Users. Each row keeps its rank order, each item appears once at its first
+// place, and the list is filtered for the viewer like every row. A missing
+// row asks for no refresh: reading the main row already does. With personal
+// rows off the fill is empty.
+func (r *Reader) SectionForYouFill(ctx context.Context, userID int, profileID string, filter catalog.AccessFilter) ([]ScoredItem, error) {
+	if r.personalOff {
+		return []ScoredItem{}, nil
+	}
+	clusters, rows, _, err := r.getClusterRows(ctx, userID, profileID)
+	if err != nil {
+		return nil, err
+	}
+	weights := make(map[int]float64, len(clusters))
+	for _, cluster := range clusters {
+		weights[cluster.ClusterIdx] = cluster.TotalWeight
+	}
+	slices.SortStableFunc(rows, func(a, b ForYouRow) int {
+		return cmp.Compare(weights[b.ClusterIndex], weights[a.ClusterIndex])
+	})
+
+	anchors, err := anchorItemIDs(ctx, r.signalReader(), r.ratingsRepo, userID, profileID, BecauseYouWatchedAnchors)
+	if err != nil {
+		return nil, err
+	}
+	for _, anchor := range anchors {
+		items, err := r.repo.GetRecommendationCache(ctx, userID, profileID, RecTypeBecauseWatched, anchor)
+		if err != nil {
+			return nil, err
+		}
+		rows = append(rows, ForYouRow{Type: RecTypeBecauseWatched, Items: items})
+	}
+	similar, err := r.repo.GetRecommendationCache(ctx, userID, profileID, RecTypeSimilarUsersLiked, "")
+	if err != nil {
+		return nil, err
+	}
+	rows = append(rows, ForYouRow{Type: RecTypeSimilarUsersLiked, Items: similar})
+
+	rows, err = r.filterRows(ctx, userID, profileID, rows, filter)
+	if err != nil {
+		return nil, err
+	}
+	seen := make(map[string]struct{})
+	fill := []ScoredItem{}
+	for _, row := range rows {
+		fill = append(fill, deduplicateItems(row.Items, seen, 0)...)
+	}
+	return fill, nil
+}
+
+// SectionSimilarUsersLiked is GetSimilarUsersLiked's row for a home or
+// library section.
+func (r *Reader) SectionSimilarUsersLiked(ctx context.Context, userID int, profileID string, filter catalog.AccessFilter) ([]ScoredItem, error) {
+	return r.similarUsersLiked(ctx, userID, profileID, CacheCandidateLimit, filter)
+}
+
+// SectionBecauseYouWatched returns a cached Because You Watched row for a
+// home or library section and the anchor it was built from. It uses
+// sourceItemID as the anchor when given, else the profile's anchors (see
+// anchorItemIDs) in turn: the first whose row keeps an item after filtering
+// wins. When libraryIDs is not nil an item must also be in one of
+// those libraries, so a section picks an anchor with recommendations in its
+// own scope. A caller must access-check the anchor before displaying it.
+func (r *Reader) SectionBecauseYouWatched(ctx context.Context, userID int, profileID, sourceItemID string, libraryIDs []int, filter catalog.AccessFilter) ([]ScoredItem, string, error) {
+	rows, err := r.becauseYouWatchedRows(ctx, userID, profileID, sourceItemID, 1, scopeToLibraries(filter, libraryIDs))
+	if err != nil {
+		return nil, "", err
+	}
+	if len(rows) == 0 {
+		return []ScoredItem{}, "", nil
+	}
+	row := trimRows(rows, CacheCandidateLimit)[0]
+	return row.Items, row.AnchorItemID, nil
+}
 
+// GetBecauseYouWatchedRows returns up to maxRows cached Because You Watched
+// rows filtered for the viewer, one per anchor, the most recent anchor first,
+// each holding at most limit items. A row names its anchor in AnchorItemID; a
+// caller must access-check the anchor before displaying it.
+func (r *Reader) GetBecauseYouWatchedRows(ctx context.Context, userID int, profileID string, maxRows, limit int, filter catalog.AccessFilter) ([]ForYouRow, error) {
+	rows, err := r.becauseYouWatchedRows(ctx, userID, profileID, "", maxRows, filter)
+	if err != nil {
+		return nil, err
+	}
+	return trimRows(rows, normalizeRecommendationLimit(limit)), nil
+}
+
+// becauseYouWatchedRows reads the cached Because You Watched rows of up to
+// maxRows anchors, filtered with filter. It uses sourceItemID as the anchor
+// when given, else the profile's anchors (see anchorItemIDs) in turn,
+// passing over an anchor whose row filters empty.
+func (r *Reader) becauseYouWatchedRows(ctx context.Context, userID int, profileID, sourceItemID string, maxRows int, filter catalog.AccessFilter) ([]ForYouRow, error) {
+	if maxRows <= 0 || r.personalOff {
+		return nil, nil
+	}
 	sourceIDs := []string{}
 	if sourceItemID != "" {
 		sourceIDs = append(sourceIDs, sourceItemID)
 	} else {
-		recentCompleted, err := r.signalReader().RecentCompletedItemIDs(ctx, userID, profileID, 3)
+		anchors, err := anchorItemIDs(ctx, r.signalReader(), r.ratingsRepo, userID, profileID, BecauseYouWatchedAnchors)
 		if err != nil {
-			return nil, "", err
+			return nil, err
 		}
-		sourceIDs = append(sourceIDs, recentCompleted...)
+		sourceIDs = append(sourceIDs, anchors...)
 	}
 
+	read := r.newRowRead(userID, profileID, filter)
+	cached := false
+	var rows []ForYouRow
 	for _, sourceID := range sourceIDs {
+		if len(rows) >= maxRows {
+			break
+		}
 		items, err := r.repo.GetRecommendationCache(ctx, userID, profileID, RecTypeBecauseWatched, sourceID)
 		if err != nil {
-			return nil, "", err
+			return nil, err
 		}
 		if len(items) == 0 {
 			continue
 		}
-		rows, err := r.filterRows(ctx, userID, profileID, []ForYouRow{{
-			Type:  RecTypeBecauseWatched,
-			Label: "Because You Watched",
-			Items: items,
-		}}, filter)
+		cached = true
+		filtered, err := read.filter(ctx, []ForYouRow{{
+			Type:         RecTypeBecauseWatched,
+			Label:        becauseYouWatchedRowLabel,
+			Items:        items,
+			AnchorItemID: sourceID,
+		}})
 		if err != nil {
-			return nil, "", err
-		}
-		rows = trimRows(rows, limit)
-		if len(rows) == 0 {
-			return []ScoredItem{}, "", nil
+			return nil, err
 		}
-		return rows[0].Items, sourceID, nil
+		// A row filtered empty, everything it recommends out of reach or out
+		// of scope, gives way to the next anchor.
+		rows = append(rows, filtered...)
 	}
 
-	if r.refresh != nil {
-		r.refresh.RequestProfileRefresh(ctx, userID, profileID)
+	// Rows are built only for completed titles, so a profile with none has
+	// nothing a refresh could add, and a refresh does not bring back what
+	// filtering removed from a cached row.
+	if len(sourceIDs) > 0 && !cached {
+		r.requestRefresh(ctx, userID, profileID)
 	}
-	return []ScoredItem{}, "", nil
+	return rows, nil
 }
 
-// GetTasteMatchRow returns the strongest matching personalized cluster row for a genre,
-// falling back to the global genre sampler when no personalized cluster matches.
-// An empty genre auto-picks: every taste cluster qualifies (strongest first),
-// and the global fallback uses the server-wide top genre.
-func (r *Reader) GetTasteMatchRow(ctx context.Context, userID int, profileID, genre string, limit int, filter catalog.AccessFilter) (*ForYouRow, error) {
-	limit = normalizeRecommendationLimit(limit)
+// scopeToLibraries narrows filter so an item must also be in one of
+// libraryIDs (see catalog.AccessFilter.LibraryScope), unless libraryIDs is
+// nil. An empty libraryIDs allows nothing, where LibraryScope would read it as
+// every library.
+func scopeToLibraries(filter catalog.AccessFilter, libraryIDs []int) catalog.AccessFilter {
+	if libraryIDs == nil {
+		return filter
+	}
+	scoped := filter
+	scoped.AllowedLibraryIDs = []int{}
+	if ids, none := filter.LibraryScope(libraryIDs); len(libraryIDs) > 0 && !none {
+		scoped.AllowedLibraryIDs = ids
+	}
+	return scoped
+}
 
-	clusters, err := r.repo.GetTasteClusters(ctx, userID, profileID)
-	if err != nil {
-		return nil, err
+// SectionTasteMatchRow returns the strongest matching personalized cluster
+// row for a genre for a home or library section, falling back to the global
+// genre sampler when no personalized cluster matches. An empty genre
+// auto-picks: every taste cluster qualifies (strongest first), and the global
+// fallback uses the server-wide top genre.
+func (r *Reader) SectionTasteMatchRow(ctx context.Context, userID int, profileID, genre string, filter catalog.AccessFilter) (*ForYouRow, error) {
+	var clusters []TasteCluster
+	if !r.personalOff {
+		var err error
+		if clusters, err = r.repo.GetTasteClusterMeta(ctx, userID, profileID); err != nil {
+			return nil, err
+		}
 	}
 
 	matching := make([]TasteCluster, 0, len(clusters))
@@ -193,23 +435,26 @@ func (r *Reader) GetTasteMatchRow(ctx context.Context, userID int, profileID, ge
 		return matching[i].TotalWeight > matching[j].TotalWeight
 	})
 
+	read := r.newRowRead(userID, profileID, filter)
 	for _, cluster := range matching {
 		items, err := r.repo.GetRecommendationCache(ctx, userID, profileID, RecTypeForYouClusterPrefix+itoa(cluster.ClusterIdx), "")
 		if err != nil {
 			return nil, err
 		}
 		if len(items) == 0 {
-			if r.refresh != nil {
-				r.refresh.RequestProfileRefresh(ctx, userID, profileID)
+			// A row cached empty was built; only a missing one needs a
+			// refresh.
+			if items == nil {
+				r.requestRefresh(ctx, userID, profileID)
 			}
 			continue
 		}
 
-		rows, err := r.filterRows(ctx, userID, profileID, []ForYouRow{clusterRow(cluster, items)}, filter)
+		rows, err := read.filter(ctx, []ForYouRow{clusterRow(cluster, items)})
 		if err != nil {
 			return nil, err
 		}
-		rows = trimRows(rows, limit)
+		rows = trimRows(read.rotatePersonalRows(rows), CacheCandidateLimit)
 		if len(rows) == 0 {
 			// This cluster's cached items were entirely filtered out (e.g.
 			// access restrictions) — try the next-strongest cluster instead of
@@ -220,11 +465,10 @@ func (r *Reader) GetTasteMatchRow(ctx context.Context, userID int, profileID, ge
 	}
 
 	if genre == "" {
-		topGenres, err := r.repo.GetTopGenres(ctx, 1)
-		if err != nil || len(topGenres) == 0 {
+		var err error
+		if genre, err = r.repo.TopGenre(ctx); err != nil || genre == "" {
 			return nil, err
 		}
-		genre = topGenres[0]
 	}
 
 	items, err := r.repo.GetRecommendationCache(ctx, GlobalCacheUserID, GlobalCacheProfileID, RecTypeGenreSamplerPrefix+genre, "")
@@ -234,103 +478,194 @@ func (r *Reader) GetTasteMatchRow(ctx context.Context, userID int, profileID, ge
 	if len(items) == 0 {
 		return nil, nil
 	}
-	rows, err := r.filterRows(ctx, userID, profileID, []ForYouRow{{
-		Type:  "genre_sampler",
-		Label: "Top " + genre,
+	rows, err := read.filter(ctx, []ForYouRow{{
+		Type:  genreSamplerRowType,
+		Label: genreRowLabel(genre),
 		Items: items,
-	}}, filter)
+	}})
 	if err != nil {
 		return nil, err
 	}
-	rows = trimRows(rows, limit)
+	rows = trimRows(rows, CacheCandidateLimit)
 	if len(rows) == 0 {
 		return nil, nil
 	}
 	return &rows[0], nil
 }
 
-func (r *Reader) getForYouPageRows(ctx context.Context, userID int, profileID string, filter catalog.AccessFilter) ([]ForYouRow, bool, error) {
-	level := 0
+// getForYouPageRows merges the profile's cached personal rows with the global
+// rows by its cold-start level. A profile with no positive title, or no taste
+// profile, is level 0 and gets only the global rows, even when personal rows
+// from an earlier taste profile are still cached. The personal rows are
+// rotated for a served window of ServedRowSize items (see rotateTail), and a
+// cluster row whose title a heavier one already has is told apart or hidden
+// (see distinguishClusterRows). The rows are not trimmed.
+//
+// The served window does not follow the read's limit: a page of any limit,
+// Discover and a row's see-all page then agree on each row's order and on
+// which rows are hidden.
+func (r *Reader) getForYouPageRows(ctx context.Context, userID int, profileID string, filter catalog.AccessFilter) ([]ForYouRow, error) {
+	return r.newRowRead(userID, profileID, filter).forYouPageRows(ctx, false)
+}
+
+// forYouPageRows is getForYouPageRows for this read. With liveDefaults the
+// global rows are the cached Popular row and the live default rows (see
+// defaultRows) rather than the cached Recently Added row.
+func (rr *rowRead) forYouPageRows(ctx context.Context, liveDefaults bool) ([]ForYouRow, error) {
+	r, userID, profileID := rr.reader, rr.userID, rr.profileID
+	if r.personalOff {
+		globalRows, err := rr.globalRows(ctx, liveDefaults)
+		if err != nil {
+			return nil, err
+		}
+		return rr.filter(ctx, globalRows)
+	}
 	meta, err := r.repo.GetTasteProfileMeta(ctx, userID, profileID)
 	if err != nil {
-		return nil, false, err
-	}
-	if meta != nil {
-		positiveSignals := 0
-		for key, count := range meta.SignalCounts {
-			switch key {
-			case "rated_low", "watch_low":
-			default:
-				positiveSignals += count
-			}
-		}
-		level = coldStartLevel(positiveSignals)
+		return nil, err
 	}
+	level := coldStartLevelOf(meta)
 
-	globalRows, err := r.getGlobalRows(ctx)
+	globalRows, err := rr.globalRows(ctx, liveDefaults)
 	if err != nil {
-		return nil, false, err
+		return nil, err
 	}
 
-	clusterRows, missingClusters, err := r.getClusterRows(ctx, userID, profileID)
+	clusters, clusterRows, missingClusters, err := r.getClusterRows(ctx, userID, profileID)
 	if err != nil {
-		return nil, false, err
+		return nil, err
 	}
 
 	personalRows := make([]ForYouRow, 0, 1+len(clusterRows))
 	mainItems, err := r.repo.GetRecommendationCache(ctx, userID, profileID, RecTypeForYouMain, "")
 	if err != nil {
-		return nil, false, err
+		return nil, err
 	}
-	missingPersonalized := level > 0 && (len(mainItems) == 0 || missingClusters)
+	// Positive signals without personal rows ask for them even at level 0:
+	// titles that had no embedding at the last refresh may have one now.
+	// A main row cached empty was built (every interest turned away).
+	missingPersonalized := positiveSignalCount(meta) > 0 && (mainItems == nil || missingClusters)
 	if len(mainItems) > 0 {
 		personalRows = append(personalRows, ForYouRow{
-			Type:  "cluster",
-			Label: "For You",
-			Items: mainItems,
+			Type:        clusterRowType,
+			Label:       ForYouLabel,
+			Items:       mainItems,
+			personalKey: RecTypeForYouMain,
 		})
 	}
 	personalRows = append(personalRows, clusterRows...)
-	if level == 0 && len(personalRows) > 0 {
-		level = 3
-	}
 
 	rows := mergePersonalizedAndColdStart(personalRows, globalRows, level)
-	rows, err = r.filterRows(ctx, userID, profileID, rows, filter)
+	rows, err = rr.filter(ctx, rows)
 	if err != nil {
-		return nil, false, err
+		return nil, err
 	}
+	// A hidden cluster row was built, so it does not count as missing.
+	rows = distinguishClusterRows(rr.rotatePersonalRows(rows), clusters)
 
-	if missingPersonalized && r.refresh != nil {
-		r.refresh.RequestProfileRefresh(ctx, userID, profileID)
+	switch {
+	case missingPersonalized:
+		r.requestRefresh(ctx, userID, profileID)
+	case meta == nil:
+		r.requestRefreshIfSignals(ctx, userID, profileID)
 	}
 
-	return rows, missingPersonalized, nil
+	return rows, nil
 }
 
-func (r *Reader) getGlobalRows(ctx context.Context) ([]ForYouRow, error) {
-	popular, err := r.repo.GetRecommendationCache(ctx, GlobalCacheUserID, GlobalCacheProfileID, RecTypePopular, "")
+// globalRows reads the rows every profile is offered: the cached Popular
+// row, then the cached Recently Added row or, with liveDefaults, the live
+// default rows. The rows are not yet filtered for the viewer.
+func (rr *rowRead) globalRows(ctx context.Context, liveDefaults bool) ([]ForYouRow, error) {
+	repo := rr.reader.repo
+	popular, err := repo.GetRecommendationCache(ctx, GlobalCacheUserID, GlobalCacheProfileID, RecTypePopular, "")
 	if err != nil {
 		return nil, err
 	}
-	recentlyAdded, err := r.repo.GetRecommendationCache(ctx, GlobalCacheUserID, GlobalCacheProfileID, RecTypeRecentlyAdded, "")
+	if liveDefaults {
+		defaults, err := rr.defaultRows(ctx, CacheCandidateLimit)
+		if err != nil {
+			return nil, err
+		}
+		return append(buildColdStartRows(popular, nil, nil), defaults...), nil
+	}
+	recentlyAdded, err := repo.GetRecommendationCache(ctx, GlobalCacheUserID, GlobalCacheProfileID, RecTypeRecentlyAdded, "")
 	if err != nil {
 		return nil, err
 	}
-	topRated, err := r.repo.GetRecommendationCache(ctx, GlobalCacheUserID, GlobalCacheProfileID, RecTypeTopRated, "")
+	return buildColdStartRows(popular, recentlyAdded, nil), nil
+}
+
+// The live default rows are titles the viewer can see and has not watched or
+// favorited, queried at read time rather than cached, so they show on a
+// fresh server, with recommendations disabled, and for a restricted profile
+// the global cache holds little for. Discover and the section pages serve
+// them; home and library sections do not, as a library has its own shelves.
+// defaultRowKinds lists them in display order: a quality ranking first, since
+// a freshly imported library's additions are in scan order.
+var defaultRowKinds = []string{RecTypeTopRated, RecTypeRecentlyAdded}
+
+// defaultRows reads the live default rows of up to limit items each,
+// dropping empty ones. Like the cached rows, they are not yet filtered.
+func (rr *rowRead) defaultRows(ctx context.Context, limit int) ([]ForYouRow, error) {
+	rows := make([]ForYouRow, 0, len(defaultRowKinds))
+	for _, kind := range defaultRowKinds {
+		row, err := rr.defaultRow(ctx, kind, limit)
+		if err != nil {
+			return nil, err
+		}
+		if len(row.Items) > 0 {
+			rows = append(rows, row)
+		}
+	}
+	return rows, nil
+}
+
+// defaultRow reads one live default row, RecTypeTopRated or
+// RecTypeRecentlyAdded, leaving out the profile's exclusion set and every
+// title it rated in the query, so the row fills past them rather than losing
+// them to the filter afterwards. The row holds series, so a rated episode
+// leaves out its series, as it does from the rows the worker builds.
+func (rr *rowRead) defaultRow(ctx context.Context, kind string, limit int) (ForYouRow, error) {
+	excluded, err := rr.exclusionSet(ctx)
+	if err != nil {
+		return ForYouRow{}, err
+	}
+	if rr.excludedIDs == nil {
+		rated, err := rr.ratedSet(ctx)
+		if err != nil {
+			return ForYouRow{}, err
+		}
+		rr.excludedIDs = make([]string, 0, len(excluded)+len(rated))
+		for id := range excluded {
+			rr.excludedIDs = append(rr.excludedIDs, id)
+		}
+		for id := range rated {
+			if _, dup := excluded[id]; !dup {
+				rr.excludedIDs = append(rr.excludedIDs, id)
+			}
+		}
+	}
+	items, err := rr.reader.repo.ListDefaultRowItems(ctx, rr.access, kind, rr.excludedIDs, limit)
 	if err != nil {
-		return nil, err
+		return ForYouRow{}, err
 	}
-	return buildColdStartRows(popular, recentlyAdded, topRated, map[string][]ScoredItem{}), nil
+	label := recentlyAddedLabel
+	if kind == RecTypeTopRated {
+		label = highlyRatedLabel
+	}
+	return ForYouRow{Type: kind, Label: label, Items: items}, nil
 }
 
-func (r *Reader) getClusterRows(ctx context.Context, userID int, profileID string) ([]ForYouRow, bool, error) {
-	clusters, err := r.repo.GetTasteClusters(ctx, userID, profileID)
+// getClusterRows reads the profile's clusters and their cached rows, and
+// reports whether a cluster has no cached row.
+func (r *Reader) getClusterRows(ctx context.Context, userID int, profileID string) ([]TasteCluster, []ForYouRow, bool, error) {
+	clusters, err := r.repo.GetTasteClusterMeta(ctx, userID, profileID)
 	if err != nil {
-		return nil, false, err
+		return nil, nil, false, err
 	}
 	if len(clusters) == 0 {
-		return []ForYouRow{}, false, nil
+		return nil, []ForYouRow{}, false, nil
 	}
 
 	rows := make([]ForYouRow, 0, len(clusters))
@@ -338,36 +673,243 @@ func (r *Reader) getClusterRows(ctx context.Context, userID int, profileID strin
 	for _, cluster := range clusters {
 		items, err := r.repo.GetRecommendationCache(ctx, userID, profileID, RecTypeForYouClusterPrefix+itoa(cluster.ClusterIdx), "")
 		if err != nil {
-			return nil, false, err
+			return nil, nil, false, err
 		}
 		if len(items) == 0 {
-			missing = true
+			// A row cached empty (the main row took its titles) was built;
+			// only a missing one is.
+			missing = missing || items == nil
 			continue
 		}
 		rows = append(rows, clusterRow(cluster, items))
 	}
-	return rows, missing, nil
+	return clusters, rows, missing, nil
 }
 
+// clusterRow titles a cached cluster row from its items, which carry the title
+// of the build that cached them; the cluster table may have been rebuilt since.
+// Items cached without a cluster title fall back to the cluster's label.
 func clusterRow(cluster TasteCluster, items []ScoredItem) ForYouRow {
-	label := cluster.Label
-	if label == "" {
-		label = "For You"
+	title := clusterTitle(cluster.Label)
+	if len(items) > 0 {
+		if _, ok := clusterTitleLabel(items[0].Reason); ok {
+			title = items[0].Reason
+		}
 	}
 	return ForYouRow{
-		Type:         "cluster",
-		Label:        "Because you enjoy " + label,
+		Type:         clusterRowType,
+		Label:        title,
 		ClusterIndex: cluster.ClusterIdx,
 		Items:        items,
+		Subject:      clusterSubject(title),
+		personalKey:  RecTypeForYouClusterPrefix + itoa(cluster.ClusterIdx),
+	}
+}
+
+// clusterSubject is the genre label a cluster row titled title is about: the
+// title without its prefix. It is "" for a cluster whose label names no
+// genre.
+func clusterSubject(title string) string {
+	label, _ := clusterTitleLabel(title)
+	return label
+}
+
+// clusterRepeatJaccard is the overlap of two same-titled cluster rows' served
+// items, as a Jaccard index, above which the lighter row is a repeat.
+const clusterRepeatJaccard = 0.5
+
+// distinguishClusterRows keeps two cluster rows from sharing a title. Rows
+// are visited heaviest cluster first; a row titled like a heavier one is
+// hidden when their first served items overlap by more than
+// clusterRepeatJaccard, and otherwise renamed with the first of its
+// cluster's dominant genres its title does not name yet. A row whose cluster
+// has no such genre, or whose cached title its cluster no longer has (the
+// clusters were rebuilt after the row was cached), keeps its title. Other
+// rows, and the order of every row kept, are unchanged.
+func distinguishClusterRows(rows []ForYouRow, clusters []TasteCluster) []ForYouRow {
+	byIndex := make(map[int]TasteCluster, len(clusters))
+	for _, c := range clusters {
+		byIndex[c.ClusterIdx] = c
+	}
+	var order []int
+	for i, row := range rows {
+		if strings.HasPrefix(row.personalKey, RecTypeForYouClusterPrefix) {
+			order = append(order, i)
+		}
+	}
+	if len(order) < 2 {
+		return rows
+	}
+	slices.SortStableFunc(order, func(a, b int) int {
+		return cmp.Compare(byIndex[rows[b].ClusterIndex].TotalWeight, byIndex[rows[a].ClusterIndex].TotalWeight)
+	})
+
+	hidden := make(map[int]bool)
+	var kept []int
+	for _, i := range order {
+		same := slices.IndexFunc(kept, func(k int) bool { return rows[k].Label == rows[i].Label })
+		if same >= 0 {
+			if servedJaccard(rows[i].Items, rows[kept[same]].Items, ServedRowSize) > clusterRepeatJaccard {
+				hidden[i] = true
+				continue
+			}
+			renameClusterRow(&rows[i], byIndex[rows[i].ClusterIndex], rows, kept)
+		}
+		kept = append(kept, i)
+	}
+	if len(hidden) == 0 {
+		return rows
+	}
+	out := make([]ForYouRow, 0, len(rows)-len(hidden))
+	for i, row := range rows {
+		if !hidden[i] {
+			out = append(out, row)
+		}
+	}
+	return out
+}
+
+// renameClusterRow adds to row's title the first of cluster's dominant
+// genres the title does not name yet that leaves it unlike every title in
+// kept, when there is one. The items' reasons take the new title too.
+func renameClusterRow(row *ForYouRow, cluster TasteCluster, rows []ForYouRow, kept []int) {
+	label, ok := clusterTitleLabel(row.Label)
+	if !ok || label == "" || clusterTitle(cluster.Label) != row.Label {
+		return
+	}
+	named := strings.Split(label, clusterLabelSeparator)
+	for _, genre := range cluster.DominantGenres {
+		if slices.Contains(named, genre) {
+			continue
+		}
+		title := clusterTitle(label + clusterLabelSeparator + genre)
+		if slices.ContainsFunc(kept, func(k int) bool { return rows[k].Label == title }) {
+			continue
+		}
+		row.Label, row.Subject = title, clusterSubject(title)
+		items := slices.Clone(row.Items)
+		for i := range items {
+			items[i].Reason = title
+		}
+		row.Items = items
+		return
+	}
+}
+
+// asServed gives a personal row read for its see-all page the title and
+// order Discover and the For You rows give it: distinguishClusterRows may
+// rename it by the profile's other cluster rows, and the day's rotation
+// reorders its served window, so the cached row alone does not say. A row
+// those reads do not show, such as one hidden as a repeat, keeps its cached
+// title and order.
+func (rr *rowRead) asServed(ctx context.Context, row *ForYouRow) error {
+	// The page rows as Discover reads them; the default rows it adds do not
+	// change a personal row.
+	rows, err := rr.forYouPageRows(ctx, false)
+	if err != nil {
+		return err
+	}
+	for _, served := range rows {
+		if served.personalKey == row.personalKey {
+			row.Label, row.Subject, row.Items = served.Label, served.Subject, served.Items
+			break
+		}
+	}
+	return nil
+}
+
+// servedJaccard is the Jaccard index of the first served items of a and b.
+func servedJaccard(a, b []ScoredItem, served int) float64 {
+	a, b = a[:min(len(a), served)], b[:min(len(b), served)]
+	in := make(map[string]struct{}, len(a))
+	for _, item := range a {
+		in[item.MediaItemID] = struct{}{}
+	}
+	shared := 0
+	for _, item := range b {
+		if _, ok := in[item.MediaItemID]; ok {
+			shared++
+		}
+	}
+	union := len(a) + len(b) - shared
+	if union == 0 {
+		return 0
 	}
+	return float64(shared) / float64(union)
 }
 
+// filterRows drops from rows the items the profile cannot access, those not of
+// recommendableMediaTypes, those in its recommendation exclusion set (watched
+// and favorited titles), and those it rated, then drops the rows left empty.
+// Rows cached before a title was watched, favorited or rated, or before rows
+// were kept to recommendableMediaTypes, are cleaned here.
 func (r *Reader) filterRows(ctx context.Context, userID int, profileID string, rows []ForYouRow, filter catalog.AccessFilter) ([]ForYouRow, error) {
+	return r.newRowRead(userID, profileID, filter).filter(ctx, rows)
+}
+
+// rowRead filters the rows one request reads for a profile. The profile's
+// exclusion set is loaded once, on first use, however many rows, anchors or
+// clusters the request goes through.
+type rowRead struct {
+	reader    *Reader
+	userID    int
+	profileID string
+	access    catalog.AccessFilter
+	excluded  map[string]struct{}
+	// rated is every title the profile rated, a rated episode as its series,
+	// loaded on first use.
+	rated map[string]struct{}
+	// excludedIDs is what a live row leaves out as a list, built when one
+	// needs it.
+	excludedIDs []string
+}
+
+func (r *Reader) newRowRead(userID int, profileID string, access catalog.AccessFilter) *rowRead {
+	return &rowRead{reader: r, userID: userID, profileID: profileID, access: access}
+}
+
+// exclusionSet is the profile's recommendation exclusion set, loaded on
+// first use.
+func (rr *rowRead) exclusionSet(ctx context.Context) (map[string]struct{}, error) {
+	if rr.excluded == nil {
+		excluded, err := rr.reader.signalReader().RecommendationExclusionSet(ctx, rr.userID, rr.profileID)
+		if err != nil {
+			return nil, err
+		}
+		if excluded == nil {
+			excluded = map[string]struct{}{}
+		}
+		rr.excluded = excluded
+	}
+	return rr.excluded, nil
+}
+
+// ratedSet is every title the profile rated, a rated episode as its series.
+func (rr *rowRead) ratedSet(ctx context.Context) (map[string]struct{}, error) {
+	if rr.rated == nil {
+		ratedIDs, err := rr.reader.repo.ListRatedItemIDs(ctx, rr.userID, rr.profileID)
+		if err != nil {
+			return nil, err
+		}
+		rated := map[string]struct{}{}
+		if len(ratedIDs) > 0 {
+			if rated, err = rr.reader.signalReader().canonicalRatedItemIDs(ctx, ratedIDs); err != nil {
+				return nil, err
+			}
+		}
+		rr.rated = rated
+	}
+	return rr.rated, nil
+}
+
+// filter is filterRows for this read.
+func (rr *rowRead) filter(ctx context.Context, rows []ForYouRow) ([]ForYouRow, error) {
 	if len(rows) == 0 {
 		return rows, nil
 	}
+	r, userID, profileID := rr.reader, rr.userID, rr.profileID
 
-	watchedSet, err := r.signalReader().WatchedItemIDSet(ctx, userID, profileID)
+	excluded, err := rr.exclusionSet(ctx)
 	if err != nil {
 		return nil, err
 	}
@@ -379,18 +921,23 @@ func (r *Reader) filterRows(ctx context.Context, userID int, profileID string, r
 		}
 	}
 
-	lowRatings := map[string]int{}
+	rated := map[string]int{}
+	// ratedSeries holds the series of the episodes the profile rated: cached
+	// rows hold series, and a rating since the build leaves its series out.
+	var ratedSeries map[string]struct{}
 	if len(itemIDs) > 0 && r.ratingsRepo != nil {
-		lowRatings, err = r.ratingsRepo.ListForItems(ctx, userID, profileID, itemIDs)
+		rated, err = r.ratingsRepo.ListForItems(ctx, userID, profileID, itemIDs)
 		if err != nil {
 			return nil, err
 		}
+		if ratedSeries, err = rr.ratedSet(ctx); err != nil {
+			return nil, err
+		}
 	}
 
 	accessible := map[string]struct{}{}
 	if len(itemIDs) > 0 {
-		var err error
-		accessible, err = r.repo.FilterAccessibleItemIDs(ctx, itemIDs, filter)
+		accessible, err = r.repo.FilterRecommendableItemIDs(ctx, itemIDs, rr.access)
 		if err != nil {
 			return nil, err
 		}
@@ -403,10 +950,13 @@ func (r *Reader) filterRows(ctx context.Context, userID int, profileID string, r
 			if _, ok := accessible[item.MediaItemID]; !ok {
 				continue
 			}
-			if _, watched := watchedSet[item.MediaItemID]; watched {
+			if _, skip := excluded[item.MediaItemID]; skip {
+				continue
+			}
+			if _, ok := rated[item.MediaItemID]; ok {
 				continue
 			}
-			if rating, rated := lowRatings[item.MediaItemID]; rated && rating <= 2 {
+			if _, ok := ratedSeries[item.MediaItemID]; ok {
 				continue
 			}
 			filteredItems = append(filteredItems, item)
@@ -422,36 +972,39 @@ func (r *Reader) filterRows(ctx context.Context, userID int, profileID string, r
 }
 
 // GetDiscoverRows assembles all rows for the discover/recommendations page.
-// It combines personalized for-you rows, similar-users, and random genre-based
-// popular rows. All data is read from cache — no live aggregation queries.
+// It combines personalized for-you rows, the live default rows,
+// similar-users, and daily genre rows. Every row but the default rows is read
+// from cache. A row shows an item no earlier row shows.
 func (r *Reader) GetDiscoverRows(ctx context.Context, userID int, profileID string, limit int, filter catalog.AccessFilter) ([]ForYouRow, error) {
 	limit = normalizeRecommendationLimit(limit)
+	read := r.newRowRead(userID, profileID, filter)
 
 	// 1. For-you rows (personalized + cold-start blended, already filtered).
-	forYouRows, _, err := r.getForYouPageRows(ctx, userID, profileID, filter)
+	forYouRows, err := read.forYouPageRows(ctx, true)
 	if err != nil {
 		return nil, err
 	}
 
-	// Track seen items for cross-row deduplication.
+	// Track shown items for cross-row deduplication.
 	seen := make(map[string]struct{})
 	for i := range forYouRows {
-		forYouRows[i].Items = deduplicateItems(forYouRows[i].Items, seen)
+		forYouRows[i].Items = deduplicateItems(forYouRows[i].Items, seen, limit)
 	}
-	forYouRows = trimRows(forYouRows, limit)
 	// Drop rows emptied by dedup.
 	forYouRows = dropEmptyRows(forYouRows)
 
 	// 2. Similar users row.
 	var extraRows []ForYouRow
-	similarItems, err := r.repo.GetRecommendationCache(ctx, userID, profileID, RecTypeSimilarUsersLiked, "")
-	if err != nil {
-		return nil, err
+	var similarItems []ScoredItem
+	if !r.personalOff {
+		if similarItems, err = r.repo.GetRecommendationCache(ctx, userID, profileID, RecTypeSimilarUsersLiked, ""); err != nil {
+			return nil, err
+		}
 	}
 	if len(similarItems) > 0 {
 		extraRows = append(extraRows, ForYouRow{
-			Type:  "similar_users_liked",
-			Label: "Users Like You Also Enjoyed",
+			Type:  RecTypeSimilarUsersLiked,
+			Label: similarUsersLabel,
 			Items: similarItems,
 		})
 	}
@@ -462,11 +1015,16 @@ func (r *Reader) GetDiscoverRows(ctx context.Context, userID int, profileID stri
 		return nil, err
 	}
 	if len(genreSamplers) > 0 {
-		// Exclude genres that overlap with the user's taste clusters.
+		// Exclude genres that overlap with the user's taste clusters, unless
+		// personal rows are off: the page is then not shaped by taste.
 		excludeGenres := make(map[string]struct{})
-		clusters, clusterErr := r.repo.GetTasteClusters(ctx, userID, profileID)
-		if clusterErr != nil {
-			slog.WarnContext(ctx, "GetDiscoverRows: failed to load taste clusters for genre exclusion", "component", "recommendations", "user_id", userID, "profile_id", profileID, "error", clusterErr)
+		var clusters []TasteCluster
+		if !r.personalOff {
+			var clusterErr error
+			clusters, clusterErr = r.repo.GetTasteClusterMeta(ctx, userID, profileID)
+			if clusterErr != nil {
+				slog.WarnContext(ctx, "GetDiscoverRows: failed to load taste clusters for genre exclusion", "component", "recommendations", "user_id", userID, "profile_id", profileID, "error", clusterErr)
+			}
 		}
 		for _, c := range clusters {
 			for _, g := range c.DominantGenres {
@@ -486,22 +1044,21 @@ func (r *Reader) GetDiscoverRows(ctx context.Context, userID int, profileID stri
 		for _, genre := range selected {
 			items := genreSamplers[genre]
 			extraRows = append(extraRows, ForYouRow{
-				Type:  "genre_sampler",
-				Label: "Popular in " + genre,
+				Type:  genreSamplerRowType,
+				Label: genreRowLabel(genre),
 				Items: items,
 			})
 		}
 	}
 
-	// Filter extra rows (watched + low-rated) and deduplicate across all rows.
-	extraRows, err = r.filterRows(ctx, userID, profileID, extraRows, filter)
+	// Filter extra rows (excluded + low-rated) and deduplicate across all rows.
+	extraRows, err = read.filter(ctx, extraRows)
 	if err != nil {
 		return nil, err
 	}
 	for i := range extraRows {
-		extraRows[i].Items = deduplicateItems(extraRows[i].Items, seen)
+		extraRows[i].Items = deduplicateItems(extraRows[i].Items, seen, limit)
 	}
-	extraRows = trimRows(extraRows, limit)
 	extraRows = dropEmptyRows(extraRows)
 
 	// Interleave: for-you rows first, then genre rows woven after every 2 for-you rows,
@@ -510,7 +1067,7 @@ func (r *Reader) GetDiscoverRows(ctx context.Context, userID int, profileID stri
 	var genreRows []ForYouRow
 	var similarRow *ForYouRow
 	for i := range extraRows {
-		if extraRows[i].Type == "similar_users_liked" {
+		if extraRows[i].Type == RecTypeSimilarUsersLiked {
 			similarRow = &extraRows[i]
 		} else {
 			genreRows = append(genreRows, extraRows[i])
@@ -552,13 +1109,33 @@ func (r *Reader) GetSection(
 	if limit <= 0 || limit > CacheCandidateLimit {
 		limit = CacheCandidateLimit
 	}
+	read := r.newRowRead(userID, profileID, filter)
 
-	row, err := r.loadSectionRow(ctx, userID, profileID, kind, key)
+	var row *ForYouRow
+	var err error
+	switch kind {
+	case SectionKindTopRated, SectionKindRecentlyAdded:
+		// The live default rows, as Discover shows them.
+		recType := RecTypeRecentlyAdded
+		if kind == SectionKindTopRated {
+			recType = RecTypeTopRated
+		}
+		var live ForYouRow
+		live, err = read.defaultRow(ctx, recType, limit)
+		row = &live
+	case SectionKindCluster, SectionKindForYouMain:
+		row, err = r.loadSectionRow(ctx, userID, profileID, kind, key)
+		if err == nil && row != nil {
+			err = read.asServed(ctx, row)
+		}
+	default:
+		row, err = r.loadSectionRow(ctx, userID, profileID, kind, key)
+	}
 	if err != nil || row == nil {
 		return nil, err
 	}
 
-	rows, err := r.filterRows(ctx, userID, profileID, []ForYouRow{*row}, filter)
+	rows, err := read.filter(ctx, []ForYouRow{*row})
 	if err != nil {
 		return nil, err
 	}
@@ -573,20 +1150,26 @@ func (r *Reader) GetSection(
 }
 
 func (r *Reader) loadSectionRow(ctx context.Context, userID int, profileID, kind, key string) (*ForYouRow, error) {
+	if r.personalOff {
+		switch kind {
+		case SectionKindForYouMain, SectionKindCluster, SectionKindSimilarUsers:
+			return nil, nil
+		}
+	}
 	switch kind {
 	case SectionKindForYouMain:
 		items, err := r.repo.GetRecommendationCache(ctx, userID, profileID, RecTypeForYouMain, "")
 		if err != nil || len(items) == 0 {
 			return nil, err
 		}
-		return &ForYouRow{Type: "cluster", Label: "For You", Items: items}, nil
+		return &ForYouRow{Type: clusterRowType, Label: ForYouLabel, Items: items, personalKey: RecTypeForYouMain}, nil
 
 	case SectionKindCluster:
 		idx, err := strconv.Atoi(key)
 		if err != nil {
 			return nil, fmt.Errorf("invalid cluster index %q: %w", key, err)
 		}
-		clusters, err := r.repo.GetTasteClusters(ctx, userID, profileID)
+		clusters, err := r.repo.GetTasteClusterMeta(ctx, userID, profileID)
 		if err != nil {
 			return nil, err
 		}
@@ -613,8 +1196,8 @@ func (r *Reader) loadSectionRow(ctx context.Context, userID int, profileID, kind
 			return nil, err
 		}
 		return &ForYouRow{
-			Type:  "similar_users_liked",
-			Label: "Users Like You Also Enjoyed",
+			Type:  RecTypeSimilarUsersLiked,
+			Label: similarUsersLabel,
 			Items: items,
 		}, nil
 
@@ -623,21 +1206,7 @@ func (r *Reader) loadSectionRow(ctx context.Context, userID int, profileID, kind
 		if err != nil || len(items) == 0 {
 			return nil, err
 		}
-		return &ForYouRow{Type: RecTypePopular, Label: "Popular on This Server", Items: items}, nil
-
-	case SectionKindRecentlyAdded:
-		items, err := r.repo.GetRecommendationCache(ctx, GlobalCacheUserID, GlobalCacheProfileID, RecTypeRecentlyAdded, "")
-		if err != nil || len(items) == 0 {
-			return nil, err
-		}
-		return &ForYouRow{Type: RecTypeRecentlyAdded, Label: "Recently Added", Items: items}, nil
-
-	case SectionKindTopRated:
-		items, err := r.repo.GetRecommendationCache(ctx, GlobalCacheUserID, GlobalCacheProfileID, RecTypeTopRated, "")
-		if err != nil || len(items) == 0 {
-			return nil, err
-		}
-		return &ForYouRow{Type: RecTypeTopRated, Label: "Top Rated", Items: items}, nil
+		return &ForYouRow{Type: RecTypePopular, Label: popularLabel, Items: items}, nil
 
 	case SectionKindGenre:
 		if key == "" {
@@ -647,12 +1216,19 @@ func (r *Reader) loadSectionRow(ctx context.Context, userID int, profileID, kind
 		if err != nil || len(items) == 0 {
 			return nil, err
 		}
-		return &ForYouRow{Type: "genre_sampler", Label: "Popular in " + key, Items: items}, nil
+		return &ForYouRow{Type: genreSamplerRowType, Label: genreRowLabel(key), Items: items}, nil
 	}
 
 	return nil, nil
 }
 
+// Row types the API reports. clusterRowType is the type of the main row and
+// of every taste-cluster row; genreSamplerRowType of a genre row.
+const (
+	clusterRowType      = "cluster"
+	genreSamplerRowType = "genre_sampler"
+)
+
 // selectDailyGenres picks up to n genres from the available list using a
 // deterministic daily seed so the selection is stable within a day for a given profile.
 func selectDailyGenres(genres []string, profileID string, n int) []string {
@@ -688,11 +1264,20 @@ func selectDailyGenres(genres []string, profileID string, n int) []string {
 	return genres[:n]
 }
 
-// deduplicateItems removes items whose MediaItemID is already in the seen set,
-// and adds surviving items to the set.
-func deduplicateItems(items []ScoredItem, seen map[string]struct{}) []ScoredItem {
-	result := make([]ScoredItem, 0, len(items))
+// deduplicateItems keeps, in order, up to limit items whose MediaItemID is
+// not in the seen set (every one when limit is not positive), and adds only
+// the kept items to the set: items a row does not show stay free for later
+// rows.
+func deduplicateItems(items []ScoredItem, seen map[string]struct{}, limit int) []ScoredItem {
+	capacity := len(items)
+	if limit > 0 {
+		capacity = min(capacity, limit)
+	}
+	result := make([]ScoredItem, 0, capacity)
 	for _, item := range items {
+		if limit > 0 && len(result) == limit {
+			break
+		}
 		if _, ok := seen[item.MediaItemID]; ok {
 			continue
 		}
@@ -725,14 +1310,23 @@ func trimRows(rows []ForYouRow, limit int) []ForYouRow {
 	return rows
 }
 
+// Public row reads answer defaultRecommendationLimit items per row unless
+// asked for a positive limit, and at most maxRecommendationLimit, the v2
+// limit parameter's maximum.
+const (
+	defaultRecommendationLimit = ServedRowSize
+	maxRecommendationLimit     = 50
+)
+
+// MaxRowReadLimit is the most items a row read returns per row, whatever
+// limit it was asked for.
+const MaxRowReadLimit = maxRecommendationLimit
+
 func normalizeRecommendationLimit(limit int) int {
 	if limit <= 0 {
-		return 20
-	}
-	if limit > 20 {
-		return 20
+		return defaultRecommendationLimit
 	}
-	return limit
+	return min(limit, maxRecommendationLimit)
 }
 
 func itoa(v int) string {
diff --git a/internal/recommendations/reader_access_test.go b/internal/recommendations/reader_access_test.go
new file mode 100644
index 0000000000..8822701e97
--- /dev/null
+++ b/internal/recommendations/reader_access_test.go
@@ -0,0 +1,107 @@
+package recommendations
+
+import (
+	"slices"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+)
+
+// A built Similar Users row can be empty when too few accounts share the
+// profile's taste. Reading it must not queue a rebuild, which could not fill
+// it; only a row that was never built asks for one.
+func TestSimilarUsersReadRefreshesOnlyAMissingRow(t *testing.T) {
+	for _, tc := range []struct {
+		name          string
+		cached        map[string][]ScoredItem
+		wantRefreshes int
+	}{
+		{name: "built empty", cached: map[string][]ScoredItem{RecTypeSimilarUsersLiked + "|": {}}, wantRefreshes: 0},
+		{name: "never built", cached: map[string][]ScoredItem{}, wantRefreshes: 1},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			refresher := &countingReadRefresher{}
+			r := &Reader{repo: &fakeReaderRepo{personal: tc.cached}, refresh: refresher, signals: NewSignalReader(&fakeSignalRepo{}, nil)}
+			items, err := r.GetSimilarUsersLiked(t.Context(), 7, "p1", 20, catalog.AccessFilter{})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if items == nil || len(items) != 0 {
+				t.Fatalf("items = %#v, want an empty list", items)
+			}
+			if refresher.calls != tc.wantRefreshes {
+				t.Fatalf("refreshes = %d, want %d", refresher.calls, tc.wantRefreshes)
+			}
+		})
+	}
+}
+
+// GetForYouPage is the main row followed by the other rows, each filtered for
+// the viewer and trimmed to the limit.
+func TestGetForYouPageServesTheMainRowFirst(t *testing.T) {
+	repo := &fakeReaderRepo{
+		meta:     &TasteProfileMeta{SignalCounts: map[string]int{"watch_high": ColdStartFullPersonalized}},
+		clusters: []TasteCluster{{ClusterIdx: 0, Label: "Drama"}},
+		personal: map[string][]ScoredItem{
+			RecTypeForYouMain + "|":                {{MediaItemID: "main-1"}, {MediaItemID: "main-hidden"}, {MediaItemID: "main-2"}, {MediaItemID: "main-3"}},
+			RecTypeForYouClusterPrefix + "0" + "|": {{MediaItemID: "drama-hidden"}},
+		},
+		global: map[string][]ScoredItem{RecTypePopular: {{MediaItemID: "popular"}}},
+		hidden: map[string]struct{}{"main-hidden": {}, "drama-hidden": {}},
+	}
+	r := &Reader{repo: repo, signals: NewSignalReader(&fakeSignalRepo{}, nil)}
+
+	rows, err := r.GetForYouPage(t.Context(), 7, "p1", 2, catalog.AccessFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got, want := rowLabels(rows), []string{"For You", "Popular on This Server"}; !slices.Equal(got, want) {
+		t.Fatalf("rows = %v, want %v: the hidden-only Drama row drops out", got, want)
+	}
+	var main []string
+	for _, item := range rows[0].Items {
+		main = append(main, item.MediaItemID)
+	}
+	if want := []string{"main-1", "main-2"}; !slices.Equal(main, want) {
+		t.Fatalf("main row = %v, want %v", main, want)
+	}
+}
+
+// Rows cached before personal rows were kept to recommendableMediaTypes still
+// hold books until they are rebuilt. A read serves none of them, and a row
+// holding only books drops out.
+func TestReadsServeOnlyRecommendableMediaTypes(t *testing.T) {
+	repo := &fakeReaderRepo{
+		meta:     &TasteProfileMeta{SignalCounts: map[string]int{"watch_high": ColdStartFullPersonalized}},
+		clusters: []TasteCluster{{ClusterIdx: 0, Label: "Drama"}},
+		personal: map[string][]ScoredItem{
+			RecTypeForYouMain + "|":                {{MediaItemID: "audiobook"}, {MediaItemID: "movie"}, {MediaItemID: "ebook"}, {MediaItemID: "series"}},
+			RecTypeForYouClusterPrefix + "0" + "|": {{MediaItemID: "audiobook-2"}},
+			RecTypeSimilarUsersLiked + "|":         {{MediaItemID: "ebook"}, {MediaItemID: "movie-2"}},
+		},
+		types: map[string]string{
+			"audiobook": "audiobook", "audiobook-2": "audiobook", "ebook": "ebook",
+			"movie": "movie", "movie-2": "movie", "series": "series",
+		},
+	}
+	r := &Reader{repo: repo, signals: NewSignalReader(&fakeSignalRepo{}, nil)}
+
+	rows, err := r.GetForYouPage(t.Context(), 7, "p1", 20, catalog.AccessFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got, want := rowLabels(rows), []string{"For You"}; !slices.Equal(got, want) {
+		t.Fatalf("rows = %v, want %v: the audiobook-only Drama row drops out", got, want)
+	}
+	if got, want := scoredIDs(rows[0].Items), []string{"movie", "series"}; !slices.Equal(got, want) {
+		t.Fatalf("main row = %v, want %v", got, want)
+	}
+
+	similar, err := r.GetSimilarUsersLiked(t.Context(), 7, "p1", 20, catalog.AccessFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got, want := scoredIDs(similar), []string{"movie-2"}; !slices.Equal(got, want) {
+		t.Fatalf("Similar Users = %v, want %v", got, want)
+	}
+}
diff --git a/internal/recommendations/reader_baseline_test.go b/internal/recommendations/reader_baseline_test.go
new file mode 100644
index 0000000000..9ef1eca07a
--- /dev/null
+++ b/internal/recommendations/reader_baseline_test.go
@@ -0,0 +1,101 @@
+package recommendations
+
+import (
+	"slices"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/userstore"
+)
+
+// A cluster row's subject is its genre label without the title wording. An
+// unlabeled cluster and any other title have none.
+func TestClusterSubject(t *testing.T) {
+	for _, tc := range []struct{ title, want string }{
+		{clusterTitle("Sci-Fi & Fantasy, Thriller"), "Sci-Fi & Fantasy, Thriller"},
+		{clusterTitle("Crime"), "Crime"},
+		{clusterTitle(""), ""},
+		{unlabeledClusterTitle, ""},
+		{clusterTitlePrefix, ""},
+		{"For You", ""},
+		{"Popular on This Server", ""},
+	} {
+		if got := clusterSubject(tc.title); got != tc.want {
+			t.Errorf("clusterSubject(%q) = %q, want %q", tc.title, got, tc.want)
+		}
+	}
+}
+
+// The page's cluster rows carry their subject, taken from the cached build's
+// title like the row title; the main row carries none.
+func TestForYouPageClusterRowsCarryTheirSubject(t *testing.T) {
+	r := &Reader{
+		repo: &fakeReaderRepo{
+			meta:     &TasteProfileMeta{SignalCounts: map[string]int{"watch_high": ColdStartFullPersonalized}},
+			clusters: []TasteCluster{{ClusterIdx: 0, Label: "Horror", TotalWeight: 2}, {ClusterIdx: 1, Label: "", TotalWeight: 1}},
+			personal: map[string][]ScoredItem{
+				RecTypeForYouMain + "|":                {{MediaItemID: "main"}},
+				RecTypeForYouClusterPrefix + "0" + "|": {{MediaItemID: "c0", Reason: clusterTitle("Comedy")}},
+				RecTypeForYouClusterPrefix + "1" + "|": {{MediaItemID: "c1"}},
+			},
+		},
+		signals: NewSignalReader(&fakeSignalRepo{}, nil),
+	}
+	rows, err := r.GetForYouPage(t.Context(), 7, "p1", 20, catalog.AccessFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	subjects := map[string]string{}
+	for _, row := range rows {
+		subjects[row.Label] = row.Subject
+	}
+	want := map[string]string{"For You": "", "Because you enjoy Comedy": "Comedy", unlabeledClusterTitle: ""}
+	for label, subject := range want {
+		got, ok := subjects[label]
+		if !ok || got != subject {
+			t.Fatalf("rows %v: %q has subject %q (present %v), want %q", subjects, label, got, ok, subject)
+		}
+	}
+}
+
+// Because You Watched rows come one per anchor, most recent first, up to the
+// number asked for. An anchor whose row filters empty gives way to the next,
+// and each row names its anchor.
+func TestGetBecauseYouWatchedRowsReadsSeveralAnchors(t *testing.T) {
+	store := anchorStore("first", "second", "third")
+	store.progress = append(store.progress, userstore.WatchProgress{ProfileID: "p1", MediaItemID: "seen", Completed: true, UpdatedAt: "2026-08-01T00:00:00Z"})
+	refresher := &countingReadRefresher{}
+	r := &Reader{
+		repo: &fakeReaderRepo{personal: map[string][]ScoredItem{
+			RecTypeBecauseWatched + "|first":  {{MediaItemID: "seen"}},
+			RecTypeBecauseWatched + "|second": scoredRun("second", 5),
+			RecTypeBecauseWatched + "|third":  scoredRun("third", 5),
+		}},
+		refresh: refresher,
+		signals: NewSignalReader(&fakeSignalRepo{}, fakeSignalProvider{store: store}),
+	}
+	ctx := t.Context()
+
+	rows, err := r.GetBecauseYouWatchedRows(ctx, 7, "p1", 2, 3, catalog.AccessFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(rows) != 2 || rows[0].AnchorItemID != "second" || rows[1].AnchorItemID != "third" {
+		t.Fatalf("rows = %+v, want the second and third anchors", rows)
+	}
+	for _, row := range rows {
+		if row.Type != RecTypeBecauseWatched || !slices.Equal(scoredIDs(row.Items), scoredIDs(scoredRun(row.AnchorItemID, 3))) {
+			t.Fatalf("row %s = %s %v, want its first 3 items", row.AnchorItemID, row.Type, scoredIDs(row.Items))
+		}
+	}
+
+	if rows, err := r.GetBecauseYouWatchedRows(ctx, 7, "p1", 1, 20, catalog.AccessFilter{}); err != nil || len(rows) != 1 || rows[0].AnchorItemID != "second" {
+		t.Fatalf("one row = %+v, %v; want the second anchor's", rows, err)
+	}
+	if rows, err := r.GetBecauseYouWatchedRows(ctx, 7, "p1", 0, 20, catalog.AccessFilter{}); err != nil || len(rows) != 0 {
+		t.Fatalf("no rows asked = %+v, %v", rows, err)
+	}
+	if refresher.calls != 0 {
+		t.Fatalf("refreshes = %d, want none: every anchor read had a cached row", refresher.calls)
+	}
+}
diff --git a/internal/recommendations/reader_defaults_test.go b/internal/recommendations/reader_defaults_test.go
new file mode 100644
index 0000000000..8b9e9b0e4a
--- /dev/null
+++ b/internal/recommendations/reader_defaults_test.go
@@ -0,0 +1,278 @@
+package recommendations
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/userstore"
+)
+
+func scored(ids ...string) []ScoredItem {
+	items := make([]ScoredItem, len(ids))
+	for i, id := range ids {
+		items[i] = ScoredItem{MediaItemID: id}
+	}
+	return items
+}
+
+func numbered(prefix string, n int) []ScoredItem {
+	items := make([]ScoredItem, n)
+	for i := range items {
+		items[i] = ScoredItem{MediaItemID: fmt.Sprintf("%s%02d", prefix, i)}
+	}
+	return items
+}
+
+func rowItems(rows []ForYouRow, label string) []string {
+	for _, row := range rows {
+		if row.Label == label {
+			return itemIDs(row.Items)
+		}
+	}
+	return nil
+}
+
+// watchedStore is a user store in which profile p1 watched the given items.
+func watchedStore(ids ...string) fakeSignalProvider {
+	store := &fakeSignalStore{}
+	for _, id := range ids {
+		store.progress = append(store.progress, userstore.WatchProgress{ProfileID: "p1", MediaItemID: id, Completed: true})
+	}
+	return fakeSignalProvider{store: store}
+}
+
+// A new profile on a server that has cached nothing, with recommendations
+// disabled (no refresher), still gets the default rows on Discover, queried
+// without the titles it watched or rated, liked or not.
+func TestDiscoverServesTheDefaultRowsWithNothingCached(t *testing.T) {
+	repo := &fakeReaderRepo{defaults: map[string][]ScoredItem{
+		RecTypeTopRated:      scored("watched", "disliked", "liked", "top-1", "top-2"),
+		RecTypeRecentlyAdded: scored("recent-1", "watched"),
+	}, rated: []string{"disliked", "liked"}}
+	r := &Reader{repo: repo, signals: NewSignalReader(&fakeSignalRepo{}, watchedStore("watched"))}
+
+	rows, err := r.GetDiscoverRows(t.Context(), 7, "p1", 20, catalog.AccessFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got, want := rowLabels(rows), []string{highlyRatedLabel, recentlyAddedLabel}; !slices.Equal(got, want) {
+		t.Fatalf("rows = %v, want %v", got, want)
+	}
+	if got := rowItems(rows, highlyRatedLabel); !slices.Equal(got, []string{"top-1", "top-2"}) {
+		t.Fatalf("highly rated = %v", got)
+	}
+	if rows[0].Type != RecTypeTopRated || rows[1].Type != RecTypeRecentlyAdded {
+		t.Fatalf("row types = %q, %q", rows[0].Type, rows[1].Type)
+	}
+	for _, call := range repo.defaultCalls {
+		if !slices.Equal(call.exclude, []string{"disliked", "liked", "watched"}) || call.limit != CacheCandidateLimit {
+			t.Fatalf("%s queried with exclude=%v limit=%d, want the watched and the rated titles and a full pool", call.kind, call.exclude, call.limit)
+		}
+	}
+}
+
+// Discover serves the live Recently Added row in place of the cached one and
+// adds Highly Rated, after the personal rows of a personalized profile.
+// Home and library sections keep the cached rows and never query the live
+// ones.
+func TestDiscoverServesDefaultRowsAndSectionsDoNot(t *testing.T) {
+	repo := &fakeReaderRepo{
+		meta:     &TasteProfileMeta{SignalCounts: map[string]int{"watch_high": ColdStartFullPersonalized}},
+		clusters: []TasteCluster{{ClusterIdx: 0, Label: "Drama"}},
+		personal: map[string][]ScoredItem{
+			RecTypeForYouMain + "|":                scored("main"),
+			RecTypeForYouClusterPrefix + "0" + "|": {{MediaItemID: "drama", Reason: clusterTitle("Drama")}},
+		},
+		global: map[string][]ScoredItem{
+			RecTypePopular:       scored("popular"),
+			RecTypeRecentlyAdded: scored("cached-recent"),
+			RecTypeTopRated:      scored("cached-top-rated"),
+		},
+		defaults: map[string][]ScoredItem{
+			RecTypeTopRated:      scored("rated"),
+			RecTypeRecentlyAdded: scored("recent"),
+		},
+	}
+	r := &Reader{repo: repo, signals: NewSignalReader(&fakeSignalRepo{}, nil)}
+
+	rows, err := r.GetDiscoverRows(t.Context(), 7, "p1", 20, catalog.AccessFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got, want := rowLabels(rows), []string{"For You", "Because you enjoy Drama", "Popular on This Server", highlyRatedLabel, recentlyAddedLabel}; !slices.Equal(got, want) {
+		t.Fatalf("discover rows = %v, want %v", got, want)
+	}
+	if got := rowItems(rows, recentlyAddedLabel); !slices.Equal(got, []string{"recent"}) {
+		t.Fatalf("recently added = %v, want the live row", got)
+	}
+
+	repo.defaultCalls = nil
+	page, err := r.GetForYouPage(t.Context(), 7, "p1", 20, catalog.AccessFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got, want := rowLabels(page), []string{"For You", "Because you enjoy Drama", "Popular on This Server", recentlyAddedLabel}; !slices.Equal(got, want) {
+		t.Fatalf("for you page = %v, want %v", got, want)
+	}
+	if got := rowItems(page, recentlyAddedLabel); !slices.Equal(got, []string{"cached-recent"}) {
+		t.Fatalf("for you page recently added = %v, want the cached row", got)
+	}
+	if _, err := r.SectionForYouMain(t.Context(), 7, "p1", catalog.AccessFilter{}); err != nil {
+		t.Fatal(err)
+	}
+	if len(repo.defaultCalls) != 0 {
+		t.Fatalf("for you page and sections queried the live rows: %+v", repo.defaultCalls)
+	}
+}
+
+// A default row's "see all" page is the same live row, longer: its first
+// items are the ones Discover shows, and an excluded or inaccessible title
+// is on neither.
+func TestDefaultRowSectionsMatchDiscover(t *testing.T) {
+	repo := &fakeReaderRepo{
+		global: map[string][]ScoredItem{RecTypeTopRated: scored("cached-top-rated")},
+		defaults: map[string][]ScoredItem{
+			RecTypeTopRated:      append(scored("watched", "hidden"), numbered("rated-", 40)...),
+			RecTypeRecentlyAdded: numbered("recent-", 40),
+		},
+		hidden: map[string]struct{}{"hidden": {}},
+	}
+	r := &Reader{repo: repo, signals: NewSignalReader(&fakeSignalRepo{}, watchedStore("watched"))}
+
+	discover, err := r.GetDiscoverRows(t.Context(), 7, "p1", 20, catalog.AccessFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for kind, label := range map[string]string{SectionKindTopRated: highlyRatedLabel, SectionKindRecentlyAdded: recentlyAddedLabel} {
+		row, err := r.GetSection(t.Context(), 7, "p1", kind, "", 60, catalog.AccessFilter{})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if row == nil || row.Label != label || len(row.Items) != 40 {
+			t.Fatalf("%s section = %+v, want 40 items labeled %q", kind, row, label)
+		}
+		shown := rowItems(discover, label)
+		if len(shown) != 20 || !slices.Equal(itemIDs(row.Items[:20]), shown) {
+			t.Fatalf("%s section starts %v, discover shows %v", kind, itemIDs(row.Items[:20]), shown)
+		}
+		if slices.Contains(itemIDs(row.Items), "watched") || slices.Contains(itemIDs(row.Items), "hidden") {
+			t.Fatalf("%s section shows an excluded or hidden title", kind)
+		}
+	}
+}
+
+// Discover dedupes a row only against the items earlier rows show: an item
+// past an earlier row's limit still appears in a later row. A limit of 10
+// leaves the main row unrotated, so it shows main-00 to main-09.
+func TestDiscoverDedupesOnlyAgainstShownItems(t *testing.T) {
+	main := numbered("main-", 25)
+	repo := &fakeReaderRepo{
+		meta:     &TasteProfileMeta{SignalCounts: map[string]int{"watch_high": ColdStartFullPersonalized}},
+		personal: map[string][]ScoredItem{RecTypeForYouMain + "|": main},
+		defaults: map[string][]ScoredItem{RecTypeTopRated: scored("main-03", "main-22", "rated")},
+		genres:   map[string][]ScoredItem{"Drama": scored("main-21", "rated", "drama")},
+	}
+	r := &Reader{repo: repo, signals: NewSignalReader(&fakeSignalRepo{}, nil)}
+
+	rows, err := r.GetDiscoverRows(t.Context(), 7, "p1", rotationMaxPinned, catalog.AccessFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := rowItems(rows, highlyRatedLabel); !slices.Equal(got, []string{"main-22", "rated"}) {
+		t.Fatalf("highly rated = %v, want the unshown main-22 kept and the shown main-03 dropped", got)
+	}
+	// Genre rows are titled for their rating-led content.
+	if got := rowItems(rows, "Top Drama"); !slices.Equal(got, []string{"main-21", "drama"}) {
+		t.Fatalf("genre row = %v (rows %v)", got, rowLabels(rows))
+	}
+}
+
+// A genre "see all" page carries the label Discover gives the row.
+func TestGenreSectionIsTitledTopGenre(t *testing.T) {
+	repo := &fakeReaderRepo{global: map[string][]ScoredItem{RecTypeGenreSamplerPrefix + "Drama": scored("drama")}}
+	r := &Reader{repo: repo, signals: NewSignalReader(&fakeSignalRepo{}, nil)}
+	row, err := r.GetSection(t.Context(), 7, "p1", SectionKindGenre, "Drama", 60, catalog.AccessFilter{})
+	if err != nil || row == nil || row.Label != "Top Drama" {
+		t.Fatalf("genre section = %+v, %v; want Top Drama", row, err)
+	}
+}
+
+// quietHouseholdCatalog is the global row store of a single-account server
+// whose titles were all added a month ago: no title has a crowd of accounts
+// behind it, and nothing was added in the last 14 days. cached holds what the
+// worker writes.
+type quietHouseholdCatalog struct {
+	cached map[string][]ScoredItem
+}
+
+func (c *quietHouseholdCatalog) GetPopularItems(_ context.Context, _, minAccounts, _ int) ([]ScoredItem, error) {
+	if minAccounts > 1 {
+		return nil, nil
+	}
+	return scored("household-pick"), nil
+}
+
+func (c *quietHouseholdCatalog) GetRecentlyAddedItems(_ context.Context, days, _ int) ([]ScoredItem, error) {
+	if days > 0 && days < 30 {
+		return nil, nil
+	}
+	return scored("month-old-1", "month-old-2"), nil
+}
+
+func (c *quietHouseholdCatalog) GetTopGenres(context.Context, int) ([]string, error) {
+	return nil, nil
+}
+
+func (c *quietHouseholdCatalog) GetGenreSamplerItems(context.Context, string, int) ([]ScoredItem, error) {
+	return nil, nil
+}
+
+func (c *quietHouseholdCatalog) UpsertRecommendationCache(_ context.Context, _ int, _, recType, _ string, items []ScoredItem, _ string) error {
+	c.cached[recType] = items
+	return nil
+}
+
+func (c *quietHouseholdCatalog) ExtendGlobalRecommendationCache(context.Context, string, bool, string) (int64, error) {
+	return 0, nil
+}
+
+func (c *quietHouseholdCatalog) DeleteGlobalRecommendationCache(context.Context, string, bool, []string) (int64, error) {
+	return 0, nil
+}
+
+// On a single-account server where nothing was added in the last 14 days,
+// a brand-new profile's cached reads (home and library "Recommended for You",
+// v1 For You, Jellyfin) still get a row: the worker caches Recently Added
+// without a window, and it stands in for the absent Popular row. Watch
+// Tonight reads the same row live.
+func TestNewProfileGetsARowOnAQuietSingleAccountServer(t *testing.T) {
+	ctx := t.Context()
+	store := &quietHouseholdCatalog{cached: map[string][]ScoredItem{}}
+	newJobTestWorker(&fakeLocker{}, nil).cacheGlobalRows(ctx, store, "expiry")
+	if _, ok := store.cached[RecTypePopular]; ok {
+		t.Fatal("one account's viewing was cached as Popular")
+	}
+	live := map[string][]ScoredItem{RecTypeRecentlyAdded: store.cached[RecTypeRecentlyAdded]}
+	r := &Reader{repo: &fakeReaderRepo{global: store.cached, defaults: live}, signals: NewSignalReader(&fakeSignalRepo{}, nil)}
+	want := []string{"month-old-1", "month-old-2"}
+
+	main, err := r.GetForYouMain(ctx, 7, "p1", 20, catalog.AccessFilter{})
+	if err != nil || main == nil || main.Label != recentlyAddedLabel || !slices.Equal(itemIDs(main.Items), want) {
+		t.Fatalf("for you main = %+v, %v; want the Recently Added row", main, err)
+	}
+	home, err := r.SectionForYouMain(ctx, 7, "p1", catalog.AccessFilter{})
+	if err != nil || home == nil || !slices.Equal(itemIDs(home.Items), want) {
+		t.Fatalf("home row = %+v, %v; want the Recently Added row", home, err)
+	}
+	page, err := r.GetForYouPage(ctx, 7, "p1", 20, catalog.AccessFilter{})
+	if err != nil || len(page) == 0 {
+		t.Fatalf("for you page = %v, %v; want a row", rowLabels(page), err)
+	}
+	tonight, err := r.GetWatchTonight(ctx, 7, "p1", 20, catalog.AccessFilter{})
+	if err != nil || !tonight.IsCold || len(tonight.Items) != len(want) {
+		t.Fatalf("watch tonight = %+v, %v; want the cold-start titles", tonight, err)
+	}
+}
diff --git a/internal/recommendations/reader_scope_test.go b/internal/recommendations/reader_scope_test.go
new file mode 100644
index 0000000000..a62b4e66f3
--- /dev/null
+++ b/internal/recommendations/reader_scope_test.go
@@ -0,0 +1,346 @@
+package recommendations
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/userstore"
+)
+
+// scoredRun returns n items named prefix-00, prefix-01, ... in descending
+// score order.
+func scoredRun(prefix string, n int) []ScoredItem {
+	items := make([]ScoredItem, n)
+	for i := range items {
+		items[i] = ScoredItem{MediaItemID: fmt.Sprintf("%s-%02d", prefix, i), Score: float64(n - i)}
+	}
+	return items
+}
+
+func scoredIDs(items []ScoredItem) []string {
+	out := make([]string, len(items))
+	for i, item := range items {
+		out[i] = item.MediaItemID
+	}
+	return out
+}
+
+func TestNormalizeRecommendationLimit(t *testing.T) {
+	for _, tc := range []struct{ in, want int }{
+		{-1, 20}, {0, 20}, {1, 1}, {20, 20}, {21, 21}, {50, 50}, {51, 50}, {CacheCandidateLimit, 50},
+	} {
+		if got := normalizeRecommendationLimit(tc.in); got != tc.want {
+			t.Errorf("normalizeRecommendationLimit(%d) = %d, want %d", tc.in, got, tc.want)
+		}
+	}
+}
+
+// Public reads answer up to the v2 maximum of 50 items per row; section
+// reads answer every cached candidate, so a section can scope the row to
+// its libraries before trimming it.
+func TestPublicReadsServeUpToFiftyAndSectionReadsTheWholePool(t *testing.T) {
+	pool := scoredRun("m", CacheCandidateLimit)
+	repo := &fakeReaderRepo{
+		meta:     &TasteProfileMeta{SignalCounts: map[string]int{"watch_high": ColdStartFullPersonalized}},
+		clusters: []TasteCluster{{ClusterIdx: 0, Label: "Drama", TotalWeight: 1}},
+		personal: map[string][]ScoredItem{
+			RecTypeForYouMain + "|":                pool,
+			RecTypeSimilarUsersLiked + "|":         pool,
+			RecTypeForYouClusterPrefix + "0" + "|": pool,
+		},
+	}
+	r := &Reader{repo: repo, signals: NewSignalReader(&fakeSignalRepo{}, nil)}
+	ctx := t.Context()
+
+	for _, tc := range []struct {
+		limit, want int
+	}{{0, 20}, {50, 50}, {60, 50}} {
+		main, err := r.GetForYouMain(ctx, 7, "p1", tc.limit, catalog.AccessFilter{})
+		if err != nil || main == nil || len(main.Items) != tc.want {
+			t.Fatalf("GetForYouMain(limit %d) = %v, %v; want %d items", tc.limit, main, err, tc.want)
+		}
+		similar, err := r.GetSimilarUsersLiked(ctx, 7, "p1", tc.limit, catalog.AccessFilter{})
+		if err != nil || len(similar) != tc.want {
+			t.Fatalf("GetSimilarUsersLiked(limit %d) = %d items, %v; want %d", tc.limit, len(similar), err, tc.want)
+		}
+	}
+
+	// The section row is rotated like a default-size page, but keeps every
+	// cached item.
+	main, err := r.SectionForYouMain(ctx, 7, "p1", catalog.AccessFilter{})
+	if err != nil || main == nil || !slices.Equal(slices.Sorted(slices.Values(scoredIDs(main.Items))), scoredIDs(pool)) {
+		t.Fatalf("SectionForYouMain = %v, %v; want the whole cached pool", main, err)
+	}
+	similar, err := r.SectionSimilarUsersLiked(ctx, 7, "p1", catalog.AccessFilter{})
+	if err != nil || len(similar) != CacheCandidateLimit {
+		t.Fatalf("SectionSimilarUsersLiked = %d items, %v; want %d", len(similar), err, CacheCandidateLimit)
+	}
+	taste, err := r.SectionTasteMatchRow(ctx, 7, "p1", "", catalog.AccessFilter{})
+	if err != nil || taste == nil || len(taste.Items) != CacheCandidateLimit {
+		t.Fatalf("SectionTasteMatchRow = %v, %v; want %d items", taste, err, CacheCandidateLimit)
+	}
+}
+
+// A library's For You fill is the profile's other personal rows in a fixed
+// order: the cluster rows heaviest first, then Because You Watched by
+// anchor, most recent first, then Similar Users. Each item appears once at
+// its first place, the fill is filtered like every row, it leaves the main
+// row out, and a missing row asks for no refresh.
+func TestSectionForYouFillOrdersTheOtherPersonalRows(t *testing.T) {
+	refresher := &countingReadRefresher{}
+	repo := &fakeReaderRepo{
+		meta: &TasteProfileMeta{SignalCounts: map[string]int{"watch_high": ColdStartFullPersonalized}},
+		clusters: []TasteCluster{
+			{ClusterIdx: 0, Label: "Drama", TotalWeight: 1},
+			{ClusterIdx: 1, Label: "Comedy", TotalWeight: 3},
+			{ClusterIdx: 2, Label: "War", TotalWeight: 2}, // no cached row
+		},
+		personal: map[string][]ScoredItem{
+			RecTypeForYouMain + "|":                {{MediaItemID: "main"}},
+			RecTypeForYouClusterPrefix + "0" + "|": {{MediaItemID: "drama-00"}, {MediaItemID: "drama-01"}, {MediaItemID: "shared"}},
+			RecTypeForYouClusterPrefix + "1" + "|": {{MediaItemID: "comedy-00"}, {MediaItemID: "shared"}, {MediaItemID: "comedy-01"}},
+			// The second anchor is watched, so the first anchor's row drops it.
+			RecTypeBecauseWatched + "|first": {{MediaItemID: "byw-00"}, {MediaItemID: "comedy-00"}, {MediaItemID: "second"}},
+			RecTypeSimilarUsersLiked + "|":   {{MediaItemID: "similar-00"}, {MediaItemID: "hidden"}, {MediaItemID: "byw-00"}},
+		},
+		hidden: map[string]struct{}{"hidden": {}},
+	}
+	r := &Reader{
+		repo:    repo,
+		refresh: refresher,
+		signals: NewSignalReader(&fakeSignalRepo{}, fakeSignalProvider{store: anchorStore("first", "second")}),
+	}
+
+	fill, err := r.SectionForYouFill(t.Context(), 7, "p1", catalog.AccessFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []string{"comedy-00", "shared", "comedy-01", "drama-00", "drama-01", "byw-00", "similar-00"}
+	if got := scoredIDs(fill); !slices.Equal(got, want) {
+		t.Fatalf("fill = %v, want %v", got, want)
+	}
+	if refresher.calls != 0 {
+		t.Fatalf("refreshes = %d, want none", refresher.calls)
+	}
+
+	// With recommendations off there is nothing personal to fill with.
+	fill, err = r.WithPersonalRows(false).SectionForYouFill(t.Context(), 7, "p1", catalog.AccessFilter{})
+	if err != nil || len(fill) != 0 {
+		t.Fatalf("fill with personal rows off = %v, %v; want none", scoredIDs(fill), err)
+	}
+}
+
+// anchorStore is a store whose profile p1 completed the given items, the
+// first most recently.
+func anchorStore(itemIDs ...string) *fakeSignalStore {
+	store := &fakeSignalStore{}
+	for i, id := range itemIDs {
+		store.progress = append(store.progress, userstore.WatchProgress{
+			ProfileID:   "p1",
+			MediaItemID: id,
+			Completed:   true,
+			UpdatedAt:   fmt.Sprintf("2026-08-10T12:%02d:00Z", 59-i),
+		})
+	}
+	return store
+}
+
+// A section's Because You Watched row takes the most recent anchor whose row
+// keeps items in the section's libraries, not the most recent anchor.
+func TestSectionBecauseYouWatchedPicksAnAnchorWithItemsInScope(t *testing.T) {
+	const tvLibrary, movieLibrary = 1, 2
+	seriesRow, movieRow := scoredRun("series", 5), scoredRun("movie", 5)
+	libraries := map[string]int{}
+	for _, item := range seriesRow {
+		libraries[item.MediaItemID] = tvLibrary
+	}
+	for _, item := range movieRow {
+		libraries[item.MediaItemID] = movieLibrary
+	}
+	refresher := &countingReadRefresher{}
+	r := &Reader{
+		repo: &fakeReaderRepo{
+			personal: map[string][]ScoredItem{
+				RecTypeBecauseWatched + "|latest-series": seriesRow,
+				RecTypeBecauseWatched + "|older-movie":   movieRow,
+			},
+			libraries: libraries,
+		},
+		refresh: refresher,
+		signals: NewSignalReader(&fakeSignalRepo{}, fakeSignalProvider{store: anchorStore("latest-series", "older-movie")}),
+	}
+	ctx := t.Context()
+
+	for _, tc := range []struct {
+		name       string
+		libraryIDs []int
+		filter     catalog.AccessFilter
+		wantSource string
+		wantItems  []ScoredItem
+	}{
+		{"no scope", nil, catalog.AccessFilter{}, "latest-series", seriesRow},
+		{"TV library", []int{tvLibrary}, catalog.AccessFilter{}, "latest-series", seriesRow},
+		{"movie library", []int{movieLibrary}, catalog.AccessFilter{}, "older-movie", movieRow},
+		{"movie library the viewer cannot see", []int{movieLibrary}, catalog.AccessFilter{AllowedLibraryIDs: []int{tvLibrary}}, "", nil},
+		{"viewer limited to movies", nil, catalog.AccessFilter{AllowedLibraryIDs: []int{movieLibrary}}, "older-movie", movieRow},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			items, source, err := r.SectionBecauseYouWatched(ctx, 7, "p1", "", tc.libraryIDs, tc.filter)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if source != tc.wantSource || !slices.Equal(scoredIDs(items), scoredIDs(tc.wantItems)) {
+				t.Fatalf("source=%q items=%v; want source %q items %v", source, scoredIDs(items), tc.wantSource, scoredIDs(tc.wantItems))
+			}
+		})
+	}
+	// Every anchor had a cached row; filtering emptied them, which a refresh
+	// would not change.
+	if refresher.calls != 0 {
+		t.Fatalf("refreshes = %d, want none", refresher.calls)
+	}
+}
+
+// An anchor whose cached row the profile has watched through moves on to
+// the next anchor instead of answering an empty row.
+func TestSectionBecauseYouWatchedMovesPastAnEmptiedAnchor(t *testing.T) {
+	store := anchorStore("first", "second")
+	store.progress = append(store.progress, userstore.WatchProgress{ProfileID: "p1", MediaItemID: "seen", Completed: true, UpdatedAt: "2026-08-01T00:00:00Z"})
+	r := &Reader{
+		repo: &fakeReaderRepo{personal: map[string][]ScoredItem{
+			RecTypeBecauseWatched + "|first":  {{MediaItemID: "seen", Score: 1}},
+			RecTypeBecauseWatched + "|second": {{MediaItemID: "fresh", Score: 1}},
+		}},
+		signals: NewSignalReader(&fakeSignalRepo{}, fakeSignalProvider{store: store}),
+	}
+	items, source, err := r.SectionBecauseYouWatched(t.Context(), 7, "p1", "", nil, catalog.AccessFilter{})
+	if err != nil || source != "second" || !slices.Equal(scoredIDs(items), []string{"fresh"}) {
+		t.Fatalf("source=%q items=%v err=%v; want the second anchor's row", source, scoredIDs(items), err)
+	}
+}
+
+// A profile whose recent completions were all deleted from the catalog has
+// no anchor, so reading the row asks for no refresh that could never fill it.
+func TestBecauseYouWatchedWithOnlyDeletedCompletionsRequestsNoRefresh(t *testing.T) {
+	refresher := &countingReadRefresher{}
+	r := &Reader{
+		repo:    &fakeReaderRepo{},
+		refresh: refresher,
+		signals: NewSignalReader(
+			&fakeSignalRepo{missing: map[string]struct{}{"deleted-movie": {}, "orphan-episode": {}}},
+			fakeSignalProvider{store: anchorStore("deleted-movie", "orphan-episode")},
+		),
+	}
+	for range 3 {
+		items, source, err := r.SectionBecauseYouWatched(t.Context(), 7, "p1", "", nil, catalog.AccessFilter{})
+		if err != nil || len(items) != 0 || source != "" {
+			t.Fatalf("items=%v source=%q err=%v; want an empty row", items, source, err)
+		}
+	}
+	if refresher.calls != 0 {
+		t.Fatalf("refreshes = %d, want none", refresher.calls)
+	}
+}
+
+// progressPageCounter counts the full progress walks the watched set makes.
+type progressPageCounter struct {
+	*fakeSignalStore
+	allPages int
+}
+
+func (s *progressPageCounter) ListProgressPage(ctx context.Context, profileID, status string, after *userstore.ProgressKey, limit int) ([]userstore.WatchProgress, error) {
+	if status == "all" {
+		s.allPages++
+	}
+	return s.fakeSignalStore.ListProgressPage(ctx, profileID, status, after, limit)
+}
+
+// One request loads the profile's exclusion set once, however many rows,
+// clusters or anchors it filters.
+func TestReadLoadsTheExclusionSetOncePerRequest(t *testing.T) {
+	store := &progressPageCounter{fakeSignalStore: anchorStore("first", "second", "third")}
+	r := &Reader{
+		repo: &fakeReaderRepo{
+			meta: &TasteProfileMeta{SignalCounts: map[string]int{"watch_high": ColdStartFullPersonalized}},
+			clusters: []TasteCluster{
+				{ClusterIdx: 0, Label: "Drama", TotalWeight: 3},
+				{ClusterIdx: 1, Label: "Comedy", TotalWeight: 2},
+			},
+			personal: map[string][]ScoredItem{
+				RecTypeForYouMain + "|":                {{MediaItemID: "main"}},
+				RecTypeSimilarUsersLiked + "|":         {{MediaItemID: "similar"}},
+				RecTypeForYouClusterPrefix + "0" + "|": {{MediaItemID: "first"}},
+				RecTypeForYouClusterPrefix + "1" + "|": {{MediaItemID: "comedy"}},
+				RecTypeBecauseWatched + "|first":       {{MediaItemID: "second"}},
+				RecTypeBecauseWatched + "|second":      {{MediaItemID: "third"}},
+				RecTypeBecauseWatched + "|third":       {{MediaItemID: "fresh"}},
+			},
+		},
+		signals: NewSignalReader(&fakeSignalRepo{}, fakeSignalProvider{store: store}),
+	}
+	ctx := t.Context()
+	for name, read := range map[string]func() error{
+		"discover": func() error {
+			_, err := r.GetDiscoverRows(ctx, 7, "p1", 20, catalog.AccessFilter{})
+			return err
+		},
+		"taste match past a watched cluster": func() error {
+			row, err := r.SectionTasteMatchRow(ctx, 7, "p1", "", catalog.AccessFilter{})
+			if err == nil && (row == nil || row.ClusterIndex != 1) {
+				return fmt.Errorf("row = %+v, want cluster 1", row)
+			}
+			return err
+		},
+		"for you fill": func() error {
+			fill, err := r.SectionForYouFill(ctx, 7, "p1", catalog.AccessFilter{})
+			if err == nil && !slices.Equal(scoredIDs(fill), []string{"comedy", "fresh", "similar"}) {
+				return fmt.Errorf("fill = %v, want comedy, fresh, similar", scoredIDs(fill))
+			}
+			return err
+		},
+		"because you watched past two watched rows": func() error {
+			items, source, err := r.SectionBecauseYouWatched(ctx, 7, "p1", "", nil, catalog.AccessFilter{})
+			if err == nil && (source != "third" || len(items) != 1) {
+				return fmt.Errorf("source=%q items=%v, want the third anchor", source, items)
+			}
+			return err
+		},
+	} {
+		store.allPages = 0
+		if err := read(); err != nil {
+			t.Fatalf("%s: %v", name, err)
+		}
+		if store.allPages != 1 {
+			t.Fatalf("%s walked the watch history %d times, want once", name, store.allPages)
+		}
+	}
+}
+
+// A section's library scope narrows the viewer's filter: nil leaves it, an
+// empty scope allows nothing, and a list is limited to what the viewer may
+// see.
+func TestScopeToLibraries(t *testing.T) {
+	restricted := catalog.AccessFilter{AllowedLibraryIDs: []int{1, 2, 3}}
+	for name, tc := range map[string]struct {
+		filter catalog.AccessFilter
+		scope  []int
+		want   []int
+	}{
+		"no scope keeps the filter":        {restricted, nil, []int{1, 2, 3}},
+		"no scope keeps unrestricted":      {catalog.AccessFilter{}, nil, nil},
+		"empty scope allows nothing":       {catalog.AccessFilter{}, []int{}, []int{}},
+		"unrestricted viewer takes scope":  {catalog.AccessFilter{}, []int{4, 5}, []int{4, 5}},
+		"restricted viewer intersects":     {restricted, []int{2, 4}, []int{2}},
+		"nothing in common allows nothing": {restricted, []int{4}, []int{}},
+		"hidden library leaves the scope":  {catalog.AccessFilter{DisabledLibraryIDs: []int{5}}, []int{4, 5}, []int{4}},
+		"only hidden libraries allow none": {catalog.AccessFilter{DisabledLibraryIDs: []int{5}}, []int{5}, []int{}},
+	} {
+		got := scopeToLibraries(tc.filter, tc.scope).AllowedLibraryIDs
+		if (got == nil) != (tc.want == nil) || !slices.Equal(got, tc.want) {
+			t.Errorf("%s: AllowedLibraryIDs = %#v, want %#v", name, got, tc.want)
+		}
+	}
+}
diff --git a/internal/recommendations/reader_test.go b/internal/recommendations/reader_test.go
index d902f4ce6a..68bf18b3ed 100644
--- a/internal/recommendations/reader_test.go
+++ b/internal/recommendations/reader_test.go
@@ -2,13 +2,19 @@ package recommendations
 
 import (
 	"context"
+	"fmt"
+	"slices"
+	"strings"
 	"testing"
 	"time"
 
+	"github.com/google/uuid"
+
 	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/userstore"
 )
 
-func TestGetBecauseYouWatchedWithSourceReturnsAnchorThatHasCache(t *testing.T) {
+func TestSectionBecauseYouWatchedReturnsAnchorThatHasCache(t *testing.T) {
 	pool := newEngineTestPool(t)
 	ctx := t.Context()
 	const prefix = "tbcw-source-"
@@ -38,7 +44,7 @@ func TestGetBecauseYouWatchedWithSourceReturnsAnchorThatHasCache(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	items, sourceID, err := NewReader(repo, nil, nil, nil).GetBecauseYouWatchedWithSource(ctx, userID, profile, "", 10, catalog.AccessFilter{})
+	items, sourceID, err := NewReader(repo, nil, nil, nil).SectionBecauseYouWatched(ctx, userID, profile, "", nil, catalog.AccessFilter{})
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -49,3 +55,695 @@ func TestGetBecauseYouWatchedWithSourceReturnsAnchorThatHasCache(t *testing.T) {
 		t.Fatalf("items = %+v, want only %q", items, rec)
 	}
 }
+
+func TestClusterRowTitleComesFromTheCachedRow(t *testing.T) {
+	// The taste job renumbered the clusters: index 0 is now Horror, but the
+	// cached row for index 0 still holds the Comedy build.
+	horror := TasteCluster{ClusterIdx: 0, Label: "Horror"}
+	cached := []ScoredItem{{MediaItemID: "m1", Reason: clusterTitle("Comedy")}, {MediaItemID: "m2", Reason: clusterTitle("Comedy")}}
+	if row := clusterRow(horror, cached); row.Label != "Because you enjoy Comedy" || row.ClusterIndex != 0 || len(row.Items) != 2 {
+		t.Fatalf("row = %+v, want the cached Comedy title", row)
+	}
+
+	// Rows whose items carry no cluster title use the cluster label.
+	for _, reason := range []string{"", "cluster_match", clusterTitlePrefix} {
+		row := clusterRow(horror, []ScoredItem{{MediaItemID: "m1", Reason: reason}})
+		if row.Label != "Because you enjoy Horror" {
+			t.Fatalf("reason %q: title = %q", reason, row.Label)
+		}
+	}
+	// An unlabeled cluster is not "Because you enjoy" anything, and its title
+	// round-trips through the cache like a labeled one.
+	if row := clusterRow(TasteCluster{}, nil); row.Label != unlabeledClusterTitle {
+		t.Fatalf("unlabeled cluster title = %q", row.Label)
+	}
+	if row := clusterRow(horror, []ScoredItem{{MediaItemID: "m1", Reason: clusterTitle("")}}); row.Label != unlabeledClusterTitle || row.Subject != "" {
+		t.Fatalf("cached unlabeled title = %q (subject %q), want %q", row.Label, row.Subject, unlabeledClusterTitle)
+	}
+}
+
+type countingReadRefresher struct{ calls int }
+
+func (c *countingReadRefresher) RequestReadRefresh(context.Context, int, string) { c.calls++ }
+
+func (c *countingReadRefresher) ReadRefreshDue(int, string) bool { return true }
+
+// A read of a profile with no taste profile asks for a refresh only when the
+// profile has signals to build one from.
+func TestReaderRefreshesAProfileWithoutTasteOnlyWhenItHasSignals(t *testing.T) {
+	ctx := t.Context()
+	refresher := &countingReadRefresher{}
+	r := &Reader{refresh: refresher, signals: NewSignalReader(&fakeSignalRepo{signalRows: true}, nil)}
+	r.requestRefreshIfSignals(ctx, 7, "p1")
+	if refresher.calls != 1 {
+		t.Fatalf("refreshes with signals = %d, want 1", refresher.calls)
+	}
+
+	r.signals = NewSignalReader(&fakeSignalRepo{}, nil)
+	r.requestRefreshIfSignals(ctx, 7, "p1")
+	if refresher.calls != 1 {
+		t.Fatalf("refreshes without signals = %d, want none", refresher.calls-1)
+	}
+
+	// Without a refresher (recommendations disabled) it does not even look.
+	repo := &fakeSignalRepo{signalRows: true}
+	(&Reader{signals: NewSignalReader(repo, nil)}).requestRefreshIfSignals(ctx, 7, "p1")
+	if len(repo.signalRowsCalls) != 0 {
+		t.Fatalf("signal checks without a refresher = %d, want none", len(repo.signalRowsCalls))
+	}
+}
+
+// Because You Watched rows are built from completed titles, so a profile
+// with none has nothing a refresh could add.
+func TestBecauseYouWatchedWithoutCompletionsRequestsNoRefresh(t *testing.T) {
+	refresher := &countingReadRefresher{}
+	r := &Reader{refresh: refresher, signals: NewSignalReader(&fakeSignalRepo{}, fakeSignalProvider{store: &fakeSignalStore{}})}
+	items, source, err := r.SectionBecauseYouWatched(t.Context(), 7, "p1", "", nil, catalog.AccessFilter{})
+	if err != nil || len(items) != 0 || source != "" {
+		t.Fatalf("items=%v source=%q err=%v, want an empty row", items, source, err)
+	}
+	if refresher.calls != 0 {
+		t.Fatalf("refreshes = %d, want none", refresher.calls)
+	}
+}
+
+// For You on a profile with no taste profile: a profile with no signals never
+// queues a refresh; once it has one, the first read queues a refresh and
+// later reads within the throttle interval do not queue another.
+func TestForYouReadRefreshesNewProfilesWithSignalsOncePostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	const prefix = "tforyou-heal-"
+	const profile = "66200000-0000-4000-8000-000000000002"
+	var userID int
+	if err := pool.QueryRow(ctx, `INSERT INTO users(username,role) VALUES($1,'user') RETURNING id`, prefix+uuid.NewString()).Scan(&userID); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _, _ = pool.Exec(context.Background(), `DELETE FROM users WHERE id=$1`, userID) })
+	if _, err := pool.Exec(ctx, `INSERT INTO user_profiles(id,user_id,name) VALUES($1,$2,'heal test')`, profile, userID); err != nil {
+		t.Fatal(err)
+	}
+	cleanupRecoMediaItems(t, pool, prefix)
+
+	w, _ := newRefreshTestWorker()
+	r := NewReader(NewRepo(pool), nil, w, nil)
+	read := func() {
+		t.Helper()
+		if _, err := r.GetForYouMain(ctx, userID, profile, 20, catalog.AccessFilter{UserID: userID, ProfileID: profile}); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	read()
+	read()
+	assertNothingQueued(t, w, "profile without signals")
+
+	watched := prefix + "movie"
+	seedRecoMediaItem(t, pool, watched, "movie", "matched")
+	if _, err := pool.Exec(ctx, `INSERT INTO user_watch_progress(user_id,profile_id,media_item_id,completed,updated_at) VALUES($1,$2,$3,true,NOW())`, userID, profile, watched); err != nil {
+		t.Fatal(err)
+	}
+	read()
+	if req := takeQueued(t, w); req.userID != userID || req.profileID != profile {
+		t.Fatalf("queued %+v", req)
+	}
+	read()
+	if _, err := r.GetDiscoverRows(ctx, userID, profile, 20, catalog.AccessFilter{UserID: userID, ProfileID: profile}); err != nil {
+		t.Fatal(err)
+	}
+	assertNothingQueued(t, w, "reads within the throttle interval")
+}
+
+// fakeReaderRepo serves the Reader's reads from memory. Every item is
+// accessible unless listed in hidden, its type in types is not one of
+// recommendableMediaTypes or, when the filter names allowed libraries, its
+// library in libraries is not one of them.
+type fakeReaderRepo struct {
+	meta     *TasteProfileMeta
+	clusters []TasteCluster
+	// personal holds the profile's cached rows by rec type and source item,
+	// global the global rows by rec type.
+	personal  map[string][]ScoredItem
+	global    map[string][]ScoredItem
+	hidden    map[string]struct{}
+	libraries map[string]int
+	// types holds item media types; an item missing from it is a movie.
+	types map[string]string
+	// genres holds the cached genre samplers by genre.
+	genres map[string][]ScoredItem
+	// defaults holds the live default rows by kind, best first;
+	// defaultCalls records each read of one.
+	defaults     map[string][]ScoredItem
+	defaultCalls []defaultRowCall
+	// rated holds the titles the profile rated.
+	rated []string
+}
+
+func (f *fakeReaderRepo) ListRatedItemIDs(context.Context, int, string) ([]string, error) {
+	return f.rated, nil
+}
+
+type defaultRowCall struct {
+	kind    string
+	exclude []string
+	limit   int
+}
+
+func (f *fakeReaderRepo) GetTasteProfileMeta(context.Context, int, string) (*TasteProfileMeta, error) {
+	return f.meta, nil
+}
+
+func (f *fakeReaderRepo) GetTasteClusterMeta(context.Context, int, string) ([]TasteCluster, error) {
+	return f.clusters, nil
+}
+
+func (f *fakeReaderRepo) GetRecommendationCache(_ context.Context, userID int, _, recType, sourceItemID string) ([]ScoredItem, error) {
+	if userID == GlobalCacheUserID {
+		return f.global[recType], nil
+	}
+	return f.personal[recType+"|"+sourceItemID], nil
+}
+
+func (f *fakeReaderRepo) ListCachedGenreSamplers(context.Context) (map[string][]ScoredItem, error) {
+	return f.genres, nil
+}
+
+func (f *fakeReaderRepo) TopGenre(context.Context) (string, error) {
+	return "", nil
+}
+
+func (f *fakeReaderRepo) FilterRecommendableItemIDs(_ context.Context, itemIDs []string, filter catalog.AccessFilter) (map[string]struct{}, error) {
+	accessible := make(map[string]struct{}, len(itemIDs))
+	for _, id := range itemIDs {
+		if _, hidden := f.hidden[id]; hidden {
+			continue
+		}
+		if mediaType, ok := f.types[id]; ok && !slices.Contains(recommendableMediaTypes, mediaType) {
+			continue
+		}
+		if filter.AllowedLibraryIDs != nil && !slices.Contains(filter.AllowedLibraryIDs, f.libraries[id]) {
+			continue
+		}
+		accessible[id] = struct{}{}
+	}
+	return accessible, nil
+}
+
+// ListDefaultRowItems serves a default row as the query does: the accessible
+// items not in exclude, at most limit of them.
+func (f *fakeReaderRepo) ListDefaultRowItems(ctx context.Context, filter catalog.AccessFilter, kind string, exclude []string, limit int) ([]ScoredItem, error) {
+	f.defaultCalls = append(f.defaultCalls, defaultRowCall{kind: kind, exclude: slices.Sorted(slices.Values(exclude)), limit: limit})
+	var ids []string
+	for _, item := range f.defaults[kind] {
+		ids = append(ids, item.MediaItemID)
+	}
+	accessible, _ := f.FilterRecommendableItemIDs(ctx, ids, filter)
+	items := []ScoredItem{}
+	for _, item := range f.defaults[kind] {
+		if _, ok := accessible[item.MediaItemID]; ok && !slices.Contains(exclude, item.MediaItemID) && len(items) < limit {
+			items = append(items, item)
+		}
+	}
+	return items, nil
+}
+
+func rowLabels(rows []ForYouRow) []string {
+	labels := make([]string, len(rows))
+	for i, row := range rows {
+		labels[i] = row.Label
+	}
+	return labels
+}
+
+// A profile with no positive title, or no taste profile, is served the
+// global rows only, even while personal rows from an earlier taste profile
+// are still cached; positive titles bring the personal rows in by level. A
+// profile seeded with three picks is level 2 and opens on its own row.
+func TestForYouPageServesGlobalRowsOnlyWithoutPositiveSignals(t *testing.T) {
+	const (
+		forYou  = "For You"
+		drama   = "Because you enjoy Drama"
+		popular = "Popular on This Server"
+		recent  = "Recently Added"
+	)
+	counts := func(kv ...any) *TasteProfileMeta {
+		m := map[string]int{}
+		for i := 0; i < len(kv); i += 2 {
+			m[kv[i].(string)] = kv[i+1].(int)
+		}
+		return &TasteProfileMeta{SignalCounts: m}
+	}
+	for _, tc := range []struct {
+		name string
+		meta *TasteProfileMeta
+		want []string
+	}{
+		{"no taste profile", nil, []string{popular, recent}},
+		{"cleared taste vector", counts(signalCountPositiveTitles, 0), []string{popular, recent}},
+		{"only negative signals", counts("watch_low", 1, "rated_low", 2, signalCountPositiveTitles, 0), []string{popular, recent}},
+		{"watchlist only", counts("watchlist", 3, signalCountPositiveTitles, 0), []string{popular, recent}},
+		{"one positive title", counts("favorited", 1, "watch_low", 4, signalCountPositiveTitles, 1), []string{popular, recent, forYou}},
+		{"one title rated, favorited and finished", counts("rated_5", 1, "favorited", 1, "watch_high", 1, signalCountPositiveTitles, 1), []string{popular, recent, forYou}},
+		{"three taste-seed picks", counts("favorited", 3, signalCountPositiveTitles, 3), []string{forYou, popular, drama, recent}},
+		{"nine titles", counts("watch_high", 9, signalCountPositiveTitles, 9), []string{forYou, popular, drama, recent}},
+		{"fully personalized", counts("watch_high", 12, signalCountPositiveTitles, ColdStartFullPersonalized), []string{forYou, drama, popular, recent}},
+		{"legacy row with one positive signal", counts("favorited", 1, "watch_low", 4), []string{popular, recent, forYou}},
+		{"legacy row past the top threshold", counts("watch_high", ColdStartFullPersonalized), []string{forYou, drama, popular, recent}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			repo := &fakeReaderRepo{
+				meta:     tc.meta,
+				clusters: []TasteCluster{{ClusterIdx: 0, Label: "Drama"}},
+				personal: map[string][]ScoredItem{
+					RecTypeForYouMain + "|":                {{MediaItemID: "personal-main"}},
+					RecTypeForYouClusterPrefix + "0" + "|": {{MediaItemID: "personal-drama", Reason: clusterTitle("Drama")}},
+				},
+				global: map[string][]ScoredItem{
+					RecTypePopular:       {{MediaItemID: "popular"}},
+					RecTypeRecentlyAdded: {{MediaItemID: "recent"}},
+				},
+			}
+			r := &Reader{repo: repo, signals: NewSignalReader(&fakeSignalRepo{}, nil)}
+			rows, err := r.getForYouPageRows(t.Context(), 7, "p1", catalog.AccessFilter{})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if got := rowLabels(rows); !slices.Equal(got, tc.want) {
+				t.Fatalf("rows = %v, want %v", got, tc.want)
+			}
+			main, err := r.GetForYouMain(t.Context(), 7, "p1", 20, catalog.AccessFilter{})
+			if err != nil || main == nil || main.Label != tc.want[0] {
+				t.Fatalf("main row = %+v, %v; want %q", main, err, tc.want[0])
+			}
+		})
+	}
+}
+
+// With recommendations disabled a fully personalized profile is served the
+// global rows only, though its personal rows are still cached, and no
+// personal row is read for a section or Discover.
+func TestDisabledRecommendationsServeNoPersonalRows(t *testing.T) {
+	repo := &fakeReaderRepo{
+		meta:     &TasteProfileMeta{SignalCounts: map[string]int{"watch_high": 12, signalCountPositiveTitles: ColdStartFullPersonalized}},
+		clusters: []TasteCluster{{ClusterIdx: 0, Label: "Drama", DominantGenres: []string{"Drama"}}},
+		personal: map[string][]ScoredItem{
+			RecTypeForYouMain + "|":                {{MediaItemID: "personal-main"}},
+			RecTypeForYouClusterPrefix + "0" + "|": {{MediaItemID: "personal-drama", Reason: clusterTitle("Drama")}},
+			RecTypeSimilarUsersLiked + "|":         {{MediaItemID: "peer-pick"}},
+		},
+		global: map[string][]ScoredItem{
+			RecTypePopular:                      {{MediaItemID: "popular"}},
+			RecTypeRecentlyAdded:                {{MediaItemID: "recent"}},
+			RecTypeGenreSamplerPrefix + "Drama": {{MediaItemID: "top-drama"}},
+		},
+		defaults: map[string][]ScoredItem{RecTypeRecentlyAdded: {{MediaItemID: "recent"}}},
+		genres:   map[string][]ScoredItem{"Drama": {{MediaItemID: "top-drama"}}},
+	}
+	r := (&Reader{repo: repo, signals: NewSignalReader(&fakeSignalRepo{}, nil)}).WithPersonalRows(false)
+	ctx := t.Context()
+
+	rows, err := r.getForYouPageRows(ctx, 7, "p1", catalog.AccessFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := rowLabels(rows); !slices.Equal(got, []string{"Popular on This Server", "Recently Added"}) {
+		t.Fatalf("rows = %v, want the global rows only", got)
+	}
+	if items, err := r.GetSimilarUsersLiked(ctx, 7, "p1", 20, catalog.AccessFilter{}); err != nil || len(items) != 0 {
+		t.Fatalf("similar users = %v, %v; want none", items, err)
+	}
+	if items, anchor, err := r.SectionBecauseYouWatched(ctx, 7, "p1", "", nil, catalog.AccessFilter{}); err != nil || len(items) != 0 || anchor != "" {
+		t.Fatalf("because you watched = %v %q, %v; want none", items, anchor, err)
+	}
+	if row, err := r.SectionTasteMatchRow(ctx, 7, "p1", "Drama", catalog.AccessFilter{}); err != nil || row == nil || row.Type != genreSamplerRowType {
+		t.Fatalf("taste match = %+v, %v; want the global genre row", row, err)
+	}
+	if row, err := r.loadSectionRow(ctx, 7, "p1", SectionKindForYouMain, ""); err != nil || row != nil {
+		t.Fatalf("for you section = %+v, %v; want none", row, err)
+	}
+	discover, err := r.GetDiscoverRows(ctx, 7, "p1", ServedRowSize, catalog.AccessFilter{})
+	if err != nil || !slices.Contains(rowLabels(discover), genreRowLabel("Drama")) {
+		t.Fatalf("discover = %v, %v; want the Drama genre row, not left out for the cached Drama taste", rowLabels(discover), err)
+	}
+	tonight, err := r.GetWatchTonight(ctx, 7, "p1", 20, catalog.AccessFilter{})
+	if err != nil || !tonight.IsCold || !slices.Equal(scoredIDs(tonight.Items), []string{"popular", "recent"}) {
+		t.Fatalf("watch tonight = %+v, %v; want the cold-start rows only", tonight, err)
+	}
+}
+
+// Watch Tonight filters a profile's cached candidates before it chooses the
+// cold-start fallback: a cache holding only titles that can no longer be
+// served, such as books cached before they left personal rows, falls back to
+// Popular and Recently Added rather than answering an empty, warm list. The
+// profile's watched set is read once for both passes.
+func TestWatchTonightFallsBackWhenFilteringEmptiesThePersonalRows(t *testing.T) {
+	repo := &fakeReaderRepo{
+		personal: map[string][]ScoredItem{RecTypeForYouMain + "|": {{MediaItemID: "cached-book", Score: 1}}},
+		global:   map[string][]ScoredItem{RecTypePopular: {{MediaItemID: "popular", Score: 1}}},
+		defaults: map[string][]ScoredItem{RecTypeRecentlyAdded: {{MediaItemID: "recent", Score: 1}}},
+		types:    map[string]string{"cached-book": "audiobook"},
+	}
+	signals := &fakeSignalRepo{}
+	r := &Reader{repo: repo, signals: NewSignalReader(signals, nil)}
+	tonight, err := r.GetWatchTonight(t.Context(), 7, "p1", 20, catalog.AccessFilter{})
+	if err != nil || !tonight.IsCold || !slices.Equal(scoredIDs(tonight.Items), []string{"popular", "recent"}) {
+		t.Fatalf("watch tonight = %+v, %v; want the cold-start rows", tonight, err)
+	}
+	if signals.watchedReads != 1 {
+		t.Fatalf("watched set read %d times, want once", signals.watchedReads)
+	}
+}
+
+// Watch Tonight's cold-start fallback reads Recently Added live, so it still
+// fills once the cached global rows expire, as they do with recommendations
+// disabled and no worker rebuilding them; the query leaves out what the
+// profile watched.
+func TestWatchTonightFallsBackToTheLiveRecentlyAddedRow(t *testing.T) {
+	repo := &fakeReaderRepo{
+		defaults: map[string][]ScoredItem{RecTypeRecentlyAdded: {{MediaItemID: "watched", Score: 2}, {MediaItemID: "recent", Score: 1}}},
+	}
+	r := (&Reader{repo: repo, signals: NewSignalReader(&fakeSignalRepo{}, watchedStore("watched"))}).WithPersonalRows(false)
+	tonight, err := r.GetWatchTonight(t.Context(), 7, "p1", 8, catalog.AccessFilter{})
+	if err != nil || !tonight.IsCold || !slices.Equal(scoredIDs(tonight.Items), []string{"recent"}) {
+		t.Fatalf("watch tonight = %+v, %v; want the live Recently Added row", tonight, err)
+	}
+	if len(repo.defaultCalls) != 1 || repo.defaultCalls[0].kind != RecTypeRecentlyAdded || !slices.Equal(repo.defaultCalls[0].exclude, []string{"watched"}) {
+		t.Fatalf("default row reads = %+v, want one Recently Added read leaving out the watched title", repo.defaultCalls)
+	}
+}
+
+// A profile with positive signals but no personal rows asks for them even at
+// level 0, since its titles may have gained embeddings since its last
+// refresh; a profile with nothing positive, or with its rows, does not.
+func TestForYouPageAsksForMissingRowsOnlyWithPositiveSignals(t *testing.T) {
+	for _, tc := range []struct {
+		name        string
+		counts      map[string]int
+		rowsCached  bool
+		wantRefresh int
+	}{
+		{"picks awaiting embeddings", map[string]int{"favorited": 3, signalCountPositiveTitles: 0}, false, 1},
+		{"level 2 without rows", map[string]int{"favorited": 3, signalCountPositiveTitles: 3}, false, 1},
+		{"level 2 with rows", map[string]int{"favorited": 3, signalCountPositiveTitles: 3}, true, 0},
+		// Every interest turned away: the main row was built, empty.
+		{"main row cached empty", map[string]int{"favorited": 3, signalCountPositiveTitles: 3}, true, 0},
+		{"watchlist only with rows", map[string]int{"watchlist": 2, signalCountPositiveTitles: 0}, true, 0},
+		{"only negative signals", map[string]int{"rated_low": 1, "watch_low": 2, signalCountPositiveTitles: 0}, false, 0},
+		{"only 3-star ratings", map[string]int{"rated_3": 2, signalCountPositiveTitles: 0}, false, 0},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			repo := &fakeReaderRepo{
+				meta:   &TasteProfileMeta{SignalCounts: tc.counts},
+				global: map[string][]ScoredItem{RecTypePopular: {{MediaItemID: "popular"}}},
+			}
+			if tc.rowsCached {
+				main := []ScoredItem{{MediaItemID: "personal-main"}}
+				if tc.name == "main row cached empty" {
+					main = []ScoredItem{}
+				}
+				repo.personal = map[string][]ScoredItem{RecTypeForYouMain + "|": main}
+			}
+			refresher := &countingReadRefresher{}
+			r := &Reader{repo: repo, refresh: refresher, signals: NewSignalReader(&fakeSignalRepo{}, nil)}
+			if _, err := r.getForYouPageRows(t.Context(), 7, "p1", catalog.AccessFilter{}); err != nil {
+				t.Fatal(err)
+			}
+			if refresher.calls != tc.wantRefresh {
+				t.Fatalf("refresh requests = %d, want %d", refresher.calls, tc.wantRefresh)
+			}
+		})
+	}
+}
+
+// filterRows leaves out what the profile watched or favorited, episodes
+// counting for their series, so rows cached before either happened are
+// cleaned. Watchlist titles stay; another profile's favorites do not count.
+func TestFilterRowsDropsWatchedAndFavoritedTitles(t *testing.T) {
+	store := &fakeSignalStore{
+		progress: []userstore.WatchProgress{
+			{ProfileID: "p1", MediaItemID: "movie-watched", Completed: true},
+			{ProfileID: "p1", MediaItemID: "episode-watched", Completed: true},
+		},
+		favorites: []userstore.Favorite{
+			{ProfileID: "p1", MediaItemID: "movie-seed-pick"},
+			{ProfileID: "p1", MediaItemID: "episode-favorite"},
+			{ProfileID: "p2", MediaItemID: "movie-plain"},
+		},
+		watchlist: []userstore.WatchlistEntry{{ProfileID: "p1", MediaItemID: "movie-watchlist"}},
+	}
+	signals := NewSignalReader(&fakeSignalRepo{canonical: map[string]string{
+		"episode-watched":  "series-watched",
+		"episode-favorite": "series-favorite",
+	}}, fakeSignalProvider{store: store})
+	r := &Reader{repo: &fakeReaderRepo{}, signals: signals}
+
+	items := func(ids ...string) []ScoredItem {
+		out := make([]ScoredItem, len(ids))
+		for i, id := range ids {
+			out[i] = ScoredItem{MediaItemID: id}
+		}
+		return out
+	}
+	rows, err := r.filterRows(t.Context(), 7, "p1", []ForYouRow{
+		{Label: "For You", Items: items("movie-watched", "series-watched", "movie-seed-pick", "series-favorite", "movie-watchlist", "movie-plain")},
+		{Label: "Because You Watched", Items: items("movie-seed-pick", "series-watched")},
+	}, catalog.AccessFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(rows) != 1 {
+		t.Fatalf("rows = %v, want only the For You row: the other held only excluded titles", rowLabels(rows))
+	}
+	var got []string
+	for _, item := range rows[0].Items {
+		got = append(got, item.MediaItemID)
+	}
+	if want := []string{"movie-watchlist", "movie-plain"}; !slices.Equal(got, want) {
+		t.Fatalf("items = %v, want %v", got, want)
+	}
+}
+
+// fakeItemRatings serves a profile's star ratings by item from memory.
+type fakeItemRatings map[string]int
+
+func (f fakeItemRatings) ListForItems(_ context.Context, _ int, _ string, itemIDs []string) (map[string]int, error) {
+	out := map[string]int{}
+	for _, id := range itemIDs {
+		if rating, ok := f[id]; ok {
+			out[id] = rating
+		}
+	}
+	return out, nil
+}
+
+// Anchors come from the latest ten completions, newest first, passing over
+// those rated two stars or lower; a 3-star title still anchors.
+func TestAnchorItemIDsPassOverDislikedCompletions(t *testing.T) {
+	recent := []string{"one-star", "liked", "three-stars", "two-stars", "next"}
+	for i := len(recent); i < 12; i++ {
+		recent = append(recent, fmt.Sprintf("older-%d", i))
+	}
+	allLow := fakeItemRatings{}
+	for _, id := range recent[:anchorCandidateLimit] {
+		allLow[id] = 1
+	}
+	signals := NewSignalReader(&fakeSignalRepo{fallbackRecentCompleted: recent}, nil)
+	for _, tc := range []struct {
+		name    string
+		ratings itemRatingReader
+		want    []string
+	}{
+		{"no ratings reader", nil, recent[:3]},
+		{"disliked passed over", fakeItemRatings{"one-star": 1, "two-stars": 2, "three-stars": 3, "liked": 5}, []string{"liked", "three-stars", "next"}},
+		// Only the latest ten are looked at, so older liked titles do not
+		// anchor a profile whose recent watching it disliked.
+		{"latest ten all disliked", allLow, []string{}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := anchorItemIDs(t.Context(), signals, tc.ratings, 7, "p1", BecauseYouWatchedAnchors)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !slices.Equal(got, tc.want) {
+				t.Fatalf("anchors = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
+
+// A title the profile marked Not interested never anchors, however it was
+// rated.
+func TestAnchorItemIDsPassOverMarkedCompletions(t *testing.T) {
+	signals := NewSignalReader(&fakeSignalRepo{
+		fallbackRecentCompleted: []string{"marked", "liked", "next", "later"},
+		fallbackMarks:           []NotInterestedMark{{MediaItemID: "marked"}},
+	}, nil)
+	got, err := anchorItemIDs(t.Context(), signals, fakeItemRatings{"marked": 5}, 7, "p1", BecauseYouWatchedAnchors)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if want := []string{"liked", "next", "later"}; !slices.Equal(got, want) {
+		t.Fatalf("anchors = %v, want %v", got, want)
+	}
+}
+
+// A title the profile rated one star never heads a Because You Watched row,
+// on Discover, in a home section or in Watch Tonight, even while the row
+// built for it is still cached; the next completion heads the row instead.
+func TestBecauseYouWatchedNeverOpensOnADislikedTitle(t *testing.T) {
+	repo := &fakeReaderRepo{personal: map[string][]ScoredItem{
+		RecTypeBecauseWatched + "|disliked": {{MediaItemID: "like-disliked", Score: 1}},
+		RecTypeBecauseWatched + "|liked":    {{MediaItemID: "like-liked", Score: 1}},
+		RecTypeBecauseWatched + "|older":    {{MediaItemID: "like-older", Score: 1}},
+	}}
+	refresher := &countingReadRefresher{}
+	r := &Reader{
+		repo:        repo,
+		ratingsRepo: fakeItemRatings{"disliked": 1},
+		refresh:     refresher,
+		signals:     NewSignalReader(&fakeSignalRepo{fallbackRecentCompleted: []string{"disliked", "liked", "older"}}, nil),
+	}
+	ctx := t.Context()
+
+	rows, err := r.GetBecauseYouWatchedRows(ctx, 7, "p1", 3, 20, catalog.AccessFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var anchors []string
+	for _, row := range rows {
+		anchors = append(anchors, row.AnchorItemID)
+	}
+	if want := []string{"liked", "older"}; !slices.Equal(anchors, want) {
+		t.Fatalf("row anchors = %v, want %v", anchors, want)
+	}
+
+	_, source, err := r.SectionBecauseYouWatched(ctx, 7, "p1", "", nil, catalog.AccessFilter{})
+	if err != nil || source != "liked" {
+		t.Fatalf("section anchor = %q, %v; want liked", source, err)
+	}
+
+	tonight, err := r.GetWatchTonight(ctx, 7, "p1", 20, catalog.AccessFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, item := range tonight.Items {
+		if item.MediaItemID == "like-disliked" {
+			t.Fatalf("Watch Tonight %v holds the disliked anchor's neighbor", tonight.Items)
+		}
+	}
+	if refresher.calls != 0 {
+		t.Fatalf("refreshes = %d, want none: the remaining anchors have rows", refresher.calls)
+	}
+
+	// Without ratings the disliked title anchors as before.
+	r.ratingsRepo = nil
+	if _, source, _ := r.SectionBecauseYouWatched(ctx, 7, "p1", "", nil, catalog.AccessFilter{}); source != "disliked" {
+		t.Fatalf("anchor without ratings = %q, want disliked", source)
+	}
+}
+
+// Two cluster rows never share a title. A lighter row that mostly repeats a
+// heavier one's served items is hidden, without asking for a rebuild; one
+// with other items is named with its next dominant genre. A row whose
+// cluster was renumbered since it was cached keeps its title.
+func TestClusterRowsWithOneTitleAreToldApartOrHidden(t *testing.T) {
+	titled := func(label string, items []ScoredItem) []ScoredItem {
+		for i := range items {
+			items[i].Reason = clusterTitle(label)
+		}
+		return items
+	}
+	heavy := titled("Family", scoredRun("f", 20))
+	// 15 of 20 shared: a Jaccard index of 15/25.
+	repeat := titled("Family", append(scoredRun("f", 15), scoredRun("r", 5)...))
+	other := titled("Family", scoredRun("o", 20))
+	stale := titled("Horror", scoredRun("h", 20))
+	repo := &fakeReaderRepo{
+		meta: &TasteProfileMeta{SignalCounts: map[string]int{signalCountPositiveTitles: ColdStartFullPersonalized}},
+		clusters: []TasteCluster{
+			{ClusterIdx: 0, Label: "Family", DominantGenres: []string{"Family", "Animation"}, TotalWeight: 2},
+			{ClusterIdx: 1, Label: "Family", DominantGenres: []string{"Family", "Animation"}, TotalWeight: 3},
+			{ClusterIdx: 2, Label: "Family", DominantGenres: []string{"Family", "Comedy", "Fantasy"}, TotalWeight: 1},
+			// The table now labels index 3 "Drama", but its cached row is
+			// the Horror build, so it cannot be renamed from the table.
+			{ClusterIdx: 3, Label: "Drama", DominantGenres: []string{"Drama", "Crime"}, TotalWeight: 0.5},
+			{ClusterIdx: 4, Label: "Horror", DominantGenres: []string{"Horror", "Thriller"}, TotalWeight: 0.8},
+		},
+		personal: map[string][]ScoredItem{
+			RecTypeForYouMain + "|":                scoredRun("main", 20),
+			RecTypeForYouClusterPrefix + "0" + "|": repeat,
+			RecTypeForYouClusterPrefix + "1" + "|": heavy,
+			RecTypeForYouClusterPrefix + "2" + "|": other,
+			RecTypeForYouClusterPrefix + "3" + "|": stale,
+			RecTypeForYouClusterPrefix + "4" + "|": titled("Horror", scoredRun("h2", 20)),
+		},
+	}
+	refresher := &countingReadRefresher{}
+	r := &Reader{repo: repo, refresh: refresher, signals: NewSignalReader(&fakeSignalRepo{}, nil)}
+
+	rows, err := r.GetForYouPage(t.Context(), 7, "p1", ServedRowSize, catalog.AccessFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []string{ForYouLabel, "Because you enjoy Family", "Because you enjoy Family, Comedy", "Because you enjoy Horror", "Because you enjoy Horror"}
+	if got := rowLabels(rows); !slices.Equal(got, want) {
+		t.Fatalf("rows = %v, want %v", got, want)
+	}
+	if rows[1].ClusterIndex != 1 {
+		t.Fatalf("kept Family row is cluster %d, want the heavier 1", rows[1].ClusterIndex)
+	}
+	renamed := rows[2]
+	if renamed.Subject != "Family, Comedy" || renamed.Items[0].Reason != renamed.Label {
+		t.Fatalf("renamed row subject %q, item reason %q", renamed.Subject, renamed.Items[0].Reason)
+	}
+	if other[0].Reason != clusterTitle("Family") {
+		t.Fatal("renaming changed the cached items")
+	}
+	if refresher.calls != 0 {
+		t.Fatalf("refreshes = %d, want none: a hidden row was built", refresher.calls)
+	}
+
+	// A row's see-all page carries the title Discover shows it under, renamed
+	// or not. The hidden repeat, which Discover does not show, keeps its own.
+	discover, err := r.GetDiscoverRows(t.Context(), 7, "p1", ServedRowSize, catalog.AccessFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	served := map[int]ForYouRow{}
+	for _, row := range discover {
+		if strings.HasPrefix(row.personalKey, RecTypeForYouClusterPrefix) {
+			served[row.ClusterIndex] = row
+		}
+	}
+	if len(served) != 4 || served[2].Label != "Because you enjoy Family, Comedy" {
+		t.Fatalf("Discover cluster rows = %v, want clusters 1 to 4 with cluster 2 renamed", rowLabels(discover))
+	}
+	for idx, want := range map[int]string{0: "Because you enjoy Family", 1: served[1].Label, 2: served[2].Label, 3: served[3].Label, 4: served[4].Label} {
+		row, err := r.GetSection(t.Context(), 7, "p1", SectionKindCluster, itoa(idx), CacheCandidateLimit, catalog.AccessFilter{})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if row == nil || row.Label != want || row.Subject != clusterSubject(want) {
+			t.Fatalf("see-all page of cluster %d = %+v, want title %q", idx, row, want)
+		}
+	}
+}
+
+// A read drops every title the profile rated, liked or not, as rows built
+// since leave them out: a title it already judged is not a recommendation.
+func TestFilterRowsDropsEveryRatedTitle(t *testing.T) {
+	r := &Reader{
+		repo:        &fakeReaderRepo{},
+		ratingsRepo: fakeItemRatings{"rated-1": 1, "rated-3": 3, "rated-5": 5},
+		signals:     NewSignalReader(&fakeSignalRepo{}, nil),
+	}
+	rows, err := r.filterRows(t.Context(), 7, "p1", []ForYouRow{{Label: ForYouLabel, Items: []ScoredItem{
+		{MediaItemID: "rated-5"}, {MediaItemID: "unrated"}, {MediaItemID: "rated-3"}, {MediaItemID: "rated-1"},
+	}}}, catalog.AccessFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(rows) != 1 || len(rows[0].Items) != 1 || rows[0].Items[0].MediaItemID != "unrated" {
+		t.Fatalf("rows = %+v, want only the unrated title", rows)
+	}
+}
diff --git a/internal/recommendations/readpath_postgres_test.go b/internal/recommendations/readpath_postgres_test.go
new file mode 100644
index 0000000000..148b4f089d
--- /dev/null
+++ b/internal/recommendations/readpath_postgres_test.go
@@ -0,0 +1,275 @@
+package recommendations
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/userstore/pgstore"
+)
+
+func seedCompletion(t *testing.T, pool *pgxpool.Pool, userID int, profile, itemID string, at time.Time) {
+	t.Helper()
+	if _, err := pool.Exec(context.Background(), `
+		INSERT INTO user_watch_progress(user_id, profile_id, media_item_id, completed, updated_at)
+		VALUES ($1, $2, $3, true, $4)`, userID, profile, itemID, at); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// Anchors are titles still in the catalog: a deleted movie and the episodes
+// of a deleted series are passed over on both the SQL path and the user
+// store path, which pages past them.
+func TestRecentCompletedItemIDsSkipDeletedItemsPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	prefix := "tlive-anchor-" + uuid.NewString()[:8] + "-"
+	cleanupRecoMediaItems(t, pool, prefix)
+	userID, profile := newTasteTestAccount(t, pool, prefix)
+
+	movieA, movieB, movieC, series := prefix+"movie-a", prefix+"movie-b", prefix+"movie-c", prefix+"series"
+	for _, id := range []string{movieA, movieB, movieC} {
+		seedRecoMediaItem(t, pool, id, "movie", "matched")
+	}
+	seedRecoMediaItem(t, pool, series, "series", "matched")
+	episodes := []string{prefix + "s1e1", prefix + "s1e2"}
+	for i, ep := range episodes {
+		if _, err := pool.Exec(ctx, `INSERT INTO episodes(content_id, series_id, season_number, episode_number, title) VALUES ($1, $2, 1, $3, 'Episode')`, ep, series, i+1); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	base := time.Date(2026, 8, 10, 12, 0, 0, 0, time.UTC)
+	seedCompletion(t, pool, userID, profile, movieC, base)
+	seedCompletion(t, pool, userID, profile, episodes[1], base.Add(-time.Minute))
+	seedCompletion(t, pool, userID, profile, episodes[0], base.Add(-2*time.Minute))
+	seedCompletion(t, pool, userID, profile, movieB, base.Add(-3*time.Minute))
+	seedCompletion(t, pool, userID, profile, movieA, base.Add(-4*time.Minute))
+
+	repo := NewRepo(pool)
+	storePath := NewSignalReader(repo, pgstore.NewPostgresProvider(pool))
+	before, err := storePath.RecentCompletedItemIDs(ctx, userID, profile, 3)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if want := []string{movieC, series, movieB}; !slices.Equal(before, want) {
+		t.Fatalf("anchors before the deletes = %v, want %v", before, want)
+	}
+
+	// Deleting the series cascades its episodes, so their progress no
+	// longer rolls up to it.
+	if _, err := pool.Exec(ctx, `DELETE FROM media_items WHERE content_id = ANY($1)`, []string{movieC, series}); err != nil {
+		t.Fatal(err)
+	}
+	want := []string{movieB, movieA}
+	sqlPath, err := repo.GetRecentCompletedItemIDs(ctx, userID, profile, 3)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !slices.Equal(sqlPath, want) {
+		t.Fatalf("SQL path anchors = %v, want %v", sqlPath, want)
+	}
+	viaStore, err := storePath.RecentCompletedItemIDs(ctx, userID, profile, 3)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !slices.Equal(viaStore, want) {
+		t.Fatalf("store path anchors = %v, want %v", viaStore, want)
+	}
+
+	existing, err := repo.RecommendableItemIDs(ctx, []string{movieA, movieC, episodes[0], series})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(existing) != 1 {
+		t.Fatalf("existing = %v, want only %s", existing, movieA)
+	}
+	if _, ok := existing[movieA]; !ok {
+		t.Fatalf("existing = %v, want %s", existing, movieA)
+	}
+}
+
+func cowatchPairsFor(t *testing.T, pool *pgxpool.Pool, prefix string) map[string]float64 {
+	t.Helper()
+	rows, err := pool.Query(context.Background(), `
+		SELECT item_id, similar_item_id, jaccard_score
+		FROM   item_cowatch
+		WHERE  item_id LIKE $1 OR similar_item_id LIKE $1`, prefix+"%")
+	if err != nil {
+		t.Fatal(err)
+	}
+	pairs := map[string]float64{}
+	for rows.Next() {
+		var item, similar string
+		var score float64
+		if err := rows.Scan(&item, &similar, &score); err != nil {
+			t.Fatal(err)
+		}
+		pairs[item+">"+similar] = score
+	}
+	if err := rows.Err(); err != nil {
+		t.Fatal(err)
+	}
+	return pairs
+}
+
+// The co-watch job never pairs a deleted item, and each run leaves only the
+// pairs it wrote: pairs for items deleted since, and pairs that fell below
+// the shared-watcher floor, are gone after the next run.
+func TestCowatchSkipsDeletedItemsAndPrunesStalePairsPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	prefix := "tcowatch-" + uuid.NewString()[:8] + "-"
+	cleanupRecoMediaItems(t, pool, prefix)
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM item_cowatch WHERE item_id LIKE $1 OR similar_item_id LIKE $1`, prefix+"%")
+	})
+
+	x, y, z, dead := prefix+"x", prefix+"y", prefix+"z", prefix+"dead"
+	for _, id := range []string{x, y, z, dead} {
+		seedRecoMediaItem(t, pool, id, "movie", "matched")
+	}
+	type watcher struct {
+		userID  int
+		profile string
+	}
+	watchers := make([]watcher, DefaultMinWatchers)
+	at := time.Now().Add(-time.Hour)
+	for i := range watchers {
+		userID, profile := newTasteTestAccount(t, pool, prefix)
+		watchers[i] = watcher{userID, profile}
+		for _, id := range []string{x, y, z, dead} {
+			seedCompletion(t, pool, userID, profile, id, at)
+		}
+	}
+	if _, err := pool.Exec(ctx, `DELETE FROM media_items WHERE content_id = $1`, dead); err != nil {
+		t.Fatal(err)
+	}
+	// A pair an earlier run left for an item deleted since.
+	if _, err := pool.Exec(ctx, `
+		INSERT INTO item_cowatch(item_id, similar_item_id, jaccard_score, cowatch_count, updated_at)
+		VALUES ($1, $2, 0.9, 9, NOW() - INTERVAL '2 days')`, x, prefix+"merged-away"); err != nil {
+		t.Fatal(err)
+	}
+
+	w := &Worker{engine: &Engine{repo: NewRepo(pool)}}
+	if _, err := w.doCowatch(ctx, fakeClusterLock{}); err != nil {
+		t.Fatal(err)
+	}
+	got := cowatchPairsFor(t, pool, prefix)
+	want := map[string]float64{x + ">" + y: 1, x + ">" + z: 1, y + ">" + x: 1, y + ">" + z: 1, z + ">" + x: 1, z + ">" + y: 1}
+	if len(got) != len(want) {
+		t.Fatalf("pairs = %v, want %v", got, want)
+	}
+	for pair, score := range want {
+		if got[pair] != score {
+			t.Fatalf("pairs = %v, want %v", got, want)
+		}
+	}
+
+	// z loses watchers until too few accounts share it; its pairs go.
+	for _, wt := range watchers[:3] {
+		if _, err := pool.Exec(ctx, `DELETE FROM user_watch_progress WHERE user_id = $1 AND media_item_id = $2`, wt.userID, z); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if _, err := w.doCowatch(ctx, fakeClusterLock{}); err != nil {
+		t.Fatal(err)
+	}
+	got = cowatchPairsFor(t, pool, prefix)
+	if len(got) != 2 || got[x+">"+y] != 1 || got[y+">"+x] != 1 {
+		t.Fatalf("pairs after the second run = %v, want only x and y paired", got)
+	}
+}
+
+// The cluster read without embeddings answers every other field the full
+// read does.
+func TestGetTasteClusterMetaOmitsOnlyEmbeddingsPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	userID, profile := newTasteTestAccount(t, pool, "tcluster-meta-")
+	repo := NewRepo(pool)
+	clusters := []TasteCluster{
+		{ClusterIdx: 0, Embedding: axisVector(0, nil), DominantGenres: []string{"Drama", "Crime"}, Label: "Drama", MemberCount: 4, TotalWeight: 2.5},
+		{ClusterIdx: 1, Embedding: axisVector(1, nil), DominantGenres: []string{"Comedy"}, Label: "Comedy", MemberCount: 2, TotalWeight: 1.25},
+	}
+	if err := repo.UpsertTasteClusters(ctx, userID, profile, clusters); err != nil {
+		t.Fatal(err)
+	}
+	full, err := repo.GetTasteClusters(ctx, userID, profile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	meta, err := repo.GetTasteClusterMeta(ctx, userID, profile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(full) != 2 || len(meta) != 2 {
+		t.Fatalf("clusters: full %d, meta %d; want 2 each", len(full), len(meta))
+	}
+	for i := range full {
+		if len(full[i].Embedding) == 0 || meta[i].Embedding != nil {
+			t.Fatalf("cluster %d: full embedding %d dims, meta embedding %v; want only the full read to carry it", i, len(full[i].Embedding), meta[i].Embedding)
+		}
+		full[i].Embedding = nil
+		if fmt.Sprint(full[i]) != fmt.Sprint(meta[i]) {
+			t.Fatalf("cluster %d: meta %+v, want %+v", i, meta[i], full[i])
+		}
+	}
+}
+
+// The watched set walks the user store by keyset across pages: every row
+// at least half watched counts, episodes for their series.
+func TestWatchedItemIDSetAcrossPagesPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	prefix := "twatched-keyset-" + uuid.NewString()[:8] + "-"
+	cleanupRecoMediaItems(t, pool, prefix)
+	userID, profile := newTasteTestAccount(t, pool, prefix)
+	series := prefix + "series"
+	seedRecoMediaItem(t, pool, series, "series", "matched")
+	episode := prefix + "episode"
+	if _, err := pool.Exec(ctx, `INSERT INTO episodes(content_id, series_id, season_number, episode_number, title) VALUES ($1, $2, 1, 1, 'Pilot')`, episode, series); err != nil {
+		t.Fatal(err)
+	}
+
+	// 2,500 rows, ten per second so page edges fall inside updated_at ties:
+	// every third row completed, every third half watched, the rest barely
+	// started.
+	const rows = 2500
+	if _, err := pool.Exec(ctx, `
+		INSERT INTO user_watch_progress(user_id, profile_id, media_item_id, position_seconds, duration_seconds, completed, updated_at)
+		SELECT $1, $2, $3 || lpad(i::text, 5, '0'),
+		       CASE i % 3 WHEN 1 THEN 60 WHEN 2 THEN 10 ELSE 0 END,
+		       100,
+		       i % 3 = 0,
+		       TIMESTAMPTZ '2026-08-10 00:00:00Z' - (i / 10) * INTERVAL '1 second'
+		FROM generate_series(0, $4 - 1) AS i`, userID, profile, prefix+"item-", rows); err != nil {
+		t.Fatal(err)
+	}
+	seedCompletion(t, pool, userID, profile, episode, time.Date(2026, 8, 10, 0, 0, 0, 0, time.UTC))
+
+	got, err := NewSignalReader(NewRepo(pool), pgstore.NewPostgresProvider(pool)).WatchedItemIDSet(ctx, userID, profile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := map[string]struct{}{series: {}}
+	for i := range rows {
+		if i%3 != 2 {
+			want[fmt.Sprintf("%sitem-%05d", prefix, i)] = struct{}{}
+		}
+	}
+	if len(got) != len(want) {
+		t.Fatalf("watched set has %d items, want %d", len(got), len(want))
+	}
+	for id := range want {
+		if _, ok := got[id]; !ok {
+			t.Fatalf("watched set misses %s", id)
+		}
+	}
+}
diff --git a/internal/recommendations/refresh_now_test.go b/internal/recommendations/refresh_now_test.go
new file mode 100644
index 0000000000..6e7cd65afe
--- /dev/null
+++ b/internal/recommendations/refresh_now_test.go
@@ -0,0 +1,247 @@
+package recommendations
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+)
+
+// blockingRefresh is a profile refresh that runs until released, recording
+// the error of the context it ran with.
+type blockingRefresh struct {
+	started  chan struct{}
+	release  chan struct{}
+	finished chan error
+}
+
+func newBlockingRefresh() *blockingRefresh {
+	return &blockingRefresh{started: make(chan struct{}, 1), release: make(chan struct{}), finished: make(chan error, 1)}
+}
+
+func (b *blockingRefresh) run(ctx context.Context, _ clusterLock, _ int, _ string) error {
+	b.started <- struct{}{}
+	<-b.release
+	b.finished <- ctx.Err()
+	return nil
+}
+
+func receive[T any](t *testing.T, ch <-chan T, what string) T {
+	t.Helper()
+	select {
+	case v := <-ch:
+		return v
+	case <-time.After(10 * time.Second):
+		t.Fatalf("timed out waiting for %s", what)
+		var zero T
+		return zero
+	}
+}
+
+// eventually polls cond until it holds, failing after a few seconds.
+func eventually(t *testing.T, what string, cond func() bool) {
+	t.Helper()
+	deadline := time.Now().Add(5 * time.Second)
+	for !cond() {
+		if time.Now().After(deadline) {
+			t.Fatalf("timed out waiting for %s", what)
+		}
+		time.Sleep(time.Millisecond)
+	}
+}
+
+// RefreshProfileNow waits for the refresh it starts, and holds the profile's
+// pending key while it runs, so neither the queue nor a second call starts a
+// duplicate on this server; their requests make it run once more instead.
+func TestRefreshNowWaitsAndHoldsThePendingKey(t *testing.T) {
+	w, _ := newRefreshTestWorker()
+	ctx := t.Context()
+	refresh := newBlockingRefresh()
+
+	result := make(chan bool, 1)
+	go func() { result <- w.refreshNow(ctx, 7, "p", time.Hour, refresh.run) }()
+	receive(t, refresh.started, "the refresh to start")
+
+	w.RequestProfileRefresh(ctx, 7, "p")
+	assertNothingQueued(t, w, "queue request during the refresh")
+	if w.refreshNow(ctx, 7, "p", time.Hour, func(context.Context, clusterLock, int, string) error {
+		t.Error("a second refresh ran beside the first")
+		return nil
+	}) {
+		t.Fatal("a second call reported a refresh it did not run")
+	}
+
+	close(refresh.release)
+	receive(t, refresh.finished, "the refresh to finish")
+	// The requests made while it ran make it run once more.
+	receive(t, refresh.finished, "the refresh to run again")
+	if !receive(t, result, "the call to return") {
+		t.Fatal("call reported the finished refresh as unfinished")
+	}
+	if !w.claimProfileRefresh(profileRefreshKey(7, "p")) {
+		t.Fatal("the pending key outlived the refresh")
+	}
+	if n := w.refreshesNow.Load(); n != 0 {
+		t.Fatalf("%d refresh slots still held", n)
+	}
+}
+
+// A refresh slower than the wait keeps running after the call returns, with
+// a context the caller cannot cancel, and is not queued again. The same holds
+// when the caller goes away first.
+func TestRefreshNowLeavesASlowRefreshRunning(t *testing.T) {
+	for name, waitFor := range map[string]time.Duration{"wait runs out": time.Millisecond, "caller leaves": time.Hour} {
+		t.Run(name, func(t *testing.T) {
+			w, _ := newRefreshTestWorker()
+			ctx, cancel := context.WithCancel(t.Context())
+			refresh := newBlockingRefresh()
+
+			result := make(chan bool, 1)
+			go func() { result <- w.refreshNow(ctx, 7, "p", waitFor, refresh.run) }()
+			receive(t, refresh.started, "the refresh to start")
+			cancel()
+			if receive(t, result, "the call to return") {
+				t.Fatal("call reported a refresh that was still running")
+			}
+			if w.claimProfileRefresh(profileRefreshKey(7, "p")) {
+				t.Fatal("the pending key was released while the refresh ran")
+			}
+
+			close(refresh.release)
+			if err := receive(t, refresh.finished, "the refresh to finish"); err != nil {
+				t.Fatalf("refresh context ended with the caller: %v", err)
+			}
+			eventually(t, "the refresh to release its key and slot", func() bool {
+				return w.refreshesNow.Load() == 0 && w.claimProfileRefresh(profileRefreshKey(7, "p"))
+			})
+			assertNothingQueued(t, w, "after a slow refresh")
+		})
+	}
+}
+
+// Past maxRefreshesNow running refreshes, a call queues the refresh instead
+// of starting another.
+func TestRefreshNowQueuesWhenTheServerIsBusy(t *testing.T) {
+	w, _ := newRefreshTestWorker()
+	w.refreshesNow.Store(maxRefreshesNow)
+	if w.refreshNow(t.Context(), 7, "p", time.Hour, func(context.Context, clusterLock, int, string) error {
+		t.Error("refresh ran past the limit")
+		return nil
+	}) {
+		t.Fatal("call reported a refresh it did not run")
+	}
+	if req := takeQueued(t, w); req.userID != 7 || req.profileID != "p" {
+		t.Fatalf("queued %+v", req)
+	}
+	if n := w.refreshesNow.Load(); n != maxRefreshesNow {
+		t.Fatalf("slots = %d, want %d", n, maxRefreshesNow)
+	}
+}
+
+// RefreshProfileNow marks the profile stale before it refreshes, as
+// NotifySignalsChanged does, so a server that dies mid-refresh leaves the
+// mark for another server's sweep. A failed refresh marks it again.
+func TestRefreshProfileNowMarksStaleFirst(t *testing.T) {
+	w, marker := newRefreshTestWorker()
+	marker.w = nil
+	w.engine = closedPoolEngine(t)
+	if !w.RefreshProfileNow(t.Context(), 7, "p") {
+		t.Fatal("refresh against a closed database did not finish within the wait")
+	}
+	if marker.calls != 2 {
+		t.Fatalf("stale marks = %d, want one before the refresh and one after it failed", marker.calls)
+	}
+
+	var disabled *Worker
+	if disabled.RefreshProfileNow(t.Context(), 7, "p") {
+		t.Fatal("a nil worker reported a refresh")
+	}
+	if w.RefreshProfileNow(t.Context(), 0, "p") || w.RefreshProfileNow(t.Context(), 7, "") {
+		t.Fatal("an invalid profile was refreshed")
+	}
+	if marker.calls != 2 {
+		t.Fatalf("stale marks for invalid profiles = %d, want none", marker.calls-2)
+	}
+}
+
+// A taste-seed request canceled after its picks were committed still leaves
+// the stale mark, written with a live context, and still queues the refresh
+// when the server is too busy to start it, so the picks are applied.
+func TestRefreshProfileNowMarksAndQueuesAfterTheCallerGaveUp(t *testing.T) {
+	w, marker := newRefreshTestWorker()
+	marker.w = nil
+	w.refreshesNow.Store(maxRefreshesNow)
+	ctx, cancel := context.WithCancel(t.Context())
+	cancel()
+
+	if w.RefreshProfileNow(ctx, 7, "p") {
+		t.Fatal("call reported a refresh it did not run")
+	}
+	if marker.calls != 1 || marker.ctxErrs[0] != nil {
+		t.Fatalf("stale marks = %d with context errors %v; want one with a live context", marker.calls, marker.ctxErrs)
+	}
+	if req := takeQueued(t, w); req.userID != 7 || req.profileID != "p" {
+		t.Fatalf("queued %+v", req)
+	}
+}
+
+// A refresh request made while a profile's refresh runs makes it run once
+// more as soon as it ends, instead of leaving the change to the stale sweep;
+// a request made while the refresh is only queued is read by it, so it adds
+// no run.
+func TestProfileRefreshRunsAgainForAChangeMadeWhileItRuns(t *testing.T) {
+	w := newJobTestWorker(&fakeLocker{}, nil)
+	w.engine = &Engine{}
+	refresh := newBlockingRefresh()
+	key := profileRefreshKey(1, "p")
+	if !w.claimProfileRefresh(key) {
+		t.Fatal("could not claim the profile refresh")
+	}
+	w.RequestProfileRefresh(t.Context(), 1, "p") // while queued
+
+	done := make(chan struct{})
+	go func() {
+		_ = w.runProfileRefresh(context.Background(), nil, 1, "p", refresh.run)
+		close(done)
+	}()
+	receive(t, refresh.started, "the first run")
+	w.RequestProfileRefresh(t.Context(), 1, "p") // while running
+	refresh.release <- struct{}{}
+	receive(t, refresh.finished, "the first run to finish")
+
+	receive(t, refresh.started, "a second run")
+	refresh.release <- struct{}{}
+	receive(t, refresh.finished, "the second run to finish")
+	receive(t, done, "the refresh to end after two runs")
+	if !w.claimProfileRefresh(key) {
+		t.Fatal("the pending key was not released")
+	}
+}
+
+// A profile still changing after profileRefreshMaxRuns runs is left for the
+// stale sweep: the refresh stops and releases the key rather than looping
+// for as long as the changes keep coming.
+func TestProfileRefreshStopsRerunningAfterTheCap(t *testing.T) {
+	w := newJobTestWorker(&fakeLocker{}, nil)
+	w.engine = &Engine{}
+	refresh := newBlockingRefresh()
+	key := profileRefreshKey(1, "p")
+	if !w.claimProfileRefresh(key) {
+		t.Fatal("could not claim the profile refresh")
+	}
+	done := make(chan struct{})
+	go func() {
+		_ = w.runProfileRefresh(context.Background(), nil, 1, "p", refresh.run)
+		close(done)
+	}()
+	for run := 1; run <= profileRefreshMaxRuns; run++ {
+		receive(t, refresh.started, fmt.Sprintf("run %d", run))
+		w.RequestProfileRefresh(t.Context(), 1, "p") // a change on every run
+		refresh.release <- struct{}{}
+		receive(t, refresh.finished, fmt.Sprintf("run %d to finish", run))
+	}
+	receive(t, done, "the refresh to stop at the cap")
+	if !w.claimProfileRefresh(key) {
+		t.Fatal("the pending key was not released")
+	}
+}
diff --git a/internal/recommendations/relevance_postgres_test.go b/internal/recommendations/relevance_postgres_test.go
new file mode 100644
index 0000000000..b73c96d39d
--- /dev/null
+++ b/internal/recommendations/relevance_postgres_test.go
@@ -0,0 +1,567 @@
+package recommendations
+
+import (
+	"encoding/json"
+	"fmt"
+	"maps"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/config"
+	"github.com/prairie-server/prairie-server/internal/userstore/pgstore"
+)
+
+// Postgres checks of what reaches a profile, after the background refresh
+// that builds its rows: nothing it watched, favorited or may not see, rows
+// that differ between two profiles of one account, and rows for a profile
+// on its first request. The metrics are defined in
+// docs/architecture/recommendations-evaluation.md; the bounds here are loose
+// regression guards, not the validators' thresholds.
+
+// relevanceFixture holds the engine, worker and reader of one test, reading
+// signals through the Postgres user store as production does.
+type relevanceFixture struct {
+	pool   *pgxpool.Pool
+	repo   *Repo
+	engine *Engine
+	worker *Worker
+	reader *Reader
+	prefix string
+}
+
+func newRelevanceFixture(t *testing.T, name string) *relevanceFixture {
+	t.Helper()
+	pool := newEngineTestPool(t)
+	prefix := "trel-" + name + "-" + uuid.NewString()[:8] + "-"
+	cleanupRecoMediaItems(t, pool, prefix)
+	store := pgstore.NewPostgresProvider(pool)
+	ratings := catalog.NewRatingsRepo(pool)
+	engine := NewEngine(pool, ratings, catalog.NewItemRepository(pool), nil, store, config.RecommendationsConfig{DiversityLambda: 0.7})
+	w := newJobTestWorker(&fakeLocker{}, nil)
+	w.engine = engine
+	w.staleMarker = engine.repo
+	return &relevanceFixture{
+		pool:   pool,
+		repo:   engine.repo,
+		engine: engine,
+		worker: w,
+		reader: NewReader(engine.repo, ratings, nil, store),
+		prefix: prefix,
+	}
+}
+
+// movie seeds an embedded, matched movie with the given genres and rating at
+// vec, and returns its content ID.
+func (f *relevanceFixture) movie(t *testing.T, name string, genres []string, rating string, ratingAge int, vec []float32) string {
+	t.Helper()
+	id := f.prefix + name
+	seedRecoMediaItem(t, f.pool, id, "movie", "matched")
+	if _, err := f.pool.Exec(t.Context(), `UPDATE media_items SET genres = $2, content_rating = $3, content_rating_age = $4 WHERE content_id = $1`, id, genres, rating, ratingAge); err != nil {
+		t.Fatal(err)
+	}
+	if err := f.repo.UpsertEmbedding(t.Context(), id, vec, "test-model", id); err != nil {
+		t.Fatal(err)
+	}
+	return id
+}
+
+// profile adds a profile to the account, with a rating ceiling when
+// maxRating is set.
+func (f *relevanceFixture) profile(t *testing.T, userID int, name, maxRating string) string {
+	t.Helper()
+	id := uuid.NewString()
+	if _, err := f.pool.Exec(t.Context(), `INSERT INTO user_profiles(id, user_id, name, max_content_rating) VALUES($1, $2, $3, $4)`, id, userID, name, maxRating); err != nil {
+		t.Fatalf("insert profile: %v", err)
+	}
+	return id
+}
+
+// finish records completed watches of items, the first most recently.
+func (f *relevanceFixture) finish(t *testing.T, userID int, profileID string, items ...string) {
+	t.Helper()
+	for i, id := range items {
+		if _, err := f.pool.Exec(t.Context(), `
+			INSERT INTO user_watch_progress(user_id, profile_id, media_item_id, completed, updated_at)
+			VALUES ($1, $2, $3, true, NOW() - $4 * INTERVAL '1 hour')`, userID, profileID, id, i+1); err != nil {
+			t.Fatal(err)
+		}
+	}
+}
+
+func (f *relevanceFixture) favorite(t *testing.T, userID int, profileID string, items ...string) {
+	t.Helper()
+	for _, id := range items {
+		if _, err := f.pool.Exec(t.Context(), `INSERT INTO user_favorites(user_id, profile_id, media_item_id) VALUES($1, $2, $3)`, userID, profileID, id); err != nil {
+			t.Fatal(err)
+		}
+	}
+}
+
+// cachedPersonalRows returns the item IDs of every row cached for the
+// profile, keyed by row type and anchor.
+func (f *relevanceFixture) cachedPersonalRows(t *testing.T, userID int, profileID string) map[string][]string {
+	t.Helper()
+	rows, err := f.pool.Query(t.Context(), `
+		SELECT rec_type, source_item_id, items FROM recommendation_cache
+		WHERE  user_id = $1 AND profile_id = $2`, userID, profileID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer rows.Close()
+	cached := map[string][]string{}
+	for rows.Next() {
+		var recType, source string
+		var raw []byte
+		if err := rows.Scan(&recType, &source, &raw); err != nil {
+			t.Fatal(err)
+		}
+		var items []ScoredItem
+		if err := json.Unmarshal(raw, &items); err != nil {
+			t.Fatal(err)
+		}
+		cached[recType+"|"+source] = scoredIDs(items)
+	}
+	if err := rows.Err(); err != nil {
+		t.Fatal(err)
+	}
+	return cached
+}
+
+// servedRows reads what the profile is served: the For You page, Discover,
+// Because You Watched and Similar Users, under its own access filter.
+func (f *relevanceFixture) servedRows(t *testing.T, userID int, profileID string) map[string][]string {
+	t.Helper()
+	ctx := t.Context()
+	filter, err := f.engine.profileAccessFilter(ctx, userID, profileID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	served := map[string][]string{}
+	add := func(source string, rows []ForYouRow, err error) {
+		t.Helper()
+		if err != nil {
+			t.Fatalf("%s: %v", source, err)
+		}
+		for i, row := range rows {
+			served[fmt.Sprintf("%s %d %s %s", source, i, row.Type, row.Label)] = scoredIDs(row.Items)
+		}
+	}
+	page, err := f.reader.GetForYouPage(ctx, userID, profileID, 50, filter)
+	add("page", page, err)
+	discover, err := f.reader.GetDiscoverRows(ctx, userID, profileID, 50, filter)
+	add("discover", discover, err)
+	watched, err := f.reader.GetBecauseYouWatchedRows(ctx, userID, profileID, 3, 50, filter)
+	add("because-watched", watched, err)
+	similar, err := f.reader.GetSimilarUsersLiked(ctx, userID, profileID, 50, filter)
+	add("similar-users", []ForYouRow{{Type: "similar_users_liked", Items: similar}}, err)
+	return served
+}
+
+// personalIDs is every item of the profile's personal rows on the page.
+func personalIDs(rows []ForYouRow) []string {
+	var ids []string
+	for _, row := range rows {
+		if row.Type == "cluster" || row.Type == "similar_users_liked" {
+			ids = append(ids, scoredIDs(row.Items)...)
+		}
+	}
+	return ids
+}
+
+// jaccard is the share of the distinct titles of a and b that both hold.
+func jaccard(a, b []string) float64 {
+	inA := map[string]bool{}
+	for _, id := range a {
+		inA[id] = true
+	}
+	union, shared := maps.Clone(inA), map[string]bool{}
+	for _, id := range b {
+		if inA[id] {
+			shared[id] = true
+		}
+		union[id] = true
+	}
+	if len(union) == 0 {
+		return 0
+	}
+	return float64(len(shared)) / float64(len(union))
+}
+
+// A full refresh caches no row holding a title the profile finished,
+// favorited or may not see, and the rows it is served hold none either.
+// The fixture puts R-rated titles nearest the taste of a PG profile and
+// three peers behind an R title and a watched one, so a row built or read
+// without the filters would carry them.
+func TestRelevanceRubricLeakagePostgres(t *testing.T) {
+	f := newRelevanceFixture(t, "leak")
+	ctx := t.Context()
+	const axis = 2700
+	genres := [][]string{{"Animation"}, {"Family"}, {"Adventure"}}
+
+	var kids, adult []string
+	for i := range 24 {
+		kids = append(kids, f.movie(t, fmt.Sprintf("kids-%02d", i), genres[i%3], "G", 0, axisVector(axis, map[int]float32{axis + 1 + i: 0.05})))
+	}
+	for i := range 12 {
+		adult = append(adult, f.movie(t, fmt.Sprintf("adult-%02d", i), genres[i%3], "R", 17, axisVector(axis, map[int]float32{axis + 40 + i: 0.01})))
+	}
+
+	userID, _ := newTasteTestAccount(t, f.pool, f.prefix+"account-")
+	kid := f.profile(t, userID, "Kid", "PG")
+	finished, favorited := kids[:10], kids[10:12]
+	f.finish(t, userID, kid, finished...)
+	f.favorite(t, userID, kid, favorited...)
+
+	// Three peer accounts share the taste and rate an R title, a title the
+	// kid finished and an open one.
+	for i := range minSimilarUsersPeerAccounts {
+		peerID, peer := newTasteTestAccount(t, f.pool, fmt.Sprintf("%speer-%d-", f.prefix, i))
+		if err := f.repo.UpsertTasteProfile(ctx, peerID, peer, axisVector(axis, nil), map[string]int{"rated_5": 3}, "", time.Now()); err != nil {
+			t.Fatal(err)
+		}
+		for _, item := range []string{adult[0], finished[0], kids[12]} {
+			if _, err := f.pool.Exec(ctx, `INSERT INTO user_ratings(user_id, profile_id, media_item_id, rating) VALUES($1, $2, $3, 5)`, peerID, peer, item); err != nil {
+				t.Fatal(err)
+			}
+		}
+	}
+
+	if err := f.worker.refreshProfile(ctx, nil, userID, kid); err != nil {
+		t.Fatalf("refresh: %v", err)
+	}
+
+	leaked := map[string]string{}
+	for _, id := range finished {
+		leaked[id] = "finished"
+	}
+	for _, id := range favorited {
+		leaked[id] = "favorited"
+	}
+	for _, id := range adult {
+		leaked[id] = "above the profile's rating ceiling"
+	}
+	check := func(stage string, rows map[string][]string) {
+		t.Helper()
+		for key, ids := range rows {
+			for _, id := range ids {
+				if why, ok := leaked[id]; ok {
+					t.Errorf("%s row %q holds %s, which is %s", stage, key, id, why)
+				}
+			}
+		}
+	}
+
+	cached := f.cachedPersonalRows(t, userID, kid)
+	// The rows were built: a main row, a Because You Watched row per anchor
+	// and a Similar Users row with the open title the peers rated.
+	if len(cached[RecTypeForYouMain+"|"]) < 10 {
+		t.Fatalf("main row = %v, want a built row of at least 10 titles", cached[RecTypeForYouMain+"|"])
+	}
+	if len(cached[RecTypeBecauseWatched+"|"+finished[0]]) == 0 {
+		t.Fatalf("cached rows %v, want a Because You Watched row for the latest watch", slices.Collect(maps.Keys(cached)))
+	}
+	if !slices.Contains(cached[RecTypeSimilarUsersLiked+"|"], kids[12]) {
+		t.Errorf("Similar Users = %v, want the open title the peers rated", cached[RecTypeSimilarUsersLiked+"|"])
+	}
+	check("cached", cached)
+	check("served", f.servedRows(t, userID, kid))
+}
+
+// Two profiles of one account with distinct histories get distinct personal
+// rows: their served For You rows share at most a fifth of their titles.
+// The fixture's tastes are orthogonal, so the expected overlap is none.
+func TestRelevanceRubricProfilesOnOneAccountDifferPostgres(t *testing.T) {
+	f := newRelevanceFixture(t, "jaccard")
+	ctx := t.Context()
+	const maxJaccard = 0.2
+
+	taste := func(axis int, name string, genres [][]string) []string {
+		var ids []string
+		for i := range 45 {
+			ids = append(ids, f.movie(t, fmt.Sprintf("%s-%02d", name, i), genres[i%len(genres)], "PG-13", 13, axisVector(axis, map[int]float32{axis + 1 + i: 0.05})))
+		}
+		return ids
+	}
+	scifi := taste(2800, "scifi", [][]string{{"Science Fiction"}, {"Thriller"}, {"Mystery"}})
+	comedy := taste(2900, "comedy", [][]string{{"Comedy"}, {"Romance"}, {"Family"}})
+
+	userID, _ := newTasteTestAccount(t, f.pool, f.prefix+"account-")
+	a := f.profile(t, userID, "A", "")
+	b := f.profile(t, userID, "B", "")
+	f.finish(t, userID, a, scifi[:12]...)
+	f.finish(t, userID, b, comedy[:12]...)
+	for _, p := range []string{a, b} {
+		if err := f.worker.refreshProfile(ctx, nil, userID, p); err != nil {
+			t.Fatalf("refresh %s: %v", p, err)
+		}
+	}
+
+	read := func(profileID string) (main, personal []string) {
+		t.Helper()
+		filter := catalog.AccessFilter{UserID: userID, ProfileID: profileID}
+		row, err := f.reader.GetForYouMain(ctx, userID, profileID, 20, filter)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if row == nil || row.Type != "cluster" {
+			t.Fatalf("profile %s main row = %+v, want a personal row", profileID, row)
+		}
+		page, err := f.reader.GetForYouPage(ctx, userID, profileID, 20, filter)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return scoredIDs(row.Items), personalIDs(page)
+	}
+	mainA, personalA := read(a)
+	mainB, personalB := read(b)
+	if len(mainA) < 10 || len(mainB) < 10 {
+		t.Fatalf("main rows hold %d and %d titles, want at least 10 each", len(mainA), len(mainB))
+	}
+	if j := jaccard(mainA, mainB); j > maxJaccard {
+		t.Errorf("main rows overlap: Jaccard %.2f > %.2f\nA %v\nB %v", j, maxJaccard, mainA, mainB)
+	}
+	if j := jaccard(personalA, personalB); j > maxJaccard {
+		t.Errorf("personal rows overlap: Jaccard %.2f > %.2f", j, maxJaccard)
+	}
+}
+
+// A profile with no history gets a row of at least 10 titles on its first
+// request, from what the worker builds at startup and nightly, with no
+// refresh of its own. After a taste seed, the refresh the submission waits
+// for leaves a personal row on the next read that holds none of the picks.
+func TestRelevanceRubricNewProfileGetsRowsPostgres(t *testing.T) {
+	f := newRelevanceFixture(t, "new")
+	ctx := t.Context()
+	const axis = 3000
+	genres := [][]string{{"Drama"}, {"Crime"}, {"Comedy"}}
+	var titles []string
+	for i := range 20 {
+		titles = append(titles, f.movie(t, fmt.Sprintf("title-%02d", i), genres[i%3], "PG", 8, axisVector(axis, map[int]float32{axis + 1 + i: 0.05})))
+	}
+
+	f.worker.cacheGlobalRows(ctx, f.repo, cacheExpiry(time.Now()))
+
+	userID, _ := newTasteTestAccount(t, f.pool, f.prefix+"account-")
+	newcomer := f.profile(t, userID, "New", "")
+	if meta, err := f.repo.GetTasteProfileMeta(ctx, userID, newcomer); err != nil || meta != nil {
+		t.Fatalf("taste profile before any signal = %+v, %v; want none", meta, err)
+	}
+	filter := catalog.AccessFilter{UserID: userID, ProfileID: newcomer}
+	rows, err := f.reader.GetDiscoverRows(ctx, userID, newcomer, 20, filter)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !slices.ContainsFunc(rows, func(row ForYouRow) bool { return len(row.Items) >= 10 }) {
+		t.Fatalf("first Discover read = %d rows %v, want one of at least 10 titles", len(rows), rowSizes(rows))
+	}
+
+	picks := titles[:3]
+	f.favorite(t, userID, newcomer, picks...)
+	if !f.worker.RefreshProfileNow(ctx, userID, newcomer) {
+		// A slow machine outlasted the wait; the refresh goes on.
+		t.Log("refresh outlasted the wait")
+		eventually(t, "the refresh to finish", func() bool { return f.worker.refreshesNow.Load() == 0 })
+	}
+	page, err := f.reader.GetForYouPage(ctx, userID, newcomer, 20, filter)
+	if err != nil {
+		t.Fatal(err)
+	}
+	personal := personalIDs(page)
+	if len(personal) == 0 {
+		t.Fatalf("page after the taste seed = %v, want a personal row", rowSizes(page))
+	}
+	for _, pick := range picks {
+		if slices.Contains(personal, pick) {
+			t.Fatalf("personal rows %v recommend pick %s back", personal, pick)
+		}
+	}
+}
+
+func rowSizes(rows []ForYouRow) []string {
+	sizes := make([]string, len(rows))
+	for i, row := range rows {
+		sizes[i] = fmt.Sprintf("%s %q: %d", row.Type, row.Label, len(row.Items))
+	}
+	return sizes
+}
+
+// Personal rows offer only recommendableMediaTypes. The fixture puts
+// matched books exactly on the profile's taste, makes a finished audiobook
+// its latest completion, co-watches books with its latest movie and has
+// three peers rate them, so a row built from any of those paths without the
+// type rule would carry one. A book still anchors its own "More like this".
+func TestPersonalRowsOfferOnlyRecommendableMediaTypesPostgres(t *testing.T) {
+	f := newRelevanceFixture(t, "types")
+	ctx := t.Context()
+	const axis = 2600
+	genres := [][]string{{"Drama"}, {"Mystery"}, {"Adventure"}}
+
+	// Enough movies that the main row's reach leaves a cluster row to build.
+	var movies []string
+	for i := range 70 {
+		movies = append(movies, f.movie(t, fmt.Sprintf("movie-%02d", i), genres[i%3], "PG-13", 13, axisVector(axis, map[int]float32{axis + 1 + i: 0.05})))
+	}
+	book := func(name, mediaType string, i int) string {
+		t.Helper()
+		id := f.prefix + name
+		seedRecoMediaItem(t, f.pool, id, mediaType, "matched")
+		if _, err := f.pool.Exec(ctx, `UPDATE media_items SET genres = $2 WHERE content_id = $1`, id, genres[i%3]); err != nil {
+			t.Fatal(err)
+		}
+		if err := f.repo.UpsertEmbedding(ctx, id, axisVector(axis, nil), "test-model", id); err != nil {
+			t.Fatal(err)
+		}
+		return id
+	}
+	var books []string
+	for i := range 6 {
+		books = append(books, book(fmt.Sprintf("audiobook-%02d", i), "audiobook", i))
+	}
+	books = append(books, book("ebook", "ebook", 0))
+	finishedBook := book("finished-audiobook", "audiobook", 1)
+
+	userID, _ := newTasteTestAccount(t, f.pool, f.prefix+"account-")
+	viewer := f.profile(t, userID, "Viewer", "")
+	finished := movies[:12]
+	// The audiobook is the latest completion; the movies follow it.
+	f.finish(t, userID, viewer, append([]string{finishedBook}, finished...)...)
+
+	// The latest movie is co-watched with an audiobook and the ebook, and the
+	// finished audiobook with another audiobook.
+	if err := f.repo.UpsertCowatchPairs(ctx, []CowatchPair{
+		{ItemID: finished[0], SimilarItemID: books[0], JaccardScore: 0.9, CowatchCount: 5},
+		{ItemID: finished[0], SimilarItemID: books[6], JaccardScore: 0.9, CowatchCount: 5},
+		{ItemID: finished[0], SimilarItemID: movies[40], JaccardScore: 0.5, CowatchCount: 3},
+		{ItemID: finishedBook, SimilarItemID: books[1], JaccardScore: 0.9, CowatchCount: 5},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		_, _ = f.pool.Exec(t.Context(), `DELETE FROM item_cowatch WHERE item_id LIKE $1 OR similar_item_id LIKE $1`, f.prefix+"%")
+	})
+
+	// Three peer accounts share the taste and rate two books and an open
+	// movie.
+	open := movies[45]
+	for i := range minSimilarUsersPeerAccounts {
+		peerID, peer := newTasteTestAccount(t, f.pool, fmt.Sprintf("%speer-%d-", f.prefix, i))
+		if err := f.repo.UpsertTasteProfile(ctx, peerID, peer, axisVector(axis, nil), map[string]int{"rated_5": 3}, "", time.Now()); err != nil {
+			t.Fatal(err)
+		}
+		for _, item := range []string{books[2], books[6], open} {
+			if _, err := f.pool.Exec(ctx, `INSERT INTO user_ratings(user_id, profile_id, media_item_id, rating) VALUES($1, $2, $3, 5)`, peerID, peer, item); err != nil {
+				t.Fatal(err)
+			}
+		}
+	}
+
+	if err := f.worker.refreshProfile(ctx, nil, userID, viewer); err != nil {
+		t.Fatalf("refresh: %v", err)
+	}
+
+	isBook := map[string]bool{finishedBook: true}
+	for _, id := range books {
+		isBook[id] = true
+	}
+	check := func(stage string, rows map[string][]string) {
+		t.Helper()
+		for key, ids := range rows {
+			for _, id := range ids {
+				if isBook[id] {
+					t.Errorf("%s row %q holds book %s", stage, key, id)
+				}
+			}
+		}
+	}
+
+	// Candidate queries: the books are the nearest titles, and none comes
+	// back, for the main row, a cluster row or a type supplement.
+	filter, err := f.engine.profileAccessFilter(ctx, userID, viewer)
+	if err != nil {
+		t.Fatal(err)
+	}
+	nearest, _, err := f.repo.FindTasteProfileCandidates(ctx, axisVector(axis, nil), nil, nil, 10, filter)
+	if err != nil {
+		t.Fatal(err)
+	}
+	clustered, _, err := f.repo.FindTasteProfileCandidates(ctx, axisVector(axis, nil), nil, []string{"Drama"}, 10, filter)
+	if err != nil {
+		t.Fatal(err)
+	}
+	check("candidates", map[string][]string{"taste": scoredIDs(nearest), "genre": scoredIDs(clustered)})
+	if len(nearest) != 10 || len(clustered) != 10 {
+		t.Fatalf("candidates = %d and %d, want 10 movies each", len(nearest), len(clustered))
+	}
+	for _, mediaType := range []string{"audiobook", "ebook"} {
+		extra, _, err := f.repo.FindTasteProfileCandidatesByMediaType(ctx, axisVector(axis, nil), nil, nil, 10, filter, mediaType)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if len(extra) != 0 {
+			t.Errorf("%s supplement = %v, want none", mediaType, scoredIDs(extra))
+		}
+	}
+
+	// The finished audiobook never anchors: the anchors are the three latest
+	// movies, on the SQL path and the user-store path.
+	sqlAnchors, err := f.repo.GetRecentCompletedItemIDs(ctx, userID, viewer, BecauseYouWatchedAnchors)
+	if err != nil {
+		t.Fatal(err)
+	}
+	anchors, err := anchorItemIDs(ctx, f.engine.signalReader(), nil, userID, viewer, BecauseYouWatchedAnchors)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, got := range [][]string{sqlAnchors, anchors} {
+		if want := finished[:BecauseYouWatchedAnchors]; !slices.Equal(got, want) {
+			t.Fatalf("anchors = %v, want the latest movies %v", got, want)
+		}
+	}
+
+	cached := f.cachedPersonalRows(t, userID, viewer)
+	if len(cached[RecTypeForYouMain+"|"]) < 10 {
+		t.Fatalf("main row = %v, want a built row of at least 10 titles", cached[RecTypeForYouMain+"|"])
+	}
+	if _, ok := cached[RecTypeBecauseWatched+"|"+finishedBook]; ok {
+		t.Errorf("cached rows %v hold a Because You Watched row for the finished audiobook", slices.Collect(maps.Keys(cached)))
+	}
+	byw := cached[RecTypeBecauseWatched+"|"+finished[0]]
+	if !slices.Contains(byw, movies[40]) {
+		t.Errorf("Because You Watched %s = %v, want its co-watched movie %s", finished[0], byw, movies[40])
+	}
+	if !slices.Contains(cached[RecTypeSimilarUsersLiked+"|"], open) {
+		t.Errorf("Similar Users = %v, want the open movie the peers rated", cached[RecTypeSimilarUsersLiked+"|"])
+	}
+	clusterRows := 0
+	for key, ids := range cached {
+		if strings.HasPrefix(key, RecTypeForYouClusterPrefix) && len(ids) > 0 {
+			clusterRows++
+		}
+	}
+	if clusterRows == 0 {
+		t.Errorf("cached rows %v, want a built cluster row", slices.Collect(maps.Keys(cached)))
+	}
+	check("cached", cached)
+	check("served", f.servedRows(t, userID, viewer))
+
+	// "More like this" keeps to the item's own type: a movie's list holds no
+	// co-watched book, and an audiobook's may hold another audiobook.
+	similar, err := f.engine.SimilarItems(ctx, userID, viewer, finished[0], 20, catalog.AccessFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	check("movie similar", map[string][]string{"similar": scoredIDs(similar)})
+	bookSimilar, err := f.engine.SimilarItems(ctx, userID, viewer, finishedBook, 20, catalog.AccessFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !slices.Contains(scoredIDs(bookSimilar), books[1]) {
+		t.Errorf("audiobook similar = %v, want the co-watched audiobook %s", scoredIDs(bookSimilar), books[1])
+	}
+}
diff --git a/internal/recommendations/relevance_test.go b/internal/recommendations/relevance_test.go
new file mode 100644
index 0000000000..8bd4b70fe9
--- /dev/null
+++ b/internal/recommendations/relevance_test.go
@@ -0,0 +1,1219 @@
+package recommendations
+
+import (
+	"cmp"
+	"context"
+	"errors"
+	"fmt"
+	"maps"
+	"math"
+	"math/rand/v2"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+)
+
+// The relevance harness builds each persona's personal rows with the
+// production row builder over a seeded toy catalog held in memory, and checks
+// what the served rows contain. The catalog's vectors are structured so a
+// genre is a direction: titles sharing a genre sit near each other, like real
+// embeddings of text that leads with the genres. The checks are thresholds,
+// never exact lists, so retuning the catalog or a constant moves numbers
+// without breaking the intent.
+
+// relevanceNow is the fixed time every persona's signals are dated from.
+var relevanceNow = time.Date(2026, 10, 1, 12, 0, 0, 0, time.UTC)
+
+const (
+	gThriller    = "Thriller"
+	gSciFi       = "Science Fiction"
+	gAction      = "Action"
+	gHorror      = "Horror"
+	gRomance     = "Romance"
+	gComedy      = "Comedy"
+	gDrama       = "Drama"
+	gDocumentary = "Documentary"
+	gAnimation   = "Animation"
+	gFamily      = "Family"
+	gCrime       = "Crime"
+	gFantasy     = "Fantasy"
+)
+
+// toyGenres lists each genre with the genres its titles take as a secondary
+// genre, so the catalog has blends such as horror-comedies.
+var toyGenres = []struct {
+	name    string
+	related []string
+}{
+	{gThriller, []string{gCrime, gAction, gHorror, gSciFi, gDrama}},
+	{gSciFi, []string{gAction, gThriller, gFantasy, gDrama}},
+	{gAction, []string{gThriller, gSciFi, gCrime, gComedy}},
+	{gHorror, []string{gThriller, gComedy, gFantasy}},
+	{gRomance, []string{gComedy, gDrama}},
+	{gComedy, []string{gRomance, gFamily, gAction, gHorror}},
+	{gDrama, []string{gRomance, gCrime, gThriller}},
+	{gDocumentary, []string{gDrama, gCrime}},
+	{gAnimation, []string{gFamily, gComedy, gFantasy}},
+	{gFamily, []string{gAnimation, gComedy, gFantasy}},
+	{gCrime, []string{gThriller, gDrama, gAction}},
+	{gFantasy, []string{gAction, gFamily, gSciFi}},
+}
+
+const (
+	toyMoviesPerGenre = 60
+	toySeriesPerGenre = 15
+	toyNoiseDims      = 48
+	// toyCommon, toySecondary, toyType and toyNoise shape the vectors:
+	// titles sharing a primary genre and a type score a cosine near 0.6,
+	// unrelated titles near 0.3, roughly what a small sentence-embedding
+	// model gives. The embedding text names the type, so a movie sits a
+	// little nearer other movies than series.
+	toyCommon    = 0.8
+	toySecondary = 0.55
+	toyType      = 0.5
+	toyNoise     = 1.0
+)
+
+type toyItem struct {
+	id            string
+	mediaType     string
+	genres        []string
+	vec           []float32
+	rating        float64 // 0 when the title has no usable rating
+	contentRating string
+	addedAt       time.Time
+}
+
+type toyCatalog struct {
+	items []toyItem
+	byID  map[string]*toyItem
+}
+
+// newToyCatalog builds the same catalog on every run.
+func newToyCatalog() *toyCatalog {
+	rng := rand.New(rand.NewPCG(20261001, 7))
+	const typeAxes = 2
+	genreAxis := make(map[string]int, len(toyGenres))
+	for i, g := range toyGenres {
+		genreAxis[g.name] = 1 + typeAxes + i
+	}
+	noiseAxis := 1 + typeAxes + len(toyGenres)
+	dims := noiseAxis + toyNoiseDims
+	c := &toyCatalog{byID: map[string]*toyItem{}}
+	add := func(id, mediaType string, primary, secondary string) {
+		vec := make([]float64, dims)
+		vec[0] = toyCommon
+		if mediaType == "series" {
+			vec[2] = toyType
+		} else {
+			vec[1] = toyType
+		}
+		vec[genreAxis[primary]] = 1
+		genres := []string{primary}
+		if secondary != "" {
+			vec[genreAxis[secondary]] = toySecondary
+			genres = append(genres, secondary)
+		}
+		var noiseNorm float64
+		noise := make([]float64, toyNoiseDims)
+		for d := range noise {
+			noise[d] = rng.NormFloat64()
+			noiseNorm += noise[d] * noise[d]
+		}
+		noiseNorm = math.Sqrt(noiseNorm)
+		for d := range noise {
+			vec[noiseAxis+d] = toyNoise * noise[d] / noiseNorm
+		}
+		out := make([]float32, dims)
+		var norm float64
+		for _, v := range vec {
+			norm += v * v
+		}
+		norm = math.Sqrt(norm)
+		for d, v := range vec {
+			out[d] = float32(v / norm)
+		}
+		rating := 0.0
+		if rng.IntN(10) != 0 {
+			rating = 6.4 + rng.NormFloat64()
+			if mediaType == "series" {
+				// Series ratings run higher than movie ratings.
+				rating += 0.6
+			}
+			rating = math.Round(min(9.3, max(2.0, rating))*10) / 10
+		}
+		contentRating := []string{"PG-13", "R"}[rng.IntN(2)]
+		if primary == gAnimation || primary == gFamily {
+			contentRating = "G"
+			if rng.IntN(4) == 0 {
+				contentRating = "PG"
+			}
+		}
+		c.items = append(c.items, toyItem{
+			id:            id,
+			mediaType:     mediaType,
+			genres:        genres,
+			vec:           out,
+			rating:        rating,
+			contentRating: contentRating,
+			addedAt:       relevanceNow.Add(-time.Duration(30+rng.IntN(700)) * 24 * time.Hour),
+		})
+	}
+	for _, g := range toyGenres {
+		slug := strings.ToLower(strings.ReplaceAll(g.name, " ", ""))
+		for i := range toyMoviesPerGenre + toySeriesPerGenre {
+			mediaType, n := "movie", i
+			if i >= toyMoviesPerGenre {
+				mediaType, n = "series", i-toyMoviesPerGenre
+			}
+			secondary := ""
+			if rng.IntN(10) < 6 {
+				secondary = g.related[rng.IntN(len(g.related))]
+			}
+			add(fmt.Sprintf("%s-%s-%02d", slug, mediaType, n), mediaType, g.name, secondary)
+		}
+	}
+	for i := range c.items {
+		c.byID[c.items[i].id] = &c.items[i]
+	}
+	return c
+}
+
+// pick returns the first n titles of mediaType whose primary genre is genre,
+// skipping the first skip of them.
+func (c *toyCatalog) pick(genre, mediaType string, skip, n int) []string {
+	var ids []string
+	for _, item := range c.items {
+		if item.genres[0] != genre || item.mediaType != mediaType {
+			continue
+		}
+		if skip > 0 {
+			skip--
+			continue
+		}
+		ids = append(ids, item.id)
+		if len(ids) == n {
+			break
+		}
+	}
+	return ids
+}
+
+// toyStore is a rowStore over the toy catalog for one persona. Its candidate
+// queries rank exactly, the way the SQL ranks with an exact scan.
+type toyStore struct {
+	catalog  *toyCatalog
+	taste    []float32
+	clusters []TasteCluster
+	allowed  func(*toyItem) bool
+	// typeQueries counts the per-type candidate queries by media type;
+	// noTypeQueries makes them return nothing.
+	typeQueries   map[string]int
+	noTypeQueries bool
+	// noRatings hides every title's quality rating.
+	noRatings bool
+	// candidateErrAt fails the candidateErrAt-th FindTasteProfileCandidates
+	// call (1-based; 0 never), and embeddingsErr every GetBatchEmbeddings.
+	candidateErrAt int
+	candidateCalls int
+	embeddingsErr  error
+}
+
+func (s *toyStore) GetItemQualityRatings(_ context.Context, ids []string) (map[string]float64, error) {
+	out := make(map[string]float64, len(ids))
+	if s.noRatings {
+		return out, nil
+	}
+	for _, id := range ids {
+		if item, ok := s.catalog.byID[id]; ok && item.rating > 0 {
+			out[id] = item.rating
+		}
+	}
+	return out, nil
+}
+
+func (s *toyStore) GetTasteProfile(context.Context, int, string) ([]float32, error) {
+	return s.taste, nil
+}
+
+func (s *toyStore) GetTasteClusters(context.Context, int, string) ([]TasteCluster, error) {
+	return s.clusters, nil
+}
+
+func (s *toyStore) FindTasteProfileCandidates(ctx context.Context, embedding []float32, excludeIDs []string, genres []string, limit int, filter catalog.AccessFilter) ([]ScoredItem, map[string][]string, error) {
+	s.candidateCalls++
+	if s.candidateCalls == s.candidateErrAt {
+		return nil, nil, errors.New("candidate query failed")
+	}
+	return s.FindTasteProfileCandidatesByMediaType(ctx, embedding, excludeIDs, genres, limit, filter, "")
+}
+
+// FindTasteProfileCandidatesByMediaType mirrors findTasteProfileCandidates:
+// the nearest titles first, and with genres the nearest limit×5 that share one
+// of them, re-ordered by how many they share.
+func (s *toyStore) FindTasteProfileCandidatesByMediaType(_ context.Context, embedding []float32, excludeIDs []string, genres []string, limit int, _ catalog.AccessFilter, mediaType string) ([]ScoredItem, map[string][]string, error) {
+	if mediaType != "" {
+		if s.typeQueries == nil {
+			s.typeQueries = map[string]int{}
+		}
+		s.typeQueries[mediaType]++
+		if s.noTypeQueries {
+			return []ScoredItem{}, map[string][]string{}, nil
+		}
+	}
+	if embedding == nil || limit <= 0 {
+		return []ScoredItem{}, map[string][]string{}, nil
+	}
+	type hit struct {
+		item    *toyItem
+		sim     float64
+		matches int
+	}
+	var hits []hit
+	for i := range s.catalog.items {
+		item := &s.catalog.items[i]
+		if slices.Contains(excludeIDs, item.id) || (mediaType != "" && item.mediaType != mediaType) {
+			continue
+		}
+		if s.allowed != nil && !s.allowed(item) {
+			continue
+		}
+		matches := 0
+		for _, g := range genres {
+			if slices.Contains(item.genres, g) {
+				matches++
+			}
+		}
+		if len(genres) > 0 && matches == 0 {
+			continue
+		}
+		hits = append(hits, hit{item, cosineSimilarity(embedding, item.vec), matches})
+	}
+	byDistance := func(a, b hit) int {
+		if c := cmp.Compare(b.sim, a.sim); c != 0 {
+			return c
+		}
+		return strings.Compare(a.item.id, b.item.id)
+	}
+	slices.SortFunc(hits, byDistance)
+	annLimit := limit
+	if len(genres) > 0 {
+		annLimit = min(limit*5, 2000)
+	}
+	hits = hits[:min(len(hits), annLimit)]
+	slices.SortStableFunc(hits, func(a, b hit) int {
+		if c := cmp.Compare(b.matches, a.matches); c != 0 {
+			return c
+		}
+		return byDistance(a, b)
+	})
+	hits = hits[:min(len(hits), limit)]
+	items := make([]ScoredItem, len(hits))
+	genreMap := make(map[string][]string, len(hits))
+	for i, h := range hits {
+		items[i] = ScoredItem{MediaItemID: h.item.id, Score: h.sim, Reason: "taste_profile_match"}
+		genreMap[h.item.id] = h.item.genres
+	}
+	return items, genreMap, nil
+}
+
+func (s *toyStore) GetBatchEmbeddings(_ context.Context, ids []string) (map[string][]float32, error) {
+	if s.embeddingsErr != nil {
+		return nil, s.embeddingsErr
+	}
+	out := make(map[string][]float32, len(ids))
+	for _, id := range ids {
+		if item, ok := s.catalog.byID[id]; ok {
+			out[id] = item.vec
+		}
+	}
+	return out, nil
+}
+
+func (s *toyStore) GetItemMediaTypes(_ context.Context, ids []string) (map[string]string, error) {
+	out := make(map[string]string, len(ids))
+	for _, id := range ids {
+		if item, ok := s.catalog.byID[id]; ok {
+			out[id] = item.mediaType
+		}
+	}
+	return out, nil
+}
+
+func (s *toyStore) GetItemAddedDates(_ context.Context, ids []string) (map[string]time.Time, error) {
+	out := make(map[string]time.Time, len(ids))
+	for _, id := range ids {
+		if item, ok := s.catalog.byID[id]; ok {
+			out[id] = item.addedAt
+		}
+	}
+	return out, nil
+}
+
+func (s *toyStore) PresentMediaTypes(_ context.Context, mediaTypes []string, _ catalog.AccessFilter) (map[string]struct{}, error) {
+	present := map[string]struct{}{}
+	for i := range s.catalog.items {
+		item := &s.catalog.items[i]
+		if slices.Contains(mediaTypes, item.mediaType) && (s.allowed == nil || s.allowed(item)) {
+			present[item.mediaType] = struct{}{}
+		}
+	}
+	return present, nil
+}
+
+// personaTitle is one title in a persona's history: its final signal weight
+// is a completed watch daysAgo before relevanceNow, plus a 5-star rating when
+// rated5 is set.
+type personaTitle struct {
+	id      string
+	daysAgo int
+	rated5  bool
+}
+
+func (p personaTitle) weight() float64 {
+	at := relevanceNow.Add(-time.Duration(p.daysAgo) * 24 * time.Hour)
+	decay := timeDecay(at, relevanceNow, 180)
+	w := WeightWatchHigh * decay
+	if p.rated5 {
+		w += WeightRated5 * decay
+	}
+	return w
+}
+
+type persona struct {
+	name    string
+	history []personaTitle
+	allowed func(*toyItem) bool
+	// tastes are the genres the persona's interests are named by; the
+	// summary counts the served items carrying each.
+	tastes []string
+}
+
+// personaRows is what the harness measures for one persona.
+type personaRows struct {
+	persona  persona
+	catalog  *toyCatalog
+	store    *toyStore
+	exclude  []string
+	main     []ScoredItem
+	clusters []ForYouRow
+	// rawTop holds the nearest titles to the taste vector, the row a plain
+	// nearest-neighbor query would serve.
+	rawTop []ScoredItem
+}
+
+func titles(ids []string, daysAgo int) []personaTitle {
+	out := make([]personaTitle, len(ids))
+	for i, id := range ids {
+		out[i] = personaTitle{id: id, daysAgo: daysAgo + i*5}
+	}
+	return out
+}
+
+// relevancePersonas builds personas A–F over c.
+func relevancePersonas(c *toyCatalog) map[string]persona {
+	a := append(titles(c.pick(gThriller, "movie", 0, 33), 5), titles(c.pick(gSciFi, "movie", 0, 18), 10)...)
+	a = append(a, titles(c.pick(gAction, "movie", 0, 6), 40)...)
+	a = append(a, titles(c.pick(gDrama, "movie", 0, 3), 90)...)
+	for i := range 6 {
+		a[i*7].rated5 = true
+	}
+
+	b := titles(c.pick(gComedy, "series", 0, 3), 700)
+	b = append(b, titles(c.pick(gCrime, "series", 0, 2), 20)...)
+	b = append(b, titles(c.pick(gDrama, "series", 0, 2), 60)...)
+	b = append(b, titles(c.pick(gThriller, "series", 0, 1), 30)...)
+
+	kid := append(titles(c.pick(gAnimation, "movie", 0, 12), 3), titles(c.pick(gFamily, "movie", 0, 6), 20)...)
+	kid = append(kid, titles(c.pick(gAnimation, "series", 0, 2), 1)...)
+
+	d := []personaTitle{
+		{id: c.pick(gSciFi, "movie", 30, 1)[0], daysAgo: 1},
+		{id: c.pick(gRomance, "movie", 30, 1)[0], daysAgo: 1},
+		{id: c.pick(gDrama, "movie", 30, 1)[0], daysAgo: 1},
+	}
+
+	e := append(titles(c.pick(gHorror, "movie", 0, 26), 5), titles(c.pick(gRomance, "movie", 0, 24), 5)...)
+
+	f := append(titles(c.pick(gCrime, "movie", 0, 20), 600), titles(c.pick(gThriller, "movie", 20, 20), 610)...)
+	f = append(f, titles(c.pick(gDocumentary, "movie", 0, 2), 10)...)
+
+	return map[string]persona{
+		"A": {name: "A movie buff", history: a, tastes: []string{gThriller, gSciFi, gAction}},
+		"B": {name: "B series binger", history: b, tastes: []string{gComedy, gCrime, gDrama, gThriller}},
+		"C": {name: "C kid", history: kid, allowed: func(item *toyItem) bool { return item.contentRating == "G" }, tastes: []string{gAnimation, gFamily}},
+		"D": {name: "D new profile", history: d, tastes: []string{gSciFi, gRomance, gDrama}},
+		"E": {name: "E mixed taste", history: e, tastes: []string{gHorror, gRomance}},
+		"F": {name: "F lapsed", history: f, tastes: []string{gCrime, gThriller, gDocumentary}},
+	}
+}
+
+// buildPersonaRows builds the persona's taste profile and clusters the way
+// RefreshTasteProfile does, then its main and cluster rows the way the cache
+// build does.
+func buildPersonaRows(t *testing.T, c *toyCatalog, p persona) personaRows {
+	t.Helper()
+	return buildPersonaRowsWith(t, c, p, func(*toyStore) {})
+}
+
+// buildPersonaRowsWith is buildPersonaRows with tweak applied to the store
+// before the rows are built.
+func buildPersonaRowsWith(t *testing.T, c *toyCatalog, p persona, tweak func(*toyStore)) personaRows {
+	t.Helper()
+	b, store, exclude := personaBuilder(t, c, p, tweak)
+	ctx := t.Context()
+	main, err := b.mainRow(ctx, 1, "p", CacheCandidateLimit, exclude, catalog.AccessFilter{})
+	if err != nil {
+		t.Fatalf("%s: main row: %v", p.name, err)
+	}
+	if main == nil {
+		t.Fatalf("%s: no main row", p.name)
+	}
+	clusters, _, err := b.clusterRows(ctx, 1, "p", CacheCandidateLimit, exclude, catalog.AccessFilter{})
+	if err != nil {
+		t.Fatalf("%s: cluster rows: %v", p.name, err)
+	}
+	rawTop, _, _ := store.FindTasteProfileCandidates(ctx, store.taste, exclude, nil, ServedRowSize, catalog.AccessFilter{})
+	return personaRows{persona: p, catalog: c, store: store, exclude: exclude, main: main.Items, clusters: clusters, rawTop: rawTop}
+}
+
+// personaBuilder returns a row builder over a store holding the persona's
+// taste profile and clusters, built the way RefreshTasteProfile builds them,
+// with tweak applied, and the persona's titles, which every row leaves out.
+func personaBuilder(t *testing.T, c *toyCatalog, p persona, tweak func(*toyStore)) (rowBuilder, *toyStore, []string) {
+	t.Helper()
+	vecs := make([][]float32, 0, len(p.history))
+	weights := make([]float64, 0, len(p.history))
+	items := make([]clusterItem, 0, len(p.history))
+	exclude := make([]string, 0, len(p.history))
+	for _, title := range p.history {
+		item := c.byID[title.id]
+		if item == nil {
+			t.Fatalf("%s: unknown title %s", p.name, title.id)
+		}
+		vecs = append(vecs, item.vec)
+		weights = append(weights, title.weight())
+		items = append(items, clusterItem{itemID: item.id, embedding: item.vec, weight: title.weight(), genres: item.genres})
+		exclude = append(exclude, item.id)
+	}
+	store := &toyStore{catalog: c, taste: weightedAverage(vecs, weights), clusters: buildTasteClusters(items), allowed: p.allowed}
+	tweak(store)
+	return rowBuilder{store: store, lambda: defaultMMRLambda, now: relevanceNow}, store, exclude
+}
+
+// served is the part of a cached row a public read serves.
+func served(items []ScoredItem) []ScoredItem {
+	return items[:min(len(items), ServedRowSize)]
+}
+
+// share is the fraction of items that carry genre.
+func (r personaRows) share(items []ScoredItem, genre string) float64 {
+	if len(items) == 0 {
+		return 0
+	}
+	n := 0
+	for _, item := range items {
+		if slices.Contains(r.catalog.byID[item.MediaItemID].genres, genre) {
+			n++
+		}
+	}
+	return float64(n) / float64(len(items))
+}
+
+// historyShare is the fraction of the persona's titles that carry genre.
+func (r personaRows) historyShare(genre string) float64 {
+	n := 0
+	for _, title := range r.persona.history {
+		if slices.Contains(r.catalog.byID[title.id].genres, genre) {
+			n++
+		}
+	}
+	return float64(n) / float64(len(r.persona.history))
+}
+
+// topHistoryGenre is the genre most of the persona's titles carry.
+func (r personaRows) topHistoryGenre() string {
+	best, bestShare := "", -1.0
+	for _, g := range toyGenres {
+		if s := r.historyShare(g.name); s > bestShare {
+			best, bestShare = g.name, s
+		}
+	}
+	return best
+}
+
+// amplification is how much more of the served row than of the history the
+// persona's top genre takes.
+func (r personaRows) amplification() float64 {
+	g := r.topHistoryGenre()
+	return r.share(served(r.main), g) - r.historyShare(g)
+}
+
+// fit is the mean, over items, of each item's highest cosine to a title in
+// the persona's history.
+func (r personaRows) fit(items []ScoredItem) float64 {
+	if len(items) == 0 {
+		return 0
+	}
+	var sum float64
+	for _, item := range items {
+		best := -1.0
+		for _, title := range r.persona.history {
+			best = max(best, cosineSimilarity(r.catalog.byID[item.MediaItemID].vec, r.catalog.byID[title.id].vec))
+		}
+		sum += best
+	}
+	return sum / float64(len(items))
+}
+
+// meanRating is the mean rating of the rated items.
+func (r personaRows) meanRating(items []ScoredItem) float64 {
+	var sum float64
+	n := 0
+	for _, item := range items {
+		if rating := r.catalog.byID[item.MediaItemID].rating; rating > 0 {
+			sum += rating
+			n++
+		}
+	}
+	if n == 0 {
+		return 0
+	}
+	return sum / float64(n)
+}
+
+// meanTasteCosine is the mean cosine of items to the taste vector.
+func (r personaRows) meanTasteCosine(items []ScoredItem) float64 {
+	if len(items) == 0 {
+		return 0
+	}
+	var sum float64
+	for _, item := range items {
+		sum += cosineSimilarity(r.store.taste, r.catalog.byID[item.MediaItemID].vec)
+	}
+	return sum / float64(len(items))
+}
+
+// count is how many items have mediaType.
+func (r personaRows) count(items []ScoredItem, mediaType string) int {
+	n := 0
+	for _, item := range items {
+		if r.catalog.byID[item.MediaItemID].mediaType == mediaType {
+			n++
+		}
+	}
+	return n
+}
+
+// rawOverlap is the fraction of the served row that the plain
+// nearest-neighbor row would also serve.
+func (r personaRows) rawOverlap() float64 {
+	raw := make(map[string]struct{}, len(r.rawTop))
+	for _, item := range r.rawTop {
+		raw[item.MediaItemID] = struct{}{}
+	}
+	s := served(r.main)
+	if len(s) == 0 {
+		return 0
+	}
+	n := 0
+	for _, item := range s {
+		if _, ok := raw[item.MediaItemID]; ok {
+			n++
+		}
+	}
+	return float64(n) / float64(len(s))
+}
+
+// tasteCount is how many items carry genre.
+func (r personaRows) tasteCount(items []ScoredItem, genre string) int {
+	return int(math.Round(r.share(items, genre) * float64(len(items))))
+}
+
+func (r personaRows) summary() string {
+	s := served(r.main)
+	top := r.topHistoryGenre()
+	tastes := make([]string, len(r.persona.tastes))
+	for i, g := range r.persona.tastes {
+		tastes[i] = fmt.Sprintf("%s=%d", g, r.tasteCount(s, g))
+	}
+	return fmt.Sprintf("%s: row=%d clusters=%d %s served=%.2f hist=%.2f amp=%+.2f raw-overlap=%.2f fit=%.3f cos=%.3f rating=%.2f series(20/60)=%d/%d served20[%s]",
+		r.persona.name, len(r.main), len(r.store.clusters), top, r.share(s, top), r.historyShare(top), r.amplification(),
+		r.rawOverlap(), r.fit(s), r.meanTasteCosine(s), r.meanRating(s), r.count(s, "series"), r.count(r.main, "series"), strings.Join(tastes, " "))
+}
+
+// anchorCounts returns, for each of the persona's main-row anchors, its share
+// of the served window in slots and how many served items lie nearer it than
+// any other anchor. A persona without anchors gets nil.
+func (r personaRows) anchorCounts() (want, got []int) {
+	anchors := mainRowAnchors(r.store.clusters)
+	if len(anchors) == 0 {
+		return nil, nil
+	}
+	weights := make([]float64, len(anchors))
+	for i, a := range anchors {
+		weights[i] = a.weight
+	}
+	want = allocateAnchorSlots(weights, ServedRowSize)
+	got = make([]int, len(anchors))
+	for _, item := range served(r.main) {
+		best, bestSim := 0, -2.0
+		for i, a := range anchors {
+			if sim := cosineSimilarity(a.embedding, r.catalog.byID[item.MediaItemID].vec); sim > bestSim {
+				best, bestSim = i, sim
+			}
+		}
+		got[best]++
+	}
+	return want, got
+}
+
+func buildAllPersonaRows(t *testing.T) map[string]personaRows {
+	t.Helper()
+	c := newToyCatalog()
+	out := map[string]personaRows{}
+	for key, p := range relevancePersonas(c) {
+		out[key] = buildPersonaRows(t, c, p)
+	}
+	return out
+}
+
+// TestRelevancePersonaReport logs what each persona is served, for comparing
+// a change's effect (go test -run TestRelevancePersonaReport -v).
+func TestRelevancePersonaReport(t *testing.T) {
+	rows := buildAllPersonaRows(t)
+	for _, key := range []string{"A", "B", "C", "D", "E", "F"} {
+		r := rows[key]
+		t.Log(r.summary())
+		want, got := r.anchorCounts()
+		var clusters []string
+		for _, c := range r.store.clusters {
+			clusters = append(clusters, fmt.Sprintf("%s(%d titles, w=%.2f)", c.Label, c.MemberCount, c.TotalWeight))
+		}
+		window := map[string]struct{}{}
+		for _, item := range served(r.main) {
+			window[item.MediaItemID] = struct{}{}
+		}
+		var overlaps, lengths []int
+		for _, row := range r.clusters {
+			n := 0
+			for _, item := range served(row.Items) {
+				if _, ok := window[item.MediaItemID]; ok {
+					n++
+				}
+			}
+			overlaps = append(overlaps, n)
+		}
+		for _, row := range withoutMainRowItems(slices.Clone(r.clusters), r.main) {
+			lengths = append(lengths, len(row.Items))
+		}
+		t.Logf("    clusters %s; anchor slots of 20 %v, served nearest each %v; cluster rows' served 20 repeating the main row %v, cached lengths after removal %v",
+			strings.Join(clusters, "; "), want, got, overlaps, lengths)
+		week := map[string]struct{}{}
+		for d := range 7 {
+			for _, item := range r.page(t, relevanceNow.AddDate(0, 0, d))[0].Items {
+				week[item.MediaItemID] = struct{}{}
+			}
+		}
+		t.Logf("    page %q; main row titles served over 7 days %d", rowLabels(r.page(t, relevanceNow)), len(week))
+	}
+}
+
+// Every persona gets a main row of distinct titles it can see and has not
+// watched, and C's restricted row holds only titles its scope admits.
+func TestRelevanceRowsHoldOnlyRecommendableTitles(t *testing.T) {
+	for key, r := range buildAllPersonaRows(t) {
+		watched := map[string]struct{}{}
+		for _, title := range r.persona.history {
+			watched[title.id] = struct{}{}
+		}
+		rows := append([]ForYouRow{{Label: "main", Items: r.main}}, r.clusters...)
+		for _, row := range rows {
+			seen := map[string]struct{}{}
+			for _, item := range row.Items {
+				if _, dup := seen[item.MediaItemID]; dup {
+					t.Fatalf("%s: %s row repeats %s", key, row.Label, item.MediaItemID)
+				}
+				seen[item.MediaItemID] = struct{}{}
+				if _, ok := watched[item.MediaItemID]; ok {
+					t.Fatalf("%s: %s row recommends watched title %s", key, row.Label, item.MediaItemID)
+				}
+				if r.persona.allowed != nil && !r.persona.allowed(r.catalog.byID[item.MediaItemID]) {
+					t.Fatalf("%s: %s row holds %s, outside the persona's scope", key, row.Label, item.MediaItemID)
+				}
+			}
+		}
+		if len(served(r.main)) < ServedRowSize {
+			t.Fatalf("%s: served main row has %d items, want %d", key, len(served(r.main)), ServedRowSize)
+		}
+	}
+}
+
+// A profile under ten titles has one cluster; the k-means profiles have
+// several.
+func TestRelevancePersonaClusterCounts(t *testing.T) {
+	rows := buildAllPersonaRows(t)
+	for _, key := range []string{"B", "D"} {
+		if n := len(rows[key].store.clusters); n != 1 {
+			t.Fatalf("%s: %d clusters, want 1 under ten titles", key, n)
+		}
+	}
+	for _, key := range []string{"A", "E", "F"} {
+		if n := len(rows[key].store.clusters); n < 2 {
+			t.Fatalf("%s: %d clusters, want several", key, n)
+		}
+	}
+}
+
+// The main row stays near the profile's taste: its served titles are, on
+// average, closer to the persona's own titles than the catalog is.
+func TestRelevanceMainRowFitsTheHistory(t *testing.T) {
+	for key, r := range buildAllPersonaRows(t) {
+		var all []ScoredItem
+		for _, item := range r.catalog.items {
+			all = append(all, ScoredItem{MediaItemID: item.id})
+		}
+		if got, base := r.fit(served(r.main)), r.fit(all); got < base+0.1 {
+			t.Fatalf("%s: served fit %.3f, want at least 0.1 above the catalog's %.3f", key, got, base)
+		}
+	}
+}
+
+// No title leaves a cached row: every main row keeps all CacheCandidateLimit
+// places, the served window first and the headroom after it.
+func TestRelevanceMainRowKeepsItsLength(t *testing.T) {
+	for key, r := range buildAllPersonaRows(t) {
+		if len(r.main) != CacheCandidateLimit {
+			t.Fatalf("%s: main row has %d items, want %d", key, len(r.main), CacheCandidateLimit)
+		}
+	}
+}
+
+// The served window no longer amplifies a movie buff's top genre: its share
+// of the served 20 stays within 0.20 of its share of the history.
+func TestRelevanceServedWindowLimitsGenreAmplification(t *testing.T) {
+	r := buildAllPersonaRows(t)["A"]
+	if amp := r.amplification(); amp > 0.20 {
+		t.Fatalf("A: %s amplification %+.2f, want at most +0.20", r.topHistoryGenre(), amp)
+	}
+}
+
+// The genre pass reorders only the served window. Past it, a row built from
+// the averaged taste vector keeps the order MMR chose; neither the pass nor
+// the type supplements re-sort it by score.
+func TestRelevanceRowKeepsMMROrderAfterTheWindow(t *testing.T) {
+	for key, r := range buildAllPersonaRows(t) {
+		if mainRowAnchors(r.store.clusters) != nil {
+			continue
+		}
+		ctx := t.Context()
+		pool, _, _ := r.store.FindTasteProfileCandidates(ctx, r.store.taste, r.exclude, nil, CacheCandidateLimit*3, catalog.AccessFilter{})
+		pool = rowBuilder{store: r.store}.withQualityPrior(ctx, pool, 0)
+		emb, _ := r.store.GetBatchEmbeddings(ctx, scoredItemIDs(pool))
+		position := map[string]int{}
+		for i, item := range applyMMR(pool, emb, defaultMMRLambda, CacheCandidateLimit) {
+			position[item.MediaItemID] = i
+		}
+		last := -1
+		for _, item := range r.main[ServedRowSize:] {
+			at, ok := position[item.MediaItemID]
+			if !ok {
+				// A type supplement: it comes after every MMR pick.
+				last = len(position)
+				continue
+			}
+			if at < last {
+				t.Fatalf("%s: %s at MMR position %d follows position %d after the window", key, item.MediaItemID, at, last)
+			}
+			last = at
+		}
+	}
+}
+
+// Library sections scope the whole cached row to one type, so each row holds
+// at least mediaTypeFloor of movies and of series. The extra titles sit after
+// the served window: the window is the same with the per-type queries
+// switched off.
+func TestRelevanceTypeSupplementsStayInTheTail(t *testing.T) {
+	c := newToyCatalog()
+	floor := mediaTypeFloor(CacheCandidateLimit)
+	for key, p := range relevancePersonas(c) {
+		r := buildPersonaRows(t, c, p)
+		for _, mediaType := range []string{"movie", "series"} {
+			if n := r.count(r.main, mediaType); n < floor {
+				t.Fatalf("%s: main row has %d %s items, want at least %d", key, n, mediaType, floor)
+			}
+		}
+		bare := buildPersonaRowsWith(t, c, p, func(s *toyStore) { s.noTypeQueries = true })
+		if got, want := mmrItemIDs(served(r.main)), mmrItemIDs(served(bare.main)); !slices.Equal(got, want) {
+			t.Fatalf("%s: served window %v changes without type supplements to %v", key, got, want)
+		}
+	}
+}
+
+// A media type the profile has no titles of is never queried for
+// supplements: a movies-only scope has no series. A type the scope has but
+// the candidates lack is queried. Books are outside recommendableMediaTypes,
+// so they are never queried.
+func TestRelevanceTypeSupplementsSkipAbsentTypes(t *testing.T) {
+	c := newToyCatalog()
+	scoped := func(allowed func(*toyItem) bool) map[string]int {
+		p := relevancePersonas(c)["A"]
+		p.allowed = allowed
+		return buildPersonaRows(t, c, p).store.typeQueries
+	}
+
+	fewSeries := scoped(func(item *toyItem) bool { return item.mediaType == "movie" || item.genres[0] == gDocumentary })
+	if fewSeries["series"] == 0 {
+		t.Fatalf("type queries %v, want a series query when the candidates hold few series", fewSeries)
+	}
+	for _, queries := range []map[string]int{fewSeries, scoped(func(item *toyItem) bool { return item.mediaType == "movie" })} {
+		for _, absent := range []string{"audiobook", "ebook"} {
+			if queries[absent] != 0 {
+				t.Fatalf("type queries %v, want none for %s", queries, absent)
+			}
+		}
+	}
+	if queries := scoped(func(item *toyItem) bool { return item.mediaType == "movie" }); queries["series"] != 0 {
+		t.Fatalf("type queries %v, want no series query for a movies-only scope", queries)
+	}
+}
+
+// A profile with several interests is served each in proportion: every
+// anchor holds at least half its share of the served window, so a minor
+// interest is not crowded out by the heaviest one.
+func TestRelevanceComposedRowServesEveryInterest(t *testing.T) {
+	composed := 0
+	for key, r := range buildAllPersonaRows(t) {
+		want, got := r.anchorCounts()
+		if want == nil {
+			continue
+		}
+		composed++
+		for i := range want {
+			if got[i] < want[i]/2 {
+				t.Fatalf("%s: anchor %d is nearest %d served items, want at least half its %d slots (all anchors: want %v, got %v)", key, i, got[i], want[i], want, got)
+			}
+		}
+	}
+	if composed < 3 {
+		t.Fatalf("%d personas have a composed main row, want at least 3", composed)
+	}
+}
+
+// A profile split between two tastes gets both: each holds at least 40% of
+// the served window.
+func TestRelevanceMixedTasteServesBothInterests(t *testing.T) {
+	r := buildAllPersonaRows(t)["E"]
+	for _, genre := range []string{gHorror, gRomance} {
+		if n := r.tasteCount(served(r.main), genre); n < ServedRowSize*2/5 {
+			t.Fatalf("E: %d of the served %d carry %s, want at least 40%%", n, ServedRowSize, genre)
+		}
+	}
+}
+
+// Cached cluster rows leave out the main row's served window, so the page
+// does not repeat its opening titles; a row left thin is emptied.
+func TestRelevanceClusterRowsLeaveOutTheServedMainRow(t *testing.T) {
+	for key, r := range buildAllPersonaRows(t) {
+		window := map[string]struct{}{}
+		for _, item := range served(r.main) {
+			window[item.MediaItemID] = struct{}{}
+		}
+		for i, row := range withoutMainRowItems(slices.Clone(r.clusters), r.main) {
+			if n := len(row.Items); n > 0 && n < minClusterRowItems && n != len(r.clusters[i].Items) {
+				t.Fatalf("%s: cluster row %d keeps %d items, want at least %d or none", key, row.ClusterIndex, n, minClusterRowItems)
+			}
+			for _, item := range row.Items {
+				if _, ok := window[item.MediaItemID]; ok {
+					t.Fatalf("%s: cluster row %d repeats served main-row title %s", key, row.ClusterIndex, item.MediaItemID)
+				}
+			}
+		}
+	}
+}
+
+// The quality prior lifts the served titles' mean rating, while their fit to
+// the persona's titles and their cosine to its taste barely move. Small
+// cluster pools are left alone.
+func TestRelevanceQualityPriorLiftsRatingsAtLittleCost(t *testing.T) {
+	c := newToyCatalog()
+	var gain float64
+	personas := relevancePersonas(c)
+	for _, key := range []string{"A", "B", "C", "D", "E", "F"} {
+		p := personas[key]
+		with := buildPersonaRows(t, c, p)
+		without := buildPersonaRowsWith(t, c, p, func(s *toyStore) { s.noRatings = true })
+		s, base := served(with.main), served(without.main)
+		delta := with.meanRating(s) - without.meanRating(base)
+		if delta < 0 {
+			t.Fatalf("%s: mean served rating fell %.2f -> %.2f", key, without.meanRating(base), with.meanRating(s))
+		}
+		if drop := without.fit(base) - with.fit(s); drop > 0.02 {
+			t.Fatalf("%s: fit fell %.3f, want at most 0.02", key, drop)
+		}
+		if drop := without.meanTasteCosine(base) - with.meanTasteCosine(s); drop > 0.03 {
+			t.Fatalf("%s: taste cosine fell %.3f, want at most 0.03", key, drop)
+		}
+		gain += delta / 6
+	}
+	if gain < 0.3 {
+		t.Fatalf("mean served rating rose %.2f across personas, want at least 0.3", gain)
+	}
+
+	ratings, types := map[string]float64{}, map[string]string{}
+	small := qualityPool("m", "movie", qualityMinSmallPool-1, func(i int) float64 { return float64(3 + i%6) }, ratings, types)
+	b := rowBuilder{store: &toyStore{catalog: &toyCatalog{byID: map[string]*toyItem{}}}}
+	if got := b.withQualityPrior(t.Context(), small, qualityMinSmallPool); !slices.Equal(got, small) {
+		t.Fatalf("a pool under %d candidates changed", qualityMinSmallPool)
+	}
+}
+
+// reader serves the persona's rows as the cache holds them, the cluster rows
+// less the main row's served window, on day.
+func (r personaRows) reader(day time.Time) *Reader {
+	personal := map[string][]ScoredItem{RecTypeForYouMain + "|": r.main}
+	for _, row := range withoutMainRowItems(slices.Clone(r.clusters), r.main) {
+		personal[RecTypeForYouClusterPrefix+itoa(row.ClusterIndex)+"|"] = row.Items
+	}
+	return &Reader{
+		repo: &fakeReaderRepo{
+			meta:     &TasteProfileMeta{SignalCounts: map[string]int{signalCountPositiveTitles: len(r.persona.history)}},
+			clusters: r.store.clusters,
+			personal: personal,
+		},
+		signals: NewSignalReader(&fakeSignalRepo{}, nil),
+		now:     func() time.Time { return day },
+	}
+}
+
+// page reads the persona's For You page on day, ServedRowSize items a row.
+func (r personaRows) page(t *testing.T, day time.Time) []ForYouRow {
+	t.Helper()
+	rows, err := r.reader(day).GetForYouPage(t.Context(), 1, "p", ServedRowSize, catalog.AccessFilter{})
+	if err != nil {
+		t.Fatalf("%s: page: %v", r.persona.name, err)
+	}
+	return rows
+}
+
+// labelFit is the share of items carrying at least one genre label names.
+func (r personaRows) labelFit(items []ScoredItem, label string) float64 {
+	named := strings.Split(label, clusterLabelSeparator)
+	if len(items) == 0 {
+		return 0
+	}
+	n := 0
+	for _, item := range items {
+		if slices.ContainsFunc(named, func(g string) bool { return slices.Contains(r.catalog.byID[item.MediaItemID].genres, g) }) {
+			n++
+		}
+	}
+	return float64(n) / float64(len(items))
+}
+
+// Cluster rows say what they hold: at least 60% of a row's served titles
+// carry a genre its title names, and no title names more than two genres
+// unless it was extended to tell two rows apart.
+func TestRelevanceClusterTitlesDescribeTheirRows(t *testing.T) {
+	for key, r := range buildAllPersonaRows(t) {
+		for _, row := range r.page(t, relevanceNow) {
+			if row.personalKey == RecTypeForYouMain || row.Type != "cluster" || row.Subject == "" {
+				continue
+			}
+			if n := len(strings.Split(row.Subject, clusterLabelSeparator)); n > labelMaxGenres+1 {
+				t.Fatalf("%s: %q names %d genres", key, row.Label, n)
+			}
+			if fit := r.labelFit(row.Items, row.Subject); fit < 0.6 {
+				t.Fatalf("%s: %.0f%% of %q's served titles carry a genre it names, want at least 60%%", key, 100*fit, row.Label)
+			}
+		}
+	}
+}
+
+// No persona's page shows two rows under one title; the kid's two Family
+// clusters are told apart or one is hidden.
+func TestRelevancePagesNeverRepeatATitle(t *testing.T) {
+	for key, r := range buildAllPersonaRows(t) {
+		labels := rowLabels(r.page(t, relevanceNow))
+		for i, label := range labels {
+			if slices.Contains(labels[:i], label) {
+				t.Fatalf("%s: page %v repeats %q", key, labels, label)
+			}
+		}
+	}
+}
+
+// The personal rows keep their best-matched head and refresh their tail
+// daily: the same all day, the first ten fixed, at least two of the served
+// 20 new each day, and more titles over a week than an unrotated row.
+func TestRelevanceRotationKeepsTheHeadAndRefreshesTheTail(t *testing.T) {
+	for _, key := range []string{"A", "E", "F"} {
+		r := buildAllPersonaRows(t)[key]
+		mainOn := func(day time.Time) []string { return scoredIDs(r.page(t, day)[0].Items) }
+		today := mainOn(relevanceNow)
+		if !slices.Equal(today, mainOn(relevanceNow.Add(6*time.Hour))) {
+			t.Fatalf("%s: the main row changed within the day", key)
+		}
+		week := map[string]struct{}{}
+		for d := range 7 {
+			day := mainOn(relevanceNow.AddDate(0, 0, d))
+			if !slices.Equal(day[:rotationMaxPinned], scoredIDs(served(r.main)[:rotationMaxPinned])) {
+				t.Fatalf("%s: day %d moved the head", key, d)
+			}
+			if d > 0 {
+				if n := ServedRowSize - len(intersect(day, mainOn(relevanceNow.AddDate(0, 0, d-1)))); n < 2 {
+					t.Fatalf("%s: day %d changed %d served titles, want at least 2", key, d, n)
+				}
+			}
+			for _, id := range day {
+				week[id] = struct{}{}
+			}
+		}
+		if len(week) < 25 {
+			t.Fatalf("%s: %d distinct titles served in a week, want at least 25", key, len(week))
+		}
+	}
+}
+
+func intersect(a, b []string) []string {
+	var out []string
+	for _, id := range a {
+		if slices.Contains(b, id) {
+			out = append(out, id)
+		}
+	}
+	return out
+}
+
+// A few new titles in the catalog reach the served rows without displacing
+// the best-matched head; a freshly imported catalog, every title new, gets
+// exactly the rows it would get with none.
+func TestRelevanceFreshnessAddsNewTitlesWithoutDisplacingTheHead(t *testing.T) {
+	newCatalog := func(isNew func(i int) bool) (*toyCatalog, map[string]bool) {
+		c := newToyCatalog()
+		ids := map[string]bool{}
+		for i := range c.items {
+			if isNew(i) {
+				c.items[i].addedAt = relevanceNow.Add(-time.Duration(1+i%5) * 24 * time.Hour)
+				ids[c.items[i].id] = true
+			}
+		}
+		return c, ids
+	}
+	old := newToyCatalog()
+	// One title in 60 is new, about a week's additions to a large library.
+	fresh, newIDs := newCatalog(func(i int) bool { return i%60 == 7 })
+	imported, _ := newCatalog(func(int) bool { return true })
+	countNew := func(items []ScoredItem) int {
+		n := 0
+		for _, item := range items {
+			if newIDs[item.MediaItemID] {
+				n++
+			}
+		}
+		return n
+	}
+	gained := 0
+	for _, key := range []string{"A", "B", "C", "D", "E", "F"} {
+		before := buildPersonaRows(t, old, relevancePersonas(old)[key])
+		after := buildPersonaRows(t, fresh, relevancePersonas(fresh)[key])
+		gained += countNew(served(after.main)) - countNew(served(before.main))
+		if kept := len(intersect(scoredIDs(served(before.main)[:rotationMaxPinned]), scoredIDs(served(after.main)))); kept < rotationMaxPinned-1 {
+			t.Fatalf("%s: %d of the head's %d titles still served, want at least %d", key, kept, rotationMaxPinned, rotationMaxPinned-1)
+		}
+		bulk := buildPersonaRows(t, imported, relevancePersonas(imported)[key])
+		if !slices.Equal(scoredIDs(bulk.main), scoredIDs(before.main)) {
+			t.Fatalf("%s: a freshly imported catalog changes the main row", key)
+		}
+	}
+	if gained < 2 {
+		t.Fatalf("new titles in the served main rows rose by %d across personas, want at least 2", gained)
+	}
+}
+
+// A profile whose interests weigh about 3:1 is served about 3:1: the composed
+// row keeps the heavier interest's share of the served window rather than
+// capping its genre at half.
+func TestRelevanceComposedRowKeepsAHeavyInterestsShare(t *testing.T) {
+	c := newToyCatalog()
+	history := append(titles(c.pick(gHorror, "movie", 0, 12), 5), titles(c.pick(gRomance, "movie", 0, 6), 5)...)
+	for i := range 4 {
+		history[i].rated5 = true
+	}
+	r := buildPersonaRows(t, c, persona{name: "heavy horror", history: history, tastes: []string{gHorror, gRomance}})
+	want, got := r.anchorCounts()
+	if len(want) != 2 {
+		t.Fatalf("anchors = %d, want horror and romance", len(want))
+	}
+	if got[0] < want[0]-1 {
+		t.Fatalf("horror anchor is nearest %d served items, want its %d slots (want %v, got %v)", got[0], want[0], want, got)
+	}
+	if n := r.tasteCount(served(r.main), gHorror); n <= ServedRowSize/2 {
+		t.Fatalf("%d of the served %d carry %s, want more than half", n, ServedRowSize, gHorror)
+	}
+}
+
+// A third interest of three titles gets a cluster of its own and its share of
+// the served window, and the profile's two earlier interests keep theirs.
+func TestRelevanceNewInterestJoinsTheMainRow(t *testing.T) {
+	c := newToyCatalog()
+	base := append(titles(c.pick(gHorror, "movie", 0, 8), 10), titles(c.pick(gRomance, "movie", 0, 6), 10)...)
+	base[0].rated5, base[1].rated5, base[8].rated5 = true, true, true
+	docs := titles(c.pick(gDocumentary, "movie", 0, 3), 0)
+	for i := range docs {
+		docs[i].rated5 = true
+	}
+	tastes := []string{gHorror, gRomance, gDocumentary}
+	before := buildPersonaRows(t, c, persona{name: "two tastes", history: base, tastes: tastes})
+	after := buildPersonaRows(t, c, persona{name: "a third taste", history: append(slices.Clone(base), docs...), tastes: tastes})
+
+	if n := len(before.store.clusters); n != 2 {
+		t.Fatalf("before: %d clusters, want horror and romance", n)
+	}
+	sizes := map[string]int{}
+	for _, cl := range after.store.clusters {
+		sizes[cl.DominantGenres[0]] = cl.MemberCount
+	}
+	if want := map[string]int{gHorror: 8, gRomance: 6, gDocumentary: 3}; !maps.Equal(sizes, want) {
+		t.Fatalf("after: cluster sizes by first dominant genre %v, want %v", sizes, want)
+	}
+	want, got := after.anchorCounts()
+	for i := range want {
+		if got[i] < want[i]/2 {
+			t.Fatalf("after: anchor %d is nearest %d served items, want at least half its %d slots (want %v, got %v)", i, got[i], want[i], want, got)
+		}
+	}
+}
+
+// A main row missing an interest is not built: a failed anchor query or
+// embeddings read fails the row rather than letting the other interests take
+// its slots, and a cluster whose embeddings cannot be read counts as failed
+// and gets no row, so the cached rows stay.
+func TestPersonalRowsFailRatherThanThin(t *testing.T) {
+	c := newToyCatalog()
+	p := relevancePersonas(c)["E"]
+	b, store, exclude := personaBuilder(t, c, p, func(s *toyStore) { s.candidateErrAt = 2 })
+	if anchors := mainRowAnchors(store.clusters); len(anchors) < 2 {
+		t.Fatalf("persona E has %d anchors, want a composed row", len(anchors))
+	}
+	// The second anchor's query fails.
+	if row, err := b.mainRow(t.Context(), 1, "p", CacheCandidateLimit, exclude, catalog.AccessFilter{}); err == nil {
+		t.Fatalf("main row = %d items, want an error for the failed anchor", len(row.Items))
+	}
+
+	b, store, exclude = personaBuilder(t, c, p, func(s *toyStore) { s.embeddingsErr = errors.New("embeddings down") })
+	if _, err := b.mainRow(t.Context(), 1, "p", CacheCandidateLimit, exclude, catalog.AccessFilter{}); err == nil {
+		t.Fatal("main row built without embeddings, want an error")
+	}
+	rows, failed, err := b.clusterRows(t.Context(), 1, "p", CacheCandidateLimit, exclude, catalog.AccessFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(rows) != 0 || failed != len(store.clusters) {
+		t.Fatalf("cluster rows = %d, failed = %d; want none built and all %d failed", len(rows), failed, len(store.clusters))
+	}
+}
diff --git a/internal/recommendations/repo.go b/internal/recommendations/repo.go
index a89d7897d3..fc352a3f82 100644
--- a/internal/recommendations/repo.go
+++ b/internal/recommendations/repo.go
@@ -5,7 +5,9 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"slices"
 	"sort"
+	"strconv"
 	"strings"
 	"time"
 
@@ -16,7 +18,6 @@ import (
 	"github.com/prairie-server/prairie-server/internal/access"
 	"github.com/prairie-server/prairie-server/internal/catalog"
 	"github.com/prairie-server/prairie-server/internal/embeddingvectors"
-	"github.com/prairie-server/prairie-server/internal/userstore"
 )
 
 func ensureCanonicalDimensions(vec []float32) ([]float32, error) {
@@ -24,13 +25,14 @@ func ensureCanonicalDimensions(vec []float32) ([]float32, error) {
 }
 
 const embeddingLockSettingKey = "recommendations.embedding_lock"
-const minHNSWEfSearch = 200
 
-// maxHNSWEfSearch is the largest hnsw.ef_search pgvector accepts. A larger
-// value fails set_config, so the candidate scan never runs. With iterative
-// scans the index keeps returning rows past ef_search, so the cap does not
-// stop a larger LIMIT at 1000 candidates.
-const maxHNSWEfSearch = 1000
+// hnswEfSearch is the hnsw.ef_search candidate scans run with, whatever their
+// LIMIT. With iterative scans the index keeps returning rows past ef_search,
+// up to hnsw.max_scan_tuples, so a larger value only widens each step of the
+// search. Raised with the LIMIT, it made the planner price the index above
+// reading every embedding, so large candidate scans ran as exact scans,
+// several times slower, for nearly the same candidates.
+const hnswEfSearch = 200
 
 // watchedActivityCTE unifies video watch progress and ebook reader progress
 // into one activity stream. Episodes roll up to their parent series via
@@ -76,17 +78,92 @@ watched_activity AS (
 	  )
 )`, catalog.EbookFinishedProgressThresholdSQL)
 
+// recentCompletedItemIDsQuery lists a profile's most recently completed
+// titles that are still in the catalog and of the media types bound at $4
+// (recommendableMediaTypes). Progress outlives a deleted item, and an episode
+// of a deleted series no longer rolls up to it, so a dead ID would otherwise
+// take an anchor's place; a finished book is passed over the same way.
 var recentCompletedItemIDsQuery = fmt.Sprintf(`
 	WITH %s
 	SELECT item_id
 	FROM   watched_activity
 	WHERE  user_id = $1 AND profile_id = $2 AND completed = true
+	  AND  EXISTS (
+		SELECT 1 FROM media_items mi
+		WHERE  mi.content_id = watched_activity.item_id AND mi.type = ANY($4)
+	  )
 	GROUP  BY item_id
 	ORDER  BY MAX(updated_at) DESC, item_id ASC
 	LIMIT  $3
 `, watchedActivityCTE)
 
-var tasteSeedCandidateQuery = fmt.Sprintf(`
+// recommendableMediaTypes are the media types every recommendation row
+// offers: the personal rows (For You, the cluster rows and type supplements,
+// Because You Watched and its anchors, Similar Users, Watch Tonight's
+// candidates), the non-personal rows (the default rows, Popular and the genre
+// rows) and the taste-seed picker, and the Reader drops other types from
+// cached rows. 1.0 supports movies and series; adding a type here extends all
+// of them to it. Other types still shape the taste vector, and an item's own
+// "More like this" list keeps to the item's type.
+//
+//nolint:goconst // The list is data: media types as media_items.type stores them.
+var recommendableMediaTypes = []string{"movie", "series"}
+
+// matchedTitleSQL admits, over media_items aliased mi, the matched titles the
+// taste candidate queries draw from.
+const matchedTitleSQL = "mi.status = 'matched'"
+
+// crowdMinAccounts is how many login accounts must have watched a title
+// before the server's viewing counts as a crowd: one household's profiles
+// are one account, so their viewing alone is never "popular".
+const crowdMinAccounts = 2
+
+// Catalog-rating SQL over media_items aliased mi, shared by every row that
+// ranks titles by their own rating. The catalog records no vote counts for
+// most titles, and an obscure title's rating rests on a handful of votes, so
+// a large catalog's best-rated titles are mostly ones nobody has heard of.
+// An IMDb rating of 9.6 or more and a TMDB rating of 9.5 or more are nearly
+// always such ratings (metadata files also copy a TMDB score into the IMDb
+// field), so neither is trusted; an IMDb rating leads a TMDB one; and
+// notable titles lead the rest.
+const (
+	// notableSQL marks a title whose metadata shows it is widely known: a
+	// logo and at least five keywords. Of the titles whose IMDb vote count is
+	// known, 98% of those with 10,000 votes or more are notable and 9% of
+	// those with fewer than 100.
+	notableSQL = `(mi.logo_path IS NOT NULL AND mi.logo_path <> '' AND COALESCE(cardinality(mi.keywords), 0) >= 5)`
+	// guardedIMDbRatingSQL is the IMDb rating when it is trusted.
+	guardedIMDbRatingSQL = `CASE WHEN mi.rating_imdb < 9.6 THEN mi.rating_imdb END`
+	// guardedTMDBRatingSQL is the TMDB rating when it is trusted.
+	guardedTMDBRatingSQL = `CASE WHEN mi.rating_tmdb < 9.5 THEN mi.rating_tmdb END`
+	// ratingTierSQL is a title's rating reliability: 2 with a trusted IMDb
+	// rating, 1 with only a trusted TMDB rating, else 0.
+	ratingTierSQL = `CASE WHEN mi.rating_imdb < 9.6 THEN 2 WHEN mi.rating_tmdb < 9.5 THEN 1 ELSE 0 END`
+	// catalogRatingSQL is a title's rating: trusted IMDb, else trusted TMDB.
+	catalogRatingSQL = `COALESCE(` + guardedIMDbRatingSQL + `, ` + guardedTMDBRatingSQL + `)`
+	// catalogRatingOrderSQL ranks notable titles first, then by reliability
+	// tier and catalogRatingSQL. idx_media_items_type_catalog_rank indexes
+	// this order per media type; keep the two identical.
+	catalogRatingOrderSQL = notableSQL + ` DESC, ` + ratingTierSQL + ` DESC, ` + guardedIMDbRatingSQL + ` DESC NULLS LAST, ` + guardedTMDBRatingSQL + ` DESC NULLS LAST`
+)
+
+// tasteSeedGenreRoundRobinBase is how many of the picker's best candidates
+// are interleaved by genre, so its first pages show every genre's leader
+// rather than the server's most-watched genres only.
+const tasteSeedGenreRoundRobinBase = 600
+
+// tasteSeedCandidateQuery builds the taste-seed picker query, which answers
+// each candidate's content ID and first genre in rank order: server
+// engagement, then rating reliability and rating, then recency. conditions
+// are the caller's predicates; limit and offset bind at limitArg and
+// limitArg+1.
+func tasteSeedCandidateQuery(conditions []string, limitArg int) string {
+	conditions = append([]string{
+		recommendationItemEligibilityWhereClause("mi"),
+		"mi.poster_path IS NOT NULL",
+		"mi.poster_path <> ''",
+	}, conditions...)
+	return fmt.Sprintf(`
 			WITH %s,
 			watched_counts AS (
 				SELECT item_id, COUNT(DISTINCT watcher_id) AS watch_count
@@ -94,40 +171,58 @@ var tasteSeedCandidateQuery = fmt.Sprintf(`
 				WHERE  updated_at > NOW() - INTERVAL '180 days'
 				GROUP  BY item_id
 			)
-			SELECT mi.content_id
+			SELECT mi.content_id, COALESCE(mi.genres[1], '')
 			FROM   media_items mi
 			LEFT JOIN watched_counts wc ON wc.item_id = mi.content_id
 			WHERE  %s
-			  AND  mi.type IN ('movie', 'series', 'audiobook', 'ebook')
-			  AND  mi.poster_path IS NOT NULL
-			  AND  mi.poster_path <> ''
 			ORDER  BY COALESCE(wc.watch_count, 0) DESC,
-			          CASE
-			            WHEN mi.rating_imdb IS NOT NULL THEN 2
-			            WHEN mi.rating_tmdb IS NOT NULL AND mi.rating_tmdb < 9.5 THEN 1
-			            ELSE 0
-			          END DESC,
-			          mi.rating_imdb DESC NULLS LAST,
-			          CASE WHEN mi.rating_tmdb < 9.5 THEN mi.rating_tmdb END DESC NULLS LAST,
+			          %s,
 			          mi.year DESC NULLS LAST,
 			          mi.content_id ASC
-			LIMIT  $1 OFFSET $2`, watchedActivityCTE, recommendationItemEligibilityWhereClause("mi"))
+			LIMIT  $%d OFFSET $%d`, watchedActivityCTE, strings.Join(conditions, " AND "), catalogRatingOrderSQL, limitArg, limitArg+1)
+}
+
+// tasteSeedCandidate is a picker candidate and its first genre: the first
+// genre its provider lists, not a true primary genre.
+type tasteSeedCandidate struct {
+	id, firstGenre string
+}
+
+// interleaveByGenre reorders ranked candidates genre by genre: every first
+// genre's best candidate, then every genre's second, and so on, each round
+// in rank order.
+func interleaveByGenre(ranked []tasteSeedCandidate) []string {
+	rounds := make([]int, len(ranked))
+	seen := map[string]int{}
+	for i, c := range ranked {
+		rounds[i] = seen[c.firstGenre]
+		seen[c.firstGenre]++
+	}
+	order := make([]int, len(ranked))
+	for i := range order {
+		order[i] = i
+	}
+	sort.SliceStable(order, func(a, b int) bool { return rounds[order[a]] < rounds[order[b]] })
+	ids := make([]string, len(order))
+	for i, idx := range order {
+		ids[i] = ranked[idx].id
+	}
+	return ids
+}
 
 // Repo provides database operations for the recommendation system.
 type Repo struct {
-	pool *pgxpool.Pool
+	pool        *pgxpool.Pool
+	titleCounts *titleCountCache
+	topGenre    topGenreCache
 }
 
 // NewRepo creates a new Repo with the given connection pool.
 func NewRepo(pool *pgxpool.Pool) *Repo {
-	return &Repo{pool: pool}
-}
-
-func hnswEfSearch(candidateLimit int) int {
-	return min(max(candidateLimit, minHNSWEfSearch), maxHNSWEfSearch)
+	return &Repo{pool: pool, titleCounts: newTitleCountCache()}
 }
 
-func (r *Repo) withHNSWCandidateScan(ctx context.Context, candidateLimit int, fn func(pgx.Tx) error) error {
+func (r *Repo) withHNSWCandidateScan(ctx context.Context, fn func(pgx.Tx) error) error {
 	tx, err := r.pool.BeginTx(ctx, pgx.TxOptions{})
 	if err != nil {
 		return fmt.Errorf("begin hnsw candidate scan tx: %w", err)
@@ -137,7 +232,7 @@ func (r *Repo) withHNSWCandidateScan(ctx context.Context, candidateLimit int, fn
 	_, err = tx.Exec(ctx, `
 		SELECT set_config('hnsw.iterative_scan', 'relaxed_order', true),
 		       set_config('hnsw.ef_search', $1, true)
-	`, fmt.Sprintf("%d", hnswEfSearch(candidateLimit)))
+	`, strconv.Itoa(hnswEfSearch))
 	if err != nil {
 		return fmt.Errorf("configure hnsw candidate scan: %w", err)
 	}
@@ -210,19 +305,27 @@ func (r *Repo) UpsertEmbedding(ctx context.Context, itemID string, embedding []f
 
 // GetEmbeddingLock retrieves the embedding lock metadata from server_settings.
 func (r *Repo) GetEmbeddingLock(ctx context.Context) (*EmbeddingLock, error) {
+	return ReadEmbeddingLock(ctx, r.pool)
+}
+
+// RowQuerier runs a query that returns at most one row. *pgxpool.Pool and
+// pgx.Tx satisfy it.
+type RowQuerier interface {
+	QueryRow(ctx context.Context, sql string, args ...any) pgx.Row
+}
+
+// ReadEmbeddingLock reads the embedding lock through q, which may be a
+// transaction. It returns nil when no lock is set.
+func ReadEmbeddingLock(ctx context.Context, q RowQuerier) (*EmbeddingLock, error) {
 	var raw string
-	err := r.pool.QueryRow(ctx, `SELECT value FROM server_settings WHERE key = $1`, embeddingLockSettingKey).Scan(&raw)
+	err := q.QueryRow(ctx, `SELECT value FROM server_settings WHERE key = $1`, embeddingLockSettingKey).Scan(&raw)
 	if err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
 			return nil, nil
 		}
 		return nil, fmt.Errorf("get embedding lock: %w", err)
 	}
-	lock, err := ParseEmbeddingLock(raw)
-	if err != nil {
-		return nil, err
-	}
-	return lock, nil
+	return ParseEmbeddingLock(raw)
 }
 
 // SetEmbeddingLock stores the embedding lock metadata in server_settings.
@@ -261,24 +364,133 @@ func (r *Repo) GetEmbedding(ctx context.Context, itemID string) ([]float32, erro
 	return v.Slice(), nil
 }
 
+// excludeEmbeddingIDsCondition drops the item IDs bound to $2 from an
+// embedding scan.
+const excludeEmbeddingIDsCondition = "e.media_item_id != ALL($2)"
+
+// ThemeMinSeeds is the fewest embedded seeds ThemeNeighbors builds a theme
+// from; one or two titles describe themselves, not a theme.
+const ThemeMinSeeds = 3
+
+// ThemeNeighbors returns movies and series near the theme the seed items
+// share: the average of their embeddings. Results are nearest first and stop
+// at the median seed's distance from that average, so every title returned is
+// at least as close to the theme as a typical seed. Seeds are excluded. It
+// returns nil when fewer than ThemeMinSeeds seeds have embeddings. filter's
+// library and maturity limits apply in the query; limit bounds the scan.
+func (r *Repo) ThemeNeighbors(ctx context.Context, seedIDs []string, limit int, filter catalog.AccessFilter) ([]ScoredItem, error) {
+	if len(seedIDs) == 0 || limit <= 0 {
+		return nil, nil
+	}
+	if filter.AllowedLibraryIDs != nil && len(filter.AllowedLibraryIDs) == 0 {
+		return nil, nil
+	}
+	var (
+		centroid pgvector.HalfVector
+		seeds    int
+		cutoff   *float64
+	)
+	err := r.pool.QueryRow(ctx, `
+		WITH seeds AS (
+			SELECT embedding::halfvec(3072) AS v
+			FROM   media_item_embeddings
+			WHERE  media_item_id = ANY($1)
+		), centroid AS (
+			SELECT avg(embedding)::halfvec(3072) AS v
+			FROM   media_item_embeddings
+			WHERE  media_item_id = ANY($1)
+		)
+		SELECT centroid.v,
+		       (SELECT count(*) FROM seeds),
+		       (SELECT percentile_cont(0.5) WITHIN GROUP (ORDER BY seeds.v <=> centroid.v) FROM seeds)
+		FROM   centroid
+		WHERE  centroid.v IS NOT NULL`, seedIDs).Scan(&centroid, &seeds, &cutoff)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, fmt.Errorf("theme centroid: %w", err)
+	}
+	if seeds < ThemeMinSeeds || cutoff == nil {
+		return nil, nil
+	}
+
+	conditions := []string{excludeEmbeddingIDsCondition, "mi.type IN ('movie', 'series')"}
+	args := []any{centroid, seedIDs, limit}
+	argIdx := len(args) + 1
+	catalog.ApplyLibraryAccessFilter("mi.content_id", filter, &conditions, &args, &argIdx)
+	catalog.ApplyMaturityLimits("mi", filter, &conditions, &args, &argIdx)
+	query := fmt.Sprintf(`
+			SELECT e.media_item_id,
+			       e.embedding::halfvec(3072) <=> $1::halfvec(3072) AS distance
+			FROM   media_item_embeddings e
+			JOIN   media_items mi ON mi.content_id = e.media_item_id
+			WHERE  %s
+			ORDER  BY e.embedding::halfvec(3072) <=> $1::halfvec(3072)
+			LIMIT  $3`, strings.Join(conditions, " AND "))
+
+	var items []ScoredItem
+	err = r.withHNSWCandidateScan(ctx, func(tx pgx.Tx) error {
+		rows, err := tx.Query(ctx, query, args...)
+		if err != nil {
+			return err
+		}
+		defer rows.Close()
+		for rows.Next() {
+			var id string
+			var distance float64
+			if err := rows.Scan(&id, &distance); err != nil {
+				return fmt.Errorf("scanning theme neighbor: %w", err)
+			}
+			// Relaxed-order iterative scans can return a farther row before
+			// a nearer one, so filter rather than stop at the first miss.
+			if distance <= *cutoff {
+				items = append(items, ScoredItem{MediaItemID: id, Score: 1 - distance})
+			}
+		}
+		return rows.Err()
+	})
+	if err != nil {
+		return nil, fmt.Errorf("theme neighbors: %w", err)
+	}
+	sort.SliceStable(items, func(i, j int) bool { return items[i].Score > items[j].Score })
+	return items, nil
+}
+
 // FindSimilar returns items ordered by cosine similarity to the given embedding,
 // excluding the specified item IDs. When mediaType is non-empty, results are
 // restricted to that media_items.type so cross-media-type results never appear
 // (e.g. an audiobook in a "Similar to this movie" rail) once audiobook
-// embeddings exist alongside movie/series ones.
-func (r *Repo) FindSimilar(ctx context.Context, embedding []float32, excludeIDs []string, mediaType string, limit int) ([]ScoredItem, error) {
-	var items []ScoredItem
-	err := r.withHNSWCandidateScan(ctx, limit, func(tx pgx.Tx) error {
-		rows, err := tx.Query(ctx, `
+// embeddings exist alongside movie/series ones. filter's library and maturity
+// limits apply in the query, as in findTasteProfileCandidates, so a restricted
+// viewer gets limit items it can see; a zero filter applies none.
+func (r *Repo) FindSimilar(ctx context.Context, embedding []float32, excludeIDs []string, mediaType string, limit int, filter catalog.AccessFilter) ([]ScoredItem, error) {
+	if filter.AllowedLibraryIDs != nil && len(filter.AllowedLibraryIDs) == 0 {
+		return []ScoredItem{}, nil
+	}
+	if excludeIDs == nil {
+		excludeIDs = []string{}
+	}
+	conditions := []string{
+		excludeEmbeddingIDsCondition,
+		"($4 = '' OR mi.type = $4)",
+	}
+	args := []any{pgvector.NewHalfVector(embedding), excludeIDs, limit, mediaType}
+	argIdx := len(args) + 1
+	catalog.ApplyLibraryAccessFilter("mi.content_id", filter, &conditions, &args, &argIdx)
+	catalog.ApplyMaturityLimits("mi", filter, &conditions, &args, &argIdx)
+	query := fmt.Sprintf(`
 			SELECT e.media_item_id,
 			       1 - (e.embedding::halfvec(3072) <=> $1::halfvec(3072)) AS similarity
 			FROM   media_item_embeddings e
 			JOIN   media_items mi ON mi.content_id = e.media_item_id
-			WHERE  e.media_item_id != ALL($2)
-			  AND  ($4 = '' OR mi.type = $4)
+			WHERE  %s
 			ORDER  BY e.embedding::halfvec(3072) <=> $1::halfvec(3072)
-			LIMIT  $3
-		`, pgvector.NewVector(embedding), excludeIDs, limit, mediaType)
+			LIMIT  $3`, strings.Join(conditions, " AND "))
+
+	var items []ScoredItem
+	err := r.withHNSWCandidateScan(ctx, func(tx pgx.Tx) error {
+		rows, err := tx.Query(ctx, query, args...)
 		if err != nil {
 			return err
 		}
@@ -304,8 +516,9 @@ func (r *Repo) FindSimilar(ctx context.Context, embedding []float32, excludeIDs
 }
 
 // FindTasteProfileCandidates returns full-library discover candidates for a
-// user's taste-profile embedding, optionally constrained to items sharing at
-// least one selected genre and to the caller's access scope.
+// user's taste-profile embedding: matched titles of recommendableMediaTypes,
+// optionally constrained to items sharing at least one selected genre and to
+// the caller's access scope.
 func (r *Repo) FindTasteProfileCandidates(
 	ctx context.Context,
 	embedding []float32,
@@ -317,6 +530,8 @@ func (r *Repo) FindTasteProfileCandidates(
 	return r.findTasteProfileCandidates(ctx, embedding, excludeIDs, genres, limit, filter, "")
 }
 
+// FindTasteProfileCandidatesByMediaType is FindTasteProfileCandidates for
+// one media type. A type outside recommendableMediaTypes has no candidates.
 func (r *Repo) FindTasteProfileCandidatesByMediaType(
 	ctx context.Context,
 	embedding []float32,
@@ -345,21 +560,25 @@ func (r *Repo) findTasteProfileCandidates(
 		excludeIDs = []string{}
 	}
 
+	// Candidates are matched titles of recommendableMediaTypes; a type
+	// supplement asks for one of them.
+	mediaTypes := recommendableMediaTypes
+	if mediaType != "" {
+		if !slices.Contains(recommendableMediaTypes, mediaType) {
+			return []ScoredItem{}, map[string][]string{}, nil
+		}
+		mediaTypes = []string{mediaType}
+	}
 	conditions := []string{
-		"(mi.status = 'matched' OR mi.type = 'audiobook')",
-		"e.media_item_id != ALL($2)",
+		matchedTitleSQL,
+		"mi.type = ANY($3)",
+		excludeEmbeddingIDsCondition,
 	}
-	args := []any{pgvector.NewVector(embedding), excludeIDs}
-	argIdx := 3
+	args := []any{pgvector.NewHalfVector(embedding), excludeIDs, mediaTypes}
+	argIdx := 4
 	genreMatchCountSQL := "0"
 	annLimit := limit
 
-	if mediaType != "" {
-		conditions = append(conditions, fmt.Sprintf("mi.type = $%d", argIdx))
-		args = append(args, mediaType)
-		argIdx++
-	}
-
 	if len(genres) > 0 {
 		annLimit = limit * 5
 		if annLimit < limit {
@@ -414,7 +633,7 @@ func (r *Repo) findTasteProfileCandidates(
 
 	var items []ScoredItem
 	genreMap := make(map[string][]string, limit)
-	err := r.withHNSWCandidateScan(ctx, annLimit, func(tx pgx.Tx) error {
+	err := r.withHNSWCandidateScan(ctx, func(tx pgx.Tx) error {
 		rows, err := tx.Query(ctx, query, args...)
 		if err != nil {
 			return err
@@ -496,13 +715,19 @@ func (r *Repo) ItemsNeedingEmbedding(ctx context.Context, currentModel, afterID
 	return ids, nil
 }
 
+// ListEmbeddingTextCandidates returns items embedded with currentModel whose
+// stored canonical text differs from the text rebuilt here in SQL, ordered by
+// content_id and paged via afterID (pass "" for the first page). The SQL text
+// approximates embeddings.BuildEmbeddingText, so callers re-check each row in
+// Go before re-embedding it.
 func (r *Repo) ListEmbeddingTextCandidates(ctx context.Context, afterID, currentModel string, limit int) ([]EmbeddingTextCandidate, error) {
 	query := fmt.Sprintf(`
-		-- Keep current_text in sync with embeddings.BuildEmbeddingText. This lets
-		-- the embedding job page over only missing, model-stale, or text-stale rows.
+		-- Keep current_text in sync with embeddings.BuildEmbeddingText.
 		-- Book lines map to embeddings.mediaTypeLabel + the author/narrator
 		-- branch in BuildEmbeddingText; any divergence here forces book items
-		-- to re-embed every job run.
+		-- to re-embed every job run. People sort like sortItemPeople in Go:
+		-- sort_order, then name and character compared byte by byte
+		-- (COLLATE "C"), then person_id.
 		WITH text_candidates AS (
 			SELECT mi.content_id,
 			       COALESCE(e.model, '') AS model,
@@ -542,7 +767,7 @@ func (r *Repo) ListEmbeddingTextCandidates(ctx context.Context, afterID, current
 			LEFT JOIN LATERAL (
 				SELECT COALESCE(string_agg(
 					CASE WHEN ranked.character <> '' THEN ranked.name || ' as ' || ranked.character ELSE ranked.name END,
-					', ' ORDER BY ranked.sort_order
+					', ' ORDER BY ranked.sort_order, ranked.name COLLATE "C", ranked.character COLLATE "C", ranked.person_id
 				), '') AS names
 				FROM (
 					SELECT COALESCE(p.name, '') AS name,
@@ -553,33 +778,33 @@ func (r *Repo) ListEmbeddingTextCandidates(ctx context.Context, afterID, current
 					JOIN people p ON p.id = ip.person_id
 					WHERE ip.content_id = mi.content_id
 					  AND ip.kind = 1
-					ORDER BY ip.sort_order, p.name, COALESCE(ip.character, ''), ip.person_id
+					ORDER BY ip.sort_order, p.name COLLATE "C", COALESCE(ip.character, '') COLLATE "C", ip.person_id
 					LIMIT 5
 				) ranked
 			) actors ON TRUE
 			LEFT JOIN LATERAL (
-				SELECT COALESCE(string_agg(COALESCE(p.name, ''), ', ' ORDER BY ip.sort_order, p.name, ip.person_id), '') AS names
+				SELECT COALESCE(string_agg(COALESCE(p.name, ''), ', ' ORDER BY ip.sort_order, p.name COLLATE "C", COALESCE(ip.character, '') COLLATE "C", ip.person_id), '') AS names
 				FROM item_people ip
 				JOIN people p ON p.id = ip.person_id
 				WHERE ip.content_id = mi.content_id
 				  AND ip.kind = 2
 			) directors ON TRUE
 			LEFT JOIN LATERAL (
-				SELECT COALESCE(string_agg(COALESCE(p.name, ''), ', ' ORDER BY ip.sort_order, p.name, ip.person_id), '') AS names
+				SELECT COALESCE(string_agg(COALESCE(p.name, ''), ', ' ORDER BY ip.sort_order, p.name COLLATE "C", COALESCE(ip.character, '') COLLATE "C", ip.person_id), '') AS names
 				FROM item_people ip
 				JOIN people p ON p.id = ip.person_id
 				WHERE ip.content_id = mi.content_id
 				  AND ip.kind = 3
 			) writers ON TRUE
 			LEFT JOIN LATERAL (
-				SELECT COALESCE(string_agg(COALESCE(p.name, ''), ', ' ORDER BY ip.sort_order, p.name, ip.person_id), '') AS names
+				SELECT COALESCE(string_agg(COALESCE(p.name, ''), ', ' ORDER BY ip.sort_order, p.name COLLATE "C", COALESCE(ip.character, '') COLLATE "C", ip.person_id), '') AS names
 				FROM item_people ip
 				JOIN people p ON p.id = ip.person_id
 				WHERE ip.content_id = mi.content_id
 				  AND ip.kind = 7
 			) authors ON TRUE
 			LEFT JOIN LATERAL (
-				SELECT COALESCE(string_agg(COALESCE(p.name, ''), ', ' ORDER BY ip.sort_order, p.name, ip.person_id), '') AS names
+				SELECT COALESCE(string_agg(COALESCE(p.name, ''), ', ' ORDER BY ip.sort_order, p.name COLLATE "C", COALESCE(ip.character, '') COLLATE "C", ip.person_id), '') AS names
 				FROM item_people ip
 				JOIN people p ON p.id = ip.person_id
 				WHERE ip.content_id = mi.content_id
@@ -592,9 +817,8 @@ func (r *Repo) ListEmbeddingTextCandidates(ctx context.Context, afterID, current
 		       mi.model,
 		       mi.canonical_text
 		FROM   text_candidates mi
-		WHERE  mi.model = ''
-		   OR  mi.model != $2
-		   OR  mi.canonical_text IS DISTINCT FROM mi.current_text
+		WHERE  mi.model = $2
+		  AND  mi.canonical_text IS DISTINCT FROM mi.current_text
 		ORDER  BY mi.content_id
 		LIMIT  $3
 	`, embeddingEligibilityWhereClause())
@@ -618,6 +842,16 @@ func (r *Repo) ListEmbeddingTextCandidates(ctx context.Context, afterID, current
 	return candidates, nil
 }
 
+// HasEmbeddingsFromModel reports whether any item has an embedding from model,
+// such as one a catalog import stored.
+func (r *Repo) HasEmbeddingsFromModel(ctx context.Context, model string) (bool, error) {
+	var has bool
+	if err := r.pool.QueryRow(ctx, `SELECT EXISTS (SELECT 1 FROM media_item_embeddings WHERE model = $1)`, model).Scan(&has); err != nil {
+		return false, fmt.Errorf("check embeddings from model: %w", err)
+	}
+	return has, nil
+}
+
 // EmbeddingCount returns the total number of stored embeddings.
 func (r *Repo) EmbeddingCount(ctx context.Context) (int, error) {
 	var count int
@@ -641,10 +875,11 @@ func (r *Repo) TotalMediaItemCount(ctx context.Context) (int, error) {
 	return count, nil
 }
 
-// TasteProfileCount returns the total number of stored taste profiles.
+// TasteProfileCount returns the number of profiles with a taste vector. Rows
+// cleared for having no positive signal (see ClearTasteProfile) do not count.
 func (r *Repo) TasteProfileCount(ctx context.Context) (int, error) {
 	var count int
-	err := r.pool.QueryRow(ctx, `SELECT COUNT(*) FROM user_taste_profiles`).Scan(&count)
+	err := r.pool.QueryRow(ctx, `SELECT COUNT(*) FROM user_taste_profiles WHERE embedding IS NOT NULL`).Scan(&count)
 	if err != nil {
 		return 0, fmt.Errorf("taste profile count: %w", err)
 	}
@@ -661,8 +896,20 @@ func (r *Repo) CacheEntryCount(ctx context.Context) (int, error) {
 	return count, nil
 }
 
+// Now returns the database's current time. Refresh start times come from
+// here, so they compare correctly with stale marks the database stamps.
+func (r *Repo) Now(ctx context.Context) (time.Time, error) {
+	var now time.Time
+	if err := r.pool.QueryRow(ctx, `SELECT NOW()`).Scan(&now); err != nil {
+		return time.Time{}, fmt.Errorf("read database time: %w", err)
+	}
+	return now, nil
+}
+
 // UpsertTasteProfile stores or updates a user's precomputed taste profile.
-func (r *Repo) UpsertTasteProfile(ctx context.Context, userID int, profileID string, embedding []float32, signalCounts map[string]int, maxContentRating string) error {
+// updatedAt is when the refresh that built it started reading signals, so a
+// stale mark written after that stays newer than the profile.
+func (r *Repo) UpsertTasteProfile(ctx context.Context, userID int, profileID string, embedding []float32, signalCounts map[string]int, maxContentRating string, updatedAt time.Time) error {
 	countsJSON, err := json.Marshal(signalCounts)
 	if err != nil {
 		return fmt.Errorf("marshaling signal counts: %w", err)
@@ -671,19 +918,88 @@ func (r *Repo) UpsertTasteProfile(ctx context.Context, userID int, profileID str
 	_, err = r.pool.Exec(ctx, `
 		INSERT INTO user_taste_profiles
 			(user_id, profile_id, embedding, signal_counts, max_content_rating, updated_at)
-		VALUES ($1, $2, $3, $4, $5, NOW())
+		VALUES ($1, $2, $3, $4, $5, $6)
 		ON CONFLICT (user_id, profile_id) DO UPDATE
 			SET embedding          = EXCLUDED.embedding,
 			    signal_counts      = EXCLUDED.signal_counts,
 			    max_content_rating = EXCLUDED.max_content_rating,
-			    updated_at         = NOW()
-	`, userID, profileID, pgvector.NewVector(embedding), countsJSON, maxContentRating)
+			    updated_at         = EXCLUDED.updated_at
+	`, userID, profileID, pgvector.NewVector(embedding), countsJSON, maxContentRating, updatedAt)
 	if err != nil {
 		return fmt.Errorf("upsert taste profile for user %d profile %s: %w", userID, profileID, err)
 	}
 	return nil
 }
 
+// clearTasteVectorQuery clears an existing taste row. A row a concurrent
+// profile purge deleted stays deleted: UPDATE skips it, where an upsert would
+// insert it again.
+const clearTasteVectorQuery = `
+		UPDATE user_taste_profiles
+		SET    embedding          = NULL,
+		       signal_counts      = $3,
+		       max_content_rating = $4,
+		       updated_at         = $5
+		WHERE  user_id = $1 AND profile_id = $2`
+
+// createClearedTasteProfileQuery is clearTasteVectorQuery that also creates a
+// missing row.
+const createClearedTasteProfileQuery = `
+		INSERT INTO user_taste_profiles
+			(user_id, profile_id, embedding, signal_counts, max_content_rating, updated_at)
+		VALUES ($1, $2, NULL, $3, $4, $5)
+		ON CONFLICT (user_id, profile_id) DO UPDATE
+			SET embedding          = NULL,
+			    signal_counts      = EXCLUDED.signal_counts,
+			    max_content_rating = EXCLUDED.max_content_rating,
+			    updated_at         = EXCLUDED.updated_at`
+
+// ClearTasteProfile stores a profile that has no positive taste signal. In one
+// transaction it sets the profile's row to signalCounts and no taste vector,
+// and deletes the profile's taste clusters and every cached row of the
+// profile; global rows are not the profile's. Keeping the row lets
+// MarkProfileStale mark it and lets readers compute its cold-start level. A
+// missing row is created only with create, which a refresh passes only for a
+// profile its user store still lists, so the row a profile deletion purged
+// does not come back. updatedAt is as for UpsertTasteProfile.
+func (r *Repo) ClearTasteProfile(ctx context.Context, userID int, profileID string, signalCounts map[string]int, maxContentRating string, updatedAt time.Time, create bool) error {
+	countsJSON, err := json.Marshal(signalCounts)
+	if err != nil {
+		return fmt.Errorf("marshaling signal counts: %w", err)
+	}
+
+	tx, err := r.pool.Begin(ctx)
+	if err != nil {
+		return fmt.Errorf("begin tx to clear taste profile: %w", err)
+	}
+	defer func() { _ = tx.Rollback(ctx) }()
+
+	if err := lockTasteClusters(ctx, tx, userID, profileID); err != nil {
+		return err
+	}
+	query := clearTasteVectorQuery
+	if create {
+		query = createClearedTasteProfileQuery
+	}
+	if _, err := tx.Exec(ctx, query, userID, profileID, countsJSON, maxContentRating, updatedAt); err != nil {
+		return fmt.Errorf("clear taste vector for user %d profile %s: %w", userID, profileID, err)
+	}
+	if _, err := tx.Exec(ctx,
+		`DELETE FROM user_taste_clusters WHERE user_id = $1 AND profile_id = $2`,
+		userID, profileID); err != nil {
+		return fmt.Errorf("delete taste clusters for user %d profile %s: %w", userID, profileID, err)
+	}
+	if _, err := tx.Exec(ctx,
+		`DELETE FROM recommendation_cache WHERE user_id = $1 AND profile_id = $2`,
+		userID, profileID); err != nil {
+		return fmt.Errorf("delete cached rows for user %d profile %s: %w", userID, profileID, err)
+	}
+	if err := tx.Commit(ctx); err != nil {
+		return fmt.Errorf("commit cleared taste profile for user %d profile %s: %w", userID, profileID, err)
+	}
+	return nil
+}
+
 // TasteProfileMeta holds the non-vector metadata for a taste profile.
 type TasteProfileMeta struct {
 	SignalCounts     map[string]int
@@ -720,11 +1036,12 @@ func (r *Repo) GetTasteProfileMeta(ctx context.Context, userID int, profileID st
 }
 
 // GetTasteProfile retrieves the embedding for a user's taste profile.
-// Returns nil, nil when no profile exists.
+// Returns nil, nil when no profile exists or the profile has no taste vector
+// (see ClearTasteProfile).
 func (r *Repo) GetTasteProfile(ctx context.Context, userID int, profileID string) ([]float32, error) {
 	var v pgvector.Vector
 	err := r.pool.QueryRow(ctx,
-		`SELECT embedding FROM user_taste_profiles WHERE user_id = $1 AND profile_id = $2`,
+		`SELECT embedding FROM user_taste_profiles WHERE user_id = $1 AND profile_id = $2 AND embedding IS NOT NULL`,
 		userID, profileID,
 	).Scan(&v)
 	if err != nil {
@@ -749,17 +1066,18 @@ func (r *Repo) FindSimilarUsers(ctx context.Context, userID int, profileID strin
 
 	allowedPeerRatings := compatiblePeerContentRatings(maxContentRating)
 	var users []UserSimilarity
-	err = r.withHNSWCandidateScan(ctx, limit, func(tx pgx.Tx) error {
+	err = r.withHNSWCandidateScan(ctx, func(tx pgx.Tx) error {
 		rows, err := tx.Query(ctx, `
 			SELECT p.user_id,
 			       p.profile_id,
 			       1 - (p.embedding::halfvec(3072) <=> $1::halfvec(3072)) AS score
 			FROM   user_taste_profiles p
 			WHERE  p.user_id     != $2
+			  AND  p.embedding IS NOT NULL
 			  AND  ($3 OR COALESCE(p.max_content_rating, '') = '' OR p.max_content_rating = ANY($4::text[]))
 			ORDER  BY p.embedding::halfvec(3072) <=> $1::halfvec(3072)
 			LIMIT  $5
-		`, pgvector.NewVector(embedding), userID, maxContentRating == "", allowedPeerRatings, limit)
+		`, pgvector.NewHalfVector(embedding), userID, maxContentRating == "", allowedPeerRatings, limit)
 		if err != nil {
 			return err
 		}
@@ -846,6 +1164,65 @@ func (r *Repo) UpsertRecommendationCache(ctx context.Context, userID int, profil
 	return nil
 }
 
+// extendGlobalRecommendationCacheQuery addresses global rows the way
+// UpsertRecommendationCache writes them: user_id NULL, the global profile ID,
+// and no source item.
+const extendGlobalRecommendationCacheQuery = `
+		UPDATE recommendation_cache
+		SET    expires_at = GREATEST(expires_at, $4::timestamptz)
+		WHERE  user_id IS NULL
+		  AND  profile_id     = $1
+		  AND  source_item_id = ''
+		  AND  (rec_type = $2 OR ($3 AND starts_with(rec_type, $2)))
+		  AND  expires_at     > NOW()`
+
+// ExtendGlobalRecommendationCache keeps the unexpired global row recType, or
+// every global row whose type starts with recType when prefix is set, until at
+// least expiresAt. It returns the number of rows it extended.
+func (r *Repo) ExtendGlobalRecommendationCache(ctx context.Context, recType string, prefix bool, expiresAt string) (int64, error) {
+	tag, err := r.pool.Exec(ctx, extendGlobalRecommendationCacheQuery, GlobalCacheProfileID, recType, prefix, expiresAt)
+	if err != nil {
+		return 0, fmt.Errorf("extend global recommendation cache %s: %w", recType, err)
+	}
+	return tag.RowsAffected(), nil
+}
+
+const deleteGlobalRecommendationCacheQuery = `
+		DELETE FROM recommendation_cache
+		WHERE  user_id IS NULL
+		  AND  profile_id     = $1
+		  AND  source_item_id = ''
+		  AND  (rec_type = $2 OR ($3 AND starts_with(rec_type, $2)))
+		  AND  rec_type <> ALL($4::text[])`
+
+// DeleteGlobalRecommendationCache deletes the global row recType, or every
+// global row whose type starts with recType when prefix is set, except the
+// types in keep. It returns the number of rows it deleted.
+func (r *Repo) DeleteGlobalRecommendationCache(ctx context.Context, recType string, prefix bool, keep []string) (int64, error) {
+	if keep == nil {
+		// A NULL array would make the ALL comparison NULL and delete nothing.
+		keep = []string{}
+	}
+	tag, err := r.pool.Exec(ctx, deleteGlobalRecommendationCacheQuery, GlobalCacheProfileID, recType, prefix, keep)
+	if err != nil {
+		return 0, fmt.Errorf("delete global recommendation cache %s: %w", recType, err)
+	}
+	return tag.RowsAffected(), nil
+}
+
+// DeleteProfileRecommendationCache deletes a profile's cached row recType for
+// sourceItemID, which is empty for rows without a source item. Global rows are
+// not a profile's; see DeleteGlobalRecommendationCache.
+func (r *Repo) DeleteProfileRecommendationCache(ctx context.Context, userID int, profileID, recType, sourceItemID string) error {
+	if _, err := r.pool.Exec(ctx, `
+		DELETE FROM recommendation_cache
+		WHERE  user_id = $1 AND profile_id = $2 AND rec_type = $3 AND source_item_id = $4`,
+		userID, profileID, recType, sourceItemID); err != nil {
+		return fmt.Errorf("delete recommendation cache %s for user %d profile %s: %w", recType, userID, profileID, err)
+	}
+	return nil
+}
+
 // GetRecommendationCache retrieves cached recommendation results that have not
 // yet expired. Returns nil, nil on cache miss or expiry.
 func (r *Repo) GetRecommendationCache(ctx context.Context, userID int, profileID, recType, sourceItemID string) ([]ScoredItem, error) {
@@ -922,14 +1299,8 @@ func (r *Repo) UpsertTasteClusters(ctx context.Context, userID int, profileID st
 	}
 	defer tx.Rollback(ctx)
 
-	// Lock the replacement, including an empty cluster set, across server
-	// processes. DELETE alone cannot protect rows another refresh has not yet
-	// committed, so concurrent replacements can otherwise collide on INSERT.
-	_, err = tx.Exec(ctx, `SELECT pg_advisory_xact_lock(hashtextextended(
-		'recommendations:taste-clusters:' || $1::bigint::text || ':' || $2::text, 0))`,
-		userID, profileID)
-	if err != nil {
-		return fmt.Errorf("lock taste clusters: %w", err)
+	if err := lockTasteClusters(ctx, tx, userID, profileID); err != nil {
+		return err
 	}
 
 	_, err = tx.Exec(ctx,
@@ -959,10 +1330,37 @@ func (r *Repo) UpsertTasteClusters(ctx context.Context, userID int, profileID st
 	return tx.Commit(ctx)
 }
 
+// lockTasteClusters locks a profile's cluster replacement, including an empty
+// cluster set, across server processes until tx ends. DELETE alone cannot
+// protect rows another refresh has not yet committed, so concurrent
+// replacements can otherwise collide on INSERT.
+func lockTasteClusters(ctx context.Context, tx pgx.Tx, userID int, profileID string) error {
+	if _, err := tx.Exec(ctx, `SELECT pg_advisory_xact_lock(hashtextextended(
+		'recommendations:taste-clusters:' || $1::bigint::text || ':' || $2::text, 0))`,
+		userID, profileID); err != nil {
+		return fmt.Errorf("lock taste clusters: %w", err)
+	}
+	return nil
+}
+
 // GetTasteClusters retrieves all clusters for a user/profile.
 func (r *Repo) GetTasteClusters(ctx context.Context, userID int, profileID string) ([]TasteCluster, error) {
+	return r.queryTasteClusters(ctx, userID, profileID, true)
+}
+
+// GetTasteClusterMeta returns the profile's taste clusters without their
+// embeddings, for reads that only label, match and order cluster rows.
+func (r *Repo) GetTasteClusterMeta(ctx context.Context, userID int, profileID string) ([]TasteCluster, error) {
+	return r.queryTasteClusters(ctx, userID, profileID, false)
+}
+
+func (r *Repo) queryTasteClusters(ctx context.Context, userID int, profileID string, withEmbedding bool) ([]TasteCluster, error) {
+	columns := "cluster_idx, dominant_genres, label, member_count, total_weight, updated_at"
+	if withEmbedding {
+		columns += ", embedding"
+	}
 	rows, err := r.pool.Query(ctx, `
-		SELECT cluster_idx, embedding, dominant_genres, label, member_count, total_weight, updated_at
+		SELECT `+columns+`
 		FROM   user_taste_clusters
 		WHERE  user_id = $1 AND profile_id = $2
 		ORDER  BY cluster_idx`,
@@ -977,12 +1375,18 @@ func (r *Repo) GetTasteClusters(ctx context.Context, userID int, profileID strin
 		var c TasteCluster
 		var v pgvector.Vector
 		var genresJSON []byte
-		if err := rows.Scan(&c.ClusterIdx, &v, &genresJSON, &c.Label, &c.MemberCount, &c.TotalWeight, &c.UpdatedAt); err != nil {
+		dest := []any{&c.ClusterIdx, &genresJSON, &c.Label, &c.MemberCount, &c.TotalWeight, &c.UpdatedAt}
+		if withEmbedding {
+			dest = append(dest, &v)
+		}
+		if err := rows.Scan(dest...); err != nil {
 			return nil, fmt.Errorf("scan cluster: %w", err)
 		}
 		c.UserID = userID
 		c.ProfileID = profileID
-		c.Embedding = v.Slice()
+		if withEmbedding {
+			c.Embedding = v.Slice()
+		}
 		if err := json.Unmarshal(genresJSON, &c.DominantGenres); err != nil {
 			return nil, fmt.Errorf("unmarshal cluster genres: %w", err)
 		}
@@ -993,31 +1397,48 @@ func (r *Repo) GetTasteClusters(ctx context.Context, userID int, profileID strin
 
 // --- Co-Watch Operations ---
 
-// UpsertCowatchPairs bulk-upserts co-watch pairs. Operates in a single transaction.
+// UpsertCowatchPairs bulk-upserts co-watch pairs in one statement, stamping
+// each with the transaction time. A batch must not repeat an (item, similar
+// item) pair.
 func (r *Repo) UpsertCowatchPairs(ctx context.Context, pairs []CowatchPair) error {
 	if len(pairs) == 0 {
 		return nil
 	}
-	tx, err := r.pool.Begin(ctx)
-	if err != nil {
-		return fmt.Errorf("begin tx for cowatch: %w", err)
+	itemIDs := make([]string, len(pairs))
+	similarIDs := make([]string, len(pairs))
+	scores := make([]float64, len(pairs))
+	counts := make([]int32, len(pairs))
+	for i, p := range pairs {
+		itemIDs[i] = p.ItemID
+		similarIDs[i] = p.SimilarItemID
+		scores[i] = p.JaccardScore
+		counts[i] = int32(p.CowatchCount)
 	}
-	defer tx.Rollback(ctx)
+	_, err := r.pool.Exec(ctx, `
+		INSERT INTO item_cowatch (item_id, similar_item_id, jaccard_score, cowatch_count, updated_at)
+		SELECT item_id, similar_item_id, jaccard_score, cowatch_count, NOW()
+		FROM   unnest($1::text[], $2::text[], $3::float8[], $4::int4[])
+		       AS p(item_id, similar_item_id, jaccard_score, cowatch_count)
+		ON CONFLICT (item_id, similar_item_id) DO UPDATE
+			SET jaccard_score = EXCLUDED.jaccard_score,
+			    cowatch_count = EXCLUDED.cowatch_count,
+			    updated_at    = EXCLUDED.updated_at`,
+		itemIDs, similarIDs, scores, counts)
+	if err != nil {
+		return fmt.Errorf("upsert cowatch pairs: %w", err)
+	}
+	return nil
+}
 
-	for _, p := range pairs {
-		_, err := tx.Exec(ctx, `
-			INSERT INTO item_cowatch (item_id, similar_item_id, jaccard_score, cowatch_count, updated_at)
-			VALUES ($1, $2, $3, $4, NOW())
-			ON CONFLICT (item_id, similar_item_id) DO UPDATE
-				SET jaccard_score = EXCLUDED.jaccard_score,
-				    cowatch_count = EXCLUDED.cowatch_count,
-				    updated_at    = NOW()`,
-			p.ItemID, p.SimilarItemID, p.JaccardScore, p.CowatchCount)
-		if err != nil {
-			return fmt.Errorf("upsert cowatch pair: %w", err)
-		}
+// DeleteCowatchPairsBefore deletes the co-watch pairs last written before
+// cutoff and returns how many it deleted.
+func (r *Repo) DeleteCowatchPairsBefore(ctx context.Context, cutoff time.Time) (int64, error) {
+	tag, err := r.pool.Exec(ctx,
+		`DELETE FROM item_cowatch WHERE updated_at IS NULL OR updated_at < $1`, cutoff)
+	if err != nil {
+		return 0, fmt.Errorf("delete stale cowatch pairs: %w", err)
 	}
-	return tx.Commit(ctx)
+	return tag.RowsAffected(), nil
 }
 
 // GetCowatchNeighbors returns the top co-watch neighbors for an item.
@@ -1055,16 +1476,50 @@ func (r *Repo) CowatchPairCount(ctx context.Context) (int, error) {
 	return count, nil
 }
 
+// purgeProfileStatements delete a profile's ratings and recommendation state.
+// None of these tables has a foreign key to the profile, which may live
+// outside Postgres.
+var purgeProfileStatements = []string{
+	`DELETE FROM user_ratings WHERE user_id = $1 AND profile_id = $2`,
+	`DELETE FROM user_taste_profiles WHERE user_id = $1 AND profile_id = $2`,
+	`DELETE FROM user_taste_clusters WHERE user_id = $1 AND profile_id = $2`,
+	`DELETE FROM recommendation_cache WHERE user_id = $1 AND profile_id = $2`,
+}
+
+// PurgeProfile deletes a deleted profile's ratings, taste profile, taste
+// clusters and cached rows in one transaction. The Postgres user store does
+// this as it deletes the profile; with a user store outside Postgres the
+// profile handler calls this after the delete.
+func (r *Repo) PurgeProfile(ctx context.Context, userID int, profileID string) error {
+	tx, err := r.pool.Begin(ctx)
+	if err != nil {
+		return fmt.Errorf("begin recommendation purge: %w", err)
+	}
+	defer func() { _ = tx.Rollback(ctx) }()
+	for _, stmt := range purgeProfileStatements {
+		if _, err := tx.Exec(ctx, stmt, userID, profileID); err != nil {
+			return fmt.Errorf("purge recommendation data for user %d profile %s: %w", userID, profileID, err)
+		}
+	}
+	if err := tx.Commit(ctx); err != nil {
+		return fmt.Errorf("commit recommendation purge: %w", err)
+	}
+	return nil
+}
+
 // --- Staleness Operations ---
 
-// MarkProfileStale sets stale_at = NOW() on a user's taste profile. A profile
-// already waiting for a refresh (stale_at > updated_at) keeps its pending
-// mark, so a repeat mark writes nothing.
+// MarkProfileStale sets stale_at = NOW() on a user's taste profile. It always
+// advances the mark, even over a pending one: a refresh that started reading
+// before this change must not clear it (see ClearStaleAt). A profile with no
+// taste row yet gets one with no vector, updated at the epoch, so the mark
+// survives a first build that read the signals before this change; readers
+// treat the row as no taste profile until a refresh stores one.
 func (r *Repo) MarkProfileStale(ctx context.Context, userID int, profileID string) error {
 	_, err := r.pool.Exec(ctx, `
-		UPDATE user_taste_profiles SET stale_at = NOW()
-		WHERE  user_id = $1 AND profile_id = $2
-		  AND  (stale_at IS NULL OR stale_at <= updated_at)`,
+		INSERT INTO user_taste_profiles (user_id, profile_id, embedding, updated_at, stale_at)
+		VALUES ($1, $2, NULL, to_timestamp(0), NOW())
+		ON CONFLICT (user_id, profile_id) DO UPDATE SET stale_at = NOW()`,
 		userID, profileID)
 	if err != nil {
 		return fmt.Errorf("mark profile stale: %w", err)
@@ -1072,18 +1527,123 @@ func (r *Repo) MarkProfileStale(ctx context.Context, userID int, profileID strin
 	return nil
 }
 
+// MarkAccountsStale marks stale the taste profile of every profile on the
+// accounts, in one statement, and returns how many it marked. Access changes
+// that reach whole accounts call it.
+func (r *Repo) MarkAccountsStale(ctx context.Context, userIDs []int) (int64, error) {
+	if len(userIDs) == 0 {
+		return 0, nil
+	}
+	tag, err := r.pool.Exec(ctx, `UPDATE user_taste_profiles SET stale_at = NOW() WHERE user_id = ANY($1)`, userIDs)
+	if err != nil {
+		return 0, fmt.Errorf("mark accounts stale: %w", err)
+	}
+	return tag.RowsAffected(), nil
+}
+
+// MarkAllProfilesStale marks every taste profile stale and returns how many
+// it marked.
+func (r *Repo) MarkAllProfilesStale(ctx context.Context) (int64, error) {
+	tag, err := r.pool.Exec(ctx, `UPDATE user_taste_profiles SET stale_at = NOW()`)
+	if err != nil {
+		return 0, fmt.Errorf("mark all profiles stale: %w", err)
+	}
+	return tag.RowsAffected(), nil
+}
+
+// policyMarkedGenerationKey is the server setting holding the newest policy
+// generation whose change has marked every taste profile stale.
+const policyMarkedGenerationKey = "recommendations.policy_marked_generation"
+
+// MarkAllProfilesStaleForPolicy marks every taste profile stale for a policy
+// change that can reach every account's scope, once per generation across
+// the cluster: every node calls it after loading the generation, and only
+// the first call for a generation newer than the last one marked marks
+// anything. It returns how many profiles it marked. One mark is enough
+// because a refresh, the only thing that clears marks, does not run on a node
+// that has not loaded the stored generation (see Worker.WithPolicyCheck).
+func (r *Repo) MarkAllProfilesStaleForPolicy(ctx context.Context, generation int64) (int64, error) {
+	tag, err := r.pool.Exec(ctx, `
+		WITH claim AS (
+			INSERT INTO server_settings (key, value) VALUES ($1, $2::bigint::text)
+			ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value
+			WHERE server_settings.value::bigint < EXCLUDED.value::bigint
+			RETURNING 1
+		)
+		UPDATE user_taste_profiles SET stale_at = NOW()
+		WHERE  EXISTS (SELECT 1 FROM claim)`,
+		policyMarkedGenerationKey, generation)
+	if err != nil {
+		return 0, fmt.Errorf("mark all profiles stale for policy generation %d: %w", generation, err)
+	}
+	return tag.RowsAffected(), nil
+}
+
+// MarkProfilesStaleForItems marks stale every taste profile whose progress,
+// history, ebook reading progress, rating, favorite or watchlist entry points
+// at one of itemIDs or at an episode of a series among them. Catalog merges
+// and splits call it after they move user state onto itemIDs, and the
+// embedding backfill after it stores their vectors. A live Postgres profile
+// with no taste row yet gets a vectorless one, as MarkProfileStale gives it,
+// so a first build that read the items before this mark does not consume it.
+// It returns how many profiles it marked.
+func (r *Repo) MarkProfilesStaleForItems(ctx context.Context, itemIDs []string) (int64, error) {
+	if len(itemIDs) == 0 {
+		return 0, nil
+	}
+	tag, err := r.pool.Exec(ctx, `
+		WITH ids AS (
+			SELECT unnest($1::text[]) AS id
+			UNION
+			SELECT content_id FROM episodes WHERE series_id = ANY($1::text[])
+		), profiles AS (
+			SELECT user_id, profile_id FROM user_taste_profiles
+			UNION
+			SELECT user_id, id FROM user_profiles
+		)
+		INSERT INTO user_taste_profiles (user_id, profile_id, embedding, updated_at, stale_at)
+		SELECT tp.user_id, tp.profile_id, NULL, to_timestamp(0), NOW()
+		FROM   profiles tp
+		WHERE EXISTS (SELECT 1 FROM user_watch_progress s JOIN ids ON ids.id = s.media_item_id
+		              WHERE s.user_id = tp.user_id AND s.profile_id = tp.profile_id)
+		   OR EXISTS (SELECT 1 FROM user_watch_history s JOIN ids ON ids.id = s.media_item_id
+		              WHERE s.user_id = tp.user_id AND s.profile_id = tp.profile_id)
+		   OR EXISTS (SELECT 1 FROM ebook_reader_progress s JOIN ids ON ids.id = s.content_id
+		              WHERE s.user_id = tp.user_id AND s.profile_id = tp.profile_id)
+		   OR EXISTS (SELECT 1 FROM user_ratings s JOIN ids ON ids.id = s.media_item_id
+		              WHERE s.user_id = tp.user_id AND s.profile_id = tp.profile_id)
+		   OR EXISTS (SELECT 1 FROM user_favorites s JOIN ids ON ids.id = s.media_item_id
+		              WHERE s.user_id = tp.user_id AND s.profile_id = tp.profile_id)
+		   OR EXISTS (SELECT 1 FROM user_watchlist s JOIN ids ON ids.id = s.media_item_id
+		              WHERE s.user_id = tp.user_id AND s.profile_id = tp.profile_id)
+		   OR EXISTS (SELECT 1 FROM user_not_interested s JOIN ids ON ids.id = s.media_item_id
+		              WHERE s.user_id = tp.user_id AND s.profile_id = tp.profile_id)
+		ON CONFLICT (user_id, profile_id) DO UPDATE SET stale_at = NOW()`,
+		itemIDs)
+	if err != nil {
+		return 0, fmt.Errorf("mark profiles stale for items: %w", err)
+	}
+	return tag.RowsAffected(), nil
+}
+
 // StaleProfile represents a taste profile that needs refreshing.
 type StaleProfile struct {
 	UserID    int
 	ProfileID string
 }
 
-// GetStaleProfiles returns profiles where stale_at > updated_at.
+// GetStaleProfiles returns profiles with a stale mark, oldest mark first. A
+// refresh that fails marks its profile again, so a profile that keeps failing
+// moves behind the others instead of taking the whole batch. Only a full
+// refresh clears a mark (ClearStaleAt): the nightly taste job stores the
+// taste vector as of its start but does not rebuild cached rows, so a mark it
+// passed over stays pending although it is older than updated_at.
 func (r *Repo) GetStaleProfiles(ctx context.Context, limit int) ([]StaleProfile, error) {
 	rows, err := r.pool.Query(ctx, `
 		SELECT user_id, profile_id
 		FROM   user_taste_profiles
-		WHERE  stale_at IS NOT NULL AND stale_at > updated_at
+		WHERE  stale_at IS NOT NULL
+		ORDER  BY stale_at, user_id, profile_id
 		LIMIT  $1`, limit)
 	if err != nil {
 		return nil, fmt.Errorf("get stale profiles: %w", err)
@@ -1101,11 +1661,23 @@ func (r *Repo) GetStaleProfiles(ctx context.Context, limit int) ([]StaleProfile,
 	return profiles, rows.Err()
 }
 
-// ClearStaleAt resets stale_at to NULL after refreshing a profile.
-func (r *Repo) ClearStaleAt(ctx context.Context, userID int, profileID string) error {
-	_, err := r.pool.Exec(ctx,
-		`UPDATE user_taste_profiles SET stale_at = NULL WHERE user_id = $1 AND profile_id = $2`,
-		userID, profileID)
+// StaleProfileCount counts the profiles waiting for the stale sweep.
+func (r *Repo) StaleProfileCount(ctx context.Context) (int, error) {
+	var n int
+	if err := r.pool.QueryRow(ctx, `SELECT COUNT(*) FROM user_taste_profiles WHERE stale_at IS NOT NULL`).Scan(&n); err != nil {
+		return 0, fmt.Errorf("count stale profiles: %w", err)
+	}
+	return n, nil
+}
+
+// ClearStaleAt resets stale_at to NULL after a refresh that started reading
+// signals at started. A mark newer than that records a change the refresh may
+// have missed, so it stays for the stale sweep.
+func (r *Repo) ClearStaleAt(ctx context.Context, userID int, profileID string, started time.Time) error {
+	_, err := r.pool.Exec(ctx, `
+		UPDATE user_taste_profiles SET stale_at = NULL
+		WHERE  user_id = $1 AND profile_id = $2 AND stale_at <= $3`,
+		userID, profileID, started)
 	if err != nil {
 		return fmt.Errorf("clear stale_at: %w", err)
 	}
@@ -1314,6 +1886,9 @@ func (r *Repo) GetRewatchCounts(ctx context.Context, userID int, profileID strin
 // (watcher, item) before ranking and aggregation so a lone binge-watcher
 // cannot satisfy the minimum-watchers threshold ($2) by itself and the
 // per-user recency cap ($1) counts distinct items rather than raw rows.
+// Progress outlives deleted items, and an episode of a deleted series no
+// longer rolls up to it, so only items still in media_items are ranked: a
+// dead ID neither enters the matrix nor uses up a watcher's recency cap.
 //
 // Watcher identity is (user_id, profile_id) for the Jaccard math — profiles of
 // one account legitimately have distinct tastes — but the minimum-watchers
@@ -1328,6 +1903,7 @@ var itemWatchersQuery = fmt.Sprintf(`
 		       item_id AS media_item_id,
 		       ROW_NUMBER() OVER (PARTITION BY user_id, profile_id ORDER BY MAX(updated_at) DESC) AS rn
 		FROM   watched_activity
+		WHERE  EXISTS (SELECT 1 FROM media_items mi WHERE mi.content_id = watched_activity.item_id)
 		GROUP  BY user_id, profile_id, watcher_id, item_id
 	)
 	SELECT media_item_id, ARRAY_AGG(watcher_id) AS watchers
@@ -1359,23 +1935,24 @@ func (r *Repo) GetItemWatchers(ctx context.Context, minWatchers int, maxPerUser
 
 // --- Cold Start Queries ---
 
-// GetPopularItems returns the most-played media items over the given number of days.
-// Episodes are resolved to their parent series.
-func (r *Repo) GetPopularItems(ctx context.Context, days, limit int) ([]ScoredItem, error) {
+// GetPopularItems returns the recommendableMediaTypes titles watched by at
+// least minAccounts login accounts over the given number of days, most
+// accounts first, then most recently watched. Its score is the account
+// count. Episodes are resolved to their parent series.
+func (r *Repo) GetPopularItems(ctx context.Context, days, minAccounts, limit int) ([]ScoredItem, error) {
 	query := fmt.Sprintf(`
-		WITH %s,
-		watched_items AS (
-			SELECT item_id, watcher_id
-			FROM   watched_activity
-			WHERE  updated_at > NOW() - make_interval(days => $1)
-		)
-		SELECT wi.item_id, COUNT(DISTINCT wi.watcher_id) AS watch_count
-		FROM   watched_items wi
-		JOIN   media_items mi ON mi.content_id = wi.item_id
-		GROUP  BY wi.item_id
-		ORDER  BY watch_count DESC
-		LIMIT  $2`, watchedActivityCTE)
-	rows, err := r.pool.Query(ctx, query, days, limit)
+		WITH %s
+		SELECT wa.item_id, COUNT(DISTINCT wa.user_id) AS accounts
+		FROM   watched_activity wa
+		JOIN   media_items mi ON mi.content_id = wa.item_id
+		WHERE  wa.updated_at > NOW() - make_interval(days => $1)
+		  AND  %s
+		  AND  mi.type = ANY($4)
+		GROUP  BY wa.item_id
+		HAVING COUNT(DISTINCT wa.user_id) >= $2
+		ORDER  BY accounts DESC, MAX(wa.updated_at) DESC, wa.item_id
+		LIMIT  $3`, watchedActivityCTE, recommendationItemEligibilityWhereClause("mi"))
+	rows, err := r.pool.Query(ctx, query, days, minAccounts, limit, recommendableMediaTypes)
 	if err != nil {
 		return nil, fmt.Errorf("get popular items: %w", err)
 	}
@@ -1384,117 +1961,350 @@ func (r *Repo) GetPopularItems(ctx context.Context, days, limit int) ([]ScoredIt
 	var items []ScoredItem
 	for rows.Next() {
 		var item ScoredItem
-		var watchCount int
-		if err := rows.Scan(&item.MediaItemID, &watchCount); err != nil {
+		var accounts int
+		if err := rows.Scan(&item.MediaItemID, &accounts); err != nil {
 			return nil, fmt.Errorf("scan popular item: %w", err)
 		}
-		item.Score = float64(watchCount)
+		item.Score = float64(accounts)
 		item.Reason = "popular"
 		items = append(items, item)
 	}
 	return items, rows.Err()
 }
 
-// GetRecentlyAddedItems returns items added within the given number of days.
-// Audiobooks and ebooks bypass the matched-status gate because their
-// scan-derived metadata is authoritative before any external-provider match
-// exists.
+// recommendableItemConditions are the predicates every non-personal row
+// starts from: matched titles of recommendableMediaTypes, bound at $1.
+func recommendableItemConditions() []string {
+	return []string{recommendationItemEligibilityWhereClause("mi"), "mi.type = ANY($1)"}
+}
+
+// addedAtSQL is when a title was added to the library: for a series, when
+// its latest episode was, if that is later. idx_media_items_type_added_at
+// indexes it per media type; keep the two identical.
+const addedAtSQL = `GREATEST(mi.created_at, COALESCE(mi.latest_episode_added_at, mi.created_at))`
+
+// perTypeItemConditions starts the conditions of a query that reads each
+// recommendable media type through its own index walk: an eligible title of
+// the type typeColumn names.
+func perTypeItemConditions(typeColumn string) []string {
+	return []string{recommendationItemEligibilityWhereClause("mi"), "mi.type = " + typeColumn}
+}
+
+// recentlyAddedQuery lists the Recently Added row: matched
+// recommendableMediaTypes titles (bound at $1) newest addedAtSQL first, ties
+// by content ID, scored by that time in Unix seconds. conditions are further
+// predicates; the limit binds at limitArg. The cached global row and the
+// live, access-filtered default row both read it. Each type is read newest
+// first from idx_media_items_type_added_at and the types are then merged, so
+// the query stops once the row is full.
+func recentlyAddedQuery(conditions []string, limitArg int) string {
+	return fmt.Sprintf(`
+		SELECT c.content_id, EXTRACT(EPOCH FROM c.added_at)::float8
+		FROM   unnest($1::text[]) AS t(type)
+		CROSS  JOIN LATERAL (
+			SELECT mi.content_id, %[1]s AS added_at
+			FROM   media_items mi
+			WHERE  %[2]s
+			ORDER  BY %[1]s DESC, mi.content_id
+			LIMIT  $%[3]d
+		) c
+		ORDER  BY c.added_at DESC, c.content_id
+		LIMIT  $%[3]d`, addedAtSQL, strings.Join(append(perTypeItemConditions("t.type"), conditions...), " AND "), limitArg)
+}
+
+// GetRecentlyAddedItems returns up to limit titles of the server's Recently
+// Added row (see recentlyAddedQuery): those added in the last days days when
+// days is positive, else any. It is not access-filtered.
 func (r *Repo) GetRecentlyAddedItems(ctx context.Context, days, limit int) ([]ScoredItem, error) {
-	query := fmt.Sprintf(`
-		SELECT mi.content_id, mi.created_at
-		FROM   media_items mi
-		WHERE  %s
-		  AND  mi.created_at > NOW() - make_interval(days => $1)
-		ORDER  BY mi.created_at DESC
-		LIMIT  $2`, recommendationItemEligibilityWhereClause("mi"))
-	rows, err := r.pool.Query(ctx, query, days, limit)
+	var conditions []string
+	args := []any{recommendableMediaTypes}
+	if days > 0 {
+		conditions = append(conditions, addedAtSQL+" > NOW() - make_interval(days => $2)")
+		args = append(args, days)
+	}
+	args = append(args, limit)
+	items, err := r.scoredItems(ctx, recentlyAddedQuery(conditions, len(args)), args, RecTypeRecentlyAdded, limit)
 	if err != nil {
 		return nil, fmt.Errorf("get recently added: %w", err)
 	}
+	return items, nil
+}
+
+// scoredItems runs query, which answers (content_id, score) rows, into items
+// carrying reason.
+func (r *Repo) scoredItems(ctx context.Context, query string, args []any, reason string, limit int) ([]ScoredItem, error) {
+	rows, err := r.pool.Query(ctx, query, args...)
+	if err != nil {
+		return nil, err
+	}
 	defer rows.Close()
 
-	var items []ScoredItem
+	items := make([]ScoredItem, 0, max(limit, 0))
 	for rows.Next() {
-		var item ScoredItem
-		var createdAt time.Time
-		if err := rows.Scan(&item.MediaItemID, &createdAt); err != nil {
-			return nil, fmt.Errorf("scan recently added: %w", err)
+		item := ScoredItem{Reason: reason}
+		if err := rows.Scan(&item.MediaItemID, &item.Score); err != nil {
+			return nil, err
 		}
-		item.Score = float64(createdAt.Unix())
-		item.Reason = "recently_added"
 		items = append(items, item)
 	}
 	return items, rows.Err()
 }
 
-// GetTopRatedItems returns items with highest average rating (min ratingCount ratings).
-func (r *Repo) GetTopRatedItems(ctx context.Context, minRatings, limit int) ([]ScoredItem, error) {
+// highlyRatedMinRating is the lowest catalog rating "Highly Rated in Your
+// Library" admits.
+const highlyRatedMinRating = 7.0
+
+// ListRatedItemIDs returns every title the profile rated, which no
+// recommendation row shows it.
+func (r *Repo) ListRatedItemIDs(ctx context.Context, userID int, profileID string) ([]string, error) {
 	rows, err := r.pool.Query(ctx, `
-		SELECT media_item_id, AVG(rating) AS avg_rating
+		SELECT media_item_id
 		FROM   user_ratings
-		GROUP  BY media_item_id
-		HAVING COUNT(*) >= $1
-		ORDER  BY avg_rating DESC
-		LIMIT  $2`,
-		minRatings, limit)
+		WHERE  user_id = $1 AND profile_id = $2`,
+		userID, profileID)
 	if err != nil {
-		return nil, fmt.Errorf("get top rated: %w", err)
+		return nil, fmt.Errorf("list rated items: %w", err)
 	}
-	defer rows.Close()
+	ids, err := pgx.CollectRows(rows, pgx.RowTo[string])
+	if err != nil {
+		return nil, fmt.Errorf("list rated items: %w", err)
+	}
+	if ids == nil {
+		ids = []string{}
+	}
+	return ids, nil
+}
 
-	var items []ScoredItem
+// ListDefaultRowItems returns up to limit items of a default row, kind
+// RecTypeTopRated ("Highly Rated in Your Library") or RecTypeRecentlyAdded,
+// among the matched recommendableMediaTypes titles filter admits, leaving out
+// the content IDs in exclude.
+//
+// Highly Rated holds titles with a catalog rating of at least
+// highlyRatedMinRating, ranked within each media type by rating reliability
+// and rating, the types interleaved in proportion to how many titles of each
+// filter admits, so a movie-heavy library is not led by series, whose
+// ratings run higher. Recently Added orders by when the title, or for a
+// series its latest episode, was added. Both break ties by content ID.
+//
+// Each type is read from its own index (see recentlyAddedQuery and
+// idx_media_items_type_catalog_rank) only as deep as the row needs, and
+// each read is planned for its own exclusions and access, so the cost does
+// not grow with the catalog.
+func (r *Repo) ListDefaultRowItems(ctx context.Context, filter catalog.AccessFilter, kind string, exclude []string, limit int) ([]ScoredItem, error) {
+	if kind != RecTypeTopRated && kind != RecTypeRecentlyAdded {
+		return nil, fmt.Errorf("list default row items: unknown kind %q", kind)
+	}
+	if limit <= 0 ||
+		(filter.AllowedLibraryIDs != nil && len(filter.AllowedLibraryIDs) == 0) ||
+		(filter.AllowedContentIDs != nil && len(filter.AllowedContentIDs) == 0) {
+		return []ScoredItem{}, nil
+	}
+	var titles []int64
+	if kind == RecTypeTopRated {
+		titles = r.titleCounts.get(ctx, filter, r.countTitlesByType)
+	}
+	query, args := defaultRowQuery(filter, kind, exclude, titles, limit)
+	// An unnamed statement plans each read for its own exclusion list, which a
+	// generic plan would scan linearly for every title it reads.
+	items, err := r.scoredItems(ctx, query, append([]any{pgx.QueryExecModeCacheDescribe}, args...), kind, limit)
+	if err != nil {
+		return nil, fmt.Errorf("list %s default row items: %w", kind, err)
+	}
+	return items, nil
+}
+
+// defaultRowQuery builds the query of ListDefaultRowItems. titles holds, for
+// Highly Rated, how many titles of each recommendableMediaTypes entry filter
+// admits, in that order.
+func defaultRowQuery(filter catalog.AccessFilter, kind string, exclude []string, titles []int64, limit int) (string, []any) {
+	if exclude == nil {
+		exclude = []string{}
+	}
+	// $1 binds recommendableMediaTypes and $2 exclude.
+	conditions := []string{"mi.content_id <> ALL($2)"}
+	args := []any{recommendableMediaTypes, exclude}
+	argIdx := 3
+	appendAccessConditions(filter, &conditions, &args, &argIdx)
+
+	if kind == RecTypeRecentlyAdded {
+		args = append(args, limit)
+		return recentlyAddedQuery(conditions, argIdx), args
+	}
+	args = append(args, titles, limit)
+	// The row shows at most limit titles of a type, so each type is ranked
+	// only that deep.
+	return fmt.Sprintf(`
+		SELECT c.content_id, c.rating::float8
+		FROM   unnest($1::text[], $%[4]d::bigint[]) AS tc(type, titles)
+		CROSS  JOIN LATERAL (
+			SELECT mi.content_id, %[2]s AS rating,
+			       ROW_NUMBER() OVER (ORDER BY %[5]s, mi.content_id) AS type_rank
+			FROM   media_items mi
+			WHERE  %[1]s
+			  AND  %[2]s >= %[3]v
+			ORDER  BY %[5]s, mi.content_id
+			LIMIT  $%[6]d
+		) c
+		ORDER  BY c.type_rank::float8 / GREATEST(tc.titles, 1), c.rating DESC, c.content_id
+		LIMIT  $%[6]d`,
+		strings.Join(append(perTypeItemConditions("tc.type"), conditions...), " AND "),
+		catalogRatingSQL, highlyRatedMinRating, argIdx, catalogRatingOrderSQL, argIdx+1), args
+}
+
+// appendAccessConditions adds the predicates limiting media_items aliased mi
+// to what filter admits.
+func appendAccessConditions(filter catalog.AccessFilter, conditions *[]string, args *[]any, argIdx *int) {
+	if filter.AllowedContentIDs != nil {
+		*conditions = append(*conditions, fmt.Sprintf("mi.content_id = ANY($%d)", *argIdx))
+		*args = append(*args, filter.AllowedContentIDs)
+		*argIdx++
+	}
+	catalog.ApplyLibraryAccessFilter("mi.content_id", filter, conditions, args, argIdx)
+	catalog.ApplyMaturityLimits("mi", filter, conditions, args, argIdx)
+}
+
+// countTitlesByType counts the titles of each recommendableMediaTypes entry
+// filter admits, in that order. It reads every such title.
+func (r *Repo) countTitlesByType(ctx context.Context, filter catalog.AccessFilter) ([]int64, error) {
+	conditions := recommendableItemConditions()
+	args := []any{recommendableMediaTypes}
+	argIdx := 2
+	appendAccessConditions(filter, &conditions, &args, &argIdx)
+	rows, err := r.pool.Query(ctx, `SELECT mi.type, COUNT(*) FROM media_items mi WHERE `+strings.Join(conditions, " AND ")+` GROUP BY mi.type`, args...)
+	if err != nil {
+		return nil, fmt.Errorf("count titles by type: %w", err)
+	}
+	defer rows.Close()
+	byType := make(map[string]int64, len(recommendableMediaTypes))
 	for rows.Next() {
-		var item ScoredItem
-		if err := rows.Scan(&item.MediaItemID, &item.Score); err != nil {
-			return nil, fmt.Errorf("scan top rated: %w", err)
+		var mediaType string
+		var n int64
+		if err := rows.Scan(&mediaType, &n); err != nil {
+			return nil, fmt.Errorf("scan title count: %w", err)
 		}
-		item.Reason = "top_rated"
-		items = append(items, item)
+		byType[mediaType] = n
 	}
-	return items, rows.Err()
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("count titles by type: %w", err)
+	}
+	counts := make([]int64, len(recommendableMediaTypes))
+	for i, mediaType := range recommendableMediaTypes {
+		counts[i] = byType[mediaType]
+	}
+	return counts, nil
+}
+
+// GetTasteSeedCandidates returns a page of content IDs of
+// recommendableMediaTypes for the taste-seeding picker. Candidates rank by
+// server engagement (most-watched in the last 180 days), then rating
+// reliability and rating score, then recency. This keeps fresh servers from
+// front-loading single-vote TMDB 10.0 obscurities while established servers
+// prioritize what users actually watch. The best
+// tasteSeedGenreRoundRobinBase candidates come first, interleaved by genre
+// (see interleaveByGenre); the rest follow in rank order, so paging continues
+// through the whole catalog. Episodes are resolved to their parent series.
+// Items without a poster are excluded, and so are those filter does not
+// admit, so a restricted profile gets full pages of titles it can pick.
+func (r *Repo) GetTasteSeedCandidates(ctx context.Context, filter catalog.AccessFilter, limit, offset int) ([]string, error) {
+	if limit <= 0 || (filter.AllowedLibraryIDs != nil && len(filter.AllowedLibraryIDs) == 0) {
+		return []string{}, nil
+	}
+	offset = max(offset, 0)
+	ids := make([]string, 0, limit)
+	if offset < tasteSeedGenreRoundRobinBase {
+		base, err := r.tasteSeedCandidates(ctx, filter, tasteSeedGenreRoundRobinBase, 0)
+		if err != nil {
+			return nil, err
+		}
+		interleaved := interleaveByGenre(base)
+		ids = append(ids, interleaved[min(offset, len(interleaved)):min(offset+limit, len(interleaved))]...)
+		if len(base) < tasteSeedGenreRoundRobinBase {
+			return ids, nil
+		}
+	}
+	// Past the base, positions match rank order.
+	if from := max(offset, tasteSeedGenreRoundRobinBase); offset+limit > from {
+		rest, err := r.tasteSeedCandidates(ctx, filter, offset+limit-from, from)
+		if err != nil {
+			return nil, err
+		}
+		for _, c := range rest {
+			ids = append(ids, c.id)
+		}
+	}
+	return ids, nil
 }
 
-// GetTasteSeedCandidates returns movie/series/audiobook content IDs ordered for the
-// taste-seeding picker: server engagement first (most-watched in the last
-// 180 days), then rating reliability and rating score, then recency. This keeps
-// fresh servers from front-loading single-vote TMDB 10.0 obscurities while
-// established servers prioritize what users actually watch. Episodes are resolved
-// to their parent series. Items without a poster are excluded.
-func (r *Repo) GetTasteSeedCandidates(ctx context.Context, limit, offset int) ([]string, error) {
-	rows, err := r.pool.Query(ctx, tasteSeedCandidateQuery, limit, offset)
+// tasteSeedCandidates reads limit picker candidates in rank order from offset.
+func (r *Repo) tasteSeedCandidates(ctx context.Context, filter catalog.AccessFilter, limit, offset int) ([]tasteSeedCandidate, error) {
+	conditions := []string{"mi.type = ANY($1)"}
+	args := []any{recommendableMediaTypes}
+	argIdx := 2
+	catalog.ApplyLibraryAccessFilter("mi.content_id", filter, &conditions, &args, &argIdx)
+	catalog.ApplyMaturityLimits("mi", filter, &conditions, &args, &argIdx)
+	args = append(args, limit, offset)
+
+	rows, err := r.pool.Query(ctx, tasteSeedCandidateQuery(conditions, argIdx), args...)
 	if err != nil {
 		return nil, fmt.Errorf("get taste seed candidates: %w", err)
 	}
 	defer rows.Close()
 
-	ids := make([]string, 0, limit)
+	candidates := make([]tasteSeedCandidate, 0, limit)
 	for rows.Next() {
-		var id string
-		if err := rows.Scan(&id); err != nil {
+		var c tasteSeedCandidate
+		if err := rows.Scan(&c.id, &c.firstGenre); err != nil {
 			return nil, fmt.Errorf("scan taste seed candidate: %w", err)
 		}
-		ids = append(ids, id)
+		candidates = append(candidates, c)
 	}
-	return ids, rows.Err()
+	return candidates, rows.Err()
 }
 
-// GetTopGenres returns the most popular genres by watch count.
-// Episodes are resolved to their parent series for genre lookup.
+// TopGenre returns GetTopGenres' first genre, or "" when there is none.
+// It is the same for every viewer and reads the whole catalog, so each
+// server reuses it for topGenreTTL (see topGenreCache).
+func (r *Repo) TopGenre(ctx context.Context) (string, error) {
+	return r.topGenre.get(ctx, func(ctx context.Context) (string, error) {
+		genres, err := r.GetTopGenres(ctx, 1)
+		if err != nil || len(genres) == 0 {
+			return "", err
+		}
+		return genres[0], nil
+	})
+}
+
+// GetTopGenres returns the genres of the matched recommendableMediaTypes
+// titles, those watched by the most login accounts first. A genre's viewing
+// counts only once crowdMinAccounts accounts share it; below that, and on a
+// server nobody has watched anything on yet, genres rank by how many titles
+// they hold, then by name. Episodes are resolved to their parent series.
 func (r *Repo) GetTopGenres(ctx context.Context, limit int) ([]string, error) {
+	eligible := strings.Join(recommendableItemConditions(), " AND ")
 	query := fmt.Sprintf(`
 		WITH %s,
-		watched_items AS (
-			SELECT item_id, watcher_id
-			FROM   watched_activity
+		catalog_genres AS (
+			SELECT g.genre, COUNT(*) AS titles
+			FROM   media_items mi
+			CROSS JOIN LATERAL UNNEST(mi.genres) AS g(genre)
+			WHERE  %s AND g.genre <> ''
+			GROUP  BY g.genre
+		),
+		watched_genres AS (
+			SELECT g.genre, COUNT(DISTINCT wa.user_id) AS accounts
+			FROM   watched_activity wa
+			JOIN   media_items mi ON mi.content_id = wa.item_id
+			CROSS JOIN LATERAL UNNEST(mi.genres) AS g(genre)
+			WHERE  %s
+			GROUP  BY g.genre
 		)
-		SELECT g.genre, COUNT(DISTINCT wi.watcher_id) AS watchers
-		FROM   watched_items wi
-		JOIN   media_items mi ON mi.content_id = wi.item_id
-		CROSS JOIN LATERAL UNNEST(mi.genres) AS g(genre)
-		GROUP  BY g.genre
-		ORDER  BY watchers DESC
-		LIMIT  $1`, watchedActivityCTE)
-	rows, err := r.pool.Query(ctx, query, limit)
+		SELECT cg.genre
+		FROM   catalog_genres cg
+		LEFT JOIN watched_genres wg ON wg.genre = cg.genre
+		ORDER  BY CASE WHEN wg.accounts >= $2 THEN wg.accounts ELSE 0 END DESC, cg.titles DESC, cg.genre
+		LIMIT  $3`, watchedActivityCTE, eligible, eligible)
+	rows, err := r.pool.Query(ctx, query, recommendableMediaTypes, crowdMinAccounts, limit)
 	if err != nil {
 		return nil, fmt.Errorf("get top genres: %w", err)
 	}
@@ -1503,8 +2313,7 @@ func (r *Repo) GetTopGenres(ctx context.Context, limit int) ([]string, error) {
 	var genres []string
 	for rows.Next() {
 		var genre string
-		var count int
-		if err := rows.Scan(&genre, &count); err != nil {
+		if err := rows.Scan(&genre); err != nil {
 			return nil, fmt.Errorf("scan top genre: %w", err)
 		}
 		genres = append(genres, genre)
@@ -1512,22 +2321,31 @@ func (r *Repo) GetTopGenres(ctx context.Context, limit int) ([]string, error) {
 	return genres, rows.Err()
 }
 
-// GetGenreSamplerItems returns the most-played media items in a specific genre.
+// GetGenreSamplerItems returns the best-rated matched recommendableMediaTypes
+// titles in a genre: by rating reliability and rating, then by how many login
+// accounts watched them (counted from crowdMinAccounts up), then newest
+// first. Its score is the catalog rating.
 func (r *Repo) GetGenreSamplerItems(ctx context.Context, genre string, limit int) ([]ScoredItem, error) {
 	query := fmt.Sprintf(`
 		WITH %s,
-		watched_items AS (
-			SELECT item_id, watcher_id
+		crowd AS (
+			SELECT item_id, COUNT(DISTINCT user_id) AS accounts
 			FROM   watched_activity
+			GROUP  BY item_id
+			HAVING COUNT(DISTINCT user_id) >= $3
 		)
-		SELECT wi.item_id, COUNT(DISTINCT wi.watcher_id) AS watch_count
-		FROM   watched_items wi
-		JOIN   media_items mi ON mi.content_id = wi.item_id
-		WHERE  $1 = ANY(mi.genres)
-		GROUP  BY wi.item_id
-		ORDER  BY watch_count DESC
-		LIMIT  $2`, watchedActivityCTE)
-	rows, err := r.pool.Query(ctx, query, genre, limit)
+		SELECT mi.content_id, COALESCE(%s, 0)::float8
+		FROM   media_items mi
+		LEFT JOIN crowd c ON c.item_id = mi.content_id
+		WHERE  %s
+		  AND  mi.type = ANY($4)
+		  AND  $1 = ANY(mi.genres)
+		ORDER  BY %s,
+		          COALESCE(c.accounts, 0) DESC,
+		          mi.year DESC NULLS LAST,
+		          mi.content_id
+		LIMIT  $2`, watchedActivityCTE, catalogRatingSQL, recommendationItemEligibilityWhereClause("mi"), catalogRatingOrderSQL)
+	rows, err := r.pool.Query(ctx, query, genre, limit, crowdMinAccounts, recommendableMediaTypes)
 	if err != nil {
 		return nil, fmt.Errorf("get genre sampler items: %w", err)
 	}
@@ -1535,13 +2353,10 @@ func (r *Repo) GetGenreSamplerItems(ctx context.Context, genre string, limit int
 
 	var items []ScoredItem
 	for rows.Next() {
-		var item ScoredItem
-		var watchCount int
-		if err := rows.Scan(&item.MediaItemID, &watchCount); err != nil {
+		item := ScoredItem{Reason: genreSamplerRowType}
+		if err := rows.Scan(&item.MediaItemID, &item.Score); err != nil {
 			return nil, fmt.Errorf("scan genre sampler item: %w", err)
 		}
-		item.Score = float64(watchCount)
-		item.Reason = "genre_sampler"
 		items = append(items, item)
 	}
 	return items, rows.Err()
@@ -1574,37 +2389,24 @@ func (r *Repo) GetBatchEmbeddings(ctx context.Context, itemIDs []string) (map[st
 	return result, rows.Err()
 }
 
-// GetItemGenres returns the full genre array for each item ID.
-func (r *Repo) GetItemGenres(ctx context.Context, itemIDs []string) (map[string][]string, error) {
-	if len(itemIDs) == 0 {
-		return nil, nil
-	}
-	rows, err := r.pool.Query(ctx, `
-		SELECT content_id, genres
-		FROM   media_items
-		WHERE  content_id = ANY($1)
-		  AND  array_length(genres, 1) > 0`,
-		itemIDs)
-	if err != nil {
-		return nil, fmt.Errorf("get item genres: %w", err)
-	}
-	defer rows.Close()
+// FilterAccessibleItemIDs returns the subset of item IDs allowed by the given
+// access filter, including its excluded media types (the Jellyfin surface
+// excludes audiobooks and podcasts) and its content scope. The returned map
+// is keyed by media_items.content_id.
+func (r *Repo) FilterAccessibleItemIDs(ctx context.Context, itemIDs []string, filter catalog.AccessFilter) (map[string]struct{}, error) {
+	return r.filterItemIDs(ctx, itemIDs, filter, nil)
+}
 
-	result := make(map[string][]string)
-	for rows.Next() {
-		var id string
-		var genres []string
-		if err := rows.Scan(&id, &genres); err != nil {
-			return nil, fmt.Errorf("scan item genre: %w", err)
-		}
-		result[id] = genres
-	}
-	return result, rows.Err()
+// FilterRecommendableItemIDs is FilterAccessibleItemIDs keeping only titles
+// of recommendableMediaTypes.
+func (r *Repo) FilterRecommendableItemIDs(ctx context.Context, itemIDs []string, filter catalog.AccessFilter) (map[string]struct{}, error) {
+	return r.filterItemIDs(ctx, itemIDs, filter, recommendableMediaTypes)
 }
 
-// FilterAccessibleItemIDs returns the subset of item IDs allowed by the given
-// access filter. The returned map is keyed by media_items.content_id.
-func (r *Repo) FilterAccessibleItemIDs(ctx context.Context, itemIDs []string, filter catalog.AccessFilter) (map[string]struct{}, error) {
+// filterItemIDs returns the IDs in itemIDs that filter admits (libraries,
+// maturity limits and the surface's excluded media types) and, when
+// mediaTypes is not nil, whose media type is one of mediaTypes.
+func (r *Repo) filterItemIDs(ctx context.Context, itemIDs []string, filter catalog.AccessFilter, mediaTypes []string) (map[string]struct{}, error) {
 	if len(itemIDs) == 0 {
 		return map[string]struct{}{}, nil
 	}
@@ -1613,21 +2415,25 @@ func (r *Repo) FilterAccessibleItemIDs(ctx context.Context, itemIDs []string, fi
 	args := []any{itemIDs}
 	argIdx := 2
 
-	if filter.AllowedContentIDs != nil {
-		if len(filter.AllowedContentIDs) == 0 {
-			return map[string]struct{}{}, nil
-		}
-		conditions = append(conditions, fmt.Sprintf("mi.content_id = ANY($%d)", argIdx))
-		args = append(args, filter.AllowedContentIDs)
+	if mediaTypes != nil {
+		conditions = append(conditions, fmt.Sprintf("mi.type = ANY($%d)", argIdx))
+		args = append(args, mediaTypes)
 		argIdx++
 	}
 
+	// The content allow-list and name prefix, as every catalog read applies
+	// them.
+	catalog.AppendContentScope(&conditions, &args, &argIdx, filter)
+
 	if filter.AllowedLibraryIDs != nil && len(filter.AllowedLibraryIDs) == 0 {
 		return map[string]struct{}{}, nil
 	}
 	catalog.ApplyLibraryAccessFilter("mi.content_id", filter, &conditions, &args, &argIdx)
 
-	catalog.ApplyMaturityLimits("mi", filter, &conditions, &args, &argIdx)
+	// The maturity limits and ExcludedMediaTypes, which a surface such as
+	// Jellyfin compatibility sets to keep types it does not serve out of
+	// the rows it reads.
+	catalog.ApplySectionAccessFilter("mi", filter, &conditions, &args, &argIdx)
 
 	rows, err := r.pool.Query(ctx, fmt.Sprintf(`
 		SELECT mi.content_id
@@ -1676,23 +2482,162 @@ func (r *Repo) GetItemAddedDates(ctx context.Context, itemIDs []string) (map[str
 	return result, rows.Err()
 }
 
-// GetAllUsersWithTasteProfiles returns all user/profile pairs that have taste profiles.
-func (r *Repo) GetAllUsersWithTasteProfiles(ctx context.Context) ([]StaleProfile, error) {
-	rows, err := r.pool.Query(ctx, `SELECT user_id, profile_id FROM user_taste_profiles`)
+// presentMediaTypesQuery keeps each media type of $1 that has an embedded,
+// recommendable title; the access conditions follow. EXISTS stops at the
+// first such title.
+const presentMediaTypesQuery = `
+		SELECT t.media_type
+		FROM   unnest($1::text[]) AS t(media_type)
+		WHERE  EXISTS (
+			SELECT 1
+			FROM   media_items mi
+			JOIN   media_item_embeddings e ON e.media_item_id = mi.content_id
+			WHERE  %s
+		)`
+
+// PresentMediaTypes returns the media types among mediaTypes that have a
+// title the taste candidate queries could return under filter: embedded,
+// matched, and inside the viewer's libraries and maturity limits.
+func (r *Repo) PresentMediaTypes(ctx context.Context, mediaTypes []string, filter catalog.AccessFilter) (map[string]struct{}, error) {
+	present := make(map[string]struct{}, len(mediaTypes))
+	if len(mediaTypes) == 0 || (filter.AllowedLibraryIDs != nil && len(filter.AllowedLibraryIDs) == 0) {
+		return present, nil
+	}
+	conditions := []string{
+		"mi.type = t.media_type",
+		matchedTitleSQL,
+	}
+	args := []any{mediaTypes}
+	argIdx := 2
+	catalog.ApplyLibraryAccessFilter("mi.content_id", filter, &conditions, &args, &argIdx)
+	catalog.ApplyMaturityLimits("mi", filter, &conditions, &args, &argIdx)
+
+	rows, err := r.pool.Query(ctx, fmt.Sprintf(presentMediaTypesQuery, strings.Join(conditions, " AND ")), args...)
 	if err != nil {
-		return nil, fmt.Errorf("get all users with taste profiles: %w", err)
+		return nil, fmt.Errorf("find present media types: %w", err)
 	}
 	defer rows.Close()
+	for rows.Next() {
+		var mediaType string
+		if err := rows.Scan(&mediaType); err != nil {
+			return nil, fmt.Errorf("scan present media type: %w", err)
+		}
+		present[mediaType] = struct{}{}
+	}
+	return present, rows.Err()
+}
 
-	var profiles []StaleProfile
+// itemQualityRatingsQuery reads the rating the quality prior uses,
+// catalogRatingSQL, as the taste-seed picker orders by.
+const itemQualityRatingsQuery = `
+		SELECT content_id, quality
+		FROM   (
+			SELECT mi.content_id, ` + catalogRatingSQL + ` AS quality
+			FROM   media_items mi
+			WHERE  mi.content_id = ANY($1)
+		) rated
+		WHERE  quality IS NOT NULL`
+
+// GetItemQualityRatings returns the quality rating of each item that has one.
+func (r *Repo) GetItemQualityRatings(ctx context.Context, itemIDs []string) (map[string]float64, error) {
+	result := make(map[string]float64, len(itemIDs))
+	if len(itemIDs) == 0 {
+		return result, nil
+	}
+	rows, err := r.pool.Query(ctx, itemQualityRatingsQuery, itemIDs)
+	if err != nil {
+		return nil, fmt.Errorf("get item quality ratings: %w", err)
+	}
+	defer rows.Close()
 	for rows.Next() {
-		var p StaleProfile
-		if err := rows.Scan(&p.UserID, &p.ProfileID); err != nil {
-			return nil, fmt.Errorf("scan user with taste profile: %w", err)
+		var id string
+		var rating float64
+		if err := rows.Scan(&id, &rating); err != nil {
+			return nil, fmt.Errorf("scan item quality rating: %w", err)
 		}
-		profiles = append(profiles, p)
+		result[id] = rating
 	}
-	return profiles, rows.Err()
+	return result, rows.Err()
+}
+
+// listCacheRefreshCandidatesQuery orders profiles by the age of their main
+// row, those without one first. A run that exhausts its time budget leaves the
+// newest rows for last, so the next run starts with the profiles it missed.
+const listCacheRefreshCandidatesQuery = `
+		SELECT tp.user_id, tp.profile_id
+		FROM   user_taste_profiles tp
+		LEFT   JOIN recommendation_cache rc
+		       ON  rc.user_id        = tp.user_id
+		       AND rc.profile_id     = tp.profile_id
+		       AND rc.rec_type       = $1
+		       AND rc.source_item_id = ''
+		ORDER  BY rc.created_at ASC NULLS FIRST, tp.user_id, tp.profile_id`
+
+// ListCacheRefreshCandidates returns every profile that has a taste profile,
+// least recently cached first.
+func (r *Repo) ListCacheRefreshCandidates(ctx context.Context) ([]StaleProfile, error) {
+	rows, err := r.pool.Query(ctx, listCacheRefreshCandidatesQuery, RecTypeForYouMain)
+	if err != nil {
+		return nil, fmt.Errorf("list cache refresh candidates: %w", err)
+	}
+	candidates, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (StaleProfile, error) {
+		var p StaleProfile
+		err := row.Scan(&p.UserID, &p.ProfileID)
+		return p, err
+	})
+	if err != nil {
+		return nil, fmt.Errorf("list cache refresh candidates: %w", err)
+	}
+	return candidates, nil
+}
+
+// HasSignalRows reports whether the profile has a rating or ebook reading
+// progress, the signals that always live in Postgres. With includeStoreTables
+// it also checks the Postgres user store's watch progress, favorites and
+// watchlist tables, which hold those signals unless the user store lives
+// elsewhere.
+func (r *Repo) HasSignalRows(ctx context.Context, userID int, profileID string, includeStoreTables bool) (bool, error) {
+	var exists bool
+	err := r.pool.QueryRow(ctx, `
+		SELECT EXISTS (SELECT 1 FROM user_ratings WHERE user_id = $1 AND profile_id = $2)
+		    OR EXISTS (SELECT 1 FROM ebook_reader_progress WHERE user_id = $1 AND profile_id = $2)
+		    OR ($3 AND (
+		           EXISTS (SELECT 1 FROM user_watch_progress WHERE user_id = $1 AND profile_id = $2)
+		        OR EXISTS (SELECT 1 FROM user_favorites WHERE user_id = $1 AND profile_id = $2)
+		        OR EXISTS (SELECT 1 FROM user_watchlist WHERE user_id = $1 AND profile_id = $2)))`,
+		userID, profileID, includeStoreTables).Scan(&exists)
+	if err != nil {
+		return false, fmt.Errorf("check signals for user %d profile %s: %w", userID, profileID, err)
+	}
+	return exists, nil
+}
+
+// ListUserIDs returns every account's ID in ascending order.
+func (r *Repo) ListUserIDs(ctx context.Context) ([]int, error) {
+	rows, err := r.pool.Query(ctx, `SELECT id FROM users ORDER BY id`)
+	if err != nil {
+		return nil, fmt.Errorf("list user ids: %w", err)
+	}
+	ids, err := pgx.CollectRows(rows, pgx.RowTo[int])
+	if err != nil {
+		return nil, fmt.Errorf("list user ids: %w", err)
+	}
+	return ids, nil
+}
+
+// HasGlobalRecommendationCache reports whether any unexpired global row is
+// cached.
+func (r *Repo) HasGlobalRecommendationCache(ctx context.Context) (bool, error) {
+	var exists bool
+	err := r.pool.QueryRow(ctx, `
+		SELECT EXISTS (
+			SELECT 1 FROM recommendation_cache
+			WHERE  user_id IS NULL AND profile_id = $1 AND expires_at > NOW()
+		)`, GlobalCacheProfileID).Scan(&exists)
+	if err != nil {
+		return false, fmt.Errorf("check global recommendation cache: %w", err)
+	}
+	return exists, nil
 }
 
 // GetWatchedItemIDs returns content IDs of media items the user has watched
@@ -1729,45 +2674,52 @@ func (r *Repo) GetWatchedItemIDSet(ctx context.Context, userID int, profileID st
 	return scoredItemIDSet(ids), nil
 }
 
-// GetWatchedItemIDSetFromStore derives watched item IDs from a user store,
-// then canonicalizes episode progress rows to their parent series IDs.
-func (r *Repo) GetWatchedItemIDSetFromStore(ctx context.Context, store userstore.UserStore, profileID string) (map[string]struct{}, error) {
-	if store == nil {
-		return map[string]struct{}{}, nil
+// GetFavoriteItemIDs returns the content IDs a profile has favorited, as
+// stored: episodes are not resolved to their series.
+func (r *Repo) GetFavoriteItemIDs(ctx context.Context, userID int, profileID string) ([]string, error) {
+	rows, err := r.pool.Query(ctx,
+		`SELECT media_item_id FROM user_favorites WHERE user_id = $1 AND profile_id = $2`,
+		userID, profileID)
+	if err != nil {
+		return nil, fmt.Errorf("get favorite item IDs: %w", err)
 	}
-
-	const pageSize = 1000
-	rawIDs := make([]string, 0, pageSize)
-	offset := 0
-
-	for {
-		progress, err := store.ListProgress(ctx, profileID, "all", pageSize, offset)
-		if err != nil {
-			return nil, fmt.Errorf("list progress from store: %w", err)
-		}
-
-		for _, wp := range progress {
-			if wp.Completed || (wp.DurationSeconds > 0 && wp.PositionSeconds/wp.DurationSeconds >= 0.5) {
-				rawIDs = append(rawIDs, wp.MediaItemID)
-			}
-		}
-
-		if len(progress) < pageSize {
-			break
-		}
-		offset += len(progress)
+	ids, err := pgx.CollectRows(rows, pgx.RowTo[string])
+	if err != nil {
+		return nil, fmt.Errorf("get favorite item IDs: %w", err)
 	}
+	return ids, nil
+}
 
-	return r.ResolveCanonicalItemIDSet(ctx, rawIDs)
+// GetNotInterestedMarks returns the profile's Not interested marks, newest
+// first.
+func (r *Repo) GetNotInterestedMarks(ctx context.Context, userID int, profileID string) ([]NotInterestedMark, error) {
+	rows, err := r.pool.Query(ctx,
+		`SELECT media_item_id, added_at FROM user_not_interested
+		 WHERE user_id = $1 AND profile_id = $2
+		 ORDER BY added_at DESC, media_item_id DESC`,
+		userID, profileID)
+	if err != nil {
+		return nil, fmt.Errorf("get not interested marks: %w", err)
+	}
+	marks, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (NotInterestedMark, error) {
+		var m NotInterestedMark
+		err := row.Scan(&m.MediaItemID, &m.MarkedAt)
+		return m, err
+	})
+	if err != nil {
+		return nil, fmt.Errorf("get not interested marks: %w", err)
+	}
+	return marks, nil
 }
 
-// GetRecentCompletedItemIDs returns the most recently completed canonical item IDs for a profile.
+// GetRecentCompletedItemIDs returns the most recently completed canonical item
+// IDs of recommendableMediaTypes for a profile.
 func (r *Repo) GetRecentCompletedItemIDs(ctx context.Context, userID int, profileID string, limit int) ([]string, error) {
 	if limit <= 0 {
 		return []string{}, nil
 	}
 
-	rows, err := r.pool.Query(ctx, recentCompletedItemIDsQuery, userID, profileID, limit)
+	rows, err := r.pool.Query(ctx, recentCompletedItemIDsQuery, userID, profileID, limit, recommendableMediaTypes)
 	if err != nil {
 		return nil, fmt.Errorf("get recent completed item IDs: %w", err)
 	}
@@ -1787,19 +2739,6 @@ func (r *Repo) GetRecentCompletedItemIDs(ctx context.Context, userID int, profil
 	return ids, nil
 }
 
-// ExcludeWatchedItems removes watched items from a scored recommendation list.
-func (r *Repo) ExcludeWatchedItems(ctx context.Context, userID int, profileID string, items []ScoredItem) ([]ScoredItem, error) {
-	if len(items) == 0 {
-		return items, nil
-	}
-
-	watchedSet, err := r.GetWatchedItemIDSet(ctx, userID, profileID)
-	if err != nil {
-		return nil, fmt.Errorf("get watched item IDs: %w", err)
-	}
-	return excludeScoredItems(items, watchedSet), nil
-}
-
 func scoredItemIDSet(ids []string) map[string]struct{} {
 	set := make(map[string]struct{}, len(ids))
 	for _, id := range ids {
@@ -1858,6 +2797,27 @@ func (r *Repo) ResolveCanonicalItemIDs(ctx context.Context, itemIDs []string) (m
 	return resolved, nil
 }
 
+// RecommendableItemIDs returns the IDs in itemIDs that still have a
+// media_items row of recommendableMediaTypes.
+func (r *Repo) RecommendableItemIDs(ctx context.Context, itemIDs []string) (map[string]struct{}, error) {
+	existing := make(map[string]struct{}, len(itemIDs))
+	if len(itemIDs) == 0 {
+		return existing, nil
+	}
+	rows, err := r.pool.Query(ctx, `SELECT content_id FROM media_items WHERE content_id = ANY($1) AND type = ANY($2)`, itemIDs, recommendableMediaTypes)
+	if err != nil {
+		return nil, fmt.Errorf("find recommendable item IDs: %w", err)
+	}
+	ids, err := pgx.CollectRows(rows, pgx.RowTo[string])
+	if err != nil {
+		return nil, fmt.Errorf("find recommendable item IDs: %w", err)
+	}
+	for _, id := range ids {
+		existing[id] = struct{}{}
+	}
+	return existing, nil
+}
+
 // ResolveCanonicalItemIDSet maps episode IDs to their parent series IDs and
 // leaves movie/series IDs unchanged.
 func (r *Repo) ResolveCanonicalItemIDSet(ctx context.Context, itemIDs []string) (map[string]struct{}, error) {
@@ -1872,17 +2832,6 @@ func (r *Repo) ResolveCanonicalItemIDSet(ctx context.Context, itemIDs []string)
 	return set, nil
 }
 
-// CleanOldCacheTypes removes V1 cache entries that are no longer used.
-func (r *Repo) CleanOldCacheTypes(ctx context.Context, userID int, profileID string) error {
-	_, err := r.pool.Exec(ctx,
-		`DELETE FROM recommendation_cache WHERE user_id = $1 AND profile_id = $2 AND rec_type IN ('for_you', 'taste_match')`,
-		userID, profileID)
-	if err != nil {
-		return fmt.Errorf("clean old cache types: %w", err)
-	}
-	return nil
-}
-
 // GetItemAllGenres returns the full genre array for each item ID.
 func (r *Repo) GetItemAllGenres(ctx context.Context, itemIDs []string) (map[string][]string, error) {
 	if len(itemIDs) == 0 {
diff --git a/internal/recommendations/repo_stale_test.go b/internal/recommendations/repo_stale_test.go
index 6557cd714a..d4d2a120d9 100644
--- a/internal/recommendations/repo_stale_test.go
+++ b/internal/recommendations/repo_stale_test.go
@@ -2,101 +2,410 @@ package recommendations
 
 import (
 	"context"
+	"encoding/json"
+	"errors"
 	"testing"
+	"time"
 
 	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/config"
+	"github.com/prairie-server/prairie-server/internal/userstore"
 )
 
-// TestMarkProfileStaleWritesOnlyWhenNotAlreadyStale counts the row versions
-// repeated stale marks write. A profile already waiting for the sweep keeps
-// its pending mark instead of rewriting the row, and a mark after a refresh
-// consumed the previous one (or after ClearStaleAt) makes it pending again.
-func TestMarkProfileStaleWritesOnlyWhenNotAlreadyStale(t *testing.T) {
+// staleTestProfile is one taste profile row in the test database.
+type staleTestProfile struct {
+	t       *testing.T
+	pool    *pgxpool.Pool
+	repo    *Repo
+	userID  int
+	profile string
+	dims    int
+}
+
+// newStaleTestProfile stores a taste profile refreshed an hour ago and never
+// marked since.
+func newStaleTestProfile(t *testing.T) *staleTestProfile {
+	t.Helper()
 	pool := newEngineTestPool(t)
 	ctx := context.Background()
-	var userID int
+	p := &staleTestProfile{t: t, pool: pool, repo: NewRepo(pool), profile: "p1"}
 	if err := pool.QueryRow(ctx, `INSERT INTO users (username, role) VALUES ($1, 'user') RETURNING id`,
-		"taste-stale-"+uuid.NewString()).Scan(&userID); err != nil {
+		"taste-stale-"+uuid.NewString()).Scan(&p.userID); err != nil {
 		t.Fatalf("insert user: %v", err)
 	}
 	t.Cleanup(func() {
-		_, _ = pool.Exec(context.Background(), `DELETE FROM users WHERE id = $1`, userID)
+		_, _ = pool.Exec(context.Background(), `DELETE FROM users WHERE id = $1`, p.userID)
 	})
-	var dims int
 	if err := pool.QueryRow(ctx, `
 		SELECT atttypmod FROM pg_attribute
-		WHERE attrelid = 'public.user_taste_profiles'::regclass AND attname = 'embedding'`).Scan(&dims); err != nil {
+		WHERE attrelid = 'public.user_taste_profiles'::regclass AND attname = 'embedding'`).Scan(&p.dims); err != nil {
 		t.Fatalf("read embedding dimensions: %v", err)
 	}
-	repo := NewRepo(pool)
-	if err := repo.UpsertTasteProfile(ctx, userID, "p1", make([]float32, dims), map[string]int{}, ""); err != nil {
-		t.Fatalf("seed taste profile: %v", err)
+	p.upsert(p.now().Add(-time.Hour))
+	return p
+}
+
+func (p *staleTestProfile) now() time.Time {
+	p.t.Helper()
+	now, err := p.repo.Now(context.Background())
+	if err != nil {
+		p.t.Fatalf("read database time: %v", err)
 	}
-	// Start from a profile refreshed an hour ago and never marked since.
-	if _, err := pool.Exec(ctx, `
-		UPDATE user_taste_profiles SET updated_at = NOW() - interval '1 hour', stale_at = NULL
-		WHERE user_id = $1 AND profile_id = 'p1'`, userID); err != nil {
-		t.Fatalf("backdate taste profile: %v", err)
+	return now
+}
+
+// upsert stores the taste profile as a refresh that started at started would.
+func (p *staleTestProfile) upsert(started time.Time) {
+	p.t.Helper()
+	if err := p.repo.UpsertTasteProfile(context.Background(), p.userID, p.profile, make([]float32, p.dims), map[string]int{}, "", started); err != nil {
+		p.t.Fatalf("store taste profile: %v", err)
 	}
+}
 
-	rowVersion := func() string {
-		t.Helper()
-		var xmin string
-		if err := pool.QueryRow(ctx, `SELECT xmin::text FROM user_taste_profiles WHERE user_id = $1 AND profile_id = 'p1'`, userID).Scan(&xmin); err != nil {
-			t.Fatalf("read row version: %v", err)
+func (p *staleTestProfile) mark() {
+	p.t.Helper()
+	if err := p.repo.MarkProfileStale(context.Background(), p.userID, p.profile); err != nil {
+		p.t.Fatalf("mark profile stale: %v", err)
+	}
+}
+
+func (p *staleTestProfile) staleAt() *time.Time {
+	p.t.Helper()
+	var at *time.Time
+	if err := p.pool.QueryRow(context.Background(), `SELECT stale_at FROM user_taste_profiles WHERE user_id = $1 AND profile_id = $2`, p.userID, p.profile).Scan(&at); err != nil {
+		p.t.Fatalf("read stale mark: %v", err)
+	}
+	return at
+}
+
+// pending reports whether the stale sweep would refresh the profile.
+func (p *staleTestProfile) pending() bool {
+	p.t.Helper()
+	stale, err := p.repo.GetStaleProfiles(context.Background(), 1000)
+	if err != nil {
+		p.t.Fatalf("get stale profiles: %v", err)
+	}
+	for _, s := range stale {
+		if s.UserID == p.userID && s.ProfileID == p.profile {
+			return true
 		}
-		return xmin
 	}
-	pending := func() bool {
-		t.Helper()
-		stale, err := repo.GetStaleProfiles(ctx, 1000)
-		if err != nil {
-			t.Fatalf("get stale profiles: %v", err)
+	return false
+}
+
+// A change to a profile that has no taste row yet is not lost when its first
+// build, which read the signals before the change, stores the profile: the
+// mark creates a vectorless row the build fills, and the mark outlives the
+// build's clear.
+func TestStaleMarkBeforeTheFirstBuildSurvivesItPostgres(t *testing.T) {
+	p := newStaleTestProfile(t)
+	ctx := context.Background()
+	if _, err := p.pool.Exec(ctx, `DELETE FROM user_taste_profiles WHERE user_id = $1 AND profile_id = $2`, p.userID, p.profile); err != nil {
+		t.Fatal(err)
+	}
+
+	started := p.now() // the first build starts reading
+	p.mark()           // a favorite lands while it reads
+	if !p.pending() {
+		t.Fatal("a mark on a profile with no taste row left nothing pending")
+	}
+	p.upsert(started)
+	if err := p.repo.ClearStaleAt(ctx, p.userID, p.profile, started); err != nil {
+		t.Fatalf("clear stale mark: %v", err)
+	}
+	if !p.pending() {
+		t.Fatalf("stale_at = %v; the change after the first build started must stay pending", p.staleAt())
+	}
+}
+
+// A change that lands while a refresh is reading signals stays pending: the
+// refresh stores the profile as of its start, and clears only marks older
+// than that start.
+func TestStaleMarkSetMidRefreshSurvivesItsClear(t *testing.T) {
+	p := newStaleTestProfile(t)
+	ctx := context.Background()
+	p.mark() // the change that queued the refresh
+
+	started := p.now()
+	p.mark() // a rating lands while the refresh reads
+	p.upsert(started)
+	if err := p.repo.ClearStaleAt(ctx, p.userID, p.profile, started); err != nil {
+		t.Fatalf("clear stale mark: %v", err)
+	}
+	if p.staleAt() == nil || !p.pending() {
+		t.Fatalf("stale_at = %v, pending = %v; the mark set mid-refresh must stay pending", p.staleAt(), p.pending())
+	}
+
+	// The next refresh starts after that mark and clears it.
+	started = p.now()
+	p.upsert(started)
+	if err := p.repo.ClearStaleAt(ctx, p.userID, p.profile, started); err != nil {
+		t.Fatalf("clear stale mark: %v", err)
+	}
+	if p.staleAt() != nil || p.pending() {
+		t.Fatalf("stale_at = %v, pending = %v after a refresh that started after the mark", p.staleAt(), p.pending())
+	}
+}
+
+// The nightly taste job rebuilds only the taste vector, stored as of its
+// start. A mark set before it (an access change, say) still needs the cached
+// rows rebuilt, so it stays pending until a full refresh clears it.
+func TestTasteJobLeavesAPendingMarkForTheSweep(t *testing.T) {
+	p := newStaleTestProfile(t)
+	p.mark()
+	p.upsert(p.now()) // the taste job reaches the profile after the mark
+	if !p.pending() {
+		t.Fatal("the taste job's write hid a pending stale mark")
+	}
+	started := p.now()
+	p.upsert(started)
+	if err := p.repo.ClearStaleAt(context.Background(), p.userID, p.profile, started); err != nil {
+		t.Fatal(err)
+	}
+	if p.pending() {
+		t.Fatal("a full refresh left the mark pending")
+	}
+}
+
+// MarkProfileStale moves a pending mark forward instead of keeping the older
+// one, which a refresh already running could clear.
+func TestMarkProfileStaleAdvancesAPendingMark(t *testing.T) {
+	p := newStaleTestProfile(t)
+	p.mark()
+	first := p.staleAt()
+	if first == nil || !p.pending() {
+		t.Fatalf("first mark: stale_at = %v, pending = %v", first, p.pending())
+	}
+	p.mark()
+	second := p.staleAt()
+	if second == nil || !second.After(*first) {
+		t.Fatalf("second mark: stale_at = %v, want later than %v", second, *first)
+	}
+}
+
+// The sweep takes the oldest marks first, so a profile whose refresh keeps
+// failing, and is marked again each time, does not hold the batch.
+func TestGetStaleProfilesTakesTheOldestMarkFirst(t *testing.T) {
+	p := newStaleTestProfile(t)
+	other := *p
+	other.profile = "p2"
+	other.upsert(p.now().Add(-time.Hour))
+	other.mark()
+	p.mark()
+
+	stale, err := p.repo.GetStaleProfiles(context.Background(), 1000)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var order []string
+	for _, s := range stale {
+		if s.UserID == p.userID {
+			order = append(order, s.ProfileID)
 		}
-		for _, p := range stale {
-			if p.UserID == userID && p.ProfileID == "p1" {
-				return true
-			}
+	}
+	if len(order) != 2 || order[0] != "p2" || order[1] != "p1" {
+		t.Fatalf("stale order = %v, want [p2 p1]", order)
+	}
+}
+
+// failingStoreProvider fails every user store lookup, so a refresh fails
+// before it reads any signal.
+type failingStoreProvider struct{}
+
+func (failingStoreProvider) ForUser(context.Context, int) (userstore.UserStore, error) {
+	return nil, errors.New("user store unavailable")
+}
+
+func (failingStoreProvider) Close() error { return nil }
+
+// A refresh that fails leaves the profile pending for the stale sweep, even
+// when nothing had marked it before the refresh ran (a read-triggered one).
+func TestFailedRefreshLeavesTheProfilePendingPostgres(t *testing.T) {
+	p := newStaleTestProfile(t)
+	if p.pending() {
+		t.Fatal("precondition: profile already pending")
+	}
+	engine := NewEngine(p.pool, nil, nil, nil, failingStoreProvider{}, config.RecommendationsConfig{})
+	w := newJobTestWorker(&fakeLocker{}, nil)
+	w.engine = engine
+	w.staleMarker = engine.repo
+	if err := w.refreshProfile(t.Context(), nil, p.userID, p.profile); err == nil {
+		t.Fatal("refresh with a failing user store succeeded")
+	}
+	if !p.pending() {
+		t.Fatalf("stale_at = %v; a failed refresh must leave the profile pending", p.staleAt())
+	}
+}
+
+// A sweep whose refresh fails is recorded with the failure counted, and the
+// profile stays in the backlog admin status reports.
+func TestStaleSweepRecordsFailedRefreshesPostgres(t *testing.T) {
+	p := newStaleTestProfile(t)
+	p.mark()
+	engine := NewEngine(p.pool, nil, nil, nil, failingStoreProvider{}, config.RecommendationsConfig{})
+	history := newFakeHistory()
+	w := newJobTestWorker(&fakeLocker{}, history)
+	w.engine = engine
+	w.staleMarker = engine.repo
+
+	w.refreshStaleProfiles(t.Context())
+	run := waitRun(t, history)
+	var res staleSweepResult
+	if err := json.Unmarshal(run.ResultData, &res); err != nil {
+		t.Fatal(err)
+	}
+	if run.TaskKey != staleSweepTaskKey || run.Status != runStatusCompleted || res.Failed == 0 {
+		t.Fatalf("recorded sweep %+v %s; want a completed run counting the failure", run, run.ResultData)
+	}
+	status, err := w.StaleSweep(t.Context())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if status.Pending == 0 || status.LastRun == nil || status.LastRun.TaskKey != staleSweepTaskKey || !p.pending() {
+		t.Fatalf("stale sweep status = %+v; want the failed profile pending and the run reported", status)
+	}
+}
+
+// Every node announces a policy generation once it loads it, but only the
+// first announcement of a generation newer than the last marked one marks the
+// profiles: one full-table update per change, not one per node.
+func TestMarkAllProfilesStaleForPolicyMarksOncePerGenerationPostgres(t *testing.T) {
+	p := newStaleTestProfile(t)
+	ctx := context.Background()
+	var saved *string
+	_ = p.pool.QueryRow(ctx, `SELECT value FROM server_settings WHERE key = $1`, policyMarkedGenerationKey).Scan(&saved)
+	t.Cleanup(func() {
+		if saved == nil {
+			_, _ = p.pool.Exec(context.Background(), `DELETE FROM server_settings WHERE key = $1`, policyMarkedGenerationKey)
+			return
 		}
-		return false
+		_, _ = p.pool.Exec(context.Background(), `UPDATE server_settings SET value = $2 WHERE key = $1`, policyMarkedGenerationKey, *saved)
+	})
+	if _, err := p.pool.Exec(ctx, `DELETE FROM server_settings WHERE key = $1`, policyMarkedGenerationKey); err != nil {
+		t.Fatal(err)
 	}
-	markCountingWrites := func(marks int) int {
+
+	mark := func(generation int64) int64 {
 		t.Helper()
-		writes := 0
-		for range marks {
-			before := rowVersion()
-			if err := repo.MarkProfileStale(ctx, userID, "p1"); err != nil {
-				t.Fatalf("mark profile stale: %v", err)
-			}
-			if rowVersion() != before {
-				writes++
-			}
+		n, err := p.repo.MarkAllProfilesStaleForPolicy(ctx, generation)
+		if err != nil {
+			t.Fatal(err)
 		}
-		return writes
+		return n
+	}
+	if n := mark(5); n == 0 || !p.pending() {
+		t.Fatalf("first node's mark for generation 5 marked %d profiles, pending = %v", n, p.pending())
+	}
+	p.upsert(p.now())
+	if err := p.repo.ClearStaleAt(ctx, p.userID, p.profile, p.now()); err != nil {
+		t.Fatal(err)
+	}
+	if n := mark(5); n != 0 || p.pending() {
+		t.Fatalf("a second node's mark for generation 5 marked %d profiles; want none", n)
+	}
+	if n := mark(4); n != 0 {
+		t.Fatalf("an older generation marked %d profiles; want none", n)
+	}
+	if n := mark(6); n == 0 || !p.pending() {
+		t.Fatalf("generation 6 marked %d profiles, pending = %v", n, p.pending())
+	}
+}
+
+// A server that has not loaded the stored policy generation does not
+// refresh: the refresh would build under the old scope and clear the mark the
+// change left. The profile stays pending for a server, or a later sweep, that
+// has loaded it.
+func TestRefreshWaitsForThePolicyChangePostgres(t *testing.T) {
+	p := newStaleTestProfile(t)
+	p.mark()
+	engine := NewEngine(p.pool, nil, nil, nil, failingStoreProvider{}, config.RecommendationsConfig{})
+	w := newJobTestWorker(&fakeLocker{}, nil)
+	w.engine = engine
+	w.staleMarker = engine.repo
+	w.WithPolicyCheck(func(context.Context) (bool, error) { return false, nil })
+
+	// failingStoreProvider would fail the refresh's first read; the policy
+	// check stops it before that.
+	if err := w.refreshProfile(t.Context(), nil, p.userID, p.profile); !errors.Is(err, errPolicyNotLoaded) {
+		t.Fatalf("refresh on a server behind the policy = %v, want errPolicyNotLoaded", err)
+	}
+	if !p.pending() {
+		t.Fatal("the profile is no longer pending")
 	}
+}
 
-	const marks = 100
-	if writes := markCountingWrites(marks); writes != 1 || !pending() {
-		t.Fatalf("%d marks on a fresh profile: row writes = %d, pending = %v; want 1 write and pending", marks, writes, pending())
+// After a merge or split moves user state onto items, every profile with
+// progress, history, a rating, favorite or watchlist entry on them, or on an
+// episode of a series among them, is marked stale; other profiles are not.
+func TestMarkProfilesStaleForItemsPostgres(t *testing.T) {
+	p := newStaleTestProfile(t)
+	ctx := context.Background()
+	const prefix = "tmark-items-"
+	cleanupRecoMediaItems(t, p.pool, prefix)
+	series, movie, other := prefix+"series", prefix+"movie", prefix+"other"
+	seedRecoMediaItem(t, p.pool, series, "series", "matched")
+	seedRecoMediaItem(t, p.pool, movie, "movie", "matched")
+	seedRecoMediaItem(t, p.pool, other, "movie", "matched")
+	episode := prefix + "episode"
+	if _, err := p.pool.Exec(ctx, `INSERT INTO episodes(content_id, series_id, season_number, episode_number) VALUES($1, $2, 1, 1)`, episode, series); err != nil {
+		t.Fatal(err)
 	}
 
-	// A refresh that finished after the last mark consumed it.
-	if _, err := pool.Exec(ctx, `
-		UPDATE user_taste_profiles SET stale_at = updated_at - interval '1 minute'
-		WHERE user_id = $1 AND profile_id = 'p1'`, userID); err != nil {
-		t.Fatalf("consume stale mark: %v", err)
+	signals := map[string]string{
+		"episode-progress": `INSERT INTO user_watch_progress(user_id, profile_id, media_item_id, completed) VALUES($1, $2, '` + episode + `', true)`,
+		"history":          `INSERT INTO user_watch_history(id, user_id, profile_id, media_item_id, completed) VALUES(gen_random_uuid()::text, $1, $2, '` + movie + `', true)`,
+		"rating":           `INSERT INTO user_ratings(user_id, profile_id, media_item_id, rating) VALUES($1, $2, '` + movie + `', 4)`,
+		"favorite":         `INSERT INTO user_favorites(user_id, profile_id, media_item_id) VALUES($1, $2, '` + series + `')`,
+		"watchlist":        `INSERT INTO user_watchlist(user_id, profile_id, media_item_id) VALUES($1, $2, '` + movie + `')`,
+		"unrelated":        `INSERT INTO user_watch_progress(user_id, profile_id, media_item_id, completed) VALUES($1, $2, '` + other + `', true)`,
+	}
+	profiles := make(map[string]*staleTestProfile, len(signals))
+	for name, insert := range signals {
+		profile := *p
+		profile.profile = name
+		profile.upsert(p.now().Add(-time.Hour))
+		if _, err := p.pool.Exec(ctx, insert, p.userID, name); err != nil {
+			t.Fatalf("seed %s: %v", name, err)
+		}
+		profiles[name] = &profile
 	}
-	if pending() {
-		t.Fatal("precondition: consumed mark still pending")
+
+	// A live profile with no taste row yet gets a stale vectorless one, so its
+	// first build cannot consume the change; a deleted profile whose history
+	// outlived it gets none.
+	fresh, deleted := uuid.NewString(), uuid.NewString()
+	if _, err := p.pool.Exec(ctx, `INSERT INTO user_profiles(id, user_id, name) VALUES($1, $2, 'fresh')`, fresh, p.userID); err != nil {
+		t.Fatal(err)
 	}
-	if writes := markCountingWrites(marks); writes != 1 || !pending() {
-		t.Fatalf("%d marks after a refresh: row writes = %d, pending = %v; want 1 write and pending", marks, writes, pending())
+	for _, profile := range []string{fresh, deleted} {
+		if _, err := p.pool.Exec(ctx, `INSERT INTO user_favorites(user_id, profile_id, media_item_id) VALUES($1, $2, $3)`, p.userID, profile, movie); err != nil {
+			t.Fatal(err)
+		}
 	}
 
-	if err := repo.ClearStaleAt(ctx, userID, "p1"); err != nil {
-		t.Fatalf("clear stale mark: %v", err)
+	marked, err := p.repo.MarkProfilesStaleForItems(ctx, []string{series, movie})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if marked != int64(len(signals)) {
+		t.Fatalf("marked %d profiles, want %d", marked, len(signals))
+	}
+	freshProfile := *p
+	freshProfile.profile = fresh
+	if !freshProfile.pending() {
+		t.Fatal("a live profile with no taste row was not marked")
+	}
+	if n := countRows(t, p.pool, `SELECT COUNT(*) FROM user_taste_profiles WHERE user_id = $1 AND profile_id = $2`, p.userID, deleted); n != 0 {
+		t.Fatalf("a deleted profile got %d taste rows", n)
+	}
+	for name, profile := range profiles {
+		if want := name != "unrelated"; profile.pending() != want {
+			t.Fatalf("profile %s pending = %v, want %v", name, profile.pending(), want)
+		}
 	}
-	if writes := markCountingWrites(marks); writes != 1 || !pending() {
-		t.Fatalf("%d marks after ClearStaleAt: row writes = %d, pending = %v; want 1 write and pending", marks, writes, pending())
+	if p.pending() {
+		t.Fatal("a profile with no state on the items was marked")
 	}
 }
diff --git a/internal/recommendations/repo_test.go b/internal/recommendations/repo_test.go
index eef22c331f..3df62b23dc 100644
--- a/internal/recommendations/repo_test.go
+++ b/internal/recommendations/repo_test.go
@@ -11,14 +11,15 @@ import (
 )
 
 func TestTasteSeedCandidateQueryOrdersByReliableColdStartSignals(t *testing.T) {
-	query := strings.Join(strings.Fields(tasteSeedCandidateQuery), " ")
+	query := strings.Join(strings.Fields(tasteSeedCandidateQuery(nil, 1)), " ")
 
 	assertQueryTermsInOrder(t, query,
 		"ORDER BY COALESCE(wc.watch_count, 0) DESC",
-		"WHEN mi.rating_imdb IS NOT NULL THEN 2",
-		"WHEN mi.rating_tmdb IS NOT NULL AND mi.rating_tmdb < 9.5 THEN 1",
+		"COALESCE(cardinality(mi.keywords), 0) >= 5) DESC",
+		"WHEN mi.rating_imdb < 9.6 THEN 2",
+		"WHEN mi.rating_tmdb < 9.5 THEN 1",
 		"ELSE 0 END DESC",
-		"mi.rating_imdb DESC NULLS LAST",
+		"CASE WHEN mi.rating_imdb < 9.6 THEN mi.rating_imdb END DESC NULLS LAST",
 		"CASE WHEN mi.rating_tmdb < 9.5 THEN mi.rating_tmdb END DESC NULLS LAST",
 		"mi.year DESC NULLS LAST",
 		"mi.content_id ASC",
@@ -29,16 +30,17 @@ func TestTasteSeedCandidateQueryOrdersByReliableColdStartSignals(t *testing.T) {
 	}
 }
 
-func TestTasteSeedCandidateQueryIncludesEbooks(t *testing.T) {
-	query := strings.Join(strings.Fields(tasteSeedCandidateQuery), " ")
-
-	for _, term := range []string{
-		"(mi.status = 'matched' OR mi.type = 'audiobook' OR mi.type = 'ebook')",
-		"mi.type IN ('movie', 'series', 'audiobook', 'ebook')",
-	} {
-		if !strings.Contains(query, term) {
-			t.Fatalf("taste seed candidate query missing %q: %s", term, query)
-		}
+// The picker's first page leads with every genre's best candidate, then each
+// genre's second, each round in rank order, rather than the top genre's run.
+func TestInterleaveByGenreTakesEachGenresBestFirst(t *testing.T) {
+	ranked := []tasteSeedCandidate{
+		{"drama-1", "Drama"}, {"drama-2", "Drama"}, {"drama-3", "Drama"},
+		{"horror-1", "Horror"}, {"drama-4", "Drama"}, {"untagged-1", ""}, {"horror-2", "Horror"},
+	}
+	got := interleaveByGenre(ranked)
+	want := []string{"drama-1", "horror-1", "untagged-1", "drama-2", "horror-2", "drama-3", "drama-4"}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("interleaved = %v, want %v", got, want)
 	}
 }
 
diff --git a/internal/recommendations/rotation.go b/internal/recommendations/rotation.go
new file mode 100644
index 0000000000..a9903f98f7
--- /dev/null
+++ b/internal/recommendations/rotation.go
@@ -0,0 +1,112 @@
+package recommendations
+
+import (
+	"cmp"
+	"crypto/sha256"
+	"encoding/binary"
+	"fmt"
+	"math"
+	"slices"
+	"time"
+)
+
+// A profile's taste vector barely moves while it is idle, so without
+// rotation its personal rows serve the same titles every day. Reads rotate
+// the main row and the cluster rows once a day: the best-matched head stays,
+// and the rest of the served window is drawn from the next-ranked titles,
+// favoring the higher ranks. The draw is a pure function of the profile, the
+// row, the UTC date and the items, so every node serves the same rotation
+// without shared state, whatever its time zone.
+const (
+	// rotationMaxPinned is the most leading items a rotation leaves in
+	// place.
+	rotationMaxPinned = 10
+	// rotationRankOffset softens how strongly the draw favors the higher
+	// ranks: the item at tail index i is drawn with weight 1/(i+offset).
+	rotationRankOffset = 5
+)
+
+// rotationSeedKey is the seed rotateTail draws a personal row with: the
+// profile and the row's cache key, so a title shared by two rows is drawn
+// independently in each.
+func rotationSeedKey(userID int, profileID, rowKey string) string {
+	return fmt.Sprintf("%d|%s|%s", userID, profileID, rowKey)
+}
+
+// rotateTail returns items with the window a read serves, its first limit
+// items, rotated for date's day. It keeps the first pin = min(10, limit/2)
+// items in place and draws the other take = limit-pin from the next 2×take
+// items, without replacement, the item at tail index i with weight
+// 1/(i+rotationRankOffset). The draws follow the leading items in rank order,
+// and the items not drawn follow them in rank order, so no item is lost and
+// a caller that trims to limit serves the rotated window. Items no longer
+// than limit, or a limit of at most rotationMaxPinned, come back unchanged.
+// items is never modified.
+//
+// The draw ranks each tail item by ln(u)·(i+rotationRankOffset), the log of
+// the weighted-sampling key u^(1/w), with u taken from
+// sha256(seedKey|date|itemID); the log keeps tiny values of u apart.
+func rotateTail(items []ScoredItem, limit int, seedKey string, date time.Time) []ScoredItem {
+	if len(items) <= limit || limit <= rotationMaxPinned {
+		return items
+	}
+	pin := min(rotationMaxPinned, limit/2)
+	take := limit - pin
+	end := min(rotationReach(limit), len(items))
+	day := date.UTC().Format(time.DateOnly)
+
+	keys := make([]float64, end-pin)
+	order := make([]int, end-pin)
+	for i := range order {
+		order[i] = i
+		keys[i] = math.Log(rotationUniform(seedKey, day, items[pin+i].MediaItemID)) * float64(i+rotationRankOffset)
+	}
+	slices.SortStableFunc(order, func(a, b int) int { return cmp.Compare(keys[b], keys[a]) })
+	drawn := make([]bool, end-pin)
+	for _, i := range order[:take] {
+		drawn[i] = true
+	}
+
+	out := make([]ScoredItem, 0, len(items))
+	out = append(out, items[:pin]...)
+	for _, keep := range []bool{true, false} {
+		for i, item := range items[pin:end] {
+			if drawn[i] == keep {
+				out = append(out, item)
+			}
+		}
+	}
+	return append(out, items[end:]...)
+}
+
+// rotationReach is how far into a row rotateTail draws a window of limit
+// items from: every item it can serve is among the row's first
+// rotationReach(limit).
+func rotationReach(limit int) int {
+	if limit <= rotationMaxPinned {
+		return limit
+	}
+	pin := min(rotationMaxPinned, limit/2)
+	return pin + 2*(limit-pin)
+}
+
+// rotationUniform maps the seed, day and item to a number in (0, 1), from
+// the first 8 bytes of their SHA-256.
+func rotationUniform(seedKey, day, itemID string) float64 {
+	sum := sha256.Sum256([]byte(seedKey + "|" + day + "|" + itemID))
+	bits := binary.BigEndian.Uint64(sum[:8]) >> 11
+	return (float64(bits) + 0.5) / (1 << 53)
+}
+
+// rotatePersonalRows rotates the read's personal rows, the main row and the
+// cluster rows, for a served window of ServedRowSize items and the server's
+// current day. Every other row keeps its order.
+func (rr *rowRead) rotatePersonalRows(rows []ForYouRow) []ForYouRow {
+	date := rr.reader.today()
+	for i := range rows {
+		if key := rows[i].personalKey; key != "" {
+			rows[i].Items = rotateTail(rows[i].Items, ServedRowSize, rotationSeedKey(rr.userID, rr.profileID, key), date)
+		}
+	}
+	return rows
+}
diff --git a/internal/recommendations/rotation_test.go b/internal/recommendations/rotation_test.go
new file mode 100644
index 0000000000..a2fee58a88
--- /dev/null
+++ b/internal/recommendations/rotation_test.go
@@ -0,0 +1,261 @@
+package recommendations
+
+import (
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+)
+
+var (
+	rotationDay  = time.Date(2026, 10, 1, 9, 0, 0, 0, time.UTC)
+	rotationSeed = rotationSeedKey(7, "p1", RecTypeForYouMain)
+)
+
+// position maps each item of items to its index.
+func position(items []ScoredItem) map[string]int {
+	at := make(map[string]int, len(items))
+	for i, item := range items {
+		at[item.MediaItemID] = i
+	}
+	return at
+}
+
+// A rotation keeps the head, draws the rest of the served window from the
+// next ranks in rank order, and loses no item; it is the same all day.
+func TestRotateTailKeepsTheHeadAndDrawsFromTheNextRanks(t *testing.T) {
+	items := scoredRun("m", CacheCandidateLimit)
+	input := slices.Clone(items)
+	for _, tc := range []struct{ limit, pin, end int }{
+		{20, 10, 30},
+		{12, 6, 18},
+		{50, 10, CacheCandidateLimit},
+	} {
+		got := rotateTail(items, tc.limit, rotationSeed, rotationDay)
+		if !slices.Equal(got[:tc.pin], items[:tc.pin]) {
+			t.Fatalf("limit %d: head %v, want the first %d unchanged", tc.limit, scoredIDs(got[:tc.pin]), tc.pin)
+		}
+		was := position(items)
+		last := -1
+		for _, item := range got[tc.pin:tc.limit] {
+			at := was[item.MediaItemID]
+			if at < tc.pin || at >= tc.end {
+				t.Fatalf("limit %d: drew %s from rank %d, outside %d-%d", tc.limit, item.MediaItemID, at, tc.pin, tc.end-1)
+			}
+			if at <= last {
+				t.Fatalf("limit %d: draws %v are not in rank order", tc.limit, scoredIDs(got[tc.pin:tc.limit]))
+			}
+			last = at
+		}
+		if !slices.Equal(slices.Sorted(slices.Values(scoredIDs(got))), scoredIDs(items)) {
+			t.Fatalf("limit %d: rotation lost or repeated items: %v", tc.limit, scoredIDs(got))
+		}
+		if later := rotateTail(items, tc.limit, rotationSeed, rotationDay.Add(14*time.Hour)); !slices.Equal(later, got) {
+			t.Fatalf("limit %d: the rotation changed within the day", tc.limit)
+		}
+	}
+	if !slices.Equal(items, input) {
+		t.Fatal("rotateTail changed its input")
+	}
+}
+
+// A row no longer than the window, or a window of at most ten, is served in
+// rank order.
+func TestRotateTailLeavesShortRowsAndSmallWindowsAlone(t *testing.T) {
+	items := scoredRun("m", CacheCandidateLimit)
+	for _, tc := range []struct {
+		items []ScoredItem
+		limit int
+	}{
+		{items, 10},
+		{items, 5},
+		{items[:20], 20},
+		{items[:15], 20},
+		{items, CacheCandidateLimit},
+	} {
+		if got := rotateTail(tc.items, tc.limit, rotationSeed, rotationDay); !slices.Equal(got, tc.items) {
+			t.Fatalf("%d items, limit %d: rotated to %v", len(tc.items), tc.limit, scoredIDs(got))
+		}
+	}
+}
+
+// Each day draws its own tail, and so do other profiles and rows: on a
+// 60-item row at least 2 of the 20 served change from day to day, and a
+// title two rows share is drawn independently in each.
+func TestRotateTailChangesDailyAndPerRow(t *testing.T) {
+	items := scoredRun("m", CacheCandidateLimit)
+	served := func(seed string, day time.Time) []string {
+		return scoredIDs(rotateTail(items, ServedRowSize, seed, day)[:ServedRowSize])
+	}
+	changed := func(a, b []string) int {
+		n := 0
+		for _, id := range a {
+			if !slices.Contains(b, id) {
+				n++
+			}
+		}
+		return n
+	}
+	today := served(rotationSeed, rotationDay)
+	for d := 1; d <= 14; d++ {
+		next := served(rotationSeed, rotationDay.AddDate(0, 0, d))
+		if n := changed(today, next); n < 2 {
+			t.Fatalf("day +%d changes %d of %d served items, want at least 2", d, n, ServedRowSize)
+		}
+		if !slices.Equal(today[:rotationMaxPinned], next[:rotationMaxPinned]) {
+			t.Fatalf("day +%d moved the pinned head", d)
+		}
+	}
+	for _, seed := range []string{
+		rotationSeedKey(8, "p1", RecTypeForYouMain),
+		rotationSeedKey(7, "p2", RecTypeForYouMain),
+		rotationSeedKey(7, "p1", RecTypeForYouClusterPrefix+"0"),
+	} {
+		if slices.Equal(served(seed, rotationDay), today) {
+			t.Fatalf("seed %q draws the same tail as %q", seed, rotationSeed)
+		}
+	}
+}
+
+// Reads rotate the main row and the cluster rows, the same way all day and
+// on every node, and leave Because You Watched and the global rows in rank
+// order. The section read and a "see all" page rotate like the page and keep
+// the whole pool, so "see all" opens with the titles the row showed.
+func TestReadsRotateOnlyThePersonalRows(t *testing.T) {
+	pool := scoredRun("m", CacheCandidateLimit)
+	cluster := scoredRun("c", CacheCandidateLimit)
+	for i := range cluster {
+		cluster[i].Reason = clusterTitle("Drama")
+	}
+	popular := scoredRun("pop", CacheCandidateLimit)
+	repo := &fakeReaderRepo{
+		meta:     &TasteProfileMeta{SignalCounts: map[string]int{signalCountPositiveTitles: ColdStartFullPersonalized}},
+		clusters: []TasteCluster{{ClusterIdx: 0, Label: "Drama", TotalWeight: 1}},
+		personal: map[string][]ScoredItem{
+			RecTypeForYouMain + "|":                pool,
+			RecTypeForYouClusterPrefix + "0" + "|": cluster,
+			RecTypeBecauseWatched + "|anchor":      scoredRun("b", CacheCandidateLimit),
+		},
+		global: map[string][]ScoredItem{RecTypePopular: popular},
+	}
+	reader := func(at time.Time) *Reader {
+		return &Reader{
+			repo:    repo,
+			signals: NewSignalReader(&fakeSignalRepo{fallbackRecentCompleted: []string{"anchor"}}, nil),
+			now:     func() time.Time { return at },
+		}
+	}
+	ctx := t.Context()
+	page := func(r *Reader) map[string][]string {
+		rows, err := r.GetForYouPage(ctx, 7, "p1", ServedRowSize, catalog.AccessFilter{})
+		if err != nil {
+			t.Fatal(err)
+		}
+		out := map[string][]string{}
+		for _, row := range rows {
+			out[row.Label] = scoredIDs(row.Items)
+		}
+		return out
+	}
+
+	morning, evening, tomorrow := page(reader(rotationDay)), page(reader(rotationDay.Add(12*time.Hour))), page(reader(rotationDay.AddDate(0, 0, 1)))
+	for label, ranked := range map[string][]ScoredItem{ForYouLabel: pool, clusterTitle("Drama"): cluster} {
+		if slices.Equal(morning[label], scoredIDs(ranked[:ServedRowSize])) {
+			t.Fatalf("%s served in rank order, want it rotated", label)
+		}
+		if !slices.Equal(morning[label], evening[label]) {
+			t.Fatalf("%s rotated differently within the day", label)
+		}
+		if slices.Equal(morning[label], tomorrow[label]) {
+			t.Fatalf("%s served the same rotation the next day", label)
+		}
+	}
+	if !slices.Equal(morning[popularLabel], scoredIDs(popular[:ServedRowSize])) {
+		t.Fatalf("Popular = %v, want rank order", morning[popularLabel])
+	}
+
+	r := reader(rotationDay)
+	byw, err := r.GetBecauseYouWatchedRows(ctx, 7, "p1", 1, ServedRowSize, catalog.AccessFilter{})
+	if err != nil || len(byw) != 1 || !slices.Equal(scoredIDs(byw[0].Items), scoredIDs(scoredRun("b", ServedRowSize))) {
+		t.Fatalf("Because You Watched = %+v, %v; want rank order", byw, err)
+	}
+	section, err := r.SectionForYouMain(ctx, 7, "p1", catalog.AccessFilter{})
+	if err != nil || section == nil || !slices.Equal(scoredIDs(section.Items[:ServedRowSize]), morning[ForYouLabel]) || len(section.Items) != CacheCandidateLimit {
+		t.Fatalf("section row = %v, %v; want the page's rotation and the whole pool", section, err)
+	}
+	for kind, key := range map[string]string{SectionKindForYouMain: "", SectionKindCluster: "0"} {
+		label := map[string]string{SectionKindForYouMain: ForYouLabel, SectionKindCluster: clusterTitle("Drama")}[kind]
+		seeAll, err := r.GetSection(ctx, 7, "p1", kind, key, CacheCandidateLimit, catalog.AccessFilter{})
+		if err != nil || seeAll == nil || len(seeAll.Items) != CacheCandidateLimit || !slices.Equal(scoredIDs(seeAll.Items[:ServedRowSize]), morning[label]) {
+			t.Fatalf("see all %s = %v, %v; want the page's rotation and the whole pool", kind, seeAll, err)
+		}
+	}
+}
+
+// A page of any limit serves each personal row in the order its see-all
+// page opens with: the served window is ServedRowSize whatever the limit, so
+// a shorter page is a prefix of it and a longer one continues it.
+func TestPagesOfAnyLimitMatchTheSeeAllOrder(t *testing.T) {
+	pool := scoredRun("m", CacheCandidateLimit)
+	cluster := scoredRun("c", CacheCandidateLimit)
+	for i := range cluster {
+		cluster[i].Reason = clusterTitle("Drama")
+	}
+	r := &Reader{
+		repo: &fakeReaderRepo{
+			meta:     &TasteProfileMeta{SignalCounts: map[string]int{signalCountPositiveTitles: ColdStartFullPersonalized}},
+			clusters: []TasteCluster{{ClusterIdx: 0, Label: "Drama", TotalWeight: 1}},
+			personal: map[string][]ScoredItem{
+				RecTypeForYouMain + "|":                pool,
+				RecTypeForYouClusterPrefix + "0" + "|": cluster,
+			},
+		},
+		signals: NewSignalReader(&fakeSignalRepo{}, nil),
+		now:     func() time.Time { return rotationDay },
+	}
+	ctx := t.Context()
+	seeAll := map[string][]string{}
+	for kind, label := range map[string]string{SectionKindForYouMain: ForYouLabel, SectionKindCluster: clusterTitle("Drama")} {
+		key := map[string]string{SectionKindForYouMain: "", SectionKindCluster: "0"}[kind]
+		row, err := r.GetSection(ctx, 7, "p1", kind, key, CacheCandidateLimit, catalog.AccessFilter{})
+		if err != nil || row == nil {
+			t.Fatalf("see all %s = %v, %v", kind, row, err)
+		}
+		seeAll[label] = scoredIDs(row.Items)
+	}
+	for _, limit := range []int{10, 15, ServedRowSize, 30} {
+		rows, err := r.GetForYouPage(ctx, 7, "p1", limit, catalog.AccessFilter{})
+		if err != nil {
+			t.Fatal(err)
+		}
+		if len(rows) != 2 {
+			t.Fatalf("limit %d: rows = %v, want the main and cluster rows", limit, rowLabels(rows))
+		}
+		for _, row := range rows {
+			if got := scoredIDs(row.Items); !slices.Equal(got, seeAll[row.Label][:limit]) {
+				t.Fatalf("limit %d: %s = %v, want the see-all page's first %d %v", limit, row.Label, got, limit, seeAll[row.Label][:limit])
+			}
+		}
+	}
+}
+
+// The rotation follows the UTC date, so servers in different time zones
+// serve the same window at the same moment, even where their local dates
+// differ.
+func TestRotateTailIsTheSameInEveryTimeZone(t *testing.T) {
+	items := scoredRun("m", CacheCandidateLimit)
+	// 23:30 UTC is already the next day in Tokyo and still the same day in
+	// Los Angeles.
+	at := time.Date(2026, 10, 1, 23, 30, 0, 0, time.UTC)
+	want := rotateTail(items, ServedRowSize, rotationSeed, at)
+	for _, zone := range []string{"Asia/Tokyo", "America/Los_Angeles"} {
+		loc, err := time.LoadLocation(zone)
+		if err != nil {
+			t.Skipf("time zone data unavailable: %v", err)
+		}
+		if got := rotateTail(items, ServedRowSize, rotationSeed, at.In(loc)); !slices.Equal(got, want) {
+			t.Fatalf("%s served %v, want the UTC rotation %v", zone, scoredIDs(got), scoredIDs(want))
+		}
+	}
+}
diff --git a/internal/recommendations/signals.go b/internal/recommendations/signals.go
index 00007b50e8..6372d94c3f 100644
--- a/internal/recommendations/signals.go
+++ b/internal/recommendations/signals.go
@@ -3,9 +3,13 @@ package recommendations
 import (
 	"context"
 	"fmt"
+	"maps"
+	"slices"
 	"sort"
+	"sync"
 	"time"
 
+	"github.com/prairie-server/prairie-server/internal/catalog"
 	"github.com/prairie-server/prairie-server/internal/userstore"
 )
 
@@ -13,12 +17,16 @@ const signalPageSize = 1000
 
 type signalRepo interface {
 	GetWatchedItemIDSet(ctx context.Context, userID int, profileID string) (map[string]struct{}, error)
+	GetFavoriteItemIDs(ctx context.Context, userID int, profileID string) ([]string, error)
+	GetNotInterestedMarks(ctx context.Context, userID int, profileID string) ([]NotInterestedMark, error)
 	GetWatchProgressForUser(ctx context.Context, userID int, profileID string) ([]WatchProgressRow, error)
 	GetEbookReaderProgressForUser(ctx context.Context, userID int, profileID string) ([]WatchProgressRow, error)
 	GetRecentCompletedItemIDs(ctx context.Context, userID int, profileID string, limit int) ([]string, error)
 	GetRewatchCounts(ctx context.Context, userID int, profileID string) ([]RewatchCount, error)
 	ResolveCanonicalItemIDs(ctx context.Context, contentIDs []string) (map[string]string, error)
 	ResolveCanonicalItemIDSet(ctx context.Context, contentIDs []string) (map[string]struct{}, error)
+	RecommendableItemIDs(ctx context.Context, itemIDs []string) (map[string]struct{}, error)
+	HasSignalRows(ctx context.Context, userID int, profileID string, includeStoreTables bool) (bool, error)
 }
 
 // SignalReader centralizes profile-scoped recommendation signals. userstore is
@@ -27,6 +35,10 @@ type signalRepo interface {
 type SignalReader struct {
 	repo          signalRepo
 	storeProvider userstore.UserStoreProvider
+	// storeOutsidePostgres marks a user store that keeps watch progress,
+	// favorites and watchlist outside the Postgres tables (the SQLite
+	// backend), so checks that would query those tables ask the store.
+	storeOutsidePostgres bool
 }
 
 func NewSignalReader(repo signalRepo, storeProvider userstore.UserStoreProvider) *SignalReader {
@@ -51,7 +63,94 @@ func (s *SignalReader) storeForUser(ctx context.Context, userID int) (userstore.
 	return store, true, nil
 }
 
+// storeIsSeparate reports whether the profile signals the user store holds
+// live outside the Postgres tables.
+func (s *SignalReader) storeIsSeparate() bool {
+	return s != nil && s.storeProvider != nil && s.storeOutsidePostgres
+}
+
+// HasSignals reports whether the profile has anything a taste profile is
+// built from: a rating, favorite, watchlist entry, or watch or reading
+// progress. It checks existence only, so it stays cheap on every read.
+func (s *SignalReader) HasSignals(ctx context.Context, userID int, profileID string) (bool, error) {
+	separate := s.storeIsSeparate()
+	found, err := s.repo.HasSignalRows(ctx, userID, profileID, !separate)
+	if err != nil || found || !separate {
+		return found, err
+	}
+	store, ok, err := s.storeForUser(ctx, userID)
+	if err != nil || !ok {
+		return false, err
+	}
+	favorites, err := store.ListFavorites(ctx, profileID, 1, 0)
+	if err != nil {
+		return false, fmt.Errorf("list favorites from store: %w", err)
+	}
+	if len(favorites) > 0 {
+		return true, nil
+	}
+	watchlist, err := store.ListWatchlist(ctx, profileID, 1, 0)
+	if err != nil {
+		return false, fmt.Errorf("list watchlist from store: %w", err)
+	}
+	if len(watchlist) > 0 {
+		return true, nil
+	}
+	progress, err := store.ListProgress(ctx, profileID, "all", 1, 0)
+	if err != nil {
+		return false, fmt.Errorf("list progress from store: %w", err)
+	}
+	return len(progress) > 0, nil
+}
+
+// watchedSetMemoKey keys the context value WithWatchedSetMemo installs.
+type watchedSetMemoKey struct{}
+
+// watchedSetMemo holds the watched sets read under one context, by account
+// and profile.
+type watchedSetMemo struct {
+	mu   sync.Mutex
+	sets map[watchedSetMemoProfile]map[string]struct{}
+}
+
+type watchedSetMemoProfile struct {
+	userID    int
+	profileID string
+}
+
+// WithWatchedSetMemo returns ctx carrying a memo for WatchedItemIDSet: under
+// it, a profile's watched set is read once however many SignalReaders ask,
+// so one request that filters rows and then blends airings walks the
+// profile's history once. A set read through the memo is shared and must not
+// be modified.
+func WithWatchedSetMemo(ctx context.Context) context.Context {
+	return context.WithValue(ctx, watchedSetMemoKey{}, &watchedSetMemo{sets: map[watchedSetMemoProfile]map[string]struct{}{}})
+}
+
+// WatchedItemIDSet returns the canonical IDs of the titles the profile has
+// watched: progress completed or at least half way, episodes counting for
+// their series, plus finished ebooks. Under WithWatchedSetMemo it reuses the
+// set read earlier for the profile.
 func (s *SignalReader) WatchedItemIDSet(ctx context.Context, userID int, profileID string) (map[string]struct{}, error) {
+	memo, _ := ctx.Value(watchedSetMemoKey{}).(*watchedSetMemo)
+	if memo == nil {
+		return s.readWatchedItemIDSet(ctx, userID, profileID)
+	}
+	key := watchedSetMemoProfile{userID, profileID}
+	memo.mu.Lock()
+	defer memo.mu.Unlock()
+	if set, ok := memo.sets[key]; ok {
+		return set, nil
+	}
+	set, err := s.readWatchedItemIDSet(ctx, userID, profileID)
+	if err != nil {
+		return nil, err
+	}
+	memo.sets[key] = set
+	return set, nil
+}
+
+func (s *SignalReader) readWatchedItemIDSet(ctx context.Context, userID int, profileID string) (map[string]struct{}, error) {
 	store, ok, err := s.storeForUser(ctx, userID)
 	if err != nil {
 		return nil, err
@@ -84,6 +183,179 @@ func (s *SignalReader) WatchedItemIDSet(ctx context.Context, userID int, profile
 	return s.repo.ResolveCanonicalItemIDSet(ctx, rawIDs)
 }
 
+// RecommendationExclusionSet returns the canonical IDs the profile's
+// recommendations leave out: the watched set, the profile's favorites, which
+// include its taste-seed picks, and the titles it marked Not interested. A
+// favorited episode excludes its series, as a watched one does. Watchlist
+// titles stay recommendable.
+func (s *SignalReader) RecommendationExclusionSet(ctx context.Context, userID int, profileID string) (map[string]struct{}, error) {
+	excluded, err := s.WatchedItemIDSet(ctx, userID, profileID)
+	if err != nil {
+		return nil, err
+	}
+	favoriteIDs, err := s.favoriteItemIDs(ctx, userID, profileID)
+	if err != nil {
+		return nil, err
+	}
+	favorites, err := s.repo.ResolveCanonicalItemIDSet(ctx, favoriteIDs)
+	if err != nil {
+		return nil, fmt.Errorf("resolve favorite item IDs: %w", err)
+	}
+	marks, err := s.NotInterestedMarks(ctx, userID, profileID)
+	if err != nil {
+		return nil, err
+	}
+	merged := make(map[string]struct{}, len(excluded)+len(favorites)+len(marks))
+	for id := range excluded {
+		merged[id] = struct{}{}
+	}
+	for id := range favorites {
+		merged[id] = struct{}{}
+	}
+	// Marks are kept to movies and series, already canonical.
+	for _, mark := range marks {
+		merged[mark.MediaItemID] = struct{}{}
+	}
+	return merged, nil
+}
+
+// NotInterestedMark is a movie or series the profile marked Not interested,
+// and when.
+type NotInterestedMark struct {
+	MediaItemID string
+	MarkedAt    time.Time
+}
+
+// NotInterestedMarks lists every title the profile marked Not interested,
+// newest first.
+func (s *SignalReader) NotInterestedMarks(ctx context.Context, userID int, profileID string) ([]NotInterestedMark, error) {
+	store, ok, err := s.storeForUser(ctx, userID)
+	if err != nil {
+		return nil, err
+	}
+	if !ok {
+		return s.repo.GetNotInterestedMarks(ctx, userID, profileID)
+	}
+
+	var marks []NotInterestedMark
+	var after *userstore.ListKey
+	for {
+		page, err := store.ListNotInterestedPage(ctx, profileID, after, signalPageSize)
+		if err != nil {
+			return nil, fmt.Errorf("list not interested marks from store: %w", err)
+		}
+		for _, e := range page {
+			marks = append(marks, NotInterestedMark{MediaItemID: e.MediaItemID, MarkedAt: parseSignalTime(e.AddedAt, time.Time{})})
+		}
+		if len(page) < signalPageSize {
+			return marks, nil
+		}
+		last := page[len(page)-1]
+		after = &userstore.ListKey{AddedAt: last.AddedAt, MediaItemID: last.MediaItemID}
+	}
+}
+
+// ratedItemLister lists every rating of a profile. *catalog.RatingsRepo
+// implements it.
+type ratedItemLister interface {
+	ListAll(ctx context.Context, userID int, profileID string) ([]catalog.UserRating, error)
+}
+
+// BuildExclusionSet returns the canonical IDs the rows built for the profile
+// leave out: RecommendationExclusionSet, every title the profile rated, as
+// SimilarUsersLiked leaves out, and every title it abandoned by now (see
+// AbandonedItemIDs). A title the profile already judged is not news to it,
+// and one it rated well would otherwise lead its own row, being nearest the
+// taste vector it weighs most in. With no ratings lister rated titles stay.
+func (s *SignalReader) BuildExclusionSet(ctx context.Context, ratings ratedItemLister, userID int, profileID string, now time.Time) (map[string]struct{}, error) {
+	excluded, err := s.RecommendationExclusionSet(ctx, userID, profileID)
+	if err != nil {
+		return nil, err
+	}
+	abandoned, err := s.AbandonedItemIDs(ctx, userID, profileID, now)
+	if err != nil {
+		return nil, fmt.Errorf("read abandoned titles: %w", err)
+	}
+	maps.Copy(excluded, abandoned)
+	if ratings == nil {
+		return excluded, nil
+	}
+	rated, err := ratings.ListAll(ctx, userID, profileID)
+	if err != nil {
+		return nil, fmt.Errorf("list rated titles: %w", err)
+	}
+	ratedIDs := make([]string, len(rated))
+	for i, rating := range rated {
+		ratedIDs[i] = rating.MediaItemID
+	}
+	canonical, err := s.canonicalRatedItemIDs(ctx, ratedIDs)
+	if err != nil {
+		return nil, err
+	}
+	maps.Copy(excluded, canonical)
+	return excluded, nil
+}
+
+// canonicalRatedItemIDs resolves the IDs of rated titles to the canonical IDs
+// rows hold: a rated episode stands for its series, as a watched one does.
+func (s *SignalReader) canonicalRatedItemIDs(ctx context.Context, ratedIDs []string) (map[string]struct{}, error) {
+	canonical, err := s.repo.ResolveCanonicalItemIDSet(ctx, ratedIDs)
+	if err != nil {
+		return nil, fmt.Errorf("resolve rated item IDs: %w", err)
+	}
+	return canonical, nil
+}
+
+// AbandonedItemIDs returns the canonical IDs of the titles the profile
+// abandoned by now: progress below lowProgressThreshold left untouched for
+// abandonedProgressAge, which its taste profile counts as a dislike (see
+// implicitWatchWeight). An abandoned episode stands for its series, as a
+// watched one does.
+func (s *SignalReader) AbandonedItemIDs(ctx context.Context, userID int, profileID string, now time.Time) (map[string]struct{}, error) {
+	progress, err := s.WatchProgressForUser(ctx, userID, profileID)
+	if err != nil {
+		return nil, err
+	}
+	var ids []string
+	for _, wp := range progress {
+		if weight, ok := implicitWatchWeight(wp, now); ok && weight == WeightWatchLow {
+			ids = append(ids, wp.MediaItemID)
+		}
+	}
+	if len(ids) == 0 {
+		return map[string]struct{}{}, nil
+	}
+	return s.repo.ResolveCanonicalItemIDSet(ctx, ids)
+}
+
+// favoriteItemIDs lists every content ID the profile has favorited.
+func (s *SignalReader) favoriteItemIDs(ctx context.Context, userID int, profileID string) ([]string, error) {
+	store, ok, err := s.storeForUser(ctx, userID)
+	if err != nil {
+		return nil, err
+	}
+	if !ok {
+		return s.repo.GetFavoriteItemIDs(ctx, userID, profileID)
+	}
+
+	var ids []string
+	var after *userstore.ListKey
+	for {
+		page, err := store.ListFavoritesPage(ctx, profileID, after, signalPageSize)
+		if err != nil {
+			return nil, fmt.Errorf("list favorites from store: %w", err)
+		}
+		for _, f := range page {
+			ids = append(ids, f.MediaItemID)
+		}
+		if len(page) < signalPageSize {
+			return ids, nil
+		}
+		last := page[len(page)-1]
+		after = &userstore.ListKey{AddedAt: last.AddedAt, MediaItemID: last.MediaItemID}
+	}
+}
+
 func (s *SignalReader) WatchProgressForUser(ctx context.Context, userID int, profileID string) ([]WatchProgressRow, error) {
 	store, ok, err := s.storeForUser(ctx, userID)
 	if err != nil {
@@ -117,6 +389,11 @@ func (s *SignalReader) WatchProgressForUser(ctx context.Context, userID int, pro
 	return rows, nil
 }
 
+// RecentCompletedItemIDs returns the canonical IDs of the profile's most
+// recently completed titles that are still in the catalog and of
+// recommendableMediaTypes, newest first. Completions of deleted items and of
+// other types, such as a finished audiobook, are skipped, so they never
+// become anchors.
 func (s *SignalReader) RecentCompletedItemIDs(ctx context.Context, userID int, profileID string, limit int) ([]string, error) {
 	if limit <= 0 {
 		return []string{}, nil
@@ -140,7 +417,8 @@ func (s *SignalReader) RecentCompletedItemIDs(ctx context.Context, userID int, p
 			candidates = append(candidates, wp)
 		}
 	}
-	if err := canonicalizeCompletedRows(ctx, s.repo, candidates); err != nil {
+	candidates, err = liveCompletedRows(ctx, s.repo, candidates)
+	if err != nil {
 		return nil, fmt.Errorf("resolve recent completed item IDs: %w", err)
 	}
 	candidates = recentDistinctCompletedRows(candidates, limit)
@@ -168,7 +446,8 @@ func (s *SignalReader) RecentCompletedItemIDs(ctx context.Context, userID int, p
 				oldestPageTime = updatedAt
 			}
 		}
-		if err := canonicalizeCompletedRows(ctx, s.repo, page); err != nil {
+		page, err = liveCompletedRows(ctx, s.repo, page)
+		if err != nil {
 			return nil, fmt.Errorf("resolve recent completed item IDs: %w", err)
 		}
 		candidates = recentDistinctCompletedRows(append(candidates, page...), limit)
@@ -193,6 +472,69 @@ func (s *SignalReader) RecentCompletedItemIDs(ctx context.Context, userID int, p
 	return ids, nil
 }
 
+// Because You Watched anchors on the profile's latest completions.
+const (
+	// BecauseYouWatchedAnchors is how many anchors a profile's Because You
+	// Watched rows are built and read for.
+	BecauseYouWatchedAnchors = 3
+	// anchorCandidateLimit is how many of the latest completions the anchors
+	// are chosen from, so disliked ones can be passed over.
+	anchorCandidateLimit = 10
+)
+
+// itemRatingReader reads a profile's star ratings of the given items, keyed
+// by item. *catalog.RatingsRepo implements it.
+type itemRatingReader interface {
+	ListForItems(ctx context.Context, userID int, profileID string, itemIDs []string) (map[string]int, error)
+}
+
+// anchorItemIDs returns up to n Because You Watched anchors for the profile:
+// its most recently completed titles of recommendableMediaTypes still in the
+// catalog, newest first, of the latest anchorCandidateLimit, leaving out
+// those it marked Not interested or rated DislikedRatingMax or lower. A row
+// headed "Because You Watched" a title the profile disliked contradicts its
+// taste. With no ratings reader rated titles stay. The worker, the Reader and Watch
+// Tonight all choose anchors here, since a read can only use an anchor whose
+// row the worker cached.
+func anchorItemIDs(ctx context.Context, signals *SignalReader, ratings itemRatingReader, userID int, profileID string, n int) ([]string, error) {
+	if n <= 0 {
+		return []string{}, nil
+	}
+	recent, err := signals.RecentCompletedItemIDs(ctx, userID, profileID, max(n, anchorCandidateLimit))
+	if err != nil {
+		return nil, err
+	}
+	if len(recent) > 0 {
+		marks, err := signals.NotInterestedMarks(ctx, userID, profileID)
+		if err != nil {
+			return nil, fmt.Errorf("read not interested marks: %w", err)
+		}
+		marked := make(map[string]struct{}, len(marks))
+		for _, m := range marks {
+			marked[m.MediaItemID] = struct{}{}
+		}
+		recent = slices.DeleteFunc(slices.Clone(recent), func(id string) bool {
+			_, ok := marked[id]
+			return ok
+		})
+	}
+	if ratings != nil && len(recent) > 0 {
+		rated, err := ratings.ListForItems(ctx, userID, profileID, recent)
+		if err != nil {
+			return nil, fmt.Errorf("read ratings of recent completions: %w", err)
+		}
+		liked := make([]string, 0, len(recent))
+		for _, id := range recent {
+			if rating, ok := rated[id]; ok && rating <= DislikedRatingMax {
+				continue
+			}
+			liked = append(liked, id)
+		}
+		recent = liked
+	}
+	return recent[:min(n, len(recent))], nil
+}
+
 func canonicalizeCompletedRows(ctx context.Context, repo signalRepo, rows []WatchProgressRow) error {
 	ids := make([]string, 0, len(rows))
 	for _, row := range rows {
@@ -210,6 +552,34 @@ func canonicalizeCompletedRows(ctx context.Context, repo signalRepo, rows []Watc
 	return nil
 }
 
+// liveCompletedRows canonicalizes rows and drops those whose canonical ID is
+// no longer in the catalog (a deleted movie, or an episode whose series was
+// deleted and so no longer resolves to it) or is not of
+// recommendableMediaTypes.
+func liveCompletedRows(ctx context.Context, repo signalRepo, rows []WatchProgressRow) ([]WatchProgressRow, error) {
+	if len(rows) == 0 {
+		return rows, nil
+	}
+	if err := canonicalizeCompletedRows(ctx, repo, rows); err != nil {
+		return nil, err
+	}
+	ids := make([]string, len(rows))
+	for i, row := range rows {
+		ids[i] = row.MediaItemID
+	}
+	existing, err := repo.RecommendableItemIDs(ctx, ids)
+	if err != nil {
+		return nil, err
+	}
+	live := rows[:0]
+	for _, row := range rows {
+		if _, ok := existing[row.MediaItemID]; ok {
+			live = append(live, row)
+		}
+	}
+	return live, nil
+}
+
 func recentDistinctCompletedRows(rows []WatchProgressRow, limit int) []WatchProgressRow {
 	sort.SliceStable(rows, func(i, j int) bool {
 		if !rows[i].UpdatedAt.Equal(rows[j].UpdatedAt) {
@@ -285,10 +655,14 @@ func (s *SignalReader) RewatchCounts(ctx context.Context, userID int, profileID
 	return result, nil
 }
 
+// pageProgress visits the profile's progress rows with the given status a
+// page at a time, newest first. It pages by keyset, so no row is read twice.
+// A row updated while the walk runs moves ahead of the cursor and is not
+// visited; the change that updated it queues a refresh of its own.
 func pageProgress(ctx context.Context, store userstore.UserStore, profileID, status string, visit func([]userstore.WatchProgress) error) error {
-	offset := 0
+	var after *userstore.ProgressKey
 	for {
-		progress, err := store.ListProgress(ctx, profileID, status, signalPageSize, offset)
+		progress, err := store.ListProgressPage(ctx, profileID, status, after, signalPageSize)
 		if err != nil {
 			return fmt.Errorf("list progress from store: %w", err)
 		}
@@ -298,7 +672,8 @@ func pageProgress(ctx context.Context, store userstore.UserStore, profileID, sta
 		if len(progress) < signalPageSize {
 			return nil
 		}
-		offset += len(progress)
+		last := progress[len(progress)-1]
+		after = &userstore.ProgressKey{UpdatedAt: last.UpdatedAt, MediaItemID: last.MediaItemID}
 	}
 }
 
diff --git a/internal/recommendations/signals_paging_test.go b/internal/recommendations/signals_paging_test.go
new file mode 100644
index 0000000000..b2e2d051a7
--- /dev/null
+++ b/internal/recommendations/signals_paging_test.go
@@ -0,0 +1,126 @@
+package recommendations
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/prairie-server/prairie-server/internal/userstore"
+)
+
+// Anchors are live catalog items: a deleted movie and an episode of a
+// deleted series (which no longer resolves to it) are passed over, also when
+// a full page of dead completions comes first.
+func TestRecentCompletedItemIDsSkipsDeletedItems(t *testing.T) {
+	at := func(minutesAgo int) string {
+		return time.Date(2026, 8, 10, 12, 0, 0, 0, time.UTC).Add(-time.Duration(minutesAgo) * time.Minute).Format(time.RFC3339)
+	}
+	completed := func(id string, minutesAgo int) userstore.WatchProgress {
+		return userstore.WatchProgress{ProfileID: "p1", MediaItemID: id, Completed: true, UpdatedAt: at(minutesAgo)}
+	}
+	missing := map[string]struct{}{"deleted-movie": {}, "orphan-episode": {}, "deleted-ebook": {}}
+
+	store := &fakeSignalStore{progress: []userstore.WatchProgress{
+		completed("deleted-movie", 1),
+		completed("orphan-episode", 2),
+		completed("live-b", 3),
+		completed("live-episode", 4),
+		completed("live-a", 5),
+		completed("live-older", 6),
+	}}
+	repo := &fakeSignalRepo{
+		canonical:     map[string]string{"live-episode": "live-series"},
+		missing:       missing,
+		ebookProgress: []WatchProgressRow{{MediaItemID: "deleted-ebook", Completed: true, UpdatedAt: time.Date(2026, 8, 10, 13, 0, 0, 0, time.UTC)}},
+	}
+	got, err := NewSignalReader(repo, fakeSignalProvider{store: store}).RecentCompletedItemIDs(t.Context(), 7, "p1", 3)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if want := []string{"live-b", "live-series", "live-a"}; !slices.Equal(got, want) {
+		t.Fatalf("anchors = %v, want %v", got, want)
+	}
+
+	// More than a page of newer dead completions: paging goes on until it
+	// has three live anchors.
+	paged := &fakeSignalStore{}
+	for i := range signalPageSize + 5 {
+		id := fmt.Sprintf("dead-%04d", i)
+		missing[id] = struct{}{}
+		paged.progress = append(paged.progress, completed(id, 1))
+	}
+	paged.progress = append(paged.progress, completed("live-b", 3), completed("live-a", 5), completed("live-older", 6))
+	got, err = NewSignalReader(&fakeSignalRepo{missing: missing}, fakeSignalProvider{store: paged}).RecentCompletedItemIDs(t.Context(), 7, "p1", 3)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if want := []string{"live-b", "live-a", "live-older"}; !slices.Equal(got, want) {
+		t.Fatalf("anchors after a page of dead completions = %v, want %v", got, want)
+	}
+}
+
+// keysetOnlyStore fails the test if a progress walk falls back to offset
+// paging.
+type keysetOnlyStore struct {
+	*fakeSignalStore
+	t     *testing.T
+	pages int
+}
+
+func (s *keysetOnlyStore) ListProgress(context.Context, string, string, int, int) ([]userstore.WatchProgress, error) {
+	s.t.Fatal("progress read with offset paging")
+	return nil, nil
+}
+
+func (s *keysetOnlyStore) ListProgressPage(ctx context.Context, profileID, status string, after *userstore.ProgressKey, limit int) ([]userstore.WatchProgress, error) {
+	s.pages++
+	return s.fakeSignalStore.ListProgressPage(ctx, profileID, status, after, limit)
+}
+
+// The watched set walks progress by keyset across pages, counting every row
+// at least half watched, including rows tied on updated_at at a page edge.
+func TestWatchedItemIDSetPagesByKeyset(t *testing.T) {
+	const rows = 2*signalPageSize + 7
+	inner := &fakeSignalStore{}
+	want := map[string]struct{}{}
+	for i := range rows {
+		id := fmt.Sprintf("item-%05d", i)
+		// Ten rows share each timestamp, so page edges fall inside ties.
+		wp := userstore.WatchProgress{
+			ProfileID:       "p1",
+			MediaItemID:     id,
+			DurationSeconds: 100,
+			UpdatedAt:       time.Date(2026, 8, 10, 0, 0, 0, 0, time.UTC).Add(-time.Duration(i/10) * time.Second).Format(time.RFC3339),
+		}
+		switch i % 3 {
+		case 0:
+			wp.Completed = true
+			want[id] = struct{}{}
+		case 1:
+			wp.PositionSeconds = 60
+			want[id] = struct{}{}
+		default:
+			wp.PositionSeconds = 10
+		}
+		inner.progress = append(inner.progress, wp)
+	}
+	store := &keysetOnlyStore{fakeSignalStore: inner, t: t}
+
+	got, err := NewSignalReader(&fakeSignalRepo{}, fakeSignalProvider{store: store}).WatchedItemIDSet(t.Context(), 7, "p1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(got) != len(want) {
+		t.Fatalf("watched set has %d items, want %d", len(got), len(want))
+	}
+	for id := range want {
+		if _, ok := got[id]; !ok {
+			t.Fatalf("watched set misses %s", id)
+		}
+	}
+	if store.pages != 3 {
+		t.Fatalf("pages read = %d, want 3", store.pages)
+	}
+}
diff --git a/internal/recommendations/signals_test.go b/internal/recommendations/signals_test.go
index 31be603ff5..09985e02b0 100644
--- a/internal/recommendations/signals_test.go
+++ b/internal/recommendations/signals_test.go
@@ -3,10 +3,12 @@ package recommendations
 import (
 	"context"
 	"fmt"
+	"maps"
 	"slices"
 	"testing"
 	"time"
 
+	"github.com/prairie-server/prairie-server/internal/catalog"
 	"github.com/prairie-server/prairie-server/internal/userstore"
 )
 
@@ -14,16 +16,42 @@ type fakeSignalRepo struct {
 	canonical map[string]string
 
 	fallbackWatched         map[string]struct{}
+	watchedReads            int
+	fallbackFavorites       []string
+	fallbackMarks           []NotInterestedMark
 	fallbackProgress        []WatchProgressRow
 	ebookProgress           []WatchProgressRow
 	fallbackRecentCompleted []string
 	fallbackRewatches       []RewatchCount
+
+	// missing lists canonical IDs RecommendableItemIDs reports as deleted from
+	// the catalog; every other ID exists.
+	missing map[string]struct{}
+
+	// signalRows answers HasSignalRows, which records each call's
+	// includeStoreTables argument.
+	signalRows      bool
+	signalRowsCalls []bool
+}
+
+func (r *fakeSignalRepo) HasSignalRows(_ context.Context, _ int, _ string, includeStoreTables bool) (bool, error) {
+	r.signalRowsCalls = append(r.signalRowsCalls, includeStoreTables)
+	return r.signalRows, nil
 }
 
 func (r *fakeSignalRepo) GetWatchedItemIDSet(context.Context, int, string) (map[string]struct{}, error) {
+	r.watchedReads++
 	return r.fallbackWatched, nil
 }
 
+func (r *fakeSignalRepo) GetFavoriteItemIDs(context.Context, int, string) ([]string, error) {
+	return r.fallbackFavorites, nil
+}
+
+func (r *fakeSignalRepo) GetNotInterestedMarks(context.Context, int, string) ([]NotInterestedMark, error) {
+	return r.fallbackMarks, nil
+}
+
 func (r *fakeSignalRepo) GetWatchProgressForUser(context.Context, int, string) ([]WatchProgressRow, error) {
 	return r.fallbackProgress, nil
 }
@@ -32,8 +60,8 @@ func (r *fakeSignalRepo) GetEbookReaderProgressForUser(context.Context, int, str
 	return r.ebookProgress, nil
 }
 
-func (r *fakeSignalRepo) GetRecentCompletedItemIDs(context.Context, int, string, int) ([]string, error) {
-	return r.fallbackRecentCompleted, nil
+func (r *fakeSignalRepo) GetRecentCompletedItemIDs(_ context.Context, _ int, _ string, limit int) ([]string, error) {
+	return r.fallbackRecentCompleted[:min(limit, len(r.fallbackRecentCompleted))], nil
 }
 
 func (r *fakeSignalRepo) GetRewatchCounts(context.Context, int, string) ([]RewatchCount, error) {
@@ -64,6 +92,16 @@ func (r *fakeSignalRepo) ResolveCanonicalItemIDSet(ctx context.Context, contentI
 	return set, nil
 }
 
+func (r *fakeSignalRepo) RecommendableItemIDs(_ context.Context, itemIDs []string) (map[string]struct{}, error) {
+	existing := make(map[string]struct{}, len(itemIDs))
+	for _, id := range itemIDs {
+		if _, gone := r.missing[id]; !gone {
+			existing[id] = struct{}{}
+		}
+	}
+	return existing, nil
+}
+
 type fakeSignalProvider struct {
 	store userstore.UserStore
 }
@@ -79,9 +117,74 @@ func (p fakeSignalProvider) Close() error {
 type fakeSignalStore struct {
 	userstore.UserStore
 
-	progress []userstore.WatchProgress
-	history  []userstore.WatchHistoryEntry
-	profile  *userstore.Profile
+	progress  []userstore.WatchProgress
+	history   []userstore.WatchHistoryEntry
+	profile   *userstore.Profile
+	favorites []userstore.Favorite
+	watchlist []userstore.WatchlistEntry
+	marks     []userstore.NotInterestedEntry
+}
+
+// ListNotInterestedPage returns the profile's marks in one page, as stored.
+func (s *fakeSignalStore) ListNotInterestedPage(_ context.Context, profileID string, after *userstore.ListKey, limit int) ([]userstore.NotInterestedEntry, error) {
+	if after != nil {
+		return nil, nil
+	}
+	var rows []userstore.NotInterestedEntry
+	for _, m := range s.marks {
+		if m.ProfileID == profileID && len(rows) < limit {
+			rows = append(rows, m)
+		}
+	}
+	return rows, nil
+}
+
+func (s *fakeSignalStore) ListFavorites(_ context.Context, profileID string, limit, offset int) ([]userstore.Favorite, error) {
+	var rows []userstore.Favorite
+	for _, f := range s.favorites {
+		if f.ProfileID == profileID {
+			rows = append(rows, f)
+		}
+	}
+	return pageOf(rows, limit, offset), nil
+}
+
+// ListFavoritesPage pages the profile's favorites in stored order, keyed by
+// media item ID; the fake keeps no timestamps to order by.
+func (s *fakeSignalStore) ListFavoritesPage(_ context.Context, profileID string, after *userstore.ListKey, limit int) ([]userstore.Favorite, error) {
+	var rows []userstore.Favorite
+	started := after == nil
+	for _, f := range s.favorites {
+		if f.ProfileID != profileID {
+			continue
+		}
+		if !started {
+			started = f.MediaItemID == after.MediaItemID
+			continue
+		}
+		rows = append(rows, f)
+		if len(rows) == limit {
+			break
+		}
+	}
+	return rows, nil
+}
+
+func (s *fakeSignalStore) ListWatchlist(_ context.Context, profileID string, limit, offset int) ([]userstore.WatchlistEntry, error) {
+	var rows []userstore.WatchlistEntry
+	for _, w := range s.watchlist {
+		if w.ProfileID == profileID {
+			rows = append(rows, w)
+		}
+	}
+	return pageOf(rows, limit, offset), nil
+}
+
+func pageOf[T any](rows []T, limit, offset int) []T {
+	if offset >= len(rows) {
+		return nil
+	}
+	return rows[offset:min(offset+limit, len(rows))]
 }
 
 func (s *fakeSignalStore) ListProgress(_ context.Context, profileID, status string, limit, offset int) ([]userstore.WatchProgress, error) {
@@ -435,7 +538,10 @@ func TestProfileAccessFilterUsesStoredStableProfileRestrictions(t *testing.T) {
 	}}
 	engine := &Engine{storeProvider: fakeSignalProvider{store: store}}
 
-	filter := engine.profileAccessFilter(context.Background(), 7, "p1")
+	filter, err := engine.profileAccessFilter(context.Background(), 7, "p1")
+	if err != nil {
+		t.Fatalf("profileAccessFilter: %v", err)
+	}
 	if filter.UserID != 7 || filter.ProfileID != "p1" {
 		t.Fatalf("unexpected filter identity: %#v", filter)
 	}
@@ -474,3 +580,171 @@ func TestSignalReaderRecentCompletedResolvesTiesAcrossPages(t *testing.T) {
 		t.Fatalf("recent completed = %v, want %v", got, want)
 	}
 }
+
+// On the Postgres user store one query answers; on a store outside Postgres
+// the query covers only ratings and reading progress and the store is asked
+// for the rest.
+func TestSignalReaderHasSignals(t *testing.T) {
+	ctx := t.Context()
+	repo := &fakeSignalRepo{signalRows: true}
+	if has, err := NewSignalReader(repo, fakeSignalProvider{store: &fakeSignalStore{}}).HasSignals(ctx, 7, "p1"); err != nil || !has {
+		t.Fatalf("postgres store with signal rows: has=%v err=%v", has, err)
+	}
+	if len(repo.signalRowsCalls) != 1 || !repo.signalRowsCalls[0] {
+		t.Fatalf("signal row queries = %v, want one including the store tables", repo.signalRowsCalls)
+	}
+
+	for name, tc := range map[string]struct {
+		store *fakeSignalStore
+		want  bool
+	}{
+		"empty":     {&fakeSignalStore{favorites: []userstore.Favorite{{ProfileID: "other", MediaItemID: "m"}}}, false},
+		"favorite":  {&fakeSignalStore{favorites: []userstore.Favorite{{ProfileID: "p1", MediaItemID: "m"}}}, true},
+		"watchlist": {&fakeSignalStore{watchlist: []userstore.WatchlistEntry{{ProfileID: "p1", MediaItemID: "m"}}}, true},
+		"progress":  {&fakeSignalStore{progress: []userstore.WatchProgress{{ProfileID: "p1", MediaItemID: "m", PositionSeconds: 1, DurationSeconds: 100}}}, true},
+	} {
+		t.Run(name, func(t *testing.T) {
+			repo := &fakeSignalRepo{}
+			reader := NewSignalReader(repo, fakeSignalProvider{store: tc.store})
+			reader.storeOutsidePostgres = true
+			has, err := reader.HasSignals(ctx, 7, "p1")
+			if err != nil || has != tc.want {
+				t.Fatalf("has=%v err=%v, want %v", has, err, tc.want)
+			}
+			if len(repo.signalRowsCalls) != 1 || repo.signalRowsCalls[0] {
+				t.Fatalf("signal row queries = %v, want one without the store tables", repo.signalRowsCalls)
+			}
+		})
+	}
+}
+
+// The exclusion set is the watched set plus every favorite of the profile,
+// read across pages, with episodes resolved to their series. Watchlist
+// entries and in-progress titles are not in it.
+func TestSignalReaderRecommendationExclusionSet(t *testing.T) {
+	favorites := []userstore.Favorite{{ProfileID: "p1", MediaItemID: "episode-favorite"}}
+	for i := range signalPageSize {
+		favorites = append(favorites, userstore.Favorite{ProfileID: "p1", MediaItemID: fmt.Sprintf("seed-%04d", i)})
+	}
+	favorites = append(favorites, userstore.Favorite{ProfileID: "other", MediaItemID: "other-favorite"})
+	store := &fakeSignalStore{
+		progress: []userstore.WatchProgress{
+			{ProfileID: "p1", MediaItemID: "episode-watched", Completed: true},
+			{ProfileID: "p1", MediaItemID: "movie-started", PositionSeconds: 10, DurationSeconds: 100},
+		},
+		favorites: favorites,
+		watchlist: []userstore.WatchlistEntry{{ProfileID: "p1", MediaItemID: "movie-watchlist"}},
+	}
+	repo := &fakeSignalRepo{canonical: map[string]string{
+		"episode-watched":  "series-watched",
+		"episode-favorite": "series-favorite",
+	}}
+
+	excluded, err := NewSignalReader(repo, fakeSignalProvider{store: store}).RecommendationExclusionSet(t.Context(), 7, "p1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(excluded) != signalPageSize+2 {
+		t.Fatalf("excluded %d titles, want %d", len(excluded), signalPageSize+2)
+	}
+	for _, id := range []string{"series-watched", "series-favorite", "seed-0000", fmt.Sprintf("seed-%04d", signalPageSize-1)} {
+		if _, ok := excluded[id]; !ok {
+			t.Fatalf("%s missing from the exclusion set", id)
+		}
+	}
+	for _, id := range []string{"episode-watched", "episode-favorite", "movie-started", "movie-watchlist", "other-favorite"} {
+		if _, ok := excluded[id]; ok {
+			t.Fatalf("%s is in the exclusion set", id)
+		}
+	}
+
+	// Without a user store the repo answers both halves.
+	fallback := &fakeSignalRepo{
+		canonical:         map[string]string{"episode-favorite": "series-favorite"},
+		fallbackWatched:   map[string]struct{}{"movie-watched": {}},
+		fallbackFavorites: []string{"episode-favorite", "movie-favorite"},
+	}
+	excluded, err = NewSignalReader(fallback, nil).RecommendationExclusionSet(t.Context(), 7, "p1")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if want := map[string]struct{}{"movie-watched": {}, "series-favorite": {}, "movie-favorite": {}}; !maps.Equal(excluded, want) {
+		t.Fatalf("repo exclusion set = %v, want %v", excluded, want)
+	}
+}
+
+// Under WithWatchedSetMemo a profile's watched set is read once however many
+// SignalReaders ask for it; another profile, or a context without the memo,
+// reads again.
+func TestWatchedSetMemoReadsEachProfileOnce(t *testing.T) {
+	repo := &fakeSignalRepo{fallbackWatched: map[string]struct{}{"watched": {}}}
+	rowsReader, blendReader := NewSignalReader(repo, nil), NewSignalReader(repo, nil)
+	read := func(ctx context.Context, reader *SignalReader, profileID string) {
+		t.Helper()
+		set, err := reader.WatchedItemIDSet(ctx, 7, profileID)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, ok := set["watched"]; !ok || len(set) != 1 {
+			t.Fatalf("watched set = %v", set)
+		}
+	}
+
+	ctx := WithWatchedSetMemo(t.Context())
+	read(ctx, rowsReader, "p1")
+	read(ctx, blendReader, "p1")
+	if repo.watchedReads != 1 {
+		t.Fatalf("reads under the memo = %d, want 1", repo.watchedReads)
+	}
+	read(ctx, blendReader, "p2")
+	read(t.Context(), rowsReader, "p1")
+	if repo.watchedReads != 3 {
+		t.Fatalf("reads = %d, want one more for another profile and one without the memo", repo.watchedReads)
+	}
+}
+
+// fakeRatedItems lists a profile's ratings from memory.
+type fakeRatedItems []string
+
+func (f fakeRatedItems) ListAll(context.Context, int, string) ([]catalog.UserRating, error) {
+	out := make([]catalog.UserRating, len(f))
+	for i, id := range f {
+		out[i] = catalog.UserRating{MediaItemID: id, Rating: 4}
+	}
+	return out, nil
+}
+
+// Rows built for a profile leave out what it watched or favorited, every
+// title it rated, and every title it abandoned: progress under 15% left for
+// 14 days. A title paused early more recently, or one partly watched, stays.
+func TestBuildExclusionSetLeavesOutRatedAndAbandonedTitles(t *testing.T) {
+	now := time.Date(2026, 10, 11, 0, 0, 0, 0, time.UTC)
+	repo := &fakeSignalRepo{
+		canonical:         map[string]string{"episode-rated": "series-rated", "episode-abandoned": "series-abandoned"},
+		fallbackWatched:   map[string]struct{}{"watched": {}},
+		fallbackFavorites: []string{"favorite"},
+		fallbackProgress: []WatchProgressRow{
+			{MediaItemID: "abandoned", PositionSeconds: 100, DurationSeconds: 6000, UpdatedAt: now.Add(-15 * 24 * time.Hour)},
+			{MediaItemID: "episode-abandoned", PositionSeconds: 60, DurationSeconds: 2400, UpdatedAt: now.Add(-30 * 24 * time.Hour)},
+			{MediaItemID: "paused-recently", PositionSeconds: 100, DurationSeconds: 6000, UpdatedAt: now.Add(-2 * 24 * time.Hour)},
+			{MediaItemID: "half-watched", PositionSeconds: 1800, DurationSeconds: 6000, UpdatedAt: now.Add(-60 * 24 * time.Hour)},
+		},
+	}
+	signals := NewSignalReader(repo, nil)
+	got, err := signals.BuildExclusionSet(t.Context(), fakeRatedItems{"rated", "episode-rated"}, 7, "p1", now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []string{"abandoned", "favorite", "rated", "series-abandoned", "series-rated", "watched"}
+	if ids := slices.Sorted(maps.Keys(got)); !slices.Equal(ids, want) {
+		t.Fatalf("excluded = %v, want %v", ids, want)
+	}
+
+	got, err = signals.BuildExclusionSet(t.Context(), nil, 7, "p1", now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := got["rated"]; ok {
+		t.Fatal("with no ratings lister, rated titles stay")
+	}
+}
diff --git a/internal/recommendations/similar.go b/internal/recommendations/similar.go
index f33323d3af..066a802a80 100644
--- a/internal/recommendations/similar.go
+++ b/internal/recommendations/similar.go
@@ -2,47 +2,30 @@ package recommendations
 
 import (
 	"context"
-	"errors"
 	"fmt"
 
 	"log/slog"
-	"strings"
 
+	"github.com/prairie-server/prairie-server/internal/catalog"
 	"github.com/prairie-server/prairie-server/internal/models"
-	"github.com/prairie-server/prairie-server/internal/recommendations/embeddings"
 )
 
-// isQuotaError identifies provider limits that should stop this backfill run.
-// Gemini has exhausted its retries or deferred an excessive wait.
-func isQuotaError(err error) bool {
-	var limitErr *embeddings.RateLimitError
-	if errors.As(err, &limitErr) {
-		return true
+// SimilarItems returns items most similar to the given item for a profile.
+// Blends embedding similarity (70%) with co-watch Jaccard score (30%),
+// applies a validation pipeline, MMR re-ranking, and assigns connection
+// reasons. Titles the profile marked Not interested are left out before
+// ranking, so they do not take the list's places.
+func (e *Engine) SimilarItems(ctx context.Context, userID int, profileID, itemID string, limit int, filter catalog.AccessFilter) ([]ScoredItem, error) {
+	marks, err := e.signalReader().NotInterestedMarks(ctx, userID, profileID)
+	if err != nil {
+		return nil, fmt.Errorf("get not interested marks: %w", err)
+	}
+	excludeIDs := make([]string, 0, len(marks)+1)
+	excludeIDs = append(excludeIDs, itemID)
+	for _, m := range marks {
+		excludeIDs = append(excludeIDs, m.MediaItemID)
 	}
-	msg := err.Error()
-	return strings.Contains(msg, "insufficient_quota") ||
-		strings.Contains(msg, "exceeded your current quota") ||
-		strings.Contains(msg, "billing")
-}
-
-func embeddingTextNeedsRefresh(storedModel, storedCanonicalText, generatedCanonicalText, currentModel string) bool {
-	return storedModel != currentModel || storedCanonicalText != generatedCanonicalText
-}
-
-const (
-	// embeddingBackfillBatchSize is how many items EmbedAll embeds per API call.
-	embeddingBackfillBatchSize = 10
-
-	// embeddingTextStaleQuotaPerRun bounds how many text-stale items the
-	// expensive Pass 2 re-embeds in a single EmbedAll run. It caps the cost of
-	// the one full-table text-staleness CTE scan per run.
-	embeddingTextStaleQuotaPerRun = 200
-)
 
-// SimilarItems returns items most similar to the given item. Blends embedding
-// similarity (70%) with co-watch Jaccard score (30%), applies a validation
-// pipeline, MMR re-ranking, and assigns connection reasons.
-func (e *Engine) SimilarItems(ctx context.Context, itemID string, limit int) ([]ScoredItem, error) {
 	// 1. Fetch source embedding.
 	embedding, err := e.repo.GetEmbedding(ctx, itemID)
 	if err != nil {
@@ -64,21 +47,37 @@ func (e *Engine) SimilarItems(ctx context.Context, itemID string, limit int) ([]
 
 	// 3. Embedding search (3x limit for filtering headroom). Constrain to the
 	// source item's media type so an audiobook never appears in a movie's
-	// Similar rail (and vice versa) once audiobook embeddings exist.
-	embCandidates, err := e.repo.FindSimilar(ctx, embedding, []string{itemID}, sourceType, limit*3)
+	// Similar rail (and vice versa) once audiobook embeddings exist. Titles
+	// the viewer cannot see are left out before ranking, so they do not take
+	// the list's places.
+	embCandidates, err := e.repo.FindSimilar(ctx, embedding, excludeIDs, sourceType, limit*3, filter)
 	if err != nil {
 		return nil, fmt.Errorf("find similar items: %w", err)
 	}
 
-	// 4. Co-watch neighbors.
+	// 4. Co-watch neighbors of the source item's media type that the viewer
+	// can see: co-watch counts ebook reading too, the rail keeps to one type
+	// like the embedding search, and hidden neighbors must not take places in
+	// the ranked list. A source of unknown type keeps every type. Co-watch
+	// only adds to the embedding candidates, so neighbors that cannot be
+	// checked are left out rather than failing the list.
 	cowatchPairs, _ := e.repo.GetCowatchNeighbors(ctx, itemID, limit*3)
-	cowatchMap := make(map[string]float64, len(cowatchPairs))
-	for _, p := range cowatchPairs {
-		cowatchMap[p.SimilarItemID] = p.JaccardScore
+	cowatchMap, err := e.cowatchScores(ctx, cowatchPairs, filter, cowatchMediaTypes(sourceType, nil))
+	if err != nil {
+		slog.WarnContext(ctx, "filtering co-watch neighbors failed; leaving them out", "component", "recommendations", "item_id", itemID, "error", err)
+		cowatchMap = map[string]float64{}
 	}
 
-	// 5. Blend scores (70% embedding, 30% co-watch).
+	// 5. Blend scores (70% embedding, 30% co-watch), leaving out the marked
+	// titles co-watch brought in.
 	blended := blendScores(embCandidates, cowatchMap, 0.7, 0.3)
+	if len(marks) > 0 {
+		marked := make(map[string]struct{}, len(marks))
+		for _, m := range marks {
+			marked[m.MediaItemID] = struct{}{}
+		}
+		blended = excludeScoredItems(blended, marked)
+	}
 
 	// 6. Validation pipeline.
 	if sourceMeta != nil && len(blended) > 0 {
@@ -91,7 +90,7 @@ func (e *Engine) SimilarItems(ctx context.Context, itemID string, limit int) ([]
 		candidateIDs[i] = item.MediaItemID
 	}
 	embMap, _ := e.repo.GetBatchEmbeddings(ctx, candidateIDs)
-	result := applyMMR(blended, embMap, e.mmrLambda(LambdaSimilarItems), limit)
+	result := applyMMR(blended, embMap, e.mmrLambda(), limit)
 
 	// 8. Connection reasons.
 	e.assignReasons(ctx, itemID, sourceMeta, result)
@@ -127,6 +126,9 @@ func (e *Engine) applyValidation(ctx context.Context, sourceMeta *ItemMetadata,
 				candTitles[id] = titleYear{title: title, year: year}
 			}
 		}
+		if err := rows.Err(); err != nil {
+			slog.WarnContext(ctx, "reading candidate titles failed; validating without them", "component", "recommendations", "error", err)
+		}
 	}
 
 	var validated []ScoredItem
@@ -213,6 +215,9 @@ func (e *Engine) assignReasons(ctx context.Context, sourceItemID string, sourceM
 				candStudios[id] = studios
 			}
 		}
+		if err := rows.Err(); err != nil {
+			slog.WarnContext(ctx, "reading candidate studios failed; assigning reasons without them", "component", "recommendations", "error", err)
+		}
 	}
 
 	sourcePeople := allPeople[sourceItemID]
@@ -232,302 +237,7 @@ func (e *Engine) assignReasons(ctx context.Context, sourceItemID string, sourceM
 	}
 }
 
-// EmbedItem generates and stores an embedding for a single media item.
-func (e *Engine) EmbedItem(ctx context.Context, itemID string) error {
-	if err := e.ensureEmbeddingLockConfig(ctx); err != nil {
-		return fmt.Errorf("embed item %s: %w", itemID, err)
-	}
-
-	items, err := e.itemRepo.GetByIDs(ctx, []string{itemID})
-	if err != nil || len(items) == 0 {
-		return fmt.Errorf("get item %s: %w", itemID, err)
-	}
-
-	// Hydrate cast/crew from item_people for richer embedding text.
-	e.hydrateItemPeople(ctx, items)
-
-	text := embeddings.BuildEmbeddingText(items[0])
-	vectors, err := e.embClient.Embed(ctx, []string{text})
-	if err != nil {
-		return fmt.Errorf("embed item %s: %w", itemID, err)
-	}
-	if len(vectors) == 0 {
-		return fmt.Errorf("no embedding returned for item %s", itemID)
-	}
-
-	if err := e.ensureEmbeddingLock(ctx, vectors[0]); err != nil {
-		return fmt.Errorf("embed item %s: %w", itemID, err)
-	}
-
-	return e.repo.UpsertEmbedding(ctx, itemID, vectors[0], e.cfg.EmbeddingModel, text)
-}
-
-// EmbedAll embeds items that are missing embeddings or have stale canonical
-// text, in two passes:
-//
-//   - Pass 1 (cheap): drain every missing or model-stale item via the
-//     ItemsNeedingEmbedding cursor. This query is a single LEFT JOIN with no
-//     item_people LATERAL joins, so active backfill (lots of brand-new items)
-//     stays cheap. The cursor advances past each page, so an item that fails to
-//     embed or store is simply retried on the next EmbedAll run rather than
-//     stalling the page forever.
-//   - Pass 2 (expensive): ONLY once Pass 1 has fully drained, make a single
-//     ListEmbeddingTextCandidates scan (LIMIT embeddingTextStaleQuotaPerRun) to
-//     find items whose embedding model is current but whose canonical text has
-//     drifted (e.g. a cast change). Detecting this requires recomputing each
-//     row's text via the full item_people LATERAL CTE, so it is run at most once
-//     per EmbedAll call. Re-embedding refreshes canonical_text, so handled items
-//     drop out of the candidate set on the next run — natural forward progress
-//     without a Pass 2 cursor.
-//
-// Coverage-first tradeoff: in steady state Pass 1 drains every run, so text-stale
-// items are re-embedded promptly. Only under pathological continuous heavy
-// ingest (Pass 1 never drains within a run) does Pass 2 get skipped — we
-// deliberately prioritize getting NEW items covered over re-embedding
-// text-changed ones. A periodic "force Pass 2 every Nth run" is a possible
-// follow-up, intentionally out of scope here.
-func (e *Engine) EmbedAll(ctx context.Context) (int, error) {
-	model := e.cfg.EmbeddingModel
-	total := 0
-
-	if err := e.ensureEmbeddingLockConfig(ctx); err != nil {
-		return total, err
-	}
-
-	// Pass 1: drain the cheap missing/model-stale backlog via the cursor.
-	afterID := ""
-	for {
-		select {
-		case <-ctx.Done():
-			return total, ctx.Err()
-		default:
-		}
-
-		ids, err := e.repo.ItemsNeedingEmbedding(ctx, model, afterID, embeddingBackfillBatchSize)
-		if err != nil {
-			return total, err
-		}
-		if len(ids) == 0 {
-			break
-		}
-		afterID = ids[len(ids)-1]
-
-		items, err := e.itemRepo.GetByIDs(ctx, ids)
-		if err != nil {
-			return total, fmt.Errorf("get items for embedding: %w", err)
-		}
-		// Hydrate cast/crew for richer embedding text.
-		e.hydrateItemPeople(ctx, items)
-
-		texts := make([]string, len(items))
-		for i, item := range items {
-			texts[i] = embeddings.BuildEmbeddingText(item)
-		}
-
-		// embedBatch only returns quota/billing or context errors; both mean the
-		// cheap backlog did not fully drain this run, so we stop here and skip the
-		// expensive Pass 2. Any per-item store/embed failure is swallowed inside
-		// embedBatch and retried next run (the cursor passes over it).
-		embedded, err := e.embedBatch(ctx, items, texts, model)
-		total += embedded
-		if err != nil {
-			return total, err
-		}
-	}
-
-	// Reaching here means Pass 1 fully drained (every error path above returns).
-
-	select {
-	case <-ctx.Done():
-		return total, ctx.Err()
-	default:
-	}
-
-	// Pass 2: one expensive text-staleness scan, bounded by the per-run quota.
-	candidates, err := e.repo.ListEmbeddingTextCandidates(ctx, "", model, embeddingTextStaleQuotaPerRun)
-	if err != nil {
-		return total, err
-	}
-	if len(candidates) == 0 {
-		return total, nil
-	}
-
-	ids := make([]string, 0, len(candidates))
-	stored := make(map[string]EmbeddingTextCandidate, len(candidates))
-	for _, candidate := range candidates {
-		ids = append(ids, candidate.MediaItemID)
-		stored[candidate.MediaItemID] = candidate
-	}
-
-	items, err := e.itemRepo.GetByIDs(ctx, ids)
-	if err != nil {
-		return total, fmt.Errorf("get items for embedding: %w", err)
-	}
-	e.hydrateItemPeople(ctx, items)
-
-	// Pass 1 already cleared missing/model-stale rows, so the remaining
-	// candidates are text-stale. Re-confirm in Go (the SQL detection is an
-	// approximation of BuildEmbeddingText) before paying for an embed.
-	staleItems := make([]*models.MediaItem, 0, len(items))
-	staleTexts := make([]string, 0, len(items))
-	for _, item := range items {
-		text := embeddings.BuildEmbeddingText(item)
-		candidate := stored[item.ContentID]
-		if embeddingTextNeedsRefresh(candidate.Model, candidate.CanonicalText, text, model) {
-			staleItems = append(staleItems, item)
-			staleTexts = append(staleTexts, text)
-		}
-	}
-
-	embedded, err := e.embedBatch(ctx, staleItems, staleTexts, model)
-	total += embedded
-	if err != nil {
-		return total, err
-	}
-
-	return total, nil
-}
-
-// embedBatch embeds the given items (parallel items/texts slices, same length),
-// chunking internally by embeddingBackfillBatchSize so callers can pass any
-// size. It returns the number of items successfully stored.
-//
-// Behavior preserved from the original EmbedAll inner loop:
-//   - quota/billing errors return immediately (retrying won't help) and are the
-//     only batch-embed errors propagated to the caller;
-//   - any other batch embed failure falls back to embedding one item at a time
-//     so a single oversized item can't block the rest;
-//   - ensureEmbeddingLock runs before each upsert;
-//   - a store (upsert) failure for one item is logged and skipped, not fatal.
-func (e *Engine) embedBatch(ctx context.Context, items []*models.MediaItem, texts []string, model string) (int, error) {
-	total := 0
-	for start := 0; start < len(items); start += embeddingBackfillBatchSize {
-		select {
-		case <-ctx.Done():
-			return total, ctx.Err()
-		default:
-		}
-
-		end := start + embeddingBackfillBatchSize
-		if end > len(items) {
-			end = len(items)
-		}
-		chunkItems := items[start:end]
-		chunkTexts := texts[start:end]
-		if len(chunkItems) == 0 {
-			continue
-		}
-
-		vectors, err := e.embClient.Embed(ctx, chunkTexts)
-		if err != nil {
-			// A provider limit will not improve by splitting the batch.
-			if isQuotaError(err) {
-				return total, fmt.Errorf("embedding batch stopped: %w", err)
-			}
-
-			// Batch failed — fall back to embedding one at a time so a single
-			// oversized item doesn't block the entire job.
-			slog.WarnContext(ctx, "batch embed failed, falling back to single-item mode", "component", "recommendations", "error", err, "batch_size", len(chunkItems))
-			for i, item := range chunkItems {
-				if ctx.Err() != nil {
-					return total, ctx.Err()
-				}
-				single := chunkTexts[i]
-				vecs, embedErr := e.embClient.Embed(ctx, []string{single})
-				if embedErr != nil {
-					if isQuotaError(embedErr) {
-						return total, fmt.Errorf("embedding batch stopped: %w", embedErr)
-					}
-					if ctx.Err() != nil {
-						return total, ctx.Err()
-					}
-					slog.WarnContext(ctx, "skipping item, embed failed", "component", "recommendations", "item_id", item.ContentID, "error", embedErr)
-					continue
-				}
-				if len(vecs) > 0 {
-					if err := e.ensureEmbeddingLock(ctx, vecs[0]); err != nil {
-						return total, fmt.Errorf("embed item %s: %w", item.ContentID, err)
-					}
-					if storeErr := e.repo.UpsertEmbedding(ctx, item.ContentID, vecs[0], model, single); storeErr != nil {
-						slog.WarnContext(ctx, "skipping item, store failed", "component", "recommendations", "item_id", item.ContentID, "error", storeErr)
-						continue
-					}
-					total++
-				}
-			}
-			continue
-		}
-
-		for i, item := range chunkItems {
-			if i >= len(vectors) {
-				break
-			}
-			if err := e.ensureEmbeddingLock(ctx, vectors[i]); err != nil {
-				return total, fmt.Errorf("embed item %s: %w", item.ContentID, err)
-			}
-			if err := e.repo.UpsertEmbedding(ctx, item.ContentID, vectors[i], model, chunkTexts[i]); err != nil {
-				slog.WarnContext(ctx, "skipping item, store failed", "component", "recommendations", "item_id", item.ContentID, "error", err)
-				continue
-			}
-			total++
-		}
-	}
-
-	return total, nil
-}
-
-// hydrateItemPeople populates the People field on media items from item_people.
-func (e *Engine) hydrateItemPeople(ctx context.Context, items []*models.MediaItem) {
-	ids := make([]string, len(items))
-	for i, item := range items {
-		ids[i] = item.ContentID
-	}
-
-	peopleMap, err := e.personRepo.ListForItems(ctx, ids)
-	if err != nil {
-		slog.WarnContext(ctx, "failed to hydrate item people for embeddings", "component", "recommendations", "error", err)
-		return
-	}
-
-	for _, item := range items {
-		if people, ok := peopleMap[item.ContentID]; ok {
-			item.People = people
-		}
-	}
-}
-
-func (e *Engine) ensureEmbeddingLock(ctx context.Context, vector []float32) error {
-	sourceDimensions := len(vector)
-
-	lock, err := e.repo.GetEmbeddingLock(ctx)
-	if err != nil {
-		return fmt.Errorf("load embedding lock: %w", err)
-	}
-	if lock == nil {
-		return e.repo.SetEmbeddingLock(ctx, EmbeddingLock{
-			BaseURL:           e.cfg.EmbeddingBaseURL,
-			Model:             e.cfg.EmbeddingModel,
-			SourceDimensions:  sourceDimensions,
-			StorageDimensions: CanonicalEmbeddingDimensions,
-		})
-	}
-
-	if err := lock.Validate(e.cfg.EmbeddingBaseURL, e.cfg.EmbeddingModel, sourceDimensions); err != nil {
-		return err
-	}
-	return nil
-}
-
 func (e *Engine) ensureEmbeddingLockConfig(ctx context.Context) error {
-	lock, err := e.repo.GetEmbeddingLock(ctx)
-	if err != nil {
-		return fmt.Errorf("load embedding lock: %w", err)
-	}
-	if lock == nil {
-		return nil
-	}
-	if err := lock.ValidateConfig(e.cfg.EmbeddingBaseURL, e.cfg.EmbeddingModel); err != nil {
-		return err
-	}
-	return nil
+	_, err := checkEmbeddingLockConfig(ctx, e.repo, e.cfg.EmbeddingBaseURL, e.cfg.EmbeddingModel)
+	return err
 }
diff --git a/internal/recommendations/similar_quota_test.go b/internal/recommendations/similar_quota_test.go
deleted file mode 100644
index 5d4d60b3ef..0000000000
--- a/internal/recommendations/similar_quota_test.go
+++ /dev/null
@@ -1,77 +0,0 @@
-package recommendations
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"strings"
-	"testing"
-
-	"github.com/prairie-server/prairie-server/internal/models"
-	"github.com/prairie-server/prairie-server/internal/recommendations/embeddings"
-)
-
-type quotaTestEmbedder func(context.Context, []string) ([][]float32, error)
-
-func (f quotaTestEmbedder) Embed(ctx context.Context, texts []string) ([][]float32, error) {
-	return f(ctx, texts)
-}
-
-func TestEmbedBatchStopsOnProviderLimit(t *testing.T) {
-	for _, tc := range []struct {
-		name string
-		err  error
-	}{
-		{"daily quota", &embeddings.RateLimitError{DailyQuota: true}},
-		{"temporary retries exhausted", &embeddings.RateLimitError{}},
-		{"excessive retry delay", &embeddings.RateLimitError{RetryDeferred: true}},
-		{"wrapped limit", fmt.Errorf("wrapped: %w", &embeddings.RateLimitError{})},
-		{"OpenAI quota", errors.New("embedding API returned 429: insufficient_quota")},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			calls := 0
-			e := &Engine{embClient: quotaTestEmbedder(func(context.Context, []string) ([][]float32, error) {
-				calls++
-				return nil, tc.err
-			})}
-			items := []*models.MediaItem{{ContentID: "test-one"}, {ContentID: "test-two"}}
-			n, err := e.embedBatch(context.Background(), items, []string{"one", "two"}, "test-model")
-			if calls != 1 || n != 0 || !errors.Is(err, tc.err) {
-				t.Fatalf("batch stop: calls=%d stored=%d error=%v", calls, n, err)
-			}
-			if strings.Contains(err.Error(), "check billing") {
-				t.Fatal("batch added an unsupported billing diagnosis")
-			}
-		})
-	}
-}
-
-func TestEmbedBatchPreservesItemFallback(t *testing.T) {
-	calls := 0
-	e := &Engine{embClient: quotaTestEmbedder(func(context.Context, []string) ([][]float32, error) {
-		calls++
-		return nil, errors.New("input too large")
-	})}
-	items := []*models.MediaItem{{ContentID: "test-one"}, {ContentID: "test-two"}}
-	n, err := e.embedBatch(context.Background(), items, []string{"one", "two"}, "test-model")
-	if err != nil || calls != 3 || n != 0 {
-		t.Fatalf("item fallback: calls=%d stored=%d error=%v", calls, n, err)
-	}
-}
-
-func TestEmbedBatchStopsFallbackOnProviderLimit(t *testing.T) {
-	calls := 0
-	limitErr := &embeddings.RateLimitError{DailyQuota: true}
-	e := &Engine{embClient: quotaTestEmbedder(func(context.Context, []string) ([][]float32, error) {
-		calls++
-		if calls == 1 {
-			return nil, errors.New("batch input too large")
-		}
-		return nil, limitErr
-	})}
-	items := []*models.MediaItem{{ContentID: "test-one"}, {ContentID: "test-two"}}
-	n, err := e.embedBatch(context.Background(), items, []string{"one", "two"}, "test-model")
-	if !errors.Is(err, limitErr) || calls != 2 || n != 0 {
-		t.Fatalf("fallback stop: calls=%d stored=%d error=%v", calls, n, err)
-	}
-}
diff --git a/internal/recommendations/taste.go b/internal/recommendations/taste.go
index c5db960a88..5ca3340df4 100644
--- a/internal/recommendations/taste.go
+++ b/internal/recommendations/taste.go
@@ -4,11 +4,13 @@ import (
 	"context"
 	"fmt"
 	"log/slog"
+	"maps"
 	"math"
-	"sort"
+	"slices"
 	"time"
 
 	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/userstore"
 )
 
 // weightedAverage computes a weighted average of embedding vectors. Each entry
@@ -143,34 +145,87 @@ func maxContentRatingFromSets(ratedSet, completedSet, favSet map[string]struct{}
 // watch progress, and rewatches. Applies time decay and builds clustered
 // sub-profiles.
 func (e *Engine) RefreshTasteProfile(ctx context.Context, userID int, profileID string) error {
+	_, err := e.refreshTasteProfile(ctx, userID, profileID)
+	return err
+}
+
+// refreshTasteProfile is RefreshTasteProfile, also reporting whether it stored
+// a taste vector. A profile with no positive signal, or none whose title has
+// an embedding yet, gets none: its vector, clusters and cached personal rows
+// are cleared instead (see clearTasteProfile). A profile deleted since the
+// refresh was queued gets no vector and no taste row.
+func (e *Engine) refreshTasteProfile(ctx context.Context, userID int, profileID string) (bool, error) {
+	started, err := e.repo.Now(ctx)
+	if err != nil {
+		return false, err
+	}
+	stored, err := e.rebuildTasteProfile(ctx, userID, profileID, started)
+	if err != nil {
+		return stored, err
+	}
+	return stored, e.purgeIfProfileDeleted(ctx, userID, profileID)
+}
+
+// purgeIfProfileDeleted deletes the recommendation state of a profile deleted
+// while a rebuild wrote it. The rebuild checks that its profile exists before
+// writing, but a deletion can land between that check and the writes, after
+// the deletion's own purge ran. Profiles may live outside Postgres, so the
+// check cannot share the writes' transaction; run after the rebuild's last
+// write, either this check sees the deletion or the deletion's purge comes
+// after every write.
+func (e *Engine) purgeIfProfileDeleted(ctx context.Context, userID int, profileID string) error {
 	store, err := e.storeProvider.ForUser(ctx, userID)
 	if err != nil {
 		return fmt.Errorf("get user store for user %d: %w", userID, err)
 	}
+	profile, err := store.GetProfile(ctx, profileID)
+	if err != nil {
+		return fmt.Errorf("get profile %s: %w", profileID, err)
+	}
+	if profile != nil {
+		return nil
+	}
+	return e.repo.PurgeProfile(ctx, userID, profileID)
+}
+
+// rebuildTasteProfile is refreshTasteProfile for a refresh that started at
+// started, database time, before any of its signal reads. The profile is
+// stored as updated at started, so a stale mark set while it reads stays newer
+// than the profile and the stale sweep refreshes it again.
+func (e *Engine) rebuildTasteProfile(ctx context.Context, userID int, profileID string, started time.Time) (bool, error) {
+	store, err := e.storeProvider.ForUser(ctx, userID)
+	if err != nil {
+		return false, fmt.Errorf("get user store for user %d: %w", userID, err)
+	}
 
 	ratings, err := e.ratingsRepo.List(ctx, userID, profileID, 1000, 0)
 	if err != nil {
-		return fmt.Errorf("list ratings: %w", err)
+		return false, fmt.Errorf("list ratings: %w", err)
 	}
 
 	favorites, err := store.ListFavorites(ctx, profileID, 1000, 0)
 	if err != nil {
-		return fmt.Errorf("list favorites: %w", err)
+		return false, fmt.Errorf("list favorites: %w", err)
 	}
 
 	watchlist, err := store.ListWatchlist(ctx, profileID, 1000, 0)
 	if err != nil {
-		return fmt.Errorf("list watchlist: %w", err)
+		return false, fmt.Errorf("list watchlist: %w", err)
 	}
 
 	watchProgress, err := e.signalReader().WatchProgressForUser(ctx, userID, profileID)
 	if err != nil {
-		return fmt.Errorf("get watch progress: %w", err)
+		return false, fmt.Errorf("get watch progress: %w", err)
 	}
 
 	rewatchCounts, err := e.signalReader().RewatchCounts(ctx, userID, profileID)
 	if err != nil {
-		return fmt.Errorf("get rewatch counts: %w", err)
+		return false, fmt.Errorf("get rewatch counts: %w", err)
+	}
+
+	marks, err := e.signalReader().NotInterestedMarks(ctx, userID, profileID)
+	if err != nil {
+		return false, fmt.Errorf("get not interested marks: %w", err)
 	}
 
 	now := time.Now()
@@ -203,7 +258,7 @@ func (e *Engine) RefreshTasteProfile(ctx context.Context, userID int, profileID
 
 	refs, err := e.repo.ResolveCanonicalContentRefs(ctx, rawIDs)
 	if err != nil {
-		return fmt.Errorf("resolve canonical content refs: %w", err)
+		return false, fmt.Errorf("resolve canonical content refs: %w", err)
 	}
 
 	signalCounts := make(map[string]int)
@@ -229,79 +284,72 @@ func (e *Engine) RefreshTasteProfile(ctx context.Context, userID int, profileID
 		s.Rating = &rating
 		ratedSet[ref.CanonicalID] = struct{}{}
 
-		decay := timeDecay(r.RatedAt, now, halfLife)
-		switch r.Rating {
-		case 5:
-			s.ExplicitWeight += WeightRated5 * decay
-			signalCounts["rated_5"]++
-		case 4:
-			s.ExplicitWeight += WeightRated4 * decay
-			signalCounts["rated_4"]++
-		case 3:
-			s.ExplicitWeight += WeightRated3 * decay
-			signalCounts["rated_3"]++
-		default:
-			s.ExplicitWeight += WeightRatedLow * decay
-			signalCounts["rated_low"]++
-		}
+		weight, kind := ratingSignal(r.Rating)
+		s.ExplicitWeight += weight * timeDecay(r.RatedAt, now, halfLife)
+		signalCounts[kind]++
 	}
 
-	for _, wp := range watchProgress {
-		ref, ok := refs[wp.MediaItemID]
-		if !ok || ref.CanonicalID == "" {
-			continue
-		}
-		weight, ok := implicitWatchWeight(wp)
-		if !ok {
-			continue
-		}
-		switch weight {
-		case WeightWatchHigh:
-			signalCounts["watch_high"]++
-		case WeightWatchMed:
-			signalCounts["watch_med"]++
-		case WeightWatchLow:
-			signalCounts["watch_low"]++
-		}
-	}
-
-	for _, rc := range rewatchCounts {
-		ref, ok := refs[rc.MediaItemID]
-		if !ok || ref.CanonicalID == "" || rc.Count < 2 {
-			continue
-		}
-		signalCounts["rewatch"]++
-	}
+	countWatchSignals(signalCounts, watchProgress, rewatchCounts, refs, now)
 
 	implicitSignals, completedSet := buildCanonicalImplicitSignals(watchProgress, rewatchCounts, refs, now, halfLife)
 	for canonicalID, weight := range implicitSignals {
 		ensureSignal(canonicalID).ImplicitWeight += weight
 	}
 
+	// Favorites and watchlist entries count once per canonical title, as
+	// watches do, so favorited episodes of one series are one favorite.
 	favSet := make(map[string]struct{}, len(favorites))
-	for _, f := range favorites {
-		ref, ok := refs[f.MediaItemID]
-		if !ok || ref.CanonicalID == "" {
-			continue
-		}
-		favSet[ref.CanonicalID] = struct{}{}
-		s := ensureSignal(ref.CanonicalID)
-		s.IntentWeight += WeightFavorited * timeDecay(parseSignalTime(f.AddedAt, now), now, halfLife)
-		signalCounts["favorited"]++
+	// Favorites and watchlist entries weigh once per canonical title, at
+	// their newest entry: several favorited episodes are one favorited series.
+	favDecay := newestDecayByTitle(favorites, refs, func(f userstore.Favorite) (string, time.Time) {
+		return f.MediaItemID, parseSignalTime(f.AddedAt, now)
+	}, now, halfLife)
+	for id, decay := range favDecay {
+		favSet[id] = struct{}{}
+		s := ensureSignal(id)
+		s.IntentWeight += WeightFavorited * decay
+		s.Favorited = true
+	}
+	if len(favSet) > 0 {
+		signalCounts["favorited"] = len(favSet)
+	}
+
+	// A marked title says the profile does not want more like it, whatever
+	// it watched, rated or favorited. Marks are kept to movies and series,
+	// which are canonical already.
+	for _, m := range marks {
+		ensureSignal(m.MediaItemID).NotInterested = true
+	}
+	if len(marks) > 0 {
+		signalCounts[signalKindNotInterested] = len(marks)
+	}
+
+	watchlistSet := make(map[string]struct{}, len(watchlist))
+	watchlistDecay := newestDecayByTitle(watchlist, refs, func(w userstore.WatchlistEntry) (string, time.Time) {
+		return w.MediaItemID, parseSignalTime(w.AddedAt, now)
+	}, now, halfLife)
+	for id, decay := range watchlistDecay {
+		watchlistSet[id] = struct{}{}
+		ensureSignal(id).IntentWeight += WeightWatchlist * decay
+	}
+	if len(watchlistSet) > 0 {
+		signalCounts["watchlist"] = len(watchlistSet)
+	}
+
+	// A refresh queued before its profile was deleted must not bring back the
+	// taste row the deletion purged, even from signals that outlive a profile
+	// such as watch history; it only clears a row left behind. Profiles may
+	// live outside Postgres, so the user store says whether it still exists.
+	userProfile, err := store.GetProfile(ctx, profileID)
+	if err != nil {
+		return false, fmt.Errorf("get profile %s: %w", profileID, err)
 	}
-
-	for _, w := range watchlist {
-		ref, ok := refs[w.MediaItemID]
-		if !ok || ref.CanonicalID == "" {
-			continue
-		}
-		s := ensureSignal(ref.CanonicalID)
-		s.IntentWeight += WeightWatchlist * timeDecay(parseSignalTime(w.AddedAt, now), now, halfLife)
-		signalCounts["watchlist"]++
+	if userProfile == nil {
+		return false, e.clearTasteProfile(ctx, userID, profileID, signalCounts, "", started, false)
 	}
 
 	if len(signals) == 0 {
-		return nil
+		return false, e.clearTasteProfile(ctx, userID, profileID, signalCounts, "", started, true)
 	}
 
 	allIDs := make([]string, 0, len(signals))
@@ -328,77 +376,208 @@ func (e *Engine) RefreshTasteProfile(ctx context.Context, userID int, profileID
 
 	embMap, err := e.repo.GetBatchEmbeddings(ctx, allIDs)
 	if err != nil {
-		return fmt.Errorf("get batch embeddings: %w", err)
+		return false, fmt.Errorf("get batch embeddings: %w", err)
 	}
 
-	vecs := make([][]float32, 0, len(signals))
-	embWeights := make([]float64, 0, len(signals))
-	var positiveItems []clusterItem
+	maxContentRating := ""
+	if len(allIDs) > 0 && items != nil {
+		crMap := make(map[string]string, len(items))
+		for _, item := range items {
+			crMap[item.ContentID] = item.ContentRating
+		}
+		maxContentRating = maxContentRatingFromSets(ratedSet, completedSet, favSet, crMap)
+	}
 
-	signalIDs := make([]string, 0, len(signals))
-	for id := range signals {
-		signalIDs = append(signalIDs, id)
+	positiveItems, levelTitles := positiveTasteItems(signals, embMap)
+	profile := tasteVector(positiveItems)
+	if profile == nil {
+		return false, e.clearTasteProfile(ctx, userID, profileID, signalCounts, maxContentRating, started, true)
+	}
+	signalCounts[signalCountPositiveTitles] = levelTitles
+
+	if err := e.repo.UpsertTasteProfile(ctx, userID, profileID, profile, signalCounts, maxContentRating, started); err != nil {
+		return false, fmt.Errorf("upsert taste profile: %w", err)
 	}
-	sort.Strings(signalIDs)
 
-	for _, id := range signalIDs {
+	clusters := buildTasteClusters(positiveItems)
+	for i := range clusters {
+		clusters[i].UserID = userID
+		clusters[i].ProfileID = profileID
+	}
+	if err := e.repo.UpsertTasteClusters(ctx, userID, profileID, clusters); err != nil {
+		return false, fmt.Errorf("upsert taste clusters: %w", err)
+	}
+
+	return true, nil
+}
+
+// ratingSignal returns a star rating's explicit weight and its signal_counts
+// kind. A 3-star rating adds no weight of its own; combineCanonicalWeight
+// halves the title's watch and intent weight instead.
+func ratingSignal(rating int) (float64, string) {
+	switch rating {
+	case 5:
+		return WeightRated5, signalKindRated5
+	case 4:
+		return WeightRated4, signalKindRated4
+	case 3:
+		return 0, signalKindRated3
+	default:
+		return WeightRatedLow, signalKindRatedLow
+	}
+}
+
+// positiveTasteItems returns the titles that shape the taste vector and its
+// clusters, in ID order: those with an embedding and a positive combined
+// weight, never one marked Not interested. Disliked, abandoned and marked
+// titles are left out rather than subtracted (the rows rank against them
+// instead; see aversion):
+// subtracting only nudges the vector off each disliked title's own direction,
+// and with nothing positive left it points at their opposites. It also
+// returns how many of the titles count toward the cold-start level
+// (countsTowardLevel).
+func positiveTasteItems(signals map[string]*canonicalWeightComponents, embeddings map[string][]float32) ([]clusterItem, int) {
+	var items []clusterItem
+	levelTitles := 0
+	for _, id := range slices.Sorted(maps.Keys(signals)) {
 		s := signals[id]
-		emb, ok := embMap[id]
-		if !ok || emb == nil {
+		emb := embeddings[id]
+		if emb == nil {
+			continue
+		}
+		if s.NotInterested {
 			continue
 		}
-		finalWeight := combineCanonicalWeight(s.Rating, s.ExplicitWeight, s.ImplicitWeight, s.IntentWeight)
-		if finalWeight == 0 {
+		weight := combineCanonicalWeight(s.Rating, s.ExplicitWeight, s.ImplicitWeight, s.IntentWeight)
+		if weight <= 0 {
 			continue
 		}
+		items = append(items, clusterItem{itemID: id, embedding: emb, weight: weight, genres: s.Genres})
+		if s.countsTowardLevel() {
+			levelTitles++
+		}
+	}
+	return items, levelTitles
+}
 
-		vecs = append(vecs, emb)
-		embWeights = append(embWeights, finalWeight)
+// tasteVector is the weighted average of items' embeddings, or nil when
+// there are none.
+func tasteVector(items []clusterItem) []float32 {
+	vecs := make([][]float32, len(items))
+	weights := make([]float64, len(items))
+	for i, item := range items {
+		vecs[i] = item.embedding
+		weights[i] = item.weight
+	}
+	return weightedAverage(vecs, weights)
+}
 
-		if finalWeight > 0 {
-			positiveItems = append(positiveItems, clusterItem{
-				itemID:    id,
-				embedding: emb,
-				weight:    finalWeight,
-				genres:    s.Genres,
-			})
+// newestDecayByTitle maps each canonical title among entries to the time
+// decay of its newest entry, so a title with several entries (episodes of one
+// series) counts once. Entries that resolve to no title are dropped.
+func newestDecayByTitle[E any](entries []E, refs map[string]canonicalContentRef, entry func(E) (string, time.Time), now time.Time, halfLife float64) map[string]float64 {
+	decays := make(map[string]float64, len(entries))
+	for _, e := range entries {
+		itemID, at := entry(e)
+		ref, ok := refs[itemID]
+		if !ok || ref.CanonicalID == "" {
+			continue
 		}
+		decays[ref.CanonicalID] = max(decays[ref.CanonicalID], timeDecay(at, now, halfLife))
 	}
+	return decays
+}
 
-	profile := weightedAverage(vecs, embWeights)
-	if profile == nil {
-		return nil
+// clearTasteProfile stores a profile that has no positive signal, or none
+// whose title has an embedding: its signal counts without a taste vector, and
+// none of the clusters or cached personal rows an earlier vector produced.
+// Readers then treat it as having no taste profile. No title shaped a
+// vector, so it records no positive titles and the profile is level 0.
+// Without create a missing row stays missing (see Repo.ClearTasteProfile).
+func (e *Engine) clearTasteProfile(ctx context.Context, userID int, profileID string, signalCounts map[string]int, maxContentRating string, started time.Time, create bool) error {
+	signalCounts[signalCountPositiveTitles] = 0
+	if err := e.repo.ClearTasteProfile(ctx, userID, profileID, signalCounts, maxContentRating, started, create); err != nil {
+		return fmt.Errorf("clear taste profile: %w", err)
 	}
+	return nil
+}
 
-	maxContentRating := ""
-	if len(allIDs) > 0 && items != nil {
-		crMap := make(map[string]string, len(items))
-		for _, item := range items {
-			crMap[item.ContentID] = item.ContentRating
+// countWatchSignals adds the watch and rewatch signal counts to counts, once
+// per canonical title: a series counts as one title however many of its
+// episodes were watched, in the bucket of its strongest watch.
+func countWatchSignals(counts map[string]int, progress []WatchProgressRow, rewatches []RewatchCount, refs map[string]canonicalContentRef, now time.Time) {
+	strongest := make(map[string]float64)
+	for _, wp := range progress {
+		ref, ok := refs[wp.MediaItemID]
+		if !ok || ref.CanonicalID == "" {
+			continue
+		}
+		weight, ok := implicitWatchWeight(wp, now)
+		if !ok {
+			continue
+		}
+		if best, seen := strongest[ref.CanonicalID]; !seen || weight > best {
+			strongest[ref.CanonicalID] = weight
+		}
+	}
+	for _, weight := range strongest {
+		switch weight {
+		case WeightWatchHigh:
+			counts["watch_high"]++
+		case WeightWatchMed:
+			counts["watch_med"]++
+		case WeightWatchLow:
+			counts[signalKindWatchLow]++
 		}
-		maxContentRating = maxContentRatingFromSets(ratedSet, completedSet, favSet, crMap)
 	}
 
-	if err := e.repo.UpsertTasteProfile(ctx, userID, profileID, profile, signalCounts, maxContentRating); err != nil {
-		return fmt.Errorf("upsert taste profile: %w", err)
+	rewatched := make(map[string]struct{})
+	for _, rc := range rewatches {
+		ref, ok := refs[rc.MediaItemID]
+		if !ok || ref.CanonicalID == "" || rc.Count < 2 {
+			continue
+		}
+		rewatched[ref.CanonicalID] = struct{}{}
+	}
+	if len(rewatched) > 0 {
+		counts["rewatch"] += len(rewatched)
 	}
+}
 
-	if len(positiveItems) > 0 {
-		clusters := buildTasteClusters(positiveItems)
-		for i := range clusters {
-			clusters[i].UserID = userID
-			clusters[i].ProfileID = profileID
+// summaryTopGenres is how many genres the taste-profile summary names.
+const summaryTopGenres = 5
+
+// clusterTopGenres returns up to n genres of a profile's taste clusters, the
+// genres its personal rows are built from: the first dominant genre of each
+// cluster, heaviest cluster first, then the second of each, and so on,
+// skipping repeats. Taking turns lets a second interest show even when the
+// heaviest cluster has genres to fill every place. A profile without clusters
+// has none.
+func clusterTopGenres(clusters []TasteCluster, n int) []string {
+	sorted := clustersHeaviestFirst(clusters)
+	genres := []string{}
+	for rank := 0; len(genres) < n; rank++ {
+		more := false
+		for _, c := range sorted {
+			if rank >= len(c.DominantGenres) {
+				continue
+			}
+			more = true
+			if g := c.DominantGenres[rank]; g != "" && !slices.Contains(genres, g) && len(genres) < n {
+				genres = append(genres, g)
+			}
 		}
-		if err := e.repo.UpsertTasteClusters(ctx, userID, profileID, clusters); err != nil {
-			return fmt.Errorf("upsert taste clusters: %w", err)
+		if !more {
+			break
 		}
 	}
-
-	return nil
+	return genres
 }
 
 // GetTasteProfileSummary returns a human-readable summary of the user's taste
-// profile including top genres and directors.
+// profile. Its genres are those of the taste clusters the personal rows are
+// built from (see clusterTopGenres); its directors those of the titles the
+// profile rated 4 stars or more or favorited.
 func (e *Engine) GetTasteProfileSummary(ctx context.Context, userID int, profileID string) (*TasteProfileSummary, error) {
 	meta, err := e.repo.GetTasteProfileMeta(ctx, userID, profileID)
 	if err != nil {
@@ -413,7 +592,13 @@ func (e *Engine) GetTasteProfileSummary(ctx context.Context, userID int, profile
 		}, nil
 	}
 
-	// Gather top-rated and favorited item IDs to derive genre/director preferences.
+	clusters, err := e.repo.GetTasteClusterMeta(ctx, userID, profileID)
+	if err != nil {
+		return nil, fmt.Errorf("get taste clusters for summary: %w", err)
+	}
+	topGenres := clusterTopGenres(clusters, summaryTopGenres)
+
+	// Gather top-rated and favorited item IDs to derive director preferences.
 	ratings, err := e.ratingsRepo.List(ctx, userID, profileID, 1000, 0)
 	if err != nil {
 		return nil, fmt.Errorf("list ratings for summary: %w", err)
@@ -468,7 +653,6 @@ func (e *Engine) GetTasteProfileSummary(ctx context.Context, userID int, profile
 		idSet[ref.CanonicalID] = struct{}{}
 	}
 
-	topGenres := []string{}
 	topDirectors := []string{}
 
 	if len(idSet) > 0 {
@@ -482,32 +666,39 @@ func (e *Engine) GetTasteProfileSummary(ctx context.Context, userID int, profile
 			return nil, fmt.Errorf("get items for summary: %w", err)
 		}
 
-		genreCounts := make(map[string]int)
 		directorCounts := make(map[string]int)
-
 		for _, item := range items {
-			for _, g := range item.Genres {
-				genreCounts[g]++
-			}
 			for _, p := range item.People {
 				if p.Kind == models.PersonKindDirector {
 					directorCounts[p.Name]++
 				}
 			}
 		}
-
-		topGenres = topN(genreCounts, 5)
 		topDirectors = topN(directorCounts, 5)
 	}
 
 	return &TasteProfileSummary{
 		TopGenres:         topGenres,
 		FavoriteDirectors: topDirectors,
-		SignalCounts:      meta.SignalCounts,
+		SignalCounts:      summarySignalCounts(meta.SignalCounts),
 		UpdatedAt:         meta.UpdatedAt,
 	}, nil
 }
 
+// summarySignalCounts returns the signal kinds of counts for the taste
+// profile summary, which reports how many signals of each kind fed the
+// profile. It leaves out signalCountPositiveTitles, a count of titles rather
+// than a kind of signal, so a client that totals the kinds is not misled.
+func summarySignalCounts(counts map[string]int) map[string]int {
+	out := make(map[string]int, len(counts))
+	for kind, count := range counts {
+		if kind != signalCountPositiveTitles {
+			out[kind] = count
+		}
+	}
+	return out
+}
+
 // topN returns up to n keys from counts, ordered by count descending.
 func topN(counts map[string]int, n int) []string {
 	type kv struct {
diff --git a/internal/recommendations/taste_signals.go b/internal/recommendations/taste_signals.go
index 028e063af5..a8d049ce76 100644
--- a/internal/recommendations/taste_signals.go
+++ b/internal/recommendations/taste_signals.go
@@ -20,6 +20,27 @@ const (
 	maxSeasonContributionShare = 0.35
 )
 
+// lowProgressThreshold is the progress below which a title left unfinished
+// counts as abandoned, once it is older than abandonedProgressAge.
+const lowProgressThreshold = 0.15
+
+// abandonedProgressAge is how long a low-progress title must go untouched
+// before it counts against the profile's taste. A title paused early tonight
+// is more likely being watched than abandoned.
+const abandonedProgressAge = 14 * 24 * time.Hour
+
+// A series that has gone quiet for longer than seriesInactiveAge counts in
+// proportion to how many of its episodes were watched with a positive weight:
+// in full from seriesDepthEpisodes episodes, and at least seriesDepthFloor.
+// A pilot or a show dropped after an episode or two was sampled, not liked.
+// A series still being watched is not scaled, so a show started last night
+// counts like a movie watched last night.
+const (
+	seriesInactiveAge   = 30 * 24 * time.Hour
+	seriesDepthEpisodes = 5
+	seriesDepthFloor    = 0.25
+)
+
 type canonicalContentRef struct {
 	Kind         canonicalContentKind
 	CanonicalID  string
@@ -44,7 +65,20 @@ type canonicalWeightComponents struct {
 	ExplicitWeight float64
 	ImplicitWeight float64
 	IntentWeight   float64
-	Genres         []string
+	Favorited      bool
+	// NotInterested marks a title the profile marked Not interested: it
+	// leaves the taste vector whatever else the profile did with it.
+	NotInterested bool
+	Genres        []string
+}
+
+// countsTowardLevel reports whether a title counts toward the profile's
+// cold-start level: it was rated, favorited, or watched with a positive
+// weight. A title that is only on the watchlist does not. Its weight is a
+// small intent signal, and the watchlist stays recommendable, so a profile of
+// a few watchlist adds would otherwise open on a row of its own watchlist.
+func (s *canonicalWeightComponents) countsTowardLevel() bool {
+	return s.Rating != nil || s.Favorited || s.ImplicitWeight > 0
 }
 
 type rawImplicitSignal struct {
@@ -70,13 +104,19 @@ func parseSignalTime(raw string, fallback time.Time) time.Time {
 	return fallback
 }
 
-func implicitWatchWeight(wp WatchProgressRow) (float64, bool) {
+// implicitWatchWeight returns the taste weight of one progress row at now,
+// and false when the row carries none. Progress below lowProgressThreshold is
+// negative only once the row is older than abandonedProgressAge; a row with no
+// timestamp counts as recent, as it does for time decay.
+func implicitWatchWeight(wp WatchProgressRow, now time.Time) (float64, bool) {
 	var progressPct float64
 	if wp.Completed {
 		progressPct = 1.0
-	} else if wp.DurationSeconds > 0 {
+	} else if wp.DurationSeconds > 0 && wp.PositionSeconds > 0 {
 		progressPct = wp.PositionSeconds / wp.DurationSeconds
 	} else {
+		// No position and not watched: a cleared resume position or a play that
+		// never got going, which says nothing either way.
 		return 0, false
 	}
 
@@ -85,7 +125,10 @@ func implicitWatchWeight(wp WatchProgressRow) (float64, bool) {
 		return WeightWatchHigh, true
 	case progressPct >= 0.5:
 		return WeightWatchMed, true
-	case progressPct < 0.15:
+	case progressPct < lowProgressThreshold:
+		if wp.UpdatedAt.IsZero() || now.Sub(wp.UpdatedAt) < abandonedProgressAge {
+			return 0, false
+		}
 		return WeightWatchLow, true
 	default:
 		return 0, false
@@ -105,7 +148,9 @@ func combineCanonicalWeight(rating *int, explicitWeight, implicitWeight, intentW
 		}
 		return total
 	case *rating == 3:
-		return explicitWeight + implicitWeight + intentWeight
+		// "Meh" halves what watching and intent say, so a 3-star completion
+		// weighs less than an unrated one; the rating adds nothing itself.
+		return 0.5 * (implicitWeight + intentWeight)
 	default:
 		total := explicitWeight
 		if implicitWeight < 0 {
@@ -115,12 +160,20 @@ func combineCanonicalWeight(rating *int, explicitWeight, implicitWeight, intentW
 	}
 }
 
-func aggregateSeriesImplicitScore(seasons []seasonAggregate, now time.Time, halfLife float64) float64 {
+// aggregateSeriesImplicitScore combines a series' season scores into its
+// implicit weight. Recent, well-sampled seasons get larger shares of the mean,
+// and the mean decays once by the series' most recent signal, as a movie
+// decays by its last watch. Decay inside the shares alone cancels out, since
+// the shares always sum to 1. A positive score of a series inactive for
+// longer than seriesInactiveAge is scaled by seriesDepth(positiveEpisodes);
+// a negative one is not, so a dislike keeps its weight.
+func aggregateSeriesImplicitScore(seasons []seasonAggregate, positiveEpisodes int, now time.Time, halfLife float64) float64 {
 	if len(seasons) == 0 {
 		return 0
 	}
 
 	rawWeights := make([]float64, len(seasons))
+	var latest time.Time
 	for i, season := range seasons {
 		sampleCount := season.SampleCount
 		if sampleCount <= 0 {
@@ -133,17 +186,33 @@ func aggregateSeriesImplicitScore(seasons []seasonAggregate, now time.Time, half
 		if lastSignalAt.IsZero() {
 			lastSignalAt = now
 		}
+		if lastSignalAt.After(latest) {
+			latest = lastSignalAt
+		}
 		rawWeights[i] = float64(sampleCount) * timeDecay(lastSignalAt, now, halfLife)
 	}
+	if latest.IsZero() {
+		return 0
+	}
 
 	shares := cappedNormalizedWeights(rawWeights, maxSeasonContributionShare)
 	score := 0.0
 	for i, share := range shares {
 		score += share * seasons[i].Score
 	}
+	score *= timeDecay(latest, now, halfLife)
+	if score > 0 && now.Sub(latest) > seriesInactiveAge {
+		score *= seriesDepth(positiveEpisodes)
+	}
 	return score
 }
 
+// seriesDepth is the share of its weight an inactive series keeps for
+// positiveEpisodes episodes watched with a positive weight.
+func seriesDepth(positiveEpisodes int) float64 {
+	return min(1, max(seriesDepthFloor, float64(positiveEpisodes)/seriesDepthEpisodes))
+}
+
 func cappedNormalizedWeights(rawWeights []float64, cap float64) []float64 {
 	shares := make([]float64, len(rawWeights))
 
@@ -230,7 +299,7 @@ func buildCanonicalImplicitSignals(progress []WatchProgressRow, rewatches []Rewa
 		if !ok || ref.CanonicalID == "" {
 			continue
 		}
-		weight, ok := implicitWatchWeight(wp)
+		weight, ok := implicitWatchWeight(wp, now)
 		if !ok {
 			continue
 		}
@@ -275,6 +344,7 @@ func buildCanonicalImplicitSignals(progress []WatchProgressRow, rewatches []Rewa
 	}
 
 	seriesBuilders := make(map[string]map[string]*seasonBuilder)
+	positiveEpisodes := make(map[string]int)
 
 	for _, signal := range rawSignals {
 		if signal.Weight == 0 || signal.Ref.CanonicalID == "" {
@@ -308,6 +378,9 @@ func buildCanonicalImplicitSignals(progress []WatchProgressRow, rewatches []Rewa
 			}
 			builder.sumWeight += signal.Weight
 			builder.sampleCount++
+			if signal.Ref.Kind == canonicalKindEpisode && signal.Weight > 0 {
+				positiveEpisodes[signal.Ref.CanonicalID]++
+			}
 			if timestamp.After(builder.lastSignalAt) {
 				builder.lastSignalAt = timestamp
 			}
@@ -335,7 +408,7 @@ func buildCanonicalImplicitSignals(progress []WatchProgressRow, rewatches []Rewa
 		if len(seasons) == 0 {
 			continue
 		}
-		signals[canonicalID] += aggregateSeriesImplicitScore(seasons, now, halfLife)
+		signals[canonicalID] += aggregateSeriesImplicitScore(seasons, positiveEpisodes[canonicalID], now, halfLife)
 	}
 
 	return signals, completedSet
diff --git a/internal/recommendations/taste_signals_test.go b/internal/recommendations/taste_signals_test.go
index d6ebc6ae4c..2061191927 100644
--- a/internal/recommendations/taste_signals_test.go
+++ b/internal/recommendations/taste_signals_test.go
@@ -1,6 +1,7 @@
 package recommendations
 
 import (
+	"fmt"
 	"math"
 	"testing"
 	"time"
@@ -46,15 +47,20 @@ func TestBuildCanonicalImplicitSignalsWeightsPartialEbookLikeMovie(t *testing.T)
 	now := time.Date(2026, 6, 1, 12, 0, 0, 0, time.UTC)
 	halfLife := 90.0
 
+	abandonedAt := now.Add(-30 * 24 * time.Hour)
 	progress := []WatchProgressRow{
 		// Mid-read book (60%) mirrors a movie watched to 60%.
 		{MediaItemID: "ebook-mid", PositionSeconds: 0.6, DurationSeconds: 1, UpdatedAt: now},
-		// Abandoned book (<15%) mirrors an abandoned movie: negative signal.
-		{MediaItemID: "ebook-abandoned", PositionSeconds: 0.05, DurationSeconds: 1, UpdatedAt: now},
+		// Abandoned book (<15%, untouched for a month) mirrors an abandoned
+		// movie: negative signal.
+		{MediaItemID: "ebook-abandoned", PositionSeconds: 0.05, DurationSeconds: 1, UpdatedAt: abandonedAt},
+		// A book opened today is not abandoned yet.
+		{MediaItemID: "ebook-started", PositionSeconds: 0.05, DurationSeconds: 1, UpdatedAt: now},
 	}
 	refs := map[string]canonicalContentRef{
 		"ebook-mid":       {Kind: canonicalKindEbook, CanonicalID: "ebook-mid"},
 		"ebook-abandoned": {Kind: canonicalKindEbook, CanonicalID: "ebook-abandoned"},
+		"ebook-started":   {Kind: canonicalKindEbook, CanonicalID: "ebook-started"},
 	}
 
 	signals, completed := buildCanonicalImplicitSignals(progress, nil, refs, now, halfLife)
@@ -62,10 +68,260 @@ func TestBuildCanonicalImplicitSignalsWeightsPartialEbookLikeMovie(t *testing.T)
 	if got := signals["ebook-mid"]; math.Abs(got-WeightWatchMed) > 1e-9 {
 		t.Fatalf("mid-read ebook weight = %v, want WeightWatchMed (%v)", got, WeightWatchMed)
 	}
-	if got := signals["ebook-abandoned"]; math.Abs(got-WeightWatchLow) > 1e-9 {
-		t.Fatalf("abandoned ebook weight = %v, want WeightWatchLow (%v)", got, WeightWatchLow)
+	if got, want := signals["ebook-abandoned"], WeightWatchLow*timeDecay(abandonedAt, now, halfLife); math.Abs(got-want) > 1e-9 {
+		t.Fatalf("abandoned ebook weight = %v, want decayed WeightWatchLow (%v)", got, want)
+	}
+	if got, ok := signals["ebook-started"]; ok {
+		t.Fatalf("ebook opened today has weight %v, want no signal", got)
 	}
 	if len(completed) != 0 {
 		t.Fatalf("no row was completed, got completed set %v", completed)
 	}
 }
+
+// A title left below 15% counts as abandoned only once it has sat untouched
+// for abandonedProgressAge; before that it carries no weight either way.
+func TestImplicitWatchWeightLowProgressCountsOnceStale(t *testing.T) {
+	now := time.Date(2026, 10, 3, 12, 0, 0, 0, time.UTC)
+	day := 24 * time.Hour
+	for _, tc := range []struct {
+		name       string
+		row        WatchProgressRow
+		wantWeight float64
+		wantOK     bool
+	}{
+		{"completed", WatchProgressRow{Completed: true, UpdatedAt: now.Add(-400 * day)}, WeightWatchHigh, true},
+		{"nearly finished", WatchProgressRow{PositionSeconds: 95, DurationSeconds: 100, UpdatedAt: now}, WeightWatchHigh, true},
+		{"half watched", WatchProgressRow{PositionSeconds: 60, DurationSeconds: 100, UpdatedAt: now}, WeightWatchMed, true},
+		{"middle band", WatchProgressRow{PositionSeconds: 30, DurationSeconds: 100, UpdatedAt: now.Add(-100 * day)}, 0, false},
+		{"paused early tonight", WatchProgressRow{PositionSeconds: 10, DurationSeconds: 100, UpdatedAt: now.Add(-2 * time.Hour)}, 0, false},
+		{"paused early 13 days ago", WatchProgressRow{PositionSeconds: 10, DurationSeconds: 100, UpdatedAt: now.Add(-13 * day)}, 0, false},
+		{"at the window", WatchProgressRow{PositionSeconds: 10, DurationSeconds: 100, UpdatedAt: now.Add(-abandonedProgressAge)}, WeightWatchLow, true},
+		{"abandoned 15 days ago", WatchProgressRow{PositionSeconds: 10, DurationSeconds: 100, UpdatedAt: now.Add(-15 * day)}, WeightWatchLow, true},
+		{"low progress without a timestamp", WatchProgressRow{PositionSeconds: 10, DurationSeconds: 100}, 0, false},
+		{"no duration", WatchProgressRow{PositionSeconds: 10, UpdatedAt: now.Add(-100 * day)}, 0, false},
+		// A cleared resume position (issue #2134) keeps the duration; it is not
+		// an abandoned watch, however long ago it was cleared.
+		{"cleared resume position", WatchProgressRow{DurationSeconds: 100, UpdatedAt: now.Add(-100 * day)}, 0, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			weight, ok := implicitWatchWeight(tc.row, now)
+			if weight != tc.wantWeight || ok != tc.wantOK {
+				t.Fatalf("weight = %v, %v; want %v, %v", weight, ok, tc.wantWeight, tc.wantOK)
+			}
+		})
+	}
+}
+
+// A series decays once, by its most recent season signal, the way a movie
+// decays by its last watch. The season shares still weight the mean.
+func TestAggregateSeriesImplicitScoreDecaysByLatestSignal(t *testing.T) {
+	now := time.Date(2026, 10, 3, 12, 0, 0, 0, time.UTC)
+	const halfLife = 180.0
+	daysAgo := func(d int) time.Time { return now.Add(-time.Duration(d) * 24 * time.Hour) }
+
+	t.Run("binge from 700 days ago", func(t *testing.T) {
+		got := aggregateSeriesImplicitScore([]seasonAggregate{
+			{Score: WeightWatchHigh, SampleCount: 10, LastSignalAt: daysAgo(700)},
+		}, 10, now, halfLife)
+		if got >= 0.1 {
+			t.Fatalf("score = %v, want below 0.1", got)
+		}
+		if movie := WeightWatchHigh * timeDecay(daysAgo(700), now, halfLife); math.Abs(got-movie) > 1e-9 {
+			t.Fatalf("score = %v, want %v, as a movie finished the same day", got, movie)
+		}
+	})
+
+	t.Run("old seasons and one watched this week", func(t *testing.T) {
+		seasons := []seasonAggregate{
+			{Score: WeightWatchHigh, SampleCount: 10, LastSignalAt: daysAgo(700)},
+			{Score: WeightWatchHigh, SampleCount: 10, LastSignalAt: daysAgo(500)},
+			{Score: WeightWatchHigh, SampleCount: 8, LastSignalAt: daysAgo(5)},
+		}
+		got := aggregateSeriesImplicitScore(seasons, 28, now, halfLife)
+		if want := WeightWatchHigh * timeDecay(daysAgo(5), now, halfLife); math.Abs(got-want) > 1e-9 {
+			t.Fatalf("score = %v, want %v: the mean decayed once by the latest season", got, want)
+		}
+		if got < 0.75 {
+			t.Fatalf("score = %v, want near the 0.8 mean for a series watched this week", got)
+		}
+	})
+
+	t.Run("mixed seasons keep their share weighting", func(t *testing.T) {
+		seasons := []seasonAggregate{
+			{Score: WeightWatchHigh, SampleCount: 10, LastSignalAt: daysAgo(3)},
+			{Score: WeightWatchMed, SampleCount: 10, LastSignalAt: daysAgo(3)},
+		}
+		got := aggregateSeriesImplicitScore(seasons, 20, now, halfLife)
+		mean := (WeightWatchHigh + WeightWatchMed) / 2
+		if want := mean * timeDecay(daysAgo(3), now, halfLife); math.Abs(got-want) > 1e-9 {
+			t.Fatalf("score = %v, want %v", got, want)
+		}
+	})
+
+	t.Run("no timestamp counts as now", func(t *testing.T) {
+		got := aggregateSeriesImplicitScore([]seasonAggregate{{Score: WeightWatchHigh, SampleCount: 3}}, 3, now, halfLife)
+		if math.Abs(got-WeightWatchHigh) > 1e-9 {
+			t.Fatalf("score = %v, want undecayed %v", got, WeightWatchHigh)
+		}
+	})
+}
+
+// Through the whole signal build, a series finished long ago weighs what a
+// movie finished the same day weighs.
+func TestBuildCanonicalImplicitSignalsDecaysOldSeriesLikeMovies(t *testing.T) {
+	now := time.Date(2026, 10, 3, 12, 0, 0, 0, time.UTC)
+	const halfLife = 180.0
+	watched := now.Add(-700 * 24 * time.Hour)
+	refs := map[string]canonicalContentRef{
+		"movie": {Kind: canonicalKindMovie, CanonicalID: "movie"},
+	}
+	progress := []WatchProgressRow{{MediaItemID: "movie", Completed: true, UpdatedAt: watched}}
+	for i := range 6 {
+		id := fmt.Sprintf("episode-%d", i)
+		refs[id] = canonicalContentRef{Kind: canonicalKindEpisode, CanonicalID: "series", SeriesID: "series", SeasonNumber: 1, HasSeason: true}
+		progress = append(progress, WatchProgressRow{MediaItemID: id, Completed: true, UpdatedAt: watched})
+	}
+
+	signals, _ := buildCanonicalImplicitSignals(progress, nil, refs, now, halfLife)
+	if math.Abs(signals["series"]-signals["movie"]) > 1e-9 || signals["series"] >= 0.1 {
+		t.Fatalf("series weight = %v, movie weight = %v; want equal and below 0.1", signals["series"], signals["movie"])
+	}
+}
+
+// A 3-star rating is half credit: it halves what watching and intent say
+// and adds nothing of its own, so a 3-star completion weighs less than an
+// unrated one instead of more.
+func TestRatedThreeIsHalfCredit(t *testing.T) {
+	weight := func(rating *int, implicit, intent float64) float64 {
+		explicit := 0.0
+		if rating != nil {
+			w, _ := ratingSignal(*rating)
+			explicit = w
+		}
+		return combineCanonicalWeight(rating, explicit, implicit, intent)
+	}
+	stars := func(n int) *int { return &n }
+
+	if w, kind := ratingSignal(3); w != 0 || kind != "rated_3" {
+		t.Fatalf("ratingSignal(3) = %v, %q; want no weight, still counted as rated_3", w, kind)
+	}
+	unrated := weight(nil, WeightWatchHigh, 0)
+	meh := weight(stars(3), WeightWatchHigh, 0)
+	if meh >= unrated || math.Abs(meh-0.5*WeightWatchHigh) > 1e-9 {
+		t.Fatalf("3-star completion = %v, unrated completion = %v; want half of it", meh, unrated)
+	}
+	if liked := weight(stars(4), WeightWatchHigh, 0); liked <= unrated {
+		t.Fatalf("4-star completion = %v, want above the unrated %v", liked, unrated)
+	}
+	if fav := weight(stars(3), WeightWatchHigh, WeightFavorited); fav >= weight(nil, WeightWatchHigh, WeightFavorited) {
+		t.Fatalf("3-star favorite completion = %v, want below the unrated favorite", fav)
+	}
+	// A 3-star rating alone carries no weight, and one on an abandoned title
+	// stays negative, so neither shapes the taste vector.
+	if w := weight(stars(3), 0, 0); w != 0 {
+		t.Fatalf("3-star rating alone = %v, want 0", w)
+	}
+	if w := weight(stars(3), WeightWatchLow, 0); w >= 0 {
+		t.Fatalf("3-star abandoned title = %v, want negative", w)
+	}
+}
+
+// A series that has gone quiet counts by how many of its episodes were
+// watched with a positive weight; one being watched now, and a dislike, are
+// not scaled.
+func TestBuildCanonicalImplicitSignalsScalesQuietSeriesByDepth(t *testing.T) {
+	now := time.Date(2026, 10, 3, 12, 0, 0, 0, time.UTC)
+	const halfLife = 180.0
+	daysAgo := func(d int) time.Time { return now.Add(-time.Duration(d) * 24 * time.Hour) }
+	completed := func(at time.Time) WatchProgressRow { return WatchProgressRow{Completed: true, UpdatedAt: at} }
+	stopped := func(at time.Time) WatchProgressRow {
+		return WatchProgressRow{PositionSeconds: 5, DurationSeconds: 100, UpdatedAt: at}
+	}
+	repeat := func(n int, row WatchProgressRow) []WatchProgressRow {
+		rows := make([]WatchProgressRow, n)
+		for i := range rows {
+			rows[i] = row
+		}
+		return rows
+	}
+	seriesWeight := func(t *testing.T, kind canonicalContentKind, episodes []WatchProgressRow) float64 {
+		t.Helper()
+		refs := map[string]canonicalContentRef{}
+		progress := make([]WatchProgressRow, len(episodes))
+		for i, row := range episodes {
+			id := fmt.Sprintf("episode-%d", i)
+			refs[id] = canonicalContentRef{Kind: kind, CanonicalID: "series", SeriesID: "series", SeasonNumber: 1 + i/10, HasSeason: true}
+			row.MediaItemID = id
+			progress[i] = row
+		}
+		signals, _ := buildCanonicalImplicitSignals(progress, nil, refs, now, halfLife)
+		return signals["series"]
+	}
+	movie := func(at time.Time) float64 { return WeightWatchHigh * timeDecay(at, now, halfLife) }
+
+	for _, tc := range []struct {
+		name     string
+		kind     canonicalContentKind
+		episodes []WatchProgressRow
+		want     float64
+	}{
+		{"pilot watched last night", canonicalKindEpisode, []WatchProgressRow{completed(daysAgo(1))}, movie(daysAgo(1))},
+		{"three episodes this week", canonicalKindEpisode, repeat(3, completed(daysAgo(2))), movie(daysAgo(2))},
+		{"quiet for exactly the window", canonicalKindEpisode, []WatchProgressRow{completed(daysAgo(30))}, movie(daysAgo(30))},
+		{"pilot only, quiet for 60 days", canonicalKindEpisode, []WatchProgressRow{completed(daysAgo(60))}, seriesDepthFloor * movie(daysAgo(60))},
+		{"two episodes, quiet for 40 days", canonicalKindEpisode, repeat(2, completed(daysAgo(40))), 0.4 * movie(daysAgo(40))},
+		{"miniseries of six finished 90 days ago", canonicalKindEpisode, repeat(6, completed(daysAgo(90))), movie(daysAgo(90))},
+		{"binge of 30 episodes 700 days ago", canonicalKindEpisode, repeat(30, completed(daysAgo(700))), movie(daysAgo(700))},
+		{
+			"dropped at episode 2, 45 days ago", canonicalKindEpisode,
+			[]WatchProgressRow{completed(daysAgo(60)), stopped(daysAgo(45))},
+			seriesDepthFloor * (WeightWatchHigh + WeightWatchLow) / 2 * timeDecay(daysAgo(45), now, halfLife),
+		},
+		{"every episode abandoned keeps its dislike", canonicalKindEpisode, repeat(2, stopped(daysAgo(60))), WeightWatchLow * timeDecay(daysAgo(60), now, halfLife)},
+		{"season rows are not episodes", canonicalKindSeason, repeat(6, completed(daysAgo(60))), seriesDepthFloor * movie(daysAgo(60))},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := seriesWeight(t, tc.kind, tc.episodes); math.Abs(got-tc.want) > 1e-9 {
+				t.Fatalf("series weight = %v, want %v", got, tc.want)
+			}
+		})
+	}
+
+	// A series dropped after the pilot and a stopped second episode used to
+	// weigh 0.3 decayed, a mild like; it now weighs a quarter of that.
+	if dropped := seriesWeight(t, canonicalKindEpisode, []WatchProgressRow{completed(daysAgo(60)), stopped(daysAgo(45))}); dropped >= 0.1 {
+		t.Fatalf("dropped series weight = %v, want far below 0.3", dropped)
+	}
+}
+
+// Several favorited episodes of one series weigh as one favorite of the
+// series, at the newest one's decay; entries with no title are dropped.
+func TestNewestDecayByTitleCountsATitleOnce(t *testing.T) {
+	now := time.Date(2026, 10, 1, 0, 0, 0, 0, time.UTC)
+	type entry struct {
+		id string
+		at time.Time
+	}
+	refs := map[string]canonicalContentRef{
+		"ep-1":  {Kind: canonicalKindSeries, CanonicalID: "series"},
+		"ep-2":  {Kind: canonicalKindSeries, CanonicalID: "series"},
+		"movie": {Kind: canonicalKindMovie, CanonicalID: "movie"},
+	}
+	entries := []entry{
+		{"ep-1", now.AddDate(0, 0, -360)},
+		{"ep-2", now.AddDate(0, 0, -180)},
+		{"movie", now},
+		{"unknown", now},
+	}
+	decays := newestDecayByTitle(entries, refs, func(e entry) (string, time.Time) { return e.id, e.at }, now, 180)
+	if len(decays) != 2 {
+		t.Fatalf("decays = %v, want one per title", decays)
+	}
+	if got, want := decays["series"], timeDecay(now.AddDate(0, 0, -180), now, 180); math.Abs(got-want) > 1e-9 {
+		t.Fatalf("series decay = %v, want the newest episode's %v", got, want)
+	}
+	if got := decays["movie"]; math.Abs(got-1) > 1e-9 {
+		t.Fatalf("movie decay = %v, want 1", got)
+	}
+}
diff --git a/internal/recommendations/taste_test.go b/internal/recommendations/taste_test.go
new file mode 100644
index 0000000000..2156c37c9f
--- /dev/null
+++ b/internal/recommendations/taste_test.go
@@ -0,0 +1,851 @@
+package recommendations
+
+import (
+	"context"
+	"fmt"
+	"maps"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/config"
+	"github.com/prairie-server/prairie-server/internal/userstore"
+	"github.com/prairie-server/prairie-server/internal/userstore/pgstore"
+)
+
+// Watch and rewatch signals count once per canonical title, in the bucket of
+// the title's strongest watch, so episode rows do not inflate the cold-start
+// level.
+func TestCountWatchSignalsCountsEachTitleOnce(t *testing.T) {
+	now := time.Date(2026, 10, 3, 12, 0, 0, 0, time.UTC)
+	old := now.Add(-30 * 24 * time.Hour)
+	refs := map[string]canonicalContentRef{
+		"movie-done":      {Kind: canonicalKindMovie, CanonicalID: "movie-done"},
+		"movie-half":      {Kind: canonicalKindMovie, CanonicalID: "movie-half"},
+		"movie-abandoned": {Kind: canonicalKindMovie, CanonicalID: "movie-abandoned"},
+		"movie-paused":    {Kind: canonicalKindMovie, CanonicalID: "movie-paused"},
+	}
+	episodes := func(series string, n int) []string {
+		ids := make([]string, n)
+		for i := range ids {
+			ids[i] = fmt.Sprintf("%s-e%02d", series, i)
+			refs[ids[i]] = canonicalContentRef{Kind: canonicalKindEpisode, CanonicalID: series, SeriesID: series, SeasonNumber: 1, HasSeason: true}
+		}
+		return ids
+	}
+	binged := episodes("series-binged", 15)
+	sampled := episodes("series-sampled", 3)
+	dropped := episodes("series-dropped", 2)
+
+	for _, tc := range []struct {
+		name      string
+		progress  []WatchProgressRow
+		rewatches []RewatchCount
+		want      map[string]int
+	}{
+		{
+			name: "fifteen finished episodes are one title",
+			progress: func() []WatchProgressRow {
+				rows := make([]WatchProgressRow, 0, len(binged))
+				for _, id := range binged {
+					rows = append(rows, WatchProgressRow{MediaItemID: id, Completed: true, UpdatedAt: now})
+				}
+				return rows
+			}(),
+			want: map[string]int{"watch_high": 1},
+		},
+		{
+			name: "a series lands in its strongest bucket",
+			progress: []WatchProgressRow{
+				{MediaItemID: sampled[0], PositionSeconds: 5, DurationSeconds: 100, UpdatedAt: old},
+				{MediaItemID: sampled[1], PositionSeconds: 60, DurationSeconds: 100, UpdatedAt: now},
+				{MediaItemID: sampled[2], PositionSeconds: 70, DurationSeconds: 100, UpdatedAt: now},
+			},
+			want: map[string]int{"watch_med": 1},
+		},
+		{
+			name: "movies and series side by side",
+			progress: []WatchProgressRow{
+				{MediaItemID: "movie-done", Completed: true, UpdatedAt: now},
+				{MediaItemID: "movie-half", PositionSeconds: 55, DurationSeconds: 100, UpdatedAt: now},
+				{MediaItemID: "movie-abandoned", PositionSeconds: 5, DurationSeconds: 100, UpdatedAt: old},
+				{MediaItemID: "movie-paused", PositionSeconds: 5, DurationSeconds: 100, UpdatedAt: now},
+				{MediaItemID: dropped[0], PositionSeconds: 3, DurationSeconds: 100, UpdatedAt: old},
+				{MediaItemID: dropped[1], PositionSeconds: 4, DurationSeconds: 100, UpdatedAt: old},
+				{MediaItemID: "unknown", Completed: true, UpdatedAt: now},
+			},
+			want: map[string]int{"watch_high": 1, "watch_med": 1, "watch_low": 2},
+		},
+		{
+			name: "rewatched episodes of one series are one rewatch",
+			rewatches: []RewatchCount{
+				{MediaItemID: binged[0], Count: 2},
+				{MediaItemID: binged[1], Count: 3},
+				{MediaItemID: binged[2], Count: 1},
+				{MediaItemID: "movie-done", Count: 2},
+			},
+			want: map[string]int{"rewatch": 2},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			counts := map[string]int{}
+			countWatchSignals(counts, tc.progress, tc.rewatches, refs, now)
+			if !maps.Equal(counts, tc.want) {
+				t.Fatalf("counts = %v, want %v", counts, tc.want)
+			}
+		})
+	}
+}
+
+// The taste vector is built from positive titles only: a disliked or
+// abandoned title is left out rather than subtracted, while it still counts
+// as a signal. Rated, favorited and watched titles count toward the
+// cold-start level once each, however many signals they carry; a title only
+// on the watchlist shapes the vector but does not count.
+func TestPositiveTasteItemsKeepsPositiveTitlesOnly(t *testing.T) {
+	stars := func(n int) *int { return &n }
+	axis := func(i int) []float32 {
+		v := make([]float32, 8)
+		v[i] = 1
+		return v
+	}
+	signals := map[string]*canonicalWeightComponents{
+		"a-liked":         {ImplicitWeight: WeightWatchHigh},
+		"b-loved":         {Rating: stars(5), ExplicitWeight: WeightRated5, ImplicitWeight: WeightWatchHigh, IntentWeight: WeightFavorited, Favorited: true},
+		"c-seed-pick":     {IntentWeight: WeightFavorited, Favorited: true},
+		"d-watchlisted":   {IntentWeight: WeightWatchlist},
+		"e-disliked":      {Rating: stars(1), ExplicitWeight: WeightRatedLow, ImplicitWeight: WeightWatchHigh},
+		"f-abandoned":     {ImplicitWeight: WeightWatchLow},
+		"g-meh-unwatched": {Rating: stars(3)},
+		"h-no-embedding":  {ImplicitWeight: WeightWatchHigh},
+		// A title marked Not interested leaves however loved it was.
+		"i-marked": {Rating: stars(5), ExplicitWeight: WeightRated5, ImplicitWeight: WeightWatchHigh, IntentWeight: WeightFavorited, Favorited: true, NotInterested: true},
+	}
+	embeddings := map[string][]float32{}
+	for i, id := range []string{"a-liked", "b-loved", "c-seed-pick", "d-watchlisted", "e-disliked", "f-abandoned", "g-meh-unwatched", "i-marked"} {
+		embeddings[id] = axis(i)
+	}
+
+	items, levelTitles := positiveTasteItems(signals, embeddings)
+	ids := make([]string, len(items))
+	for i, item := range items {
+		ids[i] = item.itemID
+	}
+	if want := []string{"a-liked", "b-loved", "c-seed-pick", "d-watchlisted"}; !slices.Equal(ids, want) {
+		t.Fatalf("taste items = %v, want %v", ids, want)
+	}
+	if levelTitles != 3 {
+		t.Fatalf("titles counting toward the level = %d, want 3 (the watchlist-only title does not)", levelTitles)
+	}
+	vec := tasteVector(items)
+	if vec[4] != 0 || vec[5] != 0 || vec[6] != 0 || vec[7] != 0 {
+		t.Fatalf("taste vector = %v, want nothing along the disliked, abandoned, 3-star and marked titles", vec)
+	}
+	if !(vec[1] > vec[0] && vec[0] > vec[3] && vec[3] > 0) {
+		t.Fatalf("taste vector = %v, want loved > liked > watchlisted > 0", vec)
+	}
+
+	// With only dislikes left there is nothing to build a vector from.
+	items, levelTitles = positiveTasteItems(map[string]*canonicalWeightComponents{
+		"e-disliked":  signals["e-disliked"],
+		"f-abandoned": signals["f-abandoned"],
+	}, embeddings)
+	if len(items) != 0 || levelTitles != 0 || tasteVector(items) != nil {
+		t.Fatalf("negative-only profile: items = %v, level titles = %d; want none and no vector", items, levelTitles)
+	}
+}
+
+// The taste-profile summary reports signals of each kind; the count of
+// positive titles behind the cold-start level is not one.
+func TestSummarySignalCountsLeavesOutPositiveTitles(t *testing.T) {
+	got := summarySignalCounts(map[string]int{"favorited": 3, "watch_high": 2, signalCountPositiveTitles: 4})
+	if want := map[string]int{"favorited": 3, "watch_high": 2}; !maps.Equal(got, want) {
+		t.Fatalf("summary counts = %v, want %v", got, want)
+	}
+	if got := summarySignalCounts(nil); got == nil || len(got) != 0 {
+		t.Fatalf("summary counts of no row = %v, want an empty map", got)
+	}
+}
+
+// axisVector is a full-width vector pointing along axis, nudged along the
+// axes in nudges, so test items sit next to each other and away from the
+// rest of a shared test database.
+func axisVector(axis int, nudges map[int]float32) []float32 {
+	v := make([]float32, CanonicalEmbeddingDimensions)
+	v[axis] = 1
+	for i, n := range nudges {
+		v[i] += n
+	}
+	return v
+}
+
+// newTasteTestAccount inserts an account and one of its profiles, removed
+// with the account when the test ends.
+func newTasteTestAccount(t *testing.T, pool *pgxpool.Pool, name string) (int, string) {
+	t.Helper()
+	ctx := context.Background()
+	var userID int
+	if err := pool.QueryRow(ctx, `INSERT INTO users(username, role) VALUES($1, 'user') RETURNING id`, name+uuid.NewString()).Scan(&userID); err != nil {
+		t.Fatalf("insert user: %v", err)
+	}
+	t.Cleanup(func() { _, _ = pool.Exec(context.Background(), `DELETE FROM users WHERE id = $1`, userID) })
+	profileID := uuid.NewString()
+	if _, err := pool.Exec(ctx, `INSERT INTO user_profiles(id, user_id, name) VALUES($1, $2, $3)`, profileID, userID, name); err != nil {
+		t.Fatalf("insert profile: %v", err)
+	}
+	return userID, profileID
+}
+
+func countRows(t *testing.T, pool *pgxpool.Pool, query string, args ...any) int {
+	t.Helper()
+	var n int
+	if err := pool.QueryRow(context.Background(), query, args...).Scan(&n); err != nil {
+		t.Fatalf("count rows: %v", err)
+	}
+	return n
+}
+
+// ClearTasteProfile keeps the profile's row, with its signal counts and no
+// vector, and drops its clusters and cached rows, leaving global rows and
+// other profiles alone. The row can still be marked stale, and similar-user
+// search neither finds the cleared profile nor runs for it.
+func TestClearTasteProfileKeepsTheRowAndDropsPersonalStatePostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	repo := NewRepo(pool)
+	userID, cleared := newTasteTestAccount(t, pool, "taste-clear-")
+	const kept = "kept"
+	peerID, peer := newTasteTestAccount(t, pool, "taste-clear-peer-")
+
+	started, err := repo.Now(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	vec := axisVector(1500, nil)
+	expires := time.Now().Add(time.Hour).Format(time.RFC3339)
+	items := []ScoredItem{{MediaItemID: "item", Score: 1}}
+	personalRows := []struct{ recType, source string }{
+		{RecTypeForYouMain, ""},
+		{RecTypeForYouClusterPrefix + "0", ""},
+		{RecTypeSimilarUsersLiked, ""},
+		{RecTypeBecauseWatched, "anchor"},
+	}
+	for _, profile := range []string{cleared, kept} {
+		if err := repo.UpsertTasteProfile(ctx, userID, profile, vec, map[string]int{"watch_high": 3}, "", started.Add(-time.Hour)); err != nil {
+			t.Fatal(err)
+		}
+		if err := repo.UpsertTasteClusters(ctx, userID, profile, []TasteCluster{{ClusterIdx: 0, Embedding: vec, Label: "Drama", MemberCount: 1, TotalWeight: 1}}); err != nil {
+			t.Fatal(err)
+		}
+		for _, row := range personalRows {
+			if err := repo.UpsertRecommendationCache(ctx, userID, profile, row.recType, row.source, items, expires); err != nil {
+				t.Fatal(err)
+			}
+		}
+	}
+	if err := repo.UpsertTasteProfile(ctx, peerID, peer, vec, map[string]int{"watch_high": 3}, "", started); err != nil {
+		t.Fatal(err)
+	}
+	globalType := "test_clear_global_" + uuid.NewString()
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM recommendation_cache WHERE user_id IS NULL AND rec_type = $1`, globalType)
+	})
+	if err := repo.UpsertRecommendationCache(ctx, GlobalCacheUserID, GlobalCacheProfileID, globalType, "", items, expires); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := repo.ClearTasteProfile(ctx, userID, cleared, map[string]int{"watch_low": 1}, "PG-13", started, true); err != nil {
+		t.Fatalf("clear taste profile: %v", err)
+	}
+
+	if emb, err := repo.GetTasteProfile(ctx, userID, cleared); err != nil || emb != nil {
+		t.Fatalf("cleared taste vector = %d dims, %v; want none", len(emb), err)
+	}
+	var vectorIsNull bool
+	var updatedAt time.Time
+	if err := pool.QueryRow(ctx, `SELECT embedding IS NULL, updated_at FROM user_taste_profiles WHERE user_id = $1 AND profile_id = $2`, userID, cleared).Scan(&vectorIsNull, &updatedAt); err != nil {
+		t.Fatalf("read cleared row: %v", err)
+	}
+	if !vectorIsNull || !updatedAt.Equal(started) {
+		t.Fatalf("cleared row: vector null = %v, updated_at = %v; want null and %v", vectorIsNull, updatedAt, started)
+	}
+	meta, err := repo.GetTasteProfileMeta(ctx, userID, cleared)
+	if err != nil || meta == nil || !maps.Equal(meta.SignalCounts, map[string]int{"watch_low": 1}) || meta.MaxContentRating != "PG-13" {
+		t.Fatalf("cleared meta = %+v, %v", meta, err)
+	}
+	if n := countRows(t, pool, `SELECT COUNT(*) FROM user_taste_clusters WHERE user_id = $1 AND profile_id = $2`, userID, cleared); n != 0 {
+		t.Fatalf("cleared profile keeps %d clusters", n)
+	}
+	if n := countRows(t, pool, `SELECT COUNT(*) FROM recommendation_cache WHERE user_id = $1 AND profile_id = $2`, userID, cleared); n != 0 {
+		t.Fatalf("cleared profile keeps %d cached rows", n)
+	}
+
+	// Other profiles and the global rows are untouched.
+	if emb, err := repo.GetTasteProfile(ctx, userID, kept); err != nil || emb == nil {
+		t.Fatalf("other profile's vector = %v, %v", emb, err)
+	}
+	if n := countRows(t, pool, `SELECT COUNT(*) FROM user_taste_clusters WHERE user_id = $1 AND profile_id = $2`, userID, kept); n != 1 {
+		t.Fatalf("other profile has %d clusters, want 1", n)
+	}
+	if n := countRows(t, pool, `SELECT COUNT(*) FROM recommendation_cache WHERE user_id = $1 AND profile_id = $2`, userID, kept); n != len(personalRows) {
+		t.Fatalf("other profile has %d cached rows, want %d", n, len(personalRows))
+	}
+	if got, err := repo.GetRecommendationCache(ctx, GlobalCacheUserID, GlobalCacheProfileID, globalType, ""); err != nil || len(got) != 1 {
+		t.Fatalf("global row = %v, %v", got, err)
+	}
+
+	// The kept row still takes stale marks.
+	if err := repo.MarkProfileStale(ctx, userID, cleared); err != nil {
+		t.Fatal(err)
+	}
+	if n := countRows(t, pool, `SELECT COUNT(*) FROM user_taste_profiles WHERE user_id = $1 AND profile_id = $2 AND stale_at > updated_at`, userID, cleared); n != 1 {
+		t.Fatal("cleared profile could not be marked stale")
+	}
+
+	// Similar-user search skips the cleared profile and does not run for it.
+	similar, err := repo.FindSimilarUsers(ctx, peerID, peer, "", 50)
+	if err != nil {
+		t.Fatalf("similar users next to a cleared profile: %v", err)
+	}
+	var foundKept bool
+	for _, u := range similar {
+		if u.UserID == userID && u.ProfileID == cleared {
+			t.Fatal("similar-user search returned the cleared profile")
+		}
+		foundKept = foundKept || (u.UserID == userID && u.ProfileID == kept)
+	}
+	if !foundKept {
+		t.Fatalf("similar users = %+v, want the kept profile", similar)
+	}
+	if similar, err := repo.FindSimilarUsers(ctx, userID, cleared, "", 50); err != nil || similar != nil {
+		t.Fatalf("similar users of the cleared profile = %v, %v; want none", similar, err)
+	}
+
+	// A profile with no row yet gets one, so later changes can mark it.
+	const fresh = "fresh"
+	if err := repo.ClearTasteProfile(ctx, userID, fresh, map[string]int{}, "", started, true); err != nil {
+		t.Fatal(err)
+	}
+	if meta, err := repo.GetTasteProfileMeta(ctx, userID, fresh); err != nil || meta == nil || len(meta.SignalCounts) != 0 {
+		t.Fatalf("fresh profile meta = %+v, %v; want an empty row", meta, err)
+	}
+
+	// Without create an existing row is still cleared, but a missing one is
+	// not created, while the profile's clusters and cached rows still go.
+	if err := repo.ClearTasteProfile(ctx, userID, fresh, map[string]int{"rated_low": 2}, "", started, false); err != nil {
+		t.Fatal(err)
+	}
+	if meta, err := repo.GetTasteProfileMeta(ctx, userID, fresh); err != nil || meta == nil || meta.SignalCounts["rated_low"] != 2 {
+		t.Fatalf("fresh profile meta = %+v, %v; want the existing row updated", meta, err)
+	}
+	const gone = "gone"
+	if err := repo.UpsertTasteClusters(ctx, userID, gone, []TasteCluster{{ClusterIdx: 0, Embedding: vec, Label: "Drama", MemberCount: 1, TotalWeight: 1}}); err != nil {
+		t.Fatal(err)
+	}
+	if err := repo.UpsertRecommendationCache(ctx, userID, gone, RecTypeForYouMain, "", items, expires); err != nil {
+		t.Fatal(err)
+	}
+	if err := repo.ClearTasteProfile(ctx, userID, gone, map[string]int{"rated_low": 1}, "", started, false); err != nil {
+		t.Fatal(err)
+	}
+	if meta, err := repo.GetTasteProfileMeta(ctx, userID, gone); err != nil || meta != nil {
+		t.Fatalf("meta without create = %+v, %v; want no row", meta, err)
+	}
+	if n := countRows(t, pool, `SELECT COUNT(*) FROM user_taste_clusters WHERE user_id = $1 AND profile_id = $2`, userID, gone); n != 0 {
+		t.Fatalf("profile cleared without create keeps %d clusters", n)
+	}
+	if n := countRows(t, pool, `SELECT COUNT(*) FROM recommendation_cache WHERE user_id = $1 AND profile_id = $2`, userID, gone); n != 0 {
+		t.Fatalf("profile cleared without create keeps %d cached rows", n)
+	}
+}
+
+// deletingStoreProvider deletes a profile, and purges its recommendation
+// state as the profile handler does, right after the first time a refresh
+// checks that the profile exists: the deletion lands between that check and
+// the refresh's writes.
+type deletingStoreProvider struct {
+	userstore.UserStoreProvider
+	repo    *Repo
+	userID  int
+	profile string
+	checks  int
+}
+
+func (p *deletingStoreProvider) ForUser(ctx context.Context, userID int) (userstore.UserStore, error) {
+	store, err := p.UserStoreProvider.ForUser(ctx, userID)
+	if err != nil {
+		return nil, err
+	}
+	return deletingStore{UserStore: store, p: p}, nil
+}
+
+type deletingStore struct {
+	userstore.UserStore
+	p *deletingStoreProvider
+}
+
+func (s deletingStore) GetProfile(ctx context.Context, profileID string) (*userstore.Profile, error) {
+	profile, err := s.UserStore.GetProfile(ctx, profileID)
+	s.p.checks++
+	if err != nil || s.p.checks > 1 || profileID != s.p.profile {
+		return profile, err
+	}
+	if err := s.DeleteProfile(ctx, profileID); err != nil {
+		return nil, err
+	}
+	return profile, s.p.repo.PurgeProfile(ctx, s.p.userID, profileID)
+}
+
+// A profile deleted after a refresh checked that it exists, and purged before
+// the refresh wrote, does not keep the taste row the refresh then writes: the
+// refresh checks again after its last write and purges what it wrote.
+func TestRefreshPurgesAProfileDeletedWhileItWritesPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	const prefix = "ttaste-racing-"
+	cleanupRecoMediaItems(t, pool, prefix)
+	userID, _ := newTasteTestAccount(t, pool, prefix)
+	movie := prefix + "movie"
+	seedRecoMediaItem(t, pool, movie, "movie", "matched")
+	repo := NewRepo(pool)
+	if err := repo.UpsertEmbedding(ctx, movie, axisVector(1750, nil), "test-model", movie); err != nil {
+		t.Fatal(err)
+	}
+	racing := uuid.NewString()
+	if _, err := pool.Exec(ctx, `INSERT INTO user_profiles(id, user_id, name) VALUES($1, $2, 'racing')`, racing, userID); err != nil {
+		t.Fatal(err)
+	}
+	for range 2 {
+		if _, err := pool.Exec(ctx, `
+			INSERT INTO user_watch_history(id, user_id, profile_id, media_item_id, duration_seconds, completed)
+			VALUES(gen_random_uuid()::text, $1, $2, $3, 5400, true)`, userID, racing, movie); err != nil {
+			t.Fatal(err)
+		}
+	}
+	provider := &deletingStoreProvider{UserStoreProvider: pgstore.NewPostgresProvider(pool), repo: repo, userID: userID, profile: racing}
+	engine := NewEngine(pool, catalog.NewRatingsRepo(pool), catalog.NewItemRepository(pool), nil, provider, config.RecommendationsConfig{})
+
+	stored, err := engine.refreshTasteProfile(ctx, userID, racing)
+	if err != nil || !stored {
+		t.Fatalf("refresh = %v, %v; want a stored vector the recheck then purges", stored, err)
+	}
+	if provider.checks != 2 {
+		t.Fatalf("existence checks = %d, want one before the writes and one after", provider.checks)
+	}
+	if n := countRows(t, pool, `SELECT COUNT(*) FROM user_taste_profiles WHERE user_id = $1 AND profile_id = $2`, userID, racing); n != 0 {
+		t.Fatalf("profile deleted during its refresh has %d taste rows, want none", n)
+	}
+}
+
+// The cache job likewise purges the rows it wrote for a profile deleted
+// after its build checked that the profile exists.
+func TestCacheJobPurgesAProfileDeletedWhileItWritesPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	const prefix = "ttaste-cache-racing-"
+	userID, _ := newTasteTestAccount(t, pool, prefix)
+	repo := NewRepo(pool)
+	racing := uuid.NewString()
+	if _, err := pool.Exec(ctx, `INSERT INTO user_profiles(id, user_id, name) VALUES($1, $2, 'racing')`, racing, userID); err != nil {
+		t.Fatal(err)
+	}
+	provider := &deletingStoreProvider{UserStoreProvider: pgstore.NewPostgresProvider(pool), repo: repo, userID: userID, profile: racing}
+	w := newJobTestWorker(&fakeLocker{}, nil)
+	w.engine = NewEngine(pool, catalog.NewRatingsRepo(pool), catalog.NewItemRepository(pool), nil, provider, config.RecommendationsConfig{})
+
+	built := w.cacheProfileRows(ctx, repo, userID, racing, cacheExpiry(time.Now()))
+	if built.failed != 0 || built.cached == 0 {
+		t.Fatalf("build = %+v; want rows written, then purged", built)
+	}
+	if provider.checks != 2 {
+		t.Fatalf("existence checks = %d, want one before the writes and one after", provider.checks)
+	}
+	if n := countRows(t, pool, `SELECT COUNT(*) FROM recommendation_cache WHERE user_id = $1 AND profile_id = $2`, userID, racing); n != 0 {
+		t.Fatalf("profile deleted during its cache build has %d cached rows, want none", n)
+	}
+}
+
+// A refresh that runs after its profile was deleted, as a queued one can,
+// writes no taste row: not from no signal, and not from a rewatch in the
+// watch history the deletion keeps. A row left behind loses its vector and
+// clusters. A live profile with no signal still gets its row.
+func TestRefreshWritesNoTasteRowForADeletedProfilePostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	const prefix = "ttaste-deleted-"
+	cleanupRecoMediaItems(t, pool, prefix)
+	userID, live := newTasteTestAccount(t, pool, prefix)
+	movie := prefix + "movie"
+	seedRecoMediaItem(t, pool, movie, "movie", "matched")
+	repo := NewRepo(pool)
+	vec := axisVector(1750, nil)
+	if err := repo.UpsertEmbedding(ctx, movie, vec, "test-model", movie); err != nil {
+		t.Fatal(err)
+	}
+	provider := pgstore.NewPostgresProvider(pool)
+	engine := NewEngine(pool, catalog.NewRatingsRepo(pool), catalog.NewItemRepository(pool), nil, provider, config.RecommendationsConfig{})
+
+	gone := uuid.NewString()
+	if _, err := pool.Exec(ctx, `INSERT INTO user_profiles(id, user_id, name) VALUES($1, $2, 'gone')`, gone, userID); err != nil {
+		t.Fatal(err)
+	}
+	store, err := provider.ForUser(ctx, userID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := store.DeleteProfile(ctx, gone); err != nil {
+		t.Fatal(err)
+	}
+
+	refresh := func(profile string) {
+		t.Helper()
+		if stored, err := engine.refreshTasteProfile(ctx, userID, profile); err != nil || stored {
+			t.Fatalf("refresh of %s stored a vector = %v, %v; want none", profile, stored, err)
+		}
+	}
+	tasteRows := func(profile string) int {
+		t.Helper()
+		return countRows(t, pool, `SELECT COUNT(*) FROM user_taste_profiles WHERE user_id = $1 AND profile_id = $2`, userID, profile)
+	}
+
+	refresh(gone)
+	if n := tasteRows(gone); n != 0 {
+		t.Fatalf("deleted profile with no signal has %d taste rows, want none", n)
+	}
+
+	for range 2 {
+		if _, err := pool.Exec(ctx, `
+			INSERT INTO user_watch_history(id, user_id, profile_id, media_item_id, duration_seconds, completed)
+			VALUES(gen_random_uuid()::text, $1, $2, $3, 5400, true)`, userID, gone, movie); err != nil {
+			t.Fatal(err)
+		}
+	}
+	refresh(gone)
+	if n := tasteRows(gone); n != 0 {
+		t.Fatalf("deleted profile with a rewatch has %d taste rows, want none", n)
+	}
+
+	started, err := repo.Now(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := repo.UpsertTasteProfile(ctx, userID, gone, vec, map[string]int{"rewatch": 1}, "", started); err != nil {
+		t.Fatal(err)
+	}
+	if err := repo.UpsertTasteClusters(ctx, userID, gone, []TasteCluster{{ClusterIdx: 0, Embedding: vec, Label: "Drama", MemberCount: 1, TotalWeight: 1}}); err != nil {
+		t.Fatal(err)
+	}
+	refresh(gone)
+	if emb, err := repo.GetTasteProfile(ctx, userID, gone); err != nil || emb != nil {
+		t.Fatalf("leftover taste vector = %d dims, %v; want it cleared", len(emb), err)
+	}
+	if n := countRows(t, pool, `SELECT COUNT(*) FROM user_taste_clusters WHERE user_id = $1 AND profile_id = $2`, userID, gone); n != 0 {
+		t.Fatalf("leftover profile keeps %d clusters", n)
+	}
+
+	refresh(live)
+	if meta, err := repo.GetTasteProfileMeta(ctx, userID, live); err != nil || meta == nil || len(meta.SignalCounts) != 1 || meta.SignalCounts[signalCountPositiveTitles] != 0 {
+		t.Fatalf("live profile meta = %+v, %v; want a row with no positive titles", meta, err)
+	}
+}
+
+// A refresh that finds no positive signal clears the taste vector an earlier
+// refresh stored, with its clusters and cached rows, and records the signal
+// counts it did find.
+func TestRefreshClearsATasteProfileWithNoPositiveSignalPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	const prefix = "ttaste-negative-"
+	cleanupRecoMediaItems(t, pool, prefix)
+	userID, profile := newTasteTestAccount(t, pool, prefix)
+	movie := prefix + "movie"
+	seedRecoMediaItem(t, pool, movie, "movie", "matched")
+	repo := NewRepo(pool)
+	if err := repo.UpsertEmbedding(ctx, movie, axisVector(1700, nil), "test-model", movie); err != nil {
+		t.Fatal(err)
+	}
+	engine := newTasteTestEngine(pool)
+	rate := func(stars int) {
+		t.Helper()
+		if _, err := pool.Exec(ctx, `
+			INSERT INTO user_ratings(user_id, profile_id, media_item_id, rating) VALUES($1, $2, $3, $4)
+			ON CONFLICT (user_id, profile_id, media_item_id) DO UPDATE SET rating = EXCLUDED.rating, rated_at = NOW()`,
+			userID, profile, movie, stars); err != nil {
+			t.Fatal(err)
+		}
+	}
+	refresh := func(wantVector bool, wantCounts map[string]int) {
+		t.Helper()
+		stored, err := engine.refreshTasteProfile(ctx, userID, profile)
+		if err != nil || stored != wantVector {
+			t.Fatalf("refresh stored a vector = %v, %v; want %v", stored, err, wantVector)
+		}
+		emb, err := repo.GetTasteProfile(ctx, userID, profile)
+		if err != nil || (emb != nil) != wantVector {
+			t.Fatalf("taste vector = %d dims, %v; want present = %v", len(emb), err, wantVector)
+		}
+		meta, err := repo.GetTasteProfileMeta(ctx, userID, profile)
+		if err != nil || meta == nil || !maps.Equal(meta.SignalCounts, wantCounts) {
+			t.Fatalf("meta = %+v, %v; want counts %v", meta, err, wantCounts)
+		}
+	}
+
+	rate(5)
+	refresh(true, map[string]int{"rated_5": 1, signalCountPositiveTitles: 1})
+	if n := countRows(t, pool, `SELECT COUNT(*) FROM user_taste_clusters WHERE user_id = $1 AND profile_id = $2`, userID, profile); n != 1 {
+		t.Fatalf("clusters after a positive refresh = %d, want 1", n)
+	}
+	if err := repo.UpsertRecommendationCache(ctx, userID, profile, RecTypeForYouMain, "", []ScoredItem{{MediaItemID: "x", Score: 1}}, time.Now().Add(time.Hour).Format(time.RFC3339)); err != nil {
+		t.Fatal(err)
+	}
+
+	rate(1)
+	refresh(false, map[string]int{"rated_low": 1, signalCountPositiveTitles: 0})
+	if n := countRows(t, pool, `SELECT COUNT(*) FROM user_taste_clusters WHERE user_id = $1 AND profile_id = $2`, userID, profile); n != 0 {
+		t.Fatalf("clusters after a negative-only refresh = %d, want none", n)
+	}
+	if n := countRows(t, pool, `SELECT COUNT(*) FROM recommendation_cache WHERE user_id = $1 AND profile_id = $2`, userID, profile); n != 0 {
+		t.Fatalf("cached rows after a negative-only refresh = %d, want none", n)
+	}
+
+	// Removing the last signal also leaves a cleared row behind.
+	if _, err := pool.Exec(ctx, `DELETE FROM user_ratings WHERE user_id = $1 AND profile_id = $2`, userID, profile); err != nil {
+		t.Fatal(err)
+	}
+	refresh(false, map[string]int{signalCountPositiveTitles: 0})
+}
+
+// newTasteTestEngine is an engine over pool with the Postgres user store.
+func newTasteTestEngine(pool *pgxpool.Pool) *Engine {
+	return NewEngine(pool, catalog.NewRatingsRepo(pool), catalog.NewItemRepository(pool), nil, pgstore.NewPostgresProvider(pool), config.RecommendationsConfig{})
+}
+
+// A refresh records the profile's positive titles, each once however many
+// signals it has, and the cold-start level follows them: three taste-seed
+// picks are level 2, a single title rated, favorited and finished or a
+// single long series is level 1, and a profile of watchlist adds, or of
+// titles with no embedding yet, is level 0. The taste-profile summary leaves
+// the count out.
+func TestRefreshCountsPositiveTitlesForTheLevelPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	const prefix = "ttaste-level-"
+	cleanupRecoMediaItems(t, pool, prefix)
+	repo := NewRepo(pool)
+	engine := newTasteTestEngine(pool)
+
+	movies := make([]string, 6)
+	for i := range movies {
+		movies[i] = fmt.Sprintf("%smovie-%d", prefix, i)
+		seedRecoMediaItem(t, pool, movies[i], "movie", "matched")
+		if err := repo.UpsertEmbedding(ctx, movies[i], axisVector(1800+i, nil), "test-model", movies[i]); err != nil {
+			t.Fatal(err)
+		}
+	}
+	unembedded := prefix + "movie-unembedded"
+	seedRecoMediaItem(t, pool, unembedded, "movie", "matched")
+	series := prefix + "series"
+	seedRecoMediaItem(t, pool, series, "series", "matched")
+	if err := repo.UpsertEmbedding(ctx, series, axisVector(1810, nil), "test-model", series); err != nil {
+		t.Fatal(err)
+	}
+	episodes := make([]string, 15)
+	for i := range episodes {
+		episodes[i] = fmt.Sprintf("%sepisode-%02d", prefix, i)
+		if _, err := pool.Exec(ctx, `INSERT INTO episodes(content_id, series_id, season_number, episode_number, title) VALUES($1, $2, 1, $3, 'Episode')`, episodes[i], series, i+1); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	exec := func(query string, args ...any) {
+		t.Helper()
+		if _, err := pool.Exec(ctx, query, args...); err != nil {
+			t.Fatal(err)
+		}
+	}
+	favorite := func(userID int, profile string, ids ...string) {
+		for _, id := range ids {
+			exec(`INSERT INTO user_favorites(user_id, profile_id, media_item_id) VALUES($1, $2, $3)`, userID, profile, id)
+		}
+	}
+	watchlist := func(userID int, profile string, ids ...string) {
+		for _, id := range ids {
+			exec(`INSERT INTO user_watchlist(user_id, profile_id, media_item_id) VALUES($1, $2, $3)`, userID, profile, id)
+		}
+	}
+	finish := func(userID int, profile string, ids ...string) {
+		for _, id := range ids {
+			exec(`INSERT INTO user_watch_progress(user_id, profile_id, media_item_id, completed, updated_at) VALUES($1, $2, $3, true, NOW())`, userID, profile, id)
+		}
+	}
+
+	for _, tc := range []struct {
+		name       string
+		seed       func(userID int, profile string)
+		wantVector bool
+		wantCounts map[string]int
+		wantLevel  int
+	}{
+		{
+			name:       "three taste-seed picks",
+			seed:       func(u int, p string) { favorite(u, p, movies[0], movies[1], movies[2]) },
+			wantVector: true,
+			wantCounts: map[string]int{"favorited": 3, signalCountPositiveTitles: 3},
+			wantLevel:  2,
+		},
+		{
+			name: "one title rated, favorited and finished",
+			seed: func(u int, p string) {
+				exec(`INSERT INTO user_ratings(user_id, profile_id, media_item_id, rating) VALUES($1, $2, $3, 5)`, u, p, movies[3])
+				favorite(u, p, movies[3])
+				finish(u, p, movies[3])
+			},
+			wantVector: true,
+			wantCounts: map[string]int{"rated_5": 1, "favorited": 1, "watch_high": 1, signalCountPositiveTitles: 1},
+			wantLevel:  1,
+		},
+		{
+			name: "one long series with two favorited episodes",
+			seed: func(u int, p string) {
+				finish(u, p, episodes...)
+				favorite(u, p, episodes[0], episodes[1])
+			},
+			wantVector: true,
+			wantCounts: map[string]int{"watch_high": 1, "favorited": 1, signalCountPositiveTitles: 1},
+			wantLevel:  1,
+		},
+		{
+			name:       "watchlist only",
+			seed:       func(u int, p string) { watchlist(u, p, movies[3], movies[4], movies[5]) },
+			wantVector: true,
+			wantCounts: map[string]int{"watchlist": 3, signalCountPositiveTitles: 0},
+			wantLevel:  0,
+		},
+		{
+			name:       "a pick with no embedding yet",
+			seed:       func(u int, p string) { favorite(u, p, unembedded) },
+			wantVector: false,
+			wantCounts: map[string]int{"favorited": 1, signalCountPositiveTitles: 0},
+			wantLevel:  0,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			userID, profile := newTasteTestAccount(t, pool, prefix)
+			tc.seed(userID, profile)
+			stored, err := engine.refreshTasteProfile(ctx, userID, profile)
+			if err != nil || stored != tc.wantVector {
+				t.Fatalf("refresh stored a vector = %v, %v; want %v", stored, err, tc.wantVector)
+			}
+			meta, err := repo.GetTasteProfileMeta(ctx, userID, profile)
+			if err != nil || meta == nil || !maps.Equal(meta.SignalCounts, tc.wantCounts) {
+				t.Fatalf("meta = %+v, %v; want counts %v", meta, err, tc.wantCounts)
+			}
+			if got := coldStartLevelOf(meta); got != tc.wantLevel {
+				t.Fatalf("level = %d, want %d", got, tc.wantLevel)
+			}
+			summary, err := engine.GetTasteProfileSummary(ctx, userID, profile)
+			if err != nil {
+				t.Fatal(err)
+			}
+			wantSummary := maps.Clone(tc.wantCounts)
+			delete(wantSummary, signalCountPositiveTitles)
+			if !maps.Equal(summary.SignalCounts, wantSummary) {
+				t.Fatalf("summary counts = %v, want %v", summary.SignalCounts, wantSummary)
+			}
+		})
+	}
+}
+
+// A 3-star completion pulls the taste vector less than an unrated
+// completion, where it used to pull more.
+func TestRefreshWeighsAThreeStarCompletionBelowAnUnratedOnePostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	const prefix = "ttaste-meh-"
+	cleanupRecoMediaItems(t, pool, prefix)
+	repo := NewRepo(pool)
+	userID, profile := newTasteTestAccount(t, pool, prefix)
+	meh, plain := prefix+"meh", prefix+"plain"
+	for i, id := range []string{meh, plain} {
+		seedRecoMediaItem(t, pool, id, "movie", "matched")
+		if err := repo.UpsertEmbedding(ctx, id, axisVector(1820+i, nil), "test-model", id); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := pool.Exec(ctx, `INSERT INTO user_watch_progress(user_id, profile_id, media_item_id, completed, updated_at) VALUES($1, $2, $3, true, NOW())`, userID, profile, id); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if _, err := pool.Exec(ctx, `INSERT INTO user_ratings(user_id, profile_id, media_item_id, rating) VALUES($1, $2, $3, 3)`, userID, profile, meh); err != nil {
+		t.Fatal(err)
+	}
+
+	if stored, err := newTasteTestEngine(pool).refreshTasteProfile(ctx, userID, profile); err != nil || !stored {
+		t.Fatalf("refresh stored a vector = %v, %v", stored, err)
+	}
+	vec, err := repo.GetTasteProfile(ctx, userID, profile)
+	if err != nil || vec == nil {
+		t.Fatalf("taste vector = %v, %v", vec, err)
+	}
+	if mehPull, plainPull := vec[1820], vec[1821]; !(mehPull > 0 && mehPull < plainPull) {
+		t.Fatalf("pull of the 3-star completion = %v, of the unrated one = %v; want 0 < 3-star < unrated", mehPull, plainPull)
+	}
+	meta, err := repo.GetTasteProfileMeta(ctx, userID, profile)
+	if err != nil || meta == nil || meta.SignalCounts["rated_3"] != 1 || meta.SignalCounts[signalCountPositiveTitles] != 2 {
+		t.Fatalf("meta = %+v, %v; want rated_3 counted and both titles positive", meta, err)
+	}
+}
+
+// The taste card's genres are the clusters' genres, taken in turns from the
+// heaviest cluster down, so a second interest shows even when the heaviest
+// cluster has genres to fill the card.
+func TestClusterTopGenresTakeTurnsAcrossClusters(t *testing.T) {
+	horror := TasteCluster{ClusterIdx: 0, DominantGenres: []string{"Horror", "Thriller", "Mystery"}, TotalWeight: 12}
+	romance := TasteCluster{ClusterIdx: 1, DominantGenres: []string{"Romance", "Comedy", "Drama"}, TotalWeight: 13}
+	horrorComedy := TasteCluster{ClusterIdx: 2, DominantGenres: []string{"Horror", "Comedy"}, TotalWeight: 5}
+	for _, tc := range []struct {
+		name     string
+		clusters []TasteCluster
+		want     []string
+	}{
+		{"two interests", []TasteCluster{horror, romance}, []string{"Romance", "Horror", "Comedy", "Thriller", "Drama"}},
+		{"a repeated genre counts once", []TasteCluster{horror, romance, horrorComedy}, []string{"Romance", "Horror", "Comedy", "Thriller", "Drama"}},
+		{"one cluster", []TasteCluster{horrorComedy}, []string{"Horror", "Comedy"}},
+		{"no clusters", nil, []string{}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := clusterTopGenres(tc.clusters, summaryTopGenres); !slices.Equal(got, tc.want) {
+				t.Fatalf("genres = %v, want %v", got, tc.want)
+			}
+		})
+	}
+}
+
+// The taste-profile summary takes its genres from the profile's clusters,
+// so a profile that never rated or favorited a title still has them.
+func TestTasteProfileSummaryGenresComeFromTheClustersPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	repo := NewRepo(pool)
+	userID, profile := newTasteTestAccount(t, pool, "ttaste-card-")
+	taste := axisVector(1830, nil)
+	if err := repo.UpsertTasteProfile(ctx, userID, profile, taste, map[string]int{"watch_high": 25, signalCountPositiveTitles: 25}, "", time.Now()); err != nil {
+		t.Fatal(err)
+	}
+	if err := repo.UpsertTasteClusters(ctx, userID, profile, []TasteCluster{
+		{ClusterIdx: 0, Embedding: taste, DominantGenres: []string{"Horror", "Thriller"}, Label: "Horror", MemberCount: 12, TotalWeight: 9},
+		{ClusterIdx: 1, Embedding: taste, DominantGenres: []string{"Romance", "Comedy"}, Label: "Romance", MemberCount: 13, TotalWeight: 10},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	summary, err := newTasteTestEngine(pool).GetTasteProfileSummary(ctx, userID, profile)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if want := []string{"Romance", "Horror", "Comedy", "Thriller"}; !slices.Equal(summary.TopGenres, want) {
+		t.Fatalf("top genres = %v, want %v", summary.TopGenres, want)
+	}
+}
diff --git a/internal/recommendations/theme_neighbors_postgres_test.go b/internal/recommendations/theme_neighbors_postgres_test.go
new file mode 100644
index 0000000000..d9392529e5
--- /dev/null
+++ b/internal/recommendations/theme_neighbors_postgres_test.go
@@ -0,0 +1,64 @@
+package recommendations
+
+import (
+	"slices"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/access"
+	"github.com/prairie-server/prairie-server/internal/catalog"
+)
+
+// ThemeNeighbors returns the movies and series at least as close to the
+// seeds' shared theme as a typical seed, nearest first: not the seeds, not
+// farther titles, not other media types, and not titles the viewer cannot see.
+func TestThemeNeighborsStopsAtTheMedianSeedPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	const prefix = "tthemenb-"
+	const axis = 2900
+	cleanupRecoMediaItems(t, pool, prefix)
+	repo := NewRepo(pool)
+	seed := func(id, mediaType, rating string, age int, nudges map[int]float32) string {
+		id = prefix + id
+		seedRecoMediaItem(t, pool, id, mediaType, "matched")
+		if _, err := pool.Exec(ctx, `UPDATE media_items SET content_rating = $2, content_rating_age = $3 WHERE content_id = $1`, id, rating, age); err != nil {
+			t.Fatal(err)
+		}
+		if err := repo.UpsertEmbedding(ctx, id, axisVector(axis, nudges), "test-model", id); err != nil {
+			t.Fatal(err)
+		}
+		return id
+	}
+	// Four seeds, each pulled off the theme axis in its own direction, so
+	// their average sits on the axis and each lies the same distance from it.
+	var seeds []string
+	for i := range 4 {
+		seeds = append(seeds, seed("seed-"+string(rune('a'+i)), "movie", "PG", 8, map[int]float32{axis + 1 + i: 0.3}))
+	}
+	nearest := seed("nearest", "movie", "PG", 8, map[int]float32{axis + 10: 0.05})
+	nearShow := seed("near-show", "series", "TV-PG", 8, map[int]float32{axis + 10: 0.15})
+	nearR := seed("near-r", "movie", "R", 17, map[int]float32{axis + 10: 0.1})
+	seed("near-audiobook", "audiobook", "", 0, map[int]float32{axis + 10: 0.02})
+	seed("far", "movie", "PG", 8, map[int]float32{axis + 11: 0.6})
+
+	got, err := repo.ThemeNeighbors(ctx, seeds, 50, catalog.AccessFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if ids := prefixed(got, prefix); !slices.Equal(ids, []string{nearest, nearR, nearShow}) {
+		t.Fatalf("neighbors = %v, want %v", ids, []string{nearest, nearR, nearShow})
+	}
+
+	restricted, err := repo.ThemeNeighbors(ctx, seeds, 50, catalog.AccessFilter{MaturityLimits: access.MaturityLimits{MaxContentRating: "PG"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if ids := prefixed(restricted, prefix); !slices.Equal(ids, []string{nearest, nearShow}) {
+		t.Fatalf("PG neighbors = %v, want %v", ids, []string{nearest, nearShow})
+	}
+
+	tooFew, err := repo.ThemeNeighbors(ctx, seeds[:ThemeMinSeeds-1], 50, catalog.AccessFilter{})
+	if err != nil || len(tooFew) != 0 {
+		t.Fatalf("with %d seeds: %v, %v; want nothing", ThemeMinSeeds-1, tooFew, err)
+	}
+}
diff --git a/internal/recommendations/title_counts.go b/internal/recommendations/title_counts.go
new file mode 100644
index 0000000000..7d6f5e59d5
--- /dev/null
+++ b/internal/recommendations/title_counts.go
@@ -0,0 +1,159 @@
+package recommendations
+
+import (
+	"context"
+	"crypto/sha256"
+	"fmt"
+	"log/slog"
+	"sync"
+	"time"
+
+	"golang.org/x/sync/singleflight"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+)
+
+// titleCountTTL is how long Highly Rated reuses one access scope's title
+// counts. The counts only set how the media types interleave, and counting
+// reads every title the scope admits, which a large catalog makes too slow
+// to repeat on every Discover read.
+const titleCountTTL = 10 * time.Minute
+
+// titleCountCacheMax bounds the scopes held; a full cache starts over.
+const titleCountCacheMax = 1024
+
+// titleCountTimeout bounds a shared count, which runs detached from the
+// request that started it so the others waiting on it are not canceled with
+// that request.
+const titleCountTimeout = 30 * time.Second
+
+// titleCountRetry is how long a scope whose count failed reuses its
+// fallback before counting again, so a count that keeps failing does not
+// hold up every read.
+const titleCountRetry = time.Minute
+
+// titleCountCache holds, per access scope, the title counts countTitlesByType
+// last read. Each server keeps its own.
+type titleCountCache struct {
+	mu      sync.Mutex
+	entries map[[sha256.Size]byte]titleCountEntry
+	// counting runs one count per scope at a time; reads that miss while it
+	// runs wait for its result rather than each counting the catalog.
+	counting singleflight.Group
+}
+
+type titleCountEntry struct {
+	counts  []int64
+	expires time.Time
+}
+
+func newTitleCountCache() *titleCountCache {
+	return &titleCountCache{entries: map[[sha256.Size]byte]titleCountEntry{}}
+}
+
+// titleCounter counts the titles of each recommendableMediaTypes entry
+// filter admits, in that order.
+type titleCounter func(ctx context.Context, filter catalog.AccessFilter) ([]int64, error)
+
+// get returns filter's title counts by type. The counts only set how
+// Highly Rated interleaves the media types, so a read never fails or waits
+// on them for long:
+//   - fresh counts are returned as they are;
+//   - expired counts are returned at once while a count refreshes them in
+//     the background;
+//   - with no counts yet, the read waits for a count, or until its context
+//     ends;
+//   - a count that fails or is not waited for gives the scope's last counts,
+//     or equal weights when it has none, and a failed count is retried
+//     after titleCountRetry.
+//
+// A nil cache counts on every read.
+func (c *titleCountCache) get(ctx context.Context, filter catalog.AccessFilter, count titleCounter) []int64 {
+	if c == nil {
+		counts, err := count(ctx, filter)
+		if err != nil {
+			slog.WarnContext(ctx, "counting titles for Highly Rated failed; weighing media types equally", "component", "recommendations", "error", err)
+			return equalTitleCounts()
+		}
+		return counts
+	}
+	key := titleCountKey(filter)
+	counts, fresh, ok := c.lookup(key)
+	if fresh {
+		return counts
+	}
+	result := c.counting.DoChan(string(key[:]), func() (any, error) {
+		// A count that finished between the lookup above and this call
+		// already stored its result.
+		if counts, fresh, _ := c.lookup(key); fresh {
+			return counts, nil
+		}
+		countCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), titleCountTimeout)
+		defer cancel()
+		counts, err := count(countCtx, filter)
+		if err != nil {
+			slog.WarnContext(countCtx, "counting titles for Highly Rated failed; reusing the last counts", "component", "recommendations", "error", err)
+			c.store(key, c.fallback(key), titleCountRetry)
+			return nil, err
+		}
+		c.store(key, counts, titleCountTTL)
+		return counts, nil
+	})
+	if ok {
+		// Expired counts serve this read; the count above refreshes them.
+		return counts
+	}
+	select {
+	case res := <-result:
+		if counts, isCounts := res.Val.([]int64); res.Err == nil && isCounts {
+			return counts
+		}
+	case <-ctx.Done():
+	}
+	return c.fallback(key)
+}
+
+// lookup returns key's counts, whether they are fresh, and whether there
+// are any.
+func (c *titleCountCache) lookup(key [sha256.Size]byte) (counts []int64, fresh, ok bool) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	entry, ok := c.entries[key]
+	return entry.counts, ok && time.Now().Before(entry.expires), ok
+}
+
+// fallback returns key's last counts, or equal weights when it has none.
+func (c *titleCountCache) fallback(key [sha256.Size]byte) []int64 {
+	if counts, _, ok := c.lookup(key); ok {
+		return counts
+	}
+	return equalTitleCounts()
+}
+
+// store keeps counts for key until ttl passes.
+func (c *titleCountCache) store(key [sha256.Size]byte, counts []int64, ttl time.Duration) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if _, ok := c.entries[key]; !ok && len(c.entries) >= titleCountCacheMax {
+		clear(c.entries)
+	}
+	c.entries[key] = titleCountEntry{counts: counts, expires: time.Now().Add(ttl)}
+}
+
+// equalTitleCounts weighs every recommendableMediaTypes entry alike.
+func equalTitleCounts() []int64 {
+	counts := make([]int64, len(recommendableMediaTypes))
+	for i := range counts {
+		counts[i] = 1
+	}
+	return counts
+}
+
+// titleCountKey identifies the titles filter admits: the fields
+// appendAccessConditions reads. AllowedContentIDs can be long, so the key is
+// a digest.
+func titleCountKey(filter catalog.AccessFilter) [sha256.Size]byte {
+	return sha256.Sum256(fmt.Appendf(nil, "%v|%v|%t|%v|%+v",
+		filter.AllowedLibraryIDs, filter.AllowedContentIDs, filter.AllowedContentIDs != nil,
+		filter.DisabledLibraryIDs, filter.MaturityLimits))
+}
diff --git a/internal/recommendations/title_counts_test.go b/internal/recommendations/title_counts_test.go
new file mode 100644
index 0000000000..6be8b2a376
--- /dev/null
+++ b/internal/recommendations/title_counts_test.go
@@ -0,0 +1,104 @@
+package recommendations
+
+import (
+	"context"
+	"errors"
+	"slices"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+)
+
+// A count that fails gives equal weights when the scope has no counts yet,
+// and the scope is not counted again until titleCountRetry passes.
+func TestTitleCountsFallBackToEqualWeightsOnError(t *testing.T) {
+	cache := newTitleCountCache()
+	var calls atomic.Int32
+	failing := func(context.Context, catalog.AccessFilter) ([]int64, error) {
+		calls.Add(1)
+		return nil, errors.New("db down")
+	}
+	for range 2 {
+		if got := cache.get(t.Context(), catalog.AccessFilter{}, failing); !slices.Equal(got, equalTitleCounts()) {
+			t.Fatalf("counts = %v, want equal weights", got)
+		}
+	}
+	if calls.Load() != 1 {
+		t.Fatalf("counts run = %d, want 1 until the retry window passes", calls.Load())
+	}
+}
+
+// Expired counts serve the read at once while a count refreshes them in the
+// background; a refresh that fails keeps them.
+func TestTitleCountsServeExpiredCountsWhileRefreshing(t *testing.T) {
+	cache := newTitleCountCache()
+	filter := catalog.AccessFilter{AllowedLibraryIDs: []int{3}}
+	key := titleCountKey(filter)
+	cache.store(key, []int64{5, 2}, -time.Second)
+
+	release := make(chan struct{})
+	refreshed := make(chan struct{})
+	blocked := func(context.Context, catalog.AccessFilter) ([]int64, error) {
+		<-release
+		defer close(refreshed)
+		return []int64{9, 4}, nil
+	}
+	if got := cache.get(t.Context(), filter, blocked); !slices.Equal(got, []int64{5, 2}) {
+		t.Fatalf("counts = %v, want the expired counts without waiting", got)
+	}
+	close(release)
+	<-refreshed
+	waitForCounts(t, cache, key, []int64{9, 4})
+
+	cache.store(key, []int64{9, 4}, -time.Second)
+	failed := make(chan struct{})
+	failing := func(context.Context, catalog.AccessFilter) ([]int64, error) {
+		defer close(failed)
+		return nil, errors.New("timeout")
+	}
+	if got := cache.get(t.Context(), filter, failing); !slices.Equal(got, []int64{9, 4}) {
+		t.Fatalf("counts = %v, want the expired counts", got)
+	}
+	<-failed
+	waitForCounts(t, cache, key, []int64{9, 4})
+}
+
+// A read waiting on a first count stops waiting when its context ends; the
+// count finishes and serves the next read.
+func TestTitleCountsStopWaitingWhenTheReadEnds(t *testing.T) {
+	cache := newTitleCountCache()
+	filter := catalog.AccessFilter{}
+	release := make(chan struct{})
+	counted := make(chan struct{})
+	slow := func(ctx context.Context, _ catalog.AccessFilter) ([]int64, error) {
+		<-release
+		defer close(counted)
+		return []int64{7, 1}, ctx.Err()
+	}
+	ctx, cancel := context.WithCancel(t.Context())
+	cancel()
+	if got := cache.get(ctx, filter, slow); !slices.Equal(got, equalTitleCounts()) {
+		t.Fatalf("counts = %v, want equal weights for a read that ended", got)
+	}
+	close(release)
+	<-counted
+	waitForCounts(t, cache, titleCountKey(filter), []int64{7, 1})
+}
+
+// waitForCounts waits until the background count stores want for key.
+func waitForCounts(t *testing.T, cache *titleCountCache, key [32]byte, want []int64) {
+	t.Helper()
+	deadline := time.Now().Add(5 * time.Second)
+	for {
+		counts, _, _ := cache.lookup(key)
+		if slices.Equal(counts, want) {
+			return
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("stored counts = %v, want %v", counts, want)
+		}
+		time.Sleep(time.Millisecond)
+	}
+}
diff --git a/internal/recommendations/titles.go b/internal/recommendations/titles.go
new file mode 100644
index 0000000000..157efcaef3
--- /dev/null
+++ b/internal/recommendations/titles.go
@@ -0,0 +1,60 @@
+package recommendations
+
+import "strings"
+
+// Row titles. Reads and the cold-start rows title rows with these words, and
+// the web's fallback labels copy them. Clients key rows by type and section
+// kind, never by title, so a title can change without breaking one.
+const (
+	// ForYouLabel titles the profile's main row.
+	ForYouLabel               = "For You"
+	similarUsersLabel         = "Profiles Like You Enjoyed"
+	popularLabel              = "Popular on This Server"
+	recentlyAddedLabel        = "Recently Added"
+	highlyRatedLabel          = "Highly Rated in Your Library"
+	becauseYouWatchedRowLabel = "Because You Watched"
+	// clusterTitlePrefix starts the title of a taste-cluster row whose label
+	// names genres, and the Reason of every item in one.
+	clusterTitlePrefix = "Because you enjoy "
+	// unlabeledClusterTitle titles a taste-cluster row whose label names no
+	// genre. It says where the titles come from without naming a taste.
+	unlabeledClusterTitle = "Picked from your history"
+)
+
+// genreRowLabel titles a genre row. Its titles are the genre's best rated,
+// not its most watched.
+func genreRowLabel(genre string) string {
+	return "Top " + genre
+}
+
+// clusterTitle titles the taste-cluster row with the given label.
+func clusterTitle(label string) string {
+	if label == "" {
+		return unlabeledClusterTitle
+	}
+	return clusterTitlePrefix + label
+}
+
+// clusterTitleLabel returns the label a taste-cluster row title was made
+// from by clusterTitle, and false for a title clusterTitle does not make.
+func clusterTitleLabel(title string) (string, bool) {
+	if title == unlabeledClusterTitle {
+		return "", true
+	}
+	label, ok := strings.CutPrefix(title, clusterTitlePrefix)
+	if !ok || label == "" {
+		return "", false
+	}
+	return label, true
+}
+
+// Global reports whether the row is one every profile is offered (Popular,
+// Recently Added, Highly Rated in Your Library or a genre row) rather than
+// one built from the profile's own history.
+func (r ForYouRow) Global() bool {
+	switch r.Type {
+	case RecTypePopular, RecTypeRecentlyAdded, RecTypeTopRated, genreSamplerRowType:
+		return true
+	}
+	return false
+}
diff --git a/internal/recommendations/top_genre.go b/internal/recommendations/top_genre.go
new file mode 100644
index 0000000000..b748e03ac9
--- /dev/null
+++ b/internal/recommendations/top_genre.go
@@ -0,0 +1,62 @@
+package recommendations
+
+import (
+	"context"
+	"sync"
+	"time"
+
+	"golang.org/x/sync/singleflight"
+)
+
+// topGenreTTL is how long a server reuses the top genre. It follows the
+// catalog and the server's viewing, which change slowly, and reading it
+// scans the whole catalog.
+const topGenreTTL = 10 * time.Minute
+
+// topGenreTimeout bounds a shared read of the top genre, which runs
+// detached from the request that started it.
+const topGenreTimeout = 30 * time.Second
+
+// topGenreCache holds the server's top genre. Its zero value is ready to
+// use. The genre is the same for every viewer, so one read serves them all:
+// an expired genre is served while a background read refreshes it, and
+// reads that find none wait on one shared read, or until their request
+// ends.
+type topGenreCache struct {
+	mu      sync.Mutex
+	genre   string
+	loaded  bool
+	expires time.Time
+	loading singleflight.Group
+}
+
+func (c *topGenreCache) get(ctx context.Context, load func(context.Context) (string, error)) (string, error) {
+	c.mu.Lock()
+	genre, loaded, fresh := c.genre, c.loaded, time.Now().Before(c.expires)
+	c.mu.Unlock()
+	if fresh {
+		return genre, nil
+	}
+	result := c.loading.DoChan("", func() (any, error) {
+		loadCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), topGenreTimeout)
+		defer cancel()
+		genre, err := load(loadCtx)
+		if err != nil {
+			return "", err
+		}
+		c.mu.Lock()
+		c.genre, c.loaded, c.expires = genre, true, time.Now().Add(topGenreTTL)
+		c.mu.Unlock()
+		return genre, nil
+	})
+	if loaded {
+		return genre, nil
+	}
+	select {
+	case res := <-result:
+		genre, _ := res.Val.(string)
+		return genre, res.Err
+	case <-ctx.Done():
+		return "", ctx.Err()
+	}
+}
diff --git a/internal/recommendations/top_genre_test.go b/internal/recommendations/top_genre_test.go
new file mode 100644
index 0000000000..93e921dc76
--- /dev/null
+++ b/internal/recommendations/top_genre_test.go
@@ -0,0 +1,79 @@
+package recommendations
+
+import (
+	"context"
+	"errors"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+// The top genre is read once and served to every viewer until it expires; a
+// failed read is not kept.
+func TestTopGenreIsReadOncePerTTL(t *testing.T) {
+	var cache topGenreCache
+	var calls atomic.Int32
+	failing := true
+	load := func(context.Context) (string, error) {
+		calls.Add(1)
+		if failing {
+			return "", errors.New("db down")
+		}
+		return "Drama", nil
+	}
+	if _, err := cache.get(t.Context(), load); err == nil {
+		t.Fatal("want the failed read's error")
+	}
+	failing = false
+	for range 3 {
+		if genre, err := cache.get(t.Context(), load); err != nil || genre != "Drama" {
+			t.Fatalf("genre = %q, %v; want Drama", genre, err)
+		}
+	}
+	if calls.Load() != 2 {
+		t.Fatalf("reads = %d, want 2: the failed one and one for every later viewer", calls.Load())
+	}
+}
+
+// An expired genre is served at once while a background read refreshes it.
+func TestTopGenreServesExpiredGenreWhileRefreshing(t *testing.T) {
+	cache := topGenreCache{genre: "Drama", loaded: true, expires: time.Now().Add(-time.Second)}
+	release := make(chan struct{})
+	loaded := make(chan struct{})
+	load := func(context.Context) (string, error) {
+		<-release
+		defer close(loaded)
+		return "Comedy", nil
+	}
+	if genre, err := cache.get(t.Context(), load); err != nil || genre != "Drama" {
+		t.Fatalf("genre = %q, %v; want the expired Drama without waiting", genre, err)
+	}
+	close(release)
+	<-loaded
+	deadline := time.Now().Add(5 * time.Second)
+	for {
+		if genre, _ := cache.get(t.Context(), load); genre == "Comedy" {
+			return
+		}
+		if time.Now().After(deadline) {
+			t.Fatal("the background read did not store Comedy")
+		}
+		time.Sleep(time.Millisecond)
+	}
+}
+
+// A read waiting on the first read stops when its request ends.
+func TestTopGenreStopsWaitingWhenTheReadEnds(t *testing.T) {
+	var cache topGenreCache
+	release := make(chan struct{})
+	defer close(release)
+	ctx, cancel := context.WithCancel(t.Context())
+	cancel()
+	_, err := cache.get(ctx, func(context.Context) (string, error) {
+		<-release
+		return "Drama", nil
+	})
+	if !errors.Is(err, context.Canceled) {
+		t.Fatalf("err = %v, want the request's cancellation", err)
+	}
+}
diff --git a/internal/recommendations/types.go b/internal/recommendations/types.go
index 1fcc780164..311b4830dd 100644
--- a/internal/recommendations/types.go
+++ b/internal/recommendations/types.go
@@ -3,6 +3,8 @@ package recommendations
 import (
 	"context"
 	"time"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
 )
 
 // ScoredItem represents a recommended item with a relevance score and explanation.
@@ -19,9 +21,19 @@ type ForYouRow struct {
 	Label        string       `json:"label"`
 	ClusterIndex int          `json:"cluster_index,omitempty"`
 	Items        []ScoredItem `json:"items"`
+	// Subject is what a taste-cluster row is about, its genre label without
+	// the title's wording, for clients that word the reason themselves. It is
+	// empty on every other row and on a cluster whose label names no genre.
+	Subject string `json:"-"`
+	// AnchorItemID is the title a Because You Watched row was built from.
+	AnchorItemID string `json:"-"`
+	// personalKey is the cache key of a personal taste row, the main row
+	// (RecTypeForYouMain) or a cluster row, and empty on every other row.
+	// Reads rotate these rows daily (see rotateTail).
+	personalKey string
 }
 
-// ForYouResponse is the grouped response for the ForYou endpoint.
+// ForYouResponse is the grouped response of the For You rows endpoint.
 type ForYouResponse struct {
 	Rows []ForYouRow `json:"rows"`
 }
@@ -56,16 +68,16 @@ type WatchSignal struct {
 	LastWatchedAt time.Time
 }
 
-// Recommender provides recommendation operations.
+// Recommender provides recommendation operations. The profile-scoped reads
+// take the viewer's access filter and leave out what it cannot see before
+// ranking, so a restricted viewer still gets a full list.
 type Recommender interface {
-	SimilarItems(ctx context.Context, itemID string, limit int) ([]ScoredItem, error)
-	ForYou(ctx context.Context, userID int, profileID string, limit int) (*ForYouResponse, error)
-	BecauseYouWatched(ctx context.Context, userID int, profileID string, sourceItemID string, limit int) ([]ScoredItem, error)
-	SimilarUsersLiked(ctx context.Context, userID int, profileID string, limit int) ([]ScoredItem, error)
+	SimilarItems(ctx context.Context, userID int, profileID, itemID string, limit int, filter catalog.AccessFilter) ([]ScoredItem, error)
+	BecauseYouWatched(ctx context.Context, userID int, profileID string, sourceItemID string, limit int, filter catalog.AccessFilter) ([]ScoredItem, error)
+	SimilarUsersLiked(ctx context.Context, userID int, profileID string, limit int, filter catalog.AccessFilter) ([]ScoredItem, error)
 	RefreshTasteProfile(ctx context.Context, userID int, profileID string) error
 	GetTasteProfileSummary(ctx context.Context, userID int, profileID string) (*TasteProfileSummary, error)
-	EmbedItem(ctx context.Context, itemID string) error
-	EmbedAll(ctx context.Context) (embedded int, err error)
+	EmbedAll(ctx context.Context) (EmbedCounts, error)
 }
 
 // TasteProfileSummary is the user-facing taste profile response.
@@ -81,15 +93,19 @@ const (
 	WeightRated5    = 1.0
 	WeightRewatch   = 0.9 // Completed 2+ times
 	WeightRated4    = 0.7
-	WeightFavorited = 0.8 // Strong deliberate action
-	WeightWatchHigh = 0.8 // Watch progress >= 90%
-	WeightWatchMed  = 0.3 // Watch progress 50-89%
-	WeightRated3    = 0.2
+	WeightFavorited = 0.8  // Strong deliberate action
+	WeightWatchHigh = 0.8  // Watch progress >= 90%
+	WeightWatchMed  = 0.3  // Watch progress 50-89%
 	WeightWatchlist = 0.15 // Intent signal
 	WeightWatchLow  = -0.2 // Abandoned (< 15%)
 	WeightRatedLow  = -0.5 // 1-2 star ratings
 )
 
+// DislikedRatingMax is the highest star rating that marks a title the profile
+// disliked: reads leave such titles out of every row, and they never anchor a
+// Because You Watched row.
+const DislikedRatingMax = 2
+
 // RecType constants for recommendation cache.
 const (
 	RecTypeForYouMain          = "for_you_main"
@@ -108,31 +124,31 @@ const GlobalCacheUserID = 0
 // GlobalCacheProfileID is the sentinel profile_id for global cache entries.
 const GlobalCacheProfileID = "__global__"
 
-// Cold-start thresholds for graduated warm-up.
+// Cold-start thresholds for graduated warm-up, in positive titles (see
+// coldStartLevelOf). Mixed matches the taste-seed picker's three-pick
+// minimum, so a seeded profile opens on its own row; ten titles is where its
+// taste first splits into two clusters.
 const (
-	ColdStartFullPersonalized = 15
-	ColdStartMixed            = 5
+	ColdStartFullPersonalized = 10
+	ColdStartMixed            = 3
 	ColdStartMinimal          = 1
 )
 
-// MMR lambda values by recommendation type.
-const (
-	LambdaForYou         = 0.7
-	LambdaGenreRow       = 0.8
-	LambdaBecauseWatched = 0.7
-	LambdaSimilarUsers   = 0.6
-	LambdaSimilarItems   = 0.8
-)
-
-// GenreCapPercent is the maximum fraction of a recommendation row any single genre can occupy.
-const GenreCapPercent = 0.4
-
 // RecencyBoostDays is the number of days a new item gets a relevance boost.
-const RecencyBoostDays = 7
+const RecencyBoostDays = 14
 
-// RecencyBoostMultiplier is the max multiplier for newly added items.
-const RecencyBoostMultiplier = 1.2
+// RecencyBoostMultiplier is the max multiplier for newly added items. The
+// boost applies before selection, where a candidate pool's scores spread by
+// about a tenth, so a small multiplier already lifts a new title several
+// places.
+const RecencyBoostMultiplier = 1.05
 
 // CacheCandidateLimit is the default number of candidates cached per row so
 // read paths have headroom for watched, low-rated, access, and dedup filters.
 const CacheCandidateLimit = 60
+
+// ServedRowSize is how many items of a row a public read serves by default:
+// the window ranking shapes for what a viewer sees first. The rest of a cached
+// row is headroom for read-time filters and for library sections, which scope
+// the whole row to their libraries.
+const ServedRowSize = 20
diff --git a/internal/recommendations/watch_tonight.go b/internal/recommendations/watch_tonight.go
index e7c7bef2cf..244704cd94 100644
--- a/internal/recommendations/watch_tonight.go
+++ b/internal/recommendations/watch_tonight.go
@@ -18,9 +18,14 @@ type WatchTonightResult struct {
 
 // GetWatchTonight returns a scored list of recommendation-engine candidates
 // for the Watch Tonight feature. It pulls from cached for-you, because-you-watched,
-// and similar-users sources, falling back to popular/recently-added for cold-start users.
-// Results are filtered before trimming so deeper cached candidates can backfill
-// watched, low-rated, or access-disallowed recommendations.
+// and similar-users sources, falling back for cold-start users to the cached
+// Popular row and the live Recently Added row, which needs no cache and so
+// still fills on a fresh server or with recommendations disabled, when no
+// worker rebuilds the cached rows. Results are filtered before trimming so
+// deeper candidates can backfill watched, rated, or access-disallowed
+// recommendations, and the profile's exclusion set is read once for both
+// passes. With personal rows off (see WithPersonalRows) only the cold-start
+// rows are used.
 func (r *Reader) GetWatchTonight(ctx context.Context, userID int, profileID string, limit int, filter catalog.AccessFilter) (WatchTonightResult, error) {
 	if limit <= 0 {
 		limit = 8
@@ -30,52 +35,80 @@ func (r *Reader) GetWatchTonight(ctx context.Context, userID int, profileID stri
 	}
 
 	byID := make(map[string]ScoredItem, limit*3)
+	read := r.newRowRead(userID, profileID, filter)
 
-	// 1. For-you main row — highest relevance band (0.80–1.00).
-	forYouItems, err := r.repo.GetRecommendationCache(ctx, userID, profileID, RecTypeForYouMain, "")
-	if err != nil {
-		return WatchTonightResult{}, err
-	}
-	mergeScored(byID, forYouItems, 0.80, 1.00)
+	// With recommendations disabled no personal row is served, even one
+	// still cached from before, and the cold-start rows stand in.
+	if !r.personalOff {
+		// 1. For-you main row — highest relevance band (0.80–1.00).
+		forYouItems, err := r.repo.GetRecommendationCache(ctx, userID, profileID, RecTypeForYouMain, "")
+		if err != nil {
+			return WatchTonightResult{}, err
+		}
+		mergeScored(byID, forYouItems, 0.80, 1.00)
 
-	// 2. Because-you-watched — mid band (0.55–0.75).
-	recentCompleted, err := r.signalReader().RecentCompletedItemIDs(ctx, userID, profileID, 3)
-	if err != nil {
-		return WatchTonightResult{}, err
-	}
-	for _, sourceID := range recentCompleted {
-		items, err := r.repo.GetRecommendationCache(ctx, userID, profileID, RecTypeBecauseWatched, sourceID)
+		// 2. Because-you-watched — mid band (0.55–0.75).
+		anchors, err := anchorItemIDs(ctx, r.signalReader(), r.ratingsRepo, userID, profileID, BecauseYouWatchedAnchors)
+		if err != nil {
+			return WatchTonightResult{}, err
+		}
+		for _, sourceID := range anchors {
+			items, err := r.repo.GetRecommendationCache(ctx, userID, profileID, RecTypeBecauseWatched, sourceID)
+			if err != nil {
+				return WatchTonightResult{}, err
+			}
+			mergeScored(byID, items, 0.55, 0.75)
+		}
+
+		// 3. Similar-users-liked — lower band (0.35–0.55).
+		similarItems, err := r.repo.GetRecommendationCache(ctx, userID, profileID, RecTypeSimilarUsersLiked, "")
 		if err != nil {
 			return WatchTonightResult{}, err
 		}
-		mergeScored(byID, items, 0.55, 0.75)
+		mergeScored(byID, similarItems, 0.35, 0.55)
 	}
 
-	// 3. Similar-users-liked — lower band (0.35–0.55).
-	similarItems, err := r.repo.GetRecommendationCache(ctx, userID, profileID, RecTypeSimilarUsersLiked, "")
+	// The personal candidates are filtered before the fallback is chosen:
+	// a cache holding only titles the viewer cannot be served, such as books
+	// cached before they left personal rows, is as cold as an empty one.
+	items, err := read.rankWatchTonight(ctx, byID)
 	if err != nil {
 		return WatchTonightResult{}, err
 	}
-	mergeScored(byID, similarItems, 0.35, 0.55)
-
-	isCold := len(byID) == 0
+	isCold := len(items) == 0
 
 	// 4. Cold-start fallback: popular + recently-added.
 	if isCold {
+		byID = make(map[string]ScoredItem, limit*2)
 		popular, err := r.repo.GetRecommendationCache(ctx, GlobalCacheUserID, GlobalCacheProfileID, RecTypePopular, "")
 		if err != nil {
 			return WatchTonightResult{}, err
 		}
 		mergeScored(byID, popular, 0.20, 0.40)
 
-		recentlyAdded, err := r.repo.GetRecommendationCache(ctx, GlobalCacheUserID, GlobalCacheProfileID, RecTypeRecentlyAdded, "")
+		recentlyAdded, err := read.defaultRow(ctx, RecTypeRecentlyAdded, limit)
 		if err != nil {
 			return WatchTonightResult{}, err
 		}
-		mergeScored(byID, recentlyAdded, 0.15, 0.35)
+		mergeScored(byID, recentlyAdded.Items, 0.15, 0.35)
+
+		if items, err = read.rankWatchTonight(ctx, byID); err != nil {
+			return WatchTonightResult{}, err
+		}
+	}
+
+	if len(items) > limit {
+		items = items[:limit]
 	}
+	return WatchTonightResult{Items: items, IsCold: isCold}, nil
+}
 
-	// Collect, sort descending by score, trim.
+// rankWatchTonight sorts byID's candidates by descending score and filters
+// them for the viewer, keeping every survivor; the caller trims.
+func (rr *rowRead) rankWatchTonight(ctx context.Context, byID map[string]ScoredItem) ([]ScoredItem, error) {
+	if len(byID) == 0 {
+		return []ScoredItem{}, nil
+	}
 	items := make([]ScoredItem, 0, len(byID))
 	for _, item := range byID {
 		items = append(items, item)
@@ -83,23 +116,18 @@ func (r *Reader) GetWatchTonight(ctx context.Context, userID int, profileID stri
 	sort.Slice(items, func(i, j int) bool {
 		return items[i].Score > items[j].Score
 	})
-	rows, err := r.filterRows(ctx, userID, profileID, []ForYouRow{{
+	rows, err := rr.filter(ctx, []ForYouRow{{
 		Type:  "watch_tonight",
 		Label: "Watch Tonight",
 		Items: items,
-	}}, filter)
+	}})
 	if err != nil {
-		return WatchTonightResult{}, err
+		return nil, err
 	}
 	if len(rows) == 0 {
-		return WatchTonightResult{Items: []ScoredItem{}, IsCold: isCold}, nil
+		return []ScoredItem{}, nil
 	}
-	items = rows[0].Items
-	if len(items) > limit {
-		items = items[:limit]
-	}
-
-	return WatchTonightResult{Items: items, IsCold: isCold}, nil
+	return rows[0].Items, nil
 }
 
 // mergeScored normalizes raw ScoredItem scores into the given band and merges
diff --git a/internal/recommendations/worker.go b/internal/recommendations/worker.go
index e211dcbd13..e79c2a1c2f 100644
--- a/internal/recommendations/worker.go
+++ b/internal/recommendations/worker.go
@@ -2,11 +2,17 @@ package recommendations
 
 import (
 	"context"
+	"encoding/json"
+	"errors"
 	"fmt"
+	"hash/fnv"
 	"log/slog"
 	"sync"
+	"sync/atomic"
 	"time"
 
+	"github.com/prairie-server/prairie-server/internal/access"
+	"github.com/prairie-server/prairie-server/internal/recommendations/embeddings"
 	"github.com/prairie-server/prairie-server/internal/telemetry"
 	"github.com/prairie-server/prairie-server/internal/workmetrics"
 
@@ -23,16 +29,74 @@ const (
 	JobRecommendations JobName = "recommendations"
 )
 
+const (
+	tasteProfilesJobTimeout = 20 * time.Minute
+	cowatchJobTimeout       = 30 * time.Minute
+	cacheJobTimeout         = 45 * time.Minute
+	globalRowsJobTimeout    = 10 * time.Minute
+
+	staleSweepInterval = 5 * time.Minute
+	staleSweepBatch    = 50
+
+	// embedMissingInterval spaces the catch-up passes that embed newly
+	// matched items between nightly embedding runs.
+	embedMissingInterval = 15 * time.Minute
+
+	// profileRefreshTimeout bounds one profile's refresh.
+	profileRefreshTimeout = 2 * time.Minute
+	// staleMarkTimeout bounds marking a profile stale after its refresh
+	// failed, which may happen after the refresh's own deadline passed.
+	staleMarkTimeout = 10 * time.Second
+	// readRefreshInterval spaces the refreshes that reads request for one
+	// profile on one server. A read cannot tell a row that was never built
+	// from one that came out empty, so without it every page load of such a
+	// profile would queue another rebuild.
+	readRefreshInterval = 15 * time.Minute
+
+	// refreshNowWait bounds how long RefreshProfileNow waits for the refresh
+	// it started; the refresh itself keeps profileRefreshTimeout.
+	refreshNowWait = 5 * time.Second
+	// maxRefreshesNow bounds the refreshes RefreshProfileNow runs at once on
+	// one server, beside the queue's one at a time. Past it, requests go to
+	// the queue.
+	maxRefreshesNow = 4
+)
+
+// profileStaleMarker marks a profile's taste profile stale. *Repo implements
+// it.
+type profileStaleMarker interface {
+	MarkProfileStale(ctx context.Context, userID int, profileID string) error
+}
+
+// accountsStaleMarker marks stale every taste profile on some accounts.
+// *Repo implements it.
+type accountsStaleMarker interface {
+	MarkAccountsStale(ctx context.Context, userIDs []int) (int64, error)
+	MarkAllProfilesStale(ctx context.Context) (int64, error)
+	MarkAllProfilesStaleForPolicy(ctx context.Context, generation int64) (int64, error)
+}
+
 // Worker runs scheduled recommendation jobs.
 type Worker struct {
 	engine                *Engine
 	cron                  *cron.Cron
+	locker                jobLocker
+	history               JobHistory
+	staleMarker           profileStaleMarker
+	accountsMarker        accountsStaleMarker
+	savedConfig           SavedConfig
+	policyCurrent         PolicyCheck
 	mu                    sync.Mutex
 	running               map[JobName]bool
 	profileRefreshCh      chan profileRefreshRequest
 	profileRefreshPending map[string]struct{}
-	cancelFunc            context.CancelFunc
-	embeddingsJobTimeout  time.Duration
+	// profileRefreshAgain holds pending profiles whose signals changed while
+	// their refresh ran; see runProfileRefresh.
+	profileRefreshAgain  map[string]struct{}
+	refreshesNow         atomic.Int32 // RefreshProfileNow refreshes running
+	readRefreshes        refreshThrottle
+	cancelFunc           context.CancelFunc
+	embeddingsJobTimeout time.Duration
 }
 
 const tasteProfileRefreshSubjectsQuery = `
@@ -48,6 +112,18 @@ const tasteProfileRefreshSubjectsQuery = `
 	UNION
 	SELECT DISTINCT user_id, profile_id FROM user_watchlist`
 
+// postgresStoreTasteProfileSubjectsQuery is tasteProfileRefreshSubjectsQuery
+// on the Postgres user store, where user_profiles lists every profile. Like
+// the purge migration, it leaves out a profile missing from an account that
+// lists others, so rows its deletion left behind (ebook reading progress, a
+// taste row written while it was being deleted) are not rebuilt every night.
+// An account that lists no profile at all is kept.
+const postgresStoreTasteProfileSubjectsQuery = `
+	SELECT s.user_id, s.profile_id
+	FROM   (` + tasteProfileRefreshSubjectsQuery + `) s
+	WHERE  EXISTS (SELECT 1 FROM user_profiles p WHERE p.user_id = s.user_id AND p.id = s.profile_id)
+	   OR  NOT EXISTS (SELECT 1 FROM user_profiles p WHERE p.user_id = s.user_id)`
+
 // NewWorker creates a new recommendation Worker.
 func NewWorker(engine *Engine, embeddingsCron, tasteProfilesCron, cowatchCron, recommendationsCron string, embeddingsJobTimeout time.Duration) (*Worker, error) {
 	if embeddingsJobTimeout <= 0 {
@@ -56,23 +132,27 @@ func NewWorker(engine *Engine, embeddingsCron, tasteProfilesCron, cowatchCron, r
 	w := &Worker{
 		engine:                engine,
 		cron:                  cron.New(),
+		locker:                pgJobLocker{pool: engine.pool},
+		staleMarker:           engine.repo,
+		accountsMarker:        engine.repo,
 		running:               make(map[JobName]bool),
 		profileRefreshCh:      make(chan profileRefreshRequest, 256),
 		profileRefreshPending: make(map[string]struct{}),
 		embeddingsJobTimeout:  embeddingsJobTimeout,
 	}
 
-	if _, err := w.cron.AddFunc(embeddingsCron, w.runEmbeddings); err != nil {
-		return nil, err
-	}
-	if _, err := w.cron.AddFunc(tasteProfilesCron, w.runTasteProfiles); err != nil {
-		return nil, err
-	}
-	if _, err := w.cron.AddFunc(cowatchCron, w.runCowatch); err != nil {
-		return nil, err
-	}
-	if _, err := w.cron.AddFunc(recommendationsCron, w.runRecommendations); err != nil {
-		return nil, err
+	for _, schedule := range []struct {
+		spec string
+		name JobName
+	}{
+		{embeddingsCron, JobEmbeddings},
+		{tasteProfilesCron, JobTasteProfiles},
+		{cowatchCron, JobCowatch},
+		{recommendationsCron, JobRecommendations},
+	} {
+		if _, err := w.cron.AddFunc(schedule.spec, func() { w.runScheduled(schedule.name) }); err != nil {
+			return nil, err
+		}
 	}
 
 	return w, nil
@@ -86,6 +166,8 @@ func (w *Worker) Start() {
 	w.cancelFunc = cancel
 	go w.profileRefreshLoop(ctx)
 	go w.stalenessLoop(ctx)
+	go w.embedMissingLoop(ctx)
+	go w.ensureGlobalRows(ctx, w.engine.repo)
 
 	slog.Info("recommendation worker started")
 }
@@ -124,63 +206,92 @@ func (w *Worker) tryStart(name JobName) bool {
 	return true
 }
 
-// TriggerEmbeddings starts an embedding job if one is not already running.
-func (w *Worker) TriggerEmbeddings() error {
-	if !w.tryStart(JobEmbeddings) {
-		return fmt.Errorf("embeddings job is already running")
+// jobFor returns the scheduled body of the named job.
+func (w *Worker) jobFor(name JobName) job {
+	switch name {
+	case JobEmbeddings:
+		return job{name: name, timeout: w.embeddingsJobTimeout, run: func(ctx context.Context, held clusterLock) (jobResult, error) { return w.doEmbeddings(ctx, held) }}
+	case JobTasteProfiles:
+		return job{name: name, timeout: tasteProfilesJobTimeout, run: func(ctx context.Context, held clusterLock) (jobResult, error) { return w.doTasteProfiles(ctx, held) }}
+	case JobCowatch:
+		return job{name: name, timeout: cowatchJobTimeout, run: func(ctx context.Context, held clusterLock) (jobResult, error) { return w.doCowatch(ctx, held) }}
+	default:
+		return job{name: JobRecommendations, timeout: cacheJobTimeout, run: func(ctx context.Context, held clusterLock) (jobResult, error) { return w.doRecommendations(ctx, held) }}
 	}
-	go func() {
-		defer w.setRunning(JobEmbeddings, false)
-		ctx, cancel := context.WithTimeout(context.Background(), w.embeddingsJobTimeout)
-		defer cancel()
-		slog.Info("starting embedding job (manual trigger)", "timeout", w.embeddingsJobTimeout)
-		ctx, observation := workmetrics.Start(ctx, "recommendations", time.Time{})
-		defer workmetrics.Profile(ctx)()
-		count, err := w.engine.EmbedAll(ctx)
-		observation.Finish(telemetry.Outcome(err))
-		if err != nil {
-			slog.Error("embedding job failed", "error", err, "embedded", count)
-			return
-		}
-		slog.Info("embedding job completed", "embedded", count)
-	}()
-	return nil
 }
 
-// TriggerTasteProfiles starts a taste profile refresh if one is not already running.
+// TriggerEmbeddings starts an embedding job unless one is already running on
+// this server or another.
+func (w *Worker) TriggerEmbeddings() error {
+	return w.runJob(w.jobFor(JobEmbeddings), true)
+}
+
+// TriggerTasteProfiles starts a taste profile refresh unless one is already
+// running on this server or another.
 func (w *Worker) TriggerTasteProfiles() error {
-	if !w.tryStart(JobTasteProfiles) {
-		return fmt.Errorf("taste profiles job is already running")
-	}
-	go func() {
-		defer w.setRunning(JobTasteProfiles, false)
-		w.doTasteProfiles()
-	}()
-	return nil
+	return w.runJob(w.jobFor(JobTasteProfiles), true)
 }
 
-// TriggerCowatch starts a co-watch matrix computation if one is not already running.
+// TriggerCowatch starts a co-watch matrix computation unless one is already
+// running on this server or another.
 func (w *Worker) TriggerCowatch() error {
-	if !w.tryStart(JobCowatch) {
-		return fmt.Errorf("cowatch job is already running")
-	}
-	go func() {
-		defer w.setRunning(JobCowatch, false)
-		w.doCowatch()
-	}()
-	return nil
+	return w.runJob(w.jobFor(JobCowatch), true)
 }
 
-// TriggerRecommendations starts a recommendation cache refresh if one is not already running.
+// TriggerRecommendations starts a recommendation cache refresh unless one is
+// already running on this server or another.
 func (w *Worker) TriggerRecommendations() error {
-	if !w.tryStart(JobRecommendations) {
-		return fmt.Errorf("recommendations job is already running")
+	return w.runJob(w.jobFor(JobRecommendations), true)
+}
+
+// embedMissingJob is the catch-up pass: Pass 1 of the embeddings job only. It
+// takes the embeddings job's claim, so it never overlaps an embedding run on
+// any server. It is recorded as a partial run, and a run that found nothing
+// to do is not recorded.
+func (w *Worker) embedMissingJob() job {
+	return job{
+		name:          JobEmbeddings,
+		timeout:       w.embeddingsJobTimeout,
+		partial:       true,
+		quietWhenIdle: true,
+		run:           func(ctx context.Context, held clusterLock) (jobResult, error) { return w.doEmbedMissing(ctx, held) },
+	}
+}
+
+// EmbedMissingNow starts the catch-up pass in the background unless an
+// embedding run holds the job here or on another server. Startup calls it
+// when items need embeddings, so an interrupted backfill resumes at once.
+func (w *Worker) EmbedMissingNow() {
+	if err := w.runJob(w.embedMissingJob(), true); err != nil {
+		slog.Info("embedding catch-up not started", "component", "recommendations", "reason", err)
+	}
+}
+
+// embedMissingLoop runs the catch-up pass every embedMissingInterval.
+func (w *Worker) embedMissingLoop(ctx context.Context) {
+	ticker := time.NewTicker(embedMissingInterval)
+	defer ticker.Stop()
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case <-ticker.C:
+			w.runEmbedMissing()
+		}
+	}
+}
+
+// runEmbedMissing runs the catch-up pass in the caller's goroutine, skipping
+// it while an embedding run holds the job here or on another server.
+func (w *Worker) runEmbedMissing() {
+	err := w.runJob(w.embedMissingJob(), false)
+	switch {
+	case err == nil:
+	case errors.Is(err, ErrJobRunning), errors.Is(err, ErrJobRunningElsewhere):
+		slog.Debug("embedding job is running; skipping the catch-up pass", "component", "recommendations", "reason", err)
+	default:
+		slog.Warn("embedding catch-up pass could not start", "component", "recommendations", "error", err)
 	}
-	go func() {
-		defer w.setRunning(JobRecommendations, false)
-		w.doRecommendations()
-	}()
-	return nil
 }
 
 type profileRefreshRequest struct {
@@ -190,35 +301,239 @@ type profileRefreshRequest struct {
 
 // RequestProfileRefresh queues a profile-scoped recommendation refresh without blocking the caller.
 func (w *Worker) RequestProfileRefresh(ctx context.Context, userID int, profileID string) {
+	w.queueProfileRefresh(ctx, userID, profileID)
+}
+
+// queueProfileRefresh is RequestProfileRefresh. It reports false when the
+// request was dropped: the queue stayed full, or ctx ended first.
+func (w *Worker) queueProfileRefresh(ctx context.Context, userID int, profileID string) bool {
 	if w == nil || w.engine == nil || userID <= 0 || profileID == "" {
-		return
+		return false
 	}
 
 	req := profileRefreshRequest{userID: userID, profileID: profileID}
 	key := profileRefreshKey(userID, profileID)
-
-	w.mu.Lock()
-	if _, exists := w.profileRefreshPending[key]; exists {
-		w.mu.Unlock()
-		return
+	if !w.claimProfileRefreshOrAskAgain(key) {
+		return true // one is queued or running, and runs again after
 	}
-	w.profileRefreshPending[key] = struct{}{}
-	ch := w.profileRefreshCh
-	w.mu.Unlock()
 
 	select {
-	case ch <- req:
+	case w.profileRefreshCh <- req:
+		return true
 	case <-ctx.Done():
 		w.clearProfileRefreshPending(key)
 	case <-time.After(10 * time.Millisecond):
 		w.clearProfileRefreshPending(key)
 		slog.WarnContext(ctx, "profile refresh queue full; dropping request", "component", "recommendations", "user_id", userID, "profile_id", profileID)
 	}
+	return false
+}
+
+// NotifySignalsChanged records that a profile's recommendation signals
+// changed: a rating, favorite, watchlist entry, watch progress or history. It
+// marks the taste profile stale, which the stale sweep on any server picks up,
+// then queues a refresh on this server. Call it once per change event or
+// import run, not once per record. It does nothing on a nil Worker, which is
+// what callers hold when recommendations are disabled.
+func (w *Worker) NotifySignalsChanged(ctx context.Context, userID int, profileID string) {
+	if w == nil || userID <= 0 || profileID == "" {
+		return
+	}
+	// The change is already committed, so the request that made it ending
+	// must not cancel recording it.
+	ctx, cancel := context.WithTimeout(context.WithoutCancel(ctx), staleMarkTimeout)
+	defer cancel()
+	w.markProfileStale(ctx, userID, profileID)
+	w.RequestProfileRefresh(ctx, userID, profileID)
+}
+
+// RefreshProfileNow is NotifySignalsChanged for a caller whose next read
+// depends on the change, such as a taste-seed submission. It marks the profile
+// stale, then refreshes it on this server at once instead of queueing it, and
+// waits up to refreshNowWait. It reports whether the refresh finished in that
+// time.
+//
+// The refresh runs detached from ctx under the usual profileRefreshTimeout:
+// a caller that gives up or disconnects, or a wait that runs out, leaves it
+// running to completion, and it is not queued again. It holds the profile's
+// pending key, so the queue and the stale sweep on this server do not start a
+// duplicate; when a refresh is already queued or running here it returns at
+// once and leaves the work to that one, which runs again if it already
+// started. When maxRefreshesNow are already running it queues the refresh
+// instead.
+func (w *Worker) RefreshProfileNow(ctx context.Context, userID int, profileID string) bool {
+	if w == nil || w.engine == nil || userID <= 0 || profileID == "" {
+		return false
+	}
+	// The picks are already committed, so neither the stale mark nor a queued
+	// refresh may depend on the caller still waiting; see NotifySignalsChanged.
+	markCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), staleMarkTimeout)
+	w.markProfileStale(markCtx, userID, profileID)
+	cancel()
+	return w.refreshNow(ctx, userID, profileID, refreshNowWait, w.refreshProfile)
+}
+
+// refreshNow runs refresh for the profile as RefreshProfileNow describes,
+// waiting up to wait.
+func (w *Worker) refreshNow(ctx context.Context, userID int, profileID string, wait time.Duration, refresh profileRefresh) bool {
+	if w.refreshesNow.Add(1) > maxRefreshesNow {
+		w.refreshesNow.Add(-1)
+		w.RequestProfileRefresh(context.WithoutCancel(ctx), userID, profileID)
+		return false
+	}
+	key := profileRefreshKey(userID, profileID)
+	if !w.claimProfileRefreshOrAskAgain(key) {
+		w.refreshesNow.Add(-1)
+		return false
+	}
+
+	done := make(chan struct{})
+	refreshCtx := context.WithoutCancel(ctx)
+	go func() {
+		defer close(done)
+		defer w.refreshesNow.Add(-1)
+		_ = w.runProfileRefresh(refreshCtx, nil, userID, profileID, refresh)
+	}()
+
+	timer := time.NewTimer(wait)
+	defer timer.Stop()
+	select {
+	case <-done:
+		return true
+	case <-timer.C:
+	case <-ctx.Done():
+	}
+	slog.InfoContext(ctx, "profile refresh still running; answering without it", "component", "recommendations", "user_id", userID, "profile_id", profileID)
+	return false
+}
+
+// NotifyAccountsScopeChanged records that the access scope of every profile
+// on the accounts changed: an account's libraries or access group, or its
+// access group's libraries. Their cached rows were built under the old scope,
+// so their taste profiles are marked stale in one statement and the stale
+// sweep rebuilds them. Nothing is refreshed here: one access group can hold
+// many accounts.
+func (w *Worker) NotifyAccountsScopeChanged(ctx context.Context, userIDs []int) {
+	if w == nil || w.accountsMarker == nil || len(userIDs) == 0 {
+		return
+	}
+	// The change is already committed; see NotifySignalsChanged.
+	ctx, cancel := context.WithTimeout(context.WithoutCancel(ctx), staleMarkTimeout)
+	defer cancel()
+	marked, err := w.accountsMarker.MarkAccountsStale(ctx, userIDs)
+	if err != nil {
+		slog.WarnContext(ctx, "marking accounts' taste profiles stale after an access change failed", "component", "recommendations", "accounts", len(userIDs), "error", err)
+		return
+	}
+	slog.InfoContext(ctx, "access change: taste profiles marked stale", "component", "recommendations", "accounts", len(userIDs), "profiles", marked)
+}
+
+// PolicyCheck reports whether this server serves the access policy
+// generation stored now. policy.System.Current implements it.
+type PolicyCheck func(ctx context.Context) (bool, error)
+
+// WithPolicyCheck makes refreshes wait until this server has loaded the
+// stored access policy, and returns the worker. A refresh that finds the
+// server behind leaves its profile marked stale for a later sweep. Profile
+// scope comes from the policy, and a refresh is what clears stale marks, so
+// with the check one mark per policy generation (NotifyPolicyChanged) covers
+// every server.
+func (w *Worker) WithPolicyCheck(check PolicyCheck) *Worker {
+	if w != nil {
+		w.policyCurrent = check
+	}
+	return w
+}
+
+// NotifyPolicyChanged records that this server loaded access policy
+// generation, which may have changed the scope of every profile: a custom
+// scope policy can widen or narrow any account's libraries or maturity
+// limits. Every taste profile is marked stale, once per generation across the
+// cluster, and the stale sweep rebuilds them; reads already filter out titles
+// the new scope forbids, but only a rebuild adds the titles it allows.
+func (w *Worker) NotifyPolicyChanged(ctx context.Context, generation int64) {
+	if w == nil || w.accountsMarker == nil {
+		return
+	}
+	// The change is already committed; see NotifySignalsChanged.
+	ctx, cancel := context.WithTimeout(context.WithoutCancel(ctx), staleMarkTimeout)
+	defer cancel()
+	marked, err := w.accountsMarker.MarkAllProfilesStaleForPolicy(ctx, generation)
+	if err != nil {
+		slog.WarnContext(ctx, "marking taste profiles stale after a policy change failed", "component", "recommendations", "generation", generation, "error", err)
+		return
+	}
+	if marked > 0 {
+		slog.InfoContext(ctx, "policy change: taste profiles marked stale", "component", "recommendations", "generation", generation, "profiles", marked)
+	}
+}
+
+// NotifyUnratedContentChanged records that the server setting
+// access.unrated_content changed. It is part of the maturity limits every
+// profile with a content-rating ceiling builds its rows under, so every taste
+// profile is marked stale. Servers cache the setting for up to settle, and a
+// refresh on one that still serves the old value would clear the mark, so the
+// profiles are marked again once settle has passed. Rows built under the old
+// value are filtered by the new one when read until then.
+func (w *Worker) NotifyUnratedContentChanged(ctx context.Context, settle time.Duration) {
+	if w == nil || w.accountsMarker == nil {
+		return
+	}
+	mark := func() {
+		// The change is already committed; see NotifySignalsChanged.
+		ctx, cancel := context.WithTimeout(context.WithoutCancel(ctx), staleMarkTimeout)
+		defer cancel()
+		marked, err := w.accountsMarker.MarkAllProfilesStale(ctx)
+		if err != nil {
+			slog.WarnContext(ctx, "marking taste profiles stale after an unrated content change failed", "component", "recommendations", "error", err)
+			return
+		}
+		slog.InfoContext(ctx, "unrated content change: taste profiles marked stale", "component", "recommendations", "profiles", marked)
+	}
+	mark()
+	time.AfterFunc(settle, mark)
+}
+
+// ReadRefreshDue reports whether RequestReadRefresh would queue a refresh for
+// the profile now, so a read can skip checking whether one is worth asking
+// for.
+func (w *Worker) ReadRefreshDue(userID int, profileID string) bool {
+	if w == nil || w.engine == nil || userID <= 0 || profileID == "" {
+		return false
+	}
+	return w.readRefreshes.due(profileRefreshKey(userID, profileID), readRefreshInterval)
+}
+
+// RequestReadRefresh queues a refresh for a profile whose cached rows a read
+// found missing, at most once per readRefreshInterval per profile on this
+// server. Signal changes go through NotifySignalsChanged, which is not
+// throttled.
+func (w *Worker) RequestReadRefresh(ctx context.Context, userID int, profileID string) {
+	if w == nil || w.engine == nil || userID <= 0 || profileID == "" {
+		return
+	}
+	key := profileRefreshKey(userID, profileID)
+	if !w.readRefreshes.allow(key, readRefreshInterval) {
+		return
+	}
+	// A dropped request leaves no stale mark, so the next read may ask again.
+	if !w.queueProfileRefresh(ctx, userID, profileID) {
+		w.readRefreshes.forget(key)
+	}
+}
+
+func (w *Worker) markProfileStale(ctx context.Context, userID int, profileID string) {
+	if w.staleMarker == nil {
+		return
+	}
+	if err := w.staleMarker.MarkProfileStale(ctx, userID, profileID); err != nil {
+		slog.WarnContext(ctx, "marking taste profile stale failed", "component", "recommendations", "user_id", userID, "profile_id", profileID, "error", err)
+	}
 }
 
 // StatusCounts returns counts used by the admin status endpoint.
 func (w *Worker) StatusCounts(ctx context.Context) (embedded, totalItems, tasteProfiles, cacheEntries, cowatchPairs int, err error) {
-	repo := NewRepo(w.engine.pool)
+	repo := w.engine.repo
 
 	embedded, err = repo.EmbeddingCount(ctx)
 	if err != nil {
@@ -240,258 +555,599 @@ func (w *Worker) StatusCounts(ctx context.Context) (embedded, totalItems, tasteP
 	return
 }
 
-func (w *Worker) runEmbeddings() {
-	if !w.tryStart(JobEmbeddings) {
-		slog.Warn("embedding job already running, skipping scheduled run")
-		return
-	}
-	defer w.setRunning(JobEmbeddings, false)
+type embeddingsResult struct {
+	// MissingOnly marks a catch-up pass, which skips the text-staleness
+	// pass.
+	MissingOnly bool `json:"missing_only,omitempty"`
+	EmbedCounts
+	// QuotaLimited marks a run a provider limit stopped; RetryDeferred
+	// marks one stopped because the provider asked to wait longer than a
+	// run waits.
+	QuotaLimited  bool `json:"quota_limited"`
+	RetryDeferred bool `json:"retry_deferred"`
+}
 
-	ctx, cancel := context.WithTimeout(context.Background(), w.embeddingsJobTimeout)
-	defer cancel()
-	slog.Info("starting embedding job", "timeout", w.embeddingsJobTimeout)
-	ctx, observation := workmetrics.Start(ctx, "recommendations", time.Time{})
-	defer workmetrics.Profile(ctx)()
-	count, err := w.engine.EmbedAll(ctx)
-	observation.Finish(telemetry.Outcome(err))
-	if err != nil {
-		slog.Error("embedding job failed", "error", err, "embedded", count)
-		return
+func (r embeddingsResult) failures() int { return r.Failed + r.Skipped }
+
+func (r embeddingsResult) idle() bool { return r.Embedded == 0 && r.failures() == 0 }
+
+func newEmbeddingsResult(counts EmbedCounts, err error, missingOnly bool) embeddingsResult {
+	res := embeddingsResult{MissingOnly: missingOnly, EmbedCounts: counts}
+	if err != nil && isQuotaError(err) {
+		res.QuotaLimited = true
+		var limitErr *embeddings.RateLimitError
+		res.RetryDeferred = errors.As(err, &limitErr) && limitErr.RetryDeferred
 	}
-	slog.Info("embedding job completed", "embedded", count)
+	return res
 }
 
-func (w *Worker) runTasteProfiles() {
-	if !w.tryStart(JobTasteProfiles) {
-		slog.Warn("taste profile job already running, skipping scheduled run")
-		return
-	}
-	defer w.setRunning(JobTasteProfiles, false)
-	w.doTasteProfiles()
+func (w *Worker) doEmbeddings(ctx context.Context, held clusterLock) (embeddingsResult, error) {
+	counts, err := w.engine.embed(ctx, held, true)
+	return newEmbeddingsResult(counts, err, false), err
 }
 
-func (w *Worker) runCowatch() {
-	if !w.tryStart(JobCowatch) {
-		slog.Warn("cowatch job already running, skipping scheduled run")
-		return
-	}
-	defer w.setRunning(JobCowatch, false)
-	w.doCowatch()
+func (w *Worker) doEmbedMissing(ctx context.Context, held clusterLock) (embeddingsResult, error) {
+	counts, err := w.engine.embed(ctx, held, false)
+	return newEmbeddingsResult(counts, err, true), err
 }
 
-func (w *Worker) runRecommendations() {
-	if !w.tryStart(JobRecommendations) {
-		slog.Warn("recommendations job already running, skipping scheduled run")
-		return
-	}
-	defer w.setRunning(JobRecommendations, false)
-	w.doRecommendations()
+type tasteProfilesResult struct {
+	Profiles  int `json:"profiles"`
+	Refreshed int `json:"refreshed"`
+	// NoOp counts profiles whose refresh stored no taste vector: no positive
+	// signal, none of their positively signaled titles has an embedding yet,
+	// or the profile was deleted after the job listed it. Their previous
+	// vector, clusters and personal rows are cleared.
+	NoOp int `json:"no_op"`
+	// Busy counts profiles another server held when the job reached them;
+	// they are marked stale for a full refresh.
+	Busy      int `json:"busy"`
+	Failed    int `json:"failed"`
+	Remaining int `json:"remaining"`
 }
 
-func (w *Worker) doTasteProfiles() {
-	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Minute)
-	defer cancel()
-	slog.Info("starting taste profile refresh")
+func (r tasteProfilesResult) failures() int { return r.Failed }
 
-	rows, err := w.engine.pool.Query(ctx, tasteProfileRefreshSubjectsQuery)
+func (w *Worker) doTasteProfiles(ctx context.Context, held clusterLock) (tasteProfilesResult, error) {
+	var res tasteProfilesResult
+	subjects, failed, err := w.tasteProfileSubjects(ctx)
+	res.Failed += failed
 	if err != nil {
-		slog.Error("taste profile query failed", "error", err)
-		return
+		return res, err
+	}
+
+	res.Profiles = len(subjects)
+	for i, s := range subjects {
+		if err := ctx.Err(); err != nil {
+			res.Remaining = len(subjects) - i
+			slog.WarnContext(ctx, "taste profile job ran out of time", "component", "recommendations", "processed", i, "remaining", res.Remaining)
+			return res, fmt.Errorf("taste profile refresh stopped after %d of %d profiles: %w", i, len(subjects), err)
+		}
+		// A refresh that started reading after this job could otherwise be
+		// overwritten by it with older signals.
+		unlock, acquired, err := w.tryProfileLock(ctx, held, s.UserID, s.ProfileID)
+		if errors.Is(err, errJobLockLost) {
+			res.Remaining = len(subjects) - i
+			return res, err
+		}
+		if err == nil && !acquired {
+			res.Busy++
+			w.markBusyProfileStale(ctx, s.UserID, s.ProfileID)
+			continue
+		}
+		var written bool
+		if err == nil {
+			written, err = w.engine.refreshTasteProfile(ctx, s.UserID, s.ProfileID)
+			unlock()
+		}
+		switch {
+		case err != nil:
+			res.Failed++
+			slog.WarnContext(ctx, "taste profile refresh failed", "component", "recommendations", "user_id", s.UserID, "profile_id", s.ProfileID, "error", err)
+		case written:
+			res.Refreshed++
+		default:
+			res.NoOp++
+		}
 	}
-	defer rows.Close()
+	if res.Refreshed == 0 && res.NoOp > 0 {
+		slog.WarnContext(ctx, "taste profile job stored no taste vectors; their titles may have no embeddings yet", "component", "recommendations", "profiles", res.Profiles, "no_op", res.NoOp)
+	}
+	return res, nil
+}
 
-	var refreshed int
+// tasteProfileSubjects lists the profiles the taste job refreshes: those with
+// a taste profile or any signal. failed counts subjects that could not be
+// read.
+func (w *Worker) tasteProfileSubjects(ctx context.Context) (subjects []StaleProfile, failed int, err error) {
+	signals := w.engine.signalReader()
+	query := postgresStoreTasteProfileSubjectsQuery
+	if signals.storeIsSeparate() {
+		query = tasteProfileRefreshSubjectsQuery
+	}
+	// Read every subject before refreshing, so the query's connection is not
+	// held for the whole job.
+	rows, err := w.engine.pool.Query(ctx, query)
+	if err != nil {
+		return nil, 0, fmt.Errorf("list taste profile subjects: %w", err)
+	}
+	seen := make(map[StaleProfile]struct{})
 	for rows.Next() {
-		var userID int
-		var profileID string
-		if err := rows.Scan(&userID, &profileID); err != nil {
+		var s StaleProfile
+		if err := rows.Scan(&s.UserID, &s.ProfileID); err != nil {
+			failed++
+			slog.WarnContext(ctx, "reading a taste profile subject failed", "component", "recommendations", "error", err)
 			continue
 		}
-		if err := w.engine.RefreshTasteProfile(ctx, userID, profileID); err != nil {
-			slog.Error("taste profile refresh failed", "user_id", userID, "profile_id", profileID, "error", err)
+		seen[s] = struct{}{}
+		subjects = append(subjects, s)
+	}
+	rows.Close()
+	if err := rows.Err(); err != nil {
+		return nil, failed, fmt.Errorf("list taste profile subjects: %w", err)
+	}
+	if !signals.storeIsSeparate() {
+		return subjects, failed, nil
+	}
+
+	// The query above sees ratings and taste profiles, but a user store
+	// outside Postgres holds the progress, favorites and watchlist. Ask it
+	// for every account's profiles that have signals.
+	userIDs, err := w.engine.repo.ListUserIDs(ctx)
+	if err != nil {
+		return nil, failed, fmt.Errorf("list taste profile subjects: %w", err)
+	}
+	for _, userID := range userIDs {
+		if err := ctx.Err(); err != nil {
+			return nil, failed, fmt.Errorf("list taste profile subjects: %w", err)
+		}
+		profiles, err := w.engine.storeProfiles(ctx, userID)
+		if err != nil {
+			failed++
+			slog.WarnContext(ctx, "listing an account's profiles for the taste job failed", "component", "recommendations", "user_id", userID, "error", err)
 			continue
 		}
-		refreshed++
+		for _, profileID := range profiles {
+			s := StaleProfile{UserID: userID, ProfileID: profileID}
+			if _, ok := seen[s]; ok {
+				continue
+			}
+			has, err := signals.HasSignals(ctx, userID, profileID)
+			if err != nil {
+				failed++
+				slog.WarnContext(ctx, "checking a profile's signals for the taste job failed", "component", "recommendations", "user_id", userID, "profile_id", profileID, "error", err)
+				continue
+			}
+			if has {
+				seen[s] = struct{}{}
+				subjects = append(subjects, s)
+			}
+		}
 	}
-	slog.Info("taste profile refresh completed", "refreshed", refreshed)
+	return subjects, failed, nil
 }
 
-func (w *Worker) doCowatch() {
-	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Minute)
-	defer cancel()
-	slog.Info("starting co-watch matrix computation")
+type cowatchResult struct {
+	Items  int   `json:"items"`
+	Pairs  int   `json:"pairs"`
+	Pruned int64 `json:"pruned"`
+}
 
-	repo := NewRepo(w.engine.pool)
-	watchers, err := repo.GetItemWatchers(ctx, 5, 500)
+func (cowatchResult) failures() int { return 0 }
+
+// doCowatch rebuilds item_cowatch from current watch history. Once every
+// batch is stored it deletes the pairs this run did not write: pairs of items
+// deleted since the last run, pairs that fell below the shared-watcher floor,
+// and pairs pushed out of an item's top neighbors. The table then holds only
+// this run's pairs.
+func (w *Worker) doCowatch(ctx context.Context, held clusterLock) (cowatchResult, error) {
+	var res cowatchResult
+	repo := w.engine.repo
+	// The database clock stamps updated_at, so the cutoff comes from it too.
+	runStart, err := repo.Now(ctx)
 	if err != nil {
-		slog.Error("co-watch: failed to get item watchers", "error", err)
-		return
+		return res, fmt.Errorf("read run start: %w", err)
 	}
-
-	if len(watchers) == 0 {
-		slog.Info("co-watch: no items with enough watchers, skipping")
-		return
+	watchers, err := repo.GetItemWatchers(ctx, DefaultMinWatchers, DefaultMaxWatchesPerUser)
+	if err != nil {
+		return res, fmt.Errorf("get item watchers: %w", err)
 	}
+	res.Items = len(watchers)
 
-	pairs := computeCowatchMatrix(watchers, 5, 3, 50)
-	if len(pairs) == 0 {
-		slog.Info("co-watch: no pairs met threshold")
-		return
+	pairs, err := computeCowatchMatrix(ctx, watchers, DefaultMinWatchers, DefaultMinShared, DefaultTopN)
+	if err != nil {
+		return res, fmt.Errorf("compute co-watch matrix: %w", err)
 	}
 
 	// Batch insert in chunks of 1000.
 	const batchSize = 1000
 	for i := 0; i < len(pairs); i += batchSize {
-		end := i + batchSize
-		if end > len(pairs) {
-			end = len(pairs)
+		end := min(i+batchSize, len(pairs))
+		if err := held.Check(ctx); err != nil {
+			return res, err
 		}
 		if err := repo.UpsertCowatchPairs(ctx, pairs[i:end]); err != nil {
-			slog.Error("co-watch: failed to upsert pairs", "error", err, "batch_start", i)
-			return
+			return res, fmt.Errorf("upsert co-watch pairs from %d: %w", i, err)
 		}
+		res.Pairs = end
+	}
+
+	// Another server may hold the lock once this one's session closes, and
+	// its run's pairs would be deleted with this run's leftovers.
+	if err := held.Check(ctx); err != nil {
+		return res, err
 	}
-	slog.Info("co-watch matrix computation completed", "pairs", len(pairs))
+	res.Pruned, err = repo.DeleteCowatchPairsBefore(ctx, runStart)
+	if err != nil {
+		return res, fmt.Errorf("delete stale co-watch pairs: %w", err)
+	}
+	return res, nil
 }
 
-func (w *Worker) doRecommendations() {
-	ctx, cancel := context.WithTimeout(context.Background(), 45*time.Minute)
-	defer cancel()
-	slog.Info("starting recommendation cache refresh")
+type cacheResult struct {
+	// GlobalOnly marks the startup run that builds only the global rows.
+	GlobalOnly     bool  `json:"global_only,omitempty"`
+	Cleaned        int64 `json:"cleaned"`
+	CleanFailed    bool  `json:"clean_failed,omitempty"`
+	GlobalRows     int   `json:"global_rows"`
+	GlobalFailures int   `json:"global_failures"`
+	Profiles       int   `json:"profiles"`
+	Processed      int   `json:"processed"`
+	Remaining      int   `json:"remaining"`
+	CachedRows     int   `json:"cached_rows"`
+	FailedProfiles int   `json:"failed_profiles"`
+	BuildErrors    int   `json:"build_errors"`
+	// Busy counts profiles another server held; they are marked stale for a
+	// full refresh.
+	Busy int `json:"busy"`
+}
 
-	repo := NewRepo(w.engine.pool)
-	cleaned, _ := repo.CleanExpiredCache(ctx)
-	if cleaned > 0 {
-		slog.Info("cleaned expired cache entries", "count", cleaned)
+func (r cacheResult) failures() int {
+	n := r.GlobalFailures + r.BuildErrors
+	if r.CleanFailed {
+		n++
 	}
+	return n
+}
+
+func (w *Worker) doRecommendations(ctx context.Context, held clusterLock) (cacheResult, error) {
+	var res cacheResult
+	expires := cacheExpiry(time.Now())
+	repo := w.engine.repo
 
-	expires := time.Now().Add(24 * time.Hour).Format(time.RFC3339)
+	cleaned, err := repo.CleanExpiredCache(ctx)
+	if err != nil {
+		res.CleanFailed = true
+		slog.WarnContext(ctx, "cleaning expired recommendation cache failed", "component", "recommendations", "error", err)
+	}
+	res.Cleaned = cleaned
 
-	// Generate global (non-personalized) cache rows.
-	w.cacheGlobalRows(ctx, repo, expires)
+	res.GlobalRows, res.GlobalFailures = w.cacheGlobalRows(ctx, repo, expires)
 
-	// Generate per-user cached rows.
-	profiles, err := repo.GetAllUsersWithTasteProfiles(ctx)
+	// Least recently cached first, so a run that runs out of time leaves the
+	// profiles refreshed most recently for last.
+	profiles, err := repo.ListCacheRefreshCandidates(ctx)
 	if err != nil {
-		slog.Error("recommendation cache query failed", "error", err)
-		return
+		return res, fmt.Errorf("list profiles to cache: %w", err)
 	}
+	res.Profiles = len(profiles)
 
-	var cached int
-	for _, p := range profiles {
-		// Clean old V1 cache type.
-		if err := repo.CleanOldCacheTypes(ctx, p.UserID, p.ProfileID); err != nil {
-			slog.Warn("failed to cache recommendations", "error", err)
+	for i, p := range profiles {
+		if err := ctx.Err(); err != nil {
+			res.Remaining = len(profiles) - i
+			slog.WarnContext(ctx, "recommendation cache job ran out of time", "component", "recommendations", "processed", i, "remaining", res.Remaining)
+			return res, fmt.Errorf("cache refresh stopped after %d of %d profiles: %w", i, len(profiles), err)
+		}
+		unlock, acquired, err := w.tryProfileLock(ctx, held, p.UserID, p.ProfileID)
+		if errors.Is(err, errJobLockLost) {
+			res.Remaining = len(profiles) - i
+			return res, err
+		}
+		if err != nil {
+			res.Processed++
+			res.FailedProfiles++
+			res.BuildErrors++
+			slog.WarnContext(ctx, "recommendation cache could not lock a profile", "component", "recommendations", "user_id", p.UserID, "profile_id", p.ProfileID, "error", err)
+			continue
+		}
+		if !acquired {
+			res.Busy++
+			w.markBusyProfileStale(ctx, p.UserID, p.ProfileID)
+			continue
+		}
+		built := w.cacheProfileRows(ctx, repo, p.UserID, p.ProfileID, expires)
+		unlock()
+		res.Processed++
+		res.CachedRows += built.cached
+		res.BuildErrors += built.failed
+		if built.failed > 0 {
+			res.FailedProfiles++
 		}
-
-		cached += w.cacheUserRows(ctx, repo, p.UserID, p.ProfileID, expires)
 	}
-	slog.Info("recommendation cache refresh completed", "cached_entries", cached)
+	return res, nil
 }
 
-// cacheGlobalRows generates and caches non-personalized rows.
-func (w *Worker) cacheGlobalRows(ctx context.Context, repo *Repo, expires string) {
-	popular, _ := repo.GetPopularItems(ctx, 30, CacheCandidateLimit)
-	if len(popular) > 0 {
-		if err := repo.UpsertRecommendationCache(ctx, GlobalCacheUserID, GlobalCacheProfileID, RecTypePopular, "", popular, expires); err != nil {
-			slog.WarnContext(ctx, "failed to cache recommendations", "component", "recommendations", "error", err)
+// globalRowStore is the part of Repo that builds and caches the global rows.
+type globalRowStore interface {
+	GetPopularItems(ctx context.Context, days, minAccounts, limit int) ([]ScoredItem, error)
+	GetRecentlyAddedItems(ctx context.Context, days, limit int) ([]ScoredItem, error)
+	GetTopGenres(ctx context.Context, limit int) ([]string, error)
+	GetGenreSamplerItems(ctx context.Context, genre string, limit int) ([]ScoredItem, error)
+	UpsertRecommendationCache(ctx context.Context, userID int, profileID, recType, sourceItemID string, items []ScoredItem, expiresAt string) error
+	ExtendGlobalRecommendationCache(ctx context.Context, recType string, prefix bool, expiresAt string) (int64, error)
+	DeleteGlobalRecommendationCache(ctx context.Context, recType string, prefix bool, keep []string) (int64, error)
+}
+
+// Global row sizes. Popular keeps a deeper pool than other rows because
+// reads filter it for each viewer's access and watch history afterwards.
+const (
+	popularWindowDays = 90
+	popularPoolSize   = 200
+	// genreMenuSize is how many genre rows are cached; Discover draws
+	// four of them a day for each profile.
+	genreMenuSize = 16
+)
+
+// cacheGlobalRows generates and caches non-personalized rows. A row whose
+// query or write fails keeps its previously cached version until the new
+// rows' expiry, so one failed run does not empty it. A row whose query finds
+// nothing, and a genre row whose genre left the menu, is deleted. Highly Rated
+// in Your Library is not cached: reads query it live for each viewer.
+func (w *Worker) cacheGlobalRows(ctx context.Context, store globalRowStore, expires string) (written, failed int) {
+	// keep extends the cached rows of recType (every type starting with it
+	// when prefix is set) after their rebuild failed with cause.
+	keep := func(recType string, prefix bool, cause error) {
+		failed++
+		slog.WarnContext(ctx, "building global recommendation row failed; keeping the cached row", "component", "recommendations", "rec_type", recType, "prefix", prefix, "error", cause)
+		if _, err := store.ExtendGlobalRecommendationCache(ctx, recType, prefix, expires); err != nil {
+			slog.WarnContext(ctx, "extending the cached global recommendation row failed", "component", "recommendations", "rec_type", recType, "prefix", prefix, "error", err)
 		}
 	}
-
-	recentlyAdded, _ := repo.GetRecentlyAddedItems(ctx, 14, CacheCandidateLimit)
-	if len(recentlyAdded) > 0 {
-		if err := repo.UpsertRecommendationCache(ctx, GlobalCacheUserID, GlobalCacheProfileID, RecTypeRecentlyAdded, "", recentlyAdded, expires); err != nil {
-			slog.WarnContext(ctx, "failed to cache recommendations", "component", "recommendations", "error", err)
+	// drop deletes the cached rows of recType (every type starting with it
+	// when prefix is set, except keep) when the rebuild found nothing to
+	// show, so an empty row does not keep serving its old items.
+	drop := func(recType string, prefix bool, keep []string) {
+		if _, err := store.DeleteGlobalRecommendationCache(ctx, recType, prefix, keep); err != nil {
+			failed++
+			slog.WarnContext(ctx, "deleting an empty global recommendation row failed", "component", "recommendations", "rec_type", recType, "prefix", prefix, "error", err)
 		}
 	}
-
-	topRated, _ := repo.GetTopRatedItems(ctx, 5, CacheCandidateLimit)
-	if len(topRated) > 0 {
-		if err := repo.UpsertRecommendationCache(ctx, GlobalCacheUserID, GlobalCacheProfileID, RecTypeTopRated, "", topRated, expires); err != nil {
-			slog.WarnContext(ctx, "failed to cache recommendations", "component", "recommendations", "error", err)
+	put := func(recType string, items []ScoredItem, buildErr error) {
+		switch {
+		case buildErr != nil:
+			keep(recType, false, buildErr)
+		case len(items) == 0:
+			drop(recType, false, nil)
+		default:
+			if err := store.UpsertRecommendationCache(ctx, GlobalCacheUserID, GlobalCacheProfileID, recType, "", items, expires); err != nil {
+				keep(recType, false, err)
+				return
+			}
+			written++
 		}
 	}
 
-	topGenres, _ := repo.GetTopGenres(ctx, 8)
+	popular, err := store.GetPopularItems(ctx, popularWindowDays, crowdMinAccounts, popularPoolSize)
+	put(RecTypePopular, popular, err)
+	// No window: a quiet library's newest titles still make a row for a new
+	// profile when no Popular row is cached.
+	recentlyAdded, err := store.GetRecentlyAddedItems(ctx, 0, CacheCandidateLimit)
+	put(RecTypeRecentlyAdded, recentlyAdded, err)
+
+	topGenres, err := store.GetTopGenres(ctx, genreMenuSize)
+	if err != nil {
+		keep(RecTypeGenreSamplerPrefix, true, err)
+		return written, failed
+	}
+	menu := make([]string, 0, len(topGenres))
 	for _, genre := range topGenres {
-		items, _ := repo.GetGenreSamplerItems(ctx, genre, CacheCandidateLimit)
-		if len(items) > 0 {
-			if err := repo.UpsertRecommendationCache(ctx, GlobalCacheUserID, GlobalCacheProfileID, RecTypeGenreSamplerPrefix+genre, "", items, expires); err != nil {
-				slog.WarnContext(ctx, "failed to cache recommendations", "component", "recommendations", "error", err)
-			}
-		}
+		items, err := store.GetGenreSamplerItems(ctx, genre, CacheCandidateLimit)
+		put(RecTypeGenreSamplerPrefix+genre, items, err)
+		menu = append(menu, RecTypeGenreSamplerPrefix+genre)
 	}
+	// A genre that left the menu would otherwise keep serving its row.
+	drop(RecTypeGenreSamplerPrefix, true, menu)
+	return written, failed
 }
 
-// cacheUserRows generates and caches personalized rows for a single user.
-func (w *Worker) cacheUserRows(ctx context.Context, repo *Repo, userID int, profileID, expires string) int {
-	var cached int
-	watchedSet, err := w.engine.watchedItemIDSet(ctx, userID, profileID)
+// globalRowCache is a globalRowStore that can tell whether any global row is
+// cached.
+type globalRowCache interface {
+	globalRowStore
+	HasGlobalRecommendationCache(ctx context.Context) (bool, error)
+}
+
+// ensureGlobalRows builds the global rows when none is cached, so cold-start
+// rows exist before the first nightly cache job. It runs under the cache job's
+// claim, so it never overlaps that job on any server.
+func (w *Worker) ensureGlobalRows(ctx context.Context, store globalRowCache) {
+	cached, err := store.HasGlobalRecommendationCache(ctx)
 	if err != nil {
-		slog.WarnContext(ctx, "failed to load watched items for recommendation cache", "component", "recommendations", "user_id", userID, "profile_id", profileID, "error", err)
-		watchedSet = nil
+		slog.WarnContext(ctx, "checking for global recommendation rows failed", "component", "recommendations", "error", err)
+		return
+	}
+	if cached {
+		return
 	}
-	watchedIDs := scoredItemIDsFromSet(watchedSet)
-	accessFilter := w.engine.profileAccessFilter(ctx, userID, profileID)
+	slog.InfoContext(ctx, "no global recommendation rows cached; building them now", "component", "recommendations")
+	err = w.runJob(job{name: JobRecommendations, timeout: globalRowsJobTimeout, partial: true, run: func(ctx context.Context, _ clusterLock) (jobResult, error) {
+		res := cacheResult{GlobalOnly: true}
+		res.GlobalRows, res.GlobalFailures = w.cacheGlobalRows(ctx, store, cacheExpiry(time.Now()))
+		return res, nil
+	}}, false)
+	switch {
+	case err == nil:
+	case errors.Is(err, ErrJobRunning), errors.Is(err, ErrJobRunningElsewhere):
+		slog.InfoContext(ctx, "global recommendation rows not built at startup", "component", "recommendations", "reason", err)
+	default:
+		slog.WarnContext(ctx, "global recommendation rows could not be built at startup", "component", "recommendations", "error", err)
+	}
+}
 
-	if aggregatedRow, err := w.engine.buildAggregatedRow(ctx, userID, profileID, CacheCandidateLimit, watchedIDs, accessFilter); err == nil && aggregatedRow != nil && len(aggregatedRow.Items) > 0 {
-		if err := repo.UpsertRecommendationCache(ctx, userID, profileID, RecTypeForYouMain, "", aggregatedRow.Items, expires); err != nil {
-			slog.WarnContext(ctx, "failed to cache recommendations", "component", "recommendations", "error", err)
-		} else {
-			cached++
+// cacheProfileRows is cacheUserRows for the cache job. A profile deleted
+// after the build checked it exists, and purged before the build wrote, would
+// keep the rows written; like a refresh, it checks again after the last write
+// and purges them.
+func (w *Worker) cacheProfileRows(ctx context.Context, repo *Repo, userID int, profileID, expires string) userRowsResult {
+	built := w.cacheUserRows(ctx, repo, userID, profileID, expires)
+	if err := w.engine.purgeIfProfileDeleted(ctx, userID, profileID); err != nil {
+		built.failed++
+		slog.WarnContext(ctx, "checking that a cached profile still exists failed", "component", "recommendations", "user_id", userID, "profile_id", profileID, "error", err)
+	}
+	return built
+}
+
+// userRowsResult counts one profile's cache build.
+type userRowsResult struct {
+	cached int
+	// failed counts the build steps and cache writes that failed.
+	failed int
+}
+
+// cacheUserRows generates and caches personalized rows for a single user. A
+// main, cluster or Because You Watched row whose rebuild finds nothing is
+// deleted; a row whose build or write fails keeps its cached version.
+func (w *Worker) cacheUserRows(ctx context.Context, repo *Repo, userID int, profileID, expires string) userRowsResult {
+	var res userRowsResult
+	fail := func(step string, err error, attrs ...any) {
+		res.failed++
+		slog.WarnContext(ctx, "recommendation cache build step failed", append([]any{
+			"component", "recommendations", "step", step, "user_id", userID, "profile_id", profileID, "error", err,
+		}, attrs...)...)
+	}
+	put := func(recType, sourceItemID string, items []ScoredItem) {
+		if err := repo.UpsertRecommendationCache(ctx, userID, profileID, recType, sourceItemID, items, expires); err != nil {
+			fail("write_cache", err, "rec_type", recType, "source_item_id", sourceItemID)
+			return
+		}
+		res.cached++
+	}
+	// putOrDrop caches a rebuilt row, or deletes the cached one when the
+	// rebuild found nothing, so it does not keep serving its old items until
+	// it expires. A row whose build failed never gets here.
+	putOrDrop := func(recType, sourceItemID string, items []ScoredItem) {
+		if len(items) > 0 {
+			put(recType, sourceItemID, items)
+			return
+		}
+		if err := repo.DeleteProfileRecommendationCache(ctx, userID, profileID, recType, sourceItemID); err != nil {
+			fail("delete_cache", err, "rec_type", recType, "source_item_id", sourceItemID)
 		}
 	}
 
-	// Cache per-cluster ForYou rows.
-	clusterRows, err := w.engine.buildClusterRows(ctx, userID, profileID, CacheCandidateLimit, watchedIDs, accessFilter)
+	// Rows are built under the scope the profile's reads are filtered by. A
+	// read only removes titles, so rows built under a wider scope would come
+	// back thin; a profile whose scope cannot be resolved keeps its cached
+	// rows, and one that no longer exists gets none.
+	accessFilter, err := w.engine.profileAccessFilter(ctx, userID, profileID)
+	if errors.Is(err, access.ErrProfileNotFound) {
+		slog.InfoContext(ctx, "profile no longer exists; recommendation rows not built", "component", "recommendations", "user_id", userID, "profile_id", profileID)
+		return res
+	}
 	if err != nil {
-		slog.WarnContext(ctx, "failed to build cluster recommendations for cache", "component", "recommendations", "user_id", userID, "profile_id", profileID, "error", err)
+		fail("access_scope", err)
+		return res
 	}
-	for _, row := range clusterRows {
-		if len(row.Items) == 0 {
-			continue
+
+	// Watched and favorited titles (taste-seed picks are favorites) never
+	// enter any row's candidates. Rows built without the set would carry
+	// them, so a profile whose set cannot be read keeps its cached rows.
+	excluded, err := w.engine.recommendationExclusionSet(ctx, userID, profileID)
+	if err != nil {
+		fail("excluded_items", err)
+		return res
+	}
+	excludeIDs := scoredItemIDsFromSet(excluded)
+
+	// The rows rank against the titles the profile turned away. Rows built
+	// without them would bring those titles' neighbors back, so a profile
+	// whose turned-away titles cannot be read keeps its cached rows.
+	builder := w.engine.rowBuilder()
+	av, err := w.engine.loadAversion(ctx, userID, profileID, builder.now)
+	if err != nil {
+		fail("aversion", err)
+		return res
+	}
+	builder.aversion = av
+	var penalized int
+	builder.penalized = &penalized
+	if !av.empty() {
+		defer func() {
+			slog.DebugContext(ctx, "recommendation rows ranked against turned-away titles", "component", "recommendations",
+				"user_id", userID, "profile_id", profileID, "turned_away_titles", av.size(), "candidates_pushed_down", penalized)
+		}()
+	}
+	aggregatedRow, err := builder.mainRow(ctx, userID, profileID, CacheCandidateLimit, excludeIDs, accessFilter)
+	if err != nil {
+		// The cluster rows leave out the main row's titles, so they keep
+		// their cached versions too: rebuilt against no main row, they would
+		// repeat the cached one's titles.
+		fail("main_row", err)
+	} else {
+		var mainItems []ScoredItem
+		if aggregatedRow != nil {
+			mainItems = aggregatedRow.Items
+		}
+		if aggregatedRow != nil && len(mainItems) == 0 {
+			// Every interest was turned away: cache the row empty, so
+			// reads know it was built rather than ask for it again.
+			put(RecTypeForYouMain, "", []ScoredItem{})
+		} else {
+			putOrDrop(RecTypeForYouMain, "", mainItems)
 		}
 
-		recType := fmt.Sprintf("%s%d", RecTypeForYouClusterPrefix, row.ClusterIndex)
-		if err := repo.UpsertRecommendationCache(ctx, userID, profileID, recType, "", row.Items, expires); err != nil {
-			slog.WarnContext(ctx, "failed to cache recommendations", "component", "recommendations", "error", err)
+		// Cache per-cluster ForYou rows. clusterRows logs each cluster whose
+		// candidates failed and returns no row for it, so its cached row
+		// stays. A row that rebuilds empty, or that the main row's titles
+		// empty, is cached empty: it replaces the old row, and reads know it
+		// was built.
+		clusterRows, failedClusters, err := builder.clusterRows(ctx, userID, profileID, CacheCandidateLimit, excludeIDs, accessFilter)
+		res.failed += failedClusters
+		if err != nil {
+			fail("cluster_rows", err)
+		}
+		for _, row := range withoutMainRowItems(clusterRows, mainItems) {
+			items := row.Items
+			if items == nil {
+				items = []ScoredItem{}
+			}
+			put(fmt.Sprintf("%s%d", RecTypeForYouClusterPrefix, row.ClusterIndex), "", items)
 		}
-		cached++
 	}
 
-	// Cache similar users liked.
-	items, err := w.engine.SimilarUsersLiked(ctx, userID, profileID, CacheCandidateLimit)
-	if err == nil && len(items) > 0 {
-		if err := repo.UpsertRecommendationCache(ctx, userID, profileID, RecTypeSimilarUsersLiked, "", items, expires); err != nil {
-			slog.WarnContext(ctx, "failed to cache recommendations", "component", "recommendations", "error", err)
-		} else {
-			cached++
+	// An empty Similar Users row is cached too: it records that the row was
+	// built and came out empty (below the account floors), so reads do not
+	// keep asking for a rebuild that cannot fill it.
+	items, err := w.engine.similarUsersLiked(ctx, builder, userID, profileID, CacheCandidateLimit, excluded, accessFilter)
+	if err != nil {
+		fail("similar_users", err)
+	} else {
+		if items == nil {
+			items = []ScoredItem{}
 		}
+		put(RecTypeSimilarUsersLiked, "", items)
 	}
 
-	recentCompleted, err := w.engine.signalReader().RecentCompletedItemIDs(ctx, userID, profileID, 3)
+	anchors, err := anchorItemIDs(ctx, w.engine.signalReader(), ratingReader(w.engine.ratingsRepo), userID, profileID, BecauseYouWatchedAnchors)
 	if err != nil {
-		slog.WarnContext(ctx, "failed to load recent completed items for recommendation cache", "component", "recommendations", "user_id", userID, "profile_id", profileID, "error", err)
-		return cached
+		fail("recent_completed", err)
+		return res
 	}
-	for _, sourceItemID := range recentCompleted {
-		items, err := w.engine.BecauseYouWatched(ctx, userID, profileID, sourceItemID, CacheCandidateLimit)
-		if err != nil || len(items) == 0 {
-			continue
-		}
-		if err := repo.UpsertRecommendationCache(ctx, userID, profileID, RecTypeBecauseWatched, sourceItemID, items, expires); err != nil {
-			slog.WarnContext(ctx, "failed to cache recommendations", "component", "recommendations", "error", err, "rec_type", RecTypeBecauseWatched, "source_item_id", sourceItemID)
+	for _, sourceItemID := range anchors {
+		items, err := w.engine.becauseYouWatched(ctx, builder, sourceItemID, CacheCandidateLimit, excluded, accessFilter)
+		if err != nil {
+			fail("because_you_watched", err, "source_item_id", sourceItemID)
 			continue
 		}
-		cached++
+		putOrDrop(RecTypeBecauseWatched, sourceItemID, items)
 	}
 
-	return cached
+	return res
 }
 
-// stalenessLoop checks for stale taste profiles every 5 minutes and refreshes them.
+// stalenessLoop refreshes stale taste profiles every few minutes.
 func (w *Worker) stalenessLoop(ctx context.Context) {
-	ticker := time.NewTicker(5 * time.Minute)
+	ticker := time.NewTicker(staleSweepInterval)
 	defer ticker.Stop()
 
 	for {
@@ -504,27 +1160,88 @@ func (w *Worker) stalenessLoop(ctx context.Context) {
 	}
 }
 
-// refreshStaleProfiles finds profiles marked stale and refreshes them.
+// staleSweepResult counts one stale sweep's profiles.
+type staleSweepResult struct {
+	// Stale counts the marked profiles the sweep took, up to its batch.
+	Stale     int `json:"stale"`
+	Refreshed int `json:"refreshed"`
+	// Failed counts refreshes that failed; their profiles are marked stale
+	// again for the next sweep.
+	Failed int `json:"failed"`
+	// Deferred counts profiles left marked for a later sweep: another
+	// server was refreshing them, or this server had not loaded a policy
+	// change yet. Queued counts those already queued or refreshing on this
+	// server.
+	Deferred int `json:"deferred"`
+	Queued   int `json:"queued"`
+}
+
+// refreshStaleProfiles refreshes the profiles marked stale. One server sweeps
+// at a time: the sweep holds its cluster lock until its refreshes finish, so a
+// server whose tick lands meanwhile skips instead of rebuilding the same
+// profiles. A sweep that refreshed or failed a profile is recorded in job
+// history under staleSweepTaskKey.
 func (w *Worker) refreshStaleProfiles(ctx context.Context) {
-	repo := NewRepo(w.engine.pool)
-	stale, err := repo.GetStaleProfiles(ctx, 50)
+	lockCtx, cancel := context.WithTimeout(ctx, jobLockTimeout)
+	held, acquired, err := w.locker.TryLock(lockCtx, staleSweepLock)
+	cancel()
 	if err != nil {
-		slog.ErrorContext(ctx, "staleness check failed", "component", "recommendations", "error", err)
+		slog.WarnContext(ctx, "stale profile sweep could not take its lock", "component", "recommendations", "error", err)
 		return
 	}
-	if len(stale) == 0 {
+	if !acquired {
 		return
 	}
+	defer held.Release()
 
-	slog.InfoContext(ctx, "refreshing stale taste profiles", "component", "recommendations", "count", len(stale))
-	for _, p := range stale {
-		w.RequestProfileRefresh(ctx, p.UserID, p.ProfileID)
+	started := time.Now()
+	res, err := w.sweepStaleProfiles(ctx, held)
+	if err == nil && res.Refreshed == 0 && res.Failed == 0 {
+		return
+	}
+	switch {
+	case err != nil:
+		slog.ErrorContext(ctx, "stale profile sweep failed", "component", "recommendations", "error", err)
+	case res.Failed > 0:
+		slog.WarnContext(ctx, "stale profile sweep completed with errors", "component", "recommendations", "stale", res.Stale, "refreshed", res.Refreshed, "failed", res.Failed)
 	}
+	data, _ := json.Marshal(res) // only ints: it cannot fail
+	w.recordRun(staleSweepTaskKey, started, time.Now(), data, err)
 }
 
-// RunEmbeddingsNow triggers an immediate embedding run (for first-run setup).
-func (w *Worker) RunEmbeddingsNow() {
-	_ = w.TriggerEmbeddings()
+func (w *Worker) sweepStaleProfiles(ctx context.Context, held clusterLock) (staleSweepResult, error) {
+	var res staleSweepResult
+	stale, err := w.engine.repo.GetStaleProfiles(ctx, staleSweepBatch)
+	if err != nil {
+		return res, fmt.Errorf("list stale profiles: %w", err)
+	}
+	res.Stale = len(stale)
+	if len(stale) == 0 {
+		return res, nil
+	}
+
+	slog.InfoContext(ctx, "refreshing stale taste profiles", "component", "recommendations", "count", len(stale))
+	// A sweep cut short by shutdown leaves the rest marked for the next one.
+	for i := 0; i < len(stale) && ctx.Err() == nil; i++ {
+		p := stale[i]
+		key := profileRefreshKey(p.UserID, p.ProfileID)
+		if !w.claimProfileRefresh(key) {
+			res.Queued++ // already queued or refreshing on this server
+			continue
+		}
+		switch err := w.runProfileRefresh(ctx, held, p.UserID, p.ProfileID, w.refreshProfile); {
+		case err == nil:
+			res.Refreshed++
+		case errors.Is(err, errProfileRefreshElsewhere), errors.Is(err, errPolicyNotLoaded):
+			res.Deferred++
+		case errors.Is(err, errJobLockLost):
+			res.Failed++
+			return res, err
+		default:
+			res.Failed++
+		}
+	}
+	return res, nil
 }
 
 func (w *Worker) profileRefreshLoop(ctx context.Context) {
@@ -533,40 +1250,297 @@ func (w *Worker) profileRefreshLoop(ctx context.Context) {
 		case <-ctx.Done():
 			return
 		case req := <-w.profileRefreshCh:
-			if err := w.refreshProfile(ctx, req.userID, req.profileID); err != nil {
-				slog.ErrorContext(ctx, "profile recommendation refresh failed", "component", "recommendations", "user_id", req.userID, "profile_id", req.profileID, "error", err)
-			}
-			w.clearProfileRefreshPending(profileRefreshKey(req.userID, req.profileID))
+			_ = w.runProfileRefresh(ctx, nil, req.userID, req.profileID, w.refreshProfile)
+		}
+	}
+}
+
+// profileRefresh refreshes a profile; refreshProfile is the one the worker
+// runs. held is the caller's cluster lock, or nil.
+type profileRefresh func(ctx context.Context, held clusterLock, userID int, profileID string) error
+
+// profileRefreshMaxRuns is the most times runProfileRefresh runs a refresh
+// back to back for requests made while it ran.
+const profileRefreshMaxRuns = 3
+
+// runProfileRefresh runs refresh for a profile whose pending key the caller
+// claimed, then releases the key, and returns the last run's error after
+// logging it. held is the caller's cluster lock, or nil. A refresh request
+// made while it runs makes it run once more as soon as it ends, so a burst of
+// changes is fully applied in seconds rather than at the next stale sweep. A
+// failed run, one another server is already doing, or one this server cannot
+// run under the latest access policy stops: the profile stays marked stale,
+// and the sweep retries it. So does a profile still changing after
+// profileRefreshMaxRuns runs, so a stream of changes to one profile cannot
+// hold the refresh queue, or the sweep's lock, for as long as it lasts: each
+// signal change marked the profile stale before asking.
+func (w *Worker) runProfileRefresh(ctx context.Context, held clusterLock, userID int, profileID string, refresh profileRefresh) error {
+	key := profileRefreshKey(userID, profileID)
+	for run := 1; ; run++ {
+		// A request made before this run started is read by it.
+		w.dropProfileRefreshAgain(key)
+		err := refresh(ctx, held, userID, profileID)
+		switch {
+		case errors.Is(err, errProfileRefreshElsewhere):
+			slog.InfoContext(ctx, "profile is refreshing on another server; left for the stale sweep", "component", "recommendations", "user_id", userID, "profile_id", profileID)
+		case errors.Is(err, errPolicyNotLoaded):
+			slog.InfoContext(ctx, "this server has not loaded the latest access policy; profile left for the stale sweep", "component", "recommendations", "user_id", userID, "profile_id", profileID)
+		case err != nil:
+			slog.ErrorContext(ctx, "profile recommendation refresh failed", "component", "recommendations", "user_id", userID, "profile_id", profileID, "error", err)
+		}
+		if err != nil {
+			w.clearProfileRefreshPending(key)
+			return err
+		}
+		if !w.finishProfileRefresh(key) {
+			return nil
+		}
+		if run == profileRefreshMaxRuns {
+			slog.InfoContext(ctx, "profile still changing after repeated refreshes; left for the stale sweep", "component", "recommendations", "user_id", userID, "profile_id", profileID, "runs", run)
+			w.clearProfileRefreshPending(key)
+			return nil
+		}
+	}
+}
+
+// tryProfileLock takes the profile's cluster-wide refresh lock without
+// waiting. Every write of a profile's taste profile, clusters or cached rows
+// holds it: refreshes and the scheduled taste and cache jobs. Work that holds
+// a cluster lock (a job, the stale sweep) passes it as held, and the profile
+// lock shares its connection; otherwise held is nil and the profile lock
+// takes its own.
+func (w *Worker) tryProfileLock(ctx context.Context, held clusterLock, userID int, profileID string) (unlock func(), acquired bool, err error) {
+	lockCtx, cancel := context.WithTimeout(ctx, jobLockTimeout)
+	defer cancel()
+	key := profileRefreshLock(userID, profileID)
+	if held != nil {
+		unlock, acquired, err = held.TryAlso(lockCtx, key)
+	} else {
+		var lock clusterLock
+		lock, acquired, err = w.locker.TryLock(lockCtx, key)
+		if acquired {
+			unlock = lock.Release
 		}
 	}
+	if err != nil {
+		return nil, false, fmt.Errorf("take profile refresh lock: %w", err)
+	}
+	return unlock, acquired, nil
+}
+
+// markBusyProfileStale marks stale a profile a scheduled job skipped because
+// another server held its lock. The holder may be the other scheduled job,
+// which rebuilds only its own stage, so the stale sweep runs a full refresh
+// after it; the mark is newer than the holder's start, so it is not cleared.
+func (w *Worker) markBusyProfileStale(ctx context.Context, userID int, profileID string) {
+	markCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), staleMarkTimeout)
+	defer cancel()
+	w.markProfileStale(markCtx, userID, profileID)
 }
 
-func (w *Worker) refreshProfile(ctx context.Context, userID int, profileID string) (runErr error) {
+// errProfileRefreshElsewhere reports a profile refresh skipped because
+// another server holds the profile's refresh lock.
+var errProfileRefreshElsewhere = errors.New("profile refresh running on another server")
+
+// errPolicyNotLoaded reports a profile refresh skipped because this server
+// has not loaded the stored access policy generation yet.
+var errPolicyNotLoaded = errors.New("access policy change not loaded on this server yet")
+
+// profileRefreshLock is the cluster-wide advisory lock key for one profile's
+// refresh. Keys hash into the same space as the job locks; a collision only
+// defers one refresh to the stale sweep.
+func profileRefreshLock(userID int, profileID string) int64 {
+	h := fnv.New64a()
+	_, _ = h.Write([]byte("prairie-recs-profile-refresh:" + profileRefreshKey(userID, profileID)))
+	return int64(h.Sum64()) //nolint:gosec // a lock key; wrapping is fine
+}
+
+// refreshProfile rebuilds one profile's taste profile and cached rows. When
+// every step succeeds it clears the stale marks set before the refresh
+// started; a mark set while it ran stays for the stale sweep. When a step
+// fails it marks the profile stale again, so the sweep retries it.
+//
+// One server at a time refreshes a profile: otherwise a refresh that read
+// older signals could finish last and overwrite a newer one's rows after that
+// one cleared the stale mark. A refresh that finds the profile's lock held
+// returns errProfileRefreshElsewhere and marks the profile stale; the holder
+// clears only marks older than its own start, so the sweep runs it again.
+func (w *Worker) refreshProfile(ctx context.Context, held clusterLock, userID int, profileID string) (runErr error) {
 	ctx, observation := workmetrics.Start(ctx, "recommendations", time.Time{})
 	defer workmetrics.Profile(ctx)()
 	defer func() { observation.Finish(telemetry.Outcome(runErr)) }()
-	refreshCtx, cancel := context.WithTimeout(ctx, 2*time.Minute)
+	defer func() {
+		if runErr == nil {
+			return
+		}
+		// The rebuild may have stored the taste profile, consuming the mark
+		// that queued this refresh, before a later step failed.
+		markCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), staleMarkTimeout)
+		defer cancel()
+		w.markProfileStale(markCtx, userID, profileID)
+	}()
+	refreshCtx, cancel := context.WithTimeout(ctx, profileRefreshTimeout)
 	defer cancel()
 
-	if err := w.engine.RefreshTasteProfile(refreshCtx, userID, profileID); err != nil {
-		return fmt.Errorf("refresh taste profile: %w", err)
+	unlock, acquired, err := w.tryProfileLock(refreshCtx, held, userID, profileID)
+	if err != nil {
+		return err
+	}
+	if !acquired {
+		return errProfileRefreshElsewhere
 	}
+	defer unlock()
 
-	repo := NewRepo(w.engine.pool)
-	expires := time.Now().Add(24 * time.Hour).Format(time.RFC3339)
-	w.cacheUserRows(refreshCtx, repo, userID, profileID, expires)
-	if err := repo.ClearStaleAt(refreshCtx, userID, profileID); err != nil {
+	// started is read under the lock, after any earlier holder finished.
+	repo := w.engine.repo
+	started, err := repo.Now(refreshCtx)
+	if err != nil {
+		return err
+	}
+	// Checked after started: a policy change committed before the check
+	// stops this refresh, and one committed after it is marked, on its first
+	// load anywhere, after started, so this refresh does not clear the mark.
+	if w.policyCurrent != nil {
+		current, err := w.policyCurrent(refreshCtx)
+		if err != nil {
+			return fmt.Errorf("check access policy generation: %w", err)
+		}
+		if !current {
+			return errPolicyNotLoaded
+		}
+	}
+	if _, err := w.engine.rebuildTasteProfile(refreshCtx, userID, profileID, started); err != nil {
+		return fmt.Errorf("refresh taste profile: %w", err)
+	}
+	if built := w.cacheUserRows(refreshCtx, repo, userID, profileID, cacheExpiry(started)); built.failed > 0 {
+		return fmt.Errorf("rebuild recommendation cache: %d steps failed", built.failed)
+	}
+	if err := w.engine.purgeIfProfileDeleted(refreshCtx, userID, profileID); err != nil {
+		return fmt.Errorf("check profile still exists: %w", err)
+	}
+	if err := repo.ClearStaleAt(refreshCtx, userID, profileID, started); err != nil {
 		slog.WarnContext(ctx, "failed to clear stale profile marker", "component", "recommendations", "user_id", userID, "profile_id", profileID, "error", err)
 	}
 	return nil
 }
 
+// claimProfileRefresh marks a profile's refresh pending on this server. It
+// returns false when one is already queued or running.
+func (w *Worker) claimProfileRefresh(key string) bool {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	if _, exists := w.profileRefreshPending[key]; exists {
+		return false
+	}
+	w.profileRefreshPending[key] = struct{}{}
+	return true
+}
+
 func (w *Worker) clearProfileRefreshPending(key string) {
 	w.mu.Lock()
 	defer w.mu.Unlock()
 	delete(w.profileRefreshPending, key)
+	delete(w.profileRefreshAgain, key)
+}
+
+// claimProfileRefreshOrAskAgain claims a profile's refresh, as
+// claimProfileRefresh does, or, when one is already queued or running on this
+// server, asks it to run once more and reports false. A refresh queued here
+// reads the change when it starts; one already running may have read the
+// signals before it. Both happen under one lock, so the request cannot fall
+// between a run that is finishing and its release of the key.
+func (w *Worker) claimProfileRefreshOrAskAgain(key string) bool {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	if _, exists := w.profileRefreshPending[key]; !exists {
+		w.profileRefreshPending[key] = struct{}{}
+		return true
+	}
+	if w.profileRefreshAgain == nil {
+		w.profileRefreshAgain = make(map[string]struct{})
+	}
+	w.profileRefreshAgain[key] = struct{}{}
+	return false
+}
+
+// dropProfileRefreshAgain forgets a request to run again.
+func (w *Worker) dropProfileRefreshAgain(key string) {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	delete(w.profileRefreshAgain, key)
+}
+
+// finishProfileRefresh ends a refresh run. It reports true, keeping the
+// pending key, when a request to run again arrived; otherwise it releases the
+// key. Both happen under one lock, so a request is never caught between them.
+func (w *Worker) finishProfileRefresh(key string) bool {
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	if _, again := w.profileRefreshAgain[key]; again {
+		delete(w.profileRefreshAgain, key)
+		return true
+	}
+	delete(w.profileRefreshPending, key)
+	return false
 }
 
 func profileRefreshKey(userID int, profileID string) string {
 	return fmt.Sprintf("%d:%s", userID, profileID)
 }
+
+// refreshThrottle lets each key through at most once per interval. The zero
+// value is ready to use.
+type refreshThrottle struct {
+	mu        sync.Mutex
+	now       func() time.Time // nil means time.Now
+	last      map[string]time.Time
+	lastPrune time.Time
+}
+
+// allow reports whether key may go ahead now, and records it when it may.
+func (t *refreshThrottle) allow(key string, interval time.Duration) bool {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	now := time.Now()
+	if t.now != nil {
+		now = t.now()
+	}
+	if t.last == nil {
+		t.last = make(map[string]time.Time)
+	}
+	// Forget expired keys once per interval, so the map holds only the
+	// profiles let through recently.
+	if now.Sub(t.lastPrune) >= interval {
+		for k, at := range t.last {
+			if now.Sub(at) >= interval {
+				delete(t.last, k)
+			}
+		}
+		t.lastPrune = now
+	}
+	if at, ok := t.last[key]; ok && now.Sub(at) < interval {
+		return false
+	}
+	t.last[key] = now
+	return true
+}
+
+// forget drops key's record, so allow lets it through again.
+func (t *refreshThrottle) forget(key string) {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	delete(t.last, key)
+}
+
+// due reports whether allow would let key go ahead now, without recording
+// it.
+func (t *refreshThrottle) due(key string, interval time.Duration) bool {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	now := time.Now()
+	if t.now != nil {
+		now = t.now()
+	}
+	at, ok := t.last[key]
+	return !ok || now.Sub(at) >= interval
+}
diff --git a/internal/recommendations/worker_postgres_test.go b/internal/recommendations/worker_postgres_test.go
new file mode 100644
index 0000000000..4f8e96953f
--- /dev/null
+++ b/internal/recommendations/worker_postgres_test.go
@@ -0,0 +1,864 @@
+package recommendations
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"slices"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/config"
+	taskrepository "github.com/prairie-server/prairie-server/internal/taskmanager/repository"
+	"github.com/prairie-server/prairie-server/internal/userdb"
+	"github.com/prairie-server/prairie-server/internal/userstore"
+	"github.com/prairie-server/prairie-server/internal/userstore/pgstore"
+)
+
+// Two workers on separate pools stand in for two API servers sharing one
+// database: while one runs a job the other skips it, and only finished runs
+// are recorded in task_executions.
+func TestRecommendationJobRunsOnOneServerPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	otherPool, err := pgxpool.New(ctx, os.Getenv("PRAIRIE_TEST_DATABASE_URL"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(otherPool.Close)
+
+	var lastID int64
+	if err := pool.QueryRow(ctx, `SELECT COALESCE(MAX(id), 0) FROM task_executions`).Scan(&lastID); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM task_executions WHERE id > $1 AND task_key LIKE 'recommendations.%'`, lastID)
+	})
+
+	serverA := newJobTestWorker(pgJobLocker{pool: pool}, taskrepository.NewPgExecutionRepository(pool))
+	serverB := newJobTestWorker(pgJobLocker{pool: otherPool}, taskrepository.NewPgExecutionRepository(otherPool))
+
+	started := make(chan struct{})
+	finish := make(chan struct{})
+	doneA := make(chan error, 1)
+	go func() {
+		doneA <- serverA.runJob(job{name: JobCowatch, timeout: time.Minute, run: func(context.Context, clusterLock) (jobResult, error) {
+			close(started)
+			<-finish
+			return countsResult{Done: 1}, nil
+		}}, false)
+	}()
+	select {
+	case <-started:
+	case err := <-doneA:
+		t.Fatalf("server A did not start the job: %v", err)
+	case <-time.After(10 * time.Second):
+		t.Fatal("server A did not start the job")
+	}
+
+	ranB := false
+	err = serverB.runJob(job{name: JobCowatch, timeout: time.Minute, run: func(context.Context, clusterLock) (jobResult, error) {
+		ranB = true
+		return countsResult{}, nil
+	}}, false)
+	if !errors.Is(err, ErrJobRunningElsewhere) || ranB {
+		t.Fatalf("server B while A runs: err=%v ran=%v; want ErrJobRunningElsewhere", err, ranB)
+	}
+	// Other jobs are not blocked by this one.
+	if err := serverB.runJob(job{name: JobTasteProfiles, timeout: time.Minute, run: func(context.Context, clusterLock) (jobResult, error) {
+		return countsResult{}, nil
+	}}, false); err != nil {
+		t.Fatalf("a different job on server B: %v", err)
+	}
+
+	close(finish)
+	if err := <-doneA; err != nil {
+		t.Fatalf("server A run: %v", err)
+	}
+	// A released the lock when its run returned, so B can take the job now.
+	if err := serverB.runJob(job{name: JobCowatch, timeout: time.Minute, run: func(context.Context, clusterLock) (jobResult, error) {
+		ranB = true
+		return countsResult{Done: 4, Failed: 2}, errors.New("co-watch upsert failed")
+	}}, false); err != nil || !ranB {
+		t.Fatalf("server B after A finished: err=%v ran=%v", err, ranB)
+	}
+
+	rows, err := pool.Query(ctx, `
+		SELECT status, COALESCE(error_message, ''), result_data::text
+		FROM task_executions
+		WHERE id > $1 AND task_key = $2
+		ORDER BY id`, lastID, cowatchTaskKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	type recorded struct{ status, errMsg, data string }
+	var runs []recorded
+	for rows.Next() {
+		var r recorded
+		if err := rows.Scan(&r.status, &r.errMsg, &r.data); err != nil {
+			t.Fatal(err)
+		}
+		runs = append(runs, r)
+	}
+	if err := rows.Err(); err != nil {
+		t.Fatal(err)
+	}
+	want := []recorded{
+		{runStatusCompleted, "", `{"done": 1, "failed": 0}`},
+		{runStatusFailed, "co-watch upsert failed", `{"done": 4, "failed": 2}`},
+	}
+	if len(runs) != len(want) {
+		t.Fatalf("recorded co-watch runs = %+v, want %+v (the skipped run must not be recorded)", runs, want)
+	}
+	for i := range want {
+		if runs[i] != want[i] {
+			t.Fatalf("run %d = %+v, want %+v", i, runs[i], want[i])
+		}
+	}
+
+	last, err := serverA.LastRuns(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if run := last[JobCowatch].Full; run == nil || run.Status != runStatusFailed || run.ErrorMessage != "co-watch upsert failed" {
+		t.Fatalf("last co-watch run = %+v", run)
+	}
+	if run := last[JobTasteProfiles].Full; run == nil || run.Status != runStatusCompleted {
+		t.Fatalf("last taste profile run = %+v", run)
+	}
+}
+
+func TestListCacheRefreshCandidatesOldestFirstPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	var userID int
+	if err := pool.QueryRow(ctx, `INSERT INTO users (username, role) VALUES ($1, 'user') RETURNING id`,
+		"cache-order-"+uuid.NewString()).Scan(&userID); err != nil {
+		t.Fatalf("insert user: %v", err)
+	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM users WHERE id = $1`, userID)
+	})
+	var dims int
+	if err := pool.QueryRow(ctx, `
+		SELECT atttypmod FROM pg_attribute
+		WHERE attrelid = 'public.user_taste_profiles'::regclass AND attname = 'embedding'`).Scan(&dims); err != nil {
+		t.Fatalf("read embedding dimensions: %v", err)
+	}
+
+	repo := NewRepo(pool)
+	for _, profile := range []string{"recent", "never", "old"} {
+		if err := repo.UpsertTasteProfile(ctx, userID, profile, make([]float32, dims), map[string]int{}, "", time.Now()); err != nil {
+			t.Fatalf("seed taste profile %s: %v", profile, err)
+		}
+	}
+	items := []ScoredItem{{MediaItemID: "item", Score: 1}}
+	expiry := time.Now().Add(3 * time.Hour).UTC().Truncate(time.Second)
+	for _, profile := range []string{"recent", "old"} {
+		if err := repo.UpsertRecommendationCache(ctx, userID, profile, RecTypeForYouMain, "", items, expiry.Format(time.RFC3339)); err != nil {
+			t.Fatal(err)
+		}
+	}
+	// A profile with only other rows has no main row and still goes first.
+	if err := repo.UpsertRecommendationCache(ctx, userID, "never", RecTypeForYouClusterPrefix+"0", "", items, expiry.Format(time.RFC3339)); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := pool.Exec(ctx, `
+		UPDATE recommendation_cache
+		SET    created_at = NOW() - CASE profile_id WHEN 'old' THEN interval '30 hours' ELSE interval '1 hour' END
+		WHERE  user_id = $1 AND rec_type = $2`, userID, RecTypeForYouMain); err != nil {
+		t.Fatal(err)
+	}
+
+	candidates, err := repo.ListCacheRefreshCandidates(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var mine []string
+	for _, c := range candidates {
+		if c.UserID == userID {
+			mine = append(mine, c.ProfileID)
+		}
+	}
+	if strings.Join(mine, ",") != "never,old,recent" {
+		t.Fatalf("candidates = %v, want never, old, recent", mine)
+	}
+
+	// A global row with a unique type makes the existence check true.
+	recType := "test_global_" + uuid.NewString()
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM recommendation_cache WHERE user_id IS NULL AND rec_type = $1`, recType)
+	})
+	if err := repo.UpsertRecommendationCache(ctx, GlobalCacheUserID, GlobalCacheProfileID, recType, "", items, expiry.Format(time.RFC3339)); err != nil {
+		t.Fatal(err)
+	}
+	if cached, err := repo.HasGlobalRecommendationCache(ctx); err != nil || !cached {
+		t.Fatalf("global cache check = %v, %v; want true", cached, err)
+	}
+}
+
+func TestExtendGlobalRecommendationCachePostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	repo := NewRepo(pool)
+	var userID int
+	if err := pool.QueryRow(ctx, `INSERT INTO users (username, role) VALUES ($1, 'user') RETURNING id`,
+		"cache-extend-"+uuid.NewString()).Scan(&userID); err != nil {
+		t.Fatalf("insert user: %v", err)
+	}
+	base := "test_extend_" + uuid.NewString() + "_"
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM recommendation_cache WHERE starts_with(rec_type, $1)`, base)
+		_, _ = pool.Exec(context.Background(), `DELETE FROM users WHERE id = $1`, userID)
+	})
+
+	now := time.Now().UTC().Truncate(time.Second)
+	soon, next, beyond, gone := now.Add(time.Hour), now.Add(cacheTTL), now.Add(cacheTTL+time.Hour), now.Add(-time.Hour)
+	items := []ScoredItem{{MediaItemID: "item", Score: 1}}
+	seed := func(userID int, recType string, expires time.Time) {
+		t.Helper()
+		if err := repo.UpsertRecommendationCache(ctx, userID, GlobalCacheProfileID, recType, "", items, expires.Format(time.RFC3339)); err != nil {
+			t.Fatal(err)
+		}
+	}
+	seed(GlobalCacheUserID, base+"one", soon)
+	seed(GlobalCacheUserID, base+"one_more", soon)
+	seed(GlobalCacheUserID, base+"p_a", soon)
+	seed(GlobalCacheUserID, base+"p_b", beyond)
+	seed(GlobalCacheUserID, base+"p_gone", gone)
+	// An account row is not global, even under the same profile ID and type.
+	seed(userID, base+"p_a", soon)
+
+	// expiry reads a row's expiry; a nil owner is the global row.
+	expiry := func(owner *int, recType string) time.Time {
+		t.Helper()
+		var at time.Time
+		if err := pool.QueryRow(ctx, `
+			SELECT expires_at FROM recommendation_cache
+			WHERE  user_id IS NOT DISTINCT FROM $1::int AND profile_id = $2
+			  AND  rec_type = $3 AND source_item_id = ''`,
+			owner, GlobalCacheProfileID, recType).Scan(&at); err != nil {
+			t.Fatalf("read %s expiry: %v", recType, err)
+		}
+		return at
+	}
+
+	n, err := repo.ExtendGlobalRecommendationCache(ctx, base+"one", false, next.Format(time.RFC3339))
+	if err != nil || n != 1 {
+		t.Fatalf("exact extend = %d, %v; want 1 row", n, err)
+	}
+	if got := expiry(nil, base+"one"); !got.Equal(next) {
+		t.Fatalf("extended row expires %v, want %v", got, next)
+	}
+	if got := expiry(nil, base+"one_more"); !got.Equal(soon) {
+		t.Fatalf("exact extend reached a longer type: %v", got)
+	}
+
+	n, err = repo.ExtendGlobalRecommendationCache(ctx, base+"p_", true, next.Format(time.RFC3339))
+	if err != nil || n != 2 {
+		t.Fatalf("prefix extend = %d, %v; want the 2 unexpired global rows", n, err)
+	}
+	for recType, want := range map[string]time.Time{
+		base + "p_a":    next,
+		base + "p_b":    beyond, // never shortened
+		base + "p_gone": gone,   // an expired row is not brought back
+	} {
+		if got := expiry(nil, recType); !got.Equal(want) {
+			t.Fatalf("%s expires %v, want %v", recType, got, want)
+		}
+	}
+	if got := expiry(&userID, base+"p_a"); !got.Equal(soon) {
+		t.Fatalf("account row extended to %v", got)
+	}
+}
+
+// On a user store outside Postgres, the nightly taste job finds profiles
+// whose only signals live in the store, and skips the store's profiles with
+// none. On the Postgres store its subject query alone decides.
+func TestTasteProfileSubjectsReadTheSQLiteStorePostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	var userID int
+	if err := pool.QueryRow(ctx, `INSERT INTO users (username, role) VALUES ($1, 'user') RETURNING id`,
+		"taste-subjects-"+uuid.NewString()).Scan(&userID); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _, _ = pool.Exec(context.Background(), `DELETE FROM users WHERE id = $1`, userID) })
+
+	provider := userdb.NewSQLiteProvider(userdb.NewUserDBPool(userdb.PoolConfig{DataDir: t.TempDir()}))
+	t.Cleanup(func() { _ = provider.Close() })
+	store, err := provider.ForUser(ctx, userID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, id := range []string{"with-signals", "empty"} {
+		if err := store.CreateProfile(ctx, userstore.Profile{ID: id, Name: id}); err != nil {
+			t.Fatalf("create profile %s: %v", id, err)
+		}
+	}
+	if _, err := store.AddFavorite(ctx, "with-signals", "movie-only-in-sqlite"); err != nil {
+		t.Fatal(err)
+	}
+
+	engine := NewEngine(pool, nil, nil, nil, provider, config.RecommendationsConfig{})
+	w := newJobTestWorker(&fakeLocker{}, nil)
+	w.engine = engine
+	subjectsOf := func() []string {
+		t.Helper()
+		subjects, failed, err := w.tasteProfileSubjects(ctx)
+		if err != nil || failed != 0 {
+			t.Fatalf("list subjects: failed=%d err=%v", failed, err)
+		}
+		var profiles []string
+		for _, s := range subjects {
+			if s.UserID == userID {
+				profiles = append(profiles, s.ProfileID)
+			}
+		}
+		return profiles
+	}
+
+	if got := subjectsOf(); len(got) != 0 {
+		t.Fatalf("subjects on the Postgres store = %v, want none: the SQLite rows are invisible to the query", got)
+	}
+	engine.WithUserStoreOutsidePostgres(true)
+	if got := subjectsOf(); len(got) != 1 || got[0] != "with-signals" {
+		t.Fatalf("subjects on the SQLite store = %v, want [with-signals]", got)
+	}
+}
+
+// On the Postgres store the nightly taste job skips the rows of a profile its
+// account no longer lists, as the purge migration does, and keeps an account
+// that lists no profile at all. A store outside Postgres cannot tell, so it
+// keeps them.
+func TestTasteProfileSubjectsSkipDeletedProfilesPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	userID, live := newTasteTestAccount(t, pool, "taste-subjects-deleted-")
+	var unlisted int
+	if err := pool.QueryRow(ctx, `INSERT INTO users (username, role) VALUES ($1, 'user') RETURNING id`,
+		"taste-subjects-unlisted-"+uuid.NewString()).Scan(&unlisted); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _, _ = pool.Exec(context.Background(), `DELETE FROM users WHERE id = $1`, unlisted) })
+
+	repo := NewRepo(pool)
+	vec := axisVector(1800, nil)
+	for _, s := range []StaleProfile{{UserID: userID, ProfileID: live}, {UserID: userID, ProfileID: "deleted"}, {UserID: unlisted, ProfileID: "unlisted"}} {
+		if err := repo.UpsertTasteProfile(ctx, s.UserID, s.ProfileID, vec, map[string]int{}, "", time.Now()); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	engine := NewEngine(pool, nil, nil, nil, pgstore.NewPostgresProvider(pool), config.RecommendationsConfig{})
+	w := newJobTestWorker(&fakeLocker{}, nil)
+	w.engine = engine
+	subjectsOf := func() []string {
+		t.Helper()
+		subjects, _, err := w.tasteProfileSubjects(ctx)
+		if err != nil {
+			t.Fatalf("list subjects: %v", err)
+		}
+		var profiles []string
+		for _, s := range subjects {
+			if s.UserID == userID || s.UserID == unlisted {
+				profiles = append(profiles, s.ProfileID)
+			}
+		}
+		slices.Sort(profiles)
+		return profiles
+	}
+
+	want := []string{live, "unlisted"}
+	slices.Sort(want)
+	if got := subjectsOf(); !slices.Equal(got, want) {
+		t.Fatalf("subjects on the Postgres store = %v, want %v", got, want)
+	}
+	engine.WithUserStoreOutsidePostgres(true)
+	if got := subjectsOf(); !slices.Contains(got, "deleted") {
+		t.Fatalf("subjects on a store outside Postgres = %v, want the unlisted profile kept", got)
+	}
+}
+
+// The scheduled taste job skips a profile another server holds: it read its
+// signals earlier than that holder and could overwrite the newer taste
+// profile. The skipped profile is marked stale, and a later run with the lock
+// free rebuilds it.
+func TestTasteProfileJobSkipsAProfileRefreshingElsewherePostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	userID, profile := newTasteTestAccount(t, pool, "taste-job-busy-")
+	repo := NewRepo(pool)
+	stored := time.Now().Add(-time.Hour).UTC().Truncate(time.Microsecond)
+	if err := repo.UpsertTasteProfile(ctx, userID, profile, axisVector(1800, nil), map[string]int{}, "", stored); err != nil {
+		t.Fatal(err)
+	}
+	updatedAt := func() time.Time {
+		t.Helper()
+		var at time.Time
+		if err := pool.QueryRow(ctx, `SELECT updated_at FROM user_taste_profiles WHERE user_id = $1 AND profile_id = $2`, userID, profile).Scan(&at); err != nil {
+			t.Fatal(err)
+		}
+		return at.UTC()
+	}
+	engine := NewEngine(pool, catalog.NewRatingsRepo(pool), catalog.NewItemRepository(pool), nil, pgstore.NewPostgresProvider(pool), config.RecommendationsConfig{})
+
+	busy := newJobTestWorker(&keyedLocker{held: map[int64]bool{profileRefreshLock(userID, profile): true}}, nil)
+	busy.engine = engine
+	busy.staleMarker = engine.repo
+	res, err := busy.doTasteProfiles(ctx, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if res.Busy < 1 || !updatedAt().Equal(stored) {
+		t.Fatalf("taste job with the profile locked elsewhere: busy %d, updated_at %v; want it skipped and left at %v", res.Busy, updatedAt(), stored)
+	}
+	// The holder may be the cache job, which does not rebuild the taste
+	// profile, so the skipped profile is left for the stale sweep.
+	var pending bool
+	if err := pool.QueryRow(ctx, `SELECT stale_at > updated_at FROM user_taste_profiles WHERE user_id = $1 AND profile_id = $2`, userID, profile).Scan(&pending); err != nil || !pending {
+		t.Fatalf("skipped profile pending = %v, %v; want it marked stale", pending, err)
+	}
+
+	free := newJobTestWorker(&fakeLocker{}, nil)
+	free.engine = engine
+	if _, err := free.doTasteProfiles(ctx, nil); err != nil {
+		t.Fatal(err)
+	}
+	if updatedAt().Equal(stored) {
+		t.Fatal("taste job with the lock free did not rebuild the profile")
+	}
+}
+
+// The profile's cached rows leave out what it watched and what it favorited,
+// including taste-seed picks and a favorited episode's series, while its
+// watchlist titles stay recommendable. This covers the main and cluster rows,
+// Because You Watched and Similar Users.
+func TestCacheUserRowsLeaveOutWatchedAndFavoritedTitlesPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	const prefix = "tcache-exclude-"
+	cleanupRecoMediaItems(t, pool, prefix)
+	userID, profile := newTasteTestAccount(t, pool, prefix)
+	// Similar Users needs three peer accounts, and two of them behind a title.
+	type account struct {
+		userID  int
+		profile string
+	}
+	var peers []account
+	for i := range minSimilarUsersPeerAccounts {
+		peerID, peer := newTasteTestAccount(t, pool, fmt.Sprintf("%speer-%d-", prefix, i))
+		peers = append(peers, account{peerID, peer})
+	}
+	repo := NewRepo(pool)
+
+	const axis = 2100
+	seedPick, watched, watchlist := prefix+"seed-pick", prefix+"watched", prefix+"watchlist"
+	plain := []string{prefix + "plain-1", prefix + "plain-2", prefix + "plain-3"}
+	series, episode := prefix+"series", prefix+"episode"
+	for i, id := range append([]string{seedPick, watched, watchlist, series}, plain...) {
+		mediaType := "movie"
+		if id == series {
+			mediaType = "series"
+		}
+		seedRecoMediaItem(t, pool, id, mediaType, "matched")
+		if err := repo.UpsertEmbedding(ctx, id, axisVector(axis, map[int]float32{axis + 1 + i: 0.05}), "test-model", id); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for _, stmt := range []struct {
+		query string
+		args  []any
+	}{
+		{`INSERT INTO episodes(content_id, series_id, season_number, episode_number) VALUES($1, $2, 1, 1)`, []any{episode, series}},
+		{`INSERT INTO user_watch_progress(user_id, profile_id, media_item_id, completed, updated_at) VALUES($1, $2, $3, true, NOW())`, []any{userID, profile, watched}},
+		{`INSERT INTO user_favorites(user_id, profile_id, media_item_id) VALUES($1, $2, $3), ($1, $2, $4)`, []any{userID, profile, seedPick, episode}},
+		{`INSERT INTO user_watchlist(user_id, profile_id, media_item_id) VALUES($1, $2, $3)`, []any{userID, profile, watchlist}},
+		{`INSERT INTO user_ratings(user_id, profile_id, media_item_id, rating) VALUES($1, $2, $3, 5), ($1, $2, $4, 5)`, []any{peers[0].userID, peers[0].profile, seedPick, plain[0]}},
+		{`INSERT INTO user_ratings(user_id, profile_id, media_item_id, rating) VALUES($1, $2, $3, 5), ($1, $2, $4, 5)`, []any{peers[1].userID, peers[1].profile, seedPick, plain[0]}},
+	} {
+		if _, err := pool.Exec(ctx, stmt.query, stmt.args...); err != nil {
+			t.Fatalf("seed %q: %v", stmt.query, err)
+		}
+	}
+	taste := axisVector(axis, nil)
+	now := time.Now()
+	for _, p := range append([]account{{userID, profile}}, peers...) {
+		if err := repo.UpsertTasteProfile(ctx, p.userID, p.profile, taste, map[string]int{"favorited": 2, "watch_high": 1}, "", now); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := repo.UpsertTasteClusters(ctx, userID, profile, []TasteCluster{{ClusterIdx: 0, Embedding: taste, Label: "Test", MemberCount: 2, TotalWeight: 1.6}}); err != nil {
+		t.Fatal(err)
+	}
+
+	engine := NewEngine(pool, catalog.NewRatingsRepo(pool), catalog.NewItemRepository(pool), nil, pgstore.NewPostgresProvider(pool), config.RecommendationsConfig{DiversityLambda: 0.7})
+	w := newJobTestWorker(&fakeLocker{}, nil)
+	w.engine = engine
+	if built := w.cacheUserRows(ctx, engine.repo, userID, profile, cacheExpiry(now)); built.failed != 0 {
+		t.Fatalf("cache build = %+v, want no failures", built)
+	}
+
+	excluded := []string{seedPick, watched, series}
+	for _, row := range []struct {
+		recType, source string
+		mustHave        string
+	}{
+		{RecTypeForYouMain, "", watchlist},
+		// The main row's served window takes every title this small catalog
+		// has, so the cluster row is cached empty: built, not missing.
+		{RecTypeForYouClusterPrefix + "0", "", ""},
+		{RecTypeSimilarUsersLiked, "", plain[0]},
+		{RecTypeBecauseWatched, watched, plain[1]},
+	} {
+		items, err := repo.GetRecommendationCache(ctx, userID, profile, row.recType, row.source)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if row.mustHave == "" {
+			if items == nil || len(items) != 0 {
+				t.Fatalf("%s row = %v, want it cached empty", row.recType, items)
+			}
+			continue
+		}
+		ids := make([]string, len(items))
+		for i, item := range items {
+			ids[i] = item.MediaItemID
+		}
+		for _, id := range excluded {
+			if slices.Contains(ids, id) {
+				t.Fatalf("%s row %v holds excluded title %s", row.recType, ids, id)
+			}
+		}
+		if !slices.Contains(ids, row.mustHave) {
+			t.Fatalf("%s row %v is missing %s", row.recType, ids, row.mustHave)
+		}
+	}
+}
+
+// A main, cluster or Because You Watched row whose rebuild finds nothing, here
+// after the profile's access narrowed to no library, is deleted instead of
+// serving its old picks until it expires. A row whose build fails keeps its
+// cached version, and Similar Users is still cached empty.
+func TestCacheUserRowsDropRowsThatRebuildEmptyPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	const prefix = "tcache-empty-"
+	cleanupRecoMediaItems(t, pool, prefix)
+	userID, profile := newTasteTestAccount(t, pool, prefix)
+	repo := NewRepo(pool)
+
+	anchor := prefix + "anchor"
+	taste := axisVector(2200, nil)
+	seedRecoMediaItem(t, pool, anchor, "movie", "matched")
+	if err := repo.UpsertEmbedding(ctx, anchor, taste, "test-model", anchor); err != nil {
+		t.Fatal(err)
+	}
+	now := time.Now()
+	if err := repo.UpsertTasteProfile(ctx, userID, profile, taste, map[string]int{"watch_high": 1}, "", now); err != nil {
+		t.Fatal(err)
+	}
+	for _, stmt := range []string{
+		`INSERT INTO user_watch_progress(user_id, profile_id, media_item_id, completed, updated_at) VALUES($1, $2, '` + anchor + `', true, NOW())`,
+		// Restrictions with no library allowed admit no title.
+		`UPDATE user_profiles SET library_restrictions_enabled = true WHERE user_id = $1 AND id = $2`,
+		// A cluster without an embedding cannot be read, so the cluster build fails.
+		`INSERT INTO user_taste_clusters(user_id, profile_id, cluster_idx, embedding, dominant_genres, label, member_count, total_weight) VALUES($1, $2, 0, NULL, '[]', 'Broken', 1, 1)`,
+	} {
+		if _, err := pool.Exec(ctx, stmt, userID, profile); err != nil {
+			t.Fatalf("seed %q: %v", stmt, err)
+		}
+	}
+
+	type cacheKey struct{ profile, recType, source string }
+	mainKey := cacheKey{profile, RecTypeForYouMain, ""}
+	clusterKey := cacheKey{profile, RecTypeForYouClusterPrefix + "0", ""}
+	becauseKey := cacheKey{profile, RecTypeBecauseWatched, anchor}
+	otherKey := cacheKey{"other", RecTypeForYouMain, ""}
+	oldPicks := []ScoredItem{{MediaItemID: prefix + "old-pick", Score: 1}}
+	for _, k := range []cacheKey{mainKey, clusterKey, becauseKey, otherKey} {
+		if err := repo.UpsertRecommendationCache(ctx, userID, k.profile, k.recType, k.source, oldPicks, cacheExpiry(now)); err != nil {
+			t.Fatal(err)
+		}
+	}
+	cached := func(k cacheKey) bool {
+		t.Helper()
+		return countRows(t, pool, `
+			SELECT COUNT(*) FROM recommendation_cache
+			WHERE  user_id = $1 AND profile_id = $2 AND rec_type = $3 AND source_item_id = $4`,
+			userID, k.profile, k.recType, k.source) == 1
+	}
+
+	engine := NewEngine(pool, catalog.NewRatingsRepo(pool), catalog.NewItemRepository(pool), nil, pgstore.NewPostgresProvider(pool), config.RecommendationsConfig{})
+	w := newJobTestWorker(&fakeLocker{}, nil)
+	w.engine = engine
+	build := func(wantFailed int) {
+		t.Helper()
+		if built := w.cacheUserRows(ctx, repo, userID, profile, cacheExpiry(now)); built.failed != wantFailed {
+			t.Fatalf("cache build = %+v, want %d failed", built, wantFailed)
+		}
+	}
+
+	// The main row is composed from the clusters, so it fails; the cluster
+	// rows, which leave out the main row's titles, keep their cached
+	// versions with it rather than being built against no main row.
+	build(1)
+	if cached(becauseKey) {
+		t.Fatal("the Because You Watched row survived an empty rebuild")
+	}
+	if !cached(mainKey) || !cached(clusterKey) {
+		t.Fatal("the main or cluster row was dropped although its build failed")
+	}
+	if items, err := repo.GetRecommendationCache(ctx, userID, profile, RecTypeSimilarUsersLiked, ""); err != nil || items == nil || len(items) != 0 {
+		t.Fatalf("similar users row = %v, %v; want it cached empty", items, err)
+	}
+	if !cached(otherKey) {
+		t.Fatal("another profile's row was dropped")
+	}
+
+	if err := repo.UpsertTasteClusters(ctx, userID, profile, []TasteCluster{{ClusterIdx: 0, Embedding: taste, Label: "Test", MemberCount: 1, TotalWeight: 1}}); err != nil {
+		t.Fatal(err)
+	}
+	// Once the clusters can be read, the empty main row goes, and the
+	// cluster row is cached empty, so reads know it was built.
+	build(0)
+	if cached(mainKey) {
+		t.Fatal("the main row survived an empty rebuild")
+	}
+	if items, err := repo.GetRecommendationCache(ctx, userID, profile, RecTypeForYouClusterPrefix+"0", ""); err != nil || items == nil || len(items) != 0 {
+		t.Fatalf("cluster row = %v, %v; want it cached empty", items, err)
+	}
+}
+
+func TestDeleteGlobalRecommendationCachePostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	repo := NewRepo(pool)
+	var userID int
+	if err := pool.QueryRow(ctx, `INSERT INTO users (username, role) VALUES ($1, 'user') RETURNING id`,
+		"cache-delete-"+uuid.NewString()).Scan(&userID); err != nil {
+		t.Fatalf("insert user: %v", err)
+	}
+	base := "test_delete_" + uuid.NewString() + "_"
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM recommendation_cache WHERE starts_with(rec_type, $1)`, base)
+		_, _ = pool.Exec(context.Background(), `DELETE FROM users WHERE id = $1`, userID)
+	})
+
+	expires := time.Now().Add(cacheTTL).Format(time.RFC3339)
+	items := []ScoredItem{{MediaItemID: "item", Score: 1}}
+	for _, row := range []struct {
+		owner   int
+		recType string
+	}{
+		{GlobalCacheUserID, base + "one"},
+		{GlobalCacheUserID, base + "one_more"},
+		{GlobalCacheUserID, base + "g_kept"},
+		{GlobalCacheUserID, base + "g_dropped"},
+		// An account row is not global, even under the same profile ID and type.
+		{userID, base + "g_dropped"},
+	} {
+		if err := repo.UpsertRecommendationCache(ctx, row.owner, GlobalCacheProfileID, row.recType, "", items, expires); err != nil {
+			t.Fatal(err)
+		}
+	}
+	remaining := func() []string {
+		t.Helper()
+		rows, err := pool.Query(ctx, `
+			SELECT COALESCE(user_id::text, 'global') || ':' || rec_type FROM recommendation_cache
+			WHERE  starts_with(rec_type, $1) ORDER BY 1`, base)
+		if err != nil {
+			t.Fatal(err)
+		}
+		got, err := pgx.CollectRows(rows, pgx.RowTo[string])
+		if err != nil {
+			t.Fatal(err)
+		}
+		return got
+	}
+
+	if n, err := repo.DeleteGlobalRecommendationCache(ctx, base+"one", false, nil); err != nil || n != 1 {
+		t.Fatalf("exact delete = %d, %v; want 1 row", n, err)
+	}
+	if n, err := repo.DeleteGlobalRecommendationCache(ctx, base+"g_", true, []string{base + "g_kept"}); err != nil || n != 1 {
+		t.Fatalf("prefix delete = %d, %v; want the 1 row off the kept list", n, err)
+	}
+	want := []string{
+		fmt.Sprintf("%d:%sg_dropped", userID, base),
+		"global:" + base + "g_kept",
+		"global:" + base + "one_more",
+	}
+	if got := remaining(); strings.Join(got, ",") != strings.Join(want, ",") {
+		t.Fatalf("remaining rows = %v, want %v", got, want)
+	}
+}
+
+// advisoryLockHolders returns the backend pid holding each advisory key that
+// is held.
+func advisoryLockHolders(t *testing.T, pool *pgxpool.Pool, keys ...int64) map[int64]int {
+	t.Helper()
+	rows, err := pool.Query(t.Context(), `
+		SELECT ((classid::bigint << 32) | objid::bigint), pid
+		FROM   pg_locks
+		WHERE  locktype = 'advisory' AND granted AND ((classid::bigint << 32) | objid::bigint) = ANY($1)`, keys)
+	if err != nil {
+		t.Fatal(err)
+	}
+	holders := make(map[int64]int)
+	for rows.Next() {
+		var key int64
+		var pid int
+		if err := rows.Scan(&key, &pid); err != nil {
+			t.Fatal(err)
+		}
+		holders[key] = pid
+	}
+	if err := rows.Err(); err != nil {
+		t.Fatal(err)
+	}
+	return holders
+}
+
+// A job's profile locks, and every lock an embeddings reset takes, share the
+// connection of the first lock, so long jobs pin one pooled connection each.
+func TestJobLocksShareOneConnectionPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	w := newJobTestWorker(pgJobLocker{pool: pool}, nil)
+
+	held, release, err := w.claimJobs(JobEmbeddings, JobTasteProfiles, JobRecommendations)
+	if err != nil {
+		t.Fatal(err)
+	}
+	unlockSweep, acquired, err := held.TryAlso(t.Context(), staleSweepLock)
+	if err != nil || !acquired {
+		t.Fatalf("stale sweep lock = (%v, %v)", acquired, err)
+	}
+	profileKey := profileRefreshLock(7, "p")
+	unlockProfile, acquired, err := w.tryProfileLock(t.Context(), held, 7, "p")
+	if err != nil || !acquired {
+		t.Fatalf("profile lock = (%v, %v)", acquired, err)
+	}
+	keys := []int64{embeddingsJobLock, tasteProfilesJobLock, cacheJobLock, staleSweepLock, profileKey}
+	holders := advisoryLockHolders(t, pool, keys...)
+	if len(holders) != len(keys) {
+		t.Fatalf("held keys = %v, want all of %#x", holders, keys)
+	}
+	for _, key := range keys {
+		if holders[key] != holders[embeddingsJobLock] {
+			t.Fatalf("lock %#x is held by backend %d, not the job's %d", key, holders[key], holders[embeddingsJobLock])
+		}
+	}
+
+	// A profile's lock is released alone, so the next profile can be taken
+	// while the job goes on.
+	unlockProfile()
+	if holders := advisoryLockHolders(t, pool, profileKey, cacheJobLock); len(holders) != 1 {
+		t.Fatalf("after the profile unlock, held = %v; want only the job lock", holders)
+	}
+	unlockSweep()
+	release()
+	if holders := advisoryLockHolders(t, pool, keys...); len(holders) != 0 {
+		t.Fatalf("after release, still held = %v", holders)
+	}
+	for _, name := range []JobName{JobEmbeddings, JobTasteProfiles, JobRecommendations} {
+		if w.IsRunning(name) {
+			t.Fatalf("%s still marked running", name)
+		}
+	}
+}
+
+// A completion the profile rated one star gets no Because You Watched row,
+// and the next completion anchors the row the home section shows.
+func TestCacheUserRowsDoNotAnchorOnDislikedTitlesPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	const prefix = "tcache-disliked-"
+	cleanupRecoMediaItems(t, pool, prefix)
+	userID, profile := newTasteTestAccount(t, pool, prefix)
+	repo := NewRepo(pool)
+
+	const axis = 2200
+	disliked, liked := prefix+"disliked", prefix+"liked"
+	neighbors := []string{prefix + "neighbor-1", prefix + "neighbor-2"}
+	for i, id := range append([]string{disliked, liked}, neighbors...) {
+		seedRecoMediaItem(t, pool, id, "movie", "matched")
+		if err := repo.UpsertEmbedding(ctx, id, axisVector(axis, map[int]float32{axis + 1 + i: 0.05}), "test-model", id); err != nil {
+			t.Fatal(err)
+		}
+	}
+	for _, stmt := range []struct {
+		query string
+		args  []any
+	}{
+		{`INSERT INTO user_watch_progress(user_id, profile_id, media_item_id, completed, updated_at) VALUES($1, $2, $3, true, NOW()), ($1, $2, $4, true, NOW() - INTERVAL '1 day')`, []any{userID, profile, disliked, liked}},
+		{`INSERT INTO user_ratings(user_id, profile_id, media_item_id, rating) VALUES($1, $2, $3, 1)`, []any{userID, profile, disliked}},
+	} {
+		if _, err := pool.Exec(ctx, stmt.query, stmt.args...); err != nil {
+			t.Fatalf("seed %q: %v", stmt.query, err)
+		}
+	}
+
+	ratings := catalog.NewRatingsRepo(pool)
+	engine := NewEngine(pool, ratings, catalog.NewItemRepository(pool), nil, pgstore.NewPostgresProvider(pool), config.RecommendationsConfig{DiversityLambda: 0.7})
+	w := newJobTestWorker(&fakeLocker{}, nil)
+	w.engine = engine
+	if built := w.cacheUserRows(ctx, engine.repo, userID, profile, cacheExpiry(time.Now())); built.failed != 0 {
+		t.Fatalf("cache build = %+v, want no failures", built)
+	}
+	if items, err := repo.GetRecommendationCache(ctx, userID, profile, RecTypeBecauseWatched, disliked); err != nil || items != nil {
+		t.Fatalf("disliked anchor row = %v, %v; want none built", items, err)
+	}
+	if items, err := repo.GetRecommendationCache(ctx, userID, profile, RecTypeBecauseWatched, liked); err != nil || len(items) == 0 {
+		t.Fatalf("liked anchor row = %v, %v; want it built", items, err)
+	}
+
+	_, source, err := NewReader(repo, ratings, nil, pgstore.NewPostgresProvider(pool)).SectionBecauseYouWatched(ctx, userID, profile, "", nil, catalog.AccessFilter{})
+	if err != nil || source != liked {
+		t.Fatalf("section anchor = %q, %v; want %q", source, err, liked)
+	}
+}
+
+// A job whose lock session dies stops instead of failing every remaining
+// profile without its cluster lock, which another server may now hold.
+func TestTasteProfileJobStopsWhenItsLockSessionDiesPostgres(t *testing.T) {
+	pool := newEngineTestPool(t)
+	ctx := t.Context()
+	repo := NewRepo(pool)
+	for _, name := range []string{"lock-lost-a-", "lock-lost-b-"} {
+		userID, profile := newTasteTestAccount(t, pool, name)
+		if err := repo.UpsertTasteProfile(ctx, userID, profile, axisVector(1800, nil), map[string]int{}, "", time.Now()); err != nil {
+			t.Fatal(err)
+		}
+	}
+	// A key of its own, so the test never contends with a real job's lock.
+	const lockLostTestKey int64 = 0x53494C4F4C4F5354 // "PRAIRIELOST"
+	held, acquired, err := pgJobLocker{pool: pool}.TryLock(ctx, lockLostTestKey)
+	if err != nil || !acquired {
+		t.Fatalf("TryLock = (%v, %v), want acquired", acquired, err)
+	}
+	defer held.Release()
+	var pid int
+	if err := held.(pgClusterLock).lock.Conn().QueryRow(ctx, `SELECT pg_backend_pid()`).Scan(&pid); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := pool.Exec(ctx, `SELECT pg_terminate_backend($1)`, pid); err != nil {
+		t.Fatal(err)
+	}
+
+	w := newJobTestWorker(&fakeLocker{}, nil)
+	w.engine = NewEngine(pool, catalog.NewRatingsRepo(pool), catalog.NewItemRepository(pool), nil, pgstore.NewPostgresProvider(pool), config.RecommendationsConfig{})
+	res, err := w.doTasteProfiles(ctx, held)
+	if !errors.Is(err, errJobLockLost) {
+		t.Fatalf("taste job error = %v, want errJobLockLost", err)
+	}
+	if res.Profiles < 2 || res.Remaining != res.Profiles || res.Failed != 0 {
+		t.Fatalf("taste job = %+v, want it stopped at the first profile", res)
+	}
+}
diff --git a/internal/recommendations/worker_test.go b/internal/recommendations/worker_test.go
new file mode 100644
index 0000000000..687fb6f8cd
--- /dev/null
+++ b/internal/recommendations/worker_test.go
@@ -0,0 +1,983 @@
+package recommendations
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"slices"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/config"
+	"github.com/prairie-server/prairie-server/internal/recommendations/embeddings"
+	"github.com/prairie-server/prairie-server/internal/taskmanager"
+)
+
+// fakeLocker grants or refuses every lock and records what was asked of it.
+type fakeLocker struct {
+	mu       sync.Mutex
+	held     bool  // another server holds every lock
+	err      error // taking a lock fails
+	keys     []int64
+	released int
+}
+
+func (l *fakeLocker) TryLock(_ context.Context, key int64) (clusterLock, bool, error) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	l.keys = append(l.keys, key)
+	if l.err != nil || l.held {
+		return nil, false, l.err
+	}
+	return fakeClusterLock{take: l.TryLock, release: func() {
+		l.mu.Lock()
+		defer l.mu.Unlock()
+		l.released++
+	}}, true, nil
+}
+
+// fakeClusterLock is a test clusterLock. Its extra keys go through take, as
+// if each were a lock of its own.
+type fakeClusterLock struct {
+	take    func(ctx context.Context, key int64) (clusterLock, bool, error)
+	release func()
+}
+
+func (l fakeClusterLock) TryAlso(ctx context.Context, key int64) (func(), bool, error) {
+	other, acquired, err := l.take(ctx, key)
+	if err != nil || !acquired {
+		return nil, false, err
+	}
+	return other.Release, true, nil
+}
+
+func (l fakeClusterLock) Check(context.Context) error { return nil }
+
+func (l fakeClusterLock) Release() { l.release() }
+
+func (l *fakeLocker) snapshot() (keys []int64, released int) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	return append([]int64(nil), l.keys...), l.released
+}
+
+// fakeHistory stores runs in memory and signals each insert on inserted.
+type fakeHistory struct {
+	mu       sync.Mutex
+	runs     []taskmanager.ExecutionResult
+	inserted chan taskmanager.ExecutionResult
+	err      error
+}
+
+func newFakeHistory() *fakeHistory {
+	return &fakeHistory{inserted: make(chan taskmanager.ExecutionResult, 16)}
+}
+
+func (h *fakeHistory) Insert(_ context.Context, run taskmanager.ExecutionResult) error {
+	h.mu.Lock()
+	h.runs = append(h.runs, run)
+	h.mu.Unlock()
+	h.inserted <- run
+	return nil
+}
+
+func (h *fakeHistory) GetLatest(_ context.Context, key string) (*taskmanager.ExecutionResult, error) {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	if h.err != nil {
+		return nil, h.err
+	}
+	for i := len(h.runs) - 1; i >= 0; i-- {
+		if h.runs[i].TaskKey == key {
+			run := h.runs[i]
+			return &run, nil
+		}
+	}
+	return nil, nil
+}
+
+func (h *fakeHistory) count() int {
+	h.mu.Lock()
+	defer h.mu.Unlock()
+	return len(h.runs)
+}
+
+func newJobTestWorker(locker jobLocker, history JobHistory) *Worker {
+	w := &Worker{
+		locker:                locker,
+		running:               make(map[JobName]bool),
+		profileRefreshCh:      make(chan profileRefreshRequest, 1),
+		profileRefreshPending: make(map[string]struct{}),
+	}
+	if history != nil {
+		w.history = history
+	}
+	return w
+}
+
+type countsResult struct {
+	Done   int `json:"done"`
+	Failed int `json:"failed"`
+}
+
+func (r countsResult) failures() int { return r.Failed }
+
+func waitRun(t *testing.T, h *fakeHistory) taskmanager.ExecutionResult {
+	t.Helper()
+	select {
+	case run := <-h.inserted:
+		return run
+	case <-time.After(10 * time.Second):
+		t.Fatal("job run was not recorded")
+		return taskmanager.ExecutionResult{}
+	}
+}
+
+func TestRunJobRefusesASecondRunInThisProcess(t *testing.T) {
+	locker := &fakeLocker{}
+	history := newFakeHistory()
+	w := newJobTestWorker(locker, history)
+
+	started := make(chan struct{})
+	finish := make(chan struct{})
+	blocking := job{name: JobCowatch, timeout: time.Minute, run: func(context.Context, clusterLock) (jobResult, error) {
+		close(started)
+		<-finish
+		return countsResult{Done: 1}, nil
+	}}
+	// A synchronous run returns only after releasing its claim, so the test
+	// can tell when the job is free again.
+	firstDone := make(chan error, 1)
+	go func() { firstDone <- w.runJob(blocking, false) }()
+	select {
+	case <-started:
+	case err := <-firstDone:
+		t.Fatalf("first run did not start: %v", err)
+	}
+	if !w.IsRunning(JobCowatch) {
+		t.Fatal("running job not reported as running")
+	}
+
+	ran := false
+	second := job{name: JobCowatch, timeout: time.Minute, run: func(context.Context, clusterLock) (jobResult, error) {
+		ran = true
+		return countsResult{}, nil
+	}}
+	err := w.runJob(second, true)
+	if !errors.Is(err, ErrJobRunning) || errors.Is(err, ErrJobRunningElsewhere) {
+		t.Fatalf("second run error = %v, want ErrJobRunning", err)
+	}
+	if err.Error() != "cowatch job is already running" {
+		t.Fatalf("second run message = %q", err.Error())
+	}
+	if keys, _ := locker.snapshot(); len(keys) != 1 || keys[0] != cowatchJobLock {
+		t.Fatalf("lock requests = %#x, want one for the co-watch lock", keys)
+	}
+
+	close(finish)
+	if err := <-firstDone; err != nil {
+		t.Fatalf("first run: %v", err)
+	}
+	if err := w.runJob(second, false); err != nil {
+		t.Fatalf("run after the first finished: %v", err)
+	}
+	if !ran {
+		t.Fatal("second job did not run after the first finished")
+	}
+	if _, released := locker.snapshot(); released != 2 {
+		t.Fatalf("locks released = %d, want 2", released)
+	}
+}
+
+func TestRunJobSkipsWhenAnotherServerHoldsTheLock(t *testing.T) {
+	locker := &fakeLocker{held: true}
+	history := newFakeHistory()
+	w := newJobTestWorker(locker, history)
+
+	ran := false
+	err := w.runJob(job{name: JobRecommendations, timeout: time.Minute, run: func(context.Context, clusterLock) (jobResult, error) {
+		ran = true
+		return cacheResult{}, nil
+	}}, true)
+	if !errors.Is(err, ErrJobRunningElsewhere) {
+		t.Fatalf("error = %v, want ErrJobRunningElsewhere", err)
+	}
+	if err.Error() != "recommendations job is already running on another server" {
+		t.Fatalf("message = %q", err.Error())
+	}
+	if ran || w.IsRunning(JobRecommendations) || history.count() != 0 {
+		t.Fatalf("skipped job ran=%v running=%v recorded=%d", ran, w.IsRunning(JobRecommendations), history.count())
+	}
+	if keys, _ := locker.snapshot(); len(keys) != 1 || keys[0] != cacheJobLock {
+		t.Fatalf("lock requests = %#x, want one for the cache lock", keys)
+	}
+}
+
+func TestRunJobLockFailureIsNotABusyJob(t *testing.T) {
+	w := newJobTestWorker(&fakeLocker{err: errors.New("connection refused")}, newFakeHistory())
+	err := w.runJob(w.jobFor(JobTasteProfiles), true)
+	if err == nil || errors.Is(err, ErrJobRunning) || errors.Is(err, ErrJobRunningElsewhere) {
+		t.Fatalf("error = %v, want a lock failure", err)
+	}
+	if w.IsRunning(JobTasteProfiles) {
+		t.Fatal("a job that never started is still marked running")
+	}
+}
+
+func TestRunJobRecordsOutcome(t *testing.T) {
+	history := newFakeHistory()
+	w := newJobTestWorker(&fakeLocker{}, history)
+
+	if err := w.runJob(job{name: JobRecommendations, timeout: time.Minute, run: func(context.Context, clusterLock) (jobResult, error) {
+		return countsResult{Done: 3, Failed: 1}, nil
+	}}, false); err != nil {
+		t.Fatal(err)
+	}
+	run := waitRun(t, history)
+	if run.TaskKey != cacheTaskKey || run.Status != runStatusCompleted || run.ErrorMessage != "" {
+		t.Fatalf("completed run = %+v", run)
+	}
+	if string(run.ResultData) != `{"done":3,"failed":1}` || run.CompletedAt.Before(run.StartedAt) || run.DurationMs < 0 {
+		t.Fatalf("completed run data = %s %+v", run.ResultData, run)
+	}
+
+	if err := w.runJob(job{name: JobEmbeddings, timeout: time.Minute, run: func(context.Context, clusterLock) (jobResult, error) {
+		return countsResult{Done: 2}, errors.New("provider unavailable")
+	}}, false); err != nil {
+		t.Fatal(err)
+	}
+	run = waitRun(t, history)
+	if run.TaskKey != embeddingsTaskKey || run.Status != runStatusFailed || run.ErrorMessage != "provider unavailable" || string(run.ResultData) != `{"done":2,"failed":0}` {
+		t.Fatalf("failed run = %+v %s", run, run.ResultData)
+	}
+
+	// A background run (a manual trigger) is recorded the same way.
+	if err := w.runJob(job{name: JobTasteProfiles, timeout: time.Minute, run: func(context.Context, clusterLock) (jobResult, error) {
+		return countsResult{Done: 5}, nil
+	}}, true); err != nil {
+		t.Fatal(err)
+	}
+	run = waitRun(t, history)
+	if run.TaskKey != tasteProfilesTaskKey || run.Status != runStatusCompleted || string(run.ResultData) != `{"done":5,"failed":0}` {
+		t.Fatalf("background run = %+v %s", run, run.ResultData)
+	}
+
+	// Without history a run still completes.
+	bare := newJobTestWorker(&fakeLocker{}, nil)
+	ran := false
+	if err := bare.runJob(job{name: JobCowatch, timeout: time.Minute, run: func(context.Context, clusterLock) (jobResult, error) {
+		ran = true
+		return countsResult{}, nil
+	}}, false); err != nil || !ran {
+		t.Fatalf("run without history: ran=%v err=%v", ran, err)
+	}
+}
+
+func TestRunJobAppliesTheJobTimeout(t *testing.T) {
+	history := newFakeHistory()
+	w := newJobTestWorker(&fakeLocker{}, history)
+	if err := w.runJob(job{name: JobCowatch, timeout: time.Millisecond, run: func(ctx context.Context, _ clusterLock) (jobResult, error) {
+		<-ctx.Done()
+		return countsResult{}, ctx.Err()
+	}}, false); err != nil {
+		t.Fatal(err)
+	}
+	if run := waitRun(t, history); run.Status != runStatusFailed || !strings.Contains(run.ErrorMessage, "deadline") {
+		t.Fatalf("timed-out run = %+v", run)
+	}
+}
+
+func TestLastRunsReadsEachJob(t *testing.T) {
+	history := newFakeHistory()
+	w := newJobTestWorker(&fakeLocker{}, history)
+	for _, name := range []JobName{JobCowatch, JobRecommendations, JobRecommendations} {
+		if err := w.runJob(job{name: name, timeout: time.Minute, run: func(context.Context, clusterLock) (jobResult, error) {
+			return countsResult{Done: history.count()}, nil
+		}}, false); err != nil {
+			t.Fatal(err)
+		}
+		waitRun(t, history)
+	}
+
+	runs, err := w.LastRuns(t.Context())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(runs) != 2 || runs[JobCowatch].Full.TaskKey != cowatchTaskKey || string(runs[JobRecommendations].Full.ResultData) != `{"done":2,"failed":0}` {
+		t.Fatalf("last runs = %+v", runs)
+	}
+
+	history.err = errors.New("db down")
+	if _, err := w.LastRuns(t.Context()); err == nil {
+		t.Fatal("history error was dropped")
+	}
+	var nilWorker *Worker
+	if runs, err := nilWorker.LastRuns(t.Context()); err != nil || len(runs) != 0 {
+		t.Fatalf("nil worker last runs = %v, %v", runs, err)
+	}
+	if runs, err := newJobTestWorker(&fakeLocker{}, nil).LastRuns(t.Context()); err != nil || len(runs) != 0 {
+		t.Fatalf("no-history last runs = %v, %v", runs, err)
+	}
+}
+
+// Partial runs (the embedding catch-up, the startup global-row build) are
+// recorded under keys of their own, so a later partial run does not hide a
+// failed full run.
+func TestPartialRunsDoNotHideTheLastFullRun(t *testing.T) {
+	history := newFakeHistory()
+	w := newJobTestWorker(&fakeLocker{}, history)
+	for _, j := range []job{
+		{name: JobEmbeddings, timeout: time.Minute, run: func(context.Context, clusterLock) (jobResult, error) {
+			return embeddingsResult{}, errors.New("provider down")
+		}},
+		{name: JobEmbeddings, timeout: time.Minute, partial: true, run: func(context.Context, clusterLock) (jobResult, error) {
+			return embeddingsResult{MissingOnly: true, EmbedCounts: EmbedCounts{Embedded: 1}}, nil
+		}},
+		{name: JobRecommendations, timeout: time.Minute, partial: true, run: func(context.Context, clusterLock) (jobResult, error) {
+			return cacheResult{GlobalOnly: true}, nil
+		}},
+	} {
+		if err := w.runJob(j, false); err != nil {
+			t.Fatal(err)
+		}
+		waitRun(t, history)
+	}
+
+	runs, err := w.LastRuns(t.Context())
+	if err != nil {
+		t.Fatal(err)
+	}
+	embed := runs[JobEmbeddings]
+	if embed.Full == nil || embed.Full.Status != runStatusFailed || embed.Full.TaskKey != embeddingsTaskKey {
+		t.Fatalf("last full embeddings run = %+v, want the failed one", embed.Full)
+	}
+	if embed.Partial == nil || embed.Partial.Status != runStatusCompleted || embed.Partial.TaskKey != embeddingsCatchUpTaskKey {
+		t.Fatalf("last embeddings catch-up = %+v", embed.Partial)
+	}
+	cache := runs[JobRecommendations]
+	if cache.Full != nil || cache.Partial == nil || cache.Partial.TaskKey != globalRowsTaskKey {
+		t.Fatalf("cache runs = %+v, want only the startup build, as a partial run", cache)
+	}
+}
+
+// A startup build skipped because the cache job is busy is routine (Info);
+// one that could not take the job's lock is a fault (Warn).
+func TestEnsureGlobalRowsWarnsWhenItCannotClaimTheJob(t *testing.T) {
+	var logs bytes.Buffer
+	previous := slog.Default()
+	slog.SetDefault(slog.New(slog.NewTextHandler(&logs, &slog.HandlerOptions{Level: slog.LevelInfo})))
+	t.Cleanup(func() { slog.SetDefault(previous) })
+
+	newJobTestWorker(&fakeLocker{held: true}, nil).ensureGlobalRows(t.Context(), &fakeGlobalRows{})
+	if out := logs.String(); !strings.Contains(out, "level=INFO") || strings.Contains(out, "level=WARN") {
+		t.Fatalf("busy job logged %q; want Info", out)
+	}
+	logs.Reset()
+	newJobTestWorker(&fakeLocker{err: errors.New("db down")}, nil).ensureGlobalRows(t.Context(), &fakeGlobalRows{})
+	if out := logs.String(); !strings.Contains(out, "level=WARN") || !strings.Contains(out, "db down") {
+		t.Fatalf("lock failure logged %q; want Warn with the error", out)
+	}
+}
+
+func TestCacheExpiryOutlivesTheDailyJob(t *testing.T) {
+	start := time.Date(2026, 10, 3, 5, 0, 0, 0, time.UTC)
+	got, err := time.Parse(time.RFC3339, cacheExpiry(start))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if want := start.Add(26 * time.Hour); !got.Equal(want) {
+		t.Fatalf("expiry = %v, want %v", got, want)
+	}
+	if !got.After(start.Add(24 * time.Hour)) {
+		t.Fatal("rows expire before the next daily run")
+	}
+}
+
+// fakeGlobalRows serves the global row queries, failing the ones named in
+// fail, and records what it cached and which cached rows it extended.
+type fakeGlobalRows struct {
+	cached    bool
+	cacheErr  error
+	fail      map[string]bool
+	written   map[string][]ScoredItem
+	expires   string
+	extended  []string // "type" or "type*" for a prefix, with its expiry
+	extendErr error
+	deleted   []string // "type" or "type*" for a prefix, with the kept types
+	// popularArgs, recentArgs and genreLimit record what the build asked
+	// for.
+	popularArgs [3]int // days, minAccounts, limit
+	recentArgs  [2]int // days, limit
+	genreLimit  int
+	deleteErr   error
+}
+
+func (f *fakeGlobalRows) result(name string, items []ScoredItem) ([]ScoredItem, error) {
+	if f.fail[name] {
+		return nil, errors.New(name + " query failed")
+	}
+	return items, nil
+}
+
+func (f *fakeGlobalRows) GetPopularItems(_ context.Context, days, minAccounts, limit int) ([]ScoredItem, error) {
+	f.popularArgs = [3]int{days, minAccounts, limit}
+	return f.result("popular", []ScoredItem{{MediaItemID: "p"}})
+}
+
+func (f *fakeGlobalRows) GetRecentlyAddedItems(_ context.Context, days, limit int) ([]ScoredItem, error) {
+	f.recentArgs = [2]int{days, limit}
+	return f.result("recent", []ScoredItem{{MediaItemID: "r"}})
+}
+
+func (f *fakeGlobalRows) GetTopGenres(_ context.Context, limit int) ([]string, error) {
+	f.genreLimit = limit
+	if f.fail["genres"] {
+		return nil, errors.New("genres query failed")
+	}
+	return []string{"Drama", "Comedy"}, nil
+}
+
+func (f *fakeGlobalRows) GetGenreSamplerItems(_ context.Context, genre string, _ int) ([]ScoredItem, error) {
+	return f.result(genre, []ScoredItem{{MediaItemID: genre}})
+}
+
+func (f *fakeGlobalRows) UpsertRecommendationCache(_ context.Context, userID int, profileID, recType, _ string, items []ScoredItem, expires string) error {
+	if userID != GlobalCacheUserID || profileID != GlobalCacheProfileID {
+		return errors.New("global row written to a profile")
+	}
+	if f.fail["write:"+recType] {
+		return errors.New("write failed")
+	}
+	if f.written == nil {
+		f.written = map[string][]ScoredItem{}
+	}
+	f.written[recType] = items
+	f.expires = expires
+	return nil
+}
+
+func (f *fakeGlobalRows) ExtendGlobalRecommendationCache(_ context.Context, recType string, prefix bool, expires string) (int64, error) {
+	if prefix {
+		recType += "*"
+	}
+	f.extended = append(f.extended, recType+"@"+expires)
+	return 1, f.extendErr
+}
+
+func (f *fakeGlobalRows) DeleteGlobalRecommendationCache(_ context.Context, recType string, prefix bool, keep []string) (int64, error) {
+	if prefix {
+		recType += "*"
+	}
+	f.deleted = append(f.deleted, recType+"-"+strings.Join(keep, "+"))
+	return 1, f.deleteErr
+}
+
+func (f *fakeGlobalRows) HasGlobalRecommendationCache(context.Context) (bool, error) {
+	return f.cached, f.cacheErr
+}
+
+func writtenTypes(f *fakeGlobalRows) string {
+	var types []string
+	for _, recType := range []string{RecTypePopular, RecTypeRecentlyAdded, RecTypeTopRated, RecTypeGenreSamplerPrefix + "Drama", RecTypeGenreSamplerPrefix + "Comedy"} {
+		if _, ok := f.written[recType]; ok {
+			types = append(types, recType)
+		}
+	}
+	return strings.Join(types, ",")
+}
+
+func TestCacheGlobalRowsCountsFailuresAndKeepsFailedRows(t *testing.T) {
+	w := newJobTestWorker(&fakeLocker{}, nil)
+
+	store := &fakeGlobalRows{fail: map[string]bool{"popular": true, "Comedy": true, "write:" + RecTypeGenreSamplerPrefix + "Drama": true}}
+	written, failed := w.cacheGlobalRows(t.Context(), store, "expiry")
+	// Popular's query, Comedy's query, and Drama's write fail, so their cached
+	// rows are kept until the new expiry. Top rated is served live, so it is
+	// neither written nor kept; every genre row off the menu is deleted.
+	if written != 1 || failed != 3 || writtenTypes(store) != RecTypeRecentlyAdded {
+		t.Fatalf("written=%d failed=%d rows=%s", written, failed, writtenTypes(store))
+	}
+	wantKept := []string{RecTypePopular + "@expiry", RecTypeGenreSamplerPrefix + "Drama@expiry", RecTypeGenreSamplerPrefix + "Comedy@expiry"}
+	if strings.Join(store.extended, ",") != strings.Join(wantKept, ",") {
+		t.Fatalf("kept rows = %v, want %v", store.extended, wantKept)
+	}
+	wantDeleted := []string{RecTypeGenreSamplerPrefix + "*-" + RecTypeGenreSamplerPrefix + "Drama+" + RecTypeGenreSamplerPrefix + "Comedy"}
+	if strings.Join(store.deleted, ",") != strings.Join(wantDeleted, ",") {
+		t.Fatalf("deleted rows = %v, want %v", store.deleted, wantDeleted)
+	}
+
+	// Without the top genres, every cached genre sampler is kept.
+	store = &fakeGlobalRows{fail: map[string]bool{"genres": true}}
+	written, failed = w.cacheGlobalRows(t.Context(), store, "expiry")
+	if written != 2 || failed != 1 || writtenTypes(store) != RecTypePopular+","+RecTypeRecentlyAdded {
+		t.Fatalf("genre failure: written=%d failed=%d rows=%s", written, failed, writtenTypes(store))
+	}
+	if strings.Join(store.extended, ",") != RecTypeGenreSamplerPrefix+"*@expiry" {
+		t.Fatalf("genre failure kept %v, want every genre sampler", store.extended)
+	}
+	if len(store.deleted) != 0 {
+		t.Fatalf("genre failure deleted %v, want nothing", store.deleted)
+	}
+
+	// A failed extend is only logged; the run goes on.
+	store = &fakeGlobalRows{fail: map[string]bool{"popular": true, "recent": true}, extendErr: errors.New("db down")}
+	written, failed = w.cacheGlobalRows(t.Context(), store, "expiry")
+	if written != 2 || failed != 2 || len(store.extended) != 2 {
+		t.Fatalf("failed extend: written=%d failed=%d extended=%v", written, failed, store.extended)
+	}
+}
+
+// The cached Popular row needs a crowd of accounts over 90 days and keeps a
+// 200-title pool for reads to filter; Recently Added has no window; the genre
+// menu holds 16 genres; and the global build no longer writes a top_rated
+// row.
+func TestCacheGlobalRowsAsksForACrowdAndAWideGenreMenu(t *testing.T) {
+	w := newJobTestWorker(&fakeLocker{}, nil)
+	store := &fakeGlobalRows{}
+	w.cacheGlobalRows(t.Context(), store, "expiry")
+	if store.popularArgs != [3]int{90, 2, 200} {
+		t.Fatalf("popular asked for days, accounts, limit = %v, want [90 2 200]", store.popularArgs)
+	}
+	if store.recentArgs != [2]int{0, CacheCandidateLimit} {
+		t.Fatalf("recently added asked for days, limit = %v, want no window and a full row", store.recentArgs)
+	}
+	if store.genreLimit != 16 {
+		t.Fatalf("genre menu = %d genres, want 16", store.genreLimit)
+	}
+	if _, ok := store.written[RecTypeTopRated]; ok {
+		t.Fatal("the global build wrote a top_rated row")
+	}
+}
+
+func TestEnsureGlobalRowsBuildsOnlyWhenNoneIsCached(t *testing.T) {
+	locker := &fakeLocker{}
+	history := newFakeHistory()
+	w := newJobTestWorker(locker, history)
+
+	store := &fakeGlobalRows{}
+	before := time.Now()
+	w.ensureGlobalRows(t.Context(), store)
+	if writtenTypes(store) != strings.Join([]string{RecTypePopular, RecTypeRecentlyAdded, RecTypeGenreSamplerPrefix + "Drama", RecTypeGenreSamplerPrefix + "Comedy"}, ",") {
+		t.Fatalf("startup build wrote %s", writtenTypes(store))
+	}
+	if expires, err := time.Parse(time.RFC3339, store.expires); err != nil || expires.Before(before.Add(cacheTTL).Truncate(time.Second)) {
+		t.Fatalf("startup rows expire at %q (%v)", store.expires, err)
+	}
+	if keys, released := locker.snapshot(); len(keys) != 1 || keys[0] != cacheJobLock || released != 1 {
+		t.Fatalf("startup build locks = %#x released %d, want the cache job's lock", keys, released)
+	}
+	run := waitRun(t, history)
+	var result cacheResult
+	if err := json.Unmarshal(run.ResultData, &result); err != nil {
+		t.Fatal(err)
+	}
+	if run.TaskKey != globalRowsTaskKey || run.Status != runStatusCompleted || !result.GlobalOnly || result.GlobalRows != 4 {
+		t.Fatalf("startup build recorded %+v %s", run, run.ResultData)
+	}
+
+	for name, skip := range map[string]*fakeGlobalRows{
+		"rows cached":  {cached: true},
+		"check failed": {cacheErr: errors.New("db down")},
+	} {
+		w.ensureGlobalRows(t.Context(), skip)
+		if len(skip.written) != 0 {
+			t.Fatalf("%s: startup build wrote %s", name, writtenTypes(skip))
+		}
+	}
+
+	// Another server already holds the cache job: it builds the rows, not us.
+	busy := newJobTestWorker(&fakeLocker{held: true}, history)
+	elsewhere := &fakeGlobalRows{}
+	busy.ensureGlobalRows(t.Context(), elsewhere)
+	if len(elsewhere.written) != 0 || history.count() != 1 {
+		t.Fatalf("startup build ran beside another server: wrote %s, runs %d", writtenTypes(elsewhere), history.count())
+	}
+}
+
+// closedPoolEngine returns an engine whose every database call fails.
+func closedPoolEngine(t *testing.T) *Engine {
+	t.Helper()
+	pool, err := pgxpool.New(t.Context(), "postgres://prairie@127.0.0.1:1/prairie")
+	if err != nil {
+		t.Fatal(err)
+	}
+	pool.Close()
+	return NewEngine(pool, nil, nil, nil, nil, config.RecommendationsConfig{})
+}
+
+func TestCacheUserRowsCountsFailedSteps(t *testing.T) {
+	engine := closedPoolEngine(t)
+	w := newJobTestWorker(&fakeLocker{}, nil)
+	w.engine = engine
+
+	built := w.cacheUserRows(t.Context(), engine.repo, 7, "profile", cacheExpiry(time.Now()))
+	if built.cached != 0 || built.failed == 0 {
+		t.Fatalf("build against a failing database = %+v, want failures and nothing cached", built)
+	}
+}
+
+func TestTasteProfileJobFailsWhenSubjectsCannotBeListed(t *testing.T) {
+	w := newJobTestWorker(&fakeLocker{}, nil)
+	w.engine = closedPoolEngine(t)
+	res, err := w.doTasteProfiles(t.Context(), nil)
+	if err == nil || res.Profiles != 0 {
+		t.Fatalf("taste job = %+v, %v; want a failure", res, err)
+	}
+}
+
+func TestCacheJobFailsWhenProfilesCannotBeListed(t *testing.T) {
+	w := newJobTestWorker(&fakeLocker{}, nil)
+	w.engine = closedPoolEngine(t)
+	res, err := w.doRecommendations(t.Context(), nil)
+	if err == nil || !res.CleanFailed || res.GlobalFailures == 0 {
+		t.Fatalf("cache job = %+v, %v; want failures", res, err)
+	}
+	if res.failures() == 0 {
+		t.Fatal("cache job failures not counted")
+	}
+}
+
+func TestStaleSweepSkipsWhileAnotherServerSweeps(t *testing.T) {
+	locker := &fakeLocker{held: true}
+	// No engine: a sweep that went ahead would dereference it.
+	w := newJobTestWorker(locker, nil)
+	w.refreshStaleProfiles(t.Context())
+	if keys, _ := locker.snapshot(); len(keys) != 1 || keys[0] != staleSweepLock {
+		t.Fatalf("sweep lock requests = %#x", keys)
+	}
+}
+
+func TestClaimProfileRefreshDedupesUntilCleared(t *testing.T) {
+	w := newJobTestWorker(&fakeLocker{}, nil)
+	key := profileRefreshKey(1, "p")
+	if !w.claimProfileRefresh(key) || w.claimProfileRefresh(key) {
+		t.Fatal("a pending profile refresh was claimed twice")
+	}
+	w.clearProfileRefreshPending(key)
+	if !w.claimProfileRefresh(key) {
+		t.Fatal("a cleared profile refresh could not be claimed")
+	}
+}
+
+// recordingStaleMarker records stale marks and how many refreshes were
+// already queued when each one happened.
+type recordingStaleMarker struct {
+	w            *Worker
+	calls        int
+	queuedBefore []int
+	ctxErrs      []error
+	err          error
+}
+
+func (m *recordingStaleMarker) MarkProfileStale(ctx context.Context, _ int, _ string) error {
+	m.calls++
+	m.ctxErrs = append(m.ctxErrs, ctx.Err())
+	if m.w != nil {
+		m.queuedBefore = append(m.queuedBefore, len(m.w.profileRefreshCh))
+	}
+	return m.err
+}
+
+func newRefreshTestWorker() (*Worker, *recordingStaleMarker) {
+	w := newJobTestWorker(&fakeLocker{}, nil)
+	w.engine = &Engine{}
+	marker := &recordingStaleMarker{w: w}
+	w.staleMarker = marker
+	return w, marker
+}
+
+// takeQueued drains one queued refresh, failing when none is queued, and
+// releases its pending key as the refresh loop would.
+func takeQueued(t *testing.T, w *Worker) profileRefreshRequest {
+	t.Helper()
+	select {
+	case req := <-w.profileRefreshCh:
+		w.clearProfileRefreshPending(profileRefreshKey(req.userID, req.profileID))
+		return req
+	default:
+		t.Fatal("no profile refresh was queued")
+		return profileRefreshRequest{}
+	}
+}
+
+func assertNothingQueued(t *testing.T, w *Worker, stage string) {
+	t.Helper()
+	select {
+	case req := <-w.profileRefreshCh:
+		t.Fatalf("%s: queued %+v, want nothing", stage, req)
+	default:
+	}
+}
+
+// NotifySignalsChanged writes the durable stale mark before it queues the
+// in-memory refresh, so a server that dies with the request queued still
+// leaves the mark for another server's sweep. A failed mark still queues.
+func TestNotifySignalsChangedMarksStaleThenQueues(t *testing.T) {
+	w, marker := newRefreshTestWorker()
+	w.NotifySignalsChanged(t.Context(), 7, "p")
+	if marker.calls != 1 || marker.queuedBefore[0] != 0 {
+		t.Fatalf("marks = %d, refreshes queued before the mark = %v; want one mark before any refresh", marker.calls, marker.queuedBefore)
+	}
+	if req := takeQueued(t, w); req.userID != 7 || req.profileID != "p" {
+		t.Fatalf("queued %+v", req)
+	}
+
+	marker.err = errors.New("database down")
+	w.NotifySignalsChanged(t.Context(), 7, "p")
+	if marker.calls != 2 {
+		t.Fatalf("marks = %d, want 2", marker.calls)
+	}
+	takeQueued(t, w)
+
+	for _, bad := range []struct {
+		userID    int
+		profileID string
+	}{{0, "p"}, {7, ""}} {
+		w.NotifySignalsChanged(t.Context(), bad.userID, bad.profileID)
+	}
+	if marker.calls != 2 {
+		t.Fatalf("marks for invalid profiles = %d, want none", marker.calls-2)
+	}
+	assertNothingQueued(t, w, "invalid profiles")
+
+	// Callers hold a nil *Worker when recommendations are disabled.
+	var disabled *Worker
+	disabled.NotifySignalsChanged(t.Context(), 7, "p")
+	disabled.RequestReadRefresh(t.Context(), 7, "p")
+}
+
+// A read refresh the full queue dropped does not count against the
+// profile's allowance: it left no stale mark, so the next read asks again.
+func TestDroppedReadRefreshCanBeAskedAgain(t *testing.T) {
+	w, _ := newRefreshTestWorker()
+	ctx := t.Context()
+	w.RequestProfileRefresh(ctx, 7, "other") // fills the one-slot queue
+	w.RequestReadRefresh(ctx, 7, "p")
+	if !w.ReadRefreshDue(7, "p") {
+		t.Fatal("a dropped read refresh still counts against the profile")
+	}
+	takeQueued(t, w)
+	w.RequestReadRefresh(ctx, 7, "p")
+	if req := takeQueued(t, w); req.profileID != "p" {
+		t.Fatalf("queued %+v, want profile p", req)
+	}
+}
+
+// Reads that find a profile's rows missing queue at most one refresh per
+// profile per interval on a server; signal changes are not throttled.
+func TestRequestReadRefreshThrottlesEachProfile(t *testing.T) {
+	w, _ := newRefreshTestWorker()
+	now := time.Date(2026, 10, 3, 12, 0, 0, 0, time.UTC)
+	w.readRefreshes.now = func() time.Time { return now }
+	ctx := t.Context()
+
+	if !w.ReadRefreshDue(7, "p") {
+		t.Fatal("a first read refresh is not due")
+	}
+	w.RequestReadRefresh(ctx, 7, "p")
+	takeQueued(t, w)
+	now = now.Add(time.Minute)
+	if w.ReadRefreshDue(7, "p") {
+		t.Fatal("a read refresh is due again within the interval")
+	}
+	w.RequestReadRefresh(ctx, 7, "p")
+	assertNothingQueued(t, w, "second read within the interval")
+
+	// Another profile has its own allowance.
+	w.RequestReadRefresh(ctx, 7, "q")
+	if req := takeQueued(t, w); req.profileID != "q" {
+		t.Fatalf("queued %+v, want profile q", req)
+	}
+	// A signal change goes straight through.
+	w.NotifySignalsChanged(ctx, 7, "p")
+	takeQueued(t, w)
+
+	now = now.Add(readRefreshInterval)
+	w.RequestReadRefresh(ctx, 7, "p")
+	takeQueued(t, w)
+	// The expired entry for q was pruned; p was just let through again.
+	w.readRefreshes.mu.Lock()
+	remembered := len(w.readRefreshes.last)
+	w.readRefreshes.mu.Unlock()
+	if remembered != 1 {
+		t.Fatalf("throttle remembers %d profiles, want only the one let through this interval", remembered)
+	}
+}
+
+// A refresh that fails marks the profile stale again, with a live context
+// even when the refresh's own context ended, so the stale sweep retries it.
+func TestRefreshProfileMarksStaleAgainWhenItFails(t *testing.T) {
+	w, marker := newRefreshTestWorker()
+	marker.w = nil
+	w.engine = closedPoolEngine(t)
+	if err := w.refreshProfile(t.Context(), nil, 7, "p"); err == nil {
+		t.Fatal("refresh against a closed database succeeded")
+	}
+	ctx, cancel := context.WithCancel(t.Context())
+	cancel()
+	if err := w.refreshProfile(ctx, nil, 7, "p"); err == nil {
+		t.Fatal("refresh with an ended context succeeded")
+	}
+	if marker.calls != 2 || marker.ctxErrs[0] != nil || marker.ctxErrs[1] != nil {
+		t.Fatalf("marks = %d with context errors %v; want two marks with live contexts", marker.calls, marker.ctxErrs)
+	}
+}
+
+// A profile another server is refreshing is not rebuilt here: the refresh
+// reads nothing, marks the profile stale for the sweep, and releases its
+// pending key. Concurrent refreshes could otherwise finish out of order and
+// leave the older one's rows.
+func TestRefreshProfileDefersToAnotherServersRefresh(t *testing.T) {
+	w, marker := newRefreshTestWorker()
+	marker.w = nil
+	locker := &fakeLocker{held: true}
+	w.locker = locker
+	// The engine has no repo, so a refresh that went ahead would panic.
+
+	if err := w.refreshProfile(t.Context(), nil, 7, "p"); !errors.Is(err, errProfileRefreshElsewhere) {
+		t.Fatalf("refresh while another server holds the lock = %v, want errProfileRefreshElsewhere", err)
+	}
+	if marker.calls != 1 {
+		t.Fatalf("stale marks = %d, want 1 so the sweep runs the profile again", marker.calls)
+	}
+	if !slices.Equal(locker.keys, []int64{profileRefreshLock(7, "p")}) {
+		t.Fatalf("locks tried %#x, want only the profile's refresh lock", locker.keys)
+	}
+
+	key := profileRefreshKey(7, "p")
+	if !w.claimProfileRefresh(key) {
+		t.Fatal("claim failed")
+	}
+	_ = w.runProfileRefresh(t.Context(), nil, 7, "p", w.refreshProfile)
+	if !w.claimProfileRefresh(key) {
+		t.Fatal("a deferred refresh kept its pending key")
+	}
+	if profileRefreshLock(7, "p") == profileRefreshLock(7, "q") || profileRefreshLock(7, "p") == profileRefreshLock(8, "p") {
+		t.Fatal("different profiles share a refresh lock")
+	}
+}
+
+// The catch-up pass runs under the embeddings job's claim: it skips while an
+// embedding run holds the job on this server or another.
+func TestEmbedMissingSkipsWhileTheEmbeddingsJobIsClaimed(t *testing.T) {
+	// The worker has no engine, so a pass that ran would panic.
+	history := newFakeHistory()
+	here := newJobTestWorker(&fakeLocker{}, history)
+	if !here.tryStart(JobEmbeddings) {
+		t.Fatal("could not claim the embeddings job")
+	}
+	here.runEmbedMissing()
+	if !here.IsRunning(JobEmbeddings) {
+		t.Fatal("the skipped pass released the running job's claim")
+	}
+
+	locker := &fakeLocker{held: true}
+	elsewhere := newJobTestWorker(locker, history)
+	elsewhere.runEmbedMissing()
+	if keys, _ := locker.snapshot(); len(keys) != 1 || keys[0] != embeddingsJobLock {
+		t.Fatalf("catch-up locks = %#x, want the embeddings job's lock", keys)
+	}
+	if elsewhere.IsRunning(JobEmbeddings) || history.count() != 0 {
+		t.Fatalf("skipped pass: running=%v recorded=%d", elsewhere.IsRunning(JobEmbeddings), history.count())
+	}
+}
+
+func TestQuietJobRecordsOnlyRunsThatDidSomething(t *testing.T) {
+	history := newFakeHistory()
+	w := newJobTestWorker(&fakeLocker{}, history)
+	quiet := func(res embeddingsResult, err error) job {
+		return job{name: JobEmbeddings, timeout: time.Minute, quietWhenIdle: true, run: func(context.Context, clusterLock) (jobResult, error) {
+			return res, err
+		}}
+	}
+
+	if err := w.runJob(quiet(embeddingsResult{MissingOnly: true}, nil), false); err != nil {
+		t.Fatal(err)
+	}
+	if history.count() != 0 {
+		t.Fatal("an idle catch-up pass was recorded")
+	}
+
+	for _, tc := range []struct {
+		name   string
+		res    embeddingsResult
+		err    error
+		status string
+	}{
+		{"embedded", embeddingsResult{MissingOnly: true, EmbedCounts: EmbedCounts{Embedded: 2}}, nil, runStatusCompleted},
+		{"item failures", embeddingsResult{MissingOnly: true, EmbedCounts: EmbedCounts{Failed: 1}}, nil, runStatusCompleted},
+		{"failed run", embeddingsResult{MissingOnly: true}, errors.New("embedding provider unavailable: refused"), runStatusFailed},
+	} {
+		if err := w.runJob(quiet(tc.res, tc.err), false); err != nil {
+			t.Fatal(err)
+		}
+		run := waitRun(t, history)
+		if run.TaskKey != embeddingsTaskKey || run.Status != tc.status || !strings.Contains(string(run.ResultData), `"missing_only":true`) {
+			t.Fatalf("%s: recorded %+v %s", tc.name, run, run.ResultData)
+		}
+	}
+}
+
+func TestEmbeddingsResultReportsOutcome(t *testing.T) {
+	counts := EmbedCounts{Embedded: 4, Truncated: 1, Failed: 2, Skipped: 1}
+	res := newEmbeddingsResult(counts, nil, false)
+	if res.failures() != 3 || res.idle() || res.QuotaLimited {
+		t.Fatalf("result = %+v failures %d", res, res.failures())
+	}
+	data, err := json.Marshal(res)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if want := `{"embedded":4,"truncated":1,"failed":2,"skipped":1,"quota_limited":false,"retry_deferred":false}`; string(data) != want {
+		t.Fatalf("result data = %s, want %s", data, want)
+	}
+
+	for name, tc := range map[string]struct {
+		err             error
+		quota, deferred bool
+	}{
+		"deferred":        {fmt.Errorf("embedding batch stopped: %w", &embeddings.RateLimitError{RetryDeferred: true}), true, true},
+		"daily quota":     {fmt.Errorf("embedding batch stopped: %w", &embeddings.RateLimitError{DailyQuota: true}), true, false},
+		"provider down":   {errors.New("embedding provider unavailable: connection refused"), false, false},
+		"deadline passed": {context.DeadlineExceeded, false, false},
+	} {
+		res := newEmbeddingsResult(EmbedCounts{}, tc.err, true)
+		if res.QuotaLimited != tc.quota || res.RetryDeferred != tc.deferred || !res.MissingOnly {
+			t.Fatalf("%s: result = %+v", name, res)
+		}
+	}
+}
+
+// A delete that fails leaves an empty global row serving its old titles, so
+// it counts as a failure and the run is not recorded as clean.
+func TestCacheGlobalRowsCountsFailedDeletes(t *testing.T) {
+	w := newJobTestWorker(&fakeLocker{}, nil)
+	store := &fakeGlobalRows{deleteErr: errors.New("db down")}
+	// Every build succeeds; the delete of the genres that left the menu
+	// fails.
+	if written, failed := w.cacheGlobalRows(t.Context(), store, cacheExpiry(time.Now())); written != 4 || failed != 1 {
+		t.Fatalf("written = %d, failed = %d; want 4 and the failed delete", written, failed)
+	}
+}
+
+// A signal change already committed is recorded even when the request that
+// made it has ended: the stale mark and the refresh do not use its context.
+func TestNotifySignalsChangedOutlivesTheRequest(t *testing.T) {
+	w, marker := newRefreshTestWorker()
+	ctx, cancel := context.WithCancel(t.Context())
+	cancel()
+	w.NotifySignalsChanged(ctx, 7, "p")
+	if marker.calls != 1 || marker.ctxErrs[0] != nil {
+		t.Fatalf("marks = %d, context errors = %v; want one mark with a live context", marker.calls, marker.ctxErrs)
+	}
+	if req := takeQueued(t, w); req.profileID != "p" {
+		t.Fatalf("queued %+v", req)
+	}
+}
diff --git a/internal/requests/api_key_optional_test.go b/internal/requests/api_key_optional_test.go
new file mode 100644
index 0000000000..38d09f250c
--- /dev/null
+++ b/internal/requests/api_key_optional_test.go
@@ -0,0 +1,395 @@
+package requests
+
+import (
+	"context"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/prairie-server/prairie-server/internal/metadata/tmdb"
+)
+
+// keylessRouterInst is a connection on installation 1 saved without an API
+// key, the way an admin sets up a server for a router that needs none.
+func keylessRouterInst(id string) Integration {
+	in := routerInst(id)
+	in.APIKeyRef = ""
+	return in
+}
+
+// A router that declares api_key_optional gets requests for a server saved
+// without a key, with an empty key, instead of the request waiting for one.
+// TestCreateRequestAutoApprovalDefersOnKeylessConnection covers a router
+// without the declaration.
+func TestCreateRequestAutoApprovalSendsToKeyOptionalRouter(t *testing.T) {
+	store := newFakeStore()
+	store.settings.RequestsEnabled = true
+	store.settings.GlobalAutoApprovalEnabled = true
+	store.integrations = []Integration{keylessRouterInst("router-1")}
+	service := newTestService(store)
+	router := &fakeRouterProvider{keyOptional: map[int]bool{1: true}}
+	service.SetRouterProvider(router)
+
+	req, err := service.CreateRequest(context.Background(), testViewer(1), CreateRequestInput{
+		MediaType: MediaTypeMovie,
+		TMDBID:    550,
+		Title:     "Fight Club",
+	})
+	if err != nil {
+		t.Fatalf("CreateRequest returned error: %v", err)
+	}
+	if router.fulfillCalls != 1 || len(router.gotConns) != 1 || router.gotConns[0].ID != "router-1" || router.gotConns[0].APIKey != "" {
+		t.Fatalf("fulfill calls = %d, connections = %+v; want one call to router-1 without a key", router.fulfillCalls, router.gotConns)
+	}
+	if req.Status == StatusApproved || req.LastError != "" {
+		t.Fatalf("request = %+v, want it sent to the router", req)
+	}
+}
+
+// When the router's declaration cannot be read and no other connection can
+// take the request, the submission retries with the read error.
+func TestSubmitDefersWhenKeyOptionalDeclarationCannotBeRead(t *testing.T) {
+	store := newFakeStore()
+	store.integrations = []Integration{keylessRouterInst("router-1")}
+	router := &fakeRouterProvider{keyOptional: map[int]bool{1: true}, featuresErr: errors.New("capabilities unavailable")}
+	svc := newTestService(store)
+	svc.SetRouterProvider(router)
+
+	req := Request{ID: "r1", MediaType: MediaTypeMovie, Status: StatusApproved, Outcome: OutcomeActive, RequestedByUserID: 7}
+	store.requests["r1"] = &req
+	got, err := svc.submitApprovedRequest(context.Background(), req, Viewer{UserID: 7, IsAdmin: true}, nil)
+	if err != nil {
+		t.Fatalf("submit: %v", err)
+	}
+	if router.fulfillCalls != 0 {
+		t.Fatalf("fulfill calls = %d, want none", router.fulfillCalls)
+	}
+	if got.Status != StatusApproved || got.Outcome != OutcomeActive || !strings.Contains(got.LastError, "capabilities unavailable") {
+		t.Fatalf("request = %+v, want it approved and waiting to retry", got)
+	}
+}
+
+// A connection whose plugin's declaration cannot be read is skipped like one
+// without a key, so a sibling with a key still takes the request.
+func TestSubmitUsesKeyedSiblingWhenKeyOptionalDeclarationCannotBeRead(t *testing.T) {
+	store := newFakeStore()
+	store.integrations = []Integration{keylessRouterInst("router-keyless"), routerInst("router-keyed")}
+	router := &fakeRouterProvider{featuresErr: errors.New("capabilities unavailable")}
+	svc := newTestService(store)
+	svc.SetRouterProvider(router)
+
+	req := Request{ID: "r1", MediaType: MediaTypeMovie, Status: StatusApproved, Outcome: OutcomeActive, RequestedByUserID: 7}
+	store.requests["r1"] = &req
+	if _, err := svc.submitApprovedRequest(context.Background(), req, Viewer{UserID: 7, IsAdmin: true}, nil); err != nil {
+		t.Fatalf("submit: %v", err)
+	}
+	if router.fulfillCalls != 1 || len(router.gotConns) != 1 || router.gotConns[0].ID != "router-keyed" {
+		t.Fatalf("fulfill calls = %d, connections = %+v; want one call to router-keyed", router.fulfillCalls, router.gotConns)
+	}
+}
+
+// A route sends to a server without a key when its router needs none, and
+// still refuses one whose router needs a key.
+func TestSubmitRoutedHonoursKeyOptionalRouter(t *testing.T) {
+	for _, tc := range []struct {
+		name        string
+		keyOptional bool
+	}{
+		{"router needs no key", true},
+		{"router needs a key", false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			store := routingStore(capturedFacts(RoutingFacts{}))
+			for i := range store.integrations {
+				store.integrations[i].APIKeyRef = ""
+			}
+			router := &fakeRouterProvider{keyOptional: map[int]bool{1: tc.keyOptional}}
+			svc := newTestService(store)
+			svc.SetRouterProvider(router)
+			svc.SetEntitlementResolver(fixedCeiling{q: "1080p"})
+
+			got, err := svc.submitApprovedRequest(context.Background(), *store.requests["r1"], Viewer{}, nil)
+			if err != nil {
+				t.Fatalf("submit: %v", err)
+			}
+			if !tc.keyOptional {
+				if len(router.fulfillLog) != 0 || !strings.Contains(got.LastError, msgRouterNoKey) {
+					t.Fatalf("fulfill calls = %+v, last error = %q; want none and the missing-key reason", router.fulfillLog, got.LastError)
+				}
+				return
+			}
+			if len(router.fulfillLog) != 1 || len(router.fulfillLog[0].conns) != 1 || router.fulfillLog[0].conns[0].APIKey != "" {
+				t.Fatalf("fulfill calls = %+v, want one call to the routed server without a key", router.fulfillLog)
+			}
+		})
+	}
+}
+
+// The route preview does not flag a server without a key when its router
+// needs none.
+func TestPreviewRouteAcceptsKeyOptionalServer(t *testing.T) {
+	store := routingStore(RoutingFacts{})
+	store.integrations[0].APIKeyRef = "" // radarr-hd, the fallback's HD server
+	svc := newTestServiceWithTMDB(store, &fakeTMDBClient{detail: &tmdb.MediaDetail{ID: 129}})
+	svc.SetRouterProvider(&fakeRouterProvider{keyOptional: map[int]bool{1: true}})
+
+	preview, err := svc.PreviewRoute(context.Background(), routeAdmin, MediaTypeMovie, 129, 7)
+	if err != nil {
+		t.Fatalf("preview: %v", err)
+	}
+	for _, tier := range preview.Tiers {
+		if tier.Reason != "" {
+			t.Fatalf("%s tier = %+v, want no failure note", tier.Quality, tier)
+		}
+	}
+}
+
+// The reconcile pass asks a key-optional router about a target on a server
+// without a key.
+func TestReconcileRequestsChecksTargetOnKeyOptionalServer(t *testing.T) {
+	store := newFakeStore()
+	store.integrations = []Integration{keylessRouterInst("router-1")}
+	store.candidates = []*Request{{ID: "req-1", MediaType: MediaTypeMovie, TMDBID: 550, Status: StatusQueued, Outcome: OutcomeActive}}
+	store.requests["req-1"] = &Request{ID: "req-1", MediaType: MediaTypeMovie, TMDBID: 550, Status: StatusQueued, Outcome: OutcomeActive}
+	if _, err := store.CreateTarget(context.Background(), Target{
+		RequestID: "req-1", IntegrationID: "router-1",
+		Quality: Quality1080p, Status: StatusQueued, ExternalID: "123",
+	}); err != nil {
+		t.Fatalf("seed target: %v", err)
+	}
+	router := &fakeRouterProvider{
+		keyOptional: map[int]bool{1: true},
+		statuses:    []RouterTargetStatus{{Quality: Quality1080p, ConnectionID: "router-1", Status: StatusDownloading, ExternalStatus: "downloading"}},
+	}
+	service := newTestService(store)
+	service.SetRouterProvider(router)
+
+	result, err := service.ReconcileRequests(context.Background(), 100)
+	if err != nil {
+		t.Fatalf("ReconcileRequests returned error: %v", err)
+	}
+	if router.statusCalls != 1 || len(router.statusLog) != 1 || router.statusLog[0].conns[0].APIKey != "" {
+		t.Fatalf("status calls = %+v, want one call without a key", router.statusLog)
+	}
+	if result.Downloading != 1 {
+		t.Fatalf("result = %+v, want the target marked downloading", result)
+	}
+}
+
+// The download refresh pass polls a key-optional router that reports
+// progress for a target on a server without a key, and keeps the progress.
+func TestRefreshDownloadsPollsKeyOptionalServer(t *testing.T) {
+	store := newFakeStore()
+	service, router := downloadRefreshService(store)
+	store.integrations = []Integration{keylessRouterInst("router-1")}
+	router.keyOptional = map[int]bool{1: true}
+	earlier := &DownloadProgress{Phase: DownloadPhaseDownloading, BytesTotal: 1000, BytesLeft: 900, Downloads: 1}
+	seedDownloadTarget(t, store, "req-keyless", "router-1", Quality1080p, StatusDownloading, earlier)
+	progress := &DownloadProgress{Phase: DownloadPhaseDownloading, BytesTotal: 1000, BytesLeft: 400, Downloads: 1}
+	router.statuses = []RouterTargetStatus{{Quality: Quality1080p, ConnectionID: "router-1", Status: StatusDownloading, Progress: progress}}
+
+	result, err := service.RefreshDownloads(context.Background(), 200, 0)
+	if err != nil {
+		t.Fatalf("RefreshDownloads: %v", err)
+	}
+	if result != (DownloadRefreshResult{Checked: 1}) || router.statusCalls != 1 {
+		t.Fatalf("result = %+v, status calls = %d; want one request checked", result, router.statusCalls)
+	}
+	if got := onlyTarget(t, store, "req-keyless"); !sameProgress(got.Download, progress) {
+		t.Fatalf("progress = %+v, want %+v", got.Download, progress)
+	}
+}
+
+// When a key-optional router's declaration cannot be read, the download
+// refresh pass settles the target as unanswered: fresh progress is kept and
+// the server is not asked, rather than the progress being cleared as if the
+// server could no longer be asked.
+func TestRefreshDownloadsKeepsProgressWhenKeyOptionalDeclarationCannotBeRead(t *testing.T) {
+	store := newFakeStore()
+	service, router := downloadRefreshService(store)
+	store.integrations = []Integration{keylessRouterInst("router-1")}
+	router.keyOptional = map[int]bool{1: true}
+	router.featuresErr = errors.New("capabilities unavailable")
+	reported := service.now().Add(-2 * time.Minute)
+	progress := &DownloadProgress{Phase: DownloadPhaseDownloading, BytesTotal: 1000, BytesLeft: 400, Downloads: 1, UpdatedAt: reported}
+	seedDownloadTarget(t, store, "req-keyless", "router-1", Quality1080p, StatusDownloading, progress)
+
+	_, _ = service.RefreshDownloads(context.Background(), 200, 0)
+	if router.statusCalls != 0 {
+		t.Fatalf("status calls = %d, want none", router.statusCalls)
+	}
+	if got := onlyTarget(t, store, "req-keyless"); !sameProgress(got.Download, progress) || !got.Download.UpdatedAt.Equal(reported) {
+		t.Fatalf("progress = %+v, want the reported progress kept", got.Download)
+	}
+}
+
+// Testing a new server for a key-optional router reaches the plugin without
+// a key or an address.
+func TestLoadIntegrationOptionsProbesKeyOptionalRouterWithoutKey(t *testing.T) {
+	store := newFakeStore()
+	router := &fakeRouterProvider{keyOptional: map[int]bool{1: true}}
+	service := newTestService(store)
+	service.SetRouterProvider(router)
+	install := 1
+
+	if _, err := service.LoadIntegrationOptions(context.Background(), Viewer{UserID: 1, IsAdmin: true}, Integration{
+		ID:             "new",
+		CapabilityID:   "arr",
+		InstallationID: &install,
+	}); err != nil {
+		t.Fatalf("LoadIntegrationOptions: %v", err)
+	}
+	if router.gotOptionsConn.ID != "new" || router.gotOptionsConn.APIKey != "" || router.gotOptionsConn.BaseURL != "" {
+		t.Fatalf("probe conn = %+v, want the new server without a key or address", router.gotOptionsConn)
+	}
+}
+
+// A key-optional router is probed at a changed address without the saved
+// key: the key stays with the address it was saved for.
+func TestLoadIntegrationOptionsKeepsSavedKeyFromChangedAddressOfKeyOptionalRouter(t *testing.T) {
+	store := newFakeStore()
+	store.integrations = []Integration{routerInst("router-1")}
+	router := &fakeRouterProvider{keyOptional: map[int]bool{1: true}}
+	service := newTestService(store)
+	service.SetRouterProvider(router)
+
+	if _, err := service.LoadIntegrationOptions(context.Background(), Viewer{UserID: 1, IsAdmin: true}, Integration{
+		ID:      "router-1",
+		BaseURL: "http://elsewhere.example",
+	}); err != nil {
+		t.Fatalf("LoadIntegrationOptions: %v", err)
+	}
+	if router.gotOptionsConn.BaseURL != "http://elsewhere.example" || router.gotOptionsConn.APIKey != "" {
+		t.Fatalf("probe conn = %+v, want the changed address without the saved key", router.gotOptionsConn)
+	}
+}
+
+// A server saved without a key has no key to protect, so its address can
+// change without one; a saved key must still be typed again for a new
+// address, whatever the router declares.
+func TestUpdateIntegrationAddressChangeNeedsKeyOnlyWhenOneIsSaved(t *testing.T) {
+	for _, tc := range []struct {
+		name      string
+		saved     Integration
+		wantError bool
+	}{
+		{"saved without a key", keylessRouterInst("router-1"), false},
+		{"saved with a key", routerInst("router-1"), true},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			store := newFakeStore()
+			store.integrations = []Integration{tc.saved}
+			router := &fakeRouterProvider{keyOptional: map[int]bool{1: true}}
+			service := newTestService(store)
+			service.SetRouterProvider(router)
+			install := 1
+
+			_, err := service.UpdateIntegration(context.Background(), Viewer{UserID: 1, IsAdmin: true}, Integration{
+				ID:             "router-1",
+				Name:           "router-1",
+				Enabled:        true,
+				CapabilityID:   "arr",
+				BaseURL:        "http://moved.local",
+				InstallationID: &install,
+			})
+			var ve *ValidationError
+			if tc.wantError {
+				if !errors.As(err, &ve) || ve.FieldErrors["api_key_ref"] == "" || router.validateCalls != 0 {
+					t.Fatalf("err = %v, validate calls = %d; want the api_key_ref field error and no validation", err, router.validateCalls)
+				}
+				return
+			}
+			if err != nil || router.validateCalls != 1 {
+				t.Fatalf("err = %v, validate calls = %d; want the change validated by the plugin", err, router.validateCalls)
+			}
+		})
+	}
+}
+
+// A blank URL in a connection test of a saved server is tested as blank when
+// its router declares base_url_optional. For any other router it still stands
+// for the saved address, and so does a URL a connection test leaves out. A
+// save validates the blank URL it stores, whatever the router declares, so the
+// plugin can refuse an address it can't use.
+func TestClearedURLIsTestedAndValidatedAsBlankForURLOptionalRouter(t *testing.T) {
+	for _, tc := range []struct {
+		name        string
+		urlOptional bool
+		want        string
+	}{
+		{"router needs no URL", true, ""},
+		{"router needs a URL", false, "http://router-1.local"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			store := newFakeStore()
+			store.integrations = []Integration{keylessRouterInst("router-1")}
+			router := &fakeRouterProvider{keyOptional: map[int]bool{1: true}, urlOptional: map[int]bool{1: tc.urlOptional}}
+			service := newTestService(store)
+			service.SetRouterProvider(router)
+			admin := Viewer{UserID: 1, IsAdmin: true}
+
+			if _, err := service.LoadIntegrationOptions(context.Background(), admin, Integration{ID: "router-1"}); err != nil {
+				t.Fatalf("LoadIntegrationOptions without a URL: %v", err)
+			}
+			if router.gotOptionsConn.BaseURL != "http://router-1.local" {
+				t.Fatalf("probed address without a URL = %q, want the saved one", router.gotOptionsConn.BaseURL)
+			}
+			if _, err := service.LoadIntegrationOptions(context.Background(), admin, Integration{ID: "router-1", BaseURLCleared: true}); err != nil {
+				t.Fatalf("LoadIntegrationOptions with a cleared URL: %v", err)
+			}
+			if router.gotOptionsConn.BaseURL != tc.want {
+				t.Fatalf("probed address with a cleared URL = %q, want %q", router.gotOptionsConn.BaseURL, tc.want)
+			}
+			install := 1
+			if _, err := service.UpdateIntegration(context.Background(), admin, Integration{
+				ID: "router-1", Name: "router-1", Enabled: true, CapabilityID: "arr", InstallationID: &install,
+			}); err != nil {
+				t.Fatalf("UpdateIntegration: %v", err)
+			}
+			stored, err := store.GetIntegration(context.Background(), "router-1")
+			if err != nil {
+				t.Fatalf("GetIntegration: %v", err)
+			}
+			if router.gotValidateConn.BaseURL != "" || stored.BaseURL != "" {
+				t.Fatalf("validated address = %q, stored address = %q; want the blank address validated and stored", router.gotValidateConn.BaseURL, stored.BaseURL)
+			}
+		})
+	}
+}
+
+// A cleared URL is a different address, so a saved key stays behind: the
+// connection test goes without it, and the save needs it typed again.
+func TestClearingURLOfServerWithSavedKeyNeedsTheKeyAgain(t *testing.T) {
+	store := newFakeStore()
+	store.integrations = []Integration{routerInst("router-1")}
+	router := &fakeRouterProvider{keyOptional: map[int]bool{1: true}, urlOptional: map[int]bool{1: true}}
+	service := newTestService(store)
+	service.SetRouterProvider(router)
+	admin := Viewer{UserID: 1, IsAdmin: true}
+
+	if _, err := service.LoadIntegrationOptions(context.Background(), admin, Integration{ID: "router-1", BaseURLCleared: true}); err != nil {
+		t.Fatalf("LoadIntegrationOptions: %v", err)
+	}
+	if router.gotOptionsConn.BaseURL != "" || router.gotOptionsConn.APIKey != "" {
+		t.Fatalf("probe conn = %+v, want no address and no saved key", router.gotOptionsConn)
+	}
+	// Leaving the URL out tests the saved connection, key and all.
+	if _, err := service.LoadIntegrationOptions(context.Background(), admin, Integration{ID: "router-1"}); err != nil {
+		t.Fatalf("LoadIntegrationOptions: %v", err)
+	}
+	if router.gotOptionsConn.BaseURL != "http://router-1.local" || router.gotOptionsConn.APIKey != "key-router-1" {
+		t.Fatalf("probe conn = %+v, want the saved address and key", router.gotOptionsConn)
+	}
+	install := 1
+	cleared := Integration{ID: "router-1", Name: "router-1", Enabled: true, CapabilityID: "arr", InstallationID: &install}
+	_, err := service.UpdateIntegration(context.Background(), admin, cleared)
+	var ve *ValidationError
+	if !errors.As(err, &ve) || ve.FieldErrors[fieldAPIKey] != integrationKeyReentry || router.validateCalls != 0 {
+		t.Fatalf("err = %v, validate calls = %d; want the re-enter error and no validation", err, router.validateCalls)
+	}
+	cleared.APIKeyRef = "key-router-1"
+	if _, err := service.UpdateIntegration(context.Background(), admin, cleared); err != nil || router.gotValidateConn.BaseURL != "" {
+		t.Fatalf("err = %v, validated address = %q; want the cleared address saved with the key typed again", err, router.gotValidateConn.BaseURL)
+	}
+}
diff --git a/internal/requests/downloads.go b/internal/requests/downloads.go
index e685b9aba3..1c8570624d 100644
--- a/internal/requests/downloads.go
+++ b/internal/requests/downloads.go
@@ -172,7 +172,9 @@ func (s *Service) settleUnansweredDownload(ctx context.Context, t Target) error
 
 // targetReportsProgress reports whether the router capability that
 // checkTargetStatuses would ask about a target declares
-// reports_download_progress. A target it would skip reports none.
+// reports_download_progress. A target it would skip reports none. An error
+// reading a declaration is returned, so the refresh pass keeps the target's
+// progress until it goes stale.
 func (s *Service) targetReportsProgress(ctx context.Context, fc *fulfillContext, mediaType MediaType, t Target) (bool, error) {
 	var installationID int
 	var capabilityID string
@@ -184,8 +186,9 @@ func (s *Service) targetReportsProgress(ctx context.Context, fc *fulfillContext,
 		installationID, capabilityID = id, capability
 	} else {
 		in := integrationByID(fc, t.IntegrationID)
-		if !statusCheckable(in) {
-			return false, nil
+		checkable, err := s.statusCheckable(ctx, fc, in)
+		if err != nil || !checkable {
+			return false, err
 		}
 		installationID, capabilityID = *in.InstallationID, in.CapabilityID
 	}
diff --git a/internal/requests/editor_concurrency_test.go b/internal/requests/editor_concurrency_test.go
index 2dd016a21a..ba11ceab3a 100644
--- a/internal/requests/editor_concurrency_test.go
+++ b/internal/requests/editor_concurrency_test.go
@@ -269,3 +269,62 @@ func TestEditorValidationRaceDatabase(t *testing.T) {
 		t.Fatalf("concurrent edit lost: %+v %v", current, err)
 	}
 }
+
+// A blank key keeps the saved key only for the address it was saved for. The
+// write checks this under the row lock, on both save paths, so a key saved
+// after validation, or an address changed since, never ends up paired with
+// another address.
+func TestIntegrationKeyStaysWithItsAddressDatabase(t *testing.T) {
+	repo := editorTestRepository(t)
+	ctx := t.Context()
+	keyed := Integration{ID: "keyed", Name: "Keyed", Enabled: true, BaseURL: "http://radarr.invalid:7878/", APIKeyRef: "secret-key", CapabilityID: "arr", InstallationID: new(1)}
+	if _, err := repo.SaveIntegrationWithDefaults(ctx, keyed, true); err != nil {
+		t.Fatal(err)
+	}
+	keyless := Integration{ID: "keyless", Name: "Keyless", Enabled: true, CapabilityID: "local", InstallationID: new(2)}
+	if _, err := repo.SaveIntegrationWithDefaults(ctx, keyless, true); err != nil {
+		t.Fatal(err)
+	}
+	refused := func(err error) bool {
+		var ve *ValidationError
+		return errors.As(err, &ve) && ve.FieldErrors[fieldAPIKey] == integrationKeyReentry
+	}
+
+	// The same address, written another way, keeps the key.
+	same := keyed
+	same.APIKeyRef, same.BaseURL = "", "radarr.invalid:7878"
+	if _, err := repo.SaveIntegrationWithDefaults(ctx, same, false); err != nil {
+		t.Fatalf("same address: %v", err)
+	}
+	// Another address without the key is refused, and the row is unchanged.
+	moved := keyed
+	moved.APIKeyRef, moved.BaseURL = "", "http://elsewhere.invalid"
+	if _, err := repo.SaveIntegrationWithDefaults(ctx, moved, false); !refused(err) {
+		t.Fatalf("new address without the key: %v, want the re-enter error", err)
+	}
+	current, err := repo.GetIntegration(ctx, keyed.ID)
+	if err != nil || current.BaseURL != same.BaseURL || current.APIKeyRef != keyed.APIKeyRef {
+		t.Fatalf("after the refused save: %+v %v", current, err)
+	}
+	edit := *current
+	edit.APIKeyRef, edit.BaseURL = "", "http://elsewhere.invalid"
+	if _, err = repo.UpdateIntegrationConditional(ctx, edit, current.Revision); !refused(err) {
+		t.Fatalf("conditional save of a new address without the key: %v, want the re-enter error", err)
+	}
+	// Clearing the address is a change of address too.
+	cleared := *current
+	cleared.APIKeyRef, cleared.BaseURL = "", ""
+	if _, err = repo.SaveIntegrationWithDefaults(ctx, cleared, false); !refused(err) {
+		t.Fatalf("cleared address without the key: %v, want the re-enter error", err)
+	}
+	// With the key typed again, the address can change.
+	moved.APIKeyRef = keyed.APIKeyRef
+	if _, err = repo.SaveIntegrationWithDefaults(ctx, moved, false); err != nil {
+		t.Fatalf("new address with the key: %v", err)
+	}
+	// A server saved without a key has none to keep, so its address can change.
+	keyless.BaseURL = "http://local.invalid"
+	if _, err = repo.SaveIntegrationWithDefaults(ctx, keyless, false); err != nil {
+		t.Fatalf("keyless server's new address: %v", err)
+	}
+}
diff --git a/internal/requests/group_limits_test.go b/internal/requests/group_limits_test.go
index f59e0f5ff1..476d4fe986 100644
--- a/internal/requests/group_limits_test.go
+++ b/internal/requests/group_limits_test.go
@@ -172,6 +172,9 @@ func TestRequestAccessMigrationDatabase(t *testing.T) {
 		got = append(got, strings.Join([]string{limitMode, approvalMode, map[bool]string{true: "allowed", false: "blocked"}[allowed]}, "/"))
 	}
 	rows.Close()
+	if err := rows.Err(); err != nil {
+		t.Fatal(err)
+	}
 	want := []string{"inherit/auto/blocked", "custom/inherit/blocked", "unlimited/manual/allowed"}
 	if strings.Join(got, " ") != strings.Join(want, " ") {
 		t.Fatalf("after migration: %v, want %v", got, want)
diff --git a/internal/requests/integration_probe.go b/internal/requests/integration_probe.go
index c3855f9818..731f17d2df 100644
--- a/internal/requests/integration_probe.go
+++ b/internal/requests/integration_probe.go
@@ -34,6 +34,9 @@ const (
 	integrationNoSuchHost     = "That host name couldn't be found."
 	integrationTimedOut       = "The server didn't answer in time."
 	integrationBadCertificate = "The server's HTTPS certificate wasn't accepted."
+	// integrationKeyReentry refuses a save that would keep a saved key for a
+	// different address.
+	integrationKeyReentry = "re-enter the API key when changing the base URL"
 )
 
 // IntegrationUnreachableError is a request server the host could not reach,
diff --git a/internal/requests/repository.go b/internal/requests/repository.go
index 17c960f511..cc9b35f6ed 100644
--- a/internal/requests/repository.go
+++ b/internal/requests/repository.go
@@ -1066,6 +1066,24 @@ func (r *Repository) updateIntegration(ctx context.Context, exec requestExecutor
 	if err != nil {
 		return nil, fmt.Errorf("encrypt api key: %w", err)
 	}
+	if apiKeyRef == "" {
+		// A blank key keeps the saved one only for the address it was saved
+		// for; a blank address is a different one. validateViaPlugin checks
+		// this too, but before the write: under the row lock, a key saved
+		// since then, or an address changed since then, is caught here.
+		var storedBaseURL string
+		var hasKey bool
+		err := exec.QueryRow(ctx, `SELECT base_url, api_key_ref <> '' FROM request_integrations WHERE id=$1 FOR UPDATE`, i.ID).Scan(&storedBaseURL, &hasKey)
+		if errors.Is(err, pgx.ErrNoRows) {
+			return nil, ErrNotFound
+		}
+		if err != nil {
+			return nil, fmt.Errorf("lock request integration: %w", err)
+		}
+		if hasKey && !sameIntegrationBaseURL(i.BaseURL, storedBaseURL) {
+			return nil, &ValidationError{FieldErrors: map[string]string{fieldAPIKey: integrationKeyReentry}}
+		}
+	}
 	row := exec.QueryRow(ctx, `
 		UPDATE request_integrations SET
 			name=$2, enabled=$3, base_url=$4,
diff --git a/internal/requests/router_seasons.go b/internal/requests/router_seasons.go
index 6b8d208f04..2864f5cf64 100644
--- a/internal/requests/router_seasons.go
+++ b/internal/requests/router_seasons.go
@@ -16,6 +16,14 @@ type RouterFeatures struct {
 	// ReportsDownloadProgress: CheckStatus fills each live target's download
 	// progress. The download refresh pass polls only such plugins.
 	ReportsDownloadProgress bool
+	// APIKeyOptional: the plugin works without an API key, so a connection
+	// with none is used like any other. Any other plugin's connection needs
+	// a key (see missingAPIKey).
+	APIKeyOptional bool
+	// BaseURLOptional: the plugin works without a base URL, so a blank one
+	// in a connection test of a saved server is tested as blank rather than
+	// as the saved address (see blankURLMeansSaved).
+	BaseURLOptional bool
 }
 
 // RouterFeatureReader reads a router capability's declared features from the
@@ -59,6 +67,19 @@ func (s *Service) routerFeatures(ctx context.Context, fc *fulfillContext, instal
 	return features, nil
 }
 
+// blankURLMeansSaved reports whether a blank base URL in a connection test
+// of a saved server stands for its saved address, as it does for a plugin that needs
+// one. A plugin that declares base_url_optional takes a blank address as it
+// is, so an admin can clear it. When the declaration cannot be read, a blank
+// address stands for the saved one, as before.
+func (s *Service) blankURLMeansSaved(ctx context.Context, in Integration) bool {
+	if in.InstallationID == nil || in.CapabilityID == "" {
+		return true
+	}
+	features, err := s.routerFeatures(ctx, &fulfillContext{}, *in.InstallationID, in.CapabilityID)
+	return err != nil || !features.BaseURLOptional
+}
+
 // routerSupportsSeasons reports whether the router capability takes a request
 // for particular seasons.
 func (s *Service) routerSupportsSeasons(ctx context.Context, fc *fulfillContext, installationID int, capabilityID string) (bool, error) {
diff --git a/internal/requests/routes_admin.go b/internal/requests/routes_admin.go
index 0138830106..06a60a22db 100644
--- a/internal/requests/routes_admin.go
+++ b/internal/requests/routes_admin.go
@@ -349,7 +349,7 @@ func (s *Service) PreviewRoute(ctx context.Context, viewer Viewer, mediaType Med
 			if in != nil {
 				tier.IntegrationName = in.Name
 			}
-			tier.Reason = routedServerProblem(in, mediaType)
+			tier.Reason = s.routedServerProblem(ctx, fc, in, mediaType)
 		}
 		preview.Tiers = append(preview.Tiers, tier)
 	}
@@ -359,7 +359,7 @@ func (s *Service) PreviewRoute(ctx context.Context, viewer Viewer, mediaType Med
 // routedServerProblem explains why a tier routed to the server would fail
 // when sent, in the cases routedConnection refuses it, and is "" when the
 // server can take it.
-func routedServerProblem(in *Integration, mediaType MediaType) string {
+func (s *Service) routedServerProblem(ctx context.Context, fc *fulfillContext, in *Integration, mediaType MediaType) string {
 	const fails = ", so this tier would fail."
 	switch {
 	case in == nil:
@@ -368,7 +368,10 @@ func routedServerProblem(in *Integration, mediaType MediaType) string {
 		return in.Name + " is disabled" + fails
 	case in.InstallationID == nil || in.CapabilityID == "":
 		return in.Name + " is not bound to a plugin installation (re-save it)" + fails
-	case strings.TrimSpace(in.APIKeyRef) == "":
+	}
+	missing, _ := s.missingAPIKey(ctx, fc, *in)
+	switch {
+	case missing:
 		return in.Name + " has no API key" + fails
 	case !integrationSupportsMediaType(*in, mediaType):
 		return in.Name + " does not take " + mediaTypePlural(mediaType) + fails
diff --git a/internal/requests/routes_admin_test.go b/internal/requests/routes_admin_test.go
index 7015702514..6525646820 100644
--- a/internal/requests/routes_admin_test.go
+++ b/internal/requests/routes_admin_test.go
@@ -346,6 +346,9 @@ func TestFirstServerBecomesEverythingElseDatabase(t *testing.T) {
 			}
 			out[mediaType] = id
 		}
+		if err := rows.Err(); err != nil {
+			t.Fatal(err)
+		}
 		return out
 	}
 
diff --git a/internal/requests/routing.go b/internal/requests/routing.go
index 9eb3ed3544..0427d9a2a6 100644
--- a/internal/requests/routing.go
+++ b/internal/requests/routing.go
@@ -2,6 +2,7 @@ package requests
 
 import (
 	"cmp"
+	"context"
 	"fmt"
 	"maps"
 	"slices"
@@ -353,7 +354,7 @@ func traceRoutes(routes []Route, req Request, qualities []Quality) (map[Quality]
 // Radarr plugin's own terms: it is the tier's default, and the plugin's anime
 // overlay is off because the route's overrides replace it. A plugin without
 // those keys ignores them.
-func routedConnection(fc *fulfillContext, d RouteDecision, mediaType MediaType, q Quality) (ResolvedRouterConnection, int, string, error) {
+func (s *Service) routedConnection(ctx context.Context, fc *fulfillContext, d RouteDecision, mediaType MediaType, q Quality) (ResolvedRouterConnection, int, string, error) {
 	var in *Integration
 	for i := range fc.integrations {
 		if fc.integrations[i].ID == d.IntegrationID {
@@ -368,7 +369,12 @@ func routedConnection(fc *fulfillContext, d RouteDecision, mediaType MediaType,
 		return ResolvedRouterConnection{}, 0, "", fmt.Errorf("route %q sends to %q, which is disabled", d.RouteName, in.Name)
 	case in.InstallationID == nil || in.CapabilityID == "":
 		return ResolvedRouterConnection{}, 0, "", fmt.Errorf("%s (route %q)", msgRouterUnbound, d.RouteName)
-	case strings.TrimSpace(in.APIKeyRef) == "":
+	}
+	missing, err := s.missingAPIKey(ctx, fc, *in)
+	switch {
+	case err != nil:
+		return ResolvedRouterConnection{}, 0, "", err
+	case missing:
 		return ResolvedRouterConnection{}, 0, "", fmt.Errorf("%s (route %q)", msgRouterNoKey, d.RouteName)
 	case !integrationSupportsMediaType(*in, mediaType):
 		// The server's media types can change after a route points at it.
diff --git a/internal/requests/routing_mode_test.go b/internal/requests/routing_mode_test.go
index 6e7584039a..403978342d 100644
--- a/internal/requests/routing_mode_test.go
+++ b/internal/requests/routing_mode_test.go
@@ -441,6 +441,9 @@ func TestAdvancedSeedUsesOnlyServersThatStillFitDatabase(t *testing.T) {
 			}
 			out[mediaType] = [2]string{hd, uhd}
 		}
+		if err := rows.Err(); err != nil {
+			t.Fatal(err)
+		}
 		return out
 	}
 	save := func(t *testing.T, repo *Repository, in Integration, create bool) {
diff --git a/internal/requests/routing_trace_test.go b/internal/requests/routing_trace_test.go
index 748c12d13f..4ad354dee8 100644
--- a/internal/requests/routing_trace_test.go
+++ b/internal/requests/routing_trace_test.go
@@ -189,7 +189,7 @@ func TestHDCopyDropsTheServers4KFlag(t *testing.T) {
 	fc := &fulfillContext{integrations: []Integration{{ID: "radarr-4k", Name: "Radarr 4K", Enabled: true, CapabilityID: "arr",
 		InstallationID: &install, APIKeyRef: "k", PluginConfig: map[string]any{"service_kind": "radarr", "is_4k": true}}}}
 	for q, want := range map[Quality]bool{Quality1080p: false, Quality2160p: true} {
-		conn, _, _, err := routedConnection(fc, RouteDecision{RouteName: "Everything else", IntegrationID: "radarr-4k"}, MediaTypeMovie, q)
+		conn, _, _, err := (&Service{}).routedConnection(context.Background(), fc, RouteDecision{RouteName: "Everything else", IntegrationID: "radarr-4k"}, MediaTypeMovie, q)
 		if err != nil {
 			t.Fatal(err)
 		}
diff --git a/internal/requests/service.go b/internal/requests/service.go
index f6b0c2a577..6a718a0ff3 100644
--- a/internal/requests/service.go
+++ b/internal/requests/service.go
@@ -476,13 +476,17 @@ func (s *Service) newFulfillContext(ctx context.Context) (*fulfillContext, error
 // installation routing isn't supported yet: it picks the first eligible
 // connection's installation and includes ONLY connections belonging to it, so a
 // second installation's resolved plaintext credentials are never handed to the
-// first plugin. A connection whose api key cannot be resolved (or resolves empty)
-// is skipped rather than aborting the whole request — a sibling healthy
-// connection can still fulfill it, and an unauthenticated request is never sent.
+// first plugin. A connection without the api key its plugin needs (see
+// missingAPIKey) is skipped rather than aborting the whole request — a sibling
+// healthy connection can still fulfill it, and an unauthenticated request is
+// never sent to a plugin that needs a key. So is one whose plugin's
+// declaration cannot be read; that error is returned only when no connection
+// is left.
 func (s *Service) resolveRouterConnections(ctx context.Context, fc *fulfillContext, mediaType MediaType) ([]ResolvedRouterConnection, int, string, error) {
 	var conns []ResolvedRouterConnection
 	installationID, capabilityID := 0, ""
 	chosen := false
+	var readErr error
 	for _, in := range fc.integrations {
 		if !eligibleRouterConnection(in, mediaType) {
 			continue
@@ -493,9 +497,13 @@ func (s *Service) resolveRouterConnections(ctx context.Context, fc *fulfillConte
 		if chosen && (*in.InstallationID != installationID || in.CapabilityID != capabilityID) {
 			continue
 		}
-		// in.APIKeyRef was decrypted by the repo on read; empty means unconfigured.
-		apiKey := strings.TrimSpace(in.APIKeyRef)
-		if apiKey == "" {
+		missing, err := s.missingAPIKey(ctx, fc, in)
+		if err != nil {
+			slog.WarnContext(ctx, "requests: skipping router connection whose plugin's api key declaration cannot be read", "component", "requests", "connection_id", in.ID, "err", err)
+			readErr = err
+			continue
+		}
+		if missing {
 			slog.WarnContext(ctx, "requests: skipping router connection with no api key", "component", "requests", "connection_id", in.ID)
 			continue
 		}
@@ -504,11 +512,35 @@ func (s *Service) resolveRouterConnections(ctx context.Context, fc *fulfillConte
 		if !chosen {
 			installationID, capabilityID, chosen = *in.InstallationID, in.CapabilityID, true
 		}
-		conns = append(conns, ResolvedRouterConnection{ID: in.ID, BaseURL: in.BaseURL, APIKey: apiKey, Config: in.PluginConfig})
+		conns = append(conns, ResolvedRouterConnection{ID: in.ID, BaseURL: in.BaseURL, APIKey: strings.TrimSpace(in.APIKeyRef), Config: in.PluginConfig})
+	}
+	if len(conns) == 0 && readErr != nil {
+		return nil, 0, "", readErr
 	}
 	return conns, installationID, capabilityID, nil
 }
 
+// missingAPIKey reports whether a connection has no API key although its
+// router capability needs one. in.APIKeyRef was decrypted by the repo on
+// read, and empty means none was saved. A capability that declares
+// api_key_optional takes connections without a key; its declaration is read
+// only for a connection without one, so a connection with a key never
+// depends on it. When the declaration cannot be read, the key counts as
+// missing and the error is returned.
+func (s *Service) missingAPIKey(ctx context.Context, fc *fulfillContext, in Integration) (bool, error) {
+	if strings.TrimSpace(in.APIKeyRef) != "" {
+		return false, nil
+	}
+	if in.InstallationID == nil || in.CapabilityID == "" {
+		return true, nil
+	}
+	features, err := s.routerFeatures(ctx, fc, *in.InstallationID, in.CapabilityID)
+	if err != nil {
+		return true, err
+	}
+	return !features.APIKeyOptional, nil
+}
+
 // Reasons a configured router connection cannot take a submission, recorded in
 // the request's last_error.
 const (
@@ -518,7 +550,7 @@ const (
 
 // unusableRouterMessage explains why no configured connection could take a
 // submission, for the request's last_error.
-func unusableRouterMessage(fc *fulfillContext, mediaType MediaType) string {
+func (s *Service) unusableRouterMessage(ctx context.Context, fc *fulfillContext, mediaType MediaType) string {
 	for _, in := range fc.integrations {
 		if !in.Enabled || in.CapabilityID == "" || !integrationSupportsMediaType(in, mediaType) {
 			continue
@@ -528,7 +560,7 @@ func unusableRouterMessage(fc *fulfillContext, mediaType MediaType) string {
 			// plugin install and were never re-bound.
 			return msgRouterUnbound
 		}
-		if strings.TrimSpace(in.APIKeyRef) == "" {
+		if missing, _ := s.missingAPIKey(ctx, fc, in); missing {
 			return msgRouterNoKey
 		}
 	}
@@ -569,11 +601,14 @@ func routerConfiguredFor(fc *fulfillContext, mediaType MediaType) bool {
 }
 
 // skippedRouterConnection reports whether resolveRouterConnections leaves out
-// a connection that would otherwise serve the media type, because its API key
-// is missing.
-func skippedRouterConnection(fc *fulfillContext, mediaType MediaType) bool {
+// a connection that would otherwise serve the media type, because it has no
+// API key and its plugin needs one.
+func (s *Service) skippedRouterConnection(ctx context.Context, fc *fulfillContext, mediaType MediaType) bool {
 	for _, in := range fc.integrations {
-		if eligibleRouterConnection(in, mediaType) && strings.TrimSpace(in.APIKeyRef) == "" {
+		if !eligibleRouterConnection(in, mediaType) {
+			continue
+		}
+		if missing, _ := s.missingAPIKey(ctx, fc, in); missing {
 			return true
 		}
 	}
@@ -1528,7 +1563,8 @@ func (s *Service) validateViaPlugin(ctx context.Context, in Integration) error {
 	// On UPDATE the client omits api_key_ref ("leave blank to keep saved key"),
 	// so we would otherwise validate against an empty credential. Mirror
 	// LoadIntegrationOptions's backfill: load the stored row by id and reuse the
-	// saved (already-decrypted) api key (and BaseURL/PluginConfig if also blank).
+	// saved (already-decrypted) api key (and PluginConfig if also blank). The
+	// base URL is validated as sent, since that is what the save stores.
 	// Nil-safe — a brand-new id has no stored row, so just proceed with what the
 	// body carries.
 	if strings.TrimSpace(in.APIKeyRef) == "" && strings.TrimSpace(in.ID) != "" {
@@ -1540,13 +1576,12 @@ func (s *Service) validateViaPlugin(ctx context.Context, in Integration) error {
 			// Don't pair a stored API key with a caller-changed base URL: require the
 			// key to be re-entered when the server URL changes (defense against
 			// exfiltrating a stored, API-unreadable key to an attacker-supplied URL).
-			if strings.TrimSpace(in.BaseURL) != "" && !sameIntegrationBaseURL(in.BaseURL, stored.BaseURL) {
-				return &ValidationError{FieldErrors: map[string]string{"api_key_ref": "re-enter the API key when changing the base URL"}}
+			// A cleared URL is a change too, since the save stores it blank. A
+			// server saved without a key has none to protect.
+			if strings.TrimSpace(stored.APIKeyRef) != "" && !sameIntegrationBaseURL(in.BaseURL, stored.BaseURL) {
+				return &ValidationError{FieldErrors: map[string]string{fieldAPIKey: integrationKeyReentry}}
 			}
 			in.APIKeyRef = stored.APIKeyRef
-			if strings.TrimSpace(in.BaseURL) == "" {
-				in.BaseURL = stored.BaseURL
-			}
 			if in.PluginConfig == nil {
 				in.PluginConfig = stored.PluginConfig
 			}
@@ -1637,35 +1672,40 @@ func (s *Service) LoadIntegrationOptions(ctx context.Context, viewer Viewer, int
 		}
 		if stored != nil {
 			submittedBaseURL := strings.TrimSpace(integration.BaseURL)
-			if submittedBaseURL == "" {
-				integration.BaseURL = stored.BaseURL
-			}
-			if strings.TrimSpace(integration.APIKeyRef) == "" && (submittedBaseURL == "" || sameIntegrationBaseURL(submittedBaseURL, stored.BaseURL)) {
-				integration.APIKeyRef = stored.APIKeyRef
-			}
 			if strings.TrimSpace(integration.CapabilityID) == "" {
 				integration.CapabilityID = stored.CapabilityID
 			}
 			if integration.InstallationID == nil {
 				integration.InstallationID = stored.InstallationID
 			}
+			if submittedBaseURL == "" && (!integration.BaseURLCleared || s.blankURLMeansSaved(ctx, integration)) {
+				integration.BaseURL = stored.BaseURL
+			}
+			// The saved key goes only to the address it was saved for, so a
+			// changed or cleared address is probed without it.
+			if strings.TrimSpace(integration.APIKeyRef) == "" && sameIntegrationBaseURL(integration.BaseURL, stored.BaseURL) {
+				integration.APIKeyRef = stored.APIKeyRef
+			}
 			if integration.PluginConfig == nil {
 				integration.PluginConfig = stored.PluginConfig
 			}
 		}
 	}
 
-	// Without a key the plugin could only fail; say so on the key field. The
-	// address is passed as given: the v2 adapter normalizes it first, and the
-	// frozen v1 route keeps sending what the client submitted.
-	apiKey := strings.TrimSpace(integration.APIKeyRef)
-	if apiKey == "" {
+	// Without a key a plugin that needs one could only fail; say so on the key
+	// field. The address is passed as given: the v2 adapter normalizes it
+	// first, and the frozen v1 route keeps sending what the client submitted.
+	missing, err := s.missingAPIKey(ctx, &fulfillContext{}, integration)
+	if err != nil {
+		return nil, err
+	}
+	if missing {
 		return nil, probeValidation(&ValidationError{FieldErrors: map[string]string{fieldAPIKey: integrationKeyMissing}})
 	}
 	if s.router == nil || integration.InstallationID == nil {
 		return nil, fmt.Errorf("no fulfillment backend configured")
 	}
-	conn := ResolvedRouterConnection{ID: integration.ID, BaseURL: integration.BaseURL, APIKey: apiKey, Config: integration.PluginConfig}
+	conn := ResolvedRouterConnection{ID: integration.ID, BaseURL: integration.BaseURL, APIKey: strings.TrimSpace(integration.APIKeyRef), Config: integration.PluginConfig}
 	options, err := s.router.ListConfigOptions(ctx, *integration.InstallationID, integration.CapabilityID, conn)
 	if err != nil {
 		return nil, classifyIntegrationError(err, integration.CapabilityID)
@@ -2266,7 +2306,7 @@ func (s *Service) submitClaimed(ctx context.Context, req Request, actor Viewer,
 		// but none is usable. That is an admin-fixable setup problem, so it is
 		// returned as a submission error: the request keeps its approval and
 		// retries with backoff, and goes through once the connection is fixed.
-		return nil, errors.New(unusableRouterMessage(fc, req.MediaType))
+		return nil, errors.New(s.unusableRouterMessage(ctx, fc, req.MediaType))
 	}
 	if missingSeasons {
 		// missingSeasonsDeliverable checked every series connection; this
@@ -2283,7 +2323,7 @@ func (s *Service) submitClaimed(ctx context.Context, req Request, actor Viewer,
 	if !fc.settings.ForceDualQuality {
 		allowed = filterUnconfiguredOptionalQualities(allowed, conns)
 	}
-	plan, done, err := s.planSubmission(ctx, req, actor, allowed, resolved && !skippedRouterConnection(fc, req.MediaType))
+	plan, done, err := s.planSubmission(ctx, req, actor, allowed, resolved && !s.skippedRouterConnection(ctx, fc, req.MediaType))
 	if done != nil || err != nil {
 		return done, err
 	}
@@ -2337,7 +2377,7 @@ func (s *Service) submitRouted(ctx context.Context, req Request, actor Viewer, f
 			failures[q] = unroutedMessage(routes, req.MediaType, q)
 			continue
 		}
-		conn, installationID, capabilityID, err := routedConnection(fc, decision, req.MediaType, q)
+		conn, installationID, capabilityID, err := s.routedConnection(ctx, fc, decision, req.MediaType, q)
 		if err != nil {
 			if len(targets) == 0 {
 				// The chosen server is gone, disabled or not set up: an
@@ -2981,6 +3021,7 @@ func (s *Service) checkTargetStatuses(ctx context.Context, req Request, targets
 	}
 	groups := map[owner]*group{}
 	var order []owner
+	var errs []error
 	groupFor := func(key owner) *group {
 		g := groups[key]
 		if g == nil {
@@ -3014,7 +3055,11 @@ func (s *Service) checkTargetStatuses(ctx context.Context, req Request, targets
 			continue
 		}
 		in := integrationByID(fc, t.IntegrationID)
-		if !statusCheckable(in) {
+		checkable, err := s.statusCheckable(ctx, fc, in)
+		if err != nil {
+			errs = append(errs, err)
+		}
+		if !checkable {
 			continue
 		}
 		g := groupFor(owner{*in.InstallationID, in.CapabilityID})
@@ -3024,7 +3069,6 @@ func (s *Service) checkTargetStatuses(ctx context.Context, req Request, targets
 	// One plugin being down must not hide the statuses another reported, so
 	// every group is asked and the errors are returned alongside them.
 	var out []RouterTargetStatus
-	var errs []error
 	for _, key := range order {
 		g := groups[key]
 		statuses, err := s.router.CheckStatus(ctx, key.installationID, key.capabilityID, req, g.refs, g.conns)
@@ -3069,9 +3113,14 @@ func soleRefConnection(refs []RouterTargetRef) string {
 
 // statusCheckable reports whether a target's server can be asked for the
 // target's status: it still exists, is enabled, is bound to a router
-// capability, and has an API key.
-func statusCheckable(in *Integration) bool {
-	return in != nil && in.Enabled && in.InstallationID != nil && in.CapabilityID != "" && strings.TrimSpace(in.APIKeyRef) != ""
+// capability, and has an API key unless its plugin needs none. The error is
+// from reading that declaration; the server is not asked then.
+func (s *Service) statusCheckable(ctx context.Context, fc *fulfillContext, in *Integration) (bool, error) {
+	if in == nil || !in.Enabled || in.InstallationID == nil || in.CapabilityID == "" {
+		return false, nil
+	}
+	missing, err := s.missingAPIKey(ctx, fc, *in)
+	return !missing && err == nil, err
 }
 
 func integrationByID(fc *fulfillContext, id string) *Integration {
diff --git a/internal/requests/service_test.go b/internal/requests/service_test.go
index 4db2f51470..ae98bfde2d 100644
--- a/internal/requests/service_test.go
+++ b/internal/requests/service_test.go
@@ -3182,8 +3182,14 @@ type fakeRouterProvider struct {
 	// progressCapable marks the installations whose router declares
 	// reports_download_progress.
 	progressCapable map[int]bool
-	featuresErr     error
-	gotTVDBID       *int
+	// keyOptional marks the installations whose router declares
+	// api_key_optional.
+	keyOptional map[int]bool
+	// urlOptional marks the installations whose router declares
+	// base_url_optional.
+	urlOptional map[int]bool
+	featuresErr error
+	gotTVDBID   *int
 
 	// CheckStatus behavior.
 	statuses  []RouterTargetStatus
@@ -3208,6 +3214,7 @@ type fakeRouterProvider struct {
 	validateErr           error
 	validateCalls         int
 	gotValidateCapability string
+	gotValidateConn       ResolvedRouterConnection
 	gotValidateSiblings   []ResolvedRouterConnection
 }
 
@@ -3217,6 +3224,8 @@ func (f *fakeRouterProvider) RouterFeatures(_ context.Context, installationID in
 	return RouterFeatures{
 		SupportsSeasons:         f.seasonCapable[installationID],
 		ReportsDownloadProgress: f.progressCapable[installationID],
+		APIKeyOptional:          f.keyOptional[installationID],
+		BaseURLOptional:         f.urlOptional[installationID],
 	}, f.featuresErr
 }
 
@@ -3294,10 +3303,11 @@ func (f *fakeRouterProvider) TestConnection(_ context.Context, _ int, _ string,
 	return true, "", nil
 }
 
-func (f *fakeRouterProvider) Validate(_ context.Context, _ int, capabilityID string, _ ResolvedRouterConnection, siblings []ResolvedRouterConnection) (map[string]string, string, error) {
+func (f *fakeRouterProvider) Validate(_ context.Context, _ int, capabilityID string, conn ResolvedRouterConnection, siblings []ResolvedRouterConnection) (map[string]string, string, error) {
 	f.mu.Lock()
 	f.validateCalls++
 	f.gotValidateCapability = capabilityID
+	f.gotValidateConn = conn
 	f.gotValidateSiblings = siblings
 	f.mu.Unlock()
 	return f.validateFieldErrors, f.validateFormError, f.validateErr
diff --git a/internal/requests/types.go b/internal/requests/types.go
index 3df84ac25f..255d5da7a1 100644
--- a/internal/requests/types.go
+++ b/internal/requests/types.go
@@ -579,11 +579,16 @@ type AdminViewCounts struct {
 }
 
 type Integration struct {
-	Revision            int64          `json:"-"`
-	ID                  string         `json:"id"`
-	Name                string         `json:"name"`
-	Enabled             bool           `json:"enabled"`
-	BaseURL             string         `json:"base_url"`
+	Revision int64  `json:"-"`
+	ID       string `json:"id"`
+	Name     string `json:"name"`
+	Enabled  bool   `json:"enabled"`
+	BaseURL  string `json:"base_url"`
+	// BaseURLCleared marks a connection test of a saved server that sent a
+	// blank base_url on purpose, rather than leaving it out. Only then does
+	// LoadIntegrationOptions test a router that needs no URL without one;
+	// an omitted URL means the saved one.
+	BaseURLCleared      bool           `json:"-"`
 	APIKeyRef           string         `json:"api_key_ref,omitempty"`
 	LastCheckAt         *time.Time     `json:"last_check_at,omitempty"`
 	LastCheckStatus     string         `json:"last_check_status,omitempty"`
diff --git a/internal/routeinventory/lintrules/router_assertions.go b/internal/routeinventory/lintrules/router_assertions.go
index ed62d551e6..4af346e03f 100644
--- a/internal/routeinventory/lintrules/router_assertions.go
+++ b/internal/routeinventory/lintrules/router_assertions.go
@@ -27,8 +27,8 @@ import "github.com/quasilyte/go-ruleguard/dsl"
 // entry function returns a sealed handler whose dynamic type is never a router,
 // so no assertion can recover one (the generator checks that shape). The rule
 // catches the attempt early and covers routers that are not listeners. Tests
-// are exempt (see .golangci.yml): they walk routers and register nothing that
-// ships.
+// are exempt (see .golangci-router-recovery.yml): they walk routers and
+// register nothing that ships.
 func routerTypeRecovery(m dsl.Matcher) {
 	m.Import("github.com/go-chi/chi/v5")
 
diff --git a/internal/routeinventory/sweep.go b/internal/routeinventory/sweep.go
index 36f5147896..d00bf4f5a4 100644
--- a/internal/routeinventory/sweep.go
+++ b/internal/routeinventory/sweep.go
@@ -88,7 +88,7 @@ func (a *Analyzer) sweep() error {
 	return errors.New(strings.Join(s.findings, "; "))
 }
 
-func (s *sweeper) report(node ast.Node, format string, args ...any) {
+func (s *sweeper) reportf(node ast.Node, format string, args ...any) {
 	s.findings = append(s.findings, s.a.errorf(node, format, args...).Error())
 }
 
@@ -100,11 +100,11 @@ func (s *sweeper) file(file *ast.File) {
 	for _, spec := range file.Imports {
 		path := strings.Trim(spec.Path.Value, `"`)
 		if defaultMuxImports[path] && !s.allowedProfilingImport(rel, spec, path) {
-			s.report(spec, "%s imports %s, which registers on http.DefaultServeMux at init; "+
+			s.reportf(spec, "%s imports %s, which registers on http.DefaultServeMux at init; "+
 				"nothing may serve that mux, so the import is refused", rel, path)
 		}
 		if path == "unsafe" && audited {
-			s.report(spec, "%s imports unsafe in an audited package; unsafe can reach the router behind a "+
+			s.reportf(spec, "%s imports unsafe in an audited package; unsafe can reach the router behind a "+
 				"sealed handler, so audited packages may not import it", rel)
 		}
 	}
@@ -165,7 +165,7 @@ func (s *sweeper) visit(decl ast.Node, where string, allowed bool) {
 				break
 			}
 			if t := s.info().TypeOf(typed.Type); s.a.set.producesRouter(t) {
-				s.report(typed, "a variable is declared with %s %s; its zero value is a working router "+
+				s.reportf(typed, "a variable is declared with %s %s; its zero value is a working router "+
 					"that no listener enumerates", typeLabel(t), where)
 			}
 		case *ast.TypeAssertExpr:
@@ -191,12 +191,12 @@ func (s *sweeper) visit(decl ast.Node, where string, allowed bool) {
 func (s *sweeper) recovery(at ast.Node, typeExpr ast.Expr, verb string) {
 	t := s.info().TypeOf(typeExpr)
 	if _, isParam := types.Unalias(t).(*types.TypeParam); isParam {
-		s.report(at, "%s a type parameter; instantiated with a router type it would recover a router "+
+		s.reportf(at, "%s a type parameter; instantiated with a router type it would recover a router "+
 			"no listener enumerates", verb)
 		return
 	}
 	if kind := s.a.set.routerKind(t); kind != ctorNone {
-		s.report(at, "%s %s, which is %s by its method set; a router recovered from a value is a "+
+		s.reportf(at, "%s %s, which is %s by its method set; a router recovered from a value is a "+
 			"registration surface the inventory cannot see", verb, typeLabel(t), kind)
 	}
 }
@@ -229,7 +229,7 @@ func (s *sweeper) ident(ident *ast.Ident) {
 	if inst, ok := s.info().Instances[ident]; ok && inst.TypeArgs != nil {
 		for i := 0; i < inst.TypeArgs.Len(); i++ {
 			if kind := s.a.set.routerKind(inst.TypeArgs.At(i)); kind != ctorNone {
-				s.report(ident, "%s is instantiated with %s, which is %s by its method set; a generic "+
+				s.reportf(ident, "%s is instantiated with %s, which is %s by its method set; a generic "+
 					"can assert a value to its type argument and recover a router", ident.Name,
 					typeLabel(inst.TypeArgs.At(i)), kind)
 			}
@@ -238,17 +238,17 @@ func (s *sweeper) ident(ident *ast.Ident) {
 	switch obj := s.info().Uses[ident].(type) {
 	case *types.Func:
 		if isRouterCtor(obj) != ctorNone && !s.a.set.callees[ident] {
-			s.report(ident, "%s.%s is used as a function value rather than called; a router built through it "+
+			s.reportf(ident, "%s.%s is used as a function value rather than called; a router built through it "+
 				"would not be recognized as a construction", obj.Pkg().Name(), obj.Name())
 		}
 		if obj.Pkg() != nil && obj.Pkg().Path() == "reflect" {
 			if why := reflectRecovery[recvName(obj)][obj.Name()]; why != "" {
-				s.report(ident, "%s on a router the inventory cannot see", why)
+				s.reportf(ident, "%s on a router the inventory cannot see", why)
 			}
 		}
 	case *types.Var:
 		if obj.Pkg() != nil && obj.Pkg().Path() == httpImportPath && obj.Name() == "DefaultServeMux" {
-			s.report(ident, "refers to http.DefaultServeMux, which no listener enumerates")
+			s.reportf(ident, "refers to http.DefaultServeMux, which no listener enumerates")
 		}
 	}
 }
@@ -261,9 +261,9 @@ func (s *sweeper) call(call *ast.CallExpr) {
 	}
 	switch {
 	case defaultMuxRegistrars[fn.Name()]:
-		s.report(call, "http.%s registers on http.DefaultServeMux, which no listener enumerates", fn.Name())
+		s.reportf(call, "http.%s registers on http.DefaultServeMux, which no listener enumerates", fn.Name())
 	case handlerConsumingCalls[fn.Name()] && len(call.Args) > 0 && isNilValue(call.Args[len(call.Args)-1], s.info()):
-		s.report(call, "serves a nil handler, which is http.DefaultServeMux; no listener enumerates it")
+		s.reportf(call, "serves a nil handler, which is http.DefaultServeMux; no listener enumerates it")
 	}
 }
 
@@ -277,18 +277,18 @@ func (s *sweeper) composite(lit *ast.CompositeLit) {
 	for _, elt := range lit.Elts {
 		kv, ok := elt.(*ast.KeyValueExpr)
 		if !ok {
-			s.report(lit, "http.Server is built with a positional literal; the route inventory requires "+
+			s.reportf(lit, "http.Server is built with a positional literal; the route inventory requires "+
 				"a keyed literal with a non-nil Handler")
 			return
 		}
 		if key, _ := kv.Key.(*ast.Ident); key != nil && key.Name == methodHandler {
 			if isNilValue(kv.Value, s.info()) {
-				s.report(kv, "http.Server is built with Handler: nil, which serves http.DefaultServeMux")
+				s.reportf(kv, "http.Server is built with Handler: nil, which serves http.DefaultServeMux")
 			}
 			return
 		}
 	}
-	s.report(lit, "http.Server is built without a Handler, so it serves http.DefaultServeMux; "+
+	s.reportf(lit, "http.Server is built without a Handler, so it serves http.DefaultServeMux; "+
 		"no listener enumerates that mux")
 }
 
@@ -302,11 +302,11 @@ func (s *sweeper) production(expr ast.Expr, where string) {
 		return
 	}
 	if strings.HasPrefix(where, "at ") {
-		s.report(expr, "%s constructed %s, which belongs to no listener entry point; "+
+		s.reportf(expr, "%s constructed %s, which belongs to no listener entry point; "+
 			"build it inside a declared listener entry function", s.a.set.exprText(expr), where)
 		return
 	}
-	s.report(expr, "%s constructed %s outside the inventoried listeners; "+
+	s.reportf(expr, "%s constructed %s outside the inventoried listeners; "+
 		"add it as a listener or record it as an explicit exclusion for that function", s.a.set.exprText(expr), where)
 }
 
diff --git a/internal/s3client/client.go b/internal/s3client/client.go
index 54b11cf7ad..cc8d7aec73 100644
--- a/internal/s3client/client.go
+++ b/internal/s3client/client.go
@@ -688,7 +688,9 @@ func (c *Client) DeletePrefix(ctx context.Context, bucket, prefix string) (int,
 }
 
 // DeleteObjects deletes the given keys in batches of up to 1000 (the S3 API
-// limit). Returns the total number of successfully deleted objects.
+// limit). Returns the total number of successfully deleted objects. Missing
+// keys count as deleted; any other failure is returned as an error alongside
+// the count, and a canceled context stops the deletion with its error.
 func (c *Client) DeleteObjects(ctx context.Context, bucket string, keys []string) (int, error) {
 	if err := c.mutations.Acquire(ctx, 1); err != nil {
 		return 0, err
@@ -700,8 +702,19 @@ func (c *Client) DeleteObjects(ctx context.Context, bucket string, keys []string
 func (c *Client) deleteObjects(ctx context.Context, bucket string, keys []string) (int, error) {
 	const batchSize = 1000
 	deleted := 0
+	failed := 0
+	var firstErr error
+	recordFailure := func(err error) {
+		failed++
+		if firstErr == nil {
+			firstErr = err
+		}
+	}
 
 	for i := 0; i < len(keys); i += batchSize {
+		if err := ctx.Err(); err != nil {
+			return deleted, err
+		}
 		end := i + batchSize
 		if end > len(keys) {
 			end = len(keys)
@@ -721,10 +734,28 @@ func (c *Client) deleteObjects(ctx context.Context, bucket string, keys []string
 			},
 		})
 		if err != nil {
+			if ctxErr := ctx.Err(); ctxErr != nil {
+				return deleted, ctxErr
+			}
+			if !isBatchDeleteUnsupported(err) {
+				// Several callers discard the error, so log it here as the
+				// per-key failures below are.
+				code := s3ErrorCode(err)
+				slog.WarnContext(ctx, "s3 DeleteObjects: batch request failed", "component", "s3client",
+					"keys", len(batch), "code", code)
+				return deleted, fmt.Errorf("s3 DeleteObjects %s: %s", bucket, code)
+			}
 			// Fall back to individual deletes if batch is not supported.
 			for _, key := range batch {
+				if ctxErr := ctx.Err(); ctxErr != nil {
+					return deleted, ctxErr
+				}
 				if delErr := c.deleteObject(ctx, bucket, key); delErr != nil {
-					slog.WarnContext(ctx, "s3 DeleteObjects fallback: failed to delete", "component", "s3client", "key", key, "error", delErr)
+					if ctxErr := ctx.Err(); ctxErr != nil {
+						return deleted, ctxErr
+					}
+					slog.WarnContext(ctx, "s3 DeleteObjects fallback: failed to delete", "component", "s3client", "key", key, "code", s3ErrorCode(delErr))
+					recordFailure(fmt.Errorf("s3 DeleteObjects %s/%s: %s", bucket, key, s3ErrorCode(delErr)))
 					continue
 				}
 				deleted++
@@ -733,21 +764,105 @@ func (c *Client) deleteObjects(ctx context.Context, bucket string, keys []string
 		}
 
 		deleted += len(batch)
-		if out != nil {
+		if out != nil && len(out.Errors) > 0 {
+			// Name each failure by the key the caller asked for. The key in the
+			// response comes from the backend, like its message, so one that
+			// matches no requested key is never logged or returned.
+			requested := make(map[string]string, len(batch))
+			for _, key := range batch {
+				requested[c.prefixedKey(key)] = key
+			}
 			for _, e := range out.Errors {
 				if isMissingObjectCode(aws.ToString(e.Code)) {
 					continue
 				}
 				deleted--
+				key, ok := requested[aws.ToString(e.Key)]
+				if !ok {
+					key = "unrecognized key"
+				}
+				code := safeErrorCode(aws.ToString(e.Code))
 				slog.WarnContext(ctx, "s3 DeleteObjects: partial failure", "component", "s3client",
-					"key", aws.ToString(e.Key), "code", aws.ToString(e.Code), "message", aws.ToString(e.Message))
+					"key", key, "code", code)
+				// The backend's free-form message is omitted from both the log
+				// and the returned error: it may echo credentials or signed URLs.
+				recordFailure(fmt.Errorf("s3 DeleteObjects %s/%s: %s", bucket, key, code))
 			}
 		}
 	}
 
+	if failed > 0 {
+		return deleted, fmt.Errorf("s3 DeleteObjects %s: %d of %d objects not deleted: %w", bucket, failed, len(keys), firstErr)
+	}
 	return deleted, nil
 }
 
+// s3ErrorCode returns the backend error code for err without its free-form
+// message, which may echo credentials or signed URLs.
+func s3ErrorCode(err error) string {
+	if apiErr, ok := errors.AsType[smithy.APIError](err); ok {
+		return safeErrorCode(apiErr.ErrorCode())
+	}
+	return "request failed"
+}
+
+const unrecognizedErrorCode = "unrecognized error code"
+
+// safeErrorCode returns code when it looks like an S3 error code (a short
+// identifier such as "AccessDenied") and a fixed placeholder otherwise. The code
+// comes from the backend, so an unexpected value is never logged or returned.
+func safeErrorCode(code string) string {
+	if code == "" || len(code) > 64 {
+		return unrecognizedErrorCode
+	}
+	for _, r := range code {
+		if !isErrorCodeRune(r) {
+			return unrecognizedErrorCode
+		}
+	}
+	return code
+}
+
+// isErrorCodeRune reports whether r may appear in an S3 error code.
+func isErrorCodeRune(r rune) bool {
+	switch {
+	case r >= 'A' && r <= 'Z', r >= 'a' && r <= 'z', r >= '0' && r <= '9':
+		return true
+	case r == '.', r == '_', r == '-':
+		return true
+	}
+	return false
+}
+
+// isBatchDeleteUnsupported reports whether a DeleteObjects error means the
+// endpoint does not accept batch deletes as the SDK sends them, so per-object
+// deletes should be used instead. Besides an unimplemented operation, that
+// covers the checksum: the SDK sends a CRC32 checksum on batch deletes, and
+// S3-compatible backends that still require Content-MD5 (older MinIO releases
+// among them) reject the batch with one of the codes below, while single
+// deletes need no checksum. Any other error, such as a wrong region, a bad
+// bucket name, or an auth failure, would fail every per-object delete the same
+// way, so it is returned instead.
+func isBatchDeleteUnsupported(err error) bool {
+	if apiErr, ok := errors.AsType[smithy.APIError](err); ok {
+		switch apiErr.ErrorCode() {
+		case "NotImplemented", "MissingContentMD5", "InvalidRequest", "InvalidDigest", "BadDigest":
+			return true
+		}
+	}
+	type httpResponseError interface {
+		HTTPStatusCode() int
+	}
+	var httpErr httpResponseError
+	if errors.As(err, &httpErr) {
+		switch httpErr.HTTPStatusCode() {
+		case http.StatusNotImplemented, http.StatusMethodNotAllowed:
+			return true
+		}
+	}
+	return false
+}
+
 func isMissingObjectCode(code string) bool {
 	return code == "NoSuchKey" || code == "NotFound"
 }
diff --git a/internal/s3client/client_test.go b/internal/s3client/client_test.go
index d8aee3d53b..d290d00b3d 100644
--- a/internal/s3client/client_test.go
+++ b/internal/s3client/client_test.go
@@ -247,14 +247,153 @@ func TestDeleteObjectsCountsOnlyMissingObjectBatchErrors(t *testing.T) {
 		w.Header().Set("Content-Type", "application/xml")
 		_, _ = io.WriteString(w, `<DeleteResult>
 			<Error><Key>missing.webp</Key><Code>NoSuchKey</Code></Error>
-			<Error><Key>denied.webp</Key><Code>AccessDenied</Code></Error>
+			<Error><Key>denied.webp</Key><Code>AccessDenied</Code><Message>signed https://x/?X-Amz-Signature=SECRETSIG</Message></Error>
 		</DeleteResult>`)
 	}))
 	t.Cleanup(server.Close)
 	client := NewClient(BucketConfig{Endpoint: server.URL, Region: "us-east-1", Bucket: "silo", PathStyle: true, AccessKey: "test", SecretKey: "test"})
 	deleted, err := client.DeleteObjects(t.Context(), client.Bucket(), []string{"missing.webp", "existing.webp", "denied.webp"})
-	if err != nil || deleted != 2 {
-		t.Fatalf("DeleteObjects() = %d, %v; want 2, nil", deleted, err)
+	if err == nil || deleted != 2 {
+		t.Fatalf("DeleteObjects() = %d, %v; want 2 and an error", deleted, err)
+	}
+	if !strings.Contains(err.Error(), "denied.webp") {
+		t.Fatal("DeleteObjects() error did not name denied.webp")
+	}
+	if !strings.Contains(err.Error(), "AccessDenied") {
+		t.Fatal("DeleteObjects() error did not carry the AccessDenied error code")
+	}
+	if strings.Contains(err.Error(), "SECRETSIG") {
+		t.Fatal("DeleteObjects() error echoed the backend message")
+	}
+}
+
+func TestDeletePrefixReturnsErrorWhenBatchDeleteFails(t *testing.T) {
+	// Neither failure is about how the batch was sent, so retrying each key on
+	// its own would fail the same way: no per-key fallback.
+	for name, rejection := range map[string]struct {
+		status int
+		code   string
+	}{
+		"access denied": {http.StatusForbidden, "AccessDenied"},
+		"wrong region":  {http.StatusBadRequest, "AuthorizationHeaderMalformed"},
+	} {
+		t.Run(name, func(t *testing.T) {
+			var mu sync.Mutex
+			var batchCalls, objectCalls int
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.Header().Set("Content-Type", "application/xml")
+				switch {
+				case r.Method == http.MethodGet && r.URL.Query().Get("list-type") == "2":
+					_, _ = io.WriteString(w, `<ListBucketResult><Name>prairie</Name><IsTruncated>false</IsTruncated>
+						<Contents><Key>local/ebooks/1/a.webp</Key></Contents>
+						<Contents><Key>local/ebooks/1/b.webp</Key></Contents>
+					</ListBucketResult>`)
+				case r.Method == http.MethodPost && r.URL.Query().Has("delete"):
+					mu.Lock()
+					batchCalls++
+					mu.Unlock()
+					w.WriteHeader(rejection.status)
+					_, _ = io.WriteString(w, "<Error><Code>"+rejection.code+"</Code><Message>signed ?X-Amz-Signature=SECRETSIG</Message></Error>")
+				case r.Method == http.MethodDelete:
+					mu.Lock()
+					objectCalls++
+					mu.Unlock()
+					w.WriteHeader(rejection.status)
+					_, _ = io.WriteString(w, "<Error><Code>"+rejection.code+"</Code></Error>")
+				default:
+					w.WriteHeader(http.StatusBadRequest)
+				}
+			}))
+			t.Cleanup(server.Close)
+			client := NewClient(BucketConfig{Endpoint: server.URL, Region: "us-east-1", Bucket: "prairie", PathStyle: true, AccessKey: "test", SecretKey: "test"})
+			deleted, err := client.DeletePrefix(t.Context(), client.Bucket(), "local/ebooks/1/")
+			if err == nil || deleted != 0 {
+				t.Fatalf("DeletePrefix() = %d, %v; want 0 and an error", deleted, err)
+			}
+			if !strings.Contains(err.Error(), rejection.code) || strings.Contains(err.Error(), "SECRETSIG") {
+				t.Fatal("DeletePrefix() error must carry the code without the backend message")
+			}
+			mu.Lock()
+			defer mu.Unlock()
+			if batchCalls != 1 || objectCalls != 0 {
+				t.Fatalf("batch requests=%d, per-key requests=%d; want 1 and 0", batchCalls, objectCalls)
+			}
+		})
+	}
+}
+
+// The key in a partial-failure entry comes from the backend, so it is never
+// echoed unless it is one the caller asked to delete.
+func TestDeleteObjectsDoesNotEchoAnUnrequestedKey(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/xml")
+		_, _ = io.WriteString(w, `<DeleteResult>
+			<Error><Key>https://x/?X-Amz-Signature=SECRETSIG</Key><Code>AccessDenied</Code></Error>
+		</DeleteResult>`)
+	}))
+	t.Cleanup(server.Close)
+	client := NewClient(BucketConfig{Endpoint: server.URL, Region: "us-east-1", Bucket: "prairie", PathStyle: true, AccessKey: "test", SecretKey: "test"})
+	deleted, err := client.DeleteObjects(t.Context(), client.Bucket(), []string{"a.webp"})
+	if err == nil || deleted != 0 {
+		t.Fatal("DeleteObjects() must report the failed entry")
+	}
+	if strings.Contains(err.Error(), "SECRETSIG") {
+		t.Fatal("DeleteObjects() error echoed a key the caller never requested")
+	}
+}
+
+func TestDeleteObjectsFallbackReturnsErrorForFailedKeys(t *testing.T) {
+	for name, rejection := range map[string]struct {
+		status int
+		body   string
+	}{
+		"not implemented": {http.StatusNotImplemented, "<Error><Code>NotImplemented</Code></Error>"},
+		// The SDK sends a CRC32 checksum on batch deletes; backends that still
+		// require Content-MD5 reject the batch but accept single deletes.
+		"missing content-md5": {http.StatusBadRequest, "<Error><Code>MissingContentMD5</Code></Error>"},
+	} {
+		t.Run(name, func(t *testing.T) {
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				w.Header().Set("Content-Type", "application/xml")
+				switch {
+				case r.Method == http.MethodPost && r.URL.Query().Has("delete"):
+					w.WriteHeader(rejection.status)
+					_, _ = io.WriteString(w, rejection.body)
+				case r.Method == http.MethodDelete && strings.HasSuffix(r.URL.Path, "/denied.webp"):
+					w.WriteHeader(http.StatusForbidden)
+					_, _ = io.WriteString(w, "<Error><Code>AccessDenied</Code></Error>")
+				case r.Method == http.MethodDelete:
+					w.WriteHeader(http.StatusNoContent)
+				default:
+					w.WriteHeader(http.StatusBadRequest)
+				}
+			}))
+			t.Cleanup(server.Close)
+			client := NewClient(BucketConfig{Endpoint: server.URL, Region: "us-east-1", Bucket: "prairie", PathStyle: true, AccessKey: "test", SecretKey: "test"})
+			deleted, err := client.DeleteObjects(t.Context(), client.Bucket(), []string{"ok.webp", "denied.webp"})
+			if err == nil || deleted != 1 {
+				t.Fatalf("DeleteObjects() = %d, %v; want 1 and an error", deleted, err)
+			}
+		})
+	}
+}
+
+func TestDeleteObjectsReturnsContextError(t *testing.T) {
+	var calls int
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		calls++
+		w.WriteHeader(http.StatusOK)
+	}))
+	t.Cleanup(server.Close)
+	client := NewClient(BucketConfig{Endpoint: server.URL, Region: "us-east-1", Bucket: "prairie", PathStyle: true, AccessKey: "test", SecretKey: "test"})
+	ctx, cancel := context.WithCancel(t.Context())
+	cancel()
+	deleted, err := client.deleteObjects(ctx, client.Bucket(), []string{"a.webp", "b.webp"})
+	if !errors.Is(err, context.Canceled) || deleted != 0 {
+		t.Fatalf("deleteObjects() = %d, %v; want 0, context.Canceled", deleted, err)
+	}
+	if calls != 0 {
+		t.Fatalf("requests=%d; want 0", calls)
 	}
 }
 
@@ -675,3 +814,18 @@ func TestArtworkDeliveryScopeExcludesCredentials(t *testing.T) {
 		t.Fatal("delivery endpoint change did not change scope")
 	}
 }
+
+func TestSafeErrorCodeAllowsOnlyIdentifierCodes(t *testing.T) {
+	for code, want := range map[string]string{
+		"AccessDenied":                      "AccessDenied",
+		"Slow_Down-1.x":                     "Slow_Down-1.x",
+		"":                                  unrecognizedErrorCode,
+		"https://x/?X-Amz-Signature=SECRET": unrecognizedErrorCode,
+		"Access Denied token":               unrecognizedErrorCode,
+		strings.Repeat("A", 65):             unrecognizedErrorCode,
+	} {
+		if got := safeErrorCode(code); got != want {
+			t.Errorf("safeErrorCode(%q) = %q, want %q", code, got, want)
+		}
+	}
+}
diff --git a/internal/s3client/metrics_test.go b/internal/s3client/metrics_test.go
index ab5f775e24..02c75463fb 100644
--- a/internal/s3client/metrics_test.go
+++ b/internal/s3client/metrics_test.go
@@ -108,9 +108,13 @@ func TestS3DialsOverlapAndLateCompletion(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if resp, err := c.Do(req); err == nil {
+	resp, err := c.Do(req)
+	if resp != nil {
 		_ = resp.Body.Close()
 	}
+	if !errors.Is(err, context.Canceled) {
+		t.Fatalf("Do error = %v, want context.Canceled", err)
+	}
 	// Background dial callbacks can arrive after Do returns, even when no
 	// GotConn follows (cancellation or a subsequent TLS handshake failure).
 	trace.ConnectDone("tcp", "late", nil)
diff --git a/internal/s3client/transport.go b/internal/s3client/transport.go
index d6202f1b86..ff69647c23 100644
--- a/internal/s3client/transport.go
+++ b/internal/s3client/transport.go
@@ -30,12 +30,14 @@ const (
 
 // All S3 clients share this pool. The SDK's dial, TLS and keep-alive defaults
 // are kept, along with its restriction to method-preserving redirects.
+var sharedTransportValue = awshttp.NewBuildableClient().WithTransportOptions(func(tr *http.Transport) {
+	tr.MaxConnsPerHost = s3MaxConnsPerHost
+	tr.MaxIdleConnsPerHost = s3MaxConnsPerHost
+	tr.MaxIdleConns = s3MaxIdleConns
+}).GetTransport()
+
 var sharedHTTPClientValue = &http.Client{
-	Transport: awshttp.NewBuildableClient().WithTransportOptions(func(tr *http.Transport) {
-		tr.MaxConnsPerHost = s3MaxConnsPerHost
-		tr.MaxIdleConnsPerHost = s3MaxConnsPerHost
-		tr.MaxIdleConns = s3MaxIdleConns
-	}).GetTransport(),
+	Transport: sharedTransportValue,
 	CheckRedirect: func(req *http.Request, via []*http.Request) error {
 		// Setting CheckRedirect replaces net/http's default, so keep its hop limit.
 		if len(via) >= maxRedirects {
@@ -53,11 +55,8 @@ var sharedHTTPClientValue = &http.Client{
 
 // Delivery URLs retain normal browser redirect behavior while sharing the
 // storage connection pool. S3 uploads must never become GETs after a redirect.
-var sharedDeliveryHTTPClient = &http.Client{Transport: sharedHTTPClientValue.Transport}
+var sharedDeliveryHTTPClient = &http.Client{Transport: sharedTransportValue}
 
 func sharedHTTPClient() *http.Client { return sharedHTTPClientValue }
 
-func sharedTransport() *http.Transport {
-	transport, _ := sharedHTTPClientValue.Transport.(*http.Transport)
-	return transport
-}
+func sharedTransport() *http.Transport { return sharedTransportValue }
diff --git a/internal/s3client/transport_test.go b/internal/s3client/transport_test.go
index 7cbcd25ccf..99cd0bd9ee 100644
--- a/internal/s3client/transport_test.go
+++ b/internal/s3client/transport_test.go
@@ -209,7 +209,7 @@ func TestBurstNeverClosesUnusedConnections(t *testing.T) {
 		mu.Unlock()
 		unblock := sync.OnceFunc(func() { close(gate) })
 		// Also release handlers if waitFor fails before the normal release.
-		defer unblock()
+		defer unblock() //nolint:gocritic,revive // every round must release its handlers if the test stops early
 
 		var wg sync.WaitGroup
 		for range 3 * s3MaxConnsPerHost {
diff --git a/internal/scanner/ebook.go b/internal/scanner/ebook.go
index 9b94656881..b8689ad542 100644
--- a/internal/scanner/ebook.go
+++ b/internal/scanner/ebook.go
@@ -556,7 +556,7 @@ func parseEbookFBZ(path string) (parsedEbook, error) {
 		if err != nil {
 			return book, err
 		}
-		defer entry.Close()
+		defer func() { _ = entry.Close() }() //nolint:gocritic,revive // the loop returns after this entry
 		return parseEbookFB2Reader(io.LimitReader(entry, maxEPUBMetadataEntrySize+1), "fbz")
 	}
 	return book, fmt.Errorf("fbz archive has no fb2 entry")
@@ -1196,7 +1196,7 @@ func readEPUBZipEntry(reader *zip.Reader, name string) ([]byte, error) {
 		if err != nil {
 			return nil, err
 		}
-		defer entry.Close()
+		defer func() { _ = entry.Close() }() //nolint:gocritic,revive // the loop returns after this entry
 		limited := io.LimitReader(entry, maxEPUBMetadataEntrySize+1)
 		data, err := io.ReadAll(limited)
 		if err != nil {
diff --git a/internal/scanner/ebook_test.go b/internal/scanner/ebook_test.go
index 3501a7a57a..db3aa5ee41 100644
--- a/internal/scanner/ebook_test.go
+++ b/internal/scanner/ebook_test.go
@@ -7,6 +7,7 @@ import (
 	"errors"
 	"os"
 	"path/filepath"
+	"slices"
 	"strings"
 	"testing"
 	"time"
@@ -14,6 +15,7 @@ import (
 
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgconn"
+
 	"github.com/prairie-server/prairie-server/internal/catalog"
 	"github.com/prairie-server/prairie-server/internal/models"
 )
@@ -2023,10 +2025,9 @@ func buildTestMOBI(t *testing.T) string {
 	recs = append(recs, exthRec(100, "A H Lee")...)          // author
 	recs = append(recs, exthRec(503, "The Sea: A Novel")...) // updated title
 	recs = append(recs, exthRec(104, "9780306406157")...)    // ISBN
-	exth := make([]byte, 12)
-	copy(exth[0:4], "EXTH")
-	binary.BigEndian.PutUint32(exth[4:8], uint32(12+len(recs)))
-	binary.BigEndian.PutUint32(exth[8:12], 3)
+	exth := []byte("EXTH")
+	exth = binary.BigEndian.AppendUint32(exth, uint32(12+len(recs))) // block length
+	exth = binary.BigEndian.AppendUint32(exth, 3)                    // record count
 	exth = append(exth, recs...)
 
 	const mobiHeaderLen = 232
@@ -2055,7 +2056,7 @@ func buildTestMOBI(t *testing.T) string {
 	binary.BigEndian.PutUint32(pdb[78:82], rec0Off) // record 0 offset
 
 	path := filepath.Join(t.TempDir(), "book.mobi")
-	if err := os.WriteFile(path, append(pdb, rec0...), 0o644); err != nil {
+	if err := os.WriteFile(path, slices.Concat(pdb, rec0), 0o644); err != nil {
 		t.Fatalf("write test mobi: %v", err)
 	}
 	return path
diff --git a/internal/scanner/extras.go b/internal/scanner/extras.go
index 4d5f4d1348..a3e4e2f4da 100644
--- a/internal/scanner/extras.go
+++ b/internal/scanner/extras.go
@@ -5,6 +5,7 @@ import (
 	"log/slog"
 	"os"
 	"path/filepath"
+	"sort"
 	"strings"
 	"time"
 
@@ -32,14 +33,19 @@ type extraCandidate struct {
 // live inside a directory named "Extras" classify everything beneath it.
 const extrasDirAncestorDepth = 2
 
+// showEvidenceDepth bounds how far below a folder a series classifier looks
+// for an episode whose series root is that folder: three path components
+// cover "Show/Season 01/Disc 1/episode.mkv".
+const showEvidenceDepth = 3
+
 // extrasClassifier classifies walked paths as local extras using the
 // library's structure. A convention-named directory ("Other", "Trailers",
 // "Extras", ...) only counts as an extras dir when it is owned by a title
-// folder — a directory that holds media of its own (the movie file beside the
-// extras dir, or episodes in season folders beside it). Convention names used
-// as content-scope folders at any depth ("movies/other/<Movie>/...",
-// "movies/4K/shorts/<Movie>/...") own no media directly and never classify,
-// so the titles beneath them stay primary.
+// folder: a directory that holds media of its own (the movie file beside the
+// extras dir) or, outside movie libraries, a folder that belongs to a show
+// (see walkedShowFolder). Convention names used as content-scope folders at any
+// depth ("movies/other/<Movie>/...", "tv/Kids/Shorts/<files>") own no media
+// directly and are no show's folder, so the titles beneath them stay primary.
 type extrasClassifier struct {
 	folderType   string
 	libraryRoots []string
@@ -52,11 +58,13 @@ type extrasClassifier struct {
 	probedOwners map[string]bool
 	// dirFiles marks directories that directly contain a walked media file.
 	dirFiles map[string]bool
-	// dirFilesBelow marks directories with a walked media file exactly two
-	// levels down through a non-convention child (a show folder above its
-	// season folders — but not a folder whose only media hides inside its
-	// own extras dirs).
-	dirFilesBelow map[string]bool
+	// walkedPaths are the paths the scan walked; sortedPaths is a sorted copy,
+	// built when a series classifier first lists the files below a candidate
+	// show folder.
+	walkedPaths []string
+	sortedPaths []string
+	// showFolders caches walkedShowFolder answers by directory.
+	showFolders map[string]bool
 	// probeFS switches ownership checks to bounded os.ReadDir probes for
 	// single-file (watch event) scans, which have no walked path list.
 	probeFS bool
@@ -66,20 +74,17 @@ type extrasClassifier struct {
 // walkRoots.
 func newExtrasClassifier(folderType string, libraryRoots, walkRoots, walkedPaths []string) *extrasClassifier {
 	c := &extrasClassifier{
-		folderType:    folderType,
-		libraryRoots:  libraryRoots,
-		rootSet:       walkRootSet(libraryRoots),
-		walkRoots:     walkRoots,
-		probedOwners:  make(map[string]bool),
-		dirFiles:      make(map[string]bool, len(walkedPaths)),
-		dirFilesBelow: make(map[string]bool, len(walkedPaths)),
+		folderType:   folderType,
+		libraryRoots: libraryRoots,
+		rootSet:      walkRootSet(libraryRoots),
+		walkRoots:    walkRoots,
+		probedOwners: make(map[string]bool),
+		dirFiles:     make(map[string]bool, len(walkedPaths)),
+		walkedPaths:  walkedPaths,
+		showFolders:  make(map[string]bool),
 	}
 	for _, p := range walkedPaths {
-		dir := filepath.Dir(p)
-		c.dirFiles[dir] = true
-		if extrasDirKinds[normalizeScannerDirLabel(filepath.Base(dir))] == "" {
-			c.dirFilesBelow[filepath.Dir(dir)] = true
-		}
+		c.dirFiles[filepath.Dir(p)] = true
 	}
 	return c
 }
@@ -91,15 +96,20 @@ func newWatchExtrasClassifier(folderType string, libraryRoots []string) *extrasC
 		folderType:   folderType,
 		libraryRoots: libraryRoots,
 		rootSet:      walkRootSet(libraryRoots),
+		showFolders:  make(map[string]bool),
 		probeFS:      true,
 	}
 }
 
 // classify reports whether the walked path is a local extra.
 //
-// Directory names win over filename suffixes. For non-movie libraries a file
-// carrying a parseable SxxExx episode token is never an extra: series
-// "Extras/SxxExx" files keep their documented season-0 mapping.
+// Directory names win over filename suffixes. Outside movie libraries, a file
+// carrying a parseable SxxExx episode token under a show's own Extras/ folder,
+// or classified only by its filename suffix, is not an extra: series
+// "Extras/SxxExx" files keep their documented episode mapping. In any other
+// extras folder ("other/", "Trailers/", a season's "Extras/", "Extras/Behind
+// The Scenes/") the episode token is part of the extra's name, so a deleted
+// scene numbered S01E05 never becomes a second version of the real episode.
 func (c *extrasClassifier) classify(path string) (extraCandidate, bool) {
 	candidate := extraCandidate{Path: path}
 
@@ -126,11 +136,19 @@ func (c *extrasClassifier) classify(path string) (extraCandidate, bool) {
 			return extraCandidate{}, false
 		}
 		candidate.Kind = models.NormalizeExtraKind(kind)
+	} else if !librarykind.IsMovie(c.folderType) {
+		// A folder named like an extras folder that holds episodes in season
+		// folders (Kids/Shorts/Season 01/Shorts S01E01.mkv) is a show of its
+		// own. Without an episode code, a season-like folder inside a show's
+		// extras (Trailers/S01/Preview.mkv) holds extras.
+		if ctx := c.pathContext(path); ctx != nil && ctx.HasEpisodePattern && ctx.HasSeasonStructure && cleanRoot(ctx) == candidate.SupplementalDir {
+			return extraCandidate{}, false
+		}
 	}
 
 	// Preserve the documented series behavior: an episode-tokened file under
-	// Extras/ is a season-0 special, not an extra.
-	if !librarykind.IsMovie(c.folderType) {
+	// a show's Extras/ is an episode (S00 a special), not an extra.
+	if !librarykind.IsMovie(c.folderType) && c.keepsEpisodeToken(candidate) {
 		if hints := naming.ParseFilename(path, c.folderType); hints != nil &&
 			hints.Type == "series" && hints.EpisodeNum > 0 {
 			return extraCandidate{}, false
@@ -140,11 +158,40 @@ func (c *extrasClassifier) classify(path string) (extraCandidate, bool) {
 	return candidate, true
 }
 
+// keepsEpisodeToken reports whether an episode token in the candidate's file
+// name still makes it an episode: only its filename suffix marked it, or it
+// sits under an Extras/ folder that its show folder holds directly (the file's
+// series root is the folder holding Extras/).
+func (c *extrasClassifier) keepsEpisodeToken(candidate extraCandidate) bool {
+	if candidate.SupplementalDir == "" {
+		return true
+	}
+	switch normalizeScannerDirLabel(filepath.Base(candidate.SupplementalDir)) {
+	case extraDirLabel, extrasDirLabel:
+	default:
+		return false
+	}
+	owner := firstNonSupplementalAncestor(candidate.SupplementalDir)
+	return owner == filepath.Dir(candidate.SupplementalDir) && cleanRoot(c.pathContext(candidate.Path)) == owner
+}
+
+// pathContext is naming's reading of file in this library.
+func (c *extrasClassifier) pathContext(file string) *naming.PathContext {
+	return naming.ResolvePathContext(file, c.folderType, c.libraryRoots...)
+}
+
+// cleanRoot is ctx's content root as a cleaned OS path, or "" without one.
+func cleanRoot(ctx *naming.PathContext) string {
+	if ctx == nil || ctx.RootPath == "" {
+		return ""
+	}
+	return filepath.Clean(filepath.FromSlash(ctx.RootPath))
+}
+
 // titleDirOwns reports whether the matched supplemental directory is owned by
 // a title folder: the first non-supplemental ancestor must lie strictly inside
-// a library root and must hold media of its own — directly for movie folders,
-// or one level down for series folders whose episodes live in season
-// subfolders. A library root that is itself named like an extras dir
+// a library root and must hold media of its own or, outside movie libraries,
+// belong to a show (see walkedShowFolder). A library root that is itself named like an extras dir
 // ("/media/shorts") has its owner above the library, which owns nothing.
 func (c *extrasClassifier) titleDirOwns(supplementalDir string) bool {
 	owner := firstNonSupplementalAncestor(supplementalDir)
@@ -157,24 +204,107 @@ func (c *extrasClassifier) titleDirOwns(supplementalDir string) bool {
 	if c.dirFiles[owner] {
 		return true
 	}
-	return !librarykind.IsMovie(c.folderType) && c.dirFilesBelow[owner]
+	return !librarykind.IsMovie(c.folderType) && c.walkedShowFolder(owner)
+}
+
+// walkedShowFolder reports whether dir, inside the walk roots, belongs to a
+// show and so owns the extras folders inside it: a file within
+// showEvidenceDepth below it resolves to dir, or to a show above it, as its
+// series root (see showEvidence). A category folder such as Kids/ holds shows
+// whose episodes resolve to their own folders, so its Shorts/ or Clips/ folder
+// stays a content folder. probeOwner applies the same test from the
+// filesystem.
+func (c *extrasClassifier) walkedShowFolder(dir string) bool {
+	if owns, ok := c.showFolders[dir]; ok {
+		return owns
+	}
+	if c.sortedPaths == nil {
+		c.sortedPaths = append([]string(nil), c.walkedPaths...)
+		sort.Strings(c.sortedPaths)
+	}
+	owns := false
+	prefix := dir + string(filepath.Separator)
+	for i := sort.SearchStrings(c.sortedPaths, prefix); !owns && i < len(c.sortedPaths) && strings.HasPrefix(c.sortedPaths[i], prefix); {
+		var skip string
+		owns, skip = c.showEvidence(c.sortedPaths[i], dir)
+		if skip == "" {
+			i++
+			continue
+		}
+		// Every path below skip sorts before skip followed by the character
+		// after the separator.
+		i = sort.SearchStrings(c.sortedPaths, skip+string(filepath.Separator+1))
+	}
+	c.showFolders[dir] = owns
+	return owns
+}
+
+// showEvidence reports what file, below dir, says about dir belonging to a
+// title: the file resolves to dir as its content root, to a show folder above
+// dir (dir is a season or disc folder of that show), or to a folder inside dir
+// under dir's own title and year (a version folder, Alien (1979)/1080p/, or a
+// wrapper, Show/Show/Season 01/; not a franchise folder, Doctor Who/Doctor Who
+// (2005)/), so dir owns its extras folders. A file that resolves to a folder
+// directly inside dir under another title marks that folder as a show of its
+// own, none of whose other files can resolve to dir, so the caller can skip
+// them (skip names it); this keeps a category folder of many shows to about
+// one file per show. A file more than showEvidenceDepth path components
+// below dir, or inside one of dir's own extras folders
+// (Kids/Extras/Show S01E01.mkv resolves to Kids), says nothing.
+func (c *extrasClassifier) showEvidence(file, dir string) (owns bool, skip string) {
+	rel, err := filepath.Rel(dir, file)
+	if err != nil || strings.Count(rel, string(filepath.Separator)) >= showEvidenceDepth {
+		return false, ""
+	}
+	for _, part := range strings.Split(filepath.Dir(rel), string(filepath.Separator)) {
+		if extrasDirKinds[normalizeScannerDirLabel(part)] != "" {
+			return false, ""
+		}
+	}
+	ctx := c.pathContext(file)
+	root := cleanRoot(ctx)
+	sep := string(filepath.Separator)
+	switch {
+	case root == "":
+		return false, ""
+	case root == dir:
+		return true, ""
+	case strings.HasPrefix(dir, root+sep) && !c.rootSet[root] && pathWithinAnyRoot(root, c.libraryRoots):
+		return true, ""
+	case !strings.HasPrefix(root, dir+sep):
+		return false, ""
+	}
+	// root lies inside dir.
+	dirTitle, dirYear, _ := naming.ParseInferFolderTitleYear(filepath.Base(dir))
+	if ctx.Year == dirYear && naming.InferTitlesCoherent(ctx.Title, dirTitle) {
+		return true, ""
+	}
+	if filepath.Dir(root) == dir && strings.HasPrefix(file, root+sep) {
+		return false, root
+	}
+	return false, ""
 }
 
 // probeOwner reports from the filesystem whether owner holds media of its
-// own: directly for movie folders, or one level down for series folders. The
-// probe applies the library walk's skip and ignore rules, so it only counts
-// files a full scan would have walked.
+// own or, outside movie libraries, belongs to a show. The probe applies the
+// library walk's skip and ignore rules, so it only counts files a full scan
+// would have walked.
 func (c *extrasClassifier) probeOwner(owner string) bool {
 	if owns, ok := c.probedOwners[owner]; ok {
 		return owns
 	}
-	depth := 1
-	if !librarykind.IsMovie(c.folderType) {
-		depth = 2
-	}
 	owns := false
 	if rules, ignored, err := scanRootIgnoreRules(owner, c.libraryRoots); err == nil && !ignored {
-		owns = c.dirHoldsMedia(owner, depth, rules)
+		if librarykind.IsMovie(c.folderType) {
+			owns, _ = c.walkMedia(owner, 1, rules, func(string) (bool, string) { return true, "" })
+		} else {
+			owns, _ = c.walkMedia(owner, showEvidenceDepth, rules, func(file string) (bool, string) {
+				if filepath.Dir(file) == owner {
+					return true, ""
+				}
+				return c.showEvidence(file, owner)
+			})
+		}
 	}
 	if c.probedOwners != nil {
 		c.probedOwners[owner] = owns
@@ -182,22 +312,24 @@ func (c *extrasClassifier) probeOwner(owner string) bool {
 	return owns
 }
 
-// dirHoldsMedia is the probeFS counterpart of dirFiles/dirFilesBelow: it
-// reports whether dir holds a file the library walk (walkLogicalTree) would
-// collect within depth levels, without descending into convention-named
-// subdirectories.
-func (c *extrasClassifier) dirHoldsMedia(dir string, depth int, inherited []ignoreRules) bool {
+// walkMedia is the probeFS counterpart of the walked path list. It calls
+// visit, in name order, for each file the library walk (walkLogicalTree) would
+// collect within depth levels below dir. visit ends the walk by returning
+// stop, or abandons the rest of a folder above the file by naming it in skip.
+// walkMedia reports whether visit ended the walk, and returns a skip that
+// names dir or a folder above it so its caller can abandon that folder too.
+func (c *extrasClassifier) walkMedia(dir string, depth int, inherited []ignoreRules, visit func(file string) (stop bool, skip string)) (bool, string) {
 	mode := walkModeFor(c.folderType)
 	if isIgnoredDirectoryPath(dir) || (mode == walkModeMovie && shouldSkipMovieSupplementalDir(dir)) {
-		return false
+		return false, ""
 	}
 	entries, err := os.ReadDir(dir)
 	if err != nil {
-		return false
+		return false, ""
 	}
-	rules, skip := dirIgnoreRules(inherited, dir, dir, entries)
-	if skip {
-		return false
+	rules, ignored := dirIgnoreRules(inherited, dir, dir, entries)
+	if ignored {
+		return false, ""
 	}
 	for _, entry := range entries {
 		child := filepath.Join(dir, entry.Name())
@@ -218,20 +350,28 @@ func (c *extrasClassifier) dirHoldsMedia(dir string, depth int, inherited []igno
 			}
 		}
 		if isDir {
-			if depth > 1 && extrasDirKinds[normalizeScannerDirLabel(entry.Name())] == "" &&
-				c.dirHoldsMedia(child, depth-1, rules) {
-				return true
+			if depth > 1 {
+				if stop, skip := c.walkMedia(child, depth-1, rules, visit); stop {
+					return true, ""
+				} else if skip != "" && skip != child {
+					return false, skip
+				}
 			}
 			continue
 		}
 		if mode == walkModeMovie && shouldSkipMovieSupplementalFile(child) {
 			continue
 		}
-		if mode.acceptsPath(child) {
-			return true
+		if !mode.acceptsPath(child) {
+			continue
+		}
+		if stop, skip := visit(child); stop {
+			return true, ""
+		} else if skip != "" {
+			return false, skip
 		}
 	}
-	return false
+	return false, ""
 }
 
 // firstNonSupplementalAncestor walks up from a supplemental directory past any
diff --git a/internal/scanner/extras_late_db_test.go b/internal/scanner/extras_late_db_test.go
index b601cdbd90..0c44df054a 100644
--- a/internal/scanner/extras_late_db_test.go
+++ b/internal/scanner/extras_late_db_test.go
@@ -229,15 +229,34 @@ func TestExtrasDirSubtreeScanConvertsMisimportedExtras(t *testing.T) {
 func TestFullScanConvertsMisimportedExtrasUnderNestedOwners(t *testing.T) {
 	ctx := t.Context()
 	fx := seedLateExtrasFixture(ctx, t)
+	showDir := filepath.Join(filepath.Dir(fx.titleDir), "Heat Show (2020)")
+	seasonDir := filepath.Join(showDir, "Season 01")
+	fx.convertToShow(ctx, t, filepath.Join(seasonDir, "Heat Show S01E01.mkv"))
+
+	showExtra := filepath.Join(showDir, "Extras", "Making Of.mkv")
+	seasonTrailer := filepath.Join(seasonDir, "Trailers", "Preview.mkv")
+	showExtraID := fx.seedMisimportedExtra(ctx, t, showExtra)
+	seasonTrailerID := fx.seedMisimportedExtra(ctx, t, seasonTrailer)
+
+	scanner := NewScanner(NewFileRepository(fx.pool), "", nil, 1, false, 0)
+	if _, err := scanner.ScanFolder(ctx, fx.folder); err != nil {
+		t.Fatalf("ScanFolder: %v", err)
+	}
+
+	fx.assertExtraOfMovie(ctx, t, showExtra)
+	fx.assertExtraOfMovie(ctx, t, seasonTrailer)
+	fx.assertItemGone(ctx, t, showExtraID)
+	fx.assertItemGone(ctx, t, seasonTrailerID)
+}
+
+// convertToShow turns the fixture into a series library whose matched item is
+// a show with one scanned episode at episodePath.
+func (fx lateExtrasFixture) convertToShow(ctx context.Context, t *testing.T, episodePath string) {
+	t.Helper()
 	if _, err := fx.pool.Exec(ctx, `UPDATE media_folders SET type = 'series' WHERE id = $1`, fx.folder.ID); err != nil {
 		t.Fatalf("make series folder: %v", err)
 	}
 	fx.folder.Type = "series"
-
-	// Reuse the fixture's matched item as the show.
-	showDir := filepath.Join(filepath.Dir(fx.titleDir), "Heat Show (2020)")
-	seasonDir := filepath.Join(showDir, "Season 01")
-	episodePath := filepath.Join(seasonDir, "Heat Show S01E01.mkv")
 	writeTestFile(t, episodePath, "episode")
 	episodeID := fx.movieID + "-s01e01"
 	if _, err := fx.pool.Exec(ctx, `
@@ -270,21 +289,50 @@ func TestFullScanConvertsMisimportedExtrasUnderNestedOwners(t *testing.T) {
 	`, fx.movieID, episodeID, fx.folder.ID, episodePath, info.Size(), normalizeFileModifiedAt(info.ModTime())); err != nil {
 		t.Fatalf("seed episode file: %v", err)
 	}
+}
 
-	showExtra := filepath.Join(showDir, "Extras", "Making Of.mkv")
-	seasonTrailer := filepath.Join(seasonDir, "Trailers", "Preview.mkv")
-	showExtraID := fx.seedMisimportedExtra(ctx, t, showExtra)
-	seasonTrailerID := fx.seedMisimportedExtra(ctx, t, seasonTrailer)
+// An earlier scan made files in a show's extras folders into a series of
+// their own, named after the folder (issue #2427): an episode-numbered file in
+// other/, and a file one folder below Trailers/. The show's name carries no
+// year, so only its episode makes it a show. A full scan converts both files
+// into extras of the show and drops the stray series; so does a subtree scan
+// of other/ for its file. (With a second stray series elsewhere in the show,
+// that subtree scan defers until a full scan, the same as for a movie.)
+func TestScanConvertsStraySeriesFromShowExtrasFolders(t *testing.T) {
+	for _, scope := range []string{"library", "other"} {
+		t.Run(scope, func(t *testing.T) {
+			ctx := t.Context()
+			fx := seedLateExtrasFixture(ctx, t)
+			showDir := filepath.Join(filepath.Dir(fx.titleDir), "Glimmer Harbor")
+			fx.convertToShow(ctx, t, filepath.Join(showDir, "Season 01", "Glimmer Harbor - S01E01.mkv"))
 
-	scanner := NewScanner(NewFileRepository(fx.pool), "", nil, 1, false, 0)
-	if _, err := scanner.ScanFolder(ctx, fx.folder); err != nil {
-		t.Fatalf("ScanFolder: %v", err)
-	}
+			makingOf := filepath.Join(showDir, "other", "Glimmer Harbor - S00E01 - Making of.mkv")
+			trailer := filepath.Join(showDir, "Trailers", "1080p", "Glimmer Harbor S00E02.mkv")
+			makingOfID := fx.seedMisimportedExtra(ctx, t, makingOf)
+			trailerID := ""
+			if scope == "library" {
+				trailerID = fx.seedMisimportedExtra(ctx, t, trailer)
+			}
 
-	fx.assertExtraOfMovie(ctx, t, showExtra)
-	fx.assertExtraOfMovie(ctx, t, seasonTrailer)
-	fx.assertItemGone(ctx, t, showExtraID)
-	fx.assertItemGone(ctx, t, seasonTrailerID)
+			scanner := NewScanner(NewFileRepository(fx.pool), "", nil, 1, false, 0)
+			var err error
+			if scope == "library" {
+				_, err = scanner.ScanFolder(ctx, fx.folder)
+			} else {
+				_, err = scanner.ScanSubtree(ctx, fx.folder, filepath.Dir(makingOf))
+			}
+			if err != nil {
+				t.Fatalf("scan %s: %v", scope, err)
+			}
+
+			fx.assertExtraOfMovie(ctx, t, makingOf)
+			fx.assertItemGone(ctx, t, makingOfID)
+			if scope == "library" {
+				fx.assertExtraOfMovie(ctx, t, trailer)
+				fx.assertItemGone(ctx, t, trailerID)
+			}
+		})
+	}
 }
 
 // A sibling marked missing still counts toward a flat folder's owners: if it
diff --git a/internal/scanner/extras_test.go b/internal/scanner/extras_test.go
index a88f2f770e..6bd31e1956 100644
--- a/internal/scanner/extras_test.go
+++ b/internal/scanner/extras_test.go
@@ -273,3 +273,150 @@ func TestMovieSupplementalDirsNoLongerSkipExtras(t *testing.T) {
 		}
 	}
 }
+
+// TestSeriesExtrasFoldersBelongToTheirShow covers extras folders in a series
+// library: their files bind to the show that owns them, never found a series
+// named after the folder, and the same folder names used as category or show
+// folders keep their own series. A full scan, a subtree scan of the file's own
+// folder, and a single-file event must agree, because a file that flips
+// between extra and primary from one scan to the next churns its show.
+func TestSeriesExtrasFoldersBelongToTheirShow(t *testing.T) {
+	type want = extrasLayoutWant
+	checkExtrasLayout(t, "series", map[string]want{
+		// A show with episodes in season folders owns every extras folder in
+		// it, whatever the files are named.
+		"Glimmer Harbor/Season 01/Glimmer Harbor - S01E01.mkv":            {root: "Glimmer Harbor"},
+		"Glimmer Harbor/other/Glimmer Harbor - S00E01 - Making of.mkv":    {extra: true, kind: models.ExtraKindOther},
+		"Glimmer Harbor/other/Extras/Glimmer Harbor.S00E02.mkv":           {extra: true, kind: models.ExtraKindOther},
+		"Glimmer Harbor/Featurettes/Glimmer Harbor S00E04 Featurette.mkv": {extra: true, kind: models.ExtraKindFeaturette},
+		"Glimmer Harbor/Extras/Behind The Scenes/clip.mkv":                {extra: true, kind: models.ExtraKindBehindTheScenes},
+		"Glimmer Harbor/Trailers/1080p/Glimmer Harbor S00E05.mkv":         {extra: true, kind: models.ExtraKindTrailer},
+		"Glimmer Harbor/Season 01/Trailers/Preview.mkv":                   {extra: true, kind: models.ExtraKindTrailer},
+		// Directly under the show's own Extras/, an episode code keeps its
+		// documented meaning. Under a season's Extras/ it doesn't, so a deleted
+		// scene never becomes a second version of the real episode.
+		"Glimmer Harbor/Extras/Glimmer Harbor S00E03.mkv":                   {root: "Glimmer Harbor"},
+		"Glimmer Harbor/Season 01/Glimmer Harbor - S01E05.mkv":              {root: "Glimmer Harbor"},
+		"Glimmer Harbor/Season 01/Extras/Glimmer Harbor S01E05 Deleted.mkv": {extra: true, kind: models.ExtraKindOther},
+		// Episodes deeper than a season folder still make the show, and the
+		// season folder owns its extras too.
+		"Ironvale/Season 01/Disc 1/Ironvale - S01E01.mkv": {root: "Ironvale"},
+		"Ironvale/Season 01/Trailers/Preview.mkv":         {extra: true, kind: models.ExtraKindTrailer},
+		"Ironvale/other/Behind the camera.mkv":            {extra: true, kind: models.ExtraKindOther},
+		// A show with no episodes yet has nothing to own its trailers/. It
+		// stays a series of its own until the first episode arrives, when a
+		// scan turns the file into an extra.
+		"Emberfall (2021)/trailers/Emberfall trailer.mkv": {root: "Emberfall (2021)/trailers"},
+		// A bare Season folder (#1660) and its Specials stay with the show.
+		"Quillmere/Season/Quillmere S01E01.mkv":          {root: "Quillmere"},
+		"Quillmere/Season/Specials/Quillmere S00E01.mkv": {root: "Quillmere"},
+		// Category folders own no extras: their extras-named folders hold
+		// shows or loose episodes, which keep their own series.
+		"Kids/Bluey/Season 01/Bluey S01E01.mkv":              {root: "Kids/Bluey"},
+		"Kids/Peppa/Peppa S01E01.mkv":                        {root: "Kids/Peppa"},
+		"Kids/Shorts/Season 01/S01E01.mkv":                   {root: "Kids/Shorts"},
+		"Kids/Shorts/Specials/S00E01.mkv":                    {root: "Kids/Shorts"},
+		"Kids/Clips/Peppa Pig S01E02.mkv":                    {root: "Kids/Clips"},
+		"Kids/Other/Other.2024.S01E02.mkv":                   {root: "Kids/Other"},
+		"Documentaries/Interviews/Interviews S01E01.mkv":     {root: "Documentaries/Interviews"},
+		"Documentaries/Interviews/S01E02.mkv":                {root: "Documentaries/Interviews"},
+		"Documentaries/Interviews/The.Interviews.S01E03.mkv": {root: "Documentaries/Interviews"},
+		"other/Flat Show/pilot.mkv":                          {root: "other/Flat Show"},
+		// A loose episode makes a category look like a show, but a folder
+		// named like an extras folder with season folders inside is a show of
+		// its own.
+		"Toons/Peppa S01E01.mkv":                   {root: "Toons"},
+		"Toons/Shorts/Season 01/Shorts S01E01.mkv": {root: "Toons/Shorts"},
+		"Toons/Shorts/Specials/Shorts S00E01.mkv":  {root: "Toons/Shorts"},
+		// Season-like folders inside a show's extras still hold extras.
+		"Glimmer Harbor/Trailers/S01/Preview.mkv":                       {extra: true, kind: models.ExtraKindTrailer},
+		"Glimmer Harbor/other/Specials/Making of.mkv":                   {extra: true, kind: models.ExtraKindOther},
+		"Glimmer Harbor/Featurettes/Season 1 Featurettes/Making of.mkv": {extra: true, kind: models.ExtraKindFeaturette},
+		// A franchise folder holding shows from different years is not an
+		// extras owner, even though the shows share its title. (Root inference
+		// collapses the same-title folders into Doctor Who, as on main.)
+		"Doctor Who/Doctor Who (1963)/Season 01/Doctor Who S01E01.mkv": {root: "Doctor Who"},
+		"Doctor Who/Doctor Who (2005)/Season 01/Doctor Who S01E01.mkv": {root: "Doctor Who"},
+		"Doctor Who/Interviews/Interview S01E01.mkv":                   {root: "Doctor Who/Interviews"},
+		// A same-name wrapper folder owns its extras.
+		"Lumen/Lumen/Season 01/Lumen S01E01.mkv": {root: "Lumen"},
+		"Lumen/Trailers/teaser.mkv":              {extra: true, kind: models.ExtraKindTrailer},
+		// A category's own Extras/ folder doesn't make it a show, and neither
+		// does a year in its name.
+		"Cartoons/Extras/Peppa S01E01.mkv":                          {root: "Cartoons"},
+		"Cartoons/Shorts/Season 01/S01E01.mkv":                      {root: "Cartoons/Shorts"},
+		"Cartoons/Clips/Clip S01E02.mkv":                            {root: "Cartoons/Clips"},
+		"Christmas (2023)/Shorts/Snowfall/E01.mkv":                  {root: "Christmas (2023)/Shorts/Snowfall"},
+		"Christmas (2023)/Elf Tales/Season 01/Elf Tales S01E01.mkv": {root: "Christmas (2023)/Elf Tales"},
+		// Shows titled like extras folders or with a number.
+		"Comedy/Extras/Season 01/Extras S01E01.mkv": {root: "Comedy/Extras"},
+		"Comedy/Extras/Specials/Extras S00E01.mkv":  {root: "Comedy/Extras"},
+		"Extras/Season 01/Extras S01E01.mkv":        {root: "Extras"},
+		"Extras/Specials/Extras S00E01.mkv":         {root: "Extras"},
+		"Drama/1883/Season 01/1883 S01E01.mkv":      {root: "Drama/1883"},
+		"Drama/1883/Specials/1883 S00E01.mkv":       {root: "Drama/1883"},
+	})
+}
+
+// TestMixedLibraryVersionFolderOwnsExtras covers a movie whose file sits in a
+// version folder in a mixed library: the title folder still owns its
+// trailers, while a category's extras-named folder stays content.
+func TestMixedLibraryVersionFolderOwnsExtras(t *testing.T) {
+	type want = extrasLayoutWant
+	checkExtrasLayout(t, "mixed", map[string]want{
+		"Alien (1979)/1080p/Alien (1979).mkv":   {root: "Alien (1979)/1080p/Alien (1979)"},
+		"Alien (1979)/Trailers/trailer.mkv":     {extra: true, kind: models.ExtraKindTrailer},
+		"Kids/Bluey/Season 01/Bluey S01E01.mkv": {root: "Kids/Bluey"},
+		"Kids/Shorts/Season 01/S01E01.mkv":      {root: "Kids/Shorts"},
+	})
+}
+
+// extrasLayoutWant is the classification a layout test expects for a file.
+type extrasLayoutWant struct {
+	extra bool
+	kind  models.ExtraKind
+	root  string // content root of a primary file, relative to the library
+}
+
+// checkExtrasLayout writes layout below a fresh library folder and checks
+// each file's classification in a full scan, a subtree scan of its own
+// folder, and a single-file event, plus the root of every primary file.
+func checkExtrasLayout(t *testing.T, libraryType string, layout map[string]extrasLayoutWant) {
+	t.Helper()
+	library := filepath.Join(t.TempDir(), "library")
+	for rel := range layout {
+		writeTestFile(t, filepath.Join(library, rel), "media")
+	}
+	roots := []string{library}
+	walked := collectTestFilePaths(t, library, libraryType)
+	if len(walked) != len(layout) {
+		t.Fatalf("walked %d files, want %d", len(walked), len(layout))
+	}
+
+	primary, extras := partitionExtraPaths(walked, libraryType, roots, roots)
+	full := make(map[string]extraCandidate, len(extras))
+	for _, candidate := range extras {
+		full[candidate.Path] = candidate
+	}
+	assignments := inferRootAssignments(primary, libraryType, 1, nil, library).Assignments
+	watch := newWatchExtrasClassifier(libraryType, roots)
+	for rel, w := range layout {
+		path := filepath.Join(library, rel)
+		candidate, isExtra := full[path]
+		if isExtra != w.extra || (isExtra && candidate.Kind != w.kind) {
+			t.Errorf("full scan: %s extra=%v kind=%q, want extra=%v kind=%q", rel, isExtra, candidate.Kind, w.extra, w.kind)
+		}
+		if !w.extra {
+			if got := assignments[path].RootPath; got != filepath.Join(library, w.root) {
+				t.Errorf("full scan: %s root %q, want %q", rel, got, filepath.Join(library, w.root))
+			}
+		}
+		_, subtree := partitionExtraPaths([]string{path}, libraryType, roots, []string{filepath.Dir(path)})
+		if got := len(subtree) == 1; got != w.extra {
+			t.Errorf("subtree scan of its folder: %s extra=%v, want %v", rel, got, w.extra)
+		}
+		if _, got := watch.classify(path); got != w.extra {
+			t.Errorf("single-file scan: %s extra=%v, want %v", rel, got, w.extra)
+		}
+	}
+}
diff --git a/internal/scanner/pdf_trailer.go b/internal/scanner/pdf_trailer.go
index 819ee7bc09..6627e61cd4 100644
--- a/internal/scanner/pdf_trailer.go
+++ b/internal/scanner/pdf_trailer.go
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"io"
 	"strconv"
+	"strings"
 )
 
 var errPDFTrailer = errors.New("invalid or unsupported PDF trailer")
@@ -27,7 +28,7 @@ func pdfDocumentEncrypted(file io.ReaderAt, size int64) (bool, error) {
 		return false, errPDFTrailer
 	}
 	idx := bytes.LastIndex(tail, []byte("startxref"))
-	if idx < 0 || (idx > 0 && !bytes.ContainsRune([]byte(pdfWhitespace), rune(tail[idx-1]))) {
+	if idx < 0 || (idx > 0 && !strings.ContainsRune(pdfWhitespace, rune(tail[idx-1]))) {
 		return false, errPDFTrailer
 	}
 	p := pdfTrailerParser{data: tail[idx:]}
@@ -263,7 +264,7 @@ func pdfTrailerNumber(text string) bool {
 func (p *pdfTrailerParser) token() pdfTrailerValue {
 	for p.pos < len(p.data) {
 		b := p.data[p.pos]
-		if bytes.ContainsRune([]byte(pdfWhitespace), rune(b)) {
+		if strings.ContainsRune(pdfWhitespace, rune(b)) {
 			p.pos++
 			continue
 		}
@@ -294,7 +295,7 @@ func (p *pdfTrailerParser) token() pdfTrailerValue {
 				if b == '>' {
 					return pdfTrailerValue{kind: 's'}
 				}
-				if fromHex(b) < 0 && !bytes.ContainsRune([]byte(pdfWhitespace), rune(b)) {
+				if fromHex(b) < 0 && !strings.ContainsRune(pdfWhitespace, rune(b)) {
 					break
 				}
 			}
diff --git a/internal/scanner/probe.go b/internal/scanner/probe.go
index 8fc372b9ac..da6d447004 100644
--- a/internal/scanner/probe.go
+++ b/internal/scanner/probe.go
@@ -63,12 +63,63 @@ type ffprobeChapter struct {
 type ffprobeSideData = mediaprobe.SideData
 type ffprobeDisp = mediaprobe.Disposition
 
+// probeLimits bounds ProbeFile's ffprobe runs. Reading a file's format,
+// streams, and chapters touches its header and index, which takes seconds
+// even on network storage, so a probe still running after two minutes is
+// stalled on its storage. The packet scan reads the whole file, so it gets
+// the longer of packetsMinimum and the time to read the file at
+// packetsBytesPerSecond: 30 minutes reads a 4 GB file at 2.2 MB/s, and
+// 10 MB/s is about the rate a 4K remux plays at.
+type probeLimits struct {
+	probe                 time.Duration
+	packetsMinimum        time.Duration
+	packetsBytesPerSecond float64
+	// waitDelay bounds how long a killed ffprobe's output may stay open,
+	// which a child it started, as a wrapper script does, can hold.
+	waitDelay time.Duration
+}
+
+var defaultProbeLimits = probeLimits{
+	probe:                 2 * time.Minute,
+	packetsMinimum:        30 * time.Minute,
+	packetsBytesPerSecond: 10_000_000,
+	waitDelay:             5 * time.Second,
+}
+
+// packetScan is the deadline of a packet scan of a file of size bytes, or of
+// unknown size when size is not positive.
+func (l probeLimits) packetScan(size int64) time.Duration {
+	read := time.Duration(float64(max(size, 0)) / l.packetsBytesPerSecond * float64(time.Second))
+	return max(l.packetsMinimum, read.Round(time.Second))
+}
+
+// errProbeTimeout reports an ffprobe run killed at its deadline. It wraps
+// neither the process's exit error nor context.DeadlineExceeded:
+// IsProbeRejection must not take the kill for ffprobe refusing the file,
+// and scan loops take a context error for the end of the whole scan.
+var errProbeTimeout = errors.New("ffprobe timed out")
+
+// probeTimedOut reports whether runCtx, made from ctx with an ffprobe run's
+// deadline, expired while ctx was still live: the run was killed at its own
+// deadline, not canceled by the caller.
+func probeTimedOut(ctx, runCtx context.Context) bool {
+	return ctx.Err() == nil && errors.Is(runCtx.Err(), context.DeadlineExceeded)
+}
+
 // ProbeFile runs ffprobe on the given file and returns parsed ProbeData.
 // ffprobePath is the path to the ffprobe binary. filePath is the media file to probe.
+// A run that does not finish within its deadline is killed and fails with a
+// timeout, which IsProbeRejection does not count against the file.
 func ProbeFile(ctx context.Context, ffprobePath string, filePath string) (*ProbeData, error) {
+	return probeFileWithin(ctx, ffprobePath, filePath, defaultProbeLimits)
+}
+
+func probeFileWithin(ctx context.Context, ffprobePath string, filePath string, limits probeLimits) (*ProbeData, error) {
+	probeCtx, cancel := context.WithTimeout(ctx, limits.probe)
+	defer cancel()
 	// Errors go to stderr (kept on the *exec.ExitError) so IsProbeRejection
 	// can tell an unreadable source from damaged content; stdout stays JSON.
-	cmd := exec.CommandContext(ctx, ffprobePath,
+	cmd := exec.CommandContext(probeCtx, ffprobePath,
 		"-v", "error",
 		"-print_format", "json",
 		"-show_format",
@@ -76,10 +127,15 @@ func ProbeFile(ctx context.Context, ffprobePath string, filePath string) (*Probe
 		"-show_chapters",
 		filePath,
 	)
+	killProcessGroupOnCancel(cmd)
+	cmd.WaitDelay = limits.waitDelay
 
 	output, err := cmd.Output()
-	processmetrics.Record(processmetrics.Probe, cmd.ProcessState, err, ctx.Err())
+	processmetrics.Record(processmetrics.Probe, cmd.ProcessState, err, probeCtx.Err())
 	if err != nil {
+		if probeTimedOut(ctx, probeCtx) {
+			return nil, fmt.Errorf("%w: no result for %s within %s", errProbeTimeout, filePath, limits.probe)
+		}
 		return nil, fmt.Errorf("ffprobe failed for %s: %w", filePath, err)
 	}
 
@@ -96,9 +152,18 @@ func ProbeFile(ctx context.Context, ffprobePath string, filePath string) (*Probe
 			// track metadata that already parsed successfully: callers persist
 			// the partial probe, and the repair layer retries rows whose
 			// duration is still unknown.
-			if duration, packetErr := probeVideoPacketDuration(ctx, ffprobePath, filePath, frameRate); packetErr == nil && duration > 0 {
+			size, _ := strconv.ParseInt(raw.Format.Size, 10, 64)
+			duration, packetErr := probeVideoPacketDuration(ctx, ffprobePath, filePath, frameRate, limits.packetScan(size), limits.waitDelay)
+			if packetErr == nil && duration > 0 {
 				probe.Duration = duration
 			}
+			if errors.Is(packetErr, errProbeTimeout) {
+				slog.WarnContext(ctx, "scanner: ffprobe packet scan timed out; the duration stays unknown until a later probe",
+					"component", "scanner",
+					"path", filePath,
+					"error", packetErr,
+				)
+			}
 		}
 	}
 
@@ -652,26 +717,41 @@ func probeVideoPacketDuration(
 	ffprobePath string,
 	filePath string,
 	frameRate string,
+	timeout time.Duration,
+	waitDelay time.Duration,
 ) (int, error) {
-	cmd := exec.CommandContext(ctx, ffprobePath,
+	packetCtx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+	cmd := exec.CommandContext(packetCtx, ffprobePath,
 		"-v", "error",
 		"-select_streams", "v:0",
 		"-show_entries", "packet=pts_time",
 		"-of", "csv=p=0",
 		filePath,
 	)
+	killProcessGroupOnCancel(cmd)
+	cmd.WaitDelay = waitDelay
 	stdout, err := cmd.StdoutPipe()
 	if err != nil {
 		return 0, fmt.Errorf("opening ffprobe packet output: %w", err)
 	}
 	if err := cmd.Start(); err != nil {
-		processmetrics.Record(processmetrics.Probe, nil, err, ctx.Err())
+		processmetrics.Record(processmetrics.Probe, nil, err, packetCtx.Err())
 		return 0, fmt.Errorf("starting ffprobe packet scan: %w", err)
 	}
 
+	// WaitDelay does not reach a pipe read before Wait, so the deadline
+	// closes it too, for a child that outlives the killed ffprobe.
+	stopClose := context.AfterFunc(packetCtx, func() { _ = stdout.Close() })
 	duration := estimateVideoPacketDuration(stdout, frameRate)
+	stopClose()
 	waitErr := cmd.Wait()
-	processmetrics.Record(processmetrics.Probe, cmd.ProcessState, waitErr, ctx.Err())
+	processmetrics.Record(processmetrics.Probe, cmd.ProcessState, waitErr, packetCtx.Err())
+	// A deadline that closed the pipe may have cut the read short, so its
+	// estimate is not trusted even when ffprobe itself exited cleanly.
+	if probeTimedOut(ctx, packetCtx) {
+		return 0, fmt.Errorf("%w: packet scan of %s did not finish within %s", errProbeTimeout, filePath, timeout)
+	}
 	if err := waitErr; err != nil {
 		return 0, fmt.Errorf("ffprobe packet scan failed for %s: %w", filePath, err)
 	}
diff --git a/internal/scanner/probe_procgroup_other.go b/internal/scanner/probe_procgroup_other.go
new file mode 100644
index 0000000000..fb8f6deaff
--- /dev/null
+++ b/internal/scanner/probe_procgroup_other.go
@@ -0,0 +1,9 @@
+//go:build !unix
+
+package scanner
+
+import "os/exec"
+
+// killProcessGroupOnCancel leaves cmd's default cancellation, which kills
+// only cmd, on platforms without Unix process groups.
+func killProcessGroupOnCancel(*exec.Cmd) {}
diff --git a/internal/scanner/probe_procgroup_unix.go b/internal/scanner/probe_procgroup_unix.go
new file mode 100644
index 0000000000..1d3f37b8e0
--- /dev/null
+++ b/internal/scanner/probe_procgroup_unix.go
@@ -0,0 +1,25 @@
+//go:build unix
+
+package scanner
+
+import (
+	"errors"
+	"os"
+	"os/exec"
+	"syscall"
+)
+
+// killProcessGroupOnCancel starts cmd in a process group of its own and makes
+// the end of its context kill the whole group. Killing only cmd would leave a
+// child it started, such as the real ffprobe under a wrapper script, running
+// and still stuck after its deadline.
+func killProcessGroupOnCancel(cmd *exec.Cmd) {
+	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
+	cmd.Cancel = func() error {
+		err := syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
+		if errors.Is(err, syscall.ESRCH) {
+			return os.ErrProcessDone
+		}
+		return err
+	}
+}
diff --git a/internal/scanner/probe_procgroup_unix_test.go b/internal/scanner/probe_procgroup_unix_test.go
new file mode 100644
index 0000000000..f637a97957
--- /dev/null
+++ b/internal/scanner/probe_procgroup_unix_test.go
@@ -0,0 +1,74 @@
+//go:build unix
+
+package scanner
+
+import (
+	"context"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+)
+
+// A wrapper script's ffprobe dies with the wrapper, so stalled probes do not
+// pile up outside the scan's workers, one per scan. The deadline and a
+// canceled scan end the run through the same cancellation, which the test
+// triggers once the wrapper has started its child, so a slow start on a
+// loaded host cannot beat it.
+func TestProbeFileKillsTheWrappersChildWithIt(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	pidFile := filepath.Join(dir, "child.pid")
+	ffprobePath := filepath.Join(dir, "ffprobe")
+	writeFakeTool(t, ffprobePath, "#!/bin/sh\nsleep 20 &\necho $! > '"+pidFile+"'\nwait\n")
+
+	ctx, cancel := context.WithCancel(t.Context())
+	defer cancel()
+	done := make(chan error, 1)
+	go func() {
+		_, err := probeFileWithin(ctx, ffprobePath, filepath.Join(dir, "S01E06.mkv"), probeLimits{probe: time.Minute, waitDelay: 200 * time.Millisecond})
+		done <- err
+	}()
+	pid := waitForPID(t, pidFile)
+	cancel()
+	select {
+	case <-done:
+	case <-time.After(15 * time.Second):
+		t.Fatal("ffprobe is still running after its context ended")
+	}
+
+	// The killed child is gone once it is reaped, and a zombie until then.
+	deadline := time.Now().Add(10 * time.Second)
+	for {
+		state, err := exec.Command("ps", "-o", "stat=", "-p", strconv.Itoa(pid)).Output()
+		if err != nil || strings.HasPrefix(strings.TrimSpace(string(state)), "Z") {
+			return
+		}
+		if time.Now().After(deadline) {
+			t.Fatalf("the wrapper's child %d is still running (%s)", pid, strings.TrimSpace(string(state)))
+		}
+		time.Sleep(50 * time.Millisecond)
+	}
+}
+
+// waitForPID waits for the fake wrapper to write its child's pid to path.
+func waitForPID(t *testing.T, path string) int {
+	t.Helper()
+	deadline := time.Now().Add(15 * time.Second)
+	for {
+		if data, err := os.ReadFile(path); err == nil && strings.HasSuffix(string(data), "\n") {
+			pid, err := strconv.Atoi(strings.TrimSpace(string(data)))
+			if err != nil {
+				t.Fatalf("child pid %q: %v", data, err)
+			}
+			return pid
+		}
+		if time.Now().After(deadline) {
+			t.Fatal("the fake wrapper never started its child")
+		}
+		time.Sleep(20 * time.Millisecond)
+	}
+}
diff --git a/internal/scanner/probe_timeout_test.go b/internal/scanner/probe_timeout_test.go
new file mode 100644
index 0000000000..d2b569b43c
--- /dev/null
+++ b/internal/scanner/probe_timeout_test.go
@@ -0,0 +1,129 @@
+package scanner
+
+import (
+	"context"
+	"errors"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"testing"
+	"time"
+)
+
+// shortProbeLimits stand in for defaultProbeLimits, so a stalled fake
+// ffprobe reaches its deadline in a second, long after the fake has started
+// its sleep.
+var shortProbeLimits = probeLimits{probe: time.Second, packetsMinimum: time.Second, packetsBytesPerSecond: 1e12, waitDelay: 200 * time.Millisecond}
+
+// escapedSleep is a shell command that sleeps in a session of its own, so
+// killing the fake's process group leaves it running and holding the fake's
+// output, which only WaitDelay or a pipe close can then let go of.
+func escapedSleep(t *testing.T) string {
+	t.Helper()
+	if _, err := exec.LookPath("perl"); err != nil {
+		t.Skip("perl is needed to start a sleep outside the process group")
+	}
+	return `perl -e 'use POSIX; POSIX::setsid(); exec "sleep", "20"'`
+}
+
+// probeFinishes runs probeFileWithin in the background and fails the test if
+// it is still running long after its deadlines: without them it waits out
+// the fake ffprobe's 20-second sleep.
+func probeFinishes(t *testing.T, ffprobePath, filePath string, limits probeLimits) (*ProbeData, error) {
+	t.Helper()
+	type result struct {
+		probe *ProbeData
+		err   error
+	}
+	done := make(chan result, 1)
+	go func() {
+		probe, err := probeFileWithin(t.Context(), ffprobePath, filePath, limits)
+		done <- result{probe, err}
+	}()
+	select {
+	case r := <-done:
+		return r.probe, r.err
+	case <-time.After(15 * time.Second):
+		t.Fatal("ffprobe is still running past its deadline")
+		return nil, nil
+	}
+}
+
+// Issue #581: ffprobes stalled on their storage held every scan worker for
+// minutes. A stalled probe is now killed at its deadline, and the timeout
+// is neither a rejection, which would mark the file unreadable until it
+// changes, nor a context error, which scan loops take for the end of the
+// whole scan. The sleep runs outside the fake's process group, so it holds
+// ffprobe's output open after the kill until WaitDelay closes it.
+func TestProbeFileKillsStalledFFprobeAtItsDeadline(t *testing.T) {
+	t.Parallel()
+	ctx := t.Context()
+	media := filepath.Join(t.TempDir(), "S01E05.mkv")
+	if err := os.WriteFile(media, []byte("media"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	ffprobePath := filepath.Join(t.TempDir(), "ffprobe")
+	writeFakeTool(t, ffprobePath, "#!/bin/sh\n"+escapedSleep(t)+"\nexit 0\n")
+
+	_, err := probeFinishes(t, ffprobePath, media, shortProbeLimits)
+	if !errors.Is(err, errProbeTimeout) {
+		t.Fatalf("stalled probe = %v, want errProbeTimeout", err)
+	}
+	if errors.Is(err, context.DeadlineExceeded) || errors.Is(err, context.Canceled) {
+		t.Fatalf("stalled probe = %v, which reads as the scan's context ending", err)
+	}
+	if IsProbeRejection(ctx, media, err) {
+		t.Fatal("a probe killed at its deadline counted as ffprobe rejecting the file")
+	}
+}
+
+// A packet scan that stalls is killed at its own deadline, and the probe
+// keeps the metadata that already parsed, as after any failed packet scan.
+// The stalled scan writes nothing, so its read waits on a pipe the sleep,
+// outside the fake's process group, holds open.
+func TestProbeFileKillsStalledPacketScanAtItsDeadline(t *testing.T) {
+	t.Parallel()
+	ffprobePath := filepath.Join(t.TempDir(), "ffprobe")
+	writeFakeTool(t, ffprobePath, `#!/bin/sh
+case " $* " in
+  *" -show_format "*)
+    printf '%s\n' '{"format":{"duration":"4298357.248000","size":"1258000000"},"streams":[{"codec_type":"video","codec_name":"h264","avg_frame_rate":"30/1"}]}'
+    ;;
+  *)
+    `+escapedSleep(t)+`
+    exit 0
+    ;;
+esac
+`)
+	limits := shortProbeLimits
+	limits.probe = time.Minute
+
+	probe, err := probeFinishes(t, ffprobePath, "stalled.mkv", limits)
+	if err != nil {
+		t.Fatalf("ProbeFile() returned error: %v", err)
+	}
+	if probe.Duration != 0 || probe.CodecVideo != "h264" {
+		t.Fatalf("probe duration %d codec %q, want an unknown duration and the parsed codec", probe.Duration, probe.CodecVideo)
+	}
+	if _, err := probeVideoPacketDuration(t.Context(), ffprobePath, "stalled.mkv", "30/1", time.Second, limits.waitDelay); !errors.Is(err, errProbeTimeout) {
+		t.Fatalf("stalled packet scan = %v, want errProbeTimeout", err)
+	}
+}
+
+// A packet scan reads the whole file: a small or unsized file gets the
+// minimum, and a large one the time to read it at the floor rate.
+func TestProbeLimitsScalePacketScanWithFileSize(t *testing.T) {
+	t.Parallel()
+	for _, tc := range []struct {
+		size int64
+		want time.Duration
+	}{
+		{0, 30 * time.Minute},
+		{4_000_000_000, 30 * time.Minute},
+		{50_000_000_000, 5000 * time.Second},
+	} {
+		if got := defaultProbeLimits.packetScan(tc.size); got != tc.want {
+			t.Errorf("packetScan(%d) = %s, want %s", tc.size, got, tc.want)
+		}
+	}
+}
diff --git a/internal/scanner/scanner.go b/internal/scanner/scanner.go
index 6db13b59a3..f9ddd299fc 100644
--- a/internal/scanner/scanner.go
+++ b/internal/scanner/scanner.go
@@ -51,6 +51,14 @@ var ignoredMovieSupplementalDirNames = map[string]bool{
 	"subtitles": true,
 }
 
+// extraDirLabel and extrasDirLabel are the normalized names of an Extras/
+// folder, the one extras folder where an episode code can keep a file an
+// episode (see keepsEpisodeToken).
+const (
+	extraDirLabel  = "extra"
+	extrasDirLabel = "extras"
+)
+
 // extrasDirKinds classifies supplemental directory names (normalized via
 // normalizeScannerDirLabel) into the shared extra-kind vocabulary. The set
 // mirrors the Jellyfin/Plex extras folder convention ("other" included: both
@@ -60,11 +68,11 @@ var ignoredMovieSupplementalDirNames = map[string]bool{
 // Convention labels can also appear as content-scope folder names ("movies/
 // other/<Movie>/<file>", "movies/shorts/..."); those never classify as extras
 // because extrasClassifier only honors a convention-named dir owned by a
-// title folder — one that holds media of its own, which library roots and
-// organizational folders do not.
+// title folder — one that holds media of its own or belongs to a show, which
+// library roots and organizational folders do not.
 var extrasDirKinds = map[string]models.ExtraKind{
-	"extra":             models.ExtraKindOther,
-	"extras":            models.ExtraKindOther,
+	extraDirLabel:       models.ExtraKindOther,
+	extrasDirLabel:      models.ExtraKindOther,
 	"other":             models.ExtraKindOther,
 	"featurette":        models.ExtraKindFeaturette,
 	"featurettes":       models.ExtraKindFeaturette,
@@ -984,9 +992,6 @@ func (s *Scanner) scanPaths(
 		Unchanged:       result.Unchanged,
 		Errors:          result.Errors,
 	})
-	if walkErr != nil {
-		return nil, walkErr
-	}
 
 	// If the scan was cancelled, return partial results without marking
 	// files as missing or deleting records — that would corrupt state.
@@ -2901,6 +2906,10 @@ func (s *Scanner) watchFolderContext(ctx context.Context, folderID int) (context
 				return
 			case <-ticker.C:
 				enabled, err := s.folderEnabledState(watchCtx, folderID)
+				if watchCtx.Err() != nil {
+					// The scan finished while the check ran.
+					return
+				}
 				if err != nil {
 					slog.WarnContext(ctx, "scanner: failed to refresh folder state", "component", "scanner", "folder_id", folderID, "error", err)
 					continue
@@ -3196,22 +3205,7 @@ func (s *Scanner) processFile(
 		mf.SubtitleTracks = []models.SubtitleTrack{}
 	}
 
-	// Convert external subtitles to model type.
-	modelExternalSubs := make([]models.ExternalSubtitle, len(externalSubs))
-	for i, es := range externalSubs {
-		modelExternalSubs[i] = models.ExternalSubtitle{
-			Path:     es.Path,
-			Language: es.Language,
-			Format:   es.Format,
-			Title:    es.Title,
-			Forced:   es.Forced,
-		}
-	}
-	mf.ExternalSubtitles = modelExternalSubs
-
-	if mf.ExternalSubtitles == nil {
-		mf.ExternalSubtitles = []models.ExternalSubtitle{}
-	}
+	mf.ExternalSubtitles = externalSubtitleModels(externalSubs)
 
 	// Upsert into DB.
 	upserted, upsertErr := s.fileRepo.Upsert(ctx, mf)
@@ -3602,7 +3596,7 @@ func externalSubtitleModels(externalSubs []ExternalSubtitleInfo) []models.Extern
 	for i, es := range externalSubs {
 		result[i] = models.ExternalSubtitle{
 			Path: es.Path, Language: es.Language, Format: es.Format,
-			Title: es.Title, Forced: es.Forced,
+			Title: es.Title, Forced: es.Forced, HearingImpaired: es.HearingImpaired,
 		}
 	}
 	return result
diff --git a/internal/scanner/subtitles.go b/internal/scanner/subtitles.go
index 37ec836950..dbfb07c790 100644
--- a/internal/scanner/subtitles.go
+++ b/internal/scanner/subtitles.go
@@ -7,7 +7,7 @@ import (
 	"strings"
 	"sync"
 
-	"github.com/prairie-server/prairie-server/internal/lang"
+	"github.com/prairie-server/prairie-server/internal/naming"
 )
 
 // subtitleExtensions lists the recognized external subtitle file extensions.
@@ -74,10 +74,13 @@ func (c *externalSubtitleDirCache) Detect(mediaFilePath string) ([]ExternalSubti
 // Naming conventions:
 //
 //	Movie.srt             -> no language
-//	Movie.eng.srt         -> language: "eng"
-//	Movie.en.srt          -> language: "en"
+//	Movie.eng.srt         -> language: "en"
 //	Movie.en.forced.srt   -> language: "en", forced: true
-//	Movie.forced.eng.srt  -> language: "eng", forced: true
+//	Movie.forced.eng.srt  -> language: "en", forced: true
+//	Movie.sdh.en.srt      -> language: "en", hearing impaired: true
+//	Movie.ai.hr.srt       -> language: "hr"
+//	Movie.hi.srt          -> language: "hi" (Hindi)
+//	Movie.en.hi.srt       -> language: "en", hearing impaired: true
 func DetectExternalSubtitles(mediaFilePath string) ([]ExternalSubtitleInfo, error) {
 	dir := filepath.Dir(mediaFilePath)
 
@@ -120,17 +123,8 @@ func externalSubtitlesFromCandidates(mediaFilePath string, candidates []external
 	var results []ExternalSubtitleInfo
 
 	for _, candidate := range candidates {
-		// Check that the subtitle file starts with the media basename
-		// followed by either a dot separator or nothing (exact match).
-		nameWithoutExt := candidate.base
-		if !strings.HasPrefix(nameWithoutExt, mediaBase) {
-			continue
-		}
-
-		// The suffix after the base name must be empty or start with a dot.
-		// This prevents "MovieExtra.srt" from matching "Movie.mkv".
-		suffix := nameWithoutExt[len(mediaBase):]
-		if suffix != "" && !strings.HasPrefix(suffix, ".") {
+		suffix, ok := naming.SubtitleSuffix(mediaBase, candidate.base)
+		if !ok {
 			continue
 		}
 
@@ -148,45 +142,14 @@ func externalSubtitlesFromCandidates(mediaFilePath string, candidates []external
 	return results
 }
 
-// parseSuffix extracts the language and forced flag from the suffix portion
-// of a subtitle filename. The suffix is the part between the media basename
-// and the subtitle extension, e.g. ".en.forced" or ".forced.eng" or ".eng".
+// parseSuffix reads the language and flags from the suffix portion of a
+// subtitle filename: the part between the media basename and the subtitle
+// extension, e.g. ".en.forced" or ".sdh.eng".
 func parseSuffix(suffix string, info *ExternalSubtitleInfo) {
-	if suffix == "" {
-		return
-	}
-
-	// Split on dots, filtering out empty parts.
-	parts := splitDots(suffix)
-	if len(parts) == 0 {
-		return
-	}
-
-	// Identify forced flag and language from the parts.
-	// Valid patterns:
-	//   [lang]
-	//   [lang, "forced"]
-	//   ["forced", lang]
-	for _, p := range parts {
-		lower := strings.ToLower(p)
-		if lower == "forced" {
-			info.Forced = true
-		} else if info.Language == "" {
-			info.Language = lang.CompatibleTag(p)
-		}
-	}
-}
-
-// splitDots splits a string on '.' and returns non-empty parts.
-func splitDots(s string) []string {
-	raw := strings.Split(s, ".")
-	var parts []string
-	for _, p := range raw {
-		if p != "" {
-			parts = append(parts, p)
-		}
-	}
-	return parts
+	tags := naming.ParseSubtitleSuffix(suffix)
+	info.Language = tags.Language
+	info.Forced = tags.Forced
+	info.HearingImpaired = tags.HearingImpaired
 }
 
 // stripExtension removes the file extension from a filename.
diff --git a/internal/scanner/subtitles_test.go b/internal/scanner/subtitles_test.go
index 4135b5f239..b6edc34e1a 100644
--- a/internal/scanner/subtitles_test.go
+++ b/internal/scanner/subtitles_test.go
@@ -87,3 +87,73 @@ func TestParseSuffixCanonicalizesCompatibleLanguageTags(t *testing.T) {
 		})
 	}
 }
+
+func TestParseSuffixReadsLanguageAndFlagsInAnyPosition(t *testing.T) {
+	tests := []struct {
+		suffix          string
+		language        string
+		forced, hearing bool
+	}{
+		{".en", "en", false, false},
+		{".en.sdh", "en", false, true},
+		{".sdh.en", "en", false, true},
+		{".EN.SDH", "en", false, true},
+		{".en.cc", "en", false, true},
+		{".cc.en", "en", false, true},
+		{".sdh", "", false, true},
+		{".ai.hr", "hr", false, false},
+		{".hr.ai", "hr", false, false},
+		{".forced.sdh.eng", "en", true, true},
+		{".en.forced.sdh", "en", true, true},
+		{".default.en", "en", false, false},
+		{".ai", "", false, false},
+		{".jp", "", false, false},
+		// The first language word wins.
+		{".en.de", "en", false, false},
+		{".pt.br", "pt", false, false},
+		// Many short words are also ISO 639-3 codes, so a language with a
+		// two-letter code wins over one that has only a three-letter code.
+		{".sub.en", "en", false, false},
+		{".dub.en", "en", false, false},
+		{".mkv.en.sdh", "en", false, true},
+		{".und.en", "en", false, false},
+		{".yue", "yue", false, false},
+		{".fil.forced", "fil", true, false},
+		// "tl" is a two-letter code that canonicalizes to "fil".
+		{".tl.en", "fil", false, false},
+		{".tl.hi", "fil", false, true},
+		// "hi" is Hindi only when no other word names a language.
+		{".hi", "hi", false, false},
+		{".HI", "hi", false, false},
+		{".hi.forced", "hi", true, false},
+		{".hi.sdh", "hi", false, true},
+		{".en.hi", "en", false, true},
+		{".hi.en", "en", false, true},
+		{".hin.hi", "hi", false, true},
+		{".hi.hi", "hi", false, true},
+		{".hi.dub", "hi", false, false},
+	}
+	for _, tc := range tests {
+		t.Run(tc.suffix, func(t *testing.T) {
+			var got ExternalSubtitleInfo
+			parseSuffix(tc.suffix, &got)
+			if got.Language != tc.language || got.Forced != tc.forced || got.HearingImpaired != tc.hearing {
+				t.Fatalf("parseSuffix(%q) = language %q, forced %v, hearing impaired %v; want %q, %v, %v",
+					tc.suffix, got.Language, got.Forced, got.HearingImpaired, tc.language, tc.forced, tc.hearing)
+			}
+		})
+	}
+}
+
+func TestExternalSubtitleModelsCarryHearingImpaired(t *testing.T) {
+	got := externalSubtitleModels([]ExternalSubtitleInfo{
+		{Path: "/m/Movie.en.sdh.srt", Language: "en", Format: "srt", Title: "Movie.en.sdh.srt", HearingImpaired: true},
+		{Path: "/m/Movie.en.srt", Language: "en", Format: "srt", Title: "Movie.en.srt"},
+	})
+	if len(got) != 2 || !got[0].HearingImpaired || got[1].HearingImpaired {
+		t.Fatalf("externalSubtitleModels = %#v, want only the SDH sidecar hearing impaired", got)
+	}
+	if empty := externalSubtitleModels(nil); empty == nil || len(empty) != 0 {
+		t.Fatalf("externalSubtitleModels(nil) = %#v, want an empty non-nil slice", empty)
+	}
+}
diff --git a/internal/scanner/types.go b/internal/scanner/types.go
index d0a92f6ff7..a07cc0b9dd 100644
--- a/internal/scanner/types.go
+++ b/internal/scanner/types.go
@@ -132,11 +132,12 @@ type SubtitleTrackInfo struct {
 
 // ExternalSubtitleInfo describes a discovered sidecar subtitle file.
 type ExternalSubtitleInfo struct {
-	Path     string
-	Language string
-	Format   string // srt, vtt, ass, ssa, sub
-	Title    string
-	Forced   bool
+	Path            string
+	Language        string
+	Format          string // srt, vtt, ass, ssa, sub
+	Title           string
+	Forced          bool
+	HearingImpaired bool
 }
 
 // ChapterInfo describes an embedded chapter extracted from ffprobe.
diff --git a/internal/scanner/variant_file_repo.go b/internal/scanner/variant_file_repo.go
new file mode 100644
index 0000000000..d284950116
--- /dev/null
+++ b/internal/scanner/variant_file_repo.go
@@ -0,0 +1,237 @@
+package scanner
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/jackc/pgx/v5"
+
+	"github.com/prairie-server/prairie-server/internal/pathscope"
+)
+
+// VariantFile is the narrow media_files projection that variant finalization
+// reads and writes: the row identity, its owner, its path and the edition,
+// presentation and multi-episode columns derived from that path. It has no
+// probe, track, chapter or identity fields on purpose, so a finalization row
+// can never reach Upsert and blank the columns it does not carry.
+type VariantFile struct {
+	ID                    int
+	ContentID             string
+	EpisodeID             string
+	FilePath              string
+	EditionRaw            string
+	EditionKey            string
+	EditionConfidence     *float64
+	EditionSource         string
+	PresentationKind      string
+	PresentationGroupKey  string
+	PresentationPartIndex int
+	PresentationPartTotal int
+	MultiEpisodeStart     int
+	MultiEpisodeEnd       int
+}
+
+const variantFileColumns = `id, content_id, episode_id, file_path,
+	edition_raw, edition_key, edition_confidence, edition_source,
+	presentation_kind, presentation_group_key, presentation_part_index, presentation_part_total,
+	multi_episode_start, multi_episode_end`
+
+const (
+	// variantOwnerLookupChunk caps the owner ids sent in one query.
+	variantOwnerLookupChunk = 5000
+	// variantUpdateChunk caps the rows written by one UPDATE statement.
+	variantUpdateChunk = 1000
+)
+
+// ListVariantFilesByPathPrefix returns the present files of a media folder at
+// or under pathPrefix in the narrow variant projection. The range form of the
+// path predicate keeps the folder/path index usable under a generic plan.
+func (r *FileRepository) ListVariantFilesByPathPrefix(ctx context.Context, folderID int, pathPrefix string) ([]VariantFile, error) {
+	clauses, clauseArgs := pathscope.RangeCoverageClauses("file_path", []string{pathPrefix}, 2)
+	query := `SELECT ` + variantFileColumns + ` FROM media_files
+		WHERE media_folder_id = $1
+		  AND missing_since IS NULL
+		  AND ` + clauses[0]
+	args := append([]any{folderID}, clauseArgs...)
+	rows, err := r.pool.Query(ctx, query, args...)
+	if err != nil {
+		return nil, fmt.Errorf("querying variant files by path prefix: %w", err)
+	}
+	return scanVariantFiles(rows)
+}
+
+// VariantOwners names owners whose files variant finalization reads: every
+// file of an owner in Whole, and only the files stored as a part of a split
+// movie or episode for the other owners in IDs.
+type VariantOwners struct {
+	IDs   []string
+	Whole map[string]struct{}
+}
+
+// ListVariantFilesByOwners returns the present files of a media folder that
+// the given episode owners, or content owners without an episode link (the
+// owner rule stableOwnerKey applies), say to read. Ids are queried in chunks
+// and the result is deduplicated by file id.
+func (r *FileRepository) ListVariantFilesByOwners(ctx context.Context, folderID int, episodes, contents VariantOwners) ([]VariantFile, error) {
+	var files []VariantFile
+	seen := make(map[int]struct{})
+	lookup := func(ownerColumn, predicate string, owners VariantOwners) error {
+		for start := 0; start < len(owners.IDs); start += variantOwnerLookupChunk {
+			chunk := owners.IDs[start:min(start+variantOwnerLookupChunk, len(owners.IDs))]
+			whole := []string{}
+			for _, id := range chunk {
+				if _, ok := owners.Whole[id]; ok {
+					whole = append(whole, id)
+				}
+			}
+			rows, err := r.pool.Query(ctx, `SELECT `+variantFileColumns+` FROM media_files
+				WHERE media_folder_id = $1
+				  AND missing_since IS NULL
+				  AND `+predicate+`
+				  AND (`+ownerColumn+` = ANY($3::text[])
+					OR presentation_part_index IS NOT NULL
+					OR presentation_part_total IS NOT NULL)`, folderID, chunk, whole)
+			if err != nil {
+				return fmt.Errorf("querying variant files by owner: %w", err)
+			}
+			found, err := scanVariantFiles(rows)
+			if err != nil {
+				return err
+			}
+			for _, file := range found {
+				if _, ok := seen[file.ID]; ok {
+					continue
+				}
+				seen[file.ID] = struct{}{}
+				files = append(files, file)
+			}
+		}
+		return nil
+	}
+	if err := lookup("episode_id", `episode_id = ANY($2::text[])`, episodes); err != nil {
+		return nil, err
+	}
+	if err := lookup("content_id", `episode_id IS NULL AND content_id = ANY($2::text[])`, contents); err != nil {
+		return nil, err
+	}
+	return files, nil
+}
+
+// UpdateVariantMetadata writes only the edition, presentation and
+// multi-episode columns (and updated_at) of the given files, in batches. A row
+// is skipped when it has gone missing or moved to another path since it was
+// loaded, or already holds these values. Returns the number of rows changed.
+func (r *FileRepository) UpdateVariantMetadata(ctx context.Context, folderID int, files []VariantFile) (int, error) {
+	updated := 0
+	for start := 0; start < len(files); start += variantUpdateChunk {
+		chunk := files[start:min(start+variantUpdateChunk, len(files))]
+		ids := make([]int64, len(chunk))
+		paths := make([]string, len(chunk))
+		editionRaw := make([]string, len(chunk))
+		editionKey := make([]string, len(chunk))
+		editionConfidence := make([]*float64, len(chunk))
+		editionSource := make([]string, len(chunk))
+		presentationKind := make([]string, len(chunk))
+		presentationGroupKey := make([]string, len(chunk))
+		partIndex := make([]*int, len(chunk))
+		partTotal := make([]*int, len(chunk))
+		multiStart := make([]*int, len(chunk))
+		multiEnd := make([]*int, len(chunk))
+		for i, file := range chunk {
+			ids[i] = int64(file.ID)
+			paths[i] = file.FilePath
+			editionRaw[i] = file.EditionRaw
+			editionKey[i] = file.EditionKey
+			editionConfidence[i] = file.EditionConfidence
+			editionSource[i] = file.EditionSource
+			presentationKind[i] = file.PresentationKind
+			presentationGroupKey[i] = file.PresentationGroupKey
+			partIndex[i] = nilIfZero(file.PresentationPartIndex)
+			partTotal[i] = nilIfZero(file.PresentationPartTotal)
+			multiStart[i] = nilIfZero(file.MultiEpisodeStart)
+			multiEnd[i] = nilIfZero(file.MultiEpisodeEnd)
+		}
+		tag, err := r.pool.Exec(ctx, `
+			UPDATE media_files AS mf SET
+				edition_raw = u.edition_raw,
+				edition_key = u.edition_key,
+				edition_confidence = u.edition_confidence,
+				edition_source = u.edition_source,
+				presentation_kind = u.presentation_kind,
+				presentation_group_key = u.presentation_group_key,
+				presentation_part_index = u.presentation_part_index,
+				presentation_part_total = u.presentation_part_total,
+				multi_episode_start = u.multi_episode_start,
+				multi_episode_end = u.multi_episode_end,
+				updated_at = NOW()
+			FROM unnest(
+				$2::bigint[], $3::text[], $4::text[], $5::text[], $6::double precision[], $7::text[],
+				$8::text[], $9::text[], $10::integer[], $11::integer[], $12::integer[], $13::integer[]
+			) AS u(id, file_path, edition_raw, edition_key, edition_confidence, edition_source,
+				presentation_kind, presentation_group_key, presentation_part_index, presentation_part_total,
+				multi_episode_start, multi_episode_end)
+			WHERE mf.id = u.id
+			  AND mf.media_folder_id = $1
+			  AND mf.file_path = u.file_path
+			  AND mf.missing_since IS NULL
+			  AND (mf.edition_raw, mf.edition_key, mf.edition_confidence, mf.edition_source,
+				mf.presentation_kind, mf.presentation_group_key, mf.presentation_part_index, mf.presentation_part_total,
+				mf.multi_episode_start, mf.multi_episode_end)
+				IS DISTINCT FROM
+				(u.edition_raw, u.edition_key, u.edition_confidence, u.edition_source,
+				u.presentation_kind, u.presentation_group_key, u.presentation_part_index, u.presentation_part_total,
+				u.multi_episode_start, u.multi_episode_end)`,
+			folderID, ids, paths, editionRaw, editionKey, editionConfidence, editionSource,
+			presentationKind, presentationGroupKey, partIndex, partTotal, multiStart, multiEnd)
+		if err != nil {
+			return updated, fmt.Errorf("updating variant metadata: %w", err)
+		}
+		updated += int(tag.RowsAffected())
+	}
+	return updated, nil
+}
+
+func scanVariantFiles(rows pgx.Rows) ([]VariantFile, error) {
+	defer rows.Close()
+	var files []VariantFile
+	for rows.Next() {
+		var (
+			file                                       VariantFile
+			contentID, episodeID                       *string
+			editionRaw, editionKey, editionSource      *string
+			presentationKind, presentationGroupKey     *string
+			partIndex, partTotal, multiStart, multiEnd *int
+		)
+		if err := rows.Scan(
+			&file.ID, &contentID, &episodeID, &file.FilePath,
+			&editionRaw, &editionKey, &file.EditionConfidence, &editionSource,
+			&presentationKind, &presentationGroupKey, &partIndex, &partTotal,
+			&multiStart, &multiEnd,
+		); err != nil {
+			return nil, fmt.Errorf("scanning variant file: %w", err)
+		}
+		file.ContentID = stringPtrValue(contentID)
+		file.EpisodeID = stringPtrValue(episodeID)
+		file.EditionRaw = stringPtrValue(editionRaw)
+		file.EditionKey = stringPtrValue(editionKey)
+		file.EditionSource = stringPtrValue(editionSource)
+		file.PresentationKind = stringPtrValue(presentationKind)
+		file.PresentationGroupKey = stringPtrValue(presentationGroupKey)
+		file.PresentationPartIndex = intPtrValue(partIndex)
+		file.PresentationPartTotal = intPtrValue(partTotal)
+		file.MultiEpisodeStart = intPtrValue(multiStart)
+		file.MultiEpisodeEnd = intPtrValue(multiEnd)
+		files = append(files, file)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("iterating variant files: %w", err)
+	}
+	return files, nil
+}
+
+func intPtrValue(value *int) int {
+	if value == nil {
+		return 0
+	}
+	return *value
+}
diff --git a/internal/scanner/variant_finalize.go b/internal/scanner/variant_finalize.go
index d30dc03a07..0a802af048 100644
--- a/internal/scanner/variant_finalize.go
+++ b/internal/scanner/variant_finalize.go
@@ -3,6 +3,7 @@ package scanner
 import (
 	"context"
 	"fmt"
+	"sort"
 
 	"github.com/prairie-server/prairie-server/internal/models"
 	"github.com/prairie-server/prairie-server/internal/naming"
@@ -10,6 +11,12 @@ import (
 
 // FinalizeVariantsByPathPrefix recomputes edition/presentation metadata after
 // canonical root ownership and item linkage are stable for the scanned scope.
+//
+// Every present file in the scope is re-parsed, so parser and folder changes
+// reach the whole scope. A file's part total is the only value that depends on
+// other files of the same owner, so files outside the scope are loaded only as
+// variantSiblingOwners and variantOwnersToWiden choose. Other out-of-scope
+// files are finalized when their own scope runs.
 func (s *Scanner) FinalizeVariantsByPathPrefix(
 	ctx context.Context,
 	folder *models.MediaFolder,
@@ -19,7 +26,7 @@ func (s *Scanner) FinalizeVariantsByPathPrefix(
 		return nil
 	}
 
-	scopedFiles, err := s.fileRepo.GetByFolderAndPathPrefix(ctx, folder.ID, pathPrefix)
+	scopedFiles, err := s.fileRepo.ListVariantFilesByPathPrefix(ctx, folder.ID, pathPrefix)
 	if err != nil {
 		return fmt.Errorf("loading files for variant finalization: %w", err)
 	}
@@ -27,38 +34,185 @@ func (s *Scanner) FinalizeVariantsByPathPrefix(
 		return nil
 	}
 
-	files, err := s.variantFinalizationFilesForScope(ctx, folder.ID, scopedFiles)
+	candidates, err := s.variantFinalizationCandidates(ctx, folder, scopedFiles)
 	if err != nil {
 		return err
 	}
-	if len(files) == 0 {
+	updates := variantMetadataUpdates(candidates)
+	if len(updates) == 0 {
 		return nil
 	}
+	if _, err := s.fileRepo.UpdateVariantMetadata(ctx, folder.ID, updates); err != nil {
+		return fmt.Errorf("finalizing variant metadata for %d files under %s: %w", len(updates), pathPrefix, err)
+	}
+	return nil
+}
+
+// variantCandidate is one file variant finalization considers, with its owner
+// and the hints parsed from its path once.
+type variantCandidate struct {
+	file     VariantFile
+	ownerKey string
+	hints    *naming.VariantHints
+}
+
+func newVariantCandidates(files []VariantFile, folder *models.MediaFolder) []variantCandidate {
+	candidates := make([]variantCandidate, 0, len(files))
+	for i := range files {
+		hints := variantHintsForFile(&files[i], folder)
+		if hints == nil {
+			hints = &naming.VariantHints{}
+		}
+		candidates = append(candidates, variantCandidate{
+			file:     files[i],
+			ownerKey: stableOwnerKey(files[i].EpisodeID, files[i].ContentID),
+			hints:    hints,
+		})
+	}
+	return candidates
+}
+
+func (s *Scanner) variantFinalizationCandidates(
+	ctx context.Context,
+	folder *models.MediaFolder,
+	scopedFiles []VariantFile,
+) ([]variantCandidate, error) {
+	candidates := newVariantCandidates(scopedFiles, folder)
+	loaded := make(map[int]struct{}, len(candidates))
+	for _, candidate := range candidates {
+		loaded[candidate.file.ID] = struct{}{}
+	}
 
-	partTotals := variantPartTotals(files, folder)
-	for _, file := range files {
-		if file == nil || file.MissingSince != nil {
+	episodes, contents := variantSiblingOwners(candidates)
+	found, err := s.loadVariantCandidates(ctx, folder, episodes, contents, loaded)
+	if err != nil {
+		return nil, err
+	}
+	candidates = append(candidates, found...)
+
+	episodes, contents = variantOwnersToWiden(found, episodes, contents)
+	more, err := s.loadVariantCandidates(ctx, folder, episodes, contents, loaded)
+	if err != nil {
+		return nil, err
+	}
+	return append(candidates, more...), nil
+}
+
+// loadVariantCandidates reads the files the owners name and returns those not
+// loaded yet, marking them loaded.
+func (s *Scanner) loadVariantCandidates(
+	ctx context.Context,
+	folder *models.MediaFolder,
+	episodes, contents VariantOwners,
+	loaded map[int]struct{},
+) ([]variantCandidate, error) {
+	if len(episodes.IDs) == 0 && len(contents.IDs) == 0 {
+		return nil, nil
+	}
+	related, err := s.fileRepo.ListVariantFilesByOwners(ctx, folder.ID, episodes, contents)
+	if err != nil {
+		return nil, fmt.Errorf("loading related files for variant finalization: %w", err)
+	}
+	var files []VariantFile
+	for _, file := range related {
+		if _, ok := loaded[file.ID]; !ok {
+			loaded[file.ID] = struct{}{}
+			files = append(files, file)
+		}
+	}
+	return newVariantCandidates(files, folder), nil
+}
+
+// variantSiblingOwners returns the owners of the in-scope files, episode
+// owners apart from content owners without an episode link. Every file of an
+// owner is read when one of its in-scope files is in a multipart group, under
+// its new hints, its stored values or a stored part total. For the other owners
+// only their files stored as parts are read: when a part leaves its group, for
+// example by a rename, the parts left behind need a new total even though
+// nothing in the scope is a part any more.
+func variantSiblingOwners(candidates []variantCandidate) (episodes, contents VariantOwners) {
+	episodeIDs := make(map[string]struct{})
+	contentIDs := make(map[string]struct{})
+	episodes.Whole = make(map[string]struct{})
+	contents.Whole = make(map[string]struct{})
+	for _, candidate := range candidates {
+		if candidate.ownerKey == "" {
 			continue
 		}
-		ownerKey := stableOwnerKey(file)
-		if ownerKey == "" {
+		ids, whole, id := episodeIDs, episodes.Whole, candidate.file.EpisodeID
+		if id == "" {
+			ids, whole, id = contentIDs, contents.Whole, candidate.file.ContentID
+		}
+		ids[id] = struct{}{}
+		if variantCandidateInPartGroup(candidate) {
+			whole[id] = struct{}{}
+		}
+	}
+	episodes.IDs = sortedVariantOwnerIDs(episodeIDs)
+	contents.IDs = sortedVariantOwnerIDs(contentIDs)
+	return episodes, contents
+}
+
+// variantOwnersToWiden returns the owners that were read only for their
+// stored parts but turned out to have a file in a multipart group, to be read
+// in full. The rest of that group can be stored without part columns, as after
+// a parser change, and the group's total needs every part.
+func variantOwnersToWiden(found []variantCandidate, episodes, contents VariantOwners) (widerEpisodes, widerContents VariantOwners) {
+	episodeIDs := make(map[string]struct{})
+	contentIDs := make(map[string]struct{})
+	for _, candidate := range found {
+		if candidate.ownerKey == "" || !variantCandidateInPartGroup(candidate) {
 			continue
 		}
+		ids, whole, id := episodeIDs, episodes.Whole, candidate.file.EpisodeID
+		if id == "" {
+			ids, whole, id = contentIDs, contents.Whole, candidate.file.ContentID
+		}
+		if _, ok := whole[id]; !ok {
+			ids[id] = struct{}{}
+		}
+	}
+	widerEpisodes = VariantOwners{IDs: sortedVariantOwnerIDs(episodeIDs), Whole: episodeIDs}
+	widerContents = VariantOwners{IDs: sortedVariantOwnerIDs(contentIDs), Whole: contentIDs}
+	return widerEpisodes, widerContents
+}
 
-		hints := variantHintsForFile(file, folder)
-		if hints == nil {
-			hints = &naming.VariantHints{}
+func variantCandidateInPartGroup(candidate variantCandidate) bool {
+	if _, ok := variantPartGroupKey(candidate.ownerKey, candidate.hints); ok {
+		return true
+	}
+	stored := &naming.VariantHints{
+		EditionKey:            candidate.file.EditionKey,
+		PresentationKind:      candidate.file.PresentationKind,
+		PresentationGroupKey:  candidate.file.PresentationGroupKey,
+		PresentationPartIndex: candidate.file.PresentationPartIndex,
+	}
+	if _, ok := variantPartGroupKey(candidate.ownerKey, stored); ok {
+		return true
+	}
+	return candidate.file.PresentationPartTotal > 0
+}
+
+// variantMetadataUpdates returns, in id order, the files whose stored variant
+// metadata differs from their parsed hints and part totals, carrying the new
+// values. Files without an owner are left as they are.
+func variantMetadataUpdates(candidates []variantCandidate) []VariantFile {
+	partTotals := variantPartTotals(candidates)
+	var updates []VariantFile
+	for _, candidate := range candidates {
+		if candidate.ownerKey == "" {
+			continue
 		}
+		hints := candidate.hints
 		partTotal := 0
-		if groupKey, ok := variantPartGroupKey(ownerKey, hints); ok {
+		if groupKey, ok := variantPartGroupKey(candidate.ownerKey, hints); ok {
 			partTotal = partTotals[groupKey]
 		}
-
-		if !variantMetadataChanged(file, hints, partTotal) {
+		if !variantMetadataChanged(&candidate.file, hints, partTotal) {
 			continue
 		}
 
-		updated := *file
+		updated := candidate.file
 		updated.EditionRaw = hints.EditionRaw
 		updated.EditionKey = hints.EditionKey
 		updated.EditionConfidence = hints.EditionConfidence
@@ -69,40 +223,27 @@ func (s *Scanner) FinalizeVariantsByPathPrefix(
 		updated.PresentationPartTotal = partTotal
 		updated.MultiEpisodeStart = hints.MultiEpisodeStart
 		updated.MultiEpisodeEnd = hints.MultiEpisodeEnd
-		if _, err := s.fileRepo.Upsert(ctx, updated); err != nil {
-			return fmt.Errorf("finalizing variant metadata for %s: %w", file.FilePath, err)
-		}
+		updates = append(updates, updated)
 	}
-
-	return nil
+	sort.Slice(updates, func(i, j int) bool { return updates[i].ID < updates[j].ID })
+	return updates
 }
 
 // variantPartTotals returns the part count for each group of files that are
 // parts of one split movie or episode. A group needs at least two distinct part
 // numbers: a lone "Part 2" file is a whole episode or movie with the part in
 // its title, such as "Resurrection Ship, Part 2" or "Mockingjay - Part 2".
-func variantPartTotals(files []*models.MediaFile, folder *models.MediaFolder) map[string]int {
+func variantPartTotals(candidates []variantCandidate) map[string]int {
 	partsByGroup := make(map[string]map[int]struct{})
-	for _, file := range files {
-		if file == nil || file.MissingSince != nil {
-			continue
-		}
-		ownerKey := stableOwnerKey(file)
-		if ownerKey == "" {
-			continue
-		}
-		hints := variantHintsForFile(file, folder)
-		if hints == nil {
-			continue
-		}
-		groupKey, ok := variantPartGroupKey(ownerKey, hints)
+	for _, candidate := range candidates {
+		groupKey, ok := variantPartGroupKey(candidate.ownerKey, candidate.hints)
 		if !ok {
 			continue
 		}
 		if partsByGroup[groupKey] == nil {
 			partsByGroup[groupKey] = make(map[int]struct{})
 		}
-		partsByGroup[groupKey][hints.PresentationPartIndex] = struct{}{}
+		partsByGroup[groupKey][candidate.hints.PresentationPartIndex] = struct{}{}
 	}
 
 	totals := make(map[string]int, len(partsByGroup))
@@ -129,7 +270,7 @@ func variantPartGroupKey(ownerKey string, hints *naming.VariantHints) (string, b
 // rather than parsed from the filename; scans keep them as they are.
 const editionSourceImport = "import"
 
-func variantHintsForFile(file *models.MediaFile, folder *models.MediaFolder) *naming.VariantHints {
+func variantHintsForFile(file *VariantFile, folder *models.MediaFolder) *naming.VariantHints {
 	if file.EditionSource == editionSourceImport && file.EditionKey != "" {
 		return &naming.VariantHints{
 			EditionRaw:            file.EditionRaw,
@@ -146,67 +287,27 @@ func variantHintsForFile(file *models.MediaFile, folder *models.MediaFolder) *na
 	return naming.ParseVariantHints(file.FilePath, folder.Type, folder.Paths...)
 }
 
-func (s *Scanner) variantFinalizationFilesForScope(
-	ctx context.Context,
-	folderID int,
-	scopedFiles []*models.MediaFile,
-) ([]*models.MediaFile, error) {
-	if len(scopedFiles) == 0 {
-		return nil, nil
+func sortedVariantOwnerIDs(ids map[string]struct{}) []string {
+	result := make([]string, 0, len(ids))
+	for id := range ids {
+		result = append(result, id)
 	}
-
-	filesByID := make(map[int]*models.MediaFile, len(scopedFiles))
-	for _, file := range scopedFiles {
-		if file == nil || file.MissingSince != nil {
-			continue
-		}
-		if file.EpisodeID == "" && file.ContentID == "" {
-			if file.MediaFolderID == folderID {
-				filesByID[file.ID] = file
-			}
-			continue
-		}
-
-		var related []*models.MediaFile
-		var err error
-		switch {
-		case file.EpisodeID != "":
-			related, err = s.fileRepo.GetByEpisodeID(ctx, file.EpisodeID)
-		case file.ContentID != "":
-			related, err = s.fileRepo.GetByContentID(ctx, file.ContentID)
-		}
-		if err != nil {
-			return nil, fmt.Errorf("loading related files for variant finalization: %w", err)
-		}
-		for _, relatedFile := range related {
-			if relatedFile == nil || relatedFile.MissingSince != nil || relatedFile.MediaFolderID != folderID {
-				continue
-			}
-			filesByID[relatedFile.ID] = relatedFile
-		}
-	}
-
-	files := make([]*models.MediaFile, 0, len(filesByID))
-	for _, file := range filesByID {
-		files = append(files, file)
-	}
-	return files, nil
+	sort.Strings(result)
+	return result
 }
 
-func stableOwnerKey(file *models.MediaFile) string {
+func stableOwnerKey(episodeID, contentID string) string {
 	switch {
-	case file == nil:
-		return ""
-	case file.EpisodeID != "":
-		return "episode:" + file.EpisodeID
-	case file.ContentID != "":
-		return "content:" + file.ContentID
+	case episodeID != "":
+		return "episode:" + episodeID
+	case contentID != "":
+		return "content:" + contentID
 	default:
 		return ""
 	}
 }
 
-func variantMetadataChanged(file *models.MediaFile, hints *naming.VariantHints, partTotal int) bool {
+func variantMetadataChanged(file *VariantFile, hints *naming.VariantHints, partTotal int) bool {
 	if file == nil {
 		return false
 	}
diff --git a/internal/scanner/variant_finalize_columns_db_test.go b/internal/scanner/variant_finalize_columns_db_test.go
new file mode 100644
index 0000000000..1713b32d18
--- /dev/null
+++ b/internal/scanner/variant_finalize_columns_db_test.go
@@ -0,0 +1,249 @@
+package scanner
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/naming"
+)
+
+// variantContractMovie is a movies folder with one matched movie, for the
+// variant finalization contracts.
+type variantContractMovie struct {
+	pool     *pgxpool.Pool
+	folderID int
+	movieID  string
+	root     string
+	suffix   int64
+}
+
+func seedVariantContractMovie(t *testing.T, name string) variantContractMovie {
+	t.Helper()
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatalf("connect test database: %v", err)
+	}
+	t.Cleanup(pool.Close)
+
+	suffix := time.Now().UnixNano()
+	fx := variantContractMovie{
+		pool:    pool,
+		movieID: fmt.Sprintf("variant-finalize-%s-%d", name, suffix),
+		root:    fmt.Sprintf("/variant-finalize-%s-%d", name, suffix),
+		suffix:  suffix,
+	}
+	if err := pool.QueryRow(ctx, `INSERT INTO media_folders (type, name, enabled) VALUES ('movies', $1, true) RETURNING id`, fx.movieID).Scan(&fx.folderID); err != nil {
+		t.Fatalf("seed folder: %v", err)
+	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM media_folders WHERE id = $1`, fx.folderID)
+		_, _ = pool.Exec(context.Background(), `DELETE FROM media_items WHERE content_id = $1`, fx.movieID)
+	})
+	if _, err := pool.Exec(ctx, `
+		INSERT INTO media_items (content_id, type, title, status, genres)
+		VALUES ($1, 'movie', 'Variant Contract', 'matched', '{}'::text[])`, fx.movieID); err != nil {
+		t.Fatalf("seed movie: %v", err)
+	}
+	return fx
+}
+
+func (fx variantContractMovie) finalize(t *testing.T, scope string) {
+	t.Helper()
+	folder := &models.MediaFolder{ID: fx.folderID, Type: "movies", Paths: []string{fx.root}}
+	scan := &Scanner{fileRepo: NewFileRepository(fx.pool)}
+	if err := scan.FinalizeVariantsByPathPrefix(context.Background(), folder, scope); err != nil {
+		t.Fatalf("finalize %s: %v", scope, err)
+	}
+}
+
+// Variant finalization writes the edition, presentation and multi-episode
+// columns and nothing else. A file the backlog suppressed while it was
+// unmatched keeps match_suppressed_at after the matcher links it, and that
+// suppression, the file's probe and chapter data and a missing sibling's
+// missing_since all survive a finalization that rewrites its edition.
+func TestFinalizeVariantsKeepsMatchSuppressionDB(t *testing.T) {
+	fx := seedVariantContractMovie(t, "columns")
+	ctx := context.Background()
+	pool, folderID, movieID, root, suffix := fx.pool, fx.folderID, fx.movieID, fx.root, fx.suffix
+
+	// The cut's file has an id past the int4 range and no stored edition yet.
+	cutID := int(3_000_000_000 + suffix%100_000_000)
+	cutPath := root + "/Columns (2010)/Columns.2010.Directors.Cut.1080p.mkv"
+	if _, err := pool.Exec(ctx, `
+		INSERT INTO media_files (id, media_folder_id, file_path, file_size, file_hash, video_tracks, chapters, updated_at)
+		VALUES ($1, $2, $3, 1024, 'hash-cut',
+			'[{"codec": "hevc", "width": 3840}]'::jsonb, '[{"start": 0, "title": "Opening"}]'::jsonb,
+			NOW() - interval '1 day')`, cutID, folderID, cutPath); err != nil {
+		t.Fatalf("seed cut: %v", err)
+	}
+	// A missing file of the same movie with a stale edition stays as it is.
+	var missingID int
+	if err := pool.QueryRow(ctx, `
+		INSERT INTO media_files (content_id, media_folder_id, file_path, file_size, edition_key, edition_source, missing_since, updated_at)
+		VALUES ($1, $2, $3, 1024, 'stale', 'heuristic_file', NOW(), NOW() - interval '1 day')
+		RETURNING id`, movieID, folderID, root+"/Columns (2010)/Columns.2010.Old.mkv").Scan(&missingID); err != nil {
+		t.Fatalf("seed missing file: %v", err)
+	}
+
+	repo := NewFileRepository(pool)
+	if suppressed, err := repo.SuppressUnmatchedMatchBacklogByFolder(ctx, folderID, RawMatchBacklogGeneric); err != nil || suppressed != 1 {
+		t.Fatalf("suppress unmatched backlog = %d, %v; want 1", suppressed, err)
+	}
+	if err := repo.UpdateContentID(ctx, cutID, movieID); err != nil {
+		t.Fatalf("link cut: %v", err)
+	}
+
+	type fileRow struct {
+		editionKey, chapters, videoTracks, fileHash string
+		suppressed, missing                         bool
+		updatedAt                                   time.Time
+	}
+	load := func(id int) fileRow {
+		t.Helper()
+		var row fileRow
+		if err := pool.QueryRow(ctx, `
+			SELECT COALESCE(edition_key, ''), COALESCE(chapters::text, ''), COALESCE(video_tracks::text, ''), COALESCE(file_hash, ''),
+				match_suppressed_at IS NOT NULL, missing_since IS NOT NULL, updated_at
+			FROM media_files WHERE id = $1`, id).Scan(
+			&row.editionKey, &row.chapters, &row.videoTracks, &row.fileHash,
+			&row.suppressed, &row.missing, &row.updatedAt,
+		); err != nil {
+			t.Fatalf("load file %d: %v", id, err)
+		}
+		return row
+	}
+	cutBefore, missingBefore := load(cutID), load(missingID)
+	if !cutBefore.suppressed {
+		t.Fatalf("fixture: linking the cut cleared match_suppressed_at")
+	}
+
+	fx.finalize(t, root+"/Columns (2010)")
+
+	cut := load(cutID)
+	wantEdition := naming.ParseVariantHints(cutPath, "movies", root).EditionKey
+	if wantEdition == "" {
+		t.Fatalf("fixture: %s parses no edition", cutPath)
+	}
+	if cut.editionKey != wantEdition {
+		t.Fatalf("cut edition = %q, want %q", cut.editionKey, wantEdition)
+	}
+	if !cut.updatedAt.After(cutBefore.updatedAt) {
+		t.Fatalf("cut updated_at not bumped")
+	}
+	if !cut.suppressed {
+		t.Fatalf("finalize cleared match_suppressed_at on the cut")
+	}
+	if cut.chapters != cutBefore.chapters || cut.videoTracks != cutBefore.videoTracks || cut.fileHash != cutBefore.fileHash {
+		t.Fatalf("finalize rewrote the cut's probe columns: before %+v after %+v", cutBefore, cut)
+	}
+	if got := load(missingID); got != missingBefore {
+		t.Fatalf("missing file changed: before %+v after %+v", missingBefore, got)
+	}
+}
+
+// When a part leaves its group, the parts left behind lose their total even
+// when the scope holds none of them. Here disc 2 of a two-disc movie is renamed:
+// its old row is missing, the new file is linked to the movie, and a file scan
+// of the new path finalizes only that path.
+func TestFinalizeVariantsRetotalsPartsLeftByARenameDB(t *testing.T) {
+	fx := seedVariantContractMovie(t, "rename")
+	ctx := context.Background()
+	dir := fx.root + "/Discs (2010)"
+	insert := func(path string) int {
+		t.Helper()
+		var id int
+		if err := fx.pool.QueryRow(ctx, `
+			INSERT INTO media_files (content_id, media_folder_id, file_path, file_size)
+			VALUES ($1, $2, $3, 1024) RETURNING id`, fx.movieID, fx.folderID, path).Scan(&id); err != nil {
+			t.Fatalf("seed %s: %v", path, err)
+		}
+		return id
+	}
+	partTotal := func(id int) int {
+		t.Helper()
+		var total int
+		if err := fx.pool.QueryRow(ctx, `SELECT COALESCE(presentation_part_total, 0) FROM media_files WHERE id = $1`, id).Scan(&total); err != nil {
+			t.Fatalf("load file %d: %v", id, err)
+		}
+		return total
+	}
+
+	discOne := insert(dir + "/Discs.2010.CD1.mkv")
+	discTwo := insert(dir + "/Discs.2010.CD2.mkv")
+	fx.finalize(t, dir)
+	if partTotal(discOne) != 2 || partTotal(discTwo) != 2 {
+		t.Fatalf("fixture: disc totals = %d and %d, want 2", partTotal(discOne), partTotal(discTwo))
+	}
+
+	if _, err := fx.pool.Exec(ctx, `UPDATE media_files SET missing_since = NOW() WHERE id = $1`, discTwo); err != nil {
+		t.Fatalf("mark disc 2 missing: %v", err)
+	}
+	renamed := dir + "/Discs.2010.1080p.mkv"
+	insert(renamed)
+	fx.finalize(t, renamed)
+
+	if got := partTotal(discOne); got != 0 {
+		t.Fatalf("disc 1 part total = %d after disc 2 left the group, want 0", got)
+	}
+}
+
+// A stored part found outside the scope can belong to a group whose other
+// files are stored without part columns, as after a parser change. The group
+// is read in full, so the stored part keeps its total and the others get one.
+func TestFinalizeVariantsReadsWholeGroupFoundOutsideTheScopeDB(t *testing.T) {
+	fx := seedVariantContractMovie(t, "widen")
+	ctx := context.Background()
+	dir := fx.root + "/Discs (2010)"
+	insert := func(path string) int {
+		t.Helper()
+		var id int
+		if err := fx.pool.QueryRow(ctx, `
+			INSERT INTO media_files (content_id, media_folder_id, file_path, file_size)
+			VALUES ($1, $2, $3, 1024) RETURNING id`, fx.movieID, fx.folderID, path).Scan(&id); err != nil {
+			t.Fatalf("seed %s: %v", path, err)
+		}
+		return id
+	}
+	partTotal := func(id int) int {
+		t.Helper()
+		var total int
+		if err := fx.pool.QueryRow(ctx, `SELECT COALESCE(presentation_part_total, 0) FROM media_files WHERE id = $1`, id).Scan(&total); err != nil {
+			t.Fatalf("load file %d: %v", id, err)
+		}
+		return total
+	}
+
+	discOne := insert(dir + "/Discs.2010.CD1.mkv")
+	discTwo := insert(dir + "/Discs.2010.CD2.mkv")
+	fx.finalize(t, dir)
+	if partTotal(discOne) != 2 || partTotal(discTwo) != 2 {
+		t.Fatalf("fixture: disc totals = %d and %d, want 2", partTotal(discOne), partTotal(discTwo))
+	}
+	if _, err := fx.pool.Exec(ctx, `
+		UPDATE media_files
+		SET presentation_kind = '', presentation_group_key = '', presentation_part_index = NULL, presentation_part_total = NULL
+		WHERE id = $1`, discTwo); err != nil {
+		t.Fatalf("clear disc 2 part columns: %v", err)
+	}
+	plain := fx.root + "/Discs (2010) Featurette/Discs.2010.1080p.mkv"
+	insert(plain)
+	fx.finalize(t, plain)
+
+	if got := partTotal(discOne); got != 2 {
+		t.Fatalf("disc 1 part total = %d, want 2", got)
+	}
+	if got := partTotal(discTwo); got != 2 {
+		t.Fatalf("disc 2 part total = %d, want 2", got)
+	}
+}
diff --git a/internal/scanner/variant_finalize_db_test.go b/internal/scanner/variant_finalize_db_test.go
new file mode 100644
index 0000000000..3203951b40
--- /dev/null
+++ b/internal/scanner/variant_finalize_db_test.go
@@ -0,0 +1,294 @@
+package scanner
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/models"
+)
+
+type variantQueryCountKey struct{}
+
+type variantQueryTracer struct{}
+
+func (variantQueryTracer) TraceQueryStart(ctx context.Context, _ *pgx.Conn, _ pgx.TraceQueryStartData) context.Context {
+	if counter, ok := ctx.Value(variantQueryCountKey{}).(*atomic.Int64); ok {
+		counter.Add(1)
+	}
+	return ctx
+}
+
+func (variantQueryTracer) TraceQueryEnd(context.Context, *pgx.Conn, pgx.TraceQueryEndData) {}
+
+type variantFinalizeFixture struct {
+	pool   *pgxpool.Pool
+	scan   *Scanner
+	folder *models.MediaFolder
+	ids    map[string]int
+}
+
+type variantFinalizeRow struct {
+	editionKey string
+	partTotal  int
+	missing    bool
+	updatedAt  time.Time
+}
+
+func (fx variantFinalizeFixture) row(ctx context.Context, t *testing.T, name string) variantFinalizeRow {
+	t.Helper()
+	var row variantFinalizeRow
+	if err := fx.pool.QueryRow(ctx, `
+		SELECT edition_key, COALESCE(presentation_part_total, 0), missing_since IS NOT NULL, updated_at
+		FROM media_files WHERE id = $1`, fx.ids[name]).Scan(
+		&row.editionKey, &row.partTotal, &row.missing, &row.updatedAt,
+	); err != nil {
+		t.Fatalf("load %s: %v", name, err)
+	}
+	return row
+}
+
+// seedVariantFinalizeFixture builds a series folder with an in-scope season
+// directory and files of the same episodes outside it.
+func seedVariantFinalizeFixture(t *testing.T) variantFinalizeFixture {
+	t.Helper()
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	cfg, err := pgxpool.ParseConfig(dsn)
+	if err != nil {
+		t.Fatalf("parse test database url: %v", err)
+	}
+	cfg.ConnConfig.Tracer = variantQueryTracer{}
+	pool, err := pgxpool.NewWithConfig(ctx, cfg)
+	if err != nil {
+		t.Fatalf("connect test database: %v", err)
+	}
+	t.Cleanup(pool.Close)
+
+	suffix := time.Now().UnixNano()
+	root := fmt.Sprintf("/variant-finalize-%d", suffix)
+	seriesID := fmt.Sprintf("variant-finalize-series-%d", suffix)
+	var folderID int
+	if err := pool.QueryRow(ctx, `INSERT INTO media_folders (type, name, enabled) VALUES ('series', $1, true) RETURNING id`, seriesID).Scan(&folderID); err != nil {
+		t.Fatalf("seed folder: %v", err)
+	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM media_folders WHERE id = $1`, folderID)
+		_, _ = pool.Exec(context.Background(), `DELETE FROM media_items WHERE content_id = $1`, seriesID)
+	})
+	if _, err := pool.Exec(ctx, `
+		INSERT INTO media_items (content_id, type, title, status, genres)
+		VALUES ($1, 'series', 'Variant Finalize', 'matched', '{}'::text[])`, seriesID); err != nil {
+		t.Fatalf("seed series: %v", err)
+	}
+	for episode := 1; episode <= 4; episode++ {
+		if _, err := pool.Exec(ctx, `
+			INSERT INTO episodes (content_id, series_id, season_number, episode_number, title)
+			VALUES ($1, $2, 1, $3, 'Episode')`, fmt.Sprintf("%s-e%d", seriesID, episode), seriesID, episode); err != nil {
+			t.Fatalf("seed episode %d: %v", episode, err)
+		}
+	}
+
+	season := root + "/Show/Season 01"
+	files := []struct {
+		name, path  string
+		episode     int
+		editionKey  string
+		editionSrc  string
+		kind, group string
+		partIndex   int
+		missing     bool
+	}{
+		// Split episode: part 1 in scope, part 2 in another directory.
+		{name: "split-in", path: season + "/Show.S01E01.Part.1.mkv", episode: 1, kind: "split_episode", group: "show s01e01", partIndex: 1},
+		{name: "split-out", path: root + "/Elsewhere/Show.S01E01.Part.2.mkv", episode: 1, kind: "split_episode", group: "show s01e01", partIndex: 2},
+		// In scope with a stale edition.
+		{name: "stale", path: season + "/Show.S01E02.mkv", episode: 2, editionKey: "stale", editionSrc: "heuristic_file"},
+		// In scope, already finalized.
+		{name: "steady", path: season + "/Show.S01E03.mkv", episode: 3},
+		// In scope with an imported edition that scans keep.
+		{name: "import", path: season + "/Show.S01E04.mkv", episode: 4, editionKey: "theatrical", editionSrc: editionSourceImport},
+		// Missing in scope, and a stale file outside the scope: both are
+		// left for later.
+		{name: "missing", path: season + "/Show.S01E04.Old.mkv", episode: 4, editionKey: "stale", editionSrc: "heuristic_file", missing: true},
+		{name: "outside-stale", path: root + "/Elsewhere/Show.S01E03.mkv", episode: 3, editionKey: "stale", editionSrc: "heuristic_file"},
+	}
+	ids := make(map[string]int, len(files))
+	for _, file := range files {
+		var id int
+		if err := pool.QueryRow(ctx, `
+			INSERT INTO media_files (
+				content_id, episode_id, media_folder_id, file_path, file_size,
+				edition_key, edition_source,
+				presentation_kind, presentation_group_key, presentation_part_index,
+				missing_since, updated_at
+			) VALUES (
+				$1, $2, $3, $4, 1024,
+				$5, $6,
+				$7, $8, NULLIF($9, 0),
+				CASE WHEN $10 THEN NOW() END, NOW() - interval '1 day'
+			) RETURNING id`,
+			seriesID, fmt.Sprintf("%s-e%d", seriesID, file.episode), folderID, file.path,
+			file.editionKey, file.editionSrc,
+			file.kind, file.group, file.partIndex,
+			file.missing,
+		).Scan(&id); err != nil {
+			t.Fatalf("seed file %s: %v", file.name, err)
+		}
+		ids[file.name] = id
+	}
+
+	return variantFinalizeFixture{
+		pool:   pool,
+		scan:   &Scanner{fileRepo: NewFileRepository(pool)},
+		folder: &models.MediaFolder{ID: folderID, Type: "series", Paths: []string{root}},
+		ids:    ids,
+	}
+}
+
+// A pass over a scope costs one narrow scope load, one owner lookup and one
+// batched update. A pass with nothing to change writes nothing.
+// TestFinalizeVariantsKeepsMatchSuppressionDB covers the columns the update
+// leaves alone.
+func TestFinalizeVariantsBatchesQueriesDB(t *testing.T) {
+	fx := seedVariantFinalizeFixture(t)
+	ctx := context.Background()
+	scope := fx.folder.Paths[0] + "/Show/Season 01"
+
+	before := map[string]variantFinalizeRow{}
+	for name := range fx.ids {
+		before[name] = fx.row(ctx, t, name)
+	}
+
+	var queries atomic.Int64
+	if err := fx.scan.FinalizeVariantsByPathPrefix(context.WithValue(ctx, variantQueryCountKey{}, &queries), fx.folder, scope); err != nil {
+		t.Fatalf("finalize: %v", err)
+	}
+	// Scope load, one owner lookup for the scope's episodes, one batched update.
+	if got := queries.Load(); got != 3 {
+		t.Fatalf("finalize issued %d queries, want 3", got)
+	}
+
+	for _, name := range []string{"split-in", "split-out"} {
+		row := fx.row(ctx, t, name)
+		if row.partTotal != 2 {
+			t.Fatalf("%s part total = %d, want 2", name, row.partTotal)
+		}
+		if !row.updatedAt.After(before[name].updatedAt) {
+			t.Fatalf("%s updated_at not bumped", name)
+		}
+	}
+
+	stale := fx.row(ctx, t, "stale")
+	if stale.editionKey != "" {
+		t.Fatalf("stale edition = %q, want it cleared", stale.editionKey)
+	}
+	if !stale.updatedAt.After(before["stale"].updatedAt) {
+		t.Fatalf("stale updated_at not bumped")
+	}
+
+	for _, name := range []string{"steady", "import", "missing", "outside-stale"} {
+		if got := fx.row(ctx, t, name); got != before[name] {
+			t.Fatalf("%s changed: before %+v after %+v", name, before[name], got)
+		}
+	}
+
+	// A second pass finds nothing to change and writes nothing.
+	settled := map[string]variantFinalizeRow{}
+	for name := range fx.ids {
+		settled[name] = fx.row(ctx, t, name)
+	}
+	queries.Store(0)
+	if err := fx.scan.FinalizeVariantsByPathPrefix(context.WithValue(ctx, variantQueryCountKey{}, &queries), fx.folder, scope); err != nil {
+		t.Fatalf("second finalize: %v", err)
+	}
+	if got := queries.Load(); got != 2 {
+		t.Fatalf("second finalize issued %d queries, want 2 (scope load and owner lookup)", got)
+	}
+	for name := range fx.ids {
+		if got := fx.row(ctx, t, name); got != settled[name] {
+			t.Fatalf("%s changed on the second pass: before %+v after %+v", name, settled[name], got)
+		}
+	}
+}
+
+// Movie discs belong to their content id, not an episode, so their siblings
+// come from the content-owner lookup.
+func TestFinalizeVariantsLoadsMovieDiscsOutsideTheScopeDB(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	cfg, err := pgxpool.ParseConfig(dsn)
+	if err != nil {
+		t.Fatalf("parse test database url: %v", err)
+	}
+	cfg.ConnConfig.Tracer = variantQueryTracer{}
+	pool, err := pgxpool.NewWithConfig(ctx, cfg)
+	if err != nil {
+		t.Fatalf("connect test database: %v", err)
+	}
+	t.Cleanup(pool.Close)
+
+	suffix := time.Now().UnixNano()
+	root := fmt.Sprintf("/variant-finalize-movies-%d", suffix)
+	movieID := fmt.Sprintf("variant-finalize-movie-%d", suffix)
+	var folderID int
+	if err := pool.QueryRow(ctx, `INSERT INTO media_folders (type, name, enabled) VALUES ('movies', $1, true) RETURNING id`, movieID).Scan(&folderID); err != nil {
+		t.Fatalf("seed folder: %v", err)
+	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM media_folders WHERE id = $1`, folderID)
+		_, _ = pool.Exec(context.Background(), `DELETE FROM media_items WHERE content_id = $1`, movieID)
+	})
+	if _, err := pool.Exec(ctx, `
+		INSERT INTO media_items (content_id, type, title, status, genres)
+		VALUES ($1, 'movie', 'Discs', 'matched', '{}'::text[])`, movieID); err != nil {
+		t.Fatalf("seed movie: %v", err)
+	}
+	scope := root + "/Discs (2010)"
+	ids := map[string]int{}
+	for name, path := range map[string]string{
+		"disc-in":  scope + "/Discs.2010.CD1.mkv",
+		"disc-out": root + "/Discs (2010) extra/Discs.2010.CD2.mkv",
+	} {
+		var id int
+		if err := pool.QueryRow(ctx, `
+			INSERT INTO media_files (content_id, media_folder_id, file_path, file_size)
+			VALUES ($1, $2, $3, 1024) RETURNING id`, movieID, folderID, path).Scan(&id); err != nil {
+			t.Fatalf("seed file %s: %v", name, err)
+		}
+		ids[name] = id
+	}
+
+	scan := &Scanner{fileRepo: NewFileRepository(pool)}
+	folder := &models.MediaFolder{ID: folderID, Type: "movies", Paths: []string{root}}
+	var queries atomic.Int64
+	if err := scan.FinalizeVariantsByPathPrefix(context.WithValue(ctx, variantQueryCountKey{}, &queries), folder, scope); err != nil {
+		t.Fatalf("finalize: %v", err)
+	}
+	// Scope load, the content-owner lookup, one batched update.
+	if got := queries.Load(); got != 3 {
+		t.Fatalf("finalize issued %d queries, want 3", got)
+	}
+	for name, id := range ids {
+		var kind string
+		var total int
+		if err := pool.QueryRow(ctx, `SELECT presentation_kind, COALESCE(presentation_part_total, 0) FROM media_files WHERE id = $1`, id).Scan(&kind, &total); err != nil {
+			t.Fatalf("load %s: %v", name, err)
+		}
+		if kind != "multipart_movie" || total != 2 {
+			t.Fatalf("%s kind=%q total=%d, want multipart_movie with total 2", name, kind, total)
+		}
+	}
+}
diff --git a/internal/scanner/variant_finalize_test.go b/internal/scanner/variant_finalize_test.go
index 65d554cbae..e92a3946b3 100644
--- a/internal/scanner/variant_finalize_test.go
+++ b/internal/scanner/variant_finalize_test.go
@@ -1,22 +1,44 @@
 package scanner
 
 import (
+	"reflect"
 	"testing"
 
 	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/naming"
 )
 
+func TestSortedVariantOwnerIDs(t *testing.T) {
+	ids := map[string]struct{}{
+		"episode-c": {},
+		"episode-a": {},
+		"episode-b": {},
+	}
+
+	got := sortedVariantOwnerIDs(ids)
+	want := []string{"episode-a", "episode-b", "episode-c"}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("sortedVariantOwnerIDs() = %v, want %v", got, want)
+	}
+}
+
+func TestSortedVariantOwnerIDsEmpty(t *testing.T) {
+	if got := sortedVariantOwnerIDs(nil); len(got) != 0 {
+		t.Fatalf("sortedVariantOwnerIDs(nil) = %v, want empty", got)
+	}
+}
+
 func TestVariantPartTotals(t *testing.T) {
 	tests := []struct {
 		name       string
 		folder     *models.MediaFolder
-		files      []*models.MediaFile
+		files      []VariantFile
 		wantTotals []int
 	}{
 		{
 			name:   "lone part number in a movie title",
 			folder: &models.MediaFolder{Type: "movies", Paths: []string{"/movies"}},
-			files: []*models.MediaFile{
+			files: []VariantFile{
 				{ID: 1, ContentID: "movie:1", FilePath: "/movies/Mockingjay Part 2 (2015)/The.Hunger.Games.Mockingjay.Part.2.2015.BluRay.1080p.mkv"},
 			},
 			wantTotals: []int{0},
@@ -24,7 +46,7 @@ func TestVariantPartTotals(t *testing.T) {
 		{
 			name:   "versions of one episode with a part number in its title",
 			folder: &models.MediaFolder{Type: "series", Paths: []string{"/tv"}},
-			files: []*models.MediaFile{
+			files: []VariantFile{
 				{ID: 1, EpisodeID: "episode:1", FilePath: "/tv/True Detective/Season 04/True.Detective.S04E04.Part.4.2160p.MAX.WEB-DL.mkv"},
 				{ID: 2, EpisodeID: "episode:1", FilePath: "/tv/True Detective/Season 04/True.Detective.S04E04.Part.4.1080p.HMAX.WEB-DL.mkv"},
 			},
@@ -33,7 +55,7 @@ func TestVariantPartTotals(t *testing.T) {
 		{
 			name:   "movie split across discs",
 			folder: &models.MediaFolder{Type: "movies", Paths: []string{"/movies"}},
-			files: []*models.MediaFile{
+			files: []VariantFile{
 				{ID: 1, ContentID: "movie:1", FilePath: "/movies/Movie (2010)/Movie.2010.CD1.mkv"},
 				{ID: 2, ContentID: "movie:1", FilePath: "/movies/Movie (2010)/Movie.2010.CD2.mkv"},
 			},
@@ -42,7 +64,7 @@ func TestVariantPartTotals(t *testing.T) {
 		{
 			name:   "episode split into parts",
 			folder: &models.MediaFolder{Type: "series", Paths: []string{"/tv"}},
-			files: []*models.MediaFile{
+			files: []VariantFile{
 				{ID: 1, EpisodeID: "episode:1", FilePath: "/tv/Show/Season 01/Show.S01E01.Part.1.mkv"},
 				{ID: 2, EpisodeID: "episode:1", FilePath: "/tv/Show/Season 01/Show.S01E01.Part.2.mkv"},
 				{ID: 3, EpisodeID: "episode:1", FilePath: "/tv/Show/Season 01/Show.S01E01.Part.3.mkv"},
@@ -53,16 +75,149 @@ func TestVariantPartTotals(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			totals := variantPartTotals(tt.files, tt.folder)
-			for i, file := range tt.files {
+			candidates := newVariantCandidates(tt.files, tt.folder)
+			totals := variantPartTotals(candidates)
+			for i, candidate := range candidates {
 				got := 0
-				if groupKey, ok := variantPartGroupKey(stableOwnerKey(file), variantHintsForFile(file, tt.folder)); ok {
+				if groupKey, ok := variantPartGroupKey(candidate.ownerKey, candidate.hints); ok {
 					got = totals[groupKey]
 				}
 				if got != tt.wantTotals[i] {
-					t.Errorf("%s part total = %d, want %d", file.FilePath, got, tt.wantTotals[i])
+					t.Errorf("%s part total = %d, want %d", candidate.file.FilePath, got, tt.wantTotals[i])
 				}
 			}
 		})
 	}
 }
+
+// steadyVariantFile returns a file whose stored variant columns already match
+// what finalization would write for it.
+func steadyVariantFile(t *testing.T, file VariantFile, folder *models.MediaFolder, partTotal int) VariantFile {
+	t.Helper()
+	hints := naming.ParseVariantHints(file.FilePath, folder.Type, folder.Paths...)
+	file.EditionRaw = hints.EditionRaw
+	file.EditionKey = hints.EditionKey
+	file.EditionConfidence = hints.EditionConfidence
+	file.EditionSource = hints.EditionSource
+	file.PresentationKind = hints.PresentationKind
+	file.PresentationGroupKey = hints.PresentationGroupKey
+	file.PresentationPartIndex = hints.PresentationPartIndex
+	file.PresentationPartTotal = partTotal
+	file.MultiEpisodeStart = hints.MultiEpisodeStart
+	file.MultiEpisodeEnd = hints.MultiEpisodeEnd
+	return file
+}
+
+func TestVariantSiblingOwners(t *testing.T) {
+	series := &models.MediaFolder{Type: "series", Paths: []string{"/tv"}}
+	movies := &models.MediaFolder{Type: "movies", Paths: []string{"/movies"}}
+	set := func(ids ...string) map[string]struct{} {
+		out := make(map[string]struct{}, len(ids))
+		for _, id := range ids {
+			out[id] = struct{}{}
+		}
+		return out
+	}
+
+	seriesFiles := []VariantFile{
+		// A plain episode: only its files stored as parts are read, in case
+		// one of them was left behind by a part that left the group.
+		{ID: 1, EpisodeID: "ep-plain", ContentID: "show", FilePath: "/tv/Show/Season 01/Show.S01E01.1080p.mkv"},
+		// A split episode part needs every file of the episode.
+		{ID: 2, EpisodeID: "ep-split", ContentID: "show", FilePath: "/tv/Show/Season 01/Show.S01E02.Part.1.mkv"},
+		// Stored as a part although its path no longer parses as one, as
+		// after a parser change: its old siblings may need a new total.
+		{ID: 3, EpisodeID: "ep-reparsed", ContentID: "show", FilePath: "/tv/Show/Season 01/Show.S01E03.mkv",
+			PresentationKind: "split_episode", PresentationGroupKey: "show s01e03", PresentationPartIndex: 1},
+		// A stored part total alone also counts.
+		{ID: 4, EpisodeID: "ep-total", ContentID: "show", FilePath: "/tv/Show/Season 01/Show.S01E04.mkv", PresentationPartTotal: 2},
+		// No owner: finalization leaves it alone.
+		{ID: 5, FilePath: "/tv/Show/Season 01/Show.S01E05.Part.1.mkv"},
+	}
+	episodes, contents := variantSiblingOwners(newVariantCandidates(seriesFiles, series))
+	want := VariantOwners{
+		IDs:   []string{"ep-plain", "ep-reparsed", "ep-split", "ep-total"},
+		Whole: set("ep-reparsed", "ep-split", "ep-total"),
+	}
+	if !reflect.DeepEqual(episodes, want) {
+		t.Fatalf("episode owners = %+v, want %+v", episodes, want)
+	}
+	if len(contents.IDs) != 0 || len(contents.Whole) != 0 {
+		t.Fatalf("content owners = %+v, want none", contents)
+	}
+
+	movieFiles := []VariantFile{
+		{ID: 10, ContentID: "movie-plain", FilePath: "/movies/Plain (2010)/Plain.2010.1080p.mkv"},
+		{ID: 11, ContentID: "movie-discs", FilePath: "/movies/Discs (2010)/Discs.2010.CD1.mkv"},
+	}
+	episodes, contents = variantSiblingOwners(newVariantCandidates(movieFiles, movies))
+	if len(episodes.IDs) != 0 || len(episodes.Whole) != 0 {
+		t.Fatalf("episode owners = %+v, want none", episodes)
+	}
+	want = VariantOwners{IDs: []string{"movie-discs", "movie-plain"}, Whole: set("movie-discs")}
+	if !reflect.DeepEqual(contents, want) {
+		t.Fatalf("content owners = %+v, want %+v", contents, want)
+	}
+}
+
+func TestVariantOwnersToWiden(t *testing.T) {
+	movies := &models.MediaFolder{Type: "movies", Paths: []string{"/movies"}}
+	read := VariantOwners{
+		IDs:   []string{"movie-discs", "movie-read-whole", "movie-plain"},
+		Whole: map[string]struct{}{"movie-read-whole": {}},
+	}
+	found := newVariantCandidates([]VariantFile{
+		// A disc of an owner read only for its stored parts: read the rest.
+		{ID: 1, ContentID: "movie-discs", FilePath: "/movies/Discs (2010)/Discs.2010.CD1.mkv"},
+		// Already read in full.
+		{ID: 2, ContentID: "movie-read-whole", FilePath: "/movies/Whole (2010)/Whole.2010.CD1.mkv"},
+		// Stored with a part total but no longer a part: still a group to finish.
+		{ID: 3, ContentID: "movie-plain", FilePath: "/movies/Plain (2010)/Plain.2010.mkv", PresentationPartTotal: 2},
+	}, movies)
+
+	episodes, contents := variantOwnersToWiden(found, VariantOwners{}, read)
+	if len(episodes.IDs) != 0 || len(episodes.Whole) != 0 {
+		t.Fatalf("episode owners = %+v, want none", episodes)
+	}
+	want := VariantOwners{
+		IDs:   []string{"movie-discs", "movie-plain"},
+		Whole: map[string]struct{}{"movie-discs": {}, "movie-plain": {}},
+	}
+	if !reflect.DeepEqual(contents, want) {
+		t.Fatalf("content owners = %+v, want %+v", contents, want)
+	}
+}
+
+func TestVariantMetadataUpdates(t *testing.T) {
+	movies := &models.MediaFolder{Type: "movies", Paths: []string{"/movies"}}
+
+	steady := steadyVariantFile(t, VariantFile{ID: 7, ContentID: "movie-steady", FilePath: "/movies/Steady (2010)/Steady.2010.1080p.mkv"}, movies, 0)
+	stale := steadyVariantFile(t, VariantFile{ID: 3, ContentID: "movie-stale", FilePath: "/movies/Stale (2010)/Stale.2010.Directors.Cut.1080p.mkv"}, movies, 0)
+	if stale.EditionKey == "" {
+		t.Fatalf("fixture %s parses no edition", stale.FilePath)
+	}
+	wantStale := stale
+	stale.EditionRaw, stale.EditionKey, stale.EditionSource, stale.EditionConfidence = "", "", "", nil
+	imported := VariantFile{ID: 5, ContentID: "movie-import", FilePath: "/movies/Import (2010)/Import.2010.1080p.mkv",
+		EditionRaw: "Theatrical", EditionKey: "theatrical", EditionSource: editionSourceImport}
+	noOwner := VariantFile{ID: 6, FilePath: "/movies/Loose (2010)/Loose.2010.Directors.Cut.mkv"}
+	// Two discs of one movie, the second loaded from outside the scope. Both
+	// are stored without a total.
+	discOne := steadyVariantFile(t, VariantFile{ID: 2, ContentID: "movie-discs", FilePath: "/movies/Discs (2010)/Discs.2010.CD1.mkv"}, movies, 0)
+	discTwo := steadyVariantFile(t, VariantFile{ID: 1, ContentID: "movie-discs", FilePath: "/elsewhere/Discs (2010)/Discs.2010.CD2.mkv"}, movies, 0)
+
+	updates := variantMetadataUpdates(newVariantCandidates([]VariantFile{steady, stale, imported, noOwner, discOne, discTwo}, movies))
+
+	wantDiscOne, wantDiscTwo := discOne, discTwo
+	wantDiscOne.PresentationPartTotal, wantDiscTwo.PresentationPartTotal = 2, 2
+	want := []VariantFile{wantDiscTwo, wantDiscOne, wantStale}
+	if !reflect.DeepEqual(updates, want) {
+		t.Fatalf("updates =\n%+v\nwant\n%+v", updates, want)
+	}
+
+	// Writing those values back leaves nothing to do on the next pass.
+	again := variantMetadataUpdates(newVariantCandidates([]VariantFile{steady, wantStale, imported, noOwner, wantDiscOne, wantDiscTwo}, movies))
+	if len(again) != 0 {
+		t.Fatalf("second pass updates = %+v, want none", again)
+	}
+}
diff --git a/internal/scantrigger/scantrigger_test.go b/internal/scantrigger/scantrigger_test.go
index d3b6576802..55af3e0646 100644
--- a/internal/scantrigger/scantrigger_test.go
+++ b/internal/scantrigger/scantrigger_test.go
@@ -612,7 +612,7 @@ func TestResolverRoutesLocalMetadataSidecarsToTheirDirectory(t *testing.T) {
 	root := t.TempDir()
 	movie := filepath.Join(root, "Film (2020)")
 	repo := &fakeFolderRepo{folders: []*models.MediaFolder{
-		{ID: 3, Type: "movies", Enabled: true, Paths: []string{filepath.Join(root)}},
+		{ID: 3, Type: "movies", Enabled: true, Paths: []string{root}},
 	}}
 	resolver := NewResolver(repo)
 	for _, name := range []string{"movie.nfo", "poster.jpg", "Film (2020)-fanart.PNG", "clearlogo.webp"} {
diff --git a/internal/scenariocatalog/executor/initial_setup_new_test.go b/internal/scenariocatalog/executor/initial_setup_new_test.go
index 8a49533e2d..b003dce197 100644
--- a/internal/scenariocatalog/executor/initial_setup_new_test.go
+++ b/internal/scenariocatalog/executor/initial_setup_new_test.go
@@ -331,7 +331,7 @@ func (e *initialSetupEnv) checkCreated(t *testing.T, all initialRows, mode, sess
 	delete(user, "password_hash")
 	initialTimestamp(t, user, "created_at", lower, upper)
 	initialTimestamp(t, user, "updated_at", lower, upper)
-	initialExact(t, "user", user, map[string]any{"id": float64(1), "email": "INITIAL-OWNER@SILO.EXAMPLE.TEST", "username": "Initial-Owner", "local_password_login_enabled": true, "role": "admin", "permissions": []any{}, "enabled": true, "library_ids": nil, "max_playback_quality": nil, "max_streams": nil, "max_transcodes": nil, "transcode_allowed": nil, "audio_transcode_allowed": nil, "download_allowed": nil, "download_transcode_allowed": nil, "requests_allowed": nil, "max_profiles": float64(5), "access_group_id": nil, "access_policy_revision": float64(1), "admin_revision": float64(1)})
+	initialExact(t, "user", user, map[string]any{"id": float64(1), "email": "INITIAL-OWNER@SILO.EXAMPLE.TEST", "username": "Initial-Owner", "local_password_login_enabled": true, "role": "admin", "permissions": []any{}, "enabled": true, "library_ids": nil, "max_playback_quality": nil, "max_streams": nil, "max_transcodes": nil, "transcode_allowed": nil, "audio_transcode_allowed": nil, "download_allowed": nil, "download_transcode_allowed": nil, "requests_allowed": nil, "max_profiles": nil, "access_group_id": nil, "access_policy_revision": float64(1), "admin_revision": float64(1)})
 	session := all["auth_sessions"][0]
 	initialTimestamp(t, session, "created_at", lower, upper)
 	initialTimestamp(t, session, "expires_at", lower.Add(e.jwt.RefreshExpiry()), upper.Add(e.jwt.RefreshExpiry()))
diff --git a/internal/sections/because_watched_title.go b/internal/sections/because_watched_title.go
index 7903223887..545cba486d 100644
--- a/internal/sections/because_watched_title.go
+++ b/internal/sections/because_watched_title.go
@@ -7,36 +7,27 @@ import (
 
 	"github.com/prairie-server/prairie-server/internal/catalog"
 	"github.com/prairie-server/prairie-server/internal/models"
-	"github.com/prairie-server/prairie-server/internal/recommendations"
 )
 
-type becauseWatchedSourceReader interface {
-	GetBecauseYouWatchedWithSource(context.Context, int, string, string, int, catalog.AccessFilter) ([]recommendations.ScoredItem, string, error)
-}
-
 // Resolve the title and items together, outside the shared, user-agnostic cache.
 // Never guess the anchor from the latest watch: that anchor may have no cache.
-func (f *Fetcher) fetchBecauseWatchedWithTitle(ctx context.Context, section ResolvedSection, libraryID *int, libraryIDs []int, userID int, profileID string, filter catalog.AccessFilter, reader becauseWatchedSourceReader) (SectionWithItems, error) {
+// The reader picks the anchor within the section's library scope, so a
+// library page passes over a recent watch with nothing to recommend there.
+func (f *Fetcher) fetchBecauseWatchedWithTitle(ctx context.Context, section ResolvedSection, libraryID *int, libraryIDs []int, userID int, profileID string, filter catalog.AccessFilter, reader recommendationReader) (SectionWithItems, error) {
 	result := SectionWithItems{ResolvedSection: section, Items: []*models.MediaItem{}}
 	if userID <= 0 || profileID == "" {
 		return result, nil
 	}
-	scored, sourceID, err := reader.GetBecauseYouWatchedWithSource(ctx, userID, profileID, parseRecommendationSectionConfig(section.Config).anchor(), section.ItemLimit, filter)
+	scope := collectionRailQueryAccess(filter, libraryID, libraryIDs).AllowedLibraryIDs
+	scored, sourceID, err := reader.SectionBecauseYouWatched(ctx, userID, profileID, parseRecommendationSectionConfig(section.Config).anchor(), scope, filter)
 	if err != nil {
 		return result, err
 	}
-	if len(scored) == 0 {
-		return result, nil
-	}
-	ids := make([]string, len(scored))
-	for i, item := range scored {
-		ids[i] = item.MediaItemID
-	}
-	items, err := f.fetchItemsByContentIDs(ctx, ids, libraryID, libraryIDs, filter)
+	items, err := f.scopeRecommendationItems(ctx, scored, libraryID, libraryIDs, filter)
 	if err != nil {
 		return result, err
 	}
-	result.Items = orderMediaItems(items, ids)
+	result.Items = limitRecommendationItems(items, section.ItemLimit)
 	result.TotalCount = len(result.Items)
 	if len(result.Items) > 0 && hasDefaultBecauseWatchedTitle(section.Title) {
 		var sources []*models.MediaItem
diff --git a/internal/sections/continue_watching_combined_db_test.go b/internal/sections/continue_watching_combined_db_test.go
new file mode 100644
index 0000000000..af0fb774ee
--- /dev/null
+++ b/internal/sections/continue_watching_combined_db_test.go
@@ -0,0 +1,216 @@
+package sections
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/access"
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/userstore/pgstore"
+)
+
+// nextUpWalkTracer records the next-up walk statements a fetch issues.
+type nextUpWalkTracer struct {
+	mu    sync.Mutex
+	walks []string
+}
+
+func (c *nextUpWalkTracer) TraceQueryStart(ctx context.Context, _ *pgx.Conn, data pgx.TraceQueryStartData) context.Context {
+	if strings.Contains(data.SQL, "RECURSIVE walk") {
+		c.mu.Lock()
+		c.walks = append(c.walks, strings.Join(strings.Fields(data.SQL), " "))
+		c.mu.Unlock()
+	}
+	return ctx
+}
+
+func (c *nextUpWalkTracer) TraceQueryEnd(context.Context, *pgx.Conn, pgx.TraceQueryEndData) {}
+
+func (c *nextUpWalkTracer) take() []string {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	out := c.walks
+	c.walks = nil
+	return out
+}
+
+// TestContinueWatchingCombinedRowKeepsNewestCardsDB pins the combined
+// Continue Watching row: in-progress and next-up cards merge newest first and
+// the row stops at its item limit. When the in-progress cards fill the row on
+// their own, the next-up walk only reads series completed since the oldest of
+// them, since anything older could not make the row. A profile showing new
+// releases first is the exception: a series finished before all of them leads
+// the row when its next episode was just released, so its walk is unbounded.
+func TestContinueWatchingCombinedRowKeepsNewestCardsDB(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	config, err := pgxpool.ParseConfig(dsn)
+	if err != nil {
+		t.Fatalf("parse test database url: %v", err)
+	}
+	tracer := &nextUpWalkTracer{}
+	config.ConnConfig.Tracer = tracer
+	pool, err := pgxpool.NewWithConfig(ctx, config)
+	if err != nil {
+		t.Fatalf("connect test database: %v", err)
+	}
+	t.Cleanup(pool.Close)
+
+	suffix := time.Now().UnixNano()
+	id := func(name string) string { return fmt.Sprintf("cw-combined-%s-%d", name, suffix) }
+	exec := func(sql string, args ...any) {
+		t.Helper()
+		if _, err := pool.Exec(ctx, sql, args...); err != nil {
+			t.Fatalf("seed: %v\n%s", err, sql)
+		}
+	}
+
+	var folderID, userID int
+	if err := pool.QueryRow(ctx, `INSERT INTO media_folders (type, name, enabled) VALUES ('series', $1, true) RETURNING id`, id("folder")).Scan(&folderID); err != nil {
+		t.Fatalf("seed folder: %v", err)
+	}
+	if err := pool.QueryRow(ctx, `INSERT INTO users (username, email, password_hash, role) VALUES ($1, $2, '', 'user') RETURNING id`, id("user"), id("user")+"@example.test").Scan(&userID); err != nil {
+		t.Fatalf("seed user: %v", err)
+	}
+	profileID := id("profile")
+
+	movies := []string{id("movie-1"), id("movie-2"), id("movie-3"), id("movie-4")}
+	// rewatch has two episodes in progress; recent was completed between the
+	// first and second movie; old was completed before every in-progress card;
+	// returning was completed before them too, but its next episode was
+	// released after all of them.
+	rewatch, recent, old, returning := id("rewatch"), id("recent"), id("old"), id("returning")
+	episode := func(series string, n int) string { return fmt.Sprintf("%s-e%d", series, n) }
+	allItems := append([]string{rewatch, recent, old, returning}, movies...)
+	t.Cleanup(func() {
+		_, _ = pool.Exec(ctx, `DELETE FROM episode_availability WHERE library_id = $1`, folderID)
+		_, _ = pool.Exec(ctx, `DELETE FROM media_files WHERE media_folder_id = $1`, folderID)
+		_, _ = pool.Exec(ctx, `DELETE FROM users WHERE id = $1`, userID)
+		_, _ = pool.Exec(ctx, `DELETE FROM episodes WHERE series_id = ANY($1)`, []string{rewatch, recent, old, returning})
+		_, _ = pool.Exec(ctx, `DELETE FROM media_items WHERE content_id = ANY($1)`, allItems)
+		_, _ = pool.Exec(ctx, `DELETE FROM media_folders WHERE id = $1`, folderID)
+	})
+
+	for _, movie := range movies {
+		exec(`INSERT INTO media_items (content_id, type, title, status, genres) VALUES ($1, 'movie', $1, 'matched', '{}'::text[])`, movie)
+	}
+	for _, series := range []string{rewatch, recent, old, returning} {
+		exec(`INSERT INTO media_items (content_id, type, title, status, genres) VALUES ($1, 'series', $1, 'matched', '{}'::text[])`, series)
+		exec(`INSERT INTO episodes (content_id, series_id, season_number, episode_number, title, overview, runtime, rating_imdb) VALUES ($1, $3, 1, 1, 'One', '', 30, 0), ($2, $3, 1, 2, 'Two', '', 30, 0)`,
+			episode(series, 1), episode(series, 2), series)
+		exec(`INSERT INTO media_files (episode_id, media_folder_id, file_path, duration) VALUES ($1, $3, '/cw-combined/' || $1, 1800), ($2, $3, '/cw-combined/' || $2, 1800)`,
+			episode(series, 1), episode(series, 2), folderID)
+	}
+	exec(`INSERT INTO media_item_libraries (content_id, media_folder_id) SELECT unnest($1::text[]), $2`, allItems, folderID)
+
+	now := time.Now().UTC().Truncate(time.Second)
+	progress := []struct {
+		item      string
+		completed bool
+		at        time.Duration
+	}{
+		{episode(rewatch, 2), false, 30 * time.Minute},
+		{movies[0], false, time.Hour},
+		{episode(recent, 1), true, 75 * time.Minute},
+		{episode(rewatch, 1), false, 90 * time.Minute},
+		{movies[1], false, 2 * time.Hour},
+		{movies[2], false, 3 * time.Hour},
+		{movies[3], false, 4 * time.Hour},
+		{episode(old, 1), true, 10 * time.Hour},
+		{episode(returning, 1), true, 12 * time.Hour},
+	}
+	for _, p := range progress {
+		position := 600.0
+		if p.completed {
+			position = 0
+		}
+		exec(`INSERT INTO user_watch_progress (user_id, profile_id, media_item_id, position_seconds, duration_seconds, completed, updated_at) VALUES ($1, $2, $3, $4, 1800, $5, $6)`,
+			userID, profileID, p.item, position, p.completed, now.Add(-p.at))
+	}
+
+	exec(`INSERT INTO episode_availability (library_id, episode_id, series_id, season_number, episode_number, episode_key, available_at, released_at)
+		VALUES ($1, $2, $3, 1, 2, 1000002, $4, $4)`, folderID, episode(returning, 2), returning, now.Add(-20*time.Minute))
+
+	provider := pgstore.NewPostgresProvider(pool)
+	fetcher := NewFetcher(pool)
+	fetcher.StoreProvider = provider
+	fetcher.NextUpRepo = catalog.NewNextUpRepository(pool, provider)
+	tests := []struct {
+		name             string
+		newReleasesFirst bool
+		limit            int
+		want             []string
+		boundedWalk      bool
+	}{
+		{
+			// The rewatch series counts once, so three in-progress cards fill
+			// the row and the walk stops at the second movie.
+			name:        "in-progress cards fill the row",
+			limit:       3,
+			want:        []string{episode(rewatch, 2), movies[0], episode(recent, 2)},
+			boundedWalk: true,
+		},
+		{
+			name:  "row short of its limit",
+			limit: 10,
+			want:  []string{episode(rewatch, 2), movies[0], episode(recent, 2), movies[1], movies[2], movies[3], episode(old, 2), episode(returning, 2)},
+		},
+		{
+			name:             "new releases first, in-progress cards fill the row",
+			newReleasesFirst: true,
+			limit:            3,
+			want:             []string{episode(returning, 2), episode(rewatch, 2), movies[0]},
+		},
+		{
+			name:             "new releases first, row short of its limit",
+			newReleasesFirst: true,
+			limit:            10,
+			want:             []string{episode(returning, 2), episode(rewatch, 2), movies[0], episode(recent, 2), movies[1], movies[2], movies[3], episode(old, 2)},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			viewerCtx := access.SetScope(ctx, access.Scope{
+				UserID: userID, ProfileID: profileID,
+				NextUpMode: NextUpModeCombined, NextUpNewReleasesFirst: tt.newReleasesFirst,
+			})
+			tracer.take()
+			section := ResolvedSection{
+				ID:          id("section"),
+				SectionType: SectionContinueWatching,
+				ItemLimit:   tt.limit,
+				Config:      ContinueTypeConfig(ContinueTypeWatching),
+			}
+			got, err := fetcher.FetchOne(viewerCtx, section, nil, []int{folderID}, userID, profileID, catalog.AccessFilter{AllowedLibraryIDs: []int{folderID}})
+			if err != nil {
+				t.Fatalf("FetchOne: %v", err)
+			}
+			if ids := contentIDs(got.Items); strings.Join(ids, ",") != strings.Join(tt.want, ",") {
+				t.Fatalf("row = %v, want %v", ids, tt.want)
+			}
+			if got.TotalCount != len(tt.want) {
+				t.Fatalf("total_count = %d, want %d", got.TotalCount, len(tt.want))
+			}
+			walks := tracer.take()
+			if len(walks) == 0 {
+				t.Fatal("fetch issued no next-up walk")
+			}
+			for _, walk := range walks {
+				if bounded := strings.Contains(walk, "uwp.updated_at >= $"); bounded != tt.boundedWalk {
+					t.Fatalf("next-up walk bounded = %v, want %v:\n%s", bounded, tt.boundedWalk, walk)
+				}
+			}
+		})
+	}
+}
diff --git a/internal/sections/defaults.go b/internal/sections/defaults.go
index 7d9dc40eda..75e19fdd2d 100644
--- a/internal/sections/defaults.go
+++ b/internal/sections/defaults.go
@@ -7,6 +7,7 @@ import (
 	"github.com/prairie-server/prairie-server/internal/catalog"
 	"github.com/prairie-server/prairie-server/internal/librarykind"
 	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/sections/recipes"
 )
 
 // Section scopes and the titles and IDs of default rows, named once for the
@@ -15,24 +16,28 @@ const (
 	scopeHome    = "home"
 	scopeLibrary = "library"
 
-	titleContinueWatching  = "Continue Watching"
-	titleContinueListening = "Continue Listening"
-	titleContinueReading   = "Continue Reading"
-	titleRecentlyAdded     = "Recently Added"
-	titleRecommendedForYou = "Recommended for You"
-	titleReturningShows    = "Returning Shows"
-	titleTrendingThisWeek  = "Trending This Week"
-	titleTopRated          = "Top Rated"
-	titleHiddenGems        = "Hidden Gems"
-	titleRandomPicks       = "Random Picks"
+	titleContinueWatching    = "Continue Watching"
+	titleContinueListening   = "Continue Listening"
+	titleContinueReading     = "Continue Reading"
+	titleRecentlyAdded       = "Recently Added"
+	titleRecentlyAddedMovies = "Recently Added Movies"
+	titleRecentlyAddedTV     = "Recently Added TV"
+	titleRecommendedForYou   = "Recommended for You"
+	titleReturningShows      = "Returning Shows"
+	titleTrendingThisWeek    = "Trending This Week"
+	titleTopRated            = "Top Rated"
+	titleHiddenGems          = "Hidden Gems"
+	titleRandomPicks         = "Random Picks"
 
-	idContinueWatching  = "default-continue-watching"
-	idContinueListening = "default-continue-listening"
-	idContinueReading   = "default-continue-reading"
-	idRecentlyAdded     = "default-recently-added"
-	idRecommendedForYou = "default-recommended-for-you"
-	idReturningShows    = "default-returning-shows"
-	idTrendingDiscover  = "default-trending-discover"
+	idContinueWatching    = "default-continue-watching"
+	idContinueListening   = "default-continue-listening"
+	idContinueReading     = "default-continue-reading"
+	idRecentlyAdded       = "default-recently-added"
+	idRecentlyAddedMovies = "default-recently-added-movies"
+	idRecentlyAddedTV     = "default-recently-added-tv"
+	idRecommendedForYou   = "default-recommended-for-you"
+	idReturningShows      = "default-returning-shows"
+	idTrendingDiscover    = "default-trending-discover"
 )
 
 // DefaultItemLimit is the row size of default rows and of rows an admin
@@ -56,11 +61,13 @@ func libraryRowItemLimit(libraryType string) int {
 // DefaultHomeSections returns the canonical default sections for the home scope.
 // These are used for seeding fresh installs and the admin "Restore Defaults" action.
 //
-// Movies and TV share one Recently Added row; only book-type libraries add rows
-// of their own. Personalized rows (Recommended, Because You Watched, Returning
-// Shows) and TMDB trending stay empty, and clients hide them, until a profile
-// has history or the library has a match. Recently Added and Top Rated need
-// neither, so a new profile on a new server still has rows to browse.
+// Movies and TV get separate Recently Added rows, as on the library pages;
+// only book-type libraries add rows of their own. Trending This Week sits
+// directly below the continue rows. Personalized rows (Recommended, Because
+// You Watched, Returning Shows) and TMDB trending stay empty, and clients hide
+// them, until a profile has history or the library has a match. Recently
+// Added and Top Rated need neither, so a new profile on a new server still
+// has rows to browse.
 func DefaultHomeSections(libraries []*models.MediaFolder) []*PageSection {
 	result := []*PageSection{
 		{ID: idContinueWatching, Scope: scopeHome, SectionType: SectionContinueWatching, Title: titleContinueWatching, ItemLimit: DefaultItemLimit, Config: ContinueTypeConfig(ContinueTypeWatching), Enabled: true},
@@ -68,11 +75,15 @@ func DefaultHomeSections(libraries []*models.MediaFolder) []*PageSection {
 	if hasAudiobookLibrary(libraries) {
 		result = append(result, &PageSection{ID: idContinueListening, Scope: scopeHome, SectionType: SectionContinueWatching, Title: titleContinueListening, ItemLimit: betaLibraryItemLimit, Config: ContinueTypeConfig(ContinueTypeListening), Enabled: true})
 	}
-	result = append(result, &PageSection{ID: idRecentlyAdded, Scope: scopeHome, SectionType: SectionRecentlyAdded, Title: titleRecentlyAdded, ItemLimit: DefaultItemLimit, Config: defaultMediaScopeConfig(catalog.MediaScopeVideo), Enabled: true})
+	result = append(result,
+		&PageSection{ID: idTrendingDiscover, Scope: scopeHome, SectionType: SectionTrendingDiscover, Title: titleTrendingThisWeek, ItemLimit: DefaultItemLimit, Config: json.RawMessage(`{"source":"tmdb","window":"week"}`), Enabled: true},
+		&PageSection{ID: idRecentlyAddedMovies, Scope: scopeHome, SectionType: SectionRecentlyAdded, Title: titleRecentlyAddedMovies, ItemLimit: DefaultItemLimit, Config: defaultMediaScopeConfig("movie"), Enabled: true},
+		&PageSection{ID: idRecentlyAddedTV, Scope: scopeHome, SectionType: SectionRecentlyAdded, Title: titleRecentlyAddedTV, ItemLimit: DefaultItemLimit, Config: defaultMediaScopeConfig("series"), Enabled: true},
+	)
 
 	for _, library := range libraries {
 		if library == nil || IsVideoLibraryType(library.Type) {
-			continue // video libraries share the Recently Added row
+			continue // video libraries are covered by the split Recently Added rows
 		}
 		for _, section := range generatedHomeLibraryRecentDefaults(library.ID, library.Name, library.Type) {
 			section.ID = generatedHomeLibraryRecentID(section, library.ID)
@@ -84,7 +95,6 @@ func DefaultHomeSections(libraries []*models.MediaFolder) []*PageSection {
 		&PageSection{ID: idRecommendedForYou, Scope: scopeHome, SectionType: SectionRecommendedForYou, Title: titleRecommendedForYou, ItemLimit: DefaultItemLimit, Config: json.RawMessage(`{}`), Enabled: true},
 		&PageSection{ID: "default-because-you-watched", Scope: scopeHome, SectionType: SectionBecauseYouWatched, Title: defaultBecauseWatchedTitle, ItemLimit: DefaultItemLimit, Config: json.RawMessage(`{}`), Enabled: true},
 		&PageSection{ID: idReturningShows, Scope: scopeHome, SectionType: SectionReturningShows, Title: titleReturningShows, ItemLimit: DefaultItemLimit, Config: json.RawMessage(`{}`), Enabled: true},
-		&PageSection{ID: idTrendingDiscover, Scope: scopeHome, SectionType: SectionTrendingDiscover, Title: titleTrendingThisWeek, ItemLimit: DefaultItemLimit, Config: json.RawMessage(`{"source":"tmdb","window":"week"}`), Enabled: true},
 		&PageSection{ID: "default-top-rated", Scope: scopeHome, SectionType: SectionCriticallyAcclaimed, Title: titleTopRated, ItemLimit: DefaultItemLimit, Config: json.RawMessage(`{}`), Enabled: true},
 		&PageSection{ID: "default-hidden-gems", Scope: scopeHome, SectionType: SectionHiddenGems, Title: titleHiddenGems, ItemLimit: DefaultItemLimit, Config: json.RawMessage(`{"min_rating":7.5}`), Enabled: true},
 		&PageSection{
@@ -93,10 +103,8 @@ func DefaultHomeSections(libraries []*models.MediaFolder) []*PageSection {
 			SectionType: SectionSeasonalThemed,
 			Title:       "Seasonal Picks",
 			ItemLimit:   DefaultItemLimit,
-			Config: json.RawMessage(
-				`{"enabled_themes":["halloween","christmas","valentines","st_patricks","thanksgiving","summer_blockbuster","saturday_morning"]}`,
-			),
-			Enabled: true,
+			Config:      json.RawMessage(recipes.DefaultSeasonalConfig),
+			Enabled:     true,
 		},
 	)
 
@@ -107,7 +115,7 @@ func DefaultHomeSections(libraries []*models.MediaFolder) []*PageSection {
 }
 
 // IsVideoLibraryType reports whether a library holds movies or TV, the
-// libraries the shared home Recently Added row covers.
+// libraries the split home Recently Added rows cover.
 func IsVideoLibraryType(libraryType string) bool {
 	return librarykind.IsMovie(libraryType) || librarykind.IsTV(libraryType) || librarykind.IsMixed(libraryType)
 }
@@ -223,7 +231,7 @@ func DefaultLibrarySectionsForType(libraryID *int, libraryType string) []*PageSe
 	case "movies", "movie":
 		return []*PageSection{
 			{ID: idContinueWatching, Scope: scopeLibrary, LibraryID: libraryID, Position: 0, SectionType: SectionContinueWatching, Title: titleContinueWatching, ItemLimit: DefaultItemLimit, Config: continueWatchingCfg, Enabled: true},
-			{ID: "default-recently-added-movies", Scope: scopeLibrary, LibraryID: libraryID, Position: 1, SectionType: SectionRecentlyAdded, Title: "Recently Added Movies", ItemLimit: DefaultItemLimit, Config: defaultMediaScopeConfig("movie"), Enabled: true},
+			{ID: idRecentlyAddedMovies, Scope: scopeLibrary, LibraryID: libraryID, Position: 1, SectionType: SectionRecentlyAdded, Title: titleRecentlyAddedMovies, ItemLimit: DefaultItemLimit, Config: defaultMediaScopeConfig("movie"), Enabled: true},
 			{ID: "default-recently-released-movies", Scope: scopeLibrary, LibraryID: libraryID, Position: 2, SectionType: SectionRecentlyReleased, Title: "Recently Released Movies", ItemLimit: DefaultItemLimit, Config: defaultMediaScopeConfig("movie"), Enabled: true},
 			{ID: "default-top-rated-movies", Scope: scopeLibrary, LibraryID: libraryID, Position: 3, SectionType: SectionCustomFilter, Title: "Top Rated Movies", ItemLimit: DefaultItemLimit, Config: defaultTopRatedConfig("movie"), Enabled: true},
 			{ID: idRecommendedForYou, Scope: scopeLibrary, LibraryID: libraryID, Position: 4, SectionType: SectionRecommendedForYou, Title: titleRecommendedForYou, ItemLimit: DefaultItemLimit, Config: emptyCfg, Enabled: true},
@@ -232,7 +240,7 @@ func DefaultLibrarySectionsForType(libraryID *int, libraryType string) []*PageSe
 	case "series":
 		return []*PageSection{
 			{ID: idContinueWatching, Scope: scopeLibrary, LibraryID: libraryID, Position: 0, SectionType: SectionContinueWatching, Title: titleContinueWatching, ItemLimit: DefaultItemLimit, Config: continueWatchingCfg, Enabled: true},
-			{ID: "default-recently-added-tv", Scope: scopeLibrary, LibraryID: libraryID, Position: 1, SectionType: SectionRecentlyAdded, Title: "Recently Added TV", ItemLimit: DefaultItemLimit, Config: defaultMediaScopeConfig("series"), Enabled: true},
+			{ID: idRecentlyAddedTV, Scope: scopeLibrary, LibraryID: libraryID, Position: 1, SectionType: SectionRecentlyAdded, Title: titleRecentlyAddedTV, ItemLimit: DefaultItemLimit, Config: defaultMediaScopeConfig("series"), Enabled: true},
 			{ID: idReturningShows, Scope: scopeLibrary, LibraryID: libraryID, Position: 2, SectionType: SectionReturningShows, Title: titleReturningShows, ItemLimit: DefaultItemLimit, Config: emptyCfg, Enabled: true},
 			{ID: "default-recently-released-episodes", Scope: scopeLibrary, LibraryID: libraryID, Position: 3, SectionType: SectionCustomFilter, Title: "Recently Released Episodes", ItemLimit: DefaultItemLimit, Config: defaultRecentEpisodesConfig(), Enabled: true},
 			{ID: "default-top-rated-tv", Scope: scopeLibrary, LibraryID: libraryID, Position: 4, SectionType: SectionCustomFilter, Title: "Top Rated TV", ItemLimit: DefaultItemLimit, Config: defaultTopRatedConfig("series"), Enabled: true},
diff --git a/internal/sections/defaults_test.go b/internal/sections/defaults_test.go
index 2fc2887b99..071dcc000f 100644
--- a/internal/sections/defaults_test.go
+++ b/internal/sections/defaults_test.go
@@ -14,12 +14,19 @@ var sharedHomeDefaultTail = []string{
 	"default-recommended-for-you",
 	"default-because-you-watched",
 	"default-returning-shows",
-	"default-trending-discover",
 	"default-top-rated",
 	"default-hidden-gems",
 	"default-seasonal",
 }
 
+// splitVideoHomeRows are the default home rows below Continue Watching:
+// Trending This Week, then the split Recently Added rows.
+var splitVideoHomeRows = []string{
+	"default-trending-discover",
+	"default-recently-added-movies",
+	"default-recently-added-tv",
+}
+
 func assertHomeSectionIDs(t *testing.T, got []*PageSection, want []string) {
 	t.Helper()
 	ids := make([]string, len(got))
@@ -39,7 +46,7 @@ func assertHomeSectionIDs(t *testing.T, got []*PageSection, want []string) {
 
 func TestDefaultHomeSectionsWithoutLibraries(t *testing.T) {
 	got := DefaultHomeSections(nil)
-	assertHomeSectionIDs(t, got, append([]string{"default-continue-watching", "default-recently-added"}, sharedHomeDefaultTail...))
+	assertHomeSectionIDs(t, got, append(append([]string{"default-continue-watching"}, splitVideoHomeRows...), sharedHomeDefaultTail...))
 	assertContinueType(t, got[0].Config, ContinueTypeWatching)
 	for _, section := range got {
 		if section.ItemLimit != DefaultItemLimit {
@@ -48,7 +55,7 @@ func TestDefaultHomeSectionsWithoutLibraries(t *testing.T) {
 	}
 }
 
-func TestDefaultHomeSectionsShareRecentlyAddedAcrossVideoLibraries(t *testing.T) {
+func TestDefaultHomeSectionsSplitRecentlyAddedAcrossVideoLibraries(t *testing.T) {
 	libraries := []*models.MediaFolder{
 		{ID: 7, Name: "Movies", Type: "movies", SortOrder: 1},
 		{ID: 9, Name: "Shows", Type: "series", SortOrder: 2},
@@ -56,23 +63,35 @@ func TestDefaultHomeSectionsShareRecentlyAddedAcrossVideoLibraries(t *testing.T)
 	}
 
 	got := DefaultHomeSections(libraries)
-	assertHomeSectionIDs(t, got, append([]string{"default-continue-watching", "default-recently-added"}, sharedHomeDefaultTail...))
+	assertHomeSectionIDs(t, got, append(append([]string{"default-continue-watching"}, splitVideoHomeRows...), sharedHomeDefaultTail...))
 
-	recent := got[1]
-	if recent.SectionType != SectionRecentlyAdded || recent.Title != "Recently Added" {
-		t.Fatalf("shared row = %s %q, want recently_added \"Recently Added\"", recent.SectionType, recent.Title)
+	recentMovies, recentTV := got[2], got[3]
+	if recentMovies.SectionType != SectionRecentlyAdded || recentMovies.Title != "Recently Added Movies" {
+		t.Fatalf("movies row = %s %q, want recently_added \"Recently Added Movies\"", recentMovies.SectionType, recentMovies.Title)
+	}
+	if recentTV.SectionType != SectionRecentlyAdded || recentTV.Title != "Recently Added TV" {
+		t.Fatalf("TV row = %s %q, want recently_added \"Recently Added TV\"", recentTV.SectionType, recentTV.Title)
+	}
+	if !homeRecentlyAddedCoversItemType(recentMovies, "movie") || homeRecentlyAddedCoversItemType(recentMovies, "series") {
+		t.Fatal("movies row does not cover movies only")
 	}
-	if !IsSharedHomeRecentlyAddedSection(recent) {
-		t.Fatal("shared Recently Added row is not recognized as shared")
+	if !homeRecentlyAddedCoversItemType(recentTV, "series") || homeRecentlyAddedCoversItemType(recentTV, "movie") {
+		t.Fatal("TV row does not cover series only")
 	}
-	assertQueryDefinition(t, recent.Config, catalog.QueryDefinition{
-		MediaScope: catalog.MediaScopeVideo,
+	assertQueryDefinition(t, recentMovies.Config, catalog.QueryDefinition{
+		MediaScope: "movie",
+		Match:      "all",
+		Groups:     []catalog.QueryGroup{},
+		Sort:       catalog.QuerySort{Field: "added_at", Order: "desc"},
+	})
+	assertQueryDefinition(t, recentTV.Config, catalog.QueryDefinition{
+		MediaScope: "series",
 		Match:      "all",
 		Groups:     []catalog.QueryGroup{},
 		Sort:       catalog.QuerySort{Field: "added_at", Order: "desc"},
 	})
 
-	trending := got[slices.IndexFunc(got, func(s *PageSection) bool { return s.ID == "default-trending-discover" })]
+	trending := got[1]
 	if trending.SectionType != SectionTrendingDiscover {
 		t.Fatalf("trending type = %s, want %s", trending.SectionType, SectionTrendingDiscover)
 	}
@@ -88,20 +107,20 @@ func TestDefaultHomeSectionsKeepBookLibraryRows(t *testing.T) {
 	}
 
 	got := DefaultHomeSections(libraries)
-	assertHomeSectionIDs(t, got, append([]string{
+	assertHomeSectionIDs(t, got, append(append([]string{
 		"default-continue-watching",
 		"default-continue-listening",
-		"default-recently-added",
+	}, splitVideoHomeRows...), append([]string{
 		"default-home-recently_added-library-10",
 		"default-home-recently_released-library-10",
-	}, sharedHomeDefaultTail...))
+	}, sharedHomeDefaultTail...)...))
 	assertContinueType(t, got[0].Config, ContinueTypeWatching)
 	assertContinueType(t, got[1].Config, ContinueTypeListening)
 
-	if got[3].Title != "Recently Added in Books" {
-		t.Fatalf("book row title = %q, want %q", got[3].Title, "Recently Added in Books")
+	if got[5].Title != "Recently Added in Books" {
+		t.Fatalf("book row title = %q, want %q", got[5].Title, "Recently Added in Books")
 	}
-	if libraryID, ok := ParseGeneratedHomeLibraryRecentConfig(got[3].Config); !ok || libraryID != 10 {
+	if libraryID, ok := ParseGeneratedHomeLibraryRecentConfig(got[5].Config); !ok || libraryID != 10 {
 		t.Fatalf("book row generated library = %d ok = %v, want 10 true", libraryID, ok)
 	}
 }
@@ -149,25 +168,30 @@ func TestDefaultRowLimitsKeepBetaLibrariesAtOldSize(t *testing.T) {
 	}
 }
 
-func TestIsSharedHomeRecentlyAddedSection(t *testing.T) {
+func TestHomeRecentlyAddedCoversItemType(t *testing.T) {
 	seven := 7
 	tests := []struct {
-		name    string
-		section *PageSection
-		want    bool
+		name     string
+		section  *PageSection
+		itemType string
+		want     bool
 	}{
-		{"video scope", &PageSection{Scope: "home", SectionType: SectionRecentlyAdded, Config: defaultMediaScopeConfig("video")}, true},
-		{"unscoped", &PageSection{Scope: "home", SectionType: SectionRecentlyAdded, Config: json.RawMessage(`{}`)}, true},
-		{"movie scope", &PageSection{Scope: "home", SectionType: SectionRecentlyAdded, Config: defaultMediaScopeConfig("movie")}, false},
-		{"one library", &PageSection{Scope: "home", SectionType: SectionRecentlyAdded, Config: json.RawMessage(`{"filter_library_ids":[7]}`)}, false},
-		{"generated", &PageSection{Scope: "home", SectionType: SectionRecentlyAdded, Config: GeneratedHomeLibraryRecentConfig(7)}, false},
-		{"library page", &PageSection{Scope: "library", LibraryID: &seven, SectionType: SectionRecentlyAdded, Config: json.RawMessage(`{}`)}, false},
-		{"other type", &PageSection{Scope: "home", SectionType: SectionRecentlyReleased, Config: json.RawMessage(`{}`)}, false},
+		{"video scope covers movie", &PageSection{Scope: "home", SectionType: SectionRecentlyAdded, Config: defaultMediaScopeConfig("video")}, "movie", true},
+		{"video scope covers series", &PageSection{Scope: "home", SectionType: SectionRecentlyAdded, Config: defaultMediaScopeConfig("video")}, "series", true},
+		{"unscoped covers movie", &PageSection{Scope: "home", SectionType: SectionRecentlyAdded, Config: json.RawMessage(`{}`)}, "movie", true},
+		{"movie scope covers movie", &PageSection{Scope: "home", SectionType: SectionRecentlyAdded, Config: defaultMediaScopeConfig("movie")}, "movie", true},
+		{"movie scope misses series", &PageSection{Scope: "home", SectionType: SectionRecentlyAdded, Config: defaultMediaScopeConfig("movie")}, "series", false},
+		{"series scope covers series", &PageSection{Scope: "home", SectionType: SectionRecentlyAdded, Config: defaultMediaScopeConfig("series")}, "series", true},
+		{"series scope misses movie", &PageSection{Scope: "home", SectionType: SectionRecentlyAdded, Config: defaultMediaScopeConfig("series")}, "movie", false},
+		{"one library", &PageSection{Scope: "home", SectionType: SectionRecentlyAdded, Config: json.RawMessage(`{"filter_library_ids":[7]}`)}, "movie", false},
+		{"generated", &PageSection{Scope: "home", SectionType: SectionRecentlyAdded, Config: GeneratedHomeLibraryRecentConfig(7)}, "movie", false},
+		{"library page", &PageSection{Scope: "library", LibraryID: &seven, SectionType: SectionRecentlyAdded, Config: json.RawMessage(`{}`)}, "movie", false},
+		{"other type", &PageSection{Scope: "home", SectionType: SectionRecentlyReleased, Config: json.RawMessage(`{}`)}, "movie", false},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if got := IsSharedHomeRecentlyAddedSection(tt.section); got != tt.want {
-				t.Fatalf("IsSharedHomeRecentlyAddedSection = %v, want %v", got, tt.want)
+			if got := homeRecentlyAddedCoversItemType(tt.section, tt.itemType); got != tt.want {
+				t.Fatalf("homeRecentlyAddedCoversItemType(%q) = %v, want %v", tt.itemType, got, tt.want)
 			}
 		})
 	}
diff --git a/internal/sections/fetch_error_log_test.go b/internal/sections/fetch_error_log_test.go
new file mode 100644
index 0000000000..797ca03ccf
--- /dev/null
+++ b/internal/sections/fetch_error_log_test.go
@@ -0,0 +1,33 @@
+package sections
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+	"testing"
+)
+
+// A row that failed only because the caller went away logs at debug from every
+// caller of LogFetchError. The same cancellation while the caller is still there
+// is a real failure and still logs an ERROR.
+func TestLogFetchErrorLogsAbandonedFetchAtDebug(t *testing.T) {
+	logs := recordSectionLogs(t)
+	row := ResolvedSection{ID: "row", SectionType: SectionCollection}
+	canceled := fmt.Errorf("loading row: %w", context.Canceled)
+
+	gone, cancel := context.WithCancel(t.Context())
+	cancel()
+	LogFetchError(gone, "api", row, canceled)
+	if errs := logs.messages(slog.LevelError); len(errs) != 0 {
+		t.Fatalf("ERROR records after the caller left = %q, want none", errs)
+	}
+	if debug := logs.messages(slog.LevelDebug); len(debug) != 1 || debug[0] != "fetching section items" {
+		t.Fatalf("DEBUG records after the caller left = %q, want one fetching section items record", debug)
+	}
+
+	logs.reset()
+	LogFetchError(t.Context(), "api", row, canceled)
+	if errs := logs.messages(slog.LevelError); len(errs) != 1 || errs[0] != "fetching section items" {
+		t.Fatalf("ERROR records with the caller still there = %q, want one fetching section items record", errs)
+	}
+}
diff --git a/internal/sections/fetcher.go b/internal/sections/fetcher.go
index 0d60cf8081..178c457ce1 100644
--- a/internal/sections/fetcher.go
+++ b/internal/sections/fetcher.go
@@ -20,6 +20,7 @@ import (
 	"golang.org/x/sync/singleflight"
 
 	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/ctxerr"
 	"github.com/prairie-server/prairie-server/internal/logredact"
 	"github.com/prairie-server/prairie-server/internal/models"
 	"github.com/prairie-server/prairie-server/internal/recommendations"
@@ -48,7 +49,7 @@ type SectionItemMeta struct {
 	DurationSeconds   *float64
 	ProgressUpdatedAt *string
 	ItemSource        string    // "in_progress" or "next_up"
-	SortTimestamp     time.Time // when the preceding episode was completed (for ordering)
+	SortTimestamp     time.Time // orders Continue Watching: progress time, or a next-up row's catalog.NextUpResult.ActivityAt
 }
 
 const recentSeasonPremiereBadgeWindowDays = 14
@@ -66,11 +67,16 @@ const fetchAllMaxConcurrency = 6
 const slowSectionFetchThreshold = 500 * time.Millisecond
 const slowAggregateFetchThreshold = time.Second
 
+// recommendationReader reads the recommendation rows sections show. Each
+// read returns the row's whole cached pool; the fetcher scopes it to the
+// section's libraries and trims it to the section's item limit.
+// SectionForYouFill is read only when a library leaves the For You row short.
 type recommendationReader interface {
-	GetForYouMain(ctx context.Context, userID int, profileID string, limit int, filter catalog.AccessFilter) (*recommendations.ForYouRow, error)
-	GetBecauseYouWatched(ctx context.Context, userID int, profileID, sourceItemID string, limit int, filter catalog.AccessFilter) ([]recommendations.ScoredItem, error)
-	GetSimilarUsersLiked(ctx context.Context, userID int, profileID string, limit int, filter catalog.AccessFilter) ([]recommendations.ScoredItem, error)
-	GetTasteMatchRow(ctx context.Context, userID int, profileID, genre string, limit int, filter catalog.AccessFilter) (*recommendations.ForYouRow, error)
+	SectionForYouMain(ctx context.Context, userID int, profileID string, filter catalog.AccessFilter) (*recommendations.ForYouRow, error)
+	SectionForYouFill(ctx context.Context, userID int, profileID string, filter catalog.AccessFilter) ([]recommendations.ScoredItem, error)
+	SectionBecauseYouWatched(ctx context.Context, userID int, profileID, sourceItemID string, libraryIDs []int, filter catalog.AccessFilter) ([]recommendations.ScoredItem, string, error)
+	SectionSimilarUsersLiked(ctx context.Context, userID int, profileID string, filter catalog.AccessFilter) ([]recommendations.ScoredItem, error)
+	SectionTasteMatchRow(ctx context.Context, userID int, profileID, genre string, filter catalog.AccessFilter) (*recommendations.ForYouRow, error)
 }
 
 // trendingSnapshotGetter is the read side of the trending snapshot table.
@@ -79,6 +85,18 @@ type trendingSnapshotGetter interface {
 	Get(ctx context.Context, source, window string) (TrendingSnapshot, bool, error)
 }
 
+// seasonalListGetter is the read side of the seasonal list snapshots.
+// Satisfied by *SeasonalListRepository.
+type seasonalListGetter interface {
+	Get(ctx context.Context, listURL string) (SeasonalListSnapshot, bool, error)
+}
+
+// seasonalNeighborFinder finds library titles near a seasonal list's theme.
+// Satisfied by *recommendations.Repo.
+type seasonalNeighborFinder interface {
+	ThemeNeighbors(ctx context.Context, seedIDs []string, limit int, filter catalog.AccessFilter) ([]recommendations.ScoredItem, error)
+}
+
 // Fetcher runs section queries against the database.
 type Fetcher struct {
 	pool                 *pgxpool.Pool
@@ -110,6 +128,15 @@ type Fetcher struct {
 	candidateCache   *editorialCandidateCache
 	candidateGroup   singleflight.Group
 
+	// SeasonalLists reads the stored MDBList lists behind seasonal rows. Nil
+	// renders seasonal rows empty.
+	SeasonalLists seasonalListGetter
+	// SeasonalResolver matches seasonal list entries to library titles.
+	SeasonalResolver externalIDResolver
+	// SeasonalNeighbors fills a seasonal row from the library's closest
+	// matches by recommendation embedding. Nil shows list titles only.
+	SeasonalNeighbors seasonalNeighborFinder
+
 	// Clock returns the current time. Defaults to recipes.RealClock{}.
 	// Clock controls time-based seasonal and editorial resolution.
 	Clock recipes.Clock
@@ -121,6 +148,7 @@ func NewFetcher(pool *pgxpool.Pool) *Fetcher {
 		pool:                pool,
 		progressFilter:      catalog.NewContinueWatchingProgressFilter(pool),
 		watchlistVisibility: catalog.NewWatchlistVisibilityFromRepos(catalog.NewItemRepository(pool), catalog.NewEpisodeRepository(pool)),
+		SeasonalResolver:    catalog.NewItemRepository(pool),
 		Clock:               recipes.RealClock{},
 	}
 }
@@ -313,9 +341,13 @@ func (f *Fetcher) FetchOne(ctx context.Context, resolved ResolvedSection, librar
 		f.logSlowSectionFetch(resolved, libraryID, libraryIDs, result, time.Since(start), err)
 	}()
 
-	if resolved.SectionType == SectionBecauseYouWatched {
-		if reader, ok := f.RecommendationReader.(becauseWatchedSourceReader); ok {
-			result, err = f.fetchBecauseWatchedWithTitle(ctx, resolved, libraryID, libraryIDs, userID, profileID, filter, reader)
+	if f.RecommendationReader != nil {
+		switch resolved.SectionType {
+		case SectionBecauseYouWatched:
+			result, err = f.fetchBecauseWatchedWithTitle(ctx, resolved, libraryID, libraryIDs, userID, profileID, filter, f.RecommendationReader)
+			return result, err
+		case SectionRecommendedForYou, SectionTasteMatch:
+			result, err = f.fetchRecommendationRowWithTitle(ctx, resolved, libraryID, libraryIDs, userID, profileID, filter, f.RecommendationReader)
 			return result, err
 		}
 	}
@@ -340,6 +372,9 @@ func (f *Fetcher) FetchOne(ctx context.Context, resolved ResolvedSection, librar
 		} else {
 			items, total, title, err = f.fetchGenreRouletteWithTitle(ctx, resolved, libraryID, libraryIDs, filter)
 		}
+		if err == nil {
+			items, total = f.withoutNotInterested(ctx, resolved, userID, profileID, items, total)
+		}
 		if err != nil {
 			return SectionWithItems{}, err
 		}
@@ -374,17 +409,21 @@ func (f *Fetcher) FetchOne(ctx context.Context, resolved ResolvedSection, librar
 	} else {
 		items, total, err = f.fetchSection(ctx, resolved, libraryID, libraryIDs, userID, profileID, filter)
 	}
+	if err == nil && HidesNotInterested(resolved.SectionType) {
+		// Marks are per profile, so they leave the row after the shared cache.
+		items, total = f.withoutNotInterested(ctx, resolved, userID, profileID, items, total)
+	}
 	if err != nil {
 		return SectionWithItems{}, err
 	}
 
-	// Apply seasonal title override when the active theme has a custom name.
-	// Done here (rather than inside fetchSeasonalThemed) so the section's
-	// stored Title is preserved as the fallback used by callers that bypass
-	// SectionWithItems construction.
+	// A seasonal row takes the in-season title of what it shows (a custom
+	// title, else the vibe's). Done here rather than inside
+	// fetchSeasonalThemed so the section's stored Title stays the fallback for
+	// callers that bypass SectionWithItems construction.
 	if resolved.SectionType == SectionSeasonalThemed && len(items) > 0 {
-		if title := f.seasonalTitleOverride(resolved); title != "" {
-			resolved.Title = title
+		if pick, ok := f.activeSeasonalPick(resolved.Config); ok && pick.Title != "" {
+			resolved.Title = pick.Title
 		}
 	}
 
@@ -420,26 +459,13 @@ func (f *Fetcher) logSlowSectionFetch(resolved ResolvedSection, libraryID *int,
 	slog.Warn("slow section fetch", attrs...)
 }
 
-// seasonalTitleOverride returns the per-theme display name override for a
-// seasonal section, or "" when no override applies.
-func (f *Fetcher) seasonalTitleOverride(resolved ResolvedSection) string {
-	if len(resolved.Config) == 0 {
-		return ""
-	}
+// activeSeasonalPick returns what a seasonal row with this config shows now.
+func (f *Fetcher) activeSeasonalPick(config json.RawMessage) (recipes.SeasonalPick, bool) {
 	var p recipes.SeasonalThemedParams
-	if err := json.Unmarshal(resolved.Config, &p); err != nil {
-		return ""
-	}
-	if len(p.ThemeTitles) == 0 {
-		return ""
+	if len(config) > 0 && json.Unmarshal(config, &p) != nil {
+		return recipes.SeasonalPick{}, false
 	}
-	now := time.Now()
-	if f.Clock != nil {
-		now = f.Clock.Now()
-	}
-	// Same usable filter as fetchSeasonalThemed so the override tracks the
-	// theme that actually resolved.
-	return recipes.SeasonalTitleOverride(p, now, seasonalThemeHasQuery)
+	return recipes.ActiveSeasonalPick(p, f.now())
 }
 
 func (f *Fetcher) fetchContinueWatchingSection(ctx context.Context, resolved ResolvedSection, libraryID *int, libraryIDs []int, userID int, profileID string, filter catalog.AccessFilter) (SectionWithItems, error) {
@@ -486,7 +512,7 @@ func (f *Fetcher) fetchContinueWatchingSection(ctx context.Context, resolved Res
 	// watch-progress store, so reading sections pull from that table and skip
 	// the next-up handling below.
 	if continueType == ContinueTypeReading {
-		orderedItems, err = f.collectContinueProgressItems(ctx, store, profileID, dismissals, catalog.DroppedSeriesSet{}, continueType, effectiveLibID, effectiveLibraryIDs, filter, limit, orderedItems, itemMeta, completedCache,
+		orderedItems, err = f.collectContinueProgressItems(ctx, store, profileID, dismissals, catalog.DroppedSeriesSet{}, continueType, effectiveLibID, effectiveLibraryIDs, filter, limit, false, orderedItems, itemMeta, completedCache,
 			func(pageLimit, offset int) ([]userstore.WatchProgress, error) {
 				entries, err := f.listEbookContinueWatchingProgress(ctx, userID, profileID, pageLimit, offset)
 				if err != nil {
@@ -513,8 +539,11 @@ func (f *Fetcher) fetchContinueWatchingSection(ctx context.Context, resolved Res
 		}, nil
 	}
 
+	combined := ContinueTypeAllowsNextUp(continueType) && !resolved.SuppressNextUp &&
+		NextUpMode(ctx, store, profileID) == NextUpModeCombined
+
 	dropped := f.activeDroppedSeries(ctx, userID, profileID)
-	orderedItems, err = f.collectContinueProgressItems(ctx, store, profileID, dismissals, dropped, continueType, effectiveLibID, effectiveLibraryIDs, filter, limit, orderedItems, itemMeta, completedCache,
+	orderedItems, err = f.collectContinueProgressItems(ctx, store, profileID, dismissals, dropped, continueType, effectiveLibID, effectiveLibraryIDs, filter, limit, combined, orderedItems, itemMeta, completedCache,
 		func(pageLimit, offset int) ([]userstore.WatchProgress, error) {
 			entries, err := store.ListProgress(ctx, profileID, "in_progress", pageLimit, offset)
 			if err != nil {
@@ -526,30 +555,35 @@ func (f *Fetcher) fetchContinueWatchingSection(ctx context.Context, resolved Res
 		return SectionWithItems{}, err
 	}
 
-	nextUpMode := ""
-	if ContinueTypeAllowsNextUp(continueType) && !resolved.SuppressNextUp {
-		nextUpMode = NextUpMode(ctx, store, profileID)
-	}
-	if ContinueTypeAllowsNextUp(continueType) && nextUpMode == NextUpModeCombined {
-		nextUpItems, nextUpMeta, nextUpErr := f.FetchNextUpItems(ctx, userID, profileID, effectiveLibID, effectiveLibraryIDs, filter, limit)
+	// Combined mode merges next-up cards into the row and keeps the newest
+	// limit cards of the two. A next-up card normally sorts by when its
+	// previous episode was completed, so once the in-progress cards fill the
+	// row the lookup only needs series completed since the oldest of them.
+	// With new releases first, a series finished before all of them still
+	// leads the row when its next episode was just released, so the lookup is
+	// not bounded.
+	if combined {
+		newReleasesFirst := NextUpNewReleasesFirst(ctx, store, profileID)
+		var since *time.Time
+		if !newReleasesFirst {
+			since = continueNextUpCutoff(orderedItems, itemMeta, limit)
+		}
+		nextUpItems, nextUpMeta, nextUpErr := f.fetchNextUpItems(ctx, userID, profileID, effectiveLibID, effectiveLibraryIDs, filter, limit, since, newReleasesFirst)
 		if nextUpErr != nil {
 			slog.ErrorContext(ctx, "fetching next-up items", "component", "sections", "error", nextUpErr)
 		} else {
 			orderedItems = append(orderedItems, nextUpItems...)
 			maps.Copy(itemMeta, nextUpMeta)
 		}
-	}
-
-	if nextUpMode == NextUpModeCombined && len(orderedItems) > 1 {
 		orderedItems = collapseContinueWatchingSeriesCandidates(orderedItems, itemMeta)
-	}
-
-	if nextUpMode == NextUpModeCombined && len(orderedItems) > 1 {
 		sort.SliceStable(orderedItems, func(i, j int) bool {
 			left := itemMeta[orderedItems[i].ContentID].SortTimestamp
 			right := itemMeta[orderedItems[j].ContentID].SortTimestamp
 			return left.After(right)
 		})
+		if len(orderedItems) > limit {
+			orderedItems = orderedItems[:limit]
+		}
 	}
 
 	if orderedItems == nil {
@@ -571,7 +605,9 @@ func (f *Fetcher) fetchContinueWatchingSection(ctx context.Context, resolved Res
 // exhausted, or continueProgressMaxScanned entries have been scanned. Paging
 // past the requested limit matters because dismissal filtering and
 // library/access scoping happen after the source query: trimming at the
-// source LIMIT would under-fill the section whenever dismissals exist.
+// source LIMIT would under-fill the section whenever dismissals exist. With
+// collapseSeries, a series' in-progress episodes count as one card, as the
+// combined row shows them.
 func (f *Fetcher) collectContinueProgressItems(
 	ctx context.Context,
 	store userstore.UserStore,
@@ -583,6 +619,7 @@ func (f *Fetcher) collectContinueProgressItems(
 	libraryIDs []int,
 	filter catalog.AccessFilter,
 	limit int,
+	collapseSeries bool,
 	orderedItems []*models.MediaItem,
 	itemMeta map[string]SectionItemMeta,
 	completedCache *catalog.CompletedProgressCache,
@@ -620,8 +657,8 @@ func (f *Fetcher) collectContinueProgressItems(
 		if err != nil {
 			return nil, err
 		}
-		orderedItems = appendUniqueContinueItems(orderedItems, pageItems, seen, limit)
 		maps.Copy(itemMeta, pageMeta)
+		orderedItems = appendContinuePage(orderedItems, pageItems, itemMeta, seen, limit, collapseSeries)
 		if rawProgressCount < pageLimit {
 			break
 		}
@@ -629,25 +666,53 @@ func (f *Fetcher) collectContinueProgressItems(
 	return orderedItems, nil
 }
 
-// appendUniqueContinueItems appends pageItems to orderedItems up to limit,
-// skipping content IDs already recorded in seen and recording every appended
-// ID. Pages come from a live LIMIT/OFFSET scan, so without this guard an item
+// appendContinuePage appends one page of cards to orderedItems, skipping
+// content IDs already recorded in seen and recording every appended ID, then
+// with collapseSeries keeps one card per series, and trims the row to limit.
+// Pages come from a live LIMIT/OFFSET scan, so without the seen guard an item
 // shifted across a page boundary by a concurrent progress write would surface
-// twice in the same section.
-func appendUniqueContinueItems(orderedItems, pageItems []*models.MediaItem, seen map[string]struct{}, limit int) []*models.MediaItem {
+// twice in the same section. The whole page goes in before the trim because
+// collapsing can shrink the row: trimming first would drop this page's later
+// cards while the next page's older ones took their places.
+func appendContinuePage(orderedItems, pageItems []*models.MediaItem, meta map[string]SectionItemMeta, seen map[string]struct{}, limit int, collapseSeries bool) []*models.MediaItem {
 	for _, item := range pageItems {
-		if len(orderedItems) >= limit {
-			break
-		}
 		if _, dup := seen[item.ContentID]; dup {
 			continue
 		}
 		seen[item.ContentID] = struct{}{}
 		orderedItems = append(orderedItems, item)
 	}
+	if collapseSeries {
+		orderedItems = collapseContinueWatchingSeriesCandidates(orderedItems, meta)
+	}
+	if len(orderedItems) > limit {
+		orderedItems = orderedItems[:limit]
+	}
 	return orderedItems
 }
 
+// continueNextUpCutoff bounds the next-up lookup of a combined row. When the
+// in-progress cards fill the row on their own, a next-up card older than all
+// of them sorts below limit cards and cannot make the row, so the lookup only
+// needs series completed at or after the oldest in-progress card. Nil when
+// the row is not full or a card has no timestamp to sort by.
+func continueNextUpCutoff(items []*models.MediaItem, meta map[string]SectionItemMeta, limit int) *time.Time {
+	if len(items) < limit {
+		return nil
+	}
+	var oldest time.Time
+	for i, item := range items {
+		ts := meta[item.ContentID].SortTimestamp
+		if ts.IsZero() {
+			return nil
+		}
+		if i == 0 || ts.Before(oldest) {
+			oldest = ts
+		}
+	}
+	return &oldest
+}
+
 // ebookContinueWatchingProgressQuery lists in-progress ebook resume points for
 // Continue Reading. Like the video path (pgstore ListProgress "in_progress"),
 // rows the user hid via user_history_hidden_items are excluded while reading
@@ -808,7 +873,7 @@ func (f *Fetcher) fetchNextUpSection(ctx context.Context, resolved ResolvedSecti
 		limit = 20
 	}
 
-	items, meta, err := f.FetchNextUpItems(ctx, userID, profileID, libraryID, libraryIDs, filter, limit)
+	items, meta, err := f.fetchNextUpItems(ctx, userID, profileID, libraryID, libraryIDs, filter, limit, nil, NextUpNewReleasesFirst(ctx, store, profileID))
 	if err != nil {
 		return SectionWithItems{}, err
 	}
@@ -830,17 +895,35 @@ func (f *Fetcher) fetchNextUpSection(ctx context.Context, resolved ResolvedSecti
 // FetchNextUpItems returns the next unwatched episode per series for the given user profile.
 // It delegates to NextUpRepository for the optimized LATERAL JOIN query, then resolves
 // the full MediaItem objects via fetchEpisodeTargetsByContentIDs.
+// The order follows the profile's ui.next_up_new_releases_first.
 func (f *Fetcher) FetchNextUpItems(ctx context.Context, userID int, profileID string, libraryID *int, libraryIDs []int, filter catalog.AccessFilter, limit int) ([]*models.MediaItem, map[string]SectionItemMeta, error) {
+	if f.NextUpRepo == nil || f.StoreProvider == nil {
+		return nil, nil, nil
+	}
+	store, err := f.StoreProvider.ForUser(ctx, userID)
+	if err != nil {
+		return nil, nil, fmt.Errorf("getting user store: %w", err)
+	}
+	return f.fetchNextUpItems(ctx, userID, profileID, libraryID, libraryIDs, filter, limit, nil, NextUpNewReleasesFirst(ctx, store, profileID))
+}
+
+// fetchNextUpItems is FetchNextUpItems with the profile's new-releases-first
+// preference already resolved, limited when since is set to series whose
+// newest completed episode is at or after since.
+func (f *Fetcher) fetchNextUpItems(ctx context.Context, userID int, profileID string, libraryID *int, libraryIDs []int, filter catalog.AccessFilter, limit int, since *time.Time, newReleasesFirst bool) ([]*models.MediaItem, map[string]SectionItemMeta, error) {
 	if f.NextUpRepo == nil {
 		return nil, nil, nil
 	}
 
 	results, err := f.NextUpRepo.ListNextUp(ctx, catalog.NextUpQuery{
-		UserID:     userID,
-		ProfileID:  profileID,
-		LibraryID:  libraryID,
-		LibraryIDs: libraryIDs,
-		Limit:      limit,
+		UserID:        userID,
+		ProfileID:     profileID,
+		LibraryID:     libraryID,
+		LibraryIDs:    libraryIDs,
+		AccessFilter:  filter,
+		Limit:         limit,
+		DateCutoff:    since,
+		RankByRelease: newReleasesFirst,
 	})
 	if err != nil {
 		return nil, nil, err
@@ -878,7 +961,7 @@ func (f *Fetcher) FetchNextUpItems(ctx context.Context, userID int, profileID st
 			continue
 		}
 		m.ItemSource = "next_up"
-		m.SortTimestamp = res.CompletedAt
+		m.SortTimestamp = res.ActivityAt
 		meta[res.ContentID] = m
 
 		item, ok := itemByID[res.ContentID]
@@ -1129,12 +1212,20 @@ func (f *Fetcher) FetchAll(ctx context.Context, resolved []ResolvedSection, libr
 // LogFetchError records a section that failed to load and is shown empty. A
 // row whose server or personal collection was deleted is expected to stay on
 // a layout until someone removes it, so it logs at debug instead of error.
+// So does a fetch that failed only because the caller went away.
 func LogFetchError(ctx context.Context, component string, sec ResolvedSection, err error) {
-	if errors.Is(err, catalog.ErrLibraryCollectionNotFound) || errors.Is(err, userstore.ErrCollectionNotFound) {
+	if IsMissingCollection(err) {
 		slog.DebugContext(ctx, "section collection no longer exists", "component", component, "section_id", sec.ID, "type", sec.SectionType, "error", err)
 		return
 	}
-	slog.ErrorContext(ctx, "fetching section items", "component", component, "section_id", sec.ID, "type", sec.SectionType, "error", err)
+	slog.Log(ctx, ctxerr.LogLevel(ctx, err, slog.LevelError), "fetching section items", "component", component, "section_id", sec.ID, "type", sec.SectionType, "error", err)
+}
+
+// IsMissingCollection reports whether a fetch failed only because the
+// section's collection no longer exists. Such a section shows an empty row
+// rather than failing the read.
+func IsMissingCollection(err error) bool {
+	return errors.Is(err, catalog.ErrLibraryCollectionNotFound) || errors.Is(err, userstore.ErrCollectionNotFound)
 }
 
 type sectionFetchRunner func(context.Context, ResolvedSection) (SectionWithItems, error)
@@ -1718,62 +1809,69 @@ func limitUserCollectionSectionItems(items []*models.MediaItem, limit int) ([]*m
 	return items, total
 }
 
+// fetchRecommendationSection reads the row's whole cached pool, scopes it to
+// the section's libraries, then trims it to the section's item limit, so a
+// library's row fills from every cached candidate in that library rather than
+// only those in the row's first page. Because You Watched, For You and taste
+// match take a FetchOne branch whenever a reader is wired, which titles the
+// section after the row it serves.
 func (f *Fetcher) fetchRecommendationSection(ctx context.Context, s ResolvedSection, libraryID *int, libraryIDs []int, userID int, profileID string, filter catalog.AccessFilter) ([]*models.MediaItem, int, error) {
-	if f.RecommendationReader == nil {
+	if f.RecommendationReader == nil || s.SectionType != SectionSimilarUsersLiked {
 		return []*models.MediaItem{}, 0, nil // graceful degradation
 	}
+	scoredItems, err := f.RecommendationReader.SectionSimilarUsersLiked(ctx, userID, profileID, filter)
+	if err != nil {
+		return []*models.MediaItem{}, 0, err
+	}
 
-	cfg := parseRecommendationSectionConfig(s.Config)
-	var scoredItems []recommendations.ScoredItem
-	switch s.SectionType {
-	case SectionRecommendedForYou:
-		row, err := f.RecommendationReader.GetForYouMain(ctx, userID, profileID, s.ItemLimit, filter)
-		if err != nil || row == nil {
-			return []*models.MediaItem{}, 0, err
-		}
-		scoredItems = row.Items
-	case SectionBecauseYouWatched:
-		items, err := f.RecommendationReader.GetBecauseYouWatched(ctx, userID, profileID, cfg.anchor(), s.ItemLimit, filter)
-		if err != nil {
-			return []*models.MediaItem{}, 0, err
-		}
-		scoredItems = items
-	case SectionSimilarUsersLiked:
-		items, err := f.RecommendationReader.GetSimilarUsersLiked(ctx, userID, profileID, s.ItemLimit, filter)
-		if err != nil {
-			return []*models.MediaItem{}, 0, err
-		}
-		scoredItems = items
-	case SectionTasteMatch:
-		// An empty genre is valid: the reader auto-picks the profile's
-		// strongest taste cluster (falling back to the server top genre).
-		row, err := f.RecommendationReader.GetTasteMatchRow(ctx, userID, profileID, strings.TrimSpace(cfg.Genre), s.ItemLimit, filter)
-		if err != nil || row == nil {
-			return []*models.MediaItem{}, 0, err
-		}
-		scoredItems = row.Items
-	default:
-		return []*models.MediaItem{}, 0, nil
+	orderedItems, err := f.scopeRecommendationItems(ctx, scoredItems, libraryID, libraryIDs, filter)
+	if err != nil {
+		return nil, 0, err
 	}
+	orderedItems = limitRecommendationItems(orderedItems, s.ItemLimit)
+	return orderedItems, len(orderedItems), nil
+}
 
-	if len(scoredItems) == 0 {
-		return []*models.MediaItem{}, 0, nil
+// scopeRecommendationItems loads the scored items that are in the section's
+// library scope, keeping their order.
+func (f *Fetcher) scopeRecommendationItems(ctx context.Context, scored []recommendations.ScoredItem, libraryID *int, libraryIDs []int, filter catalog.AccessFilter) ([]*models.MediaItem, error) {
+	if len(scored) == 0 {
+		return []*models.MediaItem{}, nil
+	}
+	ids := make([]string, len(scored))
+	for i, item := range scored {
+		ids[i] = item.MediaItemID
+	}
+	items, err := f.fetchItemsByContentIDs(ctx, ids, libraryID, libraryIDs, filter)
+	if err != nil {
+		return nil, err
 	}
+	return orderMediaItems(items, ids), nil
+}
 
-	// Resolve item IDs to full MediaItem objects
-	itemIDs := make([]string, len(scoredItems))
-	for i, item := range scoredItems {
-		itemIDs[i] = item.MediaItemID
+// limitRecommendationItems cuts a recommendation row to the section's row
+// size (see recommendationSectionLimit).
+func limitRecommendationItems(items []*models.MediaItem, itemLimit int) []*models.MediaItem {
+	itemLimit = recommendationSectionLimit(itemLimit)
+	if len(items) > itemLimit {
+		return items[:itemLimit]
 	}
+	return items
+}
 
-	mediaItems, err := f.fetchItemsByContentIDs(ctx, itemIDs, libraryID, libraryIDs, filter)
-	if err != nil {
-		return nil, 0, err
+// recommendationSectionLimit is a recommendation section's row size: its
+// item limit, or defaultRecommendationSectionLimit when it sets none.
+func recommendationSectionLimit(itemLimit int) int {
+	if itemLimit <= 0 {
+		return defaultRecommendationSectionLimit
 	}
-	orderedItems := orderMediaItems(mediaItems, itemIDs)
-	return orderedItems, len(orderedItems), nil
+	return itemLimit
 }
 
+// defaultRecommendationSectionLimit is the row size of a recommendation
+// section that sets no item limit, the size the reader's public reads use.
+const defaultRecommendationSectionLimit = 20
+
 func (f *Fetcher) fetchHiddenGems(ctx context.Context, s ResolvedSection, libraryID *int, libraryIDs []int, userID int, profileID string, filter catalog.AccessFilter) ([]*models.MediaItem, int, error) {
 	var p recipes.HiddenGemsParams
 	if len(s.Config) > 0 {
@@ -3154,6 +3252,8 @@ func itemColumnsList(alias string) []string {
 	cols := []string{
 		"content_id", "type", "title", "sort_title", "original_title", "year", "genres",
 		"content_rating", "runtime", "overview", "tagline",
+		// Localizing a card compares its target language with these.
+		"default_metadata_language", "original_language",
 		"rating_imdb", "rating_tmdb", "rating_rt_critic", "rating_rt_audience",
 		"imdb_id", "tmdb_id", "tvdb_id",
 		"poster_path", "poster_thumbhash", "backdrop_path", "backdrop_thumbhash", "logo_path",
@@ -3233,6 +3333,7 @@ func scanMediaItems(rows pgx.Rows) ([]*models.MediaItem, error) {
 		err := rows.Scan(
 			&item.ContentID, &item.Type, &item.Title, &item.SortTitle, &item.OriginalTitle,
 			&item.Year, &item.Genres, &item.ContentRating, &item.Runtime, &item.Overview, &item.Tagline,
+			&item.DefaultMetadataLanguage, &item.OriginalLanguage,
 			&item.RatingIMDB, &item.RatingTMDB, &item.RatingRTCritic, &item.RatingRTAudience,
 			&item.ImdbID, &item.TmdbID, &item.TvdbID,
 			&item.PosterPath, &item.PosterThumbhash, &item.BackdropPath, &item.BackdropThumbhash, &item.LogoPath,
@@ -3272,7 +3373,7 @@ func newTrendingEntry(tmdbID, tvdbID int, imdbID, mediaType string) trendingDisc
 	return e
 }
 
-// fetchTrendingDiscover surfaces external global trending (TMDB or Trakt),
+// fetchTrendingDiscover surfaces external global trending (TMDB),
 // mixing movies + series, matched to titles in the viewer's enabled libraries.
 // The external fetch + ID resolution are cached briefly so it does not hit the
 // upstream API on every home-page load.
@@ -3706,203 +3807,93 @@ func matchesContinueWatchingFilter(filterType string, itemType string) bool {
 	}
 }
 
-// fetchSeasonalThemed returns items for a seasonal_themed section.
-//
-// Multi-theme mode (EnabledThemes set): picks the highest-priority enabled
-// theme whose predicate matches now and queries items for that theme. Off-
-// season (no enabled theme matches) the section is empty and gets suppressed
-// by the API dispatcher.
-//
-// Legacy single-theme mode (Theme set, EnabledThemes empty): mode controls
-// suppression — "auto" hides off-season, "pinned" always renders.
+const (
+	// seasonalSeedCount is how many of a list's most popular owned titles
+	// define its theme for the recommendation fill.
+	seasonalSeedCount = 40
+	// seasonalNeighborScanMin is the fewest nearest titles the fill scans; the
+	// median-seed cutoff and the section's scope then trim them.
+	seasonalNeighborScanMin = 80
+)
+
+// fetchSeasonalThemed returns items for a seasonal_themed section: the titles
+// of the in-season list the library owns, most popular on IMDb first. Unless
+// the row is set to lists only, a row the list cannot fill is topped up with
+// the library's closest matches to the list's theme by recommendation
+// embedding. Off season (nothing picked) the section is empty and the API
+// drops it.
 func (f *Fetcher) fetchSeasonalThemed(ctx context.Context, s ResolvedSection, libraryID *int, libraryIDs []int, filter catalog.AccessFilter) ([]*models.MediaItem, int, error) {
 	var p recipes.SeasonalThemedParams
 	if len(s.Config) > 0 {
 		_ = json.Unmarshal(s.Config, &p)
 	}
-
-	now := time.Now()
-	if f.Clock != nil {
-		now = f.Clock.Now()
-	}
-
-	// Resolve which theme to use. Multi-theme mode wins when populated.
-	// Selection skips themes without an executable query so a data-less theme
-	// never blacks out the section during its own window (see
-	// ActiveSeasonalThemeWhere).
-	var theme string
-	switch {
-	case len(p.EnabledThemes) > 0:
-		theme = recipes.ActiveSeasonalThemeWhere(p.EnabledThemes, now, seasonalThemeHasQuery)
-		if theme == "" {
-			// No enabled theme is currently in season — hide the section.
-			return []*models.MediaItem{}, 0, nil
-		}
-	case p.Theme != "":
-		// Legacy single-theme path with mode-based suppression.
-		pred, ok := recipes.SeasonalPredicates[p.Theme]
-		if !ok {
-			return []*models.MediaItem{}, 0, nil
-		}
-		mode := p.Mode
-		if mode == "" {
-			mode = "auto"
-		}
-		if mode == "auto" && !pred(now) {
-			return []*models.MediaItem{}, 0, nil
-		}
-		theme = p.Theme
-	default:
+	pick, ok := recipes.ActiveSeasonalPick(p, f.now())
+	if !ok || f.SeasonalLists == nil || f.SeasonalResolver == nil {
 		return []*models.MediaItem{}, 0, nil
 	}
-
-	def, hasQuery := seasonalQueryDef(theme)
-	if !hasQuery {
-		if keywords := seasonalKeywordTitles[theme]; len(keywords) > 0 {
-			return f.fetchSeasonalKeywordItems(ctx, keywords, s, libraryID, libraryIDs, filter)
-		}
-		// Legacy single-theme path can still pin a theme without an
-		// executable query. Return empty until that data lands.
-		return []*models.MediaItem{}, 0, nil
+	snapshot, found, err := f.SeasonalLists.Get(ctx, pick.ListURL)
+	if err != nil {
+		return nil, 0, fmt.Errorf("seasonal_themed list: %w", err)
 	}
-
-	// Apply library scope the same way fetchFiltered / fetchEditorialSpotlight do.
-	def, ok := applySectionLibraryScopeToQuery(def, libraryID, libraryIDs)
-	if !ok {
+	if !found || len(snapshot.Entries) == 0 {
 		return []*models.MediaItem{}, 0, nil
 	}
+	listIDs, err := resolveSeasonalEntries(ctx, f.SeasonalResolver, snapshot.Entries)
+	if err != nil {
+		return nil, 0, err
+	}
 
 	limit := s.ItemLimit
 	if limit <= 0 {
 		limit = 20
 	}
-	def.Limit = &limit
-
-	executor := &catalog.QueryExecutor{Pool: f.pool}
-	items, _, _, err := executor.PreviewPage(ctx, def, filter, limit, 0, false)
+	items, err := f.fetchItemsByContentIDs(ctx, listIDs, libraryID, libraryIDs, filter)
 	if err != nil {
-		return nil, 0, fmt.Errorf("seasonal_themed query: %w", err)
+		return nil, 0, err
 	}
-	return items, len(items), nil
-}
-
-// seasonalQueryDef returns a catalog.QueryDefinition for the given theme and
-// whether an executable query exists. Holiday themes without genre signal
-// (christmas, st_patricks, thanksgiving) use title-keyword matching as an
-// interim heuristic until a proper keyword/tag column lands — imperfect but
-// far better than the section going dark during the holiday itself.
-func seasonalQueryDef(theme string) (catalog.QueryDefinition, bool) {
-	newDef := func(rules ...catalog.QueryRule) catalog.QueryDefinition {
-		return catalog.QueryDefinition{
-			Match: "all",
-			Groups: []catalog.QueryGroup{
-				{Match: "any", Rules: rules},
-			},
-		}
+	items = orderMediaItems(items, listIDs)
+	if len(items) < limit && !p.UsesListsOnly() && f.SeasonalNeighbors != nil && len(listIDs) > 0 {
+		items = append(items, f.seasonalNeighborItems(ctx, listIDs, limit-len(items), limit, libraryID, libraryIDs, filter)...)
 	}
-	rule := func(field, op, value string) catalog.QueryRule {
-		return catalog.QueryRule{Field: field, Op: op, Value: value}
-	}
-
-	switch theme {
-	case "halloween":
-		return newDef(
-			rule("genre", "contains", "Horror"),
-			rule("genre", "contains", "Thriller"),
-		), true
-	case "valentines":
-		return newDef(
-			rule("genre", "contains", "Romance"),
-		), true
-	case "summer", "summer_blockbuster":
-		return newDef(
-			rule("genre", "contains", "Action"),
-			rule("genre", "contains", "Adventure"),
-		), true
-	case "saturday_morning":
-		return newDef(
-			rule("genre", "contains", "Animation"),
-			rule("genre", "contains", "Family"),
-		), true
-	case "family_movie_night":
-		return newDef(
-			rule("genre", "contains", "Family"),
-			rule("genre", "contains", "Animation"),
-		), true
-	default:
-		return catalog.QueryDefinition{}, false
+	if len(items) > limit {
+		items = items[:limit]
 	}
+	return items, len(items), nil
 }
 
-// seasonalKeywordTitles maps holiday themes without genre signal to title
-// keywords, matched case-insensitively as substrings. An interim heuristic
-// until a proper keyword/tag column lands — imperfect, but far better than
-// the section going dark during the holiday itself.
-var seasonalKeywordTitles = map[string][]string{
-	"christmas":    {"christmas", "santa", "xmas", "nutcracker", "scrooge", "grinch", "noel"},
-	"st_patricks":  {"st. patrick", "leprechaun", "shamrock"},
-	"thanksgiving": {"thanksgiving"},
-}
-
-// seasonalThemeHasQuery reports whether a theme can produce items (either a
-// genre query or a title-keyword fallback). Passed to
-// ActiveSeasonalThemeWhere so multi-theme selection never picks a theme that
-// would resolve to nothing.
-func seasonalThemeHasQuery(theme string) bool {
-	if _, ok := seasonalQueryDef(theme); ok {
-		return true
+// seasonalNeighborItems returns up to want library titles near the theme of
+// the list's most popular owned titles, nearest first. The fill is best
+// effort: a failure leaves the row with its list titles.
+func (f *Fetcher) seasonalNeighborItems(ctx context.Context, listIDs []string, want, limit int, libraryID *int, libraryIDs []int, filter catalog.AccessFilter) []*models.MediaItem {
+	seeds := listIDs[:min(len(listIDs), seasonalSeedCount)]
+	// Scan only the row's libraries, so a library page's fill is not spent on
+	// titles the item fetch below would drop.
+	scope := collectionRailQueryAccess(filter, libraryID, libraryIDs)
+	neighbors, err := f.SeasonalNeighbors.ThemeNeighbors(ctx, seeds, max(limit*4, seasonalNeighborScanMin), scope)
+	if err != nil {
+		slog.WarnContext(ctx, "seasonal row: recommendation fill failed", "error", err)
+		return nil
 	}
-	return len(seasonalKeywordTitles[theme]) > 0
-}
-
-// fetchSeasonalKeywordItems resolves a keyword-based seasonal theme with a
-// direct title ILIKE query (the QueryDefinition system has no title filter
-// field). Ordering favors well-rated titles.
-func (f *Fetcher) fetchSeasonalKeywordItems(ctx context.Context, keywords []string, s ResolvedSection, libraryID *int, libraryIDs []int, filter catalog.AccessFilter) ([]*models.MediaItem, int, error) {
-	var conditions []string
-	var args []any
-	argIdx := 1
-
-	patterns := make([]string, 0, len(keywords))
-	for _, kw := range keywords {
-		patterns = append(patterns, "%"+kw+"%")
+	onList := make(map[string]bool, len(listIDs))
+	for _, id := range listIDs {
+		onList[id] = true
 	}
-	conditions = append(conditions, fmt.Sprintf("mi.title ILIKE ANY($%d)", argIdx))
-	args = append(args, patterns)
-	argIdx++
-
-	conditions = append(conditions, "mi.type IN ('movie','series')")
-
-	fromClause, libConditions, libArgs, newArgIdx := buildLibraryScope(libraryID, libraryIDs, nil, filter.DisabledLibraryIDs, argIdx)
-	conditions = append(conditions, libConditions...)
-	args = append(args, libArgs...)
-	argIdx = newArgIdx
-	catalog.ApplySectionAccessFilter("mi", filter, &conditions, &args, &argIdx)
-
-	conditions = append(conditions, catalog.MangaChapterExclusionWhere("mi"))
-
-	limit := s.ItemLimit
-	if limit <= 0 {
-		limit = 20
+	ids := make([]string, 0, len(neighbors))
+	for _, n := range neighbors {
+		if !onList[n.MediaItemID] {
+			ids = append(ids, n.MediaItemID)
+		}
 	}
-
-	query := fmt.Sprintf(
-		`SELECT %s FROM %s WHERE %s ORDER BY %s LIMIT $%d`,
-		itemColumns("mi"), fromClause, strings.Join(conditions, " AND "), catalog.RatedOrder, argIdx,
-	)
-	args = append(args, limit)
-
-	rows, err := f.pool.Query(ctx, query, args...)
+	items, err := f.fetchItemsByContentIDs(ctx, ids, libraryID, libraryIDs, filter)
 	if err != nil {
-		return nil, 0, fmt.Errorf("fetching seasonal keyword items: %w", err)
+		slog.WarnContext(ctx, "seasonal row: loading recommendation fill failed", "error", err)
+		return nil
 	}
-	defer rows.Close()
-
-	items, err := scanMediaItems(rows)
-	if err != nil {
-		return nil, 0, err
+	items = orderMediaItems(items, ids)
+	if len(items) > want {
+		items = items[:want]
 	}
-	return items, len(items), nil
+	return items
 }
 
 // fetchMoodCollection returns items for a mood_collection section: titles in
@@ -4086,31 +4077,16 @@ func (f *Fetcher) fetchReturningShows(ctx context.Context, s ResolvedSection, li
 
 	conditions = append(conditions,
 		"mi.type = 'series'",
-		// The profile has watched at least one episode of this series...
-		`EXISTS (
-			SELECT 1
-			FROM episodes we
-			JOIN user_watch_history uwh ON uwh.media_item_id = we.content_id
-			WHERE we.series_id = mi.content_id
-			  AND uwh.user_id = $1
-			  AND uwh.profile_id = $2
-		)`,
-		// ...and a season newer than any they've watched arrived recently
-		// with at least one playable file in an in-scope library.
+		// A season newer than any the profile has watched (joined from
+		// `watched` below) arrived recently with at least one playable file
+		// in an in-scope library.
 		fmt.Sprintf(`EXISTS (
 			SELECT 1
 			FROM episodes ne
 			WHERE ne.series_id = mi.content_id
 			  AND ne.season_number > 0
 			  AND ne.created_at > NOW() - make_interval(days => $3)
-			  AND ne.season_number > COALESCE((
-				SELECT MAX(we2.season_number)
-				FROM episodes we2
-				JOIN user_watch_history uwh2 ON uwh2.media_item_id = we2.content_id
-				WHERE we2.series_id = mi.content_id
-				  AND uwh2.user_id = $1
-				  AND uwh2.profile_id = $2
-			  ), 0)
+			  AND ne.season_number > COALESCE(w.max_season, 0)
 			  AND EXISTS (
 				SELECT 1 FROM media_files mf
 				WHERE mf.episode_id = ne.content_id
@@ -4130,8 +4106,21 @@ func (f *Fetcher) fetchReturningShows(ctx context.Context, s ResolvedSection, li
 		limit = 20
 	}
 
+	// `watched` reads the profile's history once: the series it has watched
+	// and the highest season watched in each. Correlating that lookup per
+	// series let Postgres's cached generic plan (which can't see how much
+	// history $1/$2 select) rescan the whole history once per watched series,
+	// turning a ~0.5s query into 10-40s for long-history profiles.
 	query := fmt.Sprintf(
-		`SELECT %s FROM %s WHERE %s
+		`WITH watched AS MATERIALIZED (
+			SELECT we.series_id, MAX(we.season_number) AS max_season
+			FROM user_watch_history uwh
+			JOIN episodes we ON we.content_id = uwh.media_item_id
+			WHERE uwh.user_id = $1
+			  AND uwh.profile_id = $2
+			GROUP BY we.series_id
+		)
+		SELECT %s FROM %s JOIN watched w ON w.series_id = mi.content_id WHERE %s
 		ORDER BY (
 			SELECT MAX(ord.created_at)
 			FROM episodes ord
diff --git a/internal/sections/fetcher_columns_test.go b/internal/sections/fetcher_columns_test.go
index 59c788884c..75112e7db2 100644
--- a/internal/sections/fetcher_columns_test.go
+++ b/internal/sections/fetcher_columns_test.go
@@ -1,8 +1,14 @@
 package sections
 
 import (
+	"context"
+	"fmt"
+	"os"
 	"slices"
 	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
 )
 
 // Jellyfin-compatible lists built from section rows (/Items/Latest) advertise
@@ -15,3 +21,47 @@ func TestItemColumnsListCarriesExtraArtworkPaths(t *testing.T) {
 		t.Fatalf("last columns = %q, want %q", got, want)
 	}
 }
+
+// Section cards are localized per viewer, and localization compares the
+// target language with the item's own metadata and original languages. A
+// section row without them reports every card as untranslated, even in its
+// source language.
+func TestScanMediaItemsCarriesMetadataLanguagesDB(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatalf("connect test database: %v", err)
+	}
+	t.Cleanup(pool.Close)
+
+	id := fmt.Sprintf("section-languages-%d", time.Now().UnixNano())
+	if _, err := pool.Exec(ctx,
+		`INSERT INTO media_items (content_id, type, title, status, genres, default_metadata_language, original_language)
+		 VALUES ($1, 'movie', 'Movie', 'matched', '{}'::text[], 'de', 'ja')`, id,
+	); err != nil {
+		t.Fatalf("seed item: %v", err)
+	}
+	t.Cleanup(func() { _, _ = pool.Exec(ctx, `DELETE FROM media_items WHERE content_id = $1`, id) })
+
+	for name, columns := range map[string]string{
+		"itemColumns":                  itemColumns("mi"),
+		"itemColumnsLatestMangaPoster": itemColumnsLatestMangaPoster("mi"),
+	} {
+		rows, err := pool.Query(ctx, `SELECT `+columns+` FROM media_items mi WHERE mi.content_id = $1`, id)
+		if err != nil {
+			t.Fatalf("%s: query: %v", name, err)
+		}
+		items, err := scanMediaItems(rows)
+		rows.Close()
+		if err != nil {
+			t.Fatalf("%s: scan: %v", name, err)
+		}
+		if len(items) != 1 || items[0].DefaultMetadataLanguage != "de" || items[0].OriginalLanguage != "ja" {
+			t.Fatalf("%s: scanned %+v, want metadata language de and original language ja", name, items)
+		}
+	}
+}
diff --git a/internal/sections/fetcher_continue_watching_test.go b/internal/sections/fetcher_continue_watching_test.go
index e6baf9c6b9..f8328ddb39 100644
--- a/internal/sections/fetcher_continue_watching_test.go
+++ b/internal/sections/fetcher_continue_watching_test.go
@@ -171,7 +171,7 @@ func TestEbookContinueWatchingProgressQueryGatesHiddenHistory(t *testing.T) {
 	}
 }
 
-func TestAppendUniqueContinueItemsDedupesAcrossPages(t *testing.T) {
+func TestAppendContinuePageDedupesAcrossPages(t *testing.T) {
 	t.Parallel()
 
 	seen := make(map[string]struct{})
@@ -181,7 +181,7 @@ func TestAppendUniqueContinueItemsDedupesAcrossPages(t *testing.T) {
 		{ContentID: "book-a"},
 		{ContentID: "book-b"},
 	}
-	ordered := appendUniqueContinueItems(nil, pageOne, seen, limit)
+	ordered := appendContinuePage(nil, pageOne, nil, seen, limit, false)
 
 	// A progress write between pages shifts rows across the LIMIT/OFFSET
 	// boundary, so page two re-serves book-b.
@@ -189,7 +189,7 @@ func TestAppendUniqueContinueItemsDedupesAcrossPages(t *testing.T) {
 		{ContentID: "book-b"},
 		{ContentID: "book-c"},
 	}
-	ordered = appendUniqueContinueItems(ordered, pageTwo, seen, limit)
+	ordered = appendContinuePage(ordered, pageTwo, nil, seen, limit, false)
 
 	got := contentIDs(ordered)
 	want := []string{"book-a", "book-b", "book-c"}
@@ -203,7 +203,7 @@ func TestAppendUniqueContinueItemsDedupesAcrossPages(t *testing.T) {
 	}
 }
 
-func TestAppendUniqueContinueItemsRespectsLimit(t *testing.T) {
+func TestAppendContinuePageRespectsLimit(t *testing.T) {
 	t.Parallel()
 
 	seen := make(map[string]struct{})
@@ -213,12 +213,66 @@ func TestAppendUniqueContinueItemsRespectsLimit(t *testing.T) {
 		{ContentID: "c"},
 	}
 
-	ordered := appendUniqueContinueItems(nil, page, seen, 2)
+	ordered := appendContinuePage(nil, page, nil, seen, 2, false)
 	if got := contentIDs(ordered); len(got) != 2 || got[0] != "a" || got[1] != "b" {
 		t.Fatalf("ordered IDs = %v, want [a b]", got)
 	}
 }
 
+// TestAppendContinuePageCollapsesBeforeTrimming pins that a series' second
+// in-progress episode does not take a row slot: the page's next card fills it,
+// rather than the slot going unfilled or to an older card from a later page.
+func TestAppendContinuePageCollapsesBeforeTrimming(t *testing.T) {
+	t.Parallel()
+
+	seriesID := "series-1"
+	base := time.Date(2026, 1, 1, 12, 0, 0, 0, time.UTC)
+	page := []*models.MediaItem{
+		{ContentID: "ep-2", Type: "episode"},
+		{ContentID: "ep-1", Type: "episode"},
+		{ContentID: "movie-1", Type: "movie"},
+		{ContentID: "movie-2", Type: "movie"},
+	}
+	meta := map[string]SectionItemMeta{
+		"ep-2":    {SeriesID: &seriesID, SeasonNumber: intPtr(1), EpisodeNumber: intPtr(2), ItemSource: "in_progress", SortTimestamp: base},
+		"ep-1":    {SeriesID: &seriesID, SeasonNumber: intPtr(1), EpisodeNumber: intPtr(1), ItemSource: "in_progress", SortTimestamp: base.Add(-time.Hour)},
+		"movie-1": {ItemSource: "in_progress", SortTimestamp: base.Add(-2 * time.Hour)},
+		"movie-2": {ItemSource: "in_progress", SortTimestamp: base.Add(-3 * time.Hour)},
+	}
+
+	ordered := appendContinuePage(nil, page, meta, make(map[string]struct{}), 2, true)
+	if got := contentIDs(ordered); len(got) != 2 || got[0] != "ep-2" || got[1] != "movie-1" {
+		t.Fatalf("ordered IDs = %v, want [ep-2 movie-1]", got)
+	}
+}
+
+func TestContinueNextUpCutoff(t *testing.T) {
+	t.Parallel()
+
+	base := time.Date(2026, 1, 1, 12, 0, 0, 0, time.UTC)
+	items := []*models.MediaItem{{ContentID: "a"}, {ContentID: "b"}, {ContentID: "c"}}
+	meta := map[string]SectionItemMeta{
+		"a": {SortTimestamp: base},
+		"b": {SortTimestamp: base.Add(-2 * time.Hour)},
+		"c": {SortTimestamp: base.Add(-time.Hour)},
+	}
+
+	if got := continueNextUpCutoff(items, meta, 4); got != nil {
+		t.Fatalf("cutoff for a row short of its limit = %v, want nil", got)
+	}
+	got := continueNextUpCutoff(items, meta, 3)
+	if got == nil || !got.Equal(base.Add(-2*time.Hour)) {
+		t.Fatalf("cutoff for a full row = %v, want the oldest card %v", got, base.Add(-2*time.Hour))
+	}
+
+	// A card without a timestamp sorts last, so a next-up card older than
+	// every other card could still outrank it.
+	meta["c"] = SectionItemMeta{}
+	if got := continueNextUpCutoff(items, meta, 3); got != nil {
+		t.Fatalf("cutoff with an untimed card = %v, want nil", got)
+	}
+}
+
 func contentIDs(items []*models.MediaItem) []string {
 	ids := make([]string, 0, len(items))
 	for _, item := range items {
diff --git a/internal/sections/generated.go b/internal/sections/generated.go
index 98430ab73d..9797b4f6c4 100644
--- a/internal/sections/generated.go
+++ b/internal/sections/generated.go
@@ -3,9 +3,11 @@ package sections
 import (
 	"encoding/json"
 	"fmt"
+	"slices"
 	"strings"
 
 	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/librarykind"
 )
 
 const GeneratedHomeLibraryRecentSource = "home_library_recent"
@@ -189,10 +191,12 @@ func GeneratedHomeLibraryRecentSyncedTitle(s *PageSection, libraryName string) s
 	return generatedHomeLibraryRecentTitle(kind, s.SectionType, libraryName)
 }
 
-// IsSharedHomeRecentlyAddedSection reports whether s is a home Recently Added
-// row that covers every video library: no library filter, no single-type
-// filter, and a media scope of video or none.
-func IsSharedHomeRecentlyAddedSection(s *PageSection) bool {
+// homeRecentlyAddedCoversItemType reports whether s is a home Recently
+// Added row that shows itemType ("movie" or "series") from every library:
+// no library filter and no narrower type filter. A combined row from older
+// defaults (media scope video or none) covers both types; the split
+// default rows cover one each.
+func homeRecentlyAddedCoversItemType(s *PageSection, itemType string) bool {
 	if s == nil || s.Scope != "home" || s.LibraryID != nil || s.SectionType != SectionRecentlyAdded {
 		return false
 	}
@@ -200,9 +204,41 @@ func IsSharedHomeRecentlyAddedSection(s *PageSection) bool {
 		return false
 	}
 	filters := recentlyAddedConfigFilters(s.Config)
-	if filters.FilterType != "" || len(filters.LibraryIDs()) > 0 {
+	if len(filters.LibraryIDs()) > 0 {
 		return false
 	}
+	if filters.FilterType != "" {
+		return filters.FilterType == itemType
+	}
 	def, err := ParseQueryDefinition(s.Config)
-	return err != nil || def.MediaScope == "" || def.MediaScope == catalog.MediaScopeVideo
+	if err != nil {
+		return true
+	}
+	return catalog.MediaScopeMatchesItemType(def.MediaScope, itemType)
+}
+
+// hasEnabledHomeRecentlyAddedCovering reports whether home has enabled
+// Recently Added rows covering every item type a library of the given type
+// holds, so the library needs no per-library rows of its own. A mixed
+// library needs both types covered.
+func hasEnabledHomeRecentlyAddedCovering(home []*PageSection, libraryType string) bool {
+	kinds := librarykind.Of(libraryType)
+	var needed []string
+	if kinds.Movie || kinds.Mixed {
+		needed = append(needed, "movie")
+	}
+	if kinds.TV || kinds.Mixed {
+		needed = append(needed, "series")
+	}
+	if len(needed) == 0 {
+		return false
+	}
+	for _, itemType := range needed {
+		if !slices.ContainsFunc(home, func(s *PageSection) bool {
+			return s.Enabled && homeRecentlyAddedCoversItemType(s, itemType)
+		}) {
+			return false
+		}
+	}
+	return true
 }
diff --git a/internal/sections/next_up_mode.go b/internal/sections/next_up_mode.go
index eced2e7b96..0f6fd6fcbd 100644
--- a/internal/sections/next_up_mode.go
+++ b/internal/sections/next_up_mode.go
@@ -44,3 +44,17 @@ func NextUpMode(ctx context.Context, store userstore.UserStore, profileID string
 	}
 	return mode
 }
+
+// NextUpNewReleasesFirst reports whether the acting profile ranks next-up rows
+// by when their next episode was released (ui.next_up_new_releases_first),
+// answering from a resolved access scope like NextUpMode. A failed read
+// degrades to the default, off.
+func NextUpNewReleasesFirst(ctx context.Context, store userstore.UserStore, profileID string) bool {
+	if profileID == "" {
+		return false
+	}
+	if scope, ok := access.GetScope(ctx); ok && scope.ProfileID == profileID && scope.NextUpMode != "" {
+		return scope.NextUpNewReleasesFirst
+	}
+	return access.ResolveViewerPreferences(ctx, store, profileID).NextUpNewReleasesFirst
+}
diff --git a/internal/sections/not_interested.go b/internal/sections/not_interested.go
new file mode 100644
index 0000000000..58f1fa81f8
--- /dev/null
+++ b/internal/sections/not_interested.go
@@ -0,0 +1,63 @@
+package sections
+
+import (
+	"context"
+	"log/slog"
+
+	"github.com/prairie-server/prairie-server/internal/models"
+)
+
+// HidesNotInterested identifies the sections that suggest titles the profile
+// did not pick: discovery rows, where a title it marked Not interested stays
+// out. Rows of what is new, what the profile watches, saved or chose, and
+// rows an admin or the profile built, keep it. The recommendation rows leave
+// marked titles out as they are read, so they are not listed here.
+func HidesNotInterested(sectionType SectionType) bool {
+	switch sectionType {
+	case SectionHiddenGems, SectionCriticallyAcclaimed, SectionAwardWinners, SectionForgottenFavorites,
+		SectionFormatShowcase, SectionEditorialSpotlight, SectionSeasonalThemed, SectionMoodCollection, SectionTrendingOnServer,
+		SectionMostWatched, SectionTrendingDiscover, SectionGenreRoulette, SectionAnniversaries, SectionShortWatches:
+		return true
+	default:
+		return false
+	}
+}
+
+// withoutNotInterested drops the titles the profile marked Not interested
+// from a fetched row, which may leave it shorter. The row is not fetched
+// again wider: several discovery rows draw a daily sample whose size follows
+// the row's limit, so a wider fetch would swap unrelated titles too. A
+// failed lookup leaves the row as fetched, like the Home dismissals.
+func (f *Fetcher) withoutNotInterested(ctx context.Context, resolved ResolvedSection, userID int, profileID string, items []*models.MediaItem, total int) ([]*models.MediaItem, int) {
+	if f.StoreProvider == nil || userID <= 0 || profileID == "" || len(items) == 0 {
+		return items, total
+	}
+	store, err := f.StoreProvider.ForUser(ctx, userID)
+	if err != nil || store == nil {
+		if err != nil {
+			slog.ErrorContext(ctx, "opening the user store for Not interested marks", "component", "sections", "user_id", userID, "error", err)
+		}
+		return items, total
+	}
+	ids := make([]string, 0, len(items))
+	for _, item := range items {
+		if item != nil {
+			ids = append(ids, item.ContentID)
+		}
+	}
+	marked, err := store.ListNotInterestedByMediaItems(ctx, profileID, ids)
+	if err != nil {
+		slog.ErrorContext(ctx, "listing Not interested marks", "component", "sections", "profile_id", profileID, "section_id", resolved.ID, "error", err)
+		return items, total
+	}
+	if len(marked) == 0 {
+		return items, total
+	}
+	kept := make([]*models.MediaItem, 0, len(items))
+	for _, item := range items {
+		if item == nil || !marked[item.ContentID] {
+			kept = append(kept, item)
+		}
+	}
+	return kept, max(0, total-(len(items)-len(kept)))
+}
diff --git a/internal/sections/not_interested_test.go b/internal/sections/not_interested_test.go
new file mode 100644
index 0000000000..3acf989ccc
--- /dev/null
+++ b/internal/sections/not_interested_test.go
@@ -0,0 +1,97 @@
+package sections
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"slices"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/sections/recipes"
+	"github.com/prairie-server/prairie-server/internal/userstore"
+)
+
+// markStore answers ListNotInterestedByMediaItems from marks, or fails.
+type markStore struct {
+	userstore.UserStore
+	marks map[string]bool
+	err   error
+}
+
+func (s markStore) ListNotInterestedByMediaItems(_ context.Context, _ string, ids []string) (map[string]bool, error) {
+	if s.err != nil {
+		return nil, s.err
+	}
+	out := map[string]bool{}
+	for _, id := range ids {
+		if s.marks[id] {
+			out[id] = true
+		}
+	}
+	return out, nil
+}
+
+type markStoreProvider struct{ store markStore }
+
+func (markStoreProvider) Close() error { return nil }
+
+func (p markStoreProvider) ForUser(context.Context, int) (userstore.UserStore, error) {
+	return p.store, nil
+}
+
+func titleRow(n int) []*models.MediaItem {
+	items := make([]*models.MediaItem, n)
+	for i := range items {
+		items[i] = &models.MediaItem{ContentID: fmt.Sprintf("t%02d", i)}
+	}
+	return items
+}
+
+func rowIDs(items []*models.MediaItem) []string {
+	ids := make([]string, len(items))
+	for i, item := range items {
+		ids[i] = item.ContentID
+	}
+	return ids
+}
+
+// A discovery row loses the profile's marked titles and keeps the rest in
+// order; it is not fetched again wider, which would change a daily mix.
+func TestWithoutNotInterestedFiltersTheRow(t *testing.T) {
+	f := &Fetcher{StoreProvider: markStoreProvider{markStore{marks: map[string]bool{"t01": true, "t03": true}}}}
+	section := ResolvedSection{ID: "s", SectionType: SectionMostWatched, ItemLimit: 4}
+
+	items, total := f.withoutNotInterested(t.Context(), section, 1, "p", titleRow(4), 50)
+	if want := []string{"t00", "t02"}; !slices.Equal(rowIDs(items), want) {
+		t.Fatalf("row = %v, want %v", rowIDs(items), want)
+	}
+	if total != 48 {
+		t.Fatalf("total = %d, want 48", total)
+	}
+	clean := []*models.MediaItem{{ContentID: "t00"}, {ContentID: "t02"}}
+	if items, total := f.withoutNotInterested(t.Context(), section, 1, "p", clean, 2); len(items) != 2 || total != 2 {
+		t.Fatalf("a row without marked titles changed: %v, %d", rowIDs(items), total)
+	}
+}
+
+// A failed mark lookup leaves the row as fetched.
+func TestWithoutNotInterestedFailsOpen(t *testing.T) {
+	f := &Fetcher{StoreProvider: markStoreProvider{markStore{err: errors.New("store down")}}}
+	row := titleRow(3)
+	items, total := f.withoutNotInterested(t.Context(), ResolvedSection{ItemLimit: 3}, 1, "p", row, 3)
+	if len(items) != 3 || total != 3 {
+		t.Fatalf("row = %v, %d; want it unchanged", rowIDs(items), total)
+	}
+}
+
+// A discovery recipe suggests titles the profile did not pick, so each one
+// must leave marked titles out.
+func TestHidesNotInterestedCoversDiscoveryRecipes(t *testing.T) {
+	for _, recipe := range recipes.List() {
+		def := recipe.Definition()
+		if def.Category == recipes.CategoryDiscovery && !HidesNotInterested(SectionType(def.Type)) {
+			t.Errorf("discovery recipe %q keeps Not interested titles", def.Type)
+		}
+	}
+}
diff --git a/internal/sections/recently_added_shared_db_test.go b/internal/sections/recently_added_shared_db_test.go
index 33b6914256..cb021df5a9 100644
--- a/internal/sections/recently_added_shared_db_test.go
+++ b/internal/sections/recently_added_shared_db_test.go
@@ -137,8 +137,8 @@ func TestGeneratedHomeRowsSkipVideoLibrariesWithSharedRowDB(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if !hasEnabledSharedHomeRecentlyAdded(home) {
-		// Older homes have no shared row, and a disabled shared row shows
+	if !hasEnabledHomeRecentlyAddedCovering(home, "movies") {
+		// Older homes have no covering row, and a disabled covering row shows
 		// nothing; both keep per-library rows.
 		disabled, err := f.repo.Create(ctx, &PageSection{Scope: "home", SectionType: SectionRecentlyAdded, Title: f.app + "-disabled", ItemLimit: DefaultItemLimit, Config: defaultMediaScopeConfig(catalog.MediaScopeVideo), Enabled: false})
 		if err != nil {
@@ -184,24 +184,33 @@ func TestGeneratedHomeRowsSkipVideoLibrariesWithSharedRowDB(t *testing.T) {
 	}
 }
 
-func TestHasEnabledSharedHomeRecentlyAdded(t *testing.T) {
-	shared := func(enabled bool) *PageSection {
-		return &PageSection{Scope: "home", SectionType: SectionRecentlyAdded, Config: defaultMediaScopeConfig(catalog.MediaScopeVideo), Enabled: enabled}
+func TestHasEnabledHomeRecentlyAddedCovering(t *testing.T) {
+	row := func(scope string, enabled bool) *PageSection {
+		return &PageSection{Scope: "home", SectionType: SectionRecentlyAdded, Config: defaultMediaScopeConfig(scope), Enabled: enabled}
 	}
-	movieOnly := &PageSection{Scope: "home", SectionType: SectionRecentlyAdded, Config: defaultMediaScopeConfig("movie"), Enabled: true}
+	shared := func(enabled bool) *PageSection { return row(catalog.MediaScopeVideo, enabled) }
+	movieOnly := row("movie", true)
+	seriesOnly := row("series", true)
 	tests := []struct {
-		name string
-		home []*PageSection
-		want bool
+		name        string
+		home        []*PageSection
+		libraryType string
+		want        bool
 	}{
-		{"enabled shared row", []*PageSection{movieOnly, shared(true)}, true},
-		{"disabled shared row", []*PageSection{movieOnly, shared(false)}, false},
-		{"no shared row", []*PageSection{movieOnly}, false},
+		{"enabled shared row covers movies", []*PageSection{movieOnly, shared(true)}, "movies", true},
+		{"enabled shared row covers mixed", []*PageSection{shared(true)}, "mixed", true},
+		{"disabled shared row covers nothing", []*PageSection{shared(false)}, "series", false},
+		{"movie row covers movies", []*PageSection{movieOnly}, "movies", true},
+		{"movie row misses series", []*PageSection{movieOnly}, "series", false},
+		{"split rows cover mixed", []*PageSection{movieOnly, seriesOnly}, "mixed", true},
+		{"movie row alone misses mixed", []*PageSection{movieOnly}, "mixed", false},
+		{"disabled split row misses mixed", []*PageSection{movieOnly, row("series", false)}, "mixed", false},
+		{"no rows", nil, "movies", false},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if got := hasEnabledSharedHomeRecentlyAdded(tt.home); got != tt.want {
-				t.Fatalf("hasEnabledSharedHomeRecentlyAdded = %v, want %v", got, tt.want)
+			if got := hasEnabledHomeRecentlyAddedCovering(tt.home, tt.libraryType); got != tt.want {
+				t.Fatalf("hasEnabledHomeRecentlyAddedCovering(%q) = %v, want %v", tt.libraryType, got, tt.want)
 			}
 		})
 	}
@@ -276,3 +285,53 @@ func TestScopeTVLibraries(t *testing.T) {
 		})
 	}
 }
+
+// The default home Recently Added TV row is scoped to series. A TV library
+// typed with an alias such as "tv" counts as covered by that row, so the row
+// has to show it.
+func TestSeriesRecentlyAddedIncludesTVAliasLibrariesDB(t *testing.T) {
+	pool := openRecentlyAddedTestPool(t)
+	ctx := t.Context()
+	suffix := time.Now().UnixNano()
+	exec := func(sql string, args ...any) {
+		t.Helper()
+		if _, err := pool.Exec(ctx, sql, args...); err != nil {
+			t.Fatalf("%s: %v", sql, err)
+		}
+	}
+	var showsID int
+	if err := pool.QueryRow(ctx, `INSERT INTO media_folders (type, name, enabled) VALUES ('tv', $1, true) RETURNING id`, fmt.Sprintf("alias-recent-tv-%d", suffix)).Scan(&showsID); err != nil {
+		t.Fatalf("seed tv folder: %v", err)
+	}
+	base := time.Date(2026, 9, 1, 12, 0, 0, 0, time.UTC)
+	seriesID := fmt.Sprintf("alias-recent-series-%d", suffix)
+	episodeID := fmt.Sprintf("alias-recent-episode-%d", suffix)
+	runID := fmt.Sprintf("alias-recent-run-%d", suffix)
+	t.Cleanup(func() {
+		bg := context.Background()
+		_, _ = pool.Exec(bg, `DELETE FROM media_items WHERE content_id = $1`, seriesID)
+		_, _ = pool.Exec(bg, `DELETE FROM media_folders WHERE id = $1`, showsID)
+	})
+	exec(`INSERT INTO media_items (content_id, type, title, status, genres, created_at) VALUES ($1, 'series', 'Alias Show', 'matched', '{}'::text[], $2)`, seriesID, base)
+	exec(`INSERT INTO media_item_libraries (content_id, media_folder_id, first_seen_at) VALUES ($1, $2, $3)`, seriesID, showsID, base)
+	exec(`INSERT INTO scan_runs (id, media_folder_id, mode, status) VALUES ($1, $2, 'library', 'completed')`, runID, showsID)
+	exec(`INSERT INTO episodes (content_id, series_id, season_number, episode_number, title, overview, runtime, rating_imdb) VALUES ($1, $2, 1, 1, 'Pilot', '', 45, 0)`, episodeID, seriesID)
+	exec(`INSERT INTO episode_libraries (episode_id, media_folder_id, first_seen_at, first_seen_scan_run_id) VALUES ($1, $2, $3, $4)`, episodeID, showsID, base.Add(time.Minute), runID)
+	exec(`INSERT INTO media_files (episode_id, media_folder_id, file_path) VALUES ($1, $2, $3)`, episodeID, showsID, "/alias-recent/"+episodeID+".mkv")
+
+	items, _, err := NewFetcher(pool).fetchRecentlyAdded(ctx, ResolvedSection{
+		SectionType: SectionRecentlyAdded,
+		ItemLimit:   20,
+		Config:      defaultMediaScopeConfig("series"),
+	}, nil, []int{showsID}, catalog.AccessFilter{})
+	if err != nil {
+		t.Fatalf("fetch series row: %v", err)
+	}
+	got := make([]string, len(items))
+	for i, item := range items {
+		got[i] = item.Type + ":" + item.ContentID
+	}
+	if want := []string{"episode:" + episodeID}; !slices.Equal(got, want) {
+		t.Fatalf("series row over a tv-typed library = %v, want %v", got, want)
+	}
+}
diff --git a/internal/sections/recipes/seasonal.go b/internal/sections/recipes/seasonal.go
index 2e89a2e572..ca9d0aa9af 100644
--- a/internal/sections/recipes/seasonal.go
+++ b/internal/sections/recipes/seasonal.go
@@ -4,41 +4,33 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"strconv"
+	"strings"
 	"time"
+	"unicode/utf8"
+
+	"github.com/prairie-server/prairie-server/internal/collectionutil"
 )
 
 // DatePredicate is a function that reports whether a given time falls within
 // the seasonal window.
 type DatePredicate func(time.Time) bool
 
-// inMonth returns a predicate that matches any time within the given month.
-func inMonth(m time.Month) DatePredicate {
-	return func(t time.Time) bool {
-		return t.Month() == m
-	}
-}
-
-// inMonths returns a predicate that matches any time within any of the given months.
-func inMonths(months ...time.Month) DatePredicate {
-	set := make(map[time.Month]bool, len(months))
-	for _, m := range months {
-		set[m] = true
+// inYearlyWindow reports whether t falls between start and end (MM-DD,
+// inclusive). An end before the start wraps across New Year. An unparseable
+// bound never matches.
+func inYearlyWindow(t time.Time, start, end string) bool {
+	sm, sd, ok1 := parseMonthDay(start)
+	em, ed, ok2 := parseMonthDay(end)
+	if !ok1 || !ok2 {
+		return false
 	}
-	return func(t time.Time) bool {
-		return set[t.Month()]
-	}
-}
-
-// dateRange returns a predicate that matches times inclusively between
-// (startMonth, startDay) and (endMonth, endDay) within the same calendar year.
-// It does not wrap across year boundaries.
-func dateRange(startMonth time.Month, startDay int, endMonth time.Month, endDay int) DatePredicate {
-	return func(t time.Time) bool {
-		y := t.Year()
-		start := time.Date(y, startMonth, startDay, 0, 0, 0, 0, t.Location())
-		end := time.Date(y, endMonth, endDay, 23, 59, 59, 999999999, t.Location())
-		return !t.Before(start) && !t.After(end)
+	at := int(t.Month())*100 + t.Day()
+	from, to := int(sm)*100+sd, int(em)*100+ed
+	if from <= to {
+		return at >= from && at <= to
 	}
+	return at >= from || at <= to
 }
 
 // weekdayBeforeHour returns a predicate that matches times on the given weekday
@@ -61,71 +53,157 @@ func weekdaysFromHour(hour int, weekdays ...time.Weekday) DatePredicate {
 	}
 }
 
-// SeasonalPredicates maps theme names to their date predicates.
-// Themes without a predicate here are not supported.
-var SeasonalPredicates = map[string]DatePredicate{
-	"halloween":          inMonth(time.October),
-	"christmas":          dateRange(time.December, 1, time.December, 31),
-	"valentines":         dateRange(time.February, 7, time.February, 14),
-	"st_patricks":        dateRange(time.March, 15, time.March, 17),
-	"thanksgiving":       dateRange(time.November, 22, time.November, 30),
-	"summer":             inMonths(time.June, time.July, time.August),
-	"summer_blockbuster": inMonths(time.June, time.July, time.August),
-	"saturday_morning":   weekdayBeforeHour(time.Saturday, 13),
-	"family_movie_night": weekdaysFromHour(17, time.Friday, time.Saturday),
+// easterWindow matches Palm Sunday through Easter Monday.
+func easterWindow(t time.Time) bool {
+	easter := easterSunday(t.Year(), t.Location())
+	day := time.Date(t.Year(), t.Month(), t.Day(), 0, 0, 0, 0, t.Location())
+	return !day.Before(easter.AddDate(0, 0, -7)) && !day.After(easter.AddDate(0, 0, 1))
 }
 
-// SeasonalThemeOrder lists themes from most-specific to most-general. When
-// multiple enabled themes match `now` (e.g. a Saturday morning in October
-// triggers both halloween and saturday_morning), the earlier entry wins.
-// Themes not listed here cannot participate in EnabledThemes auto-cycle.
+// easterSunday returns Western Easter for year (the anonymous Gregorian
+// algorithm).
+func easterSunday(year int, loc *time.Location) time.Time {
+	a := year % 19
+	b, c := year/100, year%100
+	d, e := b/4, b%4
+	f := (b + 8) / 25
+	g := (b - f + 1) / 3
+	h := (19*a + b - d - g + 15) % 30
+	i, k := c/4, c%4
+	l := (32 + 2*e + 2*i - h - k) % 7
+	m := (a + 11*h + 22*l) / 451
+	month := (h + l - 7*m + 114) / 31
+	day := (h+l-7*m+114)%31 + 1
+	return time.Date(year, time.Month(month), day, 0, 0, 0, 0, loc)
+}
+
+// SeasonalPredicates maps theme names to their default date predicates: the
+// catalog's Start-End window, or the theme's own rule. Every SeasonalThemes
+// entry has one.
+var SeasonalPredicates = func() map[string]DatePredicate {
+	rules := map[string]DatePredicate{
+		ThemeEaster:           easterWindow,
+		ThemeSaturdayMorning:  weekdayBeforeHour(time.Saturday, 13),
+		ThemeFamilyMovieNight: weekdaysFromHour(17, time.Friday, time.Saturday),
+	}
+	for _, theme := range SeasonalThemes {
+		if theme.Start != "" {
+			start, end := theme.Start, theme.End
+			rules[theme.Key] = func(t time.Time) bool { return inYearlyWindow(t, start, end) }
+		}
+	}
+	return rules
+}()
+
+// SeasonalThemeOrder lists the built-in themes from most to least specific.
+// When several enabled themes are in season at once (a Saturday morning in
+// October), the earlier one wins: the short holidays first, then the
+// month-long ones, the weekly themes, and summer last. Custom holidays
+// outrank all of them. Every SeasonalThemes entry appears exactly once.
 var SeasonalThemeOrder = []string{
-	"valentines",
-	"st_patricks",
-	"thanksgiving",
-	"christmas",
-	"halloween",
-	"saturday_morning",
-	"family_movie_night",
-	"summer_blockbuster",
-	"summer",
+	ThemeValentines,
+	ThemeStPatricks,
+	ThemeEaster,
+	ThemeThanksgiving,
+	ThemeNewYear,
+	ThemeChristmas,
+	ThemeHalloween,
+	ThemeSaturdayMorning,
+	ThemeFamilyMovieNight,
+	ThemeSummerBlockbuster,
+	ThemeSummer,
+}
+
+// Seasonal row sources. The default ranks the vibe's list titles the library
+// owns by IMDb popularity, then fills the row with the library's closest
+// matches by recommendation embedding when the server has them. Lists only
+// skips that fill.
+const (
+	SeasonalSourceRecommendations = "recommendations"
+	SeasonalSourceLists           = "lists"
+)
+
+// MaxSeasonalCustomHolidays bounds the custom holidays one row may carry.
+const MaxSeasonalCustomHolidays = 12
+
+// SeasonalCustomHoliday is a holiday a user defines for one row: a yearly
+// window (MM-DD, inclusive; End before Start wraps across New Year) and the
+// public MDBList list whose titles it shows.
+type SeasonalCustomHoliday struct {
+	Name    string `json:"name"`
+	Start   string `json:"start"`
+	End     string `json:"end"`
+	ListURL string `json:"list_url"`
+	// Title names the row in season; empty uses Name.
+	Title string `json:"title,omitempty"`
+}
+
+// SeasonalDates is a yearly window a row sets for a built-in theme in place of
+// its default: MM-DD, inclusive; End before Start wraps across New Year.
+type SeasonalDates struct {
+	Start string `json:"start"`
+	End   string `json:"end"`
 }
 
 // SeasonalThemedParams configures the seasonal_themed resolver.
 //
 // There are two modes of use:
 //
-//  1. Multi-theme auto-cycle (preferred): set EnabledThemes to the list of
-//     themes the admin wants this section to rotate through. The fetcher picks
-//     the first SeasonalThemeOrder entry whose predicate matches now and uses
-//     it; if none match, the section is empty (suppressed off-season).
+//  1. Multi-theme auto-cycle (preferred): set EnabledThemes to the themes the
+//     row rotates through and optionally CustomHolidays. The fetcher picks the
+//     first custom holiday in season, else the first SeasonalThemeOrder entry
+//     whose predicate matches now; if none match, the section is empty
+//     (suppressed off-season).
 //
 //  2. Legacy single-theme: set Theme to a single theme key. Mode controls
 //     whether the section is hidden off-season (auto, default) or pinned.
 //     Retained for backward compat with sections saved before the multi-theme
-//     shape; new gallery saves should use EnabledThemes.
+//     shape.
 //
-// EnabledThemes takes precedence when both fields are populated.
-//
-// ThemeTitles is an optional per-theme display-name override. When the active
-// theme has a non-empty entry here, the API replaces the section's saved Title
-// with it for the duration of the in-season window — letting one section read
-// "Halloween Picks" in October and "Christmas Movies" in December.
+// Vibes picks a vibe per theme key; a missing or unknown entry uses the
+// theme's default vibe. ThemeTitles optionally renames the row while a theme
+// is in season; without an entry the row takes the vibe's title. ThemeDates
+// moves a non-weekly theme's window; without an entry the theme keeps its
+// default dates (Easter keeps moving with the calendar).
 type SeasonalThemedParams struct {
-	EnabledThemes []string          `json:"enabled_themes,omitempty"`
-	ThemeTitles   map[string]string `json:"theme_titles,omitempty"`
+	EnabledThemes  []string                 `json:"enabled_themes,omitempty"`
+	ThemeTitles    map[string]string        `json:"theme_titles,omitempty"`
+	Vibes          map[string]string        `json:"vibes,omitempty"`
+	ThemeDates     map[string]SeasonalDates `json:"theme_dates,omitempty"`
+	Source         string                   `json:"source,omitempty"`
+	CustomHolidays []SeasonalCustomHoliday  `json:"custom_holidays,omitempty"`
 
-	// Legacy single-theme fields. Still honored when EnabledThemes is empty.
+	// Legacy single-theme fields. Still honored when EnabledThemes and
+	// CustomHolidays are empty.
 	Theme string `json:"theme,omitempty"`
 	Mode  string `json:"mode,omitempty"`
 }
 
+// UsesListsOnly reports whether the row skips the recommendation fill.
+func (p SeasonalThemedParams) UsesListsOnly() bool { return p.Source == SeasonalSourceLists }
+
+// themeInSeason reports whether a built-in theme is in season at now, using
+// the row's own dates for it when set.
+func (p SeasonalThemedParams) themeInSeason(theme string, now time.Time) bool {
+	if dates, ok := p.ThemeDates[theme]; ok {
+		return inYearlyWindow(now, dates.Start, dates.End)
+	}
+	pred, ok := SeasonalPredicates[theme]
+	return ok && pred(now)
+}
+
 var validSeasonalModes = map[string]bool{
 	"":       true, // valid; treated as "auto"
 	"auto":   true,
 	"pinned": true,
 }
 
+var validSeasonalSources = map[string]bool{
+	"":                            true, // treated as recommendations
+	SeasonalSourceRecommendations: true,
+	SeasonalSourceLists:           true,
+}
+
 type seasonalRecipe struct{}
 
 func (seasonalRecipe) Type() string                   { return "seasonal_themed" }
@@ -138,39 +216,113 @@ func (seasonalRecipe) Resolve(rc ResolverContext) (ResolvedItems, error) {
 
 func (seasonalRecipe) Validate(raw json.RawMessage) error {
 	if len(raw) == 0 {
-		return errors.New("seasonal_themed: enabled_themes or theme is required")
+		return errors.New("seasonal_themed: enabled_themes, custom_holidays or theme is required")
 	}
 	var p SeasonalThemedParams
 	if err := json.Unmarshal(raw, &p); err != nil {
 		return err
 	}
+	if !validSeasonalModes[p.Mode] {
+		return fmt.Errorf("seasonal_themed: invalid mode %q (want auto|pinned)", p.Mode)
+	}
+	if !validSeasonalSources[p.Source] {
+		return fmt.Errorf("seasonal_themed: invalid source %q (want recommendations|lists)", p.Source)
+	}
+	for theme, vibe := range p.Vibes {
+		entry, ok := SeasonalThemeByKey(theme)
+		if !ok {
+			return fmt.Errorf("seasonal_themed: unknown theme %q in vibes", theme)
+		}
+		if !entry.hasVibe(vibe) {
+			return fmt.Errorf("seasonal_themed: unknown vibe %q for theme %q", vibe, theme)
+		}
+	}
+	for theme, dates := range p.ThemeDates {
+		entry, ok := SeasonalThemeByKey(theme)
+		if !ok {
+			return fmt.Errorf("seasonal_themed: unknown theme %q in theme_dates", theme)
+		}
+		if entry.Weekly {
+			return fmt.Errorf("seasonal_themed: theme %q recurs weekly; its dates cannot change", theme)
+		}
+		if _, _, ok := parseMonthDay(dates.Start); !ok {
+			return fmt.Errorf("seasonal_themed: theme %q: start %q is not MM-DD", theme, dates.Start)
+		}
+		if _, _, ok := parseMonthDay(dates.End); !ok {
+			return fmt.Errorf("seasonal_themed: theme %q: end %q is not MM-DD", theme, dates.End)
+		}
+	}
+	if err := validateCustomHolidays(p.CustomHolidays); err != nil {
+		return err
+	}
 	// Multi-theme mode wins when populated.
-	if len(p.EnabledThemes) > 0 {
+	if len(p.EnabledThemes) > 0 || len(p.CustomHolidays) > 0 {
 		for _, t := range p.EnabledThemes {
 			if _, ok := SeasonalPredicates[t]; !ok {
 				return fmt.Errorf("seasonal_themed: unknown theme %q in enabled_themes", t)
 			}
 		}
-		// Mode is ignored in multi-theme mode (the off-season behavior is
-		// implicit) but still validated if the caller sent something nonsense.
-		if !validSeasonalModes[p.Mode] {
-			return fmt.Errorf("seasonal_themed: invalid mode %q (want auto|pinned)", p.Mode)
-		}
 		return nil
 	}
 	// Legacy single-theme path.
 	if p.Theme == "" {
-		return errors.New("seasonal_themed: enabled_themes or theme is required")
+		return errors.New("seasonal_themed: enabled_themes, custom_holidays or theme is required")
 	}
 	if _, ok := SeasonalPredicates[p.Theme]; !ok {
 		return fmt.Errorf("seasonal_themed: unknown theme %q", p.Theme)
 	}
-	if !validSeasonalModes[p.Mode] {
-		return fmt.Errorf("seasonal_themed: invalid mode %q (want auto|pinned)", p.Mode)
+	return nil
+}
+
+func validateCustomHolidays(holidays []SeasonalCustomHoliday) error {
+	if len(holidays) > MaxSeasonalCustomHolidays {
+		return fmt.Errorf("seasonal_themed: at most %d custom holidays", MaxSeasonalCustomHolidays)
+	}
+	for i, h := range holidays {
+		if strings.TrimSpace(h.Name) == "" {
+			return fmt.Errorf("seasonal_themed: custom holiday %d needs a name", i+1)
+		}
+		if utf8.RuneCountInString(h.Name) > 80 || utf8.RuneCountInString(h.Title) > 80 {
+			return fmt.Errorf("seasonal_themed: custom holiday %q: name and title are at most 80 characters", h.Name)
+		}
+		if _, _, ok := parseMonthDay(h.Start); !ok {
+			return fmt.Errorf("seasonal_themed: custom holiday %q: start %q is not MM-DD", h.Name, h.Start)
+		}
+		if _, _, ok := parseMonthDay(h.End); !ok {
+			return fmt.Errorf("seasonal_themed: custom holiday %q: end %q is not MM-DD", h.Name, h.End)
+		}
+		if _, err := collectionutil.CanonicalMDBListURL(h.ListURL); err != nil {
+			return fmt.Errorf("seasonal_themed: custom holiday %q: list_url must be an MDBList list (https://mdblist.com/lists/...)", h.Name)
+		}
 	}
 	return nil
 }
 
+// parseMonthDay parses MM-DD. Feb 29 is allowed; in other years it never
+// matches on its own, so a window that starts or ends there still works.
+func parseMonthDay(s string) (time.Month, int, bool) {
+	if len(s) != 5 || s[2] != '-' {
+		return 0, 0, false
+	}
+	month, errMonth := strconv.Atoi(s[:2])
+	day, errDay := strconv.Atoi(s[3:])
+	if errMonth != nil || errDay != nil {
+		return 0, 0, false
+	}
+	if month < 1 || month > 12 || day < 1 {
+		return 0, 0, false
+	}
+	if day > time.Date(2024, time.Month(month)+1, 0, 0, 0, 0, 0, time.UTC).Day() {
+		return 0, 0, false
+	}
+	return time.Month(month), day, true
+}
+
+// InSeason reports whether now falls in the holiday's window.
+func (h SeasonalCustomHoliday) InSeason(now time.Time) bool {
+	return inYearlyWindow(now, h.Start, h.End)
+}
+
 func (seasonalRecipe) Definition() RecipeDefinition {
 	return RecipeDefinition{
 		Type:             "seasonal_themed",
@@ -183,10 +335,8 @@ func (seasonalRecipe) Definition() RecipeDefinition {
 				DisplayName:      "Seasonal Picks",
 				Icon:             "🗓️",
 				DescriptionShort: "Cycles automatically — Halloween in October, Christmas in December, etc.",
-				DescriptionLong:  "One section that swaps in different theme picks based on the calendar. Toggle which holidays this profile celebrates from the Add section dialog.",
-				DefaultParams: json.RawMessage(
-					`{"enabled_themes":["halloween","christmas","valentines","st_patricks","thanksgiving","summer_blockbuster","saturday_morning"]}`,
-				),
+				DescriptionLong:  "One section that swaps in curated holiday picks based on the calendar. Choose the holidays, a vibe for each, and add your own holidays.",
+				DefaultParams:    json.RawMessage(DefaultSeasonalConfig),
 			},
 			{
 				Key:              "se_family_movie_night",
@@ -199,63 +349,86 @@ func (seasonalRecipe) Definition() RecipeDefinition {
 	}
 }
 
-// SeasonalTitleOverride returns the per-theme display name for the active
-// theme, or "" when no override is configured (or no theme is active). The
-// fetcher applies the override only when non-empty, so callers can fall back
-// to the section's saved Title. The usable filter must match the one passed
-// to ActiveSeasonalThemeWhere so the override tracks the theme that actually
-// resolved; pass nil to consider every theme usable.
-func SeasonalTitleOverride(p SeasonalThemedParams, now time.Time, usable func(theme string) bool) string {
+// DefaultSeasonalConfig is the config the Seasonal Picks preset and the
+// built-in home row start from.
+const DefaultSeasonalConfig = `{"enabled_themes":["halloween","christmas","new_year","valentines","st_patricks","easter","thanksgiving","summer_blockbuster","saturday_morning"]}`
+
+// SeasonalPick is what a seasonal row shows right now: a theme (built-in or
+// custom), the list behind it, and the row's in-season title.
+type SeasonalPick struct {
+	// Theme is the built-in theme key; empty for a custom holiday.
+	Theme   string
+	Vibe    string
+	ListURL string
+	Title   string
+}
+
+// ActiveSeasonalPick returns what the row shows at now, or false when nothing
+// is in season. Custom holidays come first, in the order saved, then the
+// enabled built-in themes in SeasonalThemeOrder, else a legacy single theme
+// (which a row pinned with mode "pinned" always shows).
+func ActiveSeasonalPick(p SeasonalThemedParams, now time.Time) (SeasonalPick, bool) {
+	for _, h := range p.CustomHolidays {
+		if h.InSeason(now) {
+			title := strings.TrimSpace(h.Title)
+			if title == "" {
+				title = strings.TrimSpace(h.Name)
+			}
+			return SeasonalPick{ListURL: h.ListURL, Title: title}, true
+		}
+	}
 	var theme string
 	switch {
 	case len(p.EnabledThemes) > 0:
-		theme = ActiveSeasonalThemeWhere(p.EnabledThemes, now, usable)
+		theme = p.ActiveTheme(now)
 	case p.Theme != "":
-		// Legacy mode — only honor an override if the predicate currently fires.
-		pred, ok := SeasonalPredicates[p.Theme]
-		if ok && pred(now) {
+		_, known := SeasonalPredicates[p.Theme]
+		if known && (p.Mode == "pinned" || p.themeInSeason(p.Theme, now)) {
 			theme = p.Theme
 		}
 	}
-	if theme == "" {
-		return ""
+	entry, ok := SeasonalThemeByKey(theme)
+	if !ok {
+		return SeasonalPick{}, false
 	}
-	return p.ThemeTitles[theme]
+	vibe := entry.Vibe(p.Vibes[theme])
+	title := strings.TrimSpace(p.ThemeTitles[theme])
+	if title == "" {
+		title = vibe.Title
+	}
+	return SeasonalPick{Theme: theme, Vibe: vibe.Key, ListURL: vibe.ListURL, Title: title}, true
 }
 
-// ActiveSeasonalTheme returns the highest-priority enabled theme whose
-// predicate matches `now`. Returns "" when no enabled theme is in season.
-// Themes not in SeasonalThemeOrder are skipped silently.
-func ActiveSeasonalTheme(enabled []string, now time.Time) string {
-	return ActiveSeasonalThemeWhere(enabled, now, nil)
+// SeasonalListURLsAround returns the list URLs a row will show from now
+// through now+lookahead, checked hourly so hour-based themes count. The
+// refresher fetches these ahead of time so a row has its list the moment its
+// window opens.
+func SeasonalListURLsAround(p SeasonalThemedParams, now time.Time, lookahead time.Duration) []string {
+	seen := map[string]bool{}
+	var urls []string
+	for at := now; !at.After(now.Add(lookahead)); at = at.Add(time.Hour) {
+		pick, ok := ActiveSeasonalPick(p, at)
+		if ok && !seen[pick.ListURL] {
+			seen[pick.ListURL] = true
+			urls = append(urls, pick.ListURL)
+		}
+	}
+	return urls
 }
 
-// ActiveSeasonalThemeWhere is ActiveSeasonalTheme with an extra usable filter:
-// an in-season theme that fails the filter is skipped so a lower-priority
-// in-season theme can win instead. The fetcher passes "has an executable
-// query" here so a theme without backing data never blacks out the section
-// during its own window (e.g. an enabled theme whose query support hasn't
-// landed yet outranking one that works). A nil filter accepts every theme.
-func ActiveSeasonalThemeWhere(enabled []string, now time.Time, usable func(theme string) bool) string {
-	if len(enabled) == 0 {
+// ActiveTheme returns the highest-priority enabled theme in season at now,
+// honoring the row's ThemeDates. Returns "" when no enabled theme is in
+// season. Themes not in SeasonalThemeOrder are skipped silently.
+func (p SeasonalThemedParams) ActiveTheme(now time.Time) string {
+	if len(p.EnabledThemes) == 0 {
 		return ""
 	}
-	enabledSet := make(map[string]bool, len(enabled))
-	for _, t := range enabled {
+	enabledSet := make(map[string]bool, len(p.EnabledThemes))
+	for _, t := range p.EnabledThemes {
 		enabledSet[t] = true
 	}
 	for _, t := range SeasonalThemeOrder {
-		if !enabledSet[t] {
-			continue
-		}
-		if usable != nil && !usable(t) {
-			continue
-		}
-		pred, ok := SeasonalPredicates[t]
-		if !ok {
-			continue
-		}
-		if pred(now) {
+		if enabledSet[t] && p.themeInSeason(t, now) {
 			return t
 		}
 	}
diff --git a/internal/sections/recipes/seasonal_catalog.go b/internal/sections/recipes/seasonal_catalog.go
new file mode 100644
index 0000000000..4f33b3a92f
--- /dev/null
+++ b/internal/sections/recipes/seasonal_catalog.go
@@ -0,0 +1,146 @@
+package recipes
+
+// SeasonalVibe is one curated take on a seasonal theme: a public MDBList list
+// whose titles the row shows, most popular on IMDb first. Keys are stored in
+// section configs, so never rename or reuse one.
+type SeasonalVibe struct {
+	Key         string `json:"key"`
+	Name        string `json:"name"`
+	Title       string `json:"title"`
+	Description string `json:"description"`
+	ListURL     string `json:"list_url"`
+}
+
+// SeasonalTheme is a holiday or recurring moment the seasonal row can follow.
+// The first vibe is the default. Hidden themes are kept for configs saved
+// before they were folded into another theme; the editor does not offer them.
+//
+// Start and End are the theme's yearly window (MM-DD, inclusive; End before
+// Start wraps across New Year). A theme without them has its own rule in
+// SeasonalPredicates: Easter moves, and Weekly themes recur on weekdays. A row
+// may give any non-weekly theme its own dates (SeasonalThemedParams.ThemeDates).
+type SeasonalTheme struct {
+	Key    string         `json:"key"`
+	Name   string         `json:"name"`
+	When   string         `json:"when"`
+	Start  string         `json:"start,omitempty"`
+	End    string         `json:"end,omitempty"`
+	Weekly bool           `json:"weekly,omitempty"`
+	Hidden bool           `json:"-"`
+	Vibes  []SeasonalVibe `json:"vibes"`
+}
+
+// Built-in theme keys. They are stored in section configs; never rename one.
+const (
+	ThemeValentines        = "valentines"
+	ThemeStPatricks        = "st_patricks"
+	ThemeEaster            = "easter"
+	ThemeThanksgiving      = "thanksgiving"
+	ThemeNewYear           = "new_year"
+	ThemeChristmas         = "christmas"
+	ThemeHalloween         = "halloween"
+	ThemeSaturdayMorning   = "saturday_morning"
+	ThemeFamilyMovieNight  = "family_movie_night"
+	ThemeSummerBlockbuster = "summer_blockbuster"
+	ThemeSummer            = "summer"
+)
+
+// Vibe keys several themes share.
+const (
+	vibeFavorites = "favorites"
+	vibeFamily    = "family"
+)
+
+const familyMovieNightTitle = "Family Movie Night"
+
+func mdblist(path string) string { return "https://mdblist.com/lists/" + path }
+
+var summerVibes = []SeasonalVibe{
+	{Key: "blockbusters", Name: "Blockbusters", Title: "Summer Blockbusters", Description: "The biggest box-office hits.", ListURL: mdblist("drovur/box-office-giants")},
+	{Key: "classic_summer", Name: "Classic summer movies", Title: "Classic Summer Movies", Description: "Summer releases that defined the season, from Jaws to Independence Day.", ListURL: mdblist("heavymgs/summer-movies")},
+	{Key: "nostalgia", Name: "Summer nostalgia", Title: "Summer Nostalgia", Description: "Long days, summer camp and coming of age.", ListURL: mdblist("reachingout/summer-movies")},
+}
+
+// SeasonalThemes lists every theme in calendar order, the order the editor
+// shows them: dated holidays by their usual start, then the weekly themes.
+// SeasonalThemeOrder decides which wins when several are in season at once.
+var SeasonalThemes = []SeasonalTheme{
+	{Key: ThemeValentines, Name: "Valentine's Day", When: "Feb 7–14", Start: "02-07", End: "02-14", Vibes: []SeasonalVibe{
+		{Key: "romcoms", Name: "Rom-coms", Title: "Valentine's Rom-Coms", Description: "The best-reviewed romantic comedies.", ListURL: mdblist("hdlists/romantic-comedies-rotten-tomatoes-top-rated")},
+		{Key: vibeFavorites, Name: "Valentine's favorites", Title: "Valentine's Favorites", Description: "Popular date-night picks.", ListURL: mdblist("linvo/valentines-day-popular-movies")},
+		{Key: "romantic_dramas", Name: "Romantic dramas", Title: "Romantic Dramas", Description: "Sweeping love stories with a few tears.", ListURL: mdblist("themtsil/romantic-dramas")},
+		{Key: "love_stories", Name: "Classic love stories", Title: "Classic Love Stories", Description: "Casablanca, Titanic and the other all-time romances.", ListURL: mdblist("tob-t/love-story")},
+	}},
+	{Key: ThemeStPatricks, Name: "St. Patrick's Day", When: "Mar 15–17", Start: "03-15", End: "03-17", Vibes: []SeasonalVibe{
+		{Key: "irish_film", Name: "Irish film", Title: "Irish Film", Description: "Films from and about Ireland.", ListURL: mdblist("irljidel/irish-interest-movies")},
+		{Key: "irish_tv", Name: "Irish TV", Title: "Irish TV", Description: "Series from and about Ireland.", ListURL: mdblist("irljidel/irish-interest-tv-shows")},
+	}},
+	{Key: ThemeEaster, Name: "Easter", When: "Palm Sunday to Easter Monday", Vibes: []SeasonalVibe{
+		{Key: vibeFamily, Name: "Easter movies", Title: "Easter Movies", Description: "Springtime family favorites and Easter classics.", ListURL: mdblist("bsm-venger/easter-movies-e78nzwjk7k")},
+		{Key: "faith", Name: "Faith and Easter stories", Title: "Easter Stories", Description: "Biblical epics and stories of faith.", ListURL: mdblist("bluejack92/easter-by-antares")},
+	}},
+	{Key: ThemeSummerBlockbuster, Name: "Summer", When: "June to August", Start: "06-01", End: "08-31", Vibes: summerVibes},
+	{Key: ThemeSummer, Name: "Summer", When: "June to August", Start: "06-01", End: "08-31", Hidden: true, Vibes: summerVibes},
+	{Key: ThemeHalloween, Name: "Halloween", When: "October", Start: "10-01", End: "10-31", Vibes: []SeasonalVibe{
+		{Key: vibeFavorites, Name: "Halloween favorites", Title: "Halloween Favorites", Description: "The best-loved Halloween movies, spooky and scary.", ListURL: mdblist("hdlists/halloween-movies-the-best-of-all-time")},
+		{Key: vibeFamily, Name: "Family Halloween", Title: "Family Halloween", Description: "Spooky fun for all ages.", ListURL: mdblist("purple_smurf/halloween-family2")},
+		{Key: "horror", Name: "Halloween horror", Title: "Halloween Horror", Description: "Slashers, hauntings and horror classics.", ListURL: mdblist("swansongfunds/horror-halloween")},
+		{Key: "animated", Name: "Animated Halloween", Title: "Animated Halloween", Description: "Animated spooky favorites.", ListURL: mdblist("swansongfunds/halloween-animation")},
+		{Key: "tv", Name: "Halloween TV", Title: "Halloween TV", Description: "Spooky series to binge.", ListURL: mdblist("rootednode/halloween-tv")},
+	}},
+	{Key: ThemeThanksgiving, Name: "Thanksgiving", When: "Nov 22–30", Start: "11-22", End: "11-30", Vibes: []SeasonalVibe{
+		{Key: vibeFavorites, Name: "Thanksgiving movies", Title: "Thanksgiving Movies", Description: "Films set around the Thanksgiving table.", ListURL: mdblist("bluejack92/thanksgiving-by-antares")},
+		{Key: "feel_good", Name: "Feel-good favorites", Title: "Feel-Good Favorites", Description: "Heartwarming picks for the long weekend.", ListURL: mdblist("netthier/thanksgiving-movies")},
+	}},
+	{Key: ThemeChristmas, Name: "Christmas", When: "December", Start: "12-01", End: "12-31", Vibes: []SeasonalVibe{
+		{Key: vibeFavorites, Name: "Christmas favorites", Title: "Christmas Favorites", Description: "The most-watched Christmas movies.", ListURL: mdblist("jbeasley74/christmas-movies")},
+		{Key: vibeFamily, Name: "Family Christmas", Title: "Family Christmas", Description: "Christmas movies for the whole family.", ListURL: mdblist("paperarmour/christmas-kids-movies")},
+		{Key: "classics", Name: "Christmas classics", Title: "Christmas Classics", Description: "Golden-age holiday films.", ListURL: mdblist("momanch/oldies-christmas-classics")},
+		{Key: "romcoms", Name: "Christmas rom-coms", Title: "Christmas Rom-Coms", Description: "Romantic comedies set at Christmas.", ListURL: mdblist("momanch/christmas-romantic-comedies")},
+		{Key: "comedies", Name: "Christmas comedies", Title: "Christmas Comedies", Description: "Holiday laughs.", ListURL: mdblist("momanch/christmas-movie-comedies")},
+		{Key: "hallmark", Name: "Hallmark Christmas", Title: "Hallmark Christmas", Description: "Hallmark's original Christmas movies.", ListURL: mdblist("vectrexgamer/hallmark-original-christmas-movies")},
+	}},
+	{Key: ThemeNewYear, Name: "New Year's", When: "Dec 26–Jan 1", Start: "12-26", End: "01-01", Vibes: []SeasonalVibe{
+		{Key: vibeFavorites, Name: "New Year's movies", Title: "New Year's Movies", Description: "Films that ring in the new year.", ListURL: mdblist("netthier/new-year-movies")},
+	}},
+	{Key: ThemeSaturdayMorning, Name: "Saturday Morning", When: "Saturdays before 1pm", Weekly: true, Vibes: []SeasonalVibe{
+		{Key: "cartoons", Name: "Saturday morning cartoons", Title: "Saturday Morning Cartoons", Description: "Classic weekend cartoons.", ListURL: mdblist("arnx1922/saturday-morning-cartoons-b75bnxjjej")},
+		{Key: "nineties", Name: "90s cartoons", Title: "90s Saturday Mornings", Description: "The cartoons of the 1990s.", ListURL: mdblist("smackdaddy17/saturday-morning-cartoons")},
+		{Key: "modern", Name: "Modern cartoons", Title: "Saturday Morning Favorites", Description: "Animated series from Batman to Gravity Falls.", ListURL: mdblist("savini-andrew-gmail-com/saturday-morning-all-time")},
+	}},
+	{Key: ThemeFamilyMovieNight, Name: familyMovieNightTitle, When: "Friday and Saturday evenings", Weekly: true, Vibes: []SeasonalVibe{
+		{Key: "new", Name: "New and popular", Title: familyMovieNightTitle, Description: "Recent family hits.", ListURL: mdblist("josh_bergeron/sunday-night-family-movies")},
+		{Key: vibeFavorites, Name: "Family favorites", Title: "Family Favorites", Description: "Family films from The Goonies to Coco.", ListURL: mdblist("jaredmecham/top-family-movies-1980")},
+		{Key: "live_action", Name: "Live-action family", Title: familyMovieNightTitle, Description: "Family films without the animation.", ListURL: mdblist("paperarmour/family-movies-animation-excluded")},
+	}},
+}
+
+// SeasonalThemeByKey returns the catalog entry for a theme key.
+func SeasonalThemeByKey(key string) (SeasonalTheme, bool) {
+	for _, theme := range SeasonalThemes {
+		if theme.Key == key {
+			return theme, true
+		}
+	}
+	return SeasonalTheme{}, false
+}
+
+// Vibe returns the vibe with the given key, or the theme's default (first)
+// vibe when key is empty or unknown.
+func (t SeasonalTheme) Vibe(key string) SeasonalVibe {
+	for _, vibe := range t.Vibes {
+		if vibe.Key == key {
+			return vibe
+		}
+	}
+	return t.Vibes[0]
+}
+
+func (t SeasonalTheme) hasVibe(key string) bool {
+	for _, vibe := range t.Vibes {
+		if vibe.Key == key {
+			return true
+		}
+	}
+	return false
+}
diff --git a/internal/sections/recipes/seasonal_test.go b/internal/sections/recipes/seasonal_test.go
index c6542d89eb..0d1cd286df 100644
--- a/internal/sections/recipes/seasonal_test.go
+++ b/internal/sections/recipes/seasonal_test.go
@@ -4,6 +4,8 @@ import (
 	"encoding/json"
 	"testing"
 	"time"
+
+	"github.com/prairie-server/prairie-server/internal/collectionutil"
 )
 
 // TestHalloweenInOctoberMatches verifies the halloween predicate matches October
@@ -188,20 +190,20 @@ func TestActiveSeasonalThemePicksMatchingTheme(t *testing.T) {
 	enabled := []string{"halloween", "christmas", "saturday_morning"}
 
 	// Mid-October Wednesday — only halloween fires.
-	got := ActiveSeasonalTheme(enabled, time.Date(2026, 10, 14, 12, 0, 0, 0, time.UTC))
+	got := (SeasonalThemedParams{EnabledThemes: enabled}).ActiveTheme(time.Date(2026, 10, 14, 12, 0, 0, 0, time.UTC))
 	if got != "halloween" {
 		t.Errorf("Oct 14 → %q, want halloween", got)
 	}
 
 	// October Saturday at 10am — both halloween and saturday_morning fire;
 	// halloween wins because it's earlier in SeasonalThemeOrder.
-	got = ActiveSeasonalTheme(enabled, time.Date(2026, 10, 17, 10, 0, 0, 0, time.UTC))
+	got = (SeasonalThemedParams{EnabledThemes: enabled}).ActiveTheme(time.Date(2026, 10, 17, 10, 0, 0, 0, time.UTC))
 	if got != "halloween" {
 		t.Errorf("Oct 17 Sat 10am → %q, want halloween (priority over saturday_morning)", got)
 	}
 
 	// March Saturday at 10am — only saturday_morning fires.
-	got = ActiveSeasonalTheme(enabled, time.Date(2026, 3, 7, 10, 0, 0, 0, time.UTC))
+	got = (SeasonalThemedParams{EnabledThemes: enabled}).ActiveTheme(time.Date(2026, 3, 7, 10, 0, 0, 0, time.UTC))
 	if got != "saturday_morning" {
 		t.Errorf("March 7 Sat 10am → %q, want saturday_morning", got)
 	}
@@ -209,7 +211,7 @@ func TestActiveSeasonalThemePicksMatchingTheme(t *testing.T) {
 	// July 4 with only halloween and christmas enabled — no themes fire.
 	// (Excluding saturday_morning here because July 4 2026 happens to be a
 	// Saturday, which would otherwise match.)
-	got = ActiveSeasonalTheme([]string{"halloween", "christmas"}, time.Date(2026, 7, 4, 12, 0, 0, 0, time.UTC))
+	got = (SeasonalThemedParams{EnabledThemes: []string{"halloween", "christmas"}}).ActiveTheme(time.Date(2026, 7, 4, 12, 0, 0, 0, time.UTC))
 	if got != "" {
 		t.Errorf("July 4 with halloween/christmas enabled → %q, want empty", got)
 	}
@@ -219,70 +221,291 @@ func TestActiveSeasonalThemePicksMatchingTheme(t *testing.T) {
 // enabled list never wins, even when its predicate matches.
 func TestActiveSeasonalThemeIgnoresDisabledThemes(t *testing.T) {
 	// Mid-October but halloween is NOT enabled — auto-cycle returns "".
-	got := ActiveSeasonalTheme([]string{"christmas"}, time.Date(2026, 10, 14, 12, 0, 0, 0, time.UTC))
+	got := (SeasonalThemedParams{EnabledThemes: []string{"christmas"}}).ActiveTheme(time.Date(2026, 10, 14, 12, 0, 0, 0, time.UTC))
 	if got != "" {
 		t.Errorf("halloween disabled → got %q, want empty", got)
 	}
 }
 
-// TestSeasonalTitleOverridePicksActiveThemeTitle verifies the helper returns
-// the per-theme title configured for whichever theme is currently active.
-func TestSeasonalTitleOverridePicksActiveThemeTitle(t *testing.T) {
-	p := SeasonalThemedParams{
-		EnabledThemes: []string{"halloween", "christmas"},
-		ThemeTitles: map[string]string{
-			"halloween": "Spooky Picks",
-			"christmas": "Festive Films",
+// TestActiveSeasonalPick pins what a row shows and what it is called: the
+// in-season theme's chosen vibe (else its default), titled by theme_titles,
+// else by the vibe, with custom holidays ahead of built-in themes.
+func TestActiveSeasonalPick(t *testing.T) {
+	halloween, _ := SeasonalThemeByKey("halloween")
+	familyHalloween := halloween.Vibe("family")
+	oct14 := time.Date(2026, 10, 14, 12, 0, 0, 0, time.UTC)
+	july2 := time.Date(2026, 7, 2, 12, 0, 0, 0, time.UTC)
+	jan1 := time.Date(2027, 1, 1, 12, 0, 0, 0, time.UTC)
+	fourth := SeasonalCustomHoliday{Name: "Fourth of July", Start: "07-01", End: "07-04", ListURL: "https://mdblist.com/lists/a/fourth"}
+	winter := SeasonalCustomHoliday{Name: "Winter Break", Title: "Snow Days", Start: "12-20", End: "01-05", ListURL: "https://mdblist.com/lists/a/winter"}
+
+	cases := []struct {
+		name   string
+		p      SeasonalThemedParams
+		now    time.Time
+		want   SeasonalPick
+		wantOK bool
+	}{
+		{
+			name:   "default vibe titles the row",
+			p:      SeasonalThemedParams{EnabledThemes: []string{"halloween"}},
+			now:    oct14,
+			want:   SeasonalPick{Theme: "halloween", Vibe: halloween.Vibes[0].Key, ListURL: halloween.Vibes[0].ListURL, Title: halloween.Vibes[0].Title},
+			wantOK: true,
+		},
+		{
+			name:   "chosen vibe",
+			p:      SeasonalThemedParams{EnabledThemes: []string{"halloween"}, Vibes: map[string]string{"halloween": "family"}},
+			now:    oct14,
+			want:   SeasonalPick{Theme: "halloween", Vibe: "family", ListURL: familyHalloween.ListURL, Title: familyHalloween.Title},
+			wantOK: true,
+		},
+		{
+			name:   "theme title overrides the vibe title",
+			p:      SeasonalThemedParams{EnabledThemes: []string{"halloween"}, Vibes: map[string]string{"halloween": "family"}, ThemeTitles: map[string]string{"halloween": "Spooky Picks"}},
+			now:    oct14,
+			want:   SeasonalPick{Theme: "halloween", Vibe: "family", ListURL: familyHalloween.ListURL, Title: "Spooky Picks"},
+			wantOK: true,
+		},
+		{
+			name:   "custom holiday outranks a built-in theme",
+			p:      SeasonalThemedParams{EnabledThemes: []string{"summer_blockbuster"}, CustomHolidays: []SeasonalCustomHoliday{fourth}},
+			now:    july2,
+			want:   SeasonalPick{ListURL: fourth.ListURL, Title: "Fourth of July"},
+			wantOK: true,
+		},
+		{
+			name:   "custom holiday wraps across New Year and uses its title",
+			p:      SeasonalThemedParams{CustomHolidays: []SeasonalCustomHoliday{winter}},
+			now:    jan1,
+			want:   SeasonalPick{ListURL: winter.ListURL, Title: "Snow Days"},
+			wantOK: true,
+		},
+		{
+			name: "custom holidays only, none in season",
+			p:    SeasonalThemedParams{CustomHolidays: []SeasonalCustomHoliday{fourth}},
+			now:  oct14,
+		},
+		{
+			name:   "legacy theme still shows beside a custom holiday out of season",
+			p:      SeasonalThemedParams{Theme: "halloween", CustomHolidays: []SeasonalCustomHoliday{fourth}},
+			now:    oct14,
+			want:   SeasonalPick{Theme: "halloween", Vibe: halloween.Vibes[0].Key, ListURL: halloween.Vibes[0].ListURL, Title: halloween.Vibes[0].Title},
+			wantOK: true,
+		},
+		{
+			name: "off season",
+			p:    SeasonalThemedParams{EnabledThemes: []string{"christmas"}},
+			now:  oct14,
+		},
+		{
+			name: "legacy auto row off season",
+			p:    SeasonalThemedParams{Theme: "halloween", Mode: "auto"},
+			now:  july2,
+		},
+		{
+			name:   "legacy pinned row shows off season",
+			p:      SeasonalThemedParams{Theme: "halloween", Mode: "pinned"},
+			now:    july2,
+			want:   SeasonalPick{Theme: "halloween", Vibe: halloween.Vibes[0].Key, ListURL: halloween.Vibes[0].ListURL, Title: halloween.Vibes[0].Title},
+			wantOK: true,
 		},
 	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got, ok := ActiveSeasonalPick(tc.p, tc.now)
+			if ok != tc.wantOK || got != tc.want {
+				t.Fatalf("ActiveSeasonalPick = %+v, %v; want %+v, %v", got, ok, tc.want, tc.wantOK)
+			}
+		})
+	}
+}
 
-	// October — halloween fires.
-	got := SeasonalTitleOverride(p, time.Date(2026, 10, 14, 12, 0, 0, 0, time.UTC), nil)
-	if got != "Spooky Picks" {
-		t.Errorf("Oct 14 → %q, want Spooky Picks", got)
+// TestActiveSeasonalPickHonorsThemeDates covers a row that moves a built-in
+// holiday to dates of its own.
+func TestActiveSeasonalPickHonorsThemeDates(t *testing.T) {
+	halloween, _ := SeasonalThemeByKey("halloween")
+	christmas, _ := SeasonalThemeByKey("christmas")
+	oct14 := time.Date(2026, 10, 14, 12, 0, 0, 0, time.UTC)
+	july2 := time.Date(2026, 7, 2, 12, 0, 0, 0, time.UTC)
+
+	cases := []struct {
+		name   string
+		p      SeasonalThemedParams
+		now    time.Time
+		want   SeasonalPick
+		wantOK bool
+	}{
+		{
+			name: "own dates move a theme out of its default window",
+			p:    SeasonalThemedParams{EnabledThemes: []string{"halloween"}, ThemeDates: map[string]SeasonalDates{"halloween": {Start: "10-20", End: "11-02"}}},
+			now:  oct14,
+		},
+		{
+			name:   "own dates move a theme into season",
+			p:      SeasonalThemedParams{EnabledThemes: []string{"christmas", "summer_blockbuster"}, ThemeDates: map[string]SeasonalDates{"christmas": {Start: "07-01", End: "07-31"}}},
+			now:    july2,
+			want:   SeasonalPick{Theme: "christmas", Vibe: christmas.Vibes[0].Key, ListURL: christmas.Vibes[0].ListURL, Title: christmas.Vibes[0].Title},
+			wantOK: true,
+		},
+		{
+			name:   "own dates on a legacy single-theme row",
+			p:      SeasonalThemedParams{Theme: "halloween", ThemeDates: map[string]SeasonalDates{"halloween": {Start: "06-25", End: "07-05"}}},
+			now:    july2,
+			want:   SeasonalPick{Theme: "halloween", Vibe: halloween.Vibes[0].Key, ListURL: halloween.Vibes[0].ListURL, Title: halloween.Vibes[0].Title},
+			wantOK: true,
+		},
 	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got, ok := ActiveSeasonalPick(tc.p, tc.now)
+			if ok != tc.wantOK || got != tc.want {
+				t.Fatalf("ActiveSeasonalPick = %+v, %v; want %+v, %v", got, ok, tc.want, tc.wantOK)
+			}
+		})
+	}
+}
 
-	// December — christmas fires.
-	got = SeasonalTitleOverride(p, time.Date(2026, 12, 20, 12, 0, 0, 0, time.UTC), nil)
-	if got != "Festive Films" {
-		t.Errorf("Dec 20 → %q, want Festive Films", got)
+// TestSeasonalValidatesVibesSourceAndCustomHolidays covers the config the
+// editor saves beyond the theme list.
+func TestSeasonalValidatesVibesSourceAndCustomHolidays(t *testing.T) {
+	rec, _ := Get("seasonal_themed")
+	holiday := func(start, end, listURL string) string {
+		return `{"custom_holidays":[{"name":"Fourth","start":"` + start + `","end":"` + end + `","list_url":"` + listURL + `"}]}`
 	}
+	cases := []struct {
+		name    string
+		config  string
+		wantErr bool
+	}{
+		{"known vibe", `{"enabled_themes":["halloween"],"vibes":{"halloween":"horror"}}`, false},
+		{"unknown vibe", `{"enabled_themes":["halloween"],"vibes":{"halloween":"cozy"}}`, true},
+		{"vibe for an unknown theme", `{"enabled_themes":["halloween"],"vibes":{"arbor_day":"favorites"}}`, true},
+		{"lists only", `{"enabled_themes":["halloween"],"source":"lists"}`, false},
+		{"unknown source", `{"enabled_themes":["halloween"],"source":"tmdb"}`, true},
+		{"custom holiday alone", holiday("07-01", "07-04", "https://mdblist.com/lists/a/b"), false},
+		{"leap day", holiday("02-29", "03-01", "https://mdblist.com/lists/a/b"), false},
+		{"impossible date", holiday("02-30", "03-01", "https://mdblist.com/lists/a/b"), true},
+		{"date not MM-DD", holiday("7-1", "07-04", "https://mdblist.com/lists/a/b"), true},
+		{"trailing junk", holiday("07-0x", "07-04", "https://mdblist.com/lists/a/b"), true},
+		{"not an MDBList list", holiday("07-01", "07-04", "https://example.com/lists/a/b"), true},
+		{"own dates", `{"enabled_themes":["easter"],"theme_dates":{"easter":{"start":"04-01","end":"04-14"}}}`, false},
+		{"own dates wrapping New Year", `{"enabled_themes":["christmas"],"theme_dates":{"christmas":{"start":"11-25","end":"01-06"}}}`, false},
+		{"own dates missing the end", `{"enabled_themes":["christmas"],"theme_dates":{"christmas":{"start":"11-25"}}}`, true},
+		{"own dates for an unknown theme", `{"enabled_themes":["christmas"],"theme_dates":{"arbor_day":{"start":"04-01","end":"04-02"}}}`, true},
+		{"own dates for a weekly theme", `{"enabled_themes":["saturday_morning"],"theme_dates":{"saturday_morning":{"start":"04-01","end":"04-02"}}}`, true},
+		{"custom holiday without a name", `{"custom_holidays":[{"name":" ","start":"07-01","end":"07-04","list_url":"https://mdblist.com/lists/a/b"}]}`, true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := rec.Validate(json.RawMessage(tc.config))
+			if (err != nil) != tc.wantErr {
+				t.Fatalf("Validate(%s) error = %v, wantErr %v", tc.config, err, tc.wantErr)
+			}
+		})
+	}
+}
 
-	// April — nothing fires, no override.
-	got = SeasonalTitleOverride(p, time.Date(2026, 4, 15, 12, 0, 0, 0, time.UTC), nil)
-	if got != "" {
-		t.Errorf("Apr 15 → %q, want empty", got)
+// TestMovableHolidayWindows pins the windows computed rather than fixed:
+// Easter week (Palm Sunday to Easter Monday) and New Year's across Jan 1.
+func TestMovableHolidayWindows(t *testing.T) {
+	day := func(y int, m time.Month, d int) time.Time { return time.Date(y, m, d, 12, 0, 0, 0, time.UTC) }
+	cases := []struct {
+		theme string
+		at    time.Time
+		want  bool
+	}{
+		// Easter 2027 is March 28; 2026 is April 5.
+		{"easter", day(2027, time.March, 20), false},
+		{"easter", day(2027, time.March, 21), true},
+		{"easter", day(2027, time.March, 29), true},
+		{"easter", day(2027, time.March, 30), false},
+		{"easter", day(2026, time.April, 5), true},
+		{"new_year", day(2026, time.December, 25), false},
+		{"new_year", day(2026, time.December, 31), true},
+		{"new_year", day(2027, time.January, 1), true},
+		{"new_year", day(2027, time.January, 2), false},
+	}
+	for _, tc := range cases {
+		if got := SeasonalPredicates[tc.theme](tc.at); got != tc.want {
+			t.Errorf("%s at %s = %v, want %v", tc.theme, tc.at.Format("2006-01-02"), got, tc.want)
+		}
 	}
 }
 
-// TestSeasonalTitleOverrideHandlesMissingEntry returns empty when the active
-// theme has no title configured (the section's saved Title is the fallback).
-func TestSeasonalTitleOverrideHandlesMissingEntry(t *testing.T) {
-	p := SeasonalThemedParams{
-		EnabledThemes: []string{"halloween", "christmas"},
-		ThemeTitles:   map[string]string{"christmas": "Festive Films"},
+// TestSeasonalCatalogIsUsable guards what configs and the refresher rely on:
+// every theme can be in season, has a default vibe, keeps vibe keys unique,
+// and points at a list the MDBList fetcher accepts.
+func TestSeasonalCatalogIsUsable(t *testing.T) {
+	for _, theme := range SeasonalThemes {
+		if _, ok := SeasonalPredicates[theme.Key]; !ok {
+			t.Errorf("theme %q has no date predicate", theme.Key)
+		}
+		if theme.Weekly && theme.Start != "" {
+			t.Errorf("weekly theme %q has a yearly window", theme.Key)
+		}
+		if theme.Start != "" || theme.End != "" {
+			if _, _, ok := parseMonthDay(theme.Start); !ok {
+				t.Errorf("theme %q start %q is not MM-DD", theme.Key, theme.Start)
+			}
+			if _, _, ok := parseMonthDay(theme.End); !ok {
+				t.Errorf("theme %q end %q is not MM-DD", theme.Key, theme.End)
+			}
+		}
+		if len(theme.Vibes) == 0 {
+			t.Errorf("theme %q has no vibes", theme.Key)
+		}
+		seen := map[string]bool{}
+		for _, vibe := range theme.Vibes {
+			if seen[vibe.Key] {
+				t.Errorf("theme %q repeats vibe %q", theme.Key, vibe.Key)
+			}
+			seen[vibe.Key] = true
+			if _, err := collectionutil.CanonicalMDBListURL(vibe.ListURL); err != nil {
+				t.Errorf("theme %q vibe %q list %q: %v", theme.Key, vibe.Key, vibe.ListURL, err)
+			}
+			if vibe.Name == "" || vibe.Title == "" {
+				t.Errorf("theme %q vibe %q needs a name and title", theme.Key, vibe.Key)
+			}
+		}
 	}
-	got := SeasonalTitleOverride(p, time.Date(2026, 10, 14, 12, 0, 0, 0, time.UTC), nil)
-	if got != "" {
-		t.Errorf("halloween active but no entry → %q, want empty (caller falls back to section Title)", got)
+	if err := (seasonalRecipe{}).Validate(json.RawMessage(DefaultSeasonalConfig)); err != nil {
+		t.Errorf("DefaultSeasonalConfig is invalid: %v", err)
 	}
 }
 
-// TestSeasonalTitleOverrideLegacyMode returns the override only when the
-// legacy theme's predicate fires.
-func TestSeasonalTitleOverrideLegacyMode(t *testing.T) {
-	p := SeasonalThemedParams{
-		Theme:       "halloween",
-		Mode:        "auto",
-		ThemeTitles: map[string]string{"halloween": "Spooky"},
+// TestSeasonalThemeOrders keeps the two orders apart: the catalog runs by
+// date for the editor, and SeasonalThemeOrder ranks every theme exactly once.
+func TestSeasonalThemeOrders(t *testing.T) {
+	ranked := map[string]int{}
+	for _, key := range SeasonalThemeOrder {
+		ranked[key]++
+	}
+	for _, theme := range SeasonalThemes {
+		if ranked[theme.Key] != 1 {
+			t.Errorf("theme %q appears %d times in SeasonalThemeOrder", theme.Key, ranked[theme.Key])
+		}
 	}
-	got := SeasonalTitleOverride(p, time.Date(2026, 10, 14, 12, 0, 0, 0, time.UTC), nil)
-	if got != "Spooky" {
-		t.Errorf("legacy in-season → %q, want Spooky", got)
+	if len(SeasonalThemeOrder) != len(SeasonalThemes) {
+		t.Errorf("SeasonalThemeOrder has %d themes, catalog %d", len(SeasonalThemeOrder), len(SeasonalThemes))
 	}
-	got = SeasonalTitleOverride(p, time.Date(2026, 4, 15, 12, 0, 0, 0, time.UTC), nil)
-	if got != "" {
-		t.Errorf("legacy off-season → %q, want empty", got)
+
+	// Dated themes by usual start (Easter, which moves, sits between March
+	// and June), then the weekly ones.
+	usualStart := func(theme SeasonalTheme) string {
+		if theme.Key == ThemeEaster {
+			return "04-01"
+		}
+		if theme.Weekly {
+			return "13-01"
+		}
+		return theme.Start
+	}
+	for i := 1; i < len(SeasonalThemes); i++ {
+		prev, next := SeasonalThemes[i-1], SeasonalThemes[i]
+		if usualStart(prev) > usualStart(next) {
+			t.Errorf("catalog lists %q before %q, out of calendar order", prev.Key, next.Key)
+		}
 	}
 }
 
@@ -328,52 +551,3 @@ func TestFamilyMovieNightPredicate(t *testing.T) {
 		t.Error("should reject Sunday evening")
 	}
 }
-
-// TestActiveSeasonalThemeWhereSkipsUnusable verifies that an in-season theme
-// failing the usable filter yields to a lower-priority in-season theme instead
-// of blacking out the section — the December regression where an enabled
-// christmas theme without query support suppressed halloween/saturday rails.
-func TestActiveSeasonalThemeWhereSkipsUnusable(t *testing.T) {
-	enabled := []string{"christmas", "saturday_morning"}
-	// A Saturday morning in December: christmas outranks saturday_morning.
-	saturdayInDecember := time.Date(2026, time.December, 12, 9, 0, 0, 0, time.UTC)
-
-	got := ActiveSeasonalThemeWhere(enabled, saturdayInDecember, nil)
-	if got != "christmas" {
-		t.Fatalf("nil filter should pick christmas, got %q", got)
-	}
-
-	noChristmas := func(theme string) bool { return theme != "christmas" }
-	got = ActiveSeasonalThemeWhere(enabled, saturdayInDecember, noChristmas)
-	if got != "saturday_morning" {
-		t.Errorf("filtered selection should fall through to saturday_morning, got %q", got)
-	}
-
-	nothingUsable := func(string) bool { return false }
-	if got := ActiveSeasonalThemeWhere(enabled, saturdayInDecember, nothingUsable); got != "" {
-		t.Errorf("expected no theme when nothing is usable, got %q", got)
-	}
-}
-
-// TestSeasonalTitleOverrideHonorsUsableFilter verifies the title override
-// follows the same filtered selection as the fetcher: when the top-priority
-// in-season theme is unusable, the override comes from the theme that
-// actually resolves.
-func TestSeasonalTitleOverrideHonorsUsableFilter(t *testing.T) {
-	p := SeasonalThemedParams{
-		EnabledThemes: []string{"christmas", "saturday_morning"},
-		ThemeTitles: map[string]string{
-			"christmas":        "Christmas Movies",
-			"saturday_morning": "Saturday Cartoons",
-		},
-	}
-	saturdayInDecember := time.Date(2026, time.December, 12, 9, 0, 0, 0, time.UTC)
-
-	if got := SeasonalTitleOverride(p, saturdayInDecember, nil); got != "Christmas Movies" {
-		t.Errorf("nil filter: got %q, want Christmas Movies", got)
-	}
-	noChristmas := func(theme string) bool { return theme != "christmas" }
-	if got := SeasonalTitleOverride(p, saturdayInDecember, noChristmas); got != "Saturday Cartoons" {
-		t.Errorf("filtered: got %q, want Saturday Cartoons", got)
-	}
-}
diff --git a/internal/sections/recipes/trending_discover.go b/internal/sections/recipes/trending_discover.go
index 8036b7be80..4adb954102 100644
--- a/internal/sections/recipes/trending_discover.go
+++ b/internal/sections/recipes/trending_discover.go
@@ -7,11 +7,11 @@ import (
 )
 
 // TrendingDiscoverParams configures the trending_discover section: external
-// global trending pulled from a single source (TMDB or Trakt), mixing movies +
-// series in one list, matched to titles already in the library.
+// global trending pulled from TMDB, mixing movies + series in one list,
+// matched to titles already in the library.
 type TrendingDiscoverParams struct {
-	Source string `json:"source"` // "tmdb" | "trakt"
-	Window string `json:"window"` // "day" | "week" (TMDB only; ignored by Trakt)
+	Source string `json:"source"` // "tmdb"
+	Window string `json:"window"` // "day" | "week"
 }
 
 type trendingDiscoverRecipe struct{}
@@ -32,9 +32,9 @@ func (trendingDiscoverRecipe) Validate(raw json.RawMessage) error {
 		return err
 	}
 	switch p.Source {
-	case "", "tmdb", "trakt":
+	case "", "tmdb":
 	default:
-		return errors.New(`trending_discover: source must be "tmdb" or "trakt"`)
+		return errors.New(`trending_discover: source must be "tmdb"`)
 	}
 	switch p.Window {
 	case "", "day", "week":
diff --git a/internal/sections/recipes/types.go b/internal/sections/recipes/types.go
index 84a4c9b573..729c5bf1ba 100644
--- a/internal/sections/recipes/types.go
+++ b/internal/sections/recipes/types.go
@@ -67,10 +67,11 @@ type DBPool interface{}
 
 // RecommendationReader matches the recommendation reader interface in sections/fetcher.go.
 type RecommendationReader interface {
-	GetForYouMain(ctx context.Context, userID int, profileID string, limit int, filter catalog.AccessFilter) (*recommendations.ForYouRow, error)
-	GetBecauseYouWatched(ctx context.Context, userID int, profileID, sourceItemID string, limit int, filter catalog.AccessFilter) ([]recommendations.ScoredItem, error)
-	GetSimilarUsersLiked(ctx context.Context, userID int, profileID string, limit int, filter catalog.AccessFilter) ([]recommendations.ScoredItem, error)
-	GetTasteMatchRow(ctx context.Context, userID int, profileID, genre string, limit int, filter catalog.AccessFilter) (*recommendations.ForYouRow, error)
+	SectionForYouMain(ctx context.Context, userID int, profileID string, filter catalog.AccessFilter) (*recommendations.ForYouRow, error)
+	SectionForYouFill(ctx context.Context, userID int, profileID string, filter catalog.AccessFilter) ([]recommendations.ScoredItem, error)
+	SectionBecauseYouWatched(ctx context.Context, userID int, profileID, sourceItemID string, libraryIDs []int, filter catalog.AccessFilter) ([]recommendations.ScoredItem, string, error)
+	SectionSimilarUsersLiked(ctx context.Context, userID int, profileID string, filter catalog.AccessFilter) ([]recommendations.ScoredItem, error)
+	SectionTasteMatchRow(ctx context.Context, userID int, profileID, genre string, filter catalog.AccessFilter) (*recommendations.ForYouRow, error)
 }
 
 // ResolverContext is everything a resolver needs to resolve.
@@ -104,7 +105,7 @@ type SectionItemMeta struct {
 	DurationSeconds   *float64
 	ProgressUpdatedAt *string
 	ItemSource        string    // "in_progress" or "next_up"
-	SortTimestamp     time.Time // when the preceding episode was completed (for ordering)
+	SortTimestamp     time.Time // orders Continue Watching: progress time, or a next-up row's catalog.NextUpResult.ActivityAt
 }
 
 // ResolvedItems is the resolver's output.
diff --git a/internal/sections/recommendation_config_test.go b/internal/sections/recommendation_config_test.go
new file mode 100644
index 0000000000..6293359fbd
--- /dev/null
+++ b/internal/sections/recommendation_config_test.go
@@ -0,0 +1,31 @@
+package sections
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+// TestRecommendationConfigAnchorPrecedence verifies because_you_watched honors
+// both the legacy source_item_id key and the recipe's anchor_item_id key,
+// preferring the legacy key when both are set.
+func TestRecommendationConfigAnchorPrecedence(t *testing.T) {
+	cases := []struct {
+		name   string
+		config string
+		want   string
+	}{
+		{"anchor only", `{"anchor_item_id":"abc"}`, "abc"},
+		{"source only", `{"source_item_id":"def"}`, "def"},
+		{"both set prefers legacy", `{"source_item_id":"def","anchor_item_id":"abc"}`, "def"},
+		{"blank strings auto-pick", `{"source_item_id":"","anchor_item_id":"  "}`, ""},
+		{"empty config auto-picks", `{}`, ""},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			cfg := parseRecommendationSectionConfig(json.RawMessage(tc.config))
+			if got := cfg.anchor(); got != tc.want {
+				t.Errorf("anchor() = %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
diff --git a/internal/sections/recommendation_section_test.go b/internal/sections/recommendation_section_test.go
new file mode 100644
index 0000000000..1249509775
--- /dev/null
+++ b/internal/sections/recommendation_section_test.go
@@ -0,0 +1,373 @@
+package sections
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/recommendations"
+)
+
+// poolReader answers every section read with fixed rows and records the
+// library scope Because You Watched was asked for. The For You and taste
+// match rows have rowType and rowLabel when set. The For You fill is fill,
+// read fillReads times, failing with fillError when set.
+type poolReader struct {
+	pool              []recommendations.ScoredItem
+	anchor            string
+	scopes            [][]int
+	readError         error
+	rowType, rowLabel string
+	fill              []recommendations.ScoredItem
+	fillReads         int
+	fillError         error
+}
+
+func (p *poolReader) row(label string) *recommendations.ForYouRow {
+	if p.rowLabel != "" {
+		label = p.rowLabel
+	}
+	return &recommendations.ForYouRow{Type: p.rowType, Label: label, Items: p.pool}
+}
+
+func (p *poolReader) SectionForYouMain(context.Context, int, string, catalog.AccessFilter) (*recommendations.ForYouRow, error) {
+	if p.readError != nil {
+		return nil, p.readError
+	}
+	return p.row(recommendations.ForYouLabel), nil
+}
+
+func (p *poolReader) SectionForYouFill(context.Context, int, string, catalog.AccessFilter) ([]recommendations.ScoredItem, error) {
+	p.fillReads++
+	return p.fill, p.fillError
+}
+
+func (p *poolReader) SectionBecauseYouWatched(_ context.Context, _ int, _, _ string, libraryIDs []int, _ catalog.AccessFilter) ([]recommendations.ScoredItem, string, error) {
+	p.scopes = append(p.scopes, libraryIDs)
+	return p.pool, p.anchor, p.readError
+}
+
+func (p *poolReader) SectionSimilarUsersLiked(context.Context, int, string, catalog.AccessFilter) ([]recommendations.ScoredItem, error) {
+	return p.pool, p.readError
+}
+
+func (p *poolReader) SectionTasteMatchRow(context.Context, int, string, string, catalog.AccessFilter) (*recommendations.ForYouRow, error) {
+	if p.readError != nil {
+		return nil, p.readError
+	}
+	return p.row(""), nil
+}
+
+// A For You or taste-match section keeps a default heading only while it
+// serves the profile's own row; served a row every profile gets, it takes
+// that row's title. A heading an admin chose is never replaced.
+func TestRecommendationSectionTitle(t *testing.T) {
+	popular := &recommendations.ForYouRow{Type: recommendations.RecTypePopular, Label: "Popular on This Server"}
+	genre := &recommendations.ForYouRow{Type: "genre_sampler", Label: "Top Drama"}
+	highlyRated := &recommendations.ForYouRow{Type: recommendations.RecTypeTopRated, Label: "Highly Rated in Your Library"}
+	recent := &recommendations.ForYouRow{Type: recommendations.RecTypeRecentlyAdded, Label: "Recently Added"}
+	forYou := &recommendations.ForYouRow{Type: "cluster", Label: recommendations.ForYouLabel}
+	cluster := &recommendations.ForYouRow{Type: "cluster", Label: "Because you enjoy Crime"}
+	for _, tc := range []struct {
+		name, title string
+		row         *recommendations.ForYouRow
+		want        string
+	}{
+		{"new profile's For You row", "Recommended for You", popular, "Popular on This Server"},
+		{"default heading in another case", "  recommended FOR you ", recent, "Recently Added"},
+		{"highly rated", "Recommended for You", highlyRated, "Highly Rated in Your Library"},
+		{"taste match without a cluster", "Top Picks Today", genre, "Top Drama"},
+		{"untitled section", "", genre, "Top Drama"},
+		{"profile's own row", "Recommended for You", forYou, "Recommended for You"},
+		{"profile's cluster row", "Top Picks Today", cluster, "Top Picks Today"},
+		{"admin title", "Tonight's Picks", popular, "Tonight's Picks"},
+		{"no row", "Recommended for You", nil, "Recommended for You"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := recommendationSectionTitle(tc.title, tc.row); got != tc.want {
+				t.Fatalf("title = %q, want %q", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestLimitRecommendationItems(t *testing.T) {
+	items := make([]*models.MediaItem, 30)
+	for _, tc := range []struct{ limit, want int }{{0, 20}, {-3, 20}, {5, 5}, {25, 25}, {40, 30}} {
+		if got := len(limitRecommendationItems(items, tc.limit)); got != tc.want {
+			t.Errorf("limitRecommendationItems(30 items, %d) = %d items, want %d", tc.limit, got, tc.want)
+		}
+	}
+}
+
+// A library's recommendation sections fill from the row's whole cached pool:
+// with the profile's 40 strongest picks in one movie library, the other
+// library's row still gets its own 20, and a widened home fetch gets them all.
+func TestRecommendationSectionsFillFromTheWholePoolPostgres(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatalf("connect test database: %v", err)
+	}
+	t.Cleanup(pool.Close)
+
+	prefix := "recs-pool-" + uuid.NewString()[:8] + "-"
+	var libraries [2]int
+	for i := range libraries {
+		if err := pool.QueryRow(ctx, `INSERT INTO media_folders (type, name, enabled) VALUES ('movies', $1, true) RETURNING id`, fmt.Sprintf("%slib-%d", prefix, i)).Scan(&libraries[i]); err != nil {
+			t.Fatalf("seed library: %v", err)
+		}
+	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM media_items WHERE content_id LIKE $1`, prefix+"%")
+		_, _ = pool.Exec(context.Background(), `DELETE FROM media_folders WHERE id = ANY($1)`, libraries[:])
+	})
+
+	scored := make([]recommendations.ScoredItem, recommendations.CacheCandidateLimit)
+	var firstLibrary, secondLibrary []string
+	for i := range scored {
+		id := fmt.Sprintf("%smovie-%02d", prefix, i)
+		scored[i] = recommendations.ScoredItem{MediaItemID: id, Score: float64(len(scored) - i)}
+		library := libraries[0]
+		if i >= 40 {
+			library = libraries[1]
+			secondLibrary = append(secondLibrary, id)
+		} else {
+			firstLibrary = append(firstLibrary, id)
+		}
+		if _, err := pool.Exec(ctx, `INSERT INTO media_items (content_id, type, title, status, genres) VALUES ($1, 'movie', $1, 'matched', '{}'::text[])`, id); err != nil {
+			t.Fatalf("seed item: %v", err)
+		}
+		if _, err := pool.Exec(ctx, `INSERT INTO media_item_libraries (content_id, media_folder_id, first_seen_at) VALUES ($1, $2, $3)`, id, library, time.Now()); err != nil {
+			t.Fatalf("seed membership: %v", err)
+		}
+	}
+	reader := &poolReader{pool: scored, anchor: firstLibrary[0]}
+	fetcher := NewFetcher(pool)
+	fetcher.RecommendationReader = reader
+
+	fetch := func(sectionType SectionType, itemLimit int, libraryID *int) []string {
+		t.Helper()
+		got, err := fetcher.FetchOne(ctx, ResolvedSection{ID: "recs", SectionType: sectionType, Title: "Recommended", ItemLimit: itemLimit}, libraryID, nil, 7, "p1", catalog.AccessFilter{})
+		if err != nil {
+			t.Fatalf("FetchOne(%s): %v", sectionType, err)
+		}
+		if got.TotalCount != len(got.Items) {
+			t.Fatalf("FetchOne(%s) total %d for %d items", sectionType, got.TotalCount, len(got.Items))
+		}
+		return contentIDs(got.Items)
+	}
+
+	for _, sectionType := range []SectionType{SectionRecommendedForYou, SectionSimilarUsersLiked, SectionTasteMatch, SectionBecauseYouWatched} {
+		if got := fetch(sectionType, 20, &libraries[1]); !slices.Equal(got, secondLibrary) {
+			t.Fatalf("%s in the second library = %v, want its 20 picks %v", sectionType, got, secondLibrary)
+		}
+		if got := fetch(sectionType, 20, &libraries[0]); !slices.Equal(got, firstLibrary[:20]) {
+			t.Fatalf("%s in the first library = %v, want its 20 strongest picks", sectionType, got)
+		}
+		// Home with hide-watched widens the fetch window past the row size.
+		if got := fetch(sectionType, 100, nil); len(got) != recommendations.CacheCandidateLimit {
+			t.Fatalf("%s on a widened home fetch = %d items, want %d", sectionType, len(got), recommendations.CacheCandidateLimit)
+		}
+	}
+
+	// Because You Watched picks its anchor within the section's scope.
+	reader.scopes = nil
+	fetch(SectionBecauseYouWatched, 20, &libraries[1])
+	fetch(SectionBecauseYouWatched, 20, nil)
+	if len(reader.scopes) != 2 || !slices.Equal(reader.scopes[0], []int{libraries[1]}) || reader.scopes[1] != nil {
+		t.Fatalf("anchor scopes = %v, want [[%d] []]", reader.scopes, libraries[1])
+	}
+}
+
+// A library's For You section the main row leaves short continues with the
+// profile's other personal rows in that library, in the reader's order and
+// without repeating a main-row title. A row the main row fills, a home
+// section and a row every profile is offered read no fill.
+func TestForYouSectionFillsALibraryFromOtherPersonalRowsPostgres(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatalf("connect test database: %v", err)
+	}
+	t.Cleanup(pool.Close)
+
+	prefix := "recs-fill-" + uuid.NewString()[:8] + "-"
+	var movies, anime int
+	for name, id := range map[string]*int{"movies": &movies, "anime": &anime} {
+		if err := pool.QueryRow(ctx, `INSERT INTO media_folders (type, name, enabled) VALUES ('movies', $1, true) RETURNING id`, prefix+name).Scan(id); err != nil {
+			t.Fatalf("seed library: %v", err)
+		}
+	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM media_items WHERE content_id LIKE $1`, prefix+"%")
+		_, _ = pool.Exec(context.Background(), `DELETE FROM media_folders WHERE id = ANY($1)`, []int{movies, anime})
+	})
+	seed := func(name string, n, library int) []recommendations.ScoredItem {
+		t.Helper()
+		items := make([]recommendations.ScoredItem, n)
+		for i := range items {
+			id := fmt.Sprintf("%s%s-%02d", prefix, name, i)
+			items[i] = recommendations.ScoredItem{MediaItemID: id, Score: float64(n - i)}
+			if _, err := pool.Exec(ctx, `INSERT INTO media_items (content_id, type, title, status, genres) VALUES ($1, 'movie', $1, 'matched', '{}'::text[])`, id); err != nil {
+				t.Fatalf("seed item: %v", err)
+			}
+			if _, err := pool.Exec(ctx, `INSERT INTO media_item_libraries (content_id, media_folder_id, first_seen_at) VALUES ($1, $2, $3)`, id, library, time.Now()); err != nil {
+				t.Fatalf("seed membership: %v", err)
+			}
+		}
+		return items
+	}
+	// The main row holds 30 titles, all in the movie library. The fill holds
+	// 25 anime titles, 5 more movie titles and 2 main-row titles.
+	main := seed("main", 30, movies)
+	animeFill := seed("anime", 25, anime)
+	movieFill := seed("movie", 5, movies)
+	fill := slices.Concat(animeFill[:10], main[:2], movieFill, animeFill[10:])
+	reader := &poolReader{pool: main, rowType: "cluster", fill: fill}
+	fetcher := NewFetcher(pool)
+	fetcher.RecommendationReader = reader
+
+	fetch := func(itemLimit int, libraryID *int) []string {
+		t.Helper()
+		got, err := fetcher.FetchOne(ctx, ResolvedSection{ID: "recs", SectionType: SectionRecommendedForYou, Title: "Recommended for You", ItemLimit: itemLimit}, libraryID, nil, 7, "p1", catalog.AccessFilter{})
+		if err != nil {
+			t.Fatalf("FetchOne: %v", err)
+		}
+		if got.TotalCount != len(got.Items) {
+			t.Fatalf("total %d for %d items", got.TotalCount, len(got.Items))
+		}
+		if len(got.Items) > 0 && got.Title != "Recommended for You" {
+			t.Fatalf("title = %q, want the section's heading", got.Title)
+		}
+		return contentIDs(got.Items)
+	}
+	ids := func(items ...[]recommendations.ScoredItem) []string {
+		var out []string
+		for _, row := range items {
+			for _, item := range row {
+				out = append(out, item.MediaItemID)
+			}
+		}
+		return out
+	}
+
+	for _, tc := range []struct {
+		name      string
+		itemLimit int
+		libraryID *int
+		want      []string
+		fillReads int
+	}{
+		{"anime library, no main-row title in it", 20, &anime, ids(animeFill[:20]), 1},
+		{"movie library the main row fills", 20, &movies, ids(main[:20]), 0},
+		{"movie library past the main row", 40, &movies, ids(main, movieFill), 1},
+		{"home", 100, nil, ids(main), 0},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			reader.fillReads = 0
+			if got := fetch(tc.itemLimit, tc.libraryID); !slices.Equal(got, tc.want) {
+				t.Fatalf("items = %v, want %v", got, tc.want)
+			}
+			if reader.fillReads != tc.fillReads {
+				t.Fatalf("fill reads = %d, want %d", reader.fillReads, tc.fillReads)
+			}
+		})
+	}
+
+	// A new profile's Popular row is served as it is, titled after itself.
+	reader.rowType, reader.rowLabel, reader.fillReads = recommendations.RecTypePopular, "Popular on This Server", 0
+	got, err := fetcher.FetchOne(ctx, ResolvedSection{ID: "recs", SectionType: SectionRecommendedForYou, Title: "Recommended for You", ItemLimit: 20}, &anime, nil, 7, "p1", catalog.AccessFilter{})
+	if err != nil || len(got.Items) != 0 || reader.fillReads != 0 {
+		t.Fatalf("Popular row in the anime library = %d items, %d fill reads, %v; want an empty row and no fill", len(got.Items), reader.fillReads, err)
+	}
+}
+
+// A failed fill fails the section, like a failed main-row read.
+func TestForYouSectionFillErrorFailsTheSection(t *testing.T) {
+	library := 3
+	fetcher := &Fetcher{RecommendationReader: &poolReader{rowType: "cluster", fillError: fmt.Errorf("cache read failed")}}
+	if _, err := fetcher.FetchOne(context.Background(), ResolvedSection{ID: "recs", SectionType: SectionRecommendedForYou, ItemLimit: 20}, &library, nil, 7, "p1", catalog.AccessFilter{}); err == nil {
+		t.Fatal("FetchOne succeeded, want the fill's error")
+	}
+}
+
+// A reader failure fails the section rather than answering an empty row.
+func TestRecommendationSectionReadErrorFailsTheSection(t *testing.T) {
+	fetcher := &Fetcher{RecommendationReader: &poolReader{readError: fmt.Errorf("cache read failed")}}
+	for _, sectionType := range []SectionType{SectionRecommendedForYou, SectionSimilarUsersLiked, SectionTasteMatch, SectionBecauseYouWatched} {
+		if _, err := fetcher.FetchOne(context.Background(), ResolvedSection{ID: "recs", SectionType: sectionType, ItemLimit: 20}, nil, nil, 7, "p1", catalog.AccessFilter{}); err == nil {
+			t.Fatalf("%s: FetchOne succeeded, want the reader's error", sectionType)
+		}
+	}
+
+	// Without a reader the section degrades to empty.
+	got, err := (&Fetcher{}).FetchOne(context.Background(), ResolvedSection{ID: "recs", SectionType: SectionRecommendedForYou, ItemLimit: 20}, nil, nil, 7, "p1", catalog.AccessFilter{})
+	if err != nil || len(got.Items) != 0 {
+		t.Fatalf("FetchOne without a reader = %d items, %v; want an empty section", len(got.Items), err)
+	}
+}
+
+// FetchOne titles a For You or taste-match section after the row it serves
+// when that row is not the profile's own, and keeps an admin's heading; a
+// row filtered empty leaves the heading alone.
+func TestRecommendationSectionsTakeTheServedRowTitlePostgres(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatalf("connect test database: %v", err)
+	}
+	t.Cleanup(pool.Close)
+
+	id := "recs-title-" + uuid.NewString()[:8]
+	t.Cleanup(func() { _, _ = pool.Exec(context.Background(), `DELETE FROM media_items WHERE content_id = $1`, id) })
+	if _, err := pool.Exec(ctx, `INSERT INTO media_items (content_id, type, title, status, genres) VALUES ($1, 'movie', $1, 'matched', '{}'::text[])`, id); err != nil {
+		t.Fatalf("seed item: %v", err)
+	}
+	fetcher := NewFetcher(pool)
+	for _, tc := range []struct {
+		name              string
+		sectionType       SectionType
+		title             string
+		rowType, rowLabel string
+		pool              []recommendations.ScoredItem
+		want              string
+	}{
+		{"new profile", SectionRecommendedForYou, "Recommended for You", recommendations.RecTypePopular, "Popular on This Server", []recommendations.ScoredItem{{MediaItemID: id}}, "Popular on This Server"},
+		{"warm profile", SectionRecommendedForYou, "Recommended for You", "cluster", recommendations.ForYouLabel, []recommendations.ScoredItem{{MediaItemID: id}}, "Recommended for You"},
+		{"taste match fallback", SectionTasteMatch, "Top Picks Today", "genre_sampler", "Top Drama", []recommendations.ScoredItem{{MediaItemID: id}}, "Top Drama"},
+		{"admin title", SectionRecommendedForYou, "Movie Night", recommendations.RecTypePopular, "Popular on This Server", []recommendations.ScoredItem{{MediaItemID: id}}, "Movie Night"},
+		{"row filtered empty", SectionRecommendedForYou, "Recommended for You", recommendations.RecTypePopular, "Popular on This Server", []recommendations.ScoredItem{{MediaItemID: id + "-missing"}}, "Recommended for You"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			fetcher.RecommendationReader = &poolReader{pool: tc.pool, rowType: tc.rowType, rowLabel: tc.rowLabel}
+			got, err := fetcher.FetchOne(ctx, ResolvedSection{ID: "recs", SectionType: tc.sectionType, Title: tc.title, ItemLimit: 20}, nil, nil, 7, "p1", catalog.AccessFilter{})
+			if err != nil {
+				t.Fatal(err)
+			}
+			if got.Title != tc.want {
+				t.Fatalf("title = %q, want %q", got.Title, tc.want)
+			}
+		})
+	}
+}
diff --git a/internal/sections/recommendation_title.go b/internal/sections/recommendation_title.go
new file mode 100644
index 0000000000..57304ad15e
--- /dev/null
+++ b/internal/sections/recommendation_title.go
@@ -0,0 +1,116 @@
+package sections
+
+import (
+	"context"
+	"slices"
+	"strings"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/recommendations"
+)
+
+// A For You or taste-match section is not always served the profile's own
+// row: a new profile's For You row is Popular or Recently Added, and a
+// profile without a matching taste cluster gets a genre row. The section
+// then takes the served row's title, so its heading describes what it shows.
+// Like the Because You Watched heading, it is resolved with the items,
+// outside the shared, user-agnostic cache.
+func (f *Fetcher) fetchRecommendationRowWithTitle(ctx context.Context, section ResolvedSection, libraryID *int, libraryIDs []int, userID int, profileID string, filter catalog.AccessFilter, reader recommendationReader) (SectionWithItems, error) {
+	result := SectionWithItems{ResolvedSection: section, Items: []*models.MediaItem{}}
+	// The main row and its fill share one walk of the watch history.
+	ctx = recommendations.WithWatchedSetMemo(ctx)
+	var row *recommendations.ForYouRow
+	var err error
+	switch section.SectionType {
+	case SectionRecommendedForYou:
+		row, err = reader.SectionForYouMain(ctx, userID, profileID, filter)
+	case SectionTasteMatch:
+		// An empty genre is valid: the reader auto-picks the profile's
+		// strongest taste cluster (falling back to the server top genre).
+		row, err = reader.SectionTasteMatchRow(ctx, userID, profileID, strings.TrimSpace(parseRecommendationSectionConfig(section.Config).Genre), filter)
+	}
+	if err != nil {
+		return SectionWithItems{}, err
+	}
+	if row == nil {
+		return result, nil
+	}
+	items, err := f.scopeRecommendationItems(ctx, row.Items, libraryID, libraryIDs, filter)
+	if err != nil {
+		return SectionWithItems{}, err
+	}
+	if section.SectionType == SectionRecommendedForYou && libraryID != nil && !row.Global() &&
+		len(items) < recommendationSectionLimit(section.ItemLimit) {
+		if items, err = f.fillForYouSection(ctx, items, row, libraryID, libraryIDs, userID, profileID, filter, reader); err != nil {
+			return SectionWithItems{}, err
+		}
+	}
+	result.Items = limitRecommendationItems(items, section.ItemLimit)
+	result.TotalCount = len(result.Items)
+	if len(result.Items) > 0 {
+		result.Title = recommendationSectionTitle(section.Title, row)
+	}
+	return result, nil
+}
+
+// fillForYouSection follows a library's For You items, the main row's titles
+// in the library, with the library's titles from the profile's other
+// personal rows (see Reader.SectionForYouFill). The main row is ranked for
+// everything the profile can see, so a library with a small share of the
+// catalog can hold few of its titles. A row every profile is offered, such
+// as a new profile's Popular row, is not filled: the section is titled after
+// it.
+func (f *Fetcher) fillForYouSection(ctx context.Context, items []*models.MediaItem, row *recommendations.ForYouRow, libraryID *int, libraryIDs []int, userID int, profileID string, filter catalog.AccessFilter, reader recommendationReader) ([]*models.MediaItem, error) {
+	fill, err := reader.SectionForYouFill(ctx, userID, profileID, filter)
+	if err != nil {
+		return nil, err
+	}
+	// The main row's titles in the library are already in items.
+	inMain := make(map[string]struct{}, len(row.Items))
+	for _, item := range row.Items {
+		inMain[item.MediaItemID] = struct{}{}
+	}
+	fill = slices.DeleteFunc(fill, func(item recommendations.ScoredItem) bool {
+		_, ok := inMain[item.MediaItemID]
+		return ok
+	})
+	more, err := f.scopeRecommendationItems(ctx, fill, libraryID, libraryIDs, filter)
+	if err != nil {
+		return nil, err
+	}
+	return append(items, more...), nil
+}
+
+// The headings For You and taste-match sections are created with.
+const (
+	defaultRecommendedForYouTitle = "Recommended for You"
+	defaultTasteMatchTitle        = "Top Picks Today"
+)
+
+var defaultRecommendationTitles = []string{defaultRecommendedForYouTitle, defaultTasteMatchTitle}
+
+func hasDefaultRecommendationTitle(title string) bool {
+	trimmed := strings.TrimSpace(title)
+	if trimmed == "" {
+		return true
+	}
+	for _, t := range defaultRecommendationTitles {
+		if strings.EqualFold(trimmed, t) {
+			return true
+		}
+	}
+	return false
+}
+
+// recommendationSectionTitle is the heading of a section titled title that
+// serves row: the row's title when the row is one every profile is offered
+// and the section still has a default heading, else title. A row built from
+// the profile's history keeps the section's heading, and a heading an admin
+// chose is never replaced.
+func recommendationSectionTitle(title string, row *recommendations.ForYouRow) string {
+	if row == nil || !row.Global() || row.Label == "" || !hasDefaultRecommendationTitle(title) {
+		return title
+	}
+	return row.Label
+}
diff --git a/internal/sections/repo.go b/internal/sections/repo.go
index f7ac18b0e6..df76f364f4 100644
--- a/internal/sections/repo.go
+++ b/internal/sections/repo.go
@@ -5,7 +5,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"slices"
 
 	"github.com/jackc/pgx/v5"
 	"github.com/jackc/pgx/v5/pgxpool"
@@ -161,14 +160,14 @@ func (r *Repository) ListTrendingDiscoverConfigs(ctx context.Context) ([]json.Ra
 	return out, rows.Err()
 }
 
-// ListTrendingDiscoverSections returns enabled trending sections with their
-// identities so profile overrides can contribute their effective configs.
-func (r *Repository) ListTrendingDiscoverSections(ctx context.Context) ([]*PageSection, error) {
+// ListEnabledSections returns the enabled sections of one type with their
+// identities, so profile overrides can contribute their effective configs.
+func (r *Repository) ListEnabledSections(ctx context.Context, sectionType SectionType) ([]*PageSection, error) {
 	rows, err := r.query(ctx).Query(ctx, fmt.Sprintf(`
 		SELECT %s FROM page_sections
-		WHERE section_type = 'trending_discover' AND enabled = true`, sectionColumns))
+		WHERE section_type = $1 AND enabled = true`, sectionColumns), string(sectionType))
 	if err != nil {
-		return nil, fmt.Errorf("listing trending_discover sections: %w", err)
+		return nil, fmt.Errorf("listing %s sections: %w", sectionType, err)
 	}
 	defer rows.Close()
 	return scanSections(rows)
@@ -496,24 +495,17 @@ func (r *Repository) nextHomePosition(ctx context.Context) (int, error) {
 	return maxPosition + 1, nil
 }
 
-// hasEnabledSharedHomeRecentlyAdded reports whether home has an enabled
-// Recently Added row that covers every video library.
-func hasEnabledSharedHomeRecentlyAdded(home []*PageSection) bool {
-	return slices.ContainsFunc(home, func(s *PageSection) bool {
-		return s.Enabled && IsSharedHomeRecentlyAddedSection(s)
-	})
-}
-
 func (r *Repository) createGeneratedHomeLibraryRecentSections(ctx context.Context, libraryID int, libraryName, libraryType string) ([]*PageSection, error) {
 	if IsVideoLibraryType(libraryType) {
 		home, err := r.ListByScopeAll(ctx, "home", nil)
 		if err != nil {
 			return nil, fmt.Errorf("listing home sections: %w", err)
 		}
-		// An enabled shared Recently Added row already shows the new library.
-		// Homes from older defaults, or whose admin disabled the shared row,
-		// still get per-library rows.
-		if hasEnabledSharedHomeRecentlyAdded(home) {
+		// Enabled home Recently Added rows covering this library's types
+		// (the split default rows, or a combined row from older defaults)
+		// already show the new library. Homes without them, or whose admin
+		// disabled them, still get per-library rows.
+		if hasEnabledHomeRecentlyAddedCovering(home, libraryType) {
 			return nil, nil
 		}
 	}
diff --git a/internal/sections/resolver_test.go b/internal/sections/resolver_test.go
index ae9bc549aa..ab1b2ac070 100644
--- a/internal/sections/resolver_test.go
+++ b/internal/sections/resolver_test.go
@@ -268,7 +268,7 @@ func TestResolveEmptySectionIDPrefersExplicitUserFields(t *testing.T) {
 	overrides := []ProfileSectionOverride{{
 		ID:              "conflicting",
 		SectionType:     SectionTrendingDiscover,
-		Config:          json.RawMessage(`{"source":"trakt","window":"week"}`),
+		Config:          json.RawMessage(`{"source":"tmdb","window":"week"}`),
 		IsUserAdded:     false,
 		UserSectionType: SectionTrendingDiscover,
 		UserConfig:      json.RawMessage(`{"source":"tmdb","window":"day"}`),
diff --git a/internal/sections/returning_shows_db_test.go b/internal/sections/returning_shows_db_test.go
new file mode 100644
index 0000000000..16910ebd8a
--- /dev/null
+++ b/internal/sections/returning_shows_db_test.go
@@ -0,0 +1,117 @@
+package sections
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+)
+
+// TestReturningShowsDB pins which series Returning Shows surfaces: a season
+// newer than any the profile watched, added inside the lookback window, with a
+// present file, newest arrival first. It forces the generic plan Postgres
+// caches for a statement a connection keeps running, the plan that made this
+// query slow.
+func TestReturningShowsDB(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	config, err := pgxpool.ParseConfig(dsn)
+	if err != nil {
+		t.Fatalf("parse test database url: %v", err)
+	}
+	config.ConnConfig.RuntimeParams["plan_cache_mode"] = "force_generic_plan"
+	pool, err := pgxpool.NewWithConfig(ctx, config)
+	if err != nil {
+		t.Fatalf("connect test database: %v", err)
+	}
+	t.Cleanup(pool.Close)
+
+	suffix := time.Now().UnixNano()
+	id := func(name string) string { return fmt.Sprintf("returning-%s-%d", name, suffix) }
+	exec := func(sql string, args ...any) {
+		t.Helper()
+		if _, err := pool.Exec(ctx, sql, args...); err != nil {
+			t.Fatalf("seed: %v\n%s", err, sql)
+		}
+	}
+
+	var folderID, userID int
+	if err := pool.QueryRow(ctx, `INSERT INTO media_folders (type, name, enabled) VALUES ('series', $1, true) RETURNING id`, id("folder")).Scan(&folderID); err != nil {
+		t.Fatalf("seed folder: %v", err)
+	}
+	if err := pool.QueryRow(ctx, `INSERT INTO users (username, email, password_hash, role) VALUES ($1, $2, '', 'user') RETURNING id`, id("user"), id("user")+"@example.test").Scan(&userID); err != nil {
+		t.Fatalf("seed user: %v", err)
+	}
+	profileID, otherProfileID := id("profile"), id("other-profile")
+
+	// Each series has S1E1 and S2E1. watched is the season this profile
+	// watched (0 for none), newAge is how long ago S2E1 was added.
+	newest, older := id("newest"), id("older")
+	caughtUp, noFile, stale, otherProfile, unwatched := id("caught-up"), id("no-file"), id("stale"), id("other-profile-series"), id("unwatched")
+	series := []struct {
+		id         string
+		watched    int
+		watchedBy  string
+		newAge     time.Duration
+		missingNew bool
+	}{
+		{newest, 1, profileID, time.Hour, false},
+		{older, 1, profileID, 48 * time.Hour, false},
+		{caughtUp, 2, profileID, time.Hour, false},
+		{noFile, 1, profileID, time.Hour, true},
+		{stale, 1, profileID, 60 * 24 * time.Hour, false},
+		{otherProfile, 1, otherProfileID, time.Hour, false},
+		{unwatched, 0, "", time.Hour, false},
+	}
+	var seriesIDs []string
+	for _, s := range series {
+		seriesIDs = append(seriesIDs, s.id)
+	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(ctx, `DELETE FROM user_watch_history WHERE user_id = $1`, userID)
+		_, _ = pool.Exec(ctx, `DELETE FROM media_files WHERE media_folder_id = $1`, folderID)
+		_, _ = pool.Exec(ctx, `DELETE FROM users WHERE id = $1`, userID)
+		_, _ = pool.Exec(ctx, `DELETE FROM episodes WHERE series_id = ANY($1)`, seriesIDs)
+		_, _ = pool.Exec(ctx, `DELETE FROM media_items WHERE content_id = ANY($1)`, seriesIDs)
+		_, _ = pool.Exec(ctx, `DELETE FROM media_folders WHERE id = $1`, folderID)
+	})
+
+	for _, s := range series {
+		s1, s2 := s.id+"-s1e1", s.id+"-s2e1"
+		exec(`INSERT INTO media_items (content_id, type, title, status, genres) VALUES ($1, 'series', $1, 'matched', '{}'::text[])`, s.id)
+		exec(`INSERT INTO episodes (content_id, series_id, season_number, episode_number, title, overview, runtime, rating_imdb, created_at)
+			VALUES ($1, $3, 1, 1, 'One', '', 30, 0, NOW() - interval '400 days'), ($2, $3, 2, 1, 'Two', '', 30, 0, NOW() - make_interval(secs => $4))`,
+			s1, s2, s.id, s.newAge.Seconds())
+		exec(`INSERT INTO media_files (episode_id, media_folder_id, file_path, duration) VALUES ($1, $2, '/returning/' || $1, 1800)`, s1, folderID)
+		if s.missingNew {
+			exec(`INSERT INTO media_files (episode_id, media_folder_id, file_path, duration, missing_since) VALUES ($1, $2, '/returning/' || $1, 1800, NOW())`, s2, folderID)
+		} else {
+			exec(`INSERT INTO media_files (episode_id, media_folder_id, file_path, duration) VALUES ($1, $2, '/returning/' || $1, 1800)`, s2, folderID)
+		}
+		if s.watched > 0 {
+			watchedEpisode := fmt.Sprintf("%s-s%de1", s.id, s.watched)
+			exec(`INSERT INTO user_watch_history (id, user_id, profile_id, media_item_id, watched_at) VALUES ($1, $2, $3, $4, NOW() - interval '200 days')`,
+				id("history-"+s.id), userID, s.watchedBy, watchedEpisode)
+		}
+	}
+	exec(`INSERT INTO media_item_libraries (content_id, media_folder_id) SELECT unnest($1::text[]), $2`, seriesIDs, folderID)
+
+	section := ResolvedSection{ID: id("section"), SectionType: SectionReturningShows, ItemLimit: 20}
+	filter := catalog.AccessFilter{AllowedLibraryIDs: []int{folderID}}
+	got, err := NewFetcher(pool).FetchOne(ctx, section, nil, []int{folderID}, userID, profileID, filter)
+	if err != nil {
+		t.Fatalf("FetchOne: %v", err)
+	}
+	if ids, want := contentIDs(got.Items), []string{newest, older}; strings.Join(ids, ",") != strings.Join(want, ",") {
+		t.Fatalf("row = %v, want %v", ids, want)
+	}
+}
diff --git a/internal/sections/seasonal_clock_test.go b/internal/sections/seasonal_clock_test.go
deleted file mode 100644
index 12006c37bf..0000000000
--- a/internal/sections/seasonal_clock_test.go
+++ /dev/null
@@ -1,124 +0,0 @@
-package sections
-
-import (
-	"context"
-	"encoding/json"
-	"testing"
-	"time"
-
-	"github.com/prairie-server/prairie-server/internal/catalog"
-	"github.com/prairie-server/prairie-server/internal/sections/recipes"
-)
-
-// halloweenSeasonalSection builds a ResolvedSection configured for the
-// halloween theme in auto mode.
-type fixedClock time.Time
-
-func (f fixedClock) Now() time.Time { return time.Time(f) }
-
-func halloweenSeasonalSection() ResolvedSection {
-	cfg, _ := json.Marshal(recipes.SeasonalThemedParams{Theme: "halloween", Mode: "auto"})
-	return ResolvedSection{
-		ID:          "test-halloween",
-		SectionType: SectionSeasonalThemed,
-		Title:       "Halloween Picks",
-		Config:      cfg,
-		ItemLimit:   10,
-	}
-}
-
-// TestSeasonalThemedSuppressesOffSeason verifies that an auto-mode seasonal
-// section returns no items when the injected clock is outside the theme's
-// date window. This exercises the off-season branch of fetchSeasonalThemed
-// without needing a database — the early return runs before any SQL.
-func TestSeasonalThemedSuppressesOffSeason(t *testing.T) {
-	f := &Fetcher{
-		Clock: fixedClock(time.Date(2026, 7, 4, 12, 0, 0, 0, time.UTC)), // Independence Day, well clear of October
-	}
-	items, total, err := f.fetchSection(
-		context.Background(),
-		halloweenSeasonalSection(),
-		nil, nil, 0, "",
-		catalog.AccessFilter{},
-	)
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if len(items) != 0 || total != 0 {
-		t.Errorf("expected empty result off-season; got %d items, total %d", len(items), total)
-	}
-}
-
-// TestSeasonalThemedPinnedModeAttemptsQuery verifies that mode=pinned
-// bypasses the off-season suppression. A pinned section in July should
-// proceed past the clock check and attempt the query (which will fail with
-// nil pool — we assert the right kind of failure to confirm the path was reached).
-func TestSeasonalThemedPinnedModeAttemptsQuery(t *testing.T) {
-	f := &Fetcher{
-		Clock: fixedClock(time.Date(2026, 7, 4, 12, 0, 0, 0, time.UTC)),
-	}
-	cfg, _ := json.Marshal(recipes.SeasonalThemedParams{Theme: "halloween", Mode: "pinned"})
-	s := ResolvedSection{
-		ID:          "test-halloween-pinned",
-		SectionType: SectionSeasonalThemed,
-		Config:      cfg,
-		ItemLimit:   10,
-	}
-
-	var reached bool
-	func() {
-		defer func() {
-			if r := recover(); r != nil {
-				// Panic from nil pool confirms we got past the off-season check.
-				reached = true
-			}
-		}()
-		_, _, err := f.fetchSection(
-			context.Background(),
-			s,
-			nil, nil, 0, "",
-			catalog.AccessFilter{},
-		)
-		if err != nil {
-			// Non-nil error from nil pool also confirms the SQL path was reached.
-			reached = true
-		}
-	}()
-
-	if !reached {
-		t.Fatal("pinned mode should have attempted the query (reached SQL path); clean nil result suggests off-season suppression triggered despite mode=pinned")
-	}
-}
-
-// TestSeasonalThemedInSeasonAttemptsQuery confirms that auto mode in October
-// bypasses the off-season check and attempts the query.
-func TestSeasonalThemedInSeasonAttemptsQuery(t *testing.T) {
-	f := &Fetcher{
-		Clock: fixedClock(time.Date(2026, 10, 15, 12, 0, 0, 0, time.UTC)), // mid-October
-	}
-
-	var reached bool
-
-	func() {
-		defer func() {
-			if r := recover(); r != nil {
-				// Panic from nil pool confirms we got past the off-season check.
-				reached = true
-			}
-		}()
-		_, _, err := f.fetchSection(
-			context.Background(),
-			halloweenSeasonalSection(),
-			nil, nil, 0, "",
-			catalog.AccessFilter{},
-		)
-		if err != nil {
-			// Non-nil error from nil pool also confirms the SQL path was reached.
-			reached = true
-		}
-	}()
-
-	if !reached {
-		t.Fatal("in-season auto mode should have attempted the query (reached SQL path); clean nil result suggests off-season suppression triggered incorrectly")
-	}
-}
diff --git a/internal/sections/seasonal_fetch_test.go b/internal/sections/seasonal_fetch_test.go
new file mode 100644
index 0000000000..eb9a1920d1
--- /dev/null
+++ b/internal/sections/seasonal_fetch_test.go
@@ -0,0 +1,391 @@
+package sections
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"os"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/access"
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/collectionutil"
+	"github.com/prairie-server/prairie-server/internal/recommendations"
+	"github.com/prairie-server/prairie-server/internal/sections/recipes"
+)
+
+type fixedClock time.Time
+
+func (f fixedClock) Now() time.Time { return time.Time(f) }
+
+type stubSeasonalList []seasonalListEntry
+
+func (s stubSeasonalList) Get(_ context.Context, listURL string) (SeasonalListSnapshot, bool, error) {
+	return SeasonalListSnapshot{ListURL: listURL, Entries: s}, true, nil
+}
+
+type stubThemeNeighbors []string
+
+func (s stubThemeNeighbors) ThemeNeighbors(context.Context, []string, int, catalog.AccessFilter) ([]recommendations.ScoredItem, error) {
+	out := make([]recommendations.ScoredItem, 0, len(s))
+	for _, id := range s {
+		out = append(out, recommendations.ScoredItem{MediaItemID: id})
+	}
+	return out, nil
+}
+
+// TestSeasonalRowShowsOwnedListTitles drives a seasonal row against the
+// catalog: the in-season list's owned titles in list order, within the
+// viewer's rating limit, topped up with theme neighbors unless the row is
+// lists only, titled by the vibe, and empty off season.
+func TestSeasonalRowShowsOwnedListTitles(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatalf("connect test database: %v", err)
+	}
+	t.Cleanup(pool.Close)
+
+	suffix := time.Now().UnixNano()
+	id := func(name string) string { return fmt.Sprintf("seasonal-%s-%d", name, suffix) }
+	tmdb := func(n int) string { return fmt.Sprintf("%d%d", n, suffix%1_000_000_000) }
+	ids := []string{id("popular-r"), id("pg-movie"), id("pg-show"), id("neighbor")}
+	var libraryID int
+	if err := pool.QueryRow(ctx, `
+		INSERT INTO media_folders (type, name, enabled) VALUES ('movies', $1, true) RETURNING id`,
+		id("library")).Scan(&libraryID); err != nil {
+		t.Fatalf("seed media folder: %v", err)
+	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM media_items WHERE content_id = ANY($1)`, ids)
+		_, _ = pool.Exec(context.Background(), `DELETE FROM media_folders WHERE id = $1`, libraryID)
+	})
+	if _, err := pool.Exec(ctx, `
+		INSERT INTO media_items (content_id, type, title, tmdb_id, tvdb_id, content_rating, content_rating_age) VALUES
+			($1, 'movie',  'Popular R Movie', $5, '', 'R', 17),
+			($2, 'movie',  'PG Movie',        $6, '', 'PG', 8),
+			($3, 'series', 'PG Show',         '', $7, 'TV-PG', 8),
+			($4, 'movie',  'Neighbor',        '', '', 'PG', 8)`,
+		ids[0], ids[1], ids[2], ids[3], tmdb(1), tmdb(2), tmdb(3)); err != nil {
+		t.Fatalf("seed media items: %v", err)
+	}
+	if _, err := pool.Exec(ctx, `
+		INSERT INTO media_item_libraries (content_id, media_folder_id) SELECT unnest($1::text[]), $2`,
+		ids, libraryID); err != nil {
+		t.Fatalf("seed media item libraries: %v", err)
+	}
+
+	list := stubSeasonalList{
+		{TMDB: tmdb(1), Type: "movie"},
+		{TMDB: tmdb(9), Type: "movie"}, // not in the library
+		{TMDB: tmdb(2), Type: "movie"},
+		{TVDB: tmdb(3), Type: "show"},
+	}
+	october := fixedClock(time.Date(2026, 10, 14, 20, 0, 0, 0, time.UTC))
+	newFetcher := func(clock recipes.Clock) *Fetcher {
+		f := NewFetcher(pool)
+		f.Clock = clock
+		f.SeasonalLists = list
+		f.SeasonalNeighbors = stubThemeNeighbors{ids[1], ids[3]}
+		return f
+	}
+	section := func(params recipes.SeasonalThemedParams, limit int) ResolvedSection {
+		config, _ := json.Marshal(params)
+		return ResolvedSection{ID: "seasonal-test", SectionType: SectionSeasonalThemed, Title: "Seasonal Picks", ItemLimit: limit, Config: config}
+	}
+	pgViewer := catalog.AccessFilter{MaturityLimits: access.MaturityLimits{MaxContentRating: "PG"}}
+	contentIDs := func(t *testing.T, s ResolvedSection, f *Fetcher, filter catalog.AccessFilter) []string {
+		t.Helper()
+		items, _, err := f.fetchSeasonalThemed(ctx, s, &libraryID, nil, filter)
+		if err != nil {
+			t.Fatalf("fetchSeasonalThemed: %v", err)
+		}
+		out := make([]string, 0, len(items))
+		for _, item := range items {
+			out = append(out, item.ContentID)
+		}
+		return out
+	}
+	halloween := recipes.SeasonalThemedParams{EnabledThemes: []string{"halloween"}}
+
+	t.Run("lists only keeps list order within the rating limit", func(t *testing.T) {
+		got := contentIDs(t, section(recipes.SeasonalThemedParams{EnabledThemes: []string{"halloween"}, Source: recipes.SeasonalSourceLists}, 10), newFetcher(october), pgViewer)
+		assertIDs(t, got, ids[1], ids[2])
+	})
+	t.Run("recommendations fill a short row without repeating list titles", func(t *testing.T) {
+		got := contentIDs(t, section(halloween, 10), newFetcher(october), pgViewer)
+		assertIDs(t, got, ids[1], ids[2], ids[3])
+	})
+	t.Run("a full row is cut at the limit", func(t *testing.T) {
+		got := contentIDs(t, section(halloween, 2), newFetcher(october), catalog.AccessFilter{})
+		assertIDs(t, got, ids[0], ids[1])
+	})
+	t.Run("off season is empty", func(t *testing.T) {
+		got := contentIDs(t, section(halloween, 10), newFetcher(fixedClock(time.Date(2026, 7, 4, 12, 0, 0, 0, time.UTC))), pgViewer)
+		assertIDs(t, got)
+	})
+	t.Run("the row takes the vibe's title", func(t *testing.T) {
+		params := recipes.SeasonalThemedParams{EnabledThemes: []string{"halloween"}, Vibes: map[string]string{"halloween": "horror"}, Source: recipes.SeasonalSourceLists}
+		result, err := newFetcher(october).FetchOne(ctx, section(params, 10), &libraryID, nil, 0, "", catalog.AccessFilter{})
+		if err != nil {
+			t.Fatalf("FetchOne: %v", err)
+		}
+		theme, _ := recipes.SeasonalThemeByKey("halloween")
+		if want := theme.Vibe("horror").Title; result.Title != want {
+			t.Errorf("title = %q, want %q", result.Title, want)
+		}
+	})
+}
+
+func assertIDs(t *testing.T, got []string, want ...string) {
+	t.Helper()
+	if fmt.Sprint(got) != fmt.Sprint(want) {
+		t.Fatalf("content IDs = %v, want %v", got, want)
+	}
+}
+
+type memorySeasonalLists struct {
+	snapshots map[string]SeasonalListSnapshot
+	failures  map[string]string
+}
+
+func (m *memorySeasonalLists) Get(_ context.Context, listURL string) (SeasonalListSnapshot, bool, error) {
+	s, ok := m.snapshots[listURL]
+	return s, ok, nil
+}
+
+func (m *memorySeasonalLists) TryClaimRefresh(context.Context, string, time.Duration) (time.Time, bool, error) {
+	return time.Unix(1, 0), true, nil
+}
+
+func (m *memorySeasonalLists) SaveSuccess(_ context.Context, listURL string, entries []seasonalListEntry, status string, _, refreshedAt time.Time) error {
+	m.snapshots[listURL] = SeasonalListSnapshot{ListURL: listURL, Entries: entries, RefreshedAt: &refreshedAt, LastStatus: status}
+	return nil
+}
+
+func (m *memorySeasonalLists) RecordFailure(_ context.Context, listURL, message string, _ time.Time) error {
+	m.failures[listURL] = message
+	return nil
+}
+
+type seasonalConfigs []json.RawMessage
+
+func (c seasonalConfigs) ListSeasonalConfigs(context.Context) ([]json.RawMessage, error) {
+	return c, nil
+}
+
+// TestSeasonalListRefresherFetchesUpcomingStaleLists covers what one
+// scheduled run downloads: lists a row shows now or within the lookahead,
+// once each, skipping fresh copies, and keeping the last good copy when a
+// download fails or comes back empty.
+func TestSeasonalListRefresherFetchesUpcomingStaleLists(t *testing.T) {
+	now := time.Date(2026, 11, 20, 12, 0, 0, 0, time.UTC) // Thanksgiving starts Nov 22
+	thanksgiving, _ := recipes.SeasonalThemeByKey("thanksgiving")
+	halloween, _ := recipes.SeasonalThemeByKey("halloween")
+	christmas, _ := recipes.SeasonalThemeByKey("christmas")
+	canonical := func(raw string) string {
+		key, err := collectionutil.CanonicalMDBListURL(raw)
+		if err != nil {
+			t.Fatalf("canonical %q: %v", raw, err)
+		}
+		return key
+	}
+	thanksgivingURL := canonical(thanksgiving.Vibes[0].ListURL)
+	christmasURL := canonical(christmas.Vibe("family").ListURL)
+	freshAt := now.Add(-time.Hour)
+	store := &memorySeasonalLists{
+		snapshots: map[string]SeasonalListSnapshot{
+			christmasURL: {ListURL: christmasURL, Entries: []seasonalListEntry{{TMDB: "1", Type: "movie"}}, RefreshedAt: &freshAt},
+		},
+		failures: map[string]string{},
+	}
+	config := json.RawMessage(`{"enabled_themes":["halloween","thanksgiving","christmas"],"vibes":{"christmas":"family"}}`)
+	var fetched []string
+	r := NewSeasonalListRefresher(seasonalConfigs{config, config}, store)
+	r.Clock = fixedClock(now)
+	r.Fetch = func(_ context.Context, listURL string) ([]seasonalListEntry, error) {
+		fetched = append(fetched, listURL)
+		return []seasonalListEntry{{TMDB: "42", Type: "movie"}}, nil
+	}
+
+	if _, err := r.RunOnce(context.Background()); err != nil {
+		t.Fatalf("RunOnce: %v", err)
+	}
+	// Thanksgiving is two days out and stale; Christmas (Dec 1) is within the
+	// lookahead but fresh; Halloween is past.
+	assertIDs(t, fetched, thanksgivingURL)
+	if _, ok := store.snapshots[canonical(halloween.Vibes[0].ListURL)]; ok {
+		t.Error("refreshed an out-of-season list")
+	}
+
+	// A failed download keeps the stored entries.
+	r.Clock = fixedClock(now.Add(seasonalListMaxAge + time.Hour))
+	r.Fetch = func(context.Context, string) ([]seasonalListEntry, error) { return nil, errors.New("mdblist down") }
+	if _, err := r.RunOnce(context.Background()); err != nil {
+		t.Fatalf("RunOnce: %v", err)
+	}
+	if got := store.snapshots[thanksgivingURL].Entries; len(got) != 1 || got[0].TMDB != "42" {
+		t.Errorf("failed refresh replaced the stored list: %+v", got)
+	}
+	if store.failures[thanksgivingURL] == "" {
+		t.Error("failed refresh was not recorded")
+	}
+
+	// So does an empty answer.
+	delete(store.failures, thanksgivingURL)
+	r.Fetch = func(context.Context, string) ([]seasonalListEntry, error) { return []seasonalListEntry{}, nil }
+	if _, err := r.RunOnce(context.Background()); err != nil {
+		t.Fatalf("RunOnce: %v", err)
+	}
+	if got := store.snapshots[thanksgivingURL].Entries; len(got) != 1 {
+		t.Errorf("empty refresh replaced the stored list: %+v", got)
+	}
+	if store.failures[thanksgivingURL] == "" {
+		t.Error("empty refresh was not recorded")
+	}
+}
+
+// TestSeasonalEntriesFromMDBList pins how an MDBList /json feed maps to list
+// entries: TMDB, IMDb and TVDB IDs kept, null or zero IDs dropped, and rows
+// that are neither movies nor shows skipped.
+// recordingThemeNeighbors records the access filter the fill searches with.
+type recordingThemeNeighbors struct{ filter catalog.AccessFilter }
+
+func (r *recordingThemeNeighbors) ThemeNeighbors(_ context.Context, _ []string, _ int, filter catalog.AccessFilter) ([]recommendations.ScoredItem, error) {
+	r.filter = filter
+	return nil, nil
+}
+
+// TestSeasonalFillSearchesOnlyTheRowsLibraries pins that a library page's
+// fill looks for neighbors in that library alone, within the viewer's access.
+func TestSeasonalFillSearchesOnlyTheRowsLibraries(t *testing.T) {
+	neighbors := &recordingThemeNeighbors{}
+	f := &Fetcher{SeasonalNeighbors: neighbors}
+	library := 7
+	f.seasonalNeighborItems(context.Background(), []string{"movie:a"}, 5, 5, &library, nil, catalog.AccessFilter{AllowedLibraryIDs: []int{3, 7}})
+	if !slices.Equal(neighbors.filter.AllowedLibraryIDs, []int{7}) {
+		t.Fatalf("fill searched libraries %v, want [7]", neighbors.filter.AllowedLibraryIDs)
+	}
+}
+
+// recordingResolver answers external-ID lookups from fixed maps and records
+// the batches it was asked for.
+type recordingResolver struct {
+	batches map[string]catalog.ExternalIDBatch
+	lookups map[string]*catalog.ExternalIDLookup
+}
+
+func (r *recordingResolver) GetByExternalIDs(_ context.Context, batch catalog.ExternalIDBatch, itemType string) (*catalog.ExternalIDLookup, error) {
+	r.batches[itemType] = batch
+	if lookup := r.lookups[itemType]; lookup != nil {
+		return lookup, nil
+	}
+	return &catalog.ExternalIDLookup{ByTMDB: map[string]string{}, ByIMDb: map[string]string{}, ByTVDB: map[string]string{}}, nil
+}
+
+// TestResolveSeasonalEntriesDedupesAndFallsBackToTVDB covers a list naming a
+// title twice and a movie the library knows only by its TVDB ID.
+func TestResolveSeasonalEntriesDedupesAndFallsBackToTVDB(t *testing.T) {
+	resolver := &recordingResolver{
+		batches: map[string]catalog.ExternalIDBatch{},
+		lookups: map[string]*catalog.ExternalIDLookup{
+			"movie": {ByTMDB: map[string]string{"1": "movie:one"}, ByIMDb: map[string]string{}, ByTVDB: map[string]string{"77": "movie:tvdb"}},
+		},
+	}
+	entries := []seasonalListEntry{
+		{TMDB: "1", Type: listEntryMovie},
+		{TMDB: "1", IMDb: "tt1", Type: listEntryMovie},
+		{TMDB: "2", TVDB: "77", Type: listEntryMovie},
+	}
+	ids, err := resolveSeasonalEntries(context.Background(), resolver, entries)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if want := []string{"movie:one", "movie:tvdb"}; !slices.Equal(ids, want) {
+		t.Fatalf("resolved %v, want %v", ids, want)
+	}
+	if got := resolver.batches["movie"].TMDBIDs; !slices.Equal(got, []string{"1", "2"}) {
+		t.Fatalf("movie TMDB batch %v, want each ID once", got)
+	}
+}
+
+func TestSeasonalEntriesFromMDBList(t *testing.T) {
+	var items []mdblistListItem
+	feed := `[
+		{"id":10439,"rank":1,"title":"Hocus Pocus","imdb_id":"tt0107120","tvdbid":null,"mediatype":"movie","release_year":1993},
+		{"id":0,"rank":2,"title":"Wednesday","imdb_id":"tt13443470","tvdbid":397060,"mediatype":"show","release_year":2022},
+		{"id":5,"rank":3,"title":"Someone","imdb_id":"nm1","tvdbid":null,"mediatype":"person"},
+		{"id":0,"rank":4,"title":"Unknown","imdb_id":"","tvdbid":0,"mediatype":"movie"}
+	]`
+	if err := json.Unmarshal([]byte(feed), &items); err != nil {
+		t.Fatalf("decode feed: %v", err)
+	}
+	got := seasonalEntriesFromMDBList(items)
+	want := []seasonalListEntry{
+		{TMDB: "10439", IMDb: "tt0107120", Type: "movie"},
+		{IMDb: "tt13443470", TVDB: "397060", Type: "show"},
+	}
+	if fmt.Sprint(got) != fmt.Sprint(want) {
+		t.Fatalf("entries = %+v, want %+v", got, want)
+	}
+}
+
+// TestSeasonalListRepositoryKeepsLastGoodList covers the snapshot table: a
+// claim blocks a second worker, a save replaces the entries, and a failed
+// download keeps them.
+func TestSeasonalListRepositoryKeepsLastGoodList(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatalf("connect test database: %v", err)
+	}
+	t.Cleanup(pool.Close)
+	listURL, err := collectionutil.CanonicalMDBListURL(fmt.Sprintf("https://mdblist.com/lists/prairie-test/seasonal-%d", time.Now().UnixNano()))
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), `DELETE FROM seasonal_list_snapshots WHERE list_url = $1`, listURL)
+	})
+	repo := NewSeasonalListRepository(pool)
+	entries := []seasonalListEntry{{TMDB: "10439", IMDb: "tt0107120", Type: "movie"}, {TVDB: "397060", Type: "show"}}
+
+	claimAt, ok, err := repo.TryClaimRefresh(ctx, listURL, time.Minute)
+	if err != nil || !ok {
+		t.Fatalf("first claim = %v, %v", ok, err)
+	}
+	if _, ok, err := repo.TryClaimRefresh(ctx, listURL, time.Minute); err != nil || ok {
+		t.Fatalf("second claim during the lease = %v, %v; want refused", ok, err)
+	}
+	if err := repo.SaveSuccess(ctx, listURL, entries, "ok", claimAt, time.Now()); err != nil {
+		t.Fatalf("SaveSuccess: %v", err)
+	}
+
+	claimAt, ok, err = repo.TryClaimRefresh(ctx, listURL, time.Minute)
+	if err != nil || !ok {
+		t.Fatalf("claim after save = %v, %v", ok, err)
+	}
+	if err := repo.RecordFailure(ctx, listURL, "mdblist down", claimAt); err != nil {
+		t.Fatalf("RecordFailure: %v", err)
+	}
+	got, found, err := repo.Get(ctx, listURL)
+	if err != nil || !found {
+		t.Fatalf("Get = %v, %v", found, err)
+	}
+	if fmt.Sprint(got.Entries) != fmt.Sprint(entries) || got.LastStatus != "error" || got.LastError != "mdblist down" {
+		t.Fatalf("after failure: entries %v status %q error %q; want last good entries kept", got.Entries, got.LastStatus, got.LastError)
+	}
+}
diff --git a/internal/sections/seasonal_lists.go b/internal/sections/seasonal_lists.go
new file mode 100644
index 0000000000..a1b22a07aa
--- /dev/null
+++ b/internal/sections/seasonal_lists.go
@@ -0,0 +1,437 @@
+package sections
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"slices"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/catalog"
+	"github.com/prairie-server/prairie-server/internal/collectionutil"
+	"github.com/prairie-server/prairie-server/internal/sections/recipes"
+)
+
+const (
+	// seasonalListLookahead is how far ahead the refresher fetches lists, so
+	// a row has its list the moment its window opens.
+	seasonalListLookahead = 14 * 24 * time.Hour
+	// seasonalListMaxAge is how old a list may get before the scheduled run
+	// fetches it again.
+	seasonalListMaxAge = 20 * time.Hour
+	// seasonalListMaxEntries bounds one list. The row shows a few dozen titles
+	// at most; the rest only widens the library match.
+	seasonalListMaxEntries   = 2000
+	seasonalListRefreshLease = 5 * time.Minute
+)
+
+// List entry media types, as MDBList names them.
+const (
+	listEntryMovie = "movie"
+	listEntryShow  = "show"
+)
+
+// seasonalListEntry is one list title by external ID, in list order.
+type seasonalListEntry struct {
+	TMDB string `json:"tmdb,omitempty"`
+	IMDb string `json:"imdb,omitempty"`
+	TVDB string `json:"tvdb,omitempty"`
+	// Type is "movie" or "show".
+	Type string `json:"type"`
+}
+
+// SeasonalListSnapshot is the stored copy of one seasonal MDBList list.
+type SeasonalListSnapshot struct {
+	ListURL     string
+	Entries     []seasonalListEntry
+	RefreshedAt *time.Time
+	LastStatus  string
+	LastError   string
+}
+
+// ErrSeasonalListLeaseLost means another worker took over the refresh before
+// this one saved its result.
+var ErrSeasonalListLeaseLost = errors.New("seasonal list refresh lease lost")
+
+// SeasonalListRepository persists seasonal_list_snapshots.
+type SeasonalListRepository struct {
+	pool *pgxpool.Pool
+}
+
+// NewSeasonalListRepository creates a SeasonalListRepository.
+func NewSeasonalListRepository(pool *pgxpool.Pool) *SeasonalListRepository {
+	return &SeasonalListRepository{pool: pool}
+}
+
+// Get returns the stored list. found is false before the first refresh.
+// Snapshots are keyed by the list's canonical /json URL, so the same list
+// typed two ways shares one row.
+func (r *SeasonalListRepository) Get(ctx context.Context, listURL string) (SeasonalListSnapshot, bool, error) {
+	key, err := collectionutil.CanonicalMDBListURL(listURL)
+	if err != nil {
+		return SeasonalListSnapshot{}, false, err
+	}
+	var s SeasonalListSnapshot
+	var raw []byte
+	err = r.pool.QueryRow(ctx, `
+		SELECT list_url, entries, refreshed_at, last_status, last_error
+		FROM seasonal_list_snapshots WHERE list_url = $1`, key).
+		Scan(&s.ListURL, &raw, &s.RefreshedAt, &s.LastStatus, &s.LastError)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return SeasonalListSnapshot{}, false, nil
+	}
+	if err != nil {
+		return SeasonalListSnapshot{}, false, fmt.Errorf("getting seasonal list: %w", err)
+	}
+	if err := json.Unmarshal(raw, &s.Entries); err != nil {
+		return SeasonalListSnapshot{}, false, fmt.Errorf("decoding seasonal list entries: %w", err)
+	}
+	return s, true, nil
+}
+
+// TryClaimRefresh claims one list for a bounded lease, the same way trending
+// snapshots are claimed: no pool connection is held while the list downloads,
+// and a crashed worker's claim expires.
+func (r *SeasonalListRepository) TryClaimRefresh(ctx context.Context, listURL string, lease time.Duration) (time.Time, bool, error) {
+	var claimedAt time.Time
+	err := r.pool.QueryRow(ctx, `
+		WITH lease_clock AS (SELECT clock_timestamp() AS claimed_at)
+		INSERT INTO seasonal_list_snapshots (list_url, last_attempt_at, last_status, last_error)
+		SELECT $1, claimed_at, 'refreshing', '' FROM lease_clock
+		ON CONFLICT (list_url) DO UPDATE SET
+			last_attempt_at = EXCLUDED.last_attempt_at,
+			last_status     = 'refreshing',
+			last_error      = ''
+		WHERE (seasonal_list_snapshots.last_attempt_at IS NULL
+		       OR seasonal_list_snapshots.last_attempt_at <= EXCLUDED.last_attempt_at)
+		  AND (seasonal_list_snapshots.last_status <> 'refreshing'
+		       OR seasonal_list_snapshots.last_attempt_at <=
+		          EXCLUDED.last_attempt_at - ($2::bigint * INTERVAL '1 millisecond'))
+		RETURNING last_attempt_at`, listURL, max(lease.Milliseconds(), 1)).Scan(&claimedAt)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return time.Time{}, false, nil
+	}
+	if err != nil {
+		return time.Time{}, false, fmt.Errorf("claiming seasonal list refresh: %w", err)
+	}
+	return claimedAt, true, nil
+}
+
+// SaveSuccess replaces the stored entries after a completed download.
+func (r *SeasonalListRepository) SaveSuccess(ctx context.Context, listURL string, entries []seasonalListEntry, status string, claimAt, refreshedAt time.Time) error {
+	if entries == nil {
+		entries = []seasonalListEntry{}
+	}
+	raw, _ := json.Marshal(entries) // plain strings; cannot fail
+	tag, err := r.pool.Exec(ctx, `
+		UPDATE seasonal_list_snapshots SET
+			entries = $2, entry_count = $3, refreshed_at = $4,
+			last_status = $5, last_error = ''
+		WHERE list_url = $1 AND last_status = 'refreshing' AND last_attempt_at = $6`,
+		listURL, raw, len(entries), refreshedAt, status, claimAt)
+	if err != nil {
+		return fmt.Errorf("saving seasonal list: %w", err)
+	}
+	if tag.RowsAffected() != 1 {
+		return ErrSeasonalListLeaseLost
+	}
+	return nil
+}
+
+// RecordFailure records a failed download and keeps the last good entries.
+func (r *SeasonalListRepository) RecordFailure(ctx context.Context, listURL, message string, claimAt time.Time) error {
+	tag, err := r.pool.Exec(ctx, `
+		UPDATE seasonal_list_snapshots SET last_status = 'error', last_error = $2
+		WHERE list_url = $1 AND last_status = 'refreshing' AND last_attempt_at = $3`,
+		listURL, message, claimAt)
+	if err != nil {
+		return fmt.Errorf("recording seasonal list failure: %w", err)
+	}
+	if tag.RowsAffected() != 1 {
+		return ErrSeasonalListLeaseLost
+	}
+	return nil
+}
+
+type seasonalListStore interface {
+	Get(ctx context.Context, listURL string) (SeasonalListSnapshot, bool, error)
+	TryClaimRefresh(ctx context.Context, listURL string, lease time.Duration) (time.Time, bool, error)
+	SaveSuccess(ctx context.Context, listURL string, entries []seasonalListEntry, status string, claimAt, refreshedAt time.Time) error
+	RecordFailure(ctx context.Context, listURL, message string, claimAt time.Time) error
+}
+
+type seasonalConfigLister interface {
+	ListSeasonalConfigs(ctx context.Context) ([]json.RawMessage, error)
+}
+
+// mdblistListItem is one entry of an MDBList /json feed.
+type mdblistListItem struct {
+	ID        json.Number `json:"id"`
+	IMDbID    string      `json:"imdb_id"`
+	TVDBID    json.Number `json:"tvdbid"`
+	MediaType string      `json:"mediatype"`
+}
+
+// SeasonalListRefresher downloads the MDBList lists seasonal rows show, in
+// IMDb popularity order, ahead of their windows. A TaskManager task drives
+// RunOnce; section saves call RefreshConfig so a new row fills right away.
+type SeasonalListRefresher struct {
+	Sections  seasonalConfigLister
+	Snapshots seasonalListStore
+	// Fetch downloads a list; nil uses MDBList's public /json feed.
+	Fetch  func(ctx context.Context, listURL string) ([]seasonalListEntry, error)
+	Clock  recipes.Clock
+	logger *slog.Logger
+}
+
+// NewSeasonalListRefresher creates a refresher backed by MDBList.
+func NewSeasonalListRefresher(sectionLister seasonalConfigLister, snapshots seasonalListStore) *SeasonalListRefresher {
+	return &SeasonalListRefresher{
+		Sections:  sectionLister,
+		Snapshots: snapshots,
+		Clock:     recipes.RealClock{},
+		logger:    slog.Default().With("component", "sections.seasonal_lists"),
+	}
+}
+
+// SeasonalListRefreshResult is the JSON summary attached to the task run.
+type SeasonalListRefreshResult struct {
+	Lists     int `json:"lists"`
+	Refreshed int `json:"refreshed"`
+	Fresh     int `json:"fresh"`
+	Failed    int `json:"failed"`
+	Skipped   int `json:"skipped"`
+}
+
+func (r *SeasonalListRefresher) now() time.Time {
+	if r.Clock != nil {
+		return r.Clock.Now()
+	}
+	return time.Now()
+}
+
+func (r *SeasonalListRefresher) log() *slog.Logger {
+	if r.logger != nil {
+		return r.logger
+	}
+	return slog.Default()
+}
+
+// RunOnce refreshes every list an enabled seasonal row shows now or within
+// the lookahead and that is older than seasonalListMaxAge.
+func (r *SeasonalListRefresher) RunOnce(ctx context.Context) (json.RawMessage, error) {
+	configs, listErr := r.Sections.ListSeasonalConfigs(ctx)
+	urls := seasonalListURLs(configs, r.now())
+	result := SeasonalListRefreshResult{Lists: len(urls)}
+	for _, listURL := range urls {
+		switch r.refreshIfStale(ctx, listURL) {
+		case seasonalListRefreshed:
+			result.Refreshed++
+		case seasonalListFresh:
+			result.Fresh++
+		case seasonalListSkipped:
+			result.Skipped++
+		default:
+			result.Failed++
+		}
+	}
+	data, _ := json.Marshal(result)
+	if listErr != nil {
+		return data, fmt.Errorf("listing seasonal sections: %w", listErr)
+	}
+	return data, nil
+}
+
+// RefreshConfig fetches the lists one saved row needs and does not have yet.
+// Best effort: the scheduled run is the recovery path.
+func (r *SeasonalListRefresher) RefreshConfig(ctx context.Context, config json.RawMessage) {
+	for _, listURL := range seasonalListURLs([]json.RawMessage{config}, r.now()) {
+		r.refreshIfStale(ctx, listURL)
+	}
+}
+
+// seasonalListURLs returns the canonical, deduplicated list URLs the configs
+// show between now and the lookahead.
+func seasonalListURLs(configs []json.RawMessage, now time.Time) []string {
+	seen := map[string]bool{}
+	var out []string
+	for _, raw := range configs {
+		var p recipes.SeasonalThemedParams
+		if len(raw) == 0 || json.Unmarshal(raw, &p) != nil {
+			continue
+		}
+		for _, listURL := range recipes.SeasonalListURLsAround(p, now, seasonalListLookahead) {
+			key, err := collectionutil.CanonicalMDBListURL(listURL)
+			if err != nil || seen[key] {
+				continue
+			}
+			seen[key] = true
+			out = append(out, key)
+		}
+	}
+	return out
+}
+
+const (
+	seasonalListRefreshed = "refreshed"
+	seasonalListFresh     = "fresh"
+	seasonalListSkipped   = "skipped"
+	seasonalListFailed    = "failed"
+)
+
+func (r *SeasonalListRefresher) refreshIfStale(ctx context.Context, listURL string) string {
+	snapshot, found, err := r.Snapshots.Get(ctx, listURL)
+	if err != nil {
+		r.log().ErrorContext(ctx, "seasonal list refresh: reading snapshot failed", "list_url", listURL, "error", err)
+		return seasonalListFailed
+	}
+	if found && snapshot.RefreshedAt != nil && r.now().Sub(*snapshot.RefreshedAt) < seasonalListMaxAge {
+		return seasonalListFresh
+	}
+	claimAt, claimed, err := r.Snapshots.TryClaimRefresh(ctx, listURL, seasonalListRefreshLease)
+	if err != nil {
+		r.log().ErrorContext(ctx, "seasonal list refresh: claim failed", "list_url", listURL, "error", err)
+		return seasonalListFailed
+	}
+	if !claimed {
+		return seasonalListSkipped
+	}
+	entries, fetchErr := r.fetch(ctx, listURL)
+	if fetchErr != nil {
+		r.log().WarnContext(ctx, "seasonal list refresh: download failed", "list_url", listURL, "error", fetchErr)
+		r.recordFailure(ctx, listURL, fetchErr.Error(), claimAt)
+		return seasonalListFailed
+	}
+	// The same status values as trending snapshots.
+	status := trendingRefreshOK
+	if len(entries) == 0 {
+		// An empty answer over a list we have is more likely a glitch than a
+		// list emptied overnight: keep the copy and try again next run.
+		if found && len(snapshot.Entries) > 0 {
+			r.recordFailure(ctx, listURL, "list came back empty", claimAt)
+			return seasonalListFailed
+		}
+		status = trendingRefreshEmpty
+	}
+	if err := r.Snapshots.SaveSuccess(ctx, listURL, entries, status, claimAt, r.now()); err != nil {
+		if errors.Is(err, ErrSeasonalListLeaseLost) {
+			return seasonalListSkipped
+		}
+		r.log().ErrorContext(ctx, "seasonal list refresh: save failed", "list_url", listURL, "error", err)
+		return seasonalListFailed
+	}
+	return seasonalListRefreshed
+}
+
+// recordFailure records a failed refresh, keeping the stored entries. A lost
+// lease means another worker owns the list now, so there is nothing to record.
+func (r *SeasonalListRefresher) recordFailure(ctx context.Context, listURL, message string, claimAt time.Time) {
+	if err := r.Snapshots.RecordFailure(ctx, listURL, message, claimAt); err != nil && !errors.Is(err, ErrSeasonalListLeaseLost) {
+		r.log().ErrorContext(ctx, "seasonal list refresh: recording failure failed", "list_url", listURL, "error", err)
+	}
+}
+
+func (r *SeasonalListRefresher) fetch(ctx context.Context, listURL string) ([]seasonalListEntry, error) {
+	if r.Fetch != nil {
+		return r.Fetch(ctx, listURL)
+	}
+	items, err := collectionutil.FetchMDBListJSONQuery[mdblistListItem](
+		ctx, collectionutil.MDBListHTTPClient(nil), listURL, seasonalListMaxEntries, collectionutil.MDBListIMDbPopularOrder)
+	if err != nil {
+		return nil, err
+	}
+	return seasonalEntriesFromMDBList(items), nil
+}
+
+func seasonalEntriesFromMDBList(items []mdblistListItem) []seasonalListEntry {
+	entries := make([]seasonalListEntry, 0, len(items))
+	for _, item := range items {
+		entry := seasonalListEntry{IMDb: item.IMDbID, Type: item.MediaType}
+		if id := item.ID.String(); id != "" && id != "0" {
+			entry.TMDB = id
+		}
+		if id := item.TVDBID.String(); id != "" && id != "0" {
+			entry.TVDB = id
+		}
+		if entry.Type != listEntryMovie && entry.Type != listEntryShow {
+			continue
+		}
+		if entry.TMDB == "" && entry.IMDb == "" && entry.TVDB == "" {
+			continue
+		}
+		entries = append(entries, entry)
+	}
+	return entries
+}
+
+// resolveSeasonalEntries maps list entries to library content IDs in list
+// order, skipping titles the library does not have. As in the trending
+// resolver, a show matches by TVDB first, then TMDB, then IMDb; a movie by
+// TMDB, then IMDb, then TVDB.
+func resolveSeasonalEntries(ctx context.Context, resolver externalIDResolver, entries []seasonalListEntry) ([]string, error) {
+	var movies, series catalog.ExternalIDBatch
+	for _, e := range entries {
+		batch := &movies
+		if e.Type == listEntryShow {
+			batch = &series
+		}
+		if e.TMDB != "" {
+			batch.TMDBIDs = append(batch.TMDBIDs, e.TMDB)
+		}
+		if e.IMDb != "" {
+			batch.IMDbIDs = append(batch.IMDbIDs, e.IMDb)
+		}
+		if e.TVDB != "" {
+			batch.TVDBIDs = append(batch.TVDBIDs, e.TVDB)
+		}
+	}
+	dedupeExternalIDs(&movies)
+	dedupeExternalIDs(&series)
+	movieLookup, err := resolver.GetByExternalIDs(ctx, movies, "movie")
+	if err != nil {
+		return nil, fmt.Errorf("resolving seasonal movies: %w", err)
+	}
+	seriesLookup, err := resolver.GetByExternalIDs(ctx, series, "series")
+	if err != nil {
+		return nil, fmt.Errorf("resolving seasonal series: %w", err)
+	}
+	seen := map[string]bool{}
+	out := make([]string, 0, len(entries))
+	for _, e := range entries {
+		var id string
+		if e.Type == listEntryShow {
+			id = firstNonEmpty(seriesLookup.ByTVDB[e.TVDB], seriesLookup.ByTMDB[e.TMDB], seriesLookup.ByIMDb[e.IMDb])
+		} else {
+			id = firstNonEmpty(movieLookup.ByTMDB[e.TMDB], movieLookup.ByIMDb[e.IMDb], movieLookup.ByTVDB[e.TVDB])
+		}
+		if id == "" || seen[id] {
+			continue
+		}
+		seen[id] = true
+		out = append(out, id)
+	}
+	return out, nil
+}
+
+// dedupeExternalIDs drops repeated IDs from a lookup batch; a list can name
+// one title twice. Order does not matter to the lookup.
+func dedupeExternalIDs(batch *catalog.ExternalIDBatch) {
+	for _, ids := range []*[]string{&batch.TMDBIDs, &batch.IMDbIDs, &batch.TVDBIDs} {
+		slices.Sort(*ids)
+		*ids = slices.Compact(*ids)
+	}
+}
+
+func firstNonEmpty(values ...string) string {
+	for _, v := range values {
+		if v != "" {
+			return v
+		}
+	}
+	return ""
+}
diff --git a/internal/sections/seasonal_query_test.go b/internal/sections/seasonal_query_test.go
deleted file mode 100644
index 1eefa5423c..0000000000
--- a/internal/sections/seasonal_query_test.go
+++ /dev/null
@@ -1,133 +0,0 @@
-package sections
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"testing"
-	"time"
-
-	"github.com/jackc/pgx/v5/pgxpool"
-
-	"github.com/prairie-server/prairie-server/internal/access"
-	"github.com/prairie-server/prairie-server/internal/catalog"
-	"github.com/prairie-server/prairie-server/internal/envutil"
-	"github.com/prairie-server/prairie-server/internal/sections/recipes"
-)
-
-// TestSeasonalThemeHasQueryCoversAllOrderedThemes ensures every theme that can
-// win multi-theme selection resolves to either a genre query or a keyword
-// fallback. A theme in SeasonalThemeOrder without either would black out the
-// section during its own window.
-func TestSeasonalThemeHasQueryCoversAllOrderedThemes(t *testing.T) {
-	for _, theme := range recipes.SeasonalThemeOrder {
-		if !seasonalThemeHasQuery(theme) {
-			t.Errorf("theme %q is selectable (SeasonalThemeOrder) but has no query or keyword fallback", theme)
-		}
-	}
-}
-
-// TestSeasonalKeywordThemesHaveNoGenreQuery pins the routing: keyword themes
-// must not also have a genre QueryDefinition, otherwise the keyword fallback
-// is dead code.
-func TestSeasonalKeywordThemesHaveNoGenreQuery(t *testing.T) {
-	for theme := range seasonalKeywordTitles {
-		if _, ok := seasonalQueryDef(theme); ok {
-			t.Errorf("theme %q has both a genre query and keyword fallback; keyword path unreachable", theme)
-		}
-		if _, ok := recipes.SeasonalPredicates[theme]; !ok {
-			t.Errorf("keyword theme %q has no seasonal predicate", theme)
-		}
-	}
-}
-
-func TestSeasonalThemedFiltersItemsAboveProfileRating(t *testing.T) {
-	dsn := envutil.Getenv("SILO_TEST_DATABASE_URL")
-	if dsn == "" {
-		t.Skip("SILO_TEST_DATABASE_URL is not set")
-	}
-
-	ctx := context.Background()
-	pool, err := pgxpool.New(ctx, dsn)
-	if err != nil {
-		t.Fatalf("connect test database: %v", err)
-	}
-	t.Cleanup(pool.Close)
-
-	suffix := time.Now().UnixNano()
-	allowedID := fmt.Sprintf("seasonal-rating-allowed-%d", suffix)
-	blockedID := fmt.Sprintf("seasonal-rating-blocked-%d", suffix)
-	var libraryID int
-	if err := pool.QueryRow(ctx, `
-		INSERT INTO media_folders (type, name, enabled)
-		VALUES ('movies', $1, true)
-		RETURNING id`, fmt.Sprintf("seasonal-rating-%d", suffix)).Scan(&libraryID); err != nil {
-		t.Fatalf("seed media folder: %v", err)
-	}
-	t.Cleanup(func() {
-		if _, err := pool.Exec(context.Background(), `DELETE FROM media_items WHERE content_id = ANY($1)`, []string{allowedID, blockedID}); err != nil {
-			t.Errorf("cleanup media items: %v", err)
-		}
-		if _, err := pool.Exec(context.Background(), `DELETE FROM media_folders WHERE id = $1`, libraryID); err != nil {
-			t.Errorf("cleanup media folder: %v", err)
-		}
-	})
-	if _, err := pool.Exec(ctx, `
-		INSERT INTO media_items (content_id, type, title, genres, content_rating, content_rating_age)
-		VALUES ($1, 'movie', 'Allowed Seasonal Movie', ARRAY['Action'], 'PG', 8),
-		       ($2, 'movie', 'Blocked Seasonal Movie', ARRAY['Action'], 'R', 17)`, allowedID, blockedID); err != nil {
-		t.Fatalf("seed media items: %v", err)
-	}
-	if _, err := pool.Exec(ctx, `
-		INSERT INTO media_item_libraries (content_id, media_folder_id)
-		VALUES ($1, $3), ($2, $3)`, allowedID, blockedID, libraryID); err != nil {
-		t.Fatalf("seed media item libraries: %v", err)
-	}
-
-	config, err := json.Marshal(recipes.SeasonalThemedParams{Theme: "summer_blockbuster", Mode: "pinned"})
-	if err != nil {
-		t.Fatalf("marshal seasonal config: %v", err)
-	}
-	fetcher := NewFetcher(pool)
-	items, _, err := fetcher.fetchSeasonalThemed(ctx, ResolvedSection{
-		ID:          "seasonal-rating-test",
-		SectionType: SectionSeasonalThemed,
-		ItemLimit:   10,
-		Config:      config,
-	}, &libraryID, nil, catalog.AccessFilter{MaturityLimits: access.MaturityLimits{MaxContentRating: "PG"}})
-	if err != nil {
-		t.Fatalf("fetch seasonal section: %v", err)
-	}
-	if len(items) != 1 || items[0].ContentID != allowedID {
-		got := make([]string, 0, len(items))
-		for _, item := range items {
-			got = append(got, item.ContentID)
-		}
-		t.Fatalf("seasonal items = %v, want only %q", got, allowedID)
-	}
-}
-
-// TestRecommendationConfigAnchorPrecedence verifies because_you_watched honors
-// both the legacy source_item_id key and the recipe's anchor_item_id key,
-// preferring the legacy key when both are set.
-func TestRecommendationConfigAnchorPrecedence(t *testing.T) {
-	cases := []struct {
-		name   string
-		config string
-		want   string
-	}{
-		{"anchor only", `{"anchor_item_id":"abc"}`, "abc"},
-		{"source only", `{"source_item_id":"def"}`, "def"},
-		{"both set prefers legacy", `{"source_item_id":"def","anchor_item_id":"abc"}`, "def"},
-		{"blank strings auto-pick", `{"source_item_id":"","anchor_item_id":"  "}`, ""},
-		{"empty config auto-picks", `{}`, ""},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			cfg := parseRecommendationSectionConfig(json.RawMessage(tc.config))
-			if got := cfg.anchor(); got != tc.want {
-				t.Errorf("anchor() = %q, want %q", got, tc.want)
-			}
-		})
-	}
-}
diff --git a/internal/sections/section_demand.go b/internal/sections/section_demand.go
new file mode 100644
index 0000000000..ae1e0edfd4
--- /dev/null
+++ b/internal/sections/section_demand.go
@@ -0,0 +1,117 @@
+package sections
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log/slog"
+
+	"github.com/prairie-server/prairie-server/internal/userstore"
+)
+
+type adminSectionLister interface {
+	ListEnabledSections(context.Context, SectionType) ([]*PageSection, error)
+}
+
+// SectionDemandLister finds the effective configs of every enabled section of
+// a type, from server sections and profile overrides, so background refreshers
+// (trending snapshots, seasonal lists) know what to fetch. It deliberately
+// reads current state on every scheduled run so missed save-time refreshes
+// recover without a separate demand index.
+type SectionDemandLister struct {
+	admin  adminSectionLister
+	users  userstore.UserLister
+	stores userstore.UserStoreProvider
+	logger *slog.Logger
+}
+
+func NewSectionDemandLister(admin adminSectionLister, users userstore.UserLister, stores userstore.UserStoreProvider) *SectionDemandLister {
+	return &SectionDemandLister{admin: admin, users: users, stores: stores, logger: slog.Default().With("component", "sections.section_demand")}
+}
+
+// ListTrendingDiscoverConfigs lists the effective trending_discover configs.
+func (l *SectionDemandLister) ListTrendingDiscoverConfigs(ctx context.Context) ([]json.RawMessage, error) {
+	return l.ListConfigs(ctx, SectionTrendingDiscover)
+}
+
+// ListSeasonalConfigs lists the effective seasonal_themed configs.
+func (l *SectionDemandLister) ListSeasonalConfigs(ctx context.Context) ([]json.RawMessage, error) {
+	return l.ListConfigs(ctx, SectionSeasonalThemed)
+}
+
+// ListConfigs returns the effective config of every enabled section of
+// sectionType: server sections, profile overrides of them, and sections a
+// profile added itself.
+func (l *SectionDemandLister) ListConfigs(ctx context.Context, sectionType SectionType) ([]json.RawMessage, error) {
+	adminSections, err := l.admin.ListEnabledSections(ctx, sectionType)
+	if err != nil {
+		return nil, err
+	}
+	configs := make([]json.RawMessage, 0, len(adminSections))
+	adminByID := make(map[string]*PageSection, len(adminSections))
+	for _, section := range adminSections {
+		configs = append(configs, section.Config)
+		adminByID[section.ID] = section
+	}
+	if l.users == nil || l.stores == nil {
+		return configs, nil
+	}
+
+	users, err := l.users.List(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("listing users for section demand: %w", err)
+	}
+	for _, user := range users {
+		store, err := l.stores.ForUser(ctx, user.ID)
+		if err != nil {
+			if ctx.Err() != nil {
+				return nil, ctx.Err()
+			}
+			l.logger.WarnContext(ctx, "section demand: skipping unavailable user store", "user_id", user.ID, "error", err)
+			continue
+		}
+		enumerator, ok := store.(userstore.SectionOverrideEnumerator)
+		if !ok {
+			l.logger.WarnContext(ctx, "section demand: skipping user store without override enumeration", "user_id", user.ID)
+			continue
+		}
+		overrides, err := enumerator.ListAllSectionOverrides(ctx)
+		if err != nil {
+			if ctx.Err() != nil {
+				return nil, ctx.Err()
+			}
+			l.logger.WarnContext(ctx, "section demand: skipping unreadable section overrides", "user_id", user.ID, "error", err)
+			continue
+		}
+		for _, override := range overrides {
+			if override.Hidden || override.Removed {
+				continue
+			}
+			if override.SectionID != "" {
+				base := adminByID[override.SectionID]
+				if base == nil {
+					continue
+				}
+				if override.Config != "" && override.Config != jsonNullLiteral {
+					configs = append(configs, json.RawMessage(override.Config))
+				}
+				continue
+			}
+
+			overrideType := override.SectionType
+			config := override.Config
+			if override.IsUserAdded || override.SectionID == "" {
+				if override.UserSectionType != "" {
+					overrideType = override.UserSectionType
+				}
+				if override.UserConfig != "" {
+					config = override.UserConfig
+				}
+			}
+			if overrideType == string(sectionType) {
+				configs = append(configs, json.RawMessage(config))
+			}
+		}
+	}
+	return configs, nil
+}
diff --git a/internal/sections/trending_demand_test.go b/internal/sections/section_demand_test.go
similarity index 94%
rename from internal/sections/trending_demand_test.go
rename to internal/sections/section_demand_test.go
index 6c306d095e..c2d2b942ed 100644
--- a/internal/sections/trending_demand_test.go
+++ b/internal/sections/section_demand_test.go
@@ -12,7 +12,7 @@ import (
 
 type demandAdminLister struct{ sections []*PageSection }
 
-func (l demandAdminLister) ListTrendingDiscoverSections(context.Context) ([]*PageSection, error) {
+func (l demandAdminLister) ListEnabledSections(context.Context, SectionType) ([]*PageSection, error) {
 	return l.sections, nil
 }
 
@@ -50,7 +50,7 @@ func TestTrendingDemandSkipsBrokenAccountAndKeepsOtherDemand(t *testing.T) {
 		},
 		errs: map[int]error{1: errors.New("broken user database")},
 	}
-	lister := NewTrendingDemandLister(
+	lister := NewSectionDemandLister(
 		demandAdminLister{sections: []*PageSection{{ID: "admin", SectionType: SectionTrendingDiscover, Config: json.RawMessage(`{"source":"tmdb","window":"week"}`)}}},
 		demandUserLister{users: []*models.User{{ID: 1}, {ID: 2}}},
 		provider,
@@ -75,7 +75,7 @@ func TestTrendingDemandIncludesActiveProfileOnlySections(t *testing.T) {
 			{ID: "removed", Removed: true, IsUserAdded: true, UserSectionType: "trending_discover", UserConfig: `{"source":"tmdb","window":"week"}`},
 		}},
 	}}
-	lister := NewTrendingDemandLister(
+	lister := NewSectionDemandLister(
 		demandAdminLister{},
 		demandUserLister{users: []*models.User{{ID: 7}}},
 		provider,
@@ -109,7 +109,7 @@ func TestTrendingDemandIncludesLinkedProfileConfig(t *testing.T) {
 			ID: "override", SectionID: "admin-trending", Config: `{"source":"tmdb","window":"day"}`,
 		}}},
 	}}
-	lister := NewTrendingDemandLister(
+	lister := NewSectionDemandLister(
 		demandAdminLister{sections: []*PageSection{{ID: "admin-trending", SectionType: SectionTrendingDiscover, Config: json.RawMessage(`{"source":"tmdb","window":"week"}`)}}},
 		demandUserLister{users: []*models.User{{ID: 9}}},
 		provider,
@@ -128,11 +128,11 @@ func TestTrendingDemandIncludesLinkedProfileConfig(t *testing.T) {
 func TestTrendingDemandEmptySectionIDPrefersExplicitUserConfig(t *testing.T) {
 	provider := demandProvider{stores: map[int]userstore.UserStore{
 		11: demandStore{overrides: []userstore.SectionOverride{{
-			ID: "conflicting", SectionType: "trending_discover", Config: `{"source":"trakt","window":"week"}`,
+			ID: "conflicting", SectionType: "trending_discover", Config: `{"source":"tmdb","window":"week"}`,
 			UserSectionType: "trending_discover", UserConfig: `{"source":"tmdb","window":"day"}`,
 		}}},
 	}}
-	lister := NewTrendingDemandLister(
+	lister := NewSectionDemandLister(
 		demandAdminLister{},
 		demandUserLister{users: []*models.User{{ID: 11}}},
 		provider,
diff --git a/internal/sections/trending_demand.go b/internal/sections/trending_demand.go
deleted file mode 100644
index 7f1dd744c1..0000000000
--- a/internal/sections/trending_demand.go
+++ /dev/null
@@ -1,102 +0,0 @@
-package sections
-
-import (
-	"context"
-	"encoding/json"
-	"fmt"
-	"log/slog"
-
-	"github.com/prairie-server/prairie-server/internal/userstore"
-)
-
-type trendingAdminSectionLister interface {
-	ListTrendingDiscoverSections(context.Context) ([]*PageSection, error)
-}
-
-// TrendingDemandLister discovers snapshot demand from server sections and
-// profile overrides. It deliberately reads current state on every scheduled
-// run so missed save-time refreshes recover without a separate demand index.
-type TrendingDemandLister struct {
-	admin  trendingAdminSectionLister
-	users  userstore.UserLister
-	stores userstore.UserStoreProvider
-	logger *slog.Logger
-}
-
-func NewTrendingDemandLister(admin trendingAdminSectionLister, users userstore.UserLister, stores userstore.UserStoreProvider) *TrendingDemandLister {
-	return &TrendingDemandLister{admin: admin, users: users, stores: stores, logger: slog.Default().With("component", "sections.trending_demand")}
-}
-
-func (l *TrendingDemandLister) ListTrendingDiscoverConfigs(ctx context.Context) ([]json.RawMessage, error) {
-	adminSections, err := l.admin.ListTrendingDiscoverSections(ctx)
-	if err != nil {
-		return nil, err
-	}
-	configs := make([]json.RawMessage, 0, len(adminSections))
-	adminByID := make(map[string]*PageSection, len(adminSections))
-	for _, section := range adminSections {
-		configs = append(configs, section.Config)
-		adminByID[section.ID] = section
-	}
-	if l.users == nil || l.stores == nil {
-		return configs, nil
-	}
-
-	users, err := l.users.List(ctx)
-	if err != nil {
-		return nil, fmt.Errorf("listing users for trending demand: %w", err)
-	}
-	for _, user := range users {
-		store, err := l.stores.ForUser(ctx, user.ID)
-		if err != nil {
-			if ctx.Err() != nil {
-				return nil, ctx.Err()
-			}
-			l.logger.WarnContext(ctx, "trending demand: skipping unavailable user store", "user_id", user.ID, "error", err)
-			continue
-		}
-		enumerator, ok := store.(userstore.SectionOverrideEnumerator)
-		if !ok {
-			l.logger.WarnContext(ctx, "trending demand: skipping user store without override enumeration", "user_id", user.ID)
-			continue
-		}
-		overrides, err := enumerator.ListAllSectionOverrides(ctx)
-		if err != nil {
-			if ctx.Err() != nil {
-				return nil, ctx.Err()
-			}
-			l.logger.WarnContext(ctx, "trending demand: skipping unreadable section overrides", "user_id", user.ID, "error", err)
-			continue
-		}
-		for _, override := range overrides {
-			if override.Hidden || override.Removed {
-				continue
-			}
-			if override.SectionID != "" {
-				base := adminByID[override.SectionID]
-				if base == nil {
-					continue
-				}
-				if override.Config != "" && override.Config != jsonNullLiteral {
-					configs = append(configs, json.RawMessage(override.Config))
-				}
-				continue
-			}
-
-			sectionType := override.SectionType
-			config := override.Config
-			if override.IsUserAdded || override.SectionID == "" {
-				if override.UserSectionType != "" {
-					sectionType = override.UserSectionType
-				}
-				if override.UserConfig != "" {
-					config = override.UserConfig
-				}
-			}
-			if sectionType == string(SectionTrendingDiscover) {
-				configs = append(configs, json.RawMessage(config))
-			}
-		}
-	}
-	return configs, nil
-}
diff --git a/internal/sections/trending_refresher.go b/internal/sections/trending_refresher.go
index 3abd0fe373..ac7d2bc895 100644
--- a/internal/sections/trending_refresher.go
+++ b/internal/sections/trending_refresher.go
@@ -47,21 +47,20 @@ type trendingSnapshotStore interface {
 	RecordAttempt(ctx context.Context, source, window, status, message string, claimAt time.Time) error
 }
 
-// trendingExternalIDResolver resolves external IDs to library content IDs.
-// Satisfied by *catalog.ItemRepository.
-type trendingExternalIDResolver interface {
+// externalIDResolver resolves external IDs to library content IDs for the
+// trending snapshots and seasonal lists. Satisfied by *catalog.ItemRepository.
+type externalIDResolver interface {
 	GetByExternalIDs(ctx context.Context, batch catalog.ExternalIDBatch, itemType string) (*catalog.ExternalIDLookup, error)
 }
 
-// TrendingRefresher fetches external global trending (TMDB/Trakt), resolves it
+// TrendingRefresher fetches external global trending (TMDB), resolves it
 // to library content IDs, and persists one snapshot per canonical
 // (source, window). It is driven by a TaskManager task on an interval.
 type TrendingRefresher struct {
-	Sections      trendingSectionConfigLister
-	Snapshots     trendingSnapshotStore
-	Resolver      trendingExternalIDResolver
-	TMDBTrending  catalog.TMDBCollectionFetcher
-	TraktTrending catalog.TraktCollectionFetcher
+	Sections     trendingSectionConfigLister
+	Snapshots    trendingSnapshotStore
+	Resolver     externalIDResolver
+	TMDBTrending catalog.TMDBCollectionFetcher
 
 	// Clock defaults to recipes.RealClock{}.
 	Clock  recipes.Clock
@@ -72,18 +71,16 @@ type TrendingRefresher struct {
 func NewTrendingRefresher(
 	sectionsRepo trendingSectionConfigLister,
 	snapshots trendingSnapshotStore,
-	resolver trendingExternalIDResolver,
+	resolver externalIDResolver,
 	tmdb catalog.TMDBCollectionFetcher,
-	trakt catalog.TraktCollectionFetcher,
 ) *TrendingRefresher {
 	return &TrendingRefresher{
-		Sections:      sectionsRepo,
-		Snapshots:     snapshots,
-		Resolver:      resolver,
-		TMDBTrending:  tmdb,
-		TraktTrending: trakt,
-		Clock:         recipes.RealClock{},
-		logger:        slog.Default(),
+		Sections:     sectionsRepo,
+		Snapshots:    snapshots,
+		Resolver:     resolver,
+		TMDBTrending: tmdb,
+		Clock:        recipes.RealClock{},
+		logger:       slog.Default(),
 	}
 }
 
@@ -209,7 +206,7 @@ func (r *TrendingRefresher) refreshCombo(ctx context.Context, source, window str
 }
 
 func (r *TrendingRefresher) refreshComboClaimed(ctx context.Context, source, window string, claimAt time.Time) string {
-	entries, err := r.fetchEntries(ctx, source, window, trendingFetchCap)
+	entries, err := r.fetchEntries(ctx, window, trendingFetchCap)
 	if err != nil {
 		r.log().ErrorContext(ctx, "trending refresh: fetch failed", "source", source, "window", window, trendingRefreshError, err)
 		return r.finishAttempt(ctx, source, window, trendingRefreshError, err.Error(), claimAt)
@@ -250,27 +247,9 @@ func (r *TrendingRefresher) finishAttempt(ctx context.Context, source, window, s
 	return status
 }
 
-// fetchEntries pulls the raw trending list from the configured provider. A
-// nil/unconfigured provider yields an empty list (no error).
-func (r *TrendingRefresher) fetchEntries(ctx context.Context, source, window string, fetchLimit int) ([]trendingDiscoverEntry, error) {
-	if source == sourceTrakt {
-		if r.TraktTrending == nil {
-			return nil, nil
-		}
-		// Trakt has no mixed endpoint; fetch movies + shows separately. Treat ANY
-		// failure as fatal so a partial result never overwrites the last-good
-		// snapshot with one media type missing.
-		movies, movieErr := r.TraktTrending.GetCollectionPreset(ctx, "trending", "movie", fetchLimit, "")
-		shows, showErr := r.TraktTrending.GetCollectionPreset(ctx, "trending", "tv", fetchLimit, "")
-		if movieErr != nil || showErr != nil {
-			return nil, fmt.Errorf("trakt trending: %w", errors.Join(movieErr, showErr))
-		}
-		// Interleave by rank so the mixed row actually shows both movies and
-		// series; plain concatenation would bury all series past the display
-		// limit whenever enough movies match the library.
-		return interleaveTraktEntries(movies, shows), nil
-	}
-
+// fetchEntries pulls the raw trending list from TMDB. An unconfigured TMDB
+// fetcher yields an empty list (no error).
+func (r *TrendingRefresher) fetchEntries(ctx context.Context, window string, fetchLimit int) ([]trendingDiscoverEntry, error) {
 	if r.TMDBTrending == nil {
 		return nil, nil
 	}
@@ -278,6 +257,14 @@ func (r *TrendingRefresher) fetchEntries(ctx context.Context, source, window str
 	if err != nil {
 		return nil, err
 	}
+	// A trending list holds at most trendingFetchCap entries, so each gets its
+	// IMDb and TVDB IDs up front; a title the catalog holds without a TMDB ID
+	// still matches.
+	if enricher, ok := r.TMDBTrending.(catalog.TMDBExternalIDEnricher); ok {
+		if err := enricher.EnrichExternalIDs(ctx, entries); err != nil {
+			return nil, err
+		}
+	}
 	out := make([]trendingDiscoverEntry, 0, len(entries))
 	for _, e := range entries {
 		out = append(out, newTrendingEntry(e.ID, e.TVDBID, e.IMDbID, e.MediaType))
@@ -285,24 +272,6 @@ func (r *TrendingRefresher) fetchEntries(ctx context.Context, source, window str
 	return out, nil
 }
 
-// interleaveTraktEntries alternates rank-ordered movies and shows so the mixed
-// trending row surfaces both media types. Each input list is already in trending
-// order; alternating preserves that order within each type while mixing them.
-func interleaveTraktEntries(movies, shows []catalog.TraktCollectionEntry) []trendingDiscoverEntry {
-	out := make([]trendingDiscoverEntry, 0, len(movies)+len(shows))
-	for i := 0; i < len(movies) || i < len(shows); i++ {
-		if i < len(movies) {
-			m := movies[i]
-			out = append(out, newTrendingEntry(m.TMDBID, m.TVDBID, m.IMDbID, m.MediaType))
-		}
-		if i < len(shows) {
-			s := shows[i]
-			out = append(out, newTrendingEntry(s.TMDBID, s.TVDBID, s.IMDbID, s.MediaType))
-		}
-	}
-	return out
-}
-
 // resolveIDs matches trending entries to library content IDs via two batched
 // external-ID lookups (movies, series), preserving trending order.
 func (r *TrendingRefresher) resolveIDs(ctx context.Context, entries []trendingDiscoverEntry) ([]string, error) {
diff --git a/internal/sections/trending_refresher_test.go b/internal/sections/trending_refresher_test.go
index d5269cee3f..876b11b880 100644
--- a/internal/sections/trending_refresher_test.go
+++ b/internal/sections/trending_refresher_test.go
@@ -79,22 +79,6 @@ func (f fakeTMDB) GetCollectionPreset(context.Context, string, string, string, i
 	return f.entries, f.err
 }
 
-type fakeTrakt struct {
-	byMediaType map[string][]catalog.TraktCollectionEntry
-	errByType   map[string]error
-}
-
-func (f fakeTrakt) GetUserList(context.Context, string, string, int, string) ([]catalog.TraktCollectionEntry, error) {
-	return nil, nil
-}
-
-func (f fakeTrakt) GetCollectionPreset(_ context.Context, _, mediaType string, _ int, _ string) ([]catalog.TraktCollectionEntry, error) {
-	if err := f.errByType[mediaType]; err != nil {
-		return nil, err
-	}
-	return f.byMediaType[mediaType], nil
-}
-
 type fakeResolver struct {
 	byType map[string]*catalog.ExternalIDLookup
 }
@@ -332,64 +316,10 @@ func TestRefresherSkipsPersonEntries(t *testing.T) {
 	}
 }
 
-func TestRefresherTraktInterleavesMoviesAndShows(t *testing.T) {
-	store := newFakeSnapshotStore()
-	r := &TrendingRefresher{
-		Sections:  fakeSectionLister{configs: []json.RawMessage{tmdbConfig(t, "trakt", "week")}},
-		Snapshots: store,
-		Resolver: fakeResolver{byType: map[string]*catalog.ExternalIDLookup{
-			"movie":  {ByTMDB: map[string]string{"1": "m1", "2": "m2"}, ByIMDb: map[string]string{}, ByTVDB: map[string]string{}},
-			"series": {ByTMDB: map[string]string{"3": "s1"}, ByIMDb: map[string]string{}, ByTVDB: map[string]string{}},
-		}},
-		TraktTrending: fakeTrakt{byMediaType: map[string][]catalog.TraktCollectionEntry{
-			"movie": {{TMDBID: 1, MediaType: "movie"}, {TMDBID: 2, MediaType: "movie"}},
-			"tv":    {{TMDBID: 3, MediaType: "tv"}},
-		}},
-		Clock: fixedClock(time.Date(2026, 5, 29, 12, 0, 0, 0, time.UTC)),
-	}
-
-	if _, err := r.RunOnce(context.Background()); err != nil {
-		t.Fatalf("RunOnce: %v", err)
-	}
-
-	// Interleaved order: movie[0], show[0], movie[1] => m1, s1, m2. A plain
-	// concat would have buried s1 after all movies.
-	got := store.saved["trakt|week"].contentIDs
-	want := []string{"m1", "s1", "m2"}
-	if len(got) != len(want) || got[0] != want[0] || got[1] != want[1] || got[2] != want[2] {
-		t.Fatalf("content IDs = %v; want %v (interleaved)", got, want)
-	}
-}
-
-func TestRefresherTraktPartialFailurePreservesLastGood(t *testing.T) {
-	store := newFakeSnapshotStore()
-	r := &TrendingRefresher{
-		Sections:  fakeSectionLister{configs: []json.RawMessage{tmdbConfig(t, "trakt", "week")}},
-		Snapshots: store,
-		Resolver:  fakeResolver{},
-		TraktTrending: fakeTrakt{
-			byMediaType: map[string][]catalog.TraktCollectionEntry{"movie": {{TMDBID: 1, MediaType: "movie"}}},
-			errByType:   map[string]error{"tv": errors.New("trakt shows 500")},
-		},
-		Clock: fixedClock(time.Date(2026, 5, 29, 12, 0, 0, 0, time.UTC)),
-	}
-
-	if _, err := r.RunOnce(context.Background()); err != nil {
-		t.Fatalf("RunOnce: %v", err)
-	}
-
-	if _, ok := store.saved["trakt|week"]; ok {
-		t.Fatal("SaveSuccess must not run when one Trakt sub-fetch fails (would drop a media type)")
-	}
-	if store.attempts["trakt|week"].status != "error" {
-		t.Fatalf("attempt status = %q; want error", store.attempts["trakt|week"].status)
-	}
-}
-
-func TestDistinctTrendingCombosCollapsesTrakt(t *testing.T) {
+func TestDistinctTrendingCombosCollapsesDuplicates(t *testing.T) {
 	configs := []json.RawMessage{
-		tmdbConfig(t, "trakt", "day"),
-		tmdbConfig(t, "trakt", "week"),
+		tmdbConfig(t, "tmdb", "week"),
+		tmdbConfig(t, "", "bogus"),
 		tmdbConfig(t, "tmdb", "day"),
 		tmdbConfig(t, "tmdb", "day"),
 	}
@@ -401,8 +331,8 @@ func TestDistinctTrendingCombosCollapsesTrakt(t *testing.T) {
 	for _, c := range got {
 		seen[c] = true
 	}
-	if !seen[trendingCombo{"trakt", "week"}] || !seen[trendingCombo{"tmdb", "day"}] {
-		t.Fatalf("combos = %+v; want {trakt week} and {tmdb day}", got)
+	if !seen[trendingCombo{"tmdb", "week"}] || !seen[trendingCombo{"tmdb", "day"}] {
+		t.Fatalf("combos = %+v; want {tmdb week} and {tmdb day}", got)
 	}
 }
 
diff --git a/internal/sections/trending_snapshot.go b/internal/sections/trending_snapshot.go
index 0e1a347d08..91150d2a6f 100644
--- a/internal/sections/trending_snapshot.go
+++ b/internal/sections/trending_snapshot.go
@@ -27,24 +27,15 @@ type TrendingSnapshot struct {
 
 // Canonical trending source and window values used as snapshot keys.
 const (
-	sourceTMDB  = "tmdb"
-	sourceTrakt = "trakt"
-	windowDay   = "day"
-	windowWeek  = "week"
+	sourceTMDB = "tmdb"
+	windowDay  = "day"
+	windowWeek = "week"
 )
 
 // canonicalTrendingKey normalizes a section's configured source/window into the
-// snapshot key space. Source is "trakt" only when explicitly set; everything
-// else collapses to "tmdb". Trakt ignores the time window, so it is pinned to
-// "week" to avoid duplicate identical rows. For TMDB, "day" is honored only
-// when explicitly set; anything else is "week".
-func canonicalTrendingKey(source, window string) (string, string) {
-	if source != sourceTrakt {
-		source = sourceTMDB
-	}
-	if source == sourceTrakt {
-		return sourceTrakt, windowWeek
-	}
+// snapshot key space. TMDB is the only source, so every source collapses to
+// "tmdb". "day" is honored only when explicitly set; anything else is "week".
+func canonicalTrendingKey(_, window string) (string, string) {
 	if window != windowDay {
 		window = windowWeek
 	}
diff --git a/internal/sections/trending_snapshot_test.go b/internal/sections/trending_snapshot_test.go
index 8252348136..ed1de4e3dc 100644
--- a/internal/sections/trending_snapshot_test.go
+++ b/internal/sections/trending_snapshot_test.go
@@ -22,9 +22,7 @@ func TestCanonicalTrendingKey(t *testing.T) {
 		{"tmdb", "", "tmdb", "week"},
 		{"", "day", "tmdb", "day"},
 		{"", "", "tmdb", "week"},
-		{"trakt", "day", "trakt", "week"},
-		{"trakt", "week", "trakt", "week"},
-		{"trakt", "", "trakt", "week"},
+		{"trakt", "day", "tmdb", "day"},
 		{"bogus", "bogus", "tmdb", "week"},
 	}
 	for _, c := range cases {
diff --git a/internal/settingskeys/keys.go b/internal/settingskeys/keys.go
index 2c077957f1..035326a52e 100644
--- a/internal/settingskeys/keys.go
+++ b/internal/settingskeys/keys.go
@@ -9,7 +9,7 @@
 package settingskeys
 
 // Revision is the manifest revision these bindings were generated from.
-const Revision = 17
+const Revision = 20
 
 // Setting keys, one constant per definition.
 const (
@@ -49,6 +49,10 @@ const (
 	PlaybackAutoSkipIntro = "playback.auto_skip_intro"
 	// Auto-skip recaps
 	PlaybackAutoSkipRecap = "playback.auto_skip_recap"
+	// Cellular maximum bitrate
+	PlaybackCellularMaxBitrateKbps = "playback.cellular_max_bitrate_kbps"
+	// Cellular quality
+	PlaybackCellularPreferredQuality = "playback.cellular_preferred_quality"
 	// Skip intros
 	PlaybackIntroSkipMode = "playback.intro_skip_mode"
 	// Maximum bitrate
@@ -133,6 +137,8 @@ const (
 	UiLibraryPageState = "ui.library_page_state"
 	// Next up episodes
 	UiNextUpMode = "ui.next_up_mode"
+	// Show new episodes first
+	UiNextUpNewReleasesFirst = "ui.next_up_new_releases_first"
 	// Remember library view
 	UiRememberLibraryPageState = "ui.remember_library_page_state"
 	// Pinned sidebar items
@@ -169,6 +175,8 @@ var Remote = []string{
 	PlaybackAutoSkipCredits,
 	PlaybackAutoSkipIntro,
 	PlaybackAutoSkipRecap,
+	PlaybackCellularMaxBitrateKbps,
+	PlaybackCellularPreferredQuality,
 	PlaybackIntroSkipMode,
 	PlaybackMaxBitrateKbps,
 	PlaybackNextUpPromptSeconds,
@@ -207,6 +215,7 @@ var Remote = []string{
 	UiLibraryOrder,
 	UiLibraryPageState,
 	UiNextUpMode,
+	UiNextUpNewReleasesFirst,
 	UiRememberLibraryPageState,
 	UiSidebarPins,
 	UiTextScale,
diff --git a/internal/storagetransition/operational_test.go b/internal/storagetransition/operational_test.go
index e3b7d2cdcb..cf3436ec8a 100644
--- a/internal/storagetransition/operational_test.go
+++ b/internal/storagetransition/operational_test.go
@@ -535,7 +535,7 @@ func TestStartRejectsValuesTheSettingsAPIWould(t *testing.T) {
 func TestStartIgnoresUnrelatedStoredSettings(t *testing.T) {
 	for name, unrelated := range map[string]map[string]string{
 		"bootstrap Redis transport":  {"ratelimit.backend": "redis"},
-		"legacy watch provider pair": {"watchsync.trakt.client_id": "legacy-client"},
+		"legacy watch provider pair": {"watchsync.simkl.client_id": "legacy-client"},
 	} {
 		t.Run(name, func(t *testing.T) {
 			settings := &memorySettings{values: map[string]string{
diff --git a/internal/streamtelemetry/global_test.go b/internal/streamtelemetry/global_test.go
index d2755e70b3..a93182e441 100644
--- a/internal/streamtelemetry/global_test.go
+++ b/internal/streamtelemetry/global_test.go
@@ -59,7 +59,7 @@ func TestBuildGlobalViewMergeRules(t *testing.T) {
 	if session.ViewerBytesAccepted != 300 || session.RelayBytesAccepted != 50 {
 		t.Fatalf("bytes = viewer %d relay %d", session.ViewerBytesAccepted, session.RelayBytesAccepted)
 	}
-	if session.StartedAt != claim || session.StartedAtSource != StartedAtSourceClaim {
+	if !session.StartedAt.Equal(claim) || session.StartedAtSource != StartedAtSourceClaim {
 		t.Fatalf("started = %v %s", session.StartedAt, session.StartedAtSource)
 	}
 	if !session.StartedAtDegraded {
diff --git a/internal/streamtoken/token.go b/internal/streamtoken/token.go
index f07f9278c5..a4621c4f21 100644
--- a/internal/streamtoken/token.go
+++ b/internal/streamtoken/token.go
@@ -132,6 +132,7 @@ type Claims struct {
 	VideoBitstreamFilter       string  `json:"vbsf,omitempty"`
 	VideoSampleEntry           string  `json:"vse,omitempty"`
 	CopyVideoMPEGTS            bool    `json:"cvts,omitempty"`
+	KeyframePlaylist           bool    `json:"kfp,omitempty"`
 	OutputSubdir               string  `json:"osd,omitempty"`
 	SeekSeconds                float64 `json:"seek,omitempty"`
 	StreamOriginSeconds        float64 `json:"origin,omitempty"`
@@ -141,13 +142,16 @@ type Claims struct {
 	SubtitleTrackIndex         int     `json:"sti,omitempty"`
 	SubtitleBurnIn             bool    `json:"sbi,omitempty"`
 	SubtitleCodec              string  `json:"sbc,omitempty"`
-	TargetBitrateKbps          int     `json:"tbr,omitempty"`
-	TotalDuration              float64 `json:"dur,omitempty"`
-	FastStart                  bool    `json:"fs,omitempty"`
-	ThrottleSeconds            int     `json:"ths,omitempty"`
-	TargetCodecAudio           string  `json:"tca,omitempty"`
-	TargetAudioChannels        int     `json:"tac,omitempty"`
-	TargetAudioBitrateKbps     int     `json:"tabr,omitempty"`
+	// SubtitleRendition emits the selected text track as the HLS WebVTT
+	// subtitle rendition of the transcode's own playlist.
+	SubtitleRendition      bool    `json:"srn,omitempty"`
+	TargetBitrateKbps      int     `json:"tbr,omitempty"`
+	TotalDuration          float64 `json:"dur,omitempty"`
+	FastStart              bool    `json:"fs,omitempty"`
+	ThrottleSeconds        int     `json:"ths,omitempty"`
+	TargetCodecAudio       string  `json:"tca,omitempty"`
+	TargetAudioChannels    int     `json:"tac,omitempty"`
+	TargetAudioBitrateKbps int     `json:"tabr,omitempty"`
 
 	// Recipe staleness hint, bumped on each re-mint after a recipe mutation
 	// (audio/quality/seek switch). An optional client-side hint only.
diff --git a/internal/subtitles/ai/service.go b/internal/subtitles/ai/service.go
index bbf5d68dd6..9c77a75882 100644
--- a/internal/subtitles/ai/service.go
+++ b/internal/subtitles/ai/service.go
@@ -78,6 +78,13 @@ type Service struct {
 	ffmpegPath      string
 	logger          *slog.Logger
 	runner          *jobrunner.Runner
+	// subtitleCache, when set, holds complete embedded text extracts shared
+	// with subtitle delivery, so a source track is demuxed once rather than
+	// on every translation of it. Optional; nil extracts every time.
+	subtitleCache *playback.SubtitleCache
+	// extractEmbedded demuxes one embedded subtitle stream (ffmpeg's 0:s:N)
+	// as SRT. Nil uses playback.ExtractSubtitle; tests replace it.
+	extractEmbedded func(ctx context.Context, filePath string, ordinal int) ([]byte, error)
 }
 
 // SetExternalTimings makes a sidecar source carry its timing correction, as
@@ -86,6 +93,12 @@ func (s *Service) SetExternalTimings(timings subtitles.ExternalTimingLookup) {
 	s.externalTimings = timings
 }
 
+// SetSubtitleCache shares the node's subtitle extract cache with translation
+// source loading. Call it before Recover or the first Enqueue.
+func (s *Service) SetSubtitleCache(cache *playback.SubtitleCache) {
+	s.subtitleCache = cache
+}
+
 // UpdateConfig swaps the service config. Safe for concurrent use; running
 // jobs finish with the config they started with.
 func (s *Service) UpdateConfig(cfg Config) {
@@ -715,7 +728,24 @@ func (s *Service) loadSource(ctx context.Context, job *Job) ([]SubtitleCue, stri
 		if playback.NeedsBurnIn(track.Codec) {
 			return nil, "", fmt.Errorf("%w: bitmap track", ErrSourceUnsupported)
 		}
-		data, _, err := playback.ExtractSubtitle(ctx, file.FilePath, embeddedIndex, s.ffmpegPath)
+		extract := func(ctx context.Context) ([]byte, error) {
+			if s.extractEmbedded != nil {
+				return s.extractEmbedded(ctx, file.FilePath, embeddedIndex)
+			}
+			data, _, err := playback.ExtractSubtitle(ctx, file.FilePath, embeddedIndex, s.ffmpegPath)
+			return data, err
+		}
+		var data []byte
+		if cached, ok := s.subtitleCache.LookupWebVTT(file.FilePath, embeddedIndex); ok {
+			// Native playback already demuxed this track as WebVTT; ParseCues
+			// reads it, so the source is not demuxed again.
+			data = cached
+		} else if s.subtitleCache != nil {
+			// ExtractSubtitle writes SRT for ffmpeg's 0:s:N, the cache's key.
+			data, err = s.subtitleCache.ExtractText(ctx, file.FilePath, embeddedIndex, "srt", extract)
+		} else {
+			data, err = extract(ctx)
+		}
 		if err != nil {
 			return nil, "", fmt.Errorf("extract embedded subtitle: %w", err)
 		}
diff --git a/internal/subtitles/ai/source_cache_test.go b/internal/subtitles/ai/source_cache_test.go
new file mode 100644
index 0000000000..3d3c1fc5e1
--- /dev/null
+++ b/internal/subtitles/ai/source_cache_test.go
@@ -0,0 +1,155 @@
+package ai
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/playback"
+)
+
+const cachedSourceSRT = `1
+00:00:01,000 --> 00:00:02,000
+Bonjour
+
+2
+00:00:03,000 --> 00:00:04,000
+Au revoir
+`
+
+// TestLoadSourceReusesCachedEmbeddedSubtitle covers #1099: translating an
+// embedded text track reads the node's complete subtitle extract instead of
+// demuxing the source again. The service's ffmpeg path does not exist, so any
+// extraction attempt fails the test.
+func TestLoadSourceReusesCachedEmbeddedSubtitle(t *testing.T) {
+	dir := t.TempDir()
+	source := filepath.Join(dir, "movie.mkv")
+	if err := os.WriteFile(source, []byte("not a real container"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	cache := playback.NewSubtitleCache(func() string { return filepath.Join(dir, "transcode") })
+	if _, err := cache.ExtractText(context.Background(), source, 1, "srt", func(context.Context) ([]byte, error) {
+		return []byte(cachedSourceSRT), nil
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	file := &models.MediaFile{ID: 7, FilePath: source, SubtitleTracks: []models.SubtitleTrack{
+		{Language: "eng", Codec: "subrip"},
+		{Language: "fre", Codec: "subrip"},
+	}}
+	svc := NewService(context.Background(), Config{}, nil, nil, nil, nil, nil,
+		runTranscribeFileResolver{file: file}, nil, filepath.Join(dir, "missing-ffmpeg"), nil, nil)
+	svc.SetSubtitleCache(cache)
+
+	cues, language, err := svc.loadSource(context.Background(), &Job{MediaFileID: file.ID, SourceIndex: 1})
+	if err != nil {
+		t.Fatalf("loadSource extracted instead of reusing the cache: %v", err)
+	}
+	if language != "fre" || len(cues) != 2 || cues[0].Lines[0] != "Bonjour" {
+		t.Fatalf("language=%q cues=%+v", language, cues)
+	}
+
+	// Without the cache the same request has to demux, which fails here.
+	svc.SetSubtitleCache(nil)
+	if _, _, err := svc.loadSource(context.Background(), &Job{MediaFileID: file.ID, SourceIndex: 1}); err == nil {
+		t.Fatal("uncached load did not attempt extraction")
+	} else if errors.Is(err, ErrSourceUnsupported) {
+		t.Fatalf("unexpected unsupported-source error: %v", err)
+	}
+}
+
+// TestLoadSourceFillsCacheOnMiss: the first translation of an uncached track
+// extracts it once and publishes the extract, so a later translation, even
+// from another service sharing the cache, reads it without extracting.
+func TestLoadSourceFillsCacheOnMiss(t *testing.T) {
+	dir := t.TempDir()
+	source := filepath.Join(dir, "movie.mkv")
+	if err := os.WriteFile(source, []byte("not a real container"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	cache := playback.NewSubtitleCache(func() string { return filepath.Join(dir, "transcode") })
+	file := &models.MediaFile{ID: 7, FilePath: source, SubtitleTracks: []models.SubtitleTrack{
+		{Language: "eng", Codec: "subrip"},
+		{Language: "fre", Codec: "subrip"},
+	}}
+	newService := func(extract func(context.Context, string, int) ([]byte, error)) *Service {
+		svc := NewService(context.Background(), Config{}, nil, nil, nil, nil, nil,
+			runTranscribeFileResolver{file: file}, nil, "", nil, nil)
+		svc.SetSubtitleCache(cache)
+		svc.extractEmbedded = extract
+		return svc
+	}
+
+	calls := 0
+	first := newService(func(_ context.Context, path string, ordinal int) ([]byte, error) {
+		calls++
+		if path != source || ordinal != 1 {
+			t.Fatalf("extracted %s track %d, want %s track 1", path, ordinal, source)
+		}
+		return []byte(cachedSourceSRT), nil
+	})
+	for range 2 {
+		cues, language, err := first.loadSource(context.Background(), &Job{MediaFileID: file.ID, SourceIndex: 1})
+		if err != nil || language != "fre" || len(cues) != 2 {
+			t.Fatalf("language=%q cues=%d err=%v", language, len(cues), err)
+		}
+	}
+	if calls != 1 {
+		t.Fatalf("extracted %d times, want 1", calls)
+	}
+
+	second := newService(func(context.Context, string, int) ([]byte, error) {
+		return nil, errors.New("extracted again despite a cached source")
+	})
+	if _, _, err := second.loadSource(context.Background(), &Job{MediaFileID: file.ID, SourceIndex: 1}); err != nil {
+		t.Fatal(err)
+	}
+}
+
+// TestLoadSourceReusesPlaybackWebVTT covers the producer/consumer path: native
+// playback's ServeExtract caches a SubRip track as WebVTT, and the first AI
+// translation of that track reads it instead of demuxing the source again.
+func TestLoadSourceReusesPlaybackWebVTT(t *testing.T) {
+	dir := t.TempDir()
+	source := filepath.Join(dir, "movie.mkv")
+	if err := os.WriteFile(source, []byte("not a real container"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	cache := playback.NewSubtitleCache(func() string { return filepath.Join(dir, "transcode") })
+
+	const vtt = "WEBVTT\n\n00:00:01.000 --> 00:00:02.000\nBonjour\n\n00:00:03.000 --> 00:00:04.000\nAu revoir\n"
+	req := httptest.NewRequest(http.MethodGet, "/subtitles/1", nil)
+	opts := playback.StreamExtractOpts{InputPath: source, TrackIndex: 1, SourceCodec: "subrip"}
+	if err := cache.ServeExtract(httptest.NewRecorder(), req, opts, func(_ context.Context, o playback.StreamExtractOpts) error {
+		_, err := io.WriteString(o.Writer, vtt)
+		return err
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	file := &models.MediaFile{ID: 7, FilePath: source, SubtitleTracks: []models.SubtitleTrack{
+		{Language: "eng", Codec: "subrip"},
+		{Language: "fre", Codec: "subrip"},
+	}}
+	svc := NewService(context.Background(), Config{}, nil, nil, nil, nil, nil,
+		runTranscribeFileResolver{file: file}, nil, "", nil, nil)
+	svc.SetSubtitleCache(cache)
+	svc.extractEmbedded = func(context.Context, string, int) ([]byte, error) {
+		return nil, errors.New("demuxed the source despite playback's cached WebVTT")
+	}
+
+	cues, language, err := svc.loadSource(context.Background(), &Job{MediaFileID: file.ID, SourceIndex: 1})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if language != "fre" || len(cues) != 2 || cues[0].Lines[0] != "Bonjour" {
+		t.Fatalf("language=%q cues=%+v", language, cues)
+	}
+}
diff --git a/internal/subtitles/manager.go b/internal/subtitles/manager.go
index ac3a649c4f..0711a31540 100644
--- a/internal/subtitles/manager.go
+++ b/internal/subtitles/manager.go
@@ -13,6 +13,8 @@ import (
 	"time"
 
 	"github.com/google/uuid"
+
+	"github.com/prairie-server/prairie-server/internal/logredact"
 )
 
 var (
@@ -115,7 +117,14 @@ func (m *Manager) Search(ctx context.Context, req SearchRequest) (*SearchRespons
 
 			results, err := prov.Search(pctx, req)
 			if err != nil {
-				ch <- providerResult{warning: fmt.Sprintf("%s: %v", prov.Name(), err)}
+				// Provider errors can carry request URLs and upstream bodies, so
+				// callers only learn which provider failed; the detail is logged
+				// unless the caller has already gone away.
+				if ctx.Err() == nil {
+					slog.WarnContext(ctx, "subtitle provider search failed", "component", "subtitles", "provider", prov.Name(),
+						"error", logredact.SanitizeText(logredact.SanitizeURLError(err).Error()))
+				}
+				ch <- providerResult{warning: prov.Name() + ": search failed"}
 				return
 			}
 			ch <- providerResult{results: results}
diff --git a/internal/subtitles/manager_test.go b/internal/subtitles/manager_test.go
index faf9f75344..daf06f6919 100644
--- a/internal/subtitles/manager_test.go
+++ b/internal/subtitles/manager_test.go
@@ -1,8 +1,11 @@
 package subtitles
 
 import (
+	"bytes"
 	"context"
 	"errors"
+	"log/slog"
+	"strings"
 	"sync"
 	"testing"
 	"time"
@@ -149,6 +152,32 @@ func (s stubProvider) Download(context.Context, string) ([]byte, SubtitleFormat,
 	return s.data, FormatSRT, nil
 }
 
+type failingSearchProvider struct{ stubProvider }
+
+func (failingSearchProvider) Search(context.Context, SearchRequest) ([]SubtitleResult, error) {
+	return nil, errors.New("rpc error: code = Unauthenticated desc = api_key=synthetic-secret upstream detail")
+}
+
+func TestManagerSearchWarningsOmitProviderErrorText(t *testing.T) {
+	var logs bytes.Buffer
+	previous := slog.Default()
+	slog.SetDefault(slog.New(slog.NewTextHandler(&logs, nil)))
+	t.Cleanup(func() { slog.SetDefault(previous) })
+
+	manager := NewManager(newMockSubtitleRepo(), newMockBlobStore())
+	manager.RegisterProvider(failingSearchProvider{stubProvider{name: "example"}})
+	resp, err := manager.SearchBridge(t.Context(), SearchRequest{Title: "Example"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(resp.Warnings) != 1 || resp.Warnings[0] != "example: search failed" {
+		t.Fatalf("warnings = %q", resp.Warnings)
+	}
+	if !strings.Contains(logs.String(), "upstream detail") || strings.Contains(logs.String(), "synthetic-secret") {
+		t.Fatalf("provider failure log = %q", logs.String())
+	}
+}
+
 func TestManagerDownloadRejectsOversizedProviderResult(t *testing.T) {
 	repo := newMockSubtitleRepo()
 	blobs := newMockBlobStore()
diff --git a/internal/subtitles/subdl/download.go b/internal/subtitles/subdl/download.go
index 9afc30a7ba..930f53283f 100644
--- a/internal/subtitles/subdl/download.go
+++ b/internal/subtitles/subdl/download.go
@@ -17,6 +17,15 @@ var downloadPathPattern = regexp.MustCompile(`^/subtitle/[0-9]+-[0-9]+\.zip$`)
 
 var errInvalidID = fmt.Errorf("subdl: %w", subtitles.ErrInvalidSubtitleID)
 
+// resultID turns the url of a SubDL search row into the result ID clients
+// see. SubDL can sign that url with the account's api_key as a query string,
+// and result IDs go to every user who can search, so only the path is kept.
+func resultID(rowURL string) string {
+	path, _, _ := strings.Cut(rowURL, "?")
+	path, _, _ = strings.Cut(path, "#")
+	return path
+}
+
 // downloadURL resolves a search result ID against the download base. The ID
 // arrives from API clients, so anything other than a SubDL archive path is
 // refused before any request is made, and the result must stay on the base's
@@ -27,9 +36,10 @@ func (p *Provider) downloadURL(id string) (string, error) {
 		!downloadPathPattern.MatchString(ref.Path) {
 		return "", errInvalidID
 	}
-	// SubDL may embed the account key as a query string; keep it, re-encoded.
-	query, err := url.ParseQuery(ref.RawQuery)
-	if err != nil {
+	// IDs issued before resultID dropped the query may still carry a signed
+	// query string. Its values are never forwarded; the server signs with its
+	// own key instead.
+	if _, err := url.ParseQuery(ref.RawQuery); err != nil {
 		return "", errInvalidID
 	}
 	base, err := url.Parse(p.dlBaseURL)
@@ -37,7 +47,10 @@ func (p *Provider) downloadURL(id string) (string, error) {
 		return "", fmt.Errorf("subdl: parse download base: %w", err)
 	}
 	target := base.JoinPath(ref.Path)
-	target.RawQuery = query.Encode()
+	target.RawQuery = ""
+	if p.apiKey != "" {
+		target.RawQuery = url.Values{"api_key": {p.apiKey}}.Encode()
+	}
 	if !sameOrigin(target, base) || target.User.String() != base.User.String() {
 		return "", errInvalidID
 	}
diff --git a/internal/subtitles/subdl/download_test.go b/internal/subtitles/subdl/download_test.go
index 29de6fecca..47d5e3ef59 100644
--- a/internal/subtitles/subdl/download_test.go
+++ b/internal/subtitles/subdl/download_test.go
@@ -51,19 +51,51 @@ func TestDownloadFetchesWellFormedIDFromDownloadHost(t *testing.T) {
 	}))
 	defer dl.Close()
 
-	p := New(Config{DLBaseURL: dl.URL})
-	data, format, err := p.Download(t.Context(), "/subtitle/3197651-3213944.zip?api_key=synthetic")
+	p := New(Config{DLBaseURL: dl.URL, APIKey: "synthetic-server-key"})
+	// An ID issued before result IDs dropped SubDL's signed query: the
+	// client's query is not forwarded, the server signs with its own key.
+	data, format, err := p.Download(t.Context(), "/subtitle/3197651-3213944.zip?api_key=client-supplied&x=1")
 	if err != nil {
 		t.Fatal(err)
 	}
 	if format != subtitles.FormatSRT || !strings.Contains(string(data), "hello") {
 		t.Fatalf("got %q (%s)", data, format)
 	}
-	if gotPath != "/subtitle/3197651-3213944.zip" || gotQuery != "api_key=synthetic" {
+	if gotPath != "/subtitle/3197651-3213944.zip" || gotQuery != "api_key=synthetic-server-key" {
 		t.Fatalf("requested %s?%s", gotPath, gotQuery)
 	}
 }
 
+func TestSignedSearchRowYieldsKeylessIDThatDownloads(t *testing.T) {
+	const key = "synthetic-subdl-key"
+	api := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		_, _ = w.Write([]byte(`{"status":true,"subtitles":[{"language":"EN","release_name":"Example.2024.srt","url":"/subtitle/3520378-8443030.zip?api_key=` + key + `"}]}`))
+	}))
+	defer api.Close()
+	var gotQuery string
+	dl := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotQuery = r.URL.RawQuery
+		_, _ = w.Write(subtitleZip(t, "1\n00:00:01,000 --> 00:00:02,000\nhello\n"))
+	}))
+	defer dl.Close()
+
+	p := New(Config{BaseURL: api.URL, DLBaseURL: dl.URL, APIKey: key})
+	results, err := p.Search(t.Context(), subtitles.SearchRequest{IMDbID: "tt0000001"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(results) != 1 || results[0].ID != "/subtitle/3520378-8443030.zip" {
+		t.Fatalf("results = %+v", results)
+	}
+	if _, _, err := p.Download(t.Context(), results[0].ID); err != nil {
+		t.Fatal(err)
+	}
+	if gotQuery != "api_key="+key {
+		t.Fatalf("download query = %q", gotQuery)
+	}
+}
+
 func TestDownloadRefusesIDsThatLeaveTheDownloadHost(t *testing.T) {
 	var dlHits atomic.Int32
 	dl := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) { dlHits.Add(1) }))
@@ -112,14 +144,30 @@ func TestDownloadRefusesRedirectOffTheDownloadHost(t *testing.T) {
 	}))
 	defer dl.Close()
 
-	if _, _, err := New(Config{DLBaseURL: dl.URL}).Download(t.Context(), "/subtitle/1-2.zip"); err == nil {
+	_, _, err := New(Config{DLBaseURL: dl.URL, APIKey: "synthetic-subdl-key"}).Download(t.Context(), "/subtitle/1-2.zip")
+	if err == nil {
 		t.Fatal("download followed an off-host redirect")
 	}
+	if strings.Contains(err.Error(), "synthetic-subdl-key") {
+		t.Fatalf("download error carries the key: %v", err)
+	}
 	if n := otherHits.Load(); n != 0 {
 		t.Fatalf("off-host server received %d requests", n)
 	}
 }
 
+func TestDownloadTransportErrorOmitsAPIKey(t *testing.T) {
+	dl := httptest.NewServer(http.NotFoundHandler())
+	dl.Close()
+	_, _, err := New(Config{DLBaseURL: dl.URL, APIKey: "synthetic-subdl-key"}).Download(t.Context(), "/subtitle/1-2.zip")
+	if err == nil {
+		t.Fatal("download from a closed server succeeded")
+	}
+	if strings.Contains(err.Error(), "synthetic-subdl-key") {
+		t.Fatalf("download error carries the key: %v", err)
+	}
+}
+
 func TestDownloadFollowsRedirectOnTheDownloadHost(t *testing.T) {
 	dl := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.URL.Path == "/subtitle/1-2.zip" {
diff --git a/internal/subtitles/subdl/subdl.go b/internal/subtitles/subdl/subdl.go
index ed33f450d0..4fb07ac785 100644
--- a/internal/subtitles/subdl/subdl.go
+++ b/internal/subtitles/subdl/subdl.go
@@ -11,6 +11,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/prairie-server/prairie-server/internal/logredact"
 	"github.com/prairie-server/prairie-server/internal/subtitles"
 )
 
@@ -97,7 +98,8 @@ func (p *Provider) Search(ctx context.Context, req subtitles.SearchRequest) ([]s
 
 	resp, err := p.client.Do(httpReq)
 	if err != nil {
-		return nil, fmt.Errorf("subdl: search request: %w", err)
+		// The request URL carries the API key; keep it out of the error text.
+		return nil, fmt.Errorf("subdl: search request: %w", logredact.SanitizeURLError(err))
 	}
 	defer resp.Body.Close()
 
@@ -123,7 +125,7 @@ func (p *Provider) Search(ctx context.Context, req subtitles.SearchRequest) ([]s
 		language := subtitles.NormalizeProviderLanguage("subdl", rawLanguage)
 		format := detectFormat(s.ReleaseName)
 		result := subtitles.SubtitleResult{
-			ID:              s.URL, // relative download path
+			ID:              resultID(s.URL),
 			Provider:        "subdl",
 			Language:        language,
 			ReleaseName:     s.ReleaseName,
@@ -152,7 +154,7 @@ func (p *Provider) Download(ctx context.Context, id string) ([]byte, subtitles.S
 
 	resp, err := p.client.Do(httpReq)
 	if err != nil {
-		return nil, "", fmt.Errorf("subdl: download request: %w", err)
+		return nil, "", fmt.Errorf("subdl: download request: %w", logredact.SanitizeURLError(err))
 	}
 	defer resp.Body.Close()
 
diff --git a/internal/subtitles/subdl/subdl_test.go b/internal/subtitles/subdl/subdl_test.go
index e84abf2571..70b8fe1d8e 100644
--- a/internal/subtitles/subdl/subdl_test.go
+++ b/internal/subtitles/subdl/subdl_test.go
@@ -3,6 +3,7 @@ package subdl
 import (
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 
 	"github.com/prairie-server/prairie-server/internal/subtitles"
@@ -33,3 +34,15 @@ func TestSearchCanonicalizesProviderLanguages(t *testing.T) {
 		}
 	}
 }
+
+func TestSearchTransportErrorOmitsAPIKey(t *testing.T) {
+	server := httptest.NewServer(http.NotFoundHandler())
+	server.Close()
+	_, err := New(Config{BaseURL: server.URL, APIKey: "synthetic-subdl-key"}).Search(t.Context(), subtitles.SearchRequest{Title: "Example"})
+	if err == nil {
+		t.Fatal("search against a closed server succeeded")
+	}
+	if strings.Contains(err.Error(), "synthetic-subdl-key") {
+		t.Fatalf("search error exposes the API key: %v", err)
+	}
+}
diff --git a/internal/subtitles/subsync/service.go b/internal/subtitles/subsync/service.go
index e6500223d1..de90d5a594 100644
--- a/internal/subtitles/subsync/service.go
+++ b/internal/subtitles/subsync/service.go
@@ -12,6 +12,7 @@ import (
 	"time"
 
 	"github.com/prairie-server/prairie-server/internal/ai/jobrunner"
+	"github.com/prairie-server/prairie-server/internal/database/queryattr"
 	"github.com/prairie-server/prairie-server/internal/mediaartifact"
 	"github.com/prairie-server/prairie-server/internal/mediasample"
 	"github.com/prairie-server/prairie-server/internal/models"
@@ -293,7 +294,7 @@ func (s *Service) SubtitlePlayed(ctx context.Context, target subtitles.SyncTarge
 		s.syncPlayed(ctx, target)
 		return
 	}
-	go s.syncPlayed(context.WithoutCancel(ctx), target)
+	go s.syncPlayed(queryattr.Detach(context.WithoutCancel(ctx)), target)
 }
 
 // firstPlay reports whether target was not considered within playedTTL, and
@@ -387,7 +388,7 @@ func (s *Service) start(ctx context.Context, job *Job, target subtitles.SyncTarg
 		s.updated(ctx, target, timing, queued)
 		return
 	}
-	go s.updated(context.WithoutCancel(ctx), target, timing, queued)
+	go s.updated(queryattr.Detach(context.WithoutCancel(ctx)), target, timing, queued)
 }
 
 func (s *Service) dispatch(job *Job) {
diff --git a/internal/subtitles/timing.go b/internal/subtitles/timing.go
index cab85d0c88..54230b7126 100644
--- a/internal/subtitles/timing.go
+++ b/internal/subtitles/timing.go
@@ -186,9 +186,8 @@ func retimeCueRange(t Timing, start, end, unit time.Duration) (time.Duration, ti
 // writeTimingLine writes line with only its start and end timestamp tokens
 // replaced, preserving surrounding whitespace, the arrow, and cue settings.
 func writeTimingLine(out *bytes.Buffer, line rawLine, start, end string) {
-	text := line.text
-	arrow := bytes.Index(text, []byte("-->"))
-	left := text[:arrow]
+	// Callers pass the cue line that holds the arrow.
+	left, right, _ := bytes.Cut(line.text, []byte("-->"))
 	s0 := len(left) - len(bytes.TrimLeftFunc(left, unicode.IsSpace))
 	s1 := len(bytes.TrimRightFunc(left, unicode.IsSpace))
 	out.Write(left[:s0])
@@ -196,7 +195,6 @@ func writeTimingLine(out *bytes.Buffer, line rawLine, start, end string) {
 	out.Write(left[s1:])
 	out.WriteString("-->")
 
-	right := text[arrow+3:]
 	e0 := len(right) - len(bytes.TrimLeftFunc(right, unicode.IsSpace))
 	e1 := len(right)
 	if sp := bytes.IndexAny(right[e0:], " \t"); sp >= 0 {
diff --git a/internal/taskmanager/tasks/check_plugin_updates.go b/internal/taskmanager/tasks/check_plugin_updates.go
index 64ef7a6f5d..705191f245 100644
--- a/internal/taskmanager/tasks/check_plugin_updates.go
+++ b/internal/taskmanager/tasks/check_plugin_updates.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"strings"
 
 	"github.com/prairie-server/prairie-server/internal/plugins"
 	"github.com/prairie-server/prairie-server/internal/taskmanager"
@@ -59,5 +60,11 @@ func (t *CheckPluginUpdatesTask) Execute(ctx context.Context, progress taskmanag
 		summary.UpdatesApplied,
 		summary.UpdatesAvailable,
 	))
+	// A refused update leaves the old version running, but the admin still has
+	// to see it: report the run as failed with each plugin's reason.
+	if summary.FailedOperations > 0 {
+		return fmt.Errorf("%d plugin update operation(s) failed: %s",
+			summary.FailedOperations, strings.Join(summary.Failures, "; "))
+	}
 	return nil
 }
diff --git a/internal/taskmanager/tasks/check_plugin_updates_test.go b/internal/taskmanager/tasks/check_plugin_updates_test.go
new file mode 100644
index 0000000000..d4d1d2c3bc
--- /dev/null
+++ b/internal/taskmanager/tasks/check_plugin_updates_test.go
@@ -0,0 +1,55 @@
+package tasks
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/plugins"
+)
+
+type pluginUpdateCheckerStub struct {
+	summary plugins.AutoUpdateSummary
+}
+
+func (s pluginUpdateCheckerStub) Check(context.Context, plugins.AutoUpdateOptions) (plugins.AutoUpdateSummary, error) {
+	return s.summary, nil
+}
+
+type pluginUpdateProgressStub struct {
+	resultData json.RawMessage
+}
+
+func (p *pluginUpdateProgressStub) Report(float64, string)          {}
+func (p *pluginUpdateProgressStub) SetResultData(d json.RawMessage) { p.resultData = d }
+
+func TestCheckPluginUpdatesTaskFailsWhenAnUpdateIsRefused(t *testing.T) {
+	task := NewCheckPluginUpdatesTask(pluginUpdateCheckerStub{summary: plugins.AutoUpdateSummary{
+		CatalogEntries:   2,
+		FailedOperations: 1,
+		Failures:         []string{"process plugin update silo.example: binary checksum mismatch"},
+	}})
+	progress := &pluginUpdateProgressStub{}
+
+	err := task.Execute(context.Background(), progress)
+	if err == nil {
+		t.Fatal("Execute returned nil, want the refused update reported")
+	}
+	if !strings.Contains(err.Error(), "silo.example: binary checksum mismatch") {
+		t.Fatalf("Execute error = %q, want the plugin and reason", err)
+	}
+	if len(progress.resultData) == 0 {
+		t.Fatal("result data not recorded for a failed run")
+	}
+}
+
+func TestCheckPluginUpdatesTaskSucceedsWithoutFailures(t *testing.T) {
+	task := NewCheckPluginUpdatesTask(pluginUpdateCheckerStub{summary: plugins.AutoUpdateSummary{
+		CatalogEntries: 2,
+		UpdatesApplied: 1,
+	}})
+	if err := task.Execute(context.Background(), &pluginUpdateProgressStub{}); err != nil {
+		t.Fatalf("Execute: %v", err)
+	}
+}
diff --git a/internal/taskmanager/tasks/contribute_markers.go b/internal/taskmanager/tasks/contribute_markers.go
index 5ae2500927..58735ece30 100644
--- a/internal/taskmanager/tasks/contribute_markers.go
+++ b/internal/taskmanager/tasks/contribute_markers.go
@@ -23,10 +23,10 @@ type AutoContributeConfigReader interface {
 	List() []markers.ProviderConfig
 }
 
-// ContributionCandidateSource lists local-intro files eligible for auto
+// ContributionCandidateSource lists local-marker files eligible for auto
 // contribution (satisfied by *markers.ContributionStore).
 type ContributionCandidateSource interface {
-	CandidateLocalIntroFiles(ctx context.Context, minConfidence float64, providers []string, after *markers.ContributionCandidate, limit int) ([]markers.ContributionCandidate, error)
+	CandidateLocalMarkerFiles(ctx context.Context, kind markers.MarkerKind, minConfidence float64, providers []string, after *markers.ContributionCandidate, limit int) ([]markers.ContributionCandidate, error)
 }
 
 // ContributionFileLoader loads files by id (satisfied by *scanner.FileRepository).
@@ -34,8 +34,9 @@ type ContributionFileLoader interface {
 	GetByIDs(ctx context.Context, ids []int) ([]*models.MediaFile, error)
 }
 
-// ContributeMarkersTask submits high-confidence local intro markers to providers
-// that have auto-contribution enabled. It is a no-op when no provider opts in.
+// ContributeMarkersTask submits high-confidence local intro and credits markers
+// to providers that have auto-contribution enabled. It is a no-op when no
+// provider opts in.
 type ContributeMarkersTask struct {
 	service    ContributionRunner
 	config     AutoContributeConfigReader
@@ -72,9 +73,9 @@ func sleepContext(ctx context.Context, d time.Duration) error {
 }
 
 func (t *ContributeMarkersTask) Key() string  { return "contribute_markers" }
-func (t *ContributeMarkersTask) Name() string { return "Share intro markers" }
+func (t *ContributeMarkersTask) Name() string { return "Share detected markers" }
 func (t *ContributeMarkersTask) Description() string {
-	return "Sends eligible intros detected on this server to providers with automatic sharing enabled."
+	return "Sends eligible intros and credits detected on this server to providers with automatic sharing enabled."
 }
 func (t *ContributeMarkersTask) Category() taskmanager.TaskCategory {
 	return taskmanager.TaskCategoryLibrary
@@ -110,16 +111,41 @@ func (t *ContributeMarkersTask) Execute(ctx context.Context, progress taskmanage
 	}
 
 	var counts contributionCounts
-	var after *markers.ContributionCandidate
 	rateLimitWaits := 0
+	// One pass per kind, intros first, so a pass asks each file for the one
+	// segment it was selected for.
+	for _, kind := range markers.AutoContributedKinds() {
+		stopped, err := t.contributeKind(ctx, progress, kind, minConfidence, providers, &counts, &rateLimitWaits)
+		if err != nil || stopped {
+			return err
+		}
+	}
 
+	counts.write(progress, 0)
+	progress.Report(100, fmt.Sprintf("Contributed %d, skipped %d, invalid %d, failed %d", counts.submitted, counts.skipped, counts.invalid, counts.failed))
+	return nil
+}
+
+// contributeKind submits one segment kind for every candidate file. It reports
+// stopped when a provider's usage limit ends the run.
+func (t *ContributeMarkersTask) contributeKind(
+	ctx context.Context,
+	progress taskmanager.ProgressReporter,
+	kind markers.MarkerKind,
+	minConfidence float64,
+	providers []string,
+	counts *contributionCounts,
+	rateLimitWaits *int,
+) (bool, error) {
+	opts := markers.ContributeOptions{Segments: []markers.MarkerKind{kind}, Auto: true}
+	var after *markers.ContributionCandidate
 	for {
-		candidates, err := t.candidates.CandidateLocalIntroFiles(ctx, minConfidence, providers, after, contributionCandidateBatch)
+		candidates, err := t.candidates.CandidateLocalMarkerFiles(ctx, kind, minConfidence, providers, after, contributionCandidateBatch)
 		if err != nil {
-			return fmt.Errorf("load contribution candidates: %w", err)
+			return false, fmt.Errorf("load contribution candidates: %w", err)
 		}
 		if len(candidates) == 0 {
-			break
+			return false, nil
 		}
 		ids := make([]int, len(candidates))
 		for i, c := range candidates {
@@ -127,7 +153,7 @@ func (t *ContributeMarkersTask) Execute(ctx context.Context, progress taskmanage
 		}
 		files, err := t.files.GetByIDs(ctx, ids)
 		if err != nil {
-			return fmt.Errorf("load candidate files: %w", err)
+			return false, fmt.Errorf("load candidate files: %w", err)
 		}
 		byID := make(map[int]*models.MediaFile, len(files))
 		for _, f := range files {
@@ -143,36 +169,32 @@ func (t *ContributeMarkersTask) Execute(ctx context.Context, progress taskmanage
 			// that already finished report skips that must not be counted twice.
 			tallied := map[string]string{}
 			for {
-				outcomes, err := t.service.ContributeFile(ctx, file, markers.ContributeOptions{Auto: true})
+				outcomes, err := t.service.ContributeFile(ctx, file, opts)
 				if err != nil {
 					counts.failed++
 					break
 				}
 				retryAfter, limited := counts.add(outcomes, tallied)
 				if !limited {
-					rateLimitWaits = 0
+					*rateLimitWaits = 0
 					break
 				}
-				if retryAfter <= 0 || retryAfter > contributionMaxInlineWait || rateLimitWaits >= contributionMaxRateLimitWaits {
+				if retryAfter <= 0 || retryAfter > contributionMaxInlineWait || *rateLimitWaits >= contributionMaxRateLimitWaits {
 					counts.write(progress, retryAfter)
 					progress.Report(100, fmt.Sprintf("Contribution usage-limited; retry after %s", formatRetryAfter(retryAfter)))
-					return nil
+					return true, nil
 				}
-				rateLimitWaits++
+				*rateLimitWaits++
 				progress.Report(50, fmt.Sprintf("Contribution rate-limited; waiting %s", retryAfter))
 				if err := t.wait(ctx, retryAfter); err != nil {
-					return err
+					return false, err
 				}
 			}
 		}
 		if ctx.Err() != nil {
-			return ctx.Err()
+			return false, ctx.Err()
 		}
 	}
-
-	counts.write(progress, 0)
-	progress.Report(100, fmt.Sprintf("Contributed %d, skipped %d, invalid %d, failed %d", counts.submitted, counts.skipped, counts.invalid, counts.failed))
-	return nil
 }
 
 type contributionCounts struct {
diff --git a/internal/taskmanager/tasks/contribute_markers_test.go b/internal/taskmanager/tasks/contribute_markers_test.go
index 1c5d076bb4..e043734576 100644
--- a/internal/taskmanager/tasks/contribute_markers_test.go
+++ b/internal/taskmanager/tasks/contribute_markers_test.go
@@ -3,6 +3,7 @@ package tasks
 import (
 	"context"
 	"encoding/json"
+	"fmt"
 	"testing"
 	"time"
 
@@ -17,6 +18,7 @@ func (p *contribTestProgress) SetResultData(d json.RawMessage) { p.data = d }
 
 type fakeContribRunner struct {
 	calls    []int
+	segments [][]markers.MarkerKind
 	autoSeen bool
 	outcomes []markers.ContributionOutcome
 	// sequence, when set, returns one entry per call before falling back to
@@ -26,6 +28,7 @@ type fakeContribRunner struct {
 
 func (f *fakeContribRunner) ContributeFile(_ context.Context, file *models.MediaFile, opts markers.ContributeOptions) ([]markers.ContributionOutcome, error) {
 	f.calls = append(f.calls, file.ID)
+	f.segments = append(f.segments, opts.Segments)
 	f.autoSeen = opts.Auto
 	if len(f.sequence) > 0 {
 		next := f.sequence[0]
@@ -39,24 +42,37 @@ type fakeAutoConfig []markers.ProviderConfig
 
 func (f fakeAutoConfig) List() []markers.ProviderConfig { return f }
 
+// fakeCandidates returns ids once for the intro pass and credits once for the
+// credits pass.
 type fakeCandidates struct {
 	ids          []int
+	credits      []int
 	gotMin       float64
 	gotProviders []string
-	afters       []*markers.ContributionCandidate
-	delivered    bool
+	kinds        []markers.MarkerKind
+	afters       map[markers.MarkerKind][]*markers.ContributionCandidate
+	delivered    map[markers.MarkerKind]bool
 }
 
-func (f *fakeCandidates) CandidateLocalIntroFiles(_ context.Context, minConfidence float64, providers []string, after *markers.ContributionCandidate, _ int) ([]markers.ContributionCandidate, error) {
+func (f *fakeCandidates) CandidateLocalMarkerFiles(_ context.Context, kind markers.MarkerKind, minConfidence float64, providers []string, after *markers.ContributionCandidate, _ int) ([]markers.ContributionCandidate, error) {
 	f.gotMin = minConfidence
 	f.gotProviders = providers
-	f.afters = append(f.afters, after)
-	if f.delivered {
+	f.kinds = append(f.kinds, kind)
+	if f.afters == nil {
+		f.afters = map[markers.MarkerKind][]*markers.ContributionCandidate{}
+		f.delivered = map[markers.MarkerKind]bool{}
+	}
+	f.afters[kind] = append(f.afters[kind], after)
+	if f.delivered[kind] {
 		return nil, nil
 	}
-	f.delivered = true
-	out := make([]markers.ContributionCandidate, len(f.ids))
-	for i, id := range f.ids {
+	f.delivered[kind] = true
+	ids := f.ids
+	if kind == markers.MarkerKindCredits {
+		ids = f.credits
+	}
+	out := make([]markers.ContributionCandidate, len(ids))
+	for i, id := range ids {
 		out[i] = markers.ContributionCandidate{FileID: id, Confidence: 0.95}
 	}
 	return out, nil
@@ -109,14 +125,42 @@ func TestContributeMarkersTaskSubmitsCandidates(t *testing.T) {
 	if len(cands.gotProviders) != 1 || cands.gotProviders[0] != "introdb" {
 		t.Errorf("providers passed = %v, want [introdb]", cands.gotProviders)
 	}
-	if len(cands.afters) != 2 || cands.afters[0] != nil || cands.afters[1] == nil || cands.afters[1].FileID != 11 {
-		t.Errorf("keyset cursors = %+v, want nil then file 11", cands.afters)
+	if afters := cands.afters[markers.MarkerKindIntro]; len(afters) != 2 || afters[0] != nil || afters[1] == nil || afters[1].FileID != 11 {
+		t.Errorf("intro keyset cursors = %+v, want nil then file 11", afters)
 	}
 	if prog.data == nil {
 		t.Error("expected result summary data")
 	}
 }
 
+// Intros are shared before credits, and each pass asks a file only for its
+// own segment, so a file whose intro was shared reports nothing for it again.
+func TestContributeMarkersTaskSharesIntrosBeforeCredits(t *testing.T) {
+	runner := &fakeContribRunner{outcomes: []markers.ContributionOutcome{{Status: markers.SubmissionStatusPending}}}
+	cands := &fakeCandidates{ids: []int{10}, credits: []int{12, 10}}
+	cfg := fakeAutoConfig{{Provider: "introdb", ContributeEnabled: true, ContributeAutoLocal: true}}
+	task := NewContributeMarkersTask(runner, cfg, cands, fakeFileLoader{})
+
+	prog := &contribTestProgress{}
+	if err := task.Execute(context.Background(), prog); err != nil {
+		t.Fatalf("Execute: %v", err)
+	}
+	if fmt.Sprint(runner.calls) != "[10 12 10]" {
+		t.Fatalf("calls = %v, want file 10's intro, then the credits of files 12 and 10", runner.calls)
+	}
+	intro, credits := []markers.MarkerKind{markers.MarkerKindIntro}, []markers.MarkerKind{markers.MarkerKindCredits}
+	if want := [][]markers.MarkerKind{intro, credits, credits}; fmt.Sprint(runner.segments) != fmt.Sprint(want) {
+		t.Fatalf("segments = %v, want %v", runner.segments, want)
+	}
+	var data map[string]int
+	if err := json.Unmarshal(prog.data, &data); err != nil {
+		t.Fatalf("decode result data: %v", err)
+	}
+	if data["submitted"] != 3 || data["skipped"] != 0 {
+		t.Fatalf("result = %v, want three submissions and no skips", data)
+	}
+}
+
 func TestContributeMarkersTaskStopsOnUsageLimit(t *testing.T) {
 	runner := &fakeContribRunner{outcomes: []markers.ContributionOutcome{{
 		Status: markers.OutcomeStatusRateLimited, RetryAfter: 20 * time.Hour,
@@ -136,6 +180,9 @@ func TestContributeMarkersTaskStopsOnUsageLimit(t *testing.T) {
 	if len(runner.calls) != 1 {
 		t.Fatalf("expected task to stop after rate limit, calls=%d", len(runner.calls))
 	}
+	if len(cands.kinds) != 1 || cands.kinds[0] != markers.MarkerKindIntro {
+		t.Fatalf("candidate passes = %v, want the run to end in the intro pass", cands.kinds)
+	}
 	var data map[string]int
 	if err := json.Unmarshal(prog.data, &data); err != nil {
 		t.Fatalf("decode result data: %v", err)
diff --git a/internal/taskmanager/tasks/refresh_seasonal_lists.go b/internal/taskmanager/tasks/refresh_seasonal_lists.go
new file mode 100644
index 0000000000..b73754a719
--- /dev/null
+++ b/internal/taskmanager/tasks/refresh_seasonal_lists.go
@@ -0,0 +1,56 @@
+package tasks
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/prairie-server/prairie-server/internal/taskmanager"
+)
+
+// RefreshSeasonalListsTask downloads the MDBList lists seasonal home rows show
+// now or in the next two weeks. Satisfied by *sections.SeasonalListRefresher.
+type RefreshSeasonalListsTask struct {
+	refresher TrendingDiscoverRefresher
+}
+
+// NewRefreshSeasonalListsTask creates a new RefreshSeasonalListsTask.
+func NewRefreshSeasonalListsTask(refresher TrendingDiscoverRefresher) *RefreshSeasonalListsTask {
+	return &RefreshSeasonalListsTask{refresher: refresher}
+}
+
+func (t *RefreshSeasonalListsTask) Key() string  { return "refresh_seasonal_lists" }
+func (t *RefreshSeasonalListsTask) Name() string { return "Refresh Seasonal Lists" }
+func (t *RefreshSeasonalListsTask) Description() string {
+	return "Downloads the curated MDBList lists behind Seasonal Picks home rows ahead of each holiday"
+}
+
+func (t *RefreshSeasonalListsTask) Category() taskmanager.TaskCategory {
+	return taskmanager.TaskCategoryLibrary
+}
+
+func (t *RefreshSeasonalListsTask) IsHidden() bool { return true }
+
+func (t *RefreshSeasonalListsTask) DefaultTriggers() []taskmanager.TriggerConfig {
+	return []taskmanager.TriggerConfig{
+		{Type: taskmanager.TriggerTypeStartup},
+		// Lists younger than a day are skipped, so most runs fetch nothing.
+		{Type: taskmanager.TriggerTypeInterval, IntervalMs: 6 * 60 * 60 * 1000},
+	}
+}
+
+func (t *RefreshSeasonalListsTask) Execute(ctx context.Context, progress taskmanager.ProgressReporter) error {
+	progress.Report(0, "Refreshing seasonal lists")
+	if t.refresher == nil {
+		return errors.New("seasonal list refresh: refresher not configured")
+	}
+	resultData, err := t.refresher.RunOnce(ctx)
+	if resultData != nil {
+		progress.SetResultData(resultData)
+	}
+	if err != nil {
+		return fmt.Errorf("seasonal list refresh: %w", err)
+	}
+	progress.Report(100, "Seasonal list refresh complete")
+	return nil
+}
diff --git a/internal/taskmanager/tasks/refresh_trending_discover.go b/internal/taskmanager/tasks/refresh_trending_discover.go
index 839fcb305f..8f91ee2319 100644
--- a/internal/taskmanager/tasks/refresh_trending_discover.go
+++ b/internal/taskmanager/tasks/refresh_trending_discover.go
@@ -30,7 +30,7 @@ func NewRefreshTrendingDiscoverTask(refresher TrendingDiscoverRefresher) *Refres
 func (t *RefreshTrendingDiscoverTask) Key() string  { return "refresh_trending_discover" }
 func (t *RefreshTrendingDiscoverTask) Name() string { return "Refresh Trending Discover" }
 func (t *RefreshTrendingDiscoverTask) Description() string {
-	return "Refreshes the persisted external trending lists (TMDB/Trakt) for Trending Discover home sections and the calendar's Trending view"
+	return "Refreshes the persisted external trending lists (TMDB) for Trending Discover home sections and the calendar's Trending view"
 }
 
 func (t *RefreshTrendingDiscoverTask) Category() taskmanager.TaskCategory {
diff --git a/internal/taskmanager/tasks/release_stored_artwork.go b/internal/taskmanager/tasks/release_stored_artwork.go
new file mode 100644
index 0000000000..12ca01ed37
--- /dev/null
+++ b/internal/taskmanager/tasks/release_stored_artwork.go
@@ -0,0 +1,72 @@
+package tasks
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/prairie-server/prairie-server/internal/metadata"
+	"github.com/prairie-server/prairie-server/internal/taskmanager"
+)
+
+// StoredArtworkReleaseRunner is the release surface. Satisfied by
+// *metadata.StoredArtworkReleaser.
+type StoredArtworkReleaseRunner interface {
+	CachingOff(ctx context.Context) (bool, error)
+	Run(ctx context.Context) (metadata.StoredArtworkReleaseStats, error)
+}
+
+// ReleaseStoredArtworkTask moves stored artwork back to its providers while
+// metadata.cache_images is off; see metadata.StoredArtworkReleaser. It runs at
+// startup, daily, and when the setting is turned off, and does nothing while
+// caching is on.
+type ReleaseStoredArtworkTask struct {
+	runner StoredArtworkReleaseRunner
+}
+
+func NewReleaseStoredArtworkTask(runner StoredArtworkReleaseRunner) *ReleaseStoredArtworkTask {
+	return &ReleaseStoredArtworkTask{runner: runner}
+}
+
+// ReleaseStoredArtworkTaskKey is the task's key.
+const ReleaseStoredArtworkTaskKey = "release_stored_artwork"
+
+func (t *ReleaseStoredArtworkTask) Key() string  { return ReleaseStoredArtworkTaskKey }
+func (t *ReleaseStoredArtworkTask) Name() string { return "Release Stored Artwork" }
+func (t *ReleaseStoredArtworkTask) Description() string {
+	return "While provider artwork is not saved to storage, points stored artwork back at its providers and queues refreshes for artwork only a provider can replace"
+}
+func (t *ReleaseStoredArtworkTask) Category() taskmanager.TaskCategory {
+	return taskmanager.TaskCategoryMetadata
+}
+func (t *ReleaseStoredArtworkTask) IsHidden() bool { return true }
+
+func (t *ReleaseStoredArtworkTask) DefaultTriggers() []taskmanager.TriggerConfig {
+	// Daily as well as at startup: a pass also undoes a copy a job still in
+	// flight published after the previous one, and picks up artwork a storage
+	// recovery cleared.
+	return []taskmanager.TriggerConfig{
+		{Type: taskmanager.TriggerTypeStartup},
+		{Type: taskmanager.TriggerTypeInterval, IntervalMs: int64(24 * time.Hour / time.Millisecond)},
+	}
+}
+
+// ShouldRun skips scheduled runs while caching is on.
+func (t *ReleaseStoredArtworkTask) ShouldRun(ctx context.Context) (bool, error) {
+	if t.runner == nil {
+		return false, nil
+	}
+	return t.runner.CachingOff(ctx)
+}
+
+func (t *ReleaseStoredArtworkTask) Execute(ctx context.Context, progress taskmanager.ProgressReporter) error {
+	if t.runner == nil {
+		return nil
+	}
+	stats, err := t.runner.Run(ctx)
+	if err != nil {
+		return err
+	}
+	progress.Report(100, fmt.Sprintf("Released %d, queued %d refreshes", stats.Released, stats.RefreshesQueued))
+	return nil
+}
diff --git a/internal/taskmanager/tasks/sync_user_collections.go b/internal/taskmanager/tasks/sync_user_collections.go
index a8500775b0..0474020de9 100644
--- a/internal/taskmanager/tasks/sync_user_collections.go
+++ b/internal/taskmanager/tasks/sync_user_collections.go
@@ -18,7 +18,7 @@ func NewSyncUserCollectionsTask(scheduler CollectionSyncRunner) *SyncUserCollect
 func (t *SyncUserCollectionsTask) Key() string  { return "sync_user_collections" }
 func (t *SyncUserCollectionsTask) Name() string { return "Sync User Collections" }
 func (t *SyncUserCollectionsTask) Description() string {
-	return "Refreshes profile-owned imported collections (TMDB, Trakt, MDBList) on their schedule"
+	return "Refreshes profile-owned imported collections (TMDB, MDBList) on their schedule"
 }
 func (t *SyncUserCollectionsTask) Category() taskmanager.TaskCategory {
 	return taskmanager.TaskCategoryLibrary
diff --git a/internal/themesongs/repository_test.go b/internal/themesongs/repository_test.go
index b73d19bd38..609e9b02ab 100644
--- a/internal/themesongs/repository_test.go
+++ b/internal/themesongs/repository_test.go
@@ -170,7 +170,7 @@ func TestRepositoryInheritanceRematchingAndAccess(t *testing.T) {
 	newSeries := series + "-new"
 	for _, id := range []string{series, newSeries} {
 		exec(`INSERT INTO media_items(content_id,type,title) VALUES($1,'series','Theme test')`, id)
-		defer func() { _, _ = pool.Exec(ctx, `DELETE FROM media_items WHERE content_id=$1`, id) }()
+		defer func() { _, _ = pool.Exec(ctx, `DELETE FROM media_items WHERE content_id=$1`, id) }() //nolint:gocritic,revive // each fixture row is removed when the test returns
 		exec(`INSERT INTO media_item_libraries(content_id,media_folder_id) VALUES($1,$2)`, id, folder)
 	}
 	exec(`INSERT INTO seasons(content_id,series_id,season_number) VALUES($1,$2,1)`, season, series)
diff --git a/internal/titleutil/provisional.go b/internal/titleutil/provisional.go
new file mode 100644
index 0000000000..e88c4c42e6
--- /dev/null
+++ b/internal/titleutil/provisional.go
@@ -0,0 +1,10 @@
+package titleutil
+
+import "strings"
+
+// IsProvisionalEpisodeTitle reports whether title is a provider placeholder
+// ("TBA"/"TBD") that stands in until the real episode title is announced.
+func IsProvisionalEpisodeTitle(title string) bool {
+	title = strings.TrimSpace(title)
+	return strings.EqualFold(title, "tba") || strings.EqualFold(title, "tbd")
+}
diff --git a/internal/titleutil/provisional_test.go b/internal/titleutil/provisional_test.go
new file mode 100644
index 0000000000..3e77159d8a
--- /dev/null
+++ b/internal/titleutil/provisional_test.go
@@ -0,0 +1,11 @@
+package titleutil
+
+import "testing"
+
+func TestIsProvisionalEpisodeTitle(t *testing.T) {
+	for title, want := range map[string]bool{"TBA": true, " tbd ": true, "Pilot": false, "": false} {
+		if got := IsProvisionalEpisodeTitle(title); got != want {
+			t.Errorf("IsProvisionalEpisodeTitle(%q) = %v, want %v", title, got, want)
+		}
+	}
+}
diff --git a/internal/tonemap/preflight.go b/internal/tonemap/preflight.go
index 685abea2f8..58b77c17c0 100644
--- a/internal/tonemap/preflight.go
+++ b/internal/tonemap/preflight.go
@@ -532,7 +532,7 @@ func sourceConversionPreflightFilter(request SourcePreflightRequest) string {
 		filter = "format=nv12,hwupload," + filter
 	}
 	if request.Backend == BackendQSV {
-		filter = QSVFilter(request.Kind) + "," + QSVInteropFilter()
+		filter = QSVFilter(request.Kind, 0) + "," + QSVInteropFilter()
 		if request.SoftwareVideoDecode {
 			format := "nv12"
 			if !IsSDRSource(request.Kind) {
diff --git a/internal/tonemap/probe.go b/internal/tonemap/probe.go
index c3b4f4bb53..1c32665471 100644
--- a/internal/tonemap/probe.go
+++ b/internal/tonemap/probe.go
@@ -548,7 +548,11 @@ func hasToken(output []byte, token string) bool {
 func hardwareProbeAvailable(backend string, filters, encoders []byte) bool {
 	switch backend {
 	case BackendQSV:
-		return hasToken(filters, HardwareFilterOpenCL) && hasToken(filters, "hwmap") && hasToken(filters, "scale_vaapi") && hasToken(encoders, "h264_qsv")
+		// Bitmap subtitle burn-in on HDR sources composites and scales on
+		// OpenCL, so a build without those filters falls back to software
+		// tone mapping instead of failing at transcode start.
+		return hasToken(filters, HardwareFilterOpenCL) && hasToken(filters, "hwmap") && hasToken(filters, "scale_vaapi") &&
+			hasToken(filters, "overlay_opencl") && hasToken(filters, "scale_opencl") && hasToken(encoders, "h264_qsv")
 	case BackendVAAPI:
 		return hasToken(filters, HardwareFilterVAAPI) && hasToken(filters, "scale_vaapi") && hasToken(encoders, "h264_vaapi")
 	case BackendNVENC:
@@ -654,7 +658,7 @@ func hardwareSmokeFilter(backend string, kind SourceKind, sourceVideoBitDepth in
 	}
 	filter := VAAPIFilter(kind)
 	if backend == BackendQSV {
-		filter = QSVFilter(kind) + "," + QSVInteropFilter()
+		filter = QSVFilter(kind, 0) + "," + QSVInteropFilter()
 	}
 	return filter + "," + HDRMetadataRemovalFilter()
 }
diff --git a/internal/tonemap/probe_test.go b/internal/tonemap/probe_test.go
index 3f2c68afd6..19dd57821e 100644
--- a/internal/tonemap/probe_test.go
+++ b/internal/tonemap/probe_test.go
@@ -162,6 +162,19 @@ func TestVideoToolboxListingGateRequiresCompletePipeline(t *testing.T) {
 	}
 }
 
+func TestQSVListingGateRequiresOpenCLBitmapSubtitleFilters(t *testing.T) {
+	filters := "tonemap_opencl hwmap scale_vaapi"
+	encoders := []byte("h264_qsv")
+	if !hardwareProbeAvailable(BackendQSV, []byte(filters+" overlay_opencl scale_opencl"), encoders) {
+		t.Fatal("complete QSV pipeline was not accepted")
+	}
+	for _, missing := range []string{" scale_opencl", " overlay_opencl"} {
+		if hardwareProbeAvailable(BackendQSV, []byte(filters+missing), encoders) {
+			t.Fatalf("QSV pipeline with only%s was accepted", missing)
+		}
+	}
+}
+
 // TestProbeTotalTimeoutCoversBoundedCommandMatrix verifies the deadline covers every possible probe command.
 func TestProbeTotalTimeoutCoversBoundedCommandMatrix(t *testing.T) {
 	tests := []struct {
@@ -627,7 +640,7 @@ func TestProbeSmokesDolbyVisionOnlyOnRPUExecutors(t *testing.T) {
 		wantSoftware bool
 		wantHardware bool
 	}{
-		{name: "tonemapx and QSV OpenCL", backend: BackendQSV, filters: " .S. zscale V->V\n .S. tonemapx V->V\n .S. sidedata V->V\n .S. tonemap_opencl V->V\n .S. hwmap V->V\n .S. scale_vaapi V->V\n", encoders: "libx264 h264_qsv", wantSoftware: true, wantHardware: true},
+		{name: "tonemapx and QSV OpenCL", backend: BackendQSV, filters: " .S. zscale V->V\n .S. tonemapx V->V\n .S. sidedata V->V\n .S. tonemap_opencl V->V\n .S. hwmap V->V\n .S. scale_vaapi V->V\n .S. overlay_opencl VV->V\n .S. scale_opencl V->V\n", encoders: "libx264 h264_qsv", wantSoftware: true, wantHardware: true},
 		{name: "tonemapx and NVENC CUDA", backend: BackendNVENC, filters: " .S. zscale V->V\n .S. tonemapx V->V\n .S. sidedata V->V\n .S. tonemap_cuda V->V\n .S. scale_cuda V->V\n", encoders: "libx264 h264_nvenc", wantSoftware: true, wantHardware: true},
 		{name: "Hable and VAAPI", backend: BackendVAAPI, filters: " .S. zscale V->V\n .S. tonemap V->V\n .S. sidedata V->V\n .S. tonemap_vaapi V->V\n .S. scale_vaapi V->V\n", encoders: "libx264 h264_vaapi"},
 		{name: "tonemapx and VideoToolbox", backend: BackendVideoToolbox, filters: " .S. zscale V->V\n .S. tonemapx V->V\n .S. sidedata V->V\n .S. scale_vt V->V\n .S. hwdownload V->V\n", encoders: "libx264 h264_videotoolbox", wantSoftware: true},
diff --git a/internal/tonemap/tonemap.go b/internal/tonemap/tonemap.go
index 4c7f66960f..2449d82032 100644
--- a/internal/tonemap/tonemap.go
+++ b/internal/tonemap/tonemap.go
@@ -6,6 +6,7 @@ import (
 	"bytes"
 	"cmp"
 	"slices"
+	"strconv"
 	"strings"
 
 	"github.com/prairie-server/prairie-server/internal/models"
@@ -237,7 +238,18 @@ func ResolveSource(source SourceMetadata) SourceResolution {
 	case DynamicRangeHDR10, DynamicRangeHDR10Plus:
 		candidate = SourcePQ
 	case DynamicRangeHLG:
+		// Cameras also record HLG with BT.709 primaries. Declaring those as
+		// BT.2020 oversaturates the conversion, and their decoded frames fail
+		// the source preflight. SourceHLGBT709 declares a BT.709 matrix too,
+		// while its preflight also accepts BT.2020-matrix frames, so it needs
+		// both tags. Any other mix keeps the BT.2020 kind, whose preflight
+		// rejects it rather than decoding it with the wrong matrix.
+		primaries := normalizeColorValue(source.ColorPrimaries)
+		matrix := normalizeColorValue(source.ColorSpace)
 		candidate = SourceHLG
+		if colorIsBT709(primaries) && colorIsBT709(matrix) {
+			candidate = SourceHLGBT709
+		}
 	case DynamicRangeDolbyVision:
 		// Legacy rows omit the presence facts, so their default zero values
 		// cannot establish a base layer.
@@ -606,7 +618,7 @@ func SoftwareFilter(kind SourceKind, filterName string) string {
 	}
 	if filterName == SoftwareFilterBT2390 {
 		return SourceParameters(kind) +
-			",tonemapx=tonemap=bt2390" + dolbyVisionOption(kind) +
+			",tonemapx=tonemap=bt2390" + toneMapPeakOption + dolbyVisionOption(kind) +
 			",zscale=p=bt709:t=bt709:m=bt709:r=tv,format=yuv420p," + HDRMetadataRemovalFilter()
 	}
 	return SourceParameters(kind) +
@@ -652,26 +664,63 @@ func VAAPIFilter(kind SourceKind) string {
 	return SourceParameters(kind) + "," + vaapiToneMapFilter()
 }
 
-// QSVFilter builds the Intel HDR-to-SDR conversion graph. Intel's VAAPI/VPP
-// tone mapper can severely crush midtones on otherwise valid PQ sources, so
-// HDR frames take Jellyfin FFmpeg's GPU OpenCL path and return to the VAAPI
-// surface family before the existing QSV encoder interop. SDR base layers only
-// need color conversion and retain the cheaper VAAPI path.
-func QSVFilter(kind SourceKind) string {
+// QSVFilter builds the Intel HDR-to-SDR conversion graph, scaled to height
+// (0 keeps the source size). Intel's VAAPI/VPP tone mapper can severely crush
+// midtones on otherwise valid PQ sources, so HDR frames take Jellyfin FFmpeg's
+// GPU OpenCL path and return to the VAAPI surface family before the existing
+// QSV encoder interop. SDR base layers only need color conversion and retain
+// the cheaper VAAPI path.
+//
+// HDR frames are scaled before tone mapping, never after. A VAAPI filter that
+// reads the OpenCL output releases the surface back to the tone mapper's pool
+// without waiting for the GPU, and on Intel Arrow Lake (iHD 26.3, jellyfin-ffmpeg
+// 8.1.3) the scaled frames then came out with blocks of the next frame during
+// motion, although the OpenCL interop should order that access itself. Passing
+// the surface straight to the encoder, which holds it until the encode
+// completes, avoids it.
+func QSVFilter(kind SourceKind, height int) string {
 	if IsSDRSource(kind) {
-		return VAAPIFilter(kind)
+		filter := VAAPIFilter(kind)
+		if height > 0 {
+			filter += ",scale_vaapi=w=-2:h=" + strconv.Itoa(height) + ":format=nv12"
+		}
+		return filter
+	}
+	return QSVOpenCLToneMapFilter(kind, height) + "," + QSVOpenCLReturnFilter()
+}
+
+// QSVOpenCLToneMapFilter is the HDR part of QSVFilter that ends with the
+// tone-mapped frame still on the OpenCL device, for graphs that composite onto
+// it there. QSVOpenCLReturnFilter then hands it back to VAAPI.
+func QSVOpenCLToneMapFilter(kind SourceKind, height int) string {
+	size := ""
+	if height > 0 {
+		size = "w=-2:h=" + strconv.Itoa(height) + ":"
 	}
 	return SourceParameters(kind) +
-		",scale_vaapi=format=p010" +
+		",scale_vaapi=" + size + "format=p010" +
 		",hwmap=derive_device=opencl:mode=read" +
-		"," + openCLToneMapFilter(kind) +
-		",hwmap=derive_device=vaapi:mode=write:reverse=1:extra_hw_frames=16,format=vaapi"
+		"," + openCLToneMapFilter(kind)
+}
+
+// QSVOpenCLReturnFilter hands OpenCL frames back to VAAPI: the reverse hwmap
+// makes the filter before it render into VAAPI surfaces, so that filter must
+// allocate its output frames rather than pass its input through. Before a QSV
+// encode only QSVInteropFilter may follow it.
+func QSVOpenCLReturnFilter() string {
+	return "hwmap=derive_device=vaapi:mode=write:reverse=1:extra_hw_frames=16,format=vaapi"
 }
 
-// openCLToneMapFilter matches Jellyfin's BT.2390 GPU recipe. A fixed 100-nit
-// SDR peak keeps output stable across sources while preserving PQ midtones.
+// toneMapPeakOption pins the source peak tonemapx and tonemap_opencl map to
+// SDR at 1000 nits (the option counts in tens of nits), so every source
+// converts on the same curve. Left unset, both filters read a Dolby Vision
+// frame's peak from its RPU instead, and a title mastered at 4000 nits comes
+// out about a third darker in the midtones.
+const toneMapPeakOption = ":peak=100"
+
+// openCLToneMapFilter matches Jellyfin's BT.2390 GPU recipe.
 func openCLToneMapFilter(kind SourceKind) string {
-	return HardwareFilterOpenCL + "=format=nv12:p=bt709:t=bt709:m=bt709:tonemap=bt2390:peak=100:desat=0" + dolbyVisionOption(kind)
+	return HardwareFilterOpenCL + "=format=nv12:p=bt709:t=bt709:m=bt709:tonemap=bt2390" + toneMapPeakOption + ":desat=0" + dolbyVisionOption(kind)
 }
 
 // vaapiToneMapFilter returns the HDR luminance and color conversion stage.
@@ -736,6 +785,9 @@ func videoToolboxSurfacePixelFormat(sourceVideoBitDepth int) string {
 // QSV encoder surface. The extra scale_vaapi stage is required by Intel's
 // driver for real decoded HEVC frames even when tonemap_vaapi already emitted
 // NV12; omitting it leaves FFmpeg trying an unsupported software auto-scale.
+// After the OpenCL tone mapper its scale_vaapi must stay a passthrough, with
+// no size or color options, so no VAAPI filter reads the OpenCL output (see
+// QSVFilter).
 func QSVInteropFilter() string {
 	return "scale_vaapi=format=nv12,hwmap=derive_device=qsv:mode=read+write,format=qsv"
 }
diff --git a/internal/tonemap/tonemap_test.go b/internal/tonemap/tonemap_test.go
index fac32534f9..5b35735982 100644
--- a/internal/tonemap/tonemap_test.go
+++ b/internal/tonemap/tonemap_test.go
@@ -91,6 +91,38 @@ func TestResolveSourceClassifiesDolbyOnlyAndPreflightsAmbiguousMetadata(t *testi
 	}
 }
 
+// TestResolveSourceClassifiesHLGByPrimaries verifies an HLG source tagged
+// with BT.709 primaries and matrix converts as BT.709 without a preflight,
+// while missing or mixed tags keep the BT.2020 kind and its preflight.
+func TestResolveSourceClassifiesHLGByPrimaries(t *testing.T) {
+	tests := []struct {
+		name          string
+		primaries     string
+		matrix        string
+		want          SourceKind
+		wantPreflight bool
+	}{
+		{name: "BT.2020 primaries", primaries: "bt2020", matrix: "bt2020nc", want: SourceHLG},
+		{name: "BT.709 primaries", primaries: "bt709", matrix: "bt709", want: SourceHLGBT709},
+		{name: "BT.709 primaries with untagged matrix", primaries: "bt709", matrix: "", want: SourceHLG, wantPreflight: true},
+		{name: "BT.709 primaries with BT.2020 matrix", primaries: "bt709", matrix: "bt2020nc", want: SourceHLG, wantPreflight: true},
+		{name: "BT.709 primaries with BT.601 matrix", primaries: "bt709", matrix: "smpte170m", want: SourceHLG, wantPreflight: true},
+		{name: "untagged primaries", primaries: "", matrix: "bt2020nc", want: SourceHLG, wantPreflight: true},
+		{name: "unknown primaries", primaries: "unknown", matrix: "bt709", want: SourceHLG, wantPreflight: true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := ResolveSource(SourceMetadata{
+				DynamicRange: DynamicRangeHLG,
+				ColorRange:   "tv", ColorPrimaries: tt.primaries, ColorTransfer: ColorTransferHLG, ColorSpace: tt.matrix,
+			})
+			if got.Kind != tt.want || got.PreflightRequired != tt.wantPreflight {
+				t.Fatalf("ResolveSource() = %#v, want kind %q preflight %t", got, tt.want, tt.wantPreflight)
+			}
+		})
+	}
+}
+
 // TestPolicyKeepsHardwareAndSoftwareIndependent verifies each executor can be enabled separately.
 func TestPolicyKeepsHardwareAndSoftwareIndependent(t *testing.T) {
 	tests := []struct {
@@ -116,7 +148,7 @@ func TestProbeAdvertisesOnlySuccessfulSourceKinds(t *testing.T) {
 		joined := strings.Join(args, " ")
 		switch {
 		case slices.Contains(args, "-filters"):
-			return []byte(" .S. sidedata V->V\n .S. zscale V->V\n .S. tonemap V->V\n .S. tonemapx V->V\n .S. tonemap_opencl V->V\n .S. hwmap V->V\n .S. scale_vaapi V->V\n"), nil
+			return []byte(" .S. sidedata V->V\n .S. zscale V->V\n .S. tonemap V->V\n .S. tonemapx V->V\n .S. tonemap_opencl V->V\n .S. hwmap V->V\n .S. scale_vaapi V->V\n .S. overlay_opencl VV->V\n .S. scale_opencl V->V\n"), nil
 		case slices.Contains(args, "-encoders"):
 			return []byte("libx264 h264_qsv"), nil
 		case strings.Contains(joined, "libx264"):
@@ -144,7 +176,7 @@ func TestProbeValidatesEveryConfiguredHardwareDevice(t *testing.T) {
 		joined := strings.Join(args, " ")
 		switch {
 		case slices.Contains(args, "-filters"):
-			return []byte(" .S. tonemap_opencl V->V\n .S. hwmap V->V\n .S. scale_vaapi V->V\n"), nil
+			return []byte(" .S. tonemap_opencl V->V\n .S. hwmap V->V\n .S. scale_vaapi V->V\n .S. overlay_opencl VV->V\n .S. scale_opencl V->V\n"), nil
 		case slices.Contains(args, "-encoders"):
 			return []byte("h264_qsv"), nil
 		case strings.Contains(joined, "renderD129"):
@@ -172,11 +204,11 @@ func TestFiltersDeclareBT709Output(t *testing.T) {
 	for name, filter := range map[string]string{
 		"software pq":  SoftwareFilter(SourcePQ, "tonemapx"),
 		"software hlg": SoftwareFilter(SourceHLG, "tonemap"),
-		"qsv":          QSVFilter(SourcePQ),
+		"qsv":          QSVFilter(SourcePQ, 0),
 		"vaapi":        VAAPIFilter(SourcePQ),
 		"cuda":         CUDAFilter(SourcePQ),
 		"software dv":  SoftwareFilter(SourceDolbyVision, SoftwareFilterBT2390),
-		"qsv dv":       QSVFilter(SourceDolbyVision),
+		"qsv dv":       QSVFilter(SourceDolbyVision, 0),
 		"cuda dv":      CUDAFilter(SourceDolbyVision),
 	} {
 		t.Run(name, func(t *testing.T) {
@@ -210,13 +242,52 @@ func TestSoftwareFiltersUseThePixelFormatExpectedByEachToneMapper(t *testing.T)
 	}
 }
 
+// TestQSVFilterScalesHDRBeforeOpenCL checks where QSVFilter places the resize:
+// before the OpenCL tone mapper for HDR kinds, after color conversion for SDR
+// bases, and nowhere when the height is 0.
+func TestQSVFilterScalesHDRBeforeOpenCL(t *testing.T) {
+	hdr := QSVFilter(SourcePQ, 720)
+	resize := strings.Index(hdr, "scale_vaapi=w=-2:h=720:format=p010")
+	if resize < 0 || resize > strings.Index(hdr, HardwareFilterOpenCL) {
+		t.Fatalf("HDR QSV filter %q does not resize before tone mapping", hdr)
+	}
+	if sdr := QSVFilter(SourceSDRBT2020, 720); !strings.HasSuffix(sdr, ",scale_vaapi=w=-2:h=720:format=nv12") {
+		t.Fatalf("SDR QSV filter %q does not resize after color conversion", sdr)
+	}
+	for _, kind := range []SourceKind{SourcePQ, SourceSDRBT2020} {
+		if filter := QSVFilter(kind, 0); strings.Contains(filter, "scale_vaapi=w=") {
+			t.Fatalf("unscaled %s QSV filter %q resizes", kind, filter)
+		}
+	}
+}
+
+// TestSoftwareAndQSVToneMapsPinTheSourcePeak keeps tonemapx on the source
+// peak the QSV graph uses. Without it tonemapx reads a Dolby Vision frame's
+// peak from the RPU and darkens sources mastered above 1000 nits.
+func TestSoftwareAndQSVToneMapsPinTheSourcePeak(t *testing.T) {
+	for _, kind := range AllSourceKinds() {
+		if IsSDRSource(kind) {
+			continue
+		}
+		for name, filter := range map[string]string{
+			"software": SoftwareFilter(kind, SoftwareFilterBT2390),
+			"qsv":      QSVFilter(kind, 0),
+		} {
+			options := strings.FieldsFunc(filter, func(r rune) bool { return r == ',' || r == ':' })
+			if !slices.Contains(options, "peak=100") {
+				t.Errorf("%s %s filter %q does not pin the source peak", name, kind, filter)
+			}
+		}
+	}
+}
+
 // TestDolbyVisionGraphsApplyTheRPU pins RPU application to the Dolby Vision
 // kind: standard bases keep their validated graphs, and only filters that can
 // apply an RPU may carry the kind.
 func TestDolbyVisionGraphsApplyTheRPU(t *testing.T) {
 	for name, filter := range map[string]string{
 		"software": SoftwareFilter(SourceDolbyVision, SoftwareFilterBT2390),
-		"qsv":      QSVFilter(SourceDolbyVision),
+		"qsv":      QSVFilter(SourceDolbyVision, 0),
 		"cuda":     CUDAFilter(SourceDolbyVision),
 	} {
 		if !strings.Contains(filter, "apply_dovi=1") {
@@ -225,7 +296,7 @@ func TestDolbyVisionGraphsApplyTheRPU(t *testing.T) {
 	}
 	for name, filter := range map[string]string{
 		"software": SoftwareFilter(SourcePQ, SoftwareFilterBT2390),
-		"qsv":      QSVFilter(SourcePQ),
+		"qsv":      QSVFilter(SourcePQ, 0),
 	} {
 		if strings.Contains(filter, "apply_dovi") {
 			t.Errorf("%s PQ filter %q changed its Dolby Vision handling", name, filter)
diff --git a/internal/transcodenode/capability_client.go b/internal/transcodenode/capability_client.go
index 47f8c4a1f1..4f0084d184 100644
--- a/internal/transcodenode/capability_client.go
+++ b/internal/transcodenode/capability_client.go
@@ -8,6 +8,7 @@ import (
 	"net/http"
 	"strings"
 
+	"github.com/prairie-server/prairie-server/internal/nodeauth"
 	"github.com/prairie-server/prairie-server/internal/telemetry"
 
 	"github.com/prairie-server/prairie-server/internal/logredact"
@@ -42,7 +43,9 @@ func FetchHWCapabilitiesPayload(ctx context.Context, baseClient *http.Client, no
 	if err != nil {
 		return playback.HWAccelInfo{}, nil, 0, logredact.SanitizeURLError(err)
 	}
-	request.Header.Set("Authorization", "Bearer "+jwtSecret)
+	if err := nodeauth.Sign(request, nodeURL, jwtSecret); err != nil {
+		return playback.HWAccelInfo{}, nil, 0, err
+	}
 
 	if baseClient == nil {
 		baseClient = http.DefaultClient
diff --git a/internal/transcodenode/capability_snapshot_test.go b/internal/transcodenode/capability_snapshot_test.go
index 8397839d33..49b7f46359 100644
--- a/internal/transcodenode/capability_snapshot_test.go
+++ b/internal/transcodenode/capability_snapshot_test.go
@@ -11,6 +11,7 @@ import (
 	"testing"
 
 	"github.com/prairie-server/prairie-server/internal/config"
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 	"github.com/prairie-server/prairie-server/internal/nodeconfig"
 	"github.com/prairie-server/prairie-server/internal/playback"
 )
@@ -79,7 +80,7 @@ func TestHWCapabilitiesPublishesCapabilityHash(t *testing.T) {
 	server.nodeRowID = func() (int, bool) { return 42, true }
 
 	request := httptest.NewRequest(http.MethodGet, "/hw-capabilities", nil)
-	request.Header.Set("Authorization", "Bearer "+testSecret)
+	nodeauthtest.Sign(t, request, testSecret)
 	recorder := httptest.NewRecorder()
 	server.Handler().ServeHTTP(recorder, request)
 
@@ -99,6 +100,9 @@ func TestHWCapabilitiesPublishesCapabilityHash(t *testing.T) {
 	if !slices.Contains(info.TransportFeatures, playback.TransportFeatureProgressiveRemuxExecutionV1) {
 		t.Fatalf("transport features = %v, want progressive remux execution", info.TransportFeatures)
 	}
+	if !slices.Contains(info.TransportFeatures, playback.TransportFeatureHLSSubtitleRenditionV1) {
+		t.Fatalf("transport features = %v, want the HLS subtitle rendition", info.TransportFeatures)
+	}
 	// The hash must describe this payload, not some earlier one.
 	served := info
 	served.CapabilityHash = ""
@@ -114,7 +118,7 @@ func TestHWCapabilitiesWithholdsProgressiveRemuxWithoutNodeIdentity(t *testing.T
 	server := newTestServer(t)
 
 	request := httptest.NewRequest(http.MethodGet, "/hw-capabilities", nil)
-	request.Header.Set("Authorization", "Bearer "+testSecret)
+	nodeauthtest.Sign(t, request, testSecret)
 	recorder := httptest.NewRecorder()
 	server.Handler().ServeHTTP(recorder, request)
 
diff --git a/internal/transcodenode/drain_test.go b/internal/transcodenode/drain_test.go
index be8b3f88dc..395c2fc886 100644
--- a/internal/transcodenode/drain_test.go
+++ b/internal/transcodenode/drain_test.go
@@ -20,6 +20,7 @@ import (
 	"github.com/prairie-server/prairie-server/internal/chapterthumbs"
 	"github.com/prairie-server/prairie-server/internal/downloadprepare"
 	"github.com/prairie-server/prairie-server/internal/mediasample"
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 	"github.com/prairie-server/prairie-server/internal/nodepool"
 	"github.com/prairie-server/prairie-server/internal/noderouting"
 	"github.com/prairie-server/prairie-server/internal/nodesessions"
@@ -84,14 +85,15 @@ func stopSession(t *testing.T, s *Server, sessionID string) {
 	}
 	r := httptest.NewRequest(http.MethodDelete, "/transcode/"+sessionID, nil)
 	rr := httptest.NewRecorder()
-	s.Handler().ServeHTTP(rr, withBearer(r))
+	s.Handler().ServeHTTP(rr, signed(t, r))
 	if rr.Code >= 300 {
 		t.Fatalf("stop %s: status %d %s", sessionID, rr.Code, rr.Body.String())
 	}
 }
 
-func withBearer(r *http.Request) *http.Request {
-	r.Header.Set("Authorization", "Bearer "+testSecret)
+func signed(t *testing.T, r *http.Request) *http.Request {
+	t.Helper()
+	nodeauthtest.Sign(t, r, testSecret)
 	return r
 }
 
@@ -294,7 +296,7 @@ func TestDrainingNodeRefusesNewJobs(t *testing.T) {
 	} {
 		t.Run(test.name, func(t *testing.T) {
 			rr := httptest.NewRecorder()
-			handler.ServeHTTP(rr, withBearer(httptest.NewRequest(http.MethodPost, test.path, strings.NewReader(test.body))))
+			handler.ServeHTTP(rr, signed(t, httptest.NewRequest(http.MethodPost, test.path, strings.NewReader(test.body))))
 			if rr.Code != http.StatusServiceUnavailable || !strings.Contains(rr.Body.String(), test.reason) {
 				t.Fatalf("status %d body %q, want 503 carrying %q", rr.Code, rr.Body.String(), test.reason)
 			}
diff --git a/internal/transcodenode/media_sample_test.go b/internal/transcodenode/media_sample_test.go
index c8b7d4a091..5a437a96dc 100644
--- a/internal/transcodenode/media_sample_test.go
+++ b/internal/transcodenode/media_sample_test.go
@@ -14,6 +14,7 @@ import (
 	"time"
 
 	"github.com/prairie-server/prairie-server/internal/mediasample"
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 )
 
 func speechRequestBody(t *testing.T, mutate func(*mediasample.Request)) []byte {
@@ -33,10 +34,10 @@ func speechRequestBody(t *testing.T, mutate func(*mediasample.Request)) []byte {
 	return body
 }
 
-func postMediaSample(server *Server, body []byte, authorized bool) *httptest.ResponseRecorder {
+func postMediaSample(t *testing.T, server *Server, body []byte, authorized bool) *httptest.ResponseRecorder {
 	req := httptest.NewRequest(http.MethodPost, mediasample.RemotePath, bytes.NewReader(body))
 	if authorized {
-		req.Header.Set("Authorization", "Bearer "+testSecret)
+		nodeauthtest.Sign(t, req, testSecret)
 	}
 	rec := httptest.NewRecorder()
 	server.router().ServeHTTP(rec, req)
@@ -60,7 +61,7 @@ func TestMediaSampleRunsSpeechRequest(t *testing.T) {
 	}
 	server.watcher.Config().Playback.FFmpegPath = ffmpeg
 
-	rec := postMediaSample(server, speechRequestBody(t, nil), true)
+	rec := postMediaSample(t, server, speechRequestBody(t, nil), true)
 	if rec.Code != http.StatusOK {
 		t.Fatalf("status %d: %s", rec.Code, rec.Body)
 	}
@@ -100,7 +101,7 @@ func TestMediaSampleRefusals(t *testing.T) {
 			if tc.paths != nil {
 				server.inputPaths = tc.paths
 			}
-			rec := postMediaSample(server, tc.body, tc.authorized)
+			rec := postMediaSample(t, server, tc.body, tc.authorized)
 			if rec.Code != tc.status {
 				t.Fatalf("status %d, want %d: %s", rec.Code, tc.status, rec.Body)
 			}
@@ -121,7 +122,7 @@ func TestMediaSampleReportsSamplingFailure(t *testing.T) {
 		t.Fatal(err)
 	}
 	server.watcher.Config().Playback.FFmpegPath = ffmpeg
-	rec := postMediaSample(server, speechRequestBody(t, nil), true)
+	rec := postMediaSample(t, server, speechRequestBody(t, nil), true)
 	if rec.Code != http.StatusUnprocessableEntity {
 		t.Fatalf("status %d: %s", rec.Code, rec.Body)
 	}
@@ -185,7 +186,7 @@ func TestMediaSampleAdmitsConfiguredCapacity(t *testing.T) {
 	}
 	done := make(chan int, 2)
 	for range 2 {
-		go func() { done <- postMediaSample(server, speechRequestBody(t, nil), true).Code }()
+		go func() { done <- postMediaSample(t, server, speechRequestBody(t, nil), true).Code }()
 	}
 	deadline := time.Now().Add(10 * time.Second)
 	for started() == 0 && time.Now().Before(deadline) {
@@ -220,7 +221,7 @@ func TestMediaSampleRefusesWhenNoSlotFreesUp(t *testing.T) {
 	}
 	server.watcher.Config().Playback.FFmpegPath = ffmpeg
 	first := make(chan int, 1)
-	go func() { first <- postMediaSample(server, speechRequestBody(t, nil), true).Code }()
+	go func() { first <- postMediaSample(t, server, speechRequestBody(t, nil), true).Code }()
 	deadline := time.Now().Add(10 * time.Second)
 	for time.Now().Before(deadline) {
 		if matches, _ := filepath.Glob(filepath.Join(dir, "start.*")); len(matches) == 1 {
@@ -231,7 +232,7 @@ func TestMediaSampleRefusesWhenNoSlotFreesUp(t *testing.T) {
 
 	// The slot is held: the next request waits its admission time, then is
 	// refused as unavailable, which callers may run elsewhere.
-	rec := postMediaSample(server, speechRequestBody(t, nil), true)
+	rec := postMediaSample(t, server, speechRequestBody(t, nil), true)
 	var failure mediasample.RemoteFailure
 	if rec.Code != http.StatusServiceUnavailable || json.Unmarshal(rec.Body.Bytes(), &failure) != nil || failure.Reason != mediasample.ReasonNodeUnavailable {
 		t.Fatalf("over capacity: %d %s", rec.Code, rec.Body)
@@ -244,7 +245,7 @@ func TestMediaSampleRefusesWhenNoSlotFreesUp(t *testing.T) {
 	if code := <-first; code != http.StatusOK {
 		t.Fatalf("first run: %d", code)
 	}
-	if code := postMediaSample(server, speechRequestBody(t, nil), true).Code; code != http.StatusOK {
+	if code := postMediaSample(t, server, speechRequestBody(t, nil), true).Code; code != http.StatusOK {
 		t.Fatalf("after release: %d", code)
 	}
 }
diff --git a/internal/transcodenode/metrics_test.go b/internal/transcodenode/metrics_test.go
index fed5dd4963..6ccca37f00 100644
--- a/internal/transcodenode/metrics_test.go
+++ b/internal/transcodenode/metrics_test.go
@@ -119,7 +119,7 @@ func TestStatusIncludesResourceSample(t *testing.T) {
 }
 
 // Operators who scrape must get the same numbers the UI shows, without a
-// credential — the same posture the API listener's own /metrics has.
+// credential — the same posture as the main server's dedicated metrics listener.
 func TestMetricsEndpointIsMountedAndUnauthenticated(t *testing.T) {
 	server := newTestServer(t)
 	recorder := httptest.NewRecorder()
diff --git a/internal/transcodenode/node_auth_test.go b/internal/transcodenode/node_auth_test.go
new file mode 100644
index 0000000000..b2ebce6ac3
--- /dev/null
+++ b/internal/transcodenode/node_auth_test.go
@@ -0,0 +1,49 @@
+package transcodenode
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
+)
+
+// The node admits only requests signed for exactly the route they reach, plus
+// the previous release's bearer while a deployment upgrades.
+func TestNodeRoutesRequireASignatureForTheRequest(t *testing.T) {
+	server := newTestServer(t)
+	status := func(r *http.Request) int {
+		recorder := httptest.NewRecorder()
+		server.Handler().ServeHTTP(recorder, r)
+		return recorder.Code
+	}
+
+	signed := httptest.NewRequest(http.MethodGet, "/status", nil)
+	nodeauthtest.Sign(t, signed, testSecret)
+	if code := status(signed); code != http.StatusOK {
+		t.Fatalf("signed request: status %d, want 200", code)
+	}
+
+	if code := status(httptest.NewRequest(http.MethodGet, "/status", nil)); code != http.StatusUnauthorized {
+		t.Fatalf("unsigned request: status %d, want 401", code)
+	}
+
+	moved := httptest.NewRequest(http.MethodGet, "/hw-capabilities", nil)
+	moved.Header.Set("Authorization", signed.Header.Get("Authorization"))
+	if code := status(moved); code != http.StatusUnauthorized {
+		t.Fatalf("signature reused on another route: status %d, want 401", code)
+	}
+
+	otherSecret := httptest.NewRequest(http.MethodGet, "/status", nil)
+	nodeauthtest.Sign(t, otherSecret, "another-secret")
+	if code := status(otherSecret); code != http.StatusUnauthorized {
+		t.Fatalf("request signed with another secret: status %d, want 401", code)
+	}
+
+	// Remove with the legacy bearer in nodeauth.Verify.
+	legacy := httptest.NewRequest(http.MethodGet, "/status", nil)
+	legacy.Header.Set("Authorization", "Bearer "+testSecret)
+	if code := status(legacy); code != http.StatusOK {
+		t.Fatalf("legacy bearer during the upgrade window: status %d, want 200", code)
+	}
+}
diff --git a/internal/transcodenode/reprobe_test.go b/internal/transcodenode/reprobe_test.go
index 87cf5f0534..722c3362b4 100644
--- a/internal/transcodenode/reprobe_test.go
+++ b/internal/transcodenode/reprobe_test.go
@@ -11,13 +11,14 @@ import (
 	"testing"
 	"time"
 
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 	"github.com/prairie-server/prairie-server/internal/playback"
 )
 
 func postReprobe(t *testing.T, server *Server) *httptest.ResponseRecorder {
 	t.Helper()
 	request := httptest.NewRequest(http.MethodPost, "/admin/reprobe-capabilities", nil)
-	request.Header.Set("Authorization", "Bearer "+testSecret)
+	nodeauthtest.Sign(t, request, testSecret)
 	recorder := httptest.NewRecorder()
 	server.Handler().ServeHTTP(recorder, request)
 	return recorder
@@ -61,7 +62,7 @@ func TestReprobeCapabilitiesRecomputesAndStoresHash(t *testing.T) {
 	// The reported hash must describe the report the capability endpoint would
 	// now serve, or the API would refetch and store something else.
 	capabilityRequest := httptest.NewRequest(http.MethodGet, "/hw-capabilities", nil)
-	capabilityRequest.Header.Set("Authorization", "Bearer "+testSecret)
+	nodeauthtest.Sign(t, capabilityRequest, testSecret)
 	capabilityRecorder := httptest.NewRecorder()
 	server.Handler().ServeHTTP(capabilityRecorder, capabilityRequest)
 	if capabilityRecorder.Code != http.StatusOK {
@@ -210,7 +211,7 @@ func TestReloadConfigKeepsActiveSessions(t *testing.T) {
 	server.activeJobs.Store(1)
 
 	request := httptest.NewRequest(http.MethodPost, "/admin/reload-config", nil)
-	request.Header.Set("Authorization", "Bearer "+testSecret)
+	nodeauthtest.Sign(t, request, testSecret)
 	recorder := httptest.NewRecorder()
 	server.Handler().ServeHTTP(recorder, request)
 
diff --git a/internal/transcodenode/server.go b/internal/transcodenode/server.go
index 5e65e05879..92faee8b50 100644
--- a/internal/transcodenode/server.go
+++ b/internal/transcodenode/server.go
@@ -28,6 +28,7 @@ import (
 	"github.com/prairie-server/prairie-server/internal/downloadstorage"
 	"github.com/prairie-server/prairie-server/internal/httpstream"
 	"github.com/prairie-server/prairie-server/internal/mediasample"
+	"github.com/prairie-server/prairie-server/internal/nodeauth"
 	"github.com/prairie-server/prairie-server/internal/nodeconfig"
 	"github.com/prairie-server/prairie-server/internal/nodemetrics"
 	"github.com/prairie-server/prairie-server/internal/noderouting"
@@ -65,6 +66,7 @@ type TranscodeStartRequest struct {
 	VideoBitstreamFilter       string                 `json:"video_bitstream_filter,omitempty"`
 	VideoSampleEntry           string                 `json:"video_sample_entry,omitempty"`
 	CopyVideoMPEGTS            bool                   `json:"copy_video_mpegts,omitempty"`
+	KeyframePlaylist           bool                   `json:"keyframe_playlist,omitempty"`
 	SeekSeconds                float64                `json:"seek_seconds"`
 	StreamOriginSeconds        float64                `json:"stream_origin_seconds,omitempty"`
 	CopySeekAnchorResolved     bool                   `json:"copy_seek_anchor_resolved,omitempty"`
@@ -81,8 +83,12 @@ type TranscodeStartRequest struct {
 	SubtitleTrackIndex         int                    `json:"subtitle_track_index"`
 	SubtitleBurnIn             bool                   `json:"subtitle_burn_in"`
 	SubtitleCodec              string                 `json:"subtitle_codec,omitempty"`
-	TotalDuration              float64                `json:"total_duration"`
-	RequireReady               bool                   `json:"require_ready,omitempty"`
+	// SubtitleRendition asks the executor to emit the selected text track as
+	// the playlist's WebVTT subtitle rendition. Only nodes advertising
+	// playback.TransportFeatureHLSSubtitleRenditionV1 receive it.
+	SubtitleRendition bool    `json:"subtitle_rendition,omitempty"`
+	TotalDuration     float64 `json:"total_duration"`
+	RequireReady      bool    `json:"require_ready,omitempty"`
 	// AutoFallbackReady asks the node to wait for the first manifest only when
 	// its own hw_accel=auto fallback is enabled for this start, so an early
 	// hardware failure can move to a safer path. The node decides from its
@@ -116,12 +122,25 @@ type TranscodeStartResponse struct {
 	// decoder failed to start. Older nodes omit it, so callers OR it with the
 	// requested value.
 	SoftwareVideoDecode bool `json:"software_video_decode,omitempty"`
+	// KeyframePlaylist attests that the executor understood a requested
+	// keyframe playlist. Older nodes omit it and are rejected before they
+	// serve FFmpeg's growing playlist under a recipe that records the planned
+	// one.
+	KeyframePlaylist bool `json:"keyframe_playlist,omitempty"`
+	// SubtitleRendition attests that the executor emits the requested subtitle
+	// rendition. Older nodes omit it and are rejected before the plan
+	// promises a rendition their playlist does not carry.
+	SubtitleRendition bool `json:"subtitle_rendition,omitempty"`
 }
 
 var ErrAudioRecipeAttestationMismatch = errors.New("transcode node audio recipe attestation mismatch")
 var ErrCopyFMP4RecipeAttestationMismatch = errors.New("transcode node copy-fmp4 recipe attestation mismatch")
 var ErrThrottleAttestationMismatch = errors.New("transcode node throttle attestation mismatch")
 
+// ErrKeyframePlaylistAttestationMismatch reports an executor that ignored a
+// requested keyframe playlist.
+var ErrKeyframePlaylistAttestationMismatch = errors.New("transcode node keyframe playlist attestation mismatch")
+
 func validateAudioRecipeRequest(req TranscodeStartRequest) error {
 	if req.SourceAudioChannels == 0 && req.AudioRecipeVersion == "" {
 		return nil
@@ -174,6 +193,30 @@ func ValidateCopyFMP4RecipeAttestation(req TranscodeStartRequest, response Trans
 	return nil
 }
 
+// ValidateKeyframePlaylistAttestation rejects an executor that silently
+// ignored a requested keyframe playlist. Requests without one stay compatible
+// with older nodes, which omit the field.
+func ValidateKeyframePlaylistAttestation(req TranscodeStartRequest, response TranscodeStartResponse) error {
+	if req.KeyframePlaylist && !response.KeyframePlaylist {
+		return ErrKeyframePlaylistAttestationMismatch
+	}
+	return nil
+}
+
+// ErrSubtitleRenditionAttestationMismatch reports an executor that ignored a
+// requested subtitle rendition.
+var ErrSubtitleRenditionAttestationMismatch = errors.New("transcode node subtitle rendition attestation mismatch")
+
+// ValidateSubtitleRenditionAttestation rejects an executor that silently
+// ignored a requested subtitle rendition. Requests without one stay compatible
+// with older nodes, which omit the field.
+func ValidateSubtitleRenditionAttestation(req TranscodeStartRequest, response TranscodeStartResponse) error {
+	if req.SubtitleRendition && !response.SubtitleRendition {
+		return ErrSubtitleRenditionAttestationMismatch
+	}
+	return nil
+}
+
 // ValidateThrottleAttestation rejects an executor that silently ignored an
 // enabled throttle policy. Disabled requests remain compatible with older
 // nodes whose response omits the field.
@@ -916,7 +959,7 @@ func (s *Server) router() chi.Router {
 	s.startIdleReaper()
 	r := chi.NewRouter()
 	r.Get("/api/v1/health", s.handleHealth)
-	// Unauthenticated, matching the API listener's own /metrics posture: a
+	// Unauthenticated, matching the main server's dedicated metrics listener: a
 	// scrape target that needs a credential is a scrape target that goes
 	// unmonitored, and the exposure is host resource counters, not media.
 	r.Method(http.MethodGet, "/metrics", promhttp.Handler())
@@ -1427,7 +1470,9 @@ func (s *Server) buildCapabilitySnapshotLocked(ctx context.Context) (playback.HW
 			}
 		}
 	}
-	info.TransportFeatures = append(info.TransportFeatures, playback.TransportFeaturePreparedTracksV1, playback.TransportFeatureTrickplayExtractV1)
+	info.TransportFeatures = append(info.TransportFeatures, playback.TransportFeaturePreparedTracksV1,
+		playback.TransportFeatureTrickplayExtractV1, playback.TransportFeatureTrickplayExtractV2,
+		playback.TransportFeatureHLSSubtitleRenditionV1)
 	info.CapabilityHash = playback.ComputeCapabilityHash(info)
 	return info, nil
 }
@@ -1563,7 +1608,9 @@ func writeChapterThumbnailError(w http.ResponseWriter, status int, reason string
 	})
 }
 
-// requireBearer is middleware that checks for Authorization: Bearer {secret}.
+// requireBearer is middleware that admits only API servers and proxies: it
+// checks the request's node signature (see nodeauth). The name predates
+// signing and is kept because the route inventory classifies by it.
 func (s *Server) requireBearer(next http.Handler) http.Handler {
 	next = telemetry.TrustedHTTPHandler("worker", next)
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -1572,8 +1619,7 @@ func (s *Server) requireBearer(next http.Handler) http.Handler {
 			http.Error(w, "node not configured", http.StatusServiceUnavailable)
 			return
 		}
-		auth := r.Header.Get("Authorization")
-		if !strings.HasPrefix(auth, "Bearer ") || strings.TrimPrefix(auth, "Bearer ") != cfg.Auth.JWTSecret {
+		if nodeauth.Verify(r, cfg.Auth.JWTSecret) != nil {
 			http.Error(w, "unauthorized", http.StatusUnauthorized)
 			return
 		}
@@ -1656,6 +1702,7 @@ func (s *Server) handleStart(w http.ResponseWriter, r *http.Request) {
 		VideoBitstreamFilter:       req.VideoBitstreamFilter,
 		VideoSampleEntry:           req.VideoSampleEntry,
 		CopyVideoMPEGTS:            req.CopyVideoMPEGTS,
+		KeyframePlaylist:           req.KeyframePlaylist,
 		SeekSeconds:                req.SeekSeconds,
 		StreamOriginSeconds:        req.StreamOriginSeconds,
 		CopySeekAnchorResolved:     req.CopySeekAnchorResolved,
@@ -1678,6 +1725,7 @@ func (s *Server) handleStart(w http.ResponseWriter, r *http.Request) {
 		SubtitleTrackIndex: req.SubtitleTrackIndex,
 		SubtitleBurnIn:     req.SubtitleBurnIn,
 		SubtitleCodec:      req.SubtitleCodec,
+		SubtitleRendition:  req.SubtitleRendition,
 		TotalDuration:      req.TotalDuration,
 		FastStart:          true,
 		NodeType:           "transcode",
@@ -1832,6 +1880,8 @@ func (s *Server) handleStart(w http.ResponseWriter, r *http.Request) {
 		CopyFMP4RecipeVersion: req.CopyFMP4RecipeVersion,
 		ThrottleSeconds:       req.ThrottleSeconds,
 		SoftwareVideoDecode:   session.Opts().SoftwareVideoDecode,
+		KeyframePlaylist:      session.Opts().KeyframePlaylist,
+		SubtitleRendition:     session.HasSubtitleRendition(),
 	})
 }
 
@@ -1867,7 +1917,7 @@ func (s *Server) requireApprovedInputPath(w http.ResponseWriter, r *http.Request
 // identity-only by design (see internal/noderecipe), and a header-authenticated
 // (tokenless) attempt, where no client-visible URL carries a credential and the
 // relayed request therefore has no token to forward. The token was never this
-// route's authorization — the static bearer already authenticated the caller —
+// route's authorization — the node signature already authenticated the caller —
 // so its absence only removes a recipe source, never a permission.
 //
 // Returns nil when no source yields a complete transcode recipe for the session
@@ -1998,6 +2048,7 @@ func (s *Server) spawnReconstruct(r *http.Request, sessionID string, requestedSe
 	outputDir := s.sessionOutputDir(sessionID)
 	opts := card.TranscodeOpts(outputDir, cfg.Playback.FFmpegPath, s.ffmpegSink)
 	opts.SessionID = sessionID
+	opts.Reconstructed = true
 	// Recipe cards preserve the original launch tuning, but reconstruction must
 	// retain the normal manifest cushion rather than the fresh-start fast path.
 	opts.FastStart = false
@@ -2233,7 +2284,7 @@ func (s *Server) acquireReconstructSlot(ctx context.Context) (func(), bool) {
 	}
 }
 
-// handleRemux executes a progressive remux on demand. The static bearer
+// handleRemux executes a progressive remux on demand. The node signature
 // authenticates the proxy process; the independently verified stream token
 // binds the media recipe and the exact transcode-execution/proxy-egress route.
 func (s *Server) handleRemux(w http.ResponseWriter, r *http.Request) {
@@ -2665,6 +2716,8 @@ func (s *Server) handleSegment(w http.ResponseWriter, r *http.Request) {
 		requestedSegment := -1
 		if n, parseErr := playback.ParseSegmentNumber(name); parseErr == nil {
 			requestedSegment = n
+		} else if n, ok := playback.ParseSubtitleSegmentNumber(name); ok {
+			requestedSegment = n
 		}
 		var reconstructErr error
 		session, reconstructErr = s.reconstructFromToken(r, sessionID, requestedSegment)
@@ -2682,6 +2735,12 @@ func (s *Server) handleSegment(w http.ResponseWriter, r *http.Request) {
 	}
 	s.attachTelemetrySession(r, sessionID)
 
+	if subtitleSegment, ok := playback.ParseSubtitleSegmentNumber(name); ok {
+		// Subtitle rendition segments never wait out or restart the video
+		// pipeline: they are answered from the cues already on disk.
+		session.ServeSubtitleSegment(w, r, subtitleSegment)
+		return
+	}
 	segmentLease, err := session.OpenSegment(name)
 	if errors.Is(err, playback.ErrSegmentNotFound) {
 		segNum, parseErr := playback.ParseSegmentNumber(name)
diff --git a/internal/transcodenode/server_test.go b/internal/transcodenode/server_test.go
index 0d66582fbc..ae74803430 100644
--- a/internal/transcodenode/server_test.go
+++ b/internal/transcodenode/server_test.go
@@ -23,6 +23,7 @@ import (
 	"github.com/prairie-server/prairie-server/internal/downloadprepare"
 	"github.com/prairie-server/prairie-server/internal/mediaprobe"
 	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 	"github.com/prairie-server/prairie-server/internal/nodeconfig"
 	"github.com/prairie-server/prairie-server/internal/noderouting"
 	"github.com/prairie-server/prairie-server/internal/nodesessions"
@@ -743,7 +744,7 @@ func TestHandleDownloadPreparePublishesToneMapReceiptAndStatusAttestation(t *tes
 	}
 
 	head := httptest.NewRequest(http.MethodHead, "/downloads/artifacts/artifact-tone-map", nil)
-	head.Header.Set("Authorization", "Bearer "+testSecret)
+	nodeauthtest.Sign(t, head, testSecret)
 	headRecorder := httptest.NewRecorder()
 	server.Handler().ServeHTTP(headRecorder, head)
 	if headRecorder.Code != http.StatusOK {
@@ -814,7 +815,7 @@ func TestHandleDownloadPreparePublishesStereoDownmixReceiptAndStatusAttestation(
 	}
 
 	head := httptest.NewRequest(http.MethodHead, "/downloads/artifacts/"+prepareRequest.ArtifactID, nil)
-	head.Header.Set("Authorization", "Bearer "+testSecret)
+	nodeauthtest.Sign(t, head, testSecret)
 	headRecorder := httptest.NewRecorder()
 	server.Handler().ServeHTTP(headRecorder, head)
 	if headRecorder.Code != http.StatusOK {
@@ -1392,6 +1393,21 @@ func TestValidateThrottleAttestation(t *testing.T) {
 	}
 }
 
+// A node that ignores a requested keyframe playlist would serve FFmpeg's
+// growing playlist under a recipe that records the planned one.
+func TestValidateKeyframePlaylistAttestation(t *testing.T) {
+	request := TranscodeStartRequest{KeyframePlaylist: true}
+	if err := ValidateKeyframePlaylistAttestation(request, TranscodeStartResponse{KeyframePlaylist: true}); err != nil {
+		t.Fatalf("matching attestation rejected: %v", err)
+	}
+	if err := ValidateKeyframePlaylistAttestation(request, TranscodeStartResponse{}); !errors.Is(err, ErrKeyframePlaylistAttestationMismatch) {
+		t.Fatalf("missing attestation error = %v, want %v", err, ErrKeyframePlaylistAttestationMismatch)
+	}
+	if err := ValidateKeyframePlaylistAttestation(TranscodeStartRequest{}, TranscodeStartResponse{}); err != nil {
+		t.Fatalf("request without a keyframe playlist rejected a legacy node response: %v", err)
+	}
+}
+
 func TestHandleStartRejectsUnversionedSourceAudioRecipeBeforeExecution(t *testing.T) {
 	server := newTestServer(t)
 	body, err := json.Marshal(TranscodeStartRequest{
@@ -1679,7 +1695,7 @@ func TestDownloadArtifactRoutesServeRangeAndDeleteNodeLocalFile(t *testing.T) {
 	}
 
 	req := httptest.NewRequest(http.MethodGet, "/downloads/artifacts/artifact-range", nil)
-	req.Header.Set("Authorization", "Bearer "+testSecret)
+	nodeauthtest.Sign(t, req, testSecret)
 	req.Header.Set("Range", "bytes=3-6")
 	rr := httptest.NewRecorder()
 	server.Handler().ServeHTTP(rr, req)
@@ -1691,7 +1707,7 @@ func TestDownloadArtifactRoutesServeRangeAndDeleteNodeLocalFile(t *testing.T) {
 	}
 
 	deleteReq := httptest.NewRequest(http.MethodDelete, "/downloads/artifacts/artifact-range", nil)
-	deleteReq.Header.Set("Authorization", "Bearer "+testSecret)
+	nodeauthtest.Sign(t, deleteReq, testSecret)
 	deleteRR := httptest.NewRecorder()
 	server.Handler().ServeHTTP(deleteRR, deleteReq)
 	if deleteRR.Code != http.StatusNoContent {
@@ -1723,7 +1739,7 @@ func TestDeleteDownloadArtifactReceiptInvalidationFailurePreservesArtifact(t *te
 	}
 
 	request := httptest.NewRequest(http.MethodDelete, "/downloads/artifacts/artifact-delete-invalidation", nil)
-	request.Header.Set("Authorization", "Bearer "+testSecret)
+	nodeauthtest.Sign(t, request, testSecret)
 	recorder := httptest.NewRecorder()
 	server.Handler().ServeHTTP(recorder, request)
 	if recorder.Code != http.StatusInternalServerError {
@@ -1793,7 +1809,7 @@ func TestDownloadArtifactHeadDoesNotWaitForConcurrentRelay(t *testing.T) {
 	getDone := make(chan struct{})
 	go func() {
 		req := httptest.NewRequest(http.MethodGet, "/downloads/artifacts/"+artifactID, nil)
-		req.Header.Set("Authorization", "Bearer "+testSecret)
+		nodeauthtest.Sign(t, req, testSecret)
 		server.Handler().ServeHTTP(blocked, req)
 		close(getDone)
 	}()
@@ -1807,7 +1823,7 @@ func TestDownloadArtifactHeadDoesNotWaitForConcurrentRelay(t *testing.T) {
 	headDone := make(chan *httptest.ResponseRecorder, 1)
 	go func() {
 		req := httptest.NewRequest(http.MethodHead, "/downloads/artifacts/"+artifactID, nil)
-		req.Header.Set("Authorization", "Bearer "+testSecret)
+		nodeauthtest.Sign(t, req, testSecret)
 		rr := httptest.NewRecorder()
 		server.Handler().ServeHTTP(rr, req)
 		headDone <- rr
diff --git a/internal/transcodenode/start_protocol_test.go b/internal/transcodenode/start_protocol_test.go
index c4f57d77cd..7797ef71bf 100644
--- a/internal/transcodenode/start_protocol_test.go
+++ b/internal/transcodenode/start_protocol_test.go
@@ -8,6 +8,8 @@ import (
 	"os/exec"
 	"strings"
 	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 )
 
 func TestWorkerStartActualMedia(t *testing.T) {
@@ -31,7 +33,7 @@ func TestWorkerStartActualMedia(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	req.Header.Set("Authorization", "Bearer "+testSecret)
+	nodeauthtest.Sign(t, req, testSecret)
 	response, err := handler.Client().Do(req)
 	if err != nil {
 		t.Fatal(err)
diff --git a/internal/transcodenode/streamdeny_test.go b/internal/transcodenode/streamdeny_test.go
index 75addbec2f..ea8900bef9 100644
--- a/internal/transcodenode/streamdeny_test.go
+++ b/internal/transcodenode/streamdeny_test.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/redis/go-redis/v9"
 
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 	"github.com/prairie-server/prairie-server/internal/noderouting"
 	"github.com/prairie-server/prairie-server/internal/playback"
 	"github.com/prairie-server/prairie-server/internal/streamtoken"
@@ -30,7 +31,7 @@ func unreachableStreamDeny(t *testing.T) *playback.StreamDeny {
 func nodeRequest(t *testing.T, server *Server, method, path, token string) *httptest.ResponseRecorder {
 	t.Helper()
 	req := httptest.NewRequest(method, path, nil)
-	req.Header.Set("Authorization", "Bearer "+testSecret)
+	nodeauthtest.Sign(t, req, testSecret)
 	if token != "" {
 		req.Header.Set("X-Prairie-Stream-Token", token)
 	}
diff --git a/internal/transcodenode/streamtelemetry_test.go b/internal/transcodenode/streamtelemetry_test.go
index b24a527499..bc7497ef23 100644
--- a/internal/transcodenode/streamtelemetry_test.go
+++ b/internal/transcodenode/streamtelemetry_test.go
@@ -10,6 +10,7 @@ import (
 	"testing"
 	"time"
 
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 	"github.com/prairie-server/prairie-server/internal/noderouting"
 	"github.com/prairie-server/prairie-server/internal/playback"
 	"github.com/prairie-server/prairie-server/internal/streamtelemetry"
@@ -35,7 +36,7 @@ func nodeMediaRequest(t *testing.T, server *httptest.Server, path, token string)
 	if err != nil {
 		t.Fatal(err)
 	}
-	req.Header.Set("Authorization", "Bearer "+testSecret)
+	nodeauthtest.Sign(t, req, testSecret)
 	if token != "" {
 		req.Header.Set("X-Prairie-Stream-Token", token)
 	}
diff --git a/internal/transcodenode/subtitle_rendition_test.go b/internal/transcodenode/subtitle_rendition_test.go
new file mode 100644
index 0000000000..56096f30c8
--- /dev/null
+++ b/internal/transcodenode/subtitle_rendition_test.go
@@ -0,0 +1,89 @@
+package transcodenode
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/prairie-server/prairie-server/internal/playback"
+)
+
+func TestNodeServesSubtitleRenditionThroughManifestAndSegmentRoutes(t *testing.T) {
+	truePath, err := exec.LookPath("true")
+	if err != nil {
+		t.Skipf("`true` not found in PATH: %v", err)
+	}
+	const sessionID = "subtitle-rendition-session"
+	server := newTestServer(t)
+	outputDir := t.TempDir()
+	session, err := playback.StartTranscode(context.Background(), playback.TranscodeOpts{
+		SessionID: sessionID, OutputDir: outputDir, FFmpegPath: truePath,
+		TargetCodecVideo: "h264", TargetCodecAudio: "aac", SegmentDuration: 2, TotalDuration: 60,
+		SubtitleTrackIndex: 0, SubtitleCodec: "subrip", SubtitleRendition: true,
+	})
+	if err != nil {
+		t.Fatalf("StartTranscode: %v", err)
+	}
+	t.Cleanup(func() { _ = session.Close() })
+	<-session.Done()
+	server.sessions[sessionID] = session
+	server.lastAccess[sessionID] = time.Now()
+	if !session.HasSubtitleRendition() {
+		t.Fatal("session must publish its subtitle rendition")
+	}
+	for name, body := range map[string]string{
+		"subtitles_0.vtt": "WEBVTT\n\n00:03.000 --> 00:04.000\nHello\n",
+		"stream.m3u8":     "#EXTM3U\n#EXT-X-TARGETDURATION:2\n#EXTINF:2.0,\nseg_00000.ts\n#EXTINF:2.0,\nseg_00001.ts\n",
+	} {
+		if err := os.WriteFile(filepath.Join(outputDir, name), []byte(body), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	manifestReq := withNodeRouteParams(httptest.NewRequest(http.MethodGet, "/transcode/"+sessionID+"/master.m3u8", nil),
+		map[string]string{"session_id": sessionID})
+	manifestRR := httptest.NewRecorder()
+	server.handleManifest(manifestRR, manifestReq)
+	if manifestRR.Code != http.StatusOK || !strings.Contains(manifestRR.Body.String(), "#EXT-X-MEDIA:TYPE=SUBTITLES") {
+		t.Fatalf("manifest = %d %q", manifestRR.Code, manifestRR.Body.String())
+	}
+
+	segmentReq := withNodeRouteParams(httptest.NewRequest(http.MethodGet, "/transcode/"+sessionID+"/segment/sub_00001.vtt", nil),
+		map[string]string{"session_id": sessionID, "name": "sub_00001.vtt"})
+	segmentRR := httptest.NewRecorder()
+	server.handleSegment(segmentRR, segmentReq)
+	if segmentRR.Code != http.StatusOK || segmentRR.Header().Get("Content-Type") != "text/vtt; charset=utf-8" ||
+		!strings.Contains(segmentRR.Body.String(), "X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000\n\n00:03.000 --> 00:04.000\nHello\n") {
+		t.Fatalf("subtitle segment = %d %q %q", segmentRR.Code, segmentRR.Header().Get("Content-Type"), segmentRR.Body.String())
+	}
+
+	// A segment no generation covers answers at once with an empty document,
+	// never a 404 or a restart of the video pipeline.
+	missingReq := withNodeRouteParams(httptest.NewRequest(http.MethodGet, "/transcode/"+sessionID+"/segment/sub_00020.vtt", nil),
+		map[string]string{"session_id": sessionID, "name": "sub_00020.vtt"})
+	missingRR := httptest.NewRecorder()
+	server.handleSegment(missingRR, missingReq)
+	if missingRR.Code != http.StatusOK || strings.Contains(missingRR.Body.String(), "-->") {
+		t.Fatalf("uncovered subtitle segment = %d %q", missingRR.Code, missingRR.Body.String())
+	}
+}
+
+func TestSubtitleRenditionAttestation(t *testing.T) {
+	requested := TranscodeStartRequest{SubtitleRendition: true}
+	if err := ValidateSubtitleRenditionAttestation(requested, TranscodeStartResponse{}); !errors.Is(err, ErrSubtitleRenditionAttestationMismatch) {
+		t.Fatalf("an executor that ignored the rendition must be rejected: %v", err)
+	}
+	if err := ValidateSubtitleRenditionAttestation(requested, TranscodeStartResponse{SubtitleRendition: true}); err != nil {
+		t.Fatal(err)
+	}
+	if err := ValidateSubtitleRenditionAttestation(TranscodeStartRequest{}, TranscodeStartResponse{}); err != nil {
+		t.Fatalf("starts without a rendition stay compatible with older nodes: %v", err)
+	}
+}
diff --git a/internal/transcodenode/theme_audio_test.go b/internal/transcodenode/theme_audio_test.go
index f76b82c2c8..70386869cb 100644
--- a/internal/transcodenode/theme_audio_test.go
+++ b/internal/transcodenode/theme_audio_test.go
@@ -14,6 +14,7 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 	"github.com/prairie-server/prairie-server/internal/noderouting"
 	"github.com/prairie-server/prairie-server/internal/playback"
 	"github.com/prairie-server/prairie-server/internal/streamtoken"
@@ -159,7 +160,7 @@ func TestHWCapabilitiesAdvertisesThemeExecutionOnlyWithAuthority(t *testing.T) {
 	features := func() []string {
 		t.Helper()
 		request := httptest.NewRequest(http.MethodGet, "/hw-capabilities", nil)
-		request.Header.Set("Authorization", "Bearer "+testSecret)
+		nodeauthtest.Sign(t, request, testSecret)
 		recorder := httptest.NewRecorder()
 		server.Handler().ServeHTTP(recorder, request)
 		if recorder.Code == http.StatusServiceUnavailable {
diff --git a/internal/transcodenode/trickplay.go b/internal/transcodenode/trickplay.go
index 1468595e2b..c510b00aab 100644
--- a/internal/transcodenode/trickplay.go
+++ b/internal/transcodenode/trickplay.go
@@ -92,7 +92,7 @@ func (s *Server) handleTrickplayExtract(w http.ResponseWriter, r *http.Request)
 	hardware.Set(accel, cfg.Playback.HWDevice)
 	resolved, device := hardware.Backend(r.Context(), ffmpeg)
 	runner := mediasample.Runner{FFmpegPath: ffmpeg, Workload: processmetrics.Trickplay}
-	if mediasample.SupportsHardwareDecode(resolved) {
+	if mediasample.SupportsHardwareSheets(resolved) {
 		runner.HWAccel, runner.HWDevice = resolved, device
 	} else {
 		req.Attempts = softwareAttempts(req.Attempts)
diff --git a/internal/transcodenode/trickplay_gate_test.go b/internal/transcodenode/trickplay_gate_test.go
index 448da73968..db169acbbd 100644
--- a/internal/transcodenode/trickplay_gate_test.go
+++ b/internal/transcodenode/trickplay_gate_test.go
@@ -19,7 +19,7 @@ func TestTrickplayRejectsReprobeBeforeResolvingHardware(t *testing.T) {
 		t.Fatal("could not start reprobe")
 	}
 	defer server.gpu.endReprobe()
-	rec := postTrickplay(server, sheetsRequestJSON(t, filepath.Join(t.TempDir(), "missing.mkv")))
+	rec := postTrickplay(t, server, sheetsRequestJSON(t, filepath.Join(t.TempDir(), "missing.mkv")))
 	if calls != 0 {
 		t.Fatalf("hardware resolved %d times during reprobe", calls)
 	}
@@ -47,7 +47,7 @@ func TestTrickplayResolutionHoldsAndReleasesGPUAdmission(t *testing.T) {
 		}
 		return "none"
 	}
-	rec := postTrickplay(server, sheetsRequestJSON(t, filepath.Join(t.TempDir(), "missing.mkv")))
+	rec := postTrickplay(t, server, sheetsRequestJSON(t, filepath.Join(t.TempDir(), "missing.mkv")))
 	if calls != 1 || rec.Code != http.StatusUnprocessableEntity {
 		t.Fatalf("calls=%d response=%d %s", calls, rec.Code, rec.Body.String())
 	}
diff --git a/internal/transcodenode/trickplay_test.go b/internal/transcodenode/trickplay_test.go
index c563481834..0958dc28de 100644
--- a/internal/transcodenode/trickplay_test.go
+++ b/internal/transcodenode/trickplay_test.go
@@ -13,6 +13,7 @@ import (
 
 	"github.com/prairie-server/prairie-server/internal/config"
 	"github.com/prairie-server/prairie-server/internal/mediasample"
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 	"github.com/prairie-server/prairie-server/internal/nodeconfig"
 	"github.com/prairie-server/prairie-server/internal/playback"
 	"github.com/prairie-server/prairie-server/internal/trickplay"
@@ -30,9 +31,9 @@ func newTrickplayTestServer(t *testing.T, ffmpeg string) *Server {
 	return &Server{watcher: watcher, inputPaths: allowInputPaths{}, sessions: make(map[string]*playback.TranscodeSession)}
 }
 
-func postTrickplay(server *Server, body string) *httptest.ResponseRecorder {
+func postTrickplay(t *testing.T, server *Server, body string) *httptest.ResponseRecorder {
 	req := httptest.NewRequest(http.MethodPost, "/trickplay/extract", strings.NewReader(body))
-	req.Header.Set("Authorization", "Bearer "+testSecret)
+	nodeauthtest.Sign(t, req, testSecret)
 	req.Header.Set("Content-Type", "application/json")
 	rec := httptest.NewRecorder()
 	server.Handler().ServeHTTP(rec, req)
@@ -67,7 +68,7 @@ func TestTrickplayExtractMakesSheets(t *testing.T) {
 		t.Skipf("cannot generate the clip: %v: %s", err, output)
 	}
 	server := newTrickplayTestServer(t, ffmpeg)
-	rec := postTrickplay(server, sheetsRequestJSON(t, clip))
+	rec := postTrickplay(t, server, sheetsRequestJSON(t, clip))
 	if rec.Code != http.StatusOK {
 		t.Fatalf("%d %s", rec.Code, rec.Body.String())
 	}
@@ -91,20 +92,20 @@ func TestTrickplayExtractRefuses(t *testing.T) {
 		_ = json.Unmarshal(rec.Body.Bytes(), &failure)
 		return failure
 	}
-	if rec := postTrickplay(server, `{`); rec.Code != http.StatusBadRequest {
+	if rec := postTrickplay(t, server, `{`); rec.Code != http.StatusBadRequest {
 		t.Fatalf("bad body: %d", rec.Code)
 	}
 	stats := `{"input":"/media/movie.mkv","samples":{"seconds":[1]},"stats":{"crop_width":1,"crop_height":1,"width":64}}`
-	if rec := postTrickplay(server, stats); rec.Code != http.StatusBadRequest || decode(rec).Reason != "invalid_request" {
+	if rec := postTrickplay(t, server, stats); rec.Code != http.StatusBadRequest || decode(rec).Reason != "invalid_request" {
 		t.Fatalf("stats request: %d %s", rec.Code, rec.Body.String())
 	}
 	server.trickplay.busy.Lock()
-	if rec := postTrickplay(server, valid); rec.Code != http.StatusServiceUnavailable || decode(rec).Reason != trickplay.NodeBusyReason {
+	if rec := postTrickplay(t, server, valid); rec.Code != http.StatusServiceUnavailable || decode(rec).Reason != trickplay.NodeBusyReason {
 		t.Fatalf("busy: %d %s", rec.Code, rec.Body.String())
 	}
 	server.trickplay.busy.Unlock()
 	server.inputPaths = denyInputPaths{}
-	if rec := postTrickplay(server, valid); rec.Code == http.StatusOK || rec.Code == http.StatusUnprocessableEntity {
+	if rec := postTrickplay(t, server, valid); rec.Code == http.StatusOK || rec.Code == http.StatusUnprocessableEntity {
 		t.Fatalf("unapproved path: %d", rec.Code)
 	}
 	unauthorized := httptest.NewRecorder()
diff --git a/internal/transcodeproxy/completion.go b/internal/transcodeproxy/completion.go
index 26e1df8b5a..090f772164 100644
--- a/internal/transcodeproxy/completion.go
+++ b/internal/transcodeproxy/completion.go
@@ -12,6 +12,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/prairie-server/prairie-server/internal/nodeauth"
 	"github.com/prairie-server/prairie-server/internal/telemetry"
 )
 
@@ -81,10 +82,10 @@ func FullRepresentationSize(resp *http.Response) int64 {
 	return size
 }
 
-// Acknowledge reports a completed downstream response to the transcode node.
-// The opaque generation token makes delayed acknowledgements harmless after a
-// restart or reconstruction.
-func Acknowledge(ctx context.Context, client *http.Client, targetURL, jwtSecret, generation string) error {
+// Acknowledge reports a completed downstream response to the transcode node at
+// nodeURL for the segment at segmentPath. The opaque generation token makes
+// delayed acknowledgements harmless after a restart or reconstruction.
+func Acknowledge(ctx context.Context, client *http.Client, nodeURL, segmentPath, jwtSecret, generation string) error {
 	if client == nil {
 		client = http.DefaultClient
 	}
@@ -94,11 +95,13 @@ func Acknowledge(ctx context.Context, client *http.Client, targetURL, jwtSecret,
 	// bounded lifetime so a successful delivery is not mistaken for a disconnect.
 	ackCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 5*time.Second)
 	defer cancel()
-	req, err := http.NewRequestWithContext(ackCtx, http.MethodPost, targetURL+"/downloaded", nil)
+	req, err := http.NewRequestWithContext(ackCtx, http.MethodPost, nodeURL+segmentPath+"/downloaded", nil)
 	if err != nil {
 		return fmt.Errorf("build acknowledgement: %w", err)
 	}
-	req.Header.Set("Authorization", "Bearer "+jwtSecret)
+	if err := nodeauth.Sign(req, nodeURL, jwtSecret); err != nil {
+		return fmt.Errorf("sign acknowledgement: %w", err)
+	}
 	req.Header.Set(GenerationHeader, generation)
 	resp, err := telemetry.DoTrustedNode(client, req, "stream_ack")
 	if err != nil {
diff --git a/internal/transcodeproxy/completion_test.go b/internal/transcodeproxy/completion_test.go
index 505e3a01a4..320ae4157c 100644
--- a/internal/transcodeproxy/completion_test.go
+++ b/internal/transcodeproxy/completion_test.go
@@ -5,6 +5,8 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 )
 
 func TestAcknowledgeSurvivesCompletedDownstreamRequest(t *testing.T) {
@@ -18,8 +20,8 @@ func TestAcknowledgeSurvivesCompletedDownstreamRequest(t *testing.T) {
 		if r.Method != http.MethodPost {
 			t.Errorf("method = %q, want POST", r.Method)
 		}
-		if got := r.Header.Get("Authorization"); got != "Bearer "+jwtSecret {
-			t.Errorf("Authorization = %q", got)
+		if !nodeauthtest.Signed(r, jwtSecret) {
+			t.Errorf("acknowledgement is not signed: Authorization = %q", r.Header.Get("Authorization"))
 		}
 		if got := r.Header.Get(GenerationHeader); got != generation {
 			t.Errorf("generation = %q, want %q", got, generation)
@@ -31,7 +33,7 @@ func TestAcknowledgeSurvivesCompletedDownstreamRequest(t *testing.T) {
 
 	requestCtx, cancelRequest := context.WithCancel(context.Background())
 	cancelRequest()
-	if err := Acknowledge(requestCtx, server.Client(), server.URL+"/segment", jwtSecret, generation); err != nil {
+	if err := Acknowledge(requestCtx, server.Client(), server.URL, "/segment", jwtSecret, generation); err != nil {
 		t.Fatalf("Acknowledge() error = %v", err)
 	}
 	select {
diff --git a/internal/trickplay/extract.go b/internal/trickplay/extract.go
index 7170faa8af..77d2ca43b6 100644
--- a/internal/trickplay/extract.go
+++ b/internal/trickplay/extract.go
@@ -65,7 +65,7 @@ func (e *LocalExtractor) Extract(ctx context.Context, _ *Job, req mediasample.Re
 	}
 	e.hardware.Set(accel, readSetting(ctx, e.settings, hwDeviceSetting))
 	resolved, device := e.hardware.Backend(ctx, ffmpeg)
-	hardware := mediasample.SupportsHardwareDecode(resolved)
+	hardware := mediasample.SupportsHardwareSheets(resolved)
 	req.Attempts = AttemptPlan(hardware, len(req.Samples.Seconds))
 	runner := mediasample.Runner{
 		FFmpegPath: ffmpeg,
@@ -93,17 +93,20 @@ func (e *LocalExtractor) Extract(ctx context.Context, _ *Job, req mediasample.Re
 
 // fallback moves a failed hardware attempt on to software, logging the
 // first failure per accelerator loudly. An input that has no video stream
-// fails the same way in software, so that ends the run.
+// fails the same way in software, so that ends the run. A GPU that cannot
+// decode a file's codec is no fault of the accelerator and is not its first
+// failure.
 func (e *LocalExtractor) fallback(ctx context.Context, accel string) func(mediasample.Attempt, mediasample.AttemptError) bool {
 	return func(attempt mediasample.Attempt, failure mediasample.AttemptError) bool {
 		if !attempt.Hardware {
 			return true
 		}
-		if failure.Cause() == mediasample.ReasonNoStream {
+		cause := failure.Cause()
+		if cause == mediasample.ReasonNoStream {
 			return false
 		}
 		level := slog.LevelDebug
-		if e.hardware.FirstFailure(accel) {
+		if cause != mediasample.ReasonUnsupported && e.hardware.FirstFailure(accel) {
 			level = slog.LevelWarn
 		}
 		e.logger.Log(ctx, level, "trickplay hardware decode failed; using software",
diff --git a/internal/trickplay/remote.go b/internal/trickplay/remote.go
index 620a469110..968149e569 100644
--- a/internal/trickplay/remote.go
+++ b/internal/trickplay/remote.go
@@ -14,6 +14,7 @@ import (
 	"time"
 
 	"github.com/prairie-server/prairie-server/internal/mediasample"
+	"github.com/prairie-server/prairie-server/internal/nodeauth"
 	"github.com/prairie-server/prairie-server/internal/nodepool"
 	"github.com/prairie-server/prairie-server/internal/playback"
 	"github.com/prairie-server/prairie-server/internal/telemetry"
@@ -33,7 +34,7 @@ const (
 	// remoteOverhead covers the transfer and the node's own start on top of
 	// a request's attempt timeouts.
 	remoteOverhead = 30 * time.Second
-	// Generation caps chunks at 64 million pixels, including the initial
+	// Generation caps chunks at 32 million pixels, including the initial
 	// geometry sample. This also fits the base64 form of uncompressible JPEGs.
 	maxRemoteResultBytes = 512 << 20
 )
@@ -129,7 +130,9 @@ func trickplayNodeEligible(node *nodepool.Node) bool {
 }
 
 // makesTrickplay reports whether a node's capability report advertises the
-// trickplay endpoint.
+// trickplay endpoint at the version this server's requests need: one that
+// reads the tone-map source signal, which an older node would ignore and
+// convert with the best-effort chains.
 func makesTrickplay(report []byte) bool {
 	var capabilities struct {
 		TransportFeatures []string `json:"transport_features"`
@@ -137,7 +140,7 @@ func makesTrickplay(report []byte) bool {
 	if len(report) == 0 || json.Unmarshal(report, &capabilities) != nil {
 		return false
 	}
-	return slices.Contains(capabilities.TransportFeatures, playback.TransportFeatureTrickplayExtractV1)
+	return slices.Contains(capabilities.TransportFeatures, playback.TransportFeatureTrickplayExtractV2)
 }
 
 // remote runs req on node. The node decides whether its hardware can decode,
@@ -159,7 +162,9 @@ func (e *NodeExtractor) remote(ctx context.Context, node *nodepool.Node, secret
 		return mediasample.Result{}, &ExtractError{Reason: NodeUnavailableReason, Message: err.Error()}
 	}
 	httpReq.Header.Set("Content-Type", "application/json")
-	httpReq.Header.Set("Authorization", "Bearer "+secret)
+	if err := nodeauth.Sign(httpReq, node.URL, secret); err != nil {
+		return mediasample.Result{}, &ExtractError{Reason: NodeUnavailableReason, Message: err.Error()}
+	}
 	resp, err := telemetry.DoTrustedNode(e.client, httpReq, "trickplay_extract")
 	if err != nil {
 		// A node that dies mid-request is unavailable, not a failure of the file.
diff --git a/internal/trickplay/remote_test.go b/internal/trickplay/remote_test.go
index b4330a03cf..721511ba3c 100644
--- a/internal/trickplay/remote_test.go
+++ b/internal/trickplay/remote_test.go
@@ -10,6 +10,7 @@ import (
 	"testing"
 
 	"github.com/prairie-server/prairie-server/internal/mediasample"
+	"github.com/prairie-server/prairie-server/internal/nodeauth/nodeauthtest"
 	"github.com/prairie-server/prairie-server/internal/nodepool"
 )
 
@@ -19,7 +20,7 @@ func (n fixedNodes) ReserveTranscodeWorkWith(workID string, eligible func(*nodep
 	return plannerForNodes(n...).ReserveTranscodeWorkWith(workID, eligible)
 }
 
-var trickplayCapabilities = []byte(`{"transport_features":["prepared_tracks_v1","trickplay_extract_v1"]}`)
+var trickplayCapabilities = []byte(`{"transport_features":["prepared_tracks_v1","trickplay_extract_v1","trickplay_extract_v2"]}`)
 
 // fakeNode answers /trickplay/extract with status and body, counting calls.
 func fakeNode(t *testing.T, status int, body any) (*nodepool.Node, *atomic.Int32) {
@@ -27,7 +28,7 @@ func fakeNode(t *testing.T, status int, body any) (*nodepool.Node, *atomic.Int32
 	calls := &atomic.Int32{}
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		calls.Add(1)
-		if r.URL.Path != "/trickplay/extract" || r.Header.Get("Authorization") != "Bearer secret" {
+		if r.URL.Path != "/trickplay/extract" || !nodeauthtest.Signed(r, "secret") {
 			w.WriteHeader(http.StatusUnauthorized)
 			return
 		}
@@ -118,7 +119,9 @@ func TestNodeExtractorModes(t *testing.T) {
 
 func TestMakesTrickplay(t *testing.T) {
 	for report, want := range map[string]bool{
-		`{"transport_features":["trickplay_extract_v1"]}`: true,
+		`{"transport_features":["trickplay_extract_v1","trickplay_extract_v2"]}`: true,
+		// An older node would ignore the tone-map source signal.
+		`{"transport_features":["trickplay_extract_v1"]}`: false,
 		`{"transport_features":["prepared_tracks_v1"]}`:   false,
 		`{}`: false,
 		``:   false,
diff --git a/internal/trickplay/repository.go b/internal/trickplay/repository.go
index cc9928c827..569258bdc5 100644
--- a/internal/trickplay/repository.go
+++ b/internal/trickplay/repository.go
@@ -205,6 +205,9 @@ type Published struct {
 	SheetBytes    []int
 	Decoder       string
 	Filled        int
+	// Refined counts the cells a repair read again (see
+	// mediasample.SheetFrames); it is logged, not stored.
+	Refined int
 }
 
 // Publish makes the claim's uploaded revision of fileID the one served, and
diff --git a/internal/trickplay/repository_db_test.go b/internal/trickplay/repository_db_test.go
index befe6342d2..fca36451d5 100644
--- a/internal/trickplay/repository_db_test.go
+++ b/internal/trickplay/repository_db_test.go
@@ -121,6 +121,9 @@ func (f *fixture) queued(t *testing.T, fileID int) []string {
 		}
 		prefixes = append(prefixes, prefix)
 	}
+	if err := rows.Err(); err != nil {
+		t.Fatal(err)
+	}
 	return prefixes
 }
 
diff --git a/internal/trickplay/service.go b/internal/trickplay/service.go
index 68dafd2e1b..41a2fb5306 100644
--- a/internal/trickplay/service.go
+++ b/internal/trickplay/service.go
@@ -56,9 +56,10 @@ const (
 	// maxChunkSheets bounds the sheets one ffmpeg run makes, which bounds
 	// the memory of a run and the size of a transcode node's answer.
 	maxChunkSheets = 16
-	// Bound decoded output as well as sheet count. The first sheet learns
-	// actual display geometry before batching subsequent sheets.
-	maxChunkPixels = 64 << 20
+	// Bound decoded output as well as sheet count: a run holds every tile it
+	// decodes, about 1.5 bytes a pixel, until its repairs are done. The first
+	// sheet learns actual display geometry before batching subsequent sheets.
+	maxChunkPixels = 32 << 20
 	// runThreads caps each ffmpeg run's decoder and filter threads. Work
 	// runs at idle priority, so more parallelism comes from more workers.
 	runThreads = 2
@@ -297,7 +298,7 @@ func (s *Service) process(ctx context.Context, job *Job) {
 	log := s.logger.With("file_id", job.FileID, "duration", s.now().Sub(started).Round(time.Millisecond))
 	if err == nil {
 		log.InfoContext(ctx, "trickplay sheets published", "thumbnails", published.Count, "sheets", len(published.SheetBytes),
-			"decoder", published.Decoder, "filled", published.Filled)
+			"decoder", published.Decoder, "filled", published.Filled, "refined", published.Refined)
 		// A reconcile run while this job held its lease skipped the row, so
 		// sheets made to settings that changed meanwhile are requeued now
 		// rather than at the periodic pass.
@@ -397,9 +398,7 @@ func (s *Service) generate(ctx context.Context, job *Job) (Published, error) {
 	columns, rows := recipe.Grid()
 	perSheet := columns * rows
 	sheets := &mediasample.SheetsOutput{TileWidth: recipe.Width, TileHeight: height, Columns: columns, Rows: rows, Quality: Quality, UseInputAspect: true}
-	if tonemap.NeedsToneMap(&models.MediaFile{HDR: job.HDR, VideoTracks: job.VideoTracks}) {
-		sheets.ToneMap = &mediasample.ToneMap{AllowSoftware: true}
-	}
+	sheets.ToneMap = sheetsToneMap(&models.MediaFile{HDR: job.HDR, VideoTracks: job.VideoTracks})
 	published := Published{Recipe: recipe, StoreIdentity: s.store.Identity(), Height: height, Count: len(times)}
 	var revision int64
 	chunkSheets := 1
@@ -445,6 +444,7 @@ func (s *Service) generate(ctx context.Context, job *Job) (Published, error) {
 			published.SheetBytes = append(published.SheetBytes, len(sheet.JPEG))
 		}
 		published.Filled += result.SheetFrames.Filled
+		published.Refined += result.SheetFrames.Refined
 		published.Decoder = result.Decoder
 		start += len(chunk)
 	}
@@ -458,6 +458,26 @@ func (s *Service) generate(ctx context.Context, job *Job) (Published, error) {
 	return published, nil
 }
 
+// sheetsToneMap is how a file's sheets convert HDR: nil for SDR, else
+// software tone mapping allowed, since it only handles thumbnail-sized
+// frames, with the base signal playback classifies the file's catalog facts
+// as. A candidate that playback would confirm by decoding frames first is
+// taken as it is, as thumbnails always have been best effort. A file the
+// facts cannot classify, such as a legacy row without Dolby Vision presence
+// flags, keeps the best-effort chains, except a Profile 5 one: its base is
+// not a signal any chain without its RPU can show, so it takes the Dolby
+// Vision signal and an RPU-applying executor.
+func sheetsToneMap(file *models.MediaFile) *mediasample.ToneMap {
+	if !tonemap.NeedsToneMap(file) {
+		return nil
+	}
+	source := tonemap.ResolveSource(tonemap.MetadataForFile(file)).Kind
+	if source == "" && file.PrimaryDVProfile() == 5 {
+		source = tonemap.SourceDolbyVision
+	}
+	return &mediasample.ToneMap{AllowSoftware: true, Source: source}
+}
+
 // leaseAware reports a lost lease rather than the error it caused.
 func leaseAware(ctx context.Context, err error) error {
 	if errors.Is(context.Cause(ctx), errLeaseLost) {
diff --git a/internal/trickplay/service_test.go b/internal/trickplay/service_test.go
index 5f90422f48..1ff18984a5 100644
--- a/internal/trickplay/service_test.go
+++ b/internal/trickplay/service_test.go
@@ -13,6 +13,7 @@ import (
 
 	"github.com/prairie-server/prairie-server/internal/mediasample"
 	"github.com/prairie-server/prairie-server/internal/models"
+	"github.com/prairie-server/prairie-server/internal/tonemap"
 )
 
 type fakeSettings map[string]string
@@ -155,12 +156,13 @@ func TestGenerateChunksUploadsAndPublishes(t *testing.T) {
 	store := &fakeStore{}
 	extractor := &fakeExtractor{}
 	s := testService(q, store, extractor, fakeSettings{IntervalSetting: "10"})
-	// 5 h at 10 s: one geometry sheet, then batches of at most 16 sheets.
+	// 5 h at 10 s: one geometry sheet, then batches of 11 sheets, the most
+	// that fit maxChunkPixels.
 	job := testJob(42, 18000)
 	job.HDR = true
 	s.process(t.Context(), job)
 
-	if len(extractor.requests) != 3 || len(extractor.requests[0].Samples.Seconds) != 80 || len(extractor.requests[1].Samples.Seconds) != 1280 || len(extractor.requests[2].Samples.Seconds) != 440 {
+	if len(extractor.requests) != 3 || len(extractor.requests[0].Samples.Seconds) != 80 || len(extractor.requests[1].Samples.Seconds) != 880 || len(extractor.requests[2].Samples.Seconds) != 840 {
 		t.Fatalf("requests of %d and %d samples", len(extractor.requests[0].Samples.Seconds), len(extractor.requests[len(extractor.requests)-1].Samples.Seconds))
 	}
 	first := extractor.requests[0]
@@ -544,3 +546,30 @@ func TestPublishAtOldRecipeRequestsReconcile(t *testing.T) {
 	default:
 	}
 }
+
+// TestSheetsToneMapNamesTheSourceSignal hands sheets the base signal playback
+// classifies a file's catalog facts as, and keeps the best-effort chains for
+// facts it cannot classify.
+func TestSheetsToneMapNamesTheSourceSignal(t *testing.T) {
+	profile5 := models.VideoTrack{DVProfile: 5, DVConfigPresent: true, DVBLCompatIDPresent: true, DVBLPresent: true, DVRPUPresent: true, DolbyVision: "Dolby Vision"}
+	tests := map[string]struct {
+		file *models.MediaFile
+		want *mediasample.ToneMap
+	}{
+		"SDR": {&models.MediaFile{VideoTracks: []models.VideoTrack{{ColorTransfer: "bt709"}}}, nil},
+		"HLG": {&models.MediaFile{HDR: true, VideoTracks: []models.VideoTrack{{ColorTransfer: "arib-std-b67", ColorPrimaries: "bt2020", ColorSpace: "bt2020nc", ColorRange: "tv"}}},
+			&mediasample.ToneMap{AllowSoftware: true, Source: tonemap.SourceHLG}},
+		"Dolby Vision profile 5": {&models.MediaFile{HDR: true, VideoTracks: []models.VideoTrack{profile5}},
+			&mediasample.ToneMap{AllowSoftware: true, Source: tonemap.SourceDolbyVision}},
+		"legacy Dolby Vision row": {&models.MediaFile{VideoTracks: []models.VideoTrack{{DolbyVision: "Dolby Vision", DVProfile: 8}}},
+			&mediasample.ToneMap{AllowSoftware: true}},
+		"legacy Dolby Vision profile 5 row": {&models.MediaFile{VideoTracks: []models.VideoTrack{{DolbyVision: "Dolby Vision", DVProfile: 5}}},
+			&mediasample.ToneMap{AllowSoftware: true, Source: tonemap.SourceDolbyVision}},
+	}
+	for name, tt := range tests {
+		got := sheetsToneMap(tt.file)
+		if (got == nil) != (tt.want == nil) || (got != nil && *got != *tt.want) {
+			t.Errorf("%s: tone map %+v, want %+v", name, got, tt.want)
+		}
+	}
+}
diff --git a/internal/uploads/session_test.go b/internal/uploads/session_test.go
index 4ee74fef47..2ccf41fdbe 100644
--- a/internal/uploads/session_test.go
+++ b/internal/uploads/session_test.go
@@ -142,8 +142,7 @@ func TestManagerAcceptsDuplicateReceivedChunk(t *testing.T) {
 	if err != nil {
 		t.Fatalf("Create() error = %v", err)
 	}
-	_, err = manager.PutChunk(context.Background(), session.ID, 0, bytes.NewReader([]byte("abcd")), 4)
-	if err != nil {
+	if _, err := manager.PutChunk(context.Background(), session.ID, 0, bytes.NewReader([]byte("abcd")), 4); err != nil {
 		t.Fatalf("PutChunk(0) error = %v", err)
 	}
 	info, err := manager.PutChunk(context.Background(), session.ID, 0, bytes.NewReader([]byte("zzzz")), 4)
diff --git a/internal/usercollections/sync.go b/internal/usercollections/sync.go
index 2367be6e6d..1799305d35 100644
--- a/internal/usercollections/sync.go
+++ b/internal/usercollections/sync.go
@@ -35,10 +35,8 @@ type Service struct {
 	httpClient    *http.Client
 	logger        *slog.Logger
 
-	TMDBCollections    catalog.TMDBCollectionFetcher
-	TMDBLists          catalog.TMDBListFetcher
-	TraktCollections   catalog.TraktCollectionFetcher
-	TraktTokenResolver catalog.TraktAccessTokenResolver
+	TMDBCollections catalog.TMDBCollectionFetcher
+	TMDBLists       catalog.TMDBListFetcher
 
 	// Collages builds the collage of a synced collection without an uploaded
 	// or imported poster; nil when artwork storage is not configured.
@@ -117,8 +115,6 @@ func (s *Service) RunSync(ctx context.Context, userID int, store userstore.UserS
 		match = s.matchTMDB
 	case SourceModeTMDBList:
 		match = s.matchTMDBList
-	case SourceModeTraktPreset:
-		match = s.matchTrakt
 	default:
 		return nil, nil, ErrSyncUnsupported
 	}
@@ -264,7 +260,7 @@ func (s *Service) matchMDBList(ctx context.Context, collection *userstore.Collec
 		if entry.ID > 0 {
 			tmdb = fmt.Sprintf("%d", entry.ID)
 		}
-		return resolveCandidate(lookup, itemType, tvdb, tmdb, entry.IMDbID)
+		return lookup.Resolve(itemType, tvdb, tmdb, entry.IMDbID)
 	}), nil
 }
 
@@ -277,30 +273,6 @@ func mdbListItemType(entry mdblistEntry) string {
 	}
 }
 
-// resolveCandidate picks a content_id from a batch lookup using the standard
-// TVDB → TMDB → IMDb priority shared with admin sync.
-func resolveCandidate(lookup *catalog.ExternalIDLookup, itemType, tvdbID, tmdbID, imdbID string) string {
-	if lookup == nil {
-		return ""
-	}
-	if itemType == itemTypeSeries && tvdbID != "" {
-		if id := lookup.ByTVDB[tvdbID]; id != "" {
-			return id
-		}
-	}
-	if tmdbID != "" {
-		if id := lookup.ByTMDB[tmdbID]; id != "" {
-			return id
-		}
-	}
-	if imdbID != "" {
-		if id := lookup.ByIMDb[imdbID]; id != "" {
-			return id
-		}
-	}
-	return ""
-}
-
 // matchEntries resolves each of total source entries to its catalog
 // content_id, in source order.
 func matchEntries(total int, resolve func(i int) string) []string {
@@ -408,7 +380,7 @@ func (s *Service) matchTMDB(ctx context.Context, _ *userstore.Collection, cfg So
 		// transport error embeds the request URL, which carries the API key.
 		return nil, fmt.Errorf("fetching TMDB preset: %w", logredact.SanitizeURLError(err))
 	}
-	return s.matchTMDBEntries(ctx, results)
+	return catalog.MatchTMDBEntries(ctx, s.items, s.TMDBCollections, results)
 }
 
 // ── TMDB lists ───────────────────────────────────────────────────────────────
@@ -429,129 +401,7 @@ func (s *Service) matchTMDBList(ctx context.Context, collection *userstore.Colle
 	if err != nil {
 		return nil, fmt.Errorf("fetching TMDB list %d: %w", listID, logredact.SanitizeURLError(err))
 	}
-	return s.matchTMDBEntries(ctx, results)
-}
-
-// matchTMDBEntries matches fetched TMDB entries against the catalog in source
-// order. Shared by the TMDB preset and list sources.
-func (s *Service) matchTMDBEntries(ctx context.Context, results []catalog.TMDBCollectionEntry) ([]string, error) {
-	// TMDB returns mixed-media-type results (the "trending all" preset and
-	// user lists can emit both movie and tv). Batch by item type so each gets
-	// a single catalog lookup instead of N round-trips through GetByExternalID.
-	var movieBatch, seriesBatch catalog.ExternalIDBatch
-	for _, entry := range results {
-		batch := &movieBatch
-		if entry.MediaType == "tv" {
-			batch = &seriesBatch
-		}
-		if entry.ID > 0 {
-			batch.TMDBIDs = append(batch.TMDBIDs, fmt.Sprintf("%d", entry.ID))
-		}
-		if entry.IMDbID != "" {
-			batch.IMDbIDs = append(batch.IMDbIDs, entry.IMDbID)
-		}
-		if entry.TVDBID > 0 && entry.MediaType == "tv" {
-			batch.TVDBIDs = append(batch.TVDBIDs, fmt.Sprintf("%d", entry.TVDBID))
-		}
-	}
-	movieLookup, err := s.items.GetByExternalIDs(ctx, movieBatch, "movie")
-	if err != nil {
-		return nil, err
-	}
-	seriesLookup, err := s.items.GetByExternalIDs(ctx, seriesBatch, itemTypeSeries)
-	if err != nil {
-		return nil, err
-	}
-
-	return matchEntries(len(results), func(i int) string {
-		entry := results[i]
-		itemType := "movie"
-		lookup := movieLookup
-		if entry.MediaType == "tv" {
-			itemType = itemTypeSeries
-			lookup = seriesLookup
-		}
-		var tmdb string
-		if entry.ID > 0 {
-			tmdb = fmt.Sprintf("%d", entry.ID)
-		}
-		var tvdb string
-		if entry.TVDBID > 0 {
-			tvdb = fmt.Sprintf("%d", entry.TVDBID)
-		}
-		return resolveCandidate(lookup, itemType, tvdb, tmdb, entry.IMDbID)
-	}), nil
-}
-
-// ── Trakt presets ────────────────────────────────────────────────────────────
-
-func (s *Service) matchTrakt(ctx context.Context, collection *userstore.Collection, cfg SourceConfig) ([]string, error) {
-	if s.TraktCollections == nil {
-		return nil, errors.New("Trakt sync requires configured Trakt access") //nolint:staticcheck // ST1005: user-facing sync status, matches library collection wording
-	}
-	preset := strings.TrimSpace(cfg.Preset)
-	mediaType := strings.TrimSpace(cfg.MediaType)
-	if mediaType == "" {
-		mediaType = "movie"
-	}
-	if preset != "trending" && preset != "popular" && preset != "recommended" {
-		return nil, fmt.Errorf("unsupported Trakt preset: %s", preset)
-	}
-
-	accessToken := ""
-	if preset == "recommended" {
-		profileID := strings.TrimSpace(cfg.ProfileID)
-		if profileID == "" {
-			profileID = collection.CreatorProfileID
-		}
-		if profileID == "" || s.TraktTokenResolver == nil {
-			return nil, errors.New("Trakt recommendations require a profile binding") //nolint:staticcheck // ST1005: user-facing sync status, matches library collection wording
-		}
-		token, err := s.TraktTokenResolver.ResolveTraktAccessToken(ctx, profileID)
-		if err != nil {
-			return nil, fmt.Errorf("resolving Trakt access token: %w", err)
-		}
-		accessToken = token
-	}
-
-	limit := collectionutil.SourceFetchLimit(cfg.Limit)
-	results, err := s.TraktCollections.GetCollectionPreset(ctx, preset, mediaType, limit, accessToken)
-	if err != nil {
-		return nil, fmt.Errorf("fetching Trakt preset: %w", err)
-	}
-
-	itemType := "movie"
-	if mediaType == "tv" {
-		itemType = itemTypeSeries
-	}
-	var batch catalog.ExternalIDBatch
-	for _, entry := range results {
-		if entry.TMDBID > 0 {
-			batch.TMDBIDs = append(batch.TMDBIDs, fmt.Sprintf("%d", entry.TMDBID))
-		}
-		if entry.IMDbID != "" {
-			batch.IMDbIDs = append(batch.IMDbIDs, entry.IMDbID)
-		}
-		if entry.TVDBID > 0 && itemType == itemTypeSeries {
-			batch.TVDBIDs = append(batch.TVDBIDs, fmt.Sprintf("%d", entry.TVDBID))
-		}
-	}
-	lookup, err := s.items.GetByExternalIDs(ctx, batch, itemType)
-	if err != nil {
-		return nil, err
-	}
-
-	return matchEntries(len(results), func(i int) string {
-		entry := results[i]
-		var tmdb, tvdb string
-		if entry.TMDBID > 0 {
-			tmdb = fmt.Sprintf("%d", entry.TMDBID)
-		}
-		if entry.TVDBID > 0 {
-			tvdb = fmt.Sprintf("%d", entry.TVDBID)
-		}
-		return resolveCandidate(lookup, itemType, tvdb, tmdb, entry.IMDbID)
-	}), nil
+	return catalog.MatchTMDBEntries(ctx, s.items, s.TMDBLists, results)
 }
 
 // ── Result application ───────────────────────────────────────────────────────
diff --git a/internal/usercollections/types.go b/internal/usercollections/types.go
index 1d47e03a42..02e2d6462a 100644
--- a/internal/usercollections/types.go
+++ b/internal/usercollections/types.go
@@ -3,7 +3,7 @@
 // library_collections subsystem).
 //
 // User collections live in user_personal_collections and use external sources
-// (TMDB / Trakt / MDBList) the same way admin collections do. A sync keeps
+// (TMDB / MDBList) the same way admin collections do. A sync keeps
 // only titles the collection's owner profile can access (its libraries and
 // rating limit), so an item limit fills with titles the owner can see. Catalog
 // reads still limit what each viewer sees to that viewer's own access.
@@ -27,14 +27,13 @@ func CanonicalMDBListURL(url string) (string, error) {
 type SourceMode string
 
 const (
-	SourceModeMDBList     SourceMode = "mdblist_json"
-	SourceModeTMDBPreset  SourceMode = "tmdb_preset"
-	SourceModeTMDBList    SourceMode = "tmdb_list"
-	SourceModeTraktPreset SourceMode = "trakt_preset"
+	SourceModeMDBList    SourceMode = "mdblist_json"
+	SourceModeTMDBPreset SourceMode = "tmdb_preset"
+	SourceModeTMDBList   SourceMode = "tmdb_list"
 )
 
 // MinSyncIntervalHours is the smallest interval (in hours between fires) that
-// a user is allowed to schedule. Stricter than admin to keep TMDB/Trakt API
+// a user is allowed to schedule. Stricter than admin to keep TMDB API
 // quota bounded across many users.
 const MinSyncIntervalHours = 24
 
@@ -75,7 +74,7 @@ func ParseSourceConfig(raw string) (SourceConfig, error) {
 
 // DisplayURL produces a stable, human-friendly identifier for the source —
 // stored on the row so list views can render it without reparsing
-// SourceConfig. Mirrors the admin tmdb://… / trakt://… scheme.
+// SourceConfig. Mirrors the admin tmdb://… scheme.
 func (c SourceConfig) DisplayURL() string {
 	switch c.Mode {
 	case SourceModeMDBList:
@@ -87,11 +86,6 @@ func (c SourceConfig) DisplayURL() string {
 		return fmt.Sprintf("tmdb://%s/%s", c.Preset, c.MediaType)
 	case SourceModeTMDBList:
 		return c.URL
-	case SourceModeTraktPreset:
-		if c.Preset == "recommended" {
-			return fmt.Sprintf("trakt://%s/%s/%s", c.Preset, c.MediaType, c.ProfileID)
-		}
-		return fmt.Sprintf("trakt://%s/%s", c.Preset, c.MediaType)
 	default:
 		return ""
 	}
diff --git a/internal/userdb/bridgeimport/preflight.go b/internal/userdb/bridgeimport/preflight.go
index c430697b99..e233f0e897 100644
--- a/internal/userdb/bridgeimport/preflight.go
+++ b/internal/userdb/bridgeimport/preflight.go
@@ -114,16 +114,17 @@ func Inspect(ctx context.Context, path string, accountID int64) (Report, error)
 	if err != nil {
 		return r, errors.New("cannot enumerate source tables")
 	}
+	defer func() { _ = rows.Close() }()
 	var names []string
 	for rows.Next() {
 		var name string
 		if err := rows.Scan(&name); err != nil {
-			_ = rows.Close()
 			return r, errors.New("cannot read table inventory")
 		}
 		names = append(names, name)
 	}
 	err = rows.Err()
+	// Close before the per-table queries below; the deferred Close is then a no-op.
 	if closeErr := rows.Close(); err == nil {
 		err = closeErr
 	}
diff --git a/internal/userdb/bridgeimport/source_schema.go b/internal/userdb/bridgeimport/source_schema.go
index 9e4b34933c..7cf9488cbf 100644
--- a/internal/userdb/bridgeimport/source_schema.go
+++ b/internal/userdb/bridgeimport/source_schema.go
@@ -19,20 +19,20 @@ func validateSourceSchema(ctx context.Context, tx *sql.Tx) error {
 	if err != nil {
 		return errors.New("cannot inspect source schema")
 	}
+	defer func() { _ = rows.Close() }()
 	found := map[string]bool{}
 	for rows.Next() {
 		var name string
 		if err := rows.Scan(&name); err != nil {
-			_ = rows.Close()
 			return errors.New("cannot inspect source schema")
 		}
 		if _, ok := sourceColumns[name]; !ok {
-			_ = rows.Close()
 			return errors.New("unmapped source table")
 		}
 		found[name] = true
 	}
 	err = rows.Err()
+	// Close before the per-table queries below; the deferred Close is then a no-op.
 	_ = rows.Close()
 	if err != nil {
 		return errors.New("cannot inspect source schema")
@@ -41,34 +41,8 @@ func validateSourceSchema(ctx context.Context, tx *sql.Tx) error {
 		return errors.New("missing source table")
 	}
 	for _, mapping := range Manifest() {
-		expected := map[string]SourceColumn{}
-		for _, column := range sourceColumns[mapping.Source] {
-			expected[column.Name] = column
-		}
-		columns, err := tx.QueryContext(ctx, "SELECT name, type, [notnull], pk, hidden FROM pragma_table_xinfo(?) ORDER BY cid", mapping.Source)
-		if err != nil {
-			return errors.New("cannot inspect source columns")
-		}
-		i := 0
-		for columns.Next() {
-			var name, declared string
-			var required bool
-			var pk, hidden int
-			if err := columns.Scan(&name, &declared, &required, &pk, &hidden); err != nil {
-				_ = columns.Close()
-				return errors.New("cannot inspect source columns")
-			}
-			column, known := expected[name]
-			if hidden != 0 || !known || strings.ToUpper(declared) != column.SQLiteType || required != column.NotNull || pk != column.PrimaryKey {
-				_ = columns.Close()
-				return fmt.Errorf("unsupported source columns in %s", mapping.Source)
-			}
-			i++
-		}
-		err = columns.Err()
-		_ = columns.Close()
-		if err != nil || i != len(expected) {
-			return fmt.Errorf("incomplete source columns in %s", mapping.Source)
+		if err := validateSourceColumns(ctx, tx, mapping.Source); err != nil {
+			return err
 		}
 		if mapping.Target == "" && mapping.Source != sourceCollectionAudiences {
 			var count int64
@@ -83,3 +57,35 @@ func validateSourceSchema(ctx context.Context, tx *sql.Tx) error {
 	}
 	return nil
 }
+
+// validateSourceColumns checks that table has exactly the columns
+// sourceColumns lists for it, with matching type, nullability, and key role.
+func validateSourceColumns(ctx context.Context, tx *sql.Tx, table string) error {
+	expected := map[string]SourceColumn{}
+	for _, column := range sourceColumns[table] {
+		expected[column.Name] = column
+	}
+	columns, err := tx.QueryContext(ctx, "SELECT name, type, [notnull], pk, hidden FROM pragma_table_xinfo(?) ORDER BY cid", table)
+	if err != nil {
+		return errors.New("cannot inspect source columns")
+	}
+	defer func() { _ = columns.Close() }()
+	i := 0
+	for columns.Next() {
+		var name, declared string
+		var required bool
+		var pk, hidden int
+		if err := columns.Scan(&name, &declared, &required, &pk, &hidden); err != nil {
+			return errors.New("cannot inspect source columns")
+		}
+		column, known := expected[name]
+		if hidden != 0 || !known || strings.ToUpper(declared) != column.SQLiteType || required != column.NotNull || pk != column.PrimaryKey {
+			return fmt.Errorf("unsupported source columns in %s", table)
+		}
+		i++
+	}
+	if err := columns.Err(); err != nil || i != len(expected) {
+		return fmt.Errorf("incomplete source columns in %s", table)
+	}
+	return nil
+}
diff --git a/internal/userdb/conformance_test.go b/internal/userdb/conformance_test.go
index 691fb56a7a..f251775d1a 100644
--- a/internal/userdb/conformance_test.go
+++ b/internal/userdb/conformance_test.go
@@ -64,6 +64,8 @@ func TestSQLiteProgressPage(t *testing.T) {
 // text comparison of added_at to the RFC 3339 form AddFavoriteAt writes.
 func TestSQLitePersonalListPage(t *testing.T) {
 	storetest.RunPersonalListPage(t, newConformanceStore)
+	storetest.RunPersonalListMembership(t, newConformanceStore)
+	storetest.RunNotInterested(t, newConformanceStore)
 }
 
 func TestSQLiteHistoryEntryOnce(t *testing.T) {
@@ -97,3 +99,7 @@ func TestSQLiteCollectionSharing(t *testing.T) {
 func TestSQLiteProfilePINRevision(t *testing.T) {
 	storetest.RunProfilePINRevision(t, newConformanceStore)
 }
+
+func TestSQLiteDeleteProfileRemovesProfileState(t *testing.T) {
+	storetest.RunDeleteProfileRemovesProfileState(t, newConformanceStore, false)
+}
diff --git a/internal/userdb/device_settings.go b/internal/userdb/device_settings.go
index d736c9c727..e50376522b 100644
--- a/internal/userdb/device_settings.go
+++ b/internal/userdb/device_settings.go
@@ -16,10 +16,10 @@ func (s *SQLiteUserStore) ListDeviceSettingsPage(ctx context.Context, opts users
 	if err := opts.Validate(); err != nil {
 		return nil, err
 	}
-	args := []any{opts.ProfileID, opts.ProfileID}
-	sqlText := `SELECT d.profile_id,d.device_id,d.device_name,d.device_platform,d.last_seen_at,COALESCE(p.name,''),COALESCE((SELECT json_group_array(k.key) FROM user_setting_values k WHERE k.scope='profile_device' AND k.profile_id=d.profile_id AND k.device_id=d.device_id), '[]')
+	args := []any{opts.ProfileID, opts.ProfileID, opts.DeviceID, opts.DeviceID}
+	sqlText := `SELECT d.profile_id,d.device_id,d.device_name,COALESCE(d.custom_name,''),d.device_platform,d.last_seen_at,COALESCE(p.name,''),COALESCE((SELECT json_group_array(k.key) FROM user_setting_values k WHERE k.scope='profile_device' AND k.profile_id=d.profile_id AND k.device_id=d.device_id), '[]')
  FROM user_devices d LEFT JOIN profiles p ON p.id=d.profile_id
- WHERE (?='' OR d.profile_id=?)`
+ WHERE (?='' OR d.profile_id=?) AND (?='' OR d.device_id=?)`
 	if opts.After != nil {
 		sqlText += ` AND (d.last_seen_at < ? OR (d.last_seen_at = ? AND (d.profile_id,d.device_id) > (?,?)))`
 		args = append(args, opts.After.LastSeenAt, opts.After.LastSeenAt, opts.After.ProfileID, opts.After.DeviceID)
@@ -35,7 +35,7 @@ func (s *SQLiteUserStore) ListDeviceSettingsPage(ctx context.Context, opts users
 	for rows.Next() {
 		var entry userstore.DeviceSettingsEntry
 		var raw []byte
-		if err := rows.Scan(&entry.ProfileID, &entry.DeviceID, &entry.DeviceName, &entry.DevicePlatform, &entry.LastSeenAt, &entry.ProfileName, &raw); err != nil {
+		if err := rows.Scan(&entry.ProfileID, &entry.DeviceID, &entry.DeviceName, &entry.CustomName, &entry.DevicePlatform, &entry.LastSeenAt, &entry.ProfileName, &raw); err != nil {
 			return nil, err
 		}
 		var keys []string
@@ -64,14 +64,15 @@ func (s *SQLiteUserStore) RemoveDeviceSettings(ctx context.Context, profileID, d
 		if err != nil {
 			return err
 		}
+		defer func() { _ = rows.Close() }()
 		for rows.Next() {
 			var key string
 			if err := rows.Scan(&key); err != nil {
-				_ = rows.Close()
 				return err
 			}
 			keys = append(keys, key)
 		}
+		// Close before the deletes below; the deferred Close is then a no-op.
 		if err := rows.Close(); err != nil {
 			return err
 		}
@@ -96,3 +97,18 @@ func (s *SQLiteUserStore) RemoveDeviceSettings(ctx context.Context, profileID, d
 	}
 	return keys, nil
 }
+
+func (s *SQLiteUserStore) RenameDevice(ctx context.Context, profileID, deviceID, name string) error {
+	result, err := s.db.ExecContext(ctx, `UPDATE user_devices SET custom_name=NULLIF(?,'') WHERE profile_id=? AND device_id=?`, name, profileID, deviceID)
+	if err != nil {
+		return err
+	}
+	changed, err := result.RowsAffected()
+	if err != nil {
+		return err
+	}
+	if changed == 0 {
+		return userstore.ErrDeviceNotFound
+	}
+	return nil
+}
diff --git a/internal/userdb/favorites.go b/internal/userdb/favorites.go
index 8e4ed67f6b..8cf8f560e3 100644
--- a/internal/userdb/favorites.go
+++ b/internal/userdb/favorites.go
@@ -19,10 +19,9 @@ type WatchlistEntry = userstore.WatchlistEntry
 // ---------- Favorites ----------
 
 // AddFavorite adds a media item to a profile's favorites.
-// If the item is already a favorite, the operation is a no-op.
-func AddFavorite(db *sql.DB, profileID, mediaItemID string) error {
-	_, err := AddFavoriteAt(db, profileID, mediaItemID, time.Now().UTC())
-	return err
+// If the item is already a favorite, the operation is a no-op that reports false.
+func AddFavorite(db *sql.DB, profileID, mediaItemID string) (bool, error) {
+	return AddFavoriteAt(db, profileID, mediaItemID, time.Now().UTC())
 }
 
 func AddFavoriteAt(db *sql.DB, profileID, mediaItemID string, addedAt time.Time) (bool, error) {
@@ -40,13 +39,21 @@ func AddFavoriteAt(db *sql.DB, profileID, mediaItemID string, addedAt time.Time)
 	return rows > 0, nil
 }
 
-// RemoveFavorite removes a media item from a profile's favorites.
-func RemoveFavorite(db *sql.DB, profileID, mediaItemID string) error {
-	_, err := db.Exec(
+// RemoveFavorite removes a media item from a profile's favorites and reports
+// whether it was there.
+func RemoveFavorite(db *sql.DB, profileID, mediaItemID string) (bool, error) {
+	result, err := db.Exec(
 		`DELETE FROM favorites WHERE profile_id = ? AND media_item_id = ?`,
 		profileID, mediaItemID,
 	)
-	return err
+	if err != nil {
+		return false, err
+	}
+	rows, err := result.RowsAffected()
+	if err != nil {
+		return false, err
+	}
+	return rows > 0, nil
 }
 
 // ListFavorites returns a paginated list of favorites for a profile,
@@ -196,10 +203,9 @@ func ListFavoritesByMediaItems(db *sql.DB, profileID string, mediaItemIDs []stri
 // ---------- Watchlist ----------
 
 // AddToWatchlist adds a media item to a profile's watchlist.
-// If the item is already on the watchlist, the operation is a no-op.
-func AddToWatchlist(db *sql.DB, profileID, mediaItemID string) error {
-	_, err := AddToWatchlistAt(db, profileID, mediaItemID, time.Now().UTC())
-	return err
+// If the item is already on the watchlist, the operation is a no-op that reports false.
+func AddToWatchlist(db *sql.DB, profileID, mediaItemID string) (bool, error) {
+	return AddToWatchlistAt(db, profileID, mediaItemID, time.Now().UTC())
 }
 
 // AddToWatchlistAt adds a media item to a profile's watchlist with an explicit
@@ -219,13 +225,21 @@ func AddToWatchlistAt(db *sql.DB, profileID, mediaItemID string, addedAt time.Ti
 	return rows > 0, nil
 }
 
-// RemoveFromWatchlist removes a media item from a profile's watchlist.
-func RemoveFromWatchlist(db *sql.DB, profileID, mediaItemID string) error {
-	_, err := db.Exec(
+// RemoveFromWatchlist removes a media item from a profile's watchlist and
+// reports whether it was there.
+func RemoveFromWatchlist(db *sql.DB, profileID, mediaItemID string) (bool, error) {
+	result, err := db.Exec(
 		`DELETE FROM watchlist WHERE profile_id = ? AND media_item_id = ?`,
 		profileID, mediaItemID,
 	)
-	return err
+	if err != nil {
+		return false, err
+	}
+	rows, err := result.RowsAffected()
+	if err != nil {
+		return false, err
+	}
+	return rows > 0, nil
 }
 
 // ReplaceWatchlistOrder assigns sort_index 0..N-1 to the given ids in order and
diff --git a/internal/userdb/migrate.go b/internal/userdb/migrate.go
index 2119a7803e..58e15fe010 100644
--- a/internal/userdb/migrate.go
+++ b/internal/userdb/migrate.go
@@ -1,11 +1,12 @@
 package userdb
 
 import (
+	"context"
 	"database/sql"
 	"fmt"
 )
 
-const schemaVersion = 31
+const schemaVersion = 33
 
 func runMigrations(db *sql.DB) error {
 	version, err := userVersion(db)
@@ -321,6 +322,26 @@ func runMigrations(db *sql.DB) error {
 			return err
 		}
 	}
+	if version < 32 {
+		// A fresh user_devices table already has the column. The Postgres
+		// store adds the same column in 20261015140728_add_user_devices_custom_name.sql.
+		if !columnExists(tx, "user_devices", "custom_name") {
+			if _, err := tx.Exec(`ALTER TABLE user_devices ADD COLUMN custom_name TEXT`); err != nil {
+				return fmt.Errorf("migration v32 failed: %w", err)
+			}
+		}
+		if _, err := tx.Exec("PRAGMA user_version = 32"); err != nil {
+			return err
+		}
+	}
+	if version < 33 {
+		if err := retireTraktSectionOverrides(tx); err != nil {
+			return fmt.Errorf("migration v33 failed: %w", err)
+		}
+		if _, err := tx.ExecContext(context.Background(), "PRAGMA user_version = 33"); err != nil {
+			return err
+		}
+	}
 	if _, err := tx.Exec(profilePINRevisionSchema); err != nil {
 		return fmt.Errorf("creating profile PIN revision trigger: %w", err)
 	}
diff --git a/internal/userdb/migrate_v32_test.go b/internal/userdb/migrate_v32_test.go
new file mode 100644
index 0000000000..b20fb2d4ef
--- /dev/null
+++ b/internal/userdb/migrate_v32_test.go
@@ -0,0 +1,51 @@
+package userdb
+
+import (
+	"context"
+	"database/sql"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/userstore"
+)
+
+// A v31 store's user_devices table has no custom_name column; v32 adds it and
+// keeps the registered devices, which can then be renamed.
+func TestMigrateToV32AddsDeviceCustomName(t *testing.T) {
+	db, err := sql.Open("sqlite3", ":memory:")
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	db.SetMaxOpenConns(1)
+	t.Cleanup(func() { _ = db.Close() })
+	if err := InitSchema(db); err != nil {
+		t.Fatalf("InitSchema: %v", err)
+	}
+	if _, err := db.Exec(`DROP TABLE user_devices;
+CREATE TABLE user_devices (
+    profile_id TEXT NOT NULL,
+    device_id TEXT NOT NULL,
+    device_name TEXT NOT NULL DEFAULT '',
+    device_platform TEXT NOT NULL DEFAULT '',
+    last_seen_at TEXT NOT NULL,
+    PRIMARY KEY (profile_id, device_id)
+);
+INSERT INTO user_devices (profile_id, device_id, device_name, last_seen_at) VALUES ('p1', 'tv', 'Apple TV', '2026-10-01T00:00:00Z');
+PRAGMA user_version = 31;`); err != nil {
+		t.Fatalf("seed v31 store: %v", err)
+	}
+
+	if err := runMigrations(db); err != nil {
+		t.Fatalf("runMigrations: %v", err)
+	}
+	if version, err := userVersion(db); err != nil || version != schemaVersion {
+		t.Fatalf("user_version = %d, %v; want %d", version, err, schemaVersion)
+	}
+	store := NewSQLiteUserStore(db)
+	if err := store.RenameDevice(context.Background(), "p1", "tv", "Living Room"); err != nil {
+		t.Fatalf("RenameDevice after migration: %v", err)
+	}
+	page, err := store.ListDeviceSettingsPage(context.Background(), userstore.DevicePageOptions{Limit: 10})
+	if err != nil || len(page) != 1 || page[0].DeviceName != "Apple TV" || page[0].CustomName != "Living Room" {
+		t.Fatalf("migrated device = %+v, %v", page, err)
+	}
+}
diff --git a/internal/userdb/migrate_v33_test.go b/internal/userdb/migrate_v33_test.go
new file mode 100644
index 0000000000..d9f793cbca
--- /dev/null
+++ b/internal/userdb/migrate_v33_test.go
@@ -0,0 +1,81 @@
+package userdb
+
+import (
+	"database/sql"
+	"encoding/json"
+	"reflect"
+	"testing"
+)
+
+// v33 rewrites the section overrides that point at Trakt: Trakt trending
+// becomes TMDB weekly trending, a row the profile added for it is hidden, a
+// collection row drops its Trakt marker, and every other override, including
+// one whose config does not parse, is left as it was.
+func TestMigrateToV33RetiresTraktSectionOverrides(t *testing.T) {
+	db, err := sql.Open("sqlite3", ":memory:")
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	db.SetMaxOpenConns(1)
+	t.Cleanup(func() { _ = db.Close() })
+	if err := InitSchema(db); err != nil {
+		t.Fatalf("InitSchema: %v", err)
+	}
+	if _, err := db.Exec(`
+INSERT INTO profile_section_overrides (id, profile_id, scope, section_id, hidden, config, is_user_added, user_section_type, user_config, created_at, updated_at) VALUES
+    ('own-trending', 'p1', 'home', NULL, 0, NULL, 1, 'trending_discover', '{"source":"trakt","window":"day"}', 'now', 'now'),
+    ('linked-trending', 'p1', 'home', 'admin-trending', 0, '{"source":"trakt"}', 0, NULL, NULL, 'now', 'now'),
+    ('linked-collection', 'p1', 'home', 'admin-collection', 0, '{"library_collection_id":"c1","source_provider":"trakt"}', 0, NULL, NULL, 'now', 'now'),
+    ('tmdb-trending', 'p1', 'home', NULL, 0, NULL, 1, 'trending_discover', '{"source":"tmdb","window":"day"}', 'now', 'now'),
+    ('unparsed', 'p1', 'home', NULL, 0, NULL, 1, 'custom_filter', '{"title":"trakt', 'now', 'now');
+PRAGMA user_version = 32;`); err != nil {
+		t.Fatalf("seed v32 store: %v", err)
+	}
+
+	if err := runMigrations(db); err != nil {
+		t.Fatalf("runMigrations: %v", err)
+	}
+	if version, err := userVersion(db); err != nil || version != schemaVersion {
+		t.Fatalf("user_version = %d, %v; want %d", version, err, schemaVersion)
+	}
+
+	type row struct {
+		hidden             bool
+		config, userConfig sql.NullString
+	}
+	read := func(id string) row {
+		t.Helper()
+		var r row
+		if err := db.QueryRow(`SELECT hidden, config, user_config FROM profile_section_overrides WHERE id = ?`, id).Scan(&r.hidden, &r.config, &r.userConfig); err != nil {
+			t.Fatalf("read %s: %v", id, err)
+		}
+		return r
+	}
+	object := func(raw sql.NullString) map[string]any {
+		t.Helper()
+		var v map[string]any
+		if err := json.Unmarshal([]byte(raw.String), &v); err != nil {
+			t.Fatalf("config %q: %v", raw.String, err)
+		}
+		return v
+	}
+
+	own := read("own-trending")
+	if !own.hidden || own.config.Valid || !reflect.DeepEqual(object(own.userConfig), map[string]any{"source": "tmdb", "window": "week"}) {
+		t.Fatalf("own trending row = %+v, want hidden TMDB weekly", own)
+	}
+	linked := read("linked-trending")
+	if linked.hidden || !reflect.DeepEqual(object(linked.config), map[string]any{"source": "tmdb", "window": "week"}) {
+		t.Fatalf("linked trending row = %+v, want visible TMDB weekly", linked)
+	}
+	collection := read("linked-collection")
+	if collection.hidden || !reflect.DeepEqual(object(collection.config), map[string]any{"library_collection_id": "c1"}) {
+		t.Fatalf("collection row = %+v, want the Trakt marker dropped", collection)
+	}
+	if tmdb := read("tmdb-trending"); tmdb.hidden || tmdb.userConfig.String != `{"source":"tmdb","window":"day"}` {
+		t.Fatalf("TMDB row = %+v, want unchanged", tmdb)
+	}
+	if unparsed := read("unparsed"); unparsed.hidden || unparsed.userConfig.String != `{"title":"trakt` {
+		t.Fatalf("unparsed row = %+v, want unchanged", unparsed)
+	}
+}
diff --git a/internal/userdb/navigation_shortcuts_migrate.go b/internal/userdb/navigation_shortcuts_migrate.go
index 4f36debdeb..b3d924d562 100644
--- a/internal/userdb/navigation_shortcuts_migrate.go
+++ b/internal/userdb/navigation_shortcuts_migrate.go
@@ -42,6 +42,7 @@ SELECT legacy.profile_id, legacy.value, legacy.created_at, legacy.updated_at
 	if err != nil {
 		return fmt.Errorf("reading sidebar pins for navigation shortcut migration: %w", err)
 	}
+	defer func() { _ = rows.Close() }()
 	type source struct {
 		profileID, raw, createdAt, updatedAt string
 	}
@@ -49,11 +50,11 @@ SELECT legacy.profile_id, legacy.value, legacy.created_at, legacy.updated_at
 	for rows.Next() {
 		var entry source
 		if err := rows.Scan(&entry.profileID, &entry.raw, &entry.createdAt, &entry.updatedAt); err != nil {
-			_ = rows.Close()
 			return fmt.Errorf("scanning sidebar pins for navigation shortcut migration: %w", err)
 		}
 		sources = append(sources, entry)
 	}
+	// Close before the inserts below; the deferred Close is then a no-op.
 	if err := rows.Close(); err != nil {
 		return fmt.Errorf("closing sidebar pins migration rows: %w", err)
 	}
diff --git a/internal/userdb/not_interested.go b/internal/userdb/not_interested.go
new file mode 100644
index 0000000000..f877454e3a
--- /dev/null
+++ b/internal/userdb/not_interested.go
@@ -0,0 +1,115 @@
+package userdb
+
+import (
+	"database/sql"
+	"errors"
+	"strings"
+	"time"
+
+	"github.com/prairie-server/prairie-server/internal/userstore"
+)
+
+// ---------- Not interested ----------
+
+// MarkNotInterested records a profile's Not interested mark on a media item
+// and reports whether it was new.
+func MarkNotInterested(db *sql.DB, profileID, mediaItemID string) (bool, error) {
+	result, err := db.Exec(
+		`INSERT OR IGNORE INTO not_interested (profile_id, media_item_id, added_at) VALUES (?, ?, ?)`,
+		profileID, mediaItemID, time.Now().UTC().Format(time.RFC3339),
+	)
+	if err != nil {
+		return false, err
+	}
+	rows, err := result.RowsAffected()
+	if err != nil {
+		return false, err
+	}
+	return rows > 0, nil
+}
+
+// UnmarkNotInterested removes a profile's mark and reports whether it was
+// there.
+func UnmarkNotInterested(db *sql.DB, profileID, mediaItemID string) (bool, error) {
+	result, err := db.Exec(
+		`DELETE FROM not_interested WHERE profile_id = ? AND media_item_id = ?`,
+		profileID, mediaItemID,
+	)
+	if err != nil {
+		return false, err
+	}
+	rows, err := result.RowsAffected()
+	if err != nil {
+		return false, err
+	}
+	return rows > 0, nil
+}
+
+// GetNotInterested answers a profile's mark on a media item, nil when the
+// item is not marked.
+func GetNotInterested(db *sql.DB, profileID, mediaItemID string) (*userstore.NotInterestedEntry, error) {
+	var e userstore.NotInterestedEntry
+	err := db.QueryRow(
+		`SELECT profile_id, media_item_id, added_at FROM not_interested WHERE profile_id = ? AND media_item_id = ?`,
+		profileID, mediaItemID,
+	).Scan(&e.ProfileID, &e.MediaItemID, &e.AddedAt)
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	return &e, nil
+}
+
+// ListNotInterestedPage pages by keyset like ListFavoritesPage.
+func ListNotInterestedPage(db *sql.DB, profileID string, after *userstore.ListKey, limit int) ([]userstore.NotInterestedEntry, error) {
+	query, args := listKeysetQuery(`SELECT profile_id, media_item_id, added_at FROM not_interested`, profileID, after, limit)
+	rows, err := db.Query(query, args...)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = rows.Close() }()
+
+	var entries []userstore.NotInterestedEntry
+	for rows.Next() {
+		var e userstore.NotInterestedEntry
+		if err := rows.Scan(&e.ProfileID, &e.MediaItemID, &e.AddedAt); err != nil {
+			return nil, err
+		}
+		entries = append(entries, e)
+	}
+	return entries, rows.Err()
+}
+
+// ListNotInterestedByMediaItems reports which of mediaItemIDs the profile
+// marked.
+func ListNotInterestedByMediaItems(db *sql.DB, profileID string, mediaItemIDs []string) (map[string]bool, error) {
+	result := make(map[string]bool, len(mediaItemIDs))
+	if len(mediaItemIDs) == 0 {
+		return result, nil
+	}
+	placeholders := make([]string, len(mediaItemIDs))
+	args := make([]any, 0, len(mediaItemIDs)+1)
+	args = append(args, profileID)
+	for i, mediaItemID := range mediaItemIDs {
+		placeholders[i] = "?"
+		args = append(args, mediaItemID)
+	}
+	rows, err := db.Query(
+		`SELECT media_item_id FROM not_interested WHERE profile_id = ? AND media_item_id IN (`+strings.Join(placeholders, ",")+`)`,
+		args...,
+	)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = rows.Close() }()
+	for rows.Next() {
+		var mediaItemID string
+		if err := rows.Scan(&mediaItemID); err != nil {
+			return nil, err
+		}
+		result[mediaItemID] = true
+	}
+	return result, rows.Err()
+}
diff --git a/internal/userdb/profiles.go b/internal/userdb/profiles.go
index 8c098be3cc..cfebfd5286 100644
--- a/internal/userdb/profiles.go
+++ b/internal/userdb/profiles.go
@@ -302,8 +302,9 @@ func updateProfile(exec preferenceSettingsExecutor, id string, u UpdateProfileIn
 	return nil
 }
 
-// DeleteProfile removes a profile and cascades deletion to favorites,
-// watchlist, watch_progress, and personal_collections (plus their items).
+// DeleteProfile removes a profile and every row of its own: lists, watch
+// progress and history, preferences, settings and personal collections
+// (plus their items), matching the Postgres store.
 func DeleteProfile(db *sql.DB, id string) error {
 	tx, err := db.Begin()
 	if err != nil {
@@ -331,7 +332,11 @@ func DeleteProfile(db *sql.DB, id string) error {
 	if err != nil {
 		return fmt.Errorf("deleting collection items for profile %s: %w", id, err)
 	}
-	if _, err := tx.Exec(`DELETE FROM personal_collection_profiles WHERE profile_id = ?`, id); err != nil {
+	if _, err := tx.Exec(`
+		DELETE FROM personal_collection_profiles
+		WHERE profile_id = ? OR collection_id IN (
+			SELECT id FROM personal_collections WHERE creator_profile_id = ?
+		)`, id, id); err != nil {
 		return fmt.Errorf("deleting collection visibility for profile %s: %w", id, err)
 	}
 
@@ -341,12 +346,22 @@ func DeleteProfile(db *sql.DB, id string) error {
 	cascadeTables := []string{
 		"favorites",
 		"watchlist",
+		"not_interested",
 		"watch_progress",
+		"watch_history",
+		"hidden_history_items",
+		"home_item_dismissals",
 		"collection_sort_preferences",
 		"personal_collections",
 		"profile_allowed_libraries",
+		sqliteAudioPreferencesTable,
+		sqliteSubtitlePreferencesTable,
 		"series_playback_preferences",
 		"library_playback_preferences",
+		"profile_onboarding",
+		"profile_section_overrides",
+		"user_devices",
+		"user_device_settings",
 		"user_setting_values",
 	}
 	for _, table := range cascadeTables {
@@ -359,6 +374,12 @@ func DeleteProfile(db *sql.DB, id string) error {
 		}
 	}
 
+	// Jellyfin display preferences carry the profile in their key.
+	prefix := userstore.ProfileDisplayPrefsPrefix(id)
+	if _, err := tx.Exec(`DELETE FROM jellycompat_displayprefs WHERE substr(prefs_id, 1, length(?)) = ?`, prefix, prefix); err != nil {
+		return fmt.Errorf("deleting display preferences for profile %s: %w", id, err)
+	}
+
 	// Delete the profile itself.
 	result, err := tx.Exec("DELETE FROM profiles WHERE id = ?", id)
 	if err != nil {
diff --git a/internal/userdb/progress.go b/internal/userdb/progress.go
index faf4839f2b..a67b8f374f 100644
--- a/internal/userdb/progress.go
+++ b/internal/userdb/progress.go
@@ -369,6 +369,51 @@ func ClearProgress(db *sql.DB, profileID, mediaItemID string) error {
 	return nil
 }
 
+// ClearResumePosition sets a visible resume position to 0 and reports whether
+// there was one, in one conditional UPDATE. Its timestamps only move forward:
+// event_at becomes the later of at and event_at, and updated_at is raised to
+// at least that because the stamp trigger copies updated_at into an unchanged
+// event_at. The comparisons use julianday() rather than MAX(): the column text
+// mixes whole-second and fractional RFC 3339 values (the Jellyfin path writes
+// fractions), and as text "…:50Z" sorts after the earlier "…:50.220Z". at
+// stays whole-second, as the other native writes are, for the text comparison
+// against hidden_before.
+func ClearResumePosition(db *sql.DB, profileID, mediaItemID string, at time.Time) (bool, error) {
+	atText := at.UTC().Format(time.RFC3339)
+	result, err := db.Exec(`
+		UPDATE watch_progress
+		SET position_seconds = 0,
+			updated_at = CASE
+				WHEN julianday(updated_at) >= julianday(?1)
+				  AND julianday(updated_at) >= julianday(COALESCE(event_at, updated_at)) THEN updated_at
+				WHEN julianday(COALESCE(event_at, updated_at)) >= julianday(?1) THEN COALESCE(event_at, updated_at)
+				ELSE ?1
+			END,
+			event_at = CASE
+				WHEN julianday(COALESCE(event_at, updated_at)) >= julianday(?1) THEN COALESCE(event_at, updated_at)
+				ELSE ?1
+			END
+		WHERE profile_id = ?2 AND media_item_id = ?3
+		  AND position_seconds > 0
+		  AND NOT EXISTS (
+			SELECT 1
+			FROM hidden_history_items hhi
+			WHERE hhi.profile_id = watch_progress.profile_id
+			  AND hhi.media_item_id = watch_progress.media_item_id
+			  AND watch_progress.updated_at <= hhi.hidden_before
+		  )`,
+		atText, profileID, mediaItemID,
+	)
+	if err != nil {
+		return false, fmt.Errorf("clearing resume position: %w", err)
+	}
+	affected, err := result.RowsAffected()
+	if err != nil {
+		return false, fmt.Errorf("clearing resume position: %w", err)
+	}
+	return affected > 0, nil
+}
+
 // MarkProgressBatch marks every (profile, media_item_id) pair as completed in a
 // single SQLite statement.
 func MarkProgressBatch(db *sql.DB, profileID string, mediaItemIDs []string, updatedAt time.Time) error {
@@ -790,6 +835,13 @@ func AddHistoryIfMissing(db *sql.DB, entry WatchHistoryEntry) (bool, error) {
 	if entry.WatchedAt == "" {
 		entry.WatchedAt = nowUTC()
 	}
+	// Timestamps here are whole-second RFC 3339 text and compare as strings,
+	// so a sub-second time ("…:05.5Z" sorts before "…:05Z") is cut to its
+	// second. A removal's watermark is whole-second too, so an import in the
+	// same second as a removal stays hidden on this store.
+	if watchedAt, err := time.Parse(time.RFC3339Nano, entry.WatchedAt); err == nil {
+		entry.WatchedAt = watchedAt.UTC().Format(time.RFC3339)
+	}
 	if entry.Source == "" {
 		entry.Source = userstore.WatchHistorySourceLegacy
 	}
diff --git a/internal/userdb/progress_test.go b/internal/userdb/progress_test.go
index 8f6a1e744f..74baa2d630 100644
--- a/internal/userdb/progress_test.go
+++ b/internal/userdb/progress_test.go
@@ -116,6 +116,51 @@ func TestAddHistoryIfMissingKeepsExistingSemantics(t *testing.T) {
 	}
 }
 
+// Imported history arrives with sub-second times. The SQLite store compares
+// its timestamps as text, so it keeps them in whole seconds: one stored that
+// way before still dedupes the replay, and a removal still hides it.
+func TestAddHistoryIfMissingStoresWholeSeconds(t *testing.T) {
+	db, err := sql.Open("sqlite3", ":memory:")
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	t.Cleanup(func() {
+		if err := db.Close(); err != nil {
+			t.Error(err)
+		}
+	})
+	if err := InitSchema(db); err != nil {
+		t.Fatalf("InitSchema: %v", err)
+	}
+
+	entry := userstore.WatchHistoryEntry{ProfileID: "profile-1", MediaItemID: "movie-1", WatchedAt: "2026-04-25T12:00:00Z", Completed: true, Source: userstore.WatchHistorySourceImport}
+	if created, err := AddHistoryIfMissing(db, entry); err != nil || !created {
+		t.Fatalf("whole-second import: created %v, err %v", created, err)
+	}
+	entry.WatchedAt = "2026-04-25T12:00:00.25Z"
+	if created, err := AddHistoryIfMissing(db, entry); err != nil || created {
+		t.Fatalf("sub-second replay: created %v, err %v; want a duplicate", created, err)
+	}
+	entry.MediaItemID = "movie-2"
+	entry.WatchedAt = "2026-04-25T12:00:01.75+00:00"
+	if created, err := AddHistoryIfMissing(db, entry); err != nil || !created {
+		t.Fatalf("sub-second import: created %v, err %v", created, err)
+	}
+	history, err := ListHistory(db, "profile-1", 10, 0)
+	if err != nil || len(history) != 2 {
+		t.Fatalf("ListHistory: %+v, err %v; want two rows", history, err)
+	}
+	if history[0].WatchedAt != "2026-04-25T12:00:01Z" {
+		t.Fatalf("stored watched_at = %q, want 2026-04-25T12:00:01Z", history[0].WatchedAt)
+	}
+	if err := RemoveHistoryItems(db, "profile-1", []string{"movie-2"}, time.Date(2026, 4, 25, 12, 0, 1, 900_000_000, time.UTC)); err != nil {
+		t.Fatal(err)
+	}
+	if created, err := AddHistoryIfMissing(db, entry); err != nil || created {
+		t.Fatalf("import before the removal: created %v, err %v; want hidden", created, err)
+	}
+}
+
 func TestListCompletedHistoryAppliesScopedFilters(t *testing.T) {
 	db, err := sql.Open("sqlite3", ":memory:")
 	if err != nil {
@@ -471,3 +516,58 @@ func TestUpdateProgressBackwardSeekPersists(t *testing.T) {
 		t.Errorf("PositionSeconds = %v, want 600 (last write wins)", wp.PositionSeconds)
 	}
 }
+
+// ClearResumePosition must only move a row's timestamps forward. The Jellyfin
+// path stores fractional seconds, which a whole-second clear in the same second
+// sorts after as text although it is earlier (issue #2134 review).
+func TestClearResumePositionNeverMovesTimestampsBack(t *testing.T) {
+	const updatedAt, eventAt = "2026-10-14T23:48:50.220Z", "2026-10-14T23:48:50.220123456Z"
+	for _, tc := range []struct {
+		name                       string
+		at                         time.Time
+		wantUpdatedAt, wantEventAt string
+	}{
+		{"same second as a fractional write", time.Date(2026, 10, 14, 23, 48, 50, 900_000_000, time.UTC), updatedAt, eventAt},
+		{"a later second", time.Date(2026, 10, 14, 23, 48, 51, 0, time.UTC), "2026-10-14T23:48:51Z", "2026-10-14T23:48:51Z"},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			db, err := sql.Open("sqlite3", ":memory:")
+			if err != nil {
+				t.Fatalf("open sqlite: %v", err)
+			}
+			t.Cleanup(func() { _ = db.Close() })
+			if err := InitSchema(db); err != nil {
+				t.Fatalf("InitSchema: %v", err)
+			}
+			if _, err := db.Exec(`
+				INSERT INTO watch_progress (profile_id, media_item_id, position_seconds, duration_seconds, completed, updated_at, event_at)
+				VALUES ('p1', 'm1', 600, 5400, 0, ?, ?)`, updatedAt, eventAt); err != nil {
+				t.Fatalf("seed progress: %v", err)
+			}
+			var seqBefore int64
+			if err := db.QueryRow(`SELECT synced_seq FROM watch_progress WHERE profile_id = 'p1' AND media_item_id = 'm1'`).Scan(&seqBefore); err != nil {
+				t.Fatalf("read seq: %v", err)
+			}
+
+			cleared, err := ClearResumePosition(db, "p1", "m1", tc.at)
+			if err != nil || !cleared {
+				t.Fatalf("ClearResumePosition = %v, %v; want cleared", cleared, err)
+			}
+
+			var position float64
+			var gotUpdatedAt, gotEventAt string
+			var seqAfter int64
+			if err := db.QueryRow(`
+				SELECT position_seconds, updated_at, event_at, synced_seq
+				FROM watch_progress WHERE profile_id = 'p1' AND media_item_id = 'm1'`).Scan(&position, &gotUpdatedAt, &gotEventAt, &seqAfter); err != nil {
+				t.Fatalf("read progress: %v", err)
+			}
+			if position != 0 || gotUpdatedAt != tc.wantUpdatedAt || gotEventAt != tc.wantEventAt {
+				t.Fatalf("after clear: position %v, updated_at %q, event_at %q; want 0, %q, %q", position, gotUpdatedAt, gotEventAt, tc.wantUpdatedAt, tc.wantEventAt)
+			}
+			if seqAfter <= seqBefore {
+				t.Fatalf("synced_seq = %d, want past %d so delta sync carries the clear", seqAfter, seqBefore)
+			}
+		})
+	}
+}
diff --git a/internal/userdb/retire_trakt.go b/internal/userdb/retire_trakt.go
new file mode 100644
index 0000000000..5e446e097a
--- /dev/null
+++ b/internal/userdb/retire_trakt.go
@@ -0,0 +1,107 @@
+package userdb
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"fmt"
+)
+
+// retireTraktSectionOverrides rewrites the profile section overrides that
+// point at Trakt, as the Postgres store does in
+// 20261016131356_retire_trakt.sql: a Trakt trending config becomes TMDB
+// weekly trending, a row the profile added for Trakt trending is hidden, and
+// a collection row drops its Trakt marker. A config that does not parse is
+// left alone.
+func retireTraktSectionOverrides(tx *sql.Tx) error {
+	ctx := context.Background()
+	overrides, err := listTraktSectionOverrides(ctx, tx)
+	if err != nil {
+		return err
+	}
+	for _, o := range overrides {
+		config, configTrending := retireTraktSectionConfig(o.config)
+		userConfig, userTrending := retireTraktSectionConfig(o.userConfig)
+		hide := o.sectionID == "" && (configTrending || userTrending)
+		if config == o.config && userConfig == o.userConfig && !hide {
+			continue
+		}
+		var newConfig, newUserConfig sql.NullString
+		if config != o.config {
+			newConfig = sql.NullString{String: config, Valid: true}
+		}
+		if userConfig != o.userConfig {
+			newUserConfig = sql.NullString{String: userConfig, Valid: true}
+		}
+		if _, err := tx.ExecContext(ctx, `
+UPDATE profile_section_overrides
+SET config = COALESCE(?, config),
+    user_config = COALESCE(?, user_config),
+    hidden = MAX(hidden, ?)
+WHERE id = ?`, newConfig, newUserConfig, hide, o.id); err != nil {
+			return fmt.Errorf("rewriting Trakt section override %s: %w", o.id, err)
+		}
+	}
+	return nil
+}
+
+type traktSectionOverride struct {
+	id, sectionID, config, userConfig string
+}
+
+// listTraktSectionOverrides reads the overrides whose configs mention Trakt.
+func listTraktSectionOverrides(ctx context.Context, tx *sql.Tx) ([]traktSectionOverride, error) {
+	rows, err := tx.QueryContext(ctx, `
+SELECT id, COALESCE(section_id, ''), COALESCE(config, ''), COALESCE(user_config, '')
+FROM profile_section_overrides
+WHERE config LIKE '%trakt%' OR user_config LIKE '%trakt%'`)
+	if err != nil {
+		return nil, fmt.Errorf("listing Trakt section overrides: %w", err)
+	}
+	defer func() { _ = rows.Close() }()
+	var overrides []traktSectionOverride
+	for rows.Next() {
+		var o traktSectionOverride
+		if err := rows.Scan(&o.id, &o.sectionID, &o.config, &o.userConfig); err != nil {
+			return nil, fmt.Errorf("reading Trakt section overrides: %w", err)
+		}
+		overrides = append(overrides, o)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("reading Trakt section overrides: %w", err)
+	}
+	return overrides, nil
+}
+
+// retireTraktSectionConfig returns raw with its Trakt source replaced, and
+// whether it was a Trakt trending config. Other configs come back unchanged.
+func retireTraktSectionConfig(raw string) (string, bool) {
+	var config map[string]json.RawMessage
+	if raw == "" || json.Unmarshal([]byte(raw), &config) != nil || config == nil {
+		return raw, false
+	}
+	trending := false
+	switch {
+	case jsonStringField(config, "source") == "trakt":
+		config["source"] = json.RawMessage(`"tmdb"`)
+		config["window"] = json.RawMessage(`"week"`)
+		trending = true
+	case jsonStringField(config, "source_provider") == "trakt":
+		delete(config, "source_provider")
+	default:
+		return raw, false
+	}
+	rewritten, err := json.Marshal(config)
+	if err != nil {
+		return raw, false
+	}
+	return string(rewritten), trending
+}
+
+func jsonStringField(object map[string]json.RawMessage, key string) string {
+	var value string
+	if raw, ok := object[key]; !ok || json.Unmarshal(raw, &value) != nil {
+		return ""
+	}
+	return value
+}
diff --git a/internal/userdb/schema.go b/internal/userdb/schema.go
index ae1feaaa3a..a45cc42833 100644
--- a/internal/userdb/schema.go
+++ b/internal/userdb/schema.go
@@ -107,6 +107,13 @@ CREATE TABLE IF NOT EXISTS watchlist (
     PRIMARY KEY (profile_id, media_item_id)
 );
 
+CREATE TABLE IF NOT EXISTS not_interested (
+    profile_id TEXT NOT NULL,
+    media_item_id TEXT NOT NULL,
+    added_at TEXT NOT NULL,
+    PRIMARY KEY (profile_id, media_item_id)
+);
+
 CREATE TABLE IF NOT EXISTS home_item_dismissals (
     profile_id TEXT NOT NULL,
     surface TEXT NOT NULL,
@@ -233,6 +240,7 @@ CREATE TABLE IF NOT EXISTS user_devices (
     device_name TEXT NOT NULL DEFAULT '',
     device_platform TEXT NOT NULL DEFAULT '',
     last_seen_at TEXT NOT NULL,
+    custom_name TEXT,
     PRIMARY KEY (profile_id, device_id)
 );
 
@@ -285,6 +293,9 @@ CREATE INDEX IF NOT EXISTS idx_personal_collection_profiles_lookup
 CREATE INDEX IF NOT EXISTS idx_home_item_dismissals_lookup
     ON home_item_dismissals(profile_id, surface);
 
+CREATE INDEX IF NOT EXISTS idx_not_interested_profile_added
+    ON not_interested(profile_id, added_at DESC, media_item_id DESC);
+
 CREATE INDEX IF NOT EXISTS idx_hidden_history_items_lookup
     ON hidden_history_items(profile_id, hidden_before);
 ` + settingContractSchema + jellycompatDisplayPrefsSchema + playbackSinkSchema + playbackSourceSchema + onboardingRevisionSchema
diff --git a/internal/userdb/sqlitestore.go b/internal/userdb/sqlitestore.go
index 6e118a49a0..33db668317 100644
--- a/internal/userdb/sqlitestore.go
+++ b/internal/userdb/sqlitestore.go
@@ -90,6 +90,10 @@ func (s *SQLiteUserStore) ClearProgress(_ context.Context, profileID, mediaItemI
 	return ClearProgress(s.db, profileID, mediaItemID)
 }
 
+func (s *SQLiteUserStore) ClearResumePosition(_ context.Context, profileID, mediaItemID string, at time.Time) (bool, error) {
+	return ClearResumePosition(s.db, profileID, mediaItemID, at)
+}
+
 // MarkWatchedBatch is one of the few paths here that forwards ctx: the write
 // is transactional precisely so a canceled request marks nothing.
 func (s *SQLiteUserStore) MarkWatchedBatch(ctx context.Context, profileID string, targets []userstore.MarkWatchedTarget, entries []userstore.WatchHistoryEntry) ([]userstore.WatchHistoryEntry, error) {
@@ -194,9 +198,31 @@ func (s *SQLiteUserStore) DeleteHomeDismissal(_ context.Context, profileID, surf
 	return DeleteHomeDismissal(s.db, profileID, surface, mediaItemID)
 }
 
+// --- Not interested ---
+
+func (s *SQLiteUserStore) MarkNotInterested(_ context.Context, profileID, mediaItemID string) (bool, error) {
+	return MarkNotInterested(s.db, profileID, mediaItemID)
+}
+
+func (s *SQLiteUserStore) UnmarkNotInterested(_ context.Context, profileID, mediaItemID string) (bool, error) {
+	return UnmarkNotInterested(s.db, profileID, mediaItemID)
+}
+
+func (s *SQLiteUserStore) GetNotInterested(_ context.Context, profileID, mediaItemID string) (*userstore.NotInterestedEntry, error) {
+	return GetNotInterested(s.db, profileID, mediaItemID)
+}
+
+func (s *SQLiteUserStore) ListNotInterestedPage(_ context.Context, profileID string, after *userstore.ListKey, limit int) ([]userstore.NotInterestedEntry, error) {
+	return ListNotInterestedPage(s.db, profileID, after, limit)
+}
+
+func (s *SQLiteUserStore) ListNotInterestedByMediaItems(_ context.Context, profileID string, mediaItemIDs []string) (map[string]bool, error) {
+	return ListNotInterestedByMediaItems(s.db, profileID, mediaItemIDs)
+}
+
 // --- Favorites & Watchlist ---
 
-func (s *SQLiteUserStore) AddFavorite(_ context.Context, profileID, mediaItemID string) error {
+func (s *SQLiteUserStore) AddFavorite(_ context.Context, profileID, mediaItemID string) (bool, error) {
 	return AddFavorite(s.db, profileID, mediaItemID)
 }
 
@@ -204,7 +230,7 @@ func (s *SQLiteUserStore) AddFavoriteAt(_ context.Context, profileID, mediaItemI
 	return AddFavoriteAt(s.db, profileID, mediaItemID, addedAt)
 }
 
-func (s *SQLiteUserStore) RemoveFavorite(_ context.Context, profileID, mediaItemID string) error {
+func (s *SQLiteUserStore) RemoveFavorite(_ context.Context, profileID, mediaItemID string) (bool, error) {
 	return RemoveFavorite(s.db, profileID, mediaItemID)
 }
 
@@ -232,7 +258,7 @@ func (s *SQLiteUserStore) GetWatchlistEntry(_ context.Context, profileID, mediaI
 	return GetWatchlistEntry(s.db, profileID, mediaItemID)
 }
 
-func (s *SQLiteUserStore) AddToWatchlist(_ context.Context, profileID, mediaItemID string) error {
+func (s *SQLiteUserStore) AddToWatchlist(_ context.Context, profileID, mediaItemID string) (bool, error) {
 	return AddToWatchlist(s.db, profileID, mediaItemID)
 }
 
@@ -240,7 +266,7 @@ func (s *SQLiteUserStore) AddToWatchlistAt(_ context.Context, profileID, mediaIt
 	return AddToWatchlistAt(s.db, profileID, mediaItemID, addedAt)
 }
 
-func (s *SQLiteUserStore) RemoveFromWatchlist(_ context.Context, profileID, mediaItemID string) error {
+func (s *SQLiteUserStore) RemoveFromWatchlist(_ context.Context, profileID, mediaItemID string) (bool, error) {
 	return RemoveFromWatchlist(s.db, profileID, mediaItemID)
 }
 
diff --git a/internal/userstore/device_settings.go b/internal/userstore/device_settings.go
index c9ee271ffe..98fe8114c7 100644
--- a/internal/userstore/device_settings.go
+++ b/internal/userstore/device_settings.go
@@ -17,8 +17,10 @@ type DevicePosition struct {
 type DevicePageOptions struct {
 	// Empty ProfileID selects the household; the application must authorize it.
 	ProfileID string
-	Limit     int
-	After     *DevicePosition
+	// DeviceID, when set, narrows the page to that device's rows.
+	DeviceID string
+	Limit    int
+	After    *DevicePosition
 }
 
 func (o DevicePageOptions) Validate() error {
@@ -33,6 +35,9 @@ func (o DevicePageOptions) Validate() error {
 
 type DeviceSettingsEntry struct {
 	DeviceEntry
+	// CustomName is the name the profile chose for the device; empty when it
+	// chose none. DeviceName stays the name the client reports.
+	CustomName   string
 	ProfileName  string
 	ChangedCount int
 }
@@ -43,4 +48,9 @@ type DeviceSettingsEntry struct {
 type DeviceSettingsStore interface {
 	ListDeviceSettingsPage(context.Context, DevicePageOptions) ([]DeviceSettingsEntry, error)
 	RemoveDeviceSettings(context.Context, string, string, bool) ([]string, error)
+	// RenameDevice sets the custom name of one profile's registry row for a
+	// device; an empty name clears it. It returns ErrDeviceNotFound when the
+	// profile has no registry row for the device. Registration never writes
+	// the custom name, so it survives the device being seen again.
+	RenameDevice(ctx context.Context, profileID, deviceID, name string) error
 }
diff --git a/internal/userstore/displayprefs.go b/internal/userstore/displayprefs.go
new file mode 100644
index 0000000000..d5c7d69488
--- /dev/null
+++ b/internal/userstore/displayprefs.go
@@ -0,0 +1,16 @@
+package userstore
+
+import "fmt"
+
+// ProfileDisplayPrefsID is the Jellyfin DisplayPreferences key of a
+// profile's preferences document id: the profile ID is length-prefixed so no
+// profile's keys are a prefix of another's.
+func ProfileDisplayPrefsID(profileID, id string) string {
+	return ProfileDisplayPrefsPrefix(profileID) + id
+}
+
+// ProfileDisplayPrefsPrefix is the start every ProfileDisplayPrefsID of
+// profileID shares, by which the store deletes a profile's preferences.
+func ProfileDisplayPrefsPrefix(profileID string) string {
+	return fmt.Sprintf("profile:%d:%s:", len(profileID), profileID)
+}
diff --git a/internal/userstore/pgstore/clear_resume_position_test.go b/internal/userstore/pgstore/clear_resume_position_test.go
new file mode 100644
index 0000000000..dc8f4ffa11
--- /dev/null
+++ b/internal/userstore/pgstore/clear_resume_position_test.go
@@ -0,0 +1,139 @@
+package pgstore
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/userstore"
+	"github.com/prairie-server/prairie-server/internal/watchstate"
+)
+
+// TestPostgresClearResumePosition pins issue #2134 on PostgreSQL: clearing a
+// resume position keeps every earlier watch in history and a rewatched item's
+// watched state, reaches delta-sync clients through synced_seq, and advances
+// event_at so an older provider resume point cannot restore the position.
+// Skips unless PRAIRIE_TEST_DATABASE_URL names a migrated database.
+func TestPostgresClearResumePosition(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatalf("connect test database: %v", err)
+	}
+	t.Cleanup(pool.Close)
+
+	var userID int
+	if err := pool.QueryRow(ctx,
+		`INSERT INTO users (username, role) VALUES ($1, 'user') RETURNING id`,
+		fmt.Sprintf("conf-resume-reset-%d", time.Now().UnixNano()),
+	).Scan(&userID); err != nil {
+		t.Fatalf("seed user: %v", err)
+	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(ctx, `DELETE FROM user_watch_history WHERE user_id = $1`, userID)
+		_, _ = pool.Exec(ctx, `DELETE FROM user_history_hidden_items WHERE user_id = $1`, userID)
+		_, _ = pool.Exec(ctx, `DELETE FROM user_watch_progress WHERE user_id = $1`, userID)
+		_, _ = pool.Exec(ctx, `DELETE FROM user_profiles WHERE user_id = $1`, userID)
+		_, _ = pool.Exec(ctx, `DELETE FROM users WHERE id = $1`, userID)
+	})
+	store := newStore(pool, userID)
+	const profileID = "resume-reset"
+	if err := store.CreateProfile(ctx, userstore.Profile{ID: profileID, Name: "Resume Reset"}); err != nil {
+		t.Fatalf("CreateProfile: %v", err)
+	}
+	service := watchstate.NewService(NewPostgresProvider(pool))
+
+	// movie-1 was watched to the end two days ago and is now partly rewatched;
+	// movie-2 was only ever skimmed to the middle.
+	if err := service.RecordManualMarkWatched(ctx, userID, profileID, []watchstate.LeafWatchTarget{{MediaItemID: "movie-1", DurationSeconds: 7200}}, time.Now().UTC().Add(-48*time.Hour)); err != nil {
+		t.Fatalf("RecordManualMarkWatched: %v", err)
+	}
+	for _, play := range []struct {
+		id       string
+		position float64
+	}{{"movie-1", 1800}, {"movie-2", 2700}} {
+		if _, err := service.RecordPlaybackStop(ctx, userID, profileID, play.id, 7200, play.position, time.Now().UTC().Add(-time.Hour), userstore.VersionHints{}, userstore.ProgressThresholds{}); err != nil {
+			t.Fatalf("RecordPlaybackStop(%s): %v", play.id, err)
+		}
+	}
+	// Backdate movie-2's position so a provider resume point from half an hour
+	// ago would win without the clear; the playback stop stamped it now.
+	if err := store.SetProgressAt(ctx, profileID, "movie-2", 2700, 7200, false, time.Now().UTC().Add(-2*time.Hour)); err != nil {
+		t.Fatalf("backdate movie-2: %v", err)
+	}
+	// movie-3's resume point sits under a hidden-history watermark an hour
+	// ahead of the clock: live writes are stamped just past it and stay
+	// visible, and the clear must still land.
+	if _, err := pool.Exec(ctx, `INSERT INTO user_history_hidden_items (user_id, profile_id, media_item_id, hidden_before)
+		VALUES ($1, $2, 'movie-3', now() + interval '1 hour')`, userID, profileID); err != nil {
+		t.Fatalf("seed hidden watermark: %v", err)
+	}
+	if err := store.UpdateProgress(ctx, profileID, "movie-3", 600, 7200, userstore.ProgressThresholds{}); err != nil {
+		t.Fatalf("UpdateProgress(movie-3): %v", err)
+	}
+	if progress, err := store.GetProgress(ctx, profileID, "movie-3"); err != nil || progress == nil || progress.PositionSeconds != 600 {
+		t.Fatalf("movie-3 before = %+v, %v; want a visible resume point", progress, err)
+	}
+	before, err := store.ListHistory(ctx, profileID, 10, 0)
+	if err != nil || len(before) != 3 {
+		t.Fatalf("history before = %+v, %v; want the mark and two partial plays", before, err)
+	}
+	_, cursor, err := store.ListProgressSince(ctx, profileID, "")
+	if err != nil {
+		t.Fatalf("ListProgressSince: %v", err)
+	}
+
+	clearedAt := time.Now().UTC()
+	for _, id := range []string{"movie-1", "movie-2", "movie-3"} {
+		cleared, err := service.ClearResumePosition(ctx, userID, profileID, id)
+		if err != nil || !cleared {
+			t.Fatalf("ClearResumePosition(%s) = %v, %v; want cleared", id, cleared, err)
+		}
+	}
+
+	delta, _, err := store.ListProgressSince(ctx, profileID, cursor)
+	if err != nil {
+		t.Fatalf("ListProgressSince after clear: %v", err)
+	}
+	if len(delta) != 3 {
+		t.Fatalf("delta after clear = %+v, want all three cleared rows", delta)
+	}
+	for _, row := range delta {
+		want := row.MediaItemID == "movie-1"
+		if row.PositionSeconds != 0 || row.Completed != want || row.DurationSeconds != 7200 {
+			t.Fatalf("%s delta row = %+v, want position 0, completed %v, duration kept", row.MediaItemID, row, want)
+		}
+	}
+	var eventAt time.Time
+	if err := pool.QueryRow(ctx, `SELECT event_at FROM user_watch_progress WHERE user_id = $1 AND profile_id = $2 AND media_item_id = 'movie-2'`,
+		userID, profileID).Scan(&eventAt); err != nil || eventAt.Before(clearedAt.Add(-time.Second)) {
+		t.Fatalf("movie-2 event_at = %v, %v; want the clear's time", eventAt, err)
+	}
+
+	after, err := store.ListHistory(ctx, profileID, 10, 0)
+	if err != nil || len(after) != len(before) {
+		t.Fatalf("history after = %+v, %v; want all %d earlier watches kept", after, err, len(before))
+	}
+	for i := range before {
+		if after[i].ID != before[i].ID || after[i].Completed != before[i].Completed {
+			t.Fatalf("history row %d = %+v, want %+v", i, after[i], before[i])
+		}
+	}
+
+	// A provider resume point recorded before the clear must not restore it.
+	applied, err := store.SetProgressIfNewer(ctx, profileID, "movie-2", 2700, 7200, false, time.Now().UTC().Add(-30*time.Minute))
+	if err != nil || applied {
+		t.Fatalf("older provider resume point applied = %v, %v; want rejected", applied, err)
+	}
+	if progress, err := store.GetProgress(ctx, profileID, "movie-2"); err != nil || progress == nil || progress.PositionSeconds != 0 {
+		t.Fatalf("movie-2 progress = %+v, %v; want position 0", progress, err)
+	}
+}
diff --git a/internal/userstore/pgstore/collection_mutations.go b/internal/userstore/pgstore/collection_mutations.go
index 003615023d..26f8b9fbed 100644
--- a/internal/userstore/pgstore/collection_mutations.go
+++ b/internal/userstore/pgstore/collection_mutations.go
@@ -26,6 +26,19 @@ func collectionMutationTxOptions(expected *int64) pgx.TxOptions {
 // The checks take no counter locks before a target row is mutated. PostgreSQL
 // SSI prevents a version read from validating a concurrent committed mutation,
 // while existing row->revision trigger ordering remains intact for old writers.
+// lockCollectionRow locks a collection's row for the rest of tx. Writes that
+// change both a collection and its items take it before the items: item
+// triggers advance the collection's revision row, and every writer locks the
+// collection row before the revision row (UpdateCollection by updating it
+// first, a profile delete by locking the collections it touches), so taking
+// them the other way round can deadlock.
+func (s *PostgresUserStore) lockCollectionRow(ctx context.Context, tx pgx.Tx, id string) error {
+	if _, err := tx.Exec(ctx, `SELECT 1 FROM user_personal_collections WHERE user_id = $1 AND id = $2 FOR UPDATE`, s.userID, id); err != nil {
+		return fmt.Errorf("locking collection %s: %w", id, err)
+	}
+	return nil
+}
+
 func (s *PostgresUserStore) checkCollectionRevision(ctx context.Context, tx pgx.Tx, id string, expected *int64) error {
 	if expected == nil {
 		return nil
diff --git a/internal/userstore/pgstore/collections.go b/internal/userstore/pgstore/collections.go
index 60091697ab..ddbb6114cd 100644
--- a/internal/userstore/pgstore/collections.go
+++ b/internal/userstore/pgstore/collections.go
@@ -299,6 +299,9 @@ func (s *PostgresUserStore) deleteCollection(ctx context.Context, id string, exp
 		return fmt.Errorf("beginning transaction for collection delete: %w", err)
 	}
 	defer tx.Rollback(ctx) //nolint:errcheck
+	if err := s.lockCollectionRow(ctx, tx, id); err != nil {
+		return err
+	}
 	if err := s.checkCollectionRevision(ctx, tx, id, expected); err != nil {
 		return err
 	}
@@ -353,6 +356,9 @@ func (s *PostgresUserStore) reorderCollectionItems(ctx context.Context, collecti
 		return fmt.Errorf("beginning collection item reorder: %w", err)
 	}
 	defer tx.Rollback(ctx) //nolint:errcheck
+	if err := s.lockCollectionRow(ctx, tx, collectionID); err != nil {
+		return err
+	}
 	if err := s.checkCollectionRevision(ctx, tx, collectionID, expected); err != nil {
 		return err
 	}
@@ -416,6 +422,13 @@ func (s *PostgresUserStore) reorderCollections(ctx context.Context, profileID st
 	if err := s.checkCollectionOrderRevision(ctx, tx, expected); err != nil {
 		return err
 	}
+	// The bulk update below locks rows in plan order; lock them in id order
+	// first, as a profile delete does, so the two cannot deadlock.
+	if _, err := tx.Exec(ctx,
+		`SELECT 1 FROM user_personal_collections WHERE user_id = $1 AND creator_profile_id = $2 AND native ORDER BY id FOR UPDATE`,
+		s.userID, profileID); err != nil {
+		return fmt.Errorf("locking collections for reorder: %w", err)
+	}
 
 	var updated, total int
 	if err := tx.QueryRow(ctx, `
diff --git a/internal/userstore/pgstore/conformance_test.go b/internal/userstore/pgstore/conformance_test.go
index 0e6ec62251..096949035c 100644
--- a/internal/userstore/pgstore/conformance_test.go
+++ b/internal/userstore/pgstore/conformance_test.go
@@ -4,10 +4,14 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"os"
+	"slices"
+	"sync"
 	"testing"
 	"time"
 
 	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
 	"github.com/jackc/pgx/v5/pgxpool"
 
 	"github.com/prairie-server/prairie-server/internal/envutil"
@@ -246,8 +250,8 @@ func TestPostgresCollectionSortPreferences(t *testing.T) {
 }
 
 // TestPostgresPersonalListPage runs the keyset favorites/watchlist paging
-// conformance test against the Postgres backend.
-// Skips unless SILO_TEST_DATABASE_URL is set.
+// and membership-change conformance tests against the Postgres backend.
+// Skips unless PRAIRIE_TEST_DATABASE_URL is set.
 func TestPostgresPersonalListPage(t *testing.T) {
 	dsn := envutil.Getenv("SILO_TEST_DATABASE_URL")
 	if dsn == "" {
@@ -260,7 +264,7 @@ func TestPostgresPersonalListPage(t *testing.T) {
 	}
 	t.Cleanup(pool.Close)
 
-	storetest.RunPersonalListPage(t, func(t *testing.T) userstore.UserStore {
+	newListStore := func(t *testing.T) userstore.UserStore {
 		var userID int
 		if err := pool.QueryRow(ctx,
 			`INSERT INTO users (username, role) VALUES ($1, 'user') RETURNING id`,
@@ -275,7 +279,10 @@ func TestPostgresPersonalListPage(t *testing.T) {
 			_, _ = pool.Exec(ctx, `DELETE FROM users WHERE id = $1`, userID)
 		})
 		return newStore(pool, userID)
-	})
+	}
+	storetest.RunPersonalListPage(t, newListStore)
+	storetest.RunPersonalListMembership(t, newListStore)
+	storetest.RunNotInterested(t, newListStore)
 }
 
 // TestPostgresProgressPage runs the keyset progress paging conformance test
@@ -308,3 +315,304 @@ func TestPostgresProgressPage(t *testing.T) {
 		return newStore(pool, userID)
 	})
 }
+
+// TestPostgresDeleteProfileRemovesProfileState runs the profile-deletion
+// conformance test against the Postgres backend. Skips unless
+// PRAIRIE_TEST_DATABASE_URL is set.
+func TestPostgresDeleteProfileRemovesProfileState(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatalf("connect test database: %v", err)
+	}
+	t.Cleanup(pool.Close)
+
+	storetest.RunDeleteProfileRemovesProfileState(t, func(t *testing.T) userstore.UserStore {
+		var userID int
+		if err := pool.QueryRow(ctx,
+			`INSERT INTO users (username, role) VALUES ($1, 'user') RETURNING id`,
+			fmt.Sprintf("conf-profiledelete-%d", time.Now().UnixNano()),
+		).Scan(&userID); err != nil {
+			t.Fatalf("seed user: %v", err)
+		}
+		// Deleting the user cascades to every user-scoped table.
+		t.Cleanup(func() { _, _ = pool.Exec(ctx, `DELETE FROM users WHERE id = $1`, userID) })
+		return newStore(pool, userID)
+	}, true)
+}
+
+// profileTablesClearedElsewhere are the user tables with a profile_id that
+// DeleteProfile leaves to another step, with the step.
+var profileTablesClearedElsewhere = map[string]string{
+	"user_devices":   "the profile handler's device-library purge (downloads.Repository.PurgeProfileDevices)",
+	"user_downloads": "the profile handler's device-library purge (downloads.Repository.PurgeProfileDevices)",
+}
+
+// Every user-store table (user_*) keyed by (user_id, profile_id) is cleared
+// when a profile is deleted: by profileCascadeTables, by a foreign key to
+// user_profiles that cascades, or by a step named in
+// profileTablesClearedElsewhere. A new table fails this test until it is given
+// one of the three. Tables other packages own (ebook reading data, downloads,
+// notifications and the like) are purged by those packages' own steps.
+func TestPostgresDeleteProfileCoversEveryProfileTable(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatalf("connect test database: %v", err)
+	}
+	t.Cleanup(pool.Close)
+
+	rows, err := pool.Query(ctx, `
+		SELECT c.table_name
+		FROM   information_schema.columns c
+		JOIN   information_schema.tables t USING (table_schema, table_name)
+		WHERE  c.table_schema = 'public' AND t.table_type = 'BASE TABLE'
+		  AND  c.table_name LIKE 'user\_%' AND c.column_name = 'profile_id'
+		  AND  EXISTS (SELECT 1 FROM information_schema.columns u
+		               WHERE u.table_schema = 'public' AND u.table_name = c.table_name AND u.column_name = 'user_id')
+		  AND  NOT EXISTS (
+		         SELECT 1 FROM pg_constraint fk
+		         WHERE fk.contype = 'f' AND fk.confdeltype = 'c'
+		           AND fk.conrelid = format('public.%I', c.table_name)::regclass
+		           AND fk.confrelid = 'public.user_profiles'::regclass)
+		ORDER  BY 1`)
+	if err != nil {
+		t.Fatalf("list profile tables: %v", err)
+	}
+	tables, err := pgx.CollectRows(rows, pgx.RowTo[string])
+	if err != nil {
+		t.Fatalf("list profile tables: %v", err)
+	}
+	if len(tables) == 0 {
+		t.Fatal("found no profile tables; the schema query is wrong")
+	}
+	for _, table := range tables {
+		if slices.Contains(profileCascadeTables, table) {
+			continue
+		}
+		if _, ok := profileTablesClearedElsewhere[table]; ok {
+			continue
+		}
+		t.Errorf("%s has a profile_id but nothing removes its rows when the profile is deleted: add it to profileCascadeTables, or to profileTablesClearedElsewhere with the step that does", table)
+	}
+}
+
+// Profiles saving section overrides for one scope at the same time each keep
+// their own: every writer reads, merges and writes the whole value under one
+// lock, so no write is lost.
+func TestPostgresConcurrentSectionOverrideSaves(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatalf("connect test database: %v", err)
+	}
+	t.Cleanup(pool.Close)
+	var userID int
+	if err := pool.QueryRow(ctx, `INSERT INTO users (username, role) VALUES ($1, 'user') RETURNING id`,
+		fmt.Sprintf("conf-overrides-%d", time.Now().UnixNano())).Scan(&userID); err != nil {
+		t.Fatalf("seed user: %v", err)
+	}
+	t.Cleanup(func() { _, _ = pool.Exec(ctx, `DELETE FROM users WHERE id = $1`, userID) })
+	store := newStore(pool, userID)
+
+	const profiles = 8
+	var wg sync.WaitGroup
+	errs := make(chan error, profiles)
+	for i := range profiles {
+		wg.Go(func() {
+			errs <- store.SaveSectionOverrides(ctx, fmt.Sprintf("p%d", i), "home", "", []userstore.SectionOverride{{SectionID: "default-recently-added", Hidden: true}})
+		})
+	}
+	wg.Wait()
+	close(errs)
+	for err := range errs {
+		if err != nil {
+			t.Fatalf("SaveSectionOverrides: %v", err)
+		}
+	}
+	for i := range profiles {
+		got, err := store.ListSectionOverrides(ctx, fmt.Sprintf("p%d", i), "home", "")
+		if err != nil || len(got) != 1 {
+			t.Fatalf("profile p%d overrides = %d, %v; want its own one", i, len(got), err)
+		}
+	}
+}
+
+// Two profiles with legacy visibility rows on each other's collections can
+// be deleted at the same time: each delete locks every collection it touches,
+// in id order, before advancing any revision, so neither waits on the other
+// in a cycle.
+func TestPostgresConcurrentProfileDeletesWithCrossVisibility(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatalf("connect test database: %v", err)
+	}
+	t.Cleanup(pool.Close)
+
+	for round := range 20 {
+		var userID int
+		if err := pool.QueryRow(ctx, `INSERT INTO users (username, role) VALUES ($1, 'user') RETURNING id`,
+			fmt.Sprintf("conf-crossdelete-%d-%d", round, time.Now().UnixNano())).Scan(&userID); err != nil {
+			t.Fatalf("seed user: %v", err)
+		}
+		t.Cleanup(func() { _, _ = pool.Exec(ctx, `DELETE FROM users WHERE id = $1`, userID) })
+		store := newStore(pool, userID)
+		profiles := []string{"keep", "a", "b"}
+		for _, id := range profiles {
+			if err := store.CreateProfile(ctx, userstore.Profile{ID: id, Name: id}); err != nil {
+				t.Fatalf("CreateProfile %s: %v", id, err)
+			}
+		}
+		collections := map[string]string{}
+		for _, id := range []string{"a", "b"} {
+			c, err := store.CreateCollection(ctx, userstore.CreateCollectionInput{CreatorProfileID: id, Name: "Picks of " + id})
+			if err != nil {
+				t.Fatalf("CreateCollection %s: %v", id, err)
+			}
+			collections[id] = c.ID
+		}
+		// Legacy allow-list rows: each profile listed on the other's collection.
+		for viewer, owner := range map[string]string{"a": "b", "b": "a"} {
+			if _, err := pool.Exec(ctx, `INSERT INTO user_personal_collection_profiles (user_id, collection_id, profile_id) VALUES ($1, $2, $3)`,
+				userID, collections[owner], viewer); err != nil {
+				t.Fatalf("seed visibility: %v", err)
+			}
+		}
+
+		var wg sync.WaitGroup
+		errs := make(chan error, 2)
+		for _, id := range []string{"a", "b"} {
+			wg.Go(func() { errs <- newStore(pool, userID).DeleteProfile(ctx, id) })
+		}
+		wg.Wait()
+		close(errs)
+		for err := range errs {
+			if err != nil {
+				t.Fatalf("round %d: concurrent DeleteProfile: %v", round, err)
+			}
+		}
+	}
+}
+
+// Deleting a profile and deleting another profile's collection that lists it
+// can run at the same time: both lock the collection row before its
+// revision row.
+func TestPostgresConcurrentProfileAndCollectionDeletes(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatalf("connect test database: %v", err)
+	}
+	t.Cleanup(pool.Close)
+
+	for round := range 20 {
+		var userID int
+		if err := pool.QueryRow(ctx, `INSERT INTO users (username, role) VALUES ($1, 'user') RETURNING id`,
+			fmt.Sprintf("conf-mixeddelete-%d-%d", round, time.Now().UnixNano())).Scan(&userID); err != nil {
+			t.Fatalf("seed user: %v", err)
+		}
+		t.Cleanup(func() { _, _ = pool.Exec(ctx, `DELETE FROM users WHERE id = $1`, userID) })
+		store := newStore(pool, userID)
+		for _, id := range []string{"owner", "listed"} {
+			if err := store.CreateProfile(ctx, userstore.Profile{ID: id, Name: id}); err != nil {
+				t.Fatalf("CreateProfile %s: %v", id, err)
+			}
+		}
+		c, err := store.CreateCollection(ctx, userstore.CreateCollectionInput{CreatorProfileID: "owner", Name: "Owner's picks"})
+		if err != nil {
+			t.Fatalf("CreateCollection: %v", err)
+		}
+		if err := store.AddCollectionItem(ctx, c.ID, "movie:pick", 0); err != nil {
+			t.Fatalf("AddCollectionItem: %v", err)
+		}
+		if _, err := pool.Exec(ctx, `INSERT INTO user_personal_collection_profiles (user_id, collection_id, profile_id) VALUES ($1, $2, 'listed')`,
+			userID, c.ID); err != nil {
+			t.Fatalf("seed visibility: %v", err)
+		}
+
+		var wg sync.WaitGroup
+		errs := make(chan error, 2)
+		wg.Go(func() { errs <- newStore(pool, userID).DeleteProfile(ctx, "listed") })
+		wg.Go(func() { errs <- newStore(pool, userID).DeleteCollection(ctx, c.ID) })
+		wg.Wait()
+		close(errs)
+		for err := range errs {
+			if err != nil {
+				t.Fatalf("round %d: concurrent delete: %v", round, err)
+			}
+		}
+	}
+}
+
+// Deleting a profile while it reorders its own collections cannot deadlock:
+// both lock the collections in id order. The reorder may find the
+// collections gone, which is not a deadlock.
+func TestPostgresConcurrentProfileDeleteAndCollectionReorder(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatalf("connect test database: %v", err)
+	}
+	t.Cleanup(pool.Close)
+
+	for round := range 20 {
+		var userID int
+		if err := pool.QueryRow(ctx, `INSERT INTO users (username, role) VALUES ($1, 'user') RETURNING id`,
+			fmt.Sprintf("conf-reorderdelete-%d-%d", round, time.Now().UnixNano())).Scan(&userID); err != nil {
+			t.Fatalf("seed user: %v", err)
+		}
+		t.Cleanup(func() { _, _ = pool.Exec(ctx, `DELETE FROM users WHERE id = $1`, userID) })
+		store := newStore(pool, userID)
+		for _, id := range []string{"keep", "gone"} {
+			if err := store.CreateProfile(ctx, userstore.Profile{ID: id, Name: id}); err != nil {
+				t.Fatalf("CreateProfile %s: %v", id, err)
+			}
+		}
+		var ids []string
+		for i := range 6 {
+			c, err := store.CreateCollection(ctx, userstore.CreateCollectionInput{CreatorProfileID: "gone", Name: fmt.Sprintf("List %d", i)})
+			if err != nil {
+				t.Fatalf("CreateCollection: %v", err)
+			}
+			ids = append([]string{c.ID}, ids...)
+		}
+
+		var wg sync.WaitGroup
+		var deleteErr, reorderErr error
+		wg.Go(func() { deleteErr = newStore(pool, userID).DeleteProfile(ctx, "gone") })
+		wg.Go(func() { reorderErr = newStore(pool, userID).ReorderCollections(ctx, "gone", ids) })
+		wg.Wait()
+		if deleteErr != nil {
+			t.Fatalf("round %d: DeleteProfile: %v", round, deleteErr)
+		}
+		var pgErr *pgconn.PgError
+		if errors.As(reorderErr, &pgErr) && pgErr.Code == "40P01" {
+			t.Fatalf("round %d: ReorderCollections deadlocked: %v", round, reorderErr)
+		}
+	}
+}
diff --git a/internal/userstore/pgstore/device_settings.go b/internal/userstore/pgstore/device_settings.go
index 8ec29379fe..ab93f6db0c 100644
--- a/internal/userstore/pgstore/device_settings.go
+++ b/internal/userstore/pgstore/device_settings.go
@@ -19,12 +19,12 @@ func (s *PostgresUserStore) ListDeviceSettingsPage(ctx context.Context, opts use
 	if err := opts.Validate(); err != nil {
 		return nil, err
 	}
-	args := []any{s.userID, opts.ProfileID}
-	sqlText := `SELECT d.profile_id,d.device_id,d.device_name,d.device_platform,d.last_seen_at,COALESCE(p.name,''),COALESCE((SELECT json_agg(k.key) FROM user_setting_values k WHERE k.user_id=d.user_id AND k.scope='profile_device' AND k.profile_id=d.profile_id AND k.device_id=d.device_id), '[]')
+	args := []any{s.userID, opts.ProfileID, opts.DeviceID}
+	sqlText := `SELECT d.profile_id,d.device_id,d.device_name,COALESCE(d.custom_name,''),d.device_platform,d.last_seen_at,COALESCE(p.name,''),COALESCE((SELECT json_agg(k.key) FROM user_setting_values k WHERE k.user_id=d.user_id AND k.scope='profile_device' AND k.profile_id=d.profile_id AND k.device_id=d.device_id), '[]')
  FROM user_devices d LEFT JOIN user_profiles p ON p.user_id=d.user_id AND p.id=d.profile_id
- WHERE d.user_id = $1 AND ($2='' OR d.profile_id=$2)`
+ WHERE d.user_id = $1 AND ($2='' OR d.profile_id=$2) AND ($3='' OR d.device_id=$3)`
 	if opts.After != nil {
-		sqlText += ` AND (d.last_seen_at < $3::timestamptz OR (d.last_seen_at = $3::timestamptz AND (d.profile_id,d.device_id) > ($4,$5)))`
+		sqlText += ` AND (d.last_seen_at < $4::timestamptz OR (d.last_seen_at = $4::timestamptz AND (d.profile_id,d.device_id) > ($5,$6)))`
 		args = append(args, opts.After.LastSeenAt, opts.After.ProfileID, opts.After.DeviceID)
 	}
 	sqlText += " ORDER BY d.last_seen_at DESC,d.profile_id,d.device_id LIMIT " + fmt.Sprintf("$%d", len(args)+1)
@@ -39,7 +39,7 @@ func (s *PostgresUserStore) ListDeviceSettingsPage(ctx context.Context, opts use
 		var entry userstore.DeviceSettingsEntry
 		var raw []byte
 		var lastSeen time.Time
-		if err := rows.Scan(&entry.ProfileID, &entry.DeviceID, &entry.DeviceName, &entry.DevicePlatform, &lastSeen, &entry.ProfileName, &raw); err != nil {
+		if err := rows.Scan(&entry.ProfileID, &entry.DeviceID, &entry.DeviceName, &entry.CustomName, &entry.DevicePlatform, &lastSeen, &entry.ProfileName, &raw); err != nil {
 			return nil, err
 		}
 		entry.LastSeenAt = lastSeen.UTC().Format(time.RFC3339Nano)
@@ -105,3 +105,14 @@ func (s *PostgresUserStore) RemoveDeviceSettings(ctx context.Context, profileID,
 	}
 	return keys, nil
 }
+
+func (s *PostgresUserStore) RenameDevice(ctx context.Context, profileID, deviceID, name string) error {
+	tag, err := s.pool.Exec(ctx, `UPDATE user_devices SET custom_name=NULLIF($4,'') WHERE user_id=$1 AND profile_id=$2 AND device_id=$3`, s.userID, profileID, deviceID, name)
+	if err != nil {
+		return err
+	}
+	if tag.RowsAffected() == 0 {
+		return userstore.ErrDeviceNotFound
+	}
+	return nil
+}
diff --git a/internal/userstore/pgstore/favorites.go b/internal/userstore/pgstore/favorites.go
index 2efd59c361..b06ca567c5 100644
--- a/internal/userstore/pgstore/favorites.go
+++ b/internal/userstore/pgstore/favorites.go
@@ -14,9 +14,8 @@ import (
 
 // --- Favorites ---
 
-func (s *PostgresUserStore) AddFavorite(ctx context.Context, profileID, mediaItemID string) error {
-	_, err := s.AddFavoriteAt(ctx, profileID, mediaItemID, time.Now().UTC())
-	return err
+func (s *PostgresUserStore) AddFavorite(ctx context.Context, profileID, mediaItemID string) (bool, error) {
+	return s.AddFavoriteAt(ctx, profileID, mediaItemID, time.Now().UTC())
 }
 
 func (s *PostgresUserStore) AddFavoriteAt(ctx context.Context, profileID, mediaItemID string, addedAt time.Time) (bool, error) {
@@ -32,12 +31,15 @@ func (s *PostgresUserStore) AddFavoriteAt(ctx context.Context, profileID, mediaI
 	return tag.RowsAffected() > 0, nil
 }
 
-func (s *PostgresUserStore) RemoveFavorite(ctx context.Context, profileID, mediaItemID string) error {
-	_, err := s.pool.Exec(ctx,
+func (s *PostgresUserStore) RemoveFavorite(ctx context.Context, profileID, mediaItemID string) (bool, error) {
+	tag, err := s.pool.Exec(ctx,
 		`DELETE FROM user_favorites WHERE user_id = $1 AND profile_id = $2 AND media_item_id = $3`,
 		s.userID, profileID, mediaItemID,
 	)
-	return err
+	if err != nil {
+		return false, err
+	}
+	return tag.RowsAffected() > 0, nil
 }
 
 func (s *PostgresUserStore) ListFavorites(ctx context.Context, profileID string, limit, offset int) ([]userstore.Favorite, error) {
@@ -196,9 +198,8 @@ func (s *PostgresUserStore) ListFavoritesByMediaItems(ctx context.Context, profi
 
 // --- Watchlist ---
 
-func (s *PostgresUserStore) AddToWatchlist(ctx context.Context, profileID, mediaItemID string) error {
-	_, err := s.AddToWatchlistAt(ctx, profileID, mediaItemID, time.Now().UTC())
-	return err
+func (s *PostgresUserStore) AddToWatchlist(ctx context.Context, profileID, mediaItemID string) (bool, error) {
+	return s.AddToWatchlistAt(ctx, profileID, mediaItemID, time.Now().UTC())
 }
 
 func (s *PostgresUserStore) AddToWatchlistAt(ctx context.Context, profileID, mediaItemID string, addedAt time.Time) (bool, error) {
@@ -214,12 +215,15 @@ func (s *PostgresUserStore) AddToWatchlistAt(ctx context.Context, profileID, med
 	return tag.RowsAffected() > 0, nil
 }
 
-func (s *PostgresUserStore) RemoveFromWatchlist(ctx context.Context, profileID, mediaItemID string) error {
-	_, err := s.pool.Exec(ctx,
+func (s *PostgresUserStore) RemoveFromWatchlist(ctx context.Context, profileID, mediaItemID string) (bool, error) {
+	tag, err := s.pool.Exec(ctx,
 		`DELETE FROM user_watchlist WHERE user_id = $1 AND profile_id = $2 AND media_item_id = $3`,
 		s.userID, profileID, mediaItemID,
 	)
-	return err
+	if err != nil {
+		return false, err
+	}
+	return tag.RowsAffected() > 0, nil
 }
 
 func (s *PostgresUserStore) ListWatchlist(ctx context.Context, profileID string, limit, offset int) ([]userstore.WatchlistEntry, error) {
diff --git a/internal/userstore/pgstore/not_interested.go b/internal/userstore/pgstore/not_interested.go
new file mode 100644
index 0000000000..459f0f83c0
--- /dev/null
+++ b/internal/userstore/pgstore/not_interested.go
@@ -0,0 +1,106 @@
+package pgstore
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+
+	"github.com/prairie-server/prairie-server/internal/userstore"
+)
+
+// --- Not interested ---
+
+func (s *PostgresUserStore) MarkNotInterested(ctx context.Context, profileID, mediaItemID string) (bool, error) {
+	tag, err := s.pool.Exec(ctx,
+		`INSERT INTO user_not_interested (user_id, profile_id, media_item_id, added_at)
+		 VALUES ($1, $2, $3, $4)
+		 ON CONFLICT DO NOTHING`,
+		s.userID, profileID, mediaItemID, time.Now().UTC(),
+	)
+	if err != nil {
+		return false, fmt.Errorf("marking not interested: %w", err)
+	}
+	return tag.RowsAffected() > 0, nil
+}
+
+func (s *PostgresUserStore) UnmarkNotInterested(ctx context.Context, profileID, mediaItemID string) (bool, error) {
+	tag, err := s.pool.Exec(ctx,
+		`DELETE FROM user_not_interested WHERE user_id = $1 AND profile_id = $2 AND media_item_id = $3`,
+		s.userID, profileID, mediaItemID,
+	)
+	if err != nil {
+		return false, fmt.Errorf("unmarking not interested: %w", err)
+	}
+	return tag.RowsAffected() > 0, nil
+}
+
+func (s *PostgresUserStore) GetNotInterested(ctx context.Context, profileID, mediaItemID string) (*userstore.NotInterestedEntry, error) {
+	var e userstore.NotInterestedEntry
+	var addedAt time.Time
+	err := s.pool.QueryRow(ctx,
+		`SELECT profile_id, media_item_id, added_at FROM user_not_interested
+		 WHERE user_id = $1 AND profile_id = $2 AND media_item_id = $3`,
+		s.userID, profileID, mediaItemID,
+	).Scan(&e.ProfileID, &e.MediaItemID, &addedAt)
+	if errors.Is(err, pgx.ErrNoRows) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, fmt.Errorf("getting not interested mark: %w", err)
+	}
+	e.AddedAt = timeToString(addedAt)
+	return &e, nil
+}
+
+// ListNotInterestedPage pages by keyset over (added_at DESC, media_item_id
+// DESC); see ListFavoritesPage for the precision rule.
+func (s *PostgresUserStore) ListNotInterestedPage(ctx context.Context, profileID string, after *userstore.ListKey, limit int) ([]userstore.NotInterestedEntry, error) {
+	query, args, err := s.listKeysetQuery(`SELECT profile_id, media_item_id, added_at FROM user_not_interested`, profileID, after, limit)
+	if err != nil {
+		return nil, err
+	}
+	rows, err := s.pool.Query(ctx, query, args...)
+	if err != nil {
+		return nil, fmt.Errorf("listing not interested page: %w", err)
+	}
+	defer rows.Close()
+
+	var entries []userstore.NotInterestedEntry
+	for rows.Next() {
+		var e userstore.NotInterestedEntry
+		var addedAt time.Time
+		if err := rows.Scan(&e.ProfileID, &e.MediaItemID, &addedAt); err != nil {
+			return nil, fmt.Errorf("scanning not interested row: %w", err)
+		}
+		e.AddedAt = addedAt.UTC().Format(time.RFC3339Nano)
+		entries = append(entries, e)
+	}
+	return entries, rows.Err()
+}
+
+func (s *PostgresUserStore) ListNotInterestedByMediaItems(ctx context.Context, profileID string, mediaItemIDs []string) (map[string]bool, error) {
+	result := make(map[string]bool, len(mediaItemIDs))
+	if len(mediaItemIDs) == 0 {
+		return result, nil
+	}
+	rows, err := s.pool.Query(ctx,
+		`SELECT media_item_id FROM user_not_interested
+		 WHERE user_id = $1 AND profile_id = $2 AND media_item_id = ANY($3)`,
+		s.userID, profileID, mediaItemIDs,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("listing not interested by media items: %w", err)
+	}
+	defer rows.Close()
+	for rows.Next() {
+		var mediaItemID string
+		if err := rows.Scan(&mediaItemID); err != nil {
+			return nil, fmt.Errorf("scanning not interested row: %w", err)
+		}
+		result[mediaItemID] = true
+	}
+	return result, rows.Err()
+}
diff --git a/internal/userstore/pgstore/profiles.go b/internal/userstore/pgstore/profiles.go
index a8a3c039f7..146d4fc047 100644
--- a/internal/userstore/pgstore/profiles.go
+++ b/internal/userstore/pgstore/profiles.go
@@ -2,8 +2,10 @@ package pgstore
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
+	"slices"
 	"strings"
 	"time"
 
@@ -307,6 +309,49 @@ func updateProfile(
 	return nil
 }
 
+// profileCascadeTables are the tables DeleteProfile clears of the profile's
+// rows by (user_id, profile_id). Tables are listed rather than left to a
+// foreign key so both backends delete identically: the per-user SQLite store
+// has no foreign keys at all. Account-scope rows carry a NULL profile_id and
+// are untouched, which is what removing one household member has to mean.
+// TestPostgresDeleteProfileCoversEveryProfileTable keeps the list complete.
+var profileCascadeTables = []string{
+	"user_favorites",
+	"user_watchlist",
+	"user_watch_progress",
+	"user_watch_history",
+	"user_history_hidden_items",
+	"user_home_item_dismissals",
+	"user_collection_sort_preferences",
+	"user_personal_collections",
+	"user_personal_collection_profiles",
+	"user_audio_preferences",
+	"user_subtitle_preferences",
+	"user_series_playback_preferences",
+	"user_library_playback_preferences",
+	"user_profile_allowed_libraries",
+	"user_profile_onboarding",
+	"user_setting_values",
+	"user_dropped_series",
+	// Leaves titles no profile watchlists any more; the profile
+	// handler's watchlist-title purge sweeps those under the title lock.
+	"user_watchlist_titles",
+	// Recommendation state. A deleted profile's ratings would otherwise
+	// keep shaping other accounts' Similar Users rows, and its taste
+	// would be rebuilt every night.
+	"user_ratings",
+	"user_not_interested",
+	"user_taste_profiles",
+	"user_taste_clusters",
+	"recommendation_cache",
+	// Ebook reading data. Like the recommendation state, it lives in
+	// Postgres whichever store holds the profile; the profile handler
+	// purges it after a delete from any other store.
+	"ebook_reader_progress",
+	"ebook_reader_config",
+	"ebook_reader_annotations",
+}
+
 func (s *PostgresUserStore) DeleteProfile(ctx context.Context, id string) error {
 	tx, err := s.pool.Begin(ctx)
 	if err != nil {
@@ -314,6 +359,22 @@ func (s *PostgresUserStore) DeleteProfile(ctx context.Context, id string) error
 	}
 	defer tx.Rollback(ctx) //nolint:errcheck
 
+	// Lock every collection whose revision the deletes below advance, in id
+	// order, before taking any revision row: the profile's own collections
+	// and those it has visibility rows on. The visibility and item deletes
+	// advance revisions through triggers, and a collection update, or
+	// another profile's delete, locks collections first; taking them in
+	// another order can deadlock.
+	if _, err := tx.Exec(ctx, `
+		SELECT 1 FROM user_personal_collections
+		WHERE user_id = $1 AND (profile_id = $2 OR id IN (
+			SELECT collection_id FROM user_personal_collection_profiles WHERE user_id = $1 AND profile_id = $2
+		))
+		ORDER BY id FOR UPDATE`,
+		s.userID, id); err != nil {
+		return fmt.Errorf("locking collections of profile %s: %w", id, err)
+	}
+
 	// Preferences belong to viewers, not creators, so remove every override
 	// for collections owned by the profile before those collections disappear.
 	if _, err := tx.Exec(ctx, `
@@ -333,25 +394,27 @@ func (s *PostgresUserStore) DeleteProfile(ctx context.Context, id string) error
 		return fmt.Errorf("deleting collection items for profile %s: %w", id, err)
 	}
 
-	// user_setting_values is listed rather than left to its composite profile
-	// FK so both backends delete identically: the per-user SQLite store has no
-	// foreign keys at all. Account-scope rows carry a NULL profile_id and are
-	// untouched, which is what removing one household member has to mean.
-	cascadeTables := []string{
-		"user_favorites",
-		"user_watchlist",
-		"user_watch_progress",
-		"user_collection_sort_preferences",
-		"user_personal_collections",
-		"user_series_playback_preferences",
-		"user_library_playback_preferences",
-		"user_setting_values",
-		"user_dropped_series",
-		// Leaves titles no profile watchlists any more; the profile
-		// handler's watchlist-title purge sweeps those under the title lock.
-		"user_watchlist_titles",
-	}
-	for _, table := range cascadeTables {
+	// Visibility rows of the profile's own collections go with them, as
+	// their items do.
+	if _, err := tx.Exec(ctx, `
+		DELETE FROM user_personal_collection_profiles
+		WHERE user_id = $1 AND collection_id IN (
+			SELECT id FROM user_personal_collections WHERE user_id = $1 AND profile_id = $2
+		)`, s.userID, id); err != nil {
+		return fmt.Errorf("deleting collection visibility for profile %s: %w", id, err)
+	}
+
+	// Jellyfin display preferences carry the profile in their key.
+	if _, err := tx.Exec(ctx,
+		`DELETE FROM jellycompat_displayprefs WHERE user_id = $1 AND left(prefs_id, length($2)) = $2`,
+		s.userID, userstore.ProfileDisplayPrefsPrefix(id)); err != nil {
+		return fmt.Errorf("deleting display preferences for profile %s: %w", id, err)
+	}
+	if err := deleteProfileSectionOverrides(ctx, tx, s.userID, id); err != nil {
+		return err
+	}
+
+	for _, table := range profileCascadeTables {
 		if _, err := tx.Exec(ctx, fmt.Sprintf("DELETE FROM %s WHERE user_id = $1 AND profile_id = $2", table), s.userID, id); err != nil {
 			return fmt.Errorf("deleting from %s for profile %s: %w", table, id, err)
 		}
@@ -393,3 +456,50 @@ func (s *PostgresUserStore) VerifyPIN(ctx context.Context, profileID, pin string
 	}
 	return true, nil
 }
+
+// deleteProfileSectionOverrides takes a profile's entries out of the account's
+// section-override settings, which hold every profile's overrides for one
+// scope and library in one JSON value (see SaveSectionOverrides). A value left
+// with no entries is deleted, as ResetSectionOverrides does.
+func deleteProfileSectionOverrides(ctx context.Context, tx pgx.Tx, userID int, profileID string) error {
+	if err := lockSectionOverrides(ctx, tx, userID); err != nil {
+		return err
+	}
+	rows, err := tx.Query(ctx,
+		`SELECT key, value FROM user_settings WHERE user_id = $1 AND key LIKE 'section\_overrides:%' FOR UPDATE`, userID)
+	if err != nil {
+		return fmt.Errorf("reading section overrides for profile %s: %w", profileID, err)
+	}
+	type setting struct{ key, value string }
+	settings, err := pgx.CollectRows(rows, func(row pgx.CollectableRow) (setting, error) {
+		var s setting
+		err := row.Scan(&s.key, &s.value)
+		return s, err
+	})
+	if err != nil {
+		return fmt.Errorf("reading section overrides for profile %s: %w", profileID, err)
+	}
+	for _, st := range settings {
+		var overrides []userstore.SectionOverride
+		if err := json.Unmarshal([]byte(st.value), &overrides); err != nil {
+			return fmt.Errorf("decoding section overrides %s: %w", st.key, err)
+		}
+		kept := slices.DeleteFunc(overrides, func(o userstore.SectionOverride) bool { return o.ProfileID == profileID })
+		if len(kept) == len(overrides) {
+			continue
+		}
+		if len(kept) == 0 {
+			_, err = tx.Exec(ctx, `DELETE FROM user_settings WHERE user_id = $1 AND key = $2`, userID, st.key)
+		} else {
+			var data []byte
+			if data, err = json.Marshal(kept); err != nil {
+				return fmt.Errorf("encoding section overrides %s: %w", st.key, err)
+			}
+			_, err = tx.Exec(ctx, `UPDATE user_settings SET value = $3 WHERE user_id = $1 AND key = $2`, userID, st.key, string(data))
+		}
+		if err != nil {
+			return fmt.Errorf("writing section overrides %s: %w", st.key, err)
+		}
+	}
+	return nil
+}
diff --git a/internal/userstore/pgstore/progress.go b/internal/userstore/pgstore/progress.go
index 862c53743f..424aca69b5 100644
--- a/internal/userstore/pgstore/progress.go
+++ b/internal/userstore/pgstore/progress.go
@@ -151,8 +151,7 @@ func (s *PostgresUserStore) SetProgressAt(ctx context.Context, profileID, mediaI
 	if updatedAt.IsZero() {
 		updatedAt = time.Now().UTC()
 	}
-	updatedAtText := updatedAt.UTC().Format(time.RFC3339)
-	suppressed, err := s.historyIsHidden(ctx, profileID, mediaItemID, updatedAtText)
+	suppressed, err := s.historyIsHidden(ctx, profileID, mediaItemID, updatedAt.UTC())
 	if err != nil {
 		return err
 	}
@@ -189,8 +188,7 @@ func (s *PostgresUserStore) SetProgressIfNewer(ctx context.Context, profileID, m
 	if updatedAt.IsZero() {
 		updatedAt = time.Now().UTC()
 	}
-	updatedAtText := updatedAt.UTC().Format(time.RFC3339)
-	suppressed, err := s.historyIsHidden(ctx, profileID, mediaItemID, updatedAtText)
+	suppressed, err := s.historyIsHidden(ctx, profileID, mediaItemID, updatedAt.UTC())
 	if err != nil {
 		return false, err
 	}
@@ -318,6 +316,34 @@ func (s *PostgresUserStore) ClearProgress(ctx context.Context, profileID, mediaI
 	return nil
 }
 
+// ClearResumePosition is one conditional UPDATE, so there is no window for a
+// concurrent unmark between reading and writing the row. updated_at is raised
+// to at least event_at: the stamp trigger copies updated_at into an unchanged
+// event_at, and an offline write may have left event_at slightly ahead.
+func (s *PostgresUserStore) ClearResumePosition(ctx context.Context, profileID, mediaItemID string, at time.Time) (bool, error) {
+	tag, err := s.pool.Exec(ctx, `
+		UPDATE user_watch_progress
+		SET position_seconds = 0,
+			updated_at = GREATEST($4::timestamptz, updated_at, event_at),
+			event_at = GREATEST($4::timestamptz, event_at)
+		WHERE user_id = $1 AND profile_id = $2 AND media_item_id = $3
+		  AND position_seconds > 0
+		  AND NOT EXISTS (
+			SELECT 1
+			FROM user_history_hidden_items hhi
+			WHERE hhi.user_id = user_watch_progress.user_id
+			  AND hhi.profile_id = user_watch_progress.profile_id
+			  AND hhi.media_item_id = user_watch_progress.media_item_id
+			  AND user_watch_progress.updated_at <= hhi.hidden_before
+		  )`,
+		s.userID, profileID, mediaItemID, at.UTC(),
+	)
+	if err != nil {
+		return false, fmt.Errorf("clearing resume position: %w", err)
+	}
+	return tag.RowsAffected() > 0, nil
+}
+
 // MarkWatchedBatch atomically marks incomplete targets watched and inserts
 // their history rows. Conflict updates recheck completed state after any
 // concurrent writer, and only changed targets emit history and provider entries.
@@ -1141,7 +1167,11 @@ func (s *PostgresUserStore) AddHistory(ctx context.Context, entry userstore.Watc
 	if entry.Source == "" {
 		entry.Source = userstore.WatchHistorySourceLegacy
 	}
-	suppressed, err := s.historyIsHidden(ctx, entry.ProfileID, entry.MediaItemID, entry.WatchedAt)
+	watchedAt, err := time.Parse(time.RFC3339Nano, entry.WatchedAt)
+	if err != nil {
+		return fmt.Errorf("parsing history watched_at: %w", err)
+	}
+	suppressed, err := s.historyIsHidden(ctx, entry.ProfileID, entry.MediaItemID, watchedAt)
 	if err != nil {
 		return err
 	}
@@ -1156,7 +1186,7 @@ func (s *PostgresUserStore) AddHistory(ctx context.Context, entry userstore.Watc
 		INSERT INTO user_watch_history (id, user_id, profile_id, media_item_id, watched_at, duration_seconds, completed, source, watch_identity)
 		VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)`,
 		entry.ID, s.userID, entry.ProfileID, entry.MediaItemID,
-		entry.WatchedAt, entry.DurationSeconds, entry.Completed, entry.Source,
+		watchedAt, entry.DurationSeconds, entry.Completed, entry.Source,
 		string(identityJSON),
 	)
 	if err != nil {
@@ -1228,6 +1258,10 @@ func (s *PostgresUserStore) AddHistoryIfMissing(ctx context.Context, entry users
 	if entry.Source == "" {
 		entry.Source = userstore.WatchHistorySourceLegacy
 	}
+	watchedAt, err := time.Parse(time.RFC3339Nano, entry.WatchedAt)
+	if err != nil {
+		return false, fmt.Errorf("parsing imported history watched_at: %w", err)
+	}
 	identityJSON, err := json.Marshal(entry.Identity)
 	if err != nil {
 		return false, fmt.Errorf("marshaling watch identity: %w", err)
@@ -1242,20 +1276,32 @@ func (s *PostgresUserStore) AddHistoryIfMissing(ctx context.Context, entry users
 	if err := lockImportedHistory(ctx, tx, s.userID, entry.ProfileID); err != nil {
 		return false, err
 	}
+	// The watermark is compared at full precision ($5), so an import later in
+	// the same second as a removal is kept. It is stored at the whole second
+	// ($10), as imports always were, unless that second is at or before the
+	// watermark; then it keeps its precise time to stay visible. Any row in the
+	// same second counts as the same play, whichever precision it was kept at.
 	tag, err := tx.Exec(ctx, `
-
+        WITH visible AS (
+            SELECT CASE
+                WHEN hhi.hidden_before IS NULL OR $10::timestamptz > hhi.hidden_before THEN $10::timestamptz
+                ELSE $5::timestamptz
+            END AS watched_at
+            FROM (SELECT 1) seed
+            LEFT JOIN user_history_hidden_items hhi
+              ON hhi.user_id = $2 AND hhi.profile_id = $3 AND hhi.media_item_id = $4
+            WHERE hhi.hidden_before IS NULL OR $5::timestamptz > hhi.hidden_before
+        )
         INSERT INTO user_watch_history (id, user_id, profile_id, media_item_id, watched_at, duration_seconds, completed, source, watch_identity)
-        SELECT $1, $2, $3, $4, $5, $6, $7, $8, $9
+        SELECT $1, $2, $3, $4, visible.watched_at, $6, $7, $8, $9
+        FROM visible
         WHERE NOT EXISTS (
-            SELECT 1 FROM user_history_hidden_items
-            WHERE user_id = $2 AND profile_id = $3 AND media_item_id = $4
-              AND hidden_before >= $5::timestamptz
-        ) AND NOT EXISTS (
             SELECT 1 FROM user_watch_history
             WHERE user_id = $2 AND profile_id = $3 AND media_item_id = $4
-              AND watched_at = $5::timestamptz
+              AND watched_at >= $10::timestamptz AND watched_at < $10::timestamptz + interval '1 second'
         )`,
-		entry.ID, s.userID, entry.ProfileID, entry.MediaItemID, entry.WatchedAt, entry.DurationSeconds, entry.Completed, entry.Source, string(identityJSON))
+		entry.ID, s.userID, entry.ProfileID, entry.MediaItemID, watchedAt, entry.DurationSeconds, entry.Completed, entry.Source, string(identityJSON),
+		watchedAt.Truncate(time.Second))
 	if err != nil {
 		return false, fmt.Errorf("adding missing history: %w", err)
 	}
@@ -1581,9 +1627,13 @@ func (s *PostgresUserStore) DeleteHistoryBySource(ctx context.Context, profileID
 	return nil
 }
 
+// historyIsHidden reports whether a write at watchedAt is at or before the
+// item's removal watermark. Both are compared as timestamptz, to the
+// microsecond, so a write later in the same second as a removal stays visible.
 func (s *PostgresUserStore) historyIsHidden(
 	ctx context.Context,
-	profileID, mediaItemID, watchedAt string,
+	profileID, mediaItemID string,
+	watchedAt time.Time,
 ) (bool, error) {
 	var exists bool
 	if err := s.pool.QueryRow(ctx, `
diff --git a/internal/userstore/pgstore/same_second_removal_test.go b/internal/userstore/pgstore/same_second_removal_test.go
new file mode 100644
index 0000000000..98fb784174
--- /dev/null
+++ b/internal/userstore/pgstore/same_second_removal_test.go
@@ -0,0 +1,127 @@
+package pgstore
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/userstore"
+)
+
+// Imported progress and history carry the event's own time, and a history
+// removal hides everything at or before its watermark, to the microsecond. A
+// write later in the same second as the removal must stay visible, while one
+// at or before the removal stays hidden.
+func TestImportedWritesAfterSameSecondRemovalDB(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := t.Context()
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(pool.Close)
+	var userID int
+	if err := pool.QueryRow(ctx, `INSERT INTO users(username,role) VALUES($1,'user') RETURNING id`,
+		fmt.Sprintf("same-second-removal-%d", time.Now().UnixNano())).Scan(&userID); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _, _ = pool.Exec(context.Background(), `DELETE FROM users WHERE id = $1`, userID) })
+	store := newStore(pool, userID)
+	if err := store.CreateProfile(ctx, userstore.Profile{ID: "p1", Name: "Viewer"}); err != nil {
+		t.Fatal(err)
+	}
+
+	second := time.Date(2026, 4, 7, 12, 0, 0, 0, time.UTC)
+	removedAt := second.Add(500 * time.Millisecond)
+	stale := []time.Time{second.Add(300 * time.Millisecond), removedAt}
+	later := second.Add(900 * time.Millisecond)
+
+	for _, tc := range []struct {
+		name  string
+		write func(mediaItemID string, at time.Time) error
+	}{
+		{"SetProgressAt", func(mediaItemID string, at time.Time) error {
+			return store.SetProgressAt(ctx, "p1", mediaItemID, 0, 600, true, at)
+		}},
+		{"SetProgressIfNewer", func(mediaItemID string, at time.Time) error {
+			_, err := store.SetProgressIfNewer(ctx, "p1", mediaItemID, 0, 600, true, at)
+			return err
+		}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			mediaItemID := "same-second-" + tc.name
+			if err := tc.write(mediaItemID, second.Add(-time.Hour)); err != nil {
+				t.Fatal(err)
+			}
+			if err := store.RemoveHistoryItems(ctx, "p1", []string{mediaItemID}, removedAt); err != nil {
+				t.Fatal(err)
+			}
+			for _, at := range stale {
+				if err := tc.write(mediaItemID, at); err != nil {
+					t.Fatal(err)
+				}
+				if progress, err := store.GetProgress(ctx, "p1", mediaItemID); err != nil || progress != nil {
+					t.Fatalf("write at %s, at or before the %s removal: progress %+v, err %v; want hidden", at.Format(time.RFC3339Nano), removedAt.Format(time.RFC3339Nano), progress, err)
+				}
+			}
+			if err := tc.write(mediaItemID, later); err != nil {
+				t.Fatal(err)
+			}
+			if progress, err := store.GetProgress(ctx, "p1", mediaItemID); err != nil || progress == nil || !progress.Completed {
+				t.Fatalf("write at %s, after the %s removal: progress %+v, err %v; want completed", later.Format(time.RFC3339Nano), removedAt.Format(time.RFC3339Nano), progress, err)
+			}
+		})
+	}
+
+	t.Run("AddHistoryIfMissing", func(t *testing.T) {
+		const mediaItemID = "same-second-history"
+		imported := func(at string) userstore.WatchHistoryEntry {
+			return userstore.WatchHistoryEntry{ProfileID: "p1", MediaItemID: mediaItemID, WatchedAt: at, Completed: true, Source: userstore.WatchHistorySourceImport}
+		}
+		if created, err := store.AddHistoryIfMissing(ctx, imported(second.Add(-time.Hour).Format(time.RFC3339))); err != nil || !created {
+			t.Fatalf("seed: created %v, err %v", created, err)
+		}
+		if err := store.RemoveHistoryItems(ctx, "p1", []string{mediaItemID}, removedAt); err != nil {
+			t.Fatal(err)
+		}
+		for _, at := range stale {
+			if created, err := store.AddHistoryIfMissing(ctx, imported(at.Format(time.RFC3339Nano))); err != nil || created {
+				t.Fatalf("import at %s, at or before the %s removal: created %v, err %v; want hidden", at.Format(time.RFC3339Nano), removedAt.Format(time.RFC3339Nano), created, err)
+			}
+		}
+		if created, err := store.AddHistoryIfMissing(ctx, imported(later.Format(time.RFC3339Nano))); err != nil || !created {
+			t.Fatalf("import at %s, after the %s removal: created %v, err %v", later.Format(time.RFC3339Nano), removedAt.Format(time.RFC3339Nano), created, err)
+		}
+		// A replay, or the same play reported by another source a moment
+		// later, is a duplicate rather than a second watch.
+		for _, at := range []time.Time{later, later.Add(50 * time.Millisecond)} {
+			if created, err := store.AddHistoryIfMissing(ctx, imported(at.Format(time.RFC3339Nano))); err != nil || created {
+				t.Fatalf("import at %s, beside one at %s: created %v, err %v; want a duplicate", at.Format(time.RFC3339Nano), later.Format(time.RFC3339Nano), created, err)
+			}
+		}
+		completed, err := store.ListCompletedHistoryItems(ctx, userstore.CompletedHistoryItemQuery{ProfileID: "p1", MediaItemIDs: []string{mediaItemID}})
+		if err != nil || len(completed) != 1 {
+			t.Fatalf("import at %s, after the %s removal: completed history %+v, err %v; want the item", later.Format(time.RFC3339Nano), removedAt.Format(time.RFC3339Nano), completed, err)
+		}
+		if rows, err := store.ListHistory(ctx, "p1", 10, 0); err != nil || len(rows) != 1 {
+			t.Fatalf("history after a replayed import: %+v, err %v; want one row", rows, err)
+		}
+
+		// Imports outside the removal's second keep whole-second stamps, so a
+		// replay with a sub-second time still matches a row stored before.
+		next := second.Add(2 * time.Second)
+		if created, err := store.AddHistoryIfMissing(ctx, imported(next.Format(time.RFC3339))); err != nil || !created {
+			t.Fatalf("whole-second import: created %v, err %v", created, err)
+		}
+		if created, err := store.AddHistoryIfMissing(ctx, imported(next.Add(400*time.Millisecond).Format(time.RFC3339Nano))); err != nil || created {
+			t.Fatalf("sub-second replay of a whole-second import: created %v, err %v; want a duplicate", created, err)
+		}
+	})
+}
diff --git a/internal/userstore/pgstore/section_overrides.go b/internal/userstore/pgstore/section_overrides.go
index d70df2d4a9..3a86dda06e 100644
--- a/internal/userstore/pgstore/section_overrides.go
+++ b/internal/userstore/pgstore/section_overrides.go
@@ -4,6 +4,9 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"slices"
+
+	"github.com/jackc/pgx/v5"
 
 	"github.com/prairie-server/prairie-server/internal/userstore"
 )
@@ -56,11 +59,6 @@ func (s *PostgresUserStore) ListAllSectionOverrides(ctx context.Context) ([]user
 }
 
 func (s *PostgresUserStore) SaveSectionOverrides(ctx context.Context, profileID, scope, libraryID string, overrides []userstore.SectionOverride) error {
-	existing, err := s.listAllSectionOverrides(ctx, scope, libraryID)
-	if err != nil {
-		return err
-	}
-
 	// Set profile ID on all overrides.
 	for i := range overrides {
 		overrides[i].ProfileID = profileID
@@ -71,49 +69,80 @@ func (s *PostgresUserStore) SaveSectionOverrides(ctx context.Context, profileID,
 		overrides[i].CreatedAt = now
 		overrides[i].UpdatedAt = now
 	}
-
-	merged := make([]userstore.SectionOverride, 0, len(existing)+len(overrides))
-	for _, override := range existing {
-		if override.ProfileID != profileID {
-			merged = append(merged, override)
+	return s.updateSectionOverrides(ctx, scope, libraryID, func(existing []userstore.SectionOverride) []userstore.SectionOverride {
+		merged := make([]userstore.SectionOverride, 0, len(existing)+len(overrides))
+		for _, override := range existing {
+			if override.ProfileID != profileID {
+				merged = append(merged, override)
+			}
 		}
+		return append(merged, overrides...)
+	})
+}
+
+func (s *PostgresUserStore) ResetSectionOverrides(ctx context.Context, profileID, scope, libraryID string) error {
+	return s.updateSectionOverrides(ctx, scope, libraryID, func(existing []userstore.SectionOverride) []userstore.SectionOverride {
+		return slices.DeleteFunc(existing, func(o userstore.SectionOverride) bool { return o.ProfileID == profileID })
+	})
+}
+
+// sectionOverridesAdvisoryClass is the advisory-lock class every writer of an
+// account's section overrides takes (see lockSectionOverrides).
+const sectionOverridesAdvisoryClass int32 = 0x5345434f // "SECO"
+
+// lockSectionOverrides serializes the account's section-override writers for
+// the rest of tx. Each setting holds every profile's overrides for one scope
+// and library, so a writer reads, merges and writes the whole value, and two
+// writers that interleave would lose one profile's change. The lock also
+// covers a value that does not exist yet, which a row lock cannot.
+func lockSectionOverrides(ctx context.Context, tx pgx.Tx, userID int) error {
+	if _, err := tx.Exec(ctx, "SELECT pg_advisory_xact_lock($1, $2)", sectionOverridesAdvisoryClass, int32(userID)); err != nil {
+		return fmt.Errorf("locking section overrides: %w", err)
 	}
-	merged = append(merged, overrides...)
+	return nil
+}
 
-	// JSON marshaling preserves the full override payload, including removed.
-	data, err := json.Marshal(merged)
+// updateSectionOverrides replaces one scope and library's overrides with
+// update's result, under lockSectionOverrides. JSON marshaling preserves
+// the full override payload, including removed. A result with no entries
+// deletes the setting.
+func (s *PostgresUserStore) updateSectionOverrides(ctx context.Context, scope, libraryID string, update func([]userstore.SectionOverride) []userstore.SectionOverride) error {
+	tx, err := s.pool.Begin(ctx)
 	if err != nil {
-		return fmt.Errorf("marshaling section overrides: %w", err)
+		return fmt.Errorf("beginning section overrides update: %w", err)
+	}
+	defer tx.Rollback(ctx) //nolint:errcheck
+	if err := lockSectionOverrides(ctx, tx, s.userID); err != nil {
+		return err
 	}
-
 	key := sectionOverridesKey(scope, libraryID)
-	return s.SetSetting(ctx, key, string(data))
-}
-
-func (s *PostgresUserStore) ResetSectionOverrides(ctx context.Context, profileID, scope, libraryID string) error {
-	existing, err := s.listAllSectionOverrides(ctx, scope, libraryID)
+	val, err := getSetting(ctx, tx, s.userID, key)
 	if err != nil {
 		return err
 	}
-
-	remaining := existing[:0]
-	for _, override := range existing {
-		if override.ProfileID != profileID {
-			remaining = append(remaining, override)
+	var existing []userstore.SectionOverride
+	if val != "" {
+		if err := json.Unmarshal([]byte(val), &existing); err != nil {
+			return fmt.Errorf("unmarshaling section overrides: %w", err)
 		}
 	}
-
-	key := sectionOverridesKey(scope, libraryID)
-	if len(remaining) == 0 {
-		return s.DeleteSetting(ctx, key)
+	next := update(existing)
+	if len(next) == 0 {
+		_, err = tx.Exec(ctx, "DELETE FROM user_settings WHERE user_id = $1 AND key = $2", s.userID, key)
+	} else {
+		var data []byte
+		if data, err = json.Marshal(next); err != nil {
+			return fmt.Errorf("marshaling section overrides: %w", err)
+		}
+		_, err = tx.Exec(ctx,
+			`INSERT INTO user_settings (user_id, key, value) VALUES ($1, $2, $3)
+			 ON CONFLICT(user_id, key) DO UPDATE SET value = excluded.value`,
+			s.userID, key, string(data))
 	}
-
-	data, err := json.Marshal(remaining)
 	if err != nil {
-		return fmt.Errorf("marshaling section overrides: %w", err)
+		return fmt.Errorf("writing section overrides %q: %w", key, err)
 	}
-
-	return s.SetSetting(ctx, key, string(data))
+	return tx.Commit(ctx)
 }
 
 func (s *PostgresUserStore) listAllSectionOverrides(ctx context.Context, scope, libraryID string) ([]userstore.SectionOverride, error) {
diff --git a/internal/userstore/store.go b/internal/userstore/store.go
index a0f0e70254..ca8914c8c2 100644
--- a/internal/userstore/store.go
+++ b/internal/userstore/store.go
@@ -86,6 +86,12 @@ type UserStore interface {
 	MarkProgressBatch(ctx context.Context, profileID string, mediaItemIDs []string, updatedAt time.Time) error
 	ClearProgressBatch(ctx context.Context, profileID string, mediaItemIDs []string, updatedAt time.Time) error
 	ClearProgress(ctx context.Context, profileID, mediaItemID string) error
+	// ClearResumePosition sets a visible resume position to 0 and reports
+	// whether there was one. It keeps the watched latch, the duration and
+	// watch history, never inserts a row, and stamps updated_at and event_at
+	// no earlier than at, so delta sync carries the change and an older
+	// provider resume point loses to it.
+	ClearResumePosition(ctx context.Context, profileID, mediaItemID string, at time.Time) (bool, error)
 	GetProgress(ctx context.Context, profileID, mediaItemID string) (*WatchProgress, error)
 	ListProgress(ctx context.Context, profileID, status string, limit, offset int) ([]WatchProgress, error)
 	// ListProgressPage is the keyset form of ListProgress: the same status
@@ -137,10 +143,11 @@ type UserStore interface {
 	UpsertHomeDismissal(ctx context.Context, dismissal HomeItemDismissal) error
 	DeleteHomeDismissal(ctx context.Context, profileID, surface, mediaItemID string) error
 
-	// Favorites & Watchlist
-	AddFavorite(ctx context.Context, profileID, mediaItemID string) error
+	// Favorites & Watchlist. Each add and remove reports whether it changed
+	// a row: false for an item already on the list or already absent.
+	AddFavorite(ctx context.Context, profileID, mediaItemID string) (bool, error)
 	AddFavoriteAt(ctx context.Context, profileID, mediaItemID string, addedAt time.Time) (bool, error)
-	RemoveFavorite(ctx context.Context, profileID, mediaItemID string) error
+	RemoveFavorite(ctx context.Context, profileID, mediaItemID string) (bool, error)
 	ListFavorites(ctx context.Context, profileID string, limit, offset int) ([]Favorite, error)
 	// ListFavoritesPage is the keyset form of ListFavorites: ordered by
 	// (added_at DESC, media_item_id DESC), returning at most limit rows
@@ -151,9 +158,9 @@ type UserStore interface {
 	// GetFavorite answers the profile's favorite entry for the item, nil when
 	// the item is not a favorite.
 	GetFavorite(ctx context.Context, profileID, mediaItemID string) (*Favorite, error)
-	AddToWatchlist(ctx context.Context, profileID, mediaItemID string) error
+	AddToWatchlist(ctx context.Context, profileID, mediaItemID string) (bool, error)
 	AddToWatchlistAt(ctx context.Context, profileID, mediaItemID string, addedAt time.Time) (bool, error)
-	RemoveFromWatchlist(ctx context.Context, profileID, mediaItemID string) error
+	RemoveFromWatchlist(ctx context.Context, profileID, mediaItemID string) (bool, error)
 	// ReplaceWatchlistOrder mirrors a provider's watchlist order: the given ids
 	// get sort_index 0..N-1 in order; all other rows reset to added_at ordering.
 	ReplaceWatchlistOrder(ctx context.Context, profileID string, orderedMediaItemIDs []string) error
@@ -174,6 +181,19 @@ type UserStore interface {
 	// hidden from display so they reappear when new episodes are added.
 	RemoveWatchedFromWatchlist(ctx context.Context, profileID string) (bool, error)
 
+	// Not interested. A mark keeps a movie or series out of the profile's
+	// recommendations and counts against similar titles there; it leaves
+	// every other surface alone. Mark and unmark report whether they changed
+	// a row.
+	MarkNotInterested(ctx context.Context, profileID, mediaItemID string) (bool, error)
+	UnmarkNotInterested(ctx context.Context, profileID, mediaItemID string) (bool, error)
+	// GetNotInterested answers the profile's mark on the item, nil when the
+	// item is not marked.
+	GetNotInterested(ctx context.Context, profileID, mediaItemID string) (*NotInterestedEntry, error)
+	// ListNotInterestedPage pages the profile's marks like ListFavoritesPage.
+	ListNotInterestedPage(ctx context.Context, profileID string, after *ListKey, limit int) ([]NotInterestedEntry, error)
+	ListNotInterestedByMediaItems(ctx context.Context, profileID string, mediaItemIDs []string) (map[string]bool, error)
+
 	// Collections
 	CreateCollection(ctx context.Context, input CreateCollectionInput) (*Collection, error)
 	GetCollection(ctx context.Context, id string) (*Collection, error)
diff --git a/internal/userstore/storetest/device_settings.go b/internal/userstore/storetest/device_settings.go
index f3aa58cc1f..7756bf9590 100644
--- a/internal/userstore/storetest/device_settings.go
+++ b/internal/userstore/storetest/device_settings.go
@@ -79,3 +79,77 @@ func RunDeviceSettings(t *testing.T, newStore func(*testing.T) userstore.UserSto
 		t.Fatalf("sibling changed: %+v %v", page, err)
 	}
 }
+
+// RunDeviceRename pins that a custom name belongs to one profile's row for one
+// device, survives the device being registered again, and clears to the
+// reported name.
+func RunDeviceRename(t *testing.T, newStore func(*testing.T) userstore.UserStore) {
+	store := newStore(t)
+	devices, ok := store.(userstore.DeviceSettingsStore)
+	if !ok {
+		t.Fatal("missing device settings implementation")
+	}
+	registry, ok := store.(userstore.DeviceRegistry)
+	if !ok {
+		t.Fatal("missing device registry implementation")
+	}
+	ctx := t.Context()
+	const reported, unnamed = "Apple TV", "Apple TV|"
+	for _, profile := range []string{"a", "b"} {
+		if err := store.CreateProfile(ctx, userstore.Profile{ID: profile, Name: profile}); err != nil {
+			t.Fatal(err)
+		}
+		for _, device := range []string{"one", "two"} {
+			if err := registry.RegisterDevice(ctx, userstore.DeviceEntry{ProfileID: profile, DeviceID: device, DeviceName: reported, LastSeenAt: "2026-01-02T03:04:05Z"}); err != nil {
+				t.Fatal(err)
+			}
+		}
+	}
+	names := func() map[string]string {
+		t.Helper()
+		page, err := devices.ListDeviceSettingsPage(ctx, userstore.DevicePageOptions{Limit: 10})
+		if err != nil {
+			t.Fatal(err)
+		}
+		got := map[string]string{}
+		for _, entry := range page {
+			got[entry.ProfileID+"/"+entry.DeviceID] = entry.DeviceName + "|" + entry.CustomName
+		}
+		return got
+	}
+
+	if err := devices.RenameDevice(ctx, "a", "one", "Living Room"); err != nil {
+		t.Fatal(err)
+	}
+	want := map[string]string{"a/one": unnamed + "Living Room", "a/two": unnamed, "b/one": unnamed, "b/two": unnamed}
+	if got := names(); !reflect.DeepEqual(got, want) {
+		t.Fatalf("rename reached other rows: %v", got)
+	}
+	if err := devices.RenameDevice(ctx, "a", "one", "Living Room"); err != nil {
+		t.Fatalf("repeating a rename: %v", err)
+	}
+	one, err := devices.ListDeviceSettingsPage(ctx, userstore.DevicePageOptions{ProfileID: "a", DeviceID: "one", Limit: 10})
+	if err != nil || len(one) != 1 || one[0].ProfileID != "a" || one[0].DeviceID != "one" || one[0].CustomName != "Living Room" {
+		t.Fatalf("one device's row: %+v %v", one, err)
+	}
+
+	if err := registry.RegisterDevice(ctx, userstore.DeviceEntry{ProfileID: "a", DeviceID: "one", DeviceName: "Apple TV 4K", LastSeenAt: "2026-01-03T03:04:05Z"}); err != nil {
+		t.Fatal(err)
+	}
+	if got := names()["a/one"]; got != "Apple TV 4K|Living Room" {
+		t.Fatalf("registering again: %q", got)
+	}
+
+	if err := devices.RenameDevice(ctx, "a", "one", ""); err != nil {
+		t.Fatal(err)
+	}
+	if got := names()["a/one"]; got != "Apple TV 4K|" {
+		t.Fatalf("clearing: %q", got)
+	}
+
+	for _, target := range [][2]string{{"a", "missing"}, {"c", "one"}} {
+		if err := devices.RenameDevice(ctx, target[0], target[1], "x"); !errors.Is(err, userstore.ErrDeviceNotFound) {
+			t.Fatalf("rename %v: %v", target, err)
+		}
+	}
+}
diff --git a/internal/userstore/storetest/profile_delete.go b/internal/userstore/storetest/profile_delete.go
new file mode 100644
index 0000000000..fd288992a7
--- /dev/null
+++ b/internal/userstore/storetest/profile_delete.go
@@ -0,0 +1,194 @@
+package storetest
+
+import (
+	"context"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/prairie-server/prairie-server/internal/userstore"
+)
+
+const (
+	deletedProfile = "pd-deleted"
+	keptProfile    = "pd-kept"
+	deleteSeries   = "series:delete-check"
+	deleteTour     = "core-2026-07"
+	deleteDevice   = "device-delete-check"
+	deleteSetting  = "player.playback_speed"
+	hiddenTitle    = "movie:hidden-before"
+	deleteScope    = "home"
+	deletePrefsID  = "usersettings"
+	deleteClient   = "emby"
+)
+
+// registeredDevice names the device registry row profileStateLeft reports.
+const registeredDevice = "registered device"
+
+// profileStateKinds is how many kinds of state seedProfileState writes.
+const profileStateKinds = 9
+
+// RunDeleteProfileRemovesProfileState checks that deleting a profile removes
+// the per-profile state the store keeps beyond its lists and progress: watch
+// history, hidden-history cutoffs, Home dismissals, audio and subtitle
+// preferences, onboarding state, device settings and registry rows, section
+// overrides and Jellyfin display preferences. Another profile's state
+// stays. A profile recreated under the deleted ID starts clean, so nothing
+// the old profile left behind (a hidden-history cutoff above all) reaches it.
+//
+// devicesPurgedElsewhere marks a store whose device registry another step
+// clears: the Postgres registry shares user_devices with downloads, which the
+// profile handler's device-library purge removes along with them.
+func RunDeleteProfileRemovesProfileState(t *testing.T, newStore func(t *testing.T) userstore.UserStore, devicesPurgedElsewhere bool) {
+	ctx := context.Background()
+	store := newStore(t)
+	for _, id := range []string{keptProfile, deletedProfile} {
+		if err := store.CreateProfile(ctx, userstore.Profile{ID: id, Name: id}); err != nil {
+			t.Fatalf("CreateProfile %s: %v", id, err)
+		}
+	}
+	watchedAt := time.Date(2026, 3, 4, 5, 6, 7, 0, time.UTC)
+	for _, id := range []string{keptProfile, deletedProfile} {
+		seedProfileState(t, ctx, store, id, watchedAt)
+	}
+
+	if err := store.DeleteProfile(ctx, deletedProfile); err != nil {
+		t.Fatalf("DeleteProfile: %v", err)
+	}
+	if err := store.CreateProfile(ctx, userstore.Profile{ID: deletedProfile, Name: "Recreated"}); err != nil {
+		t.Fatalf("CreateProfile(recreate): %v", err)
+	}
+
+	// The recreated profile starts clean.
+	left := profileStateLeft(t, ctx, store, deletedProfile)
+	if devicesPurgedElsewhere {
+		left = slices.DeleteFunc(left, func(kind string) bool { return kind == registeredDevice })
+	}
+	if len(left) > 0 {
+		t.Fatalf("deleted profile left behind: %v", left)
+	}
+	// History recorded before the old profile's hidden-history cutoff shows.
+	entry := userstore.WatchHistoryEntry{ID: "pd-after", ProfileID: deletedProfile, MediaItemID: hiddenTitle, WatchedAt: watchedAt.Format(time.RFC3339), Completed: true}
+	if err := store.AddHistory(ctx, entry); err != nil {
+		t.Fatalf("AddHistory(recreated): %v", err)
+	}
+	if rows, err := store.ListHistory(ctx, deletedProfile, 10, 0); err != nil || len(rows) != 1 {
+		t.Fatalf("recreated profile history = %d rows, %v; want the new row, not hidden by the old profile's cutoff", len(rows), err)
+	}
+
+	// The other profile keeps everything.
+	if got := profileStateLeft(t, ctx, store, keptProfile); len(got) != profileStateKinds {
+		t.Fatalf("other profile kept %v, want all %d kinds of state", got, profileStateKinds)
+	}
+}
+
+// seedProfileState gives profileID one row of each kind of state, with
+// movie:hidden-before hidden from its history.
+func seedProfileState(t *testing.T, ctx context.Context, store userstore.UserStore, profileID string, watchedAt time.Time) {
+	t.Helper()
+	at := watchedAt.Format(time.RFC3339)
+	for _, entry := range []userstore.WatchHistoryEntry{
+		{ID: profileID + "-h1", ProfileID: profileID, MediaItemID: "movie:history", WatchedAt: at, Completed: true},
+		{ID: profileID + "-h2", ProfileID: profileID, MediaItemID: hiddenTitle, WatchedAt: at, Completed: true},
+	} {
+		if err := store.AddHistory(ctx, entry); err != nil {
+			t.Fatalf("AddHistory %s: %v", profileID, err)
+		}
+	}
+	if err := store.RemoveHistoryItems(ctx, profileID, []string{hiddenTitle}, watchedAt.Add(time.Hour)); err != nil {
+		t.Fatalf("RemoveHistoryItems %s: %v", profileID, err)
+	}
+	progressAt := at
+	if err := store.UpsertHomeDismissal(ctx, userstore.HomeItemDismissal{
+		ProfileID: profileID, Surface: userstore.HomeSurfaceContinueWatching, MediaItemID: "movie:dismissed",
+		ProgressUpdatedAt: &progressAt, DismissedAt: at,
+	}); err != nil {
+		t.Fatalf("UpsertHomeDismissal %s: %v", profileID, err)
+	}
+	if err := store.SetAudioPreference(ctx, userstore.AudioPreference{ProfileID: profileID, SeriesID: deleteSeries, AudioTrackIndex: 1, AudioLanguage: "en"}); err != nil {
+		t.Fatalf("SetAudioPreference %s: %v", profileID, err)
+	}
+	if err := store.SetSubtitlePreference(ctx, userstore.SubtitlePreference{ProfileID: profileID, SeriesID: deleteSeries, SubtitleTrackIndex: 2, SubtitleLanguage: "en", SubtitleMode: "on"}); err != nil {
+		t.Fatalf("SetSubtitlePreference %s: %v", profileID, err)
+	}
+	if err := store.UpsertOnboardingState(ctx, userstore.OnboardingState{ProfileID: profileID, TourID: deleteTour, LastStep: "subtitles"}); err != nil {
+		t.Fatalf("UpsertOnboardingState %s: %v", profileID, err)
+	}
+	if err := store.SetDeviceSetting(ctx, userstore.DeviceSettingEntry{ProfileID: profileID, DeviceID: deleteDevice, Key: deleteSetting, Value: "1.25"}); err != nil {
+		t.Fatalf("SetDeviceSetting %s: %v", profileID, err)
+	}
+	registry, ok := store.(userstore.DeviceRegistry)
+	if !ok {
+		t.Fatal("the store keeps no device registry")
+	}
+	if err := registry.RegisterDevice(ctx, userstore.DeviceEntry{ProfileID: profileID, DeviceID: deleteDevice, DeviceName: "Phone", DevicePlatform: "iOS", LastSeenAt: at}); err != nil {
+		t.Fatalf("RegisterDevice %s: %v", profileID, err)
+	}
+	if err := store.SaveSectionOverrides(ctx, profileID, deleteScope, "", []userstore.SectionOverride{{SectionID: "default-recently-added", Hidden: true}}); err != nil {
+		t.Fatalf("SaveSectionOverrides %s: %v", profileID, err)
+	}
+	if err := store.SetJellycompatDisplayPrefs(ctx, userstore.ProfileDisplayPrefsID(profileID, deletePrefsID), deleteClient, `{"SortBy":"SortName"}`); err != nil {
+		t.Fatalf("SetJellycompatDisplayPrefs %s: %v", profileID, err)
+	}
+}
+
+// profileStateLeft names each kind of seeded state profileID still has.
+func profileStateLeft(t *testing.T, ctx context.Context, store userstore.UserStore, profileID string) []string {
+	t.Helper()
+	var left []string
+	if rows, err := store.ListHistory(ctx, profileID, 10, 0); err != nil {
+		t.Fatalf("ListHistory %s: %v", profileID, err)
+	} else if len(rows) > 0 {
+		left = append(left, "watch history")
+	}
+	if rows, err := store.ListHomeDismissals(ctx, profileID, userstore.HomeSurfaceContinueWatching); err != nil {
+		t.Fatalf("ListHomeDismissals %s: %v", profileID, err)
+	} else if len(rows) > 0 {
+		left = append(left, "home dismissals")
+	}
+	if pref, err := store.GetAudioPreference(ctx, profileID, deleteSeries); err != nil {
+		t.Fatalf("GetAudioPreference %s: %v", profileID, err)
+	} else if pref != nil {
+		left = append(left, "audio preference")
+	}
+	if pref, err := store.GetSubtitlePreference(ctx, profileID, deleteSeries); err != nil {
+		t.Fatalf("GetSubtitlePreference %s: %v", profileID, err)
+	} else if pref != nil {
+		left = append(left, "subtitle preference")
+	}
+	if state, err := store.GetOnboardingState(ctx, profileID, deleteTour); err != nil {
+		t.Fatalf("GetOnboardingState %s: %v", profileID, err)
+	} else if state != nil {
+		left = append(left, "onboarding state")
+	}
+	if setting, err := store.GetDeviceSetting(ctx, profileID, deleteDevice, deleteSetting); err != nil {
+		t.Fatalf("GetDeviceSetting %s: %v", profileID, err)
+	} else if setting != nil {
+		left = append(left, "device setting")
+	}
+	registry, ok := store.(userstore.DeviceRegistry)
+	if !ok {
+		t.Fatal("the store keeps no device registry")
+	}
+	devices, err := registry.ListDevices(ctx)
+	if err != nil {
+		t.Fatalf("ListDevices: %v", err)
+	}
+	for _, d := range devices {
+		if d.ProfileID == profileID {
+			left = append(left, registeredDevice)
+			break
+		}
+	}
+	if overrides, err := store.ListSectionOverrides(ctx, profileID, deleteScope, ""); err != nil {
+		t.Fatalf("ListSectionOverrides %s: %v", profileID, err)
+	} else if len(overrides) > 0 {
+		left = append(left, "section overrides")
+	}
+	if prefs, err := store.GetJellycompatDisplayPrefs(ctx, userstore.ProfileDisplayPrefsID(profileID, deletePrefsID), deleteClient); err != nil {
+		t.Fatalf("GetJellycompatDisplayPrefs %s: %v", profileID, err)
+	} else if prefs != "" {
+		left = append(left, "display preferences")
+	}
+	return left
+}
diff --git a/internal/userstore/storetest/settingvalues.go b/internal/userstore/storetest/settingvalues.go
index c6703ad347..407f01914a 100644
--- a/internal/userstore/storetest/settingvalues.go
+++ b/internal/userstore/storetest/settingvalues.go
@@ -19,6 +19,7 @@ import (
 // tests against both the PostgreSQL and per-user SQLite backends.
 func RunSettingValues(t *testing.T, newStore func(t *testing.T) userstore.UserStore) {
 	t.Run("DeviceSettings", func(t *testing.T) { RunDeviceSettings(t, newStore) })
+	t.Run("DeviceRename", func(t *testing.T) { RunDeviceRename(t, newStore) })
 	t.Run("ExplicitValuesPerScope", func(t *testing.T) {
 		testSettingValueScopes(t, newStore)
 	})
diff --git a/internal/userstore/storetest/suite.go b/internal/userstore/storetest/suite.go
index 02fe8376aa..fc2049f493 100644
--- a/internal/userstore/storetest/suite.go
+++ b/internal/userstore/storetest/suite.go
@@ -630,6 +630,118 @@ func RunPersonalListPage(t *testing.T, newStore func(t *testing.T) userstore.Use
 	})
 }
 
+// RunPersonalListMembership checks that each favorites and watchlist add and
+// remove reports whether it changed a row: the API seam notifies providers,
+// recommendations, and clients only for a change, so a repeated write must
+// report false.
+func RunPersonalListMembership(t *testing.T, newStore func(t *testing.T) userstore.UserStore) {
+	t.Run("FavoritesMembership", func(t *testing.T) {
+		store := newStore(t)
+		testPersonalListMembership(t, store, store.AddFavorite, store.RemoveFavorite)
+	})
+	t.Run("WatchlistMembership", func(t *testing.T) {
+		store := newStore(t)
+		testPersonalListMembership(t, store, store.AddToWatchlist, store.RemoveFromWatchlist)
+	})
+}
+
+// RunNotInterested checks the Not interested marks: mark and unmark report
+// whether they changed a row, reads see only the acting profile's marks,
+// the keyset page orders newest first with the id breaking ties, and
+// deleting a profile removes its marks.
+func RunNotInterested(t *testing.T, newStore func(t *testing.T) userstore.UserStore) {
+	t.Run("NotInterestedMembership", func(t *testing.T) {
+		store := newStore(t)
+		testPersonalListMembership(t, store, store.MarkNotInterested, store.UnmarkNotInterested)
+	})
+	t.Run("NotInterestedReadsAndDelete", func(t *testing.T) {
+		store := newStore(t)
+		ctx := context.Background()
+		for _, id := range []string{"p1", "p2"} {
+			if err := store.CreateProfile(ctx, userstore.Profile{ID: id, Name: id}); err != nil {
+				t.Fatalf("CreateProfile %s: %v", id, err)
+			}
+		}
+		for _, id := range []string{listA, listB, listC, listD, listE} {
+			if _, err := store.MarkNotInterested(ctx, "p1", id); err != nil {
+				t.Fatalf("MarkNotInterested %s: %v", id, err)
+			}
+		}
+		if _, err := store.MarkNotInterested(ctx, "p2", "m-z"); err != nil {
+			t.Fatalf("MarkNotInterested p2: %v", err)
+		}
+
+		entry, err := store.GetNotInterested(ctx, "p1", listC)
+		if err != nil || entry == nil || entry.MediaItemID != listC || entry.AddedAt == "" {
+			t.Fatalf("GetNotInterested = %+v, %v", entry, err)
+		}
+		if entry, err := store.GetNotInterested(ctx, "p2", listC); err != nil || entry != nil {
+			t.Fatalf("another profile's mark leaked: %+v, %v", entry, err)
+		}
+		marked, err := store.ListNotInterestedByMediaItems(ctx, "p1", []string{listA, "m-z", "m-none"})
+		if err != nil || len(marked) != 1 || !marked[listA] {
+			t.Fatalf("ListNotInterestedByMediaItems = %v, %v", marked, err)
+		}
+
+		// Marks written in one second tie on added_at in the SQLite store
+		// and are ordered by insertion in Postgres; both orders are the
+		// ids descending here.
+		var got []string
+		var after *userstore.ListKey
+		for pages := 0; ; pages++ {
+			if pages > 10 {
+				t.Fatal("paging did not terminate")
+			}
+			rows, err := store.ListNotInterestedPage(ctx, "p1", after, 2)
+			if err != nil {
+				t.Fatalf("ListNotInterestedPage: %v", err)
+			}
+			for _, r := range rows {
+				got = append(got, r.MediaItemID)
+			}
+			if len(rows) < 2 {
+				break
+			}
+			after = &userstore.ListKey{AddedAt: rows[len(rows)-1].AddedAt, MediaItemID: rows[len(rows)-1].MediaItemID}
+		}
+		if want := strings.Join([]string{listE, listD, listC, listB, listA}, ","); strings.Join(got, ",") != want {
+			t.Fatalf("keyset walk = %v, want %s", got, want)
+		}
+
+		if err := store.DeleteProfile(ctx, "p1"); err != nil {
+			t.Fatalf("DeleteProfile: %v", err)
+		}
+		if rows, err := store.ListNotInterestedPage(ctx, "p1", nil, 10); err != nil || len(rows) != 0 {
+			t.Fatalf("deleted profile kept its marks: %v, %v", rows, err)
+		}
+		if entry, err := store.GetNotInterested(ctx, "p2", "m-z"); err != nil || entry == nil {
+			t.Fatalf("deleting p1 removed p2's mark: %+v, %v", entry, err)
+		}
+	})
+}
+
+func testPersonalListMembership(t *testing.T, store userstore.UserStore, add, remove func(ctx context.Context, profileID, mediaItemID string) (bool, error)) {
+	ctx := context.Background()
+	if err := store.CreateProfile(ctx, userstore.Profile{ID: "p1", Name: "Test"}); err != nil {
+		t.Fatalf("CreateProfile: %v", err)
+	}
+	for _, step := range []struct {
+		name string
+		do   func(ctx context.Context, profileID, mediaItemID string) (bool, error)
+		want bool
+	}{
+		{"add", add, true},
+		{"repeated add", add, false},
+		{"remove", remove, true},
+		{"repeated remove", remove, false},
+	} {
+		changed, err := step.do(ctx, "p1", listA)
+		if err != nil || changed != step.want {
+			t.Fatalf("%s = %v, %v; want %v", step.name, changed, err, step.want)
+		}
+	}
+}
+
 func testPersonalListPage(t *testing.T, store userstore.UserStore,
 	add func(ctx context.Context, profileID, mediaItemID string, addedAt time.Time) (bool, error),
 	page func(ctx context.Context, profileID string, after *userstore.ListKey, limit int) ([]userstore.ListKey, error),
diff --git a/internal/userstore/types.go b/internal/userstore/types.go
index 1c6e79650f..7ac1b38909 100644
--- a/internal/userstore/types.go
+++ b/internal/userstore/types.go
@@ -104,10 +104,10 @@ type ProgressKey struct {
 	MediaItemID string
 }
 
-// ListKey is the keyset position ListFavoritesPage and ListWatchlistPage
-// resume after: the (AddedAt, MediaItemID) of the last row a caller already
-// holds, copied verbatim from a Favorite or WatchlistEntry the page returned.
-// media_item_id is unique per profile in both tables, so with the fixed
+// ListKey is the keyset position ListFavoritesPage, ListWatchlistPage and
+// ListNotInterestedPage resume after: the (AddedAt, MediaItemID) of the last
+// row a caller already holds, copied verbatim from an entry the page
+// returned. media_item_id is unique per profile in each table, so with the fixed
 // ORDER BY added_at DESC, media_item_id DESC the pair orders every row
 // totally, and a row added or removed between pages neither repeats nor
 // hides another.
@@ -232,6 +232,13 @@ type WatchlistEntry struct {
 	AddedAt     string
 }
 
+// NotInterestedEntry is a movie or series a profile marked Not interested.
+type NotInterestedEntry struct {
+	ProfileID   string
+	MediaItemID string
+	AddedAt     string
+}
+
 // Collection represents a user-created collection. CreatorProfileID owns it:
 // only that profile changes it. IsShared shows it to every profile on the
 // login, including profiles added later; otherwise only its creator sees it.
diff --git a/internal/watchlist/maintainer.go b/internal/watchlist/maintainer.go
index da49724ef8..5a2c79555f 100644
--- a/internal/watchlist/maintainer.go
+++ b/internal/watchlist/maintainer.go
@@ -29,8 +29,7 @@ type listEventDispatcher interface {
 // maintainerStore is the narrow slice of the user store the maintainer needs.
 type maintainerStore interface {
 	RemoveWatchedFromWatchlist(ctx context.Context, profileID string) (bool, error)
-	InWatchlist(ctx context.Context, profileID, mediaItemID string) (bool, error)
-	RemoveFromWatchlist(ctx context.Context, profileID, mediaItemID string) error
+	RemoveFromWatchlist(ctx context.Context, profileID, mediaItemID string) (bool, error)
 }
 
 // Maintainer removes a fully-watched movie from a profile's watchlist when its
@@ -113,14 +112,8 @@ func (m *Maintainer) process(ctx context.Context, userID int, profileID string,
 }
 
 func (m *Maintainer) removeFromWatchlist(ctx context.Context, store maintainerStore, userID int, profileID string, item *models.MediaItem) error {
-	in, err := store.InWatchlist(ctx, profileID, item.ContentID)
-	if err != nil {
-		return err
-	}
-	if !in {
-		return nil
-	}
-	if err := store.RemoveFromWatchlist(ctx, profileID, item.ContentID); err != nil {
+	removed, err := store.RemoveFromWatchlist(ctx, profileID, item.ContentID)
+	if err != nil || !removed {
 		return err
 	}
 	m.dispatchRemoval(ctx, userID, profileID, item)
diff --git a/internal/watchlist/maintainer_test.go b/internal/watchlist/maintainer_test.go
index ffd5df9813..0a9cc41928 100644
--- a/internal/watchlist/maintainer_test.go
+++ b/internal/watchlist/maintainer_test.go
@@ -19,14 +19,13 @@ func (f *fakeStore) RemoveWatchedFromWatchlist(context.Context, string) (bool, e
 	return f.removeWatched, nil
 }
 
-func (f *fakeStore) InWatchlist(_ context.Context, _ string, mediaItemID string) (bool, error) {
-	return f.watchlist[mediaItemID], nil
-}
-
-func (f *fakeStore) RemoveFromWatchlist(_ context.Context, _ string, mediaItemID string) error {
+func (f *fakeStore) RemoveFromWatchlist(_ context.Context, _ string, mediaItemID string) (bool, error) {
+	if !f.watchlist[mediaItemID] {
+		return false, nil
+	}
 	delete(f.watchlist, mediaItemID)
 	f.removed = append(f.removed, mediaItemID)
-	return nil
+	return true, nil
 }
 
 type fakeItems map[string]*models.MediaItem
diff --git a/internal/watchstate/parent_unwatch.go b/internal/watchstate/parent_unwatch.go
new file mode 100644
index 0000000000..21e227c87a
--- /dev/null
+++ b/internal/watchstate/parent_unwatch.go
@@ -0,0 +1,105 @@
+package watchstate
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/prairie-server/prairie-server/internal/userstore"
+)
+
+// Parent kinds ParentUnwatchTargets expands.
+const (
+	ParentSeries = "series"
+	ParentSeason = "season"
+)
+
+// EpisodePartitioner splits a series' or season's episodes into those a
+// library holds a file for and those it doesn't, in one read.
+// catalog.EpisodeRepository implements it.
+type EpisodePartitioner interface {
+	PartitionIDsBySeries(ctx context.Context, seriesID string) (withFile, fileless []string, err error)
+	PartitionIDsBySeason(ctx context.Context, seasonID string) (withFile, fileless []string, err error)
+}
+
+// ParentUnwatchTargets returns the episodes marking a series or season
+// unwatched must clear: every episode with a library file, plus the file-less
+// ones the profile still has history or progress on. A watched episode whose
+// file was deleted keeps its completed progress otherwise, and Next Up keeps
+// anchoring the series on it. File-less episodes nobody watched stay out, so a
+// long-running show with few files doesn't write thousands of hidden rows.
+// Both sets come from one partition read, so an episode whose file is linked
+// or unlinked mid-request still lands in one of them.
+func (s *Service) ParentUnwatchTargets(ctx context.Context, userID int, profileID string, episodes EpisodePartitioner, parentKind, parentID string) ([]string, error) {
+	var withFile, fileless []string
+	var err error
+	switch parentKind {
+	case ParentSeries:
+		withFile, fileless, err = episodes.PartitionIDsBySeries(ctx, parentID)
+	case ParentSeason:
+		withFile, fileless, err = episodes.PartitionIDsBySeason(ctx, parentID)
+	default:
+		return nil, fmt.Errorf("unwatch parent kind %q is not a series or season", parentKind)
+	}
+	if err != nil {
+		return nil, err
+	}
+	if len(fileless) == 0 {
+		return withFile, nil
+	}
+	store, err := s.storeForUser(ctx, userID)
+	if err != nil {
+		return nil, err
+	}
+	watched, err := WatchedItemIDs(ctx, store, profileID, fileless)
+	if err != nil {
+		return nil, err
+	}
+	return append(withFile, watched...), nil
+}
+
+// watchedItemIDBatch bounds each filter read below SQLite's default limit of
+// 32,766 bound variables.
+const watchedItemIDBatch = 1000
+
+// WatchedItemIDs keeps the IDs the profile has visible history or resume
+// progress for, once each, in input order.
+func WatchedItemIDs(ctx context.Context, store userstore.UserStore, profileID string, ids []string) ([]string, error) {
+	ids = compactItemIDs(ids)
+	var watched []string
+	for start := 0; start < len(ids); start += watchedItemIDBatch {
+		batch := ids[start:min(start+watchedItemIDBatch, len(ids))]
+		groups := make(map[string][]string, len(batch))
+		for _, id := range batch {
+			groups[id] = []string{id}
+		}
+		withHistory, err := store.LatestHistoryIDs(ctx, profileID, groups)
+		if err != nil {
+			return nil, err
+		}
+		withProgress, err := store.ListProgressByMediaItems(ctx, profileID, batch)
+		if err != nil {
+			return nil, err
+		}
+		for _, id := range batch {
+			_, history := withHistory[id]
+			_, progress := withProgress[id]
+			if history || progress {
+				watched = append(watched, id)
+			}
+		}
+	}
+	return watched, nil
+}
+
+func compactItemIDs(ids []string) []string {
+	seen := make(map[string]struct{}, len(ids))
+	unique := make([]string, 0, len(ids))
+	for _, id := range ids {
+		if _, ok := seen[id]; ok {
+			continue
+		}
+		seen[id] = struct{}{}
+		unique = append(unique, id)
+	}
+	return unique
+}
diff --git a/internal/watchstate/parent_unwatch_test.go b/internal/watchstate/parent_unwatch_test.go
new file mode 100644
index 0000000000..2d099103a2
--- /dev/null
+++ b/internal/watchstate/parent_unwatch_test.go
@@ -0,0 +1,112 @@
+package watchstate
+
+import (
+	"context"
+	"fmt"
+	"slices"
+	"testing"
+
+	"github.com/prairie-server/prairie-server/internal/userstore"
+)
+
+// batchRecordingStore answers the two reads WatchedItemIDs makes and
+// records each batch size.
+type batchRecordingStore struct {
+	userstore.UserStore
+	history, progress map[string]bool
+	batches           []int
+}
+
+func (s *batchRecordingStore) LatestHistoryIDs(_ context.Context, _ string, groups map[string][]string) (map[string]string, error) {
+	s.batches = append(s.batches, len(groups))
+	result := map[string]string{}
+	for id := range groups {
+		if s.history[id] {
+			result[id] = "history-" + id
+		}
+	}
+	return result, nil
+}
+
+func (s *batchRecordingStore) ListProgressByMediaItems(_ context.Context, _ string, ids []string) (map[string]userstore.WatchProgress, error) {
+	s.batches = append(s.batches, len(ids))
+	result := map[string]userstore.WatchProgress{}
+	for _, id := range ids {
+		if s.progress[id] {
+			result[id] = userstore.WatchProgress{MediaItemID: id}
+		}
+	}
+	return result, nil
+}
+
+func TestWatchedItemIDsBatchesAndDeduplicates(t *testing.T) {
+	ids := make([]string, 0, 2600)
+	for i := range 2500 {
+		ids = append(ids, fmt.Sprintf("ep-%d", i))
+	}
+	ids = append(ids, ids[:100]...) // overlapping targets repeat candidates
+	store := &batchRecordingStore{
+		history:  map[string]bool{"ep-5": true},
+		progress: map[string]bool{"ep-2400": true},
+	}
+
+	watched, err := WatchedItemIDs(context.Background(), store, "profile-1", ids)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if want := []string{"ep-5", "ep-2400"}; !slices.Equal(watched, want) {
+		t.Fatalf("watched = %v, want %v", watched, want)
+	}
+	total := 0
+	for _, n := range store.batches {
+		if n > watchedItemIDBatch {
+			t.Fatalf("batch of %d IDs, want at most %d", n, watchedItemIDBatch)
+		}
+		total += n
+	}
+	if total != 2*2500 {
+		t.Fatalf("read %d IDs across both reads, want each of the 2500 unique IDs once per read", total)
+	}
+}
+
+type fakeEpisodePartitioner struct {
+	series, season map[string][2][]string
+}
+
+func (p fakeEpisodePartitioner) PartitionIDsBySeries(_ context.Context, id string) ([]string, []string, error) {
+	sets := p.series[id]
+	return sets[0], sets[1], nil
+}
+
+func (p fakeEpisodePartitioner) PartitionIDsBySeason(_ context.Context, id string) ([]string, []string, error) {
+	sets := p.season[id]
+	return sets[0], sets[1], nil
+}
+
+// A parent unwatch clears every episode with a file and only the file-less
+// episodes the profile has history or progress on.
+func TestParentUnwatchTargetsAddsWatchedFilelessEpisodes(t *testing.T) {
+	store := &batchRecordingStore{
+		history:  map[string]bool{"deleted-history": true},
+		progress: map[string]bool{"deleted-progress": true},
+	}
+	service := NewService(testStoreProvider{store: store})
+	sets := [2][]string{{"on-disk-1", "on-disk-2"}, {"deleted-history", "metadata-only", "deleted-progress"}}
+	episodes := fakeEpisodePartitioner{
+		series: map[string][2][]string{"series-1": sets},
+		season: map[string][2][]string{"season-1": sets},
+	}
+	want := []string{"on-disk-1", "on-disk-2", "deleted-history", "deleted-progress"}
+	for _, parent := range []struct{ kind, id string }{{ParentSeries, "series-1"}, {ParentSeason, "season-1"}} {
+		got, err := service.ParentUnwatchTargets(context.Background(), 1, "profile-1", episodes, parent.kind, parent.id)
+		if err != nil {
+			t.Fatalf("%s: %v", parent.kind, err)
+		}
+		if !slices.Equal(got, want) {
+			t.Fatalf("%s targets = %v, want %v", parent.kind, got, want)
+		}
+	}
+	if _, err := service.ParentUnwatchTargets(context.Background(), 1, "profile-1", episodes, "movie", "movie-1"); err == nil {
+		t.Fatal("a movie parent expanded; want an error")
+	}
+}
diff --git a/internal/watchstate/service.go b/internal/watchstate/service.go
index 2d56084ac3..3c7339fdfc 100644
--- a/internal/watchstate/service.go
+++ b/internal/watchstate/service.go
@@ -92,6 +92,19 @@ func (s *Service) RecordManualMarkUnwatchedWithResult(ctx context.Context, userI
 	return s.recordMarkUnwatched(ctx, userID, profileID, targetIDs)
 }
 
+// ClearResumePosition sets the profile's visible resume position on a leaf
+// item to zero and reports whether there was one. Unlike mark unwatched it
+// keeps watch history, the watched latch and the known duration, and it sends
+// nothing to watch providers. The write is stamped now, so delta sync carries
+// it to other devices and an older provider resume point cannot restore it.
+func (s *Service) ClearResumePosition(ctx context.Context, userID int, profileID, mediaItemID string) (bool, error) {
+	store, err := s.storeForUser(ctx, userID)
+	if err != nil {
+		return false, err
+	}
+	return store.ClearResumePosition(ctx, profileID, mediaItemID, time.Now().UTC())
+}
+
 func (s *Service) RecordPlaybackStop(
 	ctx context.Context,
 	userID int,
@@ -335,9 +348,11 @@ func (s *Service) SetFavorite(
 		return err
 	}
 	if favorite {
-		return store.AddFavorite(ctx, profileID, targetID)
+		_, err = store.AddFavorite(ctx, profileID, targetID)
+		return err
 	}
-	return store.RemoveFavorite(ctx, profileID, targetID)
+	_, err = store.RemoveFavorite(ctx, profileID, targetID)
+	return err
 }
 
 func (s *Service) ToggleFavorite(ctx context.Context, userID int, profileID, targetID string) (bool, error) {
@@ -351,9 +366,11 @@ func (s *Service) ToggleFavorite(ctx context.Context, userID int, profileID, tar
 	}
 	next := !current
 	if next {
-		return next, store.AddFavorite(ctx, profileID, targetID)
+		_, err = store.AddFavorite(ctx, profileID, targetID)
+	} else {
+		_, err = store.RemoveFavorite(ctx, profileID, targetID)
 	}
-	return next, store.RemoveFavorite(ctx, profileID, targetID)
+	return next, err
 }
 
 func (s *Service) RecordJellycompatMarkPlayed(ctx context.Context, userID int, profileID, targetID string, watchedAt time.Time) error {
@@ -623,10 +640,12 @@ func (s *Service) addImportedHistoryIfMissingWithSource(
 	if watchedAt == nil || watchedAt.IsZero() {
 		return false, nil
 	}
+	// The full time lets the store order the import against a history removal
+	// in the same second; the store decides the precision it keeps.
 	entry := userstore.WatchHistoryEntry{
 		ProfileID:       profileID,
 		MediaItemID:     targetID,
-		WatchedAt:       watchedAt.UTC().Format(time.RFC3339),
+		WatchedAt:       watchedAt.UTC().Format(time.RFC3339Nano),
 		DurationSeconds: duration,
 		Completed:       completed,
 		Source:          source,
diff --git a/internal/watchstate/service_test.go b/internal/watchstate/service_test.go
index f7dbd3d7d1..d4cca857b6 100644
--- a/internal/watchstate/service_test.go
+++ b/internal/watchstate/service_test.go
@@ -606,6 +606,124 @@ func TestImportedWatchIfNewerSuppressesHiddenOlderWatch(t *testing.T) {
 	}
 }
 
+// TestClearResumePositionKeepsHistoryAndWatchedState pins issue #2134: a
+// resume position reset leaves every earlier watch in history (unlike mark
+// unwatched, which hides it) and keeps a rewatched item watched.
+func TestClearResumePositionKeepsHistoryAndWatchedState(t *testing.T) {
+	ctx := context.Background()
+	store, db := newTestUserStore(t)
+	t.Cleanup(func() { _ = db.Close() })
+	createWatchstateProfile(t, store)
+	service := NewService(testStoreProvider{store: store})
+
+	// movie-1 was watched to the end two days ago and is now partly rewatched;
+	// movie-2 was only ever skimmed to the middle.
+	if err := service.RecordManualMarkWatched(ctx, 1, "profile-1", []LeafWatchTarget{{MediaItemID: "movie-1", DurationSeconds: 7200}}, time.Now().UTC().Add(-48*time.Hour)); err != nil {
+		t.Fatalf("RecordManualMarkWatched: %v", err)
+	}
+	for _, play := range []struct {
+		id       string
+		position float64
+	}{{"movie-1", 1800}, {"movie-2", 2700}} {
+		if _, err := service.RecordPlaybackStop(ctx, 1, "profile-1", play.id, 7200, play.position, time.Now().UTC().Add(-time.Hour), userstore.VersionHints{}, userstore.ProgressThresholds{}); err != nil {
+			t.Fatalf("RecordPlaybackStop(%s): %v", play.id, err)
+		}
+	}
+	before, err := store.ListHistory(ctx, "profile-1", 10, 0)
+	if err != nil || len(before) != 3 {
+		t.Fatalf("history before = %+v, %v; want the mark and two partial plays", before, err)
+	}
+
+	for _, id := range []string{"movie-1", "movie-2"} {
+		cleared, err := service.ClearResumePosition(ctx, 1, "profile-1", id)
+		if err != nil || !cleared {
+			t.Fatalf("ClearResumePosition(%s) = %v, %v; want cleared", id, cleared, err)
+		}
+	}
+
+	for _, want := range []struct {
+		id        string
+		completed bool
+	}{{"movie-1", true}, {"movie-2", false}} {
+		progress, err := store.GetProgress(ctx, "profile-1", want.id)
+		if err != nil || progress == nil {
+			t.Fatalf("GetProgress(%s) = %+v, %v", want.id, progress, err)
+		}
+		if progress.PositionSeconds != 0 || progress.Completed != want.completed || progress.DurationSeconds != 7200 {
+			t.Fatalf("%s progress = %+v, want position 0, completed %v, duration kept", want.id, progress, want.completed)
+		}
+	}
+	inProgress, err := store.ListProgress(ctx, "profile-1", "in_progress", 10, 0)
+	if err != nil || len(inProgress) != 0 {
+		t.Fatalf("in-progress rows = %+v, %v; want none", inProgress, err)
+	}
+	after, err := store.ListHistory(ctx, "profile-1", 10, 0)
+	if err != nil {
+		t.Fatalf("ListHistory: %v", err)
+	}
+	if len(after) != len(before) {
+		t.Fatalf("history after = %+v, want all %d earlier watches kept", after, len(before))
+	}
+	for i := range before {
+		if after[i].ID != before[i].ID || after[i].Completed != before[i].Completed {
+			t.Fatalf("history row %d = %+v, want %+v", i, after[i], before[i])
+		}
+	}
+
+	// Nothing left to clear: a no-op that reports so.
+	if cleared, err := service.ClearResumePosition(ctx, 1, "profile-1", "movie-2"); err != nil || cleared {
+		t.Fatalf("second ClearResumePosition = %v, %v; want a no-op", cleared, err)
+	}
+}
+
+// A live write under a hidden-history watermark that lies ahead of the clock
+// (a mark unwatched after a future-dated imported watch) is stamped just past
+// the watermark and stays visible. Clearing that resume position must still
+// write, not be skipped as hidden while reporting success.
+func TestClearResumePositionUnderFutureHiddenWatermark(t *testing.T) {
+	ctx := context.Background()
+	store, db := newTestUserStore(t)
+	t.Cleanup(func() { _ = db.Close() })
+	createWatchstateProfile(t, store)
+
+	hiddenBefore := time.Now().UTC().Add(time.Hour).Format(time.RFC3339)
+	if _, err := db.Exec(`
+		INSERT INTO hidden_history_items (profile_id, media_item_id, hidden_before, updated_at)
+		VALUES (?, ?, ?, ?)`, "profile-1", "movie-1", hiddenBefore, hiddenBefore); err != nil {
+		t.Fatalf("seed hidden watermark: %v", err)
+	}
+	if err := store.UpdateProgress(ctx, "profile-1", "movie-1", 1800, 7200, userstore.ProgressThresholds{}); err != nil {
+		t.Fatalf("UpdateProgress: %v", err)
+	}
+	if progress, err := store.GetProgress(ctx, "profile-1", "movie-1"); err != nil || progress == nil || progress.PositionSeconds != 1800 {
+		t.Fatalf("progress before = %+v, %v; want a visible resume point", progress, err)
+	}
+
+	cleared, err := NewService(testStoreProvider{store: store}).ClearResumePosition(ctx, 1, "profile-1", "movie-1")
+	if err != nil || !cleared {
+		t.Fatalf("ClearResumePosition = %v, %v; want cleared", cleared, err)
+	}
+	progress, err := store.GetProgress(ctx, "profile-1", "movie-1")
+	if err != nil || progress == nil || progress.PositionSeconds != 0 {
+		t.Fatalf("progress after = %+v, %v; want visible with position 0", progress, err)
+	}
+}
+
+func TestClearResumePositionWithoutProgressWritesNothing(t *testing.T) {
+	ctx := context.Background()
+	store, db := newTestUserStore(t)
+	t.Cleanup(func() { _ = db.Close() })
+	createWatchstateProfile(t, store)
+
+	cleared, err := NewService(testStoreProvider{store: store}).ClearResumePosition(ctx, 1, "profile-1", "movie-1")
+	if err != nil || cleared {
+		t.Fatalf("ClearResumePosition = %v, %v; want a no-op", cleared, err)
+	}
+	if progress, err := store.GetProgress(ctx, "profile-1", "movie-1"); err != nil || progress != nil {
+		t.Fatalf("progress = %+v, %v; want no row", progress, err)
+	}
+}
+
 func newTestUserStore(t *testing.T) (userstore.UserStore, *sql.DB) {
 	t.Helper()
 	db, err := sql.Open("sqlite3", ":memory:")
diff --git a/internal/watchsync/first_party.go b/internal/watchsync/first_party.go
index c7031ef814..74ce71f831 100644
--- a/internal/watchsync/first_party.go
+++ b/internal/watchsync/first_party.go
@@ -9,7 +9,6 @@ import (
 
 // The provider keys of Prairie's former built-in providers.
 const (
-	traktProviderKey   = "trakt"
 	simklProviderKey   = "simkl"
 	mdblistProviderKey = "mdblist"
 )
@@ -26,7 +25,6 @@ type firstPartyPlugin struct {
 // export records, and imported watch history are all stored under these keys,
 // so registering the plugins under them carries every existing link over.
 var firstPartyProviderKeys = map[firstPartyPlugin]string{
-	{PluginID: "prairie.watchprovider." + traktProviderKey, CapabilityID: traktProviderKey}:     traktProviderKey,
 	{PluginID: "prairie.watchprovider." + simklProviderKey, CapabilityID: simklProviderKey}:     simklProviderKey,
 	{PluginID: "prairie.watchprovider." + mdblistProviderKey, CapabilityID: mdblistProviderKey}: mdblistProviderKey,
 }
@@ -45,6 +43,18 @@ func PluginProviderKey(installationID int, pluginID, capabilityID string, prairi
 	return fmt.Sprintf("%s:%d:%s", providerSourcePlugin, installationID, capabilityID)
 }
 
+// retiredPluginIDs lists first-party watch-sync plugins for providers Prairie no
+// longer supports. Their installations are never registered, so a copy left
+// installed on a server cannot sync, scrobble, or claim a provider key.
+var retiredPluginIDs = map[string]bool{
+	"prairie.watchprovider.trakt": true,
+}
+
+// RetiredPlugin reports whether pluginID is a retired watch-sync plugin.
+func RetiredPlugin(pluginID string) bool {
+	return retiredPluginIDs[pluginID]
+}
+
 // FirstPartyPluginID returns the first-party plugin that serves providerKey,
 // for keys that a former built-in provider used.
 func FirstPartyPluginID(providerKey string) (string, bool) {
@@ -56,8 +66,8 @@ func FirstPartyPluginID(providerKey string) (string, bool) {
 	return "", false
 }
 
-// The plugin global config entry, and its fields, where the first-party Trakt
-// and Simkl plugins read their provider app credentials.
+// The plugin global config entry, and its fields, where first-party plugins
+// read their provider app credentials.
 const (
 	firstPartyAppConfigKey = "app"
 	appClientIDField       = "client_id"
@@ -177,24 +187,3 @@ func MarkFirstPartyMigrated(ctx context.Context, store FirstPartyMigrationStore,
 	}
 	return store.SetServerSetting(ctx, key, "plugin")
 }
-
-// AppClientID returns the provider app client ID that the plugin serving
-// providerKey is configured with, read from its "app" global config. Other
-// Prairie features that call the same provider with a profile's token (Trakt
-// collections) must send the client ID the token was issued to. It is empty
-// when no plugin serves the key or the plugin has none configured.
-func (s *Service) AppClientID(ctx context.Context, providerKey string) (string, error) {
-	provider, ok := s.registry.Get(providerKey)
-	if !ok {
-		return "", nil
-	}
-	plugin, ok := provider.(*PluginProvider)
-	if !ok {
-		return "", nil
-	}
-	config, err := plugin.providerConfig(ctx)
-	if err != nil {
-		return "", err
-	}
-	return strings.TrimSpace(config.GetValues()[firstPartyAppConfigKey+"."+appClientIDField]), nil
-}
diff --git a/internal/watchsync/first_party_test.go b/internal/watchsync/first_party_test.go
index 33aed07dc8..6fa29407a6 100644
--- a/internal/watchsync/first_party_test.go
+++ b/internal/watchsync/first_party_test.go
@@ -17,11 +17,11 @@ func TestPluginProviderKey(t *testing.T) {
 		prairieManaged bool
 		want           string
 	}{
-		{name: "first-party Trakt keeps the built-in key", pluginID: "prairie.watchprovider.trakt", capabilityID: "trakt", prairieManaged: true, want: "trakt"},
+		{name: "retired Trakt plugin no longer claims the built-in key", pluginID: "prairie.watchprovider.trakt", capabilityID: "trakt", prairieManaged: true, want: "plugin:3:trakt"},
 		{name: "first-party Simkl keeps the built-in key", pluginID: "prairie.watchprovider.simkl", capabilityID: "simkl", prairieManaged: true, want: "simkl"},
 		{name: "first-party MDBList keeps the built-in key", pluginID: "prairie.watchprovider.mdblist", capabilityID: "mdblist", prairieManaged: true, want: "mdblist"},
-		{name: "first-party ID from another repository", pluginID: "prairie.watchprovider.trakt", capabilityID: "trakt", want: "plugin:3:trakt"},
-		{name: "unknown capability of a first-party plugin", pluginID: "prairie.watchprovider.trakt", capabilityID: "other", prairieManaged: true, want: "plugin:3:other"},
+		{name: "first-party ID from another repository", pluginID: "prairie.watchprovider.simkl", capabilityID: "simkl", want: "plugin:3:simkl"},
+		{name: "unknown capability of a first-party plugin", pluginID: "prairie.watchprovider.simkl", capabilityID: "other", prairieManaged: true, want: "plugin:3:other"},
 		{name: "third-party plugin", pluginID: "prairie.watchprovider.floppy", capabilityID: "floppy", prairieManaged: true, want: "plugin:3:floppy"},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
@@ -55,16 +55,17 @@ func (f *fakeFirstPartyStore) HasConnections(_ context.Context, providerKey stri
 }
 
 func TestFirstPartyPluginsToInstallUntilMigrated(t *testing.T) {
-	store := &fakeFirstPartyStore{connections: map[string]bool{"trakt": true, "mdblist": true}}
+	// Trakt connections no longer pull in the retired Trakt plugin.
+	store := &fakeFirstPartyStore{connections: map[string]bool{"simkl": true, "mdblist": true, "trakt": true}}
 	got, err := FirstPartyPluginsToInstall(t.Context(), store)
 	if err != nil {
 		t.Fatal(err)
 	}
-	if want := []string{"prairie.watchprovider.mdblist", "prairie.watchprovider.trakt"}; !reflect.DeepEqual(got, want) {
+	if want := []string{"prairie.watchprovider.mdblist", "prairie.watchprovider.simkl"}; !reflect.DeepEqual(got, want) {
 		t.Fatalf("plugins to install = %v, want %v", got, want)
 	}
 
-	for _, key := range []string{"trakt", "plugin:4:floppy"} {
+	for _, key := range []string{"simkl", "plugin:4:floppy"} {
 		if err := MarkFirstPartyMigrated(t.Context(), store, key); err != nil {
 			t.Fatal(err)
 		}
@@ -77,7 +78,18 @@ func TestFirstPartyPluginsToInstallUntilMigrated(t *testing.T) {
 		t.Fatal(err)
 	}
 	if want := []string{"prairie.watchprovider.mdblist"}; !reflect.DeepEqual(got, want) {
-		t.Fatalf("plugins to install after Trakt migrated = %v, want %v", got, want)
+		t.Fatalf("plugins to install after Simkl migrated = %v, want %v", got, want)
+	}
+}
+
+func TestRetiredPlugin(t *testing.T) {
+	if !RetiredPlugin("prairie.watchprovider.trakt") {
+		t.Fatal("the Trakt plugin is not retired")
+	}
+	for _, pluginID := range []string{"prairie.watchprovider.simkl", "prairie.watchprovider.mdblist", "prairie.watchprovider.floppy"} {
+		if RetiredPlugin(pluginID) {
+			t.Fatalf("%s is retired", pluginID)
+		}
 	}
 }
 
@@ -100,15 +112,15 @@ func (f *fakeConfigSeeder) SeedGlobalConfig(_ context.Context, installationID in
 
 func TestSeedFirstPartyAppConfig(t *testing.T) {
 	store := &fakeFirstPartyStore{settings: map[string]string{
-		"watchsync.trakt.client_id":     "trakt-id",
-		"watchsync.trakt.client_secret": "trakt-secret",
+		"watchsync.simkl.client_id":     "simkl-id",
+		"watchsync.simkl.client_secret": "simkl-secret",
 	}}
 	seeder := &fakeConfigSeeder{}
-	seeded, err := SeedFirstPartyAppConfig(t.Context(), "trakt", 5, store, seeder)
+	seeded, err := SeedFirstPartyAppConfig(t.Context(), "simkl", 5, store, seeder)
 	if err != nil || !seeded {
 		t.Fatalf("SeedFirstPartyAppConfig() = %t, %v", seeded, err)
 	}
-	want := map[string]any{"client_id": "trakt-id", "client_secret": "trakt-secret"}
+	want := map[string]any{"client_id": "simkl-id", "client_secret": "simkl-secret"}
 	if seeder.installationID != 5 || seeder.key != "app" || !reflect.DeepEqual(seeder.value, want) {
 		t.Fatalf("seeded %d %q %v", seeder.installationID, seeder.key, seeder.value)
 	}
@@ -116,7 +128,7 @@ func TestSeedFirstPartyAppConfig(t *testing.T) {
 	// Seeding runs once: app credentials an admin clears from the plugin later
 	// are not restored from the old settings.
 	again := &fakeConfigSeeder{}
-	if seeded, err := SeedFirstPartyAppConfig(t.Context(), "trakt", 5, store, again); err != nil || seeded || again.value != nil {
+	if seeded, err := SeedFirstPartyAppConfig(t.Context(), "simkl", 5, store, again); err != nil || seeded || again.value != nil {
 		t.Fatalf("second seed = %t, err = %v, value = %v; want nothing", seeded, err, again.value)
 	}
 
@@ -129,41 +141,6 @@ func TestSeedFirstPartyAppConfig(t *testing.T) {
 	}
 }
 
-func TestServiceAppClientID(t *testing.T) {
-	registry := NewRegistry()
-	provider, err := NewPluginProvider(PluginProviderOptions{
-		InstallationID: 2,
-		ProviderKey:    "trakt",
-		CapabilityID:   "trakt",
-		Descriptor: &pluginv1.WatchSyncProviderDescriptor{
-			AuthMethods:   []pluginv1.WatchSyncAuthMethod{pluginv1.WatchSyncAuthMethod_WATCH_SYNC_AUTH_METHOD_DEVICE_CODE},
-			ExportWatched: true,
-		},
-		ResolveClient: func(context.Context, int, string) (WatchSyncPluginClient, error) {
-			return nil, errors.New("not used")
-		},
-		ResolveConfig: func(context.Context, int) (*pluginv1.WatchSyncProviderConfig, error) {
-			return &pluginv1.WatchSyncProviderConfig{
-				Values:       map[string]string{"app.client_id": " plugin-id "},
-				SecretValues: map[string]string{"app.client_secret": "secret"},
-			}, nil
-		},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := registry.ReplacePluginProviders([]Provider{provider}); err != nil {
-		t.Fatal(err)
-	}
-	service := NewService(nil, registry)
-	if got, err := service.AppClientID(t.Context(), "trakt"); err != nil || got != "plugin-id" {
-		t.Fatalf("AppClientID(trakt) = %q, %v", got, err)
-	}
-	if got, err := service.AppClientID(t.Context(), "simkl"); err != nil || got != "" {
-		t.Fatalf("AppClientID(simkl) = %q, %v; want empty for an unregistered key", got, err)
-	}
-}
-
 // A plugin that needs provider app credentials reports whether its required
 // config is saved, so clients can hold back Connect until an admin sets it up.
 func TestPluginConnectionStatusReportsAppConfigReadiness(t *testing.T) {
@@ -180,8 +157,8 @@ func TestPluginConnectionStatusReportsAppConfigReadiness(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			provider, err := NewPluginProvider(PluginProviderOptions{
 				InstallationID: 4,
-				ProviderKey:    "trakt",
-				CapabilityID:   "trakt",
+				ProviderKey:    "simkl",
+				CapabilityID:   "simkl",
 				Descriptor: &pluginv1.WatchSyncProviderDescriptor{
 					AuthMethods:   []pluginv1.WatchSyncAuthMethod{pluginv1.WatchSyncAuthMethod_WATCH_SYNC_AUTH_METHOD_DEVICE_CODE},
 					ExportWatched: true,
@@ -198,7 +175,7 @@ func TestPluginConnectionStatusReportsAppConfigReadiness(t *testing.T) {
 			if err := registry.ReplacePluginProviders([]Provider{provider}); err != nil {
 				t.Fatal(err)
 			}
-			status, err := NewService(newServiceFakeRepo(), registry).GetConnectionStatus(t.Context(), 7, "profile-1", "trakt")
+			status, err := NewService(newServiceFakeRepo(), registry).GetConnectionStatus(t.Context(), 7, "profile-1", "simkl")
 			if err != nil {
 				t.Fatal(err)
 			}
diff --git a/internal/watchsync/history_export.go b/internal/watchsync/history_export.go
new file mode 100644
index 0000000000..14d82c0657
--- /dev/null
+++ b/internal/watchsync/history_export.go
@@ -0,0 +1,31 @@
+package watchsync
+
+import (
+	"time"
+
+	publicmanifest "github.com/prairie-server/prairie-plugin-sdk/pkg/pluginsdk/manifest"
+)
+
+// maxHistoryExportPage bounds one read of a connection's pending history
+// exports: the largest batch a plugin may declare.
+const maxHistoryExportPage = publicmanifest.MaxWatchSyncBatchSize
+
+// exportDrainReserve is how much of a run's deadline the history export
+// leaves unused: room for one plugin call that has already started and for
+// the flows that run after the export. A manual sync has a deadline; a
+// scheduled one does not, so it drains the whole backlog.
+const exportDrainReserve = 3 * time.Minute
+
+// exportSnapshotSkew allows for clock difference between the server, which
+// stamps when a run read local history, and the database, which stamps when
+// an export row was created.
+const exportSnapshotSkew = time.Minute
+
+// HistoryExportCursor is the last export one pass over the backlog listed, in
+// the backlog's (watched_at, id) order. Listing after it continues the pass, so
+// an export the pass already tried is not tried again before the next sync.
+// The zero value starts at the oldest export.
+type HistoryExportCursor struct {
+	WatchedAt time.Time
+	ID        string
+}
diff --git a/internal/watchsync/history_export_drain_test.go b/internal/watchsync/history_export_drain_test.go
new file mode 100644
index 0000000000..26c70b89a9
--- /dev/null
+++ b/internal/watchsync/history_export_drain_test.go
@@ -0,0 +1,356 @@
+package watchsync
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+	"slices"
+	"testing"
+	"time"
+
+	"github.com/prairie-server/prairie-server/internal/userdb"
+	"github.com/prairie-server/prairie-server/internal/userstore"
+)
+
+// drainExporterStub is a batched exporter whose every call is answered by
+// respond, which sees the call's index and plays.
+type drainExporterStub struct {
+	watchedExporterStub
+	batchSize int
+	calls     *[][]LocalPlay
+	tokens    *[]string // the access token each call received, when set
+	respond   func(call int, plays []LocalPlay) (ExportResult, error)
+}
+
+func (p drainExporterStub) ExportBatchSize() int { return p.batchSize }
+
+func (p drainExporterStub) ExportHistory(_ context.Context, _ ServerConfig, conn Connection, plays []LocalPlay) (ExportResult, error) {
+	call := len(*p.calls)
+	*p.calls = append(*p.calls, plays)
+	if p.tokens != nil {
+		*p.tokens = append(*p.tokens, conn.AccessToken)
+	}
+	return p.respond(call, plays)
+}
+
+func sendAllPlays(_ int, plays []LocalPlay) (ExportResult, error) {
+	result := ExportResult{}
+	for _, play := range plays {
+		result.Sent = append(result.Sent, play.HistoryID)
+	}
+	return result, nil
+}
+
+// newDrainService returns a service over count completed movie plays, one
+// minute apart.
+func newDrainService(t *testing.T, count int) (*Service, *serviceFakeRepo, userstore.UserStore) {
+	t.Helper()
+	db, err := sql.Open("sqlite3", ":memory:")
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	t.Cleanup(func() { _ = db.Close() })
+	if err := userdb.InitSchema(db); err != nil {
+		t.Fatalf("InitSchema: %v", err)
+	}
+	start := time.Date(2020, time.November, 4, 14, 0, 0, 0, time.UTC)
+	for i := range count {
+		if err := userdb.AddHistory(db, userstore.WatchHistoryEntry{
+			ID:              fmt.Sprintf("history-%03d", i),
+			ProfileID:       "profile-1",
+			MediaItemID:     testMovieMediaID,
+			WatchedAt:       start.Add(time.Duration(i) * time.Minute).Format(time.RFC3339),
+			DurationSeconds: 7200,
+			Completed:       true,
+			Source:          userstore.WatchHistorySourcePlayback,
+			Identity: userstore.WatchIdentity{
+				StableType:  "movie",
+				ProviderIDs: map[string]string{"tmdb": "603"},
+			},
+		}); err != nil {
+			t.Fatalf("AddHistory: %v", err)
+		}
+	}
+	repo := newServiceFakeRepo()
+	repo.withConnection(drainConn)
+	store := userdb.NewSQLiteUserStore(db)
+	service := NewService(repo, NewRegistry()).WithUserStoreProvider(staticStoreProvider{store: store})
+	return service, repo, store
+}
+
+var drainConn = Connection{ID: "conn-1", Provider: "trakt", UserID: 7, ProfileID: "profile-1"}
+
+func exportStatusCounts(repo *serviceFakeRepo) map[string]int {
+	counts := map[string]int{}
+	for _, export := range repo.historyExports {
+		counts[export.Status]++
+	}
+	return counts
+}
+
+func TestServiceExportWatchedDrainsBacklogInProviderBatches(t *testing.T) {
+	service, repo, _ := newDrainService(t, 25)
+	var calls [][]LocalPlay
+	exporter := drainExporterStub{batchSize: 10, calls: &calls, respond: sendAllPlays}
+
+	result, err := service.ExportWatched(t.Context(), drainConn, ServerConfig{}, exporter)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result.Sent != 25 {
+		t.Fatalf("sent = %d, want 25", result.Sent)
+	}
+	sizes := make([]int, 0, len(calls))
+	for _, plays := range calls {
+		sizes = append(sizes, len(plays))
+	}
+	if want := []int{10, 10, 5}; !slices.Equal(sizes, want) {
+		t.Fatalf("batch sizes = %v, want %v", sizes, want)
+	}
+	if calls[0][0].HistoryID != "history-000" || calls[2][4].HistoryID != "history-024" {
+		t.Fatalf("batches are not oldest first: first %s, last %s", calls[0][0].HistoryID, calls[2][4].HistoryID)
+	}
+	if counts := exportStatusCounts(repo); counts[historyExportStatusSent] != 25 {
+		t.Fatalf("export statuses = %v, want 25 sent", counts)
+	}
+	for _, size := range repo.historyPageSizes {
+		if size != 10 {
+			t.Fatalf("page sizes = %v, want each page one provider batch", repo.historyPageSizes)
+		}
+	}
+}
+
+func TestServiceExportWatchedTriesEachExportOncePerRun(t *testing.T) {
+	service, repo, _ := newDrainService(t, 7)
+	var calls [][]LocalPlay
+	exporter := drainExporterStub{batchSize: 3, calls: &calls, respond: func(_ int, plays []LocalPlay) (ExportResult, error) {
+		result := ExportResult{Failed: map[string]string{}}
+		for _, play := range plays {
+			result.Failed[play.HistoryID] = "provider refused"
+		}
+		return result, nil
+	}}
+
+	result, err := service.ExportWatched(t.Context(), drainConn, ServerConfig{}, exporter)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(calls) != 3 || result.Failed != 7 {
+		t.Fatalf("calls = %d, failed = %d; want 3 calls and 7 failures", len(calls), result.Failed)
+	}
+	for _, export := range repo.historyExports {
+		if export.Status != historyExportStatusFailed || export.AttemptCount != 1 {
+			t.Fatalf("export %s: status %s, attempts %d; want failed after one attempt", export.HistoryID, export.Status, export.AttemptCount)
+		}
+	}
+
+	// The next run retries the failures.
+	calls = nil
+	if _, err := service.ExportWatched(t.Context(), drainConn, ServerConfig{}, exporter); err != nil {
+		t.Fatal(err)
+	}
+	if len(calls) != 3 {
+		t.Fatalf("second run calls = %d, want 3", len(calls))
+	}
+}
+
+func TestServiceExportWatchedStopsDrainAtRateLimit(t *testing.T) {
+	service, repo, _ := newDrainService(t, 25)
+	var calls [][]LocalPlay
+	exporter := drainExporterStub{batchSize: 10, calls: &calls, respond: func(call int, plays []LocalPlay) (ExportResult, error) {
+		if call == 1 {
+			return ExportResult{}, RateLimitedError{Provider: "trakt", RetryAfter: time.Minute}
+		}
+		return sendAllPlays(call, plays)
+	}}
+
+	result, err := service.ExportWatched(t.Context(), drainConn, ServerConfig{}, exporter)
+	if _, limited := AsRateLimited(err); !limited {
+		t.Fatalf("error = %v, want rate limit", err)
+	}
+	if len(calls) != 2 || result.Sent != 10 {
+		t.Fatalf("calls = %d, sent = %d; want 2 calls and 10 sent", len(calls), result.Sent)
+	}
+	counts := exportStatusCounts(repo)
+	if counts[historyExportStatusSent] != 10 || counts[historyExportStatusPending] != 15 {
+		t.Fatalf("export statuses = %v, want 10 sent and 15 pending", counts)
+	}
+}
+
+func TestServiceExportWatchedStopsDrainWhenContextEnds(t *testing.T) {
+	service, repo, _ := newDrainService(t, 25)
+	ctx, cancel := context.WithCancel(t.Context())
+	var calls [][]LocalPlay
+	exporter := drainExporterStub{batchSize: 10, calls: &calls, respond: func(call int, plays []LocalPlay) (ExportResult, error) {
+		cancel()
+		return sendAllPlays(call, plays)
+	}}
+
+	if _, err := service.ExportWatched(ctx, drainConn, ServerConfig{}, exporter); err == nil {
+		t.Fatal("error = nil, want context cancellation")
+	}
+	if len(calls) != 1 {
+		t.Fatalf("calls = %d, want 1", len(calls))
+	}
+	if counts := exportStatusCounts(repo); counts[historyExportStatusSent] != 10 || counts[historyExportStatusPending] != 15 {
+		t.Fatalf("export statuses = %v, want 10 sent and 15 pending", counts)
+	}
+}
+
+// A play watched during a run has an export the run's history snapshot does
+// not hold. It stays pending for the next run; an export whose history entry
+// is really gone is still retired.
+func TestServiceExportWatchedLeavesExportsNewerThanItsHistoryReadPending(t *testing.T) {
+	service, repo, _ := newDrainService(t, 3)
+	now := time.Now().UTC()
+	repo.historyExports = append(repo.historyExports,
+		HistoryExport{ID: "export-live", ConnectionID: drainConn.ID, HistoryID: "history-live", MediaItemID: testMovieMediaID,
+			WatchedAt: now, ProviderItemKey: testMovieProviderItemKey, Status: historyExportStatusPending, CreatedAt: now.Add(time.Hour)},
+		HistoryExport{ID: "export-gone", ConnectionID: drainConn.ID, HistoryID: "history-gone", MediaItemID: testMovieMediaID,
+			WatchedAt: now, ProviderItemKey: testMovieProviderItemKey, Status: historyExportStatusPending, CreatedAt: now.Add(-time.Hour)},
+	)
+	var calls [][]LocalPlay
+	exporter := drainExporterStub{batchSize: 10, calls: &calls, respond: sendAllPlays}
+
+	if _, err := service.ExportWatched(t.Context(), drainConn, ServerConfig{}, exporter); err != nil {
+		t.Fatal(err)
+	}
+	statuses := map[string]string{}
+	for _, export := range repo.historyExports {
+		statuses[export.HistoryID] = export.Status
+	}
+	if statuses["history-live"] != historyExportStatusPending || statuses["history-gone"] != historyExportStatusNotFound {
+		t.Fatalf("statuses = %v, want history-live pending and history-gone not found", statuses)
+	}
+	if counts := exportStatusCounts(repo); counts[historyExportStatusSent] != 3 {
+		t.Fatalf("export statuses = %v, want the 3 local plays sent", counts)
+	}
+}
+
+// A run with a deadline sends at least one batch, then stops starting calls
+// once the deadline is within exportDrainReserve.
+func TestServiceExportWatchedStopsDrainNearTheRunDeadline(t *testing.T) {
+	service, repo, _ := newDrainService(t, 25)
+	ctx, cancel := context.WithTimeout(t.Context(), exportDrainReserve/2)
+	defer cancel()
+	var calls [][]LocalPlay
+	exporter := drainExporterStub{batchSize: 10, calls: &calls, respond: sendAllPlays}
+
+	if _, err := service.ExportWatched(ctx, drainConn, ServerConfig{}, exporter); err != nil {
+		t.Fatal(err)
+	}
+	if len(calls) != 1 {
+		t.Fatalf("calls = %d, want 1", len(calls))
+	}
+	if counts := exportStatusCounts(repo); counts[historyExportStatusSent] != 10 || counts[historyExportStatusPending] != 15 {
+		t.Fatalf("export statuses = %v, want 10 sent and 15 pending", counts)
+	}
+}
+
+// A play the user marks unwatched while the backlog drains is not sent as
+// watched by a later batch; its export waits for the next run.
+func TestServiceExportWatchedSkipsPlaysUnwatchedDuringTheDrain(t *testing.T) {
+	service, repo, store := newDrainService(t, 25)
+	var calls [][]LocalPlay
+	exporter := drainExporterStub{batchSize: 10, calls: &calls, respond: func(call int, plays []LocalPlay) (ExportResult, error) {
+		if call == 0 {
+			if err := store.RemoveHistoryItems(t.Context(), drainConn.ProfileID, []string{testMovieMediaID}, time.Now().UTC()); err != nil {
+				t.Fatal(err)
+			}
+		}
+		return sendAllPlays(call, plays)
+	}}
+
+	if _, err := service.ExportWatched(t.Context(), drainConn, ServerConfig{}, exporter); err != nil {
+		t.Fatal(err)
+	}
+	if len(calls) != 1 {
+		t.Fatalf("calls = %d, want only the batch sent before the unwatch", len(calls))
+	}
+	if counts := exportStatusCounts(repo); counts[historyExportStatusSent] != 10 || counts[historyExportStatusPending] != 15 {
+		t.Fatalf("export statuses = %v, want 10 sent and 15 pending", counts)
+	}
+}
+
+// Credentials a plugin rotates during one call reach the next call and are
+// not overwritten by the final connection save.
+func TestServiceExportWatchedUsesCredentialsRotatedDuringTheDrain(t *testing.T) {
+	service, repo, _ := newDrainService(t, 15)
+	var calls [][]LocalPlay
+	var tokens []string
+	exporter := drainExporterStub{batchSize: 10, calls: &calls, tokens: &tokens, respond: func(call int, plays []LocalPlay) (ExportResult, error) {
+		if call == 0 {
+			rotated := drainConn
+			rotated.AccessToken = "rotated"
+			repo.withConnection(rotated)
+		}
+		return sendAllPlays(call, plays)
+	}}
+
+	if _, err := service.ExportWatched(t.Context(), drainConn, ServerConfig{}, exporter); err != nil {
+		t.Fatal(err)
+	}
+	if len(tokens) != 2 || tokens[1] != "rotated" {
+		t.Fatalf("tokens per call = %q, want the second call to use the rotated token", tokens)
+	}
+	saved, ok, err := repo.GetConnectionByID(t.Context(), drainConn.ID)
+	if err != nil || !ok || saved.AccessToken != "rotated" {
+		t.Fatalf("saved connection token = %q (ok=%v, err=%v), want rotated", saved.AccessToken, ok, err)
+	}
+}
+
+// countingHistoryLister records the queries it receives.
+type countingHistoryLister struct {
+	queries []userstore.CompletedHistoryQuery
+}
+
+func (l *countingHistoryLister) ListCompletedHistory(_ context.Context, query userstore.CompletedHistoryQuery) ([]userstore.WatchHistoryEntry, error) {
+	l.queries = append(l.queries, query)
+	return nil, nil
+}
+
+// An empty page must not query history: an empty media filter reads it all.
+func TestVisiblePlaysSkipsTheStoreForAnEmptyPage(t *testing.T) {
+	lister := &countingHistoryLister{}
+	plays, err := visiblePlays(t.Context(), lister, userstore.CompletedHistoryQuery{ProfileID: "profile-1"}, nil)
+	if err != nil || len(plays) != 0 || len(lister.queries) != 0 {
+		t.Fatalf("plays = %v, err = %v, queries = %d; want none and no store read", plays, err, len(lister.queries))
+	}
+	if _, err := visiblePlays(t.Context(), lister, userstore.CompletedHistoryQuery{ProfileID: "profile-1"}, []LocalPlay{{HistoryID: "h", MediaItemID: "m"}}); err != nil {
+		t.Fatal(err)
+	}
+	if len(lister.queries) != 1 || !slices.Equal(lister.queries[0].MediaItemIDs, []string{"m"}) {
+		t.Fatalf("queries = %+v, want one filtered to the page's item", lister.queries)
+	}
+}
+
+// Once a batch has gone out, the deadline is checked on every page, so pages
+// that end up with nothing to send cannot run the export past the reserve.
+func TestServiceExportWatchedChecksTheDeadlineOnPagesWithNothingToSend(t *testing.T) {
+	service, repo, store := newDrainService(t, 25)
+	start := time.Now().UTC()
+	clock := start
+	service.now = func() time.Time { return clock }
+	ctx, cancel := context.WithDeadline(t.Context(), start.Add(time.Hour))
+	defer cancel()
+	var calls [][]LocalPlay
+	exporter := drainExporterStub{batchSize: 10, calls: &calls, respond: func(call int, plays []LocalPlay) (ExportResult, error) {
+		// Hide the rest of the backlog, so later pages have nothing to send,
+		// and move the clock inside the reserve.
+		if err := store.RemoveHistoryItems(t.Context(), drainConn.ProfileID, []string{testMovieMediaID}, time.Now().UTC()); err != nil {
+			t.Fatal(err)
+		}
+		clock = start.Add(time.Hour - exportDrainReserve/2)
+		return sendAllPlays(call, plays)
+	}}
+
+	if _, err := service.ExportWatched(ctx, drainConn, ServerConfig{}, exporter); err != nil {
+		t.Fatal(err)
+	}
+	if len(calls) != 1 || len(repo.historyPageSizes) != 1 {
+		t.Fatalf("calls = %d, pages read = %d; want one batch and no further page reads", len(calls), len(repo.historyPageSizes))
+	}
+	if counts := exportStatusCounts(repo); counts[historyExportStatusSent] != 10 || counts[historyExportStatusPending] != 15 {
+		t.Fatalf("export statuses = %v, want 10 sent and 15 pending", counts)
+	}
+}
diff --git a/internal/watchsync/history_exports_db_test.go b/internal/watchsync/history_exports_db_test.go
new file mode 100644
index 0000000000..6542d32f24
--- /dev/null
+++ b/internal/watchsync/history_exports_db_test.go
@@ -0,0 +1,99 @@
+package watchsync
+
+import (
+	"fmt"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/secret"
+)
+
+// Paging after a cursor visits each pending export once, in (watched_at, id)
+// order, including exports that share a watch time.
+func TestListPendingHistoryExportsPagesByCursorDB(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := t.Context()
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer pool.Close()
+	var userID int
+	if err := pool.QueryRow(ctx, "INSERT INTO users(username,role) VALUES($1,'user') RETURNING id", "watch-exports-"+uuid.NewString()).Scan(&userID); err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _, _ = pool.Exec(ctx, "DELETE FROM users WHERE id=$1", userID) }()
+	if _, err := pool.Exec(ctx, "INSERT INTO user_profiles(user_id,id,name) VALUES($1,'exports-p','Exports')", userID); err != nil {
+		t.Fatal(err)
+	}
+	cipher, err := secret.New([]byte("watch-exports-test-key-with-enough-entropy"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	repo := NewPostgresRepository(pool, cipher)
+	conn, err := repo.UpsertConnection(ctx, Connection{
+		Provider: "exports", UserID: userID, ProfileID: "exports-p", AccessToken: "token",
+		ExportWatchedEnabled: true,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Seven exports over three watch times, so pages split ties. One is
+	// already sent and must never be listed.
+	base := time.Date(2020, time.November, 4, 14, 56, 0, 0, time.UTC)
+	exports := make([]HistoryExport, 0, 8)
+	for i := range 7 {
+		exports = append(exports, HistoryExport{
+			ConnectionID: conn.ID, HistoryID: fmt.Sprintf("h-%d", i), MediaItemID: "movie:x",
+			WatchedAt: base.Add(time.Duration(i/3) * time.Minute), ProviderItemKey: "tmdb:1",
+			Status: historyExportStatusPending,
+		})
+	}
+	exports = append(exports, HistoryExport{
+		ConnectionID: conn.ID, HistoryID: "h-sent", MediaItemID: "movie:x",
+		WatchedAt: base, ProviderItemKey: "tmdb:1", Status: historyExportStatusSent,
+	})
+	if err := repo.UpsertHistoryExports(ctx, exports); err != nil {
+		t.Fatal(err)
+	}
+
+	seen := map[string]bool{}
+	var cursor HistoryExportCursor
+	var previous HistoryExport
+	for page := 0; ; page++ {
+		if page > 10 {
+			t.Fatal("paging did not end")
+		}
+		pending, err := repo.ListPendingHistoryExports(ctx, conn.ID, cursor, 2)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if len(pending) == 0 {
+			break
+		}
+		for _, export := range pending {
+			if seen[export.HistoryID] {
+				t.Fatalf("export %s listed twice", export.HistoryID)
+			}
+			seen[export.HistoryID] = true
+			if previous.ID != "" && (export.WatchedAt.Before(previous.WatchedAt) ||
+				(export.WatchedAt.Equal(previous.WatchedAt) && export.ID <= previous.ID)) {
+				t.Fatalf("export %s listed out of order after %s", export.HistoryID, previous.HistoryID)
+			}
+			previous = export
+		}
+		last := pending[len(pending)-1]
+		cursor = HistoryExportCursor{WatchedAt: last.WatchedAt, ID: last.ID}
+	}
+	if len(seen) != 7 || seen["h-sent"] {
+		t.Fatalf("listed %v, want the 7 pending exports", seen)
+	}
+}
diff --git a/internal/watchsync/history_matching_test.go b/internal/watchsync/history_matching_test.go
index d9fb40a19d..e567161eb7 100644
--- a/internal/watchsync/history_matching_test.go
+++ b/internal/watchsync/history_matching_test.go
@@ -42,7 +42,7 @@ func TestServiceExportWatchedConsumesEachRemotePlayOnce(t *testing.T) {
 			}
 			repo := newServiceFakeRepo()
 			service := NewService(repo, NewRegistry()).WithUserStoreProvider(staticStoreProvider{store: userdb.NewSQLiteUserStore(db)})
-			conn := Connection{ID: "conn-1", Provider: "trakt", UserID: 7, ProfileID: "profile-1"}
+			conn := repo.withConnection(Connection{ID: "conn-1", Provider: "trakt", UserID: 7, ProfileID: "profile-1"})
 			result, err := service.ExportWatched(t.Context(), conn, ServerConfig{}, provider)
 			if err != nil {
 				t.Fatal(err)
diff --git a/internal/watchsync/list_items_db_test.go b/internal/watchsync/list_items_db_test.go
new file mode 100644
index 0000000000..6780db9ff2
--- /dev/null
+++ b/internal/watchsync/list_items_db_test.go
@@ -0,0 +1,139 @@
+package watchsync
+
+import (
+	"os"
+	"slices"
+	"sort"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/secret"
+)
+
+// Two library items can carry the same provider key, such as two items for one
+// title with the same IMDb id. Each keeps its own shadow row.
+func TestListItemsSharingProviderKeyDB(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := t.Context()
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer pool.Close()
+	var userID int
+	if err := pool.QueryRow(ctx, "INSERT INTO users(username,role) VALUES($1,'user') RETURNING id", "watch-lists-"+uuid.NewString()).Scan(&userID); err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _, _ = pool.Exec(ctx, "DELETE FROM users WHERE id=$1", userID) }()
+	if _, err := pool.Exec(ctx, "INSERT INTO user_profiles(user_id,id,name) VALUES($1,'lists-p','Lists')", userID); err != nil {
+		t.Fatal(err)
+	}
+	cipher, err := secret.New([]byte("watch-lists-test-key-with-enough-entropy"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	repo := NewPostgresRepository(pool, cipher)
+	conn, err := repo.UpsertConnection(ctx, Connection{
+		Provider: "lists", UserID: userID, ProfileID: "lists-p", AccessToken: "token",
+		ExportFavoritesEnabled: true, SyncFavoriteRemovalsEnabled: true,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	// Copies of one title (a, b), a series with the same key (series), and a
+	// key shared by a live item (d) and one deleted from the catalog (gone),
+	// which therefore has no media_items row.
+	suffix := uuid.NewString()
+	a, b, series, gone, d := "movie:a-"+suffix, "movie:b-"+suffix, "series:s-"+suffix, "movie:gone-"+suffix, "movie:d-"+suffix
+	if _, err := pool.Exec(ctx, `INSERT INTO media_items (content_id,type,title,genres) VALUES ($1,'movie','A','{}'),($2,'movie','B','{}'),($3,'series','S','{}'),($4,'movie','D','{}')`, a, b, series, d); err != nil {
+		t.Fatal(err)
+	}
+	defer func() {
+		_, _ = pool.Exec(ctx, "DELETE FROM media_items WHERE content_id = ANY($1)", []string{a, b, series, d})
+	}()
+	now := time.Now().UTC()
+	state := func(mediaItemID, kind, key string) ListItemState {
+		return ListItemState{
+			ConnectionID: conn.ID, ListKind: ListKindFavorites, MediaItemID: mediaItemID,
+			ProviderItemKey: key, Kind: kind, LocalPresent: true, LastSeenLocalAt: &now,
+		}
+	}
+	states := []ListItemState{
+		state(a, "movie", "tmdb:550"), state(b, "movie", "tmdb:550"), state(series, "series", "tmdb:550"),
+		state(gone, "movie", "imdb:tt0000001"), state(d, "movie", "imdb:tt0000001"),
+	}
+	if err := repo.UpsertListItemStates(ctx, states); err != nil {
+		t.Fatalf("upsert items sharing a key: %v", err)
+	}
+	pending, err := repo.ListPendingListItemExports(ctx, conn.ID, ListKindFavorites, 10)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(pending) != len(states) {
+		t.Fatalf("pending exports = %d, want %d", len(pending), len(states))
+	}
+	for _, state := range states {
+		if err := repo.MarkListItemExported(ctx, conn.ID, ListKindFavorites, state.MediaItemID, now); err != nil {
+			t.Fatal(err)
+		}
+	}
+	pendingRemovals := func() []string {
+		t.Helper()
+		removals, err := repo.ListPendingListItemRemovals(ctx, conn.ID, ListKindFavorites, 10)
+		if err != nil {
+			t.Fatal(err)
+		}
+		ids := make([]string, 0, len(removals))
+		for _, removal := range removals {
+			ids = append(ids, removal.MediaItemID)
+		}
+		sort.Strings(ids)
+		return ids
+	}
+	localRemove := func(ids ...string) {
+		t.Helper()
+		for _, id := range ids {
+			if err := repo.MarkListItemLocalRemoved(ctx, conn.ID, ListKindFavorites, id, now); err != nil {
+				t.Fatal(err)
+			}
+		}
+	}
+
+	// Copy a leaves the local list while copy b still holds the key.
+	localRemove(a)
+	if got := pendingRemovals(); len(got) != 0 {
+		t.Fatalf("pending removals = %v, want none while b holds the key", got)
+	}
+	held, err := repo.ListListItemsWithSharedKeyHeld(ctx, conn.ID, ListKindFavorites, []string{a, b, series})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !held[a] || held[b] || held[series] {
+		t.Fatalf("held = %v, want only a", held)
+	}
+
+	// Once b leaves too, both copies go; the series is a different title and
+	// does not hold the movie's key.
+	localRemove(b)
+	if got, want := pendingRemovals(), []string{a, b}; !slices.Equal(got, want) {
+		t.Fatalf("pending removals = %v, want %v", got, want)
+	}
+
+	// An item deleted from the catalog no longer holds its key.
+	if err := repo.MarkListItemRemoteRemoved(ctx, conn.ID, ListKindFavorites, a, now); err != nil {
+		t.Fatal(err)
+	}
+	if err := repo.MarkListItemRemoteRemoved(ctx, conn.ID, ListKindFavorites, b, now); err != nil {
+		t.Fatal(err)
+	}
+	localRemove(d)
+	if got, want := pendingRemovals(), []string{d}; !slices.Equal(got, want) {
+		t.Fatalf("pending removals = %v, want %v", got, want)
+	}
+}
diff --git a/internal/watchsync/lists.go b/internal/watchsync/lists.go
index aec87a779a..13e92b0262 100644
--- a/internal/watchsync/lists.go
+++ b/internal/watchsync/lists.go
@@ -45,7 +45,8 @@ type listBinding struct {
 	removeItems func(ctx context.Context, cfg ServerConfig, conn Connection, provider Provider, items []LocalFavorite) (result ExportResult, ok bool, err error)
 
 	// Local list operations against the per-user store.
-	localAdd    func(ctx context.Context, store userstore.UserStore, profileID, mediaItemID string, at time.Time) error
+	// localAdd reports whether the item was new to the local list.
+	localAdd    func(ctx context.Context, store userstore.UserStore, profileID, mediaItemID string, at time.Time) (bool, error)
 	localRemove func(ctx context.Context, store userstore.UserStore, profileID, mediaItemID string) error
 	localList   func(ctx context.Context, store userstore.UserStore, profileID string, limit, offset int) ([]listRow, error)
 
@@ -101,12 +102,12 @@ func (s *Service) favoritesBinding() listBinding {
 			res, err := remover.RemoveFavorites(ctx, cfg, conn, items)
 			return res, true, err
 		},
-		localAdd: func(ctx context.Context, store userstore.UserStore, profileID, mediaItemID string, at time.Time) error {
-			_, err := store.AddFavoriteAt(ctx, profileID, mediaItemID, at)
-			return err
+		localAdd: func(ctx context.Context, store userstore.UserStore, profileID, mediaItemID string, at time.Time) (bool, error) {
+			return store.AddFavoriteAt(ctx, profileID, mediaItemID, at)
 		},
 		localRemove: func(ctx context.Context, store userstore.UserStore, profileID, mediaItemID string) error {
-			return store.RemoveFavorite(ctx, profileID, mediaItemID)
+			_, err := store.RemoveFavorite(ctx, profileID, mediaItemID)
+			return err
 		},
 		localList: func(ctx context.Context, store userstore.UserStore, profileID string, limit, offset int) ([]listRow, error) {
 			favorites, err := store.ListFavorites(ctx, profileID, limit, offset)
@@ -170,12 +171,12 @@ func (s *Service) watchlistBinding() listBinding {
 			res, err := remover.RemoveWatchlist(ctx, cfg, conn, items)
 			return res, true, err
 		},
-		localAdd: func(ctx context.Context, store userstore.UserStore, profileID, mediaItemID string, at time.Time) error {
-			_, err := store.AddToWatchlistAt(ctx, profileID, mediaItemID, at)
-			return err
+		localAdd: func(ctx context.Context, store userstore.UserStore, profileID, mediaItemID string, at time.Time) (bool, error) {
+			return store.AddToWatchlistAt(ctx, profileID, mediaItemID, at)
 		},
 		localRemove: func(ctx context.Context, store userstore.UserStore, profileID, mediaItemID string) error {
-			return store.RemoveFromWatchlist(ctx, profileID, mediaItemID)
+			_, err := store.RemoveFromWatchlist(ctx, profileID, mediaItemID)
+			return err
 		},
 		localList: func(ctx context.Context, store userstore.UserStore, profileID string, limit, offset int) ([]listRow, error) {
 			entries, err := store.ListWatchlist(ctx, profileID, limit, offset)
@@ -225,6 +226,15 @@ type ImportListResult struct {
 	Unmatched int
 	Removed   int
 	Warnings  []string
+	// added counts the imported items that were new to the local list;
+	// Imported also counts the ones it already held.
+	added int
+}
+
+// changedLocalList reports whether the import added to or removed from the
+// local list.
+func (r ImportListResult) changedLocalList() bool {
+	return r.added > 0 || r.Removed > 0
 }
 
 // importList pulls the provider's list (favorites or watchlist) and mirrors it
@@ -253,7 +263,11 @@ func (s *Service) importList(ctx context.Context, conn Connection, cfg ServerCon
 	if err != nil {
 		return result, err
 	}
-	seenRemoteKeys := make(map[string]bool, len(rows))
+	removalsPending, err := s.listItemsPendingRemoval(ctx, conn, b)
+	if err != nil {
+		return result, err
+	}
+	seenRemote := make(remoteListPresence, len(rows))
 	states := make([]ListItemState, 0, len(rows))
 	// orderedIDs records matched local ids in the order the provider returned
 	// them, so an order-providing list (e.g. MDBList watchlist) can mirror its
@@ -261,11 +275,28 @@ func (s *Service) importList(ctx context.Context, conn Connection, cfg ServerCon
 	orderedIDs := make([]string, 0, len(rows))
 	for _, row := range rows {
 		if row.Removed {
-			if err := s.applyRemoteListTombstone(ctx, conn, store, b, row, existingByRemoteKey, &result); err != nil {
+			unlisted, err := s.applyRemoteListTombstone(ctx, conn, store, b, row, existingByRemoteKey, &result)
+			if err != nil {
 				return result, err
 			}
+			// The provider no longer lists them, so a later row in this batch
+			// that lists one again is a new add, not the listing a pending
+			// local removal waits on.
+			for _, id := range unlisted {
+				delete(removalsPending, id)
+			}
 			continue
 		}
+		// The provider still lists the title even when the row matches no
+		// single library item, for example when two items carry its id. Its
+		// key format can differ from the one stored at export (Trakt keys
+		// shows by TVDB id first), so every id the row carries counts.
+		key := row.ProviderItemKey
+		if key == "" {
+			key = providerItemKeyForRemoteFavorite(row)
+		}
+		seenRemote.add(row.Kind,
+			key, prefixedID("imdb", row.IMDbID), prefixedID("tmdb", row.TMDBID), prefixedID("tvdb", row.TVDBID))
 		match, reason, err := s.matcher.Match(ctx, row.HistoryRecord())
 		if err != nil {
 			return result, err
@@ -277,18 +308,22 @@ func (s *Service) importList(ctx context.Context, conn Connection, cfg ServerCon
 			}
 			continue
 		}
-		if err := b.localAdd(ctx, store, conn.ProfileID, match.MediaItemID, row.FavoritedAt); err != nil {
+		// The provider listing the item again after the local removal is a
+		// newer add; an older or undated listing is the one the removal will
+		// take off.
+		if removedAt, pending := removalsPending[match.MediaItemID]; pending &&
+			(row.FavoritedAtGuessed || !row.FavoritedAt.After(removedAt)) {
+			continue
+		}
+		added, err := b.localAdd(ctx, store, conn.ProfileID, match.MediaItemID, row.FavoritedAt)
+		if err != nil {
 			return result, err
 		}
+		if added {
+			result.added++
+		}
 		orderedIDs = append(orderedIDs, match.MediaItemID)
 		result.Imported++
-		key := row.ProviderItemKey
-		if key == "" {
-			key = providerItemKeyForRemoteFavorite(row)
-		}
-		if key != "" {
-			seenRemoteKeys[key] = true
-		}
 		listedAt := row.FavoritedAt
 		states = append(states, ListItemState{
 			ConnectionID:     conn.ID,
@@ -308,7 +343,7 @@ func (s *Service) importList(ctx context.Context, conn Connection, cfg ServerCon
 		return result, err
 	}
 	if !batch.Incremental {
-		if err := s.reconcileMissingRemoteListItems(ctx, conn, store, b, seenRemoteKeys, &result); err != nil {
+		if err := s.reconcileMissingRemoteListItems(ctx, conn, store, b, seenRemote, &result); err != nil {
 			return result, err
 		}
 	}
@@ -330,12 +365,39 @@ func (s *Service) importList(ctx context.Context, conn Connection, cfg ServerCon
 	return result, nil
 }
 
+// listItemsPendingRemoval maps each item whose local removal has not reached
+// the provider yet to when it left the local list, when removals sync. The
+// provider still lists these items, so an import must not add them back from
+// that listing: a failed removal retries later in the run, and a removal held
+// because another library item shares the key stays until that item leaves
+// too.
+func (s *Service) listItemsPendingRemoval(ctx context.Context, conn Connection, b listBinding) (map[string]time.Time, error) {
+	if !b.removalsEnabled(conn) {
+		return nil, nil
+	}
+	states, err := s.repo.ListListItemStates(ctx, conn.ID, b.kind)
+	if err != nil {
+		return nil, err
+	}
+	pending := make(map[string]time.Time)
+	for _, state := range states {
+		if !state.LocalPresent && state.RemotePresent {
+			var removedAt time.Time
+			if state.LastRemovedLocalAt != nil {
+				removedAt = *state.LastRemovedLocalAt
+			}
+			pending[state.MediaItemID] = removedAt
+		}
+	}
+	return pending, nil
+}
+
 func (s *Service) listItemStatesByRemoteKey(
 	ctx context.Context,
 	connectionID string,
 	kind ListKind,
 	rows []RemoteFavorite,
-) (map[string]ListItemState, error) {
+) (map[string][]ListItemState, error) {
 	hasTombstone := false
 	for _, row := range rows {
 		if row.Removed {
@@ -350,67 +412,131 @@ func (s *Service) listItemStatesByRemoteKey(
 	if err != nil {
 		return nil, err
 	}
-	byRemoteKey := make(map[string]ListItemState, len(states))
+	// Several library items can share a key, such as two items for one title
+	// with the same IMDb id.
+	byRemoteKey := make(map[string][]ListItemState, len(states))
 	for _, state := range states {
 		if key := strings.TrimSpace(state.ProviderItemKey); key != "" {
-			byRemoteKey[key] = state
+			byRemoteKey[key] = append(byRemoteKey[key], state)
 		}
 	}
 	return byRemoteKey, nil
 }
 
+// applyRemoteListTombstone applies a provider removal to the rows with its key
+// and returns the media items it marked as no longer listed by the provider.
 func (s *Service) applyRemoteListTombstone(
 	ctx context.Context,
 	conn Connection,
 	store userstore.UserStore,
 	b listBinding,
 	row RemoteFavorite,
-	existingByRemoteKey map[string]ListItemState,
+	existingByRemoteKey map[string][]ListItemState,
 	result *ImportListResult,
-) error {
+) ([]string, error) {
 	key := strings.TrimSpace(row.ProviderItemKey)
-	state, ok := existingByRemoteKey[key]
-	if key == "" || !ok {
+	// Point into the map's rows so a later tombstone for the key in this
+	// batch sees them already removed.
+	existing := existingByRemoteKey[key]
+	var states []*ListItemState
+	for i := range existing {
+		if row.Kind == "" || existing[i].Kind == "" || existing[i].Kind == row.Kind {
+			states = append(states, &existing[i])
+		}
+	}
+	if key == "" || len(states) == 0 {
 		result.Warnings = append(result.Warnings, "watch sync provider returned an unknown list removal")
-		return nil
+		return nil, nil
+	}
+	// Copies of one title share a kind and all leave. A movie and a series
+	// with the same key are different titles, and a tombstone without a kind
+	// cannot say which one left.
+	if !sameListItemKind(states) {
+		result.Warnings = append(result.Warnings, "watch sync provider returned a list removal for "+key+" that matches more than one title")
+		return nil, nil
 	}
 	now := s.now()
-	if b.removalsEnabled(conn) && state.LocalPresent {
-		if err := b.localRemove(ctx, store, conn.ProfileID, state.MediaItemID); err != nil {
-			return err
+	unlisted := make([]string, 0, len(states))
+	for _, state := range states {
+		if b.removalsEnabled(conn) && state.LocalPresent {
+			if err := b.localRemove(ctx, store, conn.ProfileID, state.MediaItemID); err != nil {
+				return nil, err
+			}
+			// Counted once the local list changed, so a failed bookkeeping
+			// write below still reports the change.
+			result.Removed++
+			if err := s.repo.MarkListItemLocalRemoved(ctx, conn.ID, b.kind, state.MediaItemID, now); err != nil {
+				return nil, err
+			}
+			state.LocalPresent = false
 		}
-		if err := s.repo.MarkListItemLocalRemoved(ctx, conn.ID, b.kind, state.MediaItemID, now); err != nil {
-			return err
+		if err := s.repo.MarkListItemRemoteRemoved(ctx, conn.ID, b.kind, state.MediaItemID, now); err != nil {
+			return nil, err
 		}
-		result.Removed++
-		state.LocalPresent = false
+		state.RemotePresent = false
+		unlisted = append(unlisted, state.MediaItemID)
 	}
-	if err := s.repo.MarkListItemRemoteRemoved(ctx, conn.ID, b.kind, state.MediaItemID, now); err != nil {
-		return err
+	return unlisted, nil
+}
+
+// sameListItemKind reports whether the rows name one kind of title. A row
+// without a kind matches any.
+func sameListItemKind(states []*ListItemState) bool {
+	kind := ""
+	for _, state := range states {
+		switch {
+		case state.Kind == "":
+		case kind == "":
+			kind = state.Kind
+		case state.Kind != kind:
+			return false
+		}
 	}
-	state.RemotePresent = false
-	existingByRemoteKey[key] = state
-	return nil
+	return true
+}
+
+// remoteListPresence records the keys a complete provider read listed, with
+// the kinds of title listed under each. TMDB and TVDB number movies and series
+// separately, so a movie row does not keep a series with the same key.
+type remoteListPresence map[string]map[string]bool
+
+func (p remoteListPresence) add(kind string, keys ...string) {
+	for _, key := range keys {
+		if key == "" {
+			continue
+		}
+		if p[key] == nil {
+			p[key] = make(map[string]bool)
+		}
+		p[key][kind] = true
+	}
+}
+
+// listed reports whether the read listed a title of this kind under key. A
+// row or stored state without a kind matches any kind.
+func (p remoteListPresence) listed(kind, key string) bool {
+	kinds := p[key]
+	return kinds[kind] || kinds[""] || (kind == "" && len(kinds) > 0)
 }
 
-func (s *Service) reconcileMissingRemoteListItems(ctx context.Context, conn Connection, store userstore.UserStore, b listBinding, seenRemoteKeys map[string]bool, result *ImportListResult) error {
+func (s *Service) reconcileMissingRemoteListItems(ctx context.Context, conn Connection, store userstore.UserStore, b listBinding, seenRemote remoteListPresence, result *ImportListResult) error {
 	states, err := s.repo.ListListItemStates(ctx, conn.ID, b.kind)
 	if err != nil {
 		return err
 	}
 	now := s.now()
 	for _, state := range states {
-		if !state.RemotePresent || state.ProviderItemKey == "" || seenRemoteKeys[state.ProviderItemKey] {
+		if !state.RemotePresent || state.ProviderItemKey == "" || seenRemote.listed(state.Kind, state.ProviderItemKey) {
 			continue
 		}
 		if b.removalsEnabled(conn) && state.LocalPresent {
 			if err := b.localRemove(ctx, store, conn.ProfileID, state.MediaItemID); err != nil {
 				return err
 			}
+			result.Removed++
 			if err := s.repo.MarkListItemLocalRemoved(ctx, conn.ID, b.kind, state.MediaItemID, now); err != nil {
 				return err
 			}
-			result.Removed++
 		}
 		if err := s.repo.MarkListItemRemoteRemoved(ctx, conn.ID, b.kind, state.MediaItemID, now); err != nil {
 			return err
@@ -704,7 +830,14 @@ func (s *Service) processLocalListEvent(ctx context.Context, event LocalListEven
 			if !b.removalsEnabled(conn) || !b.capRemove(provider.Capabilities()) {
 				continue
 			}
-			result, ok, err := b.removeItems(ctx, cfg, conn, provider, event.Items)
+			toRemove, err := s.listItemsReleasedLocally(ctx, conn, b, event.Items)
+			if err != nil {
+				return err
+			}
+			if len(toRemove) == 0 {
+				continue
+			}
+			result, ok, err := b.removeItems(ctx, cfg, conn, provider, toRemove)
 			if !ok {
 				continue
 			}
@@ -713,7 +846,7 @@ func (s *Service) processLocalListEvent(ctx context.Context, event LocalListEven
 				s.recordLocalWatchEventError(ctx, conn, err)
 				continue
 			}
-			for _, item := range event.Items {
+			for _, item := range toRemove {
 				if sent, notFound := exportItemOutcome(result, item.MediaItemID, item.ProviderItemKey); sent || notFound {
 					if err := s.repo.MarkListItemRemoteRemoved(ctx, conn.ID, b.kind, item.MediaItemID, now); err != nil {
 						return err
@@ -725,6 +858,27 @@ func (s *Service) processLocalListEvent(ctx context.Context, event LocalListEven
 	return nil
 }
 
+// listItemsReleasedLocally drops the removed items whose provider key another
+// item on the local list still holds, since removing that key would take the
+// other item off the provider's list too. Their rows stay pending removal.
+func (s *Service) listItemsReleasedLocally(ctx context.Context, conn Connection, b listBinding, items []LocalFavorite) ([]LocalFavorite, error) {
+	ids := make([]string, 0, len(items))
+	for _, item := range items {
+		ids = append(ids, item.MediaItemID)
+	}
+	held, err := s.repo.ListListItemsWithSharedKeyHeld(ctx, conn.ID, b.kind, ids)
+	if err != nil {
+		return nil, err
+	}
+	released := make([]LocalFavorite, 0, len(items))
+	for _, item := range items {
+		if !held[item.MediaItemID] {
+			released = append(released, item)
+		}
+	}
+	return released, nil
+}
+
 func (s *Service) exportLocalListItems(ctx context.Context, conn Connection, cfg ServerConfig, provider Provider, b listBinding, items []LocalFavorite) error {
 	states := make([]ListItemState, 0, len(items))
 	// toSend carries the normalized items (with a computed ProviderItemKey) so
diff --git a/internal/watchsync/plugin_provider_state.go b/internal/watchsync/plugin_provider_state.go
index 2f5825ffca..f73bdbcd75 100644
--- a/internal/watchsync/plugin_provider_state.go
+++ b/internal/watchsync/plugin_provider_state.go
@@ -762,9 +762,11 @@ func remoteFavoriteFromProto(provider string, state *pluginv1.WatchSyncRemoteSta
 		return RemoteFavorite{}, err
 	}
 	row := identity.favorite(provider, providerItemKey)
-	row.FavoritedAt = time.Now().UTC()
 	if value := timePointer(listed.GetListedAt()); value != nil {
 		row.FavoritedAt = *value
+	} else {
+		row.FavoritedAt = time.Now().UTC()
+		row.FavoritedAtGuessed = true
 	}
 	return row, nil
 }
diff --git a/internal/watchsync/plugin_provider_test.go b/internal/watchsync/plugin_provider_test.go
index 4d14ecbf07..a892df1458 100644
--- a/internal/watchsync/plugin_provider_test.go
+++ b/internal/watchsync/plugin_provider_test.go
@@ -1313,6 +1313,28 @@ func TestPluginProviderRejectsIncrementalOrderedWatchlist(t *testing.T) {
 	}
 }
 
+func TestPluginProviderMarksGuessedListTime(t *testing.T) {
+	state := &pluginv1.WatchSyncRemoteState{
+		ProviderItemKey: "imdb:tt0137523",
+		Media: &pluginv1.WatchSyncMedia{
+			MediaType: pluginv1.WatchSyncMediaType_WATCH_SYNC_MEDIA_TYPE_MOVIE,
+			Title:     "Movie", ExternalIds: map[string]string{"imdb": "tt0137523"},
+		},
+	}
+	listedAt := time.Date(2026, 10, 1, 12, 0, 0, 0, time.UTC)
+	dated, err := remoteFavoriteFromProto(testPluginProviderKey, state, &pluginv1.WatchSyncRemoteListState{ListedAt: timestamppb.New(listedAt)})
+	if err != nil {
+		t.Fatal(err)
+	}
+	undated, err := remoteFavoriteFromProto(testPluginProviderKey, state, &pluginv1.WatchSyncRemoteListState{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if dated.FavoritedAtGuessed || !dated.FavoritedAt.Equal(listedAt) || !undated.FavoritedAtGuessed || undated.FavoritedAt.IsZero() {
+		t.Fatalf("dated = %v/%v, undated = %v/%v", dated.FavoritedAt, dated.FavoritedAtGuessed, undated.FavoritedAt, undated.FavoritedAtGuessed)
+	}
+}
+
 func TestPluginProviderDecodesKeyOnlyListTombstone(t *testing.T) {
 	row, err := remoteFavoriteFromProto(testPluginProviderKey, &pluginv1.WatchSyncRemoteState{
 		ProviderItemKey: "remote-1",
diff --git a/internal/watchsync/ratings.go b/internal/watchsync/ratings.go
index de269dd655..410882f21d 100644
--- a/internal/watchsync/ratings.go
+++ b/internal/watchsync/ratings.go
@@ -55,16 +55,9 @@ type ratingStore interface {
 	DeleteIfUnchanged(ctx context.Context, userID int, profileID, mediaItemID string, observed catalog.ObservedRating) (bool, error)
 }
 
-// ratingProfileStaler marks a profile's recommendations stale after imports
-// changed its ratings.
-type ratingProfileStaler interface {
-	MarkProfileStale(ctx context.Context, userID int, profileID string) error
-}
-
-func (s *Service) WithRatingStore(store ratingStore, staler ratingProfileStaler) *Service {
+func (s *Service) WithRatingStore(store ratingStore) *Service {
 	if s != nil {
 		s.ratings = store
-		s.ratingStaler = staler
 	}
 	return s
 }
@@ -94,7 +87,7 @@ const (
 // unrated; base is the last agreed rating. A zero remoteAt is unknown.
 func decideRating(local, remote, base int, localAt, remoteAt time.Time) ratingAction {
 	switch {
-	case local == remote && local == base:
+	case local == base && remote == base:
 		return ratingKeep
 	case local == remote:
 		return ratingRebase
@@ -776,18 +769,6 @@ func (s *Service) reconcileRatings(
 		}
 	}
 
-	// Imports commit one by one, so recommendations are marked stale once any
-	// applied, even if the bookkeeping after them fails or the run's context
-	// ends; the mark gets a short context of its own.
-	defer func() {
-		if result.imported > 0 && s.ratingStaler != nil {
-			markCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
-			defer cancel()
-			if err := s.ratingStaler.MarkProfileStale(markCtx, conn.UserID, conn.ProfileID); err != nil {
-				slog.WarnContext(ctx, "failed to mark profile stale after rating import", "component", "watchsync", "user_id", conn.UserID, "profile_id", conn.ProfileID, "error", err)
-			}
-		}
-	}()
 	for _, item := range items {
 		switch decideRating(item.local, item.remote, item.base, item.localAt, item.remoteAt) {
 		case ratingKeep:
diff --git a/internal/watchsync/ratings_test.go b/internal/watchsync/ratings_test.go
index 881ff3707a..a5fbc5da49 100644
--- a/internal/watchsync/ratings_test.go
+++ b/internal/watchsync/ratings_test.go
@@ -2,7 +2,6 @@ package watchsync
 
 import (
 	"context"
-	"errors"
 	"slices"
 	"sort"
 	"strings"
@@ -98,9 +97,6 @@ func TestSyncRatingsFirstSyncUnionsBothSides(t *testing.T) {
 	if result.Imported != 2 || result.Sent != 1 || result.RemoteFound != 2 || result.LocalFound != 1 {
 		t.Fatalf("result = %#v", result)
 	}
-	if !h.stale {
-		t.Fatal("imports must mark the profile's recommendations stale")
-	}
 	if s := h.state(ratingTestMovieB); s == nil || s.SyncedRating != 4 || !s.RemoteSeen {
 		t.Fatalf("imported base = %#v, want 4 stars seen", s)
 	}
@@ -852,25 +848,58 @@ func TestDeleteConnectionWaitsForTheRatingSyncLock(t *testing.T) {
 	}
 }
 
-func TestSyncRatingsMarksTheProfileStaleWhenBookkeepingFailsAfterAnImport(t *testing.T) {
+// A run whose rating bookkeeping fails after an import committed still
+// reports the import, once, with a live context, so the profile's
+// recommendations are rebuilt.
+func TestExecuteSyncRunReportsAnImportWhenBookkeepingFailsAfterIt(t *testing.T) {
 	h := newRatingHarness(t)
 	h.provider.batch = RatingImportBatch{Rows: []RemoteRating{h.remoteRow(ratingTestMovieB, 8)}, SnapshotKinds: []string{historyimport.KindMovie}}
-	h.repo.connections[connectionKey(h.conn.Provider, h.conn.UserID, h.conn.ProfileID)] = h.conn
 	// The run's deadline ends right after the import commits.
 	ctx, cancel := context.WithCancel(context.Background())
 	h.repo.upsertRatingErr = context.Canceled
 	h.store.afterWrite = cancel
-	staleCtxErr := errors.New("unset")
-	h.staleCtx = func(ctx context.Context) { staleCtxErr = ctx.Err() }
-	if _, err := h.service.syncRatings(ctx, h.conn, ServerConfig{}, h.provider); err == nil {
+	if _, err := h.service.executeSyncRun(ctx, h.conn, h.newRun()); err == nil {
 		t.Fatal("want the bookkeeping error")
 	}
-	if staleCtxErr != nil {
-		t.Fatalf("stale mark ran with context error %v, want a live context", staleCtxErr)
+	if h.store.stars(ratingTestMovieB) != 4 {
+		t.Fatalf("movieB=%d, want the import committed", h.store.stars(ratingTestMovieB))
+	}
+	h.signals.assert(t, 1)
+	if h.signals.ctxErrs[0] != nil {
+		t.Fatalf("notification ran with context error %v, want a live context", h.signals.ctxErrs[0])
+	}
+}
+
+// A sync run reports signal changes once however many items it imported,
+// and not at all when it imported nothing.
+func TestExecuteSyncRunReportsImportsOncePerRun(t *testing.T) {
+	h := newRatingHarness(t)
+	h.provider.batch = RatingImportBatch{
+		Rows:          []RemoteRating{h.remoteRow(ratingTestMovieB, 7), h.remoteRow(ratingTestSeries, 10)},
+		SnapshotKinds: []string{historyimport.KindMovie, historyimport.KindSeries},
+	}
+	run, err := h.service.executeSyncRun(context.Background(), h.conn, h.newRun())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if run.InboundRatingsImported != 2 {
+		t.Fatalf("imported = %d, want 2", run.InboundRatingsImported)
+	}
+	h.signals.assert(t, 1)
+	if h.signals.userID != ratingTestUserID || h.signals.profileID != ratingTestProfileID {
+		t.Fatalf("notified %d/%s, want the connection's profile", h.signals.userID, h.signals.profileID)
+	}
+
+	// The same ratings again import nothing; sending a local rating is not a
+	// signal change either.
+	h.store.set(ratingTestMovieA, 3)
+	if _, err := h.service.executeSyncRun(context.Background(), h.conn, h.newRun()); err != nil {
+		t.Fatal(err)
 	}
-	if h.store.stars(ratingTestMovieB) != 4 || !h.stale {
-		t.Fatalf("movieB=%d stale=%v, want the committed import to mark recommendations stale", h.store.stars(ratingTestMovieB), h.stale)
+	if len(h.provider.exported) == 0 {
+		t.Fatal("precondition: the second run sent the local rating")
 	}
+	h.signals.assert(t, 1)
 }
 
 func TestSyncRatingsLeavesRatingsToARunHoldingTheLock(t *testing.T) {
@@ -907,9 +936,39 @@ type ratingHarness struct {
 	conn     Connection
 	media    map[string]LocalFavorite
 	watched  map[string]bool
-	stale    bool
-	// staleCtx, when set, sees the context the stale mark ran with.
-	staleCtx func(context.Context)
+	signals  *recordingSignalsNotifier
+}
+
+// recordingSignalsNotifier records signal change notifications.
+type recordingSignalsNotifier struct {
+	calls     int
+	userID    int
+	profileID string
+	ctxErrs   []error
+}
+
+func (n *recordingSignalsNotifier) NotifySignalsChanged(ctx context.Context, userID int, profileID string) {
+	n.calls++
+	n.userID, n.profileID = userID, profileID
+	n.ctxErrs = append(n.ctxErrs, ctx.Err())
+}
+
+func (n *recordingSignalsNotifier) assert(t *testing.T, want int) {
+	t.Helper()
+	if n.calls != want {
+		t.Fatalf("signal change notifications = %d, want %d", n.calls, want)
+	}
+}
+
+func (h *ratingHarness) newRun() SyncRun {
+	h.t.Helper()
+	h.provider.exported, h.provider.removed = nil, nil
+	h.repo.connections[connectionKey(h.conn.Provider, h.conn.UserID, h.conn.ProfileID)] = h.conn
+	run, err := h.repo.CreateSyncRun(context.Background(), SyncRun{ConnectionID: h.conn.ID, Provider: h.conn.Provider})
+	if err != nil {
+		h.t.Fatal(err)
+	}
+	return run
 }
 
 func newRatingHarness(t *testing.T) *ratingHarness {
@@ -920,6 +979,7 @@ func newRatingHarness(t *testing.T) *ratingHarness {
 		store:    newFakeRatingStore(),
 		provider: &ratingProviderStub{},
 		watched:  map[string]bool{},
+		signals:  &recordingSignalsNotifier{},
 		media: map[string]LocalFavorite{
 			ratingTestMovieA: {MediaItemID: ratingTestMovieA, Kind: historyimport.KindMovie, IMDbID: "tt0101", TMDBID: "101", ProviderItemKey: "tmdb:101"},
 			ratingTestMovieB: {MediaItemID: ratingTestMovieB, Kind: historyimport.KindMovie, TMDBID: "102", ProviderItemKey: "tmdb:102"},
@@ -939,12 +999,8 @@ func newRatingHarness(t *testing.T) *ratingHarness {
 	h.service = NewService(h.repo, registry).
 		WithMatcher(ratingMatcherStub{media: h.media}).
 		WithUserStoreProvider(ratingHistoryStoreProvider{watched: h.watched}).
-		WithRatingStore(h.store, ratingStalerFunc(func(ctx context.Context) {
-			h.stale = true
-			if h.staleCtx != nil {
-				h.staleCtx(ctx)
-			}
-		}))
+		WithRatingStore(h.store).
+		WithSignalsChangedNotifier(h.signals)
 	return h
 }
 
@@ -1056,13 +1112,6 @@ func (s *fakeRatingStore) DeleteIfUnchanged(_ context.Context, _ int, _ string,
 	return true, nil
 }
 
-type ratingStalerFunc func(context.Context)
-
-func (f ratingStalerFunc) MarkProfileStale(ctx context.Context, _ int, _ string) error {
-	f(ctx)
-	return nil
-}
-
 // ratingMatcherStub matches remote rows by kind and TMDB id.
 type ratingMatcherStub struct {
 	media map[string]LocalFavorite
diff --git a/internal/watchsync/repository.go b/internal/watchsync/repository.go
index 1831fb3ece..cff32c923e 100644
--- a/internal/watchsync/repository.go
+++ b/internal/watchsync/repository.go
@@ -36,7 +36,7 @@ type Repository interface {
 	ListLocalWatchEventConnections(ctx context.Context, userID int, profileID string, kind LocalWatchEventKind) ([]Connection, error)
 	ListListEventConnections(ctx context.Context, userID int, profileID string, list ListKind) ([]Connection, error)
 	UpsertHistoryExports(ctx context.Context, exports []HistoryExport) error
-	ListPendingHistoryExports(ctx context.Context, connectionID string, limit int) ([]HistoryExport, error)
+	ListPendingHistoryExports(ctx context.Context, connectionID string, after HistoryExportCursor, limit int) ([]HistoryExport, error)
 	ListPendingHistoryExportsByHistoryIDs(ctx context.Context, connectionID string, historyIDs []string, limit int) ([]HistoryExport, error)
 	MarkHistoryExportStatus(ctx context.Context, id string, status string, lastError string) error
 	MarkHistoryExportSatisfiedByScrobble(ctx context.Context, connectionID string, historyID string) error
@@ -44,6 +44,7 @@ type Repository interface {
 	ListListItemStates(ctx context.Context, connectionID string, kind ListKind) ([]ListItemState, error)
 	ListPendingListItemExports(ctx context.Context, connectionID string, kind ListKind, limit int) ([]ListItemState, error)
 	ListPendingListItemRemovals(ctx context.Context, connectionID string, kind ListKind, limit int) ([]ListItemState, error)
+	ListListItemsWithSharedKeyHeld(ctx context.Context, connectionID string, kind ListKind, mediaItemIDs []string) (map[string]bool, error)
 	MarkListItemExported(ctx context.Context, connectionID string, kind ListKind, mediaItemID string, exportedAt time.Time) error
 	MarkListItemRemoteRemoved(ctx context.Context, connectionID string, kind ListKind, mediaItemID string, removedAt time.Time) error
 	MarkListItemLocalRemoved(ctx context.Context, connectionID string, kind ListKind, mediaItemID string, removedAt time.Time) error
@@ -112,6 +113,22 @@ const syncRunColumns = `
 	outbound_ratings_found, outbound_ratings_sent,
 	warning, error, started_at, completed_at, created_at`
 
+// listItemKeyHeldElsewhere is true when another library item of the same kind,
+// still on the local list, holds the provider key of the list row aliased item.
+// Removing that key from the provider would take the other item off too.
+const listItemKeyHeldElsewhere = `EXISTS (
+	SELECT 1 FROM watch_provider_list_items other
+	WHERE other.connection_id = item.connection_id
+	  AND other.list_kind = item.list_kind
+	  AND item.provider_item_key <> ''
+	  AND other.provider_item_key <> ''
+	  AND other.provider_item_key = item.provider_item_key
+	  AND other.kind = item.kind
+	  AND other.media_item_id <> item.media_item_id
+	  AND other.local_present = true
+	  AND EXISTS (SELECT 1 FROM media_items m WHERE m.content_id = other.media_item_id)
+)`
+
 // listItemStateColumns is the canonical select column list for
 // watch_provider_list_items, in the exact order scanListItemStates reads.
 const listItemStateColumns = `
@@ -1308,9 +1325,18 @@ func (r *PostgresRepository) UpsertHistoryExports(ctx context.Context, exports [
 	return nil
 }
 
-func (r *PostgresRepository) ListPendingHistoryExports(ctx context.Context, connectionID string, limit int) ([]HistoryExport, error) {
-	if limit <= 0 || limit > 100 {
-		limit = 100
+func (r *PostgresRepository) ListPendingHistoryExports(
+	ctx context.Context,
+	connectionID string,
+	after HistoryExportCursor,
+	limit int,
+) ([]HistoryExport, error) {
+	if limit <= 0 || limit > maxHistoryExportPage {
+		limit = maxHistoryExportPage
+	}
+	var afterID any
+	if after.ID != "" {
+		afterID = after.ID
 	}
 	rows, err := r.pool.Query(ctx, `
 		SELECT id::text, connection_id::text, history_id, media_item_id, watched_at,
@@ -1319,9 +1345,12 @@ func (r *PostgresRepository) ListPendingHistoryExports(ctx context.Context, conn
 		WHERE connection_id = $1::uuid
 		  AND status IN ('pending', 'failed')
 		  AND attempt_count < 5
-		ORDER BY watched_at ASC
+		  AND ($3::uuid IS NULL OR (watched_at, id) > ($4::timestamptz, $3::uuid))
+		-- Qualified: a bare "id" would sort by the id::text output column,
+		-- not the uuid the cursor compares.
+		ORDER BY watched_at ASC, watch_provider_history_exports.id ASC
 		LIMIT $2
-	`, connectionID, limit)
+	`, connectionID, limit, afterID, after.WatchedAt)
 	if err != nil {
 		return nil, fmt.Errorf("list pending history exports: %w", err)
 	}
@@ -1521,12 +1550,13 @@ func (r *PostgresRepository) ListPendingListItemRemovals(ctx context.Context, co
 	}
 	rows, err := r.pool.Query(ctx, `
 		SELECT `+listItemStateColumns+`
-		FROM watch_provider_list_items
+		FROM watch_provider_list_items item
 		WHERE connection_id = $1::uuid
 		  AND list_kind = $2
 		  AND local_present = false
 		  AND remote_present = true
 		  AND last_error = ''
+		  AND NOT `+listItemKeyHeldElsewhere+`
 		ORDER BY last_removed_local_at ASC NULLS LAST, updated_at ASC
 		LIMIT $3
 	`, connectionID, string(kind), limit)
@@ -1537,6 +1567,39 @@ func (r *PostgresRepository) ListPendingListItemRemovals(ctx context.Context, co
 	return scanListItemStates(rows)
 }
 
+// ListListItemsWithSharedKeyHeld reports which of the media items' rows share
+// their provider key with another library item of the same kind still on the
+// local list.
+func (r *PostgresRepository) ListListItemsWithSharedKeyHeld(ctx context.Context, connectionID string, kind ListKind, mediaItemIDs []string) (map[string]bool, error) {
+	held := make(map[string]bool)
+	if len(mediaItemIDs) == 0 {
+		return held, nil
+	}
+	rows, err := r.pool.Query(ctx, `
+		SELECT item.media_item_id
+		FROM watch_provider_list_items item
+		WHERE item.connection_id = $1::uuid
+		  AND item.list_kind = $2
+		  AND item.media_item_id = ANY($3)
+		  AND `+listItemKeyHeldElsewhere+`
+	`, connectionID, string(kind), mediaItemIDs)
+	if err != nil {
+		return nil, fmt.Errorf("list list items with shared key held: %w", err)
+	}
+	defer rows.Close()
+	for rows.Next() {
+		var id string
+		if err := rows.Scan(&id); err != nil {
+			return nil, fmt.Errorf("scan list item with shared key held: %w", err)
+		}
+		held[id] = true
+	}
+	if err := rows.Err(); err != nil {
+		return nil, fmt.Errorf("iterate list items with shared key held: %w", err)
+	}
+	return held, nil
+}
+
 func (r *PostgresRepository) MarkListItemExported(ctx context.Context, connectionID string, kind ListKind, mediaItemID string, exportedAt time.Time) error {
 	return r.updateListItemState(ctx, connectionID, kind, mediaItemID, `
 		remote_present = true,
@@ -2086,13 +2149,7 @@ func cloneStringMap(values map[string]string) map[string]string {
 	return result
 }
 
-type listItemStateRows interface {
-	Next() bool
-	Scan(dest ...any) error
-	Err() error
-}
-
-func scanListItemStates(rows listItemStateRows) ([]ListItemState, error) {
+func scanListItemStates(rows pgx.Rows) ([]ListItemState, error) {
 	var states []ListItemState
 	for rows.Next() {
 		var state ListItemState
diff --git a/internal/watchsync/service.go b/internal/watchsync/service.go
index 5266f6f6df..8c7452f8f1 100644
--- a/internal/watchsync/service.go
+++ b/internal/watchsync/service.go
@@ -23,7 +23,7 @@ type Service struct {
 	watchState     watchStateImporter
 	storeProvider  userstore.UserStoreProvider
 	ratings        ratingStore
-	ratingStaler   ratingProfileStaler
+	signals        SignalsChangedNotifier
 	dropped        droppedStore
 	locks          sync.Map
 	scrobbleQueues sync.Map
@@ -52,7 +52,18 @@ type watchStateImporter interface {
 	RecordImportedWatchIfNewerWithSource(ctx context.Context, userID int, profileID, targetID string, duration, position float64, completed bool, updatedAt time.Time, watchedAt *time.Time, source userstore.WatchHistorySource) (bool, error)
 }
 
+// SignalsChangedNotifier records that a profile's recommendation signals
+// changed, so its taste profile and cached recommendations get rebuilt.
+// *recommendations.Worker implements it.
+type SignalsChangedNotifier interface {
+	NotifySignalsChanged(ctx context.Context, userID int, profileID string)
+}
+
 const (
+	// signalsNotifyTimeout bounds reporting a sync run's signal changes,
+	// which happens after the run's own context may have ended.
+	signalsNotifyTimeout = 10 * time.Second
+
 	manualSyncCooldown = time.Hour
 	manualSyncTimeout  = 10 * time.Minute
 	// A completed stop may require a cold metadata lookup in a provider plugin.
@@ -99,6 +110,15 @@ func (s *Service) WithDefaultWatchState(provider userstore.UserStoreProvider) *S
 	return s.WithUserStoreProvider(provider).WithWatchState(watchstate.NewService(provider))
 }
 
+// WithSignalsChangedNotifier installs where a sync run reports that its
+// imports changed the profile's recommendation signals.
+func (s *Service) WithSignalsChangedNotifier(notifier SignalsChangedNotifier) *Service {
+	if s != nil {
+		s.signals = notifier
+	}
+	return s
+}
+
 func (s *Service) ListProviders() []ProviderSummary {
 	return s.registry.List()
 }
@@ -782,6 +802,14 @@ func (s *Service) tryLock(connectionID string) (func(), bool) {
 }
 
 func (s *Service) executeSyncRun(ctx context.Context, conn Connection, run SyncRun) (SyncRun, error) {
+	// Imports commit as they go, so a run that fails partway still reports
+	// the signal changes it made, once, when it ends.
+	signalsChanged := false
+	defer func(userID int, profileID string) {
+		if signalsChanged {
+			s.notifySignalsChanged(ctx, userID, profileID)
+		}
+	}(conn.UserID, conn.ProfileID)
 	provider, ok := s.registry.Get(conn.Provider)
 	if !ok {
 		run.Status = string(SyncRunStatusFailed)
@@ -863,6 +891,7 @@ func (s *Service) executeSyncRun(ctx context.Context, conn Connection, run SyncR
 			result, err := s.ImportWatched(ctx, conn, cfg, importer)
 			run.InboundWatchedFound = result.Found
 			run.InboundWatchedImported = result.Imported
+			signalsChanged = signalsChanged || result.Imported > 0
 			run.Warning = appendWarning(run.Warning, result.Warnings)
 			if err != nil {
 				recordFlowError("watched import", err)
@@ -881,6 +910,7 @@ func (s *Service) executeSyncRun(ctx context.Context, conn Connection, run SyncR
 			result, err := s.ImportProgress(ctx, conn, cfg, importer)
 			run.InboundProgressFound = result.Found
 			run.InboundProgressImported = result.Imported
+			signalsChanged = signalsChanged || result.Imported > 0
 			run.Warning = appendWarning(run.Warning, result.Warnings)
 			if err != nil {
 				recordFlowError("progress import", err)
@@ -917,6 +947,7 @@ func (s *Service) executeSyncRun(ctx context.Context, conn Connection, run SyncR
 		if b.importEnabled(conn) && b.capImport(caps) {
 			result, err := s.importList(ctx, conn, cfg, provider, b)
 			b.setImportCounts(&run, result.Found, result.Imported)
+			signalsChanged = signalsChanged || result.changedLocalList()
 			run.Warning = appendWarning(run.Warning, result.Warnings)
 			if err != nil {
 				recordFlowError(string(b.kind)+" import", err)
@@ -951,6 +982,7 @@ func (s *Service) executeSyncRun(ctx context.Context, conn Connection, run SyncR
 		result, err := s.syncRatings(ctx, conn, cfg, provider)
 		run.InboundRatingsFound = result.RemoteFound
 		run.InboundRatingsImported = result.Imported
+		signalsChanged = signalsChanged || result.Imported > 0
 		run.OutboundRatingsFound = result.LocalFound
 		run.OutboundRatingsSent = result.Sent
 		run.Warning = appendWarning(run.Warning, result.Warnings)
@@ -981,6 +1013,17 @@ func (s *Service) executeSyncRun(ctx context.Context, conn Connection, run SyncR
 	return s.completeSyncRun(ctx, run)
 }
 
+// notifySignalsChanged reports that a sync run changed the profile's
+// recommendation signals.
+func (s *Service) notifySignalsChanged(ctx context.Context, userID int, profileID string) {
+	if s.signals == nil {
+		return
+	}
+	notifyCtx, cancel := context.WithTimeout(context.WithoutCancel(ctx), signalsNotifyTimeout)
+	defer cancel()
+	s.signals.NotifySignalsChanged(notifyCtx, userID, profileID)
+}
+
 // deferRateLimitedConnection records when the provider's rate limit is
 // expected to clear so scheduled syncs skip the connection until then. The
 // provider limit applies to the API key/account rather than the Silo profile,
@@ -1405,6 +1448,43 @@ func listAllCompletedHistory(ctx context.Context, store completedHistoryLister,
 	}
 }
 
+// nearRunDeadline reports whether ctx's deadline is within exportDrainReserve.
+func (s *Service) nearRunDeadline(ctx context.Context) bool {
+	deadline, ok := ctx.Deadline()
+	return ok && deadline.Sub(s.now()) < exportDrainReserve
+}
+
+// visiblePlays keeps the plays whose history entries are still visible.
+func visiblePlays(ctx context.Context, store completedHistoryLister, query userstore.CompletedHistoryQuery, plays []LocalPlay) ([]LocalPlay, error) {
+	if len(plays) == 0 {
+		// An empty media filter would read the whole history.
+		return plays, nil
+	}
+	query.MediaItemIDs = make([]string, 0, len(plays))
+	seen := make(map[string]bool, len(plays))
+	for _, play := range plays {
+		if !seen[play.MediaItemID] {
+			seen[play.MediaItemID] = true
+			query.MediaItemIDs = append(query.MediaItemIDs, play.MediaItemID)
+		}
+	}
+	rows, err := listAllCompletedHistory(ctx, store, query)
+	if err != nil {
+		return nil, err
+	}
+	visible := make(map[string]bool, len(rows))
+	for _, row := range rows {
+		visible[row.ID] = true
+	}
+	kept := make([]LocalPlay, 0, len(plays))
+	for _, play := range plays {
+		if visible[play.HistoryID] {
+			kept = append(kept, play)
+		}
+	}
+	return kept, nil
+}
+
 func hasVisibleCompletedHistoryAtOrAfter(ctx context.Context, store completedHistoryLister, profileID, mediaItemID string, at time.Time) (bool, error) {
 	for offset := 0; ; offset += completedHistoryPageSize {
 		rows, err := store.ListCompletedHistory(ctx, userstore.CompletedHistoryQuery{
@@ -1433,46 +1513,16 @@ func hasVisibleCompletedHistoryAtOrAfter(ctx context.Context, store completedHis
 
 const tokenRefreshSkew = 5 * time.Minute
 
-// AccessToken returns a usable access token for a saved connection, refreshing
-// it first when it is about to expire. Callers outside watch sync, such as
-// Trakt recommendation collections, use it so their refreshes share the
-// serialized path in refreshConnectionIfNeeded.
-func (s *Service) AccessToken(ctx context.Context, connectionID string) (string, error) {
-	conn, ok, err := s.repo.GetConnectionByID(ctx, connectionID)
-	if err != nil {
-		return "", err
-	}
-	if !ok {
-		return "", ErrConnectionNotFound
-	}
-	provider, ok := s.registry.Get(conn.Provider)
-	if !ok {
-		return "", UnknownProviderError{Key: conn.Provider}
-	}
-	cfg, err := s.serverConfig(ctx, conn.Provider)
-	if err != nil {
-		return "", err
-	}
-	conn, err = s.refreshConnectionIfNeeded(ctx, provider, cfg, conn)
-	if err != nil {
-		return "", err
-	}
-	if strings.TrimSpace(conn.AccessToken) == "" {
-		return "", fmt.Errorf("%s connection is missing an access token; reconnect the provider", conn.Provider)
-	}
-	return conn.AccessToken, nil
-}
-
 func (s *Service) tokenNeedsRefresh(conn Connection) bool {
 	return conn.TokenExpiresAt != nil && !conn.TokenExpiresAt.After(s.now().Add(tokenRefreshSkew))
 }
 
 // refreshConnectionIfNeeded refreshes conn's tokens when they are about to
 // expire. Refreshes of one saved connection are serialized across the cluster
-// because refresh tokens can be single-use: Trakt spends one on each refresh,
-// so a second caller holding the same token would be refused. A caller that
-// waited on the lock continues from the stored tokens, which the previous
-// holder has usually just refreshed.
+// because refresh tokens can be single-use: a provider that spends one on each
+// refresh refuses a second caller holding the same token. A caller that waited
+// on the lock continues from the stored tokens, which the previous holder has
+// usually just refreshed.
 func (s *Service) refreshConnectionIfNeeded(ctx context.Context, provider Provider, cfg ServerConfig, conn Connection) (Connection, error) {
 	if !s.tokenNeedsRefresh(conn) {
 		return conn, nil
@@ -1596,10 +1646,12 @@ func (s *Service) ExportWatched(
 	}
 	result := ExportWatchedResult{RemoteFound: len(remote)}
 
-	historyRows, err := listAllCompletedHistory(ctx, store, userstore.CompletedHistoryQuery{
+	historyQuery := userstore.CompletedHistoryQuery{
 		ProfileID:      conn.ProfileID,
 		ExcludeSources: []userstore.WatchHistorySource{historySourceForProvider(exporter)},
-	})
+	}
+	historyReadAt := s.now()
+	historyRows, err := listAllCompletedHistory(ctx, store, historyQuery)
 	if err != nil {
 		return result, err
 	}
@@ -1630,19 +1682,43 @@ func (s *Service) ExportWatched(
 	for _, play := range local {
 		localByHistoryID[play.HistoryID] = play
 	}
+	// Drain the whole backlog in one run, one provider batch per call. The
+	// cursor moves past every export a call tried, so a failed export waits
+	// for the next sync instead of being retried in this one. A rate limit
+	// ends the run and defers the connection until the provider's window
+	// resets. A run with a deadline stops starting calls near it and leaves
+	// the rest for the next sync.
+	pageSize := min(watchedExportBatchSize(exporter, 100), maxHistoryExportPage)
+	var cursor HistoryExportCursor
+	calledProvider := false
 	for {
-		pending, err := s.repo.ListPendingHistoryExports(ctx, conn.ID, 100)
+		if err := ctx.Err(); err != nil {
+			return result, err
+		}
+		// Checked on every page, including pages that end up with nothing to
+		// send, once at least one batch has gone out.
+		if calledProvider && s.nearRunDeadline(ctx) {
+			break
+		}
+		pending, err := s.repo.ListPendingHistoryExports(ctx, conn.ID, cursor, pageSize)
 		if err != nil {
 			return result, err
 		}
 		if len(pending) == 0 {
 			break
 		}
+		last := pending[len(pending)-1]
+		cursor = HistoryExportCursor{WatchedAt: last.WatchedAt, ID: last.ID}
 		pendingPlays := make([]LocalPlay, 0, len(pending))
 		exportByHistoryID := make(map[string]HistoryExport, len(pending))
 		progressed := false
 		for _, export := range pending {
 			play, ok := localByHistoryID[export.HistoryID]
+			if !ok && export.CreatedAt.After(historyReadAt.Add(-exportSnapshotSkew)) {
+				// A play watched after this run read local history: its
+				// export is not in the snapshot, so leave it for the next run.
+				continue
+			}
 			if !ok {
 				if err := s.repo.MarkHistoryExportStatus(ctx, export.ID, historyExportStatusNotFound, "local history entry not found"); err != nil {
 					return result, err
@@ -1653,12 +1729,19 @@ func (s *Service) ExportWatched(
 			pendingPlays = append(pendingPlays, play)
 			exportByHistoryID[export.HistoryID] = export
 		}
+		// Local history can change while the backlog drains. A play the user
+		// marked unwatched after the run read history must not go out as
+		// watched; its export waits for the next run, whose read retires it.
+		pendingPlays, err = visiblePlays(ctx, store, historyQuery, pendingPlays)
+		if err != nil {
+			return result, err
+		}
 		if len(pendingPlays) == 0 {
 			continue
 		}
-		pendingPlays, singleBatch := limitWatchedExportBatch(exporter, pendingPlays)
 		pendingPlays = s.withPlayTitles(ctx, pendingPlays)
 		exportResult, err := exporter.ExportHistory(ctx, cfg, conn, pendingPlays)
+		calledProvider = true
 		_, limited := AsRateLimited(err)
 		retryable := isRetryableProviderError(err)
 		if err != nil && isWatchSyncInvalidCredentialError(err) {
@@ -1716,7 +1799,12 @@ func (s *Service) ExportWatched(
 			// Leave unmentioned events pending for a later retry.
 			return result, err
 		}
-		if !progressed || singleBatch {
+		// A plugin call can rotate the connection's credentials. Read them
+		// back so later calls and the final save use the current ones.
+		if conn, err = s.reloadConnection(ctx, conn); err != nil {
+			return result, err
+		}
+		if !progressed {
 			break
 		}
 	}
@@ -1790,7 +1878,6 @@ func (s *Service) exportLocalPlays(
 	if len(pendingPlays) == 0 {
 		return nil
 	}
-	pendingPlays, _ = limitWatchedExportBatch(exporter, pendingPlays)
 	exportResult, err := exporter.ExportHistory(ctx, cfg, conn, pendingPlays)
 	_, limited := AsRateLimited(err)
 	retryable := isRetryableProviderError(err)
@@ -1861,20 +1948,8 @@ func (s *Service) persistConnectionError(ctx context.Context, conn Connection, m
 	return err
 }
 
-func limitWatchedExportBatch(exporter WatchedExporter, plays []LocalPlay) ([]LocalPlay, bool) {
-	_, ok := exporter.(singleBatchWatchedExporter)
-	if !ok {
-		return plays, false
-	}
-	limit := watchedExportBatchSize(exporter, len(plays))
-	if len(plays) > limit {
-		plays = plays[:limit]
-	}
-	return plays, true
-}
-
 func watchedExportBatchSize(exporter WatchedExporter, fallback int) int {
-	bounded, ok := exporter.(singleBatchWatchedExporter)
+	bounded, ok := exporter.(batchedWatchedExporter)
 	if !ok {
 		return max(1, fallback)
 	}
diff --git a/internal/watchsync/service_test.go b/internal/watchsync/service_test.go
index d312f9e520..2b3527c005 100644
--- a/internal/watchsync/service_test.go
+++ b/internal/watchsync/service_test.go
@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"reflect"
+	"slices"
 	"strconv"
 	"strings"
 	"sync"
@@ -50,6 +51,7 @@ type serviceFakeRepo struct {
 	historyExports         []HistoryExport
 	historyLookupIDs       []string
 	historyLookupLimit     int
+	historyPageSizes       []int
 	listItemStates         []ListItemState
 	ratingStates           []RatingSyncState
 	droppedStates          []DroppedSyncState
@@ -66,6 +68,7 @@ type serviceFakeRepo struct {
 	confirmedScrobbles     map[string]bool
 	confirmingScrobbles    map[string]time.Time
 	markSatisfiedErr       error
+	markLocalRemovedErr    error
 	markHistoryStatusErr   error
 	syncRunMu              sync.Mutex
 	scrobbleMu             sync.Mutex
@@ -195,6 +198,13 @@ func (r *serviceFakeRepo) DeferConnectionsForAccount(
 	return deferred, nil
 }
 
+// withConnection stores conn the way a connected profile's row exists before
+// a sync, and returns it.
+func (r *serviceFakeRepo) withConnection(conn Connection) Connection {
+	r.connections[connectionKey(conn.Provider, conn.UserID, conn.ProfileID)] = conn
+	return conn
+}
+
 func (r *serviceFakeRepo) GetConnectionByID(_ context.Context, id string) (Connection, bool, error) {
 	for _, conn := range r.connections {
 		if conn.ID == id {
@@ -372,17 +382,26 @@ func (r *serviceFakeRepo) UpsertHistoryExports(_ context.Context, exports []Hist
 	return nil
 }
 
-func (r *serviceFakeRepo) ListPendingHistoryExports(_ context.Context, connectionID string, limit int) ([]HistoryExport, error) {
+func (r *serviceFakeRepo) ListPendingHistoryExports(_ context.Context, connectionID string, after HistoryExportCursor, limit int) ([]HistoryExport, error) {
+	r.historyPageSizes = append(r.historyPageSizes, limit)
 	var exports []HistoryExport
 	for _, export := range r.historyExports {
 		if export.ConnectionID == connectionID &&
-			(export.Status == historyExportStatusPending || export.Status == historyExportStatusFailed) && export.AttemptCount < 5 {
+			(export.Status == historyExportStatusPending || export.Status == historyExportStatusFailed) && export.AttemptCount < 5 &&
+			(after.ID == "" || export.WatchedAt.After(after.WatchedAt) ||
+				(export.WatchedAt.Equal(after.WatchedAt) && export.ID > after.ID)) {
 			exports = append(exports, export)
-			if limit > 0 && len(exports) >= limit {
-				break
-			}
 		}
 	}
+	slices.SortStableFunc(exports, func(a, b HistoryExport) int {
+		if c := a.WatchedAt.Compare(b.WatchedAt); c != 0 {
+			return c
+		}
+		return strings.Compare(a.ID, b.ID)
+	})
+	if limit > 0 && len(exports) > limit {
+		exports = exports[:limit]
+	}
 	return exports, nil
 }
 
@@ -495,7 +514,8 @@ func (r *serviceFakeRepo) ListPendingListItemExports(_ context.Context, connecti
 func (r *serviceFakeRepo) ListPendingListItemRemovals(_ context.Context, connectionID string, kind ListKind, limit int) ([]ListItemState, error) {
 	var states []ListItemState
 	for _, state := range r.listItemStates {
-		if state.ConnectionID == connectionID && state.ListKind == kind && !state.LocalPresent && state.RemotePresent && state.LastError == "" {
+		if state.ConnectionID == connectionID && state.ListKind == kind && !state.LocalPresent && state.RemotePresent && state.LastError == "" &&
+			!r.listItemKeyHeldElsewhere(state) {
 			states = append(states, state)
 			if limit > 0 && len(states) >= limit {
 				break
@@ -505,6 +525,30 @@ func (r *serviceFakeRepo) ListPendingListItemRemovals(_ context.Context, connect
 	return states, nil
 }
 
+func (r *serviceFakeRepo) ListListItemsWithSharedKeyHeld(_ context.Context, connectionID string, kind ListKind, mediaItemIDs []string) (map[string]bool, error) {
+	held := make(map[string]bool)
+	for _, state := range r.listItemStates {
+		if state.ConnectionID == connectionID && state.ListKind == kind && slices.Contains(mediaItemIDs, state.MediaItemID) && r.listItemKeyHeldElsewhere(state) {
+			held[state.MediaItemID] = true
+		}
+	}
+	return held, nil
+}
+
+func (r *serviceFakeRepo) listItemKeyHeldElsewhere(state ListItemState) bool {
+	if state.ProviderItemKey == "" {
+		return false
+	}
+	for _, other := range r.listItemStates {
+		if other.ConnectionID == state.ConnectionID && other.ListKind == state.ListKind &&
+			other.ProviderItemKey == state.ProviderItemKey && other.Kind == state.Kind &&
+			other.MediaItemID != state.MediaItemID && other.LocalPresent {
+			return true
+		}
+	}
+	return false
+}
+
 func (r *serviceFakeRepo) markListItem(connectionID string, kind ListKind, mediaItemID string, apply func(*ListItemState)) {
 	for i := range r.listItemStates {
 		if r.listItemStates[i].ConnectionID == connectionID && r.listItemStates[i].ListKind == kind && r.listItemStates[i].MediaItemID == mediaItemID {
@@ -534,6 +578,9 @@ func (r *serviceFakeRepo) MarkListItemRemoteRemoved(_ context.Context, connectio
 }
 
 func (r *serviceFakeRepo) MarkListItemLocalRemoved(_ context.Context, connectionID string, kind ListKind, mediaItemID string, removedAt time.Time) error {
+	if r.markLocalRemovedErr != nil {
+		return r.markLocalRemovedErr
+	}
 	r.markListItem(connectionID, kind, mediaItemID, func(s *ListItemState) {
 		s.LocalPresent = false
 		s.LastRemovedLocalAt = &removedAt
@@ -814,7 +861,7 @@ func (r *serviceFakeRepo) CompleteConfirmedScrobbleStop(_ context.Context, playb
 	r.scrobbleMu.Lock()
 	defer r.scrobbleMu.Unlock()
 	key := playbackSessionID + "|" + connectionID
-	if r.confirmingScrobbles[key] != claimVersion {
+	if !r.confirmingScrobbles[key].Equal(claimVersion) {
 		return errConfirmedStopClaimLost
 	}
 	delete(r.confirmingScrobbles, key)
@@ -839,7 +886,7 @@ func (r *serviceFakeRepo) FailConfirmedScrobbleStop(_ context.Context, playbackS
 	r.scrobbleMu.Lock()
 	defer r.scrobbleMu.Unlock()
 	key := playbackSessionID + "|" + connectionID
-	if r.confirmingScrobbles[key] != claimVersion {
+	if !r.confirmingScrobbles[key].Equal(claimVersion) {
 		return errConfirmedStopClaimLost
 	}
 	delete(r.confirmingScrobbles, key)
@@ -1099,12 +1146,12 @@ type watchedExporterStub struct {
 	source       userstore.WatchHistorySource
 }
 
-type singleBatchWatchedExporterStub struct {
+type batchedWatchedExporterStub struct {
 	watchedExporterStub
 	batchSize int
 }
 
-func (p singleBatchWatchedExporterStub) ExportBatchSize() int {
+func (p batchedWatchedExporterStub) ExportBatchSize() int {
 	return p.batchSize
 }
 
@@ -1911,6 +1958,32 @@ func TestServiceSyncConnectionRefreshesExpiredToken(t *testing.T) {
 	}
 }
 
+// refreshedAccessToken returns a saved connection's access token through the
+// serialized refresh path, so tests can drive refreshConnectionIfNeeded the
+// way a sync does.
+func refreshedAccessToken(ctx context.Context, s *Service, connectionID string) (string, error) {
+	conn, ok, err := s.repo.GetConnectionByID(ctx, connectionID)
+	if err != nil {
+		return "", err
+	}
+	if !ok {
+		return "", ErrConnectionNotFound
+	}
+	provider, ok := s.registry.Get(conn.Provider)
+	if !ok {
+		return "", UnknownProviderError{Key: conn.Provider}
+	}
+	cfg, err := s.serverConfig(ctx, conn.Provider)
+	if err != nil {
+		return "", err
+	}
+	conn, err = s.refreshConnectionIfNeeded(ctx, provider, cfg, conn)
+	if err != nil {
+		return "", err
+	}
+	return conn.AccessToken, nil
+}
+
 func TestServiceTokenRefreshPreservesConcurrentConnectionChanges(t *testing.T) {
 	for _, change := range []string{"disconnect", "reconnect", "account switch", "sync state"} {
 		t.Run(change, func(t *testing.T) {
@@ -1952,7 +2025,7 @@ func TestServiceTokenRefreshPreservesConcurrentConnectionChanges(t *testing.T) {
 				repo.connections[key] = current
 				return nil
 			}
-			_, err := service.AccessToken(t.Context(), conn.ID)
+			_, err := refreshedAccessToken(t.Context(), service, conn.ID)
 			current, exists := repo.connections[key]
 			switch change {
 			case "disconnect":
@@ -2005,7 +2078,7 @@ func TestServiceTokenRefreshReloadsAccountBinding(t *testing.T) {
 	}
 	service := NewService(repo, registry)
 	service.now = func() time.Time { return now }
-	if _, err := service.AccessToken(t.Context(), conn.ID); err != nil {
+	if _, err := refreshedAccessToken(t.Context(), service, conn.ID); err != nil {
 		t.Fatal(err)
 	}
 }
@@ -2042,7 +2115,7 @@ func TestServiceDisconnectWaitsForAnInFlightTokenRefresh(t *testing.T) {
 
 	refreshDone := make(chan error, 1)
 	go func() {
-		_, err := service.AccessToken(ctx, "conn-1")
+		_, err := refreshedAccessToken(ctx, service, "conn-1")
 		refreshDone <- err
 	}()
 	<-entered
@@ -2510,12 +2583,12 @@ func TestServiceExportWatchedDrainsPendingBatches(t *testing.T) {
 	service := NewService(repo, NewRegistry()).WithUserStoreProvider(staticStoreProvider{
 		store: userdb.NewSQLiteUserStore(db),
 	})
-	result, err := service.ExportWatched(context.Background(), Connection{
+	result, err := service.ExportWatched(context.Background(), repo.withConnection(Connection{
 		ID:        "conn-1",
 		Provider:  "simkl",
 		UserID:    7,
 		ProfileID: "profile-1",
-	}, ServerConfig{}, watchedImportExportStub{key: "simkl", source: userstore.WatchHistorySourceSimkl})
+	}), ServerConfig{}, watchedImportExportStub{key: "simkl", source: userstore.WatchHistorySourceSimkl})
 	if err != nil {
 		t.Fatalf("ExportWatched: %v", err)
 	}
@@ -2581,12 +2654,12 @@ func TestServiceExportWatchedMatchesRemotePlaysAtProviderPrecision(t *testing.T)
 			service := NewService(repo, NewRegistry()).WithUserStoreProvider(staticStoreProvider{
 				store: userdb.NewSQLiteUserStore(db),
 			})
-			result, err := service.ExportWatched(context.Background(), Connection{
+			result, err := service.ExportWatched(context.Background(), repo.withConnection(Connection{
 				ID:        "conn-1",
 				Provider:  "trakt",
 				UserID:    7,
 				ProfileID: "profile-1",
-			}, ServerConfig{}, provider)
+			}), ServerConfig{}, provider)
 			if err != nil {
 				t.Fatalf("ExportWatched: %v", err)
 			}
@@ -2887,7 +2960,7 @@ func TestServiceExportWatchedSendsCatalogTitles(t *testing.T) {
 	service := NewService(repo, NewRegistry()).WithUserStoreProvider(staticStoreProvider{store: userdb.NewSQLiteUserStore(db)})
 	var exported []LocalPlay
 	exporter := recordingWatchedExporter{watchedImportExportStub{key: "simkl", source: userstore.WatchHistorySourceSimkl}, &exported, nil}
-	if _, err := service.ExportWatched(context.Background(), Connection{ID: "conn-1", Provider: "simkl", UserID: 7, ProfileID: "profile-1"}, ServerConfig{}, exporter); err != nil {
+	if _, err := service.ExportWatched(context.Background(), repo.withConnection(Connection{ID: "conn-1", Provider: "simkl", UserID: 7, ProfileID: "profile-1"}), ServerConfig{}, exporter); err != nil {
 		t.Fatal(err)
 	}
 	if len(exported) != 1 || exported[0].Title != "17 Again" || exported[0].Year != 2009 {
@@ -3617,7 +3690,7 @@ func TestServiceExportWatchedKeepsDeadlineForProviderWhenTitlesStall(t *testing.
 	exporter := recordingWatchedExporter{watchedImportExportStub{key: "simkl", source: userstore.WatchHistorySourceSimkl}, &exported, &ctxErrs}
 	ctx, cancel := context.WithTimeout(context.Background(), 400*time.Millisecond)
 	defer cancel()
-	if _, err := service.ExportWatched(ctx, Connection{ID: "conn-1", Provider: "simkl", UserID: 7, ProfileID: "profile-1"}, ServerConfig{}, exporter); err != nil {
+	if _, err := service.ExportWatched(ctx, repo.withConnection(Connection{ID: "conn-1", Provider: "simkl", UserID: 7, ProfileID: "profile-1"}), ServerConfig{}, exporter); err != nil {
 		t.Fatal(err)
 	}
 	if len(ctxErrs) != 1 || ctxErrs[0] != nil || len(exported) != 1 || exported[0].Title != "" {
@@ -4101,7 +4174,7 @@ func TestServiceLocalWatchEventBoundsHistoryLookupToProviderBatch(t *testing.T)
 		context.Background(),
 		Connection{ID: "conn-1"},
 		ServerConfig{},
-		singleBatchWatchedExporterStub{
+		batchedWatchedExporterStub{
 			watchedExporterStub: watchedExporterStub{exported: &exported},
 			batchSize:           1,
 		},
@@ -4379,6 +4452,49 @@ func (p favoriteBatchProviderStub) FetchFavoritesBatch(context.Context, ServerCo
 	return p.batch, nil
 }
 
+// A removal that changed the local list counts as a change even when the
+// shadow-state write after it fails, so recommendations still refresh.
+func TestServiceCountsAListRemovalWhoseBookkeepingFails(t *testing.T) {
+	db, err := sql.Open("sqlite3", ":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = db.Close() }()
+	if err := userdb.InitSchema(db); err != nil {
+		t.Fatal(err)
+	}
+	store := userdb.NewSQLiteUserStore(db)
+	ctx := context.Background()
+	if _, err := store.AddFavoriteAt(ctx, "profile-1", testMovieMediaID, time.Now().UTC()); err != nil {
+		t.Fatal(err)
+	}
+	repo := newServiceFakeRepo()
+	repo.markLocalRemovedErr = errors.New("shadow state unavailable")
+	conn := Connection{
+		ID: "conn-1", Provider: "plugin:4:list", UserID: 7, ProfileID: "profile-1",
+		ImportFavoritesEnabled: true, SyncFavoriteRemovalsEnabled: true,
+	}
+	repo.listItemStates = []ListItemState{{
+		ConnectionID: conn.ID, ListKind: ListKindFavorites, MediaItemID: testMovieMediaID,
+		ProviderItemKey: testMovieProviderItemKey, RemotePresent: true, LocalPresent: true,
+	}}
+	service := NewService(repo, NewRegistry()).
+		WithMatcher(matchedMatcherStub{mediaItemID: testMovieMediaID}).
+		WithUserStoreProvider(staticStoreProvider{store: store})
+	provider := favoriteBatchProviderStub{batch: FavoriteImportBatch{
+		Rows:           []RemoteFavorite{{ProviderItemKey: testMovieProviderItemKey, Removed: true}},
+		UpdatedCursors: map[string]string{pluginFavoritesCursorKey: "cursor-2"},
+		Incremental:    true,
+	}}
+	result, err := service.importList(ctx, conn, ServerConfig{}, provider, service.favoritesBinding())
+	if err == nil {
+		t.Fatal("importList succeeded with a failing shadow-state write")
+	}
+	if result.Removed != 1 || !result.changedLocalList() {
+		t.Fatalf("result = %#v, want the committed removal counted", result)
+	}
+}
+
 func TestServiceAppliesIncrementalFavoriteTombstone(t *testing.T) {
 	db, err := sql.Open("sqlite3", ":memory:")
 	if err != nil {
@@ -4414,7 +4530,7 @@ func TestServiceAppliesIncrementalFavoriteTombstone(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if result.Removed != 1 {
+	if result.Removed != 1 || !result.changedLocalList() {
 		t.Fatalf("result = %#v", result)
 	}
 	favorites, err := store.ListFavorites(ctx, conn.ProfileID, 10, 0)
@@ -4430,6 +4546,41 @@ func TestServiceAppliesIncrementalFavoriteTombstone(t *testing.T) {
 	}
 }
 
+// A list import changes the profile's signals only when it adds to the local
+// list: Imported also counts rows the list already held.
+func TestImportListChangesSignalsOnlyWhenItAddsLocally(t *testing.T) {
+	db, err := sql.Open("sqlite3", ":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = db.Close() }()
+	if err := userdb.InitSchema(db); err != nil {
+		t.Fatal(err)
+	}
+	store := userdb.NewSQLiteUserStore(db)
+	ctx := context.Background()
+	conn := Connection{ID: "conn-1", Provider: "plugin:4:list", UserID: 7, ProfileID: "profile-1", ImportFavoritesEnabled: true}
+	service := NewService(newServiceFakeRepo(), NewRegistry()).
+		WithMatcher(matchedMatcherStub{mediaItemID: testMovieMediaID}).
+		WithUserStoreProvider(staticStoreProvider{store: store})
+	provider := favoriteBatchProviderStub{batch: FavoriteImportBatch{Rows: []RemoteFavorite{{ProviderItemKey: testMovieProviderItemKey}}}}
+
+	result, err := service.importList(ctx, conn, ServerConfig{}, provider, service.favoritesBinding())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result.Imported != 1 || !result.changedLocalList() {
+		t.Fatalf("first import = %#v, want a local change", result)
+	}
+	result, err = service.importList(ctx, conn, ServerConfig{}, provider, service.favoritesBinding())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result.Imported != 1 || result.changedLocalList() {
+		t.Fatalf("repeat import = %#v, want no local change", result)
+	}
+}
+
 func TestServiceIncrementalFavoriteAbsenceIsNotRemoval(t *testing.T) {
 	db, err := sql.Open("sqlite3", ":memory:")
 	if err != nil {
@@ -4470,6 +4621,406 @@ func TestServiceIncrementalFavoriteAbsenceIsNotRemoval(t *testing.T) {
 	}
 }
 
+func TestServiceFavoriteTombstoneForSharedKey(t *testing.T) {
+	tests := []struct {
+		name          string
+		items         map[string]string // media item id -> kind
+		tombstoneKind string
+		wantRemoved   []string
+	}{
+		{
+			// Two library items for one title carry the same IMDb id.
+			name:        "copies of one title all leave",
+			items:       map[string]string{"movie:tmdb:550": "movie", "movie:imdb:tt0137523": "movie"},
+			wantRemoved: []string{"movie:imdb:tt0137523", "movie:tmdb:550"},
+		},
+		{
+			name:        "a row without a kind is a copy",
+			items:       map[string]string{"movie:tmdb:550": "movie", "movie:imdb:tt0137523": ""},
+			wantRemoved: []string{"movie:imdb:tt0137523", "movie:tmdb:550"},
+		},
+		{
+			// A movie and a series with the same TMDB id and no IMDb id are
+			// different titles; a key-only tombstone cannot say which left.
+			name:  "different titles stay",
+			items: map[string]string{"movie:tmdb:550": "movie", "series:tmdb:550": "series"},
+		},
+		{
+			name:          "a tombstone with a kind removes that title",
+			items:         map[string]string{"movie:tmdb:550": "movie", "series:tmdb:550": "series"},
+			tombstoneKind: "movie",
+			wantRemoved:   []string{"movie:tmdb:550"},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			db, err := sql.Open("sqlite3", ":memory:")
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer func() { _ = db.Close() }()
+			if err := userdb.InitSchema(db); err != nil {
+				t.Fatal(err)
+			}
+			store := userdb.NewSQLiteUserStore(db)
+			ctx := context.Background()
+			repo := newServiceFakeRepo()
+			conn := Connection{
+				ID: "conn-1", Provider: "plugin:4:list", UserID: 7, ProfileID: "profile-1",
+				ImportFavoritesEnabled: true, SyncFavoriteRemovalsEnabled: true,
+			}
+			for id, kind := range tt.items {
+				if _, err := store.AddFavoriteAt(ctx, conn.ProfileID, id, time.Now().UTC()); err != nil {
+					t.Fatal(err)
+				}
+				repo.listItemStates = append(repo.listItemStates, ListItemState{
+					ConnectionID: conn.ID, ListKind: ListKindFavorites, MediaItemID: id, Kind: kind,
+					ProviderItemKey: "shared-key", RemotePresent: true, LocalPresent: true,
+				})
+			}
+			service := NewService(repo, NewRegistry()).
+				WithMatcher(matchedMatcherStub{mediaItemID: testMovieMediaID}).
+				WithUserStoreProvider(staticStoreProvider{store: store})
+			provider := favoriteBatchProviderStub{batch: FavoriteImportBatch{
+				Rows:        []RemoteFavorite{{ProviderItemKey: "shared-key", Kind: tt.tombstoneKind, Removed: true}},
+				Incremental: true,
+			}}
+			result, err := service.importList(ctx, conn, ServerConfig{}, provider, service.favoritesBinding())
+			if err != nil {
+				t.Fatal(err)
+			}
+			favorites, err := store.ListFavorites(ctx, conn.ProfileID, 10, 0)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if result.Removed != len(tt.wantRemoved) || len(favorites) != len(tt.items)-len(tt.wantRemoved) {
+				t.Fatalf("result=%#v favorites=%#v", result, favorites)
+			}
+			var removed []string
+			for _, state := range repo.listItemStates {
+				switch {
+				case !state.RemotePresent && !state.LocalPresent:
+					removed = append(removed, state.MediaItemID)
+				case !state.RemotePresent || !state.LocalPresent:
+					t.Fatalf("state = %#v, want unchanged or removed on both sides", state)
+				}
+			}
+			slices.Sort(removed)
+			if !slices.Equal(removed, tt.wantRemoved) {
+				t.Fatalf("removed = %v, want %v", removed, tt.wantRemoved)
+			}
+		})
+	}
+}
+
+// The matcher finds no single item for an id two library items carry, but the
+// provider still lists it, so a complete import must not read either copy as
+// removed remotely.
+func TestServiceFullFavoriteImportKeepsAmbiguousKey(t *testing.T) {
+	db, err := sql.Open("sqlite3", ":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = db.Close() }()
+	if err := userdb.InitSchema(db); err != nil {
+		t.Fatal(err)
+	}
+	store := userdb.NewSQLiteUserStore(db)
+	ctx := context.Background()
+	repo := newServiceFakeRepo()
+	conn := Connection{
+		ID: "conn-1", Provider: "plugin:4:list", UserID: 7, ProfileID: "profile-1",
+		ImportFavoritesEnabled: true, SyncFavoriteRemovalsEnabled: true,
+	}
+	// Export stored both copies under the IMDb key; Trakt keys shows by TVDB id.
+	for _, id := range []string{"series:tvdb:81189", "series:imdb:tt0903747"} {
+		if _, err := store.AddFavoriteAt(ctx, conn.ProfileID, id, time.Now().UTC()); err != nil {
+			t.Fatal(err)
+		}
+		repo.listItemStates = append(repo.listItemStates, ListItemState{
+			ConnectionID: conn.ID, ListKind: ListKindFavorites, MediaItemID: id, Kind: "series",
+			ProviderItemKey: "imdb:tt0903747", RemotePresent: true, LocalPresent: true,
+		})
+	}
+	service := NewService(repo, NewRegistry()).
+		WithMatcher(unmatchedMatcherStub{reason: "ambiguous tvdb_id match"}).
+		WithUserStoreProvider(staticStoreProvider{store: store})
+	provider := favoriteBatchProviderStub{batch: FavoriteImportBatch{
+		Rows: []RemoteFavorite{{ProviderItemKey: "tvdb:81189", Kind: "series", IMDbID: "tt0903747", TVDBID: "81189"}},
+	}}
+	result, err := service.importList(ctx, conn, ServerConfig{}, provider, service.favoritesBinding())
+	if err != nil {
+		t.Fatal(err)
+	}
+	favorites, err := store.ListFavorites(ctx, conn.ProfileID, 10, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result.Removed != 0 || result.Unmatched != 1 || len(favorites) != 2 {
+		t.Fatalf("result=%#v favorites=%#v", result, favorites)
+	}
+	for _, state := range repo.listItemStates {
+		if !state.RemotePresent || !state.LocalPresent {
+			t.Fatalf("state = %#v, want unchanged", state)
+		}
+	}
+}
+
+// Unfavoriting one copy of a title while another copy holds the key leaves
+// the key on the provider. An import must not favorite that copy again from
+// the listing the removal is waiting on, but a newer listing is a new add.
+func TestServiceFavoriteImportAndPendingLocalRemoval(t *testing.T) {
+	removedAt := time.Date(2026, 10, 1, 12, 0, 0, 0, time.UTC)
+	tests := []struct {
+		name      string
+		listedAt  time.Time
+		guessed   bool
+		wantAdded bool
+	}{
+		{name: "listing older than the removal", listedAt: removedAt.Add(-24 * time.Hour)},
+		{name: "listing newer than the removal", listedAt: removedAt.Add(time.Hour), wantAdded: true},
+		// A provider that sends no listing time gets the import time.
+		{name: "undated listing", listedAt: removedAt.Add(time.Hour), guessed: true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			db, err := sql.Open("sqlite3", ":memory:")
+			if err != nil {
+				t.Fatal(err)
+			}
+			defer func() { _ = db.Close() }()
+			if err := userdb.InitSchema(db); err != nil {
+				t.Fatal(err)
+			}
+			store := userdb.NewSQLiteUserStore(db)
+			ctx := context.Background()
+			repo := newServiceFakeRepo()
+			conn := Connection{
+				ID: "conn-1", Provider: "plugin:4:list", UserID: 7, ProfileID: "profile-1",
+				ImportFavoritesEnabled: true, SyncFavoriteRemovalsEnabled: true,
+			}
+			if _, err := store.AddFavoriteAt(ctx, conn.ProfileID, "movie-b", time.Now().UTC()); err != nil {
+				t.Fatal(err)
+			}
+			repo.listItemStates = []ListItemState{
+				{
+					ConnectionID: conn.ID, ListKind: ListKindFavorites, MediaItemID: "movie-a", Kind: "movie",
+					ProviderItemKey: "imdb:tt0137523", RemotePresent: true, LastRemovedLocalAt: &removedAt,
+				},
+				{
+					ConnectionID: conn.ID, ListKind: ListKindFavorites, MediaItemID: "movie-b", Kind: "movie",
+					ProviderItemKey: "imdb:tt0137523", RemotePresent: true, LocalPresent: true,
+				},
+			}
+			// The provider's row carries a TMDB id only movie-a has, so it matches a.
+			service := NewService(repo, NewRegistry()).
+				WithMatcher(matchedMatcherStub{mediaItemID: "movie-a"}).
+				WithUserStoreProvider(staticStoreProvider{store: store})
+			provider := favoriteBatchProviderStub{batch: FavoriteImportBatch{
+				Rows: []RemoteFavorite{{
+					ProviderItemKey: "imdb:tt0137523", Kind: "movie", IMDbID: "tt0137523", TMDBID: "550",
+					FavoritedAt: tt.listedAt, FavoritedAtGuessed: tt.guessed,
+				}},
+			}}
+			result, err := service.importList(ctx, conn, ServerConfig{}, provider, service.favoritesBinding())
+			if err != nil {
+				t.Fatal(err)
+			}
+			favorites, err := store.ListFavorites(ctx, conn.ProfileID, 10, 0)
+			if err != nil {
+				t.Fatal(err)
+			}
+			wantFavorites := 1
+			if tt.wantAdded {
+				wantFavorites = 2
+			}
+			if result.Removed != 0 || len(favorites) != wantFavorites {
+				t.Fatalf("result=%#v favorites=%#v", result, favorites)
+			}
+			if a := repo.listItemStates[0]; a.LocalPresent != tt.wantAdded || !a.RemotePresent {
+				t.Fatalf("movie-a state = %#v, want local %v", a, tt.wantAdded)
+			}
+		})
+	}
+}
+
+// A complete read that lists only a movie does not keep a series with the
+// same TMDB id; a stored row without a kind is kept by any listing.
+func TestServiceFullFavoriteImportScopesPresenceByKind(t *testing.T) {
+	db, err := sql.Open("sqlite3", ":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = db.Close() }()
+	if err := userdb.InitSchema(db); err != nil {
+		t.Fatal(err)
+	}
+	store := userdb.NewSQLiteUserStore(db)
+	ctx := context.Background()
+	repo := newServiceFakeRepo()
+	conn := Connection{
+		ID: "conn-1", Provider: "plugin:4:list", UserID: 7, ProfileID: "profile-1",
+		ImportFavoritesEnabled: true, SyncFavoriteRemovalsEnabled: true,
+	}
+	for id, kind := range map[string]string{"series:tmdb:550": "series", "unknown:tmdb:550": ""} {
+		if _, err := store.AddFavoriteAt(ctx, conn.ProfileID, id, time.Now().UTC()); err != nil {
+			t.Fatal(err)
+		}
+		repo.listItemStates = append(repo.listItemStates, ListItemState{
+			ConnectionID: conn.ID, ListKind: ListKindFavorites, MediaItemID: id, Kind: kind,
+			ProviderItemKey: "tmdb:550", RemotePresent: true, LocalPresent: true,
+		})
+	}
+	// The movie is not in the library, so it matches nothing.
+	service := NewService(repo, NewRegistry()).
+		WithMatcher(unmatchedMatcherStub{reason: "no tmdb_id match"}).
+		WithUserStoreProvider(staticStoreProvider{store: store})
+	provider := favoriteBatchProviderStub{batch: FavoriteImportBatch{
+		Rows: []RemoteFavorite{{ProviderItemKey: "tmdb:550", Kind: "movie", TMDBID: "550"}},
+	}}
+	result, err := service.importList(ctx, conn, ServerConfig{}, provider, service.favoritesBinding())
+	if err != nil {
+		t.Fatal(err)
+	}
+	favorites, err := store.ListFavorites(ctx, conn.ProfileID, 10, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result.Removed != 1 || len(favorites) != 1 || favorites[0].MediaItemID != "unknown:tmdb:550" {
+		t.Fatalf("result=%#v favorites=%#v", result, favorites)
+	}
+}
+
+// A pending local removal waits on the provider's listing. When an incremental
+// read removes that listing and then lists the item again, the second row is a
+// new add, even without a listing time.
+func TestServiceIncrementalFavoriteRemoveThenAddReplacesPendingRemoval(t *testing.T) {
+	db, err := sql.Open("sqlite3", ":memory:")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = db.Close() }()
+	if err := userdb.InitSchema(db); err != nil {
+		t.Fatal(err)
+	}
+	store := userdb.NewSQLiteUserStore(db)
+	ctx := context.Background()
+	repo := newServiceFakeRepo()
+	conn := Connection{
+		ID: "conn-1", Provider: "plugin:4:list", UserID: 7, ProfileID: "profile-1",
+		ImportFavoritesEnabled: true, SyncFavoriteRemovalsEnabled: true,
+	}
+	removedAt := time.Date(2026, 10, 1, 12, 0, 0, 0, time.UTC)
+	repo.listItemStates = []ListItemState{{
+		ConnectionID: conn.ID, ListKind: ListKindFavorites, MediaItemID: testMovieMediaID, Kind: "movie",
+		ProviderItemKey: testMovieProviderItemKey, RemotePresent: true, LastRemovedLocalAt: &removedAt,
+	}}
+	service := NewService(repo, NewRegistry()).
+		WithMatcher(matchedMatcherStub{mediaItemID: testMovieMediaID}).
+		WithUserStoreProvider(staticStoreProvider{store: store})
+	provider := favoriteBatchProviderStub{batch: FavoriteImportBatch{
+		Rows: []RemoteFavorite{
+			{ProviderItemKey: testMovieProviderItemKey, Removed: true},
+			{ProviderItemKey: testMovieProviderItemKey, Kind: "movie", IMDbID: "tt0133093", FavoritedAt: time.Now().UTC(), FavoritedAtGuessed: true},
+		},
+		Incremental: true,
+	}}
+	result, err := service.importList(ctx, conn, ServerConfig{}, provider, service.favoritesBinding())
+	if err != nil {
+		t.Fatal(err)
+	}
+	favorites, err := store.ListFavorites(ctx, conn.ProfileID, 10, 0)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if result.Imported != 1 || len(favorites) != 1 {
+		t.Fatalf("result=%#v favorites=%#v", result, favorites)
+	}
+	if state := repo.listItemStates[0]; !state.LocalPresent || !state.RemotePresent {
+		t.Fatalf("state = %#v, want listed on both sides", state)
+	}
+}
+
+type favoriteRemoverStub struct {
+	removed [][]string
+}
+
+func (*favoriteRemoverStub) Key() string         { return "plugin:4:list" }
+func (*favoriteRemoverStub) DisplayName() string { return "List" }
+func (*favoriteRemoverStub) AuthMethod() string  { return AuthMethodAPIKey }
+func (*favoriteRemoverStub) Capabilities() Capabilities {
+	return Capabilities{RemoveFavorites: true}
+}
+func (p *favoriteRemoverStub) RemoveFavorites(_ context.Context, _ ServerConfig, _ Connection, favorites []LocalFavorite) (ExportResult, error) {
+	ids := make([]string, 0, len(favorites))
+	for _, favorite := range favorites {
+		ids = append(ids, favorite.MediaItemID)
+	}
+	p.removed = append(p.removed, ids)
+	return ExportResult{Sent: ids}, nil
+}
+
+func TestServiceKeepsSharedKeyOnProviderWhileAnotherFavoriteHoldsIt(t *testing.T) {
+	ctx := context.Background()
+	repo := newServiceFakeRepo()
+	conn := Connection{
+		ID: "conn-1", Provider: "plugin:4:list", UserID: 7, ProfileID: "profile-1",
+		ExportFavoritesEnabled: true, SyncFavoriteRemovalsEnabled: true,
+	}
+	repo.connections[connectionKey(conn.Provider, conn.UserID, conn.ProfileID)] = conn
+	repo.listItemStates = []ListItemState{
+		{ConnectionID: conn.ID, ListKind: ListKindFavorites, MediaItemID: "movie-a", Kind: "movie", ProviderItemKey: "imdb:tt0137523", RemotePresent: true, LocalPresent: true},
+		{ConnectionID: conn.ID, ListKind: ListKindFavorites, MediaItemID: "movie-b", Kind: "movie", ProviderItemKey: "imdb:tt0137523", RemotePresent: true, LocalPresent: true},
+	}
+	provider := &favoriteRemoverStub{}
+	reg := NewRegistry()
+	if err := reg.Register(provider); err != nil {
+		t.Fatal(err)
+	}
+	service := NewService(repo, reg)
+
+	// Unfavoriting one of two items with the same key leaves the key on the
+	// provider's list, from the realtime event and from the scheduled pass.
+	err := service.processLocalListEvent(ctx, LocalListEvent{
+		List: ListKindFavorites, Change: ListChangeRemoved, UserID: conn.UserID, ProfileID: conn.ProfileID,
+		Items: []LocalFavorite{{MediaItemID: "movie-a", Kind: "movie", IMDbID: "tt0137523"}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	removed, err := service.removePendingListItems(ctx, conn, ServerConfig{}, provider, service.favoritesBinding())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if removed != 0 || len(provider.removed) != 0 {
+		t.Fatalf("removed=%d provider calls=%v, want none while movie-b holds the key", removed, provider.removed)
+	}
+	if state := repo.listItemStates[0]; state.LocalPresent || !state.RemotePresent {
+		t.Fatalf("movie-a state = %#v, want pending removal", state)
+	}
+
+	// Once the last item holding the key leaves the list, the key goes.
+	err = service.processLocalListEvent(ctx, LocalListEvent{
+		List: ListKindFavorites, Change: ListChangeRemoved, UserID: conn.UserID, ProfileID: conn.ProfileID,
+		Items: []LocalFavorite{{MediaItemID: "movie-b", Kind: "movie", IMDbID: "tt0137523"}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	removed, err = service.removePendingListItems(ctx, conn, ServerConfig{}, provider, service.favoritesBinding())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if want := [][]string{{"movie-b"}, {"movie-a"}}; !reflect.DeepEqual(provider.removed, want) || removed != 1 {
+		t.Fatalf("removed=%d provider calls=%v, want %v", removed, provider.removed, want)
+	}
+	for _, state := range repo.listItemStates {
+		if state.RemotePresent || state.LocalPresent {
+			t.Fatalf("state = %#v, want removed on both sides", state)
+		}
+	}
+}
+
 func (r *serviceFakeRepo) UpdateConnectionSettings(ctx context.Context, provider string, userID int, profileID string, expected *ConnectionVersion, update ConnectionUpdate, before func(Connection) error) (Connection, error) {
 	current, ok, err := r.GetConnection(ctx, provider, userID, profileID)
 	if err != nil {
diff --git a/internal/watchsync/types.go b/internal/watchsync/types.go
index bc39ef0f3b..dc5de590b4 100644
--- a/internal/watchsync/types.go
+++ b/internal/watchsync/types.go
@@ -129,9 +129,10 @@ type WatchedExporter interface {
 	ExportHistory(ctx context.Context, cfg ServerConfig, conn Connection, plays []LocalPlay) (ExportResult, error)
 }
 
-// singleBatchWatchedExporter bounds one synchronization run to one provider
-// batch. This is used for plugin RPCs with independent per-call deadlines.
-type singleBatchWatchedExporter interface {
+// batchedWatchedExporter caps how many plays one ExportHistory call takes.
+// Plugin providers declare it, since each call is one RPC with its own
+// deadline.
+type batchedWatchedExporter interface {
 	ExportBatchSize() int
 }
 
@@ -515,6 +516,9 @@ type RemoteFavorite struct {
 	SeasonNumber  int
 	EpisodeNumber int
 	FavoritedAt   time.Time
+	// FavoritedAtGuessed marks a FavoritedAt the provider did not send, which
+	// the host filled in with the import time.
+	FavoritedAtGuessed bool
 }
 
 type RemotePlay struct {
diff --git a/internal/watchtogether/buffering_policy_test.go b/internal/watchtogether/buffering_policy_test.go
index 5d8f194b58..b11c79487d 100644
--- a/internal/watchtogether/buffering_policy_test.go
+++ b/internal/watchtogether/buffering_policy_test.go
@@ -67,6 +67,22 @@ func (f *bufferingRoom) expected() float64 {
 	return expectedPosition(f.repo.room, f.now)
 }
 
+// expectedAt is the room's position when command executes, which is the
+// position every command carries.
+func (f *bufferingRoom) expectedAt(command TransportCommand) float64 {
+	f.t.Helper()
+	return expectedAtExecution(f.t, f.repo.room, command)
+}
+
+func expectedAtExecution(t *testing.T, room Room, command TransportCommand) float64 {
+	t.Helper()
+	executeAt, err := time.Parse(time.RFC3339Nano, command.ExecuteAt)
+	if err != nil {
+		t.Fatalf("command %s execute_at %q: %v", command.CommandID, command.ExecuteAt, err)
+	}
+	return expectedPosition(room, executeAt)
+}
+
 func (f *bufferingRoom) buffer(profileID string) Snapshot {
 	f.t.Helper()
 	snapshot, err := f.s.HandleBufferingForConnection(f.t.Context(), f.reg(profileID), f.userID(profileID), profileID, StateReport{
@@ -241,8 +257,8 @@ func TestRecoveryAfterDeadlineClearsBufferingAndTargetsTheRoom(t *testing.T) {
 				t.Fatal("recovered guest received no target")
 			}
 			command := lastTransport(t, f.conns["guest"])
-			if command.Action != TransportActionPlay || command.SessionID != "guest-session" || command.PositionSeconds != f.expected() {
-				t.Fatalf("recovery target = %+v, want play at %v", command, f.expected())
+			if command.Action != TransportActionPlay || command.SessionID != "guest-session" || command.PositionSeconds != f.expectedAt(command) {
+				t.Fatalf("recovery target = %+v, want play at %v", command, f.expectedAt(command))
 			}
 		})
 	}
@@ -262,7 +278,8 @@ func TestBufferingViewerIsNotCorrectedUntilTheHoldExpires(t *testing.T) {
 
 	f.now = f.now.Add(bufferingCorrectionHold)
 	f.report("guest", 100)
-	if command := lastTransport(t, f.conns["guest"]); command.PositionSeconds != f.expected() {
+	f.report("guest", 100)
+	if command := lastTransport(t, f.conns["guest"]); command.PositionSeconds != f.expectedAt(command) {
 		t.Fatalf("correction after the hold = %+v", command)
 	}
 }
@@ -286,12 +303,22 @@ func TestStalledHostDoesNotRewindTheRoom(t *testing.T) {
 	if !f.member("host").syncingToRoom {
 		t.Fatal("recovered host is not syncing to the room")
 	}
-	f.now = f.now.Add(time.Second)
+	sync := lastTransport(t, f.conns["host"])
+	if sync.PositionSeconds != f.expectedAt(sync) {
+		t.Fatalf("recovering host sync = %+v", sync)
+	}
+	// A report before the sync could have run is not corrected again.
+	f.report("host", 100.5)
+	if command := lastTransport(t, f.conns["host"]); command.CommandID != sync.CommandID {
+		t.Fatalf("report inside the settle window was corrected: %+v", command)
+	}
+	f.now = f.now.Add(3 * time.Second)
+	f.report("host", 100.5)
 	f.report("host", 100.5)
 	if f.repo.room.AnchorPositionSeconds != anchor {
 		t.Fatalf("recovering host moved the anchor to %v", f.repo.room.AnchorPositionSeconds)
 	}
-	if command := lastTransport(t, f.conns["host"]); command.PositionSeconds != f.expected() {
+	if command := lastTransport(t, f.conns["host"]); command.CommandID == sync.CommandID || command.PositionSeconds != f.expectedAt(command) {
 		t.Fatalf("recovering host correction = %+v", command)
 	}
 }
@@ -300,17 +327,33 @@ func TestHostDriftInsideTheCatchUpBandIsCorrected(t *testing.T) {
 	f := newBufferingRoom(t, "guest")
 	f.now = f.now.Add(10 * time.Second)
 	anchor := f.repo.room.AnchorPositionSeconds
-	f.report("host", f.expected()-1.8)
+	frames := len(f.conns["host"].payloads)
+
+	// Drift the client converges on by rate is neither followed nor corrected.
+	f.report("host", f.expected()-0.8)
+	f.report("host", f.expected()-0.8)
+	if f.repo.room.AnchorPositionSeconds != anchor || transportCount(f.conns["host"]) != transportCountIn(f.conns["host"].payloads[:frames]) {
+		t.Fatalf("host drift inside the nudge band moved the room or was corrected")
+	}
+
+	// Sustained larger drift is corrected on the host like a guest's.
+	f.report("host", f.expected()-6)
+	f.report("host", f.expected()-6)
 	if f.repo.room.AnchorPositionSeconds != anchor {
 		t.Fatalf("host drift inside the band moved the anchor to %v", f.repo.room.AnchorPositionSeconds)
 	}
-	if command := lastTransport(t, f.conns["host"]); command.PositionSeconds != f.expected() {
+	if command := lastTransport(t, f.conns["host"]); command.PositionSeconds != f.expectedAt(command) {
 		t.Fatalf("host drift correction = %+v", command)
 	}
 
-	f.report("host", f.expected()+30)
-	if f.repo.room.AnchorPositionSeconds != f.expected() {
-		t.Fatalf("host jump did not move the anchor: %v", f.repo.room.AnchorPositionSeconds)
+	// Only a jump beyond the host authority band is the host's decision.
+	f.now = f.now.Add(3 * time.Second)
+	jump := f.expected() + 30
+	f.report("host", jump)
+	command := lastTransport(t, f.conns["guest"])
+	if command.Action != TransportActionPlay || f.repo.room.AnchorPositionSeconds != f.expectedAt(command) ||
+		command.PositionSeconds != jump+defaultTransportLead.Seconds() {
+		t.Fatalf("host jump: anchor=%v command=%+v, want both at %v", f.repo.room.AnchorPositionSeconds, command, jump+defaultTransportLead.Seconds())
 	}
 }
 
@@ -480,8 +523,8 @@ func TestViewerLeftAloneRecoversFromTheirPosition(t *testing.T) {
 	if f.repo.room.AnchorPositionSeconds != 100 || f.repo.room.PlaybackState != RoomPlaybackStatePlaying {
 		t.Fatalf("recovery jumped the room: anchor=%v state=%s", f.repo.room.AnchorPositionSeconds, f.repo.room.PlaybackState)
 	}
-	if command := lastTransport(t, f.conns["host"]); command.Action != TransportActionPlay || command.PositionSeconds != 100 {
-		t.Fatalf("recovery target = %+v, want play at 100", command)
+	if command := lastTransport(t, f.conns["host"]); command.Action != TransportActionPlay || command.PositionSeconds != f.expectedAt(command) {
+		t.Fatalf("recovery target = %+v, want play at %v", command, f.expectedAt(command))
 	}
 }
 
diff --git a/internal/watchtogether/pause_buffering_test.go b/internal/watchtogether/pause_buffering_test.go
index 7ff1514595..5d6adeaa38 100644
--- a/internal/watchtogether/pause_buffering_test.go
+++ b/internal/watchtogether/pause_buffering_test.go
@@ -23,7 +23,9 @@ func TestPausedRoomIgnoresLateBuffering(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if snapshot.PlaybackState != RoomPlaybackStatePaused || snapshot.Generation != paused.Generation || snapshot.AnchorPositionSeconds != 120 || len(conn.payloads) != frames {
+	// The room played on until the pause executed, so it paused one lead later.
+	pausedAt := 120 + defaultTransportLead.Seconds()
+	if snapshot.PlaybackState != RoomPlaybackStatePaused || snapshot.Generation != paused.Generation || snapshot.AnchorPositionSeconds != pausedAt || len(conn.payloads) != frames {
 		t.Fatalf("late buffering reopened paused room: %+v", snapshot)
 	}
 }
diff --git a/internal/watchtogether/room_create_once_test.go b/internal/watchtogether/room_create_once_test.go
index 916f285ad1..7fcbd4a36c 100644
--- a/internal/watchtogether/room_create_once_test.go
+++ b/internal/watchtogether/room_create_once_test.go
@@ -56,7 +56,7 @@ func TestRoomCreationKeepsMembersAndCurrentReceipt(t *testing.T) {
 		t.Fatal("replay replaced members/readiness or dispatched")
 	}
 	for _, candidate := range repo.inputs {
-		if candidate.ID != base.ID || candidate.HostUserID != base.HostUserID || candidate.HostProfileID != base.HostProfileID || candidate.SelectionMode != input.SelectionMode || candidate.Code == "" || candidate.JoinToken == "" || candidate.Code == "retained" || candidate.Generation != 1 || candidate.CreatedAt != now {
+		if candidate.ID != base.ID || candidate.HostUserID != base.HostUserID || candidate.HostProfileID != base.HostProfileID || candidate.SelectionMode != input.SelectionMode || candidate.Code == "" || candidate.JoinToken == "" || candidate.Code == "retained" || candidate.Generation != 1 || !candidate.CreatedAt.Equal(now) {
 			t.Fatalf("candidate %+v", candidate)
 		}
 	}
diff --git a/internal/watchtogether/runtime.go b/internal/watchtogether/runtime.go
index d2a5970b5a..c1e202aeb3 100644
--- a/internal/watchtogether/runtime.go
+++ b/internal/watchtogether/runtime.go
@@ -29,6 +29,9 @@ type roomRuntime struct {
 	Command           *TransportCommand        `json:"command,omitempty"`
 	Members           map[string]runtimeMember `json:"members"`
 	BufferingWaitAt   time.Time                `json:"buffering_wait_at,omitzero"`
+	// PausedBeforePending is liveRoom.pausedBeforePending, so a node that
+	// adopts the room reads a pending command's requester state correctly.
+	PausedBeforePending bool `json:"paused_before_pending,omitempty"`
 }
 
 type runtimeMember struct {
@@ -207,7 +210,7 @@ func withRoomOperation[T any](ctx context.Context, s *Service, roomID string, fn
 func (s *Service) runtimeLocked(live *liveRoom) roomRuntime {
 	runtime := roomRuntime{
 		SelectionRevision: live.room.SelectionRevision, Command: live.command, BufferingWaitAt: live.bufferingWaitAt,
-		Members: make(map[string]runtimeMember, len(live.members)),
+		PausedBeforePending: live.pausedBeforePending, Members: make(map[string]runtimeMember, len(live.members)),
 	}
 	for key, m := range live.members {
 		runtime.Members[key] = runtimeMember{
@@ -231,6 +234,7 @@ func (s *Service) adoptRuntimeLocked(ctx context.Context, live *liveRoom, room R
 	live.room = room
 	live.command = state.Command
 	live.bufferingWaitAt = state.BufferingWaitAt
+	live.pausedBeforePending = state.PausedBeforePending
 	if selectionChanged {
 		live.command = nil
 		live.bufferingWaitAt = time.Time{}
@@ -252,6 +256,8 @@ func (s *Service) adoptRuntimeLocked(ctx context.Context, live *liveRoom, room R
 			if m.connection != nil {
 				m.remoteConnected = false
 				m.lastPingMS = old.lastPingMS
+				m.driftStrikes, m.settleUntil, m.lastSentCommandID = old.driftStrikes, old.settleUntil, old.lastSentCommandID
+				m.lastSentPaused, m.lastSentAt, m.bestDrift, m.correctedFrom = old.lastSentPaused, old.lastSentAt, old.bestDrift, old.correctedFrom
 				if m.leaseUntil.Sub(now) <= connectionLease-leaseRefreshInterval {
 					m.leaseUntil = now.Add(connectionLease)
 				}
@@ -360,9 +366,13 @@ func (s *Service) reconcileRoom(ctx context.Context, roomID string) error {
 		force := s.skipUnreadyMembersLocked(live, s.now())
 		snapshots, commands := s.maybeResumeFromWaitingLocked(ctx, live, force)
 		state := s.runtimeLocked(live)
+		// Snapshots show neither leases, latency, nor the commands a member
+		// was sent, so changes to them alone send nobody a snapshot.
 		for key, member := range state.Members {
 			member.LeaseUntil = time.Time{}
 			member.LastPingMS = 0
+			member.CorrectionCommand = nil
+			member.WaitingCommand = nil
 			state.Members[key] = member
 		}
 		fingerprint, _ := json.Marshal(struct {
@@ -378,7 +388,9 @@ func (s *Service) reconcileRoom(ctx context.Context, roomID string) error {
 				if member.connection == nil || member.sessionID == "" || member.lastCommandID == command.CommandID {
 					continue
 				}
-				commands = append(commands, s.targetedCommandDispatchesLocked(live, member.sessionID, *command)...)
+				// A stalled member's own seek for this wait, not the room's
+				// pause, which would let it ready up where it stalled.
+				commands = append(commands, s.targetedCommandDispatchesLocked(live, member.sessionID, *s.waitingCommandForLocked(live, member.sessionID))...)
 				member.lastCommandID = command.CommandID
 			}
 		}
diff --git a/internal/watchtogether/runtime_test.go b/internal/watchtogether/runtime_test.go
index 289e74b36f..e91e7565af 100644
--- a/internal/watchtogether/runtime_test.go
+++ b/internal/watchtogether/runtime_test.go
@@ -363,3 +363,27 @@ func TestRoomRuntimeWaitingDeadlineStartsWithAttachmentPG(t *testing.T) {
 		t.Fatal("attached straggler blocked room past the waiting deadline")
 	}
 }
+
+// The requester state from before a pending command travels with the room, so
+// a guest on another server undoing a pending play keeps the paused position.
+func TestPendingCommandRequesterStateCrossesNodesPG(t *testing.T) {
+	f := newRoomClusterFixture(t)
+	if _, err := f.host.UpdatePolicy(t.Context(), f.roomID, 7, "host", GuestControlPolicyGuestPlayPause); err != nil {
+		t.Fatal(err)
+	}
+	position := 100.0
+	request := func(s *Service, reg *Registration, user int, profile string, action TransportAction) {
+		t.Helper()
+		if _, err := s.HandleTransportRequestForConnection(t.Context(), reg, user, profile,
+			TransportRequest{Action: action, PositionSeconds: &position, IsPaused: action == TransportActionPause}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	request(f.host, f.hostReg, 7, "host", TransportActionPause)
+	f.now = f.now.Add(5 * time.Second)
+	request(f.host, f.hostReg, 7, "host", TransportActionPlay)
+	request(f.guest, f.guestReg, 8, "guest", TransportActionPause)
+	if undo := lastTransport(t, f.guestConn); undo.Action != TransportActionPause || undo.PositionSeconds != position {
+		t.Fatalf("guest pause undoing the host's pending play = %s at %.2f, want pause at the paused %.0f", undo.Action, undo.PositionSeconds, position)
+	}
+}
diff --git a/internal/watchtogether/selection_resolver.go b/internal/watchtogether/selection_resolver.go
index 9a44ef52ba..d78a5cde99 100644
--- a/internal/watchtogether/selection_resolver.go
+++ b/internal/watchtogether/selection_resolver.go
@@ -77,9 +77,10 @@ func preferredRoomVersion(versions []catalog.FileVersion) catalog.FileVersion {
 
 func (r *CatalogSelectionResolver) watchDetail(ctx context.Context, userID int, profileID string, input SelectItemInput) (*catalog.WatchDetail, error) {
 	filter := catalog.AccessFilter{
-		UserID:         userID,
-		ProfileID:      profileID,
-		SelectedFileID: 0,
+		UserID:           userID,
+		ProfileID:        profileID,
+		SelectedFileID:   0,
+		OmitWatchArtwork: true,
 	}
 	if scope, ok := access.GetScope(ctx); ok {
 		filter.AllowedLibraryIDs = scope.AllowedLibraryIDs
diff --git a/internal/watchtogether/selection_resolver_test.go b/internal/watchtogether/selection_resolver_test.go
index 7bcc06827b..6f5e7f95bf 100644
--- a/internal/watchtogether/selection_resolver_test.go
+++ b/internal/watchtogether/selection_resolver_test.go
@@ -2,6 +2,7 @@ package watchtogether
 
 import (
 	"context"
+	"errors"
 	"testing"
 
 	"github.com/prairie-server/prairie-server/internal/catalog"
@@ -11,6 +12,32 @@ type roomWatchDetail struct {
 	versions []catalog.FileVersion
 }
 
+type unavailableArtworkWatchDetail struct{}
+
+func (unavailableArtworkWatchDetail) GetWatchDetail(_ context.Context, _ string, filter catalog.AccessFilter) (*catalog.WatchDetail, error) {
+	if !filter.OmitWatchArtwork {
+		return nil, errors.New("artwork provider unavailable")
+	}
+	return &catalog.WatchDetail{ContentID: "movie-1", Type: "movie", Versions: []catalog.FileVersion{
+		{FileID: 1, Resolution: "2160p", EditionKey: "theatrical"},
+		{FileID: 2, Resolution: "1080p", EditionKey: "theatrical"},
+	}}, nil
+}
+
+func TestRoomSourceSelectionDoesNotNeedArtwork(t *testing.T) {
+	resolver := NewCatalogSelectionResolver(unavailableArtworkWatchDetail{})
+	selected, err := resolver.ResolveSelection(t.Context(), 7, "host", SelectItemInput{ContentID: "movie-1"})
+	if err != nil || selected.FileID == nil || *selected.FileID != 1 {
+		t.Fatalf("selection = %+v, error = %v", selected, err)
+	}
+	selected, err = resolver.ResolveSourceFallback(t.Context(), 7, "host", SelectItemInput{
+		ContentID: "movie-1", FileID: new(1),
+	}, fallbackReasonLowerResolution)
+	if err != nil || selected.FileID == nil || *selected.FileID != 2 {
+		t.Fatalf("fallback = %+v, error = %v", selected, err)
+	}
+}
+
 func (d roomWatchDetail) GetWatchDetail(context.Context, string, catalog.AccessFilter) (*catalog.WatchDetail, error) {
 	return &catalog.WatchDetail{ContentID: "movie-1", Type: "movie", Versions: d.versions}, nil
 }
diff --git a/internal/watchtogether/service.go b/internal/watchtogether/service.go
index 1e54082a32..93ded390b3 100644
--- a/internal/watchtogether/service.go
+++ b/internal/watchtogether/service.go
@@ -59,13 +59,66 @@ const (
 	minTransportLead     = 350 * time.Millisecond
 	// maxTransportLead bounds how far in the future transport commands may be
 	// scheduled, so a single member with a huge (or bogus) measured latency
-	// cannot stall the whole room.
-	maxTransportLead = 5 * time.Second
+	// cannot stall the whole room. A member whose round trip exceeds it
+	// receives commands late; clients project a late command forward to the
+	// room's position, so it still lands in sync.
+	maxTransportLead = 2 * time.Second
+	// pingSmoothingWeight is the weight of a slower round-trip sample in a
+	// member's latency. One slow sample (the read loop is sequential, so a slow
+	// transaction delays the pong) must not move every command's lead.
+	pingSmoothingWeight = 0.25
 	// guestCorrectionRetryInterval prevents repeated state reports from
 	// rebuilding a guest's stream while the previous correction is still being
-	// applied. A later report retries the correction if the guest remains out of
-	// sync after this bounded interval.
-	guestCorrectionRetryInterval = 5 * time.Second
+	// applied. Clients converge small drift by playback rate over tens of
+	// seconds, so a correction that is still converging is not resent sooner.
+	guestCorrectionRetryInterval = 10 * time.Second
+	// guestCorrectionDriftSeconds is how far a member's reported position may
+	// sit from the room before the server corrects it. A client with the rate
+	// loop closes the drift itself; a correction only refreshes its reference,
+	// and it still converges by rate, never a seek, under 5 s. For an older
+	// client without the loop, this is what keeps it near the room.
+	guestCorrectionDriftSeconds = 1.0
+	// guestCorrectionStrikes is how many consecutive reports must exceed
+	// guestCorrectionDriftSeconds before a correction is sent, so one late or
+	// noisy report never moves a member.
+	guestCorrectionStrikes = 2
+	// commandSettleWindow is how long after a command's execute_at a member's
+	// reports may still describe the state before it. A report in that window
+	// is neither corrected nor, from the host, taken as a room decision.
+	commandSettleWindow = 1500 * time.Millisecond
+	// namedCommandWait is how long a report naming an older command than the
+	// member was last sent is taken to predate that command. A client names
+	// the last command it applied, so until it names the newest one it has not
+	// run it; the bound covers a client that legitimately drops a command.
+	namedCommandWait = 10 * time.Second
+	// convergingDriftSeconds and convergingProgressSeconds describe a member
+	// that is already closing its drift by rate: within the clients' 5 s
+	// hard-seek band, and closer than at its last report by this much. Such a
+	// member is not corrected again; a correction would only restart it.
+	convergingDriftSeconds    = 5.0
+	convergingProgressSeconds = 0.1
+	// seekRepeatSeconds is how close a seek request may be to the seek the
+	// room is already waiting on and still be the same seek. Clients compute
+	// a relative skip from their own position, which stays on the old stream
+	// until the room's seek runs there, so a burst of presses repeats the
+	// pending target; each repeat would restart the barrier for everyone.
+	seekRepeatSeconds = 1.0
+	// stuckCorrectionSeconds is how far a paused member must move after a
+	// correction before it is corrected again. One that has not moved cannot
+	// apply it in place (a transcode lands on segment boundaries), and
+	// repeating it changes nothing.
+	stuckCorrectionSeconds = 0.1
+	// stuckCorrectionRetry is how long such a member is left alone before
+	// the correction is tried again, since a failure to apply it can pass.
+	stuckCorrectionRetry = time.Minute
+	// stallSeekToleranceSeconds is how close a stalled guest must land to the
+	// waiting room's position before it counts as ready, when its ready names
+	// the seek it ran. A rebuilt stream lands on a segment boundary, often
+	// short of the target; clients close anything inside their 5 s hard-seek
+	// band by playback rate once the room resumes, so a short landing must not
+	// cost the guest the barrier. A ready without the command ID could come
+	// from before the seek, so it keeps readySeekToleranceSeconds.
+	stallSeekToleranceSeconds = 5.0
 	// maxBufferingAnchorDriftSeconds bounds how far a buffering member's
 	// reported position may move the shared room anchor.
 	maxBufferingAnchorDriftSeconds = 5.0
@@ -99,10 +152,16 @@ const (
 	// acknowledged with ready; the hold bounds a client that never does.
 	bufferingCorrectionHold = 30 * time.Second
 	// hostAuthorityDriftSeconds is how far the host's passive position may
-	// drift before it moves the room anchor. Smaller drift, such as a short
-	// local stall, is corrected on the host like any viewer's instead of
-	// pulling every other viewer back.
-	hostAuthorityDriftSeconds = 2.0
+	// drift before it moves the room anchor. Every client sends its seeks as
+	// transport requests, so passive drift is almost always the host's stream
+	// falling behind, not a decision; it is corrected on the host like any
+	// viewer's instead of pulling every other viewer to it. Only a jump far
+	// beyond what a correction would fix is taken as the host's choice.
+	hostAuthorityDriftSeconds = 10.0
+	// legacyHostAuthorityDriftSeconds keeps the frozen /api/v1 room socket's
+	// host band. Its clients may report a host's scrub instead of requesting
+	// it, which the wider v2 band would correct away.
+	legacyHostAuthorityDriftSeconds = 2.0
 	// roomIdleTTL is how long a room may go without any playback-anchor
 	// activity before the janitor closes it.
 	roomIdleTTL = 24 * time.Hour
@@ -125,6 +184,15 @@ func closeReplacedConnection(conn RoomConnection) {
 	_ = conn.Close()
 }
 
+// hostAuthorityDrift is the host band for member's socket. A connection on
+// the /api/v1 room socket reports itself as legacy.
+func hostAuthorityDrift(member *memberState) float64 {
+	if legacy, ok := member.connection.(interface{ LegacyRoomProtocol() bool }); ok && legacy.LegacyRoomProtocol() {
+		return legacyHostAuthorityDriftSeconds
+	}
+	return hostAuthorityDriftSeconds
+}
+
 type RoomStore interface {
 	CreateRoom(ctx context.Context, room Room) (*Room, error)
 	GetRoomByID(ctx context.Context, roomID string) (*Room, error)
@@ -247,7 +315,26 @@ type memberState struct {
 	// session, and it is cleared whenever what the room is about to play
 	// changes: staging a different item, starting, or switching modes.
 	lobbyReady bool
+	// lastPingMS is the member's smoothed round-trip time.
 	lastPingMS int64
+	// driftStrikes counts consecutive state reports beyond
+	// guestCorrectionDriftSeconds. It is local to this server's connection.
+	driftStrikes int
+	// settleUntil is commandSettleWindow past the execute_at of the last
+	// command sent to this member. Reports before it may predate the command,
+	// unless they name lastSentCommandID as the command they last applied.
+	settleUntil       time.Time
+	lastSentCommandID string
+	// correctedFrom is the position the member reported when its pending
+	// correction was sent.
+	correctedFrom float64
+	// lastSentPaused is whether that command left the member paused, and
+	// lastSentAt when it was sent.
+	lastSentPaused bool
+	lastSentAt     time.Time
+	// bestDrift is the smallest out-of-sync drift reported since the last
+	// command, used to tell a converging member from a stuck one.
+	bestDrift float64
 }
 
 // resetForSelection drops everything bound to the previous playback epoch.
@@ -263,6 +350,12 @@ func (m *memberState) resetForSelection() {
 	m.lastCommandID = ""
 	m.syncingToRoom = false
 	m.lobbyReady = false
+	m.driftStrikes = 0
+	m.settleUntil = time.Time{}
+	m.lastSentCommandID = ""
+	m.lastSentPaused = false
+	m.lastSentAt = time.Time{}
+	m.bestDrift = 0
 }
 
 type liveRoom struct {
@@ -285,6 +378,9 @@ type liveRoom struct {
 	bufferingWaitAt time.Time
 	// itemEnd caches the playing file's duration for the reconciler.
 	itemEnd itemEnd
+	// pausedBeforePending is whether the room was paused before the change
+	// pending at its future anchor. Members keep that state until they run it.
+	pausedBeforePending bool
 }
 
 type snapshotDispatch struct {
@@ -706,19 +802,34 @@ func (s *Service) handleTransportRequestForConnection(
 	// An explicit transport request is the member's intent, which supersedes
 	// any pending sync to the room's position.
 	member.syncingToRoom = false
+	if s.repeatsWaitingSeekLocked(live, request) {
+		snapshot := s.buildSnapshotLocked(live, userID, profileID)
+		s.mu.Unlock()
+		return snapshot, nil
+	}
+	waiting := live.room.PlaybackState == RoomPlaybackStateWaiting
 
-	position := live.room.AnchorPositionSeconds
+	// Every command carries the room's position at its execute_at, and the
+	// anchor is taken there too, so the room's model and the members it
+	// schedules agree. Anchoring at now while members start at now plus the
+	// lead left every member that lead behind the model.
+	now := s.now()
+	executeAt := s.nextExecuteAtLocked(live, now)
+	position := expectedPosition(live.room, executeAt)
 	if request.PositionSeconds != nil {
 		position = math.Max(0, *request.PositionSeconds)
-	} else if !live.room.IsPaused {
-		position = s.expectedPositionLocked(live)
+		// A play or pause carries where the requester was when it pressed;
+		// a requester that was playing runs on until the command executes. A
+		// seek target is absolute.
+		if request.Action != TransportActionSeek && requesterPlayingLocked(live, now) {
+			position += executeAt.Sub(now).Seconds()
+		}
 	}
 
-	now := s.now()
+	live.notePendingChangeLocked(now)
 	live.room.AnchorPositionSeconds = position
-	live.room.AnchorUpdatedAt = now
+	live.room.AnchorUpdatedAt = executeAt
 	var commandDispatches []commandDispatch
-	executeAt := now.Add(s.highestPingLocked(live))
 	switch request.Action {
 	case TransportActionPlay:
 		live.room.ResumeOnReady = true
@@ -743,7 +854,11 @@ func (s *Service) handleTransportRequestForConnection(
 			executeAt,
 		)
 	case TransportActionSeek:
-		live.room.ResumeOnReady = !request.IsPaused
+		// During an open barrier the requester is paused by the barrier, not
+		// by choice, so a further seek keeps whether the room resumes.
+		if !waiting {
+			live.room.ResumeOnReady = !request.IsPaused
+		}
 		live.room.IsPaused = true
 		live.room.PlaybackState = RoomPlaybackStateWaiting
 		s.resetMemberReadinessLocked(live, false)
@@ -845,8 +960,17 @@ func (s *Service) handleStateReportForConnection(
 	// position is reporting the stream's start, not a decision. Anchoring
 	// there would rewind everyone; correct the host like a guest instead. The
 	// first report that matches the room ends the sync.
+	// A host that names the sync it was sent and plays as the sync said,
+	// inside the host band, has run it; it may still be closing the rest by
+	// rate, and its pause or resume is a decision again. Naming the sync is
+	// not enough: a player whose play was refused (a browser blocking
+	// autoplay after a reload) or whose correction never loaded names it
+	// too, and its report would pause or rewind everyone.
+	hostBand := hostAuthorityDrift(member)
 	if isHost && member.syncingToRoom {
-		if !pauseMismatch && drift <= 1.5 {
+		ranSync := report.CommandID != "" && report.CommandID == member.lastSentCommandID &&
+			report.IsPaused == member.lastSentPaused && drift <= hostBand
+		if ranSync || (!pauseMismatch && drift <= 1.5) {
 			member.syncingToRoom = false
 		} else {
 			isHost = false
@@ -855,16 +979,32 @@ func (s *Service) handleStateReportForConnection(
 	// A host who is buffering or catching up reports a stalled stream, and a
 	// host inside the catch-up band has only drifted. Neither is a decision
 	// the room should follow.
-	if isHost && (member.ignoreWait || member.isBuffering || (!pauseMismatch && drift <= hostAuthorityDriftSeconds)) {
+	if isHost && (member.ignoreWait || member.isBuffering || (!pauseMismatch && drift <= hostBand)) {
 		isHost = false
 	}
 	// A stalled stream cannot apply a target; recovery is acknowledged with
 	// ready, which sends a fresh one.
 	holdCorrection := member.isBuffering && now.Sub(member.lastStallAt) < bufferingCorrectionHold
+	// A report sent before this member's latest command executed, or just
+	// after, can still describe the state that command replaces: neither a
+	// drift to correct nor, from the host, a decision.
+	settling := s.commandSettlingLocked(live, member, report, now)
+	if settling {
+		isHost = false
+	}
 
 	snapshot := s.buildSnapshotLocked(live, userID, profileID)
 	if isHost {
-		live.room.AnchorPositionSeconds = math.Max(0, report.PositionSeconds)
+		member.driftStrikes = 0
+		// The host's report becomes the room command, which members run at
+		// executeAt; a playing host is that much further on by then.
+		executeAt := s.nextExecuteAtLocked(live, now)
+		position := math.Max(0, report.PositionSeconds)
+		if !report.IsPaused {
+			position += executeAt.Sub(now).Seconds()
+		}
+		live.notePendingChangeLocked(now)
+		live.room.AnchorPositionSeconds = position
 		live.room.IsPaused = report.IsPaused
 		// A host that pauses or resumes from the system controls reports the
 		// change instead of requesting it. Corrections, re-attaches, and
@@ -878,7 +1018,7 @@ func (s *Service) handleStateReportForConnection(
 				live.room.PlaybackState = RoomPlaybackStatePaused
 			}
 		}
-		live.room.AnchorUpdatedAt = s.now()
+		live.room.AnchorUpdatedAt = executeAt
 		conflict, updateErr := s.persistAnchorLocked(ctx, live)
 		if updateErr != nil {
 			s.mu.Unlock()
@@ -904,13 +1044,33 @@ func (s *Service) handleStateReportForConnection(
 				live,
 				action,
 				live.room.AnchorPositionSeconds,
-				now.Add(s.highestPingLocked(live)),
+				executeAt,
 			)
 		}
 		dispatches = s.prepareSnapshotDispatchesLocked(live)
 	} else if holdCorrection {
+		member.driftStrikes = 0
+		member.correctionCommand = nil
+	} else if settling {
+		// Keep the pending correction, so its retry spacing still holds.
+	} else if !pauseMismatch && drift <= guestCorrectionDriftSeconds {
+		member.driftStrikes = 0
+		member.bestDrift = 0
 		member.correctionCommand = nil
-	} else if pauseMismatch || drift > 1.0 {
+	} else if !pauseMismatch && !live.room.IsPaused && drift <= convergingDriftSeconds &&
+		(member.bestDrift == 0 || drift < member.bestDrift-convergingProgressSeconds) {
+		// Closer than its best since its last command (the first report after
+		// a command sets that best): the member is converging by rate, so it is
+		// left to it. A member of a paused room cannot converge by rate.
+		member.bestDrift = drift
+		member.driftStrikes = 0
+	} else if live.room.IsPaused && !pauseMismatch && member.correctionCommand != nil &&
+		math.Abs(report.PositionSeconds-member.correctedFrom) < stuckCorrectionSeconds &&
+		!correctionOlderThan(member.correctionCommand, now, stuckCorrectionRetry) {
+		// Paused where its last correction found it: it cannot apply one.
+		member.driftStrikes = 0
+	} else if member.driftStrikes++; pauseMismatch || member.driftStrikes >= guestCorrectionStrikes {
+		executeAt := s.nextExecuteAtLocked(live, now)
 		command := TransportCommand{
 			CommandID:         uuid.NewString(),
 			SessionID:         report.SessionID,
@@ -921,17 +1081,17 @@ func (s *Service) handleStateReportForConnection(
 				}
 				return TransportActionPause
 			}(),
-			PositionSeconds: math.Max(0, expected),
-			ExecuteAt:       now.Add(s.highestPingLocked(live)).UTC().Format(time.RFC3339Nano),
+			// The room's position when the member runs it, as for every command.
+			PositionSeconds: math.Max(0, expectedPosition(live.room, executeAt)),
+			ExecuteAt:       executeAt.UTC().Format(time.RFC3339Nano),
 			IssuedAt:        now.UTC().Format(time.RFC3339Nano),
 			PlaybackState:   live.room.PlaybackState,
 		}
 		if !correctionCommandPending(member, command, now) {
 			member.correctionCommand = &command
+			member.correctedFrom = report.PositionSeconds
 			correctionDispatches = s.targetedCommandDispatchesLocked(live, report.SessionID, command)
 		}
-	} else {
-		member.correctionCommand = nil
 	}
 	if caughtUp && dispatches == nil {
 		dispatches = s.prepareSnapshotDispatchesLocked(live)
@@ -1081,6 +1241,11 @@ func (s *Service) acceptReadyLocked(
 	delta := math.Abs(report.PositionSeconds - command.PositionSeconds)
 	isHost := userID == live.room.HostUserID && profileID == live.room.HostProfileID
 	if !isHost {
+		// The member's own seek after a stall (moveStalledMemberLocked), which
+		// its client confirms it ran by naming it.
+		if isStallSeekLocked(live, command) && report.CommandID == command.CommandID {
+			return delta <= stallSeekToleranceSeconds
+		}
 		return delta <= readySeekToleranceSeconds
 	}
 	if delta > hostReadySeekToleranceSeconds {
@@ -1212,17 +1377,35 @@ func (s *Service) handleBufferingForConnection(
 			s.sendDispatches(ctx, dispatches)
 			return snapshot, nil
 		}
-		// Bound how far a single member's report can move the shared anchor.
-		position := math.Max(0, report.PositionSeconds)
-		expected := math.Max(0, s.expectedPositionLocked(live))
-		if math.Abs(position-expected) > maxBufferingAnchorDriftSeconds {
-			position = expected
+		// Everyone else pauses where the room is when the command runs and
+		// waits there; only a stalled guest moves, forward to that point.
+		// Rewinding the room to the stalled guest replayed up to
+		// maxBufferingAnchorDriftSeconds for every other viewer.
+		executeAt := s.nextExecuteAtLocked(live, now)
+		position := math.Max(0, expectedPosition(live.room, executeAt))
+		// The room resumes from where the stalled viewer is, within a bound,
+		// when nobody else is watching, so it skips nothing they have not
+		// seen, and when the host stalls: the host's ready re-anchors the
+		// room wherever its reloaded stream lands, so moving the host forward
+		// would only rewind everyone else afterwards.
+		isHost := userID == live.room.HostUserID && profileID == live.room.HostProfileID
+		resumeFromStall := alone || isHost
+		if resumeFromStall {
+			// The bound is measured where the room is now; position already
+			// runs on to executeAt, which would narrow it by the lead.
+			if reported := math.Max(0, report.PositionSeconds); math.Abs(reported-expectedPosition(live.room, now)) <= maxBufferingAnchorDriftSeconds {
+				position = reported
+			}
 		}
 		commandDispatches, _ = s.enterWaitingLocked(
 			live,
 			position,
 			live.room.PlaybackState == RoomPlaybackStatePlaying || live.room.ResumeOnReady,
+			executeAt,
 		)
+		if !resumeFromStall {
+			commandDispatches = s.moveStalledMemberLocked(live, reg.memberKey, commandDispatches, now, executeAt)
+		}
 		conflict, updateErr := s.persistAnchorLocked(ctx, live)
 		if updateErr != nil {
 			s.mu.Unlock()
@@ -1247,6 +1430,71 @@ func (s *Service) handleBufferingForConnection(
 	return snapshot, nil
 }
 
+// moveStalledMemberLocked replaces the stalled member's room pause with a seek
+// to the room's waiting position, so the barrier waits for it to arrive there
+// (acceptReadyLocked holds a seek to its tolerance) while everyone else stays
+// put. Must be called with s.mu held.
+func (s *Service) moveStalledMemberLocked(
+	live *liveRoom,
+	memberKey string,
+	dispatches []commandDispatch,
+	now, executeAt time.Time,
+) []commandDispatch {
+	member := live.members[memberKey]
+	if member == nil || member.sessionID == "" {
+		return dispatches
+	}
+	kept := dispatches[:0]
+	for _, dispatch := range dispatches {
+		if dispatch.memberKey != memberKey {
+			kept = append(kept, dispatch)
+		}
+	}
+	issuedAt := now.UTC().Format(time.RFC3339Nano)
+	if live.command != nil {
+		// Shares the wait's issue time, which marks it as this wait's command
+		// for the member (see waitingCommandForLocked).
+		issuedAt = live.command.IssuedAt
+	}
+	return append(kept, s.targetedCommandDispatchesLocked(live, member.sessionID, TransportCommand{
+		CommandID:         uuid.NewString(),
+		SelectionRevision: live.room.SelectionRevision,
+		Action:            TransportActionSeek,
+		PositionSeconds:   live.room.AnchorPositionSeconds,
+		ExecuteAt:         executeAt.UTC().Format(time.RFC3339Nano),
+		IssuedAt:          issuedAt,
+		PlaybackState:     RoomPlaybackStateWaiting,
+	})...)
+}
+
+// waitingCommandForLocked returns the command a member must finish before the
+// waiting room resumes: the room's, or the seek a stalled member was sent for
+// this same wait. Must be called with s.mu held.
+func (s *Service) waitingCommandForLocked(live *liveRoom, sessionID string) *TransportCommand {
+	if live.command == nil {
+		return nil
+	}
+	for _, member := range live.members {
+		if member != nil && member.sessionID == sessionID && isStallSeekLocked(live, member.waitingCommand) {
+			return member.waitingCommand
+		}
+	}
+	return live.command
+}
+
+// isStallSeekLocked reports whether command is the seek a stalled member was
+// sent for the room's current wait. Only a stall wait sends one: the room is
+// waiting on a pause, and the seek shares that pause's issue time. Any other
+// room command, including the resume that ends the wait, is every member's.
+// Must be called with s.mu held.
+func isStallSeekLocked(live *liveRoom, command *TransportCommand) bool {
+	room := live.command
+	return command != nil && room != nil &&
+		live.room.PlaybackState == RoomPlaybackStateWaiting && room.Action == TransportActionPause &&
+		command.Action == TransportActionSeek && command.CommandID != room.CommandID &&
+		command.SelectionRevision == room.SelectionRevision && command.IssuedAt == room.IssuedAt
+}
+
 // bufferingMayPauseRoomLocked reports whether a member's stall while the room
 // plays should pause everyone. The room waits for a viewer once: not while
 // they are already catching up, not again until they have played
@@ -1329,6 +1577,12 @@ func (s *Service) HandlePingForConnection(
 		if maxMS := maxTransportLead.Milliseconds(); pingMS > maxMS {
 			pingMS = maxMS
 		}
+		// Queueing only ever adds delay, so a faster round trip is the better
+		// measurement and is taken at once; a slower one moves the estimate
+		// gradually.
+		if member.lastPingMS > 0 && pingMS > member.lastPingMS {
+			pingMS = int64(math.Round(float64(member.lastPingMS)*(1-pingSmoothingWeight) + float64(pingMS)*pingSmoothingWeight))
+		}
 		member.lastPingMS = pingMS
 	}
 	return nil
@@ -1854,8 +2108,12 @@ func (s *Service) maybeResumeFromWaitingLocked(
 	}
 
 	saved := live.room
+	// The room resumes when members run the command, not when it is sent.
+	now := s.now()
+	executeAt := s.nextExecuteAtLocked(live, now)
+	live.notePendingChangeLocked(now)
 	live.room.AnchorPositionSeconds = math.Max(0, live.room.AnchorPositionSeconds)
-	live.room.AnchorUpdatedAt = s.now()
+	live.room.AnchorUpdatedAt = executeAt
 	action := TransportActionPause
 	if live.room.ResumeOnReady {
 		live.room.IsPaused = false
@@ -1888,7 +2146,7 @@ func (s *Service) maybeResumeFromWaitingLocked(
 		live,
 		action,
 		live.room.AnchorPositionSeconds,
-		s.now().Add(s.highestPingLocked(live)),
+		executeAt,
 	)
 	return s.prepareSnapshotDispatchesLocked(live), commandDispatches
 }
@@ -2244,6 +2502,7 @@ func (s *Service) targetedCommandDispatchesLocked(
 		if payload.PlaybackState == RoomPlaybackStateWaiting {
 			member.waitingCommand = &payload
 		}
+		s.noteCommandSentLocked(member, payload)
 		dispatches = append(dispatches, commandDispatch{
 			conn:      member.connection,
 			memberKey: memberKey,
@@ -2282,6 +2541,7 @@ func (s *Service) transportCommandDispatchesLocked(
 		}
 		if member.connection != nil {
 			member.lastCommandID = command.CommandID
+			s.noteCommandSentLocked(member, payload)
 			dispatches = append(dispatches, commandDispatch{conn: member.connection, memberKey: memberKey,
 				payload: map[string]any{clusterMessageTypeKey: transportMessageType, commandPayloadKey: payload}})
 		}
@@ -2309,6 +2569,116 @@ func memberCommandLogAttrs(roomID string, userID int, dispatch commandDispatch)
 	}
 }
 
+// repeatsWaitingSeekLocked reports whether request is a seek to where the room
+// is already waiting to seek. Must be called with s.mu held.
+func (s *Service) repeatsWaitingSeekLocked(live *liveRoom, request TransportRequest) bool {
+	command := live.command
+	return request.Action == TransportActionSeek && request.PositionSeconds != nil &&
+		live.room.PlaybackState == RoomPlaybackStateWaiting && command != nil &&
+		command.Action == TransportActionSeek && command.SelectionRevision == live.room.SelectionRevision &&
+		// A host landing can move the barrier's destination; then the seek
+		// is not a repeat.
+		math.Abs(live.room.AnchorPositionSeconds-command.PositionSeconds) <= seekRepeatSeconds &&
+		math.Abs(*request.PositionSeconds-command.PositionSeconds) <= seekRepeatSeconds
+}
+
+// correctionOlderThan reports whether command was issued at least age ago.
+func correctionOlderThan(command *TransportCommand, now time.Time, age time.Duration) bool {
+	issuedAt, err := time.Parse(time.RFC3339Nano, command.IssuedAt)
+	return err != nil || now.Sub(issuedAt) >= age
+}
+
+// commandSettlingLocked reports whether a state report at now may predate the
+// latest command this member was sent or the room's latest command. A report
+// naming that command as the last one its client applied, with the play state
+// the command set, describes the state after it and settles at once, as long
+// as the member was also sent the room's latest command. A report naming an
+// older command predates the newest one for up to namedCommandWait.
+func (s *Service) commandSettlingLocked(live *liveRoom, member *memberState, report StateReport, now time.Time) bool {
+	roomCommand := live.command
+	if roomCommand != nil && roomCommand.SelectionRevision != live.room.SelectionRevision {
+		roomCommand = nil
+	}
+	named := report.CommandID != "" && report.CommandID == member.lastSentCommandID
+	delivered := roomCommand == nil || member.lastCommandID == roomCommand.CommandID
+	if named && delivered && report.IsPaused == member.lastSentPaused {
+		return false
+	}
+	if report.CommandID != "" && !named && now.Sub(member.lastSentAt) < namedCommandWait {
+		return true
+	}
+	if now.Before(member.settleUntil) {
+		return true
+	}
+	if roomCommand == nil {
+		return false
+	}
+	executeAt, err := time.Parse(time.RFC3339Nano, roomCommand.ExecuteAt)
+	return err == nil && now.Before(executeAt.Add(commandSettleWindow))
+}
+
+// notePendingChangeLocked records the room's paused state before it schedules a
+// change at a future anchor. A change made while another is still pending
+// keeps the state from before the first, since members have run neither.
+func (live *liveRoom) notePendingChangeLocked(now time.Time) {
+	if !live.room.AnchorUpdatedAt.After(now) {
+		live.pausedBeforePending = live.room.IsPaused
+	}
+}
+
+// requesterPlayingLocked reports whether a member sending a play or pause
+// now is playing. The room's state says so once its latest command has run.
+// While that command is still pending (the anchor lies at its execute_at),
+// the room already shows its outcome and the requester is still in the state
+// from before it. The request's is_paused is no help: clients disagree on
+// whether it is the requester's state or the one it asks for.
+func requesterPlayingLocked(live *liveRoom, now time.Time) bool {
+	if live.room.AnchorUpdatedAt.After(now) {
+		return !live.pausedBeforePending
+	}
+	return !live.room.IsPaused
+}
+
+// noteCommandSentLocked starts the member's settle window for a command, from
+// its execute_at or, for a command delivered late, from now. Drift measured
+// before the command is not evidence about the state after it, so the
+// member's strikes and convergence start over.
+func (s *Service) noteCommandSentLocked(member *memberState, command TransportCommand) {
+	now := s.now()
+	member.driftStrikes = 0
+	member.bestDrift = 0
+	member.lastSentCommandID = command.CommandID
+	member.lastSentPaused = command.PlaybackState != RoomPlaybackStatePlaying
+	member.lastSentAt = now
+	executeAt, err := time.Parse(time.RFC3339Nano, command.ExecuteAt)
+	if err != nil {
+		return
+	}
+	if executeAt.Before(now) {
+		executeAt = now
+	}
+	if until := executeAt.Add(commandSettleWindow); until.After(member.settleUntil) {
+		member.settleUntil = until
+	}
+}
+
+// nextExecuteAtLocked schedules a command one lead from now, and never before
+// the room's own latest command or anchor. The lead can drop between commands
+// (a faster round trip, the slowest member leaving), and a command that ran
+// before the room's own play would start its member ahead of everyone.
+func (s *Service) nextExecuteAtLocked(live *liveRoom, now time.Time) time.Time {
+	at := now.Add(s.highestPingLocked(live))
+	if live.room.AnchorUpdatedAt.After(at) {
+		at = live.room.AnchorUpdatedAt
+	}
+	if command := live.command; command != nil && command.SelectionRevision == live.room.SelectionRevision {
+		if executeAt, err := time.Parse(time.RFC3339Nano, command.ExecuteAt); err == nil && executeAt.After(at) {
+			at = executeAt
+		}
+	}
+	return at
+}
+
 func correctionCommandPending(member *memberState, command TransportCommand, now time.Time) bool {
 	if member == nil || member.correctionCommand == nil {
 		return false
@@ -2343,22 +2713,29 @@ func (s *Service) runCommandDispatches(dispatches []commandDispatch) {
 	}
 }
 
-func (s *Service) enterWaitingLocked(live *liveRoom, positionSeconds float64, resumeOnReady bool) ([]commandDispatch, bool) {
+// enterWaitingLocked pauses the room at positionSeconds, its position at
+// executeAt, and waits for every participant to be ready there.
+func (s *Service) enterWaitingLocked(
+	live *liveRoom,
+	positionSeconds float64,
+	resumeOnReady bool,
+	executeAt time.Time,
+) ([]commandDispatch, bool) {
 	if live.room.Phase != RoomPhasePlaying {
 		return nil, false
 	}
+	live.notePendingChangeLocked(s.now())
 	live.room.AnchorPositionSeconds = math.Max(0, positionSeconds)
 	live.room.IsPaused = true
 	live.room.PlaybackState = RoomPlaybackStateWaiting
 	live.room.ResumeOnReady = resumeOnReady
-	live.room.AnchorUpdatedAt = s.now()
+	live.room.AnchorUpdatedAt = executeAt
 	s.resetMemberReadinessLocked(live, false)
 
 	if s.activeParticipantCountLocked(live) == 0 {
 		return nil, false
 	}
 	s.armWaitingDeadlineLocked(live)
-	executeAt := s.now().Add(s.highestPingLocked(live))
 	return s.transportCommandDispatchesLocked(
 		live,
 		TransportActionPause,
@@ -2372,10 +2749,12 @@ func (s *Service) syncMemberToRoomLocked(live *liveRoom, sessionID string) []com
 		return nil
 	}
 	var dispatches []commandDispatch
-	if live.room.PlaybackState == RoomPlaybackStateWaiting && live.command != nil && live.command.SelectionRevision == live.room.SelectionRevision {
-		dispatches = s.targetedCommandDispatchesLocked(live, sessionID, *live.command)
+	waiting := s.waitingCommandForLocked(live, sessionID)
+	if live.room.PlaybackState == RoomPlaybackStateWaiting && waiting != nil && waiting.SelectionRevision == live.room.SelectionRevision {
+		dispatches = s.targetedCommandDispatchesLocked(live, sessionID, *waiting)
 	} else {
-		position := expectedPosition(live.room, s.now())
+		executeAt := s.nextExecuteAtLocked(live, s.now())
+		position := expectedPosition(live.room, executeAt)
 		action := TransportActionPause
 		if live.room.PlaybackState == RoomPlaybackStatePlaying {
 			action = TransportActionPlay
@@ -2385,7 +2764,7 @@ func (s *Service) syncMemberToRoomLocked(live *liveRoom, sessionID string) []com
 			SelectionRevision: live.room.SelectionRevision,
 			Action:            action,
 			PositionSeconds:   math.Max(0, position),
-			ExecuteAt:         s.now().Add(s.highestPingLocked(live)).UTC().Format(time.RFC3339Nano),
+			ExecuteAt:         executeAt.UTC().Format(time.RFC3339Nano),
 			IssuedAt:          s.now().UTC().Format(time.RFC3339Nano),
 			PlaybackState:     live.room.PlaybackState,
 		})
@@ -2602,8 +2981,7 @@ func (s *Service) Vote(
 	}
 
 	s.mu.Lock()
-	live := s.rooms[roomID]
-	if live != nil {
+	if live := s.rooms[roomID]; live != nil {
 		dispatches := s.prepareSuggestionDispatchesLocked(live, suggestions)
 		s.mu.Unlock()
 		s.sendDispatches(ctx, dispatches)
@@ -2649,8 +3027,7 @@ func (s *Service) Unvote(
 	}
 
 	s.mu.Lock()
-	live := s.rooms[roomID]
-	if live != nil {
+	if live := s.rooms[roomID]; live != nil {
 		dispatches := s.prepareSuggestionDispatchesLocked(live, suggestions)
 		s.mu.Unlock()
 		s.sendDispatches(ctx, dispatches)
diff --git a/internal/watchtogether/service_test.go b/internal/watchtogether/service_test.go
index bf775cf049..cfdd3d4aad 100644
--- a/internal/watchtogether/service_test.go
+++ b/internal/watchtogether/service_test.go
@@ -398,10 +398,24 @@ func TestGuestDriftCorrectionIsCoalescedAndRearmed(t *testing.T) {
 	if _, err := service.HandleStateReportForConnection(t.Context(), reg, 8, "guest", report); err != nil {
 		t.Fatal(err)
 	}
-	first := lastTransport(t, conn)
+	if got := transportCount(conn); got != 0 {
+		t.Fatalf("a single drifted report dispatched %d corrections, want 0", got)
+	}
 	if _, err := service.HandleStateReportForConnection(t.Context(), reg, 8, "guest", report); err != nil {
 		t.Fatal(err)
 	}
+	first := lastTransport(t, conn)
+	if first.PositionSeconds != expectedAtExecution(t, repo.room, first) {
+		t.Fatalf("correction = %+v, want the room's position at its execution", first)
+	}
+	// Past the correction's settle window, sustained drift is not corrected
+	// again until the retry interval has passed.
+	current = current.Add(commandSettleWindow + time.Second)
+	for range guestCorrectionStrikes {
+		if _, err := service.HandleStateReportForConnection(t.Context(), reg, 8, "guest", report); err != nil {
+			t.Fatal(err)
+		}
+	}
 	if got := transportCount(conn); got != 1 {
 		t.Fatalf("repeated drift report dispatched %d corrections, want 1", got)
 	}
@@ -418,6 +432,7 @@ func TestGuestDriftCorrectionIsCoalescedAndRearmed(t *testing.T) {
 		t.Fatalf("retry reused command ID %q", second.CommandID)
 	}
 
+	current = current.Add(commandSettleWindow + time.Second)
 	expected := expectedPosition(repo.room, current)
 	if _, err := service.HandleStateReportForConnection(t.Context(), reg, 8, "guest", StateReport{
 		SessionID:       "session-1",
@@ -425,8 +440,10 @@ func TestGuestDriftCorrectionIsCoalescedAndRearmed(t *testing.T) {
 	}); err != nil {
 		t.Fatal(err)
 	}
-	if _, err := service.HandleStateReportForConnection(t.Context(), reg, 8, "guest", report); err != nil {
-		t.Fatal(err)
+	for range guestCorrectionStrikes {
+		if _, err := service.HandleStateReportForConnection(t.Context(), reg, 8, "guest", report); err != nil {
+			t.Fatal(err)
+		}
 	}
 	if got := transportCount(conn); got != 3 {
 		t.Fatalf("in-sync report did not re-arm correction, got %d corrections, want 3", got)
@@ -436,8 +453,12 @@ func TestGuestDriftCorrectionIsCoalescedAndRearmed(t *testing.T) {
 // transportCount counts the transport commands a connection received,
 // ignoring snapshots.
 func transportCount(conn *recordingConn) int {
+	return transportCountIn(conn.payloads)
+}
+
+func transportCountIn(payloads []map[string]any) int {
 	count := 0
-	for _, payload := range conn.payloads {
+	for _, payload := range payloads {
 		if _, ok := payload["command"].(TransportCommand); ok {
 			count++
 		}
@@ -1005,8 +1026,10 @@ func TestBufferingReportCannotTeleportRoomAnchor(t *testing.T) {
 	if snapshot.PlaybackState != RoomPlaybackStateWaiting {
 		t.Fatalf("playback state = %q, want %q", snapshot.PlaybackState, RoomPlaybackStateWaiting)
 	}
-	if snapshot.AnchorPositionSeconds > 20.001 || snapshot.AnchorPositionSeconds < 19.999 {
-		t.Fatalf("anchor = %v, want ~20 (clamped)", snapshot.AnchorPositionSeconds)
+	// Clamped to the room's position when the pause executes, one lead on.
+	want := 20 + defaultTransportLead.Seconds()
+	if snapshot.AnchorPositionSeconds > want+0.001 || snapshot.AnchorPositionSeconds < want-0.001 {
+		t.Fatalf("anchor = %v, want ~%v (clamped)", snapshot.AnchorPositionSeconds, want)
 	}
 }
 
@@ -1137,7 +1160,7 @@ func TestStateReportConflictClearsStaleCorrectionCommands(t *testing.T) {
 		registrationFor(repo.room.ID, 7, "host", hostConn),
 		7,
 		"host",
-		StateReport{SessionID: "host-session", PositionSeconds: 30},
+		StateReport{SessionID: "host-session", PositionSeconds: 20 + hostAuthorityDriftSeconds + 5},
 	)
 	if err != nil {
 		t.Fatalf("HandleStateReportForConnection() error = %v", err)
@@ -1202,6 +1225,12 @@ func TestHostPauseReportPausesTheRoom(t *testing.T) {
 	if f.s.rooms[f.repo.room.ID].command == nil {
 		t.Fatal("explicit pause left no room command")
 	}
+	// A report racing the pause command describes the state before it.
+	hostReport(false)
+	if f.repo.room.PlaybackState != RoomPlaybackStatePaused {
+		t.Fatalf("a host report inside the pause's settle window moved the room to %s", f.repo.room.PlaybackState)
+	}
+	f.now = f.now.Add(commandSettleWindow + time.Second)
 	hostReport(false)
 	if f.repo.room.PlaybackState != RoomPlaybackStatePlaying || !f.repo.room.ResumeOnReady {
 		t.Fatalf("room = %s, resume on ready %v; want playing with resume", f.repo.room.PlaybackState, f.repo.room.ResumeOnReady)
@@ -1211,6 +1240,7 @@ func TestHostPauseReportPausesTheRoom(t *testing.T) {
 	}
 
 	// After another pause, a guest stall does not arm a barrier that resumes the room.
+	f.now = f.now.Add(commandSettleWindow + time.Second)
 	hostReport(true)
 	f.buffer("guest")
 	if f.repo.room.PlaybackState != RoomPlaybackStatePaused || f.repo.room.ResumeOnReady {
@@ -1248,18 +1278,20 @@ func TestReadyAcknowledgesCurrentSeek(t *testing.T) {
 			member := &memberState{userID: 7, profileID: "host", sessionID: "session", connection: conn}
 			live.members[buildMemberKey(7, "host")] = member
 			reg := registrationFor(repo.room.ID, 7, "host", conn)
-			seek := func() TransportCommand {
+			seek := func(target float64) TransportCommand {
 				t.Helper()
 				_, err := service.HandleTransportRequestForConnection(t.Context(), reg, 7, "host", TransportRequest{
-					Action: TransportActionSeek, PositionSeconds: new(1500.0),
+					Action: TransportActionSeek, PositionSeconds: &target,
 				})
 				if err != nil {
 					t.Fatal(err)
 				}
 				return conn.payloads[len(conn.payloads)-1]["command"].(TransportCommand)
 			}
-			previous := seek()
-			current := seek()
+			// A repeat of the pending target is the same seek, so the earlier
+			// seek goes elsewhere.
+			previous := seek(1400)
+			current := seek(1500)
 			commandID := current.CommandID
 			if test.staleCommand {
 				commandID = previous.CommandID
@@ -1312,6 +1344,8 @@ func TestHostRejoinReportsDoNotRewindTheRoomUntilSynced(t *testing.T) {
 		&stubFiles{file: &models.MediaFile{ID: 42, ContentID: "movie-1"}},
 		nil,
 	)
+	current := now
+	service.now = func() time.Time { return current }
 	service.rooms[repo.room.ID].members[buildMemberKey(7, "host")] = &memberState{userID: 7, profileID: "host", connection: conn}
 	reg := registrationFor(repo.room.ID, 7, "host", conn)
 	if _, err := service.AttachSessionForConnection(context.Background(), reg, 7, "host", "session-1"); err != nil {
@@ -1322,10 +1356,20 @@ func TestHostRejoinReportsDoNotRewindTheRoomUntilSynced(t *testing.T) {
 	}
 	before := len(conn.payloads)
 
-	// Stream just started: position 0 while the room is at ~600.
+	// Stream just started: position 0 while the room is at ~600. Inside the
+	// sync's settle window that is the stream before the sync, not drift.
 	if _, err := service.HandleStateReportForConnection(context.Background(), reg, 7, "host", StateReport{SessionID: "session-1", PositionSeconds: 0, IsPaused: false}); err != nil {
 		t.Fatalf("report: %v", err)
 	}
+	if repo.room.AnchorPositionSeconds != 600 || len(conn.payloads) != before {
+		t.Fatalf("host's pre-seek report moved the room to %v or was corrected", repo.room.AnchorPositionSeconds)
+	}
+	current = current.Add(commandSettleWindow + time.Second)
+	for range guestCorrectionStrikes {
+		if _, err := service.HandleStateReportForConnection(context.Background(), reg, 7, "host", StateReport{SessionID: "session-1", PositionSeconds: 0, IsPaused: false}); err != nil {
+			t.Fatalf("report: %v", err)
+		}
+	}
 	if repo.room.AnchorPositionSeconds != 600 {
 		t.Fatalf("host's pre-seek report rewound the room to %v", repo.room.AnchorPositionSeconds)
 	}
@@ -1341,14 +1385,16 @@ func TestHostRejoinReportsDoNotRewindTheRoomUntilSynced(t *testing.T) {
 	}
 
 	// The seek landed: the host now reports the room's position and becomes authoritative again.
-	if _, err := service.HandleStateReportForConnection(context.Background(), reg, 7, "host", StateReport{SessionID: "session-1", PositionSeconds: 600.4, IsPaused: false}); err != nil {
+	current = current.Add(commandSettleWindow + time.Second)
+	if _, err := service.HandleStateReportForConnection(context.Background(), reg, 7, "host", StateReport{SessionID: "session-1", PositionSeconds: expectedPosition(repo.room, current) + 0.4, IsPaused: false}); err != nil {
 		t.Fatalf("synced report: %v", err)
 	}
 	if _, err := service.HandleStateReportForConnection(context.Background(), reg, 7, "host", StateReport{SessionID: "session-1", PositionSeconds: 650, IsPaused: false}); err != nil {
 		t.Fatalf("authoritative report: %v", err)
 	}
-	if repo.room.AnchorPositionSeconds != 650 {
-		t.Fatalf("host authority not restored after sync: anchor=%v", repo.room.AnchorPositionSeconds)
+	// The host keeps playing until its command runs, one lead later.
+	if want := 650 + defaultTransportLead.Seconds(); repo.room.AnchorPositionSeconds != want {
+		t.Fatalf("host authority not restored after sync: anchor=%v, want %v", repo.room.AnchorPositionSeconds, want)
 	}
 }
 
diff --git a/internal/watchtogether/suggestion_create_once_test.go b/internal/watchtogether/suggestion_create_once_test.go
index 6f15315d0c..fb5a113218 100644
--- a/internal/watchtogether/suggestion_create_once_test.go
+++ b/internal/watchtogether/suggestion_create_once_test.go
@@ -41,7 +41,7 @@ func TestSuggestionCreationBroadcastOnlyOnInsertion(t *testing.T) {
 				t.Fatalf("first: %v", err)
 			}
 			id, err := s.CreateSuggestionWithIdentity(t.Context(), "room-1", "request", 7, "host", input)
-			if err != nil || id != "request" || store.calls != 2 || store.lists != 1 || store.input.CreatedAt != now || store.input.SuggesterUserID != 7 || store.input.SuggesterProfileID != "host" {
+			if err != nil || id != "request" || store.calls != 2 || store.lists != 1 || !store.input.CreatedAt.Equal(now) || store.input.SuggesterUserID != 7 || store.input.SuggesterProfileID != "host" {
 				t.Fatalf("retry %s %v %+v", id, err, store)
 			}
 			want := 1
diff --git a/internal/watchtogether/sync_timing_test.go b/internal/watchtogether/sync_timing_test.go
new file mode 100644
index 0000000000..80638894cc
--- /dev/null
+++ b/internal/watchtogether/sync_timing_test.go
@@ -0,0 +1,857 @@
+package watchtogether
+
+import (
+	"math"
+	"testing"
+	"time"
+)
+
+// A member that runs every command at its execute_at, projecting from it at
+// 1x, is exactly where the room says it is. A slow member raises the lead for
+// everyone; that must not show up as drift on the members who are in sync.
+func TestMembersRunningCommandsOnTimeStayInSyncWithASlowMember(t *testing.T) {
+	f := newBufferingRoom(t, "ann", "bob", "far")
+	f.member("far").lastPingMS = 1800
+
+	position := f.expected()
+	if _, err := f.s.HandleTransportRequestForConnection(t.Context(), f.reg("host"), 7, "host",
+		TransportRequest{Action: TransportActionPause, PositionSeconds: &position}); err != nil {
+		t.Fatal(err)
+	}
+	f.now = f.now.Add(5 * time.Second)
+	if _, err := f.s.HandleTransportRequestForConnection(t.Context(), f.reg("host"), 7, "host",
+		TransportRequest{Action: TransportActionPlay}); err != nil {
+		t.Fatal(err)
+	}
+	play := lastTransport(t, f.conns["ann"])
+	if play.Action != TransportActionPlay {
+		t.Fatalf("room command = %+v, want play", play)
+	}
+	executeAt, err := time.Parse(time.RFC3339Nano, play.ExecuteAt)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if lead := executeAt.Sub(f.now); lead != 1800*time.Millisecond {
+		t.Fatalf("lead = %v, want the slow member's round trip", lead)
+	}
+
+	anchor, generation := f.repo.room.AnchorPositionSeconds, f.repo.room.Generation
+	counts := map[string]int{}
+	for profile, conn := range f.conns {
+		counts[profile] = transportCount(conn)
+	}
+	for range 40 {
+		f.now = f.now.Add(1500 * time.Millisecond)
+		local := play.PositionSeconds + max(0, f.now.Sub(executeAt).Seconds())
+		for profile := range f.conns {
+			f.report(profile, local)
+		}
+	}
+	for profile, conn := range f.conns {
+		if got := transportCount(conn); got != counts[profile] {
+			t.Fatalf("%s received %d corrections while in sync", profile, got-counts[profile])
+		}
+	}
+	if f.repo.room.AnchorPositionSeconds != anchor || f.repo.room.Generation != generation {
+		t.Fatalf("in-sync reports moved the room: anchor %v -> %v", anchor, f.repo.room.AnchorPositionSeconds)
+	}
+}
+
+// A guest's stall may pause the room, but the room waits where it is: the
+// other viewers stay put and only the stalled guest is moved, forward to the
+// pause point, which the barrier holds it to.
+func TestBufferingPauseMovesOnlyTheStalledMember(t *testing.T) {
+	f := newBufferingRoom(t, "ann", "bob")
+	f.now = f.now.Add(30 * time.Second)
+	expected := f.expected()
+
+	snapshot, err := f.s.HandleBufferingForConnection(t.Context(), f.reg("ann"), f.userID("ann"), "ann",
+		StateReport{SessionID: "ann-session", PositionSeconds: expected - 3})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if snapshot.PlaybackState != RoomPlaybackStateWaiting {
+		t.Fatalf("stall did not pause the room: %s", snapshot.PlaybackState)
+	}
+	anchor := f.repo.room.AnchorPositionSeconds
+	if anchor < expected {
+		t.Fatalf("stall rewound the room from %v to %v", expected, anchor)
+	}
+	for _, profile := range []string{"host", "bob"} {
+		command := lastTransport(t, f.conns[profile])
+		if command.Action != TransportActionPause || command.PositionSeconds != anchor {
+			t.Fatalf("%s command = %+v, want pause at %v", profile, command, anchor)
+		}
+	}
+	seek := lastTransport(t, f.conns["ann"])
+	if seek.Action != TransportActionSeek || seek.PlaybackState != RoomPlaybackStateWaiting || seek.PositionSeconds != anchor {
+		t.Fatalf("stalled member command = %+v, want a waiting seek to %v", seek, anchor)
+	}
+
+	f.ready("host", anchor)
+	f.ready("bob", anchor)
+	if f.ready("ann", expected-3).PlaybackState != RoomPlaybackStateWaiting {
+		t.Fatal("the stalled member's old position satisfied the barrier")
+	}
+	// A rebuilt stream may land a few seconds short; a ready naming the seek
+	// proves it ran, and the member nudges the rest once the room plays.
+	landed, err := f.s.HandleReadyForConnection(t.Context(), f.reg("ann"), f.userID("ann"), "ann",
+		StateReport{SessionID: "ann-session", CommandID: seek.CommandID, PositionSeconds: anchor - 3})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if landed.PlaybackState != RoomPlaybackStatePlaying {
+		t.Fatal("the room did not resume once the stalled member ran its seek")
+	}
+
+	// A stall seek left over from an earlier wait earns no extra tolerance.
+	stale := seek
+	live0 := f.s.rooms[f.repo.room.ID]
+	savedRoom, savedCommand := live0.room, live0.command
+	live0.room.PlaybackState = RoomPlaybackStateWaiting
+	live0.command = &TransportCommand{CommandID: "next-wait", SelectionRevision: seek.SelectionRevision,
+		Action: TransportActionPause, IssuedAt: f.now.Add(time.Minute).Format(time.RFC3339Nano)}
+	if isStallSeekLocked(live0, &stale) {
+		t.Fatal("a stall seek from an earlier wait counted as this wait's")
+	}
+	live0.room, live0.command = savedRoom, savedCommand
+
+	// Once the room resumes, its play is the member's command, even when the
+	// clock has not moved since the wait began.
+	live := f.s.rooms[f.repo.room.ID]
+	f.member("ann").waitingCommand = &seek
+	if got := f.s.waitingCommandForLocked(live, "ann-session"); got.CommandID != live.command.CommandID || got.Action != TransportActionPlay {
+		t.Fatalf("after the resume, waiting command = %+v, want the room's play", got)
+	}
+
+	// A reconnect during a later wait gets that wait's command, not this seek.
+	live.room.PlaybackState = RoomPlaybackStateWaiting
+	live.command = &TransportCommand{CommandID: "later", SelectionRevision: seek.SelectionRevision,
+		Action: TransportActionPause, IssuedAt: f.now.Add(time.Minute).Format(time.RFC3339Nano)}
+	if got := f.s.waitingCommandForLocked(live, "ann-session"); got.CommandID != "later" {
+		t.Fatalf("waiting command = %+v, want the current wait's", got)
+	}
+}
+
+// A report sent before a command ran describes the state the command
+// replaces. It is not corrected, and once the command has settled a pause
+// mismatch is corrected at once.
+func TestReportsWhileACommandSettlesAreNotCorrected(t *testing.T) {
+	f := newBufferingRoom(t, "guest")
+	f.now = f.now.Add(10 * time.Second)
+	position := f.expected()
+	if _, err := f.s.HandleTransportRequestForConnection(t.Context(), f.reg("host"), 7, "host",
+		TransportRequest{Action: TransportActionPause, PositionSeconds: &position}); err != nil {
+		t.Fatal(err)
+	}
+	pause := lastTransport(t, f.conns["guest"])
+	still := transportCount(f.conns["guest"])
+
+	f.now = f.now.Add(200 * time.Millisecond)
+	if _, err := f.s.HandleStateReportForConnection(t.Context(), f.reg("guest"), f.userID("guest"), "guest",
+		StateReport{SessionID: "guest-session", PositionSeconds: position + 0.2, IsPaused: false}); err != nil {
+		t.Fatal(err)
+	}
+	if got := transportCount(f.conns["guest"]); got != still {
+		t.Fatalf("a report racing the pause was corrected %d times", got-still)
+	}
+
+	f.now = f.now.Add(defaultTransportLead + commandSettleWindow)
+	if _, err := f.s.HandleStateReportForConnection(t.Context(), f.reg("guest"), f.userID("guest"), "guest",
+		StateReport{SessionID: "guest-session", PositionSeconds: pause.PositionSeconds + 2, IsPaused: false}); err != nil {
+		t.Fatal(err)
+	}
+	if command := lastTransport(t, f.conns["guest"]); command.Action != TransportActionPause || command.CommandID == pause.CommandID {
+		t.Fatalf("a settled pause mismatch was not corrected: %+v", command)
+	}
+}
+
+// One slow round trip does not move every command's lead, and no member can
+// push the lead past maxTransportLead.
+func TestMemberLatencyIsSmoothedAndBounded(t *testing.T) {
+	f := newBufferingRoom(t)
+	ping := func(ms int64) {
+		t.Helper()
+		if err := f.s.HandlePingForConnection(t.Context(), f.reg("host"), 7, "host", ms); err != nil {
+			t.Fatal(err)
+		}
+	}
+	ping(100)
+	ping(900)
+	if got := f.member("host").lastPingMS; got != 300 {
+		t.Fatalf("smoothed ping = %d, want 300", got)
+	}
+	// Queueing only adds delay, so a faster round trip is taken at once.
+	ping(80)
+	if got := f.member("host").lastPingMS; got != 80 {
+		t.Fatalf("ping after a faster sample = %d, want 80", got)
+	}
+	for range 40 {
+		ping(60_000)
+	}
+	if got := f.s.highestPingLocked(f.s.rooms[f.repo.room.ID]); got > maxTransportLead || got < maxTransportLead-10*time.Millisecond {
+		t.Fatalf("lead = %v, want at most and near the %v bound", got, maxTransportLead)
+	}
+}
+
+// The room starts advancing when members run a play, so the anchor is taken at
+// the command's execute_at and every command carries that position.
+func TestPlayAndResumeAnchorTheRoomAtExecution(t *testing.T) {
+	f := newBufferingRoom(t, "guest")
+	f.member("guest").lastPingMS = 1200
+	position := f.expected()
+	if _, err := f.s.HandleTransportRequestForConnection(t.Context(), f.reg("host"), 7, "host",
+		TransportRequest{Action: TransportActionPause, PositionSeconds: &position}); err != nil {
+		t.Fatal(err)
+	}
+	f.now = f.now.Add(5 * time.Second)
+	if _, err := f.s.HandleTransportRequestForConnection(t.Context(), f.reg("host"), 7, "host",
+		TransportRequest{Action: TransportActionPlay}); err != nil {
+		t.Fatal(err)
+	}
+	assertAnchoredAtExecution := func(what string) {
+		t.Helper()
+		command := lastTransport(t, f.conns["guest"])
+		executeAt, err := time.Parse(time.RFC3339Nano, command.ExecuteAt)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if !f.repo.room.AnchorUpdatedAt.Equal(executeAt) {
+			t.Fatalf("%s anchored at %v, want its execute_at %v", what, f.repo.room.AnchorUpdatedAt, executeAt)
+		}
+		for _, later := range []time.Duration{0, 3 * time.Second} {
+			want := command.PositionSeconds + later.Seconds()
+			if got := expectedPosition(f.repo.room, executeAt.Add(later)); got != want {
+				t.Fatalf("%s: room at execute_at+%v = %v, want %v", what, later, got, want)
+			}
+		}
+	}
+	assertAnchoredAtExecution("play")
+
+	// A seek's barrier resumes the same way.
+	f.now = f.now.Add(10 * time.Second)
+	target := 500.0
+	if _, err := f.s.HandleTransportRequestForConnection(t.Context(), f.reg("host"), 7, "host",
+		TransportRequest{Action: TransportActionSeek, PositionSeconds: &target}); err != nil {
+		t.Fatal(err)
+	}
+	f.now = f.now.Add(2 * time.Second)
+	f.resumeAll()
+	assertAnchoredAtExecution("resume")
+}
+
+// A socket renewal during a stall wait resends the stalled member its own
+// seek, so it cannot ready up where it stalled.
+func TestReconcilerResendsTheStalledMembersSeek(t *testing.T) {
+	f := newBufferingRoom(t, "ann", "bob")
+	f.now = f.now.Add(30 * time.Second)
+	if _, err := f.s.HandleBufferingForConnection(t.Context(), f.reg("ann"), f.userID("ann"), "ann",
+		StateReport{SessionID: "ann-session", PositionSeconds: f.expected() - 3}); err != nil {
+		t.Fatal(err)
+	}
+	seek := lastTransport(t, f.conns["ann"])
+	f.member("ann").lastCommandID = "" // a renewed socket has delivered nothing yet
+	if err := f.s.reconcileRoom(t.Context(), f.repo.room.ID); err != nil {
+		t.Fatal(err)
+	}
+	if resent := lastTransport(t, f.conns["ann"]); resent.Action != TransportActionSeek || resent.CommandID != seek.CommandID {
+		t.Fatalf("reconciler resent %+v, want the stall seek %s", resent, seek.CommandID)
+	}
+	if got := f.member("ann").waitingCommand; got == nil || got.CommandID != seek.CommandID {
+		t.Fatalf("waiting command = %+v, want the stall seek", got)
+	}
+}
+
+// A stalled host is followed: the room waits at the host's position, because
+// the host's ready would re-anchor the room wherever its stream lands anyway.
+func TestStalledHostPausesTheRoomAtItsPosition(t *testing.T) {
+	f := newBufferingRoom(t, "ann")
+	f.now = f.now.Add(30 * time.Second)
+	stalledAt := f.expected() - 3
+	if _, err := f.s.HandleBufferingForConnection(t.Context(), f.reg("host"), 7, "host",
+		StateReport{SessionID: "host-session", PositionSeconds: stalledAt}); err != nil {
+		t.Fatal(err)
+	}
+	if f.repo.room.PlaybackState != RoomPlaybackStateWaiting || f.repo.room.AnchorPositionSeconds != stalledAt {
+		t.Fatalf("room %s at %v, want waiting at the host's %v", f.repo.room.PlaybackState, f.repo.room.AnchorPositionSeconds, stalledAt)
+	}
+	if command := lastTransport(t, f.conns["host"]); command.Action != TransportActionPause {
+		t.Fatalf("host command = %+v, want the room pause", command)
+	}
+}
+
+// A report naming the command its client last applied, with the play state
+// that command set, describes the state after it and is taken at once. One
+// that contradicts the command inside its settle window can trail the player
+// by a sample, so it waits for the window to end.
+func TestReportNamingTheLatestCommandEndsTheSettleWindow(t *testing.T) {
+	f := newBufferingRoom(t, "guest")
+	f.now = f.now.Add(10 * time.Second)
+	if _, err := f.s.HandleTransportRequestForConnection(t.Context(), f.reg("host"), 7, "host",
+		TransportRequest{Action: TransportActionPlay}); err != nil {
+		t.Fatal(err)
+	}
+	play := lastTransport(t, f.conns["guest"])
+	hostReport := func(paused bool) {
+		t.Helper()
+		if _, err := f.s.HandleStateReportForConnection(t.Context(), f.reg("host"), 7, "host",
+			StateReport{SessionID: "host-session", CommandID: play.CommandID, PositionSeconds: f.expected(), IsPaused: paused}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	guestReport := func() {
+		t.Helper()
+		if _, err := f.s.HandleStateReportForConnection(t.Context(), f.reg("guest"), f.userID("guest"), "guest",
+			StateReport{SessionID: "guest-session", CommandID: play.CommandID, PositionSeconds: f.expected() - 3}); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	// Matching the play, the guest's drift counts at once.
+	f.now = f.now.Add(time.Second)
+	before := transportCount(f.conns["guest"])
+	for range guestCorrectionStrikes + 1 {
+		guestReport()
+	}
+	if transportCount(f.conns["guest"]) == before {
+		t.Fatal("drift reported after the guest ran the play was held by the settle window")
+	}
+
+	// A paused report naming the play, inside its window, is not taken.
+	hostReport(true)
+	if f.repo.room.PlaybackState != RoomPlaybackStatePlaying {
+		t.Fatalf("a report contradicting the play inside its window moved the room to %s", f.repo.room.PlaybackState)
+	}
+	// After the window the same report is the host's decision.
+	f.now = f.now.Add(commandSettleWindow + time.Second)
+	hostReport(true)
+	if f.repo.room.PlaybackState != RoomPlaybackStatePaused {
+		t.Fatalf("the host's pause after the window was not taken: room %s", f.repo.room.PlaybackState)
+	}
+}
+
+// A member that is not closing its drift is corrected; drift measured before a
+// correction says nothing about the state after it, so the count starts over.
+func TestCorrectionStartsTheStrikesOver(t *testing.T) {
+	f := newBufferingRoom(t, "guest")
+	f.now = f.now.Add(10 * time.Second)
+	stuck := func() {
+		t.Helper()
+		for range guestCorrectionStrikes + 1 {
+			f.report("guest", f.expected()-3)
+		}
+	}
+	stuck()
+	first := transportCount(f.conns["guest"])
+	if first == 0 {
+		t.Fatal("sustained drift was not corrected")
+	}
+	f.now = f.now.Add(guestCorrectionRetryInterval + time.Second)
+	f.report("guest", f.expected()-2.5)
+	if got := transportCount(f.conns["guest"]); got != first {
+		t.Fatalf("one report after a correction was corrected again (%d corrections)", got)
+	}
+	f.report("guest", f.expected()-2.5)
+	f.report("guest", f.expected()-2.5)
+	if got := transportCount(f.conns["guest"]); got != first+1 {
+		t.Fatalf("sustained drift after a correction dispatched %d corrections, want 1", got-first)
+	}
+}
+
+// A member closing its drift by rate is left to it; correcting it again would
+// only restart its convergence. One that stops closing it is corrected.
+func TestConvergingMemberIsNotCorrectedAgain(t *testing.T) {
+	f := newBufferingRoom(t, "guest")
+	f.now = f.now.Add(10 * time.Second)
+	drift := 3.0
+	for range 20 { // about 30 s at 4 percent
+		f.now = f.now.Add(1500 * time.Millisecond)
+		f.report("guest", f.expected()-drift)
+		drift -= 0.06
+	}
+	if got := transportCount(f.conns["guest"]); got != 0 {
+		t.Fatalf("a converging member was corrected %d times", got)
+	}
+	for range 3 {
+		f.now = f.now.Add(1500 * time.Millisecond)
+		f.report("guest", f.expected()-drift)
+	}
+	if got := transportCount(f.conns["guest"]); got != 1 {
+		t.Fatalf("a member that stopped converging got %d corrections, want 1", got)
+	}
+}
+
+// A command scheduled after the lead drops never runs before the room's own
+// play, which would start its member ahead of everyone.
+func TestCommandsNeverRunBeforeTheRoomsOwnCommand(t *testing.T) {
+	f := newBufferingRoom(t, "ann", "far")
+	f.member("far").lastPingMS = 1800
+	position := f.expected()
+	if _, err := f.s.HandleTransportRequestForConnection(t.Context(), f.reg("host"), 7, "host",
+		TransportRequest{Action: TransportActionPause, PositionSeconds: &position}); err != nil {
+		t.Fatal(err)
+	}
+	f.now = f.now.Add(5 * time.Second)
+	if _, err := f.s.HandleTransportRequestForConnection(t.Context(), f.reg("host"), 7, "host",
+		TransportRequest{Action: TransportActionPlay}); err != nil {
+		t.Fatal(err)
+	}
+	play := lastTransport(t, f.conns["ann"])
+	if err := f.s.HandlePingForConnection(t.Context(), f.reg("far"), f.userID("far"), "far", 100); err != nil {
+		t.Fatal(err)
+	}
+	f.now = f.now.Add(100 * time.Millisecond)
+	f.s.mu.Lock()
+	dispatches := f.s.syncMemberToRoomLocked(f.s.rooms[f.repo.room.ID], "ann-session")
+	f.s.mu.Unlock()
+	f.s.sendCommandDispatches(t.Context(), dispatches)
+	sync := lastTransport(t, f.conns["ann"])
+	if sync.CommandID == play.CommandID {
+		t.Fatal("no sync was sent")
+	}
+	if sync.ExecuteAt < play.ExecuteAt || sync.PositionSeconds != play.PositionSeconds {
+		t.Fatalf("sync %+v runs before the room's play %+v", sync, play)
+	}
+}
+
+// A report naming an older command than the member was last sent predates the
+// newest one, however slow the member is, until namedCommandWait.
+func TestReportNamingAnOlderCommandPredatesTheNewest(t *testing.T) {
+	f := newBufferingRoom(t, "guest")
+	f.now = f.now.Add(10 * time.Second)
+	if _, err := f.s.HandleTransportRequestForConnection(t.Context(), f.reg("host"), 7, "host",
+		TransportRequest{Action: TransportActionPlay}); err != nil {
+		t.Fatal(err)
+	}
+	older := lastTransport(t, f.conns["host"])
+	f.now = f.now.Add(10 * time.Second)
+	position := f.expected()
+	if _, err := f.s.HandleTransportRequestForConnection(t.Context(), f.reg("host"), 7, "host",
+		TransportRequest{Action: TransportActionPause, PositionSeconds: &position}); err != nil {
+		t.Fatal(err)
+	}
+	// Past the pause's settle window, a slow host's report still names the play.
+	f.now = f.now.Add(4 * time.Second)
+	if _, err := f.s.HandleStateReportForConnection(t.Context(), f.reg("host"), 7, "host",
+		StateReport{SessionID: "host-session", CommandID: older.CommandID, PositionSeconds: position + 4}); err != nil {
+		t.Fatal(err)
+	}
+	if f.repo.room.PlaybackState != RoomPlaybackStatePaused {
+		t.Fatalf("a report from before the pause resumed the room: %s", f.repo.room.PlaybackState)
+	}
+}
+
+// A report naming the member's last command settles early only if the room's
+// latest command reached the member too; on another API server it may not have.
+func TestReportNamingItsCommandWaitsForAnUndeliveredRoomCommand(t *testing.T) {
+	f := newBufferingRoom(t, "guest")
+	f.now = f.now.Add(10 * time.Second)
+	if _, err := f.s.HandleTransportRequestForConnection(t.Context(), f.reg("host"), 7, "host",
+		TransportRequest{Action: TransportActionPlay}); err != nil {
+		t.Fatal(err)
+	}
+	play := lastTransport(t, f.conns["host"])
+	f.now = f.now.Add(10 * time.Second)
+	position := f.expected()
+	if _, err := f.s.HandleTransportRequestForConnection(t.Context(), f.reg("host"), 7, "host",
+		TransportRequest{Action: TransportActionPause, PositionSeconds: &position}); err != nil {
+		t.Fatal(err)
+	}
+	// As if the pause came from another server and was not yet forwarded here.
+	host := f.member("host")
+	host.lastCommandID, host.lastSentCommandID, host.lastSentPaused = play.CommandID, play.CommandID, false
+	host.settleUntil = time.Time{}
+	f.now = f.now.Add(500 * time.Millisecond)
+	if _, err := f.s.HandleStateReportForConnection(t.Context(), f.reg("host"), 7, "host",
+		StateReport{SessionID: "host-session", CommandID: play.CommandID, PositionSeconds: position + 0.5}); err != nil {
+		t.Fatal(err)
+	}
+	if f.repo.room.PlaybackState != RoomPlaybackStatePaused {
+		t.Fatalf("a report from before an undelivered pause resumed the room: %s", f.repo.room.PlaybackState)
+	}
+}
+
+// A host still closing a gap by rate after a sync has run it: a pause from its
+// system controls is the room's again once the sync has settled.
+func TestSyncingHostThatRanItsSyncCanPause(t *testing.T) {
+	f, sync := newSyncingHost(t)
+	f.now = f.now.Add(commandSettleWindow + time.Second)
+	f.hostReport(sync.CommandID, f.expected(), false)
+	if f.member("host").syncingToRoom {
+		t.Fatal("a host playing its sync at the room's position is still syncing")
+	}
+	f.now = f.now.Add(1500 * time.Millisecond)
+	f.hostReport(sync.CommandID, f.expected(), true)
+	if f.repo.room.PlaybackState != RoomPlaybackStatePaused {
+		t.Fatalf("the synced host's pause was not taken: room %s", f.repo.room.PlaybackState)
+	}
+}
+
+// A host whose play was refused (a browser blocking autoplay after a reload)
+// names its sync while paused. That is not a pause the room should follow.
+func TestSyncingHostWhosePlayWasRefusedDoesNotPauseTheRoom(t *testing.T) {
+	f, sync := newSyncingHost(t)
+	before := transportCount(f.conns["host"])
+	f.now = f.now.Add(commandSettleWindow + time.Second)
+	f.hostReport(sync.CommandID, f.expected()-3, true)
+	if f.repo.room.PlaybackState != RoomPlaybackStatePlaying || !f.member("host").syncingToRoom {
+		t.Fatalf("a host that never started its sync paused the room: room %s, syncing %v",
+			f.repo.room.PlaybackState, f.member("host").syncingToRoom)
+	}
+	if transportCount(f.conns["host"]) == before {
+		t.Fatal("the paused host was not corrected back to the room")
+	}
+}
+
+// A host whose sync correction never loaded names the sync from its old
+// stream. Far from the room, that is not a decision to rewind everyone to.
+func TestSyncingHostFarFromTheRoomDoesNotRewindIt(t *testing.T) {
+	f, sync := newSyncingHost(t)
+	f.now = f.now.Add(commandSettleWindow + time.Second)
+	expected := f.expected()
+	f.hostReport(sync.CommandID, expected-60, false)
+	if got := f.expected(); math.Abs(got-expected) > 0.5 || !f.member("host").syncingToRoom {
+		t.Fatalf("room moved from %.1f to %.1f (syncing %v)", expected, got, f.member("host").syncingToRoom)
+	}
+}
+
+func newSyncingHost(t *testing.T) (*bufferingRoom, TransportCommand) {
+	t.Helper()
+	f := newBufferingRoom(t, "guest")
+	f.now = f.now.Add(10 * time.Second)
+	f.s.mu.Lock()
+	dispatches := f.s.syncMemberToRoomLocked(f.s.rooms[f.repo.room.ID], "host-session")
+	f.member("host").syncingToRoom = true
+	f.s.mu.Unlock()
+	f.s.sendCommandDispatches(t.Context(), dispatches)
+	return f, lastTransport(t, f.conns["host"])
+}
+
+func (f *bufferingRoom) hostReport(commandID string, position float64, paused bool) {
+	f.t.Helper()
+	if _, err := f.s.HandleStateReportForConnection(f.t.Context(), f.reg("host"), 7, "host",
+		StateReport{SessionID: "host-session", CommandID: commandID, PositionSeconds: position, IsPaused: paused}); err != nil {
+		f.t.Fatal(err)
+	}
+}
+
+// A second play sent inside the lead by a member still paused where the
+// first one was sent starts the room from the same point, not a lead later.
+func TestRepeatedPlayInsideTheLeadKeepsThePausedPosition(t *testing.T) {
+	f := newBufferingRoom(t, "guest")
+	f.member("guest").lastPingMS = 2000
+	position := 100.0
+	request := func(action TransportAction) TransportCommand {
+		t.Helper()
+		// is_paused as web and Android send it: the state the request asks for.
+		if _, err := f.s.HandleTransportRequestForConnection(t.Context(), f.reg("host"), 7, "host",
+			TransportRequest{Action: action, PositionSeconds: &position, IsPaused: action == TransportActionPause}); err != nil {
+			t.Fatal(err)
+		}
+		return lastTransport(t, f.conns["guest"])
+	}
+	request(TransportActionPause)
+	f.now = f.now.Add(5 * time.Second)
+	first := request(TransportActionPlay)
+	f.now = f.now.Add(100 * time.Millisecond)
+	second := request(TransportActionPlay)
+	if first.PositionSeconds != 100 || second.PositionSeconds != 100 {
+		t.Fatalf("plays carry %.2f and %.2f, want both at the paused 100", first.PositionSeconds, second.PositionSeconds)
+	}
+}
+
+// A member of a paused room cannot close drift by rate, so its first report
+// out of sync is a strike, not progress.
+func TestPausedRoomMemberIsCorrectedAfterTwoReports(t *testing.T) {
+	f := newBufferingRoom(t, "guest")
+	position := 100.0
+	if _, err := f.s.HandleTransportRequestForConnection(t.Context(), f.reg("host"), 7, "host",
+		TransportRequest{Action: TransportActionPause, PositionSeconds: &position}); err != nil {
+		t.Fatal(err)
+	}
+	f.now = f.now.Add(10 * time.Second)
+	before := transportCount(f.conns["guest"])
+	for range guestCorrectionStrikes {
+		f.now = f.now.Add(1500 * time.Millisecond)
+		if _, err := f.s.HandleStateReportForConnection(t.Context(), f.reg("guest"), f.userID("guest"), "guest",
+			StateReport{SessionID: "guest-session", PositionSeconds: 103, IsPaused: true}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if got := transportCount(f.conns["guest"]) - before; got != 1 {
+		t.Fatalf("a paused member 3 s off got %d corrections after %d reports, want 1", got, guestCorrectionStrikes)
+	}
+}
+
+// The /api/v1 room socket keeps its host band: its clients may report a
+// host's scrub instead of requesting it.
+func TestLegacySocketHostKeepsTheNarrowBand(t *testing.T) {
+	for _, legacy := range []bool{false, true} {
+		f := newBufferingRoom(t, "guest")
+		f.now = f.now.Add(10 * time.Second)
+		var conn RoomConnection = f.conns["host"]
+		if legacy {
+			conn = legacyRoomConn{f.conns["host"]}
+		}
+		f.member("host").connection = conn
+		expected := f.expected()
+		if _, err := f.s.HandleStateReportForConnection(t.Context(), registrationFor(f.repo.room.ID, 7, "host", conn), 7, "host",
+			StateReport{SessionID: "host-session", PositionSeconds: expected + 4}); err != nil {
+			t.Fatal(err)
+		}
+		moved := math.Abs(f.expected()-expected) > 2
+		if moved != legacy {
+			t.Fatalf("legacy socket %v: a 4 s host scrub moved the room = %v", legacy, moved)
+		}
+	}
+}
+
+type legacyRoomConn struct{ *recordingConn }
+
+func (legacyRoomConn) LegacyRoomProtocol() bool { return true }
+
+// Snapshots show no member's commands, so a correction alone sends the room
+// no snapshot on reconciliation.
+func TestCorrectionsDoNotBroadcastSnapshots(t *testing.T) {
+	f := newBufferingRoom(t, "ann", "bob")
+	if err := f.s.reconcileRoom(t.Context(), f.repo.room.ID); err != nil {
+		t.Fatal(err)
+	}
+	f.now = f.now.Add(10 * time.Second)
+	snapshots := func() int {
+		n := 0
+		for _, p := range f.conns["bob"].payloads {
+			if p[clusterMessageTypeKey] == snapshotMessageType {
+				n++
+			}
+		}
+		return n
+	}
+	for range guestCorrectionStrikes + 1 {
+		f.report("ann", f.expected()-30)
+	}
+	if f.member("ann").correctionCommand == nil {
+		t.Fatal("ann was not corrected")
+	}
+	before := snapshots()
+	if before == 0 {
+		t.Fatal("bob received no snapshots at all; the count is not measuring anything")
+	}
+	if err := f.s.reconcileRoom(t.Context(), f.repo.room.ID); err != nil {
+		t.Fatal(err)
+	}
+	if got := snapshots(); got != before {
+		t.Fatalf("a correction sent bob %d snapshots", got-before)
+	}
+}
+
+// A burst of relative skips from a client whose position has not caught up
+// with the pending seek repeats that seek's target. The repeat is the same
+// seek, so the barrier does not restart, and a seek during the barrier keeps
+// whether the room resumes playing.
+func TestRepeatedSeekDuringABarrierIsTheSameSeek(t *testing.T) {
+	f := newBufferingRoom(t, "guest")
+	f.now = f.now.Add(10 * time.Second)
+	seek := func(target float64, paused bool) {
+		t.Helper()
+		if _, err := f.s.HandleTransportRequestForConnection(t.Context(), f.reg("host"), 7, "host",
+			TransportRequest{Action: TransportActionSeek, PositionSeconds: &target, IsPaused: paused}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	seek(140, false)
+	first := lastTransport(t, f.conns["guest"])
+	generation := f.repo.room.Generation
+	f.ready("guest", 140)
+
+	// The host is paused by the barrier now; its repeat carries that.
+	f.now = f.now.Add(300 * time.Millisecond)
+	seek(140.3, true)
+	if got := lastTransport(t, f.conns["guest"]); got.CommandID != first.CommandID || f.repo.room.Generation != generation {
+		t.Fatalf("a repeat of the pending seek restarted the barrier: %+v", got)
+	}
+	if !f.member("guest").isReady {
+		t.Fatal("a repeat of the pending seek reset readiness")
+	}
+
+	// A real further skip restarts it, and the room still resumes playing.
+	seek(170, true)
+	second := lastTransport(t, f.conns["guest"])
+	if second.CommandID == first.CommandID || second.PositionSeconds != 170 {
+		t.Fatalf("a further skip was dropped: %+v", second)
+	}
+	f.resumeAll()
+	if f.repo.room.PlaybackState != RoomPlaybackStatePlaying {
+		t.Fatalf("seeks during the barrier left the room %s, want playing", f.repo.room.PlaybackState)
+	}
+}
+
+// A paused member that cannot apply a correction in place (it stays where the
+// correction found it) is not corrected again and again.
+func TestPausedMemberThatCannotMoveIsNotCorrectedAgain(t *testing.T) {
+	f := newBufferingRoom(t, "guest")
+	f.now = f.now.Add(10 * time.Second)
+	position := f.expected()
+	if _, err := f.s.HandleTransportRequestForConnection(t.Context(), f.reg("host"), 7, "host",
+		TransportRequest{Action: TransportActionPause, PositionSeconds: &position}); err != nil {
+		t.Fatal(err)
+	}
+	pause := lastTransport(t, f.conns["guest"])
+	report := func(at float64) {
+		t.Helper()
+		if _, err := f.s.HandleStateReportForConnection(t.Context(), f.reg("guest"), f.userID("guest"), "guest",
+			StateReport{SessionID: "guest-session", CommandID: pause.CommandID, PositionSeconds: at, IsPaused: true}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	f.now = f.now.Add(commandSettleWindow + time.Second)
+	stuck := pause.PositionSeconds - 1.6
+	before := transportCount(f.conns["guest"])
+	for range guestCorrectionStrikes + 1 {
+		report(stuck)
+	}
+	corrections := transportCount(f.conns["guest"])
+	if corrections != before+1 {
+		t.Fatalf("the first correction was not sent (%d)", corrections-before)
+	}
+	for range 4 { // about 46 s, inside stuckCorrectionRetry
+		f.now = f.now.Add(guestCorrectionRetryInterval + commandSettleWindow)
+		report(stuck)
+		report(stuck)
+	}
+	if got := transportCount(f.conns["guest"]); got != corrections {
+		t.Fatalf("a paused member that cannot move got %d more corrections", got-corrections)
+	}
+	// A failure to apply a correction can pass, so it is retried after a while.
+	f.now = f.now.Add(stuckCorrectionRetry - 4*(guestCorrectionRetryInterval+commandSettleWindow))
+	report(stuck)
+	report(stuck)
+	if got := transportCount(f.conns["guest"]); got != corrections+1 {
+		t.Fatalf("a paused member stuck for %v got %d corrections, want 1 retry", stuckCorrectionRetry, got-corrections)
+	}
+	corrections++
+	// Once it moves, it is corrected again if it is still off.
+	f.now = f.now.Add(guestCorrectionRetryInterval)
+	for range guestCorrectionStrikes + 1 {
+		report(stuck - 2)
+	}
+	if got := transportCount(f.conns["guest"]); got != corrections+1 {
+		t.Fatalf("a paused member that moved further off got %d corrections, want 1", got-corrections)
+	}
+}
+
+// A host landing that moved the barrier's destination makes a seek back to the
+// original target a real seek, not a repeat.
+func TestSeekBackToTargetAfterAHostLandingIsNotARepeat(t *testing.T) {
+	f := newBufferingRoom(t, "guest")
+	target := 1500.0
+	if _, err := f.s.HandleTransportRequestForConnection(t.Context(), f.reg("host"), 7, "host",
+		TransportRequest{Action: TransportActionSeek, PositionSeconds: &target}); err != nil {
+		t.Fatal(err)
+	}
+	seek := lastTransport(t, f.conns["host"])
+	if _, err := f.s.HandleReadyForConnection(t.Context(), f.reg("host"), 7, "host",
+		StateReport{SessionID: "host-session", CommandID: seek.CommandID, PositionSeconds: 1494, IsPaused: true}); err != nil {
+		t.Fatal(err)
+	}
+	if f.repo.room.AnchorPositionSeconds != 1494 {
+		t.Fatalf("host landing did not move the destination: %v", f.repo.room.AnchorPositionSeconds)
+	}
+	if _, err := f.s.HandleTransportRequestForConnection(t.Context(), f.reg("host"), 7, "host",
+		TransportRequest{Action: TransportActionSeek, PositionSeconds: &target}); err != nil {
+		t.Fatal(err)
+	}
+	if again := lastTransport(t, f.conns["guest"]); again.CommandID == seek.CommandID || again.PositionSeconds != 1500 {
+		t.Fatalf("the seek back to 1500 was dropped as a repeat: %+v", again)
+	}
+}
+
+// A stalled host pauses the room where it is, within the bound measured from
+// where the room is now; the scheduling lead does not narrow it.
+func TestStalledHostWithinTheBoundPausesTheRoomAtItsPosition(t *testing.T) {
+	f := newBufferingRoom(t, "guest")
+	f.member("guest").lastPingMS = 2000
+	f.now = f.now.Add(30 * time.Second)
+	stalledAt := f.expected() - 4
+	if _, err := f.s.HandleBufferingForConnection(t.Context(), f.reg("host"), 7, "host",
+		StateReport{SessionID: "host-session", PositionSeconds: stalledAt}); err != nil {
+		t.Fatal(err)
+	}
+	if anchor := f.repo.room.AnchorPositionSeconds; anchor != stalledAt {
+		t.Fatalf("a host stalled 4 s behind paused the room at %.2f, want its position %.2f", anchor, stalledAt)
+	}
+}
+
+// A pause comes from a playing member, which runs on until the command
+// executes, so the pause lands a lead after the press, also when a second
+// pause follows inside the lead.
+func TestPauseFromAPlayingMemberRunsOnToExecuteAt(t *testing.T) {
+	f := newBufferingRoom(t, "guest")
+	f.member("guest").lastPingMS = 2000
+	f.now = f.now.Add(30 * time.Second)
+	pause := func() TransportCommand {
+		t.Helper()
+		position := f.expected()
+		if _, err := f.s.HandleTransportRequestForConnection(t.Context(), f.reg("host"), 7, "host",
+			TransportRequest{Action: TransportActionPause, PositionSeconds: &position, IsPaused: true}); err != nil {
+			t.Fatal(err)
+		}
+		command := lastTransport(t, f.conns["guest"])
+		executeAt, err := time.Parse(time.RFC3339Nano, command.ExecuteAt)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if want := position + executeAt.Sub(f.now).Seconds(); math.Abs(command.PositionSeconds-want) > 0.01 {
+			t.Fatalf("pause from %.2f lands at %.2f, want %.2f a lead later", position, command.PositionSeconds, want)
+		}
+		return command
+	}
+	pause()
+	f.now = f.now.Add(100 * time.Millisecond)
+	pause()
+}
+
+// A press that undoes a play or pause still waiting for its execute_at comes
+// from a member in the state before it: a pause canceling a pending play
+// leaves the paused room where it was, and a play canceling a pending pause
+// runs on to its own execute_at.
+func TestRequestInsideTheLeadUsesTheStateBeforeThePendingCommand(t *testing.T) {
+	f := newBufferingRoom(t, "guest")
+	f.member("guest").lastPingMS = 2000
+	request := func(action TransportAction, position float64) TransportCommand {
+		t.Helper()
+		if _, err := f.s.HandleTransportRequestForConnection(t.Context(), f.reg("host"), 7, "host",
+			TransportRequest{Action: action, PositionSeconds: &position, IsPaused: action == TransportActionPause}); err != nil {
+			t.Fatal(err)
+		}
+		return lastTransport(t, f.conns["guest"])
+	}
+	leadAfter := func(command TransportCommand) float64 {
+		t.Helper()
+		executeAt, err := time.Parse(time.RFC3339Nano, command.ExecuteAt)
+		if err != nil {
+			t.Fatal(err)
+		}
+		return executeAt.Sub(f.now).Seconds()
+	}
+
+	request(TransportActionPause, 100)
+	f.now = f.now.Add(5 * time.Second)
+	request(TransportActionPlay, 100)
+	f.now = f.now.Add(time.Second)
+	if undo := request(TransportActionPause, 100); undo.PositionSeconds != 100 {
+		t.Fatalf("pause canceling a pending play lands at %.2f, want the paused 100", undo.PositionSeconds)
+	}
+
+	f.now = f.now.Add(5 * time.Second)
+	request(TransportActionPlay, 100)
+	f.now = f.now.Add(5 * time.Second)
+	position := f.expected()
+	request(TransportActionPause, position)
+	f.now = f.now.Add(time.Second)
+	position++
+	undo := request(TransportActionPlay, position)
+	if want := position + leadAfter(undo); math.Abs(undo.PositionSeconds-want) > 0.01 {
+		t.Fatalf("play canceling a pending pause lands at %.2f, want %.2f a lead after the still-playing requester", undo.PositionSeconds, want)
+	}
+}
diff --git a/internal/webhooksync/logging.go b/internal/webhooksync/logging.go
index 33f02a32bc..637bcce791 100644
--- a/internal/webhooksync/logging.go
+++ b/internal/webhooksync/logging.go
@@ -141,7 +141,7 @@ func sanitizeMultipartBody(body []byte, boundary string) string {
 	fields := url.Values{}
 	for {
 		part, err := reader.NextPart()
-		if err == io.EOF {
+		if err == io.EOF { //nolint:errorlint // NextPart returns a bare io.EOF only at the closing boundary; a wrapped one means a truncated body
 			break
 		}
 		if err != nil {
diff --git a/internal/webhooksync/management_test.go b/internal/webhooksync/management_test.go
index 8e31198b5c..d8b3ac3ef6 100644
--- a/internal/webhooksync/management_test.go
+++ b/internal/webhooksync/management_test.go
@@ -32,7 +32,7 @@ func TestManagementPagingDB(t *testing.T) {
 		if err := pool.QueryRow(ctx, "INSERT INTO users(username,role) VALUES($1,'user') RETURNING id", "webhook-page-"+uuid.NewString()).Scan(target); err != nil {
 			t.Fatal(err)
 		}
-		defer func(id int) { _, _ = pool.Exec(ctx, "DELETE FROM users WHERE id=$1", id) }(*target)
+		defer func(id int) { _, _ = pool.Exec(ctx, "DELETE FROM users WHERE id=$1", id) }(*target) //nolint:gocritic,revive // each fixture user is removed when the test returns
 	}
 	cipher, err := secret.New([]byte("test-management-key-with-enough-entropy-for-cipher"))
 	if err != nil {
diff --git a/internal/webhooksync/providers.go b/internal/webhooksync/providers.go
index d5ebcb53e3..0d1489bb65 100644
--- a/internal/webhooksync/providers.go
+++ b/internal/webhooksync/providers.go
@@ -117,7 +117,7 @@ func (p *PlexProvider) ParseWebhook(ctx context.Context, conn *Connection, r *ht
 	if err := json.Unmarshal([]byte(payloadRaw), &payload); err != nil {
 		return nil, fmt.Errorf("invalid Plex payload")
 	}
-	if payload.Event == "" || payload.Account.ID == 0 || payload.Metadata.RatingKey == "" || payload.Metadata.Type == "" {
+	if payload.Event == "" {
 		return nil, fmt.Errorf("invalid Plex webhook payload")
 	}
 	action, completed, ok := plexWebhookAction(payload.Event)
@@ -128,6 +128,11 @@ func (p *PlexProvider) ParseWebhook(ctx context.Context, conn *Connection, r *ht
 			Apply:     false,
 		}, nil
 	}
+	// Only the events Prairie applies need an account and an item. Plex sends
+	// every event to every webhook, including server events without an item.
+	if payload.Account.ID == 0 || payload.Metadata.RatingKey == "" || payload.Metadata.Type == "" {
+		return nil, fmt.Errorf("invalid Plex webhook payload")
+	}
 	userID := strconv.FormatInt(payload.Account.ID, 10)
 	// A playback start only needs the account and item IDs, so it is recorded
 	// even when the server cannot be reached.
@@ -244,7 +249,7 @@ func (p *EmbyProvider) ParseWebhook(_ context.Context, conn *Connection, r *http
 		return nil, err
 	}
 	eventName := strings.ToLower(strings.TrimSpace(payload.Event))
-	if eventName == "" || payload.User.ID == "" || payload.Item.ID == "" || payload.Item.Type == "" {
+	if eventName == "" {
 		return nil, fmt.Errorf("invalid Emby webhook payload")
 	}
 	action, ok := embyWebhookAction(eventName)
@@ -255,6 +260,11 @@ func (p *EmbyProvider) ParseWebhook(_ context.Context, conn *Connection, r *http
 			Apply:     false,
 		}, nil
 	}
+	// Only the events Prairie applies need a user and an item. The Test
+	// Notification and server events carry neither.
+	if payload.User.ID == "" || payload.Item.ID == "" || payload.Item.Type == "" {
+		return nil, fmt.Errorf("invalid Emby webhook payload")
+	}
 	record, mediaKind, ok := embyLikeRecord(payload.Item.Type, payload.Item.Name, payload.Item.SeriesName, payload.Item.ProductionYear, payload.Item.IndexNumber, payload.Item.ParentIndexNumber, payload.Item.RunTimeTicks, payload.PlaybackInfo.PositionTicks, payload.PlaybackInfo.PlayedToCompletion || action == ActionImportProgress && isEmbyMarkPlayedEvent(eventName), payload.Item.ProviderIDs, payload.Item.ID, payload.Date, actionAllowsSeries(action))
 	if !ok {
 		return &CanonicalEvent{
@@ -379,7 +389,7 @@ func decodeEmbyMultipart(body []byte, boundary string, payload *embyWebhookPaylo
 	var fallback []byte
 	for {
 		part, err := reader.NextPart()
-		if err == io.EOF {
+		if err == io.EOF { //nolint:errorlint // NextPart returns a bare io.EOF only at the closing boundary; a wrapped one means a truncated body
 			break
 		}
 		if err != nil {
diff --git a/internal/webhooksync/providers_test.go b/internal/webhooksync/providers_test.go
index 99fdf34896..4540ae2edc 100644
--- a/internal/webhooksync/providers_test.go
+++ b/internal/webhooksync/providers_test.go
@@ -111,6 +111,25 @@ func TestEmbyProviderParseWebhookMultipart(t *testing.T) {
 	}
 }
 
+// NextPart reports a body that stops before its closing boundary with a
+// wrapped io.EOF, so a truncated delivery must not decode the part it read
+// as if the body were complete.
+func TestDecodeEmbyMultipartRejectsMissingClosingBoundary(t *testing.T) {
+	t.Parallel()
+
+	const part = "--B\r\nContent-Disposition: form-data; name=\"note\"\r\n\r\n{\"Event\":\"playback.stop\"}\r\n"
+	var payload embyWebhookPayload
+	if err := decodeEmbyMultipart([]byte(part+"--B--\r\n"), "B", &payload); err != nil {
+		t.Fatalf("complete body: %v", err)
+	}
+	if payload.Event != "playback.stop" {
+		t.Fatalf("complete body Event = %q, want playback.stop", payload.Event)
+	}
+	if err := decodeEmbyMultipart([]byte(part+"--B"), "B", &embyWebhookPayload{}); err == nil {
+		t.Fatal("truncated body decoded; want an error")
+	}
+}
+
 func TestEmbyProviderParseWebhookMarkUnplayed(t *testing.T) {
 	t.Parallel()
 
@@ -223,6 +242,83 @@ func TestEmbyProviderParseWebhookItemRateAsToggleFavorite(t *testing.T) {
 	}
 }
 
+// Emby's Test Notification button sends only the event and server fields
+// (system.notificationtest on current servers, system.webhooktest on older
+// ones). It must be accepted as an ignored delivery, or Emby reports Bad
+// Request and the connection shows an error.
+func TestEmbyProviderIgnoresTestNotification(t *testing.T) {
+	t.Parallel()
+
+	for _, eventName := range []string{"system.notificationtest", "system.webhooktest", "System.NotificationTest"} {
+		t.Run(eventName, func(t *testing.T) {
+			t.Parallel()
+			req := httptest.NewRequest("POST", "/webhook", strings.NewReader(`{
+				"Title": "Test Notification",
+				"Description": "Test Notification Description",
+				"Date": "2026-10-14T01:02:03.4567890Z",
+				"Event": "`+eventName+`",
+				"Server": { "Name": "Emby", "Id": "server-1", "Version": "4.9.5.0" }
+			}`))
+			req.Header.Set("Content-Type", "application/json")
+
+			event, err := NewEmbyProvider().ParseWebhook(context.Background(), &Connection{ServerName: "Emby"}, req)
+			if err != nil {
+				t.Fatalf("ParseWebhook() error = %v", err)
+			}
+			if event == nil || event.Apply || event.EventKind != strings.ToLower(eventName) || event.Summary != "Ignored unsupported Emby event type" {
+				t.Fatalf("expected ignored test notification, got %#v", event)
+			}
+		})
+	}
+}
+
+// Events Prairie does not apply are ignored whatever fields they carry; only the
+// events it applies need a user and an item.
+func TestEmbyProviderIgnoresUnsupportedEventsWithoutUserOrItem(t *testing.T) {
+	t.Parallel()
+
+	for name, body := range map[string]string{
+		"no user or item":   `{"Event":"system.updateavailable","Server":{"Name":"Emby"}}`,
+		"user without item": `{"Event":"user.authenticated","User":{"Id":"user-1","Name":"Alice"}}`,
+		"item without user": `{"Event":"library.new","Item":{"Id":"item-1","Name":"Movie","Type":"Movie"}}`,
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			req := httptest.NewRequest("POST", "/webhook", strings.NewReader(body))
+			event, err := NewEmbyProvider().ParseWebhook(context.Background(), &Connection{ServerName: "Emby"}, req)
+			if err != nil {
+				t.Fatalf("ParseWebhook() error = %v", err)
+			}
+			if event == nil || event.Apply {
+				t.Fatalf("expected ignored event, got %#v", event)
+			}
+		})
+	}
+}
+
+func TestEmbyProviderRejectsMalformedPayloads(t *testing.T) {
+	t.Parallel()
+
+	const movie = `"Item":{"Id":"item-1","Name":"Movie","Type":"Movie"}`
+	for name, body := range map[string]string{
+		"empty object":                 `{}`,
+		"not json":                     `not json`,
+		"missing event":                `{"User":{"Id":"user-1"},` + movie + `}`,
+		"stop without user":            `{"Event":"playback.stop",` + movie + `}`,
+		"mixed-case stop without user": `{"Event":"Playback.Stop",` + movie + `}`,
+		"mark played without item":     `{"Event":"item.markplayed","User":{"Id":"user-1"}}`,
+		"favorite without type":        `{"Event":"item.addedtofavorites","User":{"Id":"user-1"},"Item":{"Id":"item-1"}}`,
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			req := httptest.NewRequest("POST", "/webhook", strings.NewReader(body))
+			if event, err := NewEmbyProvider().ParseWebhook(context.Background(), &Connection{ServerName: "Emby"}, req); err == nil {
+				t.Fatalf("ParseWebhook() = %#v, want error", event)
+			}
+		})
+	}
+}
+
 func TestDecodeEmbyPayloadFormEncoded(t *testing.T) {
 	t.Parallel()
 
@@ -257,6 +353,7 @@ func TestEmbyWebhookAction(t *testing.T) {
 		{eventName: "item.addedtofavorites", want: ActionAddFavorite, ok: true},
 		{eventName: "item.removedfromfavorites", want: ActionRemoveFavorite, ok: true},
 		{eventName: "user.created", ok: false},
+		{eventName: "system.notificationtest", ok: false},
 	}
 
 	for _, tc := range tests {
@@ -563,10 +660,11 @@ func TestPlexProviderRejectsMalformedPayloads(t *testing.T) {
 	server := newPlexMetadataServer(t)
 
 	for name, payload := range map[string]string{
-		"not json":        `not json`,
-		"missing event":   `{"Account":{"id":5},"Metadata":{"ratingKey":"42","type":"movie"}}`,
-		"missing account": `{"event":"media.scrobble","Metadata":{"ratingKey":"42","type":"movie"}}`,
-		"missing item":    `{"event":"media.scrobble","Account":{"id":5}}`,
+		"not json":                     `not json`,
+		"missing event":                `{"Account":{"id":5},"Metadata":{"ratingKey":"42","type":"movie"}}`,
+		"missing account":              `{"event":"media.scrobble","Metadata":{"ratingKey":"42","type":"movie"}}`,
+		"missing item":                 `{"event":"media.scrobble","Account":{"id":5}}`,
+		"play without account or item": `{"event":"media.play"}`,
 	} {
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
@@ -577,6 +675,37 @@ func TestPlexProviderRejectsMalformedPayloads(t *testing.T) {
 	}
 }
 
+// Plex sends every event to every webhook, including server events without an
+// item. Events Prairie does not apply are ignored without a metadata lookup,
+// whatever fields they carry.
+func TestPlexProviderIgnoresUnsupportedEventsWithoutItem(t *testing.T) {
+	t.Parallel()
+	var lookups atomic.Int32
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		lookups.Add(1)
+		http.Error(w, "unavailable", http.StatusServiceUnavailable)
+	}))
+	t.Cleanup(server.Close)
+
+	for name, payload := range map[string]string{
+		"database backup": `{"event":"admin.database.backup","Account":{"id":1,"title":"Owner"},"Server":{"title":"Plex"}}`,
+		"new device":      `{"event":"device.new","Account":{"id":1,"title":"Owner"},"Player":{"title":"Phone"}}`,
+	} {
+		t.Run(name, func(t *testing.T) {
+			event, err := parsePlex(t, server, payload)
+			if err != nil {
+				t.Fatalf("ParseWebhook() error = %v", err)
+			}
+			if event == nil || event.Apply || event.Summary != "Ignored unsupported Plex event type" {
+				t.Fatalf("expected ignored event, got %#v", event)
+			}
+		})
+	}
+	if n := lookups.Load(); n != 0 {
+		t.Fatalf("unsupported events made %d metadata lookups, want 0", n)
+	}
+}
+
 // Plex webhooks identify the server owner by its server-local account ID, so
 // the owner's default mapping must use that ID rather than the plex.tv one.
 func TestPlexDefaultUserMapsServerOwnerAccount(t *testing.T) {
diff --git a/internal/webhooksync/repo_events.go b/internal/webhooksync/repo_events.go
index a70312eb90..d9dae47f9f 100644
--- a/internal/webhooksync/repo_events.go
+++ b/internal/webhooksync/repo_events.go
@@ -3,6 +3,7 @@ package webhooksync
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 
 	"github.com/jackc/pgx/v5"
@@ -123,7 +124,7 @@ func scanWebhookEventLog(row interface {
 		&entry.BodyExcerpt,
 		&attrsJSON,
 	); err != nil {
-		if err == pgx.ErrNoRows {
+		if errors.Is(err, pgx.ErrNoRows) {
 			return nil, ErrConnectionNotFound
 		}
 		return nil, fmt.Errorf("scan webhook event log: %w", err)
diff --git a/internal/webhooksync/service.go b/internal/webhooksync/service.go
index 8ce146b63d..915f1a59fb 100644
--- a/internal/webhooksync/service.go
+++ b/internal/webhooksync/service.go
@@ -20,6 +20,13 @@ import (
 	"github.com/prairie-server/prairie-server/internal/watchstate"
 )
 
+// SignalsChangedNotifier records that a profile's recommendation signals
+// changed, so its taste profile and cached recommendations get rebuilt.
+// *recommendations.Worker implements it.
+type SignalsChangedNotifier interface {
+	NotifySignalsChanged(ctx context.Context, userID int, profileID string)
+}
+
 type Service struct {
 	repo      *Repository
 	matcher   *historyimport.Matcher
@@ -29,6 +36,10 @@ type Service struct {
 	// localNetwork decides whether a connection's server address may be on
 	// this server's own network. Nil limits it to the public internet.
 	localNetwork *historyimport.LocalNetworkAccess
+
+	// signals hears about applied events that change a profile's
+	// recommendation signals. Nil reports nothing.
+	signals SignalsChangedNotifier
 }
 
 func NewService(repo *Repository, importRepo *historyimport.Repository, storeProvider userstore.UserStoreProvider) *Service {
@@ -53,6 +64,20 @@ func (s *Service) SetLocalNetworkAccess(access *historyimport.LocalNetworkAccess
 	}
 }
 
+// SetSignalsChangedNotifier installs where applied events that change a
+// profile's recommendation signals are reported.
+func (s *Service) SetSignalsChangedNotifier(notifier SignalsChangedNotifier) {
+	if s != nil {
+		s.signals = notifier
+	}
+}
+
+func (s *Service) notifySignalsChanged(ctx context.Context, userID int, profileID string) {
+	if s.signals != nil {
+		s.signals.NotifySignalsChanged(ctx, userID, profileID)
+	}
+}
+
 func (s *Service) SetStableIdentityResolver(identity *watchstate.StableIdentityResolver) {
 	if s == nil || s.watch == nil {
 		return
@@ -385,6 +410,7 @@ func (s *Service) ProcessWebhookBounded(ctx context.Context, secret string, r *h
 		if err := s.watch.RecordImportedMarkUnplayed(ctx, conn.UserID, profileID, match.MediaItemID, event.OccurredAt); err != nil {
 			return s.failWebhook(ctx, conn.ID, result, err, "Failed to apply mark-unplayed event")
 		}
+		s.notifySignalsChanged(ctx, conn.UserID, profileID)
 		if err := s.repo.UpsertItemState(ctx, ItemState{
 			ConnectionID:       conn.ID,
 			ExternalUserID:     event.UserID,
@@ -403,6 +429,7 @@ func (s *Service) ProcessWebhookBounded(ctx context.Context, secret string, r *h
 		if err := s.watch.SetFavorite(ctx, conn.UserID, profileID, match.MediaItemID, true); err != nil {
 			return s.failWebhook(ctx, conn.ID, result, err, "Failed to add favorite from webhook event")
 		}
+		s.notifySignalsChanged(ctx, conn.UserID, profileID)
 		result.Outcome = OutcomeApplied
 		result.Summary = "Applied favorite add event"
 		return result, nil
@@ -410,6 +437,7 @@ func (s *Service) ProcessWebhookBounded(ctx context.Context, secret string, r *h
 		if err := s.watch.SetFavorite(ctx, conn.UserID, profileID, match.MediaItemID, false); err != nil {
 			return s.failWebhook(ctx, conn.ID, result, err, "Failed to remove favorite from webhook event")
 		}
+		s.notifySignalsChanged(ctx, conn.UserID, profileID)
 		result.Outcome = OutcomeApplied
 		result.Summary = "Applied favorite removal event"
 		return result, nil
@@ -417,6 +445,7 @@ func (s *Service) ProcessWebhookBounded(ctx context.Context, secret string, r *h
 		if _, err := s.watch.ToggleFavorite(ctx, conn.UserID, profileID, match.MediaItemID); err != nil {
 			return s.failWebhook(ctx, conn.ID, result, err, "Failed to toggle favorite from webhook event")
 		}
+		s.notifySignalsChanged(ctx, conn.UserID, profileID)
 		result.Outcome = OutcomeApplied
 		result.Summary = "Applied favorite toggle event"
 		return result, nil
@@ -472,6 +501,10 @@ func (s *Service) ProcessWebhookBounded(ctx context.Context, secret string, r *h
 	if err != nil {
 		return s.failWebhook(ctx, conn.ID, result, err, "Failed to apply imported watch progress")
 	}
+	// Only stop-like events reach here (see the providers), and any recorded
+	// stop can move the taste profile: a finish, a stop at half way or more,
+	// or an early abandonment. The native stop path notifies the same way.
+	s.notifySignalsChanged(ctx, conn.UserID, profileID)
 
 	if err := s.repo.UpsertItemState(ctx, applied); err != nil {
 		return s.failWebhook(ctx, conn.ID, result, err, "Failed to persist imported watch progress")
diff --git a/internal/webhooksync/service_db_test.go b/internal/webhooksync/service_db_test.go
index fa6dd1d891..e0abbe8a48 100644
--- a/internal/webhooksync/service_db_test.go
+++ b/internal/webhooksync/service_db_test.go
@@ -19,6 +19,7 @@ import (
 	"github.com/prairie-server/prairie-server/internal/historyimport"
 	"github.com/prairie-server/prairie-server/internal/secret"
 	"github.com/prairie-server/prairie-server/internal/userstore"
+	"github.com/prairie-server/prairie-server/internal/userstore/pgstore"
 )
 
 // removeRecorder serves the profile's progress and records progress and
@@ -221,3 +222,107 @@ func TestProcessWebhookPlexSkippedScrobbleEndsPlaybackDB(t *testing.T) {
 		t.Fatalf("stop after the skipped scrobble: outcome %q (%s), writes %v; want skipped with nothing written", result.Outcome, result.Summary, store.positions)
 	}
 }
+
+// An item marked unplayed and then played again within one second ends up
+// watched on the mapped profile. The removal watermark is microsecond-precise,
+// so the played mark must be compared and stored at that precision too.
+func TestProcessWebhookPlayedInSameSecondAsUnplayedDB(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := t.Context()
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(pool.Close)
+	cipher, err := secret.New([]byte("synthetic-webhook-sync-test-key-material"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	stores := pgstore.NewPostgresProvider(pool)
+	svc := NewService(NewRepository(pool, cipher), historyimport.NewRepository(pool, cipher), stores)
+
+	for _, tc := range []struct {
+		provider string
+		payload  func(played bool, at time.Time, tmdbID string) string
+	}{
+		{ProviderJellyfin, func(played bool, at time.Time, tmdbID string) string {
+			return fmt.Sprintf(`{
+				"notification_type": "UserDataSaved",
+				"timestamp": %q,
+				"user": { "id": "external-user", "name": "Viewer" },
+				"item": { "id": "external-item", "type": "Movie", "name": "Movie", "provider_ids": { "tmdb": %q } },
+				"user_data": { "save_reason": "TogglePlayed", "played": %t }
+			}`, at.Format(time.RFC3339Nano), tmdbID, played)
+		}},
+		{ProviderEmby, func(played bool, at time.Time, tmdbID string) string {
+			event := "item.markunplayed"
+			if played {
+				event = "item.markplayed"
+			}
+			return fmt.Sprintf(`{
+				"Event": %q,
+				"Date": %q,
+				"User": { "Id": "external-user", "Name": "Viewer" },
+				"Item": { "Id": "external-item", "Type": "Movie", "Name": "Movie", "ProviderIds": { "Tmdb": %q } }
+			}`, event, at.Format(time.RFC3339Nano), tmdbID)
+		}},
+	} {
+		t.Run(tc.provider, func(t *testing.T) {
+			suffix := uuid.NewString()
+			var userID int
+			if err := pool.QueryRow(ctx, `INSERT INTO users(username,role) VALUES($1,'user') RETURNING id`, "webhook-sync-"+suffix).Scan(&userID); err != nil {
+				t.Fatal(err)
+			}
+			mediaItemID := "webhook-sync-movie-" + suffix
+			tmdbID := "webhook-sync-" + suffix
+			t.Cleanup(func() {
+				_, _ = pool.Exec(context.Background(), `DELETE FROM users WHERE id = $1`, userID)
+				_, _ = pool.Exec(context.Background(), `DELETE FROM media_items WHERE content_id = $1`, mediaItemID)
+			})
+			profileID := uuid.NewString()
+			connectionID := uuid.NewString()
+			for _, stmt := range []struct {
+				sql  string
+				args []any
+			}{
+				{`INSERT INTO user_profiles(id,user_id,name) VALUES($1,$2,'Viewer')`, []any{profileID, userID}},
+				{`INSERT INTO media_items(content_id,type,title,status,tmdb_id) VALUES($1,'movie','Movie','matched',$2)`, []any{mediaItemID, tmdbID}},
+				{`INSERT INTO webhook_sync_connections(id,user_id,provider,webhook_secret) VALUES($1,$2,$3,$4)`, []any{connectionID, userID, tc.provider, suffix}},
+				{`INSERT INTO webhook_sync_profile_mappings(connection_id,external_user_id,external_user_name,silo_profile_id) VALUES($1,'external-user','Viewer',$2)`, []any{connectionID, profileID}},
+			} {
+				if _, err := pool.Exec(ctx, stmt.sql, stmt.args...); err != nil {
+					t.Fatalf("%s: %v", stmt.sql, err)
+				}
+			}
+			mark := func(played bool, at time.Time) {
+				t.Helper()
+				req := httptest.NewRequest("POST", "/webhook", strings.NewReader(tc.payload(played, at, tmdbID)))
+				req.Header.Set("Content-Type", "application/json")
+				result, err := svc.ProcessWebhookBounded(ctx, suffix, req, 1<<20)
+				if err != nil || result.Outcome != OutcomeApplied {
+					t.Fatalf("mark played=%t at %s: outcome %q (%s), err %v; want applied", played, at.Format(time.RFC3339Nano), result.Outcome, result.Summary, err)
+				}
+			}
+
+			second := time.Date(2026, 4, 7, 12, 0, 0, 0, time.UTC)
+			mark(true, second.Add(-time.Minute))
+			mark(false, second.Add(500*time.Millisecond))
+			mark(true, second.Add(900*time.Millisecond))
+
+			store, err := stores.ForUser(ctx, userID)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if progress, err := store.GetProgress(ctx, profileID, mediaItemID); err != nil || progress == nil || !progress.Completed {
+				t.Errorf("progress after unplayed then played in one second: %+v, err %v; want completed", progress, err)
+			}
+			history, err := store.ListCompletedHistoryItems(ctx, userstore.CompletedHistoryItemQuery{ProfileID: profileID, MediaItemIDs: []string{mediaItemID}})
+			if err != nil || len(history) != 1 {
+				t.Errorf("completed history after unplayed then played in one second: %+v, err %v; want the item", history, err)
+			}
+		})
+	}
+}
diff --git a/internal/webhooksync/signals_notify_test.go b/internal/webhooksync/signals_notify_test.go
new file mode 100644
index 0000000000..455707eb67
--- /dev/null
+++ b/internal/webhooksync/signals_notify_test.go
@@ -0,0 +1,123 @@
+package webhooksync
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"github.com/prairie-server/prairie-server/internal/historyimport"
+	"github.com/prairie-server/prairie-server/internal/secret"
+	"github.com/prairie-server/prairie-server/internal/userstore/pgstore"
+)
+
+// scriptedProvider parses every webhook into the event the test set.
+type scriptedProvider struct {
+	Provider
+	event *CanonicalEvent
+}
+
+func (p *scriptedProvider) ParseWebhook(context.Context, *Connection, *http.Request) (*CanonicalEvent, error) {
+	return p.event, nil
+}
+
+type countingSignalsNotifier struct{ calls int }
+
+func (n *countingSignalsNotifier) NotifySignalsChanged(context.Context, int, string) { n.calls++ }
+
+// Applied events that change a profile's taste signals report it: a stop at
+// any position (providers send only stop-like events), a played item, a
+// favorite change, an unplay. A stale or unmatched event and an event for an
+// unmapped user do not.
+func TestWebhookEventsReportSignalChangesPostgres(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	ctx := t.Context()
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(pool.Close)
+
+	var userID int
+	if err := pool.QueryRow(ctx, "INSERT INTO users(username,role) VALUES($1,'user') RETURNING id", "webhook-signals-"+uuid.NewString()).Scan(&userID); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _, _ = pool.Exec(context.Background(), "DELETE FROM users WHERE id=$1", userID) })
+	const profileID = "webhook-signals-profile"
+	if _, err := pool.Exec(ctx, "INSERT INTO user_profiles(user_id,id,name) VALUES($1,$2,'Profile')", userID, profileID); err != nil {
+		t.Fatal(err)
+	}
+	tmdbID := "w2b-" + uuid.NewString()
+	contentID := "movie-webhook-signals-" + tmdbID
+	if _, err := pool.Exec(ctx, "INSERT INTO media_items(content_id,type,title,year,tmdb_id,status) VALUES($1,'movie','Webhook Signals',2020,$2,'matched')", contentID, tmdbID); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		_, _ = pool.Exec(context.Background(), "DELETE FROM media_items WHERE content_id=$1", contentID)
+	})
+	connID, webhookSecret := uuid.NewString(), uuid.NewString()
+	if _, err := pool.Exec(ctx, "INSERT INTO webhook_sync_connections(id,user_id,provider,webhook_secret) VALUES($1,$2,'plex',$3)", connID, userID, webhookSecret); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := pool.Exec(ctx, "INSERT INTO webhook_sync_profile_mappings(connection_id,external_user_id,silo_profile_id) VALUES($1,'ext-mapped',$2)", connID, profileID); err != nil {
+		t.Fatal(err)
+	}
+
+	cipher, err := secret.New([]byte("test-webhook-signals-key-with-enough-entropy"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	service := NewService(NewRepository(pool, cipher), historyimport.NewRepository(pool, nil), pgstore.NewPostgresProvider(pool))
+	provider := &scriptedProvider{}
+	service.providers[ProviderPlex] = provider
+	notifier := &countingSignalsNotifier{}
+	service.SetSignalsChangedNotifier(notifier)
+
+	base := time.Now().UTC().Add(-time.Hour).Truncate(time.Second)
+	event := func(minute int, action, externalUser, tmdb string, played bool, position float64) *CanonicalEvent {
+		at := base.Add(time.Duration(minute) * time.Minute)
+		return &CanonicalEvent{
+			Provider: ProviderPlex, OccurredAt: at, Action: action, UserID: externalUser,
+			ExternalItemID: "item-1", MediaKind: historyimport.KindMovie, Completed: played,
+			PositionSeconds: position, DurationSeconds: 6000, Apply: true,
+			Record: CanonicalRecord{
+				Kind: historyimport.KindMovie, Title: "Webhook Signals", Year: 2020, TMDBID: tmdb,
+				Played: played, PositionSeconds: position, DurationSeconds: 6000, UpdatedAt: at, LastPlayedAt: &at,
+			},
+		}
+	}
+	for _, step := range []struct {
+		name    string
+		event   *CanonicalEvent
+		outcome string
+		want    int // notifications so far
+	}{
+		{"early stop", event(1, ActionImportProgress, "ext-mapped", tmdbID, false, 600), OutcomeApplied, 1},
+		{"stop past half way", event(2, ActionImportProgress, "ext-mapped", tmdbID, false, 4200), OutcomeApplied, 2},
+		{"played", event(3, ActionImportProgress, "ext-mapped", tmdbID, true, 6000), OutcomeApplied, 3},
+		{"favorite added", event(4, ActionAddFavorite, "ext-mapped", tmdbID, false, 0), OutcomeApplied, 4},
+		{"favorite toggled", event(5, ActionToggleFavorite, "ext-mapped", tmdbID, false, 0), OutcomeApplied, 5},
+		{"unplayed", event(6, ActionMarkUnplayed, "ext-mapped", tmdbID, false, 0), OutcomeApplied, 6},
+		{"stale unplay", event(0, ActionMarkUnplayed, "ext-mapped", tmdbID, false, 0), OutcomeSkipped, 6},
+		{"unmatched", event(7, ActionImportProgress, "ext-mapped", "no-such-"+tmdbID, true, 6000), OutcomeUnmatched, 6},
+		{"unmapped user", event(8, ActionImportProgress, "ext-unmapped", tmdbID, true, 6000), OutcomeSkipped, 6},
+	} {
+		provider.event = step.event
+		req := httptest.NewRequest(http.MethodPost, "/webhook", http.NoBody)
+		result, err := service.ProcessWebhook(ctx, webhookSecret, req)
+		if err != nil {
+			t.Fatalf("%s: %v", step.name, err)
+		}
+		if result.Outcome != step.outcome || notifier.calls != step.want {
+			t.Fatalf("%s: outcome = %q (%s), notifications = %d; want %q and %d", step.name, result.Outcome, result.Summary, notifier.calls, step.outcome, step.want)
+		}
+	}
+}
diff --git a/internal/worker/person_refresh_test.go b/internal/worker/person_refresh_test.go
index 3a9286fd29..6a0b9aa139 100644
--- a/internal/worker/person_refresh_test.go
+++ b/internal/worker/person_refresh_test.go
@@ -368,8 +368,11 @@ func TestPersonRefreshWorkerPacesLookupsAcrossBatches(t *testing.T) {
 	w := NewPersonRefreshWorker(service, PersonRefreshWorkerConfig{BatchSize: 1})
 	const delay = 30 * time.Millisecond
 	w.delay.Store(int64(delay))
+	// Take each start from the worker's own clock: it paces from the moment
+	// it set nextLookup, just before the lookup, so a timestamp taken later
+	// in the hook can shave jitter off a correctly paced gap.
 	var starts []time.Time
-	service.onRefresh = func(int64) { starts = append(starts, time.Now()) }
+	service.onRefresh = func(int64) { starts = append(starts, w.nextLookup.Add(-delay)) }
 
 	w.drain()
 
diff --git a/internal/workmetrics/work.go b/internal/workmetrics/work.go
index 1214cab7cf..15d08ff746 100644
--- a/internal/workmetrics/work.go
+++ b/internal/workmetrics/work.go
@@ -16,6 +16,7 @@ import (
 	"go.opentelemetry.io/otel/codes"
 	"go.opentelemetry.io/otel/trace"
 
+	"github.com/prairie-server/prairie-server/internal/database/queryattr"
 	"github.com/prairie-server/prairie-server/internal/telemetry"
 )
 
@@ -67,7 +68,7 @@ func Category(key string) string {
 		return key
 	case "refresh_metadata", "refresh_all_library_metadata", "refresh_series_air_dates", "bulk_metadata_enrichment", "sync_manga_metadata", "sync_audiobook_metadata", "sync_ebook_metadata", "backfill_ebook_metadata", "sync_podcast_feeds", "metadata":
 		return "metadata"
-	case "refresh_trending_discover":
+	case "refresh_trending_discover", "refresh_seasonal_lists":
 		return "recommendations"
 	case "seed_content_availability", "rebuild_release_interest":
 		return workloadNotifications
@@ -108,6 +109,8 @@ type Run struct {
 
 // Start links an initiating request when present, then starts an independent
 // workload trace. No long-lived request span or durable identity is retained.
+// The returned context hides the request from query attribution, so workload
+// queries do not count on the initiating request's log line.
 func Start(ctx context.Context, workload string, queuedAt time.Time) (context.Context, *Run) {
 	parentCtx := ctx
 	category := Category(workload)
@@ -122,7 +125,7 @@ func Start(ctx context.Context, workload string, queuedAt time.Time) (context.Co
 		queueWait.WithLabelValues(category).Observe(run.start.Sub(queuedAt).Seconds())
 	}
 	lastProgress.WithLabelValues(category).SetToCurrentTime()
-	return context.WithValue(pprof.WithLabels(ctx, pprof.Labels(labelWorkload, category)), runKey{}, run), run
+	return context.WithValue(pprof.WithLabels(queryattr.Detach(ctx), pprof.Labels(labelWorkload, category)), runKey{}, run), run
 }
 
 // Do makes the bounded workload label available to CPU/goroutine profiling.
diff --git a/internal/workmetrics/work_test.go b/internal/workmetrics/work_test.go
index f385165986..3cb161d345 100644
--- a/internal/workmetrics/work_test.go
+++ b/internal/workmetrics/work_test.go
@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"fmt"
+	"log/slog"
 	"runtime/pprof"
 	"strings"
 	"sync"
@@ -12,8 +13,30 @@ import (
 
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/testutil"
+
+	"github.com/prairie-server/prairie-server/internal/database/queryattr"
 )
 
+func TestStartDetachesRequestAttribution(t *testing.T) {
+	t.Setenv("PRAIRIE_QUERY_ATTRIBUTION_ENABLED", "true")
+	if !queryattr.Initialize() {
+		t.Fatal("query attribution is disabled")
+	}
+	ctx, request := queryattr.StartRequest(t.Context())
+	workCtx, run := Start(ctx, "scan", time.Time{})
+	defer run.Finish("success")
+	op := queryattr.Begin(workCtx, queryattr.KindQuery, "SELECT 1", nil, 1)
+	op.End(workCtx, nil)
+	var record slog.Record
+	record.Add(request.LogAttrs()...)
+	record.Attrs(func(attr slog.Attr) bool {
+		if attr.Key == "db_queries" {
+			t.Errorf("request db_queries = %v, want field absent after detached work", attr.Value)
+		}
+		return true
+	})
+}
+
 func TestAttemptLifecycleAndBoundedLabels(t *testing.T) {
 	before := testutil.ToFloat64(completed.WithLabelValues("other", "canceled"))
 	for i := 0; i < 100; i++ {
diff --git a/migrations/access_group_max_profiles_test.go b/migrations/access_group_max_profiles_test.go
new file mode 100644
index 0000000000..51a4214ebc
--- /dev/null
+++ b/migrations/access_group_max_profiles_test.go
@@ -0,0 +1,82 @@
+package migrations
+
+import "testing"
+
+func TestAccessGroupMaxProfilesMigrationPostgres(t *testing.T) {
+	tx, schema := adminMigrationFixture(t)
+	// The users column as 093 left it, and the group columns the revision
+	// trigger reads.
+	migrationExec(t, tx, `
+CREATE TABLE server_settings (key text PRIMARY KEY, value text);
+CREATE TABLE users (id integer PRIMARY KEY, role text NOT NULL, access_group_id bigint);
+CREATE TABLE access_groups (
+    id bigint PRIMARY KEY, name text NOT NULL, description text NOT NULL DEFAULT '', library_ids integer[],
+    max_playback_quality text NOT NULL DEFAULT '', download_allowed boolean NOT NULL DEFAULT true,
+    download_transcode_allowed boolean NOT NULL DEFAULT true, transcode_allowed boolean NOT NULL DEFAULT true,
+    audio_transcode_allowed boolean NOT NULL DEFAULT true, max_streams integer NOT NULL DEFAULT 0,
+    max_transcodes integer NOT NULL DEFAULT 0, max_remote_stream_bitrate_kbps integer NOT NULL DEFAULT 0,
+    max_local_stream_bitrate_kbps integer NOT NULL DEFAULT 0, allowed_permissions text[],
+    requests_allowed boolean NOT NULL DEFAULT true, is_default boolean NOT NULL DEFAULT false,
+    created_at timestamptz NOT NULL DEFAULT now(), updated_at timestamptz NOT NULL DEFAULT now());`)
+	for _, name := range []string{"056_user_max_profiles", "093_user_max_profiles_floor", "20260906000909_add_access_group_configuration_revisions"} {
+		migrationExec(t, tx, adminMigrationSQL(t, name, schema, false))
+	}
+	migrationExec(t, tx, `
+INSERT INTO access_groups (id, name) VALUES (1, 'Household'), (2, 'Guests');
+INSERT INTO users (id, role, access_group_id) VALUES (1, 'user', 1), (2, 'user', 2), (4, 'admin', 2), (5, 'user', NULL);
+INSERT INTO users (id, role, access_group_id, max_profiles) VALUES (3, 'user', 1, 2), (6, 'admin', 2, 8);`)
+
+	const migration = "20261013231605_access_group_max_profiles"
+	migrationExec(t, tx, adminMigrationSQL(t, migration, schema, false))
+
+	// A stored 5 was the default and now inherits; other values stay overrides.
+	limits := func() string {
+		t.Helper()
+		var got string
+		if err := tx.QueryRow(t.Context(), `SELECT string_agg(id || '=' || COALESCE(max_profiles::text, 'inherit'), ' ' ORDER BY id) FROM users`).Scan(&got); err != nil {
+			t.Fatal(err)
+		}
+		return got
+	}
+	if got, want := limits(), "1=inherit 2=inherit 3=2 4=inherit 5=inherit 6=8"; got != want {
+		t.Fatalf("user limits after Up = %s, want %s", got, want)
+	}
+	var groups string
+	if err := tx.QueryRow(t.Context(), `SELECT string_agg(id || '=' || max_profiles, ' ' ORDER BY id) FROM access_groups`).Scan(&groups); err != nil {
+		t.Fatal(err)
+	}
+	if groups != "1=5 2=5" {
+		t.Fatalf("group limits after Up = %s, want 1=5 2=5", groups)
+	}
+	migrationExec(t, tx, `INSERT INTO users (id, role) VALUES (7, 'user')`)
+	requireMigrationSQLState(t, tx, `UPDATE users SET max_profiles = 0 WHERE id = 7`, "23514")
+	requireMigrationSQLState(t, tx, `UPDATE access_groups SET max_profiles = 0 WHERE id = 1`, "23514")
+
+	// The revision trigger sees the new column.
+	revision := func() int64 {
+		t.Helper()
+		var got int64
+		if err := tx.QueryRow(t.Context(), `SELECT configuration_revision FROM access_groups WHERE id = 2`).Scan(&got); err != nil {
+			t.Fatal(err)
+		}
+		return got
+	}
+	before := revision()
+	migrationExec(t, tx, `UPDATE access_groups SET max_profiles = 3 WHERE id = 2`)
+	if revision() == before {
+		t.Fatal("changing a group's profile limit kept its configuration revision")
+	}
+
+	// Down stores the limit each account resolved to: its group's for a
+	// grouped account, 5 for an ungrouped one or an admin.
+	migrationExec(t, tx, adminMigrationSQL(t, migration, schema, true))
+	if got, want := limits(), "1=5 2=3 3=2 4=5 5=5 6=8 7=5"; got != want {
+		t.Fatalf("user limits after Down = %s, want %s", got, want)
+	}
+	requireMigrationSQLState(t, tx, `INSERT INTO users (id, role, max_profiles) VALUES (8, 'user', NULL)`, "23502")
+	before = revision()
+	migrationExec(t, tx, `UPDATE access_groups SET description = 'changed' WHERE id = 2`)
+	if revision() == before {
+		t.Fatal("the restored revision trigger stopped advancing on a change")
+	}
+}
diff --git a/migrations/episode_availability_released_at_test.go b/migrations/episode_availability_released_at_test.go
new file mode 100644
index 0000000000..7d4a37c5cc
--- /dev/null
+++ b/migrations/episode_availability_released_at_test.go
@@ -0,0 +1,48 @@
+package migrations
+
+import "testing"
+
+func TestEpisodeAvailabilityReleasedAtBackfillPostgres(t *testing.T) {
+	tx, schema := adminMigrationFixture(t)
+	migrationExec(t, tx, `
+CREATE TABLE episode_availability (
+	library_id INTEGER NOT NULL, episode_id TEXT NOT NULL, available_at TIMESTAMPTZ NOT NULL,
+	PRIMARY KEY (library_id, episode_id)
+);
+CREATE TABLE notification_library_seed_state (library_id INTEGER PRIMARY KEY, seeded_at TIMESTAMPTZ NOT NULL);
+CREATE TABLE episode_libraries (
+	episode_id TEXT NOT NULL, media_folder_id INTEGER NOT NULL, first_seen_at TIMESTAMPTZ NOT NULL,
+	PRIMARY KEY (episode_id, media_folder_id)
+);
+INSERT INTO notification_library_seed_state VALUES (1, NOW() - INTERVAL '100 days');
+INSERT INTO episode_availability VALUES
+	(1, 'back-catalog', NOW() - INTERVAL '101 days'),
+	(1, 'new', NOW() - INTERVAL '5 days'),
+	(1, 'late-match', NOW() - INTERVAL '5 days'),
+	(1, 'no-membership', NOW() - INTERVAL '5 days'),
+	(1, 'restored', NOW() - INTERVAL '5 days'),
+	(2, 'unseeded', NOW() - INTERVAL '5 days');
+INSERT INTO episode_libraries VALUES
+	('back-catalog', 1, NOW() - INTERVAL '101 days'),
+	('new', 1, NOW() - INTERVAL '6 days'),
+	('late-match', 1, NOW() - INTERVAL '60 days'),
+	('restored', 1, NOW() - INTERVAL '1 day'),
+	('unseeded', 2, NOW() - INTERVAL '5 days');`)
+
+	migrationExec(t, tx, adminMigrationSQL(t, "20261016012917_add_episode_availability_released_at", schema, false))
+
+	want := map[string]bool{"back-catalog": false, "new": true, "late-match": false, "no-membership": false, "restored": false, "unseeded": false}
+	for id, released := range want {
+		var got bool
+		if err := tx.QueryRow(t.Context(),
+			`SELECT released_at IS NOT DISTINCT FROM available_at AND released_at IS NOT NULL FROM episode_availability WHERE episode_id = $1`,
+			id).Scan(&got); err != nil {
+			t.Fatalf("%s: %v", id, err)
+		}
+		if got != released {
+			t.Errorf("%s: released = %v, want %v", id, got, released)
+		}
+	}
+
+	migrationExec(t, tx, adminMigrationSQL(t, "20261016012917_add_episode_availability_released_at", schema, true))
+}
diff --git a/migrations/prune_deleted_library_access_test.go b/migrations/prune_deleted_library_access_test.go
new file mode 100644
index 0000000000..22c96f7020
--- /dev/null
+++ b/migrations/prune_deleted_library_access_test.go
@@ -0,0 +1,263 @@
+package migrations
+
+import (
+	"context"
+	"os"
+	"slices"
+	"testing"
+
+	"github.com/jackc/pgx/v5"
+)
+
+// requireLibraryIDs checks one library_ids column, keeping NULL (every
+// library) distinct from an empty array (no libraries).
+func requireLibraryIDs(t *testing.T, tx pgx.Tx, table string, id int64, want []int32) {
+	t.Helper()
+	var got []int32
+	if err := tx.QueryRow(t.Context(), `SELECT library_ids FROM `+table+` WHERE id = $1`, id).Scan(&got); err != nil {
+		t.Fatal(err)
+	}
+	if (got == nil) != (want == nil) || !slices.Equal(got, want) {
+		t.Fatalf("%s %d library_ids = %#v, want %#v", table, id, got, want)
+	}
+}
+
+// TestDeletingLibraryPrunesAccessPolicyReferencesPostgres deletes libraries
+// that access groups, account overrides and invitations name, against the
+// migrated schema in a transaction that is rolled back. The deleted IDs leave
+// every list, the surviving ones keep their order, a list left with nothing
+// stays an empty restriction rather than widening to every library, and NULL
+// stays NULL.
+func TestDeletingLibraryPrunesAccessPolicyReferencesPostgres(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	conn, err := pgx.Connect(t.Context(), dsn)
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = conn.Close(context.Background()) })
+	tx, err := conn.Begin(t.Context())
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = tx.Rollback(context.Background()) })
+
+	folder := func(name string) int32 {
+		t.Helper()
+		var id int32
+		if err := tx.QueryRow(t.Context(), `INSERT INTO media_folders (type, name) VALUES ('movies', $1) RETURNING id`, name).Scan(&id); err != nil {
+			t.Fatal(err)
+		}
+		return id
+	}
+	gone, alsoGone, kept := folder("access prune gone"), folder("access prune also gone"), folder("access prune kept")
+	insert := func(query string, args ...any) int64 {
+		t.Helper()
+		var id int64
+		if err := tx.QueryRow(t.Context(), query, args...).Scan(&id); err != nil {
+			t.Fatal(err)
+		}
+		return id
+	}
+	group := func(name string, ids []int32) int64 {
+		return insert(`INSERT INTO access_groups (name, library_ids) VALUES ($1, $2) RETURNING id`, name, ids)
+	}
+	user := func(name string, ids []int32) int64 {
+		return insert(`INSERT INTO users (username, role, library_ids) VALUES ($1, 'user', $2) RETURNING id`, name, ids)
+	}
+	mixedGroup := group("access prune mixed", []int32{gone, kept, alsoGone})
+	onlyGoneGroup := group("access prune only gone", []int32{gone})
+	allGroup := group("access prune all", nil)
+	untouchedGroup := group("access prune untouched", []int32{kept})
+	mixedUser := user("access-prune-mixed", []int32{alsoGone, kept})
+	onlyGoneUser := user("access-prune-only-gone", []int32{gone, alsoGone})
+	inheritUser := user("access-prune-inherit", nil)
+	invitation := insert(`INSERT INTO invitations (email, token_hash, library_ids, invited_by, expires_at)
+		VALUES ('access-prune@example.test', 'access-prune-token', $1, $2, now() + interval '1 day') RETURNING id`,
+		[]int32{kept, gone}, mixedUser)
+
+	revision := func(id int64) int64 {
+		t.Helper()
+		var rev int64
+		if err := tx.QueryRow(t.Context(), `SELECT configuration_revision FROM access_groups WHERE id = $1`, id).Scan(&rev); err != nil {
+			t.Fatal(err)
+		}
+		return rev
+	}
+	mixedRevision, untouchedRevision := revision(mixedGroup), revision(untouchedGroup)
+
+	if _, err := tx.Exec(t.Context(), `DELETE FROM media_folders WHERE id = ANY($1)`, []int32{gone, alsoGone}); err != nil {
+		t.Fatal(err)
+	}
+
+	requireLibraryIDs(t, tx, "access_groups", mixedGroup, []int32{kept})
+	requireLibraryIDs(t, tx, "access_groups", onlyGoneGroup, []int32{})
+	requireLibraryIDs(t, tx, "access_groups", allGroup, nil)
+	requireLibraryIDs(t, tx, "access_groups", untouchedGroup, []int32{kept})
+	requireLibraryIDs(t, tx, "users", mixedUser, []int32{kept})
+	requireLibraryIDs(t, tx, "users", onlyGoneUser, []int32{})
+	requireLibraryIDs(t, tx, "users", inheritUser, nil)
+	requireLibraryIDs(t, tx, "invitations", invitation, []int32{kept})
+
+	// An edited group gets a new revision, so an admin form opened before the
+	// delete reports a conflict instead of saving the deleted library back.
+	if revision(mixedGroup) == mixedRevision {
+		t.Fatal("pruned group kept its configuration revision")
+	}
+	if revision(untouchedGroup) != untouchedRevision {
+		t.Fatal("group without a deleted library got a new configuration revision")
+	}
+
+	// A write naming a library that does not exist, from any API, keeps only
+	// the libraries that do.
+	missing := gone
+	written := group("access prune written", []int32{kept, missing})
+	requireLibraryIDs(t, tx, "access_groups", written, []int32{kept})
+	if _, err := tx.Exec(t.Context(), `UPDATE users SET library_ids = $1 WHERE id = $2`, []int32{missing}, inheritUser); err != nil {
+		t.Fatal(err)
+	}
+	requireLibraryIDs(t, tx, "users", inheritUser, []int32{})
+}
+
+// TestLibraryDeleteRacingAccessWritePostgres commits a library delete while
+// another transaction is adding that library to an access group. The write
+// waits for the delete, as it would behind a foreign key, and stores only the
+// libraries that still exist.
+func TestLibraryDeleteRacingAccessWritePostgres(t *testing.T) {
+	dsn := os.Getenv("PRAIRIE_TEST_DATABASE_URL")
+	if dsn == "" {
+		t.Skip("PRAIRIE_TEST_DATABASE_URL is not set")
+	}
+	connect := func() *pgx.Conn {
+		t.Helper()
+		conn, err := pgx.Connect(t.Context(), dsn)
+		if err != nil {
+			t.Fatal(err)
+		}
+		t.Cleanup(func() { _ = conn.Close(context.Background()) })
+		return conn
+	}
+	deleter, writer := connect(), connect()
+	ctx := t.Context()
+
+	var kept, doomed int32
+	var groupID int64
+	if err := deleter.QueryRow(ctx, `INSERT INTO media_folders (type, name) VALUES ('movies', 'access race kept') RETURNING id`).Scan(&kept); err != nil {
+		t.Fatal(err)
+	}
+	if err := deleter.QueryRow(ctx, `INSERT INTO media_folders (type, name) VALUES ('movies', 'access race doomed') RETURNING id`).Scan(&doomed); err != nil {
+		t.Fatal(err)
+	}
+	if err := deleter.QueryRow(ctx, `INSERT INTO access_groups (name, library_ids) VALUES ('access race group', $1) RETURNING id`, []int32{kept}).Scan(&groupID); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		_, _ = deleter.Exec(context.Background(), `DELETE FROM access_groups WHERE id = $1`, groupID)
+		_, _ = deleter.Exec(context.Background(), `DELETE FROM media_folders WHERE id = ANY($1)`, []int32{kept, doomed})
+	})
+
+	tx, err := deleter.Begin(ctx)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() { _ = tx.Rollback(context.Background()) }()
+	if _, err := tx.Exec(ctx, `DELETE FROM media_folders WHERE id = $1`, doomed); err != nil {
+		t.Fatal(err)
+	}
+
+	var writerPID uint32
+	if err := writer.QueryRow(ctx, `SELECT pg_backend_pid()`).Scan(&writerPID); err != nil {
+		t.Fatal(err)
+	}
+	wrote := make(chan error, 1)
+	go func() {
+		_, err := writer.Exec(ctx, `UPDATE access_groups SET library_ids = $1 WHERE id = $2`, []int32{kept, doomed}, groupID)
+		wrote <- err
+	}()
+	// Wait until the write is blocked on the delete's lock.
+	for {
+		var waiting bool
+		if err := deleter.QueryRow(ctx, `SELECT EXISTS (SELECT 1 FROM pg_locks WHERE pid = $1 AND NOT granted)`, writerPID).Scan(&waiting); err != nil {
+			t.Fatal(err)
+		}
+		if waiting {
+			break
+		}
+		select {
+		case err := <-wrote:
+			t.Fatalf("write finished before the delete committed: %v", err)
+		default:
+		}
+	}
+	if err := tx.Commit(ctx); err != nil {
+		t.Fatal(err)
+	}
+	if err := <-wrote; err != nil {
+		t.Fatal(err)
+	}
+	var got []int32
+	if err := deleter.QueryRow(ctx, `SELECT library_ids FROM access_groups WHERE id = $1`, groupID).Scan(&got); err != nil {
+		t.Fatal(err)
+	}
+	if !slices.Equal(got, []int32{kept}) {
+		t.Fatalf("library_ids = %v, want [%d]", got, kept)
+	}
+}
+
+const pruneDeletedLibraryAccessMigration = "20261013021242_prune_deleted_library_access_references"
+
+// TestPruneDeletedLibraryAccessMigrationRepairsStaleIDsPostgres runs the
+// migration over references that earlier library deletes left behind: it
+// drops every ID that names no library and leaves NULL lists and intact lists
+// alone. The rollback removes the trigger, and running it again repairs what
+// a delete left behind in between.
+func TestPruneDeletedLibraryAccessMigrationRepairsStaleIDsPostgres(t *testing.T) {
+	tx, schema := adminMigrationFixture(t)
+	migrationExec(t, tx, `
+CREATE TABLE media_folders (id bigint PRIMARY KEY);
+CREATE TABLE access_groups (id bigint PRIMARY KEY, library_ids integer[], updated_at timestamptz NOT NULL DEFAULT now());
+CREATE TABLE users (id bigint PRIMARY KEY, library_ids integer[], updated_at timestamptz NOT NULL DEFAULT now());
+CREATE TABLE invitations (id bigint PRIMARY KEY, library_ids integer[], updated_at timestamptz NOT NULL DEFAULT now());
+INSERT INTO media_folders VALUES (1), (2), (3);
+INSERT INTO access_groups (id, library_ids) VALUES (1, '{3,20,1,23}'), (2, '{20,23}'), (3, NULL), (4, '{2,1}');
+INSERT INTO users (id, library_ids) VALUES (1, '{23,2}'), (2, '{20}'), (3, NULL), (4, '{}');
+INSERT INTO invitations (id, library_ids) VALUES (1, '{1,20}'), (2, NULL);`)
+
+	check := func() {
+		t.Helper()
+		requireLibraryIDs(t, tx, "access_groups", 1, []int32{3, 1})
+		requireLibraryIDs(t, tx, "access_groups", 2, []int32{})
+		requireLibraryIDs(t, tx, "access_groups", 3, nil)
+		requireLibraryIDs(t, tx, "access_groups", 4, []int32{2, 1})
+		requireLibraryIDs(t, tx, "users", 1, []int32{2})
+		requireLibraryIDs(t, tx, "users", 2, []int32{})
+		requireLibraryIDs(t, tx, "users", 3, nil)
+		requireLibraryIDs(t, tx, "users", 4, []int32{})
+		requireLibraryIDs(t, tx, "invitations", 1, []int32{1})
+		requireLibraryIDs(t, tx, "invitations", 2, nil)
+	}
+	migrationExec(t, tx, adminMigrationSQL(t, pruneDeletedLibraryAccessMigration, schema, false))
+	check()
+
+	// The triggers installed in the same schema filter a later write and prune
+	// a later delete.
+	migrationExec(t, tx, `UPDATE invitations SET library_ids = '{3,99}' WHERE id = 2`)
+	requireLibraryIDs(t, tx, "invitations", 2, []int32{3})
+	migrationExec(t, tx, `UPDATE invitations SET library_ids = NULL WHERE id = 2`)
+	migrationExec(t, tx, `DELETE FROM media_folders WHERE id = 2`)
+	requireLibraryIDs(t, tx, "access_groups", 4, []int32{1})
+	requireLibraryIDs(t, tx, "users", 1, []int32{})
+
+	// After the rollback a delete leaves its reference behind again, and
+	// re-running the migration repairs it.
+	migrationExec(t, tx, adminMigrationSQL(t, pruneDeletedLibraryAccessMigration, schema, true))
+	migrationExec(t, tx, `DELETE FROM media_folders WHERE id = 1`)
+	requireLibraryIDs(t, tx, "access_groups", 4, []int32{1})
+	migrationExec(t, tx, adminMigrationSQL(t, pruneDeletedLibraryAccessMigration, schema, false))
+	requireLibraryIDs(t, tx, "access_groups", 1, []int32{3})
+	requireLibraryIDs(t, tx, "access_groups", 4, []int32{})
+	requireLibraryIDs(t, tx, "invitations", 1, []int32{})
+	requireLibraryIDs(t, tx, "access_groups", 3, nil)
+}
diff --git a/migrations/purge_orphaned_recommendation_rows_test.go b/migrations/purge_orphaned_recommendation_rows_test.go
new file mode 100644
index 0000000000..8738158da5
--- /dev/null
+++ b/migrations/purge_orphaned_recommendation_rows_test.go
@@ -0,0 +1,76 @@
+package migrations
+
+import (
+	"testing"
+)
+
+const purgeOrphanedRecommendationRowsMigration = "20261004003240_purge_orphaned_recommendation_rows"
+
+// purgeFixtureSQL builds the tables the purge reads: account 1 keeps profile
+// "live" and once had profile "gone"; account 2 has no profile in
+// user_profiles, as on the SQLite user store. Every table holds a row for
+// each of those profiles, and recommendation_cache also a global row.
+const purgeFixtureSQL = `
+CREATE TABLE users (id integer PRIMARY KEY);
+CREATE TABLE user_profiles (user_id integer, id text, PRIMARY KEY (user_id, id));
+CREATE TABLE server_settings (key text PRIMARY KEY, value text);
+CREATE TABLE user_ratings (user_id integer, profile_id text, media_item_id text);
+CREATE TABLE user_taste_profiles (user_id integer, profile_id text);
+CREATE TABLE user_taste_clusters (user_id integer, profile_id text);
+CREATE TABLE recommendation_cache (user_id integer, profile_id text);
+INSERT INTO users VALUES (1), (2);
+INSERT INTO user_profiles VALUES (1, 'live');
+INSERT INTO user_ratings VALUES (1, 'live', 'm'), (1, 'gone', 'm'), (2, 'elsewhere', 'm');
+INSERT INTO user_taste_profiles VALUES (1, 'live'), (1, 'gone'), (2, 'elsewhere');
+INSERT INTO user_taste_clusters VALUES (1, 'live'), (1, 'gone'), (2, 'elsewhere');
+INSERT INTO recommendation_cache VALUES (1, 'live'), (1, 'gone'), (2, 'elsewhere'), (NULL, '__global__');`
+
+func TestPurgeOrphanedRecommendationRowsPostgres(t *testing.T) {
+	for _, tc := range []struct {
+		name    string
+		backend string // "" leaves the setting unset, which means postgres
+		purged  bool
+	}{
+		{name: "postgres store, setting unset", purged: true},
+		{name: "postgres store", backend: "postgres", purged: true},
+		{name: "sqlite store", backend: "sqlite", purged: false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			tx, schema := adminMigrationFixture(t)
+			migrationExec(t, tx, purgeFixtureSQL)
+			if tc.backend != "" {
+				migrationExec(t, tx, "INSERT INTO server_settings VALUES ('userdb.backend', '"+tc.backend+"')")
+			}
+			migrationExec(t, tx, adminMigrationSQL(t, purgeOrphanedRecommendationRowsMigration, schema, false))
+
+			count := func(table, where string) int {
+				t.Helper()
+				var n int
+				if err := tx.QueryRow(t.Context(), "SELECT count(*) FROM "+table+" WHERE "+where).Scan(&n); err != nil {
+					t.Fatal(err)
+				}
+				return n
+			}
+			for _, table := range []string{"user_ratings", "user_taste_profiles", "user_taste_clusters", "recommendation_cache"} {
+				if got := count(table, "profile_id = 'live'"); got != 1 {
+					t.Fatalf("%s: live profile rows = %d, want 1", table, got)
+				}
+				// An account with no profile in user_profiles is never
+				// treated as orphaned: its profiles may live elsewhere.
+				if got := count(table, "profile_id = 'elsewhere'"); got != 1 {
+					t.Fatalf("%s: rows of an account without Postgres profiles = %d, want 1", table, got)
+				}
+				want := 1
+				if tc.purged {
+					want = 0
+				}
+				if got := count(table, "profile_id = 'gone'"); got != want {
+					t.Fatalf("%s: deleted profile rows = %d, want %d", table, got, want)
+				}
+			}
+			if got := count("recommendation_cache", "user_id IS NULL"); got != 1 {
+				t.Fatalf("global rows = %d, want 1", got)
+			}
+		})
+	}
+}
diff --git a/migrations/rearm_tbd_episode_refresh_debt_test.go b/migrations/rearm_tbd_episode_refresh_debt_test.go
new file mode 100644
index 0000000000..f25b746750
--- /dev/null
+++ b/migrations/rearm_tbd_episode_refresh_debt_test.go
@@ -0,0 +1,79 @@
+package migrations
+
+import (
+	"testing"
+	"time"
+)
+
+func TestRearmTBDEpisodeRefreshDebtPostgres(t *testing.T) {
+	tx, schema := adminMigrationFixture(t)
+	// A zone east of UTC, with a DST change inside the 45-day window for much
+	// of the year, catches cutoffs that use the session time zone.
+	migrationExec(t, tx, `SET LOCAL TimeZone = 'Australia/Sydney'`)
+	migrationExec(t, tx, `
+CREATE TABLE episodes (
+	content_id TEXT PRIMARY KEY, season_id TEXT, series_id TEXT NOT NULL,
+	title TEXT, metadata_source TEXT, tmdb_id TEXT, tvdb_id TEXT, imdb_id TEXT, air_date DATE
+);
+CREATE TABLE metadata_refresh_debt (
+	target_type TEXT NOT NULL, content_id TEXT NOT NULL, reason_mask BIGINT NOT NULL DEFAULT 0,
+	next_refresh_at TIMESTAMPTZ NOT NULL, updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+	PRIMARY KEY (target_type, content_id)
+);
+INSERT INTO episodes VALUES
+	('old-tbd', 'season-a', 'series-a', 'TBD', 'provider', '1', '', '', CURRENT_DATE - 400),
+	('recent-tba', 'season-b', 'series-b', 'tba', 'provider', '2', '', '', CURRENT_DATE - 10),
+	('recent-soon', 'season-b', 'series-b', 'TBA', 'provider', '3', '', '', CURRENT_DATE - 10),
+	('old-fallback', 'season-c', 'series-c', 'TBD', 'scanner_fallback', '4', '', '', CURRENT_DATE - 400),
+	('undated', 'season-d', 'series-d', 'TBD', 'provider', '5', '', '', NULL);
+INSERT INTO metadata_refresh_debt (target_type, content_id, reason_mask, next_refresh_at) VALUES
+	('episode', 'old-tbd', 1, NOW() + INTERVAL '90 days'),
+	('season', 'season-a', 1, NOW() + INTERVAL '90 days'),
+	('item', 'series-a', 1, NOW() + INTERVAL '90 days'),
+	('episode', 'recent-tba', 1, NOW() + INTERVAL '90 days'),
+	('episode', 'recent-soon', 1, NOW() + INTERVAL '1 day'),
+	('season', 'season-b', 1, NOW() + INTERVAL '90 days'),
+	('item', 'series-b', 2, NOW() + INTERVAL '90 days'),
+	('episode', 'old-fallback', 1, NOW() + INTERVAL '90 days'),
+	('episode', 'undated', 1, NOW() + INTERVAL '90 days');`)
+
+	migrationExec(t, tx, adminMigrationSQL(t, "20260928120000_rearm_tbd_episode_refresh_debt", schema, false))
+
+	// The Go check reads air_date as UTC midnight (as pgx does) and adds
+	// EpisodeRecentStillWindow plus a minute; compute the expectation the same way.
+	var recentAirDate string
+	if err := tx.QueryRow(t.Context(), `SELECT (CURRENT_DATE - 10)::text`).Scan(&recentAirDate); err != nil {
+		t.Fatalf("recent air date: %v", err)
+	}
+	aired, err := time.Parse(time.DateOnly, recentAirDate)
+	if err != nil {
+		t.Fatalf("parse recent air date: %v", err)
+	}
+	recentWindowClose := "'" + aired.Add(45*24*time.Hour+time.Minute).Format(time.RFC3339) + "'"
+
+	want := map[string]string{
+		// Old real TBD rows wait an hour so a previous release cannot re-park them.
+		"episode/old-tbd": "NOW() + INTERVAL '1 hour'",
+		"season/season-a": "NOW() + INTERVAL '1 hour'",
+		"item/series-a":   "NOW() + INTERVAL '1 hour'",
+		// Recent rows come due when the 45-day window closes.
+		"episode/recent-tba": recentWindowClose,
+		"season/season-b":    recentWindowClose,
+		// Rows already due sooner, without episode-incomplete debt, or for
+		// episodes the corrected check still flags are left alone.
+		"episode/recent-soon":  "NOW() + INTERVAL '1 day'",
+		"item/series-b":        "NOW() + INTERVAL '90 days'",
+		"episode/old-fallback": "NOW() + INTERVAL '90 days'",
+		"episode/undated":      "NOW() + INTERVAL '90 days'",
+	}
+	for key, expr := range want {
+		var matches bool
+		if err := tx.QueryRow(t.Context(), `SELECT next_refresh_at = (`+expr+`)::timestamptz
+			FROM metadata_refresh_debt WHERE target_type || '/' || content_id = $1`, key).Scan(&matches); err != nil {
+			t.Fatalf("%s: %v", key, err)
+		}
+		if !matches {
+			t.Errorf("%s: next_refresh_at is not %s", key, expr)
+		}
+	}
+}
diff --git a/migrations/release_theintrodb_v3_submit_refusals_test.go b/migrations/release_theintrodb_v3_submit_refusals_test.go
new file mode 100644
index 0000000000..9c21e72b61
--- /dev/null
+++ b/migrations/release_theintrodb_v3_submit_refusals_test.go
@@ -0,0 +1,50 @@
+package migrations
+
+import (
+	"slices"
+	"strings"
+	"testing"
+)
+
+// TestReleaseTheIntroDBV3SubmitRefusalsPostgres checks that only TheIntroDB
+// refusals recorded with HTTP 404, the answer of its retired v3 submit route,
+// are released, and that other refusals and outcomes keep their claims.
+func TestReleaseTheIntroDBV3SubmitRefusalsPostgres(t *testing.T) {
+	tx, schema := adminMigrationFixture(t)
+	migrationExec(t, tx, `
+CREATE TABLE media_items (content_id text PRIMARY KEY, type text NOT NULL, tmdb_id text, imdb_id text, tvdb_id text);
+CREATE TABLE episodes (content_id text PRIMARY KEY, series_id text NOT NULL REFERENCES media_items(content_id), season_number integer, episode_number integer);
+CREATE TABLE media_files (id integer PRIMARY KEY, content_id text, episode_id text REFERENCES episodes(content_id));
+INSERT INTO media_items VALUES ('series-a', 'series', '1399', '', '');
+INSERT INTO episodes VALUES ('series-a-1-1', 'series-a', 1, 1);
+INSERT INTO media_files VALUES (1, 'series-a', 'series-a-1-1');`)
+	migrationExec(t, tx, adminMigrationSQL(t, "182_marker_contributions", schema, false))
+	migrationExec(t, tx, withoutConcurrently(adminMigrationSQL(t, "20260807140637_settle_marker_contribution_conflicts", schema, false)))
+	migrationExec(t, tx, withoutConcurrently(adminMigrationSQL(t, "20260925144545_key_marker_contribution_claims_by_target", schema, false)))
+
+	// One file, one claim per provider and segment: v3 route refusals from the
+	// plugin and the legacy built-in provider, a real 400 refusal, another
+	// provider's 404, and outcomes that are not refusals.
+	migrationExec(t, tx, `
+INSERT INTO marker_contributions (id, media_file_id, provider, segment_kind, source, content_hash, status, http_status, claim_active, target_key) VALUES
+ ('00000000-0000-0000-0000-000000000001', 1, 'plugin:4:introdb', 'intro', 'scanner', 'hash-1', 'invalid', 404, true, 'episode|tmdb:1399|1|1'),
+ ('00000000-0000-0000-0000-000000000002', 1, 'introdb', 'intro', 'scanner', 'hash-2', 'invalid', 404, true, 'episode|tmdb:1399|1|1'),
+ ('00000000-0000-0000-0000-000000000003', 1, 'plugin:4:introdb', 'credits', 'scanner', 'hash-3', 'invalid', 400, true, 'episode|tmdb:1399|1|1'),
+ ('00000000-0000-0000-0000-000000000004', 1, 'plugin:9:markers', 'intro', 'scanner', 'hash-4', 'invalid', 404, true, 'episode|tmdb:1399|1|1'),
+ ('00000000-0000-0000-0000-000000000005', 1, 'plugin:4:introdb', 'recap', 'manual', 'hash-5', 'conflict', 409, true, 'episode|tmdb:1399|1|1'),
+ ('00000000-0000-0000-0000-000000000006', 1, 'plugin:4:introdb', 'preview', 'manual', 'hash-6', 'pending', NULL, true, 'episode|tmdb:1399|1|1')`)
+
+	migrationExec(t, tx, adminMigrationSQL(t, "20261017200720_release_theintrodb_v3_submit_refusals", schema, false))
+
+	want := []string{
+		"00000000-0000-0000-0000-000000000001 error false",
+		"00000000-0000-0000-0000-000000000002 error false",
+		"00000000-0000-0000-0000-000000000003 invalid true",
+		"00000000-0000-0000-0000-000000000004 invalid true",
+		"00000000-0000-0000-0000-000000000005 conflict true",
+		"00000000-0000-0000-0000-000000000006 pending true",
+	}
+	if got := markerContributionRows(t, tx, "status || ' ' || claim_active::text"); !slices.Equal(got, want) {
+		t.Fatalf("rows:\n%s\nwant:\n%s", strings.Join(got, "\n"), strings.Join(want, "\n"))
+	}
+}
diff --git a/migrations/retire_trakt_test.go b/migrations/retire_trakt_test.go
new file mode 100644
index 0000000000..c6d04f89ae
--- /dev/null
+++ b/migrations/retire_trakt_test.go
@@ -0,0 +1,203 @@
+package migrations
+
+import (
+	"encoding/json"
+	"reflect"
+	"slices"
+	"testing"
+)
+
+const (
+	retireTraktMigration          = "20261016131356_retire_trakt"
+	retireTraktWatchSyncMigration = "20261016134645_retire_trakt_watch_sync"
+)
+
+// The two migrations convert every Trakt-backed collection and home row,
+// delete the Trakt connections, credentials and snapshots, disable the Trakt
+// plugin, and leave everything else alone.
+func TestRetireTraktMigrationPostgres(t *testing.T) {
+	tx, schema := adminMigrationFixture(t)
+	migrationExec(t, tx, `
+CREATE TABLE library_collections (
+    id text PRIMARY KEY,
+    collection_type text NOT NULL,
+    source_config jsonb NOT NULL DEFAULT '{}'::jsonb,
+    source_url text NOT NULL DEFAULT '',
+    sync_schedule text,
+    next_sync_at timestamptz,
+    updated_at timestamptz NOT NULL DEFAULT now(),
+    CONSTRAINT library_collections_collection_type_check
+        CHECK (collection_type = ANY (ARRAY['manual', 'smart', 'mdblist', 'tmdb', 'trakt']))
+);
+CREATE TABLE user_personal_collections (
+    id text PRIMARY KEY,
+    collection_type text NOT NULL,
+    source_config jsonb NOT NULL DEFAULT '{}'::jsonb,
+    source_url text NOT NULL DEFAULT '',
+    sync_schedule text,
+    next_sync_at timestamptz,
+    updated_at timestamptz NOT NULL DEFAULT now(),
+    CONSTRAINT user_personal_collections_type_check
+        CHECK (collection_type IN ('manual', 'smart', 'mdblist', 'tmdb', 'trakt', 'synced', 'playlist'))
+);
+CREATE TABLE page_sections (
+    id text PRIMARY KEY,
+    section_type text NOT NULL,
+    config jsonb NOT NULL DEFAULT '{}'::jsonb,
+    enabled boolean NOT NULL DEFAULT true,
+    updated_at timestamptz NOT NULL DEFAULT now()
+);
+CREATE TABLE user_settings (user_id integer NOT NULL, key text NOT NULL, value text NOT NULL);
+CREATE TABLE trending_discover_snapshots (source text NOT NULL, time_window text NOT NULL);
+CREATE TABLE watch_provider_connections (id uuid PRIMARY KEY, provider text NOT NULL);
+CREATE TABLE watch_provider_sync_runs (
+    connection_id uuid NOT NULL REFERENCES watch_provider_connections(id) ON DELETE CASCADE
+);
+CREATE TABLE watch_provider_auth_sessions (provider text NOT NULL);
+CREATE TABLE server_settings (key text PRIMARY KEY, value text NOT NULL);
+CREATE TABLE plugin_installations (
+    plugin_id text NOT NULL,
+    enabled boolean NOT NULL DEFAULT true,
+    updated_at timestamptz NOT NULL DEFAULT now()
+);
+
+INSERT INTO library_collections (id, collection_type, source_config, source_url, sync_schedule, next_sync_at) VALUES
+    ('trakt-preset', 'trakt', '{"mode":"trakt_preset","provider":"trakt","preset":"trending"}', 'trakt://trending/movie', 'daily', now()),
+    ('trakt-list', 'trakt', '{"mode":"trakt_list","provider":"trakt","url":"https://trakt.tv/users/u/lists/l"}', 'https://trakt.tv/users/u/lists/l', 'weekly', now()),
+    ('tmdb', 'tmdb', '{"mode":"tmdb_preset","preset":"popular"}', 'tmdb://popular/movie', 'daily', now());
+INSERT INTO user_personal_collections (id, collection_type, source_config, source_url, sync_schedule, next_sync_at) VALUES
+    ('mine-trakt', 'trakt', '{"mode":"trakt_preset","provider":"trakt"}', 'trakt://popular/tv', 'daily', now()),
+    ('mine-mdblist', 'mdblist', '{"mode":"mdblist_json"}', 'https://mdblist.com/lists/u/l', 'daily', now()),
+    ('abs-playlist', 'playlist', '{}', '', NULL, NULL);
+INSERT INTO page_sections (id, section_type, config, enabled) VALUES
+    ('trakt-trending', 'trending_discover', '{"source":"trakt","window":"week"}', true),
+    ('tmdb-trending', 'trending_discover', '{"source":"tmdb","window":"day"}', true),
+    ('trakt-collection', 'collection', '{"library_collection_id":"trakt-preset","source_provider":"trakt"}', true);
+INSERT INTO user_settings (user_id, key, value) VALUES
+    (1, 'section_overrides:p1:home', '[{"ID":"own","SectionID":"","Hidden":false,"UserSectionType":"trending_discover","UserConfig":"{\"source\":\"trakt\",\"window\":\"day\"}","Config":""},{"ID":"linked","SectionID":"trakt-collection","Hidden":false,"Config":"{\"library_collection_id\":\"trakt-preset\",\"source_provider\":\"trakt\"}","UserConfig":""},{"ID":"keep","SectionID":"","Hidden":false,"UserSectionType":"trending_discover","UserConfig":"{\"source\":\"tmdb\",\"window\":\"day\"}","Config":""}]'),
+    (1, 'section_overrides:p2:home', 'not json about trakt'),
+    (1, 'ui.note', 'trakt');
+INSERT INTO trending_discover_snapshots VALUES ('trakt', 'week'), ('tmdb', 'day');
+INSERT INTO watch_provider_connections VALUES
+    ('00000000-0000-4000-8000-000000000001', 'trakt'),
+    ('00000000-0000-4000-8000-000000000002', 'simkl');
+INSERT INTO watch_provider_sync_runs VALUES
+    ('00000000-0000-4000-8000-000000000001'),
+    ('00000000-0000-4000-8000-000000000002');
+INSERT INTO watch_provider_auth_sessions VALUES ('trakt'), ('simkl');
+INSERT INTO server_settings VALUES
+    ('watchsync.trakt.client_id', 'id'),
+    ('watchsync.trakt.client_secret', 'secret'),
+    ('watchsync.plugin_migration.trakt', 'plugin'),
+    ('watchsync.plugin_app_seeded.trakt', 'true'),
+    ('watchsync.simkl.client_id', 'id'),
+    ('watchsync.plugin_migration.simkl', 'plugin');
+INSERT INTO plugin_installations (plugin_id) VALUES ('prairie.watchprovider.trakt'), ('prairie.watchprovider.simkl');`)
+
+	values := func(query string) []string {
+		t.Helper()
+		rows, err := tx.Query(t.Context(), query)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer rows.Close()
+		var got []string
+		for rows.Next() {
+			var value string
+			if err := rows.Scan(&value); err != nil {
+				t.Fatal(err)
+			}
+			got = append(got, value)
+		}
+		if err := rows.Err(); err != nil {
+			t.Fatal(err)
+		}
+		return got
+	}
+	check := func(label, query string, want ...string) {
+		t.Helper()
+		if got := values(query); !slices.Equal(got, want) {
+			t.Fatalf("%s = %q, want %q", label, got, want)
+		}
+	}
+	verify := func() {
+		t.Helper()
+		check("library collections",
+			`SELECT id || ' ' || collection_type || ' ' || source_config::text || ' ' || source_url || ' ' || (sync_schedule IS NULL)::text || ' ' || (next_sync_at IS NULL)::text FROM library_collections ORDER BY id`,
+			`tmdb tmdb {"mode": "tmdb_preset", "preset": "popular"} tmdb://popular/movie false false`,
+			`trakt-list manual {}  true true`,
+			`trakt-preset manual {}  true true`)
+		check("personal collections",
+			`SELECT id || ' ' || collection_type || ' ' || source_config::text || ' ' || (sync_schedule IS NULL)::text FROM user_personal_collections ORDER BY id`,
+			`abs-playlist playlist {} true`,
+			`mine-mdblist mdblist {"mode": "mdblist_json"} false`,
+			`mine-trakt manual {} true`)
+		check("page sections",
+			`SELECT id || ' ' || config::text || ' ' || enabled::text FROM page_sections ORDER BY id`,
+			`tmdb-trending {"source": "tmdb", "window": "day"} true`,
+			`trakt-collection {"library_collection_id": "trakt-preset"} true`,
+			`trakt-trending {"source": "tmdb", "window": "week"} false`)
+		check("unparsed and unrelated settings",
+			`SELECT value FROM user_settings WHERE key <> 'section_overrides:p1:home' ORDER BY key`,
+			"not json about trakt", "trakt")
+		check("snapshots", `SELECT source || '|' || time_window FROM trending_discover_snapshots`, "tmdb|day")
+		check("connections", `SELECT provider FROM watch_provider_connections`, "simkl")
+		check("sync runs", `SELECT connection_id::text FROM watch_provider_sync_runs`, "00000000-0000-4000-8000-000000000002")
+		check("auth sessions", `SELECT provider FROM watch_provider_auth_sessions`, "simkl")
+		check("server settings", `SELECT key FROM server_settings ORDER BY key`, "watchsync.plugin_migration.simkl", "watchsync.simkl.client_id")
+		check("plugins", `SELECT plugin_id || ' ' || enabled::text FROM plugin_installations ORDER BY plugin_id`,
+			"prairie.watchprovider.simkl true", "prairie.watchprovider.trakt false")
+
+		var stored string
+		if err := tx.QueryRow(t.Context(), `SELECT value FROM user_settings WHERE key = 'section_overrides:p1:home'`).Scan(&stored); err != nil {
+			t.Fatal(err)
+		}
+		var overrides []map[string]any
+		if err := json.Unmarshal([]byte(stored), &overrides); err != nil {
+			t.Fatalf("overrides %q: %v", stored, err)
+		}
+		config := func(raw any) map[string]any {
+			t.Helper()
+			var v map[string]any
+			if err := json.Unmarshal([]byte(raw.(string)), &v); err != nil {
+				t.Fatalf("config %v: %v", raw, err)
+			}
+			return v
+		}
+		if len(overrides) != 3 {
+			t.Fatalf("overrides = %v", overrides)
+		}
+		if own := overrides[0]; own["ID"] != "own" || own["Hidden"] != true || !reflect.DeepEqual(config(own["UserConfig"]), map[string]any{"source": "tmdb", "window": "week"}) {
+			t.Fatalf("own trending override = %v, want hidden TMDB weekly", own)
+		}
+		if linked := overrides[1]; linked["ID"] != "linked" || linked["Hidden"] != false || !reflect.DeepEqual(config(linked["Config"]), map[string]any{"library_collection_id": "trakt-preset"}) {
+			t.Fatalf("linked collection override = %v, want the Trakt marker dropped", linked)
+		}
+		if keep := overrides[2]; keep["ID"] != "keep" || keep["Hidden"] != false || keep["UserConfig"] != `{"source":"tmdb","window":"day"}` {
+			t.Fatalf("TMDB override = %v, want unchanged", keep)
+		}
+	}
+
+	migrate := func(down bool) {
+		t.Helper()
+		if down {
+			migrationExec(t, tx, adminMigrationSQL(t, retireTraktWatchSyncMigration, schema, true))
+			migrationExec(t, tx, adminMigrationSQL(t, retireTraktMigration, schema, true))
+			return
+		}
+		migrationExec(t, tx, adminMigrationSQL(t, retireTraktMigration, schema, false))
+		migrationExec(t, tx, adminMigrationSQL(t, retireTraktWatchSyncMigration, schema, false))
+	}
+
+	migrate(false)
+	verify()
+	requireMigrationSQLState(t, tx, `INSERT INTO library_collections (id, collection_type) VALUES ('new', 'trakt')`, "23514")
+	requireMigrationSQLState(t, tx, `INSERT INTO user_personal_collections (id, collection_type) VALUES ('new', 'trakt')`, "23514")
+	migrationExec(t, tx, `INSERT INTO user_personal_collections (id, collection_type) VALUES ('new-playlist', 'playlist'); DELETE FROM user_personal_collections WHERE id = 'new-playlist'`)
+
+	// The rollback only widens the constraints again, and re-running the
+	// migrations changes nothing.
+	migrate(true)
+	migrate(false)
+	verify()
+}
diff --git a/migrations/sql/20260928120000_rearm_tbd_episode_refresh_debt.sql b/migrations/sql/20260928120000_rearm_tbd_episode_refresh_debt.sql
new file mode 100644
index 0000000000..0ae5d9f0dc
--- /dev/null
+++ b/migrations/sql/20260928120000_rearm_tbd_episode_refresh_debt.sql
@@ -0,0 +1,80 @@
+-- Episodes whose real title is "TBA" or "TBD" were kept in metadata refresh
+-- debt as if the title were a placeholder, and after three attempts those rows
+-- were parked for 90 days. The completeness check now only treats that title
+-- as provisional while the episode is undated or aired recently
+-- (EpisodeRecentStillWindow, 45 days), and the refresh debt for such an
+-- episode is due again once that window closes.
+--
+-- Pull forward only the parked rows the corrected check would now clear:
+-- provider-matched, non-fallback episodes titled TBA/TBD, plus the season and
+-- series rows carrying episode-incomplete debt for them. Rows for episodes that
+-- aired more than 45 days ago come due in one hour, not immediately, so
+-- application instances still running the previous release during an upgrade
+-- do not claim them and park them again with the old check. Rows for episodes
+-- still inside the window come due when it closes, as new debt does. Each
+-- refresh re-evaluates its target and deletes or recomputes the debt, leaving
+-- any other gaps in place.
+--
+-- The Go check reads air_date as UTC midnight and adds whole 24-hour days, so
+-- the cutoffs add the interval to the DATE and read the result as UTC instead
+-- of letting the session time zone (and its DST changes) shift them.
+
+-- +goose Up
+-- +goose StatementBegin
+CREATE TEMP TABLE tbd_cleared_episodes ON COMMIT DROP AS
+SELECT e.content_id,
+       e.season_id,
+       e.series_id,
+       CASE
+           WHEN (e.air_date + INTERVAL '45 days') AT TIME ZONE 'UTC' < NOW() THEN NOW() + INTERVAL '1 hour'
+           ELSE (e.air_date + INTERVAL '45 days 1 minute') AT TIME ZONE 'UTC'
+       END AS due_at
+FROM episodes e
+WHERE BTRIM(COALESCE(e.title, '')) ~* '^(tba|tbd)$'
+  AND LOWER(BTRIM(COALESCE(e.metadata_source, ''))) <> 'scanner_fallback'
+  AND (
+      BTRIM(COALESCE(e.tmdb_id, '')) <> ''
+      OR BTRIM(COALESCE(e.tvdb_id, '')) <> ''
+      OR BTRIM(COALESCE(e.imdb_id, '')) <> ''
+  )
+  AND e.air_date IS NOT NULL;
+
+UPDATE metadata_refresh_debt d
+SET next_refresh_at = c.due_at,
+    updated_at = NOW()
+FROM tbd_cleared_episodes c
+WHERE d.target_type = 'episode'
+  AND d.content_id = c.content_id
+  AND d.next_refresh_at > c.due_at;
+
+UPDATE metadata_refresh_debt d
+SET next_refresh_at = c.due_at,
+    updated_at = NOW()
+FROM (
+    SELECT season_id, MIN(due_at) AS due_at
+    FROM tbd_cleared_episodes
+    WHERE season_id IS NOT NULL
+    GROUP BY season_id
+) c
+WHERE d.target_type = 'season'
+  AND (d.reason_mask & 1) <> 0
+  AND d.content_id = c.season_id
+  AND d.next_refresh_at > c.due_at;
+
+UPDATE metadata_refresh_debt d
+SET next_refresh_at = c.due_at,
+    updated_at = NOW()
+FROM (
+    SELECT series_id, MIN(due_at) AS due_at
+    FROM tbd_cleared_episodes
+    GROUP BY series_id
+) c
+WHERE d.target_type = 'item'
+  AND (d.reason_mask & 1) <> 0
+  AND d.content_id = c.series_id
+  AND d.next_refresh_at > c.due_at;
+-- +goose StatementEnd
+
+-- +goose Down
+-- Nothing to undo: moving a refresh earlier only schedules a re-evaluation.
+SELECT 1;
diff --git a/migrations/sql/20261003232951_allow_cleared_taste_vectors.sql b/migrations/sql/20261003232951_allow_cleared_taste_vectors.sql
new file mode 100644
index 0000000000..d90e5c1107
--- /dev/null
+++ b/migrations/sql/20261003232951_allow_cleared_taste_vectors.sql
@@ -0,0 +1,15 @@
+-- +goose Up
+-- A taste profile with no positive signal keeps its row (signal counts, stale
+-- mark) but has no taste vector: a vector built only from disliked or abandoned
+-- titles points away from them and recommends their opposites. NULL marks that
+-- state. Dropping NOT NULL is a catalog-only change; the HNSW index skips NULL
+-- rows.
+ALTER TABLE public.user_taste_profiles
+    ALTER COLUMN embedding DROP NOT NULL;
+
+-- +goose Down
+-- Rows without a vector cannot satisfy NOT NULL; the next refresh rebuilds
+-- them.
+DELETE FROM public.user_taste_profiles WHERE embedding IS NULL;
+ALTER TABLE public.user_taste_profiles
+    ALTER COLUMN embedding SET NOT NULL;
diff --git a/migrations/sql/20261004003240_purge_orphaned_recommendation_rows.sql b/migrations/sql/20261004003240_purge_orphaned_recommendation_rows.sql
new file mode 100644
index 0000000000..88d85e9b38
--- /dev/null
+++ b/migrations/sql/20261004003240_purge_orphaned_recommendation_rows.sql
@@ -0,0 +1,45 @@
+-- +goose Up
+-- Deleting a profile left its ratings, taste vector, taste clusters and cached
+-- recommendation rows behind. None of these tables has a foreign key to
+-- user_profiles (profiles may live outside Postgres), so the rows outlived the
+-- profile: the nightly job kept rebuilding the deleted profile's taste, and its
+-- ratings kept feeding other accounts' Similar Users rows. Profile deletion
+-- now purges them; this removes the rows earlier deletions left.
+--
+-- Only on the Postgres user store, where user_profiles holds every profile.
+-- With the SQLite user store, profiles live in per-user SQLite files and
+-- user_profiles does not list them, so an orphan cannot be told from a live
+-- profile here and nothing is deleted. As a further guard, an account with no
+-- row at all in user_profiles is skipped. Global recommendation rows
+-- (user_id NULL) belong to no profile and stay.
+-- +goose StatementBegin
+DO $$
+BEGIN
+    IF COALESCE((SELECT value FROM public.server_settings WHERE key = 'userdb.backend'), 'postgres') <> 'postgres' THEN
+        RETURN;
+    END IF;
+
+    DELETE FROM public.user_ratings t
+    WHERE EXISTS (SELECT 1 FROM public.user_profiles p WHERE p.user_id = t.user_id)
+      AND NOT EXISTS (SELECT 1 FROM public.user_profiles p WHERE p.user_id = t.user_id AND p.id = t.profile_id);
+
+    DELETE FROM public.user_taste_profiles t
+    WHERE EXISTS (SELECT 1 FROM public.user_profiles p WHERE p.user_id = t.user_id)
+      AND NOT EXISTS (SELECT 1 FROM public.user_profiles p WHERE p.user_id = t.user_id AND p.id = t.profile_id);
+
+    DELETE FROM public.user_taste_clusters t
+    WHERE EXISTS (SELECT 1 FROM public.user_profiles p WHERE p.user_id = t.user_id)
+      AND NOT EXISTS (SELECT 1 FROM public.user_profiles p WHERE p.user_id = t.user_id AND p.id = t.profile_id);
+
+    DELETE FROM public.recommendation_cache t
+    WHERE t.user_id IS NOT NULL
+      AND EXISTS (SELECT 1 FROM public.user_profiles p WHERE p.user_id = t.user_id)
+      AND NOT EXISTS (SELECT 1 FROM public.user_profiles p WHERE p.user_id = t.user_id AND p.id = t.profile_id);
+END;
+$$;
+-- +goose StatementEnd
+
+-- +goose Down
+-- The deleted rows belonged to profiles that no longer exist; there is
+-- nothing to restore.
+SELECT 1;
diff --git a/migrations/sql/20261011170130_index_default_recommendation_rows.sql b/migrations/sql/20261011170130_index_default_recommendation_rows.sql
new file mode 100644
index 0000000000..5b6ea48c89
--- /dev/null
+++ b/migrations/sql/20261011170130_index_default_recommendation_rows.sql
@@ -0,0 +1,44 @@
+-- +goose NO TRANSACTION
+
+-- +goose Up
+-- Discover's live default rows, Recently Added and Highly Rated in Your
+-- Library, read each recommendable media type newest or best ranked first.
+-- These indexes supply that order per type, so a read walks only until the
+-- row is full instead of sorting every movie and series in the catalog. The
+-- expressions repeat addedAtSQL and catalogRatingOrderSQL in
+-- internal/recommendations/repo.go and must stay identical to them.
+-- An earlier interrupted build can leave an invalid index behind; drop it
+-- so IF NOT EXISTS does not keep it.
+-- +goose StatementBegin
+DO $$
+DECLARE
+    name text;
+BEGIN
+    FOREACH name IN ARRAY ARRAY['idx_media_items_type_added_at', 'idx_media_items_type_catalog_rank'] LOOP
+        IF EXISTS (
+            SELECT 1 FROM pg_class c
+            JOIN pg_namespace n ON n.oid = c.relnamespace
+            JOIN pg_index i ON i.indexrelid = c.oid
+            WHERE n.nspname = 'public' AND c.relname = name AND NOT i.indisvalid
+        ) THEN
+            EXECUTE format('DROP INDEX public.%I', name);
+        END IF;
+    END LOOP;
+END;
+$$;
+-- +goose StatementEnd
+CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_media_items_type_added_at
+    ON public.media_items (type, GREATEST(created_at, COALESCE(latest_episode_added_at, created_at)) DESC, content_id);
+CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_media_items_type_catalog_rank
+    ON public.media_items (
+        type,
+        (logo_path IS NOT NULL AND logo_path <> '' AND COALESCE(cardinality(keywords), 0) >= 5) DESC,
+        (CASE WHEN rating_imdb < 9.6 THEN 2 WHEN rating_tmdb < 9.5 THEN 1 ELSE 0 END) DESC,
+        (CASE WHEN rating_imdb < 9.6 THEN rating_imdb END) DESC NULLS LAST,
+        (CASE WHEN rating_tmdb < 9.5 THEN rating_tmdb END) DESC NULLS LAST,
+        content_id
+    );
+
+-- +goose Down
+DROP INDEX CONCURRENTLY IF EXISTS public.idx_media_items_type_catalog_rank;
+DROP INDEX CONCURRENTLY IF EXISTS public.idx_media_items_type_added_at;
diff --git a/migrations/sql/20261013021242_prune_deleted_library_access_references.sql b/migrations/sql/20261013021242_prune_deleted_library_access_references.sql
new file mode 100644
index 0000000000..74601cb4f6
--- /dev/null
+++ b/migrations/sql/20261013021242_prune_deleted_library_access_references.sql
@@ -0,0 +1,116 @@
+-- +goose Up
+-- Access groups, account overrides and invitations name libraries in integer
+-- arrays, which no foreign key covers, so deleting a library used to leave its
+-- ID behind: the admin pages listed it as "#20" and counted it as a library,
+-- and saving the policy kept it. Profile allowlists are a join table and
+-- already cascade.
+--
+-- existing_library_ids keeps the IDs that still name a library, in their
+-- order. A list left with none becomes empty, never NULL: NULL means every
+-- library, so pruning must not widen access.
+-- +goose StatementBegin
+CREATE FUNCTION public.existing_library_ids(ids integer[])
+RETURNS integer[]
+LANGUAGE sql
+STABLE
+STRICT
+AS $$
+    SELECT COALESCE(array_agg(listed.id ORDER BY listed.position), '{}')
+    FROM unnest(ids) WITH ORDINALITY AS listed(id, position)
+    WHERE EXISTS (SELECT 1 FROM public.media_folders f WHERE f.id = listed.id)
+$$;
+-- +goose StatementEnd
+
+-- Prune on every library delete, in the deleting statement, so no path can
+-- leave a reference behind. Changing users.library_ids does not bump
+-- access_policy_revision, so members stay signed in; the edited rows still get
+-- a new admin or configuration revision, so an admin form opened before the
+-- delete gets a conflict instead of saving the deleted library back.
+-- +goose StatementBegin
+CREATE FUNCTION public.prune_deleted_library_access_references()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+DECLARE
+    deleted integer[];
+BEGIN
+    -- library_ids is integer[], so a library past its range can't be listed.
+    SELECT array_agg(old_rows.id)::integer[] INTO deleted
+    FROM old_rows WHERE old_rows.id <= 2147483647;
+    IF deleted IS NULL THEN
+        RETURN NULL; -- nothing listable deleted, or a retry found it gone
+    END IF;
+    UPDATE public.access_groups
+    SET library_ids = public.existing_library_ids(library_ids), updated_at = now()
+    WHERE library_ids && deleted;
+    UPDATE public.users
+    SET library_ids = public.existing_library_ids(library_ids), updated_at = now()
+    WHERE library_ids && deleted;
+    UPDATE public.invitations
+    SET library_ids = public.existing_library_ids(library_ids), updated_at = now()
+    WHERE library_ids && deleted;
+    RETURN NULL;
+END;
+$$;
+-- +goose StatementEnd
+
+CREATE TRIGGER media_folders_prune_access_references
+    AFTER DELETE ON public.media_folders
+    REFERENCING OLD TABLE AS old_rows
+    FOR EACH STATEMENT
+    EXECUTE FUNCTION public.prune_deleted_library_access_references();
+
+-- Every write keeps only IDs that name a library, whichever API or node made
+-- it, as a foreign key would: it locks the named libraries, so a concurrent
+-- delete either waits for the write and then prunes it, or commits first and
+-- its ID is dropped here. A write that only removes IDs adds nothing to check,
+-- which keeps the prune above from locking the libraries it is not deleting.
+-- +goose StatementBegin
+CREATE FUNCTION public.keep_existing_library_ids()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+    IF TG_OP = 'UPDATE' AND NEW.library_ids <@ OLD.library_ids THEN
+        RETURN NEW;
+    END IF;
+    PERFORM 1 FROM public.media_folders WHERE id = ANY (NEW.library_ids) FOR KEY SHARE;
+    NEW.library_ids := public.existing_library_ids(NEW.library_ids);
+    RETURN NEW;
+END;
+$$;
+-- +goose StatementEnd
+
+CREATE TRIGGER access_groups_keep_existing_library_ids
+    BEFORE INSERT OR UPDATE OF library_ids ON public.access_groups
+    FOR EACH ROW WHEN (NEW.library_ids IS NOT NULL)
+    EXECUTE FUNCTION public.keep_existing_library_ids();
+CREATE TRIGGER users_keep_existing_library_ids
+    BEFORE INSERT OR UPDATE OF library_ids ON public.users
+    FOR EACH ROW WHEN (NEW.library_ids IS NOT NULL)
+    EXECUTE FUNCTION public.keep_existing_library_ids();
+CREATE TRIGGER invitations_keep_existing_library_ids
+    BEFORE INSERT OR UPDATE OF library_ids ON public.invitations
+    FOR EACH ROW WHEN (NEW.library_ids IS NOT NULL)
+    EXECUTE FUNCTION public.keep_existing_library_ids();
+
+-- Repair the references earlier deletes left behind.
+UPDATE public.access_groups
+SET library_ids = public.existing_library_ids(library_ids), updated_at = now()
+WHERE library_ids IS DISTINCT FROM public.existing_library_ids(library_ids);
+UPDATE public.users
+SET library_ids = public.existing_library_ids(library_ids), updated_at = now()
+WHERE library_ids IS DISTINCT FROM public.existing_library_ids(library_ids);
+UPDATE public.invitations
+SET library_ids = public.existing_library_ids(library_ids), updated_at = now()
+WHERE library_ids IS DISTINCT FROM public.existing_library_ids(library_ids);
+
+-- +goose Down
+-- The repaired IDs named no library, so there is nothing to restore.
+DROP TRIGGER IF EXISTS invitations_keep_existing_library_ids ON public.invitations;
+DROP TRIGGER IF EXISTS users_keep_existing_library_ids ON public.users;
+DROP TRIGGER IF EXISTS access_groups_keep_existing_library_ids ON public.access_groups;
+DROP FUNCTION IF EXISTS public.keep_existing_library_ids();
+DROP TRIGGER IF EXISTS media_folders_prune_access_references ON public.media_folders;
+DROP FUNCTION IF EXISTS public.prune_deleted_library_access_references();
+DROP FUNCTION IF EXISTS public.existing_library_ids(integer[]);
diff --git a/migrations/sql/20261013170245_requeue_trickplay_hdr_and_repairable_sheets.sql b/migrations/sql/20261013170245_requeue_trickplay_hdr_and_repairable_sheets.sql
new file mode 100644
index 0000000000..47290631c4
--- /dev/null
+++ b/migrations/sql/20261013170245_requeue_trickplay_hdr_and_repairable_sheets.sql
@@ -0,0 +1,29 @@
+-- +goose Up
+-- Trickplay sheets now convert HDR with the chains playback validated for the
+-- source's base signal, and repair cells a list read missed or repeated (see
+-- docs/architecture/trickplay.md). Regenerate the published sheets the old
+-- way got wrong, while they keep serving until their replacement publishes:
+-- HDR sheets the VAAPI or QSV tone mapper made, which rendered a Dolby Vision
+-- base without its RPU (green and magenta) and HLG as PQ, and sheets with
+-- cells filled from a neighbor. Files whose last attempts failed, such as
+-- VC-1 in Matroska, which flags no keyframes, are tried again now instead of
+-- after their backoff.
+UPDATE public.media_file_trickplay t
+SET state = 'pending', available_at = now(), failure_count = 0, last_error = '', updated_at = now()
+FROM public.media_files mf
+WHERE mf.id = t.media_file_id
+  AND t.state = 'ready'
+  AND (
+    (t.decoder IN ('hardware:vaapi', 'hardware:qsv')
+      AND (mf.hdr OR btrim(COALESCE(mf.video_tracks -> 0 ->> 'dolby_vision', '')) <> ''))
+    OR COALESCE(t.filled, 0) > 0
+  );
+
+UPDATE public.media_file_trickplay
+SET available_at = now(), updated_at = now()
+WHERE state = 'pending' AND failure_count > 0 AND available_at > now();
+
+-- +goose Down
+-- Requeued rows regenerate or keep serving their sheets; there is nothing to
+-- restore.
+SELECT 1;
diff --git a/migrations/sql/20261013231605_access_group_max_profiles.sql b/migrations/sql/20261013231605_access_group_max_profiles.sql
new file mode 100644
index 0000000000..3d886a9315
--- /dev/null
+++ b/migrations/sql/20261013231605_access_group_max_profiles.sql
@@ -0,0 +1,78 @@
+-- +goose Up
+-- Access groups set the household profile limit, and an account's
+-- max_profiles becomes an override like its other policy fields: NULL
+-- inherits the group's value. Every account stored a value, 5 unless an admin
+-- changed it (093), so a 5 becomes NULL and inherits the new group column's 5;
+-- any other value was chosen by an admin and stays as an override. Accounts
+-- outside every group, admins included, resolve NULL to 5
+-- (access.DefaultMaxProfiles), so no account's limit changes here.
+ALTER TABLE access_groups
+    ADD COLUMN max_profiles integer NOT NULL DEFAULT 5
+        CONSTRAINT access_groups_max_profiles_min_check CHECK (max_profiles >= 1);
+
+ALTER TABLE users
+    ALTER COLUMN max_profiles DROP NOT NULL,
+    ALTER COLUMN max_profiles DROP DEFAULT;
+
+UPDATE users SET max_profiles = NULL WHERE max_profiles = 5;
+
+-- Keep access-group ETags accurate when the profile limit changes.
+-- +goose StatementBegin
+CREATE OR REPLACE FUNCTION advance_access_group_configuration_revision() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+ IF TG_OP = 'INSERT' THEN
+  NEW.configuration_revision := nextval('access_group_configuration_revision_seq');
+ ELSIF ROW(NEW.id,NEW.name,NEW.description,NEW.library_ids,NEW.max_playback_quality,
+ NEW.download_allowed,NEW.download_transcode_allowed,NEW.transcode_allowed,NEW.audio_transcode_allowed,
+ NEW.max_streams,NEW.max_transcodes,NEW.max_remote_stream_bitrate_kbps,NEW.max_local_stream_bitrate_kbps,
+ NEW.max_profiles,NEW.allowed_permissions,NEW.requests_allowed,NEW.is_default,NEW.created_at,NEW.updated_at)
+ IS DISTINCT FROM ROW(OLD.id,OLD.name,OLD.description,OLD.library_ids,OLD.max_playback_quality,
+ OLD.download_allowed,OLD.download_transcode_allowed,OLD.transcode_allowed,OLD.audio_transcode_allowed,
+ OLD.max_streams,OLD.max_transcodes,OLD.max_remote_stream_bitrate_kbps,OLD.max_local_stream_bitrate_kbps,
+ OLD.max_profiles,OLD.allowed_permissions,OLD.requests_allowed,OLD.is_default,OLD.created_at,OLD.updated_at) THEN
+  NEW.configuration_revision := nextval('access_group_configuration_revision_seq');
+ ELSE
+  NEW.configuration_revision := OLD.configuration_revision;
+ END IF;
+ RETURN NEW;
+END $$;
+-- +goose StatementEnd
+
+-- +goose Down
+-- Every account gets back a stored limit: the one it resolved to, so an
+-- account that inherited a group's limit keeps it on the previous version,
+-- which ignores groups. Lossy by construction: the old column can't say
+-- "inherit", so running Up again turns only the 5s back into inherit and
+-- keeps any other group limit as an override.
+UPDATE users u
+SET max_profiles = COALESCE(
+    (SELECT g.max_profiles FROM access_groups g WHERE g.id = u.access_group_id AND u.role <> 'admin'),
+    5)
+WHERE u.max_profiles IS NULL;
+
+ALTER TABLE users
+    ALTER COLUMN max_profiles SET DEFAULT 5,
+    ALTER COLUMN max_profiles SET NOT NULL;
+
+-- +goose StatementBegin
+CREATE OR REPLACE FUNCTION advance_access_group_configuration_revision() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+ IF TG_OP = 'INSERT' THEN
+  NEW.configuration_revision := nextval('access_group_configuration_revision_seq');
+ ELSIF ROW(NEW.id,NEW.name,NEW.description,NEW.library_ids,NEW.max_playback_quality,
+ NEW.download_allowed,NEW.download_transcode_allowed,NEW.transcode_allowed,NEW.audio_transcode_allowed,
+ NEW.max_streams,NEW.max_transcodes,NEW.max_remote_stream_bitrate_kbps,NEW.max_local_stream_bitrate_kbps,
+ NEW.allowed_permissions,NEW.requests_allowed,NEW.is_default,NEW.created_at,NEW.updated_at)
+ IS DISTINCT FROM ROW(OLD.id,OLD.name,OLD.description,OLD.library_ids,OLD.max_playback_quality,
+ OLD.download_allowed,OLD.download_transcode_allowed,OLD.transcode_allowed,OLD.audio_transcode_allowed,
+ OLD.max_streams,OLD.max_transcodes,OLD.max_remote_stream_bitrate_kbps,OLD.max_local_stream_bitrate_kbps,
+ OLD.allowed_permissions,OLD.requests_allowed,OLD.is_default,OLD.created_at,OLD.updated_at) THEN
+  NEW.configuration_revision := nextval('access_group_configuration_revision_seq');
+ ELSE
+  NEW.configuration_revision := OLD.configuration_revision;
+ END IF;
+ RETURN NEW;
+END $$;
+-- +goose StatementEnd
+
+ALTER TABLE access_groups DROP COLUMN max_profiles;
diff --git a/migrations/sql/20261014033206_media_items_match_ignored_at.sql b/migrations/sql/20261014033206_media_items_match_ignored_at.sql
new file mode 100644
index 0000000000..7b9cec6065
--- /dev/null
+++ b/migrations/sql/20261014033206_media_items_match_ignored_at.sql
@@ -0,0 +1,9 @@
+-- +goose Up
+-- When an admin marked a provisional (pending, unmatched or ambiguous) item as
+-- intentionally unmatched. Such an item leaves the admin unmatched list and
+-- automatic matching leaves it alone; Identify still works and a match clears
+-- it. NULL: the item is not ignored.
+ALTER TABLE media_items ADD COLUMN IF NOT EXISTS match_ignored_at timestamptz;
+
+-- +goose Down
+ALTER TABLE media_items DROP COLUMN IF EXISTS match_ignored_at;
diff --git a/migrations/sql/20261014175636_list_items_shared_provider_key.sql b/migrations/sql/20261014175636_list_items_shared_provider_key.sql
new file mode 100644
index 0000000000..431bd3393b
--- /dev/null
+++ b/migrations/sql/20261014175636_list_items_shared_provider_key.sql
@@ -0,0 +1,41 @@
+-- +goose NO TRANSACTION
+
+-- +goose Up
+-- Two library items can share a provider key: a movie and a series with the
+-- same TMDB id and no IMDb id, or two items for one title that carry the same
+-- IMDb id. Each is its own favorites or watchlist entry in Silo, so each keeps
+-- its own shadow row; only (connection_id, list_kind, media_item_id) stays
+-- unique, as on the ratings and dropped-show shadow tables. A unique key index
+-- failed every list sync that held two such items.
+--
+-- The indexes are built and dropped concurrently so list syncs keep reading
+-- and writing the table. The migration only runs when it is not yet recorded,
+-- so a new index found here is a leftover of an interrupted build.
+DROP INDEX CONCURRENTLY IF EXISTS public.idx_watch_provider_list_items_key;
+
+CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_watch_provider_list_items_key
+    ON public.watch_provider_list_items (connection_id, list_kind, provider_item_key)
+    WHERE provider_item_key <> '';
+
+DROP INDEX CONCURRENTLY IF EXISTS public.idx_watch_provider_list_items_provider_key;
+
+-- +goose Down
+-- The unique index allows one row per key, so keep each key's most recently
+-- updated row.
+DELETE FROM public.watch_provider_list_items AS stale
+USING public.watch_provider_list_items AS kept
+WHERE stale.provider_item_key <> ''
+  AND stale.connection_id = kept.connection_id
+  AND stale.list_kind = kept.list_kind
+  AND stale.provider_item_key = kept.provider_item_key
+  AND (stale.updated_at, stale.id) < (kept.updated_at, kept.id);
+
+-- Up removed the unique index, so one found here is a leftover of an
+-- interrupted rollback, possibly invalid.
+DROP INDEX CONCURRENTLY IF EXISTS public.idx_watch_provider_list_items_provider_key;
+
+CREATE UNIQUE INDEX CONCURRENTLY IF NOT EXISTS idx_watch_provider_list_items_provider_key
+    ON public.watch_provider_list_items (connection_id, list_kind, provider_item_key)
+    WHERE provider_item_key <> '';
+
+DROP INDEX CONCURRENTLY IF EXISTS public.idx_watch_provider_list_items_key;
diff --git a/migrations/sql/20261014233655_user_not_interested.sql b/migrations/sql/20261014233655_user_not_interested.sql
new file mode 100644
index 0000000000..8856cb9222
--- /dev/null
+++ b/migrations/sql/20261014233655_user_not_interested.sql
@@ -0,0 +1,23 @@
+-- +goose Up
+-- +goose StatementBegin
+-- A profile's Not interested marks: movies and series it asked recommendations
+-- to leave out. The per-user SQLite store keeps the same rows in its
+-- not_interested table.
+CREATE TABLE public.user_not_interested (
+    user_id integer NOT NULL REFERENCES public.users(id) ON DELETE CASCADE,
+    profile_id text NOT NULL,
+    media_item_id text NOT NULL,
+    added_at timestamp with time zone NOT NULL DEFAULT now(),
+    CONSTRAINT user_not_interested_pkey PRIMARY KEY (user_id, profile_id, media_item_id)
+);
+
+CREATE INDEX idx_user_not_interested_profile
+    ON public.user_not_interested (user_id, profile_id, added_at DESC, media_item_id DESC);
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+DROP INDEX IF EXISTS idx_user_not_interested_profile;
+
+DROP TABLE IF EXISTS public.user_not_interested;
+-- +goose StatementEnd
diff --git a/migrations/sql/20261015140728_add_user_devices_custom_name.sql b/migrations/sql/20261015140728_add_user_devices_custom_name.sql
new file mode 100644
index 0000000000..78c98373f8
--- /dev/null
+++ b/migrations/sql/20261015140728_add_user_devices_custom_name.sql
@@ -0,0 +1,10 @@
+-- +goose Up
+-- A name the profile chose for one of its devices, shown in place of the name
+-- the client reports (several Apple TVs all report "Apple TV"). Registration
+-- never writes it, so a device keeps its name as it keeps being seen. NULL: no
+-- name chosen; device_name is shown. The per-user SQLite store adds the same
+-- column in its schema v32.
+ALTER TABLE user_devices ADD COLUMN IF NOT EXISTS custom_name text;
+
+-- +goose Down
+ALTER TABLE user_devices DROP COLUMN IF EXISTS custom_name;
diff --git a/migrations/sql/20261016005440_drop_hidden_history_before_index.sql b/migrations/sql/20261016005440_drop_hidden_history_before_index.sql
new file mode 100644
index 0000000000..f4f884df50
--- /dev/null
+++ b/migrations/sql/20261016005440_drop_hidden_history_before_index.sql
@@ -0,0 +1,33 @@
+-- +goose NO TRANSACTION
+
+-- +goose Up
+-- Every read of user_history_hidden_items looks up one title's row: the
+-- "progress written at or before hidden_before is hidden" check that progress,
+-- history, Continue Watching, and Next Up queries run per row. The primary key
+-- (user_id, profile_id, media_item_id) answers that with one index probe.
+--
+-- idx_user_history_hidden_items_profile (user_id, profile_id, hidden_before
+-- DESC) serves no query, but the planner keeps choosing it for that check: it
+-- turns updated_at <= hidden_before into an index range and filters
+-- media_item_id afterwards, so each probe reads every hidden row of the profile
+-- newer than the progress row. Without the index the planner can only use the
+-- primary key.
+--
+-- Measured on a copy of a development database, median of 30 runs, for a
+-- profile with 576 hidden titles and 14k completed rows: the Continue Watching
+-- next-up walk went from 406ms to 93ms, and a page of 500 completed rows at
+-- offset 2000 from 47ms to 2.2ms. On profiles with up to 11k hidden titles the
+-- other hidden-history reads (history page, in-progress page, watched joins)
+-- stayed within 1ms of their times with the index.
+--
+-- The index is dropped concurrently so progress reads and writes continue.
+DROP INDEX CONCURRENTLY IF EXISTS public.idx_user_history_hidden_items_profile;
+
+-- +goose Down
+-- The rollback only runs after the index was dropped, so an index found here
+-- is the invalid leftover of an interrupted rebuild. Drop it so the rebuild
+-- runs again instead of keeping it.
+DROP INDEX CONCURRENTLY IF EXISTS public.idx_user_history_hidden_items_profile;
+
+CREATE INDEX CONCURRENTLY idx_user_history_hidden_items_profile
+    ON public.user_history_hidden_items (user_id, profile_id, hidden_before DESC);
diff --git a/migrations/sql/20261016012917_add_episode_availability_released_at.sql b/migrations/sql/20261016012917_add_episode_availability_released_at.sql
new file mode 100644
index 0000000000..12989d2383
--- /dev/null
+++ b/migrations/sql/20261016012917_add_episode_availability_released_at.sql
@@ -0,0 +1,41 @@
+-- +goose NO TRANSACTION
+-- +goose Up
+-- released_at records the availability detector's decision that an episode was
+-- released to the server: the row was inserted after its library's first full
+-- scan (notification_library_seed_state) and its file arrived within the
+-- release window, so it is news rather than back catalog or a late match. It
+-- is set to the row's available_at; NULL means the episode was recorded
+-- silently. Next Up orders a series by this time when its next episode was
+-- released after the profile finished the previous one.
+--
+-- The migration runs outside a transaction so the column add holds its
+-- exclusive lock only briefly; the backfill below then runs on its own and
+-- doesn't block Next Up or the notifications fanout reading the table on
+-- other nodes during a rolling upgrade. Both statements are safe to rerun.
+ALTER TABLE public.episode_availability
+    ADD COLUMN IF NOT EXISTS released_at timestamptz;
+
+-- Backfill with the detector's rule, taking the time the row was recorded as
+-- the detection time. The 14 days mirror newReleaseWindow
+-- (internal/notifications/release_repo.go). The detector saw the episode's
+-- library membership when it recorded the row, which began no later than the
+-- row. An episode whose membership is gone now (its file is missing), or
+-- began after the row (its file was removed and came back), cannot be judged
+-- and stays unreleased.
+UPDATE public.episode_availability ea
+SET released_at = ea.available_at
+FROM public.notification_library_seed_state ss
+WHERE ss.library_id = ea.library_id
+  AND ea.available_at > ss.seeded_at
+  AND ea.released_at IS NULL
+  AND EXISTS (
+      SELECT 1
+      FROM public.episode_libraries el
+      WHERE el.media_folder_id = ea.library_id
+        AND el.episode_id = ea.episode_id
+        AND el.first_seen_at >= ea.available_at - interval '14 days'
+        AND el.first_seen_at <= ea.available_at
+  );
+
+-- +goose Down
+ALTER TABLE public.episode_availability DROP COLUMN IF EXISTS released_at;
diff --git a/migrations/sql/20261016012918_add_episode_availability_episode_index.sql b/migrations/sql/20261016012918_add_episode_availability_episode_index.sql
new file mode 100644
index 0000000000..0d5b61eb64
--- /dev/null
+++ b/migrations/sql/20261016012918_add_episode_availability_episode_index.sql
@@ -0,0 +1,17 @@
+-- +goose NO TRANSACTION
+-- +goose Up
+-- Next Up looks up each candidate episode's availability rows by episode_id
+-- alone, for every library the viewer can reach. The primary key leads with
+-- library_id, so without this index that lookup is one index descent per
+-- library for every candidate.
+--
+-- CONCURRENTLY avoids blocking availability writes during the build; it
+-- cannot run inside a transaction, hence the NO TRANSACTION annotation above.
+-- The index is dropped first so a retry after a failed build, which leaves an
+-- invalid index behind, recovers.
+DROP INDEX CONCURRENTLY IF EXISTS public.idx_episode_availability_episode;
+CREATE INDEX CONCURRENTLY idx_episode_availability_episode
+ON public.episode_availability USING btree (episode_id);
+
+-- +goose Down
+DROP INDEX CONCURRENTLY IF EXISTS public.idx_episode_availability_episode;
diff --git a/migrations/sql/20261016012942_drop_image_cache_local_due_index.sql b/migrations/sql/20261016012942_drop_image_cache_local_due_index.sql
new file mode 100644
index 0000000000..c1b294230b
--- /dev/null
+++ b/migrations/sql/20261016012942_drop_image_cache_local_due_index.sql
@@ -0,0 +1,11 @@
+-- +goose NO TRANSACTION
+
+-- +goose Up
+-- With metadata.cache_images off the image cache claims nothing, local
+-- artwork included, so the local-only claim this index served is gone.
+DROP INDEX CONCURRENTLY IF EXISTS metadata_image_cache_jobs_local_due_idx;
+
+-- +goose Down
+CREATE INDEX CONCURRENTLY IF NOT EXISTS metadata_image_cache_jobs_local_due_idx
+    ON metadata_image_cache_jobs (next_attempt_at, id)
+    WHERE status = 'queued' AND source_path LIKE 'file://%';
diff --git a/migrations/sql/20261016131356_retire_trakt.sql b/migrations/sql/20261016131356_retire_trakt.sql
new file mode 100644
index 0000000000..a178235cbe
--- /dev/null
+++ b/migrations/sql/20261016131356_retire_trakt.sql
@@ -0,0 +1,182 @@
+-- Silo no longer supports Trakt. This removes the Trakt sources of
+-- collections and home rows while keeping what a household built with them:
+--
+--   * Trakt-backed admin and personal collections become manual collections
+--     that keep their current members; nothing syncs them again.
+--   * Trakt trending home rows switch to TMDB weekly trending and are turned
+--     off. A profile's own Trakt trending row is switched the same way and
+--     hidden. Collection rows lose their Trakt marker and keep showing their
+--     (now manual) collection.
+--
+-- The trending snapshot rows Trakt rows read are deleted. The SQLite user
+-- store rewrites its profile section overrides the same way at schema v33.
+-- 20261016134645_retire_trakt_watch_sync.sql removes the Trakt watch-sync
+-- state.
+
+-- +goose Up
+UPDATE public.library_collections
+   SET collection_type = 'manual',
+       source_config = '{}'::jsonb,
+       source_url = '',
+       sync_schedule = NULL,
+       next_sync_at = NULL,
+       updated_at = now()
+ WHERE collection_type = 'trakt'
+    OR source_config->>'provider' = 'trakt'
+    OR source_config->>'mode' LIKE 'trakt\_%';
+
+ALTER TABLE public.library_collections DROP CONSTRAINT IF EXISTS library_collections_collection_type_check;
+ALTER TABLE public.library_collections ADD CONSTRAINT library_collections_collection_type_check
+    CHECK (collection_type = ANY (ARRAY['manual', 'smart', 'mdblist', 'tmdb']));
+
+UPDATE public.user_personal_collections
+   SET collection_type = 'manual',
+       source_config = '{}'::jsonb,
+       source_url = '',
+       sync_schedule = NULL,
+       next_sync_at = NULL,
+       updated_at = now()
+ WHERE collection_type = 'trakt'
+    OR source_config->>'provider' = 'trakt'
+    OR source_config->>'mode' LIKE 'trakt\_%';
+
+ALTER TABLE public.user_personal_collections DROP CONSTRAINT IF EXISTS user_personal_collections_type_check;
+ALTER TABLE public.user_personal_collections ADD CONSTRAINT user_personal_collections_type_check
+    CHECK (collection_type IN ('manual', 'smart', 'mdblist', 'tmdb', 'synced', 'playlist'));
+
+UPDATE public.page_sections
+   SET config = config || '{"source": "tmdb", "window": "week"}'::jsonb,
+       enabled = false,
+       updated_at = now()
+ WHERE section_type = 'trending_discover'
+   AND config->>'source' = 'trakt';
+
+UPDATE public.page_sections
+   SET config = config - 'source_provider',
+       updated_at = now()
+ WHERE section_type = 'collection'
+   AND config->>'source_provider' = 'trakt';
+
+-- A profile's section overrides are one JSON array per page, stored in
+-- user_settings under section_overrides:<profile>:<scope>[:<library>]. Each
+-- element carries its row config in Config and, for a row the profile added,
+-- UserConfig, both as JSON text. A value that does not parse is left alone.
+-- +goose StatementBegin
+CREATE FUNCTION pg_temp.retire_trakt_section_config(config text)
+RETURNS text
+LANGUAGE plpgsql
+IMMUTABLE
+AS $$
+DECLARE
+  parsed jsonb;
+BEGIN
+  IF config IS NULL OR config = '' THEN
+    RETURN config;
+  END IF;
+  BEGIN
+    parsed := config::jsonb;
+  EXCEPTION WHEN invalid_text_representation THEN
+    RETURN config;
+  END;
+  IF jsonb_typeof(parsed) <> 'object' THEN
+    RETURN config;
+  END IF;
+  IF parsed->>'source' = 'trakt' THEN
+    RETURN (parsed || '{"source": "tmdb", "window": "week"}'::jsonb)::text;
+  END IF;
+  IF parsed->>'source_provider' = 'trakt' THEN
+    RETURN (parsed - 'source_provider')::text;
+  END IF;
+  RETURN config;
+END;
+$$;
+-- +goose StatementEnd
+
+-- +goose StatementBegin
+CREATE FUNCTION pg_temp.is_trakt_trending_config(config text)
+RETURNS boolean
+LANGUAGE plpgsql
+IMMUTABLE
+AS $$
+BEGIN
+  IF config IS NULL OR config = '' THEN
+    RETURN false;
+  END IF;
+  RETURN jsonb_typeof(config::jsonb) = 'object' AND config::jsonb->>'source' = 'trakt';
+EXCEPTION WHEN invalid_text_representation THEN
+  RETURN false;
+END;
+$$;
+-- +goose StatementEnd
+
+-- +goose StatementBegin
+CREATE FUNCTION pg_temp.retire_trakt_section_overrides(stored text)
+RETURNS text
+LANGUAGE plpgsql
+IMMUTABLE
+AS $$
+DECLARE
+  overrides jsonb;
+  element jsonb;
+  rewritten jsonb := '[]'::jsonb;
+  config text;
+  user_config text;
+BEGIN
+  BEGIN
+    overrides := stored::jsonb;
+  EXCEPTION WHEN invalid_text_representation THEN
+    RETURN stored;
+  END;
+  IF jsonb_typeof(overrides) <> 'array' THEN
+    RETURN stored;
+  END IF;
+  FOR element IN SELECT value FROM jsonb_array_elements(overrides) WITH ORDINALITY ORDER BY ordinality LOOP
+    IF jsonb_typeof(element) = 'object' THEN
+      config := element->>'Config';
+      user_config := element->>'UserConfig';
+      -- A profile's own Trakt trending row is hidden, as the admin rows are
+      -- turned off; a row linked to an admin row follows that row.
+      IF COALESCE(element->>'SectionID', '') = ''
+         AND (pg_temp.is_trakt_trending_config(config) OR pg_temp.is_trakt_trending_config(user_config)) THEN
+        element := element || '{"Hidden": true}'::jsonb;
+      END IF;
+      IF jsonb_typeof(element->'Config') = 'string' THEN
+        element := jsonb_set(element, '{Config}', to_jsonb(pg_temp.retire_trakt_section_config(config)));
+      END IF;
+      IF jsonb_typeof(element->'UserConfig') = 'string' THEN
+        element := jsonb_set(element, '{UserConfig}', to_jsonb(pg_temp.retire_trakt_section_config(user_config)));
+      END IF;
+    END IF;
+    rewritten := rewritten || jsonb_build_array(element);
+  END LOOP;
+  IF rewritten = overrides THEN
+    RETURN stored;
+  END IF;
+  RETURN rewritten::text;
+END;
+$$;
+-- +goose StatementEnd
+
+UPDATE public.user_settings
+   SET value = pg_temp.retire_trakt_section_overrides(value)
+ WHERE key LIKE 'section\_overrides:%'
+   AND value LIKE '%trakt%'
+   AND pg_temp.retire_trakt_section_overrides(value) IS DISTINCT FROM value;
+
+DROP FUNCTION pg_temp.retire_trakt_section_overrides(text);
+DROP FUNCTION pg_temp.is_trakt_trending_config(text);
+DROP FUNCTION pg_temp.retire_trakt_section_config(text);
+
+DELETE FROM public.trending_discover_snapshots WHERE source = 'trakt';
+
+-- +goose Down
+-- Irreversible: the Trakt sources are not recorded anywhere. An older server
+-- keeps the converted collections and rows as manual collections and TMDB
+-- trending rows.
+ALTER TABLE public.library_collections DROP CONSTRAINT IF EXISTS library_collections_collection_type_check;
+ALTER TABLE public.library_collections ADD CONSTRAINT library_collections_collection_type_check
+    CHECK (collection_type = ANY (ARRAY['manual', 'smart', 'mdblist', 'tmdb', 'trakt']));
+
+ALTER TABLE public.user_personal_collections DROP CONSTRAINT IF EXISTS user_personal_collections_type_check;
+ALTER TABLE public.user_personal_collections ADD CONSTRAINT user_personal_collections_type_check
+    CHECK (collection_type IN ('manual', 'smart', 'mdblist', 'tmdb', 'trakt', 'synced', 'playlist'));
diff --git a/migrations/sql/20261016134411_add_profile_series_notification_mutes.sql b/migrations/sql/20261016134411_add_profile_series_notification_mutes.sql
new file mode 100644
index 0000000000..caaf0817ea
--- /dev/null
+++ b/migrations/sql/20261016134411_add_profile_series_notification_mutes.sql
@@ -0,0 +1,31 @@
+-- +goose Up
+-- +goose StatementBegin
+
+-- Series a profile muted: it gets no new-episode notification for them,
+-- whatever its interest reasons, until it unmutes. A mute is independent of
+-- the interest rows, which are recomputed and pruned, so it survives the
+-- series leaving and rejoining the profile's lists. There is no profile or
+-- media_items foreign key: shared tables do not reference profile rows, and
+-- content IDs are deterministic, so a mute still applies to a series that is
+-- rescanned. PurgeProfile removes a deleted profile's rows explicitly. A
+-- profile is identified by account and profile ID together, as in
+-- user_profiles: legacy profile IDs such as "default" repeat across accounts.
+CREATE TABLE public.profile_series_notification_mutes (
+    user_id integer NOT NULL
+        REFERENCES public.users(id) ON DELETE CASCADE,
+    profile_id text NOT NULL,
+    series_id text NOT NULL,
+    muted_at timestamptz NOT NULL DEFAULT now(),
+    PRIMARY KEY (user_id, profile_id, series_id)
+);
+
+-- Fanout anti-joins a series' candidate recipients against its mutes.
+CREATE INDEX profile_series_notification_mutes_series_idx
+    ON public.profile_series_notification_mutes (series_id, user_id, profile_id);
+
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+DROP TABLE IF EXISTS public.profile_series_notification_mutes;
+-- +goose StatementEnd
diff --git a/migrations/sql/20261016134645_retire_trakt_watch_sync.sql b/migrations/sql/20261016134645_retire_trakt_watch_sync.sql
new file mode 100644
index 0000000000..08a317f4b3
--- /dev/null
+++ b/migrations/sql/20261016134645_retire_trakt_watch_sync.sql
@@ -0,0 +1,34 @@
+-- Silo no longer supports Trakt watch sync.
+--
+--   * Trakt connections are deleted with their per-connection state (sync
+--     runs, export records, scrobble sessions, favorites, ratings, dropped
+--     shows), as a disconnect would. Watch history and other profile state
+--     imported from Trakt stays.
+--   * The legacy Trakt app credentials and the plugin migration markers are
+--     deleted, and an installed Trakt watch-sync plugin is disabled. The
+--     server refuses to register it, so re-enabling it does nothing; an admin
+--     uninstalls it to remove its files and settings.
+
+-- +goose Up
+DELETE FROM public.watch_provider_auth_sessions WHERE provider = 'trakt';
+DELETE FROM public.watch_provider_connections WHERE provider = 'trakt';
+
+DELETE FROM public.server_settings
+ WHERE key IN (
+     'watchsync.trakt.client_id',
+     'watchsync.trakt.client_secret',
+     'watchsync.plugin_migration.trakt',
+     'watchsync.plugin_app_seeded.trakt'
+ );
+
+UPDATE public.plugin_installations
+   SET enabled = false,
+       updated_at = now()
+ WHERE plugin_id = 'silo.watchprovider.trakt'
+   AND enabled;
+
+-- +goose Down
+-- Irreversible: the connections, tokens and app credentials are not recorded
+-- anywhere. An older server auto-installs the Trakt plugin only for Trakt
+-- connections, which no longer exist.
+SELECT 1;
diff --git a/migrations/sql/20261016161203_notification_state_account_key.sql b/migrations/sql/20261016161203_notification_state_account_key.sql
new file mode 100644
index 0000000000..ca30584a42
--- /dev/null
+++ b/migrations/sql/20261016161203_notification_state_account_key.sql
@@ -0,0 +1,245 @@
+-- +goose NO TRANSACTION
+-- +goose Up
+-- A profile id is only unique within its account: every account from before
+-- profiles has a profile named 'default'. Episode notification state was keyed
+-- by profile id alone, so two accounts' 'default' profiles shared one series
+-- interest row (whichever account wrote it kept it, and only that account was
+-- notified), one set of notification switches, and one delivery per episode,
+-- and each saw the other's inbox. Key all of it by account and profile.
+--
+-- CONCURRENTLY keeps these tables writable while the indexes build; it cannot
+-- run inside a transaction, hence NO TRANSACTION. Each step can run again
+-- after an interrupted attempt: an interrupted concurrent build leaves an
+-- invalid index that IF NOT EXISTS would keep, so those are dropped first, and
+-- the key swaps check whether they already happened.
+-- +goose StatementBegin
+DO $$
+DECLARE
+    idx text;
+BEGIN
+    FOR idx IN
+        SELECT c.relname
+        FROM pg_class c
+        JOIN pg_namespace n ON n.oid = c.relnamespace
+        JOIN pg_index i ON i.indexrelid = c.oid
+        WHERE n.nspname = 'public'
+          AND NOT i.indisvalid
+          AND c.relname IN (
+              'profile_series_interest_account_pkey',
+              'notification_deliveries_account_profile_event_key',
+              'notification_deliveries_account_profile_episode_key',
+              'notification_deliveries_account_profile_created_idx',
+              'notification_deliveries_account_unread_idx')
+    LOOP
+        EXECUTE format('DROP INDEX public.%I', idx);
+    END LOOP;
+END;
+$$;
+-- +goose StatementEnd
+
+-- profile_series_interest: rows already carry user_id, and the wider key holds
+-- every existing row. The primary key leads with (user_id, profile_id), which
+-- serves the per-profile reads profile_series_interest_profile_idx did.
+-- Already swapped on a rerun: the index then exists under the constraint's
+-- name, and the stray copy built here is dropped below.
+CREATE UNIQUE INDEX CONCURRENTLY IF NOT EXISTS profile_series_interest_account_pkey
+    ON public.profile_series_interest (user_id, profile_id, library_id, series_id);
+
+-- +goose StatementBegin
+DO $$
+BEGIN
+    IF pg_get_constraintdef((SELECT oid FROM pg_constraint
+            WHERE conrelid = 'public.profile_series_interest'::regclass
+              AND conname = 'profile_series_interest_pkey'))
+        <> 'PRIMARY KEY (user_id, profile_id, library_id, series_id)' THEN
+        ALTER TABLE public.profile_series_interest
+            DROP CONSTRAINT profile_series_interest_pkey,
+            ADD CONSTRAINT profile_series_interest_pkey
+                PRIMARY KEY USING INDEX profile_series_interest_account_pkey;
+    END IF;
+END;
+$$;
+-- +goose StatementEnd
+
+DROP INDEX CONCURRENTLY IF EXISTS public.profile_series_interest_account_pkey;
+DROP INDEX CONCURRENTLY IF EXISTS public.profile_series_interest_profile_idx;
+
+-- notification_deliveries: the episode at-most-once keys and the inbox read
+-- indexes. The release delivery path inserts with a bare ON CONFLICT DO
+-- NOTHING, so it honours whichever keys exist while they are swapped. One
+-- (user_id, profile_id, created_at, id) index replaces both
+-- notification_deliveries_inbox_idx and
+-- notification_deliveries_profile_created_idx; newest-first pages scan it
+-- backwards.
+CREATE UNIQUE INDEX CONCURRENTLY IF NOT EXISTS notification_deliveries_account_profile_event_key
+    ON public.notification_deliveries (user_id, profile_id, release_event_id)
+    WHERE release_event_id IS NOT NULL;
+CREATE UNIQUE INDEX CONCURRENTLY IF NOT EXISTS notification_deliveries_account_profile_episode_key
+    ON public.notification_deliveries (user_id, profile_id, episode_id)
+    WHERE type = 'episode.available';
+CREATE INDEX CONCURRENTLY IF NOT EXISTS notification_deliveries_account_profile_created_idx
+    ON public.notification_deliveries (user_id, profile_id, created_at, id);
+CREATE INDEX CONCURRENTLY IF NOT EXISTS notification_deliveries_account_unread_idx
+    ON public.notification_deliveries (user_id, profile_id, read_at, created_at DESC, id DESC);
+
+DROP INDEX CONCURRENTLY IF EXISTS public.notification_deliveries_profile_event_key;
+DROP INDEX CONCURRENTLY IF EXISTS public.notification_deliveries_profile_episode_key;
+DROP INDEX CONCURRENTLY IF EXISTS public.notification_deliveries_inbox_idx;
+DROP INDEX CONCURRENTLY IF EXISTS public.notification_deliveries_profile_created_idx;
+DROP INDEX CONCURRENTLY IF EXISTS public.notification_deliveries_unread_idx;
+
+-- notification_preferences gains its account. A row shared by two accounts'
+-- profiles with the same id is copied to each of them, so every profile keeps
+-- the switches it has today. The accounts that have a profile with the row's
+-- id come from user_profiles and, for profiles stored outside Postgres, from
+-- the account-keyed notification tables. A row no account can be found for
+-- belongs to a deleted profile and is dropped. The table holds at most one
+-- row per profile, so this rewrites it in one statement.
+-- +goose StatementBegin
+DO $$
+BEGIN
+    IF NOT EXISTS (
+        SELECT 1 FROM information_schema.columns
+        WHERE table_schema = 'public' AND table_name = 'notification_preferences'
+          AND column_name = 'user_id'
+    ) THEN
+        LOCK TABLE public.notification_preferences IN ACCESS EXCLUSIVE MODE;
+        ALTER TABLE public.notification_preferences
+            DROP CONSTRAINT notification_preferences_pkey,
+            ADD COLUMN user_id integer;
+        INSERT INTO public.notification_preferences
+            (user_id, profile_id, enabled, notify_favorites, notify_watchlist,
+             notify_continue_watching, notify_next_up, updated_at)
+        SELECT owner.user_id, np.profile_id, np.enabled, np.notify_favorites, np.notify_watchlist,
+               np.notify_continue_watching, np.notify_next_up, np.updated_at
+        FROM public.notification_preferences np
+        JOIN (
+            SELECT user_id, id AS profile_id FROM public.user_profiles
+            UNION SELECT user_id, profile_id FROM public.profile_series_interest
+            UNION SELECT user_id, profile_id FROM public.notification_deliveries
+            UNION SELECT user_id, profile_id FROM public.notification_email_prefs
+        ) owner ON owner.profile_id = np.profile_id
+        JOIN public.users u ON u.id = owner.user_id
+        WHERE np.user_id IS NULL;
+        DELETE FROM public.notification_preferences WHERE user_id IS NULL;
+        ALTER TABLE public.notification_preferences
+            ALTER COLUMN user_id SET NOT NULL,
+            ADD CONSTRAINT notification_preferences_pkey PRIMARY KEY (user_id, profile_id),
+            ADD CONSTRAINT notification_preferences_user_id_fkey FOREIGN KEY (user_id)
+                REFERENCES public.users(id) ON DELETE CASCADE;
+    END IF;
+END;
+$$;
+-- +goose StatementEnd
+
+-- Interest rows written before this migration hold one account's state for
+-- both accounts' profiles. Restart the interest rebuild from the first
+-- profile so its next run, at startup, writes the missing account's rows.
+DELETE FROM public.notification_backfill_state WHERE task = 'interest_rebuild';
+
+-- +goose Down
+-- The profile-only keys cannot hold two accounts' rows for one profile id.
+-- Refuse instead of choosing which account's notification state to delete.
+-- Stop the servers that write notifications first: a row written after this
+-- check would fail the unique builds below.
+-- +goose StatementBegin
+DO $$
+BEGIN
+    IF EXISTS (SELECT 1 FROM public.profile_series_interest
+               GROUP BY profile_id, library_id, series_id HAVING count(*) > 1)
+       OR EXISTS (SELECT 1 FROM public.notification_preferences
+                  GROUP BY profile_id HAVING count(*) > 1)
+       OR EXISTS (SELECT 1 FROM public.notification_deliveries
+                  WHERE release_event_id IS NOT NULL
+                  GROUP BY profile_id, release_event_id HAVING count(*) > 1)
+       OR EXISTS (SELECT 1 FROM public.notification_deliveries
+                  WHERE type = 'episode.available'
+                  GROUP BY profile_id, episode_id HAVING count(*) > 1) THEN
+        RAISE EXCEPTION 'notification state for profiles with the same id on different accounts cannot be keyed by profile id alone';
+    END IF;
+END;
+$$;
+-- +goose StatementEnd
+
+-- +goose StatementBegin
+DO $$
+DECLARE
+    idx text;
+BEGIN
+    FOR idx IN
+        SELECT c.relname
+        FROM pg_class c
+        JOIN pg_namespace n ON n.oid = c.relnamespace
+        JOIN pg_index i ON i.indexrelid = c.oid
+        WHERE n.nspname = 'public'
+          AND NOT i.indisvalid
+          AND c.relname IN (
+              'profile_series_interest_profile_pkey',
+              'profile_series_interest_profile_idx',
+              'notification_deliveries_profile_event_key',
+              'notification_deliveries_profile_episode_key',
+              'notification_deliveries_inbox_idx',
+              'notification_deliveries_profile_created_idx',
+              'notification_deliveries_unread_idx')
+    LOOP
+        EXECUTE format('DROP INDEX public.%I', idx);
+    END LOOP;
+END;
+$$;
+-- +goose StatementEnd
+
+-- +goose StatementBegin
+DO $$
+BEGIN
+    IF EXISTS (
+        SELECT 1 FROM information_schema.columns
+        WHERE table_schema = 'public' AND table_name = 'notification_preferences'
+          AND column_name = 'user_id'
+    ) THEN
+        ALTER TABLE public.notification_preferences
+            DROP CONSTRAINT notification_preferences_user_id_fkey,
+            DROP CONSTRAINT notification_preferences_pkey,
+            DROP COLUMN user_id,
+            ADD CONSTRAINT notification_preferences_pkey PRIMARY KEY (profile_id);
+    END IF;
+END;
+$$;
+-- +goose StatementEnd
+
+CREATE UNIQUE INDEX CONCURRENTLY IF NOT EXISTS notification_deliveries_profile_event_key
+    ON public.notification_deliveries (profile_id, release_event_id)
+    WHERE release_event_id IS NOT NULL;
+CREATE UNIQUE INDEX CONCURRENTLY IF NOT EXISTS notification_deliveries_profile_episode_key
+    ON public.notification_deliveries (profile_id, episode_id)
+    WHERE type = 'episode.available';
+CREATE INDEX CONCURRENTLY IF NOT EXISTS notification_deliveries_inbox_idx
+    ON public.notification_deliveries (profile_id, created_at DESC);
+CREATE INDEX CONCURRENTLY IF NOT EXISTS notification_deliveries_profile_created_idx
+    ON public.notification_deliveries (profile_id, created_at, id);
+CREATE INDEX CONCURRENTLY IF NOT EXISTS notification_deliveries_unread_idx
+    ON public.notification_deliveries (profile_id, read_at, created_at DESC);
+DROP INDEX CONCURRENTLY IF EXISTS public.notification_deliveries_account_profile_event_key;
+DROP INDEX CONCURRENTLY IF EXISTS public.notification_deliveries_account_profile_episode_key;
+DROP INDEX CONCURRENTLY IF EXISTS public.notification_deliveries_account_profile_created_idx;
+DROP INDEX CONCURRENTLY IF EXISTS public.notification_deliveries_account_unread_idx;
+
+CREATE INDEX CONCURRENTLY IF NOT EXISTS profile_series_interest_profile_idx
+    ON public.profile_series_interest (profile_id, updated_at DESC);
+CREATE UNIQUE INDEX CONCURRENTLY IF NOT EXISTS profile_series_interest_profile_pkey
+    ON public.profile_series_interest (profile_id, library_id, series_id);
+-- +goose StatementBegin
+DO $$
+BEGIN
+    IF pg_get_constraintdef((SELECT oid FROM pg_constraint
+            WHERE conrelid = 'public.profile_series_interest'::regclass
+              AND conname = 'profile_series_interest_pkey'))
+        <> 'PRIMARY KEY (profile_id, library_id, series_id)' THEN
+        ALTER TABLE public.profile_series_interest
+            DROP CONSTRAINT profile_series_interest_pkey,
+            ADD CONSTRAINT profile_series_interest_pkey
+                PRIMARY KEY USING INDEX profile_series_interest_profile_pkey;
+    END IF;
+END;
+$$;
+-- +goose StatementEnd
+DROP INDEX CONCURRENTLY IF EXISTS public.profile_series_interest_profile_pkey;
diff --git a/migrations/sql/20261016163853_scope_webhook_names_to_account.sql b/migrations/sql/20261016163853_scope_webhook_names_to_account.sql
new file mode 100644
index 0000000000..96bb810087
--- /dev/null
+++ b/migrations/sql/20261016163853_scope_webhook_names_to_account.sql
@@ -0,0 +1,16 @@
+-- +goose Up
+-- Profile IDs are unique only within an account (every account from before
+-- profiles has a profile "default"), so a webhook name is unique per account
+-- profile, not per profile ID. The constraint keeps its name: code maps a
+-- violation of it to "a webhook with this name already exists", and older
+-- nodes in a rolling upgrade still recognize it.
+ALTER TABLE public.notification_webhooks
+    DROP CONSTRAINT notification_webhooks_profile_name_key,
+    ADD CONSTRAINT notification_webhooks_profile_name_key UNIQUE (user_id, profile_id, name);
+
+-- +goose Down
+-- Fails, changing nothing, when two accounts' same-ID profiles now share a
+-- webhook name; rename one of them first.
+ALTER TABLE public.notification_webhooks
+    DROP CONSTRAINT notification_webhooks_profile_name_key,
+    ADD CONSTRAINT notification_webhooks_profile_name_key UNIQUE (profile_id, name);
diff --git a/migrations/sql/20261016195559_deprecate_original_playback_quality.sql b/migrations/sql/20261016195559_deprecate_original_playback_quality.sql
new file mode 100644
index 0000000000..2566a572fd
--- /dev/null
+++ b/migrations/sql/20261016195559_deprecate_original_playback_quality.sql
@@ -0,0 +1,39 @@
+-- Rewrite every stored playback.preferred_quality of "original" to "auto",
+-- and the legacy user_profiles.quality_preference column with it.
+--
+-- Settings manifest revision 20 deprecates "original". Auto with no bitrate
+-- cap already plays the source whenever the device can, and the planner now
+-- treats "original" as auto, so the two choices only confused people. The
+-- value stays valid so an older client can still write it, but current
+-- clients no longer offer it and would show a stored "original" as a choice
+-- their picker cannot display.
+--
+-- The profile column is no longer what playback resolves, but the profile API
+-- still returns it, so it is rewritten too rather than left showing a value
+-- the apps no longer offer.
+--
+-- The revision moves so a client holding the old row sees a conflict and
+-- re-reads it. updated_at is left alone: the admin device surfaces sort and
+-- label devices by it, and this is not a change anyone made to a device.
+
+-- +goose Up
+-- +goose StatementBegin
+UPDATE public.user_setting_values
+SET value = '"auto"'::jsonb,
+    revision = revision + 1
+WHERE key = 'playback.preferred_quality'
+  AND value = '"original"'::jsonb;
+-- +goose StatementEnd
+
+-- +goose StatementBegin
+UPDATE public.user_profiles
+SET quality_preference = 'auto'
+WHERE quality_preference = 'original';
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+-- Deliberately empty: nothing records which rows held "original", and auto
+-- plays the same file the old value did.
+SELECT 1;
+-- +goose StatementEnd
diff --git a/migrations/sql/20261017015325_fence_image_ladder_backfill_v3.sql b/migrations/sql/20261017015325_fence_image_ladder_backfill_v3.sql
new file mode 100644
index 0000000000..31cee85fe4
--- /dev/null
+++ b/migrations/sql/20261017015325_fence_image_ladder_backfill_v3.sql
@@ -0,0 +1,197 @@
+-- +goose Up
+-- Ladder v3 widens posters to w1000, stills to w1280 and backdrops to w2560.
+-- The v2 fence reopened the backfill whenever a published poster or still
+-- lacked w780, which every v3 revision does, so each new image would have
+-- reset a finished backfill. Replace it with one function that takes the
+-- ladder version it fences and the rung each image type gained, and cover the
+-- backdrop surfaces the v3 backfill regenerates.
+-- +goose StatementBegin
+CREATE OR REPLACE FUNCTION public.reopen_image_ladder_backfill()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+DECLARE
+    new_row jsonb := to_jsonb(NEW);
+    old_row jsonb;
+    fence_version integer := TG_ARGV[0]::integer;
+    arg_index integer := 1;
+    path_column text;
+    manifest_image_type text;
+    rung_pattern text;
+    cached_path text;
+    previous_path text;
+    state_version integer;
+    changed_cached_path boolean := false;
+BEGIN
+    IF TG_OP = 'UPDATE' THEN
+        old_row := to_jsonb(OLD);
+    END IF;
+
+    -- Arguments after the version are (path column, image type, rung pattern)
+    -- triplets. Find an affected local cached-path publication before taking
+    -- the shared singleton lock. The lock is still taken even when the state is
+    -- below the fenced version: that closes the ordering with a concurrent final
+    -- confirmation.
+    WHILE arg_index < TG_NARGS LOOP
+        path_column := TG_ARGV[arg_index];
+        cached_path := new_row ->> path_column;
+        previous_path := CASE WHEN old_row IS NULL THEN NULL ELSE old_row ->> path_column END;
+        IF COALESCE(BTRIM(cached_path), '') <> ''
+           AND cached_path NOT LIKE '%://%'
+           AND (TG_OP = 'INSERT' OR cached_path IS DISTINCT FROM previous_path) THEN
+            changed_cached_path := true;
+            EXIT;
+        END IF;
+        arg_index := arg_index + 3;
+    END LOOP;
+
+    IF NOT changed_cached_path THEN
+        RETURN NEW;
+    END IF;
+
+    SELECT backfilled_version
+    INTO state_version
+    FROM public.image_ladder_backfill_state
+    WHERE id = 1
+    FOR UPDATE;
+
+    IF state_version < fence_version THEN
+        RETURN NEW;
+    END IF;
+
+    arg_index := 1;
+    WHILE arg_index < TG_NARGS LOOP
+        path_column := TG_ARGV[arg_index];
+        manifest_image_type := TG_ARGV[arg_index + 1];
+        rung_pattern := TG_ARGV[arg_index + 2];
+        cached_path := new_row ->> path_column;
+        previous_path := CASE WHEN old_row IS NULL THEN NULL ELSE old_row ->> path_column END;
+
+        IF COALESCE(BTRIM(cached_path), '') <> ''
+           AND cached_path NOT LIKE '%://%'
+           AND (TG_OP = 'INSERT' OR cached_path IS DISTINCT FROM previous_path)
+           AND NOT EXISTS (
+               SELECT 1
+               FROM public.artwork_revision_gc_candidates manifest
+               WHERE manifest.original_path = cached_path
+                 AND manifest.image_type = manifest_image_type
+                 AND EXISTS (
+                     SELECT 1
+                     FROM unnest(manifest.object_keys) object_key
+                     WHERE object_key LIKE rung_pattern
+                 )
+           ) THEN
+            UPDATE public.image_ladder_backfill_state
+            SET backfilled_version = LEAST(backfilled_version, fence_version - 1),
+                last_attempt_at = NULL,
+                updated_at = NOW()
+            WHERE id = 1;
+            RETURN NEW;
+        END IF;
+
+        arg_index := arg_index + 3;
+    END LOOP;
+
+    RETURN NEW;
+END;
+$$;
+-- +goose StatementEnd
+
+DROP TRIGGER IF EXISTS episodes_reopen_image_ladder_v2 ON public.episodes;
+DROP TRIGGER IF EXISTS season_localizations_reopen_image_ladder_v2 ON public.season_localizations;
+DROP TRIGGER IF EXISTS seasons_reopen_image_ladder_v2 ON public.seasons;
+DROP TRIGGER IF EXISTS media_item_localizations_reopen_image_ladder_v2 ON public.media_item_localizations;
+DROP TRIGGER IF EXISTS media_items_reopen_image_ladder_v2 ON public.media_items;
+DROP FUNCTION IF EXISTS public.reopen_image_ladder_backfill_v2();
+
+CREATE TRIGGER media_items_reopen_image_ladder
+AFTER INSERT OR UPDATE OF poster_path, logo_path, backdrop_path ON public.media_items
+FOR EACH ROW EXECUTE FUNCTION public.reopen_image_ladder_backfill(
+    '3',
+    'poster_path', 'poster', '%/w1000.%',
+    'logo_path', 'logo', '%/w1280.%',
+    'backdrop_path', 'backdrop', '%/w2560.%'
+);
+
+CREATE TRIGGER media_item_localizations_reopen_image_ladder
+AFTER INSERT OR UPDATE OF poster_path, logo_path, backdrop_path ON public.media_item_localizations
+FOR EACH ROW EXECUTE FUNCTION public.reopen_image_ladder_backfill(
+    '3',
+    'poster_path', 'poster', '%/w1000.%',
+    'logo_path', 'logo', '%/w1280.%',
+    'backdrop_path', 'backdrop', '%/w2560.%'
+);
+
+CREATE TRIGGER media_item_backdrops_reopen_image_ladder
+AFTER INSERT OR UPDATE OF path ON public.media_item_backdrops
+FOR EACH ROW EXECUTE FUNCTION public.reopen_image_ladder_backfill(
+    '3',
+    'path', 'backdrop', '%/w2560.%'
+);
+
+CREATE TRIGGER seasons_reopen_image_ladder
+AFTER INSERT OR UPDATE OF poster_path ON public.seasons
+FOR EACH ROW EXECUTE FUNCTION public.reopen_image_ladder_backfill(
+    '3',
+    'poster_path', 'poster', '%/w1000.%'
+);
+
+CREATE TRIGGER season_localizations_reopen_image_ladder
+AFTER INSERT OR UPDATE OF poster_path ON public.season_localizations
+FOR EACH ROW EXECUTE FUNCTION public.reopen_image_ladder_backfill(
+    '3',
+    'poster_path', 'poster', '%/w1000.%'
+);
+
+CREATE TRIGGER episodes_reopen_image_ladder
+AFTER INSERT OR UPDATE OF still_path ON public.episodes
+FOR EACH ROW EXECUTE FUNCTION public.reopen_image_ladder_backfill(
+    '3',
+    'still_path', 'still', '%/w1280.%'
+);
+
+-- +goose Down
+DROP TRIGGER IF EXISTS episodes_reopen_image_ladder ON public.episodes;
+DROP TRIGGER IF EXISTS season_localizations_reopen_image_ladder ON public.season_localizations;
+DROP TRIGGER IF EXISTS seasons_reopen_image_ladder ON public.seasons;
+DROP TRIGGER IF EXISTS media_item_backdrops_reopen_image_ladder ON public.media_item_backdrops;
+DROP TRIGGER IF EXISTS media_item_localizations_reopen_image_ladder ON public.media_item_localizations;
+DROP TRIGGER IF EXISTS media_items_reopen_image_ladder ON public.media_items;
+
+-- Restore the v2 fence (ladder v2 rungs, no backdrops) on the shared function.
+CREATE TRIGGER media_items_reopen_image_ladder_v2
+AFTER INSERT OR UPDATE OF poster_path, logo_path ON public.media_items
+FOR EACH ROW EXECUTE FUNCTION public.reopen_image_ladder_backfill(
+    '2',
+    'poster_path', 'poster', '%/w780.%',
+    'logo_path', 'logo', '%/w1280.%'
+);
+
+CREATE TRIGGER media_item_localizations_reopen_image_ladder_v2
+AFTER INSERT OR UPDATE OF poster_path, logo_path ON public.media_item_localizations
+FOR EACH ROW EXECUTE FUNCTION public.reopen_image_ladder_backfill(
+    '2',
+    'poster_path', 'poster', '%/w780.%',
+    'logo_path', 'logo', '%/w1280.%'
+);
+
+CREATE TRIGGER seasons_reopen_image_ladder_v2
+AFTER INSERT OR UPDATE OF poster_path ON public.seasons
+FOR EACH ROW EXECUTE FUNCTION public.reopen_image_ladder_backfill(
+    '2',
+    'poster_path', 'poster', '%/w780.%'
+);
+
+CREATE TRIGGER season_localizations_reopen_image_ladder_v2
+AFTER INSERT OR UPDATE OF poster_path ON public.season_localizations
+FOR EACH ROW EXECUTE FUNCTION public.reopen_image_ladder_backfill(
+    '2',
+    'poster_path', 'poster', '%/w780.%'
+);
+
+CREATE TRIGGER episodes_reopen_image_ladder_v2
+AFTER INSERT OR UPDATE OF still_path ON public.episodes
+FOR EACH ROW EXECUTE FUNCTION public.reopen_image_ladder_backfill(
+    '2',
+    'still_path', 'still', '%/w780.%'
+);
diff --git a/migrations/sql/20261017200720_release_theintrodb_v3_submit_refusals.sql b/migrations/sql/20261017200720_release_theintrodb_v3_submit_refusals.sql
new file mode 100644
index 0000000000..53d506ad18
--- /dev/null
+++ b/migrations/sql/20261017200720_release_theintrodb_v3_submit_refusals.sql
@@ -0,0 +1,28 @@
+-- Release TheIntroDB contribution claims recorded as permanent refusals when
+-- its v3 submit endpoint went away.
+--
+-- TheIntroDB froze API v3 to GET /media, so POST /v3/submit answers
+-- 404 "Cannot POST /v3/submit" for every submission. The host treats a submit
+-- 404 as the provider refusing that item and holds the claim for 30 days, so
+-- each target a v3 plugin tried in that time would stay blocked after the
+-- upgrade to the v4 plugin. API v4's submit endpoint never answers 404, so a
+-- TheIntroDB refusal with that status recorded the missing route, not the
+-- item. The rows become released retryable errors, as a failed request is
+-- recorded, and the next contribution run submits them through v4.
+
+-- +goose Up
+-- +goose StatementBegin
+UPDATE public.marker_contributions
+SET status = 'error',
+    claim_active = false
+WHERE status = 'invalid'
+  AND http_status = 404
+  AND (provider = 'introdb' OR provider LIKE 'plugin:%:introdb');
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+-- Deliberately empty: a released claim is the state a retryable error leaves,
+-- and restoring the refusals would block items for no reason.
+SELECT 1;
+-- +goose StatementEnd
diff --git a/migrations/sql/20261018052251_add_seasonal_list_snapshots.sql b/migrations/sql/20261018052251_add_seasonal_list_snapshots.sql
new file mode 100644
index 0000000000..d7ae4ce3bf
--- /dev/null
+++ b/migrations/sql/20261018052251_add_seasonal_list_snapshots.sql
@@ -0,0 +1,23 @@
+-- +goose Up
+-- +goose StatementBegin
+-- Persisted copies of the MDBList lists behind seasonal_themed home rows, one
+-- row per canonical list URL. entries keeps the list's external IDs in IMDb
+-- popularity order; the section read path resolves them against the catalog,
+-- so titles added to the library show up without waiting for a refresh and no
+-- content_id is stored here. A background task refreshes the lists a row will
+-- need soon; a failed refresh keeps the last good entries.
+CREATE TABLE public.seasonal_list_snapshots (
+    list_url        text        PRIMARY KEY,
+    entries         jsonb       NOT NULL DEFAULT '[]'::jsonb,
+    entry_count     integer     NOT NULL DEFAULT 0,
+    refreshed_at    timestamptz,
+    last_attempt_at timestamptz,
+    last_status     text        NOT NULL DEFAULT '',  -- 'refreshing' | 'ok' | 'empty' | 'error'
+    last_error      text        NOT NULL DEFAULT ''
+);
+-- +goose StatementEnd
+
+-- +goose Down
+-- +goose StatementBegin
+DROP TABLE IF EXISTS public.seasonal_list_snapshots;
+-- +goose StatementEnd
diff --git a/scripts/check-go-lint.sh b/scripts/check-go-lint.sh
new file mode 100755
index 0000000000..7086683879
--- /dev/null
+++ b/scripts/check-go-lint.sh
@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+	printf 'usage: %s [--cached]\n' "${0##*/}" >&2
+}
+
+cached=0
+case "${1:-}" in
+	"")
+		;;
+	--cached)
+		cached=1
+		;;
+	-h|--help)
+		usage
+		exit 0
+		;;
+	*)
+		usage
+		exit 2
+		;;
+esac
+
+repo_root=$(git rev-parse --show-toplevel)
+cd "$repo_root"
+scratch=$(mktemp -d "${TMPDIR:-/tmp}/prairie-check-go-lint.XXXXXX")
+trap 'rm -rf "$scratch"' EXIT
+
+diff_args=(--name-only -z)
+if [[ "$cached" -eq 1 ]]; then
+	diff_args=(--cached "${diff_args[@]}")
+fi
+
+# NUL-delimited, so names git would quote (an accented one, say) come through
+# literally. A read loop rather than mapfile, which macOS's Bash 3.2 lacks;
+# "${array[@]+...}" below for the same reason, as Bash before 4.4 treats an
+# empty array as unset under set -u. R keeps an edited rename in the check,
+# and T includes regular files replaced by symlinks (or the reverse).
+# Materialize Git output so command failures cannot masquerade as no changes.
+git diff "${diff_args[@]}" --diff-filter=ACMRT -- '*.go' >"$scratch/go-files"
+go_files=()
+while IFS= read -r -d '' file; do
+	go_files+=("$file")
+done <"$scratch/go-files"
+
+# Deleting Go files can break the code that's left, so deletions alone still
+# run the lint gate; there's nothing of theirs to format.
+deleted=0
+git diff "${diff_args[@]}" --diff-filter=D -- '*.go' >"$scratch/deleted-go"
+while IFS= read -r -d '' _; do
+	deleted=1
+done <"$scratch/deleted-go"
+
+if [[ ${#go_files[@]} -eq 0 && "$deleted" -eq 0 ]]; then
+	exit 0
+fi
+
+failed=0
+
+if [[ "$cached" -eq 1 ]]; then
+	# The commit contains the staged blobs, so format-check those rather than
+	# the working tree, which may hold unstaged edits.
+	unformatted=""
+	# A blob that can't be read fails the check rather than passing as empty
+	# input (pipefail carries git show's failure).
+	for file in ${go_files[@]+"${go_files[@]}"}; do
+		if ! out=$(git show ":$file" | gofmt -l 2>&1) || [[ -n "$out" ]]; then
+			unformatted+="$file"$'\n'
+		fi
+	done
+elif [[ ${#go_files[@]} -gt 0 ]]; then
+	unformatted=$(gofmt -l "${go_files[@]}" 2>&1) || true
+else
+	unformatted=""
+fi
+if [[ -n "$unformatted" ]]; then
+	printf '%s\n' "gofmt is required on:" >&2
+	printf '%s\n' "$unformatted" >&2
+	printf '%s\n' "Fix with: gofmt -w <file>" >&2
+	failed=1
+fi
+
+if command -v golangci-lint >/dev/null 2>&1; then
+	lint_env=()
+	# The delegate includes the whole branch and reads dependencies, module
+	# files, lint configuration and embedded inputs from the working tree.
+	# Staged package directories alone cannot establish that it checks the
+	# commit. Require all tracked and nonignored inputs to match the index.
+	if [[ "$cached" -eq 1 ]]; then
+		git diff --name-only --no-renames -z -- >"$scratch/unstaged"
+		git ls-files --others --exclude-standard -z >"$scratch/untracked"
+		# Developer-local workspaces are ignored by Git and absent from CI.
+		lint_env=(GOWORK=off)
+	fi
+	if [[ "$cached" -eq 1 ]] && [[ -s "$scratch/unstaged" || -s "$scratch/untracked" ]]; then
+		# With the working tree differing from the commit, lint would pass a
+		# broken commit or block a good one, so refuse rather than guess.
+		printf '%s\n' "The working tree has unstaged or untracked files; the lint gate cannot check the commit as staged." >&2
+		printf '%s\n' "Stage them or move them aside (git stash push --keep-index --include-untracked) and commit again." >&2
+		failed=1
+	elif ! git rev-parse --verify --quiet "${BASE_REF:-origin/main}" >/dev/null; then
+		# lint-changed.sh diffs against this ref; without it the lint output
+		# would not name the real cause.
+		printf '%s\n' "Cannot lint the commit: base ref '${BASE_REF:-origin/main}' is missing. Run: git fetch origin main (or set BASE_REF)." >&2
+		failed=1
+	elif ! env ${lint_env[@]+"${lint_env[@]}"} "$repo_root/scripts/lint-changed.sh"; then
+		# lint-changed.sh reports CI's changed-line findings for the touched
+		# packages. A type-check failure is a real finding and fails too.
+		failed=1
+	fi
+else
+	printf '%s\n' "skipping golangci-lint: not installed. Install with:" >&2
+	printf '%s\n' "  go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2" >&2
+fi
+
+if [[ "$failed" -ne 0 ]]; then
+	exit 1
+fi
diff --git a/scripts/ci-go-lint-sync-patch.sh b/scripts/ci-go-lint-sync-patch.sh
new file mode 100755
index 0000000000..2c064abdde
--- /dev/null
+++ b/scripts/ci-go-lint-sync-patch.sh
@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+# Print a patch of the Go lines an upstream sync PR adds relative to BOTH
+# parents of its sync merge: Prairie's base branch and the Silo upstream commit
+# it merged. golangci-lint --new-from-patch then reports only those lines.
+#
+# Why: a sync PR diffs every upstream line Prairie did not have yet against
+# origin/main, so a plain --new-from-merge-base gate re-reports upstream's
+# whole lint backlog (upstream gates each of its own PRs on changed lines
+# only, so findings on lines a later upstream PR left alone are never shown
+# again there). Lines that exist verbatim upstream or on main were gated
+# where they came from; what is new to both is the merge resolution and the
+# Prairie commits on top of it, and that stays strict.
+#
+# Usage: scripts/ci-go-lint-sync-patch.sh <base-ref> [pr-head]
+# Exits 3 when pr-head (default HEAD) holds no merge with a parent outside
+# base-ref, so the caller can fall back to the ordinary gate.
+
+set -euo pipefail
+
+base="$1"
+head="${2:-HEAD}"
+
+upstream=""
+while read -r merge; do
+	for parent in $(git rev-list --no-walk --parents "$merge" | cut -d' ' -f3-); do
+		if ! git merge-base --is-ancestor "$parent" "$base" 2>/dev/null; then
+			upstream="$parent"
+			break 2
+		fi
+	done
+done < <(git rev-list --merges --first-parent "$base..$head")
+
+if [[ -z "$upstream" ]]; then
+	echo "ci-go-lint-sync-patch: no sync merge in $base..$head" >&2
+	exit 3
+fi
+echo "ci-go-lint-sync-patch: lines new to both $base and upstream parent $upstream" >&2
+
+# added_lines REV: "path<TAB>line" for every line HEAD adds relative to REV.
+added_lines() {
+	git diff --no-color --no-ext-diff --no-renames -U0 "$1" HEAD -- '*.go' | awk '
+		/^\+\+\+ / { file = substr($0, 7); next }
+		/^@@ / {
+			split($3, range, ",")
+			start = substr(range[1], 2) + 0
+			count = (length(range) > 1) ? range[2] + 0 : 1
+			for (i = 0; i < count; i++) print file "\t" start + i
+		}'
+}
+
+LC_ALL=C comm -12 <(added_lines "$base" | LC_ALL=C sort -u) <(added_lines "$upstream" | LC_ALL=C sort -u) |
+	LC_ALL=C sort -t$'\t' -k1,1 -k2,2n |
+	awk -F'\t' '
+		$1 != file {
+			file = $1
+			printf "diff --git a/%s b/%s\n--- a/%s\n+++ b/%s\n", file, file, file, file
+			n = 0
+			delete lines
+			while ((getline text < file) > 0) lines[++n] = text
+			close(file)
+		}
+		{ printf "@@ -0,0 +%d,1 @@\n+%s\n", $2, lines[$2] }'
diff --git a/scripts/ci-go-lint.sh b/scripts/ci-go-lint.sh
index 51193c7302..a4ad9545dd 100755
--- a/scripts/ci-go-lint.sh
+++ b/scripts/ci-go-lint.sh
@@ -9,6 +9,7 @@
 #   CI_GO_LINT_SHARD / CI_GO_LINT_SHARDS
 #   CI_GO_LINT_NEW_FROM_REV=…
 #   CI_GO_LINT_NEW_FROM_MERGE_BASE=…
+#   CI_GO_LINT_SYNC=1 (upstream sync PRs) / CI_GO_LINT_SYNC_HEAD=<PR head sha>
 
 set -euo pipefail
 
@@ -28,7 +29,22 @@ fi
 
 # A sync that touches every package needs more than the old 5m budget.
 args=(--timeout=20m)
-if [[ -n "${CI_GO_LINT_NEW_FROM_MERGE_BASE:-}" ]]; then
+sync_patch=""
+if [[ "${CI_GO_LINT_SYNC:-}" == "1" && -n "${CI_GO_LINT_NEW_FROM_MERGE_BASE:-}" ]]; then
+	# Upstream sync PRs: only lines new to both main and the merged upstream
+	# commit (see scripts/ci-go-lint-sync-patch.sh).
+	sync_patch="$(mktemp)"
+	if "$root/scripts/ci-go-lint-sync-patch.sh" "${CI_GO_LINT_NEW_FROM_MERGE_BASE}" "${CI_GO_LINT_SYNC_HEAD:-HEAD}" >"$sync_patch"; then
+		:
+	else
+		status=$?
+		[[ "$status" == 3 ]] || exit "$status"
+		sync_patch=""
+	fi
+fi
+if [[ -n "$sync_patch" ]]; then
+	args+=(--new-from-patch="$sync_patch")
+elif [[ -n "${CI_GO_LINT_NEW_FROM_MERGE_BASE:-}" ]]; then
 	args+=(--new-from-merge-base="${CI_GO_LINT_NEW_FROM_MERGE_BASE}")
 elif [[ -n "${CI_GO_LINT_NEW_FROM_REV:-}" ]]; then
 	args+=(--new-from-rev="${CI_GO_LINT_NEW_FROM_REV}")
diff --git a/scripts/ci/db-contracts.txt b/scripts/ci/db-contracts.txt
index 2596fde25d..4e01a7d703 100644
--- a/scripts/ci/db-contracts.txt
+++ b/scripts/ci/db-contracts.txt
@@ -18,6 +18,9 @@
 ./internal/scanner TestMatroskaTrackBackfillReadsEachFileOnce
 ./internal/scanner TestScanStateCarriesProbeRejectionDB
 ./internal/scanner TestRescanKeepsProbeFactsOfARejectedUnchangedFileDB
+./internal/scanner TestFinalizeVariantsKeepsMatchSuppressionDB
+./internal/scanner TestFinalizeVariantsRetotalsPartsLeftByARenameDB
+./internal/scanner TestFinalizeVariantsReadsWholeGroupFoundOutsideTheScopeDB
 ./migrations TestScanRunForeignKeysHaveLeadingIndexesDB
 
 # Series air-date sort keys advance when a known episode airs.
@@ -26,6 +29,10 @@
 # Same-day episodes sorted by air date keep series title and season/episode order on every query path.
 ./internal/catalog TestQueryEpisodeAirDateTiesPostgres
 
+# PostgreSQL search keeps typo matches that contain every query word and ranks
+# titles starting with the query first, on the cursor and offset paths.
+./internal/catalog TestSearchRelevancePostgres
+
 # Section and Smart collection rule fields and operators compile to working SQL.
 ./internal/catalog TestRuleFieldsFilterCatalogDB
 ./internal/api/handlers TestCatalogProfileSectionsDB
@@ -34,8 +41,10 @@
 ./internal/catalog TestFolderMembershipReconciliationRetriesDeadlockDB
 
 # Profile history and account/invitation persistence.
+./internal/api/handlers TestClearResumePositionTargetsDB
 ./internal/api/handlers TestEbookProgressEventsPostgres
 ./internal/api/handlers TestRemoveHistoryHidesEpisodesWithoutLibraryFilePostgres
+./internal/api/handlers TestParentUnwatchClearsEpisodesWithoutLibraryFilePostgres
 ./internal/auth TestUserRepositoryUpdateAccessGroupIDDB
 ./internal/auth TestUserRepositoryUpdatePromotingToAdminClearsAccessGroupDB
 ./internal/auth TestUserRepositoryUpdateDemotingAdminAssignsDefaultAccessGroupDB
@@ -107,8 +116,22 @@
 ./internal/metadata TestLocalArtworkCopiedOnDiscoveryDB
 ./internal/metadata TestLocalArtworkRetriesWithoutLibraryRootDB
 
+# With metadata.cache_images off, stored artwork goes back to its provider
+# source, and items whose stored art has none are queued for a refresh.
+./internal/metadata TestStoredArtworkReleaseDB
+
+# The artwork ladder backfill finds cached artwork that predates the current
+# ladder, on every surface its image type is cached for.
+./internal/metadata TestLadderBackfillCandidatesDB
+# The database fence reopens a finished backfill only for artwork published
+# without the current ladder's new rung, on every surface it regenerates.
+./internal/metadata TestImageLadderBackfillLateOldArtworkReopensCompletedVersion
+./internal/metadata TestImageLadderBackfillCurrentArtworkKeepsCompletedVersion
+./internal/metadata TestImageLadderBackfillLateOldBackdropReopensCompletedVersion
+
 # Artwork publication, deletion locks and corrected metadata identity.
 ./internal/metadata TestArtworkDeliveryPublicationAndReconciliation
+./internal/metadata TestArtworkPublicationSelectsPublishedRungWithoutExternalDelivery
 ./internal/metadata TestArtworkRevisionGCSerializesDeletionWithRetracking
 ./internal/metadata TestArtworkRevisionGCExpandsTriggerManifestFromImageType
 ./internal/metadata TestArtworkRevisionGCBatchRechecksClaimedState
@@ -137,6 +160,7 @@
 ./internal/notifications TestNotifyFulfilledDeliversOncePerAccountForSharedProfileID
 ./internal/notifications TestRecomputeSeriesFollowsHomeRemovalsPostgres
 ./internal/notifications TestPushDeviceRepositoryUpsertApplePreservesStableIDs
+./internal/notifications TestSendPushTestCarriesTheProfilesNewestNotification
 ./internal/notifications TestNotificationInboxCutoffReplayAndTies
 ./internal/notifications TestFanoutSkipsRecipientsWithoutAccess
 ./internal/notifications TestNotifyFulfilledSkipsRecipientWithoutAccess
@@ -145,7 +169,14 @@
 ./internal/notifications TestNotifyFulfilledRetriesWhenRecipientScopeFails
 ./internal/notifications TestNotifyFulfilledRetryResolvesOnlyUntoldRecipients
 ./internal/notifications TestDispatchOperationalResolvesBeforeHoldingConnection
+./internal/notifications TestListNotifiedSeriesMergesLibrariesAndAppliesPreferences
+./internal/notifications TestFanoutSkipsProfilesThatMutedTheSeries
+./internal/notifications TestSeriesMutesList
+./internal/notifications TestSeriesMutesUnmuteAndPurge
+./internal/metadata TestCanonicalizeMediaItemReferencesMergesNotificationMutesPostgres
+./internal/catalog/reattribute TestMovePairsMovesNotificationMutesDB
 ./internal/requests TestEditorIntegrationsDatabase
+./internal/requests TestIntegrationKeyStaysWithItsAddressDatabase
 ./internal/requests TestClosingRequestForgetsFollowsDatabase
 
 # Request cleanup, prepared downloads and user-store transactions.
@@ -169,7 +200,15 @@
 ./internal/downloads TestFailedPreparationRefreshIsSharedPostgres
 ./internal/downloads TestPreparationControlsPauseResumeAndCancel
 ./internal/downloads TestDownloadLinkedToCanceledPreparationFails
+./internal/userstore/pgstore TestPostgresClearResumePosition
 ./internal/userstore/pgstore TestPostgresCollectionContinuation
+./internal/userstore/pgstore TestPostgresDeleteProfileCoversEveryProfileTable
+./internal/userstore/pgstore TestPostgresDeleteProfileRemovesProfileState
+./internal/userstore/pgstore TestPostgresConcurrentSectionOverrideSaves
+./internal/userstore/pgstore TestPostgresConcurrentProfileDeletesWithCrossVisibility
+./internal/userstore/pgstore TestPostgresConcurrentProfileAndCollectionDeletes
+./internal/userstore/pgstore TestPostgresConcurrentProfileDeleteAndCollectionReorder
+./internal/api/handlers TestEbookReaderPurgeProfileDB
 ./internal/userstore/pgstore TestPostgresMarkWatchedBatch
 ./internal/userstore/pgstore TestPostgresPersonalListPage
 
@@ -186,6 +225,12 @@
 # Transactional administrator audit details and rollback isolation.
 ./internal/activitylog TestMutationCommitRollbackAndHistoryDB
 
+# A retried push attempt key migration keeps the key an earlier run built.
+./internal/database TestPushAttemptKeyMigrationRetriesKeepTheBuiltKeyPostgres
+
+# Stored sidecar subtitles take the scanner's reading of their names.
+./internal/database TestPostgresExternalSubtitleNameBackfill
+
 # Online partitioned audit indexes preserve writers and resume canceled builds.
 ./internal/partman TestOnlinePartitionIndexesKeepWritersAvailableDB
 
@@ -203,6 +248,10 @@
 # Watch-provider events carry catalog titles to plugins.
 ./internal/watchsync TestGetMediaTitlesDB
 
+# Two library items with one provider key each keep a list sync row, and a key
+# stays on the provider while another item of the same kind still holds it.
+./internal/watchsync TestListItemsSharingProviderKeyDB
+
 # Plugin event deliveries: a claim takes at most its limit, never shares a row,
 # and only the latest claim records the outcome.
 ./internal/plugins TestEventDeliveryOutboxPostgres
@@ -223,6 +272,90 @@
 ./internal/chapterthumbs TestMarkerThumbnailDurationEdgesDB
 ./internal/chapterthumbs TestMarkerThumbnailLifecycleEdgesDB
 
+# Recommendations: job locks, refresh marks, signal triggers, embedding lock and
+# reset, build-time access, exclusion set, profile purge, and section fill.
+./internal/api/handlers TestLibrarySectionItemsAnswersAnErrorWhenTheFetchFailsDB
+./internal/api/handlers TestV1RecentlyAddedDropsInaccessibleItemsPostgres
+./internal/api/handlers TestWatchedFilterDoesNotFallBackToPostgres
+./internal/historyimport TestImportRunReportsSignalChangesOncePostgres
+./internal/metadata TestMergeKeepsTheSourceEmbeddingPostgres
+./internal/metadata TestMergeMarksMovedProfilesStalePostgres
+./internal/recommendations TestCacheRefreshedAtPostgres
+./internal/recommendations TestCacheUserRowsDropRowsThatRebuildEmptyPostgres
+./internal/recommendations TestCacheUserRowsLeaveOutWatchedAndFavoritedTitlesPostgres
+./internal/recommendations TestClearTasteProfileKeepsTheRowAndDropsPersonalStatePostgres
+./internal/recommendations TestCowatchSkipsDeletedItemsAndPrunesStalePairsPostgres
+./internal/recommendations TestDeleteGlobalRecommendationCachePostgres
+./internal/recommendations TestDeletingAProfilePurgesItsRecommendationRowsPostgres
+./internal/recommendations TestEmbeddingLockConflictUsesTheRunningConfigPostgres
+./internal/recommendations TestEmbeddingTextSQLMatchesGoForTiedPeoplePostgres
+./internal/recommendations TestExtendGlobalRecommendationCachePostgres
+./internal/recommendations TestFailedRefreshLeavesTheProfilePendingPostgres
+./internal/recommendations TestFilterAccessibleItemIDsAppliesExcludedMediaTypesPostgres
+./internal/recommendations TestFilterItemIDsHonoursExcludedMediaTypesPostgres
+./internal/recommendations TestFindSimilarAppliesAccessLimitsInSQLPostgres
+./internal/recommendations TestForYouReadRefreshesNewProfilesWithSignalsOncePostgres
+./internal/recommendations TestGetTasteClusterMetaOmitsOnlyEmbeddingsPostgres
+./internal/recommendations TestListCacheRefreshCandidatesOldestFirstPostgres
+./internal/recommendations TestMarkAccountsStalePostgres
+./internal/recommendations TestMarkProfilesStaleForItemsPostgres
+./internal/recommendations TestProfileAccessFilterMatchesTheResolverPostgres
+./internal/recommendations TestRecentCompletedItemIDsSkipDeletedItemsPostgres
+./internal/recommendations TestRecommendationJobRunsOnOneServerPostgres
+./internal/recommendations TestJobLocksShareOneConnectionPostgres
+./internal/recommendations TestCacheJobPurgesAProfileDeletedWhileItWritesPostgres
+./internal/recommendations TestStaleSweepRecordsFailedRefreshesPostgres
+./internal/recommendations TestMarkAllProfilesStaleForPolicyMarksOncePerGenerationPostgres
+./internal/recommendations TestRefreshWaitsForThePolicyChangePostgres
+./internal/policy TestSystemAnnouncesAChangeLoadedByALaterReload
+./internal/database/pglock TestReleaseAlsoUnlocksOnlyThatKey
+./internal/database/pglock TestHeldIsFalseAfterTheSessionDies
+./internal/recommendations TestTasteProfileJobStopsWhenItsLockSessionDiesPostgres
+./internal/recommendations TestRefreshClearsATasteProfileWithNoPositiveSignalPostgres
+./internal/recommendations TestRefreshPurgesAProfileDeletedWhileItWritesPostgres
+./internal/recommendations TestRefreshWritesNoTasteRowForADeletedProfilePostgres
+./internal/recommendations TestResetEmbeddingsPostgres
+./internal/recommendations TestResetEmbeddingsRefusesDuringACatalogImportPostgres
+./internal/recommendations TestResetEmbeddingsRollsBackPostgres
+./internal/recommendations TestStaleMarkBeforeTheFirstBuildSurvivesItPostgres
+./internal/recommendations TestTasteProfileJobSkipsAProfileRefreshingElsewherePostgres
+./internal/recommendations TestTasteProfileSubjectsReadTheSQLiteStorePostgres
+./internal/recommendations TestTasteProfileSubjectsSkipDeletedProfilesPostgres
+./internal/recommendations TestTasteSeedCandidatesHonourAccessPostgres
+./internal/recommendations TestWatchedItemIDSetAcrossPagesPostgres
+./internal/sections TestRecommendationSectionsFillFromTheWholePoolPostgres
+./internal/webhooksync TestWebhookEventsReportSignalChangesPostgres
+./migrations TestPurgeOrphanedRecommendationRowsPostgres
+
+# Recommendation ranking and rows: default rows, Popular floor, genre rows, picker
+# order, taste levels, per-interest anchors, quality prior, rubric leakage,
+# media types of personal rows.
+./internal/recommendations TestCacheUserRowsDoNotAnchorOnDislikedTitlesPostgres
+./internal/recommendations TestCatalogRankLeadsWithNotableTrustedRatingsPostgres
+./internal/recommendations TestDefaultRowsLeaveOutASeriesRatedThroughAnEpisodePostgres
+./internal/recommendations TestCachedRowsLeaveOutASeriesRatedThroughAnEpisodePostgres
+./internal/recommendations TestDefaultRowsServeEachViewerLivePostgres
+./internal/recommendations TestGenreSamplerIsRatingLedPostgres
+./internal/recommendations TestGetItemQualityRatingsPostgres
+./internal/recommendations TestHighlyRatedRowBalancesMediaTypesPostgres
+./internal/recommendations TestHighlyRatedRowPostgres
+./internal/recommendations TestHighlyRatedReusesTitleCountsPostgres
+./internal/recommendations TestHighlyRatedReadsPastAStaleZeroCountPostgres
+./internal/recommendations TestPersonalRowsOfferOnlyRecommendableMediaTypesPostgres
+./internal/recommendations TestPopularNeedsACrowdOfAccountsPostgres
+./internal/recommendations TestPresentMediaTypesPostgres
+./internal/recommendations TestRecentlyAddedRowPostgres
+./internal/recommendations TestRefreshCountsPositiveTitlesForTheLevelPostgres
+./internal/recommendations TestRefreshWeighsAThreeStarCompletionBelowAnUnratedOnePostgres
+./internal/recommendations TestRelevanceRubricLeakagePostgres
+./internal/recommendations TestRelevanceRubricNewProfileGetsRowsPostgres
+./internal/recommendations TestRelevanceRubricProfilesOnOneAccountDifferPostgres
+./internal/recommendations TestTasteProfileSummaryGenresComeFromTheClustersPostgres
+./internal/recommendations TestTasteSeedPickerInterleavesGenresPostgres
+./internal/recommendations TestTopGenresRankByCrowdThenCatalogPostgres
+./internal/recommendations TestTVLibrarySectionFillsFromTheMainRowTailPostgres
+./internal/sections TestRecommendationSectionsTakeTheServedRowTitlePostgres
+
 # Banner, thumb, clear art, disc art and extra backdrops: the migration's Up
 # and Down, slot write-back, backdrop row identity and GC queueing, and the
 # folder-delete reference check over the new columns, provider backfill and
@@ -239,3 +372,33 @@
 # first position exactly where the cursor pager and a seek list it.
 ./internal/catalog TestLetterIndexMatchesCursorPagesPostgres
 ./internal/catalog TestLetterIndexEpisodesMatchCursorPagesPostgres
+
+# Deleting a library removes its ID from access groups, account overrides and
+# invitations, without widening an emptied list; a write keeps only existing
+# libraries, even racing the delete; the migration repairs earlier deletes.
+./migrations TestDeletingLibraryPrunesAccessPolicyReferencesPostgres
+./migrations TestLibraryDeleteRacingAccessWritePostgres
+./migrations TestPruneDeletedLibraryAccessMigrationRepairsStaleIDsPostgres
+
+# AI metadata translations never replace provider or manual localized text.
+./internal/catalog TestAITranslationNeverOverwritesProviderOrManualText
+
+# An unmatched item an admin ignored stays off the unmatched and scan-retry
+# lists, the matcher queues and library refreshes across a rescan, the matcher
+# and item refreshes skip it, and a match clears the mark.
+./internal/api/handlers TestIgnoredUnmatchedItemStaysIgnoredAcrossRescanDB
+./internal/metadata TestProcessLeavesIgnoredItemUnmatchedDB
+./internal/metadata TestMatchQueuesSkipIgnoredItemsDB
+./internal/metadata TestRefreshLeavesIgnoredItemAloneDB
+./internal/adminjob TestLibraryRefreshSkipsIgnoredItemsDB
+
+# A played mark later in the same second as a history removal stays visible.
+./internal/userstore/pgstore TestImportedWritesAfterSameSecondRemovalDB
+./internal/webhooksync TestProcessWebhookPlayedInSameSecondAsUnplayedDB
+
+# A history import run stays within its source limits from the queue to
+# Postgres: large Jellyfin, Emby and Plex sources import completely with paged
+# listings and chunked lookups, and a listing that decodes into millions of
+# values fails the run without allocating it.
+./internal/historyimport TestImportRunReadsLargeSourcesWithinLimits
+./internal/historyimport TestImportRunFailsOnExpandingSourceListing
diff --git a/scripts/ci/db-pins.txt b/scripts/ci/db-pins.txt
index df2aef2b5d..7ce170e181 100644
--- a/scripts/ci/db-pins.txt
+++ b/scripts/ci/db-pins.txt
@@ -53,6 +53,11 @@
 # re-id can rename an item whatever child rows it has (#933).
 ./migrations TestContentIDFamilyFKsCascadeOnUpdatePostgres
 
+# Watch detail artwork: movies, episodes and extras carry the poster and
+# backdrop clients publish to system media controls (#803).
+./internal/catalog TestGetWatchDetailArtwork
+./internal/catalog TestGetWatchDetailOmitsArtworkResolution
+
 # Detail and versions: localization and folder reads per detail build, and the
 # versions endpoint issuing fewer queries than full detail with no image work.
 ./internal/catalog TestBuildMediaItemDetailSharesLocalization
@@ -144,6 +149,13 @@
 ./internal/metadata TestInitialMatch_NFOIDsReplaceTagAnchoredSkeleton
 ./internal/metadata TestInitialMatch_NFOOnlyChainReplacesTagAnchoredSkeleton
 
+# A scan never merges a tagged movie into a title it shares only one provider
+# ID with, and copies of one movie still merge (#2263).
+./internal/metadata TestScanKeepsTaggedMovieFoldersApartDB
+./internal/metadata TestScanStillMergesCopiesOfOneMovieDB
+./internal/metadata TestRescanAfterSplitKeepsTaggedMovieApartDB
+./internal/metadata TestScanKeepsTaggedMovieApartFromTitleWithItsTaggedIDDB
+
 # A corrected Identify moves a series and its anchored children in one rename.
 ./internal/metadata TestIdentify_CorrectedSeriesMovesWithItsChildren
 ./internal/metadata TestIdentify_CorrectionOntoExistingSeriesMovesUnpairedEpisodeState
@@ -172,6 +184,11 @@
 ./internal/scanner TestEbookScanBatchesSkipQueries
 ./internal/scanner TestEbookSkipPreloadPreservesEligibility
 
+# Variant finalization: one narrow scope load, one owner lookup, and one
+# batched write of the variant columns alone.
+./internal/scanner TestFinalizeVariantsBatchesQueriesDB
+./internal/scanner TestFinalizeVariantsLoadsMovieDiscsOutsideTheScopeDB
+
 # ID-less direct ranges reuse full session payloads while checking identities.
 ./internal/jellycompat TestWebOSDurableRangeDoesNotReloadSnapshots
 
@@ -183,10 +200,6 @@
 # whose path column has an index uses it under a generic plan.
 ./internal/metadata TestArtworkReferenceChecksUsePathIndexesDB
 
-# The local-only image-cache claim, run while metadata.cache_images is off, uses
-# its partial index instead of reading the remote jobs left queued.
-./internal/metadata TestLocalImageCacheClaimUsesLocalDueIndexDB
-
 ./internal/trickplay TestStaleReconcileCannotDowngradeConcurrentUpgradeDB
 ./internal/api/handlers TestLibraryExplicitTrickplayUpdateAlwaysReconcilesPostgres
 ./internal/trickplay TestReaderRevalidatesServingWhileSigningDB
@@ -209,6 +222,10 @@
 
 ./internal/chapterthumbs TestWidthBackfillDefersCatalogScansUntilRetryDB
 ./internal/scanner TestChapterLockReusesHealthySessionsDB
+# Discover's default rows read each media type from its own index, however
+# large the catalog.
+./internal/recommendations TestDefaultRowQueriesWalkTypeIndexesPostgres
+
 # Seek preview workers stop after a library or file becomes ineligible.
 ./internal/trickplay TestLibraryTypeChangeFencesWorkerProgressDB
 ./internal/trickplay TestLibraryTypeChangeRetiresFinishedAndExpiredWorkDB
@@ -245,6 +262,11 @@
 # DATABASE_URL already chose jit.
 ./internal/database TestNewPoolDisablesJITUnlessConfiguredPostgres
 
+# Pool connections move vectors in binary, report a NULL vector as an error
+# rather than a panic, still connect before the vector extension exists, and
+# switch to binary once the migrations create it.
+./internal/database TestNewPoolMovesVectorsInBinaryPostgres
+
 # Operational log pages: a cursor prunes the partitions newer than it.
 ./internal/opslog TestListCursorPrunesNewerPartitionsDB
 
@@ -262,3 +284,8 @@
 # the frozen legacy bridge alike.
 ./internal/webhooksync TestProcessWebhookBoundedAppliesDefaultLimitDB
 ./internal/api/handlers TestLegacyWebhookReceiverRejectsOversizedBodyDB
+
+# A person write reindexes the person's titles only when it changes the name,
+# the only person field search documents carry.
+./internal/catalog TestPersonWriteReindexesTitlesOnlyOnRenamePostgres
+./internal/catalog TestPersonWriteWaitingOnARenameReindexesTitlesPostgres
diff --git a/scripts/ci/migrate/main.go b/scripts/ci/migrate/main.go
new file mode 100644
index 0000000000..938bdb1a59
--- /dev/null
+++ b/scripts/ci/migrate/main.go
@@ -0,0 +1,76 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"log/slog"
+	"os"
+
+	"github.com/jackc/pgx/v5/pgconn"
+
+	"github.com/prairie-server/prairie-server/internal/config"
+	"github.com/prairie-server/prairie-server/internal/database"
+	"github.com/prairie-server/prairie-server/migrations"
+)
+
+func main() {
+	if err := run(context.Background(), os.Args[1:], os.Stdout); err != nil {
+		slog.Error("database migration command failed", "error", err)
+		os.Exit(1)
+	}
+}
+
+func run(ctx context.Context, args []string, output io.Writer) error {
+	flags := flag.NewFlagSet("migrate", flag.ContinueOnError)
+	flags.SetOutput(output)
+	envFile := flags.String("env", ".env", "path to .env bootstrap file")
+	flags.Bool("migrate-only", false, "apply database migrations and exit (the default)")
+	status := flags.Bool("migrate-status", false, "show database migration status and exit")
+	downTo := flags.Int64("migrate-down-to", -1, "roll back every migration newer than this version and exit (the version to KEEP)")
+	if err := flags.Parse(args); err != nil {
+		if errors.Is(err, flag.ErrHelp) {
+			return nil
+		}
+		return err
+	}
+	if flags.NArg() != 0 {
+		return errors.New("unexpected positional arguments")
+	}
+	dbURL, err := config.LoadDatabaseURL(*envFile)
+	if err != nil {
+		return fmt.Errorf("bootstrap: %w", err)
+	}
+	ctx, cancel := database.MigrationContext(ctx)
+	defer cancel()
+	pool, err := database.NewPool(ctx, config.DatabaseConfig{URL: dbURL, MaxConnections: 20})
+	if err != nil {
+		// pgx parsing errors can include the complete connection string.
+		var parseError *pgconn.ParseConfigError
+		if errors.As(err, &parseError) {
+			return errors.New("database pool: invalid DATABASE_URL")
+		}
+		return fmt.Errorf("database pool: %w", err)
+	}
+	defer database.ClosePool(pool)
+	if *status {
+		if err := database.PrintMigrationStatus(ctx, pool, migrations.FS, "sql", output); err != nil {
+			return fmt.Errorf("failed to read migration status: %w", err)
+		}
+		return nil
+	}
+	if *downTo >= 0 {
+		if err := database.MigrateDownTo(ctx, pool, migrations.FS, "sql", *downTo); err != nil {
+			return fmt.Errorf("failed to roll back migrations: %w", err)
+		}
+		slog.InfoContext(ctx, "database migrations rolled back", "kept_through_version", *downTo)
+		return nil
+	}
+	if err := database.MigrateOnly(ctx, pool, migrations.FS, "sql"); err != nil {
+		return fmt.Errorf("failed to run migrations: %w", err)
+	}
+	slog.InfoContext(ctx, "database migrations applied")
+	return nil
+}
diff --git a/scripts/ci/migrate/main_test.go b/scripts/ci/migrate/main_test.go
new file mode 100644
index 0000000000..0424afbe07
--- /dev/null
+++ b/scripts/ci/migrate/main_test.go
@@ -0,0 +1,82 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestFlags(t *testing.T) {
+	for _, args := range [][]string{{"--help"}, {"--migrate-only", "--help"}, {"--migrate-status", "--help"}, {"--migrate-down-to=0", "--help"}} {
+		t.Run(strings.Join(args, " "), func(t *testing.T) {
+			var output bytes.Buffer
+			if err := run(t.Context(), args, &output); err != nil {
+				t.Fatalf("help returned %v; want success", err)
+			}
+			for _, flag := range []string{"-env", "-migrate-only", "-migrate-status", "-migrate-down-to"} {
+				if !strings.Contains(output.String(), flag) {
+					t.Errorf("help %q lacks %s", output.String(), flag)
+				}
+			}
+		})
+	}
+	for _, args := range [][]string{{"--unknown"}, {"--migrate-down-to=invalid"}, {"unexpected"}} {
+		var output bytes.Buffer
+		if err := run(t.Context(), args, &output); err == nil {
+			t.Errorf("run(%q) succeeded; want invalid arguments error", args)
+		}
+	}
+}
+
+func TestMissingDatabaseURL(t *testing.T) {
+	t.Setenv("DATABASE_URL", "")
+	var output bytes.Buffer
+	err := run(t.Context(), []string{"--env="}, &output)
+	if err == nil || !strings.Contains(err.Error(), "DATABASE_URL is required") {
+		t.Fatalf("run = %v; want missing DATABASE_URL error", err)
+	}
+}
+
+func TestInvalidDatabaseURLDoesNotDiscloseCredentials(t *testing.T) {
+	t.Setenv("DATABASE_URL", "postgres://test-user:test-password@localhost:invalid/db")
+	var output bytes.Buffer
+	err := run(t.Context(), []string{"--env="}, &output)
+	if err == nil || !strings.Contains(err.Error(), "database pool") {
+		t.Fatalf("run = %v; want database pool error", err)
+	}
+	if strings.Contains(err.Error()+output.String(), "test-password") {
+		t.Fatal("invalid URL error disclosed the password")
+	}
+}
+
+func TestUnreachableDatabase(t *testing.T) {
+	// An absent Unix socket cannot reach a running database or depend on a port race.
+	t.Setenv("DATABASE_URL", "host="+filepath.Join(t.TempDir(), "absent")+" port=5432 user=test dbname=test sslmode=disable")
+	t.Setenv("SECRET_KEY", "")
+	t.Setenv("PRAIRIE_MIGRATE_TIMEOUT", "1s")
+	for _, args := range [][]string{{"--env="}, {"--env=", "--migrate-only"}, {"--env=", "--migrate-status"}, {"--env=", "--migrate-down-to=0"}} {
+		t.Run(strings.Join(args, " "), func(t *testing.T) {
+			var output bytes.Buffer
+			err := run(t.Context(), args, &output)
+			if err == nil || !strings.Contains(err.Error(), "database pool") {
+				t.Fatalf("run = %v; want unreachable database pool error", err)
+			}
+			if strings.Contains(err.Error()+output.String(), "SECRET_KEY") {
+				t.Fatal("migration runner depends on SECRET_KEY")
+			}
+		})
+	}
+}
+
+func TestCanceledContext(t *testing.T) {
+	t.Setenv("DATABASE_URL", "host="+filepath.Join(t.TempDir(), "absent")+" user=test dbname=test")
+	ctx, cancel := context.WithCancel(t.Context())
+	cancel()
+	var output bytes.Buffer
+	if err := run(ctx, []string{"--env="}, &output); !errors.Is(err, context.Canceled) {
+		t.Fatalf("canceled run = %v; want context.Canceled", err)
+	}
+}
diff --git a/scripts/ci/migrationcheck/main.go b/scripts/ci/migrationcheck/main.go
new file mode 100644
index 0000000000..15c3641d82
--- /dev/null
+++ b/scripts/ci/migrationcheck/main.go
@@ -0,0 +1,138 @@
+// Command migrationcheck protects merged migrations and encrypted setting keys.
+package main
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"os"
+	"os/exec"
+	"regexp"
+	"strings"
+)
+
+var sqlNoise = regexp.MustCompile(`(?s)(?i:E)'(?:\\.|''|[^'\\])*'|'(?:''|[^'])*'|"(?:""|[^"])*"|--[^\n]*|/\*.*?\*/|\$[a-zA-Z0-9_]*\$`)
+var settingsWrite = regexp.MustCompile(`(?is)\b(UPDATE|INSERT\s+INTO|MERGE\s+INTO)\s+(?:ONLY\s*)?\(?\s*(?:[a-z_][a-z0-9_]*\s*\.\s*)?server_settings\b([^;]*)`)
+var selectKeyword = regexp.MustCompile(`(?i)\bSELECT\b`)
+var valuesInsert = regexp.MustCompile(`(?is)^\s*(?:AS\s+[a-z_][a-z0-9_]*\s*)?(?:\([^)]*\)\s*)?(?:DEFAULT\s+)?VALUES\b`)
+var setClause = regexp.MustCompile(`(?is)\bSET\b([^;]*)`)
+var keyAssignment = regexp.MustCompile(`(?i)(?:^|,|\()\s*key\b`)
+
+func writesSettingKey(data []byte) bool {
+	// Hide comments and values before matching SQL words. Strings mentioning
+	// settings may contain executable SQL, so refuse them instead of masking them.
+	// Quoted identifiers retain only the protected names.
+	ambiguous := false
+	sql := sqlNoise.ReplaceAllStringFunc(string(data), func(token string) string {
+		if token[0] == '$' || (strings.HasPrefix(token, "/*") && strings.Contains(token[2:], "/*")) {
+			ambiguous = true
+		}
+		if (token[0] == '\'' || token[0] == 'e' || token[0] == 'E') && strings.Contains(strings.ToLower(token), "server_settings") {
+			ambiguous = true
+		}
+		if token[0] == '"' {
+			switch token {
+			case `"key"`:
+				return "key"
+			case `"server_settings"`:
+				return "server_settings"
+			default:
+				return "quoted_identifier"
+			}
+		}
+		return " "
+	})
+	// Nested comments and string bodies exceed this text check; refuse settings
+	// migrations rather than mistake partially masked SQL for a safe write.
+	if ambiguous && strings.Contains(strings.ToLower(string(data)), "server_settings") {
+		return true
+	}
+	for _, write := range settingsWrite.FindAllStringSubmatch(sql, -1) {
+		if !strings.EqualFold(write[1], "UPDATE") {
+			// Refuse copies and unfamiliar write forms rather than infer whether
+			// their source values are encrypted. Literal VALUES inserts are safe.
+			if strings.HasPrefix(strings.ToUpper(write[1]), "MERGE") || !valuesInsert.MatchString(write[2]) || selectKeyword.MatchString(write[2]) {
+				return true
+			}
+		}
+		sets := setClause.FindAllStringSubmatch(write[2], -1)
+		if strings.EqualFold(write[1], "UPDATE") && len(sets) == 0 {
+			return true
+		}
+		for _, set := range sets {
+			// Keep the full clause: a WHERE in a value or subquery must not
+			// hide a later assignment. Include tuple assignment targets.
+			if keyAssignment.MatchString(set[1]) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func main() {
+	if err := run(os.Args[1:]); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}
+
+func git(args ...string) ([]byte, error) {
+	out, err := exec.CommandContext(context.Background(), "git", args...).Output() //nolint:gosec // fixed git executable with separate arguments, no shell
+	if err != nil {
+		return nil, fmt.Errorf("git %s: %w: %s", strings.Join(args, " "), err, out)
+	}
+	return out, nil
+}
+
+func run(args []string) error {
+	flags := flag.NewFlagSet("migrationcheck", flag.ContinueOnError)
+	base := flags.String("base", "", "base revision to compare with the working tree")
+	if err := flags.Parse(args); err != nil {
+		return err
+	}
+	if *base == "" || flags.NArg() != 0 {
+		return errors.New("migrationcheck requires -base <revision>")
+	}
+	changes, err := git("diff", "--name-status", "-z", "--no-renames", *base, "--", "migrations/sql/")
+	if err != nil {
+		return err
+	}
+	var additions []string
+	fields := bytes.Split(bytes.TrimSuffix(changes, []byte{0}), []byte{0})
+	if len(changes) > 0 {
+		for i := 0; i < len(fields); i += 2 {
+			if i+1 >= len(fields) {
+				return errors.New("incomplete migration diff")
+			}
+			if string(fields[i]) != "A" {
+				return fmt.Errorf("merged migration is immutable: %s (%s)", fields[i+1], fields[i])
+			}
+			additions = append(additions, string(fields[i+1]))
+		}
+	}
+	untracked, err := git("ls-files", "-z", "--others", "--exclude-standard", "--", "migrations/sql/")
+	if err != nil {
+		return err
+	}
+	for _, file := range bytes.Split(bytes.TrimSuffix(untracked, []byte{0}), []byte{0}) {
+		if len(file) > 0 {
+			additions = append(additions, string(file))
+		}
+	}
+	for _, file := range additions {
+		if !strings.HasSuffix(file, ".sql") {
+			continue
+		}
+		data, err := os.ReadFile(file) //nolint:gosec // paths come from git's migrations/sql listing
+		if err != nil {
+			return fmt.Errorf("read new migration %s: %w", file, err)
+		}
+		if writesSettingKey(data) {
+			return fmt.Errorf("%s: server_settings key rename invalidates encrypted values", file)
+		}
+	}
+	return nil
+}
diff --git a/scripts/ci/migrationcheck/main_test.go b/scripts/ci/migrationcheck/main_test.go
new file mode 100644
index 0000000000..36ad9e751c
--- /dev/null
+++ b/scripts/ci/migrationcheck/main_test.go
@@ -0,0 +1,206 @@
+package main
+
+import (
+	"context"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func gitTest(t *testing.T, args ...string) string {
+	t.Helper()
+	// Keep background writers out of fixtures, including the checker's Git calls.
+	t.Setenv("GIT_CONFIG_NOSYSTEM", "1")
+	t.Setenv("GIT_CONFIG_GLOBAL", os.DevNull)
+	t.Setenv("GIT_CONFIG_PARAMETERS", "")
+	t.Setenv("GIT_CONFIG_COUNT", "3")
+	t.Setenv("GIT_CONFIG_KEY_0", "maintenance.auto")
+	t.Setenv("GIT_CONFIG_VALUE_0", "false")
+	t.Setenv("GIT_CONFIG_KEY_1", "gc.auto")
+	t.Setenv("GIT_CONFIG_VALUE_1", "0")
+	t.Setenv("GIT_CONFIG_KEY_2", "core.fsmonitor")
+	t.Setenv("GIT_CONFIG_VALUE_2", "false")
+	cmd := exec.CommandContext(context.Background(), "git", args...)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("git %v: %v: %s", args, err, out)
+	}
+	return strings.TrimSpace(string(out))
+}
+
+func writeTest(t *testing.T, file, text string) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Dir(file), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(file, []byte(text), 0o600); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestGitDoesNotStartMaintenance(t *testing.T) {
+	t.Chdir(t.TempDir())
+	// Keep injected maintenance synchronous so a regression cannot race cleanup.
+	t.Setenv("GIT_CONFIG_COUNT", "1")
+	t.Setenv("GIT_CONFIG_KEY_0", "maintenance.autoDetach")
+	t.Setenv("GIT_CONFIG_VALUE_0", "false")
+	t.Setenv("GIT_CONFIG_PARAMETERS", "'maintenance.auto=true'")
+	t.Setenv("GIT_TRACE", "1")
+	gitTest(t, "init", "-q")
+	writeTest(t, "README", "fixture\n")
+	gitTest(t, "add", ".")
+	out := gitTest(t, "-c", "user.name=Test", "-c", "user.email=test@example.invalid", "commit", "-qm", "base")
+	if strings.Contains(out, "maintenance run") || strings.Contains(out, "gc --auto") {
+		t.Fatalf("git commit started maintenance; want no maintenance subprocess:\n%s", out)
+	}
+}
+
+func baseTest(t *testing.T) string {
+	t.Helper()
+	t.Chdir(t.TempDir())
+	gitTest(t, "init", "-q")
+	writeTest(t, "migrations/sql/00001_existing.sql", "-- +goose Up\nSELECT 1;\n")
+	gitTest(t, "add", ".")
+	gitTest(t, "-c", "user.name=Test", "-c", "user.email=test@example.invalid", "commit", "-qm", "base")
+	return gitTest(t, "rev-parse", "HEAD")
+}
+
+func TestMigrationChanges(t *testing.T) {
+	for _, change := range []string{"unchanged", "add", "modify", "delete", "rename", "setting-key", "multiline-key", "value-update", "missing-base"} {
+		t.Run(change, func(t *testing.T) {
+			base := baseTest(t)
+			file := "migrations/sql/00001_existing.sql"
+			switch change {
+			case "add":
+				writeTest(t, "migrations/sql/20261015000000_new.sql", "-- +goose Up\nSELECT 2;\n")
+			case "modify":
+				writeTest(t, file, "-- +goose Up\nSELECT 2;\n")
+			case "delete":
+				gitTest(t, "rm", file)
+			case "rename":
+				gitTest(t, "mv", file, "migrations/sql/00002_renamed.sql")
+			case "setting-key":
+				writeTest(t, "migrations/sql/new.sql", "UPDATE server_settings SET key = 'new' WHERE key = 'old';")
+			case "multiline-key":
+				writeTest(t, "migrations/sql/new.sql", "UPDATE public.\"server_settings\"\n SET value = 'value',\n \"key\" = 'new' WHERE key = 'old';")
+			case "value-update":
+				writeTest(t, "migrations/sql/new.sql", "UPDATE server_settings SET value = 'value' WHERE key = 'old';")
+			case "missing-base":
+				base = "missing-base"
+			}
+			err := run([]string{"-base", base})
+			wantFailure := change != "unchanged" && change != "add" && change != "value-update"
+			if (err != nil) != wantFailure {
+				t.Fatalf("%s: run = %v; want failure %t", change, err, wantFailure)
+			}
+			if change == "add" || change == "setting-key" {
+				gitTest(t, "add", ".")
+				gitTest(t, "-c", "user.name=Test", "-c", "user.email=test@example.invalid", "commit", "-qm", "head")
+				err = run([]string{"-base", base})
+				if (err != nil) != wantFailure {
+					t.Fatalf("committed %s: run = %v; want failure %t", change, err, wantFailure)
+				}
+			}
+		})
+	}
+}
+
+func TestSettingKeyWrites(t *testing.T) {
+	for _, tc := range []struct {
+		name, sql string
+		fail      bool
+	}{
+		{"single quoted DO", "DO 'BEGIN UPDATE server_settings SET key = ''new'' WHERE key = ''old''; END';", true},
+		{"single quoted EXECUTE", "EXECUTE 'UPDATE server_settings SET key = ''new'' WHERE key = ''old'';';", true},
+		{"single quoted function", "CREATE FUNCTION rename_setting() RETURNS void LANGUAGE plpgsql AS 'BEGIN UPDATE server_settings SET key = ''new'' WHERE key = ''old''; END';", true},
+		{"escape quoted DO", "DO E'BEGIN UPDATE SERVER_SETTINGS SET key = ''new'' WHERE key = ''old''; END';", true},
+		{"literal protected name", "SELECT 'server_settings';", true},
+		{"plain value literal", "UPDATE server_settings SET value = 'DO UPDATE unrelated SET key = ''new'';' WHERE key = 'old';", false},
+		{"comment before key", "UPDATE server_settings SET /* rename */ key = 'new' WHERE key = 'old';", true},
+		{"comment after key", "UPDATE server_settings SET key /* rename */ = 'new' WHERE key = 'old';", true},
+		{"line comments", "UPDATE server_settings SET -- rename\n key -- target\n = 'new' WHERE key = 'old';", true},
+		{"nested comment", "UPDATE server_settings SET /* outer /* inner */ outer */ key = 'new' WHERE key = 'old';", true},
+		{"only", "UPDATE ONLY server_settings SET key = 'new' WHERE key = 'old';", true},
+		{"alias", "UPDATE server_settings AS s SET key = 'new' WHERE s.key = 'old';", true},
+		{"bare alias", "UPDATE server_settings s SET key = 'new' WHERE s.key = 'old';", true},
+		{"quoted where", "UPDATE server_settings SET value = 'WHERE key = ''old'';', key = 'new' WHERE key = 'old';", true},
+		{"escaped quote", `UPDATE server_settings SET value = E'quote\';', key = 'new' WHERE key = 'old';`, true},
+		{"dollar quote", "UPDATE server_settings SET value = $text$WHERE;$text$, key = 'new' WHERE key = 'old';", true},
+		{"tuple assignment", "UPDATE server_settings SET (value, key) = ('value', 'new') WHERE key = 'old';", true},
+		{"insert select", "INSERT INTO server_settings (key, value) SELECT 'new', value FROM server_settings WHERE key = 'old';", true},
+		{"insert table", "INSERT INTO server_settings TABLE server_settings;", true},
+		{"086 secret copies", `INSERT INTO server_settings (key, value)
+SELECT 's3.public_secret_key', value FROM server_settings WHERE key = 's3.operational_secret_key'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;
+
+INSERT INTO server_settings (key, value)
+SELECT 's3.private_secret_key', value FROM server_settings WHERE key = 's3.operational_secret_key'
+ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;`, true},
+		{"quoted schema copy", `INSERT INTO "public"."server_settings" (key, value) SELECT 'new', value FROM "public"."server_settings" WHERE key = 'old';`, true},
+		{"conflict key assignment", "INSERT INTO server_settings (key, value) VALUES ('new', 'value') ON CONFLICT (key) DO UPDATE SET key = 'other';", true},
+		{"value update", "UPDATE server_settings SET value = 'value' WHERE key = 'old';", false},
+		{"commented value update", "UPDATE ONLY public.server_settings AS s SET /* value */ value = 'value' WHERE s.key = 'old';", false},
+		{"quoted SQL value", "UPDATE server_settings SET value = 'WHERE key = ''new''; -- /*' WHERE key = 'old';", false},
+		{"escaped value update", `UPDATE server_settings SET value = E'quote\';' WHERE key = 'old';`, false},
+		{"literal insert", "INSERT INTO server_settings (key, value) VALUES ('new', 'value');", false},
+		{"literal upsert", "INSERT INTO server_settings (key, value) VALUES ('new', 'value') ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value;", false},
+		{"commented rename", "/* UPDATE server_settings SET key = 'new'; */ SELECT 1; -- UPDATE server_settings SET key = 'new';", false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			base := baseTest(t)
+			writeTest(t, "migrations/sql/new.sql", "-- +goose Up\n"+tc.sql)
+			err := run([]string{"-base", base})
+			if (err != nil) != tc.fail {
+				t.Fatalf("run = %v; want failure %t", err, tc.fail)
+			}
+			if tc.fail && !strings.Contains(err.Error(), "server_settings key rename") {
+				t.Fatalf("wanted key rename rejection, got %v", err)
+			}
+		})
+	}
+}
+
+func TestV1FreezeTarget(t *testing.T) {
+	root, err := filepath.Abs("../../..")
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, change := range []string{"unchanged", "reorder", "v2", "v1-add", "v1-method", "v1-delete", "missing-base", "invalid-json"} {
+		t.Run(change, func(t *testing.T) {
+			baseTest(t)
+			path := "contracts/api/v2/route-inventory.json"
+			before := `{"routes":[{"listener":"api","namespace":"api_v1","method":"GET","path":"/api/v1/items"},{"listener":"api","namespace":"api_v2","method":"GET","path":"/api/v2/items"}]}`
+			writeTest(t, path, before)
+			gitTest(t, "add", ".")
+			gitTest(t, "-c", "user.name=Test", "-c", "user.email=test@example.invalid", "commit", "-qm", "inventory")
+			base := gitTest(t, "rev-parse", "HEAD")
+			switch change {
+			case "reorder":
+				writeTest(t, path, `{"routes":[{"listener":"api","namespace":"api_v2","method":"GET","path":"/api/v2/items"},{"listener":"api","namespace":"api_v1","method":"GET","path":"/api/v1/items"}]}`)
+			case "v2":
+				writeTest(t, path, strings.ReplaceAll(before, "/api/v2/items", "/api/v2/other"))
+			case "v1-add":
+				writeTest(t, path, strings.ReplaceAll(before, `"routes":[`, `"routes":[{"listener":"api","namespace":"api_v1","method":"POST","path":"/api/v1/items"},`))
+			case "v1-method":
+				writeTest(t, path, strings.Replace(before, "GET", "POST", 1))
+			case "v1-delete":
+				writeTest(t, path, `{"routes":[{"listener":"api","namespace":"api_v2","method":"GET","path":"/api/v2/items"}]}`)
+			case "missing-base":
+				base = "missing-base"
+			case "invalid-json":
+				writeTest(t, path, "{")
+			}
+			cmd := exec.CommandContext(context.Background(), "make", "-f", filepath.Join(root, "Makefile"), "verify-v1-route-freeze", "BASE_REF="+base)
+			out, err := cmd.CombinedOutput()
+			wantFailure := change != "unchanged" && change != "reorder" && change != "v2"
+			if (err != nil) != wantFailure {
+				t.Fatalf("%s: make = %v, %s; want failure %t", change, err, out, wantFailure)
+			}
+			if wantFailure && change != "missing-base" && change != "invalid-json" && !strings.Contains(string(out), "v1 routes changed") {
+				t.Fatalf("%s: wanted v1 rejection, got %s", change, out)
+			}
+		})
+	}
+}
diff --git a/scripts/ci/sizeratchet/main.go b/scripts/ci/sizeratchet/main.go
new file mode 100644
index 0000000000..a7f1758fea
--- /dev/null
+++ b/scripts/ci/sizeratchet/main.go
@@ -0,0 +1,149 @@
+// Command sizeratchet rejects files that cross their line limit since the base.
+package main
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+)
+
+func lines(data []byte) int {
+	n := bytes.Count(data, []byte{'\n'})
+	if len(data) > 0 && data[len(data)-1] != '\n' {
+		n++
+	}
+	return n
+}
+
+func generated(data []byte) bool {
+	block := false
+	for _, line := range strings.Split(string(data), "\n") {
+		line = strings.TrimSpace(line)
+		var comment string
+		switch {
+		case block:
+			comment = line
+		case strings.HasPrefix(line, "/*"):
+			block = true
+			comment = strings.TrimPrefix(line, "/*")
+		case strings.HasPrefix(line, "//"):
+			comment = strings.TrimPrefix(line, "//")
+		case line == "":
+			continue
+		default:
+			return false
+		}
+		end := strings.Index(comment, "*/")
+		text := comment
+		if block && end >= 0 {
+			text = comment[:end]
+			block = false
+		}
+		text = strings.TrimSpace(strings.TrimLeft(text, "*"))
+		if (strings.HasPrefix(text, "Code generated ") && strings.HasSuffix(text, " DO NOT EDIT.")) ||
+			strings.HasPrefix(text, "This file was auto-generated by scripts/generate-apiv2.mjs from") {
+			return true
+		}
+		if end >= 0 && strings.TrimSpace(comment[end+2:]) != "" {
+			return false
+		}
+	}
+	return false
+}
+
+func git(args ...string) ([]byte, error) {
+	out, err := exec.CommandContext(context.Background(), "git", args...).Output() //nolint:gosec // Git argument lists are constructed by this checker; no shell is invoked.
+	if err != nil {
+		return nil, fmt.Errorf("git %v: %w", args, err)
+	}
+	return out, nil
+}
+
+func checkFile(base, before, file string) error {
+	var limit int
+	switch {
+	case strings.HasSuffix(file, "_test.go"):
+		limit = 2000
+	case strings.HasSuffix(file, ".go"):
+		limit = 1000
+	case strings.HasSuffix(file, ".ts"), strings.HasSuffix(file, ".tsx"):
+		limit = 800
+	default:
+		return nil
+	}
+	data, err := os.ReadFile(filepath.Clean(file))
+	if err != nil {
+		return err
+	}
+	if generated(data) {
+		return nil
+	}
+	var old []byte
+	if before != "" {
+		old, err = git("show", base+":"+before)
+		if err != nil {
+			return err
+		}
+	}
+	if lines(old) <= limit && lines(data) > limit {
+		return fmt.Errorf("%s: %d -> %d lines crosses limit %d", file, lines(old), lines(data), limit)
+	}
+	return nil
+}
+
+func run(args []string) error {
+	flags := flag.NewFlagSet("sizeratchet", flag.ContinueOnError)
+	base := flags.String("base", "", "base commit to compare")
+	if err := flags.Parse(args); err != nil {
+		return err
+	}
+	if *base == "" {
+		return errors.New("-base is required")
+	}
+	diff, err := git("diff", "--no-ext-diff", "--no-textconv", "--name-status", "-z", "-M", "--diff-filter=AMR", *base, "--")
+	if err != nil {
+		return err
+	}
+	records := strings.Split(strings.TrimSuffix(string(diff), "\x00"), "\x00")
+	var failures []error
+	for i := 0; i < len(records) && records[i] != ""; {
+		status, before, file := records[i], records[i+1], records[i+1]
+		i += 2
+		if status[0] == 'R' {
+			file = records[i]
+			i++
+		}
+		if status == "A" {
+			before = ""
+		}
+		if err := checkFile(*base, before, file); err != nil {
+			failures = append(failures, err)
+		}
+	}
+	untracked, err := git("ls-files", "--others", "--exclude-standard", "-z")
+	if err != nil {
+		return err
+	}
+	for _, file := range strings.Split(string(untracked), "\x00") {
+		if file == "" {
+			continue
+		}
+		if err := checkFile(*base, "", file); err != nil {
+			failures = append(failures, err)
+		}
+	}
+	return errors.Join(failures...)
+}
+
+func main() {
+	if err := run(os.Args[1:]); err != nil {
+		fmt.Fprintln(os.Stderr, "sizeratchet:", err)
+		os.Exit(1)
+	}
+}
diff --git a/scripts/ci/sizeratchet/main_test.go b/scripts/ci/sizeratchet/main_test.go
new file mode 100644
index 0000000000..44336ad7bb
--- /dev/null
+++ b/scripts/ci/sizeratchet/main_test.go
@@ -0,0 +1,133 @@
+package main
+
+import (
+	"context"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func gitTest(t *testing.T, args ...string) string {
+	t.Helper()
+	// Keep background writers out of fixtures, including the checker's Git calls.
+	t.Setenv("GIT_CONFIG_NOSYSTEM", "1")
+	t.Setenv("GIT_CONFIG_GLOBAL", os.DevNull)
+	t.Setenv("GIT_CONFIG_PARAMETERS", "")
+	t.Setenv("GIT_CONFIG_COUNT", "3")
+	t.Setenv("GIT_CONFIG_KEY_0", "maintenance.auto")
+	t.Setenv("GIT_CONFIG_VALUE_0", "false")
+	t.Setenv("GIT_CONFIG_KEY_1", "gc.auto")
+	t.Setenv("GIT_CONFIG_VALUE_1", "0")
+	t.Setenv("GIT_CONFIG_KEY_2", "core.fsmonitor")
+	t.Setenv("GIT_CONFIG_VALUE_2", "false")
+	cmd := exec.CommandContext(context.Background(), "git", args...)
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		t.Fatalf("git %v: %v: %s", args, err, out)
+	}
+	return strings.TrimSpace(string(out))
+}
+
+func writeTest(t *testing.T, file, text string) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Dir(file), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(file, []byte(text), 0o600); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestGitDoesNotStartMaintenance(t *testing.T) {
+	t.Chdir(t.TempDir())
+	// Keep injected maintenance synchronous so a regression cannot race cleanup.
+	t.Setenv("GIT_CONFIG_COUNT", "1")
+	t.Setenv("GIT_CONFIG_KEY_0", "maintenance.autoDetach")
+	t.Setenv("GIT_CONFIG_VALUE_0", "false")
+	t.Setenv("GIT_CONFIG_PARAMETERS", "'maintenance.auto=true'")
+	t.Setenv("GIT_TRACE", "1")
+	gitTest(t, "init", "-q")
+	writeTest(t, "README", "fixture\n")
+	gitTest(t, "add", ".")
+	out := gitTest(t, "-c", "user.name=Test", "-c", "user.email=test@example.invalid", "commit", "-qm", "base")
+	if strings.Contains(out, "maintenance run") || strings.Contains(out, "gc --auto") {
+		t.Fatalf("git commit started maintenance; want no maintenance subprocess:\n%s", out)
+	}
+}
+
+func TestFileCrossings(t *testing.T) {
+	for _, tc := range []struct {
+		name, file    string
+		before, after int
+		tracked, fail bool
+	}{
+		{"Go exact", "a.go", 999, 1000, true, false},
+		{"Go crossing", "a.go", 1000, 1001, true, true},
+		{"test exact", "a_test.go", 1999, 2000, true, false},
+		{"test crossing", "a_test.go", 2000, 2001, true, true},
+		{"TS exact", "a.ts", 799, 800, true, false},
+		{"TS crossing", "a.ts", 800, 801, true, true},
+		{"TSX crossing", "a.tsx", 800, 801, true, true},
+		{"unchanged debt", "a.go", 1001, 1001, true, false},
+		{"growing debt", "a.go", 1001, 1002, true, false},
+		{"shrinking debt", "a.go", 1002, 1001, true, false},
+		{"new exact", "a.go", 0, 1000, false, false},
+		{"new over", "a.go", 0, 1001, false, true},
+		{"other file", "a.md", 1000, 1001, true, false},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Chdir(t.TempDir())
+			gitTest(t, "init", "-q")
+			writeTest(t, "README", "fixture\n")
+			if tc.tracked {
+				writeTest(t, tc.file, strings.Repeat("// base\n", tc.before))
+			}
+			gitTest(t, "add", ".")
+			gitTest(t, "-c", "user.name=Test", "-c", "user.email=test@example.invalid", "commit", "-qm", "base")
+			base := gitTest(t, "rev-parse", "HEAD")
+			writeTest(t, tc.file, strings.Repeat("// head\n", tc.after))
+			err := run([]string{"-base", base})
+			if (err != nil) != tc.fail {
+				t.Fatalf("run = %v; want failure %t", err, tc.fail)
+			}
+			if tc.fail && !strings.Contains(err.Error(), tc.file) {
+				t.Fatalf("run = %v; want file %s", err, tc.file)
+			}
+		})
+	}
+}
+
+func TestRenameDeletionAndGenerated(t *testing.T) {
+	t.Chdir(t.TempDir())
+	gitTest(t, "init", "-q")
+	writeTest(t, "old.go", strings.Repeat("// base\n", 1001))
+	writeTest(t, "deleted.go", strings.Repeat("// base\n", 1001))
+	gitTest(t, "add", ".")
+	gitTest(t, "-c", "user.name=Test", "-c", "user.email=test@example.invalid", "commit", "-qm", "base")
+	base := gitTest(t, "rev-parse", "HEAD")
+	gitTest(t, "mv", "old.go", "new.go")
+	gitTest(t, "rm", "deleted.go")
+	writeTest(t, "new.go", strings.Repeat("// base\n", 1002))
+	writeTest(t, "generated.go", "// Code generated by fixture. DO NOT EDIT.\n"+strings.Repeat("// generated\n", 1001))
+	writeTest(t, "settingsContract.ts", "/**\n * Code generated by cmd/settingsgen from contracts/settings/v1/manifest.json. DO NOT EDIT.\n */\n"+strings.Repeat("// generated\n", 801))
+	writeTest(t, "operations.ts", "/**\n * This file was auto-generated by scripts/generate-apiv2.mjs from\n * contracts/api/v2/openapi.json. Do not make direct changes to the file.\n */\n"+strings.Repeat("// generated\n", 801))
+	if err := run([]string{"-base", base}); err != nil {
+		t.Fatalf("rename/deletion/generated: %v; want success", err)
+	}
+	if err := run([]string{"-base", "missing-base"}); err == nil {
+		t.Fatal("missing base accepted; want error")
+	}
+}
+
+func TestLines(t *testing.T) {
+	for _, tc := range []struct {
+		text string
+		want int
+	}{{"", 0}, {"a", 1}, {"a\n", 1}, {"a\nb", 2}} {
+		if got := lines([]byte(tc.text)); got != tc.want {
+			t.Errorf("lines(%q) = %d, want %d", tc.text, got, tc.want)
+		}
+	}
+}
diff --git a/scripts/lint-changed.sh b/scripts/lint-changed.sh
index 3b98ec6523..683823060f 100755
--- a/scripts/lint-changed.sh
+++ b/scripts/lint-changed.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # Analyze the Go packages a branch touched and report findings on changed lines.
-# Local runs include committed, staged, unstaged and untracked edits and enable
-# gocritic. CI sets LINT_CHANGED_CI=1 because it runs gocritic full-tree separately.
+# Local runs include committed, staged, unstaged and untracked edits.
+# Gocritic runs on changed lines through .golangci.yml locally and in CI.
 #
 # Usage: scripts/lint-changed.sh [golangci-lint flags...]
 # BASE_REF defaults to origin/main. LINT_CHANGED_BASE_MODE defaults to merge-base
@@ -12,7 +12,7 @@ set -euo pipefail
 base_mode=${LINT_CHANGED_BASE_MODE:-merge-base}
 ci_mode=${LINT_CHANGED_CI:-0}
 case "$base_mode" in
-	merge-base | revision) ;;
+	merge-base | revision | pr-merge) ;;
 	*) echo "lint-changed: invalid LINT_CHANGED_BASE_MODE: $base_mode" >&2; exit 2 ;;
 esac
 case "$ci_mode" in
@@ -39,7 +39,15 @@ run_lint() {
 }
 
 comparison=
-if [[ "$base_mode" == merge-base ]]; then
+if [[ "$base_mode" == pr-merge ]]; then
+	# A pull-request merge ref is the tree CI tests, with the target as parent 1.
+	if git rev-parse --verify --end-of-options 'HEAD^2^{commit}' >/dev/null 2>&1; then
+		comparison=$(git rev-parse --verify --end-of-options 'HEAD^1^{commit}')
+	else
+		echo "lint-changed: tested PR merge unavailable; checking target merge base" >&2
+		comparison=$(git merge-base "$base_ref" HEAD) || comparison=
+	fi
+elif [[ "$base_mode" == merge-base ]]; then
 	if ! comparison=$(git merge-base "$base_ref" HEAD); then
 		echo "lint-changed: cannot find merge base for $base_ref; analyzing all packages" >&2
 	fi
@@ -47,9 +55,17 @@ else
 	# A missing before object (for example after a force push), or an all-zero
 	# before SHA on a new branch, cannot provide a safe changed-line filter.
 	if ! comparison=$(git rev-parse --verify --end-of-options "${base_ref}^{commit}"); then
-		echo "lint-changed: cannot resolve previous revision $base_ref; analyzing all packages" >&2
+		echo "lint-changed: cannot resolve previous revision $base_ref; checking target merge base" >&2
+		if [[ -n "${LINT_CHANGED_TARGET_REF:-}" ]]; then
+			comparison=$(git merge-base "$LINT_CHANGED_TARGET_REF" HEAD) || comparison=
+			# HEAD as the fallback base would hide every committed finding.
+			if [[ "$comparison" == "$(git rev-parse HEAD)" ]]; then
+				comparison=
+			fi
+		fi
 	fi
 fi
+echo "lint-changed: resolved base $comparison (requested $base_ref)" >&2
 if [[ -z "$comparison" ]]; then
 	run_lint "$@" ./...
 	exit
@@ -62,25 +78,42 @@ git ls-files --others --exclude-standard -z >"$scratch/untracked"
 cat "$scratch/tracked" "$scratch/untracked" >"$scratch/changed"
 git diff --color=never --no-ext-diff --no-textconv --no-renames --diff-filter=D --name-only -z "$comparison" -- '*.go' >"$scratch/deleted-go"
 
-full_tree=0
+full_tree=${LINT_CHANGED_FULL_TREE:-0}
 unsafe_paths=0
 : >"$scratch/dirs"
 while IFS= read -r -d '' file; do
 	go_input=1
 	case "$file" in
 		go.mod | go.sum | go.work | go.work.sum | */go.mod | */go.sum | */go.work | */go.work.sum | \
-		.golangci.* | */.golangci.* | Makefile | .go-version | .github/actions/setup-go/* | .github/workflows/* | \
+		.golangci.* | */.golangci.* | .go-version | .github/actions/setup-go/* | \
+		.github/actions/ci-tools/go-checks.mk | \
 		scripts/lint-changed.sh | internal/routeinventory/lintrules/* | vendor/* | \
 		*.c | *.cc | *.cpp | *.cxx | *.h | *.hh | *.hpp | *.s | *.S | *.swig | *.swigcxx)
 			full_tree=1 ;;
+		Makefile | .github/workflows/*)
+			full_tree=1 ;;
 		*.go)
 			dir=${file%/*}
 			[[ "$dir" != "$file" ]] || dir=.
 			printf '%s\n' "$dir" >>"$scratch/dirs" ;;
-		contracts/* | migrations/* | web/dist/* | internal/* | cmd/* | pkg/*)
-			# Non-Go inputs in Go source trees can be embedded or influence cgo.
-			# Directory embeds include Markdown and other documentation too.
-			full_tree=1 ;;
+		contracts/* | migrations/* | internal/* | cmd/* | pkg/*)
+			# The nearest Go directory owns non-Go package inputs. Deletions
+			# and inputs without a Go ancestor require the whole tree.
+			dir=${file%/*}
+			if [[ ! -f "$file" ]]; then
+				full_tree=1
+			else
+				while ! compgen -G "$dir/*.go" >/dev/null; do
+					if [[ "$dir" == . ]]; then break; fi
+					if [[ "$dir" == */* ]]; then dir=${dir%/*}; else dir=.; fi
+				done
+				if compgen -G "$dir/*.go" >/dev/null; then
+					printf '%s\n' "$dir" >>"$scratch/dirs"
+				else
+					full_tree=1
+				fi
+			fi ;;
+		web/dist/*) full_tree=1 ;;
 		*) go_input=0 ;;
 	esac
 	# Only Go inputs participate in package patterns or changed-line reporting.
diff --git a/scripts/prairie-dev b/scripts/prairie-dev
index e27f30e94e..20dbc95828 100755
--- a/scripts/prairie-dev
+++ b/scripts/prairie-dev
@@ -34,6 +34,8 @@ need_env_file() {
 # Run a shell command on whichever host Prairie runs on.
 on_host() {
 	if [[ -n "$PRAIRIE_SSH" ]]; then
+		# The caller builds one escaped remote command; expand its arguments locally.
+		# shellcheck disable=SC2029
 		ssh "$PRAIRIE_SSH" "$@"
 	else
 		bash -lc "$@"
diff --git a/scripts/recs-probe/capture.sh b/scripts/recs-probe/capture.sh
new file mode 100755
index 0000000000..687a583982
--- /dev/null
+++ b/scripts/recs-probe/capture.sh
@@ -0,0 +1,208 @@
+#!/usr/bin/env bash
+# Capture what /api/v2 recommends to the profiles of one account and print a
+# one-line summary per check. It only sends GET requests.
+#
+# Usage: PRAIRIE_URL=https://silo.example PRAIRIE_TOKEN=... scripts/recs-probe/capture.sh [profile-id...]
+#
+#   PRAIRIE_URL    server base URL, without /api/v2
+#   PRAIRIE_TOKEN  session token or API key of the account under test
+#   OUT_DIR     where the JSON goes; default .local/recs-probe/<UTC time>,
+#               which git ignores: the capture holds a profile's viewing
+#   PREV_DIR    an earlier capture of the same profiles, for day-over-day lines
+#
+# With no profile IDs it captures every profile of the account that has no
+# PIN. The lines are measurements, not verdicts: the metrics are defined in
+# docs/architecture/recommendations-evaluation.md.
+set -euo pipefail
+
+usage() {
+	sed -n '2,14p' "$0" | sed 's/^# \{0,1\}//' >&2
+}
+
+case "${1:-}" in
+	-h | --help)
+		usage
+		exit 0
+		;;
+esac
+
+: "${PRAIRIE_URL:?set PRAIRIE_URL (see --help)}"
+: "${PRAIRIE_TOKEN:?set PRAIRIE_TOKEN (see --help)}"
+for tool in curl jq; do
+	command -v "$tool" >/dev/null || {
+		echo "capture: $tool is required" >&2
+		exit 2
+	}
+done
+
+base=${PRAIRIE_URL%/}
+out=${OUT_DIR:-.local/recs-probe/$(date -u +%Y%m%dT%H%M%SZ)}
+prev=${PREV_DIR:-}
+mkdir -p "$out"
+
+# get PATH FILE [PROFILE] writes the response body to FILE and fails on a
+# non-2xx answer. The token goes to curl on stdin, not on its command line.
+get() {
+	local path=$1 file=$2 profile=${3:-} code
+	local headers=(-H 'Accept: application/json')
+	if [[ -n "$profile" ]]; then
+		headers+=(-H "X-Profile-Id: $profile")
+	fi
+	code=$(printf 'header = "Authorization: Bearer %s"\n' "$PRAIRIE_TOKEN" |
+		curl -sS -K - "${headers[@]}" -o "$file" -w '%{http_code}' "$base$path") || code=000
+	if [[ "$code" != 2* ]]; then
+		echo "GET $path: HTTP $code (body in $file)" >&2
+		return 1
+	fi
+}
+
+get /api/v2/profiles "$out/profiles.json"
+profiles=()
+if (($# > 0)); then
+	profiles=("$@")
+else
+	while IFS= read -r pid; do
+		profiles+=("$pid")
+	done < <(jq -r '.items[] | select(.has_pin | not) | .id' "$out/profiles.json")
+	jq -r '.items[] | select(.has_pin) | "skipped \(.id) (\(.name)): PIN-locked profiles need a profile token"' "$out/profiles.json" >&2
+fi
+if ((${#profiles[@]} == 0)); then
+	echo "capture: no profiles to capture" >&2
+	exit 1
+fi
+
+# The recommendation sections a home page can carry.
+rec_sections='["recommended_for_you","because_you_watched","similar_users_liked","taste_match"]'
+
+# cards FILE... prints every recommendation card of the captured surfaces as
+# one JSON object per line, tagged with its surface and row. Upcoming-airing
+# cards on Discover are announcements, not recommendations, and are left out.
+cards() {
+	local dir=$1
+	jq -c '{surface: "main", row: .title, type: .type} + (.items[] | {card: .})' "$dir/main.json"
+	jq -c '.items[] | . as $r | {surface: "rows", row: $r.title, type: $r.type} + ($r.items[] | {card: .})' "$dir/rows.json"
+	jq -c '.items[] | . as $r | $r.items[] | select(.upcoming_event == null) | {surface: "discover", row: $r.title, type: $r.type, card: .}' "$dir/discover.json"
+	jq -c --argjson rec "$rec_sections" '.sections[] | select(.section_type | IN($rec[])) | . as $s | $s.items[] | {surface: "home", row: $s.title, type: $s.section_type, card: .}' "$dir/home.json"
+}
+
+# rated_series DIR PROFILE writes, one per line, the series or movie each
+# rated item stands for, as recommendation cards name it: a rating names the
+# rated item, which can be an episode or season. Movie and series IDs stand
+# for themselves; any other ID is looked up with getCatalogItem, and kept as
+# it is when the lookup fails.
+rated_series() {
+	local dir=$1 profile=$2 id
+	while IFS= read -r id; do
+		if [[ $id == movie-* || $id == series-* ]]; then
+			printf '%s\n' "$id"
+		elif get "/api/v2/catalog/items/$id" "$dir/rated-item.json" "$profile" 2>/dev/null; then
+			jq -r --arg id "$id" 'if (.series_id // "") != "" then .series_id else (.content_id // $id) end' "$dir/rated-item.json"
+		else
+			printf '%s\n' "$id"
+		fi
+	done < <(jq -r '[.items[].item_id] | unique[]' "$dir/ratings.json")
+	rm -f "$dir/rated-item.json"
+}
+
+for pid in "${profiles[@]}"; do
+	dir="$out/$pid"
+	mkdir -p "$dir"
+	name=$(jq -r --arg id "$pid" '.items[] | select(.id == $id) | .name // empty' "$out/profiles.json")
+	label="${name:-$pid}"
+
+	ok=1
+	get /api/v2/recommendations/taste-profile "$dir/taste.json" "$pid" || ok=0
+	get "/api/v2/recommendations/for-you/main?limit=20" "$dir/main.json" "$pid" || ok=0
+	get "/api/v2/recommendations/for-you/rows?limit=20" "$dir/rows.json" "$pid" || ok=0
+	get /api/v2/recommendations/discover "$dir/discover.json" "$pid" || ok=0
+	get /api/v2/home/sections "$dir/home.json" "$pid" || ok=0
+	get "/api/v2/history?limit=200" "$dir/history.json" "$pid" || ok=0
+	get "/api/v2/favorites?limit=200" "$dir/favorites.json" "$pid" || ok=0
+	get "/api/v2/ratings?limit=200" "$dir/ratings.json" "$pid" || ok=0
+	if ((ok == 0)); then
+		echo "[$label] capture incomplete; summaries skipped" >&2
+		continue
+	fi
+	cards "$dir" >"$dir/cards.jsonl"
+	rated_series "$dir" "$pid" >"$dir/rated-series.txt"
+
+	echo "[$label] profile $pid"
+	jq -r '"  signals: positive=\([.signal_counts | to_entries[] | select(.key != "rated_low" and .key != "watch_low" and .key != "rated_3" and .key != "positive_titles") | .value] | add // 0) counts=\(.signal_counts | tostring) updated_at=\(.updated_at // "never")"' "$dir/taste.json"
+	jq -r '"  main: type=\(.type) title=\(.title | @json) cards=\(.items | length)"' "$dir/main.json"
+	jq -r '"  discover: rows=\(.items | length) [\([.items[] | "\(.type):\(.title)=\(.items | length)"] | join(", "))]"' "$dir/discover.json"
+	jq -r '"  discover rows with 10+ cards: \([.items[] | select((.items | length) >= 10)] | length)"' "$dir/discover.json"
+	jq -r --argjson rec "$rec_sections" '"  home sections: \([.sections[] | select(.section_type | IN($rec[])) | "\(.section_type)=\(.items | length)"] | join(", "))"' "$dir/home.json"
+
+	# Leakage: cards the profile finished, favorited or rated, by the
+	# card's own flags and by the captured history, favorites and ratings
+	# pages. Cards name a series, so an episode in those pages counts as its
+	# series. A "+" marks a page with more entries than were captured.
+	jq -rs --slurpfile h "$dir/history.json" --slurpfile f "$dir/favorites.json" --slurpfile r "$dir/ratings.json" \
+		--rawfile rs "$dir/rated-series.txt" '
+		def more(p): "\(p.items | length)\(if p.page.has_more then "+" else "" end)";
+		def series: if (.series_id // "") != "" then .series_id else .content_id end;
+		([$h[0].items[] | select(.watch.completed == true) | series] | unique) as $finished
+		| ([$f[0].items[] | series] | unique) as $favorites
+		| ($rs | split("\n") | map(select(. != "")) | unique) as $rated
+		| "  leakage: finished=\([.[] | select(.card.content_id | IN($finished[]))] | length)"
+		+ " favorited=\([.[] | select(.card.content_id | IN($favorites[]))] | length)"
+		+ " rated=\([.[] | select(.card.content_id | IN($rated[]))] | length)"
+		+ " flagged_played=\([.[] | select(.card.user_state.played == true)] | length)"
+		+ " flagged_favorite=\([.[] | select(.card.user_state.is_favorite == true)] | length)"
+		+ " no_user_state=\([.[] | select(.card.user_state == null)] | length)"
+		+ " pages: history=\(more($h[0])) favorites=\(more($f[0])) ratings=\(more($r[0]))"' "$dir/cards.jsonl"
+
+	# Repetition within one load.
+	jq -rs '
+		def dupes(s): [.[] | select(.surface == s) | .card.content_id] | group_by(.) | map(select(length > 1)) | length;
+		"  repeats: discover_cards_in_2+_rows=\(dupes("discover")) home_cards_in_2+_sections=\(dupes("home"))"' "$dir/cards.jsonl"
+
+	# Card types in the personal rows (main, cluster and Similar Users rows).
+	jq -rs '"  personal card types: \([.[] | select(.surface != "home" and (.type == "cluster" or .type == "similar_users_liked")) | .card.type] | group_by(.) | map("\(.[0])=\(length)") | join(", "))"' "$dir/cards.jsonl"
+
+	# Genre shares: the served main row against the captured completed
+	# history and favorites, each item counted once. amplification is the served share of
+	# the row's top genre minus that genre's history share.
+	jq -rn --slurpfile m "$dir/main.json" --slurpfile h "$dir/history.json" --slurpfile f "$dir/favorites.json" '
+		def shares(items): (items | length) as $n
+			| if $n == 0 then [] else [items[].genres // [] | unique[]] | group_by(.) | map({g: .[0], s: (length / $n)}) | sort_by(-.s, .g) end;
+		def fmt(xs): [xs[:3][] | "\(.g)=\(.s * 100 | round)%"] | join(", ");
+		shares($m[0].items) as $served
+		| shares([($h[0].items[] | select(.watch.completed == true)), $f[0].items[]] | unique_by(.content_id)) as $hist
+		| ($served[0].g // null) as $top
+		| "  genres: served[\(fmt($served))] history[\(fmt($hist))]"
+		+ (if $top then " amplification(\($top))=\((($served[0].s) - ([$hist[] | select(.g == $top) | .s][0] // 0)) * 100 | round)pp" else "" end)'
+done
+
+# Overlap between profiles of the account: the served main rows and the
+# union of each profile's personal rows.
+captured=()
+for pid in "${profiles[@]}"; do
+	[[ -s "$out/$pid/cards.jsonl" ]] && captured+=("$pid")
+done
+for ((i = 0; i < ${#captured[@]}; i++)); do
+	for ((j = i + 1; j < ${#captured[@]}; j++)); do
+		a=${captured[i]} b=${captured[j]}
+		jq -rn --arg a "$a" --arg b "$b" \
+			--slurpfile ma "$out/$a/main.json" --slurpfile mb "$out/$b/main.json" \
+			--slurpfile ca <(jq -s . "$out/$a/cards.jsonl") --slurpfile cb <(jq -s . "$out/$b/cards.jsonl") '
+			def jac(x; y): (x | unique) as $x | (y | unique) as $y
+				| ([$x[] | select(IN($y[]))] | length) as $i | ($x + $y | unique | length) as $u
+				| "shared=\($i) jaccard=\(if $u == 0 then "n/a" else ($i / $u * 100 | round / 100) end)";
+			def personal(c): [c[] | select(.surface != "home" and (.type == "cluster" or .type == "similar_users_liked")) | .card.content_id];
+			"overlap \($a) vs \($b): main[\(jac([$ma[0].items[].content_id]; [$mb[0].items[].content_id]))] personal[\(jac(personal($ca[0]); personal($cb[0])))]"'
+	done
+done
+
+# Day-over-day: the same profile's served main row against an earlier capture.
+if [[ -n "$prev" ]] && ((${#captured[@]} > 0)); then
+	for pid in "${captured[@]}"; do
+		[[ -s "$prev/$pid/main.json" ]] || continue
+		jq -rn --arg p "$pid" --slurpfile old "$prev/$pid/main.json" --slurpfile new "$out/$pid/main.json" '
+			def ids(r; n): [r.items[:n][].content_id];
+			def shared(n): (ids($old[0]; n)) as $o | [ids($new[0]; n)[] | select(IN($o[]))] | length;
+			"repeat \($p) vs \($ENV.PREV_DIR): top10_shared=\(shared(10)) top20_shared=\(shared(20)) cards_then=\($old[0].items | length) cards_now=\($new[0].items | length)"'
+	done
+fi
+
+echo "captured to $out" >&2
diff --git a/scripts/test_check_go_lint.py b/scripts/test_check_go_lint.py
new file mode 100644
index 0000000000..b04426d504
--- /dev/null
+++ b/scripts/test_check_go_lint.py
@@ -0,0 +1,168 @@
+#!/usr/bin/env python3
+"""Exercise the pre-commit Go gate against real Git indexes and gofmt."""
+import json
+import os
+from pathlib import Path
+import shutil
+import subprocess
+import sys
+import tempfile
+import unittest
+
+
+SCRIPT = Path(__file__).with_name("check-go-lint.sh")
+GIT = shutil.which("git")
+BASH = os.environ.get("TEST_BASH", shutil.which("bash"))
+
+
+class CheckGoLintTests(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.tmp.cleanup)
+        self.root = Path(self.tmp.name)
+        self.repo = self.root / "repo"
+        self.repo.mkdir()
+        self.bin = self.root / "bin"
+        self.bin.mkdir()
+        self.temp = self.root / "tmp"
+        self.temp.mkdir()
+        self.output = self.root / "lint.json"
+        self.env = os.environ.copy()
+        self.env.update(PATH=str(self.bin), BASE_REF="base", TMPDIR=str(self.temp))
+        for tool in ("git", "gofmt", "mktemp", "rm", "env", "bash"):
+            (self.bin / tool).symlink_to(shutil.which(tool))
+        self.git("init", "-q")
+        self.git("config", "user.name", "CI test")
+        self.git("config", "user.email", "ci-test@example.invalid")
+        self.git("config", "core.hooksPath", "/dev/null")
+        self.write("a/code.go", "package a\n\nconst Value = 1\n")
+        self.write("b/code.go", "package b\n\nconst Value = 1\n")
+        self.write("go.mod", "module example.invalid/gate\n\ngo 1.26.4\n")
+        self.write(".gitignore", "go.work\ngo.work.sum\n")
+        delegate = self.write("scripts/lint-changed.sh", "#!/usr/bin/env bash\nexec golangci-lint run\n")
+        delegate.chmod(0o755)
+        self.git("add", "--all")
+        self.git("commit", "-qm", "fixture")
+        self.git("branch", "base")
+
+    def git(self, *args):
+        return subprocess.check_output([GIT, *args], cwd=self.repo, text=True)
+
+    def write(self, name, text):
+        path = self.repo / name
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text(text)
+        return path
+
+    def linter(self, status=0):
+        path = self.bin / "golangci-lint"
+        path.write_text(
+            f"#!{sys.executable}\n"
+            "import json, os\n"
+            "from pathlib import Path\n"
+            f"Path({str(self.output)!r}).write_text(json.dumps({{'gowork': os.environ.get('GOWORK')}}))\n"
+            f"raise SystemExit({status})\n"
+        )
+        path.chmod(0o755)
+
+    def stage_go(self):
+        self.write("a/code.go", "package a\n\nconst Value = 2\n")
+        self.git("add", "a/code.go")
+
+    def gate(self, *args):
+        result = subprocess.run(
+            [BASH, str(SCRIPT), *args], cwd=self.repo, env=self.env,
+            text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE,
+        )
+        self.assertEqual(list(self.temp.iterdir()), [], "temporary inputs leaked")
+        return result
+
+    def test_no_go_changes_skip_lint(self):
+        self.linter(status=1)
+        result = self.gate("--cached")
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertFalse(self.output.exists())
+
+    def test_formatting_reads_the_index_with_literal_names(self):
+        self.write("café.go", "package a;const X=1\n")
+        self.git("add", "café.go")
+        self.write("café.go", "package a\n\nconst X = 1\n")
+        result = self.gate("--cached")
+        self.assertEqual(result.returncode, 1)
+        self.assertIn("café.go", result.stderr)
+
+    def test_dangling_symlink_type_change_is_checked(self):
+        path = self.repo / "a/code.go"
+        path.unlink()
+        path.symlink_to("missing.go")
+        self.git("add", "a/code.go")
+        self.assertIn("T\ta/code.go", self.git("diff", "--cached", "--name-status"))
+        result = self.gate("--cached")
+        self.assertEqual(result.returncode, 1)
+        self.assertIn("gofmt is required", result.stderr)
+
+    def test_git_discovery_failure_cannot_pass_as_no_changes(self):
+        self.stage_go()
+        self.git("config", "diff.orderFile", "missing-order-file")
+        result = self.gate("--cached")
+        self.assertNotEqual(result.returncode, 0)
+        self.assertIn("failed to read orderfile", result.stderr)
+
+    def test_dependency_module_and_untracked_inputs_refuse_lint(self):
+        self.linter()
+        self.stage_go()
+        for name in ("b/code.go", "go.mod", "other/new.go", "notes.txt"):
+            with self.subTest(name=name):
+                path = self.repo / name
+                original = path.read_text() if path.exists() else None
+                self.write(name, "unstaged input\n")
+                result = self.gate("--cached")
+                self.assertEqual(result.returncode, 1)
+                self.assertIn("unstaged or untracked", result.stderr)
+                self.assertIn("--include-untracked", result.stderr)
+                self.assertFalse(self.output.exists())
+                if original is None:
+                    path.unlink()
+                else:
+                    path.write_text(original)
+
+    def test_deleted_file_restored_on_disk_refuses_lint(self):
+        self.linter()
+        self.git("rm", "--cached", "b/code.go")
+        result = self.gate("--cached")
+        self.assertEqual(result.returncode, 1)
+        self.assertFalse(self.output.exists())
+
+    def test_deletion_only_commit_reaches_lint_and_preserves_failure(self):
+        self.linter(status=1)
+        self.git("rm", "b/code.go")
+        result = self.gate("--cached")
+        self.assertEqual(result.returncode, 1)
+        self.assertTrue(self.output.exists())
+
+    def test_clean_staged_commit_disables_ignored_workspaces(self):
+        self.linter()
+        self.stage_go()
+        self.write("go.work", "invalid ignored workspace\n")
+        result = self.gate("--cached")
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(json.loads(self.output.read_text())["gowork"], "off")
+
+    def test_noncached_mode_keeps_local_workspace(self):
+        self.linter()
+        self.stage_go()
+        self.write("a/code.go", "package a\n\nconst Value = 3\n")
+        self.env["GOWORK"] = "auto"
+        result = self.gate()
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(json.loads(self.output.read_text())["gowork"], "auto")
+
+    def test_missing_linter_warns_and_keeps_formatting_gate(self):
+        self.stage_go()
+        result = self.gate("--cached")
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertIn("skipping golangci-lint", result.stderr)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/scripts/test_lint_changed.py b/scripts/test_lint_changed.py
index 65c2f837e4..a242ade9d5 100644
--- a/scripts/test_lint_changed.py
+++ b/scripts/test_lint_changed.py
@@ -3,6 +3,7 @@
 import json
 import os
 from pathlib import Path
+import re
 import shutil
 import subprocess
 import sys
@@ -11,6 +12,8 @@
 
 
 SCRIPT = Path(__file__).with_name("lint-changed.sh")
+REPO_ROOT = SCRIPT.parent.parent
+CHECKS = REPO_ROOT / ".github/actions/ci-tools/go-checks.mk"
 GIT = shutil.which("git")
 BASH = os.environ.get("TEST_BASH", shutil.which("bash"))
 
@@ -47,9 +50,14 @@ def setUp(self):
         )
         self.stub(
             "go",
-            """import os, pathlib, sys
+            """import json, os, pathlib, sys
 if os.environ.get('FAIL_GO_LIST'):
     sys.exit(9)
+if sys.argv[1:] == ['list', '-e', '-json', './...']:
+    for package in json.loads(os.environ.get('GO_PACKAGES', '[]')):
+        package['Dir'] = str(pathlib.Path(package['Dir']).resolve())
+        print(json.dumps(package))
+    sys.exit(0)
 assert sys.argv[1:] == ['list', '-e', '-f', '{{.Dir}}', './...']
 for directory, dirs, files in os.walk('.'):
     dirs[:] = sorted(d for d in dirs if d not in ('testdata', 'vendor') and not d.startswith('.'))
@@ -204,8 +212,138 @@ def test_missing_merge_base_runs_unfiltered_full_tree(self):
         self.assertEqual(result.returncode, 0, result.stderr)
         self.assertEqual(output["args"], ["run", "./..."])
 
+    def test_missing_push_before_falls_back_to_verified_target_merge_base(self):
+        self.git("checkout", "-qb", "feature")
+        self.write("internal/a/code.go", "package a\n\nconst Value = 2\n")
+        self.commit()
+        result, output = self.run_lint(BASE_REF="f" * 40, LINT_CHANGED_BASE_MODE="revision",
+                                       LINT_CHANGED_TARGET_REF="base", LINT_CHANGED_CI="1")
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(self.packages(output), ["./internal/a"])
+        self.assertIn("+const Value = 2", output["patch"])
+        self.assertIn(self.base, result.stderr)
+
+    def test_missing_push_before_on_target_runs_unfiltered_full_tree(self):
+        self.git("checkout", "base")
+        self.write("internal/a/code.go", "package a\n\nconst Value = 2\n")
+        self.commit()
+        result, output = self.run_lint(BASE_REF="f" * 40, LINT_CHANGED_BASE_MODE="revision",
+                                       LINT_CHANGED_TARGET_REF="base", LINT_CHANGED_CI="1")
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertIsNotNone(output, result.stdout + result.stderr)
+        self.assertEqual(output["args"], ["run", "./..."])
+        self.assertIsNone(output["patch"])
+
+    def test_tested_pr_merge_uses_first_parent(self):
+        self.git("checkout", "-qb", "feature")
+        self.write("internal/a/code.go", "package a\n\nconst Value = 2\n")
+        self.commit()
+        self.git("checkout", "base")
+        self.write("internal/b/code.go", "package b\n\nconst Value = 8\n")
+        self.commit()
+        parent = self.git("rev-parse", "HEAD").strip()
+        self.git("merge", "--no-ff", "-qm", "tested merge", "feature")
+        result, output = self.run_lint(BASE_REF=self.base, LINT_CHANGED_BASE_MODE="pr-merge",
+                                       LINT_CHANGED_CI="1")
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(self.packages(output), ["./internal/a"])
+        self.assertNotIn("internal/b", output["patch"])
+        self.assertIn(parent, result.stderr)
+
+    def test_ci_full_tree_keeps_changed_line_filter(self):
+        self.write("internal/a/code.go", "package a\n\nconst Value = 2\n")
+        for mode in ("merge-base", "revision"):
+            for issue, expected_status in (("const Value = 1", 0), ("const Value = 2", 1)):
+                with self.subTest(mode=mode, issue=issue):
+                    result, output = self.run_lint(
+                        LINT_CHANGED_FULL_TREE="1", LINT_CHANGED_CI="1",
+                        LINT_CHANGED_BASE_MODE=mode, LINT_ISSUE_LINE=issue,
+                    )
+                    self.assertEqual(self.packages(output), ["./..."])
+                    self.assertTrue(any(arg.startswith("--new-from-patch=") for arg in output["args"]), output)
+                    self.assertEqual(result.returncode, expected_status, result.stderr)
+                    self.assertIn("+const Value = 2", output["patch"].splitlines())
+                    self.assertNotIn("+const Value = 1", output["patch"].splitlines())
+                    self.assertIn(f"resolved base {self.base}", result.stderr)
+
+    def test_go_checks_makefile_is_a_full_tree_trigger(self):
+        self.write(".github/actions/ci-tools/go-checks.mk", "lint:\n\tgo vet ./...\n")
+        result, output = self.run_lint(LINT_CHANGED_CI="1")
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertIsNotNone(output, result.stdout + result.stderr)
+        self.assertEqual(self.packages(output), ["./..."])
+
+    def test_owned_embed_selects_its_package(self):
+        self.write("internal/a/data.json", "original\n")
+        self.commit()
+        self.git("branch", "-f", "base", "HEAD")
+        self.write("internal/a/data.json", "changed\n")
+        metadata = [{"Dir": "internal/a", "ImportPath": "example.invalid/linttest/internal/a", "EmbedFiles": ["data.json"]}]
+        result, output = self.run_lint(LINT_CHANGED_CI="1", GO_PACKAGES=json.dumps(metadata))
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(self.packages(output), ["./internal/a"])
+        self.assertEqual(output["patch"], "")
+
+    def test_cross_package_embed_uses_nearest_go_directory(self):
+        self.write("internal/a/data.json", "changed\n")
+        metadata = [{"Dir": "internal/a", "EmbedFiles": ["data.json"]},
+                    {"Dir": "internal/b", "TestEmbedFiles": ["../a/data.json"]}]
+        result, output = self.run_lint(LINT_CHANGED_CI="1", GO_PACKAGES=json.dumps(metadata))
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(self.packages(output), ["./internal/a"])
+
+    def test_deleted_non_go_embed_remains_full_tree(self):
+        self.write("internal/a/data.json", "original\n")
+        self.commit()
+        self.git("branch", "-f", "base", "HEAD")
+        (self.repo / "internal/a/data.json").unlink()
+        metadata = [{"Dir": "internal/a", "EmbedFiles": ["data.json"]}]
+        result, output = self.run_lint(LINT_CHANGED_CI="1", GO_PACKAGES=json.dumps(metadata))
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(self.packages(output), ["./..."])
+
+    def test_workflow_and_makefile_comments_still_require_full_tree(self):
+        for name in (".github/workflows/ci.yml", "Makefile"):
+            self.write(name, "# original comment\n")
+        self.commit()
+        self.git("branch", "-f", "base", "HEAD")
+        for name in (".github/workflows/ci.yml", "Makefile"):
+            self.write(name, "# changed comment\n")
+        result, output = self.run_lint(FAIL_GO_LIST="1", LINT_CHANGED_CI="1")
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(self.packages(output), ["./..."])
+
+    def test_non_go_inputs_map_to_nearest_go_directory(self):
+        for directory in ("contracts", "migrations", "internal", "cmd", "pkg"):
+            with self.subTest(directory=directory):
+                self.git("reset", "--hard", "-q", self.base)
+                self.git("clean", "-fdq")
+                self.write(f"{directory}/owner/owner.go", "package owner\n")
+                self.write(f"{directory}/owner/nested/data.json", "input\n")
+                result, output = self.run_lint(LINT_CHANGED_CI="1")
+                self.assertEqual(result.returncode, 0, result.stderr)
+                self.assertEqual(self.packages(output), [f"./{directory}/owner"])
+
+    def test_no_go_ancestor_requires_full_tree(self):
+        (self.repo / "root.go").unlink()
+        self.commit()
+        self.git("branch", "-f", "base", "HEAD")
+        self.write("contracts/api/unknown.json", "input\n")
+        result, output = self.run_lint(LINT_CHANGED_CI="1")
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertEqual(self.packages(output), ["./..."])
+
+    def test_workflow_toolchain_and_lint_inputs_remain_full_tree(self):
+        for name in (".go-version", ".github/actions/setup-go/action.yml", ".github/workflows/ci.yml",
+                     ".github/workflows/trusted-linux-ci.yml"):
+            with self.subTest(name=name):
+                self.write(name, "GOLANGCI_LINT_VERSION: v9.9.9\n")
+                result, output = self.run_lint(LINT_CHANGED_CI="1")
+                self.assertEqual(result.returncode, 0, result.stderr)
+                self.assertEqual(self.packages(output), ["./..."])
+
     def test_shared_inputs_require_full_tree_with_valid_filter(self):
-        for name in ("go.mod", ".golangci.yml", "internal/routeinventory/lintrules/check.go", "internal/a/data.json", "include/config.h", "contracts/api/v2/openapi.json"):
+        for name in ("go.mod", ".golangci.yml", "internal/routeinventory/lintrules/check.go", "include/config.h"):
             with self.subTest(name=name):
                 self.git("reset", "--hard", "-q", self.base)
                 self.git("clean", "-fdq")
@@ -222,7 +360,7 @@ def test_deleted_package_requires_full_tree_for_its_importers(self):
         self.assertEqual(self.packages(output), ["./..."])
         self.assertIn("deleted file mode", output["patch"])
 
-    def test_embedded_markdown_requires_full_tree(self):
+    def test_embedded_markdown_maps_to_nearest_go_directory(self):
         self.write("internal/policy/vendor.go", 'package policy\n\nimport "embed"\n\n//go:embed vendor\nvar resources embed.FS\n')
         self.write("internal/policy/vendor/README.md", "embedded original\n")
         self.commit()
@@ -230,7 +368,7 @@ def test_embedded_markdown_requires_full_tree(self):
         self.write("internal/policy/vendor/README.md", "embedded update\n")
         result, output = self.run_lint(LINT_CHANGED_CI="1")
         self.assertEqual(result.returncode, 0, result.stderr)
-        self.assertEqual(self.packages(output), ["./..."])
+        self.assertEqual(self.packages(output), ["./internal/policy"])
         self.assertEqual(output["patch"], "")
 
     def test_unchanged_go_rename_does_not_report_inherited_findings(self):
@@ -306,5 +444,180 @@ def test_linter_failure_propagates_and_cleans_patch(self):
         self.assertEqual(self.packages(output), ["./internal/a"])
 
 
+class TestDependencyGuardTests(unittest.TestCase):
+    def run_guard(self, metadata, exit_code="0"):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory).resolve()
+            go = root / "go"
+            go.write_text(f"#!{sys.executable}\nimport os, sys\nprint(os.environ['GUARD_METADATA'])\nsys.exit(int(os.environ.get('GUARD_EXIT', '0')))\n")
+            go.chmod(0o755)
+            env = dict(os.environ, PATH=str(root) + os.pathsep + os.environ["PATH"], GUARD_METADATA=metadata, GUARD_EXIT=exit_code)
+            return subprocess.run(["make", "-f", str(CHECKS), "test-dependencies"], cwd=root,
+                                  env=env, text=True, capture_output=True)
+
+    def test_normal_test_variants_pass(self):
+        result = self.run_guard("github.com/prairie-server/prairie-server/internal/api/handlers [github.com/prairie-server/prairie-server/internal/api/handlers.test]|github.com/prairie-server/prairie-server/internal/api/handlers\n")
+        self.assertEqual(result.returncode, 0, result.stdout + result.stderr)
+
+    def test_restored_lower_layer_placements_fail(self):
+        for package, cause in (("handlers", "auth"), ("apiv2", "api/handlers")):
+            owner = "internal/api/handlers" if package == "handlers" else "internal/apiv2"
+            result = self.run_guard(f"github.com/prairie-server/prairie-server/{owner} [github.com/prairie-server/prairie-server/internal/{cause}.test]|github.com/prairie-server/prairie-server/internal/{cause}\n")
+            self.assertNotEqual(result.returncode, 0, result.stdout + result.stderr)
+            self.assertIn("lower-layer external test", result.stdout + result.stderr)
+
+    def test_empty_metadata_and_command_failures_refuse(self):
+        for metadata, code in (("", "0"), ("normal package|", "9")):
+            with self.subTest(code=code):
+                result = self.run_guard(metadata, code)
+                self.assertNotEqual(result.returncode, 0, result.stdout + result.stderr)
+
+
+class PipelineReuseTests(unittest.TestCase):
+    def step(self, job, name):
+        workflow = (REPO_ROOT / ".github/workflows/trusted-linux-ci.yml").read_text()
+        body = workflow.split("\n  " + job + ":\n", 1)[1]
+        body = re.split(r"\n  [a-z][a-z-]*:\n", body, maxsplit=1)[0]
+        step = body.split("      - name: " + name + "\n", 1)[1]
+        step = step.split("      - name:", 1)[0]
+        if "        run: |\n" in step:
+            run = step.split("        run: |\n", 1)[1]
+            return "\n".join(line[10:] for line in run.splitlines() if line.startswith("          "))
+        return step.split("        run: ", 1)[1].splitlines()[0]
+
+    def execute(self, job, names, **extra_env):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory).resolve()
+            log = root / "calls.jsonl"
+            packages = ("internal/watchtogether", "migrations", "internal/historyimport", "internal/api/handlers",
+                        "internal/adminjob", "internal/auth", "internal/recommendations", "cmd/prairie",
+                        "internal/jellycompat", "internal/plugins")
+            for package in packages:
+                (root / package).mkdir(parents=True, exist_ok=True)
+            go = root / "go"
+            binary = f'''#!{sys.executable}
+import json, os, pathlib, sys
+with open(os.environ['CALL_LOG'], 'a') as output:
+    output.write(json.dumps({{'kind': 'run', 'binary': pathlib.Path(sys.argv[0]).relative_to(os.environ['RUNNER_TEMP']).as_posix(), 'cwd': pathlib.Path.cwd().relative_to(os.environ['FIXTURE_ROOT']).as_posix(), 'args': sys.argv[1:], 'database': os.environ.get('PRAIRIE_TEST_DATABASE_URL')}}) + '\\n')
+sys.exit(int(os.environ.get('TEST_BINARY_EXIT', '0')))
+'''
+            go.write_text(f'''#!{sys.executable}
+import json, os, pathlib, sys
+with open(os.environ['CALL_LOG'], 'a') as output:
+    output.write(json.dumps({{'kind': 'build', 'args': sys.argv[1:]}}) + '\\n')
+if os.environ.get('COMPILE_EXIT'):
+    sys.exit(int(os.environ['COMPILE_EXIT']))
+target = pathlib.Path(sys.argv[sys.argv.index('-o') + 1])
+directory_output = sys.argv[sys.argv.index('-o') + 1].endswith('/')
+if directory_output:
+    target.mkdir(parents=True, exist_ok=True)
+for package in (arg for arg in sys.argv[1:] if arg.startswith('./')):
+    output = target / (pathlib.Path(package).name + '.test') if directory_output else target
+    output.write_text({binary!r})
+    output.chmod(0o755)
+''')
+            go.chmod(0o755)
+            env = dict(os.environ, PATH=str(root) + os.pathsep + os.environ["PATH"], RUNNER_TEMP=str(root / "runner"),
+                       CALL_LOG=str(log), FIXTURE_ROOT=str(root), PRAIRIE_TEST_DATABASE_URL="pgvector-fixture", **extra_env)
+            commands = "set -euo pipefail\n" + self.step(job, "Build race test binaries") + "\n"
+            workflow = (REPO_ROOT / ".github/workflows/trusted-linux-ci.yml").read_text()
+            for name in names:
+                step = workflow.split("      - name: " + name + "\n", 1)[1].split("      - name:", 1)[0]
+                database = re.search(r"          PRAIRIE_TEST_DATABASE_URL: (.*)", step)
+                commands += "\n(\n"
+                if database:
+                    commands += "export PRAIRIE_TEST_DATABASE_URL=" + repr(database[1]) + "\n"
+                commands += self.step(job, name) + "\n)\n"
+            result = subprocess.run([BASH, "-c", commands], cwd=root, env=env, text=True, capture_output=True)
+            calls = [json.loads(line) for line in log.read_text().splitlines()] if log.exists() else []
+            return result, calls
+
+    def test_auth_binaries_keep_race_filters_and_break_glass_order(self):
+        result, calls = self.execute("go-db-auth", ["Test external sign-in against Postgres"])
+        self.assertEqual(result.returncode, 0, result.stderr)
+        builds = [c for c in calls if c["kind"] == "build"]
+        runs = [c for c in calls if c["kind"] == "run"]
+        self.assertEqual(len(builds), 1, calls)
+        self.assertTrue(all("-race" in c["args"] and "-c" in c["args"] for c in builds), calls)
+        self.assertEqual([c["cwd"] for c in runs], ["internal/api/handlers", "internal/auth", "internal/jellycompat", "internal/plugins"])
+        self.assertIn("TestLocalLoginSettingRequiresBreakGlassDB", runs[0]["args"][0])
+        self.assertTrue(all(c["database"] == "pgvector-fixture" for c in runs), calls)
+        self.assertTrue(all(c["binary"] == "race/" + Path(c["cwd"]).name + ".test" for c in runs), calls)
+        self.assertEqual([arg for arg in builds[0]["args"] if arg.startswith("./")],
+                         ["./internal/api/handlers/", "./internal/auth/", "./internal/jellycompat/", "./internal/plugins/"])
+        self.assertTrue(all("-test.count=1" in c["args"] and "-test.timeout=10m" in c["args"] for c in runs), calls)
+
+    def test_compile_and_execution_failures_propagate(self):
+        for variable in ("COMPILE_EXIT", "TEST_BINARY_EXIT"):
+            with self.subTest(variable=variable):
+                result, calls = self.execute("go-db-auth", ["Test external sign-in against Postgres"], **{variable: "17"})
+                self.assertEqual(result.returncode, 17, result.stdout + result.stderr)
+                if variable == "COMPILE_EXIT":
+                    self.assertFalse(any(c["kind"] == "run" for c in calls), calls)
+
+    def test_integration_reuses_migrations_binary_and_package_directories(self):
+        result, calls = self.execute("go-integration", ["Test history import cancellation and profile authorization against Postgres",
+                                                      "Test the marker claim migration against Postgres"])
+        self.assertEqual(result.returncode, 0, result.stderr)
+        builds = [c for c in calls if c["kind"] == "build"]
+        runs = [c for c in calls if c["kind"] == "run"]
+        self.assertEqual(len(builds), 1, calls)
+        self.assertTrue(all("-race" in c["args"] for c in builds), calls)
+        self.assertEqual([c["cwd"] for c in runs], ["migrations", "internal/historyimport", "internal/api/handlers", "migrations"])
+        self.assertEqual(runs[0]["binary"], runs[-1]["binary"])
+
+    def test_integration_keeps_database_assignments_and_all_filters(self):
+        names = ["Test Watch Party coordination against Postgres",
+                 "Test history import cancellation and profile authorization against Postgres",
+                 "Test the marker claim migration against Postgres",
+                 "Test image cache cleanup resumption against Postgres",
+                 "Test device sign-in against Postgres",
+                 "Test taste cluster replacement against Postgres",
+                 "Test Jellyfin detail preferences against Postgres"]
+        result, calls = self.execute("go-integration", names)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        runs = [c for c in calls if c["kind"] == "run"]
+        self.assertEqual([c["cwd"] for c in runs],
+                         ["internal/watchtogether", "migrations", "internal/historyimport", "internal/api/handlers",
+                          "migrations", "internal/adminjob", "internal/auth", "internal/recommendations", "cmd/prairie"])
+        self.assertTrue(all("-test.count=1" in c["args"] and "-test.timeout=10m" in c["args"] for c in runs), calls)
+        # Steps override the job's pgvector URL only for the PG17 database.
+        workflow = (REPO_ROOT / ".github/workflows/trusted-linux-ci.yml").read_text()
+        for name in names[:3]:
+            step = workflow.split("      - name: " + name + "\n", 1)[1].split("      - name:", 1)[0]
+            self.assertIn("PRAIRIE_TEST_DATABASE_URL: postgres://postgres:postgres@localhost:5432/watch_party?sslmode=disable", step)
+        self.assertTrue(all(c["database"] == "pgvector-fixture" for c in runs[5:]), calls)
+        self.assertTrue(all(c["database"] == "postgres://postgres:postgres@localhost:5432/watch_party?sslmode=disable"
+                            for c in runs[:5]), calls)
+
+    def test_database_jobs_use_narrow_migration_runner(self):
+        for job in ("go-integration", "go-db-pins", "go-db-auth"):
+            command = self.step(job, "Migrate the test database")
+            self.assertIn('DATABASE_URL="$PRAIRIE_TEST_DATABASE_URL"', command)
+            self.assertIn("go run ./scripts/ci/migrate/ --migrate-only", command)
+            self.assertNotIn("SECRET_KEY", command)
+            self.assertNotIn("-race", command)
+
+    def test_weekly_compiled_cache_never_prunes_or_saves(self):
+        source = (REPO_ROOT / ".github/actions/save-go-cache/action.yml").read_text()
+        steps = source.split("    - name: ")[1:]
+        for step in steps[:2]:
+            condition = re.search(r"      if: (.*)", step)[1]
+            self.assertIn("github.event_name != 'schedule'", condition)
+        for step in steps[2:]:
+            self.assertNotIn("github.event_name != 'schedule'", re.search(r"      if: (.*)", step)[1])
+
+    def test_weekly_callers_preserve_module_policy_and_deny_compiled_writes(self):
+        workflow = (REPO_ROOT / ".github/workflows/trusted-linux-ci.yml").read_text()
+        for step in workflow.split("      - name: Save the Go cache\n")[1:]:
+            self.assertIn("github.event_name != 'schedule'", step.splitlines()[0])
+        module = workflow.split("      - name: Save the shared module cache on schedule\n")[1]
+        self.assertIn("github.event_name == 'schedule'", module.splitlines()[0])
+        self.assertIn("module-cache-key:", module.split("\n  go-integration:")[0])
+
+
 if __name__ == "__main__":
+    # The repository CI already runs this entry point for lint helper checks.
+    from test_check_go_lint import CheckGoLintTests
+
     unittest.main()
diff --git a/web/.prettierignore b/web/.prettierignore
index 6c52dbecd8..8edc9584f4 100644
--- a/web/.prettierignore
+++ b/web/.prettierignore
@@ -4,3 +4,6 @@ node_modules
 # Generated by tests; regenerate them rather than reformat.
 src/lib/homeRows/__fixtures__/recipeCatalog.v2.json
 src/lib/homeRows/payloads.golden.json
+
+# Declined: formatting outside web/src (prior sample: 1 file).
+# pnpm exec prettier --check "**/*.{ts,tsx,js,mjs,json,css,md}"
diff --git a/web/eslint-suppressions.json b/web/eslint-suppressions.json
new file mode 100644
index 0000000000..51e1704b9a
--- /dev/null
+++ b/web/eslint-suppressions.json
@@ -0,0 +1,277 @@
+{
+  "src/components/ContinueWatchingCard.tsx": {
+    "react-hooks/preserve-manual-memoization": {
+      "count": 2
+    }
+  },
+  "src/components/GlobalSearch.tsx": {
+    "react-hooks/set-state-in-effect": {
+      "count": 1
+    }
+  },
+  "src/components/ItemGrid.tsx": {
+    "react-hooks/exhaustive-deps": {
+      "count": 2
+    },
+    "react-hooks/set-state-in-effect": {
+      "count": 1
+    }
+  },
+  "src/components/Layout.tsx": {
+    "react-hooks/set-state-in-effect": {
+      "count": 1
+    }
+  },
+  "src/components/MediaItemMenu.tsx": {
+    "react-hooks/set-state-in-effect": {
+      "count": 1
+    }
+  },
+  "src/components/MetadataTranslatePanel.tsx": {
+    "react-hooks/set-state-in-effect": {
+      "count": 1
+    }
+  },
+  "src/components/RealtimeEventsProvider.tsx": {
+    "react-hooks/exhaustive-deps": {
+      "count": 2
+    },
+    "react-hooks/refs": {
+      "count": 3
+    }
+  },
+  "src/components/ServerActivity.tsx": {
+    "react-hooks/set-state-in-effect": {
+      "count": 1
+    }
+  },
+  "src/components/SplitItemDialog.tsx": {
+    "react-hooks/set-state-in-effect": {
+      "count": 1
+    }
+  },
+  "src/components/admin/plugins/PluginConfigForm.tsx": {
+    "react-hooks/set-state-in-effect": {
+      "count": 1
+    }
+  },
+  "src/components/livetv/LiveTVPlayer.tsx": {
+    "react-hooks/set-state-in-effect": {
+      "count": 1
+    }
+  },
+  "src/components/subtitles/SubtitleUploadForm.tsx": {
+    "react-hooks/exhaustive-deps": {
+      "count": 2
+    }
+  },
+  "src/hooks/AuthProvider.sessionRestore.test.tsx": {
+    "no-restricted-syntax": {
+      "count": 1
+    }
+  },
+  "src/hooks/admin/useAdminLogStream.ts": {
+    "react-hooks/set-state-in-effect": {
+      "count": 1
+    }
+  },
+  "src/hooks/queries/admin/nodes.ts": {
+    "no-restricted-syntax": {
+      "count": 2
+    }
+  },
+  "src/hooks/queries/catalog.ts": {
+    "react-hooks/set-state-in-effect": {
+      "count": 2
+    }
+  },
+  "src/hooks/queries/notInterested.test.tsx": {
+    "no-restricted-syntax": {
+      "count": 1
+    }
+  },
+  "src/hooks/queries/useRequests.test.tsx": {
+    "no-restricted-syntax": {
+      "count": 1
+    }
+  },
+  "src/hooks/useIntersectionObserver.ts": {
+    "react-hooks/refs": {
+      "count": 1
+    }
+  },
+  "src/hooks/useOnViewTranslation.ts": {
+    "react-hooks/set-state-in-effect": {
+      "count": 3
+    }
+  },
+  "src/hooks/useTheme.tsx": {
+    "react-hooks/set-state-in-effect": {
+      "count": 1
+    }
+  },
+  "src/pages/AdminCollections.tsx": {
+    "no-restricted-syntax": {
+      "count": 1
+    }
+  },
+  "src/pages/AdminLibraries.tsx": {
+    "react-hooks/exhaustive-deps": {
+      "count": 1
+    }
+  },
+  "src/pages/AdminTasks.tsx": {
+    "react-hooks/set-state-in-effect": {
+      "count": 1
+    }
+  },
+  "src/pages/Catalog.tsx": {
+    "react-hooks/set-state-in-effect": {
+      "count": 1
+    }
+  },
+  "src/pages/LibraryRecommended.tsx": {
+    "react-hooks/set-state-in-effect": {
+      "count": 2
+    }
+  },
+  "src/pages/LiveTV.tsx": {
+    "react-hooks/set-state-in-effect": {
+      "count": 1
+    }
+  },
+  "src/pages/LiveWatchRoute.tsx": {
+    "eslint-comments/require-description": {
+      "count": 1
+    }
+  },
+  "src/pages/audiobooks/player/AudiobookPlayer.tsx": {
+    "react-hooks/refs": {
+      "count": 5
+    }
+  },
+  "src/pages/audiobooks/player/SpeedControl.tsx": {
+    "react-hooks/refs": {
+      "count": 1
+    }
+  },
+  "src/pages/audiobooks/player/audiobookPlaybackContext.tsx": {
+    "react-hooks/set-state-in-effect": {
+      "count": 1
+    }
+  },
+  "src/pages/settings/DeviceSettings.tsx": {
+    "react-hooks/set-state-in-effect": {
+      "count": 1
+    }
+  },
+  "src/pages/settings/HistoryImportSettings.test.tsx": {
+    "no-restricted-syntax": {
+      "count": 1
+    }
+  },
+  "src/pages/settings/QuickConnectSettings.tsx": {
+    "no-restricted-syntax": {
+      "count": 1
+    }
+  },
+  "src/pages/setup-wizard/steps/SubtitlesStep.tsx": {
+    "react-hooks/set-state-in-effect": {
+      "count": 1
+    }
+  },
+  "src/pages/watchtogether/StartPartySheet.tsx": {
+    "react-hooks/exhaustive-deps": {
+      "count": 1
+    },
+    "react-hooks/set-state-in-effect": {
+      "count": 1
+    }
+  },
+  "src/pages/watchtogether/hooks/useRecentRooms.ts": {
+    "react-hooks/set-state-in-effect": {
+      "count": 1
+    }
+  },
+  "src/pages/watchtogether/room/browse/BrowseShelf.test.tsx": {
+    "no-restricted-syntax": {
+      "count": 2
+    }
+  },
+  "src/pages/watchtogether/room/picker/SeriesDrilldown.tsx": {
+    "react-hooks/set-state-in-effect": {
+      "count": 1
+    }
+  },
+  "src/playback/WatchPlaybackChrome.tsx": {
+    "react-hooks/set-state-in-effect": {
+      "count": 2
+    }
+  },
+  "src/player/components/AudioTrackMenu.tsx": {
+    "react-hooks/exhaustive-deps": {
+      "count": 4
+    },
+    "react-hooks/preserve-manual-memoization": {
+      "count": 3
+    }
+  },
+  "src/player/components/ChaptersMenu.tsx": {
+    "react-hooks/exhaustive-deps": {
+      "count": 3
+    },
+    "react-hooks/preserve-manual-memoization": {
+      "count": 2
+    }
+  },
+  "src/player/components/PlayerMoreMenu.tsx": {
+    "react-hooks/set-state-in-effect": {
+      "count": 1
+    }
+  },
+  "src/player/components/PlayingNextScreen.tsx": {
+    "react-hooks/set-state-in-effect": {
+      "count": 1
+    }
+  },
+  "src/player/components/SubtitleSearchModal.tsx": {
+    "react-hooks/exhaustive-deps": {
+      "count": 1
+    }
+  },
+  "src/player/components/SubtitleTranslateModal.tsx": {
+    "react-hooks/exhaustive-deps": {
+      "count": 1
+    }
+  },
+  "src/player/components/VideoPlayer.tsx": {
+    "react-hooks/exhaustive-deps": {
+      "count": 1
+    }
+  },
+  "src/player/hooks/useASSSubtitles.test.tsx": {
+    "no-restricted-syntax": {
+      "count": 3
+    }
+  },
+  "src/player/hooks/useNextEpisode.ts": {
+    "react-hooks/set-state-in-effect": {
+      "count": 1
+    }
+  },
+  "src/player/hooks/usePGSSubtitles.ts": {
+    "react-hooks/refs": {
+      "count": 4
+    }
+  },
+  "src/player/hooks/useQualityLadder.ts": {
+    "react-hooks/set-state-in-effect": {
+      "count": 1
+    }
+  },
+  "src/player/hooks/useWatchProgress.ts": {
+    "react-hooks/refs": {
+      "count": 1
+    }
+  }
+}
\ No newline at end of file
diff --git a/web/eslint.config.js b/web/eslint.config.js
index 6d04da9635..f56021ec40 100644
--- a/web/eslint.config.js
+++ b/web/eslint.config.js
@@ -3,15 +3,21 @@ import tseslint from "typescript-eslint";
 import reactHooks from "eslint-plugin-react-hooks";
 import reactRefresh from "eslint-plugin-react-refresh";
 import eslintConfigPrettier from "eslint-config-prettier";
+import eslintComments from "@eslint-community/eslint-plugin-eslint-comments";
 
 export default tseslint.config(
   { ignores: ["dist"] },
   {
     extends: [js.configs.recommended, ...tseslint.configs.recommended],
     files: ["**/*.{ts,tsx}"],
+    // Typed rules below need this block; their trials remain disabled.
+    // languageOptions: {
+    //   parserOptions: { projectService: true, tsconfigRootDir: import.meta.dirname },
+    // },
     plugins: {
       "react-hooks": reactHooks,
       "react-refresh": reactRefresh,
+      "eslint-comments": eslintComments,
     },
     rules: {
       ...reactHooks.configs.recommended.rules,
@@ -25,58 +31,51 @@ export default tseslint.config(
         "error",
         { allowInterfaces: "with-single-extends" },
       ],
-      // New react-hooks v7 rules — warn for now, tighten later.
-      "react-hooks/exhaustive-deps": "warn",
+      "eslint-comments/require-description": "error",
+      "@typescript-eslint/adjacent-overload-signatures": "error",
+      "@typescript-eslint/ban-tslint-comment": "error",
+      "@typescript-eslint/class-literal-property-style": "error",
+      "@typescript-eslint/consistent-type-assertions": "error",
+      "@typescript-eslint/no-confusing-non-null-assertion": "error",
+      "@typescript-eslint/no-inferrable-types": "error",
+      "@typescript-eslint/no-non-null-asserted-nullish-coalescing": "error",
+      "@typescript-eslint/prefer-function-type": "error",
+      "@typescript-eslint/prefer-literal-enum-member": "error",
+      "@typescript-eslint/unified-signatures": "error",
+      // "@typescript-eslint/array-type": "error", // Disabled: 265 full-tree findings.
+      // "@typescript-eslint/consistent-generic-constructors": "error", // Disabled: 5 full-tree findings.
+      // "@typescript-eslint/consistent-indexed-object-style": "error", // Disabled: 9189 full-tree findings.
+      // "@typescript-eslint/consistent-type-definitions": "error", // Disabled: 142 full-tree findings.
+      // "@typescript-eslint/no-dynamic-delete": "error", // Disabled: 16 full-tree findings.
+      // "@typescript-eslint/no-empty-function": "error", // Disabled: 706 full-tree findings.
+      // "@typescript-eslint/no-extraneous-class": "error", // Disabled: 1 full-tree findings.
+      // "@typescript-eslint/no-invalid-void-type": "error", // Disabled: 11 full-tree findings.
+      // "@typescript-eslint/no-non-null-assertion": "error", // Disabled: 1736 full-tree findings.
+      // "@typescript-eslint/no-useless-constructor": "error", // Disabled: 2 full-tree findings.
+      // "@typescript-eslint/prefer-for-of": "error", // Disabled: 1 full-tree findings.
+      // Typed rules: not enrolled; prior measurements below, no new cost campaign.
+      // "@typescript-eslint/no-floating-promises": ["error", { ignoreVoid: true }], // TEST: 199 production; ignoreVoid false: 519.
+      // "@typescript-eslint/no-misused-promises": ["error", { checksVoidReturn: true }], // TEST: 135 production; JSX attributes off: 6.
+      // "@typescript-eslint/await-thenable": "error", // TEST: 2 production.
+      // Unsafe group: prior production/all counts 26/170, 9/330, 10/2510, 4/418; origins need review.
+      // "@typescript-eslint/no-unsafe-argument": "error", // TEST: prior group counts above.
+      // "@typescript-eslint/no-unsafe-assignment": "error", // TEST: prior group counts above.
+      // "@typescript-eslint/no-unsafe-call": "error", // TEST: prior group counts above.
+      // "@typescript-eslint/no-unsafe-member-access": "error", // TEST: prior group counts above.
+      // "@typescript-eslint/no-unsafe-return": "error", // TEST: prior group counts above.
+      // "@typescript-eslint/switch-exhaustiveness-check": "error", // TEST: 6 production / 56 all.
+      // "@typescript-eslint/no-unnecessary-condition": "error", // Declined: 663 production findings.
+      // Other large typed style rules: declined; prior counts 436, 223, 663, 261.
+      "react-hooks/exhaustive-deps": "error",
       "react-hooks/rules-of-hooks": "error",
-      "react-hooks/set-state-in-effect": "warn",
-      "react-hooks/refs": "warn",
-      "react-hooks/preserve-manual-memoization": "warn",
+      "react-hooks/set-state-in-effect": "error",
+      "react-hooks/refs": "error",
+      "react-hooks/preserve-manual-memoization": "error",
     },
   },
   {
-    // Files on the v2 contract: every request goes through the typed boundary
-    // (src/api/v2/request.ts), so the shape is inferred from the generated
-    // spec rather than asserted at the call site. Extend the list as call
-    // sites migrate; never remove an entry.
-    files: [
-      "src/api/v2/**/*.{ts,tsx}",
-      "src/hooks/useAuth.tsx",
-      "src/hooks/queries/progress.ts",
-      "src/hooks/queries/history.ts",
-      "src/hooks/queries/profiles.ts",
-      "src/hooks/queries/admin/users.ts",
-      "src/hooks/queries/admin/libraries.ts",
-      "src/hooks/queries/libraryCollections.ts",
-      "src/hooks/queries/calendar.ts",
-      "src/hooks/queries/homeDismissals.ts",
-      "src/hooks/queries/favorites.ts",
-      "src/hooks/queries/watchlist.ts",
-      "src/hooks/queries/ratings.ts",
-      "src/hooks/queries/autoPlayNext.ts",
-      "src/hooks/queries/libraryPageState.ts",
-      "src/hooks/queries/pluginSettings.ts",
-      "src/hooks/queries/profileDefaults.ts",
-      "src/hooks/queries/settingValues.ts",
-      "src/hooks/queries/subtitleAppearance.ts",
-      "src/hooks/useOverlayPrefs.ts",
-      "src/lib/profile-management.ts",
-      "src/lib/seriesSubtitleSettings.ts",
-      "src/pages/OAuthComplete.tsx",
-      "src/hooks/queries/recommendations.ts",
-      "src/hooks/queries/tasteSeed.ts",
-      "src/pages/Recommendations.tsx",
-      "src/pages/RecommendationsSection.tsx",
-      "src/components/RecommendationGrid.tsx",
-      "src/pages/setup-wizard/steps/ProfileStep.tsx",
-      "src/player/utils/subtitleChoicePersistence.ts",
-      "src/hooks/queries/catalogRead.ts",
-      "src/hooks/queries/catalog.ts",
-      "src/hooks/queries/audiobookGroups.ts",
-      "src/hooks/queries/people.ts",
-      "src/hooks/queries/metadataAI.ts",
-      "src/hooks/useOnViewTranslation.ts",
-      "src/pages/PersonDetail.tsx",
-    ],
+    // Requests infer their shape through the generated v2 contract.
+    files: ["**/*.{ts,tsx}"],
     rules: {
       "no-restricted-syntax": [
         "error",
diff --git a/web/package.json b/web/package.json
index 79c328062a..29f39e8e5b 100644
--- a/web/package.json
+++ b/web/package.json
@@ -13,6 +13,7 @@
     "preview": "vite preview",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
+    "lint:prune": "eslint . --prune-suppressions",
     "format": "prettier --write \"src/**/*.{ts,tsx,css}\"",
     "format:check": "prettier --check \"src/**/*.{ts,tsx,css}\"",
     "generate:apiv2": "node scripts/generate-apiv2.mjs"
@@ -26,10 +27,7 @@
     "@dnd-kit/sortable": "^10.0.0",
     "@dnd-kit/utilities": "^3.2.2",
     "@fontsource-variable/fraunces": "^5.3.0",
-    "@fontsource-variable/manrope": "^5.3.0",
-    "@fontsource-variable/outfit": "^5.3.0",
-    "@fontsource-variable/sora": "^5.3.0",
-    "@fontsource-variable/urbanist": "^5.3.0",
+    "@fontsource-variable/plus-jakarta-sans": "^5.3.0",
     "@fontsource/noto-sans-arabic": "^5.2.10",
     "@fontsource/noto-sans-thai": "^5.2.8",
     "@formatjs/intl-displaynames": "^7.3.13",
@@ -48,6 +46,7 @@
     "hls.js": "^1.6.15",
     "jassub": "^2.5.6",
     "lucide-react": "^0.577.0",
+    "mediabunny": "^1.61.0",
     "node-unrar-js": "^2.0.2",
     "pdfjs-dist": "^6.2.108",
     "radix-ui": "^1.4.3",
@@ -61,6 +60,7 @@
     "thumbhash": "^0.1.1"
   },
   "devDependencies": {
+    "@eslint-community/eslint-plugin-eslint-comments": "4.8.1",
     "@eslint/js": "^9.39.4",
     "@tailwindcss/vite": "^4.0.0",
     "@testing-library/jest-dom": "^6.9.1",
@@ -71,6 +71,7 @@
     "@types/react-dom": "^19.0.0",
     "@vitejs/plugin-react": "^4.4.0",
     "@vitest/coverage-v8": "^4.1.0",
+    "@webgpu/types": "^0.1.74",
     "eslint": "^9.39.4",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-react-hooks": "^7.0.1",
diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml
index 51521185fe..7a78919e24 100644
--- a/web/pnpm-lock.yaml
+++ b/web/pnpm-lock.yaml
@@ -22,61 +22,52 @@ importers:
     dependencies:
       '@codemirror/language':
         specifier: ^6.12.4
-        version: 6.13.1
+        version: 6.12.4
       '@codemirror/lint':
         specifier: ^6.9.7
         version: 6.9.7
       '@codemirror/state':
         specifier: ^6.7.0
-        version: 6.7.6
+        version: 6.7.0
       '@codemirror/view':
         specifier: ^6.43.4
-        version: 6.43.14
+        version: 6.43.4
       '@dnd-kit/core':
         specifier: ^6.3.1
-        version: 6.3.1(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+        version: 6.3.1(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
       '@dnd-kit/sortable':
         specifier: ^10.0.0
-        version: 10.0.0(@dnd-kit/core@6.3.1(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react@19.3.0)
+        version: 10.0.0(@dnd-kit/core@6.3.1(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react@19.2.4)
       '@dnd-kit/utilities':
         specifier: ^3.2.2
-        version: 3.2.2(react@19.3.0)
+        version: 3.2.2(react@19.2.4)
       '@fontsource-variable/fraunces':
         specifier: ^5.3.0
         version: 5.3.0
-      '@fontsource-variable/manrope':
-        specifier: ^5.3.0
-        version: 5.3.0
-      '@fontsource-variable/outfit':
-        specifier: ^5.3.0
-        version: 5.3.0
-      '@fontsource-variable/sora':
-        specifier: ^5.3.0
-        version: 5.3.0
-      '@fontsource-variable/urbanist':
+      '@fontsource-variable/plus-jakarta-sans':
         specifier: ^5.3.0
         version: 5.3.0
       '@fontsource/noto-sans-arabic':
         specifier: ^5.2.10
-        version: 5.3.0
+        version: 5.2.10
       '@fontsource/noto-sans-thai':
         specifier: ^5.2.8
-        version: 5.3.0
+        version: 5.2.8
       '@formatjs/intl-displaynames':
         specifier: ^7.3.13
-        version: 7.3.15
+        version: 7.3.13
       '@tanstack/react-query':
         specifier: ^5.90.21
-        version: 5.104.2(react@19.3.0)
+        version: 5.90.21(react@19.2.4)
       '@tanstack/react-virtual':
         specifier: ^3.13.19
-        version: 3.14.17(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+        version: 3.13.22(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
       '@uiw/react-codemirror':
         specifier: ^4.25.10
-        version: 4.25.12(@babel/runtime@7.29.10)(@codemirror/autocomplete@6.20.3)(@codemirror/language@6.13.1)(@codemirror/lint@6.9.7)(@codemirror/search@6.7.1)(@codemirror/state@6.7.6)(@codemirror/theme-one-dark@6.1.3)(@codemirror/view@6.43.14)(codemirror@6.0.2)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+        version: 4.25.10(@babel/runtime@7.29.7)(@codemirror/autocomplete@6.20.3)(@codemirror/language@6.12.4)(@codemirror/lint@6.9.7)(@codemirror/search@6.7.1)(@codemirror/state@6.7.0)(@codemirror/theme-one-dark@6.1.3)(@codemirror/view@6.43.4)(codemirror@6.0.2)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
       '@zip.js/zip.js':
         specifier: ^2.8.26
-        version: 2.23.0
+        version: 2.8.26
       class-variance-authority:
         specifier: ^0.7.1
         version: 0.7.1
@@ -88,7 +79,7 @@ importers:
         version: 8.6.0
       embla-carousel-react:
         specifier: ^8.6.0
-        version: 8.6.0(react@19.3.0)
+        version: 8.6.0(react@19.2.4)
       embla-carousel-wheel-gestures:
         specifier: ^8.1.0
         version: 8.1.0(embla-carousel@8.6.0)
@@ -97,16 +88,19 @@ importers:
         version: file:vendor/foliate-js
       hls.js:
         specifier: ^1.6.15
-        version: 1.7.3
+        version: 1.6.15
       jassub:
         specifier: ^2.5.6
-        version: 2.5.20
+        version: 2.5.6
       lucide-react:
         specifier: ^0.577.0
-        version: 0.577.0(react@19.3.0)
+        version: 0.577.0(react@19.2.4)
+      mediabunny:
+        specifier: ^1.61.0
+        version: 1.61.0
       motion:
         specifier: ^12.38.0
-        version: 12.43.0(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+        version: 12.43.0(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
       mpegts.js:
         specifier: ^1.8.0
         version: 1.8.2
@@ -115,120 +109,122 @@ importers:
         version: 2.0.2
       pdfjs-dist:
         specifier: ^6.2.108
-        version: 6.4.299
+        version: 6.2.108
       radix-ui:
         specifier: ^1.4.3
-        version: 1.8.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+        version: 1.4.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
       react:
         specifier: ^19.0.0
-        version: 19.3.0
+        version: 19.2.4
       react-day-picker:
         specifier: ^10.0.1
-        version: 10.0.2(@types/react@19.3.0)(react@19.3.0)
+        version: 10.0.1(@types/react@19.2.14)(react@19.2.4)
       react-dom:
         specifier: ^19.0.0
-        version: 19.3.0(react@19.3.0)
+        version: 19.2.4(react@19.2.4)
       react-qr-code:
         specifier: ^2.0.18
-        version: 2.2.0(react@19.3.0)
+        version: 2.0.18(react@19.2.4)
       react-router:
         specifier: ^8.3.0
-        version: 8.4.0(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+        version: 8.3.0(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
       sonner:
         specifier: ^2.0.7
-        version: 2.0.8(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+        version: 2.0.7(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
       tailwind-merge:
         specifier: ^3.5.0
-        version: 3.7.0
+        version: 3.5.0
       thumbhash:
         specifier: ^0.1.1
         version: 0.1.1
     devDependencies:
+      '@eslint-community/eslint-plugin-eslint-comments':
+        specifier: 4.8.1
+        version: 4.8.1(eslint@9.39.4(jiti@2.6.1))
       '@eslint/js':
         specifier: ^9.39.4
-        version: 9.39.5
+        version: 9.39.4
       '@tailwindcss/vite':
         specifier: ^4.0.0
-        version: 4.3.3(vite@6.4.4(@types/node@25.9.9)(jiti@2.7.0)(lightningcss@1.32.0))
+        version: 4.2.1(vite@6.4.3(@types/node@25.5.0)(jiti@2.6.1)(lightningcss@1.32.0))
       '@testing-library/jest-dom':
         specifier: ^6.9.1
         version: 6.9.1
       '@testing-library/react':
         specifier: ^16.3.2
-        version: 16.3.3(@testing-library/dom@10.4.1)(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+        version: 16.3.2(@testing-library/dom@10.4.1)(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
       '@testing-library/user-event':
         specifier: ^14.6.1
-        version: 14.6.7(@testing-library/dom@10.4.1)
+        version: 14.6.1(@testing-library/dom@10.4.1)
       '@types/node':
         specifier: ^25.3.3
-        version: 25.9.9
+        version: 25.5.0
       '@types/react':
         specifier: ^19.0.0
-        version: 19.3.0
+        version: 19.2.14
       '@types/react-dom':
         specifier: ^19.0.0
-        version: 19.3.0(@types/react@19.3.0)
+        version: 19.2.3(@types/react@19.2.14)
       '@vitejs/plugin-react':
         specifier: ^4.4.0
-        version: 4.7.0(vite@6.4.4(@types/node@25.9.9)(jiti@2.7.0)(lightningcss@1.32.0))
+        version: 4.7.0(vite@6.4.3(@types/node@25.5.0)(jiti@2.6.1)(lightningcss@1.32.0))
       '@vitest/coverage-v8':
         specifier: ^4.1.0
-        version: 4.1.11(vitest@4.1.11)
+        version: 4.1.12(vitest@4.1.11)
+      '@webgpu/types':
+        specifier: ^0.1.74
+        version: 0.1.74
       eslint:
         specifier: ^9.39.4
-        version: 9.39.5(jiti@2.7.0)
+        version: 9.39.4(jiti@2.6.1)
       eslint-config-prettier:
         specifier: ^10.1.8
-        version: 10.1.8(eslint@9.39.5(jiti@2.7.0))
+        version: 10.1.8(eslint@9.39.4(jiti@2.6.1))
       eslint-plugin-react-hooks:
         specifier: ^7.0.1
-        version: 7.1.1(eslint@9.39.5(jiti@2.7.0))
+        version: 7.0.1(eslint@9.39.4(jiti@2.6.1))
       eslint-plugin-react-refresh:
         specifier: ^0.5.2
-        version: 0.5.7(eslint@9.39.5(jiti@2.7.0))
+        version: 0.5.2(eslint@9.39.4(jiti@2.6.1))
       jsdom:
         specifier: ^29.0.1
-        version: 29.1.1
+        version: 29.0.1
       openapi-typescript:
         specifier: 7.13.0
         version: 7.13.0(typescript@5.9.3)
       prettier:
         specifier: ^3.8.1
-        version: 3.8.5
+        version: 3.8.1
       prettier-plugin-tailwindcss:
         specifier: ^0.8.0
-        version: 0.8.1(prettier@3.8.5)
+        version: 0.8.1(prettier@3.8.1)
       tailwindcss:
         specifier: ^4.0.0
-        version: 4.3.3
+        version: 4.2.1
       typescript:
         specifier: ^5.7.0
         version: 5.9.3
       typescript-eslint:
         specifier: ^8.57.0
-        version: 8.71.2(eslint@9.39.5(jiti@2.7.0))(typescript@5.9.3)
+        version: 8.57.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.9.3)
       vite:
         specifier: ^6.4.3
-        version: 6.4.4(@types/node@25.9.9)(jiti@2.7.0)(lightningcss@1.32.0)
+        version: 6.4.3(@types/node@25.5.0)(jiti@2.6.1)(lightningcss@1.32.0)
       vitest:
         specifier: ^4.1.11
-        version: 4.1.11(@types/node@25.9.9)(@vitest/coverage-v8@4.1.11)(jsdom@29.1.1)(vite@6.4.4(@types/node@25.9.9)(jiti@2.7.0)(lightningcss@1.32.0))
+        version: 4.1.11(@types/node@25.5.0)(@vitest/coverage-v8@4.1.12)(jsdom@29.0.1)(vite@6.4.3(@types/node@25.5.0)(jiti@2.6.1)(lightningcss@1.32.0))
 
 packages:
 
   '@adobe/css-tools@4.4.4':
     resolution: {integrity: sha512-Elp+iwUx5rN5+Y8xLt5/GRoG20WGoDCQ/1Fb+1LiGtvwbDavuSk0jhD/eZdckHAuzcDzccnkv+rEjyWfRx18gg==}
 
-  '@asamuzakjp/css-color@5.1.11':
-    resolution: {integrity: sha512-KVw6qIiCTUQhByfTd78h2yD1/00waTmm9uy/R7Ck/ctUyAPj+AEDLkQIdJW0T8+qGgj3j5bpNKK7Q3G+LedJWg==}
-    engines: {node: ^20.19.0 || ^22.12.0 || >=24.0.0}
-
-  '@asamuzakjp/dom-selector@7.1.1':
-    resolution: {integrity: sha512-67RZDnYRc8H/8MLDgQCDE//zoqVFwajkepHZgmXrbwybzXOEwOWGPYGmALYl9J2DOLfFPPs6kKCqmbzV895hTQ==}
+  '@asamuzakjp/css-color@5.1.6':
+    resolution: {integrity: sha512-BXWCh8dHs9GOfpo/fWGDJtDmleta2VePN9rn6WQt3GjEbxzutVF4t0x2pmH+7dbMCLtuv3MlwqRsAuxlzFXqFg==}
     engines: {node: ^20.19.0 || ^22.12.0 || >=24.0.0}
 
-  '@asamuzakjp/generational-cache@1.0.1':
-    resolution: {integrity: sha512-wajfB8KqzMCN2KGNFdLkReeHncd0AslUSrvHVvvYWuU8ghncRJoA50kT3zP9MVL0+9g4/67H+cdvBskj9THPzg==}
+  '@asamuzakjp/dom-selector@7.0.7':
+    resolution: {integrity: sha512-d2BgqDUOS1Hfp4IzKUZqCNz+Kg3Y88AkaBvJK/ZVSQPU1f7OpPNi7nQTH6/oI47Dkdg+Z3e8Yp6ynOu4UMINAQ==}
     engines: {node: ^20.19.0 || ^22.12.0 || >=24.0.0}
 
   '@asamuzakjp/nwsapi@2.3.9':
@@ -246,6 +242,10 @@ packages:
     resolution: {integrity: sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==}
     engines: {node: '>=6.9.0'}
 
+  '@babel/generator@7.29.7':
+    resolution: {integrity: sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ==}
+    engines: {node: '>=6.9.0'}
+
   '@babel/generator@7.29.8':
     resolution: {integrity: sha512-gZbepsdh3WDtgZKWL+vTPh71LSBrm/Y4/QDZBVCcYfmeTEEuoOYwlSy+G1StfJg+/Zy550u/3TATbm7qDbbMtg==}
     engines: {node: '>=6.9.0'}
@@ -292,8 +292,8 @@ packages:
     resolution: {integrity: sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/helpers@7.29.10':
-    resolution: {integrity: sha512-EMCx3AGZ3WfAl6ht7AyQoPm2Lh+BGYEMdc4Q6Hf7uSCDOZFuLq44qNwL+iaim8VlyYhRAo4X43+weadK8ZB4Yg==}
+  '@babel/helpers@7.29.7':
+    resolution: {integrity: sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==}
     engines: {node: '>=6.9.0'}
 
   '@babel/parser@7.29.0':
@@ -323,8 +323,12 @@ packages:
     peerDependencies:
       '@babel/core': 7.29.7
 
-  '@babel/runtime@7.29.10':
-    resolution: {integrity: sha512-NpugTzbKgGrNe45Ui32cN8vCFFMxVtP/9rtfwv0nP5FRDAjvYBxJcLVpYA9mr1jxP6cnIT7x9LUzuDTbWYYNRA==}
+  '@babel/runtime@7.29.2':
+    resolution: {integrity: sha512-JiDShH45zKHWyGe4ZNVRrCjBz8Nh9TMmZG1kh4QTK8hCBTWBi8Da+i7s1fJw7/lYpM4ccepSNfqzZ/QvABBi5g==}
+    engines: {node: '>=6.9.0'}
+
+  '@babel/runtime@7.29.7':
+    resolution: {integrity: sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw==}
     engines: {node: '>=6.9.0'}
 
   '@babel/template@7.29.7':
@@ -351,18 +355,21 @@ packages:
     resolution: {integrity: sha512-6zABk/ECA/QYSCQ1NGiVwwbQerUCZ+TQbp64Q3AgmfNvurHH0j8TtXa1qbShXA6qqkpAj4V5W8pP6mLe1mcMqA==}
     engines: {node: '>=18'}
 
-  '@bramus/specificity@2.4.3':
-    resolution: {integrity: sha512-0GEz8qJWokkUVYQYRukmkSHIFNoBH8QTreeHrAFbvz1XFYc3Y+puhMs8PQ5x8GNugiC2l5jvDBXKLbBIByeSBw==}
+  '@bramus/specificity@2.4.2':
+    resolution: {integrity: sha512-ctxtJ/eA+t+6q2++vj5j7FYX3nRu311q1wfYH3xjlLOsczhlhxAg2FWNUXhpGvAw3BWo1xBcvOV6/YLc2r5FJw==}
     hasBin: true
 
   '@codemirror/autocomplete@6.20.3':
     resolution: {integrity: sha512-tlosUqb+3BbxCxZdu4tKeRghPFC+QM7q4X5YhKV2eCmPG+1r2F3f4AaSz5sCrFqUtX4Jh20VFTKecl16MgiV9g==}
 
-  '@codemirror/commands@6.11.1':
-    resolution: {integrity: sha512-O/4hG3SC1YwcmQ0d2UVNDs+AsaNWd1iHVxbTeEBuqH+6bExAiPK3iS/BvpY6rZGURALv4ZD3sIgcCmRvw3ehBg==}
+  '@codemirror/commands@6.10.4':
+    resolution: {integrity: sha512-Ryk9y9T0FFVF0cUGhAknveAyUOl/A1qReTFi+qPKtOh2Z9F4AUBz3XOrYD4ZEgZirdugVzHvd/2/Wcwy5OliTg==}
+
+  '@codemirror/commands@6.11.0':
+    resolution: {integrity: sha512-/K4Rl5BN0OtTiPWmJCdqODu38XnDMsDxKY5rgrPnCkutPTJf2wVbkoixLfealF5Kwse/s8P8M5jAiURiwSwnFA==}
 
-  '@codemirror/language@6.13.1':
-    resolution: {integrity: sha512-zfvU2r3TyylQLMj/te+5CnQ0rSqZi8B1oTCBbQkagcLW4Xc6imab6qN+pEJhsuNOLaJqiRyBXp9UhWA1DhVvDw==}
+  '@codemirror/language@6.12.4':
+    resolution: {integrity: sha512-1q4PaT+o6PbgpkJt4Q8Fv5XJxTy4FUZ4MWETtyiDw3J0Pyr9E2vqcKL+k9wcvjNTIsauxvE7OfmWj3FRPHQ76A==}
 
   '@codemirror/lint@6.9.7':
     resolution: {integrity: sha512-28/+iWLYxKxsvGYhSYL7zaCZqLz5+FFFDq9tVsvGv9kv8RY4fFAchJ5WX9M3YrrRlTIsECjsXPqeNgnSmNP2dg==}
@@ -370,52 +377,55 @@ packages:
   '@codemirror/search@6.7.1':
     resolution: {integrity: sha512-uMe5UO6PamJtSHrXhhHOzSX3ReWtiJrva6GnPMwSOrZtiExb5X5eExhr2OUZQVvdxPsKpY3Ro2mFbQadpPWmHA==}
 
-  '@codemirror/state@6.7.6':
-    resolution: {integrity: sha512-kAz+AncRtKuIknedxT1bq4XwXv4UowhbkHU1myPrtVb/jZtImWuV5BXzv5vK6i3kYACsdiZiQKFQQ5Mq7elW8w==}
+  '@codemirror/state@6.7.0':
+    resolution: {integrity: sha512-Zbl9NyscLMZkfXPQnNAIIAFftidrA1UbcJEIMp24C0Bukc2I5T8wJS0wsXYsnDOqCFJUeJ1BITGNs5CqPDSmSg==}
 
-  '@codemirror/streamparser@6.0.0':
-    resolution: {integrity: sha512-JTFPF6xrfjt0mnfGPgzcLiMwYmvIyNaoizp8BYzv8FE8KrT6GBGDZ190rtt+O7Wke3gG/MFHyiY9YGNeimof4w==}
+  '@codemirror/state@6.7.4':
+    resolution: {integrity: sha512-QhQIVRY+xHZDxwOSFrJ1eUMapJBUID3IdeAjf7dHO7zBUzSkyooHiodnalz5MG3iHzwixKMlAAyn7244y537EA==}
 
   '@codemirror/theme-one-dark@6.1.3':
     resolution: {integrity: sha512-NzBdIvEJmx6fjeremiGp3t/okrLPYT0d9orIc7AFun8oZcRk58aejkqhv6spnz4MLAevrKNPMQYXEWMg4s+sKA==}
 
-  '@codemirror/view@6.43.14':
-    resolution: {integrity: sha512-hC45YnmJNR1rz42OF57BLoQNFMV12/13drnvibDsR2quNDmldcb4WvYVV81hFQg56i9lcqQMEDqilhX2QDcGQQ==}
+  '@codemirror/view@6.43.11':
+    resolution: {integrity: sha512-2+esucbQX6wB2JYi1eDvdCPFTA31BN8oSy6xCmk3G6CloV11yOvEjYk+gH7kLrP0MuHG94E8WDhjs5oMiu3+Wg==}
+
+  '@codemirror/view@6.43.4':
+    resolution: {integrity: sha512-YImu23iyKfncJzT7sRy+rEqEhSc8RhOHqDxwy4WzXRKJwYm6iwf/9OJk5ctCAdZ6yi2ZqaGEvmf55fSVqMDrgg==}
 
-  '@csstools/color-helpers@6.1.2':
-    resolution: {integrity: sha512-grhRy3OKmniaAEKXMjua5z/EODX0MSqBGjunw8+j/3HQjOnahs2AGhvEOIYVUWcU6ScApbhLhVrQTX8XqrMrow==}
+  '@csstools/color-helpers@6.0.2':
+    resolution: {integrity: sha512-LMGQLS9EuADloEFkcTBR3BwV/CGHV7zyDxVRtVDTwdI2Ca4it0CCVTT9wCkxSgokjE5Ho41hEPgb8OEUwoXr6Q==}
     engines: {node: '>=20.19.0'}
 
-  '@csstools/css-calc@3.4.3':
-    resolution: {integrity: sha512-iex20d8CHVkyvg6B7UKV7uHnI2Bqo9g+EFfT9E0y+GvTvhZ/DwONJ+9aKb1dlqm0ZiGsL5RXjp0fCoJYnkeDjA==}
+  '@csstools/css-calc@3.1.1':
+    resolution: {integrity: sha512-HJ26Z/vmsZQqs/o3a6bgKslXGFAungXGbinULZO3eMsOyNJHeBBZfup5FiZInOghgoM4Hwnmw+OgbJCNg1wwUQ==}
     engines: {node: '>=20.19.0'}
     peerDependencies:
-      '@csstools/css-parser-algorithms': ^4.0.2
-      '@csstools/css-tokenizer': ^4.0.2
+      '@csstools/css-parser-algorithms': ^4.0.0
+      '@csstools/css-tokenizer': ^4.0.0
 
-  '@csstools/css-color-parser@4.2.6':
-    resolution: {integrity: sha512-iiPQ3iRWwnJkeEn6RIu6SJPr7hYrLz6XZ9s/QZl+2/LI5KQVjpl2fdmDSZKuD4xP6GMmMPgHFFXg6k1Wkz0Trg==}
+  '@csstools/css-color-parser@4.0.2':
+    resolution: {integrity: sha512-0GEfbBLmTFf0dJlpsNU7zwxRIH0/BGEMuXLTCvFYxuL1tNhqzTbtnFICyJLTNK4a+RechKP75e7w42ClXSnJQw==}
     engines: {node: '>=20.19.0'}
     peerDependencies:
-      '@csstools/css-parser-algorithms': ^4.0.2
-      '@csstools/css-tokenizer': ^4.0.2
+      '@csstools/css-parser-algorithms': ^4.0.0
+      '@csstools/css-tokenizer': ^4.0.0
 
-  '@csstools/css-parser-algorithms@4.0.2':
-    resolution: {integrity: sha512-40cSKyMvK+tq4qz6Awrlye2WGuOKt3FwPgtGg6KTfbHOWNw+Rk1rzbAtZnZ6IBhsY491HLRnDXwoyBAijmmILA==}
+  '@csstools/css-parser-algorithms@4.0.0':
+    resolution: {integrity: sha512-+B87qS7fIG3L5h3qwJ/IFbjoVoOe/bpOdh9hAjXbvx0o8ImEmUsGXN0inFOnk2ChCFgqkkGFQ+TpM5rbhkKe4w==}
     engines: {node: '>=20.19.0'}
     peerDependencies:
-      '@csstools/css-tokenizer': ^4.0.2
+      '@csstools/css-tokenizer': ^4.0.0
 
-  '@csstools/css-syntax-patches-for-csstree@1.1.15':
-    resolution: {integrity: sha512-J0u7HkVl2nzSlhsiTOp4AmwcUQ3D+mGEEKfBy/7To5/y7F2OHwyLrXfrhR0SMgr4p5Lo+eaMVSeai24zUcBIxA==}
+  '@csstools/css-syntax-patches-for-csstree@1.1.2':
+    resolution: {integrity: sha512-5GkLzz4prTIpoyeUiIu3iV6CSG3Plo7xRVOFPKI7FVEJ3mZ0A8SwK0XU3Gl7xAkiQ+mDyam+NNp875/C5y+jSA==}
     peerDependencies:
       css-tree: ^3.2.1
     peerDependenciesMeta:
       css-tree:
         optional: true
 
-  '@csstools/css-tokenizer@4.0.2':
-    resolution: {integrity: sha512-OoKoR0f76dCY666JlcbhmVTs2drYj1GUXZTYTcbUgJjh9Nv41aFfZ21bPQTERm5+L5cBDo466NltB2lplS5GBw==}
+  '@csstools/css-tokenizer@4.0.0':
+    resolution: {integrity: sha512-QxULHAm7cNu72w97JUNCBFODFaXpbDg+dP8b/oWFAZ2MTRppA3U00Y2L1HqaS4J6yBqxwa/Y3nMBaxVKbB/NsA==}
     engines: {node: '>=20.19.0'}
 
   '@date-fns/tz@1.5.0':
@@ -599,8 +609,14 @@ packages:
     cpu: [x64]
     os: [win32]
 
-  '@eslint-community/eslint-utils@4.10.1':
-    resolution: {integrity: sha512-cuadcxVFE8sDK6iWJbs8Sn0av2Nrh2QSGQhVlBW9AaAHqHwjWsZHT8LJ4hFGPh7ASBV2deFdM7H/DPjulmh8rg==}
+  '@eslint-community/eslint-plugin-eslint-comments@4.8.1':
+    resolution: {integrity: sha512-vafrdi15JHBFh1qWOAucyJwlEEuhdoMof28jOdKdgnwZ7bXwd6v4wzHYSmAVLwnx0yc7bqAtfJ0EZQV1WAzV/Q==}
+    engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
+    peerDependencies:
+      eslint: ^6.0.0 || ^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0
+
+  '@eslint-community/eslint-utils@4.9.1':
+    resolution: {integrity: sha512-phrYmNiYppR7znFEdqgfWHXR6NCkZEK7hwWDHZUjit/2/U0r6XvkDl0SYnoM51Hq7FhCGdLDT6zxCCOY1hexsQ==}
     engines: {node: ^12.22.0 || ^14.17.0 || >=16.0.0}
     peerDependencies:
       eslint: ^6.0.0 || ^7.0.0 || >=8.0.0
@@ -621,12 +637,12 @@ packages:
     resolution: {integrity: sha512-yL/sLrpmtDaFEiUj1osRP4TI2MDz1AddJL+jZ7KSqvBuliN4xqYY54IfdN8qD8Toa6g1iloph1fxQNkjOxrrpQ==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@eslint/eslintrc@3.3.7':
-    resolution: {integrity: sha512-F42g89Qd5oAWtp0k0nnSrjziAKza7w8SVT4mStc18LZMaRb4J1HQAHLCalEtDCxrTuksx7NU9qsmeLwpOfPqWw==}
+  '@eslint/eslintrc@3.3.5':
+    resolution: {integrity: sha512-4IlJx0X0qftVsN5E+/vGujTRIFtwuLbNsVUe7TO6zYPDR1O6nFwvwhIKEKSrl6dZchmYBITazxKoUYOjdtjlRg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@eslint/js@9.39.5':
-    resolution: {integrity: sha512-QywQuszQh77pIXCsq998c8hbhSTI/azTty1Z6N53dmAudKHhy573j3yvRLsX2BSp8YpLtoCEG8E9DJe+8zUh4A==}
+  '@eslint/js@9.39.4':
+    resolution: {integrity: sha512-nE7DEIchvtiFTwBw4Lfbu59PG+kCofhjsKaCWzxTpt4lfRjRMqG6uMBzKXuEcyXhOHoUp9riAm7/aWYGhXZ9cw==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
   '@eslint/object-schema@2.1.7':
@@ -637,8 +653,8 @@ packages:
     resolution: {integrity: sha512-43/qtrDUokr7LJqoF2c3+RInu/t4zfrpYdoSDfYyhg52rwLV6TnOvdG4fXm7IkSB3wErkcmJS9iEhjVtOSEjjA==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@exodus/bytes@1.16.0':
-    resolution: {integrity: sha512-IcpW84uEn3N7ETtNZMlxKhfl6Pec8rUNGOTBtWbK1FKhJxIFAptZyVrvVRVBimAJxJCgc3PxepxkdWWG4DVzfA==}
+  '@exodus/bytes@1.15.0':
+    resolution: {integrity: sha512-UY0nlA+feH81UGSHv92sLEPLCeZFjXOuHhrIo0HQydScuQc8s0A7kL/UdgwgDq8g8ilksmuoF35YVTNphV2aBQ==}
     engines: {node: ^20.19.0 || ^22.12.0 || >=24.0.0}
     peerDependencies:
       '@noble/hashes': ^1.8.0 || ^2.0.0
@@ -646,50 +662,41 @@ packages:
       '@noble/hashes':
         optional: true
 
-  '@floating-ui/core@1.8.0':
-    resolution: {integrity: sha512-0CIZ5itps/8x7BG8dEIhs53BvCUH2PCoogtakwRTut+Arm58sJooJ0AuZhLw2HJYIR5cMLNPBSS728sPho2khQ==}
+  '@floating-ui/core@1.7.5':
+    resolution: {integrity: sha512-1Ih4WTWyw0+lKyFMcBHGbb5U5FtuHJuujoyyr5zTaWS5EYMeT6Jb2AuDeftsCsEuchO+mM2ij5+q9crhydzLhQ==}
 
-  '@floating-ui/dom@1.8.0':
-    resolution: {integrity: sha512-yXSrzeHZBTZadLOlfyhCkJHNeLJnHRnRInwdZ40L7ZiaAtrBwoYlsDrX3v5zB1Utk7CLfzcOVnVVWoXEky7Ceg==}
+  '@floating-ui/dom@1.7.6':
+    resolution: {integrity: sha512-9gZSAI5XM36880PPMm//9dfiEngYoC6Am2izES1FF406YFsjvyBMmeJ2g4SAju3xWwtuynNRFL2s9hgxpLI5SQ==}
 
-  '@floating-ui/react-dom@2.1.9':
-    resolution: {integrity: sha512-JDjEFGCpImxDCA7JJKviA0M9+RtmJdj0m/NVU5IMgBK+AmZouAQQ7/+2GLH0GXXY0YMw9oXPB8hKdbPYg5QLYg==}
+  '@floating-ui/react-dom@2.1.8':
+    resolution: {integrity: sha512-cC52bHwM/n/CxS87FH0yWdngEZrjdtLW/qVruo68qg+prK7ZQ4YGdut2GyDVpoGeAYe/h899rVeOVm6Oi40k2A==}
     peerDependencies:
       react: '>=16.8.0'
       react-dom: '>=16.8.0'
 
-  '@floating-ui/utils@0.2.12':
-    resolution: {integrity: sha512-HpCo8tmWzLVad5s2d19EhAz5zqrrQ6s69qd6moPMQvkOuSwDT1YgRfWSVuc4ennqrgv3OHppiOGMQ7oC13yIww==}
+  '@floating-ui/utils@0.2.11':
+    resolution: {integrity: sha512-RiB/yIh78pcIxl6lLMG0CgBXAZ2Y0eVHqMPYugu+9U0AeT6YBeiJpf7lbdJNIugFP5SIjwNRgo4DhR1Qxi26Gg==}
 
   '@fontsource-variable/fraunces@5.3.0':
     resolution: {integrity: sha512-9BYGySn4AHEJdgp9Z28tQ3X+laJMEOITXkQarZXeloWQZDq5oOvXJ3kDA8c7MGIfpogIaZfjrQBqmda8POOCKA==}
 
-  '@fontsource-variable/manrope@5.3.0':
-    resolution: {integrity: sha512-6D5dgokHsWDDMtmXHznKa0hK229NN+1a4BLPmUCLqcO1Pw5EEhWY5RFt0AcXnVRAljFFPfRtLkJePQj6LSsV6g==}
+  '@fontsource-variable/plus-jakarta-sans@5.3.0':
+    resolution: {integrity: sha512-/l/4r0yyWK9JzAlmA0LiYgGgmJe/Gswt4jTJEzr5QhJfwMbvJZDmYWyW0M4X7yCK69BajMVlV/Lx8g7WDc1+sw==}
 
-  '@fontsource-variable/outfit@5.3.0':
-    resolution: {integrity: sha512-fPb5XnYK0k7SbR++HEmm4+ZqDszmLKQ+sPRUr8oQ/KNC0vy6r6hazJFe8iYozv4cqlHbvJ/JECkJWrfDodUMVQ==}
+  '@fontsource/noto-sans-arabic@5.2.10':
+    resolution: {integrity: sha512-Hgj3NwQJ0NquIADW3hFboFjsts4UvEOJQ8tOX0bhQZgpNKHsMawjv/1SZnq0QvRbP6efHTZM/A1k7tdy9S6sbA==}
 
-  '@fontsource-variable/sora@5.3.0':
-    resolution: {integrity: sha512-h8kHta4Z8SkfUGeI82TUy1n3rbrKpBRGwuk4t4qCwto5oEHxlbOFD2yGP+Df5fbmTXwKGn+o667vYp0E4K8Whw==}
-
-  '@fontsource-variable/urbanist@5.3.0':
-    resolution: {integrity: sha512-riHbcRgoOhEdCwVw3n3R1JLEwvRD1N9GlXtBcwl/UJ2KabfyDBuryE2Yq10308QJgbXw3F/IFF+VoMuuqwVfIA==}
-
-  '@fontsource/noto-sans-arabic@5.3.0':
-    resolution: {integrity: sha512-i3t6GR0LOReyJVEk+YfYCnxv53wuIelg7Y9NGNvOq4Diq/EP0YszaGXkQwfQNigLjfO4POrLaPGM0sNliGYk7A==}
-
-  '@fontsource/noto-sans-thai@5.3.0':
-    resolution: {integrity: sha512-ngqUyvDukkZUHypQbUJvUdAeYa2aYZsyeDTsdqMudf7GK2F2TK19OZ5kbo+37qsBtkNpmAMhEObQnWnzPqzKUw==}
+  '@fontsource/noto-sans-thai@5.2.8':
+    resolution: {integrity: sha512-HUQAxOzclod9PXQx4uMoGRAsor+64snW91QuBg39jT9lbsp7jJx1i3jAtHPJ7mQxHEHnhRjNp54fb8GqPPC6zg==}
 
   '@formatjs/fast-memoize@3.1.7':
     resolution: {integrity: sha512-zXfhLpvA6T7+efdt9JLbBwZ00tT7NsBMDVnDu8rpHeNNv8KfRZAMo2gkG0k9lK/Nzc//3kJ9pImsfuJxk3KhUA==}
 
-  '@formatjs/intl-displaynames@7.3.15':
-    resolution: {integrity: sha512-U26iRwxxnD4aZY+aDiSEV5Ym/7Db5S9OxKQ4c3T+WFFIj+DPKEQLh+tC++dMH1SuEa8CSWvPJkpaADa+WHn3qA==}
+  '@formatjs/intl-displaynames@7.3.13':
+    resolution: {integrity: sha512-p+rSpn96AeUS5qW5sBAkvGFyw6oYcg8y2NNI7mrqfuyfRbIeHRLzO0+fdcKLqdXoLTHBfr3iZc/v6NPWWSdkmg==}
 
-  '@formatjs/intl-localematcher@0.9.0':
-    resolution: {integrity: sha512-Z7TD3ssNry1Av1dVDoq/mzpxGyxqWwU0ClWEo+BB3k0JQTeQvUGmeK9WZGYvlqStS0UqkaKXk3dfjsb6NaHAxw==}
+  '@formatjs/intl-localematcher@0.8.13':
+    resolution: {integrity: sha512-kHEAFOkeJSPNi7c5PaKaRjxcBrJwzzt81ifUu+8uve1EDW/VJl83KsxmqgqNZLzcFEhSliZGvx3+pk/RH0IOmg==}
 
   '@humanfs/core@0.19.2':
     resolution: {integrity: sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==}
@@ -727,108 +734,104 @@ packages:
   '@jridgewell/trace-mapping@0.3.31':
     resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==}
 
-  '@lezer/common@1.5.3':
-    resolution: {integrity: sha512-H0iErY4e43LpXbYDyBci5W4v/RwTgGV3YzYOlJPiGZ8RY8w51kVE+xLn1tg3Z6UmSfyETvtsUK3r7YsgDQEI7Q==}
+  '@lezer/common@1.5.2':
+    resolution: {integrity: sha512-sxQE460fPZyU3sdc8lafxiPwJHBzZRy/udNFynGQky1SePYBdhkBl1kOagA9uT3pxR8K09bOrmTUqA9wb/PjSQ==}
 
-  '@lezer/highlight@1.2.5':
-    resolution: {integrity: sha512-O1GMVKgtf5YspFaRzpmqkVgMtIk2HG9uMAbH6wdAIdNh3TVzCsch/+cRi+6l2//UGDKe6NB9BW3cvuR5ezMQ0w==}
+  '@lezer/highlight@1.2.3':
+    resolution: {integrity: sha512-qXdH7UqTvGfdVBINrgKhDsVTJTxactNNxLk7+UMwZhU13lMHaOBlJe9Vqp907ya56Y3+ed2tlqzys7jDkTmW0g==}
 
-  '@lezer/lr@1.4.11':
-    resolution: {integrity: sha512-UwgZcl1R66H2hDzBrA7kWyYmX6s8p5TQ+e/t7CuvgCtBEPxbEPaHYHu+pJBvTvDotEJpuQkJjbXuHiw5Cixxgw==}
+  '@lezer/lr@1.4.10':
+    resolution: {integrity: sha512-rnCpTIBafOx4mRp43xOxDJbFipJm/c0cia/V5TiGlhmMa+wsSdoGmUN3w5Bqrks/09Q/D4tNAmWaT8p6NRi77A==}
+
+  '@marijn/find-cluster-break@1.0.3':
+    resolution: {integrity: sha512-FY+MKLBoTsLNJF/eLWaOsXGdz6uh3Iu1axjPf6TUq92IYumcTcXWHoS747JARLkcdlJ/Waiaxc5wQfFO8jC6NA==}
 
   '@marijn/find-cluster-break@1.0.4':
     resolution: {integrity: sha512-Wy0V7+SGUjnF9/TkiM1hKVDPj7jKXduPNboMVtHTA8dySMURWqfg/JZ9E2Sq8JgSJmkl7k7Qe9FLeMSrSraWmQ==}
 
-  '@napi-rs/canvas-android-arm64@1.0.11':
-    resolution: {integrity: sha512-dtJS4FQEfH9OwSYLtMrEnj7T8DzBbJc/97LI/OkiWOYpW/iW5t6R/gcxVrUXS8l45gCVpwMufgucRe/pe0ISqA==}
+  '@napi-rs/canvas-android-arm64@1.0.5':
+    resolution: {integrity: sha512-ZzDlpKQocwFfCwhMh17UWre6Qt5yZN3kNIJoUpGfRZqwDDZ164IKOsPOHsRd3d8Tuj5KM6bDjGuPmZxuPuG3NQ==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [android]
 
-  '@napi-rs/canvas-darwin-arm64@1.0.11':
-    resolution: {integrity: sha512-J/JylWoJTG8OQqZaiqly4IODyAxNofUlZo0wtSBJtHk6AdymbdIkPynAM1JvQaZpPaG5h+msk9QuK8y4i1ooqw==}
+  '@napi-rs/canvas-darwin-arm64@1.0.5':
+    resolution: {integrity: sha512-Hr8v6CA/TBe+OJOePdV3sXWxzQHQKfQsTKPbc8wG7iPqVeAx6MMdzKGXlYID6SVvpfwV/zqkvGcdImYWSlhrZg==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [darwin]
 
-  '@napi-rs/canvas-darwin-x64@1.0.11':
-    resolution: {integrity: sha512-nlecCk3xy06eAGC7krZtzNDm9UNTHKuHQYK8ZYegdjzgSL8anGt/eLJZm86OWaNgZkwQwvDqfSmG8Nqe6MPZNQ==}
+  '@napi-rs/canvas-darwin-x64@1.0.5':
+    resolution: {integrity: sha512-9BXlLHBXpYnK4jSae1MdFdyPq09Xi1I3PeCNpvRzqgmUUBhgJS7aC1z7SZEP8JUXDHtbfIrolCS3sFuT9IGP2A==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [darwin]
 
-  '@napi-rs/canvas-linux-arm-gnueabihf@1.0.11':
-    resolution: {integrity: sha512-DKImmG+sTPolE0kGPsYPBxTtOjb3INALp32O2lW2CfSr0bAzSEKKuu+GrQbtilClyoPOahUErS3OrznFDraoWA==}
+  '@napi-rs/canvas-linux-arm-gnueabihf@1.0.5':
+    resolution: {integrity: sha512-zEW4fgvtYsOJ/N56Us4TQPfaFrUf0shGr9CgGSj3GACc+NHfUM3ci0YF9xFTjwJWGDmaEhYPL6KqCfFCxwm/qg==}
     engines: {node: '>= 10'}
     cpu: [arm]
     os: [linux]
 
-  '@napi-rs/canvas-linux-arm64-gnu@1.0.11':
-    resolution: {integrity: sha512-55sykACGENj5j1rhj+81AO8JbR9HYgGjRZ7/H+pNr4VE1DvINKYNMTcutk8ZmWxk276jAQvUKJ3+Kdj9GXU3lQ==}
+  '@napi-rs/canvas-linux-arm64-gnu@1.0.5':
+    resolution: {integrity: sha512-HFprwLspelJxCEtZvdMcz95Mwvfs63GzFVedLFmC/wslHnaOXhjXxgYxPCM/VdM4Jhx3CV4Lk0vVmh6hJv2etQ==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@napi-rs/canvas-linux-arm64-musl@1.0.11':
-    resolution: {integrity: sha512-6Jz6jys17yXydO+WdJgu7JhoB4K7/w9sWHByzzTmLjQghUx3TDMWvLv+UcCdnWhg4oprET67EMymnrETdeGNAg==}
+  '@napi-rs/canvas-linux-arm64-musl@1.0.5':
+    resolution: {integrity: sha512-FNMGFAx8DvtDwlLfWyBJ+oQjgPXoIAqCnNTJYqtJCFRwwzK3AyAe5B1Ll3NZ6hcOzqw7HylZsq4nQxVyPCQX1Q==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@napi-rs/canvas-linux-riscv64-gnu@1.0.11':
-    resolution: {integrity: sha512-lf2XeEebWiUYVOVEjLXxF7dfXrBBSEOBn9AqBh39VYXrPt5cDqI+1t58IFSjn8npqkg5jIOs8TQbjKABbFW1gQ==}
+  '@napi-rs/canvas-linux-riscv64-gnu@1.0.5':
+    resolution: {integrity: sha512-2vd5v8Lui+37Hh/spITKIvTT384ip4dnUc5XBn0E+sMNS4b7au7IswyT5YDG2udPTjSh/eLUs3sGuB5YHooFOA==}
     engines: {node: '>= 10'}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
-  '@napi-rs/canvas-linux-x64-gnu@1.0.11':
-    resolution: {integrity: sha512-iDapw7nFSE5tsmQxcH2+KotJhyfVPmHd6vUOQN/Em+8WNbkZJwJ/rDowlJMFnMl0SYSDSfgKCNUGi6Sn5++Smg==}
+  '@napi-rs/canvas-linux-x64-gnu@1.0.5':
+    resolution: {integrity: sha512-iQIPy+Uey0expZTOszLri5n8rY7x4WUpMaY82mcXNIgbil30iHvc01OsiizhZC1KQHTK90RFMFWSpwFU+ON3aA==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@napi-rs/canvas-linux-x64-musl@1.0.11':
-    resolution: {integrity: sha512-26q26AyITo3CGZX4HWFIMgBMA1lu3YN07gxzBm4tW6Hglq/OVyTP50kDrmWuKybCX6dh3m8Ly+c7YhI+sqCgCQ==}
+  '@napi-rs/canvas-linux-x64-musl@1.0.5':
+    resolution: {integrity: sha512-Npthji25t7FUqIAKsoEkFS0qY5CYVkHjvI3tuZjDTG92wX8g4dst+Lfb4hhubdqPazlDcIwalPzInsFCtf3FFg==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@napi-rs/canvas-win32-arm64-msvc@1.0.11':
-    resolution: {integrity: sha512-cUO96IdsfvIj2S+2PNcDSkTcLhjPj8pIOEWRV1Kj70MOP4wnE9zSk7N4C1EKHlFGRcgdR5AkbnBZj0dfHK9nbQ==}
+  '@napi-rs/canvas-win32-arm64-msvc@1.0.5':
+    resolution: {integrity: sha512-bi+JsdCdbfVJDoAQybTYmkLKwh1xpYpptg5j/BNr2BB56u4/R26jrVvtjqff+CxYMXV6Kz1/jeDVhZCuj6bDng==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [win32]
 
-  '@napi-rs/canvas-win32-x64-msvc@1.0.11':
-    resolution: {integrity: sha512-DFYp/ZQRdKunI/LPc0UkRXG1vlNjJKOJf8O8Ctb8+wm2Nt2ELg9Eamc31D2VoakkfGo8L+z0Iejz6WtFbQwyGw==}
+  '@napi-rs/canvas-win32-x64-msvc@1.0.5':
+    resolution: {integrity: sha512-KQQwG9/sBmcGxqaLFIQf+k2OefREGoyEaIBmRuTM8bUuFKOEE9Xk5pel90hE6pmBwk/vo4RB0OdX+FxobJGMFw==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [win32]
 
-  '@napi-rs/canvas@1.0.11':
-    resolution: {integrity: sha512-vt5tog1cr+QKadIddGe+3LrcX0EmjEd0izF717Uwf92mBmgYfq2XRmL2r4bZU40spB69exxhrBn9I91HYEr/7w==}
+  '@napi-rs/canvas@1.0.5':
+    resolution: {integrity: sha512-GaPlicMtnvgPr5SowFRprkEJicDSrV3qCq17U4jiF5u0kNORZo3IbdN2Bk4SfcZJAMYFHbMVJ81O3w21CYxazg==}
     engines: {node: '>= 10'}
 
-  '@napi-rs/lzma-linux-x64-gnu@1.5.1':
-    resolution: {integrity: sha512-oTXEIha4SsuXdTA4Iyskj0kpdx2yVXdhd75c2v3xGrHFfVMsbhTPZU/nMPL4sWKo4pBHm3aucLaqGlF696dTyQ==}
-    engines: {node: ^22.20 || ^24.12 || >=25}
-    cpu: [x64]
-    os: [linux]
-    libc: [glibc]
-
-  '@radix-ui/number@1.1.3':
-    resolution: {integrity: sha512-Road2bidD0uu/1BGDOWNdPI06g0lIRy6IF9GZcIrDK2KGItfor8IQwQa+yM2ERgHM1MmHxaxpTzk0/Jp42lNfA==}
+  '@radix-ui/number@1.1.1':
+    resolution: {integrity: sha512-MkKCwxlXTgz6CFoJx3pCwn07GKp36+aZyu/u2Ln2VrA5DcdyCZkASEDBTd8x5whTQQL5CiYf4prXKLcgQdv29g==}
 
-  '@radix-ui/primitive@1.2.0':
-    resolution: {integrity: sha512-KABY+VMIRPJL+Vyzv/335FEhXXD/xDv8BMb1kl48/aXJZMH0LtHCTx5ga5RnxaEP3nZHtmTLf1P9vanmFX46bw==}
+  '@radix-ui/primitive@1.1.3':
+    resolution: {integrity: sha512-JTF99U/6XIjCBo0wqkU5sK10glYe27MRRsfwoiq5zzOEZLHU3A3KCMa5X/azekYRCJ0HlwI0crAXS/5dEHTzDg==}
 
-  '@radix-ui/react-accessible-icon@1.2.0':
-    resolution: {integrity: sha512-BB4+HHkFl3HipEAhm/mLhrpXV+2kRX7MvY4AaImUcQVeWQt5KhV1JEByNs8NGfJOcr95RcQGijt9+OrCo68xGA==}
+  '@radix-ui/react-accessible-icon@1.1.7':
+    resolution: {integrity: sha512-XM+E4WXl0OqUJFovy6GjmxxFyx9opfCAIUku4dlKRd5YEPqt4kALOkQOp0Of6reHuUkJuiPBEc5k0o4z4lTC8A==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -840,8 +843,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-accordion@1.3.1':
-    resolution: {integrity: sha512-lCZ6sbGS/7WO0j84yx4srIgOf0MRJ/sZ13RonADXxvKBym8xrxNCq5f6DibGcr38sIlwPk8/52uYdXeOPsbEDw==}
+  '@radix-ui/react-accordion@1.2.12':
+    resolution: {integrity: sha512-T4nygeh9YE9dLRPhAHSeOZi7HBXo+0kYIPJXayZfvWOWA0+n3dESrZbjfDPUABkUNym6Hd+f2IR113To8D2GPA==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -853,8 +856,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-alert-dialog@1.2.1':
-    resolution: {integrity: sha512-MWC4N7RY+qsbNrFNo7yQ9ZbdoZEW+B5DtpWxJfUnVCqcQxxqqg3qis3RMPTDbCNaTIdHJSn5XDkl9ZdVWXknLg==}
+  '@radix-ui/react-alert-dialog@1.1.15':
+    resolution: {integrity: sha512-oTVLkEw5GpdRe29BqJ0LSDFWI3qu0vR1M0mUkOQWDIUnY/QIkLpgDMWuKxP94c2NAC2LGcgVhG1ImF3jkZ5wXw==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -866,8 +869,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-arrow@1.1.17':
-    resolution: {integrity: sha512-67jjcVvxjXCCStnTW3Z+M7jmaFMuMR7M2JgpDzH4w7JSRrikmzhjfYgP/09ECb8n7whnsgh1ifJ+Ie96qEj+pQ==}
+  '@radix-ui/react-arrow@1.1.7':
+    resolution: {integrity: sha512-F+M1tLhO+mlQaOWspE8Wstg+z6PwxwRd8oQ8IXceWz92kfAmalTRf0EjrouQeo7QssEPfCn05B4Ihs1K9WQ/7w==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -879,8 +882,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-aspect-ratio@1.2.0':
-    resolution: {integrity: sha512-gHEU+Lx8DlT/FYIjZQvvBJrFSwUngXTjh7FeL9QvJaNALDLez6pgDj2axCUihBjtPBy82LN0gNb25+sTcSXNmA==}
+  '@radix-ui/react-aspect-ratio@1.1.7':
+    resolution: {integrity: sha512-Yq6lvO9HQyPwev1onK1daHCHqXVLzPhSVjmsNjCa2Zcxy2f7uJD2itDtxknv6FzAKCwD1qQkeVDmX/cev13n/g==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -892,8 +895,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-avatar@1.3.1':
-    resolution: {integrity: sha512-ssZOkfQNkFpYVmCPQlr978xSaU7moSrGXdwg4j2Xs2WlGl/1KsSZtfpK+WnLnx0Rwll1BAh6oUrAy/uR31SBvQ==}
+  '@radix-ui/react-avatar@1.1.10':
+    resolution: {integrity: sha512-V8piFfWapM5OmNCXTzVQY+E1rDa53zY+MQ4Y7356v4fFz6vqCyUtIz2rUD44ZEdwg78/jKmMJHj07+C/Z/rcog==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -905,8 +908,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-checkbox@1.4.1':
-    resolution: {integrity: sha512-KWtwhh+98ML3seZ9vO9yRY2OwaQG90dCiDAxjpSNY2AaZ3Hik3B0dsk6m0ILywo/no3A9/SozadyPMNweVT8yw==}
+  '@radix-ui/react-checkbox@1.3.3':
+    resolution: {integrity: sha512-wBbpv+NQftHDdG86Qc0pIyXk5IR3tM8Vd0nWLKDcX8nNn4nXFOFwsKuqw2okA/1D/mpaAkmuyndrPJTYDNZtFw==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -918,8 +921,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-collapsible@1.2.1':
-    resolution: {integrity: sha512-fSzLb/qy1wuZSxQBcxpW0hNXYHDMWiIXDGyJGdA4+FSLknOWZsNRrTCUavxb4PI8b8lvHo/CysO6NVi5zLpo5g==}
+  '@radix-ui/react-collapsible@1.1.12':
+    resolution: {integrity: sha512-Uu+mSh4agx2ib1uIGPP4/CKNULyajb3p92LsVXmH2EHVMTfZWpll88XJ0j4W0z3f8NK1eYl1+Mf/szHPmcHzyA==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -931,8 +934,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-collection@1.2.0':
-    resolution: {integrity: sha512-+yiQzqcc7Sy7/5s0jrMCjpPRFB3538VNrXPWdTLZhE/SCfgEws4aI6lHWN/vvcnyhHndROWBzqmqB4QBrITZ9Q==}
+  '@radix-ui/react-collection@1.1.7':
+    resolution: {integrity: sha512-Fh9rGN0MoI4ZFUNyfFVNU4y9LUz93u9/0K+yLgA2bwRojxM8JU1DyvvMBabnZPBgMWREAJvU2jjVzq+LrFUglw==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -944,8 +947,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-compose-refs@1.1.5':
-    resolution: {integrity: sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA==}
+  '@radix-ui/react-compose-refs@1.1.2':
+    resolution: {integrity: sha512-z4eqJvfiNnFMHIIvXP3CY57y2WJs5g2v3X0zm9mEJkrkNv4rDxu+sg9Jh8EkXyeqBkB7SOcboo9dMVqhyrACIg==}
     peerDependencies:
       '@types/react': '*'
       react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
@@ -953,8 +956,8 @@ packages:
       '@types/react':
         optional: true
 
-  '@radix-ui/react-context-menu@2.4.1':
-    resolution: {integrity: sha512-Pddn3Z8lio3/ChxyXaEP3jHTTo1LTHCWwF8+mG1chQlWijP+ttVHBKwezrQTiV6Mj670ojvumqvuGh+mdv33iQ==}
+  '@radix-ui/react-context-menu@2.2.16':
+    resolution: {integrity: sha512-O8morBEW+HsVG28gYDZPTrT9UUovQUlJue5YO836tiTJhuIWBm/zQHc7j388sHWtdH/xUZurK9olD2+pcqx5ww==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -966,8 +969,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-context@1.3.0':
-    resolution: {integrity: sha512-v5AYEocMISkbJ+1fTXzZpiFv7NRr3D2WiYbLIKf+FkmJ8VkP6d503eV2n34MFussHXY1pcoq3yfJiQH77dc4Mg==}
+  '@radix-ui/react-context@1.1.2':
+    resolution: {integrity: sha512-jCi/QKUM2r1Ju5a3J64TH2A5SpKAgh0LpknyqdQ4m6DCV0xJ2HG1xARRwNGPQfi1SLdLWZ1OJz6F4OMBBNiGJA==}
     peerDependencies:
       '@types/react': '*'
       react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
@@ -975,8 +978,8 @@ packages:
       '@types/react':
         optional: true
 
-  '@radix-ui/react-dialog@1.3.1':
-    resolution: {integrity: sha512-+0E4qvVTwjAWra9sEhJ+9BTsvHE00zkUuNw1VGh7S+Gc13dfYk+S1PVQdchWDj+XYHhAai7Z7IpzXVDCGsDplg==}
+  '@radix-ui/react-dialog@1.1.15':
+    resolution: {integrity: sha512-TCglVRtzlffRNxRMEyR36DGBLJpeusFcgMVD9PZEzAKnUs1lKCgX5u9BmC2Yg+LL9MgZDugFFs1Vl+Jp4t/PGw==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -988,8 +991,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-direction@1.2.0':
-    resolution: {integrity: sha512-FtRA52a/r+LKStFT+neLUm+8vSe7wbzkbQGGeU8ixFiwC8NU14Evoq9ATECqL3eGbcUzJR4fyfA4KkK/q6dfqg==}
+  '@radix-ui/react-direction@1.1.1':
+    resolution: {integrity: sha512-1UEWRX6jnOA2y4H5WczZ44gOOjTEmlqv1uNW4GAJEO5+bauCBhv8snY65Iw5/VOS/ghKN9gr2KjnLKxrsvoMVw==}
     peerDependencies:
       '@types/react': '*'
       react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
@@ -997,8 +1000,8 @@ packages:
       '@types/react':
         optional: true
 
-  '@radix-ui/react-dismissable-layer@1.2.1':
-    resolution: {integrity: sha512-KIfDcAsx+oVylFZ4xryVKusJUrLLhTQmfnJW4kwk4Km5myvhHCrj04hnWWUC166+xD4DHdH8tQGylwYX1h6+Pg==}
+  '@radix-ui/react-dismissable-layer@1.1.11':
+    resolution: {integrity: sha512-Nqcp+t5cTB8BinFkZgXiMJniQH0PsUt2k51FUhbdfeKvc4ACcG2uQniY/8+h1Yv6Kza4Q7lD7PQV0z0oicE0Mg==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -1010,8 +1013,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-dropdown-menu@2.2.1':
-    resolution: {integrity: sha512-XsHcmYG2AcqnvTqrOXXWcMrhquEIlqucizuDH1MV/qMRW+DndpBCMvNeTRXOxqmG1H5j89M/+I0/34Zdd+zDcQ==}
+  '@radix-ui/react-dropdown-menu@2.1.16':
+    resolution: {integrity: sha512-1PLGQEynI/3OX/ftV54COn+3Sud/Mn8vALg2rWnBLnRaGtJDduNW/22XjlGgPdpcIbiQxjKtb7BkcjP00nqfJw==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -1023,8 +1026,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-focus-guards@1.2.0':
-    resolution: {integrity: sha512-MPm5R0iRGUDrDnPNxmLBkv+X7pN4XKzt+MbWJEuJQsH3NFH4omrbpXpucyYCCKTSt+na/ZxGhEWQrWTZ0285cA==}
+  '@radix-ui/react-focus-guards@1.1.3':
+    resolution: {integrity: sha512-0rFg/Rj2Q62NCm62jZw0QX7a3sz6QCQU0LpZdNrJX8byRGaGVTqbrW9jAoIAHyMQqsNpeZ81YgSizOt5WXq0Pw==}
     peerDependencies:
       '@types/react': '*'
       react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
@@ -1032,8 +1035,8 @@ packages:
       '@types/react':
         optional: true
 
-  '@radix-ui/react-focus-scope@1.3.1':
-    resolution: {integrity: sha512-ugeMhbXt4y5S2T1GnIqbWDKEN962PDwnX1fN0eKOOgf5f63Dh2mn8F1FUySlgW0iF6GiVsRF32DzuDIWTUyQJg==}
+  '@radix-ui/react-focus-scope@1.1.7':
+    resolution: {integrity: sha512-t2ODlkXBQyn7jkl6TNaw/MtVEVvIGelJDCG41Okq/KwUsJBwQ4XVZsHAVUkK4mBv3ewiAS3PGuUWuY2BoK4ZUw==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -1045,8 +1048,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-form@0.3.0':
-    resolution: {integrity: sha512-KnmrCM27m7Jo1R8S6cFDPrEeq20Jfn5dqde0SZrJr2lVXlj6/QZSUCyFoYh1d8ti0uUrMNK5Lx6dUDuINT+f4Q==}
+  '@radix-ui/react-form@0.1.8':
+    resolution: {integrity: sha512-QM70k4Zwjttifr5a4sZFts9fn8FzHYvQ5PiB19O2HsYibaHSVt9fH9rzB0XZo/YcM+b7t/p7lYCT/F5eOeF5yQ==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -1058,8 +1061,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-hover-card@1.2.1':
-    resolution: {integrity: sha512-4QooHxgmpCKRjj1Pft+hETKidYcrbPKcVwMGtk2Oa5DcWY2IH1fHuQt9LG6q5hUQBBV2MhQxSvtx6B/C1xfiTw==}
+  '@radix-ui/react-hover-card@1.1.15':
+    resolution: {integrity: sha512-qgTkjNT1CfKMoP0rcasmlH2r1DAiYicWsDsufxl940sT2wHNEWWv6FMWIQXWhVdmC1d/HYfbhQx60KYyAtKxjg==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -1071,8 +1074,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-id@1.1.4':
-    resolution: {integrity: sha512-TMQp2llA+RYn7JcjnrMnz7wN4pcVttPZnRZo52PLQsoLVKzNlVwUeHmfePgTgRluXFvlD3GD5g5MOVVTJCO0qA==}
+  '@radix-ui/react-id@1.1.1':
+    resolution: {integrity: sha512-kGkGegYIdQsOb4XjsfM97rXsiHaBwco+hFI66oO4s9LU+PLAC5oJ7khdOVFxkhsmlbpUqDAvXw11CluXP+jkHg==}
     peerDependencies:
       '@types/react': '*'
       react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
@@ -1080,8 +1083,8 @@ packages:
       '@types/react':
         optional: true
 
-  '@radix-ui/react-label@2.1.17':
-    resolution: {integrity: sha512-xmj7MN/drx1oUAXkfiFIvyDmGNUIN/omGobvA5oAoNqu9zO2MkISYGZOkBcqSzs/UZXXwV+/3ACRE7q7mGcmkA==}
+  '@radix-ui/react-label@2.1.7':
+    resolution: {integrity: sha512-YT1GqPSL8kJn20djelMX7/cTRp/Y9w5IZHvfxQTVHrOqa2yMl7i/UfMqKRU5V7mEyKTrUVgJXhNQPVCG8PBLoQ==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -1093,8 +1096,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-menu@2.2.1':
-    resolution: {integrity: sha512-G34BsU90SBj5foYpz8pQqq/Q0Dlfyyl6KitWEfRwXC0QvfwhWNAwS49DWP2+rRJ0iwv20Z2Qx7Sk+T03bGo5JA==}
+  '@radix-ui/react-menu@2.1.16':
+    resolution: {integrity: sha512-72F2T+PLlphrqLcAotYPp0uJMr5SjP5SL01wfEspJbru5Zs5vQaSHb4VB3ZMJPimgHHCHG7gMOeOB9H3Hdmtxg==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -1106,8 +1109,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-menubar@1.2.1':
-    resolution: {integrity: sha512-bRTYtS9JITV2dUYqYZb7+N5SooQBkZrNRejfmyrSKe3Y57aXhKgx//kBUP0kY7pEpsWR/U1AHsAJRzjwCrK3PA==}
+  '@radix-ui/react-menubar@1.1.16':
+    resolution: {integrity: sha512-EB1FktTz5xRRi2Er974AUQZWg2yVBb1yjip38/lgwtCVRd3a+maUoGHN/xs9Yv8SY8QwbSEb+YrxGadVWbEutA==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -1119,8 +1122,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-navigation-menu@1.4.1':
-    resolution: {integrity: sha512-XPPZjkeyCSMNNvt0FyDv/PUauG7Ow4GwHQ/XZSwW36F/TS7rR4HFTsXH8ewLnXTOLn3x96/pmTPNQIVoTX/86g==}
+  '@radix-ui/react-navigation-menu@1.2.14':
+    resolution: {integrity: sha512-YB9mTFQvCOAQMHU+C/jVl96WmuWeltyUEpRJJky51huhds5W2FQr1J8D/16sQlf0ozxkPK8uF3niQMdUwZPv5w==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -1132,8 +1135,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-one-time-password-field@0.2.1':
-    resolution: {integrity: sha512-KtHdcgnaAK6rohQ/MMJoGYcbgSRJsIuGBdHrFeTB1/9SaKlDs14oSOniW6BL6M43HqvgCO3u4WuVdFLkuc6sqw==}
+  '@radix-ui/react-one-time-password-field@0.1.8':
+    resolution: {integrity: sha512-ycS4rbwURavDPVjCb5iS3aG4lURFDILi6sKI/WITUMZ13gMmn/xGjpLoqBAalhJaDk8I3UbCM5GzKHrnzwHbvg==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -1145,8 +1148,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-password-toggle-field@0.2.1':
-    resolution: {integrity: sha512-vu4+ZoJAaFjdI7l1lDSZRs+4dEv83Jmu7lyzajPrAeQzX74y84n0rUNWbWSgN9XB5NE8IY86Z02kGH6oRrzR+w==}
+  '@radix-ui/react-password-toggle-field@0.1.3':
+    resolution: {integrity: sha512-/UuCrDBWravcaMix4TdT+qlNdVwOM1Nck9kWx/vafXsdfj1ChfhOdfi3cy9SGBpWgTXwYCuboT/oYpJy3clqfw==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -1158,8 +1161,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-popover@1.3.1':
-    resolution: {integrity: sha512-ZNxvXRx5W2Wos4fXCXb5lpdqN0Z5chf+mStOUOTr4ik7d+62MRvoe9rzCA/eGNg36lxXqSrKEKmwuZEcUrIstw==}
+  '@radix-ui/react-popover@1.1.15':
+    resolution: {integrity: sha512-kr0X2+6Yy/vJzLYJUPCZEc8SfQcf+1COFoAqauJm74umQhta9M7lNJHP7QQS3vkvcGLQUbWpMzwrXYwrYztHKA==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -1171,8 +1174,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-popper@1.4.0':
-    resolution: {integrity: sha512-yCWRvLeGv9Pz3+efwHqGPp70mZ56r3kfIgQVF56Oj2aAa4uP/Tb+IE59wNcc+758rctqbCKx4LbK8II/r7Bn0Q==}
+  '@radix-ui/react-popper@1.2.8':
+    resolution: {integrity: sha512-0NJQ4LFFUuWkE7Oxf0htBKS6zLkkjBH+hM1uk7Ng705ReR8m/uelduy1DBo0PyBXPKVnBA6YBlU94MBGXrSBCw==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -1184,8 +1187,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-portal@1.2.0':
-    resolution: {integrity: sha512-StX7xXnaRU41VvFtMm9zlhVGz8XF6GmWWTXftkQaY+tqVkbs/R9UmAp5mLzHHapk5hM9RMZQvO/3usyIP/g42g==}
+  '@radix-ui/react-portal@1.1.9':
+    resolution: {integrity: sha512-bpIxvq03if6UNwXZ+HTK71JLh4APvnXntDc6XOX8UVq4XQOVl7lwok0AvIl+b8zgCw3fSaVTZMpAPPagXbKmHQ==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -1197,8 +1200,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-presence@1.1.11':
-    resolution: {integrity: sha512-Z7/atlkab36Z8hm+V8zYc79r0W+tiOB1o0tun1By94JyadkekLQmtEAnBSP9XKXBNQsStoStS4+gX10JpS5akA==}
+  '@radix-ui/react-presence@1.1.5':
+    resolution: {integrity: sha512-/jfEwNDdQVBCNvjkGit4h6pMOzq8bHkopq458dPt2lMjx+eBQUohZNG9A7DtO/O5ukSbxuaNGXMjHicgwy6rQQ==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -1210,8 +1213,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-primitive@2.2.0':
-    resolution: {integrity: sha512-HCTSPMNqv55Qk0IX4geJbpyXazmqulcimwuyjxTkKi29v+QZbG2Zho9BnbBq4YS2PF+KlNb2CXoLz66uUmblkg==}
+  '@radix-ui/react-primitive@2.1.3':
+    resolution: {integrity: sha512-m9gTwRkhy2lvCPe6QJp4d3G1TYEUHn/FzJUtq9MjH46an1wJU+GdoGC5VLof8RX8Ft/DlpshApkhswDLZzHIcQ==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -1223,8 +1226,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-progress@1.2.1':
-    resolution: {integrity: sha512-yQBiM6J3YM8Ums1orkEFpbznK47geKxa0igikzcaS1xHgdba3DdAQBsGbCTt5BVfR8zhEvgxQ0poGcINaD3lvw==}
+  '@radix-ui/react-progress@1.1.7':
+    resolution: {integrity: sha512-vPdg/tF6YC/ynuBIJlk1mm7Le0VgW6ub6J2UWnTQ7/D23KXcPI1qy+0vBkgKgd38RCMJavBXpB83HPNFMTb0Fg==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -1236,8 +1239,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-radio-group@1.5.1':
-    resolution: {integrity: sha512-QbyVT1ddnjqB9H+CUYKkNWdU9fIK3QHCYtjf7mS6ekSqiuXkWtWn5UZW9mhA8qtl3vrVyIsmR9gePstAtKrqkw==}
+  '@radix-ui/react-radio-group@1.3.8':
+    resolution: {integrity: sha512-VBKYIYImA5zsxACdisNQ3BjCBfmbGH3kQlnFVqlWU4tXwjy7cGX8ta80BcrO+WJXIn5iBylEH3K6ZTlee//lgQ==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -1249,8 +1252,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-roving-focus@1.2.1':
-    resolution: {integrity: sha512-UwraORzVUeEPMclhO1p0vz0qI+TbdDLO9i+FiOqhJyHKwdpCRCck9yVEscUnAMIzCiuNoQa8D4A9bIpOPXGt6Q==}
+  '@radix-ui/react-roving-focus@1.1.11':
+    resolution: {integrity: sha512-7A6S9jSgm/S+7MdtNDSb+IU859vQqJ/QAtcYQcfFC6W8RS4IxIZDldLR0xqCFZ6DCyrQLjLPsxtTNch5jVA4lA==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -1262,8 +1265,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-scroll-area@1.4.0':
-    resolution: {integrity: sha512-CFrLqHNejWq5FhKAcj9V/WPGRsol76HBQto81NdOBVFEOqIEkJkKIJt0Z824A/9hHLCtoiR/Kw3euRgzXP2pxg==}
+  '@radix-ui/react-scroll-area@1.2.10':
+    resolution: {integrity: sha512-tAXIa1g3sM5CGpVT0uIbUx/U3Gs5N8T52IICuCtObaos1S8fzsrPXG5WObkQN3S6NVl6wKgPhAIiBGbWnvc97A==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -1275,8 +1278,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-select@2.4.1':
-    resolution: {integrity: sha512-888ZwW0Md6GyptuqYABRX9nLKgoYfcooCyBBvVaX5Jp3e+8Jp2i4Zo/Uy50Hm+Ysn2JfloQXstW4U36w8teVtg==}
+  '@radix-ui/react-select@2.2.6':
+    resolution: {integrity: sha512-I30RydO+bnn2PQztvo25tswPH+wFBjehVGtmagkU78yMdwTwVf12wnAOF+AeP8S2N8xD+5UPbGhkUfPyvT+mwQ==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -1288,8 +1291,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-separator@1.2.0':
-    resolution: {integrity: sha512-1jUAap0wZEqVP05Ou7kJgRxe/W+Qftng+rUNWGa0qkKbv9r5pWTG3E7a3ELKo2eJoHKMECnzuYrZpSyO1YgcYQ==}
+  '@radix-ui/react-separator@1.1.7':
+    resolution: {integrity: sha512-0HEb8R9E8A+jZjvmFCy/J4xhbXy3TV+9XSnGJ3KvTtjlIUy/YQ/p6UYZvi7YbeoeXdyU9+Y3scizK6hkY37baA==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -1301,8 +1304,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-slider@1.6.1':
-    resolution: {integrity: sha512-IRNRR90moPqxfwCJ0XbMJIxo70W0/1ZExT/sNCxEHMaPx0SF9HoQrcPEC75+H28cFKa0b+KH63anfLYJmwKacw==}
+  '@radix-ui/react-slider@1.3.6':
+    resolution: {integrity: sha512-JPYb1GuM1bxfjMRlNLE+BcmBC8onfCi60Blk7OBqi2MLTFdS+8401U4uFjnwkOr49BLmXxLC6JHkvAsx5OJvHw==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -1314,8 +1317,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-slot@1.5.0':
-    resolution: {integrity: sha512-tyYd9ddPXAysAbdbD9eYxgwpCSv6f3PncqVSNKQFSR5lcJVLz3cb/pANDoYrLiHBpXv7skortyUgGUWsYuPPFQ==}
+  '@radix-ui/react-slot@1.2.3':
+    resolution: {integrity: sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A==}
     peerDependencies:
       '@types/react': '*'
       react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
@@ -1323,8 +1326,8 @@ packages:
       '@types/react':
         optional: true
 
-  '@radix-ui/react-switch@1.4.1':
-    resolution: {integrity: sha512-NpBGwc40rY02ZmSvuyeKk0Bvc8ZsNeTMi4qHvJ+ZH4EiYCv0zIXEgdCW4bVdzgIUeP9xxbLJSxKOUfqITYNmkA==}
+  '@radix-ui/react-switch@1.2.6':
+    resolution: {integrity: sha512-bByzr1+ep1zk4VubeEVViV592vu2lHE2BZY5OnzehZqOOgogN80+mNtCqPkhn2gklJqOpxWgPoYTSnhBCqpOXQ==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -1336,8 +1339,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-tabs@1.2.1':
-    resolution: {integrity: sha512-hRoJlode+hg5ZNlR+3tkfkUliIybdTpD5lkAvHQ9yaXseGf7XVO9Ib2GPEIOuaJJbo7YWYbNpDDRfo8Dhf6/xA==}
+  '@radix-ui/react-tabs@1.1.13':
+    resolution: {integrity: sha512-7xdcatg7/U+7+Udyoj2zodtI9H/IIopqo+YOIcZOq1nJwXWBZ9p8xiu5llXlekDbZkca79a/fozEYQXIA4sW6A==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -1349,8 +1352,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-toast@1.3.1':
-    resolution: {integrity: sha512-iQvL0J7XK4HtJNGkkWMyYrboNseI7vtotFeUkIno8YNxVA9oM7B6//fh0Mc6TSKI96+zioLWi98lQLso88yJmQ==}
+  '@radix-ui/react-toast@1.2.15':
+    resolution: {integrity: sha512-3OSz3TacUWy4WtOXV38DggwxoqJK4+eDkNMl5Z/MJZaoUPaP4/9lf81xXMe1I2ReTAptverZUpbPY4wWwWyL5g==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -1362,8 +1365,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-toggle-group@1.2.1':
-    resolution: {integrity: sha512-O8Ldx5ao4p4KoW+DO8/PmkOe5mdKNi3F2SseqjVj88wvDGDHe60cUmO0Zm/uHsKrvNgQGV8Efpuh95Tht/h4vw==}
+  '@radix-ui/react-toggle-group@1.1.11':
+    resolution: {integrity: sha512-5umnS0T8JQzQT6HbPyO7Hh9dgd82NmS36DQr+X/YJ9ctFNCiiQd6IJAYYZ33LUwm8M+taCz5t2ui29fHZc4Y6Q==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -1375,8 +1378,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-toggle@1.2.1':
-    resolution: {integrity: sha512-+3MUq+WyiBplXYqQ0EIYlq8R4sLQ0T5NbOK7DMdDLCKO93pe2uE0DUJTWWfTBprpJJXxfoF3eMW0xpakVZrYsg==}
+  '@radix-ui/react-toggle@1.1.10':
+    resolution: {integrity: sha512-lS1odchhFTeZv3xwHH31YPObmJn8gOg7Lq12inrr0+BH/l3Tsq32VfjqH1oh80ARM3mlkfMic15n0kg4sD1poQ==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -1388,8 +1391,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-toolbar@1.2.1':
-    resolution: {integrity: sha512-Cm8m7JTEeUdbfA6T9xgyu8HfOpyvSx8pB/wj0DlEuWaJe9FilIs4Az9wci/lU9RbthV/UkltszMw5WnnD+m/Ug==}
+  '@radix-ui/react-toolbar@1.1.11':
+    resolution: {integrity: sha512-4ol06/1bLoFu1nwUqzdD4Y5RZ9oDdKeiHIsntug54Hcr1pgaHiPqHFEaXI1IFP/EsOfROQZ8Mig9VTIRza6Tjg==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -1401,8 +1404,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-tooltip@1.4.1':
-    resolution: {integrity: sha512-NxLFGSFtZ78zVfcoOhTwR1xwqo5qx1Jh8Pw6FMZ9McCaqfRzz7/gIRahs2Oy5XlPgQ+8QkUcKbN5B0U44J/kCg==}
+  '@radix-ui/react-tooltip@1.2.8':
+    resolution: {integrity: sha512-tY7sVt1yL9ozIxvmbtN5qtmH2krXcBCfjEiCgKGLqunJHvgvZG2Pcl2oQ3kbcZARb1BGEHdkLzcYGO8ynVlieg==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -1414,8 +1417,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-use-callback-ref@1.1.5':
-    resolution: {integrity: sha512-Y5GBf4NKeADoXI1geiMlMuMoURT3k9MizzzKhGb/m55H94aGigZ01PIpkvsO6lML13BA6XYAXSJ6gza7vTn5nw==}
+  '@radix-ui/react-use-callback-ref@1.1.1':
+    resolution: {integrity: sha512-FkBMwD+qbGQeMu1cOHnuGB6x4yzPjho8ap5WtbEJ26umhgqVXbhekKUQO+hZEL1vU92a3wHwdp0HAcqAUF5iDg==}
     peerDependencies:
       '@types/react': '*'
       react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
@@ -1423,8 +1426,8 @@ packages:
       '@types/react':
         optional: true
 
-  '@radix-ui/react-use-controllable-state@1.3.0':
-    resolution: {integrity: sha512-TAcBI7bw2ljYCbv4+zuTSd6zICu8pRt6SDN2vJ/Z06K2MXh6I9WYFe/A9ovlFDtR5HVHGm5iDxDoABm/++dbKg==}
+  '@radix-ui/react-use-controllable-state@1.2.2':
+    resolution: {integrity: sha512-BjasUjixPFdS+NKkypcyyN5Pmg83Olst0+c6vGov0diwTEo6mgdqVR6hxcEgFuh4QrAs7Rc+9KuGJ9TVCj0Zzg==}
     peerDependencies:
       '@types/react': '*'
       react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
@@ -1432,8 +1435,8 @@ packages:
       '@types/react':
         optional: true
 
-  '@radix-ui/react-use-effect-event@0.0.5':
-    resolution: {integrity: sha512-7cshFL8HGS/7HEiHH+9kL9HBwp2sa9yX18Knwek6KYWmXwM7pegMgta2AXMQKI+rq3JnfSj9x8wYqFMTdG1Jgg==}
+  '@radix-ui/react-use-effect-event@0.0.2':
+    resolution: {integrity: sha512-Qp8WbZOBe+blgpuUT+lw2xheLP8q0oatc9UpmiemEICxGvFLYmHm9QowVZGHtJlGbS6A6yJ3iViad/2cVjnOiA==}
     peerDependencies:
       '@types/react': '*'
       react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
@@ -1441,8 +1444,8 @@ packages:
       '@types/react':
         optional: true
 
-  '@radix-ui/react-use-escape-keydown@1.1.6':
-    resolution: {integrity: sha512-9cRullnQRv+kqnRmFlmh0WC3kAPuGmHiQ9VwsXdrYk//sBhgCKEttcpPEPgIQbyx6TGUmooVEHYTyohwz/lSJg==}
+  '@radix-ui/react-use-escape-keydown@1.1.1':
+    resolution: {integrity: sha512-Il0+boE7w/XebUHyBjroE+DbByORGR9KKmITzbR7MyQ4akpORYP/ZmbhAr0DG7RmmBqoOnZdy2QlvajJ2QA59g==}
     peerDependencies:
       '@types/react': '*'
       react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
@@ -1450,8 +1453,8 @@ packages:
       '@types/react':
         optional: true
 
-  '@radix-ui/react-use-is-hydrated@0.1.3':
-    resolution: {integrity: sha512-umO/aJ+82CpOnhDZUTbILCQf7kU/g0iv+oGs/Q8jw7IkhWBzaEP4sA268PhFAJTFetbwp3ICc6ktpI4TqtxcIw==}
+  '@radix-ui/react-use-is-hydrated@0.1.0':
+    resolution: {integrity: sha512-U+UORVEq+cTnRIaostJv9AGdV3G6Y+zbVd+12e18jQ5A3c0xL03IhnHuiU4UV69wolOQp5GfR58NW/EgdQhwOA==}
     peerDependencies:
       '@types/react': '*'
       react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
@@ -1459,8 +1462,8 @@ packages:
       '@types/react':
         optional: true
 
-  '@radix-ui/react-use-layout-effect@1.1.4':
-    resolution: {integrity: sha512-K20DkRkUwDnxEYMBPcg3Y6voLkEy5p5QQmszZgLngKKiC7dzBR/aEuK3w1qlx2JWDUNH6FluahYdgR3BP+QbYw==}
+  '@radix-ui/react-use-layout-effect@1.1.1':
+    resolution: {integrity: sha512-RbJRS4UWQFkzHTTwVymMTUv8EqYhOp8dOOviLj2ugtTiXRaRQS7GLGxZTLL1jWhMeoSCf5zmcZkqTl9IiYfXcQ==}
     peerDependencies:
       '@types/react': '*'
       react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
@@ -1468,8 +1471,8 @@ packages:
       '@types/react':
         optional: true
 
-  '@radix-ui/react-use-previous@1.1.4':
-    resolution: {integrity: sha512-XoSLhbRbqxFtgJoi2fNHA3C6pDlY34x508vUpUGoFZfvePfHXHbE1lC4FYFMnJWgiCRroSTw6fOsXQoVS9RwZg==}
+  '@radix-ui/react-use-previous@1.1.1':
+    resolution: {integrity: sha512-2dHfToCj/pzca2Ck724OZ5L0EVrr3eHRNsG/b3xQJLA2hZpVCS99bLAX+hm1IHXDEnzU6by5z/5MIY794/a8NQ==}
     peerDependencies:
       '@types/react': '*'
       react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
@@ -1477,8 +1480,8 @@ packages:
       '@types/react':
         optional: true
 
-  '@radix-ui/react-use-rect@1.1.4':
-    resolution: {integrity: sha512-cSOCh6JlkmfjLyNcLiu2nB4v+nm+dkZ+Q5KHWk/soo4U7ZLiEQFKHK9/YmtBHjfCEaU43IBKQOc4/uJmCaiCTQ==}
+  '@radix-ui/react-use-rect@1.1.1':
+    resolution: {integrity: sha512-QTYuDesS0VtuHNNvMh+CjlKJ4LJickCMUAqjlE3+j8w+RlRpwyX3apEQKGFzbZGdo7XNG1tXa+bQqIE7HIXT2w==}
     peerDependencies:
       '@types/react': '*'
       react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
@@ -1486,8 +1489,8 @@ packages:
       '@types/react':
         optional: true
 
-  '@radix-ui/react-use-size@1.1.5':
-    resolution: {integrity: sha512-V1McDQkMGzgivwqdu7u96APs7oi0Jvj9LTzgq3WWrDZqxWdAqU9yZnZQqk5OizGFR8badUQwZsrlao7MOlWYOA==}
+  '@radix-ui/react-use-size@1.1.1':
+    resolution: {integrity: sha512-ewrXRDTAqAXlkl6t/fkXWNAhFX9I+CkKlw6zjEwk86RSPKwZr3xpBRso655aqYafwtnbpHLj6toFzmd6xdVptQ==}
     peerDependencies:
       '@types/react': '*'
       react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
@@ -1495,8 +1498,8 @@ packages:
       '@types/react':
         optional: true
 
-  '@radix-ui/react-visually-hidden@1.2.13':
-    resolution: {integrity: sha512-feijiN1oPk4rck4u9Dm9tsU4mT6Wp9oeEEhaz1WUEs1VuqLf8xzsFG+Qk+uWq6TnMH9O+WRECRg0NftyP9E4Fw==}
+  '@radix-ui/react-visually-hidden@1.2.3':
+    resolution: {integrity: sha512-pzJq12tEaaIhqjbzpCuv/OypJY/BPavOofm+dbab+MHLajy277+1lLm6JFcGgF5eskJ6mquGirhXY2GD/8u8Ug==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -1508,8 +1511,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/rect@1.1.3':
-    resolution: {integrity: sha512-JtyZR+mqgBibTo8xea3B6ZRmzZiM/YeVBtUkas6zMuXjAlfIFIW2FgqeM9eLyvEaYX66vr6DJMK+4U6LV0KhNw==}
+  '@radix-ui/rect@1.1.1':
+    resolution: {integrity: sha512-HPwpGIzkl28mWyZqG52jiqDJ12waP11Pa1lGoiyUkIEuMLBP0oeK/C89esbXrxsky5we7dfd8U58nm0SgAWpVw==}
 
   '@redocly/ajv@8.11.2':
     resolution: {integrity: sha512-io1JpnwtIcvojV7QKDUSIuMN/ikdOUd1ReEnUnMKGfDVridQZ31J0MmIuqwuRjWDZfmvr+Q0MqCcfHM2gTivOg==}
@@ -1521,216 +1524,213 @@ packages:
     resolution: {integrity: sha512-o/0VgsBXgwcY1lyeqcVtSGdTQAPnVggo0fbFVPlxl5XVDKUcVH0OLRqt3CbkwByT5FU305E0iE0O7MzThjDblw==}
     engines: {node: '>=18.17.0', npm: '>=9.5.0'}
 
-  '@remix-run/route-pattern@0.22.1':
-    resolution: {integrity: sha512-czdGJWh09Lapvcqt7Vb09KlrU2PhRJ8xQaI+AItTuD9aDJ5MAgxnS38lnys6Ll+6RJEqPiaUqTwIQhVLwFvv+w==}
-
   '@rolldown/pluginutils@1.0.0-beta.27':
     resolution: {integrity: sha512-+d0F4MKMCbeVUJwG96uQ4SgAznZNSq93I3V+9NHA4OpvqG8mRCpGdKmK8l/dl02h2CCDHwW2FqilnTyDcAnqjA==}
 
-  '@rollup/rollup-android-arm-eabi@4.64.5':
-    resolution: {integrity: sha512-MrfgRQSpD5hkkRg6XI16B6EDLb+6+xp8xje6bpdSwkYw+qxrBKbUVrRAQu9h82UT+QumSIVQ8HXsXjPd2dlhqw==}
+  '@rollup/rollup-android-arm-eabi@4.62.0':
+    resolution: {integrity: sha512-IPIQ55ythEHkfEd9jMEi32OQ7SxURsGA43JI22lj01OLZNt2NUbJX8YUHxkVWyQ6daHPNn0truF5nSj3DQp6YQ==}
     cpu: [arm]
     os: [android]
 
-  '@rollup/rollup-android-arm64@4.64.5':
-    resolution: {integrity: sha512-+uu2p/R9Tzn8GpoQyX1pAo5dmKT1DhXevfaCzqzmPFhnLjHLWw7uWkaVGlxmhwYoRiYYhsGfRcD5cTBpL7rgSw==}
+  '@rollup/rollup-android-arm64@4.62.0':
+    resolution: {integrity: sha512-M6s9cr10MibETyo8JsOkq+Lo1+lU6hcvb1MApnUql5qte/5hMEgzlN8/ReIKNfRV8rrqX50W1BX9zoUhC192RA==}
     cpu: [arm64]
     os: [android]
 
-  '@rollup/rollup-darwin-arm64@4.64.5':
-    resolution: {integrity: sha512-17dys+YEmzwzzFVHQAVDONg5FALXY9kd99HFEpfk4gJVHYxoh5bGea3D4t1fXXnwkTcOe25wPyd6nWS0I8IdLQ==}
+  '@rollup/rollup-darwin-arm64@4.62.0':
+    resolution: {integrity: sha512-BqCoMoIbn0keKys+dEAdBa70EtOwV1bEsQCUgU9FdiZmmMge/Zk7LlkYGqbrdHR+Frnt0E1FOanly+rlwvvQzw==}
     cpu: [arm64]
     os: [darwin]
 
-  '@rollup/rollup-darwin-x64@4.64.5':
-    resolution: {integrity: sha512-wg0zQEKkEvFZf1UaaX1UELOoPs//OSKUG7D+yITuqOsAvza7LvHTv5Wu4nmMfzNG7EYI2jp2PJC7Id6OETmsYQ==}
+  '@rollup/rollup-darwin-x64@4.62.0':
+    resolution: {integrity: sha512-SIMzST3VFNXDAbeIWDWiFCNM5qncUBDWaEV7NfE7oZbDt2mgfW4MvbKdbYiGOLoM32gbTv608UMd0XktEYSD7w==}
     cpu: [x64]
     os: [darwin]
 
-  '@rollup/rollup-freebsd-arm64@4.64.5':
-    resolution: {integrity: sha512-CoJmWcpEMuwin+TZ/ev/H9uDyF/uxUKQSWXdmIPn/UBx/uGV9+4ebMp0FwnlhWR9PE1AdzYsKf3bZevhif38+A==}
+  '@rollup/rollup-freebsd-arm64@4.62.0':
+    resolution: {integrity: sha512-ezjfSQMP7ArdUsbBwbQIfwAlhE84I2iVnzQNCFSveqV42q+BmKlzVpf7mxv5EchLcoWU4y6/heFzVg1F+hodUQ==}
     cpu: [arm64]
     os: [freebsd]
 
-  '@rollup/rollup-freebsd-x64@4.64.5':
-    resolution: {integrity: sha512-PxZnLAaTUAL5xG0W2BXLeYPKrK2b3LIASV2/e/Kf7PZvSLI1iAQIm9B9aJD+YyFIT7hc6qaMV3+OOO35R28LfA==}
+  '@rollup/rollup-freebsd-x64@4.62.0':
+    resolution: {integrity: sha512-9+qTWGW9AZRhnUgwtTwzNwcPlL87ngkeN0LA+q1bADvmY9aNvWaF2TFW8BZgnQPYxpDI7+rMVLivcd4V737TAQ==}
     cpu: [x64]
     os: [freebsd]
 
-  '@rollup/rollup-linux-arm-gnueabihf@4.64.5':
-    resolution: {integrity: sha512-uPo3IvnONjhbFXwWgroBeFwOicuhT7ZwQrnzkzmOtBJzeQbkUJUE1SJDfDI31ijQ5+ZUIA6sPrdUMxTSnxUWAg==}
+  '@rollup/rollup-linux-arm-gnueabihf@4.62.0':
+    resolution: {integrity: sha512-T1dMEQhXA/jkJ/jyMIw9IovK8bSUq7A8kLIlvZTb/6YIVsp2zLavr4F3oyllHWo7eIVJRyE5n3tUjQJEbE1IuQ==}
     cpu: [arm]
     os: [linux]
     libc: [glibc]
 
-  '@rollup/rollup-linux-arm-musleabihf@4.64.5':
-    resolution: {integrity: sha512-ywI8Jyuc4LyHYTjC0mw4yA1ulvZBkHusdpWnoiEBsmBuHvSnt90btTBGCZ+s/2y+YNNfVAEKy33nPo5UI9zTmg==}
+  '@rollup/rollup-linux-arm-musleabihf@4.62.0':
+    resolution: {integrity: sha512-2as0LgT7qQpyceQq6VUJYnumUMUrgGQCWIiDIN9DE0/tglsk6o66uCB4f3djRawAltvfCNLyZZrsqbPA6inCsA==}
     cpu: [arm]
     os: [linux]
     libc: [musl]
 
-  '@rollup/rollup-linux-arm64-gnu@4.64.5':
-    resolution: {integrity: sha512-tmuXJoQ/3ovSr637aykZMdQteU/CB2APAz2CrvsbibuoHZi1BS1Db13cVViBdEARGwXCLn1DSJ8wsjoThLJPGA==}
+  '@rollup/rollup-linux-arm64-gnu@4.62.0':
+    resolution: {integrity: sha512-bVURMg+6eNN9C/yc0aVjooZcwTTtYF4YW3xta5pP0//r3o1V8gXEHXWCndj47w/HhwsFroZrFhR+6uQP5T0n0g==}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@rollup/rollup-linux-arm64-musl@4.64.5':
-    resolution: {integrity: sha512-5FMjSYNcUOHx7oW8Qu9KB6jGPpvF/8sG7+BDHwU/Ihh1/6FMJ9ySmsFG4tJ1qbNRuP8OLzCBDso4sF0mQaLuFQ==}
+  '@rollup/rollup-linux-arm64-musl@4.62.0':
+    resolution: {integrity: sha512-Ful8pM/2yYI83PViWdFdpZhdI8HJ5qsXANe5atypbHDf+KIBBDsZsbyy8hbXnULVvW9NsTh5DHwbcBftyLTfiw==}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@rollup/rollup-linux-loong64-gnu@4.64.5':
-    resolution: {integrity: sha512-K8ZJ+neLDbUkIrL8dqF/5LtuVCrKwo27kREgOlxjBEjlOXwHvDnHLU8Z/UKv/B49qi7e8hsSDOyoJwhwqhvX4w==}
+  '@rollup/rollup-linux-loong64-gnu@4.62.0':
+    resolution: {integrity: sha512-9Gp/DgrkzfUBmNPVTyPTvay+4xEP7M/clXpj3efXBcm6uTIVIgDg4rqUpqKXvLEuFRVuEpSAOkhgNeecvaZ4Cg==}
     cpu: [loong64]
     os: [linux]
     libc: [glibc]
 
-  '@rollup/rollup-linux-loong64-musl@4.64.5':
-    resolution: {integrity: sha512-NlVxsq7PFPv0DBKGuNWRDKixQYQCjM53zl04mxEcKMBmJbCBIUm1JdPfIWDRHyOOFzzYPmLQzfeEwh4716ayQg==}
+  '@rollup/rollup-linux-loong64-musl@4.62.0':
+    resolution: {integrity: sha512-m9tsJz54LUXkSYM8+8PG81B9IKK5r+2T0clMq4QrS16xFosufU7firBDAZEsDheDs7wTlP7h3++S7lMsU955HA==}
     cpu: [loong64]
     os: [linux]
     libc: [musl]
 
-  '@rollup/rollup-linux-ppc64-gnu@4.64.5':
-    resolution: {integrity: sha512-ARhRHJYs5eCFet5azfrHD97vOkD8OzNW2RSMlvo5CcBqXaTOLfp0OHDtUQh7/K5AL5fUYoFp2fgC9KDg4vVYMQ==}
+  '@rollup/rollup-linux-ppc64-gnu@4.62.0':
+    resolution: {integrity: sha512-3UvJ5PNVU16aJf6M3tFI24pWzAl2/ynfbyRN3ICyQajK1lSkrnVYNnLz3v04J32qKa0FczJc22zeToc0lr2A3w==}
     cpu: [ppc64]
     os: [linux]
     libc: [glibc]
 
-  '@rollup/rollup-linux-ppc64-musl@4.64.5':
-    resolution: {integrity: sha512-atSgreM5C7jpxd9aEXN+6vJ5wTd05iYw+S3FiQpw7VsoEl8B90llbq35ARON+GOHj5QlVQEq2vOKWCHTob/BSQ==}
+  '@rollup/rollup-linux-ppc64-musl@4.62.0':
+    resolution: {integrity: sha512-vRWUAbYLGHBZS6Q8Msb2sfnf1fvJf+47t8l/TwOerM2qArzy+IeNMTHrYLHXh95h8MoatPHI5hhSZNs+mGXKPg==}
     cpu: [ppc64]
     os: [linux]
     libc: [musl]
 
-  '@rollup/rollup-linux-riscv64-gnu@4.64.5':
-    resolution: {integrity: sha512-vmlmwBFGnjVWxSRoVabNkyYuscSmg52Pd0fM8jEbNT3Jmka4A6HcB84x4uAmuumznWfBVaxKOqU6jbEgomWKCA==}
+  '@rollup/rollup-linux-riscv64-gnu@4.62.0':
+    resolution: {integrity: sha512-c00T5SYENHAt86cfW47URaP3Us5vLC/4QO7GYud1G5VNRffCwwCuBspwqYrriuJB+5m0WFzClCn9wed0FBjKvg==}
     cpu: [riscv64]
     os: [linux]
     libc: [glibc]
 
-  '@rollup/rollup-linux-riscv64-musl@4.64.5':
-    resolution: {integrity: sha512-hhJrP6S9WkbsbcHgUkvCBS5Cn8IdsG8XjlLZyxjnv9+NdoYfbbZE4TWJYr8apdaj1M5t5Y1id2StnEslxpNFyA==}
+  '@rollup/rollup-linux-riscv64-musl@4.62.0':
+    resolution: {integrity: sha512-krrCDilhXOwFkSkO3Wm9I/f9H0L92XHHwy2fwxjukxIbh0dem8gZqOW5Y8BsHrpJv5qwlRBV+Wl4ZFyRWhUpwg==}
     cpu: [riscv64]
     os: [linux]
     libc: [musl]
 
-  '@rollup/rollup-linux-s390x-gnu@4.64.5':
-    resolution: {integrity: sha512-NNVCyN9pGrwFmQa4bf+Cnf5aVH3g6ZpnlOg1Cs/H9swIHT9bRixijfzUqyEIWm1WtiAuR1LJ+rJH6zpBm8kgQA==}
+  '@rollup/rollup-linux-s390x-gnu@4.62.0':
+    resolution: {integrity: sha512-7pfYFSTc4/rUC/FtAI0Qp6QthDBCIi6/AuP1xYqFk5vanI6KnL5dWKP60OM/05LOsbwTmIcvr6eXC4CJuJ75IA==}
     cpu: [s390x]
     os: [linux]
     libc: [glibc]
 
-  '@rollup/rollup-linux-x64-gnu@4.64.5':
-    resolution: {integrity: sha512-dR9nd6OKnvSS60Ifz/L7Mj5zzYyoqyRn2NwTuaOONKaa3xsVGXyp8YusMbvFyEOR94DxnwgcbgsFqkHd29ZSzQ==}
+  '@rollup/rollup-linux-x64-gnu@4.62.0':
+    resolution: {integrity: sha512-7SDIalKeIpG0Ifogbbdn58HmSotYMlf23K3dCJEmiVd9Fg36Vmni82iPQec27N3wY4Bvbxftkxz6vSx9OcouTg==}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@rollup/rollup-linux-x64-musl@4.64.5':
-    resolution: {integrity: sha512-1tzsMjaqhsh3bAO6SJiJqh8hIr9sSPRd+i2vPPxJHod8/XYnf9TEnK0z/u3r1z1AkI347X0KbRSg9dWcxeGahw==}
+  '@rollup/rollup-linux-x64-musl@4.62.0':
+    resolution: {integrity: sha512-eRZevouTH2i1HeAVLqJuLnt256krQkGY0TN6WsTmsIhuzbh457HuWDMakKwmi0Cjadux983CoSr8Lim2QhUIFw==}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@rollup/rollup-openbsd-x64@4.64.5':
-    resolution: {integrity: sha512-01mWMQblKoXXsmk28KXtpbA96w7g/aOWUoV3AC16fdHdqkykGalqyyM+5u8M7uP5/MEMiiPv69Hv7iv/hEH/dA==}
+  '@rollup/rollup-openbsd-x64@4.62.0':
+    resolution: {integrity: sha512-3oVS7FLGa4U1qcvao9ylGxrjXZyUQqR8UwxEcnUEyPX53O/C/mKDZegNXTdHCP+h3e6ta/f1EN38Yif1mmZHYg==}
     cpu: [x64]
     os: [openbsd]
 
-  '@rollup/rollup-openharmony-arm64@4.64.5':
-    resolution: {integrity: sha512-trdnMPb/DNm4V/CgsaoGgr90HfQQ071wfK0KoIs4YpLvjBgVQGXhGabg2Z6nK4EcYNilrb9ZZPcsP6+zpJIdxQ==}
+  '@rollup/rollup-openharmony-arm64@4.62.0':
+    resolution: {integrity: sha512-yTB9TgfWj5wHe5QgktAgXTLLot1gvEjl1NiPPAUiCs4oPrIWFl5V4nC3GrkNdj9LaAU4s94nVrGbGOCqUpyWsg==}
     cpu: [arm64]
     os: [openharmony]
 
-  '@rollup/rollup-win32-arm64-msvc@4.64.5':
-    resolution: {integrity: sha512-x2LxZlfdfsw99T6/qb9EqE/Qi84JWzibjyOJyhJsgFJy6CafaTiqIXCCnslCGrV5XWNh7fwrS3FbRENcuKnooA==}
+  '@rollup/rollup-win32-arm64-msvc@4.62.0':
+    resolution: {integrity: sha512-5LOhoaesY3doG1c+ac/2JtgREpKoJr5bUHH8tKY0V8di7+uSV6BwLs2PlR0/yzefGOkR+wE7ZolZphHCsyG5Rw==}
     cpu: [arm64]
     os: [win32]
 
-  '@rollup/rollup-win32-ia32-msvc@4.64.5':
-    resolution: {integrity: sha512-/Qd/9aDQIo0+jmItgBmPIs8195YVbDxRRApn47GyufgbutCDOh7eP5vSKKlI4QNFeaI+wKQAkSMsPnF3EuMpaA==}
+  '@rollup/rollup-win32-ia32-msvc@4.62.0':
+    resolution: {integrity: sha512-yYkWHhmbhRTWTnWos5HC4GcPQfjlzzCNbM9e/+GXrLuaBXYA3qSDR9f0Vgufd5S8yX81U8jPKp7ZnAjZFMtRnw==}
     cpu: [ia32]
     os: [win32]
 
-  '@rollup/rollup-win32-x64-gnu@4.64.5':
-    resolution: {integrity: sha512-ngUJ/XvOWrqbd2IMsfXfh2xXFLTP3sY7sCKvxbGvYdBZ1KmXFd3ewDZ9n3/GNzAUgzRuhLT/UvJRivbNoAQRBw==}
+  '@rollup/rollup-win32-x64-gnu@4.62.0':
+    resolution: {integrity: sha512-SoTb6lPg25xZlA2ibwQ++ahCCnH+FP0qmEuafMJ4gznZKOlXioKEAeJLgCrqjM98ACziXM9V1amFjICVL4IFoA==}
     cpu: [x64]
     os: [win32]
 
-  '@rollup/rollup-win32-x64-msvc@4.64.5':
-    resolution: {integrity: sha512-IhV6ew/DuzUWwHaYmlh7MrPCV3lKFUq/amTEwysi4r/mwNPAEfAMh5dYWeTSPTeMy2pFHGMEWYtPkHzfX3tG5A==}
+  '@rollup/rollup-win32-x64-msvc@4.62.0':
+    resolution: {integrity: sha512-5L+T1fMX4RIEBoZzT0+sQ0PhTS36NULFmMXtl1TZo44TMAROIMHbZufSOjVWt/Y622BtxgxtaNOokbTDvfsrZA==}
     cpu: [x64]
     os: [win32]
 
   '@standard-schema/spec@1.1.0':
     resolution: {integrity: sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w==}
 
-  '@tailwindcss/node@4.3.3':
-    resolution: {integrity: sha512-/T8IKEsf9VTU6tLjgC7+sv2mOPtQxzE2jMw7u4Tt40Tx+QSZxpzh95/H6cMKoja9XuW7iMdLJYBB0o9G1CaAgg==}
+  '@tailwindcss/node@4.2.1':
+    resolution: {integrity: sha512-jlx6sLk4EOwO6hHe1oCGm1Q4AN/s0rSrTTPBGPM0/RQ6Uylwq17FuU8IeJJKEjtc6K6O07zsvP+gDO6MMWo7pg==}
 
-  '@tailwindcss/oxide-android-arm64@4.3.3':
-    resolution: {integrity: sha512-Y85A2gmPSkl5Ve5qR86GL4HT509cFqQh1aes9p3sSkyTPwt0Pppf3GkwGe4JPACcRYjgJIEhQgM6dBClnr0NYw==}
+  '@tailwindcss/oxide-android-arm64@4.2.1':
+    resolution: {integrity: sha512-eZ7G1Zm5EC8OOKaesIKuw77jw++QJ2lL9N+dDpdQiAB/c/B2wDh0QPFHbkBVrXnwNugvrbJFk1gK2SsVjwWReg==}
     engines: {node: '>= 20'}
     cpu: [arm64]
     os: [android]
 
-  '@tailwindcss/oxide-darwin-arm64@4.3.3':
-    resolution: {integrity: sha512-BiaWatpBcERQFDlOjRDpIVXuFK5PJez5SA4JMg6VYZdBYU+qKfV/vqjcIs+IYmtitf1xYQZTwXvU/8y4lfZUGw==}
+  '@tailwindcss/oxide-darwin-arm64@4.2.1':
+    resolution: {integrity: sha512-q/LHkOstoJ7pI1J0q6djesLzRvQSIfEto148ppAd+BVQK0JYjQIFSK3JgYZJa+Yzi0DDa52ZsQx2rqytBnf8Hw==}
     engines: {node: '>= 20'}
     cpu: [arm64]
     os: [darwin]
 
-  '@tailwindcss/oxide-darwin-x64@4.3.3':
-    resolution: {integrity: sha512-fAeUqfV5ndhxRwai8cXGzdLvul9utWOmeTkv69unv4ZXixjn61Z+p9lCWdwOwA3TYboG3BwdVuN/RDjhBRl0mw==}
+  '@tailwindcss/oxide-darwin-x64@4.2.1':
+    resolution: {integrity: sha512-/f/ozlaXGY6QLbpvd/kFTro2l18f7dHKpB+ieXz+Cijl4Mt9AI2rTrpq7V+t04nK+j9XBQHnSMdeQRhbGyt6fw==}
     engines: {node: '>= 20'}
     cpu: [x64]
     os: [darwin]
 
-  '@tailwindcss/oxide-freebsd-x64@4.3.3':
-    resolution: {integrity: sha512-iyf5bV6+wnAlflVeEy7R25dupxTNECZN5QMI0qNT6eT+EgaGdZcKhGkr5SdoaWiLJ3spLqIY9VCeSGrwmtg4kw==}
+  '@tailwindcss/oxide-freebsd-x64@4.2.1':
+    resolution: {integrity: sha512-5e/AkgYJT/cpbkys/OU2Ei2jdETCLlifwm7ogMC7/hksI2fC3iiq6OcXwjibcIjPung0kRtR3TxEITkqgn0TcA==}
     engines: {node: '>= 20'}
     cpu: [x64]
     os: [freebsd]
 
-  '@tailwindcss/oxide-linux-arm-gnueabihf@4.3.3':
-    resolution: {integrity: sha512-aAYUprJAJQWWbRrPvtjdroZ56Md+JM8pMiopS6xGEwDfLhqj+2ver2p4nU4Mb3CRqcMmNBjo8KkUgcxhkzVQGQ==}
+  '@tailwindcss/oxide-linux-arm-gnueabihf@4.2.1':
+    resolution: {integrity: sha512-Uny1EcVTTmerCKt/1ZuKTkb0x8ZaiuYucg2/kImO5A5Y/kBz41/+j0gxUZl+hTF3xkWpDmHX+TaWhOtba2Fyuw==}
     engines: {node: '>= 20'}
     cpu: [arm]
     os: [linux]
 
-  '@tailwindcss/oxide-linux-arm64-gnu@4.3.3':
-    resolution: {integrity: sha512-nDxldcEENOxZRzC2uu9jrutZdAAQtb+8WWDCSnWL1zvBk1+FN+x6MtDViPB5AJMfttVCUhehGWus3XBPgatM/w==}
+  '@tailwindcss/oxide-linux-arm64-gnu@4.2.1':
+    resolution: {integrity: sha512-CTrwomI+c7n6aSSQlsPL0roRiNMDQ/YzMD9EjcR+H4f0I1SQ8QqIuPnsVp7QgMkC1Qi8rtkekLkOFjo7OlEFRQ==}
     engines: {node: '>= 20'}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@tailwindcss/oxide-linux-arm64-musl@4.3.3':
-    resolution: {integrity: sha512-Md44bD6veX/PC5iyF8cDVnw4HBIANZepRZZ7a8DQOvkfo5WUBwcp6iAuCUz23u+4SUkhJlD3eL7hNdW8ezd/kA==}
+  '@tailwindcss/oxide-linux-arm64-musl@4.2.1':
+    resolution: {integrity: sha512-WZA0CHRL/SP1TRbA5mp9htsppSEkWuQ4KsSUumYQnyl8ZdT39ntwqmz4IUHGN6p4XdSlYfJwM4rRzZLShHsGAQ==}
     engines: {node: '>= 20'}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@tailwindcss/oxide-linux-x64-gnu@4.3.3':
-    resolution: {integrity: sha512-tx7us1muwOKAKWao2v/GaafFeQboE6aj88vC6ziN2NCGcRm8gWUhwjzg+YdVB1e4boAtdtma4L43onunI6NS4w==}
+  '@tailwindcss/oxide-linux-x64-gnu@4.2.1':
+    resolution: {integrity: sha512-qMFzxI2YlBOLW5PhblzuSWlWfwLHaneBE0xHzLrBgNtqN6mWfs+qYbhryGSXQjFYB1Dzf5w+LN5qbUTPhW7Y5g==}
     engines: {node: '>= 20'}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@tailwindcss/oxide-linux-x64-musl@4.3.3':
-    resolution: {integrity: sha512-SJxX60smvHgasZoBy11dX6YRjXJFovwWBoedhbQPOBzgFWBHGB+TVPWB9BxzR7TTxU8FQZAI2AyiNCMzFm8Img==}
+  '@tailwindcss/oxide-linux-x64-musl@4.2.1':
+    resolution: {integrity: sha512-5r1X2FKnCMUPlXTWRYpHdPYUY6a1Ar/t7P24OuiEdEOmms5lyqjDRvVY1yy9Rmioh+AunQ0rWiOTPE8F9A3v5g==}
     engines: {node: '>= 20'}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@tailwindcss/oxide-wasm32-wasi@4.3.3':
-    resolution: {integrity: sha512-jx1+rPhY/5Ympkktd656HBWEBLxP7dH06losBLjjf5vgCODXvi9KhtftWcMIwTFIDqBr7cRnQkdLnAG+IOlGvQ==}
+  '@tailwindcss/oxide-wasm32-wasi@4.2.1':
+    resolution: {integrity: sha512-MGFB5cVPvshR85MTJkEvqDUnuNoysrsRxd6vnk1Lf2tbiqNlXpHYZqkqOQalydienEWOHHFyyuTSYRsLfxFJ2Q==}
     engines: {node: '>=14.0.0'}
     cpu: [wasm32]
     bundledDependencies:
@@ -1741,43 +1741,43 @@ packages:
       - '@emnapi/wasi-threads'
       - tslib
 
-  '@tailwindcss/oxide-win32-arm64-msvc@4.3.3':
-    resolution: {integrity: sha512-3rc292Ca2ceK6Ulcc/bAVnTs/3nDtoPhyEKlgPv+yQJQi/JS/AMJlqzxvlDacL1nekbrcf6bTqp/jV4qgnPxNQ==}
+  '@tailwindcss/oxide-win32-arm64-msvc@4.2.1':
+    resolution: {integrity: sha512-YlUEHRHBGnCMh4Nj4GnqQyBtsshUPdiNroZj8VPkvTZSoHsilRCwXcVKnG9kyi0ZFAS/3u+qKHBdDc81SADTRA==}
     engines: {node: '>= 20'}
     cpu: [arm64]
     os: [win32]
 
-  '@tailwindcss/oxide-win32-x64-msvc@4.3.3':
-    resolution: {integrity: sha512-yJ0pwIVc/nYeGoV02WtsN8KYyLQv7kyI2wDnkezyJlGGjkd4QLwDGAwl47YpPJeuI0M0ObaXGSPjvWDPeTPggw==}
+  '@tailwindcss/oxide-win32-x64-msvc@4.2.1':
+    resolution: {integrity: sha512-rbO34G5sMWWyrN/idLeVxAZgAKWrn5LiR3/I90Q9MkA67s6T1oB0xtTe+0heoBvHSpbU9Mk7i6uwJnpo4u21XQ==}
     engines: {node: '>= 20'}
     cpu: [x64]
     os: [win32]
 
-  '@tailwindcss/oxide@4.3.3':
-    resolution: {integrity: sha512-krXjAikiaFSPaK/FkAQT5UTx3VormQaiZ5hBFlJZ9UFQGB/rwg1MZIhHAG9smMQRTdyJxP6Qt5MwMtdyU5FWrA==}
+  '@tailwindcss/oxide@4.2.1':
+    resolution: {integrity: sha512-yv9jeEFWnjKCI6/T3Oq50yQEOqmpmpfzG1hcZsAOaXFQPfzWprWrlHSdGPEF3WQTi8zu8ohC9Mh9J470nT5pUw==}
     engines: {node: '>= 20'}
 
-  '@tailwindcss/vite@4.3.3':
-    resolution: {integrity: sha512-yYU8cogLeSh/ms2jh8Fj7jaba/EWa7Ja6GoUqYZaraEuCI5YS6ms6ObZgjjedm+jm6XZjdNRWBpPP6Z86oOxcw==}
+  '@tailwindcss/vite@4.2.1':
+    resolution: {integrity: sha512-TBf2sJjYeb28jD2U/OhwdW0bbOsxkWPwQ7SrqGf9sVcoYwZj7rkXljroBO9wKBut9XnmQLXanuDUeqQK0lGg/w==}
     peerDependencies:
       vite: 6.4.4
 
-  '@tanstack/query-core@5.104.2':
-    resolution: {integrity: sha512-/qbsxJK5c3Ve1aFIULWYNcT2jeRUAiD4HME6Eu2ZdpofHoVgAjpkQhLg5xHuOoBkTPQUJLfP7zOxy0qsBcqROA==}
+  '@tanstack/query-core@5.90.20':
+    resolution: {integrity: sha512-OMD2HLpNouXEfZJWcKeVKUgQ5n+n3A2JFmBaScpNDUqSrQSjiveC7dKMe53uJUg1nDG16ttFPz2xfilz6i2uVg==}
 
-  '@tanstack/react-query@5.104.2':
-    resolution: {integrity: sha512-xKmzWGhadbE5wGS/ZmXShRITnI9oItox5GO14KvFZco3+vhTAyXS1erYzJWdiY280zapAGJXFUL9nHgwP6SV/g==}
+  '@tanstack/react-query@5.90.21':
+    resolution: {integrity: sha512-0Lu6y5t+tvlTJMTO7oh5NSpJfpg/5D41LlThfepTixPYkJ0sE2Jj0m0f6yYqujBwIXlId87e234+MxG3D3g7kg==}
     peerDependencies:
       react: ^18 || ^19
 
-  '@tanstack/react-virtual@3.14.17':
-    resolution: {integrity: sha512-b7b5LwydgQAWcsAWEZyd3iZkN5/QcC6S0K5E1zNheyFoSZl7E78foepGeDHlX2+JuXilA+VIGGFsUYPFddOrig==}
+  '@tanstack/react-virtual@3.13.22':
+    resolution: {integrity: sha512-EaOrBBJLi3M0bTMQRjGkxLXRw7Gizwntoy5E2Q2UnSbML7Mo2a1P/Hfkw5tw9FLzK62bj34Jl6VNbQfRV6eJcA==}
     peerDependencies:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
 
-  '@tanstack/virtual-core@3.19.2':
-    resolution: {integrity: sha512-Ch+e8t097FdTfuihfRwBMqz/OfRZKHOH/C213dbM1lXDZ8bv6r330Bcc9k9XCrP6NkoMYy0/ZCHcddOAPihW4w==}
+  '@tanstack/virtual-core@3.13.22':
+    resolution: {integrity: sha512-isuUGKsc5TAPDoHSbWTbl1SCil54zOS2MiWz/9GCWHPUQOvNTQx8qJEWC7UWR0lShhbK0Lmkcf0SZYxvch7G3g==}
 
   '@testing-library/dom@10.4.1':
     resolution: {integrity: sha512-o4PXJQidqJl82ckFaXUeoAW+XysPLauYI43Abki5hABd853iMhitooc6znOnczgbTYmEP6U6/y1ZyKAIsvMKGg==}
@@ -1787,8 +1787,8 @@ packages:
     resolution: {integrity: sha512-zIcONa+hVtVSSep9UT3jZ5rizo2BsxgyDYU7WFD5eICBE7no3881HGeb/QkGfsJs6JTkY1aQhT7rIPC7e+0nnA==}
     engines: {node: '>=14', npm: '>=6', yarn: '>=1'}
 
-  '@testing-library/react@16.3.3':
-    resolution: {integrity: sha512-Uo193NgQbPMz6lrrhtRQQFcMC6Re/ELLFbbuVL30WDlZxlpZf9/lMHTAVxPRLw1q1iu9OJmR1c2BLiENRstdBg==}
+  '@testing-library/react@16.3.2':
+    resolution: {integrity: sha512-XU5/SytQM+ykqMnAnvB2umaJNIOsLF3PVv//1Ew4CTcpz0/BRyy/af40qqrt7SjKpDdT1saBMc42CUok5gaw+g==}
     engines: {node: '>=18'}
     peerDependencies:
       '@testing-library/dom': ^10.0.0
@@ -1802,8 +1802,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@testing-library/user-event@14.6.7':
-    resolution: {integrity: sha512-MPCpX8bxe8zS+JmmTwLp8jd0dy1rAm60Te/SL8JrQM3qvQJcBOs1d7IefJMyZzqM3EWBrDn/LWDt1BCGu4ASfg==}
+  '@testing-library/user-event@14.6.1':
+    resolution: {integrity: sha512-vq7fv0rnt+QTXgPxr5Hjc210p6YKq2kmdziLgnsZGgLJ9e6VAShx1pACLuRjd/AS/sr7phAR58OIIpf0LlmQNw==}
     engines: {node: '>=12', npm: '>=6'}
     peerDependencies:
       '@testing-library/dom': '>=7.21.4'
@@ -1829,84 +1829,93 @@ packages:
   '@types/deep-eql@4.0.2':
     resolution: {integrity: sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==}
 
+  '@types/dom-mediacapture-transform@0.1.12':
+    resolution: {integrity: sha512-d7/QsLRwF864A5mgIM/YrfiglHoYn7zgCcAoJgW404r+2DwnNr7EBbLnCWpmOMgH8y0te73L1AV6H1bmauaWFw==}
+
+  '@types/dom-webcodecs@0.1.13':
+    resolution: {integrity: sha512-O5hkiFIcjjszPIYyUSyvScyvrBoV3NOEEZx/pMlsu44TKzWNkLVBBxnxJz42in5n3QIolYOcBYFCPZZ0h8SkwQ==}
+
+  '@types/estree@1.0.8':
+    resolution: {integrity: sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==}
+
   '@types/estree@1.0.9':
     resolution: {integrity: sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==}
 
   '@types/json-schema@7.0.15':
     resolution: {integrity: sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==}
 
-  '@types/node@25.9.9':
-    resolution: {integrity: sha512-b4e2xxj/yMeT2hNlD6x7zNFiQK2Dlmkb9CQ6v3/1G2RezKN4YS2lcEv8lzGm1mhs4f2lM4yNAMI/zUDBZBBt7w==}
+  '@types/node@25.5.0':
+    resolution: {integrity: sha512-jp2P3tQMSxWugkCUKLRPVUpGaL5MVFwF8RDuSRztfwgN1wmqJeMSbKlnEtQqU8UrhTmzEmZdu2I6v2dpp7XIxw==}
 
-  '@types/react-dom@19.3.0':
-    resolution: {integrity: sha512-ZI7bU42mZXXKHn/qNLEw2IrbiINU7X5+vfgdixBHkCNpYWXjKgfQ/P+uyGb5CjOLB9UcnTeg3rylQtV2hym44Q==}
+  '@types/react-dom@19.2.3':
+    resolution: {integrity: sha512-jp2L/eY6fn+KgVVQAOqYItbF0VY/YApe5Mz2F0aykSO8gx31bYCZyvSeYxCHKvzHG5eZjc+zyaS5BrBWya2+kQ==}
     peerDependencies:
-      '@types/react': ^19.3.0
+      '@types/react': ^19.2.0
 
-  '@types/react@19.3.0':
-    resolution: {integrity: sha512-N0rFCuH9YoxG9/m61l9MfpJKfmLOVU0em7ipIz6TRgSSkvReLB9vL85GB+yr8Bs5leqpvg96JSwF4ZS1s4viQg==}
+  '@types/react@19.2.14':
+    resolution: {integrity: sha512-ilcTH/UniCkMdtexkoCN0bI7pMcJDvmQFPvuPvmEaYA/NSfFTAgdUSLAoVjaRJm7+6PvcM+q1zYOwS4wTYMF9w==}
 
-  '@typescript-eslint/eslint-plugin@8.71.2':
-    resolution: {integrity: sha512-K72/pvT7qpm8q3k8G5u93NCSN1RcLxX5h7Gw0bQpbMXviBHeY6Nx1WEwmk9wP+eKTSQ8ecxvcgt/ZX/rB938xQ==}
+  '@typescript-eslint/eslint-plugin@8.57.0':
+    resolution: {integrity: sha512-qeu4rTHR3/IaFORbD16gmjq9+rEs9fGKdX0kF6BKSfi+gCuG3RCKLlSBYzn/bGsY9Tj7KE/DAQStbp8AHJGHEQ==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
-      '@typescript-eslint/parser': ^8.71.2
+      '@typescript-eslint/parser': ^8.57.0
       eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
-      typescript: '>=4.8.4 <6.1.0'
+      typescript: '>=4.8.4 <6.0.0'
 
-  '@typescript-eslint/parser@8.71.2':
-    resolution: {integrity: sha512-aTtmZjp/x3gsGHkDs04/1I8kNogBJkpQaeGaN0PfiG43NzDEmW2n+OP5im9wfsvyX0yP1UZWBrAGtDBfH9jEVw==}
+  '@typescript-eslint/parser@8.57.0':
+    resolution: {integrity: sha512-XZzOmihLIr8AD1b9hL9ccNMzEMWt/dE2u7NyTY9jJG6YNiNthaD5XtUHVF2uCXZ15ng+z2hT3MVuxnUYhq6k1g==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
-      typescript: '>=4.8.4 <6.1.0'
+      typescript: '>=4.8.4 <6.0.0'
 
-  '@typescript-eslint/project-service@8.71.2':
-    resolution: {integrity: sha512-Pd68GsLVh5ZXlcEccFPdhSOvtHZ/2WU0XsA8zmXOS3F158lVlcTLhfQ6qvtL1RzbMie0Kp8xtbVwAg4nejKPHw==}
+  '@typescript-eslint/project-service@8.57.0':
+    resolution: {integrity: sha512-pR+dK0BlxCLxtWfaKQWtYr7MhKmzqZxuii+ZjuFlZlIGRZm22HnXFqa2eY+90MUz8/i80YJmzFGDUsi8dMOV5w==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
-      typescript: '>=4.8.4 <6.1.0'
+      typescript: '>=4.8.4 <6.0.0'
 
-  '@typescript-eslint/scope-manager@8.71.2':
-    resolution: {integrity: sha512-YF4wgg5iUX5Obywoac27B56FhozMNFhdJSbh11H5GBAwmBtfyRhmgTQqW9tRNNmHDvsZ2CX6UGzoz+YfYn2Leg==}
+  '@typescript-eslint/scope-manager@8.57.0':
+    resolution: {integrity: sha512-nvExQqAHF01lUM66MskSaZulpPL5pgy5hI5RfrxviLgzZVffB5yYzw27uK/ft8QnKXI2X0LBrHJFr1TaZtAibw==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@typescript-eslint/tsconfig-utils@8.71.2':
-    resolution: {integrity: sha512-jz49TAWokm/7yWD9/o837nYax9DyALxIPOImdImvVzo6canBCZYzin8zJyqNR5k1j9K1DE0bVvr0XYB+99uAdg==}
+  '@typescript-eslint/tsconfig-utils@8.57.0':
+    resolution: {integrity: sha512-LtXRihc5ytjJIQEH+xqjB0+YgsV4/tW35XKX3GTZHpWtcC8SPkT/d4tqdf1cKtesryHm2bgp6l555NYcT2NLvA==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
-      typescript: '>=4.8.4 <6.1.0'
+      typescript: '>=4.8.4 <6.0.0'
 
-  '@typescript-eslint/type-utils@8.71.2':
-    resolution: {integrity: sha512-cC8UaalCViJkb3rH/xLIvidEwoFRtMZMUqDjjJMGEKaTFwYRHYBcoczlEGHuvkHEO8svRDrgZ0yQgOArFmwang==}
+  '@typescript-eslint/type-utils@8.57.0':
+    resolution: {integrity: sha512-yjgh7gmDcJ1+TcEg8x3uWQmn8ifvSupnPfjP21twPKrDP/pTHlEQgmKcitzF/rzPSmv7QjJ90vRpN4U+zoUjwQ==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
-      typescript: '>=4.8.4 <6.1.0'
+      typescript: '>=4.8.4 <6.0.0'
 
-  '@typescript-eslint/types@8.71.2':
-    resolution: {integrity: sha512-y5Ukl3oVp7e/VGxqIoEXoeb/Roj71PAJ4WG/N/RGj+eeDvKRLM15kGr9MijLbN0i03S52zxu31Z98E5gWChJKw==}
+  '@typescript-eslint/types@8.57.0':
+    resolution: {integrity: sha512-dTLI8PEXhjUC7B9Kre+u0XznO696BhXcTlOn0/6kf1fHaQW8+VjJAVHJ3eTI14ZapTxdkOmc80HblPQLaEeJdg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@typescript-eslint/typescript-estree@8.71.2':
-    resolution: {integrity: sha512-DgNOEsl4pdYzwSL+N/Cl33tX1Hlw3FvId73LnKXfq7jnrF2viOEn7X+P7RBkkSWCVm92gnWd28GIC5vJuLREeA==}
+  '@typescript-eslint/typescript-estree@8.57.0':
+    resolution: {integrity: sha512-m7faHcyVg0BT3VdYTlX8GdJEM7COexXxS6KqGopxdtkQRvBanK377QDHr4W/vIPAR+ah9+B/RclSW5ldVniO1Q==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
-      typescript: '>=4.8.4 <6.1.0'
+      typescript: '>=4.8.4 <6.0.0'
 
-  '@typescript-eslint/utils@8.71.2':
-    resolution: {integrity: sha512-RyKa1G1M9rKHDhrk+HJtiF1MvLD5Ux2JW3TSkzw+02pRALdpJb+QzG1Y5em+LvCgzGwgg8H7mBRFKljNz7ImPw==}
+  '@typescript-eslint/utils@8.57.0':
+    resolution: {integrity: sha512-5iIHvpD3CZe06riAsbNxxreP+MuYgVUsV0n4bwLH//VJmgtt54sQeY2GszntJ4BjYCpMzrfVh2SBnUQTtys2lQ==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
-      typescript: '>=4.8.4 <6.1.0'
+      typescript: '>=4.8.4 <6.0.0'
 
-  '@typescript-eslint/visitor-keys@8.71.2':
-    resolution: {integrity: sha512-zozlN0UA32bSG2zkKAgQyRYSbEISVoyU6vvkKYo2aSny74D8Jh4e+POkJ6Lk0dlezZi5x7TtD+88Xb06IB8nhg==}
+  '@typescript-eslint/visitor-keys@8.57.0':
+    resolution: {integrity: sha512-zm6xx8UT/Xy2oSr2ZXD0pZo7Jx2XsCoID2IUh9YSTFRu7z+WdwYTRk6LhUftm1crwqbuoF6I8zAFeCMw0YjwDg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@uiw/codemirror-extensions-basic-setup@4.25.12':
-    resolution: {integrity: sha512-wR5lz7jbVcBGyiiLEObAmDikcc39KNqrrd4bdUhav85WZu48ttgnSf1YV+grHuMsj5l/WCw6u+r9ZuSfURJgiA==}
+  '@uiw/codemirror-extensions-basic-setup@4.25.10':
+    resolution: {integrity: sha512-P3vytLlpE62KYSWrMUnwDCv2lvaQDuDZzyj03mHntuHo5bSl34fRZpjTY3kQTPGuXHxkGSYpoPFFj+hMTqaaMQ==}
     peerDependencies:
       '@codemirror/autocomplete': '>=6.0.0'
       '@codemirror/commands': '>=6.0.0'
@@ -1916,8 +1925,8 @@ packages:
       '@codemirror/state': '>=6.0.0'
       '@codemirror/view': '>=6.0.0'
 
-  '@uiw/react-codemirror@4.25.12':
-    resolution: {integrity: sha512-RE0Gj/QesD7/JWPnJREG8Kq8brGv2NAH17iUECcBrLkqXzzEAgsj/4Qqvz/OlK8XWKmzlsenLRkObT9H+gYQ0w==}
+  '@uiw/react-codemirror@4.25.10':
+    resolution: {integrity: sha512-DzgSMwM5qzB7v1FIb4gEeriYt67iiay756/HIOM9mAbeOVK0MO7rqefHf0O5c0269pJKMW7AH9FjclExD23V9w==}
     peerDependencies:
       '@babel/runtime': '>=7.11.0'
       '@codemirror/state': '>=6.0.0'
@@ -1933,11 +1942,11 @@ packages:
     peerDependencies:
       vite: 6.4.4
 
-  '@vitest/coverage-v8@4.1.11':
-    resolution: {integrity: sha512-8MVGEFnJIcdGjcbfKmeq8z0pZHH0JlVtoVZH9Q/qwUp6wyFnEJUBMrw9DCaj+ra3vShGmhavjalMIhPNxZAUcw==}
+  '@vitest/coverage-v8@4.1.12':
+    resolution: {integrity: sha512-6S7/iVknKglLAxMFxQGNppBI0iqJS2NgM6FBxavitj7KaDq/vywOWGf6dGu7F2L1Qy0G6S3uTp7aGshHrzK8JA==}
     peerDependencies:
-      '@vitest/browser': 4.1.11
-      vitest: 4.1.11
+      '@vitest/browser': 4.1.12
+      vitest: 4.1.12
     peerDependenciesMeta:
       '@vitest/browser':
         optional: true
@@ -1959,6 +1968,9 @@ packages:
   '@vitest/pretty-format@4.1.11':
     resolution: {integrity: sha512-yiZzPbGTS9Sr/JpFl8zHrcIkAofNbFV6k21vIgQN/cY/oxZeXhJv5sc/MBJ5jFKWmWs+oJHw0UXLZjmf931+Vw==}
 
+  '@vitest/pretty-format@4.1.12':
+    resolution: {integrity: sha512-XW9O8+Mxx4VpCtkYdMJLZQQwsVryP9wk7cPKDxtXFfwSak6yRh5+2fep/Y0XF/ElBvJHq8bcYdi6aeuai0opZA==}
+
   '@vitest/runner@4.1.11':
     resolution: {integrity: sha512-LztvUgdwMNJMIkj3hQnnxiC2Xy1zNxq928W/xhjCLaNCzqTZOudjwbQf6v9IntZGPw132i2Lq2rgTRZHD3JHNw==}
 
@@ -1971,20 +1983,26 @@ packages:
   '@vitest/utils@4.1.11':
     resolution: {integrity: sha512-zTCVGpyFsGWBhllOyKlTw/vnr6D9qxsfSDyfbyZmTyjHw5N/VuvzHpHoQjm2ZJzn4RJgx5w4r7V0er69CmLgPQ==}
 
-  '@zip.js/zip.js@2.23.0':
-    resolution: {integrity: sha512-K5obAqfrO7zhycnCupM9aaoZ9kx0SA0kv7+Z2oOUsdpWquv4s/Z4zyD7AdTqxrK3pgPM+ozaUi8kdRQbCWaIrQ==}
+  '@vitest/utils@4.1.12':
+    resolution: {integrity: sha512-Q3awXrwOfEV+qc3WmO5ONyE0yO7Q1gQ9/oyHxGLZ/pl7N3NO/ZztqQwKLuwMkV+CA1JYSIeO3gkHnRDIo4AVaA==}
+
+  '@webgpu/types@0.1.74':
+    resolution: {integrity: sha512-lgiI4hbuLcI9unnm2cL/tvCaQU45dp0xcLWJh5uB/9MBGvIA4F8XIk7nSiBeg+K4xWGYwgZKn80LmERI5CxoTA==}
+
+  '@zip.js/zip.js@2.8.26':
+    resolution: {integrity: sha512-RQ4h9F6DOiHxpdocUDrOl6xBM+yOtz+LkUol47AVWcfebGBDpZ7w7Xvz9PS24JgXvLGiXXzSAfdCdVy1tPlaFA==}
     engines: {bun: '>=0.7.0', deno: '>=1.0.0', node: '>=18.0.0'}
 
-  abslink@1.3.1:
-    resolution: {integrity: sha512-ukFoU6q/RBMjoC7fu0Zx2+eVH2QFMfV+aJ2cI3Ypl0Shm0ikGjZ0T2VN0xvLl0a8imhWqvfVrqu2n2Ml3eSMyQ==}
+  abslink@1.2.2:
+    resolution: {integrity: sha512-HCOItvzORPjMzddCmEpbH8+W1VM3yjH+CR7DLtxlxFKX/jz5twJbm7KLfblO7eKLnXINLah8Hk2ZAJqxXeSkOg==}
 
   acorn-jsx@5.3.2:
     resolution: {integrity: sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==}
     peerDependencies:
       acorn: ^6.0.0 || ^7.0.0 || ^8.0.0
 
-  acorn@8.19.0:
-    resolution: {integrity: sha512-oJlA3XiRm7Cyk6qFD2Jn8ak9B7jSy0qy00ADO3+8dpT0LSjFihQYv4C02LFCSYJV3Q37xYwwRy5m+IpIiUzqWw==}
+  acorn@8.16.0:
+    resolution: {integrity: sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==}
     engines: {node: '>=0.4.0'}
     hasBin: true
 
@@ -1992,8 +2010,8 @@ packages:
     resolution: {integrity: sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==}
     engines: {node: '>= 14'}
 
-  ajv@6.15.0:
-    resolution: {integrity: sha512-fgFx7Hfoq60ytK2c7DhnF8jIvzYgOMxfugjLOSMHjLIPgenqa7S7oaagATUq99mV6IYvN2tRmC0wnTYX6iPbMw==}
+  ajv@6.14.0:
+    resolution: {integrity: sha512-IWrosm/yrn43eiKqkfkHis7QioDleaXQHdDVPKg0FSwwd/DuvyX79TZnFOnYpB7dcsFAMmtFztZuXPDvSePkFw==}
 
   ansi-colors@4.1.3:
     resolution: {integrity: sha512-/6w/C21Pm1A7aZitlI5Ni/2J6FFQN8i1Cvz3kHABAAbw93v/NlvKdVOqz7CCWz/3iv/JplRSEEZ83XION15ovw==}
@@ -2039,13 +2057,13 @@ packages:
     resolution: {integrity: sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==}
     engines: {node: 18 || 20 || >=22}
 
-  baseline-browser-mapping@2.11.28:
-    resolution: {integrity: sha512-br0LOmjJqr6Rt4AEkadbcNf67Zpo7EPwKsWbjnRrJIa1QYFHQBqM4C7F2WTbV8ahTEcg1Eo+Y0aWjjORInYFyA==}
+  baseline-browser-mapping@2.11.23:
+    resolution: {integrity: sha512-le521dGVfxM7yRX0EikCoSz+rOK+hHzdDt/E7mG1jOJB/6WAAUuwVroLwaB7ApaUsz5Q0kFlDXLSA9MheUIfRQ==}
     engines: {node: '>=6.0.0'}
     hasBin: true
 
-  bidi-js@1.1.0:
-    resolution: {integrity: sha512-fX1Onk0tdVPC7obPWB5EbJ1z7NVhLq4m2xZLq2YXBkxzMXIGRpNMU88n0EPgWseKl12J7zXs7qrDxPK4sRs2fg==}
+  bidi-js@1.0.3:
+    resolution: {integrity: sha512-RKshQI1R3YQ+n9YJz2QQ147P66ELpa1FQEg20Dk8oW9t2KgLbpDLLp9aGZ7y8WHSshDknG0bknqGw5/tyCs5tw==}
 
   brace-expansion@1.1.21:
     resolution: {integrity: sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==}
@@ -2057,8 +2075,8 @@ packages:
     resolution: {integrity: sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==}
     engines: {node: 20 || >=22}
 
-  browserslist@4.29.3:
-    resolution: {integrity: sha512-1R4kiYKXGViqEN0CnoDrXc1StD9niAwu+j2dukWzrD4bJgsD4lDmEp0CRbc6E/vYJIfTHwPmwyaKtVSudICdPA==}
+  browserslist@4.28.9:
+    resolution: {integrity: sha512-EWazOblFYUvlGZcfGhPUPmYh3nikUxBVb+y9MJun5f3hBi812X+8MSQTujLBtgK3cf51fJWbWfOjyeO954d+Eg==}
     engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
     hasBin: true
 
@@ -2066,8 +2084,8 @@ packages:
     resolution: {integrity: sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==}
     engines: {node: '>=6'}
 
-  caniuse-lite@1.0.30001815:
-    resolution: {integrity: sha512-uDybUEyfgbyJJ93J1vikTylBX31AkdVYeVPeffMQpf8XN7hSfr0oZOn4VFOIMNvtU5+rHvC5Udg2TgtJKHm23Q==}
+  caniuse-lite@1.0.30001810:
+    resolution: {integrity: sha512-TITQPUkaz+aVk5GL6NhOdwk1aEaNTSDPsGFWrTuhKGtjTF70jL/Oht2W4c6rXUe5fu7Ie19VIahAXHIIiWWNeg==}
 
   chai@6.2.2:
     resolution: {integrity: sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==}
@@ -2168,8 +2186,8 @@ packages:
   dom-accessibility-api@0.6.3:
     resolution: {integrity: sha512-7ZgogeTnjuHbo+ct10G9Ffp0mif17idi0IyWNVA/wcwcm7NPOD/WEHVP3n7n3MhXqxoIYm8d6MuZohYWIZ4T3w==}
 
-  electron-to-chromium@1.5.452:
-    resolution: {integrity: sha512-cVvk1YBSj6571VmV6hdJTqj94Y79xSu8cj6Y9t6ae4Y4431z8/7EJFvu3rVp90xhfuv9BpPKUmaLfTo4+FOGBg==}
+  electron-to-chromium@1.5.427:
+    resolution: {integrity: sha512-n14zb3FdsChZ2BNobqNHAJMcP3ifFv4paox2LvCrfVAQcqGiSURgbJl+PfMpHVCNFkStnNc+RRVtPBTVW5PDgw==}
 
   embla-carousel-react@8.6.0:
     resolution: {integrity: sha512-0/PjqU7geVmo6F734pmPqpyHqiM99olvyecY7zdweCw+6tKEXnrE90pBiBbMMU8s5tICemzpQ3hi5EpxzGW+JA==}
@@ -2190,13 +2208,13 @@ packages:
   embla-carousel@8.6.0:
     resolution: {integrity: sha512-SjWyZBHJPbqxHOzckOfo8lHisEaJWmwd23XppYFYVh10bU66/Pn5tkVkbkCMZVdbUE5eTCI2nD8OyIP4Z+uwkA==}
 
-  enhanced-resolve@5.26.0:
-    resolution: {integrity: sha512-9vhedylFonb2YGogzUKX6+Ja72gOJbN1QHAqdrvqLwhdl/QWbKopzoUC9EbQNVsAns/bx/4uyqalrQAoy1IByw==}
+  enhanced-resolve@5.20.0:
+    resolution: {integrity: sha512-/ce7+jQ1PQ6rVXwe+jKEg5hW5ciicHwIQUagZkp6IufBoY3YDgdTTY1azVs0qoRgVmvsNB+rbjLJxDAeHHtwsQ==}
     engines: {node: '>=10.13.0'}
 
-  entities@8.1.0:
-    resolution: {integrity: sha512-kxL7msIffSuh9aaFAMD7rxAIuTRMAHMeBtgHW2yUdWw732ZNh4MehkF2gdjvtdmikkaIP9bFDDJOPlsvm7avrA==}
-    engines: {node: '>=20.19.0'}
+  entities@6.0.1:
+    resolution: {integrity: sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g==}
+    engines: {node: '>=0.12'}
 
   es-module-lexer@2.3.2:
     resolution: {integrity: sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw==}
@@ -2223,14 +2241,14 @@ packages:
     peerDependencies:
       eslint: '>=7.0.0'
 
-  eslint-plugin-react-hooks@7.1.1:
-    resolution: {integrity: sha512-f2I7Gw6JbvCexzIInuSbZpfdQ44D7iqdWX01FKLvrPgqxoE7oMj8clOfto8U6vYiz4yd5oKu39rRSVOe1zRu0g==}
+  eslint-plugin-react-hooks@7.0.1:
+    resolution: {integrity: sha512-O0d0m04evaNzEPoSW+59Mezf8Qt0InfgGIBJnpC0h3NH/WjUAR7BIKUfysC6todmtiZ/A0oUVS8Gce0WhBrHsA==}
     engines: {node: '>=18'}
     peerDependencies:
-      eslint: ^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0-0 || ^9.0.0 || ^10.0.0
+      eslint: ^3.0.0 || ^4.0.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0-0 || ^9.0.0
 
-  eslint-plugin-react-refresh@0.5.7:
-    resolution: {integrity: sha512-XhJSzLljuYD4UjNuFGJu2v7aD3sqNVK12w5/DCUfrNfHWegZo2+TsavNx8MuxMwEquuFAzNbNfXKU0WoZ+YUIg==}
+  eslint-plugin-react-refresh@0.5.2:
+    resolution: {integrity: sha512-hmgTH57GfzoTFjVN0yBwTggnsVUF2tcqi7RJZHqi9lIezSs4eFyAMktA68YD4r5kNw1mxyY4dmkyoFDb3FIqrA==}
     peerDependencies:
       eslint: ^9 || ^10
 
@@ -2250,8 +2268,8 @@ packages:
     resolution: {integrity: sha512-tD40eHxA35h0PEIZNeIjkHoDR4YjjJp34biM0mDvplBe//mB+IHCqHDGV7pxF+7MklTvighcCPPZC7ynWyjdTA==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=24}
 
-  eslint@9.39.5:
-    resolution: {integrity: sha512-DgZS62aPLXKlnxILS/AYCoRvHaZeXceIzlXPkkGGzJWSow1aEk0lbTlxUSlyjC8jcaKxAdOnTDz+o1JFSBsyjw==}
+  eslint@9.39.4:
+    resolution: {integrity: sha512-XoMjdBOwe/esVgEvLmNsD3IRHkm7fbKIUGvrleloJXUZgDHig2IPWNniv+GwjyJXzuNqVjlr5+4yVUZjycJwfQ==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     deprecated: This version is no longer supported. Please see https://eslint.org/version-support for other options.
     hasBin: true
@@ -2376,8 +2394,8 @@ packages:
   hermes-parser@0.25.1:
     resolution: {integrity: sha512-6pEjquH3rqaI6cYAXYPcz9MS4rY6R4ngRgrgfDshRptUZIc3lw0MCIJIGDj9++mfySOuPTHB4nrSW99BCvOPIA==}
 
-  hls.js@1.7.3:
-    resolution: {integrity: sha512-MsPlx6yVW4Qv4C7mEVou4/gk/5cN2dVxOTnrNjPSmyH2f0Ln+/UkG10Ax1PE6OvrmTVPKgQYozTtBaPOuCzq7A==}
+  hls.js@1.6.15:
+    resolution: {integrity: sha512-E3a5VwgXimGHwpRGV+WxRTKeSp2DW5DI5MWv34ulL3t5UNmyJWCQ1KmLEHbYzcfThfXG8amBL+fCYPneGHC4VA==}
 
   html-encoding-sniffer@6.0.0:
     resolution: {integrity: sha512-CV9TW3Y3f8/wT0BRFc1/KAVQ3TUHiXmaAb6VW9vtiMFf7SLoMd1PdAc4W3KFOFETBJUb90KatHqlsZMWV+R9Gg==}
@@ -2394,8 +2412,8 @@ packages:
     resolution: {integrity: sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==}
     engines: {node: '>= 4'}
 
-  ignore@7.0.12:
-    resolution: {integrity: sha512-/8UvqAPU9DGTI9k4mxtf49U37Isfwr8Uts96+SBHIkFxPJnHS0Ew4f00sM4Scd8V8EjM0jUNtVDdv1kPdt35lg==}
+  ignore@7.0.5:
+    resolution: {integrity: sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==}
     engines: {node: '>= 4'}
 
   import-fresh@3.3.1:
@@ -2440,11 +2458,11 @@ packages:
     resolution: {integrity: sha512-HGYWWS/ehqTV3xN10i23tkPkpH46MLCIMFNCaaKNavAXTF1RkqxawEPtnjnGZ6XKSInBKkiOA5BKS+aZiY3AvA==}
     engines: {node: '>=8'}
 
-  jassub@2.5.20:
-    resolution: {integrity: sha512-uUE0YoUnw/pdgFVoefRN0leLu5iFS39hfOikouCqHUffLCAU3wqRU5VkpBbY1piV8WWlFcHCz3HEPzvyxbAJTw==}
+  jassub@2.5.6:
+    resolution: {integrity: sha512-jsbEPVR+JvcOcGa8PbyVvHmFol+rQtAfty7JDp1WWrS3GEfThitjI5sXT0VLfG6/BLuyIuv1+2qykWdWyLkpQw==}
 
-  jiti@2.7.0:
-    resolution: {integrity: sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==}
+  jiti@2.6.1:
+    resolution: {integrity: sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ==}
     hasBin: true
 
   js-levenshtein@1.1.6:
@@ -2461,8 +2479,8 @@ packages:
     resolution: {integrity: sha512-SFNOvSJ+Dgf/9An904Yx+CgSlIPCkIpao4qo51lpee25TIRejdH3rhR4EZMGoNx3/TP3O+wzWuiTFl4sqbltzA==}
     hasBin: true
 
-  jsdom@29.1.1:
-    resolution: {integrity: sha512-ECi4Fi2f7BdJtUKTflYRTiaMxIB0O6zfR1fX0GXpUrf6flp8QIYn1UT20YQqdSOfk2dfkCwS8LAFoJDEppNK5Q==}
+  jsdom@29.0.1:
+    resolution: {integrity: sha512-z6JOK5gRO7aMybVq/y/MlIpKh8JIi68FBKMUtKkK2KH/wMSRlCxQ682d08LB9fYXplyY/UXG8P4XXTScmdjApg==}
     engines: {node: ^20.19.0 || ^22.13.0 || >=24.0.0}
     peerDependencies:
       canvas: ^3.0.0
@@ -2499,8 +2517,14 @@ packages:
     resolution: {integrity: sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==}
     engines: {node: '>= 0.8.0'}
 
-  lfa-ponyfill@1.1.1:
-    resolution: {integrity: sha512-Had4tsGEHtIj58MRtf6SlubNDltxinxMSdxIn1GdwrWbye8TD+pZ+D6qKETnJ9+vQOfG9q/Ds4WUPskhyAMp5Q==}
+  lfa-ponyfill@1.1.0:
+    resolution: {integrity: sha512-YS3/DmyDdywWwoEu1ZacAudqkJ4q7WtKE9+bWlaSuEoVrXva7ChIJHMJYs19zyVc1H198pzqAreQU0r/+YNeew==}
+
+  lightningcss-android-arm64@1.31.1:
+    resolution: {integrity: sha512-HXJF3x8w9nQ4jbXRiNppBCqeZPIAfUo8zE/kOEGbW5NZvGc/K7nMxbhIr+YlFlHW5mpbg/YFPdbnCh1wAXCKFg==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [android]
 
   lightningcss-android-arm64@1.32.0:
     resolution: {integrity: sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg==}
@@ -2508,30 +2532,61 @@ packages:
     cpu: [arm64]
     os: [android]
 
+  lightningcss-darwin-arm64@1.31.1:
+    resolution: {integrity: sha512-02uTEqf3vIfNMq3h/z2cJfcOXnQ0GRwQrkmPafhueLb2h7mqEidiCzkE4gBMEH65abHRiQvhdcQ+aP0D0g67sg==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [darwin]
+
   lightningcss-darwin-arm64@1.32.0:
     resolution: {integrity: sha512-RzeG9Ju5bag2Bv1/lwlVJvBE3q6TtXskdZLLCyfg5pt+HLz9BqlICO7LZM7VHNTTn/5PRhHFBSjk5lc4cmscPQ==}
     engines: {node: '>= 12.0.0'}
     cpu: [arm64]
     os: [darwin]
 
+  lightningcss-darwin-x64@1.31.1:
+    resolution: {integrity: sha512-1ObhyoCY+tGxtsz1lSx5NXCj3nirk0Y0kB/g8B8DT+sSx4G9djitg9ejFnjb3gJNWo7qXH4DIy2SUHvpoFwfTA==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [darwin]
+
   lightningcss-darwin-x64@1.32.0:
     resolution: {integrity: sha512-U+QsBp2m/s2wqpUYT/6wnlagdZbtZdndSmut/NJqlCcMLTWp5muCrID+K5UJ6jqD2BFshejCYXniPDbNh73V8w==}
     engines: {node: '>= 12.0.0'}
     cpu: [x64]
     os: [darwin]
 
+  lightningcss-freebsd-x64@1.31.1:
+    resolution: {integrity: sha512-1RINmQKAItO6ISxYgPwszQE1BrsVU5aB45ho6O42mu96UiZBxEXsuQ7cJW4zs4CEodPUioj/QrXW1r9pLUM74A==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [freebsd]
+
   lightningcss-freebsd-x64@1.32.0:
     resolution: {integrity: sha512-JCTigedEksZk3tHTTthnMdVfGf61Fky8Ji2E4YjUTEQX14xiy/lTzXnu1vwiZe3bYe0q+SpsSH/CTeDXK6WHig==}
     engines: {node: '>= 12.0.0'}
     cpu: [x64]
     os: [freebsd]
 
+  lightningcss-linux-arm-gnueabihf@1.31.1:
+    resolution: {integrity: sha512-OOCm2//MZJ87CdDK62rZIu+aw9gBv4azMJuA8/KB74wmfS3lnC4yoPHm0uXZ/dvNNHmnZnB8XLAZzObeG0nS1g==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm]
+    os: [linux]
+
   lightningcss-linux-arm-gnueabihf@1.32.0:
     resolution: {integrity: sha512-x6rnnpRa2GL0zQOkt6rts3YDPzduLpWvwAF6EMhXFVZXD4tPrBkEFqzGowzCsIWsPjqSK+tyNEODUBXeeVHSkw==}
     engines: {node: '>= 12.0.0'}
     cpu: [arm]
     os: [linux]
 
+  lightningcss-linux-arm64-gnu@1.31.1:
+    resolution: {integrity: sha512-WKyLWztD71rTnou4xAD5kQT+982wvca7E6QoLpoawZ1gP9JM0GJj4Tp5jMUh9B3AitHbRZ2/H3W5xQmdEOUlLg==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [glibc]
+
   lightningcss-linux-arm64-gnu@1.32.0:
     resolution: {integrity: sha512-0nnMyoyOLRJXfbMOilaSRcLH3Jw5z9HDNGfT/gwCPgaDjnx0i8w7vBzFLFR1f6CMLKF8gVbebmkUN3fa/kQJpQ==}
     engines: {node: '>= 12.0.0'}
@@ -2539,6 +2594,13 @@ packages:
     os: [linux]
     libc: [glibc]
 
+  lightningcss-linux-arm64-musl@1.31.1:
+    resolution: {integrity: sha512-mVZ7Pg2zIbe3XlNbZJdjs86YViQFoJSpc41CbVmKBPiGmC4YrfeOyz65ms2qpAobVd7WQsbW4PdsSJEMymyIMg==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [linux]
+    libc: [musl]
+
   lightningcss-linux-arm64-musl@1.32.0:
     resolution: {integrity: sha512-UpQkoenr4UJEzgVIYpI80lDFvRmPVg6oqboNHfoH4CQIfNA+HOrZ7Mo7KZP02dC6LjghPQJeBsvXhJod/wnIBg==}
     engines: {node: '>= 12.0.0'}
@@ -2546,6 +2608,13 @@ packages:
     os: [linux]
     libc: [musl]
 
+  lightningcss-linux-x64-gnu@1.31.1:
+    resolution: {integrity: sha512-xGlFWRMl+0KvUhgySdIaReQdB4FNudfUTARn7q0hh/V67PVGCs3ADFjw+6++kG1RNd0zdGRlEKa+T13/tQjPMA==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [linux]
+    libc: [glibc]
+
   lightningcss-linux-x64-gnu@1.32.0:
     resolution: {integrity: sha512-V7Qr52IhZmdKPVr+Vtw8o+WLsQJYCTd8loIfpDaMRWGUZfBOYEJeyJIkqGIDMZPwPx24pUMfwSxxI8phr/MbOA==}
     engines: {node: '>= 12.0.0'}
@@ -2553,6 +2622,13 @@ packages:
     os: [linux]
     libc: [glibc]
 
+  lightningcss-linux-x64-musl@1.31.1:
+    resolution: {integrity: sha512-eowF8PrKHw9LpoZii5tdZwnBcYDxRw2rRCyvAXLi34iyeYfqCQNA9rmUM0ce62NlPhCvof1+9ivRaTY6pSKDaA==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [linux]
+    libc: [musl]
+
   lightningcss-linux-x64-musl@1.32.0:
     resolution: {integrity: sha512-bYcLp+Vb0awsiXg/80uCRezCYHNg1/l3mt0gzHnWV9XP1W5sKa5/TCdGWaR/zBM2PeF/HbsQv/j2URNOiVuxWg==}
     engines: {node: '>= 12.0.0'}
@@ -2560,18 +2636,34 @@ packages:
     os: [linux]
     libc: [musl]
 
+  lightningcss-win32-arm64-msvc@1.31.1:
+    resolution: {integrity: sha512-aJReEbSEQzx1uBlQizAOBSjcmr9dCdL3XuC/6HLXAxmtErsj2ICo5yYggg1qOODQMtnjNQv2UHb9NpOuFtYe4w==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [arm64]
+    os: [win32]
+
   lightningcss-win32-arm64-msvc@1.32.0:
     resolution: {integrity: sha512-8SbC8BR40pS6baCM8sbtYDSwEVQd4JlFTOlaD3gWGHfThTcABnNDBda6eTZeqbofalIJhFx0qKzgHJmcPTnGdw==}
     engines: {node: '>= 12.0.0'}
     cpu: [arm64]
     os: [win32]
 
+  lightningcss-win32-x64-msvc@1.31.1:
+    resolution: {integrity: sha512-I9aiFrbd7oYHwlnQDqr1Roz+fTz61oDDJX7n9tYF9FJymH1cIN1DtKw3iYt6b8WZgEjoNwVSncwF4wx/ZedMhw==}
+    engines: {node: '>= 12.0.0'}
+    cpu: [x64]
+    os: [win32]
+
   lightningcss-win32-x64-msvc@1.32.0:
     resolution: {integrity: sha512-Amq9B/SoZYdDi1kFrojnoqPLxYhQ4Wo5XiL8EVJrVsB8ARoC1PWW6VGtT0WKCemjy8aC+louJnjS7U18x3b06Q==}
     engines: {node: '>= 12.0.0'}
     cpu: [x64]
     os: [win32]
 
+  lightningcss@1.31.1:
+    resolution: {integrity: sha512-l51N2r93WmGUye3WuFoN5k10zyvrVs0qfKBhyC5ogUQ6Ew6JUSswh78mbSO+IU3nTWsyOArqPCcShdQSadghBQ==}
+    engines: {node: '>= 12.0.0'}
+
   lightningcss@1.32.0:
     resolution: {integrity: sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ==}
     engines: {node: '>= 12.0.0'}
@@ -2587,8 +2679,8 @@ packages:
     resolution: {integrity: sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==}
     hasBin: true
 
-  lru-cache@11.5.3:
-    resolution: {integrity: sha512-U4N8FgzmWxc8k1VH8Kr6lQg18U7Fjvby6wXHVRX/ZZ7IwWbRMgrRbP0Wrb5q5NVinryp4SQampHKdvtecItxUg==}
+  lru-cache@11.3.1:
+    resolution: {integrity: sha512-Y71HWT4hydF1IAG/2OPync4dgQ/J2iWye7eg6CuzJHI+E97tvqFPlADzxiNnjH6WSljg8ecfXMr9k6bfFuqA5w==}
     engines: {node: 20 || >=22}
 
   lru-cache@5.1.1:
@@ -2616,12 +2708,15 @@ packages:
   mdn-data@2.27.1:
     resolution: {integrity: sha512-9Yubnt3e8A0OKwxYSXyhLymGW4sCufcLG6VdiDdUGVkPhpqLxlvP5vl1983gQjJl3tqbrM731mjaZaP68AgosQ==}
 
+  mediabunny@1.61.0:
+    resolution: {integrity: sha512-WciPOYwKZwgYkoBKcEK6JzzIf+w5whypPzFdOihOylZ/5Qv19FmNfRnTcaprH+jD136YpEASU30Eb6VNCJiz3A==}
+
   min-indent@1.0.1:
     resolution: {integrity: sha512-I9jwMn07Sy/IwOj3zVkVik2JTvgpaykDZEigL6Rx6N9LbMywwUSMtxET+7lVoDLLd3O3IXwJwvuuns8UB/HeAg==}
     engines: {node: '>=4'}
 
-  minimatch@10.2.6:
-    resolution: {integrity: sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==}
+  minimatch@10.2.4:
+    resolution: {integrity: sha512-oRjTw/97aTBN0RHbYCdtF1MQfvusSIBQM0IZEgzl6426+8jSC0nF1a/GmnVLpfB9yyr6g6FTqWqiZVbxrtaCIg==}
     engines: {node: 18 || 20 || >=22}
 
   minimatch@3.1.5:
@@ -2666,8 +2761,8 @@ packages:
   natural-compare@1.4.0:
     resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==}
 
-  node-releases@2.0.58:
-    resolution: {integrity: sha512-BdiKAgbfRlvfMq/XzO/AF9NPmaA8a+YpLAyAFTVFBj3gARrAIfWvNq7Q7NE4se3KgFu0KkrvQMxTS0XVnsGzHg==}
+  node-releases@2.0.55:
+    resolution: {integrity: sha512-mIrE/Cw9y+9Au6dS5vDKDhQza9YvG6w+ZrS6X+ZzA7yFW/soAeaups4Qzn1bL6g5FVy8WtP79+0j82oPIbqRjQ==}
     engines: {node: '>=18'}
 
   node-unrar-js@2.0.2:
@@ -2708,8 +2803,8 @@ packages:
     resolution: {integrity: sha512-ybiGyvspI+fAoRQbIPRddCcSTV9/LsJbf0e/S85VLowVGzRmokfneg2kwVW/KU5rOXrPSbF1qAKPMgNTqqROQQ==}
     engines: {node: '>=18'}
 
-  parse5@8.0.1:
-    resolution: {integrity: sha512-z1e/HMG90obSGeidlli3hj7cbocou0/wa5HacvI3ASx34PecNjNQeaHNo5WIZpWofN9kgkqV1q5YvXe3F0FoPw==}
+  parse5@8.0.0:
+    resolution: {integrity: sha512-9m4m5GSgXjL4AjumKzq1Fgfp3Z8rsvjRNbnkVwfu2ImRqE5D0LnY2QfDen18FSY9C573YU5XxSapdHZTZ2WolA==}
 
   path-exists@4.0.0:
     resolution: {integrity: sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==}
@@ -2722,8 +2817,8 @@ packages:
   pathe@2.0.3:
     resolution: {integrity: sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==}
 
-  pdfjs-dist@6.4.299:
-    resolution: {integrity: sha512-AVl138zALtfaAPvADulE0PZThbYzCBS79nL4pOSL/6Sm/4AH5A21BD9VHt97OlCuzJuCpmeZtAtkinisF4Vb1g==}
+  pdfjs-dist@6.2.108:
+    resolution: {integrity: sha512-YxFb+SQcodN2rnX9Tn3dHYlqfb7NjlzzfONPpJd+AKoKtUjEdevTfbC07d5TcczzOK6261auRkP/M8OBHs9vFQ==}
     engines: {node: '>=22.13.0 || >=24'}
 
   picocolors@1.1.1:
@@ -2800,8 +2895,8 @@ packages:
       prettier-plugin-svelte:
         optional: true
 
-  prettier@3.8.5:
-    resolution: {integrity: sha512-zxcTTCedNGJM4R8sj/Cq/F0W/c4iE0afWBcBwMTRtw4WHYP9TWkYjdiH3npPRUYsXQCPR0hTU9yjovOu+E6EQA==}
+  prettier@3.8.1:
+    resolution: {integrity: sha512-UOnG6LftzbdaHZcKoPFtOcCKztrQ57WkHDeRD9t/PTQtmT0NHSeWWepj6pS0z/N7+08BHFDQVUrfmfMRcZwbMg==}
     engines: {node: '>=14'}
     hasBin: true
 
@@ -2816,11 +2911,11 @@ packages:
     resolution: {integrity: sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==}
     engines: {node: '>=6'}
 
-  qrcode-generator@2.0.4:
-    resolution: {integrity: sha512-mZSiP6RnbHl4xL2Ap5HfkjLnmxfKcPWpWe/c+5XxCuetEenqmNFf1FH/ftXPCtFG5/TDobjsjz6sSNL0Sr8Z9g==}
+  qr.js@0.0.0:
+    resolution: {integrity: sha512-c4iYnWb+k2E+vYpRimHqSu575b1/wKl4XFeJGpFmrJQz5I88v9aY2czh7s0w36srfCM1sXgC/xpoJz5dJfq+OQ==}
 
-  radix-ui@1.8.1:
-    resolution: {integrity: sha512-HPfpVGizO9xANlsFSauruLhRe/3+iOt3vPX0MXYle/UQi3gorQrSYtBcdiv0BZYewcl2rvL59qrIuLFMGAmUrw==}
+  radix-ui@1.4.3:
+    resolution: {integrity: sha512-aWizCQiyeAenIdUbqEpXgRA1ya65P13NKn/W8rWkcN0OPkRDxdBVLWnIEDsS2RpwCK2nobI7oMUSmexzTDyAmA==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -2832,8 +2927,8 @@ packages:
       '@types/react-dom':
         optional: true
 
-  react-day-picker@10.0.2:
-    resolution: {integrity: sha512-QetiKtZWE9Uaw/pM/SYNv6WPYOTRnSJ2puL0GgwkmUFMIwiY0dtjH1W4B7DOVXVNQM0ZOClGpH/heOfBSzWeiA==}
+  react-day-picker@10.0.1:
+    resolution: {integrity: sha512-eNh6BlwcYInWaJtRv18mXQ06Ys/H6rdTZAnTaSdOYJuTpwP1JMCHNd1FDRadA+gbeinq+psdULN5Xnowy9mV8w==}
     engines: {node: '>=18'}
     peerDependencies:
       '@types/react': '>=16.8.0'
@@ -2842,10 +2937,10 @@ packages:
       '@types/react':
         optional: true
 
-  react-dom@19.3.0:
-    resolution: {integrity: sha512-JDk8dgif51OjFoDE70+OT9ICyYr+69HlmihNwp1+Nsfbna3t5sIiCa9ZJktDmQ4/1b/rn26hIAR2uYXDMr5r0Q==}
+  react-dom@19.2.4:
+    resolution: {integrity: sha512-AXJdLo8kgMbimY95O2aKQqsz2iWi9jMgKJhRBAxECE4IFxfcazB2LmzloIoibJI3C12IlY20+KFaLv+71bUJeQ==}
     peerDependencies:
-      react: ^19.3.0
+      react: ^19.2.4
 
   react-is@16.13.1:
     resolution: {integrity: sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ==}
@@ -2853,8 +2948,8 @@ packages:
   react-is@17.0.2:
     resolution: {integrity: sha512-w2GsyukL62IJnlaff/nRegPQR94C/XXamvMWmSHRJ4y7Ts/4ocGRmTHvOs8PSE6pB3dWOrD/nueuU5sduBsQ4w==}
 
-  react-qr-code@2.2.0:
-    resolution: {integrity: sha512-e5nS0UUN22K3Nf8KBRUzemfdJ6OmnN5w+kbnj1lvJaol9RyVRFeGl05bCkxSN2ZegbLxjjYjX1+mmAoX9+fAhw==}
+  react-qr-code@2.0.18:
+    resolution: {integrity: sha512-v1Jqz7urLMhkO6jkgJuBYhnqvXagzceg3qJUWayuCK/c6LTIonpWbwxR1f1APGd4xrW/QcQEovNrAojbUz65Tg==}
     peerDependencies:
       react: '*'
 
@@ -2882,8 +2977,8 @@ packages:
       '@types/react':
         optional: true
 
-  react-router@8.4.0:
-    resolution: {integrity: sha512-JtydAkBvU9UTEe5qNC+POhu+ZBNM7rlKY2IegwXc7Idj7xfRG16x5RZrw3mju+XlqBxfvb2ky9P3jUp9WyWC1g==}
+  react-router@8.3.0:
+    resolution: {integrity: sha512-qyPMvW83jGIct3yiieisxdk9M745anqhpIMKN5m1t6yBMfgVPpt77aHOqs5fUlEJRMCGffg9BaQLH9oPVOL7xQ==}
     engines: {node: '>=22.22.0'}
     peerDependencies:
       react: '>=19.2.7'
@@ -2902,8 +2997,8 @@ packages:
       '@types/react':
         optional: true
 
-  react@19.3.0:
-    resolution: {integrity: sha512-E8LUcbtBWt20bbl2YoHfx4ZDBdxVTfOKtCZn9cDSJ4l6/nuoApcpIBcj47t2wZoVX8g2ZHuMHbiShgCR1T5Sog==}
+  react@19.2.4:
+    resolution: {integrity: sha512-9nfp2hYpCwOjAN+8TZFGhtWEwgvWHXqESH8qT89AT/lWklpLON22Lc8pEtnpsZz7VmawabSU0gCjnj8aC0euHQ==}
     engines: {node: '>=0.10.0'}
 
   redent@3.0.0:
@@ -2918,8 +3013,8 @@ packages:
     resolution: {integrity: sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==}
     engines: {node: '>=4'}
 
-  rollup@4.64.5:
-    resolution: {integrity: sha512-EAP5ZHcz2ijbgCWwPkpI7zh6bfsri2Ez5FtCy2dCp1k62duXzfG7DLGGh7RU2QQXWwavT+u4qpvDF/TWOiiGTw==}
+  rollup@4.62.0:
+    resolution: {integrity: sha512-nc72Wgq62I7rtDV4izT5/aaS0zxy3kttkinf9586ApknY3jZO9NYsmtc24fUckA0X7Q2v+ML4a15pdUlV5V/jA==}
     engines: {node: '>=18.0.0', npm: '>=8.0.0'}
     hasBin: true
 
@@ -2930,15 +3025,15 @@ packages:
     resolution: {integrity: sha512-xAg7SOnEhrm5zI3puOOKyy1OMcMlIJZYNJY7xLBwSze0UjhPLnWfj2GF2EpT0jmzaJKIWKHLsaSSajf35bcYnA==}
     engines: {node: '>=v12.22.7'}
 
-  scheduler@0.28.0:
-    resolution: {integrity: sha512-juorfCmIkIw8tT+p5BXSm6PJjQF/ycEYmKyzURCIt/RaZIhL+PulbQ9Yu2z1HdOJDdqDTlxA1+xKBmHXJsczAw==}
+  scheduler@0.27.0:
+    resolution: {integrity: sha512-eNv+WrVbKu1f3vbYJT/xtiF5syA5HPIMtf9IgY/nKg0sWqzAUEvqY/xm7OcZc/qafLx/iO9FgOmeSAp4v5ti/Q==}
 
   semver@6.3.1:
     resolution: {integrity: sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==}
     hasBin: true
 
-  semver@7.8.5:
-    resolution: {integrity: sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA==}
+  semver@7.7.4:
+    resolution: {integrity: sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==}
     engines: {node: '>=10'}
     hasBin: true
 
@@ -2953,15 +3048,11 @@ packages:
   siginfo@2.0.0:
     resolution: {integrity: sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==}
 
-  sonner@2.0.8:
-    resolution: {integrity: sha512-UM/ByIoFra8yzV75n1o0Puu0bw5U/9UNnDacrJNspekBewIfsQ3D6ez1nvlWpt7aTsO6rujQtifBpycwIivqlg==}
+  sonner@2.0.7:
+    resolution: {integrity: sha512-W6ZN4p58k8aDKA4XPcx2hpIQXBRAgyiWVkYhT7CvK6D3iAu7xjvVyhQHg2/iaKJZ1XVJ4r7XuwGL+WGEK37i9w==}
     peerDependencies:
-      '@types/react': ^18.0.0 || ^19.0.0
       react: ^18.0.0 || ^19.0.0 || ^19.0.0-rc
       react-dom: ^18.0.0 || ^19.0.0 || ^19.0.0-rc
-    peerDependenciesMeta:
-      '@types/react':
-        optional: true
 
   source-map-js@1.2.2:
     resolution: {integrity: sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==}
@@ -2981,8 +3072,8 @@ packages:
     resolution: {integrity: sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==}
     engines: {node: '>=8'}
 
-  style-mod@4.1.4:
-    resolution: {integrity: sha512-XXWIQt633/EpAFx8aZDOTjBzrCaGmhvEQlQo6MVPfa2OzO2cWo+4hV9h+6UkHYlXGfy+ODXKUdP7Pthmcu5ATw==}
+  style-mod@4.1.3:
+    resolution: {integrity: sha512-i/n8VsZydrugj3Iuzll8+x/00GH2vnYsk1eomD8QiRrSAeW6ItbCQDtfXCeJHd0iwiNagqjQkvpvREEPtW3IoQ==}
 
   supports-color@10.2.2:
     resolution: {integrity: sha512-SS+jx45GF1QjgEXQx4NJZV9ImqmO2NPz5FNsIHrsDjh2YsHnawpan7SNQ1o8NuhrbHZy9AZhIoCUiCeaW/C80g==}
@@ -2995,14 +3086,14 @@ packages:
   symbol-tree@3.2.4:
     resolution: {integrity: sha512-9QNk5KwDF+Bvz+PyObkmSYjI5ksVUYtjW7AU22r2NKcfLJcXp96hkDWU3+XndOsUb+AQ9QhfzfCT2O+CNWT5Tw==}
 
-  tailwind-merge@3.7.0:
-    resolution: {integrity: sha512-XPPUyAc+cvspz3lHTcR/QgPfW2A0lv/xQNIjX3HGhLR+Nq2lHaLq5MtTesHn8GUr3W3DguT2KT5x3NVgRtYwmA==}
+  tailwind-merge@3.5.0:
+    resolution: {integrity: sha512-I8K9wewnVDkL1NTGoqWmVEIlUcB9gFriAEkXkfCjX5ib8ezGxtR3xD7iZIxrfArjEsH7F1CHD4RFUtxefdqV/A==}
 
-  tailwindcss@4.3.3:
-    resolution: {integrity: sha512-gOhV3P7ufE62QDGg1zVaTgCR+EtPv92k2nIhVcVKcLmxT1sUBsQGhnZj175j+MqRt4zLF7ic+sCYjfhxMxj7YQ==}
+  tailwindcss@4.2.1:
+    resolution: {integrity: sha512-/tBrSQ36vCleJkAOsy9kbNTgaxvGbyOamC30PRePTQe/o1MFwEKHQk4Cn7BNGaPtjp+PuUrByJehM1hgxfq4sw==}
 
-  tapable@2.3.3:
-    resolution: {integrity: sha512-uxc/zpqFg6x7C8vOE7lh6Lbda8eEL9zmVm/PLeTPBRhh1xCgdWaQ+J1CUieGpIfm2HdtsUpRv+HshiasBMcc6A==}
+  tapable@2.3.0:
+    resolution: {integrity: sha512-g9ljZiwki/LfxmQADO3dEY1CbpmXT5Hm2fJ+QaGKwSXUylMybePR7/67YW7jOrrvjEgL1Fmz5kzyAjWVWLlucg==}
     engines: {node: '>=6'}
 
   throughput@1.0.2:
@@ -3026,23 +3117,23 @@ packages:
     resolution: {integrity: sha512-yau8yJdTt989Mm0Bd/236QnzEiPf2xLLTqUZRUJOo/3CB078LSwzei343DgtJVmfJKJE3TMINY1u42SQsP6mXw==}
     engines: {node: '>=14.0.0'}
 
-  tldts-core@7.4.18:
-    resolution: {integrity: sha512-KI2PKvCmvQI/xD6ypPqkU0i7oxNXR/O58RLRaHR4svsgVUQ2JE/XC8BtMbG6PSehD27I8sZJRcC1ASnCy6lp3g==}
+  tldts-core@7.0.28:
+    resolution: {integrity: sha512-7W5Efjhsc3chVdFhqtaU0KtK32J37Zcr9RKtID54nG+tIpcY79CQK/veYPODxtD/LJ4Lue66jvrQzIX2Z2/pUQ==}
 
-  tldts@7.4.18:
-    resolution: {integrity: sha512-somxA8xKAUzlAxl0TX/jMSYIbRNFIVGnI96pVGJPeMc5BsHmfVXn6mOJT6U++ELnl04eGfzpfcEuZe8WiASkXg==}
+  tldts@7.0.28:
+    resolution: {integrity: sha512-+Zg3vWhRUv8B1maGSTFdev9mjoo8Etn2Ayfs4cnjlD3CsGkxXX4QyW3j2WJ0wdjYcYmy7Lx2RDsZMhgCWafKIw==}
     hasBin: true
 
-  tough-cookie@6.0.2:
-    resolution: {integrity: sha512-exgYmnmL/sJpR3upZfXG5PoatXQii55xAiXGXzY+sROLZ/Y+SLcp9PgJNI9Vz37HpQ74WvDcLT8eqm+kV3FzrA==}
+  tough-cookie@6.0.1:
+    resolution: {integrity: sha512-LktZQb3IeoUWB9lqR5EWTHgW/VTITCXg4D21M+lvybRVdylLrRMnqaIONLVb5mav8vM19m44HIcGq4qASeu2Qw==}
     engines: {node: '>=16'}
 
   tr46@6.0.0:
     resolution: {integrity: sha512-bLVMLPtstlZ4iMQHpFHTR7GAGj2jxi8Dg0s2h2MafAE4uSWF98FC/3MomU51iQAMf8/qDUbKWf5GxuvvVcXEhw==}
     engines: {node: '>=20'}
 
-  ts-api-utils@2.5.0:
-    resolution: {integrity: sha512-OJ/ibxhPlqrMM0UiNHJ/0CKQkoKF243/AEmplt3qpRgkW8VG7IfOS41h7V8TjITqdByHzrjcS/2si+y4lIh8NA==}
+  ts-api-utils@2.4.0:
+    resolution: {integrity: sha512-3TaVTaAv2gTiMB35i3FiGJaRfwb3Pyn/j3m/bfAvGe8FB7CF6u+LMYqYlDh7reQf7UNvoTvdfAqHGmPGOSsPmA==}
     engines: {node: '>=18.12'}
     peerDependencies:
       typescript: '>=4.8.4'
@@ -3058,27 +3149,27 @@ packages:
     resolution: {integrity: sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA==}
     engines: {node: '>=16'}
 
-  typescript-eslint@8.71.2:
-    resolution: {integrity: sha512-Rz4effbMy2g9wnvOJZG6SbVavX313Lap1vNEbk1RUochzickvzP8P4HB+bkNg5e50eVz1hQGjh9K1omI1xB4Bw==}
+  typescript-eslint@8.57.0:
+    resolution: {integrity: sha512-W8GcigEMEeB07xEZol8oJ26rigm3+bfPHxHvwbYUlu1fUDsGuQ7Hiskx5xGW/xM4USc9Ephe3jtv7ZYPQntHeA==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       eslint: ^8.57.0 || ^9.0.0 || ^10.0.0
-      typescript: '>=4.8.4 <6.1.0'
+      typescript: '>=4.8.4 <6.0.0'
 
   typescript@5.9.3:
     resolution: {integrity: sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==}
     engines: {node: '>=14.17'}
     hasBin: true
 
-  undici-types@7.24.6:
-    resolution: {integrity: sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==}
+  undici-types@7.18.2:
+    resolution: {integrity: sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==}
 
   undici@7.30.0:
     resolution: {integrity: sha512-dkrQXeHSaoamnItlYbmzG0wFYrM0ZwDxCIg0A7aKjTyyhh9svRzCNFEzV+Vm05/yehjCzjDZ31KXfGEjYSztDQ==}
     engines: {node: '>=20.18.1'}
 
-  update-browserslist-db@1.3.4:
-    resolution: {integrity: sha512-t8wonIOdQyOjtPd2VktlBu6QjTVTks6v8bSi7kd0r2Vll8TK1JYDZtRRdbmCHOAMphkZgrzK+L+vXK4pyZ8t4A==}
+  update-browserslist-db@1.3.3:
+    resolution: {integrity: sha512-pJ2sYawQS0R/WI928Gj5GlPhTGzbMelq0+4INtSYNDV9ErKJcX6xjGWkoG/VnB3dpUm00zALaqkrUD77pO5TDQ==}
     hasBin: true
     peerDependencies:
       browserslist: '>= 4.21.0'
@@ -3109,8 +3200,13 @@ packages:
       '@types/react':
         optional: true
 
-  vite@6.4.4:
-    resolution: {integrity: sha512-xGjU/SyjeNyb0E4KxXBvYz/1C+3JXuujvf2hXNOtnlcE+58o5ajd9N2/n2VhkiJvpCP2qQasnUpx5PXNeI+p1Q==}
+  use-sync-external-store@1.6.0:
+    resolution: {integrity: sha512-Pp6GSwGP/NrPIrxVFAIkOQeyw8lFenOHijQWkUTrDvrF4ALqylP2C/KCkeS9dpUM3KvYRQhna5vt7IL95+ZQ9w==}
+    peerDependencies:
+      react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
+
+  vite@6.4.3:
+    resolution: {integrity: sha512-NTKlcQjlAK7MlQoyb6LgaqHc8sso/pVyUJYWMws3jg21uTJw/LddqIFPcPqP6PzpgbIcZyKI85sFE4HBrQDA8A==}
     engines: {node: ^18.0.0 || ^20.0.0 || >=22.0.0}
     hasBin: true
     peerDependencies:
@@ -3254,31 +3350,27 @@ packages:
     peerDependencies:
       zod: ^3.25.0 || ^4.0.0
 
-  zod@4.6.7:
-    resolution: {integrity: sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==}
+  zod@4.3.6:
+    resolution: {integrity: sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg==}
 
 snapshots:
 
   '@adobe/css-tools@4.4.4': {}
 
-  '@asamuzakjp/css-color@5.1.11':
+  '@asamuzakjp/css-color@5.1.6':
     dependencies:
-      '@asamuzakjp/generational-cache': 1.0.1
-      '@csstools/css-calc': 3.4.3(@csstools/css-parser-algorithms@4.0.2(@csstools/css-tokenizer@4.0.2))(@csstools/css-tokenizer@4.0.2)
-      '@csstools/css-color-parser': 4.2.6(@csstools/css-parser-algorithms@4.0.2(@csstools/css-tokenizer@4.0.2))(@csstools/css-tokenizer@4.0.2)
-      '@csstools/css-parser-algorithms': 4.0.2(@csstools/css-tokenizer@4.0.2)
-      '@csstools/css-tokenizer': 4.0.2
+      '@csstools/css-calc': 3.1.1(@csstools/css-parser-algorithms@4.0.0(@csstools/css-tokenizer@4.0.0))(@csstools/css-tokenizer@4.0.0)
+      '@csstools/css-color-parser': 4.0.2(@csstools/css-parser-algorithms@4.0.0(@csstools/css-tokenizer@4.0.0))(@csstools/css-tokenizer@4.0.0)
+      '@csstools/css-parser-algorithms': 4.0.0(@csstools/css-tokenizer@4.0.0)
+      '@csstools/css-tokenizer': 4.0.0
 
-  '@asamuzakjp/dom-selector@7.1.1':
+  '@asamuzakjp/dom-selector@7.0.7':
     dependencies:
-      '@asamuzakjp/generational-cache': 1.0.1
       '@asamuzakjp/nwsapi': 2.3.9
-      bidi-js: 1.1.0
+      bidi-js: 1.0.3
       css-tree: 3.2.1
       is-potential-custom-element-name: 1.0.1
 
-  '@asamuzakjp/generational-cache@1.0.1': {}
-
   '@asamuzakjp/nwsapi@2.3.9': {}
 
   '@babel/code-frame@7.29.7':
@@ -3292,14 +3384,14 @@ snapshots:
   '@babel/core@7.29.7':
     dependencies:
       '@babel/code-frame': 7.29.7
-      '@babel/generator': 7.29.8
+      '@babel/generator': 7.29.7
       '@babel/helper-compilation-targets': 7.29.7
       '@babel/helper-module-transforms': 7.29.7(@babel/core@7.29.7)
-      '@babel/helpers': 7.29.10
-      '@babel/parser': 7.29.9
+      '@babel/helpers': 7.29.7
+      '@babel/parser': 7.29.7
       '@babel/template': 7.29.7
       '@babel/traverse': 7.29.10
-      '@babel/types': 7.29.8
+      '@babel/types': 7.29.7
       '@jridgewell/remapping': 2.3.5
       convert-source-map: 2.0.0
       debug: 4.4.3(supports-color@10.2.2)
@@ -3309,6 +3401,14 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  '@babel/generator@7.29.7':
+    dependencies:
+      '@babel/parser': 7.29.7
+      '@babel/types': 7.29.7
+      '@jridgewell/gen-mapping': 0.3.13
+      '@jridgewell/trace-mapping': 0.3.31
+      jsesc: 3.1.0
+
   '@babel/generator@7.29.8':
     dependencies:
       '@babel/parser': 7.29.9
@@ -3321,7 +3421,7 @@ snapshots:
     dependencies:
       '@babel/compat-data': 7.29.7
       '@babel/helper-validator-option': 7.29.7
-      browserslist: 4.29.3
+      browserslist: 4.28.9
       lru-cache: 5.1.1
       semver: 6.3.1
 
@@ -3330,7 +3430,7 @@ snapshots:
   '@babel/helper-module-imports@7.29.7':
     dependencies:
       '@babel/traverse': 7.29.10
-      '@babel/types': 7.29.8
+      '@babel/types': 7.29.7
     transitivePeerDependencies:
       - supports-color
 
@@ -3355,10 +3455,10 @@ snapshots:
 
   '@babel/helper-validator-option@7.29.7': {}
 
-  '@babel/helpers@7.29.10':
+  '@babel/helpers@7.29.7':
     dependencies:
       '@babel/template': 7.29.7
-      '@babel/types': 7.29.8
+      '@babel/types': 7.29.7
 
   '@babel/parser@7.29.0':
     dependencies:
@@ -3382,13 +3482,15 @@ snapshots:
       '@babel/core': 7.29.7
       '@babel/helper-plugin-utils': 7.28.6
 
-  '@babel/runtime@7.29.10': {}
+  '@babel/runtime@7.29.2': {}
+
+  '@babel/runtime@7.29.7': {}
 
   '@babel/template@7.29.7':
     dependencies:
       '@babel/code-frame': 7.29.7
-      '@babel/parser': 7.29.9
-      '@babel/types': 7.29.8
+      '@babel/parser': 7.29.7
+      '@babel/types': 7.29.7
 
   '@babel/traverse@7.29.10':
     dependencies:
@@ -3419,115 +3521,130 @@ snapshots:
 
   '@bcoe/v8-coverage@1.0.2': {}
 
-  '@bramus/specificity@2.4.3':
+  '@bramus/specificity@2.4.2':
     dependencies:
       css-tree: 3.2.1
 
   '@codemirror/autocomplete@6.20.3':
     dependencies:
-      '@codemirror/language': 6.13.1
-      '@codemirror/state': 6.7.6
-      '@codemirror/view': 6.43.14
-      '@lezer/common': 1.5.3
+      '@codemirror/language': 6.12.4
+      '@codemirror/state': 6.7.4
+      '@codemirror/view': 6.43.11
+      '@lezer/common': 1.5.2
 
-  '@codemirror/commands@6.11.1':
+  '@codemirror/commands@6.10.4':
     dependencies:
-      '@codemirror/language': 6.13.1
-      '@codemirror/state': 6.7.6
-      '@codemirror/view': 6.43.14
-      '@lezer/common': 1.5.3
+      '@codemirror/language': 6.12.4
+      '@codemirror/state': 6.7.0
+      '@codemirror/view': 6.43.4
+      '@lezer/common': 1.5.2
 
-  '@codemirror/language@6.13.1':
+  '@codemirror/commands@6.11.0':
     dependencies:
-      '@codemirror/state': 6.7.6
-      '@codemirror/streamparser': 6.0.0
-      '@codemirror/view': 6.43.14
-      '@lezer/common': 1.5.3
-      '@lezer/highlight': 1.2.5
-      '@lezer/lr': 1.4.11
-      style-mod: 4.1.4
+      '@codemirror/language': 6.12.4
+      '@codemirror/state': 6.7.4
+      '@codemirror/view': 6.43.11
+      '@lezer/common': 1.5.2
+
+  '@codemirror/language@6.12.4':
+    dependencies:
+      '@codemirror/state': 6.7.0
+      '@codemirror/view': 6.43.4
+      '@lezer/common': 1.5.2
+      '@lezer/highlight': 1.2.3
+      '@lezer/lr': 1.4.10
+      style-mod: 4.1.3
 
   '@codemirror/lint@6.9.7':
     dependencies:
-      '@codemirror/state': 6.7.6
-      '@codemirror/view': 6.43.14
+      '@codemirror/state': 6.7.0
+      '@codemirror/view': 6.43.4
       crelt: 1.0.7
 
   '@codemirror/search@6.7.1':
     dependencies:
-      '@codemirror/state': 6.7.6
-      '@codemirror/view': 6.43.14
+      '@codemirror/state': 6.7.4
+      '@codemirror/view': 6.43.11
       crelt: 1.0.7
 
-  '@codemirror/state@6.7.6':
+  '@codemirror/state@6.7.0':
     dependencies:
-      '@marijn/find-cluster-break': 1.0.4
+      '@marijn/find-cluster-break': 1.0.3
 
-  '@codemirror/streamparser@6.0.0': {}
+  '@codemirror/state@6.7.4':
+    dependencies:
+      '@marijn/find-cluster-break': 1.0.4
 
   '@codemirror/theme-one-dark@6.1.3':
     dependencies:
-      '@codemirror/language': 6.13.1
-      '@codemirror/state': 6.7.6
-      '@codemirror/view': 6.43.14
-      '@lezer/highlight': 1.2.5
+      '@codemirror/language': 6.12.4
+      '@codemirror/state': 6.7.4
+      '@codemirror/view': 6.43.11
+      '@lezer/highlight': 1.2.3
+
+  '@codemirror/view@6.43.11':
+    dependencies:
+      '@codemirror/state': 6.7.4
+      crelt: 1.0.7
+      style-mod: 4.1.3
+      w3c-keyname: 2.2.8
 
-  '@codemirror/view@6.43.14':
+  '@codemirror/view@6.43.4':
     dependencies:
-      '@codemirror/state': 6.7.6
+      '@codemirror/state': 6.7.0
       crelt: 1.0.7
-      style-mod: 4.1.4
+      style-mod: 4.1.3
       w3c-keyname: 2.2.8
 
-  '@csstools/color-helpers@6.1.2': {}
+  '@csstools/color-helpers@6.0.2': {}
 
-  '@csstools/css-calc@3.4.3(@csstools/css-parser-algorithms@4.0.2(@csstools/css-tokenizer@4.0.2))(@csstools/css-tokenizer@4.0.2)':
+  '@csstools/css-calc@3.1.1(@csstools/css-parser-algorithms@4.0.0(@csstools/css-tokenizer@4.0.0))(@csstools/css-tokenizer@4.0.0)':
     dependencies:
-      '@csstools/css-parser-algorithms': 4.0.2(@csstools/css-tokenizer@4.0.2)
-      '@csstools/css-tokenizer': 4.0.2
+      '@csstools/css-parser-algorithms': 4.0.0(@csstools/css-tokenizer@4.0.0)
+      '@csstools/css-tokenizer': 4.0.0
 
-  '@csstools/css-color-parser@4.2.6(@csstools/css-parser-algorithms@4.0.2(@csstools/css-tokenizer@4.0.2))(@csstools/css-tokenizer@4.0.2)':
+  '@csstools/css-color-parser@4.0.2(@csstools/css-parser-algorithms@4.0.0(@csstools/css-tokenizer@4.0.0))(@csstools/css-tokenizer@4.0.0)':
     dependencies:
-      '@csstools/color-helpers': 6.1.2
-      '@csstools/css-calc': 3.4.3(@csstools/css-parser-algorithms@4.0.2(@csstools/css-tokenizer@4.0.2))(@csstools/css-tokenizer@4.0.2)
-      '@csstools/css-parser-algorithms': 4.0.2(@csstools/css-tokenizer@4.0.2)
-      '@csstools/css-tokenizer': 4.0.2
+      '@csstools/color-helpers': 6.0.2
+      '@csstools/css-calc': 3.1.1(@csstools/css-parser-algorithms@4.0.0(@csstools/css-tokenizer@4.0.0))(@csstools/css-tokenizer@4.0.0)
+      '@csstools/css-parser-algorithms': 4.0.0(@csstools/css-tokenizer@4.0.0)
+      '@csstools/css-tokenizer': 4.0.0
 
-  '@csstools/css-parser-algorithms@4.0.2(@csstools/css-tokenizer@4.0.2)':
+  '@csstools/css-parser-algorithms@4.0.0(@csstools/css-tokenizer@4.0.0)':
     dependencies:
-      '@csstools/css-tokenizer': 4.0.2
+      '@csstools/css-tokenizer': 4.0.0
 
-  '@csstools/css-syntax-patches-for-csstree@1.1.15(css-tree@3.2.1)':
+  '@csstools/css-syntax-patches-for-csstree@1.1.2(css-tree@3.2.1)':
     optionalDependencies:
       css-tree: 3.2.1
 
-  '@csstools/css-tokenizer@4.0.2': {}
+  '@csstools/css-tokenizer@4.0.0': {}
 
   '@date-fns/tz@1.5.0': {}
 
-  '@dnd-kit/accessibility@3.1.1(react@19.3.0)':
+  '@dnd-kit/accessibility@3.1.1(react@19.2.4)':
     dependencies:
-      react: 19.3.0
+      react: 19.2.4
       tslib: 2.8.1
 
-  '@dnd-kit/core@6.3.1(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+  '@dnd-kit/core@6.3.1(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
     dependencies:
-      '@dnd-kit/accessibility': 3.1.1(react@19.3.0)
-      '@dnd-kit/utilities': 3.2.2(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@dnd-kit/accessibility': 3.1.1(react@19.2.4)
+      '@dnd-kit/utilities': 3.2.2(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
       tslib: 2.8.1
 
-  '@dnd-kit/sortable@10.0.0(@dnd-kit/core@6.3.1(react-dom@19.3.0(react@19.3.0))(react@19.3.0))(react@19.3.0)':
+  '@dnd-kit/sortable@10.0.0(@dnd-kit/core@6.3.1(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(react@19.2.4)':
     dependencies:
-      '@dnd-kit/core': 6.3.1(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@dnd-kit/utilities': 3.2.2(react@19.3.0)
-      react: 19.3.0
+      '@dnd-kit/core': 6.3.1(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@dnd-kit/utilities': 3.2.2(react@19.2.4)
+      react: 19.2.4
       tslib: 2.8.1
 
-  '@dnd-kit/utilities@3.2.2(react@19.3.0)':
+  '@dnd-kit/utilities@3.2.2(react@19.2.4)':
     dependencies:
-      react: 19.3.0
+      react: 19.2.4
       tslib: 2.8.1
 
   '@esbuild/aix-ppc64@0.25.12':
@@ -3608,9 +3725,15 @@ snapshots:
   '@esbuild/win32-x64@0.25.12':
     optional: true
 
-  '@eslint-community/eslint-utils@4.10.1(eslint@9.39.5(jiti@2.7.0))':
+  '@eslint-community/eslint-plugin-eslint-comments@4.8.1(eslint@9.39.4(jiti@2.6.1))':
     dependencies:
-      eslint: 9.39.5(jiti@2.7.0)
+      escape-string-regexp: 4.0.0
+      eslint: 9.39.4(jiti@2.6.1)
+      ignore: 7.0.5
+
+  '@eslint-community/eslint-utils@4.9.1(eslint@9.39.4(jiti@2.6.1))':
+    dependencies:
+      eslint: 9.39.4(jiti@2.6.1)
       eslint-visitor-keys: 3.4.3
 
   '@eslint-community/regexpp@4.12.2': {}
@@ -3631,9 +3754,9 @@ snapshots:
     dependencies:
       '@types/json-schema': 7.0.15
 
-  '@eslint/eslintrc@3.3.7':
+  '@eslint/eslintrc@3.3.5':
     dependencies:
-      ajv: 6.15.0
+      ajv: 6.14.0
       debug: 4.4.3(supports-color@10.2.2)
       espree: 10.4.0
       globals: 14.0.0
@@ -3645,7 +3768,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@eslint/js@9.39.5': {}
+  '@eslint/js@9.39.4': {}
 
   '@eslint/object-schema@2.1.7': {}
 
@@ -3654,46 +3777,40 @@ snapshots:
       '@eslint/core': 0.17.0
       levn: 0.4.1
 
-  '@exodus/bytes@1.16.0': {}
+  '@exodus/bytes@1.15.0': {}
 
-  '@floating-ui/core@1.8.0':
+  '@floating-ui/core@1.7.5':
     dependencies:
-      '@floating-ui/utils': 0.2.12
+      '@floating-ui/utils': 0.2.11
 
-  '@floating-ui/dom@1.8.0':
+  '@floating-ui/dom@1.7.6':
     dependencies:
-      '@floating-ui/core': 1.8.0
-      '@floating-ui/utils': 0.2.12
+      '@floating-ui/core': 1.7.5
+      '@floating-ui/utils': 0.2.11
 
-  '@floating-ui/react-dom@2.1.9(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+  '@floating-ui/react-dom@2.1.8(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
     dependencies:
-      '@floating-ui/dom': 1.8.0
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@floating-ui/dom': 1.7.6
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
 
-  '@floating-ui/utils@0.2.12': {}
+  '@floating-ui/utils@0.2.11': {}
 
   '@fontsource-variable/fraunces@5.3.0': {}
 
-  '@fontsource-variable/manrope@5.3.0': {}
-
-  '@fontsource-variable/outfit@5.3.0': {}
-
-  '@fontsource-variable/sora@5.3.0': {}
-
-  '@fontsource-variable/urbanist@5.3.0': {}
+  '@fontsource-variable/plus-jakarta-sans@5.3.0': {}
 
-  '@fontsource/noto-sans-arabic@5.3.0': {}
+  '@fontsource/noto-sans-arabic@5.2.10': {}
 
-  '@fontsource/noto-sans-thai@5.3.0': {}
+  '@fontsource/noto-sans-thai@5.2.8': {}
 
   '@formatjs/fast-memoize@3.1.7': {}
 
-  '@formatjs/intl-displaynames@7.3.15':
+  '@formatjs/intl-displaynames@7.3.13':
     dependencies:
-      '@formatjs/intl-localematcher': 0.9.0
+      '@formatjs/intl-localematcher': 0.8.13
 
-  '@formatjs/intl-localematcher@0.9.0':
+  '@formatjs/intl-localematcher@0.8.13':
     dependencies:
       '@formatjs/fast-memoize': 3.1.7
 
@@ -3732,820 +3849,814 @@ snapshots:
       '@jridgewell/resolve-uri': 3.1.2
       '@jridgewell/sourcemap-codec': 1.6.0
 
-  '@lezer/common@1.5.3': {}
+  '@lezer/common@1.5.2': {}
 
-  '@lezer/highlight@1.2.5':
+  '@lezer/highlight@1.2.3':
     dependencies:
-      '@lezer/common': 1.5.3
+      '@lezer/common': 1.5.2
 
-  '@lezer/lr@1.4.11':
+  '@lezer/lr@1.4.10':
     dependencies:
-      '@lezer/common': 1.5.3
+      '@lezer/common': 1.5.2
+
+  '@marijn/find-cluster-break@1.0.3': {}
 
   '@marijn/find-cluster-break@1.0.4': {}
 
-  '@napi-rs/canvas-android-arm64@1.0.11':
+  '@napi-rs/canvas-android-arm64@1.0.5':
     optional: true
 
-  '@napi-rs/canvas-darwin-arm64@1.0.11':
+  '@napi-rs/canvas-darwin-arm64@1.0.5':
     optional: true
 
-  '@napi-rs/canvas-darwin-x64@1.0.11':
+  '@napi-rs/canvas-darwin-x64@1.0.5':
     optional: true
 
-  '@napi-rs/canvas-linux-arm-gnueabihf@1.0.11':
+  '@napi-rs/canvas-linux-arm-gnueabihf@1.0.5':
     optional: true
 
-  '@napi-rs/canvas-linux-arm64-gnu@1.0.11':
+  '@napi-rs/canvas-linux-arm64-gnu@1.0.5':
     optional: true
 
-  '@napi-rs/canvas-linux-arm64-musl@1.0.11':
+  '@napi-rs/canvas-linux-arm64-musl@1.0.5':
     optional: true
 
-  '@napi-rs/canvas-linux-riscv64-gnu@1.0.11':
+  '@napi-rs/canvas-linux-riscv64-gnu@1.0.5':
     optional: true
 
-  '@napi-rs/canvas-linux-x64-gnu@1.0.11':
+  '@napi-rs/canvas-linux-x64-gnu@1.0.5':
     optional: true
 
-  '@napi-rs/canvas-linux-x64-musl@1.0.11':
+  '@napi-rs/canvas-linux-x64-musl@1.0.5':
     optional: true
 
-  '@napi-rs/canvas-win32-arm64-msvc@1.0.11':
+  '@napi-rs/canvas-win32-arm64-msvc@1.0.5':
     optional: true
 
-  '@napi-rs/canvas-win32-x64-msvc@1.0.11':
+  '@napi-rs/canvas-win32-x64-msvc@1.0.5':
     optional: true
 
-  '@napi-rs/canvas@1.0.11':
+  '@napi-rs/canvas@1.0.5':
     optionalDependencies:
-      '@napi-rs/canvas-android-arm64': 1.0.11
-      '@napi-rs/canvas-darwin-arm64': 1.0.11
-      '@napi-rs/canvas-darwin-x64': 1.0.11
-      '@napi-rs/canvas-linux-arm-gnueabihf': 1.0.11
-      '@napi-rs/canvas-linux-arm64-gnu': 1.0.11
-      '@napi-rs/canvas-linux-arm64-musl': 1.0.11
-      '@napi-rs/canvas-linux-riscv64-gnu': 1.0.11
-      '@napi-rs/canvas-linux-x64-gnu': 1.0.11
-      '@napi-rs/canvas-linux-x64-musl': 1.0.11
-      '@napi-rs/canvas-win32-arm64-msvc': 1.0.11
-      '@napi-rs/canvas-win32-x64-msvc': 1.0.11
-    optional: true
-
-  '@napi-rs/lzma-linux-x64-gnu@1.5.1':
+      '@napi-rs/canvas-android-arm64': 1.0.5
+      '@napi-rs/canvas-darwin-arm64': 1.0.5
+      '@napi-rs/canvas-darwin-x64': 1.0.5
+      '@napi-rs/canvas-linux-arm-gnueabihf': 1.0.5
+      '@napi-rs/canvas-linux-arm64-gnu': 1.0.5
+      '@napi-rs/canvas-linux-arm64-musl': 1.0.5
+      '@napi-rs/canvas-linux-riscv64-gnu': 1.0.5
+      '@napi-rs/canvas-linux-x64-gnu': 1.0.5
+      '@napi-rs/canvas-linux-x64-musl': 1.0.5
+      '@napi-rs/canvas-win32-arm64-msvc': 1.0.5
+      '@napi-rs/canvas-win32-x64-msvc': 1.0.5
     optional: true
 
-  '@radix-ui/number@1.1.3': {}
+  '@radix-ui/number@1.1.1': {}
 
-  '@radix-ui/primitive@1.2.0': {}
+  '@radix-ui/primitive@1.1.3': {}
 
-  '@radix-ui/react-accessible-icon@1.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+  '@radix-ui/react-accessible-icon@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
     dependencies:
-      '@radix-ui/react-visually-hidden': 1.2.13(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
-
-  '@radix-ui/react-accordion@1.3.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
-    dependencies:
-      '@radix-ui/primitive': 1.2.0
-      '@radix-ui/react-collapsible': 1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-collection': 1.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-context': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-direction': 1.2.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-id': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-use-controllable-state': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+
+  '@radix-ui/react-accordion@1.2.12(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-collapsible': 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.14)(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
-
-  '@radix-ui/react-alert-dialog@1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
-    dependencies:
-      '@radix-ui/primitive': 1.2.0
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-context': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-dialog': 1.3.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+
+  '@radix-ui/react-alert-dialog@1.1.15(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-dialog': 1.1.15(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.14)(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
 
-  '@radix-ui/react-arrow@1.1.17(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+  '@radix-ui/react-arrow@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
     dependencies:
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
 
-  '@radix-ui/react-aspect-ratio@1.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+  '@radix-ui/react-aspect-ratio@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
     dependencies:
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
-
-  '@radix-ui/react-avatar@1.3.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
-    dependencies:
-      '@radix-ui/primitive': 1.2.0
-      '@radix-ui/react-context': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-use-callback-ref': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-is-hydrated': 0.1.3(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+
+  '@radix-ui/react-avatar@1.1.10(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-is-hydrated': 0.1.0(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
-
-  '@radix-ui/react-checkbox@1.4.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
-    dependencies:
-      '@radix-ui/primitive': 1.2.0
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-context': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-presence': 1.1.11(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-use-controllable-state': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-size': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+
+  '@radix-ui/react-checkbox@1.3.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
-
-  '@radix-ui/react-collapsible@1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
-    dependencies:
-      '@radix-ui/primitive': 1.2.0
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-context': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-id': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-presence': 1.1.11(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-use-controllable-state': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+
+  '@radix-ui/react-collapsible@1.1.12(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
-
-  '@radix-ui/react-collection@1.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
-    dependencies:
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-context': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-slot': 1.5.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
-    optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
 
-  '@radix-ui/react-compose-refs@1.1.5(@types/react@19.3.0)(react@19.3.0)':
+  '@radix-ui/react-collection@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
     dependencies:
-      react: 19.3.0
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.14)(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
 
-  '@radix-ui/react-context-menu@2.4.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+  '@radix-ui/react-compose-refs@1.1.2(@types/react@19.2.14)(react@19.2.4)':
     dependencies:
-      '@radix-ui/primitive': 1.2.0
-      '@radix-ui/react-context': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-menu': 2.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-use-controllable-state': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      react: 19.2.4
+    optionalDependencies:
+      '@types/react': 19.2.14
+
+  '@radix-ui/react-context-menu@2.2.16(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-menu': 2.1.16(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.14)(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
 
-  '@radix-ui/react-context@1.3.0(@types/react@19.3.0)(react@19.3.0)':
+  '@radix-ui/react-context@1.1.2(@types/react@19.2.14)(react@19.2.4)':
     dependencies:
-      react: 19.3.0
+      react: 19.2.4
     optionalDependencies:
-      '@types/react': 19.3.0
-
-  '@radix-ui/react-dialog@1.3.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
-    dependencies:
-      '@radix-ui/primitive': 1.2.0
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-context': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-dismissable-layer': 1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-focus-guards': 1.2.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-focus-scope': 1.3.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-id': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-portal': 1.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-presence': 1.1.11(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-slot': 1.5.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-controllable-state': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+      '@types/react': 19.2.14
+
+  '@radix-ui/react-dialog@1.1.15(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.14)(react@19.2.4)
       aria-hidden: 1.2.6
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
-      react-remove-scroll: 2.7.2(@types/react@19.3.0)(react@19.3.0)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
+      react-remove-scroll: 2.7.2(@types/react@19.2.14)(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
 
-  '@radix-ui/react-direction@1.2.0(@types/react@19.3.0)(react@19.3.0)':
+  '@radix-ui/react-direction@1.1.1(@types/react@19.2.14)(react@19.2.4)':
     dependencies:
-      react: 19.3.0
+      react: 19.2.4
     optionalDependencies:
-      '@types/react': 19.3.0
+      '@types/react': 19.2.14
 
-  '@radix-ui/react-dismissable-layer@1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+  '@radix-ui/react-dismissable-layer@1.1.11(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
     dependencies:
-      '@radix-ui/primitive': 1.2.0
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-use-callback-ref': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-effect-event': 0.0.5(@types/react@19.3.0)(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-escape-keydown': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
-
-  '@radix-ui/react-dropdown-menu@2.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
-    dependencies:
-      '@radix-ui/primitive': 1.2.0
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-context': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-id': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-menu': 2.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-use-controllable-state': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+
+  '@radix-ui/react-dropdown-menu@2.1.16(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-menu': 2.1.16(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.14)(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
 
-  '@radix-ui/react-focus-guards@1.2.0(@types/react@19.3.0)(react@19.3.0)':
+  '@radix-ui/react-focus-guards@1.1.3(@types/react@19.2.14)(react@19.2.4)':
     dependencies:
-      react: 19.3.0
+      react: 19.2.4
     optionalDependencies:
-      '@types/react': 19.3.0
+      '@types/react': 19.2.14
 
-  '@radix-ui/react-focus-scope@1.3.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+  '@radix-ui/react-focus-scope@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-use-callback-ref': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
-
-  '@radix-ui/react-form@0.3.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
-    dependencies:
-      '@radix-ui/primitive': 1.2.0
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-context': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-id': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-label': 2.1.17(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+
+  '@radix-ui/react-form@0.1.8(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-label': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
-
-  '@radix-ui/react-hover-card@1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
-    dependencies:
-      '@radix-ui/primitive': 1.2.0
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-context': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-dismissable-layer': 1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-focus-scope': 1.3.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-popper': 1.4.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-portal': 1.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-presence': 1.1.11(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-use-controllable-state': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+
+  '@radix-ui/react-hover-card@1.1.15(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.14)(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
 
-  '@radix-ui/react-id@1.1.4(@types/react@19.3.0)(react@19.3.0)':
+  '@radix-ui/react-id@1.1.1(@types/react@19.2.14)(react@19.2.4)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      react: 19.3.0
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      react: 19.2.4
     optionalDependencies:
-      '@types/react': 19.3.0
+      '@types/react': 19.2.14
 
-  '@radix-ui/react-label@2.1.17(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+  '@radix-ui/react-label@2.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
     dependencies:
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
-
-  '@radix-ui/react-menu@2.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
-    dependencies:
-      '@radix-ui/primitive': 1.2.0
-      '@radix-ui/react-collection': 1.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-context': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-direction': 1.2.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-dismissable-layer': 1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-focus-guards': 1.2.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-focus-scope': 1.3.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-id': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-popper': 1.4.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-portal': 1.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-presence': 1.1.11(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-roving-focus': 1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-slot': 1.5.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-callback-ref': 1.1.5(@types/react@19.3.0)(react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+
+  '@radix-ui/react-menu@2.1.16(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.14)(react@19.2.4)
       aria-hidden: 1.2.6
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
-      react-remove-scroll: 2.7.2(@types/react@19.3.0)(react@19.3.0)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
+      react-remove-scroll: 2.7.2(@types/react@19.2.14)(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
-
-  '@radix-ui/react-menubar@1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
-    dependencies:
-      '@radix-ui/primitive': 1.2.0
-      '@radix-ui/react-collection': 1.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-context': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-direction': 1.2.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-id': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-menu': 2.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-roving-focus': 1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-use-controllable-state': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+
+  '@radix-ui/react-menubar@1.1.16(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-menu': 2.1.16(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.14)(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
-
-  '@radix-ui/react-navigation-menu@1.4.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
-    dependencies:
-      '@radix-ui/primitive': 1.2.0
-      '@radix-ui/react-collection': 1.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-context': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-direction': 1.2.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-dismissable-layer': 1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-id': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-presence': 1.1.11(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-slot': 1.5.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-callback-ref': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-controllable-state': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-previous': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-visually-hidden': 1.2.13(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+
+  '@radix-ui/react-navigation-menu@1.2.14(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
-
-  '@radix-ui/react-one-time-password-field@0.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
-    dependencies:
-      '@radix-ui/number': 1.1.3
-      '@radix-ui/primitive': 1.2.0
-      '@radix-ui/react-collection': 1.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-context': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-direction': 1.2.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-roving-focus': 1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-use-controllable-state': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-effect-event': 0.0.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-is-hydrated': 0.1.3(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+
+  '@radix-ui/react-one-time-password-field@0.1.8(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@radix-ui/number': 1.1.1
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-effect-event': 0.0.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-is-hydrated': 0.1.0(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
-
-  '@radix-ui/react-password-toggle-field@0.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
-    dependencies:
-      '@radix-ui/primitive': 1.2.0
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-context': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-id': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-use-controllable-state': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-effect-event': 0.0.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-is-hydrated': 0.1.3(@types/react@19.3.0)(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+
+  '@radix-ui/react-password-toggle-field@0.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-effect-event': 0.0.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-is-hydrated': 0.1.0(@types/react@19.2.14)(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
-
-  '@radix-ui/react-popover@1.3.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
-    dependencies:
-      '@radix-ui/primitive': 1.2.0
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-context': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-dismissable-layer': 1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-focus-guards': 1.2.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-focus-scope': 1.3.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-id': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-popper': 1.4.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-portal': 1.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-presence': 1.1.11(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-slot': 1.5.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-controllable-state': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+
+  '@radix-ui/react-popover@1.1.15(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.14)(react@19.2.4)
       aria-hidden: 1.2.6
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
-      react-remove-scroll: 2.7.2(@types/react@19.3.0)(react@19.3.0)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
+      react-remove-scroll: 2.7.2(@types/react@19.2.14)(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
-
-  '@radix-ui/react-popper@1.4.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
-    dependencies:
-      '@floating-ui/react-dom': 2.1.9(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-arrow': 1.1.17(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-context': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-use-callback-ref': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-rect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-size': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/rect': 1.1.3
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+
+  '@radix-ui/react-popper@1.2.8(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@floating-ui/react-dom': 2.1.8(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-arrow': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-rect': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/rect': 1.1.1
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
 
-  '@radix-ui/react-portal@1.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+  '@radix-ui/react-portal@1.1.9(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
     dependencies:
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
 
-  '@radix-ui/react-presence@1.1.11(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+  '@radix-ui/react-presence@1.1.5(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
 
-  '@radix-ui/react-primitive@2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+  '@radix-ui/react-primitive@2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
     dependencies:
-      '@radix-ui/react-slot': 1.5.0(@types/react@19.3.0)(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.14)(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
 
-  '@radix-ui/react-progress@1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+  '@radix-ui/react-progress@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
     dependencies:
-      '@radix-ui/react-context': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
-
-  '@radix-ui/react-radio-group@1.5.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
-    dependencies:
-      '@radix-ui/primitive': 1.2.0
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-context': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-direction': 1.2.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-presence': 1.1.11(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-roving-focus': 1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-use-controllable-state': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-size': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+
+  '@radix-ui/react-radio-group@1.3.8(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
-
-  '@radix-ui/react-roving-focus@1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
-    dependencies:
-      '@radix-ui/primitive': 1.2.0
-      '@radix-ui/react-collection': 1.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-context': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-direction': 1.2.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-id': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-use-callback-ref': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-controllable-state': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-is-hydrated': 0.1.3(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+
+  '@radix-ui/react-roving-focus@1.1.11(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.14)(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
-
-  '@radix-ui/react-scroll-area@1.4.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
-    dependencies:
-      '@radix-ui/number': 1.1.3
-      '@radix-ui/primitive': 1.2.0
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-context': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-direction': 1.2.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-presence': 1.1.11(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-slot': 1.5.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-callback-ref': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+
+  '@radix-ui/react-scroll-area@1.2.10(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@radix-ui/number': 1.1.1
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
-
-  '@radix-ui/react-select@2.4.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
-    dependencies:
-      '@radix-ui/number': 1.1.3
-      '@radix-ui/primitive': 1.2.0
-      '@radix-ui/react-collection': 1.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-context': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-direction': 1.2.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-dismissable-layer': 1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-focus-guards': 1.2.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-focus-scope': 1.3.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-id': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-popper': 1.4.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-portal': 1.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-presence': 1.1.11(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-slot': 1.5.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-callback-ref': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-controllable-state': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-visually-hidden': 1.2.13(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+
+  '@radix-ui/react-select@2.2.6(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@radix-ui/number': 1.1.1
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
       aria-hidden: 1.2.6
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
-      react-remove-scroll: 2.7.2(@types/react@19.3.0)(react@19.3.0)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
+      react-remove-scroll: 2.7.2(@types/react@19.2.14)(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
 
-  '@radix-ui/react-separator@1.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+  '@radix-ui/react-separator@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
     dependencies:
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
-
-  '@radix-ui/react-slider@1.6.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
-    dependencies:
-      '@radix-ui/number': 1.1.3
-      '@radix-ui/primitive': 1.2.0
-      '@radix-ui/react-collection': 1.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-context': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-direction': 1.2.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-use-controllable-state': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-size': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+
+  '@radix-ui/react-slider@1.3.6(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@radix-ui/number': 1.1.1
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
 
-  '@radix-ui/react-slot@1.5.0(@types/react@19.3.0)(react@19.3.0)':
+  '@radix-ui/react-slot@1.2.3(@types/react@19.2.14)(react@19.2.4)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      react: 19.3.0
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      react: 19.2.4
     optionalDependencies:
-      '@types/react': 19.3.0
-
-  '@radix-ui/react-switch@1.4.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
-    dependencies:
-      '@radix-ui/primitive': 1.2.0
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-context': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-use-controllable-state': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-size': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@types/react': 19.2.14
+
+  '@radix-ui/react-switch@1.2.6(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
-
-  '@radix-ui/react-tabs@1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
-    dependencies:
-      '@radix-ui/primitive': 1.2.0
-      '@radix-ui/react-context': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-direction': 1.2.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-id': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-presence': 1.1.11(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-roving-focus': 1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-use-controllable-state': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+
+  '@radix-ui/react-tabs@1.1.13(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.14)(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
-
-  '@radix-ui/react-toast@1.3.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
-    dependencies:
-      '@radix-ui/primitive': 1.2.0
-      '@radix-ui/react-collection': 1.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-context': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-dismissable-layer': 1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-portal': 1.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-presence': 1.1.11(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-use-callback-ref': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-controllable-state': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-visually-hidden': 1.2.13(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+
+  '@radix-ui/react-toast@1.2.15(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
-
-  '@radix-ui/react-toggle-group@1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
-    dependencies:
-      '@radix-ui/primitive': 1.2.0
-      '@radix-ui/react-context': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-direction': 1.2.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-roving-focus': 1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-toggle': 1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-use-controllable-state': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+
+  '@radix-ui/react-toggle-group@1.1.11(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-toggle': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.14)(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
 
-  '@radix-ui/react-toggle@1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+  '@radix-ui/react-toggle@1.1.10(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
     dependencies:
-      '@radix-ui/primitive': 1.2.0
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-use-controllable-state': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.14)(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
-
-  '@radix-ui/react-toolbar@1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
-    dependencies:
-      '@radix-ui/primitive': 1.2.0
-      '@radix-ui/react-context': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-direction': 1.2.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-roving-focus': 1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-separator': 1.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-toggle-group': 1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+
+  '@radix-ui/react-toolbar@1.1.11(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-separator': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-toggle-group': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
-
-  '@radix-ui/react-tooltip@1.4.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
-    dependencies:
-      '@radix-ui/primitive': 1.2.0
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-context': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-dismissable-layer': 1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-focus-scope': 1.3.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-id': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-popper': 1.4.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-portal': 1.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-presence': 1.1.11(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-slot': 1.5.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-controllable-state': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-visually-hidden': 1.2.13(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
+
+  '@radix-ui/react-tooltip@1.2.8(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
 
-  '@radix-ui/react-use-callback-ref@1.1.5(@types/react@19.3.0)(react@19.3.0)':
+  '@radix-ui/react-use-callback-ref@1.1.1(@types/react@19.2.14)(react@19.2.4)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      react: 19.3.0
+      react: 19.2.4
     optionalDependencies:
-      '@types/react': 19.3.0
+      '@types/react': 19.2.14
 
-  '@radix-ui/react-use-controllable-state@1.3.0(@types/react@19.3.0)(react@19.3.0)':
+  '@radix-ui/react-use-controllable-state@1.2.2(@types/react@19.2.14)(react@19.2.4)':
     dependencies:
-      '@radix-ui/primitive': 1.2.0
-      '@radix-ui/react-use-effect-event': 0.0.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      react: 19.3.0
+      '@radix-ui/react-use-effect-event': 0.0.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      react: 19.2.4
     optionalDependencies:
-      '@types/react': 19.3.0
+      '@types/react': 19.2.14
 
-  '@radix-ui/react-use-effect-event@0.0.5(@types/react@19.3.0)(react@19.3.0)':
+  '@radix-ui/react-use-effect-event@0.0.2(@types/react@19.2.14)(react@19.2.4)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      react: 19.3.0
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      react: 19.2.4
     optionalDependencies:
-      '@types/react': 19.3.0
+      '@types/react': 19.2.14
 
-  '@radix-ui/react-use-escape-keydown@1.1.6(@types/react@19.3.0)(react@19.3.0)':
+  '@radix-ui/react-use-escape-keydown@1.1.1(@types/react@19.2.14)(react@19.2.4)':
     dependencies:
-      '@radix-ui/react-use-callback-ref': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      react: 19.3.0
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      react: 19.2.4
     optionalDependencies:
-      '@types/react': 19.3.0
+      '@types/react': 19.2.14
 
-  '@radix-ui/react-use-is-hydrated@0.1.3(@types/react@19.3.0)(react@19.3.0)':
+  '@radix-ui/react-use-is-hydrated@0.1.0(@types/react@19.2.14)(react@19.2.4)':
     dependencies:
-      react: 19.3.0
+      react: 19.2.4
+      use-sync-external-store: 1.6.0(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
+      '@types/react': 19.2.14
 
-  '@radix-ui/react-use-layout-effect@1.1.4(@types/react@19.3.0)(react@19.3.0)':
+  '@radix-ui/react-use-layout-effect@1.1.1(@types/react@19.2.14)(react@19.2.4)':
     dependencies:
-      react: 19.3.0
+      react: 19.2.4
     optionalDependencies:
-      '@types/react': 19.3.0
+      '@types/react': 19.2.14
 
-  '@radix-ui/react-use-previous@1.1.4(@types/react@19.3.0)(react@19.3.0)':
+  '@radix-ui/react-use-previous@1.1.1(@types/react@19.2.14)(react@19.2.4)':
     dependencies:
-      react: 19.3.0
+      react: 19.2.4
     optionalDependencies:
-      '@types/react': 19.3.0
+      '@types/react': 19.2.14
 
-  '@radix-ui/react-use-rect@1.1.4(@types/react@19.3.0)(react@19.3.0)':
+  '@radix-ui/react-use-rect@1.1.1(@types/react@19.2.14)(react@19.2.4)':
     dependencies:
-      '@radix-ui/rect': 1.1.3
-      react: 19.3.0
+      '@radix-ui/rect': 1.1.1
+      react: 19.2.4
     optionalDependencies:
-      '@types/react': 19.3.0
+      '@types/react': 19.2.14
 
-  '@radix-ui/react-use-size@1.1.5(@types/react@19.3.0)(react@19.3.0)':
+  '@radix-ui/react-use-size@1.1.1(@types/react@19.2.14)(react@19.2.4)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      react: 19.3.0
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      react: 19.2.4
     optionalDependencies:
-      '@types/react': 19.3.0
+      '@types/react': 19.2.14
 
-  '@radix-ui/react-visually-hidden@1.2.13(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+  '@radix-ui/react-visually-hidden@1.2.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
     dependencies:
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
 
-  '@radix-ui/rect@1.1.3': {}
+  '@radix-ui/rect@1.1.1': {}
 
   '@redocly/ajv@8.11.2':
     dependencies:
@@ -4570,174 +4681,172 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@remix-run/route-pattern@0.22.1': {}
-
   '@rolldown/pluginutils@1.0.0-beta.27': {}
 
-  '@rollup/rollup-android-arm-eabi@4.64.5':
+  '@rollup/rollup-android-arm-eabi@4.62.0':
     optional: true
 
-  '@rollup/rollup-android-arm64@4.64.5':
+  '@rollup/rollup-android-arm64@4.62.0':
     optional: true
 
-  '@rollup/rollup-darwin-arm64@4.64.5':
+  '@rollup/rollup-darwin-arm64@4.62.0':
     optional: true
 
-  '@rollup/rollup-darwin-x64@4.64.5':
+  '@rollup/rollup-darwin-x64@4.62.0':
     optional: true
 
-  '@rollup/rollup-freebsd-arm64@4.64.5':
+  '@rollup/rollup-freebsd-arm64@4.62.0':
     optional: true
 
-  '@rollup/rollup-freebsd-x64@4.64.5':
+  '@rollup/rollup-freebsd-x64@4.62.0':
     optional: true
 
-  '@rollup/rollup-linux-arm-gnueabihf@4.64.5':
+  '@rollup/rollup-linux-arm-gnueabihf@4.62.0':
     optional: true
 
-  '@rollup/rollup-linux-arm-musleabihf@4.64.5':
+  '@rollup/rollup-linux-arm-musleabihf@4.62.0':
     optional: true
 
-  '@rollup/rollup-linux-arm64-gnu@4.64.5':
+  '@rollup/rollup-linux-arm64-gnu@4.62.0':
     optional: true
 
-  '@rollup/rollup-linux-arm64-musl@4.64.5':
+  '@rollup/rollup-linux-arm64-musl@4.62.0':
     optional: true
 
-  '@rollup/rollup-linux-loong64-gnu@4.64.5':
+  '@rollup/rollup-linux-loong64-gnu@4.62.0':
     optional: true
 
-  '@rollup/rollup-linux-loong64-musl@4.64.5':
+  '@rollup/rollup-linux-loong64-musl@4.62.0':
     optional: true
 
-  '@rollup/rollup-linux-ppc64-gnu@4.64.5':
+  '@rollup/rollup-linux-ppc64-gnu@4.62.0':
     optional: true
 
-  '@rollup/rollup-linux-ppc64-musl@4.64.5':
+  '@rollup/rollup-linux-ppc64-musl@4.62.0':
     optional: true
 
-  '@rollup/rollup-linux-riscv64-gnu@4.64.5':
+  '@rollup/rollup-linux-riscv64-gnu@4.62.0':
     optional: true
 
-  '@rollup/rollup-linux-riscv64-musl@4.64.5':
+  '@rollup/rollup-linux-riscv64-musl@4.62.0':
     optional: true
 
-  '@rollup/rollup-linux-s390x-gnu@4.64.5':
+  '@rollup/rollup-linux-s390x-gnu@4.62.0':
     optional: true
 
-  '@rollup/rollup-linux-x64-gnu@4.64.5':
+  '@rollup/rollup-linux-x64-gnu@4.62.0':
     optional: true
 
-  '@rollup/rollup-linux-x64-musl@4.64.5':
+  '@rollup/rollup-linux-x64-musl@4.62.0':
     optional: true
 
-  '@rollup/rollup-openbsd-x64@4.64.5':
+  '@rollup/rollup-openbsd-x64@4.62.0':
     optional: true
 
-  '@rollup/rollup-openharmony-arm64@4.64.5':
+  '@rollup/rollup-openharmony-arm64@4.62.0':
     optional: true
 
-  '@rollup/rollup-win32-arm64-msvc@4.64.5':
+  '@rollup/rollup-win32-arm64-msvc@4.62.0':
     optional: true
 
-  '@rollup/rollup-win32-ia32-msvc@4.64.5':
+  '@rollup/rollup-win32-ia32-msvc@4.62.0':
     optional: true
 
-  '@rollup/rollup-win32-x64-gnu@4.64.5':
+  '@rollup/rollup-win32-x64-gnu@4.62.0':
     optional: true
 
-  '@rollup/rollup-win32-x64-msvc@4.64.5':
+  '@rollup/rollup-win32-x64-msvc@4.62.0':
     optional: true
 
   '@standard-schema/spec@1.1.0': {}
 
-  '@tailwindcss/node@4.3.3':
+  '@tailwindcss/node@4.2.1':
     dependencies:
       '@jridgewell/remapping': 2.3.5
-      enhanced-resolve: 5.26.0
-      jiti: 2.7.0
-      lightningcss: 1.32.0
+      enhanced-resolve: 5.20.0
+      jiti: 2.6.1
+      lightningcss: 1.31.1
       magic-string: 0.30.21
       source-map-js: 1.2.2
-      tailwindcss: 4.3.3
+      tailwindcss: 4.2.1
 
-  '@tailwindcss/oxide-android-arm64@4.3.3':
+  '@tailwindcss/oxide-android-arm64@4.2.1':
     optional: true
 
-  '@tailwindcss/oxide-darwin-arm64@4.3.3':
+  '@tailwindcss/oxide-darwin-arm64@4.2.1':
     optional: true
 
-  '@tailwindcss/oxide-darwin-x64@4.3.3':
+  '@tailwindcss/oxide-darwin-x64@4.2.1':
     optional: true
 
-  '@tailwindcss/oxide-freebsd-x64@4.3.3':
+  '@tailwindcss/oxide-freebsd-x64@4.2.1':
     optional: true
 
-  '@tailwindcss/oxide-linux-arm-gnueabihf@4.3.3':
+  '@tailwindcss/oxide-linux-arm-gnueabihf@4.2.1':
     optional: true
 
-  '@tailwindcss/oxide-linux-arm64-gnu@4.3.3':
+  '@tailwindcss/oxide-linux-arm64-gnu@4.2.1':
     optional: true
 
-  '@tailwindcss/oxide-linux-arm64-musl@4.3.3':
+  '@tailwindcss/oxide-linux-arm64-musl@4.2.1':
     optional: true
 
-  '@tailwindcss/oxide-linux-x64-gnu@4.3.3':
+  '@tailwindcss/oxide-linux-x64-gnu@4.2.1':
     optional: true
 
-  '@tailwindcss/oxide-linux-x64-musl@4.3.3':
+  '@tailwindcss/oxide-linux-x64-musl@4.2.1':
     optional: true
 
-  '@tailwindcss/oxide-wasm32-wasi@4.3.3':
+  '@tailwindcss/oxide-wasm32-wasi@4.2.1':
     optional: true
 
-  '@tailwindcss/oxide-win32-arm64-msvc@4.3.3':
+  '@tailwindcss/oxide-win32-arm64-msvc@4.2.1':
     optional: true
 
-  '@tailwindcss/oxide-win32-x64-msvc@4.3.3':
+  '@tailwindcss/oxide-win32-x64-msvc@4.2.1':
     optional: true
 
-  '@tailwindcss/oxide@4.3.3':
+  '@tailwindcss/oxide@4.2.1':
     optionalDependencies:
-      '@tailwindcss/oxide-android-arm64': 4.3.3
-      '@tailwindcss/oxide-darwin-arm64': 4.3.3
-      '@tailwindcss/oxide-darwin-x64': 4.3.3
-      '@tailwindcss/oxide-freebsd-x64': 4.3.3
-      '@tailwindcss/oxide-linux-arm-gnueabihf': 4.3.3
-      '@tailwindcss/oxide-linux-arm64-gnu': 4.3.3
-      '@tailwindcss/oxide-linux-arm64-musl': 4.3.3
-      '@tailwindcss/oxide-linux-x64-gnu': 4.3.3
-      '@tailwindcss/oxide-linux-x64-musl': 4.3.3
-      '@tailwindcss/oxide-wasm32-wasi': 4.3.3
-      '@tailwindcss/oxide-win32-arm64-msvc': 4.3.3
-      '@tailwindcss/oxide-win32-x64-msvc': 4.3.3
+      '@tailwindcss/oxide-android-arm64': 4.2.1
+      '@tailwindcss/oxide-darwin-arm64': 4.2.1
+      '@tailwindcss/oxide-darwin-x64': 4.2.1
+      '@tailwindcss/oxide-freebsd-x64': 4.2.1
+      '@tailwindcss/oxide-linux-arm-gnueabihf': 4.2.1
+      '@tailwindcss/oxide-linux-arm64-gnu': 4.2.1
+      '@tailwindcss/oxide-linux-arm64-musl': 4.2.1
+      '@tailwindcss/oxide-linux-x64-gnu': 4.2.1
+      '@tailwindcss/oxide-linux-x64-musl': 4.2.1
+      '@tailwindcss/oxide-wasm32-wasi': 4.2.1
+      '@tailwindcss/oxide-win32-arm64-msvc': 4.2.1
+      '@tailwindcss/oxide-win32-x64-msvc': 4.2.1
 
-  '@tailwindcss/vite@4.3.3(vite@6.4.4(@types/node@25.9.9)(jiti@2.7.0)(lightningcss@1.32.0))':
+  '@tailwindcss/vite@4.2.1(vite@6.4.3(@types/node@25.5.0)(jiti@2.6.1)(lightningcss@1.32.0))':
     dependencies:
-      '@tailwindcss/node': 4.3.3
-      '@tailwindcss/oxide': 4.3.3
-      tailwindcss: 4.3.3
-      vite: 6.4.4(@types/node@25.9.9)(jiti@2.7.0)(lightningcss@1.32.0)
+      '@tailwindcss/node': 4.2.1
+      '@tailwindcss/oxide': 4.2.1
+      tailwindcss: 4.2.1
+      vite: 6.4.3(@types/node@25.5.0)(jiti@2.6.1)(lightningcss@1.32.0)
 
-  '@tanstack/query-core@5.104.2': {}
+  '@tanstack/query-core@5.90.20': {}
 
-  '@tanstack/react-query@5.104.2(react@19.3.0)':
+  '@tanstack/react-query@5.90.21(react@19.2.4)':
     dependencies:
-      '@tanstack/query-core': 5.104.2
-      react: 19.3.0
+      '@tanstack/query-core': 5.90.20
+      react: 19.2.4
 
-  '@tanstack/react-virtual@3.14.17(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+  '@tanstack/react-virtual@3.13.22(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
     dependencies:
-      '@tanstack/virtual-core': 3.19.2
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      '@tanstack/virtual-core': 3.13.22
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
 
-  '@tanstack/virtual-core@3.19.2': {}
+  '@tanstack/virtual-core@3.13.22': {}
 
   '@testing-library/dom@10.4.1':
     dependencies:
       '@babel/code-frame': 7.29.7
-      '@babel/runtime': 7.29.10
+      '@babel/runtime': 7.29.7
       '@types/aria-query': 5.0.4
       aria-query: 5.3.0
       dom-accessibility-api: 0.5.16
@@ -4754,17 +4863,17 @@ snapshots:
       picocolors: 1.1.1
       redent: 3.0.0
 
-  '@testing-library/react@16.3.3(@testing-library/dom@10.4.1)(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+  '@testing-library/react@16.3.2(@testing-library/dom@10.4.1)(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
     dependencies:
-      '@babel/runtime': 7.29.10
+      '@babel/runtime': 7.29.2
       '@testing-library/dom': 10.4.1
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
 
-  '@testing-library/user-event@14.6.7(@testing-library/dom@10.4.1)':
+  '@testing-library/user-event@14.6.1(@testing-library/dom@10.4.1)':
     dependencies:
       '@testing-library/dom': 10.4.1
 
@@ -4772,24 +4881,24 @@ snapshots:
 
   '@types/babel__core@7.20.5':
     dependencies:
-      '@babel/parser': 7.29.0
-      '@babel/types': 7.29.0
+      '@babel/parser': 7.29.7
+      '@babel/types': 7.29.7
       '@types/babel__generator': 7.27.0
       '@types/babel__template': 7.4.4
       '@types/babel__traverse': 7.28.0
 
   '@types/babel__generator@7.27.0':
     dependencies:
-      '@babel/types': 7.29.0
+      '@babel/types': 7.29.7
 
   '@types/babel__template@7.4.4':
     dependencies:
-      '@babel/parser': 7.29.0
-      '@babel/types': 7.29.0
+      '@babel/parser': 7.29.7
+      '@babel/types': 7.29.7
 
   '@types/babel__traverse@7.28.0':
     dependencies:
-      '@babel/types': 7.29.0
+      '@babel/types': 7.29.7
 
   '@types/chai@5.2.3':
     dependencies:
@@ -4798,141 +4907,149 @@ snapshots:
 
   '@types/deep-eql@4.0.2': {}
 
+  '@types/dom-mediacapture-transform@0.1.12':
+    dependencies:
+      '@types/dom-webcodecs': 0.1.13
+
+  '@types/dom-webcodecs@0.1.13': {}
+
+  '@types/estree@1.0.8': {}
+
   '@types/estree@1.0.9': {}
 
   '@types/json-schema@7.0.15': {}
 
-  '@types/node@25.9.9':
+  '@types/node@25.5.0':
     dependencies:
-      undici-types: 7.24.6
+      undici-types: 7.18.2
 
-  '@types/react-dom@19.3.0(@types/react@19.3.0)':
+  '@types/react-dom@19.2.3(@types/react@19.2.14)':
     dependencies:
-      '@types/react': 19.3.0
+      '@types/react': 19.2.14
 
-  '@types/react@19.3.0':
+  '@types/react@19.2.14':
     dependencies:
       csstype: 3.2.3
 
-  '@typescript-eslint/eslint-plugin@8.71.2(@typescript-eslint/parser@8.71.2(eslint@9.39.5(jiti@2.7.0))(typescript@5.9.3))(eslint@9.39.5(jiti@2.7.0))(typescript@5.9.3)':
+  '@typescript-eslint/eslint-plugin@8.57.0(@typescript-eslint/parser@8.57.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.9.3))(eslint@9.39.4(jiti@2.6.1))(typescript@5.9.3)':
     dependencies:
       '@eslint-community/regexpp': 4.12.2
-      '@typescript-eslint/parser': 8.71.2(eslint@9.39.5(jiti@2.7.0))(typescript@5.9.3)
-      '@typescript-eslint/scope-manager': 8.71.2
-      '@typescript-eslint/type-utils': 8.71.2(eslint@9.39.5(jiti@2.7.0))(typescript@5.9.3)
-      '@typescript-eslint/utils': 8.71.2(eslint@9.39.5(jiti@2.7.0))(typescript@5.9.3)
-      '@typescript-eslint/visitor-keys': 8.71.2
-      eslint: 9.39.5(jiti@2.7.0)
-      ignore: 7.0.12
+      '@typescript-eslint/parser': 8.57.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.9.3)
+      '@typescript-eslint/scope-manager': 8.57.0
+      '@typescript-eslint/type-utils': 8.57.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.9.3)
+      '@typescript-eslint/utils': 8.57.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.9.3)
+      '@typescript-eslint/visitor-keys': 8.57.0
+      eslint: 9.39.4(jiti@2.6.1)
+      ignore: 7.0.5
       natural-compare: 1.4.0
-      ts-api-utils: 2.5.0(typescript@5.9.3)
+      ts-api-utils: 2.4.0(typescript@5.9.3)
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/parser@8.71.2(eslint@9.39.5(jiti@2.7.0))(typescript@5.9.3)':
+  '@typescript-eslint/parser@8.57.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.9.3)':
     dependencies:
-      '@typescript-eslint/scope-manager': 8.71.2
-      '@typescript-eslint/types': 8.71.2
-      '@typescript-eslint/typescript-estree': 8.71.2(typescript@5.9.3)
-      '@typescript-eslint/visitor-keys': 8.71.2
+      '@typescript-eslint/scope-manager': 8.57.0
+      '@typescript-eslint/types': 8.57.0
+      '@typescript-eslint/typescript-estree': 8.57.0(typescript@5.9.3)
+      '@typescript-eslint/visitor-keys': 8.57.0
       debug: 4.4.3(supports-color@10.2.2)
-      eslint: 9.39.5(jiti@2.7.0)
+      eslint: 9.39.4(jiti@2.6.1)
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/project-service@8.71.2(typescript@5.9.3)':
+  '@typescript-eslint/project-service@8.57.0(typescript@5.9.3)':
     dependencies:
-      '@typescript-eslint/tsconfig-utils': 8.71.2(typescript@5.9.3)
-      '@typescript-eslint/types': 8.71.2
+      '@typescript-eslint/tsconfig-utils': 8.57.0(typescript@5.9.3)
+      '@typescript-eslint/types': 8.57.0
       debug: 4.4.3(supports-color@10.2.2)
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/scope-manager@8.71.2':
+  '@typescript-eslint/scope-manager@8.57.0':
     dependencies:
-      '@typescript-eslint/types': 8.71.2
-      '@typescript-eslint/visitor-keys': 8.71.2
+      '@typescript-eslint/types': 8.57.0
+      '@typescript-eslint/visitor-keys': 8.57.0
 
-  '@typescript-eslint/tsconfig-utils@8.71.2(typescript@5.9.3)':
+  '@typescript-eslint/tsconfig-utils@8.57.0(typescript@5.9.3)':
     dependencies:
       typescript: 5.9.3
 
-  '@typescript-eslint/type-utils@8.71.2(eslint@9.39.5(jiti@2.7.0))(typescript@5.9.3)':
+  '@typescript-eslint/type-utils@8.57.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.9.3)':
     dependencies:
-      '@typescript-eslint/types': 8.71.2
-      '@typescript-eslint/typescript-estree': 8.71.2(typescript@5.9.3)
-      '@typescript-eslint/utils': 8.71.2(eslint@9.39.5(jiti@2.7.0))(typescript@5.9.3)
+      '@typescript-eslint/types': 8.57.0
+      '@typescript-eslint/typescript-estree': 8.57.0(typescript@5.9.3)
+      '@typescript-eslint/utils': 8.57.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.9.3)
       debug: 4.4.3(supports-color@10.2.2)
-      eslint: 9.39.5(jiti@2.7.0)
-      ts-api-utils: 2.5.0(typescript@5.9.3)
+      eslint: 9.39.4(jiti@2.6.1)
+      ts-api-utils: 2.4.0(typescript@5.9.3)
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/types@8.71.2': {}
+  '@typescript-eslint/types@8.57.0': {}
 
-  '@typescript-eslint/typescript-estree@8.71.2(typescript@5.9.3)':
+  '@typescript-eslint/typescript-estree@8.57.0(typescript@5.9.3)':
     dependencies:
-      '@typescript-eslint/project-service': 8.71.2(typescript@5.9.3)
-      '@typescript-eslint/tsconfig-utils': 8.71.2(typescript@5.9.3)
-      '@typescript-eslint/types': 8.71.2
-      '@typescript-eslint/visitor-keys': 8.71.2
+      '@typescript-eslint/project-service': 8.57.0(typescript@5.9.3)
+      '@typescript-eslint/tsconfig-utils': 8.57.0(typescript@5.9.3)
+      '@typescript-eslint/types': 8.57.0
+      '@typescript-eslint/visitor-keys': 8.57.0
       debug: 4.4.3(supports-color@10.2.2)
-      minimatch: 10.2.6
-      semver: 7.8.5
+      minimatch: 10.2.4
+      semver: 7.7.4
       tinyglobby: 0.2.17
-      ts-api-utils: 2.5.0(typescript@5.9.3)
+      ts-api-utils: 2.4.0(typescript@5.9.3)
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/utils@8.71.2(eslint@9.39.5(jiti@2.7.0))(typescript@5.9.3)':
+  '@typescript-eslint/utils@8.57.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.9.3)':
     dependencies:
-      '@eslint-community/eslint-utils': 4.10.1(eslint@9.39.5(jiti@2.7.0))
-      '@typescript-eslint/scope-manager': 8.71.2
-      '@typescript-eslint/types': 8.71.2
-      '@typescript-eslint/typescript-estree': 8.71.2(typescript@5.9.3)
-      eslint: 9.39.5(jiti@2.7.0)
+      '@eslint-community/eslint-utils': 4.9.1(eslint@9.39.4(jiti@2.6.1))
+      '@typescript-eslint/scope-manager': 8.57.0
+      '@typescript-eslint/types': 8.57.0
+      '@typescript-eslint/typescript-estree': 8.57.0(typescript@5.9.3)
+      eslint: 9.39.4(jiti@2.6.1)
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/visitor-keys@8.71.2':
+  '@typescript-eslint/visitor-keys@8.57.0':
     dependencies:
-      '@typescript-eslint/types': 8.71.2
+      '@typescript-eslint/types': 8.57.0
       eslint-visitor-keys: 5.0.1
 
-  '@uiw/codemirror-extensions-basic-setup@4.25.12(@codemirror/autocomplete@6.20.3)(@codemirror/commands@6.11.1)(@codemirror/language@6.13.1)(@codemirror/lint@6.9.7)(@codemirror/search@6.7.1)(@codemirror/state@6.7.6)(@codemirror/view@6.43.14)':
+  '@uiw/codemirror-extensions-basic-setup@4.25.10(@codemirror/autocomplete@6.20.3)(@codemirror/commands@6.10.4)(@codemirror/language@6.12.4)(@codemirror/lint@6.9.7)(@codemirror/search@6.7.1)(@codemirror/state@6.7.0)(@codemirror/view@6.43.4)':
     dependencies:
       '@codemirror/autocomplete': 6.20.3
-      '@codemirror/commands': 6.11.1
-      '@codemirror/language': 6.13.1
+      '@codemirror/commands': 6.10.4
+      '@codemirror/language': 6.12.4
       '@codemirror/lint': 6.9.7
       '@codemirror/search': 6.7.1
-      '@codemirror/state': 6.7.6
-      '@codemirror/view': 6.43.14
+      '@codemirror/state': 6.7.0
+      '@codemirror/view': 6.43.4
 
-  '@uiw/react-codemirror@4.25.12(@babel/runtime@7.29.10)(@codemirror/autocomplete@6.20.3)(@codemirror/language@6.13.1)(@codemirror/lint@6.9.7)(@codemirror/search@6.7.1)(@codemirror/state@6.7.6)(@codemirror/theme-one-dark@6.1.3)(@codemirror/view@6.43.14)(codemirror@6.0.2)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)':
+  '@uiw/react-codemirror@4.25.10(@babel/runtime@7.29.7)(@codemirror/autocomplete@6.20.3)(@codemirror/language@6.12.4)(@codemirror/lint@6.9.7)(@codemirror/search@6.7.1)(@codemirror/state@6.7.0)(@codemirror/theme-one-dark@6.1.3)(@codemirror/view@6.43.4)(codemirror@6.0.2)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)':
     dependencies:
-      '@babel/runtime': 7.29.10
-      '@codemirror/commands': 6.11.1
-      '@codemirror/state': 6.7.6
+      '@babel/runtime': 7.29.7
+      '@codemirror/commands': 6.10.4
+      '@codemirror/state': 6.7.0
       '@codemirror/theme-one-dark': 6.1.3
-      '@codemirror/view': 6.43.14
-      '@uiw/codemirror-extensions-basic-setup': 4.25.12(@codemirror/autocomplete@6.20.3)(@codemirror/commands@6.11.1)(@codemirror/language@6.13.1)(@codemirror/lint@6.9.7)(@codemirror/search@6.7.1)(@codemirror/state@6.7.6)(@codemirror/view@6.43.14)
+      '@codemirror/view': 6.43.4
+      '@uiw/codemirror-extensions-basic-setup': 4.25.10(@codemirror/autocomplete@6.20.3)(@codemirror/commands@6.10.4)(@codemirror/language@6.12.4)(@codemirror/lint@6.9.7)(@codemirror/search@6.7.1)(@codemirror/state@6.7.0)(@codemirror/view@6.43.4)
       codemirror: 6.0.2
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     transitivePeerDependencies:
       - '@codemirror/autocomplete'
       - '@codemirror/language'
       - '@codemirror/lint'
       - '@codemirror/search'
 
-  '@vitejs/plugin-react@4.7.0(vite@6.4.4(@types/node@25.9.9)(jiti@2.7.0)(lightningcss@1.32.0))':
+  '@vitejs/plugin-react@4.7.0(vite@6.4.3(@types/node@25.5.0)(jiti@2.6.1)(lightningcss@1.32.0))':
     dependencies:
       '@babel/core': 7.29.7
       '@babel/plugin-transform-react-jsx-self': 7.27.1(@babel/core@7.29.7)
@@ -4940,14 +5057,14 @@ snapshots:
       '@rolldown/pluginutils': 1.0.0-beta.27
       '@types/babel__core': 7.20.5
       react-refresh: 0.17.0
-      vite: 6.4.4(@types/node@25.9.9)(jiti@2.7.0)(lightningcss@1.32.0)
+      vite: 6.4.3(@types/node@25.5.0)(jiti@2.6.1)(lightningcss@1.32.0)
     transitivePeerDependencies:
       - supports-color
 
-  '@vitest/coverage-v8@4.1.11(vitest@4.1.11)':
+  '@vitest/coverage-v8@4.1.12(vitest@4.1.11)':
     dependencies:
       '@bcoe/v8-coverage': 1.0.2
-      '@vitest/utils': 4.1.11
+      '@vitest/utils': 4.1.12
       ast-v8-to-istanbul: 1.0.7
       istanbul-lib-coverage: 3.2.2
       istanbul-lib-report: 3.0.1
@@ -4956,7 +5073,7 @@ snapshots:
       obug: 2.2.1
       std-env: 4.2.0
       tinyrainbow: 3.1.1
-      vitest: 4.1.11(@types/node@25.9.9)(@vitest/coverage-v8@4.1.11)(jsdom@29.1.1)(vite@6.4.4(@types/node@25.9.9)(jiti@2.7.0)(lightningcss@1.32.0))
+      vitest: 4.1.11(@types/node@25.5.0)(@vitest/coverage-v8@4.1.12)(jsdom@29.0.1)(vite@6.4.3(@types/node@25.5.0)(jiti@2.6.1)(lightningcss@1.32.0))
 
   '@vitest/expect@4.1.11':
     dependencies:
@@ -4967,18 +5084,22 @@ snapshots:
       chai: 6.2.2
       tinyrainbow: 3.1.1
 
-  '@vitest/mocker@4.1.11(vite@6.4.4(@types/node@25.9.9)(jiti@2.7.0)(lightningcss@1.32.0))':
+  '@vitest/mocker@4.1.11(vite@6.4.3(@types/node@25.5.0)(jiti@2.6.1)(lightningcss@1.32.0))':
     dependencies:
       '@vitest/spy': 4.1.11
       estree-walker: 3.0.3
       magic-string: 0.30.21
     optionalDependencies:
-      vite: 6.4.4(@types/node@25.9.9)(jiti@2.7.0)(lightningcss@1.32.0)
+      vite: 6.4.3(@types/node@25.5.0)(jiti@2.6.1)(lightningcss@1.32.0)
 
   '@vitest/pretty-format@4.1.11':
     dependencies:
       tinyrainbow: 3.1.1
 
+  '@vitest/pretty-format@4.1.12':
+    dependencies:
+      tinyrainbow: 3.1.1
+
   '@vitest/runner@4.1.11':
     dependencies:
       '@vitest/utils': 4.1.11
@@ -4999,19 +5120,27 @@ snapshots:
       convert-source-map: 2.0.0
       tinyrainbow: 3.1.1
 
-  '@zip.js/zip.js@2.23.0': {}
+  '@vitest/utils@4.1.12':
+    dependencies:
+      '@vitest/pretty-format': 4.1.12
+      convert-source-map: 2.0.0
+      tinyrainbow: 3.1.1
+
+  '@webgpu/types@0.1.74': {}
 
-  abslink@1.3.1: {}
+  '@zip.js/zip.js@2.8.26': {}
 
-  acorn-jsx@5.3.2(acorn@8.19.0):
+  abslink@1.2.2: {}
+
+  acorn-jsx@5.3.2(acorn@8.16.0):
     dependencies:
-      acorn: 8.19.0
+      acorn: 8.16.0
 
-  acorn@8.19.0: {}
+  acorn@8.16.0: {}
 
   agent-base@7.1.4: {}
 
-  ajv@6.15.0:
+  ajv@6.14.0:
     dependencies:
       fast-deep-equal: 3.1.3
       fast-json-stable-stringify: 2.1.0
@@ -5052,9 +5181,9 @@ snapshots:
 
   balanced-match@4.0.4: {}
 
-  baseline-browser-mapping@2.11.28: {}
+  baseline-browser-mapping@2.11.23: {}
 
-  bidi-js@1.1.0:
+  bidi-js@1.0.3:
     dependencies:
       require-from-string: 2.0.2
 
@@ -5071,17 +5200,17 @@ snapshots:
     dependencies:
       balanced-match: 4.0.4
 
-  browserslist@4.29.3:
+  browserslist@4.28.9:
     dependencies:
-      baseline-browser-mapping: 2.11.28
-      caniuse-lite: 1.0.30001815
-      electron-to-chromium: 1.5.452
-      node-releases: 2.0.58
-      update-browserslist-db: 1.3.4(browserslist@4.29.3)
+      baseline-browser-mapping: 2.11.23
+      caniuse-lite: 1.0.30001810
+      electron-to-chromium: 1.5.427
+      node-releases: 2.0.55
+      update-browserslist-db: 1.3.3(browserslist@4.28.9)
 
   callsites@3.1.0: {}
 
-  caniuse-lite@1.0.30001815: {}
+  caniuse-lite@1.0.30001810: {}
 
   chai@6.2.2: {}
 
@@ -5101,12 +5230,12 @@ snapshots:
   codemirror@6.0.2:
     dependencies:
       '@codemirror/autocomplete': 6.20.3
-      '@codemirror/commands': 6.11.1
-      '@codemirror/language': 6.13.1
+      '@codemirror/commands': 6.11.0
+      '@codemirror/language': 6.12.4
       '@codemirror/lint': 6.9.7
       '@codemirror/search': 6.7.1
-      '@codemirror/state': 6.7.6
-      '@codemirror/view': 6.43.14
+      '@codemirror/state': 6.7.4
+      '@codemirror/view': 6.43.11
 
   color-convert@2.0.1:
     dependencies:
@@ -5170,13 +5299,13 @@ snapshots:
 
   dom-accessibility-api@0.6.3: {}
 
-  electron-to-chromium@1.5.452: {}
+  electron-to-chromium@1.5.427: {}
 
-  embla-carousel-react@8.6.0(react@19.3.0):
+  embla-carousel-react@8.6.0(react@19.2.4):
     dependencies:
       embla-carousel: 8.6.0
       embla-carousel-reactive-utils: 8.6.0(embla-carousel@8.6.0)
-      react: 19.3.0
+      react: 19.2.4
 
   embla-carousel-reactive-utils@8.6.0(embla-carousel@8.6.0):
     dependencies:
@@ -5189,12 +5318,12 @@ snapshots:
 
   embla-carousel@8.6.0: {}
 
-  enhanced-resolve@5.26.0:
+  enhanced-resolve@5.20.0:
     dependencies:
       graceful-fs: 4.2.11
-      tapable: 2.3.3
+      tapable: 2.3.0
 
-  entities@8.1.0: {}
+  entities@6.0.1: {}
 
   es-module-lexer@2.3.2: {}
 
@@ -5233,24 +5362,24 @@ snapshots:
 
   escape-string-regexp@4.0.0: {}
 
-  eslint-config-prettier@10.1.8(eslint@9.39.5(jiti@2.7.0)):
+  eslint-config-prettier@10.1.8(eslint@9.39.4(jiti@2.6.1)):
     dependencies:
-      eslint: 9.39.5(jiti@2.7.0)
+      eslint: 9.39.4(jiti@2.6.1)
 
-  eslint-plugin-react-hooks@7.1.1(eslint@9.39.5(jiti@2.7.0)):
+  eslint-plugin-react-hooks@7.0.1(eslint@9.39.4(jiti@2.6.1)):
     dependencies:
       '@babel/core': 7.29.7
-      '@babel/parser': 7.29.9
-      eslint: 9.39.5(jiti@2.7.0)
+      '@babel/parser': 7.29.0
+      eslint: 9.39.4(jiti@2.6.1)
       hermes-parser: 0.25.1
-      zod: 4.6.7
-      zod-validation-error: 4.0.2(zod@4.6.7)
+      zod: 4.3.6
+      zod-validation-error: 4.0.2(zod@4.3.6)
     transitivePeerDependencies:
       - supports-color
 
-  eslint-plugin-react-refresh@0.5.7(eslint@9.39.5(jiti@2.7.0)):
+  eslint-plugin-react-refresh@0.5.2(eslint@9.39.4(jiti@2.6.1)):
     dependencies:
-      eslint: 9.39.5(jiti@2.7.0)
+      eslint: 9.39.4(jiti@2.6.1)
 
   eslint-scope@8.4.0:
     dependencies:
@@ -5263,21 +5392,21 @@ snapshots:
 
   eslint-visitor-keys@5.0.1: {}
 
-  eslint@9.39.5(jiti@2.7.0):
+  eslint@9.39.4(jiti@2.6.1):
     dependencies:
-      '@eslint-community/eslint-utils': 4.10.1(eslint@9.39.5(jiti@2.7.0))
+      '@eslint-community/eslint-utils': 4.9.1(eslint@9.39.4(jiti@2.6.1))
       '@eslint-community/regexpp': 4.12.2
       '@eslint/config-array': 0.21.2
       '@eslint/config-helpers': 0.4.2
       '@eslint/core': 0.17.0
-      '@eslint/eslintrc': 3.3.7
-      '@eslint/js': 9.39.5
+      '@eslint/eslintrc': 3.3.5
+      '@eslint/js': 9.39.4
       '@eslint/plugin-kit': 0.4.1
       '@humanfs/node': 0.16.8
       '@humanwhocodes/module-importer': 1.0.1
       '@humanwhocodes/retry': 0.4.3
-      '@types/estree': 1.0.9
-      ajv: 6.15.0
+      '@types/estree': 1.0.8
+      ajv: 6.14.0
       chalk: 4.1.2
       cross-spawn: 7.0.6
       debug: 4.4.3(supports-color@10.2.2)
@@ -5300,14 +5429,14 @@ snapshots:
       natural-compare: 1.4.0
       optionator: 0.9.4
     optionalDependencies:
-      jiti: 2.7.0
+      jiti: 2.6.1
     transitivePeerDependencies:
       - supports-color
 
   espree@10.4.0:
     dependencies:
-      acorn: 8.19.0
-      acorn-jsx: 5.3.2(acorn@8.19.0)
+      acorn: 8.16.0
+      acorn-jsx: 5.3.2(acorn@8.16.0)
       eslint-visitor-keys: 4.2.1
 
   esquery@1.7.0:
@@ -5360,14 +5489,14 @@ snapshots:
     dependencies:
       construct-style-sheets-polyfill: 3.1.0
 
-  framer-motion@12.43.0(react-dom@19.3.0(react@19.3.0))(react@19.3.0):
+  framer-motion@12.43.0(react-dom@19.2.4(react@19.2.4))(react@19.2.4):
     dependencies:
       motion-dom: 12.43.0
       motion-utils: 12.39.0
       tslib: 2.8.1
     optionalDependencies:
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
 
   fsevents@2.3.3:
     optional: true
@@ -5392,11 +5521,11 @@ snapshots:
     dependencies:
       hermes-estree: 0.25.1
 
-  hls.js@1.7.3: {}
+  hls.js@1.6.15: {}
 
   html-encoding-sniffer@6.0.0:
     dependencies:
-      '@exodus/bytes': 1.16.0
+      '@exodus/bytes': 1.15.0
     transitivePeerDependencies:
       - '@noble/hashes'
 
@@ -5411,7 +5540,7 @@ snapshots:
 
   ignore@5.3.2: {}
 
-  ignore@7.0.12: {}
+  ignore@7.0.5: {}
 
   import-fresh@3.3.1:
     dependencies:
@@ -5447,14 +5576,14 @@ snapshots:
       html-escaper: 2.0.2
       istanbul-lib-report: 3.0.1
 
-  jassub@2.5.20:
+  jassub@2.5.6:
     dependencies:
-      abslink: 1.3.1
-      lfa-ponyfill: 1.1.1
+      abslink: 1.2.2
+      lfa-ponyfill: 1.1.0
       rvfc-polyfill: 1.0.8
       throughput: 1.0.2
 
-  jiti@2.7.0: {}
+  jiti@2.6.1: {}
 
   js-levenshtein@1.1.6: {}
 
@@ -5466,23 +5595,23 @@ snapshots:
     dependencies:
       argparse: 2.0.1
 
-  jsdom@29.1.1:
+  jsdom@29.0.1:
     dependencies:
-      '@asamuzakjp/css-color': 5.1.11
-      '@asamuzakjp/dom-selector': 7.1.1
-      '@bramus/specificity': 2.4.3
-      '@csstools/css-syntax-patches-for-csstree': 1.1.15(css-tree@3.2.1)
-      '@exodus/bytes': 1.16.0
+      '@asamuzakjp/css-color': 5.1.6
+      '@asamuzakjp/dom-selector': 7.0.7
+      '@bramus/specificity': 2.4.2
+      '@csstools/css-syntax-patches-for-csstree': 1.1.2(css-tree@3.2.1)
+      '@exodus/bytes': 1.15.0
       css-tree: 3.2.1
       data-urls: 7.0.0
       decimal.js: 10.6.0
       html-encoding-sniffer: 6.0.0
       is-potential-custom-element-name: 1.0.1
-      lru-cache: 11.5.3
-      parse5: 8.0.1
+      lru-cache: 11.3.1
+      parse5: 8.0.0
       saxes: 6.0.0
       symbol-tree: 3.2.4
-      tough-cookie: 6.0.2
+      tough-cookie: 6.0.1
       undici: 7.30.0
       w3c-xmlserializer: 5.0.0
       webidl-conversions: 8.0.1
@@ -5513,41 +5642,90 @@ snapshots:
       prelude-ls: 1.2.1
       type-check: 0.4.0
 
-  lfa-ponyfill@1.1.1: {}
+  lfa-ponyfill@1.1.0: {}
+
+  lightningcss-android-arm64@1.31.1:
+    optional: true
 
   lightningcss-android-arm64@1.32.0:
     optional: true
 
+  lightningcss-darwin-arm64@1.31.1:
+    optional: true
+
   lightningcss-darwin-arm64@1.32.0:
     optional: true
 
+  lightningcss-darwin-x64@1.31.1:
+    optional: true
+
   lightningcss-darwin-x64@1.32.0:
     optional: true
 
+  lightningcss-freebsd-x64@1.31.1:
+    optional: true
+
   lightningcss-freebsd-x64@1.32.0:
     optional: true
 
+  lightningcss-linux-arm-gnueabihf@1.31.1:
+    optional: true
+
   lightningcss-linux-arm-gnueabihf@1.32.0:
     optional: true
 
+  lightningcss-linux-arm64-gnu@1.31.1:
+    optional: true
+
   lightningcss-linux-arm64-gnu@1.32.0:
     optional: true
 
+  lightningcss-linux-arm64-musl@1.31.1:
+    optional: true
+
   lightningcss-linux-arm64-musl@1.32.0:
     optional: true
 
+  lightningcss-linux-x64-gnu@1.31.1:
+    optional: true
+
   lightningcss-linux-x64-gnu@1.32.0:
     optional: true
 
+  lightningcss-linux-x64-musl@1.31.1:
+    optional: true
+
   lightningcss-linux-x64-musl@1.32.0:
     optional: true
 
+  lightningcss-win32-arm64-msvc@1.31.1:
+    optional: true
+
   lightningcss-win32-arm64-msvc@1.32.0:
     optional: true
 
+  lightningcss-win32-x64-msvc@1.31.1:
+    optional: true
+
   lightningcss-win32-x64-msvc@1.32.0:
     optional: true
 
+  lightningcss@1.31.1:
+    dependencies:
+      detect-libc: 2.1.2
+    optionalDependencies:
+      lightningcss-android-arm64: 1.31.1
+      lightningcss-darwin-arm64: 1.31.1
+      lightningcss-darwin-x64: 1.31.1
+      lightningcss-freebsd-x64: 1.31.1
+      lightningcss-linux-arm-gnueabihf: 1.31.1
+      lightningcss-linux-arm64-gnu: 1.31.1
+      lightningcss-linux-arm64-musl: 1.31.1
+      lightningcss-linux-x64-gnu: 1.31.1
+      lightningcss-linux-x64-musl: 1.31.1
+      lightningcss-win32-arm64-msvc: 1.31.1
+      lightningcss-win32-x64-msvc: 1.31.1
+
   lightningcss@1.32.0:
     dependencies:
       detect-libc: 2.1.2
@@ -5563,6 +5741,7 @@ snapshots:
       lightningcss-linux-x64-musl: 1.32.0
       lightningcss-win32-arm64-msvc: 1.32.0
       lightningcss-win32-x64-msvc: 1.32.0
+    optional: true
 
   locate-path@6.0.0:
     dependencies:
@@ -5574,15 +5753,15 @@ snapshots:
     dependencies:
       js-tokens: 4.0.0
 
-  lru-cache@11.5.3: {}
+  lru-cache@11.3.1: {}
 
   lru-cache@5.1.1:
     dependencies:
       yallist: 3.1.1
 
-  lucide-react@0.577.0(react@19.3.0):
+  lucide-react@0.577.0(react@19.2.4):
     dependencies:
-      react: 19.3.0
+      react: 19.2.4
 
   lz-string@1.5.0: {}
 
@@ -5598,13 +5777,18 @@ snapshots:
 
   make-dir@4.0.0:
     dependencies:
-      semver: 7.8.5
+      semver: 7.7.4
 
   mdn-data@2.27.1: {}
 
+  mediabunny@1.61.0:
+    dependencies:
+      '@types/dom-mediacapture-transform': 0.1.12
+      '@types/dom-webcodecs': 0.1.13
+
   min-indent@1.0.1: {}
 
-  minimatch@10.2.6:
+  minimatch@10.2.4:
     dependencies:
       brace-expansion: 5.0.12
 
@@ -5622,13 +5806,13 @@ snapshots:
 
   motion-utils@12.39.0: {}
 
-  motion@12.43.0(react-dom@19.3.0(react@19.3.0))(react@19.3.0):
+  motion@12.43.0(react-dom@19.2.4(react@19.2.4))(react@19.2.4):
     dependencies:
-      framer-motion: 12.43.0(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
+      framer-motion: 12.43.0(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
       tslib: 2.8.1
     optionalDependencies:
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
 
   mpegts.js@1.8.2:
     dependencies:
@@ -5641,7 +5825,7 @@ snapshots:
 
   natural-compare@1.4.0: {}
 
-  node-releases@2.0.58: {}
+  node-releases@2.0.55: {}
 
   node-unrar-js@2.0.2: {}
 
@@ -5686,9 +5870,9 @@ snapshots:
       index-to-position: 1.2.0
       type-fest: 4.41.0
 
-  parse5@8.0.1:
+  parse5@8.0.0:
     dependencies:
-      entities: 8.1.0
+      entities: 6.0.1
 
   path-exists@4.0.0: {}
 
@@ -5696,9 +5880,9 @@ snapshots:
 
   pathe@2.0.3: {}
 
-  pdfjs-dist@6.4.299:
+  pdfjs-dist@6.2.108:
     optionalDependencies:
-      '@napi-rs/canvas': 1.0.11
+      '@napi-rs/canvas': 1.0.5
 
   picocolors@1.1.1: {}
 
@@ -5714,11 +5898,11 @@ snapshots:
 
   prelude-ls@1.2.1: {}
 
-  prettier-plugin-tailwindcss@0.8.1(prettier@3.8.5):
+  prettier-plugin-tailwindcss@0.8.1(prettier@3.8.1):
     dependencies:
-      prettier: 3.8.5
+      prettier: 3.8.1
 
-  prettier@3.8.5: {}
+  prettier@3.8.1: {}
 
   pretty-format@27.5.1:
     dependencies:
@@ -5734,132 +5918,131 @@ snapshots:
 
   punycode@2.3.1: {}
 
-  qrcode-generator@2.0.4: {}
-
-  radix-ui@1.8.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0):
-    dependencies:
-      '@radix-ui/primitive': 1.2.0
-      '@radix-ui/react-accessible-icon': 1.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-accordion': 1.3.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-alert-dialog': 1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-arrow': 1.1.17(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-aspect-ratio': 1.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-avatar': 1.3.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-checkbox': 1.4.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-collapsible': 1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-collection': 1.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-context': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-context-menu': 2.4.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-dialog': 1.3.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-direction': 1.2.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-dismissable-layer': 1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-dropdown-menu': 2.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-focus-guards': 1.2.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-focus-scope': 1.3.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-form': 0.3.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-hover-card': 1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-label': 2.1.17(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-menu': 2.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-menubar': 1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-navigation-menu': 1.4.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-one-time-password-field': 0.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-password-toggle-field': 0.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-popover': 1.3.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-popper': 1.4.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-portal': 1.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-presence': 1.1.11(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-primitive': 2.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-progress': 1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-radio-group': 1.5.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-roving-focus': 1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-scroll-area': 1.4.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-select': 2.4.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-separator': 1.2.0(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-slider': 1.6.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-slot': 1.5.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-switch': 1.4.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-tabs': 1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-toast': 1.3.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-toggle': 1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-toggle-group': 1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-toolbar': 1.2.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-tooltip': 1.4.1(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      '@radix-ui/react-use-callback-ref': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-controllable-state': 1.3.0(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-effect-event': 0.0.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-escape-keydown': 1.1.6(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-is-hydrated': 0.1.3(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-use-size': 1.1.5(@types/react@19.3.0)(react@19.3.0)
-      '@radix-ui/react-visually-hidden': 1.2.13(@types/react-dom@19.3.0(@types/react@19.3.0))(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
+  qr.js@0.0.0: {}
+
+  radix-ui@1.4.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4):
+    dependencies:
+      '@radix-ui/primitive': 1.1.3
+      '@radix-ui/react-accessible-icon': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-accordion': 1.2.12(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-alert-dialog': 1.1.15(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-arrow': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-aspect-ratio': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-avatar': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-checkbox': 1.3.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-collapsible': 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-context-menu': 2.2.16(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-dialog': 1.1.15(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-dropdown-menu': 2.1.16(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-form': 0.1.8(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-hover-card': 1.1.15(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-label': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-menu': 2.1.16(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-menubar': 1.1.16(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-navigation-menu': 1.2.14(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-one-time-password-field': 0.1.8(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-password-toggle-field': 0.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-popover': 1.1.15(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-progress': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-radio-group': 1.3.8(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-scroll-area': 1.2.10(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-select': 2.2.6(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-separator': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-slider': 1.3.6(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-switch': 1.2.6(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-tabs': 1.1.13(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-toast': 1.2.15(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-toggle': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-toggle-group': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-toolbar': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-tooltip': 1.2.8(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-effect-event': 0.0.2(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-escape-keydown': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-is-hydrated': 0.1.0(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.14)(react@19.2.4)
+      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.2.3(@types/react@19.2.14))(@types/react@19.2.14)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
-      '@types/react-dom': 19.3.0(@types/react@19.3.0)
+      '@types/react': 19.2.14
+      '@types/react-dom': 19.2.3(@types/react@19.2.14)
 
-  react-day-picker@10.0.2(@types/react@19.3.0)(react@19.3.0):
+  react-day-picker@10.0.1(@types/react@19.2.14)(react@19.2.4):
     dependencies:
       '@date-fns/tz': 1.5.0
       date-fns: 4.4.0
-      react: 19.3.0
+      react: 19.2.4
     optionalDependencies:
-      '@types/react': 19.3.0
+      '@types/react': 19.2.14
 
-  react-dom@19.3.0(react@19.3.0):
+  react-dom@19.2.4(react@19.2.4):
     dependencies:
-      react: 19.3.0
-      scheduler: 0.28.0
+      react: 19.2.4
+      scheduler: 0.27.0
 
   react-is@16.13.1: {}
 
   react-is@17.0.2: {}
 
-  react-qr-code@2.2.0(react@19.3.0):
+  react-qr-code@2.0.18(react@19.2.4):
     dependencies:
       prop-types: 15.8.1
-      qrcode-generator: 2.0.4
-      react: 19.3.0
+      qr.js: 0.0.0
+      react: 19.2.4
 
   react-refresh@0.17.0: {}
 
-  react-remove-scroll-bar@2.3.8(@types/react@19.3.0)(react@19.3.0):
+  react-remove-scroll-bar@2.3.8(@types/react@19.2.14)(react@19.2.4):
     dependencies:
-      react: 19.3.0
-      react-style-singleton: 2.2.3(@types/react@19.3.0)(react@19.3.0)
+      react: 19.2.4
+      react-style-singleton: 2.2.3(@types/react@19.2.14)(react@19.2.4)
       tslib: 2.8.1
     optionalDependencies:
-      '@types/react': 19.3.0
+      '@types/react': 19.2.14
 
-  react-remove-scroll@2.7.2(@types/react@19.3.0)(react@19.3.0):
+  react-remove-scroll@2.7.2(@types/react@19.2.14)(react@19.2.4):
     dependencies:
-      react: 19.3.0
-      react-remove-scroll-bar: 2.3.8(@types/react@19.3.0)(react@19.3.0)
-      react-style-singleton: 2.2.3(@types/react@19.3.0)(react@19.3.0)
+      react: 19.2.4
+      react-remove-scroll-bar: 2.3.8(@types/react@19.2.14)(react@19.2.4)
+      react-style-singleton: 2.2.3(@types/react@19.2.14)(react@19.2.4)
       tslib: 2.8.1
-      use-callback-ref: 1.3.3(@types/react@19.3.0)(react@19.3.0)
-      use-sidecar: 1.1.3(@types/react@19.3.0)(react@19.3.0)
+      use-callback-ref: 1.3.3(@types/react@19.2.14)(react@19.2.4)
+      use-sidecar: 1.1.3(@types/react@19.2.14)(react@19.2.4)
     optionalDependencies:
-      '@types/react': 19.3.0
+      '@types/react': 19.2.14
 
-  react-router@8.4.0(react-dom@19.3.0(react@19.3.0))(react@19.3.0):
+  react-router@8.3.0(react-dom@19.2.4(react@19.2.4))(react@19.2.4):
     dependencies:
-      '@remix-run/route-pattern': 0.22.1
       cookie-es: 3.1.1
-      react: 19.3.0
+      react: 19.2.4
     optionalDependencies:
-      react-dom: 19.3.0(react@19.3.0)
+      react-dom: 19.2.4(react@19.2.4)
 
-  react-style-singleton@2.2.3(@types/react@19.3.0)(react@19.3.0):
+  react-style-singleton@2.2.3(@types/react@19.2.14)(react@19.2.4):
     dependencies:
       get-nonce: 1.0.1
-      react: 19.3.0
+      react: 19.2.4
       tslib: 2.8.1
     optionalDependencies:
-      '@types/react': 19.3.0
+      '@types/react': 19.2.14
 
-  react@19.3.0: {}
+  react@19.2.4: {}
 
   redent@3.0.0:
     dependencies:
@@ -5870,36 +6053,35 @@ snapshots:
 
   resolve-from@4.0.0: {}
 
-  rollup@4.64.5:
+  rollup@4.62.0:
     dependencies:
       '@types/estree': 1.0.9
     optionalDependencies:
-      '@napi-rs/lzma-linux-x64-gnu': 1.5.1
-      '@rollup/rollup-android-arm-eabi': 4.64.5
-      '@rollup/rollup-android-arm64': 4.64.5
-      '@rollup/rollup-darwin-arm64': 4.64.5
-      '@rollup/rollup-darwin-x64': 4.64.5
-      '@rollup/rollup-freebsd-arm64': 4.64.5
-      '@rollup/rollup-freebsd-x64': 4.64.5
-      '@rollup/rollup-linux-arm-gnueabihf': 4.64.5
-      '@rollup/rollup-linux-arm-musleabihf': 4.64.5
-      '@rollup/rollup-linux-arm64-gnu': 4.64.5
-      '@rollup/rollup-linux-arm64-musl': 4.64.5
-      '@rollup/rollup-linux-loong64-gnu': 4.64.5
-      '@rollup/rollup-linux-loong64-musl': 4.64.5
-      '@rollup/rollup-linux-ppc64-gnu': 4.64.5
-      '@rollup/rollup-linux-ppc64-musl': 4.64.5
-      '@rollup/rollup-linux-riscv64-gnu': 4.64.5
-      '@rollup/rollup-linux-riscv64-musl': 4.64.5
-      '@rollup/rollup-linux-s390x-gnu': 4.64.5
-      '@rollup/rollup-linux-x64-gnu': 4.64.5
-      '@rollup/rollup-linux-x64-musl': 4.64.5
-      '@rollup/rollup-openbsd-x64': 4.64.5
-      '@rollup/rollup-openharmony-arm64': 4.64.5
-      '@rollup/rollup-win32-arm64-msvc': 4.64.5
-      '@rollup/rollup-win32-ia32-msvc': 4.64.5
-      '@rollup/rollup-win32-x64-gnu': 4.64.5
-      '@rollup/rollup-win32-x64-msvc': 4.64.5
+      '@rollup/rollup-android-arm-eabi': 4.62.0
+      '@rollup/rollup-android-arm64': 4.62.0
+      '@rollup/rollup-darwin-arm64': 4.62.0
+      '@rollup/rollup-darwin-x64': 4.62.0
+      '@rollup/rollup-freebsd-arm64': 4.62.0
+      '@rollup/rollup-freebsd-x64': 4.62.0
+      '@rollup/rollup-linux-arm-gnueabihf': 4.62.0
+      '@rollup/rollup-linux-arm-musleabihf': 4.62.0
+      '@rollup/rollup-linux-arm64-gnu': 4.62.0
+      '@rollup/rollup-linux-arm64-musl': 4.62.0
+      '@rollup/rollup-linux-loong64-gnu': 4.62.0
+      '@rollup/rollup-linux-loong64-musl': 4.62.0
+      '@rollup/rollup-linux-ppc64-gnu': 4.62.0
+      '@rollup/rollup-linux-ppc64-musl': 4.62.0
+      '@rollup/rollup-linux-riscv64-gnu': 4.62.0
+      '@rollup/rollup-linux-riscv64-musl': 4.62.0
+      '@rollup/rollup-linux-s390x-gnu': 4.62.0
+      '@rollup/rollup-linux-x64-gnu': 4.62.0
+      '@rollup/rollup-linux-x64-musl': 4.62.0
+      '@rollup/rollup-openbsd-x64': 4.62.0
+      '@rollup/rollup-openharmony-arm64': 4.62.0
+      '@rollup/rollup-win32-arm64-msvc': 4.62.0
+      '@rollup/rollup-win32-ia32-msvc': 4.62.0
+      '@rollup/rollup-win32-x64-gnu': 4.62.0
+      '@rollup/rollup-win32-x64-msvc': 4.62.0
       fsevents: 2.3.3
 
   rvfc-polyfill@1.0.8: {}
@@ -5908,11 +6090,11 @@ snapshots:
     dependencies:
       xmlchars: 2.2.0
 
-  scheduler@0.28.0: {}
+  scheduler@0.27.0: {}
 
   semver@6.3.1: {}
 
-  semver@7.8.5: {}
+  semver@7.7.4: {}
 
   shebang-command@2.0.0:
     dependencies:
@@ -5922,12 +6104,10 @@ snapshots:
 
   siginfo@2.0.0: {}
 
-  sonner@2.0.8(@types/react@19.3.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0):
+  sonner@2.0.7(react-dom@19.2.4(react@19.2.4))(react@19.2.4):
     dependencies:
-      react: 19.3.0
-      react-dom: 19.3.0(react@19.3.0)
-    optionalDependencies:
-      '@types/react': 19.3.0
+      react: 19.2.4
+      react-dom: 19.2.4(react@19.2.4)
 
   source-map-js@1.2.2: {}
 
@@ -5941,7 +6121,7 @@ snapshots:
 
   strip-json-comments@3.1.1: {}
 
-  style-mod@4.1.4: {}
+  style-mod@4.1.3: {}
 
   supports-color@10.2.2: {}
 
@@ -5951,11 +6131,11 @@ snapshots:
 
   symbol-tree@3.2.4: {}
 
-  tailwind-merge@3.7.0: {}
+  tailwind-merge@3.5.0: {}
 
-  tailwindcss@4.3.3: {}
+  tailwindcss@4.2.1: {}
 
-  tapable@2.3.3: {}
+  tapable@2.3.0: {}
 
   throughput@1.0.2: {}
 
@@ -5972,21 +6152,21 @@ snapshots:
 
   tinyrainbow@3.1.1: {}
 
-  tldts-core@7.4.18: {}
+  tldts-core@7.0.28: {}
 
-  tldts@7.4.18:
+  tldts@7.0.28:
     dependencies:
-      tldts-core: 7.4.18
+      tldts-core: 7.0.28
 
-  tough-cookie@6.0.2:
+  tough-cookie@6.0.1:
     dependencies:
-      tldts: 7.4.18
+      tldts: 7.0.28
 
   tr46@6.0.0:
     dependencies:
       punycode: 2.3.1
 
-  ts-api-utils@2.5.0(typescript@5.9.3):
+  ts-api-utils@2.4.0(typescript@5.9.3):
     dependencies:
       typescript: 5.9.3
 
@@ -5998,26 +6178,26 @@ snapshots:
 
   type-fest@4.41.0: {}
 
-  typescript-eslint@8.71.2(eslint@9.39.5(jiti@2.7.0))(typescript@5.9.3):
+  typescript-eslint@8.57.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.9.3):
     dependencies:
-      '@typescript-eslint/eslint-plugin': 8.71.2(@typescript-eslint/parser@8.71.2(eslint@9.39.5(jiti@2.7.0))(typescript@5.9.3))(eslint@9.39.5(jiti@2.7.0))(typescript@5.9.3)
-      '@typescript-eslint/parser': 8.71.2(eslint@9.39.5(jiti@2.7.0))(typescript@5.9.3)
-      '@typescript-eslint/typescript-estree': 8.71.2(typescript@5.9.3)
-      '@typescript-eslint/utils': 8.71.2(eslint@9.39.5(jiti@2.7.0))(typescript@5.9.3)
-      eslint: 9.39.5(jiti@2.7.0)
+      '@typescript-eslint/eslint-plugin': 8.57.0(@typescript-eslint/parser@8.57.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.9.3))(eslint@9.39.4(jiti@2.6.1))(typescript@5.9.3)
+      '@typescript-eslint/parser': 8.57.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.9.3)
+      '@typescript-eslint/typescript-estree': 8.57.0(typescript@5.9.3)
+      '@typescript-eslint/utils': 8.57.0(eslint@9.39.4(jiti@2.6.1))(typescript@5.9.3)
+      eslint: 9.39.4(jiti@2.6.1)
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
 
   typescript@5.9.3: {}
 
-  undici-types@7.24.6: {}
+  undici-types@7.18.2: {}
 
   undici@7.30.0: {}
 
-  update-browserslist-db@1.3.4(browserslist@4.29.3):
+  update-browserslist-db@1.3.3(browserslist@4.28.9):
     dependencies:
-      browserslist: 4.29.3
+      browserslist: 4.28.9
       escalade: 3.2.0
       picocolors: 1.1.1
 
@@ -6027,39 +6207,43 @@ snapshots:
     dependencies:
       punycode: 2.3.1
 
-  use-callback-ref@1.3.3(@types/react@19.3.0)(react@19.3.0):
+  use-callback-ref@1.3.3(@types/react@19.2.14)(react@19.2.4):
     dependencies:
-      react: 19.3.0
+      react: 19.2.4
       tslib: 2.8.1
     optionalDependencies:
-      '@types/react': 19.3.0
+      '@types/react': 19.2.14
 
-  use-sidecar@1.1.3(@types/react@19.3.0)(react@19.3.0):
+  use-sidecar@1.1.3(@types/react@19.2.14)(react@19.2.4):
     dependencies:
       detect-node-es: 1.1.0
-      react: 19.3.0
+      react: 19.2.4
       tslib: 2.8.1
     optionalDependencies:
-      '@types/react': 19.3.0
+      '@types/react': 19.2.14
+
+  use-sync-external-store@1.6.0(react@19.2.4):
+    dependencies:
+      react: 19.2.4
 
-  vite@6.4.4(@types/node@25.9.9)(jiti@2.7.0)(lightningcss@1.32.0):
+  vite@6.4.3(@types/node@25.5.0)(jiti@2.6.1)(lightningcss@1.32.0):
     dependencies:
       esbuild: 0.25.12
       fdir: 6.5.0(picomatch@4.0.7)
       picomatch: 4.0.7
       postcss: 8.5.30
-      rollup: 4.64.5
+      rollup: 4.62.0
       tinyglobby: 0.2.17
     optionalDependencies:
-      '@types/node': 25.9.9
+      '@types/node': 25.5.0
       fsevents: 2.3.3
-      jiti: 2.7.0
+      jiti: 2.6.1
       lightningcss: 1.32.0
 
-  vitest@4.1.11(@types/node@25.9.9)(@vitest/coverage-v8@4.1.11)(jsdom@29.1.1)(vite@6.4.4(@types/node@25.9.9)(jiti@2.7.0)(lightningcss@1.32.0)):
+  vitest@4.1.11(@types/node@25.5.0)(@vitest/coverage-v8@4.1.12)(jsdom@29.0.1)(vite@6.4.3(@types/node@25.5.0)(jiti@2.6.1)(lightningcss@1.32.0)):
     dependencies:
       '@vitest/expect': 4.1.11
-      '@vitest/mocker': 4.1.11(vite@6.4.4(@types/node@25.9.9)(jiti@2.7.0)(lightningcss@1.32.0))
+      '@vitest/mocker': 4.1.11(vite@6.4.3(@types/node@25.5.0)(jiti@2.6.1)(lightningcss@1.32.0))
       '@vitest/pretty-format': 4.1.11
       '@vitest/runner': 4.1.11
       '@vitest/snapshot': 4.1.11
@@ -6076,12 +6260,12 @@ snapshots:
       tinyexec: 1.3.1
       tinyglobby: 0.2.17
       tinyrainbow: 3.1.1
-      vite: 6.4.4(@types/node@25.9.9)(jiti@2.7.0)(lightningcss@1.32.0)
+      vite: 6.4.3(@types/node@25.5.0)(jiti@2.6.1)(lightningcss@1.32.0)
       why-is-node-running: 2.3.0
     optionalDependencies:
-      '@types/node': 25.9.9
-      '@vitest/coverage-v8': 4.1.11(vitest@4.1.11)
-      jsdom: 29.1.1
+      '@types/node': 25.5.0
+      '@vitest/coverage-v8': 4.1.12(vitest@4.1.11)
+      jsdom: 29.0.1
     transitivePeerDependencies:
       - msw
 
@@ -6097,7 +6281,7 @@ snapshots:
 
   whatwg-url@16.0.1:
     dependencies:
-      '@exodus/bytes': 1.16.0
+      '@exodus/bytes': 1.15.0
       tr46: 6.0.0
       webidl-conversions: 8.0.1
     transitivePeerDependencies:
@@ -6128,8 +6312,8 @@ snapshots:
 
   yocto-queue@0.1.0: {}
 
-  zod-validation-error@4.0.2(zod@4.6.7):
+  zod-validation-error@4.0.2(zod@4.3.6):
     dependencies:
-      zod: 4.6.7
+      zod: 4.3.6
 
-  zod@4.6.7: {}
+  zod@4.3.6: {}
diff --git a/web/src/App.tsx b/web/src/App.tsx
index adfd060a58..42db9ad4a2 100644
--- a/web/src/App.tsx
+++ b/web/src/App.tsx
@@ -32,7 +32,6 @@ import { useIsActingAdmin } from "@/hooks/useIsActingAdmin";
 import { useNavigationDirection } from "@/hooks/useNavigationDirection";
 import { ThemeProvider } from "@/hooks/useTheme";
 import { DateTimeFormatProvider, useDateTimeFormat } from "@/hooks/useDateTimeFormat";
-import { CustomThemeProvider } from "@/contexts/CustomThemeProvider";
 import { BrandingProvider } from "@/contexts/BrandingProvider";
 import { UICustomizationProvider } from "@/contexts/UICustomizationProvider";
 import { ErrorBoundary } from "@/components/ErrorBoundary";
@@ -59,7 +58,6 @@ import {
   buildQueryCatalogHref,
   buildUserCollectionCatalogHref,
 } from "@/pages/catalogSearchParams";
-import { buildLegacyAutoscanRedirectTarget } from "@/pages/autoscanSearchParams";
 import LegacyAdminHomeRowsRedirect from "@/pages/LegacyAdminHomeRowsRedirect";
 import LegacyRequestDetailRedirect from "@/pages/LegacyRequestDetailRedirect";
 import { buildLegacyWebhookSyncRedirectTarget } from "@/lib/webhookSync";
@@ -111,6 +109,8 @@ const AdminUsers = lazy(() => import("@/pages/AdminUsers"));
 const AdminRequests = lazy(() => import("@/pages/AdminRequests"));
 const AdminDevices = lazy(() => import("@/pages/AdminDevices"));
 const AdminLibraries = lazy(() => import("@/pages/AdminLibraries"));
+const AdminAutoscan = lazy(() => import("@/pages/AdminAutoscan"));
+const AdminAutoscanActivity = lazy(() => import("@/pages/AdminAutoscanActivity"));
 const AdminSettingsLayout = lazy(() => import("@/pages/admin-settings/AdminSettingsLayout"));
 const AdminNodes = lazy(() => import("@/pages/AdminNodes"));
 const AdminDownloads = lazy(() => import("@/pages/AdminDownloads"));
@@ -153,7 +153,7 @@ const SubtitleAppearanceSettings = lazy(
   () => import("@/pages/settings/SubtitleAppearanceSettings"),
 );
 const HomeScreenSettings = lazy(() => import("@/pages/settings/HomeScreenSettings"));
-const CardOverlaySettings = lazy(() => import("@/pages/settings/CardOverlaySettings"));
+const TitlePagesSettings = lazy(() => import("@/pages/settings/TitlePagesSettings"));
 const PersonalizeSettings = lazy(() => import("@/pages/settings/PersonalizeSettings"));
 const ConnectAppsSettings = lazy(() => import("@/pages/settings/ConnectAppsSettings"));
 const InterfaceSettings = lazy(() => import("@/pages/settings/InterfaceSettings"));
@@ -341,6 +341,7 @@ export function QueryCacheManager() {
     if (prevProfileId.current && prevProfileId.current !== profile?.id) {
       qc.removeQueries({ queryKey: ["favorites"] });
       qc.removeQueries({ queryKey: ["watchlist"] });
+      qc.removeQueries({ queryKey: ["notInterested"] });
       qc.removeQueries({ queryKey: ["history"] });
       qc.removeQueries({ queryKey: ["collections"] });
       qc.removeQueries({ queryKey: ["libraryPlaybackPreferences"] });
@@ -410,16 +411,6 @@ function LegacyWebhookSyncRedirect() {
   return <Navigate to={buildLegacyWebhookSyncRedirectTarget(search)} replace />;
 }
 
-/**
- * `/admin/autoscan` → the Autoscan tab on Libraries. The old query has to be
- * translated, not dropped: the panel's own view moved from `tab` to `view`
- * because `tab` now names the Libraries tab hosting it.
- */
-function LegacyAutoscanRedirect() {
-  const { search } = useLocation();
-  return <Navigate to={buildLegacyAutoscanRedirectTarget(search)} replace />;
-}
-
 function LegacyPersonalCatalogRedirect({
   source,
 }: {
@@ -539,8 +530,8 @@ function AppRoutes() {
                     <Route path="collections/:id/edit" />
                   </Route>
                   <Route path="requests" element={<AdminRequests />} />
-                  {/* Autoscan is a tab on Libraries now; keep old links working. */}
-                  <Route path="autoscan" element={<LegacyAutoscanRedirect />} />
+                  <Route path="autoscan" element={<AdminAutoscan />} />
+                  <Route path="autoscan/activity" element={<AdminAutoscanActivity />} />
                   <Route path="livetv" element={<AdminLiveTV />} />
                   <Route path="history" element={<AdminPlaybackHistory />} />
                   <Route path="marker-history" element={<AdminMarkerHistory />} />
@@ -632,7 +623,12 @@ function AppRoutes() {
                   <Route path="watch-providers" element={<WatchProvidersSettings />} />
                   <Route path="subtitle-appearance" element={<SubtitleAppearanceSettings />} />
                   <Route path="home-screen" element={<HomeScreenSettings />} />
-                  <Route path="card-overlays" element={<CardOverlaySettings />} />
+                  {/* Card overlays merged into Navigation & Cards. */}
+                  <Route
+                    path="card-overlays"
+                    element={<Navigate to="/settings/interface" replace />}
+                  />
+                  <Route path="title-pages" element={<TitlePagesSettings />} />
                   <Route path="personalize" element={<PersonalizeSettings />} />
                   <Route path="requests" element={<RequestsSettings />} />
                   <Route path="devices" element={<DeviceSettings />} />
@@ -810,6 +806,35 @@ function PlaybackCapabilityPrewarmer() {
   return null;
 }
 
+/**
+ * Measures throughput to the server in the background so Auto quality can
+ * tell a 4K-capable link from a slow one. Signed-out screens stay quiet and a
+ * fresh cached measurement skips the probe. There is deliberately no
+ * re-measure on `connection` change events: Chromium fires them whenever its
+ * rounded estimate moves, which would spend a probe every few minutes.
+ */
+function BandwidthProbePrewarmer() {
+  const { user } = useAuth();
+  const isAuthenticated = Boolean(user);
+  useEffect(() => {
+    if (!isAuthenticated) return;
+    let cancelled = false;
+    let cleanup: (() => void) | undefined;
+    void import("@/player/bandwidth-probe")
+      .then(({ scheduleBandwidthProbe }) => {
+        if (!cancelled) cleanup = scheduleBandwidthProbe();
+      })
+      .catch(() => {
+        // Without a measurement Auto plans from the device and source alone.
+      });
+    return () => {
+      cancelled = true;
+      cleanup?.();
+    };
+  }, [isAuthenticated]);
+  return null;
+}
+
 /** Warms the hot route chunks once the first screen has settled. */
 function RouteChunkPrewarmer() {
   const { user } = useAuth();
@@ -843,30 +868,29 @@ function AppShell() {
         <ErrorBoundary>
           <BrandingProvider>
             <ThemeProvider>
-              <CustomThemeProvider>
-                <DateTimeFormatProvider>
-                  <WatchPlaybackProvider>
-                    <AudiobookPlaybackProvider>
-                      <RealtimeEventsProvider>
-                        <PlaybackCapabilityPrewarmer />
-                        <RouteChunkPrewarmer />
-                        <RealtimeEventChannels />
-                        <ScrollRestorationManager />
-                        <NavigationDirectionManager />
-                        <RouteAnnouncer />
-                        <QueryCacheManager />
-                        <AppChrome />
-                        <Suspense fallback={<RouteLoading />}>
-                          <Outlet />
-                        </Suspense>
-                        <WatchPlaybackHost />
-                        <WatchPlaybackBar />
-                        <Toaster />
-                      </RealtimeEventsProvider>
-                    </AudiobookPlaybackProvider>
-                  </WatchPlaybackProvider>
-                </DateTimeFormatProvider>
-              </CustomThemeProvider>
+              <DateTimeFormatProvider>
+                <WatchPlaybackProvider>
+                  <AudiobookPlaybackProvider>
+                    <RealtimeEventsProvider>
+                      <PlaybackCapabilityPrewarmer />
+                      <RouteChunkPrewarmer />
+                      <BandwidthProbePrewarmer />
+                      <RealtimeEventChannels />
+                      <ScrollRestorationManager />
+                      <NavigationDirectionManager />
+                      <RouteAnnouncer />
+                      <QueryCacheManager />
+                      <AppChrome />
+                      <Suspense fallback={<RouteLoading />}>
+                        <Outlet />
+                      </Suspense>
+                      <WatchPlaybackHost />
+                      <WatchPlaybackBar />
+                      <Toaster />
+                    </RealtimeEventsProvider>
+                  </AudiobookPlaybackProvider>
+                </WatchPlaybackProvider>
+              </DateTimeFormatProvider>
             </ThemeProvider>
           </BrandingProvider>
         </ErrorBoundary>
diff --git a/web/src/api/adminSections.test.ts b/web/src/api/adminSections.test.ts
index 3aeaf5b5d8..52df870d4a 100644
--- a/web/src/api/adminSections.test.ts
+++ b/web/src/api/adminSections.test.ts
@@ -10,8 +10,10 @@ import {
   deleteAdminSection,
   reorderAdminSections,
   restoreAdminSections,
+  restoreLibraryPages,
   bulkCreateAdminSections,
 } from "./adminSections";
+import { v2Problem } from "@/api/v2/problems.test-support";
 import { previewSection } from "@/lib/recipes";
 const request = vi.hoisted(() => vi.fn());
 vi.mock("@/api/v2/request", async () => ({
@@ -209,4 +211,45 @@ describe("admin sections adapter", () => {
       { body: { section_type: "query", config: row.config, library_id: "7", library_ids: ["7"] } },
     ]);
   });
+  it("tells a library page that kept its rows from one whose restore got no answer", async () => {
+    const lost = new TypeError("Failed to fetch");
+    const changed = v2Problem(412, "precondition_failed", "Changed on another client");
+    const unreadable = new TypeError("Failed to fetch");
+    // The server reads the new order back after saving; failing there is a 5xx.
+    const afterSave = v2Problem(500, "internal_error", "Database unavailable");
+    request.mockImplementation(
+      (
+        key: string,
+        options: { query?: { library_id?: string }; onResponse?: (r: Response) => void },
+      ) => {
+        const id = options.query?.library_id;
+        if (key === "GET /api/v2/admin/sections/order") {
+          if (id === "9") return Promise.reject(unreadable);
+          options.onResponse?.(new Response(null, { headers: { ETag: `"order-${id}"` } }));
+          return Promise.resolve({ ordered_ids: [] });
+        }
+        if (id === "7") return Promise.reject(lost);
+        if (id === "8") return Promise.reject(changed);
+        if (id === "10") return Promise.reject(afterSave);
+        return Promise.resolve({ items: [] });
+      },
+    );
+    await expect(restoreLibraryPages([6, 7, 8, 9, 10], true)).resolves.toEqual([
+      { libraryId: 7, error: lost, outcome: "unknown" },
+      { libraryId: 8, error: changed, outcome: "failed" },
+      { libraryId: 9, error: unreadable, outcome: "failed" },
+      { libraryId: 10, error: afterSave, outcome: "unknown" },
+    ]);
+    const restores = request.mock.calls.filter(
+      ([key]) => key === "PUT /api/v2/admin/sections/defaults",
+    );
+    expect(
+      restores.map(([, options]) => [options.query.library_id, options.headers["If-Match"]]),
+    ).toEqual([
+      ["6", '"order-6"'],
+      ["7", '"order-7"'],
+      ["8", '"order-8"'],
+      ["10", '"order-10"'],
+    ]);
+  });
 });
diff --git a/web/src/api/adminSections.ts b/web/src/api/adminSections.ts
index 68c146bf5a..d7fdaac081 100644
--- a/web/src/api/adminSections.ts
+++ b/web/src/api/adminSections.ts
@@ -172,3 +172,45 @@ export function restoreAdminSections({
     body: { reset_profiles },
   });
 }
+export interface LibraryRestoreFailure {
+  libraryId: number;
+  error: unknown;
+  /**
+   * "failed" when the page kept its rows: its version couldn't be read, or the
+   * server refused the restore with a 4xx before changing anything. "unknown"
+   * when the restore got a 5xx or no answer: the server reads the new order
+   * back after saving, so a 5xx can follow a restore that was applied.
+   */
+  outcome: "failed" | "unknown";
+}
+/**
+ * Restores each library page over the version it has when its turn comes, one
+ * page at a time. A page that fails doesn't stop the rest; the failures are returned.
+ */
+export async function restoreLibraryPages(
+  libraryIds: readonly number[],
+  resetProfiles: boolean | undefined,
+): Promise<LibraryRestoreFailure[]> {
+  const failures: LibraryRestoreFailure[] = [];
+  for (const libraryId of libraryIds) {
+    let etag: string;
+    try {
+      ({ etag } = await fetchAdminSectionOrderSnapshot("library", libraryId));
+    } catch (error) {
+      failures.push({ libraryId, error, outcome: "failed" });
+      continue;
+    }
+    try {
+      await restoreAdminSections({
+        scope: "library",
+        library_id: libraryId,
+        etag,
+        reset_profiles: resetProfiles,
+      });
+    } catch (error) {
+      const refused = error instanceof V2ProblemError && error.status < 500;
+      failures.push({ libraryId, error, outcome: refused ? "failed" : "unknown" });
+    }
+  }
+  return failures;
+}
diff --git a/web/src/api/types.ts b/web/src/api/types.ts
index 595bd58495..c37f1bf90a 100644
--- a/web/src/api/types.ts
+++ b/web/src/api/types.ts
@@ -739,6 +739,8 @@ export interface Season {
   poster_url: string;
   poster_thumbhash: string;
   user_data?: SeasonUserData;
+  /** Localized fields whose text was machine-translated by AI. */
+  machine_translated_fields?: string[];
 }
 
 export interface SeasonsResponse {
@@ -772,6 +774,8 @@ export interface MediaItemUserState {
   played: boolean;
   is_favorite: boolean;
   in_watchlist: boolean;
+  /** The profile marked the movie or series Not interested. */
+  not_interested?: boolean;
 }
 
 export interface BrowseItemSortMetrics {
@@ -1166,6 +1170,11 @@ export interface ItemDetail {
    * keys off this.
    */
   pending_translation_language?: string;
+  /**
+   * Localized fields ("overview", "tagline") whose text was machine-translated
+   * by AI rather than supplied by a metadata provider or a person.
+   */
+  machine_translated_fields?: string[];
   runtime: number;
   content_rating: string;
   /**
@@ -1330,6 +1339,10 @@ export interface EpisodeListItem {
   user_data?: LeafItemUserData;
   files: EpisodeFile[];
   overlay_summary?: OverlaySummary | null;
+  /** Localized fields whose text was machine-translated by AI. */
+  machine_translated_fields?: string[];
+  /** This profile's language when the episode's description is not in it yet. */
+  pending_translation_language?: string;
 }
 
 export interface EpisodesResponse {
@@ -1337,7 +1350,7 @@ export interface EpisodesResponse {
 }
 
 // Collections
-export type UserCollectionType = "manual" | "smart" | "mdblist" | "tmdb" | "trakt";
+export type UserCollectionType = "manual" | "smart" | "mdblist" | "tmdb";
 
 export type UserCollectionSyncStatus = "" | "running" | "success" | "failed" | "warning";
 // UI-only presets for the two display-filter dropdowns. They no longer map to
@@ -1558,7 +1571,7 @@ export interface LibraryCollection {
   slug: string;
   title: string;
   description: string;
-  collection_type: "manual" | "smart" | "mdblist" | "tmdb" | "trakt";
+  collection_type: "manual" | "smart" | "mdblist" | "tmdb";
   visibility: "visible" | "hidden";
   sort_order: number;
   group_id?: string | null;
@@ -1628,7 +1641,7 @@ export interface CreateLibraryCollectionRequest {
   slug?: string;
   title: string;
   description?: string;
-  collection_type?: "manual" | "smart" | "mdblist" | "tmdb" | "trakt";
+  collection_type?: "manual" | "smart" | "mdblist" | "tmdb";
   visibility?: "visible" | "hidden";
   sort_order?: number;
   group_id?: string | null;
@@ -1758,35 +1771,6 @@ export interface ImportTMDBCollectionResponse {
   sync_run?: LibraryCollectionSyncRun;
 }
 
-export interface ImportTraktCollectionRequest {
-  library_id?: number;
-  library_ids?: number[];
-  title: string;
-  description?: string;
-  // preset/media_type drive a discovery-feed collection; list_url drives a
-  // user-authored Trakt list. Exactly one path is used per request.
-  preset?: "trending" | "popular" | "recommended";
-  media_type?: "movie" | "tv";
-  profile_id?: string;
-  list_url?: string;
-  limit?: number;
-  featured?: boolean;
-  poster_url?: string;
-  poster_source_url?: string;
-  backdrop_source_url?: string;
-  sync_schedule?: string;
-  management_mode?: LibraryCollectionManagementMode;
-  management_source?: string;
-  management_key?: string;
-  /** Default order viewers land on; `{}` keeps the source list's own order. */
-  sort_config?: CollectionSortConfig;
-}
-
-export interface ImportTraktCollectionResponse {
-  collection: LibraryCollection;
-  sync_run?: LibraryCollectionSyncRun;
-}
-
 // User-facing imports omit library_ids / featured / visibility (server-wide
 // concerns). sync_schedule is restricted to a fixed set so we can guarantee
 // the >=24h minimum interval without parsing user-supplied cron.
@@ -2538,6 +2522,8 @@ export interface AccessGroup {
   max_transcodes: number;
   max_remote_stream_bitrate_kbps: number;
   max_local_stream_bitrate_kbps: number;
+  /** Household profiles each member account may have, unless it overrides it. */
+  max_profiles: number;
   allowed_permissions: string[] | null;
   requests_allowed: boolean;
   is_default: boolean;
@@ -2559,6 +2545,7 @@ export interface AccessGroupInput {
   max_transcodes?: number;
   max_remote_stream_bitrate_kbps?: number;
   max_local_stream_bitrate_kbps?: number;
+  max_profiles?: number;
   allowed_permissions?: string[] | null;
   requests_allowed?: boolean;
   is_default?: boolean;
@@ -2574,6 +2561,7 @@ export interface AdminUserEffectivePolicy {
   max_transcodes: number;
   max_remote_stream_bitrate_kbps: number;
   max_local_stream_bitrate_kbps: number;
+  max_profiles: number;
   transcode_allowed: boolean;
   audio_transcode_allowed: boolean;
   download_allowed: boolean;
@@ -2606,7 +2594,7 @@ export interface AdminUser {
   max_local_stream_bitrate_kbps: number | null;
   transcode_allowed: boolean | null;
   audio_transcode_allowed: boolean | null;
-  max_profiles: number;
+  max_profiles: number | null;
   download_allowed: boolean | null;
   download_transcode_allowed: boolean | null;
   requests_allowed: boolean | null;
@@ -2677,7 +2665,7 @@ export interface UpdateUserRequest {
   max_local_stream_bitrate_kbps?: number | null;
   transcode_allowed?: boolean | null;
   audio_transcode_allowed?: boolean | null;
-  max_profiles?: number;
+  max_profiles?: number | null;
   download_allowed?: boolean | null;
   download_transcode_allowed?: boolean | null;
   requests_allowed?: boolean | null;
@@ -3362,7 +3350,10 @@ export interface AdminDeviceProfileSummary {
 /** One device the signed-in viewer watches on. */
 export interface UserDevice {
   device_id: string;
+  /** The name the device reports for itself. */
   device_name: string;
+  /** The name the profile gave the device; absent when it has none. */
+  custom_name?: string;
   device_platform: string;
   last_seen_at: string;
   profile_id: string;
@@ -3902,6 +3893,8 @@ export interface PluginCapability {
   callback_url?: string;
   /** An installation's OAuth sign-in capability: the post-logout redirect URI to register. */
   post_logout_redirect_url?: string;
+  /** A request_router.v1 capability: the request server fields its plugin can do without. */
+  request_router?: { api_key_optional: boolean; base_url_optional: boolean };
 }
 
 export interface PluginRoute {
@@ -4504,6 +4497,10 @@ export interface SectionItem {
   badges?: string[];
   user_state?: MediaItemUserState;
   upcoming_event?: SectionItemUpcomingEvent | null;
+  /** This profile's language when the card's description is not in it yet. */
+  pending_translation_language?: string;
+  /** Localized fields whose text was machine-translated by AI. */
+  machine_translated_fields?: string[];
 }
 
 export interface ResolvedSection {
@@ -5051,6 +5048,13 @@ export interface AdminTimeseries {
   from: string;
   to: string;
   oldest_sample_at: string | null;
+  // Data transferred over the whole window, integrated server-side from every
+  // sampled minute (not from `points`, which are per-bucket peaks). An estimate:
+  // node egress is a rolling average and unsampled minutes count as nothing.
+  // v2 only (advertised by the `egress_totals` dashboard capability); optional
+  // because older servers do not send it.
+  egress_bytes?: number;
+  download_egress_bytes?: number;
   points: AdminTimeseriesPoint[];
 }
 
@@ -5386,6 +5390,8 @@ export interface UnmatchedLibraryItem {
   library_id: number;
   library_name: string;
   status: string;
+  /** When an admin marked the item as intentionally unmatched; absent unless ignored. */
+  ignored_at?: string;
 }
 
 export interface FilesystemBrowseEntry {
diff --git a/web/src/api/v2/adminDownloadStorage.ts b/web/src/api/v2/adminDownloadStorage.ts
index 5f5513df45..d69d9d0c6c 100644
--- a/web/src/api/v2/adminDownloadStorage.ts
+++ b/web/src/api/v2/adminDownloadStorage.ts
@@ -1,6 +1,5 @@
 import type { ProfileRequestContextSnapshot } from "@/api/client";
-import { adminKeys } from "@/hooks/queries/keys";
-import { adminAuthorityScope, requireAdminAuthority } from "./adminAuthority";
+import { requireAdminAuthority } from "./adminAuthority";
 import { v2, type V2Query, type V2Result } from "./request";
 
 export type AdminDownloadStorage = V2Result<"GET /api/v2/admin/downloads/storage">;
@@ -28,10 +27,6 @@ export const ADMIN_DOWNLOAD_STORAGE_DELETE_MAX_IDS = 500;
 /** Most download ids one revoke request may carry. */
 export const ADMIN_DOWNLOAD_REVOKE_MAX_IDS = 500;
 
-export function adminDownloadStorageRootKey(context: ProfileRequestContextSnapshot | null) {
-  return [...adminKeys.downloadStorage(), adminAuthorityScope(context)] as const;
-}
-
 async function read<T>(context: ProfileRequestContextSnapshot, run: () => Promise<T>): Promise<T> {
   requireAdminAuthority(context);
   const result = await run();
diff --git a/web/src/api/v2/adminDownloadStorageCache.ts b/web/src/api/v2/adminDownloadStorageCache.ts
new file mode 100644
index 0000000000..6aab7a2d0f
--- /dev/null
+++ b/web/src/api/v2/adminDownloadStorageCache.ts
@@ -0,0 +1,10 @@
+import type { ProfileRequestContextSnapshot } from "@/api/client";
+import { adminKeys } from "@/hooks/queries/keys";
+import { adminAuthorityScope } from "./adminAuthority";
+
+// Kept apart from adminDownloadStorage so the realtime provider, which loads
+// with the app, can refresh these queries without pulling the storage API into
+// the launch bundle.
+export function adminDownloadStorageRootKey(context: ProfileRequestContextSnapshot | null) {
+  return [...adminKeys.downloadStorage(), adminAuthorityScope(context)] as const;
+}
diff --git a/web/src/api/v2/adminUsers.ts b/web/src/api/v2/adminUsers.ts
index 3979fef39f..779ea40e7f 100644
--- a/web/src/api/v2/adminUsers.ts
+++ b/web/src/api/v2/adminUsers.ts
@@ -75,6 +75,7 @@ export function adminUserFromV2(user: AdminUserV2): AdminUser {
       max_transcodes: user.effective_policy.max_transcodes,
       max_remote_stream_bitrate_kbps: user.effective_policy.max_remote_stream_bitrate_kbps,
       max_local_stream_bitrate_kbps: user.effective_policy.max_local_stream_bitrate_kbps,
+      max_profiles: user.effective_policy.max_profiles,
       transcode_allowed: user.effective_policy.transcode_allowed,
       audio_transcode_allowed: user.effective_policy.audio_transcode_allowed,
       download_allowed: user.effective_policy.download_allowed,
diff --git a/web/src/api/v2/catalog.ts b/web/src/api/v2/catalog.ts
index 336f2bd922..66f6499e6f 100644
--- a/web/src/api/v2/catalog.ts
+++ b/web/src/api/v2/catalog.ts
@@ -97,6 +97,8 @@ export function catalogItemFromV2(item: CatalogItemV2): CatalogCardItem {
       : undefined,
     manga_chapter_count: item.manga_chapter_count,
     manga_volume_count: item.manga_volume_count,
+    pending_translation_language: item.pending_translation_language,
+    machine_translated_fields: item.machine_translated_fields,
   };
 }
 
@@ -273,6 +275,7 @@ export function catalogItemDetailFromV2(item: CatalogItemDetailV2): ItemDetail {
     overview: item.overview ?? "",
     tagline: item.tagline,
     pending_translation_language: item.pending_translation_language,
+    machine_translated_fields: item.machine_translated_fields,
     runtime: item.runtime ?? 0,
     content_rating: item.content_rating ?? "",
     advisory_age: item.advisory_age ?? null,
@@ -372,6 +375,8 @@ export function episodeFromV2(episode: EpisodeV2): EpisodeListItem {
     user_data: episode.user_data ? watchRollupFromV2(episode.user_data) : undefined,
     files: (episode.files ?? []).map(episodeFileFromV2),
     overlay_summary: episode.overlay_summary,
+    machine_translated_fields: episode.machine_translated_fields,
+    pending_translation_language: episode.pending_translation_language,
   };
 }
 
@@ -388,6 +393,7 @@ export function seasonFromV2(season: SeasonV2): Season {
     poster_url: season.poster_url ?? "",
     poster_thumbhash: season.poster_thumbhash ?? "",
     user_data: season.user_data ? watchRollupFromV2(season.user_data) : undefined,
+    machine_translated_fields: season.machine_translated_fields,
   };
 }
 
diff --git a/web/src/api/v2/notifications.test.ts b/web/src/api/v2/notifications.test.ts
index ef8e3cb96b..eb4d8c2e37 100644
--- a/web/src/api/v2/notifications.test.ts
+++ b/web/src/api/v2/notifications.test.ts
@@ -3,8 +3,10 @@ import { setAccessToken, setRefreshToken, setProfileId, setProfileToken } from "
 import {
   captureNotificationAuthority,
   listNotifications,
+  listNotificationSeries,
   markAllNotificationsRead,
   markNotificationRead,
+  setNotificationSeriesMuted,
   updateNotificationPreferences,
 } from "./notifications";
 const row = {
@@ -99,6 +101,7 @@ it("never refreshes or replays inbox and preference mutations", async () => {
     () => markNotificationRead("delivery-1"),
     () => markAllNotificationsRead("cutoff"),
     () => updateNotificationPreferences({ enabled: false }),
+    () => setNotificationSeriesMuted("series:bear", true),
   ]) {
     fetch.mockClear();
     await expect(run()).rejects.toMatchObject({ status: 401 });
@@ -131,3 +134,58 @@ it("preserves explicit false preferences and omits response-only profile identit
     notify_favorites: false,
   });
 });
+it("pages notified series by status and rejects a page that repeats its cursor", async () => {
+  const series = {
+    item: {
+      content_id: "series:bear",
+      title: "The Bear",
+      type: "series",
+      status: "matched",
+      genres: [],
+      keywords: [],
+    },
+    reasons: { favorite: true, watchlist: false, continue_watching: false, next_up: false },
+    active_reasons: { favorite: true, watchlist: false, continue_watching: false, next_up: false },
+    notifies: true,
+  };
+  const fetch = vi
+    .fn<typeof globalThis.fetch>()
+    .mockResolvedValueOnce(
+      response({ items: [series], page: { has_more: true, next_cursor: "next" } }),
+    )
+    .mockResolvedValueOnce(response({ items: [], page: { has_more: true, next_cursor: "next" } }));
+  vi.stubGlobal("fetch", fetch);
+  const page = await listNotificationSeries("inactive", {
+    q: "bear",
+    reason: "favorite",
+    sort: "-latest_episode_added",
+  });
+  expect(page).toEqual({ series: [series], next_cursor: "next" });
+  const url = new URL(String(fetch.mock.calls[0]![0]), "http://silo.test");
+  expect(url.pathname).toBe("/api/v2/notifications/series");
+  expect(Object.fromEntries(url.searchParams)).toMatchObject({
+    status: "inactive",
+    q: "bear",
+    reason: "favorite",
+    sort: "-latest_episode_added",
+  });
+  await expect(listNotificationSeries("inactive", {}, "next")).rejects.toThrow(
+    "Invalid series page",
+  );
+});
+it("mutes with PUT and unmutes with DELETE on the series' mute", async () => {
+  const fetch = vi
+    .fn<typeof globalThis.fetch>()
+    .mockImplementation(async () => new Response(null, { status: 204 }));
+  vi.stubGlobal("fetch", fetch);
+  await setNotificationSeriesMuted("series:bear", true);
+  await setNotificationSeriesMuted("series:bear", false);
+  const calls = fetch.mock.calls.map(([input, init]) => [
+    new URL(String(input), "http://silo.test").pathname,
+    init?.method,
+  ]);
+  expect(calls).toEqual([
+    ["/api/v2/notifications/series/series%3Abear/mute", "PUT"],
+    ["/api/v2/notifications/series/series%3Abear/mute", "DELETE"],
+  ]);
+});
diff --git a/web/src/api/v2/notifications.ts b/web/src/api/v2/notifications.ts
index 6aaf2d3b4f..958437c809 100644
--- a/web/src/api/v2/notifications.ts
+++ b/web/src/api/v2/notifications.ts
@@ -8,7 +8,7 @@ import type {
   NotificationPreferences,
   NotificationReasonFlags,
 } from "@/api/types";
-import { v2, type V2Result } from "./request";
+import { v2, type V2Query, type V2Result } from "./request";
 export const captureNotificationAuthority = captureAdminAuthority;
 export const notificationScope = adminAuthorityScope;
 export const requireNotificationAuthority = requireAdminAuthority;
@@ -67,6 +67,65 @@ export async function listNotifications(
     read_cutoff: body.read_cutoff,
   };
 }
+export type NotifiedSeries = V2Result<"GET /api/v2/notifications/series">["items"][number];
+export type NotifiedSeriesStatus = "active" | "inactive";
+type NotifiedSeriesQuery = NonNullable<V2Query<"GET /api/v2/notifications/series">>;
+/** The search, reason filter, and sort the Series view applies to both lists. */
+export type NotifiedSeriesOptions = {
+  q?: string;
+  reason?: NotifiedSeriesQuery["reason"];
+  sort?: NotifiedSeriesQuery["sort"];
+};
+export async function listNotificationSeries(
+  status: NotifiedSeriesStatus,
+  options: NotifiedSeriesOptions,
+  cursor?: string,
+  profileContext = captureNotificationAuthority(),
+) {
+  requireNotificationAuthority(profileContext);
+  const body = await v2("GET /api/v2/notifications/series", {
+    query: {
+      status,
+      limit: 50,
+      cursor,
+      image_size: "small",
+      q: options.q || undefined,
+      reason: options.reason,
+      sort: options.sort,
+    },
+    profileContext,
+  });
+  requireNotificationAuthority(profileContext);
+  if (
+    !Array.isArray(body.items) ||
+    !body.page ||
+    typeof body.page.has_more !== "boolean" ||
+    (body.page.has_more &&
+      (typeof body.page.next_cursor !== "string" ||
+        !body.page.next_cursor ||
+        body.page.next_cursor === cursor))
+  )
+    throw new Error("Invalid series page. Reload notifications.");
+  return {
+    series: body.items,
+    next_cursor: body.page.has_more ? body.page.next_cursor : undefined,
+  };
+}
+/** Mutes (or unmutes) new-episode notifications for one series. */
+export async function setNotificationSeriesMuted(
+  seriesId: string,
+  muted: boolean,
+  profileContext = captureNotificationAuthority(),
+) {
+  requireNotificationAuthority(profileContext);
+  await v2(
+    muted
+      ? "PUT /api/v2/notifications/series/{series_id}/mute"
+      : "DELETE /api/v2/notifications/series/{series_id}/mute",
+    { path: { series_id: seriesId }, profileContext, retryAuthentication: false },
+  );
+  requireNotificationAuthority(profileContext);
+}
 export async function unreadNotificationCount(profileContext = captureNotificationAuthority()) {
   requireNotificationAuthority(profileContext);
   const body = await v2("GET /api/v2/notifications/unread-count", { profileContext });
diff --git a/web/src/api/v2/operations.ts b/web/src/api/v2/operations.ts
index 4f0e438c66..0823360fc4 100644
--- a/web/src/api/v2/operations.ts
+++ b/web/src/api/v2/operations.ts
@@ -62,6 +62,7 @@ export const v2Operations = {
   "DELETE /api/v2/favorites/{item_id}": "deleteFavorite",
   "DELETE /api/v2/home/dismissals/{surface}/{item_id}": "undismissHomeItem",
   "DELETE /api/v2/libraries/roots/override": "deleteRootOverride",
+  "DELETE /api/v2/libraries/unmatched-items/{content_id}/ignore": "unignoreUnmatchedItem",
   "DELETE /api/v2/libraries/{id}": "deleteLibrary",
   "DELETE /api/v2/libraries/{id}/poster": "deleteLibraryPoster",
   "DELETE /api/v2/library-playback-prefs/{library_id}": "deleteLibraryPlaybackPreference",
@@ -69,9 +70,11 @@ export const v2Operations = {
   "DELETE /api/v2/livetv/series-rules/{rule_id}": "deleteLiveTVSeriesRule",
   "DELETE /api/v2/livetv/sessions/{session_id}": "stopLiveTVSession",
   "DELETE /api/v2/markers/files/{file_id}/{segment}": "clearFileMarkerSegment",
+  "DELETE /api/v2/not-interested/{item_id}": "unmarkNotInterested",
   "DELETE /api/v2/notifications/discord-link": "unlinkNotificationDiscord",
   "DELETE /api/v2/notifications/email-preferences/address": "clearNotificationEmailAddress",
   "DELETE /api/v2/notifications/push/devices/{device_id}": "unregisterPushDevice",
+  "DELETE /api/v2/notifications/series/{series_id}/mute": "unmuteNotificationSeries",
   "DELETE /api/v2/notifications/web-push/subscriptions/{id}":
     "deleteNotificationWebPushSubscription",
   "DELETE /api/v2/notifications/webhooks/{id}": "deleteNotificationWebhook",
@@ -79,6 +82,7 @@ export const v2Operations = {
   "DELETE /api/v2/profile/sections": "resetProfileSectionOverrides",
   "DELETE /api/v2/profiles/{id}": "deleteProfile",
   "DELETE /api/v2/profiles/{id}/avatar": "deleteProfileAvatar",
+  "DELETE /api/v2/progress/{media_item_id}/position": "clearResumePosition",
   "DELETE /api/v2/ratings/{item_id}": "deleteRating",
   "DELETE /api/v2/requests/follows/{media_type}/{tmdb_id}": "unfollowRequestMedia",
   "DELETE /api/v2/settings/device/subtitle-appearance": "deleteSubtitleAppearanceDeviceOverride",
@@ -177,6 +181,8 @@ export const v2Operations = {
   "GET /api/v2/admin/libraries/{library_id}/collection-groups": "listAdminCollectionGroups",
   "GET /api/v2/admin/libraries/{library_id}/collection-groups/order":
     "getAdminCollectionGroupOrder",
+  "GET /api/v2/admin/libraries/{library_id}/metadata-translation/jobs":
+    "listLibraryMetadataTranslationJobs",
   "GET /api/v2/admin/literary-works/items/{content_id}/candidates": "listAdminLiteraryCandidates",
   "GET /api/v2/admin/livetv/guide-sources": "listAdminLiveTVGuideSources",
   "GET /api/v2/admin/livetv/tuners": "listAdminLiveTVTuners",
@@ -306,6 +312,7 @@ export const v2Operations = {
   "GET /api/v2/capabilities/downloads": "getDownloadCapability",
   "GET /api/v2/capabilities/ebooks": "getEbookCapability",
   "GET /api/v2/capabilities/metadata-ai": "getMetadataAICapability",
+  "GET /api/v2/capabilities/not-interested": "getNotInterestedCapability",
   "GET /api/v2/capabilities/password-reset": "getPasswordResetCapability",
   "GET /api/v2/capabilities/ratings": "getRatingsCapability",
   "GET /api/v2/capabilities/trailers": "getTrailersCapability",
@@ -405,6 +412,8 @@ export const v2Operations = {
   "GET /api/v2/markers/files/{file_id}": "getFileMarkers",
   "GET /api/v2/markers/items/{item_id}": "getItemMarkers",
   "GET /api/v2/network-access/capabilities": "getNetworkAccessCapabilities",
+  "GET /api/v2/not-interested": "listNotInterested",
+  "GET /api/v2/not-interested/{item_id}": "getNotInterested",
   "GET /api/v2/notifications": "listNotifications",
   "GET /api/v2/notifications/capabilities": "getNotificationCapabilities",
   "GET /api/v2/notifications/discord-preferences": "getNotificationDiscordPreferences",
@@ -417,6 +426,7 @@ export const v2Operations = {
   "GET /api/v2/notifications/preferences": "getNotificationPreferences",
   "GET /api/v2/notifications/push/apple/display/{delivery_id}": "getNotificationApplePushDisplay",
   "GET /api/v2/notifications/push/devices/capabilities": "getPushRegistrationCapabilities",
+  "GET /api/v2/notifications/series": "listNotificationSeries",
   "GET /api/v2/notifications/sync": "syncNotifications",
   "GET /api/v2/notifications/unread-count": "getNotificationUnreadCount",
   "GET /api/v2/notifications/web-push/subscriptions": "listNotificationWebPushSubscriptions",
@@ -427,6 +437,7 @@ export const v2Operations = {
   "GET /api/v2/onboarding/state": "getOnboardingState",
   "GET /api/v2/openapi.json": "getOpenAPIDocument",
   "GET /api/v2/password-resets/{token}": "lookupPasswordReset",
+  "GET /api/v2/playback/bandwidth-probe": "getPlaybackBandwidthProbe",
   "GET /api/v2/playback/capabilities": "getPlaybackCapabilities",
   "GET /api/v2/playback/quality-ladder": "getPlaybackQualityLadder",
   "GET /api/v2/playback/sessions/control/capabilities": "getPlaybackControlSocketCapabilities",
@@ -441,6 +452,7 @@ export const v2Operations = {
   "GET /api/v2/profiles": "listProfiles",
   "GET /api/v2/profiles/household/sessions": "listHouseholdSessions",
   "GET /api/v2/progress": "listProgress",
+  "GET /api/v2/progress/capabilities": "getProgressCapabilities",
   "GET /api/v2/ratings": "listRatings",
   "GET /api/v2/ratings/{item_id}": "getRating",
   "GET /api/v2/recommendations/because-watched/{item_id}": "listBecauseWatched",
@@ -472,6 +484,7 @@ export const v2Operations = {
   "GET /api/v2/scan/capabilities": "getScanCapabilities",
   "GET /api/v2/sections/recipes": "listSectionRecipes",
   "GET /api/v2/sections/recipes/{type}/candidates": "listSectionRecipeCandidates",
+  "GET /api/v2/sections/seasonal-themes": "listSeasonalThemes",
   "GET /api/v2/settings/contract": "getSettingsContract",
   "GET /api/v2/settings/contract/capabilities": "getSettingsContractCapabilities",
   "GET /api/v2/settings/overlay-config": "getOverlayConfig",
@@ -504,7 +517,6 @@ export const v2Operations = {
   "GET /api/v2/system/identity": "getServerIdentity",
   "GET /api/v2/system/info": "getSystemInfo",
   "GET /api/v2/system/setup": "getSetupStatus",
-  "GET /api/v2/theme/admin-css": "getThemeOverrides",
   "GET /api/v2/theme/branding": "getBranding",
   "GET /api/v2/theme/capabilities": "getBrandingCapabilities",
   "GET /api/v2/user/libraries": "listUserLibraries",
@@ -555,6 +567,7 @@ export const v2Operations = {
   "PATCH /api/v2/admin/subtitles/{id}": "updateAdminSubtitleMetadata",
   "PATCH /api/v2/collections/groups/{id}": "updateCollectionGroup",
   "PATCH /api/v2/collections/{id}": "updateCollection",
+  "PATCH /api/v2/devices/{device_id}": "updateDevice",
   "PATCH /api/v2/downloads/subscriptions/{id}": "updateDownloadSubscription",
   "PATCH /api/v2/downloads/{id}": "reportDownloadStatus",
   "PATCH /api/v2/ebooks/{content_id}/annotations/{annotation_id}": "updateEbookAnnotation",
@@ -592,7 +605,6 @@ export const v2Operations = {
   "POST /api/v2/admin/collections/import/mdblist": "importAdminMDBList",
   "POST /api/v2/admin/collections/import/tmdb": "importAdminTMDB",
   "POST /api/v2/admin/collections/import/tmdb-list": "importAdminTMDBList",
-  "POST /api/v2/admin/collections/import/trakt": "importAdminTrakt",
   "POST /api/v2/admin/collections/preview": "previewAdminCollection",
   "POST /api/v2/admin/collections/template-bundles/{bundle_id}/apply":
     "applyAdminCollectionTemplateBundle",
@@ -637,6 +649,9 @@ export const v2Operations = {
   "POST /api/v2/admin/jellyfin-compat/web/remove": "removeAdminJellyfinCompatWeb",
   "POST /api/v2/admin/jobs/{id}/cancel": "cancelAdminJob",
   "POST /api/v2/admin/libraries/{library_id}/collection-groups": "createAdminCollectionGroup",
+  "POST /api/v2/admin/libraries/{library_id}/metadata-translation": "translateLibraryMetadata",
+  "POST /api/v2/admin/libraries/{library_id}/metadata-translation/jobs/{job_id}/cancel":
+    "cancelLibraryMetadataTranslation",
   "POST /api/v2/admin/literary-works/link": "linkAdminLiteraryItems",
   "POST /api/v2/admin/literary-works/matches/confirm": "confirmAdminLiteraryMatch",
   "POST /api/v2/admin/literary-works/matches/ignore": "ignoreAdminLiteraryMatch",
@@ -681,6 +696,7 @@ export const v2Operations = {
   "POST /api/v2/admin/policy/documents/{id}/versions": "createAdminPolicyVersion",
   "POST /api/v2/admin/policy/simulate": "simulateAdminPolicy",
   "POST /api/v2/admin/policy/validate": "validateAdminPolicy",
+  "POST /api/v2/admin/recommendations/embeddings/reset": "resetAdminRecommendationEmbeddings",
   "POST /api/v2/admin/recommendations/trigger/cowatch": "triggerAdminRecommendationCowatch",
   "POST /api/v2/admin/recommendations/trigger/embeddings": "triggerAdminRecommendationEmbeddings",
   "POST /api/v2/admin/recommendations/trigger/recommendations": "triggerAdminRecommendationRefresh",
@@ -743,7 +759,6 @@ export const v2Operations = {
   "POST /api/v2/collections/import/mdblist": "importMDBListCollection",
   "POST /api/v2/collections/import/tmdb": "importTMDBCollection",
   "POST /api/v2/collections/import/tmdb-list": "importTMDBListCollection",
-  "POST /api/v2/collections/import/trakt": "importTraktCollection",
   "POST /api/v2/collections/preview": "previewCollection",
   "POST /api/v2/collections/{id}/sync": "syncCollection",
   "POST /api/v2/devices/push/apple": "registerApplePushDevice",
@@ -898,14 +913,17 @@ export const v2Operations = {
   "PUT /api/v2/favorites/{item_id}": "addFavorite",
   "PUT /api/v2/home/dismissals/{surface}/{item_id}": "dismissHomeItem",
   "PUT /api/v2/libraries/roots/override": "setRootOverride",
+  "PUT /api/v2/libraries/unmatched-items/{content_id}/ignore": "ignoreUnmatchedItem",
   "PUT /api/v2/libraries/{id}/poster": "uploadLibraryPoster",
   "PUT /api/v2/libraries/{id}/providers": "setLibraryProviders",
   "PUT /api/v2/markers/files/{file_id}": "setFileMarkers",
   "PUT /api/v2/markers/items/{item_id}": "setItemMarkers",
+  "PUT /api/v2/not-interested/{item_id}": "markNotInterested",
   "PUT /api/v2/notifications/discord-preferences": "updateNotificationDiscordPreferences",
   "PUT /api/v2/notifications/email-preferences": "updateNotificationEmailPreferences",
   "PUT /api/v2/notifications/email-preferences/address": "requestNotificationEmailVerification",
   "PUT /api/v2/notifications/preferences": "updateNotificationPreferences",
+  "PUT /api/v2/notifications/series/{series_id}/mute": "muteNotificationSeries",
   "PUT /api/v2/notifications/webhooks/{id}": "updateNotificationWebhook",
   "PUT /api/v2/onboarding/progress": "updateOnboardingProgress",
   "PUT /api/v2/profile/sections": "replaceProfileSectionOverrides",
diff --git a/web/src/api/v2/recommendations.ts b/web/src/api/v2/recommendations.ts
index d4b5c39b3f..06b04c621f 100644
--- a/web/src/api/v2/recommendations.ts
+++ b/web/src/api/v2/recommendations.ts
@@ -2,19 +2,13 @@ import { catalogItemFromV2, type CatalogCardItem } from "@/api/v2/catalog";
 import type { components } from "@/api/v2/schema";
 
 /**
- * Recommendation reads as the Discover, For You, and Watch Tonight screens
- * still model them. v2 renders every recommended item as the shared
- * CatalogItem and names a row's members `title`/`kind`/`key`; the adapters
- * below keep the v1 hook return shapes so the screens are untouched.
+ * Recommendation reads as the Discover and For You screens still model them.
+ * v2 renders every recommended item as the shared CatalogItem and names a
+ * row's members `title`/`kind`/`key`; the adapters below keep the v1 hook
+ * return shapes so the screens are untouched.
  */
 
 type RecommendationRowV2 = components["schemas"]["RecommendationRow"];
-type WatchTonightV2 = components["schemas"]["WatchTonight"];
-type WatchTonightItemV2 = components["schemas"]["WatchTonightItem"];
-type WatchTonightCardV2 = components["schemas"]["WatchTonightCard"];
-type WatchTonightCardPageV2 = components["schemas"]["WatchTonightCardPage"];
-
-export type WatchTonightSource = WatchTonightItemV2["watch_tonight_source"];
 
 /** A recommendation row as the Discover and For You screens render it. */
 export interface DiscoverRow {
@@ -64,24 +58,3 @@ export function recommendationSectionFromV2(
     items: row.items.map(catalogItemFromV2),
   };
 }
-
-export function watchTonightItemFromV2(item: WatchTonightItemV2) {
-  return { ...catalogItemFromV2(item), watch_tonight_source: item.watch_tonight_source };
-}
-
-export function watchTonightFromV2(body: WatchTonightV2) {
-  return { items: body.items.map(watchTonightItemFromV2), is_cold: body.is_cold };
-}
-
-export function swipeCardFromV2(card: WatchTonightCardV2) {
-  return { ...watchTonightItemFromV2(card), cast: card.cast };
-}
-
-export function swipeCardsPageFromV2(page: WatchTonightCardPageV2) {
-  return {
-    cards: page.items.map(swipeCardFromV2),
-    has_more: page.has_more,
-    paging_limited: page.paging_limited,
-    is_cold: page.is_cold,
-  };
-}
diff --git a/web/src/api/v2/request.test.ts b/web/src/api/v2/request.test.ts
index 1ec80dc2ef..747ad81b75 100644
--- a/web/src/api/v2/request.test.ts
+++ b/web/src/api/v2/request.test.ts
@@ -447,7 +447,7 @@ describe("v2 declared request headers", () => {
     const fetchMock = vi.fn<typeof fetch>(async () => json({ id: "collection" }));
     vi.stubGlobal("fetch", fetchMock);
     await v2("PATCH /api/v2/watch-providers/{provider}/connection", {
-      path: { provider: "trakt" },
+      path: { provider: "simkl" },
       body: { scrobble_enabled: true },
       headers: { "If-Match": '"observed-revision"' },
     });
@@ -478,23 +478,23 @@ describe("v2 declared request headers", () => {
     if (runTypeChecks()) {
       // @ts-expect-error If-Match is required for guarded watch-provider updates.
       void v2("PATCH /api/v2/watch-providers/{provider}/connection", {
-        path: { provider: "trakt" },
+        path: { provider: "simkl" },
         body: {},
       });
       void v2("PATCH /api/v2/watch-providers/{provider}/connection", {
-        path: { provider: "trakt" },
+        path: { provider: "simkl" },
         body: {},
         // @ts-expect-error An empty header set cannot satisfy the required validator.
         headers: {},
       });
       void v2("PATCH /api/v2/watch-providers/{provider}/connection", {
-        path: { provider: "trakt" },
+        path: { provider: "simkl" },
         body: {},
         // @ts-expect-error Operation headers cannot carry session authority.
         headers: { "If-Match": '"v1"', Authorization: "other" },
       });
       void v2("PATCH /api/v2/watch-providers/{provider}/connection", {
-        path: { provider: "trakt" },
+        path: { provider: "simkl" },
         body: {},
         // @ts-expect-error Unknown headers are not part of the generated contract.
         headers: { "If-Match": '"v1"', "X-Unknown": "x" },
diff --git a/web/src/api/v2/schema.ts b/web/src/api/v2/schema.ts
index 9eab041413..187581ebc7 100644
--- a/web/src/api/v2/schema.ts
+++ b/web/src/api/v2/schema.ts
@@ -1108,23 +1108,6 @@ export interface paths {
     patch?: never;
     trace?: never;
   };
-  "/api/v2/admin/collections/import/trakt": {
-    parameters: {
-      query?: never;
-      header?: never;
-      path?: never;
-      cookie?: never;
-    };
-    get?: never;
-    put?: never;
-    /** Import a Trakt collection. */
-    post: operations["importAdminTrakt"];
-    delete?: never;
-    options?: never;
-    head?: never;
-    patch?: never;
-    trace?: never;
-  };
   "/api/v2/admin/collections/order": {
     parameters: {
       query?: never;
@@ -2553,6 +2536,57 @@ export interface paths {
     patch?: never;
     trace?: never;
   };
+  "/api/v2/admin/libraries/{library_id}/metadata-translation": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /** Prewarm a library: persist or reuse an active job that translates the missing descriptions of every item in the library, with their seasons and episodes, into a language. Existing provider, manual and AI text is kept. Progress counts items. */
+    post: operations["translateLibraryMetadata"];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/api/v2/admin/libraries/{library_id}/metadata-translation/jobs": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** Read the latest 50 prewarm jobs of a library. */
+    get: operations["listLibraryMetadataTranslationJobs"];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/api/v2/admin/libraries/{library_id}/metadata-translation/jobs/{job_id}/cancel": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /** Request cancellation only for a prewarm job of the library. */
+    post: operations["cancelLibraryMetadataTranslation"];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   "/api/v2/admin/literary-works/{work_id}/items/{content_id}": {
     parameters: {
       query?: never;
@@ -3264,7 +3298,7 @@ export interface paths {
     };
     get?: never;
     put?: never;
-    /** Dispatch one test push notification and report its current delivery outcome. */
+    /** Dispatch one test push carrying the target profile's newest notification and report its current delivery outcome. */
     post: operations["testAdminApplePushNotification"];
     delete?: never;
     options?: never;
@@ -3281,7 +3315,7 @@ export interface paths {
     };
     get?: never;
     put?: never;
-    /** Dispatch one test push notification and report its current delivery outcome. */
+    /** Dispatch one test push carrying the target profile's newest notification and report its current delivery outcome. */
     post: operations["testAdminAndroidPushNotification"];
     delete?: never;
     options?: never;
@@ -4035,6 +4069,26 @@ export interface paths {
     patch?: never;
     trace?: never;
   };
+  "/api/v2/admin/recommendations/embeddings/reset": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Delete the embedding lock, every item embedding, taste clusters and per-profile cached rows, and clear taste profile vectors, in one transaction.
+     * @description Recovers a server whose embedding lock pins a model it can no longer use, or switches embedding models. It refuses with 409 while the embedding, taste profile or recommendation job, or a stale profile sweep, runs on any server, while a catalog import with embeddings runs, and while saved embedding settings wait for a server restart. Run the embedding job afterwards to build the new embedding space.
+     */
+    post: operations["resetAdminRecommendationEmbeddings"];
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   "/api/v2/admin/recommendations/status": {
     parameters: {
       query?: never;
@@ -4042,7 +4096,7 @@ export interface paths {
       path?: never;
       cookie?: never;
     };
-    /** Read persisted counts and this process's running flags. */
+    /** Read persisted counts, each job's last run, the embedding lock conflict and this process's running flags. */
     get: operations["getAdminRecommendationsStatus"];
     put?: never;
     post?: never;
@@ -6543,6 +6597,23 @@ export interface paths {
     patch?: never;
     trace?: never;
   };
+  "/api/v2/capabilities/not-interested": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** Whether the acting profile can mark movies and series Not interested. */
+    get: operations["getNotInterestedCapability"];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   "/api/v2/capabilities/password-reset": {
     parameters: {
       query?: never;
@@ -6772,7 +6843,7 @@ export interface paths {
     };
     get?: never;
     put?: never;
-    /** Queue a translation of the item's descriptions into the language the detail document reported missing; answers 202 with the job. */
+    /** Queue a translation of the descriptions a page shows into the language its detail document reported missing: a movie's or series' own overview and tagline, a season's overview and its episodes' overviews, or one episode. Answers 202 with the job. */
     post: operations["translateCatalogItemDescription"];
     delete?: never;
     options?: never;
@@ -7281,23 +7352,6 @@ export interface paths {
     patch?: never;
     trace?: never;
   };
-  "/api/v2/collections/import/trakt": {
-    parameters: {
-      query?: never;
-      header?: never;
-      path?: never;
-      cookie?: never;
-    };
-    get?: never;
-    put?: never;
-    /** Import a Trakt preset as a synced collection. Creates the collection and runs its first sync. Not idempotent: a retry after a lost response creates a second collection. */
-    post: operations["importTraktCollection"];
-    delete?: never;
-    options?: never;
-    head?: never;
-    patch?: never;
-    trace?: never;
-  };
   "/api/v2/collections/order": {
     parameters: {
       query?: never;
@@ -7433,7 +7487,8 @@ export interface paths {
     delete: operations["forgetDevice"];
     options?: never;
     head?: never;
-    patch?: never;
+    /** Update a device's entry for the acting profile, or another household profile, and return it; omitted members are unchanged. Settings and login sessions are untouched. */
+    patch: operations["updateDevice"];
     trace?: never;
   };
   "/api/v2/devices/{device_id}/settings": {
@@ -8129,10 +8184,10 @@ export interface paths {
     };
     /** Answer whether the item is one of the acting profile's favorites: the entry, or 404 when it is not (or the viewer may not see it). */
     get: operations["getFavorite"];
-    /** Add the item to the acting profile's favorites. Automatic retries are unsafe because provider and refresh effects are not change-gated. */
+    /** Add the item to the acting profile's favorites. Adding an item already there succeeds and changes nothing, so a retry repeats no change or notification; it cannot resend notifications an interrupted earlier call never sent. */
     put: operations["addFavorite"];
     post?: never;
-    /** Remove the item from the acting profile's favorites; an absent entry succeeds, but automatic retries can repeat provider and refresh effects. */
+    /** Remove the item from the acting profile's favorites. An absent entry succeeds and changes nothing, so a retry repeats no change or notification; it cannot resend notifications an interrupted earlier call never sent. */
     delete: operations["deleteFavorite"];
     options?: never;
     head?: never;
@@ -8799,7 +8854,7 @@ export interface paths {
       path?: never;
       cookie?: never;
     };
-    /** Page the catalog items awaiting a metadata match, in title order. */
+    /** Page the catalog items awaiting a metadata match, in title order. Items an admin marked as intentionally unmatched are left out unless ignored is set, which lists only those. */
     get: operations["listUnmatchedItems"];
     put?: never;
     post?: never;
@@ -8809,6 +8864,24 @@ export interface paths {
     patch?: never;
     trace?: never;
   };
+  "/api/v2/libraries/unmatched-items/{content_id}/ignore": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    /** Mark an unmatched, pending or ambiguous movie or series as intentionally unmatched: it leaves the unmatched list and the matcher queues and automatic matching leaves it alone, while it stays playable with its local metadata. Match Item still works and clears the mark. Books cannot be ignored. */
+    put: operations["ignoreUnmatchedItem"];
+    post?: never;
+    /** Clear an item's intentionally-unmatched mark so it returns to the unmatched list and automatic matching tries it again; an unmarked item is left as is. */
+    delete: operations["unignoreUnmatchedItem"];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   "/api/v2/library-jobs/{job_id}": {
     parameters: {
       query?: never;
@@ -9222,6 +9295,42 @@ export interface paths {
     patch?: never;
     trace?: never;
   };
+  "/api/v2/not-interested": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** List the movies and series the acting profile marked Not interested as catalog cards, newest mark first; items the viewer may not see are omitted. */
+    get: operations["listNotInterested"];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/api/v2/not-interested/{item_id}": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** Answer whether the acting profile marked the item Not interested: the mark, or 404 when it did not (or the viewer may not see the item). */
+    get: operations["getNotInterested"];
+    /** Mark a movie or series Not interested for the acting profile: its recommendation and discovery rows leave it out and rank similar titles lower, after a rebuild that starts within seconds. Library browsing, search, item detail, playback, favorites and the watchlist are unchanged. Episodes and seasons are refused with 422; mark the series. Marking a marked title succeeds and changes nothing. */
+    put: operations["markNotInterested"];
+    post?: never;
+    /** Clear the acting profile's Not interested mark on the item. An absent mark succeeds and changes nothing. */
+    delete: operations["unmarkNotInterested"];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   "/api/v2/notifications": {
     parameters: {
       query?: never;
@@ -9550,6 +9659,50 @@ export interface paths {
     patch?: never;
     trace?: never;
   };
+  "/api/v2/notifications/series": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List the series whose new episodes can notify the acting profile.
+     * @description Every series the profile favorited, put on its watchlist, is partway through, or waits on a next episode of, and every series it muted, filtered and sorted as asked (by title by default). Each carries its reasons, which of them the profile's notification preferences let notify, and whether the profile muted it. Series the viewer may not see are omitted.
+     */
+    get: operations["listNotificationSeries"];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/api/v2/notifications/series/{series_id}/mute": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    /**
+     * Mute new-episode notifications for one series.
+     * @description The acting profile gets no new-episode notification for the series on any channel, whatever its reasons, until it unmutes. Favorites, the watchlist, Home, and watch history are unchanged, and other profiles are unaffected. Muting a series already muted succeeds and changes nothing. A series the viewer may not see, or an item that is not a series, is 404.
+     */
+    put: operations["muteNotificationSeries"];
+    post?: never;
+    /**
+     * Unmute new-episode notifications for one series.
+     * @description The series notifies the acting profile again for its active reasons. The mute applies when notification delivery evaluates a new episode, normally within a minute of it arriving: an episode evaluated while the series was muted is not announced later, and one still waiting to be evaluated when the profile unmutes is announced. Unmuting a series that is not muted succeeds and changes nothing. No access check runs, so a profile can lift a mute on a series it can no longer see.
+     */
+    delete: operations["unmuteNotificationSeries"];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   "/api/v2/notifications/sync": {
     parameters: {
       query?: never;
@@ -9893,6 +10046,23 @@ export interface paths {
     patch?: never;
     trace?: never;
   };
+  "/api/v2/playback/bandwidth-probe": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** Download random bytes to measure throughput to this server. Clients time the transfer and send the result as bandwidth_estimate_kbps; the bytes count as transfer egress, not playback. A server runs at most 32 probes at once; an account may run two of them and draw up to 400 MB per 10 minutes. Beyond any limit the request gets 429 with Retry-After. */
+    get: operations["getPlaybackBandwidthProbe"];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   "/api/v2/playback/capabilities": {
     parameters: {
       query?: never;
@@ -10239,6 +10409,40 @@ export interface paths {
     patch?: never;
     trace?: never;
   };
+  "/api/v2/progress/{media_item_id}/position": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    post?: never;
+    /** Clear the acting profile's resume position on a movie or episode, keeping its watched state and watch history. An item without a resume position is a no-op. */
+    delete: operations["clearResumePosition"];
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  "/api/v2/progress/capabilities": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** The watch progress features this server supports, such as clearing a resume position. */
+    get: operations["getProgressCapabilities"];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   "/api/v2/ratings": {
     parameters: {
       query?: never;
@@ -10282,7 +10486,7 @@ export interface paths {
       path?: never;
       cookie?: never;
     };
-    /** Cards recommended because the acting profile watched the item, minus what it has watched or rated low. */
+    /** Cards recommended because the acting profile watched the item, minus what it has watched or rated. */
     get: operations["listBecauseWatched"];
     put?: never;
     post?: never;
@@ -10350,7 +10554,7 @@ export interface paths {
       path?: never;
       cookie?: never;
     };
-    /** The server's most played items over the window, minus what the acting profile has watched. */
+    /** The server's most played items over the window, minus what the acting profile has watched or marked Not interested. */
     get: operations["listPopular"];
     put?: never;
     post?: never;
@@ -10367,7 +10571,7 @@ export interface paths {
       path?: never;
       cookie?: never;
     };
-    /** Items added over the window, minus what the acting profile has watched. */
+    /** Items added over the window, minus what the acting profile has watched or marked Not interested. */
     get: operations["listRecentlyAdded"];
     put?: never;
     post?: never;
@@ -10418,7 +10622,7 @@ export interface paths {
       path?: never;
       cookie?: never;
     };
-    /** Cards similar to the item by content; not personalised beyond the acting profile's access. */
+    /** Cards similar to the item by content; personalised only by the acting profile's access and by leaving out the titles it marked Not interested. */
     get: operations["listSimilar"];
     put?: never;
     post?: never;
@@ -10871,6 +11075,23 @@ export interface paths {
     patch?: never;
     trace?: never;
   };
+  "/api/v2/sections/seasonal-themes": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /** The holidays a Seasonal Picks row can follow, with the curated vibes each offers. */
+    get: operations["listSeasonalThemes"];
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   "/api/v2/settings/contract": {
     parameters: {
       query?: never;
@@ -11728,23 +11949,6 @@ export interface paths {
     patch?: never;
     trace?: never;
   };
-  "/api/v2/theme/admin-css": {
-    parameters: {
-      query?: never;
-      header?: never;
-      path?: never;
-      cookie?: never;
-    };
-    /** Read public pre-login theme overrides. */
-    get: operations["getThemeOverrides"];
-    put?: never;
-    post?: never;
-    delete?: never;
-    options?: never;
-    head?: never;
-    patch?: never;
-    trace?: never;
-  };
   "/api/v2/theme/branding": {
     parameters: {
       query?: never;
@@ -12355,10 +12559,10 @@ export interface paths {
     };
     /** Answer whether the item is on the acting profile's watchlist: the entry, or 404 when it is not (or the viewer may not see it). */
     get: operations["getWatchlistEntry"];
-    /** Add the item to the acting profile's watchlist. Automatic retries are unsafe because provider and refresh effects are not change-gated. */
+    /** Add the item to the acting profile's watchlist. Adding an item already there succeeds and changes nothing, so a retry repeats no change or notification; it cannot resend notifications an interrupted earlier call never sent. */
     put: operations["addToWatchlist"];
     post?: never;
-    /** Remove the item from the acting profile's watchlist; an absent entry succeeds, but automatic retries can repeat provider and refresh effects. */
+    /** Remove the item from the acting profile's watchlist. An absent entry succeeds and changes nothing, so a retry repeats no change or notification; it cannot resend notifications an interrupted earlier call never sent. */
     delete: operations["deleteWatchlistEntry"];
     options?: never;
     head?: never;
@@ -12779,6 +12983,11 @@ export interface components {
        */
       max_local_stream_bitrate_kbps: number;
       max_playback_quality: string;
+      /**
+       * Format: int64
+       * @description Household profiles each member account may have, unless the account overrides it
+       */
+      max_profiles: number;
       /**
        * Format: int64
        * @description Remote per-stream bitrate ceiling in kbps; 0 means unlimited
@@ -12808,6 +13017,11 @@ export interface components {
       /** Format: int64 */
       max_local_stream_bitrate_kbps?: number;
       max_playback_quality?: string;
+      /**
+       * Format: int64
+       * @description Household profiles each member account may have; 5 when a new group omits it
+       */
+      max_profiles?: number;
       /** Format: int64 */
       max_remote_stream_bitrate_kbps?: number;
       /** Format: int64 */
@@ -12842,6 +13056,11 @@ export interface components {
        */
       max_local_stream_bitrate_kbps: number;
       max_playback_quality: string;
+      /**
+       * Format: int64
+       * @description Household profiles each member account may have, unless the account overrides it
+       */
+      max_profiles: number;
       /**
        * Format: int64
        * @description Remote per-stream bitrate ceiling in kbps; 0 means unlimited
@@ -12884,6 +13103,8 @@ export interface components {
       password_reset_link: boolean;
       /** @description Whether getAdminUserPolicyDefaults reports the policy an admin or a regular account with no access group uses for fields it does not override */
       policy_defaults: boolean;
+      /** @description Whether access groups and account policy overrides take max_profiles, the household profile limit; null on an account inherits its group's limit */
+      profile_limits: boolean;
       /** @description Whether listAdminUserProfileSectionOverrides, getAdminUserProfileSectionSettings, replaceAdminUserProfileSectionOverrides and resetAdminUserProfileSectionOverrides can read and change one profile's page layout */
       profile_sections: boolean;
       /** @description Whether getAdminRequestUserUsage can report an account's request quota use */
@@ -12914,8 +13135,11 @@ export interface components {
       /** Format: int64 */
       max_local_stream_bitrate_kbps?: number | null;
       max_playback_quality?: string | null;
-      /** Format: int64 */
-      max_profiles?: number;
+      /**
+       * Format: int64
+       * @description Household profile limit override; null inherits the access group's limit
+       */
+      max_profiles?: number | null;
       /** Format: int64 */
       max_remote_stream_bitrate_kbps?: number | null;
       /** Format: int64 */
@@ -12977,8 +13201,11 @@ export interface components {
       /** Format: int64 */
       max_local_stream_bitrate_kbps?: number | null;
       max_playback_quality?: string | null;
-      /** Format: int64 */
-      max_profiles?: number;
+      /**
+       * Format: int64
+       * @description Household profile limit override; null inherits the access group's limit
+       */
+      max_profiles?: number | null;
       /** Format: int64 */
       max_remote_stream_bitrate_kbps?: number | null;
       /** Format: int64 */
@@ -14087,6 +14314,7 @@ export interface components {
       /** @description Whether the current principal may use the capability */
       allowed: boolean;
       downloads_stats: boolean;
+      egress_totals: boolean;
       health: boolean;
       log_level_list: boolean;
       playback_activity: boolean;
@@ -14204,6 +14432,10 @@ export interface components {
       watch_providers: components["schemas"]["AdminDashboardWatchProviderStats"][];
     };
     AdminDashboardTimeseries: {
+      /** Format: int64 */
+      download_egress_bytes: number;
+      /** Format: int64 */
+      egress_bytes: number;
       /**
        * Format: date-time
        * @description RFC 3339 instant in UTC with millisecond precision
@@ -16555,6 +16787,11 @@ export interface components {
        * @example 1
        */
       attempt_id: string;
+      /**
+       * @description The target profile's newest notification, which the test push carried so the device shows its real text; absent when the profile has no notification and the device can show only generic text.
+       * @example 1
+       */
+      delivery_id?: string;
       failure_message?: string;
       outcome: string;
       /**
@@ -17068,6 +17305,8 @@ export interface components {
        * @example https://silo.example.test/login
        */
       post_logout_redirect_url?: string;
+      /** @description On a request_router.v1 capability: which request server fields its plugin can do without. Omitted for other capability types */
+      request_router?: components["schemas"]["AdminPluginRequestRouter"];
       /**
        * @description How an auth_provider.v1 capability signs people in: oauth (a provider button and browser handshake, such as OIDC), credentials (a username and password form, such as LDAP) or network (a network access plugin, such as Tailscale, that signs in the owner of the device a request came from; one network binding may be on beside the one oauth or credentials binding). Omitted for other capability types
        * @example oauth
@@ -17311,6 +17550,12 @@ export interface components {
       enabled?: boolean;
       url?: string;
     };
+    AdminPluginRequestRouter: {
+      /** @description The plugin works without an API key: a request server for it can be saved and tested without one, and gets requests without one */
+      api_key_optional: boolean;
+      /** @description The plugin works without a base URL: a request server for it can be saved and tested without one */
+      base_url_optional: boolean;
+    };
     AdminPluginRuntime: {
       /** @description Why the process last stopped or failed to start */
       last_error?: string;
@@ -17332,7 +17577,7 @@ export interface components {
        */
       restart_count: number;
       /**
-       * @description Process state; backoff and failed occur only for resident plugins
+       * @description Process state; starting and backoff occur only for resident plugins, failed also marks a non-resident plugin whose last launch failed
        * @enum {string}
        */
       state: "stopped" | "starting" | "running" | "backoff" | "failed";
@@ -17717,19 +17962,86 @@ export interface components {
        */
       state: "available" | "disabled" | "not_configured" | "unsupported";
     };
+    AdminRecommendationEmbeddingsReset: {
+      /**
+       * Format: int64
+       * @description Per-profile cached recommendation rows deleted. Global rows are kept.
+       */
+      cached_rows: number;
+      /**
+       * Format: int64
+       * @description Item embeddings deleted.
+       */
+      embeddings: number;
+      /**
+       * Format: int64
+       * @description Taste clusters deleted.
+       */
+      taste_clusters: number;
+      /**
+       * Format: int64
+       * @description Taste profiles whose vectors were cleared. Each is rebuilt once the embedding job stores its titles' vectors again.
+       */
+      taste_profiles: number;
+    };
+    AdminRecommendationJobRun: {
+      /**
+       * Format: date-time
+       * @description RFC 3339 instant in UTC with millisecond precision
+       */
+      completed_at: string;
+      /** @description Why the run failed, with credentials masked. Present only when status is failed. */
+      error?: string;
+      /** @description Counts the run reported. Keys differ by job and may grow. */
+      result?: {
+        [key: string]: unknown;
+      };
+      /**
+       * Format: date-time
+       * @description RFC 3339 instant in UTC with millisecond precision
+       */
+      started_at: string;
+      /**
+       * @description completed also covers runs that finished with partial failures; result counts them.
+       * @enum {string}
+       */
+      status: "completed" | "failed";
+    };
     AdminRecommendationJobStatus: {
       /** Format: int64 */
       count: number;
+      /** @description The newest finished partial run on any server: the embedding catch-up pass for embeddings, the startup global-row build for recommendations. Absent for other jobs and until one finishes. */
+      last_partial_run?: components["schemas"]["AdminRecommendationJobRun"];
+      /** @description The newest finished full run of this job on any server: scheduled or triggered. Absent until one finishes. */
+      last_run?: components["schemas"]["AdminRecommendationJobRun"];
       running: boolean;
       /** Format: int64 */
       total?: number;
     };
     AdminRecommendationsStatus: {
+      /**
+       * Format: date-time
+       * @description When the newest cached recommendation row was written, by the cache job or a profile refresh. It is not job health: profile refreshes keep it recent while the cache job fails; read recommendations.last_run for that. Absent when nothing is cached.
+       */
+      cache_refreshed_at?: string;
       cowatch: components["schemas"]["AdminRecommendationJobStatus"];
       embeddings: components["schemas"]["AdminRecommendationJobStatus"];
+      /** @description Why the stored embedding lock rejects the embedding settings this server runs with; empty when it does not. */
+      lock_conflict: string;
       recommendations: components["schemas"]["AdminRecommendationJobStatus"];
+      /** @description The stale profile sweep, which rebuilds profiles after their signals or access change. */
+      stale_sweep: components["schemas"]["AdminRecommendationStaleSweep"];
       taste_profiles: components["schemas"]["AdminRecommendationJobStatus"];
     };
+    AdminRecommendationStaleSweep: {
+      /** @description The newest sweep on any server that rebuilt or failed at least one profile. Absent until one does. */
+      last_run?: components["schemas"]["AdminRecommendationJobRun"];
+      /**
+       * Format: int64
+       * @description Profiles whose recommendations wait for a rebuild. The sweep rebuilds up to 50 every 5 minutes; a profile whose rebuild fails stays pending.
+       */
+      pending: number;
+    };
     AdminRecommendationStarted: {
       /**
        * @description This process started background work; no durable job is created.
@@ -19358,34 +19670,15 @@ export interface components {
       /** Format: int64 */
       total_seconds: number;
     };
-    AdminTraktImport: {
-      description?: string;
-      featured?: boolean;
+    AdminTranslateLibraryInputBody: {
       /**
-       * @description Opaque identifier
-       * @example 1
-       */
-      library_id?: string;
-      library_ids?: string[];
-      /** Format: int64 */
-      limit?: number;
-      list_url?: string;
-      management_key?: string;
-      management_mode?: string;
-      management_source?: string;
-      media_type?: string;
-      poster_url?: string;
-      preset?: string;
-      /**
-       * @description Opaque identifier
-       * @example 1
+       * @description BCP 47 tag of the language to fill in
+       * @example de
        */
-      profile_id?: string;
-      sort_config?: unknown;
-      sync_schedule?: string;
-      title: string;
+      target_language: string;
     };
     AdminTranslateMetadataInputBody: {
+      /** @description Also replace text an earlier AI translation wrote. Provider and manual text is never replaced. */
       force?: boolean;
       /** @description Defaults true for item targets; ignored for season and episode targets. */
       include_children?: boolean | null;
@@ -19582,10 +19875,10 @@ export interface components {
       max_playback_quality: string | null;
       /**
        * Format: int64
-       * @description Household profile limit
+       * @description Household profile limit override; null inherits the access group's limit
        * @example 5
        */
-      max_profiles: number;
+      max_profiles: number | null;
       /**
        * Format: int64
        * @description Remote per-stream bitrate override in kbps; null inherits, 0 means unlimited
@@ -20051,6 +20344,11 @@ export interface components {
        * @example 1
        */
       server_device_id: string;
+      /**
+       * @description This deployment's identity, the server_id getServerIdentity reports. Key this registration's push credentials by it and the registering profile: pushes name both. Absent when unavailable.
+       * @example 3f2a9d5e-6b1c-4c7e-9a0d-2f4b8c1e7a35
+       */
+      server_id?: string;
     };
     APIKeyScope: {
       description: string;
@@ -20102,6 +20400,11 @@ export interface components {
        * @example 1
        */
       server_device_id: string;
+      /**
+       * @description This deployment's identity, the server_id getServerIdentity reports. Key this registration's push credentials by it and the registering profile: pushes name both. Absent when unavailable.
+       * @example 3f2a9d5e-6b1c-4c7e-9a0d-2f4b8c1e7a35
+       */
+      server_id?: string;
     };
     AppliedQuirkV3: {
       action: string;
@@ -20415,7 +20718,6 @@ export interface components {
       /** @description Whether the current principal may use the capability */
       allowed?: boolean;
       branding_available: boolean;
-      overrides_available: boolean;
       /** @description Opaque revision of this document */
       revision: string;
       /**
@@ -20681,6 +20983,8 @@ export interface components {
       last_air_date?: string;
       /** @description Presigned, short-lived */
       logo_url?: string;
+      /** @description Localized fields whose text was machine-translated by AI rather than supplied by a metadata provider or a person; absent when none were. Set only on item details, the cards built from them (shuffles, the Watch Together picker), and Home and library section cards. A card shows no tagline, so a card's overview label depends on overview alone. */
+      machine_translated_fields?: ("overview" | "tagline")[];
       /** Format: int64 */
       manga_chapter_count?: number;
       /** Format: int64 */
@@ -20691,6 +20995,8 @@ export interface components {
       /** @description Technical badges of the best file */
       overlay_summary?: components["schemas"]["CatalogItemOverlay"];
       overview?: string;
+      /** @description The language this profile reads here when the descriptions this item's page shows are not available in it yet. That is the profile's metadata language after its per-language exceptions, or, when it sets none, the library's for a library's rows or a detail opened in that library. It is pending for the item's own overview, or for a season its overview or any of its episodes' overviews. Echo it to translateCatalogItemDescription to translate on view. Set only on item details, the cards built from them (shuffles, the Watch Together picker), and Home and library section cards; other listings never carry it, so its absence there says nothing about the language. */
+      pending_translation_language?: string;
       /** @description The item to play when the card is a series or season; absent when the item plays itself */
       play_content_id?: string;
       /**
@@ -20867,6 +21173,8 @@ export interface components {
       locked_fields?: number[];
       /** @description Presigned, short-lived */
       logo_url?: string;
+      /** @description Localized fields whose text was machine-translated by AI rather than supplied by a metadata provider or a person; absent when none were. Set only on item details, the cards built from them (shuffles, the Watch Together picker), and Home and library section cards. A card shows no tagline, so a card's overview label depends on overview alone. */
+      machine_translated_fields?: ("overview" | "tagline")[];
       manga?: components["schemas"]["MangaDetailExtension"];
       /** Format: int64 */
       manga_chapter_count?: number;
@@ -20879,7 +21187,7 @@ export interface components {
       /** @description Technical badges of the best file */
       overlay_summary?: components["schemas"]["CatalogItemOverlay"];
       overview?: string;
-      /** @description A translation of the overview is queued for this language */
+      /** @description The language this profile reads here when the descriptions this item's page shows are not available in it yet. That is the profile's metadata language after its per-language exceptions, or, when it sets none, the library's for a library's rows or a detail opened in that library. It is pending for the item's own overview, or for a season its overview or any of its episodes' overviews. Echo it to translateCatalogItemDescription to translate on view. Set only on item details, the cards built from them (shuffles, the Watch Together picker), and Home and library section cards; other listings never carry it, so its absence there says nothing about the language. */
       pending_translation_language?: string;
       /** @description The item to play when the card is a series or season; absent when the item plays itself */
       play_content_id?: string;
@@ -21057,6 +21365,11 @@ export interface components {
       in_watchlist: boolean;
       /** @example false */
       is_favorite: boolean;
+      /**
+       * @description The profile marked the movie or series Not interested: recommendations leave it out and rank similar titles lower
+       * @example false
+       */
+      not_interested: boolean;
       /** @example false */
       played: boolean;
     };
@@ -22086,7 +22399,6 @@ export interface components {
       tmdb_collection?: components["schemas"]["TMDBCollectionSpec"];
       tmdb_discover?: components["schemas"]["TMDBDiscoverSpec"];
       tmdb_list?: components["schemas"]["TMDBListSpec"];
-      trakt?: components["schemas"]["TraktSpec"];
     };
     CollectionTemplateBundle: {
       description: string;
@@ -22586,7 +22898,13 @@ export interface components {
     DeviceSettings: {
       /** Format: int64 */
       changed_count: number;
+      /**
+       * @description Name the profile gave the device; show it in place of device_name. Absent when none was given
+       * @example Living Room
+       */
+      custom_name?: string;
       device_id: string;
+      /** @description Name the device reports for itself */
       device_name: string;
       device_platform: string;
       is_current_device: boolean;
@@ -22608,6 +22926,13 @@ export interface components {
       /** @description Cursor state; absent for bounded unpaginated collections */
       page?: components["schemas"]["PageInfo"];
     };
+    DeviceUpdate: {
+      /**
+       * @description Name to show for the device in place of the name it reports. Control characters and bidirectional overrides are removed and runs of spaces collapse; a name with no visible character is rejected. null removes it. The reported device_name is kept
+       * @example Living Room
+       */
+      custom_name?: string | null;
+    };
     DiagnosticsCapabilities: {
       accepted_schema_versions: number[];
       /** @description Whether the current principal may use the capability */
@@ -23287,6 +23612,12 @@ export interface components {
        * @example 1080p
        */
       max_playback_quality: string;
+      /**
+       * Format: int64
+       * @description Household profile limit
+       * @example 5
+       */
+      max_profiles: number;
       /**
        * Format: int64
        * @description Remote per-stream bitrate limit in kbps; 0 means unlimited
@@ -23568,8 +23899,14 @@ export interface components {
       episode_number: number;
       files?: components["schemas"]["EpisodeFile"][];
       imdb_id?: string;
+      /** @description Localized fields whose text was machine-translated by AI; absent when none were */
+      machine_translated_fields?: "overview"[];
       overlay_summary?: components["schemas"]["CatalogItemOverlay"];
       overview?: string;
+      /** @description The language this profile reads here (its metadata language, or the library's when it sets none) when the episode's description is not available in it yet; translating the episode's season fills it */
+      pending_translation_language?: string;
+      /** @description The episode's IMDb and TMDB ratings, in the shape a title page's ratings use. Absent when the episode has no rating. */
+      ratings?: components["schemas"]["CatalogRating"][];
       /**
        * Format: int64
        * @description Minutes
@@ -23928,6 +24265,8 @@ export interface components {
       last_air_date?: string;
       /** @description Presigned, short-lived */
       logo_url?: string;
+      /** @description Localized fields whose text was machine-translated by AI rather than supplied by a metadata provider or a person; absent when none were. Set only on item details, the cards built from them (shuffles, the Watch Together picker), and Home and library section cards. A card shows no tagline, so a card's overview label depends on overview alone. */
+      machine_translated_fields?: ("overview" | "tagline")[];
       /** Format: int64 */
       manga_chapter_count?: number;
       /** Format: int64 */
@@ -23938,6 +24277,8 @@ export interface components {
       /** @description Technical badges of the best file */
       overlay_summary?: components["schemas"]["CatalogItemOverlay"];
       overview?: string;
+      /** @description The language this profile reads here when the descriptions this item's page shows are not available in it yet. That is the profile's metadata language after its per-language exceptions, or, when it sets none, the library's for a library's rows or a detail opened in that library. It is pending for the item's own overview, or for a season its overview or any of its episodes' overviews. Echo it to translateCatalogItemDescription to translate on view. Set only on item details, the cards built from them (shuffles, the Watch Together picker), and Home and library section cards; other listings never carry it, so its absence there says nothing about the language. */
+      pending_translation_language?: string;
       /** @description The item to play when the card is a series or season; absent when the item plays itself */
       play_content_id?: string;
       /**
@@ -24321,6 +24662,12 @@ export interface components {
        */
       watched_at: string;
     };
+    HLSSubtitleRenditionV3: {
+      format: string;
+      group_id: string;
+      mime_type: string;
+      name: string;
+    };
     HomeCapabilities: {
       /** @description Whether the current principal may use the capability */
       allowed: boolean;
@@ -24373,6 +24720,10 @@ export interface components {
       /** @description Season-list boolean query parameter; false omits poster URLs and thumbhashes */
       season_list_artwork_param: string;
       sizes: string[];
+      /** @description Per-slot width query parameters, keyed by slot: poster (poster_url), backdrop (backdrop_url, backdrop_urls), logo (logo_url), still (an episode's still_url), photo (cast and crew photo_url). Each takes the width in device pixels the client draws that field at and overrides param for it; the server returns the narrowest cached size at least that wide, else the original. Accepted wherever param is */
+      slot_width_params: {
+        [key: string]: string;
+      };
       /**
        * @description Support and configuration state, not health
        * @enum {string}
@@ -24415,6 +24766,8 @@ export interface components {
       /** Format: int64 */
       embeddings_imported: number;
       /** Format: int64 */
+      embeddings_skipped: number;
+      /** Format: int64 */
       episodes_created: number;
       /** Format: int64 */
       episodes_updated: number;
@@ -24633,6 +24986,11 @@ export interface components {
     LibraryCapabilities: {
       /** @description Whether the current principal may use the capability */
       allowed: boolean;
+      /**
+       * @description This build supports marking unmatched items as intentionally unmatched with ignoreUnmatchedItem, and listing them with listUnmatchedItems' ignored filter
+       * @example true
+       */
+      ignore_unmatched: boolean;
       /**
        * @description This build supports real-time library monitoring and its status read
        * @example true
@@ -26127,7 +26485,7 @@ export interface components {
       /** @description Whether the current principal may use the capability */
       allowed: boolean;
       /**
-       * @description Viewer-triggered translation mode: off, button (the detail page offers the action), or auto (the server queues it on view)
+       * @description Viewer-triggered translation mode: off, button (the detail page offers the action), or auto (the client requests the translation itself when it shows an item whose pending_translation_language is set)
        * @example button
        */
       on_view: string;
@@ -26266,6 +26624,7 @@ export interface components {
       fields_done: number;
       /** Format: int64 */
       fields_total: number;
+      /** @description The job also replaces earlier AI text; provider and manual text is never replaced */
       force: boolean;
       /**
        * @description Opaque identifier
@@ -26283,7 +26642,7 @@ export interface components {
       source_language: string;
       /** @description pending, running, completed, failed, or canceled */
       status: string;
-      /** @description item, season, or episode */
+      /** @description item, season, episode, or library (a prewarm, whose fields_done and fields_total count items) */
       target_kind: string;
       target_language: string;
       /**
@@ -26470,6 +26829,7 @@ export interface components {
       in_app: components["schemas"]["NotificationInAppCapability"];
       /** @description Opaque revision of this document */
       revision: string;
+      series: components["schemas"]["NotificationSeriesCapability"];
       /**
        * @description Support and configuration state, not health
        * @enum {string}
@@ -26558,6 +26918,18 @@ export interface components {
        */
       verification_id: string;
     };
+    NotificationEpisodeRef: {
+      /**
+       * Format: int64
+       * @example 9
+       */
+      episode_number: number;
+      /**
+       * Format: int64
+       * @example 2
+       */
+      season_number: number;
+    };
     NotificationInAppCapability: {
       enabled: boolean;
     };
@@ -26598,8 +26970,10 @@ export interface components {
        * @description RFC 3339 instant in UTC with millisecond precision, or null
        */
       read_at: string | null;
-      /** @description A JSON value whose shape is the setting's value_schema in the settings contract. */
-      reason_flags: unknown;
+      /** @description Event-specific reason data. Its keys depend on the notification type; clients ignore keys they do not recognize. */
+      reason_flags: {
+        [key: string]: unknown;
+      };
       /** Format: int64 */
       season_number?: number;
       /**
@@ -26677,6 +27051,42 @@ export interface components {
       relay_request_id?: string;
       relay_url: string;
     };
+    NotificationSeries: {
+      /** @description The reasons the profile's notification preferences let notify; all false when they silence the series */
+      active_reasons: components["schemas"]["NotificationSeriesReasons"];
+      /** @description The series as a catalog card */
+      item: components["schemas"]["CatalogItem"];
+      /** @description The profile muted the series: it gets no new-episode notification for it, whatever the reasons, until it unmutes. active_reasons still names the reasons that would notify once unmuted. */
+      muted: boolean;
+      /** @description With an active Next Up reason, the last episode the profile finished: on that reason alone, only a new episode after it notifies */
+      next_up_after?: components["schemas"]["NotificationEpisodeRef"];
+      /** @description True when at least one reason is active and the profile has not muted the series */
+      notifies: boolean;
+      /** @description The profile's relationships to the series */
+      reasons: components["schemas"]["NotificationSeriesReasons"];
+    };
+    NotificationSeriesCapability: {
+      /** @description GET /notifications/series lists the series whose new episodes can notify the profile */
+      available: boolean;
+      /** @description PUT and DELETE /notifications/series/{series_id}/mute mute and unmute one series, and list entries carry muted */
+      mute: boolean;
+    };
+    NotificationSeriesCollection: {
+      /** @description The page's items; empty, never null */
+      items: components["schemas"]["NotificationSeries"][];
+      /** @description Cursor state; absent for bounded unpaginated collections */
+      page?: components["schemas"]["PageInfo"];
+    };
+    NotificationSeriesReasons: {
+      /** @description The profile is partway through the series */
+      continue_watching: boolean;
+      /** @description The series is one of the profile's favorites */
+      favorite: boolean;
+      /** @description The profile finished an episode and waits for the next */
+      next_up: boolean;
+      /** @description The series is on the profile's watchlist */
+      watchlist: boolean;
+    };
     NotificationServerChannel: {
       /** Format: int64 */
       consecutive_failures: number;
@@ -26858,6 +27268,36 @@ export interface components {
     NotificationWebPushUnsubscribeInputBody: {
       endpoint: string;
     };
+    NotInterestedCapability: {
+      /** @description Whether the current principal may use the capability */
+      allowed: boolean;
+      /** @description Opaque revision of this document */
+      revision: string;
+      /**
+       * @description Support and configuration state, not health
+       * @enum {string}
+       */
+      state: "available" | "disabled" | "not_configured" | "unsupported";
+    };
+    NotInterestedCollection: {
+      /** @description The page's items; empty, never null */
+      items: components["schemas"]["CatalogItem"][];
+      /** @description Cursor state; absent for bounded unpaginated collections */
+      page?: components["schemas"]["PageInfo"];
+    };
+    NotInterestedEntry: {
+      /**
+       * @description The movie or series
+       * @example movie:heat-1995
+       */
+      item_id: string;
+      /**
+       * Format: date-time
+       * @description When the profile marked it
+       * @example 2026-01-02T03:04:05.000Z
+       */
+      marked_at: string;
+    };
     OAuthCompletion: {
       /**
        * @description Bearer access token
@@ -27195,7 +27635,7 @@ export interface components {
     };
     PersonalCollection: {
       /**
-       * @description manual, smart, or an import source (mdblist, tmdb, trakt)
+       * @description manual, smart, or an import source (mdblist, tmdb)
        * @example manual
        */
       collection_type: string;
@@ -27546,6 +27986,7 @@ export interface components {
     };
     PlaybackPlan: {
       applied_quirks: components["schemas"]["AppliedQuirkV3"][];
+      /** @description Fixed quality rungs a quality_change replan may request, in menu order. The source is not listed: quality_preference auto returns to it. Empty when no rung applies. */
       available_qualities: components["schemas"]["AvailableQualityV3"][];
       claims: components["schemas"]["ValidationClaimsV3"];
       decision_reason: string;
@@ -27626,7 +28067,10 @@ export interface components {
       attempted_plan_keys: string[];
       /** Format: int64 */
       bandwidth_cap_kbps?: number;
-      /** Format: int64 */
+      /**
+       * Format: int64
+       * @description Measured throughput to this server, such as a bandwidth probe result. auto sends a source whose bitrate fits 80% of it as-is and lowers only one that does not. Omit it rather than send a guess.
+       */
       bandwidth_estimate_kbps?: number;
       client_capabilities: components["schemas"]["ClientCodecCapabilitiesV3"];
       client_features?: string[];
@@ -27639,7 +28083,11 @@ export interface components {
        */
       installation_id: string;
       local_mutations?: string[];
-      metered: boolean;
+      /**
+       * @deprecated
+       * @description Deprecated; ignored. A client on a metered link sends its cellular quality as quality_preference and bandwidth_cap_kbps instead.
+       */
+      metered?: boolean;
       /** @enum {string} */
       operation?:
         | "failure_recovery"
@@ -27655,6 +28103,7 @@ export interface components {
       position_seconds: number;
       /** Format: int64 */
       protocol_version: number;
+      /** @description auto (the default), a resolution such as 1080p, or a rung label from available_qualities. auto plays the source unless the device cannot, a measured bandwidth_estimate_kbps cannot carry it, or it is above bandwidth_cap_kbps. original is a deprecated alias of auto. */
       quality_preference: string;
       /** @description Client-minted identity of this replan; a retry with the same body replays the durable decision */
       replan_request_id: string;
@@ -28080,7 +28529,10 @@ export interface components {
       audio_track_index?: number;
       /** Format: int64 */
       bandwidth_cap_kbps?: number;
-      /** Format: int64 */
+      /**
+       * Format: int64
+       * @description Measured throughput to this server, such as a bandwidth probe result. auto sends a source whose bitrate fits 80% of it as-is and lowers only one that does not. Omit it rather than send a guess.
+       */
       bandwidth_estimate_kbps?: number;
       client_capabilities: components["schemas"]["ClientCodecCapabilitiesV3"];
       client_features: string[];
@@ -28095,7 +28547,11 @@ export interface components {
        * @example 1
        */
       installation_id: string;
-      metered: boolean;
+      /**
+       * @deprecated
+       * @description Deprecated; ignored. A client on a metered link sends its cellular quality as quality_preference and bandwidth_cap_kbps instead.
+       */
+      metered?: boolean;
       playback_attempt_id: string;
       /**
        * @description Opaque identifier
@@ -28106,6 +28562,7 @@ export interface components {
       progress_persistence?: "server" | "client";
       /** Format: int64 */
       protocol_version: number;
+      /** @description auto (the default), a resolution such as 1080p, or a rung label from available_qualities. auto plays the source unless the device cannot, a measured bandwidth_estimate_kbps cannot carry it, or it is above bandwidth_cap_kbps. original is a deprecated alias of auto. */
       quality_preference: string;
       /** Format: double */
       start_position?: number;
@@ -28408,6 +28865,12 @@ export interface components {
        * @example
        */
       max_playback_quality: string;
+      /**
+       * Format: int64
+       * @description Household profile limit
+       * @example 5
+       */
+      max_profiles: number;
       /**
        * Format: int64
        * @description Remote per-stream bitrate limit in kbps; 0 means unlimited
@@ -28570,7 +29033,7 @@ export interface components {
        */
       preferred_metadata_language: string;
       /**
-       * @description Free-form until the vocabulary is ratified (#135). Canonical values today: auto, original, 720p, 1080p, 2160p, 4k; empty when unset
+       * @description Free-form until the vocabulary is ratified (#135). Canonical values today: auto, 720p, 1080p, 2160p, 4k; original is a deprecated alias of auto; empty when unset
        * @example auto
        */
       quality_preference: string;
@@ -28690,7 +29153,7 @@ export interface components {
        */
       preferred_metadata_language?: string;
       /**
-       * @description Free-form until the vocabulary is ratified (#135); v1 never validated it. Canonical values today: auto, original, 720p, 1080p, 2160p, 4k
+       * @description Free-form until the vocabulary is ratified (#135); v1 never validated it. Canonical values today: auto, 720p, 1080p, 2160p, 4k; original is a deprecated alias of auto
        * @example auto
        */
       quality_preference?: string;
@@ -28850,7 +29313,7 @@ export interface components {
        */
       preferred_metadata_language?: string | null;
       /**
-       * @description Free-form until the vocabulary is ratified (#135); v1 never validated it. Canonical values today: auto, original, 720p, 1080p, 2160p, 4k
+       * @description Free-form until the vocabulary is ratified (#135); v1 never validated it. Canonical values today: auto, 720p, 1080p, 2160p, 4k; original is a deprecated alias of auto
        * @example auto
        */
       quality_preference?: string;
@@ -28916,6 +29379,22 @@ export interface components {
        */
       state: "available" | "disabled" | "not_configured" | "unsupported";
     };
+    ProgressCapabilities: {
+      /** @description Whether the current principal may use the capability */
+      allowed: boolean;
+      /**
+       * @description Whether clearResumePosition is served: it clears a movie or episode's resume position and keeps its watched state and watch history
+       * @example true
+       */
+      clear_resume_position: boolean;
+      /** @description Opaque revision of this document */
+      revision: string;
+      /**
+       * @description Support and configuration state, not health
+       * @enum {string}
+       */
+      state: "available" | "disabled" | "not_configured" | "unsupported";
+    };
     ProgressCollection: {
       /** @description The page's items; empty, never null */
       items: components["schemas"]["ProgressEntry"][];
@@ -29814,6 +30293,8 @@ export interface components {
       /** Format: int64 */
       episode_count: number;
       is_specials?: boolean;
+      /** @description Localized fields whose text was machine-translated by AI; absent when none were */
+      machine_translated_fields?: "overview"[];
       overview?: string;
       /** @description The episode to play next */
       play_content_id?: string;
@@ -29826,6 +30307,65 @@ export interface components {
       title: string;
       user_data?: components["schemas"]["WatchRollup"];
     };
+    SeasonalTheme: {
+      /** @description Whether a row may set its own yearly window for this holiday in theme_dates. False for weekly themes. */
+      dates_editable: boolean;
+      /**
+       * @description Last day of the default window, MM-DD, inclusive; before start when the window wraps across New Year
+       * @example 10-31
+       */
+      end?: string;
+      /**
+       * @description Stored in the row's enabled_themes config; stable
+       * @example halloween
+       */
+      key: string;
+      /** @example Halloween */
+      name: string;
+      /**
+       * @description First day of the default window, MM-DD. Absent when the holiday moves (Easter) or recurs weekly.
+       * @example 10-01
+       */
+      start?: string;
+      /** @description The first vibe is the default; never empty */
+      vibes: components["schemas"]["SeasonalVibe"][];
+      /**
+       * @description When the holiday is in season by default, for display
+       * @example October
+       */
+      when: string;
+    };
+    SeasonalThemeCatalog: {
+      /**
+       * Format: int64
+       * @description The most custom holidays one row may define
+       * @example 12
+       */
+      max_custom_holidays: number;
+      /** @description In calendar order, for display: dated holidays by their usual start, then the weekly ones */
+      themes: components["schemas"]["SeasonalTheme"][];
+    };
+    SeasonalVibe: {
+      /** @example Spooky fun for all ages. */
+      description: string;
+      /**
+       * @description Stored in the row's vibes config; stable
+       * @example family
+       */
+      key: string;
+      /**
+       * @description The MDBList list behind the vibe
+       * @example https://mdblist.com/lists/purple_smurf/halloween-family2
+       */
+      list_url: string;
+      /** @example Family Halloween */
+      name: string;
+      /**
+       * @description The row's title while this vibe is in season, unless the row sets its own
+       * @example Family Halloween
+       */
+      title: string;
+    };
     SeasonCollection: {
       /** @description The page's items; empty, never null */
       items: components["schemas"]["Season"][];
@@ -30150,6 +30690,8 @@ export interface components {
         | components["schemas"]["ServerEndpointPublic"]
         | components["schemas"]["ServerEndpointProvider"]
       )[];
+      /** @description How to reach the API server directly on the local network; absent on a server whose API port does not answer TLS. */
+      local_route?: components["schemas"]["ServerLocalRoute"];
       /** @description Opaque revision of this document */
       revision: string;
       /** @description The same identity getServerIdentity reports */
@@ -30200,6 +30742,18 @@ export interface components {
        */
       server_id: string;
     };
+    ServerLocalRoute: {
+      /**
+       * @description Base64 SHA-256 of the SubjectPublicKeyInfo of the certificate the API listener presents over TLS on its own port. A client accepts a local-network address only when TLS there presents this key, and learns it only over an address it already trusts. Derived from SECRET_KEY, so it changes when that key is rotated.
+       * @example n4bQgYhMfWWaL+qgxVrQFaO/TxsrC4Is0V1sFbDwCgg=
+       */
+      spki_sha256: string;
+      /**
+       * @description server.local_url: scheme://host[:port] of the API server on the local network, when an admin set one. Clients connect with https on the same host and port, whatever the scheme says, and require the pinned key. Absent when unset; clients may still find local addresses through LAN discovery.
+       * @example http://192.168.1.20:8080
+       */
+      url?: string;
+    };
     SettingConstraint: {
       /**
        * @description How the policy narrows the value; one of the settings contract's constraint kinds
@@ -30292,6 +30846,11 @@ export interface components {
        * @example true
        */
       supports_batched_effective: boolean;
+      /**
+       * @description Whether updateDevice can give a device a custom name, which listDevices returns as custom_name
+       * @example true
+       */
+      supports_device_rename: boolean;
       /**
        * @description Whether repeating a value write converges on the same state
        * @example true
@@ -30813,6 +31372,7 @@ export interface components {
     SubtitleDecisionV3: {
       artifact?: components["schemas"]["SubtitleArtifactV3"];
       embedded?: components["schemas"]["EmbeddedSubtitleV3"];
+      hls_rendition?: components["schemas"]["HLSSubtitleRenditionV3"];
       inventory: components["schemas"]["SubtitleInventoryItemV3"][];
       mode: string;
       track_id?: string;
@@ -31246,10 +31806,6 @@ export interface components {
        */
       container: string;
     };
-    ThemeOverrides: {
-      raw_css: string;
-      vars: string;
-    };
     ThemePlayback: {
       /**
        * @description Media type of the audio at url
@@ -31516,61 +32072,6 @@ export interface components {
       /** @description Item types the action applies to; empty when not configured */
       supported_types: string[];
     };
-    TraktCollectionImport: {
-      /** @example  */
-      description?: string;
-      /** @description Display filter fragment */
-      display_query_definition?: unknown;
-      /**
-       * @description Show the collection to every profile on the login; defaults to false
-       * @example false
-       */
-      is_shared?: boolean;
-      /**
-       * @description Libraries the sync matches against, limited to the libraries the collection's owner can access; every library the owner can access when omitted
-       * @example [
-       *       "1"
-       *     ]
-       */
-      library_ids?: string[];
-      /**
-       * Format: int64
-       * @description Cap on synced items; the server's own maximum applies when omitted
-       * @example 50
-       */
-      limit?: number;
-      /**
-       * @description movie or show; the preset's default when omitted
-       * @example movie
-       */
-      media_type?: string;
-      /**
-       * @description A bundled template poster path or an image URL
-       * @example
-       */
-      poster_url?: string;
-      /**
-       * @description A Trakt preset name
-       * @example trending
-       */
-      preset: string;
-      /** @description Default sort document */
-      sort_config?: unknown;
-      /**
-       * @description Sync cadence name; the server default when omitted
-       * @example daily
-       */
-      sync_schedule?: string;
-      /**
-       * @description The new collection's name; trimmed
-       * @example Trending movies
-       */
-      title: string;
-    };
-    TraktSpec: {
-      media_type: string;
-      preset: string;
-    };
     TransformationV3: {
       executor: string;
       name: string;
@@ -31579,7 +32080,7 @@ export interface components {
     };
     TranslateDescription: {
       /**
-       * @description BCP 47 tag of the wanted language, as the detail document's pending_translation_language reported it
+       * @description BCP 47 tag of the wanted language, exactly as this profile's detail document reported it in pending_translation_language. Any other language, or a target with nothing left to translate, is refused with 422 at body.target_language.
        * @example de
        */
       target_language: string;
@@ -31589,6 +32090,11 @@ export interface components {
       content_id: string;
       /** @example movie */
       content_type: string;
+      /**
+       * Format: date-time
+       * @description When an admin marked the item as intentionally unmatched; absent unless it is ignored
+       */
+      ignored_at?: string;
       /**
        * @description "0" when the item is in no library
        * @example 1
@@ -31824,6 +32330,9 @@ export interface components {
       title: string;
     };
     WatchDetail: {
+      backdrop_thumbhash?: string;
+      /** @description The item's backdrop, an episode's series backdrop, or an extra's parent backdrop, sized by image_size */
+      backdrop_url?: string;
       /** @example movie:heat-1995 */
       content_id: string;
       credits?: components["schemas"]["WatchMarker"];
@@ -31844,6 +32353,9 @@ export interface components {
       overview?: string;
       /** @description Logical watch choices, each spanning one or more ordered parts */
       playback_variants?: components["schemas"]["WatchPlaybackVariant"][];
+      poster_thumbhash?: string;
+      /** @description The item's poster, an episode's still, or an extra's parent poster, sized by image_size; for system media controls */
+      poster_url?: string;
       preview?: components["schemas"]["WatchMarker"];
       recap?: components["schemas"]["WatchMarker"];
       /** Format: int64 */
@@ -32743,6 +33255,8 @@ export interface components {
       last_air_date?: string;
       /** @description Presigned, short-lived */
       logo_url?: string;
+      /** @description Localized fields whose text was machine-translated by AI rather than supplied by a metadata provider or a person; absent when none were. Set only on item details, the cards built from them (shuffles, the Watch Together picker), and Home and library section cards. A card shows no tagline, so a card's overview label depends on overview alone. */
+      machine_translated_fields?: ("overview" | "tagline")[];
       /** Format: int64 */
       manga_chapter_count?: number;
       /** Format: int64 */
@@ -32753,6 +33267,8 @@ export interface components {
       /** @description Technical badges of the best file */
       overlay_summary?: components["schemas"]["CatalogItemOverlay"];
       overview?: string;
+      /** @description The language this profile reads here when the descriptions this item's page shows are not available in it yet. That is the profile's metadata language after its per-language exceptions, or, when it sets none, the library's for a library's rows or a detail opened in that library. It is pending for the item's own overview, or for a season its overview or any of its episodes' overviews. Echo it to translateCatalogItemDescription to translate on view. Set only on item details, the cards built from them (shuffles, the Watch Together picker), and Home and library section cards; other listings never carry it, so its absence there says nothing about the language. */
+      pending_translation_language?: string;
       /** @description The item to play when the card is a series or season; absent when the item plays itself */
       play_content_id?: string;
       /**
@@ -32910,6 +33426,8 @@ export interface components {
       last_air_date?: string;
       /** @description Presigned, short-lived */
       logo_url?: string;
+      /** @description Localized fields whose text was machine-translated by AI rather than supplied by a metadata provider or a person; absent when none were. Set only on item details, the cards built from them (shuffles, the Watch Together picker), and Home and library section cards. A card shows no tagline, so a card's overview label depends on overview alone. */
+      machine_translated_fields?: ("overview" | "tagline")[];
       /** Format: int64 */
       manga_chapter_count?: number;
       /** Format: int64 */
@@ -32920,6 +33438,8 @@ export interface components {
       /** @description Technical badges of the best file */
       overlay_summary?: components["schemas"]["CatalogItemOverlay"];
       overview?: string;
+      /** @description The language this profile reads here when the descriptions this item's page shows are not available in it yet. That is the profile's metadata language after its per-language exceptions, or, when it sets none, the library's for a library's rows or a detail opened in that library. It is pending for the item's own overview, or for a season its overview or any of its episodes' overviews. Echo it to translateCatalogItemDescription to translate on view. Set only on item details, the cards built from them (shuffles, the Watch Together picker), and Home and library section cards; other listings never carry it, so its absence there says nothing about the language. */
+      pending_translation_language?: string;
       /** @description The item to play when the card is a series or season; absent when the item plays itself */
       play_content_id?: string;
       /**
@@ -43818,144 +44338,6 @@ export interface operations {
       };
     };
   };
-  importAdminTrakt: {
-    parameters: {
-      query?: never;
-      header?: {
-        /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
-        "X-Profile-Id"?: string;
-        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
-        "X-Profile-Token"?: string;
-      };
-      path?: never;
-      cookie?: never;
-    };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["AdminTraktImport"];
-      };
-    };
-    responses: {
-      /** @description Created */
-      201: {
-        headers: {
-          Location?: string;
-          [name: string]: unknown;
-        };
-        content: {
-          "application/json": components["schemas"]["AdminCollectionImportResult"];
-        };
-      };
-      /** @description Bad Request */
-      400: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unauthorized */
-      401: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Forbidden */
-      403: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Not Found */
-      404: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Not Acceptable */
-      406: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unprocessable Entity */
-      422: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Too Many Requests */
-      429: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Internal Server Error */
-      500: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Service Unavailable */
-      503: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-    };
-  };
   getAdminCollectionOrder: {
     parameters: {
       query: {
@@ -55779,7 +56161,7 @@ export interface operations {
     };
     requestBody?: never;
     responses: {
-      /** @description The job was already canceled. */
+      /** @description The job is canceled: it was already canceled, or it was a queued image cache cleanup that this request canceled at once. */
       200: {
         headers: {
           [name: string]: unknown;
@@ -56548,7 +56930,7 @@ export interface operations {
       };
     };
   };
-  unlinkAdminLiteraryItem: {
+  translateLibraryMetadata: {
     parameters: {
       query?: never;
       header?: {
@@ -56558,19 +56940,26 @@ export interface operations {
         "X-Profile-Token"?: string;
       };
       path: {
-        content_id: string;
-        work_id: string;
+        /** @description The library */
+        library_id: string;
       };
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["AdminTranslateLibraryInputBody"];
+      };
+    };
     responses: {
-      /** @description No Content */
-      204: {
+      /** @description Accepted */
+      202: {
         headers: {
+          Location?: string;
           [name: string]: unknown;
         };
-        content?: never;
+        content: {
+          "application/json": components["schemas"]["MetadataTranslationJob"];
+        };
       };
       /** @description Bad Request */
       400: {
@@ -56617,91 +57006,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Unprocessable Entity */
-      422: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Too Many Requests */
-      429: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Internal Server Error */
-      500: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Service Unavailable */
-      503: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-    };
-  };
-  listAdminLiteraryCandidates: {
-    parameters: {
-      query?: {
-        limit?: number;
-      };
-      header?: {
-        /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
-        "X-Profile-Id"?: string;
-        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
-        "X-Profile-Token"?: string;
-      };
-      path: {
-        content_id: string;
-      };
-      cookie?: never;
-    };
-    requestBody?: never;
-    responses: {
-      /** @description OK */
-      200: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/json": components["schemas"]["AdminLiteraryCandidates"];
-        };
-      };
-      /** @description Bad Request */
-      400: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unauthorized */
-      401: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Forbidden */
-      403: {
+      /** @description Request Timeout */
+      408: {
         headers: {
           [name: string]: unknown;
         };
@@ -56709,8 +57015,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Not Found */
-      404: {
+      /** @description Request Entity Too Large */
+      413: {
         headers: {
           [name: string]: unknown;
         };
@@ -56718,8 +57024,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Not Acceptable */
-      406: {
+      /** @description Unsupported Media Type */
+      415: {
         headers: {
           [name: string]: unknown;
         };
@@ -56765,7 +57071,7 @@ export interface operations {
       };
     };
   };
-  linkAdminLiteraryItems: {
+  listLibraryMetadataTranslationJobs: {
     parameters: {
       query?: never;
       header?: {
@@ -56774,14 +57080,13 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
-      cookie?: never;
-    };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["AdminLiteraryLinkInputBody"];
+      path: {
+        /** @description The library */
+        library_id: string;
       };
+      cookie?: never;
     };
+    requestBody?: never;
     responses: {
       /** @description OK */
       200: {
@@ -56789,7 +57094,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminLiteraryLink"];
+          "application/json": components["schemas"]["AdminMetadataTranslationJobs"];
         };
       };
       /** @description Bad Request */
@@ -56837,33 +57142,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -56902,7 +57180,7 @@ export interface operations {
       };
     };
   };
-  confirmAdminLiteraryMatch: {
+  cancelLibraryMetadataTranslation: {
     parameters: {
       query?: never;
       header?: {
@@ -56911,23 +57189,22 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
-      cookie?: never;
-    };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["AdminLiteraryDecisionInputBody"];
+      path: {
+        /** @description Opaque identifier */
+        job_id: string;
+        /** @description The library */
+        library_id: string;
       };
+      cookie?: never;
     };
+    requestBody?: never;
     responses: {
-      /** @description OK */
-      200: {
+      /** @description No Content */
+      204: {
         headers: {
           [name: string]: unknown;
         };
-        content: {
-          "application/json": components["schemas"]["AdminLiteraryDecision"];
-        };
+        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -56974,8 +57251,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
+      /** @description Unprocessable Entity */
+      422: {
         headers: {
           [name: string]: unknown;
         };
@@ -56983,8 +57260,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Entity Too Large */
-      413: {
+      /** @description Too Many Requests */
+      429: {
         headers: {
           [name: string]: unknown;
         };
@@ -56992,8 +57269,88 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Unsupported Media Type */
-      415: {
+      /** @description Internal Server Error */
+      500: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Service Unavailable */
+      503: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+    };
+  };
+  unlinkAdminLiteraryItem: {
+    parameters: {
+      query?: never;
+      header?: {
+        /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
+        "X-Profile-Id"?: string;
+        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
+        "X-Profile-Token"?: string;
+      };
+      path: {
+        content_id: string;
+        work_id: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description No Content */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Bad Request */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unauthorized */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Forbidden */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Found */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Acceptable */
+      406: {
         headers: {
           [name: string]: unknown;
         };
@@ -57039,23 +57396,23 @@ export interface operations {
       };
     };
   };
-  ignoreAdminLiteraryMatch: {
+  listAdminLiteraryCandidates: {
     parameters: {
-      query?: never;
+      query?: {
+        limit?: number;
+      };
       header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
-      cookie?: never;
-    };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["AdminLiteraryDecisionInputBody"];
+      path: {
+        content_id: string;
       };
+      cookie?: never;
     };
+    requestBody?: never;
     responses: {
       /** @description OK */
       200: {
@@ -57063,7 +57420,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminLiteraryDecision"];
+          "application/json": components["schemas"]["AdminLiteraryCandidates"];
         };
       };
       /** @description Bad Request */
@@ -57111,33 +57468,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -57176,7 +57506,7 @@ export interface operations {
       };
     };
   };
-  updateAdminLiveTVChannel: {
+  linkAdminLiteraryItems: {
     parameters: {
       query?: never;
       header?: {
@@ -57185,15 +57515,12 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        /** @description Opaque identifier */
-        channel_id: string;
-      };
+      path?: never;
       cookie?: never;
     };
     requestBody: {
       content: {
-        "application/json": components["schemas"]["LiveTVChannelUpdate"];
+        "application/json": components["schemas"]["AdminLiteraryLinkInputBody"];
       };
     };
     responses: {
@@ -57203,7 +57530,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["LiveTVChannel"];
+          "application/json": components["schemas"]["AdminLiteraryLink"];
         };
       };
       /** @description Bad Request */
@@ -57260,15 +57587,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Conflict */
-      409: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Request Entity Too Large */
       413: {
         headers: {
@@ -57314,15 +57632,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Not Implemented */
-      501: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Service Unavailable */
       503: {
         headers: {
@@ -57334,7 +57643,7 @@ export interface operations {
       };
     };
   };
-  listAdminLiveTVGuideSources: {
+  confirmAdminLiteraryMatch: {
     parameters: {
       query?: never;
       header?: {
@@ -57346,7 +57655,11 @@ export interface operations {
       path?: never;
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["AdminLiteraryDecisionInputBody"];
+      };
+    };
     responses: {
       /** @description OK */
       200: {
@@ -57354,7 +57667,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["CollectionLiveTVGuideSource"];
+          "application/json": components["schemas"]["AdminLiteraryDecision"];
         };
       };
       /** @description Bad Request */
@@ -57402,8 +57715,26 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Conflict */
-      409: {
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Request Entity Too Large */
+      413: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unsupported Media Type */
+      415: {
         headers: {
           [name: string]: unknown;
         };
@@ -57449,7 +57780,7 @@ export interface operations {
       };
     };
   };
-  createAdminLiveTVGuideSource: {
+  ignoreAdminLiteraryMatch: {
     parameters: {
       query?: never;
       header?: {
@@ -57463,17 +57794,17 @@ export interface operations {
     };
     requestBody: {
       content: {
-        "application/json": components["schemas"]["LiveTVGuideSourceBody"];
+        "application/json": components["schemas"]["AdminLiteraryDecisionInputBody"];
       };
     };
     responses: {
-      /** @description Created */
-      201: {
+      /** @description OK */
+      200: {
         headers: {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["LiveTVGuideSource"];
+          "application/json": components["schemas"]["AdminLiteraryDecision"];
         };
       };
       /** @description Bad Request */
@@ -57530,15 +57861,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Conflict */
-      409: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Request Entity Too Large */
       413: {
         headers: {
@@ -57584,15 +57906,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Not Implemented */
-      501: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Service Unavailable */
       503: {
         headers: {
@@ -57604,7 +57917,7 @@ export interface operations {
       };
     };
   };
-  deleteAdminLiveTVGuideSource: {
+  updateAdminLiveTVChannel: {
     parameters: {
       query?: never;
       header?: {
@@ -57615,18 +57928,24 @@ export interface operations {
       };
       path: {
         /** @description Opaque identifier */
-        source_id: string;
+        channel_id: string;
       };
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["LiveTVChannelUpdate"];
+      };
+    };
     responses: {
-      /** @description No Content */
-      204: {
+      /** @description OK */
+      200: {
         headers: {
           [name: string]: unknown;
         };
-        content?: never;
+        content: {
+          "application/json": components["schemas"]["LiveTVChannel"];
+        };
       };
       /** @description Bad Request */
       400: {
@@ -57673,6 +57992,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Conflict */
       409: {
         headers: {
@@ -57682,6 +58010,24 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Request Entity Too Large */
+      413: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unsupported Media Type */
+      415: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -57729,7 +58075,7 @@ export interface operations {
       };
     };
   };
-  updateAdminLiveTVGuideSource: {
+  listAdminLiveTVGuideSources: {
     parameters: {
       query?: never;
       header?: {
@@ -57738,17 +58084,10 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        /** @description Opaque identifier */
-        source_id: string;
-      };
+      path?: never;
       cookie?: never;
     };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["LiveTVGuideSourceUpdate"];
-      };
-    };
+    requestBody?: never;
     responses: {
       /** @description OK */
       200: {
@@ -57756,7 +58095,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["LiveTVGuideSource"];
+          "application/json": components["schemas"]["CollectionLiveTVGuideSource"];
         };
       };
       /** @description Bad Request */
@@ -57804,15 +58143,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Conflict */
       409: {
         headers: {
@@ -57822,24 +58152,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -57867,15 +58179,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Not Implemented */
-      501: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Service Unavailable */
       503: {
         headers: {
@@ -57887,7 +58190,7 @@ export interface operations {
       };
     };
   };
-  syncAdminLiveTVGuideSource: {
+  createAdminLiveTVGuideSource: {
     parameters: {
       query?: never;
       header?: {
@@ -57896,16 +58199,17 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        /** @description Opaque identifier */
-        source_id: string;
-      };
+      path?: never;
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["LiveTVGuideSourceBody"];
+      };
+    };
     responses: {
-      /** @description OK */
-      200: {
+      /** @description Created */
+      201: {
         headers: {
           [name: string]: unknown;
         };
@@ -57958,6 +58262,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Conflict */
       409: {
         headers: {
@@ -57967,6 +58280,24 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Request Entity Too Large */
+      413: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unsupported Media Type */
+      415: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -58014,7 +58345,7 @@ export interface operations {
       };
     };
   };
-  lookupAdminLiveTVSchedulesDirectLineups: {
+  deleteAdminLiveTVGuideSource: {
     parameters: {
       query?: never;
       header?: {
@@ -58023,23 +58354,20 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
-      cookie?: never;
-    };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["LiveTVSchedulesDirectLineupsBody"];
+      path: {
+        /** @description Opaque identifier */
+        source_id: string;
       };
+      cookie?: never;
     };
+    requestBody?: never;
     responses: {
-      /** @description OK */
-      200: {
+      /** @description No Content */
+      204: {
         headers: {
           [name: string]: unknown;
         };
-        content: {
-          "application/json": components["schemas"]["CollectionLiveTVLineup"];
-        };
+        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -58086,15 +58414,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Conflict */
       409: {
         headers: {
@@ -58104,24 +58423,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -58169,7 +58470,7 @@ export interface operations {
       };
     };
   };
-  listAdminLiveTVTuners: {
+  updateAdminLiveTVGuideSource: {
     parameters: {
       query?: never;
       header?: {
@@ -58178,10 +58479,17 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
+      path: {
+        /** @description Opaque identifier */
+        source_id: string;
+      };
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["LiveTVGuideSourceUpdate"];
+      };
+    };
     responses: {
       /** @description OK */
       200: {
@@ -58189,7 +58497,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["CollectionLiveTVTuner"];
+          "application/json": components["schemas"]["LiveTVGuideSource"];
         };
       };
       /** @description Bad Request */
@@ -58237,6 +58545,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Conflict */
       409: {
         headers: {
@@ -58246,6 +58563,24 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Request Entity Too Large */
+      413: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unsupported Media Type */
+      415: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -58273,6 +58608,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Not Implemented */
+      501: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Service Unavailable */
       503: {
         headers: {
@@ -58284,7 +58628,7 @@ export interface operations {
       };
     };
   };
-  addAdminLiveTVTuner: {
+  syncAdminLiveTVGuideSource: {
     parameters: {
       query?: never;
       header?: {
@@ -58293,22 +58637,21 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
-      cookie?: never;
-    };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["LiveTVTunerBody"];
+      path: {
+        /** @description Opaque identifier */
+        source_id: string;
       };
+      cookie?: never;
     };
+    requestBody?: never;
     responses: {
-      /** @description Created */
-      201: {
+      /** @description OK */
+      200: {
         headers: {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["LiveTVTuner"];
+          "application/json": components["schemas"]["LiveTVGuideSource"];
         };
       };
       /** @description Bad Request */
@@ -58356,15 +58699,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Conflict */
       409: {
         headers: {
@@ -58374,24 +58708,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -58439,7 +58755,7 @@ export interface operations {
       };
     };
   };
-  deleteAdminLiveTVTuner: {
+  lookupAdminLiveTVSchedulesDirectLineups: {
     parameters: {
       query?: never;
       header?: {
@@ -58448,20 +58764,23 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        /** @description Opaque identifier */
-        tuner_id: string;
-      };
+      path?: never;
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["LiveTVSchedulesDirectLineupsBody"];
+      };
+    };
     responses: {
-      /** @description No Content */
-      204: {
+      /** @description OK */
+      200: {
         headers: {
           [name: string]: unknown;
         };
-        content?: never;
+        content: {
+          "application/json": components["schemas"]["CollectionLiveTVLineup"];
+        };
       };
       /** @description Bad Request */
       400: {
@@ -58508,6 +58827,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Conflict */
       409: {
         headers: {
@@ -58517,6 +58845,24 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Request Entity Too Large */
+      413: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unsupported Media Type */
+      415: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -58564,7 +58910,7 @@ export interface operations {
       };
     };
   };
-  scanAdminLiveTVTuner: {
+  listAdminLiveTVTuners: {
     parameters: {
       query?: never;
       header?: {
@@ -58573,10 +58919,7 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        /** @description Opaque identifier */
-        tuner_id: string;
-      };
+      path?: never;
       cookie?: never;
     };
     requestBody?: never;
@@ -58587,7 +58930,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["LiveTVTuner"];
+          "application/json": components["schemas"]["CollectionLiveTVTuner"];
         };
       };
       /** @description Bad Request */
@@ -58671,15 +59014,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Not Implemented */
-      501: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Service Unavailable */
       503: {
         headers: {
@@ -58691,7 +59025,7 @@ export interface operations {
       };
     };
   };
-  discoverAdminLiveTVTuners: {
+  addAdminLiveTVTuner: {
     parameters: {
       query?: never;
       header?: {
@@ -58703,19 +59037,19 @@ export interface operations {
       path?: never;
       cookie?: never;
     };
-    requestBody?: {
+    requestBody: {
       content: {
-        "application/json": components["schemas"]["LiveTVTunerDiscoveryBody"];
+        "application/json": components["schemas"]["LiveTVTunerBody"];
       };
     };
     responses: {
-      /** @description OK */
-      200: {
+      /** @description Created */
+      201: {
         headers: {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["LiveTVTunerDiscovery"];
+          "application/json": components["schemas"]["LiveTVTuner"];
         };
       };
       /** @description Bad Request */
@@ -58846,7 +59180,132 @@ export interface operations {
       };
     };
   };
-  lookupAdminLiveTVXMLSyncLineups: {
+  deleteAdminLiveTVTuner: {
+    parameters: {
+      query?: never;
+      header?: {
+        /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
+        "X-Profile-Id"?: string;
+        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
+        "X-Profile-Token"?: string;
+      };
+      path: {
+        /** @description Opaque identifier */
+        tuner_id: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description No Content */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Bad Request */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unauthorized */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Forbidden */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Found */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Acceptable */
+      406: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Conflict */
+      409: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unprocessable Entity */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Too Many Requests */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Internal Server Error */
+      500: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Implemented */
+      501: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Service Unavailable */
+      503: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+    };
+  };
+  scanAdminLiveTVTuner: {
     parameters: {
       query?: never;
       header?: {
@@ -58855,14 +59314,13 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
-      cookie?: never;
-    };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["LiveTVXMLSyncLineupsBody"];
+      path: {
+        /** @description Opaque identifier */
+        tuner_id: string;
       };
+      cookie?: never;
     };
+    requestBody?: never;
     responses: {
       /** @description OK */
       200: {
@@ -58870,7 +59328,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["CollectionLiveTVLineup"];
+          "application/json": components["schemas"]["LiveTVTuner"];
         };
       };
       /** @description Bad Request */
@@ -58918,15 +59376,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Conflict */
       409: {
         headers: {
@@ -58936,24 +59385,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -59001,23 +59432,9 @@ export interface operations {
       };
     };
   };
-  listAdminOperationalLogs: {
+  discoverAdminLiveTVTuners: {
     parameters: {
-      query?: {
-        component?: string;
-        cursor?: string;
-        from?: string;
-        level?: string;
-        /** @description Page size; default 50, maximum 200 */
-        limit?: number;
-        node_id?: string;
-        playback_session_id?: string;
-        q?: string;
-        request_id?: string;
-        session_id?: string;
-        to?: string;
-        user_id?: string;
-      };
+      query?: never;
       header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
@@ -59027,7 +59444,11 @@ export interface operations {
       path?: never;
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody?: {
+      content: {
+        "application/json": components["schemas"]["LiveTVTunerDiscoveryBody"];
+      };
+    };
     responses: {
       /** @description OK */
       200: {
@@ -59035,7 +59456,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["CollectionAdminOperationalLog"];
+          "application/json": components["schemas"]["LiveTVTunerDiscovery"];
         };
       };
       /** @description Bad Request */
@@ -59083,6 +59504,42 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Conflict */
+      409: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Request Entity Too Large */
+      413: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unsupported Media Type */
+      415: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -59110,6 +59567,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Not Implemented */
+      501: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Service Unavailable */
       503: {
         headers: {
@@ -59121,27 +59587,9 @@ export interface operations {
       };
     };
   };
-  listAdminAuditLogs: {
+  lookupAdminLiveTVXMLSyncLineups: {
     parameters: {
-      query?: {
-        action?: string;
-        actor_user_id?: string;
-        client_ip?: string;
-        cursor?: string;
-        from?: string;
-        /** @description Page size; default 50, maximum 200 */
-        limit?: number;
-        method?: string;
-        path_prefix?: string;
-        playback_session_id?: string;
-        request_id?: string;
-        session_id?: string;
-        status_code?: string;
-        target_id?: string;
-        target_type?: string;
-        to?: string;
-        user_id?: string;
-      };
+      query?: never;
       header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
@@ -59151,7 +59599,11 @@ export interface operations {
       path?: never;
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["LiveTVXMLSyncLineupsBody"];
+      };
+    };
     responses: {
       /** @description OK */
       200: {
@@ -59159,7 +59611,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["CollectionAdminAuditLog"];
+          "application/json": components["schemas"]["CollectionLiveTVLineup"];
         };
       };
       /** @description Bad Request */
@@ -59207,8 +59659,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Unprocessable Entity */
-      422: {
+      /** @description Request Timeout */
+      408: {
         headers: {
           [name: string]: unknown;
         };
@@ -59216,8 +59668,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Too Many Requests */
-      429: {
+      /** @description Conflict */
+      409: {
         headers: {
           [name: string]: unknown;
         };
@@ -59225,8 +59677,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Internal Server Error */
-      500: {
+      /** @description Request Entity Too Large */
+      413: {
         headers: {
           [name: string]: unknown;
         };
@@ -59234,8 +59686,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Service Unavailable */
-      503: {
+      /** @description Unsupported Media Type */
+      415: {
         headers: {
           [name: string]: unknown;
         };
@@ -59243,121 +59695,70 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-    };
-  };
-  connectAdminLogsSocket: {
-    parameters: {
-      query: {
-        /** @description audit: domain action filter. */
-        action?: string;
-        /** @description audit: acting account, including an impersonator. */
-        actor_user_id?: string;
-        /** @description audit: client address or prefix filter. */
-        client_ip?: string;
-        /** @description app: component filter. */
-        component?: string;
-        /** @description Snapshot continuation from the matching list route. */
-        cursor?: string;
-        /** @description Inclusive lower time bound. */
-        from?: string;
-        /** @description app: comma-separated levels. */
-        level?: string;
-        /** @description Snapshot size, 1-200; the list route default applies when omitted. */
-        limit?: number;
-        /** @description audit: HTTP method filter. */
-        method?: string;
-        /** @description app: node filter. */
-        node_id?: string;
-        /** @description audit: path prefix filter. */
-        path_prefix?: string;
-        /** @description Playback session filter. */
-        playback_session_id?: string;
-        /** @description app: message text search. */
-        q?: string;
-        /** @description Request identifier filter. */
-        request_id?: string;
-        /** @description Login session filter. */
-        session_id?: string;
-        /** @description audit: status filter. */
-        status_code?: number;
-        /** @description Which log stream to snapshot and follow. */
-        stream: "app" | "audit";
-        /** @description audit: affected entity identifier. */
-        target_id?: string;
-        /** @description audit: affected entity type. */
-        target_type?: string;
-        /** @description Inclusive upper time bound. */
-        to?: string;
-        /** @description Account filter. */
-        user_id?: number;
-      };
-      header: {
-        /** @description Browser origin must match the configured public origin, the request origin, or a connected network access overlay origin. */
-        Origin?: string;
-        /** @description Offer prairie.admin-logs.v2 followed by prairie.ticket.<single-use-ticket>. */
-        "Sec-WebSocket-Protocol": string;
-      };
-      path?: never;
-      cookie?: never;
-    };
-    requestBody?: never;
-    responses: {
-      /** @description Administrator log stream established. */
-      101: {
+      /** @description Unprocessable Entity */
+      422: {
         headers: {
-          /** @description WebSocket handshake header. */
-          Connection?: string;
-          /** @description WebSocket handshake header. */
-          "Sec-WebSocket-Accept"?: string;
-          /** @description WebSocket handshake header. */
-          "Sec-WebSocket-Protocol"?: string;
-          /** @description WebSocket handshake header. */
-          Upgrade?: string;
           [name: string]: unknown;
         };
-        content?: never;
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
       };
-      /** @description Handshake refused. */
-      400: {
+      /** @description Too Many Requests */
+      429: {
         headers: {
           [name: string]: unknown;
         };
         content: {
-          "text/plain": string;
+          "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Handshake refused. */
-      401: {
+      /** @description Internal Server Error */
+      500: {
         headers: {
           [name: string]: unknown;
         };
         content: {
-          "text/plain": string;
+          "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Handshake refused. */
-      403: {
+      /** @description Not Implemented */
+      501: {
         headers: {
           [name: string]: unknown;
         };
         content: {
-          "text/plain": string;
+          "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Handshake refused. */
+      /** @description Service Unavailable */
       503: {
         headers: {
           [name: string]: unknown;
         };
         content: {
-          "text/plain": string;
+          "application/problem+json": components["schemas"]["Problem"];
         };
       };
     };
   };
-  createAdminLogsSocketTicket: {
+  listAdminOperationalLogs: {
     parameters: {
-      query?: never;
+      query?: {
+        component?: string;
+        cursor?: string;
+        from?: string;
+        level?: string;
+        /** @description Page size; default 50, maximum 200 */
+        limit?: number;
+        node_id?: string;
+        playback_session_id?: string;
+        q?: string;
+        request_id?: string;
+        session_id?: string;
+        to?: string;
+        user_id?: string;
+      };
       header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
@@ -59372,11 +59773,10 @@ export interface operations {
       /** @description OK */
       200: {
         headers: {
-          "Cache-Control"?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["EventsSocketTicket"];
+          "application/json": components["schemas"]["CollectionAdminOperationalLog"];
         };
       };
       /** @description Bad Request */
@@ -59462,13 +59862,28 @@ export interface operations {
       };
     };
   };
-  getAdminLogsSocketCapabilities: {
+  listAdminAuditLogs: {
     parameters: {
-      query?: never;
+      query?: {
+        action?: string;
+        actor_user_id?: string;
+        client_ip?: string;
+        cursor?: string;
+        from?: string;
+        /** @description Page size; default 50, maximum 200 */
+        limit?: number;
+        method?: string;
+        path_prefix?: string;
+        playback_session_id?: string;
+        request_id?: string;
+        session_id?: string;
+        status_code?: string;
+        target_id?: string;
+        target_type?: string;
+        to?: string;
+        user_id?: string;
+      };
       header?: {
-        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
-        "If-Match"?: string;
-        "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
@@ -59482,23 +59897,11 @@ export interface operations {
       /** @description OK */
       200: {
         headers: {
-          "Cache-Control"?: string;
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminLogsSocketCapabilitiesOutputBody"];
-        };
-      };
-      /** @description The representation named by If-None-Match is current; no body. */
-      304: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
+          "application/json": components["schemas"]["CollectionAdminAuditLog"];
         };
-        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -59545,17 +59948,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Failed */
-      412: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -59594,13 +59986,120 @@ export interface operations {
       };
     };
   };
-  getAdminMarkerCapabilities: {
+  connectAdminLogsSocket: {
+    parameters: {
+      query: {
+        /** @description audit: domain action filter. */
+        action?: string;
+        /** @description audit: acting account, including an impersonator. */
+        actor_user_id?: string;
+        /** @description audit: client address or prefix filter. */
+        client_ip?: string;
+        /** @description app: component filter. */
+        component?: string;
+        /** @description Snapshot continuation from the matching list route. */
+        cursor?: string;
+        /** @description Inclusive lower time bound. */
+        from?: string;
+        /** @description app: comma-separated levels. */
+        level?: string;
+        /** @description Snapshot size, 1-200; the list route default applies when omitted. */
+        limit?: number;
+        /** @description audit: HTTP method filter. */
+        method?: string;
+        /** @description app: node filter. */
+        node_id?: string;
+        /** @description audit: path prefix filter. */
+        path_prefix?: string;
+        /** @description Playback session filter. */
+        playback_session_id?: string;
+        /** @description app: message text search. */
+        q?: string;
+        /** @description Request identifier filter. */
+        request_id?: string;
+        /** @description Login session filter. */
+        session_id?: string;
+        /** @description audit: status filter. */
+        status_code?: number;
+        /** @description Which log stream to snapshot and follow. */
+        stream: "app" | "audit";
+        /** @description audit: affected entity identifier. */
+        target_id?: string;
+        /** @description audit: affected entity type. */
+        target_type?: string;
+        /** @description Inclusive upper time bound. */
+        to?: string;
+        /** @description Account filter. */
+        user_id?: number;
+      };
+      header: {
+        /** @description Browser origin must match the configured public origin, the request origin, or a connected network access overlay origin. */
+        Origin?: string;
+        /** @description Offer prairie.admin-logs.v2 followed by prairie.ticket.<single-use-ticket>. */
+        "Sec-WebSocket-Protocol": string;
+      };
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Administrator log stream established. */
+      101: {
+        headers: {
+          /** @description WebSocket handshake header. */
+          Connection?: string;
+          /** @description WebSocket handshake header. */
+          "Sec-WebSocket-Accept"?: string;
+          /** @description WebSocket handshake header. */
+          "Sec-WebSocket-Protocol"?: string;
+          /** @description WebSocket handshake header. */
+          Upgrade?: string;
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Handshake refused. */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "text/plain": string;
+        };
+      };
+      /** @description Handshake refused. */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "text/plain": string;
+        };
+      };
+      /** @description Handshake refused. */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "text/plain": string;
+        };
+      };
+      /** @description Handshake refused. */
+      503: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "text/plain": string;
+        };
+      };
+    };
+  };
+  createAdminLogsSocketTicket: {
     parameters: {
       query?: never;
       header?: {
-        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
-        "If-Match"?: string;
-        "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
@@ -59615,23 +60114,12 @@ export interface operations {
       200: {
         headers: {
           "Cache-Control"?: string;
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminMarkerCapabilities"];
+          "application/json": components["schemas"]["EventsSocketTicket"];
         };
       };
-      /** @description The representation named by If-None-Match is current; no body. */
-      304: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
-        };
-        content?: never;
-      };
       /** @description Bad Request */
       400: {
         headers: {
@@ -59677,17 +60165,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Failed */
-      412: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -59726,21 +60203,19 @@ export interface operations {
       };
     };
   };
-  listAdminFileMarkerHistory: {
+  getAdminLogsSocketCapabilities: {
     parameters: {
-      query?: {
-        limit?: number;
-      };
+      query?: never;
       header?: {
+        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
+        "If-Match"?: string;
+        "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        /** @description Opaque identifier */
-        fileId: string;
-      };
+      path?: never;
       cookie?: never;
     };
     requestBody?: never;
@@ -59748,12 +60223,24 @@ export interface operations {
       /** @description OK */
       200: {
         headers: {
+          "Cache-Control"?: string;
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminMarkerHistory"];
+          "application/json": components["schemas"]["AdminLogsSocketCapabilitiesOutputBody"];
         };
       };
+      /** @description The representation named by If-None-Match is current; no body. */
+      304: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
       /** @description Bad Request */
       400: {
         headers: {
@@ -59799,6 +60286,17 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Precondition Failed */
+      412: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -59837,12 +60335,13 @@ export interface operations {
       };
     };
   };
-  listAdminMarkerHistory: {
+  getAdminMarkerCapabilities: {
     parameters: {
-      query?: {
-        limit?: number;
-      };
+      query?: never;
       header?: {
+        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
+        "If-Match"?: string;
+        "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
@@ -59856,12 +60355,24 @@ export interface operations {
       /** @description OK */
       200: {
         headers: {
+          "Cache-Control"?: string;
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminMarkerHistory"];
+          "application/json": components["schemas"]["AdminMarkerCapabilities"];
         };
       };
+      /** @description The representation named by If-None-Match is current; no body. */
+      304: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
       /** @description Bad Request */
       400: {
         headers: {
@@ -59907,6 +60418,17 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Precondition Failed */
+      412: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -59945,7 +60467,7 @@ export interface operations {
       };
     };
   };
-  listAdminItemMarkerHistory: {
+  listAdminFileMarkerHistory: {
     parameters: {
       query?: {
         limit?: number;
@@ -59957,7 +60479,8 @@ export interface operations {
         "X-Profile-Token"?: string;
       };
       path: {
-        id: string;
+        /** @description Opaque identifier */
+        fileId: string;
       };
       cookie?: never;
     };
@@ -60055,9 +60578,11 @@ export interface operations {
       };
     };
   };
-  listAdminMarkerProviders: {
+  listAdminMarkerHistory: {
     parameters: {
-      query?: never;
+      query?: {
+        limit?: number;
+      };
       header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
@@ -60075,7 +60600,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminMarkerProviders"];
+          "application/json": components["schemas"]["AdminMarkerHistory"];
         };
       };
       /** @description Bad Request */
@@ -60161,9 +60686,11 @@ export interface operations {
       };
     };
   };
-  updateAdminMarkerProvider: {
+  listAdminItemMarkerHistory: {
     parameters: {
-      query?: never;
+      query?: {
+        limit?: number;
+      };
       header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
@@ -60171,15 +60698,11 @@ export interface operations {
         "X-Profile-Token"?: string;
       };
       path: {
-        provider: string;
+        id: string;
       };
       cookie?: never;
     };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["AdminMarkerProviderUpdate"];
-      };
-    };
+    requestBody?: never;
     responses: {
       /** @description OK */
       200: {
@@ -60187,7 +60710,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminMarkerProvider"];
+          "application/json": components["schemas"]["AdminMarkerHistory"];
         };
       };
       /** @description Bad Request */
@@ -60235,33 +60758,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -60300,7 +60796,7 @@ export interface operations {
       };
     };
   };
-  validateAdminMarkerProvider: {
+  listAdminMarkerProviders: {
     parameters: {
       query?: never;
       header?: {
@@ -60309,9 +60805,7 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        provider: string;
-      };
+      path?: never;
       cookie?: never;
     };
     requestBody?: never;
@@ -60322,7 +60816,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminMarkerProviderValidation"];
+          "application/json": components["schemas"]["AdminMarkerProviders"];
         };
       };
       /** @description Bad Request */
@@ -60408,7 +60902,7 @@ export interface operations {
       };
     };
   };
-  connectNetworkAccess: {
+  updateAdminMarkerProvider: {
     parameters: {
       query?: never;
       header?: {
@@ -60422,19 +60916,19 @@ export interface operations {
       };
       cookie?: never;
     };
-    requestBody?: {
+    requestBody: {
       content: {
-        "application/json": components["schemas"]["NetworkAccessCommand"];
+        "application/json": components["schemas"]["AdminMarkerProviderUpdate"];
       };
     };
     responses: {
-      /** @description Accepted */
-      202: {
+      /** @description OK */
+      200: {
         headers: {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["NetworkAccessStatus"];
+          "application/json": components["schemas"]["AdminMarkerProvider"];
         };
       };
       /** @description Bad Request */
@@ -60547,7 +61041,115 @@ export interface operations {
       };
     };
   };
-  disconnectNetworkAccess: {
+  validateAdminMarkerProvider: {
+    parameters: {
+      query?: never;
+      header?: {
+        /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
+        "X-Profile-Id"?: string;
+        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
+        "X-Profile-Token"?: string;
+      };
+      path: {
+        provider: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description OK */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/json": components["schemas"]["AdminMarkerProviderValidation"];
+        };
+      };
+      /** @description Bad Request */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unauthorized */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Forbidden */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Found */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Acceptable */
+      406: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unprocessable Entity */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Too Many Requests */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Internal Server Error */
+      500: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Service Unavailable */
+      503: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+    };
+  };
+  connectNetworkAccess: {
     parameters: {
       query?: never;
       header?: {
@@ -60686,7 +61288,7 @@ export interface operations {
       };
     };
   };
-  getAdminNetworkAccessStatus: {
+  disconnectNetworkAccess: {
     parameters: {
       query?: never;
       header?: {
@@ -60700,10 +61302,14 @@ export interface operations {
       };
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody?: {
+      content: {
+        "application/json": components["schemas"]["NetworkAccessCommand"];
+      };
+    };
     responses: {
-      /** @description OK */
-      200: {
+      /** @description Accepted */
+      202: {
         headers: {
           [name: string]: unknown;
         };
@@ -60756,6 +61362,33 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Request Entity Too Large */
+      413: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unsupported Media Type */
+      415: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -60794,22 +61427,18 @@ export interface operations {
       };
     };
   };
-  listAdminNodeSessions: {
+  getAdminNetworkAccessStatus: {
     parameters: {
-      query?: {
-        cursor?: string;
-        /** @description Page size; default 50, maximum 200 */
-        limit?: number;
-        /** @description Opaque identifier */
-        node_id?: string;
-      };
+      query?: never;
       header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
+      path: {
+        provider: string;
+      };
       cookie?: never;
     };
     requestBody?: never;
@@ -60820,7 +61449,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminNodeSessionsOutputBody"];
+          "application/json": components["schemas"]["NetworkAccessStatus"];
         };
       };
       /** @description Bad Request */
@@ -60906,12 +61535,14 @@ export interface operations {
       };
     };
   };
-  listAdminNodes: {
+  listAdminNodeSessions: {
     parameters: {
       query?: {
         cursor?: string;
         /** @description Page size; default 50, maximum 200 */
         limit?: number;
+        /** @description Opaque identifier */
+        node_id?: string;
       };
       header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
@@ -60930,7 +61561,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["CollectionAdminNode"];
+          "application/json": components["schemas"]["AdminNodeSessionsOutputBody"];
         };
       };
       /** @description Bad Request */
@@ -61016,9 +61647,13 @@ export interface operations {
       };
     };
   };
-  createAdminNode: {
+  listAdminNodes: {
     parameters: {
-      query?: never;
+      query?: {
+        cursor?: string;
+        /** @description Page size; default 50, maximum 200 */
+        limit?: number;
+      };
       header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
@@ -61028,20 +61663,15 @@ export interface operations {
       path?: never;
       cookie?: never;
     };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["AdminNodeCreateBody"];
-      };
-    };
+    requestBody?: never;
     responses: {
-      /** @description Created */
-      201: {
+      /** @description OK */
+      200: {
         headers: {
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminNode"];
+          "application/json": components["schemas"]["CollectionAdminNode"];
         };
       };
       /** @description Bad Request */
@@ -61089,42 +61719,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Conflict */
-      409: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -61163,34 +61757,27 @@ export interface operations {
       };
     };
   };
-  updateAdminNode: {
+  createAdminNode: {
     parameters: {
       query?: never;
-      header: {
-        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
-        "If-Match": string;
-        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
-        "If-None-Match"?: string;
+      header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        id: string;
-      };
+      path?: never;
       cookie?: never;
     };
     requestBody: {
       content: {
-        "application/json": components["schemas"]["AdminNodeUpdateBody"];
+        "application/json": components["schemas"]["AdminNodeCreateBody"];
       };
     };
     responses: {
-      /** @description OK */
-      200: {
+      /** @description Created */
+      201: {
         headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
           ETag?: string;
           [name: string]: unknown;
         };
@@ -61261,17 +61848,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Failed */
-      412: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Request Entity Too Large */
       413: {
         headers: {
@@ -61299,15 +61875,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Required */
-      428: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Too Many Requests */
       429: {
         headers: {
@@ -61337,7 +61904,7 @@ export interface operations {
       };
     };
   };
-  deleteAdminNode: {
+  updateAdminNode: {
     parameters: {
       query?: never;
       header: {
@@ -61355,14 +61922,22 @@ export interface operations {
       };
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["AdminNodeUpdateBody"];
+      };
+    };
     responses: {
-      /** @description No Content */
-      204: {
+      /** @description OK */
+      200: {
         headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
           [name: string]: unknown;
         };
-        content?: never;
+        content: {
+          "application/json": components["schemas"]["AdminNode"];
+        };
       };
       /** @description Bad Request */
       400: {
@@ -61409,55 +61984,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Failed */
-      412: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unprocessable Entity */
-      422: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Precondition Required */
-      428: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Too Many Requests */
-      429: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Internal Server Error */
-      500: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Service Unavailable */
-      503: {
+      /** @description Request Timeout */
+      408: {
         headers: {
           [name: string]: unknown;
         };
@@ -61465,35 +61993,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-    };
-  };
-  checkAdminNode: {
-    parameters: {
-      query?: never;
-      header?: {
-        /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
-        "X-Profile-Id"?: string;
-        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
-        "X-Profile-Token"?: string;
-      };
-      path: {
-        id: string;
-      };
-      cookie?: never;
-    };
-    requestBody?: never;
-    responses: {
-      /** @description OK */
-      200: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/json": components["schemas"]["AdminNodeHealth"];
-        };
-      };
-      /** @description Bad Request */
-      400: {
+      /** @description Conflict */
+      409: {
         headers: {
           [name: string]: unknown;
         };
@@ -61501,17 +62002,19 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Unauthorized */
-      401: {
+      /** @description Precondition Failed */
+      412: {
         headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
           [name: string]: unknown;
         };
         content: {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Forbidden */
-      403: {
+      /** @description Request Entity Too Large */
+      413: {
         headers: {
           [name: string]: unknown;
         };
@@ -61519,8 +62022,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Not Found */
-      404: {
+      /** @description Unsupported Media Type */
+      415: {
         headers: {
           [name: string]: unknown;
         };
@@ -61528,8 +62031,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Not Acceptable */
-      406: {
+      /** @description Unprocessable Entity */
+      422: {
         headers: {
           [name: string]: unknown;
         };
@@ -61537,8 +62040,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Unprocessable Entity */
-      422: {
+      /** @description Precondition Required */
+      428: {
         headers: {
           [name: string]: unknown;
         };
@@ -61575,10 +62078,14 @@ export interface operations {
       };
     };
   };
-  drainAdminNode: {
+  deleteAdminNode: {
     parameters: {
       query?: never;
-      header?: {
+      header: {
+        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
+        "If-Match": string;
+        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
+        "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
@@ -61591,14 +62098,12 @@ export interface operations {
     };
     requestBody?: never;
     responses: {
-      /** @description OK */
-      200: {
+      /** @description No Content */
+      204: {
         headers: {
           [name: string]: unknown;
         };
-        content: {
-          "application/json": components["schemas"]["AdminNodeDrain"];
-        };
+        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -61645,9 +62150,11 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Conflict */
-      409: {
+      /** @description Precondition Failed */
+      412: {
         headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
           [name: string]: unknown;
         };
         content: {
@@ -61663,6 +62170,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Precondition Required */
+      428: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Too Many Requests */
       429: {
         headers: {
@@ -61692,7 +62208,7 @@ export interface operations {
       };
     };
   };
-  forceReloadAdminNode: {
+  checkAdminNode: {
     parameters: {
       query?: never;
       header?: {
@@ -61714,7 +62230,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminNodeReloadOutputBody"];
+          "application/json": components["schemas"]["AdminNodeHealth"];
         };
       };
       /** @description Bad Request */
@@ -61800,7 +62316,7 @@ export interface operations {
       };
     };
   };
-  reprobeAdminNode: {
+  drainAdminNode: {
     parameters: {
       query?: never;
       header?: {
@@ -61822,7 +62338,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminNodeReprobe"];
+          "application/json": components["schemas"]["AdminNodeDrain"];
         };
       };
       /** @description Bad Request */
@@ -61870,6 +62386,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Conflict */
+      409: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -61908,7 +62433,7 @@ export interface operations {
       };
     };
   };
-  resumeAdminNode: {
+  forceReloadAdminNode: {
     parameters: {
       query?: never;
       header?: {
@@ -61930,7 +62455,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminNodeDrain"];
+          "application/json": components["schemas"]["AdminNodeReloadOutputBody"];
         };
       };
       /** @description Bad Request */
@@ -61978,15 +62503,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Conflict */
-      409: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -62025,19 +62541,18 @@ export interface operations {
       };
     };
   };
-  getAdminNodeCapabilities: {
+  reprobeAdminNode: {
     parameters: {
       query?: never;
       header?: {
-        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
-        "If-Match"?: string;
-        "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
+      path: {
+        id: string;
+      };
       cookie?: never;
     };
     requestBody?: never;
@@ -62045,23 +62560,11 @@ export interface operations {
       /** @description OK */
       200: {
         headers: {
-          "Cache-Control"?: string;
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminNodeCapabilities"];
-        };
-      };
-      /** @description The representation named by If-None-Match is current; no body. */
-      304: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
+          "application/json": components["schemas"]["AdminNodeReprobe"];
         };
-        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -62108,17 +62611,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Failed */
-      412: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -62157,7 +62649,7 @@ export interface operations {
       };
     };
   };
-  forceReloadAdminNodes: {
+  resumeAdminNode: {
     parameters: {
       query?: never;
       header?: {
@@ -62166,7 +62658,9 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
+      path: {
+        id: string;
+      };
       cookie?: never;
     };
     requestBody?: never;
@@ -62177,7 +62671,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminNodeReloadOutputBody"];
+          "application/json": components["schemas"]["AdminNodeDrain"];
         };
       };
       /** @description Bad Request */
@@ -62225,105 +62719,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Unprocessable Entity */
-      422: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Too Many Requests */
-      429: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Internal Server Error */
-      500: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Service Unavailable */
-      503: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-    };
-  };
-  testAdminDiscordNotification: {
-    parameters: {
-      query?: never;
-      header?: {
-        /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
-        "X-Profile-Id"?: string;
-        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
-        "X-Profile-Token"?: string;
-      };
-      path?: never;
-      cookie?: never;
-    };
-    requestBody?: never;
-    responses: {
-      /** @description OK */
-      200: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/json": components["schemas"]["AdminNotificationDiscordTestResult"];
-        };
-      };
-      /** @description Bad Request */
-      400: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unauthorized */
-      401: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Forbidden */
-      403: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Not Found */
-      404: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Not Acceptable */
-      406: {
+      /** @description Conflict */
+      409: {
         headers: {
           [name: string]: unknown;
         };
@@ -62369,10 +62766,13 @@ export interface operations {
       };
     };
   };
-  testAdminApplePushNotification: {
+  getAdminNodeCapabilities: {
     parameters: {
       query?: never;
       header?: {
+        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
+        "If-Match"?: string;
+        "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
@@ -62381,21 +62781,29 @@ export interface operations {
       path?: never;
       cookie?: never;
     };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["AdminNotificationPushTestInputBody"];
-      };
-    };
+    requestBody?: never;
     responses: {
       /** @description OK */
       200: {
         headers: {
+          "Cache-Control"?: string;
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminNotificationPushTestResult"];
+          "application/json": components["schemas"]["AdminNodeCapabilities"];
         };
       };
+      /** @description The representation named by If-None-Match is current; no body. */
+      304: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
       /** @description Bad Request */
       400: {
         headers: {
@@ -62441,27 +62849,11 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
+      /** @description Precondition Failed */
+      412: {
         headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
           [name: string]: unknown;
         };
         content: {
@@ -62506,7 +62898,7 @@ export interface operations {
       };
     };
   };
-  testAdminAndroidPushNotification: {
+  forceReloadAdminNodes: {
     parameters: {
       query?: never;
       header?: {
@@ -62518,11 +62910,7 @@ export interface operations {
       path?: never;
       cookie?: never;
     };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["AdminNotificationPushTestInputBody"];
-      };
-    };
+    requestBody?: never;
     responses: {
       /** @description OK */
       200: {
@@ -62530,7 +62918,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminNotificationPushTestResult"];
+          "application/json": components["schemas"]["AdminNodeReloadOutputBody"];
         };
       };
       /** @description Bad Request */
@@ -62578,33 +62966,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -62643,7 +63004,7 @@ export interface operations {
       };
     };
   };
-  clearAdminNotificationRelay: {
+  testAdminDiscordNotification: {
     parameters: {
       query?: never;
       header?: {
@@ -62657,12 +63018,14 @@ export interface operations {
     };
     requestBody?: never;
     responses: {
-      /** @description No Content */
-      204: {
+      /** @description OK */
+      200: {
         headers: {
           [name: string]: unknown;
         };
-        content?: never;
+        content: {
+          "application/json": components["schemas"]["AdminNotificationDiscordTestResult"];
+        };
       };
       /** @description Bad Request */
       400: {
@@ -62747,7 +63110,7 @@ export interface operations {
       };
     };
   };
-  registerAdminNotificationRelay: {
+  testAdminApplePushNotification: {
     parameters: {
       query?: never;
       header?: {
@@ -62761,7 +63124,7 @@ export interface operations {
     };
     requestBody: {
       content: {
-        "application/json": components["schemas"]["NotificationRelayRegisterInputBody"];
+        "application/json": components["schemas"]["AdminNotificationPushTestInputBody"];
       };
     };
     responses: {
@@ -62771,7 +63134,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["NotificationRelayRegistration"];
+          "application/json": components["schemas"]["AdminNotificationPushTestResult"];
         };
       };
       /** @description Bad Request */
@@ -62884,13 +63247,9 @@ export interface operations {
       };
     };
   };
-  listAdminNotificationServerChannels: {
+  testAdminAndroidPushNotification: {
     parameters: {
-      query?: {
-        cursor?: string;
-        /** @description Page size; default 50, maximum 200 */
-        limit?: number;
-      };
+      query?: never;
       header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
@@ -62900,7 +63259,11 @@ export interface operations {
       path?: never;
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["AdminNotificationPushTestInputBody"];
+      };
+    };
     responses: {
       /** @description OK */
       200: {
@@ -62908,7 +63271,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["CollectionNotificationServerChannel"];
+          "application/json": components["schemas"]["AdminNotificationPushTestResult"];
         };
       };
       /** @description Bad Request */
@@ -62956,6 +63319,33 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Request Entity Too Large */
+      413: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unsupported Media Type */
+      415: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -62994,7 +63384,7 @@ export interface operations {
       };
     };
   };
-  createAdminNotificationServerChannel: {
+  clearAdminNotificationRelay: {
     parameters: {
       query?: never;
       header?: {
@@ -63006,20 +63396,14 @@ export interface operations {
       path?: never;
       cookie?: never;
     };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["NotificationServerChannelCreateInputBody"];
-      };
-    };
+    requestBody?: never;
     responses: {
-      /** @description Created */
-      201: {
+      /** @description No Content */
+      204: {
         headers: {
           [name: string]: unknown;
         };
-        content: {
-          "application/json": components["schemas"]["NotificationDestinationCreated"];
-        };
+        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -63066,33 +63450,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -63131,7 +63488,7 @@ export interface operations {
       };
     };
   };
-  updateAdminNotificationServerChannel: {
+  registerAdminNotificationRelay: {
     parameters: {
       query?: never;
       header?: {
@@ -63140,14 +63497,12 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        id: string;
-      };
+      path?: never;
       cookie?: never;
     };
     requestBody: {
       content: {
-        "application/json": components["schemas"]["NotificationServerChannelUpdateInputBody"];
+        "application/json": components["schemas"]["NotificationRelayRegisterInputBody"];
       };
     };
     responses: {
@@ -63157,7 +63512,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["NotificationServerChannel"];
+          "application/json": components["schemas"]["NotificationRelayRegistration"];
         };
       };
       /** @description Bad Request */
@@ -63270,28 +63625,32 @@ export interface operations {
       };
     };
   };
-  deleteAdminNotificationServerChannel: {
+  listAdminNotificationServerChannels: {
     parameters: {
-      query?: never;
+      query?: {
+        cursor?: string;
+        /** @description Page size; default 50, maximum 200 */
+        limit?: number;
+      };
       header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        id: string;
-      };
+      path?: never;
       cookie?: never;
     };
     requestBody?: never;
     responses: {
-      /** @description No Content */
-      204: {
+      /** @description OK */
+      200: {
         headers: {
           [name: string]: unknown;
         };
-        content?: never;
+        content: {
+          "application/json": components["schemas"]["CollectionNotificationServerChannel"];
+        };
       };
       /** @description Bad Request */
       400: {
@@ -63376,7 +63735,7 @@ export interface operations {
       };
     };
   };
-  rotateAdminNotificationServerChannelSecret: {
+  createAdminNotificationServerChannel: {
     parameters: {
       query?: never;
       header?: {
@@ -63385,21 +63744,22 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        id: string;
-      };
+      path?: never;
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["NotificationServerChannelCreateInputBody"];
+      };
+    };
     responses: {
-      /** @description OK */
-      200: {
+      /** @description Created */
+      201: {
         headers: {
-          "Cache-Control"?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["NotificationWebhookSecretOutputBody"];
+          "application/json": components["schemas"]["NotificationDestinationCreated"];
         };
       };
       /** @description Bad Request */
@@ -63447,90 +63807,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Unprocessable Entity */
-      422: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Too Many Requests */
-      429: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Internal Server Error */
-      500: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Service Unavailable */
-      503: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-    };
-  };
-  testAdminNotificationServerChannel: {
-    parameters: {
-      query?: never;
-      header?: {
-        /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
-        "X-Profile-Id"?: string;
-        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
-        "X-Profile-Token"?: string;
-      };
-      path: {
-        /** @description Opaque identifier */
-        id: string;
-      };
-      cookie?: never;
-    };
-    requestBody?: never;
-    responses: {
-      /** @description OK */
-      200: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/json": components["schemas"]["NotificationDestinationTestResult"];
-        };
-      };
-      /** @description Bad Request */
-      400: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unauthorized */
-      401: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Forbidden */
-      403: {
+      /** @description Request Timeout */
+      408: {
         headers: {
           [name: string]: unknown;
         };
@@ -63538,8 +63816,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Not Found */
-      404: {
+      /** @description Request Entity Too Large */
+      413: {
         headers: {
           [name: string]: unknown;
         };
@@ -63547,8 +63825,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Not Acceptable */
-      406: {
+      /** @description Unsupported Media Type */
+      415: {
         headers: {
           [name: string]: unknown;
         };
@@ -63594,7 +63872,7 @@ export interface operations {
       };
     };
   };
-  updateAdminPerson: {
+  updateAdminNotificationServerChannel: {
     parameters: {
       query?: never;
       header?: {
@@ -63604,14 +63882,13 @@ export interface operations {
         "X-Profile-Token"?: string;
       };
       path: {
-        /** @description Opaque identifier */
         id: string;
       };
       cookie?: never;
     };
     requestBody: {
       content: {
-        "application/json": components["schemas"]["AdminPersonUpdate"];
+        "application/json": components["schemas"]["NotificationServerChannelUpdateInputBody"];
       };
     };
     responses: {
@@ -63621,7 +63898,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["Person"];
+          "application/json": components["schemas"]["NotificationServerChannel"];
         };
       };
       /** @description Bad Request */
@@ -63734,7 +64011,7 @@ export interface operations {
       };
     };
   };
-  refreshAdminPerson: {
+  deleteAdminNotificationServerChannel: {
     parameters: {
       query?: never;
       header?: {
@@ -63744,21 +64021,18 @@ export interface operations {
         "X-Profile-Token"?: string;
       };
       path: {
-        /** @description Person identifier */
         id: string;
       };
       cookie?: never;
     };
     requestBody?: never;
     responses: {
-      /** @description OK */
-      200: {
+      /** @description No Content */
+      204: {
         headers: {
           [name: string]: unknown;
         };
-        content: {
-          "application/json": components["schemas"]["Person"];
-        };
+        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -63843,31 +64117,18 @@ export interface operations {
       };
     };
   };
-  listAdminPlaybackHistory: {
+  rotateAdminNotificationServerChannelSecret: {
     parameters: {
-      query?: {
-        /** @description Completion filter; all returns every finalized attempt */
-        completed?: "all" | "true" | "false";
-        /** @description Opaque cursor from page.next_cursor */
-        cursor?: string;
-        /** @description Only attempts that ended at or after this instant */
-        ended_after?: string;
-        /** @description Page size; default 50, maximum 200 */
-        limit?: number;
-        /** @description Only attempts of this catalog item */
-        media_item_id?: string;
-        /** @description Only attempts by this household profile */
-        profile_id?: string;
-        /** @description Only attempts by this login account */
-        user_id?: string;
-      };
+      query?: never;
       header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
+      path: {
+        id: string;
+      };
       cookie?: never;
     };
     requestBody?: never;
@@ -63875,10 +64136,11 @@ export interface operations {
       /** @description OK */
       200: {
         headers: {
+          "Cache-Control"?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminPlaybackHistoryCollection"];
+          "application/json": components["schemas"]["NotificationWebhookSecretOutputBody"];
         };
       };
       /** @description Bad Request */
@@ -63964,19 +64226,19 @@ export interface operations {
       };
     };
   };
-  getAdminPlaybackRoutingCapabilities: {
+  testAdminNotificationServerChannel: {
     parameters: {
       query?: never;
       header?: {
-        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
-        "If-Match"?: string;
-        "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
+      path: {
+        /** @description Opaque identifier */
+        id: string;
+      };
       cookie?: never;
     };
     requestBody?: never;
@@ -63984,23 +64246,11 @@ export interface operations {
       /** @description OK */
       200: {
         headers: {
-          "Cache-Control"?: string;
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminPlaybackRoutingCapabilities"];
-        };
-      };
-      /** @description The representation named by If-None-Match is current; no body. */
-      304: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
+          "application/json": components["schemas"]["NotificationDestinationTestResult"];
         };
-        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -64047,17 +64297,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Failed */
-      412: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -64096,23 +64335,26 @@ export interface operations {
       };
     };
   };
-  listAdminPluginCatalog: {
+  updateAdminPerson: {
     parameters: {
-      query?: {
-        cursor?: string;
-        /** @description Page size; default 50, maximum 200 */
-        limit?: number;
-      };
+      query?: never;
       header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
+      path: {
+        /** @description Opaque identifier */
+        id: string;
+      };
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["AdminPersonUpdate"];
+      };
+    };
     responses: {
       /** @description OK */
       200: {
@@ -64120,7 +64362,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["CollectionAdminPluginCatalogEntry"];
+          "application/json": components["schemas"]["Person"];
         };
       };
       /** @description Bad Request */
@@ -64168,6 +64410,33 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Request Entity Too Large */
+      413: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unsupported Media Type */
+      415: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -64206,19 +64475,19 @@ export interface operations {
       };
     };
   };
-  getAdminPluginCatalogSettings: {
+  refreshAdminPerson: {
     parameters: {
       query?: never;
       header?: {
-        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
-        "If-Match"?: string;
-        "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
+      path: {
+        /** @description Person identifier */
+        id: string;
+      };
       cookie?: never;
     };
     requestBody?: never;
@@ -64226,22 +64495,11 @@ export interface operations {
       /** @description OK */
       200: {
         headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminPluginCatalogSettings"];
-        };
-      };
-      /** @description The representation named by If-None-Match is current; no body. */
-      304: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
+          "application/json": components["schemas"]["Person"];
         };
-        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -64288,17 +64546,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Failed */
-      412: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -64337,14 +64584,25 @@ export interface operations {
       };
     };
   };
-  updateAdminPluginCatalogSettings: {
+  listAdminPlaybackHistory: {
     parameters: {
-      query?: never;
-      header: {
-        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
-        "If-Match": string;
-        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
-        "If-None-Match"?: string;
+      query?: {
+        /** @description Completion filter; all returns every finalized attempt */
+        completed?: "all" | "true" | "false";
+        /** @description Opaque cursor from page.next_cursor */
+        cursor?: string;
+        /** @description Only attempts that ended at or after this instant */
+        ended_after?: string;
+        /** @description Page size; default 50, maximum 200 */
+        limit?: number;
+        /** @description Only attempts of this catalog item */
+        media_item_id?: string;
+        /** @description Only attempts by this household profile */
+        profile_id?: string;
+        /** @description Only attempts by this login account */
+        user_id?: string;
+      };
+      header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
@@ -64353,21 +64611,15 @@ export interface operations {
       path?: never;
       cookie?: never;
     };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["AdminPluginCatalogSettings"];
-      };
-    };
+    requestBody?: never;
     responses: {
       /** @description OK */
       200: {
         headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminPluginCatalogSettings"];
+          "application/json": components["schemas"]["AdminPlaybackHistoryCollection"];
         };
       };
       /** @description Bad Request */
@@ -64415,44 +64667,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Precondition Failed */
-      412: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -64462,15 +64676,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Required */
-      428: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Too Many Requests */
       429: {
         headers: {
@@ -64500,10 +64705,13 @@ export interface operations {
       };
     };
   };
-  getAdminPluginCatalogStatus: {
+  getAdminPlaybackRoutingCapabilities: {
     parameters: {
       query?: never;
       header?: {
+        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
+        "If-Match"?: string;
+        "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
@@ -64517,12 +64725,24 @@ export interface operations {
       /** @description OK */
       200: {
         headers: {
+          "Cache-Control"?: string;
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminPluginCatalogStatus"];
+          "application/json": components["schemas"]["AdminPlaybackRoutingCapabilities"];
         };
       };
+      /** @description The representation named by If-None-Match is current; no body. */
+      304: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
       /** @description Bad Request */
       400: {
         headers: {
@@ -64568,6 +64788,17 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Precondition Failed */
+      412: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -64606,7 +64837,7 @@ export interface operations {
       };
     };
   };
-  listAdminPluginInstallations: {
+  listAdminPluginCatalog: {
     parameters: {
       query?: {
         cursor?: string;
@@ -64630,7 +64861,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["CollectionAdminPluginInstallation"];
+          "application/json": components["schemas"]["CollectionAdminPluginCatalogEntry"];
         };
       };
       /** @description Bad Request */
@@ -64716,10 +64947,13 @@ export interface operations {
       };
     };
   };
-  createAdminPluginInstallation: {
+  getAdminPluginCatalogSettings: {
     parameters: {
       query?: never;
       header?: {
+        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
+        "If-Match"?: string;
+        "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
@@ -64728,20 +64962,27 @@ export interface operations {
       path?: never;
       cookie?: never;
     };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["AdminPluginInstallCreate"];
-      };
-    };
+    requestBody?: never;
     responses: {
-      /** @description Created */
-      201: {
+      /** @description OK */
+      200: {
         headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminPluginInstallation"];
+          "application/json": components["schemas"]["AdminPluginCatalogSettings"];
+        };
+      };
+      /** @description The representation named by If-None-Match is current; no body. */
+      304: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
         };
+        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -64788,27 +65029,11 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
+      /** @description Precondition Failed */
+      412: {
         headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
           [name: string]: unknown;
         };
         content: {
@@ -64853,34 +65078,37 @@ export interface operations {
       };
     };
   };
-  updateAdminPluginInstallation: {
+  updateAdminPluginCatalogSettings: {
     parameters: {
       query?: never;
-      header?: {
+      header: {
+        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
+        "If-Match": string;
+        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
+        "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        /** @description Opaque identifier */
-        id: string;
-      };
+      path?: never;
       cookie?: never;
     };
     requestBody: {
       content: {
-        "application/json": components["schemas"]["AdminPluginInstallationUpdate"];
+        "application/json": components["schemas"]["AdminPluginCatalogSettings"];
       };
     };
     responses: {
       /** @description OK */
       200: {
         headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminPluginInstallation"];
+          "application/json": components["schemas"]["AdminPluginCatalogSettings"];
         };
       };
       /** @description Bad Request */
@@ -64937,9 +65165,11 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Conflict */
-      409: {
+      /** @description Precondition Failed */
+      412: {
         headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
           [name: string]: unknown;
         };
         content: {
@@ -64973,6 +65203,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Precondition Required */
+      428: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Too Many Requests */
       429: {
         headers: {
@@ -65002,7 +65241,7 @@ export interface operations {
       };
     };
   };
-  deleteAdminPluginInstallation: {
+  getAdminPluginCatalogStatus: {
     parameters: {
       query?: never;
       header?: {
@@ -65011,20 +65250,19 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        /** @description Opaque identifier */
-        id: string;
-      };
+      path?: never;
       cookie?: never;
     };
     requestBody?: never;
     responses: {
-      /** @description No Content */
-      204: {
+      /** @description OK */
+      200: {
         headers: {
           [name: string]: unknown;
         };
-        content?: never;
+        content: {
+          "application/json": components["schemas"]["AdminPluginCatalogStatus"];
+        };
       };
       /** @description Bad Request */
       400: {
@@ -65071,8 +65309,109 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Conflict */
-      409: {
+      /** @description Unprocessable Entity */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Too Many Requests */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Internal Server Error */
+      500: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Service Unavailable */
+      503: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+    };
+  };
+  listAdminPluginInstallations: {
+    parameters: {
+      query?: {
+        cursor?: string;
+        /** @description Page size; default 50, maximum 200 */
+        limit?: number;
+      };
+      header?: {
+        /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
+        "X-Profile-Id"?: string;
+        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
+        "X-Profile-Token"?: string;
+      };
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description OK */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/json": components["schemas"]["CollectionAdminPluginInstallation"];
+        };
+      };
+      /** @description Bad Request */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unauthorized */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Forbidden */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Found */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Acceptable */
+      406: {
         headers: {
           [name: string]: unknown;
         };
@@ -65118,7 +65457,7 @@ export interface operations {
       };
     };
   };
-  updateAdminPluginAuthBinding: {
+  createAdminPluginInstallation: {
     parameters: {
       query?: never;
       header?: {
@@ -65127,25 +65466,23 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        /** @description Opaque identifier */
-        id: string;
-      };
+      path?: never;
       cookie?: never;
     };
     requestBody: {
       content: {
-        "application/json": components["schemas"]["AdminPluginAuthBindingWrite"];
+        "application/json": components["schemas"]["AdminPluginInstallCreate"];
       };
     };
     responses: {
-      /** @description No Content */
-      204: {
+      /** @description Created */
+      201: {
         headers: {
-          "X-Prairie-Restart-Required"?: string;
           [name: string]: unknown;
         };
-        content?: never;
+        content: {
+          "application/json": components["schemas"]["AdminPluginInstallation"];
+        };
       };
       /** @description Bad Request */
       400: {
@@ -65201,15 +65538,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Conflict */
-      409: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Request Entity Too Large */
       413: {
         headers: {
@@ -65266,7 +65594,7 @@ export interface operations {
       };
     };
   };
-  testAdminPluginAuthBinding: {
+  updateAdminPluginInstallation: {
     parameters: {
       query?: never;
       header?: {
@@ -65283,7 +65611,7 @@ export interface operations {
     };
     requestBody: {
       content: {
-        "application/json": components["schemas"]["AdminPluginAuthBindingTestInputBody"];
+        "application/json": components["schemas"]["AdminPluginInstallationUpdate"];
       };
     };
     responses: {
@@ -65293,7 +65621,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AuthConnectionTestResult"];
+          "application/json": components["schemas"]["AdminPluginInstallation"];
         };
       };
       /** @description Bad Request */
@@ -65415,7 +65743,7 @@ export interface operations {
       };
     };
   };
-  updateAdminPluginInstallationConfig: {
+  deleteAdminPluginInstallation: {
     parameters: {
       query?: never;
       header?: {
@@ -65430,11 +65758,7 @@ export interface operations {
       };
       cookie?: never;
     };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["AdminPluginConfigWrite"];
-      };
-    };
+    requestBody?: never;
     responses: {
       /** @description No Content */
       204: {
@@ -65488,15 +65812,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Conflict */
       409: {
         headers: {
@@ -65506,24 +65821,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -65562,7 +65859,7 @@ export interface operations {
       };
     };
   };
-  testAdminPluginInstallationConfig: {
+  updateAdminPluginAuthBinding: {
     parameters: {
       query?: never;
       header?: {
@@ -65579,18 +65876,17 @@ export interface operations {
     };
     requestBody: {
       content: {
-        "application/json": components["schemas"]["AdminPluginConfigWrite"];
+        "application/json": components["schemas"]["AdminPluginAuthBindingWrite"];
       };
     };
     responses: {
-      /** @description OK */
-      200: {
+      /** @description No Content */
+      204: {
         headers: {
+          "X-Prairie-Restart-Required"?: string;
           [name: string]: unknown;
         };
-        content: {
-          "application/json": components["schemas"]["AdminPluginConnectionCheck"];
-        };
+        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -65711,7 +66007,7 @@ export interface operations {
       };
     };
   };
-  restartAdminPluginInstallation: {
+  testAdminPluginAuthBinding: {
     parameters: {
       query?: never;
       header?: {
@@ -65726,7 +66022,11 @@ export interface operations {
       };
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["AdminPluginAuthBindingTestInputBody"];
+      };
+    };
     responses: {
       /** @description OK */
       200: {
@@ -65734,7 +66034,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminPluginInstallation"];
+          "application/json": components["schemas"]["AuthConnectionTestResult"];
         };
       };
       /** @description Bad Request */
@@ -65782,6 +66082,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Conflict */
       409: {
         headers: {
@@ -65791,6 +66100,24 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Request Entity Too Large */
+      413: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unsupported Media Type */
+      415: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -65829,7 +66156,7 @@ export interface operations {
       };
     };
   };
-  updateAdminPluginTaskBinding: {
+  updateAdminPluginInstallationConfig: {
     parameters: {
       query?: never;
       header?: {
@@ -65839,7 +66166,6 @@ export interface operations {
         "X-Profile-Token"?: string;
       };
       path: {
-        capability_id: string;
         /** @description Opaque identifier */
         id: string;
       };
@@ -65847,18 +66173,16 @@ export interface operations {
     };
     requestBody: {
       content: {
-        "application/json": components["schemas"]["AdminPluginTaskBindingWrite"];
+        "application/json": components["schemas"]["AdminPluginConfigWrite"];
       };
     };
     responses: {
-      /** @description OK */
-      200: {
+      /** @description No Content */
+      204: {
         headers: {
           [name: string]: unknown;
         };
-        content: {
-          "application/json": components["schemas"]["AdminPluginTaskBindingResult"];
-        };
+        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -65979,7 +66303,7 @@ export interface operations {
       };
     };
   };
-  applyAdminPluginUpdate: {
+  testAdminPluginInstallationConfig: {
     parameters: {
       query?: never;
       header?: {
@@ -65994,7 +66318,11 @@ export interface operations {
       };
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["AdminPluginConfigWrite"];
+      };
+    };
     responses: {
       /** @description OK */
       200: {
@@ -66002,7 +66330,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminPluginInstallation"];
+          "application/json": components["schemas"]["AdminPluginConnectionCheck"];
         };
       };
       /** @description Bad Request */
@@ -66050,91 +66378,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Conflict */
-      409: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unprocessable Entity */
-      422: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Too Many Requests */
-      429: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Internal Server Error */
-      500: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Service Unavailable */
-      503: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-    };
-  };
-  listAdminPluginRepositories: {
-    parameters: {
-      query?: {
-        cursor?: string;
-        /** @description Page size; default 50, maximum 200 */
-        limit?: number;
-      };
-      header?: {
-        /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
-        "X-Profile-Id"?: string;
-        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
-        "X-Profile-Token"?: string;
-      };
-      path?: never;
-      cookie?: never;
-    };
-    requestBody?: never;
-    responses: {
-      /** @description OK */
-      200: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/json": components["schemas"]["CollectionAdminPluginRepository"];
-        };
-      };
-      /** @description Bad Request */
-      400: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unauthorized */
-      401: {
+      /** @description Request Timeout */
+      408: {
         headers: {
           [name: string]: unknown;
         };
@@ -66142,8 +66387,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Forbidden */
-      403: {
+      /** @description Conflict */
+      409: {
         headers: {
           [name: string]: unknown;
         };
@@ -66151,8 +66396,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Not Found */
-      404: {
+      /** @description Request Entity Too Large */
+      413: {
         headers: {
           [name: string]: unknown;
         };
@@ -66160,8 +66405,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Not Acceptable */
-      406: {
+      /** @description Unsupported Media Type */
+      415: {
         headers: {
           [name: string]: unknown;
         };
@@ -66207,7 +66452,7 @@ export interface operations {
       };
     };
   };
-  createAdminPluginRepository: {
+  restartAdminPluginInstallation: {
     parameters: {
       query?: never;
       header?: {
@@ -66216,22 +66461,21 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
-      cookie?: never;
-    };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["AdminPluginRepositoryCreateBody"];
+      path: {
+        /** @description Opaque identifier */
+        id: string;
       };
+      cookie?: never;
     };
+    requestBody?: never;
     responses: {
-      /** @description Created */
-      201: {
+      /** @description OK */
+      200: {
         headers: {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminPluginRepository"];
+          "application/json": components["schemas"]["AdminPluginInstallation"];
         };
       };
       /** @description Bad Request */
@@ -66279,26 +66523,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
+      /** @description Conflict */
+      409: {
         headers: {
           [name: string]: unknown;
         };
@@ -66344,7 +66570,7 @@ export interface operations {
       };
     };
   };
-  updateAdminPluginRepository: {
+  updateAdminPluginTaskBinding: {
     parameters: {
       query?: never;
       header?: {
@@ -66354,13 +66580,15 @@ export interface operations {
         "X-Profile-Token"?: string;
       };
       path: {
+        capability_id: string;
+        /** @description Opaque identifier */
         id: string;
       };
       cookie?: never;
     };
     requestBody: {
       content: {
-        "application/json": components["schemas"]["AdminPluginRepositoryUpdateBody"];
+        "application/json": components["schemas"]["AdminPluginTaskBindingWrite"];
       };
     };
     responses: {
@@ -66370,7 +66598,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminPluginRepository"];
+          "application/json": components["schemas"]["AdminPluginTaskBindingResult"];
         };
       };
       /** @description Bad Request */
@@ -66427,6 +66655,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Conflict */
+      409: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Request Entity Too Large */
       413: {
         headers: {
@@ -66483,7 +66720,7 @@ export interface operations {
       };
     };
   };
-  deleteAdminPluginRepository: {
+  applyAdminPluginUpdate: {
     parameters: {
       query?: never;
       header?: {
@@ -66493,18 +66730,21 @@ export interface operations {
         "X-Profile-Token"?: string;
       };
       path: {
+        /** @description Opaque identifier */
         id: string;
       };
       cookie?: never;
     };
     requestBody?: never;
     responses: {
-      /** @description No Content */
-      204: {
+      /** @description OK */
+      200: {
         headers: {
           [name: string]: unknown;
         };
-        content?: never;
+        content: {
+          "application/json": components["schemas"]["AdminPluginInstallation"];
+        };
       };
       /** @description Bad Request */
       400: {
@@ -66551,6 +66791,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Conflict */
+      409: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -66589,9 +66838,13 @@ export interface operations {
       };
     };
   };
-  uploadAdminPluginInstallation: {
+  listAdminPluginRepositories: {
     parameters: {
-      query?: never;
+      query?: {
+        cursor?: string;
+        /** @description Page size; default 50, maximum 200 */
+        limit?: number;
+      };
       header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
@@ -66601,19 +66854,125 @@ export interface operations {
       path?: never;
       cookie?: never;
     };
-    requestBody: {
-      content: {
-        "multipart/form-data": components["schemas"]["AdminPluginUploadForm"];
-      };
-    };
+    requestBody?: never;
     responses: {
-      /** @description Created */
-      201: {
+      /** @description OK */
+      200: {
         headers: {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminPluginInstallation"];
+          "application/json": components["schemas"]["CollectionAdminPluginRepository"];
+        };
+      };
+      /** @description Bad Request */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unauthorized */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Forbidden */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Found */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Acceptable */
+      406: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unprocessable Entity */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Too Many Requests */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Internal Server Error */
+      500: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Service Unavailable */
+      503: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+    };
+  };
+  createAdminPluginRepository: {
+    parameters: {
+      query?: never;
+      header?: {
+        /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
+        "X-Profile-Id"?: string;
+        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
+        "X-Profile-Token"?: string;
+      };
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["AdminPluginRepositoryCreateBody"];
+      };
+    };
+    responses: {
+      /** @description Created */
+      201: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/json": components["schemas"]["AdminPluginRepository"];
         };
       };
       /** @description Bad Request */
@@ -66726,7 +67085,7 @@ export interface operations {
       };
     };
   };
-  createAdminPluginUpload: {
+  updateAdminPluginRepository: {
     parameters: {
       query?: never;
       header?: {
@@ -66735,22 +67094,24 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
+      path: {
+        id: string;
+      };
       cookie?: never;
     };
     requestBody: {
       content: {
-        "application/json": components["schemas"]["AdminPluginChunkedUploadCreate"];
+        "application/json": components["schemas"]["AdminPluginRepositoryUpdateBody"];
       };
     };
     responses: {
-      /** @description Created */
-      201: {
+      /** @description OK */
+      200: {
         headers: {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminPluginUploadSession"];
+          "application/json": components["schemas"]["AdminPluginRepository"];
         };
       };
       /** @description Bad Request */
@@ -66863,7 +67224,7 @@ export interface operations {
       };
     };
   };
-  cancelAdminPluginUpload: {
+  deleteAdminPluginRepository: {
     parameters: {
       query?: never;
       header?: {
@@ -66873,7 +67234,7 @@ export interface operations {
         "X-Profile-Token"?: string;
       };
       path: {
-        upload_id: string;
+        id: string;
       };
       cookie?: never;
     };
@@ -66969,7 +67330,7 @@ export interface operations {
       };
     };
   };
-  putAdminPluginUploadChunk: {
+  uploadAdminPluginInstallation: {
     parameters: {
       query?: never;
       header?: {
@@ -66978,25 +67339,22 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        chunk_index: number;
-        upload_id: string;
-      };
+      path?: never;
       cookie?: never;
     };
     requestBody: {
       content: {
-        "application/octet-stream": string;
+        "multipart/form-data": components["schemas"]["AdminPluginUploadForm"];
       };
     };
     responses: {
-      /** @description OK */
-      200: {
+      /** @description Created */
+      201: {
         headers: {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminPluginUploadSession"];
+          "application/json": components["schemas"]["AdminPluginInstallation"];
         };
       };
       /** @description Bad Request */
@@ -67053,15 +67411,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Conflict */
-      409: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Request Entity Too Large */
       413: {
         headers: {
@@ -67118,7 +67467,7 @@ export interface operations {
       };
     };
   };
-  completeAdminPluginUpload: {
+  createAdminPluginUpload: {
     parameters: {
       query?: never;
       header?: {
@@ -67127,12 +67476,14 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        upload_id: string;
-      };
+      path?: never;
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["AdminPluginChunkedUploadCreate"];
+      };
+    };
     responses: {
       /** @description Created */
       201: {
@@ -67140,7 +67491,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminPluginInstallation"];
+          "application/json": components["schemas"]["AdminPluginUploadSession"];
         };
       };
       /** @description Bad Request */
@@ -67188,8 +67539,26 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Conflict */
-      409: {
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Request Entity Too Large */
+      413: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unsupported Media Type */
+      415: {
         headers: {
           [name: string]: unknown;
         };
@@ -67235,37 +67604,28 @@ export interface operations {
       };
     };
   };
-  listAdminPolicyDecisions: {
+  cancelAdminPluginUpload: {
     parameters: {
-      query?: {
-        allowed?: "true" | "false";
-        cursor?: string;
-        decision_name?: string;
-        from?: string;
-        limit?: number;
-        to?: string;
-        /** @description Opaque identifier */
-        user_id?: string;
-      };
+      query?: never;
       header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
+      path: {
+        upload_id: string;
+      };
       cookie?: never;
     };
     requestBody?: never;
     responses: {
-      /** @description OK */
-      200: {
+      /** @description No Content */
+      204: {
         headers: {
           [name: string]: unknown;
         };
-        content: {
-          "application/json": components["schemas"]["CollectionAdminPolicyDecision"];
-        };
+        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -67350,24 +67710,26 @@ export interface operations {
       };
     };
   };
-  getAdminPolicyDecision: {
+  putAdminPluginUploadChunk: {
     parameters: {
       query?: never;
       header?: {
-        "If-Match"?: string;
-        "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
       path: {
-        /** @description Opaque identifier */
-        id: string;
+        chunk_index: number;
+        upload_id: string;
       };
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        "application/octet-stream": string;
+      };
+    };
     responses: {
       /** @description OK */
       200: {
@@ -67375,7 +67737,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminPolicyDecision"];
+          "application/json": components["schemas"]["AdminPluginUploadSession"];
         };
       };
       /** @description Bad Request */
@@ -67423,6 +67785,42 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Conflict */
+      409: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Request Entity Too Large */
+      413: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unsupported Media Type */
+      415: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -67461,30 +67859,29 @@ export interface operations {
       };
     };
   };
-  listAdminPolicyDocuments: {
+  completeAdminPluginUpload: {
     parameters: {
-      query?: {
-        cursor?: string;
-        limit?: number;
-      };
+      query?: never;
       header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
+      path: {
+        upload_id: string;
+      };
       cookie?: never;
     };
     requestBody?: never;
     responses: {
-      /** @description OK */
-      200: {
+      /** @description Created */
+      201: {
         headers: {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["CollectionAdminPolicyDocument"];
+          "application/json": components["schemas"]["AdminPluginInstallation"];
         };
       };
       /** @description Bad Request */
@@ -67532,6 +67929,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Conflict */
+      409: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -67570,9 +67976,18 @@ export interface operations {
       };
     };
   };
-  createAdminPolicyDocument: {
+  listAdminPolicyDecisions: {
     parameters: {
-      query?: never;
+      query?: {
+        allowed?: "true" | "false";
+        cursor?: string;
+        decision_name?: string;
+        from?: string;
+        limit?: number;
+        to?: string;
+        /** @description Opaque identifier */
+        user_id?: string;
+      };
       header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
@@ -67582,21 +67997,15 @@ export interface operations {
       path?: never;
       cookie?: never;
     };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["AdminPolicyDocumentCreate"];
-      };
-    };
+    requestBody?: never;
     responses: {
-      /** @description Created */
-      201: {
+      /** @description OK */
+      200: {
         headers: {
-          ETag?: string;
-          Location?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminPolicyDocument"];
+          "application/json": components["schemas"]["CollectionAdminPolicyDecision"];
         };
       };
       /** @description Bad Request */
@@ -67644,33 +68053,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -67709,7 +68091,7 @@ export interface operations {
       };
     };
   };
-  getAdminPolicyDocument: {
+  getAdminPolicyDecision: {
     parameters: {
       query?: never;
       header?: {
@@ -67731,11 +68113,10 @@ export interface operations {
       /** @description OK */
       200: {
         headers: {
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminPolicySnapshot"];
+          "application/json": components["schemas"]["AdminPolicyDecision"];
         };
       };
       /** @description Bad Request */
@@ -67821,33 +68202,31 @@ export interface operations {
       };
     };
   };
-  deleteAdminPolicyDocument: {
+  listAdminPolicyDocuments: {
     parameters: {
-      query?: never;
-      header: {
-        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
-        "If-Match": string;
-        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
-        "If-None-Match"?: string;
+      query?: {
+        cursor?: string;
+        limit?: number;
+      };
+      header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        /** @description Opaque identifier */
-        id: string;
-      };
+      path?: never;
       cookie?: never;
     };
     requestBody?: never;
     responses: {
-      /** @description No Content */
-      204: {
+      /** @description OK */
+      200: {
         headers: {
           [name: string]: unknown;
         };
-        content?: never;
+        content: {
+          "application/json": components["schemas"]["CollectionAdminPolicyDocument"];
+        };
       };
       /** @description Bad Request */
       400: {
@@ -67894,17 +68273,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Failed */
-      412: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -67914,15 +68282,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Required */
-      428: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Too Many Requests */
       429: {
         headers: {
@@ -67952,40 +68311,33 @@ export interface operations {
       };
     };
   };
-  setAdminPolicyEnabled: {
+  createAdminPolicyDocument: {
     parameters: {
       query?: never;
-      header: {
-        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
-        "If-Match": string;
-        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
-        "If-None-Match"?: string;
+      header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        /** @description Opaque identifier */
-        id: string;
-      };
+      path?: never;
       cookie?: never;
     };
     requestBody: {
       content: {
-        "application/json": components["schemas"]["AdminPolicyEnabled"];
+        "application/json": components["schemas"]["AdminPolicyDocumentCreate"];
       };
     };
     responses: {
-      /** @description OK */
-      200: {
+      /** @description Created */
+      201: {
         headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
           ETag?: string;
+          Location?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminPolicyApplyResult"];
+          "application/json": components["schemas"]["AdminPolicyDocument"];
         };
       };
       /** @description Bad Request */
@@ -68042,17 +68394,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Failed */
-      412: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Request Entity Too Large */
       413: {
         headers: {
@@ -68080,15 +68421,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Required */
-      428: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Too Many Requests */
       429: {
         headers: {
@@ -68118,13 +68450,11 @@ export interface operations {
       };
     };
   };
-  activateAdminPolicyVersion: {
+  getAdminPolicyDocument: {
     parameters: {
       query?: never;
-      header: {
-        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
-        "If-Match": string;
-        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
+      header?: {
+        "If-Match"?: string;
         "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
@@ -68137,21 +68467,16 @@ export interface operations {
       };
       cookie?: never;
     };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["AdminPolicyActivation"];
-      };
-    };
+    requestBody?: never;
     responses: {
       /** @description OK */
       200: {
         headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
           ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminPolicyApplyResult"];
+          "application/json": components["schemas"]["AdminPolicySnapshot"];
         };
       };
       /** @description Bad Request */
@@ -68199,44 +68524,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Precondition Failed */
-      412: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -68246,15 +68533,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Required */
-      428: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Too Many Requests */
       429: {
         headers: {
@@ -68284,13 +68562,14 @@ export interface operations {
       };
     };
   };
-  listAdminPolicyVersions: {
+  deleteAdminPolicyDocument: {
     parameters: {
-      query?: {
-        cursor?: string;
-        limit?: number;
-      };
-      header?: {
+      query?: never;
+      header: {
+        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
+        "If-Match": string;
+        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
+        "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
@@ -68304,14 +68583,12 @@ export interface operations {
     };
     requestBody?: never;
     responses: {
-      /** @description OK */
-      200: {
+      /** @description No Content */
+      204: {
         headers: {
           [name: string]: unknown;
         };
-        content: {
-          "application/json": components["schemas"]["CollectionAdminPolicyVersion"];
-        };
+        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -68358,6 +68635,17 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Precondition Failed */
+      412: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -68367,6 +68655,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Precondition Required */
+      428: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Too Many Requests */
       429: {
         headers: {
@@ -68396,10 +68693,14 @@ export interface operations {
       };
     };
   };
-  createAdminPolicyVersion: {
+  setAdminPolicyEnabled: {
     parameters: {
       query?: never;
-      header?: {
+      header: {
+        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
+        "If-Match": string;
+        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
+        "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
@@ -68413,18 +68714,19 @@ export interface operations {
     };
     requestBody: {
       content: {
-        "application/json": components["schemas"]["AdminPolicyVersionCreate"];
+        "application/json": components["schemas"]["AdminPolicyEnabled"];
       };
     };
     responses: {
-      /** @description Created */
-      201: {
+      /** @description OK */
+      200: {
         headers: {
-          Location?: string;
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminPolicyVersion"];
+          "application/json": components["schemas"]["AdminPolicyApplyResult"];
         };
       };
       /** @description Bad Request */
@@ -68481,6 +68783,17 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Precondition Failed */
+      412: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Request Entity Too Large */
       413: {
         headers: {
@@ -68508,6 +68821,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Precondition Required */
+      428: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Too Many Requests */
       429: {
         headers: {
@@ -68537,10 +68859,14 @@ export interface operations {
       };
     };
   };
-  getAdminPolicyVersion: {
+  activateAdminPolicyVersion: {
     parameters: {
       query?: never;
-      header?: {
+      header: {
+        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
+        "If-Match": string;
+        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
+        "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
@@ -68549,20 +68875,24 @@ export interface operations {
       path: {
         /** @description Opaque identifier */
         id: string;
-        /** @description Opaque identifier */
-        version: string;
       };
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["AdminPolicyActivation"];
+      };
+    };
     responses: {
       /** @description OK */
       200: {
         headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminPolicyVersion"];
+          "application/json": components["schemas"]["AdminPolicyApplyResult"];
         };
       };
       /** @description Bad Request */
@@ -68610,6 +68940,44 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Precondition Failed */
+      412: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Request Entity Too Large */
+      413: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unsupported Media Type */
+      415: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -68619,6 +68987,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Precondition Required */
+      428: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Too Many Requests */
       429: {
         headers: {
@@ -68648,23 +69025,25 @@ export interface operations {
       };
     };
   };
-  simulateAdminPolicy: {
+  listAdminPolicyVersions: {
     parameters: {
-      query?: never;
+      query?: {
+        cursor?: string;
+        limit?: number;
+      };
       header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
-      cookie?: never;
-    };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["AdminPolicySimulation"];
+      path: {
+        /** @description Opaque identifier */
+        id: string;
       };
+      cookie?: never;
     };
+    requestBody?: never;
     responses: {
       /** @description OK */
       200: {
@@ -68672,7 +69051,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminPolicySimulationResult"];
+          "application/json": components["schemas"]["CollectionAdminPolicyVersion"];
         };
       };
       /** @description Bad Request */
@@ -68720,33 +69099,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -68785,7 +69137,7 @@ export interface operations {
       };
     };
   };
-  validateAdminPolicy: {
+  createAdminPolicyVersion: {
     parameters: {
       query?: never;
       header?: {
@@ -68794,22 +69146,26 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
+      path: {
+        /** @description Opaque identifier */
+        id: string;
+      };
       cookie?: never;
     };
     requestBody: {
       content: {
-        "application/json": components["schemas"]["AdminPolicySource"];
+        "application/json": components["schemas"]["AdminPolicyVersionCreate"];
       };
     };
     responses: {
-      /** @description OK */
-      200: {
+      /** @description Created */
+      201: {
         headers: {
+          Location?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminPolicyValidation"];
+          "application/json": components["schemas"]["AdminPolicyVersion"];
         };
       };
       /** @description Bad Request */
@@ -68922,7 +69278,7 @@ export interface operations {
       };
     };
   };
-  listAdminPolicyVendor: {
+  getAdminPolicyVersion: {
     parameters: {
       query?: never;
       header?: {
@@ -68931,7 +69287,12 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
+      path: {
+        /** @description Opaque identifier */
+        id: string;
+        /** @description Opaque identifier */
+        version: string;
+      };
       cookie?: never;
     };
     requestBody?: never;
@@ -68942,7 +69303,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["CollectionAdminPolicyVendor"];
+          "application/json": components["schemas"]["AdminPolicyVersion"];
         };
       };
       /** @description Bad Request */
@@ -69028,13 +69389,10 @@ export interface operations {
       };
     };
   };
-  getAdminRateLimitConfig: {
+  simulateAdminPolicy: {
     parameters: {
       query?: never;
       header?: {
-        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
-        "If-Match"?: string;
-        "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
@@ -69043,27 +69401,20 @@ export interface operations {
       path?: never;
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["AdminPolicySimulation"];
+      };
+    };
     responses: {
       /** @description OK */
       200: {
         headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminRateLimitConfig"];
-        };
-      };
-      /** @description The representation named by If-None-Match is current; no body. */
-      304: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
+          "application/json": components["schemas"]["AdminPolicySimulationResult"];
         };
-        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -69110,11 +69461,27 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Failed */
-      412: {
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Request Entity Too Large */
+      413: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unsupported Media Type */
+      415: {
         headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
@@ -69159,14 +69526,10 @@ export interface operations {
       };
     };
   };
-  updateAdminRateLimitConfig: {
+  validateAdminPolicy: {
     parameters: {
       query?: never;
-      header: {
-        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
-        "If-Match": string;
-        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
-        "If-None-Match"?: string;
+      header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
@@ -69177,7 +69540,7 @@ export interface operations {
     };
     requestBody: {
       content: {
-        "application/json": components["schemas"]["AdminRateLimitUpdate"];
+        "application/json": components["schemas"]["AdminPolicySource"];
       };
     };
     responses: {
@@ -69187,7 +69550,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminRateLimitUpdateResult"];
+          "application/json": components["schemas"]["AdminPolicyValidation"];
         };
       };
       /** @description Bad Request */
@@ -69244,17 +69607,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Failed */
-      412: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Request Entity Too Large */
       413: {
         headers: {
@@ -69282,15 +69634,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Required */
-      428: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Too Many Requests */
       429: {
         headers: {
@@ -69320,7 +69663,7 @@ export interface operations {
       };
     };
   };
-  getAdminRateLimitStatus: {
+  listAdminPolicyVendor: {
     parameters: {
       query?: never;
       header?: {
@@ -69340,7 +69683,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminRateLimitStatus"];
+          "application/json": components["schemas"]["CollectionAdminPolicyVendor"];
         };
       };
       /** @description Bad Request */
@@ -69426,10 +69769,13 @@ export interface operations {
       };
     };
   };
-  listAdminRatingSources: {
+  getAdminRateLimitConfig: {
     parameters: {
       query?: never;
       header?: {
+        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
+        "If-Match"?: string;
+        "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
@@ -69443,12 +69789,23 @@ export interface operations {
       /** @description OK */
       200: {
         headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["CollectionAdminRatingSource"];
+          "application/json": components["schemas"]["AdminRateLimitConfig"];
         };
       };
+      /** @description The representation named by If-None-Match is current; no body. */
+      304: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
       /** @description Bad Request */
       400: {
         headers: {
@@ -69494,6 +69851,17 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Precondition Failed */
+      412: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -69532,12 +69900,13 @@ export interface operations {
       };
     };
   };
-  getAdminRatingSourceCapabilities: {
+  updateAdminRateLimitConfig: {
     parameters: {
       query?: never;
-      header?: {
-        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
-        "If-Match"?: string;
+      header: {
+        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
+        "If-Match": string;
+        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
         "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
@@ -69547,28 +69916,20 @@ export interface operations {
       path?: never;
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["AdminRateLimitUpdate"];
+      };
+    };
     responses: {
       /** @description OK */
       200: {
         headers: {
-          "Cache-Control"?: string;
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminRatingSourceCapabilities"];
-        };
-      };
-      /** @description The representation named by If-None-Match is current; no body. */
-      304: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
+          "application/json": components["schemas"]["AdminRateLimitUpdateResult"];
         };
-        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -69615,6 +69976,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Precondition Failed */
       412: {
         headers: {
@@ -69626,6 +69996,24 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Request Entity Too Large */
+      413: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unsupported Media Type */
+      415: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -69635,6 +70023,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Precondition Required */
+      428: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Too Many Requests */
       429: {
         headers: {
@@ -69664,7 +70061,7 @@ export interface operations {
       };
     };
   };
-  getAdminRecommendationsStatus: {
+  getAdminRateLimitStatus: {
     parameters: {
       query?: never;
       header?: {
@@ -69684,7 +70081,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminRecommendationsStatus"];
+          "application/json": components["schemas"]["AdminRateLimitStatus"];
         };
       };
       /** @description Bad Request */
@@ -69770,7 +70167,7 @@ export interface operations {
       };
     };
   };
-  triggerAdminRecommendationCowatch: {
+  listAdminRatingSources: {
     parameters: {
       query?: never;
       header?: {
@@ -69790,9 +70187,130 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminRecommendationStarted"];
+          "application/json": components["schemas"]["CollectionAdminRatingSource"];
+        };
+      };
+      /** @description Bad Request */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unauthorized */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Forbidden */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Found */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Not Acceptable */
+      406: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unprocessable Entity */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Too Many Requests */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Internal Server Error */
+      500: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Service Unavailable */
+      503: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+    };
+  };
+  getAdminRatingSourceCapabilities: {
+    parameters: {
+      query?: never;
+      header?: {
+        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
+        "If-Match"?: string;
+        "If-None-Match"?: string;
+        /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
+        "X-Profile-Id"?: string;
+        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
+        "X-Profile-Token"?: string;
+      };
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description OK */
+      200: {
+        headers: {
+          "Cache-Control"?: string;
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/json": components["schemas"]["AdminRatingSourceCapabilities"];
+        };
+      };
+      /** @description The representation named by If-None-Match is current; no body. */
+      304: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
       /** @description Bad Request */
       400: {
         headers: {
@@ -69838,6 +70356,17 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Precondition Failed */
+      412: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -69876,7 +70405,7 @@ export interface operations {
       };
     };
   };
-  triggerAdminRecommendationEmbeddings: {
+  resetAdminRecommendationEmbeddings: {
     parameters: {
       query?: never;
       header?: {
@@ -69896,7 +70425,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminRecommendationStarted"];
+          "application/json": components["schemas"]["AdminRecommendationEmbeddingsReset"];
         };
       };
       /** @description Bad Request */
@@ -69944,105 +70473,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Unprocessable Entity */
-      422: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Too Many Requests */
-      429: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Internal Server Error */
-      500: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Service Unavailable */
-      503: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-    };
-  };
-  triggerAdminRecommendationRefresh: {
-    parameters: {
-      query?: never;
-      header?: {
-        /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
-        "X-Profile-Id"?: string;
-        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
-        "X-Profile-Token"?: string;
-      };
-      path?: never;
-      cookie?: never;
-    };
-    requestBody?: never;
-    responses: {
-      /** @description OK */
-      200: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/json": components["schemas"]["AdminRecommendationStarted"];
-        };
-      };
-      /** @description Bad Request */
-      400: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unauthorized */
-      401: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Forbidden */
-      403: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Not Found */
-      404: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Not Acceptable */
-      406: {
+      /** @description Conflict */
+      409: {
         headers: {
           [name: string]: unknown;
         };
@@ -70088,7 +70520,7 @@ export interface operations {
       };
     };
   };
-  triggerAdminRecommendationTasteProfiles: {
+  getAdminRecommendationsStatus: {
     parameters: {
       query?: never;
       header?: {
@@ -70108,7 +70540,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminRecommendationStarted"];
+          "application/json": components["schemas"]["AdminRecommendationsStatus"];
         };
       };
       /** @description Bad Request */
@@ -70194,7 +70626,7 @@ export interface operations {
       };
     };
   };
-  getAdminRequestGroupLimit: {
+  triggerAdminRecommendationCowatch: {
     parameters: {
       query?: never;
       header?: {
@@ -70203,10 +70635,7 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        /** @description The access group */
-        group_id: string;
-      };
+      path?: never;
       cookie?: never;
     };
     requestBody?: never;
@@ -70214,11 +70643,10 @@ export interface operations {
       /** @description OK */
       200: {
         headers: {
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminRequestGroupLimit"];
+          "application/json": components["schemas"]["AdminRecommendationStarted"];
         };
       };
       /** @description Bad Request */
@@ -70304,40 +70732,27 @@ export interface operations {
       };
     };
   };
-  updateAdminRequestGroupLimit: {
+  triggerAdminRecommendationEmbeddings: {
     parameters: {
       query?: never;
-      header: {
-        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
-        "If-Match": string;
-        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
-        "If-None-Match"?: string;
+      header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        /** @description The access group */
-        group_id: string;
-      };
+      path?: never;
       cookie?: never;
     };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["AdminRequestGroupLimitBody"];
-      };
-    };
+    requestBody?: never;
     responses: {
       /** @description OK */
       200: {
         headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminRequestGroupLimit"];
+          "application/json": components["schemas"]["AdminRecommendationStarted"];
         };
       };
       /** @description Bad Request */
@@ -70385,44 +70800,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Precondition Failed */
-      412: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -70432,15 +70809,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Required */
-      428: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Too Many Requests */
       429: {
         headers: {
@@ -70470,14 +70838,9 @@ export interface operations {
       };
     };
   };
-  listRequestIntegrations: {
+  triggerAdminRecommendationRefresh: {
     parameters: {
-      query?: {
-        /** @description Opaque cursor from page.next_cursor */
-        cursor?: string;
-        /** @description Page size; default 50, maximum 200 */
-        limit?: number;
-      };
+      query?: never;
       header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
@@ -70495,7 +70858,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["CollectionAdminRequestIntegration"];
+          "application/json": components["schemas"]["AdminRecommendationStarted"];
         };
       };
       /** @description Bad Request */
@@ -70581,7 +70944,7 @@ export interface operations {
       };
     };
   };
-  createRequestIntegration: {
+  triggerAdminRecommendationTasteProfiles: {
     parameters: {
       query?: never;
       header?: {
@@ -70593,21 +70956,15 @@ export interface operations {
       path?: never;
       cookie?: never;
     };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["AdminRequestIntegrationBody"];
-      };
-    };
+    requestBody?: never;
     responses: {
-      /** @description Created */
-      201: {
+      /** @description OK */
+      200: {
         headers: {
-          ETag?: string;
-          Location?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminRequestIntegration"];
+          "application/json": components["schemas"]["AdminRecommendationStarted"];
         };
       };
       /** @description Bad Request */
@@ -70655,33 +71012,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -70720,7 +71050,7 @@ export interface operations {
       };
     };
   };
-  getRequestIntegration: {
+  getAdminRequestGroupLimit: {
     parameters: {
       query?: never;
       header?: {
@@ -70730,8 +71060,8 @@ export interface operations {
         "X-Profile-Token"?: string;
       };
       path: {
-        /** @description The request */
-        id: string;
+        /** @description The access group */
+        group_id: string;
       };
       cookie?: never;
     };
@@ -70744,7 +71074,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminRequestIntegration"];
+          "application/json": components["schemas"]["AdminRequestGroupLimit"];
         };
       };
       /** @description Bad Request */
@@ -70830,7 +71160,7 @@ export interface operations {
       };
     };
   };
-  updateRequestIntegration: {
+  updateAdminRequestGroupLimit: {
     parameters: {
       query?: never;
       header: {
@@ -70844,14 +71174,14 @@ export interface operations {
         "X-Profile-Token"?: string;
       };
       path: {
-        /** @description The request */
-        id: string;
+        /** @description The access group */
+        group_id: string;
       };
       cookie?: never;
     };
     requestBody: {
       content: {
-        "application/json": components["schemas"]["AdminRequestIntegrationBody"];
+        "application/json": components["schemas"]["AdminRequestGroupLimitBody"];
       };
     };
     responses: {
@@ -70863,7 +71193,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminRequestIntegration"];
+          "application/json": components["schemas"]["AdminRequestGroupLimit"];
         };
       };
       /** @description Bad Request */
@@ -70996,33 +71326,33 @@ export interface operations {
       };
     };
   };
-  deleteRequestIntegration: {
+  listRequestIntegrations: {
     parameters: {
-      query?: never;
-      header: {
-        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
-        "If-Match": string;
-        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
-        "If-None-Match"?: string;
+      query?: {
+        /** @description Opaque cursor from page.next_cursor */
+        cursor?: string;
+        /** @description Page size; default 50, maximum 200 */
+        limit?: number;
+      };
+      header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        /** @description The request */
-        id: string;
-      };
+      path?: never;
       cookie?: never;
     };
     requestBody?: never;
     responses: {
-      /** @description No Content */
-      204: {
+      /** @description OK */
+      200: {
         headers: {
           [name: string]: unknown;
         };
-        content?: never;
+        content: {
+          "application/json": components["schemas"]["CollectionAdminRequestIntegration"];
+        };
       };
       /** @description Bad Request */
       400: {
@@ -71069,17 +71399,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Failed */
-      412: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -71089,15 +71408,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Required */
-      428: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Too Many Requests */
       429: {
         headers: {
@@ -71127,7 +71437,7 @@ export interface operations {
       };
     };
   };
-  loadRequestIntegrationOptions: {
+  createRequestIntegration: {
     parameters: {
       query?: never;
       header?: {
@@ -71136,25 +71446,24 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        /** @description The request */
-        id: string;
-      };
+      path?: never;
       cookie?: never;
     };
     requestBody: {
       content: {
-        "application/json": components["schemas"]["AdminRequestOptionsInputBody"];
+        "application/json": components["schemas"]["AdminRequestIntegrationBody"];
       };
     };
     responses: {
-      /** @description OK */
-      200: {
+      /** @description Created */
+      201: {
         headers: {
+          ETag?: string;
+          Location?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminRequestOptions"];
+          "application/json": components["schemas"]["AdminRequestIntegration"];
         };
       };
       /** @description Bad Request */
@@ -71267,7 +71576,7 @@ export interface operations {
       };
     };
   };
-  listRequestRoutes: {
+  getRequestIntegration: {
     parameters: {
       query?: never;
       header?: {
@@ -71276,7 +71585,10 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
+      path: {
+        /** @description The request */
+        id: string;
+      };
       cookie?: never;
     };
     requestBody?: never;
@@ -71284,10 +71596,11 @@ export interface operations {
       /** @description OK */
       200: {
         headers: {
+          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["CollectionAdminRequestRoute"];
+          "application/json": components["schemas"]["AdminRequestIntegration"];
         };
       };
       /** @description Bad Request */
@@ -71335,15 +71648,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Conflict */
-      409: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -71382,33 +71686,40 @@ export interface operations {
       };
     };
   };
-  createRequestRoute: {
+  updateRequestIntegration: {
     parameters: {
       query?: never;
-      header?: {
+      header: {
+        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
+        "If-Match": string;
+        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
+        "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
+      path: {
+        /** @description The request */
+        id: string;
+      };
       cookie?: never;
     };
     requestBody: {
       content: {
-        "application/json": components["schemas"]["AdminRequestRouteBody"];
+        "application/json": components["schemas"]["AdminRequestIntegrationBody"];
       };
     };
     responses: {
-      /** @description Created */
-      201: {
+      /** @description OK */
+      200: {
         headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
           ETag?: string;
-          Location?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminRequestRoute"];
+          "application/json": components["schemas"]["AdminRequestIntegration"];
         };
       };
       /** @description Bad Request */
@@ -71465,9 +71776,11 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Conflict */
-      409: {
+      /** @description Precondition Failed */
+      412: {
         headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
           [name: string]: unknown;
         };
         content: {
@@ -71501,6 +71814,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Precondition Required */
+      428: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Too Many Requests */
       429: {
         headers: {
@@ -71530,31 +71852,165 @@ export interface operations {
       };
     };
   };
-  getRequestRoute: {
+  deleteRequestIntegration: {
     parameters: {
       query?: never;
-      header?: {
+      header: {
+        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
+        "If-Match": string;
+        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
+        "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
       path: {
-        /** @description The route */
+        /** @description The request */
         id: string;
       };
       cookie?: never;
     };
     requestBody?: never;
+    responses: {
+      /** @description No Content */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Bad Request */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unauthorized */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Forbidden */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Found */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Acceptable */
+      406: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Precondition Failed */
+      412: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unprocessable Entity */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Precondition Required */
+      428: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Too Many Requests */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Internal Server Error */
+      500: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Service Unavailable */
+      503: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+    };
+  };
+  loadRequestIntegrationOptions: {
+    parameters: {
+      query?: never;
+      header?: {
+        /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
+        "X-Profile-Id"?: string;
+        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
+        "X-Profile-Token"?: string;
+      };
+      path: {
+        /** @description The request */
+        id: string;
+      };
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["AdminRequestOptionsInputBody"];
+      };
+    };
     responses: {
       /** @description OK */
       200: {
         headers: {
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminRequestRoute"];
+          "application/json": components["schemas"]["AdminRequestOptions"];
         };
       };
       /** @description Bad Request */
@@ -71602,8 +72058,26 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Conflict */
-      409: {
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Request Entity Too Large */
+      413: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unsupported Media Type */
+      415: {
         headers: {
           [name: string]: unknown;
         };
@@ -71649,40 +72123,27 @@ export interface operations {
       };
     };
   };
-  updateRequestRoute: {
+  listRequestRoutes: {
     parameters: {
       query?: never;
-      header: {
-        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
-        "If-Match": string;
-        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
-        "If-None-Match"?: string;
+      header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        /** @description The route */
-        id: string;
-      };
+      path?: never;
       cookie?: never;
     };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["AdminRequestRouteBody"];
-      };
-    };
+    requestBody?: never;
     responses: {
       /** @description OK */
       200: {
         headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminRequestRoute"];
+          "application/json": components["schemas"]["CollectionAdminRequestRoute"];
         };
       };
       /** @description Bad Request */
@@ -71730,15 +72191,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Conflict */
       409: {
         headers: {
@@ -71748,35 +72200,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Failed */
-      412: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -71786,15 +72209,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Required */
-      428: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Too Many Requests */
       429: {
         headers: {
@@ -71824,33 +72238,34 @@ export interface operations {
       };
     };
   };
-  deleteRequestRoute: {
+  createRequestRoute: {
     parameters: {
       query?: never;
-      header: {
-        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
-        "If-Match": string;
-        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
-        "If-None-Match"?: string;
+      header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        /** @description The route */
-        id: string;
-      };
+      path?: never;
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["AdminRequestRouteBody"];
+      };
+    };
     responses: {
-      /** @description No Content */
-      204: {
+      /** @description Created */
+      201: {
         headers: {
+          ETag?: string;
+          Location?: string;
           [name: string]: unknown;
         };
-        content?: never;
+        content: {
+          "application/json": components["schemas"]["AdminRequestRoute"];
+        };
       };
       /** @description Bad Request */
       400: {
@@ -71897,6 +72312,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Conflict */
       409: {
         headers: {
@@ -71906,19 +72330,17 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Failed */
-      412: {
+      /** @description Request Entity Too Large */
+      413: {
         headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Unprocessable Entity */
-      422: {
+      /** @description Unsupported Media Type */
+      415: {
         headers: {
           [name: string]: unknown;
         };
@@ -71926,8 +72348,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Required */
-      428: {
+      /** @description Unprocessable Entity */
+      422: {
         headers: {
           [name: string]: unknown;
         };
@@ -71964,7 +72386,7 @@ export interface operations {
       };
     };
   };
-  reorderRequestRoutes: {
+  getRequestRoute: {
     parameters: {
       query?: never;
       header?: {
@@ -71973,22 +72395,22 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
-      cookie?: never;
-    };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["AdminRequestRouteReorderInputBody"];
+      path: {
+        /** @description The route */
+        id: string;
       };
+      cookie?: never;
     };
+    requestBody?: never;
     responses: {
       /** @description OK */
       200: {
         headers: {
+          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["CollectionAdminRequestRoute"];
+          "application/json": components["schemas"]["AdminRequestRoute"];
         };
       };
       /** @description Bad Request */
@@ -72036,15 +72458,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Conflict */
       409: {
         headers: {
@@ -72054,24 +72467,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -72110,31 +72505,40 @@ export interface operations {
       };
     };
   };
-  previewRequestRoute: {
+  updateRequestRoute: {
     parameters: {
       query?: never;
-      header?: {
+      header: {
+        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
+        "If-Match": string;
+        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
+        "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
+      path: {
+        /** @description The route */
+        id: string;
+      };
       cookie?: never;
     };
     requestBody: {
       content: {
-        "application/json": components["schemas"]["AdminRequestRoutePreviewInputBody"];
+        "application/json": components["schemas"]["AdminRequestRouteBody"];
       };
     };
     responses: {
       /** @description OK */
       200: {
         headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminRequestRoutePreviewOutputBody"];
+          "application/json": components["schemas"]["AdminRequestRoute"];
         };
       };
       /** @description Bad Request */
@@ -72200,6 +72604,17 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Precondition Failed */
+      412: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Request Entity Too Large */
       413: {
         headers: {
@@ -72227,6 +72642,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Precondition Required */
+      428: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Too Many Requests */
       429: {
         headers: {
@@ -72256,32 +72680,33 @@ export interface operations {
       };
     };
   };
-  searchRequestRouteTitles: {
+  deleteRequestRoute: {
     parameters: {
-      query: {
-        media_type: "movie" | "series";
-        /** @description Title to search TMDB for */
-        q: string;
-      };
-      header?: {
+      query?: never;
+      header: {
+        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
+        "If-Match": string;
+        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
+        "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
+      path: {
+        /** @description The route */
+        id: string;
+      };
       cookie?: never;
     };
     requestBody?: never;
     responses: {
-      /** @description OK */
-      200: {
+      /** @description No Content */
+      204: {
         headers: {
           [name: string]: unknown;
         };
-        content: {
-          "application/json": components["schemas"]["AdminRequestRouteTitleCollection"];
-        };
+        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -72337,6 +72762,17 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Precondition Failed */
+      412: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -72346,6 +72782,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Precondition Required */
+      428: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Too Many Requests */
       429: {
         headers: {
@@ -72375,7 +72820,7 @@ export interface operations {
       };
     };
   };
-  getRequestRouting: {
+  reorderRequestRoutes: {
     parameters: {
       query?: never;
       header?: {
@@ -72387,16 +72832,19 @@ export interface operations {
       path?: never;
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["AdminRequestRouteReorderInputBody"];
+      };
+    };
     responses: {
       /** @description OK */
       200: {
         headers: {
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminRequestRouting"];
+          "application/json": components["schemas"]["CollectionAdminRequestRoute"];
         };
       };
       /** @description Bad Request */
@@ -72444,6 +72892,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Conflict */
       409: {
         headers: {
@@ -72453,6 +72910,24 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Request Entity Too Large */
+      413: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unsupported Media Type */
+      415: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -72491,14 +72966,10 @@ export interface operations {
       };
     };
   };
-  updateRequestRouting: {
+  previewRequestRoute: {
     parameters: {
       query?: never;
-      header: {
-        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
-        "If-Match": string;
-        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
-        "If-None-Match"?: string;
+      header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
@@ -72509,19 +72980,17 @@ export interface operations {
     };
     requestBody: {
       content: {
-        "application/json": components["schemas"]["AdminRequestRoutingUpdateInputBody"];
+        "application/json": components["schemas"]["AdminRequestRoutePreviewInputBody"];
       };
     };
     responses: {
       /** @description OK */
       200: {
         headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminRequestRouting"];
+          "application/json": components["schemas"]["AdminRequestRoutePreviewOutputBody"];
         };
       };
       /** @description Bad Request */
@@ -72587,17 +73056,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Failed */
-      412: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Request Entity Too Large */
       413: {
         headers: {
@@ -72625,15 +73083,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Required */
-      428: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Too Many Requests */
       429: {
         headers: {
@@ -72663,9 +73112,13 @@ export interface operations {
       };
     };
   };
-  getAdminRequestSettings: {
+  searchRequestRouteTitles: {
     parameters: {
-      query?: never;
+      query: {
+        media_type: "movie" | "series";
+        /** @description Title to search TMDB for */
+        q: string;
+      };
       header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
@@ -72680,127 +73133,10 @@ export interface operations {
       /** @description OK */
       200: {
         headers: {
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminRequestSettings"];
-        };
-      };
-      /** @description Bad Request */
-      400: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unauthorized */
-      401: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Forbidden */
-      403: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Not Found */
-      404: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Not Acceptable */
-      406: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unprocessable Entity */
-      422: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Too Many Requests */
-      429: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Internal Server Error */
-      500: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Service Unavailable */
-      503: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-    };
-  };
-  updateAdminRequestSettings: {
-    parameters: {
-      query?: never;
-      header: {
-        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
-        "If-Match": string;
-        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
-        "If-None-Match"?: string;
-        /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
-        "X-Profile-Id"?: string;
-        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
-        "X-Profile-Token"?: string;
-      };
-      path?: never;
-      cookie?: never;
-    };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["AdminRequestSettings"];
-      };
-    };
-    responses: {
-      /** @description OK */
-      200: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
-        };
-        content: {
-          "application/json": components["schemas"]["AdminRequestSettings"];
+          "application/json": components["schemas"]["AdminRequestRouteTitleCollection"];
         };
       };
       /** @description Bad Request */
@@ -72848,37 +73184,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Precondition Failed */
-      412: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
+      /** @description Conflict */
+      409: {
         headers: {
           [name: string]: unknown;
         };
@@ -72895,15 +73202,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Required */
-      428: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Too Many Requests */
       429: {
         headers: {
@@ -72933,7 +73231,7 @@ export interface operations {
       };
     };
   };
-  getAdminRequestUserLimit: {
+  getRequestRouting: {
     parameters: {
       query?: never;
       header?: {
@@ -72942,10 +73240,7 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        /** @description Opaque identifier */
-        user_id: string;
-      };
+      path?: never;
       cookie?: never;
     };
     requestBody?: never;
@@ -72957,7 +73252,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminRequestUserLimit"];
+          "application/json": components["schemas"]["AdminRequestRouting"];
         };
       };
       /** @description Bad Request */
@@ -73005,6 +73300,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Conflict */
+      409: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -73043,7 +73347,7 @@ export interface operations {
       };
     };
   };
-  updateAdminRequestUserLimit: {
+  updateRequestRouting: {
     parameters: {
       query?: never;
       header: {
@@ -73056,15 +73360,12 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        /** @description Opaque identifier */
-        user_id: string;
-      };
+      path?: never;
       cookie?: never;
     };
     requestBody: {
       content: {
-        "application/json": components["schemas"]["AdminRequestLimitBody"];
+        "application/json": components["schemas"]["AdminRequestRoutingUpdateInputBody"];
       };
     };
     responses: {
@@ -73076,7 +73377,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminRequestUserLimit"];
+          "application/json": components["schemas"]["AdminRequestRouting"];
         };
       };
       /** @description Bad Request */
@@ -73133,6 +73434,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Conflict */
+      409: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Precondition Failed */
       412: {
         headers: {
@@ -73209,7 +73519,7 @@ export interface operations {
       };
     };
   };
-  getAdminRequestUserUsage: {
+  getAdminRequestSettings: {
     parameters: {
       query?: never;
       header?: {
@@ -73218,10 +73528,7 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        /** @description Opaque identifier */
-        user_id: string;
-      };
+      path?: never;
       cookie?: never;
     };
     requestBody?: never;
@@ -73229,10 +73536,11 @@ export interface operations {
       /** @description OK */
       200: {
         headers: {
+          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminRequestUserUsage"];
+          "application/json": components["schemas"]["AdminRequestSettings"];
         };
       };
       /** @description Bad Request */
@@ -73318,33 +73626,182 @@ export interface operations {
       };
     };
   };
-  listAdminRequests: {
+  updateAdminRequestSettings: {
     parameters: {
-      query?: {
-        /** @description Opaque cursor from page.next_cursor */
-        cursor?: string;
-        /** @description Page size; default 50, maximum 50 */
-        limit?: number;
-        /** @description Only requests for this media type */
-        media_type?: "movie" | "series";
-        /** @description Only requests with this outcome */
-        outcome?: "active" | "declined" | "cancelled" | "failed";
-        /** @description Only requests whose title contains this text, or whose TMDB ID equals it */
-        q?: string;
-        /** @description Only requests made by this account; at most 2147483647 */
-        requested_by_user_id?: string;
-        /** @description Only requests in this status */
-        status?: "pending" | "approved" | "queued" | "downloading" | "completed";
-        /** @description Only requests in this queue view: needs_approval (pending), in_progress (approved, queued or downloading), failed, or done (completed, or closed by a decline or cancellation) */
-        view?: "needs_approval" | "in_progress" | "failed" | "done";
+      query?: never;
+      header: {
+        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
+        "If-Match": string;
+        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
+        "If-None-Match"?: string;
+        /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
+        "X-Profile-Id"?: string;
+        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
+        "X-Profile-Token"?: string;
+      };
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["AdminRequestSettings"];
+      };
+    };
+    responses: {
+      /** @description OK */
+      200: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/json": components["schemas"]["AdminRequestSettings"];
+        };
+      };
+      /** @description Bad Request */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unauthorized */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Forbidden */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Found */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Acceptable */
+      406: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Precondition Failed */
+      412: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Request Entity Too Large */
+      413: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unsupported Media Type */
+      415: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
       };
+      /** @description Unprocessable Entity */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Precondition Required */
+      428: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Too Many Requests */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Internal Server Error */
+      500: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Service Unavailable */
+      503: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+    };
+  };
+  getAdminRequestUserLimit: {
+    parameters: {
+      query?: never;
       header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
+      path: {
+        /** @description Opaque identifier */
+        user_id: string;
+      };
       cookie?: never;
     };
     requestBody?: never;
@@ -73352,10 +73809,11 @@ export interface operations {
       /** @description OK */
       200: {
         headers: {
+          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["MediaRequestCollection"];
+          "application/json": components["schemas"]["AdminRequestUserLimit"];
         };
       };
       /** @description Bad Request */
@@ -73441,34 +73899,40 @@ export interface operations {
       };
     };
   };
-  adminApproveRequest: {
+  updateAdminRequestUserLimit: {
     parameters: {
       query?: never;
-      header?: {
+      header: {
+        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
+        "If-Match": string;
+        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
+        "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
       path: {
-        /** @description The request */
-        id: string;
+        /** @description Opaque identifier */
+        user_id: string;
       };
       cookie?: never;
     };
     requestBody: {
       content: {
-        "application/json": components["schemas"]["AdminRequestActionInputBody"];
+        "application/json": components["schemas"]["AdminRequestLimitBody"];
       };
     };
     responses: {
       /** @description OK */
       200: {
         headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["MediaRequest"];
+          "application/json": components["schemas"]["AdminRequestUserLimit"];
         };
       };
       /** @description Bad Request */
@@ -73525,6 +73989,17 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Precondition Failed */
+      412: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Request Entity Too Large */
       413: {
         headers: {
@@ -73552,6 +74027,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Precondition Required */
+      428: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Too Many Requests */
       429: {
         headers: {
@@ -73581,7 +74065,7 @@ export interface operations {
       };
     };
   };
-  adminCancelRequest: {
+  getAdminRequestUserUsage: {
     parameters: {
       query?: never;
       header?: {
@@ -73591,16 +74075,12 @@ export interface operations {
         "X-Profile-Token"?: string;
       };
       path: {
-        /** @description The request */
-        id: string;
+        /** @description Opaque identifier */
+        user_id: string;
       };
       cookie?: never;
     };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["AdminRequestActionInputBody"];
-      };
-    };
+    requestBody?: never;
     responses: {
       /** @description OK */
       200: {
@@ -73608,7 +74088,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["MediaRequest"];
+          "application/json": components["schemas"]["AdminRequestUserUsage"];
         };
       };
       /** @description Bad Request */
@@ -73656,8 +74136,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
+      /** @description Unprocessable Entity */
+      422: {
         headers: {
           [name: string]: unknown;
         };
@@ -73665,8 +74145,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Entity Too Large */
-      413: {
+      /** @description Too Many Requests */
+      429: {
         headers: {
           [name: string]: unknown;
         };
@@ -73674,8 +74154,104 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Unsupported Media Type */
-      415: {
+      /** @description Internal Server Error */
+      500: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Service Unavailable */
+      503: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+    };
+  };
+  listAdminRequests: {
+    parameters: {
+      query?: {
+        /** @description Opaque cursor from page.next_cursor */
+        cursor?: string;
+        /** @description Page size; default 50, maximum 50 */
+        limit?: number;
+        /** @description Only requests for this media type */
+        media_type?: "movie" | "series";
+        /** @description Only requests with this outcome */
+        outcome?: "active" | "declined" | "cancelled" | "failed";
+        /** @description Only requests whose title contains this text, or whose TMDB ID equals it */
+        q?: string;
+        /** @description Only requests made by this account; at most 2147483647 */
+        requested_by_user_id?: string;
+        /** @description Only requests in this status */
+        status?: "pending" | "approved" | "queued" | "downloading" | "completed";
+        /** @description Only requests in this queue view: needs_approval (pending), in_progress (approved, queued or downloading), failed, or done (completed, or closed by a decline or cancellation) */
+        view?: "needs_approval" | "in_progress" | "failed" | "done";
+      };
+      header?: {
+        /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
+        "X-Profile-Id"?: string;
+        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
+        "X-Profile-Token"?: string;
+      };
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description OK */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/json": components["schemas"]["MediaRequestCollection"];
+        };
+      };
+      /** @description Bad Request */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unauthorized */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Forbidden */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Found */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Acceptable */
+      406: {
         headers: {
           [name: string]: unknown;
         };
@@ -73721,7 +74297,7 @@ export interface operations {
       };
     };
   };
-  adminDeclineRequest: {
+  adminApproveRequest: {
     parameters: {
       query?: never;
       header?: {
@@ -73861,7 +74437,7 @@ export interface operations {
       };
     };
   };
-  listAdminRequestEvents: {
+  adminCancelRequest: {
     parameters: {
       query?: never;
       header?: {
@@ -73876,7 +74452,11 @@ export interface operations {
       };
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["AdminRequestActionInputBody"];
+      };
+    };
     responses: {
       /** @description OK */
       200: {
@@ -73884,7 +74464,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminRequestEventCollection"];
+          "application/json": components["schemas"]["MediaRequest"];
         };
       };
       /** @description Bad Request */
@@ -73932,6 +74512,33 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Request Entity Too Large */
+      413: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unsupported Media Type */
+      415: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -73970,7 +74577,7 @@ export interface operations {
       };
     };
   };
-  adminRetryRequest: {
+  adminDeclineRequest: {
     parameters: {
       query?: never;
       header?: {
@@ -74110,19 +74717,19 @@ export interface operations {
       };
     };
   };
-  getAdminRequestCapabilities: {
+  listAdminRequestEvents: {
     parameters: {
       query?: never;
       header?: {
-        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
-        "If-Match"?: string;
-        "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
+      path: {
+        /** @description The request */
+        id: string;
+      };
       cookie?: never;
     };
     requestBody?: never;
@@ -74130,23 +74737,11 @@ export interface operations {
       /** @description OK */
       200: {
         headers: {
-          "Cache-Control"?: string;
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminRequestCapabilitiesOutputBody"];
-        };
-      };
-      /** @description The representation named by If-None-Match is current; no body. */
-      304: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
+          "application/json": components["schemas"]["AdminRequestEventCollection"];
         };
-        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -74193,17 +74788,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Failed */
-      412: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -74242,7 +74826,7 @@ export interface operations {
       };
     };
   };
-  getAdminRequestCounts: {
+  adminRetryRequest: {
     parameters: {
       query?: never;
       header?: {
@@ -74251,10 +74835,17 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
+      path: {
+        /** @description The request */
+        id: string;
+      };
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["AdminRequestActionInputBody"];
+      };
+    };
     responses: {
       /** @description OK */
       200: {
@@ -74262,7 +74853,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminRequestCounts"];
+          "application/json": components["schemas"]["MediaRequest"];
         };
       };
       /** @description Bad Request */
@@ -74310,6 +74901,33 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Request Entity Too Large */
+      413: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unsupported Media Type */
+      415: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -74348,14 +74966,13 @@ export interface operations {
       };
     };
   };
-  listAdminSections: {
+  getAdminRequestCapabilities: {
     parameters: {
-      query?: {
-        /** @description Opaque identifier */
-        library_id?: string;
-        scope?: "home" | "library";
-      };
+      query?: never;
       header?: {
+        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
+        "If-Match"?: string;
+        "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
@@ -74369,11 +74986,23 @@ export interface operations {
       /** @description OK */
       200: {
         headers: {
+          "Cache-Control"?: string;
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["CollectionAdminSection"];
+          "application/json": components["schemas"]["AdminRequestCapabilitiesOutputBody"];
+        };
+      };
+      /** @description The representation named by If-None-Match is current; no body. */
+      304: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
         };
+        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -74420,6 +75049,17 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Precondition Failed */
+      412: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -74458,7 +75098,7 @@ export interface operations {
       };
     };
   };
-  createAdminSection: {
+  getAdminRequestCounts: {
     parameters: {
       query?: never;
       header?: {
@@ -74470,20 +75110,15 @@ export interface operations {
       path?: never;
       cookie?: never;
     };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["AdminSectionCreate"];
-      };
-    };
+    requestBody?: never;
     responses: {
-      /** @description Created */
-      201: {
+      /** @description OK */
+      200: {
         headers: {
-          Location?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminSection"];
+          "application/json": components["schemas"]["AdminRequestCounts"];
         };
       };
       /** @description Bad Request */
@@ -74531,33 +75166,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -74596,21 +75204,20 @@ export interface operations {
       };
     };
   };
-  getAdminSection: {
+  listAdminSections: {
     parameters: {
-      query?: never;
+      query?: {
+        /** @description Opaque identifier */
+        library_id?: string;
+        scope?: "home" | "library";
+      };
       header?: {
-        "If-Match"?: string;
-        "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        /** @description Opaque identifier */
-        id: string;
-      };
+      path?: never;
       cookie?: never;
     };
     requestBody?: never;
@@ -74618,11 +75225,10 @@ export interface operations {
       /** @description OK */
       200: {
         headers: {
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminSection"];
+          "application/json": components["schemas"]["CollectionAdminSection"];
         };
       };
       /** @description Bad Request */
@@ -74708,33 +75314,33 @@ export interface operations {
       };
     };
   };
-  deleteAdminSection: {
+  createAdminSection: {
     parameters: {
       query?: never;
-      header: {
-        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
-        "If-Match": string;
-        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
-        "If-None-Match"?: string;
+      header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        /** @description Opaque identifier */
-        id: string;
-      };
+      path?: never;
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["AdminSectionCreate"];
+      };
+    };
     responses: {
-      /** @description No Content */
-      204: {
+      /** @description Created */
+      201: {
         headers: {
+          Location?: string;
           [name: string]: unknown;
         };
-        content?: never;
+        content: {
+          "application/json": components["schemas"]["AdminSection"];
+        };
       };
       /** @description Bad Request */
       400: {
@@ -74781,19 +75387,17 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Failed */
-      412: {
+      /** @description Request Timeout */
+      408: {
         headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Unprocessable Entity */
-      422: {
+      /** @description Request Entity Too Large */
+      413: {
         headers: {
           [name: string]: unknown;
         };
@@ -74801,8 +75405,17 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Required */
-      428: {
+      /** @description Unsupported Media Type */
+      415: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unprocessable Entity */
+      422: {
         headers: {
           [name: string]: unknown;
         };
@@ -74839,13 +75452,11 @@ export interface operations {
       };
     };
   };
-  updateAdminSection: {
+  getAdminSection: {
     parameters: {
       query?: never;
-      header: {
-        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
-        "If-Match": string;
-        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
+      header?: {
+        "If-Match"?: string;
         "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
@@ -74858,16 +75469,11 @@ export interface operations {
       };
       cookie?: never;
     };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["AdminSectionUpdate"];
-      };
-    };
+    requestBody?: never;
     responses: {
       /** @description OK */
       200: {
         headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
           ETag?: string;
           [name: string]: unknown;
         };
@@ -74920,8 +75526,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
+      /** @description Unprocessable Entity */
+      422: {
         headers: {
           [name: string]: unknown;
         };
@@ -74929,19 +75535,17 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Failed */
-      412: {
+      /** @description Too Many Requests */
+      429: {
         headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Entity Too Large */
-      413: {
+      /** @description Internal Server Error */
+      500: {
         headers: {
           [name: string]: unknown;
         };
@@ -74949,8 +75553,65 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Unsupported Media Type */
-      415: {
+      /** @description Service Unavailable */
+      503: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+    };
+  };
+  deleteAdminSection: {
+    parameters: {
+      query?: never;
+      header: {
+        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
+        "If-Match": string;
+        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
+        "If-None-Match"?: string;
+        /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
+        "X-Profile-Id"?: string;
+        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
+        "X-Profile-Token"?: string;
+      };
+      path: {
+        /** @description Opaque identifier */
+        id: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description No Content */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Bad Request */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unauthorized */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Forbidden */
+      403: {
         headers: {
           [name: string]: unknown;
         };
@@ -74958,6 +75619,35 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Not Found */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Acceptable */
+      406: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Precondition Failed */
+      412: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -75005,31 +75695,40 @@ export interface operations {
       };
     };
   };
-  bulkCreateAdminSections: {
+  updateAdminSection: {
     parameters: {
       query?: never;
-      header?: {
+      header: {
+        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
+        "If-Match": string;
+        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
+        "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
+      path: {
+        /** @description Opaque identifier */
+        id: string;
+      };
       cookie?: never;
     };
     requestBody: {
       content: {
-        "application/json": components["schemas"]["AdminSectionBulkCreate"];
+        "application/json": components["schemas"]["AdminSectionUpdate"];
       };
     };
     responses: {
       /** @description OK */
       200: {
         headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminSectionBulkResult"];
+          "application/json": components["schemas"]["AdminSection"];
         };
       };
       /** @description Bad Request */
@@ -75086,6 +75785,17 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Precondition Failed */
+      412: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Request Entity Too Large */
       413: {
         headers: {
@@ -75113,6 +75823,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Precondition Required */
+      428: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Too Many Requests */
       429: {
         headers: {
@@ -75142,13 +75861,10 @@ export interface operations {
       };
     };
   };
-  getAdminSectionCapabilities: {
+  bulkCreateAdminSections: {
     parameters: {
       query?: never;
       header?: {
-        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
-        "If-Match"?: string;
-        "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
@@ -75157,28 +75873,20 @@ export interface operations {
       path?: never;
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["AdminSectionBulkCreate"];
+      };
+    };
     responses: {
       /** @description OK */
       200: {
         headers: {
-          "Cache-Control"?: string;
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminSectionCapabilities"];
-        };
-      };
-      /** @description The representation named by If-None-Match is current; no body. */
-      304: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
+          "application/json": components["schemas"]["AdminSectionBulkResult"];
         };
-        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -75225,11 +75933,27 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Failed */
-      412: {
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Request Entity Too Large */
+      413: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unsupported Media Type */
+      415: {
         headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
@@ -75274,17 +75998,12 @@ export interface operations {
       };
     };
   };
-  restoreAdminSections: {
+  getAdminSectionCapabilities: {
     parameters: {
-      query?: {
-        /** @description Opaque identifier */
-        library_id?: string;
-        scope?: "home" | "library";
-      };
-      header: {
-        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
-        "If-Match": string;
-        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
+      query?: never;
+      header?: {
+        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
+        "If-Match"?: string;
         "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
@@ -75294,23 +76013,29 @@ export interface operations {
       path?: never;
       cookie?: never;
     };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["AdminSectionDefaults"];
-      };
-    };
+    requestBody?: never;
     responses: {
       /** @description OK */
       200: {
         headers: {
+          "Cache-Control"?: string;
           /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
           ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["AdminSectionOrder"];
+          "application/json": components["schemas"]["AdminSectionCapabilities"];
         };
       };
+      /** @description The representation named by If-None-Match is current; no body. */
+      304: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
       /** @description Bad Request */
       400: {
         headers: {
@@ -75356,15 +76081,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Precondition Failed */
       412: {
         headers: {
@@ -75376,24 +76092,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -75403,15 +76101,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Required */
-      428: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Too Many Requests */
       429: {
         headers: {
@@ -75441,14 +76130,18 @@ export interface operations {
       };
     };
   };
-  getAdminSectionOrder: {
+  restoreAdminSections: {
     parameters: {
       query?: {
         /** @description Opaque identifier */
         library_id?: string;
         scope?: "home" | "library";
       };
-      header?: {
+      header: {
+        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
+        "If-Match": string;
+        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
+        "If-None-Match"?: string;
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
@@ -75457,11 +76150,16 @@ export interface operations {
       path?: never;
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["AdminSectionDefaults"];
+      };
+    };
     responses: {
       /** @description OK */
       200: {
         headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
           ETag?: string;
           [name: string]: unknown;
         };
@@ -75514,6 +76212,44 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Precondition Failed */
+      412: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Request Entity Too Large */
+      413: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unsupported Media Type */
+      415: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -75523,6 +76259,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Precondition Required */
+      428: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Too Many Requests */
       429: {
         headers: {
@@ -75552,18 +76297,14 @@ export interface operations {
       };
     };
   };
-  reorderAdminSections: {
+  getAdminSectionOrder: {
     parameters: {
       query?: {
         /** @description Opaque identifier */
         library_id?: string;
         scope?: "home" | "library";
       };
-      header: {
-        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
-        "If-Match": string;
-        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
-        "If-None-Match"?: string;
+      header?: {
         /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
@@ -75572,16 +76313,11 @@ export interface operations {
       path?: never;
       cookie?: never;
     };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["AdminSectionOrderBody"];
-      };
-    };
+    requestBody?: never;
     responses: {
       /** @description OK */
       200: {
         headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
           ETag?: string;
           [name: string]: unknown;
         };
@@ -75634,44 +76370,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Precondition Failed */
-      412: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -75681,15 +76379,173 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Required */
-      428: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
+      /** @description Too Many Requests */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Internal Server Error */
+      500: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Service Unavailable */
+      503: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+    };
+  };
+  reorderAdminSections: {
+    parameters: {
+      query?: {
+        /** @description Opaque identifier */
+        library_id?: string;
+        scope?: "home" | "library";
+      };
+      header: {
+        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
+        "If-Match": string;
+        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
+        "If-None-Match"?: string;
+        /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
+        "X-Profile-Id"?: string;
+        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
+        "X-Profile-Token"?: string;
+      };
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["AdminSectionOrderBody"];
+      };
+    };
+    responses: {
+      /** @description OK */
+      200: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/json": components["schemas"]["AdminSectionOrder"];
+        };
+      };
+      /** @description Bad Request */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unauthorized */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Forbidden */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Found */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Acceptable */
+      406: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Precondition Failed */
+      412: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Request Entity Too Large */
+      413: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unsupported Media Type */
+      415: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unprocessable Entity */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Precondition Required */
+      428: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Too Many Requests */
       429: {
         headers: {
@@ -90653,13 +91509,17 @@ export interface operations {
       };
     };
   };
-  getPasswordResetCapability: {
+  getNotInterestedCapability: {
     parameters: {
       query?: never;
-      header?: {
+      header: {
         /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
         "If-Match"?: string;
         "If-None-Match"?: string;
+        /** @description The household profile acting for this request; it must belong to the authenticated account. */
+        "X-Profile-Id": string;
+        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
+        "X-Profile-Token"?: string;
       };
       path?: never;
       cookie?: never;
@@ -90675,7 +91535,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["PasswordResetCapability"];
+          "application/json": components["schemas"]["NotInterestedCapability"];
         };
       };
       /** @description The representation named by If-None-Match is current; no body. */
@@ -90696,6 +91556,33 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Unauthorized */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Forbidden */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Found */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Not Acceptable */
       406: {
         headers: {
@@ -90725,6 +91612,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Too Many Requests */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Internal Server Error */
       500: {
         headers: {
@@ -90745,17 +91641,13 @@ export interface operations {
       };
     };
   };
-  getRatingsCapability: {
+  getPasswordResetCapability: {
     parameters: {
       query?: never;
-      header: {
+      header?: {
         /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
         "If-Match"?: string;
         "If-None-Match"?: string;
-        /** @description The household profile acting for this request; it must belong to the authenticated account. */
-        "X-Profile-Id": string;
-        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
-        "X-Profile-Token"?: string;
       };
       path?: never;
       cookie?: never;
@@ -90771,7 +91663,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["RatingsCapability"];
+          "application/json": components["schemas"]["PasswordResetCapability"];
         };
       };
       /** @description The representation named by If-None-Match is current; no body. */
@@ -90792,33 +91684,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Unauthorized */
-      401: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Forbidden */
-      403: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Not Found */
-      404: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Not Acceptable */
       406: {
         headers: {
@@ -90848,15 +91713,138 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Too Many Requests */
-      429: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
+      /** @description Internal Server Error */
+      500: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Service Unavailable */
+      503: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+    };
+  };
+  getRatingsCapability: {
+    parameters: {
+      query?: never;
+      header: {
+        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
+        "If-Match"?: string;
+        "If-None-Match"?: string;
+        /** @description The household profile acting for this request; it must belong to the authenticated account. */
+        "X-Profile-Id": string;
+        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
+        "X-Profile-Token"?: string;
+      };
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description OK */
+      200: {
+        headers: {
+          "Cache-Control"?: string;
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/json": components["schemas"]["RatingsCapability"];
+        };
+      };
+      /** @description The representation named by If-None-Match is current; no body. */
+      304: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Bad Request */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unauthorized */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Forbidden */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Found */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Acceptable */
+      406: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Precondition Failed */
+      412: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unprocessable Entity */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Too Many Requests */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Internal Server Error */
       500: {
         headers: {
@@ -91012,6 +92000,8 @@ export interface operations {
   listCatalogItems: {
     parameters: {
       query?: {
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
         /** @description For source=library_collection or user_collection */
         collection_id?: string;
         /** @description Repeat the key for several ratings */
@@ -91023,18 +92013,24 @@ export interface operations {
         group?: "work";
         /** @description JSON array of structured rule groups; use POST catalog/query for larger queries */
         groups?: string;
-        /** @description Artwork variant to presign */
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
         image_size?: "small" | "medium" | "large" | "original";
         /** @description Restrict to one library; required for library sections */
         library_id?: string;
         /** @description Page size; default 50, maximum 200 */
         limit?: number;
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
         /** @description How the filters combine; default all */
         match?: "all" | "any";
         /** @description Alphabetical jump: only titles whose sort title (or title, when none is set) starts here */
         name_prefix?: string;
         /** @description For source=person */
         person_id?: string;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
         /** @description Search text */
         q?: string;
         /** @description Maximum items in the query result; zero means uncapped */
@@ -91061,6 +92057,8 @@ export interface operations {
           | "person";
         /** @description Metadata match state */
         status?: string;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
         /** @description Media scope: movie, series, episode, audiobook, ebook, manga, or video (movies and series). video_with_episodes, for source=query only, searches movies, series, and episodes when q is set and lists movies and series without q; check getCatalogSearchCapabilities.video_with_episodes_scope first */
         type?: string;
         year_max?: number;
@@ -91172,20 +92170,31 @@ export interface operations {
   listAudiobookGroups: {
     parameters: {
       query: {
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
         /** @description Opaque cursor from page.next_cursor */
         cursor?: string;
         group_by: "author" | "narrator" | "series";
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
         image_size?: "small" | "medium" | "large" | "original";
         /** @description The audiobook library */
         library_id: string;
         /** @description Page size; default 50, maximum 200 */
         limit?: number;
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
         /** @description Case-insensitive prefix on the group name */
         q?: string;
         /** @description true skips the exact count; the total is then an estimate */
         skip_total?: boolean;
         /** @description Default name */
         sort?: "name" | "count" | "duration";
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
@@ -91568,11 +92577,22 @@ export interface operations {
   getCatalogItem: {
     parameters: {
       query?: {
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
         /** @description The version the viewer selected; affects the effective playback answer */
         file_id?: string;
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
         image_size?: "small" | "medium" | "large" | "original";
         /** @description The library the item is being viewed in; picks its presentation when the item is in several */
         library_id?: string;
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The stable device identifier used to resolve device-scoped playback preferences; absent resolves the profile's preferences */
@@ -91685,11 +92705,22 @@ export interface operations {
   listCatalogItemEpisodes: {
     parameters: {
       query?: {
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
         /** @description The version the viewer selected; affects the effective playback answer */
         file_id?: string;
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
         image_size?: "small" | "medium" | "large" | "original";
         /** @description The library the item is being viewed in; picks its presentation when the item is in several */
         library_id?: string;
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
@@ -91800,11 +92831,22 @@ export interface operations {
   listCatalogItemMangaFiles: {
     parameters: {
       query?: {
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
         /** @description The version the viewer selected; affects the effective playback answer */
         file_id?: string;
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
         image_size?: "small" | "medium" | "large" | "original";
         /** @description The library the item is being viewed in; picks its presentation when the item is in several */
         library_id?: string;
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
@@ -92592,11 +93634,22 @@ export interface operations {
   listCatalogItemVersions: {
     parameters: {
       query?: {
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
         /** @description The version the viewer selected; affects the effective playback answer */
         file_id?: string;
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
         image_size?: "small" | "medium" | "large" | "original";
         /** @description The library the item is being viewed in; picks its presentation when the item is in several */
         library_id?: string;
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The stable device identifier used to resolve device-scoped playback preferences; absent resolves the profile's preferences */
@@ -93188,7 +94241,18 @@ export interface operations {
   queryCatalogItems: {
     parameters: {
       query?: {
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
         image_size?: "small" | "medium" | "large" | "original";
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
@@ -93459,11 +94523,22 @@ export interface operations {
   listSeriesSeasons: {
     parameters: {
       query?: {
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
         image_size?: "small" | "medium" | "large" | "original";
         /** @description Include poster URLs and thumbhashes; false skips poster preparation */
         include_artwork?: boolean;
         /** @description The library the series is being viewed in */
         library_id?: string;
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
@@ -93574,9 +94649,20 @@ export interface operations {
   getSeriesSeason: {
     parameters: {
       query?: {
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
         image_size?: "small" | "medium" | "large" | "original";
         /** @description The library the series is being viewed in */
         library_id?: string;
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
@@ -93689,9 +94775,20 @@ export interface operations {
   listSeasonEpisodes: {
     parameters: {
       query?: {
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
         image_size?: "small" | "medium" | "large" | "original";
         /** @description The library the series is being viewed in */
         library_id?: string;
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
@@ -97349,10 +98446,124 @@ export interface operations {
       };
     };
   };
-  importTraktCollection: {
+  getCollectionOrder: {
+    parameters: {
+      query?: {
+        /** @description Omit: personal collection groups are no longer supported, and any value is a validation failure */
+        group_id?: string;
+      };
+      header: {
+        /** @description The household profile acting for this request; it must belong to the authenticated account. */
+        "X-Profile-Id": string;
+        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
+        "X-Profile-Token"?: string;
+      };
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description OK */
+      200: {
+        headers: {
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/json": components["schemas"]["CollectionOrder"];
+        };
+      };
+      /** @description Bad Request */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unauthorized */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Forbidden */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Found */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Acceptable */
+      406: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unprocessable Entity */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Too Many Requests */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Internal Server Error */
+      500: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Service Unavailable */
+      503: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+    };
+  };
+  reorderCollections: {
     parameters: {
       query?: never;
       header: {
+        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
+        "If-Match": string;
+        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
+        "If-None-Match"?: string;
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
         "X-Profile-Id": string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
@@ -97363,18 +98574,19 @@ export interface operations {
     };
     requestBody: {
       content: {
-        "application/json": components["schemas"]["TraktCollectionImport"];
+        "application/json": components["schemas"]["CollectionOrder"];
       };
     };
     responses: {
-      /** @description Created */
-      201: {
+      /** @description OK */
+      200: {
         headers: {
-          Location?: string;
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["CollectionImportResult"];
+          "application/json": components["schemas"]["CollectionOrder"];
         };
       };
       /** @description Bad Request */
@@ -97431,6 +98643,17 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Precondition Failed */
+      412: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Request Entity Too Large */
       413: {
         headers: {
@@ -97458,6 +98681,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Precondition Required */
+      428: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Too Many Requests */
       429: {
         headers: {
@@ -97487,12 +98719,9 @@ export interface operations {
       };
     };
   };
-  getCollectionOrder: {
+  previewCollection: {
     parameters: {
-      query?: {
-        /** @description Omit: personal collection groups are no longer supported, and any value is a validation failure */
-        group_id?: string;
-      };
+      query?: never;
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
         "X-Profile-Id": string;
@@ -97502,16 +98731,19 @@ export interface operations {
       path?: never;
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["PersonalCollectionPreviewInputBody"];
+      };
+    };
     responses: {
       /** @description OK */
       200: {
         headers: {
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["CollectionOrder"];
+          "application/json": components["schemas"]["PersonalCollectionPreviewOutputBody"];
         };
       };
       /** @description Bad Request */
@@ -97559,6 +98791,33 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Request Entity Too Large */
+      413: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unsupported Media Type */
+      415: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -97597,14 +98856,10 @@ export interface operations {
       };
     };
   };
-  reorderCollections: {
+  listServerCollections: {
     parameters: {
       query?: never;
       header: {
-        /** @description The resource's current ETag, or "*" to overwrite deliberately. A missing field is 428 precondition_required; a stale tag is 412 precondition_failed with the current ETag. */
-        "If-Match": string;
-        /** @description Optional second precondition, evaluated after If-Match succeeds: "*" or any tag matching the current representation is 412 precondition_failed with the current ETag. */
-        "If-None-Match"?: string;
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
         "X-Profile-Id": string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
@@ -97613,21 +98868,15 @@ export interface operations {
       path?: never;
       cookie?: never;
     };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["CollectionOrder"];
-      };
-    };
+    requestBody?: never;
     responses: {
       /** @description OK */
       200: {
         headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["CollectionOrder"];
+          "application/json": components["schemas"]["ServerCollectionsOutputBody"];
         };
       };
       /** @description Bad Request */
@@ -97675,44 +98924,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Precondition Failed */
-      412: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -97722,15 +98933,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Required */
-      428: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Too Many Requests */
       429: {
         headers: {
@@ -97760,7 +98962,7 @@ export interface operations {
       };
     };
   };
-  previewCollection: {
+  setCollectionSortPreference: {
     parameters: {
       query?: never;
       header: {
@@ -97774,7 +98976,7 @@ export interface operations {
     };
     requestBody: {
       content: {
-        "application/json": components["schemas"]["PersonalCollectionPreviewInputBody"];
+        "application/json": components["schemas"]["CollectionSortPreference"];
       };
     };
     responses: {
@@ -97784,7 +98986,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["PersonalCollectionPreviewOutputBody"];
+          "application/json": components["schemas"]["CollectionSortPreference"];
         };
       };
       /** @description Bad Request */
@@ -97897,9 +99099,13 @@ export interface operations {
       };
     };
   };
-  listServerCollections: {
+  clearCollectionSortPreference: {
     parameters: {
-      query?: never;
+      query: {
+        /** @description Opaque identifier */
+        collection_id?: string;
+        collection_kind: "library" | "user" | "watchlist" | "favorites";
+      };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
         "X-Profile-Id": string;
@@ -97911,14 +99117,12 @@ export interface operations {
     };
     requestBody?: never;
     responses: {
-      /** @description OK */
-      200: {
+      /** @description No Content */
+      204: {
         headers: {
           [name: string]: unknown;
         };
-        content: {
-          "application/json": components["schemas"]["ServerCollectionsOutputBody"];
-        };
+        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -98003,7 +99207,7 @@ export interface operations {
       };
     };
   };
-  setCollectionSortPreference: {
+  listCollectionTemplates: {
     parameters: {
       query?: never;
       header: {
@@ -98015,11 +99219,7 @@ export interface operations {
       path?: never;
       cookie?: never;
     };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["CollectionSortPreference"];
-      };
-    };
+    requestBody?: never;
     responses: {
       /** @description OK */
       200: {
@@ -98027,7 +99227,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["CollectionSortPreference"];
+          "application/json": components["schemas"]["CollectionTemplateCatalog"];
         };
       };
       /** @description Bad Request */
@@ -98075,8 +99275,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
+      /** @description Unprocessable Entity */
+      422: {
         headers: {
           [name: string]: unknown;
         };
@@ -98084,8 +99284,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Entity Too Large */
-      413: {
+      /** @description Too Many Requests */
+      429: {
         headers: {
           [name: string]: unknown;
         };
@@ -98093,8 +99293,64 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Unsupported Media Type */
-      415: {
+      /** @description Internal Server Error */
+      500: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Service Unavailable */
+      503: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+    };
+  };
+  getCompatConnectInfo: {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description OK */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/json": components["schemas"]["CompatConnectInfoResponse"];
+        };
+      };
+      /** @description Bad Request */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unauthorized */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Acceptable */
+      406: {
         headers: {
           [name: string]: unknown;
         };
@@ -98140,14 +99396,16 @@ export interface operations {
       };
     };
   };
-  clearCollectionSortPreference: {
+  listDevices: {
     parameters: {
-      query: {
-        /** @description Opaque identifier */
-        collection_id?: string;
-        collection_kind: "library" | "user" | "watchlist" | "favorites";
+      query?: {
+        cursor?: string;
+        /** @description Page size; default 50, maximum 200 */
+        limit?: number;
+        scope?: "profile" | "household";
       };
       header: {
+        "X-Prairie-Device-Id"?: string;
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
         "X-Profile-Id": string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
@@ -98158,12 +99416,14 @@ export interface operations {
     };
     requestBody?: never;
     responses: {
-      /** @description No Content */
-      204: {
+      /** @description OK */
+      200: {
         headers: {
           [name: string]: unknown;
         };
-        content?: never;
+        content: {
+          "application/json": components["schemas"]["DeviceSettingsCollection"];
+        };
       };
       /** @description Bad Request */
       400: {
@@ -98248,28 +99508,31 @@ export interface operations {
       };
     };
   };
-  listCollectionTemplates: {
+  forgetDevice: {
     parameters: {
-      query?: never;
+      query?: {
+        /** @description Another profile on the account; requires household management authority */
+        profile_id?: string;
+      };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
         "X-Profile-Id": string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
+      path: {
+        device_id: string;
+      };
       cookie?: never;
     };
     requestBody?: never;
     responses: {
-      /** @description OK */
-      200: {
+      /** @description No Content */
+      204: {
         headers: {
           [name: string]: unknown;
         };
-        content: {
-          "application/json": components["schemas"]["CollectionTemplateCatalog"];
-        };
+        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -98354,96 +99617,11 @@ export interface operations {
       };
     };
   };
-  getCompatConnectInfo: {
-    parameters: {
-      query?: never;
-      header?: never;
-      path?: never;
-      cookie?: never;
-    };
-    requestBody?: never;
-    responses: {
-      /** @description OK */
-      200: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/json": components["schemas"]["CompatConnectInfoResponse"];
-        };
-      };
-      /** @description Bad Request */
-      400: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unauthorized */
-      401: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Not Acceptable */
-      406: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unprocessable Entity */
-      422: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Too Many Requests */
-      429: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Internal Server Error */
-      500: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Service Unavailable */
-      503: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-    };
-  };
-  listDevices: {
+  updateDevice: {
     parameters: {
       query?: {
-        cursor?: string;
-        /** @description Page size; default 50, maximum 200 */
-        limit?: number;
-        scope?: "profile" | "household";
+        /** @description Another profile on the account; requires household management authority */
+        profile_id?: string;
       };
       header: {
         "X-Prairie-Device-Id"?: string;
@@ -98452,10 +99630,16 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
+      path: {
+        device_id: string;
+      };
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["DeviceUpdate"];
+      };
+    };
     responses: {
       /** @description OK */
       200: {
@@ -98463,7 +99647,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["DeviceSettingsCollection"];
+          "application/json": components["schemas"]["DeviceSettings"];
         };
       };
       /** @description Bad Request */
@@ -98511,90 +99695,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Unprocessable Entity */
-      422: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Too Many Requests */
-      429: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Internal Server Error */
-      500: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Service Unavailable */
-      503: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-    };
-  };
-  forgetDevice: {
-    parameters: {
-      query?: {
-        /** @description Another profile on the account; requires household management authority */
-        profile_id?: string;
-      };
-      header: {
-        /** @description The household profile acting for this request; it must belong to the authenticated account. */
-        "X-Profile-Id": string;
-        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
-        "X-Profile-Token"?: string;
-      };
-      path: {
-        device_id: string;
-      };
-      cookie?: never;
-    };
-    requestBody?: never;
-    responses: {
-      /** @description No Content */
-      204: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content?: never;
-      };
-      /** @description Bad Request */
-      400: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unauthorized */
-      401: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Forbidden */
-      403: {
+      /** @description Request Timeout */
+      408: {
         headers: {
           [name: string]: unknown;
         };
@@ -98602,8 +99704,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Not Found */
-      404: {
+      /** @description Request Entity Too Large */
+      413: {
         headers: {
           [name: string]: unknown;
         };
@@ -98611,8 +99713,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Not Acceptable */
-      406: {
+      /** @description Unsupported Media Type */
+      415: {
         headers: {
           [name: string]: unknown;
         };
@@ -105524,12 +106626,22 @@ export interface operations {
   listFavorites: {
     parameters: {
       query?: {
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
         /** @description Opaque cursor from page.next_cursor */
         cursor?: string;
-        /** @description Artwork variant to presign; absent picks each surface's default */
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
         image_size?: "small" | "medium" | "large" | "original";
         /** @description Page size; default 50, maximum 200 */
         limit?: number;
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
@@ -105960,12 +107072,22 @@ export interface operations {
   listHistory: {
     parameters: {
       query?: {
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
         /** @description Opaque cursor from page.next_cursor */
         cursor?: string;
-        /** @description Artwork variant to presign; absent picks each surface's default */
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
         image_size?: "small" | "medium" | "large" | "original";
         /** @description Page size; default 50, maximum 200 */
         limit?: number;
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
@@ -107580,10 +108702,20 @@ export interface operations {
   getHomeLayout: {
     parameters: {
       query?: {
-        /** @description Artwork variant to presign for included_sections, as on getHomeSectionItems; absent picks each surface's default */
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
         image_size?: "small" | "medium" | "large" | "original";
         /** @description Also answer the cards of the first N sections in display order (featured sections count where they appear) in included_sections, saving a getHomeSectionItems call per row. 0 answers the layout alone. Send it only when getHomeCapabilities reports include_items_max; an older server rejects the parameter */
         include_items?: number;
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
@@ -107691,8 +108823,18 @@ export interface operations {
   listHomeSections: {
     parameters: {
       query?: {
-        /** @description Artwork variant to presign; absent picks each surface's default */
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
         image_size?: "small" | "medium" | "large" | "original";
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
@@ -107800,8 +108942,18 @@ export interface operations {
   getHomeSectionItems: {
     parameters: {
       query?: {
-        /** @description Artwork variant to presign; absent picks each surface's default */
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
         image_size?: "small" | "medium" | "large" | "original";
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
@@ -111412,6 +112564,8 @@ export interface operations {
       query?: {
         /** @description Opaque cursor from page.next_cursor */
         cursor?: string;
+        /** @description List the items an admin marked as intentionally unmatched instead of the ones awaiting a match */
+        ignored?: boolean;
         /** @description Page size; default 50, maximum 200 */
         limit?: number;
         /** @description Case-insensitive substring over title, type, status and library name */
@@ -111520,43 +112674,26 @@ export interface operations {
       };
     };
   };
-  getLibraryJob: {
+  ignoreUnmatchedItem: {
     parameters: {
       query?: never;
       header?: {
-        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
-        "If-Match"?: string;
-        "If-None-Match"?: string;
-        /** @description Optional. When present, it must name a profile of the authenticated account. */
+        /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
       path: {
-        job_id: string;
+        /** @description The catalog item */
+        content_id: string;
       };
       cookie?: never;
     };
     requestBody?: never;
     responses: {
-      /** @description OK */
-      200: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          Location?: string;
-          "Retry-After"?: string;
-          [name: string]: unknown;
-        };
-        content: {
-          "application/json": components["schemas"]["AdminJob"];
-        };
-      };
-      /** @description The representation named by If-None-Match is current; no body. */
-      304: {
+      /** @description No Content */
+      204: {
         headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
           [name: string]: unknown;
         };
         content?: never;
@@ -111606,11 +112743,9 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Failed */
-      412: {
+      /** @description Conflict */
+      409: {
         headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
@@ -111655,7 +112790,7 @@ export interface operations {
       };
     };
   };
-  cancelLibraryJob: {
+  unignoreUnmatchedItem: {
     parameters: {
       query?: never;
       header?: {
@@ -111665,34 +112800,19 @@ export interface operations {
         "X-Profile-Token"?: string;
       };
       path: {
-        job_id: string;
+        /** @description The catalog item */
+        content_id: string;
       };
       cookie?: never;
     };
     requestBody?: never;
     responses: {
-      /** @description The job was already canceled. */
-      200: {
-        headers: {
-          ETag?: string;
-          Location?: string;
-          [name: string]: unknown;
-        };
-        content: {
-          "application/json": components["schemas"]["AdminJob"];
-        };
-      };
-      /** @description Accepted */
-      202: {
+      /** @description No Content */
+      204: {
         headers: {
-          ETag?: string;
-          Location?: string;
-          "Retry-After"?: string;
           [name: string]: unknown;
         };
-        content: {
-          "application/json": components["schemas"]["AdminJob"];
-        };
+        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -111739,15 +112859,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Conflict */
-      409: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -111786,16 +112897,21 @@ export interface operations {
       };
     };
   };
-  listLibraryPlaybackPreferences: {
+  getLibraryJob: {
     parameters: {
       query?: never;
-      header: {
-        /** @description The household profile acting for this request; it must belong to the authenticated account. */
-        "X-Profile-Id": string;
+      header?: {
+        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
+        "If-Match"?: string;
+        "If-None-Match"?: string;
+        /** @description Optional. When present, it must name a profile of the authenticated account. */
+        "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
+      path: {
+        job_id: string;
+      };
       cookie?: never;
     };
     requestBody?: never;
@@ -111803,11 +112919,24 @@ export interface operations {
       /** @description OK */
       200: {
         headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          Location?: string;
+          "Retry-After"?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["LibraryPlaybackPreferenceCollection"];
+          "application/json": components["schemas"]["AdminJob"];
+        };
+      };
+      /** @description The representation named by If-None-Match is current; no body. */
+      304: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
         };
+        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -111854,6 +112983,17 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Precondition Failed */
+      412: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -111892,29 +113032,44 @@ export interface operations {
       };
     };
   };
-  deleteLibraryPlaybackPreference: {
+  cancelLibraryJob: {
     parameters: {
       query?: never;
-      header: {
-        /** @description The household profile acting for this request; it must belong to the authenticated account. */
-        "X-Profile-Id": string;
+      header?: {
+        /** @description Optional. When present, it must name the authenticated account's primary profile; an absent header is accepted. */
+        "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
       path: {
-        /** @description The library */
-        library_id: string;
+        job_id: string;
       };
       cookie?: never;
     };
     requestBody?: never;
     responses: {
-      /** @description No Content */
-      204: {
+      /** @description The job was already canceled. */
+      200: {
         headers: {
+          ETag?: string;
+          Location?: string;
           [name: string]: unknown;
         };
-        content?: never;
+        content: {
+          "application/json": components["schemas"]["AdminJob"];
+        };
+      };
+      /** @description Accepted */
+      202: {
+        headers: {
+          ETag?: string;
+          Location?: string;
+          "Retry-After"?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/json": components["schemas"]["AdminJob"];
+        };
       };
       /** @description Bad Request */
       400: {
@@ -111961,6 +113116,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Conflict */
+      409: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -111999,7 +113163,7 @@ export interface operations {
       };
     };
   };
-  updateLibraryPlaybackPreference: {
+  listLibraryPlaybackPreferences: {
     parameters: {
       query?: never;
       header: {
@@ -112008,24 +113172,19 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        /** @description The library */
-        library_id: string;
-      };
+      path?: never;
       cookie?: never;
     };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["LibraryPlaybackPreferenceUpdate"];
-      };
-    };
+    requestBody?: never;
     responses: {
-      /** @description No Content */
-      204: {
+      /** @description OK */
+      200: {
         headers: {
           [name: string]: unknown;
         };
-        content?: never;
+        content: {
+          "application/json": components["schemas"]["LibraryPlaybackPreferenceCollection"];
+        };
       };
       /** @description Bad Request */
       400: {
@@ -112072,8 +113231,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
+      /** @description Unprocessable Entity */
+      422: {
         headers: {
           [name: string]: unknown;
         };
@@ -112081,8 +113240,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Entity Too Large */
-      413: {
+      /** @description Too Many Requests */
+      429: {
         headers: {
           [name: string]: unknown;
         };
@@ -112090,8 +113249,88 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Unsupported Media Type */
-      415: {
+      /** @description Internal Server Error */
+      500: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Service Unavailable */
+      503: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+    };
+  };
+  deleteLibraryPlaybackPreference: {
+    parameters: {
+      query?: never;
+      header: {
+        /** @description The household profile acting for this request; it must belong to the authenticated account. */
+        "X-Profile-Id": string;
+        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
+        "X-Profile-Token"?: string;
+      };
+      path: {
+        /** @description The library */
+        library_id: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description No Content */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Bad Request */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unauthorized */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Forbidden */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Found */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Acceptable */
+      406: {
         headers: {
           [name: string]: unknown;
         };
@@ -112137,7 +113376,7 @@ export interface operations {
       };
     };
   };
-  getLibraryCollections: {
+  updateLibraryPlaybackPreference: {
     parameters: {
       query?: never;
       header: {
@@ -112147,21 +113386,23 @@ export interface operations {
         "X-Profile-Token"?: string;
       };
       path: {
-        /** @description Library identifier */
-        id: string;
+        /** @description The library */
+        library_id: string;
       };
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["LibraryPlaybackPreferenceUpdate"];
+      };
+    };
     responses: {
-      /** @description OK */
-      200: {
+      /** @description No Content */
+      204: {
         headers: {
           [name: string]: unknown;
         };
-        content: {
-          "application/json": components["schemas"]["LibraryCollectionTab"];
-        };
+        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -112208,6 +113449,33 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Request Entity Too Large */
+      413: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unsupported Media Type */
+      415: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -112246,13 +113514,9 @@ export interface operations {
       };
     };
   };
-  getLibraryCollectionItems: {
+  getLibraryCollections: {
     parameters: {
-      query?: {
-        cursor?: string;
-        /** @description Page size; default 50, maximum 200 */
-        limit?: number;
-      };
+      query?: never;
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
         "X-Profile-Id": string;
@@ -112260,9 +113524,7 @@ export interface operations {
         "X-Profile-Token"?: string;
       };
       path: {
-        /** @description Opaque identifier */
-        collection_id: string;
-        /** @description Opaque identifier */
+        /** @description Library identifier */
         id: string;
       };
       cookie?: never;
@@ -112275,7 +113537,122 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["CatalogItemCollection"];
+          "application/json": components["schemas"]["LibraryCollectionTab"];
+        };
+      };
+      /** @description Bad Request */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unauthorized */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Forbidden */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Found */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Acceptable */
+      406: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unprocessable Entity */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Too Many Requests */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Internal Server Error */
+      500: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Service Unavailable */
+      503: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+    };
+  };
+  getLibraryCollectionItems: {
+    parameters: {
+      query?: {
+        cursor?: string;
+        /** @description Page size; default 50, maximum 200 */
+        limit?: number;
+      };
+      header: {
+        /** @description The household profile acting for this request; it must belong to the authenticated account. */
+        "X-Profile-Id": string;
+        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
+        "X-Profile-Token"?: string;
+      };
+      path: {
+        /** @description Opaque identifier */
+        collection_id: string;
+        /** @description Opaque identifier */
+        id: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description OK */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/json": components["schemas"]["CatalogItemCollection"];
         };
       };
       /** @description Bad Request */
@@ -112473,8 +113850,18 @@ export interface operations {
   listLibrarySections: {
     parameters: {
       query?: {
-        /** @description Artwork variant to presign; absent picks each surface's default */
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
         image_size?: "small" | "medium" | "large" | "original";
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
@@ -112585,8 +113972,18 @@ export interface operations {
   getLibrarySectionItems: {
     parameters: {
       query?: {
-        /** @description Artwork variant to presign; absent picks each surface's default */
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
         image_size?: "small" | "medium" | "large" | "original";
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
@@ -115024,13 +116421,25 @@ export interface operations {
       };
     };
   };
-  listNotifications: {
+  listNotInterested: {
     parameters: {
       query?: {
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
+        /** @description Opaque cursor from page.next_cursor */
         cursor?: string;
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
+        image_size?: "small" | "medium" | "large" | "original";
         /** @description Page size; default 50, maximum 200 */
         limit?: number;
-        status?: "all" | "unread";
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
@@ -115049,7 +116458,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["NotificationListOutputBody"];
+          "application/json": components["schemas"]["NotInterestedCollection"];
         };
       };
       /** @description Bad Request */
@@ -115135,7 +116544,7 @@ export interface operations {
       };
     };
   };
-  getNotification: {
+  getNotInterested: {
     parameters: {
       query?: never;
       header: {
@@ -115145,8 +116554,8 @@ export interface operations {
         "X-Profile-Token"?: string;
       };
       path: {
-        /** @description Opaque identifier */
-        id: string;
+        /** @description Catalog item identifier of a movie or series */
+        item_id: string;
       };
       cookie?: never;
     };
@@ -115158,7 +116567,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["NotificationItem"];
+          "application/json": components["schemas"]["NotInterestedEntry"];
         };
       };
       /** @description Bad Request */
@@ -115244,7 +116653,7 @@ export interface operations {
       };
     };
   };
-  markNotificationRead: {
+  markNotInterested: {
     parameters: {
       query?: never;
       header: {
@@ -115254,8 +116663,8 @@ export interface operations {
         "X-Profile-Token"?: string;
       };
       path: {
-        /** @description Opaque identifier */
-        id: string;
+        /** @description Catalog item identifier of a movie or series */
+        item_id: string;
       };
       cookie?: never;
     };
@@ -115351,40 +116760,26 @@ export interface operations {
       };
     };
   };
-  getNotificationCapabilities: {
+  unmarkNotInterested: {
     parameters: {
       query?: never;
       header: {
-        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
-        "If-Match"?: string;
-        "If-None-Match"?: string;
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
         "X-Profile-Id": string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
+      path: {
+        /** @description Catalog item identifier of a movie or series */
+        item_id: string;
+      };
       cookie?: never;
     };
     requestBody?: never;
     responses: {
-      /** @description OK */
-      200: {
-        headers: {
-          "Cache-Control"?: string;
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
-        };
-        content: {
-          "application/json": components["schemas"]["NotificationCapabilities"];
-        };
-      };
-      /** @description The representation named by If-None-Match is current; no body. */
-      304: {
+      /** @description No Content */
+      204: {
         headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
           [name: string]: unknown;
         };
         content?: never;
@@ -115434,17 +116829,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Failed */
-      412: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -115483,12 +116867,17 @@ export interface operations {
       };
     };
   };
-  unlinkNotificationDiscord: {
+  listNotifications: {
     parameters: {
-      query?: never;
-      header?: {
-        /** @description Optional. When present, it must name a profile of the authenticated account. */
-        "X-Profile-Id"?: string;
+      query?: {
+        cursor?: string;
+        /** @description Page size; default 50, maximum 200 */
+        limit?: number;
+        status?: "all" | "unread";
+      };
+      header: {
+        /** @description The household profile acting for this request; it must belong to the authenticated account. */
+        "X-Profile-Id": string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
@@ -115497,12 +116886,14 @@ export interface operations {
     };
     requestBody?: never;
     responses: {
-      /** @description No Content */
-      204: {
+      /** @description OK */
+      200: {
         headers: {
           [name: string]: unknown;
         };
-        content?: never;
+        content: {
+          "application/json": components["schemas"]["NotificationListOutputBody"];
+        };
       };
       /** @description Bad Request */
       400: {
@@ -115587,16 +116978,19 @@ export interface operations {
       };
     };
   };
-  getNotificationDiscordPreferences: {
+  getNotification: {
     parameters: {
       query?: never;
-      header?: {
-        /** @description Optional. When present, it must name a profile of the authenticated account. */
-        "X-Profile-Id"?: string;
+      header: {
+        /** @description The household profile acting for this request; it must belong to the authenticated account. */
+        "X-Profile-Id": string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
+      path: {
+        /** @description Opaque identifier */
+        id: string;
+      };
       cookie?: never;
     };
     requestBody?: never;
@@ -115607,7 +117001,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["NotificationDiscordPreferences"];
+          "application/json": components["schemas"]["NotificationItem"];
         };
       };
       /** @description Bad Request */
@@ -115693,32 +117087,29 @@ export interface operations {
       };
     };
   };
-  updateNotificationDiscordPreferences: {
+  markNotificationRead: {
     parameters: {
       query?: never;
-      header?: {
-        /** @description Optional. When present, it must name a profile of the authenticated account. */
-        "X-Profile-Id"?: string;
+      header: {
+        /** @description The household profile acting for this request; it must belong to the authenticated account. */
+        "X-Profile-Id": string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
-      cookie?: never;
-    };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["NotificationChannelModeInputBody"];
+      path: {
+        /** @description Opaque identifier */
+        id: string;
       };
+      cookie?: never;
     };
+    requestBody?: never;
     responses: {
-      /** @description OK */
-      200: {
+      /** @description No Content */
+      204: {
         headers: {
           [name: string]: unknown;
         };
-        content: {
-          "application/json": components["schemas"]["NotificationDiscordPreferences"];
-        };
+        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -115765,33 +117156,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -115830,27 +117194,125 @@ export interface operations {
       };
     };
   };
-  completeNotificationDiscordLink: {
+  getNotificationCapabilities: {
     parameters: {
-      query?: {
-        code?: string;
-        error?: string;
-        state?: string;
+      query?: never;
+      header: {
+        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
+        "If-Match"?: string;
+        "If-None-Match"?: string;
+        /** @description The household profile acting for this request; it must belong to the authenticated account. */
+        "X-Profile-Id": string;
+        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
+        "X-Profile-Token"?: string;
       };
-      header?: never;
       path?: never;
       cookie?: never;
     };
     requestBody?: never;
     responses: {
-      /** @description Consent outcome redirect to notification settings */
-      302: {
+      /** @description OK */
+      200: {
         headers: {
-          Location?: string;
+          "Cache-Control"?: string;
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "text/html": string;
+          "application/json": components["schemas"]["NotificationCapabilities"];
+        };
+      };
+      /** @description The representation named by If-None-Match is current; no body. */
+      304: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Bad Request */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unauthorized */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Forbidden */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Found */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Acceptable */
+      406: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Precondition Failed */
+      412: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unprocessable Entity */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Too Many Requests */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Internal Server Error */
+      500: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
         };
       };
       /** @description Service Unavailable */
@@ -115864,7 +117326,7 @@ export interface operations {
       };
     };
   };
-  beginNotificationDiscordLink: {
+  unlinkNotificationDiscord: {
     parameters: {
       query?: never;
       header?: {
@@ -115878,14 +117340,12 @@ export interface operations {
     };
     requestBody?: never;
     responses: {
-      /** @description OK */
-      200: {
+      /** @description No Content */
+      204: {
         headers: {
           [name: string]: unknown;
         };
-        content: {
-          "application/json": components["schemas"]["NotificationDiscordLink"];
-        };
+        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -115970,12 +117430,12 @@ export interface operations {
       };
     };
   };
-  getNotificationEmailPreferences: {
+  getNotificationDiscordPreferences: {
     parameters: {
       query?: never;
-      header: {
-        /** @description The household profile acting for this request; it must belong to the authenticated account. */
-        "X-Profile-Id": string;
+      header?: {
+        /** @description Optional. When present, it must name a profile of the authenticated account. */
+        "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
@@ -115990,7 +117450,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["NotificationEmailPreferences"];
+          "application/json": components["schemas"]["NotificationDiscordPreferences"];
         };
       };
       /** @description Bad Request */
@@ -116076,12 +117536,12 @@ export interface operations {
       };
     };
   };
-  updateNotificationEmailPreferences: {
+  updateNotificationDiscordPreferences: {
     parameters: {
       query?: never;
-      header: {
-        /** @description The household profile acting for this request; it must belong to the authenticated account. */
-        "X-Profile-Id": string;
+      header?: {
+        /** @description Optional. When present, it must name a profile of the authenticated account. */
+        "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
@@ -116100,7 +117560,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["NotificationEmailPreferences"];
+          "application/json": components["schemas"]["NotificationDiscordPreferences"];
         };
       };
       /** @description Bad Request */
@@ -116213,23 +117673,53 @@ export interface operations {
       };
     };
   };
-  requestNotificationEmailVerification: {
+  completeNotificationDiscordLink: {
+    parameters: {
+      query?: {
+        code?: string;
+        error?: string;
+        state?: string;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Consent outcome redirect to notification settings */
+      302: {
+        headers: {
+          Location?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "text/html": string;
+        };
+      };
+      /** @description Service Unavailable */
+      503: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+    };
+  };
+  beginNotificationDiscordLink: {
     parameters: {
       query?: never;
-      header: {
-        /** @description The household profile acting for this request; it must belong to the authenticated account. */
-        "X-Profile-Id": string;
+      header?: {
+        /** @description Optional. When present, it must name a profile of the authenticated account. */
+        "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
       path?: never;
       cookie?: never;
     };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["NotificationEmailVerificationInputBody"];
-      };
-    };
+    requestBody?: never;
     responses: {
       /** @description OK */
       200: {
@@ -116237,7 +117727,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["NotificationEmailVerificationReceipt"];
+          "application/json": components["schemas"]["NotificationDiscordLink"];
         };
       };
       /** @description Bad Request */
@@ -116285,42 +117775,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Conflict */
-      409: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -116359,7 +117813,7 @@ export interface operations {
       };
     };
   };
-  clearNotificationEmailAddress: {
+  getNotificationEmailPreferences: {
     parameters: {
       query?: never;
       header: {
@@ -116465,13 +117919,10 @@ export interface operations {
       };
     };
   };
-  getNotificationEmailVerificationCapabilities: {
+  updateNotificationEmailPreferences: {
     parameters: {
       query?: never;
       header: {
-        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
-        "If-Match"?: string;
-        "If-None-Match"?: string;
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
         "X-Profile-Id": string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
@@ -116480,28 +117931,420 @@ export interface operations {
       path?: never;
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["NotificationChannelModeInputBody"];
+      };
+    };
     responses: {
       /** @description OK */
       200: {
         headers: {
-          "Cache-Control"?: string;
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["NotificationEmailVerificationCapability"];
-        };
-      };
-      /** @description The representation named by If-None-Match is current; no body. */
-      304: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
+          "application/json": components["schemas"]["NotificationEmailPreferences"];
         };
-        content?: never;
+      };
+      /** @description Bad Request */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unauthorized */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Forbidden */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Found */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Acceptable */
+      406: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Request Entity Too Large */
+      413: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unsupported Media Type */
+      415: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unprocessable Entity */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Too Many Requests */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Internal Server Error */
+      500: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Service Unavailable */
+      503: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+    };
+  };
+  requestNotificationEmailVerification: {
+    parameters: {
+      query?: never;
+      header: {
+        /** @description The household profile acting for this request; it must belong to the authenticated account. */
+        "X-Profile-Id": string;
+        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
+        "X-Profile-Token"?: string;
+      };
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["NotificationEmailVerificationInputBody"];
+      };
+    };
+    responses: {
+      /** @description OK */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/json": components["schemas"]["NotificationEmailVerificationReceipt"];
+        };
+      };
+      /** @description Bad Request */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unauthorized */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Forbidden */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Found */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Acceptable */
+      406: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Conflict */
+      409: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Request Entity Too Large */
+      413: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unsupported Media Type */
+      415: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unprocessable Entity */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Too Many Requests */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Internal Server Error */
+      500: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Service Unavailable */
+      503: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+    };
+  };
+  clearNotificationEmailAddress: {
+    parameters: {
+      query?: never;
+      header: {
+        /** @description The household profile acting for this request; it must belong to the authenticated account. */
+        "X-Profile-Id": string;
+        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
+        "X-Profile-Token"?: string;
+      };
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description OK */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/json": components["schemas"]["NotificationEmailPreferences"];
+        };
+      };
+      /** @description Bad Request */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unauthorized */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Forbidden */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Found */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Acceptable */
+      406: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unprocessable Entity */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Too Many Requests */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Internal Server Error */
+      500: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Service Unavailable */
+      503: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+    };
+  };
+  getNotificationEmailVerificationCapabilities: {
+    parameters: {
+      query?: never;
+      header: {
+        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
+        "If-Match"?: string;
+        "If-None-Match"?: string;
+        /** @description The household profile acting for this request; it must belong to the authenticated account. */
+        "X-Profile-Id": string;
+        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
+        "X-Profile-Token"?: string;
+      };
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description OK */
+      200: {
+        headers: {
+          "Cache-Control"?: string;
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/json": components["schemas"]["NotificationEmailVerificationCapability"];
+        };
+      };
+      /** @description The representation named by If-None-Match is current; no body. */
+      304: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -117278,7 +119121,532 @@ export interface operations {
       };
     };
   };
-  unregisterPushDevice: {
+  unregisterPushDevice: {
+    parameters: {
+      query?: never;
+      header: {
+        /** @description The household profile acting for this request; it must belong to the authenticated account. */
+        "X-Profile-Id": string;
+        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
+        "X-Profile-Token"?: string;
+        /** @description Positive decimal int64, persisted and incremented for each new installation intent across account/profile switches. Reuse exactly after uncertainty. */
+        "X-Push-Generation": string;
+        /** @description Secret 32-byte base64url installation credential. Persist privately; never rotate on retry or account switch. */
+        "X-Push-Installation-Key": string;
+      };
+      path: {
+        device_id: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description No Content */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Bad Request */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unauthorized */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Forbidden */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Found */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Acceptable */
+      406: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Conflict */
+      409: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unprocessable Entity */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Too Many Requests */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Internal Server Error */
+      500: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Service Unavailable */
+      503: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+    };
+  };
+  getPushRegistrationCapabilities: {
+    parameters: {
+      query?: never;
+      header: {
+        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
+        "If-Match"?: string;
+        "If-None-Match"?: string;
+        /** @description The household profile acting for this request; it must belong to the authenticated account. */
+        "X-Profile-Id": string;
+        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
+        "X-Profile-Token"?: string;
+      };
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description OK */
+      200: {
+        headers: {
+          "Cache-Control"?: string;
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/json": components["schemas"]["AndroidPushRegistrationCapability"];
+        };
+      };
+      /** @description The representation named by If-None-Match is current; no body. */
+      304: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Bad Request */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unauthorized */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Forbidden */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Found */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Acceptable */
+      406: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Precondition Failed */
+      412: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unprocessable Entity */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Too Many Requests */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Internal Server Error */
+      500: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Service Unavailable */
+      503: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+    };
+  };
+  markNotificationsRead: {
+    parameters: {
+      query?: never;
+      header: {
+        /** @description The household profile acting for this request; it must belong to the authenticated account. */
+        "X-Profile-Id": string;
+        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
+        "X-Profile-Token"?: string;
+      };
+      path?: never;
+      cookie?: never;
+    };
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["NotificationReadAllInputBody"];
+      };
+    };
+    responses: {
+      /** @description No Content */
+      204: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Bad Request */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unauthorized */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Forbidden */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Found */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Acceptable */
+      406: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Request Entity Too Large */
+      413: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unsupported Media Type */
+      415: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unprocessable Entity */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Too Many Requests */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Internal Server Error */
+      500: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Service Unavailable */
+      503: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+    };
+  };
+  listNotificationSeries: {
+    parameters: {
+      query?: {
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
+        /** @description Opaque cursor from page.next_cursor */
+        cursor?: string;
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
+        image_size?: "small" | "medium" | "large" | "original";
+        /** @description Page size; default 50, maximum 200 */
+        limit?: number;
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Keeps the series whose title or sort title contains this text, case-insensitively */
+        q?: string;
+        /** @description Keeps the series with this reason, whether or not the preferences let it notify; absent keeps every reason */
+        reason?: "favorite" | "watchlist" | "continue_watching" | "next_up";
+        /** @description One field, descending with a leading '-'. added_at is when the series joined the catalog; latest_episode_added when it last gained an episode. A series without a year or an episode sorts last either way; ties order by title. */
+        sort?:
+          | "title"
+          | "-title"
+          | "year"
+          | "-year"
+          | "added_at"
+          | "-added_at"
+          | "latest_episode_added"
+          | "-latest_episode_added";
+        /** @description active keeps the series that notify; inactive keeps the ones that do not, because the profile's preferences silence every reason or the profile muted the series */
+        status?: "all" | "active" | "inactive";
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
+      };
+      header: {
+        /** @description The household profile acting for this request; it must belong to the authenticated account. */
+        "X-Profile-Id": string;
+        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
+        "X-Profile-Token"?: string;
+      };
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description OK */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/json": components["schemas"]["NotificationSeriesCollection"];
+        };
+      };
+      /** @description Bad Request */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unauthorized */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Forbidden */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Found */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Acceptable */
+      406: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unprocessable Entity */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Too Many Requests */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Internal Server Error */
+      500: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Service Unavailable */
+      503: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+    };
+  };
+  muteNotificationSeries: {
     parameters: {
       query?: never;
       header: {
@@ -117286,13 +119654,10 @@ export interface operations {
         "X-Profile-Id": string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
-        /** @description Positive decimal int64, persisted and incremented for each new installation intent across account/profile switches. Reuse exactly after uncertainty. */
-        "X-Push-Generation": string;
-        /** @description Secret 32-byte base64url installation credential. Persist privately; never rotate on retry or account switch. */
-        "X-Push-Installation-Key": string;
       };
       path: {
-        device_id: string;
+        /** @description Catalog item identifier of the series */
+        series_id: string;
       };
       cookie?: never;
     };
@@ -117350,15 +119715,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Conflict */
-      409: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -117397,155 +119753,22 @@ export interface operations {
       };
     };
   };
-  getPushRegistrationCapabilities: {
+  unmuteNotificationSeries: {
     parameters: {
       query?: never;
       header: {
-        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
-        "If-Match"?: string;
-        "If-None-Match"?: string;
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
         "X-Profile-Id": string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
-      cookie?: never;
-    };
-    requestBody?: never;
-    responses: {
-      /** @description OK */
-      200: {
-        headers: {
-          "Cache-Control"?: string;
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
-        };
-        content: {
-          "application/json": components["schemas"]["AndroidPushRegistrationCapability"];
-        };
-      };
-      /** @description The representation named by If-None-Match is current; no body. */
-      304: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
-        };
-        content?: never;
-      };
-      /** @description Bad Request */
-      400: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unauthorized */
-      401: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Forbidden */
-      403: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Not Found */
-      404: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Not Acceptable */
-      406: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Precondition Failed */
-      412: {
-        headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unprocessable Entity */
-      422: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Too Many Requests */
-      429: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Internal Server Error */
-      500: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Service Unavailable */
-      503: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-    };
-  };
-  markNotificationsRead: {
-    parameters: {
-      query?: never;
-      header: {
-        /** @description The household profile acting for this request; it must belong to the authenticated account. */
-        "X-Profile-Id": string;
-        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
-        "X-Profile-Token"?: string;
+      path: {
+        /** @description Catalog item identifier of the series */
+        series_id: string;
       };
-      path?: never;
       cookie?: never;
     };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["NotificationReadAllInputBody"];
-      };
-    };
+    requestBody?: never;
     responses: {
       /** @description No Content */
       204: {
@@ -117599,33 +119822,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -120548,6 +122744,85 @@ export interface operations {
       };
     };
   };
+  getPlaybackBandwidthProbe: {
+    parameters: {
+      query?: {
+        /** @description Number of bytes to send. A client may close the connection early once it has timed enough of the transfer. */
+        size?: number;
+      };
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Random bytes */
+      200: {
+        headers: {
+          "Cache-Control"?: string;
+          "Content-Length"?: number;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/octet-stream": string;
+        };
+      };
+      /** @description Unauthorized */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Forbidden */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unprocessable Entity */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Too Many Requests */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Internal Server Error */
+      500: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Service Unavailable */
+      503: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+    };
+  };
   getPlaybackCapabilities: {
     parameters: {
       query?: never;
@@ -121466,6 +123741,8 @@ export interface operations {
       query?: {
         /** @description 1 on a plan URL whose client advertised hls_variable_substitution_v1: a large synthetic manifest may carry its query once through EXT-X-DEFINE instead of on every segment link. Not a credential; segment links repeat the manifest query. */
         hls_vars?: string;
+        /** @description Set by the multivariant playlist of a plan with subtitle.hls_rendition: video selects the media playlist, subtitles the WebVTT subtitle playlist. Absent, such a plan's manifest is the multivariant playlist. */
+        prairie_rendition?: "video" | "subtitles";
         /** @description Signed stream reference the plan URL carries; it reconstructs the session after a restart. Omitted for header-authenticated media. Account and viewer authorization are always required. */
         st?: string;
         /** @description Media-element fallback for the account bearer token when an Authorization header cannot be set. Header-authenticated media requires the Authorization header and the profile selector. */
@@ -121587,69 +123864,313 @@ export interface operations {
       };
     };
   };
-  getPlaybackSegment: {
+  getPlaybackSegment: {
+    parameters: {
+      query?: {
+        /** @description 1 on a plan URL whose client advertised hls_variable_substitution_v1: a large synthetic manifest may carry its query once through EXT-X-DEFINE instead of on every segment link. Not a credential; segment links repeat the manifest query. */
+        hls_vars?: string;
+        /** @description Signed stream reference the plan URL carries; it reconstructs the session after a restart. Omitted for header-authenticated media. Account and viewer authorization are always required. */
+        st?: string;
+        /** @description Media-element fallback for the account bearer token when an Authorization header cannot be set. Header-authenticated media requires the Authorization header and the profile selector. */
+        token?: string;
+      };
+      header?: {
+        "If-Match"?: string;
+        "If-Modified-Since"?: string;
+        "If-None-Match"?: string;
+        "If-Range"?: string;
+        "If-Unmodified-Since"?: string;
+        Range?: string;
+        /** @description Optional. When present, it must name a profile of the authenticated account. */
+        "X-Profile-Id"?: string;
+        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
+        "X-Profile-Token"?: string;
+      };
+      path: {
+        /** @description Segment name from the media playlist. sub_NNNNN.vtt names a WebVTT subtitle rendition segment, answered from the cues already produced; one the transcode does not reach in time is an empty WebVTT document. */
+        name: string;
+        session_id: string;
+      };
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description Playback bytes or HEAD metadata */
+      200: {
+        headers: {
+          "Accept-Ranges"?: string;
+          "Cache-Control"?: string;
+          "Content-Length"?: number;
+          ETag?: string;
+          "Last-Modified"?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/octet-stream": string;
+          "multipart/byteranges": string;
+          "text/vtt": string;
+          "video/mp2t": string;
+          "video/mp4": string;
+        };
+      };
+      /** @description Requested byte range */
+      206: {
+        headers: {
+          "Content-Range"?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/octet-stream": string;
+          "multipart/byteranges": string;
+          "text/vtt": string;
+          "video/mp2t": string;
+          "video/mp4": string;
+        };
+      };
+      /** @description The authorized representation has not changed */
+      304: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Bad Request */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unauthorized */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Forbidden */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Found */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Conflict */
+      409: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Gone */
+      410: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Precondition Failed */
+      412: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Requested Range Not Satisfiable */
+      416: {
+        headers: {
+          "Content-Range"?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unprocessable Entity */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Too Many Requests */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Internal Server Error */
+      500: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Service Unavailable */
+      503: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+    };
+  };
+  getPluginContentCapabilities: {
+    parameters: {
+      query?: never;
+      header?: {
+        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
+        "If-Match"?: string;
+        "If-None-Match"?: string;
+      };
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description OK */
+      200: {
+        headers: {
+          "Cache-Control"?: string;
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/json": components["schemas"]["Capability"];
+        };
+      };
+      /** @description The representation named by If-None-Match is current; no body. */
+      304: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content?: never;
+      };
+      /** @description Bad Request */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Acceptable */
+      406: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Precondition Failed */
+      412: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unprocessable Entity */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Internal Server Error */
+      500: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Service Unavailable */
+      503: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+    };
+  };
+  getPolicyCapability: {
     parameters: {
-      query?: {
-        /** @description 1 on a plan URL whose client advertised hls_variable_substitution_v1: a large synthetic manifest may carry its query once through EXT-X-DEFINE instead of on every segment link. Not a credential; segment links repeat the manifest query. */
-        hls_vars?: string;
-        /** @description Signed stream reference the plan URL carries; it reconstructs the session after a restart. Omitted for header-authenticated media. Account and viewer authorization are always required. */
-        st?: string;
-        /** @description Media-element fallback for the account bearer token when an Authorization header cannot be set. Header-authenticated media requires the Authorization header and the profile selector. */
-        token?: string;
-      };
+      query?: never;
       header?: {
+        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
         "If-Match"?: string;
-        "If-Modified-Since"?: string;
         "If-None-Match"?: string;
-        "If-Range"?: string;
-        "If-Unmodified-Since"?: string;
-        Range?: string;
         /** @description Optional. When present, it must name a profile of the authenticated account. */
         "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        name: string;
-        session_id: string;
-      };
+      path?: never;
       cookie?: never;
     };
     requestBody?: never;
     responses: {
-      /** @description Playback bytes or HEAD metadata */
+      /** @description OK */
       200: {
         headers: {
-          "Accept-Ranges"?: string;
           "Cache-Control"?: string;
-          "Content-Length"?: number;
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
           ETag?: string;
-          "Last-Modified"?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/octet-stream": string;
-          "multipart/byteranges": string;
-          "video/mp2t": string;
-          "video/mp4": string;
-        };
-      };
-      /** @description Requested byte range */
-      206: {
-        headers: {
-          "Content-Range"?: string;
-          [name: string]: unknown;
-        };
-        content: {
-          "application/octet-stream": string;
-          "multipart/byteranges": string;
-          "video/mp2t": string;
-          "video/mp4": string;
+          "application/json": components["schemas"]["PolicyCapability"];
         };
       };
-      /** @description The authorized representation has not changed */
+      /** @description The representation named by If-None-Match is current; no body. */
       304: {
         headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
           [name: string]: unknown;
         };
         content?: never;
@@ -121690,17 +124211,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Conflict */
-      409: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Gone */
-      410: {
+      /** @description Not Acceptable */
+      406: {
         headers: {
           [name: string]: unknown;
         };
@@ -121711,16 +124223,8 @@ export interface operations {
       /** @description Precondition Failed */
       412: {
         headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Requested Range Not Satisfiable */
-      416: {
-        headers: {
-          "Content-Range"?: string;
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
           [name: string]: unknown;
         };
         content: {
@@ -121765,13 +124269,19 @@ export interface operations {
       };
     };
   };
-  getPluginContentCapabilities: {
+  listProfileSectionOverrides: {
     parameters: {
-      query?: never;
-      header?: {
-        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
-        "If-Match"?: string;
-        "If-None-Match"?: string;
+      query?: {
+        /** @description The library; required when scope is library and refused otherwise */
+        library_id?: string;
+        /** @description The page the overrides apply to */
+        scope?: "home" | "library";
+      };
+      header: {
+        /** @description The household profile acting for this request; it must belong to the authenticated account. */
+        "X-Profile-Id": string;
+        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
+        "X-Profile-Token"?: string;
       };
       path?: never;
       cookie?: never;
@@ -121781,26 +124291,23 @@ export interface operations {
       /** @description OK */
       200: {
         headers: {
-          "Cache-Control"?: string;
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["Capability"];
+          "application/json": components["schemas"]["SectionOverrideCollection"];
         };
       };
-      /** @description The representation named by If-None-Match is current; no body. */
-      304: {
+      /** @description Bad Request */
+      400: {
         headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
           [name: string]: unknown;
         };
-        content?: never;
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
       };
-      /** @description Bad Request */
-      400: {
+      /** @description Unauthorized */
+      401: {
         headers: {
           [name: string]: unknown;
         };
@@ -121808,8 +124315,8 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Not Acceptable */
-      406: {
+      /** @description Forbidden */
+      403: {
         headers: {
           [name: string]: unknown;
         };
@@ -121817,11 +124324,18 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Failed */
-      412: {
+      /** @description Not Found */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Acceptable */
+      406: {
         headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
@@ -121837,6 +124351,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Too Many Requests */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Internal Server Error */
       500: {
         headers: {
@@ -121857,40 +124380,32 @@ export interface operations {
       };
     };
   };
-  getPolicyCapability: {
+  replaceProfileSectionOverrides: {
     parameters: {
-      query?: never;
-      header?: {
-        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
-        "If-Match"?: string;
-        "If-None-Match"?: string;
-        /** @description Optional. When present, it must name a profile of the authenticated account. */
-        "X-Profile-Id"?: string;
+      query?: {
+        /** @description The library; required when scope is library and refused otherwise */
+        library_id?: string;
+        /** @description The page the overrides apply to */
+        scope?: "home" | "library";
+      };
+      header: {
+        /** @description The household profile acting for this request; it must belong to the authenticated account. */
+        "X-Profile-Id": string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
       path?: never;
       cookie?: never;
     };
-    requestBody?: never;
-    responses: {
-      /** @description OK */
-      200: {
-        headers: {
-          "Cache-Control"?: string;
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
-          [name: string]: unknown;
-        };
-        content: {
-          "application/json": components["schemas"]["PolicyCapability"];
-        };
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["SectionOverrideSet"];
       };
-      /** @description The representation named by If-None-Match is current; no body. */
-      304: {
+    };
+    responses: {
+      /** @description No Content */
+      204: {
         headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
           [name: string]: unknown;
         };
         content?: never;
@@ -121940,11 +124455,27 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Precondition Failed */
-      412: {
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Request Entity Too Large */
+      413: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unsupported Media Type */
+      415: {
         headers: {
-          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
-          ETag?: string;
           [name: string]: unknown;
         };
         content: {
@@ -121989,7 +124520,7 @@ export interface operations {
       };
     };
   };
-  listProfileSectionOverrides: {
+  resetProfileSectionOverrides: {
     parameters: {
       query?: {
         /** @description The library; required when scope is library and refused otherwise */
@@ -122008,14 +124539,12 @@ export interface operations {
     };
     requestBody?: never;
     responses: {
-      /** @description OK */
-      200: {
+      /** @description No Content */
+      204: {
         headers: {
           [name: string]: unknown;
         };
-        content: {
-          "application/json": components["schemas"]["SectionOverrideCollection"];
-        };
+        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -122100,14 +124629,9 @@ export interface operations {
       };
     };
   };
-  replaceProfileSectionOverrides: {
+  getProfileSectionFlags: {
     parameters: {
-      query?: {
-        /** @description The library; required when scope is library and refused otherwise */
-        library_id?: string;
-        /** @description The page the overrides apply to */
-        scope?: "home" | "library";
-      };
+      query?: never;
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
         "X-Profile-Id": string;
@@ -122117,18 +124641,16 @@ export interface operations {
       path?: never;
       cookie?: never;
     };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["SectionOverrideSet"];
-      };
-    };
+    requestBody?: never;
     responses: {
-      /** @description No Content */
-      204: {
+      /** @description OK */
+      200: {
         headers: {
           [name: string]: unknown;
         };
-        content?: never;
+        content: {
+          "application/json": components["schemas"]["ProfileSectionFlags"];
+        };
       };
       /** @description Bad Request */
       400: {
@@ -122175,33 +124697,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -122240,7 +124735,7 @@ export interface operations {
       };
     };
   };
-  resetProfileSectionOverrides: {
+  getProfileSectionSettings: {
     parameters: {
       query?: {
         /** @description The library; required when scope is library and refused otherwise */
@@ -122259,12 +124754,14 @@ export interface operations {
     };
     requestBody?: never;
     responses: {
-      /** @description No Content */
-      204: {
+      /** @description OK */
+      200: {
         headers: {
           [name: string]: unknown;
         };
-        content?: never;
+        content: {
+          "application/json": components["schemas"]["ProfileSectionSettingCollection"];
+        };
       };
       /** @description Bad Request */
       400: {
@@ -122349,12 +124846,12 @@ export interface operations {
       };
     };
   };
-  getProfileSectionFlags: {
+  listProfiles: {
     parameters: {
       query?: never;
-      header: {
-        /** @description The household profile acting for this request; it must belong to the authenticated account. */
-        "X-Profile-Id": string;
+      header?: {
+        /** @description Optional. When present, it must name a profile of the authenticated account. */
+        "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
@@ -122369,7 +124866,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["ProfileSectionFlags"];
+          "application/json": components["schemas"]["ProfileCollection"];
         };
       };
       /** @description Bad Request */
@@ -122455,32 +124952,32 @@ export interface operations {
       };
     };
   };
-  getProfileSectionSettings: {
+  createProfile: {
     parameters: {
-      query?: {
-        /** @description The library; required when scope is library and refused otherwise */
-        library_id?: string;
-        /** @description The page the overrides apply to */
-        scope?: "home" | "library";
-      };
-      header: {
-        /** @description The household profile acting for this request; it must belong to the authenticated account. */
-        "X-Profile-Id": string;
+      query?: never;
+      header?: {
+        /** @description Optional. When present, it must name a profile of the authenticated account. */
+        "X-Profile-Id"?: string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
       path?: never;
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        "application/json": components["schemas"]["ProfileCreate"];
+      };
+    };
     responses: {
-      /** @description OK */
-      200: {
+      /** @description Created */
+      201: {
         headers: {
+          Location?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["ProfileSectionSettingCollection"];
+          "application/json": components["schemas"]["Profile"];
         };
       };
       /** @description Bad Request */
@@ -122528,6 +125025,42 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Conflict */
+      409: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Request Entity Too Large */
+      413: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unsupported Media Type */
+      415: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -122566,7 +125099,7 @@ export interface operations {
       };
     };
   };
-  listProfiles: {
+  deleteProfile: {
     parameters: {
       query?: never;
       header?: {
@@ -122575,19 +125108,20 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
+      path: {
+        /** @description The profile */
+        id: string;
+      };
       cookie?: never;
     };
     requestBody?: never;
     responses: {
-      /** @description OK */
-      200: {
+      /** @description No Content */
+      204: {
         headers: {
           [name: string]: unknown;
         };
-        content: {
-          "application/json": components["schemas"]["ProfileCollection"];
-        };
+        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -122634,6 +125168,15 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Conflict */
+      409: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -122672,7 +125215,7 @@ export interface operations {
       };
     };
   };
-  createProfile: {
+  updateProfile: {
     parameters: {
       query?: never;
       header?: {
@@ -122681,19 +125224,21 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
+      path: {
+        /** @description The profile to update */
+        id: string;
+      };
       cookie?: never;
     };
     requestBody: {
       content: {
-        "application/json": components["schemas"]["ProfileCreate"];
+        "application/json": components["schemas"]["ProfileUpdate"];
       };
     };
     responses: {
-      /** @description Created */
-      201: {
+      /** @description OK */
+      200: {
         headers: {
-          Location?: string;
           [name: string]: unknown;
         };
         content: {
@@ -122819,7 +125364,7 @@ export interface operations {
       };
     };
   };
-  deleteProfile: {
+  uploadProfileAvatar: {
     parameters: {
       query?: never;
       header?: {
@@ -122834,14 +125379,20 @@ export interface operations {
       };
       cookie?: never;
     };
-    requestBody?: never;
+    requestBody: {
+      content: {
+        "multipart/form-data": components["schemas"]["ProfileAvatarForm"];
+      };
+    };
     responses: {
-      /** @description No Content */
-      204: {
+      /** @description OK */
+      200: {
         headers: {
           [name: string]: unknown;
         };
-        content?: never;
+        content: {
+          "application/json": components["schemas"]["Profile"];
+        };
       };
       /** @description Bad Request */
       400: {
@@ -122888,8 +125439,26 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Conflict */
-      409: {
+      /** @description Request Timeout */
+      408: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Request Entity Too Large */
+      413: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unsupported Media Type */
+      415: {
         headers: {
           [name: string]: unknown;
         };
@@ -122935,7 +125504,7 @@ export interface operations {
       };
     };
   };
-  updateProfile: {
+  deleteProfileAvatar: {
     parameters: {
       query?: never;
       header?: {
@@ -122945,25 +125514,19 @@ export interface operations {
         "X-Profile-Token"?: string;
       };
       path: {
-        /** @description The profile to update */
+        /** @description The profile */
         id: string;
       };
       cookie?: never;
     };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["ProfileUpdate"];
-      };
-    };
+    requestBody?: never;
     responses: {
-      /** @description OK */
-      200: {
+      /** @description No Content */
+      204: {
         headers: {
           [name: string]: unknown;
         };
-        content: {
-          "application/json": components["schemas"]["Profile"];
-        };
+        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -123010,42 +125573,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Conflict */
-      409: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -123084,7 +125611,7 @@ export interface operations {
       };
     };
   };
-  uploadProfileAvatar: {
+  verifyProfilePIN: {
     parameters: {
       query?: never;
       header?: {
@@ -123094,14 +125621,14 @@ export interface operations {
         "X-Profile-Token"?: string;
       };
       path: {
-        /** @description The profile */
+        /** @description The profile whose PIN is checked */
         id: string;
       };
       cookie?: never;
     };
     requestBody: {
       content: {
-        "multipart/form-data": components["schemas"]["ProfileAvatarForm"];
+        "application/json": components["schemas"]["ProfilePINCheck"];
       };
     };
     responses: {
@@ -123111,7 +125638,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["Profile"];
+          "application/json": components["schemas"]["ProfileVerification"];
         };
       };
       /** @description Bad Request */
@@ -123224,7 +125751,7 @@ export interface operations {
       };
     };
   };
-  deleteProfileAvatar: {
+  listHouseholdSessions: {
     parameters: {
       query?: never;
       header?: {
@@ -123233,20 +125760,19 @@ export interface operations {
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        /** @description The profile */
-        id: string;
-      };
+      path?: never;
       cookie?: never;
     };
     requestBody?: never;
     responses: {
-      /** @description No Content */
-      204: {
+      /** @description OK */
+      200: {
         headers: {
           [name: string]: unknown;
         };
-        content?: never;
+        content: {
+          "application/json": components["schemas"]["PlaybackSessionCollection"];
+        };
       };
       /** @description Bad Request */
       400: {
@@ -123331,26 +125857,28 @@ export interface operations {
       };
     };
   };
-  verifyProfilePIN: {
+  listProgress: {
     parameters: {
-      query?: never;
-      header?: {
-        /** @description Optional. When present, it must name a profile of the authenticated account. */
-        "X-Profile-Id"?: string;
+      query?: {
+        /** @description Opaque cursor from page.next_cursor */
+        cursor?: string;
+        /** @description Only entries whose item is in this library */
+        library_id?: string;
+        /** @description Page size; default 50, maximum 200 */
+        limit?: number;
+        /** @description Only entries in this state; absent lists every entry */
+        status?: "in_progress" | "completed";
+      };
+      header: {
+        /** @description The household profile acting for this request; it must belong to the authenticated account. */
+        "X-Profile-Id": string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path: {
-        /** @description The profile whose PIN is checked */
-        id: string;
-      };
+      path?: never;
       cookie?: never;
     };
-    requestBody: {
-      content: {
-        "application/json": components["schemas"]["ProfilePINCheck"];
-      };
-    };
+    requestBody?: never;
     responses: {
       /** @description OK */
       200: {
@@ -123358,7 +125886,7 @@ export interface operations {
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["ProfileVerification"];
+          "application/json": components["schemas"]["ProgressCollection"];
         };
       };
       /** @description Bad Request */
@@ -123406,33 +125934,6 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
-      /** @description Request Timeout */
-      408: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Request Entity Too Large */
-      413: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unsupported Media Type */
-      415: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -123471,28 +125972,29 @@ export interface operations {
       };
     };
   };
-  listHouseholdSessions: {
+  clearResumePosition: {
     parameters: {
       query?: never;
-      header?: {
-        /** @description Optional. When present, it must name a profile of the authenticated account. */
-        "X-Profile-Id"?: string;
+      header: {
+        /** @description The household profile acting for this request; it must belong to the authenticated account. */
+        "X-Profile-Id": string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
         "X-Profile-Token"?: string;
       };
-      path?: never;
+      path: {
+        /** @description A movie or episode */
+        media_item_id: string;
+      };
       cookie?: never;
     };
     requestBody?: never;
     responses: {
-      /** @description OK */
-      200: {
+      /** @description No Content */
+      204: {
         headers: {
           [name: string]: unknown;
         };
-        content: {
-          "application/json": components["schemas"]["PlaybackSessionCollection"];
-        };
+        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -123577,19 +126079,13 @@ export interface operations {
       };
     };
   };
-  listProgress: {
+  getProgressCapabilities: {
     parameters: {
-      query?: {
-        /** @description Opaque cursor from page.next_cursor */
-        cursor?: string;
-        /** @description Only entries whose item is in this library */
-        library_id?: string;
-        /** @description Page size; default 50, maximum 200 */
-        limit?: number;
-        /** @description Only entries in this state; absent lists every entry */
-        status?: "in_progress" | "completed";
-      };
+      query?: never;
       header: {
+        /** @description Optional first precondition, evaluated before If-None-Match: a tag that does not match the current representation is 412 precondition_failed. */
+        "If-Match"?: string;
+        "If-None-Match"?: string;
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
         "X-Profile-Id": string;
         /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
@@ -123603,11 +126099,23 @@ export interface operations {
       /** @description OK */
       200: {
         headers: {
+          "Cache-Control"?: string;
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
           [name: string]: unknown;
         };
         content: {
-          "application/json": components["schemas"]["ProgressCollection"];
+          "application/json": components["schemas"]["ProgressCapabilities"];
+        };
+      };
+      /** @description The representation named by If-None-Match is current; no body. */
+      304: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
         };
+        content?: never;
       };
       /** @description Bad Request */
       400: {
@@ -123654,6 +126162,17 @@ export interface operations {
           "application/problem+json": components["schemas"]["Problem"];
         };
       };
+      /** @description Precondition Failed */
+      412: {
+        headers: {
+          /** @description The strong, opaque validator of the representation; send it back in If-Match on a guarded mutation or If-None-Match on a conditional read. */
+          ETag?: string;
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
       /** @description Unprocessable Entity */
       422: {
         headers: {
@@ -124160,8 +126679,20 @@ export interface operations {
   listBecauseWatched: {
     parameters: {
       query?: {
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
+        image_size?: "small" | "medium" | "large" | "original";
         /** @description Cards to answer; default 20, maximum 50 */
         limit?: number;
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
@@ -124271,7 +126802,20 @@ export interface operations {
   };
   getDiscover: {
     parameters: {
-      query?: never;
+      query?: {
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
+        image_size?: "small" | "medium" | "large" | "original";
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
+      };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
         "X-Profile-Id": string;
@@ -124378,8 +126922,20 @@ export interface operations {
   getForYouMain: {
     parameters: {
       query?: {
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
+        image_size?: "small" | "medium" | "large" | "original";
         /** @description Cards to answer; default 20, maximum 50 */
         limit?: number;
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
@@ -124487,8 +127043,20 @@ export interface operations {
   listForYouRows: {
     parameters: {
       query?: {
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
+        image_size?: "small" | "medium" | "large" | "original";
         /** @description Cards to answer; default 20, maximum 50 */
         limit?: number;
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
@@ -124596,10 +127164,22 @@ export interface operations {
   listPopular: {
     parameters: {
       query?: {
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
         /** @description Window in days; default 30 */
         days?: number;
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
+        image_size?: "small" | "medium" | "large" | "original";
         /** @description Cards to answer; default 20, maximum 50 */
         limit?: number;
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
@@ -124707,10 +127287,22 @@ export interface operations {
   listRecentlyAdded: {
     parameters: {
       query?: {
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
         /** @description Window in days; default 14 */
         days?: number;
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
+        image_size?: "small" | "medium" | "large" | "original";
         /** @description Cards to answer; default 20, maximum 50 */
         limit?: number;
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
@@ -124818,10 +127410,22 @@ export interface operations {
   getRecommendationSection: {
     parameters: {
       query?: {
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
+        image_size?: "small" | "medium" | "large" | "original";
         /** @description Section key: the cluster index of a cluster section or the genre name of a genre section */
         key?: string;
         /** @description Cards to answer; default and maximum 60 */
         limit?: number;
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
@@ -124939,8 +127543,20 @@ export interface operations {
   listSimilarUsersLiked: {
     parameters: {
       query?: {
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
+        image_size?: "small" | "medium" | "large" | "original";
         /** @description Cards to answer; default 20, maximum 50 */
         limit?: number;
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
@@ -125048,8 +127664,20 @@ export interface operations {
   listSimilar: {
     parameters: {
       query?: {
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
+        image_size?: "small" | "medium" | "large" | "original";
         /** @description Cards to answer; default 20, maximum 50 */
         limit?: number;
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
@@ -125403,10 +128031,22 @@ export interface operations {
   listTasteSeedItems: {
     parameters: {
       query?: {
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
         /** @description Opaque cursor from page.next_cursor */
         cursor?: string;
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
+        image_size?: "small" | "medium" | "large" | "original";
         /** @description Cards per page; default 30, maximum 60 */
         limit?: number;
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
@@ -125514,8 +128154,20 @@ export interface operations {
   getWatchTonight: {
     parameters: {
       query?: {
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
+        image_size?: "small" | "medium" | "large" | "original";
         /** @description Cards to answer; default 5, maximum 20 */
         limit?: number;
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
@@ -125623,14 +128275,26 @@ export interface operations {
   listWatchTonightCards: {
     parameters: {
       query: {
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
         /** @description Catalog identifiers already swiped, repeated (exclude_ids=a&exclude_ids=b) */
         exclude_ids?: string[];
         /** @description Discover-mode genre filter, repeated (genres=Crime&genres=Thriller); each must be a known genre */
         genres?: string[];
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
+        image_size?: "small" | "medium" | "large" | "original";
         /** @description Cards per page; default 12, maximum 20 */
         limit?: number;
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
         /** @description continue answers in-progress and next-up cards; discover answers taste candidates */
         mode: "continue" | "discover";
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
@@ -128463,6 +131127,112 @@ export interface operations {
       };
     };
   };
+  listSeasonalThemes: {
+    parameters: {
+      query?: never;
+      header?: {
+        /** @description Optional. When present, it must name a profile of the authenticated account. */
+        "X-Profile-Id"?: string;
+        /** @description Verification proof for a PIN-locked profile, issued by POST /api/v2/profiles/{id}/verify-pin; required only when the declared profile is locked */
+        "X-Profile-Token"?: string;
+      };
+      path?: never;
+      cookie?: never;
+    };
+    requestBody?: never;
+    responses: {
+      /** @description OK */
+      200: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/json": components["schemas"]["SeasonalThemeCatalog"];
+        };
+      };
+      /** @description Bad Request */
+      400: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unauthorized */
+      401: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Forbidden */
+      403: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Found */
+      404: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Not Acceptable */
+      406: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Unprocessable Entity */
+      422: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Too Many Requests */
+      429: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Internal Server Error */
+      500: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+      /** @description Service Unavailable */
+      503: {
+        headers: {
+          [name: string]: unknown;
+        };
+        content: {
+          "application/problem+json": components["schemas"]["Problem"];
+        };
+      };
+    };
+  };
   getSettingsContract: {
     parameters: {
       query?: never;
@@ -130516,8 +133286,18 @@ export interface operations {
   createShuffle: {
     parameters: {
       query?: {
-        /** @description Artwork variant to presign on the item cards */
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
         image_size?: "small" | "medium" | "large" | "original";
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
@@ -130666,8 +133446,18 @@ export interface operations {
   getShuffle: {
     parameters: {
       query?: {
-        /** @description Artwork variant to presign on the item cards */
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
         image_size?: "small" | "medium" | "large" | "original";
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
@@ -130894,8 +133684,18 @@ export interface operations {
   advanceShuffle: {
     parameters: {
       query?: {
-        /** @description Artwork variant to presign on the item cards */
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
         image_size?: "small" | "medium" | "large" | "original";
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
@@ -131046,8 +133846,18 @@ export interface operations {
   skipShuffleItem: {
     parameters: {
       query?: {
-        /** @description Artwork variant to presign on the item cards */
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
         image_size?: "small" | "medium" | "large" | "original";
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
@@ -136090,71 +138900,6 @@ export interface operations {
       };
     };
   };
-  getThemeOverrides: {
-    parameters: {
-      query?: never;
-      header?: never;
-      path?: never;
-      cookie?: never;
-    };
-    requestBody?: never;
-    responses: {
-      /** @description OK */
-      200: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/json": components["schemas"]["ThemeOverrides"];
-        };
-      };
-      /** @description Bad Request */
-      400: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Not Acceptable */
-      406: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Unprocessable Entity */
-      422: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Internal Server Error */
-      500: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-      /** @description Service Unavailable */
-      503: {
-        headers: {
-          [name: string]: unknown;
-        };
-        content: {
-          "application/problem+json": components["schemas"]["Problem"];
-        };
-      };
-    };
-  };
   getBranding: {
     parameters: {
       query?: never;
@@ -140673,12 +143418,22 @@ export interface operations {
   getWatchState: {
     parameters: {
       query?: {
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
         /** @description Prefer this file when the item has several versions */
         file_id?: string;
-        /** @description Artwork variant to presign; absent picks each surface's default */
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
         image_size?: "small" | "medium" | "large" | "original";
         /** @description Present the item as a member of this library */
         library_id?: string;
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header?: {
         /** @description The stable device identifier used to resolve playback preferences */
@@ -141119,12 +143874,22 @@ export interface operations {
   listWatchlist: {
     parameters: {
       query?: {
+        /** @description Width in device pixels the client draws backdrop_url and backdrop_urls at. Overrides image_size for backdrops */
+        backdrop_width?: number;
         /** @description Opaque cursor from page.next_cursor */
         cursor?: string;
-        /** @description Artwork variant to presign; absent picks each surface's default */
+        /** @description Artwork size for every image in the response; absent picks each surface's default */
         image_size?: "small" | "medium" | "large" | "original";
         /** @description Page size; default 50, maximum 200 */
         limit?: number;
+        /** @description Width in device pixels the client draws logo_url at. Overrides image_size for logos */
+        logo_width?: number;
+        /** @description Width in device pixels the client draws a cast or crew photo_url at. Overrides image_size for headshots */
+        photo_width?: number;
+        /** @description Width in device pixels the client draws poster_url at. Overrides image_size for posters: the narrowest cached size at least this wide, else the original */
+        poster_width?: number;
+        /** @description Width in device pixels the client draws an episode's still_url at. Overrides image_size for episode stills */
+        still_width?: number;
       };
       header: {
         /** @description The household profile acting for this request; it must belong to the authenticated account. */
diff --git a/web/src/api/v2/watchTogetherSocket.test.tsx b/web/src/api/v2/watchTogetherSocket.test.tsx
index d99845fc34..aae1ba1f09 100644
--- a/web/src/api/v2/watchTogetherSocket.test.tsx
+++ b/web/src/api/v2/watchTogetherSocket.test.tsx
@@ -184,6 +184,131 @@ it("gets a fresh ticket after socket close and preserves ping/message callbacks"
   expect(fetch).toHaveBeenCalledTimes(2);
   expect(RoomSocket.all[1]!.protocols[1]).toBe(`prairie.ticket.${"b".repeat(43)}`);
 });
+it("estimates the clock from the fastest pong, keeps it across a reconnect, and forgets it on leave", async () => {
+  vi.useFakeTimers();
+  vi.setSystemTime(new Date("2026-09-01T12:00:00Z"));
+  vi.stubGlobal(
+    "fetch",
+    vi.fn(async () => ticket()),
+  );
+  const view = renderHook(
+    ({ roomId }) =>
+      useWatchTogetherRoomConnection({ roomId, roomToken: roomId ? "room-proof" : null }),
+    { initialProps: { roomId: "room" as string | null } },
+  );
+  await act(() => vi.advanceTimersByTimeAsync(0));
+  const pings = (socket: RoomSocket) =>
+    socket.send.mock.calls
+      .map(([data]) => JSON.parse(data as string) as Record<string, string>)
+      .filter((message) => message.type === "ping");
+  // Answers the latest ping after `rttMs`, from a server clock `offsetMs` ahead.
+  const pong = async (socket: RoomSocket, rttMs: number, offsetMs: number) => {
+    const ping = pings(socket).at(-1)!;
+    await act(() => vi.advanceTimersByTimeAsync(rttMs));
+    const serverAt = new Date(Date.parse(ping.client_sent_at!) + rttMs / 2 + offsetMs);
+    act(() =>
+      socket.message({
+        type: "pong",
+        client_sent_at: ping.client_sent_at,
+        server_received_at: serverAt.toISOString(),
+        server_sent_at: serverAt.toISOString(),
+      }),
+    );
+  };
+
+  const first = RoomSocket.all[0]!;
+  act(() => first.open());
+  expect(pings(first)).toHaveLength(1);
+  await pong(first, 100, 500);
+  expect(view.result.current.serverTimeOffsetMs).toBe(500);
+  // Pings come every 2 s until this connection has four samples.
+  const fastSamples = [
+    [40, 520],
+    [300, 560],
+    [200, 470],
+  ] as const;
+  let previousRtt = 100;
+  for (const [index, [rtt, offset]] of fastSamples.entries()) {
+    await act(() => vi.advanceTimersByTimeAsync(2_000 - previousRtt));
+    expect(pings(first)).toHaveLength(index + 2);
+    await pong(first, rtt, offset);
+    previousRtt = rtt;
+  }
+  // The fastest round trip wins, not the latest.
+  expect(view.result.current.serverTimeOffsetMs).toBe(520);
+  await act(() => vi.advanceTimersByTimeAsync(14_000));
+  expect(pings(first)).toHaveLength(4);
+  await act(() => vi.advanceTimersByTimeAsync(1_000));
+  expect(pings(first)).toHaveLength(5);
+
+  // A reconnect to the same room keeps the samples it has.
+  act(() => first.close());
+  await act(() => vi.advanceTimersByTimeAsync(500));
+  const second = RoomSocket.all[1]!;
+  act(() => second.open());
+  expect(pings(second)).toHaveLength(1);
+  await pong(second, 1_000, 400);
+  expect(view.result.current.serverTimeOffsetMs).toBe(520);
+  // The new connection takes its own fast samples.
+  await act(() => vi.advanceTimersByTimeAsync(1_000));
+  expect(pings(second)).toHaveLength(2);
+
+  // Leaving forgets them: a slow sample in the next visit stands alone.
+  view.rerender({ roomId: null });
+  await act(() => vi.advanceTimersByTimeAsync(0));
+  expect(view.result.current.serverTimeOffsetMs).toBe(0);
+  view.rerender({ roomId: "room" });
+  await act(() => vi.advanceTimersByTimeAsync(0));
+  const third = RoomSocket.all.at(-1)!;
+  act(() => third.open());
+  await pong(third, 1_000, 300);
+  expect(view.result.current.serverTimeOffsetMs).toBe(300);
+});
+it("returns to fast pings after a clock step", async () => {
+  vi.useFakeTimers();
+  vi.setSystemTime(new Date("2026-09-01T12:00:00Z"));
+  vi.stubGlobal(
+    "fetch",
+    vi.fn(async () => ticket()),
+  );
+  const view = renderHook(() =>
+    useWatchTogetherRoomConnection({ roomId: "room", roomToken: "room-proof" }),
+  );
+  await act(() => vi.advanceTimersByTimeAsync(0));
+  const socket = RoomSocket.all[0]!;
+  const pings = () =>
+    socket.send.mock.calls
+      .map(([data]) => JSON.parse(data as string) as Record<string, string>)
+      .filter((message) => message.type === "ping");
+  const pong = (offsetMs: number) => {
+    const ping = pings().at(-1)!;
+    const serverAt = new Date(Date.parse(ping.client_sent_at!) + offsetMs).toISOString();
+    act(() =>
+      socket.message({
+        type: "pong",
+        client_sent_at: ping.client_sent_at,
+        server_received_at: serverAt,
+        server_sent_at: serverAt,
+      }),
+    );
+  };
+  act(() => socket.open());
+  pong(500);
+  for (let i = 0; i < 3; i++) {
+    await act(() => vi.advanceTimersByTimeAsync(2_000));
+    pong(500);
+  }
+  // Settled: the next ping is 15 s out.
+  await act(() => vi.advanceTimersByTimeAsync(14_999));
+  expect(pings()).toHaveLength(4);
+  await act(() => vi.advanceTimersByTimeAsync(1));
+  expect(pings()).toHaveLength(5);
+  // The clock steps by two seconds; the estimate starts over at 2 s pings.
+  pong(2_500);
+  expect(view.result.current.serverTimeOffsetMs).toBe(2_500);
+  await act(() => vi.advanceTimersByTimeAsync(2_000));
+  expect(pings()).toHaveLength(6);
+});
 it("drops a transport command with the socket that delivered it", async () => {
   vi.stubGlobal(
     "fetch",
diff --git a/web/src/app.css b/web/src/app.css
index 813ec821e9..67bb9e3cdb 100644
--- a/web/src/app.css
+++ b/web/src/app.css
@@ -400,6 +400,28 @@ html[data-navigation-direction]::view-transition-new(main-content) {
   animation: var(--duration-sidebar-collapse) var(--ease-sidebar-collapse) both nav-slide-in;
 }
 
+/* Entering or leaving personal settings swaps what the app's sidebar column
+   holds (useSidebarSwap). The column's background and border never move; only
+   its contents slide in, from the side the reader is heading toward.
+   `backwards` rather than `both`: once it ends the entrance lets go of
+   transform, which the app sidebar's own collapse motion drives on some of
+   these same children.                                                       */
+@keyframes sidebar-entrance {
+  from {
+    opacity: 0;
+    transform: translateX(var(--sidebar-entrance-shift));
+  }
+}
+[data-sidebar-entrance="forward"] {
+  --sidebar-entrance-shift: 16px;
+}
+[data-sidebar-entrance="back"] {
+  --sidebar-entrance-shift: -16px;
+}
+[data-sidebar-entrance] > * {
+  animation: var(--duration-normal) var(--ease-out) backwards sidebar-entrance;
+}
+
 @media (prefers-reduced-motion: reduce) {
   /* The directional selectors carry their own specificity — (0,1,2) against the
      bare pseudo-elements' (0,0,1) — so they have to be suppressed by name here
@@ -465,10 +487,9 @@ html[data-navigation-direction]::view-transition-new(main-content) {
 /* ================================================================
    § 3  THEME DEFINITIONS
    ================================================================
-   Silo ships one base theme, Cinema Dark, which sets ALL semantic
+   Prairie ships one theme, Cinema Dark, which sets ALL semantic
    tokens. It is activated by the static data-theme attribute on
-   <html> (index.html); the admin's token overrides and custom CSS
-   layer on top of it (contexts/CustomThemeProvider.tsx).
+   <html> (index.html).
 
    Token naming conventions:
      --background       Page background (darkest main surface)
@@ -630,8 +651,9 @@ html[data-navigation-direction]::view-transition-new(main-content) {
   }
   /* Every token here pushes toward --contrast-boost, never toward white
      directly. Hard-coded white raises contrast on a dark page and destroys it
-     on a light one, which admin CSS can still produce; mixing toward the boost
-     keeps high contrast readable either way. */
+     on a light one; mixing toward the boost keeps high contrast readable
+     either way. The brand accent restores this --ring after its own
+     (contexts/BrandingProvider.tsx). */
   html[data-high-contrast="true"] {
     --foreground: var(--contrast-boost);
     --ring: var(--contrast-boost);
@@ -2318,17 +2340,13 @@ html[data-navigation-direction]::view-transition-new(main-content) {
     animation: brand-reveal 650ms var(--ease-gentle) both;
   }
 
-  .admin-shell {
-    width: 100%;
-    min-width: 0;
-    max-width: 1560px;
-    margin-inline: auto;
-  }
-
-  /* AdminLayout owns the outer gutter. Older admin pages still use page-shell
-     for their max-width, so remove its second horizontal gutter when nested. */
+  /* .admin-shell marks AdminLayout's PageFrame, which sets the width. Shared
+     components that also render in the app (the collection editor) carry
+     page-shell, so drop its own gutter, cap, and centering here. */
   .admin-shell > .page-shell,
   .admin-shell > .page-shell-wide {
+    max-width: none;
+    margin-inline: 0;
     padding-inline: 0;
   }
 
@@ -2787,9 +2805,17 @@ html[data-navigation-direction]::view-transition-new(main-content) {
       padding-inline: 0;
     }
 
-    .player-controls[data-compact="true"][data-touch="false"] .player-quality-trigger > span {
+    .player-controls[data-compact="true"][data-touch="false"]
+      .player-quality-trigger
+      > .player-quality-label {
       display: none;
     }
+
+    .player-controls[data-compact="true"][data-touch="false"]
+      .player-quality-trigger
+      > .player-speed-badge {
+      position: absolute;
+    }
   }
 
   @container player-controls (height < 20rem) {
@@ -2823,3 +2849,24 @@ html[data-navigation-direction]::view-transition-new(main-content) {
     box-shadow: 0 12px 40px rgb(0 0 0 / 0.4);
   }
 }
+
+/* A settings section: no surface of its own, a hairline above it. Outside any
+   layer on purpose, so it also wins over a page's `space-y-*` margin and every
+   section is spaced the same on every page. A section nested in another keeps
+   to its parent's rule. */
+.settings-section {
+  margin-block: 0;
+  border-top: 1px solid color-mix(in srgb, var(--border) 65%, transparent);
+  padding-block: 1.5rem;
+}
+
+.settings-section .settings-section {
+  border-top: 0;
+  padding-block: 0.75rem 0;
+}
+
+@media (min-width: 64rem) {
+  .settings-section {
+    padding-block: 1.75rem;
+  }
+}
diff --git a/web/src/components/AdminJobHistory.test.tsx b/web/src/components/AdminJobHistory.test.tsx
new file mode 100644
index 0000000000..b8657b51b7
--- /dev/null
+++ b/web/src/components/AdminJobHistory.test.tsx
@@ -0,0 +1,62 @@
+// @vitest-environment jsdom
+import { afterEach, expect, it, vi } from "vitest";
+import { cleanup, render, screen } from "@testing-library/react";
+import type { AdminJob } from "@/api/types";
+import AdminJobHistory from "./AdminJobHistory";
+
+const jobs = vi.hoisted(() => ({ current: [] as AdminJob[] }));
+
+vi.mock("@/hooks/queries/admin/libraries", () => ({
+  useAllAdminJobs: () => ({
+    data: jobs.current,
+    isFetching: false,
+    isError: false,
+    hasNextPage: false,
+    isFetchingNextPage: false,
+    refetch: vi.fn(),
+    fetchNextPage: vi.fn(),
+    restart: vi.fn(),
+  }),
+}));
+
+afterEach(cleanup);
+
+function imageCacheCleanupJob(id: string, status: AdminJob["status"]): AdminJob {
+  return {
+    id,
+    job_type: "image_cache_cleanup",
+    status,
+    created_by_user_id: 0,
+    request_payload: { library_id: 4, library_name: "Movies" },
+    result_payload: { deleted_prefixes: 2, deleted_s3_objects: 17 },
+    message: "",
+    progress_current: 0,
+    progress_total: 0,
+    artifact_size_bytes: 0,
+    requested_at: "2026-10-10T12:00:00Z",
+  };
+}
+
+it("shows the totals a canceled image cache cleanup deleted before the cancel", () => {
+  jobs.current = [imageCacheCleanupJob("canceled", "cancelled")];
+  render(<AdminJobHistory />);
+  expect(
+    screen.getByText("Canceled after deleting 17 cached objects; 2 prefixes fully cleaned"),
+  ).toBeTruthy();
+});
+
+it("does not attribute an interrupted prefix's objects to cleaned prefixes", () => {
+  const job = imageCacheCleanupJob("interrupted", "cancelled");
+  job.result_payload = { deleted_prefixes: 0, deleted_s3_objects: 1000 };
+  jobs.current = [job];
+  render(<AdminJobHistory />);
+  expect(
+    screen.getByText("Canceled after deleting 1000 cached objects; 0 prefixes fully cleaned"),
+  ).toBeTruthy();
+});
+
+it("keeps the completed image cache cleanup summary", () => {
+  jobs.current = [imageCacheCleanupJob("done", "completed")];
+  render(<AdminJobHistory />);
+  expect(screen.getByText("Deleted 17 cached objects across 2 prefixes")).toBeTruthy();
+});
diff --git a/web/src/components/AdminJobHistory.tsx b/web/src/components/AdminJobHistory.tsx
index 1ff949861b..c1218a5135 100644
--- a/web/src/components/AdminJobHistory.tsx
+++ b/web/src/components/AdminJobHistory.tsx
@@ -74,9 +74,26 @@ function jobDescription(job: AdminJob) {
   }
 }
 
+function imageCacheCleanupTotals(result: Record<string, unknown>) {
+  const deletedPrefixes = typeof result.deleted_prefixes === "number" ? result.deleted_prefixes : 0;
+  const deletedObjects =
+    typeof result.deleted_s3_objects === "number" ? result.deleted_s3_objects : 0;
+  return {
+    objects: `${deletedObjects} cached object${deletedObjects === 1 ? "" : "s"}`,
+    prefixes: `${deletedPrefixes} prefix${deletedPrefixes === 1 ? "" : "es"}`,
+  };
+}
+
 function jobResult(job: AdminJob) {
-  if (job.status !== "completed") return null;
   const result = job.result_payload as Record<string, unknown>;
+  // A canceled image cache cleanup keeps what it deleted before the cancel.
+  // The objects include any from the prefix the cancel interrupted, which
+  // does not count as deleted, so the two totals are reported separately.
+  if (job.status === "cancelled" && job.job_type === "image_cache_cleanup") {
+    const totals = imageCacheCleanupTotals(result);
+    return `Canceled after deleting ${totals.objects}; ${totals.prefixes} fully cleaned`;
+  }
+  if (job.status !== "completed") return null;
   switch (job.job_type) {
     case "library_refresh": {
       const total = asFiniteNumber(result.total_items);
@@ -109,11 +126,8 @@ function jobResult(job: AdminJob) {
       return parts.length > 0 ? `Deleted ${parts.join(", ")}` : "Deleted (empty)";
     }
     case "image_cache_cleanup": {
-      const deletedPrefixes =
-        typeof result.deleted_prefixes === "number" ? result.deleted_prefixes : 0;
-      const deletedObjects =
-        typeof result.deleted_s3_objects === "number" ? result.deleted_s3_objects : 0;
-      return `Deleted ${deletedObjects} cached object${deletedObjects === 1 ? "" : "s"} across ${deletedPrefixes} prefix${deletedPrefixes === 1 ? "" : "es"}`;
+      const totals = imageCacheCleanupTotals(result);
+      return `Deleted ${totals.objects} across ${totals.prefixes}`;
     }
     case "catalog_export":
       return typeof result.items_exported === "number"
diff --git a/web/src/components/AdminLayout.test.tsx b/web/src/components/AdminLayout.test.tsx
index 97e94f155c..696261e8c9 100644
--- a/web/src/components/AdminLayout.test.tsx
+++ b/web/src/components/AdminLayout.test.tsx
@@ -1,5 +1,5 @@
 import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
-import { act, render, screen } from "@testing-library/react";
+import { act, fireEvent, render, screen } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import { createMemoryRouter, RouterProvider } from "react-router";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
@@ -18,9 +18,19 @@ vi.mock("@/hooks/queries/admin/plugins", () => ({
 vi.mock("@/hooks/queries/admin/policy", () => ({
   usePolicyCapability: () => ({ data: undefined }),
 }));
-vi.mock("@/components/AdminSidebar", () => ({ default: () => null }));
+// Stand-ins that expose just what the shell wires up: the sidebar's search
+// hook-up and whether the palette is open.
+vi.mock("@/components/AdminSidebar", () => ({
+  default: ({ onSearch }: { onSearch?: () => void }) =>
+    onSearch ? (
+      <button type="button" onClick={onSearch}>
+        Sidebar search
+      </button>
+    ) : null,
+}));
 vi.mock("@/components/AdminSectionCommandDialog", () => ({
-  AdminSectionCommandDialog: () => null,
+  AdminSectionCommandDialog: ({ open }: { open?: boolean }) =>
+    open ? <p>Command palette</p> : null,
 }));
 vi.mock("@/components/ServerActivity", () => ({ default: () => null }));
 vi.mock("@/playback/watchPlaybackContext", () => ({
@@ -90,11 +100,8 @@ describe("AdminLayout search shortcut hint", () => {
   it("names Ctrl off Apple platforms", () => {
     renderAdmin();
 
-    const [search] = screen.getAllByRole("button", {
-      name: "Search admin sections",
-    });
+    const search = screen.getByRole("button", { name: "Search admin sections" });
     expect(search).toHaveAttribute("title", "Search admin sections (Ctrl K)");
-    expect(screen.getByText("Ctrl K")).toBeInTheDocument();
     expect(screen.queryByText(/⌘/)).not.toBeInTheDocument();
   });
 
@@ -102,11 +109,19 @@ describe("AdminLayout search shortcut hint", () => {
     mocks.shortcutLabel = "⌘ K";
     renderAdmin();
 
-    const [search] = screen.getAllByRole("button", {
-      name: "Search admin sections",
-    });
+    const search = screen.getByRole("button", { name: "Search admin sections" });
     expect(search).toHaveAttribute("title", "Search admin sections (⌘ K)");
-    expect(screen.getByText("⌘ K")).toBeInTheDocument();
+  });
+});
+
+describe("AdminLayout search", () => {
+  it("opens the command palette from the desktop sidebar's search field", () => {
+    renderAdmin();
+    expect(screen.queryByText("Command palette")).not.toBeInTheDocument();
+
+    fireEvent.click(screen.getByRole("button", { name: "Sidebar search" }));
+
+    expect(screen.getByText("Command palette")).toBeInTheDocument();
   });
 });
 
diff --git a/web/src/components/AdminLayout.tsx b/web/src/components/AdminLayout.tsx
index e92558e959..39dda820d8 100644
--- a/web/src/components/AdminLayout.tsx
+++ b/web/src/components/AdminLayout.tsx
@@ -4,6 +4,7 @@ import AdminSidebar from "@/components/AdminSidebar";
 import { AdminSectionCommandDialog } from "@/components/AdminSectionCommandDialog";
 import ServerActivity from "@/components/ServerActivity";
 import { RestartBanner } from "@/components/admin/RestartBanner";
+import { PageFrame } from "@/components/page/PageHeader";
 import {
   Sheet,
   SheetClose,
@@ -19,7 +20,6 @@ import { useAdminServerStatus } from "@/hooks/queries/admin/settings";
 import { buildAdminCommandNavSections } from "@/lib/adminNavigation";
 import { resolveAdminDocumentTitle } from "@/lib/documentTitle";
 import { SEARCH_SHORTCUT_LABEL } from "@/lib/keyboardShortcut";
-import { cn } from "@/lib/utils";
 import { Menu, Search, X } from "lucide-react";
 import { useWatchPlaybackController } from "@/playback/watchPlaybackContext";
 import { useAudiobookPlaybackController } from "@/pages/audiobooks/player/audiobookPlaybackContext";
@@ -96,9 +96,9 @@ export default function AdminLayout() {
         Skip to content
       </a>
       <div className="from-primary/6 pointer-events-none fixed inset-x-0 top-0 z-0 h-40 bg-gradient-to-b to-transparent blur-3xl" />
-      {/* Desktop sidebar */}
+      {/* Desktop sidebar, with the admin search at its top */}
       <div className="hidden lg:block">
-        <AdminSidebar />
+        <AdminSidebar onSearch={() => setCommandOpen(true)} />
       </div>
 
       <Sheet open={mobileOpen} onOpenChange={setMobileOpen}>
@@ -128,7 +128,7 @@ export default function AdminLayout() {
             </div>
           </div>
           <div className="flex items-center gap-1">
-            <AdminSearchButton onClick={() => setCommandOpen(true)} className="h-11 w-11" />
+            <AdminSearchButton onClick={() => setCommandOpen(true)} />
             <ServerActivity className="h-11 w-11" />
           </div>
         </div>
@@ -161,14 +161,13 @@ export default function AdminLayout() {
         </SheetContent>
       </Sheet>
 
-      {/* Desktop header controls */}
+      {/* Desktop activity indicator; search lives in the sidebar */}
       <div className="fixed top-5 right-5 z-40 hidden items-center gap-2 lg:flex">
-        <AdminSearchButton onClick={() => setCommandOpen(true)} showShortcut />
         <ServerActivity />
       </div>
 
-      {/* `lg:pt-16` starts the content below the fixed Search/activity
-          controls (top-5, h-9 → they end 3.5rem down). With less, a page
+      {/* `lg:pt-16` starts the content below the fixed activity control
+          (top-5, h-9 → it ends 3.5rem down). With less, a page
           header's right-aligned buttons sit underneath them until the capped
           content column pulls away from the viewport's right edge.
           `--page-gutter` is published so fixed page chrome (the collection
@@ -180,7 +179,7 @@ export default function AdminLayout() {
           hasBackgroundBar ? "pb-32 sm:pb-36" : ""
         }`}
       >
-        <div className="admin-shell">
+        <PageFrame className="admin-shell">
           {/* Above the routed page and inside the content column, so every
               admin page carries the prompt and none of them can be covered by
               it. */}
@@ -189,41 +188,23 @@ export default function AdminLayout() {
             restartSignal={serverStatus?.restart_mark_count}
           />
           <Outlet />
-        </div>
+        </PageFrame>
       </main>
     </div>
   );
 }
 
-function AdminSearchButton({
-  onClick,
-  className,
-  showShortcut = false,
-}: {
-  onClick: () => void;
-  className?: string;
-  showShortcut?: boolean;
-}) {
+/** The phone header's search button; desktop has the field in the sidebar. */
+function AdminSearchButton({ onClick }: { onClick: () => void }) {
   return (
     <button
       type="button"
       onClick={onClick}
       aria-label="Search admin sections"
       title={`Search admin sections (${SEARCH_SHORTCUT_LABEL})`}
-      className={cn(
-        "text-muted-foreground hover:text-foreground hover:bg-accent/60 focus-visible:ring-ring/60 border-border/70 bg-surface/70 flex h-9 items-center justify-center gap-2 rounded-xl border px-2.5 transition-colors focus-visible:ring-[3px] focus-visible:outline-none",
-        className,
-      )}
+      className="text-muted-foreground hover:text-foreground hover:bg-accent/60 focus-visible:ring-ring/60 border-border/70 bg-surface/70 flex h-11 w-11 items-center justify-center rounded-xl border transition-colors focus-visible:ring-[3px] focus-visible:outline-none"
     >
       <Search className="h-4 w-4" aria-hidden="true" />
-      {showShortcut ? (
-        <>
-          <span className="hidden text-[13px] font-medium xl:inline">Search</span>
-          <kbd className="border-border/70 pointer-events-none rounded border px-1.5 py-0.5 font-mono text-[10px] whitespace-nowrap select-none">
-            {SEARCH_SHORTCUT_LABEL}
-          </kbd>
-        </>
-      ) : null}
     </button>
   );
 }
diff --git a/web/src/components/AdminSectionCommandDialog.test.tsx b/web/src/components/AdminSectionCommandDialog.test.tsx
index d3730ad3dc..55dfae3369 100644
--- a/web/src/components/AdminSectionCommandDialog.test.tsx
+++ b/web/src/components/AdminSectionCommandDialog.test.tsx
@@ -68,17 +68,27 @@ describe("AdminSectionCommandDialog", () => {
     const searchBox = await openDialog();
     await userEvent.type(searchBox, "maximum postgres connections");
 
-    expect(screen.getByRole("option", { name: /Storage & Database/ })).toBeInTheDocument();
+    expect(screen.getByRole("option", { name: /^General/ })).toBeInTheDocument();
     expect(screen.getByText("Maximum Postgres connections")).toBeInTheDocument();
 
-    await userEvent.click(screen.getByRole("option", { name: /Storage & Database/ }));
+    await userEvent.click(screen.getByRole("option", { name: /^General/ }));
 
-    expect(screen.getByLabelText("Current path")).toHaveTextContent(
-      "/admin/settings/infrastructure",
-    );
+    expect(screen.getByLabelText("Current path")).toHaveTextContent("/admin/settings/general");
     expect(screen.queryByRole("searchbox", { name: "Search admin sections" })).toBeNull();
   });
 
+  it("finds a settings page listed as Settings under its topic by its own name", async () => {
+    renderDialog();
+
+    const searchBox = await openDialog();
+    await userEvent.type(searchBox, "logging");
+    const options = screen.getAllByRole("option");
+    expect(options.length).toBeGreaterThan(0);
+    await userEvent.click(options[0]!);
+
+    expect(screen.getByLabelText("Current path")).toHaveTextContent("/admin/settings/logging");
+  });
+
   it("includes admin plugin app destinations", async () => {
     const sections = buildAdminCommandNavSections([
       {
diff --git a/web/src/components/AdminSessionActions.test.tsx b/web/src/components/AdminSessionActions.test.tsx
new file mode 100644
index 0000000000..b64d89cf6a
--- /dev/null
+++ b/web/src/components/AdminSessionActions.test.tsx
@@ -0,0 +1,48 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it } from "vitest";
+import type { AdminSession } from "@/api/types";
+import { Button } from "@/components/ui/button";
+import { AdminSessionActions } from "./AdminSessionActions";
+
+const session = {
+  session_id: "example-session",
+  user_id: 1,
+  username: "Example viewer",
+  profile_id: "example-profile",
+  media_file_id: 1,
+  requested_media_file_id: 1,
+  media_title: "Example movie",
+  media_type: "movie",
+  play_method: "direct_play",
+  reporting_node: "local",
+  file_duration: 3600,
+  started_at: "2026-01-01T12:00:00Z",
+  updated_at: "2026-01-01T12:05:00Z",
+  position_seconds: 300,
+  is_paused: false,
+  has_playback_control: true,
+  audio_track_index: 0,
+  transcode_audio: false,
+  stream_bitrate_kbps: null,
+  target_bitrate_kbps: null,
+  source_bitrate_kbps: null,
+  source_audio_channels: 2,
+} as AdminSession;
+
+describe("inline session actions", () => {
+  it("renders prefix, terminate, and menu buttons together", () => {
+    render(
+      <AdminSessionActions
+        session={session}
+        compact
+        layout="inline"
+        showInlineTerminate
+        inlinePrefixActions={<Button size="sm">FFmpeg</Button>}
+      />,
+    );
+
+    expect(screen.getByRole("button", { name: "FFmpeg" })).toBeVisible();
+    expect(screen.getByRole("button", { name: /terminate/i })).toBeVisible();
+    expect(screen.getByRole("button", { name: "Session actions" })).toBeVisible();
+  });
+});
diff --git a/web/src/components/AdminSessionActions.tsx b/web/src/components/AdminSessionActions.tsx
index 7be7e059d0..aa1001e821 100644
--- a/web/src/components/AdminSessionActions.tsx
+++ b/web/src/components/AdminSessionActions.tsx
@@ -231,39 +231,37 @@ export function AdminSessionActions({
         </Button>
       </DropdownMenuTrigger>
       <DropdownMenuContent align="end" className="w-56">
-        {layout === "menu" ? (
-          <>
-            <DropdownMenuLabel>
-              {supportsPlaybackControl ? "Playback Actions" : "Limited Playback Actions"}
-            </DropdownMenuLabel>
-            {supportsPlaybackControl ? (
-              <DropdownMenuItem onSelect={() => void runAction(primaryAction.action)}>
-                {primaryAction.action === "pause" ? (
-                  <Pause className="h-4 w-4" />
-                ) : (
-                  <Play className="h-4 w-4" />
-                )}
-                {primaryAction.label}
-              </DropdownMenuItem>
+        <DropdownMenuLabel>
+          {layout === "inline"
+            ? "Session Actions"
+            : supportsPlaybackControl
+              ? "Playback Actions"
+              : "Limited Playback Actions"}
+        </DropdownMenuLabel>
+        {supportsPlaybackControl ? (
+          <DropdownMenuItem onSelect={() => void runAction(primaryAction.action)}>
+            {primaryAction.action === "pause" ? (
+              <Pause className="h-4 w-4" />
             ) : (
-              <>
-                <div className="text-muted-foreground px-2 py-1.5 text-xs leading-5">
-                  {unsupportedPlaybackControlCopy}
-                </div>
-                <DropdownMenuSeparator />
-              </>
+              <Play className="h-4 w-4" />
             )}
-            <DropdownMenuItem onSelect={() => void runAction("stop")}>
-              <Square className="h-4 w-4" />
-              Stop
-            </DropdownMenuItem>
-          </>
+            {primaryAction.label}
+          </DropdownMenuItem>
         ) : (
-          <DropdownMenuLabel>Session Actions</DropdownMenuLabel>
+          <>
+            <div className="text-muted-foreground px-2 py-1.5 text-xs leading-5">
+              {unsupportedPlaybackControlCopy}
+            </div>
+            <DropdownMenuSeparator />
+          </>
         )}
+        <DropdownMenuItem onSelect={() => void runAction("stop")}>
+          <Square className="h-4 w-4" />
+          Stop
+        </DropdownMenuItem>
         {extraMenuItems ? (
           <>
-            {layout === "menu" ? <DropdownMenuSeparator /> : null}
+            <DropdownMenuSeparator />
             {extraMenuItems}
           </>
         ) : null}
@@ -272,13 +270,6 @@ export function AdminSessionActions({
             <MessageSquare className="h-4 w-4" />
             Message…
           </DropdownMenuItem>
-        ) : layout === "inline" ? (
-          <>
-            <div className="text-muted-foreground px-2 py-1.5 text-xs leading-5">
-              {unsupportedPlaybackControlCopy}
-            </div>
-            <DropdownMenuSeparator />
-          </>
         ) : null}
         {showInlineTerminate ? null : (
           <>
@@ -296,7 +287,7 @@ export function AdminSessionActions({
   return (
     <>
       {layout === "inline" ? (
-        <div className="flex items-center justify-end gap-1.5">
+        <div className="flex flex-wrap items-center justify-end gap-1.5">
           {inlinePrefixActions}
           {terminateButton}
           {menu}
diff --git a/web/src/components/AdminSidebar.test.tsx b/web/src/components/AdminSidebar.test.tsx
index da842d1bf8..e7ddfbb0f2 100644
--- a/web/src/components/AdminSidebar.test.tsx
+++ b/web/src/components/AdminSidebar.test.tsx
@@ -1,7 +1,10 @@
+import type { SettingsHealthItem } from "@/hooks/admin/useSettingsHealth";
 import type { BuildInfo } from "@/hooks/queries/admin/system";
+import { cleanup, fireEvent, render, screen, within } from "@testing-library/react";
 import { renderToStaticMarkup } from "react-dom/server";
 import { MemoryRouter } from "react-router";
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { SEARCH_SHORTCUT_LABEL } from "@/lib/keyboardShortcut";
 import AdminSidebar from "./AdminSidebar";
 
 interface MockBuildInfoResult {
@@ -66,16 +69,50 @@ vi.mock("@/hooks/queries/admin/requests", () => ({
   useAdminRequestCounts: () => mockUseAdminRequestCounts(),
 }));
 
-function renderSidebar(embedded = false) {
+const mockPrefetchSettings = vi.fn();
+vi.mock("@/hooks/queries/admin/settings", () => ({
+  usePrefetchAdminServerSettings: () => mockPrefetchSettings,
+}));
+
+const mockUseSettingsAttention = vi.fn<() => SettingsHealthItem[]>(() => []);
+vi.mock("@/hooks/admin/useSettingsHealth", () => ({
+  useSettingsAttention: () => mockUseSettingsAttention(),
+}));
+
+function renderSidebar(path = "/admin") {
   return renderToStaticMarkup(
-    <MemoryRouter initialEntries={["/admin"]}>
-      <AdminSidebar embedded={embedded} />
+    <MemoryRouter initialEntries={[path]}>
+      <AdminSidebar />
     </MemoryRouter>,
   );
 }
 
+function renderLiveSidebar(path = "/admin") {
+  return render(
+    <MemoryRouter initialEntries={[path]}>
+      <AdminSidebar />
+    </MemoryRouter>,
+  );
+}
+
+function stubLocalStorage() {
+  const memory = new Map<string, string>();
+  vi.stubGlobal("localStorage", {
+    getItem: (key: string) => memory.get(key) ?? null,
+    setItem: (key: string, value: string) => memory.set(key, value),
+    removeItem: (key: string) => memory.delete(key),
+  });
+  return memory;
+}
+
 describe("AdminSidebar", () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
   beforeEach(() => {
+    stubLocalStorage();
+    mockUseSettingsAttention.mockReturnValue([]);
     mockUsePolicyCapability.mockReturnValue({
       data: {
         enabled: true,
@@ -86,36 +123,155 @@ describe("AdminSidebar", () => {
     });
   });
 
-  it("shows how many requests need approval on the Requests entry", () => {
-    mockUseAdminRequestCounts.mockReturnValueOnce({ data: { needs_approval: 3 } });
-    const markup = renderSidebar();
-    const requestsLink = markup.match(/<a[^>]*href="\/admin\/requests"[^>]*>.*?<\/a>/)?.[0];
+  it("shows how many requests need approval on the queue, and on Requests while it is closed", () => {
+    mockUseAdminRequestCounts.mockReturnValue({ data: { needs_approval: 3 } });
+    const queue = renderSidebar("/admin/requests").match(
+      /<a[^>]*href="\/admin\/requests"[^>]*>.*?<\/a>/,
+    )?.[0];
+    expect(queue).toContain('<span aria-hidden="true">3</span>');
+    expect(queue).toContain(", 3 need approval");
+
+    renderLiveSidebar("/admin");
+    expect(screen.getByRole("button", { name: /^Requests, 3 need approval/ })).toHaveAttribute(
+      "aria-expanded",
+      "false",
+    );
+    mockUseAdminRequestCounts.mockReturnValue({ data: { needs_approval: 0 } });
+  });
 
-    expect(requestsLink).toContain('<span aria-hidden="true">3</span>');
-    expect(requestsLink).toContain(", 3 need approval");
+  it("leaves Requests plain when nothing needs approval", () => {
+    renderLiveSidebar("/admin");
+
+    expect(screen.getByRole("button", { name: "Requests" })).not.toHaveTextContent("approval");
   });
 
-  it("leaves the Requests entry plain when nothing needs approval", () => {
-    const markup = renderSidebar();
-    const requestsLink = markup.match(/<a[^>]*href="\/admin\/requests"[^>]*>.*?<\/a>/)?.[0];
+  it("opens the topic holding the current page and marks the page", () => {
+    renderLiveSidebar("/admin/settings/playback");
+
+    expect(screen.getByRole("button", { name: "Playback" })).toHaveAttribute(
+      "aria-expanded",
+      "true",
+    );
+    const playback = screen.getByRole("list", { name: "Playback" });
+    expect(within(playback).getByRole("link", { name: "Settings" })).toHaveAttribute(
+      "aria-current",
+      "page",
+    );
+    expect(within(playback).getByRole("link", { name: "Settings" })).toHaveAttribute(
+      "href",
+      "/admin/settings/playback",
+    );
+    expect(screen.getByRole("button", { name: "Integrations" })).toHaveAttribute(
+      "aria-expanded",
+      "false",
+    );
+  });
 
-    expect(requestsLink).toBeDefined();
-    expect(requestsLink).not.toContain("need approval");
+  it("opens and closes a topic on click and remembers the choice", () => {
+    const view = renderLiveSidebar("/admin");
+    const integrations = screen.getByRole("button", { name: "Integrations" });
+
+    fireEvent.click(integrations);
+    expect(integrations).toHaveAttribute("aria-expanded", "true");
+    expect(
+      within(screen.getByRole("list", { name: "Integrations" })).getByRole("link", {
+        name: "AI Services",
+      }),
+    ).toHaveAttribute("href", "/admin/settings/ai");
+
+    view.unmount();
+    renderLiveSidebar("/admin/users");
+    expect(screen.getByRole("button", { name: "Integrations" })).toHaveAttribute(
+      "aria-expanded",
+      "true",
+    );
   });
 
-  it("keeps settings as one sidebar destination", () => {
-    const markup = renderSidebar();
-    const settingsLinks = markup.match(/href="\/admin\/settings[^"]*"/g) ?? [];
+  it("reopens the current page's topic even after it was closed there", () => {
+    renderLiveSidebar("/admin/libraries");
+    fireEvent.click(screen.getByRole("button", { name: "Libraries" }));
+    expect(screen.getByRole("button", { name: "Libraries" })).toHaveAttribute(
+      "aria-expanded",
+      "false",
+    );
+    cleanup();
+
+    renderLiveSidebar("/admin/collections");
+    expect(screen.getByRole("button", { name: "Libraries" })).toHaveAttribute(
+      "aria-expanded",
+      "true",
+    );
+  });
 
-    expect(settingsLinks).toEqual(['href="/admin/settings"']);
-    expect(markup).not.toContain("/admin/settings?tab=");
+  it("marks a broken setting on its page and on its closed topic", () => {
+    mockUseSettingsAttention.mockReturnValue([
+      {
+        id: "transcoding",
+        label: "Transcoding",
+        state: "warn",
+        stateText: "Restart pending",
+        detail: "Saved changes apply after a restart",
+        action: { label: "Fix", page: "playback" },
+      },
+      {
+        id: "email",
+        label: "Email",
+        state: "off",
+        stateText: "Not set up",
+        detail: "Invites and resets can't send",
+        action: { label: "Set up", page: "notifications" },
+      },
+    ]);
+    renderLiveSidebar("/admin");
+
+    expect(
+      screen.getByRole("button", { name: /^Playback, Transcoding restart pending/ }),
+    ).toBeInTheDocument();
+    // Setup nobody has done yet is the Dashboard's to mention, not a dot.
+    expect(screen.getByRole("button", { name: "Integrations" })).toBeInTheDocument();
   });
 
-  it("includes a Sections link in the content navigation", () => {
-    const markup = renderSidebar();
+  it("fetches what a settings page needs once the pointer is on its link", () => {
+    mockPrefetchSettings.mockClear();
+    renderLiveSidebar("/admin/libraries");
+    const libraries = screen.getByRole("list", { name: "Libraries" });
+
+    fireEvent.pointerEnter(within(libraries).getByRole("link", { name: "Collections" }));
+    expect(mockPrefetchSettings).not.toHaveBeenCalled();
+
+    fireEvent.pointerEnter(within(libraries).getByRole("link", { name: "Settings" }));
+    expect(mockPrefetchSettings).toHaveBeenCalledTimes(1);
+  });
+
+  it("puts the admin search at the top of the desktop sidebar", () => {
+    const onSearch = vi.fn();
+    render(
+      <MemoryRouter initialEntries={["/admin"]}>
+        <AdminSidebar onSearch={onSearch} />
+      </MemoryRouter>,
+    );
+
+    const search = screen.getByRole("button", { name: "Search admin sections" });
+    expect(search).toHaveTextContent(SEARCH_SHORTCUT_LABEL);
+    fireEvent.click(search);
+    expect(onSearch).toHaveBeenCalledTimes(1);
+  });
+
+  it("leaves search out of the phone drawer, whose header has its own", () => {
+    render(
+      <MemoryRouter initialEntries={["/admin"]}>
+        <AdminSidebar embedded />
+      </MemoryRouter>,
+    );
+
+    expect(screen.queryByRole("button", { name: "Search admin sections" })).not.toBeInTheDocument();
+  });
+
+  it("lists home rows as Home Sections under Libraries", () => {
+    const markup = renderSidebar("/admin/sections");
 
     expect(markup).toContain('href="/admin/sections"');
-    expect(markup).toContain(">Sections<");
+    expect(markup).toContain(">Home Sections<");
     expect(markup).not.toContain('href="/admin/home-rows"');
   });
 
@@ -129,8 +285,10 @@ describe("AdminSidebar", () => {
       },
     });
 
-    const markup = renderSidebar();
+    // The topic is open on API Keys, so Policy would be listed beside it.
+    const markup = renderSidebar("/admin/api-keys");
 
+    expect(markup).toContain('href="/admin/api-keys"');
     expect(markup).not.toContain('href="/admin/policy"');
     expect(markup).not.toContain(">Policy<");
   });
diff --git a/web/src/components/AdminSidebar.tsx b/web/src/components/AdminSidebar.tsx
index ff8217c29c..18a5cb113c 100644
--- a/web/src/components/AdminSidebar.tsx
+++ b/web/src/components/AdminSidebar.tsx
@@ -1,35 +1,49 @@
 import { Link, useLocation } from "react-router";
-import { ArrowLeft } from "lucide-react";
+import { ArrowLeft, Search } from "lucide-react";
 import type { ReactNode } from "react";
-import { SideNavItem, SideNavSection } from "@/components/SideNav";
+import {
+  SideNavAttentionDot,
+  SideNavItem,
+  SideNavSection,
+  SideNavSubItem,
+  SideNavTopic,
+} from "@/components/SideNav";
 import { PrairieBrand } from "@/components/PrairieBrand";
 import ViewTransitionLink from "@/components/ViewTransitionLink";
 import {
   buildAdminNavSections,
   buildAdminPluginNavItems,
-  type AdminNavGroup,
+  isAdminNavTopic,
   type AdminNavItem,
 } from "@/lib/adminNavigation";
+import { adminSettingsHref } from "@/lib/adminSettingsSearch";
 import { navigateToPluginRoute } from "@/lib/buildPluginHref";
+import { SEARCH_SHORTCUT_LABEL } from "@/lib/keyboardShortcut";
+import { useSettingsAttention } from "@/hooks/admin/useSettingsHealth";
+import { useAdminNavTopics } from "@/hooks/useAdminNavTopics";
 import { useAdminPluginInstallations } from "@/hooks/queries/admin/plugins";
 import { usePolicyCapability } from "@/hooks/queries/admin/policy";
 import { useAdminSessions } from "@/hooks/queries/admin/stats";
 import { useBuildInfo } from "@/hooks/queries/admin/system";
 import { useAdminRequestCounts } from "@/hooks/queries/admin/requests";
+import { usePrefetchAdminServerSettings } from "@/hooks/queries/admin/settings";
 import { cn } from "@/lib/utils";
 
-interface SidebarItem extends AdminNavItem {
-  badge?: ReactNode;
-}
-
-interface SidebarSection extends Omit<AdminNavGroup, "items"> {
-  label: string;
-  items: SidebarItem[];
-}
-
 interface AdminSidebarProps {
   onNavigate?: () => void;
   embedded?: boolean;
+  /**
+   * Opens the admin command palette. The desktop shell passes it; the phone
+   * drawer leaves it out, since the phone header already has a search button
+   * and the drawer would have to close under the palette.
+   */
+  onSearch?: () => void;
+}
+
+const SETTINGS_PREFIX = "/admin/settings/";
+
+function preloadSettingsPages() {
+  void import("@/pages/admin-settings/AdminSettingsLayout");
 }
 
 function useSessionCount() {
@@ -37,8 +51,30 @@ function useSessionCount() {
   return sessions.length;
 }
 
-export default function AdminSidebar({ onNavigate, embedded = false }: AdminSidebarProps) {
+/**
+ * Pages whose settings are broken right now: a restart a saved setting is
+ * waiting on, or a configured service that is failing. Setup the admin has not
+ * done yet ("Email not set up") is left to the Dashboard's notice, so a server
+ * that deliberately runs without mail does not carry a dot forever.
+ */
+function useBrokenSettingsBadges(): Record<string, ReactNode> {
+  const badges: Record<string, ReactNode> = {};
+  for (const item of useSettingsAttention()) {
+    if (item.state !== "warn" || !item.action) continue;
+    badges[adminSettingsHref(item.action.page)] = (
+      <SideNavAttentionDot label={`${item.label} ${item.stateText.toLowerCase()}`} />
+    );
+  }
+  return badges;
+}
+
+export default function AdminSidebar({
+  onNavigate,
+  embedded = false,
+  onSearch,
+}: AdminSidebarProps) {
   const location = useLocation();
+  const prefetchSettings = usePrefetchAdminServerSettings();
   const sessionCount = useSessionCount();
   const buildInfo = useBuildInfo();
   const policyCapability = usePolicyCapability();
@@ -67,17 +103,13 @@ export default function AdminSidebar({ onNavigate, embedded = false }: AdminSide
       </span>
     ) : undefined;
   const badges: Record<string, ReactNode> = {
+    ...useBrokenSettingsBadges(),
     "/admin/activity": activityBadge,
     "/admin/requests": requestsBadge,
   };
-  const sections: SidebarSection[] = buildAdminNavSections({
+  const sections = buildAdminNavSections({
     policyEditorAvailable: policyCapability.data?.editor_available === true,
-  }).map((section) => ({
-    ...section,
-    items: section.items.map((item) =>
-      badges[item.href] ? { ...item, badge: badges[item.href] } : item,
-    ),
-  }));
+  });
 
   // Use the admin installations endpoint, not /settings/plugins — the user
   // settings endpoint filters to plugins that expose user settings / a user-
@@ -86,15 +118,47 @@ export default function AdminSidebar({ onNavigate, embedded = false }: AdminSide
   // its "Plugin Apps" group.
   const { data: adminInstallations } = useAdminPluginInstallations();
   const adminPluginItems = buildAdminPluginNavItems(adminInstallations);
-  if (adminPluginItems.length > 0) {
-    sections.push({ label: "Plugin Apps", items: adminPluginItems });
-  }
 
-  function isActive(item: SidebarItem) {
+  function isActive(item: AdminNavItem) {
     if (item.exact) return location.pathname === item.href;
     return location.pathname === item.href || location.pathname.startsWith(`${item.href}/`);
   }
 
+  const activeTopic = sections
+    .flatMap((section) => section.entries)
+    .find((entry) => isAdminNavTopic(entry) && entry.items.some(isActive));
+  const topics = useAdminNavTopics(
+    activeTopic && isAdminNavTopic(activeTopic) ? activeTopic.id : null,
+  );
+
+  function renderPluginItem(item: AdminNavItem) {
+    return (
+      <SideNavItem
+        key={item.href}
+        label={item.label}
+        icon={item.icon}
+        href={item.href}
+        external
+        active={isActive(item)}
+        onClick={(e) => {
+          e.preventDefault();
+          void navigateToPluginRoute(item.href);
+          onNavigate?.();
+        }}
+      />
+    );
+  }
+
+  // A settings page draws from the settings form: fetch its code and values
+  // while the pointer is on the link, so the click lands on a filled page.
+  function intentFor(item: AdminNavItem) {
+    if (!item.href.startsWith(SETTINGS_PREFIX)) return undefined;
+    return () => {
+      preloadSettingsPages();
+      prefetchSettings();
+    };
+  }
+
   return (
     <aside
       data-layout={embedded ? "drawer" : "desktop"}
@@ -116,6 +180,23 @@ export default function AdminSidebar({ onNavigate, embedded = false }: AdminSide
           <PrairieBrand className="h-12 w-[112px]" />
         </Link>
       </div>
+      {onSearch ? (
+        <div className="px-3 pb-4">
+          <button
+            type="button"
+            onClick={onSearch}
+            aria-label="Search admin sections"
+            title={`Search admin sections (${SEARCH_SHORTCUT_LABEL})`}
+            className="border-border/70 bg-surface/70 text-muted-foreground hover:text-foreground hover:bg-accent/60 focus-visible:ring-ring/60 flex h-10 w-full items-center gap-2.5 rounded-xl border px-3 text-[13px] transition-colors focus-visible:ring-[3px] focus-visible:outline-none"
+          >
+            <Search className="h-4 w-4 shrink-0" aria-hidden="true" />
+            <span>Search</span>
+            <kbd className="border-border/70 pointer-events-none ml-auto rounded border px-1.5 py-0.5 font-mono text-[10px] whitespace-nowrap select-none">
+              {SEARCH_SHORTCUT_LABEL}
+            </kbd>
+          </button>
+        </div>
+      ) : null}
       {/* Nav sections */}
       <nav
         aria-label="Admin navigation"
@@ -123,36 +204,53 @@ export default function AdminSidebar({ onNavigate, embedded = false }: AdminSide
       >
         {sections.map((section) => (
           <SideNavSection key={section.label} label={section.label} idPrefix="admin-nav">
-            {section.items.map((item) =>
-              item.external ? (
-                <SideNavItem
-                  key={item.href}
-                  label={item.label}
-                  icon={item.icon}
-                  href={item.href}
-                  external
-                  active={isActive(item)}
-                  badge={item.badge}
-                  onClick={(e) => {
-                    e.preventDefault();
-                    void navigateToPluginRoute(item.href);
-                    onNavigate?.();
-                  }}
-                />
-              ) : (
-                <SideNavItem
-                  key={item.href}
-                  label={item.label}
-                  icon={item.icon}
-                  href={item.href}
-                  active={isActive(item)}
-                  badge={item.badge}
-                  onClick={onNavigate}
-                />
-              ),
-            )}
+            {section.entries.map((entry) => {
+              if (!isAdminNavTopic(entry)) {
+                return (
+                  <SideNavItem
+                    key={entry.href}
+                    label={entry.label}
+                    icon={entry.icon}
+                    href={entry.href}
+                    active={isActive(entry)}
+                    badge={badges[entry.href]}
+                    onClick={onNavigate}
+                  />
+                );
+              }
+              // A closed topic shows the first badge among its pages, so a
+              // pending request or a broken setting is never folded away.
+              const childBadge = entry.items.map((item) => badges[item.href]).find(Boolean);
+              return (
+                <SideNavTopic
+                  key={entry.id}
+                  label={entry.label}
+                  icon={entry.icon}
+                  open={topics.isOpen(entry.id)}
+                  onToggle={() => topics.toggle(entry.id)}
+                  badge={childBadge}
+                >
+                  {entry.items.map((item) => (
+                    <SideNavSubItem
+                      key={item.href}
+                      label={item.label}
+                      href={item.href}
+                      active={isActive(item)}
+                      badge={badges[item.href]}
+                      onClick={onNavigate}
+                      onIntent={intentFor(item)}
+                    />
+                  ))}
+                </SideNavTopic>
+              );
+            })}
           </SideNavSection>
         ))}
+        {adminPluginItems.length > 0 ? (
+          <SideNavSection label="Plugin Apps" idPrefix="admin-nav">
+            {adminPluginItems.map(renderPluginItem)}
+          </SideNavSection>
+        ) : null}
       </nav>
 
       {/* Footer */}
diff --git a/web/src/components/AdminUserDeleteDialog.test.tsx b/web/src/components/AdminUserDeleteDialog.test.tsx
index b4477ff72e..2fadde3f07 100644
--- a/web/src/components/AdminUserDeleteDialog.test.tsx
+++ b/web/src/components/AdminUserDeleteDialog.test.tsx
@@ -33,7 +33,7 @@ const user = {
   max_local_stream_bitrate_kbps: null,
   transcode_allowed: null,
   audio_transcode_allowed: null,
-  max_profiles: 5,
+  max_profiles: null,
   download_allowed: null,
   download_transcode_allowed: null,
   requests_allowed: null,
@@ -48,6 +48,7 @@ const user = {
     max_transcodes: 0,
     max_remote_stream_bitrate_kbps: 0,
     max_local_stream_bitrate_kbps: 0,
+    max_profiles: 5,
     transcode_allowed: true,
     audio_transcode_allowed: true,
     download_allowed: true,
diff --git a/web/src/components/AdminUserPasswordResetDialog.tsx b/web/src/components/AdminUserPasswordResetDialog.tsx
index 4b1cbd6e05..413e9de123 100644
--- a/web/src/components/AdminUserPasswordResetDialog.tsx
+++ b/web/src/components/AdminUserPasswordResetDialog.tsx
@@ -248,7 +248,12 @@ export function AdminUserPasswordResetDialog({
               onSelect={setMethod}
             >
               <span>Type one now and tell them.</span>
-              <div className={cn("mt-2.5 space-y-2", method !== "password" && "opacity-50")}>
+              <div
+                className={cn(
+                  "mt-2.5 space-y-2",
+                  method !== "password" && "pointer-events-none opacity-50",
+                )}
+              >
                 <label htmlFor={passwordId} className="sr-only">
                   Temporary password
                 </label>
diff --git a/web/src/components/AppSidebar.tsx b/web/src/components/AppSidebar.tsx
index 6cc5adf4c7..99de08f06d 100644
--- a/web/src/components/AppSidebar.tsx
+++ b/web/src/components/AppSidebar.tsx
@@ -13,6 +13,7 @@ import {
 } from "@/components/AppSidebar.logic";
 import { PrairieBrand } from "@/components/PrairieBrand";
 import { useAuth } from "@/hooks/useAuth";
+import { useSidebarEntrance, type SidebarSwap } from "@/hooks/useSidebarSwap";
 import { useCurrentProfile } from "@/hooks/useCurrentProfile";
 import { useIsActingAdmin } from "@/hooks/useIsActingAdmin";
 import { navigateToPluginRoute } from "@/lib/buildPluginHref";
@@ -180,6 +181,19 @@ function SidebarSectionHeader({
 interface AppSidebarProps {
   onNavigate?: () => void;
   collapsed?: boolean;
+  /** Set when this sidebar just replaced the settings sidebar; see useSidebarSwap. */
+  swap?: SidebarSwap | null;
+}
+
+/**
+ * The menu's Settings item opens the settings shell on its first page. Loading
+ * their code when the menu opens means the click lands on a drawn page rather
+ * than a blank frame while the chunks arrive.
+ */
+function preloadSettings() {
+  void import("@/pages/SettingsLayout");
+  void import("@/components/settings/UserSettingsSidebar");
+  void import("@/pages/settings/PlaybackSettings");
 }
 
 interface ResolvedPrimaryMenuLink {
@@ -189,7 +203,8 @@ interface ResolvedPrimaryMenuLink {
   icon: ReactNode;
 }
 
-export default function AppSidebar({ onNavigate, collapsed = false }: AppSidebarProps) {
+export default function AppSidebar({ onNavigate, collapsed = false, swap }: AppSidebarProps) {
+  const entrance = useSidebarEntrance(swap);
   const location = useLocation();
   const navigate = useViewTransitionNavigate();
   const params = useParams<{ libraryId: string }>();
@@ -480,7 +495,10 @@ export default function AppSidebar({ onNavigate, collapsed = false }: AppSidebar
           across it. The blur lives here rather than on the frame precisely
           because this layer never moves relative to the viewport — its 40px
           backdrop is sampled from a region that never changes. */}
-      <div className="bg-sidebar/88 sidebar-inner flex h-full w-[260px] flex-col backdrop-blur-2xl">
+      <div
+        data-sidebar-entrance={entrance}
+        className="bg-sidebar/88 sidebar-inner flex h-full w-[260px] flex-col backdrop-blur-2xl"
+      >
         {/* Logo — the wordmark and the mark cross-fade in place. Swapping the
           variant outright would pop at the very start of the collapse. */}
         <ViewTransitionLink
@@ -1012,6 +1030,7 @@ export default function AppSidebar({ onNavigate, collapsed = false }: AppSidebar
               if (hoverTimerRef.current) clearTimeout(hoverTimerRef.current);
               hoverTimerRef.current = null;
               setProfileMenuOpen(open);
+              if (open) preloadSettings();
               if (!open && !collapsed) return;
               setHovered(open);
             }}
diff --git a/web/src/components/CastCarousel.test.tsx b/web/src/components/CastCarousel.test.tsx
index 5cb9a3753b..8001b4fb99 100644
--- a/web/src/components/CastCarousel.test.tsx
+++ b/web/src/components/CastCarousel.test.tsx
@@ -2,6 +2,7 @@ import { renderToStaticMarkup } from "react-dom/server";
 import { MemoryRouter } from "react-router";
 import { describe, expect, it } from "vitest";
 import CastCarousel from "./CastCarousel";
+import { buildCrewGroups } from "./castCrewGroups";
 
 describe("CastCarousel", () => {
   it("renders an Embla carousel with cast cards", () => {
@@ -36,4 +37,179 @@ describe("CastCarousel", () => {
     expect(markup).toContain(">DH<");
     expect(markup).not.toContain('data-slot="scroll-area"');
   });
+
+  it("puts crew groups ahead of the cast with labelled dividers", () => {
+    const director = {
+      name: "Denis Villeneuve",
+      job: "Director",
+      person_id: "person-100",
+      photo_url: "https://images.example.test/villeneuve.jpg",
+    };
+    const crew = [
+      director,
+      director,
+      { name: "Second Director", job: "Director", person_id: "person-101" },
+      { name: "Third Director", job: "Director", person_id: "person-102" },
+      { name: "Hampton Fancher", job: "Writer", person_id: "person-103" },
+      { name: "Denis Villeneuve", job: "Writer", person_id: "person-100" },
+      { name: "Some Producer", job: "Producer", person_id: "person-104" },
+    ];
+    const cast = Array.from({ length: 5 }, (_, i) => ({
+      name: `Actor ${i}`,
+      character: `Role ${i}`,
+      order: i,
+      person_id: `person-${i}`,
+    }));
+    const markup = renderToStaticMarkup(
+      <MemoryRouter initialEntries={["/item/movie-1"]}>
+        <CastCarousel cast={cast} crewGroups={buildCrewGroups(crew, "Director")} limit={3} />
+      </MemoryRouter>,
+    );
+
+    expect(markup.match(/>Denis Villeneuve</g)).toHaveLength(1);
+    expect(markup).toContain(">Second Director<");
+    expect(markup).not.toContain("Third Director");
+    expect(markup).not.toContain("Some Producer");
+    expect(markup).not.toContain("w-[140px]");
+    expect(markup).toContain(">Writers<");
+    expect(markup).toContain(">Cast<");
+    const order = ["Denis Villeneuve", ">Writers<", "Hampton Fancher", ">Cast<", "Actor 0"].map(
+      (needle) => markup.indexOf(needle),
+    );
+    expect(order).toEqual([...order].sort((a, b) => a - b));
+    expect(markup).toContain("Actor 2");
+    expect(markup).not.toContain("Actor 3");
+  });
+
+  it("labels series creators and renders crew alone when there is no cast", () => {
+    const markup = renderToStaticMarkup(
+      <MemoryRouter initialEntries={["/item/series-1"]}>
+        <CastCarousel
+          cast={[]}
+          crewGroups={buildCrewGroups(
+            [{ name: "Vince Gilligan", job: "Creator", person_id: "person-200" }],
+            "Creator",
+          )}
+        />
+      </MemoryRouter>,
+    );
+
+    expect(markup).toContain(">Vince Gilligan<");
+    expect(markup).toContain(">Creator<");
+    expect(markup).not.toContain(">Cast<");
+    expect(markup).not.toContain("Writers");
+  });
+
+  it("leads a series with its Creator credits ahead of its directors", () => {
+    const [leads] = buildCrewGroups(
+      [
+        { name: "Michelle MacLaren", job: "Director", person_id: "person-201" },
+        { name: "Vince Gilligan", job: "Creator", person_id: "person-200" },
+      ],
+      "Creator",
+    );
+
+    expect(leads?.members.map((c) => c.name)).toEqual(["Vince Gilligan"]);
+  });
+
+  it("captions a series' directors as directors when it has no Creator credits", () => {
+    const [leads] = buildCrewGroups(
+      [{ name: "Michelle MacLaren", job: "Director", person_id: "person-201" }],
+      "Creator",
+    );
+
+    expect(leads?.role).toBe("Director");
+    expect(leads?.members.map((c) => c.name)).toEqual(["Michelle MacLaren"]);
+  });
+
+  it("keeps a writer who is a director past the lead cap in the Writers group", () => {
+    const [, writers] = buildCrewGroups(
+      [
+        { name: "First Director", job: "Director", person_id: "person-300" },
+        { name: "Second Director", job: "Director", person_id: "person-301" },
+        { name: "Third Director", job: "Director", person_id: "person-302" },
+        { name: "First Director", job: "Writer", person_id: "person-300" },
+        { name: "Third Director", job: "Writer", person_id: "person-302" },
+      ],
+      "Director",
+    );
+
+    expect(writers?.members.map((c) => c.name)).toEqual(["Third Director"]);
+  });
+
+  it("shows every creator of a series, once each", () => {
+    const markup = renderToStaticMarkup(
+      <MemoryRouter initialEntries={["/item/series-1"]}>
+        <CastCarousel
+          cast={[]}
+          crewGroups={buildCrewGroups(
+            [
+              { name: "J.J. Abrams", job: "Creator", person_id: "person-400" },
+              { name: "Damon Lindelof", job: "Creator", person_id: "person-401" },
+              { name: "Jeffrey Lieber", job: "Creator", person_id: "person-402" },
+              { name: "J.J. Abrams", job: "Creator", person_id: "person-400" },
+            ],
+            "Creator",
+          )}
+        />
+      </MemoryRouter>,
+    );
+
+    expect(markup.match(/>Creator</g)).toHaveLength(3);
+    for (const name of ["J.J. Abrams", "Damon Lindelof", "Jeffrey Lieber"]) {
+      expect(markup.match(new RegExp(`>${name}<`, "g"))).toHaveLength(1);
+    }
+  });
+
+  it("leaves every series creator out of the Writers group", () => {
+    const [, writers] = buildCrewGroups(
+      [
+        { name: "J.J. Abrams", job: "Creator", person_id: "person-400" },
+        { name: "Damon Lindelof", job: "Creator", person_id: "person-401" },
+        { name: "Jeffrey Lieber", job: "Creator", person_id: "person-402" },
+        { name: "Jeffrey Lieber", job: "Writer", person_id: "person-402" },
+        { name: "Staff Writer", job: "Writer", person_id: "person-403" },
+      ],
+      "Creator",
+    );
+
+    expect(writers?.members.map((c) => c.name)).toEqual(["Staff Writer"]);
+  });
+
+  it.each([
+    ["a movie", "Director"],
+    ["a series without Creator credits", "Creator"],
+  ] as const)("still shows at most two directors for %s", (_, leadRole) => {
+    const markup = renderToStaticMarkup(
+      <MemoryRouter>
+        <CastCarousel
+          cast={[]}
+          crewGroups={buildCrewGroups(
+            [
+              { name: "First Director", job: "Director", person_id: "person-500" },
+              { name: "Second Director", job: "Director", person_id: "person-501" },
+              { name: "Third Director", job: "Director", person_id: "person-502" },
+            ],
+            leadRole,
+          )}
+        />
+      </MemoryRouter>,
+    );
+
+    expect(markup.match(/>Director</g)).toHaveLength(2);
+    expect(markup).toContain(">First Director<");
+    expect(markup).toContain(">Second Director<");
+    expect(markup).not.toContain("Third Director");
+  });
+
+  it("renders the plain cast row without dividers when no crew groups are passed", () => {
+    const markup = renderToStaticMarkup(
+      <MemoryRouter>
+        <CastCarousel cast={[{ name: "Solo", character: "Lead", order: 0, person_id: "p" }]} />
+      </MemoryRouter>,
+    );
+
+    expect(markup).toContain(">Solo<");
+    expect(markup).not.toContain(">Cast<");
+  });
 });
diff --git a/web/src/components/CastCarousel.tsx b/web/src/components/CastCarousel.tsx
index 0b10149e6f..413e2b0e85 100644
--- a/web/src/components/CastCarousel.tsx
+++ b/web/src/components/CastCarousel.tsx
@@ -1,7 +1,8 @@
-import { memo, useMemo, useState } from "react";
+import { Fragment, memo, useMemo, useState } from "react";
 import { ChevronLeft, ChevronRight } from "lucide-react";
 import ViewTransitionLink from "@/components/ViewTransitionLink";
 import type { CastMember } from "@/api/types";
+import type { CrewGroup } from "@/components/castCrewGroups";
 import { usePrefetchPeople } from "@/hooks/queries/people";
 import { useCarouselEmbla } from "@/hooks/useCarouselEmbla";
 import { buildPersonCatalogHref } from "@/pages/catalogSearchParams";
@@ -23,6 +24,25 @@ interface CastCarouselProps {
   fullBleed?: boolean;
   /** Warm person detail for the shown cast so opening one renders at once. */
   prefetchPeople?: boolean;
+  /**
+   * Crew groups shown ahead of the cast, in order (e.g. Director, then
+   * Writers). Each group after the first, and the cast, gets a labelled
+   * divider so the row reads as one "Cast & Crew" strip.
+   */
+  crewGroups?: CrewGroup[];
+}
+
+interface CreditCardData {
+  name: string;
+  subtitle: string;
+  personId: string;
+  photoUrl?: string;
+}
+
+interface CreditSection {
+  key: string;
+  label: string;
+  cards: CreditCardData[];
 }
 
 function CastCarousel({
@@ -30,19 +50,63 @@ function CastCarousel({
   limit = 20,
   fullBleed = false,
   prefetchPeople = false,
+  crewGroups,
 }: CastCarouselProps) {
   const { emblaRef, canScrollPrev, canScrollNext, scrollPrev, scrollNext } = useCarouselEmbla();
+  const visible = useMemo(
+    () =>
+      cast
+        .slice()
+        .sort((a, b) => a.order - b.order)
+        .slice(0, limit),
+    [cast, limit],
+  );
+  const sections = useMemo(() => {
+    const out: CreditSection[] = [];
+    for (const group of crewGroups ?? []) {
+      const seen = new Set<string>();
+      const cards: CreditCardData[] = [];
+      for (const member of group.members) {
+        const key = member.person_id || member.name;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        cards.push({
+          name: member.name,
+          subtitle: group.role,
+          personId: member.person_id,
+          photoUrl: member.photo_url,
+        });
+        if (cards.length === group.max) break;
+      }
+      if (cards.length > 0) {
+        out.push({ key: group.label, label: group.label, cards });
+      }
+    }
+    if (visible.length > 0) {
+      out.push({
+        key: "cast",
+        label: "Cast",
+        cards: visible.map((member) => ({
+          name: member.name,
+          subtitle: member.character,
+          personId: member.person_id,
+          photoUrl: member.photo_url,
+        })),
+      });
+    }
+    return out;
+  }, [crewGroups, visible]);
+  const prefetchIds = useMemo(
+    () =>
+      sections.flatMap((section) => section.cards.flatMap((c) => (c.personId ? [c.personId] : []))),
+    [sections],
+  );
 
-  if (cast.length === 0) return null;
-
-  const visible = cast
-    .slice()
-    .sort((a, b) => a.order - b.order)
-    .slice(0, limit);
+  if (sections.length === 0) return null;
 
   return (
     <div className="group/carousel relative">
-      {prefetchPeople && <PrefetchCastPeople cast={visible} />}
+      {prefetchPeople && <PrefetchCastPeople personIds={prefetchIds} />}
       {canScrollPrev && (
         <button
           type="button"
@@ -71,19 +135,36 @@ function CastCarousel({
             fullBleed && "pl-4 sm:pl-6 lg:pl-10 xl:pl-12",
           )}
         >
-          {visible.map((member) => {
-            const href = member.person_id ? buildPersonCatalogHref(member.person_id) : null;
-            return (
-              <li key={`${member.name}-${member.order}`} className="embla__slide shrink-0">
-                <PersonCard
-                  name={member.name}
-                  subtitle={member.character}
-                  photoUrl={member.photo_url}
-                  href={href}
-                />
-              </li>
-            );
-          })}
+          {sections.map((section, sectionIndex) => (
+            <Fragment key={section.key}>
+              {sectionIndex > 0 && (
+                <li
+                  aria-hidden="true"
+                  className="embla__slide flex shrink-0 items-start self-stretch px-3 pb-10"
+                >
+                  <div className="flex h-full items-center gap-2">
+                    <span className="text-muted-foreground/70 rotate-180 text-[0.625rem] font-semibold tracking-[0.2em] uppercase [writing-mode:vertical-rl]">
+                      {section.label}
+                    </span>
+                    <span className="bg-border h-full w-px" />
+                  </div>
+                </li>
+              )}
+              {section.cards.map((card, i) => (
+                <li
+                  key={`${section.key}-${card.personId || card.name}-${i}`}
+                  className="embla__slide shrink-0"
+                >
+                  <PersonCard
+                    name={card.name}
+                    subtitle={card.subtitle}
+                    photoUrl={card.photoUrl}
+                    href={card.personId ? buildPersonCatalogHref(card.personId) : null}
+                  />
+                </li>
+              ))}
+            </Fragment>
+          ))}
         </ul>
       </div>
 
@@ -106,11 +187,7 @@ function CastCarousel({
 
 export default memo(CastCarousel);
 
-function PrefetchCastPeople({ cast }: { cast: CastMember[] }) {
-  const personIds = useMemo(
-    () => cast.flatMap((member) => (member.person_id ? [member.person_id] : [])),
-    [cast],
-  );
+function PrefetchCastPeople({ personIds }: { personIds: string[] }) {
   usePrefetchPeople(personIds);
   return null;
 }
diff --git a/web/src/components/ChoiceOption.tsx b/web/src/components/ChoiceOption.tsx
index ba65a0732c..4aa611e638 100644
--- a/web/src/components/ChoiceOption.tsx
+++ b/web/src/components/ChoiceOption.tsx
@@ -1,10 +1,13 @@
-import { useId, type ReactNode } from "react";
+import { useId, useRef, type ReactNode } from "react";
 import { cn } from "@/lib/utils";
 
 /**
  * One card in a radio group of mutually exclusive choices, each with a title
  * and an explanation. Render several inside a `role="radiogroup"` container
- * sharing one `name`.
+ * sharing one `name`. The whole card selects its option; the radio stays the
+ * keyboard and screen-reader control. A caller that nests its own controls in
+ * the card should make them ignore pointer events while the option is not
+ * selected, so those clicks reach the card instead.
  */
 export function ChoiceOption<T extends string>({
   name,
@@ -24,15 +27,27 @@ export function ChoiceOption<T extends string>({
   onSelect: (value: T) => void;
 }) {
   const id = useId();
+  const radio = useRef<HTMLInputElement>(null);
   return (
     <div
+      onClick={(event) => {
+        if (disabled) return;
+        onSelect(value);
+        // Like a label click, a click on the card's text moves focus to the
+        // radio so the arrow keys keep working. Clicks on the radio, its label,
+        // or a nested control already place focus where it belongs.
+        if (!(event.target as Element).closest("input, label, textarea, select, button, a")) {
+          radio.current?.focus();
+        }
+      }}
       className={cn(
-        "border-border/70 flex items-start gap-3 rounded-xl border px-3.5 py-3",
+        "border-border/70 flex cursor-pointer items-start gap-3 rounded-xl border px-3.5 py-3",
         selected && "border-amber-500/40 bg-amber-500/5",
-        disabled && "opacity-60",
+        disabled && "cursor-not-allowed opacity-60",
       )}
     >
       <input
+        ref={radio}
         id={id}
         type="radio"
         name={name}
diff --git a/web/src/components/CollectionTemplateGallery/MDBListBrowser.tsx b/web/src/components/CollectionTemplateGallery/MDBListBrowser.tsx
index dcdf9f16aa..884d6c4193 100644
--- a/web/src/components/CollectionTemplateGallery/MDBListBrowser.tsx
+++ b/web/src/components/CollectionTemplateGallery/MDBListBrowser.tsx
@@ -153,7 +153,7 @@ export function MDBListBrowser({
                 to="/admin/settings/providers"
                 className="font-medium underline underline-offset-4"
               >
-                Settings › Subtitles &amp; Metadata
+                Settings › Providers
               </Link>
               . Popular picks and pasted links still work.
             </span>
diff --git a/web/src/components/ContinueWatchingCard.restart.test.tsx b/web/src/components/ContinueWatchingCard.restart.test.tsx
index b4637f3de4..8e14998f72 100644
--- a/web/src/components/ContinueWatchingCard.restart.test.tsx
+++ b/web/src/components/ContinueWatchingCard.restart.test.tsx
@@ -61,6 +61,47 @@ describe("ContinueWatchingCard restart eligibility", () => {
       contentId: "ep-001",
       mediaType: "episode",
       hasPartialProgress: true,
+      hasResumePosition: true,
+    });
+  });
+
+  it("offers a resume reset when the position has no known duration", () => {
+    capturedMenuProps.length = 0;
+
+    renderToStaticMarkup(
+      <QueryClientProvider client={new QueryClient()}>
+        <MemoryRouter>
+          <ContinueWatchingCard
+            sectionItem={{
+              content_id: "movie-001",
+              type: "movie",
+              title: "Heat",
+              year: 1995,
+              genres: [],
+              status: "matched",
+              rating_imdb: 8.3,
+              overview: "",
+              item_source: "continue_watching",
+              // No duration: no progress bar, but still a position to clear.
+              position_seconds: 120,
+              duration_seconds: 0,
+              progress_updated_at: "2026-03-07T00:00:00Z",
+              poster_url: "",
+              poster_thumbhash: "",
+              backdrop_url: "",
+              backdrop_thumbhash: "",
+              logo_url: "",
+            }}
+            quickActionMode="both"
+          />
+        </MemoryRouter>
+      </QueryClientProvider>,
+    );
+
+    expect(capturedMenuProps[0]).toMatchObject({
+      contentId: "movie-001",
+      hasPartialProgress: false,
+      hasResumePosition: true,
     });
   });
 });
diff --git a/web/src/components/ContinueWatchingCard.test.tsx b/web/src/components/ContinueWatchingCard.test.tsx
index 6c849a33b1..e03ee06bc8 100644
--- a/web/src/components/ContinueWatchingCard.test.tsx
+++ b/web/src/components/ContinueWatchingCard.test.tsx
@@ -1,5 +1,6 @@
 import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
 import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
 import { renderToStaticMarkup } from "react-dom/server";
 import { MemoryRouter } from "react-router";
 import { beforeEach, describe, expect, it, vi } from "vitest";
@@ -65,6 +66,37 @@ describe("ContinueWatchingCard", () => {
     },
   );
 
+  it("does not offer favorites or the watchlist in a Next Up episode's menu", async () => {
+    render(
+      <QueryClientProvider client={new QueryClient()}>
+        <MemoryRouter>
+          <ContinueWatchingCard
+            sectionItem={{
+              ...continueMovie,
+              content_id: "ep-002",
+              type: "episode",
+              title: "Second",
+              series_id: "series-1",
+              series_title: "Apex",
+              season_number: 1,
+              episode_number: 2,
+              item_source: "next_up",
+              position_seconds: 0,
+              user_state: { played: false, is_favorite: false, in_watchlist: false },
+            }}
+            quickActionMode="both"
+          />
+        </MemoryRouter>
+      </QueryClientProvider>,
+    );
+
+    await userEvent.click(screen.getByRole("button", { name: "More actions" }));
+
+    expect(await screen.findByRole("menuitem", { name: "Mark Watched" })).toBeTruthy();
+    expect(screen.queryByRole("menuitem", { name: "Add to Favorites" })).toBeNull();
+    expect(screen.queryByRole("menuitem", { name: "Add to Watchlist" })).toBeNull();
+  });
+
   it("prefers the backdrop image for section episodes (backdrop_url is the horizontal still)", () => {
     const queryClient = new QueryClient();
     const markup = renderToStaticMarkup(
diff --git a/web/src/components/ContinueWatchingCard.tsx b/web/src/components/ContinueWatchingCard.tsx
index c744845299..4a9255db8f 100644
--- a/web/src/components/ContinueWatchingCard.tsx
+++ b/web/src/components/ContinueWatchingCard.tsx
@@ -381,6 +381,7 @@ function ContinueWatchingCardView({ spoilerPrefs, ...props }: ContinueWatchingCa
           showFavoriteShortcut={false}
           dismissAction={dismissAction}
           hasPartialProgress={hasPartialProgress}
+          hasResumePosition={card.positionSeconds > 0}
           quickActionMode={props.quickActionMode ?? "none"}
           longPressRef={cardRef}
           itemTitle={heading}
diff --git a/web/src/components/HeroBanner.test.tsx b/web/src/components/HeroBanner.test.tsx
index 86aa4de19a..9f46f870ea 100644
--- a/web/src/components/HeroBanner.test.tsx
+++ b/web/src/components/HeroBanner.test.tsx
@@ -1,5 +1,5 @@
 import type { SectionItem } from "@/api/types";
-import { act, fireEvent, render, screen } from "@testing-library/react";
+import { act, fireEvent, render, screen, waitFor } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import { renderToStaticMarkup } from "react-dom/server";
 import { MemoryRouter } from "react-router";
@@ -28,6 +28,18 @@ vi.mock("@/hooks/useAmbientColor", () => ({
   useAmbientColor: () => undefined,
 }));
 
+const translationMocks = vi.hoisted(() => ({
+  hook: vi.fn(),
+  state: { translating: false, onTranslate: undefined as undefined | (() => void) },
+}));
+
+vi.mock("@/hooks/useOnViewTranslation", () => ({
+  useOnViewTranslation: (...args: unknown[]) => {
+    translationMocks.hook(...args);
+    return translationMocks.state;
+  },
+}));
+
 vi.mock("@/lib/thumbhash", () => ({
   decodeThumbhash: () => "",
 }));
@@ -763,4 +775,96 @@ describe("HeroBanner", () => {
 
     expect(playbackMocks.toggleActivePlayback).toHaveBeenCalledTimes(1);
   });
+
+  describe("on-view translation", () => {
+    afterEach(() => {
+      translationMocks.hook.mockClear();
+      translationMocks.state = { translating: false, onTranslate: undefined };
+    });
+
+    it("translates only the visible slide and refreshes the hero's items", async () => {
+      const refresh = vi.fn();
+      const visible = movieSlide({ content_id: "movie-1", pending_translation_language: "de" });
+      render(
+        <MemoryRouter>
+          <HeroBanner
+            items={[visible, movieSlide({ content_id: "movie-2" })]}
+            onRefreshItems={refresh}
+          />
+        </MemoryRouter>,
+      );
+      await waitFor(() =>
+        expect(translationMocks.hook).toHaveBeenLastCalledWith(visible, {
+          onPoll: refresh,
+          pendingContentIds: new Set(["movie-1"]),
+        }),
+      );
+    });
+
+    it("keeps translation state across a slide whose overview is hidden", async () => {
+      spoilerPrefs.hideOverviews = true;
+      const hidden = movieSlide({
+        content_id: "episode-1",
+        type: "episode",
+        overview: "Unwatched plot",
+        pending_translation_language: "de",
+      });
+      render(
+        <MemoryRouter>
+          <HeroBanner items={[hidden]} />
+        </MemoryRouter>,
+      );
+      // The hook stays mounted with no item, so nothing new starts for the
+      // hidden overview while an earlier slide's translation keeps polling.
+      await waitFor(() =>
+        expect(translationMocks.hook).toHaveBeenLastCalledWith(undefined, {
+          onPoll: undefined,
+          pendingContentIds: new Set(["episode-1"]),
+        }),
+      );
+      expect(screen.queryByText("Unwatched plot")).not.toBeInTheDocument();
+    });
+
+    it("pulses the description while it translates", async () => {
+      translationMocks.state = { translating: true, onTranslate: undefined };
+      render(
+        <MemoryRouter>
+          <HeroBanner items={[movieSlide({ overview: "Source text" })]} />
+        </MemoryRouter>,
+      );
+      expect(await screen.findByText("Translating…")).toBeInTheDocument();
+      expect(screen.getByText("Source text")).toHaveClass("animate-pulse");
+    });
+
+    it("offers the translate action in button mode", async () => {
+      const onTranslate = vi.fn();
+      translationMocks.state = { translating: false, onTranslate };
+      render(
+        <MemoryRouter>
+          <HeroBanner items={[movieSlide()]} />
+        </MemoryRouter>,
+      );
+      await userEvent.click(await screen.findByRole("button", { name: "Translate" }));
+      expect(onTranslate).toHaveBeenCalledTimes(1);
+    });
+
+    it("does not label a provider overview when only the tagline is AI", async () => {
+      render(
+        <MemoryRouter>
+          <HeroBanner items={[movieSlide({ machine_translated_fields: ["tagline"] })]} />
+        </MemoryRouter>,
+      );
+      await waitFor(() => expect(translationMocks.hook).toHaveBeenCalled());
+      expect(screen.queryByText("Translated by AI")).not.toBeInTheDocument();
+    });
+
+    it("labels a machine-translated description", async () => {
+      render(
+        <MemoryRouter>
+          <HeroBanner items={[movieSlide({ machine_translated_fields: ["overview"] })]} />
+        </MemoryRouter>,
+      );
+      expect(await screen.findByText("Translated by AI")).toBeInTheDocument();
+    });
+  });
 });
diff --git a/web/src/components/HeroBanner.tsx b/web/src/components/HeroBanner.tsx
index b4979bf896..40104fa9d8 100644
--- a/web/src/components/HeroBanner.tsx
+++ b/web/src/components/HeroBanner.tsx
@@ -1,9 +1,19 @@
-import { memo, useState, useEffect, useCallback, useMemo, type MouseEvent } from "react";
+import {
+  lazy,
+  memo,
+  Suspense,
+  useState,
+  useEffect,
+  useCallback,
+  useMemo,
+  type MouseEvent,
+} from "react";
 import { Link } from "react-router";
 import { Info, ChevronLeft, ChevronRight, Play, Pause, BookOpen } from "lucide-react";
 import { decodeThumbhash } from "@/lib/thumbhash";
 import { HERO_BANNER_SIZE } from "@/lib/design-system";
 import { useAmbientColor } from "@/hooks/useAmbientColor";
+import { HeroOverviewText } from "./HeroOverviewText";
 import { cn } from "@/lib/utils";
 import type { SectionItem } from "@/api/types";
 import { buildItemHref, buildMediaPlayHref } from "@/lib/mediaNavigation";
@@ -16,6 +26,10 @@ import { isEpisodeStill, isEpisodeUnwatched } from "@/lib/episodeSpoilers";
 import { RatingEntry } from "@/components/ratings/RatingEntry";
 import { formatHeroMetadata } from "./heroMetadata";
 
+// On-view translation for the visible slide loads after the hero itself, so
+// it stays out of the launch bundle; the plain overview shows meanwhile.
+const HeroOverview = lazy(() => import("./HeroOverview"));
+
 interface HeroBannerProps {
   items: SectionItem[];
   maxSlides?: number;
@@ -40,6 +54,11 @@ interface HeroBannerProps {
    * param so the watch/item routes can scope back to the right library.
    */
   libraryId?: number;
+  /**
+   * Refetches the items while an on-view translation of the shown slide runs,
+   * so the translated description replaces the original in place.
+   */
+  onRefreshItems?: () => void;
 }
 
 /**
@@ -149,9 +168,19 @@ export default function HeroBanner({
   bleed = false,
   reserveHeaderSpace = false,
   libraryId,
+  onRefreshItems,
 }: HeroBannerProps) {
   const spoilerPrefs = useEpisodeSpoilerPrefs();
   const slides = useMemo(() => items.slice(0, maxSlides), [items, maxSlides]);
+  const pendingSlideIds = useMemo(
+    () =>
+      new Set(
+        slides
+          .filter((slide) => slide.pending_translation_language)
+          .map((slide) => slide.content_id),
+      ),
+    [slides],
+  );
   const [{ activeIndex, outgoingIndex }, setBackdropState] = useState({
     activeIndex: 0,
     outgoingIndex: null as number | null,
@@ -222,6 +251,16 @@ export default function HeroBanner({
   useAmbientColor(current?.backdrop_thumbhash);
   if (slides.length === 0) return null;
   if (!current) return null;
+  const overviewShown =
+    Boolean(current.overview) &&
+    !(
+      spoilerPrefs.hideOverviews &&
+      current.type === "episode" &&
+      isEpisodeUnwatched({
+        played: current.user_state?.played,
+        position_seconds: current.position_seconds,
+      })
+    );
 
   const metadata = formatHeroMetadata(current);
 
@@ -334,19 +373,21 @@ export default function HeroBanner({
                 )}
               </div>
             )}
-            {current.overview &&
-              !(
-                spoilerPrefs.hideOverviews &&
-                current.type === "episode" &&
-                isEpisodeUnwatched({
-                  played: current.user_state?.played,
-                  position_seconds: current.position_seconds,
-                })
-              ) && (
-                <p className="text-foreground/72 mb-7 line-clamp-2 max-w-2xl text-sm leading-7 sm:line-clamp-none sm:text-base">
-                  {current.overview}
-                </p>
-              )}
+            <Suspense
+              fallback={
+                overviewShown ? (
+                  <div className="mb-7 max-w-2xl">
+                    <HeroOverviewText overview={current.overview} />
+                  </div>
+                ) : null
+              }
+            >
+              <HeroOverview
+                item={overviewShown ? current : undefined}
+                pendingContentIds={pendingSlideIds}
+                onRefreshItems={onRefreshItems}
+              />
+            </Suspense>
             <div className="flex flex-wrap items-center gap-3">
               <Link
                 to={playHref}
diff --git a/web/src/components/HeroOverview.tsx b/web/src/components/HeroOverview.tsx
new file mode 100644
index 0000000000..b3e67625ac
--- /dev/null
+++ b/web/src/components/HeroOverview.tsx
@@ -0,0 +1,63 @@
+import { Languages } from "lucide-react";
+import type { SectionItem } from "@/api/types";
+import { useOnViewTranslation } from "@/hooks/useOnViewTranslation";
+import MachineTranslatedLabel from "@/pages/ItemDetail/components/MachineTranslatedLabel";
+import { HeroOverviewText } from "./HeroOverviewText";
+
+/**
+ * The Featured hero's overview with on-view translation. Only the visible
+ * slide renders it, so off-screen slides wait until they rotate in:
+ * auto mode translates it, button mode offers Translate, and an AI-translated
+ * overview is labeled. onRefreshItems refetches the hero's own section while a
+ * translation runs.
+ *
+ * The hero keeps this mounted for every slide, passing no item while the
+ * slide's overview is hidden, so a translation started on an earlier slide
+ * keeps polling instead of starting over when that slide returns.
+ */
+export default function HeroOverview({
+  item,
+  pendingContentIds,
+  onRefreshItems,
+}: {
+  item: SectionItem | undefined;
+  pendingContentIds: ReadonlySet<string>;
+  onRefreshItems?: () => void;
+}) {
+  const { translating, onTranslate } = useOnViewTranslation(item, {
+    onPoll: onRefreshItems,
+    pendingContentIds,
+  });
+  if (!item) return null;
+  // The hero shows the overview without the tagline, so an AI tagline alone
+  // must not label a provider or human overview.
+  const machineTranslated = item.machine_translated_fields?.includes("overview") ?? false;
+
+  return (
+    <div className="mb-7 max-w-2xl">
+      <HeroOverviewText overview={item.overview} translating={translating} />
+      {translating ? (
+        <span className="text-muted-foreground/70 mt-1 inline-flex items-center gap-1.5 text-xs">
+          <Languages className="h-3 w-3 animate-pulse" />
+          Translating…
+        </span>
+      ) : (
+        (machineTranslated || onTranslate) && (
+          <div className="mt-1.5 flex flex-wrap items-center gap-2">
+            {machineTranslated && <MachineTranslatedLabel />}
+            {onTranslate && (
+              <button
+                type="button"
+                onClick={onTranslate}
+                className="text-muted-foreground hover:text-foreground border-border/60 inline-flex items-center gap-1.5 rounded-full border px-2.5 py-0.5 text-xs transition-colors"
+              >
+                <Languages className="h-3 w-3" />
+                Translate
+              </button>
+            )}
+          </div>
+        )
+      )}
+    </div>
+  );
+}
diff --git a/web/src/components/HeroOverviewText.tsx b/web/src/components/HeroOverviewText.tsx
new file mode 100644
index 0000000000..66b1388454
--- /dev/null
+++ b/web/src/components/HeroOverviewText.tsx
@@ -0,0 +1,21 @@
+import { cn } from "@/lib/utils";
+
+/** The Featured hero's overview paragraph. */
+export function HeroOverviewText({
+  overview,
+  translating = false,
+}: {
+  overview: string;
+  translating?: boolean;
+}) {
+  return (
+    <p
+      className={cn(
+        "text-foreground/72 line-clamp-2 text-sm leading-7 sm:line-clamp-none sm:text-base",
+        translating && "animate-pulse opacity-50",
+      )}
+    >
+      {overview}
+    </p>
+  );
+}
diff --git a/web/src/components/ImageSelectorTab.test.tsx b/web/src/components/ImageSelectorTab.test.tsx
index 08d9b140e4..37b6a876c8 100644
--- a/web/src/components/ImageSelectorTab.test.tsx
+++ b/web/src/components/ImageSelectorTab.test.tsx
@@ -1,4 +1,4 @@
-import { fireEvent, render, screen } from "@testing-library/react";
+import { fireEvent, render, screen, within } from "@testing-library/react";
 import { describe, expect, it, vi } from "vitest";
 import type { ItemDetail } from "@/api/types";
 
@@ -61,6 +61,46 @@ describe("ImageSelectorTab", () => {
     expect(onImageApplied).toHaveBeenCalledOnce();
   });
 
+  it("filters choices by provider, with counts that follow Textless", () => {
+    const poster = (provider_id: string, original_url: string, language = "") => ({
+      type: "poster",
+      provider_id,
+      original_url,
+      url: `/${original_url}`,
+      language,
+    });
+    mocks.useItemImages.mockReturnValue({
+      data: {
+        images: [
+          poster("local", "file:///poster.jpg"),
+          poster("tmdb", "tmdb-1"),
+          poster("tmdb", "tmdb-2", "en"),
+          { ...poster("tvdb", "tvdb-1"), type: "backdrop" },
+        ],
+        current: {},
+      },
+      isLoading: false,
+      isError: false,
+    });
+    mocks.useApplyItemImage.mockReturnValue({ mutate: vi.fn(), isPending: false });
+
+    render(<ImageSelectorTab item={item("movie")} enabled />);
+    const chips = within(screen.getByRole("group", { name: "Filter by provider" }));
+    expect(chips.getAllByRole("button").map((chip) => chip.textContent)).toEqual([
+      "All3",
+      "LOCAL1",
+      "TMDB2",
+    ]);
+
+    fireEvent.click(chips.getByRole("button", { name: /^TMDB\s*2$/ }));
+    expect(screen.queryAllByRole("button", { name: "LOCAL" })).toHaveLength(0);
+    expect(screen.getAllByRole("button", { name: "TMDB" })).toHaveLength(2);
+
+    fireEvent.click(screen.getByRole("button", { name: "Textless" }));
+    expect(chips.getByRole("button", { name: /^TMDB\s*1$/ })).toBeInTheDocument();
+    expect(screen.getAllByRole("button", { name: "TMDB" })).toHaveLength(1);
+  });
+
   it("reports an in-flight image apply to the metadata editor", () => {
     mocks.useItemImages.mockReturnValue({
       data: { images: [], current: {} },
diff --git a/web/src/components/ImageSelectorTab.tsx b/web/src/components/ImageSelectorTab.tsx
index 7293548587..d05f7f5b31 100644
--- a/web/src/components/ImageSelectorTab.tsx
+++ b/web/src/components/ImageSelectorTab.tsx
@@ -34,6 +34,8 @@ export default function ImageSelectorTab({
   const availableTabs = item.type === "season" ? SEASON_TABS : IMAGE_TABS;
   const [activeTab, setActiveTab] = useState<ImageTab>("poster");
   const [textlessOnly, setTextlessOnly] = useState(false);
+  // null shows every provider's choices.
+  const [providerFilter, setProviderFilter] = useState<string | null>(null);
   const [selectedImage, setSelectedImage] = useState<RemoteImage | null>(null);
   // Track which images were applied in this session (original_url per type).
   const [appliedImages, setAppliedImages] = useState<Record<string, string>>({});
@@ -41,7 +43,7 @@ export default function ImageSelectorTab({
   const { data, isLoading, isError } = useItemImages(item.content_id, enabled);
   const applyMutation = useApplyItemImage();
 
-  const images = data?.images ?? [];
+  const images = useMemo(() => data?.images ?? [], [data]);
 
   useEffect(() => {
     onApplyPendingChange?.(applyMutation.isPending);
@@ -53,13 +55,28 @@ export default function ImageSelectorTab({
 
   const tabConfig = IMAGE_TABS.find((t) => t.key === activeTab)!;
 
-  const filteredImages = useMemo(() => {
-    let result = (images ?? []).filter((img) => img.type === activeTab);
-    if (textlessOnly && activeTab !== "logo") {
-      result = result.filter((img) => img.language === "");
-    }
-    return result;
-  }, [images, activeTab, textlessOnly]);
+  const { providers, visibleImages, filteredImages, activeProvider } = useMemo(() => {
+    const ofType = images.filter((img) => img.type === activeTab);
+    const visible =
+      textlessOnly && activeTab !== "logo" ? ofType.filter((img) => img.language === "") : ofType;
+    // Chips follow the server's order, so local artwork's chip comes first.
+    const counts = new Map<string, number>(ofType.map((img) => [img.provider_id, 0]));
+    for (const img of visible) counts.set(img.provider_id, (counts.get(img.provider_id) ?? 0) + 1);
+    // A filter for a provider that is no longer listed falls back to All.
+    const active = providerFilter !== null && counts.has(providerFilter) ? providerFilter : null;
+    return {
+      providers: [...counts].map(([id, count]) => ({ id, count })),
+      visibleImages: visible,
+      filteredImages:
+        active === null ? visible : visible.filter((img) => img.provider_id === active),
+      activeProvider: active,
+    };
+  }, [images, activeTab, textlessOnly, providerFilter]);
+
+  const selectProvider = (id: string | null) => {
+    setProviderFilter(id);
+    setSelectedImage(null);
+  };
 
   // The "current" image for this tab. We first check session-local applied
   // images (which use original_url), then fall back to the server's stored
@@ -128,6 +145,7 @@ export default function ImageSelectorTab({
               setActiveTab(tab.key);
               setSelectedImage(null);
               setTextlessOnly(false);
+              setProviderFilter(null);
             }}
             className={cn(
               "rounded-md px-3 py-1.5 text-[12px] font-medium transition-colors",
@@ -144,7 +162,11 @@ export default function ImageSelectorTab({
         {activeTab !== "logo" && (
           <button
             type="button"
-            onClick={() => setTextlessOnly(!textlessOnly)}
+            onClick={() => {
+              setTextlessOnly(!textlessOnly);
+              // Don't leave a selection the filter hides ready to apply.
+              setSelectedImage(null);
+            }}
             className={cn(
               "ml-auto rounded-md px-2.5 py-1.5 text-[11px] font-medium transition-colors",
               textlessOnly
@@ -157,6 +179,33 @@ export default function ImageSelectorTab({
         )}
       </div>
 
+      {/* Provider filter — only useful with more than one source */}
+      {providers.length > 1 && (
+        <div
+          role="group"
+          aria-label="Filter by provider"
+          className="flex shrink-0 flex-wrap items-center gap-1"
+        >
+          {[{ id: null, count: visibleImages.length }, ...providers].map((p) => (
+            <button
+              key={p.id === null ? "all" : `provider:${p.id}`}
+              type="button"
+              aria-pressed={activeProvider === p.id}
+              onClick={() => selectProvider(p.id)}
+              className={cn(
+                "flex items-center gap-1 rounded-md px-2.5 py-1 text-[11px] font-medium transition-colors",
+                activeProvider === p.id
+                  ? "bg-primary/10 text-primary"
+                  : "text-muted-foreground hover:bg-muted hover:text-foreground",
+              )}
+            >
+              {p.id === null ? "All" : p.id.toUpperCase()}
+              <span className="tabular-nums opacity-60">{p.count}</span>
+            </button>
+          ))}
+        </div>
+      )}
+
       {/* Provider errors */}
       {providerErrors && Object.keys(providerErrors).length > 0 && (
         <div className="flex shrink-0 items-center gap-2 rounded-lg border border-amber-500/20 bg-amber-500/5 px-3 py-1.5 text-[11px] text-amber-600 dark:text-amber-400">
diff --git a/web/src/components/Layout.tsx b/web/src/components/Layout.tsx
index 5021cc5b7b..bb7474bf33 100644
--- a/web/src/components/Layout.tsx
+++ b/web/src/components/Layout.tsx
@@ -43,9 +43,13 @@ import { useViewTransitionNavigate } from "@/hooks/useViewTransition";
 import { catalogKeys } from "@/hooks/queries/keys";
 import { fetchCatalogItemDetail } from "@/hooks/queries/catalogRead";
 import { markCriticalContentLoaded, useCriticalContentLoaded } from "@/lib/startupPriority";
+import { useSettingsReturnPath } from "@/hooks/useSettingsReturnPath";
+import { useSidebarSwap } from "@/hooks/useSidebarSwap";
 
 // Only admins see the activity indicator, so everyone else skips downloading it.
 const ServerActivity = lazy(() => import("@/components/ServerActivity"));
+// Settings swap the app sidebar for their own; it loads with the settings pages.
+const UserSettingsSidebar = lazy(() => import("@/components/settings/UserSettingsSidebar"));
 
 /**
  * The lazily loaded activity indicator. Layout wraps every page, so a chunk
@@ -112,6 +116,9 @@ export default function Layout({ children }: LayoutProps) {
   const isLibraryRoute = location.pathname.startsWith("/library/");
   const isItemRoute = location.pathname.startsWith("/item/");
   const isPersonRoute = location.pathname.startsWith("/person/");
+  const isSettingsRoute = /^\/settings(\/|$)/.test(location.pathname);
+  const settingsReturnPath = useSettingsReturnPath(isSettingsRoute, "/");
+  const sidebarSwap = useSidebarSwap(isSettingsRoute);
   const itemRouteLocation = `${location.pathname}${location.search}`;
   // Breakpoint changes naturally cause other layout renders; navigation only
   // needs the viewport value at the moment it is attempted.
@@ -393,7 +400,19 @@ export default function Layout({ children }: LayoutProps) {
           states; `collapsed` only drives the moving frame that hides everything
           past the 64px rail, so entering a detail page never resizes it. */}
         <div className="hidden lg:block" onTransitionEnd={handleSidebarTransitionEnd}>
-          <AppSidebar collapsed={visualDetailImmersion} />
+          {isSettingsRoute ? (
+            // Settings take over the sidebar column rather than adding a
+            // second one beside it. The fallback holds the column's place.
+            <Suspense
+              fallback={
+                <div className="border-sidebar-border/70 bg-sidebar/92 fixed top-0 bottom-0 left-0 z-40 w-[260px] border-r" />
+              }
+            >
+              <UserSettingsSidebar backTo={settingsReturnPath} swap={sidebarSwap} />
+            </Suspense>
+          ) : (
+            <AppSidebar collapsed={visualDetailImmersion} swap={sidebarSwap} />
+          )}
         </div>
 
         {/* Mobile header — visible below lg. Slides up on scroll-down within
diff --git a/web/src/components/LoadMoreOnScroll.tsx b/web/src/components/LoadMoreOnScroll.tsx
new file mode 100644
index 0000000000..c462ec2f7e
--- /dev/null
+++ b/web/src/components/LoadMoreOnScroll.tsx
@@ -0,0 +1,58 @@
+import { Loader2 } from "lucide-react";
+import { Button } from "@/components/ui/button";
+import { useIntersectionObserver } from "@/hooks/useIntersectionObserver";
+
+/**
+ * The foot of a list that loads as the viewer scrolls: reaching it reads the
+ * next page, and a failed read offers a retry. Without IntersectionObserver a
+ * Load more button does the scrolling's job.
+ */
+export function LoadMoreOnScroll({
+  hasNextPage,
+  isFetchingNextPage,
+  isError,
+  onLoadMore,
+  errorMessage,
+  showSpinner = false,
+}: {
+  hasNextPage: boolean;
+  isFetchingNextPage: boolean;
+  /** The last next-page read failed. */
+  isError: boolean;
+  onLoadMore: () => void;
+  errorMessage: string;
+  /** Show a spinner while the next page loads, for lists without placeholders. */
+  showSpinner?: boolean;
+}) {
+  const sentinelRef = useIntersectionObserver({
+    onIntersect: onLoadMore,
+    enabled: hasNextPage && !isFetchingNextPage && !isError,
+  });
+  if (!hasNextPage) return null;
+  if (isFetchingNextPage) {
+    return showSpinner ? (
+      <div className="flex justify-center py-4" role="status" aria-label="Loading more">
+        <Loader2 className="text-muted-foreground h-5 w-5 animate-spin" />
+      </div>
+    ) : null;
+  }
+  if (isError) {
+    return (
+      <div className="flex flex-col items-center gap-3 py-6 text-center">
+        <p className="text-muted-foreground text-sm">{errorMessage}</p>
+        <Button variant="outline" size="sm" onClick={onLoadMore}>
+          Try again
+        </Button>
+      </div>
+    );
+  }
+  return (
+    <div ref={sentinelRef} className="flex justify-center py-4">
+      {typeof IntersectionObserver === "undefined" ? (
+        <Button variant="outline" size="sm" onClick={onLoadMore}>
+          Load more
+        </Button>
+      ) : null}
+    </div>
+  );
+}
diff --git a/web/src/components/MediaItemMenu.test.tsx b/web/src/components/MediaItemMenu.test.tsx
index 0694241e6a..f0f1be3106 100644
--- a/web/src/components/MediaItemMenu.test.tsx
+++ b/web/src/components/MediaItemMenu.test.tsx
@@ -2,7 +2,7 @@ import { act, useRef } from "react";
 import { fireEvent, render, screen, waitFor, within } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import { MemoryRouter } from "react-router";
-import type { ItemDetail } from "@/api/types";
+import type { ItemDetail, MediaItemUserState } from "@/api/types";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import MediaItemMenu, { buildMediaItemMenuModel, MetadataActionDialogHost } from "./MediaItemMenu";
 
@@ -12,6 +12,7 @@ const mocks = vi.hoisted(() => ({
   matchItem: vi.fn(),
   toggleFavorite: vi.fn(),
   toggleWatched: vi.fn(),
+  clearResumePosition: vi.fn(),
   posterSize: "standard" as "compact" | "standard" | "large",
   authState: undefined as { user: { role: "admin" | "user" } } | undefined,
 }));
@@ -45,6 +46,11 @@ vi.mock("@/hooks/queries/watchlist", () => ({
   useToggleWatchlist: () => ({ isPending: false, mutateAsync: vi.fn() }),
 }));
 
+vi.mock("@/hooks/queries/notInterested", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("@/hooks/queries/notInterested")>()),
+  useToggleNotInterested: () => ({ isPending: false, mutate: vi.fn(), mutateAsync: vi.fn() }),
+}));
+
 vi.mock("@/hooks/queries/items", () => ({
   useRefreshItemMetadata: () => ({ isPending: false, mutate: vi.fn() }),
   useWatchedStateMutation: () => ({
@@ -53,6 +59,13 @@ vi.mock("@/hooks/queries/items", () => ({
   }),
 }));
 
+vi.mock("@/hooks/queries/progress", () => ({
+  useClearResumePosition: () => ({
+    isPending: false,
+    mutate: (...args: unknown[]) => mocks.clearResumePosition(...args),
+  }),
+}));
+
 vi.mock("@/hooks/useUICustomization", () => ({
   useUICustomization: () => ({
     cardPresentation: { poster_size: mocks.posterSize },
@@ -92,6 +105,7 @@ beforeEach(() => {
   mocks.toggleFavorite.mockResolvedValue(undefined);
   mocks.toggleWatched.mockReset();
   mocks.toggleWatched.mockResolvedValue(undefined);
+  mocks.clearResumePosition.mockReset();
   mocks.posterSize = "standard";
   mocks.authState = undefined;
 });
@@ -113,10 +127,11 @@ describe("buildMediaItemMenuModel", () => {
     expect(actions[1]?.label).toBe("Mark Unwatched");
     expect(actions[2]?.label).toBe("Remove from Favorites");
     expect(actions[3]?.label).toBe("Remove from Watchlist");
-    expect(actions[4]?.label).toBe("View Play History");
-    expect(actions[5]?.label).toBe("Refresh Metadata");
-    expect(actions[6]?.label).toBe("Edit Metadata");
-    expect(actions[7]?.label).toBe("Match Item");
+    expect(actions[4]?.label).toBe("Not Interested");
+    expect(actions[5]?.label).toBe("View Play History");
+    expect(actions[6]?.label).toBe("Refresh Metadata");
+    expect(actions[7]?.label).toBe("Edit Metadata");
+    expect(actions[8]?.label).toBe("Match Item");
     expect(model.some((item) => item.kind === "action" && item.label === "View Play History")).toBe(
       true,
     );
@@ -125,9 +140,33 @@ describe("buildMediaItemMenuModel", () => {
     );
   });
 
+  it("offers Not Interested on movies and series only, and its undo once marked", () => {
+    const labels = (
+      mediaType: "movie" | "series" | "episode" | "audiobook",
+      notInterested = false,
+    ) =>
+      buildMediaItemMenuModel({
+        mediaType,
+        userState: {
+          played: false,
+          is_favorite: false,
+          in_watchlist: false,
+          not_interested: notInterested,
+        },
+        isAdmin: false,
+      })
+        .filter((item) => item.kind === "action")
+        .map((item) => item.label);
+
+    expect(labels("movie")).toContain("Not Interested");
+    expect(labels("series", true)).toContain("Show in Recommendations");
+    expect(labels("episode")).not.toContain("Not Interested");
+    expect(labels("audiobook")).not.toContain("Not Interested");
+  });
+
   it("omits favorites and watchlist when showCollectionActions is false", () => {
     const model = buildMediaItemMenuModel({
-      mediaType: "episode",
+      mediaType: "movie",
       userState: {
         played: false,
         is_favorite: false,
@@ -142,6 +181,36 @@ describe("buildMediaItemMenuModel", () => {
     expect(actions[0]?.label).toBe("Mark Watched");
   });
 
+  it.each(["episode", "season"] as const)(
+    "does not offer adding %s items to favorites or the watchlist",
+    (mediaType) => {
+      const model = buildMediaItemMenuModel({
+        mediaType,
+        userState: { played: false, is_favorite: false, in_watchlist: false },
+        isAdmin: false,
+      });
+      const keys = model.flatMap((item) => (item.kind === "action" ? [item.key] : []));
+
+      expect(keys).toEqual(["toggleWatched"]);
+    },
+  );
+
+  it("keeps Remove for an episode that is already on a list", () => {
+    const labelsFor = (userState: MediaItemUserState) =>
+      buildMediaItemMenuModel({ mediaType: "episode", userState, isAdmin: false }).flatMap(
+        (item) => (item.kind === "action" ? [item.label] : []),
+      );
+
+    expect(labelsFor({ played: false, is_favorite: true, in_watchlist: false })).toEqual([
+      "Mark Watched",
+      "Remove from Favorites",
+    ]);
+    expect(labelsFor({ played: false, is_favorite: false, in_watchlist: true })).toEqual([
+      "Mark Watched",
+      "Remove from Watchlist",
+    ]);
+  });
+
   it("shows watched toggle and admin actions when showCollectionActions is false for admins", () => {
     const model = buildMediaItemMenuModel({
       mediaType: "movie",
@@ -166,7 +235,7 @@ describe("buildMediaItemMenuModel", () => {
 
   it("omits admin actions for non-admin users", () => {
     const model = buildMediaItemMenuModel({
-      mediaType: "episode",
+      mediaType: "movie",
       userState: {
         played: false,
         is_favorite: false,
@@ -229,6 +298,73 @@ describe("buildMediaItemMenuModel", () => {
     ).toBe(true);
   });
 
+  it("offers reset progress after the watched toggle for a partly watched movie or episode", () => {
+    for (const mediaType of ["movie", "episode"] as const) {
+      const labels = buildMediaItemMenuModel({
+        mediaType,
+        hasPartialProgress: true,
+        userState: { played: false, is_favorite: false, in_watchlist: false },
+        isAdmin: false,
+        showCollectionActions: false,
+        dismissLabel: "Remove from Continue Watching",
+      }).flatMap((item) => (item.kind === "action" ? [item.label] : []));
+
+      expect(labels).toEqual([
+        "Play from Beginning",
+        "Mark Watched",
+        "Reset Progress",
+        "Remove from Continue Watching",
+      ]);
+    }
+  });
+
+  it("offers reset progress during a rewatch, which keeps the item watched", () => {
+    const labels = buildMediaItemMenuModel({
+      mediaType: "movie",
+      hasPartialProgress: true,
+      userState: { played: true, is_favorite: false, in_watchlist: false },
+      isAdmin: false,
+      showCollectionActions: false,
+    }).flatMap((item) => (item.kind === "action" ? [item.label] : []));
+
+    expect(labels).toEqual(["Play from Beginning", "Mark Unwatched", "Reset Progress"]);
+  });
+
+  it("offers reset progress for a rewatched episode in a list that hides its progress bar", () => {
+    const model = buildMediaItemMenuModel({
+      mediaType: "episode",
+      hasPartialProgress: false,
+      hasResumePosition: true,
+      userState: { played: true, is_favorite: false, in_watchlist: false },
+      isAdmin: false,
+      showCollectionActions: false,
+    });
+
+    expect(model.some((item) => item.kind === "action" && item.key === "resetProgress")).toBe(true);
+  });
+
+  it("offers reset progress only when a movie or episode has a resume position", () => {
+    const cases = [
+      { mediaType: "movie", hasPartialProgress: false, played: true },
+      { mediaType: "episode", hasPartialProgress: false, played: false },
+      { mediaType: "audiobook", hasPartialProgress: true, played: false },
+      { mediaType: "series", hasPartialProgress: true, played: false },
+    ] as const;
+    for (const { mediaType, hasPartialProgress, played } of cases) {
+      const model = buildMediaItemMenuModel({
+        mediaType,
+        hasPartialProgress,
+        userState: { played, is_favorite: false, in_watchlist: false },
+        isAdmin: false,
+      });
+
+      expect(
+        model.some((item) => item.kind === "action" && item.key === "resetProgress"),
+        mediaType,
+      ).toBe(false);
+    }
+  });
+
   it("uses listening labels for audiobook state actions", () => {
     const model = buildMediaItemMenuModel({
       mediaType: "audiobook",
@@ -569,6 +705,26 @@ describe("MediaItemMenu trigger visibility", () => {
     });
   });
 
+  it("resets a partly watched item's progress from the menu", async () => {
+    render(
+      <MemoryRouter>
+        <MediaItemMenu
+          contentId="movie-1"
+          mediaType="movie"
+          userState={{ played: false, is_favorite: false, in_watchlist: false }}
+          hasPartialProgress
+          variant="wide"
+        />
+      </MemoryRouter>,
+    );
+
+    await userEvent.click(screen.getByRole("button", { name: "More actions" }));
+    await userEvent.click(screen.getByRole("menuitem", { name: "Reset Progress" }));
+
+    expect(mocks.clearResumePosition).toHaveBeenCalledWith({ contentId: "movie-1" });
+    expect(mocks.toggleWatched).not.toHaveBeenCalled();
+  });
+
   it("rolls the watched eye back when the request fails", async () => {
     mocks.toggleWatched.mockRejectedValueOnce(new Error("request failed"));
     render(
@@ -848,6 +1004,46 @@ describe("MediaItemMenu trigger visibility", () => {
     expect(screen.getByRole("menuitem", { name: "Remove from Favorites" })).toBeTruthy();
   });
 
+  it("shows no favorite heart or Add entries on an episode card", async () => {
+    render(
+      <MemoryRouter>
+        <MediaItemMenu
+          contentId="episode-1"
+          mediaType="episode"
+          userState={{ played: false, is_favorite: false, in_watchlist: false }}
+          variant="poster"
+          quickActionMode="both"
+        />
+      </MemoryRouter>,
+    );
+
+    expect(screen.queryByRole("button", { name: "Add to favorites" })).toBeNull();
+    await userEvent.click(screen.getByRole("button", { name: "More actions" }));
+    expect(screen.getByRole("menuitem", { name: "Mark Watched" })).toBeTruthy();
+    expect(screen.queryByRole("menuitem", { name: "Add to Favorites" })).toBeNull();
+    expect(screen.queryByRole("menuitem", { name: "Add to Watchlist" })).toBeNull();
+  });
+
+  it("removes an episode that is already a favorite from its menu, not a heart", async () => {
+    render(
+      <MemoryRouter>
+        <MediaItemMenu
+          contentId="episode-1"
+          mediaType="episode"
+          userState={{ played: false, is_favorite: true, in_watchlist: false }}
+          variant="poster"
+          quickActionMode="both"
+        />
+      </MemoryRouter>,
+    );
+
+    expect(screen.queryByRole("button", { name: "Remove from favorites" })).toBeNull();
+    await userEvent.click(screen.getByRole("button", { name: "More actions" }));
+    await userEvent.click(screen.getByRole("menuitem", { name: "Remove from Favorites" }));
+
+    expect(mocks.toggleFavorite).toHaveBeenCalledWith(true);
+  });
+
   it("toggles on a short pointer release even when a carousel consumes the click", async () => {
     render(
       <MemoryRouter>
diff --git a/web/src/components/MediaItemMenu.tsx b/web/src/components/MediaItemMenu.tsx
index 4726473a8b..5a72c5a670 100644
--- a/web/src/components/MediaItemMenu.tsx
+++ b/web/src/components/MediaItemMenu.tsx
@@ -23,9 +23,12 @@ import {
   MoreVertical,
   Plus,
   RotateCcw,
+  TimerReset,
+  ThumbsDown,
   X,
 } from "lucide-react";
 import { useLocation } from "react-router";
+import { captureProfileRequestContext, isCapturedProfileAuthorityActive } from "@/api/client";
 import { useViewTransitionNavigate } from "@/hooks/useViewTransition";
 import { useFinePointer } from "@/hooks/useFinePointer";
 import type { ItemDetail, MediaItemUserState } from "@/api/types";
@@ -36,6 +39,8 @@ import { useRefreshItemMetadata, useWatchedStateMutation } from "@/hooks/queries
 import { type DismissHomeItemVariables, useDismissHomeItem } from "@/hooks/queries/homeDismissals";
 import { useToggleFavorite } from "@/hooks/queries/favorites";
 import { useToggleWatchlist } from "@/hooks/queries/watchlist";
+import { useClearResumePosition } from "@/hooks/queries/progress";
+import { canMarkNotInterested, useToggleNotInterested } from "@/hooks/queries/notInterested";
 import { getWatchedActionLabel } from "@/pages/ItemDetail/watchedState";
 import { LocalErrorBoundary } from "@/components/LocalErrorBoundary";
 import MangaFilesDialog from "@/components/MangaFilesDialog";
@@ -97,6 +102,13 @@ function prefetchMetadataDialogs() {
 
 type MediaItemType = ItemDetail["type"];
 
+// Favorites and the watchlist are kept at the title level. The server rejects
+// season writes, and the lists' default views and Home rows leave episodes
+// out, so neither offers to be added.
+function canAddToPersonalLists(mediaType: MediaItemType) {
+  return mediaType !== "season" && mediaType !== "episode";
+}
+
 function useHasFinePointer() {
   // Reads the observed pointer, not the media query: Chromium on some Windows
   // machines with a touchscreen reports no fine pointer while a mouse is in
@@ -112,8 +124,10 @@ type MediaItemMenuEntry =
       key:
         | "playFromBeginning"
         | "toggleWatched"
+        | "resetProgress"
         | "toggleFavorite"
         | "toggleWatchlist"
+        | "toggleNotInterested"
         | "dismissFromHome"
         | "viewDetails"
         | "viewPlayHistory"
@@ -130,6 +144,11 @@ interface BuildMediaItemMenuModelOptions {
   mediaType: MediaItemType;
   userState?: MediaItemUserState;
   hasPartialProgress?: boolean;
+  /**
+   * Whether the item has a resume position to clear, rewatches included.
+   * Defaults to hasPartialProgress.
+   */
+  hasResumePosition?: boolean;
   isAdmin: boolean;
   canCurateMetadata?: boolean;
   showCollectionActions?: boolean;
@@ -142,12 +161,20 @@ interface MediaItemMenuProps {
   libraryId?: number;
   userState?: MediaItemUserState;
   variant?: "poster" | "wide";
-  /** When false, hides favorites and watchlist actions (e.g. for episodes). Defaults to true. */
+  /**
+   * When false, hides favorites and watchlist actions. Defaults to true. Seasons and episodes
+   * never offer adding to either list; see canAddToPersonalLists.
+   */
   showCollectionActions?: boolean;
   /** Hides only the poster heart shortcut while retaining collection actions in the menu. */
   showFavoriteShortcut?: boolean;
   dismissAction?: DismissHomeItemVariables;
   hasPartialProgress?: boolean;
+  /**
+   * Whether the item has a resume position to clear, rewatches included, for
+   * lists that hide a watched item's progress. Defaults to hasPartialProgress.
+   */
+  hasResumePosition?: boolean;
   /** Enables the watched shortcut on wide cards such as Continue Watching. */
   showWatchedShortcut?: boolean;
   /** Uses smaller poster controls on narrow catalog cards. */
@@ -164,6 +191,7 @@ export function buildMediaItemMenuModel({
   mediaType,
   userState,
   hasPartialProgress = false,
+  hasResumePosition = hasPartialProgress,
   isAdmin,
   canCurateMetadata = isAdmin,
   showCollectionActions = true,
@@ -192,20 +220,36 @@ export function buildMediaItemMenuModel({
     });
   }
 
-  if (userState) {
-    if (showCollectionActions) {
-      entries.push(
-        {
-          kind: "action",
-          key: "toggleFavorite",
-          label: userState.is_favorite ? "Remove from Favorites" : "Add to Favorites",
-        },
-        {
-          kind: "action",
-          key: "toggleWatchlist",
-          label: userState.in_watchlist ? "Remove from Watchlist" : "Add to Watchlist",
-        },
-      );
+  // Clears the resume point without passing through watched (issue #2134).
+  if ((mediaType === "movie" || mediaType === "episode") && hasResumePosition) {
+    entries.push({ kind: "action", key: "resetProgress", label: "Reset Progress" });
+  }
+
+  if (userState && showCollectionActions) {
+    // A season or episode can already be on a list (saved by another client,
+    // imported from another server, or saved by an older web build), so it
+    // keeps the Remove entry.
+    const canAdd = canAddToPersonalLists(mediaType);
+    if (canAdd || userState.is_favorite) {
+      entries.push({
+        kind: "action",
+        key: "toggleFavorite",
+        label: userState.is_favorite ? "Remove from Favorites" : "Add to Favorites",
+      });
+    }
+    if (canAdd || userState.in_watchlist) {
+      entries.push({
+        kind: "action",
+        key: "toggleWatchlist",
+        label: userState.in_watchlist ? "Remove from Watchlist" : "Add to Watchlist",
+      });
+    }
+    if (canMarkNotInterested(mediaType)) {
+      entries.push({
+        kind: "action",
+        key: "toggleNotInterested",
+        label: userState.not_interested ? "Show in Recommendations" : "Not Interested",
+      });
     }
   }
 
@@ -288,6 +332,8 @@ function MediaItemMenuActionIcon({
       ) : (
         <EyeOff aria-hidden="true" className="size-4" />
       );
+    case "resetProgress":
+      return <TimerReset aria-hidden="true" className="size-4" />;
     case "toggleFavorite":
       return (
         <Heart
@@ -301,6 +347,13 @@ function MediaItemMenuActionIcon({
       ) : (
         <Plus aria-hidden="true" className="size-4" />
       );
+    case "toggleNotInterested":
+      return (
+        <ThumbsDown
+          aria-hidden="true"
+          className={cn("size-4", userState?.not_interested && "fill-current")}
+        />
+      );
     case "dismissFromHome":
       return <X aria-hidden="true" className="size-4" />;
     case "viewDetails":
@@ -950,16 +1003,20 @@ function MediaItemMenuEngine({
   });
   const favoriteMutation = useToggleFavorite(contentId);
   const watchlistMutation = useToggleWatchlist(contentId);
+  const notInterestedMutation = useToggleNotInterested(contentId);
   const refreshMetadataMutation = useRefreshItemMetadata();
   const dismissHomeItemMutation = useDismissHomeItem();
+  const clearResumePositionMutation = useClearResumePosition();
   const currentHref = `${location.pathname}${location.search}`;
 
   const isPending =
     watchedMutation.isPending ||
     favoriteMutation.isPending ||
     watchlistMutation.isPending ||
+    notInterestedMutation.isPending ||
     refreshMetadataMutation.isPending ||
-    dismissHomeItemMutation.isPending;
+    dismissHomeItemMutation.isPending ||
+    clearResumePositionMutation.isPending;
   const watchedPending = watchedMutation.isPending;
   const favoritePending = favoriteMutation.isPending;
   const refreshPending = refreshMetadataMutation.isPending;
@@ -1038,6 +1095,10 @@ function MediaItemMenuEngine({
         await handleWatchedToggle();
         return;
       }
+      case "resetProgress": {
+        clearResumePositionMutation.mutate({ contentId });
+        return;
+      }
       case "toggleFavorite": {
         await handleFavoriteToggle();
         return;
@@ -1050,6 +1111,21 @@ function MediaItemMenuEngine({
         );
         return;
       }
+      case "toggleNotInterested": {
+        if (!currentUserState) return;
+        const marked = currentUserState.not_interested ?? false;
+        const authority = captureProfileRequestContext();
+        setCurrentUserState((prev) => (prev ? { ...prev, not_interested: !marked } : prev));
+        try {
+          await notInterestedMutation.mutateAsync(marked);
+        } catch {
+          // After a profile switch the card shows the new profile's state.
+          if (!authority || isCapturedProfileAuthorityActive(authority)) {
+            setCurrentUserState((prev) => (prev ? { ...prev, not_interested: marked } : prev));
+          }
+        }
+        return;
+      }
       case "viewDetails": {
         setFilesDialogMounted(true);
         setFilesDialogOpen(true);
@@ -1164,6 +1240,7 @@ export default function MediaItemMenu({
   showFavoriteShortcut = true,
   dismissAction,
   hasPartialProgress = false,
+  hasResumePosition = hasPartialProgress,
   showWatchedShortcut = false,
   narrowPosterActions = false,
   quickActionMode = "none",
@@ -1181,6 +1258,8 @@ export default function MediaItemMenu({
   const hasFinePointer = useHasFinePointer();
   const [currentUserState, setCurrentUserState] = useState(userState);
   const lastSyncedUserStateRef = useRef(userState);
+  const activeProfileId = currentProfile?.id;
+  const lastSyncedProfileRef = useRef(activeProfileId);
   // A card that has never been hovered, focused, or used mounts none of the
   // action machinery — a home page holds hundreds of cards.
   const [engineMounted, setEngineMounted] = useState(false);
@@ -1202,16 +1281,22 @@ export default function MediaItemMenu({
 
   useEffect(() => {
     const lastSynced = lastSyncedUserStateRef.current;
+    // A profile switch always resyncs: the local state may still hold the
+    // earlier profile's optimistic change while the props look unchanged.
+    const sameProfile = lastSyncedProfileRef.current === activeProfileId;
     if (
+      sameProfile &&
       lastSynced?.played === userState?.played &&
       lastSynced?.is_favorite === userState?.is_favorite &&
-      lastSynced?.in_watchlist === userState?.in_watchlist
+      lastSynced?.in_watchlist === userState?.in_watchlist &&
+      lastSynced?.not_interested === userState?.not_interested
     ) {
       return;
     }
     lastSyncedUserStateRef.current = userState;
+    lastSyncedProfileRef.current = activeProfileId;
     setCurrentUserState(userState);
-  }, [userState]);
+  }, [userState, activeProfileId]);
 
   const dismissLabel =
     dismissAction?.surface === "continue_watching"
@@ -1228,6 +1313,7 @@ export default function MediaItemMenu({
     mediaType,
     userState: currentUserState,
     hasPartialProgress,
+    hasResumePosition,
     isAdmin,
     canCurateMetadata,
     showCollectionActions,
@@ -1292,9 +1378,12 @@ export default function MediaItemMenu({
     },
     enabled: model.length > 0,
   });
+  // The model can still hold Remove for a season or episode already on the
+  // list; that stays in the menu rather than a heart that vanishes on click.
   const showPosterFavorite =
     hasFinePointer &&
     variant === "poster" &&
+    canAddToPersonalLists(mediaType) &&
     showFavoriteShortcut &&
     showsFavoriteQuickAction(quickActionMode) &&
     model.some((entry) => entry.kind === "action" && entry.key === "toggleFavorite");
diff --git a/web/src/components/MetadataTranslatePanel.tsx b/web/src/components/MetadataTranslatePanel.tsx
index 8fd3d94247..f960db6c59 100644
--- a/web/src/components/MetadataTranslatePanel.tsx
+++ b/web/src/components/MetadataTranslatePanel.tsx
@@ -100,8 +100,8 @@ export function MetadataTranslatePanel({ item }: { item: ItemDetail }) {
         <span className="text-sm font-medium">Translate with AI</span>
       </div>
       <p className="text-muted-foreground text-xs">
-        {description} into the chosen language. Translations are served to libraries using that
-        metadata language; provider data replaces them when it becomes available.
+        {description} into the chosen language. Descriptions a provider or a person already supplied
+        in that language are kept, and provider data replaces AI text when it becomes available.
       </p>
       <div className="flex flex-wrap items-end gap-3">
         <div className="space-y-1">
@@ -126,7 +126,7 @@ export function MetadataTranslatePanel({ item }: { item: ItemDetail }) {
         <div className="flex h-9 items-center gap-2">
           <Switch id="translate-force" checked={force} onCheckedChange={setForce} disabled={busy} />
           <Label htmlFor="translate-force" className="text-xs">
-            Re-translate existing
+            Re-translate AI text
           </Label>
         </div>
         <Button type="button" size="sm" onClick={start} disabled={busy}>
diff --git a/web/src/components/PrairieBrand.test.tsx b/web/src/components/PrairieBrand.test.tsx
index 8a27bfe3bb..6a71782949 100644
--- a/web/src/components/PrairieBrand.test.tsx
+++ b/web/src/components/PrairieBrand.test.tsx
@@ -16,6 +16,7 @@ const BRANDING_DEFAULTS: BrandingContextValue = {
   faviconUrl: null,
   loginBgUrl: null,
   storageAvailable: false,
+  loaded: false,
 };
 
 function renderBrandSrc(
diff --git a/web/src/components/RealtimeEventsProvider.test.tsx b/web/src/components/RealtimeEventsProvider.test.tsx
index dd07253ae7..df7d4bb469 100644
--- a/web/src/components/RealtimeEventsProvider.test.tsx
+++ b/web/src/components/RealtimeEventsProvider.test.tsx
@@ -16,6 +16,7 @@ import {
   adminKeys,
   catalogKeys,
   collectionKeys,
+  itemKeys,
   libraryKeys,
   requestKeys,
   sectionKeys,
@@ -25,6 +26,7 @@ import { invalidateCatalogState } from "./realtimeCatalogInvalidation";
 import {
   buildEventsUrl,
   EVENTS_ACCESS_CHANGED_CLOSE_CODE,
+  HIDDEN_EVENTS_SOCKET_GRACE_MS,
   RealtimeEventsProvider,
 } from "./RealtimeEventsProvider";
 
@@ -816,6 +818,9 @@ describe("RealtimeEventsProvider", () => {
       };
       view.rerender(provider());
     });
+    await act(async () => {
+      vi.advanceTimersByTime(HIDDEN_EVENTS_SOCKET_GRACE_MS);
+    });
 
     expect(firstSocket.readyState).toBe(FakeWebSocket.CLOSED);
     await act(async () => {
@@ -884,6 +889,42 @@ describe("RealtimeEventsProvider", () => {
     });
   });
 
+  it("drops a closed player's cached watch detail when progress changes elsewhere", async () => {
+    const queryClient = new QueryClient();
+    const watchKey = itemKeys.watchDetail("movie-1");
+    const otherKey = itemKeys.watchDetail("movie-2");
+    queryClient.setQueryData(watchKey, {
+      content_id: "movie-1",
+      user_data: { position_seconds: 600 },
+    });
+    queryClient.setQueryData(otherKey, {
+      content_id: "movie-2",
+      user_data: { position_seconds: 60 },
+    });
+
+    render(
+      <QueryClientProvider client={queryClient}>
+        <RealtimeEventsProvider>
+          <div />
+        </RealtimeEventsProvider>
+      </QueryClientProvider>,
+    );
+
+    await act(async () => {});
+    await act(async () => {
+      FakeWebSocket.instances[0]?.emitMessage({
+        type: "event",
+        channel: "user_state",
+        event: "user_state.changed",
+        data: { profile_id: "profile-1", content_id: "movie-1", change: "progress" },
+      });
+    });
+
+    // Dropped at once: a play started now would use its resume position.
+    expect(queryClient.getQueryData(watchKey)).toBeUndefined();
+    expect(queryClient.getQueryData(otherKey)).toBeDefined();
+  });
+
   it("refetches request state once per burst of request notifications, for any profile", async () => {
     const queryClient = new QueryClient();
     const refreshed = [
@@ -997,6 +1038,335 @@ describe("RealtimeEventsProvider", () => {
     expect(invalidations(search)).toBe(1);
   });
 
+  describe("hidden page", () => {
+    const catchUp = { type: "active", predicate: expect.any(Function) };
+
+    function setPage({ visible, frozen = false }: { visible: boolean; frozen?: boolean }) {
+      mockState.pageActivity = {
+        ...mockState.pageActivity,
+        isVisible: visible,
+        isFrozen: frozen,
+        canPollDashboard: visible && !frozen && mockState.pageActivity.isFocused,
+        canApplyRealtimeUpdates: visible && !frozen,
+      };
+    }
+
+    function renderProvider(queryClient: QueryClient) {
+      const provider = () => (
+        <QueryClientProvider client={queryClient}>
+          <RealtimeEventsProvider>
+            <div />
+          </RealtimeEventsProvider>
+        </QueryClientProvider>
+      );
+      const view = render(provider());
+      return () => view.rerender(provider());
+    }
+
+    function ticketMints() {
+      return vi
+        .mocked(fetch)
+        .mock.calls.filter(([url]) => String(url).endsWith("/api/v2/events/ws-ticket")).length;
+    }
+
+    it("keeps the socket and skips the catch-up across a short tab switch", async () => {
+      const queryClient = new QueryClient();
+      const refetchQueries = vi.spyOn(queryClient, "refetchQueries");
+      const rerender = renderProvider(queryClient);
+      await act(async () => {});
+      const socket = FakeWebSocket.instances[0]!;
+
+      await act(async () => {
+        setPage({ visible: false });
+        rerender();
+      });
+      await act(async () => {
+        vi.advanceTimersByTime(HIDDEN_EVENTS_SOCKET_GRACE_MS - 1);
+      });
+      expect(socket.readyState).not.toBe(FakeWebSocket.CLOSED);
+
+      await act(async () => {
+        setPage({ visible: true });
+        rerender();
+      });
+      expect(FakeWebSocket.instances).toHaveLength(1);
+      expect(ticketMints()).toBe(1);
+      expect(refetchQueries).not.toHaveBeenCalled();
+      expect(mockState.refreshAccount).not.toHaveBeenCalled();
+    });
+
+    it("applies frames and subscribes while the tab is briefly hidden", async () => {
+      const queryClient = new QueryClient();
+      const detailKey = catalogKeys.itemDetail("movie-1");
+      queryClient.setQueryData(detailKey, { content_id: "movie-1", type: "movie" });
+      const rerender = renderProvider(queryClient);
+      await act(async () => {});
+      const socket = FakeWebSocket.instances[0]!;
+      socket.readyState = FakeWebSocket.OPEN;
+      const send = vi.spyOn(socket, "send");
+
+      await act(async () => {
+        setPage({ visible: false });
+        rerender();
+      });
+      await act(async () => {
+        socket.emitMessage({ type: "hello" });
+        socket.emitMessage({
+          type: "event",
+          channel: "user_state",
+          event: "favorite.updated",
+          data: { content_id: "movie-1", change: "favorite", is_favorite: true },
+        });
+      });
+
+      expect(send).toHaveBeenCalledWith(expect.stringContaining('"type":"subscribe"'));
+      expect(queryClient.getQueryData(detailKey)).toMatchObject({
+        user_state: { is_favorite: true },
+      });
+    });
+
+    it("closes the socket after the grace period and catches up once on return", async () => {
+      const queryClient = new QueryClient();
+      const refetchQueries = vi.spyOn(queryClient, "refetchQueries").mockResolvedValue(undefined);
+      const rerender = renderProvider(queryClient);
+      await act(async () => {});
+      const socket = FakeWebSocket.instances[0]!;
+      const hiddenAt = Date.now();
+
+      await act(async () => {
+        setPage({ visible: false });
+        rerender();
+      });
+      await act(async () => {
+        vi.advanceTimersByTime(HIDDEN_EVENTS_SOCKET_GRACE_MS);
+      });
+      expect(socket.readyState).toBe(FakeWebSocket.CLOSED);
+      // Leave the clock behind so only the closed socket can ask for the catch-up.
+      vi.setSystemTime(hiddenAt);
+
+      await act(async () => {
+        setPage({ visible: true });
+        rerender();
+      });
+      expect(FakeWebSocket.instances).toHaveLength(2);
+      expect(refetchQueries).toHaveBeenCalledTimes(1);
+      expect(refetchQueries).toHaveBeenCalledWith(catchUp);
+      expect(mockState.refreshAccount).toHaveBeenCalledTimes(1);
+    });
+
+    it("catches up after a long suspension even when the grace timer never ran", async () => {
+      const queryClient = new QueryClient();
+      const refetchQueries = vi.spyOn(queryClient, "refetchQueries").mockResolvedValue(undefined);
+      const rerender = renderProvider(queryClient);
+      await act(async () => {});
+
+      await act(async () => {
+        setPage({ visible: false });
+        rerender();
+      });
+      // A suspended page's clock moves on while its timers do not.
+      vi.setSystemTime(Date.now() + 2 * HIDDEN_EVENTS_SOCKET_GRACE_MS);
+      await act(async () => {
+        setPage({ visible: true });
+        rerender();
+      });
+
+      // The old socket may have died without a close event, so it is replaced.
+      expect(FakeWebSocket.instances).toHaveLength(2);
+      expect(FakeWebSocket.instances[0]!.readyState).toBe(FakeWebSocket.CLOSED);
+      expect(ticketMints()).toBe(2);
+      expect(refetchQueries).toHaveBeenCalledTimes(1);
+      expect(refetchQueries).toHaveBeenCalledWith(catchUp);
+      expect(mockState.refreshAccount).toHaveBeenCalledTimes(1);
+    });
+
+    it("closes the socket at once when the page is frozen and catches up on resume", async () => {
+      const queryClient = new QueryClient();
+      const refetchQueries = vi.spyOn(queryClient, "refetchQueries").mockResolvedValue(undefined);
+      const rerender = renderProvider(queryClient);
+      await act(async () => {});
+      const socket = FakeWebSocket.instances[0]!;
+
+      await act(async () => {
+        setPage({ visible: false, frozen: true });
+        rerender();
+      });
+      expect(socket.readyState).toBe(FakeWebSocket.CLOSED);
+
+      await act(async () => {
+        setPage({ visible: true });
+        rerender();
+      });
+      expect(FakeWebSocket.instances).toHaveLength(2);
+      expect(refetchQueries).toHaveBeenCalledTimes(1);
+      expect(refetchQueries).toHaveBeenCalledWith(catchUp);
+      expect(mockState.refreshAccount).toHaveBeenCalledTimes(1);
+    });
+
+    it("catches up on return when the socket drops while the tab is hidden", async () => {
+      const queryClient = new QueryClient();
+      const refetchQueries = vi.spyOn(queryClient, "refetchQueries").mockResolvedValue(undefined);
+      const rerender = renderProvider(queryClient);
+      await act(async () => {});
+
+      await act(async () => {
+        setPage({ visible: false });
+        rerender();
+      });
+      await act(async () => {
+        FakeWebSocket.instances[0]!.emitClose();
+        vi.advanceTimersByTime(1_000);
+      });
+      // The usual reconnect still runs during the grace period.
+      expect(FakeWebSocket.instances).toHaveLength(2);
+      expect(refetchQueries).not.toHaveBeenCalled();
+
+      await act(async () => {
+        setPage({ visible: true });
+        rerender();
+      });
+      expect(refetchQueries).toHaveBeenCalledTimes(1);
+      expect(refetchQueries).toHaveBeenCalledWith(catchUp);
+      expect(FakeWebSocket.instances).toHaveLength(2);
+    });
+
+    it("catches up at once when a socket that lived through a hide drops later", async () => {
+      const queryClient = new QueryClient();
+      const refetchQueries = vi.spyOn(queryClient, "refetchQueries").mockResolvedValue(undefined);
+      const rerender = renderProvider(queryClient);
+      await act(async () => {});
+
+      await act(async () => {
+        setPage({ visible: false });
+        rerender();
+      });
+      await act(async () => {
+        setPage({ visible: true });
+        rerender();
+      });
+      expect(refetchQueries).not.toHaveBeenCalled();
+
+      // A resumed phone browser can learn only now that its socket died.
+      await act(async () => {
+        FakeWebSocket.instances[0]!.emitClose();
+      });
+      expect(refetchQueries).toHaveBeenCalledTimes(1);
+      expect(refetchQueries).toHaveBeenCalledWith(catchUp);
+      expect(mockState.refreshAccount).toHaveBeenCalledTimes(1);
+    });
+
+    it("catches up on the next return after the socket dropped while visible", async () => {
+      const queryClient = new QueryClient();
+      const refetchQueries = vi.spyOn(queryClient, "refetchQueries").mockResolvedValue(undefined);
+      const rerender = renderProvider(queryClient);
+      await act(async () => {});
+
+      // A visible page reconnects without a catch-up, as before.
+      await act(async () => {
+        FakeWebSocket.instances[0]!.emitClose();
+      });
+      expect(refetchQueries).not.toHaveBeenCalled();
+
+      // A quick switch before the reconnect lands catches up what it lost.
+      await act(async () => {
+        setPage({ visible: false });
+        rerender();
+      });
+      await act(async () => {
+        setPage({ visible: true });
+        rerender();
+      });
+      expect(refetchQueries).toHaveBeenCalledTimes(1);
+      expect(refetchQueries).toHaveBeenCalledWith(catchUp);
+
+      // Once caught up, the next quick switch costs nothing.
+      await act(async () => {
+        vi.advanceTimersByTime(1_000);
+        setPage({ visible: false });
+        rerender();
+      });
+      await act(async () => {
+        setPage({ visible: true });
+        rerender();
+      });
+      expect(refetchQueries).toHaveBeenCalledTimes(1);
+    });
+
+    it("drops a pending catch-up when the account signs out while hidden", async () => {
+      const signedInUser = mockState.user;
+      const queryClient = new QueryClient();
+      const refetchQueries = vi.spyOn(queryClient, "refetchQueries").mockResolvedValue(undefined);
+      const rerender = renderProvider(queryClient);
+      await act(async () => {});
+      try {
+        await act(async () => {
+          setPage({ visible: false });
+          rerender();
+        });
+        await act(async () => {
+          vi.advanceTimersByTime(HIDDEN_EVENTS_SOCKET_GRACE_MS);
+        });
+        await act(async () => {
+          (mockState as { user: unknown }).user = null;
+          rerender();
+        });
+        await act(async () => {
+          setPage({ visible: true });
+          rerender();
+        });
+        await act(async () => {
+          mockState.user = signedInUser;
+          rerender();
+        });
+        expect(refetchQueries).not.toHaveBeenCalled();
+        expect(mockState.refreshAccount).not.toHaveBeenCalled();
+      } finally {
+        mockState.user = signedInUser;
+      }
+    });
+
+    it("catches up when a background tab stays hidden past the grace period", async () => {
+      setPage({ visible: false });
+      const queryClient = new QueryClient();
+      const refetchQueries = vi.spyOn(queryClient, "refetchQueries").mockResolvedValue(undefined);
+      const rerender = renderProvider(queryClient);
+      await act(async () => {});
+      await act(async () => {
+        vi.advanceTimersByTime(HIDDEN_EVENTS_SOCKET_GRACE_MS);
+      });
+      expect(FakeWebSocket.instances[0]!.readyState).toBe(FakeWebSocket.CLOSED);
+
+      await act(async () => {
+        setPage({ visible: true });
+        rerender();
+      });
+      expect(FakeWebSocket.instances).toHaveLength(2);
+      expect(refetchQueries).toHaveBeenCalledTimes(1);
+      expect(refetchQueries).toHaveBeenCalledWith(catchUp);
+    });
+
+    it("connects in a background tab and skips the catch-up when shown soon after", async () => {
+      setPage({ visible: false });
+      const queryClient = new QueryClient();
+      const refetchQueries = vi.spyOn(queryClient, "refetchQueries");
+      const rerender = renderProvider(queryClient);
+      await act(async () => {});
+      expect(FakeWebSocket.instances).toHaveLength(1);
+
+      await act(async () => {
+        vi.advanceTimersByTime(5_000);
+      });
+      await act(async () => {
+        setPage({ visible: true });
+        rerender();
+      });
+
+      expect(FakeWebSocket.instances).toHaveLength(1);
+      expect(refetchQueries).not.toHaveBeenCalled();
+      expect(mockState.refreshAccount).not.toHaveBeenCalled();
+    });
+  });
+
   describe("access changes", () => {
     const libraries = libraryKeys.user("none");
     const detail = catalogKeys.itemDetail("movie-1");
diff --git a/web/src/components/RealtimeEventsProvider.tsx b/web/src/components/RealtimeEventsProvider.tsx
index 6705130c67..6cdd27ab80 100644
--- a/web/src/components/RealtimeEventsProvider.tsx
+++ b/web/src/components/RealtimeEventsProvider.tsx
@@ -51,7 +51,7 @@ import {
   isDownloadPreparationProgressEvent,
   type AdminDownloadPreparationList,
 } from "@/api/v2/adminDownloadPreparations";
-import { adminDownloadStorageRootKey } from "@/api/v2/adminDownloadStorage";
+import { adminDownloadStorageRootKey } from "@/api/v2/adminDownloadStorageCache";
 import { adminStatsKey } from "@/hooks/queries/admin/stats";
 import { useAuth } from "@/hooks/useAuth";
 import { useIsActingAdmin } from "@/hooks/useIsActingAdmin";
@@ -60,10 +60,12 @@ import {
   adminKeys,
   historyImportKeys,
   libraryKeys,
+  notInterestedKeys,
   requestKeys,
   sectionKeys,
 } from "@/hooks/queries/keys";
 import {
+  dropInactiveWatchDetail,
   scheduleMediaSurfaceInvalidation,
   updateCatalogItemDetail,
 } from "@/hooks/queries/mediaSurfaceRefresh";
@@ -81,10 +83,18 @@ interface UserStatePayload {
   profile_id: string;
   content_id?: string;
   series_id?: string;
-  change: "progress" | "favorite" | "watchlist" | "history" | "watched" | "home_dismissal";
+  change:
+    | "progress"
+    | "favorite"
+    | "watchlist"
+    | "history"
+    | "watched"
+    | "home_dismissal"
+    | "not_interested";
   played?: boolean;
   is_favorite?: boolean;
   in_watchlist?: boolean;
+  not_interested?: boolean;
 }
 
 const CATALOG_ITEM_CHANGED_EVENTS = new Set([
@@ -114,6 +124,14 @@ function isRequestNotification(notification: Pick<AppNotification, "type">) {
  */
 export const EVENTS_ACCESS_CHANGED_CLOSE_CODE = 4001;
 
+/**
+ * How long the events socket stays open after the page is hidden. Its frames
+ * keep the cache current meanwhile, so a quick tab switch costs no requests. A
+ * longer absence closes the socket, and the return refetches active queries
+ * once to cover the frames it missed.
+ */
+export const HIDDEN_EVENTS_SOCKET_GRACE_MS = 60_000;
+
 function buildEventsUrl(location: Pick<Location, "protocol" | "host">) {
   const protocol = location.protocol === "https:" ? "wss:" : "ws:";
   return `${protocol}//${location.host}/api/v2/events/ws`;
@@ -385,11 +403,13 @@ function handleUserStateEvent(
         payload.played ?? detail.user_state?.played ?? detail.user_data?.played ?? false;
       const isFavorite = payload.is_favorite ?? detail.user_state?.is_favorite ?? false;
       const inWatchlist = payload.in_watchlist ?? detail.user_state?.in_watchlist ?? false;
+      const notInterested = payload.not_interested ?? detail.user_state?.not_interested ?? false;
       if (
         played === (detail.user_data?.played ?? false) &&
         played === (detail.user_state?.played ?? false) &&
         isFavorite === (detail.user_state?.is_favorite ?? false) &&
-        inWatchlist === (detail.user_state?.in_watchlist ?? false)
+        inWatchlist === (detail.user_state?.in_watchlist ?? false) &&
+        notInterested === (detail.user_state?.not_interested ?? false)
       ) {
         return detail;
       }
@@ -403,24 +423,41 @@ function handleUserStateEvent(
           played,
           is_favorite: isFavorite,
           in_watchlist: inWatchlist,
+          not_interested: notInterested,
         },
       };
     });
   }
 
-  // The patch above only carries played/favourite/watchlist, which is the whole
-  // of what a favorite or watchlist event changes. Every other change — progress
+  // The patch above only carries played/favourite/watchlist/not-interested,
+  // which is the whole of what a favorite, watchlist or not-interested event
+  // changes. Every other change — progress
   // above all, which arrives with no state at all — also moves fields the patch
   // cannot reconstruct (position_seconds, is_in_progress, season counts), so the
   // detail query still has to be refreshed for those.
-  const detailFullyPatched = payload.change === "favorite" || payload.change === "watchlist";
+  const detailFullyPatched =
+    payload.change === "favorite" ||
+    payload.change === "watchlist" ||
+    payload.change === "not_interested";
+  if (payload.change === "not_interested") {
+    void queryClient.invalidateQueries({ queryKey: notInterestedKeys.all });
+  }
+  // A closed player would start from its cached watch detail's resume
+  // position, so drop it now rather than after the coalesced refresh; the
+  // refresh still reaches the series it led to.
+  const knownRelatedIds =
+    payload.content_id && (payload.change === "progress" || payload.change === "watched")
+      ? dropInactiveWatchDetail(queryClient, payload.content_id)
+      : undefined;
   scheduleMediaSurfaceInvalidation(
     queryClient,
     payload.content_id
       ? {
           itemId: payload.content_id,
           skipItemDetail: detailFullyPatched,
-          skipSimilarItems: true,
+          // A mark changes which titles More like this lists.
+          skipSimilarItems: payload.change !== "not_interested",
+          knownRelatedIds,
         }
       : { skipSimilarItems: true },
   );
@@ -469,12 +506,22 @@ export function RealtimeEventsProvider({ children }: { children: ReactNode }) {
   const nextHandlerIDRef = useRef(1);
   const waitersRef = useRef(new Map<string, JobWaiter>());
   const activeProfileIDRef = useRef<string | null | undefined>(profile?.id);
-  const canApplyRealtimeUpdatesRef = useRef(pageActivity.canApplyRealtimeUpdates);
   const allowDashboardRealtimeUpdatesRef = useRef(allowDashboardRealtimeUpdates);
-  const shouldCatchUpOnFocusRef = useRef(!pageActivity.canApplyRealtimeUpdates);
+  const shouldCatchUpOnFocusRef = useRef(false);
+  const hiddenAtRef = useRef<number | null>(null);
+  const hideCountRef = useRef(0);
+  // An unexpected drop on a visible page is not caught up at once, but the
+  // next return from a hide catches up the frames it lost.
+  const droppedSinceCatchUpRef = useRef(false);
+  const [hiddenGraceExpired, setHiddenGraceExpired] = useState(false);
+  // Bumping these replaces the socket, or runs a catch-up while the page is visible.
+  const [socketGeneration, setSocketGeneration] = useState(0);
+  const [catchUpSignal, setCatchUpSignal] = useState(0);
+  // A frozen page runs no timers or socket handlers, so it gets no grace.
+  const keepSocketOpen =
+    pageActivity.canApplyRealtimeUpdates || (!pageActivity.isFrozen && !hiddenGraceExpired);
 
   activeProfileIDRef.current = profile?.id;
-  canApplyRealtimeUpdatesRef.current = pageActivity.canApplyRealtimeUpdates;
   allowDashboardRealtimeUpdatesRef.current = allowDashboardRealtimeUpdates;
 
   useEffect(() => () => catalogInvalidation.cancel(), [catalogInvalidation]);
@@ -803,13 +850,43 @@ export function RealtimeEventsProvider({ children }: { children: ReactNode }) {
   }
 
   useEffect(() => {
-    if (!authenticatedUserID) {
+    if (pageActivity.canApplyRealtimeUpdates) {
+      setHiddenGraceExpired(false);
       return;
     }
+    const timer = window.setTimeout(
+      () => setHiddenGraceExpired(true),
+      HIDDEN_EVENTS_SOCKET_GRACE_MS,
+    );
+    return () => window.clearTimeout(timer);
+  }, [pageActivity.canApplyRealtimeUpdates]);
+
+  useEffect(() => {
     if (!pageActivity.canApplyRealtimeUpdates) {
-      shouldCatchUpOnFocusRef.current = true;
+      if (hiddenAtRef.current === null) {
+        hiddenAtRef.current = Date.now();
+        hideCountRef.current += 1;
+      }
       return;
     }
+    const hiddenAt = hiddenAtRef.current;
+    hiddenAtRef.current = null;
+    if (!authenticatedUserID) {
+      shouldCatchUpOnFocusRef.current = false;
+      return;
+    }
+    // A suspended page (a phone browser in the background) runs no timers, so
+    // the grace timer may not have closed the socket. Frames were probably
+    // missed, and the socket may have died without a close event: replace it.
+    if (hiddenAt !== null && Date.now() - hiddenAt >= HIDDEN_EVENTS_SOCKET_GRACE_MS) {
+      shouldCatchUpOnFocusRef.current = true;
+      if (socketRef.current) {
+        setSocketGeneration((generation) => generation + 1);
+      }
+    }
+    if (hiddenAt !== null && droppedSinceCatchUpRef.current) {
+      shouldCatchUpOnFocusRef.current = true;
+    }
     if (!shouldCatchUpOnFocusRef.current) {
       return;
     }
@@ -824,6 +901,7 @@ export function RealtimeEventsProvider({ children }: { children: ReactNode }) {
     }
 
     shouldCatchUpOnFocusRef.current = false;
+    droppedSinceCatchUpRef.current = false;
     void queryClient.refetchQueries({
       type: "active",
       predicate: (query) => !isDashboardQueryKey(query.queryKey),
@@ -834,6 +912,7 @@ export function RealtimeEventsProvider({ children }: { children: ReactNode }) {
     void refreshAccount().catch(() => {});
   }, [
     authenticatedUserID,
+    catchUpSignal,
     isForegroundPlaybackRoute,
     pageActivity.canApplyRealtimeUpdates,
     queryClient,
@@ -841,7 +920,13 @@ export function RealtimeEventsProvider({ children }: { children: ReactNode }) {
   ]);
 
   useEffect(() => {
-    if (!authenticatedUserID || !pageActivity.canApplyRealtimeUpdates) {
+    if (!authenticatedUserID) {
+      setConnectionState("disconnected");
+      return;
+    }
+    if (!keepSocketOpen) {
+      // Frames sent from now on are missed; catch up when the page returns.
+      shouldCatchUpOnFocusRef.current = true;
       setConnectionState("disconnected");
       return;
     }
@@ -934,6 +1019,7 @@ export function RealtimeEventsProvider({ children }: { children: ReactNode }) {
 
       activeSocket = socket;
       socketRef.current = socket;
+      const hideCountAtOpen = hideCountRef.current;
       // The server sends access_changed and then closes with
       // EVENTS_ACCESS_CHANGED_CLOSE_CODE; whichever arrives first refreshes.
       let accessChangeHandled = false;
@@ -959,9 +1045,6 @@ export function RealtimeEventsProvider({ children }: { children: ReactNode }) {
         if (closedByEffect || socketRef.current !== socket || !authorityActive()) {
           return;
         }
-        if (!canApplyRealtimeUpdatesRef.current) {
-          return;
-        }
         const message = parseEventsMessage(event.data);
         if (!message) {
           return;
@@ -1041,6 +1124,20 @@ export function RealtimeEventsProvider({ children }: { children: ReactNode }) {
           authorityActive()
         ) {
           handleAccessChanged();
+        } else if (!closedByEffect) {
+          droppedSinceCatchUpRef.current = true;
+        }
+        if (
+          event.code !== EVENTS_ACCESS_CHANGED_CLOSE_CODE &&
+          !closedByEffect &&
+          (hiddenAtRef.current !== null || hideCountRef.current !== hideCountAtOpen)
+        ) {
+          // The socket was up while the page was hidden, and a phone browser
+          // may have been suspended then, so frames could have been lost
+          // without notice. Catalog and user-state channels send no snapshot
+          // on reconnect: catch up now, or when the page returns.
+          shouldCatchUpOnFocusRef.current = true;
+          setCatchUpSignal((signal) => signal + 1);
         }
         socketRef.current = null;
         activeSocket = null;
@@ -1084,7 +1181,8 @@ export function RealtimeEventsProvider({ children }: { children: ReactNode }) {
     renderedAuthority?.serverOrigin,
     renderedAuthority?.profileId,
     renderedAuthority?.profileToken,
-    pageActivity.canApplyRealtimeUpdates,
+    keepSocketOpen,
+    socketGeneration,
     queryClient,
     refreshAccount,
     sendSubscribe,
diff --git a/web/src/components/RequestResultsGrid.tsx b/web/src/components/RequestResultsGrid.tsx
index 9a9c05d1d3..bdc3bc2eae 100644
--- a/web/src/components/RequestResultsGrid.tsx
+++ b/web/src/components/RequestResultsGrid.tsx
@@ -2,7 +2,7 @@ import type { RequestMediaResult } from "@/api/types";
 import RequestPosterCard from "@/components/RequestPosterCard";
 import { Button } from "@/components/ui/button";
 import { Skeleton } from "@/components/ui/skeleton";
-import { useIntersectionObserver } from "@/hooks/useIntersectionObserver";
+import { LoadMoreOnScroll } from "@/components/LoadMoreOnScroll";
 import { useSubmitMediaRequest } from "@/hooks/useSubmitMediaRequest";
 import { useUICustomization } from "@/hooks/useUICustomization";
 import { useWatchlistTitleToggle } from "@/hooks/useWatchlistTitleToggle";
@@ -91,30 +91,14 @@ export function RequestResultsLoadMore({
   isError: boolean;
   onLoadMore: () => void;
 }) {
-  const sentinelRef = useIntersectionObserver({
-    onIntersect: onLoadMore,
-    enabled: hasNextPage && !isFetchingNextPage && !isError,
-  });
-  if (!hasNextPage) return null;
-  if (isFetchingNextPage) return null;
-  if (isError) {
-    return (
-      <div className="flex flex-col items-center gap-3 py-6 text-center">
-        <p className="text-muted-foreground text-sm">Couldn&rsquo;t load more titles.</p>
-        <Button variant="outline" size="sm" onClick={onLoadMore}>
-          Try again
-        </Button>
-      </div>
-    );
-  }
   return (
-    <div ref={sentinelRef} className="flex justify-center py-4">
-      {typeof IntersectionObserver === "undefined" ? (
-        <Button variant="outline" size="sm" onClick={onLoadMore}>
-          Load more
-        </Button>
-      ) : null}
-    </div>
+    <LoadMoreOnScroll
+      hasNextPage={hasNextPage}
+      isFetchingNextPage={isFetchingNextPage}
+      isError={isError}
+      onLoadMore={onLoadMore}
+      errorMessage="Couldn’t load more titles."
+    />
   );
 }
 
diff --git a/web/src/components/SearchBar.test.tsx b/web/src/components/SearchBar.test.tsx
index 7113c67a7f..bbbc59f0a7 100644
--- a/web/src/components/SearchBar.test.tsx
+++ b/web/src/components/SearchBar.test.tsx
@@ -1,8 +1,13 @@
 import { act, fireEvent, render, screen } from "@testing-library/react";
-import { MemoryRouter, useLocation } from "react-router";
+import { Suspense } from "react";
+import { MemoryRouter, useLocation, useNavigate, useSearchParams } from "react-router";
 import { afterEach, describe, expect, it, vi } from "vitest";
 
-import { buildCatalogQueryUpdateHref, parseCatalogSearchParams } from "@/pages/catalogSearchParams";
+import {
+  buildCatalogQueryUpdateHref,
+  buildQueryCatalogHref,
+  parseCatalogSearchParams,
+} from "@/pages/catalogSearchParams";
 
 const mocks = vi.hoisted(() => ({ transitionNavigate: vi.fn() }));
 
@@ -17,10 +22,246 @@ function LocationProbe() {
   return <output aria-label="location">{`${location.pathname}${location.search}`}</output>;
 }
 
+function currentQueryParam() {
+  const location = new URL(`http://example.test${screen.getByLabelText("location").textContent}`);
+  return location.searchParams.get("q");
+}
+
+// Searches the test has not finished yet. Rendering results for one of these
+// suspends, which holds the router's navigation transition the way a slow
+// search response does on a real results page.
+const slowSearches = new Map<
+  string,
+  { promise: Promise<void>; finish: () => void; finished: boolean }
+>();
+
+function startSlowSearch(query: string) {
+  let finish = () => {};
+  const promise = new Promise<void>((resolve) => {
+    finish = resolve;
+  });
+  const search = { promise, finished: false, finish: () => {} };
+  search.finish = () => {
+    search.finished = true;
+    finish();
+  };
+  slowSearches.set(query, search);
+}
+
+async function finishSlowSearch(query: string) {
+  const search = slowSearches.get(query);
+  if (!search) throw new Error(`no slow search for ${query}`);
+  await act(async () => {
+    search.finish();
+    await search.promise;
+  });
+}
+
+function SlowResults({ query }: { query: string }) {
+  const search = slowSearches.get(query);
+  if (search && !search.finished) throw search.promise;
+  return <p>{`Results for ${query}`}</p>;
+}
+
+// Mirrors the Search page: the query comes from the URL, an empty query shows
+// the empty state with its own bar, and a query shows a second bar above the
+// results.
+function SearchPage() {
+  const [searchParams] = useSearchParams();
+  const query = searchParams.get("q")?.trim() ?? "";
+  if (!query) {
+    return (
+      <section>
+        <SearchBar prominent />
+      </section>
+    );
+  }
+  return (
+    <div>
+      <SearchBar prominent initialQuery={query} />
+      <SlowResults query={query} />
+    </div>
+  );
+}
+
+function OpenQueryButton({ query }: { query: string }) {
+  const navigate = useNavigate();
+  return (
+    <button type="button" onClick={() => navigate(buildQueryCatalogHref(query))}>
+      {`Open ${query}`}
+    </button>
+  );
+}
+
+function VideoScopeButton() {
+  const [searchParams, setSearchParams] = useSearchParams();
+  return (
+    <button
+      type="button"
+      onClick={() => {
+        const next = new URLSearchParams(searchParams);
+        next.set("type", "video");
+        setSearchParams(next);
+      }}
+    >
+      Videos only
+    </button>
+  );
+}
+
+function renderSearchPage(initialEntry: string, externalQuery = "dune") {
+  return render(
+    <MemoryRouter initialEntries={[initialEntry]}>
+      <Suspense fallback={<p>Loading</p>}>
+        <SearchPage />
+        <LocationProbe />
+        <OpenQueryButton query={externalQuery} />
+        <VideoScopeButton />
+      </Suspense>
+    </MemoryRouter>,
+  );
+}
+
 describe("SearchBar", () => {
   afterEach(() => {
     vi.useRealTimers();
     mocks.transitionNavigate.mockReset();
+    slowSearches.clear();
+  });
+
+  it("keeps a trailing space when the URL echoes the trimmed query", () => {
+    vi.useFakeTimers();
+    renderSearchPage("/catalog?source=query&q=th");
+
+    const input = screen.getByRole("textbox");
+    fireEvent.change(input, { target: { value: "the " } });
+    act(() => vi.advanceTimersByTime(201));
+
+    expect(currentQueryParam()).toBe("the");
+    expect(input).toHaveValue("the ");
+  });
+
+  it("keeps text typed while an earlier search is still loading", async () => {
+    vi.useFakeTimers();
+    renderSearchPage("/catalog?source=query&q=st");
+
+    const input = screen.getByRole("textbox");
+    startSlowSearch("sta");
+    fireEvent.change(input, { target: { value: "sta" } });
+    act(() => vi.advanceTimersByTime(201));
+    fireEvent.change(input, { target: { value: "star" } });
+    act(() => vi.advanceTimersByTime(100));
+
+    await finishSlowSearch("sta");
+
+    expect(screen.getByText("Results for sta")).toBeInTheDocument();
+    expect(screen.getByRole("textbox")).toHaveValue("star");
+
+    act(() => vi.advanceTimersByTime(201));
+    expect(currentQueryParam()).toBe("star");
+    expect(screen.getByRole("textbox")).toHaveValue("star");
+  });
+
+  it("keeps text typed while the first search replaces the empty Search page", async () => {
+    vi.useFakeTimers();
+    renderSearchPage("/catalog?source=query");
+
+    startSlowSearch("s");
+    fireEvent.change(screen.getByRole("textbox"), { target: { value: "s" } });
+    act(() => vi.advanceTimersByTime(201));
+    fireEvent.change(screen.getByRole("textbox"), { target: { value: "st" } });
+    act(() => vi.advanceTimersByTime(100));
+
+    await finishSlowSearch("s");
+
+    expect(screen.getByText("Results for s")).toBeInTheDocument();
+    expect(screen.getByRole("textbox")).toHaveValue("st");
+
+    act(() => vi.advanceTimersByTime(201));
+    expect(currentQueryParam()).toBe("st");
+    expect(screen.getByRole("textbox")).toHaveValue("st");
+  });
+
+  it("does not carry unsent text into a Search page opened later", async () => {
+    vi.useFakeTimers();
+    const first = renderSearchPage("/catalog?source=query&q=st");
+
+    startSlowSearch("sta");
+    fireEvent.change(screen.getByRole("textbox"), { target: { value: "sta" } });
+    act(() => vi.advanceTimersByTime(201));
+    fireEvent.change(screen.getByRole("textbox"), { target: { value: "star" } });
+    first.unmount();
+    await act(async () => {});
+
+    slowSearches.clear();
+    renderSearchPage("/catalog?source=query&q=sta");
+    expect(screen.getByRole("textbox")).toHaveValue("sta");
+  });
+
+  it("keeps text typed while several of its searches land together", async () => {
+    vi.useFakeTimers();
+    renderSearchPage("/catalog?source=query&q=st");
+
+    const input = screen.getByRole("textbox");
+    startSlowSearch("sta");
+    startSlowSearch("star");
+    fireEvent.change(input, { target: { value: "sta" } });
+    act(() => vi.advanceTimersByTime(201));
+    fireEvent.change(input, { target: { value: "star" } });
+    act(() => vi.advanceTimersByTime(201));
+    fireEvent.change(input, { target: { value: "stars" } });
+
+    await finishSlowSearch("sta");
+    await finishSlowSearch("star");
+
+    expect(currentQueryParam()).toBe("star");
+    expect(screen.getByRole("textbox")).toHaveValue("stars");
+  });
+
+  it("follows a link to the query it is still loading", async () => {
+    vi.useFakeTimers();
+    renderSearchPage("/catalog?source=query&q=st", "sta");
+
+    const input = screen.getByRole("textbox");
+    startSlowSearch("sta");
+    fireEvent.change(input, { target: { value: "sta" } });
+    act(() => vi.advanceTimersByTime(201));
+    fireEvent.change(input, { target: { value: "star" } });
+    fireEvent.click(screen.getByRole("button", { name: "Open sta" }));
+
+    await finishSlowSearch("sta");
+
+    expect(currentQueryParam()).toBe("sta");
+    expect(screen.getByRole("textbox")).toHaveValue("sta");
+    act(() => vi.advanceTimersByTime(500));
+    expect(currentQueryParam()).toBe("sta");
+    expect(screen.getByRole("textbox")).toHaveValue("sta");
+  });
+
+  it("keeps typed text when a navigation leaves the query alone", () => {
+    vi.useFakeTimers();
+    renderSearchPage("/catalog?source=query&q=th");
+
+    const input = screen.getByRole("textbox");
+    fireEvent.change(input, { target: { value: "the " } });
+    act(() => vi.advanceTimersByTime(201));
+    fireEvent.click(screen.getByRole("button", { name: "Videos only" }));
+
+    const location = new URL(`http://example.test${screen.getByLabelText("location").textContent}`);
+    expect(location.searchParams.get("type")).toBe("video");
+    expect(location.searchParams.get("q")).toBe("the");
+    expect(input).toHaveValue("the ");
+  });
+
+  it("shows a query from outside navigation", () => {
+    vi.useFakeTimers();
+    renderSearchPage("/catalog?source=query&q=heat");
+
+    expect(screen.getByRole("textbox")).toHaveValue("heat");
+    fireEvent.click(screen.getByRole("button", { name: "Open dune" }));
+
+    expect(currentQueryParam()).toBe("dune");
+    expect(screen.getByRole("textbox")).toHaveValue("dune");
   });
 
   it("keeps All Media selected when live search changes the query", () => {
diff --git a/web/src/components/SearchBar.tsx b/web/src/components/SearchBar.tsx
index c713061c2d..d2273710c7 100644
--- a/web/src/components/SearchBar.tsx
+++ b/web/src/components/SearchBar.tsx
@@ -1,5 +1,5 @@
-import { useEffect, useRef, useState } from "react";
-import { useNavigate } from "react-router";
+import { useCallback, useEffect, useLayoutEffect, useRef, useState } from "react";
+import { useLocation, useNavigate } from "react-router";
 import { useViewTransitionNavigate } from "@/hooks/useViewTransition";
 import { useDebounce } from "@/hooks/useDebounce";
 import { Input } from "@/components/ui/input";
@@ -8,6 +8,35 @@ import { Search, X } from "lucide-react";
 import type { FormEvent } from "react";
 
 const SEARCH_NAVIGATION_DEBOUNCE_MS = 200;
+const SEARCH_NAVIGATION_STATE_KEY = "searchBarNavigation";
+
+let searchNavigationCount = 0;
+
+// History state survives a reload, which restarts the counter, so the time
+// keeps an older entry's id from matching a new navigation.
+function createSearchNavigationId() {
+  searchNavigationCount += 1;
+  return `${Date.now().toString(36)}-${searchNavigationCount}`;
+}
+
+function readSearchNavigationId(state: unknown): string | null {
+  if (typeof state !== "object" || state === null) return null;
+  const id = (state as Record<string, unknown>)[SEARCH_NAVIGATION_STATE_KEY];
+  return typeof id === "string" ? id : null;
+}
+
+interface LiveSearchDraft {
+  query: string;
+  pendingNavigations: string[];
+  lastNavigatedQuery: string;
+}
+
+// The Search page renders one bar in its empty state and another above the
+// results, so its first live search unmounts the bar being typed in. Anything
+// typed while that navigation rendered exists only in the outgoing bar. It
+// leaves its text here as it unmounts, and the incoming bar takes it in the
+// same commit. A draft nobody took is dropped once that commit ends.
+let liveSearchHandoff: LiveSearchDraft | null = null;
 
 interface SearchBarProps {
   initialQuery?: string;
@@ -28,23 +57,90 @@ export default function SearchBar({
   const [query, setQuery] = useState(initialQuery);
   const navigate = useViewTransitionNavigate();
   const navigateWithoutTransition = useNavigate();
+  const location = useLocation();
+  const landedNavigationId = readSearchNavigationId(location.state);
   const inputRef = useRef<HTMLInputElement>(null);
   const isInitialMount = useRef(true);
   const buildSearchHrefRef = useRef(buildSearchHref);
   const lastNavigatedQueryRef = useRef(initialQuery.trim());
+  // Navigations this bar has started that the router has not committed yet,
+  // oldest first, by the id each carries in its history state. Router
+  // navigations commit as transitions, so each one lands after a delay, and
+  // the person may have typed more by then.
+  const pendingNavigationsRef = useRef<string[]>([]);
+  const syncedQueryRef = useRef(initialQuery);
+  const queryRef = useRef(query);
+  const mountNavigationIdRef = useRef(landedNavigationId);
   const debouncedQuery = useDebounce(query, SEARCH_NAVIGATION_DEBOUNCE_MS);
 
   useEffect(() => {
     buildSearchHrefRef.current = buildSearchHref;
   }, [buildSearchHref]);
 
+  useLayoutEffect(() => {
+    queryRef.current = query;
+  }, [query]);
+
+  useLayoutEffect(() => {
+    const draft = liveSearchHandoff;
+    liveSearchHandoff = null;
+    const mountNavigationId = mountNavigationIdRef.current;
+    if (prominent && mountNavigationId && draft?.pendingNavigations.includes(mountNavigationId)) {
+      pendingNavigationsRef.current = draft.pendingNavigations;
+      lastNavigatedQueryRef.current = draft.lastNavigatedQuery;
+      // eslint-disable-next-line react-hooks/set-state-in-effect -- adopts the unmounted bar's text before paint
+      setQuery(draft.query);
+    }
+    return () => {
+      if (pendingNavigationsRef.current.length === 0) return;
+      const outgoing = {
+        query: queryRef.current,
+        pendingNavigations: [...pendingNavigationsRef.current],
+        lastNavigatedQuery: lastNavigatedQueryRef.current,
+      };
+      liveSearchHandoff = outgoing;
+      queueMicrotask(() => {
+        if (liveSearchHandoff === outgoing) liveSearchHandoff = null;
+      });
+    };
+  }, [prominent]);
+
   // Browser history, scope changes, and external navigation can update the
   // canonical query without remounting this component. Keep the input in sync
-  // instead of leaving it attached to a stale request key.
+  // instead of leaving it attached to a stale request key. A navigation this
+  // bar started is only the router catching up: the input already holds that
+  // text or newer typing, and the URL query is trimmed, so copying it back
+  // would drop whatever was typed since, trailing spaces included. Any other
+  // navigation that changes the query replaces the text, even when it opens a
+  // query this bar is still loading.
   useEffect(() => {
+    const pendingNavigations = pendingNavigationsRef.current;
+    const landedIndex = landedNavigationId ? pendingNavigations.indexOf(landedNavigationId) : -1;
+    if (landedIndex >= 0) {
+      pendingNavigations.splice(0, landedIndex + 1);
+      syncedQueryRef.current = initialQuery;
+      return;
+    }
+    if (initialQuery === syncedQueryRef.current) return;
+    syncedQueryRef.current = initialQuery;
+    pendingNavigationsRef.current = [];
+    // eslint-disable-next-line react-hooks/set-state-in-effect -- the URL changed outside this bar
     setQuery(initialQuery);
     lastNavigatedQueryRef.current = initialQuery.trim();
-  }, [initialQuery]);
+  }, [initialQuery, landedNavigationId]);
+
+  const navigateToQuery = useCallback(
+    (normalizedQuery: string, options?: { replace: true }) => {
+      const navigationId = createSearchNavigationId();
+      lastNavigatedQueryRef.current = normalizedQuery;
+      pendingNavigationsRef.current.push(navigationId);
+      navigateWithoutTransition(buildSearchHrefRef.current(normalizedQuery), {
+        ...options,
+        state: { [SEARCH_NAVIGATION_STATE_KEY]: navigationId },
+      });
+    },
+    [navigateWithoutTransition],
+  );
 
   useEffect(() => {
     if (autoFocus && inputRef.current) {
@@ -73,18 +169,14 @@ export default function SearchBar({
     // Updating only the query string is not a page transition. Animating a
     // full route snapshot for every debounced keystroke makes the search page
     // visibly wobble and adds compositor work to its hottest interaction.
-    lastNavigatedQueryRef.current = normalizedDebouncedQuery;
-    navigateWithoutTransition(buildSearchHrefRef.current(normalizedDebouncedQuery), {
-      replace: true,
-    });
-  }, [debouncedQuery, prominent, navigateWithoutTransition, query]);
+    navigateToQuery(normalizedDebouncedQuery, { replace: true });
+  }, [debouncedQuery, prominent, navigateToQuery, query]);
 
   function handleSubmit(e: FormEvent) {
     e.preventDefault();
     if (query.trim()) {
       if (prominent) {
-        lastNavigatedQueryRef.current = query.trim();
-        navigateWithoutTransition(buildSearchHref(query.trim()));
+        navigateToQuery(query.trim());
       } else {
         navigate(buildSearchHref(query.trim()));
       }
@@ -97,8 +189,7 @@ export default function SearchBar({
 
     // Clear is an explicit action, not typeahead. Remove the active route and
     // abort its request immediately instead of waiting for the debounce.
-    lastNavigatedQueryRef.current = "";
-    navigateWithoutTransition(buildSearchHrefRef.current(""), { replace: true });
+    navigateToQuery("", { replace: true });
   }
 
   if (prominent) {
diff --git a/web/src/components/SectionRow.test.tsx b/web/src/components/SectionRow.test.tsx
index be52f6dfca..4916a7a4af 100644
--- a/web/src/components/SectionRow.test.tsx
+++ b/web/src/components/SectionRow.test.tsx
@@ -210,6 +210,91 @@ describe("SectionRow", () => {
     expect(markup).not.toContain("aspect-video");
   });
 
+  function continueSection(items: ResolvedSection["items"]): ResolvedSection {
+    return {
+      id: "continue-watching",
+      section_type: "continue_watching",
+      title: "Continue Watching",
+      featured: false,
+      item_limit: 10,
+      total_count: items.length,
+      is_custom: false,
+      customized: false,
+      items,
+    };
+  }
+
+  function progressItem(
+    contentId: string,
+    type: ResolvedSection["items"][number]["type"],
+    art: { poster_url?: string; backdrop_url?: string },
+  ): ResolvedSection["items"][number] {
+    return {
+      content_id: contentId,
+      type,
+      title: contentId,
+      position_seconds: 600,
+      duration_seconds: 6000,
+      year: 2020,
+      genres: [],
+      status: "matched",
+      rating_imdb: null,
+      overview: "",
+      poster_url: art.poster_url ?? "",
+      poster_thumbhash: "",
+      backdrop_url: art.backdrop_url ?? "",
+      backdrop_thumbhash: "",
+      logo_url: "",
+    };
+  }
+
+  function renderRow(section: ResolvedSection) {
+    return renderToStaticMarkup(
+      <QueryClientProvider client={new QueryClient()}>
+        <MemoryRouter>
+          <SectionRow section={section} />
+        </MemoryRouter>
+      </QueryClientProvider>,
+    );
+  }
+
+  it("keeps all-movie continue sections as wide backdrop cards", () => {
+    const markup = renderRow(
+      continueSection([
+        progressItem("movie-1", "movie", {
+          poster_url: "/movie-poster.jpg",
+          backdrop_url: "/movie-backdrop.jpg",
+        }),
+      ]),
+    );
+
+    expect(markup).toContain("aspect-video");
+    expect(markup).not.toContain("aspect-[2/3]");
+    expect(markup).toContain('src="/movie-backdrop.jpg"');
+  });
+
+  it("falls back to the poster on a wide movie card without a backdrop", () => {
+    const markup = renderRow(
+      continueSection([progressItem("movie-1", "movie", { poster_url: "/movie-poster.jpg" })]),
+    );
+
+    expect(markup).toContain("aspect-video");
+    expect(markup).toContain('src="/movie-poster.jpg"');
+  });
+
+  it("keeps continue sections that mix movies and books wide", () => {
+    const markup = renderRow(
+      continueSection([
+        progressItem("movie-1", "movie", { backdrop_url: "/movie-backdrop.jpg" }),
+        progressItem("book-1", "audiobook", { poster_url: "/book-cover.jpg" }),
+      ]),
+    );
+
+    expect(markup).toContain("aspect-video");
+    expect(markup).not.toContain("aspect-square");
+    expect(markup).not.toContain("aspect-[2/3]");
+  });
+
   it("routes supported home section view-all actions to home browse destinations", () => {
     const queryClient = new QueryClient();
     const section: ResolvedSection = {
diff --git a/web/src/components/SectionRow.tsx b/web/src/components/SectionRow.tsx
index adc1e880de..e84213181e 100644
--- a/web/src/components/SectionRow.tsx
+++ b/web/src/components/SectionRow.tsx
@@ -71,16 +71,15 @@ export default memo(function SectionRow({ section, libraryId, priority = false }
   // One spoiler lookup per row rather than one per card.
   const { hideImages, hideOverviews } = useEpisodeSpoilerPrefs({ enabled: isProgressRow });
   const spoilerPrefs = useMemo(() => ({ hideImages, hideOverviews }), [hideImages, hideOverviews]);
-  // Continue Watching with only movies, audiobooks, and/or ebooks looks better
-  // as upright covers (audiobook covers render square within the poster
-  // variant; ebook covers are naturally 2:3). Episodes (incl. Next Up) keep the
-  // wide variant so stills are shown with their natural 16:9 framing.
+  // Progress rows stay wide (16:9) whenever they hold any video, matching the
+  // native apps, so Continue Watching keeps its shape as movies and episodes
+  // come and go. Only a Continue Watching row made up entirely of books uses
+  // the poster variant, where audiobook covers render square and ebook covers
+  // upright 2:3.
   const progressCardVariant: "wide" | "poster" =
     section.section_type === "continue_watching" &&
     section.items.length > 0 &&
-    section.items.every(
-      (it) => it.type === "movie" || it.type === "audiobook" || it.type === "ebook",
-    )
+    section.items.every((it) => it.type === "audiobook" || it.type === "ebook")
       ? "poster"
       : "wide";
   const slideSize = isProgressRow && progressCardVariant === "wide" ? "wide" : posterSize;
diff --git a/web/src/components/SideNav.tsx b/web/src/components/SideNav.tsx
index a8bb4ac2c5..238f458012 100644
--- a/web/src/components/SideNav.tsx
+++ b/web/src/components/SideNav.tsx
@@ -1,12 +1,12 @@
 import { Link } from "react-router";
+import { ChevronDown, ChevronRight } from "lucide-react";
 import type { LucideIcon } from "lucide-react";
-import type { MouseEvent, ReactNode } from "react";
+import { useEffect, useId, useRef, type MouseEvent, type ReactNode } from "react";
 import { cn } from "@/lib/utils";
 
 // Shared building blocks for the grouped vertical navigation rails used by the
-// admin sidebar, the admin settings page, and the user settings page. Keeping
-// the markup here means active states, spacing, and section headers stay
-// consistent across all three.
+// admin sidebar and the user settings sidebar. Keeping the markup here means
+// active states, spacing, and section headers stay consistent across both.
 
 interface SideNavSectionProps {
   label: string;
@@ -44,6 +44,8 @@ interface SideNavItemProps {
   external?: boolean;
   /** Without href, the item renders as a <button>. */
   onClick?: (event: MouseEvent<HTMLElement>) => void;
+  /** Hover or focus: the reader is likely to open this, so warm what it needs. */
+  onIntent?: () => void;
 }
 
 export function SideNavItem({
@@ -54,6 +56,7 @@ export function SideNavItem({
   href,
   external,
   onClick,
+  onIntent,
 }: SideNavItemProps) {
   const className = cn(
     "relative flex w-full items-center gap-2.5 rounded-xl px-3 py-2.5 text-left text-[13px] font-medium transition-colors duration-150",
@@ -86,7 +89,14 @@ export function SideNavItem({
             {inner}
           </a>
         ) : (
-          <Link to={href} onClick={onClick} aria-current={ariaCurrent} className={className}>
+          <Link
+            to={href}
+            onClick={onClick}
+            onPointerEnter={onIntent}
+            onFocus={onIntent}
+            aria-current={ariaCurrent}
+            className={className}
+          >
             {inner}
           </Link>
         )
@@ -98,3 +108,160 @@ export function SideNavItem({
     </li>
   );
 }
+
+interface SideNavTopicProps {
+  label: string;
+  icon: LucideIcon;
+  open: boolean;
+  onToggle: () => void;
+  /** Shown on the heading while it is closed, standing in for its pages' own. */
+  badge?: ReactNode;
+  /** `SideNavSubItem`s. */
+  children: ReactNode;
+}
+
+/**
+ * A heading that opens to list a topic's pages. It never navigates: a click
+ * only opens or closes it, so reaching a page is always the page's own row.
+ */
+/** Scroll an element just far enough to show it, without motion when asked. */
+function revealInNav(element: HTMLElement | null) {
+  const reduceMotion =
+    typeof window.matchMedia === "function" &&
+    window.matchMedia("(prefers-reduced-motion: reduce)").matches;
+  // jsdom has no scrollIntoView.
+  element?.scrollIntoView?.({ block: "nearest", behavior: reduceMotion ? "auto" : "smooth" });
+}
+
+export function SideNavTopic({
+  label,
+  icon: Icon,
+  open,
+  onToggle,
+  badge,
+  children,
+}: SideNavTopicProps) {
+  const listId = useId();
+  const topicRef = useRef<HTMLLIElement>(null);
+  const wasOpen = useRef(open);
+  const Chevron = open ? ChevronDown : ChevronRight;
+
+  // A topic opened near the bottom of the sidebar would list its pages below
+  // the fold, and the click would seem to do nothing.
+  useEffect(() => {
+    if (open && !wasOpen.current) revealInNav(topicRef.current);
+    wasOpen.current = open;
+  }, [open]);
+
+  return (
+    <li ref={topicRef}>
+      <button
+        type="button"
+        aria-expanded={open}
+        aria-controls={listId}
+        onClick={onToggle}
+        className={cn(
+          "hover:text-foreground hover:bg-accent/70 flex w-full items-center gap-2.5 rounded-xl px-3 py-2.5 text-left text-[13px] font-medium transition-colors duration-150",
+          open ? "text-foreground" : "text-muted-foreground",
+        )}
+      >
+        <span className="flex w-[18px] flex-shrink-0 items-center justify-center">
+          <Icon className="h-[18px] w-[18px]" />
+        </span>
+        <span className="min-w-0 truncate">{label}</span>
+        <span className="ml-auto flex items-center gap-2">
+          {!open && badge ? badge : null}
+          <Chevron className="text-muted-foreground h-3.5 w-3.5" aria-hidden="true" />
+        </span>
+      </button>
+      {open ? (
+        <ul
+          id={listId}
+          aria-label={label}
+          className="border-border/70 mt-0.5 mb-1.5 ml-[21px] list-none space-y-px border-l pl-3"
+        >
+          {children}
+        </ul>
+      ) : null}
+    </li>
+  );
+}
+
+interface SideNavSubItemProps {
+  label: string;
+  href: string;
+  active?: boolean;
+  badge?: ReactNode;
+  /** See `SideNavItem`. */
+  external?: boolean;
+  onClick?: (event: MouseEvent<HTMLElement>) => void;
+  onIntent?: () => void;
+}
+
+/** One page under a `SideNavTopic`: no icon, indented under its heading. */
+export function SideNavSubItem({
+  label,
+  href,
+  active = false,
+  badge,
+  external,
+  onClick,
+  onIntent,
+}: SideNavSubItemProps) {
+  const className = cn(
+    "relative flex w-full items-center gap-2 rounded-lg px-2.5 py-1.5 text-left text-[12.5px] transition-colors duration-150",
+    active
+      ? "text-primary bg-accent font-medium"
+      : "text-muted-foreground hover:text-foreground hover:bg-accent/70",
+  );
+  const inner = (
+    <>
+      {active && (
+        <span
+          className="absolute top-1/2 left-[-13px] h-4 w-[2px] -translate-y-1/2 rounded-full"
+          style={{ background: "var(--primary)" }}
+        />
+      )}
+      <span className="min-w-0 truncate">{label}</span>
+      {badge && <span className="ml-auto">{badge}</span>}
+    </>
+  );
+  const ariaCurrent = active ? "page" : undefined;
+  const itemRef = useRef<HTMLLIElement>(null);
+
+  // A deep link can open on a page far down the sidebar; keep it in sight.
+  useEffect(() => {
+    if (active) revealInNav(itemRef.current);
+  }, [active]);
+
+  return (
+    <li ref={itemRef}>
+      {external ? (
+        <a href={href} onClick={onClick} aria-current={ariaCurrent} className={className}>
+          {inner}
+        </a>
+      ) : (
+        <Link
+          to={href}
+          onClick={onClick}
+          onPointerEnter={onIntent}
+          onFocus={onIntent}
+          aria-current={ariaCurrent}
+          className={className}
+        >
+          {inner}
+        </Link>
+      )}
+    </li>
+  );
+}
+
+/** A nav badge for a page holding something broken; the label is for screen readers. */
+export function SideNavAttentionDot({ label }: { label: string }) {
+  return (
+    <span className="flex items-center">
+      <span aria-hidden="true" className="block h-2 w-2 rounded-full bg-amber-400" />
+      <span className="sr-only">, {label}</span>
+    </span>
+  );
+}
diff --git a/web/src/components/UserPolicyFields.tsx b/web/src/components/UserPolicyFields.tsx
index 5238271e5c..7b153b4dc5 100644
--- a/web/src/components/UserPolicyFields.tsx
+++ b/web/src/components/UserPolicyFields.tsx
@@ -38,6 +38,7 @@ export interface UserPolicyState {
   maxTranscodes: number | null;
   maxRemoteStreamBitrateKbps: number | null;
   maxLocalStreamBitrateKbps: number | null;
+  maxProfiles: number | null;
   transcodeAllowed: boolean | null;
   audioTranscodeAllowed: boolean | null;
   downloadAllowed: boolean | null;
@@ -54,6 +55,7 @@ const POLICY_FIELDS = {
   maxTranscodes: "max_transcodes",
   maxRemoteStreamBitrateKbps: "max_remote_stream_bitrate_kbps",
   maxLocalStreamBitrateKbps: "max_local_stream_bitrate_kbps",
+  maxProfiles: "max_profiles",
   transcodeAllowed: "transcode_allowed",
   audioTranscodeAllowed: "audio_transcode_allowed",
   downloadAllowed: "download_allowed",
@@ -119,6 +121,7 @@ export function policyInheritHints(
     max_transcodes: group.max_transcodes,
     max_remote_stream_bitrate_kbps: group.max_remote_stream_bitrate_kbps,
     max_local_stream_bitrate_kbps: group.max_local_stream_bitrate_kbps,
+    max_profiles: group.max_profiles,
     transcode_allowed: group.transcode_allowed,
     audio_transcode_allowed: group.audio_transcode_allowed,
     download_allowed: group.download_allowed,
@@ -203,6 +206,19 @@ interface PolicyContext {
   disabled?: boolean;
 }
 
+// Raw text of limit fields whose box holds no valid number. A cleared or
+// half-typed box is not in UserPolicyState, which keeps the last valid value,
+// so the form keeps these drafts itself and refuses to save while any remain,
+// even when the Limits tab is not mounted and native validation cannot see the
+// box. Keeping the text, not just a flag, lets a remounted field show it again.
+export type LimitPolicyKey = "maxStreams" | "maxTranscodes" | "maxProfiles";
+
+export interface LimitValidity {
+  invalidLimitDrafts: ReadonlyMap<LimitPolicyKey, string>;
+  // `undefined` clears the entry once the box holds a valid number again.
+  onInvalidLimitDraftChange: (key: LimitPolicyKey, draft: string | undefined) => void;
+}
+
 function defaultHint(source: PolicyDefaultSource, effectiveText: string | undefined): string {
   const text = DEFAULT_SOURCE_TEXT[source];
   return effectiveText === undefined ? text.unknown : `${text.prefix}: ${effectiveText}`;
@@ -230,8 +246,8 @@ function BooleanPolicyRow({
   const id = useId();
   const selectValue = value === null ? INHERIT : value ? "allowed" : "blocked";
   return (
-    <div className="border-border flex items-center justify-between gap-3 rounded-md border px-3 py-2">
-      <div className="min-w-0">
+    <div className="border-border flex flex-wrap items-center justify-between gap-x-3 gap-y-2 rounded-md border px-3 py-2">
+      <div className="min-w-32 flex-1 break-words">
         <Label htmlFor={id}>{label}</Label>
         {description && <p className="text-muted-foreground text-xs">{description}</p>}
       </div>
@@ -240,7 +256,10 @@ function BooleanPolicyRow({
         onValueChange={(next) => onValueChange(next === INHERIT ? null : next === "allowed")}
         disabled={disabled}
       >
-        <SelectTrigger id={id} className="w-40 shrink-0">
+        <SelectTrigger
+          id={id}
+          className="max-w-full min-w-40 shrink-0 text-left whitespace-normal data-[size=default]:h-auto data-[size=default]:min-h-9 *:data-[slot=select-value]:line-clamp-none"
+        >
           <SelectValue />
         </SelectTrigger>
         <SelectContent>
@@ -258,10 +277,10 @@ function BooleanPolicyRow({
   );
 }
 
-function limitDraftValue(draft: string): number | null {
+function limitDraftValue(draft: string, min: number): number | null {
   if (draft.trim() === "") return null;
   const parsed = Number(draft);
-  if (!Number.isInteger(parsed) || parsed < 0) return null;
+  if (!Number.isInteger(parsed) || parsed < min) return null;
   return parsed;
 }
 
@@ -313,28 +332,45 @@ function LimitPolicyField({
   onValueChange,
   source,
   effectiveValue,
+  min = 0,
+  invalidDraft,
+  onInvalidDraftChange,
 }: {
   label: string;
   value: number | null;
   onValueChange: (value: number | null) => void;
   source: PolicyDefaultSource;
   effectiveValue?: number;
+  /** The lowest value; with 0 allowed it means unlimited. */
+  min?: number;
+  // The invalid text left behind when the field last unmounted, or undefined.
+  // The field reopens overridden with that text so it shows the pending edit
+  // instead of the stale saved value.
+  invalidDraft: string | undefined;
+  onInvalidDraftChange: (draft: string | undefined) => void;
 }) {
   const id = useId();
   // Override is tracked locally because "overriding, but nothing typed yet" has
   // no representation in UserPolicyState: while the box is empty the field
   // keeps inheriting rather than pinning 0, which would mean unlimited.
-  const [overridden, setOverridden] = useState(value !== null);
+  const [overridden, setOverridden] = useState(value !== null || invalidDraft !== undefined);
   // The raw string stays local so a cleared or half-typed box is an unsaved
   // edit instead of collapsing to 0 or NaN.
-  const [draft, setDraft] = useState(() => (value === null ? "" : String(value)));
-  const draftValue = limitDraftValue(draft);
+  const [draft, setDraft] = useState(() => invalidDraft ?? (value === null ? "" : String(value)));
+  const draftValue = limitDraftValue(draft, min);
+  const help =
+    draftValue === null
+      ? `Enter a whole number${min > 0 ? ` of at least ${min}` : ""}, or turn Override off to ${DEFAULT_SOURCE_TEXT[source].revert}.`
+      : min === 0
+        ? "0 = unlimited"
+        : undefined;
 
   function handleOverrideChange(checked: boolean) {
     setOverridden(checked);
     if (!checked) {
       setDraft("");
       onValueChange(null);
+      onInvalidDraftChange(undefined);
       return;
     }
     // Seed the value the field already resolves to. With no hint available the
@@ -342,11 +378,13 @@ function LimitPolicyField({
     // value, so an unknown limit is never silently saved as unlimited.
     setDraft(effectiveValue === undefined ? "" : String(effectiveValue));
     onValueChange(effectiveValue ?? null);
+    onInvalidDraftChange(effectiveValue === undefined ? "" : undefined);
   }
 
   function handleDraftChange(raw: string) {
     setDraft(raw);
-    const parsed = limitDraftValue(raw);
+    const parsed = limitDraftValue(raw, min);
+    onInvalidDraftChange(parsed === null ? raw : undefined);
     if (parsed === null) return;
     onValueChange(parsed);
   }
@@ -369,17 +407,13 @@ function LimitPolicyField({
       <Input
         id={id}
         type="number"
-        min={0}
+        min={min}
         step={1}
         required
         value={draft}
         onChange={(event) => handleDraftChange(event.target.value)}
       />
-      <p className="text-muted-foreground text-xs">
-        {draftValue === null
-          ? `Enter a whole number, or turn Override off to ${DEFAULT_SOURCE_TEXT[source].revert}.`
-          : "0 = unlimited"}
-      </p>
+      {help && <p className="text-muted-foreground text-xs">{help}</p>}
     </PolicyOverrideField>
   );
 }
@@ -495,7 +529,15 @@ export function PolicyAccessFields({
 }
 
 // Limits-tab policy fields: stream/transcode ceilings and the quality gate.
-export function PolicyLimitFields({ state, onChange, source, effective, disabled }: PolicyContext) {
+export function PolicyLimitFields({
+  state,
+  onChange,
+  source,
+  effective,
+  disabled,
+  invalidLimitDrafts,
+  onInvalidLimitDraftChange,
+}: PolicyContext & LimitValidity) {
   const qualityId = useId();
   const qualityValue: PlaybackQualityPreset | typeof INHERIT =
     state.maxPlaybackQuality === null
@@ -510,6 +552,8 @@ export function PolicyLimitFields({ state, onChange, source, effective, disabled
           onValueChange={(maxStreams) => onChange({ ...state, maxStreams })}
           source={source}
           effectiveValue={effective?.max_streams}
+          invalidDraft={invalidLimitDrafts.get("maxStreams")}
+          onInvalidDraftChange={(draft) => onInvalidLimitDraftChange("maxStreams", draft)}
         />
         <LimitPolicyField
           label="Max Transcodes"
@@ -517,6 +561,8 @@ export function PolicyLimitFields({ state, onChange, source, effective, disabled
           onValueChange={(maxTranscodes) => onChange({ ...state, maxTranscodes })}
           source={source}
           effectiveValue={effective?.max_transcodes}
+          invalidDraft={invalidLimitDrafts.get("maxTranscodes")}
+          onInvalidDraftChange={(draft) => onInvalidLimitDraftChange("maxTranscodes", draft)}
         />
         <StreamBitratePolicyField
           label="Max remote stream bitrate"
@@ -598,6 +644,16 @@ export function PolicyLimitFields({ state, onChange, source, effective, disabled
             : PLAYBACK_QUALITY_OPTIONS.find((option) => option.value === qualityValue)?.description}
         </p>
       </div>
+      <LimitPolicyField
+        label="Max Profiles"
+        min={1}
+        value={state.maxProfiles}
+        onValueChange={(maxProfiles) => onChange({ ...state, maxProfiles })}
+        source={source}
+        effectiveValue={effective?.max_profiles}
+        invalidDraft={invalidLimitDrafts.get("maxProfiles")}
+        onInvalidDraftChange={(draft) => onInvalidLimitDraftChange("maxProfiles", draft)}
+      />
     </>
   );
 }
diff --git a/web/src/components/WatchTonightCard.test.tsx b/web/src/components/WatchTonightCard.test.tsx
deleted file mode 100644
index be4b4ce962..0000000000
--- a/web/src/components/WatchTonightCard.test.tsx
+++ /dev/null
@@ -1,79 +0,0 @@
-import { renderToStaticMarkup } from "react-dom/server";
-import { MemoryRouter } from "react-router";
-import { render, screen } from "@testing-library/react";
-import { describe, expect, it, vi } from "vitest";
-import WatchTonightCard from "./WatchTonightCard";
-
-vi.mock("@/playback/watchPlaybackContext", () => ({
-  useWatchPlaybackController: () => ({ startPlayback: vi.fn() }),
-}));
-
-describe("WatchTonightCard", () => {
-  it("links ebook cards to the reader and shows percent read", () => {
-    const markup = renderToStaticMarkup(
-      <MemoryRouter>
-        <WatchTonightCard
-          item={{
-            content_id: "ebook 1",
-            type: "ebook",
-            title: "A Reader",
-            year: 2026,
-            genres: ["Fantasy"],
-            status: "matched",
-            content_rating: "",
-            rating_imdb: null,
-            overview: "Ebook overview",
-            watch_tonight_source: "continue_watching",
-            position_seconds: 0.57,
-            duration_seconds: 1,
-            progress_updated_at: "2026-06-07T00:00:00Z",
-            poster_url: "/ebook-cover.jpg",
-            poster_thumbhash: "",
-            backdrop_url: "",
-            backdrop_thumbhash: "",
-            logo_url: "",
-          }}
-          onPlay={() => {}}
-        />
-      </MemoryRouter>,
-    );
-
-    expect(markup).toContain('href="/item/ebook%201"');
-    expect(markup).toContain('href="/reader/ebook/ebook%201"');
-    expect(markup).toContain("57% read");
-    expect(markup).not.toContain('href="/watch/ebook');
-    expect(markup).not.toContain("0 min left");
-  });
-
-  it("uses listen copy for audiobook play links", () => {
-    render(
-      <MemoryRouter>
-        <WatchTonightCard
-          onPlay={() => {}}
-          item={{
-            content_id: "book-1",
-            type: "audiobook",
-            title: "Book One",
-            year: 2026,
-            genres: [],
-            status: "matched",
-            content_rating: "",
-            rating_imdb: null,
-            overview: "",
-            poster_url: "",
-            poster_thumbhash: "",
-            backdrop_url: "",
-            backdrop_thumbhash: "",
-            logo_url: "",
-            watch_tonight_source: "recommendation",
-          }}
-        />
-      </MemoryRouter>,
-    );
-
-    expect(screen.getByRole("link", { name: "Listen Book One" })).toHaveAttribute(
-      "href",
-      "/item/book-1?play=1",
-    );
-  });
-});
diff --git a/web/src/components/WatchTonightCard.tsx b/web/src/components/WatchTonightCard.tsx
deleted file mode 100644
index 89bbf94262..0000000000
--- a/web/src/components/WatchTonightCard.tsx
+++ /dev/null
@@ -1,167 +0,0 @@
-import { BookOpen, Play } from "lucide-react";
-import { useCallback } from "react";
-import { useLocation } from "react-router";
-import type { WatchTonightItem } from "@/hooks/queries/recommendations";
-import ViewTransitionLink from "@/components/ViewTransitionLink";
-import { Badge } from "@/components/ui/badge";
-import { useWatchPlaybackController } from "@/playback/watchPlaybackContext";
-import { parseWatchHref } from "@/pages/watchRouteHelpers";
-import { buildItemHref, buildMediaPlayHref, isVideoWatchHref } from "@/lib/mediaNavigation";
-
-const sourceLabels: Record<string, string> = {
-  continue_watching: "Continue",
-  next_up: "Next Up",
-  recommendation: "For You",
-};
-
-interface WatchTonightCardProps {
-  item: WatchTonightItem;
-  onPlay: () => void;
-}
-
-export default function WatchTonightCard({ item, onPlay }: WatchTonightCardProps) {
-  const location = useLocation();
-  const playbackController = useWatchPlaybackController();
-
-  const watchHref = buildMediaPlayHref({
-    contentId: item.content_id,
-    type: item.type,
-  });
-  const itemHref = buildItemHref({ contentId: item.content_id });
-  const source = item.watch_tonight_source ?? "";
-  const isInProgress = source === "continue_watching";
-  const isNextUp = source === "next_up";
-  const hasEpisodeMeta = item.season_number != null && item.episode_number != null;
-  const heading = hasEpisodeMeta && item.series_title ? item.series_title : item.title;
-  const progressPercent =
-    isInProgress && (item.duration_seconds ?? 0) > 0
-      ? ((item.position_seconds ?? 0) / (item.duration_seconds ?? 1)) * 100
-      : 0;
-
-  const episodeMeta = hasEpisodeMeta
-    ? `S${item.season_number} E${item.episode_number}${item.title && item.series_title ? ` \u2022 ${item.title}` : ""}`
-    : null;
-
-  const subtitle = isNextUp
-    ? "Next Episode"
-    : isInProgress && item.type === "ebook"
-      ? `${Math.round(Math.min(Math.max(progressPercent, 0), 100))}% read`
-      : isInProgress && (item.duration_seconds ?? 0) > 0
-        ? `${Math.max(0, Math.round(((item.duration_seconds ?? 0) - (item.position_seconds ?? 0)) / 60))} min left`
-        : item.genres?.slice(0, 2).join(", ") || "\u00A0";
-  const playVerb = item.type === "ebook" ? "Read" : item.type === "audiobook" ? "Listen" : "Play";
-
-  const handlePlayClick = useCallback(
-    (event: React.MouseEvent<HTMLAnchorElement>) => {
-      if (
-        event.defaultPrevented ||
-        event.button !== 0 ||
-        event.metaKey ||
-        event.altKey ||
-        event.ctrlKey ||
-        event.shiftKey
-      ) {
-        return;
-      }
-
-      if (!isVideoWatchHref(watchHref)) {
-        return;
-      }
-
-      const parsed = parseWatchHref(watchHref);
-      if (!parsed) return;
-
-      event.preventDefault();
-      onPlay();
-      playbackController.startPlayback(
-        {
-          contentId: parsed.contentId,
-          fileId: parsed.fileId,
-          libraryId: parsed.libraryId,
-          restart: parsed.restart,
-          returnHref: `${location.pathname}${location.search}`,
-        },
-        "viewer",
-      );
-    },
-    [watchHref, location.pathname, location.search, playbackController, onPlay],
-  );
-
-  const badgeLabel = sourceLabels[source];
-
-  return (
-    <div className="group/card flex gap-5 rounded-xl p-3 transition-colors hover:bg-white/5">
-      {/* Thumbnail */}
-      <ViewTransitionLink
-        to={watchHref}
-        onClick={handlePlayClick}
-        aria-label={`${playVerb} ${heading}`}
-        className="group/play relative w-44 shrink-0"
-      >
-        <div className="relative aspect-video overflow-hidden rounded-lg">
-          {item.backdrop_url ? (
-            <img
-              src={item.backdrop_url}
-              alt={heading}
-              className="h-full w-full object-cover"
-              loading="lazy"
-            />
-          ) : item.poster_url ? (
-            <img
-              src={item.poster_url}
-              alt={heading}
-              className="h-full w-full object-cover"
-              loading="lazy"
-            />
-          ) : (
-            <div className="text-muted-foreground bg-surface flex h-full w-full items-center justify-center text-xs">
-              No Image
-            </div>
-          )}
-
-          {/* Play overlay */}
-          <div className="absolute inset-0 flex items-center justify-center bg-black/0 transition-colors group-hover/card:bg-black/30 group-focus-visible/play:bg-black/30">
-            <div className="bg-primary text-primary-foreground flex h-10 w-10 items-center justify-center rounded-full opacity-0 shadow-lg transition-opacity group-hover/card:opacity-100 group-focus-visible/play:opacity-100">
-              {item.type === "ebook" ? (
-                <BookOpen className="h-4 w-4" />
-              ) : (
-                <Play className="ml-0.5 h-4 w-4" fill="currentColor" />
-              )}
-            </div>
-          </div>
-
-          {/* Progress bar */}
-          {isInProgress && progressPercent > 0 && (
-            <div className="absolute inset-x-2.5 bottom-2 h-[3px] overflow-hidden rounded-full bg-black/40">
-              <div
-                className="h-full rounded-full transition-all duration-300"
-                style={{
-                  width: `${Math.min(progressPercent, 100)}%`,
-                  background: "var(--primary)",
-                }}
-              />
-            </div>
-          )}
-        </div>
-      </ViewTransitionLink>
-
-      {/* Info */}
-      <div className="flex min-w-0 flex-1 flex-col justify-center gap-1">
-        <div className="flex items-center gap-2">
-          {badgeLabel && (
-            <Badge variant="secondary" className="shrink-0 text-[10px]">
-              {badgeLabel}
-            </Badge>
-          )}
-        </div>
-        <ViewTransitionLink to={itemHref} className="min-w-0">
-          <div className="truncate text-[15px] leading-tight font-semibold">{heading}</div>
-        </ViewTransitionLink>
-        {episodeMeta && (
-          <div className="text-muted-foreground truncate text-[13px]">{episodeMeta}</div>
-        )}
-        <div className="text-muted-foreground text-[13px]">{subtitle}</div>
-      </div>
-    </div>
-  );
-}
diff --git a/web/src/components/WatchTonightDialog.test.tsx b/web/src/components/WatchTonightDialog.test.tsx
deleted file mode 100644
index b79df11673..0000000000
--- a/web/src/components/WatchTonightDialog.test.tsx
+++ /dev/null
@@ -1,60 +0,0 @@
-// @vitest-environment jsdom
-import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
-import { fireEvent, render, screen, waitFor } from "@testing-library/react";
-import { afterEach, expect, it, vi } from "vitest";
-import { setProfileId } from "@/api/client";
-import { installPolicyStorageMocks, jsonResponse } from "@/pages/admin-policy/policyTestUtils";
-import fixture from "../../../contracts/api/v2/fixtures/list_watch_tonight_cards_ok.json";
-import WatchTonightDialog from "./WatchTonightDialog";
-
-vi.mock("./watchtonight/CardStack", () => ({
-  default: ({
-    cards,
-    onNeedMore,
-    onReset,
-  }: {
-    cards: unknown[];
-    onNeedMore: () => void;
-    onReset: () => void;
-  }) => (
-    <div>
-      <span>Cards: {cards.length}</span>
-      <button onClick={onNeedMore}>More</button>
-      <button onClick={onReset}>Start Over</button>
-    </div>
-  ),
-}));
-afterEach(() => vi.unstubAllGlobals());
-it("starts over with empty exclusions instead of reusing a finished swipe session", async () => {
-  installPolicyStorageMocks();
-  setProfileId("p-owner");
-  const exclusions: string[][] = [];
-  vi.stubGlobal(
-    "fetch",
-    vi.fn(async (input: RequestInfo | URL) => {
-      const ids = new URL(String(input), "http://localhost").searchParams.getAll("exclude_ids");
-      exclusions.push(ids);
-      return jsonResponse({
-        ...fixture,
-        items: [{ ...fixture.items[0], content_id: `movie:${ids.length}` }],
-        has_more: true,
-        paging_limited: ids.length > 0,
-      });
-    }),
-  );
-  const client = new QueryClient({ defaultOptions: { queries: { retry: false } } });
-  render(
-    <QueryClientProvider client={client}>
-      <WatchTonightDialog open onOpenChange={vi.fn()} />
-    </QueryClientProvider>,
-  );
-  fireEvent.click(screen.getByRole("button", { name: /Pick Up Where I Left Off/ }));
-  await screen.findByText("Cards: 1");
-  fireEvent.click(screen.getByRole("button", { name: "More" }));
-  await screen.findByText("Cards: 2");
-  fireEvent.click(screen.getByRole("button", { name: "Start Over" }));
-  fireEvent.click(screen.getByRole("button", { name: /Pick Up Where I Left Off/ }));
-  await waitFor(() => expect(exclusions).toHaveLength(3));
-  expect(exclusions).toEqual([[], ["movie:0"], []]);
-  await screen.findByText("Cards: 1");
-});
diff --git a/web/src/components/WatchTonightDialog.tsx b/web/src/components/WatchTonightDialog.tsx
deleted file mode 100644
index d012656ec2..0000000000
--- a/web/src/components/WatchTonightDialog.tsx
+++ /dev/null
@@ -1,181 +0,0 @@
-import { useQueryClient } from "@tanstack/react-query";
-import { recKeys } from "@/hooks/queries/keys";
-import { useCallback, useEffect, useMemo, useState } from "react";
-import { ArrowRight, History, Sparkles } from "lucide-react";
-import {
-  Dialog,
-  DialogContent,
-  DialogDescription,
-  DialogHeader,
-  DialogTitle,
-} from "@/components/ui/dialog";
-import { Button } from "@/components/ui/button";
-import { type SwipeMode, useSwipeCards } from "@/hooks/queries/recommendations";
-import GenrePicker from "./watchtonight/GenrePicker";
-import CardStack from "./watchtonight/CardStack";
-
-type Step = "mode-select" | "genre-picker" | "swipe-deck";
-
-interface WatchTonightDialogProps {
-  open: boolean;
-  onOpenChange: (open: boolean) => void;
-}
-
-export default function WatchTonightDialog({ open, onOpenChange }: WatchTonightDialogProps) {
-  const queryClient = useQueryClient();
-  const [step, setStep] = useState<Step>("mode-select");
-  const [mode, setMode] = useState<SwipeMode>("discover");
-  const [genres, setGenres] = useState<string[]>([]);
-
-  // Reset state when dialog closes.
-  useEffect(() => {
-    if (!open) {
-      // Small delay to let close animation finish before resetting.
-      const t = setTimeout(() => {
-        setStep("mode-select");
-        setMode("discover");
-        setGenres([]);
-      }, 200);
-      return () => clearTimeout(t);
-    }
-  }, [open]);
-
-  const swipeEnabled = open && step === "swipe-deck";
-  const { data, fetchNextPage, hasNextPage, isFetching, isFetchingNextPage } = useSwipeCards(
-    swipeEnabled,
-    mode,
-    genres,
-  );
-
-  const cards = useMemo(() => data?.pages.flatMap((p) => p.cards) ?? [], [data]);
-
-  const hasMore = hasNextPage ?? false;
-
-  const handleModeSelect = useCallback((selectedMode: SwipeMode) => {
-    setMode(selectedMode);
-    if (selectedMode === "continue") {
-      setStep("swipe-deck");
-    } else {
-      setStep("genre-picker");
-    }
-  }, []);
-
-  const handleGenresConfirm = useCallback(() => {
-    setStep("swipe-deck");
-  }, []);
-
-  const handleNeedMore = useCallback(() => {
-    if (hasNextPage && !isFetchingNextPage) {
-      void fetchNextPage();
-    }
-  }, [fetchNextPage, hasNextPage, isFetchingNextPage]);
-
-  const handleClose = useCallback(() => {
-    onOpenChange(false);
-  }, [onOpenChange]);
-
-  const handleReset = useCallback(() => {
-    queryClient.removeQueries({ queryKey: recKeys.watchTonightCards(mode, genres), exact: true });
-    setStep("mode-select");
-    setGenres([]);
-  }, [queryClient, mode, genres]);
-
-  // Dynamic dialog sizing based on step.
-  const dialogClass =
-    step === "swipe-deck"
-      ? "gap-0 overflow-hidden p-0 sm:max-w-md"
-      : "gap-0 overflow-hidden p-0 sm:max-w-lg";
-
-  return (
-    <Dialog open={open} onOpenChange={onOpenChange}>
-      <DialogContent className={dialogClass}>
-        <DialogHeader className="px-6 pt-6 pb-4">
-          <DialogTitle className="flex items-center gap-2">
-            <Sparkles className="text-primary h-5 w-5" />
-            Watch Tonight
-          </DialogTitle>
-          <DialogDescription>
-            {step === "mode-select" && "What are you in the mood for?"}
-            {step === "genre-picker" && "Pick some genres to narrow things down"}
-            {step === "swipe-deck" &&
-              (mode === "continue"
-                ? "Swipe through your in-progress titles"
-                : "Swipe right to play, left to skip")}
-          </DialogDescription>
-        </DialogHeader>
-
-        <div className="px-6 pb-6">
-          {/* Step 1: Mode Selection */}
-          {step === "mode-select" && (
-            <div className="grid gap-3 sm:grid-cols-2">
-              <button
-                type="button"
-                onClick={() => handleModeSelect("continue")}
-                className="border-border hover:border-primary/50 hover:bg-primary/5 group flex flex-col items-center gap-3 rounded-xl border-2 p-6 text-center transition-all"
-              >
-                <div className="bg-primary/10 text-primary flex h-12 w-12 items-center justify-center rounded-full">
-                  <History className="h-6 w-6" />
-                </div>
-                <div>
-                  <p className="font-semibold">Pick Up Where I Left Off</p>
-                  <p className="text-muted-foreground mt-1 text-xs">
-                    Continue in-progress titles or start what is next
-                  </p>
-                </div>
-              </button>
-
-              <button
-                type="button"
-                onClick={() => handleModeSelect("discover")}
-                className="border-border hover:border-primary/50 hover:bg-primary/5 group flex flex-col items-center gap-3 rounded-xl border-2 p-6 text-center transition-all"
-              >
-                <div className="bg-primary/10 text-primary flex h-12 w-12 items-center justify-center rounded-full">
-                  <Sparkles className="h-6 w-6" />
-                </div>
-                <div>
-                  <p className="font-semibold">Find Something New</p>
-                  <p className="text-muted-foreground mt-1 text-xs">
-                    Discover personalized recommendations
-                  </p>
-                </div>
-              </button>
-            </div>
-          )}
-
-          {/* Step 2: Genre Picker */}
-          {step === "genre-picker" && (
-            <div className="space-y-5">
-              <GenrePicker selected={genres} onChange={setGenres} />
-              <div className="flex items-center justify-between">
-                <button
-                  type="button"
-                  onClick={() => setStep("mode-select")}
-                  className="text-muted-foreground text-sm hover:underline"
-                >
-                  Back
-                </button>
-                <Button onClick={handleGenresConfirm} size="sm" className="gap-1.5">
-                  {genres.length === 0 ? "All Genres" : `Go (${genres.length})`}
-                  <ArrowRight className="h-4 w-4" />
-                </Button>
-              </div>
-            </div>
-          )}
-
-          {/* Step 3: Swipe Deck */}
-          {step === "swipe-deck" && (
-            <CardStack
-              cards={cards}
-              hasMore={hasMore}
-              pagingLimited={data?.pages[data.pages.length - 1]?.paging_limited}
-              isFetching={isFetching || isFetchingNextPage}
-              onNeedMore={handleNeedMore}
-              onClose={handleClose}
-              onReset={handleReset}
-            />
-          )}
-        </div>
-      </DialogContent>
-    </Dialog>
-  );
-}
diff --git a/web/src/components/admin/BrandingAssetField.tsx b/web/src/components/admin/BrandingAssetField.tsx
index a2d6ea303c..9f6369add9 100644
--- a/web/src/components/admin/BrandingAssetField.tsx
+++ b/web/src/components/admin/BrandingAssetField.tsx
@@ -75,18 +75,14 @@ export function BrandingAssetField({
           )}
         </div>
         {showingDefault && (
-          <span className="text-muted-foreground text-[10px] leading-none">
-            {spec.emptyCaption}
-          </span>
+          <span className="text-muted-foreground text-xs leading-none">{spec.emptyCaption}</span>
         )}
       </div>
 
       <div className="min-w-0 flex-1">
         <p className="text-sm font-medium">{label}</p>
         {description && <p className="text-muted-foreground mt-0.5 text-xs">{description}</p>}
-        <p className="text-muted-foreground/80 mt-0.5 text-[11px] leading-relaxed">
-          {spec.guidance}
-        </p>
+        <p className="text-muted-foreground mt-0.5 text-xs leading-relaxed">{spec.guidance}</p>
       </div>
 
       <input
diff --git a/web/src/components/admin/SettingsAttention.tsx b/web/src/components/admin/SettingsAttention.tsx
new file mode 100644
index 0000000000..c9c07d80c1
--- /dev/null
+++ b/web/src/components/admin/SettingsAttention.tsx
@@ -0,0 +1,56 @@
+import { ArrowRight, TriangleAlert } from "lucide-react";
+import { Link } from "react-router";
+
+import type { SettingsHealthItem } from "@/hooks/admin/useSettingsHealth";
+import { adminSettingsHref } from "@/lib/adminSettingsSearch";
+import { cn } from "@/lib/utils";
+
+/**
+ * The server setup the admin still owes: storage nobody configured, a restart
+ * a saved setting is waiting on, mail that cannot send. Each item links to the
+ * settings page that fixes it. Renders nothing while everything is in order.
+ */
+export function SettingsAttention({
+  items,
+  className,
+}: {
+  items: readonly SettingsHealthItem[];
+  className?: string;
+}) {
+  if (items.length === 0) return null;
+
+  return (
+    <section
+      aria-label="Needs attention"
+      className={cn("border-warning/30 bg-warning/8 rounded-2xl border p-4", className)}
+    >
+      <p className="text-warning flex items-center gap-2 text-sm font-semibold">
+        <TriangleAlert className="h-4 w-4" aria-hidden="true" />
+        Needs attention
+      </p>
+      <ul className="mt-3 grid list-none gap-2 sm:grid-cols-2 xl:grid-cols-3">
+        {items.map((item) =>
+          item.action ? (
+            <li key={item.id}>
+              <Link
+                to={adminSettingsHref(item.action.page)}
+                className="hover:bg-warning/10 focus-visible:ring-ring/60 border-warning/20 flex h-full items-start gap-3 rounded-xl border px-3 py-2.5 transition-colors focus-visible:ring-[3px] focus-visible:outline-none"
+              >
+                <span className="min-w-0 flex-1 text-sm leading-snug">
+                  <span className="text-foreground block font-medium">
+                    {item.label} · {item.stateText}
+                  </span>
+                  <span className="text-muted-foreground block text-xs">{item.detail}</span>
+                </span>
+                <span className="text-foreground/80 inline-flex shrink-0 items-center gap-1 text-xs font-medium">
+                  {item.action.label}
+                  <ArrowRight className="h-3 w-3" aria-hidden="true" />
+                </span>
+              </Link>
+            </li>
+          ) : null,
+        )}
+      </ul>
+    </section>
+  );
+}
diff --git a/web/src/components/admin/dashboard/format.test.ts b/web/src/components/admin/dashboard/format.test.ts
new file mode 100644
index 0000000000..0bc976831f
--- /dev/null
+++ b/web/src/components/admin/dashboard/format.test.ts
@@ -0,0 +1,40 @@
+import { describe, expect, it } from "vitest";
+
+import { formatDataTotal } from "./format";
+
+describe("formatDataTotal", () => {
+  it("reads missing or invalid totals as unknown", () => {
+    expect(formatDataTotal(undefined)).toBe("—");
+    expect(formatDataTotal(null)).toBe("—");
+    expect(formatDataTotal(Number.NaN)).toBe("—");
+    expect(formatDataTotal(-1)).toBe("—");
+  });
+
+  it("keeps whole bytes for tiny totals", () => {
+    expect(formatDataTotal(0)).toBe("0 B");
+    expect(formatDataTotal(999)).toBe("999 B");
+  });
+
+  it("uses decimal units with one decimal below 100", () => {
+    expect(formatDataTotal(1_500)).toBe("1.5 KB");
+    expect(formatDataTotal(42_300_000_000)).toBe("42.3 GB");
+    expect(formatDataTotal(1_400_000_000_000)).toBe("1.4 TB");
+  });
+
+  it("drops the decimal once the number is large", () => {
+    expect(formatDataTotal(512_000_000_000)).toBe("512 GB");
+  });
+
+  it("chooses unit and precision after rounding", () => {
+    // Rounds up across a unit boundary: never "1,000 KB" or "1,000 B".
+    expect(formatDataTotal(999_950)).toBe("1.0 MB");
+    expect(formatDataTotal(999_999_999_999)).toBe("1.0 TB");
+    // Rounds up to 100: the decimal goes, never "100.0 GB".
+    expect(formatDataTotal(99_960_000_000)).toBe("100 GB");
+    expect(formatDataTotal(99_940_000_000)).toBe("99.9 GB");
+  });
+
+  it("stays in petabytes rather than running off the unit list", () => {
+    expect(formatDataTotal(5_000_000_000_000_000_000)).toBe("5,000 PB");
+  });
+});
diff --git a/web/src/components/admin/dashboard/format.ts b/web/src/components/admin/dashboard/format.ts
index d42318c37e..73e390e83b 100644
--- a/web/src/components/admin/dashboard/format.ts
+++ b/web/src/components/admin/dashboard/format.ts
@@ -45,6 +45,39 @@ export function formatMbps(mbps: number) {
   return `${formatMbpsValue(mbps)} Mbps`;
 }
 
+const DATA_TOTAL_UNITS = ["B", "KB", "MB", "GB", "TB", "PB"] as const;
+
+/**
+ * Data transferred over a window. Decimal (1000-based) units, matching the
+ * Mbps rates beside it, with one decimal below 100 so a quiet window does not
+ * round to a misleading whole number.
+ *
+ * Unit and precision are chosen on the value as it will be displayed, so
+ * rounding never produces "1,000 KB" (it reads "1.0 MB") or "100.0 GB" (it
+ * reads "100 GB").
+ */
+export function formatDataTotal(bytes: number | null | undefined) {
+  if (bytes == null || !Number.isFinite(bytes) || bytes < 0) {
+    return "—";
+  }
+  let value = bytes;
+  let unit = 0;
+  for (;;) {
+    const decimals = unit > 0 && value < 100 ? 1 : 0;
+    const rounded = Number(value.toFixed(decimals));
+    if (rounded >= 1000 && unit < DATA_TOTAL_UNITS.length - 1) {
+      value /= 1000;
+      unit += 1;
+      continue;
+    }
+    const shown = unit > 0 && rounded < 100 ? 1 : 0;
+    return `${rounded.toLocaleString(undefined, {
+      minimumFractionDigits: shown,
+      maximumFractionDigits: shown,
+    })} ${DATA_TOTAL_UNITS[unit]}`;
+  }
+}
+
 export function formatDashboardLibraryScanProgress(scan: ScanRun, activeScanCount: number) {
   const status = scan.status === "running" ? "Scanning" : "Queued";
   const progress = formatActiveScanProgress(scan);
diff --git a/web/src/components/admin/dashboard/registry.tsx b/web/src/components/admin/dashboard/registry.tsx
index 3b52e75342..045e19ee08 100644
--- a/web/src/components/admin/dashboard/registry.tsx
+++ b/web/src/components/admin/dashboard/registry.tsx
@@ -270,9 +270,9 @@ export const DASHBOARD_WIDGETS: DashboardWidgetDefinition[] = [
     minSpan: 6,
     maxSpan: 12,
     defaultSpan: 12,
-    // One compact row per provider. It starts at the single row it occupied as
-    // a Trakt-only strip and grows to three for a deployment running several
-    // providers; past that the list scrolls like the other list widgets.
+    // One compact row per provider. It starts at a single row and grows to
+    // three for a deployment running several providers; past that the list
+    // scrolls like the other list widgets.
     minRows: 1,
     maxRows: 3,
     defaultRows: 1,
@@ -409,8 +409,7 @@ export function getDashboardWidget(id: WidgetId): DashboardWidgetDefinition {
  * both the old and the new id collapses to one entry.
  */
 const LEGACY_WIDGET_IDS: Record<string, WidgetId> = {
-  // Became the pluggable per-provider widget; the payload it reads is no
-  // longer Trakt-specific.
+  // The old single-provider sync widget, replaced by the per-provider one.
   "trakt-sync": "watch-providers",
 };
 
diff --git a/web/src/components/admin/dashboard/widgets/EgressWidget.test.tsx b/web/src/components/admin/dashboard/widgets/EgressWidget.test.tsx
new file mode 100644
index 0000000000..fc52e716a8
--- /dev/null
+++ b/web/src/components/admin/dashboard/widgets/EgressWidget.test.tsx
@@ -0,0 +1,94 @@
+import { render, screen } from "@testing-library/react";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import type { AdminTimeseries } from "@/api/types";
+
+const mocks = vi.hoisted(() => ({
+  useAdminTimeseries: vi.fn(),
+}));
+
+vi.mock("@/hooks/queries/admin/dashboardInsights", () => ({
+  useAdminTimeseries: mocks.useAdminTimeseries,
+}));
+
+import { EgressWidget } from "./EgressWidget";
+
+const HOUR_MS = 3_600_000;
+
+function series(overrides: Partial<AdminTimeseries> = {}): AdminTimeseries {
+  const to = Date.now();
+  const from = to - 24 * HOUR_MS;
+  return {
+    resolution_seconds: 300,
+    from: new Date(from).toISOString(),
+    to: new Date(to).toISOString(),
+    oldest_sample_at: new Date(from - 7 * 24 * HOUR_MS).toISOString(),
+    points: [
+      {
+        t: new Date(to - HOUR_MS).toISOString(),
+        streams: 1,
+        direct: 1,
+        remux: 0,
+        transcode: 0,
+        egress_kbps: 56_000,
+      },
+    ],
+    ...overrides,
+  };
+}
+
+describe("EgressWidget", () => {
+  beforeEach(() => {
+    mocks.useAdminTimeseries.mockReset();
+  });
+
+  it("shows the server's transfer total beside the peak", () => {
+    mocks.useAdminTimeseries.mockReturnValue({ data: series({ egress_bytes: 1_400_000_000_000 }) });
+
+    render(<EgressWidget />);
+
+    expect(screen.getByText("Total 1.4 TB")).toBeTruthy();
+    expect(screen.getByText("Peak 56 Mbps")).toBeTruthy();
+  });
+
+  // jsdom does not evaluate container queries, so this pins the contract
+  // instead: hidden by default, shown only once the card header is wide
+  // enough, and never truncated or carrying hover-only details.
+  it("drops the total, rather than truncating it, in a narrow header", () => {
+    mocks.useAdminTimeseries.mockReturnValue({ data: series({ egress_bytes: 1_400_000_000_000 }) });
+
+    render(<EgressWidget />);
+
+    const total = screen.getByText("Total 1.4 TB");
+    expect(total.classList).toContain("hidden");
+    expect(total.classList).toContain("@md/card-header:inline");
+    expect(total.classList).toContain("whitespace-nowrap");
+    expect(total.classList).not.toContain("truncate");
+    expect(total.getAttribute("title")).toBeNull();
+    expect(total.closest('[data-slot="card-header"]')?.className).toContain(
+      "@container/card-header",
+    );
+    // With the total gone, Peak must still be free to wrap; holding it on one
+    // line pushes the range picker out of a minimum-span card.
+    const peak = screen.getByText("Peak 56 Mbps");
+    expect(peak.classList).not.toContain("whitespace-nowrap");
+    expect(peak.classList).not.toContain("shrink-0");
+  });
+
+  it("shows a zero total, which is a real answer", () => {
+    mocks.useAdminTimeseries.mockReturnValue({ data: series({ egress_bytes: 0 }) });
+
+    render(<EgressWidget />);
+
+    expect(screen.getByText("Total 0 B")).toBeTruthy();
+  });
+
+  it("hides the total when the server does not send one", () => {
+    mocks.useAdminTimeseries.mockReturnValue({ data: series() });
+
+    render(<EgressWidget />);
+
+    expect(screen.queryByText(/^Total /)).toBeNull();
+    expect(screen.getByText("Peak 56 Mbps")).toBeTruthy();
+  });
+});
diff --git a/web/src/components/admin/dashboard/widgets/EgressWidget.tsx b/web/src/components/admin/dashboard/widgets/EgressWidget.tsx
index f1cfcf8040..9b63ca2a25 100644
--- a/web/src/components/admin/dashboard/widgets/EgressWidget.tsx
+++ b/web/src/components/admin/dashboard/widgets/EgressWidget.tsx
@@ -2,7 +2,7 @@ import { useMemo } from "react";
 
 import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import { useAdminTimeseries } from "@/hooks/queries/admin/dashboardInsights";
-import { formatMbps, formatMbpsValue } from "../format";
+import { formatDataTotal, formatMbps, formatMbpsValue } from "../format";
 import {
   formatRangeTimestamp,
   rangeEdgeLabels,
@@ -51,12 +51,23 @@ export function EgressWidget() {
   );
 
   const peak = points.reduce((max, point) => Math.max(max, point.value ?? 0), 0);
+  // Integrated server-side from every sampled minute; summing `points` here
+  // would be wrong, since wide windows carry each bucket's peak minute.
+  const totalBytes = query.data?.egress_bytes;
 
   return (
     <Card className="h-full">
       <CardHeader className="flex shrink-0 flex-row items-center justify-between gap-2 space-y-0 pb-3">
         <CardTitle className="text-sm font-bold">{rangeTitle("Egress", range)}</CardTitle>
         <div className="flex min-w-0 items-center gap-2">
+          {totalBytes != null ? (
+            // Secondary to the peak: when the header is too narrow for both
+            // beside the range picker, the total is dropped rather than
+            // truncated. CardHeader is the `card-header` container.
+            <span className="text-muted-foreground hidden text-[11px] whitespace-nowrap tabular-nums @md/card-header:inline">
+              Total {formatDataTotal(totalBytes)}
+            </span>
+          ) : null}
           <span className="text-muted-foreground text-[11px] tabular-nums">
             Peak {formatMbps(peak)}
           </span>
diff --git a/web/src/components/admin/dashboard/widgets/WatchProvidersWidget.tsx b/web/src/components/admin/dashboard/widgets/WatchProvidersWidget.tsx
index 59e81befee..1cdb129e41 100644
--- a/web/src/components/admin/dashboard/widgets/WatchProvidersWidget.tsx
+++ b/web/src/components/admin/dashboard/widgets/WatchProvidersWidget.tsx
@@ -12,9 +12,8 @@ import { SectionError } from "../feedback";
  * The watch-provider subsystem is pluggable, so this reads the server's
  * per-provider breakdown rather than any one provider's fields: built-in
  * providers and ones a plugin registers at runtime are the same kind of row.
- * The widget keeps the one-line-per-provider strip shape it had as a
- * Trakt-only tile — it sits in a 1-row slot by default and scrolls once there
- * are more providers than fit.
+ * One line per provider: it sits in a 1-row slot by default and scrolls once
+ * there are more providers than fit.
  */
 export function WatchProvidersWidget() {
   const statsQuery = useAdminStats();
diff --git a/web/src/components/admin/deviceOverrides.platforms.test.tsx b/web/src/components/admin/deviceOverrides.platforms.test.tsx
index a37261922d..61a2945bcc 100644
--- a/web/src/components/admin/deviceOverrides.platforms.test.tsx
+++ b/web/src/components/admin/deviceOverrides.platforms.test.tsx
@@ -19,11 +19,7 @@ if (typeof globalThis.ResizeObserver === "undefined") {
     ResizeObserverStub;
 }
 
-const NATIVE_ONLY_PLAYER_KEYS = [
-  "player.playback_speed",
-  "player.subtitle_sync_ms",
-  "player.hdr_enabled",
-];
+const NATIVE_ONLY_PLAYER_KEYS = ["player.playback_speed", "player.hdr_enabled"];
 
 function renderAllSettings(devicePlatform: string, settings: AdminDeviceSetting[] = []) {
   render(
@@ -84,6 +80,8 @@ describe("DeviceProfileTabs platform filtering", () => {
       expect(web).not.toContain(key);
       expect(tv).toContain(key);
     }
+    // The web player applies the subtitle offset from manifest revision 19.
+    expect(web).toContain("player.subtitle_sync_ms");
     expect(deviceSettingKeysForPlatform("Windows Web", ["player.playback_speed"])).toHaveLength(
       web.length + 1,
     );
diff --git a/web/src/components/admin/deviceOverrides.tsx b/web/src/components/admin/deviceOverrides.tsx
index 27cd59e921..1f8f4050c3 100644
--- a/web/src/components/admin/deviceOverrides.tsx
+++ b/web/src/components/admin/deviceOverrides.tsx
@@ -645,7 +645,7 @@ export function DeviceProfileTabs({
       <div
         role="tablist"
         aria-label="Profiles on this device"
-        className="border-border/60 flex shrink-0 scrollbar-thin gap-0.5 overflow-x-auto border-b px-2 pt-2"
+        className="border-border/60 scrollbar-thin flex shrink-0 gap-0.5 overflow-x-auto border-b px-2 pt-2"
       >
         {profiles.map((profile) => {
           const isActive = profile.profileId === active.profileId;
diff --git a/web/src/components/admin/libraries/LibraryFormSections.tsx b/web/src/components/admin/libraries/LibraryFormSections.tsx
index 5ac48ecc22..2ba9077bf8 100644
--- a/web/src/components/admin/libraries/LibraryFormSections.tsx
+++ b/web/src/components/admin/libraries/LibraryFormSections.tsx
@@ -39,6 +39,7 @@ import {
 } from "./realtimeMonitoring";
 import { contentLevelLabel } from "./useLibraryForm";
 import type { LevelChainItem, LibraryFormController } from "./useLibraryForm";
+import { LibraryTranslatePanel } from "./LibraryTranslatePanel";
 
 function SettingCard({
   htmlFor,
@@ -370,6 +371,7 @@ export function MetadataFields({ form }: { form: LibraryFormController }) {
           onCheckedChange={form.setAutoTranslateMetadata}
         />
       </div>
+      {form.library && <LibraryTranslatePanel libraryId={form.library.id} />}
       {form.settingSupport.trailers && (
         <div className="space-y-1.5">
           <Label>Trailer &amp; extras types</Label>
@@ -486,7 +488,8 @@ export function AdvancedFields({
           footer={
             !chapterThumbnailsSupported ? (
               <p className="text-warning text-xs">
-                Artwork storage is not configured, so there is nowhere to put the generated images.
+                Artwork storage must be available before this can be enabled. Check it in Storage
+                &amp; Database settings.
               </p>
             ) : null
           }
diff --git a/web/src/components/admin/libraries/LibraryTranslatePanel.test.tsx b/web/src/components/admin/libraries/LibraryTranslatePanel.test.tsx
new file mode 100644
index 0000000000..e146af5e35
--- /dev/null
+++ b/web/src/components/admin/libraries/LibraryTranslatePanel.test.tsx
@@ -0,0 +1,237 @@
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import type { ReactNode } from "react";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  v2: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+  status: { enabled: true, on_view: "off" },
+}));
+
+vi.mock("@/api/v2/request", async () => {
+  const actual = await vi.importActual<typeof import("@/api/v2/request")>("@/api/v2/request");
+  return { ...actual, v2: mocks.v2 };
+});
+
+vi.mock("sonner", () => ({
+  toast: { success: mocks.toastSuccess, error: mocks.toastError },
+}));
+
+vi.mock("@/hooks/queries/metadataAI", () => ({
+  useMetadataAIStatus: () => ({ data: mocks.status }),
+}));
+
+import { catalogKeys } from "@/hooks/queries/keys";
+
+import { LibraryTranslatePanel } from "./LibraryTranslatePanel";
+
+function renderPanel(client = new QueryClient({ defaultOptions: { queries: { retry: false } } })) {
+  const wrapper = ({ children }: { children: ReactNode }) => (
+    <QueryClientProvider client={client}>{children}</QueryClientProvider>
+  );
+  return render(<LibraryTranslatePanel libraryId={4} />, { wrapper });
+}
+
+function job(overrides: object) {
+  return {
+    id: "11",
+    target_kind: "library",
+    content_id: "library:4",
+    include_children: true,
+    source_language: "",
+    target_language: "de",
+    engine: "openai",
+    model: "m",
+    status: "running",
+    progress: 0.5,
+    progress_message: "Translating item 2 of 4",
+    fields_done: 1,
+    fields_total: 4,
+    force: false,
+    created_at: "2026-10-09T00:00:00.000Z",
+    updated_at: "2026-10-09T00:00:00.000Z",
+    ...overrides,
+  };
+}
+
+describe("LibraryTranslatePanel", () => {
+  afterEach(() => {
+    mocks.v2.mockReset();
+    mocks.toastSuccess.mockReset();
+    mocks.toastError.mockReset();
+    mocks.status = { enabled: true, on_view: "off" };
+  });
+
+  it("starts a prewarm for the chosen language", async () => {
+    mocks.v2.mockImplementation((route: string) =>
+      route.startsWith("GET")
+        ? Promise.resolve({ jobs: [] })
+        : Promise.resolve(job({ status: "pending" })),
+    );
+    renderPanel();
+    await userEvent.selectOptions(await screen.findByLabelText("Language"), "de");
+    await userEvent.click(screen.getByRole("button", { name: "Translate" }));
+    await waitFor(() =>
+      expect(mocks.v2).toHaveBeenCalledWith(
+        "POST /api/v2/admin/libraries/{library_id}/metadata-translation",
+        expect.objectContaining({ path: { library_id: "4" }, body: { target_language: "de" } }),
+      ),
+    );
+  });
+
+  it("shows progress and stops a running prewarm", async () => {
+    mocks.v2.mockImplementation((route: string) =>
+      route.startsWith("GET") ? Promise.resolve({ jobs: [job({})] }) : Promise.resolve(undefined),
+    );
+    renderPanel();
+    expect(await screen.findByText("Translating item 2 of 4 (50%)")).toBeInTheDocument();
+    await userEvent.click(screen.getByRole("button", { name: "Stop" }));
+    await waitFor(() =>
+      expect(mocks.v2).toHaveBeenCalledWith(
+        "POST /api/v2/admin/libraries/{library_id}/metadata-translation/jobs/{job_id}/cancel",
+        expect.objectContaining({ path: { library_id: "4", job_id: "11" } }),
+      ),
+    );
+  });
+
+  it("is hidden while AI description translation is off", () => {
+    mocks.status = { enabled: false, on_view: "off" };
+    const { container } = renderPanel();
+    expect(container).toBeEmptyDOMElement();
+    expect(mocks.v2).not.toHaveBeenCalled();
+  });
+
+  it("reports a prewarm that finishes before the first poll", async () => {
+    let jobs: object[] = [];
+    mocks.v2.mockImplementation((route: string) => {
+      if (route.startsWith("GET")) return Promise.resolve({ jobs });
+      // The job is already finished by the time the list is read again.
+      jobs = [
+        job({
+          status: "completed",
+          progress: 1,
+          progress_message: "Translated 2 descriptions across 1 items",
+        }),
+      ];
+      return Promise.resolve(job({ status: "pending" }));
+    });
+    renderPanel();
+    await userEvent.selectOptions(await screen.findByLabelText("Language"), "de");
+    await userEvent.click(screen.getByRole("button", { name: "Translate" }));
+    await waitFor(() =>
+      expect(mocks.toastSuccess).toHaveBeenCalledWith("Translated 2 descriptions across 1 items"),
+    );
+  });
+
+  it("reports each of two prewarms when the newer one finishes first", async () => {
+    let jobs = [job({ id: "12", target_language: "fr" }), job({ id: "11" })];
+    mocks.v2.mockImplementation(() => Promise.resolve({ jobs }));
+    const client = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+    renderPanel(client);
+    expect(await screen.findAllByRole("status")).toHaveLength(2);
+
+    jobs = [
+      job({
+        id: "12",
+        target_language: "fr",
+        status: "completed",
+        progress_message: "French done",
+      }),
+      job({ id: "11" }),
+    ];
+    await client.refetchQueries();
+    await waitFor(() => expect(mocks.toastSuccess).toHaveBeenCalledWith("French done"));
+
+    jobs = [
+      job({
+        id: "12",
+        target_language: "fr",
+        status: "completed",
+        progress_message: "French done",
+      }),
+      job({ id: "11", status: "completed", progress_message: "German done" }),
+    ];
+    await client.refetchQueries();
+    await waitFor(() => expect(mocks.toastSuccess).toHaveBeenCalledWith("German done"));
+    expect(mocks.toastSuccess).toHaveBeenCalledTimes(2);
+  });
+
+  it("refreshes localized media views after a prewarm that failed partway", async () => {
+    let jobs = [job({})];
+    mocks.v2.mockImplementation(() => Promise.resolve({ jobs }));
+    const client = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+    const catalogKey = [...catalogKeys.all, "list"];
+    const favoritesKey = ["favorites", "list"];
+    client.setQueryData(catalogKey, { items: [] });
+    client.setQueryData(favoritesKey, { items: [] });
+    renderPanel(client);
+    expect(await screen.findByRole("status")).toBeInTheDocument();
+
+    jobs = [job({ status: "failed", error_message: "quota exceeded" })];
+    await client.refetchQueries({ queryKey: ["admin", "library-metadata-translation"] });
+    await waitFor(() => expect(mocks.toastError).toHaveBeenCalledWith("quota exceeded"));
+    await waitFor(() => expect(client.getQueryState(catalogKey)?.isInvalidated).toBe(true));
+    expect(client.getQueryState(favoritesKey)?.isInvalidated).toBe(true);
+  });
+
+  it("reports a prewarm that finished while the editor was closed", async () => {
+    let jobs = [job({})];
+    mocks.v2.mockImplementation(() => Promise.resolve({ jobs }));
+    const client = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+    const first = renderPanel(client);
+    expect(await screen.findByRole("status")).toBeInTheDocument();
+    first.unmount();
+
+    // Long enough for the unused jobs query to be garbage-collected.
+    client.removeQueries();
+    jobs = [job({ status: "completed", progress_message: "German done" })];
+    renderPanel(client);
+    await waitFor(() => expect(mocks.toastSuccess).toHaveBeenCalledWith("German done"));
+  });
+
+  it("reports a prewarm whose start answered after the editor closed", async () => {
+    let jobs: object[] = [];
+    let answer: (value: object) => void = () => {};
+    mocks.v2.mockImplementation((route: string) =>
+      route.startsWith("GET")
+        ? Promise.resolve({ jobs })
+        : new Promise((resolve) => {
+            answer = resolve;
+          }),
+    );
+    const client = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+    const first = renderPanel(client);
+    await userEvent.selectOptions(await screen.findByLabelText("Language"), "de");
+    await userEvent.click(screen.getByRole("button", { name: "Translate" }));
+    first.unmount();
+    answer(job({ status: "pending" }));
+    await waitFor(() => expect(client.isMutating()).toBe(0));
+
+    client.removeQueries();
+    jobs = [job({ status: "completed", progress_message: "German done" })];
+    renderPanel(client);
+    await waitFor(() => expect(mocks.toastSuccess).toHaveBeenCalledWith("German done"));
+  });
+
+  it("offers a Stop for each of two running prewarms", async () => {
+    mocks.v2.mockImplementation((route: string) =>
+      route.startsWith("GET")
+        ? Promise.resolve({ jobs: [job({ id: "12", target_language: "fr" }), job({ id: "11" })] })
+        : Promise.resolve(undefined),
+    );
+    renderPanel();
+    const stops = await screen.findAllByRole("button", { name: "Stop" });
+    expect(stops).toHaveLength(2);
+    expect(screen.getByRole("button", { name: "Translate" })).toBeDisabled();
+    await userEvent.click(stops[1]!);
+    await waitFor(() =>
+      expect(mocks.v2).toHaveBeenCalledWith(
+        "POST /api/v2/admin/libraries/{library_id}/metadata-translation/jobs/{job_id}/cancel",
+        expect.objectContaining({ path: { library_id: "4", job_id: "11" } }),
+      ),
+    );
+  });
+});
diff --git a/web/src/components/admin/libraries/LibraryTranslatePanel.tsx b/web/src/components/admin/libraries/LibraryTranslatePanel.tsx
new file mode 100644
index 0000000000..ace14d074b
--- /dev/null
+++ b/web/src/components/admin/libraries/LibraryTranslatePanel.tsx
@@ -0,0 +1,152 @@
+import { useEffect, useMemo, useState } from "react";
+import { Languages } from "lucide-react";
+import { toast } from "sonner";
+import { useQueryClient } from "@tanstack/react-query";
+
+import { Button } from "@/components/ui/button";
+import { Label } from "@/components/ui/label";
+import { useMetadataAIStatus } from "@/hooks/queries/metadataAI";
+import {
+  isActiveTranslationJob,
+  useCancelLibraryTranslation,
+  useLibraryTranslationJobs,
+  useTranslateLibraryMetadata,
+  watchedLibraryTranslationJobs,
+} from "@/hooks/queries/admin/libraryTranslation";
+import { refreshLocalizedMediaQueries } from "@/hooks/queries/mediaSurfaceRefresh";
+import { LANGUAGES } from "@/player/utils/languageNames";
+
+function languageLabel(code: string): string {
+  return LANGUAGES.find((lang) => lang.code === code)?.label ?? code;
+}
+
+/**
+ * Prewarms a library's translations: fills in the descriptions of every item,
+ * season and episode that is missing in the chosen language, so viewers do
+ * not wait for on-view translation. Existing provider, manual and AI text is
+ * kept. Rendered only for a saved library while AI description translation
+ * is enabled.
+ */
+export function LibraryTranslatePanel({ libraryId }: { libraryId: number }) {
+  const queryClient = useQueryClient();
+  const { data: status } = useMetadataAIStatus();
+  const enabled = Boolean(status?.enabled);
+  const [targetLang, setTargetLang] = useState("");
+
+  const jobsQuery = useLibraryTranslationJobs(libraryId, enabled);
+  const translate = useTranslateLibraryMetadata(libraryId);
+  const cancel = useCancelLibraryTranslation(libraryId);
+  const jobs = useMemo(() => jobsQuery.data?.jobs ?? [], [jobsQuery.data?.jobs]);
+  const activeJobs = jobs.filter(isActiveTranslationJob);
+  // With one prewarm running, Stop replaces Translate; with several (two
+  // languages started from different tabs), each status row gets its own.
+  const activeJob = activeJobs.length === 1 ? activeJobs[0] : undefined;
+
+  // When a watched job finishes, report it and refresh the catalog views that
+  // show the new text; a failed or stopped job has still saved the items it
+  // translated. The enqueue hook adds the started job before the list is
+  // refetched, so a prewarm that ends before the first poll is still reported,
+  // and the set outlives the panel, so a job that finishes while the editor is
+  // closed is reported when the panel next sees it.
+  const watched = watchedLibraryTranslationJobs(queryClient);
+  useEffect(() => {
+    let finished = false;
+    for (const job of jobs) {
+      if (isActiveTranslationJob(job)) {
+        watched.add(job.id);
+        continue;
+      }
+      if (!watched.delete(job.id)) continue;
+      finished = true;
+      if (job.status === "completed") {
+        toast.success(job.progress_message || "Library translation finished.");
+      } else if (job.status === "failed") {
+        toast.error(job.error_message || "Library translation failed.");
+      }
+    }
+    if (finished) {
+      void refreshLocalizedMediaQueries(queryClient);
+    }
+  }, [jobs, watched, queryClient]);
+
+  if (!enabled) return null;
+
+  const busy = translate.isPending || activeJobs.length > 0;
+  const start = () => {
+    if (!targetLang) {
+      toast.error("Pick a target language first.");
+      return;
+    }
+    translate.mutate(targetLang);
+  };
+
+  return (
+    <div className="border-border bg-muted/30 space-y-3 rounded-md border px-3 py-3">
+      <div className="flex items-center gap-2">
+        <Languages className="text-muted-foreground h-4 w-4" aria-hidden="true" />
+        <span className="text-sm font-medium">Translate library descriptions</span>
+      </div>
+      <p className="text-muted-foreground text-xs">
+        Translates every overview and tagline in this library, with season and episode overviews,
+        that is missing in the chosen language. Descriptions that already exist in that language are
+        kept. Viewers otherwise get translations as they browse.
+      </p>
+      <div className="flex flex-wrap items-end gap-3">
+        <div className="space-y-1">
+          <Label htmlFor={`library-translate-target-${libraryId}`} className="text-xs">
+            Language
+          </Label>
+          <select
+            id={`library-translate-target-${libraryId}`}
+            className="border-border bg-background text-foreground h-9 rounded-md border px-2 text-sm"
+            value={targetLang}
+            onChange={(event) => setTargetLang(event.target.value)}
+            disabled={busy}
+          >
+            <option value="">Select…</option>
+            {LANGUAGES.map((lang) => (
+              <option key={lang.code} value={lang.code}>
+                {lang.label}
+              </option>
+            ))}
+          </select>
+        </div>
+        {activeJob ? (
+          <Button
+            type="button"
+            size="sm"
+            variant="outline"
+            onClick={() => cancel.mutate(activeJob.id)}
+            disabled={cancel.isPending}
+          >
+            Stop
+          </Button>
+        ) : (
+          <Button type="button" size="sm" onClick={start} disabled={busy}>
+            {translate.isPending ? "Starting…" : "Translate"}
+          </Button>
+        )}
+      </div>
+      {activeJobs.map((job) => (
+        <div key={job.id} className="flex items-center gap-2">
+          <p className="text-muted-foreground text-xs" role="status">
+            {activeJobs.length > 1 && `${languageLabel(job.target_language)}: `}
+            {job.progress_message || "Queued"}
+            {job.fields_total > 0 && ` (${Math.round(job.progress * 100)}%)`}
+          </p>
+          {!activeJob && (
+            <Button
+              type="button"
+              size="sm"
+              variant="ghost"
+              onClick={() => cancel.mutate(job.id)}
+              disabled={cancel.isPending}
+            >
+              Stop
+            </Button>
+          )}
+        </div>
+      ))}
+    </div>
+  );
+}
diff --git a/web/src/components/admin/libraries/useLibraryForm.localMetadata.test.tsx b/web/src/components/admin/libraries/useLibraryForm.localMetadata.test.tsx
index 0c130a5934..3313780c4b 100644
--- a/web/src/components/admin/libraries/useLibraryForm.localMetadata.test.tsx
+++ b/web/src/components/admin/libraries/useLibraryForm.localMetadata.test.tsx
@@ -37,6 +37,9 @@ vi.mock("@/hooks/queries/admin/libraries", () => ({
   useLibraryRealtimeMonitoring: () => ({ data: undefined }),
 }));
 
+// The translation panel fetches its own status; this file only covers the provider chain.
+vi.mock("./LibraryTranslatePanel", () => ({ LibraryTranslatePanel: () => null }));
+
 beforeEach(() => setChain.mockClear());
 
 const library = { id: 7, name: "Shows", type: "series", paths: ["/tv"] } as Library;
diff --git a/web/src/components/adminSessionActionsUi.test.tsx b/web/src/components/adminSessionActionsUi.test.tsx
index d143ea40df..cc49b13de2 100644
--- a/web/src/components/adminSessionActionsUi.test.tsx
+++ b/web/src/components/adminSessionActionsUi.test.tsx
@@ -268,6 +268,64 @@ describe("AdminSessionActions", () => {
     );
   });
 
+  async function renderInline(session: AdminSession) {
+    await act(async () => {
+      root.render(
+        <AdminSessionActions
+          session={session}
+          compact
+          layout="inline"
+          showInlineTerminate
+          extraMenuItems={<button type="button">View Logs</button>}
+        />,
+      );
+    });
+  }
+
+  it("offers pause, stop and message in the Activity page's inline layout", async () => {
+    mocks.sendCommand.mockResolvedValue({
+      command_id: "cmd-for-session-1",
+      sequence: 42,
+      outcome: "applied",
+      delivery: "dispatched",
+    });
+
+    await renderInline(baseSession);
+
+    expect(findButton(container, "Pause")).toBeTruthy();
+    expect(findButton(container, "Message")).toBeTruthy();
+    expect(findButton(container, "Terminate")).toBeTruthy();
+    expect(findButton(container, "View Logs")).toBeTruthy();
+
+    await click(findButton(container, "Stop"));
+    expect(mocks.sendCommand).toHaveBeenCalledWith(
+      {
+        sessionId: "session-1",
+        action: "stop",
+        identity: { command_id: "cmd-for-session-1", sequence: 42 },
+      },
+      { profileId: "owner" },
+    );
+  });
+
+  it("offers resume for a paused session in the inline layout", async () => {
+    await renderInline({ ...baseSession, is_paused: true });
+
+    expect(findButton(container, "Resume")).toBeTruthy();
+    expect(findButton(container, "Pause")).toBeUndefined();
+  });
+
+  it("keeps stop and shows the limited copy once in the inline layout without playback control", async () => {
+    await renderInline({ ...baseSession, has_playback_control: false });
+
+    const copy =
+      "This session does not support live pause, resume, or messages. Stop and Terminate can still end playback.";
+    expect(container.textContent?.split(copy).length).toBe(2);
+    expect(findButton(container, "Pause")).toBeUndefined();
+    expect(findButton(container, "Message")).toBeUndefined();
+    expect(findButton(container, "Stop")).toBeTruthy();
+  });
+
   it("reports a refused stale command without changing the shown state", async () => {
     mocks.sendCommand.mockRejectedValue(new Error("The command sequence is behind"));
 
diff --git a/web/src/components/calm/CalmPage.test.tsx b/web/src/components/calm/CalmPage.test.tsx
index 1e08e63036..df4de70e1d 100644
--- a/web/src/components/calm/CalmPage.test.tsx
+++ b/web/src/components/calm/CalmPage.test.tsx
@@ -8,7 +8,6 @@ describe("CalmPage", () => {
   it("is a page's own h1 with its buttons in the header", () => {
     render(
       <CalmPage
-        heading="page"
         title="Collections"
         subtitle="What viewers see on each library's Collections tab."
         actions={<button type="button">New collection</button>}
@@ -24,13 +23,13 @@ describe("CalmPage", () => {
     expect(screen.getByRole("banner").parentElement).not.toHaveClass("pb-24");
   });
 
-  it("is an h2 under a parent page and leaves room for a docked bar", () => {
+  it("leaves room for a docked bar", () => {
     render(
-      <CalmPage heading="section" title="Home Screen" subtitle="Your rows." padBottom>
+      <CalmPage title="Home Screen" subtitle="Your rows." padBottom>
         <p>List</p>
       </CalmPage>,
     );
-    expect(screen.getByRole("heading", { level: 2, name: "Home Screen" })).toBeInTheDocument();
+    expect(screen.getByRole("heading", { level: 1, name: "Home Screen" })).toBeInTheDocument();
     expect(screen.getByRole("banner").parentElement).toHaveClass("pb-24");
   });
 });
diff --git a/web/src/components/calm/CalmPage.tsx b/web/src/components/calm/CalmPage.tsx
index b38dae0bc5..1dda04f9c6 100644
--- a/web/src/components/calm/CalmPage.tsx
+++ b/web/src/components/calm/CalmPage.tsx
@@ -1,21 +1,22 @@
 import type { ReactNode } from "react";
+
+import { PageHeader } from "@/components/page/PageHeader";
 import { cn } from "@/lib/utils";
 
 /**
- * The 1000px column of a calm list page, with its heading, subtitle and the
- * page's buttons at the right. `heading="page"` is a page's own h1;
- * `heading="section"` an h2 under a parent page's heading (Settings).
- * `padBottom` keeps room at the foot for a bar docked at the bottom.
+ * The 1000px column of a calm list page, with the shared page header, its
+ * subtitle and the page's buttons at the right. The column starts at the
+ * layout's gutter like every other page. Blocks under the header sit 24px
+ * apart, as on the other admin pages. `padBottom` keeps room at the foot for a
+ * bar docked at the bottom.
  */
 export function CalmPage({
-  heading,
   title,
   subtitle,
   actions,
   padBottom = false,
   children,
 }: {
-  heading: "page" | "section";
   title: string;
   subtitle: string;
   actions?: ReactNode;
@@ -25,30 +26,9 @@ export function CalmPage({
   return (
     // One column that may shrink below its content's width, so a row of pills
     // scrolls instead of pushing the list past the right edge of a phone.
-    <div
-      className={cn(
-        "mx-auto grid max-w-[1000px] grid-cols-[minmax(0,1fr)] gap-7",
-        padBottom && "pb-24",
-      )}
-    >
-      <header className="page-header gap-5">
-        {heading === "page" ? (
-          <div className="space-y-3">
-            <h1 className="page-title text-[clamp(2rem,4vw,3rem)]">{title}</h1>
-            <p className="page-subtitle max-w-[76ch] text-sm sm:text-base">{subtitle}</p>
-          </div>
-        ) : (
-          <div className="space-y-3">
-            <h2 className="text-2xl font-semibold tracking-tight sm:text-3xl">{title}</h2>
-            <p className="text-muted-foreground max-w-2xl text-sm leading-relaxed">{subtitle}</p>
-          </div>
-        )}
-        {actions ? (
-          // Stays at the right when the header wraps, so a menu opens over the list.
-          <div className="ml-auto flex flex-wrap items-center gap-2">{actions}</div>
-        ) : null}
-      </header>
-      {children}
+    <div className={cn("grid max-w-[1000px] grid-cols-[minmax(0,1fr)]", padBottom && "pb-24")}>
+      <PageHeader title={title} subtitle={subtitle} actions={actions} />
+      <div className="grid grid-cols-[minmax(0,1fr)] gap-6">{children}</div>
     </div>
   );
 }
diff --git a/web/src/components/calm/PillSwitcher.tsx b/web/src/components/calm/PillSwitcher.tsx
index 2bef62d92b..f0ef6c5e05 100644
--- a/web/src/components/calm/PillSwitcher.tsx
+++ b/web/src/components/calm/PillSwitcher.tsx
@@ -54,7 +54,7 @@ export function PillSwitcher({
           aria-label={label}
           onScroll={measure}
           className={cn(
-            "-mx-1 [scrollbar-width:none] overflow-x-auto px-1 py-1 [--strip-fade:4rem] [--strip-hold:1.75rem] [&::-webkit-scrollbar]:hidden",
+            "-mx-1 overflow-x-auto px-1 py-1 [--strip-fade:4rem] [--strip-hold:1.75rem] [scrollbar-width:none] [&::-webkit-scrollbar]:hidden",
             edgeMask(edges),
           )}
         >
diff --git a/web/src/components/castCrewGroups.ts b/web/src/components/castCrewGroups.ts
new file mode 100644
index 0000000000..4aae30527e
--- /dev/null
+++ b/web/src/components/castCrewGroups.ts
@@ -0,0 +1,68 @@
+import type { CrewMember } from "@/api/types";
+
+export interface CrewGroup {
+  /** Divider label shown before the group (omitted for the first group). */
+  label: string;
+  /** Caption under each card, e.g. "Director". */
+  role: string;
+  members: CrewMember[];
+  /** Most cards shown for this group. */
+  max: number;
+}
+
+const LEAD_MAX = 2;
+
+/**
+ * Headline crew for a title's "Cast & Crew" row: the director (or series
+ * creator) first, then writers. A series leads with every one of its Creator
+ * credits and falls back to its Director credits, captioned "Director", when it
+ * has none. Directors are capped at two cards.
+ */
+export function buildCrewGroups(crew: CrewMember[], leadRole: "Director" | "Creator"): CrewGroup[] {
+  const lead = leadCredits(crew, leadRole);
+  // A writer-director already has a card in the lead group. Only the lead
+  // cards the row shows count, so a director past the cap still shows as a writer.
+  const shownLeadKeys = new Set(uniqueByPerson(lead.members).slice(0, lead.max).map(creditKey));
+  return [
+    {
+      label: lead.role,
+      role: lead.role,
+      members: lead.members,
+      max: lead.max,
+    },
+    {
+      label: "Writers",
+      role: "Writer",
+      members: crew.filter(
+        (c) => (c.job === "Writer" || c.job === "Screenplay") && !shownLeadKeys.has(creditKey(c)),
+      ),
+      max: 3,
+    },
+  ];
+}
+
+function leadCredits(
+  crew: CrewMember[],
+  leadRole: "Director" | "Creator",
+): { role: "Director" | "Creator"; members: CrewMember[]; max: number } {
+  if (leadRole === "Creator") {
+    const creators = crew.filter((c) => c.job === "Creator");
+    // Every creator gets a card; a series rarely has more than a handful.
+    if (creators.length > 0) return { role: "Creator", members: creators, max: Infinity };
+  }
+  return { role: "Director", members: crew.filter((c) => c.job === "Director"), max: LEAD_MAX };
+}
+
+function creditKey(credit: CrewMember): string {
+  return credit.person_id || credit.name;
+}
+
+function uniqueByPerson(credits: CrewMember[]): CrewMember[] {
+  const seen = new Set<string>();
+  return credits.filter((credit) => {
+    const key = creditKey(credit);
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
diff --git a/web/src/components/collections/editor/LockedSourceSummary.tsx b/web/src/components/collections/editor/LockedSourceSummary.tsx
index 24ea211eed..e47c453e52 100644
--- a/web/src/components/collections/editor/LockedSourceSummary.tsx
+++ b/web/src/components/collections/editor/LockedSourceSummary.tsx
@@ -1,11 +1,6 @@
 import { Lock } from "lucide-react";
 
-import {
-  DISCOVER_LOCKED,
-  DISCOVER_STILL_EDITABLE,
-  TRAKT_LOCKED,
-  TRAKT_STILL_EDITABLE,
-} from "@/lib/collections/copy";
+import { DISCOVER_LOCKED, DISCOVER_STILL_EDITABLE } from "@/lib/collections/copy";
 import { SYNCED_SOURCE_LABEL } from "@/lib/collections/types";
 
 const DISCOVER_ORDER: Record<string, string> = {
@@ -32,46 +27,24 @@ function discoverFinds(config: Record<string, unknown>): string {
   return order ? `${media}, ${order}` : media;
 }
 
-/** "Recommended movies", or the Trakt list's link. */
-function traktFinds(config: Record<string, unknown>, sourceUrl: string): string {
-  const link = text(config.list_url) || text(config.url);
-  if (config.mode === "trakt_list") return link || sourceUrl;
-  const preset = text(config.preset) || "trending";
-  const media = config.media_type === "tv" ? "TV shows" : "movies";
-  return `${preset.charAt(0).toUpperCase()}${preset.slice(1)} ${media}`;
-}
-
 /**
- * The list a Discover (starter pack) or legacy Trakt list follows, read-only:
- * the editor can't rebuild either source, so a save never sends it.
+ * The list a Discover (starter pack) list follows, read-only: the editor
+ * can't rebuild its source, so a save never sends it.
  */
-export function LockedSourceSummary({
-  source,
-  config,
-  sourceUrl,
-}: {
-  source: "tmdb_discover" | "trakt";
-  config: Record<string, unknown>;
-  sourceUrl: string;
-}) {
-  const discover = source === "tmdb_discover";
+export function LockedSourceSummary({ config }: { config: Record<string, unknown> }) {
   return (
     <div className="bg-muted/40 grid gap-3 rounded-xl px-4 py-3.5 text-[13.5px]">
       <p className="flex items-center gap-2 font-semibold">
         <Lock aria-hidden className="size-4 shrink-0" />
-        {discover ? DISCOVER_LOCKED : TRAKT_LOCKED}
+        {DISCOVER_LOCKED}
       </p>
       <dl className="grid grid-cols-[72px_minmax(0,1fr)] gap-x-3 gap-y-1.5">
         <dt className="text-muted-foreground">Source</dt>
-        <dd>{SYNCED_SOURCE_LABEL[source]}</dd>
+        <dd>{SYNCED_SOURCE_LABEL.tmdb_discover}</dd>
         <dt className="text-muted-foreground">Finds</dt>
-        <dd className="break-words">
-          {discover ? discoverFinds(config) : traktFinds(config, sourceUrl)}
-        </dd>
+        <dd className="break-words">{discoverFinds(config)}</dd>
       </dl>
-      <p className="text-muted-foreground text-[13px]">
-        {discover ? DISCOVER_STILL_EDITABLE : TRAKT_STILL_EDITABLE}
-      </p>
+      <p className="text-muted-foreground text-[13px]">{DISCOVER_STILL_EDITABLE}</p>
     </div>
   );
 }
diff --git a/web/src/components/collections/editor/SyncedListPanel.tsx b/web/src/components/collections/editor/SyncedListPanel.tsx
index 1535a6bed1..2d73eb02d8 100644
--- a/web/src/components/collections/editor/SyncedListPanel.tsx
+++ b/web/src/components/collections/editor/SyncedListPanel.tsx
@@ -29,7 +29,6 @@ import {
   SYNCED_OFF,
   TMDB_LIST_HELP,
   TMDB_LIST_LINK,
-  TRAKT_SCHEDULE_STOPPED,
   YOU_DECIDE,
   ineligibleLibrariesLine,
   youDecideItems,
@@ -396,10 +395,8 @@ function ListSettings({
   onChange,
   libraries,
   librariesNote,
-  librariesLocked,
   eligibleKinds,
   limit,
-  limitLocked,
   onLimitChange,
   schedule,
   onScheduleChange,
@@ -412,10 +409,8 @@ function ListSettings({
   onChange: (update: (draft: CollectionDraft) => CollectionDraft) => void;
   libraries: readonly LibraryOption[];
   librariesNote?: string;
-  librariesLocked?: boolean;
   eligibleKinds?: string[];
   limit: number | undefined;
-  limitLocked?: boolean;
   onLimitChange: (limit: number | undefined) => void;
   schedule: string;
   onScheduleChange: (schedule: string) => void;
@@ -435,7 +430,6 @@ function ListSettings({
           allLabel={isServer ? undefined : ALL_MY_LIBRARIES_LABEL}
           eligibleKinds={eligibleKinds}
           ineligibleReason={eligibleKinds ? ONLY_KIND_REASON[eligibleKinds[0]!] : undefined}
-          disabled={librariesLocked}
           onChange={(libraryIds) => onChange((current) => ({ ...current, libraryIds }))}
           warning={
             librariesNote ? (
@@ -449,7 +443,6 @@ function ListSettings({
         mode="synced"
         sortConfig={draft.rawSortConfig}
         limit={limit}
-        limitLocked={limitLocked}
         allowPersonalized={!isServer}
         onSortChange={(rawSortConfig) => onChange((current) => ({ ...current, rawSortConfig }))}
         onLimitChange={onLimitChange}
@@ -675,13 +668,11 @@ function SavedSource({
   isServer,
   list,
   name,
-  sourceUrl,
   onChange,
 }: {
   isServer: boolean;
   list: ListDraft;
   name: string;
-  sourceUrl: string;
   onChange: (fields: Partial<ListDraft>) => void;
 }) {
   switch (list.source) {
@@ -708,16 +699,13 @@ function SavedSource({
         <FixedSource list={list} />
       );
     case "tmdb_discover":
-    case "trakt":
-      return (
-        <LockedSourceSummary source={list.source} config={list.stored} sourceUrl={sourceUrl} />
-      );
+      return <LockedSourceSummary config={list.stored} />;
   }
 }
 
 /**
  * What the list controls and what the editor controls, side by side. Discover
- * and legacy Trakt lists say this in their locked summary instead.
+ * lists say this in their locked summary instead.
  */
 function WhoDecides({ scheduleEditable }: { scheduleEditable: boolean }) {
   const id = useId();
@@ -766,7 +754,7 @@ export interface SavedListSync {
 /**
  * A saved Synced list: a failed sync at the top, the sync status strip, the
  * list it follows (a link, a chart, a TMDB collection ID, or a locked summary
- * for Discover and legacy Trakt lists), then its libraries, order and schedule.
+ * for Discover lists), then its libraries, order and schedule.
  */
 function SavedListContents({
   scopeKind,
@@ -784,17 +772,13 @@ function SavedListContents({
   const kinds = eligibleLibraryKinds(mediaKind);
   const only = mediaKind === "movie" || mediaKind === "tv" ? mediaKind : null;
   const left = libraries.filter((library) => !fits(library, kinds)).map((library) => library.name);
-  const trakt = list.source === "trakt";
   const chosen = libraries.filter((library) => draft.libraryIds.includes(library.id));
-  // The server won't restart a stopped Trakt schedule, and a profile's
-  // schedule stays put until the server says it may change.
-  let scheduleLockedReason: string | undefined;
-  if (trakt && !sync.schedule.trim()) scheduleLockedReason = TRAKT_SCHEDULE_STOPPED;
-  if (!isServer && capabilities?.sync_schedule_editable === false) {
-    scheduleLockedReason = PERSONAL_SCHEDULE_LOCKED;
-  }
-  const scheduleLocked =
-    Boolean(scheduleLockedReason) || (!isServer && !capabilities?.sync_schedule_editable);
+  // A profile's schedule stays put until the server says it may change.
+  const scheduleLockedReason =
+    !isServer && capabilities?.sync_schedule_editable === false
+      ? PERSONAL_SCHEDULE_LOCKED
+      : undefined;
+  const scheduleLocked = !isServer && !capabilities?.sync_schedule_editable;
   // A new source unticks libraries that can't hold its titles, as on create.
   const updateList = (fields: Partial<ListDraft>) =>
     onChange((current) => {
@@ -831,12 +815,9 @@ function SavedListContents({
         isServer={isServer}
         list={list}
         name={view.name}
-        sourceUrl={view.raw.source_url ?? ""}
         onChange={updateList}
       />
-      {list.source === "tmdb_discover" || trakt ? null : (
-        <WhoDecides scheduleEditable={!scheduleLocked} />
-      )}
+      {list.source === "tmdb_discover" ? null : <WhoDecides scheduleEditable={!scheduleLocked} />}
       <ListSettings
         // Discard puts back the settings' own state too, such as an open custom schedule.
         key={`settings-${saved.discards ?? 0}`}
@@ -845,10 +826,8 @@ function SavedListContents({
         onChange={onChange}
         libraries={libraries}
         librariesNote={only && left.length > 0 ? ineligibleLibrariesLine(only, left) : undefined}
-        librariesLocked={trakt}
         eligibleKinds={kinds}
         limit={list.limit}
-        limitLocked={trakt}
         onLimitChange={(limit) => updateList({ limit })}
         schedule={list.schedule}
         onScheduleChange={(schedule) => updateList({ schedule })}
diff --git a/web/src/components/collections/fields/OrderBlock.test.tsx b/web/src/components/collections/fields/OrderBlock.test.tsx
index 1b2666880f..b188894a19 100644
--- a/web/src/components/collections/fields/OrderBlock.test.tsx
+++ b/web/src/components/collections/fields/OrderBlock.test.tsx
@@ -163,11 +163,15 @@ describe("OrderBlock, Synced list", () => {
     };
   }
 
-  it("keeps the list's own order by default and says blank takes the whole list", () => {
+  it("keeps the list's own order by default and explains a blank limit", () => {
     const { input } = renderSynced();
     expect(screen.getByRole("combobox", { name: "Default sort" })).toHaveTextContent("List order");
     expect(input).toHaveAttribute("placeholder", "Whole list");
-    expect(screen.getByText(/Blank takes the whole list, up to 500\./)).toBeInTheDocument();
+    expect(
+      screen.getByText(
+        /Blank takes the whole list: up to 10,000 titles from MDBList, or the first 20 of a TMDB chart\./,
+      ),
+    ).toBeInTheDocument();
   });
 
   it("sends the chosen default sort", () => {
@@ -176,12 +180,12 @@ describe("OrderBlock, Synced list", () => {
     expect(onSortChange).toHaveBeenCalledWith({ field: "title", order: "asc" });
   });
 
-  it("caps max titles at 500 and clears it when blank", () => {
+  it("keeps max titles above 500 and clears it when blank", () => {
     const { input, onLimitChange } = renderSynced({ limit: 50 });
-    fireEvent.change(input, { target: { value: "900" } });
+    fireEvent.change(input, { target: { value: "10000" } });
     fireEvent.blur(input);
-    expect(onLimitChange).toHaveBeenLastCalledWith(500);
-    expect(input).toHaveValue(500);
+    expect(onLimitChange).toHaveBeenLastCalledWith(10000);
+    expect(input).toHaveValue(10000);
     fireEvent.change(input, { target: { value: "" } });
     fireEvent.blur(input);
     expect(onLimitChange).toHaveBeenLastCalledWith(undefined);
diff --git a/web/src/components/collections/fields/OrderBlock.tsx b/web/src/components/collections/fields/OrderBlock.tsx
index 1a0fb87122..61bf925b39 100644
--- a/web/src/components/collections/fields/OrderBlock.tsx
+++ b/web/src/components/collections/fields/OrderBlock.tsx
@@ -12,7 +12,6 @@ import {
   SelectValue,
 } from "@/components/ui/select";
 import { useShownRatingSources } from "@/hooks/queries/ratingsCapability";
-import { COLLECTION_MAX_ITEMS } from "@/lib/collectionTemplates";
 import {
   COLLECTION_SOURCE_ORDER,
   collectionDefaultSortOptions,
@@ -88,8 +87,6 @@ export type OrderBlockProps =
       onSortChange: (sortConfig: Record<string, unknown>) => void;
       onLimitChange: (limit: number | undefined) => void;
       allowPersonalized: boolean;
-      /** Max titles shown but fixed, as on a legacy Trakt list. */
-      limitLocked?: boolean;
     }
   | {
       mode: "smart";
@@ -221,29 +218,23 @@ function SmartOrder({
 function MaxTitlesInput({
   limit,
   placeholder,
-  max,
-  disabled,
   onCommit,
 }: {
   limit: number | undefined;
   placeholder: string;
-  max?: number;
-  disabled?: boolean;
   onCommit: (input: HTMLInputElement) => void;
 }) {
   return (
-    <label className="border-border bg-background focus-within:border-ring focus-within:ring-ring/50 flex h-11 items-center gap-3 rounded-md border px-3 text-sm shadow-xs transition-[color,box-shadow] focus-within:ring-[3px] has-[input:disabled]:cursor-not-allowed has-[input:disabled]:opacity-50">
+    <label className="border-border bg-background focus-within:border-ring focus-within:ring-ring/50 flex h-11 items-center gap-3 rounded-md border px-3 text-sm shadow-xs transition-[color,box-shadow] focus-within:ring-[3px]">
       <Input
         key={limit ?? ""}
         type="number"
         min={1}
-        max={max}
         step={1}
         aria-label="Max titles"
         placeholder={placeholder}
         defaultValue={limit ?? ""}
-        disabled={disabled}
-        className="h-full min-w-0 flex-1 rounded-none border-0 bg-transparent p-0 shadow-none focus-visible:ring-0 disabled:opacity-100"
+        className="h-full min-w-0 flex-1 rounded-none border-0 bg-transparent p-0 shadow-none focus-visible:ring-0"
         onBlur={(event) => onCommit(event.currentTarget)}
         onKeyDown={(event) => {
           if (event.key === "Enter") event.currentTarget.blur();
@@ -265,7 +256,6 @@ function SyncedOrder({
   onSortChange,
   onLimitChange,
   allowPersonalized,
-  limitLocked,
 }: Extract<OrderBlockProps, { mode: "synced" }>) {
   const id = useId();
   const shownRatingSources = useShownRatingSources();
@@ -277,8 +267,7 @@ function SyncedOrder({
   );
 
   function commitLimit(input: HTMLInputElement) {
-    const typed = parsedLimit(input.value, limit);
-    const next = typed === undefined ? undefined : Math.min(typed, COLLECTION_MAX_ITEMS);
+    const next = parsedLimit(input.value, limit);
     input.value = next === undefined ? "" : String(next);
     if (next !== limit) onLimitChange(next);
   }
@@ -304,13 +293,7 @@ function SyncedOrder({
             ))}
           </SelectContent>
         </Select>
-        <MaxTitlesInput
-          limit={limit}
-          placeholder="Whole list"
-          max={COLLECTION_MAX_ITEMS}
-          disabled={limitLocked}
-          onCommit={commitLimit}
-        />
+        <MaxTitlesInput limit={limit} placeholder="Whole list" onCommit={commitLimit} />
       </div>
       <p className="text-muted-foreground text-[13px]">
         {SYNCED_ORDER_HELP} {ORDER_HELP}
diff --git a/web/src/components/homeRows/HideWatchedCard.tsx b/web/src/components/homeRows/HideWatchedCard.tsx
deleted file mode 100644
index 2c6ea6b6f0..0000000000
--- a/web/src/components/homeRows/HideWatchedCard.tsx
+++ /dev/null
@@ -1,35 +0,0 @@
-import { useId } from "react";
-import { Switch } from "@/components/ui/switch";
-
-/** Settings > Home Screen, under the list: the profile's Hide watched items setting. */
-export function HideWatchedCard({
-  checked,
-  disabled,
-  onCheckedChange,
-}: {
-  checked: boolean;
-  disabled: boolean;
-  onCheckedChange: (checked: boolean) => void;
-}) {
-  const id = useId();
-  return (
-    <div className="surface-panel flex items-center justify-between gap-4 rounded-[22px] px-[22px] py-5">
-      <div className="min-w-0 space-y-1">
-        <label htmlFor={id} className="text-sm font-semibold">
-          Hide watched items
-        </label>
-        <p id={`${id}-help`} className="text-muted-foreground text-[13px] leading-relaxed">
-          Remove titles you&apos;ve finished from ordinary rows. Hero banners and watch-history rows
-          keep them.
-        </p>
-      </div>
-      <Switch
-        id={id}
-        aria-describedby={`${id}-help`}
-        checked={checked}
-        disabled={disabled}
-        onCheckedChange={(next) => onCheckedChange(next === true)}
-      />
-    </div>
-  );
-}
diff --git a/web/src/components/homeRows/HomePreferencesCard.tsx b/web/src/components/homeRows/HomePreferencesCard.tsx
new file mode 100644
index 0000000000..bcf3ecadb0
--- /dev/null
+++ b/web/src/components/homeRows/HomePreferencesCard.tsx
@@ -0,0 +1,133 @@
+import { useId } from "react";
+
+import { Button } from "@/components/ui/button";
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from "@/components/ui/select";
+import { Switch } from "@/components/ui/switch";
+import { optionsFor } from "@/lib/settingsDisplay";
+import { SETTING_DEFINITIONS, SETTING_KEYS } from "@/lib/settingsContract";
+
+const NEXT_UP_MODES = optionsFor(SETTING_DEFINITIONS[SETTING_KEYS.UI_NEXT_UP_MODE]);
+
+/**
+ * Settings > Home Screen, under the list: the profile's preferences for what
+ * Home's rows hold, as opposed to which rows there are.
+ */
+export function HomePreferencesCard({
+  nextUpMode,
+  nextUpChosen,
+  onNextUpModeChange,
+  onNextUpReset,
+  newReleasesFirst,
+  onNewReleasesFirstChange,
+  hideWatched,
+  onHideWatchedChange,
+  disabled,
+}: {
+  nextUpMode: string;
+  /** Whether the profile stored a choice, which is what a reset can undo. */
+  nextUpChosen: boolean;
+  onNextUpModeChange: (mode: string) => void;
+  onNextUpReset: () => void;
+  newReleasesFirst: boolean;
+  onNewReleasesFirstChange: (checked: boolean) => void;
+  hideWatched: boolean;
+  onHideWatchedChange: (checked: boolean) => void;
+  disabled: boolean;
+}) {
+  const nextUpId = useId();
+  const newReleasesFirstId = useId();
+  const hideWatchedId = useId();
+
+  return (
+    <div className="surface-panel divide-border/60 divide-y rounded-[22px] px-[22px]">
+      <div className="flex flex-col gap-3 py-5 sm:flex-row sm:items-center sm:justify-between sm:gap-4">
+        <div className="min-w-0 space-y-1">
+          <label htmlFor={nextUpId} className="text-sm font-semibold">
+            Next up episodes
+          </label>
+          <p id={`${nextUpId}-help`} className="text-muted-foreground text-[13px] leading-relaxed">
+            Keep the next episode of a show you&apos;re watching in Continue Watching, or give them
+            their own row.
+          </p>
+        </div>
+        <div className="flex shrink-0 items-center gap-2">
+          <Select value={nextUpMode} onValueChange={onNextUpModeChange} disabled={disabled}>
+            <SelectTrigger
+              id={nextUpId}
+              aria-describedby={`${nextUpId}-help`}
+              className="w-full sm:w-[240px]"
+            >
+              <SelectValue />
+            </SelectTrigger>
+            <SelectContent>
+              {NEXT_UP_MODES.map((mode) => (
+                <SelectItem key={mode.value} value={mode.value}>
+                  {mode.label}
+                </SelectItem>
+              ))}
+            </SelectContent>
+          </Select>
+          {nextUpChosen ? (
+            <Button
+              variant="ghost"
+              size="sm"
+              className="h-9 rounded-full px-3"
+              onClick={onNextUpReset}
+              disabled={disabled}
+            >
+              Reset
+            </Button>
+          ) : null}
+        </div>
+      </div>
+      <div className="flex items-center justify-between gap-4 py-5">
+        <div className="min-w-0 space-y-1">
+          <label htmlFor={newReleasesFirstId} className="text-sm font-semibold">
+            Show new episodes first
+          </label>
+          <p
+            id={`${newReleasesFirstId}-help`}
+            className="text-muted-foreground text-[13px] leading-relaxed"
+          >
+            Move a show you&apos;re caught up on to the front of Continue Watching and Next Up when
+            a new episode or season arrives.
+          </p>
+        </div>
+        <Switch
+          id={newReleasesFirstId}
+          aria-describedby={`${newReleasesFirstId}-help`}
+          checked={newReleasesFirst}
+          disabled={disabled}
+          onCheckedChange={(next) => onNewReleasesFirstChange(next === true)}
+        />
+      </div>
+      <div className="flex items-center justify-between gap-4 py-5">
+        <div className="min-w-0 space-y-1">
+          <label htmlFor={hideWatchedId} className="text-sm font-semibold">
+            Hide watched items
+          </label>
+          <p
+            id={`${hideWatchedId}-help`}
+            className="text-muted-foreground text-[13px] leading-relaxed"
+          >
+            Remove titles you&apos;ve finished from ordinary rows. Hero banners and watch-history
+            rows keep them.
+          </p>
+        </div>
+        <Switch
+          id={hideWatchedId}
+          aria-describedby={`${hideWatchedId}-help`}
+          checked={hideWatched}
+          disabled={disabled}
+          onCheckedChange={(next) => onHideWatchedChange(next === true)}
+        />
+      </div>
+    </div>
+  );
+}
diff --git a/web/src/components/homeRows/HomeRowsPage.test.tsx b/web/src/components/homeRows/HomeRowsPage.test.tsx
index 718828bb72..217a06d7da 100644
--- a/web/src/components/homeRows/HomeRowsPage.test.tsx
+++ b/web/src/components/homeRows/HomeRowsPage.test.tsx
@@ -31,7 +31,6 @@ function makeRow(id: string, overrides: Partial<HomeRow> = {}): HomeRow {
     hero: false,
     shown: true,
     own: false,
-    legacyTrakt: false,
     ...overrides,
   };
 }
@@ -235,11 +234,6 @@ describe("HomeRowsPage", () => {
     expect(toggle()).not.toBeChecked();
   });
 
-  it("does not let a legacy Trakt row be turned back on", () => {
-    render(<FakePage initialRows={[makeRow("a", { shown: false, legacyTrakt: true })]} />);
-    expect(screen.getByRole("switch", { name: "Row A is off for everyone" })).toBeDisabled();
-  });
-
   it("marks the current page and disables the switcher while a write is pending", async () => {
     const { unmount } = render(<FakePage initialRows={[makeRow("a")]} />);
     const group = screen.getByRole("group", { name: "Page" });
diff --git a/web/src/components/homeRows/HomeRowsPage.tsx b/web/src/components/homeRows/HomeRowsPage.tsx
index 2ae50b365b..75ded1eb64 100644
--- a/web/src/components/homeRows/HomeRowsPage.tsx
+++ b/web/src/components/homeRows/HomeRowsPage.tsx
@@ -176,8 +176,7 @@ export function HomeRowsPage({
 
   return (
     <CalmPage
-      // Settings > Home Screen sits under the Settings page's own heading.
-      heading={surface === "admin" ? "page" : "section"}
+      // Settings > Home Screen titles itself like every other settings page.
       title={title}
       subtitle={subtitle}
       actions={
@@ -274,7 +273,7 @@ export function HomeRowsPage({
                             }
                           : undefined
                       }
-                      switchDisabled={!adapter.canEdit || (row.legacyTrakt && !row.shown)}
+                      switchDisabled={!adapter.canEdit}
                       onShownChange={(shown) => void adapter.setShown(row.id, shown)}
                       onOpen={onOpenRow ? () => onOpenRow(row) : undefined}
                       menu={
diff --git a/web/src/components/homeRows/RestoreDialog.test.tsx b/web/src/components/homeRows/RestoreDialog.test.tsx
index fddd097bc1..94e28a4879 100644
--- a/web/src/components/homeRows/RestoreDialog.test.tsx
+++ b/web/src/components/homeRows/RestoreDialog.test.tsx
@@ -8,6 +8,7 @@ type Props = ComponentProps<typeof RestoreDialog>;
 
 function Harness(overrides: Partial<Props>) {
   const [resetProfiles, setResetProfiles] = useState(false);
+  const [restoreAll, setRestoreAll] = useState(false);
   return (
     <RestoreDialog
       open
@@ -16,6 +17,8 @@ function Harness(overrides: Partial<Props>) {
       otherLibraryLabels={["Movies", "TV Shows"]}
       rowCount={9}
       collectionRowTitles={[]}
+      restoreAll={restoreAll}
+      onRestoreAllChange={setRestoreAll}
       resetSupported
       resetProfiles={resetProfiles}
       onResetProfilesChange={setResetProfiles}
@@ -93,6 +96,61 @@ describe("RestoreDialog", () => {
     ]);
   });
 
+  it("also restores every library page from Home", async () => {
+    render(<Harness />);
+    const toggle = screen.getByRole("switch", { name: "Also restore every library page" });
+    expect(toggle).toHaveAccessibleDescription(
+      "Movies, TV Shows go back to Prairie's default rows too.",
+    );
+    await userEvent.click(toggle);
+    expect(
+      screen.getByRole("dialog", {
+        name: "Restore Home and every library page to the default rows?",
+      }),
+    ).toHaveAccessibleDescription(
+      "Home and every library page go back to the rows Prairie starts with.",
+    );
+    expect(bullets()).toEqual([
+      "The 9 rows on Home are replaced by Prairie's default rows.",
+      "Library pages (Movies, TV Shows) also go back to Prairie's default rows, and their collection rows are removed.",
+    ]);
+    const reset = screen.getByRole("switch", {
+      name: "Also reset every profile's Home and library pages",
+    });
+    await userEvent.click(reset);
+    expect(reset).toHaveAccessibleDescription(
+      "Clears what each profile hid, renamed, moved or added on Home and every library page.",
+    );
+  });
+
+  it("also restores the other library pages from a library page, and leaves Home alone", async () => {
+    render(
+      <Harness
+        page={{ kind: "library", libraryId: 7 }}
+        pageLabel="Movies"
+        otherLibraryLabels={["TV Shows"]}
+      />,
+    );
+    await userEvent.click(
+      screen.getByRole("switch", { name: "Also restore the other library pages" }),
+    );
+    expect(
+      screen.getByRole("dialog", { name: "Restore every library page to the default rows?" }),
+    ).toHaveAccessibleDescription("Every library page goes back to the rows Prairie starts with.");
+    expect(bullets()).toEqual([
+      "The 9 rows on the Movies page are replaced by Prairie's default rows.",
+      "The other library pages (TV Shows) also go back to Prairie's default rows, and their collection rows are removed. Home doesn't change.",
+    ]);
+    expect(
+      screen.getByRole("switch", { name: "Also reset every profile's library pages" }),
+    ).toBeInTheDocument();
+  });
+
+  it("offers no restore-all switch when there are no other library pages", () => {
+    render(<Harness otherLibraryLabels={[]} />);
+    expect(screen.getAllByRole("switch")).toHaveLength(1);
+  });
+
   it("explains both settings of the reset-every-profile switch", async () => {
     render(<Harness />);
     const toggle = screen.getByRole("switch", { name: "Also reset every profile's Home" });
@@ -107,7 +165,7 @@ describe("RestoreDialog", () => {
   });
 
   it("turns the switch off and says why when the server can't reset profiles", () => {
-    render(<Harness resetSupported={false} />);
+    render(<Harness otherLibraryLabels={[]} resetSupported={false} />);
     const toggle = screen.getByRole("switch", { name: "Also reset every profile's Home" });
     expect(toggle).toBeDisabled();
     expect(screen.getByText("Resetting profiles isn't available on this server.")).toBeVisible();
diff --git a/web/src/components/homeRows/RestoreDialog.tsx b/web/src/components/homeRows/RestoreDialog.tsx
index c6c58710e0..afb2f6b315 100644
--- a/web/src/components/homeRows/RestoreDialog.tsx
+++ b/web/src/components/homeRows/RestoreDialog.tsx
@@ -47,8 +47,30 @@ function collectionLine(titles: string[]): string | null {
   return `Rows that show collections, like ${listTitles(titles)}, are removed. The collections themselves stay in Collections.`;
 }
 
-function otherPagesLine(page: PageRef, otherLibraryLabels: string[]): string | null {
+/** Every page the restore changes, for use inside a sentence. */
+function targetName(page: PageRef, label: string, restoreAll: boolean): string {
+  if (!restoreAll) return pageName(page, label);
+  return page.kind === "home" ? "Home and every library page" : "every library page";
+}
+
+/** The profile pages the reset clears: "Home", "Movies page", "library pages"… */
+function profilePagesName(page: PageRef, label: string, restoreAll: boolean): string {
+  if (restoreAll) return page.kind === "home" ? "Home and library pages" : "library pages";
+  return page.kind === "home" ? "Home" : `${label} page`;
+}
+
+function otherPagesLine(
+  page: PageRef,
+  otherLibraryLabels: string[],
+  restoreAll: boolean,
+): string | null {
   const others = otherLibraryLabels.join(", ");
+  if (restoreAll) {
+    const restored = `also go back to Prairie's default rows, and their collection rows are removed.`;
+    return page.kind === "home"
+      ? `Library pages (${others}) ${restored}`
+      : `The other library pages (${others}) ${restored} Home doesn't change.`;
+  }
   if (page.kind === "home")
     return otherLibraryLabels.length > 0 ? `Library pages (${others}) don't change.` : null;
   return otherLibraryLabels.length > 0
@@ -56,11 +78,52 @@ function otherPagesLine(page: PageRef, otherLibraryLabels: string[]): string | n
     : "Home doesn't change.";
 }
 
+function OptionRow({
+  id,
+  label,
+  help,
+  note,
+  checked,
+  disabled,
+  onCheckedChange,
+}: {
+  id: string;
+  label: string;
+  help: string;
+  note?: string;
+  checked: boolean;
+  disabled: boolean;
+  onCheckedChange: (checked: boolean) => void;
+}) {
+  return (
+    <div className="border-border flex items-center justify-between gap-4 rounded-[14px] border px-4 py-3.5">
+      <div className="min-w-0">
+        <Label htmlFor={id} className="text-sm font-medium">
+          {label}
+        </Label>
+        <p id={`${id}-help`} className="text-muted-foreground mt-1 text-[13px]">
+          {help}
+        </p>
+        {note ? <p className="text-muted-foreground mt-1 text-[13px]">{note}</p> : null}
+      </div>
+      <Switch
+        id={id}
+        aria-describedby={`${id}-help`}
+        checked={checked}
+        disabled={disabled}
+        onCheckedChange={(next) => onCheckedChange(next === true)}
+      />
+    </div>
+  );
+}
+
 /**
- * Confirms putting back Prairie's default rows on one page. It says what goes,
- * that collections stay, which pages are untouched, and what the optional
- * reset of every profile clears. The page version was read when it opened; a
- * 412 keeps the dialog and asks for an explicit reload.
+ * Confirms putting back Prairie's default rows on one page, and optionally on the
+ * other library pages too. It says what goes, that collections stay, which
+ * pages are untouched, and what the optional reset of every profile clears.
+ * This page's version was read when it opened; a 412 keeps the dialog and asks
+ * for an explicit reload. The other library pages are restored over the version
+ * they have when the restore reaches them.
  */
 export function RestoreDialog({
   open,
@@ -69,6 +132,8 @@ export function RestoreDialog({
   otherLibraryLabels,
   rowCount,
   collectionRowTitles,
+  restoreAll,
+  onRestoreAllChange,
   resetSupported,
   resetProfiles,
   onResetProfilesChange,
@@ -88,6 +153,9 @@ export function RestoreDialog({
   rowCount: number;
   /** Titles of the page's collection rows. */
   collectionRowTitles: string[];
+  /** Also restore every library page in `otherLibraryLabels`. */
+  restoreAll: boolean;
+  onRestoreAllChange: (restoreAll: boolean) => void;
   resetSupported: boolean;
   resetProfiles: boolean;
   onResetProfilesChange: (reset: boolean) => void;
@@ -100,19 +168,23 @@ export function RestoreDialog({
 }) {
   const id = useId();
   const name = pageName(page, pageLabel);
+  const all = restoreAll && otherLibraryLabels.length > 0;
+  const target = targetName(page, pageLabel, all);
   const bullets: Array<[LucideIcon, string | null]> = [
     [Rows3, rowsLine(rowCount, name)],
     [Trash2, collectionLine(collectionRowTitles)],
-    [Library, otherPagesLine(page, otherLibraryLabels)],
+    [Library, otherPagesLine(page, otherLibraryLabels, all)],
   ];
   const reset = resetSupported && resetProfiles;
   return (
     <Dialog open={open} onOpenChange={(next) => !busy && onOpenChange(next)}>
       <DialogContent className="gap-5 sm:max-w-[640px]">
-        <DialogHeader>
-          <DialogTitle>Restore {name} to the default rows?</DialogTitle>
+        {/* Keeps the title clear of the close button. */}
+        <DialogHeader className="px-6 sm:pr-6 sm:pl-0">
+          <DialogTitle>Restore {target} to the default rows?</DialogTitle>
           <DialogDescription>
-            {capitalize(name)} goes back to the rows Prairie starts with.
+            {capitalize(target)} {all && page.kind === "home" ? "go" : "goes"} back to the rows
+            Prairie starts with.
           </DialogDescription>
         </DialogHeader>
         <ul
@@ -128,30 +200,33 @@ export function RestoreDialog({
             ) : null,
           )}
         </ul>
-        <div className="border-border flex items-center justify-between gap-4 rounded-[14px] border px-4 py-3.5">
-          <div className="min-w-0">
-            <Label htmlFor={`${id}-reset`} className="text-sm font-medium">
-              Also reset every profile&apos;s {page.kind === "home" ? "Home" : `${pageLabel} page`}
-            </Label>
-            <p id={`${id}-reset-help`} className="text-muted-foreground mt-1 text-[13px]">
-              {reset
-                ? `Clears what each profile hid, renamed, moved or added on ${name}.`
-                : "Profiles keep rows they added. What they hid or renamed on the old rows no longer applies."}
-            </p>
-            {resetSupported ? null : (
-              <p className="text-muted-foreground mt-1 text-[13px]">
-                Resetting profiles isn&apos;t available on this server.
-              </p>
-            )}
-          </div>
-          <Switch
-            id={`${id}-reset`}
-            aria-describedby={`${id}-reset-help`}
-            checked={reset}
-            disabled={!resetSupported || busy}
-            onCheckedChange={(checked) => onResetProfilesChange(checked === true)}
+        {otherLibraryLabels.length > 0 ? (
+          <OptionRow
+            id={`${id}-all`}
+            label={
+              page.kind === "home"
+                ? "Also restore every library page"
+                : "Also restore the other library pages"
+            }
+            help={`${otherLibraryLabels.join(", ")} go back to Prairie's default rows too.`}
+            checked={all}
+            disabled={busy}
+            onCheckedChange={onRestoreAllChange}
           />
-        </div>
+        ) : null}
+        <OptionRow
+          id={`${id}-reset`}
+          label={`Also reset every profile's ${profilePagesName(page, pageLabel, all)}`}
+          help={
+            reset
+              ? `Clears what each profile hid, renamed, moved or added on ${target}.`
+              : "Profiles keep rows they added. What they hid or renamed on the old rows no longer applies."
+          }
+          note={resetSupported ? undefined : "Resetting profiles isn't available on this server."}
+          checked={reset}
+          disabled={!resetSupported || busy}
+          onCheckedChange={onResetProfilesChange}
+        />
         {conflict ? (
           <div
             role="alert"
diff --git a/web/src/components/homeRows/RowLine.tsx b/web/src/components/homeRows/RowLine.tsx
index 9c5585df94..3e6e27162e 100644
--- a/web/src/components/homeRows/RowLine.tsx
+++ b/web/src/components/homeRows/RowLine.tsx
@@ -68,13 +68,13 @@ export function RowLine({
       tags={
         <>
           {row.hero ? (
-            <span className="bg-warning/15 text-warning ring-warning/30 inline-flex h-[22px] shrink-0 items-center gap-1 rounded-full px-2 text-[11.5px] font-semibold ring-1 ring-inset max-sm:hidden">
+            <span className="bg-warning/15 text-warning ring-warning/30 inline-flex h-[22px] shrink-0 items-center gap-1 rounded-full px-2 text-xs font-semibold ring-1 ring-inset max-sm:hidden">
               <Star className="size-3" aria-hidden />
               Hero banner
             </span>
           ) : null}
           {row.own ? (
-            <span className="bg-info/15 text-info ring-info/30 inline-flex h-[22px] shrink-0 items-center rounded-full px-2 text-[11.5px] font-semibold ring-1 ring-inset">
+            <span className="bg-info/15 text-info ring-info/30 inline-flex h-[22px] shrink-0 items-center rounded-full px-2 text-xs font-semibold ring-1 ring-inset">
               Yours
             </span>
           ) : null}
diff --git a/web/src/components/homeRows/addRow/AddRowDialog.test.tsx b/web/src/components/homeRows/addRow/AddRowDialog.test.tsx
index 04c2475f01..574ffff8c4 100644
--- a/web/src/components/homeRows/addRow/AddRowDialog.test.tsx
+++ b/web/src/components/homeRows/addRow/AddRowDialog.test.tsx
@@ -3,7 +3,7 @@ import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
 import { act, cleanup, fireEvent, render, screen, waitFor, within } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import { MemoryRouter } from "react-router";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
 import type { CollectionOption } from "@/hooks/queries/useAllUserCollections";
 import { recipeCatalogFixture } from "@/lib/homeRows/recipeCatalogFixture.test-support";
 import type { RowDraft } from "@/lib/homeRows/rowDraft";
@@ -11,8 +11,13 @@ import type { EditSession, HomeRow, HomeRowsAdapter } from "@/lib/homeRows/types
 import { VARIANT_FAMILIES } from "@/lib/homeRows/variants";
 import { AddRowDialog } from "./AddRowDialog";
 import { paramFieldKeys } from "@/lib/homeRows/paramFields";
+import seasonalThemes from "../../../../../contracts/api/v2/fixtures/list_seasonal_themes_ok.json";
 
 vi.mock("sonner", () => ({ toast: { error: vi.fn(), success: vi.fn() } }));
+// The real catalog body the server's contract fixture pins.
+vi.mock("@/hooks/queries/seasonalThemes", () => ({
+  useSeasonalThemes: () => ({ data: seasonalThemes, isError: false }),
+}));
 vi.mock("@/hooks/queries/ratingsCapability", () => ({
   useShownRatingSources: () => new Set(["imdb", "tmdb"]),
 }));
@@ -20,6 +25,16 @@ vi.mock("@/hooks/queries/items", () => ({
   fetchWatchDetail: async (id: string) => ({ title: `Title ${id}` }),
 }));
 
+// Radix Select drives pointer capture and scrolling that jsdom lacks.
+beforeAll(() => {
+  Object.defineProperties(Element.prototype, {
+    hasPointerCapture: { configurable: true, value: () => false },
+    setPointerCapture: { configurable: true, value: () => {} },
+    releasePointerCapture: { configurable: true, value: () => {} },
+    scrollIntoView: { configurable: true, value: () => {} },
+  });
+});
+
 const COLLECTIONS: CollectionOption[] = [
   {
     id: "ghibli",
@@ -49,7 +64,6 @@ function row(overrides: Partial<HomeRow> = {}): HomeRow {
     hero: false,
     shown: true,
     own: false,
-    legacyTrakt: false,
     ...overrides,
   };
 }
@@ -320,7 +334,9 @@ describe("Add row form", () => {
       if (box.getAttribute("aria-checked") === "true") await userEvent.click(box);
     }
     expect(within(form).getByRole("radio", { name: /Holidays/ })).toBeChecked();
-    expect(within(form).getByText("Pick at least one holiday.")).toBeInTheDocument();
+    expect(
+      within(form).getByText("Pick at least one holiday or add your own."),
+    ).toBeInTheDocument();
     expect(within(form).getByRole("button", { name: "Add row" })).toBeDisabled();
   });
 
diff --git a/web/src/components/homeRows/addRow/AddRowDialog.tsx b/web/src/components/homeRows/addRow/AddRowDialog.tsx
index b8646163ca..9727dabe08 100644
--- a/web/src/components/homeRows/addRow/AddRowDialog.tsx
+++ b/web/src/components/homeRows/addRow/AddRowDialog.tsx
@@ -37,7 +37,7 @@ import {
   type HomeRowsAdapter,
   type RowCollections,
 } from "@/lib/homeRows/types";
-import { kindLocked, showsLabel, variantLocked } from "@/lib/homeRows/variants";
+import { showsLabel, variantLocked } from "@/lib/homeRows/variants";
 import type { RecipeCatalogResponse } from "@/lib/recipes";
 import { cn } from "@/lib/utils";
 import type { ParamLibrary } from "./ParamFields";
@@ -459,10 +459,7 @@ export function AddRowDialog({
                 ? {
                     label: showsLabel(draft.sectionType, draft.config),
                     sentence: sentenceWithoutStop(rowKindSentence(draft.sectionType)),
-                    onChange:
-                      kindLocked(draft.config) || session?.kindLocked
-                        ? undefined
-                        : () => setStep("pick"),
+                    onChange: session?.kindLocked ? undefined : () => setStep("pick"),
                   }
                 : undefined
             }
diff --git a/web/src/components/homeRows/addRow/CollectionPicker.test.tsx b/web/src/components/homeRows/addRow/CollectionPicker.test.tsx
index f367fef2a6..01332a6368 100644
--- a/web/src/components/homeRows/addRow/CollectionPicker.test.tsx
+++ b/web/src/components/homeRows/addRow/CollectionPicker.test.tsx
@@ -20,7 +20,7 @@ const OPTIONS = [
   option("best", "Best Picture Winners", "mdblist"),
   option("xmas", "Christmas Classics", "smart"),
   option("tmdb", "TMDB Top", "tmdb", "user"),
-  option("trakt", "Trakt Watchlist", "trakt", "user"),
+  option("watchlist", "IMDb Watchlist", "mdblist", "user"),
   option("mine", "My Picks", "manual", "user"),
 ];
 
@@ -38,12 +38,10 @@ function Harness({
   initial = "",
   source = collections(),
   onPick = vi.fn(),
-  locked,
 }: {
   initial?: string;
   source?: RowCollections;
   onPick?: (option: CollectionOption) => void;
-  locked?: boolean;
 }) {
   const [value, setValue] = useState(initial);
   return (
@@ -52,7 +50,6 @@ function Harness({
       value={value}
       onPageIds={new Set(["ghibli"])}
       pageLabel="Home"
-      locked={locked}
       onPick={(picked) => {
         setValue(picked.id);
         onPick(picked);
@@ -74,7 +71,7 @@ describe("CollectionPicker", () => {
       "Best Picture Winners",
       "Christmas Classics",
       "TMDB Top",
-      "Trakt Watchlist",
+      "IMDb Watchlist",
       "My Picks",
     ]);
     const ghibli = screen.getByRole("radio", { name: "Studio Ghibli" });
@@ -100,7 +97,7 @@ describe("CollectionPicker", () => {
     await userEvent.click(within(filters).getByRole("button", { name: "Smart" }));
     expect(names()).toEqual(["Christmas Classics"]);
     await userEvent.click(within(filters).getByRole("button", { name: "Synced list" }));
-    expect(names()).toEqual(["Best Picture Winners", "TMDB Top", "Trakt Watchlist"]);
+    expect(names()).toEqual(["Best Picture Winners", "TMDB Top", "IMDb Watchlist"]);
     await userEvent.click(within(filters).getByRole("button", { name: "All" }));
     expect(names()).toHaveLength(6);
   });
@@ -159,12 +156,4 @@ describe("CollectionPicker", () => {
       screen.getByText("No collections yet. Make one in Collections first."),
     ).toBeInTheDocument();
   });
-
-  it("can't change a legacy Trakt row's collection", () => {
-    render(<Harness initial="ghibli" locked />);
-    for (const radio of screen.getAllByRole("radio")) expect(radio).toBeDisabled();
-    expect(
-      screen.getByText("This row follows a Trakt list, so its collection can't change."),
-    ).toBeInTheDocument();
-  });
 });
diff --git a/web/src/components/homeRows/addRow/CollectionPicker.tsx b/web/src/components/homeRows/addRow/CollectionPicker.tsx
index f0081222d2..4915ee0909 100644
--- a/web/src/components/homeRows/addRow/CollectionPicker.tsx
+++ b/web/src/components/homeRows/addRow/CollectionPicker.tsx
@@ -29,7 +29,6 @@ export function CollectionPicker({
   onPick,
   onPageIds,
   pageLabel,
-  locked = false,
 }: {
   collections: RowCollections;
   /** The collection the row shows now, or "". */
@@ -38,8 +37,6 @@ export function CollectionPicker({
   /** Collections a row on this page already shows. */
   onPageIds: ReadonlySet<string>;
   pageLabel: string;
-  /** A legacy Trakt row: the server refuses a different collection. */
-  locked?: boolean;
 }) {
   const labelId = useId();
   const [query, setQuery] = useState("");
@@ -100,11 +97,7 @@ export function CollectionPicker({
             ))}
           </div>
         </div>
-        {locked ? (
-          <p className="text-muted-foreground border-border border-b px-4 py-2.5 text-[13px]">
-            This row follows a Trakt list, so its collection can't change.
-          </p>
-        ) : missing ? (
+        {missing ? (
           <p
             role="status"
             className="border-warning/40 bg-warning/10 border-b px-4 py-2.5 text-[13px]"
@@ -116,7 +109,6 @@ export function CollectionPicker({
           <RadioGroup
             aria-labelledby={labelId}
             value={value}
-            disabled={locked}
             onValueChange={(id) => {
               const picked = options.find((option) => option.id === id);
               if (picked) onPick(picked);
@@ -171,7 +163,7 @@ function CollectionRadio({
       />
       <span className="min-w-0">
         <span className="block truncate text-sm font-semibold">{option.title}</span>
-        <span aria-hidden className="text-muted-foreground block truncate text-[12.5px]">
+        <span aria-hidden className="text-muted-foreground block truncate text-[13px]">
           {meta}
         </span>
         <span id={metaId} className="sr-only">
@@ -181,7 +173,7 @@ function CollectionRadio({
       {onPage ? (
         <span
           aria-hidden
-          className="bg-background/70 ring-border inline-flex h-[22px] items-center gap-1 rounded-full px-2 text-[11.5px] font-semibold ring-1 ring-inset"
+          className="bg-background/70 ring-border inline-flex h-[22px] items-center gap-1 rounded-full px-2 text-xs font-semibold ring-1 ring-inset"
         >
           <Check className="text-success size-3" />
           On {pageLabel}
diff --git a/web/src/components/homeRows/addRow/ParamFields.tsx b/web/src/components/homeRows/addRow/ParamFields.tsx
index c8834e0880..429ed6c1f5 100644
--- a/web/src/components/homeRows/addRow/ParamFields.tsx
+++ b/web/src/components/homeRows/addRow/ParamFields.tsx
@@ -1,6 +1,5 @@
-import { useId, useState, type ReactNode } from "react";
+import { useId, type ReactNode } from "react";
 import LibraryMultiSelect from "@/components/LibraryMultiSelect";
-import { Checkbox } from "@/components/ui/checkbox";
 import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
 import {
@@ -13,7 +12,8 @@ import {
 import { Switch } from "@/components/ui/switch";
 import { sectionLibraryFilterIds, withSectionLibraryFilterIds } from "@/lib/sectionLibraryFilter";
 import { hasParamFields } from "@/lib/homeRows/paramFields";
-import { SEASONAL_THEME_LABELS } from "@/lib/homeRows/variants";
+import { variantOf } from "@/lib/homeRows/variants";
+import { FamilyNightFields, HolidayFields } from "./SeasonalFields";
 
 type Config = Record<string, unknown>;
 
@@ -271,113 +271,6 @@ function SpotlightFields({ config, onChange }: FieldProps) {
   );
 }
 
-// Order matches SeasonalThemeOrder on the server: earlier holidays win when
-// several are in season at once. Family movie night is its own variant, so it
-// isn't offered here; a stored one stays in the list.
-const HOLIDAYS = [
-  { key: "valentines", when: "Feb 7–14" },
-  { key: "st_patricks", when: "Mar 15–17" },
-  { key: "thanksgiving", when: "Nov 22–30" },
-  { key: "christmas", when: "December" },
-  { key: "halloween", when: "October" },
-  { key: "saturday_morning", when: "Saturdays before 1pm" },
-  { key: "summer_blockbuster", when: "June to August" },
-].map((holiday) => ({ ...holiday, label: SEASONAL_THEME_LABELS[holiday.key]! }));
-
-function enabledHolidays(config: Config): string[] {
-  if (Array.isArray(config.enabled_themes)) {
-    return config.enabled_themes.filter((value): value is string => typeof value === "string");
-  }
-  // A legacy single-holiday row starts from its one holiday.
-  return typeof config.theme === "string" && config.theme ? [config.theme] : [];
-}
-
-function HolidayChecklist({ config, onChange }: FieldProps) {
-  const id = useId();
-  // The name box being typed in, as typed: the draft gets it trimmed, so a
-  // space typed between words would otherwise vanish before the next word.
-  const [typed, setTyped] = useState<{ key: string; text: string } | null>(null);
-  const enabled = new Set(enabledHolidays(config));
-  const titles: Record<string, string> = {};
-  if (config.theme_titles && typeof config.theme_titles === "object") {
-    for (const [key, value] of Object.entries(config.theme_titles)) {
-      if (typeof value === "string") titles[key] = value;
-    }
-  }
-
-  function commit(nextEnabled: Set<string>, nextTitles: Record<string, string>) {
-    // Keep only titles for holidays that are on, so the saved config stays tidy.
-    const kept = Object.fromEntries(
-      Object.entries(nextTitles)
-        .filter(([key]) => nextEnabled.has(key))
-        .map(([key, value]) => [key, value.trim()] as const)
-        .filter(([, value]) => value !== ""),
-    );
-    onChange({
-      ...config,
-      enabled_themes: Array.from(nextEnabled),
-      theme_titles: Object.keys(kept).length > 0 ? kept : undefined,
-      // Legacy single-theme keys would shadow the list on the server.
-      theme: "",
-      mode: "",
-    });
-  }
-
-  return (
-    <fieldset className="grid gap-2">
-      <legend className="mb-2 text-sm font-medium">Holidays</legend>
-      <div className="border-border divide-border/70 divide-y rounded-xl border">
-        {HOLIDAYS.map((holiday) => {
-          const on = enabled.has(holiday.key);
-          const checkboxId = `${id}-${holiday.key}`;
-          return (
-            <div key={holiday.key} className="grid gap-2 px-3.5 py-2.5">
-              <div className="flex items-center gap-3">
-                <Checkbox
-                  id={checkboxId}
-                  checked={on}
-                  onCheckedChange={(checked) => {
-                    const next = new Set(enabled);
-                    if (checked === true) next.add(holiday.key);
-                    else next.delete(holiday.key);
-                    commit(next, titles);
-                  }}
-                />
-                <Label htmlFor={checkboxId} className="font-normal">
-                  {holiday.label}
-                </Label>
-                <span className="text-muted-foreground ml-auto text-xs">{holiday.when}</span>
-              </div>
-              {on ? (
-                <Input
-                  aria-label={`Row name during ${holiday.label}`}
-                  placeholder={`Name in season (defaults to "${holiday.label}")`}
-                  className="h-8 text-[13px]"
-                  value={typed?.key === holiday.key ? typed.text : (titles[holiday.key] ?? "")}
-                  onChange={(event) => {
-                    setTyped({ key: holiday.key, text: event.target.value });
-                    commit(enabled, { ...titles, [holiday.key]: event.target.value });
-                  }}
-                  onBlur={() => setTyped(null)}
-                />
-              ) : null}
-            </div>
-          );
-        })}
-      </div>
-      {HOLIDAYS.some((holiday) => enabled.has(holiday.key)) ? (
-        <p className="text-muted-foreground text-[13px]">
-          The row shows whichever holiday is in season and hides itself when none is.
-        </p>
-      ) : (
-        <p role="status" className="text-destructive text-[13px]">
-          Pick at least one holiday.
-        </p>
-      )}
-    </fieldset>
-  );
-}
-
 /**
  * The plain settings a ready-made row keeps, in one of two places: next to
  * the variant ("primary") or under More options ("more"). The raw Anchor item
@@ -399,11 +292,14 @@ export function ParamFields({
   if (!hasParamFields(sectionType, slot, config, onLibraryPage)) return null;
   const props = { config, onChange };
   if (slot === "primary") {
-    return sectionType === "seasonal_themed" ? (
-      <HolidayChecklist {...props} />
-    ) : (
-      <LibraryFilterField {...props} libraries={libraries} />
-    );
+    if (sectionType === "seasonal_themed") {
+      return variantOf(sectionType, config) === "se_family_movie_night" ? (
+        <FamilyNightFields {...props} />
+      ) : (
+        <HolidayFields {...props} />
+      );
+    }
+    return <LibraryFilterField {...props} libraries={libraries} />;
   }
   switch (sectionType) {
     case "watchlist":
diff --git a/web/src/components/homeRows/addRow/PickerRail.tsx b/web/src/components/homeRows/addRow/PickerRail.tsx
index aa4d28da90..f57081c0e2 100644
--- a/web/src/components/homeRows/addRow/PickerRail.tsx
+++ b/web/src/components/homeRows/addRow/PickerRail.tsx
@@ -52,7 +52,7 @@ export function PickerRail({
       className={cn(
         vertical
           ? "grid content-start gap-0.5"
-          : "flex [scrollbar-width:none] gap-2 overflow-x-auto px-5 pb-1",
+          : "flex gap-2 overflow-x-auto px-5 pb-1 [scrollbar-width:none]",
       )}
     >
       {groups.map((group, index) => {
diff --git a/web/src/components/homeRows/addRow/RowCard.tsx b/web/src/components/homeRows/addRow/RowCard.tsx
index 73dde36fd5..ef5324ca10 100644
--- a/web/src/components/homeRows/addRow/RowCard.tsx
+++ b/web/src/components/homeRows/addRow/RowCard.tsx
@@ -69,7 +69,7 @@ export function RowCard({
           ) : null}
         </span>
         {summary ? (
-          <span className="text-foreground/80 mt-1 block text-[12.5px]">{summary}</span>
+          <span className="text-foreground/80 mt-1 block text-[13px]">{summary}</span>
         ) : compact ? null : (
           <VariantChips card={card} onPick={(presetKey) => onPick(presetKey)} />
         )}
@@ -77,7 +77,7 @@ export function RowCard({
       {onPage ? (
         <span
           aria-hidden
-          className="bg-background/70 ring-border absolute top-3 right-3 inline-flex h-[22px] items-center gap-1 rounded-full px-2 text-[11.5px] font-semibold ring-1 ring-inset"
+          className="bg-background/70 ring-border absolute top-3 right-3 inline-flex h-[22px] items-center gap-1 rounded-full px-2 text-xs font-semibold ring-1 ring-inset"
         >
           <Check className="text-success size-3" />
           On {pageLabel}
diff --git a/web/src/components/homeRows/addRow/RowForm.tsx b/web/src/components/homeRows/addRow/RowForm.tsx
index 27f1572474..5eef1255cd 100644
--- a/web/src/components/homeRows/addRow/RowForm.tsx
+++ b/web/src/components/homeRows/addRow/RowForm.tsx
@@ -16,7 +16,7 @@ import {
 } from "@/lib/homeRows/rowDraft";
 import { BULK_LIBRARY_LIMIT } from "@/lib/homeRows/bulkCopy";
 import type { LibraryPage, RowCollections } from "@/lib/homeRows/types";
-import { kindLocked, variantFamily } from "@/lib/homeRows/variants";
+import { variantFamily } from "@/lib/homeRows/variants";
 import { FILTER_SECTION_TYPES } from "@/lib/sectionTypes";
 import { CollectionPicker } from "./CollectionPicker";
 import { CuratedTitlesEditor } from "./CuratedTitlesEditor";
@@ -82,7 +82,6 @@ function KindControl({
         value={choices.value}
         onPageIds={choices.onPageIds}
         pageLabel={choices.pageLabel}
-        locked={kindLocked(draft.config)}
         onPick={(option) => onChange(withCollection(draft, option, choices.current?.title))}
       />
     );
@@ -139,7 +138,7 @@ export function RowForm({
   previewOffText: string;
   /** Edit row only. */
   shows?: ShowsLine;
-  /** No variant control: legacy Trakt rows and Continue Reading rows. */
+  /** No variant control: Continue Reading rows. */
   variantLocked: boolean;
   libraries: ParamLibrary[];
   onLibraryPage: boolean;
@@ -204,7 +203,8 @@ export function RowForm({
   );
   const showsLine = shows ? <ShowsSummary sectionType={draft.sectionType} {...shows} /> : null;
   return (
-    <div className="grid gap-5">
+    // minmax(0,1fr): a truncated line or a wide control can't widen the form past a phone screen.
+    <div className="grid grid-cols-[minmax(0,1fr)] gap-5">
       {CONTROL_KINDS.has(draft.sectionType) ? (
         <>
           {showsLine}
diff --git a/web/src/components/homeRows/addRow/RowPicker.tsx b/web/src/components/homeRows/addRow/RowPicker.tsx
index 1300ef0b70..83958e8a7d 100644
--- a/web/src/components/homeRows/addRow/RowPicker.tsx
+++ b/web/src/components/homeRows/addRow/RowPicker.tsx
@@ -88,7 +88,7 @@ export function RowPicker({
           orientation={narrow ? "horizontal" : "vertical"}
         />
         {narrow ? null : (
-          <p className="border-border text-muted-foreground mx-1 mt-3.5 border-t px-2 pt-3.5 text-[12.5px] leading-[1.55]">
+          <p className="border-border text-muted-foreground mx-1 mt-3.5 border-t px-2 pt-3.5 text-[13px] leading-[1.55]">
             Rows marked <b className="text-foreground font-medium">On {pageLabel}</b> are already
             here. You can add them again with other settings.
           </p>
diff --git a/web/src/components/homeRows/addRow/SeasonalFields.test.tsx b/web/src/components/homeRows/addRow/SeasonalFields.test.tsx
new file mode 100644
index 0000000000..382acb152e
--- /dev/null
+++ b/web/src/components/homeRows/addRow/SeasonalFields.test.tsx
@@ -0,0 +1,126 @@
+import { useState } from "react";
+import { cleanup, render, screen, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
+import { canSaveDraft } from "@/lib/homeRows/rowDraft";
+import { HolidayFields } from "./SeasonalFields";
+import seasonalThemes from "../../../../../contracts/api/v2/fixtures/list_seasonal_themes_ok.json";
+
+// The real catalog body the server's contract fixture pins.
+vi.mock("@/hooks/queries/seasonalThemes", () => ({
+  useSeasonalThemes: () => ({ data: seasonalThemes, isError: false }),
+}));
+
+// Radix Select drives pointer capture and scrolling that jsdom lacks.
+beforeAll(() => {
+  Object.defineProperties(Element.prototype, {
+    hasPointerCapture: { configurable: true, value: () => false },
+    setPointerCapture: { configurable: true, value: () => {} },
+    releasePointerCapture: { configurable: true, value: () => {} },
+    scrollIntoView: { configurable: true, value: () => {} },
+  });
+});
+
+afterEach(cleanup);
+
+type Config = Record<string, unknown>;
+
+/** Renders the Holidays fields over a config and exposes what they last saved. */
+function renderHolidays(initial: Config = { enabled_themes: ["halloween", "saturday_morning"] }) {
+  const latest = { config: initial };
+  function Harness() {
+    const [config, setConfig] = useState(initial);
+    return (
+      <HolidayFields
+        config={config}
+        onChange={(next) => {
+          latest.config = next;
+          setConfig(next);
+        }}
+      />
+    );
+  }
+  render(<Harness />);
+  const canSave = () =>
+    canSaveDraft({
+      sectionType: "seasonal_themed",
+      title: "Seasonal Picks",
+      titleFollowsVariant: false,
+      config: latest.config,
+      itemLimit: 20,
+      hero: false,
+    });
+  return { latest, canSave };
+}
+
+describe("Holiday fields", () => {
+  it("picks a vibe per holiday, names the row after it, and can skip recommendations", async () => {
+    const { latest } = renderHolidays();
+    const name = screen.getByRole("textbox", { name: "Row name during Halloween" });
+    expect(name).toHaveAttribute(
+      "placeholder",
+      'Name in season (defaults to "Halloween Favorites")',
+    );
+    await userEvent.click(screen.getByRole("combobox", { name: "Vibe for Halloween" }));
+    await userEvent.click(await screen.findByRole("option", { name: "Family Halloween" }));
+    expect(name).toHaveAttribute("placeholder", 'Name in season (defaults to "Family Halloween")');
+    await userEvent.click(screen.getByRole("combobox", { name: "Picks from" }));
+    await userEvent.click(await screen.findByRole("option", { name: "The lists only" }));
+    expect(latest.config).toMatchObject({ vibes: { halloween: "family" }, source: "lists" });
+  });
+
+  it("moves a holiday to dates of the user's own, except weekly ones", async () => {
+    const { latest, canSave } = renderHolidays();
+    expect(screen.getByText("Leave empty for the usual dates (October).")).toBeInTheDocument();
+    expect(
+      screen.queryByRole("textbox", { name: "Saturday Morning starts (MM-DD)" }),
+    ).not.toBeInTheDocument();
+    await userEvent.type(
+      screen.getByRole("textbox", { name: "Halloween starts (MM-DD)" }),
+      "10-20",
+    );
+    expect(screen.getByText(/Enter both dates as MM-DD/)).toBeInTheDocument();
+    expect(canSave()).toBe(false);
+    await userEvent.type(screen.getByRole("textbox", { name: "Halloween ends (MM-DD)" }), "11-02");
+    expect(screen.getByText("Oct 20–Nov 2")).toBeInTheDocument();
+    expect(canSave()).toBe(true);
+    expect(latest.config.theme_dates).toEqual({ halloween: { start: "10-20", end: "11-02" } });
+  });
+
+  it("adds a holiday of its own and allows saving only once it is complete", async () => {
+    const { latest, canSave } = renderHolidays();
+    await userEvent.click(screen.getByRole("button", { name: "Add a holiday" }));
+    expect(screen.getByText("Give the holiday a name.")).toBeInTheDocument();
+    expect(canSave()).toBe(false);
+    await userEvent.type(
+      screen.getByRole("textbox", { name: "Name of holiday 1" }),
+      "Fourth of July",
+    );
+    const holiday = screen.getByRole("group", { name: "Your holidays" });
+    await userEvent.type(
+      within(holiday).getByRole("textbox", { name: "Fourth of July starts (MM-DD)" }),
+      "07-01",
+    );
+    await userEvent.type(
+      within(holiday).getByRole("textbox", { name: "Fourth of July ends (MM-DD)" }),
+      "07-04",
+    );
+    // Paste the links: typing them key by key is slow under a full parallel run.
+    const list = within(holiday).getByRole("textbox", { name: "Fourth of July MDBList list" });
+    await userEvent.click(list);
+    await userEvent.paste("https://example.com/lists/a/b");
+    expect(screen.getByText(/Use a public MDBList list link/)).toBeInTheDocument();
+    expect(canSave()).toBe(false);
+    await userEvent.clear(list);
+    await userEvent.paste("https://mdblist.com/lists/a/fourth");
+    expect(canSave()).toBe(true);
+    expect(latest.config.custom_holidays).toEqual([
+      {
+        name: "Fourth of July",
+        start: "07-01",
+        end: "07-04",
+        list_url: "https://mdblist.com/lists/a/fourth",
+      },
+    ]);
+  });
+});
diff --git a/web/src/components/homeRows/addRow/SeasonalFields.tsx b/web/src/components/homeRows/addRow/SeasonalFields.tsx
new file mode 100644
index 0000000000..9cfe347bab
--- /dev/null
+++ b/web/src/components/homeRows/addRow/SeasonalFields.tsx
@@ -0,0 +1,441 @@
+import { useId, useState } from "react";
+import { Plus, Trash2 } from "lucide-react";
+import { Button } from "@/components/ui/button";
+import { Checkbox } from "@/components/ui/checkbox";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from "@/components/ui/select";
+import {
+  useSeasonalThemes,
+  type SeasonalTheme,
+  type SeasonalVibe,
+} from "@/hooks/queries/seasonalThemes";
+import {
+  customHolidayProblem,
+  customHolidaysOf,
+  holidayDatesProblem,
+  holidayDatesLabel,
+  themeDatesOf,
+  type CustomHoliday,
+  type HolidayDates,
+} from "@/lib/homeRows/seasonal";
+
+type Config = Record<string, unknown>;
+
+interface FieldProps {
+  config: Config;
+  onChange: (next: Config) => void;
+}
+
+/** Family movie night is its own variant, so the holiday list leaves it out. */
+const FAMILY_NIGHT = "family_movie_night";
+
+function enabledHolidays(config: Config): string[] {
+  if (Array.isArray(config.enabled_themes)) {
+    return config.enabled_themes.filter((value): value is string => typeof value === "string");
+  }
+  // A legacy single-holiday row starts from its one holiday.
+  return typeof config.theme === "string" && config.theme ? [config.theme] : [];
+}
+
+function stringMap(value: unknown): Record<string, string> {
+  const out: Record<string, string> = {};
+  if (value && typeof value === "object") {
+    for (const [key, entry] of Object.entries(value)) {
+      if (typeof entry === "string") out[key] = entry;
+    }
+  }
+  return out;
+}
+
+function chosenVibe(theme: SeasonalTheme, vibes: Record<string, string>): SeasonalVibe {
+  return theme.vibes.find((vibe) => vibe.key === vibes[theme.key]) ?? theme.vibes[0]!;
+}
+
+function CatalogStatus({ isError }: { isError: boolean }) {
+  return (
+    <p role="status" className="text-muted-foreground text-[13px]">
+      {isError ? "Couldn't load the holidays. Close and try again." : "Loading holidays…"}
+    </p>
+  );
+}
+
+function VibeSelect({
+  theme,
+  value,
+  onChange,
+}: {
+  theme: SeasonalTheme;
+  value: SeasonalVibe;
+  onChange: (key: string) => void;
+}) {
+  return (
+    <div className="grid gap-1">
+      <Select value={value.key} onValueChange={onChange}>
+        <SelectTrigger aria-label={`Vibe for ${theme.name}`} className="h-8 w-full text-[13px]">
+          <SelectValue />
+        </SelectTrigger>
+        <SelectContent>
+          {theme.vibes.map((vibe) => (
+            <SelectItem key={vibe.key} value={vibe.key}>
+              {vibe.name}
+            </SelectItem>
+          ))}
+        </SelectContent>
+      </Select>
+      <p className="text-muted-foreground text-xs">{value.description}</p>
+    </div>
+  );
+}
+
+function MonthDayInput({
+  label,
+  placeholder,
+  value,
+  onChange,
+}: {
+  label: string;
+  placeholder: string;
+  value: string;
+  onChange: (value: string) => void;
+}) {
+  return (
+    <Input
+      aria-label={label}
+      placeholder={placeholder}
+      inputMode="numeric"
+      maxLength={5}
+      className="h-8 w-24 text-[13px]"
+      value={value}
+      onChange={(event) => onChange(event.target.value)}
+    />
+  );
+}
+
+/** A holiday's own dates; empty keeps its usual window. */
+function HolidayDatesFields({
+  theme,
+  dates,
+  onChange,
+}: {
+  theme: SeasonalTheme;
+  dates: HolidayDates | undefined;
+  onChange: (next: HolidayDates | undefined) => void;
+}) {
+  const value = dates ?? { start: "", end: "" };
+  const set = (patch: Partial<HolidayDates>) => {
+    const next = { ...value, ...patch };
+    onChange(next.start === "" && next.end === "" ? undefined : next);
+  };
+  const problem = dates ? holidayDatesProblem(dates) : null;
+  return (
+    <div className="grid gap-1">
+      {/* On the narrowest phones the dates wrap under "In season", kept together. */}
+      <div className="flex flex-wrap items-center gap-x-2 gap-y-1.5 text-[13px]">
+        <span className="text-muted-foreground">In season</span>
+        <span className="flex items-center gap-2">
+          <MonthDayInput
+            label={`${theme.name} starts (MM-DD)`}
+            placeholder="MM-DD"
+            value={value.start}
+            onChange={(start) => set({ start })}
+          />
+          <span className="text-muted-foreground">to</span>
+          <MonthDayInput
+            label={`${theme.name} ends (MM-DD)`}
+            placeholder="MM-DD"
+            value={value.end}
+            onChange={(end) => set({ end })}
+          />
+        </span>
+      </div>
+      {problem ? (
+        <p className="text-destructive text-xs">{problem}</p>
+      ) : (
+        <p className="text-muted-foreground text-xs">
+          {dates
+            ? "Every year on these dates."
+            : `Leave empty for the usual dates (${theme.when}).`}
+        </p>
+      )}
+    </div>
+  );
+}
+
+const SOURCES = [
+  {
+    value: "recommendations",
+    label: "Prairie recommendations",
+    hint: "The list's titles you have, most popular first, then similar titles from your library.",
+  },
+  {
+    value: "lists",
+    label: "The lists only",
+    hint: "Only the list's titles you have, most popular first.",
+  },
+];
+
+function SourceField({ config, onChange }: FieldProps) {
+  const id = useId();
+  const value = config.source === "lists" ? "lists" : "recommendations";
+  const hint = SOURCES.find((source) => source.value === value)!.hint;
+  return (
+    <div className="grid gap-1.5">
+      <Label htmlFor={`${id}-source`}>Picks from</Label>
+      <Select
+        value={value}
+        onValueChange={(next) =>
+          onChange({ ...config, source: next === "recommendations" ? undefined : next })
+        }
+      >
+        <SelectTrigger id={`${id}-source`} className="w-full">
+          <SelectValue />
+        </SelectTrigger>
+        <SelectContent>
+          {SOURCES.map((source) => (
+            <SelectItem key={source.value} value={source.value}>
+              {source.label}
+            </SelectItem>
+          ))}
+        </SelectContent>
+      </Select>
+      <p className="text-muted-foreground text-[13px]">{hint}</p>
+    </div>
+  );
+}
+
+function CustomHolidays({ config, onChange, max }: FieldProps & { max: number }) {
+  const holidays = customHolidaysOf(config);
+  const commit = (next: CustomHoliday[]) =>
+    onChange({ ...config, custom_holidays: next.length > 0 ? next : undefined });
+  const update = (index: number, patch: Partial<CustomHoliday>) =>
+    commit(holidays.map((holiday, i) => (i === index ? { ...holiday, ...patch } : holiday)));
+
+  return (
+    <fieldset className="grid gap-2">
+      <legend className="mb-1 text-sm font-medium">Your holidays</legend>
+      <p className="text-muted-foreground text-[13px]">
+        Add a holiday of your own with any public MDBList list. It shows ahead of the built-in
+        holidays while it's in season.
+      </p>
+      {holidays.map((holiday, index) => {
+        const label = holiday.name.trim() || `Holiday ${index + 1}`;
+        const problem = customHolidayProblem(holiday);
+        return (
+          <div key={index} className="border-border grid gap-2 rounded-xl border px-3.5 py-3">
+            <div className="flex items-center gap-2">
+              <Input
+                aria-label={`Name of holiday ${index + 1}`}
+                placeholder="Name, e.g. Fourth of July"
+                className="h-8 text-[13px]"
+                value={holiday.name}
+                onChange={(event) => update(index, { name: event.target.value })}
+              />
+              <Button
+                type="button"
+                variant="ghost"
+                size="icon"
+                aria-label={`Remove ${label}`}
+                onClick={() => commit(holidays.filter((_, i) => i !== index))}
+              >
+                <Trash2 className="size-4" />
+              </Button>
+            </div>
+            <div className="flex items-center gap-2 text-[13px]">
+              <MonthDayInput
+                label={`${label} starts (MM-DD)`}
+                placeholder="MM-DD"
+                value={holiday.start}
+                onChange={(start) => update(index, { start })}
+              />
+              <span className="text-muted-foreground">to</span>
+              <MonthDayInput
+                label={`${label} ends (MM-DD)`}
+                placeholder="MM-DD"
+                value={holiday.end}
+                onChange={(end) => update(index, { end })}
+              />
+            </div>
+            <Input
+              aria-label={`${label} MDBList list`}
+              placeholder="https://mdblist.com/lists/…"
+              className="h-8 text-[13px]"
+              value={holiday.list_url}
+              onChange={(event) => update(index, { list_url: event.target.value })}
+            />
+            {problem ? <p className="text-destructive text-xs">{problem}</p> : null}
+          </div>
+        );
+      })}
+      {holidays.length < max ? (
+        <Button
+          type="button"
+          variant="outline"
+          size="sm"
+          className="justify-self-start"
+          onClick={() => commit([...holidays, { name: "", start: "", end: "", list_url: "" }])}
+        >
+          <Plus className="size-4" /> Add a holiday
+        </Button>
+      ) : null}
+    </fieldset>
+  );
+}
+
+/** The Holidays variant: which holidays, a vibe and name for each, and your own holidays. */
+export function HolidayFields({ config, onChange }: FieldProps) {
+  const id = useId();
+  const catalog = useSeasonalThemes();
+  // The name box being typed in, as typed: the draft gets it trimmed, so a
+  // space typed between words would otherwise vanish before the next word.
+  const [typed, setTyped] = useState<{ key: string; text: string } | null>(null);
+  if (!catalog.data) return <CatalogStatus isError={catalog.isError} />;
+
+  const themes = catalog.data.themes.filter((theme) => theme.key !== FAMILY_NIGHT);
+  const enabled = new Set(enabledHolidays(config));
+  const titles = stringMap(config.theme_titles);
+  const vibes = stringMap(config.vibes);
+  const dates = themeDatesOf(config);
+  const hasCustom = customHolidaysOf(config).length > 0;
+
+  function commit(
+    nextEnabled: Set<string>,
+    nextTitles: Record<string, string>,
+    nextVibes = vibes,
+    nextDates = dates,
+  ) {
+    // Keep only titles, vibes and dates for holidays that are on, so the saved config stays tidy.
+    const forEnabled = <T,>(entries: Record<string, T>) =>
+      Object.entries(entries).filter(([key]) => nextEnabled.has(key));
+    const orUndefined = <T,>(entries: [string, T][]) =>
+      entries.length > 0 ? Object.fromEntries(entries) : undefined;
+    onChange({
+      ...config,
+      enabled_themes: Array.from(nextEnabled),
+      theme_titles: orUndefined(
+        forEnabled(nextTitles)
+          .map(([key, value]) => [key, value.trim()] as [string, string])
+          .filter(([, value]) => value !== ""),
+      ),
+      vibes: orUndefined(forEnabled(nextVibes)),
+      theme_dates: orUndefined(forEnabled(nextDates)),
+      // Legacy single-theme keys would shadow the list on the server.
+      theme: "",
+      mode: "",
+    });
+  }
+
+  return (
+    <div className="grid gap-5">
+      <fieldset className="grid gap-2">
+        <legend className="mb-2 text-sm font-medium">Holidays</legend>
+        <div className="border-border divide-border/70 divide-y rounded-xl border">
+          {themes.map((theme) => {
+            const on = enabled.has(theme.key);
+            const checkboxId = `${id}-${theme.key}`;
+            const vibe = chosenVibe(theme, vibes);
+            const own = dates[theme.key];
+            const when = own && !holidayDatesProblem(own) ? holidayDatesLabel(own) : theme.when;
+            return (
+              <div key={theme.key} className="grid gap-2 px-3.5 py-2.5">
+                <div className="flex items-center gap-3">
+                  <Checkbox
+                    id={checkboxId}
+                    checked={on}
+                    onCheckedChange={(checked) => {
+                      const next = new Set(enabled);
+                      if (checked === true) next.add(theme.key);
+                      else next.delete(theme.key);
+                      commit(next, titles);
+                    }}
+                  />
+                  <Label htmlFor={checkboxId} className="font-normal">
+                    {theme.name}
+                  </Label>
+                  <span className="text-muted-foreground ml-auto text-xs">{when}</span>
+                </div>
+                {on ? (
+                  <div className="grid gap-2 pl-7">
+                    {theme.vibes.length > 1 ? (
+                      <VibeSelect
+                        theme={theme}
+                        value={vibe}
+                        onChange={(key) => commit(enabled, titles, { ...vibes, [theme.key]: key })}
+                      />
+                    ) : null}
+                    <Input
+                      aria-label={`Row name during ${theme.name}`}
+                      placeholder={`Name in season (defaults to "${vibe.title}")`}
+                      className="h-8 text-[13px]"
+                      value={typed?.key === theme.key ? typed.text : (titles[theme.key] ?? "")}
+                      onChange={(event) => {
+                        setTyped({ key: theme.key, text: event.target.value });
+                        commit(enabled, { ...titles, [theme.key]: event.target.value });
+                      }}
+                      onBlur={() => setTyped(null)}
+                    />
+                    {theme.dates_editable ? (
+                      <HolidayDatesFields
+                        theme={theme}
+                        dates={own}
+                        onChange={(next) => {
+                          const { [theme.key]: _previous, ...others } = dates;
+                          commit(
+                            enabled,
+                            titles,
+                            vibes,
+                            next ? { ...others, [theme.key]: next } : others,
+                          );
+                        }}
+                      />
+                    ) : null}
+                  </div>
+                ) : null}
+              </div>
+            );
+          })}
+        </div>
+        {themes.some((theme) => enabled.has(theme.key)) || hasCustom ? (
+          <p className="text-muted-foreground text-[13px]">
+            The row shows whichever holiday is in season and hides itself when none is.
+          </p>
+        ) : (
+          <p role="status" className="text-destructive text-[13px]">
+            Pick at least one holiday or add your own.
+          </p>
+        )}
+      </fieldset>
+      <CustomHolidays config={config} onChange={onChange} max={catalog.data.max_custom_holidays} />
+      <SourceField config={config} onChange={onChange} />
+    </div>
+  );
+}
+
+/** The Family movie night variant: its vibe and where its picks come from. */
+export function FamilyNightFields({ config, onChange }: FieldProps) {
+  const catalog = useSeasonalThemes();
+  if (!catalog.data) return <CatalogStatus isError={catalog.isError} />;
+  const theme = catalog.data.themes.find((entry) => entry.key === FAMILY_NIGHT);
+  const vibes = stringMap(config.vibes);
+  return (
+    <div className="grid gap-5">
+      {theme && theme.vibes.length > 1 ? (
+        <div className="grid gap-1.5">
+          <Label>Vibe</Label>
+          <VibeSelect
+            theme={theme}
+            value={chosenVibe(theme, vibes)}
+            onChange={(key) => onChange({ ...config, vibes: { [FAMILY_NIGHT]: key } })}
+          />
+        </div>
+      ) : null}
+      <SourceField config={config} onChange={onChange} />
+    </div>
+  );
+}
diff --git a/web/src/components/homeRows/addRow/ShowsSummary.tsx b/web/src/components/homeRows/addRow/ShowsSummary.tsx
index 9ff5763c88..2ca50ead8d 100644
--- a/web/src/components/homeRows/addRow/ShowsSummary.tsx
+++ b/web/src/components/homeRows/addRow/ShowsSummary.tsx
@@ -13,13 +13,13 @@ export function ShowsSummary({
   sectionType: string;
   label: string;
   sentence: string;
-  /** Omitted when the kind cannot change (legacy Trakt rows). */
+  /** Omitted when the kind cannot change (a server row on Settings > Home Screen). */
   onChange?: () => void;
 }) {
   const group = rowKindGroup(sectionType);
   const Icon = KIND_ICONS[sectionType] ?? GROUP_ICONS[group];
   return (
-    <div className="grid gap-2">
+    <div className="grid grid-cols-[minmax(0,1fr)] gap-2">
       <span className="text-sm font-medium">Shows</span>
       <div className="border-border flex items-center gap-3 rounded-xl border py-2.5 pr-3 pl-2.5">
         <span
@@ -33,7 +33,7 @@ export function ShowsSummary({
         </span>
         <span className="min-w-0 flex-1">
           <span className="block truncate text-sm font-semibold">{label}</span>
-          <span className="text-muted-foreground block truncate text-[12.5px]">{sentence}</span>
+          <span className="text-muted-foreground block truncate text-[13px]">{sentence}</span>
         </span>
         {onChange ? (
           <Button
diff --git a/web/src/components/homeRows/addRow/VariantChips.tsx b/web/src/components/homeRows/addRow/VariantChips.tsx
index e0f2a5f2eb..7514136e69 100644
--- a/web/src/components/homeRows/addRow/VariantChips.tsx
+++ b/web/src/components/homeRows/addRow/VariantChips.tsx
@@ -22,13 +22,13 @@ export function VariantChips({
           type="button"
           aria-label={`${card.label}, ${option.chip}`}
           onClick={() => onPick(option.presetKey)}
-          className="border-border bg-background/60 text-foreground/80 hover:bg-secondary hover:text-foreground focus-visible:ring-ring/50 inline-flex h-[26px] items-center rounded-full border px-2.5 text-[12.5px] font-medium whitespace-nowrap outline-none focus-visible:ring-[3px]"
+          className="border-border bg-background/60 text-foreground/80 hover:bg-secondary hover:text-foreground focus-visible:ring-ring/50 inline-flex h-[26px] items-center rounded-full border px-2.5 text-[13px] font-medium whitespace-nowrap outline-none focus-visible:ring-[3px]"
         >
           {option.chip}
         </button>
       ))}
       {hidden > 0 ? (
-        <span className="border-border text-muted-foreground inline-flex h-[26px] items-center rounded-full border border-dashed px-2.5 text-[12.5px] font-medium">
+        <span className="border-border text-muted-foreground inline-flex h-[26px] items-center rounded-full border border-dashed px-2.5 text-[13px] font-medium">
           +{hidden}
         </span>
       ) : null}
diff --git a/web/src/components/homeRows/notes.tsx b/web/src/components/homeRows/notes.tsx
index a24dd2b7fe..a8c9f677c4 100644
--- a/web/src/components/homeRows/notes.tsx
+++ b/web/src/components/homeRows/notes.tsx
@@ -33,7 +33,7 @@ function Key({ children, label }: { children: string; label?: string }) {
   return (
     <kbd
       aria-label={label}
-      className="border-border bg-background text-foreground inline-grid h-5 min-w-5 place-items-center rounded-md border px-1.5 text-[11px] font-medium"
+      className="border-border bg-background text-foreground inline-grid h-5 min-w-5 place-items-center rounded-md border px-1.5 text-xs font-medium"
     >
       {children}
     </kbd>
diff --git a/web/src/components/markers/RedetectMarkersDialog.tsx b/web/src/components/markers/RedetectMarkersDialog.tsx
index 52a348effa..8b58d3d3a2 100644
--- a/web/src/components/markers/RedetectMarkersDialog.tsx
+++ b/web/src/components/markers/RedetectMarkersDialog.tsx
@@ -118,7 +118,7 @@ export default function RedetectMarkersDialog({
         <div className="flex items-center justify-end gap-3">
           {anyOff && (
             <Link
-              to="/admin/settings/library"
+              to="/admin/settings/playback"
               className="text-muted-foreground hover:text-foreground mr-auto text-sm underline underline-offset-4 transition-colors"
             >
               Change marker settings
diff --git a/web/src/components/notifications/NotificationPoster.tsx b/web/src/components/notifications/NotificationPoster.tsx
new file mode 100644
index 0000000000..5bfd71db25
--- /dev/null
+++ b/web/src/components/notifications/NotificationPoster.tsx
@@ -0,0 +1,22 @@
+import { decodeThumbhash } from "@/lib/thumbhash";
+
+/** A notification row's poster; the thumbhash shows while the image loads. */
+export function NotificationPoster({ url, thumbhash }: { url?: string; thumbhash?: string }) {
+  const thumbhashUrl = thumbhash ? decodeThumbhash(thumbhash) : "";
+  return (
+    <div
+      className="bg-muted relative h-16 w-11 shrink-0 overflow-hidden rounded-md"
+      style={
+        thumbhashUrl
+          ? {
+              backgroundImage: `url(${thumbhashUrl})`,
+              backgroundSize: "cover",
+              backgroundPosition: "center",
+            }
+          : undefined
+      }
+    >
+      {url && <img src={url} alt="" className="h-full w-full object-cover" loading="lazy" />}
+    </div>
+  );
+}
diff --git a/web/src/components/notifications/NotifiedSeriesList.tsx b/web/src/components/notifications/NotifiedSeriesList.tsx
new file mode 100644
index 0000000000..e1aa7a8c54
--- /dev/null
+++ b/web/src/components/notifications/NotifiedSeriesList.tsx
@@ -0,0 +1,408 @@
+import { useEffect, useState } from "react";
+import { useSearchParams } from "react-router";
+import { Bell, BellOff, Search } from "lucide-react";
+import type { NotificationPreferences } from "@/api/types";
+import type { NotifiedSeries, NotifiedSeriesOptions } from "@/api/v2/notifications";
+import ViewTransitionLink from "@/components/ViewTransitionLink";
+import { buildItemHref } from "@/lib/mediaNavigation";
+import { cn } from "@/lib/utils";
+import { LoadMoreOnScroll } from "@/components/LoadMoreOnScroll";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from "@/components/ui/select";
+import { Skeleton } from "@/components/ui/skeleton";
+import {
+  formatEpisodeCode,
+  useNotificationPreferences,
+  useNotificationSeries,
+  useSetNotificationSeriesMuted,
+} from "@/hooks/queries/notifications";
+import { useDebounce } from "@/hooks/useDebounce";
+import { NotificationPoster } from "./NotificationPoster";
+import { NOTIFICATION_REASONS } from "./reasons";
+
+type Reason = (typeof NOTIFICATION_REASONS)[number]["key"];
+
+/** The preference that lets each reason notify, named as its switch is. */
+const REASON_PREFERENCES: Record<Reason, { key: keyof NotificationPreferences; label: string }> = {
+  favorite: { key: "notify_favorites", label: "Favorites" },
+  watchlist: { key: "notify_watchlist", label: "Watchlist" },
+  continue_watching: { key: "notify_continue_watching", label: "Continue Watching" },
+  next_up: { key: "notify_next_up", label: "Next Up" },
+};
+
+/** What a new episode has to be for the series to notify. */
+function triggerText(series: NotifiedSeries): string {
+  const { favorite, watchlist, continue_watching: continueWatching } = series.active_reasons;
+  const code = series.next_up_after && formatEpisodeCode(series.next_up_after);
+  if (favorite || watchlist || continueWatching || !code) return "Any new episode";
+  return `Any episode after ${code}`;
+}
+
+/** Why a listed series does not notify: the mute, or the switches that
+ * silence it. */
+function silencedText(series: NotifiedSeries, prefs: NotificationPreferences | undefined) {
+  if (series.muted) return "Muted";
+  if (prefs && !prefs.enabled) return "Notifications are off";
+  const off = prefs
+    ? NOTIFICATION_REASONS.filter(
+        (reason) => series.reasons[reason.key] && !prefs[REASON_PREFERENCES[reason.key].key],
+      ).map((reason) => REASON_PREFERENCES[reason.key].label)
+    : [];
+  if (off.length === 0) return "Won’t notify right now";
+  const names = off.length === 1 ? off[0] : `${off.slice(0, -1).join(", ")} and ${off.at(-1)}`;
+  return `${names} notifications are off`;
+}
+
+/** Mutes or unmutes a row's series; absent when the server cannot. */
+type MuteAction = {
+  pending: string | undefined;
+  set: (series: NotifiedSeries, muted: boolean) => void;
+};
+
+function NotifiedSeriesRow({
+  series,
+  prefs,
+  mute,
+}: {
+  series: NotifiedSeries;
+  prefs: NotificationPreferences | undefined;
+  mute: MuteAction | undefined;
+}) {
+  const { item } = series;
+  const muteLabel = series.muted ? "Unmute" : "Mute";
+  return (
+    <li className="hover:bg-muted/60 flex items-center gap-1 rounded-xl pr-2 transition-colors">
+      <ViewTransitionLink
+        to={buildItemHref({ contentId: item.content_id })}
+        className="flex min-w-0 flex-1 items-start gap-3 rounded-xl px-3 py-3"
+      >
+        <div className={`shrink-0 ${series.notifies ? "" : "opacity-50"}`}>
+          <NotificationPoster url={item.poster_url} thumbhash={item.poster_thumbhash} />
+        </div>
+        <div className="min-w-0 flex-1">
+          <div
+            className={`truncate text-sm font-medium ${series.notifies ? "" : "text-muted-foreground"}`}
+          >
+            {item.title}
+          </div>
+          <div className="text-muted-foreground mt-0.5 truncate text-sm">
+            {series.notifies ? triggerText(series) : silencedText(series, prefs)}
+          </div>
+          <div className="mt-1.5 flex flex-wrap gap-1">
+            {NOTIFICATION_REASONS.filter((reason) => series.reasons[reason.key]).map((reason) => {
+              const off = series.muted || !series.active_reasons[reason.key];
+              return (
+                <span
+                  key={reason.key}
+                  className={cn(
+                    "text-muted-foreground rounded-full px-2 py-0.5 text-[10px] font-medium",
+                    off ? "border-border border line-through" : "bg-muted",
+                  )}
+                >
+                  {reason.label}
+                  {off && <span className="sr-only"> (off)</span>}
+                </span>
+              );
+            })}
+          </div>
+        </div>
+      </ViewTransitionLink>
+      {mute && (
+        <Button
+          variant="ghost"
+          size="sm"
+          className="text-muted-foreground shrink-0"
+          disabled={mute.pending === item.content_id}
+          aria-label={`${muteLabel} ${item.title}`}
+          title={
+            series.muted
+              ? "Notify me about new episodes again"
+              : "Stop notifying me about new episodes"
+          }
+          onClick={() => mute.set(series, !series.muted)}
+        >
+          {series.muted ? <Bell /> : <BellOff />}
+          <span className="hidden sm:inline">{muteLabel}</span>
+        </Button>
+      )}
+    </li>
+  );
+}
+
+const REASON_FILTERS = [
+  { value: "all", label: "All reasons" },
+  { value: "favorite", label: "Favorites" },
+  { value: "watchlist", label: "Watchlist" },
+  { value: "continue_watching", label: "Continue Watching" },
+  { value: "next_up", label: "Next Up" },
+] as const;
+
+const SORTS = [
+  { value: "title", label: "Title (A–Z)" },
+  { value: "-title", label: "Title (Z–A)" },
+  { value: "-latest_episode_added", label: "Latest episode" },
+  { value: "-added_at", label: "Recently added" },
+  { value: "-year", label: "Release year" },
+] as const;
+
+type ReasonFilter = (typeof REASON_FILTERS)[number]["value"];
+type SortOption = (typeof SORTS)[number]["value"];
+
+function oneOf<T extends string>(
+  values: readonly { value: T }[],
+  value: string | null,
+  fallback: T,
+) {
+  return values.find((option) => option.value === value)?.value ?? fallback;
+}
+
+/**
+ * The Series view's search, reason filter, and sort, kept in the URL so they
+ * survive opening a series and coming back.
+ */
+function useSeriesOptions() {
+  const [params, setParams] = useSearchParams();
+  const reason = oneOf(REASON_FILTERS, params.get("reason"), "all");
+  const sort = oneOf(SORTS, params.get("sort"), "title");
+  const q = params.get("q") ?? "";
+  const set = (key: string, value: string, fallback: string) =>
+    setParams(
+      (current) => {
+        const next = new URLSearchParams(current);
+        if (value === fallback) next.delete(key);
+        else next.set(key, value);
+        return next;
+      },
+      { replace: true },
+    );
+  return {
+    reason,
+    sort,
+    q,
+    setReason: (value: ReasonFilter) => set("reason", value, "all"),
+    setSort: (value: SortOption) => set("sort", value, "title"),
+    setQ: (value: string) => set("q", value, ""),
+    options: {
+      q: q.trim(),
+      reason: reason === "all" ? undefined : reason,
+      sort,
+    } satisfies NotifiedSeriesOptions,
+  };
+}
+
+function SeriesToolbar({ series }: { series: ReturnType<typeof useSeriesOptions> }) {
+  const [text, setText] = useState(series.q);
+  const debounced = useDebounce(text, 300);
+  const setQ = series.setQ;
+  useEffect(() => {
+    if (debounced !== series.q) setQ(debounced);
+    // eslint-disable-next-line react-hooks/exhaustive-deps -- only a settled edit writes the URL; series.q follows from it
+  }, [debounced]);
+  useEffect(() => {
+    // The URL changed from elsewhere (the Series button resets it); our own
+    // writes match the settled text and leave typing in progress alone.
+    if (series.q !== debounced) setText(series.q);
+    // eslint-disable-next-line react-hooks/exhaustive-deps -- runs on URL changes only, not on each keystroke
+  }, [series.q]);
+  return (
+    <div className="mb-3 flex flex-col gap-2 px-3 sm:flex-row sm:items-center">
+      <div className="relative min-w-0 flex-1">
+        <Search className="text-muted-foreground pointer-events-none absolute top-1/2 left-2.5 h-4 w-4 -translate-y-1/2" />
+        <Input
+          type="search"
+          value={text}
+          onChange={(event) => setText(event.target.value)}
+          placeholder="Search series"
+          aria-label="Search series"
+          className="h-9 pl-8"
+        />
+      </div>
+      <div className="flex gap-2">
+        <Select
+          value={series.reason}
+          onValueChange={(value) => series.setReason(value as ReasonFilter)}
+        >
+          <SelectTrigger
+            className="h-9 flex-1 sm:w-auto sm:min-w-[9.5rem] sm:flex-none"
+            aria-label="Filter by reason"
+          >
+            <SelectValue />
+          </SelectTrigger>
+          <SelectContent>
+            {REASON_FILTERS.map((option) => (
+              <SelectItem key={option.value} value={option.value}>
+                {option.label}
+              </SelectItem>
+            ))}
+          </SelectContent>
+        </Select>
+        <Select value={series.sort} onValueChange={(value) => series.setSort(value as SortOption)}>
+          <SelectTrigger
+            className="h-9 flex-1 sm:w-auto sm:min-w-[9.5rem] sm:flex-none"
+            aria-label="Sort"
+          >
+            <SelectValue />
+          </SelectTrigger>
+          <SelectContent>
+            {SORTS.map((option) => (
+              <SelectItem key={option.value} value={option.value}>
+                {option.label}
+              </SelectItem>
+            ))}
+          </SelectContent>
+        </Select>
+      </div>
+    </div>
+  );
+}
+
+/**
+ * The Series view of the notifications page: every series whose new episodes
+ * notify this profile, then the ones that won't, because its preferences
+ * silence them or it muted them. Both lists load as the viewer scrolls; the
+ * second starts once the first is complete. With canMute, each row can mute
+ * or unmute its series.
+ */
+export function NotifiedSeriesList({
+  onOpenPreferences,
+  canMute = false,
+}: {
+  onOpenPreferences: () => void;
+  canMute?: boolean;
+}) {
+  const series = useSeriesOptions();
+  const setMuted = useSetNotificationSeriesMuted();
+  const mute: MuteAction | undefined = canMute
+    ? {
+        pending: setMuted.isPending ? setMuted.variables?.seriesId : undefined,
+        set: (entry, muted) =>
+          setMuted.mutate({ seriesId: entry.item.content_id, title: entry.item.title, muted }),
+      }
+    : undefined;
+  const active = useNotificationSeries("active", series.options);
+  const inactive = useNotificationSeries("inactive", series.options);
+  const { data: prefs } = useNotificationPreferences();
+  const notifying = active.data?.pages.flatMap((page) => page.series) ?? [];
+  const silenced = inactive.data?.pages.flatMap((page) => page.series) ?? [];
+  const filtered = series.options.q !== "" || series.options.reason !== undefined;
+  // The scroll foot pages the list it sits under: notifying series first.
+  const tail = active.hasNextPage ? active : inactive;
+
+  let body;
+  if (active.isLoading || inactive.isLoading) {
+    body = (
+      <div className="space-y-2">
+        {Array.from({ length: 5 }).map((_, index) => (
+          <Skeleton key={index} className="h-20 w-full rounded-xl" />
+        ))}
+      </div>
+    );
+  } else if (
+    (active.isError && !active.isFetchNextPageError) ||
+    (inactive.isError && !inactive.isFetchNextPageError)
+  ) {
+    body = (
+      <div role="alert" className="px-3 text-sm">
+        Could not load the series that notify you.{" "}
+        <Button
+          variant="outline"
+          size="sm"
+          onClick={() => void Promise.all([active.refetch(), inactive.refetch()])}
+        >
+          Retry
+        </Button>
+      </div>
+    );
+  } else if (
+    notifying.length === 0 &&
+    silenced.length === 0 &&
+    // A page can resolve to no visible series and still have more behind it.
+    !active.hasNextPage &&
+    !inactive.hasNextPage
+  ) {
+    body = filtered ? (
+      <div className="text-muted-foreground py-16 text-center text-sm">
+        No series match. Try another search or reason.
+      </div>
+    ) : (
+      <div className="text-muted-foreground flex flex-col items-center gap-3 py-20 text-center">
+        <BellOff className="h-10 w-10 opacity-50" />
+        <div className="text-sm">No series notify you yet</div>
+        <div className="max-w-sm text-xs">
+          Series you favorite, add to your watchlist, or start watching show up here.
+        </div>
+      </div>
+    );
+  } else {
+    body = (
+      <div
+        className={
+          active.isPlaceholderData || inactive.isPlaceholderData ? "opacity-60" : undefined
+        }
+      >
+        <ul className="list-none space-y-1">
+          {notifying.map((entry) => (
+            <NotifiedSeriesRow
+              key={entry.item.content_id}
+              series={entry}
+              prefs={prefs}
+              mute={mute}
+            />
+          ))}
+        </ul>
+        {!active.hasNextPage && silenced.length > 0 && (
+          <section aria-labelledby="notified-series-silenced" className="mt-6">
+            <h2
+              id="notified-series-silenced"
+              className="text-muted-foreground after:bg-border mb-1 flex items-center gap-2 px-3 text-xs font-semibold after:h-px after:flex-1"
+            >
+              Won’t notify
+            </h2>
+            <ul className="list-none space-y-1">
+              {silenced.map((entry) => (
+                <NotifiedSeriesRow
+                  key={entry.item.content_id}
+                  series={entry}
+                  prefs={prefs}
+                  mute={mute}
+                />
+              ))}
+            </ul>
+          </section>
+        )}
+        <LoadMoreOnScroll
+          hasNextPage={tail.hasNextPage}
+          isFetchingNextPage={tail.isFetchingNextPage}
+          isError={tail.isFetchNextPageError}
+          onLoadMore={() => void tail.fetchNextPage()}
+          errorMessage="Couldn’t load more series."
+          showSpinner
+        />
+      </div>
+    );
+  }
+  return (
+    <div>
+      <p className="text-muted-foreground mb-3 px-3 text-sm">
+        New episodes of these series notify this profile. Change which reasons count in{" "}
+        <button
+          type="button"
+          className="text-foreground underline underline-offset-4"
+          onClick={onOpenPreferences}
+        >
+          Preferences
+        </button>
+        {canMute ? ", or mute one series." : "."}
+      </p>
+      <SeriesToolbar series={series} />
+      {body}
+    </div>
+  );
+}
diff --git a/web/src/components/notifications/reasons.ts b/web/src/components/notifications/reasons.ts
new file mode 100644
index 0000000000..22e5d94d8d
--- /dev/null
+++ b/web/src/components/notifications/reasons.ts
@@ -0,0 +1,8 @@
+/** The reasons a profile hears about a series, keyed like a notification's
+ * reason_flags, with the label each reason pill shows. */
+export const NOTIFICATION_REASONS = [
+  { key: "favorite", label: "Favorite" },
+  { key: "watchlist", label: "Watchlist" },
+  { key: "continue_watching", label: "Continue Watching" },
+  { key: "next_up", label: "Next Up" },
+] as const;
diff --git a/web/src/components/onboarding/OnboardingGate.tsx b/web/src/components/onboarding/OnboardingGate.tsx
index a8086b2b01..790f979bfa 100644
--- a/web/src/components/onboarding/OnboardingGate.tsx
+++ b/web/src/components/onboarding/OnboardingGate.tsx
@@ -56,8 +56,7 @@ function ProfileOnboardingGate({ children }: { children: ReactNode }) {
         },
       },
     );
-    // progress is a stable mutation handle; state.data is covered by `suppressed`.
-    // eslint-disable-next-line react-hooks/exhaustive-deps
+    // eslint-disable-next-line react-hooks/exhaustive-deps -- progress is a stable mutation handle; state.data is covered by `suppressed`
   }, [suppressed]);
 
   const flow = useOnboardingFlow({ enabled: shouldShow && !suppressed });
diff --git a/web/src/components/onboarding/TourHost.tsx b/web/src/components/onboarding/TourHost.tsx
index 30d686f142..4ef9e778fe 100644
--- a/web/src/components/onboarding/TourHost.tsx
+++ b/web/src/components/onboarding/TourHost.tsx
@@ -105,8 +105,7 @@ export function TourHost({ flow, onDone }: TourHostProps) {
     if (!step) {
       finish({ skipped: false });
     }
-    // finish is stable enough for this one-shot; re-running on step change is the point.
-    // eslint-disable-next-line react-hooks/exhaustive-deps
+    // eslint-disable-next-line react-hooks/exhaustive-deps -- finish is stable enough for this one-shot; re-running on step change is the point
   }, [step]);
 
   if (saveFailed)
diff --git a/web/src/components/overlays/OverlayPreviewCard.tsx b/web/src/components/overlays/OverlayPreviewCard.tsx
index d141d5c2d2..aff69ed81a 100644
--- a/web/src/components/overlays/OverlayPreviewCard.tsx
+++ b/web/src/components/overlays/OverlayPreviewCard.tsx
@@ -32,8 +32,7 @@ const SIZE_CLASSES: Record<NonNullable<OverlayPreviewCardProps["size"]>, string>
   md: "w-[180px]",
 };
 
-// Shared preview component used by both the user-facing card overlays
-// settings page and the admin defaults editor. Renders a 2:3 poster
+// Preview used by the admin defaults editor. Renders a 2:3 poster
 // placeholder with the actual <CardOverlays /> renderer on top of it,
 // fed sample data.
 export function OverlayPreviewCard({
diff --git a/web/src/components/overlays/OverlayPreviewVariantToggle.tsx b/web/src/components/overlays/OverlayPreviewVariantToggle.tsx
index 48fe590d0c..07d7bb2dcb 100644
--- a/web/src/components/overlays/OverlayPreviewVariantToggle.tsx
+++ b/web/src/components/overlays/OverlayPreviewVariantToggle.tsx
@@ -10,11 +10,11 @@ interface OverlayPreviewVariantToggleProps {
 }
 
 /**
- * Pill pair that picks which sample data <OverlayPreviewCard /> renders. Shared
- * by the user Card Overlays page and the admin defaults editor so both can
- * preview show-only overlays (network, show status) and the request status of
- * a watchlist title the library doesn't have yet while editing. The choice
- * is local view state on both surfaces and is deliberately never persisted.
+ * Pill pair that picks which sample data <OverlayPreviewCard /> renders in the
+ * admin defaults editor, so it can preview show-only overlays (network, show
+ * status) and the request status of a watchlist title the library doesn't
+ * have yet while editing. The choice is local view state and is deliberately
+ * never persisted.
  */
 export function OverlayPreviewVariantToggle({
   value,
diff --git a/web/src/components/page/PageHeader.tsx b/web/src/components/page/PageHeader.tsx
new file mode 100644
index 0000000000..d83ff99999
--- /dev/null
+++ b/web/src/components/page/PageHeader.tsx
@@ -0,0 +1,82 @@
+import type { ReactNode } from "react";
+
+import { cn } from "@/lib/utils";
+
+export interface PageHeaderProps {
+  title: ReactNode;
+  /** One sentence on what the page is for, under the title. */
+  subtitle?: ReactNode;
+  /** Buttons or menus level with the title, at the right. */
+  actions?: ReactNode;
+  /** Content between the title and the subtitle, such as a status chip. */
+  eyebrow?: ReactNode;
+  className?: string;
+}
+
+/**
+ * The heading every admin page and settings page opens with. One size, one
+ * position and one gap to the content below, so moving between pages never
+ * moves the title.
+ */
+export function PageHeader({ title, subtitle, actions, eyebrow, className }: PageHeaderProps) {
+  return (
+    <header
+      className={cn(
+        "page-header mb-8 flex min-w-0 flex-wrap items-start justify-between gap-x-6 gap-y-3",
+        className,
+      )}
+    >
+      <div className="min-w-0 space-y-2">
+        {eyebrow}
+        <h1 className="text-[1.75rem] leading-[1.15] font-bold tracking-[-0.035em] text-balance sm:text-[2rem]">
+          {title}
+        </h1>
+        {subtitle ? (
+          <p className="text-muted-foreground max-w-[72ch] text-sm leading-relaxed">{subtitle}</p>
+        ) : null}
+      </div>
+      {actions ? (
+        // Stays at the right when the header wraps, so a menu opens over the content.
+        <div className="ml-auto flex flex-wrap items-center gap-2">{actions}</div>
+      ) : null}
+    </header>
+  );
+}
+
+/**
+ * The frame admin pages and user settings pages sit in: full width up to
+ * 1560px, then centered, so on a wide window the content does not hug the
+ * sidebar. Both areas use it so their pages line up the same way.
+ */
+export function PageFrame({ className, children }: { className?: string; children: ReactNode }) {
+  return <div className={cn("mx-auto w-full max-w-[1560px] min-w-0", className)}>{children}</div>;
+}
+
+/**
+ * The column a page's content sits in. It starts at the layout's gutter on
+ * every page instead of centering, so a narrow page and a wide one share the
+ * same left edge and title position. `settings` caps it at a width where
+ * labels and controls stay in reach; `full` lets tables and dashboards use the
+ * whole screen.
+ */
+export function PageColumn({
+  width = "full",
+  className,
+  children,
+}: {
+  width?: "settings" | "full";
+  className?: string;
+  children: ReactNode;
+}) {
+  return (
+    <div
+      className={cn(
+        "@container w-full min-w-0",
+        width === "settings" ? "max-w-[70rem]" : "max-w-none",
+        className,
+      )}
+    >
+      {children}
+    </div>
+  );
+}
diff --git a/web/src/components/profiles/ProfileEditorDialog.tsx b/web/src/components/profiles/ProfileEditorDialog.tsx
index 01a06d6a5c..1ce67000a9 100644
--- a/web/src/components/profiles/ProfileEditorDialog.tsx
+++ b/web/src/components/profiles/ProfileEditorDialog.tsx
@@ -1,6 +1,7 @@
 import { useEffect, useId, useMemo, useState, type FormEvent } from "react";
 import { Loader2, RefreshCw, Save, Trash2, X } from "lucide-react";
 
+import type { ProfileRequestContextSnapshot } from "@/api/client";
 import type { Profile, UserLibrary } from "@/api/types";
 import { ImageUploadField } from "@/components/ImageUploadField";
 import { Avatar, AvatarFallback, AvatarImage } from "@/components/ui/avatar";
@@ -58,6 +59,11 @@ interface ProfileEditorDialogProps {
   advisoryAgeSupported?: boolean;
   /** The server accepts `require_advisory_age`; hides the switch when false. */
   requireAdvisoryAgeSupported?: boolean;
+  /**
+   * Creates the profile and uploads its avatar as this profile instead of the
+   * active one, as Who's watching does for the verified primary profile.
+   */
+  profileContext?: ProfileRequestContextSnapshot;
   onOpenChange: (open: boolean) => void;
   onSaveSuccess?: (
     profile: Profile,
@@ -88,6 +94,7 @@ export function ProfileEditorDialog({
   avatarUploadEnabled = false,
   advisoryAgeSupported = false,
   requireAdvisoryAgeSupported = false,
+  profileContext,
   onOpenChange,
   onSaveSuccess,
 }: ProfileEditorDialogProps) {
@@ -115,6 +122,7 @@ export function ProfileEditorDialog({
             avatarUploadEnabled={avatarUploadEnabled}
             advisoryAgeSupported={advisoryAgeSupported}
             requireAdvisoryAgeSupported={requireAdvisoryAgeSupported}
+            profileContext={profileContext}
             onOpenChange={onOpenChange}
             onSaveSuccess={onSaveSuccess}
           />
@@ -131,6 +139,7 @@ function ProfileEditorForm({
   avatarUploadEnabled,
   advisoryAgeSupported,
   requireAdvisoryAgeSupported,
+  profileContext,
   onOpenChange,
   onSaveSuccess,
 }: {
@@ -140,6 +149,7 @@ function ProfileEditorForm({
   avatarUploadEnabled: boolean;
   advisoryAgeSupported: boolean;
   requireAdvisoryAgeSupported: boolean;
+  profileContext?: ProfileRequestContextSnapshot;
   onOpenChange: (open: boolean) => void;
   onSaveSuccess?: (
     profile: Profile,
@@ -149,9 +159,9 @@ function ProfileEditorForm({
     },
   ) => void;
 }) {
-  const createMutation = useCreateProfile();
+  const createMutation = useCreateProfile(profileContext);
   const updateMutation = useUpdateProfile();
-  const uploadAvatarMutation = useUploadProfileAvatar();
+  const uploadAvatarMutation = useUploadProfileAvatar(profileContext);
   const deleteAvatarMutation = useDeleteProfileAvatar();
   const isPending =
     createMutation.isPending ||
diff --git a/web/src/components/profiles/ProfilePinDialog.test.tsx b/web/src/components/profiles/ProfilePinDialog.test.tsx
index c26889319a..8dee837584 100644
--- a/web/src/components/profiles/ProfilePinDialog.test.tsx
+++ b/web/src/components/profiles/ProfilePinDialog.test.tsx
@@ -55,6 +55,21 @@ describe("ProfilePinDialog", () => {
     await waitFor(() => expect((screen.getByLabelText("PIN") as HTMLInputElement).value).toBe(""));
   });
 
+  it("ignores a check that finishes after the dialog was cancelled", async () => {
+    let answer: (value: { valid: boolean; profile_token: string }) => void = () => {};
+    const { onVerified } = renderDialog(
+      () =>
+        new Promise((resolve) => {
+          answer = resolve;
+        }),
+    );
+    submitPin("1234");
+    fireEvent.click(screen.getByRole("button", { name: "Cancel" }));
+    answer({ valid: true, profile_token: "late-token" });
+    await waitFor(() => expect(screen.getByRole("button", { name: "Confirm" })).toBeTruthy());
+    expect(onVerified).not.toHaveBeenCalled();
+  });
+
   it("keeps the generic failure for other errors", async () => {
     renderDialog(vi.fn().mockRejectedValue(new Error("offline")));
     submitPin("1234");
diff --git a/web/src/components/profiles/ProfilePinDialog.tsx b/web/src/components/profiles/ProfilePinDialog.tsx
index 1d14179f82..de875c4747 100644
--- a/web/src/components/profiles/ProfilePinDialog.tsx
+++ b/web/src/components/profiles/ProfilePinDialog.tsx
@@ -1,9 +1,15 @@
-import { useId, useState } from "react";
+import { useId, useRef, useState } from "react";
 import type { FormEvent } from "react";
 
 import type { Profile } from "@/api/types";
 import { Button } from "@/components/ui/button";
-import { Dialog, DialogContent, DialogHeader, DialogTitle } from "@/components/ui/dialog";
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogHeader,
+  DialogTitle,
+} from "@/components/ui/dialog";
 import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
 
@@ -12,6 +18,8 @@ import { pinLockoutMessage } from "./pinLockout";
 
 interface ProfilePinDialogProps {
   profile: Profile | null;
+  /** Why the PIN is asked for, when it isn't to switch to the profile. */
+  description?: string;
   onClose: () => void;
   onVerified: (profile: Profile, token: string) => void;
   verifyPin: (
@@ -22,6 +30,7 @@ interface ProfilePinDialogProps {
 
 export function ProfilePinDialog({
   profile,
+  description,
   onClose,
   onVerified,
   verifyPin,
@@ -30,8 +39,12 @@ export function ProfilePinDialog({
   const [error, setError] = useState("");
   const [verifying, setVerifying] = useState(false);
   const pinInputId = useId();
+  // Advances when the dialog closes, so a check still in flight then is
+  // ignored: cancelling must not switch profiles or open what the PIN unlocks.
+  const attemptRef = useRef(0);
 
   function handleClose() {
+    attemptRef.current += 1;
     setPin("");
     setError("");
     onClose();
@@ -45,8 +58,12 @@ export function ProfilePinDialog({
 
     setError("");
     setVerifying(true);
+    const attempt = attemptRef.current;
     try {
       const response = await verifyPin(profile.id, pin);
+      if (attemptRef.current !== attempt) {
+        return;
+      }
       if (response.valid && response.profile_token) {
         setPin("");
         onVerified(profile, response.profile_token);
@@ -56,6 +73,9 @@ export function ProfilePinDialog({
       setError("Incorrect PIN");
       setPin("");
     } catch (err) {
+      if (attemptRef.current !== attempt) {
+        return;
+      }
       const lockout = pinLockoutMessage(err);
       if (lockout) {
         setPin("");
@@ -78,6 +98,7 @@ export function ProfilePinDialog({
       <DialogContent className="sm:max-w-xs">
         <DialogHeader>
           <DialogTitle>Enter PIN for {profile?.name}</DialogTitle>
+          {description ? <DialogDescription>{description}</DialogDescription> : null}
         </DialogHeader>
 
         <form onSubmit={handleSubmit} className="space-y-4">
diff --git a/web/src/components/realtimeCatalogInvalidation.test.ts b/web/src/components/realtimeCatalogInvalidation.test.ts
index 092891becc..28f4fb6d33 100644
--- a/web/src/components/realtimeCatalogInvalidation.test.ts
+++ b/web/src/components/realtimeCatalogInvalidation.test.ts
@@ -125,6 +125,28 @@ describe("createCatalogInvalidationScheduler", () => {
     expect(invalidatedLibraries(queryClient, [3])).toEqual([3]);
   });
 
+  it("keeps a library-wide event broad when coalesced with a single item", async () => {
+    const queryClient = new QueryClient();
+    const otherDetailKey = catalogKeys.itemDetail("item-2");
+    queryClient.setQueryData(otherDetailKey, { content_id: "item-2" });
+    const scheduler = createCatalogInvalidationScheduler(queryClient, WINDOW_MS);
+
+    try {
+      scheduler.schedule({ itemId: "item-1", libraryId: 3, allowDashboardRefetch: false });
+      await vi.advanceTimersByTimeAsync(0);
+      expect(queryClient.getQueryState(otherDetailKey)?.isInvalidated).toBe(false);
+
+      scheduler.schedule({ itemId: "item-1", libraryId: 3, allowDashboardRefetch: false });
+      scheduler.schedule({ libraryId: 3, allowDashboardRefetch: false });
+      await vi.advanceTimersByTimeAsync(WINDOW_MS);
+
+      expect(queryClient.getQueryState(otherDetailKey)?.isInvalidated).toBe(true);
+    } finally {
+      scheduler.cancel();
+      queryClient.clear();
+    }
+  });
+
   it("marks home section data stale (without refetching) on a library-scoped sweep", async () => {
     const queryClient = new QueryClient();
     const homeLayoutKey = sectionKeys.homeLayout();
diff --git a/web/src/components/realtimeCatalogInvalidation.ts b/web/src/components/realtimeCatalogInvalidation.ts
index b219f930e8..07e17e430b 100644
--- a/web/src/components/realtimeCatalogInvalidation.ts
+++ b/web/src/components/realtimeCatalogInvalidation.ts
@@ -36,9 +36,11 @@ export function invalidateCatalogState(
       refetchType: "none",
     });
   }
-  void invalidateMediaSurfaceQueries(queryClient, { itemId, libraryId }).then(() => {
-    bumpHomeRefreshSignal(queryClient);
-  });
+  void invalidateMediaSurfaceQueries(queryClient, { itemId, libraryId, itemMayBeNew: true }).then(
+    () => {
+      bumpHomeRefreshSignal(queryClient);
+    },
+  );
   if (includeLibraryLists) {
     void queryClient.invalidateQueries({
       queryKey: adminKeys.libraries(),
@@ -93,6 +95,7 @@ interface PendingCatalogInvalidation {
   itemIds: Set<string>;
   libraryIds: Set<number>;
   hasUnscopedEvent: boolean;
+  hasItemUnscopedEvent: boolean;
   allowDashboardRefetch: boolean;
   includeLibraryLists: boolean;
 }
@@ -156,11 +159,13 @@ function mergeCatalogInvalidation(
     itemIds: new Set(),
     libraryIds: new Set(),
     hasUnscopedEvent: false,
+    hasItemUnscopedEvent: false,
     allowDashboardRefetch: false,
     includeLibraryLists: false,
   };
 
   if (options.itemId) next.itemIds.add(options.itemId);
+  else next.hasItemUnscopedEvent = true;
   if (options.libraryId === undefined) {
     next.hasUnscopedEvent = true;
   } else {
@@ -176,7 +181,7 @@ function resolveBatch(batch: PendingCatalogInvalidation): CatalogInvalidationOpt
   const [onlyItemId] = batch.itemIds;
   const [onlyLibraryId] = batch.libraryIds;
   return {
-    itemId: batch.itemIds.size === 1 ? onlyItemId : undefined,
+    itemId: !batch.hasItemUnscopedEvent && batch.itemIds.size === 1 ? onlyItemId : undefined,
     libraryId: !batch.hasUnscopedEvent && batch.libraryIds.size === 1 ? onlyLibraryId : undefined,
     allowDashboardRefetch: batch.allowDashboardRefetch,
     includeLibraryLists: batch.includeLibraryLists,
diff --git a/web/src/components/sections/HomeLayoutTransfer.tsx b/web/src/components/sections/HomeLayoutTransfer.tsx
index fa919aee3b..a26c21398f 100644
--- a/web/src/components/sections/HomeLayoutTransfer.tsx
+++ b/web/src/components/sections/HomeLayoutTransfer.tsx
@@ -179,11 +179,10 @@ export function HomeLayoutImportDialog({ onClose, libraries }: HomeLayoutImportD
     }
     setApplying(true);
     const failures: string[] = [];
-    const keptSavedChanges: string[] = [];
     for (const page of plan.pages) {
       try {
         const query = pageQuery(page.scope, page.libraryId);
-        const { keptSavedChanges: kept } = await importPage(
+        await importPage(
           page,
           plan.sameServer,
           {
@@ -191,16 +190,11 @@ export function HomeLayoutImportDialog({ onClose, libraries }: HomeLayoutImportD
               v2("GET /api/v2/profile/sections", { query, profileContext }).then(
                 (result) => result.items,
               ),
-            listView: () =>
-              v2("GET /api/v2/profile/sections/settings", { query, profileContext }).then(
-                (result) => result.items,
-              ),
             save: (overrides) =>
               v2("PUT /api/v2/profile/sections", { query, body: { overrides }, profileContext }),
           },
           randomUUID,
         );
-        if (kept) keptSavedChanges.push(page.label);
       } catch (error) {
         failures.push(`${page.label} (${problemMessage(error)})`);
       }
@@ -228,14 +222,7 @@ export function HomeLayoutImportDialog({ onClose, libraries }: HomeLayoutImportD
     await qc.invalidateQueries({ queryKey: sectionKeys.all });
     setApplying(false);
     if (failures.length === 0) {
-      toast.success(
-        "Home layout imported",
-        keptSavedChanges.length > 0
-          ? {
-              description: `This profile's own changes to some sections were kept on: ${keptSavedChanges.join(", ")}.`,
-            }
-          : undefined,
-      );
+      toast.success("Home layout imported");
       onClose();
     } else {
       toast.error(`Some parts didn't import: ${failures.join("; ")}`);
diff --git a/web/src/components/sessions/LoginSessionsPanel.tsx b/web/src/components/sessions/LoginSessionsPanel.tsx
index e7b1d78ad1..4cc52541ca 100644
--- a/web/src/components/sessions/LoginSessionsPanel.tsx
+++ b/web/src/components/sessions/LoginSessionsPanel.tsx
@@ -3,6 +3,7 @@ import { Link, useNavigate } from "react-router";
 import { Loader2, RefreshCw, ShieldCheck } from "lucide-react";
 import { toast } from "sonner";
 import { SettingsGroup } from "@/components/settings/SettingsGroup";
+import { cn } from "@/lib/utils";
 import { Button } from "@/components/ui/button";
 import {
   AlertDialog,
@@ -86,17 +87,31 @@ export function LoginSessionsPanel({
       ))}
     </ul>
   );
+  // A section of the admin's user page there; the page's own title in Settings.
+  const Heading = adminUser ? "h2" : "h1";
   return (
     <div className="space-y-6">
-      <div className="flex flex-wrap items-start justify-between gap-3">
+      {/* In Settings this is the page header, so it matches `PageHeader`'s
+          title and gap; it keeps its own markup for the focusable heading. */}
+      <div
+        className={cn(
+          "flex flex-wrap items-start justify-between gap-3",
+          !adminUser && "page-header mb-8",
+        )}
+      >
         <div className="space-y-2">
-          <h2
+          <Heading
             ref={heading}
             tabIndex={-1}
-            className={`${adminUser ? "text-lg" : "text-2xl sm:text-3xl"} font-semibold tracking-tight focus:outline-none`}
+            className={cn(
+              "focus:outline-none",
+              adminUser
+                ? "text-lg font-semibold tracking-tight"
+                : "text-[1.75rem] leading-[1.15] font-bold tracking-[-0.035em] text-balance sm:text-[2rem]",
+            )}
           >
             Signed-in sessions
-          </h2>
+          </Heading>
           <p className="text-muted-foreground max-w-2xl text-sm leading-relaxed">
             {adminUser
               ? `Browsers and apps signed in to ${adminUser.username}’s account.`
diff --git a/web/src/components/settings/AdvancedSection.tsx b/web/src/components/settings/AdvancedSection.tsx
index 26ae973f1b..df9bc4d539 100644
--- a/web/src/components/settings/AdvancedSection.tsx
+++ b/web/src/components/settings/AdvancedSection.tsx
@@ -114,7 +114,7 @@ export function AdvancedSection({
         />
         <span className="min-w-0 font-medium">{title}</span>
         {typeof count === "number" ? (
-          <span aria-hidden="true" className="text-muted-foreground ml-auto shrink-0 text-[11.5px]">
+          <span aria-hidden="true" className="text-muted-foreground ml-auto shrink-0 text-xs">
             {count}
           </span>
         ) : null}
diff --git a/web/src/components/settings/CurrentProfileLink.tsx b/web/src/components/settings/CurrentProfileLink.tsx
new file mode 100644
index 0000000000..85814a4e8e
--- /dev/null
+++ b/web/src/components/settings/CurrentProfileLink.tsx
@@ -0,0 +1,38 @@
+import { ChevronRight } from "lucide-react";
+import { Link } from "react-router";
+
+import { Avatar, AvatarFallback, AvatarImage } from "@/components/ui/avatar";
+import { useCurrentProfile } from "@/hooks/useCurrentProfile";
+import { cn } from "@/lib/utils";
+
+/**
+ * Whose settings these are. Almost every personal setting is stored per
+ * profile, so the settings area names the profile and links to the picker.
+ */
+export function CurrentProfileLink({ className }: { className?: string }) {
+  const { profile } = useCurrentProfile();
+  const profileName = profile?.name ?? "Your profile";
+
+  return (
+    <Link
+      to="/profiles"
+      aria-label={`Current profile: ${profileName}`}
+      className={cn(
+        "hover:bg-accent/70 focus-visible:ring-ring/60 flex items-center gap-2.5 rounded-xl px-2 py-1.5 transition-colors focus-visible:ring-[3px] focus-visible:outline-none",
+        className,
+      )}
+    >
+      <Avatar className="border-border h-8 w-8 border">
+        {profile?.avatar_url ? <AvatarImage src={profile.avatar_url} alt="" /> : null}
+        <AvatarFallback className="bg-accent text-foreground text-xs font-semibold">
+          {profileName.charAt(0).toUpperCase()}
+        </AvatarFallback>
+      </Avatar>
+      <span className="min-w-0 flex-1">
+        <span className="text-muted-foreground block text-xs leading-tight">Current profile</span>
+        <span className="block truncate text-sm font-semibold">{profileName}</span>
+      </span>
+      <ChevronRight className="text-muted-foreground h-4 w-4 shrink-0" aria-hidden="true" />
+    </Link>
+  );
+}
diff --git a/web/src/components/settings/DeviceList.test.tsx b/web/src/components/settings/DeviceList.test.tsx
index 051c8ec492..b3c87ac730 100644
--- a/web/src/components/settings/DeviceList.test.tsx
+++ b/web/src/components/settings/DeviceList.test.tsx
@@ -157,6 +157,42 @@ describe("DeviceList", () => {
     const [onlyItem] = items;
     expect(within(onlyItem!).getByText("Living Room")).toBeInTheDocument();
   });
+
+  it("lists a renamed device by its chosen name and finds it by either name", () => {
+    const tvs = [
+      device({ device_id: "den", device_name: "Apple TV", custom_name: "Den" }),
+      device({ device_id: "bedroom", device_name: "Apple TV" }),
+    ];
+    const { rerender } = render(
+      <DeviceList
+        devices={tvs}
+        selectedKey={null}
+        onSelect={vi.fn()}
+        search="den"
+        onSearchChange={vi.fn()}
+        now={NOW}
+      />,
+    );
+    let items = screen.getAllByRole("listitem");
+    expect(items).toHaveLength(1);
+    expect(within(items[0]!).getByText("Den")).toBeInTheDocument();
+
+    rerender(
+      <DeviceList
+        devices={tvs}
+        selectedKey={null}
+        onSelect={vi.fn()}
+        search="apple tv"
+        onSearchChange={vi.fn()}
+        now={NOW}
+      />,
+    );
+    items = screen.getAllByRole("listitem");
+    expect(items.map((item) => item.textContent)).toEqual([
+      expect.stringContaining("Den"),
+      expect.stringContaining("Apple TV"),
+    ]);
+  });
 });
 
 describe("DeviceList at scale", () => {
diff --git a/web/src/components/settings/DeviceList.tsx b/web/src/components/settings/DeviceList.tsx
index 5739f4c5a8..665bba4aa5 100644
--- a/web/src/components/settings/DeviceList.tsx
+++ b/web/src/components/settings/DeviceList.tsx
@@ -8,7 +8,11 @@ import {
   PlatformIcon,
   platformKindLabel,
 } from "@/components/admin/deviceOverrides";
-import { deviceRecencyGroup, type DeviceRecencyGroup } from "@/hooks/queries/devices";
+import {
+  deviceDisplayName,
+  deviceRecencyGroup,
+  type DeviceRecencyGroup,
+} from "@/hooks/queries/devices";
 import { cn } from "@/lib/utils";
 
 const GROUP_TITLES: Record<DeviceRecencyGroup, string> = {
@@ -106,6 +110,7 @@ export function DeviceList({
       const platform = platformKindLabel(classifyPlatform(device.device_platform));
       return (
         device.device_name.toLowerCase().includes(query) ||
+        (device.custom_name ?? "").toLowerCase().includes(query) ||
         device.device_platform.toLowerCase().includes(query) ||
         platform.toLowerCase().includes(query) ||
         device.profile_name.toLowerCase().includes(query)
@@ -172,7 +177,7 @@ export function DeviceList({
         // line at any household size — the same trade the settings shell's own
         // mobile tab bar makes — and unwraps into a normal row from xl up.
         <div
-          className="flex [scrollbar-width:none] gap-1.5 overflow-x-auto px-0.5 pt-2 pb-1 [-ms-overflow-style:none] xl:flex-wrap xl:gap-1 xl:overflow-visible [&::-webkit-scrollbar]:hidden"
+          className="flex gap-1.5 overflow-x-auto px-0.5 pt-2 pb-1 [-ms-overflow-style:none] [scrollbar-width:none] xl:flex-wrap xl:gap-1 xl:overflow-visible [&::-webkit-scrollbar]:hidden"
           role="group"
           aria-label="Filter by profile"
         >
@@ -213,7 +218,7 @@ export function DeviceList({
       <div className="overlay-scroll -mr-1.5 max-h-[min(60vh,520px)] overflow-y-auto overscroll-contain pr-1.5 xl:max-h-[calc(100vh-16rem)]">
         {sections.map((section) => (
           <section key={section.title}>
-            <h3 className="text-muted-foreground bg-surface sticky top-0 z-10 px-2 pt-3 pb-1 text-[10.5px] font-semibold tracking-[0.09em] uppercase">
+            <h3 className="text-muted-foreground bg-surface sticky top-0 z-10 px-2 pt-3 pb-1 text-xs font-semibold tracking-[0.09em] uppercase">
               {section.title}
             </h3>
             <ul>
@@ -311,11 +316,7 @@ function ProfileChip({
       )}
     >
       {label}
-      <span
-        className={cn("text-[11px]", active ? "text-muted-foreground" : "text-muted-foreground/70")}
-      >
-        {count}
-      </span>
+      <span className="text-muted-foreground text-xs">{count}</span>
     </button>
   );
 }
@@ -350,12 +351,10 @@ function DeviceRow({
       </span>
       <span className="min-w-0 flex-1">
         <span className="block truncate text-sm font-medium xl:text-[13px]">
-          {device.device_name || "Unknown device"}
+          {deviceDisplayName(device)}
         </span>
-        <span className="text-muted-foreground block truncate text-[12.5px] xl:text-[11.5px]">
-          {device.is_current_device
-            ? "This is the device you're on"
-            : lastSeenLabel(device.last_seen_at, now)}
+        <span className="text-muted-foreground block truncate text-[13px]">
+          {device.is_current_device ? "This device" : lastSeenLabel(device.last_seen_at, now)}
         </span>
       </span>
       {device.is_current_device ? (
@@ -374,14 +373,14 @@ function DeviceRow({
 function ChangedCount({ count }: { count: number }) {
   if (count <= 0) {
     return (
-      <span className="text-muted-foreground/50 shrink-0 text-[11px]" aria-label="Nothing changed">
+      <span className="text-muted-foreground shrink-0 text-xs" aria-label="Nothing changed">
         —
       </span>
     );
   }
   return (
     <span
-      className="shrink-0 rounded-full border border-amber-500/30 bg-amber-500/10 px-1.5 text-[11px] font-semibold text-amber-300"
+      className="shrink-0 rounded-full border border-amber-500/30 bg-amber-500/10 px-1.5 text-xs font-semibold text-amber-300"
       aria-label={`${count} ${count === 1 ? "setting" : "settings"} changed here`}
     >
       {count}
diff --git a/web/src/components/settings/DeviceSettingGroups.test.tsx b/web/src/components/settings/DeviceSettingGroups.test.tsx
index 6912318cf5..c16eb9ec5f 100644
--- a/web/src/components/settings/DeviceSettingGroups.test.tsx
+++ b/web/src/components/settings/DeviceSettingGroups.test.tsx
@@ -250,6 +250,22 @@ describe("DeviceSettingGroups", () => {
     expect(screen.queryByText("App default")).not.toBeInTheDocument();
   });
 
+  it("shows a stored original quality as Auto and no longer offers Original", async () => {
+    renderGroups({
+      "playback.preferred_quality": effective({
+        key: "playback.preferred_quality",
+        value: "original",
+        source: "profile_device",
+        scope: "profile_device",
+      }),
+    });
+
+    const select = screen.getByRole("combobox", { name: "Preferred quality" });
+    expect(select).toHaveTextContent("Auto");
+    await userEvent.click(select);
+    expect(screen.queryByRole("option", { name: /Original/ })).not.toBeInTheDocument();
+  });
+
   it("offers the three intro modes and writes the selected device override", async () => {
     const { onChange } = renderGroups({
       "playback.intro_skip_mode": effective({
@@ -340,9 +356,11 @@ describe("DeviceSettingGroups", () => {
       }),
     });
 
-    expect(screen.getByText("2 Mbps")).toBeInTheDocument();
+    // Anchored: the cellular maximum bitrate row has its own 2 Mbps default.
+    const select = screen.getByRole("combobox", { name: /^Maximum bitrate/i });
+    expect(select).toHaveTextContent("2 Mbps");
 
-    await userEvent.click(screen.getByRole("combobox", { name: /Maximum bitrate/i }));
+    await userEvent.click(select);
     const option = await screen.findByRole("option", { name: "10 Mbps" });
     for (const name of ["200 Mbps", "100 Mbps", "1.5 Mbps", "No limit"]) {
       expect(screen.getByRole("option", { name })).toBeInTheDocument();
@@ -369,6 +387,23 @@ describe("DeviceSettingGroups", () => {
     expect(screen.getByText("3.5 Mbps")).toBeInTheDocument();
   });
 
+  // The cellular cap defaults to 2 Mbps, so a stored null is a choice of its
+  // own and must not fall back to the default.
+  it("shows a stored no-limit cellular bitrate as No limit", () => {
+    renderGroups({
+      "playback.cellular_max_bitrate_kbps": effective({
+        key: "playback.cellular_max_bitrate_kbps",
+        value: null,
+        source: "profile_device",
+        scope: "profile_device",
+      }),
+    });
+
+    expect(screen.getByRole("combobox", { name: /^Cellular maximum bitrate/i })).toHaveTextContent(
+      "No limit",
+    );
+  });
+
   // The sliders shipped controlled with only onValueCommit, so the thumb
   // never moved and no keyboard or pointer gesture could change the value.
   // Keyboard steps are what jsdom can exercise; they commit through the same
diff --git a/web/src/components/settings/DeviceSettingGroups.tsx b/web/src/components/settings/DeviceSettingGroups.tsx
index cadfc4b8fc..d5e3020a82 100644
--- a/web/src/components/settings/DeviceSettingGroups.tsx
+++ b/web/src/components/settings/DeviceSettingGroups.tsx
@@ -14,11 +14,12 @@ import { SettingSlider } from "@/components/settings/SettingSlider";
 import { SettingsGroup } from "@/components/settings/SettingsGroup";
 import { groupDeviceSettings } from "@/lib/deviceSettingGroups";
 import type { EffectiveSetting } from "@/hooks/queries/settingValues";
-import { SETTING_DEFINITIONS, type SettingKey } from "@/lib/settingsContract";
+import { SETTING_DEFINITIONS, SETTING_KEYS, type SettingKey } from "@/lib/settingsContract";
 import { bitrateSelectChoices } from "@/lib/bitrateOptions";
 import { namedLanguageOptionsFor } from "@/lib/languageOptions";
 import { controlKindFor, formatSettingValue, optionsFor } from "@/lib/settingsDisplay";
 import { cn } from "@/lib/utils";
+import { normalizeQualityPreferenceV3 } from "@/player/protocol-v3";
 
 const EMPTY_SELECT_VALUE = "__empty__";
 
@@ -140,7 +141,9 @@ function DeviceSettingRow({
   // the limit capped.
   const inheritedFrom =
     changedHere || profileWide || constrained ? null : sourceLabel(effective, ownerLabel);
-  const value = effective?.value ?? definition.defaultValue;
+  // A stored null is a value ("No limit"), not a missing one, so only a
+  // missing answer falls back to the default.
+  const value = displayedValue(settingKey, effective ? effective.value : definition.defaultValue);
   const inlineControl = controlKindFor(definition) === "switch";
 
   return (
@@ -162,7 +165,7 @@ function DeviceSettingRow({
           <div className="flex flex-wrap items-center gap-2">
             <span className="text-sm font-medium">{definition.label}</span>
             {changedHere ? (
-              <span className="rounded-full border border-amber-500/30 bg-amber-500/10 px-1.5 py-px text-[10px] font-semibold tracking-[0.04em] text-amber-300 uppercase">
+              <span className="rounded-full border border-amber-500/30 bg-amber-500/10 px-1.5 py-px text-xs font-semibold tracking-[0.04em] text-amber-300 uppercase">
                 Changed here
               </span>
             ) : null}
@@ -170,7 +173,7 @@ function DeviceSettingRow({
               <span className="text-muted-foreground text-xs">{inheritedFrom}</span>
             ) : null}
             {constrained ? (
-              <span className="border-info/30 bg-info/10 text-info inline-flex items-center gap-1 rounded-full border px-1.5 py-px text-[10px] font-semibold tracking-[0.04em] uppercase">
+              <span className="border-info/30 bg-info/10 text-info inline-flex items-center gap-1 rounded-full border px-1.5 py-px text-xs font-semibold tracking-[0.04em] uppercase">
                 <Lock className="h-2.5 w-2.5" />
                 Household limit
               </span>
@@ -180,12 +183,12 @@ function DeviceSettingRow({
             {definition.description}
           </p>
           {constrained ? (
-            <p className="text-[12.5px] leading-relaxed text-amber-300/90">
+            <p className="text-[13px] leading-relaxed text-amber-300/90">
               {constraintExplanation(effective)}
             </p>
           ) : null}
           {profileWide ? (
-            <p className="text-muted-foreground text-[12.5px] leading-relaxed">
+            <p className="text-muted-foreground text-[13px] leading-relaxed">
               {retainedHere
                 ? `Set for all devices on this profile, so this device's own choice (${retainedValueLabel(settingKey, storedOnDevice?.[settingKey])}) isn't used right now. `
                 : "Set for all devices on this profile. "}
@@ -222,6 +225,16 @@ function DeviceSettingRow({
   );
 }
 
+/**
+ * The value the control shows. A stored "original" quality is a deprecated
+ * alias of Auto that the select no longer offers, so it shows as Auto.
+ */
+function displayedValue(settingKey: SettingKey, value: unknown): unknown {
+  return settingKey === SETTING_KEYS.PLAYBACK_PREFERRED_QUALITY && typeof value === "string"
+    ? normalizeQualityPreferenceV3(value)
+    : value;
+}
+
 /**
  * Names where a value not stored on this device comes from.
  *
@@ -368,7 +381,7 @@ function DeviceSettingControl({
   // showing nothing at all. Present the range as bandwidth choices people
   // recognise instead, and keep the stored value visible if it is not one of
   // them.
-  const numericChoices = numericSelectChoices(settingKey, definition, options, asString);
+  const numericChoices = numericSelectChoices(definition, options, asString);
   if (numericChoices) {
     return (
       <Select
@@ -453,7 +466,6 @@ function permittedOptions(settingKey: SettingKey, effective: EffectiveSetting |
  * profile Defaults screen offers the same choices.
  */
 function numericSelectChoices(
-  settingKey: SettingKey,
   definition: (typeof SETTING_DEFINITIONS)[SettingKey],
   options: { value: string; label: string }[],
   currentValue: string,
@@ -462,7 +474,7 @@ function numericSelectChoices(
   const hasMembers = options.some((option) => option.value !== "");
   if (!isNumeric || hasMembers) return null;
 
-  const unsetLabel = settingKey === "playback.max_bitrate_kbps" ? "No limit" : "Unset";
+  const unsetLabel = definition.unit === "kbps" ? "No limit" : "Unset";
   return bitrateSelectChoices(definition, currentValue, unsetLabel);
 }
 
diff --git a/web/src/components/settings/LanguageSelect.tsx b/web/src/components/settings/LanguageSelect.tsx
index 27b5191b6c..a804e69078 100644
--- a/web/src/components/settings/LanguageSelect.tsx
+++ b/web/src/components/settings/LanguageSelect.tsx
@@ -162,7 +162,7 @@ export function LanguageSelect({
             </Button>
           </div>
           <p
-            className="text-muted-foreground text-[11px] leading-tight"
+            className="text-muted-foreground text-xs leading-tight"
             role={draftInvalid ? "alert" : undefined}
           >
             {draftInvalid
diff --git a/web/src/components/settings/NotInterestedList.test.tsx b/web/src/components/settings/NotInterestedList.test.tsx
new file mode 100644
index 0000000000..2d7301cb92
--- /dev/null
+++ b/web/src/components/settings/NotInterestedList.test.tsx
@@ -0,0 +1,81 @@
+import { render, screen } from "@testing-library/react";
+import { MemoryRouter } from "react-router";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import type { BrowseItem } from "@/api/types";
+import { NotInterestedList } from "@/components/settings/NotInterestedList";
+
+const mocks = vi.hoisted(() => ({ list: vi.fn() }));
+
+vi.mock("@/hooks/queries/notInterested", () => ({
+  useNotInterestedList: () => mocks.list(),
+  useToggleNotInterested: () => ({ mutate: vi.fn(), isPending: false }),
+}));
+
+function title(id: string): BrowseItem {
+  return { content_id: id, type: "movie", title: `Title ${id}`, year: 2020 } as BrowseItem;
+}
+
+function listState(overrides: Record<string, unknown>) {
+  return {
+    data: undefined,
+    isPending: false,
+    isError: false,
+    isFetchNextPageError: false,
+    hasNextPage: false,
+    fetchNextPage: vi.fn(),
+    isFetchingNextPage: false,
+    refetch: vi.fn(),
+    isRefetching: false,
+    ...overrides,
+  };
+}
+
+function renderList() {
+  render(
+    <MemoryRouter>
+      <NotInterestedList />
+    </MemoryRouter>,
+  );
+}
+
+describe("NotInterestedList", () => {
+  beforeEach(() => mocks.list.mockReset());
+
+  it("offers more titles when a page holds none the viewer can see", () => {
+    mocks.list.mockReturnValue(listState({ data: { pages: [{ items: [] }] }, hasNextPage: true }));
+    renderList();
+    expect(screen.getByRole("button", { name: "Show more" })).toBeTruthy();
+    expect(screen.queryByText(/Nothing yet/)).toBeNull();
+  });
+
+  it("keeps the loaded titles when a later page fails", () => {
+    mocks.list.mockReturnValue(
+      listState({
+        data: { pages: [{ items: [title("movie:a")] }] },
+        isError: true,
+        isFetchNextPageError: true,
+        hasNextPage: true,
+      }),
+    );
+    renderList();
+    expect(screen.getByText("Title movie:a")).toBeTruthy();
+    expect(screen.getByRole("button", { name: "Retry loading more" })).toBeTruthy();
+  });
+
+  it("keeps the loaded titles when a refresh fails, with a retry", () => {
+    mocks.list.mockReturnValue(
+      listState({ data: { pages: [{ items: [title("movie:a")] }] }, isError: true }),
+    );
+    renderList();
+    expect(screen.getByText("Title movie:a")).toBeTruthy();
+    expect(screen.getByRole("button", { name: "Retry" })).toBeTruthy();
+  });
+
+  it("offers a retry when nothing loaded", () => {
+    mocks.list.mockReturnValue(listState({ isError: true }));
+    renderList();
+    expect(screen.getByText(/Couldn't load/)).toBeTruthy();
+    expect(screen.getByRole("button", { name: "Retry" })).toBeTruthy();
+  });
+});
diff --git a/web/src/components/settings/NotInterestedList.tsx b/web/src/components/settings/NotInterestedList.tsx
new file mode 100644
index 0000000000..fe3beebf89
--- /dev/null
+++ b/web/src/components/settings/NotInterestedList.tsx
@@ -0,0 +1,151 @@
+import { Link } from "react-router";
+import { ThumbsDown } from "lucide-react";
+import type { BrowseItem } from "@/api/types";
+import { Button } from "@/components/ui/button";
+import { useNotInterestedList, useToggleNotInterested } from "@/hooks/queries/notInterested";
+import { buildItemHref } from "@/lib/mediaNavigation";
+
+function NotInterestedRow({ item }: { item: BrowseItem }) {
+  const { mutate: toggle, isPending } = useToggleNotInterested(item.content_id);
+  return (
+    <li className="grid grid-cols-[auto_minmax(0,1fr)] items-center gap-x-3 gap-y-2 py-2 sm:grid-cols-[auto_minmax(0,1fr)_auto]">
+      <Link
+        to={buildItemHref({ contentId: item.content_id })}
+        className="bg-muted row-span-2 h-16 w-11 overflow-hidden rounded sm:row-span-1"
+      >
+        {item.poster_url && (
+          <img src={item.poster_url} alt="" className="h-full w-full object-cover" loading="lazy" />
+        )}
+      </Link>
+      <div className="min-w-0">
+        <Link
+          to={buildItemHref({ contentId: item.content_id })}
+          className="block truncate text-sm font-medium hover:underline"
+        >
+          {item.title}
+        </Link>
+        <span className="text-muted-foreground text-xs">
+          {[item.year > 0 ? item.year : null, item.type === "series" ? "Series" : "Movie"]
+            .filter(Boolean)
+            .join(" · ")}
+        </span>
+      </div>
+      <Button
+        variant="outline"
+        size="sm"
+        className="justify-self-start sm:justify-self-end"
+        disabled={isPending}
+        onClick={() => toggle(true)}
+      >
+        Show in Recommendations
+      </Button>
+    </li>
+  );
+}
+
+/**
+ * The titles the profile marked Not interested, newest first, each with a
+ * way to put it back in recommendations.
+ */
+export function NotInterestedList() {
+  const {
+    data,
+    isPending,
+    isError,
+    isFetchNextPageError,
+    hasNextPage,
+    fetchNextPage,
+    isFetchingNextPage,
+    refetch,
+    isRefetching,
+  } = useNotInterestedList();
+  const items = data?.pages.flatMap((page) => page.items) ?? [];
+
+  return (
+    <div className="surface-panel rounded-2xl border-0 p-6">
+      <div className="flex items-start gap-4">
+        <div className="bg-primary/10 text-primary flex h-12 w-12 shrink-0 items-center justify-center rounded-full">
+          <ThumbsDown className="h-6 w-6" />
+        </div>
+        <div className="min-w-0 flex-1 space-y-3">
+          <div>
+            <h3 className="text-base font-semibold">Not interested</h3>
+            <p className="text-muted-foreground mt-1 text-sm">
+              Titles you marked Not interested stay out of your recommendations, and similar titles
+              rank lower. You can still find and play them anywhere else.
+            </p>
+          </div>
+          {isPending ? (
+            <p className="text-muted-foreground text-sm">Loading…</p>
+          ) : !data ? (
+            <div className="flex items-center gap-3">
+              <p className="text-muted-foreground text-sm">
+                Couldn't load your Not interested titles.
+              </p>
+              <Button
+                variant="outline"
+                size="sm"
+                disabled={isRefetching}
+                onClick={() => void refetch()}
+              >
+                Retry
+              </Button>
+            </div>
+          ) : (
+            <>
+              {items.length > 0 ? (
+                <ul className="divide-border divide-y">
+                  {items.map((item) => (
+                    <NotInterestedRow key={item.content_id} item={item} />
+                  ))}
+                </ul>
+              ) : (
+                !hasNextPage && (
+                  <p className="text-muted-foreground text-sm">
+                    Nothing yet. Choose Not Interested from a movie or show's menu.
+                  </p>
+                )
+              )}
+              {isError && !isFetchNextPageError && (
+                <div className="flex items-center gap-3">
+                  <p className="text-muted-foreground text-sm">
+                    Couldn't refresh this list; it may be out of date.
+                  </p>
+                  <Button
+                    variant="outline"
+                    size="sm"
+                    disabled={isRefetching}
+                    onClick={() => void refetch()}
+                  >
+                    Retry
+                  </Button>
+                </div>
+              )}
+              {hasNextPage && (
+                <div className="flex items-center gap-3">
+                  <Button
+                    variant="ghost"
+                    size="sm"
+                    disabled={isFetchingNextPage}
+                    onClick={() => void fetchNextPage()}
+                  >
+                    {isFetchingNextPage
+                      ? "Loading…"
+                      : isFetchNextPageError
+                        ? "Retry loading more"
+                        : "Show more"}
+                  </Button>
+                  {isFetchNextPageError && !isFetchingNextPage && (
+                    <span className="text-muted-foreground text-sm">
+                      Couldn't load more titles.
+                    </span>
+                  )}
+                </div>
+              )}
+            </>
+          )}
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/web/src/components/settings/ProviderTile.test.tsx b/web/src/components/settings/ProviderTile.test.tsx
index 717e6f4f69..48f4b8b620 100644
--- a/web/src/components/settings/ProviderTile.test.tsx
+++ b/web/src/components/settings/ProviderTile.test.tsx
@@ -1,22 +1,26 @@
-import { render, screen } from "@testing-library/react";
+import { render, screen, within } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import { describe, expect, it, vi } from "vitest";
 
 import { ProviderTile, ProviderTileGrid } from "@/components/settings/ProviderTile";
 
 describe("ProviderTileGrid", () => {
-  it("stops at two columns so tile headers do not truncate the provider name", () => {
-    const { container } = render(
+  it("lists providers as rows, with the button on the provider's own line", () => {
+    render(
       <ProviderTileGrid>
-        <ProviderTile name="OpenSubtitles" tagline="Community subtitles" state="connected" />
+        <ProviderTile
+          name="OpenSubtitles"
+          tagline="Community subtitles"
+          state="not_connected"
+          primaryAction={{ label: "Connect", onClick: () => {} }}
+        />
       </ProviderTileGrid>,
     );
 
-    expect(screen.getByRole("group", { name: "OpenSubtitles" })).toBeInTheDocument();
-    expect(screen.getByText("Community subtitles")).toBeInTheDocument();
-    const grid = container.firstElementChild;
-    expect(grid).toHaveClass("sm:grid-cols-2");
-    expect(grid?.className).not.toMatch(/grid-cols-3/);
+    const row = screen.getByRole("group", { name: "OpenSubtitles" });
+    expect(row).toHaveClass("provider-row");
+    expect(within(row).getByText("Community subtitles")).toBeInTheDocument();
+    expect(within(row).getByRole("button", { name: "Connect" })).toBeInTheDocument();
   });
 });
 
diff --git a/web/src/components/settings/ProviderTile.tsx b/web/src/components/settings/ProviderTile.tsx
index 38e786d9c5..094e7c16e2 100644
--- a/web/src/components/settings/ProviderTile.tsx
+++ b/web/src/components/settings/ProviderTile.tsx
@@ -70,7 +70,7 @@ export function ProviderState({
     <span
       data-state={state}
       className={cn(
-        "inline-flex shrink-0 items-center gap-1.5 text-[11.5px] whitespace-nowrap",
+        "inline-flex shrink-0 items-center gap-1.5 text-xs whitespace-nowrap",
         state === "error" ? "text-amber-600 dark:text-amber-400" : "text-muted-foreground",
         className,
       )}
@@ -82,10 +82,8 @@ export function ProviderState({
 }
 
 /**
- * Two-up grid for tiles; an expanded tile spans the full width inside it.
- * It stops at two columns on purpose: the settings content column is clamped
- * to `max-w-3xl`, so a third column leaves each tile too narrow for its header
- * (monogram, name, badge, state pill) and truncates provider names.
+ * The list providers sit in: one row each, divided by hairlines like every
+ * other settings row. An expanded row opens its panel in place.
  */
 export function ProviderTileGrid({
   className,
@@ -94,7 +92,7 @@ export function ProviderTileGrid({
   className?: string;
   children: ReactNode;
 }) {
-  return <div className={cn("grid gap-3 sm:grid-cols-2", className)}>{children}</div>;
+  return <div className={cn("provider-list flex min-w-0 flex-col", className)}>{children}</div>;
 }
 
 /** Result of the last Test on a tile, kept in memory for the tile itself. */
@@ -153,8 +151,8 @@ export function ProviderPanelActions({
           role="status"
           className={
             test.ok
-              ? "text-muted-foreground mr-auto text-[11.5px]"
-              : "mr-auto text-[11.5px] text-amber-600 dark:text-amber-400"
+              ? "text-muted-foreground mr-auto text-xs"
+              : "mr-auto text-xs text-amber-600 dark:text-amber-400"
           }
         >
           {test.ok ? testedLabel(test) : test.message}
@@ -166,9 +164,10 @@ export function ProviderPanelActions({
 }
 
 /**
- * One third-party provider: identity, connection state, and — once expanded —
- * its credential panel inline instead of in a dialog, so the admin never loses
- * sight of the list they are working through.
+ * One third-party provider as a settings row: identity, connection state and
+ * its button, and — once expanded — its credential panel inline instead of in
+ * a dialog, so the admin never loses sight of the list they are working
+ * through.
  */
 export function ProviderTile({
   name,
@@ -196,13 +195,9 @@ export function ProviderTile({
       aria-labelledby={headingId}
       data-state={state}
       data-expanded={expanded ? "true" : undefined}
-      className={cn(
-        "border-border/70 bg-foreground/[0.02] flex min-w-0 flex-col rounded-2xl border p-4",
-        expanded && "col-span-full shadow-lg",
-        className,
-      )}
+      className={cn("provider-row flex min-w-0 flex-col py-3.5", className)}
     >
-      <div className="flex items-center gap-3">
+      <div className="flex flex-wrap items-center gap-x-3 gap-y-2">
         <span
           aria-hidden="true"
           className={cn(
@@ -222,47 +217,35 @@ export function ProviderTile({
           {tagline ? (
             <p className="text-muted-foreground mt-0.5 text-xs leading-snug">{tagline}</p>
           ) : null}
+          {meta ? (
+            <p
+              className={cn(
+                "mt-1 text-xs",
+                state === "error" ? "text-amber-600 dark:text-amber-400" : "text-muted-foreground",
+              )}
+            >
+              {meta}
+            </p>
+          ) : null}
         </div>
-        <div className="flex shrink-0 items-center gap-2.5">
+        <div className="ml-auto flex shrink-0 items-center gap-2.5">
           <ProviderState state={state} label={statePill} />
           {headerActions}
+          {!expanded && primaryAction ? (
+            <Button
+              type="button"
+              size="sm"
+              variant="outline"
+              onClick={primaryAction.onClick}
+              disabled={primaryAction.disabled}
+            >
+              {primaryAction.label}
+            </Button>
+          ) : null}
         </div>
       </div>
 
-      {/* Grid rows stretch the tiles to equal height, but a taller tagline
-          would otherwise push these rows down in one tile and not its
-          neighbor. `mt-auto` on the first bottom-block element pins the
-          action and meta lines to the tile foot, so they sit on the same
-          baseline across every tile in the row. */}
-      {!expanded && primaryAction ? (
-        <div className="mt-auto flex justify-end pt-3.5">
-          <Button
-            type="button"
-            size="sm"
-            variant="outline"
-            onClick={primaryAction.onClick}
-            disabled={primaryAction.disabled}
-          >
-            {primaryAction.label}
-          </Button>
-        </div>
-      ) : null}
-
-      {meta ? (
-        <p
-          className={cn(
-            "text-[11.5px]",
-            !expanded && primaryAction ? "mt-2.5" : "mt-auto pt-2.5",
-            state === "error" ? "text-amber-600 dark:text-amber-400" : "text-muted-foreground",
-          )}
-        >
-          {meta}
-        </p>
-      ) : null}
-
-      {expanded && children ? (
-        <div className="border-border/70 mt-3.5 border-t pt-3.5">{children}</div>
-      ) : null}
+      {expanded && children ? <div className="mt-3.5 pl-12">{children}</div> : null}
     </fieldset>
   );
 }
diff --git a/web/src/components/settings/RegistrySettingControl.tsx b/web/src/components/settings/RegistrySettingControl.tsx
index c283b91a3c..e7248e98b5 100644
--- a/web/src/components/settings/RegistrySettingControl.tsx
+++ b/web/src/components/settings/RegistrySettingControl.tsx
@@ -32,7 +32,7 @@ function selectOptions(definition: SettingDisplay, value: string) {
   const options = optionsFor(definition);
   const numeric = definition.type === "integer" || definition.type === "number";
   if (!numeric || options.some((option) => option.value !== "")) return options;
-  const unsetLabel = definition.key === "playback.max_bitrate_kbps" ? "No limit" : "Unset";
+  const unsetLabel = definition.unit === "kbps" ? "No limit" : "Unset";
   return bitrateSelectChoices(definition, value, unsetLabel);
 }
 
diff --git a/web/src/components/settings/RestartBadge.tsx b/web/src/components/settings/RestartBadge.tsx
index de50d0d973..bbbbb5a34e 100644
--- a/web/src/components/settings/RestartBadge.tsx
+++ b/web/src/components/settings/RestartBadge.tsx
@@ -16,7 +16,7 @@ export function RestartBadge({ className }: { className?: string }) {
       aria-label={RESTART_TITLE}
       className={cn(
         "inline-flex shrink-0 items-center gap-1 rounded-md border border-amber-500/25",
-        "bg-amber-500/10 px-1.5 py-0.5 text-[10px] font-medium tracking-wide",
+        "bg-amber-500/10 px-1.5 py-0.5 text-xs font-medium tracking-wide",
         "text-amber-600 dark:text-amber-400",
         className,
       )}
diff --git a/web/src/components/settings/SettingsGroup.tsx b/web/src/components/settings/SettingsGroup.tsx
index ac97fa3de2..d724da17c0 100644
--- a/web/src/components/settings/SettingsGroup.tsx
+++ b/web/src/components/settings/SettingsGroup.tsx
@@ -17,9 +17,14 @@ interface SettingsGroupProps {
 }
 
 /**
- * The one settings panel: a quiet surface with a small title, shared by the
- * user settings pages and (via the admin `FieldGroup` wrapper) the admin
- * settings pages, so both surfaces read as the same product.
+ * The one settings section, shared by the user settings pages and (via the
+ * admin `FieldGroup` wrapper) the admin settings pages, so both surfaces read
+ * as the same product. Sections sit on the page itself, divided by hairlines
+ * rather than drawn as cards. Once the section is wide enough its title and
+ * description move into a left column beside the settings, which uses the
+ * width a wide screen has instead of leaving it empty. Only from `lg`, where
+ * the sidebar appears: below it a section can be just as wide, and would go
+ * two-column, then back to one as the sidebar took its width.
  */
 export function SettingsGroup({
   title,
@@ -34,20 +39,26 @@ export function SettingsGroup({
     <section
       role="group"
       aria-labelledby={titleId}
-      className={cn("surface-panel-raised px-4 py-5 sm:px-6", className)}
+      className={cn("settings-section @container/settings-section", className)}
     >
-      <div className="flex flex-wrap items-baseline justify-between gap-x-3 gap-y-1">
-        <div className="min-w-0 space-y-1">
-          <h3 id={titleId} className="text-foreground text-sm font-semibold tracking-tight">
-            {title}
-          </h3>
+      <div className="grid gap-x-12 gap-y-4 lg:@[52rem]/settings-section:grid-cols-[16rem_minmax(0,1fr)]">
+        <div className="min-w-0 space-y-1.5">
+          <div className="flex items-baseline justify-between gap-3">
+            <h3 id={titleId} className="text-foreground text-[15px] font-semibold tracking-tight">
+              {title}
+            </h3>
+            {actions ? <div className="flex shrink-0 items-center gap-2">{actions}</div> : null}
+          </div>
           {description ? (
             <p className="text-muted-foreground text-[13px] leading-relaxed">{description}</p>
           ) : null}
         </div>
-        {actions ? <div className="flex shrink-0 items-center gap-2">{actions}</div> : null}
+        <div
+          className={cn("min-w-0", flush ? "lg:@[52rem]/settings-section:-mt-3.5" : "space-y-4")}
+        >
+          {children}
+        </div>
       </div>
-      <div className={flush ? "mt-2" : "mt-5 space-y-4"}>{children}</div>
     </section>
   );
 }
diff --git a/web/src/components/settings/SettingsIndexList.tsx b/web/src/components/settings/SettingsIndexList.tsx
new file mode 100644
index 0000000000..2af36c37fc
--- /dev/null
+++ b/web/src/components/settings/SettingsIndexList.tsx
@@ -0,0 +1,90 @@
+import { ChevronRight } from "lucide-react";
+import type { LucideIcon } from "lucide-react";
+import { Link } from "react-router";
+
+export interface SettingsIndexItem {
+  id: string;
+  label: string;
+  description: string;
+  icon: LucideIcon;
+  href: string;
+}
+
+export interface SettingsIndexGroup {
+  label: string;
+  items: readonly SettingsIndexItem[];
+}
+
+interface SettingsIndexListProps {
+  groups: readonly SettingsIndexGroup[];
+  ariaLabel: string;
+  idPrefix: string;
+}
+
+function groupSectionId(idPrefix: string, label: string) {
+  return `${idPrefix}-${label.toLowerCase().replace(/[^a-z0-9]+/g, "-")}`;
+}
+
+/**
+ * Every personal settings page as a grouped list. Phones show it at the
+ * settings root, where desktop has the settings sidebar instead.
+ */
+export function SettingsIndexList({ groups, ariaLabel, idPrefix }: SettingsIndexListProps) {
+  if (groups.length === 0) {
+    return (
+      <div className="surface-panel-subtle rounded-2xl px-5 py-8 text-center">
+        <p className="font-medium">No matching settings</p>
+        <p className="text-muted-foreground mt-1 text-sm">
+          Try a category, feature, or setting name.
+        </p>
+      </div>
+    );
+  }
+
+  return (
+    <nav aria-label={ariaLabel} className="space-y-6">
+      {groups.map((group) => {
+        const sectionId = groupSectionId(idPrefix, group.label);
+
+        return (
+          <section key={group.label} aria-labelledby={sectionId}>
+            <h2
+              id={sectionId}
+              className="text-muted-foreground mb-2 px-1 text-xs font-semibold tracking-[0.16em] uppercase"
+            >
+              {group.label}
+            </h2>
+            <ul className="surface-panel overflow-hidden rounded-2xl border-0 shadow-none">
+              {group.items.map((item) => {
+                const Icon = item.icon;
+
+                return (
+                  <li key={item.id} className="border-border/60 border-b last:border-b-0">
+                    <Link
+                      to={item.href}
+                      className="hover:bg-surface-hover/70 focus-visible:bg-surface-hover/70 focus-visible:ring-ring/70 flex min-h-[4.5rem] items-center gap-3 px-4 py-3 transition-colors focus-visible:ring-2 focus-visible:outline-none focus-visible:ring-inset"
+                    >
+                      <span className="bg-accent text-foreground flex h-9 w-9 shrink-0 items-center justify-center rounded-xl">
+                        <Icon className="h-[18px] w-[18px]" aria-hidden="true" />
+                      </span>
+                      <span className="min-w-0 flex-1">
+                        <span className="block text-sm font-semibold">{item.label}</span>
+                        <span className="text-muted-foreground mt-0.5 block text-xs leading-snug">
+                          {item.description}
+                        </span>
+                      </span>
+                      <ChevronRight
+                        className="text-muted-foreground h-4 w-4 shrink-0"
+                        aria-hidden="true"
+                      />
+                    </Link>
+                  </li>
+                );
+              })}
+            </ul>
+          </section>
+        );
+      })}
+    </nav>
+  );
+}
diff --git a/web/src/components/settings/SettingsOverviewNav.tsx b/web/src/components/settings/SettingsOverviewNav.tsx
deleted file mode 100644
index c22ea3edad..0000000000
--- a/web/src/components/settings/SettingsOverviewNav.tsx
+++ /dev/null
@@ -1,142 +0,0 @@
-import { ChevronRight } from "lucide-react";
-import type { LucideIcon } from "lucide-react";
-import { Link } from "react-router";
-
-import { cn } from "@/lib/utils";
-
-export interface SettingsOverviewNavItem {
-  id: string;
-  label: string;
-  description: string;
-  icon: LucideIcon;
-  href: string;
-}
-
-export interface SettingsOverviewNavGroup {
-  label: string;
-  items: readonly SettingsOverviewNavItem[];
-}
-
-interface SettingsOverviewNavProps {
-  groups: readonly SettingsOverviewNavGroup[];
-  ariaLabel: string;
-  idPrefix: string;
-  variant?: "grouped-list" | "directory";
-}
-
-function groupSectionId(idPrefix: string, label: string) {
-  return `${idPrefix}-${label.toLowerCase().replace(/[^a-z0-9]+/g, "-")}`;
-}
-
-export function SettingsOverviewNav({
-  groups,
-  ariaLabel,
-  idPrefix,
-  variant = "grouped-list",
-}: SettingsOverviewNavProps) {
-  const isDirectory = variant === "directory";
-
-  if (groups.length === 0) {
-    return (
-      <div className="surface-panel-subtle rounded-2xl px-5 py-8 text-center">
-        <p className="font-medium">No matching settings</p>
-        <p className="text-muted-foreground mt-1 text-sm">
-          Try a category, feature, or setting name.
-        </p>
-      </div>
-    );
-  }
-
-  // No category jump bar: it listed the same group names, with the same
-  // counts, directly above the headings that repeat them — and on an index
-  // this short it saved about one scroll flick.
-  return (
-    <nav
-      aria-label={ariaLabel}
-      className={cn(
-        "grid items-start gap-6 lg:grid-cols-2",
-        isDirectory && "block space-y-6 lg:space-y-10",
-      )}
-    >
-      {groups.map((group) => {
-        const sectionId = groupSectionId(idPrefix, group.label);
-
-        return (
-          <section key={group.label} aria-labelledby={sectionId}>
-            <h2
-              id={sectionId}
-              className={cn(
-                "text-muted-foreground mb-2 px-1 text-[11px] font-semibold tracking-[0.16em] uppercase",
-                isDirectory &&
-                  "lg:text-foreground lg:mb-3 lg:px-0 lg:text-base lg:font-semibold lg:tracking-tight lg:normal-case",
-              )}
-            >
-              {group.label}
-            </h2>
-            <ul
-              className={cn(
-                "surface-panel overflow-hidden rounded-2xl border-0 shadow-none",
-                isDirectory &&
-                  "lg:grid lg:grid-cols-2 lg:gap-3 lg:overflow-visible lg:rounded-none lg:bg-transparent 2xl:grid-cols-4",
-              )}
-            >
-              {group.items.map((item) => {
-                const Icon = item.icon;
-
-                return (
-                  <li
-                    key={item.id}
-                    className={cn(
-                      "border-border/60 border-b last:border-b-0",
-                      isDirectory && "lg:border-0",
-                    )}
-                  >
-                    <Link
-                      to={item.href}
-                      className={cn(
-                        "hover:bg-surface-hover/70 focus-visible:bg-surface-hover/70 focus-visible:ring-ring/70 flex min-h-[4.5rem] items-center gap-3 px-4 py-3 transition-colors focus-visible:ring-2 focus-visible:outline-none focus-visible:ring-inset",
-                        isDirectory &&
-                          "lg:bg-card/45 lg:border-border/70 lg:hover:border-ring/40 lg:h-28 lg:rounded-xl lg:border lg:px-4 lg:py-4 lg:shadow-sm lg:hover:-translate-y-0.5 lg:hover:shadow-md lg:focus-visible:-translate-y-0.5",
-                      )}
-                    >
-                      <span
-                        className={cn(
-                          "bg-accent text-foreground flex h-9 w-9 shrink-0 items-center justify-center rounded-xl",
-                          isDirectory && "lg:h-10 lg:w-10",
-                        )}
-                      >
-                        <Icon className="h-[18px] w-[18px]" aria-hidden="true" />
-                      </span>
-                      <span className="min-w-0 flex-1">
-                        <span
-                          className={cn(
-                            "block text-sm font-semibold",
-                            isDirectory && "lg:text-[15px]",
-                          )}
-                        >
-                          {item.label}
-                        </span>
-                        <span
-                          className={cn(
-                            "text-muted-foreground mt-0.5 block text-xs leading-snug",
-                            isDirectory && "lg:line-clamp-3",
-                          )}
-                        >
-                          {item.description}
-                        </span>
-                      </span>
-                      <ChevronRight
-                        className="text-muted-foreground h-4 w-4 shrink-0"
-                        aria-hidden="true"
-                      />
-                    </Link>
-                  </li>
-                );
-              })}
-            </ul>
-          </section>
-        );
-      })}
-    </nav>
-  );
-}
diff --git a/web/src/components/settings/SettingsPageHeader.tsx b/web/src/components/settings/SettingsPageHeader.tsx
index 500f2e91ac..38d3c17db9 100644
--- a/web/src/components/settings/SettingsPageHeader.tsx
+++ b/web/src/components/settings/SettingsPageHeader.tsx
@@ -1,6 +1,7 @@
-import type { ReactNode } from "react";
+import { useContext, type ReactNode } from "react";
 
-import { cn } from "@/lib/utils";
+import { PageHeader } from "@/components/page/PageHeader";
+import { SettingsPageDescriptionContext } from "@/components/settings/settingsPageDescription";
 import "@/styles/admin-settings.css";
 
 export interface SettingsPageHeaderProps {
@@ -10,15 +11,10 @@ export interface SettingsPageHeaderProps {
   className?: string;
 }
 
-/**
- * The heading every admin settings page opens with: the page's name and
- * nothing else.
- */
+/** The heading every admin settings page opens with: the shared `PageHeader`. */
 export function SettingsPageHeader({ title, actions, className }: SettingsPageHeaderProps) {
+  const description = useContext(SettingsPageDescriptionContext);
   return (
-    <header className={cn("flex min-w-0 flex-wrap items-start justify-between gap-3", className)}>
-      <h1 className="text-[28px] leading-tight font-semibold tracking-[-0.03em]">{title}</h1>
-      {actions ? <div className="flex shrink-0 items-center gap-2">{actions}</div> : null}
-    </header>
+    <PageHeader title={title} subtitle={description} actions={actions} className={className} />
   );
 }
diff --git a/web/src/components/settings/SettingsPageRail.tsx b/web/src/components/settings/SettingsPageRail.tsx
deleted file mode 100644
index b4601f4f68..0000000000
--- a/web/src/components/settings/SettingsPageRail.tsx
+++ /dev/null
@@ -1,37 +0,0 @@
-import { SideNavItem, SideNavSection } from "@/components/SideNav";
-import { ADMIN_SETTINGS_NAV, type AdminSettingsSearchItem } from "@/lib/adminSettingsSearch";
-import { settingsPageHref } from "@/hooks/admin/useSettingsOverview";
-
-export interface SettingsPageRailProps {
-  /** Page id of the page being shown, e.g. `general`. */
-  activeId: string;
-  /** Pages to show — pass the search-filtered list; defaults to every page. */
-  items?: readonly AdminSettingsSearchItem[];
-}
-
-/**
- * The admin settings sibling nav: every settings page one hop away, rendered
- * with the same `SideNavItem` rail the user settings page uses so the two
- * settings surfaces read identically. Desktop only — on smaller screens the
- * Overview (via the All settings link) is the directory.
- */
-export function SettingsPageRail({ activeId, items = ADMIN_SETTINGS_NAV }: SettingsPageRailProps) {
-  return (
-    <nav aria-label="Settings pages" className="sticky top-6 space-y-5 py-5 pr-3 pl-5">
-      <SideNavSection label="Settings" idPrefix="admin-settings-nav">
-        {items.map((item) => (
-          <SideNavItem
-            key={item.id}
-            label={item.label}
-            icon={item.icon}
-            href={settingsPageHref(item.id)}
-            active={item.id === activeId}
-          />
-        ))}
-      </SideNavSection>
-      {items.length === 0 ? (
-        <p className="text-muted-foreground px-2 text-sm">No matching settings</p>
-      ) : null}
-    </nav>
-  );
-}
diff --git a/web/src/components/settings/SettingsSearchInput.tsx b/web/src/components/settings/SettingsSearchInput.tsx
index f0a657a6ac..2b4682d47e 100644
--- a/web/src/components/settings/SettingsSearchInput.tsx
+++ b/web/src/components/settings/SettingsSearchInput.tsx
@@ -97,7 +97,7 @@ export function SettingsSearchInput({
         ) : showShortcutHint ? (
           <kbd
             aria-hidden="true"
-            className="border-border/80 bg-surface text-muted-foreground pointer-events-none absolute top-1/2 right-2 hidden h-6 -translate-y-1/2 items-center rounded-md border px-1.5 font-sans text-[10px] font-medium sm:inline-flex"
+            className="border-border/80 bg-surface text-muted-foreground pointer-events-none absolute top-1/2 right-2 hidden h-6 -translate-y-1/2 items-center rounded-md border px-1.5 font-sans text-xs font-medium sm:inline-flex"
           >
             {SEARCH_SHORTCUT_LABEL}
           </kbd>
diff --git a/web/src/components/settings/SettingsSidebar.tsx b/web/src/components/settings/SettingsSidebar.tsx
new file mode 100644
index 0000000000..08148efd06
--- /dev/null
+++ b/web/src/components/settings/SettingsSidebar.tsx
@@ -0,0 +1,119 @@
+import { ArrowLeft } from "lucide-react";
+import type { LucideIcon } from "lucide-react";
+import type { ReactNode } from "react";
+
+import { SideNavItem, SideNavSection } from "@/components/SideNav";
+import ViewTransitionLink from "@/components/ViewTransitionLink";
+import { SettingsSearchInput } from "@/components/settings/SettingsSearchInput";
+import type { SidebarSwap } from "@/hooks/useSidebarSwap";
+import { cn } from "@/lib/utils";
+
+const DESKTOP_MEDIA_QUERY = "(min-width: 64rem)";
+
+export interface SettingsSidebarItem {
+  id: string;
+  label: string;
+  icon: LucideIcon;
+  href: string;
+}
+
+export interface SettingsSidebarGroup {
+  label: string;
+  items: readonly SettingsSidebarItem[];
+}
+
+export interface SettingsSidebarProps {
+  /** Shown above the search box, e.g. "Settings" or "Server settings". */
+  title: string;
+  backTo: string;
+  backLabel: string;
+  /** Groups to list, already narrowed by `search`. */
+  groups: readonly SettingsSidebarGroup[];
+  activeId: string | null;
+  search: string;
+  onSearchChange: (value: string) => void;
+  resultCount: number;
+  /** See `SettingsSearchInput`; off where another surface owns ⌘K. */
+  captureShortcut?: boolean;
+  /** Prefix for group heading ids, so two settings areas never collide. */
+  idPrefix: string;
+  /** Rendered under the title: whose settings these are. */
+  scope?: ReactNode;
+  /** Set when this sidebar just replaced the shell's own; see useSidebarSwap. */
+  entrance?: SidebarSwap;
+  className?: string;
+}
+
+/**
+ * The sidebar personal settings put in place of the app's navigation: a way
+ * back out, search, and every settings page grouped. `Layout` renders it at
+ * the app sidebar's width, so entering settings swaps what the column holds
+ * instead of adding a second column beside it.
+ */
+export function SettingsSidebar({
+  title,
+  backTo,
+  backLabel,
+  groups,
+  activeId,
+  search,
+  onSearchChange,
+  resultCount,
+  captureShortcut,
+  idPrefix,
+  scope,
+  entrance,
+  className,
+}: SettingsSidebarProps) {
+  return (
+    <aside
+      data-settings-sidebar=""
+      data-sidebar-entrance={entrance}
+      className={cn(
+        "border-sidebar-border/70 bg-sidebar/92 fixed top-0 bottom-0 left-0 z-40 flex flex-col border-r backdrop-blur-2xl",
+        className,
+      )}
+    >
+      <div className="space-y-4 px-3 pt-6 pb-4">
+        <ViewTransitionLink
+          to={backTo}
+          up
+          className="text-muted-foreground hover:text-foreground hover:bg-accent/70 focus-visible:ring-ring/60 flex w-fit items-center gap-2 rounded-lg px-2 py-1.5 text-[13px] font-medium transition-colors focus-visible:ring-[3px] focus-visible:outline-none"
+        >
+          <ArrowLeft className="h-4 w-4" aria-hidden="true" />
+          {backLabel}
+        </ViewTransitionLink>
+        <p className="px-2 text-[22px] leading-tight font-extrabold tracking-[-0.03em]">{title}</p>
+        {scope}
+        <SettingsSearchInput
+          value={search}
+          onChange={onSearchChange}
+          resultCount={resultCount}
+          captureShortcut={captureShortcut}
+          // The shells keep this sidebar mounted but hidden below lg, where the
+          // page's own search box is the one on screen.
+          shortcutMediaQuery={DESKTOP_MEDIA_QUERY}
+        />
+      </div>
+
+      <nav aria-label={title} className="sidebar-scroll flex-1 space-y-5 overflow-y-auto px-3 pb-6">
+        {groups.map((group) => (
+          <SideNavSection key={group.label} label={group.label} idPrefix={idPrefix}>
+            {group.items.map((item) => (
+              <SideNavItem
+                key={item.id}
+                label={item.label}
+                icon={item.icon}
+                href={item.href}
+                active={item.id === activeId}
+              />
+            ))}
+          </SideNavSection>
+        ))}
+        {groups.length === 0 ? (
+          <p className="text-muted-foreground px-2 text-sm">No matching settings</p>
+        ) : null}
+      </nav>
+    </aside>
+  );
+}
diff --git a/web/src/components/settings/SettingsSubheading.tsx b/web/src/components/settings/SettingsSubheading.tsx
index 72940d2713..84f8eda15a 100644
--- a/web/src/components/settings/SettingsSubheading.tsx
+++ b/web/src/components/settings/SettingsSubheading.tsx
@@ -12,8 +12,8 @@ export interface SettingsSubheadingProps {
 
 /**
  * A divider inside a settings group: the one treatment for a sub-grouping label,
- * so "Per user" in Downloads, "Mail Server" in Notifications and "Permission
- * checks" in Infrastructure read as the same kind of thing.
+ * so "Per user" in Downloads, "HDR chapter thumbnails" in Playback and
+ * "Permission checks" in Logging read as the same kind of thing.
  *
  * Deliberately quieter than a `SettingsGroup` title and than a row label — it
  * separates rows without competing with them, which is what four different
@@ -22,11 +22,11 @@ export interface SettingsSubheadingProps {
 export function SettingsSubheading({ children, caption }: SettingsSubheadingProps) {
   return (
     <div className="pt-4 pb-1">
-      <h4 className="text-muted-foreground/80 text-[11px] font-semibold tracking-wider uppercase">
+      <h4 className="text-muted-foreground text-xs font-semibold tracking-wider uppercase">
         {children}
       </h4>
       {caption ? (
-        <p className="text-muted-foreground mt-1 text-xs leading-relaxed">{caption}</p>
+        <p className="text-muted-foreground mt-1 text-[13px] leading-relaxed">{caption}</p>
       ) : null}
     </div>
   );
diff --git a/web/src/components/settings/SubtitleAppearancePanelView.tsx b/web/src/components/settings/SubtitleAppearancePanelView.tsx
index 8f33140e5c..f50d8b1001 100644
--- a/web/src/components/settings/SubtitleAppearancePanelView.tsx
+++ b/web/src/components/settings/SubtitleAppearancePanelView.tsx
@@ -96,7 +96,7 @@ export function SubtitleAppearancePanelView({
         {/* Header */}
         <div className="flex items-center justify-between border-b border-white/[0.08] px-5 py-3.5">
           <div className="flex flex-col">
-            <div className="text-[10px] font-semibold tracking-[0.22em] text-white/50 uppercase">
+            <div className="text-xs font-semibold tracking-[0.22em] text-white/65 uppercase">
               {eyebrow}
             </div>
             <div className="text-[17px] font-semibold tracking-tight text-white">
@@ -243,7 +243,7 @@ export function SubtitleAppearancePanelView({
           ) : (
             <span aria-hidden="true" />
           )}
-          <div className="text-[11px] tracking-wide text-white/40 uppercase">{status}</div>
+          <div className="text-xs tracking-wide text-white/65 uppercase">{status}</div>
         </div>
       </div>
     </div>,
@@ -260,9 +260,7 @@ export function SubtitleAppearancePanelView({
 function Section({ label, children }: { label: string; children: ReactNode }) {
   return (
     <section className="space-y-3">
-      <div className="text-[10.5px] font-semibold tracking-[0.2em] text-white/45 uppercase">
-        {label}
-      </div>
+      <div className="text-xs font-semibold tracking-[0.2em] text-white/65 uppercase">{label}</div>
       <div className="space-y-3">{children}</div>
     </section>
   );
@@ -306,7 +304,7 @@ function PillGroup<T extends string>({
             role="radio"
             aria-checked={active}
             onClick={() => onChange(option.value)}
-            className={`inline-flex items-center rounded-full px-3 py-1 text-[12.5px] font-medium transition-colors focus-visible:ring-2 focus-visible:ring-white/70 focus-visible:outline-none ${
+            className={`inline-flex items-center rounded-full px-3 py-1 text-[13px] font-medium transition-colors focus-visible:ring-2 focus-visible:ring-white/70 focus-visible:outline-none ${
               active
                 ? "bg-white text-black"
                 : "bg-white/[0.06] text-white/75 hover:bg-white/10 hover:text-white"
@@ -388,9 +386,9 @@ function PercentField({
         onKeyDown={(e) => {
           if (e.key === "Enter") e.currentTarget.blur();
         }}
-        className="w-14 [appearance:textfield] rounded-md border border-white/15 bg-white/[0.06] px-2 py-1 text-right text-[12.5px] text-white outline-none focus-visible:ring-2 focus-visible:ring-white/70 [&::-webkit-inner-spin-button]:appearance-none [&::-webkit-outer-spin-button]:appearance-none"
+        className="w-14 [appearance:textfield] rounded-md border border-white/15 bg-white/[0.06] px-2 py-1 text-right text-[13px] text-white outline-none focus-visible:ring-2 focus-visible:ring-white/70 [&::-webkit-inner-spin-button]:appearance-none [&::-webkit-outer-spin-button]:appearance-none"
       />
-      <span className="text-[12.5px] text-white/60">%</span>
+      <span className="text-[13px] text-white/60">%</span>
     </div>
   );
 }
diff --git a/web/src/components/settings/UserSettingsSidebar.tsx b/web/src/components/settings/UserSettingsSidebar.tsx
new file mode 100644
index 0000000000..eee4d0c147
--- /dev/null
+++ b/web/src/components/settings/UserSettingsSidebar.tsx
@@ -0,0 +1,61 @@
+import { useMemo, useState } from "react";
+import { useLocation } from "react-router";
+
+import { CurrentProfileLink } from "@/components/settings/CurrentProfileLink";
+import { SettingsSidebar } from "@/components/settings/SettingsSidebar";
+import {
+  countSettingsSearchItems,
+  filterSettingsSearchGroups,
+} from "@/components/settings/settingsSearch";
+import { useSidebarEntrance, type SidebarSwap } from "@/hooks/useSidebarSwap";
+import { useUserSettingsGroups } from "@/hooks/useUserSettingsGroups";
+import { userSettingsHref } from "@/lib/userSettingsNav";
+
+/**
+ * The app sidebar while a personal settings page is open. `Layout` mounts it
+ * in place of `AppSidebar`, at the same 260px width.
+ */
+export default function UserSettingsSidebar({
+  backTo,
+  swap,
+}: {
+  backTo: string;
+  swap?: SidebarSwap | null;
+}) {
+  const location = useLocation();
+  const entrance = useSidebarEntrance(swap);
+  const groups = useUserSettingsGroups();
+  const [search, setSearch] = useState("");
+  const filteredGroups = useMemo(
+    () => filterSettingsSearchGroups(groups, search),
+    [groups, search],
+  );
+  // The root redirects to the first page; marking it now saves a frame with
+  // nothing selected.
+  const activeId = location.pathname.split("/")[2] || groups[0]?.items[0]?.path || null;
+
+  return (
+    <SettingsSidebar
+      title="Settings"
+      backTo={backTo}
+      backLabel="Back to App"
+      groups={filteredGroups.map((group) => ({
+        label: group.label,
+        items: group.items.map((item) => ({
+          id: item.path,
+          label: item.label,
+          icon: item.icon,
+          href: userSettingsHref(item.path),
+        })),
+      }))}
+      activeId={activeId}
+      search={search}
+      onSearchChange={setSearch}
+      resultCount={countSettingsSearchItems(filteredGroups)}
+      idPrefix="settings-nav"
+      scope={<CurrentProfileLink />}
+      entrance={entrance}
+      className="w-[260px]"
+    />
+  );
+}
diff --git a/web/src/components/settings/settingsPageDescription.ts b/web/src/components/settings/settingsPageDescription.ts
new file mode 100644
index 0000000000..94da25e806
--- /dev/null
+++ b/web/src/components/settings/settingsPageDescription.ts
@@ -0,0 +1,8 @@
+import { createContext } from "react";
+
+/**
+ * The description of the admin settings page on screen, from the settings
+ * index. The settings layout provides it so every page's header carries the
+ * same sentence the sidebar search shows, without each page repeating it.
+ */
+export const SettingsPageDescriptionContext = createContext<string | undefined>(undefined);
diff --git a/web/src/components/theme/RawCssEditor.tsx b/web/src/components/theme/RawCssEditor.tsx
deleted file mode 100644
index d05805e03b..0000000000
--- a/web/src/components/theme/RawCssEditor.tsx
+++ /dev/null
@@ -1,59 +0,0 @@
-import { cn } from "@/lib/utils";
-import { MAX_CSS_SIZE } from "@/lib/themeTokens";
-
-interface RawCssEditorProps {
-  value: string;
-  onChange: (css: string) => void;
-}
-
-export function RawCssEditor({ value, onChange }: RawCssEditorProps) {
-  const bytes = new TextEncoder().encode(value).length;
-  const pct = Math.min(100, (bytes / MAX_CSS_SIZE) * 100);
-  const isNearLimit = pct > 90;
-  const isOverLimit = bytes > MAX_CSS_SIZE;
-
-  return (
-    <div className="space-y-3">
-      <div className="space-y-1">
-        <p className="text-muted-foreground text-[13px] leading-relaxed">
-          Write custom CSS that is injected after all theme variables. Target any selector — your
-          overrides apply on top of Cinema Dark for everyone. Use{" "}
-          <code className="bg-muted rounded px-1 py-0.5 text-xs">:root</code> to override CSS custom
-          properties directly.
-        </p>
-      </div>
-
-      <textarea
-        value={value}
-        onChange={(e) => {
-          const next = e.target.value;
-          if (new TextEncoder().encode(next).length <= MAX_CSS_SIZE) {
-            onChange(next);
-          }
-        }}
-        placeholder={`/* Example: override the primary color */\n:root {\n  --primary: #ff6b6b;\n}\n\n/* Example: custom scrollbar */\n::-webkit-scrollbar {\n  width: 8px;\n}`}
-        spellCheck={false}
-        className={cn(
-          "border-border bg-background text-foreground placeholder:text-muted-foreground/50 min-h-[240px] w-full resize-y rounded-xl border p-3 font-mono text-[13px] leading-relaxed focus:ring-2 focus:outline-none",
-          isOverLimit ? "focus:ring-destructive" : "focus:ring-ring",
-        )}
-      />
-
-      <div className="flex items-center justify-between">
-        <p className="text-muted-foreground text-[11px]">Applies to everyone once you save.</p>
-        <span
-          className={cn(
-            "font-mono text-[11px]",
-            isOverLimit
-              ? "text-destructive"
-              : isNearLimit
-                ? "text-warning"
-                : "text-muted-foreground",
-          )}
-        >
-          {(bytes / 1024).toFixed(1)} / {MAX_CSS_SIZE / 1024} KB
-        </span>
-      </div>
-    </div>
-  );
-}
diff --git a/web/src/components/theme/ThemePreviewCard.tsx b/web/src/components/theme/ThemePreviewCard.tsx
deleted file mode 100644
index 8ae5753c94..0000000000
--- a/web/src/components/theme/ThemePreviewCard.tsx
+++ /dev/null
@@ -1,123 +0,0 @@
-import type { ThemeVarOverrides } from "@/lib/themeTokens";
-
-interface ThemePreviewCardProps {
-  vars: ThemeVarOverrides;
-}
-
-/** A miniature UI mockup that renders with the given variable overrides applied inline. */
-export function ThemePreviewCard({ vars }: ThemePreviewCardProps) {
-  const v = (token: string, fallback: string) =>
-    (vars as Record<string, string>)[token] ?? `var(--${token}, ${fallback})`;
-
-  return (
-    <div
-      className="overflow-hidden rounded-2xl border"
-      style={{
-        backgroundColor: v("background", "#141417"),
-        borderColor: v("border", "#2a2a2e"),
-        color: v("foreground", "#e8e8ec"),
-      }}
-    >
-      <div className="flex">
-        {/* Sidebar mock */}
-        <div
-          className="hidden w-14 flex-col items-center gap-2 py-3 sm:flex"
-          style={{ backgroundColor: v("sidebar", "#111114") }}
-        >
-          <div
-            className="h-6 w-6 rounded-md"
-            style={{ backgroundColor: v("sidebar-primary", "#e8e8ec") }}
-          />
-          <div
-            className="h-5 w-5 rounded-md"
-            style={{ backgroundColor: v("sidebar-accent", "#222226") }}
-          />
-          <div
-            className="h-5 w-5 rounded-md"
-            style={{ backgroundColor: v("sidebar-accent", "#222226") }}
-          />
-        </div>
-
-        {/* Content area */}
-        <div className="flex-1 p-3">
-          {/* Nav bar mock */}
-          <div className="mb-3 flex items-center gap-2">
-            <div
-              className="h-2 w-2.5 rounded-full"
-              style={{ backgroundColor: v("primary", "#e8e8ec") }}
-            />
-            <div
-              className="h-1.5 w-14 rounded-full"
-              style={{
-                backgroundColor: v("foreground", "#e8e8ec"),
-                opacity: 0.7,
-              }}
-            />
-            <div className="flex-1" />
-            <div
-              className="h-1.5 w-8 rounded-full"
-              style={{
-                backgroundColor: v("muted-foreground", "#71717a"),
-                opacity: 0.5,
-              }}
-            />
-          </div>
-
-          {/* Cards row */}
-          <div className="flex gap-2">
-            <div
-              className="flex-1 space-y-1.5 p-2"
-              style={{
-                backgroundColor: v("card", "#1c1c20"),
-                borderRadius: v("radius", "0.5rem"),
-              }}
-            >
-              <div
-                className="h-1.5 w-16 rounded-full"
-                style={{
-                  backgroundColor: v("foreground", "#e8e8ec"),
-                  opacity: 0.8,
-                }}
-              />
-              <div
-                className="h-1.5 w-full rounded-full"
-                style={{ backgroundColor: v("muted", "#27272a"), opacity: 0.6 }}
-              />
-              <div
-                className="h-1.5 w-3/4 rounded-full"
-                style={{ backgroundColor: v("muted", "#27272a"), opacity: 0.4 }}
-              />
-              <div className="mt-2 flex gap-1.5">
-                <div
-                  className="h-4 w-10 rounded-md"
-                  style={{ backgroundColor: v("primary", "#e8e8ec") }}
-                />
-                <div
-                  className="h-4 w-10 rounded-md"
-                  style={{
-                    backgroundColor: v("secondary", "#27272a"),
-                  }}
-                />
-              </div>
-            </div>
-            <div
-              className="w-16"
-              style={{
-                backgroundColor: v("accent", "#222226"),
-                borderRadius: v("radius", "0.5rem"),
-              }}
-            >
-              <div
-                className="h-full min-h-14"
-                style={{
-                  background: `linear-gradient(180deg, ${v("primary", "#e8e8ec")}22, transparent)`,
-                  borderRadius: v("radius", "0.5rem"),
-                }}
-              />
-            </div>
-          </div>
-        </div>
-      </div>
-    </div>
-  );
-}
diff --git a/web/src/components/theme/TokenEditor.tsx b/web/src/components/theme/TokenEditor.tsx
deleted file mode 100644
index 1528e4713a..0000000000
--- a/web/src/components/theme/TokenEditor.tsx
+++ /dev/null
@@ -1,266 +0,0 @@
-import { useCallback, useMemo } from "react";
-import { RotateCcw } from "lucide-react";
-import { Slider } from "@/components/ui/slider";
-import {
-  TOKEN_GROUP_ORDER,
-  TOKEN_GROUPS,
-  AVAILABLE_FONTS,
-  getComputedToken,
-} from "@/lib/themeTokens";
-import type { ThemeToken, ThemeVarOverrides, TokenMeta } from "@/lib/themeTokens";
-import { cn } from "@/lib/utils";
-
-interface TokenEditorProps {
-  vars: ThemeVarOverrides;
-  onSetVar: (token: ThemeToken, value: string) => void;
-  onResetVar: (token: ThemeToken) => void;
-}
-
-/** Attempt to convert any CSS color value to hex for the color input. */
-function toHex(value: string): string {
-  if (/^#[0-9a-f]{6}$/i.test(value)) return value;
-  // Use a temporary element to resolve CSS colors to rgb
-  try {
-    const el = document.createElement("div");
-    el.style.color = value;
-    document.body.appendChild(el);
-    const computed = getComputedStyle(el).color;
-    document.body.removeChild(el);
-    const match = computed.match(/rgba?\((\d+),\s*(\d+),\s*(\d+)/);
-    if (match) {
-      const [, r, g, b] = match;
-      return `#${[r, g, b].map((c) => Number(c).toString(16).padStart(2, "0")).join("")}`;
-    }
-  } catch {
-    // Ignore
-  }
-  return "#000000";
-}
-
-function ColorTokenInput({
-  meta,
-  value,
-  computedValue,
-  onSet,
-  onReset,
-}: {
-  meta: TokenMeta;
-  value: string | undefined;
-  computedValue: string;
-  onSet: (value: string) => void;
-  onReset: () => void;
-}) {
-  const displayValue = value ?? computedValue;
-  const hexValue = toHex(displayValue);
-  const isOverridden = value !== undefined;
-
-  return (
-    <div className="flex items-center gap-3">
-      <div className="relative">
-        <input
-          type="color"
-          value={hexValue}
-          onChange={(e) => onSet(e.target.value)}
-          className="h-8 w-8 cursor-pointer rounded-lg border-0 bg-transparent p-0"
-          title={meta.label}
-        />
-      </div>
-      <div className="min-w-0 flex-1">
-        <div className="flex items-center gap-2">
-          <span className="text-[13px] font-medium">{meta.label}</span>
-          {isOverridden && (
-            <button
-              type="button"
-              onClick={onReset}
-              className="text-muted-foreground hover:text-foreground"
-              title="Reset to theme default"
-            >
-              <RotateCcw className="h-3 w-3" />
-            </button>
-          )}
-        </div>
-        <span className="text-muted-foreground font-mono text-[11px]">{displayValue}</span>
-      </div>
-    </div>
-  );
-}
-
-function RadiusInput({
-  value,
-  computedValue,
-  onSet,
-  onReset,
-}: {
-  value: string | undefined;
-  computedValue: string;
-  onSet: (value: string) => void;
-  onReset: () => void;
-}) {
-  const currentRem = parseFloat(value ?? computedValue) || 0.5;
-  const isOverridden = value !== undefined;
-
-  return (
-    <div className="space-y-2">
-      <div className="flex items-center justify-between">
-        <div className="flex items-center gap-2">
-          <span className="text-[13px] font-medium">Border Radius</span>
-          {isOverridden && (
-            <button
-              type="button"
-              onClick={onReset}
-              className="text-muted-foreground hover:text-foreground"
-              title="Reset to theme default"
-            >
-              <RotateCcw className="h-3 w-3" />
-            </button>
-          )}
-        </div>
-        <span className="text-muted-foreground font-mono text-[11px]">{currentRem}rem</span>
-      </div>
-      <Slider
-        value={[currentRem]}
-        min={0}
-        max={1.5}
-        step={0.05}
-        onValueChange={([v]) => onSet(`${v}rem`)}
-      />
-      <div className="flex justify-between">
-        <div className="rounded-sm border p-2" style={{ borderRadius: "0rem" }}>
-          <div className="bg-muted h-3 w-6" />
-        </div>
-        <div className="rounded-sm border p-2" style={{ borderRadius: `${currentRem}rem` }}>
-          <div className="bg-primary h-3 w-6" style={{ borderRadius: `${currentRem}rem` }} />
-        </div>
-        <div className="rounded-sm border p-2" style={{ borderRadius: "1.5rem" }}>
-          <div className="bg-muted h-3 w-6" style={{ borderRadius: "1.5rem" }} />
-        </div>
-      </div>
-    </div>
-  );
-}
-
-function FontInput({
-  value,
-  computedValue,
-  onSet,
-  onReset,
-}: {
-  value: string | undefined;
-  computedValue: string;
-  onSet: (value: string) => void;
-  onReset: () => void;
-}) {
-  const currentFont = value ?? computedValue.split(",")[0]?.replace(/["']/g, "").trim() ?? "Outfit";
-  const isOverridden = value !== undefined;
-
-  return (
-    <div className="space-y-2">
-      <div className="flex items-center gap-2">
-        <span className="text-[13px] font-medium">Font Family</span>
-        {isOverridden && (
-          <button
-            type="button"
-            onClick={onReset}
-            className="text-muted-foreground hover:text-foreground"
-            title="Reset to theme default"
-          >
-            <RotateCcw className="h-3 w-3" />
-          </button>
-        )}
-      </div>
-      <div className="flex flex-wrap gap-2">
-        {AVAILABLE_FONTS.map((font) => (
-          <button
-            key={font}
-            type="button"
-            onClick={() => onSet(`"${font}", sans-serif`)}
-            className={cn(
-              "rounded-xl border px-3 py-1.5 text-sm transition-colors",
-              currentFont.includes(font)
-                ? "border-primary bg-primary/10 text-foreground"
-                : "border-border text-muted-foreground hover:border-primary/30 hover:text-foreground",
-            )}
-            style={{ fontFamily: `"${font}", sans-serif` }}
-          >
-            {font}
-          </button>
-        ))}
-      </div>
-    </div>
-  );
-}
-
-export function TokenEditor({ vars, onSetVar, onResetVar }: TokenEditorProps) {
-  // The base theme is fixed, so the painted values only need reading once.
-  const computedValues = useMemo(() => {
-    const map: Partial<Record<ThemeToken, string>> = {};
-    for (const group of Object.values(TOKEN_GROUPS)) {
-      for (const meta of group) {
-        map[meta.token] = getComputedToken(meta.token);
-      }
-    }
-    return map;
-  }, []);
-
-  const handleSet = useCallback(
-    (token: ThemeToken) => (value: string) => onSetVar(token, value),
-    [onSetVar],
-  );
-  const handleReset = useCallback((token: ThemeToken) => () => onResetVar(token), [onResetVar]);
-
-  return (
-    <div className="space-y-6">
-      {TOKEN_GROUP_ORDER.map((groupName) => {
-        const tokens = TOKEN_GROUPS[groupName];
-        if (!tokens) return null;
-
-        return (
-          <div key={groupName}>
-            <h4 className="text-muted-foreground mb-3 text-xs font-semibold tracking-wider uppercase">
-              {groupName}
-            </h4>
-            <div className="space-y-3">
-              {tokens.map((meta) => {
-                if (meta.inputType === "color") {
-                  return (
-                    <ColorTokenInput
-                      key={meta.token}
-                      meta={meta}
-                      value={vars[meta.token]}
-                      computedValue={computedValues[meta.token] ?? ""}
-                      onSet={handleSet(meta.token)}
-                      onReset={handleReset(meta.token)}
-                    />
-                  );
-                }
-                if (meta.inputType === "radius") {
-                  return (
-                    <RadiusInput
-                      key={meta.token}
-                      value={vars[meta.token]}
-                      computedValue={computedValues[meta.token] ?? "0.5rem"}
-                      onSet={handleSet(meta.token)}
-                      onReset={handleReset(meta.token)}
-                    />
-                  );
-                }
-                if (meta.inputType === "font") {
-                  return (
-                    <FontInput
-                      key={meta.token}
-                      value={vars[meta.token]}
-                      computedValue={computedValues[meta.token] ?? '"Outfit", sans-serif'}
-                      onSet={handleSet(meta.token)}
-                      onReset={handleReset(meta.token)}
-                    />
-                  );
-                }
-                return null;
-              })}
-            </div>
-          </div>
-        );
-      })}
-    </div>
-  );
-}
diff --git a/web/src/components/ui/table.tsx b/web/src/components/ui/table.tsx
index 87a86ed2a7..7c2f4271d4 100644
--- a/web/src/components/ui/table.tsx
+++ b/web/src/components/ui/table.tsx
@@ -6,7 +6,7 @@ function Table({ className, ...props }: React.ComponentProps<"table">) {
   return (
     <div
       data-slot="table-container"
-      className="relative w-full [scrollbar-width:thin] overflow-x-auto rounded-[inherit]"
+      className="relative w-full overflow-x-auto rounded-[inherit] [scrollbar-width:thin]"
     >
       <table
         data-slot="table"
diff --git a/web/src/components/watchtonight/CardStack.limit.test.tsx b/web/src/components/watchtonight/CardStack.limit.test.tsx
deleted file mode 100644
index b4fc71aacb..0000000000
--- a/web/src/components/watchtonight/CardStack.limit.test.tsx
+++ /dev/null
@@ -1,45 +0,0 @@
-// @vitest-environment jsdom
-import { fireEvent, render, screen } from "@testing-library/react";
-import { MemoryRouter } from "react-router";
-import { describe, expect, it, vi } from "vitest";
-import CardStack from "./CardStack";
-
-vi.mock("@/playback/watchPlaybackContext", () => ({
-  useWatchPlaybackController: () => ({ startPlayback: vi.fn() }),
-}));
-
-describe("swipe session ending", () => {
-  it("distinguishes a session limit from exhausted recommendations and offers restart", () => {
-    const onReset = vi.fn();
-    const { rerender } = render(
-      <MemoryRouter>
-        <CardStack
-          cards={[]}
-          hasMore={false}
-          pagingLimited
-          isFetching={false}
-          onNeedMore={vi.fn()}
-          onClose={vi.fn()}
-          onReset={onReset}
-        />
-      </MemoryRouter>,
-    );
-    expect(screen.getByText(/end of this swipe session/)).toBeTruthy();
-    expect(screen.queryByText(/seen everything/)).toBeNull();
-    fireEvent.click(screen.getByRole("button", { name: "Start Over" }));
-    expect(onReset).toHaveBeenCalledOnce();
-    rerender(
-      <MemoryRouter>
-        <CardStack
-          cards={[]}
-          hasMore={false}
-          isFetching={false}
-          onNeedMore={vi.fn()}
-          onClose={vi.fn()}
-          onReset={onReset}
-        />
-      </MemoryRouter>,
-    );
-    expect(screen.getByText(/seen everything/)).toBeTruthy();
-  });
-});
diff --git a/web/src/components/watchtonight/CardStack.test.ts b/web/src/components/watchtonight/CardStack.test.ts
deleted file mode 100644
index eb1dd76cff..0000000000
--- a/web/src/components/watchtonight/CardStack.test.ts
+++ /dev/null
@@ -1,40 +0,0 @@
-import { describe, expect, it } from "vitest";
-import type { SwipeCard } from "@/hooks/queries/recommendations";
-import { playTargetForSwipeCard } from "./CardStack";
-
-function card(type: SwipeCard["type"]): SwipeCard {
-  return {
-    content_id: `${type}-1`,
-    type,
-    title: "Pick",
-    year: 2026,
-    genres: [],
-    status: "matched",
-    rating_imdb: null,
-    overview: "",
-    poster_url: "",
-    poster_thumbhash: "",
-    backdrop_url: "",
-    backdrop_thumbhash: "",
-    logo_url: "",
-    content_rating: "",
-    watch_tonight_source: "recommendation",
-    cast: [],
-  };
-}
-
-describe("playTargetForSwipeCard", () => {
-  it("routes audiobook cards to the detail player", () => {
-    expect(playTargetForSwipeCard(card("audiobook"))).toEqual({
-      href: "/item/audiobook-1?play=1",
-      isVideo: false,
-    });
-  });
-
-  it("keeps video cards on the watch route", () => {
-    expect(playTargetForSwipeCard(card("movie"))).toEqual({
-      href: "/watch/movie-1",
-      isVideo: true,
-    });
-  });
-});
diff --git a/web/src/components/watchtonight/CardStack.tsx b/web/src/components/watchtonight/CardStack.tsx
deleted file mode 100644
index 030ce2a658..0000000000
--- a/web/src/components/watchtonight/CardStack.tsx
+++ /dev/null
@@ -1,209 +0,0 @@
-import { useCallback, useEffect, useRef, useState } from "react";
-import { AnimatePresence, motion } from "motion/react";
-import { useLocation, useNavigate } from "react-router";
-import { RefreshCw, Tv } from "lucide-react";
-import type { SwipeCard as SwipeCardType } from "@/hooks/queries/recommendations";
-import { useWatchPlaybackController } from "@/playback/watchPlaybackContext";
-import { Skeleton } from "@/components/ui/skeleton";
-import SwipeCard, { CardActions } from "./SwipeCard";
-import { buildMediaPlayHref, isVideoWatchHref } from "@/lib/mediaNavigation";
-
-// Stack positioning for each depth level (0 = top, 1 = behind, 2 = further).
-const stackVariants = {
-  0: { scale: 1, y: 0, opacity: 1 },
-  1: { scale: 0.95, y: 8, opacity: 0.7 },
-  2: { scale: 0.9, y: 16, opacity: 0.4 },
-};
-
-const stackTransition = {
-  type: "spring" as const,
-  stiffness: 400,
-  damping: 30,
-};
-
-interface CardStackProps {
-  cards: SwipeCardType[];
-  hasMore: boolean;
-  pagingLimited?: boolean;
-  isFetching: boolean;
-  onNeedMore: () => void;
-  onClose: () => void;
-  onReset: () => void;
-}
-
-export function playTargetForSwipeCard(card: SwipeCardType) {
-  const href = buildMediaPlayHref({
-    contentId: card.content_id,
-    type: card.type,
-  });
-  return {
-    href,
-    isVideo: isVideoWatchHref(href),
-  };
-}
-
-export default function CardStack({
-  cards,
-  hasMore,
-  pagingLimited = false,
-  isFetching,
-  onNeedMore,
-  onClose,
-  onReset,
-}: CardStackProps) {
-  const [topIndex, setTopIndex] = useState(0);
-  const prefetchTriggered = useRef(false);
-  const location = useLocation();
-  const navigate = useNavigate();
-  const playbackController = useWatchPlaybackController();
-
-  const visibleCards = cards.slice(topIndex, topIndex + 3);
-  const isDone = visibleCards.length === 0 && !hasMore && !isFetching;
-
-  // Prefetch next page when 3 cards remain.
-  useEffect(() => {
-    const remaining = cards.length - topIndex;
-    if (remaining <= 3 && hasMore && !isFetching && !prefetchTriggered.current) {
-      prefetchTriggered.current = true;
-      onNeedMore();
-    }
-    if (remaining > 3) {
-      prefetchTriggered.current = false;
-    }
-  }, [topIndex, cards.length, hasMore, isFetching, onNeedMore]);
-
-  const advance = useCallback(() => {
-    setTopIndex((i) => i + 1);
-  }, []);
-
-  const handlePlay = useCallback(() => {
-    const card = cards[topIndex];
-    if (!card) return;
-    onClose();
-    const target = playTargetForSwipeCard(card);
-    if (!target.isVideo) {
-      void navigate(target.href);
-      return;
-    }
-    playbackController.startPlayback(
-      {
-        contentId: card.content_id,
-        returnHref: `${location.pathname}${location.search}`,
-      },
-      "viewer",
-    );
-  }, [cards, topIndex, onClose, playbackController, location.pathname, location.search, navigate]);
-
-  // Keyboard navigation.
-  useEffect(() => {
-    function handleKeyDown(e: KeyboardEvent) {
-      if (visibleCards.length === 0) return;
-      if (e.key === "ArrowLeft") {
-        e.preventDefault();
-        advance();
-      } else if (e.key === "ArrowRight") {
-        e.preventDefault();
-        handlePlay();
-      }
-    }
-    window.addEventListener("keydown", handleKeyDown);
-    return () => window.removeEventListener("keydown", handleKeyDown);
-  }, [visibleCards.length, advance, handlePlay]);
-
-  // Loading initial cards.
-  if (cards.length === 0 && isFetching) {
-    return (
-      <div className="flex flex-col items-center gap-4 py-8">
-        <div className="relative h-80 w-full max-w-sm">
-          <Skeleton className="h-full w-full rounded-2xl" />
-        </div>
-      </div>
-    );
-  }
-
-  // All done — no more cards.
-  if (isDone) {
-    return (
-      <div className="flex flex-col items-center justify-center gap-4 py-12 text-center">
-        <Tv className="text-muted-foreground h-12 w-12" />
-        <p className="text-muted-foreground text-sm">
-          {pagingLimited
-            ? "You reached the end of this swipe session. Start over or choose different genres for more picks."
-            : "You've seen everything! Come back later for fresh picks."}
-        </p>
-        <button
-          type="button"
-          onClick={onReset}
-          className="border-border hover:bg-muted/40 flex items-center gap-2 rounded-lg border px-4 py-2 text-sm font-medium"
-        >
-          <RefreshCw className="h-4 w-4" />
-          Start Over
-        </button>
-      </div>
-    );
-  }
-
-  // Waiting for more cards (current batch exhausted but more available).
-  if (visibleCards.length === 0 && isFetching) {
-    return (
-      <div className="flex flex-col items-center gap-4 py-8">
-        <div className="relative h-80 w-full max-w-sm">
-          <Skeleton className="h-full w-full rounded-2xl" />
-        </div>
-        <p className="text-muted-foreground text-sm">Loading more picks...</p>
-      </div>
-    );
-  }
-
-  return (
-    <div className="flex flex-col items-center gap-2">
-      {/* Card stack area */}
-      <div className="relative h-80 w-full max-w-sm sm:h-96">
-        <AnimatePresence mode="popLayout">
-          {/* Render in reverse so the top card is last in DOM (highest z-index) */}
-          {[...visibleCards].reverse().map((card, reverseIdx) => {
-            const depth = visibleCards.length - 1 - reverseIdx; // 0 = top
-            const isTop = depth === 0;
-
-            return (
-              <motion.div
-                key={card.content_id}
-                className="absolute inset-0"
-                style={{ zIndex: visibleCards.length - depth }}
-                // Animate into stack position when promoted.
-                initial={stackVariants[2]}
-                animate={stackVariants[Math.min(depth, 2) as 0 | 1 | 2]}
-                // Exit: fly off to the side and shrink.
-                exit={{
-                  x: -300,
-                  opacity: 0,
-                  scale: 0.8,
-                  rotate: -10,
-                  transition: { duration: 0.3, ease: "easeIn" },
-                }}
-                transition={stackTransition}
-              >
-                <SwipeCard card={card} isTop={isTop} onAccept={handlePlay} onReject={advance} />
-              </motion.div>
-            );
-          })}
-        </AnimatePresence>
-      </div>
-
-      {/* Action buttons */}
-      {visibleCards.length > 0 && (
-        <CardActions
-          onReject={advance}
-          onAccept={handlePlay}
-          onPlay={handlePlay}
-          playLabel={visibleCards[0]?.type === "audiobook" ? "Listen now" : "Play now"}
-        />
-      )}
-
-      {/* Counter */}
-      <p className="text-muted-foreground pt-1 text-xs">
-        {topIndex + 1} / {hasMore ? `${cards.length}+` : cards.length}
-      </p>
-    </div>
-  );
-}
diff --git a/web/src/components/watchtonight/GenrePicker.tsx b/web/src/components/watchtonight/GenrePicker.tsx
deleted file mode 100644
index 8b10919e97..0000000000
--- a/web/src/components/watchtonight/GenrePicker.tsx
+++ /dev/null
@@ -1,42 +0,0 @@
-import { ADVANCED_FILTER_GENRES } from "@/components/advancedFilterOptions";
-import { cn } from "@/lib/utils";
-
-interface GenrePickerProps {
-  selected: string[];
-  onChange: (genres: string[]) => void;
-}
-
-export default function GenrePicker({ selected, onChange }: GenrePickerProps) {
-  const selectedSet = new Set(selected);
-
-  function toggle(genre: string) {
-    if (selectedSet.has(genre)) {
-      onChange(selected.filter((g) => g !== genre));
-    } else {
-      onChange([...selected, genre]);
-    }
-  }
-
-  return (
-    <div className="flex flex-wrap gap-2">
-      {ADVANCED_FILTER_GENRES.map((genre) => {
-        const isSelected = selectedSet.has(genre);
-        return (
-          <button
-            key={genre}
-            type="button"
-            onClick={() => toggle(genre)}
-            className={cn(
-              "rounded-full border px-3.5 py-1.5 text-sm font-medium transition-colors",
-              isSelected
-                ? "border-primary bg-primary/15 text-primary"
-                : "border-border text-muted-foreground hover:border-foreground/30 hover:text-foreground",
-            )}
-          >
-            {genre}
-          </button>
-        );
-      })}
-    </div>
-  );
-}
diff --git a/web/src/components/watchtonight/SwipeCard.test.tsx b/web/src/components/watchtonight/SwipeCard.test.tsx
deleted file mode 100644
index 2cadece5e4..0000000000
--- a/web/src/components/watchtonight/SwipeCard.test.tsx
+++ /dev/null
@@ -1,78 +0,0 @@
-import { fireEvent, render, screen } from "@testing-library/react";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-import type { SwipeCard as SwipeCardType } from "@/hooks/queries/recommendations";
-import SwipeCard from "./SwipeCard";
-
-const spoilerPrefs = vi.hoisted(() => ({ hideImages: false, hideOverviews: false }));
-vi.mock("@/hooks/useEpisodeSpoilerPrefs", () => ({
-  useEpisodeSpoilerPrefs: () => spoilerPrefs,
-}));
-
-const episode: SwipeCardType = {
-  content_id: "episode-1",
-  type: "episode",
-  title: "The reveal",
-  series_title: "Mystery series",
-  season_number: 1,
-  episode_number: 2,
-  year: 2026,
-  genres: [],
-  content_rating: "TV-PG",
-  status: "matched",
-  rating_imdb: null,
-  overview: "The culprit is revealed",
-  poster_url: "",
-  poster_thumbhash: "",
-  backdrop_is_episode_still: true,
-  poster_is_episode_still: false,
-  backdrop_url: "/episode-still.jpg",
-  backdrop_thumbhash: "",
-  logo_url: "",
-  user_state: { played: false, is_favorite: false, in_watchlist: false },
-  watch_tonight_source: "next_up",
-  cast: [],
-};
-
-describe("Watch Tonight spoiler protection", () => {
-  beforeEach(() => {
-    spoilerPrefs.hideImages = true;
-    spoilerPrefs.hideOverviews = true;
-  });
-
-  it("hides the description when flipping an unwatched Next Up episode", () => {
-    render(<SwipeCard card={episode} isTop onAccept={vi.fn()} onReject={vi.fn()} />);
-    expect(screen.getByAltText("Mystery series")).toHaveClass("blur-xl");
-    fireEvent.click(screen.getByAltText("Mystery series"));
-    expect(screen.queryByText(episode.overview)).not.toBeInTheDocument();
-  });
-
-  it("preserves fallback series art and protects an old payload without provenance", () => {
-    const { rerender } = render(
-      <SwipeCard
-        card={{ ...episode, backdrop_is_episode_still: false }}
-        isTop
-        onAccept={vi.fn()}
-        onReject={vi.fn()}
-      />,
-    );
-    expect(screen.getByAltText("Mystery series")).not.toHaveClass("blur-xl");
-    rerender(
-      <SwipeCard
-        card={{ ...episode, backdrop_is_episode_still: undefined }}
-        isTop
-        onAccept={vi.fn()}
-        onReject={vi.fn()}
-      />,
-    );
-    expect(screen.getByAltText("Mystery series")).toHaveClass("blur-xl");
-  });
-
-  it.each([
-    { ...episode, user_state: { played: true, is_favorite: false, in_watchlist: false } },
-    { ...episode, position_seconds: 120, watch_tonight_source: "continue_watching" as const },
-    { ...episode, type: "movie" as const },
-  ])("keeps descriptions for played or started episodes and movies", (card) => {
-    render(<SwipeCard card={card} isTop onAccept={vi.fn()} onReject={vi.fn()} />);
-    expect(screen.getByText(episode.overview)).toBeInTheDocument();
-  });
-});
diff --git a/web/src/components/watchtonight/SwipeCard.tsx b/web/src/components/watchtonight/SwipeCard.tsx
deleted file mode 100644
index 052955109d..0000000000
--- a/web/src/components/watchtonight/SwipeCard.tsx
+++ /dev/null
@@ -1,379 +0,0 @@
-import { useRef, useState } from "react";
-import { motion, useMotionValue, useTransform, type PanInfo } from "motion/react";
-import { Check, Info, Play, X } from "lucide-react";
-import type { SwipeCard as SwipeCardType } from "@/hooks/queries/recommendations";
-import { Badge } from "@/components/ui/badge";
-import { useEpisodeSpoilerPrefs } from "@/hooks/useEpisodeSpoilerPrefs";
-import { isEpisodeStill, isEpisodeUnwatched, SPOILER_IMAGE_CLASS } from "@/lib/episodeSpoilers";
-import { RatingEntry } from "@/components/ratings/RatingEntry";
-import { primaryCardRating } from "@/components/ratings/ratings";
-import { cn } from "@/lib/utils";
-
-const sourceLabels: Record<string, string> = {
-  continue_watching: "Continue",
-  next_up: "Next Up",
-  recommendation: "For You",
-};
-
-const SWIPE_THRESHOLD = 100;
-const SWIPE_VELOCITY = 0.4;
-
-interface SwipeCardProps {
-  card: SwipeCardType;
-  isTop: boolean;
-  onAccept: () => void;
-  onReject: () => void;
-}
-
-export default function SwipeCard({ card, isTop, onAccept, onReject }: SwipeCardProps) {
-  const spoilerPrefs = useEpisodeSpoilerPrefs();
-  const unwatched =
-    card.type === "episode" &&
-    isEpisodeUnwatched({
-      played: card.user_state?.played,
-      position_seconds: card.position_seconds,
-    });
-  const hideImage =
-    spoilerPrefs.hideImages &&
-    unwatched &&
-    isEpisodeStill(
-      card.backdrop_url ? card.backdrop_is_episode_still : card.poster_is_episode_still,
-    );
-  const hideOverview = spoilerPrefs.hideOverviews && unwatched;
-  const [isFlipped, setIsFlipped] = useState(false);
-  const didDragRef = useRef(false);
-
-  // Motion values for smooth drag-driven transforms.
-  const x = useMotionValue(0);
-  const rotate = useTransform(x, [-200, 0, 200], [-12, 0, 12]);
-  const rejectOpacity = useTransform(x, [-SWIPE_THRESHOLD, 0], [1, 0]);
-  const acceptOpacity = useTransform(x, [0, SWIPE_THRESHOLD], [0, 1]);
-
-  const source = card.watch_tonight_source ?? "";
-  const isInProgress = source === "continue_watching";
-  const hasEpisodeMeta = card.season_number != null && card.episode_number != null;
-  const heading = hasEpisodeMeta && card.series_title ? card.series_title : card.title;
-  const progressPercent =
-    isInProgress && (card.duration_seconds ?? 0) > 0
-      ? ((card.position_seconds ?? 0) / (card.duration_seconds ?? 1)) * 100
-      : 0;
-
-  const rating = primaryCardRating(card);
-  const badgeLabel = sourceLabels[source];
-
-  function handleDragEnd(_: unknown, info: PanInfo) {
-    const { offset, velocity } = info;
-    if (Math.abs(offset.x) > SWIPE_THRESHOLD || Math.abs(velocity.x) > SWIPE_VELOCITY) {
-      if (offset.x > 0) onAccept();
-      else onReject();
-    }
-  }
-
-  return (
-    <motion.div
-      className="absolute inset-0"
-      style={isTop ? { x, rotate } : undefined}
-      drag={isTop ? "x" : false}
-      dragConstraints={{ left: 0, right: 0 }}
-      dragElastic={0.9}
-      onDragStart={() => {
-        didDragRef.current = true;
-      }}
-      onDragEnd={handleDragEnd}
-    >
-      <div
-        className={cn(
-          "relative h-full w-full select-none",
-          isTop && "cursor-grab touch-none active:cursor-grabbing",
-        )}
-        style={{
-          transformStyle: "preserve-3d",
-          transform: isFlipped ? "rotateY(180deg)" : "rotateY(0deg)",
-          transition: "transform 0.45s ease",
-        }}
-        onClick={(e) => {
-          if (!isTop) return;
-          if (didDragRef.current) {
-            didDragRef.current = false;
-            return;
-          }
-          if ((e.target as HTMLElement).closest("[data-action]") === null) {
-            setIsFlipped((f) => !f);
-          }
-        }}
-      >
-        {/* Front face */}
-        <div
-          className="absolute inset-0 overflow-hidden rounded-2xl"
-          style={{
-            backfaceVisibility: "hidden",
-            WebkitBackfaceVisibility: "hidden",
-          }}
-        >
-          {/* Backdrop image */}
-          {card.backdrop_url ? (
-            <img
-              src={card.backdrop_url}
-              alt={heading}
-              className={cn("h-full w-full object-cover", hideImage && SPOILER_IMAGE_CLASS)}
-              draggable={false}
-            />
-          ) : card.poster_url ? (
-            <img
-              src={card.poster_url}
-              alt={heading}
-              className={cn("h-full w-full object-cover", hideImage && SPOILER_IMAGE_CLASS)}
-              draggable={false}
-            />
-          ) : (
-            <div className="bg-muted flex h-full w-full items-center justify-center rounded-2xl">
-              <span className="text-muted-foreground text-sm">No Image</span>
-            </div>
-          )}
-
-          {/* Gradient overlay */}
-          <div className="absolute inset-0 bg-gradient-to-t from-black/80 via-black/20 to-transparent" />
-
-          {/* Source badge */}
-          {badgeLabel && (
-            <Badge variant="secondary" className="absolute top-3 right-3 text-[10px]">
-              {badgeLabel}
-            </Badge>
-          )}
-
-          {/* Swipe indicators — driven by motion values for smooth response */}
-          {isTop && (
-            <>
-              <motion.div
-                className="absolute top-4 left-4 flex h-14 w-14 items-center justify-center rounded-full border-2 border-red-500 text-red-500"
-                style={{ opacity: rejectOpacity, rotate: -15 }}
-              >
-                <X className="h-8 w-8" strokeWidth={3} />
-              </motion.div>
-              <motion.div
-                className="absolute top-4 right-4 flex h-14 w-14 items-center justify-center rounded-full border-2 border-green-500 text-green-500"
-                style={{ opacity: acceptOpacity, rotate: 15 }}
-              >
-                <Check className="h-8 w-8" strokeWidth={3} />
-              </motion.div>
-            </>
-          )}
-
-          {/* Bottom info */}
-          <div className="absolute inset-x-0 bottom-0 p-5">
-            {card.logo_url ? (
-              <img
-                src={card.logo_url}
-                alt={heading}
-                className="mb-2 h-10 max-w-[70%] object-contain object-left"
-                draggable={false}
-              />
-            ) : (
-              <h3 className="mb-1 text-xl font-bold text-white drop-shadow-md">{heading}</h3>
-            )}
-
-            {hasEpisodeMeta && (
-              <p className="mb-1 text-sm text-white/80">
-                S{card.season_number} E{card.episode_number}
-                {card.title && card.series_title ? ` \u2022 ${card.title}` : ""}
-              </p>
-            )}
-
-            <div className="flex flex-wrap items-center gap-2">
-              {card.year > 0 && (
-                <span className="text-sm font-medium text-white/70">{card.year}</span>
-              )}
-              {rating && <RatingEntry rating={rating} size="sm" className="text-white/90" />}
-              {card.runtime != null && card.runtime > 0 && (
-                <span className="text-sm text-white/60">
-                  {card.runtime >= 60
-                    ? `${Math.floor(card.runtime / 60)}h ${card.runtime % 60}m`
-                    : `${card.runtime}m`}
-                </span>
-              )}
-              {card.genres?.slice(0, 3).map((g) => (
-                <Badge
-                  key={g}
-                  variant="outline"
-                  className="border-white/30 text-[10px] text-white/70"
-                >
-                  {g}
-                </Badge>
-              ))}
-            </div>
-          </div>
-
-          {/* Progress bar for continue watching */}
-          {isInProgress && progressPercent > 0 && (
-            <div className="absolute inset-x-0 bottom-0 h-1 bg-white/20">
-              <div
-                className="h-full"
-                style={{
-                  width: `${Math.min(progressPercent, 100)}%`,
-                  background: "var(--primary)",
-                }}
-              />
-            </div>
-          )}
-
-          {/* Flip hint */}
-          {isTop && (
-            <div className="absolute right-3 bottom-3 flex items-center gap-1 rounded-full bg-black/40 px-2 py-1 text-[10px] text-white/60 backdrop-blur-sm">
-              <Info className="h-3 w-3" />
-              Tap for details
-            </div>
-          )}
-        </div>
-
-        {/* Back face */}
-        <div
-          className="absolute inset-0 overflow-hidden rounded-2xl"
-          style={{
-            backfaceVisibility: "hidden",
-            WebkitBackfaceVisibility: "hidden",
-            transform: "rotateY(180deg)",
-          }}
-        >
-          {/* Blurred backdrop */}
-          {card.backdrop_url && (
-            <img
-              src={card.backdrop_url}
-              alt=""
-              className="absolute inset-0 h-full w-full scale-110 object-cover blur-xl brightness-[0.3]"
-              draggable={false}
-            />
-          )}
-          <div className="bg-background/80 absolute inset-0" />
-
-          <div className="overlay-scroll relative flex h-full flex-col gap-4 overflow-y-auto p-5">
-            <h3 className="text-lg font-bold">{heading}</h3>
-
-            {hasEpisodeMeta && (
-              <p className="text-muted-foreground text-sm">
-                S{card.season_number} E{card.episode_number}
-                {card.title && card.series_title ? ` \u2022 ${card.title}` : ""}
-              </p>
-            )}
-
-            {card.overview && !hideOverview && (
-              <p className="text-muted-foreground line-clamp-6 text-sm leading-relaxed">
-                {card.overview}
-              </p>
-            )}
-
-            {card.cast?.length > 0 && (
-              <div>
-                <h4 className="text-muted-foreground mb-1.5 text-xs font-semibold tracking-wider uppercase">
-                  Cast
-                </h4>
-                <div className="space-y-1">
-                  {card.cast.map((c) => (
-                    <p key={c.name} className="text-sm">
-                      <span className="font-medium">{c.name}</span>
-                      {c.character && (
-                        <span className="text-muted-foreground"> as {c.character}</span>
-                      )}
-                    </p>
-                  ))}
-                </div>
-              </div>
-            )}
-
-            <div className="flex flex-wrap gap-3 text-sm">
-              {rating && <RatingEntry rating={rating} size="sm" className="text-foreground" />}
-              {card.runtime != null && card.runtime > 0 && (
-                <span className="text-muted-foreground">
-                  {card.runtime >= 60
-                    ? `${Math.floor(card.runtime / 60)}h ${card.runtime % 60}m`
-                    : `${card.runtime}m`}
-                </span>
-              )}
-              {card.year > 0 && <span className="text-muted-foreground">{card.year}</span>}
-            </div>
-
-            {card.genres && card.genres.length > 0 && (
-              <div className="flex flex-wrap gap-1.5">
-                {card.genres.map((g) => (
-                  <Badge key={g} variant="outline" className="text-[10px]">
-                    {g}
-                  </Badge>
-                ))}
-              </div>
-            )}
-          </div>
-
-          {/* Flip back hint */}
-          <div className="absolute right-3 bottom-3 flex items-center gap-1 rounded-full bg-black/40 px-2 py-1 text-[10px] text-white/60 backdrop-blur-sm">
-            <Info className="h-3 w-3" />
-            Tap to flip back
-          </div>
-        </div>
-      </div>
-    </motion.div>
-  );
-}
-
-// --- Action buttons shown below the card stack ---
-
-interface CardActionsProps {
-  onReject: () => void;
-  onAccept: () => void;
-  onPlay: () => void;
-  playLabel?: string;
-  disabled?: boolean;
-}
-
-export function CardActions({
-  onReject,
-  onAccept,
-  onPlay,
-  playLabel = "Play now",
-  disabled,
-}: CardActionsProps) {
-  return (
-    <div className="flex items-center justify-center gap-4 pt-4">
-      <button
-        type="button"
-        data-action
-        onClick={onReject}
-        disabled={disabled}
-        className={cn(
-          "flex h-14 w-14 items-center justify-center rounded-full border-2 transition-colors",
-          "border-red-500/40 text-red-400 hover:border-red-500 hover:bg-red-500/10 hover:text-red-500",
-          "disabled:pointer-events-none disabled:opacity-40",
-        )}
-        aria-label="Skip"
-      >
-        <X className="h-6 w-6" />
-      </button>
-      <button
-        type="button"
-        data-action
-        onClick={onPlay}
-        disabled={disabled}
-        className={cn(
-          "flex h-16 w-16 items-center justify-center rounded-full border-2 transition-colors",
-          "border-primary/40 text-primary hover:border-primary hover:bg-primary/10",
-          "disabled:pointer-events-none disabled:opacity-40",
-        )}
-        aria-label={playLabel}
-      >
-        <Play className="ml-0.5 h-7 w-7" fill="currentColor" />
-      </button>
-      <button
-        type="button"
-        data-action
-        onClick={onAccept}
-        disabled={disabled}
-        className={cn(
-          "flex h-14 w-14 items-center justify-center rounded-full border-2 transition-colors",
-          "border-green-500/40 text-green-400 hover:border-green-500 hover:bg-green-500/10 hover:text-green-500",
-          "disabled:pointer-events-none disabled:opacity-40",
-        )}
-        aria-label="Like"
-      >
-        <Check className="h-6 w-6" />
-      </button>
-    </div>
-  );
-}
diff --git a/web/src/contexts/BrandingProvider.tsx b/web/src/contexts/BrandingProvider.tsx
index 19adf2c17e..df23d9efc7 100644
--- a/web/src/contexts/BrandingProvider.tsx
+++ b/web/src/contexts/BrandingProvider.tsx
@@ -4,6 +4,7 @@ import { useQuery } from "@tanstack/react-query";
 
 import { v2 } from "@/api/v2/request";
 import { themeKeys } from "@/hooks/queries/keys";
+import { accentDeclarations } from "@/lib/accentColor";
 import { setAppDocumentTitle } from "@/lib/documentTitle";
 
 const DEFAULT_SERVER_NAME = "Prairie";
@@ -33,6 +34,8 @@ export interface BrandingContextValue {
   loginBgUrl: string | null;
   /** Whether the running server has an active object-store client for assets. */
   storageAvailable: boolean;
+  /** The server's branding has arrived; until then every field is a default. */
+  loaded: boolean;
 }
 
 const DEFAULT_BRANDING: BrandingContextValue = {
@@ -44,6 +47,7 @@ const DEFAULT_BRANDING: BrandingContextValue = {
   faviconUrl: null,
   loginBgUrl: null,
   storageAvailable: false,
+  loaded: false,
 };
 
 // A non-null default means useBranding() is safe to call anywhere (e.g. in
@@ -60,6 +64,7 @@ function mapResponse(data: BrandingApiResponse | undefined): BrandingContextValu
     faviconUrl: data?.favicon_url || null,
     loginBgUrl: data?.login_bg_url || null,
     storageAvailable: data?.storage_available ?? false,
+    loaded: data !== undefined,
   };
 }
 
@@ -75,10 +80,40 @@ function applyFavicon(url: string | null) {
   link.href = url ?? "/favicon.ico";
 }
 
+const ACCENT_STYLE_ID = "prairie-accent";
+
+/**
+ * Paints the accent over Cinema Dark. It is an unlayered :root rule appended
+ * to <head>, so it wins over the theme's layered tokens. That would also beat
+ * high contrast's boosted focus ring, so a second unlayered rule restores it:
+ * a dark accent must not hide keyboard focus for someone who asked for high
+ * contrast.
+ */
+function applyAccent(hex: string | null) {
+  if (typeof document === "undefined") return;
+  const declarations = hex ? accentDeclarations(hex) : null;
+  const css = declarations
+    ? `:root {\n${Object.entries(declarations)
+        .map(([token, value]) => `  --${token}: ${value};`)
+        .join("\n")}\n}\nhtml[data-high-contrast="true"] {\n  --ring: var(--contrast-boost);\n}`
+    : "";
+  let style = document.getElementById(ACCENT_STYLE_ID) as HTMLStyleElement | null;
+  if (!css) {
+    style?.remove();
+    return;
+  }
+  if (!style) {
+    style = document.createElement("style");
+    style.id = ACCENT_STYLE_ID;
+    document.head.appendChild(style);
+  }
+  style.textContent = css;
+}
+
 /**
  * BrandingProvider fetches server branding (public endpoint, available before
- * login) and exposes it via context. It owns the document-title and favicon
- * side effects so they run exactly once, fixing the tab title and applying the
+ * login) and exposes it via context. It owns the document-title, favicon, and
+ * accent side effects so they run exactly once, fixing the tab title and applying the
  * custom favicon in dev (where the server does not template index.html).
  */
 export function BrandingProvider({ children }: { children: ReactNode }) {
@@ -102,5 +137,9 @@ export function BrandingProvider({ children }: { children: ReactNode }) {
     applyFavicon(value.faviconUrl);
   }, [value.faviconUrl]);
 
+  useEffect(() => {
+    applyAccent(value.accentColor);
+  }, [value.accentColor]);
+
   return <BrandingContext value={value}>{children}</BrandingContext>;
 }
diff --git a/web/src/contexts/CustomThemeProvider.tsx b/web/src/contexts/CustomThemeProvider.tsx
deleted file mode 100644
index 7ca2798ac5..0000000000
--- a/web/src/contexts/CustomThemeProvider.tsx
+++ /dev/null
@@ -1,61 +0,0 @@
-import { useEffect, useRef } from "react";
-import type { ReactNode } from "react";
-import { useAdminPublicCss } from "@/hooks/queries/theme";
-
-/** Reject values that could break out of CSS declarations. */
-const UNSAFE_VALUE = /[;{}]|\/\*|<\//;
-
-function buildVarOverrideCSS(vars: Record<string, string>): string {
-  const entries = Object.entries(vars).filter(([, v]) => v !== "" && !UNSAFE_VALUE.test(v));
-  if (entries.length === 0) return "";
-  const props = entries.map(([k, v]) => `  --${k}: ${v};`).join("\n");
-  return `:root {\n${props}\n}`;
-}
-
-function getOrCreateStyle(id: string): HTMLStyleElement {
-  let el = document.getElementById(id) as HTMLStyleElement | null;
-  if (!el) {
-    el = document.createElement("style");
-    el.id = id;
-    document.head.appendChild(el);
-  }
-  return el;
-}
-
-/**
- * Paints the admin's server-wide theme customization — token overrides, then
- * raw CSS — on top of the Cinema Dark base. Theming is an admin decision:
- * profiles have no overrides of their own.
- */
-export function CustomThemeProvider({ children }: { children: ReactNode }) {
-  const { data: adminCss } = useAdminPublicCss();
-
-  const adminVarsRef = useRef<HTMLStyleElement>(null);
-  const adminRawRef = useRef<HTMLStyleElement>(null);
-
-  // Create style elements on mount
-  useEffect(() => {
-    adminVarsRef.current = getOrCreateStyle("silo-admin-vars");
-    adminRawRef.current = getOrCreateStyle("silo-admin-raw-css");
-
-    return () => {
-      // Clean up on unmount (dev HMR)
-      adminVarsRef.current?.remove();
-      adminRawRef.current?.remove();
-    };
-  }, []);
-
-  useEffect(() => {
-    if (adminVarsRef.current) {
-      adminVarsRef.current.textContent = buildVarOverrideCSS(adminCss?.vars ?? {});
-    }
-  }, [adminCss?.vars]);
-
-  useEffect(() => {
-    if (adminRawRef.current) {
-      adminRawRef.current.textContent = adminCss?.rawCss ?? "";
-    }
-  }, [adminCss?.rawCss]);
-
-  return children;
-}
diff --git a/web/src/fonts.css b/web/src/fonts.css
index 53fefde475..5261981fa2 100644
--- a/web/src/fonts.css
+++ b/web/src/fonts.css
@@ -1,134 +1,40 @@
 /* ================================================================
    SELF-HOSTED UI FONTS
    ================================================================
-   The families the themes and the token editor offer
-   (AVAILABLE_FONTS in lib/themeTokens.ts). They ship with the build
-   instead of loading from a font CDN, so first paint never waits on a
+   Plus Jakarta Sans, the UI font Cinema Dark sets as --font-body and
+   --font-display (app.css), and Fraunces, the prairie-dusk display face.
+   They ship with the build instead of
+   loading from a font CDN, so first paint never waits on a
    third-party stylesheet that a LAN-only or offline network may never
    reach, and the files get the same immutable caching as every other
    /assets/ file.
 
-   The files come from the @fontsource-variable packages (the Google
-   Fonts builds, variable wght axis), but the families keep their plain
-   names: theme CSS and saved custom themes say "Outfit", "Sora",
-   "Urbanist", and "Manrope", while the packages' own CSS would name them
-   "<Family> Variable". Subsets and unicode ranges match the packages'
-   CSS, and the browser downloads a file only when rendered text needs
-   that family and range.
+   The files come from the @fontsource-variable package (the Google
+   Fonts build, variable wght axis), but the family keeps its plain
+   name: app.css says "Plus Jakarta Sans", while the package's own CSS
+   would name it "Plus Jakarta Sans Variable". Subsets and unicode
+   ranges match the package's CSS, and the browser downloads a file only
+   when rendered text needs that family and range.
    ================================================================ */
 
-/* ── Outfit ── */
+/* ── Plus Jakarta Sans ── */
 
 @font-face {
-  font-family: "Outfit";
-  font-style: normal;
-  font-display: swap;
-  font-weight: 100 900;
-  src: url("@fontsource-variable/outfit/files/outfit-latin-ext-wght-normal.woff2") format("woff2");
-  unicode-range:
-    U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329,
-    U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F,
-    U+A720-A7FF;
-}
-
-@font-face {
-  font-family: "Outfit";
-  font-style: normal;
-  font-display: swap;
-  font-weight: 100 900;
-  src: url("@fontsource-variable/outfit/files/outfit-latin-wght-normal.woff2") format("woff2");
-  unicode-range:
-    U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329,
-    U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
-}
-
-/* ── Sora ── */
-
-@font-face {
-  font-family: "Sora";
-  font-style: normal;
-  font-display: swap;
-  font-weight: 100 800;
-  src: url("@fontsource-variable/sora/files/sora-latin-ext-wght-normal.woff2") format("woff2");
-  unicode-range:
-    U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329,
-    U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F,
-    U+A720-A7FF;
-}
-
-@font-face {
-  font-family: "Sora";
-  font-style: normal;
-  font-display: swap;
-  font-weight: 100 800;
-  src: url("@fontsource-variable/sora/files/sora-latin-wght-normal.woff2") format("woff2");
-  unicode-range:
-    U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329,
-    U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
-}
-
-/* ── Urbanist ── */
-
-@font-face {
-  font-family: "Urbanist";
-  font-style: normal;
-  font-display: swap;
-  font-weight: 100 900;
-  src: url("@fontsource-variable/urbanist/files/urbanist-latin-ext-wght-normal.woff2")
-    format("woff2");
-  unicode-range:
-    U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329,
-    U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F,
-    U+A720-A7FF;
-}
-
-@font-face {
-  font-family: "Urbanist";
-  font-style: normal;
-  font-display: swap;
-  font-weight: 100 900;
-  src: url("@fontsource-variable/urbanist/files/urbanist-latin-wght-normal.woff2") format("woff2");
-  unicode-range:
-    U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329,
-    U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
-}
-
-/* ── Manrope ── */
-
-@font-face {
-  font-family: "Manrope";
+  font-family: "Plus Jakarta Sans";
   font-style: normal;
   font-display: swap;
   font-weight: 200 800;
-  src: url("@fontsource-variable/manrope/files/manrope-cyrillic-ext-wght-normal.woff2")
+  src: url("@fontsource-variable/plus-jakarta-sans/files/plus-jakarta-sans-cyrillic-ext-wght-normal.woff2")
     format("woff2");
   unicode-range: U+0460-052F, U+1C80-1C8A, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;
 }
 
 @font-face {
-  font-family: "Manrope";
-  font-style: normal;
-  font-display: swap;
-  font-weight: 200 800;
-  src: url("@fontsource-variable/manrope/files/manrope-cyrillic-wght-normal.woff2") format("woff2");
-  unicode-range: U+0301, U+0400-045F, U+0490-0491, U+04B0-04B1, U+2116;
-}
-
-@font-face {
-  font-family: "Manrope";
+  font-family: "Plus Jakarta Sans";
   font-style: normal;
   font-display: swap;
   font-weight: 200 800;
-  src: url("@fontsource-variable/manrope/files/manrope-greek-wght-normal.woff2") format("woff2");
-  unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;
-}
-
-@font-face {
-  font-family: "Manrope";
-  font-style: normal;
-  font-display: swap;
-  font-weight: 200 800;
-  src: url("@fontsource-variable/manrope/files/manrope-vietnamese-wght-normal.woff2")
+  src: url("@fontsource-variable/plus-jakarta-sans/files/plus-jakarta-sans-vietnamese-wght-normal.woff2")
     format("woff2");
   unicode-range:
     U+0102-0103, U+0110-0111, U+0128-0129, U+0168-0169, U+01A0-01A1, U+01AF-01B0, U+0300-0301,
@@ -136,11 +42,12 @@
 }
 
 @font-face {
-  font-family: "Manrope";
+  font-family: "Plus Jakarta Sans";
   font-style: normal;
   font-display: swap;
   font-weight: 200 800;
-  src: url("@fontsource-variable/manrope/files/manrope-latin-ext-wght-normal.woff2") format("woff2");
+  src: url("@fontsource-variable/plus-jakarta-sans/files/plus-jakarta-sans-latin-ext-wght-normal.woff2")
+    format("woff2");
   unicode-range:
     U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7, U+02DD-02FF, U+0304, U+0308, U+0329,
     U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF, U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F,
@@ -148,11 +55,12 @@
 }
 
 @font-face {
-  font-family: "Manrope";
+  font-family: "Plus Jakarta Sans";
   font-style: normal;
   font-display: swap;
   font-weight: 200 800;
-  src: url("@fontsource-variable/manrope/files/manrope-latin-wght-normal.woff2") format("woff2");
+  src: url("@fontsource-variable/plus-jakarta-sans/files/plus-jakarta-sans-latin-wght-normal.woff2")
+    format("woff2");
   unicode-range:
     U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA, U+02DC, U+0304, U+0308, U+0329,
     U+2000-206F, U+20AC, U+2122, U+2191, U+2193, U+2212, U+2215, U+FEFF, U+FFFD;
diff --git a/web/src/fonts.test.ts b/web/src/fonts.test.ts
index 235af38168..8cdac17688 100644
--- a/web/src/fonts.test.ts
+++ b/web/src/fonts.test.ts
@@ -5,8 +5,6 @@ import { createRequire } from "node:module";
 import { fileURLToPath } from "node:url";
 import { describe, expect, it } from "vitest";
 
-import { AVAILABLE_FONTS } from "@/lib/themeTokens";
-
 /**
  * fonts.css copies each @fontsource-variable package's @font-face rules by
  * hand, only renaming "<Family> Variable" to the plain family name. A package
@@ -50,12 +48,20 @@ function sortFaces(faces: Face[]): Face[] {
   return [...faces].sort((a, b) => a.file.localeCompare(b.file));
 }
 
+/** The families fonts.css self-hosts: Cinema Dark's UI font, plus Fraunces for the Prairie prairie-dusk display face. */
+const UI_FONTS = ["Fraunces", "Plus Jakarta Sans"];
+
 const localFaces = parseFaces(fontsCss);
 
+/** "Plus Jakarta Sans" is published as @fontsource-variable/plus-jakarta-sans. */
+function packageSlug(family: string): string {
+  return family.toLowerCase().replace(/ /g, "-");
+}
+
 describe("fonts.css", () => {
-  it("declares exactly the fonts the themes and token editor offer", () => {
+  it("declares exactly the UI fonts", () => {
     expect([...new Set(localFaces.map((face) => face.family))].sort()).toEqual(
-      [...AVAILABLE_FONTS].sort(),
+      [...UI_FONTS].sort(),
     );
   });
 
@@ -63,9 +69,9 @@ describe("fonts.css", () => {
     for (const face of localFaces) expect(face.display, face.file).toBe("swap");
   });
 
-  it.each(AVAILABLE_FONTS)("matches the @fontsource-variable package for %s", (family) => {
+  it.each(UI_FONTS)("matches the @fontsource-variable package for %s", (family) => {
     const packageCss = readFileSync(
-      require.resolve(`@fontsource-variable/${family.toLowerCase()}/wght.css`),
+      require.resolve(`@fontsource-variable/${packageSlug(family)}/wght.css`),
       "utf8",
     );
     const packageFaces = parseFaces(packageCss).map((face) => ({
@@ -82,7 +88,9 @@ describe("fonts.css", () => {
     const sources = [...fontsCss.matchAll(/url\(\s*"([^"]+)"\s*\)/g)].map(([, src]) => src);
     expect(sources).toHaveLength(localFaces.length);
     for (const src of sources) {
-      expect(src).toMatch(/^@fontsource-variable\/([a-z]+)\/files\/\1-[a-z-]+-wght-normal\.woff2$/);
+      expect(src).toMatch(
+        /^@fontsource-variable\/([a-z]+(?:-[a-z]+)*)\/files\/\1-[a-z-]+-wght-normal\.woff2$/,
+      );
     }
   });
 });
diff --git a/web/src/hooks/admin/useAdminLogStream.scope.test.ts b/web/src/hooks/admin/useAdminLogStream.scope.test.ts
index b27afdbbb1..d5bb6abcb0 100644
--- a/web/src/hooks/admin/useAdminLogStream.scope.test.ts
+++ b/web/src/hooks/admin/useAdminLogStream.scope.test.ts
@@ -203,3 +203,37 @@ it("reports a filter change as connecting until the new selection's snapshot arr
   expect(result.current.rows).toEqual([]);
   expect(result.current.isConnecting).toBe(false);
 });
+
+it("keeps debouncing filter changes after an explicit reconnect", async () => {
+  vi.useFakeTimers();
+  vi.stubGlobal("WebSocket", FakeWebSocket);
+  mint.mockResolvedValue({ ticket: "test-ticket" });
+  const { result, rerender } = renderHook(
+    ({ method }) => {
+      const params = useMemo(() => ({ method }), [method]);
+      return useAdminLogStream("audit", params, true);
+    },
+    { initialProps: { method: "PUT" } },
+  );
+  await act(async () => vi.advanceTimersByTimeAsync(250));
+  expect(mint).toHaveBeenCalledTimes(1);
+
+  act(() => result.current.reconnect());
+  await act(async () => vi.advanceTimersByTimeAsync(0));
+  expect(mint).toHaveBeenCalledTimes(2);
+
+  for (const method of ["PO", "POS", "POST"]) {
+    rerender({ method });
+    await act(async () => vi.advanceTimersByTimeAsync(0));
+  }
+  expect(mint).toHaveBeenCalledTimes(2);
+
+  await act(async () => vi.advanceTimersByTimeAsync(249));
+  expect(mint).toHaveBeenCalledTimes(2);
+  await act(async () => vi.advanceTimersByTimeAsync(1));
+  expect(mint).toHaveBeenCalledTimes(3);
+
+  act(() => result.current.reconnect());
+  await act(async () => vi.advanceTimersByTimeAsync(0));
+  expect(mint).toHaveBeenCalledTimes(4);
+});
diff --git a/web/src/hooks/admin/useAdminLogStream.ts b/web/src/hooks/admin/useAdminLogStream.ts
index 97ff3bdee5..7d175b6123 100644
--- a/web/src/hooks/admin/useAdminLogStream.ts
+++ b/web/src/hooks/admin/useAdminLogStream.ts
@@ -1,4 +1,4 @@
-import { startTransition, useDeferredValue, useEffect, useMemo, useState } from "react";
+import { startTransition, useDeferredValue, useEffect, useMemo, useRef, useState } from "react";
 import { captureProfileRequestContext, isCapturedProfileAuthorityActive } from "@/api/client";
 import {
   adminLogsSocketProtocols,
@@ -61,6 +61,7 @@ export function useAdminLogStream<TStream extends AdminLogStream>(
   const [connectionState, setConnectionState] = useState<ConnectionState>("disconnected");
   const [error, setError] = useState<string>();
   const [reconnectNonce, setReconnectNonce] = useState(0);
+  const attemptedNonce = useRef(reconnectNonce);
 
   const deferredParams = useDeferredValue(params);
   const queryString = useMemo(() => buildAdminLogsSocketQuery(deferredParams), [deferredParams]);
@@ -116,11 +117,14 @@ export function useAdminLogStream<TStream extends AdminLogStream>(
     setConnectionState("connecting");
     setError(undefined);
 
-    // Debounce the initial attempt; an explicit reconnect() retries immediately.
+    // Debounce every attempt except the one an explicit reconnect() starts, so
+    // filter changes after a reconnect still wait for typing to settle.
     // Authority is captured once per connection attempt: the credential is
     // minted under it, and frames arriving after it changed are discarded.
     let closedByEffect = false;
-    const connectDelay = reconnectNonce === 0 ? 250 : 0;
+    const reconnectRequested = reconnectNonce !== attemptedNonce.current;
+    attemptedNonce.current = reconnectNonce;
+    const connectDelay = reconnectRequested ? 0 : 250;
     const connectTimer = window.setTimeout(() => {
       const authority = captureProfileRequestContext();
       if (!authority) {
diff --git a/web/src/hooks/admin/useSettingsAttention.test.ts b/web/src/hooks/admin/useSettingsAttention.test.ts
new file mode 100644
index 0000000000..5f37e57ed4
--- /dev/null
+++ b/web/src/hooks/admin/useSettingsAttention.test.ts
@@ -0,0 +1,35 @@
+import { renderHook } from "@testing-library/react";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import { useSettingsAttention } from "./useSettingsHealth";
+
+const brandingMock = vi.fn();
+
+vi.mock("@/hooks/useBranding", () => ({ useBranding: () => brandingMock() }));
+
+vi.mock("@/hooks/queries/admin/settings", () => ({
+  // Nothing configured: no storage, no mail, no public URL.
+  useAdminServerSettings: () => ({ data: {} }),
+  useAdminSensitiveStatus: () => ({ data: { configured: [] } }),
+  useAdminServerStatus: () => ({ data: undefined }),
+  useCatalogSearchStatus: () => ({ data: undefined }),
+}));
+
+const ids = () => renderHook(() => useSettingsAttention()).result.current.map((item) => item.id);
+
+beforeEach(() => brandingMock.mockReset());
+
+describe("useSettingsAttention", () => {
+  it("leaves storage out until branding reports whether it is available", () => {
+    brandingMock.mockReturnValue({ storageAvailable: false, loaded: false });
+
+    expect(ids()).not.toContain("storage");
+    expect(ids()).toContain("email");
+  });
+
+  it("lists storage once branding says it is not available", () => {
+    brandingMock.mockReturnValue({ storageAvailable: false, loaded: true });
+
+    expect(ids()).toContain("storage");
+  });
+});
diff --git a/web/src/hooks/admin/useSettingsOverview.test.ts b/web/src/hooks/admin/useSettingsHealth.test.ts
similarity index 82%
rename from web/src/hooks/admin/useSettingsOverview.test.ts
rename to web/src/hooks/admin/useSettingsHealth.test.ts
index 0f0f7c1347..90a8cf078b 100644
--- a/web/src/hooks/admin/useSettingsOverview.test.ts
+++ b/web/src/hooks/admin/useSettingsHealth.test.ts
@@ -2,32 +2,25 @@ import { describe, expect, it } from "vitest";
 
 import { ADMIN_SETTINGS_NAV } from "@/lib/adminSettingsSearch";
 import {
-  buildSettingsOverview,
-  type OverviewCard,
-  type OverviewTile,
-  type SettingsOverviewInput,
-} from "./useSettingsOverview";
-
-function tile(input: SettingsOverviewInput, id: string): OverviewTile {
-  const found = buildSettingsOverview(input).tiles.find((entry) => entry.id === id);
+  ADMIN_SETTINGS_PAGE_IDS,
+  buildSettingsHealth,
+  settingsAttentionItems,
+  type SettingsHealthInput,
+  type SettingsHealthItem,
+} from "./useSettingsHealth";
+
+function tile(input: SettingsHealthInput, id: string): SettingsHealthItem {
+  const found = buildSettingsHealth(input).find((entry) => entry.id === id);
   if (!found) throw new Error(`no tile ${id}`);
   return found;
 }
 
-function card(input: SettingsOverviewInput, id: string): OverviewCard {
-  const found = buildSettingsOverview(input).cards.find((entry) => entry.id === id);
-  if (!found) throw new Error(`no card ${id}`);
-  return found;
-}
-
-describe("buildSettingsOverview health tiles", () => {
+describe("buildSettingsHealth", () => {
   it("degrades to placeholders rather than throwing when nothing has loaded", () => {
-    const model = buildSettingsOverview({});
+    const items = buildSettingsHealth({});
 
-    expect(model.tiles).toHaveLength(5);
-    expect(model.cards).toHaveLength(16);
+    expect(items).toHaveLength(6);
     expect(tile({}, "storage").stateText).toBe("Not set up");
-    expect(card({}, "general")).toEqual({ id: "general" });
   });
 
   it("names the bucket when only public storage is configured", () => {
@@ -78,7 +71,7 @@ describe("buildSettingsOverview health tiles", () => {
     expect(storage.state).toBe("warn");
     expect(storage.stateText).toBe("Restart pending");
     expect(storage.detail).toBe("S3 · silo-art · applies after a restart");
-    expect(storage.action).toEqual({ label: "Fix", page: "infrastructure" });
+    expect(storage.action).toEqual({ label: "Fix", page: "storage" });
   });
 
   it("still calls storage unconfigured when no bucket is saved", () => {
@@ -98,7 +91,7 @@ describe("buildSettingsOverview health tiles", () => {
 
     expect(storage.state).toBe("off");
     expect(storage.stateText).toBe("Not set up");
-    expect(storage.action).toEqual({ label: "Set up", page: "infrastructure" });
+    expect(storage.action).toEqual({ label: "Set up", page: "storage" });
   });
 
   it("does not read a restart another subsystem asked for as pending storage", () => {
@@ -119,26 +112,15 @@ describe("buildSettingsOverview health tiles", () => {
     expect(storage.stateText).toBe("Not set up");
   });
 
-  it("reports the detected accelerator on the transcoding tile", () => {
+  it("names the configured accelerator on the transcoding item", () => {
     const transcoding = tile(
-      {
-        settings: {
-          "playback.transcode_enabled": "true",
-          "playback.hw_accel": "auto",
-        },
-        hwAccel: {
-          resolved: "vaapi",
-          render_devices: ["/dev/dri/renderD128"],
-          intel_detected: true,
-          source: "local",
-        },
-      },
+      { settings: { "playback.transcode_enabled": "true", "playback.hw_accel": "vaapi" } },
       "transcoding",
     );
 
     expect(transcoding.state).toBe("ok");
     expect(transcoding.stateText).toBe("Ready");
-    expect(transcoding.detail).toBe("Auto · VA-API · /dev/dri/renderD128");
+    expect(transcoding.detail).toBe("VA-API");
   });
 
   it("scopes restart warnings to the tile whose keys are actually pending", () => {
@@ -231,7 +213,7 @@ describe("buildSettingsOverview health tiles", () => {
         search: {
           active_provider: "meilisearch",
           meilisearch: { configured: true, healthy: true },
-        } as SettingsOverviewInput["search"],
+        } as SettingsHealthInput["search"],
       },
       "search",
     );
@@ -255,14 +237,14 @@ describe("buildSettingsOverview health tiles", () => {
           degraded: true,
           degraded_reason: "Search index rebuild required; using Meilisearch keyword search",
           meilisearch: { configured: true, healthy: true },
-        } as SettingsOverviewInput["search"],
+        } as SettingsHealthInput["search"],
       },
       "search",
     );
 
     expect(search.state).toBe("warn");
     expect(search.detail).toBe("Search index rebuild required; using Meilisearch keyword search");
-    expect(search.action).toEqual({ label: "Fix", page: "library" });
+    expect(search.action).toEqual({ label: "Fix", page: "search" });
   });
 
   it("only calls email ready when it is on with a host and a sender address", () => {
@@ -295,10 +277,33 @@ describe("buildSettingsOverview health tiles", () => {
   });
 });
 
-describe("buildSettingsOverview groups", () => {
-  it("keeps the group manifest aligned with the overview ids", () => {
-    expect(buildSettingsOverview({}).cards.map((entry) => entry.id)).toEqual(
-      ADMIN_SETTINGS_NAV.map((item) => item.id),
+describe("settingsAttentionItems", () => {
+  it("keeps only the items that ask the admin to act", () => {
+    const items = settingsAttentionItems(
+      buildSettingsHealth({
+        settings: {
+          "email.enabled": "true",
+          "email.smtp_host": "smtp.example.com",
+          "email.from_address": "prairie@example.com",
+          "playback.transcode_enabled": "true",
+          "server.public_url": "https://silo.example.com",
+        },
+        storageAvailable: true,
+      }),
+    );
+
+    expect(items).toEqual([]);
+    expect(settingsAttentionItems(buildSettingsHealth({})).map((item) => item.id)).toEqual([
+      "storage",
+      "transcoding",
+      "public-url",
+      "email",
+    ]);
+  });
+
+  it("only links to settings pages that exist", () => {
+    expect([...ADMIN_SETTINGS_PAGE_IDS].sort()).toEqual(
+      ADMIN_SETTINGS_NAV.map((item) => item.id).sort(),
     );
   });
 });
diff --git a/web/src/hooks/admin/useSettingsOverview.ts b/web/src/hooks/admin/useSettingsHealth.ts
similarity index 69%
rename from web/src/hooks/admin/useSettingsOverview.ts
rename to web/src/hooks/admin/useSettingsHealth.ts
index 28ec2d7c24..231c101251 100644
--- a/web/src/hooks/admin/useSettingsOverview.ts
+++ b/web/src/hooks/admin/useSettingsHealth.ts
@@ -10,26 +10,28 @@ import {
   useCatalogSearchStatus,
   type CatalogSearchStatus,
 } from "@/hooks/queries/admin/settings";
-import { useHWAccelDetection, type HWAccelInfo } from "@/hooks/queries/admin/system";
 
 /**
- * The settings pages the overview links to. The ids here are stable route
- * segments and have to match the pages the settings layout mounts.
+ * The settings pages a health item can send the admin to. The ids here are
+ * stable route segments and have to match the pages the settings layout mounts.
  */
 export const ADMIN_SETTINGS_PAGE_IDS = [
   "about",
   "general",
-  "infrastructure",
+  "storage",
+  "search",
+  "logging",
   "appearance",
   "security",
   "sign-in",
   "library",
+  "autoscan",
   "playback",
   "downloads",
   "requests",
   "providers",
-  "watch-sync",
   "ai",
+  "email",
   "notifications",
   "compatibility",
   "network-access",
@@ -37,34 +39,23 @@ export const ADMIN_SETTINGS_PAGE_IDS = [
 
 export type AdminSettingsPageID = (typeof ADMIN_SETTINGS_PAGE_IDS)[number];
 
-/** Colour band a health tile reads in: green, amber, dimmed, or neutral blue. */
-export type OverviewState = "ok" | "warn" | "off" | "info";
+/** How a health item reads: healthy, needs fixing, not set up, or informational. */
+export type SettingsHealthState = "ok" | "warn" | "off" | "info";
 
-export interface OverviewTileAction {
+export interface SettingsHealthAction {
   label: string;
   page: AdminSettingsPageID;
 }
 
-export interface OverviewTile {
+export interface SettingsHealthItem {
   id: string;
   label: string;
-  state: OverviewState;
+  state: SettingsHealthState;
   /** One or two words, e.g. "Healthy" or "Restart pending". */
   stateText: string;
   /** Single supporting line under the state. */
   detail: string;
-  action?: OverviewTileAction;
-}
-
-export interface OverviewCard {
-  id: AdminSettingsPageID;
-}
-
-export interface SettingsOverviewModel {
-  /** True until the settings map has arrived; the page shows skeletons. */
-  isLoading: boolean;
-  tiles: OverviewTile[];
-  cards: OverviewCard[];
+  action?: SettingsHealthAction;
 }
 
 /**
@@ -72,18 +63,12 @@ export interface SettingsOverviewModel {
  * off hooks inside the builder) so the derivation is testable without a query
  * client, and so a missing/failed query is just `undefined` here.
  */
-export interface SettingsOverviewInput {
+export interface SettingsHealthInput {
   settings?: Record<string, string>;
   sensitiveConfigured?: readonly string[];
   storageAvailable?: boolean;
   serverStatus?: AdminServerStatus;
   search?: CatalogSearchStatus;
-  hwAccel?: HWAccelInfo;
-}
-
-/** Deep link to one settings page. */
-export function settingsPageHref(page: string): string {
-  return `/admin/settings/${encodeURIComponent(page)}`;
 }
 
 const TRUE_VALUES = new Set(["true", "1", "yes", "on"]);
@@ -123,17 +108,9 @@ function hwAccelLabel(value: string): string {
   return HW_ACCEL_LABELS[value] ?? value.toUpperCase();
 }
 
-/**
- * How transcoding is set up, in one phrase: the configured mode, and for
- * "auto" the mode detection actually resolved to.
- */
-function transcodeModeLabel(configured: string, detection: HWAccelInfo | undefined): string {
-  const mode = configured || "auto";
-  if (mode !== "auto") return hwAccelLabel(mode);
-  const resolved = detection?.resolved;
-  if (!resolved) return "Auto";
-  if (resolved === "none") return "Auto · software";
-  return `Auto · ${hwAccelLabel(resolved)}`;
+/** The configured transcoding mode, in one word. */
+function transcodeModeLabel(configured: string): string {
+  return hwAccelLabel(configured || "auto");
 }
 
 const SEARCH_PROVIDER_LABELS: Record<string, string> = {
@@ -166,7 +143,7 @@ function legacySettingsRestartPending(status: AdminServerStatus): boolean {
  * Whether a saved setting under one of `prefixes` is waiting for a restart.
  *
  * The server accumulates one "setting:<key>" reason per restart-required save,
- * so a tile can warn about its own keys and stay quiet for everyone else's —
+ * so an item can warn about its own keys and stay quiet for everyone else's —
  * and a later unrelated save cannot overwrite the evidence. An older server
  * without the list falls back to the coarse last-reason heuristic, which warns
  * for any settings save rather than missing a real one.
@@ -186,23 +163,24 @@ function settingsRestartPending(
 }
 
 // ---------------------------------------------------------------------------
-// Health tiles
+// Health items
 // ---------------------------------------------------------------------------
 
 /**
- * The link a tile carries. Only a tile the admin has to do something about
- * gets one — a healthy tile is a fact, not a task.
+ * The link an item carries. Only an item the admin has to do something about
+ * gets one — a healthy item is a fact, not a task.
  */
 function tileAction(
-  state: OverviewState,
+  state: SettingsHealthState,
   page: AdminSettingsPageID,
-): OverviewTileAction | undefined {
+): SettingsHealthAction | undefined {
   if (state === "warn") return { label: "Fix", page };
   if (state === "off") return { label: "Set up", page };
   return undefined;
 }
 
-function buildTiles(input: SettingsOverviewInput): OverviewTile[] {
+/** Every health item, healthy or not, derived from already-fetched data. */
+export function buildSettingsHealth(input: SettingsHealthInput): SettingsHealthItem[] {
   const { settings } = input;
   const configured = new Set(input.sensitiveConfigured ?? []);
 
@@ -220,16 +198,19 @@ function buildTiles(input: SettingsOverviewInput): OverviewTile[] {
   // admin who just did the work that it did not take.
   const storageRestartPending =
     !storageReady && publicBucket !== "" && settingsRestartPending(input.serverStatus, ["s3."]);
-  const storageState: OverviewState = storageReady ? "ok" : storageRestartPending ? "warn" : "off";
+  const storageState: SettingsHealthState = storageReady
+    ? "ok"
+    : storageRestartPending
+      ? "warn"
+      : "off";
 
   const maxConnections = readInt(settings, "database.max_connections");
   const redisConfigured = configured.has("redis.url") || readText(settings, "redis.url") !== "";
 
   const transcodeEnabled = readBool(settings, "playback.transcode_enabled");
-  const transcodeMode = transcodeModeLabel(readText(settings, "playback.hw_accel"), input.hwAccel);
-  const renderDevice = input.hwAccel?.render_devices?.[0] ?? "";
+  const transcodeMode = transcodeModeLabel(readText(settings, "playback.hw_accel"));
   const playbackRestartPending = settingsRestartPending(input.serverStatus, ["playback."]);
-  const transcodeState: OverviewState = playbackRestartPending
+  const transcodeState: SettingsHealthState = playbackRestartPending
     ? "warn"
     : transcodeEnabled
       ? "ok"
@@ -241,7 +222,7 @@ function buildTiles(input: SettingsOverviewInput): OverviewTile[] {
   const meiliConfigured = input.search?.meilisearch.configured ?? false;
   const meiliHealthy = input.search?.meilisearch.healthy ?? false;
   const searchDegraded = input.search?.degraded ?? false;
-  const searchState: OverviewState =
+  const searchState: SettingsHealthState =
     activeSearch === "meilisearch"
       ? !searchStatusResolved
         ? "info"
@@ -258,7 +239,12 @@ function buildTiles(input: SettingsOverviewInput): OverviewTile[] {
     emailHost,
     readText(settings, "email.from_address"),
   );
-  const emailState: OverviewState = mailReady ? "ok" : "off";
+  const emailState: SettingsHealthState = mailReady ? "ok" : "off";
+
+  // Invitation and reset links, sign-in provider redirects, and links in
+  // email and Discord messages are all built from it, and Prairie cannot guess it.
+  const publicUrl = readText(settings, "server.public_url");
+  const publicUrlState: SettingsHealthState = publicUrl ? "ok" : "off";
 
   return [
     {
@@ -275,7 +261,7 @@ function buildTiles(input: SettingsOverviewInput): OverviewTile[] {
         : storageRestartPending
           ? `${bucketDetail} · applies after a restart`
           : "Artwork and uploads have nowhere to go",
-      action: tileAction(storageState, "infrastructure"),
+      action: tileAction(storageState, "storage"),
     },
     {
       id: "database",
@@ -296,7 +282,7 @@ function buildTiles(input: SettingsOverviewInput): OverviewTile[] {
       detail: playbackRestartPending
         ? "Saved changes apply after a restart"
         : transcodeEnabled
-          ? join([transcodeMode, renderDevice])
+          ? transcodeMode
           : "Video plays as-is; remux and audio conversion still run",
       action: tileAction(transcodeState, "playback"),
     },
@@ -317,7 +303,15 @@ function buildTiles(input: SettingsOverviewInput): OverviewTile[] {
           : meiliConfigured
             ? "Meilisearch configured but not active"
             : "Meilisearch not connected",
-      action: tileAction(searchState, "library"),
+      action: tileAction(searchState, "search"),
+    },
+    {
+      id: "public-url",
+      label: "Public URL",
+      state: publicUrlState,
+      stateText: publicUrl ? "Set" : "Not set",
+      detail: publicUrl || "Invitation and reset links, and sign-in providers, need it",
+      action: tileAction(publicUrlState, "general"),
     },
     {
       id: "email",
@@ -325,34 +319,24 @@ function buildTiles(input: SettingsOverviewInput): OverviewTile[] {
       state: emailState,
       stateText: mailReady ? "Ready" : "Not set up",
       detail: mailReady ? `SMTP · ${emailHost}` : "Invites and resets can't send",
-      action: tileAction(emailState, "notifications"),
+      action: tileAction(emailState, "email"),
     },
   ];
 }
 
-// ---------------------------------------------------------------------------
-// Settings groups
-// ---------------------------------------------------------------------------
-
-function buildCards(): OverviewCard[] {
-  return ADMIN_SETTINGS_PAGE_IDS.map((id) => ({ id }));
-}
-
-/** Derives the whole overview model from already-fetched data. */
-export function buildSettingsOverview(input: SettingsOverviewInput): SettingsOverviewModel {
-  const tiles = buildTiles(input);
-  const cards = buildCards();
-
-  return { isLoading: false, tiles, cards };
+/** The health items that ask the admin to do something, and the page that does it. */
+export function settingsAttentionItems(items: readonly SettingsHealthItem[]): SettingsHealthItem[] {
+  return items.filter((item) => item.action != null);
 }
 
 /**
- * Live settings state for the admin settings landing page. Every query it
- * reads is one an individual page already loads, so opening the overview warms
- * the caches those pages go on to use.
+ * What in the server's setup needs the admin, for the Dashboard's notice and
+ * the admin sidebar's dots. Every query it reads is one a settings page
+ * already loads. Empty until the settings map arrives, so an unloaded server
+ * never reads as unconfigured.
  */
-export function useSettingsOverview(): SettingsOverviewModel {
-  const { data: settings, isLoading: settingsLoading } = useAdminServerSettings();
+export function useSettingsAttention(): SettingsHealthItem[] {
+  const { data: settings } = useAdminServerSettings();
   const { data: sensitive } = useAdminSensitiveStatus();
   const { data: serverStatus } = useAdminServerStatus();
   const branding = useBranding();
@@ -362,35 +346,29 @@ export function useSettingsOverview(): SettingsOverviewModel {
   const searchProvider = (settings?.["catalog.search.provider"] ?? "").trim() || "postgres";
   const { data: search } = useCatalogSearchStatus(
     settings != null && searchProvider === "meilisearch",
-  );
-
-  // Hardware detection shells out to ffmpeg on the transcode host, so it is
-  // only asked for when transcoding could actually use it.
-  const hwAccelMode = (settings?.["playback.hw_accel"] ?? "").trim();
-  const transcodeEnabled = TRUE_VALUES.has(
-    (settings?.["playback.transcode_enabled"] ?? "").trim().toLowerCase(),
-  );
-  const { data: hwAccel } = useHWAccelDetection(
-    settings != null && transcodeEnabled && hwAccelMode !== "none",
+    { pollRebuild: false },
   );
 
   return useMemo(() => {
-    const model = buildSettingsOverview({
-      settings,
-      sensitiveConfigured: sensitive?.configured,
-      storageAvailable: branding.storageAvailable,
-      serverStatus,
-      search,
-      hwAccel,
-    });
-    return { ...model, isLoading: settingsLoading && settings == null };
+    if (settings == null) return [];
+    const items = settingsAttentionItems(
+      buildSettingsHealth({
+        settings,
+        sensitiveConfigured: sensitive?.configured,
+        storageAvailable: branding.storageAvailable,
+        serverStatus,
+        search,
+      }),
+    );
+    // Branding reports whether storage is available; before it arrives that
+    // reads as false, which is not the same as storage that is not set up.
+    return branding.loaded ? items : items.filter((item) => item.id !== "storage");
   }, [
+    branding.loaded,
     branding.storageAvailable,
-    hwAccel,
     search,
     sensitive?.configured,
     serverStatus,
     settings,
-    settingsLoading,
   ]);
 }
diff --git a/web/src/hooks/queries/admin/accessGroups.test.ts b/web/src/hooks/queries/admin/accessGroups.test.ts
index 39c855b387..a68a3f75f2 100644
--- a/web/src/hooks/queries/admin/accessGroups.test.ts
+++ b/web/src/hooks/queries/admin/accessGroups.test.ts
@@ -32,6 +32,7 @@ const group: AccessGroup = {
   max_transcodes: 0,
   max_remote_stream_bitrate_kbps: 0,
   max_local_stream_bitrate_kbps: 0,
+  max_profiles: 5,
   allowed_permissions: null,
   requests_allowed: true,
   is_default: false,
diff --git a/web/src/hooks/queries/admin/catalogTransfer.v2.test.ts b/web/src/hooks/queries/admin/catalogTransfer.v2.test.ts
index bef0710bc4..175add6190 100644
--- a/web/src/hooks/queries/admin/catalogTransfer.v2.test.ts
+++ b/web/src/hooks/queries/admin/catalogTransfer.v2.test.ts
@@ -119,3 +119,15 @@ it("keeps large catalog search event identities as strings", async () => {
   await waitFor(() => expect(result.current.isSuccess).toBe(true));
   expect(result.current.data?.index.last_processed_event_id).toBe("9007199254740993");
 });
+it.each([
+  [true, "polls"],
+  [false, "does not poll"],
+])("with pollRebuild %s, %s while an index rebuild is pending", async (pollRebuild) => {
+  const rebuilding = { ...status, index: { ...status.index, rebuild_required: true } };
+  const { calls, wrapper } = setup(() => jsonResponse(rebuilding));
+  const { result } = renderHook(() => useCatalogSearchStatus(true, { pollRebuild }), { wrapper });
+  await waitFor(() => expect(result.current.isSuccess).toBe(true));
+  await act(() => new Promise((resolve) => setTimeout(resolve, 2_500)));
+  if (pollRebuild) expect(calls.length).toBeGreaterThan(1);
+  else expect(calls).toHaveLength(1);
+});
diff --git a/web/src/hooks/queries/admin/downloadStorage.ts b/web/src/hooks/queries/admin/downloadStorage.ts
index bcecf4fd12..106172a75a 100644
--- a/web/src/hooks/queries/admin/downloadStorage.ts
+++ b/web/src/hooks/queries/admin/downloadStorage.ts
@@ -1,8 +1,8 @@
 import { useInfiniteQuery, useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 import { captureProfileRequestContext, StaleApiRequestContextError } from "@/api/client";
+import { adminDownloadStorageRootKey } from "@/api/v2/adminDownloadStorageCache";
 import {
   ADMIN_DOWNLOAD_STORAGE_PAGE_SIZE,
-  adminDownloadStorageRootKey,
   cleanUpAdminDownloadStorageLocation,
   deleteAdminDownloadStorageFiles,
   deleteAdminDownloadStorageUntrackedFiles,
diff --git a/web/src/hooks/queries/admin/libraries.ts b/web/src/hooks/queries/admin/libraries.ts
index e21b0a043d..34b5a46697 100644
--- a/web/src/hooks/queries/admin/libraries.ts
+++ b/web/src/hooks/queries/admin/libraries.ts
@@ -742,16 +742,19 @@ export interface UnmatchedLibraryItemsPage {
 /**
  * Fetches one page of the unmatched-item listing; `cursor` is the previous
  * page's `nextCursor`. The search is server-side and spans the whole table.
+ * With `ignored` set it pages the items an admin ignored instead.
  */
 export async function fetchUnmatchedLibraryItemsPage(
   search: string,
   cursor?: string,
   signal?: AbortSignal,
+  ignored = false,
 ): Promise<UnmatchedLibraryItemsPage> {
   const result = await v2("GET /api/v2/libraries/unmatched-items", {
     query: {
       limit: UNMATCHED_PAGE_SIZE,
       ...(search ? { q: search } : {}),
+      ...(ignored ? { ignored: true } : {}),
       ...(cursor === undefined ? {} : { cursor }),
     },
     signal,
@@ -765,15 +768,17 @@ export async function fetchUnmatchedLibraryItemsPage(
 }
 
 /**
- * Pages the unmatched-item listing by cursor. The loaded pages keep their
- * cursors, so opening page N costs one request and a refetch refreshes the
- * loaded pages in place instead of walking the chain from the first page.
+ * Pages the unmatched-item listing by cursor, or with `ignored` the items an
+ * admin ignored. The loaded pages keep their cursors, so opening page N costs
+ * one request and a refetch refreshes the loaded pages in place instead of
+ * walking the chain from the first page.
  */
-export function useUnmatchedLibraryItems(search = "") {
+export function useUnmatchedLibraryItems(search = "", ignored = false) {
   const trimmed = search.trim();
   return useInfiniteQuery({
-    queryKey: adminKeys.unmatchedItems(trimmed),
-    queryFn: ({ pageParam, signal }) => fetchUnmatchedLibraryItemsPage(trimmed, pageParam, signal),
+    queryKey: adminKeys.unmatchedItems(trimmed, ignored),
+    queryFn: ({ pageParam, signal }) =>
+      fetchUnmatchedLibraryItemsPage(trimmed, pageParam, signal, ignored),
     initialPageParam: undefined as string | undefined,
     getNextPageParam: (lastPage) => lastPage.nextCursor,
     staleTime: ADMIN_STALE_TIME,
@@ -782,6 +787,66 @@ export function useUnmatchedLibraryItems(search = "") {
 
 export { UNMATCHED_PAGE_SIZE };
 
+export interface UnmatchedItemIgnoreVariables {
+  contentId: string;
+  title: string;
+  /** True ignores the item; false restores it to the unmatched list. */
+  ignored: boolean;
+}
+
+function setUnmatchedItemIgnored({ contentId, ignored }: UnmatchedItemIgnoreVariables) {
+  const path = { content_id: contentId };
+  return ignored
+    ? v2("PUT /api/v2/libraries/unmatched-items/{content_id}/ignore", { path })
+    : v2("DELETE /api/v2/libraries/unmatched-items/{content_id}/ignore", { path });
+}
+
+/**
+ * Marks an unmatched item as intentionally unmatched, so it leaves the list
+ * and automatic matching leaves it alone, or restores an ignored one. The
+ * success toast offers Undo, which flips the item back.
+ */
+export function useSetUnmatchedItemIgnored() {
+  const queryClient = useQueryClient();
+  const refresh = () => queryClient.invalidateQueries({ queryKey: adminKeys.unmatchedItems() });
+
+  const undoMutation = useMutation({
+    mutationFn: (variables: UnmatchedItemIgnoreVariables) =>
+      setUnmatchedItemIgnored({ ...variables, ignored: !variables.ignored }),
+    onError: (err) => {
+      toast.error(err instanceof Error ? err.message : "Failed to undo");
+    },
+    onSettled: refresh,
+  });
+
+  return useMutation({
+    mutationFn: setUnmatchedItemIgnored,
+    onError: (err, variables) => {
+      toast.error(
+        err instanceof Error
+          ? err.message
+          : variables.ignored
+            ? "Failed to ignore item"
+            : "Failed to restore item",
+      );
+    },
+    onSuccess: (_data, variables) => {
+      toast.success(
+        variables.ignored ? `Ignored ${variables.title}` : `Restored ${variables.title}`,
+        {
+          description: variables.ignored
+            ? "Prairie won't try to match it again. You can restore it from the Ignored view."
+            : "It's back on the unmatched list, and Prairie will try to match it again.",
+          action: { label: "Undo", onClick: () => undoMutation.mutate(variables) },
+        },
+      );
+    },
+    // Refresh after a failure too: a 409 means the item was matched since the
+    // list loaded, so its row is stale either way.
+    onSettled: refresh,
+  });
+}
+
 export function useConfirmEmptyRootCleanup() {
   const queryClient = useQueryClient();
   return useMutation({
diff --git a/web/src/hooks/queries/admin/libraries.v2.test.ts b/web/src/hooks/queries/admin/libraries.v2.test.ts
index ca5e8ee4b8..16fc1ee461 100644
--- a/web/src/hooks/queries/admin/libraries.v2.test.ts
+++ b/web/src/hooks/queries/admin/libraries.v2.test.ts
@@ -17,6 +17,7 @@ import listLibrariesOk from "../../../../../contracts/api/v2/fixtures/list_libra
 import listLibraryRootsOk from "../../../../../contracts/api/v2/fixtures/list_library_roots_ok.json";
 import listMetadataMatchQueuesOk from "../../../../../contracts/api/v2/fixtures/list_metadata_match_queues_ok.json";
 import listStaleIdsOk from "../../../../../contracts/api/v2/fixtures/list_stale_ids_ok.json";
+import listIgnoredUnmatchedItemsOk from "../../../../../contracts/api/v2/fixtures/list_ignored_unmatched_items_ok.json";
 import listUnmatchedItemsOk from "../../../../../contracts/api/v2/fixtures/list_unmatched_items_ok.json";
 import refreshLibraryMetadataAccepted from "../../../../../contracts/api/v2/fixtures/refresh_library_metadata_accepted.json";
 import updateLibraryOk from "../../../../../contracts/api/v2/fixtures/update_library_ok.json";
@@ -28,6 +29,7 @@ import {
   fetchLibraryMetadataMatchQueuePage,
   fetchUnmatchedLibraryItemsPage,
   useUnmatchedLibraryItems,
+  useSetUnmatchedItemIgnored,
   useCheckLibraryMount,
   useCreateLibrary,
   useDeleteLibrary,
@@ -48,7 +50,8 @@ import {
   useUpdateLibrary,
 } from "./libraries";
 
-vi.mock("sonner", () => ({ toast: { success: vi.fn(), error: vi.fn() } }));
+const toastMocks = vi.hoisted(() => ({ success: vi.fn(), error: vi.fn() }));
+vi.mock("sonner", () => ({ toast: toastMocks }));
 
 function createWrapper() {
   const client = new QueryClient({
@@ -460,6 +463,52 @@ describe("library admin hooks on the v2 contract", () => {
     expect(result.current.data?.pages[1]?.items[0]?.title).toBe("Beta");
   });
 
+  it("pages the ignored items with the ignored filter and keeps when each was ignored", async () => {
+    const fetchMock = stubFetch(() => jsonResponse(listIgnoredUnmatchedItemsOk));
+
+    const page = await fetchUnmatchedLibraryItemsPage("", undefined, undefined, true);
+
+    const url = requestsOf(fetchMock)[0]?.url;
+    expect(url?.pathname).toBe("/api/v2/libraries/unmatched-items");
+    expect(url?.searchParams.get("ignored")).toBe("true");
+    expect(page.items.map((i) => [i.title, i.ignored_at])).toEqual([
+      ["Delta", "2026-01-02T03:04:05.678Z"],
+    ]);
+
+    // The default listing never sends the filter.
+    await fetchUnmatchedLibraryItemsPage("");
+    expect(requestsOf(fetchMock)[1]?.url.searchParams.has("ignored")).toBe(false);
+  });
+
+  it("ignores an unmatched item and undoes it from the toast", async () => {
+    const fetchMock = stubFetch(() => new Response(null, { status: 204 }));
+    toastMocks.success.mockClear();
+
+    const { result } = renderHook(() => useSetUnmatchedItemIgnored(), {
+      wrapper: createWrapper(),
+    });
+    await result.current.mutateAsync({ contentId: "movie:a", title: "Alpha", ignored: true });
+
+    expect(
+      requestsOf(fetchMock).map((r) => [r.method, decodeURIComponent(r.url.pathname)]),
+    ).toEqual([["PUT", "/api/v2/libraries/unmatched-items/movie:a/ignore"]]);
+    expect(toastMocks.success).toHaveBeenCalledWith(
+      "Ignored Alpha",
+      expect.objectContaining({ action: expect.objectContaining({ label: "Undo" }) }),
+    );
+
+    const [, options] = toastMocks.success.mock.calls[0] as [
+      string,
+      { action: { onClick: () => void } },
+    ];
+    options.action.onClick();
+    await waitFor(() => expect(fetchMock).toHaveBeenCalledTimes(2));
+    expect(requestsOf(fetchMock)[1]?.method).toBe("DELETE");
+    expect(decodeURIComponent(requestsOf(fetchMock)[1]?.url.pathname ?? "")).toBe(
+      "/api/v2/libraries/unmatched-items/movie:a/ignore",
+    );
+  });
+
   it("decodes the matcher backlog detail with the page fields the section reads", async () => {
     const fetchMock = stubFetch(() => jsonResponse(getMetadataMatchQueueOk));
 
diff --git a/web/src/hooks/queries/admin/libraryTranslation.ts b/web/src/hooks/queries/admin/libraryTranslation.ts
new file mode 100644
index 0000000000..4253f995d3
--- /dev/null
+++ b/web/src/hooks/queries/admin/libraryTranslation.ts
@@ -0,0 +1,82 @@
+import { type QueryClient, useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import { toast } from "sonner";
+
+import { v2, type V2Result } from "@/api/v2/request";
+
+export type LibraryTranslationJob =
+  V2Result<"GET /api/v2/admin/libraries/{library_id}/metadata-translation/jobs">["jobs"][number];
+
+const libraryTranslationJobsKey = (libraryId: number) =>
+  ["admin", "library-metadata-translation", libraryId] as const;
+
+// Prewarm job ids the admin started or saw running, per query client so they
+// outlive the library editor for the app session. The panel reports each one
+// when it finishes.
+const watchedJobsByClient = new WeakMap<QueryClient, Set<string>>();
+
+export function watchedLibraryTranslationJobs(client: QueryClient): Set<string> {
+  let watched = watchedJobsByClient.get(client);
+  if (!watched) {
+    watched = new Set();
+    watchedJobsByClient.set(client, watched);
+  }
+  return watched;
+}
+
+export function isActiveTranslationJob(job: LibraryTranslationJob): boolean {
+  return job.status === "pending" || job.status === "running";
+}
+
+/** A library's recent prewarm jobs, polled while one is active. */
+export function useLibraryTranslationJobs(libraryId: number, enabled: boolean) {
+  return useQuery({
+    queryKey: libraryTranslationJobsKey(libraryId),
+    queryFn: () =>
+      v2("GET /api/v2/admin/libraries/{library_id}/metadata-translation/jobs", {
+        path: { library_id: String(libraryId) },
+      }),
+    enabled,
+    refetchInterval: (query) =>
+      (query.state.data?.jobs ?? []).some(isActiveTranslationJob) ? 2000 : false,
+  });
+}
+
+/** Starts (or joins) the prewarm of a library's missing translations. */
+export function useTranslateLibraryMetadata(libraryId: number) {
+  const queryClient = useQueryClient();
+  return useMutation({
+    retry: false,
+    mutationFn: (targetLanguage: string) =>
+      v2("POST /api/v2/admin/libraries/{library_id}/metadata-translation", {
+        path: { library_id: String(libraryId) },
+        body: { target_language: targetLanguage },
+        retryAuthentication: false,
+      }),
+    onSuccess: (job) => {
+      // Recorded here rather than in a mutate() callback, which is dropped when
+      // the editor closes before the request answers.
+      watchedLibraryTranslationJobs(queryClient).add(job.id);
+      return queryClient.invalidateQueries({ queryKey: libraryTranslationJobsKey(libraryId) });
+    },
+    onError: (err) => {
+      toast.error(err instanceof Error ? err.message : "Failed to start translation");
+    },
+  });
+}
+
+export function useCancelLibraryTranslation(libraryId: number) {
+  const queryClient = useQueryClient();
+  return useMutation({
+    retry: false,
+    mutationFn: (jobId: string) =>
+      v2("POST /api/v2/admin/libraries/{library_id}/metadata-translation/jobs/{job_id}/cancel", {
+        path: { library_id: String(libraryId), job_id: jobId },
+        retryAuthentication: false,
+      }),
+    onSettled: () =>
+      queryClient.invalidateQueries({ queryKey: libraryTranslationJobsKey(libraryId) }),
+    onError: (err) => {
+      toast.error(err instanceof Error ? err.message : "Failed to cancel translation");
+    },
+  });
+}
diff --git a/web/src/hooks/queries/admin/nodeCommands.test.tsx b/web/src/hooks/queries/admin/nodeCommands.test.tsx
index 4562560555..7cab93016e 100644
--- a/web/src/hooks/queries/admin/nodeCommands.test.tsx
+++ b/web/src/hooks/queries/admin/nodeCommands.test.tsx
@@ -15,6 +15,12 @@ import { setAccessToken, setRefreshToken, setProfileId, setProfileToken } from "
 import type { StreamNode } from "@/api/types";
 import { useAdminNodes, useCheckNodeHealth, useReprobeNode } from "./nodes";
 import AdminNodes from "@/pages/AdminNodes";
+
+// Routing settings have their own suite, and their unsaved-changes guard needs
+// a data router these node-command tests do not mount.
+vi.mock("@/pages/admin-settings/NodeRoutingSettings", () => ({
+  NodeRoutingSettings: () => null,
+}));
 const node: StreamNode = {
   id: "17",
   name: "Synthetic",
diff --git a/web/src/hooks/queries/admin/nodeConfiguration.test.tsx b/web/src/hooks/queries/admin/nodeConfiguration.test.tsx
index 510cb15623..d265b55f76 100644
--- a/web/src/hooks/queries/admin/nodeConfiguration.test.tsx
+++ b/web/src/hooks/queries/admin/nodeConfiguration.test.tsx
@@ -22,6 +22,12 @@ import type { StreamNode } from "@/api/types";
 import { useCreateNode, useUpdateNode, useDeleteNode } from "./nodes";
 import { adminKeys } from "../keys";
 import AdminNodes from "@/pages/AdminNodes";
+
+// Routing settings have their own suite, and their unsaved-changes guard needs
+// a data router these node-command tests do not mount.
+vi.mock("@/pages/admin-settings/NodeRoutingSettings", () => ({
+  NodeRoutingSettings: () => null,
+}));
 const node: StreamNode = {
   id: "17",
   config_etag: '"original"',
diff --git a/web/src/hooks/queries/admin/recommendations.ts b/web/src/hooks/queries/admin/recommendations.ts
index ef4805d982..e69744edae 100644
--- a/web/src/hooks/queries/admin/recommendations.ts
+++ b/web/src/hooks/queries/admin/recommendations.ts
@@ -82,3 +82,22 @@ export function useTriggerRecommendations() {
     },
   });
 }
+
+/**
+ * Deletes the embedding lock, every item embedding, taste profiles and
+ * per-profile cached rows. Not retried: a later replay would also delete what
+ * the embedding job built since. The caller reports success and failure.
+ */
+export function useResetEmbeddings() {
+  const queryClient = useQueryClient();
+  return useMutation({
+    retry: false,
+    mutationFn: () =>
+      v2("POST /api/v2/admin/recommendations/embeddings/reset", { retryAuthentication: false }),
+    onSettled: () => {
+      queryClient.invalidateQueries({ queryKey: adminKeys.recommendationsStatus() });
+      // The lock card reads the lock from the stored settings.
+      queryClient.invalidateQueries({ queryKey: adminKeys.serverSettings() });
+    },
+  });
+}
diff --git a/web/src/hooks/queries/admin/recommendations.v2.test.ts b/web/src/hooks/queries/admin/recommendations.v2.test.ts
index 88b2b29ca5..7cbb366691 100644
--- a/web/src/hooks/queries/admin/recommendations.v2.test.ts
+++ b/web/src/hooks/queries/admin/recommendations.v2.test.ts
@@ -11,6 +11,7 @@ import {
   useTriggerTasteProfiles,
   useTriggerCowatch,
   useTriggerRecommendations,
+  useResetEmbeddings,
 } from "./recommendations";
 
 vi.mock("sonner", () => ({ toast: { error: vi.fn() } }));
@@ -77,12 +78,25 @@ it.each(triggers)("starts %s using the generated v2 operation", async (suffix, h
     { path: `/api/v2/admin/recommendations/trigger/${suffix}`, method: "POST" },
   ]);
 });
-it("reads typed counts and running flags from v2", async () => {
+it("reads typed counts, last runs and running flags from v2", async () => {
   const status = {
-    embeddings: { running: true, count: 3, total: 10 },
+    embeddings: {
+      running: true,
+      count: 3,
+      total: 10,
+      last_run: {
+        status: "failed",
+        started_at: "2026-10-03T03:00:00.000Z",
+        completed_at: "2026-10-03T03:01:30.000Z",
+        error: "embedding provider unavailable",
+        result: { embedded: 0 },
+      },
+    },
     taste_profiles: { running: false, count: 4 },
     cowatch: { running: false, count: 6 },
     recommendations: { running: false, count: 5 },
+    lock_conflict: "",
+    cache_refreshed_at: "2026-10-03T05:01:00.000Z",
   };
   const { calls, wrapper } = setup(() => jsonResponse(status));
   const { result, unmount } = renderHook(useRecommendationsStatus, { wrapper });
@@ -90,3 +104,39 @@ it("reads typed counts and running flags from v2", async () => {
   expect(calls[0]?.path).toBe("/api/v2/admin/recommendations/status");
   unmount();
 });
+
+it("resets embeddings once, without refresh or replay after 401", async () => {
+  setAccessToken("synthetic-admin");
+  setRefreshToken("synthetic-refresh");
+  const { calls, wrapper } = setup(
+    () =>
+      new Response(
+        JSON.stringify({
+          type: "https://siloserver.org/docs/api/v2/problems/invalid_token",
+          title: "Invalid token",
+          status: 401,
+          detail: "Expired",
+          instance: "urn:prairie:request:test",
+        }),
+        { status: 401, headers: { "Content-Type": "application/problem+json" } },
+      ),
+  );
+  const { result } = renderHook(useResetEmbeddings, { wrapper });
+  await act(async () => {
+    await expect(result.current.mutateAsync()).rejects.toThrow();
+  });
+  expect(calls).toEqual([
+    { path: "/api/v2/admin/recommendations/embeddings/reset", method: "POST" },
+  ]);
+});
+it("resets embeddings using the generated v2 operation", async () => {
+  const deleted = { embeddings: 120, taste_profiles: 3, taste_clusters: 9, cached_rows: 41 };
+  const { calls, wrapper } = setup(() => jsonResponse(deleted));
+  const { result } = renderHook(useResetEmbeddings, { wrapper });
+  await act(async () => {
+    await expect(result.current.mutateAsync()).resolves.toEqual(deleted);
+  });
+  expect(calls).toEqual([
+    { path: "/api/v2/admin/recommendations/embeddings/reset", method: "POST" },
+  ]);
+});
diff --git a/web/src/hooks/queries/admin/settings.ts b/web/src/hooks/queries/admin/settings.ts
index 62dfd55019..5b6566492d 100644
--- a/web/src/hooks/queries/admin/settings.ts
+++ b/web/src/hooks/queries/admin/settings.ts
@@ -66,17 +66,15 @@ function useRetainedSettingsBaseline(
     },
   };
 }
-/* eslint-enable react-hooks/refs */
+/* eslint-enable react-hooks/refs -- ends the baseline-capture exception */
 
 export type CatalogSearchStatus = V2Result<"GET /api/v2/admin/catalog/search/status">;
 
-export function useAdminServerSettings({ enabled = true }: { enabled?: boolean } = {}) {
-  const profileContext = captureProfileRequestContext();
-  return useQuery({
+function adminServerSettingsQuery(profileContext: ReturnType<typeof captureProfileRequestContext>) {
+  return {
     queryKey: profileContext
       ? adminSettingsKey(profileContext)
       : [...adminKeys.serverSettings(), null],
-    enabled: enabled && profileContext !== null,
     queryFn: () => {
       if (!profileContext) throw new StaleApiRequestContextError();
       return readAdminSettings(profileContext);
@@ -85,9 +83,38 @@ export function useAdminServerSettings({ enabled = true }: { enabled?: boolean }
     // with an older equal-valued record when only a redacted secret changed.
     structuralSharing: false,
     staleTime: 30_000,
+  };
+}
+
+export function useAdminServerSettings({ enabled = true }: { enabled?: boolean } = {}) {
+  const profileContext = captureProfileRequestContext();
+  return useQuery({
+    ...adminServerSettingsQuery(profileContext),
+    enabled: enabled && profileContext !== null,
   });
 }
 
+const ADMIN_SENSITIVE_STATUS_QUERY = {
+  queryKey: [...adminKeys.serverSettings(), "sensitive-status"] as const,
+  queryFn: () => v2("GET /api/v2/admin/settings/sensitive-status"),
+  staleTime: 30_000,
+};
+
+/**
+ * Warms what every settings page waits on before it can draw, so a click on
+ * Settings lands on a filled page instead of a skeleton. Call on intent
+ * (hover, focus); fresh entries are left alone.
+ */
+export function usePrefetchAdminServerSettings() {
+  const queryClient = useQueryClient();
+  return () => {
+    const profileContext = captureProfileRequestContext();
+    if (!profileContext) return;
+    void queryClient.prefetchQuery(adminServerSettingsQuery(profileContext));
+    void queryClient.prefetchQuery(ADMIN_SENSITIVE_STATUS_QUERY);
+  };
+}
+
 export type StorageTransitionPolicy = "start_fresh" | "preserve_uploads" | "migrate_all";
 export type StorageTransitionCapabilities =
   V2Result<"GET /api/v2/admin/storage-transitions/capabilities">;
@@ -241,11 +268,8 @@ export function useUpdateServerSettings(displayed?: SettingsValues) {
           }),
         );
       }
-      if (keys.some((key) => key.startsWith("branding.") || key.startsWith("ui.admin_"))) {
-        invalidations.push(
-          queryClient.invalidateQueries({ queryKey: themeKeys.adminCss() }),
-          queryClient.invalidateQueries({ queryKey: themeKeys.branding() }),
-        );
+      if (keys.some((key) => key.startsWith("branding."))) {
+        invalidations.push(queryClient.invalidateQueries({ queryKey: themeKeys.branding() }));
       }
       if (keys.some(affectsOverlayConfig)) {
         invalidations.push(
@@ -354,15 +378,11 @@ export function useUpdateServerSetting(displayed?: SettingsValues) {
           }),
         );
       }
-      // Branding and admin theme settings are served live by public endpoints
-      // (`/theme/branding`, `/theme/admin-css`) and require no restart. Refresh
-      // those caches so saved changes apply immediately instead of waiting out
-      // the 60s / 5min stale windows.
-      if (variables.key.startsWith("branding.") || variables.key.startsWith("ui.admin_")) {
-        invalidations.push(
-          queryClient.invalidateQueries({ queryKey: themeKeys.adminCss() }),
-          queryClient.invalidateQueries({ queryKey: themeKeys.branding() }),
-        );
+      // Branding settings are served live by the public `/theme/branding`
+      // endpoint and require no restart. Refresh that cache so saved changes
+      // apply immediately instead of waiting out its stale window.
+      if (variables.key.startsWith("branding.")) {
+        invalidations.push(queryClient.invalidateQueries({ queryKey: themeKeys.branding() }));
       }
       if (affectsOverlayConfig(variables.key)) {
         invalidations.push(
@@ -415,11 +435,7 @@ export function useUpdateServerSetting(displayed?: SettingsValues) {
 }
 
 export function useAdminSensitiveStatus() {
-  return useQuery({
-    queryKey: [...adminKeys.serverSettings(), "sensitive-status"] as const,
-    queryFn: () => v2("GET /api/v2/admin/settings/sensitive-status"),
-    staleTime: 30_000,
-  });
+  return useQuery(ADMIN_SENSITIVE_STATUS_QUERY);
 }
 
 export function useCheckAdminSettingsConnection() {
@@ -434,13 +450,20 @@ export function useCheckAdminSettingsConnection() {
   });
 }
 
-export function useCatalogSearchStatus(enabled = true) {
+/**
+ * Search status. The Search page polls it every 2s while an index rebuild is
+ * pending; `pollRebuild: false` is for readers that sit on every admin page
+ * (the sidebar's health dots), where that poll would run a full-catalog count
+ * on the server every 2s from anywhere in admin.
+ */
+export function useCatalogSearchStatus(enabled = true, { pollRebuild = true } = {}) {
   return useQuery({
     queryKey: adminKeys.catalogSearchStatus(),
     queryFn: ({ signal }) => v2("GET /api/v2/admin/catalog/search/status", { signal }),
     enabled,
     staleTime: 15_000,
-    refetchInterval: (query) => (query.state.data?.index.rebuild_required ? 2_000 : false),
+    refetchInterval: (query) =>
+      pollRebuild && query.state.data?.index.rebuild_required ? 2_000 : false,
   });
 }
 
diff --git a/web/src/hooks/queries/branding.v2.test.tsx b/web/src/hooks/queries/branding.v2.test.tsx
index 95c2334af7..7e30cfee4a 100644
--- a/web/src/hooks/queries/branding.v2.test.tsx
+++ b/web/src/hooks/queries/branding.v2.test.tsx
@@ -4,7 +4,6 @@ import { cleanup, renderHook, waitFor } from "@testing-library/react";
 import { useContext, type ReactNode } from "react";
 import { afterEach, beforeEach, expect, it, vi } from "vitest";
 import { BrandingContext, BrandingProvider } from "@/contexts/BrandingProvider";
-import { useAdminPublicCss } from "./theme";
 import { installPolicyStorageMocks, jsonResponse } from "@/pages/admin-policy/policyTestUtils";
 import { setAccessToken, setRefreshToken } from "@/api/client";
 
@@ -26,29 +25,39 @@ function wrapper({ children }: { children: ReactNode }) {
     </QueryClientProvider>
   );
 }
-it("loads v2 branding and CSS before login and follows versioned v2 image URLs", async () => {
+it("loads v2 branding before login and follows versioned v2 image URLs", async () => {
   const fetchMock = vi.fn<typeof fetch>(async (input) => {
     if (String(input) === "/api/v2/theme/branding")
       return jsonResponse({
         server_name: "Fixture",
         login_subtitle: "Welcome",
+        accent_color: "#10b981",
         storage_available: true,
         favicon_url: "/api/v2/branding/assets/favicon?v=ref.png",
       });
-    if (String(input) === "/api/v2/theme/admin-css")
-      return jsonResponse({ vars: '{"--primary":"red"}', raw_css: "body { color: red; }" });
     throw new Error("Unexpected request: " + String(input));
   });
   vi.stubGlobal("fetch", fetchMock);
-  const { result } = renderHook(
-    () => ({ branding: useContext(BrandingContext), css: useAdminPublicCss() }),
-    { wrapper },
-  );
+  const { result } = renderHook(() => ({ branding: useContext(BrandingContext) }), { wrapper });
   await waitFor(() => expect(result.current.branding.serverName).toBe("Fixture"));
-  await waitFor(() => expect(result.current.css.data?.rawCss).toBe("body { color: red; }"));
-  expect(result.current.css.data?.vars).toEqual({ "--primary": "red" });
+  expect(result.current.branding.accentColor).toBe("#10b981");
+  expect(document.getElementById("prairie-accent")?.textContent).toBe(
+    ":root {\n  --primary: #10b981;\n  --ring: #10b981;\n  --sidebar-primary: #10b981;\n}\n" +
+      'html[data-high-contrast="true"] {\n  --ring: var(--contrast-boost);\n}',
+  );
   expect(document.querySelector('link[rel="icon"]')?.getAttribute("href")).toBe(
     "/api/v2/branding/assets/favicon?v=ref.png",
   );
-  expect(fetchMock).toHaveBeenCalledTimes(2);
+  expect(fetchMock).toHaveBeenCalledTimes(1);
+});
+
+it("paints no accent when the stored value is not a hex color", async () => {
+  const fetchMock = vi.fn<typeof fetch>(async () =>
+    jsonResponse({ server_name: "Fixture", accent_color: "red;} body{display:none" }),
+  );
+  vi.stubGlobal("fetch", fetchMock);
+  document.getElementById("prairie-accent")?.remove();
+  const { result } = renderHook(() => useContext(BrandingContext), { wrapper });
+  await waitFor(() => expect(result.current.serverName).toBe("Fixture"));
+  expect(document.getElementById("prairie-accent")).toBeNull();
 });
diff --git a/web/src/hooks/queries/catalog.test.tsx b/web/src/hooks/queries/catalog.test.tsx
index d8e3ff8e20..5c8db5831e 100644
--- a/web/src/hooks/queries/catalog.test.tsx
+++ b/web/src/hooks/queries/catalog.test.tsx
@@ -13,7 +13,10 @@ vi.mock("@tanstack/react-query", () => ({
   keepPreviousData: Symbol("keepPreviousData"),
   useQueries: (...args: unknown[]) => mocks.useQueries(...args),
   useQuery: (...args: unknown[]) => mocks.useQuery(...args),
-  useQueryClient: () => ({ getQueryState: mocks.getQueryState }),
+  useQueryClient: () => ({
+    getQueryState: mocks.getQueryState,
+    getQueryCache: () => ({ findAll: () => [] }),
+  }),
 }));
 
 vi.mock("@/api/v2/request", () => ({
@@ -234,7 +237,13 @@ describe("useCatalogWindow", () => {
         }>;
       }) => {
         const offsets = queries.map((query) => query.queryKey[2].offset ?? 0);
-        const hasPlaceholderData = queries.some((query) => "placeholderData" in query);
+        // keepPreviousData would hand each slot whatever page it held before
+        // the window moved; a placeholder may only come from the same offset.
+        const hasPlaceholderData = queries.some((query) =>
+          typeof query.placeholderData === "function"
+            ? (query.placeholderData as () => unknown)() !== undefined
+            : query.placeholderData !== undefined,
+        );
 
         if (offsets.join(",") === "60") {
           return [{ data: makePage(60, limit), isLoading: false }];
diff --git a/web/src/hooks/queries/catalog.ts b/web/src/hooks/queries/catalog.ts
index c8d466ff48..1056af6d31 100644
--- a/web/src/hooks/queries/catalog.ts
+++ b/web/src/hooks/queries/catalog.ts
@@ -1,5 +1,5 @@
 import { useEffect, useMemo, useState } from "react";
-import { useQueries, useQuery, useQueryClient } from "@tanstack/react-query";
+import { useQueries, useQuery, useQueryClient, type Query } from "@tanstack/react-query";
 
 import type { CatalogFiltersResponse, CatalogResponse } from "@/api/types";
 import { catalogFiltersFromV2, catalogItemFromV2 } from "@/api/v2/catalog";
@@ -278,6 +278,26 @@ export function useCatalogWindow(
     pageIndex === 0
       ? page0Key
       : catalogKeys.list({ ...remainingPageParams, limit, offset: pageIndex * limit, snapshot });
+  // Every page past the first is keyed by page 0's snapshot, so each page 0
+  // refetch (a realtime event invalidating the list, say) re-keys them all.
+  // Until a page loads under the new snapshot, show what it held under an
+  // earlier one instead of dropping the grid back to skeletons.
+  const earlierSnapshotPage = (pageIndex: number) => {
+    let newest: Query<CatalogPage>["state"] | undefined;
+    // The key without a snapshot matches this page under every snapshot.
+    const samePage = catalogKeys.list({ ...remainingPageParams, limit, offset: pageIndex * limit });
+    for (const query of queryClient.getQueryCache().findAll({ queryKey: samePage })) {
+      const { state } = query as Query<CatalogPage>;
+      if (
+        state.data !== undefined &&
+        state.data.snapshot !== snapshot &&
+        state.dataUpdatedAt > (newest?.dataUpdatedAt ?? 0)
+      ) {
+        newest = state;
+      }
+    }
+    return newest?.data;
+  };
   const continuationCursor = (page: CatalogPage | undefined) =>
     snapshot !== undefined &&
     page?.snapshot === snapshot &&
@@ -356,6 +376,7 @@ export function useCatalogWindow(
         queryKey: pageKey(pageIndex),
         queryFn: ({ signal }: { signal: AbortSignal }) => fetchRemainingPage(pageIndex, signal),
         ...remainingPageOptions,
+        placeholderData: () => earlierSnapshotPage(pageIndex),
         enabled:
           canFetchRemainingPages &&
           (!continuationIsIndexed || pageIndex >= visibleStartPage || firstVisiblePageSettled),
diff --git a/web/src/hooks/queries/catalogPaging.test.tsx b/web/src/hooks/queries/catalogPaging.test.tsx
index 8920ec22c2..05413aeced 100644
--- a/web/src/hooks/queries/catalogPaging.test.tsx
+++ b/web/src/hooks/queries/catalogPaging.test.tsx
@@ -285,6 +285,42 @@ describe("catalog window cursor paging", () => {
     expect(requests[4]?.body.seek).toBeUndefined();
   });
 
+  it("keeps showing a loaded page while it reloads under a new snapshot", async () => {
+    const { fetchMock, reply } = catalogTransport();
+    let releaseHeld: (() => void) | undefined;
+    fetchMock.mockImplementation(async (_url, options) => {
+      const body = JSON.parse(String(options?.body)) as CatalogQueryBody;
+      // Hold page 1 only once it is read under page 0's second snapshot.
+      const offset = body.seek ?? Number(body.cursor?.match(/^next:(\d+):/)?.[1] ?? 0);
+      if (offset === 2 && body.cursor?.endsWith(":2")) {
+        await new Promise<void>((resolve) => (releaseHeld = resolve));
+      }
+      return reply(body);
+    });
+    const { wrapper, queryClient } = makeClient();
+    const state = createCatalogSearchState("history");
+    const { result } = renderHook(
+      () => useCatalogWindow(state, { limit: 2, includeTotal: false, visibleRange: [2, 3] }),
+      { wrapper },
+    );
+    await waitFor(() => expect(result.current.data.pages.get(1)).toHaveLength(2));
+
+    // A realtime event invalidates the list. Page 0 comes back under a new
+    // snapshot, which re-keys page 1.
+    await act(async () => {
+      await queryClient.invalidateQueries({ queryKey: ["catalog"] });
+    });
+    await waitFor(() => expect(releaseHeld).toBeDefined());
+    expect(result.current.data.pages.get(1)?.map((item) => item.content_id)).toEqual([
+      "item-2",
+      "item-3",
+    ]);
+
+    act(() => releaseHeld!());
+    await waitFor(() => expect(queryClient.isFetching()).toBe(0));
+    expect(result.current.data.pages.get(1)).toHaveLength(2);
+  });
+
   it.each([
     ["search text", { q: "moon" }],
     ["library", { library_id: 7 }],
diff --git a/web/src/hooks/queries/catalogRead.test.ts b/web/src/hooks/queries/catalogRead.test.ts
index 8ed1396c50..72419b2e6b 100644
--- a/web/src/hooks/queries/catalogRead.test.ts
+++ b/web/src/hooks/queries/catalogRead.test.ts
@@ -65,7 +65,12 @@ describe("catalog item reads on the v2 contract", () => {
     expect(detail.rating_imdb).toBeNull();
     expect(detail.release_date).toBeNull();
     expect(detail.intro).toBeNull();
-    expect(detail.user_state).toEqual({ played: true, is_favorite: true, in_watchlist: false });
+    expect(detail.user_state).toEqual({
+      played: true,
+      is_favorite: true,
+      in_watchlist: false,
+      not_interested: false,
+    });
     expect(detail.status).toBeUndefined();
   });
 
diff --git a/web/src/hooks/queries/devices.ts b/web/src/hooks/queries/devices.ts
index 2a23f5cb06..f884a64f0d 100644
--- a/web/src/hooks/queries/devices.ts
+++ b/web/src/hooks/queries/devices.ts
@@ -61,6 +61,42 @@ export interface DeviceTarget {
   profileId?: string;
 }
 
+/**
+ * Give a device a name of the profile's choosing, or clear it with `null` so the
+ * device shows the name it reports again. Only the device list reads the name.
+ */
+export function useRenameDevice() {
+  const qc = useQueryClient();
+
+  return useMutation({
+    mutationFn: ({ device, name }: RenameDeviceInput) =>
+      v2("PATCH /api/v2/devices/{device_id}", {
+        path: { device_id: device.deviceId },
+        query: { profile_id: device.profileId },
+        body: { custom_name: name },
+      }),
+    // The saved entry goes into every cached list first, so a refetch that
+    // fails still leaves the new name on screen when the editor closes.
+    onSuccess: (saved) => {
+      qc.setQueriesData<UserDevice[]>({ queryKey: deviceKeys.all }, (devices) =>
+        devices?.map((row) =>
+          row.device_id === saved.device_id && row.profile_id === saved.profile_id
+            ? { ...row, custom_name: saved.custom_name }
+            : row,
+        ),
+      );
+    },
+    // Awaited, so a successful refresh lands before the editor closes.
+    onSettled: () => qc.invalidateQueries({ queryKey: deviceKeys.all }),
+  });
+}
+
+export interface RenameDeviceInput {
+  device: DeviceTarget;
+  /** The new name, or `null` to show the reported name again. */
+  name: string | null;
+}
+
 /** Remove the device's settings and drop it from the registry. */
 export function useForgetDevice() {
   return useDeviceMutation(true);
@@ -83,3 +119,8 @@ export function deviceRecencyGroup(device: UserDevice, now: number): DeviceRecen
   if (Number.isNaN(seen)) return "earlier";
   return now - seen < 7 * 24 * 60 * 60 * 1000 ? "week" : "earlier";
 }
+
+/** What to call a device: the name its profile gave it, else the one it reports. */
+export function deviceDisplayName(device: Pick<UserDevice, "custom_name" | "device_name">): string {
+  return device.custom_name || device.device_name || "Unknown device";
+}
diff --git a/web/src/hooks/queries/devices.v2.test.ts b/web/src/hooks/queries/devices.v2.test.ts
index 93809bcb15..4f77a6e300 100644
--- a/web/src/hooks/queries/devices.v2.test.ts
+++ b/web/src/hooks/queries/devices.v2.test.ts
@@ -3,7 +3,7 @@ import { renderHook, waitFor, act } from "@testing-library/react";
 import { createElement, type ReactNode } from "react";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
-import { useMyDevices, useForgetDevice, useClearDeviceSettings } from "./devices";
+import { useMyDevices, useForgetDevice, useClearDeviceSettings, useRenameDevice } from "./devices";
 import { deviceKeys, settingsKeys } from "./keys";
 
 const request = vi.hoisted(() => vi.fn());
@@ -66,4 +66,49 @@ describe("device settings v2", () => {
       expect(invalidate).toHaveBeenCalledWith({ queryKey: [...settingsKeys.all, "values"] });
     },
   );
+  it.each([
+    ["Den", "Den"],
+    [null, null],
+  ])("sends the name %s for the selected profile's device", async (name, sent) => {
+    const { client, wrapper } = setup();
+    const invalidate = vi.spyOn(client, "invalidateQueries");
+    request.mockResolvedValueOnce({
+      ...device,
+      profile_id: "sibling",
+      custom_name: sent ?? undefined,
+    });
+    const { result } = renderHook(() => useRenameDevice(), { wrapper });
+    await act(async () => {
+      await result.current.mutateAsync({
+        device: { deviceId: "tv/shared", profileId: "sibling" },
+        name,
+      });
+    });
+    expect(request).toHaveBeenCalledWith("PATCH /api/v2/devices/{device_id}", {
+      path: { device_id: "tv/shared" },
+      query: { profile_id: "sibling" },
+      body: { custom_name: sent },
+    });
+    expect(invalidate).toHaveBeenCalledWith({ queryKey: deviceKeys.all });
+  });
+  it("keeps the saved name on screen when the refresh after it fails", async () => {
+    const { client, wrapper } = setup();
+    const own = { ...device, device_id: "tv" };
+    const sibling = { ...device, device_id: "tv", profile_id: "sibling" };
+    client.setQueryData(deviceKeys.list("household"), [own, sibling]);
+    request
+      .mockResolvedValueOnce({ ...own, custom_name: "Living Room" })
+      .mockRejectedValue(new Error("offline"));
+    const { result } = renderHook(() => useRenameDevice(), { wrapper });
+    await act(async () => {
+      await result.current.mutateAsync({
+        device: { deviceId: "tv" },
+        name: "  Living   Room ",
+      });
+    });
+    expect(client.getQueryData(deviceKeys.list("household"))).toEqual([
+      { ...own, custom_name: "Living Room" },
+      sibling,
+    ]);
+  });
 });
diff --git a/web/src/hooks/queries/favorites.ts b/web/src/hooks/queries/favorites.ts
index 2f3c43852c..5f6d00b97b 100644
--- a/web/src/hooks/queries/favorites.ts
+++ b/web/src/hooks/queries/favorites.ts
@@ -59,6 +59,7 @@ export function useToggleFavorite(itemId: string) {
       updateCatalogItemDetail(queryClient, itemId, (detail) => ({
         ...detail,
         user_state: {
+          ...detail.user_state,
           played: detail.user_state?.played ?? detail.user_data?.played ?? false,
           is_favorite: !currentlyFavorite,
           in_watchlist: detail.user_state?.in_watchlist ?? false,
@@ -71,6 +72,7 @@ export function useToggleFavorite(itemId: string) {
       updateCatalogItemDetail(queryClient, itemId, (detail) => ({
         ...detail,
         user_state: {
+          ...detail.user_state,
           played: detail.user_state?.played ?? detail.user_data?.played ?? false,
           is_favorite: currentlyFavorite,
           in_watchlist: detail.user_state?.in_watchlist ?? false,
diff --git a/web/src/hooks/queries/homeRows/useAdminHomeRows.test.tsx b/web/src/hooks/queries/homeRows/useAdminHomeRows.test.tsx
index b8545ed78d..cfbde40697 100644
--- a/web/src/hooks/queries/homeRows/useAdminHomeRows.test.tsx
+++ b/web/src/hooks/queries/homeRows/useAdminHomeRows.test.tsx
@@ -176,15 +176,12 @@ const writes = () =>
 
 describe("useAdminHomeRows", () => {
   it("maps the page's rows in server order", async () => {
-    rows = [
-      row("a", { featured: true }),
-      row("b", { enabled: false, config: { source_provider: "trakt" } }),
-    ];
+    rows = [row("a", { featured: true }), row("b", { enabled: false })];
     const { result } = setup();
     await ready(result);
     expect(result.current.adapter.rows).toEqual([
       expect.objectContaining({ id: "a", title: "Title a", hero: true, shown: true }),
-      expect.objectContaining({ id: "b", shown: false, legacyTrakt: true, own: false }),
+      expect.objectContaining({ id: "b", shown: false, own: false }),
     ]);
     expect(result.current.adapter.pages).toEqual([
       { ref: { kind: "home" }, label: "Home" },
@@ -482,21 +479,17 @@ describe("useAdminHomeRows", () => {
       });
     });
 
-    it("skips rows already in that state and refuses to turn a legacy Trakt row back on", async () => {
-      rows = [
-        row("a", { enabled: false }),
-        row("b", { enabled: true }),
-        row("t", { enabled: false, config: { source_provider: "trakt" } }),
-      ];
+    it("skips rows already in that state", async () => {
+      rows = [row("a", { enabled: false }), row("b", { enabled: true })];
       const { result } = setup();
       await ready(result);
       perRowVersions();
       let outcome!: Awaited<ReturnType<typeof result.current.adapter.setShownMany>>;
       await act(async () => {
-        outcome = await result.current.adapter.setShownMany(["a", "b", "t"], true);
+        outcome = await result.current.adapter.setShownMany(["a", "b"], true);
       });
       expect(outcome.changedIds).toEqual(["a"]);
-      expect(outcome.failures).toEqual([expect.objectContaining({ id: "t", reason: "legacy" })]);
+      expect(outcome.failures).toEqual([]);
       expect(writes().map((call) => call.args.path?.id)).toEqual(["a"]);
     });
 
diff --git a/web/src/hooks/queries/homeRows/useAdminHomeRows.ts b/web/src/hooks/queries/homeRows/useAdminHomeRows.ts
index e028b40ad4..234142e63e 100644
--- a/web/src/hooks/queries/homeRows/useAdminHomeRows.ts
+++ b/web/src/hooks/queries/homeRows/useAdminHomeRows.ts
@@ -38,7 +38,6 @@ import {
   type HomeRowsPageOption,
   type PageRef,
 } from "@/lib/homeRows/types";
-import { isTraktConfig } from "@/lib/sectionTypes";
 
 type AdminSectionList = Awaited<ReturnType<typeof fetchAdminSections>>;
 type QuickField = "shown" | "hero";
@@ -53,8 +52,8 @@ const BATCH_PARALLEL = 4;
 export interface BatchFailure {
   id: string;
   title: string;
-  /** changed: it no longer matches the page; legacy: a Trakt row can't be turned back on. */
-  reason: "changed" | "legacy" | "failed";
+  /** changed: it no longer matches the page. */
+  reason: "changed" | "failed";
   message?: string;
 }
 
@@ -73,7 +72,6 @@ function toHomeRow(section: PageSectionConfig): HomeRow {
     hero: section.featured,
     shown: section.enabled,
     own: false,
-    legacyTrakt: isTraktConfig(section.config),
   };
 }
 
@@ -296,7 +294,6 @@ export function useAdminHomeRows(): AdminHomeRows {
         const writeOne = async (id: string): Promise<BatchFailure["reason"] | null> => {
           const section = onScreen.get(id);
           if (!section) return "changed";
-          if (shown && !section.enabled && isTraktConfig(section.config)) return "legacy";
           // Read even a row that already looks right: another admin may have
           // flipped it since this page loaded.
           const snapshot = await fetchAdminSectionSnapshot(id);
diff --git a/web/src/hooks/queries/homeRows/useProfileHomeRows.test.tsx b/web/src/hooks/queries/homeRows/useProfileHomeRows.test.tsx
index e530b135d3..e9393194bf 100644
--- a/web/src/hooks/queries/homeRows/useProfileHomeRows.test.tsx
+++ b/web/src/hooks/queries/homeRows/useProfileHomeRows.test.tsx
@@ -196,33 +196,6 @@ describe("useProfileHomeRows", () => {
     expect(result.current.sections.map((s) => s.id)).toEqual(["c", "a", "b"]);
   });
 
-  it("sends every merged change, including one to a legacy Trakt row with no saved override", async () => {
-    pages.home!.rows = [
-      entry("a"),
-      entry("trakt", { position: 1, config: { source: "trakt", list: "trending" } }),
-      entry("b", { position: 2 }),
-    ];
-    const { result } = await ready();
-    hold("PUT /api/v2/profile/sections");
-
-    act(() => result.current.setHidden("a", true));
-    // The Trakt row and another row change while the first save is in flight.
-    act(() => result.current.saveSection({ ...result.current.sections[1]!, title: "Trakt" }));
-    act(() => result.current.setHidden("b", true));
-
-    await settle("PUT /api/v2/profile/sections");
-    await settle("PUT /api/v2/profile/sections");
-    await waitFor(() => expect(result.current.pending).toBe(false));
-
-    // The first save stores only the row it changed, so the shown Trakt row
-    // is left out; the merged one names it.
-    expect(puts[0]!.overrides.map((o) => o.section_id)).toEqual(["a"]);
-    expect(puts[1]!.overrides).toContainEqual(
-      expect.objectContaining({ section_id: "trakt", title: "Trakt" }),
-    );
-    expect(hiddenIds(puts[1]!.overrides)).toEqual(["a", "b"]);
-  });
-
   it("does not pin an admin edit that lands between two saves of one burst", async () => {
     const { result } = await ready();
     hold("PUT /api/v2/profile/sections");
@@ -249,23 +222,19 @@ describe("useProfileHomeRows", () => {
   });
 
   it("keeps an older edit when its save fails and a newer save is queued", async () => {
-    pages.home!.rows = [
-      entry("a"),
-      entry("trakt", { position: 1, config: { source: "trakt", list: "trending" } }),
-      entry("b", { position: 2 }),
-    ];
+    pages.home!.rows = [entry("a"), entry("r", { position: 1 }), entry("b", { position: 2 })];
     const { result } = await ready();
     hold("PUT /api/v2/profile/sections");
 
-    // The Trakt row's edit is in flight when the next change is made.
-    act(() => result.current.saveSection({ ...result.current.sections[1]!, title: "Trakt" }));
+    // Row r's edit is in flight when the next change is made.
+    act(() => result.current.saveSection({ ...result.current.sections[1]!, title: "Renamed" }));
     act(() => result.current.setHidden("b", true));
     await settle("PUT /api/v2/profile/sections", v2Problem(500, "internal", "boom"));
     await settle("PUT /api/v2/profile/sections");
     await waitFor(() => expect(result.current.pending).toBe(false));
 
     expect(puts.at(-1)!.overrides).toContainEqual(
-      expect.objectContaining({ section_id: "trakt", title: "Trakt" }),
+      expect.objectContaining({ section_id: "r", title: "Renamed" }),
     );
     expect(hiddenIds(puts.at(-1)!.overrides)).toEqual(["b"]);
   });
@@ -305,27 +274,23 @@ describe("useProfileHomeRows", () => {
   });
 
   it("leaves the last profile's queued rows out of the next profile's save", async () => {
-    pages.home!.rows = [
-      entry("a"),
-      entry("trakt", { position: 1, config: { source: "trakt", list: "trending" } }),
-      entry("b", { position: 2 }),
-    ];
+    pages.home!.rows = [entry("a"), entry("r", { position: 1 }), entry("b", { position: 2 })];
     const { result } = await ready();
     hold("PUT /api/v2/profile/sections");
 
     act(() => result.current.setHidden("a", true));
     await waitFor(() => expect(held.get("PUT /api/v2/profile/sections")).toHaveLength(1));
     // Queued behind the save in flight, then dropped by the profile switch.
-    act(() => result.current.saveSection({ ...result.current.sections[1]!, title: "Trakt" }));
+    act(() => result.current.saveSection({ ...result.current.sections[1]!, title: "Renamed" }));
     setProfileId("child");
-    act(() => result.current.move("b", ["b", "a", "trakt"]));
+    act(() => result.current.move("b", ["b", "a", "r"]));
     await settle("PUT /api/v2/profile/sections");
     await settle("PUT /api/v2/profile/sections");
     await waitFor(() => expect(result.current.pending).toBe(false));
 
     expect(puts.map((put) => put.profileId)).toEqual(["parent", "child"]);
-    // The child never touched the legacy Trakt row, so its save leaves it out.
-    expect(puts[1]!.overrides.map((o) => o.section_id)).not.toContain("trakt");
+    // The parent's queued rename never reaches the child's save.
+    expect(puts[1]!.overrides).not.toContainEqual(expect.objectContaining({ title: "Renamed" }));
   });
 
   it("holds edits after a failed save until the page is read again", async () => {
@@ -353,16 +318,12 @@ describe("useProfileHomeRows", () => {
     expect(hiddenIds(puts[1]!.overrides)).toEqual(["a", "b"]);
   });
 
-  it("keeps a saved edit to a legacy Trakt row when the overrides fail to reload before the next save", async () => {
-    pages.home!.rows = [
-      entry("a"),
-      entry("trakt", { position: 1, config: { source: "trakt", list: "trending" } }),
-      entry("b", { position: 2 }),
-    ];
+  it("keeps a saved edit when the overrides fail to reload before the next save", async () => {
+    pages.home!.rows = [entry("a"), entry("r", { position: 1 }), entry("b", { position: 2 })];
     const { result } = await ready();
     hold("PUT /api/v2/profile/sections");
 
-    act(() => result.current.saveSection({ ...result.current.sections[1]!, title: "Trakt" }));
+    act(() => result.current.saveSection({ ...result.current.sections[1]!, title: "Renamed" }));
     act(() => result.current.setHidden("b", true));
     hold("GET /api/v2/profile/sections");
     await settle("PUT /api/v2/profile/sections");
@@ -371,7 +332,7 @@ describe("useProfileHomeRows", () => {
     await waitFor(() => expect(puts).toHaveLength(2));
 
     expect(puts[1]!.overrides).toContainEqual(
-      expect.objectContaining({ section_id: "trakt", title: "Trakt" }),
+      expect.objectContaining({ section_id: "r", title: "Renamed" }),
     );
     expect(hiddenIds(puts[1]!.overrides)).toEqual(["b"]);
   });
diff --git a/web/src/hooks/queries/homeRows/useProfileHomeRows.ts b/web/src/hooks/queries/homeRows/useProfileHomeRows.ts
index 48db0d0a92..3a48f6625a 100644
--- a/web/src/hooks/queries/homeRows/useProfileHomeRows.ts
+++ b/web/src/hooks/queries/homeRows/useProfileHomeRows.ts
@@ -175,7 +175,6 @@ export function useProfileHomeRows(): ProfileHomeRows {
         )?.overrides,
         baseline: entry.baseline,
         newId: newOverrideId.current,
-        changedSectionIds: entry.changedIds,
       });
       await replaceProfileSectionOverrides({
         scope,
diff --git a/web/src/hooks/queries/homeRows/useProfileHomeRowsAdapter.ts b/web/src/hooks/queries/homeRows/useProfileHomeRowsAdapter.ts
index 09a3e76b58..685a935e4e 100644
--- a/web/src/hooks/queries/homeRows/useProfileHomeRowsAdapter.ts
+++ b/web/src/hooks/queries/homeRows/useProfileHomeRowsAdapter.ts
@@ -22,7 +22,6 @@ import type {
   PageRef,
 } from "@/lib/homeRows/types";
 import { fetchRecipeCatalog, type RecipeCatalogResponse } from "@/lib/recipes";
-import { isTraktConfig } from "@/lib/sectionTypes";
 import { useProfileHomeRows } from "./useProfileHomeRows";
 import { useProfileRowCollections } from "./useRowCollectionOptions";
 
@@ -57,7 +56,6 @@ function toHomeRow(section: SettingsSectionEntry): HomeRow {
     hero: section.featured,
     shown: !section.hidden,
     own: section.is_custom,
-    legacyTrakt: isTraktConfig(section.config),
     renamedFrom: renamed ? section.default_title : undefined,
   };
 }
diff --git a/web/src/hooks/queries/items.ts b/web/src/hooks/queries/items.ts
index e6f48a5729..de9256308e 100644
--- a/web/src/hooks/queries/items.ts
+++ b/web/src/hooks/queries/items.ts
@@ -380,6 +380,7 @@ export function useWatchedStateMutation(item: WatchedMutationItem) {
         ...detail,
         user_data: { ...detail.user_data, played: nextPlayed },
         user_state: {
+          ...detail.user_state,
           played: nextPlayed,
           is_favorite: detail.user_state?.is_favorite ?? false,
           in_watchlist: detail.user_state?.in_watchlist ?? false,
@@ -393,6 +394,7 @@ export function useWatchedStateMutation(item: WatchedMutationItem) {
         ...detail,
         user_data: { ...detail.user_data, played: !nextPlayed },
         user_state: {
+          ...detail.user_state,
           played: !nextPlayed,
           is_favorite: detail.user_state?.is_favorite ?? false,
           in_watchlist: detail.user_state?.in_watchlist ?? false,
diff --git a/web/src/hooks/queries/keys.ts b/web/src/hooks/queries/keys.ts
index 218d0b211d..a0adad1b8d 100644
--- a/web/src/hooks/queries/keys.ts
+++ b/web/src/hooks/queries/keys.ts
@@ -103,6 +103,11 @@ export const favoriteKeys = {
   check: (itemId: string) => ["favorites", "check", itemId] as const,
 };
 
+export const notInterestedKeys = {
+  all: ["notInterested"] as const,
+  list: () => ["notInterested", "list"] as const,
+};
+
 export const watchlistKeys = {
   all: ["watchlist"] as const,
   list: () => ["watchlist", "list"] as const,
@@ -245,6 +250,7 @@ export const settingsKeys = {
 export const notificationKeys = {
   all: ["notifications"] as const,
   list: (status: "all" | "unread" = "all") => ["notifications", "list", status] as const,
+  series: (status: "active" | "inactive") => ["notifications", "series", status] as const,
   unreadCount: () => ["notifications", "unread-count"] as const,
   preferences: () => ["notifications", "preferences"] as const,
   emailPreferences: () => ["notifications", "email-preferences"] as const,
@@ -327,14 +333,9 @@ export const recKeys = {
   forYouMain: () => [...recKeys.all, "for-you", "main"] as const,
   forYouRows: () => [...recKeys.all, "for-you", "rows"] as const,
   similar: (itemId: string) => [...recKeys.all, "similar", itemId] as const,
-  becauseWatched: (itemId: string) => [...recKeys.all, "because-watched", itemId] as const,
-  similarUsers: () => [...recKeys.all, "similar-users"] as const,
   tasteProfile: () => [...recKeys.all, "taste-profile"] as const,
   discover: () => [...recKeys.all, "discover"] as const,
   section: (kind: string, key?: string) => [...recKeys.all, "section", kind, key ?? ""] as const,
-  watchTonight: () => [...recKeys.all, "watch-tonight"] as const,
-  watchTonightCards: (mode: string, genres: string[]) =>
-    [...recKeys.all, "watch-tonight-cards", mode, ...genres.sort()] as const,
   tasteSeedItems: () => [...recKeys.all, "taste-seed", "items"] as const,
 };
 
@@ -352,7 +353,6 @@ export const downloadKeys = {
 
 export const themeKeys = {
   all: ["theme"] as const,
-  adminCss: () => ["theme", "admin-css"] as const,
   branding: () => ["theme", "branding"] as const,
 };
 
@@ -538,10 +538,16 @@ export const adminKeys = {
   pluginCatalog: () => ["admin", "plugins", "catalog"] as const,
   pluginCatalogSettings: () => ["admin", "plugins", "catalogSettings"] as const,
   pluginInstallations: () => ["admin", "plugins", "installations"] as const,
-  unmatchedItems: (search?: string) =>
-    search !== undefined
-      ? (["admin", "libraries", "unmatchedItems", search] as const)
-      : (["admin", "libraries", "unmatchedItems"] as const),
+  unmatchedItems: (search?: string, ignored = false) =>
+    search === undefined
+      ? (["admin", "libraries", "unmatchedItems"] as const)
+      : ([
+          "admin",
+          "libraries",
+          "unmatchedItems",
+          ignored ? "ignored" : "unmatched",
+          search,
+        ] as const),
   itemImages: (id: string) => ["admin", "items", id, "images"] as const,
   buildInfo: () => ["admin", "system", "buildInfo"] as const,
   hwAccel: () => ["admin", "system", "hwAccel"] as const,
diff --git a/web/src/hooks/queries/libraries.ts b/web/src/hooks/queries/libraries.ts
index db669779dd..a9aa34586b 100644
--- a/web/src/hooks/queries/libraries.ts
+++ b/web/src/hooks/queries/libraries.ts
@@ -6,6 +6,7 @@ import {
   isCapturedProfileAuthorityActive,
   isSessionIdentityCurrent,
   StaleApiRequestContextError,
+  type ProfileRequestContextSnapshot,
 } from "@/api/client";
 import { v2 } from "@/api/v2/request";
 import type { UserLibrary } from "@/api/types";
@@ -72,6 +73,28 @@ export function filterVisibleLibraries(libraries: UserLibrary[], disabledLibrary
   return libraries.filter((library) => !disabled.has(library.id));
 }
 
+/**
+ * The libraries a profile may browse, read as profileContext when given and as
+ * the active profile otherwise.
+ */
+export async function listUserLibraries({
+  profileContext,
+  includeHidden = false,
+}: {
+  profileContext?: ProfileRequestContextSnapshot;
+  includeHidden?: boolean;
+} = {}): Promise<UserLibrary[]> {
+  const result = await v2("GET /api/v2/user/libraries", {
+    profileContext,
+    ...(includeHidden ? { query: { include_hidden: true } } : {}),
+  });
+  return result.items.map((library) => {
+    const id = Number(library.id);
+    if (!Number.isSafeInteger(id) || id <= 0) throw new Error("Unsupported library identifier.");
+    return { ...library, id };
+  });
+}
+
 /**
  * The libraries this profile may browse. includeHidden also lists the ones it
  * hid itself (ui.disabled_library_ids), which a profile with a library limit
@@ -102,17 +125,12 @@ export function useAvailableUserLibraries({
     ],
     queryFn: async (): Promise<UserLibrary[]> => {
       requireAuthority();
-      const result = await v2("GET /api/v2/user/libraries", {
+      const libraries = await listUserLibraries({
         profileContext: profileContext ?? undefined,
-        ...(includeHidden ? { query: { include_hidden: true } } : {}),
+        includeHidden,
       });
       requireAuthority();
-      return result.items.map((library) => {
-        const id = Number(library.id);
-        if (!Number.isSafeInteger(id) || id <= 0)
-          throw new Error("Unsupported library identifier.");
-        return { ...library, id };
-      });
+      return libraries;
     },
     staleTime: 5 * 60 * 1000,
   });
diff --git a/web/src/hooks/queries/mediaSurfaceRefresh.test.ts b/web/src/hooks/queries/mediaSurfaceRefresh.test.ts
index 1408318a6d..618660f8cb 100644
--- a/web/src/hooks/queries/mediaSurfaceRefresh.test.ts
+++ b/web/src/hooks/queries/mediaSurfaceRefresh.test.ts
@@ -9,13 +9,17 @@ import {
   mediaSurfaceKeys,
   personKeys,
   progressKeys,
+  ratingKeys,
   recKeys,
   sectionKeys,
   watchlistKeys,
 } from "./keys";
 import {
   cancelItemDetailQueries,
+  dropInactiveWatchDetail,
+  getQueryKeyItemId,
   invalidateMediaSurfaceQueries,
+  relatedItemIds,
   removeItemFromHomeSectionCaches,
   scheduleMediaSurfaceInvalidation,
 } from "./mediaSurfaceRefresh";
@@ -405,4 +409,349 @@ describe("invalidateMediaSurfaceQueries", () => {
       },
     });
   });
+
+  it("does not invalidate detail queries for a different item ID when itemId is specified", async () => {
+    const queryClient = new QueryClient();
+    const item1DetailKey = itemKeys.detail("item-1");
+    const item2DetailKey = itemKeys.detail("item-2");
+    const item1WatchKey = itemKeys.watchDetail("item-1");
+    const item2WatchKey = itemKeys.watchDetail("item-2");
+
+    queryClient.setQueryData(item1DetailKey, { content_id: "item-1" });
+    queryClient.setQueryData(item2DetailKey, { content_id: "item-2" });
+    queryClient.setQueryData(item1WatchKey, { content_id: "item-1" });
+    queryClient.setQueryData(item2WatchKey, { content_id: "item-2" });
+    // Catalog keys pass activeCatalogQueryMatchesLibrary, so only the itemId
+    // gate narrows them; this is the shape catalog.item.changed drives (#796).
+    const item1CatalogKey = catalogKeys.itemDetail("item-1");
+    const item2CatalogKey = catalogKeys.itemDetail("item-2");
+    queryClient.setQueryData(item1CatalogKey, { content_id: "item-1" });
+    queryClient.setQueryData(item2CatalogKey, { content_id: "item-2" });
+
+    await invalidateMediaSurfaceQueries(queryClient, { itemId: "item-1" });
+
+    expect(queryClient.getQueryState(item1DetailKey)?.isInvalidated).toBe(true);
+    expect(queryClient.getQueryState(item1WatchKey)?.isInvalidated).toBe(true);
+    expect(queryClient.getQueryState(item2DetailKey)?.isInvalidated).toBe(false);
+    expect(queryClient.getQueryState(item2WatchKey)?.isInvalidated).toBe(false);
+    expect(queryClient.getQueryState(item1CatalogKey)?.isInvalidated).toBe(true);
+    expect(queryClient.getQueryState(item2CatalogKey)?.isInvalidated).toBe(false);
+  });
+
+  it("does not read the ratings list key as an item ID", () => {
+    // ["ratings", "list"] shares the ["ratings", id] shape; an item-scoped
+    // refresh must not treat it as another item's query.
+    expect(getQueryKeyItemId(ratingKeys.list())).toBeUndefined();
+    expect(getQueryKeyItemId(ratingKeys.item("item-2"))).toBe("item-2");
+  });
+
+  it("refreshes an episode's season and series queries for its event", async () => {
+    const queryClient = new QueryClient();
+    const seasonEpisodesKey = catalogKeys.itemEpisodes("season-1");
+    const seasonsKey = catalogKeys.seriesSeasons("series-1");
+    const seriesDetailKey = catalogKeys.itemDetail("series-1", 7);
+    const episodeDetailKey = catalogKeys.itemDetail("episode-1");
+    const otherDetailKey = catalogKeys.itemDetail("item-2");
+    queryClient.setQueryData(seasonEpisodesKey, {
+      episodes: [{ content_id: "episode-1" }, { content_id: "episode-2" }],
+    });
+    queryClient.setQueryData(seasonsKey, { seasons: [{ content_id: "season-1" }] });
+    queryClient.setQueryData(seriesDetailKey, { content_id: "series-1" });
+    queryClient.setQueryData(episodeDetailKey, { content_id: "episode-1" });
+    queryClient.setQueryData(otherDetailKey, { content_id: "item-2" });
+
+    await invalidateMediaSurfaceQueries(queryClient, { itemId: "episode-1" });
+
+    expect(queryClient.getQueryState(seasonEpisodesKey)?.isInvalidated).toBe(true);
+    expect(queryClient.getQueryState(seriesDetailKey)?.isInvalidated).toBe(true);
+    expect(queryClient.getQueryState(episodeDetailKey)?.isInvalidated).toBe(true);
+    expect(queryClient.getQueryState(otherDetailKey)?.isInvalidated).toBe(false);
+  });
+
+  it("finds an episode's series from its cached detail", () => {
+    const queryClient = new QueryClient();
+    queryClient.setQueryData(catalogKeys.itemDetail("episode-1"), {
+      content_id: "episode-1",
+      series_id: "series-1",
+    });
+
+    expect(relatedItemIds(queryClient, "episode-1")).toEqual(new Set(["episode-1", "series-1"]));
+  });
+
+  it("refreshes open episode grids for an item the cache doesn't know yet", async () => {
+    // A scan adds an episode: its event names only the new episode, which no
+    // cached query mentions, so the season grid that should list it refreshes.
+    const queryClient = new QueryClient();
+    const seasonEpisodesKey = catalogKeys.itemEpisodes("season-1");
+    queryClient.setQueryData(seasonEpisodesKey, { episodes: [{ content_id: "episode-1" }] });
+
+    await invalidateMediaSurfaceQueries(queryClient, { itemId: "episode-new", itemMayBeNew: true });
+
+    expect(queryClient.getQueryState(seasonEpisodesKey)?.isInvalidated).toBe(true);
+  });
+
+  it("keeps other items' detail out of an unknown new item's refresh", async () => {
+    // An episode is playing while a scan adds another: its watch detail and
+    // series lists' detail aren't about the new episode.
+    const queryClient = new QueryClient();
+    const playingKey = itemKeys.watchDetail("episode-1");
+    const seasonsKey = catalogKeys.seriesSeasons("series-1");
+    queryClient.setQueryData(playingKey, { content_id: "episode-1" });
+    queryClient.setQueryData(seasonsKey, { seasons: [] });
+
+    await invalidateMediaSurfaceQueries(queryClient, { itemId: "episode-new", itemMayBeNew: true });
+
+    expect(queryClient.getQueryState(playingKey)?.isInvalidated).toBe(false);
+    expect(queryClient.getQueryState(seasonsKey)?.isInvalidated).toBe(true);
+  });
+
+  it("refreshes an open season's detail with its list for a new episode", async () => {
+    // The season's episode count changes with its episode list.
+    const queryClient = new QueryClient();
+    const seasonDetailKey = catalogKeys.itemDetail("season-1");
+    const seasonEpisodesKey = catalogKeys.itemEpisodes("season-1");
+    const otherDetailKey = catalogKeys.itemDetail("movie-1");
+    queryClient.setQueryData(seasonDetailKey, { content_id: "season-1", episode_count: 1 });
+    queryClient.setQueryData(seasonEpisodesKey, { episodes: [{ content_id: "episode-1" }] });
+    queryClient.setQueryData(otherDetailKey, { content_id: "movie-1" });
+
+    await invalidateMediaSurfaceQueries(queryClient, { itemId: "episode-new", itemMayBeNew: true });
+
+    expect(queryClient.getQueryState(seasonDetailKey)?.isInvalidated).toBe(true);
+    expect(queryClient.getQueryState(otherDetailKey)?.isInvalidated).toBe(false);
+  });
+
+  it("links a season detail cached under its series to the season", async () => {
+    const queryClient = new QueryClient();
+    const seasonDetailKey = catalogKeys.seasonDetail("series-1", 1);
+    queryClient.setQueryData(seasonDetailKey, { season: { content_id: "season-1" } });
+
+    await invalidateMediaSurfaceQueries(queryClient, { itemId: "season-1" });
+
+    expect(queryClient.getQueryState(seasonDetailKey)?.isInvalidated).toBe(true);
+  });
+
+  it("follows a cached watch detail to its series", async () => {
+    // Only the player's watch detail knows the episode's series.
+    const queryClient = new QueryClient();
+    queryClient.setQueryData(itemKeys.watchDetail("episode-1"), {
+      content_id: "episode-1",
+      series_id: "series-1",
+    });
+    const seasonsKey = catalogKeys.seriesSeasons("series-1");
+    queryClient.setQueryData(seasonsKey, { seasons: [] });
+
+    await invalidateMediaSurfaceQueries(queryClient, { itemId: "episode-1" });
+
+    expect(queryClient.getQueryState(seasonsKey)?.isInvalidated).toBe(true);
+  });
+
+  it("drops a closed player's watch detail and keeps its link to the series", async () => {
+    // The watch detail is the only link from the episode to its series, and
+    // its cached resume position no longer holds.
+    const queryClient = new QueryClient();
+    const closedKey = itemKeys.watchDetail("episode-1");
+    queryClient.setQueryData(closedKey, { content_id: "episode-1", series_id: "series-1" });
+    const seasonsKey = catalogKeys.seriesSeasons("series-1");
+    queryClient.setQueryData(seasonsKey, { seasons: [] });
+
+    const knownRelatedIds = dropInactiveWatchDetail(queryClient, "episode-1");
+    expect(queryClient.getQueryData(closedKey)).toBeUndefined();
+
+    await invalidateMediaSurfaceQueries(queryClient, { itemId: "episode-1", knownRelatedIds });
+    expect(queryClient.getQueryState(seasonsKey)?.isInvalidated).toBe(true);
+  });
+
+  it("keeps an open player's watch detail", () => {
+    const queryClient = new QueryClient();
+    const openKey = itemKeys.watchDetail("episode-1");
+    queryClient.setQueryData(openKey, { content_id: "episode-1" });
+    const observer = new QueryObserver(queryClient, {
+      queryKey: openKey,
+      queryFn: () => ({ content_id: "episode-1" }),
+      staleTime: Infinity,
+    });
+    const unsubscribe = observer.subscribe(() => undefined);
+
+    expect(dropInactiveWatchDetail(queryClient, "episode-1")).toBeUndefined();
+    expect(queryClient.getQueryData(openKey)).toBeDefined();
+    unsubscribe();
+  });
+
+  it("stays narrowed for a progress event about an uncached item", async () => {
+    // Progress on another client: the item exists, it just isn't open here.
+    const queryClient = new QueryClient();
+    const playingKey = itemKeys.watchDetail("episode-1");
+    const seasonEpisodesKey = catalogKeys.itemEpisodes("season-1");
+    queryClient.setQueryData(playingKey, { content_id: "episode-1" });
+    queryClient.setQueryData(seasonEpisodesKey, { episodes: [{ content_id: "episode-1" }] });
+
+    await invalidateMediaSurfaceQueries(queryClient, { itemId: "episode-elsewhere" });
+
+    expect(queryClient.getQueryState(playingKey)?.isInvalidated).toBe(false);
+    expect(queryClient.getQueryState(seasonEpisodesKey)?.isInvalidated).toBe(false);
+  });
+
+  it("narrows series-keyed queries to the event's series", async () => {
+    const queryClient = new QueryClient();
+    queryClient.setQueryData(catalogKeys.itemDetail("episode-1"), {
+      content_id: "episode-1",
+      series_id: "series-1",
+    });
+    const ownSeasonsKey = catalogKeys.seriesSeasons("series-1");
+    const otherSeasonsKey = catalogKeys.seriesSeasons("series-9");
+    const otherEpisodesKey = catalogKeys.seasonEpisodes("series-9", 1);
+    queryClient.setQueryData(ownSeasonsKey, { seasons: [] });
+    queryClient.setQueryData(otherSeasonsKey, { seasons: [] });
+    queryClient.setQueryData(otherEpisodesKey, { episodes: [] });
+
+    await invalidateMediaSurfaceQueries(queryClient, { itemId: "episode-1" });
+
+    expect(queryClient.getQueryState(ownSeasonsKey)?.isInvalidated).toBe(true);
+    expect(queryClient.getQueryState(otherSeasonsKey)?.isInvalidated).toBe(false);
+    expect(queryClient.getQueryState(otherEpisodesKey)?.isInvalidated).toBe(false);
+  });
+
+  it("refreshes a directly opened season when its series changes", async () => {
+    const queryClient = new QueryClient();
+    // A season page opened by URL caches its detail and episodes, but not the
+    // series' season list.
+    const seasonDetailKey = catalogKeys.itemDetail("season-1");
+    const seasonEpisodesKey = catalogKeys.itemEpisodes("season-1");
+    const otherDetailKey = catalogKeys.itemDetail("season-9");
+    queryClient.setQueryData(seasonDetailKey, { content_id: "season-1", series_id: "series-1" });
+    queryClient.setQueryData(seasonEpisodesKey, { episodes: [{ content_id: "episode-1" }] });
+    queryClient.setQueryData(otherDetailKey, { content_id: "season-9", series_id: "series-9" });
+
+    await invalidateMediaSurfaceQueries(queryClient, { itemId: "series-1" });
+
+    expect(queryClient.getQueryState(seasonDetailKey)?.isInvalidated).toBe(true);
+    expect(queryClient.getQueryState(seasonEpisodesKey)?.isInvalidated).toBe(true);
+    expect(queryClient.getQueryState(otherDetailKey)?.isInvalidated).toBe(false);
+  });
+
+  it("refreshes a marked season's cached episode details", async () => {
+    const queryClient = new QueryClient();
+    queryClient.setQueryData(catalogKeys.itemEpisodes("season-1"), {
+      episodes: [{ content_id: "episode-1" }],
+    });
+    const episodeDetailKey = catalogKeys.itemDetail("episode-1");
+    const episodeWatchKey = itemKeys.watchDetail("episode-1");
+    const otherWatchKey = itemKeys.watchDetail("item-2");
+    queryClient.setQueryData(episodeDetailKey, { content_id: "episode-1" });
+    queryClient.setQueryData(episodeWatchKey, { content_id: "episode-1" });
+    queryClient.setQueryData(otherWatchKey, { content_id: "item-2" });
+
+    await invalidateMediaSurfaceQueries(queryClient, { itemId: "season-1" });
+
+    expect(queryClient.getQueryState(episodeDetailKey)?.isInvalidated).toBe(true);
+    expect(queryClient.getQueryState(episodeWatchKey)?.isInvalidated).toBe(true);
+    expect(queryClient.getQueryState(otherWatchKey)?.isInvalidated).toBe(false);
+  });
+
+  it("refreshes episode details when a series-keyed season is marked watched", async () => {
+    const queryClient = new QueryClient();
+    queryClient.setQueryData(catalogKeys.seasonDetail("series-1", 1), {
+      season: { content_id: "season-1", season_number: 1 },
+    });
+    queryClient.setQueryData(catalogKeys.seasonEpisodes("series-1", 1), {
+      episodes: [{ content_id: "episode-1" }],
+    });
+    const episodeDetailKey = catalogKeys.itemDetail("episode-1");
+    const episodeWatchKey = itemKeys.watchDetail("episode-1");
+    const otherWatchKey = itemKeys.watchDetail("episode-2");
+    queryClient.setQueryData(episodeDetailKey, { content_id: "episode-1" });
+    queryClient.setQueryData(episodeWatchKey, { content_id: "episode-1" });
+    queryClient.setQueryData(otherWatchKey, { content_id: "episode-2" });
+
+    await invalidateMediaSurfaceQueries(queryClient, { itemId: "season-1" });
+
+    expect(queryClient.getQueryState(episodeDetailKey)?.isInvalidated).toBe(true);
+    expect(queryClient.getQueryState(episodeWatchKey)?.isInvalidated).toBe(true);
+    expect(queryClient.getQueryState(otherWatchKey)?.isInvalidated).toBe(false);
+  });
+
+  it("finds a numbered season's episode children from its cached season list", () => {
+    const queryClient = new QueryClient();
+    queryClient.setQueryData(catalogKeys.seasonEpisodes("series-1", 0), {
+      episodes: [{ content_id: "special-1" }],
+    });
+    // The season list may enter the cache after the episode list.
+    queryClient.setQueryData(catalogKeys.seriesSeasons("series-1"), {
+      seasons: [{ content_id: "specials", season_number: 0 }],
+    });
+
+    expect(relatedItemIds(queryClient, "specials")).toEqual(
+      new Set(["specials", "series-1", "special-1"]),
+    );
+  });
+
+  it("finds an episode's season even when the cached episode list omits it", async () => {
+    const queryClient = new QueryClient();
+    const seasonDetailKey = catalogKeys.itemDetail("season-1");
+    const seasonEpisodesKey = catalogKeys.itemEpisodes("season-1");
+    queryClient.setQueryData(seasonDetailKey, {
+      content_id: "season-1",
+      type: "season",
+      series_id: "series-1",
+      season_number: 1,
+    });
+    queryClient.setQueryData(seasonEpisodesKey, { episodes: [] });
+    queryClient.setQueryData(itemKeys.watchDetail("episode-1"), {
+      content_id: "episode-1",
+      type: "episode",
+      series_id: "series-1",
+      season_number: 1,
+    });
+
+    await invalidateMediaSurfaceQueries(queryClient, { itemId: "episode-1" });
+
+    expect(queryClient.getQueryState(seasonDetailKey)?.isInvalidated).toBe(true);
+    expect(queryClient.getQueryState(seasonEpisodesKey)?.isInvalidated).toBe(true);
+  });
+
+  it("refreshes new-item lists even when an item detail query has no data", async () => {
+    const queryClient = new QueryClient();
+    const seasonEpisodesKey = catalogKeys.itemEpisodes("season-1");
+    queryClient.setQueryData(seasonEpisodesKey, { episodes: [{ content_id: "episode-1" }] });
+    queryClient.getQueryCache().build(queryClient, {
+      queryKey: catalogKeys.itemDetail("episode-new"),
+    });
+
+    await invalidateMediaSurfaceQueries(queryClient, { itemId: "episode-new", itemMayBeNew: true });
+
+    expect(queryClient.getQueryState(seasonEpisodesKey)?.isInvalidated).toBe(true);
+  });
+
+  it("matches a watched item key in any library", async () => {
+    const queryClient = new QueryClient();
+    const libraryDetailKey = catalogKeys.itemDetail("series-1", 7);
+    const otherDetailKey = catalogKeys.itemDetail("item-2", 7);
+    queryClient.setQueryData(libraryDetailKey, { content_id: "series-1" });
+    queryClient.setQueryData(otherDetailKey, { content_id: "item-2" });
+
+    await invalidateMediaSurfaceQueries(queryClient, {
+      itemId: "episode-1",
+      watchedKeys: [catalogKeys.itemDetail("series-1")],
+    });
+
+    expect(queryClient.getQueryState(libraryDetailKey)?.isInvalidated).toBe(true);
+    expect(queryClient.getQueryState(otherDetailKey)?.isInvalidated).toBe(false);
+  });
+
+  it("still invalidates explicitly watched keys that belong to another item", async () => {
+    const queryClient = new QueryClient();
+    const seriesDetailKey = itemKeys.detail("series-1");
+    const otherDetailKey = itemKeys.detail("item-2");
+    queryClient.setQueryData(seriesDetailKey, { content_id: "series-1" });
+    queryClient.setQueryData(otherDetailKey, { content_id: "item-2" });
+
+    await invalidateMediaSurfaceQueries(queryClient, {
+      itemId: "episode-1",
+      watchedKeys: [seriesDetailKey],
+    });
+
+    expect(queryClient.getQueryState(seriesDetailKey)?.isInvalidated).toBe(true);
+    expect(queryClient.getQueryState(otherDetailKey)?.isInvalidated).toBe(false);
+  });
 });
diff --git a/web/src/hooks/queries/mediaSurfaceRefresh.ts b/web/src/hooks/queries/mediaSurfaceRefresh.ts
index 2e674f1fdc..a5a8559e32 100644
--- a/web/src/hooks/queries/mediaSurfaceRefresh.ts
+++ b/web/src/hooks/queries/mediaSurfaceRefresh.ts
@@ -1,8 +1,16 @@
 import type { Query, QueryClient } from "@tanstack/react-query";
-import type { HomeSectionItemsResponse, ItemDetail } from "@/api/types";
+import type {
+  HomeSectionItemsResponse,
+  ItemDetail,
+  SeasonDetailResponse,
+  SeasonsResponse,
+} from "@/api/types";
 import {
   adminKeys,
+  calendarKeys,
   catalogKeys,
+  collectionKeys,
+  episodeKeys,
   favoriteKeys,
   historyKeys,
   itemKeys,
@@ -11,6 +19,7 @@ import {
   progressKeys,
   recKeys,
   sectionKeys,
+  shuffleKeys,
   watchlistKeys,
 } from "./keys";
 import {
@@ -30,6 +39,19 @@ interface InvalidateMediaSurfaceOptions {
    */
   skipItemQueries?: boolean;
   skipSimilarItems?: boolean;
+  // Items already found related to itemId, such as through a watch detail
+  // dropped since (dropInactiveWatchDetail), which was the only link from an
+  // episode to its series.
+  knownRelatedIds?: ReadonlySet<string>;
+  // The item may be one this client has never seen, such as an episode a
+  // scan just added. Only catalog events can say so; progress, favorite and
+  // watchlist events are about items that already exist.
+  itemMayBeNew?: boolean;
+  // Set internally for such an item when nothing in the cache names it,
+  // with the items owning the cached lists, whose detail (a season's
+  // episode count) changes with them.
+  refreshItemKeyedLists?: boolean;
+  listOwnerIds?: ReadonlySet<string>;
 }
 
 const MEDIA_SURFACE_REFRESH_DELAY_MS = 600;
@@ -81,10 +103,27 @@ export function cancelItemDetailQueries(queryClient: QueryClient, itemId: string
   });
 }
 
+// dropInactiveWatchDetail drops a closed player's cached watch detail for an
+// item whose resume position changed, at once: the player starts from that
+// detail's position while it refetches. The detail may be the only link from
+// an episode to its series, so the items it led to are returned for the
+// media surface refresh (knownRelatedIds). An open player's query is active
+// and keeps its data. Undefined when there was nothing to drop.
+export function dropInactiveWatchDetail(
+  queryClient: QueryClient,
+  itemId: string,
+): ReadonlySet<string> | undefined {
+  const filters = { queryKey: [...itemKeys.all, "watchDetail", itemId], type: "inactive" } as const;
+  if (queryClient.getQueryCache().findAll(filters).length === 0) return undefined;
+  const related = relatedItemIds(queryClient, itemId);
+  queryClient.removeQueries(filters);
+  return related;
+}
+
 export function removeItemFromHomeSectionCaches(
   queryClient: QueryClient,
   itemId: string,
-  sectionType?: string,
+  sectionType?: string | ReadonlySet<string>,
 ) {
   queryClient.setQueriesData<HomeSectionItemsResponse>(
     {
@@ -98,7 +137,11 @@ export function removeItemFromHomeSectionCaches(
       if (!current?.section) {
         return current;
       }
-      if (sectionType && current.section.section_type !== sectionType) {
+      if (
+        typeof sectionType === "string"
+          ? current.section.section_type !== sectionType
+          : sectionType && !sectionType.has(current.section.section_type)
+      ) {
         return current;
       }
       const nextItems = current.section.items.filter((item) => item.content_id !== itemId);
@@ -120,6 +163,10 @@ export function removeItemFromHomeSectionCaches(
   );
 }
 
+function isWatchDetailQueryKey(queryKey: readonly unknown[]) {
+  return queryKey[0] === "items" && queryKey[1] === "watchDetail";
+}
+
 export function isItemDetailQueryKey(queryKey: unknown, itemId: string) {
   return (
     Array.isArray(queryKey) &&
@@ -150,9 +197,169 @@ function queryKeyStartsWith(queryKey: readonly unknown[], prefix: readonly unkno
   );
 }
 
+// Only these shapes are narrowed by itemId. episodeKeys.byItem is left out on
+// purpose: it is invalidated only through watchedKeys, and mapping it here
+// would change which episode lists a refresh touches.
+export function getQueryKeyItemId(queryKey: readonly unknown[]): string | undefined {
+  if (!Array.isArray(queryKey) || queryKey.length < 2) return undefined;
+  if (
+    queryKey[0] === "items" &&
+    (queryKey[1] === "detail" || queryKey[1] === "watchDetail" || queryKey[1] === "markers") &&
+    typeof queryKey[2] === "string"
+  ) {
+    return queryKey[2];
+  }
+  // A series' season list, season detail and episodes are keyed by series.
+  if (
+    queryKey[0] === "catalog" &&
+    (queryKey[1] === "items" || queryKey[1] === "series") &&
+    typeof queryKey[2] === "string"
+  ) {
+    return queryKey[2];
+  }
+  // ratingKeys.list() shares the ["ratings", x] shape; "list" is not an item ID.
+  if (queryKey[0] === "ratings" && typeof queryKey[1] === "string" && queryKey[1] !== "list") {
+    return queryKey[1];
+  }
+  return undefined;
+}
+
+// The item whose episodes or seasons a cached list query holds: an episode
+// list belongs to its season (or series), a season list to its series.
+function listOwnerId(queryKey: readonly unknown[]): string | undefined {
+  if (queryKey[0] === "catalog" && queryKey[1] === "series" && typeof queryKey[2] === "string") {
+    return queryKey[2];
+  }
+  return getQueryKeyItemId(queryKey);
+}
+
+function listedChildIds(data: unknown): string[] {
+  if (typeof data !== "object" || data === null) return [];
+  const ids: string[] = [];
+  for (const field of ["episodes", "seasons"] as const) {
+    const list = (data as Record<string, unknown>)[field];
+    if (!Array.isArray(list)) continue;
+    for (const entry of list) {
+      const id = (entry as { content_id?: unknown } | null)?.content_id;
+      if (typeof id === "string") ids.push(id);
+    }
+  }
+  return ids;
+}
+
+// relatedItemIds is itemId plus the items whose cached state derives from it,
+// as far as the cache shows: its parents (the series named by its detail, and
+// the season or series whose cached list holds it, and theirs) and its
+// children (the episodes or seasons its own cached lists hold, the cached
+// details that name it as their series, and theirs).
+// Realtime events and watched marks name only the item itself, so narrowing
+// to that one ID would leave an open season grid, series watched totals or a
+// marked season's episodes stale.
+export function relatedItemIds(queryClient: QueryClient, itemId: string): Set<string> {
+  // Index season identities before the links, then walk them, so a
+  // series with many cached seasons and episodes costs two cache scans,
+  // not one per item.
+  const childrenOf = new Map<string, string[]>();
+  const parentsOf = new Map<string, string[]>();
+  const queries = queryClient.getQueryCache().getAll();
+  const seasonIds = new Map<string, Map<number, string>>();
+  const rememberSeason = (
+    seriesId: string,
+    season: Pick<ItemDetail, "content_id" | "season_number"> | undefined,
+  ) => {
+    if (!season?.content_id || season.season_number == null) return;
+    let seasons = seasonIds.get(seriesId);
+    if (!seasons) {
+      seasons = new Map();
+      seasonIds.set(seriesId, seasons);
+    }
+    seasons.set(season.season_number, season.content_id);
+  };
+  for (const query of queries) {
+    const owner = listOwnerId(query.queryKey);
+    if (!owner) continue;
+    if (query.queryKey[0] === "catalog" && query.queryKey[1] === "series") {
+      for (const season of (query.state.data as SeasonsResponse | undefined)?.seasons ?? []) {
+        rememberSeason(owner, season);
+      }
+      rememberSeason(owner, (query.state.data as SeasonDetailResponse | undefined)?.season);
+    }
+    if (isItemDetailQueryKey(query.queryKey, owner)) {
+      const detail = query.state.data as ItemDetail | undefined;
+      if (detail?.type === "season" && detail.series_id) {
+        rememberSeason(detail.series_id, detail);
+      }
+    }
+  }
+  const add = (edges: Map<string, string[]>, from: string, to: string) => {
+    const list = edges.get(from);
+    if (list) list.push(to);
+    else edges.set(from, [to]);
+  };
+  const link = (parent: string, child: string) => {
+    if (parent === child) return;
+    add(childrenOf, parent, child);
+    add(parentsOf, child, parent);
+  };
+  for (const query of queries) {
+    const owner = listOwnerId(query.queryKey);
+    if (!owner) continue;
+    // Numbered season episode keys name the series, while their members
+    // belong to the season whose identity the first pass found.
+    const numberedSeason =
+      query.queryKey[0] === "catalog" &&
+      query.queryKey[1] === "series" &&
+      query.queryKey[5] === "episodes" &&
+      typeof query.queryKey[4] === "number"
+        ? seasonIds.get(owner)?.get(query.queryKey[4])
+        : undefined;
+    if (numberedSeason) link(owner, numberedSeason);
+    for (const child of listedChildIds(query.state.data)) link(numberedSeason ?? owner, child);
+    // A season's detail is cached under its series, so its own ID is only
+    // in the data.
+    const seasonId = (query.state.data as { season?: { content_id?: unknown } } | undefined)?.season
+      ?.content_id;
+    if (typeof seasonId === "string") link(owner, seasonId);
+    if (isItemDetailQueryKey(query.queryKey, owner) || isWatchDetailQueryKey(query.queryKey)) {
+      const detail = query.state.data as ItemDetail | undefined;
+      const seriesId = detail?.series_id;
+      // A detail names its series, and derives its series title, backdrop
+      // and credits from it. A season page opened directly has no cached
+      // season list, so this edge is how a series change reaches it. A
+      // playing episode's watch detail names it too, so its progress
+      // reaches the series' watched summary.
+      if (seriesId) {
+        link(seriesId, owner);
+        const seasonId =
+          detail.season_number == null
+            ? undefined
+            : seasonIds.get(seriesId)?.get(detail.season_number);
+        if (seasonId) link(seasonId, owner);
+      }
+    }
+  }
+
+  const related = new Set([itemId]);
+  const walk = (edges: Map<string, string[]>) => {
+    const pending = [itemId];
+    while (pending.length > 0) {
+      for (const next of edges.get(pending.pop() as string) ?? []) {
+        if (!related.has(next)) {
+          related.add(next);
+          pending.push(next);
+        }
+      }
+    }
+  };
+  walk(parentsOf);
+  walk(childrenOf);
+  return related;
+}
+
 function shouldInvalidateMediaSurfaceQuery(
   queryKey: readonly unknown[],
   options: InvalidateMediaSurfaceOptions,
+  relatedIds?: ReadonlySet<string>,
 ) {
   if (options.skipItemDetail && options.itemId && isItemDetailQueryKey(queryKey, options.itemId)) {
     return false;
@@ -161,6 +368,26 @@ function shouldInvalidateMediaSurfaceQuery(
     return false;
   }
 
+  if (options.itemId) {
+    const targetItemId = getQueryKeyItemId(queryKey);
+    // Keys for related items (see relatedItemIds) or named in watchedKeys (a
+    // watched episode's season or series, say) belong to other item IDs by
+    // design; don't narrow them away.
+    if (
+      targetItemId &&
+      targetItemId !== options.itemId &&
+      !relatedIds?.has(targetItemId) &&
+      !isWatchedKey(queryKey, options) &&
+      !(
+        options.refreshItemKeyedLists &&
+        (isItemKeyedListQuery(queryKey) ||
+          (options.listOwnerIds?.has(targetItemId) && isItemDetailQueryKey(queryKey, targetItemId)))
+      )
+    ) {
+      return false;
+    }
+  }
+
   if (queryKeyStartsWith(queryKey, catalogKeys.all)) {
     return activeCatalogQueryMatchesLibrary(queryKey, options.libraryId);
   }
@@ -178,7 +405,31 @@ function shouldInvalidateMediaSurfaceQuery(
     return true;
   }
 
-  return (options.watchedKeys ?? []).some((key) => queryKeyStartsWith(queryKey, key));
+  return isWatchedKey(queryKey, options);
+}
+
+// isItemKeyedListQuery reports a list of a series' or season's children, keyed
+// by the parent: a season list, a season's detail and episodes, or an item's
+// episodes. A new child can't be traced to its parent's lists from the cache.
+function isItemKeyedListQuery(queryKey: readonly unknown[]): boolean {
+  return queryKey[0] === "catalog" && (queryKey[1] === "series" || queryKey[3] === "episodes");
+}
+
+// isWatchedKey is a prefix match on purpose: everything under a watched key
+// (a watched season's or episode's detail variants) changes with it, so it is
+// exempt from the itemId narrowing too. Don't tighten it to an exact match.
+// An item key also matches a watched key for the same item in any library:
+// watched keys carry the "default" library segment, while an item opened
+// through its library caches under that library's ID.
+function isWatchedKey(queryKey: readonly unknown[], options: InvalidateMediaSurfaceOptions) {
+  const targetItemId = getQueryKeyItemId(queryKey);
+  return (options.watchedKeys ?? []).some(
+    (key) =>
+      queryKeyStartsWith(queryKey, key) ||
+      (targetItemId !== undefined &&
+        getQueryKeyItemId(key) === targetItemId &&
+        queryKeyStartsWith(queryKey, key.slice(0, 2))),
+  );
 }
 
 export async function invalidateMediaSurfaceQueries(
@@ -189,13 +440,93 @@ export async function invalidateMediaSurfaceQueries(
   // `cancelRefetch: false` — reusing an in-flight request would let a response
   // that predates the mutation satisfy the invalidation and land in the cache
   // as fresh.
-  const matches = (query: Query) => shouldInvalidateMediaSurfaceQuery(query.queryKey, options);
+  const relatedIds = options.itemId ? relatedItemIds(queryClient, options.itemId) : undefined;
+  options.knownRelatedIds?.forEach((id) => relatedIds?.add(id));
+  // A new item nothing in the cache knows about, such as an episode a scan
+  // just added, can't be traced to the season or series lists that should now
+  // show it, so its event refreshes every such list. Other items' detail
+  // stays narrowed away. A caller that names the keys it changed
+  // (watchedKeys) has scoped it already.
+  const scoped =
+    options.itemMayBeNew &&
+    options.itemId &&
+    !options.watchedKeys?.length &&
+    relatedIds?.size === 1 &&
+    !cacheHasItemDetail(queryClient, options.itemId)
+      ? { ...options, refreshItemKeyedLists: true, listOwnerIds: itemKeyedListOwners(queryClient) }
+      : options;
+  const matches = (query: Query) =>
+    shouldInvalidateMediaSurfaceQuery(query.queryKey, scoped, relatedIds);
   const runningLetterIndexes = refetchLetterIndexesWhenDone(queryClient, matches);
   await queryClient.invalidateQueries({
     predicate: (query) => matches(query) && !runningLetterIndexes.has(query),
   });
 }
 
+// itemKeyedListOwners is the items whose children a cached list holds.
+function itemKeyedListOwners(queryClient: QueryClient): Set<string> {
+  const owners = new Set<string>();
+  for (const query of queryClient.getQueryCache().getAll()) {
+    const owner = isItemKeyedListQuery(query.queryKey) ? listOwnerId(query.queryKey) : undefined;
+    if (owner) owners.add(owner);
+  }
+  return owners;
+}
+
+// A pending query or a markers-only read does not establish item ancestry.
+function cacheHasItemDetail(queryClient: QueryClient, itemId: string): boolean {
+  return queryClient
+    .getQueryCache()
+    .getAll()
+    .some(
+      (query) =>
+        getQueryKeyItemId(query.queryKey) === itemId &&
+        (isItemDetailQueryKey(query.queryKey, itemId) || isWatchDetailQueryKey(query.queryKey)) &&
+        query.state.data != null,
+    );
+}
+
+// Reads that carry localized titles and descriptions beyond the media surfaces:
+// the families a viewer access change refetches, shuffle cards, collection
+// peeks, the Home-row editor's peeks, previews and curated-title search, and
+// the Watch Together picker's rows and catalog searches (pickerKeys in the
+// picker's usePickerData; its room presence and member state are not localized).
+const LOCALIZED_READ_PREFIXES = [
+  collectionKeys.all,
+  episodeKeys.all,
+  calendarKeys.all,
+  shuffleKeys.all,
+  ["collection-peek"],
+  ["home-row-peek"],
+  ["home-row-preview"],
+  ["curatedListPicker"],
+  ["watch-party", "picker"],
+  ["watch-party", "search"],
+  ["watch-party", "recently-added"],
+];
+
+function isLocalizedMediaQuery(query: Query) {
+  return (
+    shouldInvalidateMediaSurfaceQuery(query.queryKey, {}) ||
+    LOCALIZED_READ_PREFIXES.some((prefix) => queryKeyStartsWith(query.queryKey, prefix))
+  );
+}
+
+/**
+ * Refreshes the localized media reads after the viewer's metadata language
+ * changes. A request still in flight would answer in the old language and land
+ * as fresh: TanStack reuses a running request that has no data yet instead of
+ * restarting it, and an observer-less one (Home rows, prefetches) is never
+ * refetched. So those requests are cancelled before the reads are invalidated.
+ * Resolves once the reads are marked stale; mounted screens refetch on their
+ * own, and Home's load queue restarts right away.
+ */
+export async function refreshLocalizedMediaQueries(queryClient: QueryClient) {
+  await queryClient.cancelQueries({ predicate: isLocalizedMediaQuery });
+  void queryClient.invalidateQueries({ predicate: isLocalizedMediaQuery });
+  bumpHomeRefreshSignal(queryClient);
+}
+
 // A letter index sorts the whole result, which on a large library can outlast
 // a scan's invalidation window, so cancelling and restarting it on every sweep
 // would keep it from ever finishing. A running read finishes instead, and one
@@ -249,6 +580,13 @@ export function scheduleMediaSurfaceInvalidation(
     skipSimilarItems: existing
       ? Boolean(existing.options.skipSimilarItems && options.skipSimilarItems)
       : options.skipSimilarItems,
+    knownRelatedIds:
+      existing?.options.knownRelatedIds || options.knownRelatedIds
+        ? new Set([
+            ...(existing?.options.knownRelatedIds ?? []),
+            ...(options.knownRelatedIds ?? []),
+          ])
+        : undefined,
     watchedKeys: [...(existing?.options.watchedKeys ?? []), ...(options.watchedKeys ?? [])],
   };
   const now = Date.now();
diff --git a/web/src/hooks/queries/notInterested.test.tsx b/web/src/hooks/queries/notInterested.test.tsx
new file mode 100644
index 0000000000..76dc56351a
--- /dev/null
+++ b/web/src/hooks/queries/notInterested.test.tsx
@@ -0,0 +1,200 @@
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { act, cleanup, renderHook, waitFor } from "@testing-library/react";
+import type { ReactNode } from "react";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import type { HomeSectionItemsResponse } from "@/api/types";
+import { sectionKeys } from "./keys";
+
+const mocks = vi.hoisted(() => ({
+  activeProfile: "p-owner",
+  fetchWithSession: vi.fn(),
+  toastError: vi.fn(),
+  toastSuccess: vi.fn(),
+}));
+
+vi.mock("@/api/client", () => ({
+  fetchWithSession: (...args: unknown[]) => mocks.fetchWithSession(...args),
+  reportProfileUnverified: vi.fn(),
+  captureProfileRequestContext: () => ({
+    accessToken: "token",
+    authContextVersion: 1,
+    serverOrigin: "",
+    profileId: mocks.activeProfile,
+    profileToken: null,
+  }),
+  isProfileRequestContextCurrent: () => true,
+  isCapturedProfileAuthorityActive: (snapshot: { profileId: string }) =>
+    snapshot.profileId === mocks.activeProfile,
+}));
+
+vi.mock("sonner", () => ({
+  toast: {
+    error: (...args: unknown[]) => mocks.toastError(...args),
+    success: (...args: unknown[]) => mocks.toastSuccess(...args),
+  },
+}));
+
+import { canMarkNotInterested, useToggleNotInterested } from "./notInterested";
+
+function noContent() {
+  return {
+    res: new Response(null, { status: 204 }),
+    requestProfileId: "p-owner",
+    requestProfileToken: null,
+  };
+}
+
+function homeRow(sectionType: string): HomeSectionItemsResponse {
+  return {
+    section: {
+      id: sectionType,
+      section_type: sectionType,
+      total_count: 2,
+      items: [{ content_id: "movie:heat" }, { content_id: "movie:other" }],
+    },
+  } as unknown as HomeSectionItemsResponse;
+}
+
+function rowIDs(queryClient: QueryClient, sectionType: string) {
+  return queryClient
+    .getQueryData<HomeSectionItemsResponse>(sectionKeys.homeItems(sectionType))
+    ?.section.items.map((item) => item.content_id);
+}
+
+describe("useToggleNotInterested", () => {
+  let queryClient: QueryClient;
+
+  beforeEach(() => {
+    queryClient = new QueryClient({ defaultOptions: { mutations: { retry: false } } });
+    mocks.fetchWithSession.mockReset();
+    mocks.fetchWithSession.mockImplementation(() => Promise.resolve(noContent()));
+    mocks.toastSuccess.mockReset();
+    mocks.activeProfile = "p-owner";
+    mocks.toastError.mockReset();
+    for (const sectionType of ["most_watched", "recommended_for_you", "continue_watching"]) {
+      queryClient.setQueryData(sectionKeys.homeItems(sectionType), homeRow(sectionType));
+    }
+  });
+
+  afterEach(cleanup);
+
+  function wrapper({ children }: { children: ReactNode }) {
+    return <QueryClientProvider client={queryClient}>{children}</QueryClientProvider>;
+  }
+
+  it("marks the title, takes it off recommendation and discovery rows only, and offers undo", async () => {
+    const { result } = renderHook(() => useToggleNotInterested("movie:heat"), { wrapper });
+
+    await act(() => result.current.mutateAsync(false));
+
+    const [url, init] = mocks.fetchWithSession.mock.calls[0] as [string, RequestInit];
+    expect(url).toContain("/api/v2/not-interested/movie%3Aheat");
+    expect(init.method).toBe("PUT");
+    expect(rowIDs(queryClient, "most_watched")).toEqual(["movie:other"]);
+    expect(rowIDs(queryClient, "recommended_for_you")).toEqual(["movie:other"]);
+    expect(rowIDs(queryClient, "continue_watching")).toEqual(["movie:heat", "movie:other"]);
+
+    const [, options] = mocks.toastSuccess.mock.calls[0] as [
+      string,
+      { action: { label: string; onClick: () => void } },
+    ];
+    expect(options.action.label).toBe("Undo");
+    act(() => options.action.onClick());
+    await waitFor(() => expect(mocks.fetchWithSession).toHaveBeenCalledTimes(2));
+    expect((mocks.fetchWithSession.mock.calls[1] as [string, RequestInit])[1].method).toBe(
+      "DELETE",
+    );
+  });
+
+  it("refuses Undo after a profile switch rather than act as the earlier profile", async () => {
+    const { result } = renderHook(() => useToggleNotInterested("movie:heat"), { wrapper });
+    await act(() => result.current.mutateAsync(false));
+    const [, options] = mocks.toastSuccess.mock.calls[0] as [
+      string,
+      { action: { onClick: () => void } },
+    ];
+
+    mocks.activeProfile = "p-other";
+    queryClient.setQueryData(sectionKeys.homeItems("most_watched"), homeRow("most_watched"));
+    act(() => options.action.onClick());
+    await waitFor(() => expect(mocks.toastError).toHaveBeenCalled());
+
+    // Nothing is sent with the earlier profile's authority.
+    expect(mocks.fetchWithSession).toHaveBeenCalledTimes(1);
+    expect(rowIDs(queryClient, "most_watched")).toEqual(["movie:heat", "movie:other"]);
+  });
+
+  it("undoes a mark while its profile is still active", async () => {
+    const { result } = renderHook(() => useToggleNotInterested("movie:heat"), { wrapper });
+    await act(() => result.current.mutateAsync(false));
+    const [, options] = mocks.toastSuccess.mock.calls[0] as [
+      string,
+      { action: { onClick: () => void } },
+    ];
+    act(() => options.action.onClick());
+    await waitFor(() => expect(mocks.fetchWithSession).toHaveBeenCalledTimes(2));
+    const [, init] = mocks.fetchWithSession.mock.calls[1] as [string, RequestInit];
+    expect(init.method).toBe("DELETE");
+    expect((init.headers as Record<string, string>)["X-Profile-Id"]).toBe("p-owner");
+  });
+
+  it("undoes the title it marked after the hook moves to another title", async () => {
+    const { result, rerender } = renderHook(({ id }) => useToggleNotInterested(id), {
+      wrapper,
+      initialProps: { id: "movie:heat" },
+    });
+    await act(() => result.current.mutateAsync(false));
+    const [, options] = mocks.toastSuccess.mock.calls[0] as [
+      string,
+      { action: { onClick: () => void } },
+    ];
+
+    rerender({ id: "movie:other" });
+    act(() => options.action.onClick());
+    await waitFor(() => expect(mocks.fetchWithSession).toHaveBeenCalledTimes(2));
+    const [url, init] = mocks.fetchWithSession.mock.calls[1] as [string, RequestInit];
+    expect(init.method).toBe("DELETE");
+    expect(url).toContain("/api/v2/not-interested/movie%3Aheat");
+  });
+
+  it("keeps a mark in flight on its profile when the profile switches", async () => {
+    let finish: (value: ReturnType<typeof noContent>) => void = () => {};
+    mocks.fetchWithSession.mockImplementationOnce(
+      () => new Promise((resolve) => (finish = resolve)),
+    );
+    const { result } = renderHook(() => useToggleNotInterested("movie:heat"), { wrapper });
+
+    let pending!: Promise<unknown>;
+    act(() => {
+      pending = result.current.mutateAsync(false);
+    });
+    await waitFor(() => expect(mocks.fetchWithSession).toHaveBeenCalledTimes(1));
+    mocks.activeProfile = "p-other";
+    queryClient.setQueryData(sectionKeys.homeItems("most_watched"), homeRow("most_watched"));
+    finish(noContent());
+    await act(() => pending);
+
+    const [, init] = mocks.fetchWithSession.mock.calls[0] as [string, RequestInit];
+    expect((init.headers as Record<string, string>)["X-Profile-Id"]).toBe("p-owner");
+    expect(rowIDs(queryClient, "most_watched")).toEqual(["movie:heat", "movie:other"]);
+  });
+
+  it("clears a mark without touching the rows", async () => {
+    const { result } = renderHook(() => useToggleNotInterested("movie:heat"), { wrapper });
+
+    await act(() => result.current.mutateAsync(true));
+
+    expect((mocks.fetchWithSession.mock.calls[0] as [string, RequestInit])[1].method).toBe(
+      "DELETE",
+    );
+    expect(rowIDs(queryClient, "most_watched")).toEqual(["movie:heat", "movie:other"]);
+  });
+
+  it("is offered for movies and series only", () => {
+    expect(canMarkNotInterested("movie")).toBe(true);
+    expect(canMarkNotInterested("series")).toBe(true);
+    expect(canMarkNotInterested("episode")).toBe(false);
+    expect(canMarkNotInterested("season")).toBe(false);
+  });
+});
diff --git a/web/src/hooks/queries/notInterested.ts b/web/src/hooks/queries/notInterested.ts
new file mode 100644
index 0000000000..849a22966c
--- /dev/null
+++ b/web/src/hooks/queries/notInterested.ts
@@ -0,0 +1,239 @@
+import { useInfiniteQuery, useMutation, useQueryClient } from "@tanstack/react-query";
+import { toast } from "sonner";
+import type { BrowseItem } from "@/api/types";
+import { catalogItemFromV2 } from "@/api/v2/catalog";
+import {
+  captureProfileRequestContext,
+  isCapturedProfileAuthorityActive,
+  type ProfileRequestContextSnapshot,
+} from "@/api/client";
+import { v2 } from "@/api/v2/request";
+import { bumpHomeRefreshSignal } from "@/pages/homeSurfaceRefresh";
+import { notInterestedKeys } from "./keys";
+import {
+  cancelItemDetailQueries,
+  removeItemFromHomeSectionCaches,
+  scheduleMediaSurfaceInvalidation,
+  updateCatalogItemDetail,
+} from "./mediaSurfaceRefresh";
+import {
+  PERSONAL_STATE_WRITE_TIMEOUT_MS,
+  personalStateMutationOptions,
+} from "./personalStateWrites";
+
+/**
+ * The Home section types a Not interested title leaves: the recommendation
+ * rows and the discovery rows the server filters (sections.HidesNotInterested).
+ * Rows of what is new, in progress, saved or chosen keep it.
+ */
+export const NOT_INTERESTED_HIDING_SECTION_TYPES: ReadonlySet<string> = new Set([
+  "recommended_for_you",
+  "because_you_watched",
+  "similar_users_liked",
+  "taste_match",
+  "hidden_gems",
+  "critically_acclaimed",
+  "award_winners",
+  "forgotten_favorites",
+  "format_showcase",
+  "editorial_spotlight",
+  "seasonal_themed",
+  "mood_collection",
+  "trending_on_server",
+  "most_watched",
+  "trending_discover",
+  "genre_roulette",
+  "anniversaries",
+  "short_watches",
+]);
+
+/** Only movies and series can be marked; a series mark covers its episodes. */
+export function canMarkNotInterested(type: string | undefined): boolean {
+  return type === "movie" || type === "series";
+}
+
+const NOT_INTERESTED_PAGE_SIZE = 50;
+
+interface NotInterestedPage {
+  items: BrowseItem[];
+  next_cursor?: string;
+}
+
+/** The acting profile's marked titles, newest mark first, a page at a time. */
+export function useNotInterestedList() {
+  return useInfiniteQuery({
+    queryKey: notInterestedKeys.list(),
+    queryFn: async ({
+      pageParam,
+      signal,
+    }: {
+      pageParam: string;
+      signal: AbortSignal;
+    }): Promise<NotInterestedPage> => {
+      const page = await v2("GET /api/v2/not-interested", {
+        query: { limit: NOT_INTERESTED_PAGE_SIZE, cursor: pageParam || undefined },
+        signal,
+      });
+      return {
+        items: page.items.map(catalogItemFromV2),
+        next_cursor: page.page?.has_more ? page.page.next_cursor : undefined,
+      };
+    },
+    initialPageParam: "",
+    getNextPageParam: (lastPage) => lastPage.next_cursor,
+  });
+}
+
+function setDetailNotInterested(
+  queryClient: ReturnType<typeof useQueryClient>,
+  itemId: string,
+  notInterested: boolean,
+) {
+  updateCatalogItemDetail(queryClient, itemId, (detail) => ({
+    ...detail,
+    user_state: {
+      ...detail.user_state,
+      played: detail.user_state?.played ?? detail.user_data?.played ?? false,
+      is_favorite: detail.user_state?.is_favorite ?? false,
+      in_watchlist: detail.user_state?.in_watchlist ?? false,
+      not_interested: notInterested,
+    },
+  }));
+}
+
+/**
+ * Marks or clears the acting profile's Not interested mark. The argument is
+ * whether the title is marked now. A new mark takes the title off the Home
+ * recommendation and discovery rows at once and offers an undo; the server
+ * rebuilds the rows within seconds.
+ */
+export function useToggleNotInterested(itemId: string) {
+  const queryClient = useQueryClient();
+
+  // Every callback takes the item from its variables, not this render: the
+  // hook's options follow the latest render, and a card or action bar can be
+  // reused for another title before a write settles or its Undo is chosen.
+  const settle = (target: string) => {
+    void queryClient.invalidateQueries({ queryKey: notInterestedKeys.all });
+    scheduleMediaSurfaceInvalidation(queryClient, { itemId: target, skipItemDetail: true });
+  };
+
+  // Undo clears the mark only while the profile that made it is still the
+  // active one. After a switch it is refused rather than sent as the earlier
+  // profile: that would reuse its PIN authority from another profile.
+  const undo = useMutation({
+    ...personalStateMutationOptions,
+    mutationFn: ({ itemId: target, authority }: UndoVariables) => {
+      if (!isCapturedProfileAuthorityActive(authority)) {
+        return Promise.reject(new UndoProfileChangedError());
+      }
+      return v2("DELETE /api/v2/not-interested/{item_id}", {
+        path: { item_id: target },
+        profileContext: authority,
+        timeoutMs: PERSONAL_STATE_WRITE_TIMEOUT_MS,
+      });
+    },
+    onMutate: async ({ itemId: target, authority }) => {
+      if (!isCapturedProfileAuthorityActive(authority)) return;
+      await cancelItemDetailQueries(queryClient, target);
+      // The profile may have switched while the reads were cancelled.
+      if (isCapturedProfileAuthorityActive(authority)) {
+        setDetailNotInterested(queryClient, target, false);
+      }
+    },
+    onError: (err, { itemId: target, authority }) => {
+      if (err instanceof UndoProfileChangedError) {
+        toast.error("Switch back to the profile that marked this to undo it");
+        return;
+      }
+      if (isCapturedProfileAuthorityActive(authority)) {
+        setDetailNotInterested(queryClient, target, true);
+      }
+      toast.error("Failed to undo Not interested");
+    },
+    onSettled: (_data, _err, { itemId: target, authority }) => {
+      if (isCapturedProfileAuthorityActive(authority)) settle(target);
+    },
+  });
+
+  const toggle = useMutation({
+    ...personalStateMutationOptions,
+    mutationFn: ({ itemId: target, marked, authority }: ToggleVariables) =>
+      marked
+        ? v2("DELETE /api/v2/not-interested/{item_id}", {
+            path: { item_id: target },
+            profileContext: authority ?? undefined,
+            timeoutMs: PERSONAL_STATE_WRITE_TIMEOUT_MS,
+          })
+        : v2("PUT /api/v2/not-interested/{item_id}", {
+            path: { item_id: target },
+            profileContext: authority ?? undefined,
+            timeoutMs: PERSONAL_STATE_WRITE_TIMEOUT_MS,
+          }),
+    onMutate: async ({ itemId: target, marked, authority }) => {
+      if (!isActive(authority)) return;
+      await cancelItemDetailQueries(queryClient, target);
+      // The profile may have switched while the reads were cancelled.
+      if (isActive(authority)) setDetailNotInterested(queryClient, target, !marked);
+    },
+    onError: (_err, { itemId: target, marked, authority }) => {
+      if (isActive(authority)) setDetailNotInterested(queryClient, target, marked);
+      toast.error("Failed to update Not interested");
+    },
+    onSuccess: (_data, { itemId: target, marked, authority }) => {
+      if (marked) {
+        toast.success("Back in your recommendations");
+        return;
+      }
+      if (isActive(authority)) {
+        removeItemFromHomeSectionCaches(queryClient, target, NOT_INTERESTED_HIDING_SECTION_TYPES);
+        bumpHomeRefreshSignal(queryClient);
+      }
+      toast.success(
+        "We won't recommend this",
+        authority
+          ? {
+              action: {
+                label: "Undo",
+                onClick: () => undo.mutate({ itemId: target, authority }),
+              },
+            }
+          : undefined,
+      );
+    },
+    onSettled: (_data, _err, { itemId: target, authority }) => {
+      if (isActive(authority)) settle(target);
+    },
+  });
+
+  // The item and profile are captured when the action is chosen: the write
+  // goes out as that profile and its cache updates apply only while it is
+  // still active.
+  return {
+    isPending: toggle.isPending,
+    mutate: (marked: boolean) =>
+      toggle.mutate({ itemId, marked, authority: captureProfileRequestContext() }),
+    mutateAsync: (marked: boolean) =>
+      toggle.mutateAsync({ itemId, marked, authority: captureProfileRequestContext() }),
+  };
+}
+
+/** Undo was chosen after the profile that made the mark stopped being active. */
+class UndoProfileChangedError extends Error {}
+
+interface UndoVariables {
+  itemId: string;
+  authority: ProfileRequestContextSnapshot;
+}
+
+interface ToggleVariables {
+  itemId: string;
+  /** Whether the title is marked now. */
+  marked: boolean;
+  authority: ProfileRequestContextSnapshot | null;
+}
+
+/** A write with no captured profile ran as whichever profile was active. */
+function isActive(authority: ProfileRequestContextSnapshot | null) {
+  return authority === null || isCapturedProfileAuthorityActive(authority);
+}
diff --git a/web/src/hooks/queries/notifications.ts b/web/src/hooks/queries/notifications.ts
index 8e019bbcf6..a26ac2cc88 100644
--- a/web/src/hooks/queries/notifications.ts
+++ b/web/src/hooks/queries/notifications.ts
@@ -9,13 +9,23 @@ import {
   unlinkNotificationDiscord,
 } from "@/api/v2/notificationDiscord";
 import type { QueryClient } from "@tanstack/react-query";
-import { useInfiniteQuery, useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import {
+  keepPreviousData,
+  useInfiniteQuery,
+  useMutation,
+  useQuery,
+  useQueryClient,
+} from "@tanstack/react-query";
 import { captureProfileRequestContext, StaleApiRequestContextError } from "@/api/client";
 import {
   captureNotificationAuthority,
   notificationScope,
   requireNotificationAuthority,
   listNotifications,
+  listNotificationSeries,
+  setNotificationSeriesMuted,
+  type NotifiedSeriesOptions,
+  type NotifiedSeriesStatus,
   unreadNotificationCount,
   notificationPreferences,
   updateNotificationPreferences,
@@ -49,6 +59,10 @@ export const notificationInboxKeys = {
   ],
   count: (scope = notificationScope()) => [...notificationKeys.unreadCount(), scope],
   preferences: (scope = notificationScope()) => [...notificationKeys.preferences(), scope],
+  series: (status: NotifiedSeriesStatus, scope = notificationScope()) => [
+    ...notificationKeys.series(status),
+    scope,
+  ],
 };
 function invalidateInbox(queryClient: QueryClient, scope = notificationScope()) {
   for (const status of ["all", "unread"] as const)
@@ -84,6 +98,61 @@ export function useNotifications(status: "all" | "unread" = "all") {
   });
   return { ...query, restart: () => queryClient.resetQueries({ queryKey, exact: true }) };
 }
+/** The series whose new episodes can notify the profile, or whose
+ * notifications its preferences silence, ordered by title. */
+export function useNotificationSeries(
+  status: NotifiedSeriesStatus,
+  options: NotifiedSeriesOptions,
+  enabled = true,
+) {
+  const context = captureProfileRequestContext();
+  return useInfiniteQuery({
+    queryKey: [...notificationInboxKeys.series(status, notificationScope(context)), options],
+    initialPageParam: undefined as string | undefined,
+    queryFn: ({ pageParam }) =>
+      listNotificationSeries(status, options, pageParam, context ?? captureNotificationAuthority()),
+    getNextPageParam: (last) => last.next_cursor,
+    // A new search or sort keeps the previous list on screen until it loads.
+    placeholderData: keepPreviousData,
+    // Favorites, watchlist, and progress change the list from other pages, so
+    // reopening the view reads it again.
+    refetchOnMount: "always",
+    enabled: enabled && context !== null,
+    retry: false,
+  });
+}
+/** Mutes or unmutes one series, then reloads both series lists: the series
+ * moves between them. A mute offers Undo, since the row leaves the view. */
+export function useSetNotificationSeriesMuted() {
+  const queryClient = useQueryClient();
+  const context = captureNotificationAuthority();
+  const mutation = useMutation({
+    mutationFn: ({ seriesId, muted }: { seriesId: string; title: string; muted: boolean }) =>
+      setNotificationSeriesMuted(seriesId, muted, context),
+    retry: false,
+    onSettled: () => {
+      const scope = notificationScope(context);
+      for (const status of ["active", "inactive"] as const)
+        void queryClient.invalidateQueries({
+          queryKey: notificationInboxKeys.series(status, scope),
+        });
+    },
+    onSuccess: (_data, variables) => {
+      if (!variables.muted) return;
+      toast.success(`Muted ${variables.title}`, {
+        action: {
+          label: "Undo",
+          onClick: () => mutation.mutate({ ...variables, muted: false }),
+        },
+      });
+    },
+    onError: (error, variables) => {
+      if (error instanceof StaleApiRequestContextError) return;
+      toast.error(variables.muted ? "Failed to mute the series" : "Failed to unmute the series");
+    },
+  });
+  return mutation;
+}
 export function useUnreadNotificationCount(enabled = true) {
   const context = captureProfileRequestContext();
   return useQuery({
@@ -140,10 +209,13 @@ export function useUpdateNotificationPreferences() {
       updateNotificationPreferences(input, context),
     retry: false,
     onSuccess: (prefs) => {
-      queryClient.setQueryData(
-        notificationInboxKeys.preferences(notificationScope(context)),
-        prefs,
-      );
+      const scope = notificationScope(context);
+      queryClient.setQueryData(notificationInboxKeys.preferences(scope), prefs);
+      // Preferences decide which listed series notify.
+      for (const status of ["active", "inactive"] as const)
+        void queryClient.invalidateQueries({
+          queryKey: notificationInboxKeys.series(status, scope),
+        });
     },
     onError: () => toast.error("Failed to save notification preferences"),
   });
@@ -519,7 +591,9 @@ export function applyNotificationsSnapshot(queryClient: QueryClient, rows: AppNo
 }
 
 /** Formats the "S2E5" style episode code for a notification row. */
-export function formatEpisodeCode(notification: AppNotification): string | null {
+export function formatEpisodeCode(
+  notification: Pick<AppNotification, "season_number" | "episode_number">,
+): string | null {
   if (notification.season_number == null || notification.episode_number == null) {
     return null;
   }
diff --git a/web/src/hooks/queries/onboarding.ts b/web/src/hooks/queries/onboarding.ts
index 8183f7fcd0..9d82283278 100644
--- a/web/src/hooks/queries/onboarding.ts
+++ b/web/src/hooks/queries/onboarding.ts
@@ -49,8 +49,7 @@ export function useOnboardingProgress() {
   const { context, scope } = useOnboardingContext();
   const writer = useMemo(
     () => (context ? createOnboardingWriter(context) : null),
-    // Token refresh preserves authority; account/profile changes start a new sequence.
-    // eslint-disable-next-line react-hooks/exhaustive-deps
+    // eslint-disable-next-line react-hooks/exhaustive-deps -- token refresh preserves authority; account/profile changes start a new sequence
     [context?.serverOrigin, context?.authContextVersion, context?.profileId, context?.profileToken],
   );
   return useMutation({
diff --git a/web/src/hooks/queries/profiles.test.ts b/web/src/hooks/queries/profiles.test.ts
index aac5bf567e..392d8ce9fc 100644
--- a/web/src/hooks/queries/profiles.test.ts
+++ b/web/src/hooks/queries/profiles.test.ts
@@ -7,7 +7,13 @@ import uploadProfileAvatarOk from "../../../../contracts/api/v2/fixtures/upload_
 import verifyProfilePinOk from "../../../../contracts/api/v2/fixtures/verify_profile_pin_ok.json";
 import verifyProfilePinWrong from "../../../../contracts/api/v2/fixtures/verify_profile_pin_wrong.json";
 
-import { setAccessToken, setProfileId } from "@/api/client";
+import {
+  captureProfileRequestContext,
+  captureProfileRequestContextAs,
+  setAccessToken,
+  setProfileId,
+  setProfileToken,
+} from "@/api/client";
 import {
   createProfile,
   listHouseholdSessions,
@@ -36,6 +42,7 @@ beforeEach(() => {
   sessionStorage.clear();
   setAccessToken("tok-user");
   setProfileId("p-owner");
+  setProfileToken(null);
 });
 
 describe("profile queries on the v2 contract", () => {
@@ -95,6 +102,26 @@ describe("profile queries on the v2 contract", () => {
     );
   });
 
+  it("creates a profile as an explicit profile without touching the active one", async () => {
+    setProfileToken("pvt-child");
+    const fetchMock = vi.fn<typeof fetch>(async () =>
+      json(createProfileCreated, 201, { ...JSON_HEADERS, Location: "/api/v2/profiles/p-kid" }),
+    );
+    vi.stubGlobal("fetch", fetchMock);
+
+    const primary = captureProfileRequestContextAs("p-primary", "pvt-primary");
+    if (!primary) throw new Error("no session");
+    await createProfile({ name: "Kid" }, primary);
+
+    const headers = requestOf(fetchMock, 0).init.headers;
+    expect(headers["X-Profile-Id"]).toBe("p-primary");
+    expect(headers["X-Profile-Token"]).toBe("pvt-primary");
+    expect(captureProfileRequestContext()).toMatchObject({
+      profileId: "p-owner",
+      profileToken: "pvt-child",
+    });
+  });
+
   it("verifies a PIN and passes the token through; a wrong PIN is a plain false", async () => {
     const fetchMock = vi
       .fn<typeof fetch>()
diff --git a/web/src/hooks/queries/profiles.ts b/web/src/hooks/queries/profiles.ts
index 61b58c6358..3403b2723b 100644
--- a/web/src/hooks/queries/profiles.ts
+++ b/web/src/hooks/queries/profiles.ts
@@ -1,4 +1,5 @@
 import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
+import type { ProfileRequestContextSnapshot } from "@/api/client";
 import type { AdminSession, Profile } from "@/api/types";
 import type { components } from "@/api/v2/schema";
 import { v2, type V2Body, type V2Result } from "@/api/v2/request";
@@ -122,18 +123,32 @@ export async function listProfiles(): Promise<ProfileList> {
   };
 }
 
-export function createProfile(body: ProfileCreate): Promise<Profile> {
-  return v2("POST /api/v2/profiles", { body }).then(profileFromV2);
+/**
+ * Creates a profile. profileContext makes the request as that profile rather
+ * than the active one: Who's watching creates as the verified primary profile
+ * without selecting it.
+ */
+export function createProfile(
+  body: ProfileCreate,
+  profileContext?: ProfileRequestContextSnapshot,
+): Promise<Profile> {
+  return v2("POST /api/v2/profiles", { body, profileContext }).then(profileFromV2);
 }
 
 export function verifyProfilePIN(profileId: string, pin: string): Promise<ProfileVerification> {
   return v2("POST /api/v2/profiles/{id}/verify-pin", { path: { id: profileId }, body: { pin } });
 }
 
-export function uploadProfileAvatar(id: string, file: File): Promise<Profile> {
-  return v2("PUT /api/v2/profiles/{id}/avatar", { path: { id }, form: { avatar: file } }).then(
-    profileFromV2,
-  );
+export function uploadProfileAvatar(
+  id: string,
+  file: File,
+  profileContext?: ProfileRequestContextSnapshot,
+): Promise<Profile> {
+  return v2("PUT /api/v2/profiles/{id}/avatar", {
+    path: { id },
+    form: { avatar: file },
+    profileContext,
+  }).then(profileFromV2);
 }
 
 export async function listHouseholdSessions(): Promise<AdminSession[]> {
@@ -172,10 +187,10 @@ export function useProfiles(options?: { enabled?: boolean }) {
   };
 }
 
-export function useCreateProfile() {
+export function useCreateProfile(profileContext?: ProfileRequestContextSnapshot) {
   const queryClient = useQueryClient();
   return useMutation({
-    mutationFn: createProfile,
+    mutationFn: (body: ProfileCreate) => createProfile(body, profileContext),
     onSuccess: () => {
       toast.success("Profile created");
       void queryClient.invalidateQueries({ queryKey: profileKeys.list() });
@@ -210,10 +225,11 @@ export function useUpdateProfile() {
   });
 }
 
-export function useUploadProfileAvatar() {
+export function useUploadProfileAvatar(profileContext?: ProfileRequestContextSnapshot) {
   const queryClient = useQueryClient();
   return useMutation({
-    mutationFn: ({ id, file }: { id: string; file: File }) => uploadProfileAvatar(id, file),
+    mutationFn: ({ id, file }: { id: string; file: File }) =>
+      uploadProfileAvatar(id, file, profileContext),
     onSuccess: (updatedProfile) => {
       queryClient.setQueryData<ProfileList | undefined>(profileKeys.list(), (current) => ({
         profiles: replaceProfileInList(current?.profiles, updatedProfile),
diff --git a/web/src/hooks/queries/progress.test.ts b/web/src/hooks/queries/progress.test.ts
index 99b602d370..1c7aacaaca 100644
--- a/web/src/hooks/queries/progress.test.ts
+++ b/web/src/hooks/queries/progress.test.ts
@@ -1,4 +1,6 @@
+import { renderHook } from "@testing-library/react";
 import { beforeEach, describe, expect, it, vi } from "vitest";
+import type { ItemDetail } from "@/api/types";
 
 import syncProgressOk from "../../../../contracts/api/v2/fixtures/sync_progress_ok.json";
 
@@ -9,6 +11,14 @@ const mocks = vi.hoisted(() => ({
   useQueryClient: vi.fn(),
   fetchCatalogItemDetail: vi.fn(),
   v2: vi.fn(),
+  removeItemFromHomeSectionCaches: vi.fn(),
+  cancelItemDetailQueries: vi.fn(),
+  dropInactiveWatchDetail: vi.fn(),
+  updateCatalogItemDetail: vi.fn(),
+  invalidateMediaSurfaceQueries: vi.fn(),
+  bumpHomeRefreshSignal: vi.fn(),
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
 }));
 
 vi.mock("@tanstack/react-query", () => ({
@@ -27,7 +37,33 @@ vi.mock("./catalogRead", () => ({
   fetchCatalogItemDetail: (...args: unknown[]) => mocks.fetchCatalogItemDetail(...args),
 }));
 
-import { useContinueWatching, useReportMediaProgress } from "./progress";
+vi.mock("./mediaSurfaceRefresh", () => ({
+  removeItemFromHomeSectionCaches: (...args: unknown[]) =>
+    mocks.removeItemFromHomeSectionCaches(...args),
+  cancelItemDetailQueries: (...args: unknown[]) => mocks.cancelItemDetailQueries(...args),
+  dropInactiveWatchDetail: (...args: unknown[]) => mocks.dropInactiveWatchDetail(...args),
+  updateCatalogItemDetail: (...args: unknown[]) => mocks.updateCatalogItemDetail(...args),
+  invalidateMediaSurfaceQueries: (...args: unknown[]) =>
+    mocks.invalidateMediaSurfaceQueries(...args),
+}));
+
+vi.mock("@/pages/homeSurfaceRefresh", () => ({
+  bumpHomeRefreshSignal: (...args: unknown[]) => mocks.bumpHomeRefreshSignal(...args),
+}));
+
+vi.mock("sonner", () => ({
+  toast: {
+    success: (...args: unknown[]) => mocks.toastSuccess(...args),
+    error: (...args: unknown[]) => mocks.toastError(...args),
+  },
+}));
+
+import {
+  useClearResumePosition,
+  useContinueWatching,
+  useReportMediaProgress,
+  useResetProgressAction,
+} from "./progress";
 
 describe("useContinueWatching", () => {
   const signal = new AbortController().signal;
@@ -146,3 +182,148 @@ describe("useReportMediaProgress", () => {
     );
   });
 });
+
+describe("useClearResumePosition", () => {
+  type ClearOptions = {
+    mutationFn: (vars: { contentId: string }) => Promise<unknown>;
+    onSuccess: (data: unknown, vars: { contentId: string }) => Promise<void>;
+  };
+
+  beforeEach(() => {
+    mocks.useMutation.mockReset();
+    mocks.useMutation.mockImplementation((options: unknown) => options);
+    mocks.useQueryClient.mockReset();
+    mocks.v2.mockReset();
+    mocks.v2.mockResolvedValue(undefined);
+    mocks.removeItemFromHomeSectionCaches.mockReset();
+    mocks.cancelItemDetailQueries.mockReset();
+    mocks.cancelItemDetailQueries.mockResolvedValue(undefined);
+    mocks.dropInactiveWatchDetail.mockReset();
+    mocks.updateCatalogItemDetail.mockReset();
+    mocks.invalidateMediaSurfaceQueries.mockReset();
+    mocks.invalidateMediaSurfaceQueries.mockResolvedValue(undefined);
+    mocks.bumpHomeRefreshSignal.mockReset();
+    mocks.toastSuccess.mockReset();
+  });
+
+  it("clears the resume position through clearResumePosition", async () => {
+    mocks.useQueryClient.mockReturnValue({});
+    const options = useClearResumePosition() as unknown as ClearOptions;
+
+    await options.mutationFn({ contentId: "movie-8f2c1a" });
+
+    expect(mocks.v2).toHaveBeenCalledWith("DELETE /api/v2/progress/{media_item_id}/position", {
+      path: { media_item_id: "movie-8f2c1a" },
+    });
+  });
+
+  it("takes the item off Continue Watching and drops its cached resume point", async () => {
+    const queryClient = {};
+    mocks.useQueryClient.mockReturnValue(queryClient);
+    const related = new Set(["movie-8f2c1a"]);
+    mocks.dropInactiveWatchDetail.mockReturnValue(related);
+    const options = useClearResumePosition() as unknown as ClearOptions;
+
+    await options.onSuccess(undefined, { contentId: "movie-8f2c1a" });
+
+    expect(mocks.cancelItemDetailQueries).toHaveBeenCalledWith(queryClient, "movie-8f2c1a");
+    expect(mocks.updateCatalogItemDetail.mock.calls[0]?.[1]).toBe("movie-8f2c1a");
+    expect(mocks.removeItemFromHomeSectionCaches).toHaveBeenCalledWith(
+      queryClient,
+      "movie-8f2c1a",
+      "continue_watching",
+    );
+    // A closed player's cached watch detail is dropped, and the series it led
+    // to still refreshes.
+    expect(mocks.dropInactiveWatchDetail).toHaveBeenCalledWith(queryClient, "movie-8f2c1a");
+    expect(mocks.invalidateMediaSurfaceQueries).toHaveBeenCalledWith(queryClient, {
+      itemId: "movie-8f2c1a",
+      skipSimilarItems: true,
+      knownRelatedIds: related,
+    });
+    // Once at once from the patched cache, once after the server refresh.
+    expect(mocks.bumpHomeRefreshSignal).toHaveBeenCalledTimes(2);
+    expect(mocks.toastSuccess).toHaveBeenCalledWith("Progress reset");
+
+    const updater = mocks.updateCatalogItemDetail.mock.calls[0]?.[2] as (
+      detail: ItemDetail,
+    ) => ItemDetail;
+    // The API sends the season counters on a movie's detail too.
+    const cleared = updater({
+      content_id: "movie-8f2c1a",
+      type: "movie",
+      user_data: {
+        played: true,
+        is_in_progress: true,
+        position_seconds: 1325.5,
+        duration_seconds: 5400,
+        watched_count: 0,
+        unplayed_count: 0,
+        in_progress_count: 0,
+      },
+    } as unknown as ItemDetail);
+    expect(cleared.user_data).toEqual({
+      played: true,
+      is_in_progress: false,
+      position_seconds: 0,
+      duration_seconds: 5400,
+      watched_count: 0,
+      unplayed_count: 0,
+      in_progress_count: 0,
+    });
+  });
+});
+
+describe("useResetProgressAction", () => {
+  const mutate = vi.fn();
+
+  beforeEach(() => {
+    mutate.mockReset();
+    mocks.useMutation.mockReset();
+    mocks.useMutation.mockReturnValue({ mutate });
+    mocks.useQueryClient.mockReset();
+    mocks.useQueryClient.mockReturnValue({});
+  });
+
+  it("offers the reset for a movie or episode with a resume position", () => {
+    for (const type of ["movie", "episode"] as const) {
+      // As the API answers a leaf: the season counters come along too.
+      // A rewatch: watched and with a live resume point.
+      const userData = {
+        played: true,
+        position_seconds: 120,
+        is_in_progress: true,
+        watched_count: 0,
+        unplayed_count: 0,
+        in_progress_count: 0,
+      } as unknown as ItemDetail["user_data"];
+      const { result } = renderHook(() =>
+        useResetProgressAction({ content_id: `${type}-1`, type, user_data: userData }),
+      );
+
+      result.current?.();
+      expect(mutate).toHaveBeenLastCalledWith({ contentId: `${type}-1` });
+    }
+  });
+
+  it("offers nothing without a resume position or for other kinds", () => {
+    const items: Array<Pick<ItemDetail, "content_id" | "type" | "user_data">> = [
+      { content_id: "movie-1", type: "movie", user_data: { played: true, position_seconds: 0 } },
+      { content_id: "episode-1", type: "episode" },
+      {
+        content_id: "season-1",
+        type: "season",
+        user_data: { played: false, watched_count: 1, unplayed_count: 2, in_progress_count: 1 },
+      },
+      {
+        content_id: "audiobook-1",
+        type: "audiobook",
+        user_data: { played: false, position_seconds: 300 },
+      },
+    ];
+    for (const item of items) {
+      const { result } = renderHook(() => useResetProgressAction(item));
+      expect(result.current, item.content_id).toBeUndefined();
+    }
+  });
+});
diff --git a/web/src/hooks/queries/progress.ts b/web/src/hooks/queries/progress.ts
index 00bc22770b..231fb62f20 100644
--- a/web/src/hooks/queries/progress.ts
+++ b/web/src/hooks/queries/progress.ts
@@ -1,8 +1,18 @@
+import { useCallback } from "react";
 import { useMutation, useQuery, useQueries, useQueryClient } from "@tanstack/react-query";
+import { toast } from "sonner";
 import type { ItemDetail } from "@/api/types";
 import { v2, type V2Result } from "@/api/v2/request";
+import { bumpHomeRefreshSignal } from "@/pages/homeSurfaceRefresh";
 import { catalogKeys, progressKeys } from "./keys";
 import { fetchCatalogItemDetail } from "./catalogRead";
+import {
+  cancelItemDetailQueries,
+  dropInactiveWatchDetail,
+  invalidateMediaSurfaceQueries,
+  removeItemFromHomeSectionCaches,
+  updateCatalogItemDetail,
+} from "./mediaSurfaceRefresh";
 
 interface ContinueWatchingOptions {
   enabled?: boolean;
@@ -114,3 +124,66 @@ export function useReportMediaProgress() {
     },
   });
 }
+
+interface ClearResumePositionVars {
+  contentId: string;
+}
+
+/**
+ * Clears the acting profile's resume position on a movie or episode, keeping
+ * its watched state and watch history (issue #2134). The item leaves Continue
+ * Watching at once, and its cached watch detail is dropped so playing it next
+ * starts from the beginning instead of a stale resume point.
+ */
+export function useClearResumePosition() {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: ({ contentId }: ClearResumePositionVars) =>
+      v2("DELETE /api/v2/progress/{media_item_id}/position", {
+        path: { media_item_id: contentId },
+      }),
+    onError: (error) => {
+      toast.error(error instanceof Error ? error.message : "Failed to reset progress");
+    },
+    onSuccess: async (_data, { contentId }) => {
+      await cancelItemDetailQueries(queryClient, contentId);
+      updateCatalogItemDetail(queryClient, contentId, (detail) =>
+        detail.user_data
+          ? {
+              ...detail,
+              user_data: { ...detail.user_data, position_seconds: 0, is_in_progress: false },
+            }
+          : detail,
+      );
+      removeItemFromHomeSectionCaches(queryClient, contentId, "continue_watching");
+      bumpHomeRefreshSignal(queryClient);
+      toast.success("Progress reset");
+      // The next play must start from the beginning, not the cached position.
+      const knownRelatedIds = dropInactiveWatchDetail(queryClient, contentId);
+      await invalidateMediaSurfaceQueries(queryClient, {
+        itemId: contentId,
+        skipSimilarItems: true,
+        knownRelatedIds,
+      });
+      bumpHomeRefreshSignal(queryClient);
+    },
+  });
+}
+
+/**
+ * The detail page's Reset Progress action: offered for a movie or episode with
+ * a resume position, otherwise undefined.
+ */
+export function useResetProgressAction(
+  item: Pick<ItemDetail, "content_id" | "type" | "user_data">,
+): (() => void) | undefined {
+  const { mutate } = useClearResumePosition();
+  const contentId = item.content_id;
+  const reset = useCallback(() => mutate({ contentId }), [contentId, mutate]);
+  // Leaf detail also carries the season counters, so read the position itself.
+  const userData = item.user_data;
+  const position =
+    userData && "position_seconds" in userData ? (userData.position_seconds ?? 0) : 0;
+  const hasResumePosition = (item.type === "movie" || item.type === "episode") && position > 0;
+  return hasResumePosition ? reset : undefined;
+}
diff --git a/web/src/hooks/queries/qualityPreference.test.ts b/web/src/hooks/queries/qualityPreference.test.ts
index d93c95e9fe..8f62fc6caa 100644
--- a/web/src/hooks/queries/qualityPreference.test.ts
+++ b/web/src/hooks/queries/qualityPreference.test.ts
@@ -19,10 +19,18 @@ function setResolved(value: unknown) {
 }
 
 describe("useQualityPreference", () => {
-  it("passes 'original' through unchanged — it is a distinct wire value from 'auto' (#849)", () => {
-    setResolved("original");
-    const { result } = renderHook(() => useQualityPreference("1080p"));
-    expect(result.current).toBe("original");
+  it("reads the deprecated 'original' and the older source spellings as auto", () => {
+    for (const value of ["original", "Original", "source", "max"]) {
+      setResolved(value);
+      const { result } = renderHook(() => useQualityPreference("1080p"));
+      expect(result.current).toBe("auto");
+    }
+  });
+
+  it("reads an 'original' profile column fallback as auto", () => {
+    setResolved(undefined);
+    const { result } = renderHook(() => useQualityPreference("original"));
+    expect(result.current).toBe("auto");
   });
 
   it("passes resolution rungs and auto through unchanged", () => {
diff --git a/web/src/hooks/queries/qualityPreference.ts b/web/src/hooks/queries/qualityPreference.ts
index 6848ba9807..41a3d62ecc 100644
--- a/web/src/hooks/queries/qualityPreference.ts
+++ b/web/src/hooks/queries/qualityPreference.ts
@@ -1,5 +1,6 @@
 import { useEffectiveSettings } from "@/hooks/queries/settingValues";
 import { SETTING_KEYS } from "@/lib/settingsContract";
+import { normalizeQualityPreferenceV3 } from "@/player/protocol-v3";
 
 /**
  * The resolution cap playback should apply, read from the contract.
@@ -11,14 +12,11 @@ import { SETTING_KEYS } from "@/lib/settingsContract";
  * carry two axes. Left alone, choosing a quality would appear to save and then
  * change nothing about what plays.
  *
- * The canonical vocabulary — "auto", "original", "480p", "720p", "1080p",
- * "2160p" — passes through unchanged. "original" and "auto" are distinct wire
- * values: the server's planner preserves the source for "original" (subject
- * only to the hard bitrate cap) but adapts "auto" to device limits, bandwidth
- * evidence, and metered connections. Web-side consumers that look resolutions
- * up in a table treat "original" the same as "auto" — no cap — but the value
- * sent to the server must stay "original" or the user's choice is discarded
- * (#849).
+ * The canonical vocabulary is "auto", "480p", "720p", "1080p" and "2160p".
+ * "original" is a deprecated member that a migration rewrites to "auto"; it,
+ * and the older "source" and "max" spellings, read as "auto" here, because
+ * Auto already plays the original file whenever the device and connection
+ * can carry it.
  *
  * `fallback` is the profile column, used until the settings read resolves (and
  * if it fails). Playback must never block on a preferences fetch, and the
@@ -30,6 +28,6 @@ export function useQualityPreference(fallback?: string | null): string | null {
   });
   const resolved = data?.[SETTING_KEYS.PLAYBACK_PREFERRED_QUALITY]?.value;
 
-  if (typeof resolved !== "string") return fallback ?? null;
-  return resolved;
+  if (typeof resolved === "string") return normalizeQualityPreferenceV3(resolved);
+  return fallback ? normalizeQualityPreferenceV3(fallback) : null;
 }
diff --git a/web/src/hooks/queries/recommendations.test.ts b/web/src/hooks/queries/recommendations.test.ts
index c142d40c76..868bef1013 100644
--- a/web/src/hooks/queries/recommendations.test.ts
+++ b/web/src/hooks/queries/recommendations.test.ts
@@ -1,7 +1,7 @@
 // @vitest-environment jsdom
 
 import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
-import { act, renderHook, waitFor } from "@testing-library/react";
+import { renderHook, waitFor } from "@testing-library/react";
 import { createElement } from "react";
 import type { ReactNode } from "react";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
@@ -12,16 +12,15 @@ import getRecommendationSectionOk from "../../../../contracts/api/v2/fixtures/ge
 import getTasteProfileOk from "../../../../contracts/api/v2/fixtures/get_taste_profile_ok.json";
 import listSimilarOk from "../../../../contracts/api/v2/fixtures/list_similar_ok.json";
 import listTasteSeedItemsOk from "../../../../contracts/api/v2/fixtures/list_taste_seed_items_ok.json";
-import listWatchTonightCardsOk from "../../../../contracts/api/v2/fixtures/list_watch_tonight_cards_ok.json";
 
 import { setProfileId } from "@/api/client";
+import { mediaSurfaceKeys } from "./keys";
 import { installPolicyStorageMocks, jsonResponse } from "@/pages/admin-policy/policyTestUtils";
 
 import {
   useDiscover,
   useRecommendationSection,
   useSimilarItems,
-  useSwipeCards,
   useTasteProfile,
 } from "./recommendations";
 import { useSubmitTasteSeed, useTasteSeedItems } from "./tasteSeed";
@@ -123,68 +122,6 @@ describe("recommendation reads on the v2 contract", () => {
     expect(result.current.data?.signal_counts).toEqual(getTasteProfileOk.signal_counts);
     expect(result.current.data?.updated_at).toBe(getTasteProfileOk.updated_at);
   });
-
-  it("pages swipe cards by excluded ids sent as repeated query keys", async () => {
-    const fetchMock = stubFetch(() => jsonResponse(listWatchTonightCardsOk));
-
-    const { result } = renderHook(() => useSwipeCards(true, "discover", ["Crime", "Action"]), {
-      wrapper: createWrapper(),
-    });
-    await waitFor(() => expect(result.current.isSuccess).toBe(true));
-
-    const url = requestedUrl(fetchMock);
-    expect(url.pathname).toBe("/api/v2/recommendations/watch-tonight/cards");
-    expect(url.searchParams.get("mode")).toBe("discover");
-    expect(url.searchParams.getAll("genres")).toEqual(["Action", "Crime"]);
-
-    const page = result.current.data?.pages[0];
-    expect(page?.has_more).toBe(listWatchTonightCardsOk.has_more);
-    expect(page?.cards.map((c) => c.content_id)).toEqual(
-      listWatchTonightCardsOk.items.map((c) => c.content_id),
-    );
-    expect(page?.cards[0]?.cast).toEqual(listWatchTonightCardsOk.items[0]?.cast);
-    expect(result.current.hasNextPage).toBe(listWatchTonightCardsOk.has_more);
-
-    await result.current.fetchNextPage();
-    await waitFor(() => expect(fetchMock.mock.calls.length).toBe(2));
-    expect(requestedUrl(fetchMock, 1).searchParams.getAll("exclude_ids")).toEqual(
-      listWatchTonightCardsOk.items.map((c) => c.content_id),
-    );
-  });
-  it("stops a limited swipe session before exclusion requests exceed the schema", async () => {
-    const fetchMock = stubFetch((url) => {
-      const prior = url.searchParams.getAll("exclude_ids");
-      expect(prior.length).toBeLessThanOrEqual(200);
-      const count = Math.min(12, 200 - prior.length);
-      return jsonResponse({
-        ...listWatchTonightCardsOk,
-        items: Array.from({ length: count }, (_, i) => ({
-          ...listWatchTonightCardsOk.items[0],
-          content_id: `movie:${prior.length + i}`,
-        })),
-        has_more: true,
-        paging_limited: prior.length + count === 200,
-      });
-    });
-    const { result } = renderHook(() => useSwipeCards(true, "discover", []), {
-      wrapper: createWrapper(),
-    });
-    await waitFor(() => expect(result.current.isSuccess).toBe(true));
-    expect(result.current.data?.pages[0]?.cards).toHaveLength(12);
-    expect(result.current.hasNextPage).toBe(true);
-    for (let page = 1; page < 17; page++) {
-      await act(async () => {
-        const fetched = await result.current.fetchNextPage();
-        expect(fetched.error).toBeNull();
-      });
-      await waitFor(() => expect(result.current.data?.pages).toHaveLength(page + 1));
-    }
-    expect(result.current.data?.pages.flatMap((page) => page.cards)).toHaveLength(200);
-    expect(result.current.data?.pages[result.current.data.pages.length - 1]?.has_more).toBe(true);
-    expect(result.current.hasNextPage).toBe(false);
-    await result.current.fetchNextPage();
-    expect(fetchMock).toHaveBeenCalledTimes(17);
-  });
 });
 
 describe("taste seeding on the v2 contract", () => {
@@ -227,4 +164,81 @@ describe("taste seeding on the v2 contract", () => {
       item_ids: ["movie:heat-1995"],
     });
   });
+
+  // The server answers once the profile's refresh finished or after a few
+  // seconds; the recommendation reads are refetched again later so a slower
+  // refresh still shows up. Home, which reloads every section on a bump, is
+  // bumped on success and once more with the last refetch.
+  function renderSubmit() {
+    const client = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+    const invalidate = vi.spyOn(client, "invalidateQueries");
+    const recInvalidations = () =>
+      invalidate.mock.calls.filter(([filters]) => filters?.queryKey?.[0] === "recommendations")
+        .length;
+    const setData = vi.spyOn(client, "setQueryData");
+    const signalKey = JSON.stringify(mediaSurfaceKeys.refreshSignal());
+    const homeBumps = () =>
+      setData.mock.calls.filter(([key]) => JSON.stringify(key) === signalKey).length;
+    const { result } = renderHook(() => useSubmitTasteSeed(), {
+      wrapper: ({ children }: { children: ReactNode }) =>
+        createElement(QueryClientProvider, { client }, children),
+    });
+    return { result, recInvalidations, homeBumps };
+  }
+
+  it("refetches the recommendation reads again after a submission", async () => {
+    stubFetch(() => jsonResponse(createTasteSeedOk));
+    const { result, recInvalidations, homeBumps } = renderSubmit();
+
+    vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout"] });
+    try {
+      await result.current.mutateAsync(["movie:heat-1995"]);
+      expect(recInvalidations()).toBe(1);
+      expect(homeBumps()).toBe(1);
+
+      await vi.advanceTimersByTimeAsync(3_000);
+      expect(recInvalidations()).toBe(2);
+      await vi.advanceTimersByTimeAsync(12_000);
+      expect(recInvalidations()).toBe(3);
+      await vi.advanceTimersByTimeAsync(30_000);
+      expect(recInvalidations()).toBe(4);
+      await vi.advanceTimersByTimeAsync(80_000);
+      expect(recInvalidations()).toBe(5);
+      expect(homeBumps()).toBe(1);
+      // The last refetch comes after two of the server's two-minute refresh
+      // timeouts: a refresh and the rerun the submission asked for.
+      await vi.advanceTimersByTimeAsync(120_000);
+      expect(recInvalidations()).toBe(6);
+      expect(homeBumps()).toBe(2);
+      await vi.advanceTimersByTimeAsync(300_000);
+      expect(recInvalidations()).toBe(6);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  // A second submission replaces the first one's refetches rather than
+  // adding its own, and a profile switch cancels what is left.
+  it("keeps one refetch schedule and drops it on a profile switch", async () => {
+    stubFetch(() => jsonResponse(createTasteSeedOk));
+    const { result, recInvalidations, homeBumps } = renderSubmit();
+
+    vi.useFakeTimers({ toFake: ["setTimeout", "clearTimeout"] });
+    try {
+      await result.current.mutateAsync(["movie:heat-1995"]);
+      await vi.advanceTimersByTimeAsync(1_000);
+      await result.current.mutateAsync(["movie:alien-1979"]);
+      expect(recInvalidations()).toBe(2);
+
+      await vi.advanceTimersByTimeAsync(3_000);
+      expect(recInvalidations()).toBe(3);
+
+      setProfileId("p-kid");
+      await vi.advanceTimersByTimeAsync(300_000);
+      expect(recInvalidations()).toBe(3);
+      expect(homeBumps()).toBe(2);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
 });
diff --git a/web/src/hooks/queries/recommendations.ts b/web/src/hooks/queries/recommendations.ts
index 0cb9867aaf..d663c989d6 100644
--- a/web/src/hooks/queries/recommendations.ts
+++ b/web/src/hooks/queries/recommendations.ts
@@ -1,13 +1,10 @@
-import { useInfiniteQuery, useQuery } from "@tanstack/react-query";
+import { useQuery } from "@tanstack/react-query";
 import { catalogItemFromV2, type CatalogCardItem } from "@/api/v2/catalog";
 import {
   type DiscoverResponse,
   type RecommendationSectionResponse,
   discoverFromV2,
-  discoverRowFromV2,
   recommendationSectionFromV2,
-  swipeCardsPageFromV2,
-  watchTonightFromV2,
 } from "@/api/v2/recommendations";
 import { v2, type V2PathParams, type V2Result } from "@/api/v2/request";
 import { recKeys } from "./keys";
@@ -41,49 +38,6 @@ export function useSimilarItems(itemId: string) {
   });
 }
 
-export function useForYouMain(enabled = true) {
-  return useQuery({
-    queryKey: recKeys.forYouMain(),
-    queryFn: ({ signal }) =>
-      v2("GET /api/v2/recommendations/for-you/main", { signal }).then(discoverRowFromV2),
-    staleTime: 300_000,
-    enabled,
-  });
-}
-
-export function useForYouRows(enabled = true) {
-  return useQuery({
-    queryKey: recKeys.forYouRows(),
-    queryFn: ({ signal }): Promise<DiscoverResponse> =>
-      v2("GET /api/v2/recommendations/for-you/rows", { signal }).then(discoverFromV2),
-    staleTime: 300_000,
-    enabled,
-  });
-}
-
-export function useBecauseWatched(itemId: string) {
-  return useQuery({
-    queryKey: recKeys.becauseWatched(itemId),
-    queryFn: ({ signal }): Promise<RecommendationResponse> =>
-      v2("GET /api/v2/recommendations/because-watched/{item_id}", {
-        path: { item_id: itemId },
-        signal,
-      }).then(cardList),
-    staleTime: 300_000,
-    enabled: !!itemId,
-  });
-}
-
-export function useSimilarUsers(enabled = true) {
-  return useQuery({
-    queryKey: recKeys.similarUsers(),
-    queryFn: ({ signal }): Promise<RecommendationResponse> =>
-      v2("GET /api/v2/recommendations/similar-users", { signal }).then(cardList),
-    staleTime: 300_000,
-    enabled,
-  });
-}
-
 export function useTasteProfile() {
   return useQuery({
     queryKey: recKeys.tasteProfile(),
@@ -93,15 +47,6 @@ export function useTasteProfile() {
   });
 }
 
-export function usePopular(days?: number) {
-  return useQuery({
-    queryKey: [...recKeys.all, "popular", days ?? 30],
-    queryFn: ({ signal }): Promise<RecommendationResponse> =>
-      v2("GET /api/v2/recommendations/popular", { query: { days }, signal }).then(cardList),
-    staleTime: 600_000,
-  });
-}
-
 export function useDiscover() {
   return useQuery({
     queryKey: recKeys.discover(),
@@ -147,9 +92,6 @@ export function useRecommendationSection(kind: string | undefined, key?: string)
   });
 }
 
-export type WatchTonightResponse = ReturnType<typeof watchTonightFromV2>;
-export type WatchTonightItem = WatchTonightResponse["items"][number];
-
 export function useRecentlyAdded(days?: number) {
   return useQuery({
     queryKey: [...recKeys.all, "recently-added", days ?? 14],
@@ -158,34 +100,3 @@ export function useRecentlyAdded(days?: number) {
     staleTime: 600_000,
   });
 }
-
-// --- Swipe Cards (gamified Watch Tonight) ---
-
-export type SwipeMode = "continue" | "discover";
-
-export type SwipeCardsPage = ReturnType<typeof swipeCardsPageFromV2>;
-export type SwipeCard = SwipeCardsPage["cards"][number];
-export type SwipeCardCastMember = SwipeCard["cast"][number];
-
-export function useSwipeCards(enabled: boolean, mode: SwipeMode, genres: string[]) {
-  return useInfiniteQuery({
-    queryKey: recKeys.watchTonightCards(mode, genres),
-    queryFn: ({ pageParam, signal }: { pageParam: string[]; signal?: AbortSignal }) =>
-      v2("GET /api/v2/recommendations/watch-tonight/cards", {
-        query: {
-          mode,
-          limit: 12,
-          genres: [...genres].sort(),
-          exclude_ids: pageParam,
-        },
-        signal,
-      }).then(swipeCardsPageFromV2),
-    initialPageParam: [] as string[],
-    getNextPageParam: (lastPage, allPages) => {
-      if (!lastPage.has_more || lastPage.paging_limited) return undefined;
-      return [...new Set(allPages.flatMap((p) => p.cards.map((c) => c.content_id)))];
-    },
-    staleTime: 0,
-    enabled,
-  });
-}
diff --git a/web/src/hooks/queries/seasonalThemes.ts b/web/src/hooks/queries/seasonalThemes.ts
new file mode 100644
index 0000000000..5cf43a9b06
--- /dev/null
+++ b/web/src/hooks/queries/seasonalThemes.ts
@@ -0,0 +1,16 @@
+import { useQuery } from "@tanstack/react-query";
+import { v2 } from "@/api/v2/request";
+import type { components } from "@/api/v2/schema";
+
+export type SeasonalThemeCatalog = components["schemas"]["SeasonalThemeCatalog"];
+export type SeasonalTheme = components["schemas"]["SeasonalTheme"];
+export type SeasonalVibe = components["schemas"]["SeasonalVibe"];
+
+/** The holidays a Seasonal Picks row can follow, with their vibes. Static per server build. */
+export function useSeasonalThemes() {
+  return useQuery({
+    queryKey: ["sections", "seasonal-themes"],
+    queryFn: () => v2("GET /api/v2/sections/seasonal-themes"),
+    staleTime: Infinity,
+  });
+}
diff --git a/web/src/hooks/queries/sections.ts b/web/src/hooks/queries/sections.ts
index 2d55584cf3..38fa151a4d 100644
--- a/web/src/hooks/queries/sections.ts
+++ b/web/src/hooks/queries/sections.ts
@@ -14,6 +14,7 @@ import {
   fetchAdminSectionCapabilities,
   deleteAdminSection,
   restoreAdminSections,
+  restoreLibraryPages,
   type AdminSectionDeleteTarget,
 } from "@/api/adminSections";
 import { sectionFromV2 } from "@/api/v2/catalog";
@@ -329,12 +330,22 @@ export function resetProfileSectionOverrides(params: {
   });
 }
 
+/**
+ * Restores one page over its captured version; a 412 there stops before any
+ * other page changes. Then restores `alsoLibraryIds` and returns their failures.
+ */
 export function useRestoreDefaultSections() {
   const qc = useQueryClient();
   return useMutation({
     retry: false,
     mutationKey: sectionKeys.adminWrite(),
-    mutationFn: restoreAdminSections,
+    mutationFn: async ({
+      alsoLibraryIds = [],
+      ...page
+    }: Parameters<typeof restoreAdminSections>[0] & { alsoLibraryIds?: readonly number[] }) => {
+      await restoreAdminSections(page);
+      return restoreLibraryPages(alsoLibraryIds, page.reset_profiles);
+    },
     onSuccess: () => {
       void qc.invalidateQueries({ queryKey: sectionKeys.all });
     },
diff --git a/web/src/hooks/queries/settingValues.ts b/web/src/hooks/queries/settingValues.ts
index 75a0e6218c..38a5ddac59 100644
--- a/web/src/hooks/queries/settingValues.ts
+++ b/web/src/hooks/queries/settingValues.ts
@@ -14,6 +14,7 @@ import { useEventChannel } from "@/components/realtimeEventsContext";
 import type { ShortcutTarget } from "@/lib/uiCustomization";
 import { bumpHomeRefreshSignal } from "@/pages/homeSurfaceRefresh";
 import { deviceKeys, libraryKeys, sectionKeys, settingsKeys } from "./keys";
+import { refreshLocalizedMediaQueries } from "./mediaSurfaceRefresh";
 
 /**
  * Typed access to the canonical settings API.
@@ -432,8 +433,14 @@ function shouldReconcileAfterMutationError(error: unknown): boolean {
   return !isDefinitiveSettingMutationRejection(error);
 }
 
+// Profile preferences that change which cards Home's rows hold or their order.
+const HOME_REFRESH_KEYS: ReadonlySet<string> = new Set([
+  SETTING_KEYS.HOME_HIDE_WATCHED_ITEMS,
+  SETTING_KEYS.UI_NEXT_UP_NEW_RELEASES_FIRST,
+]);
+
 function refreshHomeForSetting(queryClient: ReturnType<typeof useQueryClient>, key?: string) {
-  if (key !== SETTING_KEYS.HOME_HIDE_WATCHED_ITEMS) return;
+  if (!key || !HOME_REFRESH_KEYS.has(key)) return;
   // Home uses observer-less fetchQuery calls. Mark its data stale before
   // resetting the load queue, including when the settings screen has unmounted.
   return queryClient
@@ -449,6 +456,23 @@ function refreshLibrariesForSetting(queryClient: ReturnType<typeof useQueryClien
   return queryClient.invalidateQueries({ queryKey: libraryKeys.all });
 }
 
+const METADATA_LANGUAGE_KEYS: ReadonlySet<string> = new Set([
+  SETTING_KEYS.CATALOG_METADATA_LANGUAGE,
+  SETTING_KEYS.CATALOG_METADATA_LANGUAGE_OVERRIDES,
+]);
+
+// The metadata language decides the localized titles and descriptions in the
+// media reads (catalog, home sections, people, collections, episodes). The
+// write does not wait for their refetch, so the settings controls unlock as
+// soon as the value is saved.
+function refreshLocalizedMediaForSetting(
+  queryClient: ReturnType<typeof useQueryClient>,
+  key?: string,
+) {
+  if (!key || !METADATA_LANGUAGE_KEYS.has(key)) return;
+  return refreshLocalizedMediaQueries(queryClient);
+}
+
 /** Refreshes the reads a setting write changes, as useSetSettingValue does. */
 export function invalidateSettingValueQueries(
   queryClient: ReturnType<typeof useQueryClient>,
@@ -459,6 +483,7 @@ export function invalidateSettingValueQueries(
     queryClient.invalidateQueries({ queryKey: [...settingsKeys.all, "values"] }),
     refreshHomeForSetting(queryClient, key),
     refreshLibrariesForSetting(queryClient, key),
+    refreshLocalizedMediaForSetting(queryClient, key),
   ];
   // A device-scoped write changes that device's "how many things differ"
   // count, which the device list shows. Without this the badge stays stale
@@ -591,7 +616,10 @@ export type SettingsCapabilities = Pick<
   Partial<
     Pick<
       V2Result<"GET /api/v2/settings/contract/capabilities">,
-      "supports_batched_effective" | "supports_idempotent_writes" | "supports_atomic_shortcuts"
+      | "supports_batched_effective"
+      | "supports_idempotent_writes"
+      | "supports_atomic_shortcuts"
+      | "supports_device_rename"
     >
   >;
 
@@ -704,6 +732,7 @@ export function useSettingValuesRealtime() {
         qc.invalidateQueries({ queryKey: [...settingsKeys.all, "values"] });
         void refreshHomeForSetting(qc, event.data?.key);
         void refreshLibrariesForSetting(qc, event.data?.key);
+        void refreshLocalizedMediaForSetting(qc, event.data?.key);
       },
     }),
     [qc],
diff --git a/web/src/hooks/queries/settingValuesMutations.test.tsx b/web/src/hooks/queries/settingValuesMutations.test.tsx
index 7eb9a925e6..1ed56544ec 100644
--- a/web/src/hooks/queries/settingValuesMutations.test.tsx
+++ b/web/src/hooks/queries/settingValuesMutations.test.tsx
@@ -1,11 +1,25 @@
-import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { QueryClient, QueryClientProvider, useQuery } from "@tanstack/react-query";
 import { act, renderHook, waitFor } from "@testing-library/react";
 import type { ReactNode } from "react";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 import { v2Problem } from "@/api/v2/problems.test-support";
 import { SETTING_KEYS } from "@/lib/settingsContract";
-import { deviceKeys, libraryKeys, mediaSurfaceKeys, sectionKeys, settingsKeys } from "./keys";
+import {
+  adminKeys,
+  catalogKeys,
+  deviceKeys,
+  libraryKeys,
+  mediaSurfaceKeys,
+  sectionKeys,
+  settingsKeys,
+  shuffleKeys,
+} from "./keys";
+import type { LibraryCollection } from "@/api/types";
+import { serverCollectionPeek } from "@/lib/collections/peek";
+import { adminPeekKey, profilePeekKey } from "@/lib/homeRows/peek";
+import type { HomeRow } from "@/lib/homeRows/types";
+import { pickerKeys } from "@/pages/watchtogether/room/picker/usePickerData";
 import { useClearSettingValue, useSetSettingValue } from "./settingValues";
 
 const v2Mock = vi.hoisted(() => vi.fn());
@@ -62,6 +76,24 @@ describe("typed setting mutations", () => {
     },
   );
 
+  it("refreshes Home when Show new episodes first changes", async () => {
+    v2Mock.mockResolvedValueOnce({});
+    const { queryClient, wrapper } = createHarness();
+    const homeKey = sectionKeys.homeItems("continue-watching");
+    queryClient.setQueryData(homeKey, { section: { items: [] } });
+    queryClient.setQueryData(mediaSurfaceKeys.refreshSignal(), 0);
+    const { result } = renderHook(() => useSetSettingValue(), { wrapper });
+    await act(async () => {
+      await result.current.mutateAsync({
+        key: SETTING_KEYS.UI_NEXT_UP_NEW_RELEASES_FIRST,
+        value: true,
+        identity: { scope: "profile" },
+      });
+    });
+    expect(queryClient.getQueryState(homeKey)?.isInvalidated).toBe(true);
+    expect(queryClient.getQueryData(mediaSurfaceKeys.refreshSignal())).toBe(1);
+  });
+
   it("refreshes Home when the preference is cleared", async () => {
     v2Mock.mockResolvedValueOnce({});
     const { queryClient, wrapper } = createHarness();
@@ -78,6 +110,31 @@ describe("typed setting mutations", () => {
     expect(queryClient.getQueryData(mediaSurfaceKeys.refreshSignal())).toBe(1);
   });
 
+  it.each([
+    SETTING_KEYS.CATALOG_METADATA_LANGUAGE,
+    SETTING_KEYS.CATALOG_METADATA_LANGUAGE_OVERRIDES,
+  ])("refreshes Home and library rows when %s changes", async (key) => {
+    v2Mock.mockResolvedValueOnce({});
+    const { queryClient, wrapper } = createHarness();
+    const homeKey = sectionKeys.homeItems("featured");
+    const libraryKey = sectionKeys.libraryItems(7, "featured");
+    queryClient.setQueryData(homeKey, { section: { items: [] } });
+    queryClient.setQueryData(libraryKey, { section: { items: [] } });
+    const { result } = renderHook(() => useSetSettingValue(), { wrapper });
+    await act(async () => {
+      await result.current.mutateAsync({
+        key,
+        value: key === SETTING_KEYS.CATALOG_METADATA_LANGUAGE ? "fr" : { ja: "original" },
+        identity: { scope: "profile" },
+      });
+    });
+    // Section cards carry localized text, so a cached German Home would
+    // otherwise stay German after switching to French.
+    expect(queryClient.getQueryState(homeKey)?.isInvalidated).toBe(true);
+    expect(queryClient.getQueryState(libraryKey)?.isInvalidated).toBe(true);
+    expect(queryClient.getQueryData(mediaSurfaceKeys.refreshSignal())).toBe(1);
+  });
+
   it("keeps Home cached after an unrelated setting changes", async () => {
     v2Mock.mockResolvedValueOnce({});
     const { queryClient, wrapper } = createHarness();
@@ -119,6 +176,195 @@ describe("typed setting mutations", () => {
     expect(queryClient.getQueryState(librariesKey)?.isInvalidated).toBe(true);
   });
 
+  it.each([
+    SETTING_KEYS.CATALOG_METADATA_LANGUAGE,
+    SETTING_KEYS.CATALOG_METADATA_LANGUAGE_OVERRIDES,
+  ])("marks localized media stale when %s changes", async (key) => {
+    v2Mock.mockResolvedValueOnce({});
+    const { queryClient, wrapper } = createHarness();
+    const detailKey = catalogKeys.itemDetail("movie-1");
+    const homeKey = sectionKeys.homeItems("recent");
+    queryClient.setQueryData(detailKey, { content_id: "movie-1", overview: "English" });
+    queryClient.setQueryData(homeKey, { section: { items: [] } });
+    queryClient.setQueryData(mediaSurfaceKeys.refreshSignal(), 0);
+    const { result } = renderHook(() => useSetSettingValue(), { wrapper });
+    await act(async () => {
+      await result.current.mutateAsync({ key, value: "de", identity: { scope: "profile" } });
+    });
+    expect(queryClient.getQueryState(detailKey)?.isInvalidated).toBe(true);
+    expect(queryClient.getQueryState(homeKey)?.isInvalidated).toBe(true);
+    // The home signal is bumped, not reset by its own invalidation.
+    expect(queryClient.getQueryState(mediaSurfaceKeys.refreshSignal())?.isInvalidated).toBe(false);
+    expect(queryClient.getQueryData(mediaSurfaceKeys.refreshSignal())).toBe(1);
+  });
+
+  it("marks shuffle, Home-row editor and Watch Together picker cards stale, not room presence", async () => {
+    v2Mock.mockResolvedValueOnce({});
+    const { queryClient, wrapper } = createHarness();
+    const page = { kind: "home" } as const;
+    const row = {
+      id: "row-1",
+      sectionType: "recently_added",
+      config: {},
+      itemLimit: 20,
+    } as HomeRow;
+    const localized = [
+      shuffleKeys.detail("shuffle-1"),
+      adminPeekKey(page, row),
+      profilePeekKey(page, row),
+      ["home-row-preview", "home", "{}", 12],
+      ["curatedListPicker", "alien"],
+      serverCollectionPeek(
+        { id: "collection-1", updated_at: "2026-10-14" } as LibraryCollection,
+        3,
+        false,
+      ).queryKey,
+      pickerKeys.rows("room-1", []),
+      pickerKeys.search("alien"),
+      pickerKeys.recent("movie"),
+    ];
+    const presenceKey = ["watch-party", "presence", "room-1", null];
+    for (const key of [...localized, presenceKey]) queryClient.setQueryData(key, {});
+    const { result } = renderHook(() => useSetSettingValue(), { wrapper });
+    await act(async () => {
+      await result.current.mutateAsync({
+        key: SETTING_KEYS.CATALOG_METADATA_LANGUAGE,
+        value: "fr",
+        identity: { scope: "profile" },
+      });
+    });
+    for (const key of localized) {
+      expect(queryClient.getQueryState(key)?.isInvalidated).toBe(true);
+    }
+    expect(queryClient.getQueryState(presenceKey)?.isInvalidated).toBe(false);
+  });
+
+  it("cancels a Home row still loading in the old language", async () => {
+    v2Mock.mockResolvedValueOnce({});
+    const { queryClient, wrapper } = createHarness();
+    const homeKey = sectionKeys.homeItems("recent");
+    let resolveRow!: (value: object) => void;
+    const loading = queryClient
+      .fetchQuery({
+        queryKey: homeKey,
+        queryFn: () => new Promise<object>((resolve) => (resolveRow = resolve)),
+      })
+      .catch(() => undefined);
+    const { result } = renderHook(() => useSetSettingValue(), { wrapper });
+    await act(async () => {
+      await result.current.mutateAsync({
+        key: SETTING_KEYS.CATALOG_METADATA_LANGUAGE,
+        value: "fr",
+        identity: { scope: "profile" },
+      });
+    });
+    resolveRow({ section: { items: [{ overview: "Deutsch" }] } });
+    await loading;
+    // The old-language answer did not land as fresh data.
+    expect(queryClient.getQueryData(homeKey)).toBeUndefined();
+  });
+
+  it("cancels a detail read still loading in the old language", async () => {
+    v2Mock.mockResolvedValueOnce({});
+    const { queryClient, wrapper } = createHarness();
+    const detailKey = catalogKeys.itemDetail("movie-1");
+    let resolveDetail!: (value: object) => void;
+    const loading = queryClient
+      .prefetchQuery({
+        queryKey: detailKey,
+        queryFn: () => new Promise<object>((resolve) => (resolveDetail = resolve)),
+      })
+      .catch(() => undefined);
+    const { result } = renderHook(() => useSetSettingValue(), { wrapper });
+    await act(async () => {
+      await result.current.mutateAsync({
+        key: SETTING_KEYS.CATALOG_METADATA_LANGUAGE,
+        value: "fr",
+        identity: { scope: "profile" },
+      });
+    });
+    resolveDetail({ content_id: "movie-1", overview: "Deutsch" });
+    await loading;
+    expect(queryClient.getQueryData(detailKey)).toBeUndefined();
+  });
+
+  it("leaves client-only admin state alone", async () => {
+    v2Mock.mockResolvedValueOnce({});
+    const { queryClient, wrapper } = createHarness();
+    const scan = { id: "scan-1", status: "running" };
+    // Fed only by the events socket; a refetch would replace it with [].
+    const queryFn = vi.fn(() => Promise.resolve([] as object[]));
+    renderHook(
+      () =>
+        useQuery({
+          queryKey: adminKeys.activeScans(),
+          queryFn,
+          initialData: [scan],
+          staleTime: Infinity,
+        }),
+      { wrapper },
+    );
+    const { result } = renderHook(() => useSetSettingValue(), { wrapper });
+    await act(async () => {
+      await result.current.mutateAsync({
+        key: SETTING_KEYS.CATALOG_METADATA_LANGUAGE,
+        value: "fr",
+        identity: { scope: "profile" },
+      });
+    });
+    await act(async () => {
+      await Promise.resolve();
+    });
+    expect(queryFn).not.toHaveBeenCalled();
+    expect(queryClient.getQueryData(adminKeys.activeScans())).toEqual([scan]);
+  });
+
+  it("settles the write without waiting for mounted screens to refetch", async () => {
+    v2Mock.mockResolvedValueOnce({});
+    const { queryClient, wrapper } = createHarness();
+    const detailKey = catalogKeys.itemDetail("movie-1");
+    let calls = 0;
+    const { result: detail } = renderHook(
+      () =>
+        useQuery({
+          queryKey: detailKey,
+          // The first read answers; the refetch never does.
+          queryFn: () =>
+            calls++ === 0
+              ? Promise.resolve({ content_id: "movie-1" })
+              : new Promise<object>(() => undefined),
+        }),
+      { wrapper },
+    );
+    await waitFor(() => expect(detail.current.data).toBeDefined());
+    const { result } = renderHook(() => useSetSettingValue(), { wrapper });
+    await act(async () => {
+      await result.current.mutateAsync({
+        key: SETTING_KEYS.CATALOG_METADATA_LANGUAGE,
+        value: "fr",
+        identity: { scope: "profile" },
+      });
+    });
+    expect(result.current.isPending).toBe(false);
+    expect(queryClient.getQueryState(detailKey)?.fetchStatus).toBe("fetching");
+  });
+
+  it("keeps catalog reads cached after an unrelated setting changes", async () => {
+    v2Mock.mockResolvedValueOnce({});
+    const { queryClient, wrapper } = createHarness();
+    const detailKey = catalogKeys.itemDetail("movie-1");
+    queryClient.setQueryData(detailKey, { content_id: "movie-1" });
+    const { result } = renderHook(() => useSetSettingValue(), { wrapper });
+    await act(async () => {
+      await result.current.mutateAsync({
+        key: SETTING_KEYS.UI_THEME,
+        value: "dark",
+        identity: { scope: "profile" },
+      });
+    });
+    expect(queryClient.getQueryState(detailKey)?.isInvalidated).toBe(false);
+  });
+
   it("does not invalidate effective settings after a definitive rejected write", async () => {
     v2Mock.mockRejectedValueOnce(v2Problem(429, "rate_limited", "rate limited"));
     const { queryClient, wrapper } = createHarness();
diff --git a/web/src/hooks/queries/subtitleAppearance.test.tsx b/web/src/hooks/queries/subtitleAppearance.test.tsx
index 9de6a98575..0f6e711f6e 100644
--- a/web/src/hooks/queries/subtitleAppearance.test.tsx
+++ b/web/src/hooks/queries/subtitleAppearance.test.tsx
@@ -6,6 +6,7 @@ import { renderHook, waitFor } from "@testing-library/react";
 import { v2Problem } from "@/api/v2/problems.test-support";
 import { DEFAULT_SUBTITLE_APPEARANCE } from "@/lib/subtitleAppearance";
 import { SETTING_KEYS } from "@/lib/settingsContract";
+import { resolveSettingValues, type StoredSettingRow } from "@/lib/settingsResolve";
 import { useSubtitleAppearanceSetting } from "./subtitleAppearance";
 
 const v2Mock = vi.hoisted(() => vi.fn());
@@ -14,6 +15,8 @@ vi.mock("@/api/v2/request", async () => {
   return { ...actual, v2: v2Mock };
 });
 
+const KEY = SETTING_KEYS.PLAYBACK_SUBTITLE_APPEARANCE;
+
 function createHarness() {
   const queryClient = new QueryClient({
     defaultOptions: { queries: { retry: false }, mutations: { retry: false } },
@@ -24,110 +27,137 @@ function createHarness() {
   return { queryClient, wrapper };
 }
 
-/** The effective response the server sends for one resolved key. */
-function effectiveResponse(value: unknown, source: string) {
-  return {
-    revision: 1,
-    items: [
-      { key: SETTING_KEYS.PLAYBACK_SUBTITLE_APPEARANCE, value, source, definition_revision: 1 },
-    ],
-  };
+/**
+ * A server stand-in that resolves through the shared client resolver, which
+ * mirrors internal/settingsresolve, so a profile_device row really does
+ * outrank a profile row here.
+ */
+function fakeSettingsServer(initial: StoredSettingRow[] = []) {
+  const rows = [...initial];
+  v2Mock.mockImplementation(
+    (
+      operation: string,
+      options?: { path?: { key: string }; query?: { scope: string }; body?: { value: unknown } },
+    ) => {
+      if (operation === "GET /api/v2/settings/values/effective") {
+        const resolved = resolveSettingValues([KEY], rows, {
+          profileId: "profile-1",
+          deviceId: "device-1",
+        })[0]!;
+        return Promise.resolve({
+          revision: 1,
+          items: [
+            { key: KEY, value: resolved.value, source: resolved.source, definition_revision: 1 },
+          ],
+        });
+      }
+      const key = options?.path?.key;
+      const scope = options?.query?.scope;
+      if (!key || !scope) return Promise.resolve(undefined);
+      const index = rows.findIndex((row) => row.key === key && row.scope === scope);
+      if (operation.startsWith("DELETE ")) {
+        if (index < 0) {
+          return Promise.reject(v2Problem(404, "not_found", "No value is set at this scope"));
+        }
+        rows.splice(index, 1);
+        return Promise.resolve(undefined);
+      }
+      const row: StoredSettingRow = {
+        key,
+        scope: scope as StoredSettingRow["scope"],
+        profileId: "profile-1",
+        deviceId: scope === "profile_device" ? "device-1" : undefined,
+        value: options?.body?.value,
+      };
+      if (index < 0) rows.push(row);
+      else rows[index] = row;
+      return Promise.resolve(undefined);
+    },
+  );
+  return rows;
 }
 
+const XLARGE = { ...DEFAULT_SUBTITLE_APPEARANCE, fontSize: "xlarge" as const };
+
 describe("useSubtitleAppearanceSetting", () => {
   beforeEach(() => {
     v2Mock.mockReset();
   });
 
-  it("saves the device override at profile_device scope", async () => {
-    v2Mock.mockImplementation((operation: string) => {
-      if (operation === "GET /api/v2/settings/values/effective") {
-        return Promise.resolve(effectiveResponse(DEFAULT_SUBTITLE_APPEARANCE, "default"));
-      }
-      return Promise.resolve(undefined);
-    });
-
+  it("saves at profile scope so the appearance follows the profile to every device", async () => {
+    const rows = fakeSettingsServer();
     const { wrapper } = createHarness();
-    const { result } = renderHook(() => useSubtitleAppearanceSetting(), {
-      wrapper,
-    });
-    await waitFor(() => expect(result.current.appearance.fontSize).toBe("large"));
-
-    await result.current.save({
-      ...DEFAULT_SUBTITLE_APPEARANCE,
-      fontSize: "xlarge",
-    });
-
-    const write = v2Mock.mock.calls.find(
-      ([operation]) => operation !== "GET /api/v2/settings/values/effective",
-    );
-    expect(write?.[0]).toBe("PUT /api/v2/settings/values/{key}");
-    expect(write?.[1]).toMatchObject({
-      path: { key: SETTING_KEYS.PLAYBACK_SUBTITLE_APPEARANCE },
-      query: { scope: "profile_device" },
-      // The contract types this value as an object, so the body carries the
-      // object itself rather than the JSON-encoded string the legacy route took.
-      body: { value: { ...DEFAULT_SUBTITLE_APPEARANCE, fontSize: "xlarge" } },
-    });
+    const { result } = renderHook(() => useSubtitleAppearanceSetting(), { wrapper });
+    await waitFor(() => expect(result.current.isLoading).toBe(false));
+
+    await result.current.save(XLARGE);
+
+    // The contract types this value as an object, so the body carries the
+    // object itself rather than a JSON-encoded string.
+    expect(rows).toEqual([expect.objectContaining({ key: KEY, scope: "profile", value: XLARGE })]);
   });
 
-  it("resets by clearing the device row so the profile value applies again", async () => {
-    v2Mock.mockImplementation((operation: string) => {
-      if (operation === "GET /api/v2/settings/values/effective") {
-        return Promise.resolve(effectiveResponse(DEFAULT_SUBTITLE_APPEARANCE, "profile_device"));
-      }
-      return Promise.resolve(undefined);
-    });
+  it("clears this browser's row so a save from an older per-device build stops winning", async () => {
+    const rows = fakeSettingsServer([
+      {
+        key: KEY,
+        scope: "profile_device",
+        profileId: "profile-1",
+        deviceId: "device-1",
+        value: { ...DEFAULT_SUBTITLE_APPEARANCE, fontSize: "small" },
+      },
+    ]);
+    const { wrapper } = createHarness();
+    const { result } = renderHook(() => useSubtitleAppearanceSetting(), { wrapper });
+    await waitFor(() => expect(result.current.appearance.fontSize).toBe("small"));
+
+    await result.current.save(XLARGE);
+
+    expect(rows).toEqual([expect.objectContaining({ scope: "profile", value: XLARGE })]);
+    await waitFor(() => expect(result.current.appearance.fontSize).toBe("xlarge"));
+  });
 
+  it("does not attempt a delete when nothing is shadowing the profile row", async () => {
+    fakeSettingsServer([{ key: KEY, scope: "profile", profileId: "profile-1", value: XLARGE }]);
     const { wrapper } = createHarness();
-    const { result } = renderHook(() => useSubtitleAppearanceSetting(), {
-      wrapper,
-    });
-    await waitFor(() => expect(result.current.hasDeviceOverride).toBe(true));
+    const { result } = renderHook(() => useSubtitleAppearanceSetting(), { wrapper });
+    await waitFor(() => expect(result.current.appearance.fontSize).toBe("xlarge"));
 
-    await result.current.reset();
+    await result.current.save(DEFAULT_SUBTITLE_APPEARANCE);
 
-    const write = v2Mock.mock.calls.find(
-      ([operation]) => operation !== "GET /api/v2/settings/values/effective",
+    const deletes = v2Mock.mock.calls.filter(([operation]) =>
+      String(operation).startsWith("DELETE "),
     );
-    expect(write?.[0]).toBe("DELETE /api/v2/settings/values/{key}");
-    expect(write?.[1]).toMatchObject({
-      path: { key: SETTING_KEYS.PLAYBACK_SUBTITLE_APPEARANCE },
-      query: { scope: "profile_device" },
-    });
+    expect(deletes).toHaveLength(0);
   });
 
-  it("reports no device override when the value resolved from a wider scope", async () => {
-    v2Mock.mockResolvedValue(effectiveResponse(DEFAULT_SUBTITLE_APPEARANCE, "profile"));
-
+  it("resets to the default by clearing both the profile and this browser's rows", async () => {
+    const rows = fakeSettingsServer([
+      { key: KEY, scope: "profile", profileId: "profile-1", value: XLARGE },
+      {
+        key: KEY,
+        scope: "profile_device",
+        profileId: "profile-1",
+        deviceId: "device-1",
+        value: XLARGE,
+      },
+    ]);
     const { wrapper } = createHarness();
-    const { result } = renderHook(() => useSubtitleAppearanceSetting(), {
-      wrapper,
-    });
+    const { result } = renderHook(() => useSubtitleAppearanceSetting(), { wrapper });
+    await waitFor(() => expect(result.current.isCustomized).toBe(true));
 
-    await waitFor(() => expect(result.current.isLoading).toBe(false));
-    expect(result.current.appearance.fontSize).toBe("large");
-    // A profile-wide appearance is not this device's override, so offering
-    // "reset this device" would be a no-op the user cannot see the effect of.
-    expect(result.current.hasDeviceOverride).toBe(false);
+    await result.current.reset();
+
+    expect(rows).toEqual([]);
+    await waitFor(() => expect(result.current.isCustomized).toBe(false));
+    expect(result.current.appearance).toEqual(DEFAULT_SUBTITLE_APPEARANCE);
   });
 
   it("treats a reset with nothing stored as already done", async () => {
-    v2Mock.mockImplementation((operation: string) => {
-      if (operation === "GET /api/v2/settings/values/effective") {
-        return Promise.resolve(effectiveResponse(DEFAULT_SUBTITLE_APPEARANCE, "profile_device"));
-      }
-      if (operation.startsWith("DELETE ")) {
-        return Promise.reject(v2Problem(404, "not_found", "No value is set at this scope"));
-      }
-      return Promise.resolve(undefined);
-    });
-
+    fakeSettingsServer();
     const { wrapper } = createHarness();
-    const { result } = renderHook(() => useSubtitleAppearanceSetting(), {
-      wrapper,
-    });
-    await waitFor(() => expect(result.current.hasDeviceOverride).toBe(true));
+    const { result } = renderHook(() => useSubtitleAppearanceSetting(), { wrapper });
+    await waitFor(() => expect(result.current.isLoading).toBe(false));
 
     // The canonical DELETE answers 404 for "nothing stored here", which for a
     // reset is the requested state rather than a failure.
diff --git a/web/src/hooks/queries/subtitleAppearance.ts b/web/src/hooks/queries/subtitleAppearance.ts
index d85b0fd319..c24dfae50a 100644
--- a/web/src/hooks/queries/subtitleAppearance.ts
+++ b/web/src/hooks/queries/subtitleAppearance.ts
@@ -1,87 +1,49 @@
 import { useCallback, useMemo } from "react";
-import {
-  isSettingValueMissing,
-  useClearSettingValue,
-  useEffectiveSettings,
-  useSetSettingValue,
-  type SettingIdentity,
-} from "@/hooks/queries/settingValues";
+import { useEffectiveSettings } from "@/hooks/queries/settingValues";
+import { useProfileDefaultWriter } from "@/hooks/queries/profileDefaults";
 import { SETTING_KEYS } from "@/lib/settingsContract";
 import { parseSubtitleAppearance, type SubtitleAppearance } from "@/lib/subtitleAppearance";
 
 /**
  * The one place subtitle appearance is read and written.
  *
- * The value used to live behind three bespoke endpoints
- * (/settings/subtitle_appearance/effective and the PUT/DELETE pair on
- * /settings/device/subtitle_appearance) that existed only because the legacy
- * string API had no way to express "this device's copy of an object-valued
- * setting". The contract does: playback.subtitle_appearance is an object typed
- * by the manifest, resolving profile_device → profile → default, so a device
- * override is an ordinary write at profile_device and "use the fallback" is an
- * ordinary delete at that scope.
+ * playback.subtitle_appearance resolves profile_device → profile → default.
+ * Appearance is a profile preference that follows the profile to every device,
+ * so both the settings screen and the in-player panel write the profile row.
+ * A device row outranks it, so the shared writer clears this browser's row on
+ * every save: otherwise a row written by an older web build (which saved per
+ * device) would keep winning here and the saved look would never show.
  *
  * Three surfaces render this value — the settings screen, the in-player panel,
- * and the cue renderer — and before the cutover each parsed the effective
- * response itself. Sharing one hook is what keeps them from disagreeing about
- * which scope a save lands at.
+ * and the cue renderer — and sharing one hook is what keeps them from
+ * disagreeing about which scope a save lands at.
  */
-
-/** Both the settings screen and the in-player panel override per device. */
-const DEVICE_SCOPE: SettingIdentity = { scope: "profile_device" };
+const KEY = SETTING_KEYS.PLAYBACK_SUBTITLE_APPEARANCE;
+const KEYS = [KEY];
 
 export function useSubtitleAppearanceSetting() {
-  const query = useEffectiveSettings({
-    keys: [SETTING_KEYS.PLAYBACK_SUBTITLE_APPEARANCE],
-  });
-  const setValue = useSetSettingValue();
-  const clearValue = useClearSettingValue();
+  const query = useEffectiveSettings({ keys: KEYS });
+  const writer = useProfileDefaultWriter(query.data);
 
-  const entry = query.data?.[SETTING_KEYS.PLAYBACK_SUBTITLE_APPEARANCE];
+  const entry = query.data?.[KEY];
   // The manifest default is the same object DEFAULT_SUBTITLE_APPEARANCE spells,
   // and the effective endpoint always answers, so an unset value arrives as the
   // default rather than as nothing to parse.
   const appearance = useMemo(() => parseSubtitleAppearance(entry?.value), [entry?.value]);
 
-  /**
-   * Whether this device holds its own override, which is what gates the
-   * "reset" affordance. The resolved scope names the row the value came from,
-   * so this needs no separate read of the stored value.
-   */
-  const hasDeviceOverride = entry?.source === "profile_device";
-
-  const save = useCallback(
-    (next: SubtitleAppearance) =>
-      setValue.mutateAsync({
-        key: SETTING_KEYS.PLAYBACK_SUBTITLE_APPEARANCE,
-        value: next,
-        identity: DEVICE_SCOPE,
-      }),
-    [setValue],
-  );
+  /** Whether a stored profile or device value differs from the contract default. */
+  const isCustomized = entry !== undefined && entry.source !== "default";
 
-  const reset = useCallback(async () => {
-    try {
-      await clearValue.mutateAsync({
-        key: SETTING_KEYS.PLAYBACK_SUBTITLE_APPEARANCE,
-        identity: DEVICE_SCOPE,
-      });
-    } catch (error) {
-      // Nothing stored at this scope is the state a reset asks for, so the
-      // canonical DELETE's 404 is success, matching how the legacy per-device
-      // delete behaved.
-      if (isSettingValueMissing(error)) return;
-      throw error;
-    }
-  }, [clearValue]);
+  const { save: saveKey, reset: resetKey } = writer;
+  const save = useCallback((next: SubtitleAppearance) => saveKey(KEY, next), [saveKey]);
+  const reset = useCallback(() => resetKey(KEY), [resetKey]);
 
   return {
     appearance,
-    hasDeviceOverride,
+    isCustomized,
     save,
     reset,
-    isSaving: setValue.isPending,
-    isResetting: clearValue.isPending,
+    isSaving: writer.isSaving,
     isLoading: query.isLoading,
   };
 }
diff --git a/web/src/hooks/queries/subtitleSync.test.tsx b/web/src/hooks/queries/subtitleSync.test.tsx
new file mode 100644
index 0000000000..f51f367d1d
--- /dev/null
+++ b/web/src/hooks/queries/subtitleSync.test.tsx
@@ -0,0 +1,183 @@
+import { describe, expect, it, vi, beforeEach } from "vitest";
+import type { ReactNode } from "react";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { act, renderHook, waitFor } from "@testing-library/react";
+
+import { v2Problem } from "@/api/v2/problems.test-support";
+import { SETTING_KEYS, SETTINGS_API_VERSION, SETTINGS_REVISION } from "@/lib/settingsContract";
+import { resolveSettingValues, type StoredSettingRow } from "@/lib/settingsResolve";
+import { useSubtitleSyncSetting } from "./subtitleSync";
+
+const v2Mock = vi.hoisted(() => vi.fn());
+vi.mock("@/api/v2/request", async () => {
+  const actual = await vi.importActual<typeof import("@/api/v2/request")>("@/api/v2/request");
+  return { ...actual, v2: v2Mock };
+});
+
+const KEY = SETTING_KEYS.PLAYER_SUBTITLE_SYNC_MS;
+
+function createHarness() {
+  const queryClient = new QueryClient({
+    defaultOptions: { queries: { retry: false }, mutations: { retry: false } },
+  });
+  const wrapper = ({ children }: { children: ReactNode }) => (
+    <QueryClientProvider client={queryClient}>{children}</QueryClientProvider>
+  );
+  return { queryClient, wrapper };
+}
+
+/**
+ * A server stand-in that resolves through the shared client resolver, which
+ * mirrors internal/settingsresolve, so a profile_device row really does
+ * outrank a profile row here.
+ */
+function fakeSettingsServer(
+  initial: StoredSettingRow[] = [],
+  manifestRevision = SETTINGS_REVISION,
+) {
+  const rows = [...initial];
+  v2Mock.mockImplementation(
+    (
+      operation: string,
+      options?: { path?: { key: string }; query?: { scope: string }; body?: { value: unknown } },
+    ) => {
+      if (operation === "GET /api/v2/settings/contract/capabilities") {
+        return Promise.resolve({
+          api_version: SETTINGS_API_VERSION,
+          manifest_revision: manifestRevision,
+          contract_etag: "etag",
+        });
+      }
+      if (operation === "GET /api/v2/settings/values/effective") {
+        const resolved = resolveSettingValues([KEY], rows, {
+          profileId: "profile-1",
+          deviceId: "device-1",
+        })[0]!;
+        return Promise.resolve({
+          revision: 1,
+          items: [
+            { key: KEY, value: resolved.value, source: resolved.source, definition_revision: 1 },
+          ],
+        });
+      }
+      const key = options?.path?.key;
+      const scope = options?.query?.scope;
+      if (!key || !scope) return Promise.resolve(undefined);
+      const index = rows.findIndex((row) => row.key === key && row.scope === scope);
+      if (operation.startsWith("DELETE ")) {
+        if (index < 0) {
+          return Promise.reject(v2Problem(404, "not_found", "No value is set at this scope"));
+        }
+        rows.splice(index, 1);
+        return Promise.resolve(undefined);
+      }
+      const row: StoredSettingRow = {
+        key,
+        scope: scope as StoredSettingRow["scope"],
+        profileId: "profile-1",
+        deviceId: scope === "profile_device" ? "device-1" : undefined,
+        value: options?.body?.value,
+      };
+      if (index < 0) rows.push(row);
+      else rows[index] = row;
+      return Promise.resolve(undefined);
+    },
+  );
+  return rows;
+}
+
+describe("useSubtitleSyncSetting", () => {
+  beforeEach(() => {
+    v2Mock.mockReset();
+  });
+
+  it("reads the profile's offset when this browser has none of its own", async () => {
+    fakeSettingsServer([{ key: KEY, scope: "profile", profileId: "profile-1", value: -750 }]);
+    const { wrapper } = createHarness();
+    const { result } = renderHook(() => useSubtitleSyncSetting(), { wrapper });
+
+    expect(result.current.isLoaded).toBe(false);
+    await waitFor(() => expect(result.current.offsetMs).toBe(-750));
+    expect(result.current.isLoaded).toBe(true);
+  });
+
+  it("saves at profile scope and clears a shadowing browser row", async () => {
+    const rows = fakeSettingsServer([
+      {
+        key: KEY,
+        scope: "profile_device",
+        profileId: "profile-1",
+        deviceId: "device-1",
+        value: 300,
+      },
+    ]);
+    const { wrapper } = createHarness();
+    const { result } = renderHook(() => useSubtitleSyncSetting(), { wrapper });
+    await waitFor(() => expect(result.current.offsetMs).toBe(300));
+
+    await result.current.save(-200);
+
+    expect(rows).toEqual([expect.objectContaining({ key: KEY, scope: "profile", value: -200 })]);
+    await waitFor(() => expect(result.current.offsetMs).toBe(-200));
+  });
+
+  it("clamps an offset past the contract's bounds instead of sending one the server refuses", async () => {
+    const rows = fakeSettingsServer();
+    const { wrapper } = createHarness();
+    const { result } = renderHook(() => useSubtitleSyncSetting(), { wrapper });
+    await waitFor(() => expect(result.current.isLoaded).toBe(true));
+
+    await result.current.save(12_345);
+
+    expect(rows).toEqual([expect.objectContaining({ value: 10_000 })]);
+  });
+
+  it("saves and resets for this browser only on a server older than the profile scope", async () => {
+    const rows = fakeSettingsServer(
+      [
+        {
+          key: KEY,
+          scope: "profile_device",
+          profileId: "profile-1",
+          deviceId: "device-1",
+          value: 300,
+        },
+      ],
+      17,
+    );
+    const { wrapper } = createHarness();
+    const { result } = renderHook(() => useSubtitleSyncSetting(), { wrapper });
+    await waitFor(() => expect(result.current.isLoaded).toBe(true));
+
+    await result.current.save(-200);
+    expect(rows).toEqual([
+      expect.objectContaining({ key: KEY, scope: "profile_device", value: -200 }),
+    ]);
+
+    await result.current.reset();
+    expect(rows).toEqual([]);
+    await result.current.reset();
+  });
+
+  it("stays loaded when a background capabilities refetch fails", async () => {
+    fakeSettingsServer([{ key: KEY, scope: "profile", profileId: "profile-1", value: -750 }]);
+    const { queryClient, wrapper } = createHarness();
+    const { result } = renderHook(() => useSubtitleSyncSetting(), { wrapper });
+    await waitFor(() => expect(result.current.isLoaded).toBe(true));
+
+    const answer = v2Mock.getMockImplementation()!;
+    v2Mock.mockImplementation((operation: string, ...rest: unknown[]) =>
+      operation === "GET /api/v2/settings/contract/capabilities"
+        ? Promise.reject(new Error("offline"))
+        : answer(operation, ...rest),
+    );
+    await act(() => queryClient.refetchQueries({ type: "active" }));
+    expect(
+      queryClient.getQueryCache().findAll({
+        predicate: (query) => query.queryKey.includes("capabilities"),
+      })[0]?.state.status,
+    ).toBe("error");
+
+    expect(result.current.isLoaded).toBe(true);
+  });
+});
diff --git a/web/src/hooks/queries/subtitleSync.ts b/web/src/hooks/queries/subtitleSync.ts
new file mode 100644
index 0000000000..95f3b0ff96
--- /dev/null
+++ b/web/src/hooks/queries/subtitleSync.ts
@@ -0,0 +1,85 @@
+import { useCallback } from "react";
+import {
+  isSettingValueMissing,
+  useClearSettingValue,
+  useEffectiveSettings,
+  useSetSettingValue,
+  useSettingsCapabilities,
+  type SettingIdentity,
+} from "@/hooks/queries/settingValues";
+import { useProfileDefaultWriter } from "@/hooks/queries/profileDefaults";
+import { SETTING_DEFINITIONS, SETTING_KEYS, SETTINGS_API_VERSION } from "@/lib/settingsContract";
+
+const KEY = SETTING_KEYS.PLAYER_SUBTITLE_SYNC_MS;
+const KEYS = [KEY];
+const DEVICE_SCOPE: SettingIdentity = { scope: "profile_device" };
+
+/** The manifest revision that added the profile scope for this key. */
+const PROFILE_SCOPE_REVISION =
+  SETTING_DEFINITIONS[KEY].scopeIntroducedIn[SETTING_DEFINITIONS[KEY].scopes.indexOf("profile")]!;
+
+/** The contract's bounds for the offset, so a nudge past them is clamped rather than refused. */
+export const SUBTITLE_SYNC_MAX_MS = 10_000;
+
+export function clampSubtitleSyncMs(ms: number): number {
+  return Math.max(-SUBTITLE_SYNC_MAX_MS, Math.min(SUBTITLE_SYNC_MAX_MS, Math.round(ms)));
+}
+
+/**
+ * The profile's subtitle timing offset (player.subtitle_sync_ms), in
+ * milliseconds; positive shows subtitles later.
+ *
+ * Timing is one of the subtitle display settings that follow the profile to
+ * every device, so the settings screen and the player's Delay control both
+ * write the profile row. The shared writer also clears a row this browser may
+ * hold, which would otherwise outrank the profile value here. A server older
+ * than the profile scope refuses that write, so there the offset is saved for
+ * this browser only, as it was before.
+ */
+export function useSubtitleSyncSetting() {
+  const query = useEffectiveSettings({ keys: KEYS });
+  const capabilities = useSettingsCapabilities();
+  const profileWriter = useProfileDefaultWriter(query.data);
+  const setValue = useSetSettingValue();
+  const clearValue = useClearSettingValue();
+  const supportsProfileScope =
+    capabilities.data?.api_version === SETTINGS_API_VERSION &&
+    capabilities.data.manifest_revision >= PROFILE_SCOPE_REVISION;
+
+  const value = query.data?.[KEY]?.value;
+  const offsetMs =
+    typeof value === "number" ? value : (SETTING_DEFINITIONS[KEY].defaultValue as number);
+
+  const { save: saveProfile, reset: resetProfile } = profileWriter;
+  const { mutateAsync: setDeviceValue } = setValue;
+  const { mutateAsync: clearDeviceValue } = clearValue;
+  const save = useCallback(
+    async (ms: number) => {
+      const next = clampSubtitleSyncMs(ms);
+      if (supportsProfileScope) return saveProfile(KEY, next);
+      await setDeviceValue({ key: KEY, value: next, identity: DEVICE_SCOPE });
+    },
+    [saveProfile, setDeviceValue, supportsProfileScope],
+  );
+  const reset = useCallback(async () => {
+    if (supportsProfileScope) return resetProfile(KEY);
+    try {
+      await clearDeviceValue({ key: KEY, identity: DEVICE_SCOPE });
+    } catch (error) {
+      if (isSettingValueMissing(error)) return;
+      throw error;
+    }
+  }, [clearDeviceValue, resetProfile, supportsProfileScope]);
+
+  return {
+    offsetMs,
+    /**
+     * False until the server's value and contract revision have arrived, so a
+     * caller does not act on the default or write a scope the server refuses.
+     */
+    isLoaded: query.data !== undefined && capabilities.data !== undefined,
+    save,
+    reset,
+    isSaving: profileWriter.isSaving || setValue.isPending || clearValue.isPending,
+  };
+}
diff --git a/web/src/hooks/queries/tasteSeed.ts b/web/src/hooks/queries/tasteSeed.ts
index 5f75b718d6..e272eb20f7 100644
--- a/web/src/hooks/queries/tasteSeed.ts
+++ b/web/src/hooks/queries/tasteSeed.ts
@@ -1,9 +1,11 @@
 import { useInfiniteQuery, useMutation, useQueryClient } from "@tanstack/react-query";
+import type { QueryClient } from "@tanstack/react-query";
 import { catalogItemFromV2, type CatalogCardItem } from "@/api/v2/catalog";
 import { v2 } from "@/api/v2/request";
 import { recKeys, favoriteKeys } from "./keys";
 import { invalidateMediaSurfaceQueries } from "./mediaSurfaceRefresh";
 import { bumpHomeRefreshSignal } from "@/pages/homeSurfaceRefresh";
+import { storage } from "@/utils/storage";
 
 export interface TasteSeedItemsPage {
   items: CatalogCardItem[];
@@ -36,6 +38,51 @@ export function useTasteSeedItems(enabled = true) {
   });
 }
 
+/**
+ * When the recommendation surfaces are refetched again after a taste-seed
+ * submission. The server answers once the profile's refresh is done or after
+ * a few seconds; a slower refresh lands later, and these refetches pick it up.
+ * A submission that arrives while a refresh is reading makes that refresh run
+ * once more when it ends, each run within the server's two-minute timeout, so
+ * the last refetch comes after two timeouts, when neither can be running.
+ */
+const TASTE_SEED_REFETCH_DELAYS_MS = [3_000, 15_000, 45_000, 125_000, 245_000] as const;
+
+/** The pending delayed refetches of the latest submission. */
+let tasteSeedRefetchTimers: ReturnType<typeof setTimeout>[] = [];
+
+function cancelTasteSeedRefetches() {
+  for (const timer of tasteSeedRefetchTimers) clearTimeout(timer);
+  tasteSeedRefetchTimers = [];
+}
+
+/**
+ * Schedules the delayed refetches for the current profile, replacing those of
+ * an earlier submission. Each refetches only the recommendation reads, which
+ * reload just the queries on screen; Home, which reloads every section on a
+ * bump, is bumped once more with the last. A profile or account switch
+ * cancels what is left: the refetches would only reload the new profile's
+ * rows.
+ */
+function scheduleTasteSeedRefetches(queryClient: QueryClient) {
+  cancelTasteSeedRefetches();
+  const profileId = storage.get(storage.KEYS.PROFILE_ID);
+  const last = TASTE_SEED_REFETCH_DELAYS_MS.length - 1;
+  tasteSeedRefetchTimers = TASTE_SEED_REFETCH_DELAYS_MS.map((delay, i) =>
+    setTimeout(() => {
+      if (storage.get(storage.KEYS.PROFILE_ID) !== profileId) {
+        cancelTasteSeedRefetches();
+        return;
+      }
+      void queryClient.invalidateQueries({ queryKey: recKeys.all });
+      if (i === last) {
+        bumpHomeRefreshSignal(queryClient);
+        tasteSeedRefetchTimers = [];
+      }
+    }, delay),
+  );
+}
+
 /**
  * Submits a batch of selected content IDs as favorites and triggers a single
  * taste-profile refresh. Uses the dedicated POST /api/v2/recommendations/taste-seed
@@ -48,13 +95,15 @@ export function useSubmitTasteSeed() {
     mutationFn: (itemIds: string[]) =>
       v2("POST /api/v2/recommendations/taste-seed", { body: { item_ids: itemIds } }),
     onSuccess: async () => {
-      // Invalidate favorites and recommendation surfaces — the new favorites
-      // should appear immediately; the For You / Discover rows will warm up
-      // on next render once the worker re-runs the taste profile.
+      // Invalidate favorites and recommendation surfaces. The server waits
+      // for the profile's refresh before answering, so the rows usually
+      // already reflect the picks; the delayed refetches cover a refresh that
+      // took longer than that wait.
       await queryClient.invalidateQueries({ queryKey: favoriteKeys.all });
       await queryClient.invalidateQueries({ queryKey: recKeys.all });
       await invalidateMediaSurfaceQueries(queryClient);
       bumpHomeRefreshSignal(queryClient);
+      scheduleTasteSeedRefetches(queryClient);
     },
   });
 }
diff --git a/web/src/hooks/queries/theme.ts b/web/src/hooks/queries/theme.ts
deleted file mode 100644
index 4cdf06cffa..0000000000
--- a/web/src/hooks/queries/theme.ts
+++ /dev/null
@@ -1,30 +0,0 @@
-import { useQuery } from "@tanstack/react-query";
-import { v2 } from "@/api/v2/request";
-import { themeKeys } from "./keys";
-
-/** Fetch the admin's server-wide custom CSS config. Public endpoint (no auth needed). */
-export function useAdminPublicCss() {
-  return useQuery({
-    queryKey: themeKeys.adminCss(),
-    queryFn: async () => {
-      try {
-        const result = await v2("GET /api/v2/theme/admin-css");
-        let vars: Record<string, string> = {};
-        if (result.vars) {
-          try {
-            vars = JSON.parse(result.vars) as Record<string, string>;
-          } catch {
-            // Keep valid raw CSS active even if a legacy vars row is corrupt.
-          }
-        }
-        return {
-          vars,
-          rawCss: result.raw_css ?? "",
-        };
-      } catch {
-        return { vars: {} as Record<string, string>, rawCss: "" };
-      }
-    },
-    staleTime: 60_000,
-  });
-}
diff --git a/web/src/hooks/queries/watchProviders.test.ts b/web/src/hooks/queries/watchProviders.test.ts
index b7f801f6e7..f076262fe8 100644
--- a/web/src/hooks/queries/watchProviders.test.ts
+++ b/web/src/hooks/queries/watchProviders.test.ts
@@ -31,7 +31,7 @@ describe("watch provider v2 queries", () => {
       options?.onResponse?.(new Response(null, { headers: { ETag: '"version-1"' } }));
       return { import_watched_enabled: true } as never;
     });
-    expect(await fetchWatchProviderConnection("trakt")).toMatchObject({
+    expect(await fetchWatchProviderConnection("simkl")).toMatchObject({
       connected: true,
       etag: '"version-1"',
     });
@@ -39,20 +39,20 @@ describe("watch provider v2 queries", () => {
 
   it("unwraps provider and bounded activity collections", async () => {
     await expect(fetchWatchProviders()).resolves.toEqual({ providers: [] });
-    await expect(fetchWatchProviderSyncRuns("trakt")).resolves.toEqual({ runs: [] });
+    await expect(fetchWatchProviderSyncRuns("simkl")).resolves.toEqual({ runs: [] });
     expect(v2).toHaveBeenLastCalledWith("GET /api/v2/watch-providers/{provider}/sync-runs", {
-      path: { provider: "trakt" },
+      path: { provider: "simkl" },
       query: { limit: 10 },
     });
   });
   it("passes credentials in typed bodies and keeps provider keys as path values", async () => {
-    await expect(startWatchProviderDeviceAuth("trakt")).resolves.toMatchObject({
+    await expect(startWatchProviderDeviceAuth("simkl")).resolves.toMatchObject({
       id: "auth-1",
       user_code: "PUBLIC",
     });
-    await pollWatchProviderDeviceAuth("trakt", "auth-1");
+    await pollWatchProviderDeviceAuth("simkl", "auth-1");
     expect(v2).toHaveBeenLastCalledWith("POST /api/v2/watch-providers/{provider}/auth/poll", {
-      path: { provider: "trakt" },
+      path: { provider: "simkl" },
       body: { auth_session_id: "auth-1" },
     });
     await connectWatchProviderAPIKey("plugin:4:floppy", "token", { floppy: { region: "test" } });
@@ -60,9 +60,9 @@ describe("watch provider v2 queries", () => {
       path: { provider: "plugin:4:floppy" },
       body: { api_key: "token", connection_config: { floppy: { region: "test" } } },
     });
-    await updateWatchProviderConnection("trakt", { scrobble_enabled: true }, '"version-1"');
+    await updateWatchProviderConnection("simkl", { scrobble_enabled: true }, '"version-1"');
     expect(v2).toHaveBeenLastCalledWith("PATCH /api/v2/watch-providers/{provider}/connection", {
-      path: { provider: "trakt" },
+      path: { provider: "simkl" },
       body: { scrobble_enabled: true },
       headers: { "If-Match": '"version-1"' },
       onResponse: expect.any(Function),
@@ -78,11 +78,11 @@ describe("watch provider v2 queries", () => {
       headers: { "If-Match": '"version-2"' },
       onResponse: expect.any(Function),
     });
-    await deleteWatchProviderConnection("trakt");
+    await deleteWatchProviderConnection("simkl");
     expect(v2).toHaveBeenLastCalledWith("DELETE /api/v2/watch-providers/{provider}/connection", {
-      path: { provider: "trakt" },
+      path: { provider: "simkl" },
     });
-    await expect(triggerWatchProviderSync("trakt")).resolves.toMatchObject({
+    await expect(triggerWatchProviderSync("simkl")).resolves.toMatchObject({
       run: { id: "run-1" },
     });
   });
diff --git a/web/src/hooks/queries/watchlist.ts b/web/src/hooks/queries/watchlist.ts
index 070359eb98..2279f50e17 100644
--- a/web/src/hooks/queries/watchlist.ts
+++ b/web/src/hooks/queries/watchlist.ts
@@ -31,6 +31,7 @@ export function useToggleWatchlist(itemId: string) {
       updateCatalogItemDetail(queryClient, itemId, (detail) => ({
         ...detail,
         user_state: {
+          ...detail.user_state,
           played: detail.user_state?.played ?? detail.user_data?.played ?? false,
           is_favorite: detail.user_state?.is_favorite ?? false,
           in_watchlist: !currentlyInWatchlist,
@@ -43,6 +44,7 @@ export function useToggleWatchlist(itemId: string) {
       updateCatalogItemDetail(queryClient, itemId, (detail) => ({
         ...detail,
         user_state: {
+          ...detail.user_state,
           played: detail.user_state?.played ?? detail.user_data?.played ?? false,
           is_favorite: detail.user_state?.is_favorite ?? false,
           in_watchlist: currentlyInWatchlist,
diff --git a/web/src/hooks/useAdminNavTopics.test.ts b/web/src/hooks/useAdminNavTopics.test.ts
new file mode 100644
index 0000000000..e5bd318479
--- /dev/null
+++ b/web/src/hooks/useAdminNavTopics.test.ts
@@ -0,0 +1,29 @@
+import { act, renderHook } from "@testing-library/react";
+import { afterEach, expect, it } from "vitest";
+
+import { useAdminNavTopics } from "./useAdminNavTopics";
+
+const KEY = "prairie.admin-nav.open-topics";
+
+afterEach(() => localStorage.clear());
+
+// The desktop sidebar and the phone drawer each run the hook at once.
+it("keeps a choice made in one sidebar when the other toggles a different topic", () => {
+  const desktop = renderHook(() => useAdminNavTopics(null));
+  const drawer = renderHook(() => useAdminNavTopics(null));
+
+  act(() => drawer.result.current.toggle("playback"));
+  act(() => desktop.result.current.toggle("server"));
+
+  expect(JSON.parse(localStorage.getItem(KEY) ?? "{}")).toEqual({ playback: true, server: true });
+});
+
+it("opens the topic holding the current page and remembers other toggles", () => {
+  const { result } = renderHook(() => useAdminNavTopics("server"));
+  expect(result.current.isOpen("server")).toBe(true);
+  expect(result.current.isOpen("playback")).toBe(false);
+
+  act(() => result.current.toggle("playback"));
+  expect(result.current.isOpen("playback")).toBe(true);
+  expect(JSON.parse(localStorage.getItem(KEY) ?? "{}")).toEqual({ playback: true });
+});
diff --git a/web/src/hooks/useAdminNavTopics.ts b/web/src/hooks/useAdminNavTopics.ts
new file mode 100644
index 0000000000..796fbb2237
--- /dev/null
+++ b/web/src/hooks/useAdminNavTopics.ts
@@ -0,0 +1,63 @@
+import { useCallback, useState } from "react";
+
+const OPEN_TOPICS_KEY = "prairie.admin-nav.open-topics";
+
+type TopicChoices = Record<string, boolean>;
+
+function readChoices(): TopicChoices {
+  try {
+    const parsed: unknown = JSON.parse(localStorage.getItem(OPEN_TOPICS_KEY) ?? "{}");
+    return parsed && typeof parsed === "object" ? (parsed as TopicChoices) : {};
+  } catch {
+    return {};
+  }
+}
+
+function writeChoices(choices: TopicChoices) {
+  try {
+    localStorage.setItem(OPEN_TOPICS_KEY, JSON.stringify(choices));
+  } catch {
+    // Storage full or unavailable: the choice lasts for this page load.
+  }
+}
+
+/** The choices with `topicId` open again, if the admin had closed it. */
+function withTopicOpen(choices: TopicChoices, topicId: string | null): TopicChoices {
+  return topicId && choices[topicId] === false ? { ...choices, [topicId]: true } : choices;
+}
+
+/**
+ * Which admin sidebar topics are open. The topic holding the current page opens
+ * by itself, including after the admin closed it on an earlier visit; every
+ * other topic stays as the admin last left it, across navigations and reloads.
+ */
+export function useAdminNavTopics(activeTopicId: string | null) {
+  const [choices, setChoices] = useState(() => withTopicOpen(readChoices(), activeTopicId));
+  // Adjusted during render rather than in an effect, so arriving in a topic
+  // never paints one frame with it closed.
+  const [arrivedIn, setArrivedIn] = useState(activeTopicId);
+  if (arrivedIn !== activeTopicId) {
+    setArrivedIn(activeTopicId);
+    const reopened = withTopicOpen(choices, activeTopicId);
+    if (reopened !== choices) setChoices(reopened);
+  }
+
+  const isOpen = useCallback(
+    (topicId: string) => choices[topicId] ?? topicId === activeTopicId,
+    [activeTopicId, choices],
+  );
+
+  // The desktop sidebar and the phone drawer each run this hook, so a toggle
+  // merges into what is stored instead of writing back this instance's whole
+  // snapshot, which would undo a choice the other instance made since.
+  const toggle = useCallback(
+    (topicId: string) => {
+      const open = !isOpen(topicId);
+      writeChoices({ ...readChoices(), [topicId]: open });
+      setChoices((current) => ({ ...current, [topicId]: open }));
+    },
+    [isOpen],
+  );
+
+  return { isOpen, toggle };
+}
diff --git a/web/src/hooks/useOnViewTranslation.test.tsx b/web/src/hooks/useOnViewTranslation.test.tsx
new file mode 100644
index 0000000000..ffea68869b
--- /dev/null
+++ b/web/src/hooks/useOnViewTranslation.test.tsx
@@ -0,0 +1,388 @@
+import { act, renderHook } from "@testing-library/react";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import type { ReactNode } from "react";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  v2: vi.fn(() => Promise.resolve({})),
+  mode: "auto",
+}));
+
+vi.mock("@/api/v2/request", () => ({
+  v2: (...args: unknown[]) => mocks.v2(...(args as [])),
+}));
+
+vi.mock("@/hooks/queries/metadataAI", () => ({
+  useMetadataAIStatus: () => ({ data: { enabled: true, on_view: mocks.mode } }),
+}));
+
+import { type OnViewTranslationTarget, useOnViewTranslation } from "./useOnViewTranslation";
+
+function wrapper({ children }: { children: ReactNode }) {
+  return <QueryClientProvider client={new QueryClient()}>{children}</QueryClientProvider>;
+}
+
+describe("useOnViewTranslation", () => {
+  afterEach(() => {
+    vi.useRealTimers();
+    mocks.v2.mockClear();
+    mocks.mode = "auto";
+  });
+
+  it("translates a season from its episode list in auto mode", () => {
+    renderHook(
+      () => useOnViewTranslation({ content_id: "season-1", pending_translation_language: "de" }),
+      { wrapper },
+    );
+    expect(mocks.v2).toHaveBeenCalledTimes(1);
+    expect(mocks.v2).toHaveBeenCalledWith("POST /api/v2/catalog/items/{id}/translate-description", {
+      path: { id: "season-1" },
+      body: { target_language: "de" },
+    });
+  });
+
+  it("does nothing when nothing is pending or the mode is not auto", () => {
+    renderHook(() => useOnViewTranslation({ content_id: "season-1" }), { wrapper });
+    mocks.mode = "button";
+    const { result } = renderHook(
+      () => useOnViewTranslation({ content_id: "season-2", pending_translation_language: "de" }),
+      { wrapper },
+    );
+    expect(mocks.v2).not.toHaveBeenCalled();
+    expect(result.current.onTranslate).toBeTypeOf("function");
+  });
+
+  it("lets the button retry after a failed request", async () => {
+    mocks.mode = "button";
+    mocks.v2.mockImplementationOnce(() => Promise.reject(new Error("offline")));
+    const { result } = renderHook(
+      () => useOnViewTranslation({ content_id: "movie-1", pending_translation_language: "de" }),
+      { wrapper },
+    );
+    await act(async () => result.current.onTranslate?.());
+    expect(result.current.translating).toBe(false);
+    expect(result.current.onTranslate).toBeTypeOf("function");
+    act(() => result.current.onTranslate?.());
+    expect(mocks.v2).toHaveBeenCalledTimes(2);
+    expect(result.current.translating).toBe(true);
+  });
+
+  it("offers a working retry once a long season job outlasts the wait", () => {
+    vi.useFakeTimers();
+    mocks.mode = "button";
+    const { result } = renderHook(
+      () => useOnViewTranslation({ content_id: "season-1", pending_translation_language: "de" }),
+      { wrapper },
+    );
+    act(() => result.current.onTranslate?.());
+    expect(mocks.v2).toHaveBeenCalledTimes(1);
+    expect(result.current.translating).toBe(true);
+
+    // The episodes are still pending when the wait runs out.
+    act(() => vi.advanceTimersByTime(50_000));
+    expect(result.current.translating).toBe(false);
+
+    act(() => result.current.onTranslate?.());
+    expect(mocks.v2).toHaveBeenCalledTimes(2);
+    expect(result.current.translating).toBe(true);
+  });
+
+  it("keeps polling for an earlier hero slide after the next one starts", async () => {
+    vi.useFakeTimers();
+    try {
+      const onPoll = vi.fn();
+      // The hero passes the slides still pending, so its earlier jobs stay.
+      const heroSlides: ReadonlySet<string> = new Set(["a", "b"]);
+      const { result, rerender } = renderHook(
+        ({ item }) => useOnViewTranslation(item, { onPoll, pendingContentIds: heroSlides }),
+        {
+          wrapper,
+          initialProps: { item: { content_id: "a", pending_translation_language: "de" } },
+        },
+      );
+      rerender({ item: { content_id: "b", pending_translation_language: "de" } });
+      // Slide b finishes first; slide a's job is still running.
+      rerender({ item: { content_id: "b", pending_translation_language: "" } });
+      expect(result.current.translating).toBe(false);
+      await act(() => vi.advanceTimersByTimeAsync(2_000));
+      expect(onPoll).toHaveBeenCalledTimes(1);
+      rerender({ item: { content_id: "a", pending_translation_language: "de" } });
+      expect(result.current.translating).toBe(true);
+      rerender({ item: { content_id: "a", pending_translation_language: "" } });
+      await act(() => vi.advanceTimersByTimeAsync(4_000));
+      expect(onPoll).toHaveBeenCalledTimes(1);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it("stops polling when an earlier slide finishes while another one shows", async () => {
+    vi.useFakeTimers();
+    try {
+      const onPoll = vi.fn();
+      const { rerender } = renderHook(
+        ({ item, pendingContentIds }) => useOnViewTranslation(item, { onPoll, pendingContentIds }),
+        {
+          wrapper,
+          initialProps: {
+            item: { content_id: "a", pending_translation_language: "de" },
+            pendingContentIds: new Set(["a"]) as ReadonlySet<string>,
+          },
+        },
+      );
+      // The hero moves on to b, which is already localized.
+      rerender({
+        item: { content_id: "b", pending_translation_language: "" },
+        pendingContentIds: new Set(["a"]),
+      });
+      await act(() => vi.advanceTimersByTimeAsync(2_000));
+      expect(onPoll).toHaveBeenCalledTimes(1);
+      // The refreshed section no longer reports a as pending: a is done.
+      rerender({
+        item: { content_id: "b", pending_translation_language: "" },
+        pendingContentIds: new Set(),
+      });
+      await act(() => vi.advanceTimersByTimeAsync(10_000));
+      expect(onPoll).toHaveBeenCalledTimes(1);
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it("keeps a retry going when the request it replaced fails late", async () => {
+    vi.useFakeTimers();
+    mocks.mode = "button";
+    let rejectFirst: (reason: unknown) => void = () => {};
+    mocks.v2.mockImplementationOnce(
+      () =>
+        new Promise((_, reject) => {
+          rejectFirst = reject;
+        }),
+    );
+    mocks.v2.mockImplementationOnce(() => new Promise(() => {}));
+    const { result } = renderHook(
+      () => useOnViewTranslation({ content_id: "season-1", pending_translation_language: "de" }),
+      { wrapper },
+    );
+    act(() => result.current.onTranslate?.());
+    act(() => vi.advanceTimersByTime(50_000));
+    act(() => result.current.onTranslate?.());
+    expect(mocks.v2).toHaveBeenCalledTimes(2);
+
+    // The first, replaced request fails only now.
+    await act(async () => {
+      rejectFirst(new Error("network"));
+      await Promise.resolve();
+    });
+    expect(result.current.translating).toBe(true);
+  });
+
+  it("keeps refreshing a long season job slowly after the wait in auto mode", () => {
+    vi.useFakeTimers();
+    const client = new QueryClient();
+    const invalidate = vi.spyOn(client, "invalidateQueries");
+    renderHook(
+      () => useOnViewTranslation({ content_id: "season-1", pending_translation_language: "de" }),
+      {
+        wrapper: ({ children }: { children: ReactNode }) => (
+          <QueryClientProvider client={client}>{children}</QueryClientProvider>
+        ),
+      },
+    );
+    expect(mocks.v2).toHaveBeenCalledTimes(1);
+    act(() => vi.advanceTimersByTime(50_000));
+    const afterWait = invalidate.mock.calls.length;
+
+    // Episodes still pending: later batches keep reaching the page.
+    act(() => vi.advanceTimersByTime(30_000));
+    expect(invalidate.mock.calls.length).toBeGreaterThan(afterWait);
+    expect(mocks.v2).toHaveBeenCalledTimes(1);
+  });
+
+  it("stops the slow refresh after its limit", () => {
+    vi.useFakeTimers();
+    const client = new QueryClient();
+    const invalidate = vi.spyOn(client, "invalidateQueries");
+    renderHook(
+      () => useOnViewTranslation({ content_id: "season-1", pending_translation_language: "de" }),
+      {
+        wrapper: ({ children }: { children: ReactNode }) => (
+          <QueryClientProvider client={client}>{children}</QueryClientProvider>
+        ),
+      },
+    );
+    // The 45-second wait, then the five-minute slow refresh.
+    act(() => vi.advanceTimersByTime(45_000 + 5 * 60_000 + 20_000));
+    const atLimit = invalidate.mock.calls.length;
+    act(() => vi.advanceTimersByTime(60_000));
+    expect(invalidate.mock.calls.length).toBe(atLimit);
+  });
+
+  it("stops a detail page's job when the page moves to another item", () => {
+    vi.useFakeTimers();
+    const client = new QueryClient();
+    const invalidate = vi.spyOn(client, "invalidateQueries");
+    const { rerender } = renderHook(({ item }) => useOnViewTranslation(item), {
+      wrapper: ({ children }: { children: ReactNode }) => (
+        <QueryClientProvider client={client}>{children}</QueryClientProvider>
+      ),
+      initialProps: {
+        item: {
+          content_id: "episode-a",
+          pending_translation_language: "de",
+          series_id: "show",
+          season_number: 1,
+        } as OnViewTranslationTarget,
+      },
+    });
+    // The route moves on to an episode that is already localized.
+    rerender({ item: { content_id: "episode-b", series_id: "show", season_number: 2 } });
+    const afterMove = invalidate.mock.calls.length;
+    act(() => vi.advanceTimersByTime(30_000));
+    expect(invalidate.mock.calls.length).toBe(afterMove);
+  });
+
+  it("refreshes each running job's own season, not the item on screen", () => {
+    vi.useFakeTimers();
+    const client = new QueryClient();
+    const invalidate = vi.spyOn(client, "invalidateQueries");
+    const { rerender } = renderHook(
+      ({ item, pendingContentIds }) => useOnViewTranslation(item, { pendingContentIds }),
+      {
+        wrapper: ({ children }: { children: ReactNode }) => (
+          <QueryClientProvider client={client}>{children}</QueryClientProvider>
+        ),
+        initialProps: {
+          item: {
+            content_id: "episode-a",
+            pending_translation_language: "de",
+            series_id: "show",
+            season_number: 1,
+          } as OnViewTranslationTarget | undefined,
+          pendingContentIds: new Set(["episode-a"]) as ReadonlySet<string>,
+        },
+      },
+    );
+    // The hero moves on to a movie slide while episode a still translates.
+    rerender({ item: { content_id: "movie-b" }, pendingContentIds: new Set(["episode-a"]) });
+    invalidate.mockClear();
+    act(() => vi.advanceTimersByTime(2_000));
+    expect(invalidate).toHaveBeenCalledWith({
+      queryKey: ["catalog", "series", "show", "seasons", 1],
+    });
+  });
+
+  it("marks cached Home and library rows stale when a translation lands", () => {
+    const client = new QueryClient();
+    const homeKey = ["sections", "home", "items", "featured"];
+    const libraryKey = ["sections", "library", 7, "items", "featured"];
+    client.setQueryData(homeKey, { section: { items: [] } });
+    client.setQueryData(libraryKey, { section: { items: [] } });
+    const { rerender } = renderHook(({ item }) => useOnViewTranslation(item), {
+      wrapper: ({ children }: { children: ReactNode }) => (
+        <QueryClientProvider client={client}>{children}</QueryClientProvider>
+      ),
+      initialProps: {
+        item: {
+          content_id: "movie-1",
+          pending_translation_language: "de",
+        } as OnViewTranslationTarget,
+      },
+    });
+    expect(client.getQueryState(homeKey)?.isInvalidated).toBe(false);
+    // The refetched detail comes back localized.
+    rerender({ item: { content_id: "movie-1" } });
+    expect(client.getQueryState(homeKey)?.isInvalidated).toBe(true);
+    expect(client.getQueryState(libraryKey)?.isInvalidated).toBe(true);
+  });
+
+  it("marks cached rows stale when an off-screen hero slide's translation lands", () => {
+    const client = new QueryClient();
+    const homeKey = ["sections", "home", "items", "recent"];
+    client.setQueryData(homeKey, { section: { items: [] } });
+    const { rerender } = renderHook(
+      ({ item, pendingContentIds }) => useOnViewTranslation(item, { pendingContentIds }),
+      {
+        wrapper: ({ children }: { children: ReactNode }) => (
+          <QueryClientProvider client={client}>{children}</QueryClientProvider>
+        ),
+        initialProps: {
+          item: { content_id: "a", pending_translation_language: "de" } as OnViewTranslationTarget,
+          pendingContentIds: new Set(["a"]) as ReadonlySet<string>,
+        },
+      },
+    );
+    // The hero shows b while a is still translating.
+    rerender({ item: { content_id: "b" }, pendingContentIds: new Set(["a"]) });
+    expect(client.getQueryState(homeKey)?.isInvalidated).toBe(false);
+    // The hero's refreshed section no longer reports a as pending.
+    rerender({ item: { content_id: "b" }, pendingContentIds: new Set() });
+    expect(client.getQueryState(homeKey)?.isInvalidated).toBe(true);
+  });
+
+  // Another tab or profile can finish the translation first, and the server
+  // then refuses the request: the page re-reads its detail.
+  it("re-reads the detail after a refused request", async () => {
+    mocks.v2.mockImplementationOnce(() => Promise.reject(new Error("nothing to translate")));
+    const queryClient = new QueryClient();
+    const invalidate = vi.spyOn(queryClient, "invalidateQueries");
+    const { result } = renderHook(
+      () => useOnViewTranslation({ content_id: "movie-1", pending_translation_language: "de" }),
+      {
+        wrapper: ({ children }: { children: ReactNode }) => (
+          <QueryClientProvider client={queryClient}>{children}</QueryClientProvider>
+        ),
+      },
+    );
+    await act(async () => {});
+    expect(invalidate).toHaveBeenCalledWith({ queryKey: ["catalog", "items", "movie-1"] });
+    expect(result.current.translating).toBe(false);
+  });
+
+  it("lets the button try again after a failed request", async () => {
+    mocks.mode = "button";
+    mocks.v2.mockImplementationOnce(() => Promise.reject(new Error("rate limited")));
+    const { result } = renderHook(
+      () => useOnViewTranslation({ content_id: "movie-1", pending_translation_language: "de" }),
+      { wrapper },
+    );
+    await act(async () => result.current.onTranslate?.());
+    expect(result.current.translating).toBe(false);
+    act(() => result.current.onTranslate?.());
+    expect(mocks.v2).toHaveBeenCalledTimes(2);
+  });
+
+  // Auto mode fires once per view; after a failure such as a 429 it offers
+  // the translate action so the viewer can try again without a reload.
+  it("offers the translate action after a failed auto run", async () => {
+    mocks.v2.mockImplementationOnce(() => Promise.reject(new Error("rate limited")));
+    const { result } = renderHook(
+      () => useOnViewTranslation({ content_id: "movie-1", pending_translation_language: "de" }),
+      { wrapper },
+    );
+    expect(result.current.onTranslate).toBeUndefined();
+    await act(async () => {});
+    expect(mocks.v2).toHaveBeenCalledTimes(1);
+    expect(result.current.onTranslate).toBeTypeOf("function");
+    act(() => result.current.onTranslate?.());
+    expect(mocks.v2).toHaveBeenCalledTimes(2);
+    expect(result.current.onTranslate).toBeUndefined();
+  });
+
+  it("restarts a detail page's job when the page returns to its item", () => {
+    const { rerender } = renderHook(({ item }) => useOnViewTranslation(item), {
+      wrapper,
+      initialProps: {
+        item: {
+          content_id: "movie-a",
+          pending_translation_language: "de",
+        } as OnViewTranslationTarget,
+      },
+    });
+    expect(mocks.v2).toHaveBeenCalledTimes(1);
+    // The route moves on to a cached item, then back to a.
+    rerender({ item: { content_id: "movie-b" } });
+    rerender({ item: { content_id: "movie-a", pending_translation_language: "de" } });
+    expect(mocks.v2).toHaveBeenCalledTimes(2);
+  });
+});
diff --git a/web/src/hooks/useOnViewTranslation.ts b/web/src/hooks/useOnViewTranslation.ts
index 5f031016f5..7a390fb5d7 100644
--- a/web/src/hooks/useOnViewTranslation.ts
+++ b/web/src/hooks/useOnViewTranslation.ts
@@ -3,12 +3,37 @@ import { useQueryClient } from "@tanstack/react-query";
 
 import { v2 } from "@/api/v2/request";
 import type { ItemDetail } from "@/api/types";
+import { sectionKeys } from "@/hooks/queries/keys";
 import { useMetadataAIStatus } from "@/hooks/queries/metadataAI";
 
 // Give up shimmering after this long; the original text stays and the
 // server-side cooldown keeps a failing endpoint from being re-hit per view.
 const TRANSLATE_TIMEOUT_MS = 45_000;
 const POLL_INTERVAL_MS = 2_000;
+// A season job can outlast the shimmer. After it, keep refreshing slowly for
+// a while so episodes that land later still reach the open page.
+const SLOW_POLL_INTERVAL_MS = 10_000;
+const SLOW_POLL_LIMIT_MS = 5 * 60_000;
+
+/** What the hook needs from a page: a detail document, or a season's episode list. */
+export type OnViewTranslationTarget = Pick<
+  ItemDetail,
+  "content_id" | "pending_translation_language" | "series_id" | "season_number"
+>;
+
+export interface OnViewTranslationOptions {
+  /**
+   * Called on every poll tick while a translation runs, for surfaces whose
+   * data does not live under the catalog item keys (Home sections).
+   */
+  onPoll?: () => void;
+  /**
+   * The content IDs that still lack the language on a surface that switches
+   * items (the Featured hero's slides). A running translation whose item has
+   * left this set finished off screen, so it stops polling.
+   */
+  pendingContentIds?: ReadonlySet<string>;
+}
 
 /**
  * Viewer-facing on-demand description translation for the detail page.
@@ -19,10 +44,14 @@ const POLL_INTERVAL_MS = 2_000;
  *   - "auto": fire the translation on view (once per item+language) and pulse
  *     the description until the refetched detail comes back localized.
  *   - "button": expose a translate trigger for the chip under the overview.
- * Completion is observed as the flag clearing on refetch — the job's first
- * batch translates the item's own overview, so this lands in seconds.
+ * Completion is observed as the flag clearing on refetch. An item's own
+ * overview lands in seconds; a season's flag clears only once its episodes
+ * are translated too, which can outlast the wait.
  */
-export function useOnViewTranslation(item: ItemDetail | undefined) {
+export function useOnViewTranslation(
+  item: OnViewTranslationTarget | undefined,
+  { onPoll, pendingContentIds }: OnViewTranslationOptions = {},
+) {
   const queryClient = useQueryClient();
   const { data: status } = useMetadataAIStatus();
   const mode = status?.on_view ?? "off";
@@ -31,64 +60,206 @@ export function useOnViewTranslation(item: ItemDetail | undefined) {
   const pendingLanguage = item?.pending_translation_language ?? "";
   const seriesId = item?.series_id;
   const seasonNumber = item?.season_number;
+  const key = contentId && pendingLanguage ? `${contentId}\u0000${pendingLanguage}` : "";
 
-  const [translating, setTranslating] = useState(false);
-  // Tracks which item+language we already fired for, so auto mode triggers
-  // once per view rather than re-firing on every refetch while polling.
-  const firedForRef = useRef("");
-
-  const trigger = useCallback(() => {
-    if (!contentId || !pendingLanguage) return;
-    const key = `${contentId}:${pendingLanguage}`;
-    if (firedForRef.current === key) return;
-    firedForRef.current = key;
-    setTranslating(true);
-    v2("POST /api/v2/catalog/items/{id}/translate-description", {
-      path: { id: contentId },
-      body: { target_language: pendingLanguage },
-    }).catch(() => {
-      setTranslating(false);
-    });
-  }, [contentId, pendingLanguage]);
+  // Translations in flight, keyed by item and language. A surface that
+  // switches items (the Featured hero rotating its slides) shows each item's
+  // own progress and keeps polling for an earlier slide's job.
+  // An entry past the wait stops pulsing but stays, settling, while the
+  // language is still pending.
+  const [running, setRunning] = useState<ReadonlyMap<string, RunningTranslation>>(new Map());
+  const entry = key ? running.get(key) : undefined;
+  const translating = entry !== undefined && entry.settlingSince === undefined;
+  // Item+language pairs already requested, so auto mode triggers once per
+  // view rather than re-firing on every refetch while polling. A failure or a
+  // timeout releases the pair, and the button bypasses this, so a viewer can
+  // retry.
+  const firedRef = useRef(new Set<string>());
+  // The latest request per item+language, so a late failure of one that a
+  // retry replaced cannot end the retry's wait.
+  const attemptsRef = useRef(new Map<string, number>());
+  // Item+language pairs whose last request failed (refused, rate limited, or
+  // unreachable). Auto mode fires once per view, so it then offers the
+  // translate action instead.
+  const [failedKeys, setFailedKeys] = useState<ReadonlySet<string>>(new Set());
+  const onPollRef = useRef(onPoll);
+  useEffect(() => {
+    onPollRef.current = onPoll;
+  });
+
+  const trigger = useCallback(
+    (manual: boolean) => {
+      if (!key || (!manual && firedRef.current.has(key))) return;
+      firedRef.current.add(key);
+      const attempt = (attemptsRef.current.get(key) ?? 0) + 1;
+      attemptsRef.current.set(key, attempt);
+      setFailedKeys((current) => withoutKey(current, key));
+      setRunning((current) =>
+        new Map(current).set(key, { contentId, seriesId, seasonNumber, startedAt: Date.now() }),
+      );
+      v2("POST /api/v2/catalog/items/{id}/translate-description", {
+        path: { id: contentId },
+        body: { target_language: pendingLanguage },
+      }).catch(() => {
+        if (attemptsRef.current.get(key) !== attempt) return;
+        firedRef.current.delete(key);
+        setRunning((current) => withoutEntries(current, (entryKey) => entryKey === key));
+        setFailedKeys((current) => new Set(current).add(key));
+        // The server refuses a language the page no longer reports missing,
+        // which happens when another tab or profile finished the translation
+        // first. Re-read the page, and let the translate action try again.
+        void queryClient.invalidateQueries({ queryKey: ["catalog", "items", contentId] });
+        if (seriesId && typeof seasonNumber === "number") {
+          void queryClient.invalidateQueries({
+            queryKey: ["catalog", "series", seriesId, "seasons", seasonNumber],
+          });
+        }
+        onPollRef.current?.();
+      });
+    },
+    [contentId, key, pendingLanguage, seriesId, seasonNumber, queryClient],
+  );
+  const translateNow = useCallback(() => trigger(true), [trigger]);
 
   // Auto mode: translate on view.
   useEffect(() => {
-    if (mode === "auto" && pendingLanguage) trigger();
+    if (mode === "auto" && pendingLanguage) trigger(false);
   }, [mode, pendingLanguage, trigger]);
 
-  // While translating, poll the detail; the localized overview replaces the
-  // text and clears the pending flag, which ends the shimmer below.
+  // While translating, poll; the localized overview replaces the text and
+  // clears the pending flag, which ends the shimmer below. Once every entry is
+  // settling, poll slowly instead.
+  const allSettling = [...running.values()].every((entry) => entry.settlingSince !== undefined);
   useEffect(() => {
-    if (!translating || !contentId) return;
-    const startedAt = Date.now();
-    const timer = setInterval(() => {
-      if (Date.now() - startedAt > TRANSLATE_TIMEOUT_MS) {
-        setTranslating(false);
-        return;
-      }
-      // Prefix invalidation covers the per-library detail key variants
-      // (["catalog", "items", id, "detail", <libraryId|"default">]).
-      void queryClient.invalidateQueries({
-        queryKey: ["catalog", "items", contentId],
-      });
-      if (seriesId && typeof seasonNumber === "number") {
-        void queryClient.invalidateQueries({
-          queryKey: ["catalog", "series", seriesId, "seasons", seasonNumber],
+    if (running.size === 0) return;
+    const timer = setInterval(
+      () => {
+        const now = Date.now();
+        // Read the entries from the update, not this render: ticks can run
+        // before the next render replaces the interval.
+        setRunning((current) => {
+          let changed = false;
+          const next = new Map<string, RunningTranslation>();
+          for (const [entryKey, entry] of current) {
+            if (entry.settlingSince === undefined && now - entry.startedAt > TRANSLATE_TIMEOUT_MS) {
+              // A season job can outlast the wait. Release the pair so the
+              // translate action works again: a retry rejoins the running
+              // job. Auto mode does not re-fire until the item is viewed again.
+              firedRef.current.delete(entryKey);
+              next.set(entryKey, { ...entry, settlingSince: now });
+              changed = true;
+            } else if (
+              entry.settlingSince !== undefined &&
+              now - entry.settlingSince > SLOW_POLL_LIMIT_MS
+            ) {
+              changed = true;
+            } else {
+              next.set(entryKey, entry);
+            }
+          }
+          return changed ? next : current;
         });
-      }
-    }, POLL_INTERVAL_MS);
+        // Prefix invalidation covers the per-library detail key variants
+        // (["catalog", "items", id, "detail", <libraryId|"default">]).
+        // Each entry refreshes its own item and season, not the one on screen.
+        const keys = new Map<string, readonly unknown[]>();
+        for (const entry of running.values()) {
+          keys.set(entry.contentId, ["catalog", "items", entry.contentId]);
+          if (entry.seriesId && typeof entry.seasonNumber === "number") {
+            const season = ["catalog", "series", entry.seriesId, "seasons", entry.seasonNumber];
+            keys.set(season.join("\u0000"), season);
+          }
+        }
+        for (const queryKey of keys.values()) void queryClient.invalidateQueries({ queryKey });
+        onPollRef.current?.();
+      },
+      allSettling ? SLOW_POLL_INTERVAL_MS : POLL_INTERVAL_MS,
+    );
     return () => clearInterval(timer);
-  }, [translating, contentId, queryClient, seasonNumber, seriesId]);
+  }, [running, allSettling, queryClient]);
+
+  // Home and library rows carry the same localized text. Mark them stale when
+  // a translation lands so the next visit shows it; rows on screen keep theirs.
+  const markSectionRowsStale = useCallback(() => {
+    void queryClient.invalidateQueries({ queryKey: sectionKeys.home(), refetchType: "none" });
+    void queryClient.invalidateQueries({
+      queryKey: sectionKeys.libraryRoot(),
+      refetchType: "none",
+    });
+  }, [queryClient]);
 
-  // The refetched detail no longer reports a missing language: done.
+  // The refetched item no longer reports a missing language: done.
+  const finished =
+    contentId !== "" &&
+    !pendingLanguage &&
+    [...running.values()].some((runningEntry) => runningEntry.contentId === contentId);
   useEffect(() => {
-    if (translating && !pendingLanguage) setTranslating(false);
-  }, [translating, pendingLanguage]);
+    if (!finished) return;
+    setRunning((current) => withoutEntries(current, (_, entry) => entry.contentId === contentId));
+    markSectionRowsStale();
+  }, [finished, contentId, markSectionRowsStale]);
+
+  // A page that shows one item (a detail page) follows only that item: moving
+  // to another item leaves the earlier job behind instead of polling for it.
+  useEffect(() => {
+    if (pendingContentIds) return;
+    setRunning((current) =>
+      withoutEntries(current, (entryKey, entry) => {
+        if (entry.contentId === contentId) return false;
+        // Returning to the item later starts its job again.
+        firedRef.current.delete(entryKey);
+        return true;
+      }),
+    );
+  }, [pendingContentIds, contentId]);
+
+  // An item the surface no longer reports as pending is done, even off screen.
+  const finishedOffScreen =
+    pendingContentIds !== undefined &&
+    [...running.values()].some((runningEntry) => !pendingContentIds.has(runningEntry.contentId));
+  useEffect(() => {
+    if (!finishedOffScreen || !pendingContentIds) return;
+    setRunning((current) =>
+      withoutEntries(current, (_, entry) => !pendingContentIds.has(entry.contentId)),
+    );
+    markSectionRowsStale();
+  }, [finishedOffScreen, pendingContentIds, markSectionRowsStale]);
 
   return {
     /** Pulse the description text. */
     translating,
-    /** Render the explicit translate chip (button mode only). */
-    onTranslate: mode === "button" && pendingLanguage && !translating ? trigger : undefined,
+    /** Render the explicit translate chip: in button mode, or after a failed auto run. */
+    onTranslate:
+      (mode === "button" || (mode === "auto" && failedKeys.has(key))) &&
+      pendingLanguage &&
+      !translating
+        ? translateNow
+        : undefined,
   };
 }
+
+interface RunningTranslation {
+  contentId: string;
+  seriesId?: string | null;
+  seasonNumber?: number | null;
+  startedAt: number;
+  /** When the wait ran out; the entry then refreshes slowly until the limit. */
+  settlingSince?: number;
+}
+
+/** The map without matching entries, or the same map when nothing matches. */
+function withoutEntries(
+  current: ReadonlyMap<string, RunningTranslation>,
+  drop: (key: string, entry: RunningTranslation) => boolean,
+): ReadonlyMap<string, RunningTranslation> {
+  const next = new Map([...current].filter(([key, entry]) => !drop(key, entry)));
+  return next.size === current.size ? current : next;
+}
+
+/** The set without key, or the same set when it has no key. */
+function withoutKey(current: ReadonlySet<string>, key: string): ReadonlySet<string> {
+  if (!current.has(key)) return current;
+  const next = new Set(current);
+  next.delete(key);
+  return next;
+}
diff --git a/web/src/hooks/useOverlayPrefs.test.tsx b/web/src/hooks/useOverlayPrefs.test.tsx
index 94857de1b1..7c9a4a816d 100644
--- a/web/src/hooks/useOverlayPrefs.test.tsx
+++ b/web/src/hooks/useOverlayPrefs.test.tsx
@@ -426,11 +426,11 @@ describe("useOverlayPrefs", () => {
       wrapper: createWrapper(),
     });
     await waitFor(() => expect(result.current.isLoading).toBe(false));
-    expect(result.current.hasOverride).toBe(true);
+    expect(result.current.hasBadgeOverride).toBe(true);
     expect(result.current.prefs?.preset).toBe("minimal");
 
     await act(async () => {
-      await result.current.resetPrefs();
+      await result.current.resetPrefs("badges");
     });
 
     expect(mocks.clearValue).toHaveBeenCalledWith({
@@ -443,10 +443,39 @@ describe("useOverlayPrefs", () => {
     mocks.effective = effectiveOverlayValue(null).data as Record<string, { value: unknown }>;
     rerender();
 
-    expect(result.current.hasOverride).toBe(false);
+    expect(result.current.hasBadgeOverride).toBe(false);
     expect(result.current.prefs?.preset).toBe("vibrant");
   });
 
+  it("resets shortcuts without touching a stored badge choice", async () => {
+    mocks.profileId = "profile-1";
+    mocks.v2.mockResolvedValue({ enabled: true });
+    mocks.effective = {
+      ...(effectiveOverlayValue({ version: 2, preset: "minimal", order: [], items: {} })
+        .data as Record<string, { value: unknown }>),
+      [SETTING_KEYS.UI_CARD_QUICK_ACTIONS_ENABLED]: {
+        key: SETTING_KEYS.UI_CARD_QUICK_ACTIONS_ENABLED,
+        value: true,
+        source: "profile",
+      },
+    } as Record<string, { value: unknown }>;
+    mocks.clearValue.mockResolvedValue(undefined);
+
+    const { result } = renderHook(() => useOverlayPrefs(), { wrapper: createWrapper() });
+    await waitFor(() => expect(result.current.isLoading).toBe(false));
+    expect(result.current.hasBadgeOverride).toBe(true);
+    expect(result.current.hasQuickActionOverride).toBe(true);
+
+    await act(async () => {
+      await result.current.resetPrefs("quickActions");
+    });
+
+    const cleared = mocks.clearValue.mock.calls.map(([request]) => request.key);
+    expect(cleared.sort()).toEqual(
+      [SETTING_KEYS.UI_CARD_QUICK_ACTIONS, SETTING_KEYS.UI_CARD_QUICK_ACTIONS_ENABLED].sort(),
+    );
+  });
+
   it("treats a 404 from the canonical delete as already inheriting", async () => {
     mocks.profileId = "profile-1";
     mocks.v2.mockResolvedValue({ enabled: true });
@@ -459,7 +488,7 @@ describe("useOverlayPrefs", () => {
     await waitFor(() => expect(result.current.isLoading).toBe(false));
 
     await act(async () => {
-      await expect(result.current.resetPrefs()).resolves.toBeUndefined();
+      await expect(result.current.resetPrefs("badges")).resolves.toBeUndefined();
     });
   });
 
@@ -480,7 +509,7 @@ describe("useOverlayPrefs", () => {
     await waitFor(() => expect(result.current.isLoading).toBe(false));
 
     await act(async () => {
-      await expect(result.current.resetPrefs()).rejects.toThrow("boom");
+      await expect(result.current.resetPrefs("badges")).rejects.toThrow("boom");
     });
   });
 });
diff --git a/web/src/hooks/useOverlayPrefs.ts b/web/src/hooks/useOverlayPrefs.ts
index f75dfcc47f..0c741dd174 100644
--- a/web/src/hooks/useOverlayPrefs.ts
+++ b/web/src/hooks/useOverlayPrefs.ts
@@ -33,12 +33,20 @@ import {
 /** Card overlay preferences are profile-wide in the contract (no device scope). */
 const PROFILE_SCOPE: SettingIdentity = { scope: "profile" };
 
-const OVERLAY_KEYS = [
-  SETTING_KEYS.UI_CARD_OVERLAYS,
-  SETTING_KEYS.UI_CARD_OVERLAYS_ENABLED,
+const BADGE_KEYS = [SETTING_KEYS.UI_CARD_OVERLAYS, SETTING_KEYS.UI_CARD_OVERLAYS_ENABLED] as const;
+const QUICK_ACTION_KEYS = [
   SETTING_KEYS.UI_CARD_QUICK_ACTIONS,
   SETTING_KEYS.UI_CARD_QUICK_ACTIONS_ENABLED,
 ] as const;
+const OVERLAY_KEYS = [...BADGE_KEYS, ...QUICK_ACTION_KEYS] as const;
+
+/** The independently resettable halves of the card overlay preferences. */
+export type OverlayPrefsPart = "badges" | "quickActions";
+
+const PART_KEYS: Record<OverlayPrefsPart, readonly SettingKey[]> = {
+  badges: BADGE_KEYS,
+  quickActions: QUICK_ACTION_KEYS,
+};
 
 // Overlay booleans are inherit-with-override, not a policy gate: the server
 // setting is only the default for profiles that have not chosen, and an
@@ -192,21 +200,27 @@ export function useOverlayPrefs() {
     [setProfileValue],
   );
 
-  const resetPrefs = useCallback(async () => {
-    await Promise.all(
-      OVERLAY_KEYS.map(async (key) => {
-        try {
-          await clearValue.mutateAsync({ key, identity: PROFILE_SCOPE });
-        } catch (error) {
-          // A missing scoped value already means this part of the preference
-          // is inheriting from the server default.
-          if (!isSettingValueMissing(error)) throw error;
-        }
-      }),
-    );
-  }, [clearValue]);
+  const resetPrefs = useCallback(
+    async (part: OverlayPrefsPart) => {
+      await Promise.all(
+        PART_KEYS[part].map(async (key) => {
+          try {
+            await clearValue.mutateAsync({ key, identity: PROFILE_SCOPE });
+          } catch (error) {
+            // A missing scoped value already means this part of the preference
+            // is inheriting from the server default.
+            if (!isSettingValueMissing(error)) throw error;
+          }
+        }),
+      );
+    },
+    [clearValue],
+  );
 
-  const hasOverride = OVERLAY_KEYS.some((key) => effective?.[key]?.source === "profile");
+  const overrides = (keys: readonly SettingKey[]) =>
+    keys.some((key) => effective?.[key]?.source === "profile");
+  const hasBadgeOverride = overrides(BADGE_KEYS);
+  const hasQuickActionOverride = overrides(QUICK_ACTION_KEYS);
 
   // While either query is in flight, report null prefs instead of built-in
   // defaults: rendering defaults first would flash badges that vanish (or
@@ -226,7 +240,8 @@ export function useOverlayPrefs() {
     quickActionsEnabled,
     setQuickActionsEnabled,
     resetPrefs,
-    hasOverride,
+    hasBadgeOverride,
+    hasQuickActionOverride,
     isResetting: clearValue.isPending,
     isLoading,
   };
diff --git a/web/src/hooks/useSettingsReturnPath.ts b/web/src/hooks/useSettingsReturnPath.ts
new file mode 100644
index 0000000000..2c3f1568b6
--- /dev/null
+++ b/web/src/hooks/useSettingsReturnPath.ts
@@ -0,0 +1,24 @@
+import { useEffect } from "react";
+import { useLocation } from "react-router";
+
+// Module state rather than React state: the app shell is mounted per route
+// branch, so entering settings mounts a fresh shell that has to read what the
+// previous one saw.
+let returnPath: string | undefined;
+
+/**
+ * Where the settings sidebar's back link goes: the last page the app shell
+ * showed outside settings, so leaving settings lands back on the title it was
+ * opened from. Falls back to `fallback` when settings was the first page
+ * loaded.
+ */
+export function useSettingsReturnPath(inSettings: boolean, fallback: string): string {
+  const location = useLocation();
+  const here = `${location.pathname}${location.search}`;
+
+  useEffect(() => {
+    if (!inSettings) returnPath = here;
+  }, [here, inSettings]);
+
+  return returnPath ?? fallback;
+}
diff --git a/web/src/hooks/useSidebarSwap.test.ts b/web/src/hooks/useSidebarSwap.test.ts
new file mode 100644
index 0000000000..4f683e0ff3
--- /dev/null
+++ b/web/src/hooks/useSidebarSwap.test.ts
@@ -0,0 +1,50 @@
+import { renderHook } from "@testing-library/react";
+import { describe, expect, it } from "vitest";
+
+import { useSidebarEntrance, useSidebarSwap } from "./useSidebarSwap";
+
+describe("useSidebarSwap", () => {
+  it("reports a swap only on the render that crosses the settings boundary", () => {
+    const { result, rerender } = renderHook(({ inSettings }) => useSidebarSwap(inSettings), {
+      initialProps: { inSettings: false },
+    });
+    // A first load has nothing to swap from.
+    expect(result.current).toBeNull();
+
+    rerender({ inSettings: false });
+    expect(result.current).toBeNull();
+
+    rerender({ inSettings: true });
+    expect(result.current).toBe("forward");
+    rerender({ inSettings: true });
+    expect(result.current).toBeNull();
+
+    rerender({ inSettings: false });
+    expect(result.current).toBe("back");
+  });
+
+  it("remembers the last sidebar across a shell remount", () => {
+    // The app shell is mounted per route branch: the one leaving settings is
+    // not the one that renders the destination.
+    const before = renderHook(() => useSidebarSwap(false));
+    before.unmount();
+
+    const settings = renderHook(() => useSidebarSwap(true));
+    expect(settings.result.current).toBe("forward");
+    settings.unmount();
+
+    const after = renderHook(() => useSidebarSwap(false));
+    expect(after.result.current).toBe("back");
+  });
+});
+
+describe("useSidebarEntrance", () => {
+  it("keeps the swap it mounted with when later renders report none", () => {
+    const { result, rerender } = renderHook(({ swap }) => useSidebarEntrance(swap), {
+      initialProps: { swap: "forward" as "forward" | null },
+    });
+    rerender({ swap: null });
+
+    expect(result.current).toBe("forward");
+  });
+});
diff --git a/web/src/hooks/useSidebarSwap.ts b/web/src/hooks/useSidebarSwap.ts
new file mode 100644
index 0000000000..c4991a963a
--- /dev/null
+++ b/web/src/hooks/useSidebarSwap.ts
@@ -0,0 +1,41 @@
+import { useEffect, useState } from "react";
+
+/**
+ * Which way the app's sidebar column just changed: `forward` into settings,
+ * `back` out of it.
+ */
+export type SidebarSwap = "forward" | "back";
+
+// Module state rather than a ref: the app shell is mounted per route branch,
+// so the shell that renders after the swap is not the one that saw the
+// sidebar before it.
+let showedSettings: boolean | undefined;
+
+/**
+ * Whether this render swaps the sidebar column between the app's navigation
+ * and the settings sidebar, so the incoming one can animate in.
+ * Null on a first load and on every navigation that keeps the same sidebar.
+ *
+ * The answer is only true for the render that crosses the boundary; the
+ * sidebar that mounts on it should hold onto it for its entrance (see
+ * `useSidebarEntrance`).
+ */
+export function useSidebarSwap(inSettings: boolean): SidebarSwap | null {
+  const previous = showedSettings;
+
+  useEffect(() => {
+    showedSettings = inSettings;
+  }, [inSettings]);
+
+  if (previous === undefined || previous === inSettings) return null;
+  return inSettings ? "forward" : "back";
+}
+
+/**
+ * Holds a swap for the life of the sidebar that mounted on it, so later renders
+ * of the shell (which report no swap) cannot cut its entrance short.
+ */
+export function useSidebarEntrance(swap: SidebarSwap | null | undefined): SidebarSwap | undefined {
+  const [entrance] = useState(swap ?? undefined);
+  return entrance;
+}
diff --git a/web/src/hooks/useUserSettingsGroups.ts b/web/src/hooks/useUserSettingsGroups.ts
new file mode 100644
index 0000000000..9e7c230ee5
--- /dev/null
+++ b/web/src/hooks/useUserSettingsGroups.ts
@@ -0,0 +1,19 @@
+import { useMemo } from "react";
+
+import { useRequestFeatureStatus } from "@/hooks/queries/useRequests";
+import { useCurrentProfile } from "@/hooks/useCurrentProfile";
+import { useIsActingAdmin } from "@/hooks/useIsActingAdmin";
+import { visibleUserSettingsGroups, type UserSettingsNavGroup } from "@/lib/userSettingsNav";
+
+/** The personal settings pages the signed-in profile can open, grouped. */
+export function useUserSettingsGroups(): UserSettingsNavGroup[] {
+  const { profile } = useCurrentProfile();
+  const actingAdmin = useIsActingAdmin();
+  const canManageProfiles = actingAdmin || profile?.is_primary === true;
+  const requestsEnabled = useRequestFeatureStatus().data?.requests_enabled === true;
+
+  return useMemo(
+    () => visibleUserSettingsGroups({ canManageProfiles, requestsEnabled }),
+    [canManageProfiles, requestsEnabled],
+  );
+}
diff --git a/web/src/lib/accentColor.test.ts b/web/src/lib/accentColor.test.ts
new file mode 100644
index 0000000000..97679ba1a5
--- /dev/null
+++ b/web/src/lib/accentColor.test.ts
@@ -0,0 +1,37 @@
+import { describe, expect, it } from "vitest";
+
+import { accentDeclarations } from "./accentColor";
+
+describe("accentDeclarations", () => {
+  it("keeps Cinema Dark's dark labels on a light accent", () => {
+    expect(accentDeclarations("#10b981")).toEqual({
+      primary: "#10b981",
+      ring: "#10b981",
+      "sidebar-primary": "#10b981",
+    });
+  });
+
+  it("turns the labels white on a dark accent", () => {
+    const cases: [accent: string, hex: string][] = [
+      ["#000000", "#000000"],
+      ["#4f46e5", "#4f46e5"],
+      ["#64748B", "#64748b"],
+      ["#00f", "#0000ff"],
+    ];
+    for (const [accent, hex] of cases) {
+      expect(accentDeclarations(accent), accent).toMatchObject({
+        primary: hex,
+        "primary-foreground": "#ffffff",
+        "sidebar-primary-foreground": "#ffffff",
+      });
+    }
+  });
+
+  // Email buttons honor only hex too, and the admin picker only writes hex.
+  it("ignores a value that is not a hex color", () => {
+    expect(accentDeclarations("rebeccapurple")).toBeNull();
+    expect(accentDeclarations("rgb(0, 0, 0)")).toBeNull();
+    expect(accentDeclarations("red;} body{display:none")).toBeNull();
+    expect(accentDeclarations("#12345")).toBeNull();
+  });
+});
diff --git a/web/src/lib/accentColor.ts b/web/src/lib/accentColor.ts
new file mode 100644
index 0000000000..7eac0220a6
--- /dev/null
+++ b/web/src/lib/accentColor.ts
@@ -0,0 +1,58 @@
+/** Cinema Dark's label color on primary surfaces (--primary-foreground). */
+const DARK_LABEL = "#141417";
+const WHITE_LABEL = "#ffffff";
+
+/**
+ * Returns the stored accent as lowercase "#rrggbb" when it is a "#rgb" or
+ * "#rrggbb" hex color, else null. The setting is free text, but the admin
+ * picker only writes hex, and email buttons (internal/mail) honor only hex too.
+ */
+function normalizeHex(color: string): string | null {
+  const match = /^#([0-9a-f]{3}|[0-9a-f]{6})$/i.exec(color.trim());
+  if (!match?.[1]) return null;
+  const digits = match[1].toLowerCase();
+  return digits.length === 3
+    ? `#${[...digits].map((digit) => digit + digit).join("")}`
+    : `#${digits}`;
+}
+
+function relativeLuminance(hex: string): number {
+  const value = parseInt(hex.slice(1), 16);
+  const channel = (shift: number) => {
+    const c = ((value >> shift) & 0xff) / 255;
+    return c <= 0.04045 ? c / 12.92 : ((c + 0.055) / 1.055) ** 2.4;
+  };
+  return 0.2126 * channel(16) + 0.7152 * channel(8) + 0.0722 * channel(0);
+}
+
+/**
+ * Whether white text has higher WCAG contrast than Cinema Dark's dark label on
+ * the accent. Email buttons make the same choice (internal/mail).
+ */
+function prefersWhiteLabel(hex: string): boolean {
+  const background = relativeLuminance(hex);
+  const dark = relativeLuminance(DARK_LABEL);
+  return (1 + 0.05) / (background + 0.05) > (background + 0.05) / (dark + 0.05);
+}
+
+/**
+ * The CSS custom properties the admin's accent sets, or null when the stored
+ * value is not a hex color, which is then ignored as email ignores it. The
+ * accent recolors the primary action color, the focus ring, and the sidebar's
+ * primary accent. When white reads better on it, the labels drawn on those
+ * surfaces turn white too; a light accent keeps Cinema Dark's own dark labels.
+ */
+export function accentDeclarations(accent: string): Record<string, string> | null {
+  const hex = normalizeHex(accent);
+  if (!hex) return null;
+  const declarations: Record<string, string> = {
+    primary: hex,
+    ring: hex,
+    "sidebar-primary": hex,
+  };
+  if (prefersWhiteLabel(hex)) {
+    declarations["primary-foreground"] = WHITE_LABEL;
+    declarations["sidebar-primary-foreground"] = WHITE_LABEL;
+  }
+  return declarations;
+}
diff --git a/web/src/lib/accentMapping.ts b/web/src/lib/accentMapping.ts
deleted file mode 100644
index 1be843fa1c..0000000000
--- a/web/src/lib/accentMapping.ts
+++ /dev/null
@@ -1,18 +0,0 @@
-import type { ThemeToken } from "@/lib/themeTokens";
-
-/**
- * Theme tokens driven by the brand accent quick-picker. Setting one accent
- * color recolors the primary action color, the focus ring, and the sidebar's
- * primary accent so the brand color shows across the prominent UI surfaces.
- * Admins who want finer control still have the full TokenEditor in Theming.
- */
-export const ACCENT_TOKENS: readonly ThemeToken[] = ["primary", "ring", "sidebar-primary"];
-
-/** Maps a chosen accent hex to the token overrides that recolor the UI accent. */
-export function accentColorToTokens(hex: string): Record<string, string> {
-  const out: Record<string, string> = {};
-  for (const token of ACCENT_TOKENS) {
-    out[token] = hex;
-  }
-  return out;
-}
diff --git a/web/src/lib/adminNavigation.test.ts b/web/src/lib/adminNavigation.test.ts
index d73328a3c4..1bf0f712b2 100644
--- a/web/src/lib/adminNavigation.test.ts
+++ b/web/src/lib/adminNavigation.test.ts
@@ -4,7 +4,55 @@ import { describe, expect, it } from "vitest";
 
 import { filterSettingsSearchGroups } from "@/components/settings/settingsSearch";
 
-import { buildAdminCommandNavSections } from "./adminNavigation";
+import { ADMIN_SETTINGS_NAV } from "./adminSettingsSearch";
+import {
+  ADMIN_NAV_SECTIONS,
+  buildAdminCommandNavSections,
+  isAdminNavTopic,
+} from "./adminNavigation";
+
+const TOOL_PAGES = [
+  "/admin",
+  "/admin/activity",
+  "/admin/logs",
+  "/admin/diagnostics",
+  "/admin/libraries",
+  "/admin/livetv",
+  "/admin/autoscan",
+  "/admin/autoscan/activity",
+  "/admin/collections",
+  "/admin/sections",
+  "/admin/marker-history",
+  "/admin/subtitles",
+  "/admin/requests",
+  "/admin/users",
+  "/admin/access-groups",
+  "/admin/devices",
+  "/admin/history-import",
+  "/admin/nodes",
+  "/admin/history",
+  "/admin/downloads",
+  "/admin/tasks",
+  "/admin/maintenance",
+  "/admin/api-keys",
+  "/admin/policy",
+  "/admin/plugins",
+  "/admin/recommendations",
+];
+
+describe("admin sidebar tree", () => {
+  it("lists every admin page and settings page exactly once", () => {
+    const hrefs = ADMIN_NAV_SECTIONS.flatMap((section) =>
+      section.entries.flatMap((entry) =>
+        isAdminNavTopic(entry) ? entry.items.map((item) => item.href) : [entry.href],
+      ),
+    );
+
+    expect([...hrefs].sort()).toEqual(
+      [...TOOL_PAGES, ...ADMIN_SETTINGS_NAV.map((page) => `/admin/settings/${page.id}`)].sort(),
+    );
+  });
+});
 
 function hrefsFor(query: string): string[] {
   return filterSettingsSearchGroups(buildAdminCommandNavSections(undefined), query).flatMap(
@@ -27,4 +75,15 @@ describe("admin command palette", () => {
   it("still finds the request queue", () => {
     expect(hrefsFor("approvals")).toContain("/admin/requests");
   });
+
+  it("groups a topic's pages under the topic, so a bare Settings says whose", () => {
+    const requests = buildAdminCommandNavSections(undefined).find(
+      (group) => group.label === "Requests",
+    );
+
+    expect(requests?.items.map((item) => [item.label, item.href])).toEqual([
+      ["Queue", "/admin/requests"],
+      ["Settings", "/admin/settings/requests"],
+    ]);
+  });
 });
diff --git a/web/src/lib/adminNavigation.ts b/web/src/lib/adminNavigation.ts
index b04e814e8b..5bf44f6023 100644
--- a/web/src/lib/adminNavigation.ts
+++ b/web/src/lib/adminNavigation.ts
@@ -12,13 +12,16 @@ import {
   LayoutPanelTop,
   Library,
   MonitorSmartphone,
+  PlayCircle,
   Puzzle,
+  Radar,
   Radio,
   Rows2,
   ScrollText,
   Send,
   Server,
   Settings2,
+  Shield,
   ShieldCheck,
   SkipForward,
   Users,
@@ -29,7 +32,7 @@ import type { LucideIcon } from "lucide-react";
 
 import type { PluginInstallation } from "@/api/types";
 import type { SettingsSearchGroup, SettingsSearchItem } from "@/components/settings/settingsSearch";
-import { ADMIN_SETTINGS_NAV } from "@/lib/adminSettingsSearch";
+import { ADMIN_SETTINGS_NAV, adminSettingsHref } from "@/lib/adminSettingsSearch";
 import { pluginRouteHref } from "@/lib/pluginRouteHref";
 
 export interface AdminNavItem extends SettingsSearchItem {
@@ -40,258 +43,412 @@ export interface AdminNavItem extends SettingsSearchItem {
   external?: boolean;
 }
 
+/** A sidebar topic: a heading that opens to list its pages. */
+export interface AdminNavTopic {
+  /** Stable key for the topic's remembered open state. */
+  id: string;
+  label: string;
+  icon: LucideIcon;
+  items: AdminNavItem[];
+}
+
+export type AdminNavEntry = AdminNavItem | AdminNavTopic;
+
+export interface AdminNavSection {
+  label: string;
+  entries: AdminNavEntry[];
+}
+
+/** A flat group of pages, as the command palette lists them. */
 export type AdminNavGroup = SettingsSearchGroup<AdminNavItem>;
 
 export interface AdminNavVisibility {
   policyEditorAvailable?: boolean;
 }
 
-export const ADMIN_NAV_SECTIONS: AdminNavGroup[] = [
+export function isAdminNavTopic(entry: AdminNavEntry): entry is AdminNavTopic {
+  return "items" in entry;
+}
+
+const PAGES = {
+  dashboard: {
+    label: "Dashboard",
+    description: "Live sessions, content health, and server activity.",
+    keywords: ["overview", "stats", "health", "scan all"],
+    icon: LayoutDashboard,
+    href: "/admin",
+    exact: true,
+  },
+  activity: {
+    label: "Activity",
+    description: "Live streams and current playback sessions.",
+    keywords: ["streams", "sessions", "now playing", "transcode"],
+    icon: Radio,
+    href: "/admin/activity",
+  },
+  logs: {
+    label: "Logs",
+    description: "Server log stream and operational output.",
+    keywords: ["server logs", "debug", "tail", "events"],
+    icon: ScrollText,
+    href: "/admin/logs",
+  },
+  diagnostics: {
+    label: "Diagnostics",
+    description: "Uploaded client crash reports, device context, and debug bundles.",
+    keywords: ["client diagnostics", "crash reports", "debug bundles", "support"],
+    icon: FileWarning,
+    href: "/admin/diagnostics",
+  },
+  libraries: {
+    label: "Libraries",
+    description: "Media libraries, paths, scanning, and catalog import.",
+    keywords: ["library", "paths", "scan", "catalog", "seed"],
+    icon: Library,
+    href: "/admin/libraries",
+  },
+  liveTv: {
+    label: "Live TV",
+    description: "HDHomeRun tuners, channel lineup, Schedules Direct, and XML sync guide sources.",
+    keywords: ["ota", "hdhomerun", "epg", "dvr", "guide", "schedules direct"],
+    icon: Radio,
+    href: "/admin/livetv",
+  },
+  autoscanSources: {
+    label: "Sources",
+    description: "What Autoscan watches for changes: folders, webhooks, and servers.",
+    keywords: ["autoscan", "scan sources", "polling", "webhook source", "run now"],
+    icon: Radar,
+    href: "/admin/autoscan",
+    // Activity is its own page below this path.
+    exact: true,
+  },
+  autoscanActivity: {
+    label: "Activity",
+    description: "Changes Autoscan received and the scans they started.",
+    keywords: ["autoscan", "scan queue", "scan events", "scan history"],
+    icon: Radar,
+    href: "/admin/autoscan/activity",
+  },
+  collections: {
+    label: "Collections",
+    description: "Curated and smart collection management.",
+    keywords: ["collection groups", "templates", "smart collections"],
+    icon: LayoutPanelTop,
+    href: "/admin/collections",
+  },
+  sections: {
+    label: "Sections",
+    description: "Rows on Home and on library pages.",
+    keywords: ["home rows", "rows", "rails", "featured sections"],
+    icon: Rows2,
+    href: "/admin/sections",
+  },
+  requests: {
+    label: "Requests",
+    description: "Review, approve, and decline media requests.",
+    // Servers, routing, and the request limit itself live on the Requests
+    // settings page, which the command palette lists with its own keywords.
+    // A group's or an account's own limit lives with the group or account.
+    keywords: ["requested media", "approvals", "request queue", "decline"],
+    icon: Send,
+    href: "/admin/requests",
+  },
+  scheduledTasks: {
+    label: "Scheduled Tasks",
+    description: "Background task schedules, runs, and job history.",
+    keywords: ["tasks", "jobs", "scheduler", "sync"],
+    icon: CalendarClock,
+    href: "/admin/tasks",
+  },
+  subtitleFiles: {
+    label: "Subtitle Files",
+    description: "Downloaded subtitle records and subtitle admin tools.",
+    keywords: ["captions", "subtitle downloads", "providers"],
+    icon: Captions,
+    href: "/admin/subtitles",
+  },
+  markers: {
+    label: "Markers",
+    description: "Intro, recap, and credits marker history.",
+    keywords: ["intro markers", "credits", "recaps", "chapters"],
+    icon: SkipForward,
+    href: "/admin/marker-history",
+  },
+  recommendations: {
+    label: "Recommendations",
+    description: "Recommendation diagnostics, seed data, and ranking controls.",
+    keywords: ["taste", "ranking", "recommendation seeds"],
+    icon: Bot,
+    href: "/admin/recommendations",
+  },
+  users: {
+    label: "Users",
+    description: "Accounts, roles, profile settings, and access.",
+    keywords: ["accounts", "profiles", "roles", "permissions"],
+    icon: Users,
+    href: "/admin/users",
+  },
+  accessGroups: {
+    label: "Access Groups",
+    description: "Shared access defaults: libraries, downloads, streams, requests, permissions.",
+    keywords: [
+      "groups",
+      "roles",
+      "permissions",
+      "library access",
+      "downloads",
+      "limits",
+      "request limits",
+    ],
+    icon: UsersRound,
+    href: "/admin/access-groups",
+  },
+  devices: {
+    label: "Devices",
+    description: "Registered devices, overrides, and per-device settings.",
+    keywords: ["clients", "device overrides", "sessions"],
+    icon: MonitorSmartphone,
+    href: "/admin/devices",
+  },
+  playbackHistory: {
+    label: "Playback History",
+    description: "Historical playback events across users and profiles.",
+    keywords: ["history", "watched", "progress", "plays"],
+    icon: History,
+    href: "/admin/history",
+  },
+  historyImport: {
+    label: "History Import",
+    description: "Admin history import mappings and bulk import runs.",
+    keywords: ["emby", "imports", "mappings", "watch history"],
+    icon: Download,
+    href: "/admin/history-import",
+  },
+  plugins: {
+    label: "Plugins",
+    description: "Plugin catalog, repositories, installs, and plugin configuration.",
+    keywords: ["extensions", "plugin catalog", "repositories"],
+    icon: Blocks,
+    href: "/admin/plugins",
+  },
+  policy: {
+    label: "Policy",
+    description: "OPA policy documents, vendor modules, simulations, and decision logs.",
+    keywords: ["opa", "rego", "authorization", "decision log", "access policy"],
+    icon: ShieldCheck,
+    href: "/admin/policy",
+  },
+  nodes: {
+    label: "Nodes",
+    description: "Stream nodes, remote worker status, and where playback work runs.",
+    keywords: [
+      "stream nodes",
+      "workers",
+      "transcode nodes",
+      "proxy nodes",
+      "routing",
+      "egress",
+      "gpu offload",
+      "central egress",
+    ],
+    settings: [
+      { label: "Routing preset" },
+      { label: "Direct play egress" },
+      { label: "Remux execution" },
+      { label: "Remux egress" },
+      { label: "Video transcode execution" },
+      { label: "Video transcode egress" },
+    ],
+    icon: Server,
+    href: "/admin/nodes",
+  },
+  downloads: {
+    label: "Downloads",
+    description: "Prepared download storage on the server and nodes, and device copies.",
+    keywords: [
+      "offline downloads",
+      "prepared files",
+      "artifacts",
+      "disk space",
+      "storage",
+      "revoke",
+      "devices",
+    ],
+    icon: HardDriveDownload,
+    href: "/admin/downloads",
+  },
+  apiKeys: {
+    label: "API Keys",
+    description: "Admin API keys and tier assignment.",
+    keywords: ["tokens", "keys", "access", "rate limit tier"],
+    icon: KeyRound,
+    href: "/admin/api-keys",
+  },
+  maintenance: {
+    label: "Maintenance",
+    description: "Operational maintenance tools.",
+    keywords: ["repair", "cleanup", "system maintenance"],
+    icon: Wrench,
+    href: "/admin/maintenance",
+  },
+} satisfies Record<string, AdminNavItem>;
+
+/**
+ * A settings page as a sidebar entry. Under a topic that also holds tools the
+ * page is just "Settings"; the topic already says whose. Its own name stays a
+ * keyword, so searching "Logging" still finds Logs › Settings.
+ */
+function settingsPage(id: string, label?: string): AdminNavItem {
+  const page = ADMIN_SETTINGS_NAV.find((item) => item.id === id);
+  if (!page) throw new Error(`Unknown admin settings page ${id}`);
+  return {
+    label: label ?? page.label,
+    description: page.description,
+    keywords: ["settings", "configuration", page.label, ...(page.keywords ?? [])],
+    settings: page.settings,
+    icon: page.icon,
+    href: adminSettingsHref(id),
+  };
+}
+
+/**
+ * The admin sidebar. Tools and settings sit together under the topic they are
+ * about, so an admin looks for "Requests", not "request settings"; a topic's own
+ * settings page is its last entry. Every admin page appears exactly once.
+ */
+export const ADMIN_NAV_SECTIONS: AdminNavSection[] = [
   {
-    label: "Overview",
-    items: [
-      {
-        label: "Dashboard",
-        description: "Live sessions, content health, and server activity.",
-        keywords: ["overview", "stats", "health", "scan all"],
-        icon: LayoutDashboard,
-        href: "/admin",
-        exact: true,
-      },
-      {
-        label: "Activity",
-        description: "Live streams and current playback sessions.",
-        keywords: ["streams", "sessions", "now playing", "transcode"],
-        icon: Radio,
-        href: "/admin/activity",
-      },
+    label: "Monitor",
+    entries: [
+      PAGES.dashboard,
+      PAGES.activity,
       {
+        id: "logs",
         label: "Logs",
-        description: "Server log stream and operational output.",
-        keywords: ["server logs", "debug", "tail", "events"],
         icon: ScrollText,
-        href: "/admin/logs",
-      },
-      {
-        label: "Diagnostics",
-        description: "Uploaded client crash reports, device context, and debug bundles.",
-        keywords: ["client diagnostics", "crash reports", "debug bundles", "support"],
-        icon: FileWarning,
-        href: "/admin/diagnostics",
+        items: [
+          { ...PAGES.logs, label: "Server Log" },
+          { ...PAGES.diagnostics, label: "Client Diagnostics" },
+          settingsPage("logging", "Settings"),
+        ],
       },
     ],
   },
   {
-    label: "Content",
-    items: [
+    label: "Manage",
+    entries: [
       {
+        id: "libraries",
         label: "Libraries",
-        description: "Media libraries, paths, scanning, autoscan sources, and catalog import.",
-        keywords: [
-          "library",
-          "paths",
-          "scan",
-          "catalog",
-          "seed",
-          "autoscan",
-          "scan queue",
-          "polling",
-          "webhook source",
-        ],
         icon: Library,
-        href: "/admin/libraries",
-      },
-      {
-        label: "Live TV",
-        description:
-          "HDHomeRun tuners, channel lineup, Schedules Direct, and XML sync guide sources.",
-        keywords: ["ota", "hdhomerun", "epg", "dvr", "guide", "schedules direct"],
-        icon: Radio,
-        href: "/admin/livetv",
-      },
-      {
-        label: "Collections",
-        description: "Curated and smart collection management.",
-        keywords: ["collection groups", "templates", "smart collections"],
-        icon: LayoutPanelTop,
-        href: "/admin/collections",
+        items: [
+          PAGES.libraries,
+          PAGES.liveTv,
+          PAGES.collections,
+          { ...PAGES.sections, label: "Home Sections" },
+          PAGES.subtitleFiles,
+          settingsPage("library", "Settings"),
+        ],
       },
       {
-        label: "Sections",
-        description: "Rows on Home and on library pages.",
-        keywords: ["home rows", "rows", "rails", "featured sections"],
-        icon: Rows2,
-        href: "/admin/sections",
+        id: "autoscan",
+        label: "Autoscan",
+        icon: Radar,
+        items: [
+          PAGES.autoscanActivity,
+          PAGES.autoscanSources,
+          settingsPage("autoscan", "Settings"),
+        ],
       },
       {
+        id: "requests",
         label: "Requests",
-        description: "Review, approve, and decline media requests.",
-        // Servers, routing, and the request limit itself live on the Requests
-        // settings page, which the command palette lists with its own keywords.
-        // A group's or an account's own limit lives with the group or account.
-        keywords: ["requested media", "approvals", "request queue", "decline"],
         icon: Send,
-        href: "/admin/requests",
-      },
-    ],
-  },
-  {
-    label: "Automation",
-    items: [
-      {
-        label: "Scheduled Tasks",
-        description: "Background task schedules, runs, and job history.",
-        keywords: ["tasks", "jobs", "scheduler", "sync"],
-        icon: CalendarClock,
-        href: "/admin/tasks",
+        items: [{ ...PAGES.requests, label: "Queue" }, settingsPage("requests", "Settings")],
       },
       {
-        label: "Subtitle Files",
-        description: "Downloaded subtitle records and subtitle admin tools.",
-        keywords: ["captions", "subtitle downloads", "providers"],
-        icon: Captions,
-        href: "/admin/subtitles",
-      },
-      {
-        label: "Markers",
-        description: "Intro, recap, and credits marker history.",
-        keywords: ["intro markers", "credits", "recaps", "chapters"],
-        icon: SkipForward,
-        href: "/admin/marker-history",
-      },
-      {
-        label: "Recommendations",
-        description: "Recommendation diagnostics, seed data, and ranking controls.",
-        keywords: ["taste", "ranking", "recommendation seeds"],
-        icon: Bot,
-        href: "/admin/recommendations",
-      },
-    ],
-  },
-  {
-    label: "Users",
-    items: [
-      {
+        id: "users",
         label: "Users",
-        description: "Accounts, roles, profile settings, and access.",
-        keywords: ["accounts", "profiles", "roles", "permissions"],
         icon: Users,
-        href: "/admin/users",
+        items: [PAGES.users, PAGES.accessGroups, PAGES.devices, PAGES.historyImport],
       },
       {
-        label: "Access Groups",
-        description:
-          "Shared access defaults: libraries, downloads, streams, requests, permissions.",
-        keywords: [
-          "groups",
-          "roles",
-          "permissions",
-          "library access",
-          "downloads",
-          "limits",
-          "request limits",
+        id: "playback",
+        label: "Playback",
+        icon: PlayCircle,
+        items: [
+          { ...PAGES.playbackHistory, label: "History" },
+          { ...PAGES.markers, label: "Skip Markers" },
+          PAGES.nodes,
+          settingsPage("playback", "Settings"),
         ],
-        icon: UsersRound,
-        href: "/admin/access-groups",
-      },
-      {
-        label: "Devices",
-        description: "Registered devices, overrides, and per-device settings.",
-        keywords: ["clients", "device overrides", "sessions"],
-        icon: MonitorSmartphone,
-        href: "/admin/devices",
       },
       {
-        label: "Playback History",
-        description: "Historical playback events across users and profiles.",
-        keywords: ["history", "watched", "progress", "plays"],
-        icon: History,
-        href: "/admin/history",
-      },
-      {
-        label: "History Import",
-        description: "Admin history import mappings and bulk import runs.",
-        keywords: ["emby", "imports", "mappings", "watch history"],
-        icon: Download,
-        href: "/admin/history-import",
+        id: "downloads",
+        label: "Downloads",
+        icon: HardDriveDownload,
+        items: [
+          { ...PAGES.downloads, label: "Prepared Files" },
+          settingsPage("downloads", "Settings"),
+        ],
       },
     ],
   },
   {
-    label: "Settings",
-    items: [
+    label: "Configure",
+    entries: [
       {
-        label: "Settings",
-        description: "Server configuration, integrations, playback, storage, and access.",
-        keywords: ["settings", "configuration", "server settings", "preferences"],
+        id: "server",
+        label: "Server",
         icon: Settings2,
-        href: "/admin/settings",
-      },
-    ],
-  },
-  {
-    label: "System",
-    items: [
-      {
-        label: "Plugins",
-        description: "Plugin catalog, repositories, installs, and plugin configuration.",
-        keywords: ["extensions", "plugin catalog", "repositories"],
-        icon: Blocks,
-        href: "/admin/plugins",
-      },
-      {
-        label: "Policy",
-        description: "OPA policy documents, vendor modules, simulations, and decision logs.",
-        keywords: ["opa", "rego", "authorization", "decision log", "access policy"],
-        icon: ShieldCheck,
-        href: "/admin/policy",
-      },
-      {
-        label: "Nodes",
-        description: "Stream nodes and remote worker status.",
-        keywords: ["stream nodes", "workers", "transcode nodes"],
-        icon: Server,
-        href: "/admin/nodes",
-      },
-      {
-        label: "Downloads",
-        description: "Prepared download storage on the server and nodes, and device copies.",
-        keywords: [
-          "offline downloads",
-          "prepared files",
-          "artifacts",
-          "disk space",
-          "storage",
-          "revoke",
-          "devices",
+        items: [
+          settingsPage("general"),
+          settingsPage("appearance"),
+          settingsPage("storage"),
+          settingsPage("search"),
+          settingsPage("network-access"),
+          PAGES.scheduledTasks,
+          PAGES.maintenance,
+          settingsPage("about"),
         ],
-        icon: HardDriveDownload,
-        href: "/admin/downloads",
       },
       {
-        label: "API Keys",
-        description: "Admin API keys and tier assignment.",
-        keywords: ["tokens", "keys", "access", "rate limit tier"],
-        icon: KeyRound,
-        href: "/admin/api-keys",
+        id: "access",
+        label: "Sign-in & Security",
+        icon: Shield,
+        items: [settingsPage("sign-in"), settingsPage("security"), PAGES.apiKeys, PAGES.policy],
       },
       {
-        label: "Maintenance",
-        description: "Operational maintenance tools.",
-        keywords: ["repair", "cleanup", "system maintenance"],
-        icon: Wrench,
-        href: "/admin/maintenance",
+        id: "integrations",
+        label: "Integrations",
+        icon: Puzzle,
+        items: [
+          PAGES.plugins,
+          settingsPage("providers"),
+          settingsPage("email"),
+          settingsPage("notifications"),
+          settingsPage("ai"),
+          PAGES.recommendations,
+          settingsPage("compatibility"),
+        ],
       },
     ],
   },
 ];
 
-export function buildAdminNavSections(visibility: AdminNavVisibility = {}): AdminNavGroup[] {
+function visibleItem(item: AdminNavItem, visibility: AdminNavVisibility): boolean {
+  return item.href !== "/admin/policy" || visibility.policyEditorAvailable === true;
+}
+
+export function buildAdminNavSections(visibility: AdminNavVisibility = {}): AdminNavSection[] {
   return ADMIN_NAV_SECTIONS.map((section) => ({
     ...section,
-    items: section.items.filter(
-      (item) => item.href !== "/admin/policy" || visibility.policyEditorAvailable === true,
-    ),
+    entries: section.entries.flatMap((entry): AdminNavEntry[] => {
+      if (!isAdminNavTopic(entry)) return visibleItem(entry, visibility) ? [entry] : [];
+      const items = entry.items.filter((item) => visibleItem(item, visibility));
+      return items.length > 0 ? [{ ...entry, items }] : [];
+    }),
   }));
 }
 
@@ -340,30 +497,24 @@ export function appendAdminPluginNavSection(
   ];
 }
 
+/**
+ * The command palette's groups: the sidebar's loose pages under their section,
+ * and each topic as its own group, so a result reads "Requests" over
+ * "Settings" rather than a bare "Settings". Every setting each settings page
+ * indexes is searchable through its entry.
+ */
 export function buildAdminCommandNavSections(
   installations: readonly PluginInstallation[] | undefined,
   visibility: AdminNavVisibility = {},
 ): AdminNavGroup[] {
-  // Keep the persistent sidebar quiet while preserving direct access to every
-  // settings category and individual setting through Cmd+K.
-  const sections = buildAdminNavSections(visibility).map((section) =>
-    section.label === "Settings"
-      ? {
-          ...section,
-          items: [
-            ...section.items,
-            ...ADMIN_SETTINGS_NAV.map((item) => ({
-              label: item.label,
-              description: item.description,
-              keywords: ["settings", "configuration", ...(item.keywords ?? [])],
-              settings: item.settings,
-              icon: item.icon,
-              href: `/admin/settings/${encodeURIComponent(item.id)}`,
-            })),
-          ],
-        }
-      : section,
-  );
+  const groups: AdminNavGroup[] = [];
+  for (const section of buildAdminNavSections(visibility)) {
+    const loose = section.entries.filter((entry): entry is AdminNavItem => !isAdminNavTopic(entry));
+    if (loose.length > 0) groups.push({ label: section.label, items: loose });
+    for (const entry of section.entries) {
+      if (isAdminNavTopic(entry)) groups.push({ label: entry.label, items: entry.items });
+    }
+  }
 
-  return appendAdminPluginNavSection(sections, installations);
+  return appendAdminPluginNavSection(groups, installations);
 }
diff --git a/web/src/lib/adminSettingsSearch.test.ts b/web/src/lib/adminSettingsSearch.test.ts
index 63abec7d4b..5208bf3bde 100644
--- a/web/src/lib/adminSettingsSearch.test.ts
+++ b/web/src/lib/adminSettingsSearch.test.ts
@@ -5,8 +5,8 @@ import { filterSettingsSearchEntries } from "@/components/settings/settingsSearc
 import { ADMIN_SETTINGS_NAV } from "./adminSettingsSearch";
 
 describe("adminSettingsSearch", () => {
-  it("finds the Redis database number on the Storage & Database page", () => {
-    const page = ADMIN_SETTINGS_NAV.find((item) => item.id === "infrastructure");
+  it("finds the Redis database number on the General page", () => {
+    const page = ADMIN_SETTINGS_NAV.find((item) => item.id === "general");
 
     expect(filterSettingsSearchEntries(page?.settings, "database number")).toEqual([
       { label: "Database number" },
diff --git a/web/src/lib/adminSettingsSearch.ts b/web/src/lib/adminSettingsSearch.ts
index ef856fa438..4eb68ca104 100644
--- a/web/src/lib/adminSettingsSearch.ts
+++ b/web/src/lib/adminSettingsSearch.ts
@@ -1,711 +1,794 @@
 import {
   Bell,
-  Captions,
-  KeyRound,
+  Blocks,
   Database,
   Download,
   Info,
+  KeyRound,
   Library,
+  Mail,
   Network,
   Paintbrush,
   PlayCircle,
   Plug,
-  RefreshCw,
+  Radar,
+  ScrollText,
+  Search,
   Send,
   Settings2,
+  Shield,
   Sparkles,
-  Users,
 } from "lucide-react";
 import type { LucideIcon } from "lucide-react";
 
-import type { SettingsSearchGroup, SettingsSearchItem } from "@/components/settings/settingsSearch";
+import type { SettingsSearchItem } from "@/components/settings/settingsSearch";
 
 export interface AdminSettingsSearchItem extends SettingsSearchItem {
   id: string;
   label: string;
   description: string;
-  /** The named sections visible inside this settings destination. */
-  groups: readonly string[];
   keywords?: readonly string[];
-  settings?: readonly {
-    label: string;
-    description?: string;
-    keywords?: readonly string[];
-  }[];
+  /**
+   * Every group heading and control on the page, by its visible label, so the
+   * sidebar search and ⌘K can find it. Keep it in step with the page.
+   */
+  settings?: readonly { label: string; description?: string; keywords?: readonly string[] }[];
   icon: LucideIcon;
   /**
    * Short qualifier rendered next to the label in a nav that wants one. The
-   * settings rail reads section health as a status dot instead, so nothing
-   * sets this today; the prop stays so a future nav can opt in without
-   * reshaping the item type.
+   * admin sidebar reads page health as a status dot instead, so nothing sets
+   * this today; the prop stays so a future nav can opt in without reshaping
+   * the item type.
    */
   badge?: string;
 }
 
-export type AdminSettingsSearchGroup = SettingsSearchGroup<AdminSettingsSearchItem>;
-
 const settingIndex = (...labels: string[]) => labels.map((label) => ({ label }));
 
-// Page ids are stable route segments. Old ids from the 20-tab layout are kept
-// working by LEGACY_ADMIN_SETTINGS_PAGE_ALIASES below — regroup or reorder
-// freely, but add an alias entry whenever an id disappears.
+// Every admin settings page, with what search needs to find it. Where a page
+// sits in the admin sidebar is ADMIN_NAV_SECTIONS' call (lib/adminNavigation);
+// this list is only the registry. Page ids are stable route segments. Old ids
+// from the 20-tab layout are kept working by LEGACY_ADMIN_SETTINGS_PAGE_ALIASES
+// below — add an alias entry whenever an id disappears.
 //
-// One group keeps the Overview cards and command palette in the same order.
-export const ADMIN_SETTINGS_GROUPS: AdminSettingsSearchGroup[] = [
+// A setting lives on the page whose name covers it: public signups and
+// password reset only work with Prairie passwords, so they are on Sign-in, and
+// every log setting is on Logging.
+export const ADMIN_SETTINGS_NAV: AdminSettingsSearchItem[] = [
+  {
+    id: "about",
+    label: "About",
+    description: "Server version, update status, and changelog.",
+    keywords: ["version", "build", "update", "changelog", "release notes", "revision", "git"],
+    settings: settingIndex("Version", "Update status", "Latest version", "Changelog"),
+    icon: Info,
+  },
+  {
+    id: "general",
+    label: "General",
+    description: "The server's name and public address, the proxies in front of it, and Redis.",
+    keywords: [
+      "server name",
+      "login subtitle",
+      "branding name",
+      "public url",
+      "lan discovery",
+      "local network",
+      "local address",
+      "lan address",
+      "multicast",
+      "reverse proxy",
+      "trusted proxies",
+      "x-forwarded-for",
+      "client ip",
+      "redis",
+      "postgres",
+      "database",
+      "pool",
+    ],
+    settings: settingIndex(
+      "Identity",
+      "Server name",
+      "Login subtitle",
+      "Network",
+      "Prairie public URL",
+      "Show on the local network",
+      "Local network address",
+      "Trusted proxies",
+      "Database",
+      "Maximum Postgres connections",
+      "Redis",
+      "Use Redis",
+      "Connection URL",
+      "Database number",
+      "Check connection",
+    ),
+    icon: Settings2,
+  },
+  {
+    id: "appearance",
+    label: "Appearance",
+    description: "Logos, the accent color, and poster badge defaults.",
+    keywords: [
+      "logo",
+      "wordmark",
+      "favicon",
+      "login background",
+      "white label",
+      "brand",
+      "accent color",
+      "app name",
+      "pwa",
+      "overlays",
+      "poster badges",
+    ],
+    settings: settingIndex(
+      "Logos and icons",
+      "Logo (wordmark)",
+      "Logo (icon)",
+      "Favicon",
+      "Login background",
+      "Colors",
+      "Accent color",
+      "Custom accent color",
+      "Card overlays",
+      "Show badges on poster art",
+      "Badge style",
+      "Restore defaults",
+    ),
+    icon: Paintbrush,
+  },
+  {
+    id: "storage",
+    label: "Storage",
+    description: "Where artwork and uploads are stored: local disk or S3 buckets.",
+    keywords: [
+      "s3",
+      "bucket",
+      "storage",
+      "local storage path",
+      "artwork.storage_backend",
+      "artwork.local_path",
+      "endpoint",
+      "region",
+      "access key",
+      "secret key",
+      "infrastructure",
+      "artwork",
+      "image caching",
+      "cache images",
+      "cloudflare",
+      "presigned",
+    ],
+    settings: settingIndex(
+      "Storage",
+      "Backend",
+      "Local storage path",
+      "Save provider artwork to storage",
+      "Review transition",
+      "What should move?",
+      "Public storage",
+      "Private storage",
+      "Check connection",
+      "Endpoint",
+      "Region",
+      "Bucket",
+      "Access Key",
+      "Secret Key",
+      "Put the bucket name in the URL path",
+      "Folder inside the bucket",
+      "How asset links are authorized",
+      "Address clients download from",
+      "Token Secret",
+      "Token query parameter",
+      "Link lifetime (seconds)",
+    ),
+    icon: Database,
+  },
+  {
+    id: "logging",
+    label: "Logging",
+    description: "What the server logs, and how much log history the database keeps.",
+    keywords: [
+      "log level",
+      "debug",
+      "quiet",
+      "silenced log messages",
+      "ops log",
+      "retention",
+      "decision log",
+      "permission checks",
+      "opa",
+      "audit",
+    ],
+    settings: settingIndex(
+      "Server log",
+      "Log level",
+      "Quiet log prefixes",
+      "Log retention",
+      "Delete log entries older than",
+      "Maximum log size",
+      "Maximum log entries",
+      "Permission checks",
+      "Delete permission records older than",
+      "How much to record",
+    ),
+    icon: ScrollText,
+  },
+  {
+    id: "sign-in",
+    label: "Sign-in",
+    description: "Prairie passwords and signups, single sign-on, and network sign-in.",
+    keywords: [
+      "sso",
+      "single sign-on",
+      "oidc",
+      "openid connect",
+      "ldap",
+      "active directory",
+      "authentik",
+      "authelia",
+      "keycloak",
+      "pocket id",
+      "redirect uri",
+      "callback url",
+      "break-glass",
+      "local password",
+      "auto-create accounts",
+      "email match",
+      "provider logout",
+      "rp-initiated logout",
+      "bind dn",
+      "base dn",
+      "issuer",
+      "client id",
+      "signup",
+      "invite",
+      "forgot password",
+      "password reset",
+      "tailscale",
+    ],
+    settings: settingIndex(
+      "Prairie passwords",
+      "Allow password sign-in",
+      "Public signups",
+      "Self-service password reset",
+      "Manage invite codes",
+      "Single sign-on",
+      "Match existing accounts by email",
+      "Redirect URI",
+      "Post-logout redirect URI",
+      "Issuer URL",
+      "Client ID",
+      "Client secret",
+      "Bind DN",
+      "User search base DN",
+      "Allowed groups",
+      "Admin groups",
+      "Create accounts on first sign-in",
+      "Test the connection",
+      "Login button",
+      "Network sign-in",
+      "How roles and sharing work",
+    ),
+    icon: KeyRound,
+  },
+  {
+    id: "security",
+    label: "Security",
+    description: "Which local servers Prairie may contact, and request rate limits.",
+    keywords: [
+      "private destinations",
+      "ssrf",
+      "rate limit",
+      "throttle",
+      "429",
+      "api key tier",
+      "security",
+    ],
+    settings: settingIndex(
+      "Local network",
+      "Local servers for every account",
+      "Rate limiting",
+      "Enable rate limiting",
+      "Where counters are kept",
+      "Whole-server limit",
+      "Per client address",
+      "API key tiers",
+      "Standard API keys",
+      "Elevated API keys",
+      "Sign-in and webhook endpoints",
+    ),
+    icon: Shield,
+  },
+  {
+    id: "network-access",
+    label: "Network Access",
+    description:
+      "Overlay-network providers such as Tailscale that reach this server without port forwarding.",
+    keywords: [
+      "tailscale",
+      "netbird",
+      "overlay",
+      "tailnet",
+      "vpn",
+      "remote access",
+      "port forwarding",
+      "network access provider",
+      "plugin",
+      "connect",
+      "authorization",
+    ],
+    icon: Network,
+  },
+  {
+    id: "library",
+    label: "Library & Metadata",
+    description:
+      "Which versions a title lists, scanning, maturity limits, ratings, and subtitle sync.",
+    keywords: [
+      "scanner workers",
+      "image encoding workers",
+      "image workers",
+      "cpu",
+      "matcher",
+      "batch size",
+      "versions",
+      "unrated",
+      "age rating",
+      "parental",
+      "rotten tomatoes",
+      "metadata",
+      "subtitle sync",
+      "subtitle timing",
+    ],
+    settings: settingIndex(
+      "General",
+      "Show all library versions on detail page",
+      "Scanning",
+      "Scanner workers",
+      "Matcher workers",
+      "Image encoding workers",
+      "Person lookups per minute",
+      "Matcher batch size",
+      "Maturity limits",
+      "Titles with no age rating",
+      "Ratings",
+      "Subtitle sync",
+      "Sync subtitles automatically",
+      "Where to analyze audio",
+      "Concurrent syncs per transcode node",
+    ),
+    icon: Library,
+  },
+  {
+    id: "search",
+    label: "Search",
+    description: "The search engine: built-in Postgres, or Meilisearch for typo-tolerant search.",
+    keywords: ["meilisearch", "postgres search", "semantic", "typo", "search index", "reindex"],
+    settings: settingIndex(
+      "Search",
+      "Search engine",
+      "Meilisearch URL",
+      "Meilisearch API key",
+      "Check connection",
+      "When a search has several words",
+      "Match by meaning as well as words",
+      "Index name prefix",
+      "Query timeout (ms)",
+      "Items sent to the index per batch",
+      "Meaning-based share of results",
+      "Search status",
+    ),
+    icon: Search,
+  },
+  {
+    id: "autoscan",
+    label: "Autoscan",
+    description:
+      "How often Autoscan checks polled sources, and the servers its sources connect to.",
+    keywords: [
+      "autoscan",
+      "polling",
+      "poll interval",
+      "check interval",
+      "debounce",
+      "connections",
+      "saved servers",
+      "sonarr",
+      "radarr",
+    ],
+    settings: settingIndex(
+      "Polling defaults",
+      "Default check interval",
+      "Debounce",
+      "Connections",
+      "Add connection",
+    ),
+    icon: Radar,
+  },
+  {
+    id: "playback",
+    label: "Playback",
+    description:
+      "Watch thresholds, transcoding, chapter thumbnails and seek previews, and skip markers.",
+    keywords: [
+      "ffmpeg",
+      "transcode",
+      "hardware acceleration",
+      "gpu",
+      "hevc",
+      "tone mapping",
+      "chapter thumbnails",
+      "trickplay",
+      "seek preview",
+      "watched threshold",
+      "resume",
+      "4k",
+      "intro",
+      "credits",
+      "recap",
+      "markers",
+      "marker detection",
+      "credits detection",
+      "skip credits",
+      "TheIntroDB",
+      "online marker storage",
+      "on-demand only",
+      "store markers locally",
+      "populate markers",
+      "contribute markers",
+      "scheduled online sync",
+    ],
+    settings: settingIndex(
+      "Watch behavior",
+      "Mark watched at (%)",
+      "Show in Continue Watching after (%)",
+      "Transcoding",
+      "Video transcoding",
+      "Hardware acceleration",
+      "Allow HEVC encoding",
+      "Allow 4K transcoding",
+      "FFmpeg path",
+      "Transcode directory",
+      "GPU devices",
+      "Enable Hardware HDR Tone Mapping",
+      "Enable Software HDR Tone Mapping",
+      "Throttle transcoding",
+      "Buffer ahead (seconds)",
+      "Transcode back buffer",
+      "Preview images",
+      "Chapter thumbnail workers",
+      "Generate chapter thumbnails on",
+      "HDR handling",
+      "Software HDR tone mapping",
+      "Preview image width",
+      "Seek preview interval",
+      "Seek preview workers",
+      "Generate seek previews on",
+      "HDR chapter thumbnails",
+      "Skip markers",
+      "Marker source",
+      "Detect intros",
+      "Detect credits",
+      "Save online markers",
+      "Find markers on playback",
+      "Detection workers",
+      "Sync online markers",
+      "Detect markers on this server",
+      "Share detected markers",
+    ),
+    icon: PlayCircle,
+  },
+  {
+    id: "downloads",
+    label: "Downloads",
+    description: "Offline downloads, per-user and server-wide limits, and prepared copies.",
+    keywords: [
+      "downloads",
+      "offline",
+      "bandwidth",
+      "mbps",
+      "throttle",
+      "quota",
+      "concurrency",
+      "prepared copies",
+      "artifacts",
+      "storage budget",
+      "cache",
+      "disk ceiling",
+    ],
+    settings: settingIndex(
+      "Downloads",
+      "Allow downloads",
+      "Per-user bandwidth",
+      "Per user",
+      "Downloads at once per user",
+      "Downloads per period",
+      "Period length",
+      "Whole server",
+      "Server bandwidth",
+      "Prepare device-friendly copies",
+      "Prepare locally when workers are unavailable",
+      "Prepared file directory",
+      "Files prepared at once",
+      "Default storage budget per location",
+      "Keep cached files for",
+      "Disk ceiling (%)",
+    ),
+    icon: Download,
+  },
+  {
+    id: "requests",
+    label: "Requests",
+    description:
+      "Request limits and approval, the Sonarr and Radarr servers, and where requests go.",
+    keywords: [
+      "requests",
+      "media requests",
+      "sonarr",
+      "radarr",
+      "arr",
+      "request servers",
+      "routing",
+      "routes",
+      "rules",
+      "anime",
+      "quota",
+      "request limit",
+      "approval",
+      "auto approve",
+      "4k",
+      "root folder",
+      "quality profile",
+      "overseerr",
+      "jellyseerr",
+      "watchlist",
+    ],
+    settings: settingIndex(
+      "General",
+      "Allow requests",
+      "Approval",
+      "Request limit",
+      "Limit window",
+      "Request titles added to a watchlist",
+      "Also request a 4K version of every title",
+      "Servers",
+      "Add server",
+      "API key",
+      "4K server",
+      "Where requests go",
+      "Standard",
+      "Advanced",
+      "Add rule",
+      "Everything else",
+      "Try a title",
+      "Request queue",
+    ),
+    icon: Send,
+  },
   {
-    label: "Settings",
-    items: [
-      {
-        id: "about",
-        label: "About",
-        description: "Server version, update status, and changelog.",
-        groups: ["Version", "Updates", "Changelog"],
-        keywords: ["version", "build", "update", "changelog", "release notes", "revision", "git"],
-        settings: settingIndex("Version", "Update status", "Latest version", "Changelog"),
-        icon: Info,
-      },
-      {
-        id: "general",
-        label: "General",
-        description: "Server identity, public signups, and logging.",
-        groups: ["Identity", "Access", "Logging"],
-        keywords: [
-          "server name",
-          "login subtitle",
-          "signup",
-          "invite",
-          "forgot password",
-          "password reset",
-          "log level",
-          "quiet",
-          "silenced log messages",
-          "branding name",
-        ],
-        settings: settingIndex(
-          "Identity",
-          "Server name",
-          "Login subtitle",
-          "Access",
-          "Public signups",
-          "Self-service password reset",
-          "Logging",
-          "Log level",
-          "Quiet log prefixes",
-        ),
-        icon: Settings2,
-      },
-      {
-        id: "infrastructure",
-        label: "Storage & Database",
-        description: "Redis, S3 storage buckets, the database, and log retention.",
-        groups: ["Redis", "Public storage", "Private storage", "Database", "Logs"],
-        keywords: [
-          "redis",
-          "s3",
-          "bucket",
-          "Storage",
-          "Local storage path",
-          "artwork.storage_backend",
-          "artwork.local_path",
-          "endpoint",
-          "region",
-          "access key",
-          "secret key",
-          "postgres",
-          "pool",
-          "user db",
-          "ops log",
-          "retention",
-          "decision log",
-          "opa",
-          "infrastructure",
-        ],
-        settings: settingIndex(
-          "Redis",
-          "Use Redis",
-          "Connection URL",
-          "Database number",
-          "Public storage",
-          "Private storage",
-          "Endpoint",
-          "Region",
-          "Bucket",
-          "Access Key",
-          "Secret Key",
-          "Put the bucket name in the URL path",
-          "Folder inside the bucket",
-          "How asset links are authorized",
-          "Address clients download from",
-          "Token Secret",
-          "Token query parameter",
-          "Link lifetime (seconds)",
-          "Database",
-          "Maximum Postgres connections",
-          "Where per-user data is stored",
-          "Open files per user",
-          "Close idle user databases after",
-          "Logs",
-          "How much to record",
-          "Delete log entries older than (days)",
-          "Maximum log entries",
-          "Maximum log size (MB)",
-          "Delete permission records older than (days)",
-          "Record one allowed check in every",
-        ),
-        icon: Database,
-      },
-      {
-        id: "appearance",
-        label: "Appearance",
-        description: "Logos, accent color, theme colors, custom CSS, and poster badges.",
-        groups: ["Logos and icons", "Colors", "Card overlays"],
-        keywords: [
-          "logo",
-          "wordmark",
-          "favicon",
-          "login background",
-          "white label",
-          "brand",
-          "accent color",
-          "app name",
-          "pwa",
-          "theme",
-          "custom css",
-          "cinema dark",
-          "reset theme",
-          "overlays",
-          "poster badges",
-        ],
-        settings: settingIndex(
-          "Logos and icons",
-          "Logo (wordmark)",
-          "Logo (icon)",
-          "Favicon",
-          "Login background",
-          "Colors",
-          "Reset to Cinema Dark",
-          "Accent color",
-          "Custom accent color",
-          "Individual colors and fonts",
-          "Custom CSS",
-          "Card overlays",
-          "Show badges on poster art",
-          "Badge style",
-        ),
-        icon: Paintbrush,
-      },
-      {
-        id: "security",
-        label: "Security & Access",
-        description: "Sign-in sessions, trusted proxies, and request rate limits.",
-        groups: ["Sign-in sessions", "Network", "Rate limiting"],
-        keywords: [
-          "access token",
-          "refresh token",
-          "expiry",
-          "session",
-          "proxy",
-          "x-forwarded-for",
-          "client ip",
-          "rate limit",
-          "throttle",
-          "429",
-          "api key tier",
-          "security",
-        ],
-        settings: settingIndex(
-          "Sign-in sessions",
-          "Access token expiry",
-          "Refresh token expiry",
-          "Network",
-          "Trusted proxies",
-          "Rate limiting",
-          "Enable rate limiting",
-          "Where counters are kept",
-          "Whole-server requests per second",
-          "Per client address",
-          "Burst allowance",
-          "Standard API keys",
-          "Elevated API keys",
-        ),
-        icon: Users,
-      },
-      {
-        id: "sign-in",
-        label: "Sign-in",
-        description:
-          "Single sign-on with OpenID Connect or LDAP, Prairie passwords, and account matching.",
-        groups: ["Single sign-on", "Prairie passwords", "Accounts and sessions"],
-        keywords: [
-          "sso",
-          "single sign-on",
-          "oidc",
-          "openid connect",
-          "ldap",
-          "active directory",
-          "authentik",
-          "authelia",
-          "keycloak",
-          "pocket id",
-          "redirect uri",
-          "callback url",
-          "break-glass",
-          "local password",
-          "auto-create accounts",
-          "email match",
-          "provider logout",
-          "rp-initiated logout",
-          "re-check",
-          "bind dn",
-          "base dn",
-          "issuer",
-          "client id",
-        ],
-        settings: settingIndex(
-          "Single sign-on",
-          "Redirect URI",
-          "Post-logout redirect URI",
-          "Issuer URL",
-          "Client ID",
-          "Client secret",
-          "Bind DN",
-          "User search base DN",
-          "Allowed groups",
-          "Admin groups",
-          "Create accounts on first sign-in",
-          "Test the connection",
-          "Login button",
-          "Prairie passwords",
-          "Allow password sign-in",
-          "Accounts and sessions",
-          "Match existing accounts by email",
-          "Re-check access every",
-          "If the provider is unreachable",
-        ),
-        icon: KeyRound,
-      },
-      {
-        id: "library",
-        label: "Library & Metadata",
-        description: "Artwork storage, scanning, skip markers, and catalog search.",
-        groups: ["Artwork", "Scanning", "Skip markers", "Search"],
-        keywords: [
-          "scanner workers",
-          "image encoding workers",
-          "image workers",
-          "cpu",
-          "matcher",
-          "batch size",
-          "artwork",
-          "posters",
-          "image caching",
-          "cache images",
-          "object storage",
-          "intro",
-          "credits",
-          "recap",
-          "markers",
-          "marker detection",
-          "credits detection",
-          "skip credits",
-          "TheIntroDB",
-          "online marker storage",
-          "on-demand only",
-          "store markers locally",
-          "populate markers",
-          "contribute markers",
-          "scheduled online sync",
-          "meilisearch",
-          "postgres search",
-          "semantic",
-          "metadata",
-        ],
-        settings: settingIndex(
-          "Artwork",
-          "Keep provider artwork",
-          "Scanning",
-          "Scanner workers",
-          "Matcher workers",
-          "Matcher batch size",
-          "Skip markers",
-          "Marker source",
-          "Online preferred + server detection",
-          "Detect intros",
-          "Detect credits",
-          "Find markers on playback",
-          "Detection workers",
-          "Save online markers",
-          "Save to library",
-          "Fetch when needed",
-          "Sync online markers",
-          "Detect markers on this server",
-          "Share intro markers",
-          "Search",
-          "Search engine",
-          "Meilisearch URL",
-          "Meilisearch API key",
-          "Index name prefix",
-          "Query timeout (ms)",
-          "When a search has several words",
-          "Items sent to the index per batch",
-          "Match by meaning as well as words",
-          "Meaning-based share of results",
-          "Search status",
-        ),
-        icon: Library,
-      },
-      {
-        id: "playback",
-        label: "Playback",
-        description: "Transcoding, hardware acceleration, and watch thresholds.",
-        groups: ["Transcoding", "Watch behavior"],
-        keywords: [
-          "ffmpeg",
-          "transcode",
-          "hardware acceleration",
-          "gpu",
-          "chapter thumbnails",
-          "watched threshold",
-          "resume",
-          "4k",
-        ],
-        settings: settingIndex(
-          "Video transcoding",
-          "Hardware acceleration",
-          "Allow 4K transcoding",
-          "FFmpeg path",
-          "Transcode directory",
-          "GPU devices",
-          "Local transcode fallback",
-          "Throttle transcoding",
-          "Buffer ahead (seconds)",
-          "Chapter thumbnail workers",
-          "Generate chapter thumbnails on",
-          "HDR handling",
-          "Convert HDR colors on the CPU when the GPU cannot",
-          "Watch behavior",
-          "Mark watched at (%)",
-          "Show in Continue Watching after (%)",
-        ),
-        icon: PlayCircle,
-      },
-      {
-        id: "downloads",
-        label: "Downloads",
-        description: "Offline downloads, per-user and server-wide limits, and prepared copies.",
-        groups: ["Downloads"],
-        keywords: [
-          "downloads",
-          "offline",
-          "bandwidth",
-          "mbps",
-          "throttle",
-          "quota",
-          "concurrency",
-          "prepared copies",
-          "artifacts",
-          "storage budget",
-          "cache",
-          "disk ceiling",
-        ],
-        settings: settingIndex(
-          "Downloads",
-          "Allow downloads",
-          "Per-user bandwidth",
-          "Per user",
-          "Downloads at once per user",
-          "Downloads per period",
-          "Period length",
-          "Whole server",
-          "Server bandwidth",
-          "Prepare device-friendly copies",
-          "Prepared file directory",
-          "Files prepared at once",
-          "Default storage budget per location",
-          "Keep cached files for",
-          "Disk ceiling (%)",
-        ),
-        icon: Download,
-      },
-      {
-        id: "requests",
-        label: "Requests",
-        description:
-          "Request limits and approval, the Sonarr and Radarr servers, and routing rules.",
-        groups: ["General", "Servers", "Movie routing", "Series routing"],
-        keywords: [
-          "requests",
-          "media requests",
-          "sonarr",
-          "radarr",
-          "arr",
-          "request servers",
-          "routing",
-          "routes",
-          "rules",
-          "anime",
-          "quota",
-          "request limit",
-          "approval",
-          "auto approve",
-          "4k",
-          "root folder",
-          "quality profile",
-          "overseerr",
-          "jellyseerr",
-        ],
-        settings: settingIndex(
-          "General",
-          "Allow requests",
-          "Approval",
-          "Request limit",
-          "Limit window",
-          "Also request a 4K version of every title",
-          "Servers",
-          "Add server",
-          "API key",
-          "Default destination",
-          "HD server",
-          "4K server",
-          "Rules",
-          "Add rule",
-          "Test a title",
-        ),
-        icon: Send,
-      },
-      {
-        id: "providers",
-        label: "Subtitles & Metadata",
-        description: "Subtitle provider accounts, the MDBList metadata key, and marker providers.",
-        groups: ["Subtitle providers", "Metadata providers", "Marker providers"],
-        keywords: [
-          "opensubtitles",
-          "subdl",
-          "subsource",
-          "mdblist",
-          "subtitles",
-          "captions",
-          "api key",
-          "provider credentials",
-          "integrations",
-          "theintrodb",
-          "introdb",
-          "marker providers",
-          "contributions",
-          "markers",
-          "intro",
-          "credits",
-        ],
-        settings: settingIndex(
-          "Subtitle providers",
-          "OpenSubtitles",
-          "SubDL",
-          "SubSource",
-          "Username",
-          "Password",
-          "API key",
-          "Metadata providers",
-          "MDBList",
-          "Marker providers",
-          "TheIntroDB",
-          "Get markers from this provider",
-          "Provider priority",
-          "Allow sharing with this provider",
-          "Automatically share detected intros",
-          "Minimum confidence for automatic sharing",
-        ),
-        icon: Captions,
-      },
-      {
-        id: "watch-sync",
-        label: "Watch Providers",
-        description:
-          "Watch-provider plugins such as Trakt, Simkl, and MDBList that profiles connect their own accounts to.",
-        groups: ["Watch providers"],
-        keywords: [
-          "trakt",
-          "simkl",
-          "mdblist",
-          "scrobble",
-          "watch providers",
-          "sync",
-          "integrations",
-          "plugin",
-        ],
-        settings: settingIndex("Watch providers"),
-        icon: RefreshCw,
-      },
-      {
-        id: "ai",
-        label: "AI Services",
-        description: "Text and speech-to-text models, and the features that spend them.",
-        groups: ["Models", "Features", "Usage and tuning"],
-        keywords: [
-          "openai",
-          "ollama",
-          "groq",
-          "whisper",
-          "llm",
-          "model",
-          "translation",
-          "transcription",
-          "subtitle translation",
-          "integrations",
-        ],
-        settings: settingIndex(
-          "Models",
-          "Text model",
-          "Speech-to-text",
-          "Base URL",
-          "Model",
-          "API key",
-          "Features",
-          "Translate subtitles",
-          "Create subtitles from audio",
-          "Translate descriptions",
-          "Description translation for viewers",
-          "Jobs running at once",
-          "Subtitle lines per request",
-          "Surrounding lines sent for context",
-          "Audio sent per request (seconds)",
-          "Transcriptions per account",
-          "Allowance resets",
-        ),
-        icon: Sparkles,
-      },
-      {
-        id: "notifications",
-        label: "Notifications",
-        description: "Release events, delivery channels, the mail server, and webhooks.",
-        groups: ["Release events", "Delivery channels", "Tuning", "Retention"],
-        keywords: [
-          "release events",
-          "new episode",
-          "email",
-          "smtp",
-          "mail",
-          "silo push relay",
-          "mobile push",
-          "apns",
-          "fcm",
-          "discord",
-          "web push",
-          "webhooks",
-          "server channels",
-          "digest",
-        ],
-        settings: settingIndex(
-          "Notice new content",
-          "Enable release events",
-          "Work out who wants it",
-          "Enable fanout",
-          "Delivery Channels",
-          "In-App",
-          "Web Push",
-          "Prairie Push Relay",
-          "Relay URL",
-          "Deployment ID",
-          "Apple Push (APNs)",
-          "Android Push (FCM)",
-          "Email",
-          "Send email from this server",
-          "From address",
-          "From name",
-          "Mail server address",
-          "Port",
-          "Encryption",
-          "Username",
-          "Password",
-          "Test email recipient",
-          "Let people pick an email per episode",
-          "Send the daily summary at",
-          "Link back to this server at",
-          "Discord",
-          "Client ID",
-          "Client secret",
-          "Bot token",
-          "Let people pick a DM per episode",
-          "Show artwork in Discord messages",
-          "Mention the requester on Discord",
-          "Personal Webhooks",
-          "Webhooks each person may create",
-          "Webhook calls per minute, per person",
-          "Allow webhooks to private addresses",
-          "Server Channels",
-          "Collect new items for (seconds)",
-          "Grouping and flood control",
-          "Wait before sending (seconds)",
-          "Most messages per show at once",
-          "Give up on content older than (hours)",
-          "How long notifications are kept",
-        ),
-        icon: Bell,
-      },
-      {
-        id: "compatibility",
-        label: "Compatibility",
-        description:
-          "Jellyfin and Audiobookshelf client compatibility and the Jellyfin web player.",
-        groups: ["Jellyfin", "Audiobookshelf"],
-        keywords: [
-          "jellyfin",
-          "audiobookshelf",
-          "abs",
-          "proxy",
-          "public url",
-          "server id",
-          "session ttl",
-          "web player",
-        ],
-        settings: settingIndex(
-          "Jellyfin",
-          "Allow Jellyfin apps to connect",
-          "Address Jellyfin apps should use",
-          "Jellyfin Web install progress",
-          "Web player version to install",
-          "Web player install folder",
-          "Name shown to Jellyfin apps",
-          "Server ID",
-          "Jellyfin version to report",
-          "Stay signed in for",
-          "Forget idle playback after",
-          "Audiobookshelf",
-          "Allow Audiobookshelf apps to connect",
-        ),
-        icon: Plug,
-      },
-      {
-        id: "network-access",
-        label: "Network Access",
-        description:
-          "Overlay-network providers such as Tailscale that reach this server without port forwarding.",
-        groups: ["Providers"],
-        keywords: [
-          "tailscale",
-          "netbird",
-          "overlay",
-          "tailnet",
-          "vpn",
-          "remote access",
-          "port forwarding",
-          "network access provider",
-          "plugin",
-        ],
-        settings: settingIndex("Providers", "Connect", "Disconnect", "Authorization"),
-        icon: Network,
-      },
+    id: "providers",
+    label: "Providers",
+    description:
+      "Watch-provider plugins such as Simkl, subtitle provider accounts, the MDBList lists key, and skip-marker providers.",
+    keywords: [
+      "simkl",
+      "scrobble",
+      "watch providers",
+      "sync",
+      "plugin",
+      "opensubtitles",
+      "subdl",
+      "subsource",
+      "mdblist",
+      "lists",
+      "subtitles",
+      "captions",
+      "api key",
+      "provider credentials",
+      "integrations",
+      "theintrodb",
+      "introdb",
+      "marker providers",
+      "contributions",
+      "markers",
+      "intro",
+      "credits",
+      "metadata",
     ],
+    settings: settingIndex(
+      "Watch providers",
+      "Subtitle providers",
+      "OpenSubtitles",
+      "SubDL",
+      "SubSource",
+      "Username",
+      "Password",
+      "API key",
+      "Lists",
+      "MDBList",
+      "Marker providers",
+      "TheIntroDB",
+      "Get markers from this provider",
+      "Provider priority",
+      "Allow sharing with this provider",
+      "Automatically share detected intros and credits",
+      "Minimum confidence for automatic sharing",
+    ),
+    icon: Blocks,
+  },
+  {
+    id: "ai",
+    label: "AI Services",
+    description: "Text and speech-to-text models, and the features that spend them.",
+    keywords: [
+      "openai",
+      "ollama",
+      "groq",
+      "whisper",
+      "chatgpt",
+      "llm",
+      "model",
+      "translation",
+      "transcription",
+      "subtitle translation",
+      "integrations",
+    ],
+    settings: settingIndex(
+      "Models",
+      "Text model",
+      "Authentication",
+      "Reasoning level",
+      "Speech-to-text",
+      "Base URL",
+      "Model",
+      "API key",
+      "Features",
+      "Translate subtitles",
+      "Create subtitles from audio",
+      "Translate descriptions",
+      "Description translation for viewers",
+      "Server-wide tuning",
+      "Jobs running at once",
+      "Subtitle lines per request",
+      "Surrounding lines sent for context",
+      "Audio per request",
+      "Per-account limits",
+      "Transcriptions per account",
+      "Allowance resets",
+    ),
+    icon: Sparkles,
+  },
+  {
+    id: "email",
+    label: "Email",
+    description:
+      "The mail server Prairie sends invitations, password resets, and notification emails through.",
+    keywords: [
+      "email",
+      "smtp",
+      "mail",
+      "mail server",
+      "invitations",
+      "password reset",
+      "test email",
+    ],
+    settings: settingIndex(
+      "Mail server",
+      "Send email from this server",
+      "From address",
+      "From name",
+      "Mail server address",
+      "Port",
+      "Encryption",
+      "Username",
+      "Password",
+      "Test email recipient",
+      "Send test",
+    ),
+    icon: Mail,
+  },
+  {
+    id: "notifications",
+    label: "Notifications",
+    description: "Delivery channels, server channels, and how new content becomes notifications.",
+    keywords: [
+      "release events",
+      "new episode",
+      "prairie push relay",
+      "mobile push",
+      "apns",
+      "fcm",
+      "discord",
+      "web push",
+      "webhooks",
+      "server channels",
+      "digest",
+      "retention",
+      "email",
+    ],
+    settings: settingIndex(
+      "Delivery Channels",
+      "In-App",
+      "Web Push",
+      "Prairie Push Relay",
+      "Apple Push (APNs)",
+      "Android Push (FCM)",
+      "Relay URL",
+      "Deployment ID",
+      "Email",
+      "Let people pick an email per episode",
+      "Daily summary hour",
+      "Discord",
+      "Setup guide",
+      "Client ID",
+      "Client secret",
+      "Bot token",
+      "Let people pick a DM per episode",
+      "Artwork",
+      "Personal Webhooks",
+      "Webhooks per person",
+      "Deliveries per person",
+      "Allow webhooks to private addresses",
+      "Server Channels",
+      "Add server channel",
+      "Batch window",
+      "Mention the requester on Discord",
+      "Processing",
+      "Notice new content",
+      "Work out who wants it",
+      "Grouping and flood control",
+      "Settle window",
+      "Max messages per show",
+      "Max content age",
+      "Retention",
+      "Read notifications",
+      "Unread notifications",
+      "Sent history",
+    ),
+    icon: Bell,
+  },
+  {
+    id: "compatibility",
+    label: "Compatibility",
+    description: "Jellyfin and Audiobookshelf client compatibility and the Jellyfin web player.",
+    keywords: [
+      "jellyfin",
+      "audiobookshelf",
+      "abs",
+      "proxy",
+      "public url",
+      "server id",
+      "session ttl",
+      "web player",
+    ],
+    settings: settingIndex(
+      "Jellyfin",
+      "Allow Jellyfin apps to connect",
+      "Address Jellyfin apps should use",
+      "Jellyfin web player",
+      "Download details",
+      "Web player version to install",
+      "Web player install folder",
+      "Name shown to Jellyfin apps",
+      "Server ID",
+      "Jellyfin version to report",
+      "Stay signed in for",
+      "Forget idle playback after",
+      "Audiobookshelf",
+      "Allow Audiobookshelf apps to connect",
+    ),
+    icon: Plug,
   },
 ];
 
-export const ADMIN_SETTINGS_NAV = ADMIN_SETTINGS_GROUPS.flatMap((group) => group.items);
-
 const ADMIN_SETTINGS_PAGE_IDS = new Set(ADMIN_SETTINGS_NAV.map((item) => item.id));
 
 /**
  * Deep links from earlier layouts. Bookmarks, docs, and older client builds
  * still point at these ids, so every one of them resolves to the page that
- * absorbed it rather than falling through to the settings overview.
+ * absorbed it rather than falling through to the settings index.
  */
 export const LEGACY_ADMIN_SETTINGS_PAGE_ALIASES: Readonly<Record<string, string>> = {
   branding: "appearance",
@@ -713,19 +796,23 @@ export const LEGACY_ADMIN_SETTINGS_PAGE_ALIASES: Readonly<Record<string, string>
   overlays: "appearance",
   "rate-limiting": "security",
   scanner: "library",
-  search: "library",
-  intro: "library",
+  intro: "playback",
   subtitles: "providers",
   integrations: "providers",
-  "watch-providers": "watch-sync",
-  email: "notifications",
+  "watch-providers": "providers",
+  "watch-sync": "providers",
   jellyfin: "compatibility",
   "compatibility-proxies": "compatibility",
-  database: "infrastructure",
-  storage: "infrastructure",
-  "log-retention": "infrastructure",
+  database: "general",
+  infrastructure: "storage",
+  "log-retention": "logging",
 };
 
+/** Deep link to one admin settings page. */
+export function adminSettingsHref(page: string): string {
+  return `/admin/settings/${encodeURIComponent(page)}`;
+}
+
 /** Resolves a route segment or legacy `?tab=` value to a current page id. */
 export function resolveAdminSettingsPageID(value: string | null): string | null {
   if (!value) return null;
diff --git a/web/src/lib/collectionTemplates.ts b/web/src/lib/collectionTemplates.ts
index 8bef6445aa..227e543527 100644
--- a/web/src/lib/collectionTemplates.ts
+++ b/web/src/lib/collectionTemplates.ts
@@ -2,11 +2,7 @@ import { useQuery } from "@tanstack/react-query";
 
 import { v2 } from "@/api/v2/request";
 import type { components } from "@/api/v2/schema";
-import type {
-  ImportMDBListCollectionRequest,
-  ImportTMDBCollectionRequest,
-  ImportTraktCollectionRequest,
-} from "@/api/types";
+import type { ImportMDBListCollectionRequest, ImportTMDBCollectionRequest } from "@/api/types";
 import { adminKeys } from "@/hooks/queries/keys";
 
 export type CollectionTemplateCategory =
@@ -22,7 +18,6 @@ export type CollectionTemplateCategory =
 
 export type CollectionTemplateSource =
   | "tmdb"
-  | "trakt"
   | "mdblist"
   | "tmdb_discover"
   | "tmdb_collection"
@@ -37,8 +32,6 @@ export type CollectionTemplateTMDB = Pick<
   "preset" | "media_type" | "time_window"
 >;
 
-export type CollectionTemplateTrakt = Pick<ImportTraktCollectionRequest, "preset" | "media_type">;
-
 export type CollectionTemplateMDBList = Pick<ImportMDBListCollectionRequest, "url">;
 
 // An empty url is a "bring your own list" template that asks for the list URL.
@@ -86,7 +79,6 @@ export interface CollectionTemplate {
   featured?: boolean;
   tags?: string[];
   tmdb?: CollectionTemplateTMDB;
-  trakt?: CollectionTemplateTrakt;
   mdblist?: CollectionTemplateMDBList;
   tmdb_collection?: CollectionTemplateTMDBCollection;
   tmdb_discover?: CollectionTemplateTMDBDiscover;
@@ -171,11 +163,6 @@ export interface ApplyCollectionTemplateBundleResponse {
 
 export const TEMPLATE_STALE_TIME = 5 * 60_000;
 
-// Largest explicit "Max Items" value the import APIs accept. Mirrors
-// MaxExplicitItemLimit in internal/collectionutil — sync never scans more
-// than 500 source entries, so larger limits could never be satisfied.
-export const COLLECTION_MAX_ITEMS = 500;
-
 export function fetchCollectionTemplates(): Promise<CollectionTemplateCatalog> {
   return v2("GET /api/v2/admin/collections/templates").then(
     (value) => value as CollectionTemplateCatalog,
diff --git a/web/src/lib/collections/adminList.test.ts b/web/src/lib/collections/adminList.test.ts
index d629eed1f5..c746f6fe5d 100644
--- a/web/src/lib/collections/adminList.test.ts
+++ b/web/src/lib/collections/adminList.test.ts
@@ -46,7 +46,7 @@ describe("readAdminListState", () => {
 
   it("ignores values it doesn't know", () => {
     expect(
-      readAdminListState(new URLSearchParams("view=grid&libraryId=-2&type=trakt&failed=yes")),
+      readAdminListState(new URLSearchParams("view=grid&libraryId=-2&type=plex&failed=yes")),
     ).toEqual(STATE);
   });
 });
diff --git a/web/src/lib/collections/copy.ts b/web/src/lib/collections/copy.ts
index 71f2bf7b7d..376712530d 100644
--- a/web/src/lib/collections/copy.ts
+++ b/web/src/lib/collections/copy.ts
@@ -453,7 +453,8 @@ export const NAME_FILLED_HELP =
   "Filled in from the list. Picking another list keeps anything you typed.";
 export const SYNCS_ON_CREATE = "It syncs for the first time when you create it.";
 export const PICK_A_LIST_FIRST = "Pick a list, then create it.";
-export const SYNCED_ORDER_HELP = "Blank takes the whole list, up to 500.";
+export const SYNCED_ORDER_HELP =
+  "Blank takes the whole list: up to 10,000 titles from MDBList, or the first 20 of a TMDB chart.";
 
 /** "Kept your name", "Kept your name and description": what a new pick left alone. */
 export function keptMessage(fields: readonly ("name" | "description")[]): string | null {
@@ -532,11 +533,6 @@ export const FRANCHISE_ID_INVALID = "Use the number from the collection's link,
 export const DISCOVER_LOCKED = "Made by a starter pack. Its rules can't be changed here.";
 export const DISCOVER_STILL_EDITABLE =
   "You can still change its name, artwork, max titles, schedule and where it shows.";
-export const TRAKT_LOCKED =
-  "New Trakt lists aren't supported. This one keeps its source and libraries.";
-export const TRAKT_STILL_EDITABLE =
-  "You can still change its name, artwork, order, schedule and where it shows.";
-export const TRAKT_SCHEDULE_STOPPED = "A stopped Trakt list can't be scheduled again.";
 export const PERSONAL_SCHEDULE_LOCKED =
   "This server doesn't let profiles change a list's schedule.";
 export const LIST_DECIDES = "The list decides";
diff --git a/web/src/lib/collections/scope.ts b/web/src/lib/collections/scope.ts
index f1cfc7c115..c439eb827c 100644
--- a/web/src/lib/collections/scope.ts
+++ b/web/src/lib/collections/scope.ts
@@ -532,8 +532,7 @@ function storedWithLimit(list: ListDraft): Partial<StoredSource> {
 /**
  * What a saved list's PATCH sends for its source. MDBList, chart, TMDB list
  * and franchise sources are rebuilt whole; a Discover list, and a franchise
- * list with no ID yet, send their stored config only when Max titles changed;
- * a Trakt list never sends its source, which the server keeps as it is.
+ * list with no ID yet, send their stored config only when Max titles changed.
  */
 function editedSource(list: ListDraft, linkChanged: boolean): Partial<StoredSource> {
   switch (list.source) {
@@ -555,18 +554,15 @@ function editedSource(list: ListDraft, linkChanged: boolean): Partial<StoredSour
     }
     case "tmdb_discover":
       return storedWithLimit(list);
-    case "trakt":
-      return {};
   }
 }
 
-const COLLECTION_TYPE_OF: Readonly<Record<SyncedSource, "mdblist" | "tmdb" | "trakt">> = {
+const COLLECTION_TYPE_OF: Readonly<Record<SyncedSource, "mdblist" | "tmdb">> = {
   mdblist: "mdblist",
   tmdb_chart: "tmdb",
   tmdb_list: "tmdb",
   tmdb_franchise: "tmdb",
   tmdb_discover: "tmdb",
-  trakt: "trakt",
 };
 
 /** A saved server list's PATCH: every field, its source rebuilt, never `featured`. */
@@ -591,8 +587,7 @@ function serverListRequest(
 /**
  * A saved personal list's PATCH. Name, sharing, libraries, the Collections
  * tab switch and Show only always go; everything else only when it changed
- * from `base`. A legacy Trakt list never sends libraries: the server refuses
- * any it's sent. A "custom" schedule is never sent: it stays until another is picked.
+ * from `base`. A "custom" schedule is never sent: it stays until another is picked.
  */
 function personalListRequest(draft: ListEditDraft, base: CollectionDraft): UpdateCollectionRequest {
   const changed = new Set(changedFields(base, draft));
@@ -602,8 +597,8 @@ function personalListRequest(draft: ListEditDraft, base: CollectionDraft): Updat
     is_shared: draft.personal?.shared ?? false,
     include_in_server_collections: draft.personal?.inLibraryTabs ?? false,
     display_query_definition: draft.showOnly,
+    library_ids: draft.libraryIds,
   };
-  if (list.source !== "trakt") body.library_ids = draft.libraryIds;
   if (changed.has("description")) body.description = draft.description;
   if (changed.has("rawSortConfig")) body.sort_config = draft.rawSortConfig ?? {};
   if (changed.has("list") && list.source === "mdblist") {
diff --git a/web/src/lib/collections/synced.test.ts b/web/src/lib/collections/synced.test.ts
index 69f6bbf604..ffe03f49d1 100644
--- a/web/src/lib/collections/synced.test.ts
+++ b/web/src/lib/collections/synced.test.ts
@@ -93,7 +93,7 @@ describe("ready-made picks", () => {
           TRENDING_WEEK,
           template({ id: "discover", source: "tmdb_discover" }),
           template({ id: "franchise", source: "tmdb_collection" }),
-          template({ id: "trakt", source: "trakt", requires_profile: true }),
+          template({ ...TRENDING_WEEK, id: "for-you", requires_profile: true }),
           template({ id: "byo", source: "mdblist", mdblist: { url: "" } }),
         ],
       },
diff --git a/web/src/lib/collections/synced.ts b/web/src/lib/collections/synced.ts
index 8fd032108d..6ded6d28ea 100644
--- a/web/src/lib/collections/synced.ts
+++ b/web/src/lib/collections/synced.ts
@@ -59,7 +59,7 @@ export interface SyncedDraft {
   /** The MDBList and TMDB list links, as typed. */
   mdblistLink: string;
   tmdbListLink: string;
-  /** Blank takes the whole list (up to 500). */
+  /** Blank takes the whole list. */
   limit?: number;
   /** Server: a cron expression. Personal: a schedule name. "" = no scheduled sync. */
   schedule: string;
@@ -348,7 +348,6 @@ export function savedListMediaKind(list: ListDraft): ListMediaKind {
     case "tmdb_franchise":
       return "movie";
     case "tmdb_discover":
-    case "trakt":
       return media === "movie" || media === "tv" ? media : "mixed";
     default:
       return "mixed";
diff --git a/web/src/lib/collections/types.test.ts b/web/src/lib/collections/types.test.ts
index 2659c39f51..1d4680e0de 100644
--- a/web/src/lib/collections/types.test.ts
+++ b/web/src/lib/collections/types.test.ts
@@ -13,7 +13,6 @@ const stored: Array<[string, Record<string, unknown> | undefined, string]> = [
   ["manual", undefined, "Manual"],
   ["smart", undefined, "Smart"],
   ["mdblist", { mode: "mdblist_json" }, "Synced list · MDBList"],
-  ["trakt", { mode: "trakt_preset" }, "Synced list · Trakt (legacy)"],
   ["tmdb", undefined, "Synced list · TMDB chart"],
   ["tmdb", { mode: "" }, "Synced list · TMDB chart"],
   ["tmdb", { mode: "tmdb_preset" }, "Synced list · TMDB chart"],
diff --git a/web/src/lib/collections/types.ts b/web/src/lib/collections/types.ts
index 5af2b429dd..42d6cbf9e1 100644
--- a/web/src/lib/collections/types.ts
+++ b/web/src/lib/collections/types.ts
@@ -1,13 +1,13 @@
 import type { LibraryCollection } from "@/api/types";
 
-// List-backed collections follow an MDBList, TMDB or legacy Trakt list, and
+// List-backed collections follow an MDBList or TMDB list, and
 // only they can be synced: a manual collection has no list, and a smart one
 // is filled from its rules whenever it is read. Mirrors catalog.IsSyncableType
 // in internal/catalog/collection_type.go.
 export function isListBackedCollectionType(
   collectionType: LibraryCollection["collection_type"],
 ): boolean {
-  return collectionType === "mdblist" || collectionType === "tmdb" || collectionType === "trakt";
+  return collectionType === "mdblist" || collectionType === "tmdb";
 }
 
 /** What a person picks when they make a collection; every stored list type is "synced". */
@@ -19,8 +19,7 @@ export type SyncedSource =
   | "tmdb_chart"
   | "tmdb_list"
   | "tmdb_franchise"
-  | "tmdb_discover"
-  | "trakt";
+  | "tmdb_discover";
 
 export const COLLECTION_KIND_LABEL: Readonly<Record<CollectionKind, string>> = {
   manual: "Manual",
@@ -34,7 +33,6 @@ export const SYNCED_SOURCE_LABEL: Readonly<Record<SyncedSource, string>> = {
   tmdb_list: "TMDB list",
   tmdb_franchise: "TMDB franchise",
   tmdb_discover: "TMDB Discover",
-  trakt: "Trakt (legacy)",
 };
 
 export function collectionKindOf(collectionType: string): CollectionKind {
@@ -54,8 +52,6 @@ export function syncedSourceOf(
   switch (collectionType) {
     case "mdblist":
       return "mdblist";
-    case "trakt":
-      return "trakt";
     case "tmdb":
       switch (sourceConfig?.mode) {
         case "tmdb_list":
diff --git a/web/src/lib/cssSanitizer.ts b/web/src/lib/cssSanitizer.ts
deleted file mode 100644
index 427fcb6dd6..0000000000
--- a/web/src/lib/cssSanitizer.ts
+++ /dev/null
@@ -1,98 +0,0 @@
-/**
- * CSS sanitizer that strips external resource loading from raw CSS.
- *
- * Blocks: @import, external url(), external @font-face src
- * Allows: url(data:...), url(/...), url(#...), all other CSS
- *
- * Comments are stripped and CSS escapes normalized before matching so
- * comment-obfuscated @import and escaped external url() forms cannot bypass checks.
- */
-
-/** Matches @import rules (with url() or bare string) */
-const AT_IMPORT_RE = /@import\s+(?:url\(.*?\)|['"].*?['"])[^;]*;?/gi;
-
-function stripCssComments(css: string): string {
-  let out = "";
-  for (let i = 0; i < css.length; ) {
-    if (css[i] === "/" && css[i + 1] === "*") {
-      const end = css.indexOf("*/", i + 2);
-      if (end < 0) break;
-      i = end + 2;
-      continue;
-    }
-    out += css[i];
-    i += 1;
-  }
-  return out;
-}
-
-function unescapeCss(value: string): string {
-  let out = "";
-  for (let i = 0; i < value.length; ) {
-    if (value[i] !== "\\" || i + 1 >= value.length) {
-      out += value[i];
-      i += 1;
-      continue;
-    }
-    let j = i + 1;
-    let hexDigits = 0;
-    while (j < value.length && hexDigits < 6 && /[0-9a-fA-F]/.test(value[j]!)) {
-      j += 1;
-      hexDigits += 1;
-    }
-    if (hexDigits > 0) {
-      const code = Number.parseInt(value.slice(i + 1, j), 16);
-      if (Number.isFinite(code)) {
-        // CSS allows escapes beyond Unicode; fromCodePoint throws above U+10FFFF.
-        out += code >= 0 && code <= 0x10ffff ? String.fromCodePoint(code) : "\uFFFD";
-      }
-      if (j < value.length && /[ \t\n\r\f]/.test(value[j]!)) j += 1;
-      i = j;
-      continue;
-    }
-    out += value[i + 1];
-    i += 2;
-  }
-  return out;
-}
-
-/** Check if a single url() value is safe (data:, local path, or fragment) */
-function isSafeUrl(urlContent: string): boolean {
-  const trimmed = unescapeCss(urlContent)
-    .trim()
-    .replace(/^['"]|['"]$/g, "");
-  if (!trimmed) return true;
-  if (trimmed.startsWith("data:")) return true;
-  if (trimmed.startsWith("/") && !trimmed.startsWith("//")) return true;
-  if (trimmed.startsWith("#")) return true;
-  // Relative paths (no scheme) are fine — they resolve to the same origin
-  if (!/^[a-z][a-z0-9+.-]*:/i.test(trimmed) && !trimmed.startsWith("//")) return true;
-  return false;
-}
-
-/**
- * Sanitize raw CSS by stripping external resource references.
- * Returns the cleaned CSS string.
- */
-export function sanitizeCss(css: string): string {
-  let result = stripCssComments(css);
-
-  // Strip @import rules entirely
-  result = result.replace(AT_IMPORT_RE, "/* [blocked @import] */");
-
-  // Replace external url() with empty url()
-  result = result.replace(
-    /url\(\s*(['"]?)([\s\S]*?)\1\s*\)/gi,
-    (_match, _quote, content: string) => {
-      if (isSafeUrl(content)) return _match;
-      return "/* [blocked external url] */";
-    },
-  );
-
-  return result;
-}
-
-/** Quick check if CSS contains patterns that would be sanitized. */
-export function hasUnsafeCss(css: string): boolean {
-  return css !== sanitizeCss(css);
-}
diff --git a/web/src/lib/deviceSettingGroups.test.ts b/web/src/lib/deviceSettingGroups.test.ts
index 3fddff3ee0..e1944dde99 100644
--- a/web/src/lib/deviceSettingGroups.test.ts
+++ b/web/src/lib/deviceSettingGroups.test.ts
@@ -60,7 +60,6 @@ describe("deviceSettingGroups", () => {
   // changes nothing.
   const NATIVE_ONLY_PLAYER_KEYS = [
     "player.playback_speed",
-    "player.subtitle_sync_ms",
     "player.hdr_enabled",
     "player.audio_sync_ms",
   ] as const;
diff --git a/web/src/lib/deviceSettingGroups.ts b/web/src/lib/deviceSettingGroups.ts
index 009b605059..b78f513ef5 100644
--- a/web/src/lib/deviceSettingGroups.ts
+++ b/web/src/lib/deviceSettingGroups.ts
@@ -51,6 +51,8 @@ const EXPLICIT_GROUPS: Partial<Record<string, DeviceSettingGroupId>> = {
   "playback.subtitle_appearance": "subtitles",
   "playback.preferred_quality": "picture",
   "playback.max_bitrate_kbps": "picture",
+  "playback.cellular_preferred_quality": "picture",
+  "playback.cellular_max_bitrate_kbps": "picture",
   "playback.auto_skip_intro": "episodes",
   "playback.intro_skip_mode": "episodes",
   "playback.auto_skip_credits": "episodes",
diff --git a/web/src/lib/documentTitle.ts b/web/src/lib/documentTitle.ts
index 8d52b3958e..533ef0fc5e 100644
--- a/web/src/lib/documentTitle.ts
+++ b/web/src/lib/documentTitle.ts
@@ -37,12 +37,15 @@ const SETTINGS_TITLES: Record<string, string> = {
   "history-import": "History Import Settings",
   "plex-webhooks": "Webhook Sync Settings",
   "webhook-sync": "Webhook Sync Settings",
-  "subtitle-appearance": "Subtitle Settings",
+  "subtitle-appearance": "Language & Subtitle Settings",
   "home-screen": "Home Screen Settings",
-  "card-overlays": "Card Overlay Settings",
+  "title-pages": "Title Page Settings",
   "connect-apps": "Connect Apps Settings",
   "quick-connect": "Quick Connect Settings",
-  notifications: "Notifications Settings",
+  devices: "Your Devices",
+  personalize: "Personalize",
+  "watch-providers": "Watch Provider Settings",
+  notifications: "Notification Settings",
 };
 
 const ADMIN_TITLES: Record<string, string> = {
@@ -52,7 +55,6 @@ const ADMIN_TITLES: Record<string, string> = {
   autoscan: "Admin Autoscan",
   collections: "Admin Collections",
   devices: "Admin Devices",
-  "settings/devices": "Your Devices",
   diagnostics: "Admin Client Diagnostics",
   downloads: "Admin Downloads",
   history: "Admin Playback History",
@@ -113,6 +115,10 @@ export function resolveAdminDocumentTitle(pathname: string): string {
     return "Admin User";
   }
 
+  if (adminSegment === "autoscan" && nestedSegment === "activity") {
+    return "Admin Autoscan Activity";
+  }
+
   if (adminSegment === "plugins" && nestedSegment) {
     return "Admin Plugin";
   }
diff --git a/web/src/lib/homeLayoutTransfer.test.ts b/web/src/lib/homeLayoutTransfer.test.ts
index 71f0e29796..d578531dd5 100644
--- a/web/src/lib/homeLayoutTransfer.test.ts
+++ b/web/src/lib/homeLayoutTransfer.test.ts
@@ -8,7 +8,6 @@ import { matchRecipePreset } from "@/lib/recipes";
 import {
   buildHomeLayoutFile,
   importPage,
-  legacyTraktSectionIds,
   mergeImportedPage,
   parseHomeLayoutFile,
   planHomeLayoutImport,
@@ -297,7 +296,6 @@ describe("planHomeLayoutImport on the same server", () => {
                 title: "Staff picks",
                 config: { item_ids: ["x"] },
               },
-              { user_section_type: "trending_discover", user_config: { source: "trakt" } },
               { user_section_type: "hidden_gems", removed: true },
             ],
           },
@@ -313,7 +311,6 @@ describe("planHomeLayoutImport on the same server", () => {
     expect(plan.skippedSections).toEqual([
       { page: "Home", title: "collection", reason: "collection" },
       { page: "Home", title: "Staff picks", reason: "custom_disabled" },
-      { page: "Home", title: "trending_discover", reason: "trakt" },
     ]);
   });
 
@@ -708,8 +705,6 @@ describe("planHomeLayoutImport on another server", () => {
 });
 
 describe("mergeImportedPage", () => {
-  const noTrakt = new Set<string>();
-
   it("replaces the whole page on the same server, reusing the saved override IDs the server resolves", () => {
     const page = {
       scope: "home" as const,
@@ -728,71 +723,13 @@ describe("mergeImportedPage", () => {
       stored({ id: "old-custom", user_section_type: "hidden_gems", is_user_added: true }),
     ];
 
-    expect(mergeImportedPage(page, existing, true, noTrakt, sequentialIds())).toEqual([
+    expect(mergeImportedPage(page, existing, true, sequentialIds())).toEqual([
       { id: "saved-1", section_id: "admin-1", position: 0, hidden: true },
       { id: "new-1", section_id: "admin-2", position: 1 },
       { id: "new-custom", user_section_type: "hidden_gems", position: 2 },
     ]);
   });
 
-  it("leaves legacy Trakt admin sections as the profile saved them", () => {
-    const trakt = new Set([
-      "trakt-saved",
-      "trakt-unsaved-hidden",
-      "trakt-unsaved-shown",
-      "trakt-omitted",
-    ]);
-    const page = {
-      scope: "home" as const,
-      label: "Home",
-      overrides: [
-        { section_id: "trakt-saved", position: 0 },
-        { section_id: "trakt-unsaved-hidden", hidden: true },
-        { section_id: "trakt-unsaved-shown", position: 3 },
-      ],
-    };
-    const existing = [
-      stored({ id: "saved-a", section_id: "trakt-saved", hidden: true }),
-      stored({ id: "saved-b", section_id: "trakt-omitted", removed: true }),
-    ];
-
-    expect(mergeImportedPage(page, existing, true, trakt, sequentialIds())).toEqual([
-      { id: "saved-a", section_id: "trakt-saved", hidden: true },
-      { id: "new-1", section_id: "trakt-unsaved-hidden", hidden: true },
-      { id: "saved-b", section_id: "trakt-omitted", removed: true },
-    ]);
-  });
-
-  it("keeps saved profile-built Trakt sections on either server", () => {
-    const page = {
-      scope: "home" as const,
-      label: "Home",
-      overrides: [{ id: "new-1", user_section_type: "hidden_gems" }],
-    };
-    const existing = [
-      stored({
-        id: "trakt-row",
-        user_section_type: "trending_discover",
-        user_config: { source: "trakt" },
-      }),
-      stored({ id: "plain-row", user_section_type: "hidden_gems", user_config: {} }),
-    ];
-    const kept = {
-      id: "trakt-row",
-      user_section_type: "trending_discover",
-      user_config: { source: "trakt" },
-    };
-
-    expect(mergeImportedPage(page, existing, true, noTrakt, sequentialIds())).toEqual([
-      { id: "new-1", user_section_type: "hidden_gems" },
-      kept,
-    ]);
-    expect(mergeImportedPage(page, existing, false, noTrakt, sequentialIds())).toEqual([
-      kept,
-      { id: "new-1", user_section_type: "hidden_gems" },
-    ]);
-  });
-
   it("keeps this server's section changes on another server", () => {
     const page = {
       scope: "home" as const,
@@ -804,7 +741,7 @@ describe("mergeImportedPage", () => {
       stored({ id: "old-custom", user_section_type: "hidden_gems", is_user_added: true }),
     ];
 
-    expect(mergeImportedPage(page, existing, false, noTrakt, sequentialIds())).toEqual([
+    expect(mergeImportedPage(page, existing, false, sequentialIds())).toEqual([
       { id: "keep", section_id: "admin-1", position: 3, hidden: true },
       { id: "new-1", user_section_type: "hidden_gems" },
     ]);
@@ -832,24 +769,6 @@ describe("fileReferences", () => {
   });
 });
 
-describe("legacyTraktSectionIds", () => {
-  it("finds Trakt-sourced admin sections in the page view and saved overrides", () => {
-    const settings = [
-      { id: "trending", is_custom: false, config: { source: "trakt", window: "week" } },
-      { id: "list", is_custom: false, config: { source_provider: "trakt" } },
-      { id: "tmdb", is_custom: false, config: { source: "tmdb" } },
-      { id: "custom", is_custom: true, config: { source: "trakt" } },
-    ];
-    const existing = [
-      stored({ id: "o1", section_id: "removed-trakt", config: { source: "trakt" } }),
-    ];
-
-    expect(legacyTraktSectionIds(settings, existing)).toEqual(
-      new Set(["trending", "list", "removed-trakt"]),
-    );
-  });
-});
-
 describe("importPage", () => {
   const page = {
     scope: "home" as const,
@@ -864,62 +783,17 @@ describe("importPage", () => {
       if (result instanceof Error) throw result;
       return result;
     });
-    return {
-      listSaved: vi.fn(async () => [removedUnlisted]),
-      listView: vi.fn(async () => [{ id: "shown", is_custom: false }]),
-      save,
-    };
+    return { listSaved: vi.fn(async () => [removedUnlisted]), save };
   }
 
-  it("saves the merged page once when the server accepts it", async () => {
+  it("saves the merged page once", async () => {
     const api = fakeApi([undefined]);
 
-    await expect(importPage(page, true, api, sequentialIds())).resolves.toEqual({
-      keptSavedChanges: false,
-    });
+    await importPage(page, true, api, sequentialIds());
     expect(api.save).toHaveBeenCalledTimes(1);
     expect(api.save).toHaveBeenCalledWith([{ id: "new-custom", user_section_type: "hidden_gems" }]);
   });
 
-  it("retries a refused same-server save with every saved admin-section change kept", async () => {
-    const api = fakeApi([
-      v2Problem(422, "validation_failed", "The request did not pass validation; see errors."),
-      undefined,
-    ]);
-
-    await expect(importPage(page, true, api, sequentialIds())).resolves.toEqual({
-      keptSavedChanges: true,
-    });
-    expect(api.save).toHaveBeenCalledTimes(2);
-    expect(api.save).toHaveBeenLastCalledWith([
-      { id: "new-custom", user_section_type: "hidden_gems" },
-      { id: "saved-gone", section_id: "gone", removed: true },
-    ]);
-  });
-
-  it("keeps a saved override whose config masks a legacy Trakt source", async () => {
-    const masking = stored({ id: "saved-mask", section_id: "masked", config: { source: "tmdb" } });
-    const api = {
-      listSaved: vi.fn(async () => [masking]),
-      listView: vi.fn(async () => [{ id: "masked", is_custom: false, config: { source: "tmdb" } }]),
-      save: vi
-        .fn()
-        .mockRejectedValueOnce(v2Problem(422, "validation_failed", "invalid"))
-        .mockResolvedValueOnce(undefined),
-    };
-
-    await expect(importPage(page, true, api, sequentialIds())).resolves.toEqual({
-      keptSavedChanges: true,
-    });
-    expect(api.save).toHaveBeenNthCalledWith(1, [
-      { id: "new-custom", user_section_type: "hidden_gems" },
-    ]);
-    expect(api.save).toHaveBeenLastCalledWith([
-      { id: "new-custom", user_section_type: "hidden_gems" },
-      { id: "saved-mask", section_id: "masked", config: { source: "tmdb" } },
-    ]);
-  });
-
   it("refuses a page over the save endpoint's override limit", async () => {
     const big = {
       scope: "home" as const,
@@ -937,18 +811,12 @@ describe("importPage", () => {
     expect(api.save).not.toHaveBeenCalled();
   });
 
-  it("doesn't retry other failures", async () => {
+  it("passes a refused save through without retrying", async () => {
     const refused = v2Problem(422, "validation_failed", "invalid");
-    const unavailable = v2Problem(503, "dependency_unavailable", "down");
-
-    const other = fakeApi([unavailable]);
-    await expect(importPage(page, true, other, sequentialIds())).rejects.toBe(unavailable);
-    expect(other.save).toHaveBeenCalledTimes(1);
+    const api = fakeApi([refused]);
 
-    const otherServer = fakeApi([refused]);
-    await expect(importPage(page, false, otherServer, sequentialIds())).rejects.toBe(refused);
-    expect(otherServer.save).toHaveBeenCalledTimes(1);
-    expect(otherServer.listView).not.toHaveBeenCalled();
+    await expect(importPage(page, true, api, sequentialIds())).rejects.toBe(refused);
+    expect(api.save).toHaveBeenCalledTimes(1);
   });
 });
 
diff --git a/web/src/lib/homeLayoutTransfer.ts b/web/src/lib/homeLayoutTransfer.ts
index 119d8b4cf2..1c5c7f1f0e 100644
--- a/web/src/lib/homeLayoutTransfer.ts
+++ b/web/src/lib/homeLayoutTransfer.ts
@@ -1,6 +1,5 @@
-import { V2ProblemError } from "@/api/v2/request";
 import type { components } from "@/api/v2/schema";
-import { FILTER_SECTION_TYPES, isTraktConfig } from "@/lib/sectionTypes";
+import { FILTER_SECTION_TYPES } from "@/lib/sectionTypes";
 
 // Home layout export and import: a profile's saved section overrides for the
 // home page and each library page, written to a JSON file that another
@@ -241,7 +240,6 @@ export function fileReferences(file: HomeLayoutFile): HomeLayoutReferences {
 export type HomeLayoutSkipReason =
   | "unknown_recipe"
   | "custom_disabled"
-  | "trakt"
   | "library"
   | "collection"
   | "profile";
@@ -249,7 +247,6 @@ export type HomeLayoutSkipReason =
 export const HOME_LAYOUT_SKIP_REASON_LABELS: Record<HomeLayoutSkipReason, string> = {
   unknown_recipe: "This server doesn't offer this section type",
   custom_disabled: "Only an admin can add this kind of row",
-  trakt: "Trakt-backed sections can't be added again",
   library: "Uses a library this profile doesn't have here",
   collection: "Uses a collection this profile can't see here",
   profile: "Follows a profile outside this account",
@@ -388,8 +385,6 @@ function sectionSkipReason(
   if (recipe?.adminOnly && !target.allowAdminOnlyRecipes) return "custom_disabled";
 
   const config = effectiveConfig(override);
-  // The server refuses any new override whose config names Trakt as its source.
-  if (isTraktConfig(config)) return "trakt";
   if (sameServer) return sameServerReferenceProblem(config, target, libraries);
   if (nonEmptyString(config.library_collection_id) || nonEmptyString(config.user_collection_id)) {
     return "collection";
@@ -575,33 +570,17 @@ function keepExisting(override: SectionOverrideRead): SectionOverrideWrite {
  *
  * On the same server the file describes the whole page and replaces what the
  * profile saved. A change to an admin section keeps the ID of the profile's
- * saved override for that section, or gets a new one, as the server's
- * section source policy expects of every override. For a section in
- * `keepSavedSectionIds`, such as a legacy Trakt admin section, which can't
- * be changed or shown again, the profile's saved override stays as it is;
- * without one, only a hide or remove carries over.
- *
- * Either way, a saved profile-built Trakt section stays, since it can't be
- * created again.
+ * saved override for that section, or gets a new one.
  */
 export function mergeImportedPage(
   page: HomeLayoutPlannedPage,
   existing: SectionOverrideRead[],
   sameServer: boolean,
-  keepSavedSectionIds: ReadonlySet<string>,
   newId: () => string,
 ): SectionOverrideWrite[] {
-  // A saved profile-built Trakt section can't be created again, so the
-  // profile keeps it instead of losing it to the replacement.
-  const savedTraktBuilt = existing
-    .filter(
-      (override) => !override.section_id && isTraktConfig(override.user_config ?? override.config),
-    )
-    .map(keepExisting);
   if (!sameServer) {
     return [
       ...existing.filter((override) => override.section_id).map(keepExisting),
-      ...savedTraktBuilt,
       ...page.overrides,
     ];
   }
@@ -622,98 +601,32 @@ export function mergeImportedPage(
     // One override per section; a second would repeat the saved ID.
     if (imported.has(sectionId)) continue;
     imported.add(sectionId);
-    const saved = existingBySection.get(sectionId);
-    if (keepSavedSectionIds.has(sectionId)) {
-      if (saved) merged.push(keepExisting(saved));
-      else if (override.hidden || override.removed) merged.push({ ...override, id: newId() });
-      continue;
-    }
-    merged.push({ ...override, id: saved?.id || newId() });
-  }
-  // Dropping a saved hide of such a section would show it again.
-  for (const [sectionId, saved] of existingBySection) {
-    if (!imported.has(sectionId) && keepSavedSectionIds.has(sectionId)) {
-      merged.push(keepExisting(saved));
-    }
-  }
-  return [...merged, ...savedTraktBuilt];
-}
-
-/**
- * The legacy Trakt admin sections on a page, from the importing profile's
- * view of it and its saved overrides.
- */
-export function legacyTraktSectionIds(
-  settings: { id: string; is_custom: boolean; config?: Record<string, unknown> }[],
-  existing: SectionOverrideRead[],
-): Set<string> {
-  const ids = new Set<string>();
-  for (const section of settings) {
-    if (!section.is_custom && isTraktConfig(section.config)) ids.add(section.id);
+    merged.push({ ...override, id: existingBySection.get(sectionId)?.id || newId() });
   }
-  for (const override of existing) {
-    if (override.section_id && isTraktConfig(override.config)) ids.add(override.section_id);
-  }
-  return ids;
+  return merged;
 }
 
 /** The most overrides one page's save accepts (SectionOverrideSet in the v2 contract). */
 export const HOME_LAYOUT_MAX_PAGE_OVERRIDES = 500;
 
-type PageViewSection = { id: string; is_custom: boolean; config?: Record<string, unknown> };
-
 /** The requests that import one page, bound to the importing profile. */
 export interface HomeLayoutPageApi {
   listSaved(): Promise<SectionOverrideRead[]>;
-  listView(): Promise<PageViewSection[]>;
   save(overrides: SectionOverrideWrite[]): Promise<unknown>;
 }
 
-/**
- * Saves one planned page over the profile's saved overrides. The server
- * refuses to change or drop a saved override that holds back a legacy Trakt
- * admin section, and the client can't always tell which those are: a removed
- * section isn't in the page view, and an older override can mask its source.
- * A refused save writes nothing, so a refused same-server page is retried
- * once with every saved admin-section override kept as it is; the file's
- * changes then apply only to sections the profile hadn't changed.
- * `keptSavedChanges` reports that retry.
- */
+/** Saves one planned page over the profile's saved overrides. */
 export async function importPage(
   page: HomeLayoutPlannedPage,
   sameServer: boolean,
   api: HomeLayoutPageApi,
   newId: () => string,
-): Promise<{ keptSavedChanges: boolean }> {
-  const [existing, view] = await Promise.all([
-    api.listSaved(),
-    sameServer ? api.listView() : Promise.resolve([]),
-  ]);
-  const legacyTrakt = legacyTraktSectionIds(view, existing);
-  const save = (keep: ReadonlySet<string>) => {
-    const overrides = mergeImportedPage(page, existing, sameServer, keep, newId);
-    if (overrides.length > HOME_LAYOUT_MAX_PAGE_OVERRIDES) {
-      throw new Error(
-        `this page would have more than ${HOME_LAYOUT_MAX_PAGE_OVERRIDES} saved section changes`,
-      );
-    }
-    return api.save(overrides);
-  };
-  try {
-    await save(legacyTrakt);
-    return { keptSavedChanges: false };
-  } catch (error) {
-    const saved = existing.flatMap((override) =>
-      override.section_id ? [override.section_id] : [],
+): Promise<void> {
+  const overrides = mergeImportedPage(page, await api.listSaved(), sameServer, newId);
+  if (overrides.length > HOME_LAYOUT_MAX_PAGE_OVERRIDES) {
+    throw new Error(
+      `this page would have more than ${HOME_LAYOUT_MAX_PAGE_OVERRIDES} saved section changes`,
     );
-    if (
-      !sameServer ||
-      !(error instanceof V2ProblemError && error.status === 422) ||
-      saved.length === 0
-    ) {
-      throw error;
-    }
-    await save(new Set([...legacyTrakt, ...saved]));
-    return { keptSavedChanges: true };
   }
+  await api.save(overrides);
 }
diff --git a/web/src/lib/homeRows/__fixtures__/recipeCatalog.v2.json b/web/src/lib/homeRows/__fixtures__/recipeCatalog.v2.json
index 3d63d4040e..5d37341999 100644
--- a/web/src/lib/homeRows/__fixtures__/recipeCatalog.v2.json
+++ b/web/src/lib/homeRows/__fixtures__/recipeCatalog.v2.json
@@ -640,13 +640,15 @@
               "display_name": "Seasonal Picks",
               "icon": "🗓️",
               "description_short": "Cycles automatically — Halloween in October, Christmas in December, etc.",
-              "description_long": "One section that swaps in different theme picks based on the calendar. Toggle which holidays this profile celebrates from the Add section dialog.",
+              "description_long": "One section that swaps in curated holiday picks based on the calendar. Choose the holidays, a vibe for each, and add your own holidays.",
               "default_params": {
                 "enabled_themes": [
                   "halloween",
                   "christmas",
+                  "new_year",
                   "valentines",
                   "st_patricks",
+                  "easter",
                   "thanksgiving",
                   "summer_blockbuster",
                   "saturday_morning"
diff --git a/web/src/lib/homeRows/bulkCopy.test.ts b/web/src/lib/homeRows/bulkCopy.test.ts
index 08be35193f..e1dc54a53a 100644
--- a/web/src/lib/homeRows/bulkCopy.test.ts
+++ b/web/src/lib/homeRows/bulkCopy.test.ts
@@ -36,12 +36,6 @@ describe("canCopyToLibraries", () => {
   ])("refuses a row whose settings name a library through %s", (_key, config) => {
     expect(canCopyToLibraries({ sectionType: "recently_added", config })).toBe(false);
   });
-
-  it("refuses a legacy Trakt row, which the server won't create again", () => {
-    expect(
-      canCopyToLibraries({ sectionType: "trending_discover", config: { source: "trakt" } }),
-    ).toBe(false);
-  });
 });
 
 const PAGES = [
diff --git a/web/src/lib/homeRows/bulkCopy.ts b/web/src/lib/homeRows/bulkCopy.ts
index 3fb2a48ff3..1c594de5c2 100644
--- a/web/src/lib/homeRows/bulkCopy.ts
+++ b/web/src/lib/homeRows/bulkCopy.ts
@@ -1,5 +1,4 @@
 import { sectionLibraryFilterIds } from "@/lib/sectionLibraryFilter";
-import { isTraktConfig } from "@/lib/sectionTypes";
 import type { RowDraft } from "./rowDraft";
 import type { LibraryPage, PageRef } from "./types";
 
@@ -34,7 +33,7 @@ function namesLibrary(config: Record<string, unknown>): boolean {
 /**
  * Whether a row can be copied to other library pages as it is. The bulk
  * create sends one config to every page, so only ready-made kinds whose
- * settings name no library qualify. Legacy Trakt rows can't be created again.
+ * settings name no library qualify.
  * Hero rows are handled by the caller: a new hero row stays on its own page,
  * and copies of an existing one are never heroes.
  */
@@ -42,11 +41,7 @@ export function canCopyToLibraries(row: {
   sectionType: string;
   config: Record<string, unknown>;
 }): boolean {
-  return (
-    !PAGE_BOUND_TYPES.has(row.sectionType) &&
-    !namesLibrary(row.config) &&
-    !isTraktConfig(row.config)
-  );
+  return !PAGE_BOUND_TYPES.has(row.sectionType) && !namesLibrary(row.config);
 }
 
 /** Spellings of a library type, by the kind they name (as in internal/librarykind). */
diff --git a/web/src/lib/homeRows/describe.test.ts b/web/src/lib/homeRows/describe.test.ts
index 6d7d428236..2bac59f43a 100644
--- a/web/src/lib/homeRows/describe.test.ts
+++ b/web/src/lib/homeRows/describe.test.ts
@@ -21,7 +21,6 @@ function row(sectionType: string, config: Record<string, unknown> = {}): HomeRow
     hero: false,
     shown: true,
     own: false,
-    legacyTrakt: false,
   };
 }
 
@@ -242,7 +241,7 @@ describe("collection kinds", () => {
   it("names each stored collection type the way the picker filters them", () => {
     expect(collectionKind("manual")).toBe("Manual");
     expect(collectionKind("smart")).toBe("Smart");
-    for (const type of ["mdblist", "tmdb", "trakt"] as const)
+    for (const type of ["mdblist", "tmdb"] as const)
       expect(collectionKind(type)).toBe("Synced list");
     expect(collectionKind(undefined)).toBeUndefined();
   });
diff --git a/web/src/lib/homeRows/paramFields.ts b/web/src/lib/homeRows/paramFields.ts
index 1704f177d6..0464b07262 100644
--- a/web/src/lib/homeRows/paramFields.ts
+++ b/web/src/lib/homeRows/paramFields.ts
@@ -18,7 +18,18 @@ const FIELD_KEYS: Record<string, { primary?: string[]; more?: string[] }> = {
   anniversaries: { more: ["milestone_years"] },
   taste_match: { more: ["genre"] },
   editorial_spotlight: { more: ["auto_rotate", "rotation_cadence", "subject"] },
-  seasonal_themed: { primary: ["enabled_themes", "theme_titles", "theme", "mode"] },
+  seasonal_themed: {
+    primary: [
+      "enabled_themes",
+      "theme_titles",
+      "vibes",
+      "theme_dates",
+      "source",
+      "custom_holidays",
+      "theme",
+      "mode",
+    ],
+  },
 };
 
 export function paramFieldKeys(sectionType: string): string[] {
@@ -36,9 +47,14 @@ export function hasParamFields(
   if (slot === "primary") {
     if (LIBRARY_FILTER_SECTION_TYPES.has(sectionType)) return !onLibraryPage;
     if (sectionType === "seasonal_themed") {
-      // Holidays, or a legacy single-holiday row, whose list starts from that holiday.
+      // Holidays (or a legacy single-holiday row, whose list starts from that
+      // holiday) and Family movie night, which picks a vibe.
       const variant = variantOf(sectionType, config);
-      return variant === "se_auto" || (variant === null && typeof config.theme === "string");
+      return (
+        variant === "se_auto" ||
+        variant === "se_family_movie_night" ||
+        (variant === null && typeof config.theme === "string")
+      );
     }
   }
   return Boolean(FIELD_KEYS[sectionType]?.[slot]);
diff --git a/web/src/lib/homeRows/payloads.golden.json b/web/src/lib/homeRows/payloads.golden.json
index a72a590d0c..304b5b9717 100644
--- a/web/src/lib/homeRows/payloads.golden.json
+++ b/web/src/lib/homeRows/payloads.golden.json
@@ -862,8 +862,10 @@
         "enabled_themes": [
           "halloween",
           "christmas",
+          "new_year",
           "valentines",
           "st_patricks",
+          "easter",
           "thanksgiving",
           "summer_blockbuster",
           "saturday_morning"
@@ -882,8 +884,10 @@
         "enabled_themes": [
           "halloween",
           "christmas",
+          "new_year",
           "valentines",
           "st_patricks",
+          "easter",
           "thanksgiving",
           "summer_blockbuster",
           "saturday_morning"
diff --git a/web/src/lib/homeRows/peek.test.ts b/web/src/lib/homeRows/peek.test.ts
index 7c1836ba5d..dacb795237 100644
--- a/web/src/lib/homeRows/peek.test.ts
+++ b/web/src/lib/homeRows/peek.test.ts
@@ -14,7 +14,6 @@ function row(overrides: Partial<HomeRow> = {}): HomeRow {
     hero: false,
     shown: true,
     own: false,
-    legacyTrakt: false,
     ...overrides,
   };
 }
diff --git a/web/src/lib/homeRows/profileOverrides.test.ts b/web/src/lib/homeRows/profileOverrides.test.ts
index ae8ac7beb8..fb1aabca82 100644
--- a/web/src/lib/homeRows/profileOverrides.test.ts
+++ b/web/src/lib/homeRows/profileOverrides.test.ts
@@ -18,33 +18,6 @@ function entry(id: string, overrides: Partial<SettingsSectionEntry> = {}): Setti
   };
 }
 
-describe("buildSectionOverrides with several changed rows", () => {
-  const trakt = { source: "trakt", list: "trending" };
-  const sections = [
-    entry("a"),
-    entry("trakt-1", { position: 1, config: trakt }),
-    entry("trakt-2", { position: 2, config: trakt }),
-  ];
-  const newId = (id: string) => `new-${id}`;
-
-  it("sends each shown legacy Trakt row the merged changes name, and leaves out the rest", () => {
-    const overrides = buildSectionOverrides(sections, [], {
-      newId,
-      changedSectionIds: new Set(["a", "trakt-2"]),
-    });
-    expect(overrides.map((o) => [o.section_id, o.position])).toEqual([
-      ["a", 0],
-      ["trakt-2", 2],
-    ]);
-  });
-
-  it("matches the single changed row form when the set holds one id", () => {
-    expect(
-      buildSectionOverrides(sections, [], { newId, changedSectionIds: new Set(["trakt-1"]) }),
-    ).toEqual(buildSectionOverrides(sections, [], { newId, changedSectionId: "trakt-1" }));
-  });
-});
-
 // O3: with the page as it was read, a save stores only what the profile changed,
 // so later admin edits to the rest of a row still reach this profile.
 describe("buildSectionOverrides against the page as it was read", () => {
@@ -86,15 +59,12 @@ describe("buildSectionOverrides against the page as it was read", () => {
 
   it("stores only the hide of a server row, without its title, size, hero or config", () => {
     const next = page.map((s) => (s.id === "b" ? { ...s, hidden: true } : s));
-    expect(build(next, { changedSectionId: "b" })).toEqual([
-      { section_id: "b", id: "new-b", hidden: true },
-      ownOverride,
-    ]);
+    expect(build(next)).toEqual([{ section_id: "b", id: "new-b", hidden: true }, ownOverride]);
   });
 
   it("stores a rename as the title alone", () => {
     const next = page.map((s) => (s.id === "a" ? { ...s, title: "New Movies" } : s));
-    expect(build(next, { changedSectionId: "a" })).toEqual([
+    expect(build(next)).toEqual([
       { section_id: "a", id: "new-a", hidden: false, title: "New Movies" },
       ownOverride,
     ]);
@@ -104,7 +74,7 @@ describe("buildSectionOverrides against the page as it was read", () => {
     const next = page.map((s) =>
       s.id === "b" ? { ...s, featured: true, item_limit: 30, config: { window: "24h" } } : s,
     );
-    expect(build(next, { changedSectionId: "b" })[0]).toEqual({
+    expect(build(next)[0]).toEqual({
       section_id: "b",
       id: "new-b",
       hidden: false,
@@ -123,7 +93,6 @@ describe("buildSectionOverrides against the page as it was read", () => {
         newId,
         baseline: renamed,
         savedOverrides: saved,
-        changedSectionId: "a",
       })[0],
     ).toEqual({ section_id: "a", id: "saved-a", hidden: false });
   });
@@ -141,7 +110,7 @@ describe("buildSectionOverrides against the page as it was read", () => {
       },
     ];
     const next = page.map((s) => (s.id === "a" ? { ...s, hidden: true } : s));
-    const overrides = build(next, { savedOverrides: saved, changedSectionId: "a" });
+    const overrides = build(next, { savedOverrides: saved });
     expect(overrides.find((o) => o.section_id === "b")).toEqual({
       section_id: "b",
       id: "saved-b",
@@ -157,7 +126,7 @@ describe("buildSectionOverrides against the page as it was read", () => {
   it("keeps what an earlier save without an ID stored, under a new ID", () => {
     const saved = [{ id: "", section_id: "b", title: "Hot", item_limit: 30 }];
     const next = page.map((s) => (s.id === "a" ? { ...s, hidden: true } : s));
-    const overrides = build(next, { savedOverrides: saved, changedSectionId: "a" });
+    const overrides = build(next, { savedOverrides: saved });
     expect(overrides.find((o) => o.section_id === "b")).toEqual({
       section_id: "b",
       id: "new-b",
@@ -169,7 +138,7 @@ describe("buildSectionOverrides against the page as it was read", () => {
 
   it("stores every row's position once the profile moves a row", () => {
     const next = [page[1]!, page[0]!, page[2]!];
-    expect(build(next, { changedSectionId: "b" })).toEqual([
+    expect(build(next)).toEqual([
       { section_id: "b", id: "new-b", position: 0, hidden: false },
       { section_id: "a", id: "new-a", position: 1, hidden: false },
       ownOverride,
@@ -180,10 +149,7 @@ describe("buildSectionOverrides against the page as it was read", () => {
     const saved = [{ id: "saved-a", section_id: "a", position: 0 }];
     const next = page.map((s) => (s.id === "b" ? { ...s, hidden: true } : s));
     expect(
-      build(next, { savedOverrides: saved, changedSectionId: "b" }).map((o) => [
-        o.section_id ?? o.id,
-        o.position,
-      ]),
+      build(next, { savedOverrides: saved }).map((o) => [o.section_id ?? o.id, o.position]),
     ).toEqual([
       ["a", 0],
       ["b", 1],
@@ -200,7 +166,7 @@ describe("buildSectionOverrides against the page as it was read", () => {
       position: 3,
       config: {},
     });
-    expect(build([...page, added], { changedSectionId: "added" }).at(-1)).toEqual({
+    expect(build([...page, added]).at(-1)).toEqual({
       section_id: undefined,
       id: "added",
       position: 3,
@@ -218,9 +184,7 @@ describe("buildSectionOverrides against the page as it was read", () => {
       entry(id, { section_type: "random", title: id, is_custom: true, customized: true, position });
 
     it("keeps the admin order while the new rows stay at the bottom in order", () => {
-      const overrides = build([...page, added("x", 3), added("y", 4)], {
-        changedSectionIds: new Set(["x", "y"]),
-      });
+      const overrides = build([...page, added("x", 3), added("y", 4)]);
       expect(overrides.map((o) => [o.section_id ?? o.id, o.position])).toEqual([
         ["own", 2],
         ["x", 3],
@@ -229,9 +193,7 @@ describe("buildSectionOverrides against the page as it was read", () => {
     });
 
     it("stores every position once a new row moves above another row", () => {
-      const overrides = build([page[0]!, added("x", 3), page[1]!, page[2]!], {
-        changedSectionId: "x",
-      });
+      const overrides = build([page[0]!, added("x", 3), page[1]!, page[2]!]);
       expect(overrides.map((o) => [o.section_id ?? o.id, o.position])).toEqual([
         ["a", 0],
         ["x", 1],
@@ -241,9 +203,7 @@ describe("buildSectionOverrides against the page as it was read", () => {
     });
 
     it("stores every position once two new rows swap", () => {
-      const overrides = build([...page, added("y", 4), added("x", 3)], {
-        changedSectionIds: new Set(["x", "y"]),
-      });
+      const overrides = build([...page, added("y", 4), added("x", 3)]);
       expect(overrides.map((o) => [o.section_id ?? o.id, o.position])).toEqual([
         ["a", 0],
         ["b", 1],
@@ -255,7 +215,7 @@ describe("buildSectionOverrides against the page as it was read", () => {
   });
 
   it("stores a removed server row as removed and nothing for rows left alone", () => {
-    expect(build(page.slice(1), { changedSectionId: "a" }, [{ id: "a" }])).toEqual([
+    expect(build(page.slice(1), {}, [{ id: "a" }])).toEqual([
       ownOverride,
       { section_id: "a", id: "new-a", removed: true },
     ]);
diff --git a/web/src/lib/homeRows/profileOverrides.ts b/web/src/lib/homeRows/profileOverrides.ts
index 21d923f265..5d53e93472 100644
--- a/web/src/lib/homeRows/profileOverrides.ts
+++ b/web/src/lib/homeRows/profileOverrides.ts
@@ -5,7 +5,6 @@
  */
 import type { SectionOverride, SettingsSectionEntry } from "@/api/types";
 import { V2ProblemError } from "@/api/v2/request";
-import { isTraktConfig } from "@/lib/sectionTypes";
 import { randomUUID } from "@/lib/uuid";
 import { stableJson } from "./stableJson";
 
@@ -18,10 +17,6 @@ export interface SectionOverrideIds {
   savedOverrides?: SectionOverride[];
   /** An ID for an admin section the profile has no saved override for. */
   newId?: (sectionId: string) => string;
-  /** The section the change being saved is to, if it is to one section. */
-  changedSectionId?: string;
-  /** Every section the changes being saved are to, when several are saved at once. */
-  changedSectionIds?: ReadonlySet<string>;
   /**
    * The page as it was read. With it, a save stores only what the profile
    * changed (see `buildSectionOverrides`); without it every field of every
@@ -82,13 +77,7 @@ function movedNewRow(sections: SettingsSectionEntry[], baseline: SettingsSection
 /**
  * The override set to save for one page. A change to an admin section keeps
  * the ID of the profile's saved override for that section, or gets one from
- * `newId`: the server's section source policy refuses a legacy Trakt admin
- * section's override without an ID. It also refuses a new override that
- * leaves such a section showing, so a shown one without a saved override ID is
- * left out and keeps its admin position, unless a change being saved is to
- * that section; the refusal then reaches the user instead of the change
- * silently not saving. Positions are only as close to the list order as that
- * held position allows.
+ * `newId`.
  *
  * With a `baseline`, an admin section's override stores only what the
  * profile changed: whether it is hidden, the fields it edited (or an earlier
@@ -99,13 +88,7 @@ function movedNewRow(sections: SettingsSectionEntry[], baseline: SettingsSection
 export function buildSectionOverrides(
   sections: SettingsSectionEntry[],
   removedSystemSections: RemovedSystemOverride[] = [],
-  {
-    savedOverrides = [],
-    newId = () => randomUUID(),
-    changedSectionId,
-    changedSectionIds,
-    baseline,
-  }: SectionOverrideIds = {},
+  { savedOverrides = [], newId = () => randomUUID(), baseline }: SectionOverrideIds = {},
 ): SectionOverride[] {
   // The server resolves the last saved override for a section. One saved
   // without an ID still holds the profile's changes; it gets a new ID below.
@@ -115,9 +98,6 @@ export function buildSectionOverrides(
   }
   const savedId = (sectionId: string) => saved.get(sectionId)?.id || newId(sectionId);
   const baseById = new Map(baseline?.map((s) => [s.id, s]));
-  const changed = (id: string) => id === changedSectionId || Boolean(changedSectionIds?.has(id));
-  const leftOut = (s: SettingsSectionEntry) =>
-    !s.is_custom && !s.hidden && !saved.get(s.id)?.id && !changed(s.id) && isTraktConfig(s.config);
   // Positions follow the list once the profile orders the page; until then
   // admin sections keep the admin order and only added rows store a position.
   const ordered =
@@ -125,19 +105,8 @@ export function buildSectionOverrides(
     savedOverrides.some((o) => o.section_id && o.position !== undefined) ||
     stableJson(sharedOrder(sections, baseline)) !== stableJson(sharedOrder(baseline, sections)) ||
     movedNewRow(sections, baseline);
-  // A section left out keeps its admin position, so the others are numbered
-  // in list order around it and never on it: the server orders sections with
-  // equal positions arbitrarily.
-  const heldPositions = new Set(sections.filter(leftOut).map((s) => s.position));
   const overrides: SectionOverride[] = [];
-  let position = 0;
-  for (const s of sections) {
-    if (leftOut(s)) {
-      position = Math.max(position, s.position + 1);
-      continue;
-    }
-    while (heldPositions.has(position)) position += 1;
-    const listPosition = position++;
+  for (const [listPosition, s] of sections.entries()) {
     if (s.is_custom) {
       overrides.push({
         section_id: undefined,
diff --git a/web/src/lib/homeRows/rowDraft.test.ts b/web/src/lib/homeRows/rowDraft.test.ts
index 17c569d668..730680b1f5 100644
--- a/web/src/lib/homeRows/rowDraft.test.ts
+++ b/web/src/lib/homeRows/rowDraft.test.ts
@@ -58,7 +58,6 @@ function row(overrides: Partial<HomeRow> = {}): HomeRow {
     hero: false,
     shown: true,
     own: false,
-    legacyTrakt: false,
     ...overrides,
   };
 }
@@ -401,11 +400,8 @@ describe("rule rows", () => {
         },
       ],
       ["custom_filter", { ...rules, limit: 40, generated_source: "home" }],
-      [
-        "collection",
-        { library_collection_id: "lib-trakt", source_provider: "trakt", source_preset: "trending" },
-      ],
-      ["trending_discover", { source: "trakt", window: "week" }],
+      ["collection", { library_collection_id: "lib-1", source_provider: "mdblist" }],
+      ["trending_discover", { source: "tmdb", window: "week" }],
       ["award_winners", { award_type: "oscar" }],
       ["admin_curated_list", { item_ids: ["movie:a", "movie:b"] }],
       [
diff --git a/web/src/lib/homeRows/rowDraft.ts b/web/src/lib/homeRows/rowDraft.ts
index 01dc3945f9..5635530688 100644
--- a/web/src/lib/homeRows/rowDraft.ts
+++ b/web/src/lib/homeRows/rowDraft.ts
@@ -4,6 +4,12 @@ import type { GalleryPreset, RecipeCatalogResponse, RecipeDefinition } from "@/l
 import { FILTER_SECTION_TYPES } from "@/lib/sectionTypes";
 import { rowKindLabel } from "./catalog";
 import { collectionIdOf, withPickedCollection, withQueryDefinition } from "./payloads";
+import {
+  customHolidayProblem,
+  customHolidaysOf,
+  holidayDatesProblem,
+  themeDatesOf,
+} from "./seasonal";
 import { stableJson } from "./stableJson";
 import type { HomeRow, Surface } from "./types";
 import { applyVariant, variantFamily, variantOf } from "./variants";
@@ -147,9 +153,18 @@ export function savedTitle(
 export function canSaveDraft(draft: RowDraft, surface: Surface = "profile"): boolean {
   const { config } = draft;
   switch (draft.sectionType) {
-    case "seasonal_themed":
-      // An empty holiday list with no legacy theme.
-      return !(Array.isArray(config.enabled_themes) && config.enabled_themes.length === 0);
+    case "seasonal_themed": {
+      // Every custom holiday and every holiday's own dates complete, and at
+      // least one holiday of either kind unless a legacy single theme remains.
+      const custom = customHolidaysOf(config);
+      if (custom.some((holiday) => customHolidayProblem(holiday) !== null)) return false;
+      const dates = Object.values(themeDatesOf(config));
+      if (dates.some((window) => holidayDatesProblem(window) !== null)) return false;
+      return (
+        custom.length > 0 ||
+        !(Array.isArray(config.enabled_themes) && config.enabled_themes.length === 0)
+      );
+    }
     case "collection":
       return collectionIdOf(config, surface) !== "";
     case "admin_curated_list":
diff --git a/web/src/lib/homeRows/rowLinks.ts b/web/src/lib/homeRows/rowLinks.ts
index c520e46bc5..aced80b23d 100644
--- a/web/src/lib/homeRows/rowLinks.ts
+++ b/web/src/lib/homeRows/rowLinks.ts
@@ -58,7 +58,7 @@ export function readRowLinks(params: URLSearchParams, surface: Surface): RowLink
 }
 
 const RETURN_PREFIXES = ["/admin/collections/", "/collections/"];
-// eslint-disable-next-line no-control-regex
+// eslint-disable-next-line no-control-regex -- the pattern matches control characters on purpose
 const CONTROL_CHARACTER = /[\u0000-\u001f\u007f]/;
 
 function unsafe(path: string) {
diff --git a/web/src/lib/homeRows/seasonal.test.ts b/web/src/lib/homeRows/seasonal.test.ts
new file mode 100644
index 0000000000..24b4b46835
--- /dev/null
+++ b/web/src/lib/homeRows/seasonal.test.ts
@@ -0,0 +1,25 @@
+import { describe, expect, it } from "vitest";
+import { customHolidayProblem } from "./seasonal";
+
+const holiday = (list_url: string) => ({ name: "Fourth", start: "07-01", end: "07-04", list_url });
+
+describe("customHolidayProblem", () => {
+  it("accepts the MDBList list links the server accepts", () => {
+    expect(customHolidayProblem(holiday("https://mdblist.com/lists/a/b"))).toBeNull();
+    expect(customHolidayProblem(holiday("http://www.mdblist.com:443/lists/a/b"))).toBeNull();
+  });
+
+  it("refuses links the server would refuse", () => {
+    for (const link of [
+      "https://example.com/lists/a/b",
+      "https://user:secret@mdblist.com/lists/a/b",
+      "https://@mdblist.com/lists/a/b",
+      "https://:@mdblist.com/lists/a/b",
+      "https:\\\\user@mdblist.com\\lists\\a",
+      "https://mdblist.com:8443/lists/a/b",
+      "https://mdblist.com/toplists/",
+    ]) {
+      expect(customHolidayProblem(holiday(link)), link).toMatch(/MDBList list link/);
+    }
+  });
+});
diff --git a/web/src/lib/homeRows/seasonal.ts b/web/src/lib/homeRows/seasonal.ts
new file mode 100644
index 0000000000..1702e42025
--- /dev/null
+++ b/web/src/lib/homeRows/seasonal.ts
@@ -0,0 +1,126 @@
+type Config = Record<string, unknown>;
+
+/** A holiday a user adds to a Seasonal Picks row (the server's SeasonalCustomHoliday). */
+export interface CustomHoliday {
+  name: string;
+  /** MM-DD, inclusive. An end before the start wraps across New Year. */
+  start: string;
+  end: string;
+  list_url: string;
+  title?: string;
+}
+
+export function customHolidaysOf(config: Config): CustomHoliday[] {
+  if (!Array.isArray(config.custom_holidays)) return [];
+  return config.custom_holidays
+    .filter((entry): entry is Record<string, unknown> => !!entry && typeof entry === "object")
+    .map((entry) => ({
+      ...(entry as Partial<CustomHoliday>),
+      name: typeof entry.name === "string" ? entry.name : "",
+      start: typeof entry.start === "string" ? entry.start : "",
+      end: typeof entry.end === "string" ? entry.end : "",
+      list_url: typeof entry.list_url === "string" ? entry.list_url : "",
+    }));
+}
+
+// Days per month in a leap year: Feb 29 is a valid boundary.
+const MONTH_DAYS = [31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+
+function validMonthDay(value: string): boolean {
+  const match = /^(\d{2})-(\d{2})$/.exec(value);
+  if (!match) return false;
+  const month = Number(match[1]);
+  const day = Number(match[2]);
+  return month >= 1 && month <= 12 && day >= 1 && day <= MONTH_DAYS[month - 1]!;
+}
+
+const MONTH_NAMES = [
+  "Jan",
+  "Feb",
+  "Mar",
+  "Apr",
+  "May",
+  "Jun",
+  "Jul",
+  "Aug",
+  "Sep",
+  "Oct",
+  "Nov",
+  "Dec",
+];
+
+function monthDayParts(value: string): [string, number] {
+  return [MONTH_NAMES[Number(value.slice(0, 2)) - 1]!, Number(value.slice(3))];
+}
+
+/** A window in the catalog's style: "Oct 20–Nov 2", or "Oct 15–31" within a month. */
+export function holidayDatesLabel(dates: HolidayDates): string {
+  const [startMonth, startDay] = monthDayParts(dates.start);
+  const [endMonth, endDay] = monthDayParts(dates.end);
+  return startMonth === endMonth && startDay <= endDay
+    ? `${startMonth} ${startDay}–${endDay}`
+    : `${startMonth} ${startDay}–${endMonth} ${endDay}`;
+}
+
+/** A row's own yearly window for a built-in holiday (the server's SeasonalDates). */
+export interface HolidayDates {
+  start: string;
+  end: string;
+}
+
+/** The row's theme_dates, keyed by holiday. */
+export function themeDatesOf(config: Config): Record<string, HolidayDates> {
+  const out: Record<string, HolidayDates> = {};
+  const raw = config.theme_dates;
+  if (!raw || typeof raw !== "object") return out;
+  for (const [key, entry] of Object.entries(raw as Record<string, unknown>)) {
+    if (!entry || typeof entry !== "object") continue;
+    const { start, end } = entry as Record<string, unknown>;
+    out[key] = {
+      start: typeof start === "string" ? start : "",
+      end: typeof end === "string" ? end : "",
+    };
+  }
+  return out;
+}
+
+/** Why the server would refuse a holiday's own dates, or null when they're complete. */
+export function holidayDatesProblem(dates: HolidayDates): string | null {
+  if (validMonthDay(dates.start) && validMonthDay(dates.end)) return null;
+  return "Enter both dates as MM-DD, or clear them to use the usual dates.";
+}
+
+function isMDBListList(value: string): boolean {
+  try {
+    const raw = value.trim();
+    const url = new URL(raw);
+    const host = url.hostname.toLowerCase().replace(/\.$/, "");
+    // The same rules as the server's ValidateMDBListURL. The server refuses
+    // any userinfo, even an empty "https://@host", which URL reports as no
+    // username, so look for "@" in the authority as typed.
+    const authority = /^[a-z][a-z\d+.-]*:\/\/([^/?#]*)/i.exec(raw)?.[1] ?? "";
+    return (
+      (url.protocol === "https:" || url.protocol === "http:") &&
+      !authority.includes("@") &&
+      url.username === "" &&
+      url.password === "" &&
+      (url.port === "" || url.port === "80" || url.port === "443") &&
+      (host === "mdblist.com" || host === "www.mdblist.com") &&
+      url.pathname.startsWith("/lists/")
+    );
+  } catch {
+    return false;
+  }
+}
+
+/** Why the server would refuse this holiday, or null when it's complete. */
+export function customHolidayProblem(holiday: CustomHoliday): string | null {
+  if (holiday.name.trim() === "") return "Give the holiday a name.";
+  if (!validMonthDay(holiday.start) || !validMonthDay(holiday.end)) {
+    return "Enter the start and end as MM-DD, such as 07-04.";
+  }
+  if (!isMDBListList(holiday.list_url)) {
+    return "Use a public MDBList list link (https://mdblist.com/lists/…).";
+  }
+  return null;
+}
diff --git a/web/src/lib/homeRows/types.ts b/web/src/lib/homeRows/types.ts
index db6d411b9b..51240c72be 100644
--- a/web/src/lib/homeRows/types.ts
+++ b/web/src/lib/homeRows/types.ts
@@ -37,8 +37,6 @@ export interface HomeRow {
   shown: boolean;
   /** A row the profile added itself ("Yours"). Always false on the admin surface. */
   own: boolean;
-  /** A legacy Trakt row: the server refuses config changes and turning it back on. */
-  legacyTrakt: boolean;
   /** Profile: the server's own name for a row this profile renamed. */
   renamedFrom?: string;
 }
diff --git a/web/src/lib/homeRows/variants.test.ts b/web/src/lib/homeRows/variants.test.ts
index ef3a0d5300..49a9389420 100644
--- a/web/src/lib/homeRows/variants.test.ts
+++ b/web/src/lib/homeRows/variants.test.ts
@@ -1,13 +1,6 @@
 import { describe, expect, it } from "vitest";
 import { everyRecipe } from "./recipeCatalogFixture.test-support";
-import {
-  applyVariant,
-  kindLocked,
-  showsLabel,
-  VARIANT_FAMILIES,
-  variantLocked,
-  variantOf,
-} from "./variants";
+import { applyVariant, showsLabel, VARIANT_FAMILIES, variantLocked, variantOf } from "./variants";
 
 describe("variant families", () => {
   it("covers every catalog kind that offers more than one preset", () => {
@@ -73,6 +66,19 @@ describe("strict inference", () => {
     expect(variantOf("format_showcase", { format: "4k", sort: "title" })).toBeNull();
     expect(variantOf("continue_watching", { continue_type: "reading" })).toBeNull();
     expect(variantOf("seasonal_themed", { theme: "christmas" })).toBeNull();
+    // A row with only custom holidays is Holidays, the variant that edits them.
+    expect(
+      variantOf("seasonal_themed", {
+        custom_holidays: [
+          {
+            name: "Fourth",
+            start: "07-01",
+            end: "07-04",
+            list_url: "https://mdblist.com/lists/a/b",
+          },
+        ],
+      }),
+    ).toBe("se_auto");
     expect(variantOf("recently_added", {})).toBeNull();
   });
 
@@ -153,6 +159,27 @@ describe("seasonal themes", () => {
       ),
     ).toEqual({ enabled_themes: ["family_movie_night"], theme_titles: { x: "y" } });
   });
+
+  it("leaves no hidden custom holidays or holiday dates on a Family movie night row", () => {
+    const holiday = {
+      name: "Fourth",
+      start: "07-01",
+      end: "07-04",
+      list_url: "https://mdblist.com/lists/a/b",
+    };
+    expect(
+      applyVariant(
+        "seasonal_themed",
+        {
+          enabled_themes: ["halloween"],
+          custom_holidays: [holiday],
+          theme_dates: { halloween: { start: "10-20", end: "11-02" } },
+          source: "lists",
+        },
+        "se_family_movie_night",
+      ),
+    ).toEqual({ enabled_themes: ["family_movie_night"], source: "lists" });
+  });
 });
 
 describe("Shows line", () => {
@@ -163,10 +190,8 @@ describe("Shows line", () => {
     expect(showsLabel("seasonal_themed", { theme: "unknown_day" })).toBe("Seasonal picks");
   });
 
-  it("locks the kind only for legacy Trakt rows; Continue Reading can still change kind", () => {
-    const reading = { continue_type: "reading" };
-    expect(variantLocked("continue_watching", reading)).toBe(true);
-    expect(kindLocked(reading)).toBe(false);
-    expect(kindLocked({ source: "trakt", window: "week" })).toBe(true);
+  it("locks the variant of Continue Reading rows only", () => {
+    expect(variantLocked("continue_watching", { continue_type: "reading" })).toBe(true);
+    expect(variantLocked("continue_watching", {})).toBe(false);
   });
 });
diff --git a/web/src/lib/homeRows/variants.ts b/web/src/lib/homeRows/variants.ts
index d07ce3f118..608d0c06da 100644
--- a/web/src/lib/homeRows/variants.ts
+++ b/web/src/lib/homeRows/variants.ts
@@ -6,7 +6,6 @@
  * and the form shows none selected instead of guessing. Applying a variant
  * changes only the discriminator keys and keeps every other key.
  */
-import { isTraktConfig } from "@/lib/sectionTypes";
 import { NOT_OFFERED_FOR_NEW_ROWS, retiredKindLabel, rowKindLabel } from "./catalog";
 
 type Config = Record<string, unknown>;
@@ -36,8 +35,10 @@ export interface VariantFamily {
 const HOLIDAY_THEMES = [
   "halloween",
   "christmas",
+  "new_year",
   "valentines",
   "st_patricks",
+  "easter",
   "thanksgiving",
   "summer_blockbuster",
   "saturday_morning",
@@ -47,7 +48,9 @@ const HOLIDAY_THEMES = [
 export const SEASONAL_THEME_LABELS: Readonly<Record<string, string>> = {
   valentines: "Valentine's Day",
   st_patricks: "St. Patrick's Day",
+  easter: "Easter",
   thanksgiving: "Thanksgiving",
+  new_year: "New Year's",
   christmas: "Christmas",
   halloween: "Halloween",
   saturday_morning: "Saturday morning cartoons",
@@ -74,12 +77,25 @@ function inferSeasonal(config: Config): string | null {
       : "se_auto";
   }
   if (themes === undefined && config.theme === "family_movie_night") return "se_family_movie_night";
+  // Only Holidays shows custom holidays, so a row with nothing else is Holidays.
+  if (
+    themes === undefined &&
+    typeof config.theme !== "string" &&
+    Array.isArray(config.custom_holidays)
+  ) {
+    return "se_auto";
+  }
   return null;
 }
 
 function applySeasonal(config: Config, option: VariantOption): Config {
   const { theme: _legacy, ...rest } = config;
-  return { ...rest, enabled_themes: [...(option.values.enabled_themes as string[])] };
+  // Custom holidays outrank every theme and only the Holidays variant shows
+  // them or the holidays' own dates, so a Family movie night row must not keep
+  // any out of sight.
+  const { custom_holidays: _custom, theme_dates: _dates, ...familyNight } = rest;
+  const base = option.presetKey === "se_family_movie_night" ? familyNight : rest;
+  return { ...base, enabled_themes: [...(option.values.enabled_themes as string[])] };
 }
 
 function inferSpotlight(config: Config): string | null {
@@ -377,23 +393,9 @@ export function showsLabel(sectionType: string, config: Config): string {
   return holiday ? `${rowKindLabel(sectionType)} (${holiday} only)` : rowKindLabel(sectionType);
 }
 
-/**
- * Rows whose kind cannot change: the server refuses config changes on legacy
- * Trakt rows.
- */
-export function kindLocked(config: Config): boolean {
-  return isTraktConfig(config);
-}
-
-/**
- * Rows whose variant cannot change: legacy Trakt rows, and Continue Reading
- * (ebooks, beta), which has no preset.
- */
+/** Rows whose variant cannot change: Continue Reading (ebooks, beta), which has no preset. */
 export function variantLocked(sectionType: string, config: Config): boolean {
-  return (
-    kindLocked(config) ||
-    (sectionType === "continue_watching" && config.continue_type === "reading")
-  );
+  return sectionType === "continue_watching" && config.continue_type === "reading";
 }
 
 const SUMMARY_CHIPS = 3;
diff --git a/web/src/lib/mediaFormat.test.ts b/web/src/lib/mediaFormat.test.ts
index d471687091..cf2c952753 100644
--- a/web/src/lib/mediaFormat.test.ts
+++ b/web/src/lib/mediaFormat.test.ts
@@ -2,6 +2,8 @@
 
 import { describe, expect, it } from "vitest";
 import {
+  audioTrackHasAtmos,
+  audioTrackLabel,
   compactHdrSuffix,
   dolbyVisionLabel,
   formatBitrate,
@@ -35,8 +37,16 @@ describe("formatCodecLabel", () => {
 
 describe("mapAudioLabel", () => {
   it("prefers Atmos over other markers", () => {
-    expect(mapAudioLabel("TrueHD Atmos")).toBe("Atmos");
-    expect(mapAudioLabel("eac3 atmos")).toBe("Atmos");
+    expect(mapAudioLabel("TrueHD Atmos")).toBe("TrueHD Atmos");
+    expect(mapAudioLabel("eac3 atmos")).toBe("DD+ Atmos");
+    expect(mapAudioLabel("Atmos")).toBe("Atmos");
+  });
+
+  it("reads Atmos from the FFprobe profile of a plain codec", () => {
+    expect(mapAudioLabel("eac3", "Dolby Digital Plus + Dolby Atmos")).toBe("DD+ Atmos");
+    expect(mapAudioLabel("truehd", "Dolby TrueHD + Dolby Atmos")).toBe("TrueHD Atmos");
+    expect(mapAudioLabel("eac3", "")).toBe("EAC3");
+    expect(mapAudioLabel("dts", "DTS-HD MA")).toBe("DTS");
   });
 
   it("maps codec families", () => {
@@ -174,3 +184,36 @@ describe("compactHdrSuffix", () => {
     expect(compactHdrSuffix(undefined)).toBeNull();
   });
 });
+
+describe("audioTrackLabel", () => {
+  it("reads Atmos from a track's profile or titles", () => {
+    const longName = "ATSC A/52B (AC-3, E-AC-3)";
+    expect(
+      audioTrackLabel({
+        codec: "eac3",
+        title: longName,
+        profile: "Dolby Digital Plus + Dolby Atmos",
+      }),
+    ).toBe("DD+ Atmos");
+    expect(audioTrackLabel({ codec: "truehd", embedded_title: "TrueHD Atmos 7.1" })).toBe(
+      "TrueHD Atmos",
+    );
+    expect(audioTrackLabel({ codec: "eac3", title: longName })).toBe("EAC3");
+    expect(audioTrackLabel({ title: "Atmos" })).toBe("");
+    expect(audioTrackHasAtmos({ codec: "eac3", profile: "Dolby Digital Plus + Dolby Atmos" })).toBe(
+      true,
+    );
+    expect(audioTrackHasAtmos({ codec: "eac3", title: longName })).toBe(false);
+  });
+
+  it("ignores Atmos titles on codecs that cannot carry it", () => {
+    expect(audioTrackLabel({ codec: "ac3", title: "AC3 5.1 (from TrueHD Atmos)" })).toBe("AC3");
+    expect(audioTrackLabel({ codec: "aac", title: "AAC 2.0 (DDP Atmos downmix)" })).toBe("AAC");
+    expect(audioTrackHasAtmos({ codec: "opus", title: "Opus 5.1 from Atmos" })).toBe(false);
+    expect(audioTrackLabel({ codec: "mlp", profile: "Dolby Atmos" })).toBe("Atmos");
+  });
+
+  it("matches Atmos only as a word", () => {
+    expect(audioTrackLabel({ codec: "eac3", title: "Atmospheric score" })).toBe("EAC3");
+  });
+});
diff --git a/web/src/lib/mediaFormat.ts b/web/src/lib/mediaFormat.ts
index bf8c963be0..6642623706 100644
--- a/web/src/lib/mediaFormat.ts
+++ b/web/src/lib/mediaFormat.ts
@@ -27,10 +27,59 @@ export function formatCodecLabel(codec?: string, fallback = "—"): string {
   return CODEC_LABELS[normalized.toLowerCase()] ?? normalized.toUpperCase();
 }
 
-/** Fuzzy audio-family label for quality badges ("truehd atmos" → "Atmos"). */
-export function mapAudioLabel(codec: string): string {
+const ATMOS_WORD = /\batmos\b/i;
+
+// Codec families that cannot carry Atmos. A compatibility track of one of
+// them is often titled after its source ("AC3 5.1 (from TrueHD Atmos)"), so
+// its titles are not evidence. E-AC-3 contains "ac-3" and is checked first.
+const NON_ATMOS_CODECS = [
+  "aac",
+  "ac3",
+  "ac-3",
+  "dts",
+  "flac",
+  "mp3",
+  "opus",
+  "vorbis",
+  "pcm",
+  "alac",
+];
+
+function codecCanCarryAtmos(lowerCodec: string): boolean {
+  if (
+    lowerCodec.includes("truehd") ||
+    lowerCodec.includes("eac3") ||
+    lowerCodec.includes("e-ac-3")
+  ) {
+    return true;
+  }
+  return !NON_ATMOS_CODECS.some((family) => lowerCodec.includes(family));
+}
+
+/** Whether text names Atmos as a word ("Atmospheric" does not). */
+export function mentionsAtmos(text?: string): boolean {
+  return Boolean(text && ATMOS_WORD.test(text));
+}
+
+function namesAtmos(lowerCodec: string, atmosEvidence?: string): boolean {
+  if (lowerCodec.includes("atmos")) return true;
+  return mentionsAtmos(atmosEvidence) && codecCanCarryAtmos(lowerCodec);
+}
+
+/**
+ * Fuzzy audio-family label for quality badges. The stored codec of an Atmos
+ * track is plain "eac3" or "truehd", so atmosEvidence carries any other text
+ * that can name Atmos, such as the track's FFprobe profile ("Dolby Digital
+ * Plus + Dolby Atmos"). It counts only for a codec that can carry Atmos or
+ * an unknown one. audioTrackLabel builds it from a track.
+ */
+export function mapAudioLabel(codec: string, atmosEvidence?: string): string {
   const lower = codec.toLowerCase();
-  if (lower.includes("atmos")) return "Atmos";
+  if (namesAtmos(lower, atmosEvidence)) {
+    if (lower.includes("truehd")) return "TrueHD Atmos";
+    if (lower.includes("eac3") || lower.includes("e-ac-3")) return "DD+ Atmos";
+    return "Atmos";
+  }
   if (lower.includes("truehd")) return "TrueHD";
   if (lower.includes("dts-hd") || lower.includes("dts:x")) return "DTS-HD";
   if (lower.includes("dts")) return "DTS";
@@ -40,6 +89,33 @@ export function mapAudioLabel(codec: string): string {
   return codec.toUpperCase();
 }
 
+/** The audio track fields that can identify a codec and Atmos. */
+export interface AudioTrackFormat {
+  codec?: string;
+  profile?: string;
+  title?: string;
+  embedded_title?: string;
+}
+
+/**
+ * Text beyond the codec that can name Atmos: the FFprobe profile, and the
+ * track titles, which some releases tag "Atmos" when the profile is empty.
+ */
+export function audioTrackAtmosEvidence(track: AudioTrackFormat): string {
+  return [track.profile, track.title, track.embedded_title].filter(Boolean).join(" ");
+}
+
+/** Whether a track's codec, profile, or titles name Atmos, as audioTrackLabel reads them. */
+export function audioTrackHasAtmos(track: AudioTrackFormat): boolean {
+  const codec = track.codec?.toLowerCase();
+  return codec ? namesAtmos(codec, audioTrackAtmosEvidence(track)) : false;
+}
+
+/** Audio-family label for one track ("DD+ Atmos", "TrueHD", …), or "" without a codec. */
+export function audioTrackLabel(track: AudioTrackFormat): string {
+  return track.codec ? mapAudioLabel(track.codec, audioTrackAtmosEvidence(track)) : "";
+}
+
 interface FormatFileSizeOptions {
   fallback?: string;
   /** Use IEC unit labels (GiB/MiB/KiB) instead of GB/MB/KB. Math is 1024-based either way. */
diff --git a/web/src/lib/pluginHelpers.test.ts b/web/src/lib/pluginHelpers.test.ts
index 16a354ae14..12e82e542a 100644
--- a/web/src/lib/pluginHelpers.test.ts
+++ b/web/src/lib/pluginHelpers.test.ts
@@ -239,6 +239,34 @@ describe("pluginStatusIndicator", () => {
       }),
     ).toMatchObject({ dotClass: "bg-muted-foreground", label: "Off" });
   });
+
+  it("shows a non-resident plugin whose last launch failed as Failed with the error", () => {
+    const base = installation();
+    expect(
+      pluginStatusIndicator({
+        ...base,
+        runtime: { resident: false, state: "failed", restart_count: 0, last_error: "exit 2" },
+      }),
+    ).toMatchObject({ dotClass: "bg-destructive", label: "Failed", title: "exit 2" });
+    expect(
+      pluginStatusIndicator({
+        ...base,
+        runtime: { resident: false, state: "running", restart_count: 0 },
+      }),
+    ).toMatchObject({ dotClass: "bg-success", label: "Active" });
+    expect(
+      pluginStatusIndicator({
+        ...base,
+        enabled: false,
+        runtime: { resident: false, state: "failed", restart_count: 0, last_error: "exit 2" },
+      }),
+    ).toMatchObject({ label: "Off" });
+    expect(
+      pluginStatus(
+        installation({ runtime: { resident: false, state: "failed", restart_count: 0 } }),
+      ),
+    ).toMatchObject({ label: "Failed", attention: true, rank: 0 });
+  });
 });
 
 describe("taskTrigger", () => {
diff --git a/web/src/lib/pluginStatus.ts b/web/src/lib/pluginStatus.ts
index 3572af7fa6..b85f563c8e 100644
--- a/web/src/lib/pluginStatus.ts
+++ b/web/src/lib/pluginStatus.ts
@@ -25,7 +25,7 @@ export function pluginStatus(installation: PluginInstallation): PluginStatus {
   if (!installation.enabled) {
     return { ...indicator, textClass: "text-muted-foreground", attention: false, rank: 4 };
   }
-  if (installation.runtime.resident && installation.runtime.state === "failed") {
+  if (installation.runtime.state === "failed") {
     return { ...indicator, textClass: "text-destructive", attention: true, rank: 0 };
   }
   if (installation.runtime.resident && installation.runtime.state === "backoff") {
diff --git a/web/src/lib/pluginStatusIndicator.ts b/web/src/lib/pluginStatusIndicator.ts
index f05515be02..1593d357d4 100644
--- a/web/src/lib/pluginStatusIndicator.ts
+++ b/web/src/lib/pluginStatusIndicator.ts
@@ -2,7 +2,8 @@ import type { PluginInstallation } from "@/api/types";
 
 /**
  * Status dot for an installation. A resident plugin (one the server keeps
- * running) reports its supervisor state; everything else reads enabled.
+ * running) reports its supervisor state. A plugin started on first use reads
+ * Active unless its last launch failed.
  */
 export function pluginStatusIndicator(installation: PluginInstallation): {
   dotClass: string;
@@ -14,6 +15,9 @@ export function pluginStatusIndicator(installation: PluginInstallation): {
   }
   const runtime = installation.runtime;
   if (!runtime.resident) {
+    if (runtime.state === "failed") {
+      return { dotClass: "bg-destructive", label: "Failed", title: runtime.last_error };
+    }
     return { dotClass: "bg-success", label: "Active" };
   }
   switch (runtime.state) {
diff --git a/web/src/lib/recommendation-provider-presets.test.ts b/web/src/lib/recommendation-provider-presets.test.ts
index eb3ec09a83..0314d53a98 100644
--- a/web/src/lib/recommendation-provider-presets.test.ts
+++ b/web/src/lib/recommendation-provider-presets.test.ts
@@ -45,6 +45,18 @@ describe("recommendation provider presets", () => {
     expect(custom?.modelPlaceholder).toBe("text-embedding-qwen3-embedding-0.6b");
   });
 
+  it("uses an Ollama model whose vectors Prairie can store", () => {
+    const ollama = RECOMMENDATION_PROVIDER_OPTIONS.find((preset) => preset.id === "ollama");
+    expect(ollama?.model).toBe("qwen3-embedding:0.6b");
+    expect(
+      matchRecommendationProviderPreset("http://ollama:11434", "qwen3-embedding:0.6b")?.id,
+    ).toBe("ollama");
+    // Servers saved with the 4096-dimension :latest tag show as a custom model.
+    expect(
+      matchRecommendationProviderPreset("http://ollama:11434", "qwen3-embedding:latest"),
+    ).toBeNull();
+  });
+
   it("returns null when the settings do not match a built-in provider", () => {
     expect(matchRecommendationProviderPreset("http://localhost:9999", "custom-model")).toBeNull();
   });
diff --git a/web/src/lib/recommendation-provider-presets.ts b/web/src/lib/recommendation-provider-presets.ts
index 1c3a123942..10b4383f4b 100644
--- a/web/src/lib/recommendation-provider-presets.ts
+++ b/web/src/lib/recommendation-provider-presets.ts
@@ -26,10 +26,10 @@ export const RECOMMENDATION_PROVIDER_PRESETS: RecommendationProviderPreset[] = [
     id: "ollama",
     label: "Ollama",
     tag: "Local",
-    description: "Free, self-hosted. Needs Ollama running. Uses Qwen3 Embedding 0.6B (~640MB).",
+    description: "Free, self-hosted. Needs Ollama running. About 640 MB; 1024-dimension vectors.",
     baseUrl: "http://ollama:11434",
-    // Prefer the 0.6B tag: :latest is the 8B (~4.7GB) model and emits 4096-d
-    // vectors, which exceed Prairie's 3072 canonical storage width.
+    // The :latest tag is the 8B model, whose 4096-dimension vectors Prairie
+    // cannot store.
     model: "qwen3-embedding:0.6b",
     needsToken: false,
   },
diff --git a/web/src/lib/sectionTypes.ts b/web/src/lib/sectionTypes.ts
index ba016cc57a..d44163cfc7 100644
--- a/web/src/lib/sectionTypes.ts
+++ b/web/src/lib/sectionTypes.ts
@@ -1,11 +1 @@
 export const FILTER_SECTION_TYPES = new Set(["genre", "custom_filter"]);
-
-/**
- * Whether a section config names Trakt as its source, read the way the
- * server's section source policy reads it. New Trakt-backed overrides are
- * refused, and legacy Trakt admin sections can be hidden but never changed
- * or shown again.
- */
-export function isTraktConfig(config: Record<string, unknown> | undefined): boolean {
-  return config?.source === "trakt" || config?.source_provider === "trakt";
-}
diff --git a/web/src/lib/seriesSubtitleSettings.ts b/web/src/lib/seriesSubtitleSettings.ts
index 3d49aee91e..7eb1dcaba2 100644
--- a/web/src/lib/seriesSubtitleSettings.ts
+++ b/web/src/lib/seriesSubtitleSettings.ts
@@ -14,7 +14,7 @@ import { SETTING_KEYS, type SettingKey } from "./settingsContract";
  * forced-subtitle control: the value it holds is the *resolved* one, which for
  * a viewer who never expressed a preference is the contract default. Writing
  * it back would pin that default at the top of the ladder and permanently
- * shadow the profile-scope toggle on the Subtitles settings screen. It stays
+ * shadow the profile-scope toggle on the Language & Subtitles settings screen. It stays
  * on the legacy composite row, which is not part of the canonical ladder.
  */
 export const SERIES_SUBTITLE_SETTING_KEYS = [
diff --git a/web/src/lib/settingsConformance.json b/web/src/lib/settingsConformance.json
index 0729c73154..3f84f5a25d 100644
--- a/web/src/lib/settingsConformance.json
+++ b/web/src/lib/settingsConformance.json
@@ -1,6 +1,6 @@
 {
   "fixture_version": 1,
-  "manifest_revision": 17,
+  "manifest_revision": 20,
   "description": "Cross-platform conformance cases for settings resolution. Every case runs against the shipped manifest in this directory: definitions are referenced by key, never restated, so an expectation can only be satisfied by resolving the real contract. Each platform's resolver (Go in internal/settingsresolve, TypeScript in web/src/lib/settingsResolve.ts, Kotlin and Swift in the client repos) runs every case through a hand-written runner; a runner must fail on any fixture field it does not know, because schema drift in the fixture itself is drift. A case's constraint_bindings attach a constraint to a copy of a real definition so constraint semantics stay testable even while no shipped definition carries that constraint kind. In expected entries, constrained:true requires stored_value and constraint_kind to be present, and stored_value may be null to mean the authored value was JSON null.",
   "cases": [
     {
@@ -1087,6 +1087,25 @@
         {"key": "ui.title_art", "scope": "profile_device", "profile_id": "p1", "device_id": "phone", "value": false}
       ],
       "expected": [{"key": "ui.title_art", "value": true, "source": "profile"}]
+    },
+    {
+      "name": "subtitle_sync_follows_profile",
+      "description": "From revision 19 player.subtitle_sync_ms is also a profile value: a device with no offset of its own uses the profile's.",
+      "keys": ["player.subtitle_sync_ms"],
+      "context": {"profile_id": "p1", "device_id": "another-device"},
+      "stored": [{"key": "player.subtitle_sync_ms", "scope": "profile", "profile_id": "p1", "value": -750}],
+      "expected": [{"key": "player.subtitle_sync_ms", "value": -750, "source": "profile"}]
+    },
+    {
+      "name": "subtitle_sync_device_wins",
+      "description": "A device's own player.subtitle_sync_ms still wins over the profile offset on that device.",
+      "keys": ["player.subtitle_sync_ms"],
+      "context": {"profile_id": "p1", "device_id": "d1"},
+      "stored": [
+        {"key": "player.subtitle_sync_ms", "scope": "profile", "profile_id": "p1", "value": -750},
+        {"key": "player.subtitle_sync_ms", "scope": "profile_device", "profile_id": "p1", "device_id": "d1", "value": 250}
+      ],
+      "expected": [{"key": "player.subtitle_sync_ms", "value": 250, "source": "profile_device"}]
     }
   ]
 }
diff --git a/web/src/lib/settingsContract.ts b/web/src/lib/settingsContract.ts
index 8913d3280e..41fa035824 100644
--- a/web/src/lib/settingsContract.ts
+++ b/web/src/lib/settingsContract.ts
@@ -9,7 +9,7 @@
  */
 
 export const SETTINGS_API_VERSION = 1;
-export const SETTINGS_REVISION = 17;
+export const SETTINGS_REVISION = 20;
 
 export interface SettingSuggestedOption {
   value: string;
@@ -216,6 +216,10 @@ export const SETTING_KEYS = {
   PLAYBACK_AUTO_SKIP_INTRO: "playback.auto_skip_intro",
   /** Auto-skip recaps */
   PLAYBACK_AUTO_SKIP_RECAP: "playback.auto_skip_recap",
+  /** Cellular maximum bitrate */
+  PLAYBACK_CELLULAR_MAX_BITRATE_KBPS: "playback.cellular_max_bitrate_kbps",
+  /** Cellular quality */
+  PLAYBACK_CELLULAR_PREFERRED_QUALITY: "playback.cellular_preferred_quality",
   /** Skip intros */
   PLAYBACK_INTRO_SKIP_MODE: "playback.intro_skip_mode",
   /** Maximum bitrate */
@@ -300,6 +304,8 @@ export const SETTING_KEYS = {
   UI_LIBRARY_PAGE_STATE: "ui.library_page_state",
   /** Next up episodes */
   UI_NEXT_UP_MODE: "ui.next_up_mode",
+  /** Show new episodes first */
+  UI_NEXT_UP_NEW_RELEASES_FIRST: "ui.next_up_new_releases_first",
   /** Remember library view */
   UI_REMEMBER_LIBRARY_PAGE_STATE: "ui.remember_library_page_state",
   /** Pinned sidebar items */
@@ -353,7 +359,8 @@ export interface SettingDefinition {
   platforms?: readonly string[];
   suggestedOptions?: SettingOptionSetId;
   unsetLabel?: string;
-  values?: readonly { value: unknown; label: string; introducedIn: number }[];
+  /** A deprecated member stays a valid stored value but is no longer offered. */
+  values?: readonly { value: unknown; label: string; introducedIn: number; deprecated?: boolean }[];
   /** Present on enums whose members are ranked, so a ceiling or floor has a direction. */
   ordered?: boolean;
   minimum?: number;
@@ -666,6 +673,50 @@ export const SETTING_DEFINITIONS: Record<SettingKey, SettingDefinition> = {
     category: "playback",
     control: "switch",
   },
+  "playback.cellular_max_bitrate_kbps": {
+    key: "playback.cellular_max_bitrate_kbps",
+    type: "integer",
+    nullable: true,
+    persistence: "remote",
+    introducedIn: 20,
+    scopes: ["profile", "profile_device"],
+    scopeIntroducedIn: [20, 20],
+    resolutionOrder: ["profile_device", "profile", "default"],
+    defaultValue: 2000,
+    label: "Cellular maximum bitrate",
+    description: "Cap how much data playback may use on mobile data or another metered connection.",
+    category: "playback",
+    control: "select",
+    unit: "kbps",
+    platforms: ["ios", "android", "web"],
+    minimum: 100,
+    maximum: 200000,
+  },
+  "playback.cellular_preferred_quality": {
+    key: "playback.cellular_preferred_quality",
+    type: "enum",
+    nullable: false,
+    persistence: "remote",
+    introducedIn: 20,
+    scopes: ["profile", "profile_device"],
+    scopeIntroducedIn: [20, 20],
+    resolutionOrder: ["profile_device", "profile", "default"],
+    defaultValue: "720p",
+    label: "Cellular quality",
+    description: "The resolution to play at on mobile data or another metered connection.",
+    category: "playback",
+    control: "select",
+    platforms: ["ios", "android", "web"],
+    values: [
+      { value: "auto", label: "Auto", introducedIn: 20 },
+      { value: "480p", label: "480p", introducedIn: 20 },
+      { value: "720p", label: "720p", introducedIn: 20 },
+      { value: "1080p", label: "1080p", introducedIn: 20 },
+      { value: "2160p", label: "2160p / 4K", introducedIn: 20 },
+    ],
+    ordered: true,
+    constrainedBy: { policyInput: "max_playback_quality", constraint: "ceiling" },
+  },
   "playback.intro_skip_mode": {
     key: "playback.intro_skip_mode",
     type: "enum",
@@ -744,7 +795,7 @@ export const SETTING_DEFINITIONS: Record<SettingKey, SettingDefinition> = {
       { value: "720p", label: "720p", introducedIn: 1 },
       { value: "1080p", label: "1080p", introducedIn: 1 },
       { value: "2160p", label: "2160p / 4K", introducedIn: 1 },
-      { value: "original", label: "Original quality", introducedIn: 1 },
+      { value: "original", label: "Original quality", introducedIn: 1, deprecated: true },
     ],
     ordered: true,
     constrainedBy: { policyInput: "max_playback_quality", constraint: "ceiling" },
@@ -1099,16 +1150,17 @@ export const SETTING_DEFINITIONS: Record<SettingKey, SettingDefinition> = {
     nullable: false,
     persistence: "remote",
     introducedIn: 1,
-    scopes: ["profile_device"],
-    scopeIntroducedIn: [1],
-    resolutionOrder: ["profile_device", "default"],
+    scopes: ["profile", "profile_device"],
+    scopeIntroducedIn: [19, 1],
+    resolutionOrder: ["profile_device", "profile", "default"],
     defaultValue: 0,
     label: "Subtitle sync offset",
-    description: "Shift subtitles earlier or later on this device.",
+    description:
+      "Shift subtitles earlier or later for this profile. A device can keep its own offset.",
     category: "player",
     control: "slider",
     unit: "milliseconds",
-    platforms: ["ios", "tvos", "macos", "android", "android_tv"],
+    platforms: ["web", "ios", "tvos", "macos", "android", "android_tv"],
     minimum: -10000,
     maximum: 10000,
   },
@@ -1455,6 +1507,22 @@ export const SETTING_DEFINITIONS: Record<SettingKey, SettingDefinition> = {
       { value: "separate", label: "Separate row", introducedIn: 1 },
     ],
   },
+  "ui.next_up_new_releases_first": {
+    key: "ui.next_up_new_releases_first",
+    type: "boolean",
+    nullable: false,
+    persistence: "remote",
+    introducedIn: 18,
+    scopes: ["profile"],
+    scopeIntroducedIn: [18],
+    resolutionOrder: ["profile", "default"],
+    defaultValue: false,
+    label: "Show new episodes first",
+    description:
+      "Move a show you've caught up on to the front of Continue Watching and Next Up when a new episode or season arrives.",
+    category: "navigation",
+    control: "switch",
+  },
   "ui.remember_library_page_state": {
     key: "ui.remember_library_page_state",
     type: "boolean",
diff --git a/web/src/lib/settingsDisplay.test.ts b/web/src/lib/settingsDisplay.test.ts
index cfad6f79d2..99ae92d264 100644
--- a/web/src/lib/settingsDisplay.test.ts
+++ b/web/src/lib/settingsDisplay.test.ts
@@ -101,6 +101,13 @@ describe("settingsDisplay", () => {
 
   it("renders booleans and enum members with their contract labels", () => {
     expect(formatSettingValue(SETTING_KEYS.PLAYBACK_AUTO_SKIP_INTRO, "true")).toBe("Enabled");
+    // A stored null bandwidth cap is "No limit" even where the default is a cap.
+    expect(formatSettingValue(SETTING_KEYS.PLAYBACK_CELLULAR_MAX_BITRATE_KBPS, null)).toBe(
+      "No limit",
+    );
+    expect(formatSettingValue(SETTING_KEYS.PLAYBACK_CELLULAR_MAX_BITRATE_KBPS, "2000")).toBe(
+      "2 Mbps",
+    );
     expect(formatSettingValue(SETTING_KEYS.PLAYBACK_SUBTITLE_MODE, "always")).toBe("Always on");
   });
 
diff --git a/web/src/lib/settingsDisplay.ts b/web/src/lib/settingsDisplay.ts
index 179191971e..77de760b4e 100644
--- a/web/src/lib/settingsDisplay.ts
+++ b/web/src/lib/settingsDisplay.ts
@@ -61,17 +61,20 @@ export function isStructuredSetting(definition: SettingDisplay | null): boolean
  * Enum members come straight from the contract. Open language tags use the
  * definition's generated advisory option set. A nullable definition gains a
  * leading, context-specific unset entry so a control can express clearing it.
+ * Deprecated members stay valid stored values but are not offered.
  */
 export function optionsFor(definition: SettingDisplay): SettingOption[] {
   if (definition.type === "language_tag") {
     return languageOptionsFor(definition.key);
   }
-  const members = (definition.values ?? []).map((member) => ({
-    value: String(member.value),
-    // The manifest leaves a label empty when the member is its own label
-    // (the date formats spell themselves).
-    label: member.label || String(member.value),
-  }));
+  const members = (definition.values ?? [])
+    .filter((member) => !member.deprecated)
+    .map((member) => ({
+      value: String(member.value),
+      // The manifest leaves a label empty when the member is its own label
+      // (the date formats spell themselves).
+      label: member.label || String(member.value),
+    }));
   if (definition.nullable) {
     return [{ value: "", label: "Unset" }, ...members];
   }
@@ -104,7 +107,8 @@ export function formatSettingValue(key: string, value: string | null | undefined
   }
   if (definition.unit === "kbps") {
     // A bandwidth cap reads in Mbps like its select; no value means no cap.
-    const raw = value || defaultValueToString(definition);
+    // A stored null is "No limit" even where the default is a cap.
+    const raw = value === null ? "" : value || defaultValueToString(definition);
     const kbps = Number(raw);
     return raw && Number.isFinite(kbps) ? formatBitrateKbps(kbps) : "No limit";
   }
diff --git a/web/src/lib/themeTokens.ts b/web/src/lib/themeTokens.ts
deleted file mode 100644
index 06dffbdb17..0000000000
--- a/web/src/lib/themeTokens.ts
+++ /dev/null
@@ -1,287 +0,0 @@
-/** All CSS custom property tokens that a theme can override. */
-
-export type ThemeToken =
-  | "background"
-  | "foreground"
-  | "card"
-  | "card-foreground"
-  | "popover"
-  | "popover-foreground"
-  | "surface"
-  | "surface-hover"
-  | "surface-raised"
-  | "primary"
-  | "primary-foreground"
-  | "secondary"
-  | "secondary-foreground"
-  | "muted"
-  | "muted-foreground"
-  | "accent"
-  | "accent-foreground"
-  | "destructive"
-  | "destructive-foreground"
-  | "border"
-  | "input"
-  | "ring"
-  | "sidebar"
-  | "sidebar-foreground"
-  | "sidebar-primary"
-  | "sidebar-primary-foreground"
-  | "sidebar-accent"
-  | "sidebar-accent-foreground"
-  | "sidebar-border"
-  | "sidebar-section-divider"
-  | "sidebar-ring"
-  | "ambient"
-  | "radius"
-  | "font-body";
-
-export type TokenGroup =
-  | "Surfaces"
-  | "Interactive"
-  | "Sidebar"
-  | "Borders & Focus"
-  | "Shape & Font";
-
-export type TokenInputType = "color" | "radius" | "font";
-
-export interface TokenMeta {
-  token: ThemeToken;
-  label: string;
-  group: TokenGroup;
-  inputType: TokenInputType;
-}
-
-export const THEME_TOKENS: TokenMeta[] = [
-  // Surfaces
-  {
-    token: "background",
-    label: "Background",
-    group: "Surfaces",
-    inputType: "color",
-  },
-  {
-    token: "foreground",
-    label: "Foreground",
-    group: "Surfaces",
-    inputType: "color",
-  },
-  { token: "card", label: "Card", group: "Surfaces", inputType: "color" },
-  {
-    token: "card-foreground",
-    label: "Card Text",
-    group: "Surfaces",
-    inputType: "color",
-  },
-  { token: "popover", label: "Popover", group: "Surfaces", inputType: "color" },
-  {
-    token: "popover-foreground",
-    label: "Popover Text",
-    group: "Surfaces",
-    inputType: "color",
-  },
-  { token: "surface", label: "Surface", group: "Surfaces", inputType: "color" },
-  {
-    token: "surface-hover",
-    label: "Surface Hover",
-    group: "Surfaces",
-    inputType: "color",
-  },
-  {
-    token: "surface-raised",
-    label: "Surface Raised",
-    group: "Surfaces",
-    inputType: "color",
-  },
-
-  // Interactive
-  {
-    token: "primary",
-    label: "Primary",
-    group: "Interactive",
-    inputType: "color",
-  },
-  {
-    token: "primary-foreground",
-    label: "Primary Text",
-    group: "Interactive",
-    inputType: "color",
-  },
-  {
-    token: "secondary",
-    label: "Secondary",
-    group: "Interactive",
-    inputType: "color",
-  },
-  {
-    token: "secondary-foreground",
-    label: "Secondary Text",
-    group: "Interactive",
-    inputType: "color",
-  },
-  { token: "muted", label: "Muted", group: "Interactive", inputType: "color" },
-  {
-    token: "muted-foreground",
-    label: "Muted Text",
-    group: "Interactive",
-    inputType: "color",
-  },
-  {
-    token: "accent",
-    label: "Accent",
-    group: "Interactive",
-    inputType: "color",
-  },
-  {
-    token: "accent-foreground",
-    label: "Accent Text",
-    group: "Interactive",
-    inputType: "color",
-  },
-  {
-    token: "destructive",
-    label: "Destructive",
-    group: "Interactive",
-    inputType: "color",
-  },
-  {
-    token: "destructive-foreground",
-    label: "Destructive Text",
-    group: "Interactive",
-    inputType: "color",
-  },
-  {
-    token: "ambient",
-    label: "Ambient Glow",
-    group: "Interactive",
-    inputType: "color",
-  },
-
-  // Sidebar
-  { token: "sidebar", label: "Sidebar", group: "Sidebar", inputType: "color" },
-  {
-    token: "sidebar-foreground",
-    label: "Sidebar Text",
-    group: "Sidebar",
-    inputType: "color",
-  },
-  {
-    token: "sidebar-primary",
-    label: "Sidebar Primary",
-    group: "Sidebar",
-    inputType: "color",
-  },
-  {
-    token: "sidebar-primary-foreground",
-    label: "Sidebar Primary Text",
-    group: "Sidebar",
-    inputType: "color",
-  },
-  {
-    token: "sidebar-accent",
-    label: "Sidebar Accent",
-    group: "Sidebar",
-    inputType: "color",
-  },
-  {
-    token: "sidebar-accent-foreground",
-    label: "Sidebar Accent Text",
-    group: "Sidebar",
-    inputType: "color",
-  },
-  {
-    token: "sidebar-border",
-    label: "Sidebar Border",
-    group: "Sidebar",
-    inputType: "color",
-  },
-  {
-    token: "sidebar-section-divider",
-    label: "Sidebar Section Divider",
-    group: "Sidebar",
-    inputType: "color",
-  },
-  {
-    token: "sidebar-ring",
-    label: "Sidebar Ring",
-    group: "Sidebar",
-    inputType: "color",
-  },
-
-  // Borders & Focus
-  {
-    token: "border",
-    label: "Border",
-    group: "Borders & Focus",
-    inputType: "color",
-  },
-  {
-    token: "input",
-    label: "Input Border",
-    group: "Borders & Focus",
-    inputType: "color",
-  },
-  {
-    token: "ring",
-    label: "Focus Ring",
-    group: "Borders & Focus",
-    inputType: "color",
-  },
-
-  // Shape & Font
-  {
-    token: "radius",
-    label: "Border Radius",
-    group: "Shape & Font",
-    inputType: "radius",
-  },
-  {
-    token: "font-body",
-    label: "Font Family",
-    group: "Shape & Font",
-    inputType: "font",
-  },
-];
-
-/** Tokens grouped by category for the editor UI. */
-export const TOKEN_GROUPS: Record<TokenGroup, TokenMeta[]> = THEME_TOKENS.reduce(
-  (acc, meta) => {
-    (acc[meta.group] ??= []).push(meta);
-    return acc;
-  },
-  {} as Record<TokenGroup, TokenMeta[]>,
-);
-
-/** Token group display order. */
-export const TOKEN_GROUP_ORDER: TokenGroup[] = [
-  "Surfaces",
-  "Interactive",
-  "Sidebar",
-  "Borders & Focus",
-  "Shape & Font",
-];
-
-/** Available font families, self-hosted by fonts.css. */
-export const AVAILABLE_FONTS = ["Sora", "Fraunces", "Outfit", "Urbanist", "Manrope"];
-
-/** Read the current computed value of a CSS custom property from the DOM. */
-export function getComputedToken(token: ThemeToken): string {
-  return getComputedStyle(document.documentElement).getPropertyValue(`--${token}`).trim();
-}
-
-/** Per-token overrides layered on the Cinema Dark base, keyed by token name. */
-export type ThemeVarOverrides = Partial<Record<ThemeToken, string>>;
-
-/** Largest custom CSS the admin editor accepts. */
-export const MAX_CSS_SIZE = 64 * 1024; // 64 KB
-
-/** Parse a JSON string into a ThemeVarOverrides map. Returns empty object on failure. */
-export function parseVarsJson(raw: string | null | undefined): ThemeVarOverrides {
-  if (!raw) return {};
-  try {
-    const parsed = JSON.parse(raw);
-    return typeof parsed === "object" && parsed !== null ? parsed : {};
-  } catch {
-    return {};
-  }
-}
diff --git a/web/src/lib/userSettingsNav.ts b/web/src/lib/userSettingsNav.ts
new file mode 100644
index 0000000000..008c71fca2
--- /dev/null
+++ b/web/src/lib/userSettingsNav.ts
@@ -0,0 +1,650 @@
+import {
+  Bell,
+  Bookmark,
+  Cast,
+  Clapperboard,
+  Clock,
+  Cloud,
+  Eye,
+  KeyRound,
+  LayoutDashboard,
+  Library,
+  MonitorSmartphone,
+  PanelTop,
+  Play,
+  Server,
+  ShieldCheck,
+  Sparkles,
+  Subtitles,
+  Users,
+} from "lucide-react";
+import type { LucideIcon } from "lucide-react";
+
+export interface UserSettingsNavItem {
+  path: string;
+  label: string;
+  icon: LucideIcon;
+  description: string;
+  keywords?: readonly string[];
+  /** Every control on the page, by its visible label, so search can find it. */
+  settings?: readonly { label: string; description?: string; keywords?: readonly string[] }[];
+  primaryOrAdmin?: boolean;
+  /** Listed only while the server has requests turned on. */
+  requiresRequests?: boolean;
+}
+
+export interface UserSettingsNavGroup {
+  label: string;
+  items: UserSettingsNavItem[];
+}
+
+const settingIndex = (...labels: string[]) => labels.map((label) => ({ label }));
+
+/**
+ * Grouped by the question a person arrives with, not by which service stores
+ * the value: "how does it play", "how does it look", "what do I see", "what is
+ * it wired to", "who am I". Your Devices sits under Playback because nearly
+ * every setting on it is a device's playback override; Libraries sits with Home
+ * Screen because both decide what the app puts in front of you.
+ *
+ * Paths are stable route segments: the server links to some of them (the
+ * notification emails to `notifications`, sign-in linking to `account`, Plex
+ * sign-in to `webhook-sync`), so rename labels freely but keep paths.
+ */
+export const USER_SETTINGS_GROUPS: UserSettingsNavGroup[] = [
+  {
+    label: "Playback",
+    items: [
+      {
+        path: "playback",
+        label: "Playback",
+        icon: Play,
+        description: "Quality, skipping, and what plays next.",
+        keywords: [
+          "video quality",
+          "resolution",
+          "bitrate",
+          "bandwidth",
+          "auto skip",
+          "intro",
+          "credits",
+          "recap",
+          "auto play",
+          "preview",
+          "rewind",
+          "fast forward",
+          "fast-forward",
+          "skip",
+          "seek",
+          "seek controls",
+          "skip interval",
+          "audiobook skip",
+        ],
+        settings: settingIndex(
+          "Preferred quality",
+          "Maximum bitrate",
+          "Skip intros",
+          "Auto-skip recaps",
+          "Auto-skip credits",
+          "Start next at preview",
+          "Auto-play next episode",
+          "Seek controls",
+          "Rewind interval",
+          "Fast-forward interval",
+          "Use this browser's audiobook intervals",
+        ),
+      },
+      {
+        path: "subtitle-appearance",
+        label: "Language & Subtitles",
+        icon: Subtitles,
+        description: "Preferred languages, when subtitles appear, and how they look.",
+        keywords: [
+          "language",
+          "audio language",
+          "spoken language",
+          "audio track",
+          "metadata language",
+          "translation",
+          "subtitles",
+          "subtitle language",
+          "forced subtitles",
+          "captions",
+          "font size",
+          "font color",
+          "background",
+          "position",
+          "timing",
+          "subtitle delay",
+        ],
+        settings: settingIndex(
+          "Spoken language",
+          "Metadata language",
+          "Add exception",
+          "Subtitle language",
+          "Subtitle behavior",
+          "Show forced subtitles",
+          "Preview",
+          "Save appearance",
+          "Discard changes",
+          "Font size",
+          "Font family",
+          "Font color",
+          "Text opacity",
+          "Text outline",
+          "Outline color",
+          "Background style",
+          "Background opacity",
+          "Background color",
+          "Subtitle position",
+          "Subtitle offset",
+        ),
+      },
+      {
+        path: "devices",
+        label: "Your Devices",
+        icon: MonitorSmartphone,
+        description:
+          "Override playback, subtitles, and episode behavior on one device, and choose the profile this browser opens.",
+        keywords: [
+          "devices",
+          "tv",
+          "phone",
+          "tablet",
+          "browser",
+          "this device",
+          "forget device",
+          "hdr",
+          "dolby vision",
+          "sound delay",
+          "lip sync",
+          "who's watching",
+          "profile picker",
+          "remember profile",
+          "launch",
+          "override",
+        ],
+        settings: settingIndex(
+          "Profile at launch",
+          "Remember last profile",
+          "Ask who's watching",
+          "Use profile settings",
+          "Forget",
+          "Preferred quality",
+          "Maximum bitrate",
+          "HDR",
+          "Dolby Vision",
+          "Dolby Vision Profile 7 fallback",
+          "Match content frame rate",
+          "Video sizing",
+          "Screen orientation",
+          "Preferred audio language",
+          "Theme music",
+          "Audio sync offset",
+          "Playback speed",
+          "Preferred subtitle language",
+          "Subtitle appearance",
+          "Subtitle sync offset",
+          "Skip intros",
+          "Auto-play next",
+          "Preview next episode",
+          "Default sleep timer",
+          "Show title art",
+        ),
+      },
+    ],
+  },
+  {
+    label: "Appearance",
+    items: [
+      {
+        path: "interface",
+        label: "Navigation & Cards",
+        icon: PanelTop,
+        description: "Poster size, captions, shortcuts and badges on posters, and your menu.",
+        keywords: [
+          "navigation",
+          "menu",
+          "pin library",
+          "poster size",
+          "card size",
+          "caption",
+          "hide title",
+          "hide year",
+          "artwork only",
+          "poster",
+          "badges",
+          "overlay",
+          "card overlays",
+          "accent color",
+          "corner",
+          "position",
+          "quick actions",
+          "favorite",
+          "watched",
+          "server defaults",
+        ],
+        settings: settingIndex(
+          "Preview",
+          "Posters",
+          "Size",
+          "Under each poster",
+          "Title and details",
+          "Title only",
+          "Shortcuts",
+          "Badges",
+          "Show badges on posters",
+          "Style",
+          "Media Info",
+          "Ratings & Certifications",
+          "Content Metadata",
+          "Status & Awards",
+          "Adjust",
+          "Corner",
+          "Color",
+          "Show icon",
+          "Menu",
+          "Add a link",
+          "Reset",
+        ),
+      },
+      {
+        path: "title-pages",
+        label: "Title Pages",
+        icon: Clapperboard,
+        description: "Title art, theme music, spoilers, and age guidance on movie and show pages.",
+        keywords: [
+          "title art",
+          "logo",
+          "clearlogo",
+          "theme music",
+          "detail page",
+          "spoilers",
+          "blur",
+          "unwatched",
+          "advisory age",
+          "age rating",
+          "common sense media",
+        ],
+        settings: settingIndex(
+          "Show title art",
+          "Apply to all devices",
+          "Theme music",
+          "Loop theme music",
+          "Blur unwatched episode images",
+          "Hide unwatched episode descriptions",
+          "Show advisory age",
+        ),
+      },
+      {
+        path: "accessibility",
+        label: "Accessibility",
+        icon: Eye,
+        description: "Text size, weight, contrast, and date and time formats.",
+        keywords: [
+          "contrast",
+          "readability",
+          "text",
+          "date format",
+          "time format",
+          "clock",
+          "24-hour",
+          "12-hour",
+        ],
+        settings: settingIndex(
+          "Text size",
+          "Text weight",
+          "Contrast",
+          "High Contrast",
+          "Preview",
+          "Date & time",
+          "Date format",
+          "Time format",
+        ),
+      },
+    ],
+  },
+  {
+    label: "Home & Discovery",
+    items: [
+      {
+        path: "home-screen",
+        label: "Home Screen",
+        icon: LayoutDashboard,
+        description: "The rows on Home and each library page, and what they hold.",
+        keywords: [
+          "home rows",
+          "sections",
+          "rows",
+          "continue watching",
+          "next up",
+          "library pages",
+          "hero banner",
+        ],
+        settings: settingIndex(
+          "Home rows",
+          "Add row",
+          "Hide watched items",
+          "Next up episodes",
+          "Export layout",
+          "Import layout",
+          "Reset Home",
+          "Continue Watching",
+          "Next Up",
+          "Recently Added",
+        ),
+      },
+      {
+        path: "libraries",
+        label: "Libraries",
+        icon: Library,
+        description: "Which libraries you see, their order, and per-library languages.",
+        keywords: [
+          "library visibility",
+          "access",
+          "disabled libraries",
+          "library order",
+          "playback preferences",
+        ],
+        settings: settingIndex(
+          "Remember library pages",
+          "Library visibility",
+          "Visible in navigation",
+          "Show all",
+          "Hide all",
+          "Library order",
+          "Spoken language",
+          "Subtitle language",
+          "Subtitle behavior",
+          "Forced subtitles",
+          "Playback preferences",
+        ),
+      },
+      {
+        path: "personalize",
+        label: "Personalize",
+        icon: Sparkles,
+        description: "Re-tune the taste profile behind your recommendations.",
+        keywords: [
+          "taste profile",
+          "recommendations",
+          "ratings",
+          "likes",
+          "dislikes",
+          "not interested",
+          "hidden",
+          "tour",
+        ],
+        settings: settingIndex(
+          "Refine your taste profile",
+          "Taste profile",
+          "Recommendations",
+          "Not interested",
+          "Replay the feature tour",
+        ),
+      },
+      {
+        path: "requests",
+        label: "Requests",
+        icon: Bookmark,
+        description: "Whether adding to your watchlist also requests the title.",
+        keywords: ["watchlist", "request", "discover", "auto request"],
+        settings: settingIndex("Request titles I add to my watchlist"),
+        requiresRequests: true,
+      },
+    ],
+  },
+  {
+    label: "Connections",
+    items: [
+      {
+        path: "connect-apps",
+        label: "Connect Apps",
+        icon: Cast,
+        description: "Sign-in details for Prairie and Jellyfin-compatible apps.",
+        keywords: [
+          "jellyfin",
+          "infuse",
+          "swiftfin",
+          "jellycon",
+          "findroid",
+          "compatibility",
+          "sign in",
+          "login",
+          "server address",
+          "username",
+          "pin",
+        ],
+        settings: settingIndex(
+          "Prairie app or website",
+          "Jellyfin-compatible app",
+          "Server",
+          "Username",
+          "Password",
+          "Which profile are you signing in as?",
+          "A Jellyfin app says my username or password is wrong",
+          "Every profile at a glance",
+        ),
+      },
+      {
+        path: "quick-connect",
+        label: "Quick Connect",
+        icon: MonitorSmartphone,
+        description: "Approve sign-in on another device",
+        keywords: [
+          "quick connect",
+          "pair device",
+          "device login",
+          "tv login",
+          "roku",
+          "smart tv",
+          "approve",
+          "code",
+          "qr",
+        ],
+        settings: settingIndex(
+          "Enter device code",
+          "Approve sign-in",
+          "Match code",
+          "How it works",
+        ),
+      },
+      {
+        path: "watch-providers",
+        label: "Watch Providers",
+        icon: Cloud,
+        description: "Sync watch history, ratings, and watchlists with services like Simkl.",
+        keywords: [
+          "simkl",
+          "import",
+          "export",
+          "scrobble",
+          "favorites",
+          "watch history",
+          "watchlist",
+          "ratings",
+        ],
+        settings: settingIndex(
+          "Last imported",
+          "Last exported",
+          "Watched",
+          "Progress",
+          "Favorites",
+          "Watchlist",
+          "Ratings",
+          "Exported",
+          "Import watched history",
+          "Import paused progress",
+          "Send watched changes",
+          "Send unwatched changes",
+          "Sync favorites",
+          "Sync favorite removals",
+          "Sync watchlist",
+          "Mirror watchlist order",
+          "Import ratings",
+          "Send ratings",
+          "Sync dropped shows",
+          "Scrobble playback",
+        ),
+      },
+      {
+        path: "webhook-sync",
+        label: "Webhook Sync",
+        icon: Server,
+        description: "Take watch progress from Plex, Emby, and Jellyfin as it happens.",
+        keywords: ["plex", "emby", "jellyfin", "webhook", "progress", "watched", "live"],
+        settings: settingIndex(
+          "Add a connection",
+          "Connected servers",
+          "Webhook URL",
+          "Default profile",
+          "Profile mapping",
+          "Recent deliveries",
+          "Plex",
+          "Emby",
+          "Jellyfin",
+        ),
+      },
+      {
+        path: "history-import",
+        label: "History Import",
+        icon: Clock,
+        description:
+          "Copy watch history, watchlist, and favorites from Emby, Plex, or Jellyfin once.",
+        keywords: ["emby", "plex", "jellyfin", "watched history", "import", "mapping", "migrate"],
+        settings: settingIndex(
+          "New import",
+          "Import into profile",
+          "Start import",
+          "Latest import",
+          "Import history",
+          "Fetched",
+          "Matched",
+          "Unmatched",
+          "Skipped",
+        ),
+      },
+    ],
+  },
+  {
+    label: "Account",
+    items: [
+      {
+        path: "notifications",
+        label: "Notifications",
+        icon: Bell,
+        description: "New-episode alerts by email, Discord, push, or webhook.",
+        keywords: ["new episodes", "email", "discord", "browser push", "webhooks", "alerts"],
+        settings: settingIndex(
+          "New Episode Notifications",
+          "Favorites",
+          "Watchlist",
+          "Continue Watching",
+          "Next Up",
+          "Browser Notifications",
+          "Email Notifications",
+          "Deliver to",
+          "Frequency",
+          "Digest",
+          "Discord Notifications",
+          "Webhooks",
+          "Webhook URL",
+        ),
+      },
+      {
+        path: "profiles",
+        label: "Profiles",
+        icon: Users,
+        description: "Household profiles, their PINs, and what each may watch.",
+        keywords: [
+          "profile name",
+          "pin",
+          "access",
+          "primary profile",
+          "household",
+          "kids",
+          "parental controls",
+        ],
+        settings: settingIndex(
+          "New profile",
+          "Profile name",
+          "PIN",
+          "Kids profile",
+          "Maximum content rating",
+          "Maximum advisory age",
+          "Maximum playback quality",
+          "Restrict libraries",
+          "Active streams",
+          "Delete profile",
+          "Primary profile",
+        ),
+        primaryOrAdmin: true,
+      },
+      {
+        path: "account",
+        label: "Account",
+        icon: KeyRound,
+        description: "The password and sign-in providers every household profile shares.",
+        keywords: ["password", "credential", "sign in", "security", "account", "sso"],
+        settings: settingIndex(
+          "Current password",
+          "New password",
+          "Confirm new password",
+          "Change password",
+          "Sign-in",
+          "Connect",
+          "Disconnect",
+        ),
+        primaryOrAdmin: true,
+      },
+      {
+        path: "sessions",
+        label: "Signed-in sessions",
+        icon: ShieldCheck,
+        description: "See where your account is signed in, and sign out a browser or app.",
+        primaryOrAdmin: true,
+        keywords: [
+          "sessions",
+          "active",
+          "client",
+          "device",
+          "last seen",
+          "sign out",
+          "revoke",
+          "security",
+        ],
+        settings: settingIndex(
+          "Active sign-ins",
+          "This browser",
+          "Other signed-in sessions",
+          "Sign out everywhere",
+        ),
+      },
+    ],
+  },
+];
+
+export interface UserSettingsNavAccess {
+  /** Admins and primary profiles manage the household's sign-in and profiles. */
+  canManageProfiles: boolean;
+  /** Whether the server has requests turned on. */
+  requestsEnabled: boolean;
+}
+
+/** The groups this profile can open, with empty groups dropped. */
+export function visibleUserSettingsGroups({
+  canManageProfiles,
+  requestsEnabled,
+}: UserSettingsNavAccess): UserSettingsNavGroup[] {
+  return USER_SETTINGS_GROUPS.map((group) => ({
+    ...group,
+    items: group.items.filter(
+      (item) =>
+        (!item.primaryOrAdmin || canManageProfiles) && (!item.requiresRequests || requestsEnabled),
+    ),
+  })).filter((group) => group.items.length > 0);
+}
+
+export function userSettingsHref(path: string): string {
+  return `/settings/${path}`;
+}
diff --git a/web/src/pages/AdminAccessGroups.test.tsx b/web/src/pages/AdminAccessGroups.test.tsx
index e6b60e855e..2fd0c83548 100644
--- a/web/src/pages/AdminAccessGroups.test.tsx
+++ b/web/src/pages/AdminAccessGroups.test.tsx
@@ -71,6 +71,7 @@ const GROUP = {
   max_transcodes: 0,
   max_remote_stream_bitrate_kbps: 0,
   max_local_stream_bitrate_kbps: 0,
+  max_profiles: 5,
   allowed_permissions: [] as string[],
   requests_allowed: false,
   is_default: true,
@@ -593,6 +594,23 @@ describe("AdminAccessGroups", () => {
     expect(dialog).not.toHaveTextContent("This group has no members");
   });
 
+  it("saves the group's profile limit and won't save one below 1", async () => {
+    const user = userEvent.setup();
+    renderPage();
+    fireEvent.click(await screen.findByRole("button", { name: /Kids/ }));
+    const limit = await screen.findByRole("spinbutton", { name: "Max profiles" });
+    expect(limit).toHaveValue(5);
+    await user.clear(limit);
+    await user.type(limit, "0");
+    expect(screen.getByRole("button", { name: "Save changes" })).toBeDisabled();
+    await user.clear(limit);
+    await user.type(limit, "3");
+    fireEvent.click(screen.getByRole("button", { name: "Save changes" }));
+    await waitFor(() => {
+      expect(putBody).toMatchObject({ max_profiles: 3 });
+    });
+  });
+
   it("saves a custom Mbps bitrate limit as whole kbps", async () => {
     const user = userEvent.setup();
     renderPage();
diff --git a/web/src/pages/AdminAccessGroups.tsx b/web/src/pages/AdminAccessGroups.tsx
index 7e28f9b628..b8c922264f 100644
--- a/web/src/pages/AdminAccessGroups.tsx
+++ b/web/src/pages/AdminAccessGroups.tsx
@@ -16,6 +16,7 @@ import type { AccessGroup, AccessGroupInput } from "@/api/types";
 import { EditorConflict } from "@/components/admin/EditorConflict";
 import { RequestLimitFields } from "@/components/admin/RequestLimitFields";
 import { LibraryAccessSelector } from "@/components/LibraryAccessSelector";
+import { PageHeader } from "@/components/page/PageHeader";
 import { StreamBitrateLimitInput } from "@/components/StreamBitrateLimitInput";
 import {
   AlertDialog,
@@ -67,6 +68,7 @@ import {
   resolveRequestTerms,
 } from "@/lib/requestAccess";
 import { useStagedDraft } from "@/pages/admin-settings/useStagedDraft";
+import { parseWholeNumber } from "@/pages/admin-users/detail/access/policySources";
 import {
   PLAYBACK_QUALITY_OPTIONS,
   playbackQualityPresetFromValue,
@@ -118,6 +120,7 @@ function storedGroupBody(group: AccessGroup): AccessGroupInput {
     max_transcodes: group.max_transcodes,
     max_remote_stream_bitrate_kbps: group.max_remote_stream_bitrate_kbps,
     max_local_stream_bitrate_kbps: group.max_local_stream_bitrate_kbps,
+    max_profiles: group.max_profiles,
     allowed_permissions: group.allowed_permissions,
     requests_allowed: group.requests_allowed,
     is_default: group.is_default,
@@ -230,7 +233,7 @@ function AccessGroupsPage() {
 
   if (selected && available) {
     return (
-      <div className="page-shell space-y-6 py-4 sm:py-6">
+      <div className="space-y-6 pb-4 sm:pb-6">
         <Button
           type="button"
           variant="ghost"
@@ -258,23 +261,20 @@ function AccessGroupsPage() {
   }
 
   return (
-    <div className="page-shell space-y-6 py-4 sm:py-6">
-      <div className="page-header gap-5">
-        <div className="space-y-3">
-          <h1 className="page-title text-[clamp(2rem,4vw,3rem)]">Access Groups</h1>
-          <p className="page-subtitle text-sm sm:text-base">
-            The shared policy layer for a set of users. A group supplies the value for every field
-            its members leave on Inherit; a per-user override replaces the group value in either
-            direction.
-          </p>
-        </div>
-        {!creating && available && (
-          <Button type="button" onClick={() => setCreating(true)}>
-            <Plus className="size-4" />
-            New group
-          </Button>
-        )}
-      </div>
+    <div className="space-y-6 pb-4 sm:pb-6">
+      <PageHeader
+        title="Access Groups"
+        subtitle="The shared policy layer for a set of users. A group supplies the value for every field its members leave on Inherit; a per-user override replaces the group value in either direction."
+        actions={
+          !creating &&
+          available && (
+            <Button type="button" onClick={() => setCreating(true)}>
+              <Plus className="size-4" />
+              New group
+            </Button>
+          )
+        }
+      />
 
       {!available && <p role="status">Access group editing is unavailable.</p>}
       {error && <p role="alert">{error}</p>}
@@ -479,6 +479,9 @@ function AccessGroupEditor({ initialEditor, onSaved, onDeleted }: AccessGroupEdi
   );
   const bitrateLimitsValid =
     maxRemoteStreamBitrateKbps !== null && maxLocalStreamBitrateKbps !== null;
+  // Kept as typed so a cleared box is an unsaved edit; Save waits for a valid limit.
+  const [maxProfilesText, setMaxProfilesText] = useState(String(group.max_profiles));
+  const maxProfiles = parseWholeNumber(maxProfilesText, 1);
   const [permissions, setPermissions] = useState<string[] | null>(group.allowed_permissions);
   const [requestsAllowed, setRequestsAllowed] = useState(group.requests_allowed);
   const [isDefault, setIsDefault] = useState(group.is_default);
@@ -521,7 +524,12 @@ function AccessGroupEditor({ initialEditor, onSaved, onDeleted }: AccessGroupEdi
 
   async function save() {
     if (busy.current || conflict || limitBlocksSave) return;
-    if (maxRemoteStreamBitrateKbps === null || maxLocalStreamBitrateKbps === null) return;
+    if (
+      maxRemoteStreamBitrateKbps === null ||
+      maxLocalStreamBitrateKbps === null ||
+      maxProfiles === null
+    )
+      return;
     busy.current = true;
     setError("");
     setLimitError("");
@@ -540,6 +548,7 @@ function AccessGroupEditor({ initialEditor, onSaved, onDeleted }: AccessGroupEdi
       max_transcodes: maxTranscodes,
       max_remote_stream_bitrate_kbps: maxRemoteStreamBitrateKbps,
       max_local_stream_bitrate_kbps: maxLocalStreamBitrateKbps,
+      max_profiles: maxProfiles,
       allowed_permissions: permissions,
       requests_allowed: requestsAllowed,
       is_default: isDefault,
@@ -803,6 +812,32 @@ function AccessGroupEditor({ initialEditor, onSaved, onDeleted }: AccessGroupEdi
         />
       </section>
 
+      <section className="surface-panel space-y-2 rounded-2xl border-0 p-5">
+        <h2 className="text-sm font-semibold">Profiles</h2>
+        <div className="grid gap-4 sm:grid-cols-2">
+          <div className="space-y-2">
+            <div className="flex items-baseline justify-between">
+              <Label htmlFor="group-profiles">Max profiles</Label>
+              <span className="text-muted-foreground text-xs">At least 1</span>
+            </div>
+            <Input
+              id="group-profiles"
+              type="number"
+              inputMode="numeric"
+              min={1}
+              step={1}
+              value={maxProfilesText}
+              aria-invalid={maxProfiles === null ? true : undefined}
+              onChange={(event) => setMaxProfilesText(event.target.value)}
+            />
+          </div>
+        </div>
+        <p className="text-muted-foreground text-xs">
+          Each member account can have up to this many profiles, unless the account sets its own
+          limit. Existing profiles over a lowered limit are kept.
+        </p>
+      </section>
+
       <section className="surface-panel space-y-3 rounded-2xl border-0 p-5">
         <div className="flex items-center justify-between">
           <div>
@@ -867,6 +902,7 @@ function AccessGroupEditor({ initialEditor, onSaved, onDeleted }: AccessGroupEdi
             conflict ||
             reloading ||
             !bitrateLimitsValid ||
+            maxProfiles === null ||
             limitBlocksSave
           }
         >
diff --git a/web/src/pages/AdminActivity.test.tsx b/web/src/pages/AdminActivity.test.tsx
index 3bfc98b017..2196af1eae 100644
--- a/web/src/pages/AdminActivity.test.tsx
+++ b/web/src/pages/AdminActivity.test.tsx
@@ -105,6 +105,26 @@ function renderActivity() {
   );
 }
 
+describe("stacked stream sorting", () => {
+  it("sorts the stacked rows, which have no column headers", () => {
+    mocks.sessions = [
+      makeSession({ session_id: "a", username: "Alpha", started_at: "2026-01-01T12:00:00Z" }),
+      makeSession({ session_id: "b", username: "Bravo", started_at: "2026-01-01T13:00:00Z" }),
+    ];
+    renderActivity();
+    const order = () => [
+      ...new Set(screen.getAllByText(/^(Alpha|Bravo)$/).map((el) => el.textContent)),
+    ];
+    const sort = screen.getByRole("group", { name: "Sort streams" });
+
+    expect(order()).toEqual(["Bravo", "Alpha"]);
+    fireEvent.click(within(sort).getByRole("button", { name: "User" }));
+    expect(order()).toEqual(["Alpha", "Bravo"]);
+    fireEvent.click(within(sort).getByRole("button", { name: /User/ }));
+    expect(order()).toEqual(["Bravo", "Alpha"]);
+  });
+});
+
 describe("activity playback scopes", () => {
   beforeEach(() => {
     mocks.sessions = [makeSession()];
diff --git a/web/src/pages/AdminActivity.tsx b/web/src/pages/AdminActivity.tsx
index 340e4e49ce..71ad81e63a 100644
--- a/web/src/pages/AdminActivity.tsx
+++ b/web/src/pages/AdminActivity.tsx
@@ -3,6 +3,7 @@ import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { Link, Navigate, useSearchParams } from "react-router";
 import { AdminSessionActions } from "@/components/AdminSessionActions";
 import { JellyfinSessionPill } from "@/components/JellyfinSessionPill";
+import { PageHeader } from "@/components/page/PageHeader";
 import { PlaybackRouteBadges } from "@/components/PlaybackRouteBadges";
 import { useRealtimeEvents } from "@/components/realtimeEventsContext";
 import { useOperationalLogs } from "@/hooks/queries/admin/logs";
@@ -67,6 +68,21 @@ type SortDir = "asc" | "desc";
 
 const REFRESH_SPINNER_MIN_VISIBLE_MS = 1_000;
 
+// The stream table's header and rows share one column template, whose minimums
+// add up to 977px plus 4rem of gaps and padding (1041px at a 16px root font,
+// 1057px at 20px). Keep the spacing in rem in the container breakpoint so larger
+// fonts show stacked rows until the columns fit, regardless of sidebar width.
+const STREAM_TABLE_COLUMNS =
+  "grid-cols-[minmax(120px,1.1fr)_minmax(190px,1.7fr)_minmax(220px,1.9fr)_minmax(90px,0.8fr)_minmax(125px,0.9fr)_minmax(232px,1.4fr)]";
+
+const STACKED_SORT_FIELDS: [SortField, string][] = [
+  ["username", "User"],
+  ["media", "Stream"],
+  ["method", "Playback"],
+  ["node", "Route"],
+  ["started", "Time"],
+];
+
 function routeSortValue(session: AdminSession): string {
   return getSessionRouteNodes(session)
     .map((node) => `${node.label} ${node.name}`)
@@ -243,49 +259,48 @@ export default function AdminActivity() {
   if (searchParams.get("view") === "preparations") {
     return <Navigate to="/admin/downloads?tab=preparation" replace />;
   }
-  if (isLoading) return <div className="text-muted-foreground p-8">Loading activity...</div>;
+  if (isLoading) return <div className="text-muted-foreground pb-8">Loading activity...</div>;
 
   return (
     <div className="space-y-5 lg:space-y-6">
-      {/* Header */}
-      <div className="page-header">
-        <div className="space-y-3">
-          <div className="flex items-center gap-3">
-            <h1 className="page-title text-[clamp(2rem,4vw,3.25rem)]">Activity</h1>
+      <PageHeader
+        title="Activity"
+        subtitle={
+          sessions.length === 0
+            ? "No active streams"
+            : `${sessions.length} active stream${sessions.length !== 1 ? "s" : ""} across ${routeNodes.length} node${routeNodes.length !== 1 ? "s" : ""}`
+        }
+        actions={
+          <>
             {sessions.length > 0 && (
               <span className="live-badge flex items-center gap-1.5">
                 <Radio className="h-3 w-3" />
                 {sessions.length} live
               </span>
             )}
-          </div>
-          <p className="page-subtitle text-sm sm:text-base">
-            {sessions.length === 0
-              ? "No active streams"
-              : `${sessions.length} active stream${sessions.length !== 1 ? "s" : ""} across ${routeNodes.length} node${routeNodes.length !== 1 ? "s" : ""}`}
-          </p>
-        </div>
-        <div className="flex items-center gap-1.5">
-          <Button
-            variant="outline"
-            size="sm"
-            className="min-w-[8.25rem] justify-center"
-            onClick={() => void refreshActivity({ manual: true })}
-            disabled={isManualRefreshPending}
-            aria-busy={isManualRefreshPending}
-          >
-            <RefreshCw className={`h-3.5 w-3.5 ${isManualRefreshPending ? "animate-spin" : ""}`} />
-            {isManualRefreshPending ? "Refreshing..." : "Refresh"}
-          </Button>
-          <div className="min-w-[8.75rem] px-1 text-right">
-            <div className="text-muted-foreground text-[10px] font-semibold tracking-wider uppercase">
-              Realtime Updates
+            <Button
+              variant="outline"
+              size="sm"
+              className="min-w-[8.25rem] justify-center"
+              onClick={() => void refreshActivity({ manual: true })}
+              disabled={isManualRefreshPending}
+              aria-busy={isManualRefreshPending}
+            >
+              <RefreshCw
+                className={`h-3.5 w-3.5 ${isManualRefreshPending ? "animate-spin" : ""}`}
+              />
+              {isManualRefreshPending ? "Refreshing..." : "Refresh"}
+            </Button>
+            <div className="min-w-[8.75rem] px-1 text-right">
+              <div className="text-muted-foreground text-[10px] font-semibold tracking-wider uppercase">
+                Realtime Updates
+              </div>
+              <div className="text-[12px]">{formatConnectionState(connectionState)}</div>
+              {error && <div className="text-muted-foreground text-[11px]">{error}</div>}
             </div>
-            <div className="text-[12px]">{formatConnectionState(connectionState)}</div>
-            {error && <div className="text-muted-foreground text-[11px]">{error}</div>}
-          </div>
-        </div>
-      </div>
+          </>
+        }
+      />
 
       {/* IP Lookup */}
       <details
@@ -525,9 +540,33 @@ export default function AdminActivity() {
       {filtered.length === 0 ? (
         <EmptyState hasData={sessions.length > 0} />
       ) : (
-        <div className="bg-card border-border overflow-hidden rounded-lg border">
+        <div className="bg-card border-border @container overflow-hidden rounded-lg border">
+          {/* Sort controls for the stacked rows, which have no column headers */}
+          <div
+            role="group"
+            aria-label="Sort streams"
+            className="border-border bg-surface/50 flex flex-wrap items-center gap-x-4 gap-y-1.5 border-b px-4 py-2.5 @min-[calc(977px+4rem)]:hidden"
+          >
+            <span className="text-muted-foreground/70 text-[10px] font-semibold tracking-wider uppercase">
+              Sort
+            </span>
+            {STACKED_SORT_FIELDS.map(([field, label]) => (
+              <SortHeader
+                key={field}
+                field={field}
+                current={sortField}
+                dir={sortDir}
+                onClick={toggleSort}
+              >
+                {label}
+              </SortHeader>
+            ))}
+          </div>
+
           {/* Table header */}
-          <div className="border-border bg-surface/50 hidden grid-cols-[minmax(120px,1.1fr)_minmax(190px,1.7fr)_minmax(220px,1.9fr)_minmax(90px,0.8fr)_minmax(125px,0.9fr)_minmax(220px,1.4fr)] items-center gap-2 border-b px-3 py-2.5 sm:grid">
+          <div
+            className={`border-border bg-surface/50 hidden ${STREAM_TABLE_COLUMNS} items-center gap-2 border-b px-3 py-2.5 @min-[calc(977px+4rem)]:grid`}
+          >
             <SortHeader field="username" current={sortField} dir={sortDir} onClick={toggleSort}>
               User
             </SortHeader>
@@ -652,7 +691,9 @@ function StreamRow({
       }`}
     >
       {/* Desktop row */}
-      <div className="hidden grid-cols-[minmax(120px,1.1fr)_minmax(190px,1.7fr)_minmax(220px,1.9fr)_minmax(90px,0.8fr)_minmax(125px,0.9fr)_minmax(220px,1.4fr)] items-center gap-2 px-3 py-2.5 sm:grid">
+      <div
+        className={`hidden ${STREAM_TABLE_COLUMNS} items-center gap-2 px-3 py-2.5 @min-[calc(977px+4rem)]:grid`}
+      >
         {/* User */}
         <div className="flex min-w-0 items-center gap-2">
           <Link to={userHref} className="hover:text-primary shrink-0 transition-colors">
@@ -835,7 +876,7 @@ function StreamRow({
       </div>
 
       {/* Mobile row */}
-      <div className="flex gap-3 px-4 py-3 sm:hidden">
+      <div className="flex gap-3 px-4 py-3 @min-[calc(977px+4rem)]:hidden">
         <Link
           to={userHref}
           className="text-primary-foreground flex h-7 w-7 flex-shrink-0 items-center justify-center rounded-full text-[10px] font-bold"
diff --git a/web/src/pages/AdminApiKeys.tsx b/web/src/pages/AdminApiKeys.tsx
index 273d77b803..23a539ba73 100644
--- a/web/src/pages/AdminApiKeys.tsx
+++ b/web/src/pages/AdminApiKeys.tsx
@@ -19,6 +19,7 @@ import {
 } from "@/api/v2/adminApiKeys";
 import { isCapturedProfileAuthorityActive } from "@/api/client";
 import { V2ProblemError } from "@/api/v2/request";
+import { PageHeader } from "@/components/page/PageHeader";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
@@ -126,23 +127,21 @@ function ApiKeyManager() {
     }
   }
   return (
-    <div className="page-shell flex flex-col gap-6 py-4 sm:py-6">
-      <div className="page-header gap-5">
-        <div className="flex flex-col gap-3">
-          <h1 className="page-title">API Keys</h1>
-          <p className="page-subtitle">
-            Create and manage credentials for integrations and automation.
-          </p>
-        </div>
-        <Button
-          size="sm"
-          disabled={!capability.data?.available}
-          onClick={() => setCreateOpen(true)}
-        >
-          <Plus data-icon="inline-start" />
-          Create Key
-        </Button>
-      </div>
+    <div className="space-y-6 pb-4 sm:pb-6">
+      <PageHeader
+        title="API Keys"
+        subtitle="Create and manage credentials for integrations and automation."
+        actions={
+          <Button
+            size="sm"
+            disabled={!capability.data?.available}
+            onClick={() => setCreateOpen(true)}
+          >
+            <Plus data-icon="inline-start" />
+            Create Key
+          </Button>
+        }
+      />
       {capability.isPending ? (
         <p role="status">Checking API key management…</p>
       ) : capability.isError ? (
diff --git a/web/src/pages/AdminAutoscan.tsx b/web/src/pages/AdminAutoscan.tsx
index 167db77d22..1d2e35908a 100644
--- a/web/src/pages/AdminAutoscan.tsx
+++ b/web/src/pages/AdminAutoscan.tsx
@@ -1,158 +1,39 @@
-import {
-  captureProfileRequestContext,
-  isCapturedProfileAuthorityActive,
-  type ProfileRequestContextSnapshot,
-} from "@/api/client";
-import { useState } from "react";
-import { useSearchParams } from "react-router";
-import { ChevronDown, ChevronRight, Play } from "lucide-react";
-import type { AutoscanSettings } from "@/api/types";
+import { captureProfileRequestContext, isCapturedProfileAuthorityActive } from "@/api/client";
+import { Navigate, useLocation } from "react-router";
+import { Play } from "lucide-react";
+import { PageHeader } from "@/components/page/PageHeader";
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
-import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
 import { Switch } from "@/components/ui/switch";
-import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
 import {
   useAutoscanSettings,
   useAutoscanSources,
   useTriggerAutoscan,
   useUpdateAutoscanSettings,
 } from "@/hooks/queries/useAutoscan";
-import ConnectionsPanel from "@/pages/admin/autoscan/ConnectionsPanel";
-import ActivityPanel from "@/pages/admin/autoscan/ActivityPanel";
 import SourcesPanel from "@/pages/admin/autoscan/SourcesPanel";
 import { showRunNow } from "@/pages/admin/autoscan/runNow";
-import { isLegacyAdvancedTab, normalizeTab } from "@/pages/autoscanSearchParams";
-
-// ---------------------------------------------------------------------------
-// Settings tab
-// ---------------------------------------------------------------------------
-
-function SettingsTab() {
-  const settings = useAutoscanSettings();
-  const readAuthority = captureProfileRequestContext();
-  const updateSettings = useUpdateAutoscanSettings();
-
-  const [form, setForm] = useState<{
-    value: AutoscanSettings;
-    authority: ProfileRequestContextSnapshot;
-  } | null>(null);
-  const activeForm = form && isCapturedProfileAuthorityActive(form.authority) ? form : null;
-  const effective = activeForm?.value ?? settings.data;
-  function patch(delta: Partial<AutoscanSettings>) {
-    const authority = captureProfileRequestContext();
-    if (
-      !authority ||
-      !effective ||
-      !readAuthority ||
-      !isCapturedProfileAuthorityActive(readAuthority)
-    )
-      return;
-    setForm({ value: { ...effective, ...delta }, authority });
-  }
-  function save() {
-    if (
-      !effective ||
-      updateSettings.isPending ||
-      !settings.data ||
-      !readAuthority ||
-      !isCapturedProfileAuthorityActive(readAuthority) ||
-      (activeForm && !isCapturedProfileAuthorityActive(activeForm.authority))
-    )
-      return;
-    const captured = activeForm;
-    updateSettings.mutate(
-      { ...effective },
-      { onSuccess: () => setForm((current) => (current === captured ? null : current)) },
-    );
-  }
-
-  if (settings.isLoading) {
-    return <p className="text-muted-foreground py-4 text-sm">Loading settings…</p>;
-  }
-
-  if (!effective || settings.isError)
-    return <p role="alert">Autoscan settings could not be loaded. Reload before editing.</p>;
-
-  return (
-    <div className="max-w-lg space-y-6">
-      {/* Default poll interval */}
-      <div className="space-y-1.5">
-        <Label htmlFor="default-poll-interval">Default check interval (seconds)</Label>
-        <div className="flex items-center gap-2">
-          <Input
-            id="default-poll-interval"
-            className="w-32"
-            type="number"
-            min={1}
-            value={effective.default_poll_interval_seconds}
-            onChange={(e) =>
-              patch({
-                default_poll_interval_seconds: Number(e.target.value) || 300,
-              })
-            }
-          />
-          <span className="text-muted-foreground text-sm">sec</span>
-        </div>
-        <p className="text-muted-foreground text-xs">
-          Used by sources that don&apos;t set their own.
-        </p>
-      </div>
-
-      {/* Debounce */}
-      <div className="space-y-1.5">
-        <Label htmlFor="debounce-seconds">Debounce (seconds)</Label>
-        <div className="flex items-center gap-2">
-          <Input
-            id="debounce-seconds"
-            className="w-32"
-            type="number"
-            min={0}
-            value={effective.debounce_seconds}
-            onChange={(e) => patch({ debounce_seconds: Number(e.target.value) || 0 })}
-          />
-          <span className="text-muted-foreground text-sm">sec</span>
-        </div>
-        <p className="text-muted-foreground text-xs">
-          Skips repeat reports of an unchanged file within this window. Changed or deleted files
-          still scan.
-        </p>
-      </div>
-      <Button onClick={save} disabled={!activeForm || updateSettings.isPending}>
-        Save settings
-      </Button>
-    </div>
-  );
-}
-
-// ---------------------------------------------------------------------------
-// Page
-// ---------------------------------------------------------------------------
-
-interface AdminAutoscanProps {
-  /**
-   * Rendered inside the Libraries page rather than as its own route. The
-   * heading drops to an h2 and the Sources/Activity selection moves to `view`,
-   * because `tab` already names the Libraries tab that hosts this panel.
-   */
-  embedded?: boolean;
+import { legacyAutoscanPageTarget } from "@/pages/autoscanSearchParams";
+
+/**
+ * Autoscan › Sources: what Autoscan watches, with the switch that turns it on
+ * and Run now. Activity and the polling defaults are their own pages under the
+ * Autoscan topic.
+ */
+export default function AdminAutoscan() {
+  const { search } = useLocation();
+  const legacyTarget = legacyAutoscanPageTarget(search);
+  if (legacyTarget) return <Navigate to={legacyTarget} replace />;
+  return <AutoscanSourcesPage />;
 }
 
-export default function AdminAutoscan({ embedded = false }: AdminAutoscanProps = {}) {
-  const [searchParams, setSearchParams] = useSearchParams();
-  const tabParam = embedded ? "view" : "tab";
-  const requestedTab = searchParams.get(tabParam);
-  const activeTab = normalizeTab(requestedTab);
+function AutoscanSourcesPage() {
   const trigger = useTriggerAutoscan();
   const settings = useAutoscanSettings();
   const readAuthority = captureProfileRequestContext();
   const updateSettings = useUpdateAutoscanSettings();
 
-  // Open Advanced automatically when arriving from an old connections/settings
-  // link, so a bookmark still lands on the thing it pointed at.
-  const [advancedOpen, setAdvancedOpen] = useState(() => isLegacyAdvancedTab(requestedTab));
-
   const enabled = settings.data?.enabled ?? false;
 
   // Run now polls every enabled polling source at once, so hide it when
@@ -166,28 +47,13 @@ export default function AdminAutoscan({ embedded = false }: AdminAutoscanProps =
     updateSettings.mutate({ ...settings.data, enabled: checked });
   }
 
-  function setActiveTab(value: string) {
-    const next = new URLSearchParams(searchParams);
-    if (value === "sources") {
-      next.delete(tabParam);
-    } else {
-      next.set(tabParam, value);
-    }
-    setSearchParams(next, { replace: true });
-  }
-
   return (
     <div className="space-y-6">
-      <div className="page-header">
-        <div className="space-y-2">
-          <div className="flex items-center gap-2.5">
-            {embedded ? (
-              <h2 className="text-xl font-semibold tracking-tight">Autoscan</h2>
-            ) : (
-              <h1 className="text-3xl font-semibold tracking-normal text-balance sm:text-4xl">
-                Autoscan
-              </h1>
-            )}
+      <PageHeader
+        title="Autoscan"
+        subtitle="Prairie re-scans a library as soon as something changes, instead of waiting for the next scheduled scan. Add a source for each thing you want watched."
+        actions={
+          <>
             {settings.data &&
               (enabled ? (
                 <Badge variant="secondary">Enabled</Badge>
@@ -196,91 +62,34 @@ export default function AdminAutoscan({ embedded = false }: AdminAutoscanProps =
                   Disabled
                 </Badge>
               ))}
-          </div>
-          <p className="text-muted-foreground max-w-2xl text-sm leading-6">
-            Prairie re-scans a library as soon as something changes, instead of waiting for the next
-            scheduled scan. Add a source for each thing you want watched.
-          </p>
-        </div>
-        <div className="flex items-center gap-3">
-          <div className="flex items-center gap-2">
-            <Label htmlFor="autoscan-enabled" className="text-muted-foreground text-sm">
-              Autoscan
-            </Label>
-            <Switch
-              id="autoscan-enabled"
-              checked={enabled}
-              onCheckedChange={toggleEnabled}
-              disabled={!settings.data || updateSettings.isPending}
-              aria-label="Enable autoscan"
-            />
-          </div>
-          {runNowVisible ? (
-            <Button
-              variant="outline"
-              size="sm"
-              disabled={trigger.isPending}
-              onClick={() => trigger.mutate()}
-            >
-              <Play />
-              {trigger.isPending ? "Triggering…" : "Run now"}
-            </Button>
-          ) : null}
-        </div>
-      </div>
-
-      <Tabs value={activeTab} onValueChange={setActiveTab} className="gap-5">
-        <TabsList variant="line" className="border-border w-full justify-start border-b">
-          <TabsTrigger value="sources">Sources</TabsTrigger>
-          <TabsTrigger value="activity">Activity</TabsTrigger>
-        </TabsList>
-
-        <TabsContent value="sources" className="space-y-6">
-          <SourcesPanel />
-
-          {/* Advanced — servers and polling defaults. Collapsed by default
-              because most setups never need either: a webhook source needs no
-              server, and the default interval is usually fine. */}
-          <section className="border-border rounded-lg border">
-            <button
-              type="button"
-              className="flex w-full items-center gap-2 px-4 py-3 text-left"
-              onClick={() => setAdvancedOpen((open) => !open)}
-              aria-expanded={advancedOpen}
-              aria-controls="autoscan-advanced"
-            >
-              {advancedOpen ? (
-                <ChevronDown className="text-muted-foreground size-4 shrink-0" />
-              ) : (
-                <ChevronRight className="text-muted-foreground size-4 shrink-0" />
-              )}
-              <span className="text-sm font-medium">Advanced</span>
-              <span className="text-muted-foreground text-xs">
-                Saved servers and polling defaults
-              </span>
-            </button>
-
-            {advancedOpen && (
-              <div id="autoscan-advanced" className="space-y-8 border-t px-4 py-5">
-                <ConnectionsPanel />
-                <div className="space-y-4">
-                  <div className="space-y-1">
-                    <h2 className="text-sm font-medium">Polling defaults</h2>
-                    <p className="text-muted-foreground text-xs">
-                      Applied to sources that don&apos;t override them.
-                    </p>
-                  </div>
-                  <SettingsTab />
-                </div>
-              </div>
-            )}
-          </section>
-        </TabsContent>
-
-        <TabsContent value="activity">
-          <ActivityPanel />
-        </TabsContent>
-      </Tabs>
+            <div className="flex items-center gap-2">
+              <Label htmlFor="autoscan-enabled" className="text-muted-foreground text-sm">
+                Autoscan
+              </Label>
+              <Switch
+                id="autoscan-enabled"
+                checked={enabled}
+                onCheckedChange={toggleEnabled}
+                disabled={!settings.data || updateSettings.isPending}
+                aria-label="Enable autoscan"
+              />
+            </div>
+            {runNowVisible ? (
+              <Button
+                variant="outline"
+                size="sm"
+                disabled={trigger.isPending}
+                onClick={() => trigger.mutate()}
+              >
+                <Play />
+                {trigger.isPending ? "Triggering…" : "Run now"}
+              </Button>
+            ) : null}
+          </>
+        }
+      />
+
+      <SourcesPanel />
     </div>
   );
 }
diff --git a/web/src/pages/AdminAutoscanActivity.tsx b/web/src/pages/AdminAutoscanActivity.tsx
new file mode 100644
index 0000000000..e3aadb9680
--- /dev/null
+++ b/web/src/pages/AdminAutoscanActivity.tsx
@@ -0,0 +1,15 @@
+import { PageHeader } from "@/components/page/PageHeader";
+import ActivityPanel from "@/pages/admin/autoscan/ActivityPanel";
+
+/** Autoscan › Activity: the changes Autoscan received and the scans they started. */
+export default function AdminAutoscanActivity() {
+  return (
+    <div className="space-y-6">
+      <PageHeader
+        title="Autoscan Activity"
+        subtitle="Changes Autoscan received from its sources, and the scans they started."
+      />
+      <ActivityPanel />
+    </div>
+  );
+}
diff --git a/web/src/pages/AdminCollections.tsx b/web/src/pages/AdminCollections.tsx
index 4948000884..be3b73c1bd 100644
--- a/web/src/pages/AdminCollections.tsx
+++ b/web/src/pages/AdminCollections.tsx
@@ -753,7 +753,6 @@ export default function AdminCollections() {
   return (
     <div aria-busy={deleting} inert={deleting ? true : undefined}>
       <CalmPage
-        heading="page"
         title="Collections"
         subtitle="Server collections everyone can browse on each library's Collections tab and use in Sections."
         actions={
diff --git a/web/src/pages/AdminDashboard.tsx b/web/src/pages/AdminDashboard.tsx
index 9465d8852b..890257e5ff 100644
--- a/web/src/pages/AdminDashboard.tsx
+++ b/web/src/pages/AdminDashboard.tsx
@@ -13,12 +13,15 @@ import { useAdminPluginInstallations } from "@/hooks/queries/admin/plugins";
 import { usePolicyCapability } from "@/hooks/queries/admin/policy";
 import { useAdminUsers } from "@/hooks/queries/admin/users";
 import { useAdminLibraries, useScanAllLibraries } from "@/hooks/queries/admin/libraries";
+import { PageHeader } from "@/components/page/PageHeader";
 import { Button } from "@/components/ui/button";
 import { LayoutDashboard, Plus, RefreshCw, ScanLine } from "lucide-react";
 import { useQueryClient } from "@tanstack/react-query";
 import { adminKeys } from "@/hooks/queries/keys";
 import { usePageActivity } from "@/hooks/usePageActivity";
 import { buildAdminCommandNavSections } from "@/lib/adminNavigation";
+import { SettingsAttention } from "@/components/admin/SettingsAttention";
+import { useSettingsAttention } from "@/hooks/admin/useSettingsHealth";
 
 // Query prefixes the dashboard's stats/sessions/libraries/users refetch does
 // not already cover. Widgets fetch these themselves, so Refresh only has to
@@ -78,6 +81,7 @@ export default function AdminDashboard() {
   const lastUpdatedLabel = lastDashboardUpdatedAt
     ? formatRelativeUpdatedLabel(relativeUpdatedNow, lastDashboardUpdatedAt)
     : null;
+  const settingsAttention = useSettingsAttention();
   const adminSearchSections = useMemo(
     () =>
       buildAdminCommandNavSections(adminInstallations, {
@@ -209,62 +213,64 @@ export default function AdminDashboard() {
       <AdminSectionCommandDialog sections={adminSearchSections} />
 
       {/* Page header */}
-      <div className="page-header">
-        <div className="space-y-3">
-          <h1 className="page-title text-[clamp(2rem,4vw,3.25rem)]">Dashboard</h1>
-          <p className="page-subtitle text-sm sm:text-base">
-            Live sessions, content health, and server activity in one view.
-          </p>
-        </div>
-        <div className="grid w-full gap-2 sm:flex sm:w-auto sm:flex-wrap sm:items-center">
-          <div className="grid gap-2 sm:flex sm:items-center">
-            {lastUpdatedLabel && (
-              <span className="text-muted-foreground text-xs sm:whitespace-nowrap">
-                Updated {lastUpdatedLabel}
-              </span>
-            )}
+      <PageHeader
+        title="Dashboard"
+        subtitle="Live sessions, content health, and server activity in one view."
+        actions={
+          <div className="grid w-full gap-2 sm:flex sm:w-auto sm:flex-wrap sm:items-center">
+            <div className="grid gap-2 sm:flex sm:items-center">
+              {lastUpdatedLabel && (
+                <span className="text-muted-foreground text-xs sm:whitespace-nowrap">
+                  Updated {lastUpdatedLabel}
+                </span>
+              )}
+              <Button
+                variant="outline"
+                size="sm"
+                className="min-w-[8.25rem] justify-center sm:w-auto"
+                onClick={() => {
+                  void refreshDashboard({ manual: true });
+                }}
+                disabled={isManualRefreshPending}
+                aria-busy={isManualRefreshPending}
+              >
+                <RefreshCw
+                  className={`h-3.5 w-3.5 ${isManualRefreshPending ? "animate-spin" : ""}`}
+                />
+                {isManualRefreshPending ? "Refreshing..." : "Refresh"}
+              </Button>
+              <Button
+                variant="outline"
+                size="sm"
+                className="cursor-pointer justify-center sm:w-auto"
+                onClick={toggleCustomizing}
+                aria-pressed={layout.isCustomizing}
+              >
+                <LayoutDashboard className="h-3.5 w-3.5" />
+                {layout.isCustomizing ? "Done" : "Customize"}
+              </Button>
+            </div>
             <Button
-              variant="outline"
+              variant="default"
               size="sm"
-              className="min-w-[8.25rem] justify-center sm:w-auto"
+              className="w-full cursor-pointer sm:w-auto"
               onClick={() => {
-                void refreshDashboard({ manual: true });
+                if (libraries.length > 0) {
+                  scanAll.mutate();
+                }
               }}
-              disabled={isManualRefreshPending}
-              aria-busy={isManualRefreshPending}
+              disabled={scanAll.isPending || libraries.length === 0}
             >
-              <RefreshCw
-                className={`h-3.5 w-3.5 ${isManualRefreshPending ? "animate-spin" : ""}`}
-              />
-              {isManualRefreshPending ? "Refreshing..." : "Refresh"}
-            </Button>
-            <Button
-              variant="outline"
-              size="sm"
-              className="cursor-pointer justify-center sm:w-auto"
-              onClick={toggleCustomizing}
-              aria-pressed={layout.isCustomizing}
-            >
-              <LayoutDashboard className="h-3.5 w-3.5" />
-              {layout.isCustomizing ? "Done" : "Customize"}
+              <ScanLine className="h-3.5 w-3.5" />
+              Scan All Libraries
             </Button>
           </div>
-          <Button
-            variant="default"
-            size="sm"
-            className="w-full cursor-pointer sm:w-auto"
-            onClick={() => {
-              if (libraries.length > 0) {
-                scanAll.mutate();
-              }
-            }}
-            disabled={scanAll.isPending || libraries.length === 0}
-          >
-            <ScanLine className="h-3.5 w-3.5" />
-            Scan All Libraries
-          </Button>
-        </div>
-      </div>
+        }
+      />
+
+      {/* Setup the server still owes, each item linking to the page that
+          fixes it. The admin sidebar marks the broken ones too. */}
+      <SettingsAttention items={settingsAttention} />
 
       {layout.isCustomizing && (
         <div className="surface-panel-subtle flex flex-wrap items-center gap-x-4 gap-y-2 rounded-xl px-4 py-2.5">
diff --git a/web/src/pages/AdminDevices.tsx b/web/src/pages/AdminDevices.tsx
index 487f13452c..b1cf75a953 100644
--- a/web/src/pages/AdminDevices.tsx
+++ b/web/src/pages/AdminDevices.tsx
@@ -25,6 +25,7 @@ import {
 } from "@/hooks/queries/admin/users";
 import type { AdminDeviceSummary } from "@/api/types";
 import { ConfirmDialog } from "@/components/ConfirmDialog";
+import { PageHeader } from "@/components/page/PageHeader";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { Dialog, DialogContent, DialogHeader, DialogTitle } from "@/components/ui/dialog";
@@ -352,41 +353,41 @@ export default function AdminDevices() {
   };
 
   return (
-    <div className="mx-auto w-full max-w-[1920px] space-y-5 px-4 py-4 sm:px-6 sm:py-6 lg:px-8 xl:px-10">
-      {/* page header */}
-      <div className="page-header items-end gap-5">
-        <div className="space-y-3">
-          <h1 className="page-title text-[clamp(2rem,4vw,3rem)]">Devices</h1>
-          <p className="page-subtitle max-w-2xl text-sm sm:text-base">
+    <div className="w-full space-y-5 pb-4 sm:pb-6">
+      <PageHeader
+        title="Devices"
+        subtitle={
+          <>
             Inspect, tune, and reset per-profile playback overrides across the fleet. Filter by
             user, platform, or override pattern. Press{" "}
             <kbd className="bg-surface/70 border-border/70 text-foreground/80 inline-flex items-center rounded border px-1.5 py-0.5 font-mono text-[10.5px]">
               {SEARCH_SHORTCUT_LABEL}
             </kbd>{" "}
             to jump to another admin page.
-          </p>
-        </div>
-
-        <div className="relative w-full sm:w-[340px]">
-          <Search className="text-muted-foreground absolute top-1/2 left-3 h-4 w-4 -translate-y-1/2" />
-          <Input
-            className="bg-background/60 h-9 pr-9 pl-9 text-[13px]"
-            placeholder="Search devices, users, IDs, profiles…"
-            value={search}
-            onChange={(event) => setSearch(event.target.value)}
-          />
-          {search ? (
-            <button
-              type="button"
-              onClick={() => setSearch("")}
-              className="text-muted-foreground hover:text-foreground absolute top-1/2 right-2 -translate-y-1/2 rounded p-1 transition-colors"
-              aria-label="Clear search"
-            >
-              <X className="h-3.5 w-3.5" />
-            </button>
-          ) : null}
-        </div>
-      </div>
+          </>
+        }
+        actions={
+          <div className="relative w-full sm:w-[340px]">
+            <Search className="text-muted-foreground absolute top-1/2 left-3 h-4 w-4 -translate-y-1/2" />
+            <Input
+              className="bg-background/60 h-9 pr-9 pl-9 text-[13px]"
+              placeholder="Search devices, users, IDs, profiles…"
+              value={search}
+              onChange={(event) => setSearch(event.target.value)}
+            />
+            {search ? (
+              <button
+                type="button"
+                onClick={() => setSearch("")}
+                className="text-muted-foreground hover:text-foreground absolute top-1/2 right-2 -translate-y-1/2 rounded p-1 transition-colors"
+                aria-label="Clear search"
+              >
+                <X className="h-3.5 w-3.5" />
+              </button>
+            ) : null}
+          </div>
+        }
+      />
 
       {/* fleet pulse */}
       {!isLoading && devices.length > 0 && (
diff --git a/web/src/pages/AdminDiagnostics.tsx b/web/src/pages/AdminDiagnostics.tsx
index 402cbb70a7..cf0fde8ec9 100644
--- a/web/src/pages/AdminDiagnostics.tsx
+++ b/web/src/pages/AdminDiagnostics.tsx
@@ -17,6 +17,7 @@ import { toast } from "sonner";
 import type { DiagnosticReport, DiagnosticReportState, DiagnosticReportSummary } from "@/api/types";
 import { ConfirmDialog } from "@/components/ConfirmDialog";
 import { DateTimePicker } from "@/components/DateTimePicker";
+import { PageHeader } from "@/components/page/PageHeader";
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
@@ -179,35 +180,36 @@ export default function AdminDiagnostics() {
 
   return (
     <div className="space-y-6">
-      <div className="page-header gap-5">
-        <div className="space-y-3">
-          <h1 className="page-title text-[clamp(2rem,4vw,3rem)]">Client Diagnostics</h1>
-          <p className="page-subtitle text-sm sm:text-base">
-            Review client crash reports, device context, and correlated playback sessions.
-          </p>
-        </div>
-        <div className="flex items-center gap-5 sm:gap-6">
-          <div className="flex items-center gap-2">
-            <Label htmlFor="diagnostics-uploads-enabled" className="text-muted-foreground text-sm">
-              Client uploads
-            </Label>
-            <Switch
-              id="diagnostics-uploads-enabled"
-              checked={uploadsEnabled}
-              onCheckedChange={(enabled) => updateUploadsEnabled.mutate(enabled)}
-              disabled={!status.data || status.isError || updateUploadsEnabled.isPending}
-            />
-          </div>
-          <div className="text-right">
-            <div className="text-muted-foreground text-xs font-medium tracking-[0.2em] uppercase">
-              Retention
+      <PageHeader
+        title="Client Diagnostics"
+        subtitle="Review client crash reports, device context, and correlated playback sessions."
+        actions={
+          <div className="flex items-center gap-5 sm:gap-6">
+            <div className="flex items-center gap-2">
+              <Label
+                htmlFor="diagnostics-uploads-enabled"
+                className="text-muted-foreground text-sm"
+              >
+                Client uploads
+              </Label>
+              <Switch
+                id="diagnostics-uploads-enabled"
+                checked={uploadsEnabled}
+                onCheckedChange={(enabled) => updateUploadsEnabled.mutate(enabled)}
+                disabled={!status.data || status.isError || updateUploadsEnabled.isPending}
+              />
             </div>
-            <div className="text-sm">
-              {status.data ? `${status.data.retention_days} days` : "Loading..."}
+            <div className="text-right">
+              <div className="text-muted-foreground text-xs font-medium tracking-[0.2em] uppercase">
+                Retention
+              </div>
+              <div className="text-sm">
+                {status.data ? `${status.data.retention_days} days` : "Loading..."}
+              </div>
             </div>
           </div>
-        </div>
-      </div>
+        }
+      />
 
       {status.data?.status !== undefined && status.data.status !== "available" && (
         <FeatureStatusBanner status={status.data.status} />
diff --git a/web/src/pages/AdminDownloads.tsx b/web/src/pages/AdminDownloads.tsx
index 117fa3cac6..0813a094ee 100644
--- a/web/src/pages/AdminDownloads.tsx
+++ b/web/src/pages/AdminDownloads.tsx
@@ -1,4 +1,5 @@
 import { useSearchParams } from "react-router";
+import { PageHeader } from "@/components/page/PageHeader";
 import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
 import { useAdminDownloadPreparations } from "@/hooks/queries/admin/downloadPreparations";
 import DeviceCopiesTab from "@/pages/admin-downloads/DeviceCopiesTab";
@@ -33,15 +34,10 @@ export default function AdminDownloads() {
 
   return (
     <div className="space-y-5 lg:space-y-6">
-      <div className="page-header">
-        <div className="space-y-3">
-          <h1 className="page-title text-[clamp(2rem,4vw,3.25rem)]">Downloads</h1>
-          <p className="page-subtitle text-sm sm:text-base">
-            Preparing downloads, the prepared files on the server and nodes, and the copies on
-            people's devices.
-          </p>
-        </div>
-      </div>
+      <PageHeader
+        title="Downloads"
+        subtitle="Preparing downloads, the prepared files on the server and nodes, and the copies on people's devices."
+      />
       <Tabs
         value={tab}
         onValueChange={(value) => open(parseAdminDownloadsTab(value))}
diff --git a/web/src/pages/AdminHistoryImport.tsx b/web/src/pages/AdminHistoryImport.tsx
index 196f61142c..5bd730cbd9 100644
--- a/web/src/pages/AdminHistoryImport.tsx
+++ b/web/src/pages/AdminHistoryImport.tsx
@@ -35,6 +35,7 @@ import {
   X,
   XCircle,
 } from "lucide-react";
+import { PageHeader } from "@/components/page/PageHeader";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
@@ -1512,15 +1513,11 @@ function AdminHistoryImportPage() {
   if (sourcesError && sources.length === 0)
     return <p role="alert">Saved servers could not be loaded.</p>;
   return (
-    <div className="page-shell space-y-8 py-4 sm:py-6">
-      <div className="page-header">
-        <div className="space-y-3">
-          <h1 className="page-title text-[clamp(2rem,4vw,3rem)]">History Import</h1>
-          <p className="page-subtitle text-sm sm:text-base">
-            Import watch history from external servers into Prairie user profiles.
-          </p>
-        </div>
-      </div>
+    <div className="space-y-8 pb-4 sm:pb-6">
+      <PageHeader
+        title="History Import"
+        subtitle="Import watch history from external servers into Prairie user profiles."
+      />
 
       {/* Source selector */}
       <SourceBar
diff --git a/web/src/pages/AdminHomeRows.addRow.test.tsx b/web/src/pages/AdminHomeRows.addRow.test.tsx
index 74e8fe70c8..bf7f188f6d 100644
--- a/web/src/pages/AdminHomeRows.addRow.test.tsx
+++ b/web/src/pages/AdminHomeRows.addRow.test.tsx
@@ -7,6 +7,7 @@ import golden from "@/lib/homeRows/payloads.golden.json";
 import { expectPhoneLayout, stubPhone } from "@/components/homeRows/phoneLayout.test-support";
 import { recipeCatalogFixture } from "@/lib/homeRows/recipeCatalogFixture.test-support";
 import { V2ProblemError } from "@/api/v2/request";
+import seasonalThemes from "../../../contracts/api/v2/fixtures/list_seasonal_themes_ok.json";
 import AdminHomeRows from "./AdminHomeRows";
 
 const mocks = vi.hoisted(() => ({
@@ -140,6 +141,7 @@ beforeEach(() => {
     args.onResponse?.(new Response(null, { headers: { ETag: '"rev-1"' } }));
     const scope = args.query?.scope ?? "home";
     const here = rows.filter((row) => row.scope === scope);
+    if (operation === "GET /api/v2/sections/seasonal-themes") return seasonalThemes;
     if (operation === "GET /api/v2/admin/sections/capabilities")
       return { available: true, reset_profiles: false, preview };
     if (operation === "GET /api/v2/admin/sections/order")
@@ -445,30 +447,18 @@ describe("Edit row", () => {
     });
   });
 
-  it("shows Continue Reading rows without a variant, and legacy Trakt rows without Change", async () => {
+  it("shows Continue Reading rows without a variant", async () => {
     rows[1] = {
       ...rows[1]!,
       title: "Keep reading",
       section_type: "continue_watching",
       config: { continue_type: "reading" },
     };
-    rows.push(
-      stored("t", {
-        position: 5,
-        title: "Trakt trending",
-        section_type: "trending_discover",
-        config: { source: "trakt", window: "week" },
-      }),
-    );
     await setup();
-    let dialog = await editRow("Keep reading");
+    const dialog = await editRow("Keep reading");
     expect(within(dialog).getByText("Continue Reading")).toBeInTheDocument();
     expect(within(dialog).queryByRole("radiogroup")).toBeNull();
     expect(within(dialog).getByRole("button", { name: /^Change/ })).toBeInTheDocument();
-    await userEvent.click(within(dialog).getByRole("button", { name: "Cancel" }));
-    dialog = await editRow("Trakt trending");
-    expect(within(dialog).queryByRole("radiogroup")).toBeNull();
-    expect(within(dialog).queryByRole("button", { name: /^Change/ })).toBeNull();
   });
 
   it("changes what a row shows through the picker and saves the new kind's settings", async () => {
diff --git a/web/src/pages/AdminHomeRows.concurrency.test.tsx b/web/src/pages/AdminHomeRows.concurrency.test.tsx
index 768bdaee09..9411d27c6f 100644
--- a/web/src/pages/AdminHomeRows.concurrency.test.tsx
+++ b/web/src/pages/AdminHomeRows.concurrency.test.tsx
@@ -10,6 +10,7 @@ import AdminHomeRows from "./AdminHomeRows";
 
 const mocks = vi.hoisted(() => ({
   request: vi.fn(),
+  success: vi.fn(),
   error: vi.fn(),
   warning: vi.fn(),
 }));
@@ -18,7 +19,7 @@ vi.mock("@/api/v2/request", async () => ({
   v2: mocks.request,
 }));
 vi.mock("sonner", () => ({
-  toast: { success: vi.fn(), error: mocks.error, warning: mocks.warning },
+  toast: { success: mocks.success, error: mocks.error, warning: mocks.warning },
 }));
 vi.mock("@/hooks/queries/admin/libraries", () => ({
   useAdminLibraries: () => ({ data: libraries }),
@@ -261,7 +262,9 @@ describe("admin section captured snapshots", () => {
     await setup();
     await chooseMoreAction("Restore defaults…");
     const dialog = await screen.findByRole("dialog", { name: "Restore Home to the default rows?" });
-    expect(within(dialog).getByRole("switch")).toBeDisabled();
+    expect(
+      within(dialog).getByRole("switch", { name: "Also reset every profile's Home" }),
+    ).toBeDisabled();
     expect(
       within(dialog).getByText("Resetting profiles isn't available on this server."),
     ).toBeVisible();
@@ -300,6 +303,118 @@ describe("admin section captured snapshots", () => {
     ]);
     expect(writes[0]!.args.body?.reset_profiles).toBe(true);
   });
+  it("also restores every library page, each over its current version", async () => {
+    resetSupported = true;
+    await setup();
+    await chooseMoreAction("Restore defaults…");
+    const dialog = await screen.findByRole("dialog", { name: "Restore Home to the default rows?" });
+    fireEvent.click(
+      within(dialog).getByRole("switch", { name: "Also restore every library page" }),
+    );
+    fireEvent.click(
+      within(dialog).getByRole("switch", {
+        name: "Also reset every profile's Home and library pages",
+      }),
+    );
+    fireEvent.click(within(dialog).getByRole("button", { name: "Restore defaults" }));
+    await waitFor(() => expect(screen.queryByRole("dialog")).not.toBeInTheDocument());
+    expect(
+      writes.map(({ operation, args }) => [operation, args.query, args.body?.reset_profiles]),
+    ).toEqual([
+      ["PUT /api/v2/admin/sections/defaults", { scope: "home", library_id: undefined }, true],
+      ["PUT /api/v2/admin/sections/defaults", { scope: "library", library_id: "7" }, true],
+    ]);
+    expect(mocks.success).toHaveBeenCalledWith(
+      "Restored the default rows on Home and 1 library page.",
+    );
+  });
+  it("closes the restore dialog when the page changes while it is open", async () => {
+    await setup();
+    await chooseMoreAction("Restore defaults…");
+    const dialog = await screen.findByRole("dialog", { name: "Restore Home to the default rows?" });
+    fireEvent.click(
+      within(dialog).getByRole("switch", { name: "Also restore every library page" }),
+    );
+    // Back or Forward moves ?page= while the dialog is open.
+    fireEvent.click(screen.getByRole("button", { name: "Movies", hidden: true }));
+    await waitFor(() => expect(screen.queryByRole("dialog")).not.toBeInTheDocument());
+    expect(writes).toEqual([]);
+    // Opening it again on the new page starts with the switches off.
+    await screen.findByRole("button", { name: "Movies", pressed: true });
+    await chooseMoreAction("Restore defaults…");
+    const again = await screen.findByRole("dialog", {
+      name: "Restore the Movies page to the default rows?",
+    });
+    expect(within(again).queryByRole("switch", { checked: true })).not.toBeInTheDocument();
+  });
+  it("leaves the library pages alone when this page changed since the dialog opened", async () => {
+    await setup();
+    await chooseMoreAction("Restore defaults…");
+    const dialog = await screen.findByRole("dialog", { name: "Restore Home to the default rows?" });
+    fireEvent.click(
+      within(dialog).getByRole("switch", { name: "Also restore every library page" }),
+    );
+    revision = 2;
+    fireEvent.click(within(dialog).getByRole("button", { name: "Restore defaults" }));
+    await within(dialog).findByText(/These rows changed since you opened this/);
+    expect(writes).toHaveLength(1);
+    expect(writes[0]!.args.query?.scope).toBe("home");
+  });
+  it("names the library pages that kept their rows", async () => {
+    libraries.push({ id: 8, name: "TV Shows", type: "tv" });
+    const implementation = mocks.request.getMockImplementation()!;
+    mocks.request.mockImplementation((operation: string, args: Args = {}) => {
+      if (operation === "PUT /api/v2/admin/sections/defaults" && args.query?.library_id === "7") {
+        writes.push({ operation, args });
+        return Promise.reject(v2Problem(404, "not_found", "Library not found"));
+      }
+      return implementation(operation, args);
+    });
+    try {
+      await setup();
+      await chooseMoreAction("Restore defaults…");
+      const dialog = await screen.findByRole("dialog", {
+        name: "Restore Home to the default rows?",
+      });
+      fireEvent.click(
+        within(dialog).getByRole("switch", { name: "Also restore every library page" }),
+      );
+      fireEvent.click(within(dialog).getByRole("button", { name: "Restore defaults" }));
+      await waitFor(() => expect(screen.queryByRole("dialog")).not.toBeInTheDocument());
+      expect(writes.map(({ args }) => args.query?.library_id)).toEqual([undefined, "7", "8"]);
+      expect(mocks.warning).toHaveBeenCalledWith(
+        "Restored the default rows on Home and 1 library page. 1 library page kept its rows.",
+        { description: "Movies: Library not found" },
+      );
+    } finally {
+      libraries.pop();
+    }
+  });
+  it("says a library page may have been restored when its restore got no answer", async () => {
+    const implementation = mocks.request.getMockImplementation()!;
+    mocks.request.mockImplementation((operation: string, args: Args = {}) => {
+      if (operation === "PUT /api/v2/admin/sections/defaults" && args.query?.library_id === "7") {
+        writes.push({ operation, args });
+        return Promise.reject(new TypeError("Failed to fetch"));
+      }
+      return implementation(operation, args);
+    });
+    await setup();
+    await chooseMoreAction("Restore defaults…");
+    const dialog = await screen.findByRole("dialog", { name: "Restore Home to the default rows?" });
+    fireEvent.click(
+      within(dialog).getByRole("switch", { name: "Also restore every library page" }),
+    );
+    fireEvent.click(within(dialog).getByRole("button", { name: "Restore defaults" }));
+    await waitFor(() => expect(screen.queryByRole("dialog")).not.toBeInTheDocument());
+    expect(mocks.warning).toHaveBeenCalledWith(
+      "Restored the default rows on Home. 1 library page may have been restored.",
+      {
+        description:
+          "Movies: it may have been restored, but Prairie couldn't confirm it. Reload it to check.",
+      },
+    );
+  });
   it("names the collection rows as of the version Restore replaces", async () => {
     await setup();
     // Another admin adds a collection row after this page loaded.
@@ -455,7 +570,7 @@ describe("admin section captured snapshots", () => {
     rows[0]!.section_type = "collection";
     rows[0]!.config = {
       library_collection_id: "public",
-      source_provider: "trakt",
+      source_provider: "mdblist",
       source_preset: "popular",
       extra: { retained: true },
     };
@@ -468,7 +583,7 @@ describe("admin section captured snapshots", () => {
     await waitFor(() => expect(writes).toHaveLength(1));
     expect(writes[0]!.args.body?.config).toEqual({
       library_collection_id: "public",
-      source_provider: "trakt",
+      source_provider: "mdblist",
       source_preset: "popular",
       extra: { retained: true },
     });
diff --git a/web/src/pages/AdminHomeRows.tsx b/web/src/pages/AdminHomeRows.tsx
index 49116d2ba2..4997d5ea85 100644
--- a/web/src/pages/AdminHomeRows.tsx
+++ b/web/src/pages/AdminHomeRows.tsx
@@ -23,6 +23,7 @@ import {
   fetchAdminSectionSnapshot,
   fetchAdminSectionDeleteTargets,
   fetchAdminSections,
+  type LibraryRestoreFailure,
 } from "@/api/adminSections";
 import { V2ProblemError } from "@/api/v2/request";
 import { HomeRowsPage, type SharedRowMenuItems } from "@/components/homeRows/HomeRowsPage";
@@ -38,8 +39,8 @@ import type { ActionMenuItem } from "@/components/calm/ActionMenu";
 import { useNewRowHighlight } from "@/components/homeRows/useNewRowHighlight";
 import { useRowFocus } from "@/components/homeRows/useRowFocus";
 import { useRowDialog, useRowLinks } from "@/components/homeRows/useRowLinks";
-import { libraryPagesOf, pageLabel, pageParam, samePage } from "@/lib/homeRows/pages";
-import type { HomeRow } from "@/lib/homeRows/types";
+import { libraryPagesOf, pageLabel, pageParam } from "@/lib/homeRows/pages";
+import type { HomeRow, LibraryPage, PageRef } from "@/lib/homeRows/types";
 import { updateCheckboxSelection } from "@/lib/checkboxSelection";
 
 function rowCount(count: number) {
@@ -48,7 +49,6 @@ function rowCount(count: number) {
 
 function batchFailureText({ title, reason, message }: BatchFailure) {
   if (reason === "changed") return `${title} changed since you opened this page.`;
-  if (reason === "legacy") return `${title} is a Trakt row, which can't be turned back on.`;
   return `${title}: ${message}`;
 }
 
@@ -65,6 +65,46 @@ function reportShownBatch({ changedIds, failures }: ShownBatchResult, shown: boo
     toast.error(`Could not turn ${shown ? "on" : "off"} ${rowCount(attempted)}.`, { description });
 }
 
+/**
+ * Reports a restore: the library pages confirmed restored in the title, then
+ * those that kept their rows and those whose restore Prairie couldn't confirm, each named
+ * with the reason.
+ */
+function reportRestore(
+  page: PageRef,
+  pageLabel: string,
+  alsoPages: LibraryPage[],
+  failures: LibraryRestoreFailure[],
+) {
+  const noun = page.kind === "home" ? "library page" : "other library page";
+  const pages = (count: number) => `${count} ${noun}${count === 1 ? "" : "s"}`;
+  const restored = alsoPages.length - failures.length;
+  const title =
+    restored > 0
+      ? `Restored the default rows on ${pageLabel} and ${pages(restored)}.`
+      : `Restored the default rows on ${pageLabel}.`;
+  if (failures.length === 0) {
+    toast.success(title);
+    return;
+  }
+  const failed = failures.filter((failure) => failure.outcome === "failed").length;
+  const unknown = failures.length - failed;
+  const outcomes = [
+    failed > 0 ? `${pages(failed)} kept ${failed === 1 ? "its" : "their"} rows.` : null,
+    unknown > 0 ? `${pages(unknown)} may have been restored.` : null,
+  ].filter(Boolean);
+  const description = failures
+    .map(({ libraryId, error, outcome }) => {
+      const label =
+        alsoPages.find((page) => page.id === libraryId)?.label ?? `Library ${libraryId}`;
+      if (outcome === "unknown")
+        return `${label}: it may have been restored, but Prairie couldn't confirm it. Reload it to check.`;
+      return `${label}: ${adminSectionMutationMessage(error, "Could not restore the default rows")}`;
+    })
+    .join(" ");
+  toast.warning([title, ...outcomes].join(" "), { description });
+}
+
 export default function AdminHomeRows() {
   const adapter = useAdminHomeRows();
   const { scope, serverCapabilities: capabilities } = adapter;
@@ -131,14 +171,19 @@ export default function AdminHomeRows() {
   const deleteMutation = useDeleteSection();
   const deleteSectionsMutation = useDeleteSections();
   const restoreDefaultsMutation = useRestoreDefaultSections();
-  const [confirmRestoreOpen, setConfirmRestoreOpen] = useState(false);
+  // The page the Restore dialog was opened on. Back or Forward to another page
+  // closes it, so it never describes one page while restoring another.
+  const [restorePage, setRestorePage] = useState<string | null>(null);
+  if (restorePage !== null && restorePage !== currentPageKey) setRestorePage(null);
   const [resetProfiles, setResetProfiles] = useState(false);
+  const [restoreAll, setRestoreAll] = useState(false);
   // The Add row / Edit row dialog: open with no session to add a row.
   const [rowDialog, setRowDialog] = useRowDialog();
   const [highlightId, setHighlightId] = useNewRowHighlight();
   // ⋯ Add to other libraries…: the row being copied.
   const [copyRow, setCopyRow] = useState<HomeRow | null>(null);
   const libraryPages = useMemo(() => libraryPagesOf(adapter.pages), [adapter.pages]);
+  const otherLibraryPages = libraryPages.filter((page) => page.id !== activeLibraryId);
   /** The library pages a row on this page fits, this page included. */
   const copyPagesFor = (row: HomeRow) =>
     activeLibraryId === null ? [] : copyTargetPages(row, libraryPages, activeLibraryId);
@@ -291,30 +336,33 @@ export default function AdminHomeRows() {
       if (request !== snapshotRequest.current) return;
       setRestoreSnapshot({ ...snapshot, scope, libraryId });
       setRestoreConflict(false);
-      setConfirmRestoreOpen(true);
+      // A new dialog starts with both switches off.
+      setResetProfiles(false);
+      setRestoreAll(false);
+      setRestorePage(currentPageKey);
     });
   }
 
   function closeRestore() {
     snapshotRequest.current++;
-    setConfirmRestoreOpen(false);
-    setResetProfiles(false);
+    setRestorePage(null);
   }
 
   function confirmRestore() {
     if (!restoreSnapshot) return;
+    const alsoPages = restoreAll ? otherLibraryPages : [];
     restoreDefaultsMutation.mutate(
       {
         scope: restoreSnapshot.scope,
         library_id: restoreSnapshot.libraryId,
         etag: restoreSnapshot.etag,
         reset_profiles: Boolean(capabilities?.reset_profiles && resetProfiles),
+        alsoLibraryIds: alsoPages.map((page) => page.id),
       },
       {
-        onSuccess: () => {
-          toast.success(`Restored the default rows on ${currentPageLabel}.`);
-          setConfirmRestoreOpen(false);
-          setResetProfiles(false);
+        onSuccess: (failures) => {
+          reportRestore(adapter.page, currentPageLabel, alsoPages, failures);
+          setRestorePage(null);
         },
         onError: (error) => {
           const stale = error instanceof V2ProblemError && error.status === 412;
@@ -497,16 +545,14 @@ export default function AdminHomeRows() {
           }}
         />
         <RestoreDialog
-          open={confirmRestoreOpen}
+          open={restorePage !== null}
           page={adapter.page}
           pageLabel={currentPageLabel}
-          otherLibraryLabels={adapter.pages
-            .filter(
-              (option) => option.ref.kind === "library" && !samePage(option.ref, adapter.page),
-            )
-            .map((option) => option.label)}
+          otherLibraryLabels={otherLibraryPages.map((page) => page.label)}
           rowCount={restoreSections.length}
           collectionRowTitles={restoreCollectionTitles}
+          restoreAll={restoreAll}
+          onRestoreAllChange={setRestoreAll}
           resetSupported={Boolean(capabilities?.reset_profiles)}
           resetProfiles={resetProfiles}
           onResetProfilesChange={setResetProfiles}
diff --git a/web/src/pages/AdminLibraries.test.tsx b/web/src/pages/AdminLibraries.test.tsx
index 5ab8783ccc..3d3ace84c3 100644
--- a/web/src/pages/AdminLibraries.test.tsx
+++ b/web/src/pages/AdminLibraries.test.tsx
@@ -36,6 +36,7 @@ const mocks = vi.hoisted(() => ({
   useUploadLibraryPoster: vi.fn(),
   useDeleteLibraryPoster: vi.fn(),
   useUnmatchedLibraryItems: vi.fn(),
+  useSetUnmatchedItemIgnored: vi.fn(),
   useAdminPlugins: vi.fn(),
   useCancelLibraryScans: vi.fn(),
   useCancelAdminJob: vi.fn(),
@@ -76,6 +77,7 @@ vi.mock("@/hooks/queries/admin/libraries", () => ({
   useUploadLibraryPoster: (...args: unknown[]) => mocks.useUploadLibraryPoster(...args),
   useDeleteLibraryPoster: (...args: unknown[]) => mocks.useDeleteLibraryPoster(...args),
   useUnmatchedLibraryItems: (...args: unknown[]) => mocks.useUnmatchedLibraryItems(...args),
+  useSetUnmatchedItemIgnored: (...args: unknown[]) => mocks.useSetUnmatchedItemIgnored(...args),
   useCancelLibraryScans: (...args: unknown[]) => mocks.useCancelLibraryScans(...args),
   useCancelAdminJob: (...args: unknown[]) => mocks.useCancelAdminJob(...args),
   useLibraryRoots: (...args: unknown[]) => mocks.useLibraryRoots(...args),
@@ -251,6 +253,7 @@ describe("AdminLibraries", () => {
       isLoading: false,
     });
     mocks.useUnmatchedLibraryItems.mockReturnValue(unmatchedItemsResult([]));
+    mocks.useSetUnmatchedItemIgnored.mockReturnValue({ mutate: vi.fn(), isPending: false });
     mocks.useCancelLibraryScans.mockReturnValue(queryState);
     mocks.useCancelAdminJob.mockReturnValue(queryState);
     mocks.useLibraryRoots.mockReturnValue({
@@ -676,6 +679,107 @@ describe("AdminLibraries", () => {
     expect(titles()).toEqual(["Zulu", "Middle", "Alpha"]);
   });
 
+  it("ignores an unmatched item and restores an ignored one", async () => {
+    const item = {
+      content_id: "movie:special",
+      library_id: 1,
+      title: "Bonus Disc Featurette",
+      year: 2003,
+      content_type: "movie",
+      library_name: "Movies",
+      status: "unmatched",
+    };
+    const ignored = {
+      ...item,
+      content_id: "movie:reel",
+      title: "Family Holiday Reel",
+      ignored_at: "2026-01-02T03:04:05.678Z",
+    };
+    const book = {
+      ...item,
+      content_id: "audiobook:pending",
+      title: "Pending Audiobook",
+      content_type: "audiobook",
+      status: "pending",
+    };
+    mocks.useUnmatchedLibraryItems.mockImplementation((_search: string, ignoredView: boolean) =>
+      unmatchedItemsResult(ignoredView ? [ignored] : [item, book]),
+    );
+    const mutate = vi.fn();
+    mocks.useSetUnmatchedItemIgnored.mockReturnValue({ mutate, isPending: false });
+    const client = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+    render(
+      <QueryClientProvider client={client}>
+        <MemoryRouter>
+          <AdminLibraries />
+        </MemoryRouter>
+      </QueryClientProvider>,
+    );
+    fireEvent.click(screen.getByText("Unmatched Items"));
+
+    fireEvent.click(screen.getByRole("button", { name: "Ignore Bonus Disc Featurette" }));
+    // Books keep their own enrichment, so they offer no Ignore.
+    expect(screen.queryByRole("button", { name: "Ignore Pending Audiobook" })).toBeNull();
+    expect(mutate).toHaveBeenLastCalledWith({
+      contentId: "movie:special",
+      title: "Bonus Disc Featurette",
+      ignored: true,
+    });
+
+    await userEvent.click(screen.getByRole("combobox", { name: "Unmatched item view" }));
+    await userEvent.click(await screen.findByRole("option", { name: "Ignored" }));
+    expect(screen.getByText("Family Holiday Reel")).toBeInTheDocument();
+    expect(screen.queryByText("Bonus Disc Featurette")).toBeNull();
+    expect(
+      screen.getByPlaceholderText("Search ignored items by title, library, or type..."),
+    ).toBeInTheDocument();
+
+    fireEvent.click(screen.getByRole("button", { name: "Restore Family Holiday Reel" }));
+    expect(mutate).toHaveBeenLastCalledWith({
+      contentId: "movie:reel",
+      title: "Family Holiday Reel",
+      ignored: false,
+    });
+  });
+
+  it("keeps the unmatched section while every item is ignored", () => {
+    const ignored = {
+      content_id: "movie:reel",
+      library_id: 1,
+      title: "Family Holiday Reel",
+      year: 2011,
+      content_type: "movie",
+      library_name: "Movies",
+      status: "unmatched",
+      ignored_at: "2026-01-02T03:04:05.678Z",
+    };
+    mocks.useUnmatchedLibraryItems.mockImplementation((_search: string, ignoredView: boolean) =>
+      unmatchedItemsResult(ignoredView ? [ignored] : []),
+    );
+    const client = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+    render(
+      <QueryClientProvider client={client}>
+        <MemoryRouter>
+          <AdminLibraries />
+        </MemoryRouter>
+      </QueryClientProvider>,
+    );
+    fireEvent.click(screen.getByText("Unmatched Items"));
+    expect(screen.getByText("No items are awaiting a match.")).toBeInTheDocument();
+  });
+
+  it("hides the unmatched section when nothing is unmatched or ignored", () => {
+    const client = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+    render(
+      <QueryClientProvider client={client}>
+        <MemoryRouter>
+          <AdminLibraries />
+        </MemoryRouter>
+      </QueryClientProvider>,
+    );
+    expect(screen.queryByText("Unmatched Items")).toBeNull();
+  });
+
   it.each(["search", "first", "previous"])(
     "cancels a pending Last traversal after %s",
     async (action) => {
diff --git a/web/src/pages/AdminLibraries.tsx b/web/src/pages/AdminLibraries.tsx
index b3b38d650a..2ea0dabb56 100644
--- a/web/src/pages/AdminLibraries.tsx
+++ b/web/src/pages/AdminLibraries.tsx
@@ -33,6 +33,7 @@ import {
   useCancelAdminJob,
   useConfirmEmptyRootCleanup,
   useUnmatchedLibraryItems,
+  useSetUnmatchedItemIgnored,
   UNMATCHED_PAGE_SIZE,
 } from "@/hooks/queries/admin/libraries";
 import { useAdminTrickplayLibraries } from "@/hooks/queries/admin/trickplay";
@@ -45,6 +46,7 @@ import { RealtimeMonitoringBadge } from "@/components/admin/libraries/RealtimeMo
 import { TrickplayLibraryBadge } from "@/components/admin/trickplay/TrickplayLibraryBadge";
 import { MetadataMatcherQueuesSection } from "@/components/admin/libraries/MetadataMatcherQueuesSection";
 import { CollapsibleDiagnosticsSection } from "@/components/admin/CollapsibleDiagnosticsSection";
+import { PageHeader } from "@/components/page/PageHeader";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
@@ -72,7 +74,7 @@ import {
   SelectTrigger,
   SelectValue,
 } from "@/components/ui/select";
-import { Link, useSearchParams } from "react-router";
+import { Link, Navigate, useLocation } from "react-router";
 import {
   Plus,
   Pencil,
@@ -95,9 +97,10 @@ import {
   Unlink,
   Search,
   FolderOpen,
+  EyeOff,
+  Undo2,
 } from "lucide-react";
-import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
-import AdminAutoscan from "@/pages/AdminAutoscan";
+import { legacyLibrariesAutoscanTarget } from "@/pages/autoscanSearchParams";
 import { ConfirmDialog } from "@/components/ConfirmDialog";
 import { cn } from "@/lib/utils";
 import { toast } from "sonner";
@@ -144,9 +147,6 @@ const EMPTY_ROOT_WARNING_TEXT =
 const EMPTY_ROOT_WARNING_HINT =
   "Run another scan after storage returns, or confirm deletion before the next empty-root scan.";
 
-const LIBRARY_TABS = ["libraries", "autoscan"] as const;
-type LibraryTab = (typeof LIBRARY_TABS)[number];
-
 // Stable fallbacks while queries load. A fresh `[]` on every render re-ran the
 // effect that copies libraries into the reorder state, so the page re-rendered
 // until the query resolved.
@@ -154,27 +154,15 @@ const NO_LIBRARIES: Library[] = [];
 const NO_ACTIVE_SCANS: ScanRun[] = [];
 
 export default function AdminLibraries() {
-  useEventChannel("scans");
-  // Autoscan used to be its own sidebar page even though it only ever
-  // configured how these libraries get scanned; it is a tab here now, and
-  // /admin/autoscan redirects to it.
-  const [searchParams, setSearchParams] = useSearchParams();
-  const requestedTab = searchParams.get("tab");
-  const activeTab: LibraryTab = LIBRARY_TABS.includes(requestedTab as LibraryTab)
-    ? (requestedTab as LibraryTab)
-    : "libraries";
-
-  function setActiveTab(value: string) {
-    const next = new URLSearchParams(searchParams);
-    if (value === "libraries") {
-      next.delete("tab");
-      next.delete("view");
-    } else {
-      next.set("tab", value);
-    }
-    setSearchParams(next, { replace: true });
-  }
+  // Autoscan was a tab here before it became its own sidebar topic.
+  const { search } = useLocation();
+  const autoscanTarget = legacyLibrariesAutoscanTarget(search);
+  if (autoscanTarget) return <Navigate to={autoscanTarget} replace />;
+  return <LibrariesPage />;
+}
 
+function LibrariesPage() {
+  useEventChannel("scans");
   const { data: libraries = NO_LIBRARIES, isLoading } = useAdminLibraries();
   const { data: libraryCapabilities } = useLibraryCapabilities();
   const { data: activeScans = NO_ACTIVE_SCANS } = useActiveScans();
@@ -348,12 +336,10 @@ export default function AdminLibraries() {
     });
   }
 
-  if (isLoading && activeTab === "libraries")
-    return <div className="p-8">Loading libraries...</div>;
+  if (isLoading) return <div className="pb-8">Loading libraries...</div>;
 
   return (
     <div className="space-y-6">
-      <JobPageControls query={refreshJobsQuery} label="Load older refresh jobs" />
       <ConfirmDialog
         open={confirmDeleteLib !== null}
         onOpenChange={(open) => {
@@ -382,319 +368,403 @@ export default function AdminLibraries() {
           setConfirmEmptyRootLib(null);
         }}
       />
-      <div className="page-header">
-        <div className="space-y-3">
-          <h1 className="page-title text-[clamp(2rem,4vw,3rem)]">Libraries</h1>
-          <p className="page-subtitle text-sm sm:text-base">
-            Manage library roots and scans. Catalog import/export now lives under Maintenance.
-          </p>
-        </div>
-        <div className={cn("flex gap-2", activeTab !== "libraries" && "hidden")}>
-          {activeScanGroups.length > 0 && (
-            <ScanQueuePopover
-              groups={activeScanGroups}
-              cancellingLibraryID={
-                cancelScansMutation.isPending ? (cancelScansMutation.variables ?? null) : null
+      <PageHeader
+        title="Libraries"
+        subtitle="Manage library roots and scans. Catalog import/export now lives under Maintenance."
+        actions={
+          <div className="flex gap-2">
+            {activeScanGroups.length > 0 && (
+              <ScanQueuePopover
+                groups={activeScanGroups}
+                cancellingLibraryID={
+                  cancelScansMutation.isPending ? (cancelScansMutation.variables ?? null) : null
+                }
+                onCancel={(libraryID) => cancelScansMutation.mutate(libraryID)}
+              />
+            )}
+            <Button
+              variant="outline"
+              size="sm"
+              onClick={() => scanAllMutation.mutate()}
+              disabled={scanAllMutation.isPending}
+            >
+              <ScanLine className="h-3.5 w-3.5" />
+              Scan All Libraries
+            </Button>
+            <Button variant="outline" size="sm" asChild>
+              <Link to="/admin/maintenance">
+                <Wrench className="mr-1 h-4 w-4" />
+                Catalog Maintenance
+              </Link>
+            </Button>
+            <Button
+              size="sm"
+              onClick={() => {
+                setEditingLib(null);
+                setDialogOpen(true);
+              }}
+            >
+              <Plus className="mr-1 h-4 w-4" /> Add Library
+            </Button>
+            <LibraryEditorDialog
+              open={dialogOpen}
+              onOpenChange={(open) => {
+                setDialogOpen(open);
+                if (!open) setEditingLib(null);
+              }}
+              library={editingLib}
+              chapterThumbnailsSupported={
+                editingLib?.chapter_thumbnails_supported ??
+                libraries[0]?.chapter_thumbnails_supported ??
+                true
+              }
+              trickplaySupported={
+                editingLib?.trickplay_supported ??
+                libraries[0]?.trickplay_supported ??
+                (libraryCapabilities?.trickplay === true
+                  ? libraryCapabilities.trickplay_supported
+                  : undefined)
               }
-              onCancel={(libraryID) => cancelScansMutation.mutate(libraryID)}
             />
-          )}
-          <Button
-            variant="outline"
-            size="sm"
-            onClick={() => scanAllMutation.mutate()}
-            disabled={scanAllMutation.isPending}
-          >
-            <ScanLine className="h-3.5 w-3.5" />
-            Scan All Libraries
-          </Button>
-          <Button variant="outline" size="sm" asChild>
-            <Link to="/admin/maintenance">
-              <Wrench className="mr-1 h-4 w-4" />
-              Catalog Maintenance
-            </Link>
-          </Button>
-          <Button
-            size="sm"
-            onClick={() => {
-              setEditingLib(null);
-              setDialogOpen(true);
-            }}
-          >
-            <Plus className="mr-1 h-4 w-4" /> Add Library
-          </Button>
-          <LibraryEditorDialog
-            open={dialogOpen}
-            onOpenChange={(open) => {
-              setDialogOpen(open);
-              if (!open) setEditingLib(null);
-            }}
-            library={editingLib}
-            chapterThumbnailsSupported={
-              editingLib?.chapter_thumbnails_supported ??
-              libraries[0]?.chapter_thumbnails_supported ??
-              true
-            }
-            trickplaySupported={
-              editingLib?.trickplay_supported ??
-              libraries[0]?.trickplay_supported ??
-              (libraryCapabilities?.trickplay === true
-                ? libraryCapabilities.trickplay_supported
-                : undefined)
-            }
-          />
-          <LibraryRefreshDialog
-            libraryName={refreshLib?.name ?? null}
-            onOpenChange={(open) => {
-              // Keep the dialog up until the queued request settles.
-              if (!open && !refreshMutation.isPending) setRefreshLib(null);
-            }}
-            isPending={refreshMutation.isPending}
-            onConfirm={(mode) => {
-              if (!refreshLib) return;
-              const id = refreshLib.id;
-              refreshMutation.mutate(
-                { id, mode },
-                { onSettled: () => setRefreshLib((open) => (open?.id === id ? null : open)) },
-              );
-            }}
-          />
-        </div>
-      </div>
+            <LibraryRefreshDialog
+              libraryName={refreshLib?.name ?? null}
+              onOpenChange={(open) => {
+                // Keep the dialog up until the queued request settles.
+                if (!open && !refreshMutation.isPending) setRefreshLib(null);
+              }}
+              isPending={refreshMutation.isPending}
+              onConfirm={(mode) => {
+                if (!refreshLib) return;
+                const id = refreshLib.id;
+                refreshMutation.mutate(
+                  { id, mode },
+                  { onSettled: () => setRefreshLib((open) => (open?.id === id ? null : open)) },
+                );
+              }}
+            />
+          </div>
+        }
+      />
 
-      <Tabs value={activeTab} onValueChange={setActiveTab} className="gap-6">
-        <TabsList variant="line" className="border-border w-full justify-start border-b">
-          <TabsTrigger value="libraries">Libraries</TabsTrigger>
-          <TabsTrigger value="autoscan">Autoscan</TabsTrigger>
-        </TabsList>
-
-        <TabsContent value="libraries" className="space-y-6">
-          <DndContext
-            sensors={sensors}
-            collisionDetection={closestCenter}
-            onDragStart={handleDragStart}
-            onDragEnd={handleDragEnd}
-            onDragCancel={handleDragCancel}
-          >
-            <div className="surface-panel overflow-x-auto rounded-2xl border-0">
-              <Table>
-                <TableHeader>
-                  <TableRow>
-                    <TableHead className="w-10" />
-                    <TableHead>Name</TableHead>
-                    <TableHead>Paths</TableHead>
-                    <TableHead>Type</TableHead>
-                    <TableHead>Status</TableHead>
-                    <TableHead>Last Scanned</TableHead>
-                    <TableHead className="w-[15rem]">Actions</TableHead>
-                  </TableRow>
-                </TableHeader>
-                <SortableContext
-                  items={orderedLibraries.map((l) => l.id)}
-                  strategy={verticalListSortingStrategy}
-                >
-                  <TableBody>
-                    {orderedLibraries.map((lib) => {
-                      const isScanning =
-                        scanMutation.isPending && scanMutation.variables === lib.id;
-                      const activeRefreshJob = activeRefreshJobsByLibraryId.get(lib.id);
-                      const activeLibraryScans = activeScansByLibraryId.get(lib.id) ?? [];
-                      const runningLibraryScans = activeLibraryScans.filter(
-                        (scan) => scan.status === "running",
-                      ).length;
-                      const queuedLibraryScans = activeLibraryScans.length - runningLibraryScans;
-                      const isRefreshStarting =
-                        refreshMutation.isPending && refreshMutation.variables?.id === lib.id;
-                      const isCheckingMount =
-                        mountCheckMutation.isPending && mountCheckMutation.variables === lib.id;
-                      const mountCheck = lastMountCheckByLibraryId[lib.id];
-                      const hasActiveWork =
-                        activeRefreshJob !== undefined || activeLibraryScans.length > 0;
-                      const isCancellingLibraryScans =
-                        cancelScansMutation.isPending && cancelScansMutation.variables === lib.id;
-                      const isCancellingRefreshJob =
-                        activeRefreshJob !== undefined &&
-                        cancelAdminJobMutation.isPending &&
-                        cancelAdminJobMutation.variables === activeRefreshJob.id;
-                      return (
-                        <Fragment key={lib.id}>
-                          <SortableLibraryRow id={lib.id}>
-                            <TableCell className="font-medium">{lib.name}</TableCell>
-                            <TableCell className="font-mono text-xs">
-                              {lib.paths.length === 1 ? (
-                                <span className="text-muted-foreground">{lib.paths[0]}</span>
-                              ) : (
-                                <button
-                                  type="button"
-                                  className="text-muted-foreground hover:text-foreground text-left transition-colors"
-                                  onClick={() => {
-                                    setEditingLib(lib);
-                                    setDialogOpen(true);
-                                  }}
-                                >
-                                  {lib.paths.length} folders
-                                </button>
-                              )}
-                            </TableCell>
-                            <TableCell>
-                              <Badge variant="secondary">{lib.type}</Badge>
-                            </TableCell>
-                            <TableCell>
-                              <div className="flex flex-col gap-1">
-                                <Badge variant={lib.enabled ? "outline" : "destructive"}>
-                                  {lib.enabled ? "Enabled" : "Disabled"}
-                                </Badge>
-                                {runningLibraryScans > 0 ? (
-                                  <Badge variant="secondary">{runningLibraryScans} running</Badge>
-                                ) : null}
-                                {queuedLibraryScans > 0 ? (
-                                  <Badge variant="secondary">{queuedLibraryScans} queued</Badge>
-                                ) : null}
-                                {lib.scan_warning_code === "empty_root" ? (
-                                  <Badge variant="destructive">Empty root guarded</Badge>
-                                ) : null}
-                                {lib.scan_warning_code === "dead_root" ? (
-                                  <Badge variant="destructive">Root unreachable</Badge>
-                                ) : null}
-                                {lib.scan_warning_code === "partial_walk" ? (
-                                  <Badge variant="destructive">Partial scan</Badge>
-                                ) : null}
-                                <RealtimeMonitoringBadge
-                                  entry={realtimeMonitoringByLibraryId.get(lib.id)}
-                                />
-                                <TrickplayLibraryBadge library={trickplayByLibraryId.get(lib.id)} />
+      <div className="space-y-6">
+        <DndContext
+          sensors={sensors}
+          collisionDetection={closestCenter}
+          onDragStart={handleDragStart}
+          onDragEnd={handleDragEnd}
+          onDragCancel={handleDragCancel}
+        >
+          <div className="surface-panel overflow-x-auto rounded-2xl border-0">
+            <Table>
+              <TableHeader>
+                <TableRow>
+                  <TableHead className="w-10" />
+                  <TableHead>Name</TableHead>
+                  <TableHead>Paths</TableHead>
+                  <TableHead>Type</TableHead>
+                  <TableHead>Status</TableHead>
+                  <TableHead>Last Scanned</TableHead>
+                  <TableHead className="w-[15rem]">Actions</TableHead>
+                </TableRow>
+              </TableHeader>
+              <SortableContext
+                items={orderedLibraries.map((l) => l.id)}
+                strategy={verticalListSortingStrategy}
+              >
+                <TableBody>
+                  {orderedLibraries.map((lib) => {
+                    const isScanning = scanMutation.isPending && scanMutation.variables === lib.id;
+                    const activeRefreshJob = activeRefreshJobsByLibraryId.get(lib.id);
+                    const activeLibraryScans = activeScansByLibraryId.get(lib.id) ?? [];
+                    const runningLibraryScans = activeLibraryScans.filter(
+                      (scan) => scan.status === "running",
+                    ).length;
+                    const queuedLibraryScans = activeLibraryScans.length - runningLibraryScans;
+                    const isRefreshStarting =
+                      refreshMutation.isPending && refreshMutation.variables?.id === lib.id;
+                    const isCheckingMount =
+                      mountCheckMutation.isPending && mountCheckMutation.variables === lib.id;
+                    const mountCheck = lastMountCheckByLibraryId[lib.id];
+                    const hasActiveWork =
+                      activeRefreshJob !== undefined || activeLibraryScans.length > 0;
+                    const isCancellingLibraryScans =
+                      cancelScansMutation.isPending && cancelScansMutation.variables === lib.id;
+                    const isCancellingRefreshJob =
+                      activeRefreshJob !== undefined &&
+                      cancelAdminJobMutation.isPending &&
+                      cancelAdminJobMutation.variables === activeRefreshJob.id;
+                    return (
+                      <Fragment key={lib.id}>
+                        <SortableLibraryRow id={lib.id}>
+                          <TableCell className="font-medium">{lib.name}</TableCell>
+                          <TableCell className="font-mono text-xs">
+                            {lib.paths.length === 1 ? (
+                              <span className="text-muted-foreground">{lib.paths[0]}</span>
+                            ) : (
+                              <button
+                                type="button"
+                                className="text-muted-foreground hover:text-foreground text-left transition-colors"
+                                onClick={() => {
+                                  setEditingLib(lib);
+                                  setDialogOpen(true);
+                                }}
+                              >
+                                {lib.paths.length} folders
+                              </button>
+                            )}
+                          </TableCell>
+                          <TableCell>
+                            <Badge variant="secondary">{lib.type}</Badge>
+                          </TableCell>
+                          <TableCell>
+                            <div className="flex flex-col gap-1">
+                              <Badge variant={lib.enabled ? "outline" : "destructive"}>
+                                {lib.enabled ? "Enabled" : "Disabled"}
+                              </Badge>
+                              {runningLibraryScans > 0 ? (
+                                <Badge variant="secondary">{runningLibraryScans} running</Badge>
+                              ) : null}
+                              {queuedLibraryScans > 0 ? (
+                                <Badge variant="secondary">{queuedLibraryScans} queued</Badge>
+                              ) : null}
+                              {lib.scan_warning_code === "empty_root" ? (
+                                <Badge variant="destructive">Empty root guarded</Badge>
+                              ) : null}
+                              {lib.scan_warning_code === "dead_root" ? (
+                                <Badge variant="destructive">Root unreachable</Badge>
+                              ) : null}
+                              {lib.scan_warning_code === "partial_walk" ? (
+                                <Badge variant="destructive">Partial scan</Badge>
+                              ) : null}
+                              <RealtimeMonitoringBadge
+                                entry={realtimeMonitoringByLibraryId.get(lib.id)}
+                              />
+                              <TrickplayLibraryBadge library={trickplayByLibraryId.get(lib.id)} />
+                            </div>
+                          </TableCell>
+                          <TableCell className="text-muted-foreground text-xs">
+                            <div className="space-y-1">
+                              <div>
+                                {lib.last_scanned_at
+                                  ? formatDateTime(lib.last_scanned_at)
+                                  : "Never"}
                               </div>
-                            </TableCell>
-                            <TableCell className="text-muted-foreground text-xs">
-                              <div className="space-y-1">
-                                <div>
-                                  {lib.last_scanned_at
-                                    ? formatDateTime(lib.last_scanned_at)
-                                    : "Never"}
+                              {lib.scan_warning_at ? (
+                                <div className="text-destructive text-[11px]">
+                                  Warning: {formatDateTime(lib.scan_warning_at)}
                                 </div>
-                                {lib.scan_warning_at ? (
-                                  <div className="text-destructive text-[11px]">
-                                    Warning: {formatDateTime(lib.scan_warning_at)}
-                                  </div>
-                                ) : null}
-                              </div>
-                            </TableCell>
-                            <TableCell className="w-[15rem] align-middle">
-                              <div className="flex flex-nowrap items-center justify-end gap-1">
-                                <Button
-                                  variant="ghost"
-                                  size="icon"
-                                  className={cn(
-                                    "h-7 w-7",
-                                    activeLibraryScans.length > 0 && "text-destructive",
-                                  )}
-                                  title={
-                                    activeLibraryScans.length > 0
-                                      ? "Stop Library Scans"
-                                      : "Scan Library"
+                              ) : null}
+                            </div>
+                          </TableCell>
+                          <TableCell className="w-[15rem] align-middle">
+                            <div className="flex flex-nowrap items-center justify-end gap-1">
+                              <Button
+                                variant="ghost"
+                                size="icon"
+                                className={cn(
+                                  "h-7 w-7",
+                                  activeLibraryScans.length > 0 && "text-destructive",
+                                )}
+                                title={
+                                  activeLibraryScans.length > 0
+                                    ? "Stop Library Scans"
+                                    : "Scan Library"
+                                }
+                                aria-label={
+                                  activeLibraryScans.length > 0
+                                    ? "Stop Library Scans"
+                                    : "Scan Library"
+                                }
+                                disabled={
+                                  activeLibraryScans.length > 0
+                                    ? isCancellingLibraryScans
+                                    : isScanning
+                                }
+                                onClick={() => {
+                                  if (activeLibraryScans.length > 0) {
+                                    cancelScansMutation.mutate(lib.id);
+                                    return;
                                   }
-                                  aria-label={
-                                    activeLibraryScans.length > 0
-                                      ? "Stop Library Scans"
-                                      : "Scan Library"
-                                  }
-                                  disabled={
-                                    activeLibraryScans.length > 0
-                                      ? isCancellingLibraryScans
-                                      : isScanning
+                                  scanMutation.mutate(lib.id);
+                                }}
+                              >
+                                {activeLibraryScans.length > 0 ? (
+                                  <Square className="h-3 w-3 fill-current" />
+                                ) : (
+                                  <RefreshCw
+                                    className={`h-3 w-3 ${isScanning ? "animate-spin" : ""}`}
+                                  />
+                                )}
+                              </Button>
+                              <Button
+                                variant="ghost"
+                                size="icon"
+                                className={cn("h-7 w-7", activeRefreshJob && "text-destructive")}
+                                title={
+                                  activeRefreshJob ? "Stop Metadata Refresh" : "Rescan Metadata"
+                                }
+                                aria-label={
+                                  activeRefreshJob ? "Stop Metadata Refresh" : "Rescan Metadata"
+                                }
+                                disabled={
+                                  activeRefreshJob ? isCancellingRefreshJob : isRefreshStarting
+                                }
+                                onClick={() => {
+                                  if (activeRefreshJob) {
+                                    cancelAdminJobMutation.mutate(activeRefreshJob.id);
+                                    return;
                                   }
-                                  onClick={() => {
-                                    if (activeLibraryScans.length > 0) {
-                                      cancelScansMutation.mutate(lib.id);
-                                      return;
-                                    }
-                                    scanMutation.mutate(lib.id);
-                                  }}
-                                >
-                                  {activeLibraryScans.length > 0 ? (
-                                    <Square className="h-3 w-3 fill-current" />
-                                  ) : (
-                                    <RefreshCw
-                                      className={`h-3 w-3 ${isScanning ? "animate-spin" : ""}`}
-                                    />
-                                  )}
-                                </Button>
+                                  setRefreshLib(lib);
+                                }}
+                              >
+                                {activeRefreshJob ? (
+                                  <Square className="h-3 w-3 fill-current" />
+                                ) : (
+                                  <DatabaseBackup className="h-3 w-3" />
+                                )}
+                              </Button>
+                              <Button
+                                variant="ghost"
+                                size="icon"
+                                className="h-7 w-7"
+                                title={
+                                  mountCheck ? formatMountCheckMessage(mountCheck) : "Verify Mounts"
+                                }
+                                aria-label={
+                                  mountCheck ? formatMountCheckMessage(mountCheck) : "Verify Mounts"
+                                }
+                                disabled={isCheckingMount}
+                                onClick={() => handleMountCheck(lib.id)}
+                              >
+                                <MountCheckButtonIcon
+                                  pending={isCheckingMount}
+                                  result={mountCheck}
+                                />
+                              </Button>
+                              <Button
+                                variant="ghost"
+                                size="icon"
+                                className="h-7 w-7"
+                                aria-label={`Edit ${lib.name}`}
+                                onClick={() => {
+                                  setEditingLib(lib);
+                                  setDialogOpen(true);
+                                }}
+                              >
+                                <Pencil className="h-3 w-3" aria-hidden="true" />
+                              </Button>
+                              <Button
+                                variant="ghost"
+                                size="icon"
+                                className="h-7 w-7"
+                                aria-label={`Delete ${lib.name}`}
+                                onClick={() => handleDelete(lib)}
+                              >
+                                <Trash2 className="h-3 w-3" aria-hidden="true" />
+                              </Button>
+                              {lib.scan_warning_code === "empty_root" ||
+                              lib.scan_warning_code === "dead_root" ? (
                                 <Button
                                   variant="ghost"
                                   size="icon"
-                                  className={cn("h-7 w-7", activeRefreshJob && "text-destructive")}
-                                  title={
-                                    activeRefreshJob ? "Stop Metadata Refresh" : "Rescan Metadata"
-                                  }
-                                  aria-label={
-                                    activeRefreshJob ? "Stop Metadata Refresh" : "Rescan Metadata"
-                                  }
+                                  className="text-destructive h-7 w-7"
+                                  title="Confirm cleanup for missing or empty roots"
                                   disabled={
-                                    activeRefreshJob ? isCancellingRefreshJob : isRefreshStarting
+                                    confirmEmptyRootCleanupMutation.isPending &&
+                                    confirmEmptyRootCleanupMutation.variables === lib.id
                                   }
-                                  onClick={() => {
-                                    if (activeRefreshJob) {
-                                      cancelAdminJobMutation.mutate(activeRefreshJob.id);
-                                      return;
-                                    }
-                                    setRefreshLib(lib);
-                                  }}
+                                  onClick={() => handleConfirmEmptyRootCleanup(lib)}
                                 >
-                                  {activeRefreshJob ? (
-                                    <Square className="h-3 w-3 fill-current" />
-                                  ) : (
-                                    <DatabaseBackup className="h-3 w-3" />
-                                  )}
+                                  <Trash2 className="h-3 w-3" />
                                 </Button>
+                              ) : null}
+                            </div>
+                          </TableCell>
+                        </SortableLibraryRow>
+                        {hasActiveWork ? (
+                          <LibraryActiveWorkRow
+                            activeLibraryScans={activeLibraryScans}
+                            activeRefreshJob={activeRefreshJob}
+                            cancellingJobID={
+                              cancelAdminJobMutation.isPending
+                                ? cancelAdminJobMutation.variables
+                                : undefined
+                            }
+                            cancellingLibraryID={
+                              cancelScansMutation.isPending
+                                ? cancelScansMutation.variables
+                                : undefined
+                            }
+                            libraryID={lib.id}
+                            onCancelJob={(jobID) => cancelAdminJobMutation.mutate(jobID)}
+                            onCancelScans={(libraryID) => cancelScansMutation.mutate(libraryID)}
+                          />
+                        ) : null}
+                      </Fragment>
+                    );
+                  })}
+                  {orderedLibraries
+                    .filter(
+                      (lib) =>
+                        lib.scan_warning_code === "empty_root" ||
+                        lib.scan_warning_code === "dead_root" ||
+                        lib.scan_warning_code === "partial_walk",
+                    )
+                    .map((lib) => {
+                      if (lib.scan_warning_code === "partial_walk") {
+                        return (
+                          <TableRow key={`${lib.id}-warning`}>
+                            <TableCell colSpan={7} className="bg-destructive/5 text-sm">
+                              <div className="flex flex-col gap-2 py-1">
+                                <div className="text-destructive font-medium">Partial scan</div>
+                                <div className="text-muted-foreground">
+                                  {lib.scan_warning_message ??
+                                    "Some paths could not be read. Run another scan after storage is available."}
+                                </div>
+                              </div>
+                            </TableCell>
+                          </TableRow>
+                        );
+                      }
+                      const mountCheck = lastMountCheckByLibraryId[lib.id];
+                      const isCheckingMount =
+                        mountCheckMutation.isPending && mountCheckMutation.variables === lib.id;
+                      return (
+                        <TableRow key={`${lib.id}-warning`}>
+                          <TableCell colSpan={7} className="bg-destructive/5 text-sm">
+                            <div className="flex flex-col gap-2 py-1">
+                              <div className="text-destructive font-medium">
+                                {lib.scan_warning_code === "dead_root"
+                                  ? DEAD_ROOT_WARNING_TEXT
+                                  : EMPTY_ROOT_WARNING_TEXT}
+                              </div>
+                              <div className="text-muted-foreground">
+                                {lib.scan_warning_message ??
+                                  (lib.scan_warning_code === "dead_root"
+                                    ? DEAD_ROOT_WARNING_HINT
+                                    : EMPTY_ROOT_WARNING_HINT)}
+                              </div>
+                              <div className="flex gap-2">
                                 <Button
-                                  variant="ghost"
-                                  size="icon"
-                                  className="h-7 w-7"
+                                  variant="outline"
+                                  size="sm"
                                   title={
-                                    mountCheck
-                                      ? formatMountCheckMessage(mountCheck)
-                                      : "Verify Mounts"
-                                  }
-                                  aria-label={
-                                    mountCheck
-                                      ? formatMountCheckMessage(mountCheck)
-                                      : "Verify Mounts"
+                                    mountCheck ? formatMountCheckMessage(mountCheck) : "Check mount"
                                   }
                                   disabled={isCheckingMount}
                                   onClick={() => handleMountCheck(lib.id)}
                                 >
                                   <MountCheckButtonIcon
+                                    className="mr-1 h-3.5 w-3.5"
                                     pending={isCheckingMount}
                                     result={mountCheck}
                                   />
+                                  Check Mount
                                 </Button>
-                                <Button
-                                  variant="ghost"
-                                  size="icon"
-                                  className="h-7 w-7"
-                                  aria-label={`Edit ${lib.name}`}
-                                  onClick={() => {
-                                    setEditingLib(lib);
-                                    setDialogOpen(true);
-                                  }}
-                                >
-                                  <Pencil className="h-3 w-3" aria-hidden="true" />
-                                </Button>
-                                <Button
-                                  variant="ghost"
-                                  size="icon"
-                                  className="h-7 w-7"
-                                  aria-label={`Delete ${lib.name}`}
-                                  onClick={() => handleDelete(lib)}
-                                >
-                                  <Trash2 className="h-3 w-3" aria-hidden="true" />
-                                </Button>
-                                {lib.scan_warning_code === "empty_root" ||
-                                lib.scan_warning_code === "dead_root" ? (
+                                {lib.scan_warning_code === "dead_root" ? (
                                   <Button
-                                    variant="ghost"
-                                    size="icon"
-                                    className="text-destructive h-7 w-7"
+                                    variant="outline"
+                                    size="sm"
                                     title="Confirm cleanup for missing or empty roots"
                                     disabled={
                                       confirmEmptyRootCleanupMutation.isPending &&
@@ -702,157 +772,55 @@ export default function AdminLibraries() {
                                     }
                                     onClick={() => handleConfirmEmptyRootCleanup(lib)}
                                   >
-                                    <Trash2 className="h-3 w-3" />
+                                    <Trash2 className="mr-1 h-3.5 w-3.5" />
+                                    Confirm Cleanup
                                   </Button>
                                 ) : null}
                               </div>
-                            </TableCell>
-                          </SortableLibraryRow>
-                          {hasActiveWork ? (
-                            <LibraryActiveWorkRow
-                              activeLibraryScans={activeLibraryScans}
-                              activeRefreshJob={activeRefreshJob}
-                              cancellingJobID={
-                                cancelAdminJobMutation.isPending
-                                  ? cancelAdminJobMutation.variables
-                                  : undefined
-                              }
-                              cancellingLibraryID={
-                                cancelScansMutation.isPending
-                                  ? cancelScansMutation.variables
-                                  : undefined
-                              }
-                              libraryID={lib.id}
-                              onCancelJob={(jobID) => cancelAdminJobMutation.mutate(jobID)}
-                              onCancelScans={(libraryID) => cancelScansMutation.mutate(libraryID)}
-                            />
-                          ) : null}
-                        </Fragment>
+                            </div>
+                          </TableCell>
+                        </TableRow>
                       );
                     })}
-                    {orderedLibraries
-                      .filter(
-                        (lib) =>
-                          lib.scan_warning_code === "empty_root" ||
-                          lib.scan_warning_code === "dead_root" ||
-                          lib.scan_warning_code === "partial_walk",
-                      )
-                      .map((lib) => {
-                        if (lib.scan_warning_code === "partial_walk") {
-                          return (
-                            <TableRow key={`${lib.id}-warning`}>
-                              <TableCell colSpan={7} className="bg-destructive/5 text-sm">
-                                <div className="flex flex-col gap-2 py-1">
-                                  <div className="text-destructive font-medium">Partial scan</div>
-                                  <div className="text-muted-foreground">
-                                    {lib.scan_warning_message ??
-                                      "Some paths could not be read. Run another scan after storage is available."}
-                                  </div>
-                                </div>
-                              </TableCell>
-                            </TableRow>
-                          );
-                        }
-                        const mountCheck = lastMountCheckByLibraryId[lib.id];
-                        const isCheckingMount =
-                          mountCheckMutation.isPending && mountCheckMutation.variables === lib.id;
-                        return (
-                          <TableRow key={`${lib.id}-warning`}>
-                            <TableCell colSpan={7} className="bg-destructive/5 text-sm">
-                              <div className="flex flex-col gap-2 py-1">
-                                <div className="text-destructive font-medium">
-                                  {lib.scan_warning_code === "dead_root"
-                                    ? DEAD_ROOT_WARNING_TEXT
-                                    : EMPTY_ROOT_WARNING_TEXT}
-                                </div>
-                                <div className="text-muted-foreground">
-                                  {lib.scan_warning_message ??
-                                    (lib.scan_warning_code === "dead_root"
-                                      ? DEAD_ROOT_WARNING_HINT
-                                      : EMPTY_ROOT_WARNING_HINT)}
-                                </div>
-                                <div className="flex gap-2">
-                                  <Button
-                                    variant="outline"
-                                    size="sm"
-                                    title={
-                                      mountCheck
-                                        ? formatMountCheckMessage(mountCheck)
-                                        : "Check mount"
-                                    }
-                                    disabled={isCheckingMount}
-                                    onClick={() => handleMountCheck(lib.id)}
-                                  >
-                                    <MountCheckButtonIcon
-                                      className="mr-1 h-3.5 w-3.5"
-                                      pending={isCheckingMount}
-                                      result={mountCheck}
-                                    />
-                                    Check Mount
-                                  </Button>
-                                  {lib.scan_warning_code === "dead_root" ? (
-                                    <Button
-                                      variant="outline"
-                                      size="sm"
-                                      title="Confirm cleanup for missing or empty roots"
-                                      disabled={
-                                        confirmEmptyRootCleanupMutation.isPending &&
-                                        confirmEmptyRootCleanupMutation.variables === lib.id
-                                      }
-                                      onClick={() => handleConfirmEmptyRootCleanup(lib)}
-                                    >
-                                      <Trash2 className="mr-1 h-3.5 w-3.5" />
-                                      Confirm Cleanup
-                                    </Button>
-                                  ) : null}
-                                </div>
-                              </div>
-                            </TableCell>
-                          </TableRow>
-                        );
-                      })}
-                  </TableBody>
-                </SortableContext>
+                </TableBody>
+              </SortableContext>
+            </Table>
+          </div>
+          <DragOverlay>
+            {activeLibrary ? (
+              <Table>
+                <TableBody>
+                  <TableRow className="bg-background shadow-lg">
+                    <TableCell className="w-10">
+                      <GripVertical className="text-muted-foreground h-4 w-4" />
+                    </TableCell>
+                    <TableCell className="font-medium">{activeLibrary.name}</TableCell>
+                    <TableCell className="text-muted-foreground font-mono text-xs">
+                      {activeLibrary.paths.length === 1
+                        ? activeLibrary.paths[0]
+                        : `${activeLibrary.paths.length} folders`}
+                    </TableCell>
+                    <TableCell>
+                      <Badge variant="secondary">{activeLibrary.type}</Badge>
+                    </TableCell>
+                    <TableCell />
+                    <TableCell />
+                    <TableCell />
+                  </TableRow>
+                </TableBody>
               </Table>
-            </div>
-            <DragOverlay>
-              {activeLibrary ? (
-                <Table>
-                  <TableBody>
-                    <TableRow className="bg-background shadow-lg">
-                      <TableCell className="w-10">
-                        <GripVertical className="text-muted-foreground h-4 w-4" />
-                      </TableCell>
-                      <TableCell className="font-medium">{activeLibrary.name}</TableCell>
-                      <TableCell className="text-muted-foreground font-mono text-xs">
-                        {activeLibrary.paths.length === 1
-                          ? activeLibrary.paths[0]
-                          : `${activeLibrary.paths.length} folders`}
-                      </TableCell>
-                      <TableCell>
-                        <Badge variant="secondary">{activeLibrary.type}</Badge>
-                      </TableCell>
-                      <TableCell />
-                      <TableCell />
-                      <TableCell />
-                    </TableRow>
-                  </TableBody>
-                </Table>
-              ) : null}
-            </DragOverlay>
-          </DndContext>
-
-          <UnmatchedItemsSection />
-          <MetadataMatcherQueuesSection libraries={libraries} />
-          <AmbiguousRootsSection libraries={libraries} />
-          <SkippedRootsSection />
-          <StaleIDsSection />
-        </TabsContent>
-
-        <TabsContent value="autoscan">
-          <AdminAutoscan embedded />
-        </TabsContent>
-      </Tabs>
+            ) : null}
+          </DragOverlay>
+        </DndContext>
+
+        <UnmatchedItemsSection />
+        <MetadataMatcherQueuesSection libraries={libraries} />
+        <AmbiguousRootsSection libraries={libraries} />
+        <SkippedRootsSection />
+        <StaleIDsSection />
+      </div>
+      {/* After the content so its padded row never pushes the page header down. */}
+      <JobPageControls query={refreshJobsQuery} label="Load older refresh jobs" />
     </div>
   );
 }
@@ -2064,6 +2032,10 @@ function SkippedRootsSection() {
 
 /* ─── Unmatched Items ──────────────────────────────────────────── */
 
+// IGNORABLE_UNMATCHED_TYPES are the content types an admin can mark as
+// intentionally unmatched.
+const IGNORABLE_UNMATCHED_TYPES = new Set(["movie", "series"]);
+
 function UnmatchedItemsSection() {
   const [open, setOpen] = useState(false);
   const navigationVersion = useRef(0);
@@ -2076,12 +2048,23 @@ function UnmatchedItemsSection() {
   const [page, setPage] = useState(0);
   const [search, setSearch] = useState("");
   const debouncedSearch = useDebounce(search, 250);
+  // "ignored" lists the items an admin marked as intentionally unmatched.
+  const [view, setView] = useState<"unmatched" | "ignored">("unmatched");
+  const ignoredView = view === "ignored";
   const [matchItem, setMatchItem] = useState<UnmatchedLibraryItem | null>(null);
+  const setIgnored = useSetUnmatchedItemIgnored();
   // The listing is an infinite query that retains each loaded page's cursor:
   // `page` indexes the loaded pages, Next fetches only when the next page is
   // not loaded yet, and a refetch refreshes the loaded pages in place.
-  const { data, hasNextPage, fetchNextPage, isFetching } =
-    useUnmatchedLibraryItems(debouncedSearch);
+  const { data, hasNextPage, fetchNextPage, isFetching } = useUnmatchedLibraryItems(
+    debouncedSearch,
+    ignoredView,
+  );
+  // Unfiltered totals of both views, for the header count and for hiding the
+  // section; each shares its cache entry with the listing while no search
+  // is active.
+  const awaitingTotal = useUnmatchedLibraryItems("", false).data?.pages[0]?.total;
+  const ignoredTotal = useUnmatchedLibraryItems("", true).data?.pages[0]?.total;
   const loadedPages = data?.pages ?? [];
   const total = loadedPages[0]?.total ?? 0;
   const totalPages = Math.max(1, Math.ceil(total / UNMATCHED_PAGE_SIZE));
@@ -2113,34 +2096,67 @@ function UnmatchedItemsSection() {
     })();
   };
 
-  // Hide the section only when there are genuinely no unmatched items and no
-  // active search — keep it mounted while searching so the box and the
-  // "no matches" state stay visible even when a query returns nothing.
-  if (total === 0 && page === 0 && search.trim() === "") return null;
+  // Hide the section only while it is closed and nothing is unmatched or
+  // ignored. Once open it stays mounted, so the search box and the empty
+  // states stay put while a search or an Ignore refetches the listings.
+  if (!open && !awaitingTotal && !ignoredTotal && search.trim() === "") return null;
+
+  const emptyMessage = ignoredView
+    ? search.trim()
+      ? "No ignored items match your search."
+      : "No items are ignored."
+    : search.trim()
+      ? "No unmatched items match your search."
+      : "No items are awaiting a match.";
 
   return (
     <CollapsibleDiagnosticsSection
       title="Unmatched Items"
       description="Items that could not be matched to any metadata provider."
-      count={total}
+      count={awaitingTotal}
       icon={<Search className="h-4 w-4 text-amber-500" />}
       open={open}
       onOpenChange={setOpen}
     >
-      <div className="relative mb-2">
-        <Search className="text-muted-foreground pointer-events-none absolute top-1/2 left-2.5 h-3.5 w-3.5 -translate-y-1/2" />
-        <Input
-          placeholder="Search all unmatched items by title, library, or type..."
-          value={search}
-          onChange={(e) => {
-            // Search is server-side and spans the whole table; jump back to
-            // the first page so results start at the top as the query changes.
+      <div className="mb-2 flex flex-col gap-2 sm:flex-row">
+        <Select
+          value={view}
+          onValueChange={(value) => {
             navigationVersion.current++;
-            setSearch(e.target.value);
+            setView(value === "ignored" ? "ignored" : "unmatched");
             setPage(0);
           }}
-          className="h-8 pl-8 text-xs"
-        />
+        >
+          <SelectTrigger
+            aria-label="Unmatched item view"
+            className="h-8 w-full text-xs sm:w-[180px]"
+          >
+            <SelectValue />
+          </SelectTrigger>
+          <SelectContent>
+            <SelectItem value="unmatched">Awaiting a match</SelectItem>
+            <SelectItem value="ignored">Ignored</SelectItem>
+          </SelectContent>
+        </Select>
+        <div className="relative flex-1">
+          <Search className="text-muted-foreground pointer-events-none absolute top-1/2 left-2.5 h-3.5 w-3.5 -translate-y-1/2" />
+          <Input
+            placeholder={
+              ignoredView
+                ? "Search ignored items by title, library, or type..."
+                : "Search all unmatched items by title, library, or type..."
+            }
+            value={search}
+            onChange={(e) => {
+              // Search is server-side and spans the whole table; jump back to
+              // the first page so results start at the top as the query changes.
+              navigationVersion.current++;
+              setSearch(e.target.value);
+              setPage(0);
+            }}
+            className="h-8 pl-8 text-xs"
+          />
+        </div>
       </div>
       <div className="border-border/40 bg-background/40 overflow-x-auto rounded-xl border">
         <Table>
@@ -2150,14 +2166,14 @@ function UnmatchedItemsSection() {
               <TableHead>Library</TableHead>
               <TableHead>Type</TableHead>
               <TableHead>Status</TableHead>
-              <TableHead className="w-[100px]">Actions</TableHead>
+              <TableHead className="w-[190px]">Actions</TableHead>
             </TableRow>
           </TableHeader>
           <TableBody>
             {items.length === 0 ? (
               <TableRow>
                 <TableCell colSpan={5} className="text-muted-foreground text-center text-sm">
-                  No unmatched items match your search.
+                  {emptyMessage}
                 </TableCell>
               </TableRow>
             ) : (
@@ -2182,15 +2198,48 @@ function UnmatchedItemsSection() {
                     <Badge variant="secondary">{u.status}</Badge>
                   </TableCell>
                   <TableCell>
-                    <Button
-                      variant="outline"
-                      size="sm"
-                      className="h-7 gap-1 text-xs"
-                      onClick={() => setMatchItem(u)}
-                    >
-                      <Search className="h-3 w-3" />
-                      Match
-                    </Button>
+                    <div className="flex gap-1">
+                      <Button
+                        variant="outline"
+                        size="sm"
+                        className="h-7 gap-1 text-xs"
+                        onClick={() => setMatchItem(u)}
+                      >
+                        <Search className="h-3 w-3" />
+                        Match
+                      </Button>
+                      {/* Books keep their own enrichment, so only a movie or series can be ignored. */}
+                      {ignoredView || IGNORABLE_UNMATCHED_TYPES.has(u.content_type) ? (
+                        <Button
+                          variant="ghost"
+                          size="sm"
+                          className="h-7 gap-1 text-xs"
+                          disabled={
+                            setIgnored.isPending && setIgnored.variables?.contentId === u.content_id
+                          }
+                          aria-label={`${ignoredView ? "Restore" : "Ignore"} ${u.title}`}
+                          title={
+                            ignoredView
+                              ? "Put this item back on the unmatched list so Prairie tries to match it again"
+                              : "Mark this item as intentionally unmatched: Prairie stops trying to match it and moves it to the Ignored view"
+                          }
+                          onClick={() =>
+                            setIgnored.mutate({
+                              contentId: u.content_id,
+                              title: u.title,
+                              ignored: !ignoredView,
+                            })
+                          }
+                        >
+                          {ignoredView ? (
+                            <Undo2 className="h-3 w-3" />
+                          ) : (
+                            <EyeOff className="h-3 w-3" />
+                          )}
+                          {ignoredView ? "Restore" : "Ignore"}
+                        </Button>
+                      ) : null}
+                    </div>
                   </TableCell>
                 </TableRow>
               ))
diff --git a/web/src/pages/AdminLogs.tsx b/web/src/pages/AdminLogs.tsx
index 30906a8a7a..9f2c69cd7c 100644
--- a/web/src/pages/AdminLogs.tsx
+++ b/web/src/pages/AdminLogs.tsx
@@ -1,6 +1,7 @@
 import { memo, useMemo, useState } from "react";
 import type { ReactNode } from "react";
 import { useSearchParams } from "react-router";
+import { PageHeader } from "@/components/page/PageHeader";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import {
@@ -140,38 +141,36 @@ function AdminLogsPage() {
 
   return (
     <div className="space-y-6">
-      <div className="page-header gap-5">
-        <div className="space-y-3">
-          <h1 className="page-title text-[clamp(2rem,4vw,3rem)]">Logs</h1>
-          <p className="page-subtitle text-sm sm:text-base">
-            Search application logs and request audit trails without leaving the admin UI.
-          </p>
-        </div>
-        <div className="text-right">
-          <div className="text-muted-foreground text-xs font-medium tracking-[0.2em] uppercase">
-            Stream
-          </div>
-          <div className="text-sm">
-            {browsingHistory
-              ? "Historical results"
-              : formatConnectionState(activeStream.connectionState)}
+      <PageHeader
+        title="Logs"
+        subtitle="Search application logs and request audit trails without leaving the admin UI."
+        actions={
+          <div className="text-right">
+            <div className="text-muted-foreground text-xs font-medium tracking-[0.2em] uppercase">
+              Stream
+            </div>
+            <div className="text-sm">
+              {browsingHistory
+                ? "Historical results"
+                : formatConnectionState(activeStream.connectionState)}
+            </div>
+            {!browsingHistory && activeStream.error && (
+              <div className="text-muted-foreground text-xs">{activeStream.error}</div>
+            )}
+            {!browsingHistory && activeStream.connectionState === "disconnected" && (
+              <Button
+                variant="ghost"
+                size="sm"
+                className="mt-1 h-7 px-2 text-xs"
+                onClick={activeStream.reconnect}
+              >
+                <RefreshCw />
+                Reconnect
+              </Button>
+            )}
           </div>
-          {!browsingHistory && activeStream.error && (
-            <div className="text-muted-foreground text-xs">{activeStream.error}</div>
-          )}
-          {!browsingHistory && activeStream.connectionState === "disconnected" && (
-            <Button
-              variant="ghost"
-              size="sm"
-              className="mt-1 h-7 px-2 text-xs"
-              onClick={activeStream.reconnect}
-            >
-              <RefreshCw />
-              Reconnect
-            </Button>
-          )}
-        </div>
-      </div>
+        }
+      />
 
       <div className="surface-panel rounded-2xl border-0 px-3 py-3">
         <div className="flex flex-wrap items-center gap-2">
diff --git a/web/src/pages/AdminMaintenance.tsx b/web/src/pages/AdminMaintenance.tsx
index 6d628d36fa..a46b208cb6 100644
--- a/web/src/pages/AdminMaintenance.tsx
+++ b/web/src/pages/AdminMaintenance.tsx
@@ -1,18 +1,14 @@
 import AdminCatalogMaintenance from "@/components/AdminCatalogMaintenance";
 import AdminJobHistory from "@/components/AdminJobHistory";
+import { PageHeader } from "@/components/page/PageHeader";
 
 export default function AdminMaintenance() {
   return (
-    <div className="page-shell space-y-6 py-4 sm:py-6">
-      <div className="page-header gap-5">
-        <div className="space-y-3">
-          <h1 className="page-title text-[clamp(2rem,4vw,3rem)]">Maintenance</h1>
-          <p className="page-subtitle text-sm sm:text-base">
-            Operational tools that affect the whole catalog live here. Use this page for bulk
-            import/export workflows and other future maintenance actions.
-          </p>
-        </div>
-      </div>
+    <div className="space-y-6 pb-4 sm:pb-6">
+      <PageHeader
+        title="Maintenance"
+        subtitle="Operational tools that affect the whole catalog live here. Use this page for bulk import/export workflows and other future maintenance actions."
+      />
 
       <AdminCatalogMaintenance />
       <AdminJobHistory />
diff --git a/web/src/pages/AdminMarkerHistory.tsx b/web/src/pages/AdminMarkerHistory.tsx
index 25a411f28b..8ea51cc4ca 100644
--- a/web/src/pages/AdminMarkerHistory.tsx
+++ b/web/src/pages/AdminMarkerHistory.tsx
@@ -2,6 +2,7 @@ import { useState } from "react";
 import { Link } from "react-router";
 import { RefreshCw } from "lucide-react";
 import type { MarkerEditAuditEntry, MarkerSegment } from "@/api/types";
+import { PageHeader } from "@/components/page/PageHeader";
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
 import {
@@ -32,41 +33,39 @@ export default function AdminMarkerHistory() {
   const rows = history.data ?? [];
 
   return (
-    <div className="page-shell space-y-6 py-4 sm:py-6">
-      <div className="page-header gap-5">
-        <div className="space-y-2">
-          <h1 className="page-title text-[clamp(2rem,4vw,3rem)]">Marker History</h1>
-          <p className="page-subtitle text-sm sm:text-base">
-            Recent manual intro, recap, credits, and preview marker edits across the server.
-          </p>
-        </div>
-        <div className="flex items-center gap-2">
-          <Select value={limit} onValueChange={setLimit}>
-            <SelectTrigger className="w-[8rem]" aria-label="History limit">
-              <SelectValue />
-            </SelectTrigger>
-            <SelectContent>
-              {LIMIT_OPTIONS.map((option) => (
-                <SelectItem key={option} value={option}>
-                  {option} rows
-                </SelectItem>
-              ))}
-            </SelectContent>
-          </Select>
-          <Button
-            type="button"
-            variant="outline"
-            size="sm"
-            onClick={() => {
-              void history.refetch();
-            }}
-            disabled={history.isFetching}
-          >
-            <RefreshCw className={`size-4 ${history.isFetching ? "animate-spin" : ""}`} />
-            Refresh
-          </Button>
-        </div>
-      </div>
+    <div className="space-y-6 pb-4 sm:pb-6">
+      <PageHeader
+        title="Marker History"
+        subtitle="Recent manual intro, recap, credits, and preview marker edits across the server."
+        actions={
+          <div className="flex items-center gap-2">
+            <Select value={limit} onValueChange={setLimit}>
+              <SelectTrigger className="w-[8rem]" aria-label="History limit">
+                <SelectValue />
+              </SelectTrigger>
+              <SelectContent>
+                {LIMIT_OPTIONS.map((option) => (
+                  <SelectItem key={option} value={option}>
+                    {option} rows
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+            <Button
+              type="button"
+              variant="outline"
+              size="sm"
+              onClick={() => {
+                void history.refetch();
+              }}
+              disabled={history.isFetching}
+            >
+              <RefreshCw className={`size-4 ${history.isFetching ? "animate-spin" : ""}`} />
+              Refresh
+            </Button>
+          </div>
+        }
+      />
 
       <div className="border-border bg-surface overflow-hidden rounded-lg border">
         {history.isLoading ? (
diff --git a/web/src/pages/AdminNodes.tsx b/web/src/pages/AdminNodes.tsx
index f669d9f268..1c50c49de0 100644
--- a/web/src/pages/AdminNodes.tsx
+++ b/web/src/pages/AdminNodes.tsx
@@ -14,6 +14,7 @@ import {
   useSetNodeDrain,
   useToggleNode,
 } from "@/hooks/queries/admin/nodes";
+import { PageHeader } from "@/components/page/PageHeader";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
@@ -72,6 +73,7 @@ import {
   nodeUsesCUDADevices,
   parseHWDeviceOverride,
 } from "./adminNodesPresentation";
+import { NodeRoutingSettings } from "@/pages/admin-settings/NodeRoutingSettings";
 
 type NodeType = "proxy" | "transcode";
 
@@ -1306,19 +1308,14 @@ export default function AdminNodes() {
     }
   }
 
-  if (isLoading) return <div className="page-shell py-8">Loading nodes...</div>;
+  if (isLoading) return <div className="pb-8">Loading nodes...</div>;
 
   return (
-    <div className="page-shell space-y-8 py-4 sm:py-6">
-      <div className="page-header gap-5">
-        <div className="space-y-3">
-          <h1 className="page-title text-[clamp(2rem,4vw,3rem)]">Stream Nodes</h1>
-          <p className="page-subtitle text-sm sm:text-base">
-            Manage proxy and transcode workers that distribute playback load across your
-            infrastructure.
-          </p>
-        </div>
-      </div>
+    <div className="space-y-8 pb-4 sm:pb-6">
+      <PageHeader
+        title="Stream Nodes"
+        subtitle="Manage proxy and transcode workers that distribute playback load across your infrastructure."
+      />
 
       <NodeGroupFilter
         options={groupOptions}
@@ -1394,6 +1391,13 @@ export default function AdminNodes() {
         }
       />
 
+      <section aria-labelledby="node-routing-heading" className="max-w-3xl space-y-3">
+        <h2 id="node-routing-heading" className="text-lg font-semibold">
+          Routing
+        </h2>
+        <NodeRoutingSettings />
+      </section>
+
       <Dialog open={dialogOpen} onOpenChange={handleDialogChange}>
         <DialogContent>
           <DialogHeader>
diff --git a/web/src/pages/AdminPlaybackHistory.tsx b/web/src/pages/AdminPlaybackHistory.tsx
index 2be6e03f38..c22bad1b50 100644
--- a/web/src/pages/AdminPlaybackHistory.tsx
+++ b/web/src/pages/AdminPlaybackHistory.tsx
@@ -2,6 +2,7 @@ import { useCallback, useEffect, useRef, useState } from "react";
 import { Link, useSearchParams } from "react-router";
 import { useAdminUsers } from "@/hooks/queries/admin/users";
 import { useAdminPlaybackHistory, useAdminUserProfiles } from "@/hooks/queries/admin/history";
+import { PageHeader } from "@/components/page/PageHeader";
 import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
@@ -122,94 +123,94 @@ export default function AdminPlaybackHistory() {
   const activeMediaItemLabel = allRows[0]?.media_title || selectedMediaItemId;
 
   return (
-    <div className="page-shell space-y-6 py-4 sm:py-6">
-      <div className="page-header gap-5">
-        <div className="space-y-3">
-          <h1 className="page-title text-[clamp(2rem,4vw,3rem)]">Playback History</h1>
-          <p className="page-subtitle text-sm sm:text-base">
-            Finalized playback attempts across all users and profiles.
-          </p>
-        </div>
-        <div className="flex flex-wrap items-center gap-2">
-          {selectedMediaItemId && (
-            <div className="border-border bg-muted/40 flex items-center gap-2 rounded-md border px-3 py-2 text-xs">
-              <span className="text-muted-foreground font-medium">Item filter active</span>
-              <Link
-                to={`/item/${encodeURIComponent(selectedMediaItemId)}`}
-                className="hover:text-primary font-semibold transition-colors hover:underline"
-              >
-                {activeMediaItemLabel}
-              </Link>
-            </div>
-          )}
+    <div className="space-y-6 pb-4 sm:pb-6">
+      <PageHeader
+        title="Playback History"
+        subtitle="Finalized playback attempts across all users and profiles."
+        actions={
+          <div className="flex flex-wrap items-center gap-2">
+            {selectedMediaItemId && (
+              <div className="border-border bg-muted/40 flex items-center gap-2 rounded-md border px-3 py-2 text-xs">
+                <span className="text-muted-foreground font-medium">Item filter active</span>
+                <Link
+                  to={`/item/${encodeURIComponent(selectedMediaItemId)}`}
+                  className="hover:text-primary font-semibold transition-colors hover:underline"
+                >
+                  {activeMediaItemLabel}
+                </Link>
+              </div>
+            )}
 
-          <Select value={selectedUser} onValueChange={(value) => updateFilter("user_id", value)}>
-            <SelectTrigger className="w-full sm:w-[220px]">
-              <SelectValue placeholder="All users" />
-            </SelectTrigger>
-            <SelectContent>
-              <SelectItem value={ALL_USERS}>All users</SelectItem>
-              {users.map((user) => (
-                <SelectItem key={user.id} value={String(user.id)}>
-                  {user.username}
-                </SelectItem>
-              ))}
-            </SelectContent>
-          </Select>
+            <Select value={selectedUser} onValueChange={(value) => updateFilter("user_id", value)}>
+              <SelectTrigger className="w-full sm:w-[220px]">
+                <SelectValue placeholder="All users" />
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem value={ALL_USERS}>All users</SelectItem>
+                {users.map((user) => (
+                  <SelectItem key={user.id} value={String(user.id)}>
+                    {user.username}
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
 
-          <Select
-            value={selectedProfile}
-            onValueChange={(value) => updateFilter("profile_id", value)}
-            disabled={selectedUser === ALL_USERS}
-          >
-            <SelectTrigger className="w-full sm:w-[220px]">
-              <SelectValue
-                placeholder={selectedUser === ALL_USERS ? "Choose a user first" : "All profiles"}
-              />
-            </SelectTrigger>
-            <SelectContent>
-              <SelectItem value={ALL_PROFILES}>All profiles</SelectItem>
-              {(profiles.data ?? []).map((profile) => (
-                <SelectItem key={profile.id} value={profile.id}>
-                  {profile.name}
-                </SelectItem>
-              ))}
-            </SelectContent>
-          </Select>
+            <Select
+              value={selectedProfile}
+              onValueChange={(value) => updateFilter("profile_id", value)}
+              disabled={selectedUser === ALL_USERS}
+            >
+              <SelectTrigger className="w-full sm:w-[220px]">
+                <SelectValue
+                  placeholder={selectedUser === ALL_USERS ? "Choose a user first" : "All profiles"}
+                />
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem value={ALL_PROFILES}>All profiles</SelectItem>
+                {(profiles.data ?? []).map((profile) => (
+                  <SelectItem key={profile.id} value={profile.id}>
+                    {profile.name}
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
 
-          <Select
-            value={selectedCompleted}
-            onValueChange={(value) => updateFilter("completed", value)}
-          >
-            <SelectTrigger className="w-full sm:w-[180px]">
-              <SelectValue placeholder="All attempts" />
-            </SelectTrigger>
-            <SelectContent>
-              <SelectItem value={ALL_COMPLETION}>All attempts</SelectItem>
-              <SelectItem value="true">Completed</SelectItem>
-              <SelectItem value="false">Partial</SelectItem>
-            </SelectContent>
-          </Select>
+            <Select
+              value={selectedCompleted}
+              onValueChange={(value) => updateFilter("completed", value)}
+            >
+              <SelectTrigger className="w-full sm:w-[180px]">
+                <SelectValue placeholder="All attempts" />
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem value={ALL_COMPLETION}>All attempts</SelectItem>
+                <SelectItem value="true">Completed</SelectItem>
+                <SelectItem value="false">Partial</SelectItem>
+              </SelectContent>
+            </Select>
 
-          <Button variant="outline" size="sm" onClick={resetFilters}>
-            <RotateCcw />
-            Reset
-          </Button>
-          <Button
-            variant="outline"
-            size="sm"
-            className="min-w-[8.25rem] justify-center"
-            onClick={() => {
-              void refreshHistory();
-            }}
-            disabled={isManualRefreshPending}
-            aria-busy={isManualRefreshPending}
-          >
-            <RefreshCw className={`h-3.5 w-3.5 ${isManualRefreshPending ? "animate-spin" : ""}`} />
-            {isManualRefreshPending ? "Refreshing..." : "Refresh"}
-          </Button>
-        </div>
-      </div>
+            <Button variant="outline" size="sm" onClick={resetFilters}>
+              <RotateCcw />
+              Reset
+            </Button>
+            <Button
+              variant="outline"
+              size="sm"
+              className="min-w-[8.25rem] justify-center"
+              onClick={() => {
+                void refreshHistory();
+              }}
+              disabled={isManualRefreshPending}
+              aria-busy={isManualRefreshPending}
+            >
+              <RefreshCw
+                className={`h-3.5 w-3.5 ${isManualRefreshPending ? "animate-spin" : ""}`}
+              />
+              {isManualRefreshPending ? "Refreshing..." : "Refresh"}
+            </Button>
+          </div>
+        }
+      />
 
       <div className="grid grid-cols-1 gap-3 sm:grid-cols-3">
         <InfoCard label="Visible Rows" value={String(allRows.length)} />
diff --git a/web/src/pages/AdminPluginDetail.test.tsx b/web/src/pages/AdminPluginDetail.test.tsx
index 78279d8142..ce04d3c8ae 100644
--- a/web/src/pages/AdminPluginDetail.test.tsx
+++ b/web/src/pages/AdminPluginDetail.test.tsx
@@ -304,6 +304,25 @@ describe("AdminPluginDetail", () => {
     expect(restartMock).toHaveBeenCalledWith(7);
   });
 
+  it("shows the start error of a non-resident plugin without offering Restart", () => {
+    installationsQuery = query([
+      makeInstallation({
+        global_config_schema: [],
+        runtime: {
+          resident: false,
+          state: "failed",
+          restart_count: 0,
+          last_error: "start plugin process: exit status 2",
+        },
+      }),
+    ]);
+    renderPage();
+
+    expect(screen.getByText("MDBList Ratings failed to start.")).toBeInTheDocument();
+    expect(screen.getByText("start plugin process: exit status 2")).toBeInTheDocument();
+    expect(screen.queryByRole("button", { name: "Restart now" })).not.toBeInTheDocument();
+  });
+
   it.each([
     { enabled: false, resident: true, state: "running", visible: false, disabled: false },
     { enabled: true, resident: false, state: "stopped", visible: false, disabled: false },
diff --git a/web/src/pages/AdminPluginDetail.tsx b/web/src/pages/AdminPluginDetail.tsx
index a444f31774..2945ffc848 100644
--- a/web/src/pages/AdminPluginDetail.tsx
+++ b/web/src/pages/AdminPluginDetail.tsx
@@ -155,11 +155,7 @@ export default function AdminPluginDetail() {
 }
 
 function PageLoading() {
-  return (
-    <div className="page-shell text-muted-foreground py-16 text-center text-sm">
-      Loading plugin...
-    </div>
-  );
+  return <div className="text-muted-foreground pb-16 text-center text-sm">Loading plugin...</div>;
 }
 
 function AllPluginsLink() {
@@ -188,7 +184,7 @@ function BackLink({ fallback }: { fallback: string }) {
   );
 }
 
-function PageHeader({
+function PluginPageHeader({
   name,
   meta,
   actions,
@@ -201,7 +197,9 @@ function PageHeader({
     <div className="flex flex-wrap items-center gap-4">
       <PluginMonogram name={name} size="lg" />
       <div className="min-w-[220px] flex-1">
-        <h1 className="page-title text-3xl">{name}</h1>
+        <h1 className="text-[1.75rem] leading-[1.15] font-bold tracking-[-0.035em] text-balance sm:text-[2rem]">
+          {name}
+        </h1>
         <div className="text-muted-foreground mt-1.5 flex flex-wrap items-center gap-x-4 gap-y-1 text-[13.5px]">
           {meta}
         </div>
@@ -284,8 +282,7 @@ function InstalledPluginPage({
   const jobs = capabilityListLabel(capabilities);
   const runtimeProblem =
     installation.enabled &&
-    runtime.resident &&
-    (runtime.state === "failed" || runtime.state === "backoff");
+    (runtime.state === "failed" || (runtime.resident && runtime.state === "backoff"));
 
   const restartButton = (
     <Button
@@ -300,10 +297,10 @@ function InstalledPluginPage({
   );
 
   return (
-    <div className="page-shell space-y-5 py-4 sm:py-6">
+    <div className="space-y-5 pb-4 sm:pb-6">
       <BackLink fallback="/admin/plugins" />
 
-      <PageHeader
+      <PluginPageHeader
         name={name}
         meta={
           <>
@@ -402,24 +399,31 @@ function InstalledPluginPage({
             <AlertTriangle aria-hidden="true" className="text-warning mt-0.5 size-4 shrink-0" />
           }
         >
-          <p>
-            <strong className="font-semibold">
-              {runtime.state === "failed"
-                ? `${name} stopped and won't restart on its own.`
-                : `${name} keeps stopping.`}
-            </strong>{" "}
-            Prairie has restarted it {runtime.restart_count}{" "}
-            {runtime.restart_count === 1 ? "time" : "times"}
-            {runtime.state === "backoff" && runtime.next_restart_at
-              ? `. The next attempt is at ${formatDateTime(runtime.next_restart_at)}.`
-              : "."}
-          </p>
+          {runtime.resident ? (
+            <p>
+              <strong className="font-semibold">
+                {runtime.state === "failed"
+                  ? `${name} stopped and won't restart on its own.`
+                  : `${name} keeps stopping.`}
+              </strong>{" "}
+              Prairie has restarted it {runtime.restart_count}{" "}
+              {runtime.restart_count === 1 ? "time" : "times"}
+              {runtime.state === "backoff" && runtime.next_restart_at
+                ? `. The next attempt is at ${formatDateTime(runtime.next_restart_at)}.`
+                : "."}
+            </p>
+          ) : (
+            <p>
+              <strong className="font-semibold">{name} failed to start.</strong> Prairie tries again
+              the next time it needs the plugin.
+            </p>
+          )}
           {runtime.last_error ? (
             <pre className="bg-background/60 rounded-lg border px-3 py-2 font-mono text-xs [overflow-wrap:anywhere] whitespace-pre-wrap">
               {runtime.last_error}
             </pre>
           ) : null}
-          <div>{restartButton}</div>
+          {canRestart ? <div>{restartButton}</div> : null}
         </Banner>
       ) : null}
 
@@ -498,9 +502,9 @@ function CatalogPluginPreview({ entry }: { entry: PluginCatalogEntry }) {
   const jobs = capabilityListLabel(entry.capabilities ?? []);
 
   return (
-    <div className="page-shell space-y-5 py-4 sm:py-6">
+    <div className="space-y-5 pb-4 sm:pb-6">
       <BackLink fallback="/admin/plugins?tab=catalog" />
-      <PageHeader
+      <PluginPageHeader
         name={name}
         meta={
           <>
diff --git a/web/src/pages/AdminPlugins.tsx b/web/src/pages/AdminPlugins.tsx
index 0a78b6690f..6993a08663 100644
--- a/web/src/pages/AdminPlugins.tsx
+++ b/web/src/pages/AdminPlugins.tsx
@@ -15,6 +15,7 @@ import {
   InstalledPluginTile,
   PluginTileGrid,
 } from "@/components/admin/plugins/PluginTile";
+import { PageHeader } from "@/components/page/PageHeader";
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
 import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
@@ -141,27 +142,25 @@ function PluginsBoard() {
   }, [pluginUpdateTask?.state, queryClient]);
 
   const header = (
-    <div className="flex flex-col gap-4 sm:flex-row sm:items-end sm:justify-between">
-      <div className="space-y-3">
-        <h1 className="page-title text-[clamp(2rem,4vw,3rem)]">Plugins</h1>
-        <p className="page-subtitle text-sm sm:text-base">
-          Add metadata sources, playback markers, request routing, and watch sync to Prairie.
-        </p>
-      </div>
-      <Button
-        variant="outline"
-        onClick={() => checkPluginUpdates.mutate()}
-        disabled={checkPluginUpdates.isPending || isCheckingUpdates}
-      >
-        <Download className="mr-1.5 h-3.5 w-3.5" />
-        {isCheckingUpdates ? "Checking updates..." : "Check for updates"}
-      </Button>
-    </div>
+    <PageHeader
+      title="Plugins"
+      subtitle="Add metadata sources, playback markers, request routing, and watch sync to Prairie."
+      actions={
+        <Button
+          variant="outline"
+          onClick={() => checkPluginUpdates.mutate()}
+          disabled={checkPluginUpdates.isPending || isCheckingUpdates}
+        >
+          <Download className="mr-1.5 h-3.5 w-3.5" />
+          {isCheckingUpdates ? "Checking updates..." : "Check for updates"}
+        </Button>
+      }
+    />
   );
 
   if (isLoading) {
     return (
-      <div className="page-shell space-y-6 py-4 sm:py-6">
+      <div className="space-y-6 pb-4 sm:pb-6">
         {header}
         <div className="text-muted-foreground py-12 text-center text-sm">Loading plugins...</div>
       </div>
@@ -169,7 +168,7 @@ function PluginsBoard() {
   }
 
   return (
-    <div className="page-shell space-y-6 py-4 sm:py-6">
+    <div className="space-y-6 pb-4 sm:pb-6">
       {header}
 
       <Tabs
diff --git a/web/src/pages/AdminRecommendations.test.tsx b/web/src/pages/AdminRecommendations.test.tsx
index 6c8cf22d1c..689d518d1b 100644
--- a/web/src/pages/AdminRecommendations.test.tsx
+++ b/web/src/pages/AdminRecommendations.test.tsx
@@ -15,6 +15,17 @@ const mocks = vi.hoisted(() => ({
   triggerTasteProfilesMutate: vi.fn(),
   triggerCowatchMutate: vi.fn(),
   triggerRecommendationsMutate: vi.fn(),
+  resetMutateAsync: vi.fn(),
+  resetPending: false,
+  toastSuccess: vi.fn(),
+  toastError: vi.fn(),
+}));
+
+vi.mock("sonner", () => ({
+  toast: {
+    success: (...args: unknown[]) => mocks.toastSuccess(...args),
+    error: (...args: unknown[]) => mocks.toastError(...args),
+  },
 }));
 
 vi.mock("@/hooks/queries/admin/settings", () => ({
@@ -49,10 +60,30 @@ vi.mock("@/hooks/queries/admin/recommendations", () => ({
     isPending: false,
     mutate: (...args: unknown[]) => mocks.triggerRecommendationsMutate(...args),
   }),
+  useResetEmbeddings: () => ({
+    isPending: mocks.resetPending,
+    mutateAsync: (...args: unknown[]) => mocks.resetMutateAsync(...args),
+  }),
 }));
 
 import AdminRecommendations from "./AdminRecommendations";
 
+function idleJob(count: number) {
+  return { running: false, count };
+}
+
+function statusWith(overrides: Record<string, unknown> = {}) {
+  return {
+    embeddings: { ...idleJob(3), total: 10 },
+    taste_profiles: idleJob(4),
+    cowatch: idleJob(6),
+    recommendations: idleJob(5),
+    stale_sweep: { pending: 0 },
+    lock_conflict: "",
+    ...overrides,
+  };
+}
+
 function findButton(container: HTMLElement, label: string) {
   return Array.from(container.querySelectorAll("button")).find((button) =>
     button.textContent?.includes(label),
@@ -108,6 +139,10 @@ describe("AdminRecommendations", () => {
     mocks.triggerTasteProfilesMutate.mockReset();
     mocks.triggerCowatchMutate.mockReset();
     mocks.triggerRecommendationsMutate.mockReset();
+    mocks.resetMutateAsync.mockReset();
+    mocks.resetPending = false;
+    mocks.toastSuccess.mockReset();
+    mocks.toastError.mockReset();
 
     mocks.useAdminServerSettings.mockReturnValue({
       data: {
@@ -198,4 +233,155 @@ describe("AdminRecommendations", () => {
       },
     });
   });
+
+  it("shows each job's last run, the newest cached row and a lock conflict", async () => {
+    const minutesAgo = (n: number) => new Date(Date.now() - n * 60_000).toISOString();
+    mocks.useRecommendationsStatus.mockReturnValue({
+      data: statusWith({
+        embeddings: {
+          ...idleJob(0),
+          total: 10,
+          last_run: {
+            status: "failed",
+            started_at: minutesAgo(12),
+            completed_at: minutesAgo(10),
+            error: "recommendations reset required: embedding model changed",
+            result: { embedded: 0 },
+          },
+          last_partial_run: {
+            status: "completed",
+            started_at: minutesAgo(4),
+            completed_at: minutesAgo(3),
+            result: { missing_only: true, embedded: 2 },
+          },
+        },
+        recommendations: {
+          ...idleJob(5),
+          last_run: {
+            status: "completed",
+            started_at: minutesAgo(70),
+            completed_at: minutesAgo(60),
+          },
+        },
+        stale_sweep: {
+          pending: 7,
+          last_run: {
+            status: "completed",
+            started_at: minutesAgo(2),
+            completed_at: minutesAgo(2),
+            result: { stale: 3, refreshed: 2, failed: 1 },
+          },
+        },
+        cache_refreshed_at: minutesAgo(5),
+        lock_conflict: 'Embeddings were created with model "a", not "b".',
+      }),
+    });
+    await render();
+
+    const text = container.textContent ?? "";
+    expect(text).toContain("Last run failed 10m ago");
+    // A later catch-up shows beside the failed full run, not instead of it.
+    expect(text).toContain("Last catch-up completed 3m ago");
+    expect(text).toContain("recommendations reset required: embedding model changed");
+    expect(text).toContain("Last run completed 1h ago");
+    expect(text).toContain("No finished run recorded");
+    expect(text).toContain("Newest cached row written 5m ago");
+    expect(text).toContain("7 profiles wait for a rebuild");
+    expect(text).toContain("Last stale sweep completed 2m ago");
+    expect(container.querySelector('[role="alert"]')?.textContent).toContain(
+      'Embeddings were created with model "a", not "b".',
+    );
+  });
+
+  it("shows no lock warning when the lock matches", async () => {
+    mocks.useRecommendationsStatus.mockReturnValue({ data: statusWith() });
+    await render();
+
+    expect(container.querySelector('[role="alert"]')).toBeNull();
+  });
+
+  it("resets embeddings only after confirmation and reports the result", async () => {
+    mocks.useRecommendationsStatus.mockReturnValue({ data: statusWith() });
+    mocks.resetMutateAsync.mockResolvedValue({
+      embeddings: 1200,
+      taste_profiles: 3,
+      taste_clusters: 9,
+      cached_rows: 41,
+    });
+    await render();
+
+    await click(findButton(container, "Reset embeddings"));
+    expect(mocks.resetMutateAsync).not.toHaveBeenCalled();
+    const dialog = document.body.querySelector('[role="alertdialog"]');
+    expect(dialog?.textContent).toContain("Reset embeddings?");
+
+    await click(findButton(dialog as HTMLElement, "Reset embeddings"));
+    expect(mocks.resetMutateAsync).toHaveBeenCalledOnce();
+    expect(mocks.toastSuccess).toHaveBeenCalledWith(
+      expect.stringContaining("deleted 1,200 embeddings and cleared 3 taste profiles"),
+    );
+    expect(mocks.toastError).not.toHaveBeenCalled();
+  });
+
+  it("does not reset when the confirmation is cancelled", async () => {
+    mocks.useRecommendationsStatus.mockReturnValue({ data: statusWith() });
+    await render();
+
+    await click(findButton(container, "Reset embeddings"));
+    const dialog = document.body.querySelector('[role="alertdialog"]');
+    await click(findButton(dialog as HTMLElement, "Cancel"));
+
+    expect(mocks.resetMutateAsync).not.toHaveBeenCalled();
+    expect(document.body.querySelector('[role="alertdialog"]')).toBeNull();
+  });
+
+  it("reports a failed reset", async () => {
+    mocks.useRecommendationsStatus.mockReturnValue({ data: statusWith() });
+    mocks.resetMutateAsync.mockRejectedValue(
+      new Error("Recommendation work that uses embeddings is running on this or another server."),
+    );
+    await render();
+
+    await click(findButton(container, "Reset embeddings"));
+    await click(
+      findButton(
+        document.body.querySelector('[role="alertdialog"]') as HTMLElement,
+        "Reset embeddings",
+      ),
+    );
+
+    expect(mocks.toastError).toHaveBeenCalledWith(
+      "Recommendation work that uses embeddings is running on this or another server.",
+    );
+    expect(mocks.toastSuccess).not.toHaveBeenCalled();
+  });
+
+  it.each(["embeddings", "taste_profiles", "recommendations"] as const)(
+    "disables the reset while the %s job runs",
+    async (job) => {
+      mocks.useRecommendationsStatus.mockReturnValue({
+        data: statusWith({ [job]: { running: true, count: 1 } }),
+      });
+      await render();
+
+      expect(findButton(container, "Reset embeddings")?.disabled).toBe(true);
+    },
+  );
+
+  it("keeps the reset available while only co-watch runs", async () => {
+    mocks.useRecommendationsStatus.mockReturnValue({
+      data: statusWith({ cowatch: { running: true, count: 1 } }),
+    });
+    await render();
+
+    expect(findButton(container, "Reset embeddings")?.disabled).toBe(false);
+  });
+
+  it("disables the reset while a reset is in flight", async () => {
+    mocks.useRecommendationsStatus.mockReturnValue({ data: statusWith() });
+    mocks.resetPending = true;
+    await render();
+
+    expect(findButton(container, "Reset embeddings")?.disabled).toBe(true);
+  });
 });
diff --git a/web/src/pages/AdminRecommendations.tsx b/web/src/pages/AdminRecommendations.tsx
index ef6d5f5c80..099cf62aaa 100644
--- a/web/src/pages/AdminRecommendations.tsx
+++ b/web/src/pages/AdminRecommendations.tsx
@@ -1,4 +1,5 @@
 import { useState, useEffect } from "react";
+import { PageHeader } from "@/components/page/PageHeader";
 import { Button } from "@/components/ui/button";
 import { Switch } from "@/components/ui/switch";
 import { Label } from "@/components/ui/label";
@@ -14,9 +15,13 @@ import {
   RotateCcw,
   X,
 } from "lucide-react";
+import { toast } from "sonner";
 import { Skeleton } from "@/components/ui/skeleton";
 import type { AdminSettingsConnectionCheckRequest, ConnectionCheckResponse } from "@/api/types";
+import type { components } from "@/api/v2/schema";
 import { ConnectionCheckAction } from "@/components/admin/ConnectionCheckAction";
+import { ConfirmDialog } from "@/components/ConfirmDialog";
+import { formatRelativeTime } from "@/lib/date";
 import {
   useAdminServerSettings,
   useCheckAdminSettingsConnection,
@@ -29,6 +34,7 @@ import {
   useTriggerTasteProfiles,
   useTriggerRecommendations,
   useTriggerCowatch,
+  useResetEmbeddings,
 } from "@/hooks/queries/admin/recommendations";
 import {
   buildRecommendationSections,
@@ -42,6 +48,8 @@ import {
   type RecommendationProviderPreset,
 } from "@/lib/recommendation-provider-presets";
 
+type RecJobRun = components["schemas"]["AdminRecommendationJobRun"];
+
 interface RecLocalValues {
   [key: string]: string;
 }
@@ -227,11 +235,41 @@ function RecSettingField({
   );
 }
 
+function RecJobLastRun({ run, label = "Last run" }: { run?: RecJobRun; label?: string }) {
+  if (!run) {
+    return <p className="text-muted-foreground text-xs">No finished run recorded</p>;
+  }
+  const when = formatRelativeTime(run.completed_at) ?? run.completed_at;
+  if (run.status === "failed") {
+    return (
+      <div className="space-y-0.5">
+        <p className="text-destructive text-xs font-medium">
+          {label} failed {when}
+        </p>
+        {run.error && (
+          <p className="text-muted-foreground line-clamp-3 text-xs break-words" title={run.error}>
+            {run.error}
+          </p>
+        )}
+      </div>
+    );
+  }
+  return (
+    <p className="text-muted-foreground text-xs">
+      {label} completed {when}
+    </p>
+  );
+}
+
 function RecJobStatusCard({
   title,
   count,
   total,
   running,
+  lastRun,
+  secondaryRun,
+  secondaryRunLabel,
+  note,
   onTrigger,
   triggerPending,
 }: {
@@ -239,6 +277,11 @@ function RecJobStatusCard({
   count: number;
   total?: number;
   running: boolean;
+  lastRun?: RecJobRun;
+  /** Work that runs between full runs (a catch-up pass, the stale sweep), shown beside the last full run. */
+  secondaryRun?: RecJobRun;
+  secondaryRunLabel?: string;
+  note?: string;
   onTrigger: () => void;
   triggerPending: boolean;
 }) {
@@ -256,6 +299,9 @@ function RecJobStatusCard({
               ? `${count.toLocaleString()} / ${total.toLocaleString()} items`
               : `${count.toLocaleString()} ${count === 1 ? "entry" : "entries"}`}
           </p>
+          {note && <p className="text-muted-foreground text-xs">{note}</p>}
+          <RecJobLastRun run={lastRun} />
+          {secondaryRun && <RecJobLastRun run={secondaryRun} label={secondaryRunLabel} />}
         </div>
         <Button
           size="sm"
@@ -308,8 +354,7 @@ function RecEmbeddingLockCard({
         <div className="space-y-1">
           <h2 className="text-sm font-semibold">Embedding Lock</h2>
           <p className="text-muted-foreground text-sm">
-            This installation is locked to a specific embedding space after the first successful
-            embed.
+            This installation is locked to the embedding space of its first stored embedding.
           </p>
         </div>
         <Badge variant="outline" className="shrink-0">
@@ -341,6 +386,70 @@ function RecEmbeddingLockCard({
   );
 }
 
+function RecEmbeddingResetCard({
+  lockConflict,
+  disabled,
+  isPending,
+  onReset,
+}: {
+  lockConflict: string;
+  disabled: boolean;
+  isPending: boolean;
+  onReset: () => void;
+}) {
+  const [confirming, setConfirming] = useState(false);
+  return (
+    <div className="surface-panel max-w-3xl space-y-3 rounded-2xl border-0 px-5 py-4">
+      {lockConflict && (
+        <div
+          role="alert"
+          className="border-warning/30 bg-warning/10 text-warning flex items-start gap-3 rounded-xl border px-4 py-3 text-sm"
+        >
+          <AlertTriangle className="mt-0.5 h-4 w-4 flex-shrink-0" />
+          <span>{lockConflict}</span>
+        </div>
+      )}
+      <div className="flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between">
+        <div className="space-y-1">
+          <h2 className="text-sm font-semibold">Reset Embeddings</h2>
+          <p className="text-muted-foreground text-sm">
+            Deletes the embedding lock, every item embedding and personal recommendation rows, and
+            clears taste profiles, so you can switch embedding models. Run the embedding job
+            afterwards; taste profiles rebuild as their titles are embedded again.
+          </p>
+        </div>
+        <Button
+          size="sm"
+          variant="outline"
+          className="text-destructive shrink-0"
+          onClick={() => setConfirming(true)}
+          disabled={disabled || isPending}
+        >
+          {isPending ? (
+            <Loader2 className="size-3.5 animate-spin" />
+          ) : (
+            <RotateCcw className="size-3.5" />
+          )}
+          Reset embeddings
+        </Button>
+      </div>
+      <ConfirmDialog
+        open={confirming}
+        onOpenChange={setConfirming}
+        title="Reset embeddings?"
+        description="Every item embedding and personal recommendation row is deleted, and taste profiles are cleared. Personal recommendations and semantic search stay unavailable until the embedding job has run again."
+        confirmLabel="Reset embeddings"
+        variant="destructive"
+        isPending={isPending}
+        onConfirm={() => {
+          setConfirming(false);
+          onReset();
+        }}
+      />
+    </div>
+  );
+}
+
 export default function AdminRecommendations() {
   const { data: settings, isLoading } = useAdminServerSettings();
   const { data: sensitiveData } = useAdminSensitiveStatus();
@@ -352,6 +461,7 @@ export default function AdminRecommendations() {
   const triggerTasteProfiles = useTriggerTasteProfiles();
   const triggerCowatch = useTriggerCowatch();
   const triggerRecommendations = useTriggerRecommendations();
+  const resetEmbeddings = useResetEmbeddings();
 
   const [localValues, setLocalValues] = useState<RecLocalValues>({});
   const [dirtyKeys, setDirtyKeys] = useState<Set<string>>(new Set());
@@ -378,7 +488,7 @@ export default function AdminRecommendations() {
       }
       return merged;
     });
-    // eslint-disable-next-line react-hooks/exhaustive-deps
+    // eslint-disable-next-line react-hooks/exhaustive-deps -- seeds only keys missing from localValues; depending on it would rerun on every edit
   }, [settings, sensitiveData]);
 
   function handleLocalChange(key: string, value: string) {
@@ -445,6 +555,17 @@ export default function AdminRecommendations() {
     }
   }
 
+  async function handleResetEmbeddings() {
+    try {
+      const deleted = await resetEmbeddings.mutateAsync();
+      toast.success(
+        `Embeddings reset: deleted ${deleted.embeddings.toLocaleString()} embeddings and cleared ${deleted.taste_profiles.toLocaleString()} taste profiles.`,
+      );
+    } catch (error) {
+      toast.error(error instanceof Error ? error.message : "Failed to reset embeddings");
+    }
+  }
+
   function toggleSection(title: string) {
     setCollapsed((prev) => ({ ...prev, [title]: !prev[title] }));
   }
@@ -478,7 +599,7 @@ export default function AdminRecommendations() {
 
   if (isLoading)
     return (
-      <div className="page-shell space-y-6 py-4 sm:py-6">
+      <div className="space-y-6 pb-4 sm:pb-6">
         <div className="grid gap-3 sm:grid-cols-2 lg:grid-cols-4">
           {Array.from({ length: 4 }).map((_, i) => (
             <Skeleton key={i} className="h-28 rounded-2xl" />
@@ -501,16 +622,11 @@ export default function AdminRecommendations() {
   );
 
   return (
-    <div className="page-shell space-y-6 py-4 sm:py-6">
-      <div className="page-header gap-5">
-        <div className="space-y-3">
-          <h1 className="page-title text-[clamp(2rem,4vw,3rem)]">Recommendations</h1>
-          <p className="page-subtitle text-sm sm:text-base">
-            Configure the AI-powered recommendation engine. Requires an OpenAI-compatible embedding
-            endpoint.
-          </p>
-        </div>
-      </div>
+    <div className="space-y-6 pb-4 sm:pb-6">
+      <PageHeader
+        title="Recommendations"
+        subtitle="Configure the AI-powered recommendation engine. Requires an OpenAI-compatible embedding endpoint."
+      />
 
       {restartRequired && (
         <div className="border-warning/30 bg-warning/10 text-warning flex max-w-3xl items-center gap-3 rounded-xl border px-4 py-3 text-sm">
@@ -531,6 +647,9 @@ export default function AdminRecommendations() {
               count={status.embeddings.count}
               total={status.embeddings.total}
               running={status.embeddings.running}
+              lastRun={status.embeddings.last_run}
+              secondaryRun={status.embeddings.last_partial_run}
+              secondaryRunLabel="Last catch-up"
               onTrigger={() => triggerEmbeddings.mutate()}
               triggerPending={triggerEmbeddings.isPending}
             />
@@ -538,6 +657,14 @@ export default function AdminRecommendations() {
               title="Taste Profiles"
               count={status.taste_profiles.count}
               running={status.taste_profiles.running}
+              lastRun={status.taste_profiles.last_run}
+              secondaryRun={status.stale_sweep.last_run}
+              secondaryRunLabel="Last stale sweep"
+              note={
+                status.stale_sweep.pending > 0
+                  ? `${status.stale_sweep.pending.toLocaleString()} ${status.stale_sweep.pending === 1 ? "profile waits" : "profiles wait"} for a rebuild`
+                  : undefined
+              }
               onTrigger={() => triggerTasteProfiles.mutate()}
               triggerPending={triggerTasteProfiles.isPending}
             />
@@ -545,6 +672,7 @@ export default function AdminRecommendations() {
               title="Co-Watch Matrix"
               count={status.cowatch.count}
               running={status.cowatch.running}
+              lastRun={status.cowatch.last_run}
               onTrigger={() => triggerCowatch.mutate()}
               triggerPending={triggerCowatch.isPending}
             />
@@ -552,6 +680,16 @@ export default function AdminRecommendations() {
               title="Recommendations"
               count={status.recommendations.count}
               running={status.recommendations.running}
+              lastRun={status.recommendations.last_run}
+              secondaryRun={status.recommendations.last_partial_run}
+              secondaryRunLabel="Last startup build"
+              // Profile refreshes also write rows, so this is not job health;
+              // the last run above is.
+              note={
+                status.cache_refreshed_at
+                  ? `Newest cached row written ${formatRelativeTime(status.cache_refreshed_at) ?? status.cache_refreshed_at}`
+                  : undefined
+              }
               onTrigger={() => triggerRecommendations.mutate()}
               triggerPending={triggerRecommendations.isPending}
             />
@@ -561,6 +699,18 @@ export default function AdminRecommendations() {
 
       <div className="space-y-3">
         <RecEmbeddingLockCard lock={embeddingLock} />
+        {status && (
+          <RecEmbeddingResetCard
+            lockConflict={status.lock_conflict}
+            disabled={
+              status.embeddings.running ||
+              status.taste_profiles.running ||
+              status.recommendations.running
+            }
+            isPending={resetEmbeddings.isPending}
+            onReset={() => void handleResetEmbeddings()}
+          />
+        )}
 
         {buildRecommendationSections().map((section) => {
           const isOpen = !collapsed[section.title];
diff --git a/web/src/pages/AdminRequests.tsx b/web/src/pages/AdminRequests.tsx
index 800dfe4bcf..10f3ca4257 100644
--- a/web/src/pages/AdminRequests.tsx
+++ b/web/src/pages/AdminRequests.tsx
@@ -2,6 +2,7 @@ import { useEffect } from "react";
 import { Link, Navigate, useSearchParams } from "react-router";
 import { Settings2 } from "lucide-react";
 import { toast } from "sonner";
+import { PageHeader } from "@/components/page/PageHeader";
 import { Button } from "@/components/ui/button";
 import { useAdminRequestCapabilities } from "@/hooks/queries/admin/requests";
 import { RequestQueue } from "@/pages/admin-requests/RequestQueue";
@@ -57,22 +58,18 @@ function RequestQueuePage() {
 
   return (
     <div className="space-y-6">
-      {/* The action sits under the text, as on the other admin pages: the
-          shell's search button floats over the header's top-right corner. */}
-      <div className="page-header">
-        <div className="space-y-2">
-          <h1 className="page-title text-[clamp(2rem,4vw,3rem)]">Requests</h1>
-          <p className="text-muted-foreground max-w-2xl text-sm leading-6">
-            Approve, decline, and follow media requests.
-          </p>
+      <PageHeader
+        title="Requests"
+        subtitle="Approve, decline, and follow media requests."
+        actions={
           <Button asChild variant="outline" size="sm">
             <Link to={REQUEST_SETTINGS_HREF}>
               <Settings2 aria-hidden="true" />
               Request settings
             </Link>
           </Button>
-        </div>
-      </div>
+        }
+      />
 
       <RequestQueue />
     </div>
diff --git a/web/src/pages/AdminStats.tsx b/web/src/pages/AdminStats.tsx
index d6996c3cb2..55fa5e5759 100644
--- a/web/src/pages/AdminStats.tsx
+++ b/web/src/pages/AdminStats.tsx
@@ -1,5 +1,6 @@
 import type { ReactNode } from "react";
 import { useAdminStats, useAdminSessions } from "@/hooks/queries/admin/stats";
+import { PageHeader } from "@/components/page/PageHeader";
 import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import {
   Table,
@@ -26,16 +27,11 @@ export default function AdminStats() {
   const sessions = sessionsQuery.data ?? [];
 
   return (
-    <div className="page-shell space-y-6 py-4 sm:py-6">
-      <div className="page-header gap-5">
-        <div className="space-y-3">
-          <h1 className="page-title text-[clamp(2rem,4vw,3rem)]">System stats</h1>
-          <p className="page-subtitle text-sm sm:text-base">
-            Track the size of the library and inspect the sessions currently playing through the
-            system.
-          </p>
-        </div>
-      </div>
+    <div className="space-y-6 pb-4 sm:pb-6">
+      <PageHeader
+        title="System stats"
+        subtitle="Track the size of the library and inspect the sessions currently playing through the system."
+      />
 
       <StatsCards
         stats={statsQuery.data}
diff --git a/web/src/pages/AdminSubtitles.tsx b/web/src/pages/AdminSubtitles.tsx
index a1daa6ffc0..3067ab43ad 100644
--- a/web/src/pages/AdminSubtitles.tsx
+++ b/web/src/pages/AdminSubtitles.tsx
@@ -5,6 +5,7 @@ import AdminSubtitlesFilters, {
   FILTER_ALL,
 } from "@/components/admin/subtitles/AdminSubtitlesFilters";
 import AdminSubtitlesTable from "@/components/admin/subtitles/AdminSubtitlesTable";
+import { PageHeader } from "@/components/page/PageHeader";
 import { Button } from "@/components/ui/button";
 import {
   Select,
@@ -92,7 +93,7 @@ export default function AdminSubtitles() {
 
   if (subtitlesQuery.isLoading) {
     return (
-      <div className="page-shell space-y-6 py-4 sm:py-6">
+      <div className="space-y-6 pb-4 sm:pb-6">
         <div className="space-y-3">
           <Skeleton className="h-12 w-72 rounded-lg" />
           <Skeleton className="h-5 w-full max-w-xl rounded-lg" />
@@ -107,15 +108,11 @@ export default function AdminSubtitles() {
   }
 
   return (
-    <div className="page-shell space-y-6 py-4 sm:py-6">
-      <div className="page-header gap-5">
-        <div className="space-y-3">
-          <h1 className="page-title text-[clamp(2rem,4vw,3rem)]">Subtitles</h1>
-          <p className="page-subtitle text-sm sm:text-base">
-            Manage stored subtitle files across the library — user uploads and provider downloads.
-          </p>
-        </div>
-      </div>
+    <div className="space-y-6 pb-4 sm:pb-6">
+      <PageHeader
+        title="Subtitles"
+        subtitle="Manage stored subtitle files across the library — user uploads and provider downloads."
+      />
 
       <div className="surface-panel-subtle grid gap-4 rounded-2xl px-4 py-4 sm:grid-cols-2 xl:grid-cols-4">
         <StatBlock label="Total stored" value={total} />
diff --git a/web/src/pages/AdminTaskDetail.tsx b/web/src/pages/AdminTaskDetail.tsx
index ba95e0f2d9..9d7b41f234 100644
--- a/web/src/pages/AdminTaskDetail.tsx
+++ b/web/src/pages/AdminTaskDetail.tsx
@@ -5,6 +5,7 @@ import { isNotFoundProblem } from "@/api/v2/request";
 import { Button } from "@/components/ui/button";
 import PageUnavailable from "@/components/PageUnavailable";
 import ViewTransitionLink from "@/components/ViewTransitionLink";
+import { PageHeader } from "@/components/page/PageHeader";
 import { Badge } from "@/components/ui/badge";
 import { TaskStatusBadge } from "@/components/admin/TaskStatusBadge";
 import { Input } from "@/components/ui/input";
@@ -38,6 +39,7 @@ const REFRESH_REASON_LABELS: Record<string, string> = {
   refresh_failure: "Refresh failure",
   core_metadata_incomplete: "Core metadata incomplete",
   trailers_requested: "Trailers requested",
+  provider_artwork: "Provider artwork",
 };
 
 function formatDuration(ms: number): string {
@@ -602,7 +604,7 @@ export default function AdminTaskDetail() {
   };
 
   if (isLoading) {
-    return <p className="page-shell text-muted-foreground py-8 text-sm">Loading...</p>;
+    return <p className="text-muted-foreground pb-8 text-sm">Loading...</p>;
   }
 
   // A key that names no task used to leave this on "Loading..." for good.
@@ -634,53 +636,53 @@ export default function AdminTaskDetail() {
   const isRunning = task.state === "running" || task.state === "cancelling";
 
   return (
-    <div className="page-shell space-y-6 py-4 sm:py-6">
-      <nav
-        aria-label="Breadcrumb"
-        className="text-muted-foreground flex items-center gap-1.5 text-sm"
-      >
-        <Link to="/admin" className="hover:text-foreground transition-colors">
-          Admin
-        </Link>
-        <ChevronRight className="h-3.5 w-3.5" />
-        <Link to="/admin/tasks" className="hover:text-foreground transition-colors">
-          Scheduled Tasks
-        </Link>
-        <ChevronRight className="h-3.5 w-3.5" />
-        <span className="text-foreground font-medium">{task.name}</span>
-      </nav>
-
-      <div className="page-header gap-5">
-        <div className="space-y-3">
-          <div className="flex flex-wrap items-center gap-3">
-            <h1 className="page-title text-[clamp(2rem,4vw,3rem)]">{task.name}</h1>
-            <Badge variant="outline">{task.category}</Badge>
-          </div>
-          <p className="page-subtitle text-sm sm:text-base">{task.description}</p>
-        </div>
-
-        {isRunning ? (
-          <Button
-            variant="outline"
-            className="w-full sm:w-auto"
-            onClick={() => cancelTask.mutate(task.key)}
-            disabled={cancelTask.isPending || task.state === "cancelling"}
-          >
-            <Square className="mr-1.5 h-4 w-4" />
-            Cancel
-          </Button>
-        ) : (
-          <Button
-            variant="outline"
-            className="w-full sm:w-auto"
-            onClick={() => runTask.mutate(task.key)}
-            disabled={runTask.isPending}
+    <div className="space-y-6 pb-4 sm:pb-6">
+      <PageHeader
+        eyebrow={
+          <nav
+            aria-label="Breadcrumb"
+            className="text-muted-foreground flex items-center gap-1.5 text-sm"
           >
-            <Play className="mr-1.5 h-4 w-4" />
-            Run Now
-          </Button>
-        )}
-      </div>
+            <Link to="/admin" className="hover:text-foreground transition-colors">
+              Admin
+            </Link>
+            <ChevronRight className="h-3.5 w-3.5" />
+            <Link to="/admin/tasks" className="hover:text-foreground transition-colors">
+              Scheduled Tasks
+            </Link>
+            <ChevronRight className="h-3.5 w-3.5" />
+            <span className="text-foreground font-medium">{task.name}</span>
+          </nav>
+        }
+        title={task.name}
+        subtitle={task.description}
+        actions={
+          <>
+            <Badge variant="outline">{task.category}</Badge>
+            {isRunning ? (
+              <Button
+                variant="outline"
+                className="w-full sm:w-auto"
+                onClick={() => cancelTask.mutate(task.key)}
+                disabled={cancelTask.isPending || task.state === "cancelling"}
+              >
+                <Square className="mr-1.5 h-4 w-4" />
+                Cancel
+              </Button>
+            ) : (
+              <Button
+                variant="outline"
+                className="w-full sm:w-auto"
+                onClick={() => runTask.mutate(task.key)}
+                disabled={runTask.isPending}
+              >
+                <Play className="mr-1.5 h-4 w-4" />
+                Run Now
+              </Button>
+            )}
+          </>
+        }
+      />
 
       {task.key === "scan_libraries" && (
         <div className="surface-panel-subtle rounded-xl p-4 text-sm leading-relaxed">
diff --git a/web/src/pages/AdminTasks.tsx b/web/src/pages/AdminTasks.tsx
index 4adaeb2179..05d772041c 100644
--- a/web/src/pages/AdminTasks.tsx
+++ b/web/src/pages/AdminTasks.tsx
@@ -2,6 +2,7 @@ import { useEffect, useRef, useState } from "react";
 import { Link } from "react-router";
 import { useEventChannel } from "@/components/realtimeEventsContext";
 import { AlertTriangle, Loader2, Play, Square } from "lucide-react";
+import { PageHeader } from "@/components/page/PageHeader";
 import { Button } from "@/components/ui/button";
 import { Badge } from "@/components/ui/badge";
 import { TaskStatusBadge } from "@/components/admin/TaskStatusBadge";
@@ -35,6 +36,7 @@ const REFRESH_REASON_LABELS: Record<string, string> = {
   refresh_failure: "Refresh failure",
   core_metadata_incomplete: "Core metadata incomplete",
   trailers_requested: "Trailers requested",
+  provider_artwork: "Provider artwork",
 };
 
 function useTaskClock() {
@@ -317,17 +319,11 @@ export default function AdminTasks() {
   ].filter((g) => g.tasks.length > 0);
 
   return (
-    <div className="page-shell space-y-6 py-4 sm:py-6">
-      <div className="page-header gap-5">
-        <div className="space-y-3">
-          <h1 className="page-title text-[clamp(2rem,4vw,3rem)]">Scheduled Tasks</h1>
-          <p className="page-subtitle text-sm sm:text-base">
-            View and manage background tasks. You can trigger tasks manually or adjust their
-            schedules, including whether a task runs on server startup. Internal workers that need
-            no attention run automatically and are not listed.
-          </p>
-        </div>
-      </div>
+    <div className="space-y-6 pb-4 sm:pb-6">
+      <PageHeader
+        title="Scheduled Tasks"
+        subtitle="View and manage background tasks. You can trigger tasks manually or adjust their schedules, including whether a task runs on server startup. Internal workers that need no attention run automatically and are not listed."
+      />
 
       {isLoading && <p className="text-muted-foreground text-sm">Loading tasks...</p>}
 
diff --git a/web/src/pages/AdminUserDetail.test.tsx b/web/src/pages/AdminUserDetail.test.tsx
index 10bfa92c5a..a0fb294685 100644
--- a/web/src/pages/AdminUserDetail.test.tsx
+++ b/web/src/pages/AdminUserDetail.test.tsx
@@ -59,7 +59,7 @@ const adminUser: AdminUser = {
   max_local_stream_bitrate_kbps: null,
   transcode_allowed: null,
   audio_transcode_allowed: null,
-  max_profiles: 4,
+  max_profiles: null,
   download_allowed: null,
   download_transcode_allowed: null,
   requests_allowed: null,
@@ -74,6 +74,7 @@ const adminUser: AdminUser = {
     max_transcodes: 0,
     max_remote_stream_bitrate_kbps: 0,
     max_local_stream_bitrate_kbps: 0,
+    max_profiles: 4,
     transcode_allowed: true,
     audio_transcode_allowed: true,
     download_allowed: true,
@@ -151,6 +152,7 @@ vi.mock("@/hooks/queries/admin/accessGroups", () => ({
         max_transcodes: 0,
         max_remote_stream_bitrate_kbps: 8000,
         max_local_stream_bitrate_kbps: 0,
+        max_profiles: 5,
         allowed_permissions: [PERMISSION_MARKER_EDIT],
         requests_allowed: false,
         is_default: false,
@@ -673,6 +675,33 @@ describe("unsaved changes", () => {
     expect(search()).toBe("?tab=access");
   });
 
+  it("stays when a card's draft can't be saved, with the reason in the card", async () => {
+    const ui = userEvent.setup();
+    mocks.user = { ...adminUser, max_profiles: 6 };
+    renderUserDetail("/admin/users/7?tab=access");
+    await ui.click(screen.getByRole("button", { name: "Edit Sign-in & role" }));
+    const signIn = screen.getByRole("region", { name: "Sign-in & role" });
+    const username = within(signIn).getByRole("textbox", { name: "Username" });
+    await ui.clear(username);
+    await ui.type(username, "jordan");
+    const limit = within(signIn).getByRole("spinbutton", { name: "Profiles allowed" });
+    await ui.clear(limit);
+    await ui.type(limit, "0");
+    await ui.click(screen.getByRole("tab", { name: "Overview" }));
+    await ui.click(
+      within(await screen.findByRole("alertdialog")).getByRole("button", {
+        name: "Save and continue",
+      }),
+    );
+    expect(
+      await within(signIn).findByText("Allow at least 1 profile, or choose Default."),
+    ).toBeInTheDocument();
+    await waitFor(() => expect(screen.queryByRole("alertdialog")).toBeNull());
+    expect(search()).toBe("?tab=access");
+    expect(mocks.update).not.toHaveBeenCalled();
+    expect(limit).toHaveValue(0);
+  });
+
   it("asks before leaving the page too", async () => {
     const ui = userEvent.setup();
     await dirtyPlayback(ui);
diff --git a/web/src/pages/AdminUserDetail.tsx b/web/src/pages/AdminUserDetail.tsx
index d3aa368321..857ef94425 100644
--- a/web/src/pages/AdminUserDetail.tsx
+++ b/web/src/pages/AdminUserDetail.tsx
@@ -83,7 +83,7 @@ function AdminUserDetailPage() {
   const [disableOpen, setDisableOpen] = useState(false);
   const [deleteEditor, setDeleteEditor] = useState<AdminUserEditor | null>(null);
 
-  if (isLoading) return <div className="page-shell py-8">Loading user...</div>;
+  if (isLoading) return <div className="pb-8">Loading user...</div>;
   if (!user) {
     if (error && !isNotFoundProblem(error)) {
       return (
@@ -195,7 +195,7 @@ function AdminUserDetailPage() {
 
   return (
     <CardEditingProvider>
-      <div className="page-shell min-w-0 space-y-6 py-4 sm:py-6">
+      <div className="min-w-0 space-y-6 pb-4 sm:pb-6">
         {actionError && <p role="alert">{actionError}</p>}
         {!available && <p role="status">User administration is unavailable.</p>}
         {available && manageable && !editor && (
diff --git a/web/src/pages/AdminUsers.test.tsx b/web/src/pages/AdminUsers.test.tsx
index 49852ae437..dfdd27465c 100644
--- a/web/src/pages/AdminUsers.test.tsx
+++ b/web/src/pages/AdminUsers.test.tsx
@@ -137,6 +137,7 @@ const adminUser: AdminUser = {
     max_transcodes: 0,
     max_remote_stream_bitrate_kbps: 0,
     max_local_stream_bitrate_kbps: 0,
+    max_profiles: 4,
     transcode_allowed: true,
     audio_transcode_allowed: true,
     download_allowed: true,
@@ -316,6 +317,7 @@ const defaultGroup: AccessGroup = {
   max_transcodes: 3,
   max_remote_stream_bitrate_kbps: 0,
   max_local_stream_bitrate_kbps: 0,
+  max_profiles: 2,
   allowed_permissions: null,
   requests_allowed: true,
   is_default: true,
@@ -398,6 +400,7 @@ describe("AdminUsers user dialog policy hints", () => {
 
     expect(within(dialog).getByText("Inherited: 5")).toBeInTheDocument();
     expect(within(dialog).getByText("Inherited: 3")).toBeInTheDocument();
+    expect(within(dialog).getByText("Inherited: 2")).toBeInTheDocument();
   });
 
   it("uses the server defaults once a loaded list has no default group", async () => {
@@ -408,6 +411,7 @@ describe("AdminUsers user dialog policy hints", () => {
 
     // The server then creates the account without a group.
     expect(within(dialog).getAllByText("Server default: Unlimited")).toHaveLength(4);
+    expect(within(dialog).getByText("Server default: 5")).toBeInTheDocument();
     expect(within(dialog).queryByText(/Inherit/)).not.toBeInTheDocument();
   });
 
@@ -460,6 +464,8 @@ describe("AdminUsers user dialog policy hints", () => {
 
     await waitFor(() => expect(mocks.create).toHaveBeenCalledTimes(1));
     expect(mocks.create.mock.calls[0]![0].body.access_group_id).toBe(3);
+    // The profile limit follows the group unless the admin sets one.
+    expect(mocks.create.mock.calls[0]![0].body).not.toHaveProperty("max_profiles");
   });
 
   it("disables the group picker for admins", async () => {
@@ -474,6 +480,102 @@ describe("AdminUsers user dialog policy hints", () => {
     expect(within(dialog).getByRole("combobox", { name: "Group" })).toBeDisabled();
     expect(within(dialog).getByText("Admin accounts can't join groups.")).toBeInTheDocument();
   });
+  // Overrides Max Streams to 3 in a fresh Create User dialog and fills the
+  // account fields, so only the limit can stop the save. The 3 is the last
+  // valid value a later edit could leave behind.
+  async function openCreateWithStreamsOverride(user: ReturnType<typeof userEvent.setup>) {
+    mocks.create.mockReset().mockResolvedValue({ id: 11 });
+    renderPage();
+    const dialog = await openLimits(user, /Add User/);
+    // Max Streams is the first field on the Limits tab.
+    await user.click(within(dialog).getAllByRole("switch")[0]!);
+    await user.type(within(dialog).getByLabelText("Max Streams"), "3");
+    await user.click(within(dialog).getByRole("tab", { name: "Account" }));
+    await user.type(within(dialog).getByLabelText("Username"), "newbie");
+    await user.type(within(dialog).getByLabelText("Email"), "newbie@example.test");
+    await user.type(within(dialog).getByLabelText(/^Password/), "a-long-password");
+    await user.click(within(dialog).getByRole("tab", { name: "Limits" }));
+    return dialog;
+  }
+
+  it("refuses to save a cleared limit from another tab and shows the Limits tab", async () => {
+    const user = userEvent.setup();
+    const dialog = await openCreateWithStreamsOverride(user);
+    await user.clear(within(dialog).getByLabelText("Max Streams"));
+
+    await user.click(within(dialog).getByRole("tab", { name: "Account" }));
+    // The browser reports a field by firing `invalid` at it.
+    const reported: EventTarget[] = [];
+    dialog
+      .querySelector("form")!
+      .addEventListener("invalid", (event) => reported.push(event.target!), true);
+    await user.click(within(dialog).getByRole("button", { name: /save/i }));
+
+    expect(mocks.create).not.toHaveBeenCalled();
+    expect(within(dialog).getByRole("tab", { name: "Limits" })).toHaveAttribute(
+      "aria-selected",
+      "true",
+    );
+    // The field still shows the edit, not the last valid value, and the
+    // browser points at it.
+    const field = within(dialog).getByLabelText("Max Streams");
+    expect(field).toHaveValue(null);
+    expect(reported).toContain(field);
+  });
+
+  it("keeps a non-whole limit across a tab switch and still refuses to save it", async () => {
+    const user = userEvent.setup();
+    const dialog = await openCreateWithStreamsOverride(user);
+    await user.clear(within(dialog).getByLabelText("Max Streams"));
+    await user.type(within(dialog).getByLabelText("Max Streams"), "1.5");
+
+    await user.click(within(dialog).getByRole("tab", { name: "Account" }));
+    expect(within(dialog).queryByLabelText("Max Streams")).not.toBeInTheDocument();
+    await user.click(within(dialog).getByRole("tab", { name: "Limits" }));
+    expect(within(dialog).getByLabelText("Max Streams")).toHaveValue(1.5);
+
+    await user.click(within(dialog).getByRole("tab", { name: "Account" }));
+    await user.click(within(dialog).getByRole("button", { name: /save/i }));
+    expect(mocks.create).not.toHaveBeenCalled();
+    expect(within(dialog).getByLabelText("Max Streams")).toHaveValue(1.5);
+  });
+
+  it("saves the retyped value after a cleared limit", async () => {
+    const user = userEvent.setup();
+    const dialog = await openCreateWithStreamsOverride(user);
+    await user.clear(within(dialog).getByLabelText("Max Streams"));
+    await user.click(within(dialog).getByRole("tab", { name: "Account" }));
+    await user.click(within(dialog).getByRole("tab", { name: "Limits" }));
+    await user.type(within(dialog).getByLabelText("Max Streams"), "2");
+    await user.click(within(dialog).getByRole("tab", { name: "Account" }));
+    await user.click(within(dialog).getByRole("button", { name: /save/i }));
+    await waitFor(() => expect(mocks.create).toHaveBeenCalledTimes(1));
+    expect(mocks.create.mock.calls[0]![0].body.max_streams).toBe(2);
+  });
+
+  it("refuses to save a cleared Max Profiles limit from another tab", async () => {
+    mocks.create.mockReset().mockResolvedValue({ id: 11 });
+    const user = userEvent.setup();
+    renderPage();
+    const dialog = await openLimits(user, /Add User/);
+    const profilesField = within(dialog).getByText("Max Profiles").closest("div.space-y-1")!;
+    await user.click(within(profilesField as HTMLElement).getByRole("switch"));
+    await user.type(within(dialog).getByLabelText("Max Profiles"), "3");
+    await user.clear(within(dialog).getByLabelText("Max Profiles"));
+
+    await user.click(within(dialog).getByRole("tab", { name: "Account" }));
+    await user.type(within(dialog).getByLabelText("Username"), "newbie");
+    await user.type(within(dialog).getByLabelText("Email"), "newbie@example.test");
+    await user.type(within(dialog).getByLabelText(/^Password/), "a-long-password");
+    await user.click(within(dialog).getByRole("button", { name: /save/i }));
+
+    expect(mocks.create).not.toHaveBeenCalled();
+    expect(within(dialog).getByRole("tab", { name: "Limits" })).toHaveAttribute(
+      "aria-selected",
+      "true",
+    );
+    expect(within(dialog).getByLabelText("Max Profiles")).toHaveValue(null);
+  });
 });
 
 describe("AdminUsers access group column and filter", () => {
diff --git a/web/src/pages/AdminUsers.tsx b/web/src/pages/AdminUsers.tsx
index 8c485143d1..a07f2bfdd3 100644
--- a/web/src/pages/AdminUsers.tsx
+++ b/web/src/pages/AdminUsers.tsx
@@ -1,4 +1,5 @@
 import { useState, useId, useMemo, useRef } from "react";
+import { flushSync } from "react-dom";
 import type { FormEvent, ReactNode } from "react";
 import { Link, useSearchParams } from "react-router";
 import type { AdminUser, CreateUserRequest } from "@/api/types";
@@ -21,9 +22,11 @@ import {
   policyDefaultSource,
   policyInheritHints,
   policyStateFromUser,
+  type LimitPolicyKey,
 } from "@/components/UserPolicyFields";
 import { Tooltip, TooltipContent, TooltipProvider, TooltipTrigger } from "@/components/ui/tooltip";
 import { AdminUserImpersonationDialog } from "@/components/AdminUserImpersonationDialog";
+import { PageHeader } from "@/components/page/PageHeader";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
@@ -221,6 +224,61 @@ function AdminUsersPage() {
           onError={setActionError}
         />
       )}
+      <PageHeader
+        title="Users"
+        subtitle="Manage access, defaults, and invite flow for the people using Prairie."
+        actions={
+          <>
+            {serverSettings !== undefined && (
+              <Link
+                to="/admin/settings/sign-in"
+                className="inline-flex w-fit items-center gap-1 hover:opacity-80"
+              >
+                <Badge
+                  variant={signupsEnabled ? "outline" : "secondary"}
+                  className={
+                    signupsEnabled
+                      ? "border-emerald-500/30 bg-emerald-500/10 text-emerald-500"
+                      : undefined
+                  }
+                >
+                  {signupsEnabled ? "Public signups on" : "Public signups off"}
+                  <ArrowRight className="h-3 w-3" aria-hidden="true" />
+                </Badge>
+              </Link>
+            )}
+            <Button variant="outline" size="sm" asChild>
+              <Link to="/admin/access-groups">
+                <Settings2 className="mr-1 h-4 w-4" /> Access Groups
+              </Link>
+            </Button>
+            <Dialog
+              open={dialogOpen}
+              onOpenChange={(open) => {
+                if (formBusy.current || (open && !available)) return;
+                setDialogOpen(open);
+              }}
+            >
+              <DialogTrigger asChild>
+                <Button size="sm">
+                  <Plus className="mr-1 h-4 w-4" /> Add User
+                </Button>
+              </DialogTrigger>
+              <DialogContent className="sm:max-w-2xl">
+                <DialogHeader>
+                  <DialogTitle>Create User</DialogTitle>
+                </DialogHeader>
+                <CreateUserForm
+                  onBusy={(value) => {
+                    formBusy.current = value;
+                  }}
+                  onClose={() => setDialogOpen(false)}
+                />
+              </DialogContent>
+            </Dialog>
+          </>
+        }
+      />
       {actionError && <p role="alert">{actionError}</p>}
       {usersQuery.isError && (
         <div role="alert">
@@ -229,63 +287,6 @@ function AdminUsersPage() {
         </div>
       )}
       {!available && <p role="status">User administration is unavailable.</p>}
-      <div className="page-header">
-        <div className="space-y-3">
-          <h1 className="page-title text-[clamp(2rem,4vw,3rem)]">Users</h1>
-          <p className="page-subtitle text-sm sm:text-base">
-            Manage access, defaults, and invite flow for the people using Prairie.
-          </p>
-          {serverSettings !== undefined && (
-            <Link
-              to="/admin/settings/general"
-              className="inline-flex w-fit items-center gap-1 hover:opacity-80"
-            >
-              <Badge
-                variant={signupsEnabled ? "outline" : "secondary"}
-                className={
-                  signupsEnabled
-                    ? "border-emerald-500/30 bg-emerald-500/10 text-emerald-500"
-                    : undefined
-                }
-              >
-                {signupsEnabled ? "Public signups on" : "Public signups off"}
-                <ArrowRight className="h-3 w-3" aria-hidden="true" />
-              </Badge>
-            </Link>
-          )}
-        </div>
-        <div className="flex gap-2">
-          <Button variant="outline" size="sm" asChild>
-            <Link to="/admin/access-groups">
-              <Settings2 className="mr-1 h-4 w-4" /> Access Groups
-            </Link>
-          </Button>
-          <Dialog
-            open={dialogOpen}
-            onOpenChange={(open) => {
-              if (formBusy.current || (open && !available)) return;
-              setDialogOpen(open);
-            }}
-          >
-            <DialogTrigger asChild>
-              <Button size="sm">
-                <Plus className="mr-1 h-4 w-4" /> Add User
-              </Button>
-            </DialogTrigger>
-            <DialogContent className="sm:max-w-2xl">
-              <DialogHeader>
-                <DialogTitle>Create User</DialogTitle>
-              </DialogHeader>
-              <CreateUserForm
-                onBusy={(value) => {
-                  formBusy.current = value;
-                }}
-                onClose={() => setDialogOpen(false)}
-              />
-            </DialogContent>
-          </Dialog>
-        </div>
-      </div>
 
       <Tabs value={activeTab} onValueChange={setActiveTab}>
         <TabsList variant="line" className="border-border w-full justify-start border-b">
@@ -737,7 +738,20 @@ function CreateUserForm({
   const [permissions, setPermissions] = useState<string[]>([PERMISSION_MARKER_EDIT]);
   // Policy fields inherit from the access group unless explicitly overridden.
   const [policy, setPolicy] = useState(() => policyStateFromUser(null));
-  const [maxProfiles, setMaxProfiles] = useState(5);
+  const [invalidLimitDrafts, setInvalidLimitDrafts] = useState<ReadonlyMap<LimitPolicyKey, string>>(
+    new Map(),
+  );
+  const [dialogTab, setDialogTab] = useState("account");
+  const formRef = useRef<HTMLFormElement>(null);
+  function handleInvalidLimitDraftChange(key: LimitPolicyKey, draft: string | undefined) {
+    setInvalidLimitDrafts((current) => {
+      if (current.get(key) === draft) return current;
+      const next = new Map(current);
+      if (draft === undefined) next.delete(key);
+      else next.set(key, draft);
+      return next;
+    });
+  }
   const usernameId = useId();
   const emailId = useId();
   const passwordId = useId();
@@ -745,7 +759,6 @@ function CreateUserForm({
   const roleId = useId();
   const markerEditId = useId();
   const metadataCurationId = useId();
-  const maxProfilesId = useId();
   const accessGroupSelectId = useId();
   const createMutation = useCreateUser();
   // The group picker starts on the default group (undefined until picked),
@@ -793,6 +806,15 @@ function CreateUserForm({
       setError(INVALID_EMAIL_MESSAGE);
       return;
     }
+    // A cleared or half-typed limit is not in the policy state, which still
+    // holds the last valid value; saving now would send that instead.
+    if (invalidLimitDrafts.size > 0) {
+      // The Limits fields mount only once the tab has rendered, so render it
+      // now and then let the browser point at the invalid field.
+      flushSync(() => setDialogTab("limits"));
+      formRef.current?.reportValidity();
+      return;
+    }
     busy.current = true;
     onBusy(true);
     setError("");
@@ -805,7 +827,6 @@ function CreateUserForm({
         role,
         permissions,
         create_default_profile: createDefaultProfile,
-        max_profiles: maxProfiles,
         ...policyCreateFields(policy),
         ...(typeof groupToSend === "number" ? { access_group_id: groupToSend } : {}),
       };
@@ -821,7 +842,7 @@ function CreateUserForm({
   }
 
   return (
-    <form onSubmit={handleSubmit} className="flex max-h-[70vh] flex-col">
+    <form ref={formRef} onSubmit={handleSubmit} className="flex max-h-[70vh] flex-col">
       {error && <p role="alert">{error}</p>}
       <label className="mb-3 flex items-center gap-2">
         <input
@@ -834,7 +855,7 @@ function CreateUserForm({
           " (unavailable; uncheck to create only the account)"}
       </label>
 
-      <Tabs defaultValue="account" className="min-h-0 flex-1">
+      <Tabs value={dialogTab} onValueChange={setDialogTab} className="min-h-0 flex-1">
         <TabsList variant="line" className="border-border mb-4 w-full justify-start border-b pb-1">
           <TabsTrigger value="account" className="flex-none px-1">
             Account
@@ -997,17 +1018,9 @@ function CreateUserForm({
               onChange={setPolicy}
               source={hintSource}
               effective={inheritHints}
+              invalidLimitDrafts={invalidLimitDrafts}
+              onInvalidLimitDraftChange={handleInvalidLimitDraftChange}
             />
-            <div className="space-y-1">
-              <Label htmlFor={maxProfilesId}>Max Profiles</Label>
-              <Input
-                id={maxProfilesId}
-                type="number"
-                min={1}
-                value={maxProfiles}
-                onChange={(e) => setMaxProfiles(Number(e.target.value))}
-              />
-            </div>
           </TabsContent>
         </div>
       </Tabs>
diff --git a/web/src/pages/CollectionEditorPage.synced.test.tsx b/web/src/pages/CollectionEditorPage.synced.test.tsx
index 68d2750e6c..8f811429d3 100644
--- a/web/src/pages/CollectionEditorPage.synced.test.tsx
+++ b/web/src/pages/CollectionEditorPage.synced.test.tsx
@@ -339,7 +339,7 @@ describe("Synced list step, server", () => {
     const search = screen.getByRole("searchbox", { name: "Search lists" });
     expect(search).toBeDisabled();
     expect(search).toHaveAccessibleDescription(/Searching MDBList needs an API key/);
-    expect(screen.getByRole("link", { name: "Settings › Subtitles & Metadata" })).toHaveAttribute(
+    expect(screen.getByRole("link", { name: "Settings › Providers" })).toHaveAttribute(
       "href",
       "/admin/settings/providers",
     );
@@ -391,7 +391,7 @@ describe("Synced list step, server", () => {
     expect(screen.getByText("Pick its libraries, then create it.")).toBeInTheDocument();
   });
 
-  it("caps Max titles at 500 and labels the schedule with the server's offset", async () => {
+  it("keeps Max titles above 500 and labels the schedule with the server's offset", async () => {
     showPage(SERVER_NEW);
     await pick("IMDb Top 250 Movies");
     expect(screen.getByText("Server time (UTC−5)")).toBeInTheDocument();
@@ -401,7 +401,7 @@ describe("Synced list step, server", () => {
     choose(screen.getByRole("combobox", { name: "Sync schedule" }), "Every 6 hours");
     await create();
     expect(imports("/api/v2/admin/collections/import/mdblist")[0]?.body).toMatchObject({
-      limit: 500,
+      limit: 900,
       sync_schedule: "0 */6 * * *",
       featured: false,
       poster_url: "/images/collection-templates/mdblist_imdb_top_250_movies.jpg",
diff --git a/web/src/pages/CollectionEditorPage.syncedEdit.test.tsx b/web/src/pages/CollectionEditorPage.syncedEdit.test.tsx
index 46f8345705..56df884887 100644
--- a/web/src/pages/CollectionEditorPage.syncedEdit.test.tsx
+++ b/web/src/pages/CollectionEditorPage.syncedEdit.test.tsx
@@ -1,7 +1,7 @@
 /**
  * Editing a saved Synced list on the collection editor page, both scopes: the
  * list it follows (a link, a chart, a TMDB collection ID, or a locked summary
- * for Discover and legacy Trakt lists), its sync status and Sync now, and the
+ * for Discover lists), its sync status and Sync now, and the
  * schedule a profile picks by name.
  */
 import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
@@ -74,22 +74,14 @@ beforeEach(() => {
 type Source = { source_url: string; source_config: Record<string, unknown> };
 
 /** A saved server Synced list, as the editor reads it and as the list shows it. */
-function serverList(
-  type: "mdblist" | "tmdb" | "trakt",
-  source: Source,
-  extra: Record<string, unknown> = {},
-) {
+function serverList(type: "mdblist" | "tmdb", source: Source, extra: Record<string, unknown> = {}) {
   const collection = { ...adminSyncedCollection(type, source), ...extra };
   v2Recorder.answer("GET /api/v2/admin/collections/{id}", collection);
   v2Recorder.answer("GET /api/v2/admin/collections", adminCollectionList(collection));
   return collection;
 }
 
-function personalList(
-  type: "mdblist" | "tmdb" | "trakt",
-  source: Source,
-  extra: Record<string, unknown>,
-) {
+function personalList(type: "mdblist" | "tmdb", source: Source, extra: Record<string, unknown>) {
   v2Recorder.answer("GET /api/v2/collections/{id}", {
     ...personalSyncedCollection(type, source),
     ...extra,
@@ -532,13 +524,13 @@ describe("server Synced list editor", () => {
     expect(saveButton()).toBeDisabled();
   });
 
-  it("caps Max titles at 500, which sync can fill", async () => {
+  it("keeps Max titles above 500", async () => {
     serverList("mdblist", MDBLIST);
     showPage(SERVER_EDIT);
-    expect(await setMaxTitles("501")).toHaveValue(500);
+    expect(await setMaxTitles("10000")).toHaveValue(10000);
     await save(ADMIN_PATCH);
     expect(patches(ADMIN_PATCH)[0]).toMatchObject({
-      source_config: { mode: "mdblist_json", limit: 500 },
+      source_config: { mode: "mdblist_json", limit: 10000 },
     });
   });
 
@@ -765,64 +757,6 @@ describe("server Synced list editor", () => {
     expect(screen.queryByRole("list", { name: "You decide" })).toBeNull();
   });
 
-  describe("a legacy Trakt list", () => {
-    const TRAKT: Source = {
-      source_url: "trakt://recommended/movie/p-owner",
-      source_config: {
-        mode: "trakt_preset",
-        preset: "recommended",
-        media_type: "movie",
-        profile_id: "p-owner",
-        limit: 40,
-      },
-    };
-
-    it("shows its source read-only, locks libraries and max titles, and sends no source", async () => {
-      serverList("trakt", TRAKT);
-      showPage(SERVER_EDIT);
-      expect(
-        await screen.findByText(
-          "New Trakt lists aren't supported. This one keeps its source and libraries.",
-        ),
-      ).toBeInTheDocument();
-      expect(
-        screen.getByText(
-          "You can still change its name, artwork, order, schedule and where it shows.",
-        ),
-      ).toBeInTheDocument();
-      expect(screen.getByRole("spinbutton", { name: "Max titles" })).toBeDisabled();
-      expect(screen.getByRole("spinbutton", { name: "Max titles" })).toHaveValue(40);
-      expect(screen.getByRole("button", { name: /Match into/ })).toBeDisabled();
-      await rename("For you");
-      await save(ADMIN_PATCH);
-      const body = patches(ADMIN_PATCH)[0]!;
-      expect(body).toMatchObject({
-        title: "For you",
-        collection_type: "trakt",
-        library_ids: ["1"],
-      });
-      expect(body).not.toHaveProperty("source_url");
-      expect(body).not.toHaveProperty("source_config");
-    });
-
-    it("can't turn a schedule on, and says why", async () => {
-      serverList("trakt", TRAKT);
-      showPage(SERVER_EDIT);
-      expect(await screen.findByRole("combobox", { name: "Sync schedule" })).toBeDisabled();
-      expect(screen.getByText("A stopped Trakt list can't be scheduled again.")).toBeVisible();
-    });
-
-    it("can still change or stop a schedule it already has", async () => {
-      serverList("trakt", TRAKT, { sync_schedule: "0 3 * * *" });
-      showPage(SERVER_EDIT);
-      const schedule = await screen.findByRole("combobox", { name: "Sync schedule" });
-      expect(schedule).toBeEnabled();
-      choose(schedule, "No automatic sync");
-      await save(ADMIN_PATCH);
-      expect(patches(ADMIN_PATCH)[0]).toMatchObject({ sync_schedule: "" });
-    });
-  });
-
   describe("artwork", () => {
     beforeEach(() => {
       serverList("mdblist", MDBLIST, {
@@ -893,27 +827,6 @@ describe("personal Synced list editor", () => {
     });
   });
 
-  it("sends no libraries for a legacy Trakt list, which the server won't take", async () => {
-    personalList(
-      "trakt",
-      {
-        source_url: "trakt://recommended/movie/p-owner",
-        source_config: { limit: 40, library_ids: [1] },
-      },
-      { sync_schedule: "17 4 * * *", sync_cadence: "daily" },
-    );
-    showPage(PERSONAL_EDIT);
-    const schedule = await screen.findByRole("combobox", { name: "Sync schedule" });
-    await vi.waitFor(() => expect(schedule).toBeEnabled());
-    choose(schedule, "Weekly");
-    await save(PERSONAL_PATCH);
-    const body = patches(PERSONAL_PATCH)[0]!;
-    expect(body).toMatchObject({ sync_schedule: "weekly" });
-    expect(body).not.toHaveProperty("library_ids");
-    expect(body).not.toHaveProperty("source_url");
-    expect(body).not.toHaveProperty("max_items");
-  });
-
   it("keeps a schedule it can't name until another is picked", async () => {
     personalList("mdblist", PERSONAL_MDBLIST, {
       sync_schedule: "0 */6 * * *",
diff --git a/web/src/pages/CollectionImports.goldens.test.tsx b/web/src/pages/CollectionImports.goldens.test.tsx
index d668e59835..cdf3fc9775 100644
--- a/web/src/pages/CollectionImports.goldens.test.tsx
+++ b/web/src/pages/CollectionImports.goldens.test.tsx
@@ -289,25 +289,6 @@ describe("admin Synced list editor", () => {
     await saveAndWait(1);
     expect(v2Recorder.writes()).toEqual(goldens.adminEditTMDBList);
   });
-
-  it("sends no source for a legacy Trakt list", async () => {
-    answerAdmin(
-      adminSyncedCollection("trakt", {
-        source_url: "trakt://recommended/movie/p-owner",
-        source_config: {
-          mode: "trakt_preset",
-          preset: "recommended",
-          media_type: "movie",
-          profile_id: "p-owner",
-          limit: 40,
-        },
-      }),
-    );
-    show(<></>, "/admin/collections/c1/edit?libraryId=1");
-    await type("Name", "For you");
-    await saveAndWait(1);
-    expect(v2Recorder.writes()).toEqual(goldens.adminEditTrakt);
-  });
 });
 
 describe("personal Synced list editor", () => {
diff --git a/web/src/pages/Collections.tsx b/web/src/pages/Collections.tsx
index ec4484bac0..8fe1c8c59c 100644
--- a/web/src/pages/Collections.tsx
+++ b/web/src/pages/Collections.tsx
@@ -110,7 +110,6 @@ export default function Collections() {
   return (
     <div className="page-shell py-4 sm:py-6">
       <CalmPage
-        heading="page"
         title="Collections"
         subtitle={
           multiProfile
diff --git a/web/src/pages/Home.test.tsx b/web/src/pages/Home.test.tsx
index ffda710920..9f5ae922d7 100644
--- a/web/src/pages/Home.test.tsx
+++ b/web/src/pages/Home.test.tsx
@@ -19,6 +19,7 @@ import { bumpHomeRefreshSignal } from "./homeSurfaceRefresh";
 
 const mockUseHomeLayout = vi.fn();
 const mockFetchHomeSectionItems = vi.fn();
+const mockFetchRecipeCatalog = vi.fn();
 const SAFARI_USER_AGENT =
   "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 Version/18.6 Safari/605.1.15";
 const FIREFOX_USER_AGENT =
@@ -37,6 +38,10 @@ vi.mock("@/hooks/queries/sections", () => ({
   HOME_SECTION_GC_TIME: 60 * 60 * 1000,
 }));
 
+vi.mock("@/lib/recipes", () => ({
+  fetchRecipeCatalog: () => mockFetchRecipeCatalog(),
+}));
+
 vi.mock("@/hooks/useDocumentTitle", () => ({
   useDocumentTitle: vi.fn(),
 }));
@@ -86,6 +91,8 @@ describe("Home", () => {
       refetch: vi.fn(),
     });
     mockFetchHomeSectionItems.mockReset();
+    mockFetchRecipeCatalog.mockReset();
+    mockFetchRecipeCatalog.mockResolvedValue({ categories: {} });
   });
 
   afterEach(async () => {
@@ -861,6 +868,80 @@ describe("Home", () => {
     });
   });
 
+  it("drops what an earlier row shows from avoid-duplicates rows, whatever order rows load in", async () => {
+    mockFetchRecipeCatalog.mockResolvedValue({
+      categories: {
+        personalized: [
+          {
+            type: "recommended_for_you",
+            category: "personalized",
+            presets: [],
+            avoid_duplicates: true,
+            supports_rotation: false,
+            admin_only: false,
+          },
+          {
+            type: "taste_match",
+            category: "personalized",
+            presets: [],
+            avoid_duplicates: true,
+            supports_rotation: false,
+            admin_only: false,
+          },
+        ],
+      },
+    });
+    const layout = [
+      { ...homeLayout("for-you"), section_type: "recommended_for_you" },
+      { ...homeLayout("top-picks"), section_type: "taste_match" },
+      homeLayout("recent"),
+    ];
+    const rows: Record<string, string[]> = {
+      "for-you": ["Shared", "For You Only"],
+      "top-picks": ["Shared", "Top Pick Only"],
+      recent: ["Shared"],
+    };
+    mockUseHomeLayout.mockReturnValue({
+      data: { sections: layout },
+      isLoading: false,
+      isError: false,
+      refetch: vi.fn(),
+    });
+    const requests = deferSectionRequests();
+    const respond = (sectionId: string) => {
+      const request = requests.find((candidate) => candidate.sectionId === sectionId)!;
+      const entry = layout.find((candidate) => candidate.id === sectionId)!;
+      request.respond({
+        section: {
+          ...entry,
+          total_count: rows[sectionId]!.length,
+          items: rows[sectionId]!.map((title) => ({
+            ...homeSection(sectionId).section.items[0],
+            content_id: title,
+            title,
+          })),
+        },
+      });
+    };
+
+    await renderHome(new QueryClient());
+    await waitForRequestCount(requests, 3);
+
+    // The later rows answer first and show the shared title.
+    respond("top-picks");
+    respond("recent");
+    await waitForRenderedFirstItems({ "top-picks": "Shared", recent: "Shared" });
+
+    // Once the first row loads, the later avoid-duplicates row gives it up;
+    // the plain row keeps it.
+    respond("for-you");
+    await waitForRenderedFirstItems({
+      "for-you": "Shared",
+      "top-picks": "Top Pick Only",
+      recent: "Shared",
+    });
+  });
+
   async function renderHome(queryClient: QueryClient) {
     await act(async () => {
       root.render(
@@ -893,6 +974,7 @@ interface DeferredSectionRequest {
   sectionId: string;
   signal: AbortSignal;
   resolve: (label: string) => void;
+  respond: (response: unknown) => void;
   reject: (error: Error) => void;
 }
 
@@ -907,6 +989,7 @@ function deferSectionRequests(): DeferredSectionRequest[] {
           sectionId,
           signal: options.signal,
           resolve: (label) => resolve(homeSection(sectionId, label)),
+          respond: resolve,
           reject,
         });
       }),
diff --git a/web/src/pages/Home.tsx b/web/src/pages/Home.tsx
index 38f64f836c..26bfd5d967 100644
--- a/web/src/pages/Home.tsx
+++ b/web/src/pages/Home.tsx
@@ -1,4 +1,4 @@
-/* eslint-disable react-hooks/set-state-in-effect */
+/* eslint-disable react-hooks/set-state-in-effect -- section state resets when the layout or cache changes, and the reveal gates follow sidebar transitions */
 import { memo, startTransition, useEffect, useMemo, useRef, useState } from "react";
 import { useQueryClient, type QueryClient } from "@tanstack/react-query";
 import { Link } from "react-router";
@@ -23,6 +23,7 @@ import {
 import { planNextHomeSectionBatch } from "./homeSectionQueue";
 import { buildHomeSectionViewModel, type HomeSectionSlot } from "./homeSectionState";
 import { collectCachedHomeSections } from "./homeSectionCache";
+import { useDedupedSections } from "./sectionDedupe";
 import { useSectionRefreshSignal } from "./homeSurfaceRefresh";
 import { useUICustomization } from "@/hooks/useUICustomization";
 import { carouselIntrinsicHeight } from "@/lib/uiCustomization";
@@ -221,12 +222,30 @@ export default function Home() {
     if (hasFirstContent) markCriticalContentLoaded();
   }, [hasFirstContent]);
 
+  const visibleSections = useDedupedSections(layout, loadedSections);
+
   const viewModel = buildHomeSectionViewModel({
     layout,
-    loadedSections,
+    loadedSections: visibleSections,
     failedIds,
   });
 
+  // Refetches one section in place through the regular loader, keeping its
+  // current items on screen; the Featured hero uses it while an on-view
+  // translation runs.
+  const refreshSection = (sectionId: string) => {
+    void queryClient
+      .invalidateQueries({ queryKey: sectionKeys.homeItems(sectionId), refetchType: "none" })
+      .then(() =>
+        setCompletedIds((prev) => {
+          if (!prev.has(sectionId)) return prev;
+          const next = new Set(prev);
+          next.delete(sectionId);
+          return next;
+        }),
+      );
+  };
+
   const retrySection = (sectionId: string) => {
     queryClient.removeQueries({ queryKey: sectionKeys.homeItems(sectionId) });
     setFailedIds((prev) => {
@@ -242,7 +261,7 @@ export default function Home() {
       return next;
     });
   };
-  const heroSlot = renderHeroSlot(viewModel.hero, retrySection);
+  const heroSlot = renderHeroSlot(viewModel.hero, retrySection, refreshSection);
   const hasHeroSlot = heroSlot !== null;
   const rowPlaceholderHeight = carouselIntrinsicHeight(cardPresentation.poster_size);
   // Rows count toward the eager budget by layout position: a loading or
@@ -474,11 +493,21 @@ function setsHaveSameEntries<T>(left: Set<T>, right: Set<T>): boolean {
   return true;
 }
 
-function renderHeroSlot(hero: HomeSectionSlot | null, retrySection: (sectionId: string) => void) {
+function renderHeroSlot(
+  hero: HomeSectionSlot | null,
+  retrySection: (sectionId: string) => void,
+  refreshSection: (sectionId: string) => void,
+) {
   if (!hero) return null;
 
   if (hero.state === "ready" && hero.section) {
-    return <HeroBanner items={hero.section.items} maxSlides={hero.layout.item_limit} />;
+    return (
+      <HeroBanner
+        items={hero.section.items}
+        maxSlides={hero.layout.item_limit}
+        onRefreshItems={() => refreshSection(hero.layout.id)}
+      />
+    );
   }
 
   if (hero.state === "error") {
diff --git a/web/src/pages/ItemDetail/AudiobookContent.tsx b/web/src/pages/ItemDetail/AudiobookContent.tsx
index 281ad48b93..c38582f999 100644
--- a/web/src/pages/ItemDetail/AudiobookContent.tsx
+++ b/web/src/pages/ItemDetail/AudiobookContent.tsx
@@ -17,6 +17,7 @@ import { audiobookFilesFromVersions } from "@/lib/audiobooks/files";
 import { useAudiobookPlaybackController } from "@/pages/audiobooks/player/audiobookPlaybackContext";
 import { coldResumePosition } from "@/pages/audiobooks/player/smartRewind";
 import { getAudiobookSmartRewind } from "@/pages/audiobooks/player/useAudiobookPrefs";
+import { hasMachineTranslation } from "./components/machineTranslation";
 
 function formatSeconds(totalSeconds: number): string {
   if (!Number.isFinite(totalSeconds) || totalSeconds < 0) return "";
@@ -164,6 +165,7 @@ export default function AudiobookContent({
       />
 
       <DetailHero
+        overviewMachineTranslated={hasMachineTranslation(item.machine_translated_fields)}
         title={item.title}
         topNav={<PageBack />}
         context="Audiobook"
diff --git a/web/src/pages/ItemDetail/DetailHero.tsx b/web/src/pages/ItemDetail/DetailHero.tsx
index 33f76bf14a..281fa7d072 100644
--- a/web/src/pages/ItemDetail/DetailHero.tsx
+++ b/web/src/pages/ItemDetail/DetailHero.tsx
@@ -8,6 +8,7 @@ import { useShowTitleArt } from "@/hooks/useTitleArt";
 import "./detailLayout.css";
 import DetailOverview from "./components/DetailOverview";
 import DetailTitle from "./DetailTitle";
+import MachineTranslatedLabel from "./components/MachineTranslatedLabel";
 
 interface DetailHeroProps {
   title: string;
@@ -37,6 +38,10 @@ interface DetailHeroProps {
   overviewTranslating?: boolean;
   /** When set, renders a small "Translate" chip under the overview. */
   onTranslateOverview?: () => void;
+  /** Labels the overview as machine-translated by AI. */
+  overviewMachineTranslated?: boolean;
+  /** Marks the tagline as machine-translated by AI. */
+  taglineMachineTranslated?: boolean;
   /** Spoiler protection: keep the overview behind a reveal button. */
   overviewHidden?: boolean;
   onRevealOverview?: () => void;
@@ -67,6 +72,8 @@ export default function DetailHero({
   overview,
   overviewTranslating = false,
   onTranslateOverview,
+  overviewMachineTranslated = false,
+  taglineMachineTranslated = false,
   overviewHidden = false,
   onRevealOverview,
   actions,
@@ -302,6 +309,9 @@ export default function DetailHero({
                     }`}
                   >
                     {tagline || subtitle}
+                    {tagline && taglineMachineTranslated && (
+                      <MachineTranslatedLabel compact className="ml-1.5 align-middle not-italic" />
+                    )}
                   </div>
                 )}
 
@@ -317,6 +327,7 @@ export default function DetailHero({
                     clamp={isViewportBounded}
                     translating={overviewTranslating}
                     onTranslate={onTranslateOverview}
+                    machineTranslated={overviewMachineTranslated}
                     hidden={overviewHidden}
                     onReveal={onRevealOverview}
                   />
diff --git a/web/src/pages/ItemDetail/EbookContent.tsx b/web/src/pages/ItemDetail/EbookContent.tsx
index a53647229d..e1dfff6218 100644
--- a/web/src/pages/ItemDetail/EbookContent.tsx
+++ b/web/src/pages/ItemDetail/EbookContent.tsx
@@ -22,6 +22,7 @@ import ScoreRow from "./components/ScoreRow";
 import { getWatchedActionLabel } from "./watchedState";
 import { formatFileSize } from "@/lib/mediaFormat";
 import { formatPageCount, metadataLine } from "./components/versionFormatUtils";
+import { hasMachineTranslation } from "./components/machineTranslation";
 
 function authorNames(item: ItemDetail): string[] {
   const extensionAuthors = (item.ebook?.authors ?? [])
@@ -112,6 +113,7 @@ export default function EbookContent({
   return (
     <div>
       <DetailHero
+        overviewMachineTranslated={hasMachineTranslation(item.machine_translated_fields)}
         title={item.title}
         topNav={<PageBack />}
         context="Ebook"
diff --git a/web/src/pages/ItemDetail/EpisodeContent.test.tsx b/web/src/pages/ItemDetail/EpisodeContent.test.tsx
index 3128da85f6..21647816c4 100644
--- a/web/src/pages/ItemDetail/EpisodeContent.test.tsx
+++ b/web/src/pages/ItemDetail/EpisodeContent.test.tsx
@@ -107,6 +107,15 @@ vi.mock("@/hooks/queries/admin/libraries", () => ({
   useLibraryCapabilities: mocks.useLibraryCapabilities,
 }));
 
+const resetProgressMocks = vi.hoisted(() => ({
+  useResetProgressAction: vi.fn((): (() => void) | undefined => undefined),
+}));
+
+vi.mock("@/hooks/queries/progress", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("@/hooks/queries/progress")>()),
+  useResetProgressAction: resetProgressMocks.useResetProgressAction,
+}));
+
 vi.mock("@/hooks/queries/items", () => ({
   useRedetectItemMarkers: mocks.useRedetectItemMarkers,
   useRedetectEpisodeIntro: mocks.useRedetectEpisodeIntro,
@@ -481,6 +490,34 @@ describe("EpisodeContent", () => {
     }
   });
 
+  it("passes the reset progress action for the episode's resume position", () => {
+    const resetProgress = vi.fn();
+    resetProgressMocks.useResetProgressAction.mockImplementation(() => resetProgress);
+    try {
+      renderToStaticMarkup(
+        <MemoryRouter initialEntries={["/item/episode-1"]}>
+          <EpisodeContent
+            item={makeEpisodeItem({
+              user_data: {
+                played: false,
+                is_in_progress: true,
+                position_seconds: 300,
+                duration_seconds: 1800,
+              },
+            })}
+          />
+        </MemoryRouter>,
+      );
+    } finally {
+      resetProgressMocks.useResetProgressAction.mockImplementation(() => undefined);
+    }
+
+    expect(resetProgressMocks.useResetProgressAction).toHaveBeenCalledWith(
+      expect.objectContaining({ content_id: "episode-1" }),
+    );
+    expect(mocks.capturedActionBarProps.value?.onResetProgress).toBe(resetProgress);
+  });
+
   it("passes restartHref when the episode is partially watched", () => {
     renderToStaticMarkup(
       <MemoryRouter initialEntries={["/item/episode-1"]}>
diff --git a/web/src/pages/ItemDetail/EpisodeContent.tsx b/web/src/pages/ItemDetail/EpisodeContent.tsx
index eec75e04bd..ed1a26b189 100644
--- a/web/src/pages/ItemDetail/EpisodeContent.tsx
+++ b/web/src/pages/ItemDetail/EpisodeContent.tsx
@@ -51,6 +51,7 @@ import {
 import { isEpisodeUnwatched } from "@/lib/episodeSpoilers";
 import { formatRuntimeMinutes } from "@/lib/mediaFormat";
 import { useQualityPreference } from "@/hooks/queries/qualityPreference";
+import { hasMachineTranslation } from "./components/machineTranslation";
 
 export default function EpisodeContent({ item }: { item: ItemDetail & { type: "episode" } }) {
   const { translating: overviewTranslating, onTranslate: onTranslateOverview } =
@@ -338,6 +339,7 @@ export default function EpisodeContent({ item }: { item: ItemDetail & { type: "e
           overview={item.overview}
           overviewTranslating={overviewTranslating}
           onTranslateOverview={onTranslateOverview}
+          overviewMachineTranslated={hasMachineTranslation(item.machine_translated_fields)}
           overviewHidden={overviewHidden}
           onRevealOverview={() => setRevealedOverviewId(item.content_id)}
           crewLine={<HeroCrewLine crew={item.crew ?? []} />}
diff --git a/web/src/pages/ItemDetail/MangaContent.tsx b/web/src/pages/ItemDetail/MangaContent.tsx
index c26c466382..6d4c2298bd 100644
--- a/web/src/pages/ItemDetail/MangaContent.tsx
+++ b/web/src/pages/ItemDetail/MangaContent.tsx
@@ -44,6 +44,7 @@ import MetadataBadges from "./components/MetadataBadges";
 import ScoreRow from "./components/ScoreRow";
 import { formatFileSize } from "@/lib/mediaFormat";
 import { formatPageCount, metadataLine } from "./components/versionFormatUtils";
+import { hasMachineTranslation } from "./components/machineTranslation";
 
 function genreHref(genre: string, libraryId?: number): string {
   const params = new URLSearchParams();
@@ -292,6 +293,7 @@ export default function MangaContent({
   return (
     <div>
       <DetailHero
+        overviewMachineTranslated={hasMachineTranslation(item.machine_translated_fields)}
         title={item.title}
         topNav={<PageBack />}
         context="Manga"
diff --git a/web/src/pages/ItemDetail/MovieContent.test.tsx b/web/src/pages/ItemDetail/MovieContent.test.tsx
index b060a40c99..6d2971f8fa 100644
--- a/web/src/pages/ItemDetail/MovieContent.test.tsx
+++ b/web/src/pages/ItemDetail/MovieContent.test.tsx
@@ -72,6 +72,11 @@ vi.mock("@/hooks/queries/watchlist", () => ({
   useToggleWatchlist: mocks.useToggleWatchlist,
 }));
 
+vi.mock("@/hooks/queries/notInterested", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("@/hooks/queries/notInterested")>()),
+  useToggleNotInterested: () => ({ isPending: false, mutate: vi.fn(), mutateAsync: vi.fn() }),
+}));
+
 vi.mock("@/hooks/queries/admin/markers", () => ({
   useAdminMarkerCapabilities: mocks.useAdminMarkerCapabilities,
 }));
@@ -80,6 +85,15 @@ vi.mock("@/hooks/queries/admin/libraries", () => ({
   useLibraryCapabilities: mocks.useLibraryCapabilities,
 }));
 
+const resetProgressMocks = vi.hoisted(() => ({
+  useResetProgressAction: vi.fn((): (() => void) | undefined => undefined),
+}));
+
+vi.mock("@/hooks/queries/progress", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("@/hooks/queries/progress")>()),
+  useResetProgressAction: resetProgressMocks.useResetProgressAction,
+}));
+
 vi.mock("@/hooks/queries/items", () => ({
   useRefreshItemMetadata: mocks.useRefreshItemMetadata,
   useRedetectItemMarkers: mocks.useRedetectItemMarkers,
@@ -126,10 +140,6 @@ vi.mock("@/components/CastCarousel", () => ({
   default: () => <div />,
 }));
 
-vi.mock("@/components/CrewList", () => ({
-  default: () => <div />,
-}));
-
 vi.mock("@/components/DownloadVersionPicker", () => ({
   default: () => <div />,
 }));
@@ -344,6 +354,34 @@ describe("MovieContent", () => {
     });
   });
 
+  it("passes the reset progress action for the movie's resume position", () => {
+    const resetProgress = vi.fn();
+    resetProgressMocks.useResetProgressAction.mockImplementation(() => resetProgress);
+    try {
+      renderToStaticMarkup(
+        <MemoryRouter initialEntries={["/item/movie-1"]}>
+          <MovieContent
+            item={makeMovieItem({
+              user_data: {
+                played: false,
+                is_in_progress: true,
+                position_seconds: 600,
+                duration_seconds: 3600,
+              },
+            })}
+          />
+        </MemoryRouter>,
+      );
+    } finally {
+      resetProgressMocks.useResetProgressAction.mockImplementation(() => undefined);
+    }
+
+    expect(resetProgressMocks.useResetProgressAction).toHaveBeenCalledWith(
+      expect.objectContaining({ content_id: "movie-1" }),
+    );
+    expect(mocks.capturedActionBarProps.value?.onResetProgress).toBe(resetProgress);
+  });
+
   it("passes restartHref when the movie is partially watched", () => {
     renderToStaticMarkup(
       <MemoryRouter initialEntries={["/item/movie-1"]}>
diff --git a/web/src/pages/ItemDetail/MovieContent.tsx b/web/src/pages/ItemDetail/MovieContent.tsx
index 9001b39635..90bbaa5de8 100644
--- a/web/src/pages/ItemDetail/MovieContent.tsx
+++ b/web/src/pages/ItemDetail/MovieContent.tsx
@@ -12,7 +12,7 @@ import { useIsActingAdmin } from "@/hooks/useIsActingAdmin";
 import { useAmbientColor } from "@/hooks/useAmbientColor";
 import { useCurrentProfile } from "@/hooks/useCurrentProfile";
 import CastCarousel from "@/components/CastCarousel";
-import CrewList from "@/components/CrewList";
+import { buildCrewGroups } from "@/components/castCrewGroups";
 import DownloadVersionPicker from "@/components/DownloadVersionPicker";
 import EditMetadataDialog from "@/components/EditMetadataDialog";
 import MediaLocations from "@/components/MediaLocations";
@@ -44,6 +44,7 @@ import {
 import { formatRuntimeMinutes } from "@/lib/mediaFormat";
 import { useQualityPreference } from "@/hooks/queries/qualityPreference";
 import { useDetailWatchTogether } from "@/pages/watchtogether/DetailWatchTogether";
+import { hasMachineTranslation } from "./components/machineTranslation";
 
 export default function MovieContent({
   item,
@@ -90,6 +91,7 @@ export default function MovieContent({
   const [downloadOpen, setDownloadOpen] = useState(false);
   const [subtitleSearchOpen, setSubtitleSearchOpen] = useState(false);
   const [mediaInfoOpen, setMediaInfoOpen] = useState(false);
+  const crewGroups = useMemo(() => buildCrewGroups(item.crew ?? [], "Director"), [item.crew]);
   const [mediaInfoFileId, setMediaInfoFileId] = useState<number | null>(null);
 
   // Version selection state — drives the Play button and inline stream popovers.
@@ -277,6 +279,11 @@ export default function MovieContent({
           overview={item.overview}
           overviewTranslating={overviewTranslating}
           onTranslateOverview={onTranslateOverview}
+          overviewMachineTranslated={hasMachineTranslation(item.machine_translated_fields)}
+          taglineMachineTranslated={hasMachineTranslation(
+            item.machine_translated_fields,
+            "tagline",
+          )}
           crewLine={<HeroCrewLine crew={item.crew ?? []} genres={item.genres} />}
           actions={
             <MediaUserActionBar
@@ -425,14 +432,12 @@ export default function MovieContent({
 
       {item.extras && item.extras.length > 0 && <ExtrasSection extras={item.extras} />}
 
-      {item.cast && item.cast.length > 0 && (
-        <DetailSection title="Cast">
-          <CastCarousel cast={item.cast} prefetchPeople />
+      {((item.cast?.length ?? 0) > 0 || crewGroups.some((g) => g.members.length > 0)) && (
+        <DetailSection title="Cast & Crew">
+          <CastCarousel cast={item.cast ?? []} crewGroups={crewGroups} limit={12} prefetchPeople />
         </DetailSection>
       )}
 
-      {item.crew && item.crew.length > 0 && <CrewList crew={item.crew} />}
-
       {/* More Like This */}
       {similarLoading ? (
         <RecommendationGridSkeleton />
diff --git a/web/src/pages/ItemDetail/SeasonContent.test.tsx b/web/src/pages/ItemDetail/SeasonContent.test.tsx
index b2b302dfbd..bd419c7038 100644
--- a/web/src/pages/ItemDetail/SeasonContent.test.tsx
+++ b/web/src/pages/ItemDetail/SeasonContent.test.tsx
@@ -1,3 +1,4 @@
+import { fireEvent, render, screen } from "@testing-library/react";
 import type { ReactNode } from "react";
 import { renderToStaticMarkup } from "react-dom/server";
 import { MemoryRouter } from "react-router";
@@ -50,6 +51,15 @@ vi.mock("@/hooks/queries/episodes", () => ({
   useItemEpisodes: mocks.useItemEpisodes,
 }));
 
+const resetProgressMocks = vi.hoisted(() => ({
+  useResetProgressAction: vi.fn((): (() => void) | undefined => undefined),
+}));
+
+vi.mock("@/hooks/queries/progress", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("@/hooks/queries/progress")>()),
+  useResetProgressAction: resetProgressMocks.useResetProgressAction,
+}));
+
 vi.mock("@/hooks/queries/items", () => ({
   useRefreshItemMetadata: mocks.useRefreshItemMetadata,
   useWatchedStateMutation: mocks.useWatchedStateMutation,
@@ -330,4 +340,55 @@ describe("SeasonContent", () => {
     expect(markup).toContain("Season Director");
     expect(markup).not.toContain("Series Creator");
   });
+
+  it("offers the season's translation beside the episodes when there is no overview", () => {
+    const translate = vi.fn();
+    mocks.useOnViewTranslation.mockReturnValue({ translating: false, onTranslate: translate });
+    render(
+      <MemoryRouter>
+        <SeasonContent item={makeSeasonItem({ overview: "" })} />
+      </MemoryRouter>,
+    );
+    fireEvent.click(screen.getByRole("button", { name: "Translate episodes" }));
+    expect(translate).toHaveBeenCalledTimes(1);
+  });
+
+  it("leaves the action to the overview when the season has one", () => {
+    const translate = vi.fn();
+    mocks.useOnViewTranslation.mockReturnValue({ translating: false, onTranslate: translate });
+    render(
+      <MemoryRouter>
+        <SeasonContent item={makeSeasonItem()} />
+      </MemoryRouter>,
+    );
+    expect(screen.queryByRole("button", { name: "Translate episodes" })).not.toBeInTheDocument();
+    expect(mocks.capturedDetailHeroProps.value).toMatchObject({ onTranslateOverview: translate });
+  });
+
+  it("moves the action to the episodes when an episode is what is missing", () => {
+    const translate = vi.fn();
+    mocks.useOnViewTranslation.mockReturnValue({ translating: false, onTranslate: translate });
+    const listed = mocks.useItemEpisodes();
+    mocks.useItemEpisodes.mockReturnValue({
+      ...listed,
+      data: {
+        ...listed.data,
+        episodes: listed.data.episodes.map((episode: object) => ({
+          ...episode,
+          pending_translation_language: "fr",
+        })),
+      },
+    });
+    render(
+      <MemoryRouter>
+        <SeasonContent item={makeSeasonItem()} />
+      </MemoryRouter>,
+    );
+    fireEvent.click(screen.getByRole("button", { name: "Translate episodes" }));
+    expect(translate).toHaveBeenCalledTimes(1);
+    expect(mocks.capturedDetailHeroProps.value).toMatchObject({
+      overviewTranslating: false,
+      onTranslateOverview: undefined,
+    });
+  });
 });
diff --git a/web/src/pages/ItemDetail/SeasonContent.tsx b/web/src/pages/ItemDetail/SeasonContent.tsx
index 7644bf4f0b..99bc68c71b 100644
--- a/web/src/pages/ItemDetail/SeasonContent.tsx
+++ b/web/src/pages/ItemDetail/SeasonContent.tsx
@@ -22,6 +22,8 @@ import DetailBreadcrumb from "./components/DetailBreadcrumb";
 import SeasonEpisodeGrid from "./components/SeasonEpisodeGrid";
 import type { EpisodeNavigationState } from "./itemDetailLayout";
 import { canCurateMetadata as canCurateMetadataForUser } from "@/lib/permissions";
+import { hasMachineTranslation } from "./components/machineTranslation";
+import EpisodesTranslationAction from "./components/EpisodesTranslationAction";
 
 function seasonLabel(seasonNumber: number, title?: string) {
   if (title) return title;
@@ -49,6 +51,13 @@ export default function SeasonContent({ item }: { item: ItemDetail & { type: "se
   } = useItemEpisodes(item.content_id);
 
   const episodes = episodesData?.episodes ?? [];
+  // The season's pending language also covers its episodes. While an episode
+  // is the thing missing, or the season has no overview of its own, the
+  // translation status and action sit with the episode list; otherwise the
+  // hero offers them under the overview.
+  const episodesPending = episodes.some((episode) => episode.pending_translation_language);
+  const translationWithEpisodes = !item.overview || episodesPending;
+  const translationInHero = !translationWithEpisodes && !episodesLoading;
   const seasonNumber = item.season_number ?? 0;
   const label = item.is_specials ? "Specials" : seasonLabel(seasonNumber, item.title);
   const seriesTitle = item.series_title ?? "Series";
@@ -133,8 +142,9 @@ export default function SeasonContent({ item }: { item: ItemDetail & { type: "se
             />
           }
           overview={item.overview}
-          overviewTranslating={overviewTranslating}
-          onTranslateOverview={onTranslateOverview}
+          overviewTranslating={translationInHero && overviewTranslating}
+          onTranslateOverview={translationInHero ? onTranslateOverview : undefined}
+          overviewMachineTranslated={hasMachineTranslation(item.machine_translated_fields)}
           actions={
             <WatchedActionBar
               compactMobile
@@ -176,9 +186,17 @@ export default function SeasonContent({ item }: { item: ItemDetail & { type: "se
           <section>
             <div className="mb-5 flex items-center justify-between gap-3">
               <h2 className="text-xl font-semibold tracking-tight">Episodes</h2>
-              <span className="text-muted-foreground text-sm">
-                {item.episode_count ?? episodes.length} total
-              </span>
+              <div className="flex items-center gap-3">
+                {translationWithEpisodes && (
+                  <EpisodesTranslationAction
+                    translating={overviewTranslating}
+                    onTranslate={onTranslateOverview}
+                  />
+                )}
+                <span className="text-muted-foreground text-sm">
+                  {item.episode_count ?? episodes.length} total
+                </span>
+              </div>
             </div>
 
             <SeasonEpisodeGrid
diff --git a/web/src/pages/ItemDetail/SeriesContent.test.tsx b/web/src/pages/ItemDetail/SeriesContent.test.tsx
index 36d6d25539..6054db0d22 100644
--- a/web/src/pages/ItemDetail/SeriesContent.test.tsx
+++ b/web/src/pages/ItemDetail/SeriesContent.test.tsx
@@ -1,10 +1,10 @@
+import { fireEvent, render, screen } from "@testing-library/react";
 import type { ReactNode } from "react";
 import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
 import { renderToStaticMarkup } from "react-dom/server";
 import { MemoryRouter } from "react-router";
 import { beforeEach, describe, expect, it, vi } from "vitest";
-import type { CrewMember, ItemDetail, Season } from "@/api/types";
-import { buildPersonCatalogHref } from "@/pages/catalogSearchParams";
+import type { ItemDetail, Season } from "@/api/types";
 import SeriesContent from "./SeriesContent";
 
 const mocks = vi.hoisted(() => {
@@ -30,6 +30,7 @@ const mocks = vi.hoisted(() => {
     useWatchedStateMutation: vi.fn(),
     useSeasons: vi.fn(),
     useItemEpisodes: vi.fn(),
+    useOnViewTranslation: vi.fn(),
     useSimilarItems: vi.fn(),
     useSetRating: vi.fn(),
     useDeleteRating: vi.fn(),
@@ -45,7 +46,7 @@ vi.mock("@/pages/watchtogether/DetailWatchTogether", () => ({
   useDetailWatchTogether: () => ({ menu: undefined, sheet: null }),
 }));
 vi.mock("@/hooks/useOnViewTranslation", () => ({
-  useOnViewTranslation: () => ({ translating: false, onTranslate: undefined }),
+  useOnViewTranslation: mocks.useOnViewTranslation,
 }));
 
 vi.mock("@/hooks/useAuth", () => ({
@@ -67,6 +68,11 @@ vi.mock("@/hooks/queries/watchlist", () => ({
   useToggleWatchlist: mocks.useToggleWatchlist,
 }));
 
+vi.mock("@/hooks/queries/notInterested", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("@/hooks/queries/notInterested")>()),
+  useToggleNotInterested: () => ({ isPending: false, mutate: vi.fn(), mutateAsync: vi.fn() }),
+}));
+
 vi.mock("@/hooks/queries/items", () => ({
   useRefreshItemMetadata: mocks.useRefreshItemMetadata,
   useWatchedStateMutation: mocks.useWatchedStateMutation,
@@ -219,6 +225,27 @@ describe("SeriesContent", () => {
     mocks.useSimilarItems.mockReturnValue({ data: undefined, isLoading: false });
     mocks.useSetRating.mockReturnValue({ mutate: mocks.setRatingMutate });
     mocks.useDeleteRating.mockReturnValue({ mutate: mocks.deleteRatingMutate });
+    mocks.useOnViewTranslation.mockReturnValue({ translating: false, onTranslate: undefined });
+  });
+
+  it("offers the season's translation for the inline episode list in button mode", () => {
+    const translateSeason = vi.fn();
+    mocks.useOnViewTranslation.mockImplementation((target?: { content_id: string }) => ({
+      translating: false,
+      onTranslate: target?.content_id === makeSeason().content_id ? translateSeason : undefined,
+    }));
+    mocks.useItemEpisodes.mockReturnValue({
+      data: { episodes: [{ content_id: "episode-1", pending_translation_language: "de" }] },
+    });
+    render(
+      <QueryClientProvider client={new QueryClient()}>
+        <MemoryRouter>
+          <SeriesContent item={makeSeriesItem()} />
+        </MemoryRouter>
+      </QueryClientProvider>,
+    );
+    fireEvent.click(screen.getByRole("button", { name: "Translate episodes" }));
+    expect(translateSeason).toHaveBeenCalledTimes(1);
   });
 
   it.each([
@@ -264,33 +291,4 @@ describe("SeriesContent", () => {
     expect(mocks.setRatingMutate).toHaveBeenCalledWith(5);
     expect(mocks.deleteRatingMutate).toHaveBeenCalledTimes(1);
   });
-
-  it("lists every creator in the Crew section, past the two the hero line shows", () => {
-    const creators: CrewMember[] = [
-      { name: "Creator One", job: "Creator", person_id: "creator-1" },
-      { name: "Creator Two", job: "Creator", person_id: "creator-2" },
-      { name: "Creator Three", job: "Creator", person_id: "creator-3" },
-    ];
-    const crew: CrewMember[] = [
-      ...creators,
-      { name: "Series Director", job: "Director", person_id: "director-1" },
-    ];
-
-    // DetailHero and HeroCrewLine are mocked, so these names can only come
-    // from the Crew section.
-    const markup = renderToStaticMarkup(
-      <QueryClientProvider client={new QueryClient()}>
-        <MemoryRouter initialEntries={["/item/series-1"]}>
-          <SeriesContent item={makeSeriesItem({ crew })} />
-        </MemoryRouter>
-      </QueryClientProvider>,
-    );
-
-    // Prairie's crew rail has no job headings: creators lead, then the director.
-    for (const creator of creators) {
-      expect(markup).toContain(`href="${buildPersonCatalogHref(creator.person_id)}"`);
-      expect(markup).toContain(creator.name);
-    }
-    expect(markup.indexOf("Creator Three")).toBeLessThan(markup.indexOf("Series Director"));
-  });
 });
diff --git a/web/src/pages/ItemDetail/SeriesContent.tsx b/web/src/pages/ItemDetail/SeriesContent.tsx
index b5699a5da5..d8f1c0a4ab 100644
--- a/web/src/pages/ItemDetail/SeriesContent.tsx
+++ b/web/src/pages/ItemDetail/SeriesContent.tsx
@@ -13,7 +13,7 @@ import { useCurrentProfile } from "@/hooks/useCurrentProfile";
 import { useMissingSeasonsRequestable } from "@/hooks/useCanRequest";
 import { RequestSeasonsDialog } from "@/components/RequestSeasonsDialog";
 import CastCarousel from "@/components/CastCarousel";
-import CrewList from "@/components/CrewList";
+import { buildCrewGroups } from "@/components/castCrewGroups";
 import EditMetadataDialog from "@/components/EditMetadataDialog";
 import MatchItemDialog from "@/components/MatchItemDialog";
 import SplitItemDialog from "@/components/SplitItemDialog";
@@ -35,16 +35,12 @@ import { SeasonCarouselSkeleton, RecommendationGridSkeleton } from "./components
 import { getSeasonDisplayTitle, resolveSeriesPrimaryAction } from "./itemDetailLayout";
 import { canCurateMetadata as canCurateMetadataForUser } from "@/lib/permissions";
 import { cn } from "@/lib/utils";
+import { hasMachineTranslation } from "./components/machineTranslation";
+import EpisodesTranslationAction from "./components/EpisodesTranslationAction";
 
 /** Series lead with their creators; one without Creator credits keeps showing its directors. */
 const SERIES_LEAD_JOBS = ["Creator", "Director"] as const;
 
-/**
- * The series Crew section lists every creator ahead of the usual crew. Season
- * and episode pages keep CrewList's default jobs, so creators stay on the series.
- */
-const SERIES_CREW_JOBS = ["Creator", "Director", "Writer", "Producer"] as const;
-
 export default function SeriesContent({
   item,
   showAdvisoryAge,
@@ -81,6 +77,7 @@ export default function SeriesContent({
   const { data: seasonsData, isLoading: seasonsLoading } = useSeasons(item.content_id);
   const { data: similarData, isLoading: similarLoading } = useSimilarItems(item.content_id);
   const seasons = useMemo(() => seasonsData?.seasons ?? [], [seasonsData?.seasons]);
+  const crewGroups = useMemo(() => buildCrewGroups(item.crew ?? [], "Creator"), [item.crew]);
 
   const title = item.title ?? "";
   const firstYear = item.first_air_date?.slice(0, 4);
@@ -97,6 +94,21 @@ export default function SeriesContent({
 
   const primaryAction = resolveSeriesPrimaryAction(item);
   const singleSeasonEpisodesQuery = useItemEpisodes(singleSeason?.content_id);
+  // A single-season show lists its episodes here rather than on a season
+  // page, so this page starts the season's on-view translation (the season
+  // job covers its episodes) when an episode reports a missing description.
+  const singleSeasonPendingLanguage = singleSeasonEpisodesQuery.data?.episodes.find(
+    (episode) => episode.pending_translation_language,
+  )?.pending_translation_language;
+  const { translating: episodesTranslating, onTranslate: onTranslateEpisodes } =
+    useOnViewTranslation(
+      singleSeason
+        ? {
+            content_id: singleSeason.content_id,
+            pending_translation_language: singleSeasonPendingLanguage,
+          }
+        : undefined,
+    );
   const singleSeasonEpisodeLinkState = singleSeason
     ? {
         parentSeasonHref: `/item/${singleSeason.content_id}`,
@@ -163,6 +175,11 @@ export default function SeriesContent({
             overview={item.overview}
             overviewTranslating={overviewTranslating}
             onTranslateOverview={onTranslateOverview}
+            overviewMachineTranslated={hasMachineTranslation(item.machine_translated_fields)}
+            taglineMachineTranslated={hasMachineTranslation(
+              item.machine_translated_fields,
+              "tagline",
+            )}
             crewLine={
               <HeroCrewLine
                 crew={item.crew ?? []}
@@ -229,9 +246,15 @@ export default function SeriesContent({
                 <section>
                   <div className="mb-5 flex items-center justify-between gap-3">
                     <h2 className="text-xl font-semibold tracking-tight">Episodes</h2>
-                    <span className="text-muted-foreground text-sm">
-                      {singleSeason.episode_count} total
-                    </span>
+                    <div className="flex items-center gap-3">
+                      <EpisodesTranslationAction
+                        translating={episodesTranslating}
+                        onTranslate={onTranslateEpisodes}
+                      />
+                      <span className="text-muted-foreground text-sm">
+                        {singleSeason.episode_count} total
+                      </span>
+                    </div>
                   </div>
                   <SeasonEpisodeGrid
                     episodes={singleSeasonEpisodesQuery.data?.episodes ?? []}
@@ -276,12 +299,11 @@ export default function SeriesContent({
 
       {item.extras && item.extras.length > 0 && <ExtrasSection extras={item.extras} />}
 
-      {item.cast && item.cast.length > 0 && (
-        <DetailSection title="Cast">
-          <CastCarousel cast={item.cast} prefetchPeople />
+      {((item.cast?.length ?? 0) > 0 || crewGroups.some((g) => g.members.length > 0)) && (
+        <DetailSection title="Cast & Crew">
+          <CastCarousel cast={item.cast ?? []} crewGroups={crewGroups} limit={12} prefetchPeople />
         </DetailSection>
       )}
-      {item.crew && item.crew.length > 0 && <CrewList crew={item.crew} jobs={SERIES_CREW_JOBS} />}
 
       {similarLoading ? (
         <RecommendationGridSkeleton />
diff --git a/web/src/pages/ItemDetail/components/ActionBar.menu.test.tsx b/web/src/pages/ItemDetail/components/ActionBar.menu.test.tsx
index e4f81a66a1..e8e82d883f 100644
--- a/web/src/pages/ItemDetail/components/ActionBar.menu.test.tsx
+++ b/web/src/pages/ItemDetail/components/ActionBar.menu.test.tsx
@@ -1,4 +1,4 @@
-import { render, screen, waitFor, within } from "@testing-library/react";
+import { fireEvent, render, screen, waitFor, within } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import { MemoryRouter } from "react-router";
 import { afterEach, describe, expect, it, vi } from "vitest";
@@ -25,6 +25,11 @@ vi.mock("@/hooks/queries/admin/markers", () => ({
   useMarkerDetectionKinds: () => markerMocks.detectionKinds,
 }));
 
+async function openManage() {
+  await userEvent.click(screen.getByTitle("More"));
+  await userEvent.click(screen.getByRole("menuitem", { name: "Manage" }));
+}
+
 describe("ActionBar Add to collection", () => {
   it("names the title it adds", async () => {
     render(
@@ -60,7 +65,7 @@ describe("ActionBar marker re-detection", () => {
       </MemoryRouter>,
     );
 
-    await userEvent.click(screen.getByTitle("More"));
+    await openManage();
     await userEvent.click(screen.getByRole("menuitem", { name: "Re-detect Markers" }));
     const dialog = await screen.findByRole("dialog", { name: "Re-detect Markers" });
     for (const name of enabledLabels) {
@@ -73,7 +78,7 @@ describe("ActionBar marker re-detection", () => {
     }
     expect(within(dialog).getByRole("link", { name: "Change marker settings" })).toHaveAttribute(
       "href",
-      "/admin/settings/library",
+      "/admin/settings/playback",
     );
   });
 
@@ -85,7 +90,7 @@ describe("ActionBar marker re-detection", () => {
       </MemoryRouter>,
     );
 
-    await userEvent.click(screen.getByTitle("More"));
+    await openManage();
     await userEvent.click(screen.getByRole("menuitem", { name: "Re-detect Markers" }));
     const dialog = await screen.findByRole("dialog", { name: "Re-detect Markers" });
     for (const name of ["Intro", "Credits", "Intro and credits"]) {
@@ -102,7 +107,7 @@ describe("ActionBar marker re-detection", () => {
       </MemoryRouter>,
     );
 
-    await userEvent.click(screen.getByTitle("More"));
+    await openManage();
     expect(screen.queryByRole("menuitem", { name: "Re-detect Intro Markers" })).toBeNull();
     await userEvent.click(screen.getByRole("menuitem", { name: "Re-detect Markers" }));
     expect(onRedetectMarkers).not.toHaveBeenCalled();
@@ -127,7 +132,7 @@ describe("ActionBar marker re-detection", () => {
       </MemoryRouter>,
     );
 
-    await userEvent.click(screen.getByTitle("More"));
+    await openManage();
     await userEvent.click(screen.getByRole("menuitem", { name: "Re-detect Markers" }));
     const dialog = await screen.findByRole("dialog", { name: "Re-detect Markers" });
     await userEvent.click(within(dialog).getByRole("button", { name: label }));
@@ -147,7 +152,7 @@ describe("ActionBar marker re-detection", () => {
       </MemoryRouter>,
     );
 
-    await userEvent.click(screen.getByTitle("More"));
+    await openManage();
     expect(screen.queryByRole("menuitem", { name: "Re-detect Markers" })).toBeNull();
     await userEvent.click(screen.getByRole("menuitem", { name: "Re-detect Credits" }));
     expect(onRedetectMarkers).toHaveBeenCalledExactlyOnceWith("credits");
@@ -167,7 +172,7 @@ describe("ActionBar marker re-detection", () => {
       </MemoryRouter>,
     );
 
-    await userEvent.click(screen.getByTitle("More"));
+    await openManage();
     expect(screen.queryByRole("menuitem", { name: "Re-detect Markers" })).toBeNull();
     await userEvent.click(screen.getByRole("menuitem", { name: "Re-detect Intro Markers" }));
     expect(onRedetectMarkers).toHaveBeenCalledExactlyOnceWith("intro");
@@ -202,12 +207,11 @@ describe("ActionBar request and party actions", () => {
       </MemoryRouter>,
     );
     await userEvent.click(screen.getByTitle("More"));
-    expect(screen.getByText("Watch Together")).toBeInTheDocument();
     expect(screen.queryByRole("menuitem", { name: /Suggest to/ })).toBeNull();
     await userEvent.click(screen.getByRole("menuitem", { name: "Request Seasons" }));
     expect(onRequestSeasons).toHaveBeenCalledTimes(1);
     await userEvent.click(screen.getByTitle("More"));
-    await userEvent.click(screen.getByRole("menuitem", { name: "Start a party with this" }));
+    await userEvent.click(screen.getByRole("menuitem", { name: "Start a Watch Party" }));
     expect(onStartParty).toHaveBeenCalledTimes(1);
     view.unmount();
 
@@ -220,7 +224,6 @@ describe("ActionBar request and party actions", () => {
       </MemoryRouter>,
     );
     await userEvent.click(screen.getByTitle("More"));
-    expect(screen.getByText(/KX7Q2M is live/)).toBeInTheDocument();
     await userEvent.click(screen.getByRole("menuitem", { name: "Suggest to KX7Q2M" }));
     expect(onSuggest).toHaveBeenCalledTimes(1);
     await userEvent.click(screen.getByTitle("More"));
@@ -259,6 +262,60 @@ describe("ActionBar shuffle", () => {
   });
 });
 
+describe("ActionBar reset progress", () => {
+  it("leaves Play from Beginning to the Play button's resume prompt", async () => {
+    const onResetProgress = vi.fn();
+    render(
+      <MemoryRouter>
+        <ActionBar
+          contentId="movie-1"
+          playHref="/watch/movie-1"
+          playLabel="Resume"
+          restartHref="/watch/movie-1?restart=1"
+          onResetProgress={onResetProgress}
+        />
+      </MemoryRouter>,
+    );
+
+    await userEvent.click(screen.getByTitle("More"));
+    expect(screen.queryByRole("menuitem", { name: "Play from Beginning" })).toBeNull();
+    await userEvent.click(screen.getByRole("menuitem", { name: "Reset Progress" }));
+
+    expect(onResetProgress).toHaveBeenCalledOnce();
+    expect(screen.queryByRole("menu")).toBeNull();
+  });
+
+  it("offers Play from Beginning before Reset Progress when Play does not ask", async () => {
+    render(
+      <MemoryRouter>
+        <ActionBar
+          contentId="movie-1"
+          playHref="/watch/movie-1"
+          playLabel="Resume"
+          restartHref="/watch/movie-1?restart=1"
+          versions={[{ file_id: 1 }, { file_id: 2 }] as never}
+          onResetProgress={vi.fn()}
+        />
+      </MemoryRouter>,
+    );
+
+    await userEvent.click(screen.getByTitle("More"));
+    const labels = screen.getAllByRole("menuitem").map((item) => item.textContent);
+    expect(labels.slice(0, 2)).toEqual(["Play from Beginning", "Reset Progress"]);
+  });
+
+  it("leaves Reset Progress out without a resume position", async () => {
+    render(
+      <MemoryRouter>
+        <ActionBar contentId="movie-1" playHref="/watch/movie-1" />
+      </MemoryRouter>,
+    );
+
+    await userEvent.click(screen.getByTitle("More"));
+    expect(screen.queryByRole("menuitem", { name: "Reset Progress" })).toBeNull();
+  });
+});
+
 describe("ActionBar collection eligibility", () => {
   it.each(["movie", "series"])("keeps Add to Collection for %s", async (type) => {
     render(
@@ -296,3 +353,118 @@ describe("ActionBar collection eligibility", () => {
     expect(screen.queryByTitle("More")).toBeNull();
   });
 });
+
+describe("ActionBar Manage menu", () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  function renderAdmin() {
+    const onEditMetadata = vi.fn();
+    render(
+      <MemoryRouter>
+        <ActionBar
+          contentId="movie-1"
+          isAdmin
+          canCurateMetadata
+          onToggleWatchlist={vi.fn()}
+          onEditMetadata={onEditMetadata}
+          onMatchItem={vi.fn()}
+        />
+      </MemoryRouter>,
+    );
+    return { onEditMetadata };
+  }
+
+  // jsdom has no layout; the menus only move focus to items that render a box.
+  function mockLayout() {
+    vi.spyOn(HTMLElement.prototype, "getClientRects").mockReturnValue([
+      new DOMRect(0, 0, 100, 30),
+    ] as unknown as DOMRectList);
+  }
+
+  it("opens management actions in a second menu beside the first", async () => {
+    const { onEditMetadata } = renderAdmin();
+
+    await userEvent.click(screen.getByTitle("More"));
+    expect(screen.queryByRole("menuitem", { name: "Edit Metadata" })).toBeNull();
+    const manage = screen.getByRole("menuitem", { name: "Manage" });
+    expect(manage).toHaveAttribute("aria-expanded", "false");
+    await userEvent.click(manage);
+
+    expect(manage).toHaveAttribute("aria-expanded", "true");
+    expect(screen.getByRole("menuitem", { name: "Add to Watchlist" })).toBeInTheDocument();
+    const submenu = screen.getByRole("menu", { name: "Manage" });
+    const labels = within(submenu)
+      .getAllByRole("menuitem")
+      .map((item) => item.textContent);
+    expect(labels).toEqual(["Edit Metadata", "Match Item", "View Play History"]);
+    await userEvent.click(within(submenu).getByRole("menuitem", { name: "Edit Metadata" }));
+    expect(onEditMetadata).toHaveBeenCalledOnce();
+    expect(screen.queryByRole("menu")).toBeNull();
+  });
+
+  it("opens on hover and closes when another item is hovered", async () => {
+    renderAdmin();
+
+    await userEvent.click(screen.getByTitle("More"));
+    await userEvent.hover(screen.getByRole("menuitem", { name: "Manage" }));
+    expect(screen.getByRole("menu", { name: "Manage" })).toBeInTheDocument();
+    await userEvent.hover(screen.getByRole("menuitem", { name: "Add to Watchlist" }));
+    expect(screen.queryByRole("menu", { name: "Manage" })).toBeNull();
+  });
+
+  it.each(["{ArrowLeft}", "{Escape}"])(
+    "moves into Manage with ArrowRight and back to it with %s",
+    async (key) => {
+      mockLayout();
+      renderAdmin();
+
+      await userEvent.click(screen.getByTitle("More"));
+      const manage = screen.getByRole("menuitem", { name: "Manage" });
+      manage.focus();
+      await userEvent.keyboard("{ArrowRight}");
+      const submenu = screen.getByRole("menu", { name: "Manage" });
+      await waitFor(() =>
+        expect(within(submenu).getByRole("menuitem", { name: "Edit Metadata" })).toHaveFocus(),
+      );
+
+      await userEvent.keyboard(key);
+      expect(screen.queryByRole("menu", { name: "Manage" })).toBeNull();
+      expect(manage).toHaveFocus();
+      expect(manage).toHaveAttribute("aria-expanded", "false");
+    },
+  );
+
+  it("keeps Manage beside its trigger when the main menu scrolls", async () => {
+    renderAdmin();
+    await userEvent.click(screen.getByTitle("More"));
+    const manage = screen.getByRole("menuitem", { name: "Manage" });
+    let triggerTop = 200;
+    vi.spyOn(HTMLElement.prototype, "getBoundingClientRect").mockImplementation(function (
+      this: HTMLElement,
+    ) {
+      return this === manage ? new DOMRect(0, triggerTop, 120, 30) : new DOMRect(0, 0, 120, 100);
+    });
+    await userEvent.click(manage);
+    const submenu = screen.getByRole("menu", { name: "Manage" });
+    await waitFor(() => expect(submenu.style.top).toBe("195px"));
+
+    triggerTop = 100;
+    const mainMenu = screen.getAllByRole("menu").find((menu) => menu !== submenu)!;
+    fireEvent.scroll(mainMenu);
+    await waitFor(() => expect(submenu.style.top).toBe("95px"));
+  });
+
+  it("shows a lone management action in the main menu", async () => {
+    render(
+      <MemoryRouter>
+        <ActionBar contentId="movie-1" isAdmin onToggleWatchlist={vi.fn()} />
+      </MemoryRouter>,
+    );
+
+    await userEvent.click(screen.getByTitle("More"));
+    expect(screen.queryByRole("menuitem", { name: "Manage" })).toBeNull();
+    expect(screen.getByRole("menuitem", { name: "View Play History" })).toBeInTheDocument();
+  });
+});
diff --git a/web/src/pages/ItemDetail/components/ActionBar.tsx b/web/src/pages/ItemDetail/components/ActionBar.tsx
index bbe2ee57db..61213678f0 100644
--- a/web/src/pages/ItemDetail/components/ActionBar.tsx
+++ b/web/src/pages/ItemDetail/components/ActionBar.tsx
@@ -1,6 +1,10 @@
 import {
   type ComponentProps,
+  Fragment,
+  type FocusEvent as ReactFocusEvent,
   type KeyboardEvent,
+  type PointerEvent as ReactPointerEvent,
+  type ReactNode,
   useCallback,
   useEffect,
   useId,
@@ -16,7 +20,7 @@ import {
   Heart,
   Plus,
   Check,
-  Captions,
+  ChevronRight,
   Download,
   ExternalLink,
   FolderPlus,
@@ -31,10 +35,14 @@ import {
   RotateCcw,
   Shuffle,
   Tags,
+  TimerReset,
+  ThumbsDown,
   UsersRound,
   Hand,
+  Wrench,
   Zap,
 } from "lucide-react";
+import { cn } from "@/lib/utils";
 import AddToCollectionDialog from "@/components/AddToCollectionDialog";
 import { Button } from "@/components/ui/button";
 import {
@@ -70,6 +78,8 @@ const responsivePrimaryActionClass =
   "transform-gpu transition-transform duration-150 motion-safe:hover:scale-[1.02] motion-safe:active:scale-[0.98]";
 const responsivePlayActionClass = `${responsivePrimaryActionClass} hover:bg-primary motion-reduce:hover:bg-primary/90`;
 const staticGlassActionClass = "transition-none";
+const overflowMenuClass =
+  "detail-overflow-menu border-border bg-popover text-popover-foreground fixed z-50 max-h-[calc(100vh-1rem)] w-max max-w-[calc(100vw-2rem)] min-w-0 overflow-y-auto rounded-md border p-1 shadow-md";
 
 function visibleOverflowItems(menu: HTMLElement | null): HTMLButtonElement[] {
   if (!menu) return [];
@@ -102,13 +112,31 @@ function CommunityRatingLabel({
   );
 }
 
+function DetailOverflowSeparator() {
+  return <div role="separator" className="bg-border -mx-1 my-1 h-px" />;
+}
+
+/** Renders the non-empty groups with a separator between each. */
+function DetailOverflowGroups({ groups }: { groups: ReactNode[][] }) {
+  return groups
+    .map((group) => group.filter(Boolean))
+    .filter((group) => group.length > 0)
+    .map((group, index) => (
+      <Fragment key={index}>
+        {index > 0 && <DetailOverflowSeparator />}
+        {group}
+      </Fragment>
+    ));
+}
+
 function DetailOverflowMenuItem({
   className,
   closeMenu,
   onAction,
   ...props
 }: Omit<ComponentProps<"button">, "onClick"> & {
-  closeMenu: () => void;
+  /** Omitted by items that keep the menu open, such as Manage. */
+  closeMenu?: () => void;
   onAction?: () => void;
 }) {
   return (
@@ -118,7 +146,7 @@ function DetailOverflowMenuItem({
       role="menuitem"
       className={`focus:bg-accent focus:text-accent-foreground hover:bg-accent hover:text-accent-foreground [&_svg:not([class*='text-'])]:text-muted-foreground relative flex w-full cursor-pointer items-center gap-2 rounded-sm px-2 py-1.5 text-left text-sm outline-hidden select-none disabled:pointer-events-none disabled:opacity-50 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4 ${className ?? ""}`}
       onClick={() => {
-        closeMenu();
+        closeMenu?.();
         onAction?.();
       }}
     />
@@ -204,6 +232,8 @@ export interface ActionBarProps {
   playLabel?: string;
   playProgress?: number;
   restartHref?: string;
+  /** Clears the resume position without marking the item watched. */
+  onResetProgress?: () => void;
   resumePositionSeconds?: number;
   resumeDurationSeconds?: number;
   resumeResolution?: string;
@@ -218,6 +248,9 @@ export interface ActionBarProps {
   isFavorite?: boolean;
   onToggleWatchlist?: () => void;
   inWatchlist?: boolean;
+  /** Marks or clears Not interested; movies and series only. */
+  onToggleNotInterested?: () => void;
+  notInterested?: boolean;
   onRefresh?: (mode: RefreshItemMetadataMode) => void;
   isRefreshing?: boolean;
   /** Re-detects local markers; without redetectKind the admin picks intro, credits, or both. */
@@ -282,6 +315,7 @@ export default function ActionBar({
   playLabel = "Play",
   playProgress,
   restartHref,
+  onResetProgress,
   resumePositionSeconds,
   resumeDurationSeconds,
   watchedLabel,
@@ -292,6 +326,8 @@ export default function ActionBar({
   isFavorite = false,
   onToggleWatchlist,
   inWatchlist = false,
+  onToggleNotInterested,
+  notInterested = false,
   onRefresh,
   isRefreshing = false,
   onRedetectMarkers,
@@ -336,6 +372,13 @@ export default function ActionBar({
   const playbackController = useWatchPlaybackController();
   const [playChoiceOpen, setPlayChoiceOpen] = useState(false);
   const [overflowOpen, setOverflowOpen] = useState(false);
+  // The admin and curation actions open in a second menu beside this one.
+  const [manageOpen, setManageOpen] = useState(false);
+  const [managePosition, setManagePosition] = useState<{ left: number; top: number } | null>(null);
+  const manageMenuId = useId();
+  const manageTriggerRef = useRef<HTMLButtonElement>(null);
+  const manageMenuRef = useRef<HTMLDivElement>(null);
+  const focusManageOnOpenRef = useRef(false);
   const overflowMenuId = useId();
   const [overflowPosition, setOverflowPosition] = useState<{
     left: number;
@@ -446,8 +489,28 @@ export default function ActionBar({
   const closeOverflowMenu = useCallback(() => setOverflowOpen(false), []);
   const toggleOverflowMenu = useCallback(() => {
     setOverflowPosition(null);
+    setManageOpen(false);
     setOverflowOpen((open) => !open);
   }, []);
+  /** Pointer hover opens Manage in place; the keyboard and clicks also move focus into it. */
+  const openManageMenu = useCallback(
+    (focusFirst: boolean) => {
+      if (manageOpen) {
+        if (focusFirst) {
+          visibleOverflowItems(manageMenuRef.current)[0]?.focus({ preventScroll: true });
+        }
+        return;
+      }
+      focusManageOnOpenRef.current = focusFirst;
+      setManagePosition(null);
+      setManageOpen(true);
+    },
+    [manageOpen],
+  );
+  const closeManageMenu = useCallback((returnFocus: boolean) => {
+    setManageOpen(false);
+    if (returnFocus) manageTriggerRef.current?.focus({ preventScroll: true });
+  }, []);
   const positionOverflowMenu = useCallback(() => {
     const trigger = overflowTriggerRef.current;
     const menu = overflowMenuRef.current;
@@ -468,6 +531,39 @@ export default function ActionBar({
     );
     setOverflowPosition({ left, top });
   }, []);
+  const positionManageMenu = useCallback(() => {
+    const main = overflowMenuRef.current;
+    const trigger = manageTriggerRef.current;
+    const menu = manageMenuRef.current;
+    if (!main || !trigger || !menu) return;
+
+    const viewportPadding = 8;
+    const gap = 4;
+    const mainRect = main.getBoundingClientRect();
+    const triggerRect = trigger.getBoundingClientRect();
+    const menuRect = menu.getBoundingClientRect();
+    const clampTop = (top: number) =>
+      Math.min(
+        window.innerHeight - menuRect.height - viewportPadding,
+        Math.max(viewportPadding, top),
+      );
+    // Line the first item up with Manage: the menu's border and padding sit above it.
+    const besideTop = clampTop(triggerRect.top - 5);
+    if (mainRect.right + gap + menuRect.width <= window.innerWidth - viewportPadding) {
+      setManagePosition({ left: mainRect.right + gap, top: besideTop });
+    } else if (mainRect.left - gap - menuRect.width >= viewportPadding) {
+      setManagePosition({ left: mainRect.left - gap - menuRect.width, top: besideTop });
+    } else {
+      // No room beside it on a narrow screen: cascade over the main menu, under Manage.
+      setManagePosition({
+        left: Math.min(
+          window.innerWidth - menuRect.width - viewportPadding,
+          Math.max(viewportPadding, mainRect.left + 24),
+        ),
+        top: clampTop(triggerRect.bottom),
+      });
+    }
+  }, []);
 
   useLayoutEffect(() => {
     if (!overflowOpen) return;
@@ -495,38 +591,52 @@ export default function ActionBar({
     visibleOverflowItems(overflowMenuRef.current)[0]?.focus({ preventScroll: true });
   }, [overflowOpen, overflowPositioned]);
 
+  // Manage follows the main menu as it is placed, resized, or scrolled.
+  useLayoutEffect(() => {
+    if (overflowOpen && manageOpen) positionManageMenu();
+  }, [manageOpen, overflowOpen, overflowPosition, positionManageMenu]);
+  const managePositioned = managePosition !== null;
+  useLayoutEffect(() => {
+    if (!manageOpen || !managePositioned || !focusManageOnOpenRef.current) return;
+    focusManageOnOpenRef.current = false;
+    visibleOverflowItems(manageMenuRef.current)[0]?.focus({ preventScroll: true });
+  }, [manageOpen, managePositioned]);
+
   useEffect(() => {
     if (!overflowOpen) return;
 
+    const isInsideMenus = (target: Node) =>
+      Boolean(
+        overflowMenuRef.current?.contains(target) ||
+        manageMenuRef.current?.contains(target) ||
+        overflowTriggerRef.current?.contains(target),
+      );
     const handlePointerDown = (event: PointerEvent) => {
-      const target = event.target as Node;
-      if (
-        !overflowMenuRef.current?.contains(target) &&
-        !overflowTriggerRef.current?.contains(target)
-      ) {
-        closeOverflowMenu();
-      }
+      if (!isInsideMenus(event.target as Node)) closeOverflowMenu();
     };
     const handleKeyDown = (event: globalThis.KeyboardEvent) => {
       if (event.key !== "Escape") return;
       event.preventDefault();
+      if (manageOpen) {
+        closeManageMenu(true);
+        return;
+      }
       closeOverflowMenu();
       overflowTriggerRef.current?.focus({ preventScroll: true });
     };
     const handleFocusIn = (event: FocusEvent) => {
-      const target = event.target as Node;
-      if (
-        !overflowMenuRef.current?.contains(target) &&
-        !overflowTriggerRef.current?.contains(target)
-      ) {
-        closeOverflowMenu();
-      }
+      if (!isInsideMenus(event.target as Node)) closeOverflowMenu();
     };
     // Stay anchored to the trigger while the page scrolls rather than
     // dismissing on every wheel nudge. One measurement per frame at most.
     const handleScroll = (event: Event) => {
       const target = event.target;
-      if (target instanceof Node && overflowMenuRef.current?.contains(target)) return;
+      if (target instanceof Node && isInsideMenus(target)) {
+        // Scrolling the main menu moves Manage's trigger. Placing the main menu
+        // again places Manage after it.
+        const movesManageTrigger = manageOpen && overflowMenuRef.current?.contains(target);
+        if (!movesManageTrigger) return;
+      }
       if (scrollFrameRef.current !== null) return;
       scrollFrameRef.current = requestAnimationFrame(() => {
         scrollFrameRef.current = null;
@@ -548,8 +658,18 @@ export default function ActionBar({
         scrollFrameRef.current = null;
       }
     };
-  }, [closeOverflowMenu, overflowOpen, positionOverflowMenu]);
+  }, [closeManageMenu, closeOverflowMenu, manageOpen, overflowOpen, positionOverflowMenu]);
   const handleOverflowKeyDown = (event: KeyboardEvent<HTMLDivElement>) => {
+    if (event.key === "ArrowRight" && event.target === manageTriggerRef.current) {
+      event.preventDefault();
+      openManageMenu(true);
+      return;
+    }
+    if (event.key === "ArrowLeft" && event.currentTarget === manageMenuRef.current) {
+      event.preventDefault();
+      closeManageMenu(true);
+      return;
+    }
     const isNavigationKey = ["ArrowDown", "ArrowUp", "Home", "End"].includes(event.key);
     // Printable single characters jump to the next item whose label starts with
     // what has been typed, the way the menu behaved before.
@@ -595,26 +715,250 @@ export default function ActionBar({
     }
     items[nextIndex]?.focus({ preventScroll: true });
   };
-  const hasOverflowActions = Boolean(
-    restartHref ||
-    onShuffle ||
-    onToggleWatchlist ||
-    onDownload ||
-    onSearchSubtitles ||
-    onRequestSeasons,
-  );
-  const hasAdminActions = Boolean(isAdmin && (contentId || onRedetectMarkers));
-  const hasMetadataActions = Boolean(
-    (canCurateMetadata && (onRefresh || onEditMetadata || onMatchItem || onShowMediaInfo)) ||
-    showMarkerEditor,
-  );
+  // With one version, Play already asks whether to resume or start over.
+  const showRestartInMenu = Boolean(restartHref) && !showPlayChoiceDialog;
+  const playbackItems = [
+    onShuffle && (
+      <DetailOverflowMenuItem key="shuffle" closeMenu={closeOverflowMenu} onAction={onShuffle}>
+        <Shuffle className="size-4" />
+        Shuffle
+      </DetailOverflowMenuItem>
+    ),
+    showRestartInMenu && (
+      <DetailOverflowMenuItem
+        key="restart"
+        closeMenu={closeOverflowMenu}
+        onAction={handleRestartPlayback}
+      >
+        <RotateCcw className="size-4" />
+        Play from Beginning
+      </DetailOverflowMenuItem>
+    ),
+    onResetProgress && (
+      <DetailOverflowMenuItem key="reset" closeMenu={closeOverflowMenu} onAction={onResetProgress}>
+        <TimerReset className="size-4" />
+        Reset Progress
+      </DetailOverflowMenuItem>
+    ),
+  ];
+  const libraryItems = [
+    onToggleWatchlist && (
+      <DetailOverflowMenuItem
+        key="watchlist"
+        closeMenu={closeOverflowMenu}
+        onAction={onToggleWatchlist}
+      >
+        {inWatchlist ? <Check className="size-4" /> : <Plus className="size-4" />}
+        {inWatchlist ? "Remove from Watchlist" : "Add to Watchlist"}
+      </DetailOverflowMenuItem>
+    ),
+    contentId && canAddToCollection && (
+      <DetailOverflowMenuItem
+        key="collection"
+        closeMenu={closeOverflowMenu}
+        onAction={() => setAddToCollectionOpen(true)}
+      >
+        <FolderPlus className="size-4" />
+        Add to Collection
+      </DetailOverflowMenuItem>
+    ),
+    onDownload && (
+      <DetailOverflowMenuItem key="download" closeMenu={closeOverflowMenu} onAction={onDownload}>
+        <Download className="size-4" />
+        Download
+      </DetailOverflowMenuItem>
+    ),
+    onRequestSeasons && (
+      <DetailOverflowMenuItem
+        key="request-seasons"
+        closeMenu={closeOverflowMenu}
+        onAction={onRequestSeasons}
+      >
+        <Inbox className="size-4" />
+        Request Seasons
+      </DetailOverflowMenuItem>
+    ),
+    onToggleNotInterested && (
+      <DetailOverflowMenuItem
+        key="not-interested"
+        closeMenu={closeOverflowMenu}
+        onAction={onToggleNotInterested}
+      >
+        <ThumbsDown className={cn("size-4", notInterested && "fill-current")} />
+        {notInterested ? "Show in Recommendations" : "Not Interested"}
+      </DetailOverflowMenuItem>
+    ),
+  ];
+  const partyItems = watchTogether
+    ? [
+        <DetailOverflowMenuItem
+          key="start-party"
+          closeMenu={closeOverflowMenu}
+          onAction={watchTogether.onStartParty}
+        >
+          <UsersRound className="size-4" />
+          Start a Watch Party
+        </DetailOverflowMenuItem>,
+        watchTogether.liveRoom && (
+          <DetailOverflowMenuItem
+            key="suggest-party"
+            closeMenu={closeOverflowMenu}
+            onAction={watchTogether.liveRoom.onSuggest}
+          >
+            <Hand className="size-4" />
+            Suggest to {watchTogether.liveRoom.code}
+          </DetailOverflowMenuItem>
+        ),
+        watchTogether.liveRoom?.onPlay && (
+          <DetailOverflowMenuItem
+            key="play-party"
+            closeMenu={closeOverflowMenu}
+            onAction={watchTogether.liveRoom.onPlay}
+          >
+            <Zap className="size-4" />
+            Play in {watchTogether.liveRoom.code}
+          </DetailOverflowMenuItem>
+        ),
+      ]
+    : [];
+  const manageGroups = [
+    [
+      canCurateMetadata && onEditMetadata && (
+        <DetailOverflowMenuItem
+          key="edit-metadata"
+          closeMenu={closeOverflowMenu}
+          onAction={onEditMetadata}
+        >
+          <MediaActionIcon action="editMetadata" />
+          Edit Metadata
+        </DetailOverflowMenuItem>
+      ),
+      canCurateMetadata && onMatchItem && (
+        <DetailOverflowMenuItem key="match" closeMenu={closeOverflowMenu} onAction={onMatchItem}>
+          <MediaActionIcon action="matchItem" />
+          Match Item
+        </DetailOverflowMenuItem>
+      ),
+      canCurateMetadata && onRefresh && (
+        <DetailOverflowMenuItem
+          key="refresh"
+          closeMenu={closeOverflowMenu}
+          disabled={isRefreshing}
+          onAction={() => setRefreshDialogOpen(true)}
+        >
+          <MediaActionIcon action="refreshMetadata" isPending={isRefreshing} />
+          Refresh Metadata
+        </DetailOverflowMenuItem>
+      ),
+    ],
+    [
+      showMarkerEditor && (
+        <DetailOverflowMenuItem
+          key="edit-markers"
+          closeMenu={closeOverflowMenu}
+          onAction={() => setMarkerEditorOpen(true)}
+        >
+          <Tags className="size-4" />
+          Edit Markers
+        </DetailOverflowMenuItem>
+      ),
+      isAdmin && onRedetectMarkers && (
+        <DetailOverflowMenuItem
+          key="redetect"
+          closeMenu={closeOverflowMenu}
+          disabled={isRedetectingMarkers}
+          onAction={() =>
+            redetectKind ? onRedetectMarkers(redetectKind) : setRedetectDialogOpen(true)
+          }
+        >
+          <RefreshCw className={`size-4 ${isRedetectingMarkers ? "animate-spin" : ""}`} />
+          {redetectKind === "credits"
+            ? "Re-detect Credits"
+            : redetectKind === "intro"
+              ? "Re-detect Intro Markers"
+              : "Re-detect Markers"}
+        </DetailOverflowMenuItem>
+      ),
+      showTrickplay && (
+        <DetailOverflowMenuItem
+          key="trickplay"
+          closeMenu={closeOverflowMenu}
+          onAction={() => setTrickplayOpen(true)}
+        >
+          <GalleryHorizontal className="size-4" />
+          Seek Previews
+        </DetailOverflowMenuItem>
+      ),
+      canCurateMetadata && onSplitItem && (
+        <DetailOverflowMenuItem key="split" closeMenu={closeOverflowMenu} onAction={onSplitItem}>
+          <Scissors className="size-4" />
+          Split Versions
+        </DetailOverflowMenuItem>
+      ),
+    ],
+    [
+      canCurateMetadata && onShowMediaInfo && (
+        <DetailOverflowMenuItem
+          key="media-info"
+          closeMenu={closeOverflowMenu}
+          onAction={onShowMediaInfo}
+        >
+          <Info className="size-4" />
+          Media Info
+        </DetailOverflowMenuItem>
+      ),
+      isAdmin && contentId && (
+        <DetailOverflowMenuItem
+          key="play-history"
+          closeMenu={closeOverflowMenu}
+          onAction={() => navigate(`/admin/history?media_item_id=${encodeURIComponent(contentId)}`)}
+        >
+          <MediaActionIcon action="viewPlayHistory" />
+          View Play History
+        </DetailOverflowMenuItem>
+      ),
+    ],
+  ];
+  const manageItems = manageGroups.flat().filter(Boolean);
+  // A single management action sits at the end of the menu instead of behind Manage.
+  const hasManagePanel = manageItems.length > 1;
+  const mainGroups = [
+    playbackItems,
+    libraryItems,
+    partyItems,
+    hasManagePanel
+      ? [
+          <DetailOverflowMenuItem
+            key="manage"
+            ref={manageTriggerRef}
+            aria-haspopup="menu"
+            aria-expanded={manageOpen}
+            aria-controls={manageOpen ? manageMenuId : undefined}
+            className="aria-expanded:bg-accent aria-expanded:text-accent-foreground"
+            onAction={() => openManageMenu(true)}
+          >
+            <Wrench className="size-4" />
+            Manage
+            <ChevronRight className="ml-auto size-4" />
+          </DetailOverflowMenuItem>,
+        ]
+      : manageItems,
+  ];
+  const hasMainMenuItems = mainGroups.some((group) => group.some(Boolean));
   const hasOverflowMenuItems =
-    hasOverflowActions ||
-    hasAdminActions ||
-    hasMetadataActions ||
-    Boolean(contentId && canAddToCollection) ||
-    (compactMobile && Boolean(onToggleFavorite || onRatingChange)) ||
-    Boolean(watchTogether);
+    hasMainMenuItems || (compactMobile && Boolean(onToggleFavorite || onRatingChange));
+  // Hovering another item, or moving focus to one, closes Manage again.
+  const handleMainMenuPointerOver = (event: ReactPointerEvent<HTMLDivElement>) => {
+    if (event.pointerType !== "mouse" || !hasManagePanel) return;
+    const item = (event.target as Element).closest('[role="menuitem"]');
+    if (item === manageTriggerRef.current) openManageMenu(false);
+    else if (item && manageOpen) closeManageMenu(false);
+  };
+  const handleMainMenuFocus = (event: ReactFocusEvent<HTMLDivElement>) => {
+    if (manageOpen && (event.target as Element) !== manageTriggerRef.current) {
+      closeManageMenu(false);
+    }
+  };
 
   const formattedResumeTime = formatPlaybackTime(resumePositionSeconds ?? 0);
   const percentComplete =
@@ -789,9 +1133,11 @@ export default function ActionBar({
                 top: overflowPosition?.top ?? 0,
                 visibility: overflowPosition ? "visible" : "hidden",
               }}
-              className="detail-overflow-menu border-border bg-popover text-popover-foreground fixed z-50 max-h-[calc(100vh-1rem)] w-max max-w-[calc(100vw-2rem)] min-w-0 overflow-y-auto rounded-md border p-1 shadow-md"
+              className={overflowMenuClass}
               role="menu"
               onKeyDown={handleOverflowKeyDown}
+              onPointerOver={handleMainMenuPointerOver}
+              onFocus={handleMainMenuFocus}
             >
               {compactMobile && (
                 <div className="detail-mobile-menu-actions">
@@ -808,7 +1154,7 @@ export default function ActionBar({
                     <div className="px-2 py-2" role="group" aria-label="Your rating">
                       <span className="mb-2 block text-sm">Your rating</span>
                       {/* ArrowUp/ArrowDown keep moving through the menu; only
-                          ArrowLeft/ArrowRight change the rating here. */}
+                              ArrowLeft/ArrowRight change the rating here. */}
                       <StarRating
                         value={rating ?? null}
                         onChange={onRatingChange}
@@ -820,189 +1166,32 @@ export default function ActionBar({
                       )}
                     </div>
                   )}
+                  {hasMainMenuItems && <DetailOverflowSeparator />}
                 </div>
               )}
-              {onShuffle && (
-                <DetailOverflowMenuItem closeMenu={closeOverflowMenu} onAction={onShuffle}>
-                  <Shuffle className="size-4" />
-                  Shuffle
-                </DetailOverflowMenuItem>
-              )}
-              {restartHref && (
-                <DetailOverflowMenuItem
-                  closeMenu={closeOverflowMenu}
-                  onAction={handleRestartPlayback}
-                >
-                  <RotateCcw className="size-4" />
-                  Play from Beginning
-                </DetailOverflowMenuItem>
-              )}
-              {onToggleWatchlist && (
-                <DetailOverflowMenuItem closeMenu={closeOverflowMenu} onAction={onToggleWatchlist}>
-                  {inWatchlist ? <Check className="size-4" /> : <Plus className="size-4" />}
-                  {inWatchlist ? "Remove from Watchlist" : "Add to Watchlist"}
-                </DetailOverflowMenuItem>
-              )}
-              {contentId && canAddToCollection && (
-                <DetailOverflowMenuItem
-                  closeMenu={closeOverflowMenu}
-                  onAction={() => setAddToCollectionOpen(true)}
-                >
-                  <FolderPlus className="size-4" />
-                  Add to Collection
-                </DetailOverflowMenuItem>
-              )}
-              {onDownload && (
-                <DetailOverflowMenuItem closeMenu={closeOverflowMenu} onAction={onDownload}>
-                  <Download className="size-4" />
-                  Download
-                </DetailOverflowMenuItem>
-              )}
-              {onSearchSubtitles && (
-                <DetailOverflowMenuItem closeMenu={closeOverflowMenu} onAction={onSearchSubtitles}>
-                  <Captions className="size-4" />
-                  Add Subtitles
-                </DetailOverflowMenuItem>
-              )}
-              {onRequestSeasons && (
-                <DetailOverflowMenuItem closeMenu={closeOverflowMenu} onAction={onRequestSeasons}>
-                  <Inbox className="size-4" />
-                  Request Seasons
-                </DetailOverflowMenuItem>
-              )}
-              {watchTogether && (
-                <>
-                  <div role="separator" className="bg-border -mx-1 my-1 h-px" />
-                  <div
-                    role="presentation"
-                    className="text-muted-foreground flex items-center gap-1.5 px-2 pt-1 pb-0.5 text-[0.625rem] font-semibold tracking-[0.16em] uppercase"
-                  >
-                    {watchTogether.liveRoom ? (
-                      <span aria-hidden="true" className="size-1.5 rounded-full bg-emerald-400" />
-                    ) : null}
-                    Watch Together
-                    {watchTogether.liveRoom ? ` · ${watchTogether.liveRoom.code} is live` : ""}
-                  </div>
-                  <DetailOverflowMenuItem
-                    closeMenu={closeOverflowMenu}
-                    onAction={watchTogether.onStartParty}
-                  >
-                    <UsersRound className="size-4" />
-                    Start a party with this
-                  </DetailOverflowMenuItem>
-                  {watchTogether.liveRoom && (
-                    <DetailOverflowMenuItem
-                      closeMenu={closeOverflowMenu}
-                      onAction={watchTogether.liveRoom.onSuggest}
-                    >
-                      <Hand className="size-4" />
-                      Suggest to {watchTogether.liveRoom.code}
-                    </DetailOverflowMenuItem>
-                  )}
-                  {watchTogether.liveRoom?.onPlay && (
-                    <DetailOverflowMenuItem
-                      closeMenu={closeOverflowMenu}
-                      onAction={watchTogether.liveRoom.onPlay}
-                    >
-                      <Zap className="size-4" />
-                      Play in {watchTogether.liveRoom.code}
-                    </DetailOverflowMenuItem>
-                  )}
-                </>
-              )}
-              {(hasAdminActions || hasMetadataActions) && (
-                <>
-                  {hasOverflowActions && (
-                    <div role="separator" className="bg-border -mx-1 my-1 h-px" />
-                  )}
-                  {canCurateMetadata && onShowMediaInfo && (
-                    <DetailOverflowMenuItem
-                      closeMenu={closeOverflowMenu}
-                      onAction={onShowMediaInfo}
-                    >
-                      <Info className="size-4" />
-                      Media Info
-                    </DetailOverflowMenuItem>
-                  )}
-                  {isAdmin && contentId && (
-                    <DetailOverflowMenuItem
-                      closeMenu={closeOverflowMenu}
-                      onAction={() =>
-                        navigate(`/admin/history?media_item_id=${encodeURIComponent(contentId)}`)
-                      }
-                    >
-                      <MediaActionIcon action="viewPlayHistory" />
-                      View Play History
-                    </DetailOverflowMenuItem>
-                  )}
-                  {canCurateMetadata && onRefresh && (
-                    <DetailOverflowMenuItem
-                      closeMenu={closeOverflowMenu}
-                      disabled={isRefreshing}
-                      onAction={() => {
-                        setRefreshDialogOpen(true);
-                      }}
-                    >
-                      <MediaActionIcon action="refreshMetadata" isPending={isRefreshing} />
-                      Refresh Metadata
-                    </DetailOverflowMenuItem>
-                  )}
-                  {isAdmin && onRedetectMarkers && (
-                    <DetailOverflowMenuItem
-                      closeMenu={closeOverflowMenu}
-                      disabled={isRedetectingMarkers}
-                      onAction={() =>
-                        redetectKind ? onRedetectMarkers(redetectKind) : setRedetectDialogOpen(true)
-                      }
-                    >
-                      <RefreshCw
-                        className={`size-4 ${isRedetectingMarkers ? "animate-spin" : ""}`}
-                      />
-                      {redetectKind === "credits"
-                        ? "Re-detect Credits"
-                        : redetectKind === "intro"
-                          ? "Re-detect Intro Markers"
-                          : "Re-detect Markers"}
-                    </DetailOverflowMenuItem>
-                  )}
-                  {showTrickplay && (
-                    <DetailOverflowMenuItem
-                      closeMenu={closeOverflowMenu}
-                      onAction={() => setTrickplayOpen(true)}
-                    >
-                      <GalleryHorizontal className="size-4" />
-                      Seek Previews
-                    </DetailOverflowMenuItem>
-                  )}
-                  {canCurateMetadata && onEditMetadata && (
-                    <DetailOverflowMenuItem closeMenu={closeOverflowMenu} onAction={onEditMetadata}>
-                      <MediaActionIcon action="editMetadata" />
-                      Edit Metadata
-                    </DetailOverflowMenuItem>
-                  )}
-                  {showMarkerEditor && (
-                    <DetailOverflowMenuItem
-                      closeMenu={closeOverflowMenu}
-                      onAction={() => setMarkerEditorOpen(true)}
-                    >
-                      <Tags className="size-4" />
-                      Edit Markers
-                    </DetailOverflowMenuItem>
-                  )}
-                  {canCurateMetadata && onMatchItem && (
-                    <DetailOverflowMenuItem closeMenu={closeOverflowMenu} onAction={onMatchItem}>
-                      <MediaActionIcon action="matchItem" />
-                      Match Item
-                    </DetailOverflowMenuItem>
-                  )}
-                  {canCurateMetadata && onSplitItem && (
-                    <DetailOverflowMenuItem closeMenu={closeOverflowMenu} onAction={onSplitItem}>
-                      <Scissors className="size-4" />
-                      Split Versions
-                    </DetailOverflowMenuItem>
-                  )}
-                </>
-              )}
+              <DetailOverflowGroups groups={mainGroups} />
+            </div>,
+            document.body,
+          )}
+        {hasOverflowMenuItems &&
+          overflowOpen &&
+          hasManagePanel &&
+          manageOpen &&
+          createPortal(
+            <div
+              id={manageMenuId}
+              ref={manageMenuRef}
+              style={{
+                left: managePosition?.left ?? 0,
+                top: managePosition?.top ?? 0,
+                visibility: managePosition ? "visible" : "hidden",
+              }}
+              className={overflowMenuClass}
+              role="menu"
+              aria-label="Manage"
+              onKeyDown={handleOverflowKeyDown}
+            >
+              <DetailOverflowGroups groups={manageGroups} />
             </div>,
             document.body,
           )}
@@ -1111,6 +1300,7 @@ export default function ActionBar({
               onSelectSubtitle={onSelectSubtitle}
               onSelectSubtitleOff={onSelectSubtitleOff}
               onResetSelection={onResetSubtitleSelection}
+              onSearchSubtitles={onSearchSubtitles}
             />
           )}
         </div>
diff --git a/web/src/pages/ItemDetail/components/AudioTracksPopover.tsx b/web/src/pages/ItemDetail/components/AudioTracksPopover.tsx
index bc01e34af8..994e5c71fd 100644
--- a/web/src/pages/ItemDetail/components/AudioTracksPopover.tsx
+++ b/web/src/pages/ItemDetail/components/AudioTracksPopover.tsx
@@ -5,7 +5,7 @@ import type { FileVersion } from "@/api/types";
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
 import { getLanguageName } from "@/player/utils/languageNames";
-import { formatChannels, mapAudioLabel } from "@/lib/mediaFormat";
+import { audioTrackLabel, formatChannels } from "@/lib/mediaFormat";
 import { audioTitle, compactAudioMeta } from "./versionFormatUtils";
 import { formatAudioTrackSummary, resolveAudioTrackSelection } from "./prePlaySelection";
 import DetailPopover from "./DetailPopover";
@@ -119,7 +119,7 @@ function AudioTracksPopover({
           />
         )}
         {tracks.map((track, index) => {
-          const codec = track.codec ? mapAudioLabel(track.codec) : "";
+          const codec = audioTrackLabel(track);
           const channels = formatChannels(track.channels);
           const language = getLanguageName(track.language ?? "");
           const fallbackTitle = audioTitle(track);
diff --git a/web/src/pages/ItemDetail/components/DetailOverview.test.tsx b/web/src/pages/ItemDetail/components/DetailOverview.test.tsx
index 30d80dbcdd..065a167f42 100644
--- a/web/src/pages/ItemDetail/components/DetailOverview.test.tsx
+++ b/web/src/pages/ItemDetail/components/DetailOverview.test.tsx
@@ -47,4 +47,14 @@ describe("DetailOverview", () => {
     expect(screen.getByText("Full text")).not.toHaveClass("line-clamp-3");
     expect(screen.queryByRole("button", { name: "More" })).not.toBeInTheDocument();
   });
+
+  it("labels machine-translated text, but not while a translation is running", () => {
+    mockOverflow(false);
+    const { rerender } = render(<DetailOverview overview="Übersetzt" machineTranslated />);
+    expect(screen.getByText("Translated by AI")).toBeInTheDocument();
+    rerender(<DetailOverview overview="Übersetzt" machineTranslated translating />);
+    expect(screen.queryByText("Translated by AI")).not.toBeInTheDocument();
+    rerender(<DetailOverview overview="Provider text" />);
+    expect(screen.queryByText("Translated by AI")).not.toBeInTheDocument();
+  });
 });
diff --git a/web/src/pages/ItemDetail/components/DetailOverview.tsx b/web/src/pages/ItemDetail/components/DetailOverview.tsx
index 7e01b1e8ad..af7e02d1fc 100644
--- a/web/src/pages/ItemDetail/components/DetailOverview.tsx
+++ b/web/src/pages/ItemDetail/components/DetailOverview.tsx
@@ -1,5 +1,6 @@
 import { useLayoutEffect, useRef, useState } from "react";
 import { EyeOff, Languages } from "lucide-react";
+import MachineTranslatedLabel from "./MachineTranslatedLabel";
 
 interface DetailOverviewProps {
   overview: string;
@@ -8,6 +9,8 @@ interface DetailOverviewProps {
   clamp?: boolean;
   translating?: boolean;
   onTranslate?: () => void;
+  /** The shown text was machine-translated by AI; label it as such. */
+  machineTranslated?: boolean;
   /** Spoiler protection: show a reveal button instead of the text. */
   hidden?: boolean;
   onReveal?: () => void;
@@ -19,6 +22,7 @@ export default function DetailOverview({
   clamp = false,
   translating = false,
   onTranslate,
+  machineTranslated = false,
   hidden = false,
   onReveal,
 }: DetailOverviewProps) {
@@ -83,6 +87,7 @@ export default function DetailOverview({
             Translating…
           </span>
         )}
+        {!translating && machineTranslated && <MachineTranslatedLabel className="mt-1" />}
         {!translating && onTranslate && (
           <button
             type="button"
diff --git a/web/src/pages/ItemDetail/components/EpisodeCarousel.test.tsx b/web/src/pages/ItemDetail/components/EpisodeCarousel.test.tsx
index 3e1afc17f9..0e02cbb17c 100644
--- a/web/src/pages/ItemDetail/components/EpisodeCarousel.test.tsx
+++ b/web/src/pages/ItemDetail/components/EpisodeCarousel.test.tsx
@@ -179,6 +179,25 @@ describe("EpisodeCarousel", () => {
                 duration_seconds: 1800,
               },
             },
+            {
+              content_id: "ep-3",
+              season_number: 1,
+              episode_number: 3,
+              title: "Rewatch",
+              overview: "",
+              air_date: null,
+              runtime: 44,
+              still_url: "",
+              still_thumbhash: "",
+              files: [],
+              // Watched before and partly rewatched: no progress bar, but a
+              // resume position Reset Progress can clear.
+              user_data: {
+                played: true,
+                position_seconds: 300,
+                duration_seconds: 1800,
+              },
+            },
           ]}
         />
       </MemoryRouter>,
@@ -195,6 +214,7 @@ describe("EpisodeCarousel", () => {
       showCollectionActions: false,
       showWatchedShortcut: true,
       hasPartialProgress: false,
+      hasResumePosition: false,
       quickActionMode: "watched",
     });
     expect(capturedMenuProps[1]).toMatchObject({
@@ -207,7 +227,13 @@ describe("EpisodeCarousel", () => {
       },
       showWatchedShortcut: true,
       hasPartialProgress: true,
+      hasResumePosition: true,
       quickActionMode: "watched",
     });
+    expect(capturedMenuProps[2]).toMatchObject({
+      contentId: "ep-3",
+      hasPartialProgress: false,
+      hasResumePosition: true,
+    });
   });
 });
diff --git a/web/src/pages/ItemDetail/components/EpisodeCarousel.tsx b/web/src/pages/ItemDetail/components/EpisodeCarousel.tsx
index 0815bc110c..1f2255a436 100644
--- a/web/src/pages/ItemDetail/components/EpisodeCarousel.tsx
+++ b/web/src/pages/ItemDetail/components/EpisodeCarousel.tsx
@@ -197,6 +197,7 @@ function EpisodeCarouselCard({
             showCollectionActions={false}
             showWatchedShortcut
             hasPartialProgress={progress != null}
+            hasResumePosition={(ep.user_data?.position_seconds ?? 0) > 0}
             quickActionMode={quickActionMode}
             longPressRef={cardRef}
             itemTitle={episodeTitle}
diff --git a/web/src/pages/ItemDetail/components/EpisodesTranslationAction.tsx b/web/src/pages/ItemDetail/components/EpisodesTranslationAction.tsx
new file mode 100644
index 0000000000..afe218cc12
--- /dev/null
+++ b/web/src/pages/ItemDetail/components/EpisodesTranslationAction.tsx
@@ -0,0 +1,34 @@
+import { Languages } from "lucide-react";
+
+/**
+ * The on-view translation status or action beside an Episodes heading. A
+ * season's job covers its episodes, so this is where a page offers it when
+ * the episode list, not the page's own description, is what is missing.
+ */
+export default function EpisodesTranslationAction({
+  translating,
+  onTranslate,
+}: {
+  translating: boolean;
+  onTranslate?: () => void;
+}) {
+  if (translating) {
+    return (
+      <span className="text-muted-foreground/70 inline-flex items-center gap-1.5 text-xs">
+        <Languages className="h-3 w-3 animate-pulse" />
+        Translating…
+      </span>
+    );
+  }
+  if (!onTranslate) return null;
+  return (
+    <button
+      type="button"
+      onClick={onTranslate}
+      className="text-muted-foreground hover:text-foreground border-border/60 inline-flex items-center gap-1.5 rounded-full border px-2.5 py-0.5 text-xs transition-colors"
+    >
+      <Languages className="h-3 w-3" />
+      Translate episodes
+    </button>
+  );
+}
diff --git a/web/src/pages/ItemDetail/components/MachineTranslatedLabel.tsx b/web/src/pages/ItemDetail/components/MachineTranslatedLabel.tsx
new file mode 100644
index 0000000000..47dff5dc48
--- /dev/null
+++ b/web/src/pages/ItemDetail/components/MachineTranslatedLabel.tsx
@@ -0,0 +1,37 @@
+import { Languages } from "lucide-react";
+
+const DESCRIPTION = "Translated by AI";
+
+/**
+ * Marks text the server reports as machine-translated (the
+ * `machine_translated_fields` of a detail, season or episode). The compact
+ * form is an icon for dense rows such as episode cards; it keeps the words
+ * for screen readers and as a tooltip.
+ */
+export default function MachineTranslatedLabel({
+  compact = false,
+  className = "",
+}: {
+  compact?: boolean;
+  className?: string;
+}) {
+  if (compact) {
+    return (
+      <span
+        className={`text-muted-foreground/70 inline-flex items-center ${className}`}
+        title={DESCRIPTION}
+      >
+        <Languages className="h-3 w-3" aria-hidden="true" />
+        <span className="sr-only">{DESCRIPTION}</span>
+      </span>
+    );
+  }
+  return (
+    <span
+      className={`text-muted-foreground/70 inline-flex items-center gap-1.5 text-xs ${className}`}
+    >
+      <Languages className="h-3 w-3" aria-hidden="true" />
+      {DESCRIPTION}
+    </span>
+  );
+}
diff --git a/web/src/pages/ItemDetail/components/MediaUserActionBar.tsx b/web/src/pages/ItemDetail/components/MediaUserActionBar.tsx
index 9f41ff56b6..44517e0cc9 100644
--- a/web/src/pages/ItemDetail/components/MediaUserActionBar.tsx
+++ b/web/src/pages/ItemDetail/components/MediaUserActionBar.tsx
@@ -2,8 +2,10 @@ import { useCallback } from "react";
 import type { ItemDetail } from "@/api/types";
 import { useToggleFavorite } from "@/hooks/queries/favorites";
 import { useWatchedStateMutation } from "@/hooks/queries/items";
+import { useResetProgressAction } from "@/hooks/queries/progress";
 import { useDeleteRating, useSetRating } from "@/hooks/queries/ratings";
 import { useToggleWatchlist } from "@/hooks/queries/watchlist";
+import { canMarkNotInterested, useToggleNotInterested } from "@/hooks/queries/notInterested";
 import { itemTitleLinks } from "@/lib/titleLinks";
 import { getWatchedActionLabel } from "../watchedState";
 import ActionBar, { type ActionBarProps } from "./ActionBar";
@@ -13,10 +15,13 @@ type UserActionProps =
   | "watchedLabel"
   | "onToggleWatched"
   | "isUpdatingWatched"
+  | "onResetProgress"
   | "onToggleFavorite"
   | "isFavorite"
   | "onToggleWatchlist"
   | "inWatchlist"
+  | "onToggleNotInterested"
+  | "notInterested"
   | "rating"
   | "communityRating"
   | "onRatingChange"
@@ -34,11 +39,14 @@ interface MediaUserActionBarProps extends Omit<ActionBarProps, UserActionProps>
 export default function MediaUserActionBar({ item, ...props }: MediaUserActionBarProps) {
   const isFavorite = item.user_state?.is_favorite ?? false;
   const inWatchlist = item.user_state?.in_watchlist ?? false;
+  const notInterested = item.user_state?.not_interested ?? false;
   const { mutate: toggleWatched, isPending: isUpdatingWatched } = useWatchedStateMutation(item);
   const { mutate: toggleFavorite } = useToggleFavorite(item.content_id);
   const { mutate: toggleWatchlist } = useToggleWatchlist(item.content_id);
+  const { mutate: toggleNotInterested } = useToggleNotInterested(item.content_id);
   const { mutate: setRating } = useSetRating(item.content_id);
   const { mutate: deleteRating } = useDeleteRating(item.content_id);
+  const resetProgress = useResetProgressAction(item);
 
   const handleToggleWatched = useCallback(
     () => toggleWatched(!(item.user_data?.played ?? false)),
@@ -52,6 +60,10 @@ export default function MediaUserActionBar({ item, ...props }: MediaUserActionBa
     () => toggleWatchlist(inWatchlist),
     [inWatchlist, toggleWatchlist],
   );
+  const handleToggleNotInterested = useCallback(
+    () => toggleNotInterested(notInterested),
+    [notInterested, toggleNotInterested],
+  );
   const handleRatingChange = useCallback(
     (rating: number | null) => {
       if (rating === null) {
@@ -72,10 +84,15 @@ export default function MediaUserActionBar({ item, ...props }: MediaUserActionBa
       isWatched={item.user_data?.played ?? false}
       onToggleWatched={handleToggleWatched}
       isUpdatingWatched={isUpdatingWatched}
+      onResetProgress={resetProgress}
       onToggleFavorite={handleToggleFavorite}
       isFavorite={isFavorite}
       onToggleWatchlist={handleToggleWatchlist}
       inWatchlist={inWatchlist}
+      onToggleNotInterested={
+        canMarkNotInterested(item.type) && item.user_state ? handleToggleNotInterested : undefined
+      }
+      notInterested={notInterested}
       rating={item.user_rating ?? null}
       communityRating={item.community_rating ?? null}
       onRatingChange={handleRatingChange}
diff --git a/web/src/pages/ItemDetail/components/SeasonEpisodeGrid.test.tsx b/web/src/pages/ItemDetail/components/SeasonEpisodeGrid.test.tsx
index 22ecfde0ed..9d4ae6067b 100644
--- a/web/src/pages/ItemDetail/components/SeasonEpisodeGrid.test.tsx
+++ b/web/src/pages/ItemDetail/components/SeasonEpisodeGrid.test.tsx
@@ -130,4 +130,59 @@ describe("SeasonEpisodeGrid", () => {
     expect(card).not.toBeNull();
     expect(card).toHaveTextContent("Damaged file");
   });
+
+  it("marks episodes whose overview was machine-translated", () => {
+    const episode = (id: string, number: number, fields?: string[]) => ({
+      content_id: id,
+      season_number: 1,
+      episode_number: number,
+      title: `Episode title ${number}`,
+      overview: `Overview ${number}`,
+      air_date: null,
+      runtime: 0,
+      still_url: "",
+      still_thumbhash: "",
+      files: [],
+      machine_translated_fields: fields,
+    });
+    render(
+      <MemoryRouter>
+        <SeasonEpisodeGrid
+          isLoading={false}
+          episodes={[episode("ep-1", 1, ["overview"]), episode("ep-2", 2)]}
+        />
+      </MemoryRouter>,
+    );
+    expect(screen.getAllByText("Translated by AI")).toHaveLength(1);
+  });
+
+  it("drops the translation label with a spoiler-hidden overview", () => {
+    spoilerPrefs.hideOverviews = true;
+    const episode = (id: string, number: number, userData?: Record<string, unknown>) => ({
+      content_id: id,
+      season_number: 1,
+      episode_number: number,
+      title: `Episode title ${number}`,
+      overview: `Overview ${number}`,
+      air_date: null,
+      runtime: 0,
+      still_url: "",
+      still_thumbhash: "",
+      files: [],
+      machine_translated_fields: ["overview"],
+      user_data: userData as never,
+    });
+    render(
+      <MemoryRouter>
+        <SeasonEpisodeGrid
+          isLoading={false}
+          episodes={[episode("ep-1", 1, { played: true }), episode("ep-2", 2)]}
+        />
+      </MemoryRouter>,
+    );
+    // Only the watched episode shows its overview, so only it carries the label.
+    expect(screen.getAllByText("Translated by AI")).toHaveLength(1);
+    const hiddenCard = screen.getByText("Episode title 2").closest("a");
+    expect(hiddenCard).not.toHaveTextContent("Translated by AI");
+  });
 });
diff --git a/web/src/pages/ItemDetail/components/SeasonEpisodeGrid.tsx b/web/src/pages/ItemDetail/components/SeasonEpisodeGrid.tsx
index f52ccb185a..04e40352f3 100644
--- a/web/src/pages/ItemDetail/components/SeasonEpisodeGrid.tsx
+++ b/web/src/pages/ItemDetail/components/SeasonEpisodeGrid.tsx
@@ -18,6 +18,8 @@ import { overlayDataFromEpisodeListItem, type CardOverlayPrefs } from "@/lib/ove
 import { cn } from "@/lib/utils";
 import { EpisodeGridSkeleton } from "./SectionSkeletons";
 import type { EpisodeNavigationState } from "../itemDetailLayout";
+import MachineTranslatedLabel from "./MachineTranslatedLabel";
+import { hasMachineTranslation } from "./machineTranslation";
 
 /**
  * How much of a season stays visible before the section scrolls, so a long one
@@ -168,6 +170,7 @@ function SeasonEpisodeCard({
           showCollectionActions={false}
           showWatchedShortcut
           hasPartialProgress={hasPartialProgress}
+          hasResumePosition={(episode.user_data?.position_seconds ?? 0) > 0}
           quickActionMode={quickActionMode}
           longPressRef={cardRef}
           itemTitle={episodeTitle}
@@ -196,6 +199,11 @@ function SeasonEpisodeCard({
                 }).format(new Date(episode.air_date))}
               </span>
             )}
+            {episode.overview &&
+              !hideOverview &&
+              hasMachineTranslation(episode.machine_translated_fields) && (
+                <MachineTranslatedLabel compact />
+              )}
           </div>
           {episode.overview && !hideOverview && (
             <p className="text-muted-foreground line-clamp-2 text-xs leading-relaxed">
diff --git a/web/src/pages/ItemDetail/components/SubtitlesPopover.tsx b/web/src/pages/ItemDetail/components/SubtitlesPopover.tsx
index 599db24b72..45f97c61a2 100644
--- a/web/src/pages/ItemDetail/components/SubtitlesPopover.tsx
+++ b/web/src/pages/ItemDetail/components/SubtitlesPopover.tsx
@@ -1,6 +1,6 @@
 import { useMemo, useState } from "react";
 import type { ReactNode } from "react";
-import { Captions, Check, ChevronDown, Loader2 } from "lucide-react";
+import { Captions, Check, ChevronDown, Loader2, Search } from "lucide-react";
 
 import type { FileVersion } from "@/api/types";
 import { Badge } from "@/components/ui/badge";
@@ -37,6 +37,8 @@ interface SubtitlesPopoverProps {
   onSelectSubtitle?: (selection: PrePlaySubtitleSelection) => void;
   onSelectSubtitleOff?: () => void;
   onResetSelection?: () => void;
+  /** Opens the subtitle provider search for this version. */
+  onSearchSubtitles?: () => void;
 }
 
 function SubtitleFlagBadges({
@@ -203,6 +205,7 @@ export default function SubtitlesPopover({
   onSelectSubtitle,
   onSelectSubtitleOff,
   onResetSelection,
+  onSearchSubtitles,
 }: SubtitlesPopoverProps) {
   const [open, setOpen] = useState(false);
   // Downloaded subtitles normally load lazily on open, but when the saved
@@ -331,6 +334,21 @@ export default function SubtitlesPopover({
         {candidates.all.length === 0 && !downloadedQuery.isLoading && (
           <div className="text-muted-foreground px-3 py-2 text-sm">No subtitles available.</div>
         )}
+        {onSearchSubtitles && (
+          <div className="border-border bg-popover sticky -bottom-1.5 -mx-1.5 border-t px-1.5 pt-1.5 pb-1.5">
+            <button
+              type="button"
+              onClick={() => {
+                setOpen(false);
+                onSearchSubtitles();
+              }}
+              className="hover:bg-accent/30 flex w-full items-center gap-2 rounded-lg px-3 py-2 text-left text-sm font-medium transition-colors"
+            >
+              <Search className="text-muted-foreground size-4" />
+              Search for Subtitles…
+            </button>
+          </div>
+        )}
       </div>
     </DetailPopover>
   );
diff --git a/web/src/pages/ItemDetail/components/VersionFlyout.tsx b/web/src/pages/ItemDetail/components/VersionFlyout.tsx
index 37ac41f88e..7fa9d906f5 100644
--- a/web/src/pages/ItemDetail/components/VersionFlyout.tsx
+++ b/web/src/pages/ItemDetail/components/VersionFlyout.tsx
@@ -7,7 +7,7 @@ import {
 } from "@/components/ui/dropdown-menu";
 import { formatFileSize, mapAudioLabel } from "@/lib/mediaFormat";
 import { videoRangeLabel } from "@/lib/videoRange";
-import { extractSourceHint } from "./versionFormatUtils";
+import { extractSourceHint, versionAudioAtmosEvidence } from "./versionFormatUtils";
 import { resolutionScore } from "./versionRankingUtils";
 
 // ---------------------------------------------------------------------------
@@ -21,7 +21,8 @@ export function buildQualitySummary(version: FileVersion): string {
   if (version.codec_video) parts.push(version.codec_video.toUpperCase());
   const rangeLabel = videoRangeLabel(version);
   if (rangeLabel) parts.push(rangeLabel);
-  if (version.codec_audio) parts.push(mapAudioLabel(version.codec_audio));
+  if (version.codec_audio)
+    parts.push(mapAudioLabel(version.codec_audio, versionAudioAtmosEvidence(version)));
   if (parts.length === 0 && version.container) {
     parts.push(version.container.toUpperCase());
   }
diff --git a/web/src/pages/ItemDetail/components/WatchedActionBar.tsx b/web/src/pages/ItemDetail/components/WatchedActionBar.tsx
index 48ba4bf895..a19fb4f24e 100644
--- a/web/src/pages/ItemDetail/components/WatchedActionBar.tsx
+++ b/web/src/pages/ItemDetail/components/WatchedActionBar.tsx
@@ -1,6 +1,7 @@
 import { useCallback } from "react";
 import type { ItemDetail } from "@/api/types";
 import { useWatchedStateMutation } from "@/hooks/queries/items";
+import { useResetProgressAction } from "@/hooks/queries/progress";
 import { itemTitleLinks } from "@/lib/titleLinks";
 import { getWatchedActionLabel } from "../watchedState";
 import ActionBar, { type ActionBarProps } from "./ActionBar";
@@ -10,6 +11,7 @@ type WatchedActionProps =
   | "watchedLabel"
   | "onToggleWatched"
   | "isUpdatingWatched"
+  | "onResetProgress"
   | "links";
 
 interface WatchedActionBarProps extends Omit<ActionBarProps, WatchedActionProps> {
@@ -19,6 +21,7 @@ interface WatchedActionBarProps extends Omit<ActionBarProps, WatchedActionProps>
 /** Keeps mutation lifecycle renders inside the episode action bar. */
 export default function WatchedActionBar({ item, ...props }: WatchedActionBarProps) {
   const { mutate: toggleWatched, isPending: isUpdatingWatched } = useWatchedStateMutation(item);
+  const resetProgress = useResetProgressAction(item);
   const handleToggleWatched = useCallback(
     () => toggleWatched(!(item.user_data?.played ?? false)),
     [item.user_data?.played, toggleWatched],
@@ -33,6 +36,7 @@ export default function WatchedActionBar({ item, ...props }: WatchedActionBarPro
       isWatched={item.user_data?.played ?? false}
       onToggleWatched={handleToggleWatched}
       isUpdatingWatched={isUpdatingWatched}
+      onResetProgress={resetProgress}
     />
   );
 }
diff --git a/web/src/pages/ItemDetail/components/machineTranslation.test.ts b/web/src/pages/ItemDetail/components/machineTranslation.test.ts
new file mode 100644
index 0000000000..aaec4cdb75
--- /dev/null
+++ b/web/src/pages/ItemDetail/components/machineTranslation.test.ts
@@ -0,0 +1,14 @@
+import { describe, expect, it } from "vitest";
+
+import { hasMachineTranslation } from "./machineTranslation";
+
+describe("hasMachineTranslation", () => {
+  it("names only the field it is asked about", () => {
+    // A provider overview with an AI tagline must not label the overview.
+    expect(hasMachineTranslation(["tagline"])).toBe(false);
+    expect(hasMachineTranslation(["tagline"], "tagline")).toBe(true);
+    expect(hasMachineTranslation(["overview", "tagline"])).toBe(true);
+    expect(hasMachineTranslation(["overview"], "tagline")).toBe(false);
+    expect(hasMachineTranslation(undefined)).toBe(false);
+  });
+});
diff --git a/web/src/pages/ItemDetail/components/machineTranslation.ts b/web/src/pages/ItemDetail/components/machineTranslation.ts
new file mode 100644
index 0000000000..a11e61754b
--- /dev/null
+++ b/web/src/pages/ItemDetail/components/machineTranslation.ts
@@ -0,0 +1,11 @@
+/**
+ * Whether the server reports this field ("overview" by default, or "tagline")
+ * as machine-translated. A label names the field it sits on, so an AI tagline
+ * never marks a provider or human overview.
+ */
+export function hasMachineTranslation(
+  fields: readonly string[] | undefined,
+  field: "overview" | "tagline" = "overview",
+): boolean {
+  return fields?.includes(field) ?? false;
+}
diff --git a/web/src/pages/ItemDetail/components/prePlaySelection.ts b/web/src/pages/ItemDetail/components/prePlaySelection.ts
index cb41b5cd74..e0f6d35560 100644
--- a/web/src/pages/ItemDetail/components/prePlaySelection.ts
+++ b/web/src/pages/ItemDetail/components/prePlaySelection.ts
@@ -15,7 +15,7 @@ import { getLanguageName } from "@/player/utils/languageNames";
 import { normalizeSubtitleMode } from "@/player/utils/subtitleMode";
 import { resolveSubtitleAutoSelect } from "@/player/utils/subtitleSort";
 import { getSubtitleFormatLabel } from "@/player/utils/subtitleCodecs";
-import { formatChannels, mapAudioLabel } from "@/lib/mediaFormat";
+import { audioTrackLabel, formatChannels } from "@/lib/mediaFormat";
 import {
   buildVersionSubtitleInventory,
   type VersionSubtitleInventoryRow,
@@ -142,7 +142,7 @@ export function formatAudioTrackSummary(track: VersionAudioTrack | undefined): s
   }
 
   const language = getLanguageName(track.language ?? "") || "Unknown";
-  const codec = track.codec ? mapAudioLabel(track.codec) : "";
+  const codec = audioTrackLabel(track);
   const channels = formatChannels(track.channels);
   return [language, codec, channels].filter(Boolean).join(" · ");
 }
diff --git a/web/src/pages/ItemDetail/components/versionFormatUtils.ts b/web/src/pages/ItemDetail/components/versionFormatUtils.ts
index a60a69cc93..f559b3121d 100644
--- a/web/src/pages/ItemDetail/components/versionFormatUtils.ts
+++ b/web/src/pages/ItemDetail/components/versionFormatUtils.ts
@@ -1,6 +1,29 @@
-import type { VersionAudioTrack, VersionSubtitleTrack, VersionVideoTrack } from "@/api/types";
+import type {
+  FileVersion,
+  VersionAudioTrack,
+  VersionSubtitleTrack,
+  VersionVideoTrack,
+} from "@/api/types";
 import { englishLanguageName, getLanguageName } from "@/lib/languageNames";
-import { formatBitrate, formatChannels, formatSampleRate } from "@/lib/mediaFormat";
+import {
+  audioTrackAtmosEvidence,
+  formatBitrate,
+  formatChannels,
+  formatSampleRate,
+} from "@/lib/mediaFormat";
+
+/**
+ * Atmos evidence for the audio stream a version's codec_audio describes. The
+ * scanner takes codec_audio from the first audio stream, so the first track's
+ * profile and titles apply when its codec agrees.
+ */
+export function versionAudioAtmosEvidence(version: FileVersion): string | undefined {
+  const first = version.audio_tracks?.[0];
+  if (!first?.codec || !version.codec_audio) return undefined;
+  return first.codec.toLowerCase() === version.codec_audio.toLowerCase()
+    ? audioTrackAtmosEvidence(first)
+    : undefined;
+}
 
 export function formatPageCount(pages?: number): string {
   if (!pages || pages <= 0) return "";
diff --git a/web/src/pages/ItemDetail/components/versionRankingUtils.test.ts b/web/src/pages/ItemDetail/components/versionRankingUtils.test.ts
index c96c8678d8..4da0d596e1 100644
--- a/web/src/pages/ItemDetail/components/versionRankingUtils.test.ts
+++ b/web/src/pages/ItemDetail/components/versionRankingUtils.test.ts
@@ -2,7 +2,7 @@
 
 import { describe, expect, it } from "vitest";
 import type { FileVersion } from "@/api/types";
-import { pickBestAttributes } from "./versionRankingUtils";
+import { pickBestAttributes, selectDefaultVersion } from "./versionRankingUtils";
 
 function makeVersion(overrides: Partial<FileVersion> = {}): FileVersion {
   return {
@@ -45,7 +45,47 @@ describe("pickBestAttributes", () => {
     ];
     const result = pickBestAttributes(versions);
     expect(result).not.toBeNull();
-    expect(result!.audioLabel).toBe("Atmos");
+    expect(result!.audioLabel).toBe("TrueHD Atmos");
+  });
+
+  it("labels Atmos from a later track of the same codec", () => {
+    const versions = [
+      makeVersion({
+        codec_audio: "eac3",
+        audio_tracks: [
+          { codec: "eac3", language: "en" },
+          { codec: "eac3", profile: "Dolby Digital Plus + Dolby Atmos", language: "en" },
+        ],
+      }),
+    ];
+    expect(pickBestAttributes(versions)?.audioLabel).toBe("DD+ Atmos");
+  });
+
+  it("labels Atmos from the primary audio track's profile", () => {
+    const versions = [
+      makeVersion({
+        resolution: "2160p",
+        codec_audio: "eac3",
+        audio_tracks: [
+          { codec: "eac3", profile: "Dolby Digital Plus + Dolby Atmos", language: "en" },
+        ],
+      }),
+    ];
+    expect(pickBestAttributes(versions)?.audioLabel).toBe("DD+ Atmos");
+  });
+
+  // Real files never pair an aac track with an Atmos profile; the mismatch
+  // proves the profile is read only from codec_audio's own stream.
+  it("does not read a profile from a first track that is not codec_audio's stream", () => {
+    const versions = [
+      makeVersion({
+        codec_audio: "eac3",
+        audio_tracks: [
+          { codec: "aac", profile: "Dolby Digital Plus + Dolby Atmos", language: "en" },
+        ],
+      }),
+    ];
+    expect(pickBestAttributes(versions)?.audioLabel).toBe("EAC3");
   });
 
   it("sets hdr true when any version has hdr", () => {
@@ -78,7 +118,7 @@ describe("pickBestAttributes", () => {
     ];
     const result = pickBestAttributes(versions);
     expect(result).not.toBeNull();
-    expect(result!.audioLabel).toBe("Atmos");
+    expect(result!.audioLabel).toBe("TrueHD Atmos");
   });
 
   it("ignores audio_tracks entries without codec", () => {
@@ -101,3 +141,18 @@ describe("pickBestAttributes", () => {
     expect(result!.audioLabel).toBe("");
   });
 });
+
+describe("selectDefaultVersion audio matching", () => {
+  it("still matches versions by codec when the preferred track's profile names Atmos", () => {
+    const plain = makeVersion({ file_id: 1, resolution: "2160p", codec_audio: "aac" });
+    const atmos = makeVersion({
+      file_id: 2,
+      resolution: "2160p",
+      codec_audio: "eac3",
+      audio_tracks: [
+        { codec: "eac3", profile: "Dolby Digital Plus + Dolby Atmos", language: "en" },
+      ],
+    });
+    expect(selectDefaultVersion([plain, atmos])?.file_id).toBe(2);
+  });
+});
diff --git a/web/src/pages/ItemDetail/components/versionRankingUtils.ts b/web/src/pages/ItemDetail/components/versionRankingUtils.ts
index 4965e1b014..96449f45ed 100644
--- a/web/src/pages/ItemDetail/components/versionRankingUtils.ts
+++ b/web/src/pages/ItemDetail/components/versionRankingUtils.ts
@@ -1,5 +1,6 @@
 import type { FileVersion, LeafItemUserData, PlaybackVariant } from "@/api/types";
-import { mapAudioLabel } from "@/lib/mediaFormat";
+import { audioTrackAtmosEvidence, mapAudioLabel } from "@/lib/mediaFormat";
+import { versionAudioAtmosEvidence } from "./versionFormatUtils";
 
 const RESOLUTION_RANK: Record<string, number> = {
   "4k": 4,
@@ -85,6 +86,26 @@ export function pickBestAttributes(
   resolution: string;
   hdr: boolean;
   audioLabel: string;
+} | null {
+  const best = bestAttributes(versions, qualityPreference);
+  if (!best) return null;
+  return {
+    resolution: best.resolution,
+    hdr: best.hdr,
+    audioLabel: best.audioCodec ? mapAudioLabel(best.audioCodec, best.audioEvidence) : "",
+  };
+}
+
+// bestAttributes ranks audio by codec alone; the profile and titles only
+// refine the displayed label, so they never change which version is preferred.
+function bestAttributes(
+  versions: FileVersion[],
+  qualityPreference?: string | null,
+): {
+  resolution: string;
+  hdr: boolean;
+  audioCodec: string;
+  audioEvidence?: string;
 } | null {
   if (versions.length === 0) return null;
 
@@ -102,8 +123,19 @@ export function pickBestAttributes(
   let bestResScore = -1;
   let hdr = false;
   let bestAudioCodec = "";
+  let bestAudioEvidence: string | undefined;
   let bestAudioScore = -1;
 
+  // On equal codec scores an Atmos track supplies the label. Equal scores are
+  // the same codec family, so the codec-only label used to pick a version
+  // does not change.
+  const replacesBestAudio = (score: number, codec: string, evidence?: string) =>
+    score > bestAudioScore ||
+    (score >= 0 &&
+      score === bestAudioScore &&
+      !mapAudioLabel(bestAudioCodec, bestAudioEvidence).includes("Atmos") &&
+      mapAudioLabel(codec, evidence).includes("Atmos"));
+
   for (const v of candidates) {
     const rs = resolutionScore(v.resolution);
     if (rs > bestResScore) {
@@ -113,9 +145,11 @@ export function pickBestAttributes(
     if (v.hdr) hdr = true;
 
     const as_ = audioScore(v.codec_audio);
-    if (as_ > bestAudioScore) {
+    const versionEvidence = versionAudioAtmosEvidence(v);
+    if (replacesBestAudio(as_, v.codec_audio, versionEvidence)) {
       bestAudioScore = as_;
       bestAudioCodec = v.codec_audio;
+      bestAudioEvidence = versionEvidence;
     }
 
     // Also check individual audio tracks for higher-quality codecs
@@ -123,9 +157,11 @@ export function pickBestAttributes(
       for (const t of v.audio_tracks) {
         if (t.codec) {
           const ts = audioScore(t.codec);
-          if (ts > bestAudioScore) {
+          const trackEvidence = audioTrackAtmosEvidence(t);
+          if (replacesBestAudio(ts, t.codec, trackEvidence)) {
             bestAudioScore = ts;
             bestAudioCodec = t.codec;
+            bestAudioEvidence = trackEvidence;
           }
         }
       }
@@ -135,7 +171,8 @@ export function pickBestAttributes(
   return {
     resolution: bestRes,
     hdr,
-    audioLabel: bestAudioCodec ? mapAudioLabel(bestAudioCodec) : "",
+    audioCodec: bestAudioCodec,
+    audioEvidence: bestAudioEvidence,
   };
 }
 
@@ -169,14 +206,15 @@ export function selectDefaultVersion(
   if (candidates.length === 1) return candidates[0] ?? null;
 
   // Use quality-preference ranking to find the best match.
-  const preferred = pickBestAttributes(candidates, qualityPreference);
+  const preferred = bestAttributes(candidates, qualityPreference);
   if (preferred) {
+    const preferredAudio = preferred.audioCodec ? mapAudioLabel(preferred.audioCodec) : "";
     const matching = candidates.find(
       (v) =>
         v.resolution === preferred.resolution &&
         v.hdr === preferred.hdr &&
-        (preferred.audioLabel === "" ||
-          mapAudioLabel(v.codec_audio).toLowerCase() === preferred.audioLabel.toLowerCase()),
+        (preferredAudio === "" ||
+          mapAudioLabel(v.codec_audio).toLowerCase() === preferredAudio.toLowerCase()),
     );
     if (matching) return matching;
   }
diff --git a/web/src/pages/LibraryLoadError.test.tsx b/web/src/pages/LibraryLoadError.test.tsx
index ab12c84dcd..91dce1b0a6 100644
--- a/web/src/pages/LibraryLoadError.test.tsx
+++ b/web/src/pages/LibraryLoadError.test.tsx
@@ -40,6 +40,12 @@ vi.mock("@/hooks/queries/sidebarPins", () => ({
   useSidebarPins: () => ({ pins: {} }),
 }));
 
+// The Recommended tab reads the recipe gallery for its cross-row duplicate
+// rule; keep that read off the sequenced request mock above.
+vi.mock("@/lib/recipes", () => ({
+  fetchRecipeCatalog: () => Promise.resolve({ categories: {} }),
+}));
+
 // Stands in for the grid with its empty message, which a failed browse must
 // never reach.
 vi.mock("@/components/ItemGrid", async () => {
diff --git a/web/src/pages/LibraryPage.tsx b/web/src/pages/LibraryPage.tsx
index cebd3da9ff..e632733832 100644
--- a/web/src/pages/LibraryPage.tsx
+++ b/web/src/pages/LibraryPage.tsx
@@ -190,7 +190,7 @@ export default function LibraryPage() {
     setSearchParams,
     shouldApplySavedLibrarySearch,
   ]);
-  /* eslint-enable react-hooks/set-state-in-effect */
+  /* eslint-enable react-hooks/set-state-in-effect -- ends the hydration exception */
 
   useEffect(() => {
     if (!libraryType || shouldApplySavedLibrarySearch) {
diff --git a/web/src/pages/LibraryRecommended.test.tsx b/web/src/pages/LibraryRecommended.test.tsx
index 5ac24ab4e9..3836be21a5 100644
--- a/web/src/pages/LibraryRecommended.test.tsx
+++ b/web/src/pages/LibraryRecommended.test.tsx
@@ -22,6 +22,11 @@ const mockUseSidebarPins = vi.fn();
 const mockUseLibraryCollectionItems = vi.fn();
 const mockUseLibraryHasItems = vi.fn();
 const mockUseIsActingAdmin = vi.fn();
+const mockFetchRecipeCatalog = vi.fn();
+
+vi.mock("@/lib/recipes", () => ({
+  fetchRecipeCatalog: () => mockFetchRecipeCatalog(),
+}));
 
 vi.mock("@/hooks/useIsActingAdmin", () => ({
   useIsActingAdmin: () => mockUseIsActingAdmin(),
@@ -85,13 +90,14 @@ vi.mock("@/components/SectionRow", () => ({
     section: {
       title: string;
       section_type: string;
-      items: Array<{ user_state?: { is_favorite: boolean } }>;
+      items: Array<{ content_id: string; user_state?: { is_favorite: boolean } }>;
     };
   }) => (
     <div
       data-kind="section-row"
       data-section-type={section.section_type}
       data-favorite={section.items[0]?.user_state?.is_favorite ? "true" : "false"}
+      data-item-ids={section.items.map((item) => item.content_id).join(",")}
     >
       {section.title}
     </div>
@@ -209,6 +215,8 @@ describe("LibraryRecommended", () => {
     mockUseLibraryHasItems.mockReset();
     mockUseLibraryHasItems.mockReturnValue({ data: undefined });
     mockUseIsActingAdmin.mockReturnValue(false);
+    mockFetchRecipeCatalog.mockReset();
+    mockFetchRecipeCatalog.mockResolvedValue({ categories: {} });
   });
 
   afterEach(async () => {
@@ -232,6 +240,58 @@ describe("LibraryRecommended", () => {
     return queryClient;
   }
 
+  it("drops what an earlier row shows from avoid-duplicates rows", async () => {
+    mockFetchRecipeCatalog.mockResolvedValue({
+      categories: {
+        personalized: [
+          {
+            type: "recommended_for_you",
+            category: "personalized",
+            presets: [],
+            avoid_duplicates: true,
+            supports_rotation: false,
+            admin_only: false,
+          },
+        ],
+      },
+    });
+    mockUseLibraryLayout.mockReturnValue({
+      data: {
+        sections: [
+          makeLayout({ id: "recent", title: "Recently Added" }),
+          makeLayout({ id: "for-you", section_type: "recommended_for_you", title: "For You" }),
+        ],
+      },
+      isLoading: false,
+    });
+    mockFetchLibrarySectionItems.mockImplementation((_libraryId: number, sectionId: string) => {
+      const section =
+        sectionId === "recent"
+          ? makeSection({ id: "recent", title: "Recently Added" })
+          : makeSection({ id: "for-you", section_type: "recommended_for_you", title: "For You" });
+      const items =
+        sectionId === "recent"
+          ? section.items
+          : [...section.items, { ...section.items[0]!, content_id: "item-2", title: "Item Two" }];
+      return Promise.resolve({ section: { ...section, items, total_count: items.length } });
+    });
+
+    await render(<LibraryRecommended libraryId={42} />);
+
+    await waitFor(() => {
+      expect(
+        container
+          .querySelector('[data-section-type="recommended_for_you"]')
+          ?.getAttribute("data-item-ids"),
+      ).toBe("item-2");
+    });
+    expect(
+      container
+        .querySelector('[data-section-type="recently_added"]')
+        ?.getAttribute("data-item-ids"),
+    ).toBe("item-1");
+  });
+
   it("does not invalidate cached library sections on mount", async () => {
     const invalidateQueries = vi.spyOn(QueryClient.prototype, "invalidateQueries");
 
diff --git a/web/src/pages/LibraryRecommended.tsx b/web/src/pages/LibraryRecommended.tsx
index 124f6168af..cf729c25bb 100644
--- a/web/src/pages/LibraryRecommended.tsx
+++ b/web/src/pages/LibraryRecommended.tsx
@@ -24,6 +24,7 @@ import { sectionKeys } from "@/hooks/queries/keys";
 import { planNextHomeSectionBatch } from "./homeSectionQueue";
 import { buildHomeSectionViewModel, type HomeSectionSlot } from "./homeSectionState";
 import { collectCachedHomeSections } from "./homeSectionCache";
+import { useDedupedSections } from "./sectionDedupe";
 import { isAudiobookLibraryType } from "./libraryPageSearchParams";
 import { useUICustomization } from "@/hooks/useUICustomization";
 import { carouselCardWidthClasses } from "@/lib/uiCustomization";
@@ -175,9 +176,10 @@ export default function LibraryRecommended({
     });
   }, [completedIds, inFlightIds, layout, libraryId, queryClient]);
 
+  const visibleSections = useDedupedSections(layout, loadedSections);
   const viewModel = buildHomeSectionViewModel({
     layout,
-    loadedSections,
+    loadedSections: visibleSections,
     failedIds,
   });
 
@@ -204,6 +206,25 @@ export default function LibraryRecommended({
     enabled: sectionsSettledEmpty,
   });
 
+  // Refetches one section in place through the regular loader, keeping its
+  // current items on screen; the Featured hero uses it while an on-view
+  // translation runs.
+  const refreshSection = (sectionId: string) => {
+    void queryClient
+      .invalidateQueries({
+        queryKey: sectionKeys.libraryItems(libraryId, sectionId),
+        refetchType: "none",
+      })
+      .then(() =>
+        setCompletedIds((prev) => {
+          if (!prev.has(sectionId)) return prev;
+          const next = new Set(prev);
+          next.delete(sectionId);
+          return next;
+        }),
+      );
+  };
+
   const retrySection = (sectionId: string) => {
     queryClient.removeQueries({
       queryKey: sectionKeys.libraryItems(libraryId, sectionId),
@@ -249,7 +270,7 @@ export default function LibraryRecommended({
 
   return (
     <div className="space-y-10 sm:space-y-12">
-      {renderHeroSlot(viewModel.hero, retrySection, libraryId, libraryType)}
+      {renderHeroSlot(viewModel.hero, retrySection, refreshSection, libraryId, libraryType)}
       {/* A layout refetch (after playback, a library change, a reconnect)
           failed: the cached layout stays, and the layout can be retried. */}
       {isError ? (
@@ -295,6 +316,7 @@ export default function LibraryRecommended({
 function renderHeroSlot(
   hero: HomeSectionSlot | null,
   retrySection: (sectionId: string) => void,
+  refreshSection: (sectionId: string) => void,
   libraryId: number,
   libraryType: string,
 ) {
@@ -315,6 +337,7 @@ function renderHeroSlot(
         bleed
         reserveHeaderSpace
         libraryId={libraryId}
+        onRefreshItems={() => refreshSection(hero.layout.id)}
       />
     );
   }
diff --git a/web/src/pages/Login.tsx b/web/src/pages/Login.tsx
index e604f4d72e..e87554b30a 100644
--- a/web/src/pages/Login.tsx
+++ b/web/src/pages/Login.tsx
@@ -614,17 +614,7 @@ export default function Login() {
                   />
                 </div>
                 <div className="space-y-2">
-                  <div className="flex items-baseline justify-between gap-2">
-                    <Label htmlFor="password">Password</Label>
-                    {forgotPasswordShown && (
-                      <Link
-                        to={forgotPasswordHref}
-                        className="text-muted-foreground hover:text-foreground text-xs underline-offset-4 hover:underline"
-                      >
-                        Forgot password?
-                      </Link>
-                    )}
-                  </div>
+                  <Label htmlFor="password">Password</Label>
                   <PasswordInput
                     id="password"
                     value={password}
@@ -632,6 +622,16 @@ export default function Login() {
                     autoComplete="current-password"
                     required
                   />
+                  {forgotPasswordShown && (
+                    <div className="flex justify-end">
+                      <Link
+                        to={forgotPasswordHref}
+                        className="text-muted-foreground hover:text-foreground text-xs underline-offset-4 hover:underline"
+                      >
+                        Forgot password?
+                      </Link>
+                    </div>
+                  )}
                 </div>
                 {(credentialProviders.length > 1 || hasDirectoryProvider) && (
                   <div className="space-y-2">
diff --git a/web/src/pages/Notifications.test.tsx b/web/src/pages/Notifications.test.tsx
index 963ddcc453..2023778cdc 100644
--- a/web/src/pages/Notifications.test.tsx
+++ b/web/src/pages/Notifications.test.tsx
@@ -11,18 +11,32 @@ const state = vi.hoisted(() => ({
     restart: vi.fn(),
   },
   all: { mutateAsync: vi.fn(), isPending: false, isError: false, reset: vi.fn() },
+  capability: undefined as unknown,
+  prefs: undefined as unknown,
+  series: {} as Record<string, unknown>,
+  seriesOptions: [] as unknown[],
+  mute: { mutate: vi.fn(), isPending: false, variables: undefined as unknown },
 }));
 vi.mock("@/hooks/useAuth", () => ({ useAuth: () => ({}) }));
 vi.mock("@/api/v2/notifications", () => ({ notificationScope: () => "owner" }));
 vi.mock("@/hooks/useDocumentTitle", () => ({ useDocumentTitle: () => {} }));
-vi.mock("@/hooks/queries/notifications", () => ({
+vi.mock("@/hooks/queries/notificationWebhooks", () => ({
+  useNotificationCapability: () => ({ data: state.capability }),
+}));
+vi.mock("@/hooks/queries/notifications", async (importOriginal) => ({
+  formatEpisodeCode: (await importOriginal<typeof import("@/hooks/queries/notifications")>())
+    .formatEpisodeCode,
+  useNotificationSeries: (status: string, options: unknown) => {
+    state.seriesOptions.push(options);
+    return state.series[status];
+  },
   useNotifications: () => state.list,
   useUnreadNotificationCount: () => ({ data: 2 }),
   useMarkAllNotificationsRead: () => state.all,
   useMarkNotificationRead: () => ({ mutate: vi.fn() }),
-  useNotificationPreferences: () => ({ data: undefined, isLoading: false }),
+  useNotificationPreferences: () => ({ data: state.prefs, isLoading: false }),
   useUpdateNotificationPreferences: () => ({ mutate: vi.fn() }),
-  formatEpisodeCode: () => "",
+  useSetNotificationSeriesMuted: () => state.mute,
 }));
 const row = {
   id: "one",
@@ -40,6 +54,13 @@ beforeEach(() => {
   state.all.mutateAsync.mockReset();
   state.all.reset.mockReset();
   state.list.restart.mockReset().mockResolvedValue(undefined);
+  state.capability = undefined;
+  state.prefs = undefined;
+  state.series = {};
+  state.seriesOptions = [];
+  state.mute.mutate.mockReset();
+  state.mute.isPending = false;
+  state.mute.variables = undefined;
 });
 afterEach(cleanup);
 it("submits the displayed cutoff once while the mutation remains pending", async () => {
@@ -49,7 +70,11 @@ it("submits the displayed cutoff once while the mutation remains pending", async
       finish = resolve;
     }),
   );
-  render(<Notifications />);
+  render(
+    <MemoryRouter>
+      <Notifications />
+    </MemoryRouter>,
+  );
   const button = screen.getByRole("button", { name: "Mark all read" });
   fireEvent.click(button);
   fireEvent.click(button);
@@ -60,7 +85,11 @@ it("submits the displayed cutoff once while the mutation remains pending", async
 it("retains partial rows and requires explicit reload after a mark-all failure", async () => {
   state.list.isError = true;
   state.all.isError = true;
-  render(<Notifications />);
+  render(
+    <MemoryRouter>
+      <Notifications />
+    </MemoryRouter>,
+  );
   expect(screen.getByText("Displayed episode")).toBeInTheDocument();
   expect(screen.queryByText("No notifications yet")).not.toBeInTheDocument();
   expect(screen.getByRole("button", { name: "Mark all read" })).toBeDisabled();
@@ -144,8 +173,245 @@ it("leaves a request row unlinked when its payload lacks the TMDB id", () => {
 it("does not describe failed initial loading as an empty inbox or permit an unbounded read-all", () => {
   state.list.data = undefined;
   state.list.isError = true;
-  render(<Notifications />);
+  render(
+    <MemoryRouter>
+      <Notifications />
+    </MemoryRouter>,
+  );
   expect(screen.queryByText("No notifications yet")).not.toBeInTheDocument();
   expect(screen.getByRole("button", { name: "Mark all read" })).toBeDisabled();
   expect(screen.getByRole("button", { name: "Reload notifications" })).toBeInTheDocument();
 });
+
+const prefs = {
+  profile_id: "owner",
+  enabled: true,
+  notify_favorites: true,
+  notify_watchlist: false,
+  notify_continue_watching: true,
+  notify_next_up: true,
+};
+const reasons = (set: Partial<Record<string, boolean>>) => ({
+  favorite: false,
+  watchlist: false,
+  continue_watching: false,
+  next_up: false,
+  ...set,
+});
+function seriesQuery(series: unknown[]) {
+  return { data: { pages: [{ series }] }, isLoading: false, isError: false, hasNextPage: false };
+}
+function seriesEntry(id: string, title: string, entry: Record<string, unknown>) {
+  return {
+    item: { content_id: id, title, type: "series", status: "matched", genres: [], keywords: [] },
+    ...entry,
+  };
+}
+function renderAt(path: string) {
+  render(
+    <MemoryRouter initialEntries={[path]}>
+      <Notifications />
+    </MemoryRouter>,
+  );
+}
+it("offers the Series view only when the server lists notified series", () => {
+  renderAt("/notifications?view=series");
+  expect(screen.queryByRole("button", { name: "Series" })).not.toBeInTheDocument();
+  expect(screen.getByText("Displayed episode")).toBeInTheDocument();
+});
+it("lists the series that notify, then the ones the preferences silence", () => {
+  state.capability = { series: { available: true } };
+  state.prefs = prefs;
+  state.series = {
+    active: seriesQuery([
+      seriesEntry("series:andor", "Andor", {
+        reasons: reasons({ next_up: true }),
+        active_reasons: reasons({ next_up: true }),
+        notifies: true,
+        next_up_after: { season_number: 2, episode_number: 8 },
+      }),
+      seriesEntry("series:omitb", "Only Murders", {
+        reasons: reasons({ favorite: true, watchlist: true }),
+        active_reasons: reasons({ favorite: true }),
+        notifies: true,
+      }),
+    ]),
+    inactive: seriesQuery([
+      seriesEntry("series:slow", "Slow Horses", {
+        reasons: reasons({ watchlist: true }),
+        active_reasons: reasons({}),
+        notifies: false,
+      }),
+    ]),
+  };
+  renderAt("/notifications?view=series");
+  expect(screen.getByRole("button", { name: "Series" })).toBeInTheDocument();
+  expect(screen.queryByText("Displayed episode")).not.toBeInTheDocument();
+  expect(screen.queryByRole("button", { name: "Mark all read" })).not.toBeInTheDocument();
+  expect(screen.getByRole("link", { name: /Andor/ })).toHaveTextContent("Any episode after S2E8");
+  const omitb = screen.getByRole("link", { name: /Only Murders/ });
+  expect(omitb).toHaveTextContent("Any new episode");
+  expect(omitb).toHaveTextContent("Watchlist (off)");
+  expect(screen.getByRole("heading", { name: "Won’t notify" })).toBeInTheDocument();
+  expect(screen.getByRole("link", { name: /Slow Horses/ })).toHaveTextContent(
+    "Watchlist notifications are off",
+  );
+});
+it("returns from the Series view to the inbox", () => {
+  state.capability = { series: { available: true } };
+  state.series = { active: seriesQuery([]), inactive: seriesQuery([]) };
+  renderAt("/notifications?view=series");
+  expect(screen.getByText("No series notify you yet")).toBeInTheDocument();
+  fireEvent.click(screen.getByRole("button", { name: "All" }));
+  expect(screen.getByText("Displayed episode")).toBeInTheDocument();
+});
+it("links an empty inbox to the series that can notify", () => {
+  state.capability = { series: { available: true } };
+  state.series = { active: seriesQuery([]), inactive: seriesQuery([]) };
+  state.list.data = { pages: [{ notifications: [], read_cutoff: "" }] };
+  renderAt("/notifications");
+  fireEvent.click(screen.getByRole("button", { name: "See which series can notify you" }));
+  expect(screen.getByText("No series notify you yet")).toBeInTheDocument();
+});
+it("searches, filters, and sorts the Series view from the URL", async () => {
+  state.capability = { series: { available: true } };
+  state.series = { active: seriesQuery([]), inactive: seriesQuery([]) };
+  renderAt("/notifications?view=series&reason=watchlist&sort=-year");
+  expect(state.seriesOptions.at(-1)).toEqual({ q: "", reason: "watchlist", sort: "-year" });
+  expect(screen.getByRole("combobox", { name: "Filter by reason" })).toHaveTextContent("Watchlist");
+  expect(screen.getByRole("combobox", { name: "Sort" })).toHaveTextContent("Release year");
+  expect(screen.getByText("No series match. Try another search or reason.")).toBeInTheDocument();
+  fireEvent.change(screen.getByRole("searchbox", { name: "Search series" }), {
+    target: { value: " bear " },
+  });
+  await waitFor(() =>
+    expect(state.seriesOptions.at(-1)).toEqual({ q: "bear", reason: "watchlist", sort: "-year" }),
+  );
+});
+it("pages the notifying series before showing the silenced ones", () => {
+  state.capability = { series: { available: true } };
+  state.prefs = prefs;
+  const active = {
+    ...seriesQuery([
+      seriesEntry("series:bear", "The Bear", {
+        reasons: reasons({ favorite: true }),
+        active_reasons: reasons({ favorite: true }),
+        notifies: true,
+      }),
+    ]),
+    hasNextPage: true,
+    fetchNextPage: vi.fn(),
+  };
+  const inactive = {
+    ...seriesQuery([
+      seriesEntry("series:slow", "Slow Horses", {
+        reasons: reasons({ watchlist: true }),
+        active_reasons: reasons({}),
+        notifies: false,
+      }),
+    ]),
+    hasNextPage: true,
+    fetchNextPage: vi.fn(),
+  };
+  state.series = { active, inactive };
+  renderAt("/notifications?view=series");
+  expect(screen.queryByText("Slow Horses")).not.toBeInTheDocument();
+  // jsdom has no IntersectionObserver, so the foot offers a button.
+  fireEvent.click(screen.getByRole("button", { name: "Load more" }));
+  expect(active.fetchNextPage).toHaveBeenCalledOnce();
+  expect(inactive.fetchNextPage).not.toHaveBeenCalled();
+});
+it("keeps loading when a page resolves to no visible series", () => {
+  state.capability = { series: { available: true } };
+  const active = { ...seriesQuery([]), hasNextPage: true, fetchNextPage: vi.fn() };
+  state.series = { active, inactive: seriesQuery([]) };
+  renderAt("/notifications?view=series");
+  expect(screen.queryByText("No series notify you yet")).not.toBeInTheDocument();
+  fireEvent.click(screen.getByRole("button", { name: "Load more" }));
+  expect(active.fetchNextPage).toHaveBeenCalledOnce();
+});
+it("clears the search box when the Series button resets the view", async () => {
+  state.capability = { series: { available: true } };
+  state.series = { active: seriesQuery([]), inactive: seriesQuery([]) };
+  renderAt("/notifications?view=series&q=bear");
+  const search = screen.getByRole("searchbox", { name: "Search series" });
+  expect(search).toHaveValue("bear");
+  fireEvent.click(screen.getByRole("button", { name: "Series" }));
+  await waitFor(() => expect(search).toHaveValue(""));
+  await new Promise((resolve) => setTimeout(resolve, 400));
+  expect(state.seriesOptions.at(-1)).toMatchObject({ q: "" });
+});
+it("mutes a series from its row and lists muted series under Won't notify with Unmute", () => {
+  state.capability = { series: { available: true, mute: true } };
+  state.prefs = prefs;
+  state.series = {
+    active: seriesQuery([
+      seriesEntry("series:andor", "Andor", {
+        reasons: reasons({ favorite: true }),
+        active_reasons: reasons({ favorite: true }),
+        notifies: true,
+        muted: false,
+      }),
+    ]),
+    inactive: seriesQuery([
+      seriesEntry("series:wire", "The Wire", {
+        reasons: reasons({ favorite: true }),
+        active_reasons: reasons({ favorite: true }),
+        notifies: false,
+        muted: true,
+      }),
+    ]),
+  };
+  renderAt("/notifications?view=series");
+  fireEvent.click(screen.getByRole("button", { name: "Mute Andor" }));
+  expect(state.mute.mutate).toHaveBeenLastCalledWith({
+    seriesId: "series:andor",
+    title: "Andor",
+    muted: true,
+  });
+  const wire = screen.getByRole("link", { name: /The Wire/ });
+  expect(wire).toHaveTextContent("Muted");
+  expect(wire).toHaveTextContent("Favorite (off)");
+  expect(screen.queryByRole("button", { name: "Mute The Wire" })).not.toBeInTheDocument();
+  fireEvent.click(screen.getByRole("button", { name: "Unmute The Wire" }));
+  expect(state.mute.mutate).toHaveBeenLastCalledWith({
+    seriesId: "series:wire",
+    title: "The Wire",
+    muted: false,
+  });
+});
+it("disables the row whose mute is in flight", () => {
+  state.capability = { series: { available: true, mute: true } };
+  state.mute.isPending = true;
+  state.mute.variables = { seriesId: "series:andor", title: "Andor", muted: true };
+  const entry = (id: string, title: string) =>
+    seriesEntry(id, title, {
+      reasons: reasons({ favorite: true }),
+      active_reasons: reasons({ favorite: true }),
+      notifies: true,
+      muted: false,
+    });
+  state.series = {
+    active: seriesQuery([entry("series:andor", "Andor"), entry("series:bear", "The Bear")]),
+    inactive: seriesQuery([]),
+  };
+  renderAt("/notifications?view=series");
+  expect(screen.getByRole("button", { name: "Mute Andor" })).toBeDisabled();
+  expect(screen.getByRole("button", { name: "Mute The Bear" })).toBeEnabled();
+});
+it("offers no Mute when the server cannot mute a series", () => {
+  state.capability = { series: { available: true } };
+  state.series = {
+    active: seriesQuery([
+      seriesEntry("series:andor", "Andor", {
+        reasons: reasons({ favorite: true }),
+        active_reasons: reasons({ favorite: true }),
+        notifies: true,
+      }),
+    ]),
+    inactive: seriesQuery([]),
+  };
+  renderAt("/notifications?view=series");
+  expect(screen.getByRole("link", { name: /Andor/ })).toBeInTheDocument();
+  expect(screen.queryByRole("button", { name: /Mute/ })).not.toBeInTheDocument();
+});
diff --git a/web/src/pages/Notifications.tsx b/web/src/pages/Notifications.tsx
index 6ae0fb6730..35f04506a8 100644
--- a/web/src/pages/Notifications.tsx
+++ b/web/src/pages/Notifications.tsx
@@ -1,6 +1,7 @@
 import { useAuth } from "@/hooks/useAuth";
 import { notificationScope } from "@/api/v2/notifications";
 import { Fragment, useState, useRef } from "react";
+import { useSearchParams } from "react-router";
 import { Bell, BellOff, Check, CheckCheck, Loader2, RefreshCw, Settings2 } from "lucide-react";
 import type { AppNotification } from "@/api/types";
 import { Button } from "@/components/ui/button";
@@ -18,10 +19,13 @@ import {
   useUpdateNotificationPreferences,
 } from "@/hooks/queries/notifications";
 import { useDocumentTitle } from "@/hooks/useDocumentTitle";
-import { decodeThumbhash } from "@/lib/thumbhash";
 import { preferredDateLocale } from "@/lib/datetime";
 import { requestDetailHref } from "@/lib/mediaRequests";
 import ViewTransitionLink from "@/components/ViewTransitionLink";
+import { NotifiedSeriesList } from "@/components/notifications/NotifiedSeriesList";
+import { useNotificationCapability } from "@/hooks/queries/notificationWebhooks";
+import { NotificationPoster } from "@/components/notifications/NotificationPoster";
+import { NOTIFICATION_REASONS } from "@/components/notifications/reasons";
 
 function formatNotificationTime(value: string): string {
   const date = new Date(value);
@@ -116,20 +120,7 @@ function notificationHref(notification: AppNotification): string | null {
 
 function reasonLabels(notification: AppNotification): string[] {
   const flags = notification.reason_flags ?? {};
-  const labels: string[] = [];
-  if (flags.favorite) {
-    labels.push("Favorite");
-  }
-  if (flags.watchlist) {
-    labels.push("Watchlist");
-  }
-  if (flags.continue_watching) {
-    labels.push("Continue Watching");
-  }
-  if (flags.next_up) {
-    labels.push("Next Up");
-  }
-  return labels;
+  return NOTIFICATION_REASONS.filter((reason) => flags[reason.key]).map((reason) => reason.label);
 }
 
 function NotificationRow({
@@ -140,34 +131,11 @@ function NotificationRow({
   onMarkRead: (id: string) => void;
 }) {
   const unread = !notification.read_at;
-  const thumbhashUrl = notification.poster_thumbhash
-    ? decodeThumbhash(notification.poster_thumbhash)
-    : "";
   const detailHref = notificationHref(notification);
 
   const body = (
     <>
-      <div
-        className="bg-muted relative h-16 w-11 shrink-0 overflow-hidden rounded-md"
-        style={
-          thumbhashUrl
-            ? {
-                backgroundImage: `url(${thumbhashUrl})`,
-                backgroundSize: "cover",
-                backgroundPosition: "center",
-              }
-            : undefined
-        }
-      >
-        {notification.poster_url && (
-          <img
-            src={notification.poster_url}
-            alt=""
-            className="h-full w-full object-cover"
-            loading="lazy"
-          />
-        )}
-      </div>
+      <NotificationPoster url={notification.poster_url} thumbhash={notification.poster_thumbhash} />
       <div className="min-w-0 flex-1">
         <div className="flex items-center gap-2">
           {unread && (
@@ -240,7 +208,16 @@ function NotificationRow({
   );
 }
 
-function NotificationPreferencesPopover() {
+function NotificationPreferencesPopover({
+  open,
+  onOpenChange,
+  onSeeSeries,
+}: {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  /** Opens the Series view; absent when the server has none. */
+  onSeeSeries?: () => void;
+}) {
   const { data: prefs, isLoading, refetch } = useNotificationPreferences();
   const updatePrefs = useUpdateNotificationPreferences();
 
@@ -282,7 +259,7 @@ function NotificationPreferencesPopover() {
   ];
 
   return (
-    <Popover>
+    <Popover open={open} onOpenChange={onOpenChange}>
       <PopoverTrigger asChild>
         <Button variant="outline" size="sm">
           <Settings2 className="mr-1.5 h-4 w-4" />
@@ -326,6 +303,22 @@ function NotificationPreferencesPopover() {
                 </div>
               </Fragment>
             ))}
+            {onSeeSeries && (
+              <>
+                <Separator />
+                <Button
+                  variant="link"
+                  size="sm"
+                  className="h-auto p-0"
+                  onClick={() => {
+                    onOpenChange(false);
+                    onSeeSeries();
+                  }}
+                >
+                  See which series notify you
+                </Button>
+              </>
+            )}
           </div>
         )}
       </PopoverContent>
@@ -340,6 +333,12 @@ export default function Notifications() {
 function NotificationsInbox() {
   useDocumentTitle("Notifications");
   const [statusFilter, setStatusFilter] = useState<"all" | "unread">("all");
+  const [searchParams, setSearchParams] = useSearchParams();
+  const [preferencesOpen, setPreferencesOpen] = useState(false);
+  const { data: capability } = useNotificationCapability();
+  const seriesAvailable = capability?.series?.available === true;
+  const showSeries = seriesAvailable && searchParams.get("view") === "series";
+  const openSeries = seriesAvailable ? () => setSearchParams({ view: "series" }) : undefined;
   const list = useNotifications(statusFilter);
   const { data: unreadCount } = useUnreadNotificationCount();
   const markRead = useMarkNotificationRead();
@@ -368,7 +367,7 @@ function NotificationsInbox() {
           Notifications
         </h1>
         <div className="ml-auto flex items-center gap-2">
-          {(unreadCount ?? 0) > 0 && (
+          {!showSeries && (unreadCount ?? 0) > 0 && (
             <Button
               variant="outline"
               size="sm"
@@ -379,7 +378,11 @@ function NotificationsInbox() {
               Mark all read
             </Button>
           )}
-          <NotificationPreferencesPopover />
+          <NotificationPreferencesPopover
+            open={preferencesOpen}
+            onOpenChange={setPreferencesOpen}
+            onSeeSeries={openSeries}
+          />
         </div>
       </div>
 
@@ -387,80 +390,102 @@ function NotificationsInbox() {
         {(["all", "unread"] as const).map((status) => (
           <Button
             key={status}
-            variant={statusFilter === status ? "secondary" : "ghost"}
+            variant={!showSeries && statusFilter === status ? "secondary" : "ghost"}
             size="sm"
-            onClick={() => setStatusFilter(status)}
+            onClick={() => {
+              setStatusFilter(status);
+              if (showSeries) setSearchParams({}, { replace: true });
+            }}
           >
             {status === "all" ? "All" : `Unread${unreadCount ? ` (${unreadCount})` : ""}`}
           </Button>
         ))}
+        {openSeries && (
+          <Button variant={showSeries ? "secondary" : "ghost"} size="sm" onClick={openSeries}>
+            Series
+          </Button>
+        )}
       </div>
 
-      {markAllRead.isError && (
-        <p role="alert">
-          Could not mark the displayed notifications read.{" "}
-          <Button
-            onClick={() => {
-              void list.restart().then(() => markAllRead.reset());
-            }}
-          >
-            Reload inbox
-          </Button>{" "}
-          before trying again.
-        </p>
-      )}
-      {list.isError && (
-        <div role="alert">
-          Could not load notifications.{" "}
-          <Button
-            onClick={() => {
-              void list.restart().then(() => markAllRead.reset());
-            }}
-          >
-            Reload notifications
-          </Button>
-        </div>
-      )}
-      {list.isLoading ? (
-        <div className="space-y-2">
-          {Array.from({ length: 5 }).map((_, index) => (
-            <Skeleton key={index} className="h-20 w-full rounded-xl" />
-          ))}
-        </div>
-      ) : notifications.length === 0 && !list.isError ? (
-        <div className="text-muted-foreground flex flex-col items-center gap-3 py-20 text-center">
-          <BellOff className="h-10 w-10 opacity-50" />
-          <div className="text-sm">
-            {statusFilter === "unread" ? "No unread notifications" : "No notifications yet"}
-          </div>
-          <div className="max-w-sm text-xs">
-            You will be notified here when new episodes arrive for series you favorite, watchlist,
-            or are watching.
-          </div>
-        </div>
+      {showSeries ? (
+        <NotifiedSeriesList
+          onOpenPreferences={() => setPreferencesOpen(true)}
+          canMute={capability?.series?.mute === true}
+        />
       ) : (
         <>
-          <ul className="list-none space-y-1">
-            {notifications.map((notification) => (
-              <NotificationRow
-                key={notification.id}
-                notification={notification}
-                onMarkRead={(id) => markRead.mutate(id)}
-              />
-            ))}
-          </ul>
-          {list.hasNextPage && (
-            <div className="mt-6 flex justify-center">
+          {markAllRead.isError && (
+            <p role="alert">
+              Could not mark the displayed notifications read.{" "}
+              <Button
+                onClick={() => {
+                  void list.restart().then(() => markAllRead.reset());
+                }}
+              >
+                Reload inbox
+              </Button>{" "}
+              before trying again.
+            </p>
+          )}
+          {list.isError && (
+            <div role="alert">
+              Could not load notifications.{" "}
               <Button
-                variant="outline"
-                onClick={() => list.fetchNextPage()}
-                disabled={list.isFetchingNextPage}
+                onClick={() => {
+                  void list.restart().then(() => markAllRead.reset());
+                }}
               >
-                {list.isFetchingNextPage && <Loader2 className="mr-2 h-4 w-4 animate-spin" />}
-                Load more
+                Reload notifications
               </Button>
             </div>
           )}
+          {list.isLoading ? (
+            <div className="space-y-2">
+              {Array.from({ length: 5 }).map((_, index) => (
+                <Skeleton key={index} className="h-20 w-full rounded-xl" />
+              ))}
+            </div>
+          ) : notifications.length === 0 && !list.isError ? (
+            <div className="text-muted-foreground flex flex-col items-center gap-3 py-20 text-center">
+              <BellOff className="h-10 w-10 opacity-50" />
+              <div className="text-sm">
+                {statusFilter === "unread" ? "No unread notifications" : "No notifications yet"}
+              </div>
+              <div className="max-w-sm text-xs">
+                You will be notified here when new episodes arrive for series you favorite,
+                watchlist, or are watching.
+              </div>
+              {openSeries && (
+                <Button variant="link" size="sm" onClick={openSeries}>
+                  See which series can notify you
+                </Button>
+              )}
+            </div>
+          ) : (
+            <>
+              <ul className="list-none space-y-1">
+                {notifications.map((notification) => (
+                  <NotificationRow
+                    key={notification.id}
+                    notification={notification}
+                    onMarkRead={(id) => markRead.mutate(id)}
+                  />
+                ))}
+              </ul>
+              {list.hasNextPage && (
+                <div className="mt-6 flex justify-center">
+                  <Button
+                    variant="outline"
+                    onClick={() => list.fetchNextPage()}
+                    disabled={list.isFetchingNextPage}
+                  >
+                    {list.isFetchingNextPage && <Loader2 className="mr-2 h-4 w-4 animate-spin" />}
+                    Load more
+                  </Button>
+                </div>
+              )}
+            </>
+          )}
         </>
       )}
     </div>
diff --git a/web/src/pages/Profiles.test.tsx b/web/src/pages/Profiles.test.tsx
index c302b851cb..a899e1b822 100644
--- a/web/src/pages/Profiles.test.tsx
+++ b/web/src/pages/Profiles.test.tsx
@@ -13,9 +13,25 @@ const mocks = vi.hoisted(() => ({
   useAuth: vi.fn(),
   navigate: vi.fn(),
   editorPin: "",
+  editorProps: null as null | { profileContext?: unknown; libraries: UserLibrary[] },
   searchParams: new URLSearchParams(),
+  listUserLibraries: vi.fn(),
+  toastError: vi.fn(),
 }));
 
+vi.mock("sonner", () => ({ toast: { error: mocks.toastError, success: vi.fn() } }));
+
+vi.mock("@/api/client", async () => {
+  const actual = await vi.importActual<typeof import("@/api/client")>("@/api/client");
+  return {
+    ...actual,
+    captureProfileRequestContextAs: (profileId: string, profileToken: string | null) => ({
+      profileId,
+      profileToken,
+    }),
+  };
+});
+
 vi.mock("react-router", async () => {
   const actual = await vi.importActual<typeof import("react-router")>("react-router");
   return {
@@ -31,6 +47,7 @@ vi.mock("@/hooks/queries/profiles", () => ({
 
 vi.mock("@/hooks/queries/libraries", () => ({
   useAvailableUserLibraries: (...args: unknown[]) => mocks.useAvailableUserLibraries(...args),
+  listUserLibraries: (...args: unknown[]) => mocks.listUserLibraries(...args),
 }));
 
 vi.mock("@/hooks/useAuth", () => ({
@@ -41,11 +58,15 @@ vi.mock("@/components/profiles/ProfileEditorDialog", () => ({
   ProfileEditorDialog: ({
     open,
     onSaveSuccess,
+    ...props
   }: {
     open: boolean;
+    profileContext?: unknown;
+    libraries: UserLibrary[];
     onSaveSuccess?: (profile: Profile, context: { mode: "create" | "edit"; pin: string }) => void;
-  }) =>
-    open ? (
+  }) => {
+    if (open) mocks.editorProps = props;
+    return open ? (
       <button
         type="button"
         onClick={() =>
@@ -64,7 +85,8 @@ vi.mock("@/components/profiles/ProfileEditorDialog", () => ({
       >
         save-editor
       </button>
-    ) : null,
+    ) : null;
+  },
 }));
 
 vi.mock("@/components/profiles/ProfilePinDialog", () => ({
@@ -85,6 +107,10 @@ vi.mock("@/components/profiles/ProfilePinDialog", () => ({
 import Profiles from "./Profiles";
 
 const libraries: UserLibrary[] = [{ id: 1, name: "Movies", type: "movies", sort_order: 0 }];
+const primaryLibraries: UserLibrary[] = [
+  ...libraries,
+  { id: 2, name: "Shows", type: "tvshows", sort_order: 1 },
+];
 
 function makeProfile(overrides: Partial<Profile> = {}): Profile {
   return {
@@ -154,7 +180,10 @@ describe("Profiles", () => {
     mocks.useAuth.mockReset();
     mocks.navigate.mockReset();
     mocks.editorPin = "";
+    mocks.editorProps = null;
     mocks.searchParams = new URLSearchParams();
+    mocks.listUserLibraries.mockReset().mockResolvedValue(primaryLibraries);
+    mocks.toastError.mockReset();
 
     mocks.useProfiles.mockReturnValue({
       data: [makeProfile(), makeProfile({ id: "profile-2", name: "Guest" })],
@@ -261,4 +290,60 @@ describe("Profiles", () => {
 
     expect(mocks.navigate).toHaveBeenCalledWith("/");
   });
+  it.each([
+    { hasPin: false, token: null },
+    { hasPin: true, token: "verified-token" },
+  ])(
+    "adds a profile as the primary profile (PIN $hasPin) without selecting anyone",
+    async ({ hasPin, token }) => {
+      const primary = makeProfile({
+        id: "primary",
+        name: "Parent",
+        is_primary: true,
+        has_pin: hasPin,
+      });
+      mocks.useProfiles.mockReturnValue({ data: [primary, makeProfile()], isLoading: false });
+
+      await render(<Profiles />);
+      await click(findButton(container, "Add profile"));
+      if (hasPin) {
+        await click(findButton(container, "confirm-pin"));
+      }
+
+      const profileContext = { profileId: "primary", profileToken: token };
+      expect(mocks.listUserLibraries).toHaveBeenCalledWith({ profileContext });
+      expect(mocks.editorProps).toMatchObject({ profileContext, libraries: primaryLibraries });
+
+      await click(findButton(container, "save-editor"));
+      expect(selectProfile).not.toHaveBeenCalled();
+      expect(mocks.navigate).not.toHaveBeenCalled();
+    },
+  );
+
+  it("manages profiles by selecting the verified primary profile", async () => {
+    const primary = makeProfile({ id: "primary", name: "Parent", is_primary: true, has_pin: true });
+    mocks.useProfiles.mockReturnValue({ data: [primary, makeProfile()], isLoading: false });
+    mocks.searchParams = new URLSearchParams("redirect=%2Fmovies");
+
+    await render(<Profiles />);
+    await click(findButton(container, "Manage profiles"));
+    await click(findButton(container, "confirm-pin"));
+
+    expect(selectProfile).toHaveBeenCalledWith(primary, "verified-token");
+    expect(mocks.navigate).toHaveBeenCalledWith("/settings/profiles");
+  });
+
+  it("reports a failure to open the new profile form on the picker", async () => {
+    mocks.useProfiles.mockReturnValue({
+      data: [makeProfile({ id: "primary", is_primary: true }), makeProfile({ id: "p2" })],
+      isLoading: false,
+    });
+    mocks.listUserLibraries.mockRejectedValue(new TypeError("Failed to fetch"));
+
+    await render(<Profiles />);
+    await click(findButton(container, "Add profile"));
+
+    expect(mocks.toastError).toHaveBeenCalledWith("Couldn't open the new profile form. Try again.");
+    expect(mocks.editorProps).toBeNull();
+  });
 });
diff --git a/web/src/pages/Profiles.tsx b/web/src/pages/Profiles.tsx
index 6a87396d1b..26a09b5de2 100644
--- a/web/src/pages/Profiles.tsx
+++ b/web/src/pages/Profiles.tsx
@@ -1,9 +1,14 @@
 import { useState } from "react";
 import { useNavigate, useSearchParams } from "react-router";
-import { Lock, LogOut, Plus } from "lucide-react";
+import { Lock, LogOut, Plus, UserCog } from "lucide-react";
 import { toast } from "sonner";
 
-import type { Profile } from "@/api/types";
+import {
+  captureProfileRequestContextAs,
+  StaleApiRequestContextError,
+  type ProfileRequestContextSnapshot,
+} from "@/api/client";
+import type { Profile, UserLibrary } from "@/api/types";
 import { ProfileEditorDialog } from "@/components/profiles/ProfileEditorDialog";
 import { ProfilePinDialog } from "@/components/profiles/ProfilePinDialog";
 import { pinLockoutMessage } from "@/components/profiles/pinLockout";
@@ -12,12 +17,27 @@ import { Button } from "@/components/ui/button";
 import { Skeleton } from "@/components/ui/skeleton";
 import { useDocumentTitle } from "@/hooks/useDocumentTitle";
 import { useAuth } from "@/hooks/useAuth";
-import { useAvailableUserLibraries } from "@/hooks/queries/libraries";
+import { listUserLibraries, useAvailableUserLibraries } from "@/hooks/queries/libraries";
 import { useProfiles } from "@/hooks/queries/profiles";
 import { AuthBackground } from "@/components/auth/AuthBackground";
 import { AuthBrandHero } from "@/components/auth/AuthBrandHero";
 import { sanitizeAuthRedirect } from "@/lib/authRedirect";
 
+type ManagePurpose = "add" | "manage";
+/** What a PIN prompt on the picker unlocks. */
+type PinPurpose = "select" | ManagePurpose;
+
+const PIN_PURPOSE_DESCRIPTIONS: Partial<Record<PinPurpose, string>> = {
+  add: "Adding a profile needs the primary profile's PIN.",
+  manage: "Managing profiles needs the primary profile's PIN.",
+};
+
+/** A new profile being created as the verified primary profile. */
+interface AddProfileSession {
+  profileContext: ProfileRequestContextSnapshot;
+  libraries: UserLibrary[];
+}
+
 export default function Profiles() {
   const {
     data: profiles = [],
@@ -28,7 +48,11 @@ export default function Profiles() {
   } = useProfiles();
   const { data: libraries = [], isLoading: librariesLoading } = useAvailableUserLibraries();
   const [editorOpen, setEditorOpen] = useState(false);
-  const [pinProfile, setPinProfile] = useState<Profile | null>(null);
+  const [pinRequest, setPinRequest] = useState<{ profile: Profile; purpose: PinPurpose } | null>(
+    null,
+  );
+  const [addSession, setAddSession] = useState<AddProfileSession | null>(null);
+  const [preparingAdd, setPreparingAdd] = useState(false);
   const { selectProfile, verifyProfilePin, logout } = useAuth();
   const navigate = useNavigate();
   const [searchParams] = useSearchParams();
@@ -44,7 +68,7 @@ export default function Profiles() {
 
   function handleSelect(profile: Profile) {
     if (profile.has_pin) {
-      setPinProfile(profile);
+      setPinRequest({ profile, purpose: "select" });
       return;
     }
 
@@ -52,6 +76,66 @@ export default function Profiles() {
     enterApp();
   }
 
+  // Adding and managing profiles verify the household's primary profile
+  // first, as the apps do: its PIN when it has one. The server decides
+  // whether the account may manage profiles at all.
+  function startManaging(purpose: ManagePurpose) {
+    const primary = profiles.find((profile) => profile.is_primary);
+    if (!primary) {
+      toast.error("Couldn't find the primary profile needed to manage profiles.");
+      return;
+    }
+    if (primary.has_pin) {
+      setPinRequest({ profile: primary, purpose });
+      return;
+    }
+    void continueManaging(purpose, primary, null);
+  }
+
+  async function continueManaging(
+    purpose: ManagePurpose,
+    primary: Profile,
+    profileToken: string | null,
+  ) {
+    if (purpose === "manage") {
+      selectProfile(primary, profileToken ?? undefined);
+      navigate("/settings/profiles");
+      return;
+    }
+
+    // The new profile is created as the primary profile without selecting
+    // it, so the browser's profile stays as it was and the person still
+    // picks who's watching. The editor lists the primary's libraries, not
+    // those of a profile this browser may still remember.
+    const profileContext = captureProfileRequestContextAs(primary.id, profileToken);
+    if (!profileContext) {
+      toast.error("Your session ended. Sign in again.");
+      return;
+    }
+    setPreparingAdd(true);
+    try {
+      const libraries = await listUserLibraries({ profileContext });
+      setAddSession({ profileContext, libraries });
+    } catch (err) {
+      if (!(err instanceof StaleApiRequestContextError)) {
+        toast.error("Couldn't open the new profile form. Try again.");
+      }
+    } finally {
+      setPreparingAdd(false);
+    }
+  }
+
+  function handlePinVerified(profile: Profile, profileToken: string) {
+    const purpose = pinRequest?.purpose ?? "select";
+    setPinRequest(null);
+    if (purpose === "select") {
+      selectProfile(profile, profileToken);
+      enterApp();
+      return;
+    }
+    void continueManaging(purpose, profile, profileToken);
+  }
+
   async function handleCreateSuccess(
     profile: Profile,
     context: {
@@ -150,6 +234,7 @@ export default function Profiles() {
           <div key={profile.id} className="group relative">
             <button
               onClick={() => handleSelect(profile)}
+              disabled={preparingAdd}
               aria-label={profile.has_pin ? `${profile.name} (PIN protected)` : profile.name}
               className="surface-panel hover:border-primary flex w-[148px] flex-col items-center gap-3 rounded-[1.75rem] p-5 transition-all duration-150 hover:-translate-y-1"
             >
@@ -170,23 +255,56 @@ export default function Profiles() {
             </button>
           </div>
         ))}
+        <button
+          type="button"
+          onClick={() => startManaging("add")}
+          disabled={preparingAdd}
+          className="group border-border hover:border-primary text-muted-foreground hover:text-foreground flex w-[148px] flex-col items-center gap-3 rounded-[1.75rem] border-2 border-dashed p-5 transition-all duration-150 hover:-translate-y-1 disabled:pointer-events-none disabled:opacity-60"
+        >
+          <span className="border-border group-hover:border-primary/40 flex h-20 w-20 items-center justify-center rounded-full border-2 transition-colors">
+            <Plus className="h-8 w-8" aria-hidden="true" />
+          </span>
+          <span className="text-sm font-medium">Add profile</span>
+        </button>
       </div>
 
-      <Button variant="outline" size="sm" onClick={logout} className="relative z-10 mt-2">
-        <LogOut />
-        Sign out
-      </Button>
+      <div className="relative z-10 mt-2 flex flex-wrap justify-center gap-3">
+        <Button
+          variant="outline"
+          size="sm"
+          onClick={() => startManaging("manage")}
+          disabled={preparingAdd}
+        >
+          <UserCog className="h-4 w-4" />
+          Manage profiles
+        </Button>
+        <Button variant="outline" size="sm" onClick={logout}>
+          <LogOut />
+          Sign out
+        </Button>
+      </div>
 
       <ProfilePinDialog
-        profile={pinProfile}
-        onClose={() => setPinProfile(null)}
-        onVerified={(profile, token) => {
-          setPinProfile(null);
-          selectProfile(profile, token);
-          enterApp();
-        }}
+        profile={pinRequest?.profile ?? null}
+        description={pinRequest ? PIN_PURPOSE_DESCRIPTIONS[pinRequest.purpose] : undefined}
+        onClose={() => setPinRequest(null)}
+        onVerified={handlePinVerified}
         verifyPin={verifyProfilePin}
       />
+
+      <ProfileEditorDialog
+        open={addSession !== null}
+        libraries={addSession?.libraries ?? []}
+        avatarUploadEnabled={avatarUploadEnabled}
+        advisoryAgeSupported={maxAdvisoryAgeSupported}
+        requireAdvisoryAgeSupported={requireAdvisoryAgeSupported}
+        profileContext={addSession?.profileContext}
+        onOpenChange={(open) => {
+          if (!open) {
+            setAddSession(null);
+          }
+        }}
+      />
     </div>
   );
 }
diff --git a/web/src/pages/Recommendations.test.tsx b/web/src/pages/Recommendations.test.tsx
index f58d2a7bfb..086133eae0 100644
--- a/web/src/pages/Recommendations.test.tsx
+++ b/web/src/pages/Recommendations.test.tsx
@@ -75,6 +75,78 @@ describe("Recommendations", () => {
       isError: false,
     });
   });
+
+  it("shows the taste genres without a signal count", () => {
+    mockUseDiscover.mockReturnValue({ data: { rows: [] }, isLoading: false, isError: false });
+
+    const markup = renderPage();
+
+    // The count summed raw signal rows, so a series binger read "300+ signals".
+    expect(markup).toContain("Your Taste Profile");
+    expect(markup).toContain("Drama");
+    expect(markup).not.toMatch(/\d+ signals?/);
+  });
+
+  it("renders a neutral empty state when discover returns no rows", () => {
+    mockUseDiscover.mockReturnValue({
+      data: { rows: [] },
+      isLoading: false,
+      isError: false,
+    });
+
+    const markup = renderPage();
+
+    // Discover always carries the default rows, so no rows means nothing in
+    // the viewer's libraries, not too little history.
+    expect(markup).toContain("Nothing to show yet");
+    expect(markup).not.toContain("Watch and rate more");
+    expect(markup).not.toContain("Personalized picks");
+  });
+
+  it("renders the default rows for a profile with no history", () => {
+    mockUseTasteProfile.mockReturnValue({
+      data: { top_genres: [], favorite_directors: [], signal_counts: {} },
+      isLoading: false,
+    });
+    mockUseDiscover.mockReturnValue({
+      data: {
+        rows: [
+          {
+            type: "top_rated",
+            label: "Highly Rated in Your Library",
+            section_kind: "top-rated",
+            items: [
+              { content_id: "item-1", title: "Movie A", type: "movie", year: 2024, genres: [] },
+            ],
+          },
+          {
+            type: "recently_added",
+            label: "Recently Added",
+            section_kind: "recently-added",
+            items: [
+              { content_id: "item-2", title: "Series B", type: "series", year: 2023, genres: [] },
+            ],
+          },
+        ],
+      },
+      isLoading: false,
+      isError: false,
+    });
+
+    const markup = renderPage();
+
+    expect(markup).toContain('data-title="Highly Rated in Your Library"');
+    expect(markup).toContain('data-title="Recently Added"');
+    expect(markup).toContain("Movie A");
+    expect(markup).toContain("Series B");
+    expect(markup).toContain('data-href="/recommendations/section/top-rated"');
+    expect(markup).toContain('data-href="/recommendations/section/recently-added"');
+    expect(markup).not.toContain("Nothing to show yet");
+    // Not personal yet, so the page does not claim to come from its history.
+    expect(markup).not.toContain("based on your viewing history");
+    expect(markup).toContain("Watch and rate titles to personalize this page.");
+  });
+
   it("renders carousel rows with enriched items", () => {
     mockUseDiscover.mockReturnValue({
       data: {
@@ -95,7 +167,7 @@ describe("Recommendations", () => {
           },
           {
             type: "genre_sampler",
-            label: "Popular in Action",
+            label: "Top Action",
             section_kind: "genre",
             section_key: "Sci Fi & Action",
             items: [
@@ -124,7 +196,7 @@ describe("Recommendations", () => {
     const markup = renderPage();
 
     expect(markup).toContain("For You");
-    expect(markup).toContain("Popular in Action");
+    expect(markup).toContain("Top Action");
     expect(markup).toContain("Movie A");
     expect(markup).toContain("Movie B");
     expect(markup).toContain('data-title="Custom row" data-href=""');
diff --git a/web/src/pages/Recommendations.tsx b/web/src/pages/Recommendations.tsx
index bba92e7190..3e3a3f8f50 100644
--- a/web/src/pages/Recommendations.tsx
+++ b/web/src/pages/Recommendations.tsx
@@ -9,6 +9,19 @@ import { Sparkles, RefreshCw } from "lucide-react";
 import { useUICustomization } from "@/hooks/useUICustomization";
 import { carouselCardWidthClasses } from "@/lib/uiCustomization";
 
+/** Rows built from the profile's own history; the others are shared rows. */
+const PERSONAL_ROW_TYPES = new Set(["cluster", "similar_users_liked"]);
+
+/**
+ * The page's subtitle. A profile with no personal row yet sees the default
+ * rows, so it is not told they come from its history.
+ */
+function pageSubtitle(rows: DiscoverRow[]): string {
+  return rows.some((row) => PERSONAL_ROW_TYPES.has(row.type))
+    ? "Personalized picks based on your viewing history and ratings."
+    : "Highly rated and recently added titles from your library. Watch and rate titles to personalize this page.";
+}
+
 function buildSectionHref(row: DiscoverRow): string | undefined {
   if (!row.section_kind) return undefined;
   const base = `/recommendations/section/${encodeURIComponent(row.section_kind)}`;
@@ -23,7 +36,6 @@ function TasteProfileCard({
     | {
         top_genres: string[];
         favorite_directors: string[];
-        signal_counts: Record<string, number>;
       }
     | undefined;
   isLoading: boolean;
@@ -41,18 +53,9 @@ function TasteProfileCard({
     return null;
   }
 
-  const totalSignals = Object.values(profile.signal_counts).reduce((a, b) => a + b, 0);
-
   return (
     <div className="glass-subtle space-y-4 rounded-xl p-5">
-      <div className="flex items-center justify-between">
-        <h2 className="text-base font-semibold">Your Taste Profile</h2>
-        {totalSignals > 0 && (
-          <span className="text-muted-foreground text-xs">
-            {totalSignals} signal{totalSignals !== 1 ? "s" : ""}
-          </span>
-        )}
-      </div>
+      <h2 className="text-base font-semibold">Your Taste Profile</h2>
 
       {profile.top_genres.length > 0 && (
         <div className="space-y-1.5">
@@ -98,9 +101,9 @@ function DiscoverEmptyState() {
     <div className="flex flex-col items-center justify-center gap-3 py-24 text-center">
       <Sparkles className="text-muted-foreground/50 h-10 w-10" />
       <div className="space-y-1">
-        <p className="text-sm font-medium">Not enough data yet</p>
+        <p className="text-sm font-medium">Nothing to show yet</p>
         <p className="text-muted-foreground max-w-sm text-xs">
-          Watch and rate more content to unlock personalized recommendations.
+          Movies and series appear here once your libraries have titles you can watch.
         </p>
       </div>
     </div>
@@ -167,9 +170,9 @@ export default function Recommendations() {
             <h1 className="text-foreground text-2xl font-bold tracking-tight sm:text-3xl">
               For You
             </h1>
-            <p className="text-muted-foreground mt-1 text-sm">
-              Personalized picks based on your viewing history and ratings.
-            </p>
+            {rows.length > 0 && (
+              <p className="text-muted-foreground mt-1 text-sm">{pageSubtitle(rows)}</p>
+            )}
           </div>
           <TasteProfileCard
             profile={tasteProfileQuery.data}
diff --git a/web/src/pages/RecommendationsSection.tsx b/web/src/pages/RecommendationsSection.tsx
index 0cdfbb5efa..73cb0b0233 100644
--- a/web/src/pages/RecommendationsSection.tsx
+++ b/web/src/pages/RecommendationsSection.tsx
@@ -13,11 +13,11 @@ import { cardGridClasses } from "@/lib/uiCustomization";
 const KIND_FALLBACK_LABEL: Record<string, (key?: string) => string> = {
   "for-you-main": () => "For You",
   cluster: (key) => (key ? `Personalized cluster ${key}` : "Personalized cluster"),
-  "similar-users": () => "Users Like You Also Enjoyed",
+  "similar-users": () => "Profiles Like You Enjoyed",
   popular: () => "Popular on This Server",
   "recently-added": () => "Recently Added",
-  "top-rated": () => "Top Rated",
-  genre: (key) => (key ? `Popular in ${key}` : "Genre picks"),
+  "top-rated": () => "Highly Rated in Your Library",
+  genre: (key) => (key ? `Top ${key}` : "Genre picks"),
 };
 
 function fallbackTitle(kind: string, key?: string) {
diff --git a/web/src/pages/SettingsLayout.test.tsx b/web/src/pages/SettingsLayout.test.tsx
index e332d1ec34..da9faf733a 100644
--- a/web/src/pages/SettingsLayout.test.tsx
+++ b/web/src/pages/SettingsLayout.test.tsx
@@ -1,4 +1,4 @@
-import { fireEvent, render, screen } from "@testing-library/react";
+import { fireEvent, render, screen, within } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import { renderToStaticMarkup } from "react-dom/server";
 import { MemoryRouter, Route, Routes } from "react-router";
@@ -22,8 +22,40 @@ vi.mock("@/hooks/useCurrentProfile", () => ({
   useCurrentProfile: () => ({ profile: mocks.useAuth()?.profile ?? null }),
 }));
 
+import UserSettingsSidebar from "@/components/settings/UserSettingsSidebar";
+
 import SettingsLayout from "./SettingsLayout";
 
+// The settings route as the app mounts it: `Layout` renders the settings
+// sidebar in the app sidebar's place, beside the routed settings page.
+function SettingsShell() {
+  return (
+    <>
+      <UserSettingsSidebar backTo="/movies" />
+      <SettingsLayout />
+    </>
+  );
+}
+
+function renderSettings(path: string) {
+  return render(
+    <MemoryRouter initialEntries={[path]}>
+      <Routes>
+        <Route path="/settings/*" element={<SettingsShell />}>
+          <Route path="*" element={<div data-testid="settings-page" />} />
+        </Route>
+      </Routes>
+    </MemoryRouter>,
+  );
+}
+
+function stubDesktop(matches: boolean) {
+  vi.stubGlobal(
+    "matchMedia",
+    vi.fn(() => ({ matches, addEventListener: vi.fn(), removeEventListener: vi.fn() })),
+  );
+}
+
 describe("SettingsLayout", () => {
   beforeEach(() => {
     mocks.useAuth.mockReset();
@@ -52,14 +84,14 @@ describe("SettingsLayout", () => {
     expect(renderIndex()).not.toContain('href="/settings/requests"');
   });
 
-  it("places Quick Connect early in the settings nav", () => {
+  it("places Quick Connect in the Connections group, ahead of Notifications", () => {
     const markup = renderToStaticMarkup(
       <MemoryRouter initialEntries={["/settings/playback"]}>
-        <SettingsLayout />
+        <SettingsShell />
       </MemoryRouter>,
     );
 
-    const accountHeading = markup.indexOf('id="settings-nav-account"');
+    const accountHeading = markup.indexOf('id="settings-nav-connections"');
     const quickConnectHref = markup.indexOf("/settings/quick-connect");
     const notificationsHref = markup.indexOf("/settings/notifications");
 
@@ -77,7 +109,7 @@ describe("SettingsLayout", () => {
 
     const markup = renderToStaticMarkup(
       <MemoryRouter initialEntries={["/settings/playback"]}>
-        <SettingsLayout />
+        <SettingsShell />
       </MemoryRouter>,
     );
 
@@ -95,7 +127,7 @@ describe("SettingsLayout", () => {
 
     const markup = renderToStaticMarkup(
       <MemoryRouter initialEntries={["/settings/profiles"]}>
-        <SettingsLayout />
+        <SettingsShell />
       </MemoryRouter>,
     );
 
@@ -106,11 +138,7 @@ describe("SettingsLayout", () => {
   });
 
   it("filters personal settings sections from the search box", async () => {
-    render(
-      <MemoryRouter initialEntries={["/settings/playback"]}>
-        <SettingsLayout />
-      </MemoryRouter>,
-    );
+    renderSettings("/settings/playback");
 
     await userEvent.type(screen.getByRole("searchbox", { name: "Search settings" }), "pin");
 
@@ -125,11 +153,7 @@ describe("SettingsLayout", () => {
   });
 
   it("finds Home Screen when searching for home rows", async () => {
-    render(
-      <MemoryRouter initialEntries={["/settings/playback"]}>
-        <SettingsLayout />
-      </MemoryRouter>,
-    );
+    renderSettings("/settings/playback");
 
     await userEvent.type(screen.getByRole("searchbox", { name: "Search settings" }), "home rows");
 
@@ -139,11 +163,7 @@ describe("SettingsLayout", () => {
   it.each(["hide watched items", "export layout", "import layout", "reset home"])(
     "finds Home Screen when searching for %s",
     async (query) => {
-      render(
-        <MemoryRouter initialEntries={["/settings/playback"]}>
-          <SettingsLayout />
-        </MemoryRouter>,
-      );
+      renderSettings("/settings/playback");
 
       await userEvent.type(screen.getByRole("searchbox", { name: "Search settings" }), query);
 
@@ -179,17 +199,9 @@ describe("SettingsLayout", () => {
     expect(searchBox).toHaveFocus();
   });
 
-  it("does not consume Cmd+K when the detail search is hidden", () => {
-    vi.stubGlobal(
-      "matchMedia",
-      vi.fn(() => ({ matches: false })),
-    );
-
-    render(
-      <MemoryRouter initialEntries={["/settings/playback"]}>
-        <SettingsLayout />
-      </MemoryRouter>,
-    );
+  it("does not consume Cmd+K while the settings sidebar is hidden", () => {
+    stubDesktop(false);
+    renderSettings("/settings/playback");
 
     const event = new KeyboardEvent("keydown", {
       key: "k",
@@ -200,27 +212,33 @@ describe("SettingsLayout", () => {
     expect(document.dispatchEvent(event)).toBe(true);
     expect(event.defaultPrevented).toBe(false);
   });
-  // jsdom can't measure layout; the real check is a 390px browser walk. The
-  // app shell, the page shell and this pane each pad a phone by 16px, which
-  // leaves Home Screen's rows too narrow to read their titles.
-  it("lets Home Screen use the pane's full width on a phone", () => {
-    function paneAt(path: string) {
-      const view = render(
-        <MemoryRouter initialEntries={[`/settings/${path}`]}>
-          <Routes>
-            <Route path="/settings/*" element={<SettingsLayout />}>
-              <Route path="*" element={<div data-testid="settings-page" />} />
-            </Route>
-          </Routes>
-        </MemoryRouter>,
-      );
-      const pane = screen.getByTestId("settings-page").parentElement?.parentElement;
-      const classes = pane?.className ?? "";
-      view.unmount();
-      return classes;
-    }
-
-    expect(paneAt("home-screen")).toContain("max-sm:px-0");
-    expect(paneAt("playback")).not.toContain("max-sm:px-0");
+  it("opens the first settings page at the root on desktop", () => {
+    stubDesktop(true);
+    renderSettings("/settings");
+
+    expect(screen.getByTestId("settings-page")).toBeInTheDocument();
+    const sidebar = screen.getByRole("navigation", { name: "Settings" });
+    expect(within(sidebar).getByRole("link", { name: "Playback" })).toHaveAttribute(
+      "aria-current",
+      "page",
+    );
+  });
+
+  it("lists every settings page at the root on a phone", () => {
+    stubDesktop(false);
+    renderSettings("/settings");
+
+    const index = screen.getByRole("navigation", { name: "Settings pages" });
+    expect(within(index).getByRole("link", { name: /^Playback/ })).toHaveAttribute(
+      "href",
+      "/settings/playback",
+    );
+    expect(screen.queryByTestId("settings-page")).not.toBeInTheDocument();
+  });
+
+  it("leads back to the page settings were opened from", () => {
+    renderSettings("/settings/playback");
+
+    expect(screen.getByRole("link", { name: "Back to App" })).toHaveAttribute("href", "/movies");
   });
 });
diff --git a/web/src/pages/SettingsLayout.tsx b/web/src/pages/SettingsLayout.tsx
index 5028b12b5a..482062d6a3 100644
--- a/web/src/pages/SettingsLayout.tsx
+++ b/web/src/pages/SettingsLayout.tsx
@@ -1,718 +1,110 @@
 import { useMemo, useState } from "react";
-import { Link, Outlet, useLocation } from "react-router";
-import {
-  ChevronLeft,
-  ChevronRight,
-  Play,
-  Library,
-  Cast,
-  Clock,
-  Cloud,
-  Subtitles,
-  LayoutDashboard,
-  Eye,
-  Layers,
-  Users,
-  Server,
-  Sparkles,
-  Bell,
-  MonitorSmartphone,
-  PanelTop,
-  KeyRound,
-  Bookmark,
-} from "lucide-react";
-// Sparkles is used by the Personalization nav entry below.
-import type { LucideIcon } from "lucide-react";
+import { Link, Navigate, Outlet, useLocation } from "react-router";
+import { ChevronLeft } from "lucide-react";
+
+import { PageColumn, PageFrame, PageHeader } from "@/components/page/PageHeader";
 import PageBack from "@/components/PageBack";
-import { SideNavItem, SideNavSection } from "@/components/SideNav";
-import { SettingsOverviewNav } from "@/components/settings/SettingsOverviewNav";
+import { CurrentProfileLink } from "@/components/settings/CurrentProfileLink";
+import { SettingsIndexList } from "@/components/settings/SettingsIndexList";
 import { SettingsSearchInput } from "@/components/settings/SettingsSearchInput";
-import { Avatar, AvatarFallback, AvatarImage } from "@/components/ui/avatar";
-import { useRequestFeatureStatus } from "@/hooks/queries/useRequests";
-import { useDocumentTitle } from "@/hooks/useDocumentTitle";
-import { useCurrentProfile } from "@/hooks/useCurrentProfile";
-import { useIsActingAdmin } from "@/hooks/useIsActingAdmin";
-import { resolveSettingsDocumentTitle } from "@/lib/documentTitle";
 import {
   countSettingsSearchItems,
   filterSettingsSearchGroups,
 } from "@/components/settings/settingsSearch";
-import { cn } from "@/lib/utils";
-
-interface NavItem {
-  path: string;
-  label: string;
-  icon: LucideIcon;
-  description: string;
-  keywords?: readonly string[];
-  settings?: readonly {
-    label: string;
-    description?: string;
-    keywords?: readonly string[];
-  }[];
-  primaryOrAdmin?: boolean;
-  /** Listed only while the server has requests turned on. */
-  requiresRequests?: boolean;
-}
-
-interface NavSection {
-  label: string;
-  items: NavItem[];
-}
+import { useDocumentTitle } from "@/hooks/useDocumentTitle";
+import { useMediaQuery } from "@/hooks/useMediaQuery";
+import { useUserSettingsGroups } from "@/hooks/useUserSettingsGroups";
+import { resolveSettingsDocumentTitle } from "@/lib/documentTitle";
+import { userSettingsHref, type UserSettingsNavGroup } from "@/lib/userSettingsNav";
 
-const settingIndex = (...labels: string[]) => labels.map((label) => ({ label }));
+/** Where `Layout` swaps the app sidebar for the settings sidebar. */
+const DESKTOP_MEDIA_QUERY = "(min-width: 64rem)";
 
 /**
  * Settings pages that manage their own multi-column layout, so the shell's
  * reading-width cap would squeeze them instead of helping.
  */
 const WIDE_SETTINGS_PAGES = new Set(["devices"]);
-// On a phone the app shell and the page shell already pad the page, so these
-// pages drop the pane's own side padding to keep their rows readable.
-const FLUSH_ON_PHONE_SETTINGS_PAGES = new Set(["home-screen"]);
 
 /**
- * Grouped by the question a person arrives with, not by which service stores
- * the value: "how does it play", "how does it look", "what do I see", "what is
- * it wired to", "who am I". Devices sits under Playback because every setting
- * on that screen is a playback override, and Personalize sits with Home Screen
- * because both shape what the app puts in front of you.
+ * Personal settings. On desktop the settings sidebar (mounted by `Layout` in
+ * place of the app sidebar) is the navigation, so the root opens the first
+ * page. On a phone the root is the list of pages and each page links back to
+ * it.
  */
-const NAV_SECTIONS: NavSection[] = [
-  {
-    label: "Playback",
-    items: [
-      {
-        path: "playback",
-        label: "Playback",
-        icon: Play,
-        description: "Quality, languages, skipping, and what plays next.",
-        keywords: [
-          "video quality",
-          "bitrate",
-          "bandwidth",
-          "spoken language",
-          "metadata language",
-          "auto skip",
-          "auto play",
-          "next up",
-          "preview",
-          "rewind",
-          "fast forward",
-          "fast-forward",
-          "skip",
-          "seek",
-          "seek controls",
-          "skip interval",
-          "audiobook skip",
-        ],
-        settings: settingIndex(
-          "Preferred quality",
-          "Maximum bitrate",
-          "Spoken language",
-          "Metadata language",
-          "Skip intros",
-          "Auto-skip credits",
-          "Auto-skip recaps",
-          "Start next at preview",
-          "Auto-play next episode",
-          "Next up episodes",
-          "Seek controls",
-          "Rewind interval",
-          "Fast-forward interval",
-          "Use this browser's audiobook intervals",
-        ),
-      },
-      {
-        path: "subtitle-appearance",
-        label: "Subtitles",
-        icon: Subtitles,
-        description: "Subtitle language, when they appear, and how they look.",
-        keywords: [
-          "subtitle language",
-          "forced subtitles",
-          "captions",
-          "font size",
-          "font color",
-          "background",
-          "position",
-        ],
-        settings: settingIndex(
-          "Subtitle language",
-          "Subtitle behavior",
-          "Show forced subtitles",
-          "Preview",
-          "Font size",
-          "Font family",
-          "Font color",
-          "Text outline",
-          "Outline color",
-          "Background style",
-          "Background opacity",
-          "Background color",
-          "Subtitle position",
-        ),
-      },
-      {
-        path: "devices",
-        label: "Your Devices",
-        icon: MonitorSmartphone,
-        description: "Per-device quality, HDR, sync, and the profile this browser opens.",
-        keywords: [
-          "devices",
-          "tv",
-          "phone",
-          "tablet",
-          "browser",
-          "this device",
-          "forget device",
-          "hdr",
-          "dolby vision",
-          "sound delay",
-          "lip sync",
-          "who's watching",
-          "profile picker",
-          "remember profile",
-          "launch",
-        ],
-        settings: settingIndex(
-          "Profile at launch",
-          "Remember last profile",
-          "Ask who's watching",
-          "Preferred quality",
-          "Maximum bitrate",
-          "HDR",
-          "Dolby Vision",
-          "Play Dolby Vision films as HDR10",
-          "Match content frame rate",
-          "How video fills the screen",
-          "Audio sync offset",
-          "Subtitle sync offset",
-          "Forget this device",
-        ),
-      },
-    ],
-  },
-  {
-    label: "Appearance",
-    items: [
-      {
-        path: "interface",
-        label: "Navigation & Cards",
-        icon: PanelTop,
-        description: "Your primary menu, poster size, card captions, and title art.",
-        keywords: [
-          "navigation",
-          "menu",
-          "pin library",
-          "poster size",
-          "card size",
-          "hide title",
-          "hide year",
-          "artwork only",
-          "preset",
-          "title art",
-          "logo",
-          "clearlogo",
-        ],
-        settings: settingIndex(
-          "Card preset",
-          "Poster size",
-          "Caption",
-          "Title & metadata",
-          "Title only",
-          "Artwork only",
-          "Title pages",
-          "Show title art",
-          "Apply to all devices",
-          "Primary menu",
-          "Choose destination or shortcut",
-          "Add to menu",
-          "Reset to default",
-        ),
-      },
-      {
-        path: "card-overlays",
-        label: "Card Overlays",
-        icon: Layers,
-        description: "Badges drawn on poster cards, and where they sit.",
-        keywords: ["poster", "badges", "overlay", "accent color", "preset"],
-        settings: settingIndex(
-          "Preview",
-          "Preset",
-          "Accent color",
-          "Show icon",
-          "Position",
-          "How styling works",
-        ),
-      },
-      {
-        path: "accessibility",
-        label: "Accessibility",
-        icon: Eye,
-        description: "Text size, weight, contrast, and date and time formats.",
-        keywords: [
-          "contrast",
-          "readability",
-          "motion",
-          "transparency",
-          "text",
-          "date format",
-          "time format",
-          "clock",
-          "24-hour",
-          "12-hour",
-        ],
-        settings: settingIndex(
-          "Text size",
-          "Text weight",
-          "Contrast",
-          "High Contrast",
-          "Preview",
-          "Date & time",
-          "Date format",
-          "Time format",
-        ),
-      },
-    ],
-  },
-  {
-    label: "Home & Discovery",
-    items: [
-      {
-        path: "home-screen",
-        label: "Home Screen",
-        icon: LayoutDashboard,
-        description: "Which rows appear on Home, and in what order.",
-        keywords: [
-          "home rows",
-          "sections",
-          "rows",
-          "continue watching",
-          "next up",
-          "library order",
-        ],
-        settings: settingIndex(
-          "Home rows",
-          "Hide watched items",
-          "Export layout",
-          "Import layout",
-          "Reset Home",
-          "Continue Watching",
-          "Next Up",
-          "Recently Added",
-          "Library order",
-        ),
-      },
-      {
-        path: "personalize",
-        label: "Personalize",
-        icon: Sparkles,
-        description: "Re-tune the taste profile behind your recommendations.",
-        keywords: ["taste profile", "recommendations", "ratings", "likes", "dislikes"],
-        settings: settingIndex("Refine your taste profile", "Taste profile", "Recommendations"),
-      },
-      {
-        path: "requests",
-        label: "Requests",
-        icon: Bookmark,
-        description: "Whether adding to your watchlist also requests the title.",
-        keywords: ["watchlist", "request", "discover", "auto request"],
-        settings: settingIndex("Request titles I add to my watchlist"),
-        requiresRequests: true,
-      },
-      {
-        path: "libraries",
-        label: "Libraries",
-        icon: Library,
-        description: "Which libraries you see, their order, and per-library audio.",
-        keywords: [
-          "library visibility",
-          "access",
-          "disabled libraries",
-          "library order",
-          "playback preferences",
-        ],
-        settings: settingIndex(
-          "Remember library pages",
-          "Library visibility",
-          "Library order",
-          "Spoken language",
-          "Subtitle language",
-          "Subtitle behavior",
-          "Forced subtitles",
-          "Playback preferences",
-        ),
-      },
-    ],
-  },
-  {
-    label: "Connections",
-    items: [
-      {
-        path: "connect-apps",
-        label: "Connect Apps",
-        icon: Cast,
-        description: "Sign-in details for Prairie and Jellyfin-compatible apps.",
-        keywords: [
-          "jellyfin",
-          "infuse",
-          "swiftfin",
-          "jellycon",
-          "findroid",
-          "compatibility",
-          "sign in",
-          "login",
-          "server address",
-          "username",
-          "pin",
-        ],
-        settings: settingIndex(
-          "Prairie app or website",
-          "Jellyfin-compatible app",
-          "Server",
-          "Username",
-          "Password",
-          "Which profile are you signing in as?",
-          "A Jellyfin app says my username or password is wrong",
-          "Every profile at a glance",
-        ),
-      },
-      {
-        path: "watch-providers",
-        label: "Watch Providers",
-        icon: Cloud,
-        description: "Trakt watch history, favorites, and scrobbling.",
-        keywords: ["trakt", "import", "export", "scrobble", "favorites", "watch history"],
-        settings: settingIndex(
-          "Last imported",
-          "Last exported",
-          "Watched",
-          "Progress",
-          "Favorites",
-          "Exported",
-          "Import watched history",
-          "Import paused progress",
-          "Send watched changes",
-          "Send unwatched changes",
-          "Sync favorites",
-          "Sync favorite removals",
-          "Scrobble playback",
-        ),
-      },
-      {
-        path: "webhook-sync",
-        label: "Webhook Sync",
-        icon: Server,
-        description: "Take progress from Plex, Emby, and Jellyfin webhooks.",
-        keywords: ["plex", "emby", "jellyfin", "webhook", "progress", "watched"],
-        settings: settingIndex(
-          "Add a connection",
-          "Connected servers",
-          "Recent deliveries",
-          "Plex",
-          "Emby",
-          "Jellyfin",
-          "Server URL",
-          "Token",
-        ),
-      },
-      {
-        path: "history-import",
-        label: "History Import",
-        icon: Clock,
-        description: "Bring an existing Emby watch history into Prairie.",
-        keywords: ["emby", "watched history", "import", "mapping", "sync"],
-        settings: settingIndex(
-          "New import",
-          "Import history",
-          "Fetched",
-          "Matched",
-          "Unmatched",
-          "Progress",
-          "History",
-          "Skipped",
-        ),
-      },
-    ],
-  },
-  {
-    label: "Account",
-    items: [
-      {
-        path: "sessions",
-        label: "Signed-in sessions",
-        icon: MonitorSmartphone,
-        description: "See active sign-ins and sign out a browser or app.",
-        primaryOrAdmin: true,
-        keywords: [
-          "sessions",
-          "active",
-          "client",
-          "device",
-          "last seen",
-          "sign out",
-          "revoke",
-          "security",
-        ],
-      },
-      {
-        path: "account",
-        label: "Account",
-        icon: KeyRound,
-        description: "Change the password shared by every household profile.",
-        keywords: ["password", "credential", "sign in", "security", "account"],
-        settings: settingIndex("Current password", "New password", "Confirm new password"),
-        primaryOrAdmin: true,
-      },
-      {
-        path: "quick-connect",
-        label: "Quick Connect",
-        icon: MonitorSmartphone,
-        description: "Approve sign-in on another device",
-        keywords: [
-          "quick connect",
-          "pair device",
-          "device login",
-          "tv login",
-          "roku",
-          "smart tv",
-          "approve",
-          "code",
-          "qr",
-        ],
-        settings: settingIndex(
-          "Enter device code",
-          "Approve sign-in",
-          "Match code",
-          "How it works",
-        ),
-      },
-      {
-        path: "profiles",
-        label: "Profiles",
-        icon: Users,
-        description: "Household profile names, PINs, and library access.",
-        keywords: ["profile name", "pin", "access", "primary profile", "household"],
-        settings: settingIndex(
-          "Profile name",
-          "PIN",
-          "Library access",
-          "Create profile",
-          "Delete profile",
-          "Primary profile",
-        ),
-        primaryOrAdmin: true,
-      },
-      {
-        path: "notifications",
-        label: "Notifications",
-        icon: Bell,
-        description: "New-episode alerts by email, Discord, push, or webhook.",
-        keywords: ["new episodes", "email", "discord", "browser push", "webhooks"],
-        settings: settingIndex(
-          "New Episode Notifications",
-          "Email Notifications",
-          "Discord Notifications",
-          "Browser Notifications",
-          "Webhooks",
-          "Per-episode alerts",
-          "Digest",
-          "Webhook URL",
-        ),
-      },
-    ],
-  },
-];
+export default function SettingsLayout() {
+  const location = useLocation();
+  const groups = useUserSettingsGroups();
+  const isDesktop = useMediaQuery(DESKTOP_MEDIA_QUERY);
+  const activeSegment = location.pathname.split("/")[2] || null;
 
-interface SettingsOverviewProps {
-  sections: readonly { label: string; items: readonly NavItem[] }[];
-  profile: { name: string; avatar_url?: string } | null;
-}
+  useDocumentTitle(resolveSettingsDocumentTitle(location.pathname));
 
-/**
- * The index is the same directory the admin settings index uses: category jump
- * links, then one uniform card grid per group across the full page width.
- *
- * The two-column list it replaced paired groups side by side, so a short group
- * next to a long one left a column of dead space taller than the short group
- * itself — the exact shape of the desktop complaint.
- */
-function SettingsOverview({ sections, profile }: SettingsOverviewProps) {
-  const profileName = profile?.name ?? "Your profile";
+  if (!activeSegment) {
+    const firstPage = groups[0]?.items[0];
+    if (isDesktop && firstPage) {
+      return <Navigate to={userSettingsHref(firstPage.path)} replace />;
+    }
+    return <SettingsIndex groups={groups} />;
+  }
+
+  const wideSetting = WIDE_SETTINGS_PAGES.has(activeSegment);
 
   return (
-    <div className="w-full space-y-6">
+    <div className="lg:pt-8">
       <Link
-        to="/profiles"
-        aria-label={`Current profile: ${profileName}`}
-        className="surface-panel-subtle hover:bg-surface-hover/70 focus-visible:ring-ring flex min-h-16 items-center gap-3 rounded-2xl px-4 py-3 transition-colors focus-visible:ring-2 focus-visible:outline-none sm:max-w-md"
+        to="/settings"
+        className="text-muted-foreground hover:text-foreground focus-visible:ring-ring mb-5 inline-flex w-fit items-center gap-1.5 rounded-lg pr-2 text-sm font-medium transition-colors focus-visible:ring-2 focus-visible:outline-none lg:hidden"
       >
-        <Avatar className="border-border h-10 w-10 border">
-          {profile?.avatar_url ? <AvatarImage src={profile.avatar_url} alt="" /> : null}
-          <AvatarFallback className="bg-accent text-foreground font-semibold">
-            {profileName.charAt(0).toUpperCase()}
-          </AvatarFallback>
-        </Avatar>
-        <div className="min-w-0 flex-1">
-          <p className="text-muted-foreground text-xs">Current profile</p>
-          <p className="truncate text-sm font-semibold">{profileName}</p>
-        </div>
-        <ChevronRight className="text-muted-foreground h-4 w-4 shrink-0" aria-hidden="true" />
+        <ChevronLeft className="h-4 w-4" aria-hidden="true" />
+        All settings
       </Link>
+      <PageFrame>
+        <PageColumn width={wideSetting ? "full" : "settings"}>
+          <Outlet />
+        </PageColumn>
+      </PageFrame>
+    </div>
+  );
+}
+
+function SettingsIndex({ groups }: { groups: readonly UserSettingsNavGroup[] }) {
+  const [search, setSearch] = useState("");
+  const filteredGroups = useMemo(
+    () => filterSettingsSearchGroups(groups, search),
+    [groups, search],
+  );
 
-      <SettingsOverviewNav
-        groups={sections.map((section) => ({
-          ...section,
-          items: section.items.map((item) => ({
+  return (
+    <div className="mx-auto w-full max-w-3xl space-y-6">
+      <PageBack to="/" up floating />
+      {/* The top margin clears the floating back button above it. */}
+      <PageHeader
+        className="mt-10 sm:mt-12"
+        title="Settings"
+        subtitle="Make Prairie work the way you like."
+      />
+      <CurrentProfileLink className="surface-panel-subtle min-h-14 rounded-2xl px-4 py-3" />
+      <SettingsSearchInput
+        value={search}
+        onChange={setSearch}
+        resultCount={countSettingsSearchItems(filteredGroups)}
+        showShortcutHint
+      />
+      <SettingsIndexList
+        groups={filteredGroups.map((group) => ({
+          label: group.label,
+          items: group.items.map((item) => ({
             id: item.path,
             label: item.label,
             description: item.description,
             icon: item.icon,
-            href: `/settings/${item.path}`,
+            href: userSettingsHref(item.path),
           })),
         }))}
-        ariaLabel="Settings sections"
+        ariaLabel="Settings pages"
         idPrefix="settings-index"
-        variant="directory"
       />
     </div>
   );
 }
-
-export default function SettingsLayout() {
-  const location = useLocation();
-  const [settingsSearch, setSettingsSearch] = useState("");
-  const { profile } = useCurrentProfile();
-  const actingAdmin = useIsActingAdmin();
-  const segments = location.pathname.split("/");
-  const activeSegment = segments[2] || null;
-  const canManageProfiles = actingAdmin || profile?.is_primary === true;
-  const requestsEnabled = useRequestFeatureStatus().data?.requests_enabled === true;
-  // Most settings pages are a single column of rows and read best measured.
-  // A page that is itself two panes needs the room, so it opts out.
-  const wideSetting = activeSegment ? WIDE_SETTINGS_PAGES.has(activeSegment) : false;
-  const flushOnPhone = activeSegment ? FLUSH_ON_PHONE_SETTINGS_PAGES.has(activeSegment) : false;
-
-  const visibleSections = useMemo(
-    () =>
-      NAV_SECTIONS.map((section) => ({
-        ...section,
-        items: section.items.filter(
-          (item) =>
-            (!item.primaryOrAdmin || canManageProfiles) &&
-            (!item.requiresRequests || requestsEnabled),
-        ),
-      })).filter((section) => section.items.length > 0),
-    [canManageProfiles, requestsEnabled],
-  );
-
-  const filteredSections = useMemo(
-    () => filterSettingsSearchGroups(visibleSections, settingsSearch),
-    [settingsSearch, visibleSections],
-  );
-  const filteredSettingsCount = countSettingsSearchItems(filteredSections);
-
-  useDocumentTitle(resolveSettingsDocumentTitle(location.pathname));
-
-  return (
-    <div className="min-h-[100dvh]">
-      <main className="page-shell-wide relative flex min-h-[100dvh] flex-col py-4 sm:py-6">
-        {activeSegment ? (
-          <>
-            <div className="hidden lg:block">
-              <PageBack to="/" up floating />
-            </div>
-            <Link
-              to="/settings"
-              className="text-muted-foreground hover:text-foreground focus-visible:ring-ring mt-1 inline-flex w-fit items-center gap-1.5 rounded-lg pr-2 text-sm font-medium transition-colors focus-visible:ring-2 focus-visible:outline-none lg:hidden"
-            >
-              <ChevronLeft className="h-4 w-4" aria-hidden="true" />
-              All settings
-            </Link>
-            <div className="page-header mt-10 hidden gap-5 sm:mt-12 lg:flex">
-              <div className="min-w-0 space-y-3">
-                <h1 className="page-title text-[clamp(2rem,4vw,3rem)]">Settings</h1>
-                <p className="page-subtitle text-sm sm:text-base">
-                  Manage your playback preferences, libraries, and display options.
-                </p>
-              </div>
-              <SettingsSearchInput
-                value={settingsSearch}
-                onChange={setSettingsSearch}
-                resultCount={filteredSettingsCount}
-                className="w-full sm:max-w-sm"
-                shortcutMediaQuery={activeSegment ? "(min-width: 64rem)" : undefined}
-              />
-            </div>
-
-            {/* From lg up, the rail and the active page share one panel, the
-                same shell the admin settings use. Below lg the rail is hidden
-                and the page is already a stack of its own panels, so the extra
-                chrome would only nest a card inside a card — mobile keeps the
-                bare layout.
-
-                Admin scrolls its detail pane inside the panel; here the page
-                scrolls and the rail sticks, because Your Devices owns a
-                viewport-height scroller that a nested one would strand. */}
-            <div className="surface-panel-lg mt-5 flex min-w-0 flex-1 flex-col lg:mt-10 lg:min-h-[500px] lg:flex-row lg:overflow-hidden">
-              <aside className="border-border hidden lg:block lg:w-60 lg:flex-shrink-0 lg:border-r">
-                <nav
-                  aria-label="Settings sections"
-                  className="sticky top-6 space-y-5 py-5 pr-3 pl-5"
-                >
-                  {filteredSections.map((section) => (
-                    <SideNavSection
-                      key={section.label}
-                      label={section.label}
-                      idPrefix="settings-nav"
-                    >
-                      {section.items.map((item) => (
-                        <SideNavItem
-                          key={item.path}
-                          label={item.label}
-                          icon={item.icon}
-                          href={`/settings/${item.path}`}
-                          active={item.path === activeSegment}
-                        />
-                      ))}
-                    </SideNavSection>
-                  ))}
-                  {filteredSections.length === 0 ? (
-                    <p className="text-muted-foreground px-2 text-sm">No matching settings</p>
-                  ) : null}
-                </nav>
-              </aside>
-
-              <div className={cn("min-w-0 flex-1 p-4 sm:p-6", flushOnPhone && "max-sm:px-0")}>
-                <div className={cn("w-full", wideSetting ? "max-w-none" : "max-w-3xl")}>
-                  <Outlet />
-                </div>
-              </div>
-            </div>
-          </>
-        ) : (
-          <>
-            <PageBack to="/" up floating />
-            <div className="page-header mt-10 mb-6 gap-5 sm:mt-12 sm:mb-8">
-              <div className="min-w-0 space-y-3">
-                <h1 className="page-title text-[clamp(2rem,4vw,3rem)]">Settings</h1>
-                <p className="page-subtitle text-sm sm:text-base">
-                  Make Prairie work the way you like.
-                </p>
-              </div>
-              <SettingsSearchInput
-                value={settingsSearch}
-                onChange={setSettingsSearch}
-                resultCount={filteredSettingsCount}
-                className="w-full sm:max-w-sm lg:w-[26rem] lg:max-w-none"
-                showShortcutHint
-              />
-            </div>
-            <SettingsOverview sections={filteredSections} profile={profile} />
-          </>
-        )}
-      </main>
-    </div>
-  );
-}
diff --git a/web/src/pages/TasteSeed.test.tsx b/web/src/pages/TasteSeed.test.tsx
new file mode 100644
index 0000000000..719ee004fd
--- /dev/null
+++ b/web/src/pages/TasteSeed.test.tsx
@@ -0,0 +1,198 @@
+import { fireEvent, render, screen } from "@testing-library/react";
+import { MemoryRouter, Route, Routes } from "react-router";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import type { CatalogCardItem } from "@/api/v2/catalog";
+
+const mocks = vi.hoisted(() => ({
+  fetchNextPage: vi.fn(),
+  useTasteSeedItems: vi.fn(),
+  submit: vi.fn(),
+}));
+
+vi.mock("@/hooks/queries/tasteSeed", () => ({
+  useTasteSeedItems: () => mocks.useTasteSeedItems(),
+  useSubmitTasteSeed: () => ({ isPending: false, mutateAsync: mocks.submit }),
+}));
+
+vi.mock("@/hooks/useAuth", () => ({
+  useAuth: () => ({ profile: { id: "p1" } }),
+}));
+
+vi.mock("@/hooks/useDocumentTitle", () => ({
+  useDocumentTitle: vi.fn(),
+}));
+
+import TasteSeed from "./TasteSeed";
+
+interface PickerState {
+  pages: { items: CatalogCardItem[] }[];
+  hasNextPage: boolean;
+  isFetchingNextPage?: boolean;
+  isFetchNextPageError?: boolean;
+}
+
+function pickerState({
+  pages,
+  hasNextPage,
+  isFetchingNextPage = false,
+  isFetchNextPageError = false,
+}: PickerState) {
+  return {
+    data: { pages },
+    fetchNextPage: mocks.fetchNextPage,
+    hasNextPage,
+    isFetching: isFetchingNextPage,
+    isFetchingNextPage,
+    isFetchNextPageError,
+    isPending: false,
+  };
+}
+
+function card(id: string): CatalogCardItem {
+  return { content_id: id, title: `Title ${id}`, type: "movie" } as CatalogCardItem;
+}
+
+function renderPicker() {
+  return render(
+    <MemoryRouter>
+      <TasteSeed />
+    </MemoryRouter>,
+  );
+}
+
+class NoopObserver {
+  observe() {}
+  disconnect() {}
+}
+
+describe("TasteSeed paging", () => {
+  beforeEach(() => {
+    mocks.fetchNextPage.mockReset();
+    mocks.useTasteSeedItems.mockReset();
+    vi.stubGlobal("IntersectionObserver", NoopObserver);
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  // A restricted profile's first page can hydrate to no visible card while
+  // the catalog has more pages; the picker keeps loading instead of showing
+  // the empty state.
+  it("keeps loading past a page with no visible cards", () => {
+    mocks.useTasteSeedItems.mockReturnValue(
+      pickerState({ pages: [{ items: [] }], hasNextPage: true }),
+    );
+
+    renderPicker();
+
+    expect(mocks.fetchNextPage).toHaveBeenCalledTimes(1);
+    expect(screen.queryByText("No items to show yet")).toBeNull();
+  });
+
+  it("waits while the next page is loading", () => {
+    mocks.useTasteSeedItems.mockReturnValue(
+      pickerState({ pages: [{ items: [] }], hasNextPage: true, isFetchingNextPage: true }),
+    );
+
+    renderPicker();
+
+    expect(mocks.fetchNextPage).not.toHaveBeenCalled();
+    expect(screen.queryByText("No items to show yet")).toBeNull();
+  });
+
+  it("shows the empty state once the catalog runs out", () => {
+    mocks.useTasteSeedItems.mockReturnValue(
+      pickerState({ pages: [{ items: [] }, { items: [] }], hasNextPage: false }),
+    );
+
+    renderPicker();
+
+    expect(mocks.fetchNextPage).not.toHaveBeenCalled();
+    expect(screen.getByText("No items to show yet")).toBeTruthy();
+  });
+
+  it("stops retrying after a failed page", () => {
+    mocks.useTasteSeedItems.mockReturnValue(
+      pickerState({ pages: [{ items: [] }], hasNextPage: true, isFetchNextPageError: true }),
+    );
+
+    renderPicker();
+
+    expect(mocks.fetchNextPage).not.toHaveBeenCalled();
+    expect(screen.getByText("No items to show yet")).toBeTruthy();
+  });
+
+  it("renders the cards a later page brings", () => {
+    mocks.useTasteSeedItems.mockReturnValue(
+      pickerState({ pages: [{ items: [] }, { items: [card("movie-1")] }], hasNextPage: true }),
+    );
+
+    renderPicker();
+
+    expect(mocks.fetchNextPage).not.toHaveBeenCalled();
+    expect(screen.getByRole("option", { name: "Select Title movie-1" })).toBeTruthy();
+  });
+});
+
+describe("TasteSeed destinations", () => {
+  beforeEach(() => {
+    mocks.submit.mockReset();
+    mocks.submit.mockResolvedValue({ added: 3 });
+    mocks.useTasteSeedItems.mockReset();
+    mocks.useTasteSeedItems.mockReturnValue(
+      pickerState({ pages: [{ items: [card("m1"), card("m2"), card("m3")] }], hasNextPage: false }),
+    );
+    vi.stubGlobal("IntersectionObserver", NoopObserver);
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  function renderAt(entry: string) {
+    return render(
+      <MemoryRouter initialEntries={[entry]}>
+        <Routes>
+          <Route path="/taste-seed" element={<TasteSeed />} />
+          <Route path="/" element={<p>home page</p>} />
+          <Route path="/recommendations" element={<p>recommendations page</p>} />
+          <Route path="/settings/personalize" element={<p>settings page</p>} />
+        </Routes>
+      </MemoryRouter>,
+    );
+  }
+
+  function pickAll() {
+    for (const id of ["m1", "m2", "m3"]) {
+      fireEvent.click(screen.getByRole("option", { name: `Select Title ${id}` }));
+    }
+  }
+
+  // A first-run submission opens the recommendations it just shaped.
+  it("opens the recommendations after a first-run submission", async () => {
+    renderAt("/taste-seed");
+    pickAll();
+    fireEvent.click(screen.getByRole("button", { name: "Done" }));
+
+    expect(await screen.findByText("recommendations page")).toBeTruthy();
+    expect(mocks.submit).toHaveBeenCalledWith(["m1", "m2", "m3"]);
+  });
+
+  it("returns to settings after a submission from settings", async () => {
+    renderAt("/taste-seed?from=settings");
+    pickAll();
+    fireEvent.click(screen.getByRole("button", { name: "Done" }));
+
+    expect(await screen.findByText("settings page")).toBeTruthy();
+  });
+
+  it("goes home when the first-run picker is skipped", async () => {
+    renderAt("/taste-seed");
+    fireEvent.click(screen.getByRole("button", { name: "Skip" }));
+
+    expect(await screen.findByText("home page")).toBeTruthy();
+    expect(mocks.submit).not.toHaveBeenCalled();
+  });
+});
diff --git a/web/src/pages/TasteSeed.tsx b/web/src/pages/TasteSeed.tsx
index 588b5af245..9d1f2c9627 100644
--- a/web/src/pages/TasteSeed.tsx
+++ b/web/src/pages/TasteSeed.tsx
@@ -20,14 +20,25 @@ export default function TasteSeed() {
   useDocumentTitle("Pick what you love");
 
   const isReturning = searchParams.get("from") === "settings";
+  // Finishing the picker opens the recommendations it just shaped; skipping
+  // it, or returning from settings, goes back where the user came from.
+  const exitPath = isReturning ? "/settings/personalize" : "/";
+  const donePath = isReturning ? "/settings/personalize" : "/recommendations";
 
   // Track only the user's explicit toggles. Final `selected` set is derived
   // from items + toggles each render, so already-favorited items are
   // automatically pre-selected without needing setState-in-effect.
   const [userToggles, setUserToggles] = useState<Map<string, boolean>>(new Map());
 
-  const { data, fetchNextPage, hasNextPage, isFetching, isFetchingNextPage, isPending } =
-    useTasteSeedItems(true);
+  const {
+    data,
+    fetchNextPage,
+    hasNextPage,
+    isFetching,
+    isFetchingNextPage,
+    isFetchNextPageError,
+    isPending,
+  } = useTasteSeedItems(true);
   const submit = useSubmitTasteSeed();
 
   // Flatten paginated pages into a single item list.
@@ -50,6 +61,15 @@ export default function TasteSeed() {
     return set;
   }, [items, userToggles]);
 
+  // A page can hydrate to no cards the profile may see. Keep paging until a
+  // card shows up or the catalog runs out, instead of settling on the empty
+  // state; the sentinel below only exists once cards render.
+  const waitingForCards = items.length === 0 && hasNextPage && !isFetchNextPageError;
+  useEffect(() => {
+    if (isPending || !waitingForCards || isFetchingNextPage) return;
+    void fetchNextPage();
+  }, [fetchNextPage, isFetchingNextPage, isPending, waitingForCards]);
+
   // Infinite-scroll trigger: load the next page when sentinel becomes visible.
   const sentinelRef = useRef<HTMLDivElement | null>(null);
   useEffect(() => {
@@ -83,8 +103,8 @@ export default function TasteSeed() {
     if (profile) {
       setTasteSeedDismissed(profile.id);
     }
-    void navigate(isReturning ? "/settings/playback" : "/", { replace: true });
-  }, [navigate, profile, isReturning]);
+    void navigate(exitPath, { replace: true });
+  }, [navigate, profile, exitPath]);
 
   const handleSubmit = useCallback(async () => {
     if (selected.size < MIN_PICKS) {
@@ -104,9 +124,7 @@ export default function TasteSeed() {
       if (profile) {
         setTasteSeedDismissed(profile.id);
       }
-      void navigate(isReturning ? "/settings/playback" : "/", {
-        replace: true,
-      });
+      void navigate(donePath, { replace: true });
       return;
     }
 
@@ -117,16 +135,14 @@ export default function TasteSeed() {
       }
       toast.success(
         result.added === 1
-          ? "Added 1 favorite — personalizing your home"
-          : `Added ${result.added} favorites — personalizing your home`,
+          ? "Added 1 favorite — personalizing your recommendations"
+          : `Added ${result.added} favorites — personalizing your recommendations`,
       );
-      void navigate(isReturning ? "/settings/playback" : "/", {
-        replace: true,
-      });
+      void navigate(donePath, { replace: true });
     } catch (err) {
       toast.error(err instanceof Error ? err.message : "Failed to save your picks");
     }
-  }, [selected, items, submit, navigate, profile, isReturning]);
+  }, [selected, items, submit, navigate, profile, donePath]);
 
   const submitDisabled = selected.size < MIN_PICKS || submit.isPending;
 
@@ -166,7 +182,7 @@ export default function TasteSeed() {
       </header>
 
       <main className="mx-auto max-w-6xl px-4 py-6 sm:px-6 sm:py-8">
-        {isPending ? (
+        {isPending || waitingForCards ? (
           <TasteSeedGridSkeleton />
         ) : items.length === 0 ? (
           <div className="text-muted-foreground flex flex-col items-center gap-3 py-24 text-center">
diff --git a/web/src/pages/WatchRoute.test.tsx b/web/src/pages/WatchRoute.test.tsx
index c0b1bc239f..c25d7ad293 100644
--- a/web/src/pages/WatchRoute.test.tsx
+++ b/web/src/pages/WatchRoute.test.tsx
@@ -316,9 +316,14 @@ describe("buildWatchPageProps", () => {
     });
   });
 
-  it.each(["pgs"])(
-    "passes a selected bitmap subtitle ordinal into the initial playback request",
-    (codec) => {
+  it.each([
+    ["dvd_subtitle", { 42: 0 }],
+    // Embedded PGS arrives as a sidecar the player draws, so a refused start
+    // is not the subtitle's doing.
+    ["pgs", {}],
+  ] as const)(
+    "passes a selected %s subtitle ordinal into the initial playback request",
+    (codec, bitmapIndexes) => {
       const props = buildWatchPageProps({
         request: createWatchRouteRequest({
           contentId: "movie-1",
@@ -372,7 +377,7 @@ describe("buildWatchPageProps", () => {
       // Bitmap burn-in rides the normal start request, while its separate marker
       // enables the subtitle-free fallback if that start is refused.
       expect(props.initialSubtitleTrackIndexByFileId).toEqual({ 42: 0 });
-      expect(props.initialBitmapSubtitleTrackIndexByFileId).toEqual({ 42: 0 });
+      expect(props.initialBitmapSubtitleTrackIndexByFileId).toEqual(bitmapIndexes);
     },
   );
 
diff --git a/web/src/pages/admin-policy/AdminPolicyLayout.tsx b/web/src/pages/admin-policy/AdminPolicyLayout.tsx
index 875b1b61fa..3eb4c2a075 100644
--- a/web/src/pages/admin-policy/AdminPolicyLayout.tsx
+++ b/web/src/pages/admin-policy/AdminPolicyLayout.tsx
@@ -1,6 +1,7 @@
 import { ArrowRight, PackageCheck, PenLine, ScrollText } from "lucide-react";
 import { useSearchParams } from "react-router";
 
+import { PageHeader } from "@/components/page/PageHeader";
 import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
 import { usePolicyCapability } from "@/hooks/queries/admin/policy";
 import { useDocumentTitle } from "@/hooks/useDocumentTitle";
@@ -81,15 +82,11 @@ export default function AdminPolicyLayout() {
     capability.data?.editor_available === false;
 
   return (
-    <div className="page-shell space-y-6 py-4 sm:py-6">
-      <div className="page-header gap-5">
-        <div className="space-y-3">
-          <h1 className="page-title text-[clamp(2rem,4vw,3rem)]">Policy</h1>
-          <p className="page-subtitle text-sm sm:text-base">
-            Household access rules: what Prairie allows by default, and where you tighten it.
-          </p>
-        </div>
-      </div>
+    <div className="space-y-6 pb-4 sm:pb-6">
+      <PageHeader
+        title="Policy"
+        subtitle="Household access rules: what Prairie allows by default, and where you tighten it."
+      />
 
       {capability.isLoading && (
         <p className="text-muted-foreground text-sm">Loading policy capability...</p>
diff --git a/web/src/pages/admin-requests/RequestQueue.tsx b/web/src/pages/admin-requests/RequestQueue.tsx
index d40aa8feb0..b60ebc0b55 100644
--- a/web/src/pages/admin-requests/RequestQueue.tsx
+++ b/web/src/pages/admin-requests/RequestQueue.tsx
@@ -205,7 +205,7 @@ export function RequestQueue() {
         onValueChange={(value) => updateParams((params) => params.set("view", value))}
         className="gap-4"
       >
-        <div className="-mx-4 [scrollbar-width:thin] overflow-x-auto px-4 pb-1 sm:mx-0 sm:px-0">
+        <div className="-mx-4 overflow-x-auto px-4 pb-1 [scrollbar-width:thin] sm:mx-0 sm:px-0">
           <TabsList aria-label="Request views" className="w-max">
             {REQUEST_QUEUE_VIEWS.map((view) => (
               <TabsTrigger key={view.value} value={view.value} className="px-3">
diff --git a/web/src/pages/admin-settings/AISettings.test.tsx b/web/src/pages/admin-settings/AISettings.test.tsx
index 996de55d58..e90c9312a5 100644
--- a/web/src/pages/admin-settings/AISettings.test.tsx
+++ b/web/src/pages/admin-settings/AISettings.test.tsx
@@ -172,10 +172,48 @@ describe("AISettings", () => {
     Object.assign(values, DEFAULT_VALUES);
   });
 
+  it("keeps the reasoning level in the text model tile's Advanced section", async () => {
+    const user = userEvent.setup();
+    render(<AISettings />);
+    const tile = await openTile(user, "Text model");
+
+    expect(
+      within(tile).queryByRole("combobox", { name: "Reasoning level" }),
+    ).not.toBeInTheDocument();
+    await user.click(within(tile).getByRole("button", { name: "Advanced · 1 setting" }));
+    expect(within(tile).getByRole("combobox", { name: "Reasoning level" })).toBeInTheDocument();
+  });
+
+  it("opens the text model's Advanced section for a staged reasoning level", () => {
+    values["ai.reasoning_effort"] = "high";
+    dirtyKeys = ["ai.reasoning_effort"];
+    dirtyCount = 1;
+    render(<AISettings />);
+
+    // The staged edit holds the tile open, and the section with it.
+    const tile = screen.getByRole("group", { name: "Text model" });
+    expect(within(tile).getByRole("combobox", { name: "Reasoning level" })).toBeInTheDocument();
+  });
+
+  it("opens the text model's Advanced section when the model drops the saved level", () => {
+    values["ai.reasoning_effort"] = "high";
+    dirtyKeys = ["ai.chat_model"];
+    dirtyCount = 1;
+    reasoningLevels = [];
+    render(<AISettings />);
+
+    // Save refuses this level, so the field it names has to be on screen.
+    const tile = screen.getByRole("group", { name: "Text model" });
+    expect(within(tile).getByRole("combobox", { name: "Reasoning level" })).toHaveTextContent(
+      "high (unsupported by this model)",
+    );
+  });
+
   it("stages reasoning effort and clears it for the model default", async () => {
     const user = userEvent.setup();
     const view = render(<AISettings />);
     await openTile(user, "Text model");
+    await user.click(screen.getByRole("button", { name: "Advanced · 1 setting" }));
     await user.click(screen.getByRole("combobox", { name: "Reasoning level" }));
     await user.click(screen.getByRole("option", { name: "High" }));
     expect(mocks.setValue).toHaveBeenCalledWith("ai.reasoning_effort", "high");
@@ -360,6 +398,111 @@ describe("AISettings", () => {
     expect(mocks.setValue).toHaveBeenCalledWith("ai.asr_model", "whisper-large-v3-turbo");
   });
 
+  it("does not call a fresh install's default OpenAI endpoint configured without a key", () => {
+    // What a fresh install reads: the server defaults, and no key anywhere.
+    values["ai.base_url"] = "https://api.openai.com";
+    values["ai.chat_model"] = "gpt-4o-mini";
+    values["ai.asr_model"] = "whisper-1";
+    values["subtitle_ai.enabled"] = "false";
+    sensitiveConfigured = [];
+
+    render(<AISettings />);
+
+    const text = screen.getByRole("group", { name: "Text model" });
+    expect(within(text).queryByText("Configured")).not.toBeInTheDocument();
+    expect(within(text).getByText("API key required")).toBeInTheDocument();
+    expect(within(text).getByRole("button", { name: "Connect" })).toBeInTheDocument();
+    expect(screen.getByRole("switch", { name: "Translate subtitles" })).toBeDisabled();
+    expect(screen.getByRole("switch", { name: "Translate descriptions" })).toBeDisabled();
+    expect(screen.getByRole("switch", { name: "Create subtitles from audio" })).toBeDisabled();
+  });
+
+  it("counts the default endpoint ready once a key is saved", () => {
+    values["ai.base_url"] = "https://api.openai.com";
+    values["subtitle_ai.enabled"] = "false";
+    sensitiveConfigured = ["ai.api_key"];
+
+    render(<AISettings />);
+
+    const text = screen.getByRole("group", { name: "Text model" });
+    expect(within(text).getByText("Configured")).toBeInTheDocument();
+    expect(screen.getByRole("switch", { name: "Translate subtitles" })).toBeEnabled();
+    expect(screen.getByRole("switch", { name: "Create subtitles from audio" })).toBeEnabled();
+  });
+
+  it("lets a local endpoint run without a key, as the server does", () => {
+    values["ai.base_url"] = "http://ollama:11434";
+    values["subtitle_ai.enabled"] = "false";
+    sensitiveConfigured = [];
+
+    render(<AISettings />);
+
+    expect(
+      within(screen.getByRole("group", { name: "Text model" })).getByText("Configured"),
+    ).toBeInTheDocument();
+    expect(screen.getByRole("switch", { name: "Translate subtitles" })).toBeEnabled();
+  });
+
+  it.each([
+    ["Groq", "https://api.groq.com/openai"],
+    ["OpenRouter", "https://openrouter.ai/api/v1"],
+    ["Mistral", "https://api.mistral.ai/v1"],
+    ["an Azure OpenAI resource", "https://example-resource.openai.azure.com/openai"],
+  ])("does not count %s ready for transcription without a key", (_name, url) => {
+    values["ai.base_url"] = "http://ollama:11434";
+    values["ai.asr_base_url"] = url;
+    values["ai.asr_model"] = "whisper-large-v3";
+    values["subtitle_ai.enabled"] = "false";
+    sensitiveConfigured = [];
+
+    render(<AISettings />);
+
+    expect(screen.getByRole("switch", { name: "Create subtitles from audio" })).toBeDisabled();
+    // The local text endpoint still runs without one.
+    expect(screen.getByRole("switch", { name: "Translate subtitles" })).toBeEnabled();
+  });
+
+  it("stops counting the default endpoint ready while its key's clear is staged", () => {
+    values["ai.base_url"] = "https://api.openai.com";
+    values["ai.api_key"] = "";
+    values["subtitle_ai.enabled"] = "false";
+    sensitiveConfigured = ["ai.api_key"];
+    dirtyKeys = ["ai.api_key"];
+    dirtyCount = 1;
+
+    render(<AISettings />);
+
+    expect(screen.getByRole("switch", { name: "Translate subtitles" })).toBeDisabled();
+  });
+
+  it("refuses to save a feature switch for the default endpoint without a key", async () => {
+    values["ai.base_url"] = "https://api.openai.com";
+    values["metadata_ai.enabled"] = "true";
+    sensitiveConfigured = [];
+    dirtyKeys = ["metadata_ai.enabled"];
+    dirtyCount = 1;
+
+    render(<AISettings />);
+    await userEvent.click(screen.getByRole("button", { name: "Save" }));
+
+    expect(mocks.save).not.toHaveBeenCalled();
+    expect(mocks.toastError).toHaveBeenCalledWith(
+      "Add an API key for the text model, or point it at an endpoint that needs none.",
+    );
+  });
+
+  it("says the concurrent job budget is per server process", async () => {
+    const user = userEvent.setup();
+    render(<AISettings />);
+    await user.click(screen.getByRole("button", { name: "Advanced · 6 settings" }));
+
+    expect(
+      screen.getByText(
+        "Shared by every AI job in one server process; each process gets its own budget.",
+      ),
+    ).toBeInTheDocument();
+  });
+
   it("blocks turning on a feature whose model cannot serve it", () => {
     // Whitespace leaves the speech model unconfigured.
     values["ai.asr_model"] = " ";
diff --git a/web/src/pages/admin-settings/AISettings.tsx b/web/src/pages/admin-settings/AISettings.tsx
index daf15570fa..b9eecbcac0 100644
--- a/web/src/pages/admin-settings/AISettings.tsx
+++ b/web/src/pages/admin-settings/AISettings.tsx
@@ -139,6 +139,31 @@ const TRANSCRIPTION_PRESETS = [
   },
 ] as const;
 
+/**
+ * Hosted providers that reject a request without a key, matched by host
+ * suffix like the server's own hosted-provider list (strictHostedASRHosts in
+ * internal/ai/llm/transcribe.go), so an Azure resource subdomain counts too.
+ */
+const KEY_REQUIRED_HOSTS = [
+  "api.openai.com",
+  "openai.azure.com",
+  "api.groq.com",
+  "api.mistral.ai",
+  "openrouter.ai",
+];
+
+/**
+ * Whether an endpoint can be ready without an API key. The server sends no
+ * Authorization header when the key is empty, which is how a local provider
+ * (Ollama, Speaches) runs, so a missing key only disqualifies the hosted
+ * providers Prairie knows require one. Treating the default OpenAI endpoint as
+ * ready is how a fresh install read "Configured".
+ */
+function keylessEndpoint(rawURL: string): boolean {
+  const host = hostLabel(rawURL).toLowerCase().replace(/:\d+$/, "");
+  return !KEY_REQUIRED_HOSTS.some((hosted) => host === hosted || host.endsWith(`.${hosted}`));
+}
+
 function hostLabel(rawURL: string): string {
   const trimmed = rawURL.trim();
   if (!trimmed) return "";
@@ -207,7 +232,7 @@ function ModelPanelActions({
           role="status"
           aria-live="polite"
           className={cn(
-            "mr-auto text-[11.5px]",
+            "mr-auto text-xs",
             test.ok ? "text-muted-foreground" : "text-amber-600 dark:text-amber-400",
           )}
         >
@@ -274,6 +299,7 @@ function TextModelTile({
   authMode,
   reasoningEffort,
   reasoningLevels,
+  reasoningAttention,
   chatGPTSupported,
   baseURL,
   chatModel,
@@ -281,6 +307,7 @@ function TextModelTile({
   apiKeyConfigured,
   apiKeyCleared,
   ready,
+  missingAPIKey,
   canTest,
   dirty,
   restartKeys,
@@ -299,6 +326,11 @@ function TextModelTile({
   authMode: string;
   reasoningEffort: string;
   reasoningLevels: string[];
+  /**
+   * The reasoning level has a staged edit, or one the selected model cannot
+   * use; either holds the tile's Advanced section open.
+   */
+  reasoningAttention: boolean;
   chatGPTSupported: boolean;
   baseURL: string;
   chatModel: string;
@@ -306,6 +338,8 @@ function TextModelTile({
   apiKeyConfigured: boolean;
   apiKeyCleared: boolean;
   ready: boolean;
+  /** Endpoint and model are set, and only the API key is missing. */
+  missingAPIKey: boolean;
   canTest: boolean;
   dirty: boolean;
   restartKeys: RestartKeyMatcher;
@@ -346,7 +380,9 @@ function TextModelTile({
               ? `${chatModel} · ${authMode === "chatgpt" ? "ChatGPT plan" : hostLabel(baseURL)}`
               : authMode === "chatgpt"
                 ? "Connect an account and choose a model"
-                : "Base URL and model required"
+                : missingAPIKey
+                  ? "API key required"
+                  : "Base URL and model required"
       }
       expanded={expanded}
       primaryAction={{ label: ready ? "Manage" : "Connect", onClick: onExpand }}
@@ -404,34 +440,36 @@ function TextModelTile({
           />
         </>
       )}
-      <SettingField
-        label="Reasoning level"
-        type="select"
-        value={reasoningEffort || "default"}
-        description="Higher effort can improve complex translations and use more time and tokens."
-        onChange={(next) => onChange("ai.reasoning_effort", next === "default" ? "" : next)}
-        options={[
-          { value: "default", label: "Provider default" },
-          ...reasoningLevels.map((level) => ({
-            value: level,
-            label:
-              level === "none"
-                ? "None"
-                : level === "xhigh"
-                  ? "Extra high"
-                  : level.charAt(0).toUpperCase() + level.slice(1),
-          })),
-          ...(reasoningEffort && !reasoningLevels.includes(reasoningEffort)
-            ? [
-                {
-                  value: reasoningEffort,
-                  label: `${reasoningEffort} (unsupported by this model)`,
-                  disabled: true,
-                },
-              ]
-            : []),
-        ]}
-      />
+      <AdvancedSection id="ai.text-model" count={1} forceOpen={reasoningAttention}>
+        <SettingField
+          label="Reasoning level"
+          type="select"
+          value={reasoningEffort || "default"}
+          description="Higher effort can improve complex translations and use more time and tokens."
+          onChange={(next) => onChange("ai.reasoning_effort", next === "default" ? "" : next)}
+          options={[
+            { value: "default", label: "Provider default" },
+            ...reasoningLevels.map((level) => ({
+              value: level,
+              label:
+                level === "none"
+                  ? "None"
+                  : level === "xhigh"
+                    ? "Extra high"
+                    : level.charAt(0).toUpperCase() + level.slice(1),
+            })),
+            ...(reasoningEffort && !reasoningLevels.includes(reasoningEffort)
+              ? [
+                  {
+                    value: reasoningEffort,
+                    label: `${reasoningEffort} (unsupported by this model)`,
+                    disabled: true,
+                  },
+                ]
+              : []),
+          ]}
+        />
+      </AdvancedSection>
       <ModelPanelActions
         testLabel="Test text model"
         pendingLabel="Testing text model..."
@@ -664,22 +702,54 @@ export default function AISettings() {
   const chatModel = effectiveValue("ai.chat_model", "subtitle_ai.chat_model", "gpt-4o-mini");
   const asrBaseURL = value("ai.asr_base_url");
   const asrModel = value("ai.asr_model", "whisper-1");
+  // A key counts once it is saved (and no clear is staged) or typed in. The
+  // legacy key still serves an upgraded server until the modern one is saved.
+  const textAPIKeyConfigured =
+    form.sensitiveConfigured.includes("ai.api_key") ||
+    form.sensitiveConfigured.includes("subtitle_ai.api_key");
+  const textHasAPIKey =
+    value("ai.api_key").trim() !== "" ||
+    (textAPIKeyConfigured && !form.isClearStaged("ai.api_key"));
+  const textEndpointSet = textBaseURL.trim() !== "" && chatModel.trim() !== "";
+  const textMissingAPIKey = textEndpointSet && !textHasAPIKey && !keylessEndpoint(textBaseURL);
+  // Defaults alone (the OpenAI endpoint and gpt-4o-mini, no key) are not a
+  // configured provider: every request would fail at the provider.
   const textReady =
     authMode === "chatgpt"
       ? authenticatedAccount?.connected === true &&
         !!chatGPTModels.data?.models.some((model) => model.id === chatModel)
-      : textBaseURL.trim() !== "" && chatModel.trim() !== "";
+      : textEndpointSet && !textMissingAPIKey;
   const textCanTest =
     textReady ||
     (authMode === "chatgpt" &&
       authenticatedAccount?.usage_limited === true &&
       configuredChatModel.trim() !== "");
   const speechUsesTextEndpoint = asrBaseURL.trim() === "";
+  // Speech borrows the text endpoint and the text key when its own are empty,
+  // as the server does (`internal/ai/llm/client.go`).
+  const speechBaseURL = speechUsesTextEndpoint ? textBaseURL : asrBaseURL;
+  const speechHasAPIKey =
+    value("ai.asr_api_key").trim() !== "" ||
+    (form.sensitiveConfigured.includes("ai.asr_api_key") &&
+      !form.isClearStaged("ai.asr_api_key")) ||
+    textHasAPIKey;
   const speechReady =
-    (asrBaseURL.trim() !== "" || textBaseURL.trim() !== "") && asrModel.trim() !== "";
+    speechBaseURL.trim() !== "" &&
+    asrModel.trim() !== "" &&
+    (speechHasAPIKey || keylessEndpoint(speechBaseURL));
   const subtitleTranslateEnabled = value("subtitle_ai.enabled", "false") === "true";
   const transcribeEnabled = value("subtitle_ai.transcribe_enabled", "false") === "true";
   const descriptionEnabled = value("metadata_ai.enabled", "false") === "true";
+  // Only judged once the capabilities describe the model being saved; while
+  // they are stale or loading, the server's own validation decides.
+  const reasoningEffort = value("ai.reasoning_effort");
+  const reasoningUnsupported =
+    reasoningEffort !== "" &&
+    capabilityModel === currentModel &&
+    !capabilities.isFetching &&
+    capabilities.isSuccess &&
+    !!capabilities.data &&
+    !capabilities.data.reasoning_levels.includes(reasoningEffort);
   const textDirty = TEXT_AI_KEYS.some((key) => form.isDirty(key));
   const speechDirty = SPEECH_ONLY_KEYS.some((key) => form.isDirty(key));
   const advancedChangedCount = AI_ADVANCED_KEYS.filter((key) => form.isDirty(key)).length;
@@ -765,20 +835,13 @@ export default function AISettings() {
       toast.error(
         authMode === "chatgpt"
           ? "Connect a ChatGPT account and choose an available text model."
-          : "Text AI base URL and chat model are required.",
+          : textMissingAPIKey
+            ? "Add an API key for the text model, or point it at an endpoint that needs none."
+            : "Text AI base URL and chat model are required.",
       );
       return;
     }
-    const effort = value("ai.reasoning_effort");
-    if (
-      requiresTextConnection &&
-      effort &&
-      capabilityModel === currentModel &&
-      !capabilities.isFetching &&
-      capabilities.isSuccess &&
-      capabilities.data &&
-      !capabilities.data.reasoning_levels.includes(effort)
-    ) {
+    if (requiresTextConnection && reasoningUnsupported) {
       toast.error("Choose a reasoning level supported by the selected model.");
       return;
     }
@@ -812,7 +875,7 @@ export default function AISettings() {
   }
 
   return (
-    <div className="flex h-full max-w-5xl flex-col gap-7">
+    <div className="space-y-5">
       <SettingsPageHeader title="AI Services" />
 
       {authMode === "chatgpt" ? (
@@ -826,18 +889,17 @@ export default function AISettings() {
           <ProviderTileGrid>
             <TextModelTile
               authMode={authMode}
-              reasoningEffort={value("ai.reasoning_effort")}
+              reasoningEffort={reasoningEffort}
               reasoningLevels={capabilities.data?.reasoning_levels ?? []}
+              reasoningAttention={form.isDirty("ai.reasoning_effort") || reasoningUnsupported}
               chatGPTSupported={capabilities.data?.chatgpt_sign_in === true}
               baseURL={textBaseURL}
               chatModel={chatModel}
               apiKeyValue={value("ai.api_key")}
-              apiKeyConfigured={
-                form.sensitiveConfigured.includes("ai.api_key") ||
-                form.sensitiveConfigured.includes("subtitle_ai.api_key")
-              }
+              apiKeyConfigured={textAPIKeyConfigured}
               apiKeyCleared={form.isClearStaged("ai.api_key")}
               ready={textReady}
+              missingAPIKey={authMode !== "chatgpt" && textMissingAPIKey}
               canTest={textCanTest}
               dirty={textDirty}
               restartKeys={restartKeys}
@@ -974,7 +1036,9 @@ export default function AISettings() {
                 "2",
               )}
               onChange={(next) => setValue("ai.max_concurrent_jobs", next)}
-              description="One budget shared by every AI job on the server."
+              // Each server process builds its own dispatch semaphore at start
+              // (internal/api/router.go), so a cluster runs this many per process.
+              description="Shared by every AI job in one server process; each process gets its own budget."
               restartRequired={restartKeys.has("ai.max_concurrent_jobs")}
             />
             <SettingField
diff --git a/web/src/pages/admin-settings/AdminSettingsLayout.test.tsx b/web/src/pages/admin-settings/AdminSettingsLayout.test.tsx
index 0bcadaf4d9..4478eb21f1 100644
--- a/web/src/pages/admin-settings/AdminSettingsLayout.test.tsx
+++ b/web/src/pages/admin-settings/AdminSettingsLayout.test.tsx
@@ -1,17 +1,15 @@
 import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
-import { render, screen, within } from "@testing-library/react";
+import { render, screen } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
-import { createMemoryRouter, RouterProvider } from "react-router";
+import { createMemoryRouter, Link, RouterProvider } from "react-router";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
-import type { SettingsOverviewModel } from "@/hooks/admin/useSettingsOverview";
 import { ADMIN_SETTINGS_NAV, LEGACY_ADMIN_SETTINGS_PAGE_ALIASES } from "@/lib/adminSettingsSearch";
 
 import AdminSettingsLayout from "./AdminSettingsLayout";
 
 const mocks = vi.hoisted(() => ({
   useAdminServerStatus: vi.fn(),
-  useSettingsOverview: vi.fn(),
   // How many staged edits the open page claims; drives the shell's
   // unsaved-changes guard.
   dirtyCount: 0,
@@ -56,24 +54,8 @@ vi.mock("@/hooks/queries/admin/settings", async (importOriginal) => ({
   useAdminServerStatus: (...args: unknown[]) => mocks.useAdminServerStatus(...args),
 }));
 
-vi.mock("@/hooks/admin/useSettingsOverview", async (importOriginal) => ({
-  ...(await importOriginal<typeof import("@/hooks/admin/useSettingsOverview")>()),
-  useSettingsOverview: () => mocks.useSettingsOverview(),
-}));
-
-function overviewModel(): SettingsOverviewModel {
-  return {
-    isLoading: false,
-    tiles: [],
-    cards: [],
-  };
-}
-
 beforeEach(() => {
-  mocks.useAdminServerStatus.mockReturnValue({
-    data: { restart_required: false },
-  });
-  mocks.useSettingsOverview.mockReturnValue(overviewModel());
+  mocks.useAdminServerStatus.mockReturnValue({ data: { restart_required: false } });
   mocks.dirtyCount = 0;
 });
 
@@ -82,15 +64,24 @@ afterEach(() => {
 });
 
 // A data router, like the app itself mounts: the shell blocks navigation with
-// `useBlocker`, which the declarative `<MemoryRouter>` cannot serve. The second
-// route stands in for the rest of the admin area (the sidebar's targets).
+// `useBlocker`, which the declarative `<MemoryRouter>` cannot serve. The link
+// beside the pages stands in for the admin sidebar, and the second route for
+// the rest of the admin area.
 function renderInteractiveLayout(suffix = "") {
   const client = new QueryClient({
     defaultOptions: { queries: { retry: false } },
   });
   const router = createMemoryRouter(
     [
-      { path: "/admin/settings/*", element: <AdminSettingsLayout /> },
+      {
+        path: "/admin/settings/*",
+        element: (
+          <>
+            <Link to="/admin/settings/playback">Playback settings</Link>
+            <AdminSettingsLayout />
+          </>
+        ),
+      },
       { path: "/admin/users", element: <h1>Admin users</h1> },
     ],
     { initialEntries: [`/admin/settings${suffix}`] },
@@ -152,26 +143,13 @@ describe("AdminSettingsLayout", () => {
     ).toBeInTheDocument();
   });
 
-  it("redirects an unknown settings page to the overview", async () => {
+  it.each(["", "/not-a-page"])("opens the first settings page from %s", async (suffix) => {
     vi.stubGlobal("scrollTo", vi.fn());
-    renderInteractiveLayout("/not-a-page");
-
-    expect(await screen.findByRole("heading", { level: 1, name: "Settings" })).toBeInTheDocument();
-  });
-
-  it("filters the page rail from the settings search box", async () => {
-    vi.stubGlobal("scrollTo", vi.fn());
-    renderInteractiveLayout("/general");
-
-    const box = screen.getByRole("searchbox", { name: "Search settings" });
-    await userEvent.type(box, "transcode");
-
-    const rail = screen.getByRole("navigation", { name: "Settings pages" });
-    expect(within(rail).getByRole("link", { name: "Playback" })).toBeInTheDocument();
-    expect(within(rail).queryByRole("link", { name: "General" })).not.toBeInTheDocument();
+    const { router } = renderInteractiveLayout(suffix);
 
-    await userEvent.clear(box);
-    expect(within(rail).getByRole("link", { name: "General" })).toBeInTheDocument();
+    const first = ADMIN_SETTINGS_NAV[0];
+    expect(await screen.findByRole("region", { name: `${first?.label} settings` })).toBeVisible();
+    expect(router.state.location.pathname).toBe(`/admin/settings/${first?.id}`);
   });
 });
 
@@ -184,12 +162,11 @@ describe("AdminSettingsLayout unsaved-changes guard", () => {
     vi.stubGlobal("scrollTo", vi.fn());
   });
 
-  it("holds a rail navigation until staged edits are discarded", async () => {
+  it("holds a navigation away until staged edits are discarded", async () => {
     mocks.dirtyCount = 1;
     const { router } = renderInteractiveLayout("/general");
 
-    const rail = screen.getByRole("navigation", { name: "Settings pages" });
-    await user.click(within(rail).getByRole("link", { name: "Playback" }));
+    await user.click(screen.getByRole("link", { name: "Playback settings" }));
 
     expect(
       await screen.findByRole("alertdialog", {
@@ -201,7 +178,7 @@ describe("AdminSettingsLayout unsaved-changes guard", () => {
     await user.click(screen.getByRole("button", { name: "Cancel" }));
     expect(screen.getByRole("region", { name: "General settings" })).toBeInTheDocument();
 
-    await user.click(within(rail).getByRole("link", { name: "Playback" }));
+    await user.click(screen.getByRole("link", { name: "Playback settings" }));
     await user.click(await screen.findByRole("button", { name: "Discard" }));
 
     expect(await screen.findByRole("region", { name: "Playback settings" })).toBeInTheDocument();
diff --git a/web/src/pages/admin-settings/AdminSettingsLayout.tsx b/web/src/pages/admin-settings/AdminSettingsLayout.tsx
index ddbbe68d04..c159e6052b 100644
--- a/web/src/pages/admin-settings/AdminSettingsLayout.tsx
+++ b/web/src/pages/admin-settings/AdminSettingsLayout.tsx
@@ -1,21 +1,15 @@
-import { useEffect, useMemo, useRef, useState, type ComponentType } from "react";
-import { ChevronLeft } from "lucide-react";
-import { Link, Navigate, useParams, useSearchParams } from "react-router";
+import { useEffect, useRef, type ComponentType } from "react";
+import { Navigate, useParams, useSearchParams } from "react-router";
 
 import {
-  ADMIN_SETTINGS_GROUPS,
   ADMIN_SETTINGS_NAV,
+  adminSettingsHref,
   resolveAdminSettingsPageID,
   type AdminSettingsSearchItem,
 } from "@/lib/adminSettingsSearch";
-import {
-  countSettingsSearchItems,
-  filterSettingsSearchGroups,
-} from "@/components/settings/settingsSearch";
-import { SettingsSearchInput } from "@/components/settings/SettingsSearchInput";
+import { PageColumn } from "@/components/page/PageHeader";
+import { SettingsPageDescriptionContext } from "@/components/settings/settingsPageDescription";
 import { UnsavedChangesGuard } from "@/components/UnsavedChangesGuard";
-import { settingsPageHref } from "@/hooks/admin/useSettingsOverview";
-import { SettingsPageRail } from "@/components/settings/SettingsPageRail";
 
 import AboutSettings from "./AboutSettings";
 import GeneralSettings from "./GeneralSettings";
@@ -23,17 +17,19 @@ import AppearanceSettings from "./AppearanceSettings";
 import SecurityAccessSettings from "./SecurityAccessSettings";
 import SignInSettings from "./SignInSettings";
 import LibraryMetadataSettings from "./LibraryMetadataSettings";
+import AutoscanSettings from "./AutoscanSettings";
 import PlaybackSettings from "./PlaybackSettings";
 import DownloadsSettings from "./DownloadsSettings";
 import RequestsSettings from "./RequestsSettings";
 import ProvidersSettings from "./ProvidersSettings";
-import WatchSyncSettings from "./WatchSyncSettings";
 import AISettings from "./AISettings";
 import NotificationsAdminSettings from "./NotificationsAdminSettings";
 import CompatibilityProxiesSettings from "./CompatibilityProxiesSettings";
 import NetworkAccessSettings from "./NetworkAccessSettings";
-import InfrastructureSettings from "./InfrastructureSettings";
-import SettingsOverview from "./SettingsOverview";
+import StorageSettings from "./StorageSettings";
+import SearchSettings from "./SearchSettings";
+import LoggingSettings from "./LoggingSettings";
+import EmailSettings from "./EmailSettings";
 import "@/styles/admin-settings.css";
 
 interface SettingsNav extends AdminSettingsSearchItem {
@@ -47,16 +43,19 @@ const SETTINGS_COMPONENTS: Record<string, ComponentType> = {
   security: SecurityAccessSettings,
   "sign-in": SignInSettings,
   library: LibraryMetadataSettings,
+  autoscan: AutoscanSettings,
   playback: PlaybackSettings,
   downloads: DownloadsSettings,
   requests: RequestsSettings,
   providers: ProvidersSettings,
-  "watch-sync": WatchSyncSettings,
   ai: AISettings,
   notifications: NotificationsAdminSettings,
   compatibility: CompatibilityProxiesSettings,
   "network-access": NetworkAccessSettings,
-  infrastructure: InfrastructureSettings,
+  storage: StorageSettings,
+  search: SearchSettings,
+  logging: LoggingSettings,
+  email: EmailSettings,
 };
 
 function settingsComponent(id: string) {
@@ -72,19 +71,15 @@ const SETTINGS_NAV: SettingsNav[] = ADMIN_SETTINGS_NAV.map((item) => ({
   component: settingsComponent(item.id),
 }));
 
+/**
+ * Server settings pages. The admin sidebar lists each one under the topic it
+ * belongs to; this only mounts the page the URL names. The bare
+ * /admin/settings, where the old Settings entry led, opens the first page.
+ */
 export default function AdminSettingsLayout() {
   const params = useParams();
   const [searchParams] = useSearchParams();
   const activeContentRef = useRef<HTMLDivElement>(null);
-  const [settingsSearch, setSettingsSearch] = useState("");
-  const filteredGroups = useMemo(
-    () => filterSettingsSearchGroups(ADMIN_SETTINGS_GROUPS, settingsSearch),
-    [settingsSearch],
-  );
-  const filteredItems = useMemo(
-    () => filteredGroups.flatMap((group) => group.items),
-    [filteredGroups],
-  );
   const rawPageId = params["*"]?.replace(/^\/+|\/+$/g, "") || null;
   const legacyTabId = searchParams.get("tab");
   const requestedId = rawPageId ?? legacyTabId;
@@ -103,71 +98,36 @@ export default function AdminSettingsLayout() {
     activeContentRef.current?.focus({ preventScroll: true });
   }, [activeId]);
 
-  // Turn old query-string tabs and retired page ids into canonical page URLs.
-  if (requestedId && !activeId) {
-    return <Navigate to="/admin/settings" replace />;
+  // Old query-string tabs and retired page ids become canonical page URLs; an
+  // unknown or missing id opens the first page.
+  if (!active || !ActiveComponent) {
+    const fallback = SETTINGS_NAV[0];
+    return fallback ? <Navigate to={adminSettingsHref(fallback.id)} replace /> : null;
   }
-  if (
-    activeId &&
-    (rawPageId !== activeId || legacyTabId !== null || searchParams.toString() !== "")
-  ) {
-    return <Navigate to={settingsPageHref(activeId)} replace />;
+  if (rawPageId !== activeId || legacyTabId !== null || searchParams.toString() !== "") {
+    return <Navigate to={adminSettingsHref(active.id)} replace />;
   }
 
   return (
-    <div className="w-full max-w-[96rem]">
+    <div className="w-full">
       {/* Settings pages stage their edits and only write them from the SaveBar,
-          so leaving the shell — rail, back link, admin sidebar, browser back —
-          would drop them. One guard for the whole area; the pages themselves
-          only report that they are dirty. */}
+          so leaving a page — the admin sidebar, browser back — would drop
+          them. One guard for the whole area; the pages themselves only report
+          that they are dirty. */}
       <UnsavedChangesGuard />
-
-      {active && ActiveComponent ? (
-        <div className="w-full space-y-5">
-          <div className="flex flex-wrap items-center gap-3">
-            <Link
-              to="/admin/settings"
-              className="text-muted-foreground hover:text-foreground focus-visible:ring-ring inline-flex w-fit items-center gap-1.5 rounded-lg pr-2 text-sm font-medium transition-colors focus-visible:ring-2 focus-visible:outline-none"
-            >
-              <ChevronLeft className="h-4 w-4" aria-hidden="true" />
-              All settings
-            </Link>
-          </div>
-
-          {/* Same shell as the user settings page (SettingsLayout): one panel,
-              nav rail on the left, content column on the right. */}
-          <div className="surface-panel-lg flex min-w-0 flex-col lg:min-h-[500px] lg:flex-row lg:overflow-hidden">
-            <aside className="border-border hidden lg:block lg:w-60 lg:flex-shrink-0 lg:border-r">
-              {/* Lives with the rail it filters, not in the header row: the
-                  admin shell floats its own fixed Search ⌘K / activity controls
-                  over the top-right corner, which overlapped an input there. */}
-              <div className="pt-5 pr-3 pl-5">
-                <SettingsSearchInput
-                  value={settingsSearch}
-                  onChange={setSettingsSearch}
-                  resultCount={countSettingsSearchItems(filteredGroups)}
-                  captureShortcut={false}
-                />
-              </div>
-              <SettingsPageRail activeId={active.id} items={filteredItems} />
-            </aside>
-
-            <div className="min-w-0 flex-1 p-4 sm:p-6">
-              <div
-                ref={activeContentRef}
-                role="region"
-                aria-label={`${active.label} settings`}
-                tabIndex={-1}
-                className="w-full max-w-3xl min-w-0 focus:outline-none"
-              >
-                <ActiveComponent />
-              </div>
-            </div>
-          </div>
-        </div>
-      ) : (
-        <SettingsOverview />
-      )}
+      <div
+        ref={activeContentRef}
+        role="region"
+        aria-label={`${active.label} settings`}
+        tabIndex={-1}
+        className="min-w-0 focus:outline-none"
+      >
+        <PageColumn width="settings">
+          <SettingsPageDescriptionContext.Provider value={active.description}>
+            <ActiveComponent />
+          </SettingsPageDescriptionContext.Provider>
+        </PageColumn>
+      </div>
     </div>
   );
 }
diff --git a/web/src/pages/admin-settings/AppearanceSettings.test.tsx b/web/src/pages/admin-settings/AppearanceSettings.test.tsx
index 29a81cd06e..3712e8b76c 100644
--- a/web/src/pages/admin-settings/AppearanceSettings.test.tsx
+++ b/web/src/pages/admin-settings/AppearanceSettings.test.tsx
@@ -4,6 +4,7 @@ import { fireEvent, render, screen } from "@testing-library/react";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 const useSettingsFormMock = vi.fn();
+const brandingState = { storageAvailable: true };
 
 vi.mock("@/hooks/useSettingsForm", () => ({
   useSettingsForm: (...args: unknown[]) => useSettingsFormMock(...args),
@@ -15,7 +16,7 @@ vi.mock("@/hooks/useRestartKeys", () => ({
 
 vi.mock("@/hooks/useBranding", () => ({
   useBranding: () => ({
-    storageAvailable: true,
+    storageAvailable: brandingState.storageAvailable,
     wordmarkUrl: null,
     markUrl: null,
     faviconUrl: null,
@@ -27,28 +28,6 @@ vi.mock("@/components/admin/BrandingAssetField", () => ({
   BrandingAssetField: ({ label }: { label: string }) => <div>{label}</div>,
 }));
 
-vi.mock("@/components/theme/TokenEditor", () => ({
-  TokenEditor: ({ onSetVar }: { onSetVar: (token: "primary", value: string) => void }) => (
-    <button type="button" onClick={() => onSetVar("primary", "#112233")}>
-      Set primary token
-    </button>
-  ),
-}));
-
-vi.mock("@/components/theme/RawCssEditor", () => ({
-  RawCssEditor: ({ value, onChange }: { value: string; onChange: (css: string) => void }) => (
-    <textarea
-      aria-label="Custom CSS editor"
-      value={value}
-      onChange={(event) => onChange(event.target.value)}
-    />
-  ),
-}));
-
-vi.mock("@/components/theme/ThemePreviewCard", () => ({
-  ThemePreviewCard: () => null,
-}));
-
 vi.mock("@/components/overlays/OverlayPreviewCard", () => ({
   OverlayPreviewCard: ({ variant }: { variant?: string }) => (
     <div data-testid="overlay-preview">{variant}</div>
@@ -98,60 +77,48 @@ let form: ReturnType<typeof makeForm>;
 describe("AppearanceSettings", () => {
   beforeEach(() => {
     localStorage.clear();
+    brandingState.storageAvailable = true;
     form = makeForm();
     useSettingsFormMock.mockReset();
     useSettingsFormMock.mockImplementation(() => form);
   });
 
-  it("stages the accent color and its theme tokens instead of saving immediately", () => {
+  it("points unavailable uploads at artwork storage, not an S3 bucket", () => {
+    brandingState.storageAvailable = false;
+    render(<AppearanceSettings />);
+
+    expect(
+      screen.getByText(/Image uploads need artwork storage \(local disk or S3\)/),
+    ).toBeInTheDocument();
+    expect(screen.queryByText(/public S3 bucket/)).not.toBeInTheDocument();
+  });
+
+  // The accent is the only color an admin picks: it is staged as the one
+  // branding key, with no token overrides or custom CSS beside it.
+  it("stages the accent color alone and offers no other theme controls", () => {
     render(<AppearanceSettings />);
 
     const keys = useSettingsFormMock.mock.calls[0]?.[0]?.keys as string[];
-    expect(keys).toEqual(
-      expect.arrayContaining([
-        "branding.accent_color",
-        "ui.admin_theme_vars",
-        "ui.admin_custom_css",
-        "overlays.enabled",
-        "defaults.card_overlays",
-      ]),
-    );
-    expect(keys).not.toContain("branding.server_name");
-    expect(keys).not.toContain("branding.login_subtitle");
-    expect(keys).not.toContain("branding.default_theme");
-    expect(keys).not.toContain("theme.catalog_url");
+    expect(keys).toEqual(["branding.accent_color", "overlays.enabled", "defaults.card_overlays"]);
 
     fireEvent.click(screen.getByRole("button", { name: "Use accent #10b981" }));
 
     expect(form.save).not.toHaveBeenCalled();
+    expect(form.setValue).toHaveBeenCalledTimes(1);
     expect(form.setValue).toHaveBeenCalledWith("branding.accent_color", "#10b981");
-    expect(form.setValue).toHaveBeenCalledWith(
-      "ui.admin_theme_vars",
-      JSON.stringify({
-        primary: "#10b981",
-        ring: "#10b981",
-        "sidebar-primary": "#10b981",
-      }),
-    );
+
+    expect(screen.queryByText("Custom CSS")).toBeNull();
+    expect(screen.queryByText("Individual colors and fonts")).toBeNull();
+    expect(screen.queryByRole("button", { name: /Reset to Cinema Dark/ })).toBeNull();
   });
 
-  // Like restoring badge defaults, the reset is a staged edit confirmed
-  // through the SaveBar.
-  it("stages a reset of accent, tokens and CSS back to Cinema Dark", () => {
-    form = makeForm({
-      "branding.accent_color": "#10b981",
-      "ui.admin_theme_vars": JSON.stringify({ primary: "#10b981", background: "#000000" }),
-      "ui.admin_custom_css": "body { color: red; }",
-    });
+  it("clears the accent with the default swatch", () => {
+    form = makeForm({ "branding.accent_color": "#10b981" });
     render(<AppearanceSettings />);
 
-    fireEvent.click(screen.getByRole("button", { name: /Reset to Cinema Dark/ }));
-    expect(form.setValue).not.toHaveBeenCalled();
-    fireEvent.click(screen.getByRole("button", { name: "Reset" }));
+    fireEvent.click(screen.getByRole("button", { name: "Use theme default accent" }));
 
     expect(form.setValue).toHaveBeenCalledWith("branding.accent_color", "");
-    expect(form.setValue).toHaveBeenCalledWith("ui.admin_theme_vars", "{}");
-    expect(form.setValue).toHaveBeenCalledWith("ui.admin_custom_css", "");
     expect(form.save).not.toHaveBeenCalled();
   });
 
@@ -174,22 +141,17 @@ describe("AppearanceSettings", () => {
     expect(form.setValue).not.toHaveBeenCalledWith("overlays.enabled", expect.anything());
   });
 
-  it("stages sanitized CSS while the editor keeps showing what was typed", () => {
+  it("lists every badge in view and stages a badge edit", () => {
     render(<AppearanceSettings />);
 
-    fireEvent.click(screen.getByRole("button", { name: /Advanced · 2 settings/ }));
-    const editor = screen.getByRole("textbox", { name: "Custom CSS editor" });
-    fireEvent.change(editor, {
-      target: {
-        value: '@import "https://example.invalid/x.css"; .card { color: red; }',
-      },
-    });
+    expect(screen.queryByRole("button", { name: /^Advanced/ })).not.toBeInTheDocument();
+    const toggle = screen.getByRole("switch", { name: "Show Resolution" });
+    const wasOn = toggle.getAttribute("aria-checked") === "true";
+    fireEvent.click(toggle);
 
-    expect(form.save).not.toHaveBeenCalled();
-    expect(form.setValue).toHaveBeenCalledWith(
-      "ui.admin_custom_css",
-      "/* [blocked @import] */ .card { color: red; }",
-    );
-    expect(editor).toHaveValue('@import "https://example.invalid/x.css"; .card { color: red; }');
+    expect(form.setValue).toHaveBeenCalledTimes(1);
+    const [key, value] = form.setValue.mock.calls[0] as [string, string];
+    expect(key).toBe("defaults.card_overlays");
+    expect(JSON.parse(value).items.resolution.enabled).toBe(!wasOn);
   });
 });
diff --git a/web/src/pages/admin-settings/AppearanceSettings.tsx b/web/src/pages/admin-settings/AppearanceSettings.tsx
index 8f3842f14a..ac0b0088a0 100644
--- a/web/src/pages/admin-settings/AppearanceSettings.tsx
+++ b/web/src/pages/admin-settings/AppearanceSettings.tsx
@@ -8,12 +8,8 @@ import {
   type OverlayPreviewVariant,
 } from "@/components/overlays/OverlayPreviewCard";
 import { OverlayPreviewVariantToggle } from "@/components/overlays/OverlayPreviewVariantToggle";
-import { AdvancedSection } from "@/components/settings/AdvancedSection";
 import { SettingsPageHeader } from "@/components/settings/SettingsPageHeader";
-import { RawCssEditor } from "@/components/theme/RawCssEditor";
-import { ThemePreviewCard } from "@/components/theme/ThemePreviewCard";
-import { TokenEditor } from "@/components/theme/TokenEditor";
-import { Label } from "@/components/ui/label";
+import { SettingsSubheading } from "@/components/settings/SettingsSubheading";
 import {
   Select,
   SelectContent,
@@ -26,8 +22,6 @@ import { useBranding } from "@/hooks/useBranding";
 import { useRestartKeys } from "@/hooks/useRestartKeys";
 import { useShownRatingSources } from "@/hooks/queries/ratingsCapability";
 import { useSettingsForm } from "@/hooks/useSettingsForm";
-import { ACCENT_TOKENS, accentColorToTokens } from "@/lib/accentMapping";
-import { sanitizeCss } from "@/lib/cssSanitizer";
 import {
   buildDefaultPrefs,
   CATEGORY_META,
@@ -44,8 +38,6 @@ import {
   type OverlayPosition,
   type PresetId,
 } from "@/lib/overlays";
-import { parseVarsJson } from "@/lib/themeTokens";
-import type { ThemeToken, ThemeVarOverrides } from "@/lib/themeTokens";
 import { cn } from "@/lib/utils";
 import { FieldGroup } from "./FieldGroup";
 import { SaveBar } from "@/components/SaveBar";
@@ -67,14 +59,19 @@ const ACCENT_PRESETS = [
 ];
 
 const ACCENT_KEY = "branding.accent_color";
-const THEME_VARS_KEY = "ui.admin_theme_vars";
-const CUSTOM_CSS_KEY = "ui.admin_custom_css";
 const OVERLAYS_ENABLED_KEY = "overlays.enabled";
 const OVERLAY_DEFAULTS_KEY = "defaults.card_overlays";
 
-const THEME_KEYS = [ACCENT_KEY, THEME_VARS_KEY, CUSTOM_CSS_KEY];
-
+/**
+ * Every appearance key the page stages, saved as one batch by the shared
+ * SaveBar. Asset uploads keep their own upload/delete mutations because a file
+ * picker has no draft to batch.
+ *
+ * Server name and login subtitle deliberately live on the General page: they are
+ * server identity, not look and feel.
+ */
 const OVERLAY_KEYS = [OVERLAYS_ENABLED_KEY, OVERLAY_DEFAULTS_KEY];
+const KEYS = [ACCENT_KEY, ...OVERLAY_KEYS];
 
 /**
  * Prairie's built-in overlay configuration, derived from the registry's own
@@ -83,35 +80,13 @@ const OVERLAY_KEYS = [OVERLAYS_ENABLED_KEY, OVERLAY_DEFAULTS_KEY];
  */
 const BUILT_IN_OVERLAY_DEFAULTS = serializeOverlayPrefs(buildDefaultPrefs());
 
-/**
- * Every appearance key the page stages, saved as one batch by the shared
- * SaveBar. Theming used to autosave each keystroke through
- * `useUpdateServerSetting`; it now shares this form so the whole page has one
- * save model. Asset uploads keep their own upload/delete mutations because a
- * file picker has no draft to batch.
- *
- * Server name and login subtitle deliberately live on the General page: they are
- * server identity, not look and feel.
- */
-const KEYS = [...THEME_KEYS, ...OVERLAY_KEYS];
-
 export default function AppearanceSettings() {
   const form = useSettingsForm({ keys: useMemo(() => KEYS, []) });
   const branding = useBranding();
   const restartKeys = useRestartKeys();
   const shownRatingSources = useShownRatingSources();
 
-  // The CSS box shows exactly what was typed while the staged value is the
-  // sanitized copy that will be saved, so stripping an external @import never
-  // rewrites the text under the cursor.
-  const [cssDraft, setCssDraft] = useState<string | null>(null);
-  // The accent picker and the style preset write the same keys as the advanced
-  // controls, so plain dirty state would pop the disclosure open on an
-  // essential edit. Track use of the advanced controls themselves instead.
-  const [tokensTouched, setTokensTouched] = useState(false);
-  const [overlayItemsTouched, setOverlayItemsTouched] = useState(false);
   const [confirmRestoreOverlaysOpen, setConfirmRestoreOverlaysOpen] = useState(false);
-  const [confirmResetThemeOpen, setConfirmResetThemeOpen] = useState(false);
   // Which sample the badge preview stands in for. View state only — show-only
   // overlays (network, show status) are otherwise impossible to see here.
   const [previewVariant, setPreviewVariant] = useState<OverlayPreviewVariant>("movie");
@@ -120,13 +95,6 @@ export default function AppearanceSettings() {
   const customAccentActive =
     Boolean(accentColor) &&
     !ACCENT_PRESETS.some((hex) => hex.toLowerCase() === accentColor.toLowerCase());
-  const vars = parseVarsJson(form.getValue(THEME_VARS_KEY));
-  const savedCss = form.getValue(CUSTOM_CSS_KEY);
-  const rawCss = cssDraft ?? savedCss;
-  // Cinema Dark is the only base theme, so "no customization" is exactly
-  // Cinema Dark as shipped.
-  const hasThemeOverrides =
-    Object.keys(vars).length > 0 || rawCss.length > 0 || Boolean(accentColor);
 
   // s3.public_bucket is not staged here, but getValue falls back to the full
   // settings response so the uploads can still be gated on it.
@@ -140,53 +108,6 @@ export default function AppearanceSettings() {
   const overlayDefaultsAreBuiltIn =
     serializeOverlayPrefs(overlayPrefs) === BUILT_IN_OVERLAY_DEFAULTS;
 
-  const setVars = (next: ThemeVarOverrides) => form.setValue(THEME_VARS_KEY, JSON.stringify(next));
-
-  // Accent recolors the primary action color, focus ring, and sidebar accent
-  // (ACCENT_TOKENS). It merges into the staged token overrides so a pick never
-  // clobbers the advanced editor and repeated picks compound correctly.
-  const applyAccent = (hex: string) => {
-    setVars({ ...vars, ...accentColorToTokens(hex) });
-    form.setValue(ACCENT_KEY, hex);
-  };
-
-  const clearAccent = () => {
-    const next = { ...vars };
-    for (const token of ACCENT_TOKENS) {
-      delete next[token];
-    }
-    setVars(next);
-    form.setValue(ACCENT_KEY, "");
-  };
-
-  const setToken = (token: ThemeToken, value: string) => {
-    setTokensTouched(true);
-    setVars({ ...vars, [token]: value });
-  };
-
-  const resetToken = (token: ThemeToken) => {
-    setTokensTouched(true);
-    const next = { ...vars };
-    delete next[token];
-    setVars(next);
-  };
-
-  const handleCssChange = (css: string) => {
-    setTokensTouched(true);
-    setCssDraft(css);
-    form.setValue(CUSTOM_CSS_KEY, sanitizeCss(css));
-  };
-
-  // Staged like any other edit: the admin still confirms the batch through the
-  // SaveBar, and Discard puts the previous customization back.
-  const resetToCinemaDark = () => {
-    setConfirmResetThemeOpen(false);
-    setCssDraft("");
-    setVars({});
-    form.setValue(CUSTOM_CSS_KEY, "");
-    form.setValue(ACCENT_KEY, "");
-  };
-
   const setOverlayPrefs = (next: CardOverlayPrefs) =>
     form.setValue(OVERLAY_DEFAULTS_KEY, serializeOverlayPrefs(next));
 
@@ -194,7 +115,6 @@ export default function AppearanceSettings() {
     id: OverlayId,
     patch: Partial<CardOverlayPrefs["items"][OverlayId]>,
   ) => {
-    setOverlayItemsTouched(true);
     setOverlayPrefs({
       ...overlayPrefs,
       items: {
@@ -212,22 +132,13 @@ export default function AppearanceSettings() {
     form.setValue(OVERLAY_DEFAULTS_KEY, BUILT_IN_OVERLAY_DEFAULTS);
   };
 
-  // Discarding has to drop the untouched CSS draft too, otherwise the box would
-  // keep showing text that is no longer staged.
-  const discard = () => {
-    setCssDraft(null);
-    form.discard();
-  };
-
-  const themeAdvancedDirty = tokensTouched || form.isDirty(CUSTOM_CSS_KEY);
-
   const allRestart = (keys: string[]) => keys.every((key) => restartKeys.has(key));
 
   if (form.isLoading) return <div>Loading...</div>;
 
   return (
     <div className="flex h-full flex-col">
-      <SettingsPageHeader title="Appearance" className="mb-8" />
+      <SettingsPageHeader title="Appearance" />
 
       <div className="flex-1 space-y-5">
         <FieldGroup label="Logos and icons">
@@ -239,9 +150,8 @@ export default function AppearanceSettings() {
                   <>Restart the server to finish enabling image uploads.</>
                 ) : (
                   <>
-                    Image uploads need a public S3 bucket, set in{" "}
-                    <span className="text-foreground font-medium">Storage &amp; Database</span>{" "}
-                    settings.
+                    Image uploads need artwork storage (local disk or S3), set in{" "}
+                    <span className="text-foreground font-medium">Storage</span> settings.
                   </>
                 )}
               </p>
@@ -288,21 +198,7 @@ export default function AppearanceSettings() {
           </div>
         </FieldGroup>
 
-        <FieldGroup
-          label="Colors"
-          restartAll={allRestart(THEME_KEYS)}
-          actions={
-            <button
-              type="button"
-              onClick={() => setConfirmResetThemeOpen(true)}
-              disabled={!hasThemeOverrides}
-              className="text-muted-foreground hover:text-destructive inline-flex items-center gap-1.5 text-xs font-medium transition-colors disabled:pointer-events-none disabled:opacity-40"
-            >
-              <RotateCcw className="h-3 w-3" aria-hidden="true" />
-              Reset to Cinema Dark
-            </button>
-          }
-        >
+        <FieldGroup label="Colors" restartAll={restartKeys.has(ACCENT_KEY)}>
           <SettingFieldRow
             label="Accent color"
             description="Recolors buttons, focus outlines, and the sidebar."
@@ -314,7 +210,7 @@ export default function AppearanceSettings() {
                   matches no preset. */}
               <button
                 type="button"
-                onClick={clearAccent}
+                onClick={() => form.setValue(ACCENT_KEY, "")}
                 aria-label="Use theme default accent"
                 aria-pressed={!accentColor}
                 title="Theme default"
@@ -333,7 +229,7 @@ export default function AppearanceSettings() {
                   <button
                     key={hex}
                     type="button"
-                    onClick={() => applyAccent(hex)}
+                    onClick={() => form.setValue(ACCENT_KEY, hex)}
                     aria-label={`Use accent ${hex}`}
                     aria-pressed={selected}
                     className={cn(
@@ -362,7 +258,7 @@ export default function AppearanceSettings() {
                   type="color"
                   aria-label="Custom accent color"
                   value={accentColor || "#4f46e5"}
-                  onChange={(e) => applyAccent(e.target.value)}
+                  onChange={(e) => form.setValue(ACCENT_KEY, e.target.value)}
                   className="h-5 w-5 cursor-pointer border-0 bg-transparent p-0"
                 />
                 Custom
@@ -370,29 +266,6 @@ export default function AppearanceSettings() {
               </label>
             </div>
           </SettingFieldRow>
-
-          <AdvancedSection id="appearance.theme" count={2} forceOpen={themeAdvancedDirty}>
-            <div className="space-y-3 py-3.5">
-              <div className="space-y-1">
-                <Label className="text-sm font-medium">Individual colors and fonts</Label>
-                <p className="text-muted-foreground text-xs leading-relaxed">
-                  Applied on top of Cinema Dark for everyone.
-                </p>
-              </div>
-              <ThemePreviewCard vars={vars} />
-              <TokenEditor vars={vars} onSetVar={setToken} onResetVar={resetToken} />
-            </div>
-
-            <div className="space-y-2 py-3.5">
-              <div className="space-y-1">
-                <Label className="text-sm font-medium">Custom CSS</Label>
-                <p className="text-muted-foreground text-xs leading-relaxed">
-                  Applied to every page after the theme.
-                </p>
-              </div>
-              <RawCssEditor value={rawCss} onChange={handleCssChange} />
-            </div>
-          </AdvancedSection>
         </FieldGroup>
 
         <FieldGroup
@@ -412,7 +285,7 @@ export default function AppearanceSettings() {
         >
           <SettingField
             label="Show badges on poster art"
-            description="Off hides badges for everyone."
+            description="The default for every profile. A profile that turns badges on or off for itself keeps its own choice."
             type="toggle"
             value={form.getValue(OVERLAYS_ENABLED_KEY) || "true"}
             onChange={(v) => form.setValue(OVERLAYS_ENABLED_KEY, v)}
@@ -448,7 +321,7 @@ export default function AppearanceSettings() {
             </SettingFieldRow>
             <div className="border-border/70 bg-foreground/[0.02] mb-4 rounded-xl border p-3">
               <div className="flex items-center justify-between gap-3 px-1">
-                <span className="text-muted-foreground text-[11px] font-medium tracking-wide uppercase">
+                <span className="text-muted-foreground text-xs font-medium tracking-wide uppercase">
                   Preview
                 </span>
                 <OverlayPreviewVariantToggle value={previewVariant} onChange={setPreviewVariant} />
@@ -463,82 +336,59 @@ export default function AppearanceSettings() {
             inert={!overlaysEnabled}
             className={cn(overlaysEnabled ? "" : "pointer-events-none opacity-50")}
           >
-            <AdvancedSection
-              id="appearance.overlays"
-              count={OVERLAY_REGISTRY.length}
-              forceOpen={overlayItemsTouched}
-            >
-              {OVERLAY_CATEGORIES.map((category) => {
-                const overlays = OVERLAY_REGISTRY.filter(
-                  (d) => d.category === category && isOverlayOffered(d, shownRatingSources),
-                );
-                if (overlays.length === 0) return null;
-                return (
-                  <div key={category} className="min-w-0">
-                    <p className="text-muted-foreground pt-3.5 pb-1 text-xs font-medium">
-                      {CATEGORY_META[category].title}
-                    </p>
-                    <div className="settings-field-list">
-                      {overlays.map((def) => {
-                        const config = overlayPrefs.items[def.id];
-                        return (
-                          <SettingFieldRow
-                            key={def.id}
-                            label={def.label}
-                            description={def.description}
+            {OVERLAY_CATEGORIES.map((category) => {
+              const overlays = OVERLAY_REGISTRY.filter(
+                (d) => d.category === category && isOverlayOffered(d, shownRatingSources),
+              );
+              if (overlays.length === 0) return null;
+              return (
+                <div key={category} className="min-w-0">
+                  <SettingsSubheading>{CATEGORY_META[category].title}</SettingsSubheading>
+                  <div className="settings-field-list">
+                    {overlays.map((def) => {
+                      const config = overlayPrefs.items[def.id];
+                      return (
+                        <SettingFieldRow
+                          key={def.id}
+                          label={def.label}
+                          description={def.description}
+                        >
+                          <Select
+                            value={config.position}
+                            disabled={!config.enabled}
+                            onValueChange={(pos) =>
+                              updateOverlayItem(def.id, { position: pos as OverlayPosition })
+                            }
                           >
-                            <Select
-                              value={config.position}
-                              disabled={!config.enabled}
-                              onValueChange={(pos) =>
-                                updateOverlayItem(def.id, {
-                                  position: pos as OverlayPosition,
-                                })
-                              }
-                            >
-                              <SelectTrigger
-                                className="w-[130px]"
-                                aria-label={`${def.label} corner`}
-                              >
-                                <SelectValue />
-                              </SelectTrigger>
-                              <SelectContent>
-                                {POSITION_OPTIONS.map((opt) => (
-                                  <SelectItem key={opt.value} value={opt.value}>
-                                    {opt.label}
-                                  </SelectItem>
-                                ))}
-                              </SelectContent>
-                            </Select>
-                            <Switch
-                              checked={config.enabled}
-                              aria-label={`Show ${def.label}`}
-                              onCheckedChange={(checked) =>
-                                updateOverlayItem(def.id, { enabled: checked })
-                              }
-                            />
-                          </SettingFieldRow>
-                        );
-                      })}
-                    </div>
+                            <SelectTrigger className="w-[130px]" aria-label={`${def.label} corner`}>
+                              <SelectValue />
+                            </SelectTrigger>
+                            <SelectContent>
+                              {POSITION_OPTIONS.map((opt) => (
+                                <SelectItem key={opt.value} value={opt.value}>
+                                  {opt.label}
+                                </SelectItem>
+                              ))}
+                            </SelectContent>
+                          </Select>
+                          <Switch
+                            checked={config.enabled}
+                            aria-label={`Show ${def.label}`}
+                            onCheckedChange={(checked) =>
+                              updateOverlayItem(def.id, { enabled: checked })
+                            }
+                          />
+                        </SettingFieldRow>
+                      );
+                    })}
                   </div>
-                );
-              })}
-            </AdvancedSection>
+                </div>
+              );
+            })}
           </div>
         </FieldGroup>
       </div>
 
-      <ConfirmDialog
-        open={confirmResetThemeOpen}
-        onOpenChange={setConfirmResetThemeOpen}
-        title="Reset to Cinema Dark"
-        description="Remove the accent color, individual color and font overrides, and custom CSS, so everyone sees Cinema Dark as shipped. Nothing is written until you save."
-        confirmLabel="Reset"
-        variant="destructive"
-        onConfirm={resetToCinemaDark}
-      />
-
       <ConfirmDialog
         open={confirmRestoreOverlaysOpen}
         onOpenChange={setConfirmRestoreOverlaysOpen}
@@ -551,17 +401,8 @@ export default function AppearanceSettings() {
 
       <SaveBar
         dirtyCount={form.dirtyCount}
-        onSave={() => {
-          // What persists is the SANITIZED css. Dropping the raw draft on
-          // success flips the editor to the canonical saved value, so stripped
-          // content (an external @import, say) never lingers on screen looking
-          // accepted. On failure the draft stays; the mutation already toasts.
-          void form.save().then(
-            () => setCssDraft(null),
-            () => {},
-          );
-        }}
-        onDiscard={discard}
+        onSave={form.save}
+        onDiscard={form.discard}
         isSaving={form.isSaving}
       />
     </div>
diff --git a/web/src/pages/AdminAutoscanSettingsWrite.test.tsx b/web/src/pages/admin-settings/AutoscanSettings.test.tsx
similarity index 55%
rename from web/src/pages/AdminAutoscanSettingsWrite.test.tsx
rename to web/src/pages/admin-settings/AutoscanSettings.test.tsx
index 9f65d29547..a104ccfe49 100644
--- a/web/src/pages/AdminAutoscanSettingsWrite.test.tsx
+++ b/web/src/pages/admin-settings/AutoscanSettings.test.tsx
@@ -3,10 +3,8 @@ import { MemoryRouter } from "react-router";
 import { act, cleanup, fireEvent, render, screen, waitFor } from "@testing-library/react";
 import { afterEach, beforeEach, it, expect, vi } from "vitest";
 import { setAccessToken, setProfileId, setProfileToken } from "@/api/client";
-import AdminAutoscan from "./AdminAutoscan";
+import AutoscanSettings from "./AutoscanSettings";
 vi.mock("@/pages/admin/autoscan/ConnectionsPanel", () => ({ default: () => null }));
-vi.mock("@/pages/admin/autoscan/ActivityPanel", () => ({ default: () => null }));
-vi.mock("@/pages/admin/autoscan/SourcesPanel", () => ({ default: () => null }));
 beforeEach(() => {
   localStorage.clear();
   sessionStorage.clear();
@@ -21,13 +19,16 @@ afterEach(() => {
 function setup() {
   let stored = { enabled: true, default_poll_interval_seconds: 300, debounce_seconds: 10 };
   let finish!: () => void;
+  let failReads = false;
   const writes: (typeof stored)[] = [];
   const reply = (body: unknown) =>
     new Response(JSON.stringify(body), { headers: { "Content-Type": "application/json" } });
   vi.stubGlobal(
     "fetch",
     vi.fn((_url: unknown, init: RequestInit) => {
-      if (init.method !== "PUT") return Promise.resolve(reply(stored));
+      if (init.method !== "PUT") {
+        return Promise.resolve(failReads ? new Response("", { status: 500 }) : reply(stored));
+      }
       const body = JSON.parse(String(init.body)) as typeof stored;
       writes.push(body);
       return new Promise<Response>((resolve) => {
@@ -41,32 +42,42 @@ function setup() {
   const client = new QueryClient({
     defaultOptions: { queries: { retry: false }, mutations: { retry: 3 } },
   });
-  render(
-    <MemoryRouter initialEntries={["/?tab=settings"]}>
+  // A fresh element each time, so a rerender reaches the page.
+  const tree = () => (
+    <MemoryRouter>
       <QueryClientProvider client={client}>
-        <AdminAutoscan />
+        <AutoscanSettings />
       </QueryClientProvider>
-    </MemoryRouter>,
+    </MemoryRouter>
   );
-  return { writes, finish: () => act(async () => finish()) };
+  const { rerender } = render(tree());
+  return {
+    writes,
+    client,
+    failReads: () => {
+      failReads = true;
+    },
+    finish: () => act(async () => finish()),
+    rerender: () => rerender(tree()),
+  };
 }
 it.each([false, true])("explicit save keeps later edits=%s", async (changed) => {
   const f = setup();
-  const input = await screen.findByLabelText("Default check interval (seconds)");
+  const input = await screen.findByLabelText("Default check interval");
   fireEvent.change(input, { target: { value: "120" } });
   fireEvent.blur(input);
   expect(f.writes).toHaveLength(0);
-  fireEvent.click(screen.getByRole("button", { name: "Save settings" }));
+  fireEvent.click(screen.getByRole("button", { name: "Save" }));
   await waitFor(() => expect(f.writes).toHaveLength(1));
   if (changed) fireEvent.change(input, { target: { value: "240" } });
   await f.finish();
   await waitFor(() =>
-    expect(
-      (screen.getByLabelText("Default check interval (seconds)") as HTMLInputElement).value,
-    ).toBe(changed ? "240" : "120"),
+    expect((screen.getByLabelText("Default check interval") as HTMLInputElement).value).toBe(
+      changed ? "240" : "120",
+    ),
   );
   if (changed) {
-    fireEvent.click(screen.getByRole("button", { name: "Save settings" }));
+    fireEvent.click(screen.getByRole("button", { name: "Save" }));
     await waitFor(() => expect(f.writes).toHaveLength(2));
     expect(f.writes[1]?.default_poll_interval_seconds).toBe(240);
     await f.finish();
@@ -74,10 +85,30 @@ it.each([false, true])("explicit save keeps later edits=%s", async (changed) =>
 });
 it("does not submit a retained draft under a replacement authority", async () => {
   const f = setup();
-  const input = await screen.findByLabelText("Default check interval (seconds)");
+  const input = await screen.findByLabelText("Default check interval");
   fireEvent.change(input, { target: { value: "120" } });
+  expect(screen.getByRole("button", { name: "Save" })).toBeTruthy();
   act(() => setProfileToken("pin-b"));
-  // An observable local rerender resolves the current authority without remounting the form.
-  fireEvent.click(screen.getByRole("button", { name: "Save settings" }));
-  await waitFor(() => expect(f.writes).toHaveLength(0));
+  // A rerender resolves the current authority without remounting the form. The
+  // draft belonged to the old profile, so there is nothing left to save.
+  f.rerender();
+  const reloaded = (await screen.findByLabelText("Default check interval")) as HTMLInputElement;
+  expect(reloaded.value).toBe("300");
+  expect(screen.queryByRole("button", { name: "Save" })).toBeNull();
+  expect(f.writes).toHaveLength(0);
+});
+
+it("does not send a draft hidden by a failed refetch", async () => {
+  const f = setup();
+  const input = await screen.findByLabelText("Default check interval");
+  fireEvent.change(input, { target: { value: "120" } });
+  f.failReads();
+  await act(() => f.client.refetchQueries());
+  await screen.findByRole("alert");
+  expect(screen.queryByLabelText("Default check interval")).toBeNull();
+
+  fireEvent.click(screen.getByRole("button", { name: "Save" }));
+  // The write would go out on a later tick; let it.
+  await act(() => new Promise((resolve) => setTimeout(resolve, 50)));
+  expect(f.writes).toHaveLength(0);
 });
diff --git a/web/src/pages/admin-settings/AutoscanSettings.tsx b/web/src/pages/admin-settings/AutoscanSettings.tsx
new file mode 100644
index 0000000000..463b4dd2e6
--- /dev/null
+++ b/web/src/pages/admin-settings/AutoscanSettings.tsx
@@ -0,0 +1,148 @@
+import { useState } from "react";
+
+import {
+  captureProfileRequestContext,
+  isCapturedProfileAuthorityActive,
+  type ProfileRequestContextSnapshot,
+} from "@/api/client";
+import type { AutoscanSettings as AutoscanSettingsValue } from "@/api/types";
+import { SaveBar } from "@/components/SaveBar";
+import { SettingsPageHeader } from "@/components/settings/SettingsPageHeader";
+import { Skeleton } from "@/components/ui/skeleton";
+import { useAutoscanSettings, useUpdateAutoscanSettings } from "@/hooks/queries/useAutoscan";
+import { useReportUnsavedChanges } from "@/hooks/useUnsavedChanges";
+import ConnectionsPanel from "@/pages/admin/autoscan/ConnectionsPanel";
+
+import { FieldGroup } from "./FieldGroup";
+import { SettingField } from "./SettingField";
+
+type PollingDefaults = Pick<
+  AutoscanSettingsValue,
+  "default_poll_interval_seconds" | "debounce_seconds"
+>;
+
+/**
+ * Autoscan › Settings: the polling defaults and the saved server connections.
+ * Turning Autoscan on and running it stay on Sources, beside the sources they
+ * act on. These are not `server_settings` rows, so the page keeps its own
+ * draft, but it saves through the same save bar and unsaved-changes prompt.
+ */
+export default function AutoscanSettings() {
+  const settings = useAutoscanSettings();
+  const readAuthority = captureProfileRequestContext();
+  const updateSettings = useUpdateAutoscanSettings();
+
+  // A draft belongs to the profile that started it; switching profile drops it
+  // rather than saving one profile's edit under another's authority.
+  const [draft, setDraft] = useState<{
+    value: PollingDefaults;
+    authority: ProfileRequestContextSnapshot;
+  } | null>(null);
+  const activeDraft = draft && isCapturedProfileAuthorityActive(draft.authority) ? draft : null;
+  const saved = settings.data;
+  const effective = activeDraft?.value ?? saved;
+
+  const isDirty = (key: keyof PollingDefaults) =>
+    !!activeDraft && !!saved && activeDraft.value[key] !== saved[key];
+  const intervalDirty = isDirty("default_poll_interval_seconds");
+  const debounceDirty = isDirty("debounce_seconds");
+  const dirtyCount = Number(intervalDirty) + Number(debounceDirty);
+  useReportUnsavedChanges(dirtyCount > 0);
+
+  function edit(delta: Partial<PollingDefaults>) {
+    const authority = captureProfileRequestContext();
+    if (
+      !authority ||
+      !effective ||
+      !readAuthority ||
+      !isCapturedProfileAuthorityActive(readAuthority)
+    )
+      return;
+    setDraft({
+      value: {
+        default_poll_interval_seconds: effective.default_poll_interval_seconds,
+        debounce_seconds: effective.debounce_seconds,
+        ...delta,
+      },
+      authority,
+    });
+  }
+
+  function save() {
+    // A failed refetch hides the fields behind "Reload before editing", so the
+    // draft can no longer be seen and must not be sent.
+    if (
+      !activeDraft ||
+      !saved ||
+      settings.isError ||
+      updateSettings.isPending ||
+      !readAuthority ||
+      !isCapturedProfileAuthorityActive(readAuthority)
+    )
+      return;
+    const captured = draft;
+    // Only the two defaults are this page's; the on/off switch is on Sources
+    // and may have changed since the draft started.
+    updateSettings.mutate(
+      { ...saved, ...activeDraft.value },
+      { onSuccess: () => setDraft((current) => (current === captured ? null : current)) },
+    );
+  }
+
+  if (settings.isLoading)
+    return (
+      <div className="space-y-6" role="status" aria-label="Loading settings">
+        <Skeleton className="h-8 w-48" />
+        <Skeleton className="h-10 w-full" />
+        <Skeleton className="h-10 w-full" />
+        <span className="sr-only">Loading settings</span>
+      </div>
+    );
+
+  return (
+    <div className="flex h-full flex-col">
+      <SettingsPageHeader title="Autoscan" />
+
+      <div className="flex-1 space-y-5">
+        {!effective || settings.isError ? (
+          <p role="alert" className="text-sm">
+            Autoscan settings could not be loaded. Reload before editing.
+          </p>
+        ) : (
+          <FieldGroup
+            label="Polling defaults"
+            description="Used by sources that don't set their own."
+            dirty={dirtyCount > 0}
+          >
+            <SettingField
+              label="Default check interval"
+              type="number"
+              unit="seconds"
+              dirty={intervalDirty}
+              value={String(effective.default_poll_interval_seconds)}
+              onChange={(value) => edit({ default_poll_interval_seconds: Number(value) || 300 })}
+            />
+            <SettingField
+              label="Debounce"
+              type="number"
+              unit="seconds"
+              description="Skips repeat reports of an unchanged file within this window. Changed or deleted files still scan."
+              dirty={debounceDirty}
+              value={String(effective.debounce_seconds)}
+              onChange={(value) => edit({ debounce_seconds: Number(value) || 0 })}
+            />
+          </FieldGroup>
+        )}
+
+        <ConnectionsPanel />
+      </div>
+
+      <SaveBar
+        dirtyCount={dirtyCount}
+        onSave={save}
+        onDiscard={() => setDraft(null)}
+        isSaving={updateSettings.isPending}
+      />
+    </div>
+  );
+}
diff --git a/web/src/pages/admin-settings/CompatibilityProxiesSettings.test.tsx b/web/src/pages/admin-settings/CompatibilityProxiesSettings.test.tsx
new file mode 100644
index 0000000000..adc64a6d10
--- /dev/null
+++ b/web/src/pages/admin-settings/CompatibilityProxiesSettings.test.tsx
@@ -0,0 +1,170 @@
+import { render, screen, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { MemoryRouter } from "react-router";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import CompatibilityProxiesSettings from "./CompatibilityProxiesSettings";
+
+const useSettingsFormMock = vi.fn();
+
+vi.mock("@/hooks/useSettingsForm", () => ({
+  useSettingsForm: (...args: unknown[]) => useSettingsFormMock(...args),
+}));
+
+vi.mock("@/hooks/useRestartKeys", () => ({
+  useRestartKeys: () => new Set<string>(),
+}));
+
+let compatStatus: Record<string, unknown> = {};
+
+vi.mock("@/hooks/queries/admin/settings", () => ({
+  useJellyfinCompatStatus: () => ({ data: compatStatus, isLoading: false }),
+  useInstallJellyfinCompatWeb: () => ({ mutate: vi.fn(), isPending: false }),
+  useRemoveJellyfinCompatWeb: () => ({ mutate: vi.fn(), isPending: false }),
+  useUpdateJellyfinCompatSettings: () => ({ mutate: vi.fn(), isPending: false }),
+}));
+
+const DEFAULTS: Record<string, string> = {
+  "jellyfin_compat.enabled": "true",
+  "jellyfin_compat.public_url": "https://media.example.com",
+  "jellyfin_compat.server_name": "Prairie",
+  "jellyfin_compat.server_id": "4f1c0f8e2b6d4c1a9e3f7a2b5c8d0e1f",
+  "jellyfin_compat.emulated_server_version": "12.1.0",
+  "jellyfin_compat.session_ttl": "87600h",
+  "jellyfin_compat.playback_session_ttl": "6h",
+  "jellyfin_compat.web_enabled": "true",
+  "jellyfin_compat.web_version": "12.1",
+  "jellyfin_compat.web_install_dir": "/var/lib/prairie/jellyfin-web",
+  "audiobookshelf_compat.enabled": "false",
+};
+
+function makeForm(overrides: Record<string, string> = {}, dirty: string[] = []) {
+  const values = { ...DEFAULTS, ...overrides };
+  return {
+    isLoading: false,
+    getValue: (key: string) => values[key] ?? "",
+    setValue: vi.fn(),
+    isDirty: (key: string) => dirty.includes(key),
+    dirtyKeys: dirty,
+    dirtyCount: dirty.length,
+    save: vi.fn(),
+    discard: vi.fn(),
+    isSaving: false,
+    restartRequired: false,
+    sensitiveConfigured: [],
+    sensitiveManagedByEnv: [],
+  };
+}
+
+function renderPage() {
+  return render(
+    <MemoryRouter>
+      <CompatibilityProxiesSettings />
+    </MemoryRouter>,
+  );
+}
+
+const LOOPBACK_WARNING =
+  "Only this server can reach that address. Use one other devices can reach.";
+
+describe("CompatibilityProxiesSettings", () => {
+  beforeEach(() => {
+    localStorage.clear();
+    compatStatus = { enabled: true, web_enabled: true, web_state: "missing", api_state: "running" };
+    useSettingsFormMock.mockReset();
+    useSettingsFormMock.mockReturnValue(makeForm());
+  });
+
+  it("shows the server ID read-only, saying what changing it does", async () => {
+    renderPage();
+    const jellyfin = screen.getByRole("group", { name: "Jellyfin" });
+    await userEvent.click(within(jellyfin).getByRole("button", { name: "Advanced · 7 settings" }));
+
+    expect(within(jellyfin).getByText(DEFAULTS["jellyfin_compat.server_id"]!)).toBeInTheDocument();
+    expect(
+      within(jellyfin).getByText(
+        "Read-only. Changing it makes every Jellyfin app see a new server.",
+      ),
+    ).toBeInTheDocument();
+    expect(within(jellyfin).queryByRole("textbox", { name: "Server ID" })).not.toBeInTheDocument();
+    // Its key still loads so the value can be shown.
+    expect(useSettingsFormMock.mock.calls[0]?.[0]?.keys).toContain("jellyfin_compat.server_id");
+  });
+
+  it("keeps the advanced Jellyfin fields editable", async () => {
+    const form = makeForm();
+    useSettingsFormMock.mockReturnValue(form);
+    renderPage();
+    await userEvent.click(screen.getByRole("button", { name: "Advanced · 7 settings" }));
+
+    await userEvent.type(screen.getByLabelText("Name shown to Jellyfin apps"), "x");
+    expect(form.setValue).toHaveBeenCalledWith("jellyfin_compat.server_name", "Prairiex");
+    // Nothing reads branding.server_name for Jellyfin apps.
+    expect(screen.getByText("Separate from the server name on General.")).toBeInTheDocument();
+    // The default refills an emptied field, so "leave blank" is not offered.
+    expect(screen.queryByText(/Leave blank/)).not.toBeInTheDocument();
+    expect(
+      screen.getByText(
+        "The default pairs with the default reported Jellyfin version; change them together.",
+      ),
+    ).toBeInTheDocument();
+  });
+
+  it.each([
+    "http://127.0.0.1:8096",
+    "http://localhost:8096",
+    "http://[::1]:8096",
+    "127.0.0.2",
+    "HTTP://LOCALHOST",
+  ])("warns that %s only reaches the server itself", (address) => {
+    useSettingsFormMock.mockReturnValue(makeForm({ "jellyfin_compat.public_url": address }));
+    renderPage();
+
+    expect(screen.getByText(LOOPBACK_WARNING)).toBeInTheDocument();
+  });
+
+  it.each([
+    "https://media.example.com",
+    "http://192.168.1.10:8096",
+    "http://localhost.example.com",
+    "",
+  ])("does not warn about %j", (address) => {
+    useSettingsFormMock.mockReturnValue(makeForm({ "jellyfin_compat.public_url": address }));
+    renderPage();
+
+    expect(screen.queryByText(LOOPBACK_WARNING)).not.toBeInTheDocument();
+  });
+
+  it("does not warn about the address while Jellyfin apps are not allowed", () => {
+    useSettingsFormMock.mockReturnValue(
+      makeForm({
+        "jellyfin_compat.enabled": "false",
+        "jellyfin_compat.public_url": "http://127.0.0.1:8096",
+      }),
+    );
+    renderPage();
+
+    expect(screen.queryByText(LOOPBACK_WARNING)).not.toBeInTheDocument();
+  });
+
+  it("labels Audiobookshelf as beta", () => {
+    renderPage();
+
+    const group = screen.getByRole("group", { name: "Audiobookshelf" });
+    expect(within(group).getByText("Beta")).toBeInTheDocument();
+    expect(
+      within(group).getByRole("switch", { name: "Allow Audiobookshelf apps to connect" }),
+    ).toBeInTheDocument();
+    expect(within(screen.getByRole("group", { name: "Jellyfin" })).queryByText("Beta")).toBeNull();
+  });
+
+  it("opens the web player's download details through the shared disclosure", async () => {
+    renderPage();
+
+    const details = screen.getByRole("button", { name: "Download details" });
+    expect(details).toHaveAttribute("aria-expanded", "false");
+    expect(screen.queryByText("Listen address")).not.toBeInTheDocument();
+    await userEvent.click(details);
+    expect(screen.getByText("Listen address")).toBeInTheDocument();
+  });
+});
diff --git a/web/src/pages/admin-settings/CompatibilityProxiesSettings.tsx b/web/src/pages/admin-settings/CompatibilityProxiesSettings.tsx
index 6a3e6d9b36..0ec5c1cf0f 100644
--- a/web/src/pages/admin-settings/CompatibilityProxiesSettings.tsx
+++ b/web/src/pages/admin-settings/CompatibilityProxiesSettings.tsx
@@ -1,4 +1,4 @@
-import { useMemo, useState } from "react";
+import { useMemo } from "react";
 import {
   AlertCircle,
   CheckCircle2,
@@ -26,9 +26,14 @@ import { useSettingsForm } from "@/hooks/useSettingsForm";
 import { SaveBar } from "@/components/SaveBar";
 
 import { FieldGroup } from "./FieldGroup";
-import { SettingField, SettingFieldStatus } from "./SettingField";
+import { SettingField, SettingFieldRow, SettingFieldStatus } from "./SettingField";
 import { formatDateTime } from "@/lib/datetime";
 
+/**
+ * Rows in the Jellyfin Advanced section. The server ID is among them but is
+ * shown read-only: it is generated on first start, and every Jellyfin app
+ * keys its saved server on it.
+ */
 const JELLYFIN_ADVANCED_KEYS = [
   "jellyfin_compat.server_name",
   "jellyfin_compat.server_id",
@@ -92,6 +97,38 @@ function formatOperationPhase(value?: string): string {
   return statusLabel(value);
 }
 
+/**
+ * Whether an address points back at the server itself (127.0.0.0/8,
+ * localhost, ::1). Prairie hands this address to Jellyfin apps, and from any
+ * other device a loopback address is that device, not the server.
+ */
+function isLoopbackAddress(raw: string): boolean {
+  const trimmed = raw.trim();
+  if (!trimmed) return false;
+  let hostname: string;
+  try {
+    hostname = new URL(trimmed.includes("://") ? trimmed : `http://${trimmed}`).hostname;
+  } catch {
+    return false;
+  }
+  hostname = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+  return (
+    hostname === "localhost" ||
+    hostname.endsWith(".localhost") ||
+    hostname === "::1" ||
+    /^127(\.\d{1,3}){3}$/.test(hostname)
+  );
+}
+
+/** Marks a feature that ships outside the 1.0 support promise. */
+function BetaChip() {
+  return (
+    <span className="border-border text-muted-foreground inline-flex shrink-0 items-center rounded-md border px-1.5 py-0.5 text-xs font-medium tracking-wide">
+      Beta
+    </span>
+  );
+}
+
 function clampProgressPercent(value?: number): number | null {
   if (typeof value !== "number" || !Number.isFinite(value)) return null;
   return Math.min(100, Math.max(0, Math.round(value)));
@@ -125,7 +162,6 @@ export default function CompatibilityProxiesSettings() {
   const removeWeb = useRemoveJellyfinCompatWeb();
   const updateCompatSettings = useUpdateJellyfinCompatSettings();
   const status = statusQuery.data;
-  const [showDiagnostics, setShowDiagnostics] = useState(false);
 
   if (form.isLoading || statusQuery.isLoading)
     return (
@@ -161,6 +197,8 @@ export default function CompatibilityProxiesSettings() {
   const jellyfinWebServing = jellyfinProxyRunning && status?.web_enabled !== false;
   const installedWebAssetsPresent = Boolean(status?.installed_version);
   const pinnedJellyfinWebInstalled = hasPinnedJellyfinWebInstalled(status);
+  const publicURL = form.getValue("jellyfin_compat.public_url");
+  const serverID = form.getValue("jellyfin_compat.server_id");
 
   const setJellyfinAPIEnabled = (value: string) => {
     form.setValue("jellyfin_compat.enabled", value);
@@ -175,7 +213,7 @@ export default function CompatibilityProxiesSettings() {
 
   return (
     <div className="flex h-full flex-col">
-      <SettingsPageHeader title="Compatibility" className="mb-8" />
+      <SettingsPageHeader title="Compatibility" />
 
       <div className="flex-1 space-y-5">
         <FieldGroup label="Jellyfin" restartAll={allRestart(JELLYFIN_KEYS)}>
@@ -191,8 +229,15 @@ export default function CompatibilityProxiesSettings() {
           <SettingField
             label="Address Jellyfin apps should use"
             hint="https://media.example.com"
-            value={form.getValue("jellyfin_compat.public_url")}
+            value={publicURL}
             onChange={(v) => form.setValue("jellyfin_compat.public_url", v)}
+            status={
+              jellyfinEnabledChecked && isLoopbackAddress(publicURL) ? (
+                <SettingFieldStatus tone="warn">
+                  Only this server can reach that address. Use one other devices can reach.
+                </SettingFieldStatus>
+              ) : undefined
+            }
             restartRequired={restartKeys.has("jellyfin_compat.public_url")}
           />
 
@@ -348,46 +393,32 @@ export default function CompatibilityProxiesSettings() {
               ) : null}
             </div>
 
-            <div>
-              <Button
-                type="button"
-                size="xs"
-                variant="ghost"
-                aria-expanded={showDiagnostics}
-                onClick={() => setShowDiagnostics((current) => !current)}
-              >
-                {showDiagnostics ? "Hide download details" : "Show download details"}
-              </Button>
-              {showDiagnostics && (
-                <div className="grid gap-x-8 pt-2 md:grid-cols-2">
-                  <StatusLine
-                    label="API state"
-                    value={status ? statusLabel(status.api_state) : ""}
-                  />
-                  <StatusLine label="Listen address" value={status?.listen} mono />
-                  <StatusLine label="Public URL in use" value={status?.public_url} mono />
-                  <StatusLine
-                    label="Jellyfin version reported"
-                    value={status?.emulated_server_version}
-                  />
-                  <StatusLine label="Version chosen" value={status?.pinned_version} />
-                  <StatusLine
-                    label="Current job"
-                    value={
-                      status?.operation
-                        ? `${statusLabel(status.operation.kind)} ${statusLabel(status.operation.state)}`
-                        : "None"
-                    }
-                  />
-                  <StatusLine label="Downloaded from" value={status?.source_url} mono />
-                  <StatusLine label="Source commit" value={status?.commit_sha} mono />
-                  <StatusLine label="Checksum" value={status?.checksum} mono />
-                  <StatusLine label="Installed at" value={status?.install_path} mono />
-                  <StatusLine label="License file present" value={status?.license_present} />
-                  <StatusLine label="Download record present" value={status?.provenance_present} />
-                </div>
-              )}
-            </div>
+            <AdvancedSection id="compatibility.jellyfin.web-details" title="Download details">
+              <div className="grid gap-x-8 py-2 md:grid-cols-2">
+                <StatusLine label="API state" value={status ? statusLabel(status.api_state) : ""} />
+                <StatusLine label="Listen address" value={status?.listen} mono />
+                <StatusLine label="Public URL in use" value={status?.public_url} mono />
+                <StatusLine
+                  label="Jellyfin version reported"
+                  value={status?.emulated_server_version}
+                />
+                <StatusLine label="Version chosen" value={status?.pinned_version} />
+                <StatusLine
+                  label="Current job"
+                  value={
+                    status?.operation
+                      ? `${statusLabel(status.operation.kind)} ${statusLabel(status.operation.state)}`
+                      : "None"
+                  }
+                />
+                <StatusLine label="Downloaded from" value={status?.source_url} mono />
+                <StatusLine label="Source commit" value={status?.commit_sha} mono />
+                <StatusLine label="Checksum" value={status?.checksum} mono />
+                <StatusLine label="Installed at" value={status?.install_path} mono />
+                <StatusLine label="License file present" value={status?.license_present} />
+                <StatusLine label="Download record present" value={status?.provenance_present} />
+              </div>
+            </AdvancedSection>
           </div>
 
           <AdvancedSection
@@ -397,18 +428,21 @@ export default function CompatibilityProxiesSettings() {
           >
             <SettingField
               label="Name shown to Jellyfin apps"
-              description="Defaults to your Prairie server name."
+              // jellycompat reads only its own key, defaulting to "Prairie"; the
+              // server name on General never reaches Jellyfin apps.
+              description="Separate from the server name on General."
               value={form.getValue("jellyfin_compat.server_name")}
               onChange={(v) => form.setValue("jellyfin_compat.server_name", v)}
               restartRequired={restartKeys.has("jellyfin_compat.server_name")}
             />
-            <SettingField
+            <SettingFieldRow
               label="Server ID"
-              description="Changing it makes saved clients treat Prairie as a new server."
-              value={form.getValue("jellyfin_compat.server_id")}
-              onChange={(v) => form.setValue("jellyfin_compat.server_id", v)}
-              restartRequired={restartKeys.has("jellyfin_compat.server_id")}
-            />
+              description="Read-only. Changing it makes every Jellyfin app see a new server."
+            >
+              <span className="text-muted-foreground font-mono text-xs break-all">
+                {serverID || "Created on the next start"}
+              </span>
+            </SettingFieldRow>
             <SettingField
               label="Jellyfin version to report"
               description="Leave as is unless an app refuses to connect."
@@ -434,14 +468,17 @@ export default function CompatibilityProxiesSettings() {
             />
             <SettingField
               label="Web player version to install"
-              description="Leave blank to match the reported Jellyfin version."
+              // The effective default (DefaultJellyfinWebVersion) refills an
+              // emptied field, and Install sends what the field shows, so
+              // "leave blank to match" could never happen.
+              description="The default pairs with the default reported Jellyfin version; change them together."
               value={form.getValue("jellyfin_compat.web_version")}
               onChange={(v) => form.setValue("jellyfin_compat.web_version", v)}
               restartRequired={restartKeys.has("jellyfin_compat.web_version")}
             />
             <SettingField
               label="Web player install folder"
-              description="Leave blank to use the folder Prairie manages."
+              description="The default is the folder Prairie manages."
               value={form.getValue("jellyfin_compat.web_install_dir")}
               onChange={(v) => form.setValue("jellyfin_compat.web_install_dir", v)}
               restartRequired={restartKeys.has("jellyfin_compat.web_install_dir")}
@@ -449,7 +486,13 @@ export default function CompatibilityProxiesSettings() {
           </AdvancedSection>
         </FieldGroup>
 
-        <FieldGroup label="Audiobookshelf" restartAll={allRestart(AUDIOBOOKSHELF_KEYS)}>
+        {/* Audiobookshelf compatibility ships as beta, outside the 1.0
+            support promise (docs/architecture/v1-scope.md). */}
+        <FieldGroup
+          label="Audiobookshelf"
+          actions={<BetaChip />}
+          restartAll={allRestart(AUDIOBOOKSHELF_KEYS)}
+        >
           <SettingField
             label="Allow Audiobookshelf apps to connect"
             type="toggle"
diff --git a/web/src/pages/admin-settings/DownloadsSettings.test.tsx b/web/src/pages/admin-settings/DownloadsSettings.test.tsx
index 9713727223..12566cbe2b 100644
--- a/web/src/pages/admin-settings/DownloadsSettings.test.tsx
+++ b/web/src/pages/admin-settings/DownloadsSettings.test.tsx
@@ -1,4 +1,4 @@
-import { fireEvent, render, screen } from "@testing-library/react";
+import { fireEvent, render, screen, within } from "@testing-library/react";
 import { MemoryRouter } from "react-router";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
@@ -68,18 +68,18 @@ describe("DownloadsSettings staged edits", () => {
 
     expect(useSettingsFormMock.mock.calls[0]?.[0]?.keys).toEqual([
       "download.enabled",
+      "download.transcode_enabled",
+      "download.max_concurrent_prepares",
+      "download.artifact_dir",
+      "download.artifact_max_bytes",
+      "download.artifact_disk_ceiling_percent",
+      "download.server_bandwidth_mbps",
       "download.user_bandwidth_mbps",
       "download.max_concurrent_per_user",
       "download.max_per_period",
       "download.period_duration",
-      "download.server_bandwidth_mbps",
-      "download.transcode_enabled",
       "download.local_transcode_fallback",
-      "download.artifact_dir",
-      "download.max_concurrent_prepares",
-      "download.artifact_max_bytes",
       "download.artifact_cache_hours",
-      "download.artifact_disk_ceiling_percent",
     ]);
 
     fireEvent.click(screen.getByRole("switch", { name: /Allow downloads/i }));
@@ -89,7 +89,21 @@ describe("DownloadsSettings staged edits", () => {
     expect(form.save).not.toHaveBeenCalled();
   });
 
-  it("stages a per-user bandwidth cap", () => {
+  it("stages device-friendly copies without opening the disclosure", () => {
+    renderSettings();
+
+    expect(screen.getByRole("button", { name: /^Advanced/ })).toHaveAttribute(
+      "aria-expanded",
+      "false",
+    );
+    fireEvent.click(screen.getByRole("switch", { name: /Prepare device-friendly copies/ }));
+
+    expect(lastForm().setValue).toHaveBeenCalledWith("download.transcode_enabled", "true");
+    expect(lastForm().save).not.toHaveBeenCalled();
+  });
+
+  it("stages a per-user bandwidth cap from the Per user limits", () => {
+    expandAdvanced();
     renderSettings();
 
     fireEvent.change(screen.getByLabelText("Per-user bandwidth"), {
@@ -99,8 +113,7 @@ describe("DownloadsSettings staged edits", () => {
     expect(lastForm().setValue).toHaveBeenCalledWith("download.user_bandwidth_mbps", "25");
   });
 
-  it("stages an advanced text field", () => {
-    expandAdvanced();
+  it("stages the prepared file directory without opening the disclosure", () => {
     renderSettings();
 
     fireEvent.change(screen.getByLabelText("Prepared file directory"), {
@@ -114,9 +127,62 @@ describe("DownloadsSettings staged edits", () => {
   });
 });
 
-describe("DownloadsSettings prepared file storage budget", () => {
-  beforeEach(expandAdvanced);
+describe("DownloadsSettings tiers", () => {
+  it("shows the switches and server-wide storage until Advanced is opened", () => {
+    renderSettings();
+    const group = screen.getByRole("group", { name: "Downloads" });
+    // Row labels before the disclosure; each limit's "Unlimited" switch label
+    // is not a row.
+    const labels = Array.from(group.querySelectorAll("label"), (el) => el.textContent).filter(
+      (label) => label !== "Unlimited",
+    );
+
+    expect(labels).toEqual([
+      "Allow downloads",
+      "Prepare device-friendly copies",
+      "Files prepared at once",
+      "Prepared file directory",
+      "Default storage budget per location",
+      "Disk ceiling (%)",
+      "Server bandwidth",
+    ]);
+    expect(
+      within(group).getByRole("button", { name: "Advanced · 6 settings" }),
+    ).toBeInTheDocument();
+    expect(within(group).queryByLabelText("Per-user bandwidth")).toBeNull();
+    expect(within(group).queryByText("Keep cached files for")).toBeNull();
+  });
+
+  it("lists the bandwidth cap first among the per-user limits", () => {
+    expandAdvanced();
+    renderSettings();
+    const group = screen.getByRole("group", { name: "Downloads" });
+    // Subheadings and row labels; each limit's "Unlimited" switch label is not a row.
+    const labels = Array.from(group.querySelectorAll("h4, label"), (el) => el.textContent).filter(
+      (label) => label !== "Unlimited",
+    );
+
+    expect(labels.slice(labels.indexOf("Per user"), labels.indexOf("Whole server"))).toEqual([
+      "Per user",
+      "Per-user bandwidth",
+      "Downloads at once per user",
+      "Downloads per period",
+      "Period length",
+    ]);
+    expect(group.textContent).not.toContain("cap above");
+  });
+
+  it("opens the disclosure for an unsaved bandwidth cap", () => {
+    useSettingsFormMock.mockReturnValue(
+      makeForm({ "download.user_bandwidth_mbps": "25" }, ["download.user_bandwidth_mbps"]),
+    );
+    renderSettings();
 
+    expect(screen.getByLabelText("Per-user bandwidth")).toHaveValue(25);
+  });
+});
+
+describe("DownloadsSettings prepared file storage budget", () => {
   it("writes bytes back when a GB budget is typed", () => {
     useSettingsFormMock.mockReturnValue(makeForm({ "download.artifact_max_bytes": "53687091200" }));
     renderSettings();
@@ -155,8 +221,6 @@ describe("DownloadsSettings prepared file storage budget", () => {
 });
 
 describe("DownloadsSettings prepared file directory", () => {
-  beforeEach(expandAdvanced);
-
   const RESET = { name: "Reset Prepared file directory to default" };
 
   it("stages an empty value when an overridden directory is reset", () => {
diff --git a/web/src/pages/admin-settings/DownloadsSettings.tsx b/web/src/pages/admin-settings/DownloadsSettings.tsx
index b0a9b8d45f..500402a5cc 100644
--- a/web/src/pages/admin-settings/DownloadsSettings.tsx
+++ b/web/src/pages/admin-settings/DownloadsSettings.tsx
@@ -19,31 +19,33 @@ import { effectiveDownloadArtifactDir } from "./settingsPathDefaults";
 // Decimal GB, matching how drives and object stores are sold and reported.
 const BYTES_PER_GB = 1_000_000_000;
 
-// Shown without a disclosure: whether offline downloads exist at all, and the
-// one cap a household admin actually reaches for.
-const ESSENTIAL_KEYS = ["download.enabled", "download.user_bandwidth_mbps"];
+// Shown without a disclosure: whether offline downloads exist at all, whether
+// Prairie converts them, and where and how much it prepares. Without conversion no
+// lower quality is offered, and a device gets the original video even when it
+// can't play it (DownloadQualityResolver in internal/downloads/policy.go).
+const ESSENTIAL_KEYS = [
+  "download.enabled",
+  "download.transcode_enabled",
+  "download.max_concurrent_prepares",
+  "download.artifact_dir",
+  "download.artifact_max_bytes",
+  "download.artifact_disk_ceiling_percent",
+  "download.server_bandwidth_mbps",
+];
 
 // Enforced per user: QuantityLimiter counts concurrency and period usage
 // against a user ID (internal/downloads/limiter.go), and the bandwidth cap
 // shapes each user's transfer. They are listed first, under their own
 // heading, so they do not read as server-wide budgets.
 const PER_USER_ADVANCED_KEYS = [
+  "download.user_bandwidth_mbps",
   "download.max_concurrent_per_user",
   "download.max_per_period",
   "download.period_duration",
 ];
 
 // Enforced across the whole server.
-const GLOBAL_ADVANCED_KEYS = [
-  "download.server_bandwidth_mbps",
-  "download.transcode_enabled",
-  "download.local_transcode_fallback",
-  "download.artifact_dir",
-  "download.max_concurrent_prepares",
-  "download.artifact_max_bytes",
-  "download.artifact_cache_hours",
-  "download.artifact_disk_ceiling_percent",
-];
+const GLOBAL_ADVANCED_KEYS = ["download.local_transcode_fallback", "download.artifact_cache_hours"];
 
 const ADVANCED_KEYS = [...PER_USER_ADVANCED_KEYS, ...GLOBAL_ADVANCED_KEYS];
 
@@ -110,12 +112,59 @@ export default function DownloadsSettings() {
             onChange={(v) => form.setValue("download.enabled", v)}
             restartRequired={restartKeys.has("download.enabled")}
           />
+          <SettingField
+            label="Prepare device-friendly copies"
+            type="toggle"
+            description="Converts video the device can't play and offers lower qualities. Off, every download keeps the original video, even where the device can't play it."
+            value={form.getValue("download.transcode_enabled")}
+            onChange={(v) => form.setValue("download.transcode_enabled", v)}
+            restartRequired={restartKeys.has("download.transcode_enabled")}
+          />
+          {/* Not a LimitField: the server reads 0 as "use the built-in
+              worker count" (2), not as unlimited. */}
+          <SettingField
+            label="Files prepared at once"
+            type="number"
+            description="0 uses the built-in default of 2."
+            value={form.getValue("download.max_concurrent_prepares")}
+            onChange={(v) => form.setValue("download.max_concurrent_prepares", v)}
+            restartRequired={restartKeys.has("download.max_concurrent_prepares")}
+          />
+          <PathSettingField
+            label="Prepared file directory"
+            defaultValue={derivedArtifactDir}
+            description="Leave blank for a silo-download-artifacts folder beside this server's transcode directory. Transcode nodes use download-artifacts inside their own transcode directory unless a node has its own directory."
+            value={form.getValue("download.artifact_dir")}
+            onChange={(v) => form.setValue("download.artifact_dir", v)}
+            restartRequired={restartKeys.has("download.artifact_dir")}
+          />
+          {/* Stored as raw bytes (download.artifact_max_bytes); typed in GB
+              because nobody sizes a disk budget in bytes. Unlimited stays
+              the default and still writes the 0 sentinel. */}
+          <LimitField
+            label="Default storage budget per location"
+            unit="GB"
+            scale={BYTES_PER_GB}
+            hint="Applies to this server and to every node without its own budget. Over budget, cached files go first, least recently used first; files a device is still waiting on stay."
+            value={form.getValue("download.artifact_max_bytes")}
+            onChange={(v) => form.setValue("download.artifact_max_bytes", v)}
+            restartRequired={restartKeys.has("download.artifact_max_bytes")}
+          />
+          <SettingField
+            label="Disk ceiling (%)"
+            type="number"
+            description="Above this disk fill, cached files at that location are deleted early, whatever the budget. 50 to 95; nodes stop taking playback at 95% when downloads share their transcode disk."
+            value={form.getValue("download.artifact_disk_ceiling_percent")}
+            onChange={(v) => form.setValue("download.artifact_disk_ceiling_percent", v)}
+            restartRequired={restartKeys.has("download.artifact_disk_ceiling_percent")}
+          />
           <LimitField
-            label="Per-user bandwidth"
+            label="Server bandwidth"
             unit="Mbps"
-            value={form.getValue("download.user_bandwidth_mbps")}
-            onChange={(v) => form.setValue("download.user_bandwidth_mbps", v)}
-            restartRequired={restartKeys.has("download.user_bandwidth_mbps")}
+            hint="All downloads on this server combined."
+            value={form.getValue("download.server_bandwidth_mbps")}
+            onChange={(v) => form.setValue("download.server_bandwidth_mbps", v)}
+            restartRequired={restartKeys.has("download.server_bandwidth_mbps")}
           />
 
           <AdvancedSection
@@ -124,9 +173,16 @@ export default function DownloadsSettings() {
             forceOpen={anyDirty(ADVANCED_KEYS)}
           >
             <SettingsSubheading>Per user</SettingsSubheading>
+            <LimitField
+              label="Per-user bandwidth"
+              unit="Mbps"
+              value={form.getValue("download.user_bandwidth_mbps")}
+              onChange={(v) => form.setValue("download.user_bandwidth_mbps", v)}
+              restartRequired={restartKeys.has("download.user_bandwidth_mbps")}
+            />
             <LimitField
               label="Downloads at once per user"
-              hint="Counted per user, alongside the per-user bandwidth cap above."
+              hint="Counted per user, alongside the per-user bandwidth cap."
               value={form.getValue("download.max_concurrent_per_user")}
               onChange={(v) => form.setValue("download.max_concurrent_per_user", v)}
               restartRequired={restartKeys.has("download.max_concurrent_per_user")}
@@ -148,22 +204,6 @@ export default function DownloadsSettings() {
             />
 
             <SettingsSubheading>Whole server</SettingsSubheading>
-            <LimitField
-              label="Server bandwidth"
-              unit="Mbps"
-              hint="All downloads on this server combined."
-              value={form.getValue("download.server_bandwidth_mbps")}
-              onChange={(v) => form.setValue("download.server_bandwidth_mbps", v)}
-              restartRequired={restartKeys.has("download.server_bandwidth_mbps")}
-            />
-            <SettingField
-              label="Prepare device-friendly copies"
-              type="toggle"
-              description="Converts a file the device cannot play before download."
-              value={form.getValue("download.transcode_enabled")}
-              onChange={(v) => form.setValue("download.transcode_enabled", v)}
-              restartRequired={restartKeys.has("download.transcode_enabled")}
-            />
             <SettingField
               label="Prepare locally when workers are unavailable"
               type="toggle"
@@ -172,36 +212,6 @@ export default function DownloadsSettings() {
               onChange={(v) => form.setValue("download.local_transcode_fallback", v)}
               restartRequired={restartKeys.has("download.local_transcode_fallback")}
             />
-            <PathSettingField
-              label="Prepared file directory"
-              defaultValue={derivedArtifactDir}
-              description="Leave blank for a silo-download-artifacts folder beside this server's transcode directory. Transcode nodes use download-artifacts inside their own transcode directory unless a node has its own directory."
-              value={form.getValue("download.artifact_dir")}
-              onChange={(v) => form.setValue("download.artifact_dir", v)}
-              restartRequired={restartKeys.has("download.artifact_dir")}
-            />
-            {/* Not a LimitField: the server reads 0 as "use the built-in
-                worker count" (2), not as unlimited. */}
-            <SettingField
-              label="Files prepared at once"
-              type="number"
-              description="0 uses the built-in default of 2."
-              value={form.getValue("download.max_concurrent_prepares")}
-              onChange={(v) => form.setValue("download.max_concurrent_prepares", v)}
-              restartRequired={restartKeys.has("download.max_concurrent_prepares")}
-            />
-            {/* Stored as raw bytes (download.artifact_max_bytes); typed in GB
-                because nobody sizes a disk budget in bytes. Unlimited stays
-                the default and still writes the 0 sentinel. */}
-            <LimitField
-              label="Default storage budget per location"
-              unit="GB"
-              scale={BYTES_PER_GB}
-              hint="Applies to this server and to every node without its own budget. Over budget, cached files go first, least recently used first; files a device is still waiting on stay."
-              value={form.getValue("download.artifact_max_bytes")}
-              onChange={(v) => form.setValue("download.artifact_max_bytes", v)}
-              restartRequired={restartKeys.has("download.artifact_max_bytes")}
-            />
             <SettingField
               label="Keep cached files for"
               type="number"
@@ -210,14 +220,6 @@ export default function DownloadsSettings() {
               onChange={(v) => form.setValue("download.artifact_cache_hours", v)}
               restartRequired={restartKeys.has("download.artifact_cache_hours")}
             />
-            <SettingField
-              label="Disk ceiling (%)"
-              type="number"
-              description="Above this disk fill, cached files at that location are deleted early, whatever the budget. 50 to 95; nodes stop taking playback at 95% when downloads share their transcode disk."
-              value={form.getValue("download.artifact_disk_ceiling_percent")}
-              onChange={(v) => form.setValue("download.artifact_disk_ceiling_percent", v)}
-              restartRequired={restartKeys.has("download.artifact_disk_ceiling_percent")}
-            />
           </AdvancedSection>
         </FieldGroup>
       </div>
diff --git a/web/src/pages/admin-settings/EmailSettings.test.tsx b/web/src/pages/admin-settings/EmailSettings.test.tsx
new file mode 100644
index 0000000000..b947eee7ae
--- /dev/null
+++ b/web/src/pages/admin-settings/EmailSettings.test.tsx
@@ -0,0 +1,180 @@
+import { render, screen, waitFor, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { MemoryRouter } from "react-router";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { setAccessToken, setProfileId, setProfileToken, setRefreshToken } from "@/api/client";
+
+import EmailSettings from "./EmailSettings";
+
+// JSDOM omits the browser methods used by Radix Select.
+if (!HTMLElement.prototype.hasPointerCapture) HTMLElement.prototype.hasPointerCapture = () => false;
+if (!HTMLElement.prototype.scrollIntoView) HTMLElement.prototype.scrollIntoView = () => {};
+
+const toast = vi.hoisted(() => ({ success: vi.fn(), error: vi.fn() }));
+vi.mock("sonner", () => ({ toast }));
+
+const useSettingsFormMock = vi.fn();
+
+vi.mock("@/hooks/useSettingsForm", () => ({
+  useSettingsForm: (...args: unknown[]) => useSettingsFormMock(...args),
+}));
+
+vi.mock("@/hooks/useRestartKeys", () => ({
+  useRestartKeys: () => new Set<string>(),
+}));
+
+const SAVED: Record<string, string> = {
+  "email.enabled": "true",
+  "email.from_address": "prairie@example.com",
+  "email.from_name": "Prairie",
+  "email.smtp_host": "smtp.example.com",
+  "email.smtp_port": "587",
+  "email.smtp_security": "starttls",
+  "email.smtp_username": "mailer",
+};
+
+function makeForm({
+  dirty = [] as string[],
+  values = SAVED,
+  sensitiveConfigured = ["email.smtp_password"],
+} = {}) {
+  return {
+    isLoading: false,
+    getValue: (key: string) => values[key] ?? "",
+    setValue: vi.fn(),
+    resetValue: vi.fn(),
+    isDirty: vi.fn((key: string) => dirty.includes(key)),
+    isClearStaged: vi.fn((key: string) => dirty.includes(key) && (values[key] ?? "") === ""),
+    dirtyCount: dirty.length,
+    dirtyKeys: dirty,
+    save: vi.fn(() => Promise.resolve()),
+    discard: vi.fn(),
+    isSaving: false,
+    restartRequired: false,
+    sensitiveConfigured,
+    sensitiveManagedByEnv: [],
+  };
+}
+
+function renderPage() {
+  return render(
+    <MemoryRouter>
+      <EmailSettings />
+    </MemoryRouter>,
+  );
+}
+
+describe("EmailSettings", () => {
+  beforeEach(() => {
+    localStorage.clear();
+    useSettingsFormMock.mockReset();
+    toast.success.mockReset();
+    toast.error.mockReset();
+  });
+  afterEach(() => vi.unstubAllGlobals());
+
+  it("holds the mail server that used to sit in the Email channel card", () => {
+    useSettingsFormMock.mockReturnValue(makeForm());
+    renderPage();
+
+    expect(screen.getByRole("heading", { level: 1, name: "Email" })).toBeInTheDocument();
+    expect(new Set(useSettingsFormMock.mock.calls[0]?.[0]?.keys)).toEqual(
+      new Set([
+        "email.enabled",
+        "email.from_address",
+        "email.smtp_host",
+        "email.smtp_port",
+        "email.smtp_security",
+        "email.smtp_username",
+        "email.smtp_password",
+        "email.from_name",
+      ]),
+    );
+
+    const group = screen.getByRole("group", { name: "Mail server" });
+    expect(
+      within(group).getByText(
+        "Prairie sends invitations, password resets, and notification emails through it.",
+      ),
+    ).toBeInTheDocument();
+    expect(
+      within(group).getByRole("switch", { name: "Send email from this server" }),
+    ).toBeChecked();
+    expect(within(group).getByLabelText("From address")).toHaveValue("prairie@example.com");
+    expect(within(group).getByLabelText("Mail server address")).toHaveValue("smtp.example.com");
+    expect(within(group).getByRole("spinbutton", { name: "Port" })).toHaveValue(587);
+    expect(within(group).getByRole("combobox", { name: "Encryption" })).toHaveTextContent(
+      "STARTTLS",
+    );
+    expect(within(group).getByLabelText("Username")).toHaveValue("mailer");
+    expect(within(group).getByLabelText("Test email recipient")).toBeInTheDocument();
+  });
+
+  it("shows the sender name beside the from address with no Advanced disclosure", () => {
+    useSettingsFormMock.mockReturnValue(makeForm());
+    renderPage();
+
+    expect(screen.getByLabelText("From name")).toHaveValue("Prairie");
+    expect(screen.queryByRole("button", { name: /^Advanced/ })).not.toBeInTheDocument();
+  });
+
+  it("stages the mail server through the page's own save bar", async () => {
+    const form = makeForm({ dirty: ["email.smtp_host"] });
+    useSettingsFormMock.mockReturnValue(form);
+    renderPage();
+
+    await userEvent.type(screen.getByLabelText("Mail server address"), "x");
+    expect(form.setValue).toHaveBeenCalledWith("email.smtp_host", "smtp.example.comx");
+    await userEvent.click(screen.getByRole("switch", { name: "Send email from this server" }));
+    expect(form.setValue).toHaveBeenCalledWith("email.enabled", "false");
+    await userEvent.click(screen.getByRole("combobox", { name: "Encryption" }));
+    await userEvent.click(screen.getByRole("option", { name: "TLS (implicit)" }));
+    expect(form.setValue).toHaveBeenCalledWith("email.smtp_security", "tls");
+
+    await userEvent.click(screen.getByRole("button", { name: "Save" }));
+    expect(form.save).toHaveBeenCalledOnce();
+  });
+
+  it("shows the saved SMTP password as a masked, editable input", async () => {
+    const form = makeForm();
+    useSettingsFormMock.mockReturnValue(form);
+    renderPage();
+
+    // No Replace step: typing stages a replacement, blank keeps the saved one.
+    const input = screen.getByLabelText("Password");
+    expect(input).toHaveAttribute("type", "password");
+    expect(input).toHaveAttribute("placeholder", "••••••••••••");
+    expect(screen.queryByRole("button", { name: /Replace/ })).not.toBeInTheDocument();
+
+    // A relay that needs no sign-in has to be able to drop the password too.
+    await userEvent.click(screen.getByRole("button", { name: "Clear saved value" }));
+    expect(form.setValue).toHaveBeenCalledWith("email.smtp_password", "");
+  });
+
+  it("sends a test email through the saved settings", async () => {
+    setAccessToken("test-admin");
+    setRefreshToken(null);
+    setProfileId("profile-a");
+    setProfileToken("pin-a");
+    const fetchMock = vi.fn<typeof fetch>().mockResolvedValue(
+      new Response(JSON.stringify({ ok: true, duration_ms: 7 }), {
+        headers: { "Content-Type": "application/json" },
+      }),
+    );
+    vi.stubGlobal("fetch", fetchMock);
+    useSettingsFormMock.mockReturnValue(makeForm());
+    renderPage();
+
+    await userEvent.type(screen.getByLabelText("Test email recipient"), "admin@example.test");
+    await userEvent.click(screen.getByRole("button", { name: "Send test" }));
+
+    await waitFor(() => expect(fetchMock).toHaveBeenCalledOnce());
+    expect(fetchMock.mock.calls[0]?.[0]).toBe("/api/v2/admin/email/test");
+    expect(fetchMock.mock.calls[0]?.[1]).toMatchObject({
+      method: "POST",
+      body: JSON.stringify({ to: "admin@example.test" }),
+    });
+    expect(await screen.findByText("Delivered to the mail server in 7ms.")).toBeInTheDocument();
+  });
+});
diff --git a/web/src/pages/admin-settings/EmailSettings.tsx b/web/src/pages/admin-settings/EmailSettings.tsx
new file mode 100644
index 0000000000..4107edc590
--- /dev/null
+++ b/web/src/pages/admin-settings/EmailSettings.tsx
@@ -0,0 +1,148 @@
+import { TestEmailRow } from "@/components/admin/EmailTestRow";
+import { SaveBar } from "@/components/SaveBar";
+import { SecretField } from "@/components/settings/SecretField";
+import { SettingsPageHeader } from "@/components/settings/SettingsPageHeader";
+import { Skeleton } from "@/components/ui/skeleton";
+import { useRestartKeys } from "@/hooks/useRestartKeys";
+import { useSettingsForm } from "@/hooks/useSettingsForm";
+
+import { FieldGroup } from "./FieldGroup";
+import { SettingField } from "./SettingField";
+
+const EMAIL_KEYS = [
+  "email.enabled",
+  "email.from_address",
+  "email.from_name",
+  "email.smtp_host",
+  "email.smtp_port",
+  "email.smtp_security",
+  "email.smtp_username",
+  "email.smtp_password",
+];
+
+/**
+ * Outbound mail. It used to sit inside the Email channel card on Notifications,
+ * but invitations and password resets send through the same server, so it has
+ * its own page; the channel card only says whether mail is set up and links
+ * here.
+ */
+export default function EmailSettings() {
+  const form = useSettingsForm({ keys: EMAIL_KEYS });
+  const restartKeys = useRestartKeys();
+
+  const allRestart = EMAIL_KEYS.every((key) => restartKeys.has(key));
+  const anyDirty = EMAIL_KEYS.some((key) => form.isDirty(key));
+
+  if (form.isLoading)
+    return (
+      <div className="space-y-6" role="status" aria-label="Loading settings">
+        <Skeleton className="h-8 w-48" />
+        <div className="space-y-4">
+          <Skeleton className="h-10 w-full" />
+          <Skeleton className="h-10 w-full" />
+          <Skeleton className="h-10 w-full" />
+          <Skeleton className="h-10 w-full" />
+        </div>
+        <span className="sr-only">Loading settings</span>
+      </div>
+    );
+
+  return (
+    <div className="flex h-full flex-col">
+      <SettingsPageHeader title="Email" />
+
+      <div className="flex-1 space-y-5">
+        <FieldGroup
+          label="Mail server"
+          description="Prairie sends invitations, password resets, and notification emails through it."
+          restartAll={allRestart}
+          dirty={anyDirty}
+        >
+          <SettingField
+            label="Send email from this server"
+            dirty={form.isDirty("email.enabled")}
+            type="toggle"
+            value={form.getValue("email.enabled")}
+            onChange={(v) => form.setValue("email.enabled", v)}
+            restartRequired={restartKeys.has("email.enabled")}
+          />
+          <SettingField
+            label="From address"
+            dirty={form.isDirty("email.from_address")}
+            hint="prairie@example.com"
+            value={form.getValue("email.from_address")}
+            onChange={(v) => form.setValue("email.from_address", v)}
+            restartRequired={restartKeys.has("email.from_address")}
+          />
+          <SettingField
+            label="From name"
+            dirty={form.isDirty("email.from_name")}
+            hint="Prairie"
+            value={form.getValue("email.from_name")}
+            onChange={(v) => form.setValue("email.from_name", v)}
+            restartRequired={restartKeys.has("email.from_name")}
+          />
+          <SettingField
+            label="Mail server address"
+            dirty={form.isDirty("email.smtp_host")}
+            hint="smtp.example.com"
+            value={form.getValue("email.smtp_host")}
+            onChange={(v) => form.setValue("email.smtp_host", v)}
+            restartRequired={restartKeys.has("email.smtp_host")}
+          />
+          <SettingField
+            label="Port"
+            dirty={form.isDirty("email.smtp_port")}
+            description="587 for STARTTLS (typical), 465 for implicit TLS"
+            type="number"
+            value={form.getValue("email.smtp_port")}
+            onChange={(v) => form.setValue("email.smtp_port", v)}
+            restartRequired={restartKeys.has("email.smtp_port")}
+          />
+          <SettingField
+            label="Encryption"
+            dirty={form.isDirty("email.smtp_security")}
+            description="Use whatever your mail provider documents."
+            type="select"
+            options={[
+              { value: "starttls", label: "STARTTLS" },
+              { value: "tls", label: "TLS (implicit)" },
+              { value: "none", label: "None (insecure)" },
+            ]}
+            value={form.getValue("email.smtp_security") || "starttls"}
+            onChange={(v) => form.setValue("email.smtp_security", v)}
+            restartRequired={restartKeys.has("email.smtp_security")}
+          />
+          <SettingField
+            label="Username"
+            dirty={form.isDirty("email.smtp_username")}
+            description="Leave empty if the mail server needs no sign-in."
+            value={form.getValue("email.smtp_username")}
+            onChange={(v) => form.setValue("email.smtp_username", v)}
+            restartRequired={restartKeys.has("email.smtp_username")}
+          />
+          <SecretField
+            label="Password"
+            value={form.getValue("email.smtp_password")}
+            configured={form.sensitiveConfigured.includes("email.smtp_password")}
+            onKeep={() => form.resetValue("email.smtp_password")}
+            // The username above can be emptied for a relay that needs no
+            // sign-in; without this the password could not follow it.
+            onClear={() => form.setValue("email.smtp_password", "")}
+            cleared={form.isClearStaged("email.smtp_password")}
+            onChange={(v) => form.setValue("email.smtp_password", v)}
+            restartRequired={restartKeys.has("email.smtp_password")}
+          />
+          <TestEmailRow />
+        </FieldGroup>
+      </div>
+
+      <SaveBar
+        dirtyCount={form.dirtyCount}
+        onSave={form.save}
+        onDiscard={form.discard}
+        isSaving={form.isSaving}
+      />
+    </div>
+  );
+}
diff --git a/web/src/pages/admin-settings/GeneralSettings.test.tsx b/web/src/pages/admin-settings/GeneralSettings.test.tsx
index 4534634f27..374c9acf55 100644
--- a/web/src/pages/admin-settings/GeneralSettings.test.tsx
+++ b/web/src/pages/admin-settings/GeneralSettings.test.tsx
@@ -1,35 +1,78 @@
-import { render, screen } from "@testing-library/react";
+import { fireEvent, render, screen, waitFor, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
 import { MemoryRouter } from "react-router";
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 import GeneralSettings from "./GeneralSettings";
 
-const useSettingsFormMock = vi.fn();
+const settingsFormMock = vi.fn();
+const useCheckAdminSettingsConnectionMock = vi.fn();
 
-vi.mock("@/hooks/useSettingsForm", () => ({
-  useSettingsForm: (...args: unknown[]) => useSettingsFormMock(...args),
+// Most cases drive the page from a hand-written form. The Redis editing cases
+// that have to prove a value reaches the server flip this and run the real hook.
+const { realForm, serverSettings, sensitiveStatus, updateSettingsMock } = vi.hoisted(() => ({
+  realForm: { enabled: false },
+  serverSettings: { current: {} as Record<string, string> },
+  sensitiveStatus: { current: { configured: [] as string[], managed_by_env: [] as string[] } },
+  updateSettingsMock: vi.fn(),
 }));
 
+vi.mock("@/hooks/useSettingsForm", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("@/hooks/useSettingsForm")>();
+  return {
+    useSettingsForm: (options: { keys: string[] }) =>
+      realForm.enabled ? actual.useSettingsForm(options) : settingsFormMock(options),
+  };
+});
+
+vi.mock("@/hooks/queries/admin/settings", () => ({
+  useCheckAdminSettingsConnection: (...args: unknown[]) =>
+    useCheckAdminSettingsConnectionMock(...args),
+  useAdminServerSettings: () => ({ data: serverSettings.current, isLoading: false }),
+  useAdminSensitiveStatus: () => ({ data: sensitiveStatus.current, isError: false }),
+  useUpdateServerSettings: () => ({ mutateAsync: updateSettingsMock, isPending: false }),
+}));
+
+const RESTART_KEYS = new Set<string>([
+  "server.lan_discovery",
+  "clientip.trusted_proxies",
+  "database.max_connections",
+  "redis.url",
+  "redis.db",
+]);
+const restartKeysMock = vi.fn(() => ({ has: (key: string) => RESTART_KEYS.has(key) }));
+
 vi.mock("@/hooks/useRestartKeys", () => ({
-  useRestartKeys: () => new Set<string>(["server.log_level"]),
+  useRestartKeys: () => restartKeysMock(),
 }));
 
-function makeForm(values: Record<string, string> = {}) {
+function makeForm(values: Record<string, string> = {}, overrides: Record<string, unknown> = {}) {
   return {
     isLoading: false,
     getValue: (key: string) => values[key] ?? "",
+    getPersistedValue: (key: string) => values[key] ?? "",
     setValue: vi.fn(),
+    resetValue: vi.fn(),
     isDirty: () => false,
+    isClearStaged: () => false,
     dirtyCount: 0,
+    dirtyKeys: [],
     save: vi.fn(),
     discard: vi.fn(),
     isSaving: false,
     restartRequired: false,
     sensitiveConfigured: [],
     sensitiveManagedByEnv: [],
+    sensitiveStatusReady: true,
+    sensitiveStatusError: false,
+    buildConnectionCheckRequest: vi.fn(),
+    ...overrides,
   };
 }
 
+const network = () => within(screen.getByRole("group", { name: "Network" }));
+const redis = () => within(screen.getByRole("group", { name: "Redis" }));
+
 function renderPage() {
   return render(
     <MemoryRouter>
@@ -41,29 +84,331 @@ function renderPage() {
 describe("GeneralSettings", () => {
   beforeEach(() => {
     localStorage.clear();
-    useSettingsFormMock.mockReset();
-    useSettingsFormMock.mockReturnValue(makeForm({ "signup.enabled": "true" }));
+    settingsFormMock.mockReset();
+    settingsFormMock.mockReturnValue(makeForm({ "branding.server_name": "Prairie" }));
+    useCheckAdminSettingsConnectionMock.mockReset();
+    useCheckAdminSettingsConnectionMock.mockReturnValue({
+      isPending: false,
+      mutateAsync: vi.fn(),
+    });
   });
 
-  it("manages identity, signup and logging keys on one save bar", () => {
+  // Signups and password reset moved to Sign-in, and logging to its own page;
+  // their tests followed them to SignInSettings.test.tsx and
+  // LoggingSettings.test.tsx. Redis and the Postgres pool moved here from
+  // Storage.
+  it("manages identity, network, database and Redis keys on one save bar", () => {
     renderPage();
 
-    expect(useSettingsFormMock.mock.calls[0]?.[0]?.keys).toEqual([
+    expect(settingsFormMock.mock.calls[0]?.[0]?.keys).toEqual([
       "server.public_url",
       "server.lan_discovery",
+      "server.local_url",
+      "clientip.trusted_proxies",
       "branding.server_name",
       "branding.login_subtitle",
-      "signup.enabled",
-      "password_reset.self_service_enabled",
-      "server.log_level",
-      "server.log_quiet",
+      "database.max_connections",
+      "redis.url",
+      "redis.db",
+    ]);
+    expect(screen.getAllByRole("heading", { level: 3 }).map((h) => h.textContent)).toEqual([
+      "Identity",
+      "Network",
+      "Database",
+      "Redis",
     ]);
   });
 
+  // The local address applies live, like the public URL: apps read it from the
+  // connections document on their next refresh.
+  it("stages the local network address without a restart chip", async () => {
+    const form = makeForm({ "server.local_url": "http://192.168.1.20:8080" });
+    settingsFormMock.mockReturnValue(form);
+    renderPage();
+
+    const field = network().getByLabelText("Local network address");
+    expect(field).toHaveValue("http://192.168.1.20:8080");
+    expect(
+      network()
+        .queryAllByLabelText("Takes effect after a server restart")
+        .find((el) => el.parentElement?.textContent?.includes("Local network address")),
+    ).toBeUndefined();
+
+    await userEvent.clear(field);
+    expect(form.setValue).toHaveBeenLastCalledWith("server.local_url", "");
+  });
+
+  // Trusted proxies moved here from Security, beside the public URL, the way
+  // the setup wizard asks for them.
+  it("shows trusted proxies with no disclosure and stages edits", async () => {
+    const form = makeForm({ "clientip.trusted_proxies": "10.0.0.0/8" });
+    settingsFormMock.mockReturnValue(form);
+    renderPage();
+
+    expect(network().getByLabelText("Prairie public URL")).toBeInTheDocument();
+    expect(network().queryByRole("button", { name: /Behind a reverse proxy/ })).toBeNull();
+
+    const proxies = network().getByLabelText("Trusted proxies");
+    expect(proxies).toHaveValue("10.0.0.0/8");
+    expect(proxies).toBeEnabled();
+    expect(network().getByText(/empty keeps the private defaults/)).toBeInTheDocument();
+    // The proxy list needs a restart; the public URL beside it does not, so the
+    // chip stays on the row instead of the group.
+    const badge = network()
+      .getAllByLabelText("Takes effect after a server restart")
+      .find((el) => el.parentElement?.textContent?.includes("Trusted proxies"));
+    expect(badge).toBeDefined();
+
+    await userEvent.type(proxies, ",");
+    expect(form.setValue).toHaveBeenCalledWith("clientip.trusted_proxies", "10.0.0.0/8,");
+  });
+
+  it("locks trusted proxies when PRAIRIE_TRUSTED_PROXIES manages them", () => {
+    settingsFormMock.mockReturnValue(
+      makeForm({}, { sensitiveManagedByEnv: ["clientip.trusted_proxies"] }),
+    );
+    renderPage();
+
+    expect(network().getByLabelText("Trusted proxies")).toBeDisabled();
+    expect(network().getByText("Managed by PRAIRIE_TRUSTED_PROXIES.")).toBeInTheDocument();
+  });
+
+  it("shows the Postgres connection limit with no disclosure", () => {
+    const form = makeForm({ "database.max_connections": "25" });
+    settingsFormMock.mockReturnValue(form);
+    renderPage();
+
+    const database = within(screen.getByRole("group", { name: "Database" }));
+    expect(database.queryByRole("button", { name: /Advanced/ })).toBeNull();
+    const field = database.getByLabelText("Maximum Postgres connections");
+    expect(field).toHaveValue(25);
+    fireEvent.change(field, { target: { value: "40" } });
+    expect(form.setValue).toHaveBeenCalledWith("database.max_connections", "40");
+    // The per-user database backend and its SQLite tuning are Hidden.
+    expect(database.queryByText("Where per-user data is stored")).toBeNull();
+  });
+
+  it("shows only the Redis switch while Redis is off", () => {
+    renderPage();
+
+    expect(redis().getByRole("switch", { name: "Use Redis" })).not.toBeChecked();
+    expect(redis().queryByLabelText("Connection URL")).toBeNull();
+    expect(redis().queryByLabelText("Database number")).toBeNull();
+  });
+
+  it("keeps the Redis connection check available when REDIS_URL comes from the environment", () => {
+    settingsFormMock.mockReturnValue(
+      makeForm({}, { sensitiveConfigured: ["redis.url"], sensitiveManagedByEnv: ["redis.url"] }),
+    );
+    renderPage();
+
+    // The value stays read-only — only writes are refused for env-managed keys —
+    // but the check runs against the value the server merged from REDIS_URL.
+    expect(redis().getByLabelText("Connection URL")).toBeDisabled();
+    expect(redis().getByRole("button", { name: "Check Connection" })).toBeEnabled();
+    // The switch already stages the empty URL, so the field offers no clear.
+    expect(redis().queryByRole("button", { name: "Clear saved value" })).toBeNull();
+  });
+
+  it("shows the Redis database number in use and stages an edit to it", () => {
+    const form = makeForm({ "redis.db": "3" }, { sensitiveConfigured: ["redis.url"] });
+    settingsFormMock.mockReturnValue(form);
+    renderPage();
+
+    const field = redis().getByLabelText("Database number");
+    expect(field).toHaveValue(3);
+    expect(field).toBeEnabled();
+    fireEvent.change(field, { target: { value: "5" } });
+    expect(form.setValue).toHaveBeenCalledWith("redis.db", "5");
+  });
+
+  it("holds the Redis switch and database number while a save is in flight", () => {
+    settingsFormMock.mockReturnValue(
+      makeForm({ "redis.db": "3" }, { sensitiveConfigured: ["redis.url"], isSaving: true }),
+    );
+    renderPage();
+
+    expect(redis().getByRole("switch", { name: "Use Redis" })).toBeDisabled();
+    expect(redis().getByLabelText("Database number")).toBeDisabled();
+  });
+
+  it("makes the Redis database number read-only when REDIS_URL comes from the environment", () => {
+    settingsFormMock.mockReturnValue(
+      makeForm(
+        { "redis.db": "1" },
+        {
+          sensitiveConfigured: ["redis.url"],
+          sensitiveManagedByEnv: ["redis.url", "redis.db"],
+        },
+      ),
+    );
+    renderPage();
+
+    // The server reports the number in REDIS_URL; it cannot be saved here.
+    expect(redis().getByLabelText("Database number")).toHaveValue(1);
+    expect(redis().getByLabelText("Database number")).toBeDisabled();
+  });
+
+  it("checks the Redis connection with the database number", async () => {
+    const mutateAsync = vi.fn().mockResolvedValue({ success: true, message: "ok" });
+    useCheckAdminSettingsConnectionMock.mockReturnValue({ isPending: false, mutateAsync });
+    const request = { values: { "redis.url": "", "redis.db": "5" }, dirty_keys: ["redis.db"] };
+    const form = makeForm(
+      {},
+      {
+        sensitiveConfigured: ["redis.url"],
+        buildConnectionCheckRequest: vi.fn(() => request),
+      },
+    );
+    settingsFormMock.mockReturnValue(form);
+    renderPage();
+
+    fireEvent.click(redis().getByRole("button", { name: "Check Connection" }));
+
+    await waitFor(() => expect(mutateAsync).toHaveBeenCalledWith({ kind: "redis", body: request }));
+    expect(form.buildConnectionCheckRequest).toHaveBeenCalledWith(["redis.url", "redis.db"]);
+  });
+
+  it("marks the Redis database number for a restart on its own", () => {
+    // A registry where only the number needs a restart: the group cannot say
+    // so for every field, which leaves the chip to this one.
+    restartKeysMock.mockReturnValueOnce({ has: (key: string) => key === "redis.db" });
+    settingsFormMock.mockReturnValue(makeForm({}, { sensitiveConfigured: ["redis.url"] }));
+    renderPage();
+
+    const badges = redis().getAllByLabelText("Takes effect after a server restart");
+    expect(badges).toHaveLength(1);
+    expect(badges[0]?.parentElement).toHaveTextContent("Database number");
+  });
+
+  it("holds only Redis when protected credential status cannot be loaded", () => {
+    settingsFormMock.mockReturnValue(
+      makeForm({}, { sensitiveStatusReady: false, sensitiveStatusError: true }),
+    );
+    renderPage();
+
+    expect(screen.getByRole("alert")).toHaveTextContent("Redis settings are unavailable");
+    expect(screen.queryByRole("group", { name: "Redis" })).toBeNull();
+    expect(network().getByLabelText("Prairie public URL")).toBeEnabled();
+  });
+
+  it("saves other edits but not a Redis draft hidden by a credential status error", async () => {
+    const form = makeForm(
+      {},
+      {
+        sensitiveStatusReady: false,
+        sensitiveStatusError: true,
+        dirtyCount: 2,
+        dirtyKeys: ["server.public_url", "redis.url"],
+        isDirty: (key: string) => key === "server.public_url" || key === "redis.url",
+      },
+    );
+    settingsFormMock.mockReturnValue(form);
+    renderPage();
+
+    await userEvent.click(screen.getByRole("button", { name: "Save" }));
+
+    expect(form.save).toHaveBeenCalledWith(["server.public_url"]);
+  });
+
+  describe("editing the Redis connection", () => {
+    const newUrl = "redis://new.example.invalid:6379/7";
+
+    beforeEach(() => {
+      realForm.enabled = true;
+      // No redis.db is saved: the server reports the 3 in the saved URL.
+      serverSettings.current = { "redis.db": "3" };
+      sensitiveStatus.current = { configured: ["redis.url"], managed_by_env: [] };
+      updateSettingsMock.mockReset();
+      updateSettingsMock.mockResolvedValue({ values: {}, restart_required: false });
+    });
+
+    afterEach(() => {
+      realForm.enabled = false;
+    });
+
+    it("saves the number on screen with a new URL", async () => {
+      renderPage();
+
+      await userEvent.type(redis().getByLabelText("Connection URL"), newUrl);
+
+      expect(redis().getByLabelText("Database number")).toHaveValue(3);
+      await userEvent.click(screen.getByRole("button", { name: "Save" }));
+      await waitFor(() =>
+        expect(updateSettingsMock).toHaveBeenCalledWith({ "redis.url": newUrl, "redis.db": "3" }),
+      );
+    });
+
+    it("checks a new URL with the number on screen", async () => {
+      const mutateAsync = vi.fn().mockResolvedValue({ success: true, message: "ok" });
+      useCheckAdminSettingsConnectionMock.mockReturnValue({ isPending: false, mutateAsync });
+      renderPage();
+
+      await userEvent.type(redis().getByLabelText("Connection URL"), newUrl);
+      await userEvent.click(redis().getByRole("button", { name: "Check Connection" }));
+
+      await waitFor(() =>
+        expect(mutateAsync).toHaveBeenCalledWith({
+          kind: "redis",
+          body: {
+            values: { "redis.url": newUrl, "redis.db": "3" },
+            dirty_keys: ["redis.url", "redis.db"],
+          },
+        }),
+      );
+    });
+
+    it("stages nothing once the new URL is taken back", async () => {
+      renderPage();
+
+      await userEvent.type(redis().getByLabelText("Connection URL"), newUrl);
+      expect(screen.getByText("2 unsaved changes")).toBeInTheDocument();
+      await userEvent.clear(redis().getByLabelText("Connection URL"));
+
+      expect(screen.queryByText(/unsaved change/)).not.toBeInTheDocument();
+      expect(redis().getByLabelText("Database number")).toHaveValue(3);
+    });
+
+    it("drops a URL keystroke that arrives while a save is in flight", async () => {
+      updateSettingsMock.mockReturnValue(new Promise(() => {}));
+      renderPage();
+      fireEvent.change(redis().getByLabelText("Database number"), { target: { value: "5" } });
+      await userEvent.click(screen.getByRole("button", { name: "Save" }));
+      await waitFor(() => expect(updateSettingsMock).toHaveBeenCalledWith({ "redis.db": "5" }));
+
+      fireEvent.change(redis().getByLabelText("Connection URL"), { target: { value: "r" } });
+
+      expect(redis().getByLabelText("Connection URL")).toHaveValue("");
+    });
+
+    it("sends the number with the empty URL when Redis is switched off", async () => {
+      // The server stores no number without a URL, so this removes a saved one.
+      renderPage();
+
+      await userEvent.click(screen.getByRole("switch", { name: "Use Redis" }));
+      await userEvent.click(screen.getByRole("button", { name: "Save" }));
+
+      await waitFor(() =>
+        expect(updateSettingsMock).toHaveBeenCalledWith({ "redis.url": "", "redis.db": "3" }),
+      );
+    });
+
+    it("stages nothing once Redis is switched back on", async () => {
+      renderPage();
+
+      await userEvent.click(screen.getByRole("switch", { name: "Use Redis" }));
+      expect(screen.getByText("2 unsaved changes")).toBeInTheDocument();
+      await userEvent.click(screen.getByRole("switch", { name: "Use Redis" }));
+
+      expect(screen.queryByText(/unsaved change/)).not.toBeInTheDocument();
+      expect(redis().getByLabelText("Database number")).toHaveValue(3);
+    });
+  });
+
   // The save bar moves to components/ but must render the same markup on every
   // settings page that uses it: scroll room, scrim and the pill.
   it("renders the settings save bar for a dirty form", () => {
-    useSettingsFormMock.mockReturnValue({ ...makeForm(), dirtyCount: 2 });
+    settingsFormMock.mockReturnValue({ ...makeForm(), dirtyCount: 2 });
     renderPage();
 
     const pill = screen.getByText("2 unsaved changes").closest("[role=status]");
diff --git a/web/src/pages/admin-settings/GeneralSettings.tsx b/web/src/pages/admin-settings/GeneralSettings.tsx
index 6d40465964..6ff38030c5 100644
--- a/web/src/pages/admin-settings/GeneralSettings.tsx
+++ b/web/src/pages/admin-settings/GeneralSettings.tsx
@@ -1,26 +1,44 @@
-import { useMemo } from "react";
-import { Link } from "react-router";
-import { ArrowRight } from "lucide-react";
+import { useMemo, useRef, useState } from "react";
+import { AlertTriangle } from "lucide-react";
 
 import { useSettingsForm } from "@/hooks/useSettingsForm";
 import { useRestartKeys } from "@/hooks/useRestartKeys";
-import { AdvancedSection } from "@/components/settings/AdvancedSection";
 import { SettingsPageHeader } from "@/components/settings/SettingsPageHeader";
 import { Skeleton } from "@/components/ui/skeleton";
 import { SettingField } from "./SettingField";
 import { SaveBar } from "@/components/SaveBar";
 import { FieldGroup } from "./FieldGroup";
+import { RedisGroup, type RedisUrlEditors } from "./RedisGroup";
+import { REDIS_KEYS } from "./redisDraft";
 
-// Identity (server name, login subtitle) used to live on the Branding tab and
-// public signups on the Invite Codes tab; both are plain server-wide switches an
-// admin looks for under General, so they save with everything else on this page.
+// Identity (server name, login subtitle) used to live on the Branding tab; it is
+// a plain server-wide value an admin looks for under General, so it saves with
+// everything else on this page. Public signups and password reset live on
+// Sign-in, since both only work with Prairie passwords, and the log level on
+// Logging.
 const IDENTITY_KEYS = ["branding.server_name", "branding.login_subtitle"];
-const ACCESS_KEYS = ["signup.enabled", "password_reset.self_service_enabled"];
-const LOGGING_ADVANCED_KEYS = ["server.log_quiet"];
-const LOGGING_KEYS = ["server.log_level", ...LOGGING_ADVANCED_KEYS];
 
-const NETWORK_KEYS = ["server.public_url", "server.lan_discovery"];
-const KEYS = [...NETWORK_KEYS, ...IDENTITY_KEYS, ...ACCESS_KEYS, ...LOGGING_KEYS];
+// Trusted proxies sit beside the public URL, the way the setup wizard asks for
+// them: both are what an install behind a reverse proxy needs to get right.
+const TRUSTED_PROXIES_KEY = "clientip.trusted_proxies";
+// The local address covers what LAN discovery cannot reach: a Docker bridge
+// network, where the advert never leaves the container and names the wrong port.
+const LOCAL_URL_KEY = "server.local_url";
+const NETWORK_KEYS = [
+  "server.public_url",
+  "server.lan_discovery",
+  LOCAL_URL_KEY,
+  TRUSTED_PROXIES_KEY,
+];
+
+// Redis and the Postgres pool are server-wide plumbing, not storage, so they
+// moved here from the Storage page. userdb.backend, userdb.pool_max_open and
+// userdb.idle_timeout are Hidden on purpose: PostgreSQL is the only usable
+// per-user store, and the two SQLite tuning fields could never show. They stay
+// ordinary settings through the API.
+const DATABASE_KEYS = ["database.max_connections"];
+
+const KEYS = [...NETWORK_KEYS, ...IDENTITY_KEYS, ...DATABASE_KEYS, ...REDIS_KEYS];
 
 export default function GeneralSettings() {
   const form = useSettingsForm({ keys: useMemo(() => KEYS, []) });
@@ -28,8 +46,50 @@ export default function GeneralSettings() {
 
   const allRestart = (keys: string[]) => keys.every((key) => restartKeys.has(key));
   const anyDirty = (keys: string[]) => keys.some((key) => form.isDirty(key));
+  const trustedProxiesManaged = form.sensitiveManagedByEnv.includes(TRUSTED_PROXIES_KEY);
+  const [saveInProgress, setSaveInProgress] = useState(false);
+  const saveInProgressRef = useRef(false);
+
+  // The Redis URL is a credential: its editors are frozen while a save is in
+  // flight so a late keystroke cannot ride along with it.
+  const redisUrlEditors: RedisUrlEditors = {
+    keepSaved: (key) => {
+      if (saveInProgressRef.current) return;
+      form.resetValue(key);
+    },
+    setSecret: (key, value) => {
+      if (saveInProgressRef.current) return;
+      form.setValue(key, value);
+    },
+    disabled: form.isSaving || saveInProgress,
+  };
+
+  async function handleSave() {
+    if (saveInProgressRef.current) return;
+    saveInProgressRef.current = true;
+    setSaveInProgress(true);
+    try {
+      // While credential status is unavailable the Redis group is replaced by
+      // "Reload before editing", so its retained draft stays unsent.
+      await form.save(
+        form.sensitiveStatusError
+          ? form.dirtyKeys.filter((key) => !REDIS_KEYS.includes(key))
+          : undefined,
+      );
+    } finally {
+      saveInProgressRef.current = false;
+      setSaveInProgress(false);
+    }
+  }
 
-  if (form.isLoading)
+  function handleDiscard() {
+    if (saveInProgressRef.current) return;
+    form.discard();
+  }
+
+  // Redis reads whether a URL is saved from the protected-credential status,
+  // so the page waits for it; if it fails, only the Redis group is held.
+  if (form.isLoading || (!form.sensitiveStatusReady && !form.sensitiveStatusError))
     return (
       <div className="space-y-6" role="status" aria-label="Loading settings">
         <Skeleton className="h-8 w-48" />
@@ -47,7 +107,7 @@ export default function GeneralSettings() {
 
   return (
     <div className="flex h-full flex-col">
-      <SettingsPageHeader title="General" className="mb-7" />
+      <SettingsPageHeader title="General" />
 
       <div className="flex-1 space-y-5">
         <FieldGroup
@@ -57,7 +117,6 @@ export default function GeneralSettings() {
         >
           <SettingField
             label="Server name"
-            settingKey="branding.server_name"
             dirty={form.isDirty("branding.server_name")}
             hint="Prairie"
             value={form.getValue("branding.server_name")}
@@ -66,7 +125,6 @@ export default function GeneralSettings() {
           />
           <SettingField
             label="Login subtitle"
-            settingKey="branding.login_subtitle"
             dirty={form.isDirty("branding.login_subtitle")}
             hint="Sign in with an existing account."
             description="Shown under the server name on the sign-in page."
@@ -83,7 +141,6 @@ export default function GeneralSettings() {
         >
           <SettingField
             label="Prairie public URL"
-            settingKey="server.public_url"
             dirty={form.isDirty("server.public_url")}
             description="The HTTPS address users open. Used for websocket origins and links in email notifications."
             hint="https://silo.example.com"
@@ -93,7 +150,6 @@ export default function GeneralSettings() {
           />
           <SettingField
             label="Show on the local network"
-            settingKey="server.lan_discovery"
             dirty={form.isDirty("server.lan_discovery")}
             type="toggle"
             description="Prairie apps on the same network list this server when adding one, so nobody has to type its address. Needs a network that passes multicast (Docker host networking, not the default bridge)."
@@ -101,89 +157,70 @@ export default function GeneralSettings() {
             onChange={(v) => form.setValue("server.lan_discovery", v)}
             restartRequired={restartKeys.has("server.lan_discovery")}
           />
-        </FieldGroup>
-
-        <FieldGroup
-          label="Access"
-          restartAll={allRestart(ACCESS_KEYS)}
-          dirty={anyDirty(ACCESS_KEYS)}
-          actions={
-            <Link
-              to="/admin/users?tab=invite-codes"
-              className="text-muted-foreground hover:text-foreground inline-flex items-center gap-1.5 text-xs font-medium transition-colors"
-            >
-              Manage invite codes
-              <ArrowRight className="h-3 w-3" aria-hidden="true" />
-            </Link>
-          }
-        >
           <SettingField
-            label="Public signups"
-            settingKey="signup.enabled"
-            dirty={form.isDirty("signup.enabled")}
-            type="toggle"
-            description="Anyone with a valid invite code can create an account."
-            value={form.getValue("signup.enabled")}
-            onChange={(v) => form.setValue("signup.enabled", v)}
-            restartRequired={restartKeys.has("signup.enabled")}
+            label="Local network address"
+            dirty={form.isDirty(LOCAL_URL_KEY)}
+            description="Where devices on your home network reach Prairie directly: the host's IP and the port Prairie listens on, or the published port under Docker. Signed-in apps switch to it on their own while they can reach it, over an encrypted connection. Leave empty when apps already find the server on the local network."
+            hint="http://192.168.1.20:8080"
+            value={form.getValue(LOCAL_URL_KEY)}
+            onChange={(v) => form.setValue(LOCAL_URL_KEY, v)}
+            restartRequired={restartKeys.has(LOCAL_URL_KEY)}
           />
           <SettingField
-            label="Self-service password reset"
-            settingKey="password_reset.self_service_enabled"
-            dirty={form.isDirty("password_reset.self_service_enabled")}
-            type="toggle"
-            description="Adds “Forgot password?” to the sign-in page, so people can get a reset link by email. Needs email and the public URL."
-            value={form.getValue("password_reset.self_service_enabled")}
-            onChange={(v) => form.setValue("password_reset.self_service_enabled", v)}
-            restartRequired={restartKeys.has("password_reset.self_service_enabled")}
+            label="Trusted proxies"
+            dirty={form.isDirty(TRUSTED_PROXIES_KEY)}
+            description={
+              trustedProxiesManaged
+                ? "Managed by PRAIRIE_TRUSTED_PROXIES."
+                : "Comma-separated proxy ranges; empty keeps the private defaults."
+            }
+            hint="172.16.0.0/12, 203.0.113.7/32"
+            value={form.getValue(TRUSTED_PROXIES_KEY)}
+            onChange={(v) => form.setValue(TRUSTED_PROXIES_KEY, v)}
+            disabled={trustedProxiesManaged}
+            restartRequired={restartKeys.has(TRUSTED_PROXIES_KEY)}
           />
         </FieldGroup>
 
         <FieldGroup
-          label="Logging"
-          restartAll={allRestart(LOGGING_KEYS)}
-          dirty={anyDirty(LOGGING_KEYS)}
+          label="Database"
+          restartAll={allRestart(DATABASE_KEYS)}
+          dirty={anyDirty(DATABASE_KEYS)}
         >
           <SettingField
-            label="Log level"
-            settingKey="server.log_level"
-            dirty={form.isDirty("server.log_level")}
-            type="select"
-            description="Debug is loud; use it while chasing a problem."
-            value={form.getValue("server.log_level")}
-            onChange={(v) => form.setValue("server.log_level", v)}
-            restartRequired={restartKeys.has("server.log_level")}
-            options={[
-              { value: "debug", label: "Debug" },
-              { value: "info", label: "Info" },
-              { value: "warn", label: "Warn" },
-              { value: "error", label: "Error" },
-            ]}
+            label="Maximum Postgres connections"
+            dirty={form.isDirty("database.max_connections")}
+            type="number"
+            description="Raise only if the logs show connection-pool waits."
+            value={form.getValue("database.max_connections")}
+            onChange={(v) => form.setValue("database.max_connections", v)}
+            restartRequired={restartKeys.has("database.max_connections")}
           />
-          <AdvancedSection
-            id="general.logging"
-            count={LOGGING_ADVANCED_KEYS.length}
-            forceOpen={form.isDirty("server.log_quiet")}
-          >
-            <SettingField
-              label="Quiet log prefixes"
-              settingKey="server.log_quiet"
-              dirty={form.isDirty("server.log_quiet")}
-              hint="metadata, scanner"
-              description="Drops log lines starting with any of these words."
-              value={form.getValue("server.log_quiet")}
-              onChange={(v) => form.setValue("server.log_quiet", v)}
-              restartRequired={restartKeys.has("server.log_quiet")}
-            />
-          </AdvancedSection>
         </FieldGroup>
+
+        {form.sensitiveStatusError ? (
+          <div
+            className="flex items-start gap-3 rounded-xl border border-red-500/20 bg-red-500/5 p-4"
+            role="alert"
+          >
+            <AlertTriangle className="mt-0.5 h-4 w-4 shrink-0 text-red-500" />
+            <div>
+              <p className="text-sm font-medium">Redis settings are unavailable</p>
+              <p className="text-muted-foreground mt-1 text-[13px]">
+                Protected credential status could not be loaded. Reload this page to edit Redis.
+              </p>
+            </div>
+          </div>
+        ) : (
+          <RedisGroup form={form} restartKeys={restartKeys} secrets={redisUrlEditors} />
+        )}
       </div>
 
       <SaveBar
         dirtyCount={form.dirtyCount}
-        onSave={form.save}
-        onDiscard={form.discard}
-        isSaving={form.isSaving}
+        onSave={handleSave}
+        onDiscard={handleDiscard}
+        isSaving={form.isSaving || saveInProgress}
       />
     </div>
   );
diff --git a/web/src/pages/admin-settings/InvitationsTab.test.tsx b/web/src/pages/admin-settings/InvitationsTab.test.tsx
index e91e9f594b..d408fab9f3 100644
--- a/web/src/pages/admin-settings/InvitationsTab.test.tsx
+++ b/web/src/pages/admin-settings/InvitationsTab.test.tsx
@@ -229,6 +229,15 @@ it("creates a link invitation without an address and shows the link to share", a
   expect(screen.getByText("https://example.invalid/invite/link-only")).toBeInTheDocument();
   expect(screen.getByText(/Anyone with the link can use it/)).toBeInTheDocument();
 });
+it("selects a delivery option when its card text is clicked", () => {
+  render(<InvitationsTab />, { wrapper: MemoryRouter });
+  fireEvent.click(screen.getByRole("button", { name: "Invite someone" }));
+  fireEvent.click(screen.getByText("You share the link yourself, for example in a chat."));
+  expect(screen.getByLabelText("Create link")).toBeChecked();
+  expect(screen.getByLabelText("Create link")).toHaveFocus();
+  fireEvent.click(screen.getByText("We email the link. You can copy it too."));
+  expect(screen.getByLabelText("Send email")).toBeChecked();
+});
 it("offers only link creation when email is not configured", () => {
   mocks.emailDelivery = false;
   render(<InvitationsTab />, { wrapper: MemoryRouter });
@@ -236,9 +245,10 @@ it("offers only link creation when email is not configured", () => {
   expect(screen.getByLabelText("Create link")).toBeChecked();
   expect(screen.getByLabelText("Send email")).toBeDisabled();
   expect(screen.getByText("Email isn't set up on this server.")).toBeInTheDocument();
-  expect(screen.getByRole("link", { name: /Notifications settings/ })).toHaveAttribute(
+  // The mail server has its own page; Notifications only links to it.
+  expect(screen.getByRole("link", { name: /Email settings/ })).toHaveAttribute(
     "href",
-    "/admin/settings/notifications",
+    "/admin/settings/email",
   );
   expect(screen.getByRole("button", { name: "Create link" })).toBeInTheDocument();
 });
diff --git a/web/src/pages/admin-settings/InvitationsTab.tsx b/web/src/pages/admin-settings/InvitationsTab.tsx
index e395a4c835..ffa36c3a61 100644
--- a/web/src/pages/admin-settings/InvitationsTab.tsx
+++ b/web/src/pages/admin-settings/InvitationsTab.tsx
@@ -753,12 +753,12 @@ function CreateInvitationForm({
           <div className="flex items-start gap-3 rounded-xl border border-amber-500/20 bg-amber-500/5 p-3">
             <AlertTriangle className="mt-0.5 h-4 w-4 shrink-0 text-amber-500" aria-hidden="true" />
             <p className="text-[13px] leading-relaxed">
-              To send invitations by email, set up email in{" "}
+              To send invitations by email, set up the mail server in{" "}
               <Link
-                to="/admin/settings/notifications"
+                to="/admin/settings/email"
                 className="text-foreground inline-flex items-center gap-1 font-medium hover:underline"
               >
-                Notifications settings
+                Email settings
                 <ArrowRight className="h-3 w-3" aria-hidden="true" />
               </Link>
             </p>
diff --git a/web/src/pages/admin-settings/InviteCodesTab.tsx b/web/src/pages/admin-settings/InviteCodesTab.tsx
index 3867a6b0d5..eaa5a2121d 100644
--- a/web/src/pages/admin-settings/InviteCodesTab.tsx
+++ b/web/src/pages/admin-settings/InviteCodesTab.tsx
@@ -126,7 +126,7 @@ export default function InviteCodesTab() {
           <p className="text-muted-foreground text-sm">
             Codes only work while public signups are on.{" "}
             <Link
-              to="/admin/settings/general"
+              to="/admin/settings/sign-in"
               className="text-foreground inline-flex items-center gap-1 font-medium hover:underline"
             >
               Public signups setting
@@ -140,7 +140,7 @@ export default function InviteCodesTab() {
               <span className="font-medium text-amber-500">Public signups are off</span> — these
               codes won't work until you enable them.{" "}
               <Link
-                to="/admin/settings/general"
+                to="/admin/settings/sign-in"
                 className="text-foreground inline-flex items-center gap-1 font-medium hover:underline"
               >
                 Public signups setting
diff --git a/web/src/pages/admin-settings/LibraryMetadataSettings.test.tsx b/web/src/pages/admin-settings/LibraryMetadataSettings.test.tsx
index ebf78ca229..8e9d6a1cdc 100644
--- a/web/src/pages/admin-settings/LibraryMetadataSettings.test.tsx
+++ b/web/src/pages/admin-settings/LibraryMetadataSettings.test.tsx
@@ -1,3 +1,5 @@
+import { render as renderPage, screen, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
 import { renderToStaticMarkup } from "react-dom/server";
 import { MemoryRouter } from "react-router";
 import { beforeEach, describe, expect, it, vi } from "vitest";
@@ -6,14 +8,6 @@ import LibraryMetadataSettings from "./LibraryMetadataSettings";
 
 const useSettingsFormMock = vi.fn();
 const useRestartKeysMock = vi.fn(() => new Set<string>());
-const storageAvailableMock = vi.fn(() => true);
-const markerCapabilitiesMock = vi.fn<() => { data?: Record<string, boolean> }>(() => ({
-  data: { detection_kind_settings: true },
-}));
-
-vi.mock("@/hooks/useBranding", () => ({
-  useBranding: () => ({ storageAvailable: storageAvailableMock() }),
-}));
 
 vi.mock("@tanstack/react-query", async (importOriginal) => ({
   ...(await importOriginal<typeof import("@tanstack/react-query")>()),
@@ -28,16 +22,15 @@ vi.mock("@/hooks/useRestartKeys", () => ({
   useRestartKeys: () => useRestartKeysMock(),
 }));
 
-vi.mock("@/hooks/queries/admin/settings", () => ({
-  useCheckAdminSettingsConnection: () => ({
-    mutateAsync: vi.fn(),
-    isPending: false,
-  }),
-  useCatalogSearchStatus: () => ({ data: undefined, isLoading: true }),
+/** A transcode node subtitle sync could run on. */
+const transcodeNode = { id: 1, name: "node-1", type: "transcode", enabled: true, healthy: true };
+const useAdminNodesMock = vi.fn(() => ({
+  data: [transcodeNode] as unknown[] | undefined,
+  isSuccess: true,
 }));
 
-vi.mock("@/hooks/queries/admin/markers", () => ({
-  useAdminMarkerCapabilities: () => markerCapabilitiesMock(),
+vi.mock("@/hooks/queries/admin/nodes", () => ({
+  useAdminNodes: () => useAdminNodesMock(),
 }));
 
 const ratingSourcesMock = vi.fn(() => ({
@@ -74,15 +67,6 @@ vi.mock("@/hooks/queries/admin/ratingSources", () => ({
   useAdminRatingSources: () => ratingSourcesMock(),
 }));
 
-vi.mock("@/hooks/queries/admin/tasks", () => ({
-  useTasks: () => ({ data: [] }),
-  useRunTask: () => ({ mutateAsync: vi.fn() }),
-}));
-
-vi.mock("@/components/realtimeEventsContext", () => ({
-  useEventChannel: () => undefined,
-}));
-
 function makeForm(values: Record<string, string>, dirty: string[] = []) {
   const dirtySet = new Set(dirty);
   return {
@@ -90,16 +74,12 @@ function makeForm(values: Record<string, string>, dirty: string[] = []) {
     getValue: (key: string) => values[key] ?? "",
     getPersistedValue: (key: string) => values[key] ?? "",
     setValue: vi.fn(),
-    resetValue: vi.fn(),
     isDirty: (key: string) => dirtySet.has(key),
-    isClearStaged: (key: string) => dirtySet.has(key) && (values[key] ?? "") === "",
     dirtyCount: dirtySet.size,
     save: vi.fn(),
     discard: vi.fn(),
     isSaving: false,
     restartRequired: false,
-    sensitiveConfigured: [] as string[],
-    buildConnectionCheckRequest: vi.fn(() => ({ values: {}, dirty_keys: [] })),
   };
 }
 
@@ -112,26 +92,37 @@ function render(values: Record<string, string>, dirty: string[] = []) {
   );
 }
 
-function text(markup: string): string {
+/** Opens one group's Advanced disclosure via its persisted state. */
+function expand(id: string) {
+  localStorage.setItem(`silo.admin.advanced.${id}`, "true");
+}
+
+/** The static-markup group whose heading reads `name`. */
+function groupNamed(markup: string, name: string): HTMLElement {
   const container = document.createElement("div");
   container.innerHTML = markup;
-  return container.textContent ?? "";
+  const group = Array.from(container.querySelectorAll<HTMLElement>("[role=group]")).find(
+    (candidate) => candidate.querySelector("h3")?.textContent === name,
+  );
+  if (!group) throw new Error(`no group rendered with heading: ${name}`);
+  return group;
 }
 
-// The toggle is a Radix switch, so reach it through the label association
-// SettingField sets up rather than by scanning the markup for "disabled".
-function toggleDisabled(markup: string, label: string): boolean {
+/** The accessible names of a group's disclosure buttons. */
+function disclosures(group: HTMLElement): string[] {
+  return Array.from(group.querySelectorAll("button[aria-expanded]"), (button) =>
+    button.getAttribute("aria-label"),
+  ).filter((label): label is string => label !== null);
+}
+
+function text(markup: string): string {
   const container = document.createElement("div");
   container.innerHTML = markup;
-  const labelEl = Array.from(container.querySelectorAll("label")).find(
-    (el) => el.textContent?.trim() === label,
-  );
-  if (!labelEl?.htmlFor) throw new Error(`no label found for ${label}`);
-  const control = container.querySelector(`[id="${labelEl.htmlFor}"]`);
-  if (!control) throw new Error(`no control found for ${label}`);
-  return control.hasAttribute("disabled");
+  return container.textContent ?? "";
 }
 
+// The toggle is a Radix switch, so reach it through the label association
+// SettingField sets up rather than by scanning the markup.
 function toggleChecked(markup: string, label: string): boolean {
   const container = document.createElement("div");
   container.innerHTML = markup;
@@ -148,55 +139,90 @@ describe("LibraryMetadataSettings", () => {
   beforeEach(() => {
     localStorage.clear();
     useRestartKeysMock.mockReturnValue(new Set<string>());
-    storageAvailableMock.mockReturnValue(true);
-    markerCapabilitiesMock.mockReturnValue({ data: { detection_kind_settings: true } });
+    useAdminNodesMock.mockReturnValue({ data: [transcodeNode], isSuccess: true });
   });
 
-  it("offers the server-wide real-time monitoring switch, on by default", () => {
-    const rendered = render({ "catalog.search.provider": "postgres" });
+  it("orders the groups with the general switch first", () => {
+    const container = document.createElement("div");
+    container.innerHTML = render({});
 
-    expect(text(rendered)).toContain("Real-time monitoring");
-    expect(text(rendered)).toContain(
-      "Scan automatically when files in library folders change. Prairie scans only what changed, usually within seconds. Works on local disks; network shares (NFS, SMB) aren't supported. Libraries can opt out individually.",
+    const headings = Array.from(
+      container.querySelectorAll("section[role=group]"),
+      (group) => group.querySelector("h3")?.textContent,
+    );
+    expect(headings).toEqual([
+      "General",
+      "Scanning",
+      "Maturity limits",
+      "Ratings",
+      "Subtitle sync",
+    ]);
+  });
+
+  it("shows the versions switch alone in General, without a disclosure", () => {
+    const group = groupNamed(render({}), "General");
+    expect(disclosures(group)).toEqual([]);
+    expect(group.textContent).toContain("Show all library versions on detail page");
+    expect(group.textContent).not.toContain("Save provider artwork to storage");
+  });
+
+  it("shows the versions switch as the opposite of the stored scope key", () => {
+    const label = "Show all library versions on detail page";
+    expect(toggleChecked(render({}), label)).toBe(true);
+    expect(toggleChecked(render({ "catalog.scope_versions_to_library": "false" }), label)).toBe(
+      true,
     );
-    expect(toggleDisabled(rendered, "Real-time monitoring")).toBe(false);
-    expect(toggleChecked(rendered, "Real-time monitoring")).toBe(true);
+    expect(toggleChecked(render({ "catalog.scope_versions_to_library": "true" }), label)).toBe(
+      false,
+    );
+  });
+
+  it("shows the three worker counts and keeps the rest of scanning behind Advanced", () => {
+    const rendered = render({});
+    const scanning = groupNamed(rendered, "Scanning");
+
+    for (const label of ["Scanner workers", "Matcher workers", "Image encoding workers"]) {
+      expect(scanning.textContent).toContain(label);
+    }
+    expect(disclosures(scanning)).toEqual(["Advanced · 2 settings"]);
+    expect(scanning.textContent).not.toContain("Matcher batch size");
+    // Each library has its own real-time monitoring switch; the server-wide
+    // one shows only while it is off.
+    expect(text(rendered)).not.toContain("Real-time monitoring");
 
     const calls = useSettingsFormMock.mock.calls;
     const keys: string[] = calls[calls.length - 1]?.[0]?.keys ?? [];
     expect(keys).toEqual(
       expect.arrayContaining([
-        "metadata.cache_images",
         "catalog.scope_versions_to_library",
         "scanner.workers",
         "matcher.workers",
         "matcher.batch_size",
         "metadata.image_workers",
         "metadata.person_refresh_per_minute",
-        "markers.mode",
-        "markers.lazy_playback",
-        "markers.online_storage",
-        "markers.detection_workers",
-        "markers.detect_intros",
-        "markers.detect_credits",
-        "catalog.search.provider",
-        "catalog.search.meilisearch.url",
-        "catalog.search.meilisearch.api_key",
-        "catalog.search.meilisearch.semantic_ratio",
       ]),
     );
-    // Hidden tier: still saved through the API, no control on this tab.
-    expect(keys).not.toContain("catalog.search.meilisearch.embedder");
-    expect(keys).not.toContain("catalog.search.meilisearch.binary_quantized");
-    expect(keys).not.toContain("catalog.search.meilisearch.rebuild_batch_size");
+    // Moved to Storage, Playback and Search, which load and save them.
+    expect(keys).not.toContain("metadata.cache_images");
+    expect(keys.some((key) => key.startsWith("markers."))).toBe(false);
+    expect(keys.some((key) => key.startsWith("catalog.search."))).toBe(false);
     expect(keys).toContain("scanner.realtime_monitoring");
   });
 
+  it("shows the server-wide real-time monitoring switch only while it is off", () => {
+    const off = render({ "scanner.realtime_monitoring": "false" });
+    expect(toggleChecked(off, "Real-time monitoring")).toBe(false);
+
+    // Turning it back on keeps it in view until the change is saved.
+    const turningOn = render({ "scanner.realtime_monitoring": "true" }, [
+      "scanner.realtime_monitoring",
+    ]);
+    expect(toggleChecked(turningOn, "Real-time monitoring")).toBe(true);
+  });
+
   it("offers the background person lookup rate in the advanced scanning settings", () => {
     // The Advanced section opens on its own when one of its fields is edited.
-    const rendered = render({ "catalog.search.provider": "postgres" }, [
-      "metadata.person_refresh_per_minute",
-    ]);
+    const rendered = render({}, ["metadata.person_refresh_per_minute"]);
 
     expect(text(rendered)).toContain("Person lookups per minute");
     expect(text(rendered)).toContain(
@@ -204,72 +230,6 @@ describe("LibraryMetadataSettings", () => {
     );
   });
 
-  it("reflects a stored off value for real-time monitoring", () => {
-    const rendered = render({ "scanner.realtime_monitoring": "false" });
-
-    expect(toggleChecked(rendered, "Real-time monitoring")).toBe(false);
-  });
-
-  it("hides Meilisearch connection fields until that engine is selected", () => {
-    expect(text(render({ "catalog.search.provider": "postgres" }))).not.toContain(
-      "Meilisearch URL",
-    );
-
-    expect(text(render({ "catalog.search.provider": "meilisearch" }))).toContain("Meilisearch URL");
-  });
-
-  it("allows caching provider artwork without an S3 bucket", () => {
-    storageAvailableMock.mockReturnValue(false);
-    const rendered = render({});
-    expect(text(rendered)).not.toContain("Artwork storage needs a public S3 bucket");
-    expect(toggleDisabled(rendered, "Keep provider artwork")).toBe(false);
-  });
-
-  it("offers separate intro and credits detection while this server detects markers", () => {
-    for (const mode of ["local", "both"]) {
-      const rendered = text(render({ "markers.mode": mode }));
-      expect(rendered).toContain("Detection workers");
-      expect(rendered).toContain("Detect intros");
-      expect(rendered).toContain("Detect credits");
-      expect(rendered).toContain("reading the end of each episode and movie");
-    }
-    for (const mode of ["online", "off"]) {
-      const rendered = text(render({ "markers.mode": mode }));
-      expect(rendered).not.toContain("Detection workers");
-      expect(rendered).not.toContain("Detect intros");
-      expect(rendered).not.toContain("Detect credits");
-    }
-  });
-
-  it("hides the detection switches unless the server honors them", () => {
-    const cases: Array<[string, { data?: Record<string, boolean> }]> = [
-      ["capabilities not loaded", {}],
-      ["a server without detection_kind_settings", { data: { redetect_markers: true } }],
-      ["a server with detection_kind_settings off", { data: { detection_kind_settings: false } }],
-    ];
-    for (const [, capabilities] of cases) {
-      markerCapabilitiesMock.mockReturnValue(capabilities);
-      const rendered = text(render({ "markers.mode": "local" }));
-      expect(rendered).not.toContain("Detect intros");
-      expect(rendered).not.toContain("Detect credits");
-      expect(rendered).toContain("Detection workers");
-    }
-  });
-
-  it("shows each detection switch's saved state and defaults both on", () => {
-    const defaults = render({ "markers.mode": "both" });
-    expect(toggleChecked(defaults, "Detect intros")).toBe(true);
-    expect(toggleChecked(defaults, "Detect credits")).toBe(true);
-
-    const introsOnly = render({ "markers.mode": "local", "markers.detect_credits": "false" });
-    expect(toggleChecked(introsOnly, "Detect intros")).toBe(true);
-    expect(toggleChecked(introsOnly, "Detect credits")).toBe(false);
-
-    const creditsOnly = render({ "markers.mode": "local", "markers.detect_intros": "false" });
-    expect(toggleChecked(creditsOnly, "Detect intros")).toBe(false);
-    expect(toggleChecked(creditsOnly, "Detect credits")).toBe(true);
-  });
-
   it("lists the ratings plugins declare, grouped by plugin, but not IMDb and TMDB", () => {
     const markup = render({ "catalog.extra_rating_sources": "kinopoisk" });
     const page = text(markup);
@@ -301,3 +261,126 @@ describe("LibraryMetadataSettings", () => {
     expect(page).not.toContain("From Kinopoisk Metadata");
   });
 });
+
+describe("LibraryMetadataSettings subtitle sync", () => {
+  beforeEach(() => {
+    localStorage.clear();
+    useRestartKeysMock.mockReturnValue(new Set<string>());
+    useAdminNodesMock.mockReturnValue({ data: [transcodeNode], isSuccess: true });
+  });
+
+  function renderInteractive(values: Record<string, string>, dirty: string[] = []) {
+    const form = makeForm(values, dirty);
+    useSettingsFormMock.mockReturnValue(form);
+    const view = renderPage(
+      <MemoryRouter>
+        <LibraryMetadataSettings />
+      </MemoryRouter>,
+    );
+    return {
+      form,
+      unmount: view.unmount,
+      group: within(screen.getByRole("group", { name: "Subtitle sync" })),
+    };
+  }
+
+  it("stages the subtitle sync settings with their defaults", async () => {
+    expand("library.subtitle_sync");
+    const { form, group } = renderInteractive({});
+
+    expect(useSettingsFormMock.mock.calls[0]?.[0]?.keys).toEqual(
+      expect.arrayContaining([
+        "subtitles.auto_sync",
+        "subtitles.sync_execution",
+        "subtitles.sync_node_capacity",
+      ]),
+    );
+    expect(
+      group.getByText("Shifts subtitle timing to match the video's audio."),
+    ).toBeInTheDocument();
+    const auto = group.getByRole("switch", { name: /Sync subtitles automatically/ });
+    expect(auto).toBeChecked();
+    expect(
+      group.getByText(
+        "Aligns subtitles to the video's audio: downloaded and uploaded ones when they're added, any other the first time it's played. Fixes subtitles cut for a different release.",
+      ),
+    ).toBeInTheDocument();
+    expect(group.getByRole("combobox", { name: /Where to analyze audio/ })).toHaveTextContent(
+      "Prefer transcode nodes",
+    );
+    expect(
+      group.getByRole("spinbutton", { name: /Concurrent syncs per transcode node/ }),
+    ).toHaveValue(1);
+    expect(group.queryByText("No transcode nodes are connected")).not.toBeInTheDocument();
+
+    await userEvent.click(auto);
+    expect(form.setValue).toHaveBeenCalledWith("subtitles.auto_sync", "false");
+  });
+
+  it("keeps where and how many syncs run behind the disclosure", () => {
+    const { group } = renderInteractive({});
+
+    expect(group.getByRole("switch", { name: /Sync subtitles automatically/ })).toBeInTheDocument();
+    expect(group.getByRole("button", { name: "Advanced · 2 settings" })).toHaveAttribute(
+      "aria-expanded",
+      "false",
+    );
+    expect(group.queryByRole("combobox", { name: /Where to analyze audio/ })).toBeNull();
+    expect(
+      group.queryByRole("spinbutton", { name: /Concurrent syncs per transcode node/ }),
+    ).toBeNull();
+  });
+
+  it("opens the disclosure for an unsaved placement change", () => {
+    const { group } = renderInteractive({ "subtitles.sync_execution": "local" }, [
+      "subtitles.sync_execution",
+    ]);
+
+    expect(group.getByRole("combobox", { name: /Where to analyze audio/ })).toHaveTextContent(
+      "Local server",
+    );
+  });
+
+  it("hides node capacity for local sync and warns about node-only sync without nodes", () => {
+    expand("library.subtitle_sync");
+    const local = renderInteractive({ "subtitles.sync_execution": "local" });
+    expect(local.group.getByRole("button", { name: "Advanced · 1 setting" })).toBeInTheDocument();
+    expect(
+      local.group.queryByRole("spinbutton", { name: /Concurrent syncs per transcode node/ }),
+    ).not.toBeInTheDocument();
+    local.unmount();
+
+    useAdminNodesMock.mockReturnValue({ data: [], isSuccess: true });
+    const nodeOnly = renderInteractive({ "subtitles.sync_execution": "transcode_nodes_only" });
+    expect(nodeOnly.group.getByText("No transcode nodes are connected")).toBeInTheDocument();
+  });
+
+  it("keeps an unsaved node capacity in view after sync moves to the local server", () => {
+    expand("library.subtitle_sync");
+    const { group } = renderInteractive({ "subtitles.sync_execution": "local" }, [
+      "subtitles.sync_execution",
+      "subtitles.sync_node_capacity",
+    ]);
+
+    expect(group.getByRole("button", { name: "Advanced · 2 settings" })).toBeInTheDocument();
+    expect(
+      group.getByRole("spinbutton", { name: /Concurrent syncs per transcode node/ }),
+    ).toBeVisible();
+  });
+
+  it("does not warn before the node list has loaded", () => {
+    expand("library.subtitle_sync");
+    useAdminNodesMock.mockReturnValue({ data: undefined, isSuccess: false });
+    const { group } = renderInteractive({ "subtitles.sync_execution": "transcode_nodes_only" });
+
+    expect(group.queryByText("No transcode nodes are connected")).not.toBeInTheDocument();
+  });
+
+  it("saves subtitle sync through this page's save bar", async () => {
+    const { form } = renderInteractive({ "subtitles.auto_sync": "false" }, ["subtitles.auto_sync"]);
+
+    await userEvent.click(screen.getByRole("button", { name: "Save" }));
+
+    expect(form.save).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/web/src/pages/admin-settings/LibraryMetadataSettings.tsx b/web/src/pages/admin-settings/LibraryMetadataSettings.tsx
index 4d49f9d402..5fbf5263f3 100644
--- a/web/src/pages/admin-settings/LibraryMetadataSettings.tsx
+++ b/web/src/pages/admin-settings/LibraryMetadataSettings.tsx
@@ -1,28 +1,18 @@
-import { useState } from "react";
 import { useQueryClient } from "@tanstack/react-query";
-import { ArrowRight, RotateCcw } from "lucide-react";
-import { Link } from "react-router";
+import { RotateCcw } from "lucide-react";
 
-import type { ConnectionCheckResponse } from "@/api/types";
-import { ConnectionCheckAction } from "@/components/admin/ConnectionCheckAction";
 import { AdvancedSection } from "@/components/settings/AdvancedSection";
-import { SecretField } from "@/components/settings/SecretField";
 import { SettingsPageHeader } from "@/components/settings/SettingsPageHeader";
 import { Button } from "@/components/ui/button";
 import { Skeleton } from "@/components/ui/skeleton";
-import { useAdminMarkerCapabilities } from "@/hooks/queries/admin/markers";
+import { useAdminNodes } from "@/hooks/queries/admin/nodes";
 import {
   useAdminRatingSourceCapabilities,
   useAdminRatingSources,
 } from "@/hooks/queries/admin/ratingSources";
-import {
-  useCatalogSearchStatus,
-  useCheckAdminSettingsConnection,
-} from "@/hooks/queries/admin/settings";
 import { useRestartKeys } from "@/hooks/useRestartKeys";
 import { useSettingsForm } from "@/hooks/useSettingsForm";
 import { FieldGroup } from "./FieldGroup";
-import { MarkerTasksCard } from "./MarkerTasksCard";
 import {
   EXTRA_RATING_SOURCES_KEY,
   groupRatingSourcesByPlugin,
@@ -32,80 +22,62 @@ import {
   undeclaredRatingSources,
 } from "./ratingSources";
 import { SaveBar } from "@/components/SaveBar";
-import { SearchStatusPanel } from "./SearchStatusPanel";
+import {
+  SUBTITLE_SYNC_EXECUTION_DEFAULT,
+  hasUsableTranscodeNode,
+  isNodeBackedExecution,
+  subtitleSyncExecutionOptions,
+} from "./playbackSettings.utils";
 import { SettingField, SettingFieldStatus } from "./SettingField";
 import { WORKER_SETTING_DEFAULTS, hasWorkerOverrides } from "./settingsWorkerDefaults";
 
-const ARTWORK_KEYS = ["metadata.cache_images"];
+// Skip markers are on Playback, search on its own Search page, and saving
+// provider artwork on Storage; none of their keys are loaded here.
+const GENERAL_KEYS = ["catalog.scope_versions_to_library"];
 
-const BROWSING_KEYS = ["catalog.scope_versions_to_library", "access.unrated_content"];
+// Not a browsing preference: a rule about what a profile with a maximum
+// content rating may see at all.
+const MATURITY_KEYS = ["access.unrated_content"];
 
 const RATINGS_KEYS = [EXTRA_RATING_SOURCES_KEY];
 
-// A top-level toggle in the Scanning group, outside the collapsed worker
-// tuning, and applied live without a restart.
-const REALTIME_MONITORING_KEY = "scanner.realtime_monitoring";
+// How many files, lookups, and images run at once is what decides scan speed
+// on a given machine, so the three worker counts are shown; the person lookup
+// rate and the matcher batch are tuning behind Advanced.
+const SCANNER_ADVANCED_KEYS = ["metadata.person_refresh_per_minute", "matcher.batch_size"];
 
 const SCANNER_KEYS = [
   "scanner.workers",
   "matcher.workers",
-  "matcher.batch_size",
   "metadata.image_workers",
-  "metadata.person_refresh_per_minute",
+  ...SCANNER_ADVANCED_KEYS,
 ];
 
-const SCANNING_GROUP_KEYS = [REALTIME_MONITORING_KEY, ...SCANNER_KEYS];
-
-const MARKER_KEYS = [
-  "markers.mode",
-  "markers.lazy_playback",
-  "markers.online_storage",
-  "markers.detection_workers",
-  "markers.detect_intros",
-  "markers.detect_credits",
-];
-
-const MEILI_URL_KEY = "catalog.search.meilisearch.url";
-const MEILI_API_KEY = "catalog.search.meilisearch.api_key";
+// Each library turns real-time monitoring on or off in its own settings, so the
+// server-wide switch only appears while it is off: the library editor sends an
+// admin here to turn it back on.
+const REALTIME_MONITORING_KEY = "scanner.realtime_monitoring";
 
-const MEILI_ADVANCED_KEYS = [
-  "catalog.search.meilisearch.index",
-  "catalog.search.meilisearch.timeout_ms",
-  "catalog.search.meilisearch.matching_strategy",
-  "catalog.search.meilisearch.sync_batch_size",
-  "catalog.search.meilisearch.semantic_enabled",
-  "catalog.search.meilisearch.semantic_ratio",
-];
+const SCANNING_GROUP_KEYS = [REALTIME_MONITORING_KEY, ...SCANNER_KEYS];
 
-const MEILI_KEYS = [MEILI_URL_KEY, MEILI_API_KEY, ...MEILI_ADVANCED_KEYS];
+// Subtitle sync aligns a subtitle file that is already there, so it sits with
+// the other per-file analysis here rather than with the subtitle providers that
+// supply the files. Where the audio is decoded is placement, behind Advanced.
+const SUBTITLE_SYNC_ADVANCED_KEYS = ["subtitles.sync_execution", "subtitles.sync_node_capacity"];
 
-const SEARCH_KEYS = ["catalog.search.provider", ...MEILI_KEYS];
+const SUBTITLE_SYNC_KEYS = ["subtitles.auto_sync", ...SUBTITLE_SYNC_ADVANCED_KEYS];
 
-// Hidden tier: still saved and readable through the settings API, deliberately
-// without a control here because the defaults are right for every deployment we
-// support — catalog.search.meilisearch.{rebuild_batch_size,
-// rebuild_task_queue_depth,index_types,embedder,binary_quantized}.
 const KEYS = [
-  ...ARTWORK_KEYS,
-  ...BROWSING_KEYS,
-  ...RATINGS_KEYS,
+  ...GENERAL_KEYS,
   ...SCANNING_GROUP_KEYS,
-  ...MARKER_KEYS,
-  ...SEARCH_KEYS,
+  ...MATURITY_KEYS,
+  ...RATINGS_KEYS,
+  ...SUBTITLE_SYNC_KEYS,
 ];
 
 export default function LibraryMetadataSettings() {
   const form = useSettingsForm({ keys: KEYS });
   const restartKeys = useRestartKeys();
-  const checkConnection = useCheckAdminSettingsConnection();
-  const [connectionResult, setConnectionResult] = useState<ConnectionCheckResponse | null>(null);
-
-  const provider = form.getValue("catalog.search.provider") || "postgres";
-  const meiliEnabled = provider === "meilisearch";
-  const { data: searchStatus } = useCatalogSearchStatus(meiliEnabled);
-  // An older API node saves the detection kind switches but ignores them, so
-  // they are offered only where the server says it honors them.
-  const { data: markerCapabilities } = useAdminMarkerCapabilities();
   // An older API node has no rating source list, so the Ratings group shows
   // only where the server says it has one.
   const { data: ratingSourceCapabilities } = useAdminRatingSourceCapabilities();
@@ -115,41 +87,20 @@ export default function LibraryMetadataSettings() {
 
   // A saved rating choice also refreshes cached title pages and cards.
   const handleSave = () => saveAndRefreshRatings(form, queryClient);
-  const detectionKindSettings = markerCapabilities?.detection_kind_settings === true;
   const anyDirty = (keys: string[]) => keys.some((key) => form.isDirty(key));
   const allRestart = (keys: string[]) => keys.every((key) => restartKeys.has(key));
   // Restoring stages every worker value at once; the save bar still confirms
   // it. The button is only offered while something differs from the default,
   // so an untouched group never shows a control that would do nothing.
   const workerOverrides = hasWorkerOverrides(form.getValue);
+  const showRealtimeSwitch =
+    form.getPersistedValue(REALTIME_MONITORING_KEY) === "false" ||
+    form.isDirty(REALTIME_MONITORING_KEY);
   function restoreWorkerDefaults() {
     for (const [key, fallback] of Object.entries(WORKER_SETTING_DEFAULTS)) {
       if (form.getValue(key) !== fallback) form.setValue(key, fallback);
     }
   }
-  // Staged Meilisearch edits stay reachable after switching the provider back,
-  // so the save bar can never count a change the admin cannot see.
-  const showMeili = meiliEnabled || anyDirty(MEILI_KEYS);
-  const enablingSemanticSearch =
-    form.isDirty("catalog.search.meilisearch.semantic_enabled") &&
-    form.getPersistedValue("catalog.search.meilisearch.semantic_enabled") !== "true" &&
-    form.getValue("catalog.search.meilisearch.semantic_enabled") === "true";
-
-  async function handleCheckConnection() {
-    try {
-      setConnectionResult(
-        await checkConnection.mutateAsync({
-          kind: "meilisearch",
-          body: form.buildConnectionCheckRequest(MEILI_KEYS),
-        }),
-      );
-    } catch (error) {
-      setConnectionResult({
-        success: false,
-        message: error instanceof Error ? error.message : "Connection check failed.",
-      });
-    }
-  }
 
   const extraRatingSources = parseRatingSources(form.getValue(EXTRA_RATING_SOURCES_KEY));
   const ratingSourceGroups = groupRatingSourcesByPlugin(ratingSources.data?.items ?? []);
@@ -169,10 +120,18 @@ export default function LibraryMetadataSettings() {
       EXTRA_RATING_SOURCES_KEY,
       toggleRatingSource(form.getValue(EXTRA_RATING_SOURCES_KEY), source, on),
     );
-  const markerMode = form.getValue("markers.mode") || "both";
-  const onlineMarkersEnabled = markerMode === "online" || markerMode === "both";
-  const onlineMarkerStorage = form.getValue("markers.online_storage") || "stored";
-  const localMarkersEnabled = markerMode === "local" || markerMode === "both";
+
+  // Gate the node-backed sync modes only on a node list we actually have:
+  // while the query is in flight or after it failed, leave every option
+  // reachable rather than blocking a valid choice on a transient error.
+  const nodes = useAdminNodes();
+  const transcodeNodeAvailable = !nodes.isSuccess || hasUsableTranscodeNode(nodes.data);
+  const syncExecution =
+    form.getValue("subtitles.sync_execution") || SUBTITLE_SYNC_EXECUTION_DEFAULT;
+  const syncOnNodes = isNodeBackedExecution(syncExecution);
+  // An unsaved capacity stays in view after placement moves off the nodes, so
+  // the save bar never counts a change the admin cannot see.
+  const showSyncCapacity = syncOnNodes || form.isDirty("subtitles.sync_node_capacity");
 
   if (form.isLoading) {
     return (
@@ -188,37 +147,113 @@ export default function LibraryMetadataSettings() {
 
   return (
     <div className="flex h-full flex-col">
-      <SettingsPageHeader title="Library & Metadata" className="mb-8" />
+      <SettingsPageHeader title="Library & Metadata" />
 
       <div className="flex-1 space-y-5">
         <FieldGroup
-          label="Artwork"
-          description="Posters and backdrops from metadata providers, copied into your artwork storage."
-          restartAll={allRestart(ARTWORK_KEYS)}
+          label="General"
+          restartAll={allRestart(GENERAL_KEYS)}
+          dirty={anyDirty(GENERAL_KEYS)}
         >
+          {/* Shown as the opposite of the stored key: on is the default, where
+              catalog.scope_versions_to_library is false. */}
           <SettingField
-            label="Keep provider artwork"
+            label="Show all library versions on detail page"
             type="toggle"
-            description="When off, clients load provider artwork straight from the providers. Artwork stored next to your media is copied either way."
-            value={form.getValue("metadata.cache_images")}
-            onChange={(value) => form.setValue("metadata.cache_images", value)}
-            restartRequired={restartKeys.has("metadata.cache_images")}
+            description="When a title is in several libraries, its detail page lists every version the viewer can access, wherever they opened it. Off, it lists only the files in the library they opened it from. Playback always sees every version."
+            value={form.getValue("catalog.scope_versions_to_library") === "true" ? "false" : "true"}
+            onChange={(value) =>
+              form.setValue(
+                "catalog.scope_versions_to_library",
+                value === "true" ? "false" : "true",
+              )
+            }
+            restartRequired={restartKeys.has("catalog.scope_versions_to_library")}
           />
         </FieldGroup>
 
         <FieldGroup
-          label="Browsing"
-          description="How an item that lives in more than one library is shown."
-          restartAll={allRestart(BROWSING_KEYS)}
+          label="Scanning"
+          restartAll={allRestart(SCANNING_GROUP_KEYS)}
+          dirty={anyDirty(SCANNING_GROUP_KEYS)}
+          actions={
+            workerOverrides ? (
+              <Button
+                type="button"
+                variant="ghost"
+                size="xs"
+                className="text-muted-foreground hover:text-foreground"
+                onClick={restoreWorkerDefaults}
+              >
+                <RotateCcw aria-hidden="true" />
+                Restore defaults
+              </Button>
+            ) : undefined
+          }
         >
+          {showRealtimeSwitch && (
+            <SettingField
+              label="Real-time monitoring"
+              type="toggle"
+              description="Off for every library. When on, each library's own switch decides whether its folders are watched."
+              value={form.getValue(REALTIME_MONITORING_KEY) || "true"}
+              onChange={(value) => form.setValue(REALTIME_MONITORING_KEY, value)}
+              restartRequired={restartKeys.has(REALTIME_MONITORING_KEY)}
+            />
+          )}
           <SettingField
-            label="Show only the browsed library's versions"
-            type="toggle"
-            description="When an item is in several libraries, opening it from one library lists only the files stored there. Off, every version the viewer can access is listed no matter where they opened it. Playback always sees every version."
-            value={form.getValue("catalog.scope_versions_to_library") || "false"}
-            onChange={(value) => form.setValue("catalog.scope_versions_to_library", value)}
-            restartRequired={restartKeys.has("catalog.scope_versions_to_library")}
+            label="Scanner workers"
+            type="number"
+            description="How many files Prairie reads at once."
+            value={form.getValue("scanner.workers")}
+            onChange={(value) => form.setValue("scanner.workers", value)}
+            restartRequired={restartKeys.has("scanner.workers")}
           />
+          <SettingField
+            label="Matcher workers"
+            type="number"
+            description="How many items Prairie looks up at once."
+            value={form.getValue("matcher.workers")}
+            onChange={(value) => form.setValue("matcher.workers", value)}
+            restartRequired={restartKeys.has("matcher.workers")}
+          />
+          <SettingField
+            label="Image encoding workers"
+            type="number"
+            description="How many artwork images Prairie encodes at once. 0 uses one per CPU core."
+            value={form.getValue("metadata.image_workers")}
+            onChange={(value) => form.setValue("metadata.image_workers", value)}
+            restartRequired={restartKeys.has("metadata.image_workers")}
+          />
+          <AdvancedSection
+            id="library.scanning"
+            count={SCANNER_ADVANCED_KEYS.length}
+            forceOpen={anyDirty(SCANNER_ADVANCED_KEYS)}
+          >
+            <SettingField
+              label="Person lookups per minute"
+              type="number"
+              description="How many cast and crew members each server looks up per minute in the background. Opening a person's page isn't limited."
+              value={form.getValue("metadata.person_refresh_per_minute")}
+              onChange={(value) => form.setValue("metadata.person_refresh_per_minute", value)}
+              restartRequired={restartKeys.has("metadata.person_refresh_per_minute")}
+            />
+            <SettingField
+              label="Matcher batch size"
+              type="number"
+              description="How many items each matcher worker claims per round."
+              value={form.getValue("matcher.batch_size")}
+              onChange={(value) => form.setValue("matcher.batch_size", value)}
+              restartRequired={restartKeys.has("matcher.batch_size")}
+            />
+          </AdvancedSection>
+        </FieldGroup>
+
+        <FieldGroup
+          label="Maturity limits"
+          description="For profiles with a maximum content rating, which is set on each profile."
+          restartAll={allRestart(MATURITY_KEYS)}
+        >
           <SettingField
             label="Titles with no age rating"
             type="select"
@@ -289,350 +324,58 @@ export default function LibraryMetadataSettings() {
         )}
 
         <FieldGroup
-          label="Scanning"
-          restartAll={allRestart(SCANNING_GROUP_KEYS)}
-          dirty={anyDirty(SCANNING_GROUP_KEYS)}
-          actions={
-            workerOverrides ? (
-              <Button
-                type="button"
-                variant="ghost"
-                size="xs"
-                className="text-muted-foreground hover:text-foreground"
-                onClick={restoreWorkerDefaults}
-              >
-                <RotateCcw aria-hidden="true" />
-                Restore defaults
-              </Button>
-            ) : undefined
-          }
+          label="Subtitle sync"
+          description="Shifts subtitle timing to match the video's audio."
+          restartAll={allRestart(SUBTITLE_SYNC_KEYS)}
+          dirty={anyDirty(SUBTITLE_SYNC_KEYS)}
         >
           <SettingField
-            label="Real-time monitoring"
+            label="Sync subtitles automatically"
             type="toggle"
-            description="Scan automatically when files in library folders change. Prairie scans only what changed, usually within seconds. Works on local disks; network shares (NFS, SMB) aren't supported. Libraries can opt out individually."
-            value={form.getValue(REALTIME_MONITORING_KEY) || "true"}
-            onChange={(value) => form.setValue(REALTIME_MONITORING_KEY, value)}
-            restartRequired={restartKeys.has(REALTIME_MONITORING_KEY)}
+            description="Aligns subtitles to the video's audio: downloaded and uploaded ones when they're added, any other the first time it's played. Fixes subtitles cut for a different release."
+            dirty={form.isDirty("subtitles.auto_sync")}
+            value={form.getValue("subtitles.auto_sync") || "true"}
+            onChange={(value) => form.setValue("subtitles.auto_sync", value)}
+            restartRequired={restartKeys.has("subtitles.auto_sync")}
           />
           <AdvancedSection
-            id="library.scanning"
-            count={SCANNER_KEYS.length}
-            forceOpen={anyDirty(SCANNER_KEYS)}
+            id="library.subtitle_sync"
+            count={showSyncCapacity ? 2 : 1}
+            forceOpen={
+              anyDirty(SUBTITLE_SYNC_ADVANCED_KEYS) ||
+              // A node-only mode with no node to run on is stranded work;
+              // its warning must not sit inside a closed disclosure.
+              (!transcodeNodeAvailable && syncExecution === "transcode_nodes_only")
+            }
           >
             <SettingField
-              label="Scanner workers"
-              type="number"
-              description="How many files Prairie reads at once."
-              value={form.getValue("scanner.workers")}
-              onChange={(value) => form.setValue("scanner.workers", value)}
-              restartRequired={restartKeys.has("scanner.workers")}
-            />
-            <SettingField
-              label="Image encoding workers"
-              type="number"
-              description="How many artwork images Prairie encodes at once. 0 uses one per CPU core."
-              value={form.getValue("metadata.image_workers")}
-              onChange={(value) => form.setValue("metadata.image_workers", value)}
-              restartRequired={restartKeys.has("metadata.image_workers")}
-            />
-            <SettingField
-              label="Person lookups per minute"
-              type="number"
-              description="How many cast and crew members each server looks up per minute in the background. Opening a person's page isn't limited."
-              value={form.getValue("metadata.person_refresh_per_minute")}
-              onChange={(value) => form.setValue("metadata.person_refresh_per_minute", value)}
-              restartRequired={restartKeys.has("metadata.person_refresh_per_minute")}
-            />
-            <SettingField
-              label="Matcher workers"
-              type="number"
-              description="How many items Prairie looks up at once."
-              value={form.getValue("matcher.workers")}
-              onChange={(value) => form.setValue("matcher.workers", value)}
-              restartRequired={restartKeys.has("matcher.workers")}
-            />
-            <SettingField
-              label="Matcher batch size"
-              type="number"
-              description="How many items each matcher worker claims per round."
-              value={form.getValue("matcher.batch_size")}
-              onChange={(value) => form.setValue("matcher.batch_size", value)}
-              restartRequired={restartKeys.has("matcher.batch_size")}
-            />
-          </AdvancedSection>
-        </FieldGroup>
-
-        {/*
-          Detection behavior lives here; which online providers answer a lookup,
-          and on what terms, is provider configuration and lives with the other
-          providers.
-        */}
-        <FieldGroup
-          label="Skip markers"
-          description="Markers identify intros, credits, recaps, and previews so players can offer skip controls."
-          restartAll={allRestart(MARKER_KEYS)}
-          actions={
-            <Link
-              to="/admin/settings/providers"
-              className="text-muted-foreground hover:text-foreground inline-flex items-center gap-1.5 text-xs font-medium transition-colors"
-            >
-              Marker providers
-              <ArrowRight className="h-3 w-3" aria-hidden="true" />
-            </Link>
-          }
-        >
-          <SettingField
-            label="Marker source"
-            type="select"
-            description="Online markers take priority. Prairie skips local detection of an intro or credits when an online one is saved in your library. Local detection uses CPU."
-            className="[&_[data-slot=select-trigger]]:h-auto [&_[data-slot=select-trigger]]:min-h-9 [&_[data-slot=select-value]]:line-clamp-none [&_[data-slot=select-value]]:text-left [&_[data-slot=select-value]]:whitespace-normal"
-            options={[
-              { value: "off", label: "Off" },
-              { value: "local", label: "Detect on this server" },
-              { value: "both", label: "Online preferred + server detection" },
-              { value: "online", label: "Online providers only" },
-            ]}
-            value={markerMode}
-            onChange={(value) => form.setValue("markers.mode", value)}
-            restartRequired={restartKeys.has("markers.mode")}
-          />
-
-          {localMarkersEnabled && detectionKindSettings && (
-            <>
-              <SettingField
-                label="Detect intros"
-                type="toggle"
-                description="Finds each episode's opening from embedded chapters, or by comparing the start of episodes in a season."
-                value={form.getValue("markers.detect_intros") || "true"}
-                onChange={(value) => form.setValue("markers.detect_intros", value)}
-                restartRequired={restartKeys.has("markers.detect_intros")}
-              />
-              <SettingField
-                label="Detect credits"
-                type="toggle"
-                description="Finds end credits from embedded chapters, or by reading the end of each episode and movie. Uses more CPU than intro detection."
-                value={form.getValue("markers.detect_credits") || "true"}
-                onChange={(value) => form.setValue("markers.detect_credits", value)}
-                restartRequired={restartKeys.has("markers.detect_credits")}
-              />
-            </>
-          )}
-
-          {onlineMarkersEnabled && (
-            <SettingField
-              label="Save online markers"
+              label="Where to analyze audio"
               type="select"
-              description={
-                onlineMarkerStorage === "stored"
-                  ? "Prairie saves markers from enabled providers such as TheIntroDB. The Sync online markers task fetches missing markers and refreshes saved markers daily at 03:00 (server time) by default."
-                  : "Fetch markers when needed without saving them to your library. Scheduled online sync is disabled."
+              description="Sync decodes a few minutes of the file's audio."
+              options={subtitleSyncExecutionOptions(syncExecution, transcodeNodeAvailable)}
+              status={
+                !transcodeNodeAvailable && syncOnNodes ? (
+                  <SettingFieldStatus tone="warn">
+                    No transcode nodes are connected
+                  </SettingFieldStatus>
+                ) : undefined
               }
-              options={[
-                { value: "stored", label: "Save to library" },
-                { value: "on_demand", label: "Fetch when needed" },
-              ]}
-              value={onlineMarkerStorage}
-              onChange={(value) => {
-                form.setValue("markers.online_storage", value);
-                if (value === "on_demand") form.setValue("markers.lazy_playback", "true");
-              }}
-              restartRequired={restartKeys.has("markers.online_storage")}
-            />
-          )}
-
-          {markerMode !== "off" && (!onlineMarkersEnabled || onlineMarkerStorage === "stored") && (
-            <SettingField
-              label="Find markers on playback"
-              type="toggle"
-              description={
-                onlineMarkersEnabled
-                  ? markerMode === "both"
-                    ? "Check online first when playback starts. Prairie detects only the intro or credits online providers don't have, using this server's CPU."
-                    : "Check online for missing or outdated markers when playback starts."
-                  : "Detect missing markers when playback starts. Local analysis uses CPU."
-              }
-              value={form.getValue("markers.lazy_playback") || "true"}
-              onChange={(value) => form.setValue("markers.lazy_playback", value)}
-              restartRequired={restartKeys.has("markers.lazy_playback")}
-            />
-          )}
-
-          {localMarkersEnabled && (
-            <SettingField
-              label="Detection workers"
-              type="number"
-              description="How many seasons or movies Prairie analyzes at once, each with its own ffmpeg process. Defaults to 1. Raise it to finish a large library sooner if your storage and CPU have room."
-              value={form.getValue("markers.detection_workers")}
-              onChange={(value) => form.setValue("markers.detection_workers", value)}
-              restartRequired={restartKeys.has("markers.detection_workers")}
+              dirty={form.isDirty("subtitles.sync_execution")}
+              value={syncExecution}
+              onChange={(value) => form.setValue("subtitles.sync_execution", value)}
+              restartRequired={restartKeys.has("subtitles.sync_execution")}
             />
-          )}
-
-          <div className="py-3.5">
-            <MarkerTasksCard />
-          </div>
-        </FieldGroup>
-
-        <FieldGroup label="Search" restartAll={allRestart(SEARCH_KEYS)}>
-          <SettingField
-            label="Search engine"
-            type="select"
-            description="Meilisearch tolerates typos but runs as its own service. If it goes down, search falls back to the built-in engine automatically."
-            value={provider}
-            onChange={(value) => form.setValue("catalog.search.provider", value)}
-            options={[
-              { value: "postgres", label: "Built-in (Postgres)" },
-              { value: "meilisearch", label: "Meilisearch" },
-            ]}
-            restartRequired={restartKeys.has("catalog.search.provider")}
-          />
-
-          {showMeili && (
-            <>
+            {showSyncCapacity && (
               <SettingField
-                label="Meilisearch URL"
-                value={form.getValue(MEILI_URL_KEY)}
-                onChange={(value) => form.setValue(MEILI_URL_KEY, value)}
-                hint="http://localhost:7700"
-                disabled={!meiliEnabled}
-                restartRequired={restartKeys.has(MEILI_URL_KEY)}
-              />
-              <SecretField
-                label="Meilisearch API key"
-                value={form.getValue(MEILI_API_KEY)}
-                configured={form.sensitiveConfigured.includes(MEILI_API_KEY)}
-                onChange={(value) => form.setValue(MEILI_API_KEY, value)}
-                onKeep={() => form.resetValue(MEILI_API_KEY)}
-                // Nothing else on this page can empty the stored key, and a
-                // Meilisearch instance without a master key needs it empty.
-                onClear={() => form.setValue(MEILI_API_KEY, "")}
-                cleared={form.isClearStaged(MEILI_API_KEY)}
-                hint="Master key, or one that can read and write the index."
-                disabled={!meiliEnabled}
-                restartRequired={restartKeys.has(MEILI_API_KEY)}
-              />
-              <ConnectionCheckAction
-                onClick={handleCheckConnection}
-                result={connectionResult}
-                isPending={checkConnection.isPending}
-                disabled={!meiliEnabled}
+                label="Concurrent syncs per transcode node"
+                type="number"
+                description="How many subtitles one transcode node syncs at once."
+                dirty={form.isDirty("subtitles.sync_node_capacity")}
+                value={form.getValue("subtitles.sync_node_capacity") || "1"}
+                onChange={(value) => form.setValue("subtitles.sync_node_capacity", value)}
+                restartRequired={restartKeys.has("subtitles.sync_node_capacity")}
               />
-
-              <AdvancedSection
-                id="library.search.meilisearch"
-                count={MEILI_ADVANCED_KEYS.length}
-                forceOpen={anyDirty(MEILI_ADVANCED_KEYS)}
-              >
-                <SettingField
-                  label="Index name prefix"
-                  value={form.getValue("catalog.search.meilisearch.index") || "silo_media_items"}
-                  onChange={(value) => form.setValue("catalog.search.meilisearch.index", value)}
-                  description="Only needed when Prairie servers share one Meilisearch."
-                  disabled={!meiliEnabled}
-                  restartRequired={restartKeys.has("catalog.search.meilisearch.index")}
-                />
-                <SettingField
-                  label="Query timeout"
-                  type="number"
-                  unit="ms"
-                  value={form.getValue("catalog.search.meilisearch.timeout_ms") || "800"}
-                  onChange={(value) =>
-                    form.setValue("catalog.search.meilisearch.timeout_ms", value)
-                  }
-                  description="Searches that take longer fall back to the built-in engine."
-                  disabled={!meiliEnabled}
-                  restartRequired={restartKeys.has("catalog.search.meilisearch.timeout_ms")}
-                />
-                <SettingField
-                  label="When a search has several words"
-                  type="select"
-                  value={form.getValue("catalog.search.meilisearch.matching_strategy") || "last"}
-                  onChange={(value) =>
-                    form.setValue("catalog.search.meilisearch.matching_strategy", value)
-                  }
-                  options={[
-                    {
-                      value: "last",
-                      label: "Drop trailing words until something matches",
-                    },
-                    { value: "all", label: "Require every word" },
-                  ]}
-                  disabled={!meiliEnabled}
-                  restartRequired={restartKeys.has("catalog.search.meilisearch.matching_strategy")}
-                />
-                <SettingField
-                  label="Items sent to the index per batch"
-                  type="number"
-                  value={form.getValue("catalog.search.meilisearch.sync_batch_size") || "500"}
-                  onChange={(value) =>
-                    form.setValue("catalog.search.meilisearch.sync_batch_size", value)
-                  }
-                  description="Larger batches index faster and use more memory."
-                  disabled={!meiliEnabled}
-                  restartRequired={restartKeys.has("catalog.search.meilisearch.sync_batch_size")}
-                />
-                <SettingField
-                  label="Match by meaning as well as words"
-                  type="toggle"
-                  value={form.getValue("catalog.search.meilisearch.semantic_enabled") || "false"}
-                  onChange={(value) =>
-                    form.setValue("catalog.search.meilisearch.semantic_enabled", value)
-                  }
-                  description="Also matches items whose description means something similar."
-                  status={
-                    enablingSemanticSearch ? (
-                      <SettingFieldStatus tone="warn">
-                        Enabling this changes the index format. After you save and restart, Prairie
-                        rebuilds the index automatically. Keyword search stays available while it
-                        rebuilds.
-                      </SettingFieldStatus>
-                    ) : undefined
-                  }
-                  disabled={!meiliEnabled}
-                  restartRequired={restartKeys.has("catalog.search.meilisearch.semantic_enabled")}
-                />
-                <SettingField
-                  label="Meaning-based share of results"
-                  type="number"
-                  value={form.getValue("catalog.search.meilisearch.semantic_ratio") || "0.50"}
-                  onChange={(value) =>
-                    form.setValue("catalog.search.meilisearch.semantic_ratio", value)
-                  }
-                  description="0 ranks by words, 1 by meaning."
-                  disabled={!meiliEnabled}
-                  restartRequired={restartKeys.has("catalog.search.meilisearch.semantic_ratio")}
-                />
-              </AdvancedSection>
-            </>
-          )}
-
-          {meiliEnabled && searchStatus?.degraded && (
-            <div className="py-3.5">
-              <SettingFieldStatus tone="warn">
-                <span>
-                  {searchStatus.degraded_reason ?? "Search is running in a degraded mode."}
-                  {searchStatus.index.rebuild_required && (
-                    <>
-                      {" "}
-                      Automatic search maintenance rebuilds the index in the background and retries
-                      if needed.{" "}
-                      <Link
-                        className="font-medium underline underline-offset-2"
-                        to="/admin/tasks/sync_catalog_search_index"
-                      >
-                        Open maintenance task
-                      </Link>
-                      .
-                    </>
-                  )}
-                </span>
-              </SettingFieldStatus>
-            </div>
-          )}
-
-          <AdvancedSection id="library.search.status" title="Search status">
-            <SearchStatusPanel />
+            )}
           </AdvancedSection>
         </FieldGroup>
       </div>
diff --git a/web/src/pages/admin-settings/LoggingSettings.test.tsx b/web/src/pages/admin-settings/LoggingSettings.test.tsx
new file mode 100644
index 0000000000..dfcbc00f8a
--- /dev/null
+++ b/web/src/pages/admin-settings/LoggingSettings.test.tsx
@@ -0,0 +1,238 @@
+import { render, screen, waitFor, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import type { RestartKeyMatcher } from "@/hooks/useRestartKeys";
+
+import LoggingSettings from "./LoggingSettings";
+
+// Radix Select opens through pointer capture and scrolls its options into
+// view, neither of which jsdom provides.
+window.HTMLElement.prototype.hasPointerCapture ??= () => false;
+window.HTMLElement.prototype.setPointerCapture ??= () => {};
+window.HTMLElement.prototype.releasePointerCapture ??= () => {};
+window.HTMLElement.prototype.scrollIntoView ??= () => {};
+
+const settingsFormMock = vi.fn();
+
+// Most cases drive the page from a hand-written form; the ones that prove a
+// value reaches the server flip this and run the real hook instead.
+const { realForm, serverSettings, updateSettingsMock } = vi.hoisted(() => ({
+  realForm: { enabled: false },
+  serverSettings: { current: {} as Record<string, string> },
+  updateSettingsMock: vi.fn(),
+}));
+
+vi.mock("@/hooks/useSettingsForm", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("@/hooks/useSettingsForm")>();
+  return {
+    useSettingsForm: (options: { keys: string[] }) =>
+      realForm.enabled ? actual.useSettingsForm(options) : settingsFormMock(options),
+  };
+});
+
+vi.mock("@/hooks/queries/admin/settings", () => ({
+  useAdminServerSettings: () => ({ data: serverSettings.current, isLoading: false }),
+  useAdminSensitiveStatus: () => ({
+    data: { configured: [], managed_by_env: [] },
+    isError: false,
+  }),
+  useUpdateServerSettings: () => ({ mutateAsync: updateSettingsMock, isPending: false }),
+}));
+
+// Mirrors the server registry: nothing on this page needs a restart. Tests that
+// need a different registry override the mock.
+const NO_RESTART: RestartKeyMatcher = { has: () => false };
+const restartKeysMock = vi.fn((): RestartKeyMatcher => NO_RESTART);
+
+vi.mock("@/hooks/useRestartKeys", () => ({
+  useRestartKeys: () => restartKeysMock(),
+}));
+
+function mockForm(overrides: Partial<Record<string, unknown>> = {}) {
+  const form = {
+    isLoading: false,
+    getValue: () => "",
+    getPersistedValue: () => "",
+    setValue: vi.fn(),
+    resetValue: vi.fn(),
+    dirtyCount: 0,
+    dirtyKeys: [],
+    isDirty: () => false,
+    save: vi.fn(),
+    discard: vi.fn(),
+    isSaving: false,
+    restartRequired: false,
+    sensitiveConfigured: [],
+    sensitiveManagedByEnv: [],
+    ...overrides,
+  };
+  settingsFormMock.mockReturnValue(form);
+  return form;
+}
+
+function group(name: string) {
+  return within(screen.getByRole("group", { name }));
+}
+
+async function openAdvanced(name: string) {
+  await userEvent.click(group(name).getByRole("button", { name: /Advanced/ }));
+}
+
+describe("LoggingSettings", () => {
+  beforeEach(() => {
+    localStorage.clear();
+    settingsFormMock.mockReset();
+    restartKeysMock.mockReset();
+    restartKeysMock.mockReturnValue(NO_RESTART);
+  });
+
+  it("manages the server log and log retention keys on one save bar", () => {
+    mockForm();
+    render(<LoggingSettings />);
+
+    expect(settingsFormMock.mock.calls[0]?.[0]?.keys).toEqual([
+      "server.log_level",
+      "server.log_quiet",
+      "opslog.retention_days",
+      "opslog.max_size_mb",
+      "opslog.max_rows",
+      "policy.decision_log_retention_days",
+      "policy.decision_log_verbosity",
+    ]);
+    expect(screen.getByRole("heading", { name: "Logging" })).toBeInTheDocument();
+    expect(screen.getAllByRole("heading", { level: 3 }).map((h) => h.textContent)).toEqual([
+      "Server log",
+      "Log retention",
+    ]);
+  });
+
+  it("says the log level is the container's, not the Server Log page's", () => {
+    mockForm();
+    render(<LoggingSettings />);
+
+    // The Server Log page captures at opslog.capture_level (Info), whatever
+    // server.log_level says.
+    expect(
+      group("Server log").getByText(/The Server Log page records Info and above either way/),
+    ).toBeInTheDocument();
+  });
+
+  it("stages the server log level and quiet prefixes", async () => {
+    const form = mockForm({
+      getValue: (key: string) => (key === "server.log_level" ? "info" : ""),
+    });
+    render(<LoggingSettings />);
+
+    await userEvent.click(group("Server log").getByRole("combobox", { name: "Log level" }));
+    await userEvent.click(screen.getByRole("option", { name: "Debug" }));
+    expect(form.setValue).toHaveBeenCalledWith("server.log_level", "debug");
+
+    await openAdvanced("Server log");
+    await userEvent.type(group("Server log").getByLabelText("Quiet log prefixes"), "m");
+    expect(form.setValue).toHaveBeenCalledWith("server.log_quiet", "m");
+  });
+
+  it("stages the retention limits and permission-check settings", async () => {
+    const form = mockForm();
+    render(<LoggingSettings />);
+    const retention = group("Log retention");
+
+    // The age and size limits show by default; the row cap is a backstop.
+    expect(retention.queryByLabelText("Maximum log entries")).not.toBeInTheDocument();
+    expect(retention.getByRole("button", { name: "Advanced · 3 settings" })).toBeInTheDocument();
+    await userEvent.type(retention.getByLabelText("Delete log entries older than"), "9");
+    expect(form.setValue).toHaveBeenCalledWith("opslog.retention_days", "9");
+    await userEvent.type(retention.getByLabelText("Maximum log size"), "9");
+    expect(form.setValue).toHaveBeenCalledWith("opslog.max_size_mb", "9");
+
+    await openAdvanced("Log retention");
+    await userEvent.type(retention.getByLabelText("Maximum log entries"), "9");
+    expect(form.setValue).toHaveBeenCalledWith("opslog.max_rows", "9");
+    expect(retention.getByText("Permission checks")).toBeInTheDocument();
+    await userEvent.type(retention.getByLabelText("Delete permission records older than"), "9");
+    expect(form.setValue).toHaveBeenCalledWith("policy.decision_log_retention_days", "9");
+    // The sample rate and the per-area limits are Hidden tier.
+    expect(retention.queryByLabelText("Record one allowed check in every")).not.toBeInTheDocument();
+    expect(screen.queryByText("Per-area limits")).not.toBeInTheDocument();
+    await userEvent.click(retention.getByRole("combobox", { name: "How much to record" }));
+    await userEvent.click(screen.getByRole("option", { name: "Full" }));
+    expect(form.setValue).toHaveBeenCalledWith("policy.decision_log_verbosity", "verbose");
+  });
+
+  it("opens the retention Advanced section while the row cap is unsaved", () => {
+    mockForm({
+      isDirty: (key: string) => key === "opslog.max_rows",
+      dirtyCount: 1,
+      getValue: (key: string) => (key === "opslog.max_rows" ? "512" : ""),
+    });
+    render(<LoggingSettings />);
+
+    expect(group("Log retention").getByLabelText("Maximum log entries")).toHaveValue(512);
+  });
+
+  it("marks a field for a restart on its own when the registry names it", async () => {
+    restartKeysMock.mockReturnValue({ has: (key: string) => key === "opslog.max_rows" });
+    mockForm();
+    render(<LoggingSettings />);
+    await openAdvanced("Log retention");
+
+    expect(screen.getAllByLabelText("Takes effect after a server restart")).toHaveLength(1);
+    const badges = group("Log retention").getAllByLabelText("Takes effect after a server restart");
+    expect(badges[0]?.parentElement).toHaveTextContent("Maximum log entries");
+  });
+
+  it("saves and discards through the save bar", async () => {
+    const form = mockForm({ dirtyCount: 2 });
+    render(<LoggingSettings />);
+
+    expect(screen.getByText("2 unsaved changes")).toBeInTheDocument();
+    await userEvent.click(screen.getByRole("button", { name: "Save" }));
+    expect(form.save).toHaveBeenCalledTimes(1);
+    await userEvent.click(screen.getByRole("button", { name: "Discard" }));
+    expect(form.discard).toHaveBeenCalledTimes(1);
+  });
+
+  describe("saving to the server", () => {
+    beforeEach(() => {
+      realForm.enabled = true;
+      serverSettings.current = {
+        "server.log_level": "info",
+        "server.log_quiet": "",
+        "opslog.retention_days": "7",
+        "opslog.max_rows": "1000000",
+        "opslog.max_size_mb": "1024",
+      };
+      updateSettingsMock.mockReset();
+      updateSettingsMock.mockResolvedValue({ values: {}, restart_required: false });
+    });
+
+    afterEach(() => {
+      realForm.enabled = false;
+    });
+
+    it("sends the edited log keys in one batch", async () => {
+      render(<LoggingSettings />);
+
+      const days = group("Log retention").getByLabelText("Delete log entries older than");
+      await userEvent.clear(days);
+      await userEvent.type(days, "14");
+      await openAdvanced("Server log");
+      await userEvent.type(group("Server log").getByLabelText("Quiet log prefixes"), "scanner");
+      const size = group("Log retention").getByLabelText("Maximum log size");
+      await userEvent.clear(size);
+      await userEvent.type(size, "512");
+
+      expect(screen.getByText("3 unsaved changes")).toBeInTheDocument();
+      await userEvent.click(screen.getByRole("button", { name: "Save" }));
+
+      await waitFor(() =>
+        expect(updateSettingsMock).toHaveBeenCalledWith({
+          "opslog.retention_days": "14",
+          "server.log_quiet": "scanner",
+          "opslog.max_size_mb": "512",
+        }),
+      );
+    });
+  });
+});
diff --git a/web/src/pages/admin-settings/LoggingSettings.tsx b/web/src/pages/admin-settings/LoggingSettings.tsx
new file mode 100644
index 0000000000..ea7066863d
--- /dev/null
+++ b/web/src/pages/admin-settings/LoggingSettings.tsx
@@ -0,0 +1,185 @@
+import { useMemo } from "react";
+
+import { AdvancedSection } from "@/components/settings/AdvancedSection";
+import { SettingsPageHeader } from "@/components/settings/SettingsPageHeader";
+import { SettingsSubheading } from "@/components/settings/SettingsSubheading";
+import { Skeleton } from "@/components/ui/skeleton";
+import { useRestartKeys } from "@/hooks/useRestartKeys";
+import { useSettingsForm } from "@/hooks/useSettingsForm";
+import { SaveBar } from "@/components/SaveBar";
+
+import { FieldGroup } from "./FieldGroup";
+import { SettingField } from "./SettingField";
+
+const OPSLOG_RETENTION_DAYS_KEY = "opslog.retention_days";
+const OPSLOG_MAX_ROWS_KEY = "opslog.max_rows";
+const OPSLOG_MAX_SIZE_MB_KEY = "opslog.max_size_mb";
+
+const SERVER_LOG_ADVANCED_KEYS = ["server.log_quiet"];
+const SERVER_LOG_KEYS = ["server.log_level", ...SERVER_LOG_ADVANCED_KEYS];
+
+// How long and how large the log may grow is what an admin comes here to
+// change. The row cap is a backstop whose default suits almost every server,
+// and the policy decision log is a debugging tool; both sit behind Advanced.
+//
+// Hidden tier: still saved and readable through the settings API, without a
+// control here — policy.decision_log_scope_sample_rate and
+// opslog.bucket_policies (per-area limits).
+const RETENTION_ESSENTIAL_KEYS = [OPSLOG_RETENTION_DAYS_KEY, OPSLOG_MAX_SIZE_MB_KEY];
+
+const RETENTION_ADVANCED_KEYS = [
+  OPSLOG_MAX_ROWS_KEY,
+  "policy.decision_log_retention_days",
+  "policy.decision_log_verbosity",
+];
+
+const RETENTION_KEYS = [...RETENTION_ESSENTIAL_KEYS, ...RETENTION_ADVANCED_KEYS];
+
+const KEYS = [...SERVER_LOG_KEYS, ...RETENTION_KEYS];
+
+/**
+ * Settings → Logging: what the server writes to its log, and how much log
+ * history the database keeps. Every field is a plain batched setting, so the
+ * page saves through the ordinary save bar.
+ */
+export default function LoggingSettings() {
+  const form = useSettingsForm({ keys: useMemo(() => KEYS, []) });
+  const restartKeys = useRestartKeys();
+
+  const allRestart = (keys: string[]) => keys.every((key) => restartKeys.has(key));
+  const anyDirty = (keys: string[]) => keys.some((key) => form.isDirty(key));
+
+  if (form.isLoading)
+    return (
+      <div className="space-y-6" role="status" aria-label="Loading settings">
+        <Skeleton className="h-8 w-48" />
+        <div className="space-y-4">
+          <Skeleton className="h-10 w-full" />
+          <Skeleton className="h-10 w-full" />
+        </div>
+        <div className="space-y-4">
+          <Skeleton className="h-10 w-full" />
+          <Skeleton className="h-10 w-full" />
+          <Skeleton className="h-10 w-full" />
+        </div>
+        <span className="sr-only">Loading settings</span>
+      </div>
+    );
+
+  return (
+    <div className="flex h-full flex-col">
+      <SettingsPageHeader title="Logging" />
+
+      <div className="flex-1 space-y-5">
+        <FieldGroup
+          label="Server log"
+          restartAll={allRestart(SERVER_LOG_KEYS)}
+          dirty={anyDirty(SERVER_LOG_KEYS)}
+        >
+          <SettingField
+            label="Log level"
+            dirty={form.isDirty("server.log_level")}
+            type="select"
+            description="Sets the container log's level; Debug is loud, so keep it for chasing a problem. The Server Log page records Info and above either way."
+            value={form.getValue("server.log_level")}
+            onChange={(v) => form.setValue("server.log_level", v)}
+            restartRequired={restartKeys.has("server.log_level")}
+            options={[
+              { value: "debug", label: "Debug" },
+              { value: "info", label: "Info" },
+              { value: "warn", label: "Warn" },
+              { value: "error", label: "Error" },
+            ]}
+          />
+          <AdvancedSection
+            id="logging.server"
+            count={SERVER_LOG_ADVANCED_KEYS.length}
+            forceOpen={anyDirty(SERVER_LOG_ADVANCED_KEYS)}
+          >
+            <SettingField
+              label="Quiet log prefixes"
+              dirty={form.isDirty("server.log_quiet")}
+              hint="metadata, scanner"
+              description="Drops log lines starting with any of these words."
+              value={form.getValue("server.log_quiet")}
+              onChange={(v) => form.setValue("server.log_quiet", v)}
+              restartRequired={restartKeys.has("server.log_quiet")}
+            />
+          </AdvancedSection>
+        </FieldGroup>
+
+        <FieldGroup
+          label="Log retention"
+          description="How much log history the database keeps."
+          restartAll={allRestart(RETENTION_KEYS)}
+          dirty={anyDirty(RETENTION_KEYS)}
+        >
+          <SettingField
+            label="Delete log entries older than"
+            dirty={form.isDirty(OPSLOG_RETENTION_DAYS_KEY)}
+            type="number"
+            unit="days"
+            value={form.getValue(OPSLOG_RETENTION_DAYS_KEY)}
+            onChange={(v) => form.setValue(OPSLOG_RETENTION_DAYS_KEY, v)}
+            restartRequired={restartKeys.has(OPSLOG_RETENTION_DAYS_KEY)}
+          />
+          <SettingField
+            label="Maximum log size"
+            dirty={form.isDirty(OPSLOG_MAX_SIZE_MB_KEY)}
+            type="number"
+            unit="MB"
+            value={form.getValue(OPSLOG_MAX_SIZE_MB_KEY)}
+            onChange={(v) => form.setValue(OPSLOG_MAX_SIZE_MB_KEY, v)}
+            restartRequired={restartKeys.has(OPSLOG_MAX_SIZE_MB_KEY)}
+          />
+
+          <AdvancedSection
+            id="logging.retention"
+            count={RETENTION_ADVANCED_KEYS.length}
+            forceOpen={anyDirty(RETENTION_ADVANCED_KEYS)}
+          >
+            <SettingField
+              label="Maximum log entries"
+              dirty={form.isDirty(OPSLOG_MAX_ROWS_KEY)}
+              type="number"
+              value={form.getValue(OPSLOG_MAX_ROWS_KEY)}
+              onChange={(v) => form.setValue(OPSLOG_MAX_ROWS_KEY, v)}
+              restartRequired={restartKeys.has(OPSLOG_MAX_ROWS_KEY)}
+            />
+
+            <SettingsSubheading>Permission checks</SettingsSubheading>
+            <SettingField
+              label="Delete permission records older than"
+              dirty={form.isDirty("policy.decision_log_retention_days")}
+              type="number"
+              unit="days"
+              value={form.getValue("policy.decision_log_retention_days")}
+              onChange={(v) => form.setValue("policy.decision_log_retention_days", v)}
+              restartRequired={restartKeys.has("policy.decision_log_retention_days")}
+            />
+            <SettingField
+              label="How much to record"
+              dirty={form.isDirty("policy.decision_log_verbosity")}
+              type="select"
+              description="Full also stores a sample of each request."
+              value={form.getValue("policy.decision_log_verbosity") || "digest"}
+              onChange={(v) => form.setValue("policy.decision_log_verbosity", v)}
+              options={[
+                { value: "digest", label: "Summary" },
+                { value: "verbose", label: "Full" },
+              ]}
+              restartRequired={restartKeys.has("policy.decision_log_verbosity")}
+            />
+          </AdvancedSection>
+        </FieldGroup>
+      </div>
+
+      <SaveBar
+        dirtyCount={form.dirtyCount}
+        onSave={form.save}
+        onDiscard={form.discard}
+        isSaving={form.isSaving}
+      />
+    </div>
+  );
+}
diff --git a/web/src/pages/admin-settings/MarkerProviderTiles.tsx b/web/src/pages/admin-settings/MarkerProviderTiles.tsx
index 98673ef6d3..74cd2b1377 100644
--- a/web/src/pages/admin-settings/MarkerProviderTiles.tsx
+++ b/web/src/pages/admin-settings/MarkerProviderTiles.tsx
@@ -10,6 +10,7 @@ import {
   resolveProviderTileState,
   type ProviderTestState,
 } from "@/components/settings/ProviderTile";
+import { AdvancedSection } from "@/components/settings/AdvancedSection";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { Skeleton } from "@/components/ui/skeleton";
@@ -314,21 +315,6 @@ function MarkerProviderTile({
         value={fetchEnabled ? "true" : "false"}
         onChange={(value) => setFetchEnabled(value === "true")}
       />
-      <SettingFieldRow
-        label="Provider priority"
-        htmlFor={priorityID}
-        description="If providers return markers for the same section, prefer the provider with the lower number."
-      >
-        <Input
-          id={priorityID}
-          type="number"
-          value={fetchPriority}
-          step={1}
-          onChange={(event) => setFetchPriority(event.target.value)}
-          className={SETTINGS_NUMBER_WIDTH}
-          aria-invalid={!priorityValid}
-        />
-      </SettingFieldRow>
       <SettingField
         label="Allow sharing with this provider"
         type="toggle"
@@ -345,35 +331,62 @@ function MarkerProviderTile({
       />
       <div className="border-border ml-3 border-l pl-4">
         <SettingField
-          label="Automatically share detected intros"
+          label="Automatically share detected intros and credits"
           type="toggle"
           value={autoLocal ? "true" : "false"}
           onChange={(value) => setAutoLocal(value === "true")}
           disabled={!provider.is_submitter || !contributeEnabled}
-          description="Share intros detected on this server that meet the minimum confidence below."
+          description="Share intros and credits detected on this server that meet the minimum confidence under Advanced."
         />
-        <div className="border-border ml-3 border-l pl-4">
-          <SettingFieldRow
-            label="Minimum confidence for automatic sharing"
-            htmlFor={minConfidenceID}
-            description="Choose a value from 0% to 100%. Recommended: 95%."
-            unit="%"
-          >
-            <Input
-              id={minConfidenceID}
-              type="number"
-              value={minConfidence}
-              min={0}
-              max={100}
-              step="any"
-              onChange={(event) => setMinConfidence(event.target.value)}
-              className={SETTINGS_NUMBER_WIDTH}
-              aria-invalid={!confidenceValid}
-              disabled={!provider.is_submitter}
-            />
-          </SettingFieldRow>
-        </div>
       </div>
+      {/* Lookup order and the sharing threshold have working defaults; an
+          edited or invalid value holds the section open so Save never stalls
+          on a field the admin cannot see. */}
+      <AdvancedSection
+        id={`providers.marker.${slug}`}
+        count={2}
+        forceOpen={
+          !priorityValid ||
+          !confidenceValid ||
+          provider.fetch_priority !== parsedFetchPriority ||
+          savedMinConfidence !== parsedMinConfidence
+        }
+      >
+        <SettingFieldRow
+          label="Provider priority"
+          htmlFor={priorityID}
+          description="If providers return markers for the same section, prefer the provider with the lower number."
+        >
+          <Input
+            id={priorityID}
+            type="number"
+            value={fetchPriority}
+            step={1}
+            onChange={(event) => setFetchPriority(event.target.value)}
+            className={SETTINGS_NUMBER_WIDTH}
+            aria-invalid={!priorityValid}
+          />
+        </SettingFieldRow>
+        <SettingFieldRow
+          label="Minimum confidence for automatic sharing"
+          htmlFor={minConfidenceID}
+          description="Choose a value from 0% to 100%. Recommended: 95%."
+          unit="%"
+        >
+          <Input
+            id={minConfidenceID}
+            type="number"
+            value={minConfidence}
+            min={0}
+            max={100}
+            step="any"
+            onChange={(event) => setMinConfidence(event.target.value)}
+            className={SETTINGS_NUMBER_WIDTH}
+            aria-invalid={!confidenceValid}
+            disabled={!provider.is_submitter}
+          />
+        </SettingFieldRow>
+      </AdvancedSection>
 
       {stats && (
         <div className="border-border bg-muted/20 mt-3.5 rounded-md border px-3 py-3">
diff --git a/web/src/pages/admin-settings/MarkerTasksCard.tsx b/web/src/pages/admin-settings/MarkerTasksCard.tsx
index a3f4f3b112..cced2fb464 100644
--- a/web/src/pages/admin-settings/MarkerTasksCard.tsx
+++ b/web/src/pages/admin-settings/MarkerTasksCard.tsx
@@ -131,8 +131,8 @@ export function MarkerTasksCard() {
       />
       <TaskActionRow
         task={contributeTask}
-        fallbackName="Share intro markers"
-        fallbackDescription="Sends eligible intros detected on this server to providers with automatic sharing enabled."
+        fallbackName="Share detected markers"
+        fallbackDescription="Sends eligible intros and credits detected on this server to providers with automatic sharing enabled."
         onRun={() => void run("contribute_markers")}
         pending={pendingTasks.has("contribute_markers")}
       />
diff --git a/web/src/pages/admin-settings/NetworkSignInSection.tsx b/web/src/pages/admin-settings/NetworkSignInSection.tsx
index c244d8f724..e970eb4b3b 100644
--- a/web/src/pages/admin-settings/NetworkSignInSection.tsx
+++ b/web/src/pages/admin-settings/NetworkSignInSection.tsx
@@ -4,6 +4,7 @@ import { Link } from "react-router";
 
 import type { PluginInstallation } from "@/api/types";
 import { FeedbackLine, type Feedback } from "@/components/admin/FeedbackLine";
+import { AdvancedSection } from "@/components/settings/AdvancedSection";
 import { Switch } from "@/components/ui/switch";
 import {
   signInBindingMutationKey,
@@ -36,7 +37,9 @@ const GRANT_EXAMPLE = `"grants": [
  * account creation apply at once, like the provider slot's switch. Who may
  * sign in, and with which role, is the tailnet policy's (the plugin's "Who
  * can sign in" setting and siloserver.org/cap/prairie grants); see
- * docs/architecture/external-sign-in.md#network-identity.
+ * docs/architecture/external-sign-in.md#network-identity. The two switches
+ * stay in view; how grants, roles and shared devices work is reference reading
+ * behind a disclosure.
  */
 export function NetworkSignInSection({
   installations,
@@ -127,40 +130,45 @@ function NetworkSignInRow({ installation }: { installation: PluginInstallation }
           }
         />
       </SettingFieldRow>
-      <div className="text-muted-foreground space-y-2 py-3.5 text-xs leading-relaxed">
-        <p>
-          Anyone whose device can reach this server over {label} can sign in, including people you
-          share the server with; tagged devices can&apos;t. To limit it, set the plugin&apos;s
-          &ldquo;Who can sign in&rdquo; to people granted{" "}
-          <code className="font-mono">siloserver.org/cap/prairie</code>. {label} sign-in never
-          matches an existing account by email: its owner connects {label} from their own Sign-in
-          settings.
-        </p>
-        <p>
-          Roles come from grants in your tailnet policy: a{" "}
-          <code className="font-mono">siloserver.org/cap/prairie</code> grant with{" "}
-          <code className="font-mono">{`{"role":"admin"}`}</code> makes someone a Prairie admin, and{" "}
-          <code className="font-mono">{`{"role":"user"}`}</code> a regular user. Anyone who can edit
-          the tailnet policy can make themselves a Prairie admin. Without a grant, a person&apos;s
-          role is left as it is, so removing someone&apos;s admin grant doesn&apos;t demote them:
-          grant them <code className="font-mono">{`{"role":"user"}`}</code> instead. Policy changes
-          apply at the next sign-in or access re-check. An account that also signs in through your
-          main sign-in provider takes its role from that provider.
-        </p>
-        <pre className="bg-muted overflow-x-auto rounded-md p-3 font-mono">{GRANT_EXAMPLE}</pre>
-        <p>
-          Everyone using a shared TV signs in as whoever signed that TV in to {label}, with their
-          role, so sign shared TVs in as someone without an admin grant; profiles keep their
-          watching apart. Tag any device that relays other people&apos;s traffic to this server,
-          such as a reverse proxy, or everyone behind it signs in as its owner.{" "}
-          <Link
-            to={pluginPagePath(installation.plugin_id)}
-            className="text-foreground underline underline-offset-4"
-          >
-            {label} plugin settings
-          </Link>
-        </p>
-      </div>
+      <AdvancedSection
+        id={`sign-in.network.${installation.plugin_id}`}
+        title="How roles and sharing work"
+      >
+        <div className="settings-field-note text-muted-foreground space-y-2 py-3.5 text-xs leading-relaxed">
+          <p>
+            Anyone whose device can reach this server over {label} can sign in, including people you
+            share the server with; tagged devices can&apos;t. To limit it, set the plugin&apos;s
+            &ldquo;Who can sign in&rdquo; to people granted{" "}
+            <code className="font-mono">siloserver.org/cap/prairie</code>. {label} sign-in never
+            matches an existing account by email: its owner connects {label} from their own Sign-in
+            settings.
+          </p>
+          <p>
+            Roles come from grants in your tailnet policy: a{" "}
+            <code className="font-mono">siloserver.org/cap/prairie</code> grant with{" "}
+            <code className="font-mono">{`{"role":"admin"}`}</code> makes someone a Prairie admin,
+            and <code className="font-mono">{`{"role":"user"}`}</code> a regular user. Anyone who
+            can edit the tailnet policy can make themselves a Prairie admin. Without a grant, a
+            person&apos;s role is left as it is, so removing someone&apos;s admin grant doesn&apos;t
+            demote them: grant them <code className="font-mono">{`{"role":"user"}`}</code> instead.
+            Policy changes apply at the next sign-in or access re-check. An account that also signs
+            in through your main sign-in provider takes its role from that provider.
+          </p>
+          <pre className="bg-muted overflow-x-auto rounded-md p-3 font-mono">{GRANT_EXAMPLE}</pre>
+          <p>
+            Everyone using a shared TV signs in as whoever signed that TV in to {label}, with their
+            role, so sign shared TVs in as someone without an admin grant; profiles keep their
+            watching apart. Tag any device that relays other people&apos;s traffic to this server,
+            such as a reverse proxy, or everyone behind it signs in as its owner.{" "}
+            <Link
+              to={pluginPagePath(installation.plugin_id)}
+              className="text-foreground underline underline-offset-4"
+            >
+              {label} plugin settings
+            </Link>
+          </p>
+        </div>
+      </AdvancedSection>
     </div>
   );
 }
diff --git a/web/src/pages/admin-settings/NodeRoutingSettings.test.tsx b/web/src/pages/admin-settings/NodeRoutingSettings.test.tsx
new file mode 100644
index 0000000000..1ce97dff26
--- /dev/null
+++ b/web/src/pages/admin-settings/NodeRoutingSettings.test.tsx
@@ -0,0 +1,121 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { createMemoryRouter, RouterProvider } from "react-router";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import { NodeRoutingSettings } from "./NodeRoutingSettings";
+
+const useSettingsFormMock = vi.fn();
+const useAdminNodesMock = vi.fn();
+
+vi.mock("@/hooks/useSettingsForm", () => ({
+  useSettingsForm: (...args: unknown[]) => useSettingsFormMock(...args),
+}));
+
+vi.mock("@/hooks/useRestartKeys", () => ({
+  useRestartKeys: () => new Set<string>(),
+}));
+
+vi.mock("@/hooks/queries/admin/nodes", () => ({
+  useAdminNodes: () => useAdminNodesMock(),
+}));
+
+const DEFAULT_ROUTING = {
+  "playback.routing.direct_play_egress": "prefer_proxy",
+  "playback.routing.remux_execution": "prefer_transcode",
+  "playback.routing.remux_egress": "prefer_proxy",
+  "playback.routing.video_transcode_execution": "prefer_transcode",
+  "playback.routing.video_transcode_egress": "prefer_proxy",
+};
+
+function makeForm(values: Record<string, string>, dirty: string[] = []) {
+  const dirtyKeys = new Set(dirty);
+  return {
+    isLoading: false,
+    getValue: (key: string) => values[key] ?? "",
+    getPersistedValue: (key: string) => values[key] ?? "",
+    setValue: vi.fn(),
+    isDirty: (key: string) => dirtyKeys.has(key),
+    dirtyCount: dirtyKeys.size,
+    dirtyKeys: [...dirtyKeys],
+    save: vi.fn().mockResolvedValue(undefined),
+    discard: vi.fn(),
+    isSaving: false,
+    restartRequired: false,
+  };
+}
+
+function transcodeNode(overrides: Record<string, unknown> = {}) {
+  return { id: 1, name: "node-1", type: "transcode", enabled: true, healthy: true, ...overrides };
+}
+
+// The section guards its own staged edits with `useBlocker`, which needs a
+// data router.
+function renderRouting() {
+  const router = createMemoryRouter([{ path: "/admin/nodes", element: <NodeRoutingSettings /> }], {
+    initialEntries: ["/admin/nodes"],
+  });
+  return render(<RouterProvider router={router} />);
+}
+
+beforeEach(() => {
+  useSettingsFormMock.mockReset();
+  useAdminNodesMock.mockReturnValue({ data: [transcodeNode()], isSuccess: true });
+});
+
+describe("NodeRoutingSettings", () => {
+  it("manages only the routing keys", () => {
+    useSettingsFormMock.mockReturnValue(makeForm(DEFAULT_ROUTING));
+    renderRouting();
+
+    expect(useSettingsFormMock.mock.calls[0]?.[0]?.keys).toEqual(Object.keys(DEFAULT_ROUTING));
+  });
+
+  it("stages every primitive setting when a preset is selected", async () => {
+    const form = makeForm(DEFAULT_ROUTING);
+    useSettingsFormMock.mockReturnValue(form);
+
+    renderRouting();
+    await userEvent.click(screen.getByRole("button", { name: "GPU offload" }));
+
+    expect(form.setValue.mock.calls).toEqual([
+      ["playback.routing.direct_play_egress", "prefer_api"],
+      ["playback.routing.remux_execution", "prefer_api"],
+      ["playback.routing.remux_egress", "prefer_api"],
+      ["playback.routing.video_transcode_execution", "prefer_worker"],
+      ["playback.routing.video_transcode_egress", "prefer_proxy"],
+    ]);
+    expect(form.save).not.toHaveBeenCalled();
+  });
+
+  it("warns when hard routes lack nodes or universal client-origin support", () => {
+    useAdminNodesMock.mockReturnValue({
+      data: [transcodeNode({ healthy: false })],
+      isSuccess: true,
+    });
+    useSettingsFormMock.mockReturnValue(
+      makeForm({
+        ...DEFAULT_ROUTING,
+        "playback.routing.direct_play_egress": "proxy_only",
+        "playback.routing.remux_execution": "worker_only",
+      }),
+    );
+
+    renderRouting();
+
+    expect(screen.getByText(/no healthy supporting node/)).toBeInTheDocument();
+    expect(
+      screen.getByText(/requires every native client to support authorized media origins/),
+    ).toBeInTheDocument();
+  });
+
+  it("saves staged routing through its own bar", async () => {
+    const form = makeForm(DEFAULT_ROUTING, ["playback.routing.remux_egress"]);
+    useSettingsFormMock.mockReturnValue(form);
+
+    renderRouting();
+    await userEvent.click(screen.getByRole("button", { name: /^Save/ }));
+
+    expect(form.save).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/web/src/pages/admin-settings/NodeRoutingSettings.tsx b/web/src/pages/admin-settings/NodeRoutingSettings.tsx
new file mode 100644
index 0000000000..3c5917cd85
--- /dev/null
+++ b/web/src/pages/admin-settings/NodeRoutingSettings.tsx
@@ -0,0 +1,307 @@
+import { SaveBar } from "@/components/SaveBar";
+import { AdvancedSection } from "@/components/settings/AdvancedSection";
+import { Button } from "@/components/ui/button";
+import { UnsavedChangesGuard } from "@/components/UnsavedChangesGuard";
+import { useAdminNodes } from "@/hooks/queries/admin/nodes";
+import { useRestartKeys } from "@/hooks/useRestartKeys";
+import { useSettingsForm } from "@/hooks/useSettingsForm";
+
+import { FieldGroup } from "./FieldGroup";
+import { SettingField, SettingFieldRow, SettingFieldStatus } from "./SettingField";
+import { hasUsableTranscodeNode } from "./playbackSettings.utils";
+// The settings layout loads these field styles for its pages; the Nodes page
+// is not one of them.
+import "@/styles/admin-settings.css";
+
+const executionOptions = [
+  { value: "prefer_worker", label: "Prefer any worker" },
+  { value: "prefer_transcode", label: "Prefer transcode node" },
+  { value: "worker_only", label: "Any worker only" },
+  { value: "prefer_api", label: "Prefer API server" },
+  { value: "api_only", label: "API server only" },
+];
+
+const egressOptions = [
+  { value: "prefer_proxy", label: "Prefer proxy" },
+  { value: "proxy_only", label: "Proxy only" },
+  { value: "prefer_api", label: "Prefer API server" },
+  { value: "api_only", label: "API server only" },
+];
+
+type ExecutionWorkload = "remux" | "video_transcode";
+
+function executionPreview(value: string, workload: ExecutionWorkload) {
+  const worker = workload === "remux" ? "Any worker" : "Transcode node";
+  switch (value) {
+    case "prefer_transcode":
+      return workload === "remux" ? "Transcode node → any worker → API" : "Transcode node → API";
+    case "worker_only":
+      return `${worker} only`;
+    case "prefer_api":
+      return `API → ${worker.toLowerCase()}`;
+    case "api_only":
+      return "API only";
+    default:
+      return `${worker} → API`;
+  }
+}
+
+function egressPreview(value: string) {
+  switch (value) {
+    case "proxy_only":
+      return "Proxy only";
+    case "prefer_api":
+      return "API → proxy";
+    case "api_only":
+      return "API only";
+    default:
+      return "Proxy → API";
+  }
+}
+
+/** The whole path for a workload that needs an executor, e.g. "Worker → API · Proxy → API". */
+function routePreview(execution: string, egress: string, workload: ExecutionWorkload) {
+  return `${executionPreview(execution, workload)} · ${egressPreview(egress)}`;
+}
+
+// A routing policy either picks who runs the work (execution) or who serves the
+// bytes (egress). The kind decides the choices offered and the value the server
+// applies while the row has never been set.
+const ROUTING_KINDS = {
+  execution: { options: executionOptions, serverDefault: "prefer_transcode" },
+  egress: { options: egressOptions, serverDefault: "prefer_proxy" },
+};
+
+type RoutingKind = keyof typeof ROUTING_KINDS;
+
+const ROUTING_KEYS = [
+  "playback.routing.direct_play_egress",
+  "playback.routing.remux_execution",
+  "playback.routing.remux_egress",
+  "playback.routing.video_transcode_execution",
+  "playback.routing.video_transcode_egress",
+] as const;
+
+type RoutingKey = (typeof ROUTING_KEYS)[number];
+
+const FORM_KEYS: string[] = [...ROUTING_KEYS];
+
+interface RoutingField {
+  key: RoutingKey;
+  label: string;
+  kind: RoutingKind;
+  description?: string;
+}
+
+// One row per key in ROUTING_KEYS, in the order they render.
+const ROUTING_FIELDS: readonly RoutingField[] = [
+  {
+    key: "playback.routing.direct_play_egress",
+    label: "Direct play egress",
+    kind: "egress",
+    description: "Original bytes need no executor.",
+  },
+  {
+    key: "playback.routing.remux_execution",
+    label: "Remux execution",
+    kind: "execution",
+    description:
+      "A worker can be a proxy or transcode node. Prefer transcode node runs HLS or progressive remux there when supported; progressive output is relayed through the selected proxy.",
+  },
+  { key: "playback.routing.remux_egress", label: "Remux egress", kind: "egress" },
+  {
+    key: "playback.routing.video_transcode_execution",
+    label: "Video transcode execution",
+    kind: "execution",
+    description: "Video transcode workers are transcode nodes; proxy nodes only provide egress.",
+  },
+  {
+    key: "playback.routing.video_transcode_egress",
+    label: "Video transcode egress",
+    kind: "egress",
+  },
+];
+
+const ROUTING_PRESETS = {
+  standard: {
+    label: "Prairie Defaults",
+    values: {
+      "playback.routing.direct_play_egress": "prefer_proxy",
+      "playback.routing.remux_execution": "prefer_transcode",
+      "playback.routing.remux_egress": "prefer_proxy",
+      "playback.routing.video_transcode_execution": "prefer_transcode",
+      "playback.routing.video_transcode_egress": "prefer_proxy",
+    },
+  },
+  gpu: {
+    label: "GPU offload",
+    values: {
+      "playback.routing.direct_play_egress": "prefer_api",
+      "playback.routing.remux_execution": "prefer_api",
+      "playback.routing.remux_egress": "prefer_api",
+      "playback.routing.video_transcode_execution": "prefer_worker",
+      "playback.routing.video_transcode_egress": "prefer_proxy",
+    },
+  },
+  central: {
+    label: "Central egress",
+    values: {
+      "playback.routing.direct_play_egress": "api_only",
+      "playback.routing.remux_execution": "prefer_worker",
+      "playback.routing.remux_egress": "api_only",
+      "playback.routing.video_transcode_execution": "prefer_worker",
+      "playback.routing.video_transcode_egress": "api_only",
+    },
+  },
+} as const;
+
+/** One line of the preferred-path summary: workload on the left, route on the right. */
+function PreferredPathRow({ label, route }: { label: string; route: string }) {
+  return (
+    <div className="flex justify-between gap-5">
+      <span className="text-muted-foreground">{label}</span>
+      <span className="font-medium">{route}</span>
+    </div>
+  );
+}
+
+/**
+ * Where playback work runs and who serves the bytes, across the API server and
+ * its proxy and transcode nodes. It lives on the Nodes page because it only
+ * means anything once nodes exist, and it saves through its own bar.
+ */
+export function NodeRoutingSettings() {
+  const form = useSettingsForm({ keys: FORM_KEYS });
+  const restartKeys = useRestartKeys();
+  const nodes = useAdminNodes();
+  // Gate on a node list we actually have: while it loads or after it failed,
+  // read every kind as available rather than warn on a transient error.
+  const transcodeNodeAvailable = !nodes.isSuccess || hasUsableTranscodeNode(nodes.data);
+  const proxyNodeAvailable =
+    !nodes.isSuccess ||
+    (nodes.data ?? []).some((node) => node.type === "proxy" && node.enabled && node.healthy);
+
+  const routingValues = Object.fromEntries(
+    ROUTING_KEYS.map((key) => [key, form.getValue(key)]),
+  ) as Record<RoutingKey, string>;
+  const activeRoutingPreset = Object.values(ROUTING_PRESETS).find((preset) =>
+    ROUTING_KEYS.every((key) => routingValues[key] === preset.values[key]),
+  );
+  const applyRoutingPreset = (values: Record<RoutingKey, string>) => {
+    for (const key of ROUTING_KEYS) form.setValue(key, values[key]);
+  };
+
+  const routingDirty = ROUTING_KEYS.some((key) => form.isDirty(key));
+  const usesProxyOnlyEgress = ROUTING_KEYS.some((key) => routingValues[key] === "proxy_only");
+  // A remux can run on a proxy node (progressive) or a transcode node (HLS), so
+  // worker-only remuxing is only stranded when neither kind is available.
+  const strandedRoute =
+    (usesProxyOnlyEgress && !proxyNodeAvailable) ||
+    (routingValues["playback.routing.remux_execution"] === "worker_only" &&
+      !proxyNodeAvailable &&
+      !transcodeNodeAvailable) ||
+    (routingValues["playback.routing.video_transcode_execution"] === "worker_only" &&
+      !transcodeNodeAvailable);
+
+  if (form.isLoading) return null;
+
+  return (
+    <>
+      {/* The Nodes page is not under the settings layout, so it guards its
+          own staged routing edits. */}
+      <UnsavedChangesGuard />
+      <FieldGroup
+        label="Where playback work runs"
+        description="Which machine runs a remux or transcode, and which one sends the stream to the player. A preferred route falls back to the API server; an “only” route never does."
+        restartAll={ROUTING_KEYS.every((key) => restartKeys.has(key))}
+        dirty={routingDirty}
+      >
+        <SettingFieldRow
+          label="Routing preset"
+          description="Sets all five routes under Advanced at once; Custom is not stored."
+        >
+          <div className="flex flex-wrap justify-end gap-2">
+            {Object.entries(ROUTING_PRESETS).map(([id, preset]) => (
+              <Button
+                key={id}
+                type="button"
+                size="sm"
+                variant={activeRoutingPreset === preset ? "default" : "outline"}
+                onClick={() => applyRoutingPreset(preset.values)}
+              >
+                {preset.label}
+              </Button>
+            ))}
+            {!activeRoutingPreset && (
+              <span className="text-muted-foreground self-center text-xs">Custom</span>
+            )}
+          </div>
+        </SettingFieldRow>
+
+        {/* The five routes are what a preset writes. An admin picks a preset;
+            setting them one by one is the tuning tier. */}
+        <AdvancedSection id="nodes.routing" count={ROUTING_FIELDS.length} forceOpen={routingDirty}>
+          {ROUTING_FIELDS.map((field) => (
+            <SettingField
+              key={field.key}
+              label={field.label}
+              type="select"
+              options={ROUTING_KINDS[field.kind].options}
+              description={field.description}
+              value={routingValues[field.key] || ROUTING_KINDS[field.kind].serverDefault}
+              onChange={(v) => form.setValue(field.key, v)}
+              restartRequired={restartKeys.has(field.key)}
+            />
+          ))}
+        </AdvancedSection>
+
+        <SettingFieldRow
+          label="Preferred paths"
+          description="Arrows show soft fallback order; only modes never cross that boundary."
+        >
+          <div className="grid min-w-64 gap-1 text-xs">
+            <PreferredPathRow
+              label="Direct play"
+              route={egressPreview(routingValues["playback.routing.direct_play_egress"])}
+            />
+            <PreferredPathRow
+              label="Remux"
+              route={routePreview(
+                routingValues["playback.routing.remux_execution"],
+                routingValues["playback.routing.remux_egress"],
+                "remux",
+              )}
+            />
+            <PreferredPathRow
+              label="Video transcode"
+              route={routePreview(
+                routingValues["playback.routing.video_transcode_execution"],
+                routingValues["playback.routing.video_transcode_egress"],
+                "video_transcode",
+              )}
+            />
+          </div>
+        </SettingFieldRow>
+
+        {strandedRoute && (
+          <SettingFieldStatus tone="warn">
+            An “only” route currently has no healthy supporting node. Saving is allowed so nodes can
+            join later.
+          </SettingFieldStatus>
+        )}
+        {usesProxyOnlyEgress && (
+          <SettingFieldStatus tone="warn">
+            Proxy-only egress requires every native client to support authorized media origins;
+            older clients may be unable to start that workload.
+          </SettingFieldStatus>
+        )}
+      </FieldGroup>
+      <SaveBar
+        dirtyCount={form.dirtyCount}
+        onSave={form.save}
+        onDiscard={form.discard}
+        isSaving={form.isSaving}
+      />
+    </>
+  );
+}
diff --git a/web/src/pages/admin-settings/NotificationsAdminSettings.test.tsx b/web/src/pages/admin-settings/NotificationsAdminSettings.test.tsx
index 35a99c5745..e8d859aaa0 100644
--- a/web/src/pages/admin-settings/NotificationsAdminSettings.test.tsx
+++ b/web/src/pages/admin-settings/NotificationsAdminSettings.test.tsx
@@ -1,5 +1,5 @@
 import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
-import { render, screen, waitFor } from "@testing-library/react";
+import { render, screen, waitFor, within } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import { MemoryRouter } from "react-router";
 import { beforeEach, describe, expect, it, vi } from "vitest";
@@ -140,17 +140,19 @@ describe("NotificationsAdminSettings", () => {
     );
     expect(keys).not.toContain("notifications.push_relay_api_key");
     expect(keys).toContain("notifications.push_relay_url");
+    // Mail readiness is read for the Email channel's status line; the mail
+    // server itself is edited on the Email page.
+    for (const key of ["email.enabled", "email.smtp_host", "email.from_address"]) {
+      expect(keys).toContain(key);
+    }
     for (const key of [
-      "email.enabled",
-      "email.smtp_host",
       "email.smtp_port",
       "email.smtp_security",
       "email.smtp_username",
       "email.smtp_password",
-      "email.from_address",
       "email.from_name",
     ]) {
-      expect(keys).toContain(key);
+      expect(keys).not.toContain(key);
     }
     for (const key of ["discord.client_id", "discord.client_secret", "discord.bot_token"]) {
       expect(keys).toContain(key);
@@ -163,6 +165,10 @@ describe("NotificationsAdminSettings", () => {
     await userEvent.click(screen.getByRole("button", { name: /Prairie Push Relay/ }));
 
     expect(screen.getByText("Privacy disclosure")).toBeInTheDocument();
+    // Per-platform switches and relay internals wait under the card's Advanced.
+    expect(screen.queryByText("Apple Push (APNs)")).not.toBeInTheDocument();
+    expect(screen.queryByText("Relay URL")).not.toBeInTheDocument();
+    await userEvent.click(screen.getByRole("button", { name: "Advanced · 4 settings" }));
     expect(screen.getByText("Apple Push (APNs)")).toBeInTheDocument();
     expect(screen.getByText("Android Push (FCM)")).toBeInTheDocument();
     expect(screen.getByText(/content-free request to Prairie's push relay/)).toBeInTheDocument();
@@ -178,19 +184,197 @@ describe("NotificationsAdminSettings", () => {
     expect(screen.queryByText("Send test push")).not.toBeInTheDocument();
   });
 
-  it("shows the saved SMTP password as a masked, editable input", async () => {
-    const form = makeForm();
-    form.sensitiveConfigured = ["email.smtp_password"];
+  it("treats an unregistered relay as normal: the server registers on its first send", async () => {
+    // A fresh install: delivery is on by default and nothing is registered.
+    const form = makeForm({
+      "notifications.push_relay_deployment_id": "",
+      "notifications.push_relay_key_prefix": "",
+      "notifications.push_relay_expires_at": "",
+    });
+    form.sensitiveConfigured = [];
+    useSettingsFormMock.mockReturnValue(form);
+
+    render(renderPage());
+
+    const chip = screen.getByText("Registers on first send");
+    expect(chip).not.toHaveClass("text-amber-500");
+    expect(screen.queryByText(/registration required/i)).not.toBeInTheDocument();
+
+    await userEvent.click(screen.getByRole("button", { name: /Prairie Push Relay/ }));
+    await userEvent.click(screen.getByRole("button", { name: "Advanced · 4 settings" }));
+    expect(screen.getByText(/Prairie registers on its first push/)).toBeInTheDocument();
+    expect(screen.getByRole("button", { name: "Register relay" })).toBeInTheDocument();
+  });
+
+  it("keeps the warning and opens the relay controls when re-registration is required", async () => {
+    // Parked by an admin's clear or the relay: first-use registration will not
+    // undo that, so the admin has to act.
+    const form = makeForm({
+      "notifications.push_relay_reregistration_required": "true",
+      "notifications.push_relay_deployment_id": "",
+    });
+    form.sensitiveConfigured = [];
     useSettingsFormMock.mockReturnValue(form);
 
     render(renderPage());
+
+    expect(screen.getByText("Re-registration required")).toHaveClass("text-amber-500");
+    await userEvent.click(screen.getByRole("button", { name: /Prairie Push Relay/ }));
+    expect(screen.getByRole("button", { name: "Re-register relay" })).toBeInTheDocument();
+  });
+
+  it("links the Email channel to the Email page instead of holding the mail server", async () => {
+    useSettingsFormMock.mockReturnValue(makeForm());
+
+    render(renderPage());
+    // The channel defaults on while mail is not set up, which is every fresh
+    // install: that is a neutral state, not a warning.
+    expect(screen.getByText("Mail server not set up")).not.toHaveClass("text-amber-500");
+    await openChannel(EMAIL_CHANNEL);
+
+    expect(screen.getByRole("link", { name: "Email page" })).toHaveAttribute(
+      "href",
+      "/admin/settings/email",
+    );
+    expect(screen.getByText(/No email can send until it is/)).toBeInTheDocument();
+    for (const label of [
+      "Send email from this server",
+      "From address",
+      "Mail server address",
+      "Port",
+      "Encryption",
+      "Username",
+      "Password",
+    ]) {
+      expect(screen.queryByLabelText(label)).not.toBeInTheDocument();
+    }
+    expect(screen.queryByRole("button", { name: "Send test" })).not.toBeInTheDocument();
+    expect(
+      screen.getByRole("switch", { name: "Let people pick an email per episode" }),
+    ).toBeInTheDocument();
+    expect(screen.queryByText("Daily summary hour")).not.toBeInTheDocument();
+
+    await userEvent.click(screen.getByRole("button", { name: "Advanced · 1 setting" }));
+    expect(screen.getByRole("spinbutton", { name: "Daily summary hour" })).toHaveValue(8);
+  });
+
+  it("says when the mail server is set up", async () => {
+    useSettingsFormMock.mockReturnValue(
+      makeForm({
+        "email.enabled": "true",
+        "email.smtp_host": "smtp.example.com",
+        "email.from_address": "prairie@example.com",
+      }),
+    );
+
+    render(renderPage());
+    expect(screen.getByText("Mail server set up")).toBeInTheDocument();
     await openChannel(EMAIL_CHANNEL);
+    expect(screen.getByText(/Mail server set up\. Change it on the/)).toBeInTheDocument();
+  });
+
+  it("files Discord artwork and the summary hour under the card's Advanced", async () => {
+    useSettingsFormMock.mockReturnValue(makeForm());
+
+    render(renderPage());
+    await openChannel(DISCORD_CHANNEL);
+
+    expect(
+      screen.getByRole("switch", { name: "Let people pick a DM per episode" }),
+    ).toBeInTheDocument();
+    expect(screen.queryByText("Artwork")).not.toBeInTheDocument();
+    await userEvent.click(screen.getByRole("button", { name: "Advanced · 2 settings" }));
+    expect(screen.getByRole("combobox", { name: "Artwork" })).toHaveTextContent(
+      "Provider images only",
+    );
+    expect(screen.getByRole("spinbutton", { name: "Daily summary hour" })).toHaveValue(8);
+  });
+
+  it("opens the Discord setup guide through the shared disclosure", async () => {
+    useSettingsFormMock.mockReturnValue(makeForm());
+
+    render(renderPage());
+    await openChannel(DISCORD_CHANNEL);
+
+    const guide = screen.getByRole("button", { name: "Setup guide" });
+    expect(guide).toHaveAttribute("aria-expanded", "false");
+    expect(screen.queryByText(/discord.com\/developers\/applications/)).not.toBeInTheDocument();
+    await userEvent.click(guide);
+    expect(screen.getByText(/discord.com\/developers\/applications/)).toBeInTheDocument();
+  });
+
+  it("keeps server channel destinations visible and their tuning under Advanced", async () => {
+    useSettingsFormMock.mockReturnValue(makeForm());
+
+    render(renderPage());
+    await userEvent.click(screen.getByRole("button", { name: /Server-wide announcements/ }));
+
+    expect(screen.getByRole("button", { name: "Add server channel" })).toBeInTheDocument();
+    expect(screen.queryByText("Batch window")).not.toBeInTheDocument();
+    await userEvent.click(screen.getByRole("button", { name: "Advanced · 2 settings" }));
+    expect(screen.getByRole("spinbutton", { name: "Batch window" })).toHaveValue(300);
+    expect(
+      screen.getByRole("switch", { name: "Mention the requester on Discord" }),
+    ).toBeInTheDocument();
+  });
+
+  it("says the webhook delivery limit is counted per server process", async () => {
+    useSettingsFormMock.mockReturnValue(makeForm());
+
+    render(renderPage());
+    await userEvent.click(screen.getByRole("button", { name: /Webhooks people create/ }));
+    await userEvent.click(screen.getByRole("button", { name: "Advanced · 3 settings" }));
+
+    expect(screen.getByText(/Counted by each server process on its own/)).toBeInTheDocument();
+  });
+
+  it("gathers the pipeline switches, grouping, and retention in one Advanced area", async () => {
+    const form = makeForm();
+    useSettingsFormMock.mockReturnValue(form);
+
+    render(renderPage());
+
+    expect(screen.queryByText("Pipeline")).not.toBeInTheDocument();
+    expect(screen.queryByRole("switch", { name: "Notice new content" })).not.toBeInTheDocument();
+    const processing = screen.getByRole("group", { name: "Processing" });
+    await userEvent.click(
+      within(processing).getByRole("button", { name: "Advanced · 8 settings" }),
+    );
+
+    for (const name of ["Notice new content", "Work out who wants it"]) {
+      expect(within(processing).getByRole("switch", { name })).toBeChecked();
+    }
+    for (const name of [
+      "Settle window",
+      "Max messages per show",
+      "Max content age",
+      "Read notifications",
+      "Unread notifications",
+      "Sent history",
+    ]) {
+      expect(within(processing).getByRole("spinbutton", { name })).toBeInTheDocument();
+    }
+    await userEvent.click(within(processing).getByRole("switch", { name: "Notice new content" }));
+    expect(form.setValue).toHaveBeenCalledWith("notifications.release_events_enabled", "false");
+  });
+
+  it("opens the Advanced area for a staged edit inside it", () => {
+    const form = makeForm();
+    form.isDirty = vi.fn((key: string) => key === "notifications.retention.read_days");
+    useSettingsFormMock.mockReturnValue(form);
+
+    render(renderPage());
+
+    expect(screen.getByRole("spinbutton", { name: "Read notifications" })).toBeInTheDocument();
+  });
+
+  it("says so up top, and opens the switches, when the pipeline is paused", () => {
+    useSettingsFormMock.mockReturnValue(makeForm({ "notifications.fanout_enabled": "false" }));
+
+    render(renderPage());
 
-    // No Replace step: typing stages a replacement, blank keeps the saved one.
-    const input = screen.getByLabelText("Password");
-    expect(input).toHaveAttribute("type", "password");
-    expect(input).toHaveAttribute("placeholder", "••••••••••••");
-    expect(screen.queryByRole("button", { name: /Replace/ })).not.toBeInTheDocument();
+    expect(screen.getByRole("status")).toHaveTextContent(/Sending is paused/);
+    expect(screen.getByRole("switch", { name: "Work out who wants it" })).not.toBeChecked();
   });
 
   it("confirms the invite link copy only once it has actually happened", async () => {
diff --git a/web/src/pages/admin-settings/NotificationsAdminSettings.tsx b/web/src/pages/admin-settings/NotificationsAdminSettings.tsx
index 497ad3f39d..7ec5e9b909 100644
--- a/web/src/pages/admin-settings/NotificationsAdminSettings.tsx
+++ b/web/src/pages/admin-settings/NotificationsAdminSettings.tsx
@@ -2,12 +2,9 @@ import { useId, useMemo, useRef, useState } from "react";
 import { MobilePushPrivacyDisclosure } from "@/components/notifications/MobilePushPrivacyDisclosure";
 import { useQueryClient } from "@tanstack/react-query";
 import {
-  Bell,
-  BookOpen,
   Bot,
   Check,
   ChevronDown,
-  ChevronRight,
   Copy,
   ExternalLink,
   Inbox,
@@ -17,12 +14,11 @@ import {
   Megaphone,
   MonitorSmartphone,
   RadioTower,
-  Rss,
   TriangleAlert,
   Webhook,
-  Workflow,
 } from "lucide-react";
 import type { LucideIcon } from "lucide-react";
+import { Link } from "react-router";
 import { toast } from "sonner";
 import {
   captureProfileRequestContext,
@@ -36,7 +32,6 @@ import {
   clearNotificationRelay,
   type NotificationRelayRegistration,
 } from "@/api/v2/notificationRelay";
-import { TestEmailRow } from "@/components/admin/EmailTestRow";
 import { Button } from "@/components/ui/button";
 import {
   AlertDialog,
@@ -65,9 +60,15 @@ import { copyTextToClipboard } from "@/lib/clipboard";
 import { cn } from "@/lib/utils";
 import { FieldGroup } from "./FieldGroup";
 import { SaveBar } from "@/components/SaveBar";
-import { SettingField } from "./SettingField";
+import { SettingField, SettingFieldStatus } from "./SettingField";
 import ServerNotificationChannels from "./ServerNotificationChannels";
 
+/**
+ * Operator kill switches for the whole pipeline. Both default on and only
+ * come off to stop a flood or chase a problem, so they sit under Advanced.
+ */
+const PIPELINE_KEYS = ["notifications.release_events_enabled", "notifications.fanout_enabled"];
+
 /** Batching and flood control; all advanced. */
 const FANOUT_KEYS = [
   "notifications.fanout.settle_seconds",
@@ -82,6 +83,9 @@ const RETENTION_KEYS = [
   "notifications.retention.event_days",
 ];
 
+/** The page's one foot-of-page Advanced area. */
+const PROCESSING_KEYS = [...PIPELINE_KEYS, ...FANOUT_KEYS, ...RETENTION_KEYS];
+
 /** Personal webhook limits and the SSRF escape hatch; all advanced. */
 const WEBHOOK_ADVANCED_KEYS = [
   "notifications.webhooks.max_per_profile",
@@ -89,22 +93,41 @@ const WEBHOOK_ADVANCED_KEYS = [
   "notifications.webhooks.allow_private_destinations",
 ];
 
+const PUSH_DELIVERY_KEYS = [
+  "notifications.apple_push_delivery_enabled",
+  "notifications.android_push_delivery_enabled",
+];
+
 /**
- * Outbound mail. The SMTP server used to be its own tab; it now lives in the
- * Email channel card because "email notifications don't arrive" is always an
- * SMTP question.
+ * Rows in the relay card's Advanced section: the per-platform switches (the
+ * card's own switch flips both), the relay URL, and the deployment ID. Only the
+ * switches go through the settings form.
  */
-const EMAIL_KEYS = [
-  "email.enabled",
-  "email.smtp_host",
-  "email.smtp_port",
-  "email.smtp_security",
-  "email.smtp_username",
-  "email.smtp_password",
-  "email.from_address",
-  "email.from_name",
+const PUSH_RELAY_ADVANCED_KEYS = [
+  ...PUSH_DELIVERY_KEYS,
+  "notifications.push_relay_url",
+  "notifications.push_relay_deployment_id",
+];
+
+const EMAIL_CHANNEL_ADVANCED_KEYS = ["notifications.email.digest_hour"];
+
+const DISCORD_ADVANCED_KEYS = [
+  "notifications.discord.poster_mode",
+  "notifications.discord.digest_hour",
+];
+
+const SERVER_CHANNELS_ADVANCED_KEYS = [
+  "notifications.server_channels.batch_seconds",
+  "notifications.server_channels.mention_requesters",
 ];
 
+/**
+ * Read for the Email channel's status line only. The mail server itself is
+ * edited on the Email page, since invitations and password resets send
+ * through it too.
+ */
+const MAIL_STATUS_KEYS = ["email.enabled", "email.smtp_host", "email.from_address"];
+
 /**
  * The Discord application. Saved by its own card inside the Discord channel
  * (a bot token has to be testable before it is committed), but listed here so
@@ -113,13 +136,11 @@ const EMAIL_KEYS = [
 const DISCORD_APP_KEYS = ["discord.client_id", "discord.client_secret", "discord.bot_token"];
 
 const KEYS = [
-  "notifications.release_events_enabled",
-  "notifications.fanout_enabled",
+  ...PIPELINE_KEYS,
   "notifications.ui_enabled",
   "notifications.webhooks_enabled",
   "notifications.web_push_enabled",
-  "notifications.apple_push_delivery_enabled",
-  "notifications.android_push_delivery_enabled",
+  ...PUSH_DELIVERY_KEYS,
   // Relay lifecycle fields are read for status but are never edited through
   // the shared settings form; credential endpoints replace them atomically.
   "notifications.push_relay_url",
@@ -131,16 +152,14 @@ const KEYS = [
   ...WEBHOOK_ADVANCED_KEYS,
   "notifications.email_enabled",
   "notifications.email.allow_per_episode",
-  "notifications.email.digest_hour",
+  ...EMAIL_CHANNEL_ADVANCED_KEYS,
   "notifications.discord_enabled",
   "notifications.discord.allow_per_episode",
-  "notifications.discord.digest_hour",
-  "notifications.discord.poster_mode",
+  ...DISCORD_ADVANCED_KEYS,
   "notifications.server_channels_enabled",
-  "notifications.server_channels.batch_seconds",
-  "notifications.server_channels.mention_requesters",
+  ...SERVER_CHANNELS_ADVANCED_KEYS,
   ...RETENTION_KEYS,
-  ...EMAIL_KEYS,
+  ...MAIL_STATUS_KEYS,
   ...DISCORD_APP_KEYS,
 ];
 
@@ -163,7 +182,7 @@ function Chip({
   return (
     <span
       className={cn(
-        "inline-flex items-center gap-1 rounded-full border px-2 py-0.5 text-[11px] font-medium whitespace-nowrap",
+        "inline-flex items-center gap-1 rounded-full border px-2 py-0.5 text-xs font-medium whitespace-nowrap",
         tone === "neutral" && "border-border/70 text-muted-foreground",
         tone === "positive" && "border-emerald-500/30 bg-emerald-500/10 text-emerald-500",
         tone === "warning" && "border-amber-500/30 bg-amber-500/10 text-amber-500",
@@ -174,42 +193,16 @@ function Chip({
   );
 }
 
-function ZoneHeading({ title }: { title: string }) {
-  return (
-    <h3 className="text-muted-foreground px-1 text-xs font-semibold tracking-[0.22em] uppercase">
-      {title}
-    </h3>
-  );
-}
-
-interface PipelineStageProps {
-  icon: LucideIcon;
-  title: string;
-  description: string;
-  /** Visually de-emphasize the stage when an upstream stage is switched off. */
-  dimmed?: boolean;
-  control: React.ReactNode;
-}
-
-function PipelineStage({ icon: Icon, title, description, dimmed, control }: PipelineStageProps) {
-  return (
-    <div className="flex items-start justify-between gap-3">
-      <div className={cn("min-w-0 transition-opacity", dimmed && "opacity-50")}>
-        <div className="flex items-center gap-2">
-          <Icon className="text-muted-foreground h-4 w-4 shrink-0" />
-          <span className="text-sm font-medium">{title}</span>
-        </div>
-        <p className="text-muted-foreground mt-1 text-xs leading-relaxed">{description}</p>
-      </div>
-      {control}
-    </div>
-  );
-}
-
-function PipelineArrow() {
+/**
+ * A labelled cluster inside an Advanced disclosure. One element per cluster
+ * means the disclosure's child rule draws a single hairline between clusters,
+ * with the rows keeping their own inside each.
+ */
+function AdvancedCluster({ label, children }: { label: string; children: React.ReactNode }) {
   return (
-    <div className="hidden items-center md:flex">
-      <ChevronRight className="text-muted-foreground/50 h-4 w-4" />
+    <div>
+      <SettingsSubheading>{label}</SettingsSubheading>
+      {children}
     </div>
   );
 }
@@ -225,10 +218,14 @@ interface ChannelCardProps {
 }
 
 /**
- * One delivery channel: an always-visible header row (icon, title, status
- * chips, enable switch) with settings tucked behind an expandable body.
+ * One delivery channel as a settings row: icon, title, status chips and the
+ * enable switch, with the channel's setup in an expandable body below it.
  * Settings stay editable while the channel is off so admins can configure
  * before enabling.
+ *
+ * The body is the channel's main content (credentials, destinations, the
+ * privacy disclosure), not an Advanced tier, so it is this card's own
+ * expand/collapse; tuning inside it sits behind an `AdvancedSection`.
  */
 function ChannelCard({
   icon: Icon,
@@ -266,8 +263,8 @@ function ChannelCard({
   );
 
   return (
-    <div className="surface-panel overflow-hidden rounded-2xl border-0">
-      <div className="flex items-center gap-3 p-4 sm:px-5">
+    <div>
+      <div className="flex items-center gap-3 py-3.5">
         {expandable ? (
           <button
             type="button"
@@ -300,7 +297,7 @@ function ChannelCard({
       {expandable && open && (
         <div
           id={bodyId}
-          className="border-border/60 animate-in fade-in-0 slide-in-from-top-1 border-t px-4 pt-1 pb-4 duration-200 sm:px-5"
+          className="animate-in fade-in-0 slide-in-from-top-1 pb-4 pl-[3.25rem] duration-200"
         >
           {children}
         </div>
@@ -348,7 +345,9 @@ function RegisterRelayRow({
       : `Expires ${expiration.toLocaleString()}; Prairie renews automatically.`
     : configured
       ? "Expiration unknown; Prairie refreshes the credential on its next renewal."
-      : "No relay credential is registered.";
+      : reregistrationRequired
+        ? "No relay credential is registered."
+        : "Not registered yet; Prairie registers on its first push.";
 
   const registerRelay = async () => {
     if (inFlight.current) return;
@@ -490,59 +489,38 @@ function discordInviteUrl(clientId: string): string {
 }
 
 function DiscordSetupGuide() {
-  const [open, setOpen] = useState(false);
-  const guideId = useId();
-
   return (
-    <div className="py-2">
-      <button
-        type="button"
-        aria-expanded={open}
-        aria-controls={guideId}
-        onClick={() => setOpen((current) => !current)}
-        className="text-muted-foreground hover:text-foreground inline-flex cursor-pointer items-center gap-1.5 text-xs font-medium transition-colors"
-      >
-        <BookOpen className="h-3.5 w-3.5" />
-        {open ? "Hide setup guide" : "Show setup guide"}
-        <ChevronDown
-          className={cn("h-3.5 w-3.5 transition-transform duration-200", open && "rotate-180")}
-        />
-      </button>
-      {open && (
-        <div
-          id={guideId}
-          className="text-muted-foreground animate-in fade-in-0 mt-3 space-y-1.5 text-xs leading-relaxed duration-200"
-        >
-          <p>Set up at discord.com/developers/applications:</p>
-          <ol className="list-decimal space-y-1.5 pl-4">
-            <li>Create an application (or open an existing one).</li>
-            <li>
-              OAuth2 page: copy the <strong>Client ID</strong>, reset and copy the{" "}
-              <strong>Client Secret</strong>, and under Redirects add
-              <code className="bg-muted mx-1 rounded px-1">
-                {"<public URL>"}/api/v2/notifications/discord/link/callback
-              </code>
-              using this server&apos;s public URL — it must match exactly.
-            </li>
-            <li>
-              Bot page: reset and copy the <strong>Token</strong>. Leave all Privileged Gateway
-              Intents (Presence, Server Members, Message Content) <strong>off</strong> — Prairie
-              never connects to the gateway; it only sends DMs.
-            </li>
-            <li>
-              Keep <strong>Requires OAuth2 Code Grant</strong> off, or the invite link below
-              won&apos;t work. Enable <strong>Public Bot</strong> only if someone other than the
-              application owner will be inviting it.
-            </li>
-            <li>
-              Paste the three credentials below, save, then use the invite button to add the bot to
-              your Discord server. It needs <strong>no role permissions</strong> — membership alone
-              lets it DM members, and users must share that server with the bot to receive DMs.
-            </li>
-          </ol>
-        </div>
-      )}
-    </div>
+    <AdvancedSection id="notifications.discord.setup-guide" title="Setup guide">
+      <div className="text-muted-foreground space-y-1.5 py-3 text-xs leading-relaxed">
+        <p>Set up at discord.com/developers/applications:</p>
+        <ol className="list-decimal space-y-1.5 pl-4">
+          <li>Create an application (or open an existing one).</li>
+          <li>
+            OAuth2 page: copy the <strong>Client ID</strong>, reset and copy the{" "}
+            <strong>Client Secret</strong>, and under Redirects add
+            <code className="bg-muted mx-1 rounded px-1">
+              {"<public URL>"}/api/v2/notifications/discord/link/callback
+            </code>
+            using this server&apos;s public URL — it must match exactly.
+          </li>
+          <li>
+            Bot page: reset and copy the <strong>Token</strong>. Leave all Privileged Gateway
+            Intents (Presence, Server Members, Message Content) <strong>off</strong> — Prairie never
+            connects to the gateway; it only sends DMs.
+          </li>
+          <li>
+            Keep <strong>Requires OAuth2 Code Grant</strong> off, or the invite link below
+            won&apos;t work. Enable <strong>Public Bot</strong> only if someone other than the
+            application owner will be inviting it.
+          </li>
+          <li>
+            Paste the three credentials below, save, then use the invite button to add the bot to
+            your Discord server. It needs <strong>no role permissions</strong> — membership alone
+            lets it DM members, and users must share that server with the bot to receive DMs.
+          </li>
+        </ol>
+      </div>
+    </AdvancedSection>
   );
 }
 
@@ -823,7 +801,6 @@ export default function NotificationsAdminSettings() {
     return (
       <div className="space-y-6">
         <Skeleton className="h-7 w-44" />
-        <Skeleton className="h-36 w-full rounded-2xl" />
         <div className="space-y-3">
           {[0, 1, 2, 3].map((i) => (
             <Skeleton key={i} className="h-[72px] w-full rounded-2xl" />
@@ -898,9 +875,10 @@ export default function NotificationsAdminSettings() {
   const allowPrivate =
     form.getValue("notifications.webhooks.allow_private_destinations") === "true";
 
-  // Mail readiness mirrors the server's rule (shared with the overview tile):
-  // the outbound switch, a server, AND a sender address — legacy rows and
-  // single-key writes can store enabled-without-sender, which cannot send.
+  // Mail readiness mirrors the server's rule (shared with the Dashboard's
+  // attention notice): the outbound switch, a server, AND a sender address —
+  // legacy rows and single-key writes can store enabled-without-sender, which
+  // cannot send.
   const mailReady = emailReady(
     form.getValue("email.enabled") === "true",
     form.getValue("email.smtp_host"),
@@ -915,91 +893,40 @@ export default function NotificationsAdminSettings() {
     form.sensitiveConfigured.includes("discord.client_secret") &&
     form.sensitiveConfigured.includes("discord.bot_token");
 
-  const channelStates = [
-    uiOn,
-    webPushOn,
-    mobilePushOn,
-    emailOn,
-    discordOn,
-    webhooksOn,
-    serverChannelsOn,
-  ];
-  const enabledChannelCount = channelStates.filter(Boolean).length;
-
   const failingServerChannels = (serverChannels ?? []).filter(
     (channel) =>
       channel.last_failure_at != null &&
       (channel.last_success_at == null || channel.last_failure_at > channel.last_success_at),
   ).length;
 
+  // The kill switches live under Advanced, so a pipeline someone switched off
+  // has to say so up here: every channel below is idle while it is.
   const pausedMessage = !releaseEventsOn
-    ? "New content is not being recorded, so nothing can be sent."
+    ? "New content is not being recorded, so nothing can be sent. Turn it back on under Processing."
     : !fanoutOn
-      ? "Sending is paused; new content waits in the queue."
+      ? "Sending is paused; new content waits in the queue. Turn it back on under Processing."
       : null;
 
   return (
     <div className="flex h-full flex-col">
-      <SettingsPageHeader className="mb-6" title="Notifications" />
+      <SettingsPageHeader title="Notifications" />
 
       <div className="flex-1 space-y-5">
-        {/* ── Pipeline: the master switches, framed as the flow they gate ── */}
-        <div className="surface-panel rounded-2xl border-0 p-4 sm:p-5">
-          <div className="text-muted-foreground mb-4 text-xs font-semibold tracking-[0.22em] uppercase">
-            Pipeline
-          </div>
-          <div className="grid gap-4 md:grid-cols-[1fr_auto_1fr_auto_1fr] md:gap-3">
-            <PipelineStage
-              icon={Rss}
-              title="Notice new content"
-              description="Record new items during library scans."
-              control={
-                <Switch
-                  checked={releaseEventsOn}
-                  onCheckedChange={setToggle("notifications.release_events_enabled")}
-                  aria-label="Enable release events"
-                />
-              }
-            />
-            <PipelineArrow />
-            <PipelineStage
-              icon={Workflow}
-              title="Work out who wants it"
-              description="Match each item against everyone's preferences."
-              dimmed={!releaseEventsOn}
-              control={
-                <Switch
-                  checked={fanoutOn}
-                  onCheckedChange={setToggle("notifications.fanout_enabled")}
-                  aria-label="Enable fanout"
-                />
-              }
-            />
-            <PipelineArrow />
-            <PipelineStage
-              icon={Bell}
-              title="Send it"
-              description="Hand queued messages to the channels below."
-              dimmed={!releaseEventsOn || !fanoutOn}
-              control={
-                <Chip>
-                  {enabledChannelCount}/{channelStates.length} channels on
-                </Chip>
-              }
-            />
+        {pausedMessage && (
+          <div
+            role="status"
+            className="flex items-start gap-2 rounded-2xl border border-amber-500/25 bg-amber-500/5 px-4 py-3 text-xs text-amber-600 dark:text-amber-400"
+          >
+            <TriangleAlert className="mt-0.5 h-4 w-4 shrink-0" />
+            <p>{pausedMessage}</p>
           </div>
-          {pausedMessage && (
-            <div className="mt-4 flex items-start gap-2 text-xs text-amber-500">
-              <TriangleAlert className="mt-0.5 h-4 w-4 shrink-0" />
-              <p>{pausedMessage}</p>
-            </div>
-          )}
-        </div>
+        )}
 
         {/* ── Delivery channels ── */}
-        <section className="space-y-3">
-          <ZoneHeading title="Delivery Channels" />
-
+        <FieldGroup
+          label="Delivery channels"
+          description="Where notifications go. A channel's setup stays editable while it is off, so it can be ready before it is turned on."
+        >
           <ChannelCard
             icon={Inbox}
             title="In-App"
@@ -1031,53 +958,66 @@ export default function NotificationsAdminSettings() {
               ) : pushRelayAPIKeyReady ? (
                 <Chip tone="positive">Relay configured</Chip>
               ) : (
-                <Chip tone={mobilePushOn ? "warning" : "neutral"}>Relay registration required</Chip>
+                // A server that never registered does so on its first send
+                // (internal/notifications/push_sender.go), so a fresh install
+                // has nothing to fix here.
+                <Chip>Registers on first send</Chip>
               )
             }
           >
             <div className="settings-field-list">
               <MobilePushPrivacyDisclosure />
-              <SettingField
-                label="Apple Push (APNs)"
-                type="toggle"
-                value={String(applePushOn)}
-                onChange={(value) =>
-                  form.setValue("notifications.apple_push_delivery_enabled", value)
-                }
-                restartRequired={needsRestart("notifications.apple_push_delivery_enabled")}
-              />
-              <SettingField
-                label="Android Push (FCM)"
-                type="toggle"
-                value={String(androidPushOn)}
-                onChange={(value) =>
-                  form.setValue("notifications.android_push_delivery_enabled", value)
-                }
-                restartRequired={needsRestart("notifications.android_push_delivery_enabled")}
-              />
-              <SettingField
-                label="Relay URL"
-                description="Saved when you register below."
-                type="text"
-                value={pushRelayURL}
-                onChange={(v) => setPushRelayURLDraft(v)}
-                restartRequired={needsRestart("notifications.push_relay_url")}
-              />
-              <RegisterRelayRow
-                key={notificationScope()}
-                relayURL={pushRelayURL}
-                deploymentID={pushRelayDeploymentID}
-                keyPrefix={pushRelayKeyPrefix}
-                expiresAt={pushRelayExpiresAt}
-                reregistrationRequired={pushRelayReregistrationRequired}
-                urlEdited={pushRelayURLEdited}
-                onRegistered={(submittedRelayURL) =>
-                  setPushRelayURLDraft((currentDraft) => {
-                    const currentURL = currentDraft ?? savedPushRelayURL;
-                    return currentURL === submittedRelayURL ? null : currentDraft;
-                  })
+              <AdvancedSection
+                id="notifications.push-relay"
+                count={PUSH_RELAY_ADVANCED_KEYS.length}
+                forceOpen={
+                  anyDirty(PUSH_DELIVERY_KEYS) ||
+                  pushRelayURLEdited ||
+                  pushRelayReregistrationRequired
                 }
-              />
+              >
+                <SettingField
+                  label="Apple Push (APNs)"
+                  type="toggle"
+                  value={String(applePushOn)}
+                  onChange={(value) =>
+                    form.setValue("notifications.apple_push_delivery_enabled", value)
+                  }
+                  restartRequired={needsRestart("notifications.apple_push_delivery_enabled")}
+                />
+                <SettingField
+                  label="Android Push (FCM)"
+                  type="toggle"
+                  value={String(androidPushOn)}
+                  onChange={(value) =>
+                    form.setValue("notifications.android_push_delivery_enabled", value)
+                  }
+                  restartRequired={needsRestart("notifications.android_push_delivery_enabled")}
+                />
+                <SettingField
+                  label="Relay URL"
+                  description="Saved when you register below."
+                  type="text"
+                  value={pushRelayURL}
+                  onChange={(v) => setPushRelayURLDraft(v)}
+                  restartRequired={needsRestart("notifications.push_relay_url")}
+                />
+                <RegisterRelayRow
+                  key={notificationScope()}
+                  relayURL={pushRelayURL}
+                  deploymentID={pushRelayDeploymentID}
+                  keyPrefix={pushRelayKeyPrefix}
+                  expiresAt={pushRelayExpiresAt}
+                  reregistrationRequired={pushRelayReregistrationRequired}
+                  urlEdited={pushRelayURLEdited}
+                  onRegistered={(submittedRelayURL) =>
+                    setPushRelayURLDraft((currentDraft) => {
+                      const currentURL = currentDraft ?? savedPushRelayURL;
+                      return currentURL === submittedRelayURL ? null : currentDraft;
+                    })
+                  }
+                />
+              </AdvancedSection>
             </div>
           </ChannelCard>
 
@@ -1089,92 +1029,34 @@ export default function NotificationsAdminSettings() {
             onEnabledChange={setToggle("notifications.email_enabled")}
             chips={
               <>
-                {mailReady ? (
-                  <Chip tone="positive">Mail server set up</Chip>
-                ) : (
-                  <Chip tone={emailOn ? "warning" : "neutral"}>Mail server not set up</Chip>
-                )}
+                {/* Neutral either way: a server that runs without mail on
+                    purpose is not broken, and the Dashboard lists what is. */}
+                <Chip tone={mailReady ? "positive" : "neutral"}>
+                  {mailReady ? "Mail server set up" : "Mail server not set up"}
+                </Chip>
                 <Chip>
                   Summary at {digestHourLabel(form.getValue("notifications.email.digest_hour"))}
                 </Chip>
               </>
             }
           >
-            <SettingsSubheading>Mail Server</SettingsSubheading>
-            <div className="settings-field-list">
-              <SettingField
-                label="Send email from this server"
-                description="Covers every email Prairie sends, not just notifications."
-                type="toggle"
-                value={form.getValue("email.enabled")}
-                onChange={(v) => form.setValue("email.enabled", v)}
-                restartRequired={needsRestart("email.enabled")}
-              />
-              <SettingField
-                label="From address"
-                hint="silo@example.com"
-                value={form.getValue("email.from_address")}
-                onChange={(v) => form.setValue("email.from_address", v)}
-                restartRequired={needsRestart("email.from_address")}
-              />
-              <SettingField
-                label="From name"
-                hint="Prairie"
-                value={form.getValue("email.from_name")}
-                onChange={(v) => form.setValue("email.from_name", v)}
-                restartRequired={needsRestart("email.from_name")}
-              />
-              <SettingField
-                label="Mail server address"
-                hint="smtp.example.com"
-                value={form.getValue("email.smtp_host")}
-                onChange={(v) => form.setValue("email.smtp_host", v)}
-                restartRequired={needsRestart("email.smtp_host")}
-              />
-              <SettingField
-                label="Port"
-                description="587 for STARTTLS (typical), 465 for implicit TLS"
-                type="number"
-                value={form.getValue("email.smtp_port")}
-                onChange={(v) => form.setValue("email.smtp_port", v)}
-                restartRequired={needsRestart("email.smtp_port")}
-              />
-              <SettingField
-                label="Encryption"
-                description="Use whatever your mail provider documents."
-                type="select"
-                options={[
-                  { value: "starttls", label: "STARTTLS" },
-                  { value: "tls", label: "TLS (implicit)" },
-                  { value: "none", label: "None (insecure)" },
-                ]}
-                value={form.getValue("email.smtp_security") || "starttls"}
-                onChange={(v) => form.setValue("email.smtp_security", v)}
-                restartRequired={needsRestart("email.smtp_security")}
-              />
-              <SettingField
-                label="Username"
-                description="Leave empty if the mail server needs no sign-in."
-                value={form.getValue("email.smtp_username")}
-                onChange={(v) => form.setValue("email.smtp_username", v)}
-                restartRequired={needsRestart("email.smtp_username")}
-              />
-              <SecretField
-                label="Password"
-                value={form.getValue("email.smtp_password")}
-                configured={form.sensitiveConfigured.includes("email.smtp_password")}
-                onKeep={() => form.resetValue("email.smtp_password")}
-                // The username above can be emptied for a relay that needs no
-                // sign-in; without this the password could not follow it.
-                onClear={() => form.setValue("email.smtp_password", "")}
-                cleared={form.isClearStaged("email.smtp_password")}
-                onChange={(v) => form.setValue("email.smtp_password", v)}
-                restartRequired={needsRestart("email.smtp_password")}
-              />
-              <TestEmailRow />
-            </div>
-            <SettingsSubheading>Delivery</SettingsSubheading>
             <div className="settings-field-list">
+              <div className="py-3.5">
+                <SettingFieldStatus tone={mailReady ? "ok" : "muted"}>
+                  <span>
+                    {mailReady
+                      ? "Mail server set up. Change it on the "
+                      : "Mail server not set up. No email can send until it is; set it up on the "}
+                    <Link
+                      to="/admin/settings/email"
+                      className="text-foreground font-medium underline underline-offset-2"
+                    >
+                      Email page
+                    </Link>
+                    .
+                  </span>
+                </SettingFieldStatus>
+              </div>
               <SettingField
                 label="Let people pick an email per episode"
                 description="Off sends them the daily summary instead."
@@ -1183,15 +1065,21 @@ export default function NotificationsAdminSettings() {
                 onChange={(v) => form.setValue("notifications.email.allow_per_episode", v)}
                 restartRequired={needsRestart("notifications.email.allow_per_episode")}
               />
-              <SettingField
-                label="Daily summary hour"
-                description="In the server's own time zone."
-                unit="0-23"
-                type="number"
-                value={numberValue("notifications.email.digest_hour", "8")}
-                onChange={(v) => form.setValue("notifications.email.digest_hour", v)}
-                restartRequired={needsRestart("notifications.email.digest_hour")}
-              />
+              <AdvancedSection
+                id="notifications.email"
+                count={EMAIL_CHANNEL_ADVANCED_KEYS.length}
+                forceOpen={anyDirty(EMAIL_CHANNEL_ADVANCED_KEYS)}
+              >
+                <SettingField
+                  label="Daily summary hour"
+                  description="In the server's own time zone."
+                  unit="0-23"
+                  type="number"
+                  value={numberValue("notifications.email.digest_hour", "8")}
+                  onChange={(v) => form.setValue("notifications.email.digest_hour", v)}
+                  restartRequired={needsRestart("notifications.email.digest_hour")}
+                />
+              </AdvancedSection>
             </div>
           </ChannelCard>
 
@@ -1225,30 +1113,35 @@ export default function NotificationsAdminSettings() {
                 onChange={(v) => form.setValue("notifications.discord.allow_per_episode", v)}
                 restartRequired={needsRestart("notifications.discord.allow_per_episode")}
               />
-              <SettingField
-                label="Daily summary hour"
-                description="In the server's own time zone."
-                unit="0-23"
-                type="number"
-                value={numberValue("notifications.discord.digest_hour", "8")}
-                onChange={(v) => form.setValue("notifications.discord.digest_hour", v)}
-                restartRequired={needsRestart("notifications.discord.digest_hour")}
-              />
+              <AdvancedSection
+                id="notifications.discord"
+                count={DISCORD_ADVANCED_KEYS.length}
+                forceOpen={anyDirty(DISCORD_ADVANCED_KEYS)}
+              >
+                <SettingField
+                  label="Artwork"
+                  description="Server images reveal your server URL to anyone who sees the message."
+                  type="select"
+                  value={form.getValue("notifications.discord.poster_mode") || "provider"}
+                  options={[
+                    { value: "provider", label: "Provider images only" },
+                    { value: "server", label: "Provider and server images" },
+                    { value: "off", label: "No artwork" },
+                  ]}
+                  onChange={(v) => form.setValue("notifications.discord.poster_mode", v)}
+                  restartRequired={needsRestart("notifications.discord.poster_mode")}
+                />
+                <SettingField
+                  label="Daily summary hour"
+                  description="In the server's own time zone."
+                  unit="0-23"
+                  type="number"
+                  value={numberValue("notifications.discord.digest_hour", "8")}
+                  onChange={(v) => form.setValue("notifications.discord.digest_hour", v)}
+                  restartRequired={needsRestart("notifications.discord.digest_hour")}
+                />
+              </AdvancedSection>
             </div>
-            <SettingsSubheading>Appearance</SettingsSubheading>
-            <SettingField
-              label="Artwork"
-              description="Server images reveal your server URL to anyone who sees the message."
-              type="select"
-              value={form.getValue("notifications.discord.poster_mode") || "provider"}
-              options={[
-                { value: "provider", label: "Provider images only" },
-                { value: "server", label: "Provider and server images" },
-                { value: "off", label: "No artwork" },
-              ]}
-              onChange={(v) => form.setValue("notifications.discord.poster_mode", v)}
-              restartRequired={needsRestart("notifications.discord.poster_mode")}
-            />
           </ChannelCard>
 
           <ChannelCard
@@ -1275,7 +1168,10 @@ export default function NotificationsAdminSettings() {
               />
               <SettingField
                 label="Deliveries per person"
-                description="Calls over the limit are dropped; the inbox notification still arrives."
+                // The limiter is in memory on each process
+                // (internal/notifications/webhook_sender.go), so a cluster
+                // allows this many per process, not per server.
+                description="Counted by each server process on its own. Calls over the limit are dropped; the inbox notification still arrives."
                 unit="per minute"
                 type="number"
                 value={numberValue(
@@ -1332,110 +1228,127 @@ export default function NotificationsAdminSettings() {
             }
           >
             <div className="settings-field-list">
-              <SettingField
-                label="Batch window"
-                description="New content waits this long so a season posts as one message."
-                unit="seconds"
-                type="number"
-                value={numberValue("notifications.server_channels.batch_seconds", "300")}
-                onChange={(v) => form.setValue("notifications.server_channels.batch_seconds", v)}
-                restartRequired={needsRestart("notifications.server_channels.batch_seconds")}
-              />
-              <SettingField
-                label="Mention the requester on Discord"
-                description="Unlinked accounts show their Prairie username instead."
-                type="toggle"
-                value={form.getValue("notifications.server_channels.mention_requesters")}
-                onChange={(v) =>
-                  form.setValue("notifications.server_channels.mention_requesters", v)
-                }
-                restartRequired={needsRestart("notifications.server_channels.mention_requesters")}
-              />
-              <div className="pt-3">
+              <div className="py-3">
                 <ServerNotificationChannels />
               </div>
-            </div>
-          </ChannelCard>
-        </section>
-
-        {/* ── Tuning: everything here has a working default ── */}
-        <section className="space-y-3">
-          <ZoneHeading title="Tuning" />
-          {/* Full width, not a two-up grid: the settings column is clamped to
-              max-w-3xl, so side-by-side groups left each row with a ~140px
-              label column beside its control and every description wrapped to
-              six lines. */}
-          <div className="space-y-3">
-            <FieldGroup label="Grouping and flood control" restartAll={allRestart(FANOUT_KEYS)}>
               <AdvancedSection
-                id="notifications.fanout"
-                count={FANOUT_KEYS.length}
-                forceOpen={anyDirty(FANOUT_KEYS)}
+                id="notifications.server-channels"
+                count={SERVER_CHANNELS_ADVANCED_KEYS.length}
+                forceOpen={anyDirty(SERVER_CHANNELS_ADVANCED_KEYS)}
               >
                 <SettingField
-                  label="Settle window"
-                  description="Items that finish scanning together arrive as one notification."
+                  label="Batch window"
+                  description="New content waits this long so a season posts as one message."
                   unit="seconds"
                   type="number"
-                  value={numberValue("notifications.fanout.settle_seconds", "30")}
-                  onChange={(v) => form.setValue("notifications.fanout.settle_seconds", v)}
-                  restartRequired={needsRestart("notifications.fanout.settle_seconds")}
+                  value={numberValue("notifications.server_channels.batch_seconds", "300")}
+                  onChange={(v) => form.setValue("notifications.server_channels.batch_seconds", v)}
+                  restartRequired={needsRestart("notifications.server_channels.batch_seconds")}
                 />
                 <SettingField
-                  label="Max messages per show"
-                  description="Anything past this is skipped for that batch."
-                  type="number"
-                  value={numberValue("notifications.fanout.max_series_burst", "3")}
-                  onChange={(v) => form.setValue("notifications.fanout.max_series_burst", v)}
-                  restartRequired={needsRestart("notifications.fanout.max_series_burst")}
-                />
-                <SettingField
-                  label="Max content age"
-                  description="Older items are dropped instead of arriving as stale news."
-                  unit="hours"
-                  type="number"
-                  value={numberValue("notifications.fanout.max_event_age_hours", "72")}
-                  onChange={(v) => form.setValue("notifications.fanout.max_event_age_hours", v)}
-                  restartRequired={needsRestart("notifications.fanout.max_event_age_hours")}
+                  label="Mention the requester on Discord"
+                  description="Unlinked accounts show their Prairie username instead."
+                  type="toggle"
+                  value={form.getValue("notifications.server_channels.mention_requesters")}
+                  onChange={(v) =>
+                    form.setValue("notifications.server_channels.mention_requesters", v)
+                  }
+                  restartRequired={needsRestart("notifications.server_channels.mention_requesters")}
                 />
               </AdvancedSection>
-            </FieldGroup>
+            </div>
+          </ChannelCard>
+        </FieldGroup>
 
-            <FieldGroup label="Retention" restartAll={allRestart(RETENTION_KEYS)}>
-              <AdvancedSection
-                id="notifications.retention"
-                count={RETENTION_KEYS.length}
-                forceOpen={anyDirty(RETENTION_KEYS)}
-              >
-                <SettingField
-                  label="Read notifications"
-                  unit="days"
-                  type="number"
-                  value={numberValue("notifications.retention.read_days", "90")}
-                  onChange={(v) => form.setValue("notifications.retention.read_days", v)}
-                  restartRequired={needsRestart("notifications.retention.read_days")}
-                />
-                <SettingField
-                  label="Unread notifications"
-                  unit="days"
-                  type="number"
-                  value={numberValue("notifications.retention.unread_days", "180")}
-                  onChange={(v) => form.setValue("notifications.retention.unread_days", v)}
-                  restartRequired={needsRestart("notifications.retention.unread_days")}
-                />
-                <SettingField
-                  label="Sent history"
-                  description="Record of what Prairie already notified about."
-                  unit="days"
-                  type="number"
-                  value={numberValue("notifications.retention.event_days", "30")}
-                  onChange={(v) => form.setValue("notifications.retention.event_days", v)}
-                  restartRequired={needsRestart("notifications.retention.event_days")}
-                />
-              </AdvancedSection>
-            </FieldGroup>
-          </div>
-        </section>
+        {/* ── Processing: everything here has a working default ── */}
+        <FieldGroup
+          label="Processing"
+          description="How Prairie notices new content, groups it into messages, and how long it keeps them."
+          restartAll={allRestart(PROCESSING_KEYS)}
+          dirty={anyDirty(PROCESSING_KEYS)}
+        >
+          <AdvancedSection
+            id="notifications.processing"
+            count={PROCESSING_KEYS.length}
+            // A switched-off pipeline is the one thing in here that stops every
+            // channel, so it does not stay folded away.
+            forceOpen={anyDirty(PROCESSING_KEYS) || pausedMessage !== null}
+          >
+            <AdvancedCluster label="Pipeline">
+              <SettingField
+                label="Notice new content"
+                description="Record new items during library scans."
+                type="toggle"
+                value={toggleValue("notifications.release_events_enabled")}
+                onChange={(v) => form.setValue("notifications.release_events_enabled", v)}
+                restartRequired={needsRestart("notifications.release_events_enabled")}
+              />
+              <SettingField
+                label="Work out who wants it"
+                description="Match each item against everyone's preferences."
+                type="toggle"
+                value={toggleValue("notifications.fanout_enabled")}
+                onChange={(v) => form.setValue("notifications.fanout_enabled", v)}
+                restartRequired={needsRestart("notifications.fanout_enabled")}
+              />
+            </AdvancedCluster>
+            <AdvancedCluster label="Grouping and flood control">
+              <SettingField
+                label="Settle window"
+                description="Items that finish scanning together arrive as one notification."
+                unit="seconds"
+                type="number"
+                value={numberValue("notifications.fanout.settle_seconds", "30")}
+                onChange={(v) => form.setValue("notifications.fanout.settle_seconds", v)}
+                restartRequired={needsRestart("notifications.fanout.settle_seconds")}
+              />
+              <SettingField
+                label="Max messages per show"
+                description="Anything past this is skipped for that batch."
+                type="number"
+                value={numberValue("notifications.fanout.max_series_burst", "3")}
+                onChange={(v) => form.setValue("notifications.fanout.max_series_burst", v)}
+                restartRequired={needsRestart("notifications.fanout.max_series_burst")}
+              />
+              <SettingField
+                label="Max content age"
+                description="Older items are dropped instead of arriving as stale news."
+                unit="hours"
+                type="number"
+                value={numberValue("notifications.fanout.max_event_age_hours", "72")}
+                onChange={(v) => form.setValue("notifications.fanout.max_event_age_hours", v)}
+                restartRequired={needsRestart("notifications.fanout.max_event_age_hours")}
+              />
+            </AdvancedCluster>
+            <AdvancedCluster label="Retention">
+              <SettingField
+                label="Read notifications"
+                unit="days"
+                type="number"
+                value={numberValue("notifications.retention.read_days", "90")}
+                onChange={(v) => form.setValue("notifications.retention.read_days", v)}
+                restartRequired={needsRestart("notifications.retention.read_days")}
+              />
+              <SettingField
+                label="Unread notifications"
+                unit="days"
+                type="number"
+                value={numberValue("notifications.retention.unread_days", "180")}
+                onChange={(v) => form.setValue("notifications.retention.unread_days", v)}
+                restartRequired={needsRestart("notifications.retention.unread_days")}
+              />
+              <SettingField
+                label="Sent history"
+                description="Record of what Prairie already notified about."
+                unit="days"
+                type="number"
+                value={numberValue("notifications.retention.event_days", "30")}
+                onChange={(v) => form.setValue("notifications.retention.event_days", v)}
+                restartRequired={needsRestart("notifications.retention.event_days")}
+              />
+            </AdvancedCluster>
+          </AdvancedSection>
+        </FieldGroup>
       </div>
 
       <SaveBar
diff --git a/web/src/pages/admin-settings/PlaybackSettings.test.tsx b/web/src/pages/admin-settings/PlaybackSettings.test.tsx
index 45ac51b1b2..6ad57d558b 100644
--- a/web/src/pages/admin-settings/PlaybackSettings.test.tsx
+++ b/web/src/pages/admin-settings/PlaybackSettings.test.tsx
@@ -1,6 +1,7 @@
 import { fireEvent, render, screen, within } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import { renderToStaticMarkup } from "react-dom/server";
+import { MemoryRouter } from "react-router";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 import PlaybackSettings from "./PlaybackSettings";
@@ -23,6 +24,9 @@ const useHWAccelDetectionMock = vi.fn();
 const useAdminNodesMock = vi.fn();
 const useAdminTrickplayLibrariesMock = vi.fn();
 const useLibraryCapabilitiesMock = vi.fn();
+const markerCapabilitiesMock = vi.fn<() => { data?: Record<string, boolean> }>(() => ({
+  data: { detection_kind_settings: true },
+}));
 
 vi.mock("@/hooks/useSettingsForm", () => ({
   useSettingsForm: (...args: unknown[]) => useSettingsFormMock(...args),
@@ -48,6 +52,29 @@ vi.mock("@/hooks/queries/admin/trickplay", () => ({
   useAdminTrickplayLibraries: () => useAdminTrickplayLibrariesMock(),
 }));
 
+vi.mock("@/hooks/queries/admin/markers", () => ({
+  useAdminMarkerCapabilities: () => markerCapabilitiesMock(),
+}));
+
+vi.mock("@/hooks/queries/admin/tasks", () => ({
+  useTasks: () => ({ data: [] }),
+  useRunTask: () => ({ mutateAsync: vi.fn() }),
+}));
+
+vi.mock("@/components/realtimeEventsContext", () => ({
+  useEventChannel: () => undefined,
+}));
+
+// Preview images links to Libraries and Skip markers to its providers, so the
+// page renders in a router.
+function Page() {
+  return (
+    <MemoryRouter>
+      <PlaybackSettings />
+    </MemoryRouter>
+  );
+}
+
 /** A transcode node the chapter-thumbnail extractor could reserve. */
 function transcodeNode(overrides: Record<string, unknown> = {}) {
   return {
@@ -96,11 +123,25 @@ function labelled(container: HTMLElement, text: string): Element {
   return control;
 }
 
-/** Opens the page's advanced disclosure via its persisted state. */
+/** The static-markup group whose heading reads `name`. */
+function groupNamed(container: HTMLElement, name: string): HTMLElement {
+  const group = Array.from(container.querySelectorAll<HTMLElement>("[role=group]")).find(
+    (candidate) => candidate.querySelector("h3")?.textContent === name,
+  );
+  if (!group) throw new Error(`no group rendered with heading: ${name}`);
+  return group;
+}
+
+/** Opens the Transcoding group's advanced disclosure via its persisted state. */
 function expandAdvanced() {
   localStorage.setItem("silo.admin.advanced.playback.transcoding", "true");
 }
 
+/** Opens the Preview images group's disclosure via its persisted state. */
+function expandPreviewImages() {
+  localStorage.setItem("silo.admin.advanced.playback.preview_images", "true");
+}
+
 const TONE_MAP_LABEL = "Software HDR tone mapping";
 
 beforeEach(() => {
@@ -116,75 +157,290 @@ beforeEach(() => {
   useAdminNodesMock.mockReturnValue({ data: [transcodeNode()], isSuccess: true });
   useAdminTrickplayLibrariesMock.mockReset();
   useAdminTrickplayLibrariesMock.mockReturnValue({ data: undefined, isSuccess: false });
+  markerCapabilitiesMock.mockReturnValue({ data: { detection_kind_settings: true } });
 });
 
 describe("PlaybackSettings layout", () => {
   it("manages the playback key family and leaves downloads to their own page", () => {
     useSettingsFormMock.mockReturnValue(makeForm({ "playback.hw_accel": "none" }));
 
-    renderToStaticMarkup(<PlaybackSettings />);
+    renderToStaticMarkup(<Page />);
     const keys: string[] = useSettingsFormMock.mock.calls[0]?.[0]?.keys ?? [];
 
     expect(keys).toContain("playback.transcode_enabled");
     expect(keys).toContain("playback.allow_hevc_encoding");
-    expect(keys).toContain("playback.routing.video_transcode_egress");
     expect(keys).toContain("playback.watched_threshold");
+    expect(keys).toContain("playback.copy_keyframe_playlist");
+    expect(keys).toEqual(
+      expect.arrayContaining([
+        "markers.mode",
+        "markers.detect_intros",
+        "markers.detect_credits",
+        "markers.online_storage",
+        "markers.lazy_playback",
+        "markers.detection_workers",
+      ]),
+    );
     expect(keys.some((key) => key.startsWith("download."))).toBe(false);
+    // Node routing and subtitle sync have their own pages and forms.
+    expect(keys.some((key) => key.startsWith("playback.routing."))).toBe(false);
+    expect(keys.some((key) => key.startsWith("subtitles."))).toBe(false);
     // Hidden tier: still saved and readable through the API, no UI.
     expect(keys).not.toContain("playback.chapter_thumbnail_node_capacity");
   });
-});
 
-describe("PlaybackSettings node routing", () => {
-  const defaultRouting = {
-    "playback.routing.direct_play_egress": "prefer_proxy",
-    "playback.routing.remux_execution": "prefer_transcode",
-    "playback.routing.remux_egress": "prefer_proxy",
-    "playback.routing.video_transcode_execution": "prefer_transcode",
-    "playback.routing.video_transcode_egress": "prefer_proxy",
-  };
+  it("orders the groups with watch behavior first and skip markers last", () => {
+    useSettingsFormMock.mockReturnValue(makeForm({ "playback.hw_accel": "none" }));
 
-  it("stages every primitive setting when a preset is selected", async () => {
-    const form = makeForm({ "playback.hw_accel": "none", ...defaultRouting });
-    useSettingsFormMock.mockReturnValue(form);
+    const container = parse(renderToStaticMarkup(<Page />));
 
-    render(<PlaybackSettings />);
-    await userEvent.click(screen.getByRole("button", { name: "GPU offload" }));
+    // Group headings only: the marker task cards carry their own h3s.
+    expect(
+      Array.from(
+        container.querySelectorAll("section[role=group]"),
+        (group) => group.querySelector("h3")?.textContent,
+      ),
+    ).toEqual(["Watch behavior", "Transcoding", "Preview images", "Skip markers"]);
+  });
 
-    expect(form.setValue.mock.calls).toEqual([
-      ["playback.routing.direct_play_egress", "prefer_api"],
-      ["playback.routing.remux_execution", "prefer_api"],
-      ["playback.routing.remux_egress", "prefer_api"],
-      ["playback.routing.video_transcode_execution", "prefer_worker"],
-      ["playback.routing.video_transcode_egress", "prefer_proxy"],
-    ]);
-    expect(form.save).not.toHaveBeenCalled();
+  it("counts each group's advanced settings in its own disclosure", () => {
+    useSettingsFormMock.mockReturnValue(makeForm({ "playback.hw_accel": "none" }));
+
+    render(<Page />);
+
+    // Without a device picker: the FFmpeg path, the back buffer and complete
+    // playlists for copied video.
+    expect(
+      within(screen.getByRole("group", { name: "Transcoding" })).getByRole("button", {
+        name: "Advanced · 3 settings",
+      }),
+    ).toBeInTheDocument();
+    // With a transcode node the placement selects sit outside: the seek
+    // preview worker count and the two chapter-thumbnail HDR fields stay.
+    expect(
+      within(screen.getByRole("group", { name: "Preview images" })).getByRole("button", {
+        name: "Advanced · 3 settings",
+      }),
+    ).toBeInTheDocument();
+    // Every Skip markers setting is shown, so it has no disclosure.
+    expect(
+      within(screen.getByRole("group", { name: "Skip markers" })).queryByRole("button", {
+        name: /^Advanced/,
+      }),
+    ).toBeNull();
   });
 
-  it("warns when hard routes lack nodes or universal client-origin support", () => {
-    useAdminNodesMock.mockReturnValue({
-      data: [transcodeNode({ healthy: false })],
-      isSuccess: true,
-    });
+  it("shows buffer ahead beside throttling, only while throttling is on", () => {
+    useSettingsFormMock.mockReturnValue(makeForm({ "playback.hw_accel": "none" }));
+    const off = render(<Page />);
+    expect(
+      within(screen.getByRole("group", { name: "Transcoding" })).queryByText("Buffer ahead"),
+    ).toBeNull();
+    off.unmount();
+
+    useSettingsFormMock.mockReturnValue(
+      makeForm({ "playback.hw_accel": "none", enable_transcode_throttle: "true" }),
+    );
+    render(<Page />);
+    const transcoding = within(screen.getByRole("group", { name: "Transcoding" }));
+
+    expect(transcoding.getByText("Buffer ahead")).toBeInTheDocument();
+    expect(transcoding.getByRole("button", { name: "Advanced · 3 settings" })).toHaveAttribute(
+      "aria-expanded",
+      "false",
+    );
+  });
+
+  it("shows HEVC, tone mapping, throttling and the transcode directory without the disclosure", () => {
+    useSettingsFormMock.mockReturnValue(makeForm({ "playback.hw_accel": "none" }));
+
+    render(<Page />);
+    const transcoding = within(screen.getByRole("group", { name: "Transcoding" }));
+
+    for (const name of [
+      "Video transcoding",
+      "Allow 4K transcoding",
+      "Allow HEVC encoding",
+      "Enable Hardware HDR Tone Mapping",
+      "Enable Software HDR Tone Mapping",
+      "Throttle transcoding",
+    ]) {
+      expect(transcoding.getByRole("switch", { name })).toBeInTheDocument();
+    }
+    expect(transcoding.getByLabelText("Transcode directory")).toBeInTheDocument();
+    expect(transcoding.queryByText("FFmpeg path")).toBeNull();
+    expect(transcoding.queryByText("Transcode back buffer")).toBeNull();
+  });
+
+  it("opens the Transcoding disclosure for a dirty FFmpeg path", () => {
+    useSettingsFormMock.mockReturnValue(
+      makeForm({ "playback.hw_accel": "none", "playback.ffmpeg_path": "/opt/ffmpeg" }, [
+        "playback.ffmpeg_path",
+      ]),
+    );
+
+    render(<Page />);
+
+    expect(screen.getByLabelText("FFmpeg path")).toHaveValue("/opt/ffmpeg");
+  });
+
+  it("describes how a blank FFmpeg path is resolved", () => {
+    expandAdvanced();
+    useSettingsFormMock.mockReturnValue(makeForm({ "playback.hw_accel": "none" }));
+
+    render(<Page />);
+
+    expect(
+      screen.getByText(
+        "Leave blank to use jellyfin-ffmpeg at /usr/lib/jellyfin-ffmpeg/ffmpeg when it is installed, then ffmpeg on PATH. macOS tries Homebrew's ffmpeg-full first.",
+      ),
+    ).toBeInTheDocument();
+  });
+
+  it("keeps preview image fields out of the Transcoding disclosure", () => {
+    expandAdvanced();
+    expandPreviewImages();
+    useSettingsFormMock.mockReturnValue(makeForm({ "playback.hw_accel": "none" }));
+
+    render(<Page />);
+    const transcoding = within(screen.getByRole("group", { name: "Transcoding" }));
+    const previews = within(screen.getByRole("group", { name: "Preview images" }));
+
+    for (const label of [
+      "Chapter thumbnail workers",
+      "Generate chapter thumbnails on",
+      "HDR handling",
+      TONE_MAP_LABEL,
+      "Preview image width",
+      "Seek preview interval",
+      "Seek preview workers",
+      "Generate seek previews on",
+    ]) {
+      expect(previews.getByText(label)).toBeInTheDocument();
+      expect(transcoding.queryByText(label)).toBeNull();
+    }
+    expect(transcoding.getByText("Transcode back buffer")).toBeInTheDocument();
+  });
+
+  it("opens the Preview images disclosure, not Transcoding's, for a dirty preview field", () => {
+    useSettingsFormMock.mockReturnValue(
+      makeForm({ "playback.hw_accel": "none", "playback.trickplay_workers": "4" }, [
+        "playback.trickplay_workers",
+      ]),
+    );
+
+    render(<Page />);
+
+    expect(
+      within(screen.getByRole("group", { name: "Preview images" })).getByLabelText(
+        "Seek preview workers",
+      ),
+    ).toHaveValue(4);
+    expect(
+      within(screen.getByRole("group", { name: "Transcoding" })).queryByText("FFmpeg path"),
+    ).toBeNull();
+  });
+});
+
+describe("PlaybackSettings preview images tiering", () => {
+  it("points at the per-library switches", () => {
+    useSettingsFormMock.mockReturnValue(makeForm({ "playback.hw_accel": "none" }));
+
+    render(<Page />);
+    const group = within(screen.getByRole("group", { name: "Preview images" }));
+
+    expect(
+      group.getByText(
+        "Chapter thumbnails and seek previews are turned on for each library in Libraries.",
+      ),
+    ).toBeInTheDocument();
+    expect(group.getByRole("link", { name: "Libraries" })).toHaveAttribute(
+      "href",
+      "/admin/libraries",
+    );
+  });
+
+  it("shows width, interval and chapter thumbnail workers without opening the disclosure", () => {
     useSettingsFormMock.mockReturnValue(
       makeForm({
         "playback.hw_accel": "none",
-        ...defaultRouting,
-        "playback.routing.direct_play_egress": "proxy_only",
-        "playback.routing.remux_execution": "worker_only",
+        "playback.preview_image_width": "300",
+        "playback.trickplay_interval_seconds": "10",
       }),
     );
 
-    const text = parse(renderToStaticMarkup(<PlaybackSettings />)).textContent ?? "";
+    render(<Page />);
+    const group = within(screen.getByRole("group", { name: "Preview images" }));
+
+    expect(group.getByRole("button", { name: /^Advanced/ })).toHaveAttribute(
+      "aria-expanded",
+      "false",
+    );
+    expect(group.getByLabelText("Preview image width")).toHaveValue(300);
+    expect(group.getByLabelText("Seek preview interval")).toHaveValue(10);
+    expect(group.getByLabelText("Chapter thumbnail workers")).toBeInTheDocument();
+    for (const label of ["Seek preview workers", "HDR handling", TONE_MAP_LABEL]) {
+      expect(group.queryByText(label)).toBeNull();
+    }
+  });
+
+  it("shows where previews are made only while a transcode node can take the work", () => {
+    useSettingsFormMock.mockReturnValue(makeForm({ "playback.hw_accel": "none" }));
+
+    const view = render(<Page />);
+    let group = within(screen.getByRole("group", { name: "Preview images" }));
+    expect(group.getByText("Generate chapter thumbnails on")).toBeInTheDocument();
+    expect(group.getByText("Generate seek previews on")).toBeInTheDocument();
+    view.unmount();
+
+    for (const nodes of [
+      { data: [], isSuccess: true },
+      { data: [transcodeNode({ healthy: false })], isSuccess: true },
+      { data: undefined, isSuccess: false },
+    ]) {
+      useAdminNodesMock.mockReturnValue(nodes);
+      const collapsed = render(<Page />);
+      group = within(screen.getByRole("group", { name: "Preview images" }));
+      expect(group.queryByText("Generate chapter thumbnails on")).toBeNull();
+      expect(group.queryByText("Generate seek previews on")).toBeNull();
+      // Both selects join the seek preview worker count and the two HDR fields.
+      expect(group.getByRole("button", { name: "Advanced · 5 settings" })).toBeInTheDocument();
+      collapsed.unmount();
+    }
+  });
+
+  it("opens the disclosure for a dirty placement select it holds", () => {
+    useAdminNodesMock.mockReturnValue({ data: [], isSuccess: true });
+    useSettingsFormMock.mockReturnValue(
+      makeForm({ "playback.hw_accel": "none", "playback.chapter_thumbnail_execution": "local" }, [
+        "playback.chapter_thumbnail_execution",
+      ]),
+    );
+
+    render(<Page />);
+
+    expect(
+      within(screen.getByRole("group", { name: "Preview images" })).getByText(
+        "Generate chapter thumbnails on",
+      ),
+    ).toBeInTheDocument();
+  });
+
+  it("labels the HDR fields as chapter thumbnail settings", () => {
+    expandPreviewImages();
+    useSettingsFormMock.mockReturnValue(makeForm({ "playback.hw_accel": "none" }));
+
+    render(<Page />);
+    const group = within(screen.getByRole("group", { name: "Preview images" }));
 
-    expect(text).toContain("no healthy supporting node");
-    expect(text).toContain("requires every native client to support authorized media origins");
+    expect(group.getByRole("heading", { name: "HDR chapter thumbnails" })).toBeInTheDocument();
+    expect(group.getByText("Seek previews always convert HDR to SDR.")).toBeInTheDocument();
   });
 });
 
 describe("PlaybackSettings CPU tone mapping", () => {
   it("includes the setting and renders it off by default", () => {
-    expandAdvanced();
+    expandPreviewImages();
     useSettingsFormMock.mockReturnValue(
       makeForm({
         "playback.hw_accel": "none",
@@ -192,12 +448,12 @@ describe("PlaybackSettings CPU tone mapping", () => {
       }),
     );
 
-    const container = parse(renderToStaticMarkup(<PlaybackSettings />));
+    const container = parse(renderToStaticMarkup(<Page />));
 
     expect(useSettingsFormMock.mock.calls[0]?.[0]?.keys).toContain(
       "playback.chapter_thumbnail_software_tone_map_enabled",
     );
-    const toggle = labelled(container, TONE_MAP_LABEL);
+    const toggle = labelled(groupNamed(container, "Preview images"), TONE_MAP_LABEL);
     expect(toggle).toHaveAttribute("aria-checked", "false");
     expect(toggle).not.toHaveAttribute("disabled");
   });
@@ -205,14 +461,14 @@ describe("PlaybackSettings CPU tone mapping", () => {
   it("offers VideoToolbox hardware acceleration", async () => {
     useSettingsFormMock.mockReturnValue(makeForm({ "playback.hw_accel": "auto" }));
 
-    render(<PlaybackSettings />);
+    render(<Page />);
     await userEvent.click(screen.getByRole("combobox", { name: "Hardware acceleration" }));
 
     expect(screen.getByRole("option", { name: "VideoToolbox (macOS)" })).toBeInTheDocument();
   });
 
   it("disables the toggle while HDR chapter thumbnails are disabled", () => {
-    expandAdvanced();
+    expandPreviewImages();
     useSettingsFormMock.mockReturnValue(
       makeForm({
         "playback.hw_accel": "none",
@@ -221,8 +477,8 @@ describe("PlaybackSettings CPU tone mapping", () => {
       }),
     );
 
-    const container = parse(renderToStaticMarkup(<PlaybackSettings />));
-    const toggle = labelled(container, TONE_MAP_LABEL);
+    const container = parse(renderToStaticMarkup(<Page />));
+    const toggle = labelled(groupNamed(container, "Preview images"), TONE_MAP_LABEL);
 
     expect(toggle).toHaveAttribute("aria-checked", "true");
     expect(toggle).toHaveAttribute("disabled");
@@ -230,21 +486,20 @@ describe("PlaybackSettings CPU tone mapping", () => {
 });
 
 describe("PlaybackSettings transcode tone mapping", () => {
-  beforeEach(expandAdvanced);
-
   it("registers independent hardware and software settings disabled by default", () => {
     useSettingsFormMock.mockReturnValue(makeForm({ "playback.hw_accel": "auto" }));
 
-    const container = parse(renderToStaticMarkup(<PlaybackSettings />));
+    const container = parse(renderToStaticMarkup(<Page />));
     const keys = useSettingsFormMock.mock.calls[0]?.[0]?.keys as string[];
 
     expect(keys).toContain("playback.transcode_hardware_tone_map_enabled");
     expect(keys).toContain("playback.transcode_software_tone_map_enabled");
-    expect(labelled(container, "Enable Hardware HDR Tone Mapping")).toHaveAttribute(
+    const transcoding = groupNamed(container, "Transcoding");
+    expect(labelled(transcoding, "Enable Hardware HDR Tone Mapping")).toHaveAttribute(
       "aria-checked",
       "false",
     );
-    expect(labelled(container, "Enable Software HDR Tone Mapping")).toHaveAttribute(
+    expect(labelled(transcoding, "Enable Software HDR Tone Mapping")).toHaveAttribute(
       "aria-checked",
       "false",
     );
@@ -259,7 +514,7 @@ describe("PlaybackSettings transcode tone mapping", () => {
       }),
     );
 
-    const container = parse(renderToStaticMarkup(<PlaybackSettings />));
+    const container = parse(renderToStaticMarkup(<Page />));
 
     expect(labelled(container, "Enable Hardware HDR Tone Mapping")).toHaveAttribute(
       "aria-checked",
@@ -280,7 +535,7 @@ describe("PlaybackSettings transcode tone mapping", () => {
     );
 
     const toggle = labelled(
-      parse(renderToStaticMarkup(<PlaybackSettings />)),
+      parse(renderToStaticMarkup(<Page />)),
       "Enable Hardware HDR Tone Mapping",
     );
 
@@ -307,7 +562,7 @@ describe("PlaybackSettings transcode tone mapping", () => {
     );
 
     const toggle = labelled(
-      parse(renderToStaticMarkup(<PlaybackSettings />)),
+      parse(renderToStaticMarkup(<Page />)),
       "Enable Hardware HDR Tone Mapping",
     );
 
@@ -324,7 +579,7 @@ describe("PlaybackSettings path defaults", () => {
   it("shows the effective default of each path field as its placeholder", () => {
     useSettingsFormMock.mockReturnValue(makeForm({ "playback.hw_accel": "none" }));
 
-    const container = parse(renderToStaticMarkup(<PlaybackSettings />));
+    const container = parse(renderToStaticMarkup(<Page />));
 
     expect(labelled(container, "Transcode directory")).toHaveAttribute(
       "placeholder",
@@ -342,7 +597,7 @@ describe("PlaybackSettings path defaults", () => {
       "playback.transcode_dir": "/mnt/fast/transcode",
     });
     useSettingsFormMock.mockReturnValue(form);
-    render(<PlaybackSettings />);
+    render(<Page />);
 
     fireEvent.click(screen.getByRole("button", RESET_TRANSCODE_DIR));
 
@@ -352,7 +607,7 @@ describe("PlaybackSettings path defaults", () => {
 });
 
 describe("PlaybackSettings chapter thumbnail execution", () => {
-  beforeEach(expandAdvanced);
+  beforeEach(expandPreviewImages);
 
   it("warns when no transcode node can take an extraction", () => {
     useAdminNodesMock.mockReturnValue({
@@ -361,15 +616,17 @@ describe("PlaybackSettings chapter thumbnail execution", () => {
     });
     useSettingsFormMock.mockReturnValue(makeForm({ "playback.hw_accel": "none" }));
 
-    const container = parse(renderToStaticMarkup(<PlaybackSettings />));
+    const container = parse(renderToStaticMarkup(<Page />));
 
-    expect(container.textContent).toContain("No transcode nodes are connected");
+    expect(groupNamed(container, "Preview images").textContent).toContain(
+      "No transcode nodes are connected",
+    );
   });
 
   it("stays quiet while a healthy transcode node is connected", () => {
     useSettingsFormMock.mockReturnValue(makeForm({ "playback.hw_accel": "none" }));
 
-    const container = parse(renderToStaticMarkup(<PlaybackSettings />));
+    const container = parse(renderToStaticMarkup(<Page />));
 
     expect(container.textContent).not.toContain("No transcode nodes are connected");
   });
@@ -378,22 +635,26 @@ describe("PlaybackSettings chapter thumbnail execution", () => {
     useAdminNodesMock.mockReturnValue({ data: undefined, isSuccess: false });
     useSettingsFormMock.mockReturnValue(makeForm({ "playback.hw_accel": "none" }));
 
-    const container = parse(renderToStaticMarkup(<PlaybackSettings />));
+    const container = parse(renderToStaticMarkup(<Page />));
 
     expect(container.textContent).not.toContain("No transcode nodes are connected");
   });
 });
 
 describe("PlaybackSettings seek-preview node capability", () => {
-  beforeEach(expandAdvanced);
+  beforeEach(expandPreviewImages);
 
   it.each([
     [{ capabilities: undefined }, true],
     [{ capabilities: { transport_features: ["chapter_extract_v1"] } }, true],
-    [{ capabilities: { transport_features: ["trickplay_extract_v1"] } }, false],
+    [{ capabilities: { transport_features: ["trickplay_extract_v1"] } }, true],
+    [
+      { capabilities: { transport_features: ["trickplay_extract_v1", "trickplay_extract_v2"] } },
+      false,
+    ],
     [
       {
-        capabilities: { transport_features: ["trickplay_extract_v1"] },
+        capabilities: { transport_features: ["trickplay_extract_v1", "trickplay_extract_v2"] },
         advertised_capabilities_hash: "",
         capabilities_hash: "snapshot",
       },
@@ -401,7 +662,7 @@ describe("PlaybackSettings seek-preview node capability", () => {
     ],
     [
       {
-        capabilities: { transport_features: ["trickplay_extract_v1"] },
+        capabilities: { transport_features: ["trickplay_extract_v1", "trickplay_extract_v2"] },
         advertised_capabilities_hash: "new-snapshot",
         capabilities_hash: "old-snapshot",
       },
@@ -409,14 +670,14 @@ describe("PlaybackSettings seek-preview node capability", () => {
     ],
     [
       {
-        capabilities: { transport_features: ["trickplay_extract_v1"] },
+        capabilities: { transport_features: ["trickplay_extract_v1", "trickplay_extract_v2"] },
         advertised_capabilities_hash: "snapshot",
       },
       true,
     ],
     [
       {
-        capabilities: { transport_features: ["trickplay_extract_v1"] },
+        capabilities: { transport_features: ["trickplay_extract_v1", "trickplay_extract_v2"] },
         advertised_capabilities_hash: "snapshot",
         capabilities_hash: "snapshot",
       },
@@ -425,7 +686,7 @@ describe("PlaybackSettings seek-preview node capability", () => {
   ])("gates node execution for node snapshot %o", async (overrides, disabled) => {
     useAdminNodesMock.mockReturnValue({ data: [transcodeNode(overrides)], isSuccess: true });
     useSettingsFormMock.mockReturnValue(makeForm({ "playback.trickplay_execution": "local" }));
-    render(<PlaybackSettings />);
+    render(<Page />);
     await userEvent.click(screen.getByRole("combobox", { name: "Generate seek previews on" }));
     const option = screen.getByRole("option", { name: "Transcode nodes only" });
     expect(option.getAttribute("aria-disabled") === "true").toBe(disabled);
@@ -438,7 +699,7 @@ describe("PlaybackSettings seek-preview node capability", () => {
     useAdminNodesMock.mockReturnValue({
       data: [
         transcodeNode({
-          capabilities: { transport_features: ["trickplay_extract_v1"] },
+          capabilities: { transport_features: ["trickplay_extract_v1", "trickplay_extract_v2"] },
           advertised_capabilities_hash: "new-snapshot",
           capabilities_hash: "old-snapshot",
         }),
@@ -446,7 +707,7 @@ describe("PlaybackSettings seek-preview node capability", () => {
       isSuccess: true,
     });
     useSettingsFormMock.mockReturnValue(makeForm({ "playback.trickplay_execution": mode }));
-    render(<PlaybackSettings />);
+    render(<Page />);
     await userEvent.click(screen.getByRole("combobox", { name: "Generate seek previews on" }));
     expect(screen.getByRole("option", { name: saved })).not.toHaveAttribute(
       "aria-disabled",
@@ -464,12 +725,102 @@ describe("HEVC encoding policy", () => {
   it("saves the HEVC switch through the playback settings form", () => {
     const form = makeForm({ "playback.hw_accel": "none", "playback.allow_hevc_encoding": "false" });
     useSettingsFormMock.mockReturnValue(form);
-    render(<PlaybackSettings />);
+    render(<Page />);
     fireEvent.click(screen.getByRole("switch", { name: "Allow HEVC encoding" }));
     expect(form.setValue).toHaveBeenCalledWith("playback.allow_hevc_encoding", "true");
   });
 });
 
+describe("PlaybackSettings skip markers", () => {
+  function markersGroup(values: Record<string, string>, dirty: string[] = []): HTMLElement {
+    useSettingsFormMock.mockReturnValue(
+      makeForm({ "playback.hw_accel": "none", ...values }, dirty),
+    );
+    return groupNamed(parse(renderToStaticMarkup(<Page />)), "Skip markers");
+  }
+
+  it("links to the marker providers", () => {
+    const link = markersGroup({}).querySelector("a[href='/admin/settings/providers']");
+    expect(link?.textContent).toBe("Marker providers");
+  });
+
+  it("shows the settings that apply to each marker source, without a disclosure", () => {
+    const cases: Array<[string, string[], string[]]> = [
+      [
+        "both",
+        [
+          "Detect intros",
+          "Detect credits",
+          "Save online markers",
+          "Find markers on playback",
+          "Detection workers",
+        ],
+        [],
+      ],
+      [
+        "local",
+        ["Detect intros", "Detect credits", "Find markers on playback", "Detection workers"],
+        ["Save online markers"],
+      ],
+      [
+        "online",
+        ["Save online markers", "Find markers on playback"],
+        ["Detect intros", "Detect credits", "Detection workers"],
+      ],
+      [
+        "off",
+        [],
+        [
+          "Detect intros",
+          "Detect credits",
+          "Save online markers",
+          "Find markers on playback",
+          "Detection workers",
+        ],
+      ],
+    ];
+    for (const [mode, shown, hidden] of cases) {
+      const group = markersGroup({ "markers.mode": mode });
+      expect(group.textContent).toContain("Marker source");
+      for (const label of shown) expect(group.textContent).toContain(label);
+      for (const label of hidden) expect(group.textContent).not.toContain(label);
+      expect(group.querySelector("button[aria-label^=Advanced]")).toBeNull();
+    }
+  });
+
+  it("leaves out playback lookups while online markers are fetched when needed", () => {
+    const group = markersGroup({ "markers.mode": "online", "markers.online_storage": "on_demand" });
+
+    expect(group.textContent).toContain("Save online markers");
+    expect(group.textContent).not.toContain("Find markers on playback");
+  });
+
+  it("hides the detection switches unless the server honors them", () => {
+    const cases: Array<{ data?: Record<string, boolean> }> = [
+      {},
+      { data: { redetect_markers: true } },
+      { data: { detection_kind_settings: false } },
+    ];
+    for (const capabilities of cases) {
+      markerCapabilitiesMock.mockReturnValue(capabilities);
+      const group = markersGroup({ "markers.mode": "local" });
+      expect(group.textContent).not.toContain("Detect intros");
+      expect(group.textContent).not.toContain("Detect credits");
+      expect(group.textContent).toContain("Detection workers");
+    }
+  });
+
+  it("shows each detection switch's saved state and defaults both on", () => {
+    const defaults = markersGroup({ "markers.mode": "both" });
+    expect(labelled(defaults, "Detect intros")).toHaveAttribute("aria-checked", "true");
+    expect(labelled(defaults, "Detect credits")).toHaveAttribute("aria-checked", "true");
+
+    const introsOnly = markersGroup({ "markers.mode": "local", "markers.detect_credits": "false" });
+    expect(labelled(introsOnly, "Detect intros")).toHaveAttribute("aria-checked", "true");
+    expect(labelled(introsOnly, "Detect credits")).toHaveAttribute("aria-checked", "false");
+  });
+});
+
 describe("seek preview settings", () => {
   const library = (ready: number, running = 0) => ({
     library_id: "1",
@@ -493,7 +844,7 @@ describe("seek preview settings", () => {
       data: [{ ...library(0), pending: 3, sheet_bytes: 1000 }],
       isSuccess: true,
     });
-    render(<PlaybackSettings />);
+    render(<Page />);
     await userEvent.click(screen.getByRole("button", { name: "Save" }));
     expect(form.save).not.toHaveBeenCalled();
     expect(screen.getByRole("alertdialog")).toBeTruthy();
@@ -504,8 +855,8 @@ describe("seek preview settings", () => {
     expect(form.dirtyCount).toBe(1);
   });
 
-  it("manages the four seek preview keys under advanced", () => {
-    expandAdvanced();
+  it("manages the four seek preview keys under Preview images", () => {
+    expandPreviewImages();
     useSettingsFormMock.mockReturnValue(
       makeForm({
         "playback.hw_accel": "none",
@@ -515,7 +866,7 @@ describe("seek preview settings", () => {
       }),
     );
 
-    render(<PlaybackSettings />);
+    render(<Page />);
     const keys: string[] = useSettingsFormMock.mock.calls[0]?.[0]?.keys ?? [];
 
     for (const key of [
@@ -526,10 +877,11 @@ describe("seek preview settings", () => {
     ]) {
       expect(keys).toContain(key);
     }
-    expect(screen.getByLabelText("Preview image width")).toHaveValue(300);
-    expect(screen.getByLabelText("Seek preview interval")).toHaveValue(10);
-    expect(screen.getByLabelText("Seek preview workers")).toHaveValue(2);
-    expect(screen.getByText("Generate seek previews on")).toBeTruthy();
+    const group = within(screen.getByRole("group", { name: "Preview images" }));
+    expect(group.getByLabelText("Preview image width")).toHaveValue(300);
+    expect(group.getByLabelText("Seek preview interval")).toHaveValue(10);
+    expect(group.getByLabelText("Seek preview workers")).toHaveValue(2);
+    expect(group.getByText("Generate seek previews on")).toBeTruthy();
   });
 
   it("asks before a new width remakes chapter thumbnails and published previews", async () => {
@@ -544,7 +896,7 @@ describe("seek preview settings", () => {
       isSuccess: true,
     });
 
-    render(<PlaybackSettings />);
+    render(<Page />);
     await userEvent.click(screen.getByRole("button", { name: "Save" }));
 
     expect(form.save).not.toHaveBeenCalled();
@@ -568,7 +920,7 @@ describe("seek preview settings", () => {
     useSettingsFormMock.mockReturnValue(form);
     useAdminTrickplayLibrariesMock.mockReturnValue({ data: [], isSuccess: true });
 
-    render(<PlaybackSettings />);
+    render(<Page />);
     await userEvent.click(screen.getByRole("button", { name: "Save" }));
 
     expect(form.save).not.toHaveBeenCalled();
@@ -605,7 +957,7 @@ describe("seek preview settings", () => {
     useSettingsFormMock.mockReturnValue(form);
     useAdminTrickplayLibrariesMock.mockReturnValue({ data: libraries, isSuccess: true });
 
-    render(<PlaybackSettings />);
+    render(<Page />);
     await userEvent.click(screen.getByRole("button", { name: "Save" }));
 
     expect(form.save).toHaveBeenCalledTimes(1);
@@ -614,13 +966,24 @@ describe("seek preview settings", () => {
 });
 
 it("hides unsupported seek preview settings and leaves their keys out", () => {
-  expandAdvanced();
+  expandPreviewImages();
   useLibraryCapabilitiesMock.mockReturnValue({ data: { trickplay: false } });
   useSettingsFormMock.mockReturnValue(makeForm({ "playback.hw_accel": "none" }));
-  render(<PlaybackSettings />);
+  render(<Page />);
   expect(screen.queryByLabelText("Seek preview interval")).toBeNull();
   expect(screen.queryByLabelText("Preview image width")).toBeNull();
   expect(useSettingsFormMock.mock.calls[0]?.[0]?.keys).not.toContain("playback.trickplay_workers");
+  // The chapter thumbnail half of the group stays, and the count follows it:
+  // the two HDR fields, with workers shown and placement outside beside a node.
+  const group = within(screen.getByRole("group", { name: "Preview images" }));
+  expect(group.getByRole("button", { name: "Advanced · 2 settings" })).toBeInTheDocument();
+  expect(group.getByText("Chapter thumbnail workers")).toBeInTheDocument();
+  expect(group.getByText("Generate chapter thumbnails on")).toBeInTheDocument();
+  expect(group.queryByText("Generate seek previews on")).toBeNull();
+  expect(group.queryByText("Seek preview workers")).toBeNull();
+  expect(
+    group.getByText("Chapter thumbnails are turned on for each library in Libraries."),
+  ).toBeTruthy();
 });
 
 it("asks before changing the interval when preview status is unavailable", async () => {
@@ -631,7 +994,7 @@ it("asks before changing the interval when preview status is unavailable", async
     { "playback.trickplay_interval_seconds": "10" },
   );
   useSettingsFormMock.mockReturnValue(form);
-  render(<PlaybackSettings />);
+  render(<Page />);
   await userEvent.click(screen.getByRole("button", { name: "Save" }));
   expect(form.save).not.toHaveBeenCalled();
   expect(screen.getByRole("alertdialog")).toHaveTextContent(
@@ -645,7 +1008,7 @@ it("renders the settings save bar for a dirty form", () => {
   useSettingsFormMock.mockReturnValue(
     makeForm({ "playback.hw_accel": "none" }, ["playback.hw_accel", "playback.ffmpeg_path"]),
   );
-  render(<PlaybackSettings />);
+  render(<Page />);
 
   const pill = screen.getByText("2 unsaved changes").closest("[role=status]");
   const scrim = pill?.previousElementSibling;
diff --git a/web/src/pages/admin-settings/PlaybackSettings.tsx b/web/src/pages/admin-settings/PlaybackSettings.tsx
index 37d8759c12..ad609bc9b2 100644
--- a/web/src/pages/admin-settings/PlaybackSettings.tsx
+++ b/web/src/pages/admin-settings/PlaybackSettings.tsx
@@ -1,10 +1,12 @@
 import { useMemo, useState } from "react";
+import { ArrowRight } from "lucide-react";
 import { Link } from "react-router";
 import { useSettingsForm } from "@/hooks/useSettingsForm";
 import { useRestartKeys } from "@/hooks/useRestartKeys";
 import { useHWAccelDetection } from "@/hooks/queries/admin/system";
 import { useAdminNodes } from "@/hooks/queries/admin/nodes";
 import { useLibraryCapabilities } from "@/hooks/queries/admin/libraries";
+import { useAdminMarkerCapabilities } from "@/hooks/queries/admin/markers";
 import { useAdminTrickplayLibraries } from "@/hooks/queries/admin/trickplay";
 import {
   AlertDialog,
@@ -17,7 +19,6 @@ import {
   AlertDialogTitle,
 } from "@/components/ui/alert-dialog";
 import { Switch } from "@/components/ui/switch";
-import { Button } from "@/components/ui/button";
 import { AdvancedSection } from "@/components/settings/AdvancedSection";
 import { PathSettingField } from "@/components/settings/PathSettingField";
 import { SettingsPageHeader } from "@/components/settings/SettingsPageHeader";
@@ -25,6 +26,7 @@ import { SettingsSubheading } from "@/components/settings/SettingsSubheading";
 import { SettingField, SettingFieldRow, SettingFieldStatus } from "./SettingField";
 import { SaveBar } from "@/components/SaveBar";
 import { FieldGroup } from "./FieldGroup";
+import { MarkerTasksCard } from "./MarkerTasksCard";
 import { DEFAULT_FFMPEG_PATH, DEFAULT_TRANSCODE_DIR } from "./settingsPathDefaults";
 import {
   IMAGE_EXECUTION_DEFAULT,
@@ -39,32 +41,55 @@ import {
   toggleHWDevice,
 } from "./playbackSettings.utils";
 
-// Shown without a disclosure: the handful of controls a household admin
-// actually touches.
+// Shown without a disclosure: the controls a household admin actually
+// touches, including the HDR tone mapping switches, throttling and where
+// segments are written.
 const TRANSCODING_ESSENTIAL_KEYS = [
   "playback.transcode_enabled",
-  "playback.allow_hevc_encoding",
   "playback.hw_accel",
   "allow_4k_transcode",
+  "playback.allow_hevc_encoding",
+  "playback.transcode_hardware_tone_map_enabled",
+  "playback.transcode_software_tone_map_enabled",
+  "enable_transcode_throttle",
+  "transcode_throttle_seconds",
+  "playback.transcode_dir",
 ];
 
 const TRANSCODING_ADVANCED_KEYS = [
   "playback.ffmpeg_path",
-  "playback.transcode_dir",
-  "playback.segment_retention_seconds",
   "playback.hw_device",
-  "playback.transcode_hardware_tone_map_enabled",
-  "playback.transcode_software_tone_map_enabled",
-  "enable_transcode_throttle",
-  "transcode_throttle_seconds",
+  "playback.segment_retention_seconds",
+  "playback.copy_keyframe_playlist",
+];
+
+// Chapter thumbnails and seek previews are images cut from the video, not part
+// of a transcode, so they get their own group. Width, interval and the chapter
+// thumbnail worker count show without a disclosure.
+const PREVIEW_SHOWN_KEYS = [
+  "playback.preview_image_width",
+  "playback.trickplay_interval_seconds",
   "playback.chapter_thumbnail_workers",
+];
+
+// Where the images are made is only a real choice once a transcode node could
+// take the work, so these sit beside width and interval then and in Advanced
+// otherwise.
+const PREVIEW_PLACEMENT_KEYS = [
   "playback.chapter_thumbnail_execution",
+  "playback.trickplay_execution",
+];
+
+const PREVIEW_ADVANCED_KEYS = [
+  "playback.trickplay_workers",
   "playback.chapter_thumbnail_hdr_policy",
   "playback.chapter_thumbnail_software_tone_map_enabled",
-  "playback.preview_image_width",
-  "playback.trickplay_interval_seconds",
-  "playback.trickplay_workers",
-  "playback.trickplay_execution",
+];
+
+const PREVIEW_IMAGE_KEYS = [
+  ...PREVIEW_SHOWN_KEYS,
+  ...PREVIEW_PLACEMENT_KEYS,
+  ...PREVIEW_ADVANCED_KEYS,
 ];
 
 // A new preview image width makes every chapter thumbnail and seek preview
@@ -91,148 +116,17 @@ function remakeDescription(widthChanged: boolean, previews: number | null): stri
   return `${what} made again ${how}. This runs in the background and can take a long time on a large library; players keep the current images until each is replaced.`;
 }
 
-const executionOptions = [
-  { value: "prefer_worker", label: "Prefer any worker" },
-  { value: "prefer_transcode", label: "Prefer transcode node" },
-  { value: "worker_only", label: "Any worker only" },
-  { value: "prefer_api", label: "Prefer API server" },
-  { value: "api_only", label: "API server only" },
-];
-
-const egressOptions = [
-  { value: "prefer_proxy", label: "Prefer proxy" },
-  { value: "proxy_only", label: "Proxy only" },
-  { value: "prefer_api", label: "Prefer API server" },
-  { value: "api_only", label: "API server only" },
-];
-
-type ExecutionWorkload = "remux" | "video_transcode";
-
-function executionPreview(value: string, workload: ExecutionWorkload) {
-  const worker = workload === "remux" ? "Any worker" : "Transcode node";
-  switch (value) {
-    case "prefer_transcode":
-      return workload === "remux" ? "Transcode node → any worker → API" : "Transcode node → API";
-    case "worker_only":
-      return `${worker} only`;
-    case "prefer_api":
-      return `API → ${worker.toLowerCase()}`;
-    case "api_only":
-      return "API only";
-    default:
-      return `${worker} → API`;
-  }
-}
-
-function egressPreview(value: string) {
-  switch (value) {
-    case "proxy_only":
-      return "Proxy only";
-    case "prefer_api":
-      return "API → proxy";
-    case "api_only":
-      return "API only";
-    default:
-      return "Proxy → API";
-  }
-}
-
-/** The whole path for a workload that needs an executor, e.g. "Worker → API · Proxy → API". */
-function routePreview(execution: string, egress: string, workload: ExecutionWorkload) {
-  return `${executionPreview(execution, workload)} · ${egressPreview(egress)}`;
-}
-
-// A routing policy either picks who runs the work (execution) or who serves the
-// bytes (egress). The kind decides the choices offered and the value the server
-// applies while the row has never been set.
-const ROUTING_KINDS = {
-  execution: { options: executionOptions, serverDefault: "prefer_transcode" },
-  egress: { options: egressOptions, serverDefault: "prefer_proxy" },
-};
-
-type RoutingKind = keyof typeof ROUTING_KINDS;
-
-const ROUTING_KEYS = [
-  "playback.routing.direct_play_egress",
-  "playback.routing.remux_execution",
-  "playback.routing.remux_egress",
-  "playback.routing.video_transcode_execution",
-  "playback.routing.video_transcode_egress",
-] as const;
-
-type RoutingKey = (typeof ROUTING_KEYS)[number];
-
-interface RoutingField {
-  key: RoutingKey;
-  label: string;
-  kind: RoutingKind;
-  description?: string;
-}
+const WATCH_KEYS = ["playback.watched_threshold", "playback.min_resume_threshold"];
 
-// One row per key in ROUTING_KEYS, in the order they render.
-const ROUTING_FIELDS: readonly RoutingField[] = [
-  {
-    key: "playback.routing.direct_play_egress",
-    label: "Direct play egress",
-    kind: "egress",
-    description: "Original bytes need no executor.",
-  },
-  {
-    key: "playback.routing.remux_execution",
-    label: "Remux execution",
-    kind: "execution",
-    description:
-      "A worker can be a proxy or transcode node. Prefer transcode node runs HLS or progressive remux there when supported; progressive output is relayed through the selected proxy.",
-  },
-  { key: "playback.routing.remux_egress", label: "Remux egress", kind: "egress" },
-  {
-    key: "playback.routing.video_transcode_execution",
-    label: "Video transcode execution",
-    kind: "execution",
-    description: "Video transcode workers are transcode nodes; proxy nodes only provide egress.",
-  },
-  {
-    key: "playback.routing.video_transcode_egress",
-    label: "Video transcode egress",
-    kind: "egress",
-  },
+const MARKER_KEYS = [
+  "markers.mode",
+  "markers.detect_intros",
+  "markers.detect_credits",
+  "markers.online_storage",
+  "markers.lazy_playback",
+  "markers.detection_workers",
 ];
 
-const ROUTING_PRESETS = {
-  standard: {
-    label: "Prairie Defaults",
-    values: {
-      "playback.routing.direct_play_egress": "prefer_proxy",
-      "playback.routing.remux_execution": "prefer_transcode",
-      "playback.routing.remux_egress": "prefer_proxy",
-      "playback.routing.video_transcode_execution": "prefer_transcode",
-      "playback.routing.video_transcode_egress": "prefer_proxy",
-    },
-  },
-  gpu: {
-    label: "GPU offload",
-    values: {
-      "playback.routing.direct_play_egress": "prefer_api",
-      "playback.routing.remux_execution": "prefer_api",
-      "playback.routing.remux_egress": "prefer_api",
-      "playback.routing.video_transcode_execution": "prefer_worker",
-      "playback.routing.video_transcode_egress": "prefer_proxy",
-    },
-  },
-  central: {
-    label: "Central egress",
-    values: {
-      "playback.routing.direct_play_egress": "api_only",
-      "playback.routing.remux_execution": "prefer_worker",
-      "playback.routing.remux_egress": "api_only",
-      "playback.routing.video_transcode_execution": "prefer_worker",
-      "playback.routing.video_transcode_egress": "api_only",
-    },
-  },
-} as const;
-
-const WATCH_KEYS = ["playback.watched_threshold", "playback.min_resume_threshold"];
-
 // `playback.chapter_thumbnail_node_capacity` is deliberately absent from the
 // UI (hidden tier): it is still saved and read through the settings API, but
 // the per-node budget is derived from the node pool rather than typed in.
@@ -240,22 +134,13 @@ const WATCH_KEYS = ["playback.watched_threshold", "playback.min_resume_threshold
 // The `download.*` family is its own page (DownloadsSettings), so it is not
 // loaded or saved here.
 const KEYS = [
+  ...WATCH_KEYS,
   ...TRANSCODING_ESSENTIAL_KEYS,
   ...TRANSCODING_ADVANCED_KEYS,
-  ...ROUTING_KEYS,
-  ...WATCH_KEYS,
+  ...PREVIEW_IMAGE_KEYS,
+  ...MARKER_KEYS,
 ];
 
-/** One line of the preferred-path summary: workload on the left, route on the right. */
-function PreferredPathRow({ label, route }: { label: string; route: string }) {
-  return (
-    <div className="flex justify-between gap-5">
-      <span className="text-muted-foreground">{label}</span>
-      <span className="font-medium">{route}</span>
-    </div>
-  );
-}
-
 export default function PlaybackSettings() {
   const supportsTrickplay = useLibraryCapabilities().data?.trickplay === true;
   const keys = useMemo(
@@ -314,37 +199,34 @@ export default function PlaybackSettings() {
   // reachable rather than blocking a valid choice on a transient error.
   const transcodeNodeAvailable = !nodes.isSuccess || hasUsableTranscodeNode(nodes.data);
   const trickplayNodeAvailable = !nodes.isSuccess || hasUsableTrickplayNode(nodes.data);
-  const proxyNodeAvailable =
-    !nodes.isSuccess ||
-    (nodes.data ?? []).some((node) => node.type === "proxy" && node.enabled && node.healthy);
-
-  const routingValues = Object.fromEntries(
-    ROUTING_KEYS.map((key) => [key, form.getValue(key)]),
-  ) as Record<RoutingKey, string>;
-  const activeRoutingPreset = Object.values(ROUTING_PRESETS).find((preset) =>
-    ROUTING_KEYS.every((key) => routingValues[key] === preset.values[key]),
-  );
-  const applyRoutingPreset = (values: Record<RoutingKey, string>) => {
-    for (const key of ROUTING_KEYS) form.setValue(key, values[key]);
-  };
-
-  const usesProxyOnlyEgress = ROUTING_KEYS.some((key) => routingValues[key] === "proxy_only");
-  // A remux can run on a proxy node (progressive) or a transcode node (HLS), so
-  // worker-only remuxing is only stranded when neither kind is available. Both
-  // availability flags read as available until the node list has loaded, which
-  // keeps the warning quiet on a transient error.
-  const strandedRoute =
-    (usesProxyOnlyEgress && !proxyNodeAvailable) ||
-    (routingValues["playback.routing.remux_execution"] === "worker_only" &&
-      !proxyNodeAvailable &&
-      !transcodeNodeAvailable) ||
-    (routingValues["playback.routing.video_transcode_execution"] === "worker_only" &&
-      !transcodeNodeAvailable);
+  // Showing the placement selects takes a node list that has one, so a
+  // single-server page never shows them while the list loads.
+  const showPreviewPlacement = hasUsableTranscodeNode(nodes.data);
+  const previewAdvancedKeys = [
+    ...PREVIEW_ADVANCED_KEYS,
+    ...(showPreviewPlacement ? [] : PREVIEW_PLACEMENT_KEYS),
+  ].filter((key) => keys.includes(key));
 
   const isDirty = form.isDirty;
   const anyDirty = (keys: readonly string[]) => keys.some((key) => isDirty(key));
   const allRestart = (keys: readonly string[]) => keys.every((key) => restartKeys.has(key));
 
+  const throttleOn = form.getValue("enable_transcode_throttle") === "true";
+  // Every advanced transcoding key has one row, except the device picker,
+  // which renders only when it applies.
+  const transcodingAdvancedCount = TRANSCODING_ADVANCED_KEYS.length - (showDevicePicker ? 0 : 1);
+
+  // An older API node saves the detection kind switches but ignores them, so
+  // they are offered only where the server says it honors them.
+  const { data: markerCapabilities } = useAdminMarkerCapabilities();
+  const detectionKindSettings = markerCapabilities?.detection_kind_settings === true;
+  const markerMode = form.getValue("markers.mode") || "both";
+  const onlineMarkersEnabled = markerMode === "online" || markerMode === "both";
+  const onlineMarkerStorage = form.getValue("markers.online_storage") || "stored";
+  const localMarkersEnabled = markerMode === "local" || markerMode === "both";
+  const showLazyPlayback =
+    markerMode !== "off" && (!onlineMarkersEnabled || onlineMarkerStorage === "stored");
+
   const detection = hwAccel === "none" ? undefined : hwDetection.data;
   const detectedLabel = describeDetection(detection);
 
@@ -378,13 +260,66 @@ export default function PlaybackSettings() {
       <span className="flex flex-col items-start gap-1">{hwAccelLines}</span>
     ) : undefined;
 
+  const chapterExecutionField = (
+    <SettingField
+      label="Generate chapter thumbnails on"
+      type="select"
+      options={imageExecutionOptions(chapterExecution, transcodeNodeAvailable)}
+      status={
+        transcodeNodeAvailable ? undefined : (
+          <SettingFieldStatus tone="warn">No transcode nodes are connected</SettingFieldStatus>
+        )
+      }
+      value={chapterExecution}
+      onChange={(v) => form.setValue("playback.chapter_thumbnail_execution", v)}
+      restartRequired={restartKeys.has("playback.chapter_thumbnail_execution")}
+    />
+  );
+  const trickplayExecutionField = supportsTrickplay ? (
+    <SettingField
+      label="Generate seek previews on"
+      type="select"
+      options={imageExecutionOptions(trickplayExecution, trickplayNodeAvailable)}
+      status={
+        trickplayNodeAvailable ? undefined : (
+          <SettingFieldStatus tone="warn">
+            No connected transcode node supports seek previews
+          </SettingFieldStatus>
+        )
+      }
+      value={trickplayExecution}
+      onChange={(v) => form.setValue("playback.trickplay_execution", v)}
+      restartRequired={restartKeys.has("playback.trickplay_execution")}
+    />
+  ) : null;
+
   if (form.isLoading) return <div>Loading...</div>;
 
   return (
     <div className="flex h-full flex-col">
-      <SettingsPageHeader title="Playback" className="mb-8" />
+      <SettingsPageHeader title="Playback" />
 
       <div className="flex-1 space-y-5">
+        <FieldGroup label="Watch behavior" restartAll={allRestart(WATCH_KEYS)}>
+          <SettingField
+            label="Mark watched at"
+            type="number"
+            unit="%"
+            value={form.getValue("playback.watched_threshold")}
+            onChange={(v) => form.setValue("playback.watched_threshold", v)}
+            restartRequired={restartKeys.has("playback.watched_threshold")}
+          />
+          <SettingField
+            label="Show in Continue Watching after"
+            type="number"
+            unit="%"
+            description="Progress below this is ignored."
+            value={form.getValue("playback.min_resume_threshold")}
+            onChange={(v) => form.setValue("playback.min_resume_threshold", v)}
+            restartRequired={restartKeys.has("playback.min_resume_threshold")}
+          />
+        </FieldGroup>
+
         <FieldGroup
           label="Transcoding"
           restartAll={allRestart([...TRANSCODING_ESSENTIAL_KEYS, ...TRANSCODING_ADVANCED_KEYS])}
@@ -407,6 +342,14 @@ export default function PlaybackSettings() {
             onChange={(v) => form.setValue("playback.hw_accel", v)}
             restartRequired={restartKeys.has("playback.hw_accel")}
           />
+          <SettingField
+            label="Allow 4K transcoding"
+            type="toggle"
+            description="Heavy load on most hardware."
+            value={form.getValue("allow_4k_transcode")}
+            onChange={(v) => form.setValue("allow_4k_transcode", v)}
+            restartRequired={restartKeys.has("allow_4k_transcode")}
+          />
           <SettingField
             label="Allow HEVC encoding"
             type="toggle"
@@ -415,39 +358,61 @@ export default function PlaybackSettings() {
             onChange={(v) => form.setValue("playback.allow_hevc_encoding", v)}
           />
           <SettingField
-            label="Allow 4K transcoding"
+            label="Enable Hardware HDR Tone Mapping"
             type="toggle"
-            description="Heavy load on most hardware."
-            value={form.getValue("allow_4k_transcode")}
-            onChange={(v) => form.setValue("allow_4k_transcode", v)}
-            restartRequired={restartKeys.has("allow_4k_transcode")}
+            hint="Allows validated local or remote GPU executors to convert HDR video to SDR when transcoding."
+            value={form.getValue("playback.transcode_hardware_tone_map_enabled")}
+            onChange={(v) => form.setValue("playback.transcode_hardware_tone_map_enabled", v)}
+            restartRequired={restartKeys.has("playback.transcode_hardware_tone_map_enabled")}
+          />
+          <SettingField
+            label="Enable Software HDR Tone Mapping"
+            type="toggle"
+            hint="Allows the CPU to convert HDR video to SDR when transcoding. This can be very CPU-intensive."
+            value={form.getValue("playback.transcode_software_tone_map_enabled")}
+            onChange={(v) => form.setValue("playback.transcode_software_tone_map_enabled", v)}
+            restartRequired={restartKeys.has("playback.transcode_software_tone_map_enabled")}
+          />
+          <SettingField
+            label="Throttle transcoding"
+            type="toggle"
+            description="Pause encoding once the client is far enough ahead."
+            value={form.getValue("enable_transcode_throttle")}
+            onChange={(v) => form.setValue("enable_transcode_throttle", v)}
+            restartRequired={restartKeys.has("enable_transcode_throttle")}
+          />
+          {throttleOn && (
+            <SettingField
+              label="Buffer ahead"
+              type="number"
+              unit="seconds"
+              value={form.getValue("transcode_throttle_seconds")}
+              onChange={(v) => form.setValue("transcode_throttle_seconds", v)}
+              restartRequired={restartKeys.has("transcode_throttle_seconds")}
+            />
+          )}
+          <PathSettingField
+            label="Transcode directory"
+            defaultValue={DEFAULT_TRANSCODE_DIR}
+            description={`Use fast local storage with room to spare. Leave blank to use ${DEFAULT_TRANSCODE_DIR}.`}
+            value={form.getValue("playback.transcode_dir")}
+            onChange={(v) => form.setValue("playback.transcode_dir", v)}
+            restartRequired={restartKeys.has("playback.transcode_dir")}
           />
 
           <AdvancedSection
             id="playback.transcoding"
-            count={
-              TRANSCODING_ADVANCED_KEYS.length -
-              (showDevicePicker ? 0 : 1) -
-              (supportsTrickplay ? 0 : 4)
-            }
+            count={transcodingAdvancedCount}
             forceOpen={anyDirty(TRANSCODING_ADVANCED_KEYS)}
           >
             <PathSettingField
               label="FFmpeg path"
               defaultValue={DEFAULT_FFMPEG_PATH}
-              description={`Leave blank to use the FFmpeg that ships with the server, at ${DEFAULT_FFMPEG_PATH}.`}
+              description={`Leave blank to use jellyfin-ffmpeg at ${DEFAULT_FFMPEG_PATH} when it is installed, then ffmpeg on PATH. macOS tries Homebrew's ffmpeg-full first.`}
               value={form.getValue("playback.ffmpeg_path")}
               onChange={(v) => form.setValue("playback.ffmpeg_path", v)}
               restartRequired={restartKeys.has("playback.ffmpeg_path")}
             />
-            <PathSettingField
-              label="Transcode directory"
-              defaultValue={DEFAULT_TRANSCODE_DIR}
-              description={`Use fast local storage with room to spare. Leave blank to use ${DEFAULT_TRANSCODE_DIR}.`}
-              value={form.getValue("playback.transcode_dir")}
-              onChange={(v) => form.setValue("playback.transcode_dir", v)}
-              restartRequired={restartKeys.has("playback.transcode_dir")}
-            />
             {showDevicePicker && (
               <div>
                 <SettingsSubheading
@@ -514,40 +479,6 @@ export default function PlaybackSettings() {
                 ))}
               </div>
             )}
-            <SettingField
-              label="Enable Hardware HDR Tone Mapping"
-              type="toggle"
-              hint="Allows validated local or remote GPU executors to convert HDR video to SDR when transcoding."
-              value={form.getValue("playback.transcode_hardware_tone_map_enabled")}
-              onChange={(v) => form.setValue("playback.transcode_hardware_tone_map_enabled", v)}
-              restartRequired={restartKeys.has("playback.transcode_hardware_tone_map_enabled")}
-            />
-            <SettingField
-              label="Enable Software HDR Tone Mapping"
-              type="toggle"
-              hint="Allows the CPU to convert HDR video to SDR when transcoding. This can be very CPU-intensive."
-              value={form.getValue("playback.transcode_software_tone_map_enabled")}
-              onChange={(v) => form.setValue("playback.transcode_software_tone_map_enabled", v)}
-              restartRequired={restartKeys.has("playback.transcode_software_tone_map_enabled")}
-            />
-            <SettingField
-              label="Throttle transcoding"
-              type="toggle"
-              description="Pause encoding once the client is far enough ahead."
-              value={form.getValue("enable_transcode_throttle")}
-              onChange={(v) => form.setValue("enable_transcode_throttle", v)}
-              restartRequired={restartKeys.has("enable_transcode_throttle")}
-            />
-            {form.getValue("enable_transcode_throttle") === "true" && (
-              <SettingField
-                label="Buffer ahead"
-                type="number"
-                unit="seconds"
-                value={form.getValue("transcode_throttle_seconds")}
-                onChange={(v) => form.setValue("transcode_throttle_seconds", v)}
-                restartRequired={restartKeys.has("transcode_throttle_seconds")}
-              />
-            )}
             <SettingField
               label="Transcode back buffer"
               type="number"
@@ -558,28 +489,104 @@ export default function PlaybackSettings() {
               restartRequired={restartKeys.has("playback.segment_retention_seconds")}
             />
             <SettingField
-              label="Chapter thumbnail workers"
-              type="number"
-              description="How many files Prairie extracts chapter thumbnails from at once. One more worker takes only titles that are playing, so they aren't stuck behind the queue."
-              value={form.getValue("playback.chapter_thumbnail_workers")}
-              onChange={(v) => form.setValue("playback.chapter_thumbnail_workers", v)}
-              restartRequired={restartKeys.has("playback.chapter_thumbnail_workers")}
-            />
-            <SettingField
-              label="Generate chapter thumbnails on"
-              type="select"
-              options={imageExecutionOptions(chapterExecution, transcodeNodeAvailable)}
-              status={
-                transcodeNodeAvailable ? undefined : (
-                  <SettingFieldStatus tone="warn">
-                    No transcode nodes are connected
-                  </SettingFieldStatus>
-                )
-              }
-              value={chapterExecution}
-              onChange={(v) => form.setValue("playback.chapter_thumbnail_execution", v)}
-              restartRequired={restartKeys.has("playback.chapter_thumbnail_execution")}
+              label="Complete playlists for copied video"
+              type="toggle"
+              description="Experimental. When Prairie copies a file's video, list every segment from the start, using the file's keyframes, instead of a playlist that grows as Prairie copies. Stops Safari freezing partway through. A seek ahead of what Prairie has copied waits for it to get there."
+              value={form.getValue("playback.copy_keyframe_playlist") || "false"}
+              onChange={(v) => form.setValue("playback.copy_keyframe_playlist", v)}
+              restartRequired={restartKeys.has("playback.copy_keyframe_playlist")}
             />
+          </AdvancedSection>
+        </FieldGroup>
+
+        <FieldGroup
+          label="Preview images"
+          description={
+            supportsTrickplay
+              ? "Chapter thumbnails and seek previews are turned on for each library in Libraries."
+              : "Chapter thumbnails are turned on for each library in Libraries."
+          }
+          restartAll={allRestart(PREVIEW_IMAGE_KEYS)}
+          // FieldGroup descriptions are plain text, so the link sits on the
+          // heading line, as Skip markers links to its providers.
+          actions={
+            <Link
+              to="/admin/libraries"
+              className="text-muted-foreground hover:text-foreground inline-flex items-center gap-1.5 text-xs font-medium transition-colors"
+            >
+              Libraries
+              <ArrowRight className="h-3 w-3" aria-hidden="true" />
+            </Link>
+          }
+        >
+          {supportsTrickplay && (
+            <>
+              <SettingField
+                label="Preview image width"
+                type="number"
+                unit="px"
+                description="Width of chapter thumbnails and of the thumbnails players show while seeking, 160 to 640. Changing it makes them all again; players keep the current ones until each is replaced."
+                value={form.getValue("playback.preview_image_width")}
+                onChange={(v) => form.setValue("playback.preview_image_width", v)}
+                restartRequired={restartKeys.has("playback.preview_image_width")}
+              />
+              <SettingField
+                label="Seek preview interval"
+                type="number"
+                unit="seconds"
+                description="Time between seek previews, 5 to 60. Changing it makes every library's previews again."
+                value={form.getValue("playback.trickplay_interval_seconds")}
+                onChange={(v) => form.setValue("playback.trickplay_interval_seconds", v)}
+                restartRequired={restartKeys.has("playback.trickplay_interval_seconds")}
+              />
+            </>
+          )}
+          <SettingField
+            label="Chapter thumbnail workers"
+            type="number"
+            description="How many files Prairie extracts chapter thumbnails from at once. One more worker takes only titles that are playing, so they aren't stuck behind the queue."
+            value={form.getValue("playback.chapter_thumbnail_workers")}
+            onChange={(v) => form.setValue("playback.chapter_thumbnail_workers", v)}
+            restartRequired={restartKeys.has("playback.chapter_thumbnail_workers")}
+          />
+          {showPreviewPlacement && (
+            <>
+              {chapterExecutionField}
+              {trickplayExecutionField}
+            </>
+          )}
+
+          <AdvancedSection
+            id="playback.preview_images"
+            count={previewAdvancedKeys.length}
+            forceOpen={
+              anyDirty(previewAdvancedKeys) ||
+              // Node-only extraction with no node to run on is stranded work;
+              // its warning must not sit inside a closed disclosure.
+              (!transcodeNodeAvailable && chapterExecution === "transcode_nodes_only") ||
+              (!trickplayNodeAvailable && trickplayExecution === "transcode_nodes_only")
+            }
+          >
+            {!showPreviewPlacement && chapterExecutionField}
+            {supportsTrickplay && (
+              <SettingField
+                label="Seek preview workers"
+                type="number"
+                description="How many files each server makes seek previews for at once. They run at low priority, so playback comes first."
+                value={form.getValue("playback.trickplay_workers")}
+                onChange={(v) => form.setValue("playback.trickplay_workers", v)}
+                restartRequired={restartKeys.has("playback.trickplay_workers")}
+              />
+            )}
+            {!showPreviewPlacement && trickplayExecutionField}
+            {/* internal/trickplay tone-maps every HDR seek preview, in
+                software when it has to; these two settings are read only by
+                chapter thumbnail extraction. */}
+            <SettingsSubheading
+              caption={supportsTrickplay ? "Seek previews always convert HDR to SDR." : undefined}
+            >
+              HDR chapter thumbnails
+            </SettingsSubheading>
             <SettingField
               label="HDR handling"
               type="select"
@@ -605,150 +612,118 @@ export default function PlaybackSettings() {
                 "playback.chapter_thumbnail_software_tone_map_enabled",
               )}
             />
-            {supportsTrickplay && (
-              <>
-                <SettingField
-                  label="Preview image width"
-                  type="number"
-                  unit="px"
-                  description="Width of chapter thumbnails and of the thumbnails players show while seeking, 160 to 640. Changing it makes them all again; players keep the current ones until each is replaced."
-                  value={form.getValue("playback.preview_image_width")}
-                  onChange={(v) => form.setValue("playback.preview_image_width", v)}
-                  restartRequired={restartKeys.has("playback.preview_image_width")}
-                />
-                <SettingField
-                  label="Seek preview interval"
-                  type="number"
-                  unit="seconds"
-                  description="Time between seek previews, 5 to 60. Changing it makes every library's previews again."
-                  value={form.getValue("playback.trickplay_interval_seconds")}
-                  onChange={(v) => form.setValue("playback.trickplay_interval_seconds", v)}
-                  restartRequired={restartKeys.has("playback.trickplay_interval_seconds")}
-                />
-                <SettingField
-                  label="Seek preview workers"
-                  type="number"
-                  description="How many files each server makes seek previews for at once. They run at low priority, so playback comes first."
-                  value={form.getValue("playback.trickplay_workers")}
-                  onChange={(v) => form.setValue("playback.trickplay_workers", v)}
-                  restartRequired={restartKeys.has("playback.trickplay_workers")}
-                />
-                <SettingField
-                  label="Generate seek previews on"
-                  type="select"
-                  options={imageExecutionOptions(trickplayExecution, trickplayNodeAvailable)}
-                  status={
-                    trickplayNodeAvailable ? undefined : (
-                      <SettingFieldStatus tone="warn">
-                        No connected transcode node supports seek previews
-                      </SettingFieldStatus>
-                    )
-                  }
-                  value={trickplayExecution}
-                  onChange={(v) => form.setValue("playback.trickplay_execution", v)}
-                  restartRequired={restartKeys.has("playback.trickplay_execution")}
-                />
-              </>
-            )}
           </AdvancedSection>
         </FieldGroup>
 
-        <FieldGroup label="Node routing" restartAll={allRestart(ROUTING_KEYS)}>
-          <SettingFieldRow
-            label="Routing preset"
-            description="Presets update the five primitive policies below; Custom is not stored."
-          >
-            <div className="flex flex-wrap justify-end gap-2">
-              {Object.entries(ROUTING_PRESETS).map(([id, preset]) => (
-                <Button
-                  key={id}
-                  type="button"
-                  size="sm"
-                  variant={activeRoutingPreset === preset ? "default" : "outline"}
-                  onClick={() => applyRoutingPreset(preset.values)}
-                >
-                  {preset.label}
-                </Button>
-              ))}
-              {!activeRoutingPreset && (
-                <span className="text-muted-foreground self-center text-xs">Custom</span>
-              )}
-            </div>
-          </SettingFieldRow>
+        {/*
+          Detection behavior lives here; which online providers answer a lookup,
+          and on what terms, is provider configuration and lives with the other
+          providers.
+        */}
+        <FieldGroup
+          label="Skip markers"
+          description="Markers identify intros, credits, recaps, and previews so players can offer skip controls."
+          restartAll={allRestart(MARKER_KEYS)}
+          actions={
+            <Link
+              to="/admin/settings/providers"
+              className="text-muted-foreground hover:text-foreground inline-flex items-center gap-1.5 text-xs font-medium transition-colors"
+            >
+              Marker providers
+              <ArrowRight className="h-3 w-3" aria-hidden="true" />
+            </Link>
+          }
+        >
+          <SettingField
+            label="Marker source"
+            type="select"
+            description="Online markers take priority. Prairie skips local detection of an intro or credits when an online one is saved in your library. Local detection uses CPU."
+            className="[&_[data-slot=select-trigger]]:h-auto [&_[data-slot=select-trigger]]:min-h-9 [&_[data-slot=select-value]]:line-clamp-none [&_[data-slot=select-value]]:text-left [&_[data-slot=select-value]]:whitespace-normal"
+            options={[
+              { value: "off", label: "Off" },
+              { value: "local", label: "Detect on this server" },
+              { value: "both", label: "Online preferred + server detection" },
+              { value: "online", label: "Online providers only" },
+            ]}
+            value={markerMode}
+            onChange={(value) => form.setValue("markers.mode", value)}
+            restartRequired={restartKeys.has("markers.mode")}
+          />
+
+          {localMarkersEnabled && detectionKindSettings && (
+            <>
+              <SettingField
+                label="Detect intros"
+                type="toggle"
+                description="Finds each episode's opening from embedded chapters, or by comparing the start of episodes in a season."
+                value={form.getValue("markers.detect_intros") || "true"}
+                onChange={(value) => form.setValue("markers.detect_intros", value)}
+                restartRequired={restartKeys.has("markers.detect_intros")}
+              />
+              <SettingField
+                label="Detect credits"
+                type="toggle"
+                description="Finds end credits from embedded chapters, or by reading the end of each episode and movie. Uses more CPU than intro detection."
+                value={form.getValue("markers.detect_credits") || "true"}
+                onChange={(value) => form.setValue("markers.detect_credits", value)}
+                restartRequired={restartKeys.has("markers.detect_credits")}
+              />
+            </>
+          )}
 
-          {ROUTING_FIELDS.map((field) => (
+          {onlineMarkersEnabled && (
             <SettingField
-              key={field.key}
-              label={field.label}
+              label="Save online markers"
               type="select"
-              options={ROUTING_KINDS[field.kind].options}
-              description={field.description}
-              value={routingValues[field.key] || ROUTING_KINDS[field.kind].serverDefault}
-              onChange={(v) => form.setValue(field.key, v)}
-              restartRequired={restartKeys.has(field.key)}
+              description={
+                onlineMarkerStorage === "stored"
+                  ? "Prairie saves markers from enabled providers such as TheIntroDB. The Sync online markers task fetches missing markers and refreshes saved markers daily at 03:00 (server time) by default."
+                  : "Fetch markers when needed without saving them to your library. Scheduled online sync is disabled."
+              }
+              options={[
+                { value: "stored", label: "Save to library" },
+                { value: "on_demand", label: "Fetch when needed" },
+              ]}
+              value={onlineMarkerStorage}
+              onChange={(value) => {
+                form.setValue("markers.online_storage", value);
+                if (value === "on_demand") form.setValue("markers.lazy_playback", "true");
+              }}
+              restartRequired={restartKeys.has("markers.online_storage")}
             />
-          ))}
-
-          <SettingFieldRow
-            label="Preferred paths"
-            description="Arrows show soft fallback order; only modes never cross that boundary."
-          >
-            <div className="grid min-w-64 gap-1 text-xs">
-              <PreferredPathRow
-                label="Direct play"
-                route={egressPreview(routingValues["playback.routing.direct_play_egress"])}
-              />
-              <PreferredPathRow
-                label="Remux"
-                route={routePreview(
-                  routingValues["playback.routing.remux_execution"],
-                  routingValues["playback.routing.remux_egress"],
-                  "remux",
-                )}
-              />
-              <PreferredPathRow
-                label="Video transcode"
-                route={routePreview(
-                  routingValues["playback.routing.video_transcode_execution"],
-                  routingValues["playback.routing.video_transcode_egress"],
-                  "video_transcode",
-                )}
-              />
-            </div>
-          </SettingFieldRow>
+          )}
 
-          {strandedRoute && (
-            <SettingFieldStatus tone="warn">
-              An “only” route currently has no healthy supporting node. Saving is allowed so nodes
-              can join later.
-            </SettingFieldStatus>
+          {showLazyPlayback && (
+            <SettingField
+              label="Find markers on playback"
+              type="toggle"
+              description={
+                onlineMarkersEnabled
+                  ? markerMode === "both"
+                    ? "Check online first when playback starts. Prairie detects only the intro or credits online providers don't have, using this server's CPU."
+                    : "Check online for missing or outdated markers when playback starts."
+                  : "Detect missing markers when playback starts. Local analysis uses CPU."
+              }
+              value={form.getValue("markers.lazy_playback") || "true"}
+              onChange={(value) => form.setValue("markers.lazy_playback", value)}
+              restartRequired={restartKeys.has("markers.lazy_playback")}
+            />
           )}
-          {usesProxyOnlyEgress && (
-            <SettingFieldStatus tone="warn">
-              Proxy-only egress requires every native client to support authorized media origins;
-              older clients may be unable to start that workload.
-            </SettingFieldStatus>
+
+          {localMarkersEnabled && (
+            <SettingField
+              label="Detection workers"
+              type="number"
+              description="How many seasons or movies Prairie analyzes at once, each with its own ffmpeg process. Defaults to 1. Raise it to finish a large library sooner if your storage and CPU have room."
+              value={form.getValue("markers.detection_workers")}
+              onChange={(value) => form.setValue("markers.detection_workers", value)}
+              restartRequired={restartKeys.has("markers.detection_workers")}
+            />
           )}
-        </FieldGroup>
 
-        <FieldGroup label="Watch behavior" restartAll={allRestart(WATCH_KEYS)}>
-          <SettingField
-            label="Mark watched at"
-            type="number"
-            unit="%"
-            value={form.getValue("playback.watched_threshold")}
-            onChange={(v) => form.setValue("playback.watched_threshold", v)}
-            restartRequired={restartKeys.has("playback.watched_threshold")}
-          />
-          <SettingField
-            label="Show in Continue Watching after"
-            type="number"
-            unit="%"
-            description="Progress below this is ignored."
-            value={form.getValue("playback.min_resume_threshold")}
-            onChange={(v) => form.setValue("playback.min_resume_threshold", v)}
-            restartRequired={restartKeys.has("playback.min_resume_threshold")}
-          />
+          <div className="py-3.5">
+            <MarkerTasksCard />
+          </div>
         </FieldGroup>
       </div>
 
diff --git a/web/src/pages/admin-settings/ProvidersSettings.test.tsx b/web/src/pages/admin-settings/ProvidersSettings.test.tsx
index 97cfd808f9..bfe81cae5e 100644
--- a/web/src/pages/admin-settings/ProvidersSettings.test.tsx
+++ b/web/src/pages/admin-settings/ProvidersSettings.test.tsx
@@ -44,7 +44,9 @@ function markerProvider(overrides: Partial<MarkerProviderConfig> = {}): MarkerPr
 }
 
 let markerProviders: MarkerProviderConfig[] = [];
-let pluginInstallations: Partial<PluginInstallation>[] = [];
+let pluginInstallations: Partial<PluginInstallation>[] | undefined = [];
+let installationsError = false;
+const refetchInstallations = vi.fn();
 
 vi.mock("@/hooks/queries/admin/markers", () => ({
   useMarkerProviders: () => ({
@@ -62,17 +64,17 @@ vi.mock("@/hooks/queries/admin/markers", () => ({
 }));
 
 vi.mock("@/hooks/queries/admin/plugins", () => ({
-  useAdminPluginInstallations: () => ({ data: pluginInstallations }),
+  useAdminPluginInstallations: () => ({
+    data: pluginInstallations,
+    isLoading: false,
+    isError: installationsError,
+    refetch: refetchInstallations,
+  }),
 }));
 
 let sensitiveConfigured: string[] = ["mdblist.api_key"];
 let settingsValues: Record<string, string> = {};
 const setValueMock = vi.fn();
-let adminNodes: { data?: unknown[]; isSuccess: boolean } = { data: [], isSuccess: true };
-
-vi.mock("@/hooks/queries/admin/nodes", () => ({
-  useAdminNodes: () => adminNodes,
-}));
 
 const useSettingsFormMock = vi.fn((_options?: { keys: string[] }) => ({
   isLoading: false,
@@ -189,60 +191,39 @@ describe("ProvidersSettings", () => {
     );
     sensitiveConfigured = ["mdblist.api_key"];
     settingsValues = {};
-    adminNodes = { data: [], isSuccess: true };
     setValueMock.mockReset();
     markerProviders = [];
     pluginInstallations = [];
+    installationsError = false;
+    refetchInstallations.mockReset();
     for (const mock of Object.values(mocks)) mock.mockReset();
   });
 
-  it("stages the subtitle sync settings with their defaults", async () => {
-    adminNodes = {
-      data: [{ id: 1, type: "transcode", enabled: true, healthy: true }],
-      isSuccess: true,
-    };
+  it("leaves subtitle sync to Playback and stages nothing through a save bar", () => {
     render(<ProvidersSettings />);
 
-    expect(useSettingsFormMock).toHaveBeenLastCalledWith({
-      keys: expect.arrayContaining([
-        "subtitles.auto_sync",
-        "subtitles.sync_execution",
-        "subtitles.sync_node_capacity",
-      ]),
-    });
-    const group = screen.getByRole("group", { name: "Subtitle sync" });
-    const auto = within(group).getByRole("switch", { name: /Sync subtitles automatically/ });
-    expect(auto).toBeChecked();
-    expect(
-      within(group).getByText(
-        "Aligns subtitles to the video's audio: downloaded and uploaded ones when they're added, any other the first time it's played. Fixes subtitles cut for a different release.",
-      ),
-    ).toBeInTheDocument();
-    expect(
-      within(group).getByRole("combobox", { name: /Where to analyze audio/ }),
-    ).toHaveTextContent("Prefer transcode nodes");
-    expect(
-      within(group).getByRole("spinbutton", { name: /Concurrent syncs per transcode node/ }),
-    ).toHaveValue(1);
-    expect(within(group).queryByText("No transcode nodes are connected")).not.toBeInTheDocument();
-
-    await userEvent.click(auto);
-    expect(setValueMock).toHaveBeenCalledWith("subtitles.auto_sync", "false");
+    expect(screen.getByRole("heading", { level: 1, name: "Providers" })).toBeInTheDocument();
+    expect(useSettingsFormMock).toHaveBeenLastCalledWith({ keys: ["mdblist.api_key"] });
+    expect(screen.queryByRole("group", { name: "Subtitle sync" })).not.toBeInTheDocument();
+    expect(screen.queryByText("Sync subtitles automatically")).not.toBeInTheDocument();
+    const groups = ["Watch providers", "Lists", "Subtitle providers", "Marker providers"];
+    const headings = Array.from(document.querySelectorAll("h3"), (h) => h.textContent ?? "");
+    expect(headings.filter((heading) => groups.includes(heading))).toEqual(groups);
+    expect(setValueMock).not.toHaveBeenCalled();
   });
 
-  it("hides node capacity for local sync and warns about node-only sync without nodes", () => {
-    settingsValues = { "subtitles.sync_execution": "local" };
-    const view = render(<ProvidersSettings />);
-    let group = screen.getByRole("group", { name: "Subtitle sync" });
-    expect(
-      within(group).queryByRole("spinbutton", { name: /Concurrent syncs per transcode node/ }),
-    ).not.toBeInTheDocument();
-    view.unmount();
-
-    settingsValues = { "subtitles.sync_execution": "transcode_nodes_only" };
+  it("files the MDBList key under Lists and points metadata providers to Plugins", () => {
     render(<ProvidersSettings />);
-    group = screen.getByRole("group", { name: "Subtitle sync" });
-    expect(within(group).getByText("No transcode nodes are connected")).toBeInTheDocument();
+
+    const lists = screen.getByRole("group", { name: "Lists" });
+    const mdblist = within(lists).getByRole("group", { name: "MDBList" });
+    expect(within(mdblist).getByText("Lists")).toBeInTheDocument();
+    expect(screen.queryByRole("group", { name: "Metadata providers" })).not.toBeInTheDocument();
+    expect(screen.queryByText("Ratings and lists")).not.toBeInTheDocument();
+    expect(
+      screen.getByText(/Metadata providers, including TMDB, TheTVDB, and MDBList ratings/),
+    ).toBeInTheDocument();
+    expect(screen.getByRole("link", { name: "Plugins" })).toHaveAttribute("href", "/admin/plugins");
   });
 
   it("reports a credential draft to the unsaved-changes registry", async () => {
@@ -280,7 +261,8 @@ describe("ProvidersSettings", () => {
           etag: '"captured"',
           intent: expect.objectContaining({ provider: "subdl" }),
         }),
-        config: { enabled: false, api_key: "retained-secret" },
+        // SubDL had no key, so its first one switches it on.
+        config: { enabled: true, api_key: "retained-secret" },
       },
       expect.anything(),
     );
@@ -296,6 +278,69 @@ describe("ProvidersSettings", () => {
     expect(globalThis.fetch).toHaveBeenCalledTimes(2);
   });
 
+  it("switches a subtitle provider on with its first credentials", async () => {
+    const user = userEvent.setup();
+    render(<ProvidersSettings />);
+    await user.click(
+      within(screen.getByRole("group", { name: "SubDL" })).getByRole("button", { name: "Connect" }),
+    );
+    const panel = within(screen.getByRole("group", { name: "SubDL" }));
+    await waitFor(() => expect(panel.getByRole("switch", { name: "Enable SubDL" })).toBeEnabled());
+    expect(panel.getByRole("switch", { name: "Enable SubDL" })).not.toBeChecked();
+
+    await user.type(panel.getByLabelText("API key"), "first-key");
+    // The switch shows what Save will do before it does it.
+    expect(panel.getByRole("switch", { name: "Enable SubDL" })).toBeChecked();
+    await user.click(panel.getByRole("button", { name: "Save" }));
+
+    expect(mocks.updateProvider).toHaveBeenCalledWith(
+      expect.objectContaining({ config: { enabled: true, api_key: "first-key" } }),
+      expect.anything(),
+    );
+  });
+
+  it("keeps a first-connected provider off when the admin switched it off", async () => {
+    const user = userEvent.setup();
+    render(<ProvidersSettings />);
+    await user.click(
+      within(screen.getByRole("group", { name: "SubDL" })).getByRole("button", { name: "Connect" }),
+    );
+    const panel = within(screen.getByRole("group", { name: "SubDL" }));
+    await waitFor(() => expect(panel.getByRole("switch", { name: "Enable SubDL" })).toBeEnabled());
+
+    await user.type(panel.getByLabelText("API key"), "first-key");
+    await user.click(panel.getByRole("switch", { name: "Enable SubDL" }));
+    await user.click(panel.getByRole("button", { name: "Save" }));
+
+    expect(mocks.updateProvider).toHaveBeenCalledWith(
+      expect.objectContaining({ config: { enabled: false, api_key: "first-key" } }),
+      expect.anything(),
+    );
+  });
+
+  it("leaves a configured provider that is off alone when its key is replaced", async () => {
+    const user = userEvent.setup();
+    render(<ProvidersSettings />);
+    await user.click(
+      within(screen.getByRole("group", { name: "SubSource" })).getByRole("button", {
+        name: "Manage",
+      }),
+    );
+    const panel = within(screen.getByRole("group", { name: "SubSource" }));
+    await waitFor(() =>
+      expect(panel.getByRole("switch", { name: "Enable SubSource" })).toBeEnabled(),
+    );
+
+    await user.type(panel.getByLabelText("API key"), "rotated-key");
+    expect(panel.getByRole("switch", { name: "Enable SubSource" })).not.toBeChecked();
+    await user.click(panel.getByRole("button", { name: "Save" }));
+
+    expect(mocks.updateProvider).toHaveBeenCalledWith(
+      expect.objectContaining({ config: { enabled: false, api_key: "rotated-key" } }),
+      expect.anything(),
+    );
+  });
+
   it("shows subtitle saved with local failure without claiming immediate removal", async () => {
     const user = userEvent.setup();
     mocks.updateProvider.mockImplementation((_vars, options) =>
@@ -404,6 +449,16 @@ describe("ProvidersSettings", () => {
 
     const tile = screen.getByRole("group", { name: "TheIntroDB" });
     expect(tile).toHaveAttribute("data-expanded", "true");
+    // Lookup order and the sharing threshold have working defaults, so they
+    // wait under the tile's Advanced section.
+    expect(within(tile).queryByLabelText("Provider priority")).not.toBeInTheDocument();
+    expect(
+      within(tile).queryByLabelText("Minimum confidence for automatic sharing"),
+    ).not.toBeInTheDocument();
+    expect(
+      within(tile).getByRole("switch", { name: "Get markers from this provider" }),
+    ).toBeChecked();
+    await user.click(within(tile).getByRole("button", { name: "Advanced · 2 settings" }));
     expect(within(tile).getByLabelText("Provider priority")).toHaveValue(10);
     expect(within(tile).getByLabelText("Minimum confidence for automatic sharing")).toHaveValue(95);
     // Credentials are the plugin's, not Prairie's: the panel links out for them.
@@ -436,6 +491,7 @@ describe("ProvidersSettings", () => {
       render(<ProvidersSettings />);
       const tile = within(screen.getByRole("group", { name: "TheIntroDB" }));
       await user.click(tile.getByRole("button", { name: "Manage" }));
+      await user.click(tile.getByRole("button", { name: /^Advanced/ }));
 
       const confidence = tile.getByLabelText("Minimum confidence for automatic sharing");
       await user.clear(confidence);
@@ -464,6 +520,7 @@ describe("ProvidersSettings", () => {
       render(<ProvidersSettings />);
       const tile = within(screen.getByRole("group", { name: "TheIntroDB" }));
       await user.click(tile.getByRole("button", { name: "Manage" }));
+      await user.click(tile.getByRole("button", { name: /^Advanced/ }));
 
       expect(tile.getByRole("button", { name: "Save" })).toBeDisabled();
       expect(reportUnsavedMock.mock.calls.every(([dirty]) => dirty === false)).toBe(true);
@@ -486,6 +543,7 @@ describe("ProvidersSettings", () => {
     render(<ProvidersSettings />);
     const tile = within(screen.getByRole("group", { name: "TheIntroDB" }));
     await user.click(tile.getByRole("button", { name: "Manage" }));
+    await user.click(tile.getByRole("button", { name: /^Advanced/ }));
 
     const confidence = tile.getByLabelText("Minimum confidence for automatic sharing");
     await user.clear(confidence);
@@ -502,9 +560,12 @@ describe("ProvidersSettings", () => {
     render(<ProvidersSettings />);
     const tile = within(screen.getByRole("group", { name: "TheIntroDB" }));
     await user.click(tile.getByRole("button", { name: "Manage" }));
+    await user.click(tile.getByRole("button", { name: /^Advanced/ }));
 
     const sharing = tile.getByRole("switch", { name: "Allow sharing with this provider" });
-    const automatic = tile.getByRole("switch", { name: "Automatically share detected intros" });
+    const automatic = tile.getByRole("switch", {
+      name: "Automatically share detected intros and credits",
+    });
     const confidence = tile.getByLabelText("Minimum confidence for automatic sharing");
     expect(automatic).toBeDisabled();
     expect(confidence).toBeEnabled();
@@ -529,6 +590,7 @@ describe("ProvidersSettings", () => {
     render(<ProvidersSettings />);
     const tile = within(screen.getByRole("group", { name: "TheIntroDB" }));
     await user.click(tile.getByRole("button", { name: "Manage" }));
+    await user.click(tile.getByRole("button", { name: /^Advanced/ }));
     const priority = tile.getByLabelText("Provider priority");
     const confidence = tile.getByLabelText("Minimum confidence for automatic sharing");
     await user.clear(priority);
@@ -561,10 +623,11 @@ describe("ProvidersSettings", () => {
     render(<ProvidersSettings />);
     const tile = within(screen.getByRole("group", { name: "TheIntroDB" }));
     await user.click(tile.getByRole("button", { name: "Manage" }));
+    await user.click(tile.getByRole("button", { name: /^Advanced/ }));
 
     expect(tile.getByRole("switch", { name: "Allow sharing with this provider" })).toBeDisabled();
     expect(
-      tile.getByRole("switch", { name: "Automatically share detected intros" }),
+      tile.getByRole("switch", { name: "Automatically share detected intros and credits" }),
     ).toBeDisabled();
     expect(tile.getByLabelText("Minimum confidence for automatic sharing")).toBeDisabled();
     expect(tile.queryByRole("button", { name: "Test connection" })).not.toBeInTheDocument();
@@ -587,4 +650,55 @@ describe("ProvidersSettings", () => {
     );
     expect(tile.getByRole("status")).toHaveTextContent("Tested");
   });
+
+  it("reports a failed watch provider load instead of claiming nothing is installed", async () => {
+    pluginInstallations = undefined;
+    installationsError = true;
+    render(<ProvidersSettings />);
+
+    const watch = screen.getByRole("group", { name: "Watch providers" });
+    expect(within(watch).getByRole("alert")).toHaveTextContent(
+      "Couldn't load the installed watch provider plugins.",
+    );
+    expect(screen.queryByText("No watch provider plugins are installed.")).not.toBeInTheDocument();
+    await userEvent.setup().click(within(watch).getByRole("button", { name: "Retry" }));
+    expect(refetchInstallations).toHaveBeenCalled();
+  });
+
+  it("does not label an enabled watch plugin as connected until its required config is set", () => {
+    const schema = [{ key: "account", title: "Account", json_schema: "{}", required: true }];
+    pluginInstallations = [
+      {
+        id: 7,
+        plugin_id: "prairie-plugin-watchsync-anilist",
+        enabled: true,
+        capabilities: [{ type: "watch_sync_provider.v1", id: "anilist", display_name: "AniList" }],
+        global_config_schema: schema,
+        global_configs: [],
+      },
+      {
+        id: 9,
+        plugin_id: "prairie-plugin-watchsync-serializd",
+        enabled: true,
+        capabilities: [
+          { type: "watch_sync_provider.v1", id: "serializd", display_name: "Serializd" },
+        ],
+        global_config_schema: schema,
+        global_configs: [{ key: "account", value: {}, configured_secrets: ["api_key"] }],
+      },
+    ];
+
+    render(<ProvidersSettings />);
+
+    // Enabled but keyless: the plugin cannot serve a request, so the tile must
+    // not read as set up.
+    const watch = screen.getByRole("group", { name: "Watch providers" });
+    const anilist = within(watch).getByRole("group", { name: "AniList" });
+    expect(anilist).toHaveAttribute("data-state", "not_connected");
+    expect(within(anilist).getByText("Needs setup")).toBeInTheDocument();
+
+    const serializd = within(watch).getByRole("group", { name: "Serializd" });
+    expect(serializd).toHaveAttribute("data-state", "connected");
+    expect(within(serializd).getByText("Enabled")).toBeInTheDocument();
+  });
 });
diff --git a/web/src/pages/admin-settings/ProvidersSettings.tsx b/web/src/pages/admin-settings/ProvidersSettings.tsx
index 2d00910d65..4fcdedf323 100644
--- a/web/src/pages/admin-settings/ProvidersSettings.tsx
+++ b/web/src/pages/admin-settings/ProvidersSettings.tsx
@@ -47,30 +47,20 @@ import {
 import { useRestartKeys, type RestartKeyMatcher } from "@/hooks/useRestartKeys";
 import { useSettingsForm } from "@/hooks/useSettingsForm";
 import { sortSubtitleProviders } from "@/lib/subtitleProviders";
-import { SaveBar } from "@/components/SaveBar";
 
 import { FieldGroup } from "./FieldGroup";
 import { MarkerProviderTiles } from "./MarkerProviderTiles";
-import { SettingField, SettingFieldStatus } from "./SettingField";
-import { useAdminNodes } from "@/hooks/queries/admin/nodes";
-import {
-  SUBTITLE_SYNC_EXECUTION_DEFAULT,
-  hasUsableTranscodeNode,
-  isNodeBackedExecution,
-  subtitleSyncExecutionOptions,
-} from "./playbackSettings.utils";
+import { SettingField } from "./SettingField";
+import { WatchProviderTiles } from "./WatchProviderTiles";
 
 /**
  * MDBList is the only provider on this page whose credential is a server
- * setting; the subtitle providers have their own endpoints. The form also
- * stages the subtitle sync settings, which save through the page's SaveBar.
+ * setting; the subtitle and marker providers have their own endpoints, and
+ * watch providers are configured on their plugin pages. Every tile saves
+ * itself, so the page has no save bar: the form only reports which
+ * secrets are configured and reads the marker detection mode.
  */
-const SUBTITLE_SYNC_KEYS = [
-  "subtitles.auto_sync",
-  "subtitles.sync_execution",
-  "subtitles.sync_node_capacity",
-];
-const KEYS = ["mdblist.api_key", ...SUBTITLE_SYNC_KEYS];
+const KEYS = ["mdblist.api_key"];
 
 // ---------------------------------------------------------------------------
 // Shared tile plumbing
@@ -203,11 +193,17 @@ function SubtitleProviderTile({
   const testProvider = useTestSubtitleProvider();
 
   const canonical = editor?.body ?? config;
-  const enabled = enabledDraft ?? canonical.enabled;
   const providerName = config.provider_name;
   const { name, tagline, monogram, monogramClass } = presentationFor(providerName);
   const usesAccount = providerName === "opensubtitles";
   const configured = usesAccount ? canonical.has_credentials : canonical.has_api_key;
+  const credentialTyped = usesAccount
+    ? username.trim() !== "" && password !== ""
+    : apiKey.trim() !== "";
+  // Typing the first credentials into a provider that has none is connecting
+  // it, so the switch follows unless the admin set it themselves; otherwise
+  // the save lands as "Connected · off" and nothing downloads.
+  const enabled = enabledDraft ?? (!configured && credentialTyped ? true : canonical.enabled);
 
   const draft = usesAccount ? { username, password } : { api_key: apiKey };
   // Tile drafts live outside useSettingsForm, so the navigation guard and
@@ -524,7 +520,7 @@ function MDBListTile({
   return (
     <ProviderTile
       name="MDBList"
-      tagline="Ratings and lists"
+      tagline="Lists"
       monogram="MD"
       monogramClass="bg-emerald-500/20 text-emerald-700 dark:text-emerald-300"
       state={state}
@@ -539,7 +535,8 @@ function MDBListTile({
       }}
     >
       <p className="text-muted-foreground mb-1 text-xs">
-        A key adds search and browse; list URLs import without one. Get a key at{" "}
+        A key lets collection imports search and browse MDBList lists; pasted list URLs import
+        without one. Get a key at{" "}
         <a
           href="https://mdblist.com/preferences/#api"
           target="_blank"
@@ -615,20 +612,13 @@ export default function ProvidersSettings() {
   }
 
   // Marker tiles can be perfectly set up and still never run: the detection
-  // mode on Library & Metadata decides whether Prairie looks online at all. The
-  // key is read, not staged — this page never saves it.
+  // mode on Playback decides whether Prairie looks online at all. The key is
+  // read, not staged — this page never saves it.
   const markerMode = form.getValue("markers.mode") || "both";
   const onlineMarkerLookupEnabled = markerMode === "online" || markerMode === "both";
 
   const providers = sortSubtitleProviders(data?.providers ?? []);
 
-  const nodes = useAdminNodes();
-  // Gate node-backed modes only on a node list we actually have, as the
-  // chapter thumbnail setting does.
-  const transcodeNodeAvailable = !nodes.isSuccess || hasUsableTranscodeNode(nodes.data);
-  const syncExecution =
-    form.getValue("subtitles.sync_execution") || SUBTITLE_SYNC_EXECUTION_DEFAULT;
-
   if (form.isLoading || isLoading) {
     return (
       <div className="max-w-5xl space-y-6" role="status" aria-label="Loading providers">
@@ -642,8 +632,35 @@ export default function ProvidersSettings() {
   }
 
   return (
-    <div className="flex h-full max-w-5xl flex-col gap-7">
-      <SettingsPageHeader title="Subtitles & Metadata" />
+    <div className="space-y-5">
+      <SettingsPageHeader title="Providers" />
+
+      <FieldGroup label="Watch providers">
+        <div className="py-3.5">
+          <WatchProviderTiles />
+        </div>
+      </FieldGroup>
+
+      {/*
+        The server's MDBList key only powers list search and browse in
+        collection imports; MDBList ratings come from its metadata plugin,
+        configured under Plugins like TMDB and TheTVDB.
+      */}
+      <FieldGroup label="Lists">
+        <div className="py-3.5">
+          <ProviderTileGrid>
+            <MDBListTile
+              sensitiveConfigured={form.sensitiveConfigured}
+              restartKeys={restartKeys}
+              expanded={expandedTile === "mdblist"}
+              onExpand={() => setExpandedTile("mdblist")}
+              onCollapse={() => setExpandedTile(null)}
+              test={tests.mdblist}
+              onTested={(test) => recordTest("mdblist", test)}
+            />
+          </ProviderTileGrid>
+        </div>
+      </FieldGroup>
 
       <FieldGroup label="Subtitle providers">
         <div className="py-3.5">
@@ -668,71 +685,10 @@ export default function ProvidersSettings() {
         </div>
       </FieldGroup>
 
-      <FieldGroup label="Subtitle sync" dirty={SUBTITLE_SYNC_KEYS.some((key) => form.isDirty(key))}>
-        <SettingField
-          label="Sync subtitles automatically"
-          type="toggle"
-          description="Aligns subtitles to the video's audio: downloaded and uploaded ones when they're added, any other the first time it's played. Fixes subtitles cut for a different release."
-          dirty={form.isDirty("subtitles.auto_sync")}
-          value={form.getValue("subtitles.auto_sync") || "true"}
-          onChange={(v) => form.setValue("subtitles.auto_sync", v)}
-          restartRequired={restartKeys.has("subtitles.auto_sync")}
-        />
-        <SettingField
-          label="Where to analyze audio"
-          type="select"
-          description="Sync decodes a few minutes of the file's audio."
-          options={subtitleSyncExecutionOptions(syncExecution, transcodeNodeAvailable)}
-          status={
-            !transcodeNodeAvailable && isNodeBackedExecution(syncExecution) ? (
-              <SettingFieldStatus tone="warn">No transcode nodes are connected</SettingFieldStatus>
-            ) : undefined
-          }
-          dirty={form.isDirty("subtitles.sync_execution")}
-          value={syncExecution}
-          onChange={(v) => form.setValue("subtitles.sync_execution", v)}
-          restartRequired={restartKeys.has("subtitles.sync_execution")}
-        />
-        {isNodeBackedExecution(syncExecution) && (
-          <SettingField
-            label="Concurrent syncs per transcode node"
-            type="number"
-            description="How many subtitles one transcode node syncs at once."
-            dirty={form.isDirty("subtitles.sync_node_capacity")}
-            value={form.getValue("subtitles.sync_node_capacity") || "1"}
-            onChange={(v) => form.setValue("subtitles.sync_node_capacity", v)}
-            restartRequired={restartKeys.has("subtitles.sync_node_capacity")}
-          />
-        )}
-      </FieldGroup>
-
-      <FieldGroup label="Metadata providers">
-        <div className="space-y-3 py-3.5">
-          <ProviderTileGrid>
-            <MDBListTile
-              sensitiveConfigured={form.sensitiveConfigured}
-              restartKeys={restartKeys}
-              expanded={expandedTile === "mdblist"}
-              onExpand={() => setExpandedTile("mdblist")}
-              onCollapse={() => setExpandedTile(null)}
-              test={tests.mdblist}
-              onTested={(test) => recordTest("mdblist", test)}
-            />
-          </ProviderTileGrid>
-          <p className="text-muted-foreground text-xs">
-            TMDB and TheTVDB connect from{" "}
-            <Link to="/admin/plugins" className="underline underline-offset-2">
-              Plugins
-            </Link>
-            .
-          </p>
-        </div>
-      </FieldGroup>
-
       {/*
         Marker providers are the online half of "Marker source". The
-        detection mode itself stays on Library & Metadata; what each provider
-        does — lookup order, whether this server contributes back — is provider
+        detection mode itself stays on Playback; what each provider does —
+        lookup order, whether this server contributes back — is provider
         configuration and belongs beside the other providers.
       */}
       <FieldGroup label="Marker providers">
@@ -746,7 +702,7 @@ export default function ProvidersSettings() {
             Online marker lookup is {onlineMarkerLookupEnabled ? "enabled" : "disabled"}. Change
             this under{" "}
             <Link
-              to="/admin/settings/library"
+              to="/admin/settings/playback"
               className="hover:text-foreground font-medium underline underline-offset-2 transition-colors"
             >
               Marker source
@@ -756,12 +712,15 @@ export default function ProvidersSettings() {
         </div>
       </FieldGroup>
 
-      <SaveBar
-        dirtyCount={form.dirtyCount}
-        onSave={form.save}
-        onDiscard={form.discard}
-        isSaving={form.isSaving}
-      />
+      {/* An admin looking for metadata providers on a page called Providers
+          lands here, so say where they are. */}
+      <p className="text-muted-foreground text-xs">
+        Metadata providers, including TMDB, TheTVDB, and MDBList ratings, connect from{" "}
+        <Link to="/admin/plugins" className="underline underline-offset-2">
+          Plugins
+        </Link>
+        .
+      </p>
     </div>
   );
 }
diff --git a/web/src/pages/admin-settings/RedisGroup.tsx b/web/src/pages/admin-settings/RedisGroup.tsx
new file mode 100644
index 0000000000..4a8ce2a420
--- /dev/null
+++ b/web/src/pages/admin-settings/RedisGroup.tsx
@@ -0,0 +1,150 @@
+import { useState } from "react";
+
+import type { ConnectionCheckResponse } from "@/api/types";
+import { ConnectionCheckAction } from "@/components/admin/ConnectionCheckAction";
+import { SecretField } from "@/components/settings/SecretField";
+import { useCheckAdminSettingsConnection } from "@/hooks/queries/admin/settings";
+import type { RestartKeyMatcher } from "@/hooks/useRestartKeys";
+import type { useSettingsForm } from "@/hooks/useSettingsForm";
+
+import { FieldGroup } from "./FieldGroup";
+import { SettingField } from "./SettingField";
+import { REDIS_KEYS, keepSavedRedisUrl, stageRedisUrl } from "./redisDraft";
+
+/**
+ * How the page stages the connection URL. The page freezes both while a save
+ * is in flight, so a late keystroke cannot ride along with it; emptying the
+ * input reverts to the saved URL (`keepSaved`).
+ */
+export interface RedisUrlEditors {
+  keepSaved: (key: string) => void;
+  setSecret: (key: string, value: string) => void;
+  disabled: boolean;
+}
+
+export function RedisGroup({
+  form,
+  restartKeys,
+  secrets,
+}: {
+  form: ReturnType<typeof useSettingsForm>;
+  restartKeys: RestartKeyMatcher;
+  secrets: RedisUrlEditors;
+}) {
+  const checkConnection = useCheckAdminSettingsConnection();
+  const [connectionResult, setConnectionResult] = useState<ConnectionCheckResponse | null>(null);
+  const redisUrl = form.getValue("redis.url");
+  const managedByEnv = form.sensitiveManagedByEnv.includes("redis.url");
+  const configured = form.sensitiveConfigured.includes("redis.url");
+  const [enabledOverride, setEnabledOverride] = useState<boolean | null>(null);
+  // Saving or discarding clears the toggle override so it follows the stored
+  // URL again. Adjusting during render (rather than in an effect) keeps the
+  // override alive while the admin is still editing.
+  const [lastDirtyCount, setLastDirtyCount] = useState(form.dirtyCount);
+  if (lastDirtyCount !== form.dirtyCount) {
+    setLastDirtyCount(form.dirtyCount);
+    if (form.dirtyCount === 0) setEnabledOverride(null);
+  }
+  const enabled = enabledOverride ?? (redisUrl.trim() !== "" || configured);
+  // URL edits go through the page's editors, which drop a keystroke that
+  // arrives while a save is in flight.
+  const urlDraft = { ...form, setValue: secrets.setSecret, resetValue: secrets.keepSaved };
+
+  async function handleCheckConnection() {
+    try {
+      setConnectionResult(
+        await checkConnection.mutateAsync({
+          kind: "redis",
+          body: form.buildConnectionCheckRequest(REDIS_KEYS),
+        }),
+      );
+    } catch (error) {
+      setConnectionResult({
+        success: false,
+        message: error instanceof Error ? error.message : "Connection check failed.",
+      });
+    }
+  }
+
+  return (
+    <FieldGroup
+      label="Redis"
+      restartAll={REDIS_KEYS.every((key) => restartKeys.has(key))}
+      dirty={REDIS_KEYS.some((key) => form.isDirty(key))}
+    >
+      <SettingField
+        label="Use Redis"
+        type="toggle"
+        description={
+          managedByEnv ? "Set by REDIS_URL" : "Needed when running more than one server."
+        }
+        value={enabled ? "true" : "false"}
+        onChange={(value) => {
+          // The switch stages or takes back the credential, so it holds still
+          // while a save is in flight, like the URL field below.
+          if (secrets.disabled) return;
+          if (value === "true") {
+            setEnabledOverride(true);
+            // Takes back a staged switch-off, which cleared the number too.
+            form.resetValue("redis.url");
+            form.resetValue("redis.db");
+            return;
+          }
+          setEnabledOverride(false);
+          stageRedisUrl(form, "");
+        }}
+        disabled={managedByEnv || secrets.disabled}
+        restartRequired={restartKeys.has("redis.url")}
+      />
+      {enabled && (
+        <>
+          {/*
+            No `onClear` here: the Use Redis switch above already stages the
+            empty URL, and one clear per surface is the rule.
+          */}
+          <SecretField
+            label="Connection URL"
+            value={redisUrl}
+            configured={configured}
+            onKeep={() => keepSavedRedisUrl(urlDraft)}
+            onChange={(v) => stageRedisUrl(urlDraft, v)}
+            hint={managedByEnv ? "Value supplied by REDIS_URL" : "redis://host:6379"}
+            disabled={managedByEnv || secrets.disabled}
+            restartRequired={restartKeys.has("redis.url")}
+          />
+          {/*
+            The server reports the number in use here while none is saved: the
+            one in the URL, or in REDIS_URL when the environment supplies it.
+          */}
+          <SettingField
+            label="Database number"
+            dirty={form.isDirty("redis.db")}
+            type="number"
+            description={
+              managedByEnv
+                ? "Set by REDIS_URL"
+                : "Replaces the number in the URL. Installs sharing one Redis each need their own."
+            }
+            value={form.getValue("redis.db")}
+            onChange={(v) => {
+              if (!secrets.disabled) form.setValue("redis.db", v);
+            }}
+            disabled={managedByEnv || secrets.disabled}
+            restartRequired={restartKeys.has("redis.db")}
+          />
+          {/*
+            Env-managed URLs stay checkable: the field is read-only so nothing
+            is dirty, and the server checks the effective value it merged from
+            REDIS_URL. Only writes are refused for env-managed keys.
+          */}
+          <ConnectionCheckAction
+            onClick={handleCheckConnection}
+            result={connectionResult}
+            isPending={checkConnection.isPending}
+            disabled={form.isSaving}
+          />
+        </>
+      )}
+    </FieldGroup>
+  );
+}
diff --git a/web/src/pages/admin-settings/RequestRoutingList.tsx b/web/src/pages/admin-settings/RequestRoutingList.tsx
index 0e6e5149db..824eda95e2 100644
--- a/web/src/pages/admin-settings/RequestRoutingList.tsx
+++ b/web/src/pages/admin-settings/RequestRoutingList.tsx
@@ -205,11 +205,7 @@ function RuleRow({
               )}
             >
               {rule.name}
-              {!rule.enabled ? (
-                <Badge variant="secondary" className="text-[10px]">
-                  Off
-                </Badge>
-              ) : null}
+              {!rule.enabled ? <Badge variant="secondary">Off</Badge> : null}
             </span>
             <span
               className={cn(
@@ -426,6 +422,7 @@ export function RequestRoutingList({
     rules,
     fallback,
     servers: scope.allServers,
+    installations: scope.installations,
     serverFields: (server: RequestIntegration) => serverOverrideFields(server, scope.installations),
     language: scope.language,
     forceDual: scope.forceDual,
diff --git a/web/src/pages/admin-settings/RequestRuleConditions.tsx b/web/src/pages/admin-settings/RequestRuleConditions.tsx
index 974c02fc07..9447bb7f76 100644
--- a/web/src/pages/admin-settings/RequestRuleConditions.tsx
+++ b/web/src/pages/admin-settings/RequestRuleConditions.tsx
@@ -477,7 +477,7 @@ export function RuleConditionsEditor({
               {index > 0 ? (
                 <li
                   aria-hidden="true"
-                  className="text-muted-foreground px-3 text-[11px] font-semibold tracking-wide uppercase"
+                  className="text-muted-foreground px-3 text-xs font-semibold tracking-wide uppercase"
                 >
                   and
                 </li>
diff --git a/web/src/pages/admin-settings/RequestServers.tsx b/web/src/pages/admin-settings/RequestServers.tsx
index 1f7f889c55..7dd49381e1 100644
--- a/web/src/pages/admin-settings/RequestServers.tsx
+++ b/web/src/pages/admin-settings/RequestServers.tsx
@@ -72,6 +72,8 @@ import {
   serverInstallation,
   serverKind,
   serverDeleteBlockers,
+  serverNeedsAPIKey,
+  serverNeedsBaseURL,
   serverReady,
   serverRouteUsage,
   serverTypeLabel,
@@ -160,7 +162,7 @@ function ServerTile({
   onEdit: () => void;
 }) {
   const type = serverTypeLabel(server, installations);
-  const ready = serverReady(server);
+  const ready = serverReady(server, installations);
   const usage =
     routing?.mode === "standard"
       ? standardServerUsage(server.id, routing)
@@ -361,6 +363,10 @@ function useServerOptions(
     installation_id?: number;
     capability_id: string;
     plugin_config: Record<string, unknown>;
+    /** The server type needs a URL (see serverNeedsBaseURL). */
+    needs_base_url: boolean;
+    /** The server type needs an API key (see serverNeedsAPIKey). */
+    needs_api_key: boolean;
   },
 ) {
   const load = useLoadRequestIntegrationOptions();
@@ -373,10 +379,10 @@ function useServerOptions(
   const connRef = useRef(0);
 
   const canLoad =
-    draft.base_url.trim().length > 0 &&
+    (draft.base_url.trim().length > 0 || !draft.needs_base_url) &&
     Boolean(draft.installation_id) &&
     draft.capability_id.trim().length > 0 &&
-    Boolean(draft.api_key_ref.trim() || draft.has_api_key);
+    (Boolean(draft.api_key_ref.trim() || draft.has_api_key) || !draft.needs_api_key);
 
   const sig = JSON.stringify({
     u: draft.base_url,
@@ -443,8 +449,7 @@ function useServerOptions(
     probe().catch(() => {
       // Shown inline through `status`; the Test button reports the reason.
     });
-    // Only the connection identity decides when to probe again.
-    // eslint-disable-next-line react-hooks/exhaustive-deps
+    // eslint-disable-next-line react-hooks/exhaustive-deps -- only the connection identity decides when to probe again
   }, [debouncedSig, canLoad]);
 
   return { options, status, problem, canLoad, probe };
@@ -526,6 +531,16 @@ export function RequestServerEditor({
     form.capability_id,
   );
   const { descriptor, jsonSchema } = serverConfigSchema(selected);
+  const needsBaseURL = serverNeedsBaseURL(selected);
+  const needsAPIKey = serverNeedsAPIKey(selected);
+  const connectionFields =
+    needsBaseURL && needsAPIKey
+      ? "the URL and API key"
+      : needsBaseURL
+        ? "the URL"
+        : needsAPIKey
+          ? "the API key"
+          : "the server's settings";
   const fieldTypes = useMemo(() => parseFieldTypes(jsonSchema), [jsonSchema]);
   // The Sonarr/Radarr plugin's "4K instance" switch. Routing owns the
   // plugin's other default switches, so the editor shows this one itself.
@@ -547,6 +562,8 @@ export function RequestServerEditor({
     installation_id: hasInstallation ? installationID : undefined,
     capability_id: selected?.capability.id ?? "",
     plugin_config: pluginConfig,
+    needs_base_url: needsBaseURL,
+    needs_api_key: needsAPIKey,
   });
 
   // Once the server's choices arrive, fill each empty single choice with the
@@ -680,8 +697,8 @@ export function RequestServerEditor({
     !conflict &&
     (isNew || Boolean(etag)) &&
     form.name.trim().length > 0 &&
-    form.base_url.trim().length > 0 &&
-    hasKey &&
+    (form.base_url.trim().length > 0 || !needsBaseURL) &&
+    (hasKey || !needsAPIKey) &&
     hasInstallation &&
     (!descriptor || schemaValid);
 
@@ -811,7 +828,11 @@ export function RequestServerEditor({
             className={SETTINGS_CONTROL_WIDTH}
           />
         </SettingFieldRow>
-        <SettingFieldRow label="URL" htmlFor={urlId} status={<FieldError>{urlError}</FieldError>}>
+        <SettingFieldRow
+          label={needsBaseURL ? "URL" : "URL (optional)"}
+          htmlFor={urlId}
+          status={<FieldError>{urlError}</FieldError>}
+        >
           <Input
             id={urlId}
             value={form.base_url}
@@ -826,14 +847,16 @@ export function RequestServerEditor({
           />
         </SettingFieldRow>
         <SecretField
-          label="API key"
+          label={needsAPIKey ? "API key" : "API key (optional)"}
           value={form.api_key_ref}
           configured={form.has_api_key}
           onChange={(value) => patch({ api_key_ref: value })}
           hint={
             form.has_api_key
               ? "Saved. Type a new key to replace it; leave blank to keep it."
-              : "From the server's Settings › General."
+              : needsAPIKey
+                ? "From the server's Settings › General."
+                : "This server type works without one."
           }
           status={<FieldError>{keyError}</FieldError>}
         />
@@ -888,7 +911,7 @@ export function RequestServerEditor({
           (probeError?.message || Object.keys(probeError?.fields ?? {}).length === 0) ? (
             <p className="text-xs text-amber-600 dark:text-amber-400">
               {probeError?.message ||
-                "Couldn't read root folders and profiles from the server. Check the URL and API key, then Test."}
+                `Couldn't read root folders and profiles from the server. Check ${connectionFields}, then Test.`}
             </p>
           ) : null}
           {optionsStatus === "idle" && detected && !test && !kindMismatch ? (
diff --git a/web/src/pages/admin-settings/RequestsSettings.test.tsx b/web/src/pages/admin-settings/RequestsSettings.test.tsx
index 1d6e358015..06737d5c39 100644
--- a/web/src/pages/admin-settings/RequestsSettings.test.tsx
+++ b/web/src/pages/admin-settings/RequestsSettings.test.tsx
@@ -1,7 +1,8 @@
 // @vitest-environment jsdom
 import { act, cleanup, fireEvent, screen, waitFor, within } from "@testing-library/react";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, onTestFinished, vi } from "vitest";
 
+import type { PluginCapability } from "@/api/types";
 import { adminKeys } from "@/hooks/queries/keys";
 
 import {
@@ -24,6 +25,7 @@ import {
   sonarr,
   stubBrowser,
 } from "./requestsSettings.fixtures";
+import { pluginInstallations } from "./requestsSettings.mockData";
 
 vi.mock("@/api/v2/request", async (importOriginal) => ({
   ...(await importOriginal<typeof import("@/api/v2/request")>()),
@@ -117,6 +119,16 @@ describe("Requests settings: general", () => {
     });
   });
 
+  // The cross-links to access groups, users, notifications and Autoscan are
+  // Hidden tier: none of them is a request setting.
+  it("shows no Related links group", async () => {
+    serve({});
+    mount();
+    await screen.findByLabelText("Request limit");
+    expect(screen.queryByRole("group", { name: "Related" })).not.toBeInTheDocument();
+    expect(screen.queryByRole("link", { name: "Notifications" })).not.toBeInTheDocument();
+  });
+
   it("saves a request limit of 0 and refuses a negative or empty one", async () => {
     serve({
       handlers: {
@@ -172,6 +184,26 @@ describe("Requests settings: general", () => {
       screen.queryByRole("switch", { name: "Request titles added to a watchlist" }),
     ).toBeNull();
   });
+
+  it("shows the 4K-for-every-title switch and saves it", async () => {
+    serve({
+      handlers: {
+        "PUT /api/v2/admin/request-settings": (options) =>
+          reply(options, { ...settings, force_dual_quality: true }, '"saved"'),
+      },
+    });
+    mount();
+    await screen.findByLabelText("Request limit");
+    const general = within(group("General"));
+    const toggle = general.getByRole("switch", { name: /4K version of every title/ });
+    expect(toggle).toHaveAttribute("aria-checked", "false");
+    fireEvent.click(toggle);
+    fireEvent.click(screen.getByRole("button", { name: "Save" }));
+    await waitFor(() => expect(calls("PUT /api/v2/admin/request-settings")).toHaveLength(1));
+    expect(calls("PUT /api/v2/admin/request-settings")[0]).toMatchObject({
+      body: { force_dual_quality: true },
+    });
+  });
 });
 
 async function openServer(name: string) {
@@ -181,6 +213,15 @@ async function openServer(name: string) {
   return screen.findByRole("dialog");
 }
 
+/** Declares, for one test, which server fields the arr plugin can do without. */
+function routerNeeds(flags: { api_key_optional: boolean; base_url_optional: boolean }) {
+  const capability: PluginCapability = pluginInstallations.data[0]!.capabilities[0]!;
+  capability.request_router = flags;
+  onTestFinished(() => {
+    delete capability.request_router;
+  });
+}
+
 describe("Requests settings: servers", () => {
   it("names each server by type and hides the switches routing owns", async () => {
     serve({
@@ -347,6 +388,87 @@ describe("Requests settings: servers", () => {
     });
   });
 
+  it("adds and tests a server without a URL or key when its plugin needs neither", async () => {
+    routerNeeds({ api_key_optional: true, base_url_optional: true });
+    serve({
+      servers: [radarr],
+      handlers: {
+        "POST /api/v2/admin/request-integrations/{id}/options": (options) =>
+          reply(options, {
+            options: {
+              ...serverOptions,
+              service_kind: [{ value: "sonarr", label: "Sonarr 4.0.14" }],
+            },
+          }),
+        "POST /api/v2/admin/request-integrations": (options) =>
+          reply(options, server("sonarr-9", "Local", "sonarr"), '"new"'),
+      },
+    });
+    mount();
+    fireEvent.click(await screen.findByRole("button", { name: "Add server" }));
+    const dialog = await screen.findByRole("dialog");
+    expect(within(dialog).getByLabelText("URL (optional)")).toBeInTheDocument();
+    expect(within(dialog).getByLabelText("API key (optional)")).toBeInTheDocument();
+    expect(within(dialog).getByText("This server type works without one.")).toBeInTheDocument();
+
+    // The plugin is asked for its choices with neither, and they fill the form.
+    expect(await within(dialog).findByText("Detected Sonarr 4.0.14.")).toBeInTheDocument();
+    const [probe] = calls("POST /api/v2/admin/request-integrations/{id}/options");
+    const probeBody = probe!.body as { base_url: string; api_key_ref?: string };
+    expect(probeBody.base_url).toBe("");
+    expect(probeBody.api_key_ref).toBeUndefined();
+    expect(within(dialog).getByRole("button", { name: "Test" })).toBeEnabled();
+
+    fireEvent.click(within(dialog).getByRole("button", { name: "Add server" }));
+    await waitFor(() => expect(calls("POST /api/v2/admin/request-integrations")).toHaveLength(1));
+    const body = calls("POST /api/v2/admin/request-integrations")[0]!.body as {
+      base_url: string;
+      api_key_ref?: string;
+    };
+    expect(body.base_url).toBe("");
+    expect(body.api_key_ref).toBeUndefined();
+  });
+
+  it("asks for a URL and a key before a server can be added or tested", async () => {
+    serve({
+      handlers: {
+        "POST /api/v2/admin/request-integrations/{id}/options": (options) =>
+          reply(options, { options: serverOptions }),
+      },
+    });
+    mount();
+    fireEvent.click(await screen.findByRole("button", { name: "Add server" }));
+    const dialog = await screen.findByRole("dialog");
+    fireEvent.change(within(dialog).getByLabelText("Name"), { target: { value: "Radarr 4K" } });
+    const add = within(dialog).getByRole("button", { name: "Add server" });
+    const test = within(dialog).getByRole("button", { name: "Test" });
+    expect(add).toBeDisabled();
+    expect(test).toBeDisabled();
+
+    fireEvent.change(within(dialog).getByLabelText("URL"), {
+      target: { value: "http://10.0.0.5:7878" },
+    });
+    expect(add).toBeDisabled();
+    expect(test).toBeDisabled();
+    expect(calls("POST /api/v2/admin/request-integrations/{id}/options")).toHaveLength(0);
+
+    fireEvent.change(within(dialog).getByLabelText("API key"), { target: { value: "key" } });
+    expect(test).toBeEnabled();
+  });
+
+  it("shows a server without a key as needing setup only when its plugin needs one", async () => {
+    serve({ servers: [{ ...radarr, has_api_key: false }] });
+    mount();
+    const tile = await screen.findByRole("group", { name: "Radarr" });
+    expect(within(tile).getByText("Needs setup")).toBeInTheDocument();
+    cleanup();
+
+    routerNeeds({ api_key_optional: true, base_url_optional: false });
+    mount();
+    const keyOptional = await screen.findByRole("group", { name: "Radarr" });
+    expect(within(keyOptional).queryByText("Needs setup")).toBeNull();
+  });
+
   it("renames a server it named when a later address answers as the other service", async () => {
     serve({
       servers: [radarr],
diff --git a/web/src/pages/admin-settings/RequestsSettings.tsx b/web/src/pages/admin-settings/RequestsSettings.tsx
index 4f41ec8c6f..c34b9a9ff7 100644
--- a/web/src/pages/admin-settings/RequestsSettings.tsx
+++ b/web/src/pages/admin-settings/RequestsSettings.tsx
@@ -23,7 +23,7 @@ import { FieldGroup } from "./FieldGroup";
 import { RequestRoutingGroup } from "./RequestRouting";
 import { RequestServersGroup } from "./RequestServers";
 import { requestRouterInstallations } from "./requestServerModel";
-import { SETTINGS_BUTTON, SettingField, SettingFieldRow, SettingFieldStatus } from "./SettingField";
+import { SettingField, SettingFieldStatus } from "./SettingField";
 import { useStagedDraft } from "./useStagedDraft";
 
 interface GeneralDraft {
@@ -278,14 +278,6 @@ function RequestsSettingsContent({ routing }: { routing: boolean }) {
                     ) : undefined
                   }
                 />
-                <SettingField
-                  label="Also request a 4K version of every title"
-                  type="toggle"
-                  description="Normally a 4K version is requested only for people whose playback limit allows 4K, and only when a server takes 4K. With this on, every request also asks for 4K."
-                  value={String(draft.force_dual_quality)}
-                  onChange={(value) => editGeneral({ force_dual_quality: value === "true" })}
-                  dirty={draft.force_dual_quality !== baseGeneral.force_dual_quality}
-                />
                 {draft.watchlist_requests !== undefined ? (
                   <SettingField
                     label="Request titles added to a watchlist"
@@ -296,6 +288,14 @@ function RequestsSettingsContent({ routing }: { routing: boolean }) {
                     dirty={draft.watchlist_requests !== baseGeneral.watchlist_requests}
                   />
                 ) : null}
+                <SettingField
+                  label="Also request a 4K version of every title"
+                  type="toggle"
+                  description="Normally a 4K version is requested only for people whose playback limit allows 4K, and only when a server takes 4K. With this on, every request also asks for 4K."
+                  value={String(draft.force_dual_quality)}
+                  onChange={(value) => editGeneral({ force_dual_quality: value === "true" })}
+                  dirty={draft.force_dual_quality !== baseGeneral.force_dual_quality}
+                />
                 {generalConflict ? (
                   <div className="py-3.5">
                     <EditorConflict onReload={reloadGeneral} />
@@ -329,36 +329,6 @@ function RequestsSettingsContent({ routing }: { routing: boolean }) {
             forceDual={general.base?.force_dual_quality ?? false}
           />
         ) : null}
-
-        <FieldGroup label="Related">
-          <SettingFieldRow
-            label="Group and account limits"
-            description="Give an access group or one account its own approval and limit. An account's own setting wins, then its group's, then the defaults above."
-          >
-            <Button asChild variant="outline" size="sm" className={SETTINGS_BUTTON}>
-              <Link to="/admin/access-groups">Access groups</Link>
-            </Button>
-            <Button asChild variant="outline" size="sm" className={SETTINGS_BUTTON}>
-              <Link to="/admin/users">Users</Link>
-            </Button>
-          </SettingFieldRow>
-          <SettingFieldRow
-            label="Request notifications"
-            description="Announce submitted, approved, declined, and fulfilled requests on Discord or a webhook."
-          >
-            <Button asChild variant="outline" size="sm" className={SETTINGS_BUTTON}>
-              <Link to="/admin/settings/notifications">Notifications</Link>
-            </Button>
-          </SettingFieldRow>
-          <SettingFieldRow
-            label="Autoscan"
-            description="Autoscan can reuse these servers to import downloads as soon as they finish."
-          >
-            <Button asChild variant="outline" size="sm" className={SETTINGS_BUTTON}>
-              <Link to="/admin/libraries?tab=autoscan">Autoscan</Link>
-            </Button>
-          </SettingFieldRow>
-        </FieldGroup>
       </div>
 
       <SaveBar
diff --git a/web/src/pages/admin-settings/SearchSettings.test.tsx b/web/src/pages/admin-settings/SearchSettings.test.tsx
new file mode 100644
index 0000000000..52659d391a
--- /dev/null
+++ b/web/src/pages/admin-settings/SearchSettings.test.tsx
@@ -0,0 +1,162 @@
+import { renderToStaticMarkup } from "react-dom/server";
+import { MemoryRouter } from "react-router";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import SearchSettings from "./SearchSettings";
+
+const useSettingsFormMock = vi.fn();
+
+vi.mock("@/hooks/useSettingsForm", () => ({
+  useSettingsForm: (...args: unknown[]) => useSettingsFormMock(...args),
+}));
+
+vi.mock("@/hooks/useRestartKeys", () => ({
+  useRestartKeys: () => new Set<string>(),
+}));
+
+vi.mock("@/hooks/queries/admin/settings", () => ({
+  useCheckAdminSettingsConnection: () => ({ mutateAsync: vi.fn(), isPending: false }),
+  useCatalogSearchStatus: () => ({ data: undefined, isLoading: true }),
+}));
+
+function makeForm(values: Record<string, string>, dirty: string[] = []) {
+  const dirtySet = new Set(dirty);
+  return {
+    isLoading: false,
+    getValue: (key: string) => values[key] ?? "",
+    getPersistedValue: (key: string) => values[key] ?? "",
+    setValue: vi.fn(),
+    resetValue: vi.fn(),
+    isDirty: (key: string) => dirtySet.has(key),
+    isClearStaged: (key: string) => dirtySet.has(key) && (values[key] ?? "") === "",
+    dirtyCount: dirtySet.size,
+    save: vi.fn(),
+    discard: vi.fn(),
+    isSaving: false,
+    restartRequired: false,
+    sensitiveConfigured: [] as string[],
+    buildConnectionCheckRequest: vi.fn(() => ({ values: {}, dirty_keys: [] })),
+  };
+}
+
+/** The page's one group, from static markup. */
+function render(values: Record<string, string>, dirty: string[] = []): HTMLElement {
+  useSettingsFormMock.mockReturnValue(makeForm(values, dirty));
+  const container = document.createElement("div");
+  container.innerHTML = renderToStaticMarkup(
+    <MemoryRouter>
+      <SearchSettings />
+    </MemoryRouter>,
+  );
+  const group = container.querySelector<HTMLElement>("section[role=group]");
+  if (!group) throw new Error("no group rendered");
+  return group;
+}
+
+/** Opens the Advanced disclosure via its persisted state. */
+function expand() {
+  localStorage.setItem("silo.admin.advanced.search", "true");
+}
+
+/** The accessible names of a group's disclosure buttons. */
+function disclosures(group: HTMLElement): string[] {
+  return Array.from(group.querySelectorAll("button[aria-expanded]"), (button) =>
+    button.getAttribute("aria-label"),
+  ).filter((label): label is string => label !== null);
+}
+
+describe("SearchSettings", () => {
+  beforeEach(() => {
+    localStorage.clear();
+  });
+
+  it("loads the search keys and leaves the hidden tier out", () => {
+    render({});
+
+    const calls = useSettingsFormMock.mock.calls;
+    const keys: string[] = calls[calls.length - 1]?.[0]?.keys ?? [];
+    expect(keys).toEqual(
+      expect.arrayContaining([
+        "catalog.search.provider",
+        "catalog.search.meilisearch.url",
+        "catalog.search.meilisearch.api_key",
+        "catalog.search.meilisearch.matching_strategy",
+        "catalog.search.meilisearch.semantic_enabled",
+        "catalog.search.meilisearch.semantic_ratio",
+      ]),
+    );
+    // Hidden tier: still saved through the API, no control on this page.
+    expect(keys).not.toContain("catalog.search.meilisearch.embedder");
+    expect(keys).not.toContain("catalog.search.meilisearch.binary_quantized");
+    expect(keys).not.toContain("catalog.search.meilisearch.rebuild_batch_size");
+  });
+
+  it("hides Meilisearch connection fields until that engine is selected", () => {
+    expand();
+    expect(render({ "catalog.search.provider": "postgres" }).textContent).not.toContain(
+      "Meilisearch URL",
+    );
+
+    expect(render({ "catalog.search.provider": "meilisearch" }).textContent).toContain(
+      "Meilisearch URL",
+    );
+  });
+
+  it("shows only the engine and a status disclosure with Postgres", () => {
+    const group = render({ "catalog.search.provider": "postgres" });
+    expect(group.querySelector("h3")?.textContent).toBe("Search");
+    expect(group.textContent).toContain(
+      "Built-in Postgres search needs no setup. Meilisearch is optional.",
+    );
+    expect(group.textContent).toContain("Search engine");
+    // Only the status panel is behind it, and that is not a setting.
+    expect(disclosures(group)).toEqual(["Advanced"]);
+  });
+
+  it("shows the Meilisearch connection and result choices, keeping tuning behind Advanced", () => {
+    const collapsed = render({ "catalog.search.provider": "meilisearch" });
+    for (const label of [
+      "Meilisearch URL",
+      "Meilisearch API key",
+      "Check Connection",
+      "When a search has several words",
+      "Match by meaning as well as words",
+    ]) {
+      expect(collapsed.textContent).toContain(label);
+    }
+    // Index prefix, timeout, batch size and the meaning-based share.
+    expect(disclosures(collapsed)).toEqual(["Advanced · 4 settings"]);
+    for (const label of [
+      "Index name prefix",
+      "Query timeout",
+      "Items sent to the index per batch",
+      "Meaning-based share of results",
+    ]) {
+      expect(collapsed.textContent).not.toContain(label);
+    }
+    expect(collapsed.querySelector("h4")).toBeNull();
+
+    expand();
+    const open = render({ "catalog.search.provider": "meilisearch" });
+    expect(open.textContent).toContain("Index name prefix");
+    expect(open.textContent).toContain("Meaning-based share of results");
+    expect(open.querySelector("h4")?.textContent).toBe("Search status");
+  });
+
+  it("keeps an unsaved Meilisearch change in view after switching back to Postgres", () => {
+    const group = render({ "catalog.search.provider": "postgres" }, [
+      "catalog.search.provider",
+      "catalog.search.meilisearch.url",
+    ]);
+
+    expect(group.textContent).toContain("Meilisearch URL");
+  });
+
+  it("opens the disclosure for an unsaved tuning change", () => {
+    const group = render({ "catalog.search.provider": "meilisearch" }, [
+      "catalog.search.meilisearch.timeout_ms",
+    ]);
+
+    expect(group.textContent).toContain("Query timeout");
+  });
+});
diff --git a/web/src/pages/admin-settings/SearchSettings.tsx b/web/src/pages/admin-settings/SearchSettings.tsx
new file mode 100644
index 0000000000..8e318a52be
--- /dev/null
+++ b/web/src/pages/admin-settings/SearchSettings.tsx
@@ -0,0 +1,278 @@
+import { useState } from "react";
+import { Link } from "react-router";
+
+import type { ConnectionCheckResponse } from "@/api/types";
+import { ConnectionCheckAction } from "@/components/admin/ConnectionCheckAction";
+import { AdvancedSection } from "@/components/settings/AdvancedSection";
+import { SecretField } from "@/components/settings/SecretField";
+import { SettingsPageHeader } from "@/components/settings/SettingsPageHeader";
+import { SettingsSubheading } from "@/components/settings/SettingsSubheading";
+import { Skeleton } from "@/components/ui/skeleton";
+import {
+  useCatalogSearchStatus,
+  useCheckAdminSettingsConnection,
+} from "@/hooks/queries/admin/settings";
+import { useRestartKeys } from "@/hooks/useRestartKeys";
+import { useSettingsForm } from "@/hooks/useSettingsForm";
+import { SaveBar } from "@/components/SaveBar";
+import { FieldGroup } from "./FieldGroup";
+import { SearchStatusPanel, SearchStatusSummary } from "./SearchStatusPanel";
+import { SettingField, SettingFieldStatus } from "./SettingField";
+
+const PROVIDER_KEY = "catalog.search.provider";
+const MEILI_URL_KEY = "catalog.search.meilisearch.url";
+const MEILI_API_KEY = "catalog.search.meilisearch.api_key";
+
+// Reaching Meilisearch and the two choices that change what a search returns
+// are shown once it is selected; the index name, timing and ranking mix are
+// tuning behind Advanced.
+const MEILI_SHOWN_KEYS = [
+  MEILI_URL_KEY,
+  MEILI_API_KEY,
+  "catalog.search.meilisearch.matching_strategy",
+  "catalog.search.meilisearch.semantic_enabled",
+];
+
+const MEILI_ADVANCED_KEYS = [
+  "catalog.search.meilisearch.index",
+  "catalog.search.meilisearch.timeout_ms",
+  "catalog.search.meilisearch.sync_batch_size",
+  "catalog.search.meilisearch.semantic_ratio",
+];
+
+const MEILI_KEYS = [...MEILI_SHOWN_KEYS, ...MEILI_ADVANCED_KEYS];
+
+// Hidden tier: still saved and readable through the settings API, deliberately
+// without a control here because the defaults are right for every deployment we
+// support — catalog.search.meilisearch.{rebuild_batch_size,
+// rebuild_task_queue_depth,index_types,embedder,binary_quantized}.
+const KEYS = [PROVIDER_KEY, ...MEILI_KEYS];
+
+export default function SearchSettings() {
+  const form = useSettingsForm({ keys: KEYS });
+  const restartKeys = useRestartKeys();
+  const checkConnection = useCheckAdminSettingsConnection();
+  const [connectionResult, setConnectionResult] = useState<ConnectionCheckResponse | null>(null);
+
+  const provider = form.getValue(PROVIDER_KEY) || "postgres";
+  const meiliEnabled = provider === "meilisearch";
+  const { data: searchStatus } = useCatalogSearchStatus(meiliEnabled);
+  const anyDirty = (keys: string[]) => keys.some((key) => form.isDirty(key));
+  // Staged Meilisearch edits stay reachable after switching the provider back,
+  // so the save bar can never count a change the admin cannot see.
+  const showMeili = meiliEnabled || anyDirty(MEILI_KEYS);
+  const enablingSemanticSearch =
+    form.isDirty("catalog.search.meilisearch.semantic_enabled") &&
+    form.getPersistedValue("catalog.search.meilisearch.semantic_enabled") !== "true" &&
+    form.getValue("catalog.search.meilisearch.semantic_enabled") === "true";
+
+  async function handleCheckConnection() {
+    try {
+      setConnectionResult(
+        await checkConnection.mutateAsync({
+          kind: "meilisearch",
+          body: form.buildConnectionCheckRequest(MEILI_KEYS),
+        }),
+      );
+    } catch (error) {
+      setConnectionResult({
+        success: false,
+        message: error instanceof Error ? error.message : "Connection check failed.",
+      });
+    }
+  }
+
+  if (form.isLoading) {
+    return (
+      <div className="space-y-6" role="status" aria-label="Loading settings">
+        <Skeleton className="h-8 w-48" />
+        <Skeleton className="h-32 w-full" />
+        <span className="sr-only">Loading settings</span>
+      </div>
+    );
+  }
+
+  return (
+    <div className="flex h-full flex-col">
+      <SettingsPageHeader title="Search" />
+
+      <div className="flex-1 space-y-5">
+        <FieldGroup
+          label="Search"
+          description="Built-in Postgres search needs no setup. Meilisearch is optional."
+          restartAll={KEYS.every((key) => restartKeys.has(key))}
+          dirty={anyDirty(KEYS)}
+        >
+          <SettingField
+            label="Search engine"
+            type="select"
+            description="Meilisearch tolerates typos but runs as its own service. If it goes down, search falls back to the built-in engine automatically."
+            value={provider}
+            onChange={(value) => form.setValue(PROVIDER_KEY, value)}
+            options={[
+              { value: "postgres", label: "Built-in (Postgres)" },
+              { value: "meilisearch", label: "Meilisearch" },
+            ]}
+            status={meiliEnabled && !searchStatus?.degraded ? <SearchStatusSummary /> : undefined}
+            restartRequired={restartKeys.has(PROVIDER_KEY)}
+          />
+          {meiliEnabled && searchStatus?.degraded && (
+            <div className="py-3.5">
+              <SettingFieldStatus tone="warn">
+                <span>
+                  {searchStatus.degraded_reason ?? "Search is running in a degraded mode."}
+                  {searchStatus.index.rebuild_required && (
+                    <>
+                      {" "}
+                      Automatic search maintenance rebuilds the index in the background and retries
+                      if needed.{" "}
+                      <Link
+                        className="font-medium underline underline-offset-2"
+                        to="/admin/tasks/sync_catalog_search_index"
+                      >
+                        Open maintenance task
+                      </Link>
+                      .
+                    </>
+                  )}
+                </span>
+              </SettingFieldStatus>
+            </div>
+          )}
+
+          {showMeili && (
+            <>
+              <SettingField
+                label="Meilisearch URL"
+                value={form.getValue(MEILI_URL_KEY)}
+                onChange={(value) => form.setValue(MEILI_URL_KEY, value)}
+                hint="http://localhost:7700"
+                disabled={!meiliEnabled}
+                restartRequired={restartKeys.has(MEILI_URL_KEY)}
+              />
+              <SecretField
+                label="Meilisearch API key"
+                value={form.getValue(MEILI_API_KEY)}
+                configured={form.sensitiveConfigured.includes(MEILI_API_KEY)}
+                onChange={(value) => form.setValue(MEILI_API_KEY, value)}
+                onKeep={() => form.resetValue(MEILI_API_KEY)}
+                // Nothing else on this page can empty the stored key, and a
+                // Meilisearch instance without a master key needs it empty.
+                onClear={() => form.setValue(MEILI_API_KEY, "")}
+                cleared={form.isClearStaged(MEILI_API_KEY)}
+                hint="Master key, or one that can read and write the index."
+                disabled={!meiliEnabled}
+                restartRequired={restartKeys.has(MEILI_API_KEY)}
+              />
+              <ConnectionCheckAction
+                onClick={handleCheckConnection}
+                result={connectionResult}
+                isPending={checkConnection.isPending}
+                disabled={!meiliEnabled}
+              />
+              <SettingField
+                label="When a search has several words"
+                type="select"
+                value={form.getValue("catalog.search.meilisearch.matching_strategy") || "last"}
+                onChange={(value) =>
+                  form.setValue("catalog.search.meilisearch.matching_strategy", value)
+                }
+                options={[
+                  { value: "last", label: "Drop trailing words until something matches" },
+                  { value: "all", label: "Require every word" },
+                ]}
+                disabled={!meiliEnabled}
+                restartRequired={restartKeys.has("catalog.search.meilisearch.matching_strategy")}
+              />
+              <SettingField
+                label="Match by meaning as well as words"
+                type="toggle"
+                value={form.getValue("catalog.search.meilisearch.semantic_enabled") || "false"}
+                onChange={(value) =>
+                  form.setValue("catalog.search.meilisearch.semantic_enabled", value)
+                }
+                description="Also matches items whose description means something similar."
+                status={
+                  enablingSemanticSearch ? (
+                    <SettingFieldStatus tone="warn">
+                      Enabling this changes the index format. After you save and restart, Prairie
+                      rebuilds the index automatically. Keyword search stays available while it
+                      rebuilds.
+                    </SettingFieldStatus>
+                  ) : undefined
+                }
+                disabled={!meiliEnabled}
+                restartRequired={restartKeys.has("catalog.search.meilisearch.semantic_enabled")}
+              />
+            </>
+          )}
+
+          {/* The status panel is not a setting, so it is not counted; with
+              Postgres the disclosure holds nothing else. */}
+          <AdvancedSection
+            id="search"
+            count={showMeili ? MEILI_ADVANCED_KEYS.length : undefined}
+            forceOpen={anyDirty(MEILI_ADVANCED_KEYS)}
+          >
+            {showMeili && (
+              <>
+                <SettingField
+                  label="Index name prefix"
+                  value={form.getValue("catalog.search.meilisearch.index") || "prairie_media_items"}
+                  onChange={(value) => form.setValue("catalog.search.meilisearch.index", value)}
+                  description="Only needed when Prairie servers share one Meilisearch."
+                  disabled={!meiliEnabled}
+                  restartRequired={restartKeys.has("catalog.search.meilisearch.index")}
+                />
+                <SettingField
+                  label="Query timeout"
+                  type="number"
+                  unit="ms"
+                  value={form.getValue("catalog.search.meilisearch.timeout_ms") || "800"}
+                  onChange={(value) =>
+                    form.setValue("catalog.search.meilisearch.timeout_ms", value)
+                  }
+                  description="Searches that take longer fall back to the built-in engine."
+                  disabled={!meiliEnabled}
+                  restartRequired={restartKeys.has("catalog.search.meilisearch.timeout_ms")}
+                />
+                <SettingField
+                  label="Items sent to the index per batch"
+                  type="number"
+                  value={form.getValue("catalog.search.meilisearch.sync_batch_size") || "500"}
+                  onChange={(value) =>
+                    form.setValue("catalog.search.meilisearch.sync_batch_size", value)
+                  }
+                  description="Larger batches index faster and use more memory."
+                  disabled={!meiliEnabled}
+                  restartRequired={restartKeys.has("catalog.search.meilisearch.sync_batch_size")}
+                />
+                <SettingField
+                  label="Meaning-based share of results"
+                  type="number"
+                  value={form.getValue("catalog.search.meilisearch.semantic_ratio") || "0.50"}
+                  onChange={(value) =>
+                    form.setValue("catalog.search.meilisearch.semantic_ratio", value)
+                  }
+                  description="0 ranks by words, 1 by meaning."
+                  disabled={!meiliEnabled}
+                  restartRequired={restartKeys.has("catalog.search.meilisearch.semantic_ratio")}
+                />
+              </>
+            )}
+
+            <SettingsSubheading>Search status</SettingsSubheading>
+            <SearchStatusPanel />
+          </AdvancedSection>
+        </FieldGroup>
+      </div>
+
+      <SaveBar
+        dirtyCount={form.dirtyCount}
+        onSave={form.save}
+        onDiscard={form.discard}
+        isSaving={form.isSaving}
+      />
+    </div>
+  );
+}
diff --git a/web/src/pages/admin-settings/SearchStatusPanel.tsx b/web/src/pages/admin-settings/SearchStatusPanel.tsx
index b8b0e1f08e..0103b6ed02 100644
--- a/web/src/pages/admin-settings/SearchStatusPanel.tsx
+++ b/web/src/pages/admin-settings/SearchStatusPanel.tsx
@@ -153,6 +153,22 @@ export function SearchStatusPanel() {
   );
 }
 
+/**
+ * One line of the index status for the Search engine row, so an admin sees
+ * whether Meilisearch is keeping up without opening Advanced. Shares the
+ * status query with the full panel.
+ */
+export function SearchStatusSummary() {
+  const { data: status } = useCatalogSearchStatus();
+  if (!status) return null;
+  const lastSync = formatStatusDate(status.index.last_sync_at) || "never";
+  return (
+    <SettingFieldStatus tone="muted">
+      {`Last sync ${lastSync} · ${status.index.document_count.toLocaleString()} items indexed`}
+    </SettingFieldStatus>
+  );
+}
+
 /** The two index maintenance tasks. Shown whether or not the status resolved. */
 function SearchTaskLinks() {
   return (
diff --git a/web/src/pages/admin-settings/SecurityAccessSettings.test.tsx b/web/src/pages/admin-settings/SecurityAccessSettings.test.tsx
index 99d9808c8d..81f36a4c5f 100644
--- a/web/src/pages/admin-settings/SecurityAccessSettings.test.tsx
+++ b/web/src/pages/admin-settings/SecurityAccessSettings.test.tsx
@@ -1,4 +1,4 @@
-import { render, screen, waitFor } from "@testing-library/react";
+import { render, screen, waitFor, within } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
@@ -35,7 +35,7 @@ vi.mock("@/hooks/useUnsavedChanges", () => ({
 }));
 
 vi.mock("@/hooks/useRestartKeys", () => ({
-  useRestartKeys: () => new Set<string>(["auth.access_token_expiry"]),
+  useRestartKeys: () => new Set<string>(),
 }));
 
 vi.mock("@/hooks/queries/admin/rateLimits", () => ({
@@ -73,10 +73,9 @@ const SERVER_CONFIG: RateLimitConfig = {
   redis_available: true,
 };
 
-const REDIS_HINT = /Configure Redis under Storage & Database first/;
+const REDIS_HINT = /Set up Redis on the General page first/;
 
 async function openBackendSelect() {
-  await userEvent.click(screen.getByRole("button", { name: /Advanced/i }));
   await userEvent.click(screen.getByRole("combobox", { name: /Where counters are kept/i }));
 }
 
@@ -113,6 +112,53 @@ describe("SecurityAccessSettings", () => {
     });
   });
 
+  // Token lifetimes moved to Sign-in and trusted proxies to General; their tests
+  // live in SignInSettings.test.tsx and GeneralSettings.test.tsx.
+  it("manages only the local network key through the settings batch", () => {
+    render(<SecurityAccessSettings />);
+
+    expect(useSettingsFormMock.mock.calls[0]?.[0]?.keys).toEqual([
+      "media_servers.allow_private_destinations",
+    ]);
+    expect(screen.getByRole("heading", { name: "Security" })).toBeInTheDocument();
+    expect(screen.getAllByRole("heading", { level: 3 }).map((h) => h.textContent)).toEqual([
+      "Local network",
+      "Rate limiting",
+    ]);
+    expect(screen.queryByLabelText("Access token expiry")).not.toBeInTheDocument();
+    expect(screen.queryByLabelText("Trusted proxies")).not.toBeInTheDocument();
+  });
+
+  it("shows every rate limit in the group, with no disclosure", () => {
+    render(<SecurityAccessSettings />);
+    const group = screen.getByRole("group", { name: "Rate limiting" });
+    const rateLimiting = within(group);
+
+    expect(rateLimiting.getByRole("switch", { name: /Enable rate limiting/i })).toBeVisible();
+    expect(rateLimiting.queryByRole("button", { name: /settings$/ })).not.toBeInTheDocument();
+    expect(rateLimiting.getByRole("combobox", { name: /Where counters are kept/i })).toBeVisible();
+    expect(rateLimiting.getByLabelText("Whole-server limit")).toBeVisible();
+    expect(rateLimiting.getByText("Per client address")).toBeVisible();
+    expect(rateLimiting.getByRole("heading", { level: 4, name: "API key tiers" })).toBeVisible();
+    expect(rateLimiting.getByText("Standard API keys")).toBeVisible();
+    expect(rateLimiting.getByText("Elevated API keys")).toBeVisible();
+    expect(
+      rateLimiting.getByRole("heading", { level: 4, name: "Sign-in and webhook endpoints" }),
+    ).toBeVisible();
+    expect(rateLimiting.getByText("Sign in")).toBeVisible();
+    expect(rateLimiting.getByText("Autoscan webhook")).toBeVisible();
+  });
+
+  it("stages an API key tier edit on the shared save bar", async () => {
+    render(<SecurityAccessSettings />);
+
+    const standardBurst = screen
+      .getAllByLabelText("Burst")
+      .find((input) => (input as HTMLInputElement).value === "20") as HTMLInputElement;
+    await userEvent.type(standardBurst, "1");
+    expect(screen.getByText("1 unsaved change")).toBeInTheDocument();
+  });
+
   it("reports a rate-limit-only draft to the unsaved-changes registry", async () => {
     render(<SecurityAccessSettings />);
     expect(reportUnsavedMock).toHaveBeenLastCalledWith(false);
@@ -146,8 +192,6 @@ describe("SecurityAccessSettings", () => {
   it("stages an edited rate-limit row on the shared save bar", async () => {
     render(<SecurityAccessSettings />);
 
-    await userEvent.click(screen.getByRole("button", { name: /Advanced/i }));
-
     // The control rejects empty/zero input, so append rather than clear first.
     const rpsInput = screen.getByLabelText("Whole-server limit") as HTMLInputElement;
     await userEvent.type(rpsInput, "5");
@@ -223,7 +267,7 @@ describe("SecurityAccessSettings", () => {
     expect(screen.queryByText(REDIS_HINT)).not.toBeInTheDocument();
   });
 
-  it("disables the Redis backend and points at Storage & Database when Redis is unconfigured", async () => {
+  it("disables the Redis backend and points at General when Redis is unconfigured", async () => {
     rateLimitConfigMock.mockReturnValue({
       data: { ...SERVER_CONFIG, redis_available: false },
       isLoading: false,
@@ -250,7 +294,6 @@ describe("SecurityAccessSettings", () => {
     });
 
     render(<SecurityAccessSettings />);
-    await userEvent.click(screen.getByRole("button", { name: /Advanced/i }));
 
     expect(
       screen.getByText(/running limiter is using in-memory counters, not the saved Redis/i),
@@ -275,7 +318,6 @@ describe("SecurityAccessSettings", () => {
     });
 
     render(<SecurityAccessSettings />);
-    await userEvent.click(screen.getByRole("button", { name: /Advanced/i }));
 
     expect(screen.queryByText(/no limiter is running/i)).not.toBeInTheDocument();
     expect(screen.queryByText(/running limiter is using/i)).not.toBeInTheDocument();
diff --git a/web/src/pages/admin-settings/SecurityAccessSettings.tsx b/web/src/pages/admin-settings/SecurityAccessSettings.tsx
index 316f3c378a..ed7f770bd2 100644
--- a/web/src/pages/admin-settings/SecurityAccessSettings.tsx
+++ b/web/src/pages/admin-settings/SecurityAccessSettings.tsx
@@ -6,7 +6,6 @@ import type {
   RateLimitConfig,
   RateLimitTierConfig,
 } from "@/api/types";
-import { AdvancedSection } from "@/components/settings/AdvancedSection";
 import { SettingsPageHeader } from "@/components/settings/SettingsPageHeader";
 import { SettingsSubheading } from "@/components/settings/SettingsSubheading";
 import { Input } from "@/components/ui/input";
@@ -34,15 +33,14 @@ import {
   SettingFieldStatus,
 } from "./SettingField";
 
-// Sign-in lifetimes, proxy trust, and local media server access go through the
-// batched settings endpoint. Rate limits do not: they live behind
-// /admin/rate-limits/config and the batch endpoint rejects those keys, so this
-// page drives two writers behind one save bar rather than showing the admin two
-// different Save buttons.
-const SESSION_KEYS = ["auth.access_token_expiry", "auth.refresh_token_expiry"];
+// Local media server access goes through the batched settings endpoint. Rate
+// limits do not: they live behind /admin/rate-limits/config and the batch
+// endpoint rejects those keys, so this page drives two writers behind one save
+// bar rather than showing the admin two different Save buttons. Token lifetimes
+// live on Sign-in, with the rest of what decides how long a sign-in lasts, and
+// trusted proxies on General, beside the public URL.
 const LOCAL_MEDIA_SERVERS_KEY = "media_servers.allow_private_destinations";
-const NETWORK_KEYS = ["clientip.trusted_proxies", LOCAL_MEDIA_SERVERS_KEY];
-const KEYS = [...SESSION_KEYS, ...NETWORK_KEYS];
+const LOCAL_NETWORK_KEYS = [LOCAL_MEDIA_SERVERS_KEY];
 
 const DEFAULT_TIER: RateLimitTierConfig = {
   requests_per_second: 10,
@@ -117,7 +115,7 @@ function RateBox({
 }) {
   return (
     <span className="flex flex-col items-end gap-1">
-      <Label htmlFor={id} className="text-muted-foreground text-[11px] font-normal">
+      <Label htmlFor={id} className="text-muted-foreground text-xs font-normal">
         {caption}
       </Label>
       <Input
@@ -174,13 +172,12 @@ function RateTriadRow({
 }
 
 export default function SecurityAccessSettings() {
-  const form = useSettingsForm({ keys: useMemo(() => KEYS, []) });
+  const form = useSettingsForm({ keys: useMemo(() => LOCAL_NETWORK_KEYS, []) });
   const restartKeys = useRestartKeys();
   const allRestart = (keys: string[]) => keys.every((key) => restartKeys.has(key));
   const { data: serverConfig, isLoading: rateLimitsLoading } = useRateLimitConfig();
   const updateConfig = useUpdateRateLimitConfig();
 
-  const trustedProxiesManaged = form.sensitiveManagedByEnv.includes("clientip.trusted_proxies");
   const localMediaServersAllowed = form.getValue(LOCAL_MEDIA_SERVERS_KEY) === "true";
 
   // The save endpoint rejects the Redis backend unless Redis is configured, so
@@ -289,13 +286,6 @@ export default function SecurityAccessSettings() {
   // itself to the unsaved-changes registry on its own — otherwise the
   // navigation guard and the reload prompt only know about the batched keys.
   useReportUnsavedChanges(rateLimitsDirty);
-  // Everything except the on/off switch lives in the disclosure, so compare the
-  // two with `enabled` normalised away to decide whether to force it open.
-  const advancedDirty =
-    JSON.stringify({ ...config, enabled: true }) !==
-    JSON.stringify({ ...hydratedConfig, enabled: true });
-  const advancedCount =
-    2 + 3 + Object.keys(TIER_LABELS).length * 3 + Object.keys(AUTH_ENDPOINT_LABELS).length * 2;
 
   /**
    * One Save, two writers — and they are ordered, not concurrent. The
@@ -352,42 +342,10 @@ export default function SecurityAccessSettings() {
 
   return (
     <div className="flex h-full flex-col">
-      <SettingsPageHeader title="Security & Access" className="mb-8" />
+      <SettingsPageHeader title="Security" />
 
       <div className="flex-1 space-y-5">
-        <FieldGroup label="Sign-in sessions" restartAll={allRestart(SESSION_KEYS)}>
-          <SettingField
-            label="Access token expiry"
-            type="duration"
-            description="How long before an app silently renews, e.g. 30m."
-            value={form.getValue("auth.access_token_expiry")}
-            onChange={(v) => form.setValue("auth.access_token_expiry", v)}
-            restartRequired={restartKeys.has("auth.access_token_expiry")}
-          />
-          <SettingField
-            label="Refresh token expiry"
-            type="duration"
-            description="How long someone stays signed in, e.g. 30d. Also how long an account whose sign-in provider can't re-check it keeps its API keys and Audiobookshelf sessions without signing in through the provider."
-            value={form.getValue("auth.refresh_token_expiry")}
-            onChange={(v) => form.setValue("auth.refresh_token_expiry", v)}
-            restartRequired={restartKeys.has("auth.refresh_token_expiry")}
-          />
-        </FieldGroup>
-
-        <FieldGroup label="Network" restartAll={allRestart(NETWORK_KEYS)}>
-          <SettingField
-            label="Trusted proxies"
-            description={
-              trustedProxiesManaged
-                ? "Managed by PRAIRIE_TRUSTED_PROXIES."
-                : "Comma-separated proxy ranges; empty keeps the private defaults."
-            }
-            hint="172.16.0.0/12, 203.0.113.7/32"
-            value={form.getValue("clientip.trusted_proxies")}
-            onChange={(v) => form.setValue("clientip.trusted_proxies", v)}
-            disabled={trustedProxiesManaged}
-            restartRequired={restartKeys.has("clientip.trusted_proxies")}
-          />
+        <FieldGroup label="Local network" restartAll={allRestart(LOCAL_NETWORK_KEYS)}>
           <SettingField
             label="Local servers for every account"
             description="Lets every account import history from, and sync with, Plex, Emby, and Jellyfin servers at local network addresses such as 192.168.x.x or localhost. Admins always can."
@@ -424,154 +382,134 @@ export default function SecurityAccessSettings() {
             }
           />
 
-          <AdvancedSection
-            id="security.rate-limits"
-            count={advancedCount}
-            forceOpen={advancedDirty}
+          <SettingFieldRow
+            label="Where counters are kept"
+            htmlFor="rate-limit-backend"
+            description={
+              redisSelectable
+                ? "Redis shares counters across servers, after a restart."
+                : "Redis shares counters across servers, after a restart. Set up Redis on the General page first."
+            }
+            status={
+              runningBackendDiffers ? (
+                <SettingFieldStatus tone="warn">
+                  The running limiter is using {backendNoun(runningBackend)} counters, not the saved{" "}
+                  {backendNoun(savedBackend)} backend. If a restart does not fix it, check that the
+                  saved backend is reachable.
+                </SettingFieldStatus>
+              ) : undefined
+            }
           >
-            <SettingFieldRow
-              label="Where counters are kept"
-              htmlFor="rate-limit-backend"
-              description={
-                redisSelectable
-                  ? "Redis shares counters across servers, after a restart."
-                  : "Redis shares counters across servers, after a restart. Configure Redis under Storage & Database first."
-              }
-              status={
-                runningBackendDiffers ? (
-                  <SettingFieldStatus tone="warn">
-                    The running limiter is using {backendNoun(runningBackend)} counters, not the
-                    saved {backendNoun(savedBackend)} backend. If a restart does not fix it, check
-                    that the saved backend is reachable.
-                  </SettingFieldStatus>
-                ) : undefined
-              }
-            >
-              <Select
-                value={config.backend}
-                onValueChange={(value) =>
-                  updateConfigState((prev) => ({ ...prev, backend: value }))
-                }
-                disabled={savingRateLimits}
-              >
-                <SelectTrigger id="rate-limit-backend" className={SETTINGS_CONTROL_WIDTH}>
-                  <SelectValue />
-                </SelectTrigger>
-                <SelectContent>
-                  <SelectItem value="memory">This server only</SelectItem>
-                  <SelectItem value="redis" disabled={!redisSelectable}>
-                    Shared via Redis
-                  </SelectItem>
-                </SelectContent>
-              </Select>
-            </SettingFieldRow>
-
-            <SettingFieldRow
-              label="Whole-server limit"
-              htmlFor="global-rps"
-              description="Ceiling across every rate-limited route."
-              // The row's unit slot rather than a span beside the input: the
-              // triad rows below have no unit, and an inline one here would
-              // push this box off the column they share.
-              unit="per second"
+            <Select
+              value={config.backend}
+              onValueChange={(value) => updateConfigState((prev) => ({ ...prev, backend: value }))}
+              disabled={savingRateLimits}
             >
-              <Input
-                id="global-rps"
-                type="number"
-                min={1}
-                value={config.global_requests_per_second}
-                onChange={(e) =>
-                  setNumber((num) =>
-                    updateConfigState((prev) => ({
-                      ...prev,
-                      global_requests_per_second: num,
-                    })),
-                  )(e.target.value)
-                }
-                disabled={savingRateLimits}
-                className={cn("text-right tabular-nums", SETTINGS_NUMBER_WIDTH)}
-              />
-            </SettingFieldRow>
-
-            <RateTriadRow
-              label="Per client address"
-              description="Budget one IP address gets."
+              <SelectTrigger id="rate-limit-backend" className={SETTINGS_CONTROL_WIDTH}>
+                <SelectValue />
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem value="memory">This server only</SelectItem>
+                <SelectItem value="redis" disabled={!redisSelectable}>
+                  Shared via Redis
+                </SelectItem>
+              </SelectContent>
+            </Select>
+          </SettingFieldRow>
+
+          <SettingFieldRow
+            label="Whole-server limit"
+            htmlFor="global-rps"
+            description="Ceiling across every rate-limited route."
+            // The row's unit slot rather than a span beside the input: the
+            // triad rows below have no unit, and an inline one here would
+            // push this box off the column they share.
+            unit="per second"
+          >
+            <Input
+              id="global-rps"
+              type="number"
+              min={1}
+              value={config.global_requests_per_second}
+              onChange={(e) =>
+                setNumber((num) =>
+                  updateConfigState((prev) => ({ ...prev, global_requests_per_second: num })),
+                )(e.target.value)
+              }
               disabled={savingRateLimits}
-              perSecond={{
-                value: config.ip_requests_per_second,
-                onChange: setNumber((num) =>
-                  updateConfigState((prev) => ({
-                    ...prev,
-                    ip_requests_per_second: num,
-                  })),
-                ),
-              }}
-              perMinute={{
-                value: config.ip_requests_per_minute,
-                onChange: setNumber((num) =>
-                  updateConfigState((prev) => ({
-                    ...prev,
-                    ip_requests_per_minute: num,
-                  })),
-                ),
-              }}
-              burst={{
-                value: config.ip_burst,
-                onChange: setNumber((num) =>
-                  updateConfigState((prev) => ({ ...prev, ip_burst: num })),
-                ),
-              }}
+              className={cn("text-right tabular-nums", SETTINGS_NUMBER_WIDTH)}
             />
+          </SettingFieldRow>
+
+          <RateTriadRow
+            label="Per client address"
+            description="Budget one IP address gets."
+            disabled={savingRateLimits}
+            perSecond={{
+              value: config.ip_requests_per_second,
+              onChange: setNumber((num) =>
+                updateConfigState((prev) => ({ ...prev, ip_requests_per_second: num })),
+              ),
+            }}
+            perMinute={{
+              value: config.ip_requests_per_minute,
+              onChange: setNumber((num) =>
+                updateConfigState((prev) => ({ ...prev, ip_requests_per_minute: num })),
+              ),
+            }}
+            burst={{
+              value: config.ip_burst,
+              onChange: setNumber((num) =>
+                updateConfigState((prev) => ({ ...prev, ip_burst: num })),
+              ),
+            }}
+          />
 
-            {Object.keys(TIER_LABELS).map((tier) => {
-              const tierConfig = config.tiers[tier] ?? DEFAULT_TIER;
-              return (
-                <RateTriadRow
-                  key={tier}
-                  label={TIER_LABELS[tier]!}
-                  disabled={savingRateLimits}
-                  perSecond={{
-                    value: tierConfig.requests_per_second,
-                    onChange: setNumber((num) =>
-                      handleTierChange(tier, "requests_per_second", num),
-                    ),
-                  }}
-                  perMinute={{
-                    value: tierConfig.requests_per_minute,
-                    onChange: setNumber((num) =>
-                      handleTierChange(tier, "requests_per_minute", num),
-                    ),
-                  }}
-                  burst={{
-                    value: tierConfig.burst,
-                    onChange: setNumber((num) => handleTierChange(tier, "burst", num)),
-                  }}
-                />
-              );
-            })}
-
-            <SettingsSubheading>Sign-in and webhook endpoints</SettingsSubheading>
-            {Object.keys(AUTH_ENDPOINT_LABELS).map((endpoint) => {
-              const epConfig = config.auth_endpoints[endpoint] ?? DEFAULT_AUTH_ENDPOINT;
-              return (
-                <RateTriadRow
-                  key={endpoint}
-                  label={AUTH_ENDPOINT_LABELS[endpoint]!}
-                  disabled={savingRateLimits}
-                  perMinute={{
-                    value: epConfig.requests_per_minute,
-                    onChange: setNumber((num) =>
-                      handleAuthEndpointChange(endpoint, "requests_per_minute", num),
-                    ),
-                  }}
-                  burst={{
-                    value: epConfig.burst,
-                    onChange: setNumber((num) => handleAuthEndpointChange(endpoint, "burst", num)),
-                  }}
-                />
-              );
-            })}
-          </AdvancedSection>
+          <SettingsSubheading>API key tiers</SettingsSubheading>
+          {Object.keys(TIER_LABELS).map((tier) => {
+            const tierConfig = config.tiers[tier] ?? DEFAULT_TIER;
+            return (
+              <RateTriadRow
+                key={tier}
+                label={TIER_LABELS[tier]!}
+                disabled={savingRateLimits}
+                perSecond={{
+                  value: tierConfig.requests_per_second,
+                  onChange: setNumber((num) => handleTierChange(tier, "requests_per_second", num)),
+                }}
+                perMinute={{
+                  value: tierConfig.requests_per_minute,
+                  onChange: setNumber((num) => handleTierChange(tier, "requests_per_minute", num)),
+                }}
+                burst={{
+                  value: tierConfig.burst,
+                  onChange: setNumber((num) => handleTierChange(tier, "burst", num)),
+                }}
+              />
+            );
+          })}
+
+          <SettingsSubheading>Sign-in and webhook endpoints</SettingsSubheading>
+          {Object.keys(AUTH_ENDPOINT_LABELS).map((endpoint) => {
+            const epConfig = config.auth_endpoints[endpoint] ?? DEFAULT_AUTH_ENDPOINT;
+            return (
+              <RateTriadRow
+                key={endpoint}
+                label={AUTH_ENDPOINT_LABELS[endpoint]!}
+                disabled={savingRateLimits}
+                perMinute={{
+                  value: epConfig.requests_per_minute,
+                  onChange: setNumber((num) =>
+                    handleAuthEndpointChange(endpoint, "requests_per_minute", num),
+                  ),
+                }}
+                burst={{
+                  value: epConfig.burst,
+                  onChange: setNumber((num) => handleAuthEndpointChange(endpoint, "burst", num)),
+                }}
+              />
+            );
+          })}
         </FieldGroup>
       </div>
 
diff --git a/web/src/pages/admin-settings/SettingField.tsx b/web/src/pages/admin-settings/SettingField.tsx
index 27ff824b11..475109b2ca 100644
--- a/web/src/pages/admin-settings/SettingField.tsx
+++ b/web/src/pages/admin-settings/SettingField.tsx
@@ -55,7 +55,7 @@ export function SettingFieldStatus({
   return (
     <span
       className={cn(
-        "inline-flex items-center gap-1.5 text-[12.5px] leading-snug",
+        "inline-flex items-center gap-1.5 text-[13px] leading-snug",
         tone === "ok" && "text-green-600 dark:text-green-400",
         tone === "warn" && "text-amber-600 dark:text-amber-400",
         tone === "muted" && "text-muted-foreground",
@@ -71,12 +71,6 @@ export interface SettingFieldRowProps {
   label: ReactNode;
   /** Ties the label to the control; omit for rows whose control has no id. */
   htmlFor?: string;
-  /**
-   * The `server_settings` key behind the row, e.g. `branding.server_name`.
-   * Rendered as a small mono caption under the label so an admin can match
-   * what they see to the API, environment overrides, and support answers.
-   */
-  settingKey?: string;
   /** The row has an unsaved edit; shows the accent dot before the label. */
   dirty?: boolean;
   /** Description under the label. One short sentence, or nothing at all. */
@@ -107,7 +101,6 @@ export interface SettingFieldRowProps {
 export function SettingFieldRow({
   label,
   htmlFor,
-  settingKey,
   dirty,
   description,
   descriptionId,
@@ -142,13 +135,8 @@ export function SettingFieldRow({
           </Label>
           {restartRequired && !groupSaysRestart && <RestartBadge />}
         </div>
-        {settingKey ? (
-          <span className="text-muted-foreground/70 mt-0.5 block font-mono text-[10px] tracking-[0.02em]">
-            {settingKey}
-          </span>
-        ) : null}
         {description ? (
-          <p id={descriptionId} className="text-muted-foreground mt-1 text-xs leading-relaxed">
+          <p id={descriptionId} className="text-muted-foreground mt-1 text-[13px] leading-relaxed">
             {description}
           </p>
         ) : null}
@@ -166,7 +154,7 @@ export function SettingFieldRow({
           {children}
         </div>
         {unit ? (
-          <span className="text-muted-foreground shrink-0 text-xs whitespace-nowrap sm:w-[var(--settings-unit-w)]">
+          <span className="text-muted-foreground shrink-0 text-[13px] whitespace-nowrap sm:w-[var(--settings-unit-w)]">
             {unit}
           </span>
         ) : (
@@ -184,8 +172,6 @@ export function SettingFieldRow({
 
 interface SettingFieldProps {
   label: string;
-  /** The `server_settings` key, shown as a mono caption under the label. */
-  settingKey?: string;
   /** The field has an unsaved edit; drive it from `form.isDirty(key)`. */
   dirty?: boolean;
   type?: "text" | "number" | "password" | "toggle" | "duration" | "select";
@@ -212,7 +198,6 @@ interface SettingFieldProps {
 
 export function SettingField({
   label,
-  settingKey,
   dirty,
   type = "text",
   hint,
@@ -240,7 +225,6 @@ export function SettingField({
     <SettingFieldRow
       label={label}
       htmlFor={controlId}
-      settingKey={settingKey}
       dirty={dirty}
       description={rowDescription}
       descriptionId={hintId}
diff --git a/web/src/pages/admin-settings/SettingsOverview.tsx b/web/src/pages/admin-settings/SettingsOverview.tsx
deleted file mode 100644
index d3f18817ca..0000000000
--- a/web/src/pages/admin-settings/SettingsOverview.tsx
+++ /dev/null
@@ -1,81 +0,0 @@
-import { CircleCheck } from "lucide-react";
-
-import { useSettingsOverview } from "@/hooks/admin/useSettingsOverview";
-import { HealthTile, HealthTileSkeleton, SectionCard, SectionCardSkeleton } from "./overviewCards";
-
-const SKELETON_TILES = [0, 1];
-const SKELETON_CARDS = [0, 1, 2, 3, 4, 5];
-
-/**
- * The settings landing page: whatever needs the admin across the top, then one
- * directory of settings categories. Mounted at the settings index route.
- */
-export default function SettingsOverview() {
-  const { isLoading, tiles, cards } = useSettingsOverview();
-
-  // Keep this focused on actionable setup and health items rather than
-  // presenting every configured integration as a wall of green tiles.
-  const attentionTiles = tiles.filter((tile) => tile.state === "warn" || tile.state === "off");
-
-  return (
-    <div className="w-full space-y-10">
-      <header className="max-w-3xl space-y-3">
-        <h1 className="page-title text-[clamp(2.25rem,4vw,3.5rem)]">Settings</h1>
-        <p className="text-muted-foreground text-sm leading-relaxed sm:text-base">
-          Configure the server, media processing, integrations, and the defaults your household
-          starts with.
-        </p>
-      </header>
-
-      <section aria-labelledby="setup-health-heading" className="space-y-4">
-        <div className="space-y-1.5">
-          <h2 id="setup-health-heading" className="text-xl font-semibold tracking-tight">
-            Setup &amp; health
-          </h2>
-          <p className="text-muted-foreground text-sm">
-            Recommendations and configuration problems that may limit server features.
-          </p>
-        </div>
-        {isLoading ? (
-          <div className="grid grid-cols-2 gap-3 md:grid-cols-3 xl:grid-cols-5">
-            {SKELETON_TILES.map((index) => (
-              <HealthTileSkeleton key={index} />
-            ))}
-          </div>
-        ) : attentionTiles.length === 0 ? (
-          <div className="border-border/60 bg-card/35 inline-flex max-w-xl items-start gap-3 rounded-xl border px-4 py-3">
-            <CircleCheck className="mt-0.5 size-4 shrink-0 text-emerald-500" aria-hidden="true" />
-            <div className="space-y-0.5">
-              <p className="text-sm font-medium">No action needed</p>
-              <p className="text-muted-foreground text-xs leading-relaxed">
-                Missing setup, unavailable services, and restart-required changes will appear here.
-              </p>
-            </div>
-          </div>
-        ) : (
-          <div className="grid grid-cols-2 gap-3 md:grid-cols-3 xl:grid-cols-5">
-            {attentionTiles.map((tile) => (
-              <HealthTile key={tile.id} tile={tile} />
-            ))}
-          </div>
-        )}
-      </section>
-
-      <section aria-labelledby="settings-groups-heading" className="space-y-5">
-        <div className="space-y-1.5">
-          <h2 id="settings-groups-heading" className="text-xl font-semibold tracking-tight">
-            Settings groups
-          </h2>
-          <p className="text-muted-foreground text-sm">
-            Each group shows the sections you’ll find inside.
-          </p>
-        </div>
-        <div className="grid grid-cols-1 gap-4 lg:grid-cols-2">
-          {isLoading
-            ? SKELETON_CARDS.map((index) => <SectionCardSkeleton key={index} />)
-            : cards.map((card) => <SectionCard key={card.id} card={card} />)}
-        </div>
-      </section>
-    </div>
-  );
-}
diff --git a/web/src/pages/admin-settings/SignInProviderSlot.tsx b/web/src/pages/admin-settings/SignInProviderSlot.tsx
index 933935144e..b3f4fa9b64 100644
--- a/web/src/pages/admin-settings/SignInProviderSlot.tsx
+++ b/web/src/pages/admin-settings/SignInProviderSlot.tsx
@@ -252,7 +252,7 @@ function Step({
       <div className="flex items-center gap-2.5">
         <span
           aria-hidden="true"
-          className="border-border bg-muted/40 text-muted-foreground grid size-[22px] shrink-0 place-items-center rounded-full border text-[11.5px] font-semibold"
+          className="border-border bg-muted/40 text-muted-foreground grid size-[22px] shrink-0 place-items-center rounded-full border text-xs font-semibold"
         >
           {number}
         </span>
@@ -976,7 +976,7 @@ export function SignInProviderSlot({
               <span className="flex items-center justify-between gap-2">
                 <span className="text-sm font-semibold">{choice.title}</span>
                 {choice.state ? (
-                  <span className="text-muted-foreground border-border inline-flex shrink-0 items-center gap-1.5 rounded-full border px-2 py-0.5 text-[11px]">
+                  <span className="text-muted-foreground border-border inline-flex shrink-0 items-center gap-1.5 rounded-full border px-2 py-0.5 text-xs">
                     <StateDot tone={choice.state.tone} />
                     {choice.state.word}
                   </span>
diff --git a/web/src/pages/admin-settings/SignInSettings.test.tsx b/web/src/pages/admin-settings/SignInSettings.test.tsx
index 62fd69b9cb..772120c760 100644
--- a/web/src/pages/admin-settings/SignInSettings.test.tsx
+++ b/web/src/pages/admin-settings/SignInSettings.test.tsx
@@ -13,6 +13,7 @@ import { BREAK_GLASS_REQUIRED_TEXT } from "@/lib/externalSignInAdmin";
 import SignInSettings from "./SignInSettings";
 
 const state = vi.hoisted(() => ({
+  keys: [] as string[],
   values: {} as Record<string, string>,
   dirty: new Set<string>(),
   setValue: vi.fn(),
@@ -26,17 +27,20 @@ const state = vi.hoisted(() => ({
 }));
 
 vi.mock("@/hooks/useSettingsForm", () => ({
-  useSettingsForm: () => ({
-    isLoading: false,
-    getValue: (key: string) => state.values[key] ?? "",
-    getPersistedValue: (key: string) => state.values[key] ?? "",
-    setValue: state.setValue,
-    isDirty: (key: string) => state.dirty.has(key),
-    dirtyCount: state.dirty.size,
-    save: state.save,
-    discard: state.discard,
-    isSaving: false,
-  }),
+  useSettingsForm: (options: { keys: string[] }) => {
+    state.keys = options.keys;
+    return {
+      isLoading: false,
+      getValue: (key: string) => state.values[key] ?? "",
+      getPersistedValue: (key: string) => state.values[key] ?? "",
+      setValue: state.setValue,
+      isDirty: (key: string) => state.dirty.has(key),
+      dirtyCount: state.dirty.size,
+      save: state.save,
+      discard: state.discard,
+      isSaving: false,
+    };
+  },
 }));
 vi.mock("@/hooks/queries/admin/plugins", () => ({
   useAdminPluginInstallations: () => ({
@@ -181,6 +185,8 @@ let failures: Record<string, unknown>;
 // Operations that answer only when the test resolves them.
 let held: Record<string, Promise<unknown>>;
 let testResult: unknown;
+// The server's restart registry, served to the page's useRestartKeys.
+let restartKeys: { keys: string[]; prefixes: string[] };
 const calls: Array<{ op: string; options?: { body?: unknown; path?: unknown } }> = [];
 
 function problem(type: string, status: number, detail = `raw ${type}`) {
@@ -201,6 +207,10 @@ beforeEach(() => {
     "auth.email_auto_match": "false",
     "auth.provider_recheck_interval": "12h",
     "auth.provider_recheck_outage_policy": "fail_open",
+    "auth.access_token_expiry": "30m",
+    "auth.refresh_token_expiry": "30d",
+    "signup.enabled": "false",
+    "password_reset.self_service_enabled": "false",
     "server.public_url": "https://silo.example.test",
   };
   state.dirty = new Set();
@@ -225,6 +235,7 @@ beforeEach(() => {
   };
   failures = {};
   held = {};
+  restartKeys = { keys: [], prefixes: [] };
   testResult = {
     ok: false,
     callback_url: "https://silo.example.test/api/v2/auth/oauth/6/callback",
@@ -241,6 +252,8 @@ beforeEach(() => {
     switch (op) {
       case "GET /api/v2/auth/external-sign-in/capabilities":
         return Promise.resolve(capabilities);
+      case "GET /api/v2/admin/settings/restart-keys":
+        return Promise.resolve(restartKeys);
       case "GET /api/v2/auth/providers":
         return Promise.resolve({
           items: [
@@ -629,6 +642,21 @@ describe("SignInSettings network sign-in", () => {
       default_login: false,
     });
   });
+
+  it("keeps both switches in view and the roles explanation behind a disclosure", async () => {
+    const user = userEvent.setup();
+    state.installations = [oidcInstallation(), tailscaleInstallation()];
+    mount();
+    const network = within(screen.getByRole("group", { name: "Network sign-in" }));
+    expect(network.getByRole("switch", { name: "Sign in with Tailscale" })).toBeVisible();
+    expect(network.getByRole("switch", { name: "Create accounts on first sign-in" })).toBeVisible();
+    expect(network.queryByText(/Roles come from grants/)).not.toBeInTheDocument();
+
+    await user.click(network.getByRole("button", { name: "How roles and sharing work" }));
+    expect(network.getByText(/Roles come from grants/)).toBeVisible();
+    expect(network.getByText(/"grants": \[/)).toBeVisible();
+    expect(network.getByRole("link", { name: "Tailscale plugin settings" })).toBeVisible();
+  });
 });
 
 describe("SignInSettings guided setup", () => {
@@ -1007,9 +1035,111 @@ describe("SignInSettings password sign-in", () => {
     expect(screen.getByText("/login?local=1")).toBeInTheDocument();
     expect(screen.getByText("prairie auth local-login enable")).toBeInTheDocument();
   });
+
+  // Signups and resets only ever make or mend a Prairie-password account, so they
+  // sit with the switch that decides whether those accounts sign in at all.
+  it("keeps public signups and password reset with Prairie passwords", async () => {
+    const user = userEvent.setup();
+    mount();
+    const passwords = within(screen.getByRole("group", { name: "Prairie passwords" }));
+    expect(passwords.getByRole("link", { name: "Manage invite codes" })).toHaveAttribute(
+      "href",
+      "/admin/users?tab=invite-codes",
+    );
+    await user.click(passwords.getByRole("switch", { name: "Public signups" }));
+    expect(state.setValue).toHaveBeenCalledWith("signup.enabled", "true");
+    await user.click(passwords.getByRole("switch", { name: "Self-service password reset" }));
+    expect(state.setValue).toHaveBeenCalledWith("password_reset.self_service_enabled", "true");
+  });
+
+  it("saves a staged signup change through the save bar", async () => {
+    const user = userEvent.setup();
+    state.values["signup.enabled"] = "true";
+    state.dirty = new Set(["signup.enabled"]);
+    mount();
+    expect(screen.getByText("1 unsaved change")).toBeInTheDocument();
+    await user.click(screen.getByRole("button", { name: "Save" }));
+    await waitFor(() => expect(state.save).toHaveBeenCalledTimes(1));
+  });
 });
 
-describe("SignInSettings accounts and sessions", () => {
+describe("SignInSettings account matching", () => {
+  it("manages signups, password reset and email matching with the sign-in keys", () => {
+    mount();
+    expect(state.keys).toEqual([
+      "auth.local_password_login",
+      "signup.enabled",
+      "password_reset.self_service_enabled",
+      "auth.email_auto_match",
+      "server.public_url",
+    ]);
+  });
+
+  it("orders the groups passwords, single sign-on, then network sign-in", () => {
+    state.installations = [oidcInstallation(), ldapInstallation(), tailscaleInstallation()];
+    mount();
+    const groups = ["Prairie passwords", "Single sign-on", "Network sign-in"];
+    const headings = Array.from(document.querySelectorAll("h3"), (h) => h.textContent ?? "");
+    expect(headings.filter((heading) => groups.includes(heading))).toEqual(groups);
+  });
+
+  // Token lifetimes and the provider re-check are Hidden tier: saved through
+  // the settings API, with no control on this page.
+  it("keeps email matching under single sign-on and shows no session controls", () => {
+    mount();
+    const sso = within(screen.getByRole("group", { name: "Single sign-on" }));
+    expect(sso.getByRole("switch", { name: "Match existing accounts by email" })).toBeVisible();
+    expect(screen.queryByRole("group", { name: "Accounts and sessions" })).not.toBeInTheDocument();
+    expect(screen.queryByLabelText("Access token expiry")).not.toBeInTheDocument();
+    expect(screen.queryByLabelText("Refresh token expiry")).not.toBeInTheDocument();
+    expect(
+      screen.queryByRole("combobox", { name: "Re-check access every" }),
+    ).not.toBeInTheDocument();
+    expect(
+      screen.queryByRole("combobox", { name: "If the provider is unreachable" }),
+    ).not.toBeInTheDocument();
+  });
+
+  it("leaves out matching while no sign-in plugin is installed", () => {
+    state.installations = [];
+    mount();
+    expect(
+      screen.queryByRole("switch", { name: "Match existing accounts by email" }),
+    ).not.toBeInTheDocument();
+  });
+
+  it("leaves out matching for a network sign-in, which never matches by email", () => {
+    state.installations = [tailscaleInstallation()];
+    mount();
+    expect(
+      screen.queryByRole("switch", { name: "Match existing accounts by email" }),
+    ).not.toBeInTheDocument();
+  });
+
+  it("keeps matching that is on even with no plugin installed", () => {
+    state.installations = [];
+    state.values["auth.email_auto_match"] = "true";
+    mount();
+    expect(screen.getByRole("switch", { name: "Match existing accounts by email" })).toBeChecked();
+  });
+
+  it("keeps matching while the installations are unknown", () => {
+    state.installations = undefined;
+    state.installationsError = true;
+    mount();
+    expect(screen.getByRole("switch", { name: "Match existing accounts by email" })).toBeVisible();
+  });
+
+  it("marks the fields that the restart registry names", async () => {
+    restartKeys = { keys: ["signup.enabled"], prefixes: [] };
+    mount();
+    const passwordBadges = await within(
+      screen.getByRole("group", { name: "Prairie passwords" }),
+    ).findAllByLabelText("Takes effect after a server restart");
+    expect(passwordBadges).toHaveLength(1);
+    expect(passwordBadges[0]?.parentElement).toHaveTextContent("Public signups");
+  });
+
   it("warns about account takeover and stages email matching", async () => {
     const user = userEvent.setup();
     mount();
@@ -1017,15 +1147,4 @@ describe("SignInSettings accounts and sessions", () => {
     await user.click(screen.getByRole("switch", { name: "Match existing accounts by email" }));
     expect(state.setValue).toHaveBeenCalledWith("auth.email_auto_match", "true");
   });
-
-  it("keeps a stored interval no preset names and explains the outage policy", () => {
-    state.values["auth.provider_recheck_interval"] = "3h";
-    state.values["auth.provider_recheck_outage_policy"] = "fail_closed";
-    mount();
-    expect(screen.getByRole("combobox", { name: "Re-check access every" })).toHaveTextContent("3h");
-    expect(
-      screen.getByRole("combobox", { name: "If the provider is unreachable" }),
-    ).toHaveTextContent("Stop sessions from renewing");
-    expect(screen.getByText(/apps stop working during an outage/)).toBeInTheDocument();
-  });
 });
diff --git a/web/src/pages/admin-settings/SignInSettings.tsx b/web/src/pages/admin-settings/SignInSettings.tsx
index e288938015..e265ebb34a 100644
--- a/web/src/pages/admin-settings/SignInSettings.tsx
+++ b/web/src/pages/admin-settings/SignInSettings.tsx
@@ -1,5 +1,6 @@
 import { useMemo, useRef, useState } from "react";
 import { useIsMutating } from "@tanstack/react-query";
+import { ArrowRight } from "lucide-react";
 import { Link } from "react-router";
 
 import { V2ProblemError } from "@/api/v2/request";
@@ -13,8 +14,13 @@ import {
   useExternalSignInCapabilities,
 } from "@/hooks/queries/admin/externalSignIn";
 import { useAdminUsers } from "@/hooks/queries/admin/users";
+import { useRestartKeys } from "@/hooks/useRestartKeys";
 import { useSettingsForm } from "@/hooks/useSettingsForm";
-import { activeSignInInstallation, BREAK_GLASS_REQUIRED_TEXT } from "@/lib/externalSignInAdmin";
+import {
+  activeSignInInstallation,
+  BREAK_GLASS_REQUIRED_TEXT,
+  primarySignInInstallations,
+} from "@/lib/externalSignInAdmin";
 import { SaveBar } from "@/components/SaveBar";
 
 import { FieldGroup } from "./FieldGroup";
@@ -25,45 +31,28 @@ import { useSignInProviderDrafts } from "./useSignInProviderDrafts";
 
 export const LOCAL_LOGIN_KEY = "auth.local_password_login";
 export const EMAIL_MATCH_KEY = "auth.email_auto_match";
-export const RECHECK_INTERVAL_KEY = "auth.provider_recheck_interval";
-export const OUTAGE_POLICY_KEY = "auth.provider_recheck_outage_policy";
-const RECHECK_KEYS = [RECHECK_INTERVAL_KEY, OUTAGE_POLICY_KEY];
+// Both only work for Prairie-password accounts: the server refuses a signup while
+// password sign-in is off, and a reset needs a local password to replace.
+const PASSWORD_ACCOUNT_KEYS = ["signup.enabled", "password_reset.self_service_enabled"];
+// Hidden tier: still saved and readable through the settings API, deliberately
+// without a control here because the defaults suit every deployment we
+// support — auth.access_token_expiry, auth.refresh_token_expiry,
+// auth.provider_recheck_interval, auth.provider_recheck_outage_policy.
 // server.public_url is read, not edited: OpenID Connect needs it.
-const KEYS = [LOCAL_LOGIN_KEY, EMAIL_MATCH_KEY, ...RECHECK_KEYS, "server.public_url"];
-
-const RECHECK_INTERVALS = [
-  { value: "15m", label: "15 minutes" },
-  { value: "1h", label: "1 hour" },
-  { value: "6h", label: "6 hours" },
-  { value: "12h", label: "12 hours (default)" },
-  { value: "1d", label: "1 day" },
-  { value: "7d", label: "7 days" },
-];
-
-const OUTAGE_POLICIES = [
-  { value: "fail_open", label: "Keep people signed in (default)" },
-  { value: "fail_closed", label: "Stop sessions from renewing" },
-];
-
-/** The recheck interval options, plus a stored value none of them names. */
-function intervalOptions(current: string) {
-  const value = current.trim();
-  if (!value || RECHECK_INTERVALS.some((option) => option.value === value)) {
-    return RECHECK_INTERVALS;
-  }
-  return [...RECHECK_INTERVALS, { value, label: value }];
-}
+const KEYS = [LOCAL_LOGIN_KEY, ...PASSWORD_ACCOUNT_KEYS, EMAIL_MATCH_KEY, "server.public_url"];
 
 /**
- * Settings → Sign-in: the server's one external sign-in provider (OIDC or
- * LDAP) as guided setup, whether Prairie passwords still sign in, how first
- * sign-ins match accounts, and how often Prairie asks the provider again. Every
- * edit, the provider's configuration included, saves through the save bar;
- * only turning a provider on or off applies at once. The rules are in
+ * Settings → Sign-in: whether Prairie passwords still sign in, with public
+ * signups and self-service password reset; the server's one external sign-in
+ * provider (OIDC or LDAP) as guided setup, with how its first sign-ins match
+ * existing accounts; and network sign-in. Every edit, the provider's
+ * configuration included, saves through the save bar; only turning a provider
+ * on or off applies at once. The rules are in
  * docs/architecture/external-sign-in.md.
  */
 export default function SignInSettings() {
   const form = useSettingsForm({ keys: useMemo(() => KEYS, []) });
+  const restartKeys = useRestartKeys();
   const capabilities = useExternalSignInCapabilities();
   const installations = useAdminPluginInstallations();
   const users = useAdminUsers();
@@ -89,6 +78,11 @@ export default function SignInSettings() {
     return active?.enabled === true;
   }, [installations.data]);
   const providerKnown = installations.data !== undefined;
+  // Email matching only acts on accounts OIDC or LDAP signs in (a network
+  // sign-in never matches by email). Without one installed it is noise, but it
+  // stays while the installations are unknown or while it is on, saved or
+  // staged, so nothing set is ever out of reach.
+  const primaryInstalled = primarySignInInstallations(installations.data).length > 0;
 
   function showLocalError(text: string) {
     setLocalError(text);
@@ -149,10 +143,15 @@ export default function SignInSettings() {
   const localLoginOn = form.getValue(LOCAL_LOGIN_KEY) !== "false";
   const emailMatchOn = form.getValue(EMAIL_MATCH_KEY) === "true";
   const publicUrlSet = form.getPersistedValue("server.public_url").trim() !== "";
+  const emailMatchSet =
+    form.isDirty(EMAIL_MATCH_KEY) ||
+    emailMatchOn ||
+    form.getPersistedValue(EMAIL_MATCH_KEY).trim() === "true";
+  const showEmailMatch = !providerKnown || primaryInstalled || emailMatchSet;
 
   return (
     <div className="flex h-full flex-col">
-      <SettingsPageHeader title="Sign-in" className="mb-7" />
+      <SettingsPageHeader title="Sign-in" />
 
       <div className="flex-1 space-y-5">
         {capabilities.isError || (caps && !supported) ? (
@@ -162,30 +161,20 @@ export default function SignInSettings() {
         ) : null}
 
         <FieldGroup
-          label="Single sign-on"
-          description="Let people sign in with your identity provider. A server uses one provider at a time."
-          dirty={drafts.changeCount > 0}
+          label="Prairie passwords"
+          dirty={[LOCAL_LOGIN_KEY, ...PASSWORD_ACCOUNT_KEYS].some((key) => form.isDirty(key))}
+          actions={
+            <Link
+              to="/admin/users?tab=invite-codes"
+              className="text-muted-foreground hover:text-foreground inline-flex items-center gap-1.5 text-xs font-medium transition-colors"
+            >
+              Manage invite codes
+              <ArrowRight className="h-3 w-3" aria-hidden="true" />
+            </Link>
+          }
         >
-          <div className="settings-field-note">
-            <FeedbackLine feedback={providerFeedback} focusRef={providerFeedbackRef} />
-            <SignInProviderSlot
-              installations={installations.data}
-              loading={installations.isLoading}
-              failed={installations.isError}
-              drafts={drafts}
-              localLoginOn={form.getPersistedValue(LOCAL_LOGIN_KEY) !== "false"}
-              publicUrlSet={publicUrlSet}
-              connectionTestServed={caps?.connection_test === true}
-            />
-          </div>
-        </FieldGroup>
-
-        <NetworkSignInSection installations={installations.data} />
-
-        <FieldGroup label="Prairie passwords" dirty={form.isDirty(LOCAL_LOGIN_KEY)}>
           <SettingField
             label="Allow password sign-in"
-            settingKey={LOCAL_LOGIN_KEY}
             dirty={form.isDirty(LOCAL_LOGIN_KEY)}
             type="toggle"
             description="Off: everyone signs in with the provider, except break-glass admins. Needs at least one break-glass admin; the server owner is one by default."
@@ -218,6 +207,24 @@ export default function SignInSettings() {
               {localError}
             </p>
           ) : null}
+          <SettingField
+            label="Public signups"
+            dirty={form.isDirty("signup.enabled")}
+            type="toggle"
+            description="Anyone with a valid invite code can create an account."
+            value={form.getValue("signup.enabled")}
+            onChange={(v) => form.setValue("signup.enabled", v)}
+            restartRequired={restartKeys.has("signup.enabled")}
+          />
+          <SettingField
+            label="Self-service password reset"
+            dirty={form.isDirty("password_reset.self_service_enabled")}
+            type="toggle"
+            description="Adds “Forgot password?” to the sign-in page, so people can get a reset link by email. Needs email and the public URL."
+            value={form.getValue("password_reset.self_service_enabled")}
+            onChange={(v) => form.setValue("password_reset.self_service_enabled", v)}
+            restartRequired={restartKeys.has("password_reset.self_service_enabled")}
+          />
           <AdvancedSection id="sign-in.locked-out" title="Locked out?">
             <p className="settings-field-note text-muted-foreground py-2 text-xs leading-relaxed">
               <code className="font-mono">/login?local=1</code> shows the password form for
@@ -229,53 +236,44 @@ export default function SignInSettings() {
         </FieldGroup>
 
         <FieldGroup
-          label="Accounts and sessions"
-          description="Applies to whichever provider is on."
-          dirty={[EMAIL_MATCH_KEY, ...RECHECK_KEYS].some((key) => form.isDirty(key))}
+          label="Single sign-on"
+          description="Let people sign in with your identity provider. A server uses one provider at a time."
+          dirty={drafts.changeCount > 0 || form.isDirty(EMAIL_MATCH_KEY)}
         >
-          <SettingField
-            label="Match existing accounts by email"
-            settingKey={EMAIL_MATCH_KEY}
-            dirty={form.isDirty(EMAIL_MATCH_KEY)}
-            type="toggle"
-            description="A first sign-in connects to the regular Prairie account with the same email, when the provider says the email is verified. Admin, owner and break-glass accounts are never matched."
-            value={emailMatchOn ? "true" : "false"}
-            onChange={(value) => form.setValue(EMAIL_MATCH_KEY, value)}
-            status={
-              <SettingFieldStatus tone={emailMatchOn ? "warn" : "muted"}>
-                Whoever controls that email at the provider takes over the Prairie account. Prairie
-                doesn't verify account emails, so the account matched is whichever one registered or
-                set the address first; matching signs it out everywhere and deletes its API keys.
-                Turn this on only if the provider verifies every email and people can't change their
-                own.
-              </SettingFieldStatus>
-            }
-          />
-          <SettingField
-            label="Re-check access every"
-            settingKey={RECHECK_INTERVAL_KEY}
-            dirty={form.isDirty(RECHECK_INTERVAL_KEY)}
-            type="select"
-            description="Prairie asks the provider again whether each person may still sign in, so someone removed there is signed out of Prairie at the next check."
-            value={form.getValue(RECHECK_INTERVAL_KEY) || "12h"}
-            onChange={(value) => form.setValue(RECHECK_INTERVAL_KEY, value)}
-            options={intervalOptions(form.getValue(RECHECK_INTERVAL_KEY))}
-          />
-          <SettingField
-            label="If the provider is unreachable"
-            settingKey={OUTAGE_POLICY_KEY}
-            dirty={form.isDirty(OUTAGE_POLICY_KEY)}
-            type="select"
-            description={
-              form.getValue(OUTAGE_POLICY_KEY) === "fail_closed"
-                ? "A session due for a check can't renew until the provider answers, so apps stop working during an outage and carry on once it's over."
-                : "Sessions keep renewing and Prairie asks again at the next renewal, so an outage doesn't sign anyone out."
-            }
-            value={form.getValue(OUTAGE_POLICY_KEY) || "fail_open"}
-            onChange={(value) => form.setValue(OUTAGE_POLICY_KEY, value)}
-            options={OUTAGE_POLICIES}
-          />
+          <div className="settings-field-note">
+            <FeedbackLine feedback={providerFeedback} focusRef={providerFeedbackRef} />
+            <SignInProviderSlot
+              installations={installations.data}
+              loading={installations.isLoading}
+              failed={installations.isError}
+              drafts={drafts}
+              localLoginOn={form.getPersistedValue(LOCAL_LOGIN_KEY) !== "false"}
+              publicUrlSet={publicUrlSet}
+              connectionTestServed={caps?.connection_test === true}
+            />
+          </div>
+          {showEmailMatch ? (
+            <SettingField
+              label="Match existing accounts by email"
+              dirty={form.isDirty(EMAIL_MATCH_KEY)}
+              type="toggle"
+              description="A first sign-in connects to the regular Prairie account with the same email, when the provider says the email is verified. Admin, owner and break-glass accounts are never matched."
+              value={emailMatchOn ? "true" : "false"}
+              onChange={(value) => form.setValue(EMAIL_MATCH_KEY, value)}
+              status={
+                <SettingFieldStatus tone={emailMatchOn ? "warn" : "muted"}>
+                  Whoever controls that email at the provider takes over the Prairie account.
+                  Prairie doesn't verify account emails, so the account matched is whichever one
+                  registered or set the address first; matching signs it out everywhere and deletes
+                  its API keys. Turn this on only if the provider verifies every email and people
+                  can't change their own.
+                </SettingFieldStatus>
+              }
+            />
+          ) : null}
         </FieldGroup>
+
+        <NetworkSignInSection installations={installations.data} />
       </div>
 
       <SaveBar
diff --git a/web/src/pages/admin-settings/InfrastructureSettings.test.tsx b/web/src/pages/admin-settings/StorageSettings.test.tsx
similarity index 75%
rename from web/src/pages/admin-settings/InfrastructureSettings.test.tsx
rename to web/src/pages/admin-settings/StorageSettings.test.tsx
index 180a44d5df..38dd9f0224 100644
--- a/web/src/pages/admin-settings/InfrastructureSettings.test.tsx
+++ b/web/src/pages/admin-settings/StorageSettings.test.tsx
@@ -1,10 +1,9 @@
-import { fireEvent, render, screen, waitFor, within } from "@testing-library/react";
+import { render, screen, waitFor, within } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import { renderToStaticMarkup } from "react-dom/server";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
-import InfrastructureSettings from "./InfrastructureSettings";
-import { OPSLOG_BUCKET_POLICIES_KEY } from "./logRetentionPolicy";
+import StorageSettings from "./StorageSettings";
 
 window.HTMLElement.prototype.hasPointerCapture ??= () => false;
 window.HTMLElement.prototype.setPointerCapture ??= () => {};
@@ -39,11 +38,11 @@ vi.mock("@/hooks/useSettingsForm", async (importOriginal) => {
   };
 });
 
-// Mirrors the server registry's restart prefixes: every artwork/s3/redis/database/
-// userdb key restarts; nothing else on this page does. Tests that need a
+// Mirrors the server registry's restart prefixes: every artwork/s3 key restarts;
+// metadata.cache_images hot-reloads. Tests that need a
 // different registry override the mock.
 const restartKeysMock = vi.fn(() => ({
-  has: (key: string) => /^(artwork|s3|redis|database|userdb)\./.test(key),
+  has: (key: string) => /^(artwork|s3)\./.test(key),
 }));
 
 vi.mock("@/hooks/useRestartKeys", () => ({
@@ -150,8 +149,10 @@ function mockForm(overrides: FormOverrides = {}) {
   return form;
 }
 
-describe("InfrastructureSettings", () => {
+describe("StorageSettings", () => {
   afterEach(() => {
+    // Disclosures remember being opened; start every case collapsed.
+    localStorage.clear();
     serverStatus.current = { artwork_storage: { backend: "local", locked: false } };
     serverStatus.isPending = false;
     serverStatus.isError = false;
@@ -192,7 +193,7 @@ describe("InfrastructureSettings", () => {
             : "",
     });
 
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     expect(screen.queryByRole("button", { name: "Save" })).not.toBeInTheDocument();
     expect(screen.queryByLabelText("Bucket")).not.toBeInTheDocument();
@@ -206,7 +207,7 @@ describe("InfrastructureSettings", () => {
   it("keeps the backend editable until artwork has been stored", () => {
     serverStatus.current = { artwork_storage: { backend: "local", locked: false } };
     mockForm();
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
     expect(screen.getByRole("combobox", { name: "Backend" })).toBeEnabled();
     expect(screen.queryByText(/Locked to/)).not.toBeInTheDocument();
     expect(screen.getByLabelText("Local storage path")).toBeEnabled();
@@ -215,7 +216,7 @@ describe("InfrastructureSettings", () => {
   it("opens the managed transition when a locked S3 backend changes", async () => {
     serverStatus.current = { artwork_storage: { backend: "s3", locked: true } };
     mockForm({ getValue: (key: string) => (key === "artwork.storage_backend" ? "auto" : "") });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
     const backend = screen.getByRole("combobox", { name: "Backend" });
     expect(backend).toBeEnabled();
     expect(backend).toHaveTextContent("S3");
@@ -245,7 +246,7 @@ describe("InfrastructureSettings", () => {
     const form = mockForm({
       getValue: (key: string) => (key === "artwork.storage_backend" ? "s3" : ""),
     });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     await userEvent.click(screen.getByRole("combobox", { name: "Backend" }));
     await userEvent.click(screen.getByRole("option", { name: "Local disk" }));
@@ -263,11 +264,11 @@ describe("InfrastructureSettings", () => {
         key === "artwork.storage_backend"
           ? "s3"
           : key === "artwork.local_path"
-            ? "/srv/silo/artwork"
+            ? "/srv/prairie/artwork"
             : "",
     });
     createStorageTransitionMock.mockResolvedValueOnce({ job: { id: "transition-1" } });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     await userEvent.click(screen.getByRole("combobox", { name: "Backend" }));
     await userEvent.click(screen.getByRole("option", { name: "Local disk" }));
@@ -284,7 +285,7 @@ describe("InfrastructureSettings", () => {
         policy: "start_fresh",
         values: {
           "artwork.storage_backend": "local",
-          "artwork.local_path": "/srv/silo/artwork",
+          "artwork.local_path": "/srv/prairie/artwork",
         },
       }),
     );
@@ -317,10 +318,10 @@ describe("InfrastructureSettings", () => {
         key === "artwork.storage_backend"
           ? "s3"
           : key === "artwork.local_path"
-            ? "/srv/silo/artwork"
+            ? "/srv/prairie/artwork"
             : "",
     });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     await userEvent.click(screen.getByRole("combobox", { name: "Backend" }));
     await userEvent.click(screen.getByRole("option", { name: "Local disk" }));
@@ -342,204 +343,289 @@ describe("InfrastructureSettings", () => {
     serverStatus.current = undefined;
   });
 
-  it("manages the merged database, storage and log keys in one form", () => {
+  it("manages the storage keys and provider artwork caching in one form", () => {
     mockForm();
 
-    renderToStaticMarkup(<InfrastructureSettings />);
+    renderToStaticMarkup(<StorageSettings />);
 
     const calls = settingsFormMock.mock.calls as [{ keys: string[] }][];
     const keys = calls[calls.length - 1]?.[0].keys ?? [];
     expect(keys).toEqual(
-      expect.arrayContaining(["redis.url", "redis.db", "database.max_connections"]),
+      expect.arrayContaining(["s3.public_bucket", "s3.private_bucket", "metadata.cache_images"]),
     );
-    expect(keys).toEqual(
-      expect.arrayContaining(["s3.public_bucket", "s3.private_bucket", OPSLOG_BUCKET_POLICIES_KEY]),
-    );
-    // Provider caching remains on Library & Metadata. This page selects storage.
-    expect(keys).not.toContain("metadata.cache_images");
+    // Redis and the Postgres pool moved to General, which saves those keys itself.
+    expect(keys.filter((key) => /^(redis|database)\./.test(key))).toEqual([]);
+    // Log retention moved to the Logging page, which saves those keys itself.
+    expect(keys.filter((key) => /^(opslog|policy)\./.test(key))).toEqual([]);
     // The disabled Litestream storage tab is gone; its keys keep working through the API.
     expect(keys.filter((key) => key.startsWith("s3.user_db_"))).toEqual([]);
+    // The per-user database backend and its SQLite tuning are Hidden: one usable
+    // option and two fields that could never show. The API still serves them.
+    expect(keys.filter((key) => key.startsWith("userdb."))).toEqual([]);
   });
 
-  it("keeps the Redis connection check available when REDIS_URL comes from the environment", () => {
-    mockForm({
-      sensitiveConfigured: ["redis.url"],
-      sensitiveManagedByEnv: ["redis.url"],
-    });
-
-    render(<InfrastructureSettings />);
-
-    const redisGroup = within(screen.getByRole("group", { name: "Redis" }));
-    // The value stays read-only — only writes are refused for env-managed keys —
-    // but the check runs against the value the server merged from REDIS_URL.
-    expect(redisGroup.getByLabelText("Connection URL")).toBeDisabled();
-    expect(redisGroup.getByRole("button", { name: "Check Connection" })).toBeEnabled();
+  it("shows provider artwork caching in the Storage group and stages edits", async () => {
+    const form = mockForm({
+      getValue: (key: string) =>
+        key === "metadata.cache_images" ? "true" : key === "s3.public_url_auth" ? "presigned" : "",
+    });
+    render(<StorageSettings />);
+
+    const storage = within(screen.getByRole("group", { name: "Storage" }));
+    const toggle = storage.getByRole("switch", { name: "Save provider artwork to storage" });
+    expect(toggle).toBeChecked();
+    // It hot-reloads, so the group no longer claims a restart for every row.
+    expect(storage.queryByText("Changes apply after a restart")).not.toBeInTheDocument();
+    expect(storage.getAllByLabelText("Takes effect after a server restart")).toHaveLength(2);
+    await userEvent.click(toggle);
+    expect(form.setValue).toHaveBeenCalledWith("metadata.cache_images", "false");
   });
 
-  it("shows the Redis database number in use and stages an edit to it", () => {
+  it("saves provider artwork caching directly on a locked install", async () => {
+    serverStatus.current = { artwork_storage: { backend: "local", locked: true } };
     const form = mockForm({
-      getValue: (key: string) => (key === "redis.db" ? "3" : ""),
-      sensitiveConfigured: ["redis.url"],
+      dirtyCount: 1,
+      dirtyKeys: ["metadata.cache_images"],
+      isDirty: (key: string) => key === "metadata.cache_images",
+      getValue: (key: string) =>
+        key === "artwork.storage_backend"
+          ? "local"
+          : key === "metadata.cache_images"
+            ? "false"
+            : key === "s3.public_url_auth"
+              ? "presigned"
+              : "",
+      getPersistedValue: (key: string) =>
+        key === "artwork.storage_backend" ? "local" : key === "metadata.cache_images" ? "true" : "",
     });
+    render(<StorageSettings />);
 
-    render(<InfrastructureSettings />);
-
-    const field = within(screen.getByRole("group", { name: "Redis" })).getByLabelText(
-      "Database number",
-    );
-    expect(field).toHaveValue(3);
-    expect(field).toBeEnabled();
-    fireEvent.change(field, { target: { value: "5" } });
-    expect(form.setValue).toHaveBeenCalledWith("redis.db", "5");
+    await userEvent.click(screen.getByRole("button", { name: "Save" }));
+    expect(form.save).toHaveBeenCalledWith(undefined);
+    expect(screen.queryByRole("dialog")).not.toBeInTheDocument();
+    serverStatus.current = undefined;
   });
 
-  it("makes the Redis database number read-only when REDIS_URL comes from the environment", () => {
+  it.each([
+    ["Automatic without a bucket", "", ""],
+    ["Automatic without a bucket, saved as auto", "auto", ""],
+    ["S3", "s3", ""],
+    ["Automatic with a saved bucket", "auto", "artwork"],
+  ])("shows public and private storage for %s", (_, backend, savedBucket) => {
     mockForm({
-      getValue: (key: string) => (key === "redis.db" ? "1" : ""),
-      sensitiveConfigured: ["redis.url"],
-      sensitiveManagedByEnv: ["redis.url", "redis.db"],
+      getPersistedValue: (key: string) =>
+        key === "artwork.storage_backend" ? backend : key === "s3.public_bucket" ? savedBucket : "",
+      getValue: (key: string) =>
+        key === "artwork.storage_backend"
+          ? backend
+          : key === "s3.public_bucket"
+            ? savedBucket
+            : key === "s3.public_url_auth"
+              ? "presigned"
+              : "",
     });
+    render(<StorageSettings />);
 
-    render(<InfrastructureSettings />);
-
-    const redisGroup = within(screen.getByRole("group", { name: "Redis" }));
-    // The server reports the number in REDIS_URL; it cannot be saved here.
-    expect(redisGroup.getByLabelText("Database number")).toHaveValue(1);
-    expect(redisGroup.getByLabelText("Database number")).toBeDisabled();
+    const publicStorage = within(screen.getByRole("group", { name: "Public storage" }));
+    expect(publicStorage.getByLabelText("Bucket")).toBeVisible();
+    const privateStorage = within(screen.getByRole("group", { name: "Private storage" }));
+    expect(privateStorage.getByLabelText("Bucket")).toBeVisible();
+    expect(screen.queryByRole("group", { name: "S3 storage" })).not.toBeInTheDocument();
   });
 
-  it("checks the Redis connection with the database number", async () => {
-    const mutateAsync = vi.fn().mockResolvedValue({ success: true, message: "ok" });
-    useCheckAdminSettingsConnectionMock.mockReturnValue({ isPending: false, mutateAsync });
-    const request = { values: { "redis.url": "", "redis.db": "5" }, dirty_keys: ["redis.db"] };
-    const form = mockForm({
-      sensitiveConfigured: ["redis.url"],
-      buildConnectionCheckRequest: vi.fn(() => request),
+  // Public storage serves only S3 and Automatic, and local disk keeps private
+  // files in the local path, so Local disk shows neither bucket section.
+  it.each([
+    ["Local disk", ""],
+    ["Local disk with a leftover public bucket", "artwork"],
+  ])("hides both bucket sections for %s", (_, savedBucket) => {
+    mockForm({
+      getPersistedValue: (key: string) =>
+        key === "artwork.storage_backend" ? "local" : key === "s3.public_bucket" ? savedBucket : "",
+      getValue: (key: string) =>
+        key === "artwork.storage_backend"
+          ? "local"
+          : key === "s3.public_bucket"
+            ? savedBucket
+            : key === "s3.public_url_auth"
+              ? "presigned"
+              : "",
     });
+    render(<StorageSettings />);
 
-    render(<InfrastructureSettings />);
-    fireEvent.click(
-      within(screen.getByRole("group", { name: "Redis" })).getByRole("button", {
-        name: "Check Connection",
-      }),
-    );
-
-    await waitFor(() => expect(mutateAsync).toHaveBeenCalledWith({ kind: "redis", body: request }));
-    expect(form.buildConnectionCheckRequest).toHaveBeenCalledWith(["redis.url", "redis.db"]);
+    expect(screen.queryByRole("group", { name: "Public storage" })).not.toBeInTheDocument();
+    expect(screen.queryByRole("group", { name: "Private storage" })).not.toBeInTheDocument();
   });
 
-  it("marks the Redis database number for a restart on its own", () => {
-    // A registry where only the number needs a restart: the group cannot say
-    // so for every field, which leaves the chip to this one.
-    restartKeysMock.mockReturnValueOnce({ has: (key: string) => key === "redis.db" });
-    mockForm({ sensitiveConfigured: ["redis.url"] });
-
-    render(<InfrastructureSettings />);
+  // A saved private bucket holds the avatars even on local disk, so it stays
+  // in view where it can be changed or cleared.
+  it("keeps a saved private bucket in view on Local disk", () => {
+    mockForm({
+      getPersistedValue: (key: string) =>
+        key === "artwork.storage_backend" ? "local" : key === "s3.private_bucket" ? "ops" : "",
+      getValue: (key: string) =>
+        key === "artwork.storage_backend" ? "local" : key === "s3.private_bucket" ? "ops" : "",
+    });
+    render(<StorageSettings />);
 
-    const badges = within(screen.getByRole("group", { name: "Redis" })).getAllByLabelText(
-      "Takes effect after a server restart",
-    );
-    expect(badges).toHaveLength(1);
-    expect(badges[0]?.parentElement).toHaveTextContent("Database number");
+    const privateStorage = within(screen.getByRole("group", { name: "Private storage" }));
+    expect(privateStorage.getByLabelText("Bucket")).toHaveValue("ops");
   });
 
-  describe("editing the Redis connection", () => {
-    const newUrl = "redis://new.example.invalid:6379/7";
-
-    beforeEach(() => {
-      realForm.enabled = true;
-      // No redis.db is saved: the server reports the 3 in the saved URL.
-      serverSettings.current = { "s3.public_url_auth": "presigned", "redis.db": "3" };
-      sensitiveStatus.current = { configured: ["redis.url"], managed_by_env: [] };
-      updateSettingsMock.mockReset();
-      updateSettingsMock.mockResolvedValue({ values: {}, restart_required: false });
-    });
-
-    afterEach(() => {
-      realForm.enabled = false;
+  it("shows a staged public endpoint after the backend goes back to Local disk", () => {
+    mockForm({
+      dirtyCount: 2,
+      isDirty: (key: string) => key === "artwork.storage_backend" || key === "s3.public_endpoint",
+      getValue: (key: string) =>
+        key === "artwork.storage_backend"
+          ? "local"
+          : key === "s3.public_endpoint"
+            ? "https://s3.example"
+            : key === "s3.public_url_auth"
+              ? "presigned"
+              : "",
     });
+    render(<StorageSettings />);
 
-    it("saves the number on screen with a new URL", async () => {
-      render(<InfrastructureSettings />);
-      const redisGroup = within(screen.getByRole("group", { name: "Redis" }));
-
-      await userEvent.type(redisGroup.getByLabelText("Connection URL"), newUrl);
+    expect(
+      within(screen.getByRole("group", { name: "Public storage" })).getByLabelText("Endpoint"),
+    ).toHaveValue("https://s3.example");
+  });
 
-      expect(redisGroup.getByLabelText("Database number")).toHaveValue(3);
-      await userEvent.click(screen.getByRole("button", { name: "Save" }));
-      await waitFor(() =>
-        expect(updateSettingsMock).toHaveBeenCalledWith({ "redis.url": newUrl, "redis.db": "3" }),
-      );
+  // Choosing S3 stages the backend instead of opening the review, so Public
+  // storage appears and its bucket can be filled in before Save.
+  it("stages S3 on a locked local install instead of opening the review", async () => {
+    serverStatus.current = { artwork_storage: { backend: "local", locked: true } };
+    const form = mockForm({
+      getPersistedValue: (key: string) => (key === "artwork.storage_backend" ? "local" : ""),
+      getValue: (key: string) =>
+        key === "artwork.storage_backend"
+          ? "local"
+          : key === "s3.public_url_auth"
+            ? "presigned"
+            : "",
     });
+    render(<StorageSettings />);
 
-    it("checks a new URL with the number on screen", async () => {
-      const mutateAsync = vi.fn().mockResolvedValue({ success: true, message: "ok" });
-      useCheckAdminSettingsConnectionMock.mockReturnValue({ isPending: false, mutateAsync });
-      render(<InfrastructureSettings />);
-      const redisGroup = within(screen.getByRole("group", { name: "Redis" }));
+    await userEvent.click(screen.getByRole("combobox", { name: "Backend" }));
+    await userEvent.click(screen.getByRole("option", { name: "S3" }));
 
-      await userEvent.type(redisGroup.getByLabelText("Connection URL"), newUrl);
-      await userEvent.click(redisGroup.getByRole("button", { name: "Check Connection" }));
+    expect(form.setValue).toHaveBeenCalledWith("artwork.storage_backend", "s3");
+    expect(
+      screen.queryByRole("dialog", { name: "Change artwork storage" }),
+    ).not.toBeInTheDocument();
+    serverStatus.current = undefined;
+  });
 
-      await waitFor(() =>
-        expect(mutateAsync).toHaveBeenCalledWith({
-          kind: "redis",
-          body: {
-            values: { "redis.url": newUrl, "redis.db": "3" },
-            dirty_keys: ["redis.url", "redis.db"],
-          },
-        }),
-      );
-    });
+  it("shows every private storage field without a disclosure", () => {
+    mockForm();
+    render(<StorageSettings />);
 
-    it("stages nothing once the new URL is taken back", async () => {
-      render(<InfrastructureSettings />);
-      const redisGroup = within(screen.getByRole("group", { name: "Redis" }));
+    const privateStorage = within(screen.getByRole("group", { name: "Private storage" }));
+    expect(
+      privateStorage.getByText(/on local disk they stay in the local storage path/),
+    ).toBeInTheDocument();
+    for (const label of [
+      "Endpoint",
+      "Bucket",
+      "Access Key",
+      "Secret Key",
+      "Region",
+      "Put the bucket name in the URL path",
+      "Folder inside the bucket",
+    ]) {
+      expect(privateStorage.getByLabelText(label)).toBeVisible();
+    }
+    expect(privateStorage.getByRole("button", { name: "Check Connection" })).toBeVisible();
+    expect(privateStorage.queryByRole("button", { name: /Advanced/ })).not.toBeInTheDocument();
+  });
 
-      await userEvent.type(redisGroup.getByLabelText("Connection URL"), newUrl);
-      expect(screen.getByText("2 unsaved changes")).toBeInTheDocument();
-      await userEvent.clear(redisGroup.getByLabelText("Connection URL"));
+  it("shows the public bucket connection and link mode with no disclosure for signed links", () => {
+    mockForm();
+    render(<StorageSettings />);
 
-      expect(screen.queryByText(/unsaved change/)).not.toBeInTheDocument();
-      expect(redisGroup.getByLabelText("Database number")).toHaveValue(3);
-    });
+    const publicStorage = within(screen.getByRole("group", { name: "Public storage" }));
+    for (const label of [
+      "Endpoint",
+      "Bucket",
+      "Region",
+      "Access Key",
+      "Secret Key",
+      "Put the bucket name in the URL path",
+      "Folder inside the bucket",
+      "How asset links are authorized",
+    ]) {
+      expect(publicStorage.getByLabelText(label)).toBeVisible();
+    }
+    expect(publicStorage.getByRole("button", { name: "Check Connection" })).toBeVisible();
+    // Signed links need neither a CDN address nor a token.
+    expect(publicStorage.queryByRole("button", { name: /Advanced/ })).not.toBeInTheDocument();
+    expect(publicStorage.queryByLabelText("Address clients download from")).not.toBeInTheDocument();
+  });
 
-    it("drops a URL keystroke that arrives while a save is in flight", async () => {
-      updateSettingsMock.mockReturnValue(new Promise(() => {}));
-      render(<InfrastructureSettings />);
-      const redisGroup = within(screen.getByRole("group", { name: "Redis" }));
-      fireEvent.change(redisGroup.getByLabelText("Database number"), { target: { value: "5" } });
-      await userEvent.click(screen.getByRole("button", { name: "Save" }));
-      await waitFor(() => expect(updateSettingsMock).toHaveBeenCalledWith({ "redis.db": "5" }));
+  it.each([
+    ["public", 1, ["Address clients download from"]],
+    [
+      "cloudflare_token",
+      4,
+      ["Address clients download from", "Token Secret", "Token query parameter", "Link lifetime"],
+    ],
+  ])(
+    "keeps the %s link settings behind public storage's Advanced disclosure",
+    async (urlAuth, count, labels) => {
+      mockForm({
+        getValue: (key: string) => (key === "s3.public_url_auth" ? urlAuth : ""),
+      });
+      render(<StorageSettings />);
 
-      fireEvent.change(redisGroup.getByLabelText("Connection URL"), { target: { value: "r" } });
+      const publicStorage = within(screen.getByRole("group", { name: "Public storage" }));
+      for (const label of labels) {
+        expect(publicStorage.queryByLabelText(label)).not.toBeInTheDocument();
+      }
+      await userEvent.click(
+        publicStorage.getByRole("button", {
+          name: `Advanced · ${count} setting${count === 1 ? "" : "s"}`,
+        }),
+      );
+      for (const label of labels) {
+        expect(publicStorage.getByLabelText(label)).toBeVisible();
+      }
+    },
+  );
 
-      expect(redisGroup.getByLabelText("Connection URL")).toHaveValue("");
+  it("opens public storage's Advanced disclosure while one of its fields is unsaved", () => {
+    mockForm({
+      dirtyCount: 1,
+      dirtyKeys: ["s3.public_read_endpoint"],
+      isDirty: (key: string) => key === "s3.public_read_endpoint",
+      getValue: (key: string) =>
+        key === "s3.public_url_auth"
+          ? "public"
+          : key === "s3.public_read_endpoint"
+            ? "https://cdn.example"
+            : "",
     });
+    render(<StorageSettings />);
 
-    it("sends the number with the empty URL when Redis is switched off", async () => {
-      // The server stores no number without a URL, so this removes a saved one.
-      render(<InfrastructureSettings />);
-
-      await userEvent.click(screen.getByRole("switch", { name: "Use Redis" }));
-      await userEvent.click(screen.getByRole("button", { name: "Save" }));
+    expect(
+      within(screen.getByRole("group", { name: "Public storage" })).getByLabelText(
+        "Address clients download from",
+      ),
+    ).toHaveValue("https://cdn.example");
+  });
 
-      await waitFor(() =>
-        expect(updateSettingsMock).toHaveBeenCalledWith({ "redis.url": "", "redis.db": "3" }),
-      );
+  it("warns about a staged private bucket", () => {
+    mockForm({
+      dirtyCount: 1,
+      dirtyKeys: ["s3.private_bucket"],
+      isDirty: (key: string) => key === "s3.private_bucket",
+      getValue: (key: string) => (key === "s3.private_bucket" ? "private-new" : ""),
     });
+    render(<StorageSettings />);
 
-    it("stages nothing once Redis is switched back on", async () => {
-      render(<InfrastructureSettings />);
-
-      await userEvent.click(screen.getByRole("switch", { name: "Use Redis" }));
-      expect(screen.getByText("2 unsaved changes")).toBeInTheDocument();
-      await userEvent.click(screen.getByRole("switch", { name: "Use Redis" }));
-
-      expect(screen.queryByText(/unsaved change/)).not.toBeInTheDocument();
-      const redisGroup = within(screen.getByRole("group", { name: "Redis" }));
-      expect(redisGroup.getByLabelText("Database number")).toHaveValue(3);
-    });
+    const privateStorage = within(screen.getByRole("group", { name: "Private storage" }));
+    expect(privateStorage.getByLabelText("Bucket")).toHaveValue("private-new");
+    expect(privateStorage.getByText("Storage location change")).toBeVisible();
   });
 
   it("saves unrelated edits before opening an S3 location transition", async () => {
@@ -557,7 +643,7 @@ describe("InfrastructureSettings", () => {
         return "";
       },
     });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     await userEvent.click(screen.getByRole("button", { name: "Review transition" }));
 
@@ -588,7 +674,7 @@ describe("InfrastructureSettings", () => {
           return "";
         },
       });
-      render(<InfrastructureSettings />);
+      render(<StorageSettings />);
 
       await userEvent.click(screen.getByRole("button", { name: "Review transition" }));
 
@@ -616,7 +702,7 @@ describe("InfrastructureSettings", () => {
       },
     });
     createStorageTransitionMock.mockResolvedValueOnce({ job: { id: "transition-s3" } });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     await userEvent.click(screen.getByRole("button", { name: "Review transition" }));
 
@@ -651,23 +737,23 @@ describe("InfrastructureSettings", () => {
       dirtyKeys: ["artwork.local_path"],
       isDirty: (key: string) => key === "artwork.local_path",
       getPersistedValue: (key: string) =>
-        key === "artwork.local_path" ? "/srv/silo/artwork-old" : "",
+        key === "artwork.local_path" ? "/srv/prairie/artwork-old" : "",
       getValue: (key: string) => {
         if (key === "artwork.storage_backend") return "local";
-        if (key === "artwork.local_path") return "/srv/silo/artwork-new";
+        if (key === "artwork.local_path") return "/srv/prairie/artwork-new";
         if (key === "s3.public_url_auth") return "presigned";
         return "";
       },
     });
     createStorageTransitionMock.mockResolvedValueOnce({ job: { id: "transition-local-path" } });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     expect(screen.getByLabelText("Local storage path")).toBeEnabled();
     await userEvent.click(screen.getByRole("button", { name: "Review transition" }));
 
     const dialog = screen.getByRole("dialog", { name: "Change artwork storage" });
     expect(within(dialog).getByLabelText("Local artwork path")).toHaveValue(
-      "/srv/silo/artwork-new",
+      "/srv/prairie/artwork-new",
     );
     await userEvent.click(within(dialog).getByRole("button", { name: "Queue transition" }));
     await waitFor(() =>
@@ -675,7 +761,7 @@ describe("InfrastructureSettings", () => {
         policy: "preserve_uploads",
         values: {
           "artwork.storage_backend": "local",
-          "artwork.local_path": "/srv/silo/artwork-new",
+          "artwork.local_path": "/srv/prairie/artwork-new",
         },
       }),
     );
@@ -689,15 +775,15 @@ describe("InfrastructureSettings", () => {
       dirtyKeys: ["artwork.local_path"],
       isDirty: (key: string) => key === "artwork.local_path",
       getPersistedValue: (key: string) =>
-        key === "artwork.local_path" ? "/srv/silo/artwork-old" : "",
+        key === "artwork.local_path" ? "/srv/prairie/artwork-old" : "",
       getValue: (key: string) => {
         if (key === "artwork.storage_backend") return "local";
-        if (key === "artwork.local_path") return "/srv/silo/artwork-new";
+        if (key === "artwork.local_path") return "/srv/prairie/artwork-new";
         if (key === "s3.public_url_auth") return "presigned";
         return "";
       },
     });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     await userEvent.click(screen.getByRole("button", { name: "Review transition" }));
 
@@ -724,7 +810,7 @@ describe("InfrastructureSettings", () => {
     ).not.toBeInTheDocument();
   });
 
-  it.each(["/srv/silo/artwork/", "/srv//silo/./artwork/"])(
+  it.each(["/srv/prairie/artwork/", "/srv//prairie/./artwork/"])(
     "does not start a transition for a restyled local path %s",
     (path) => {
       serverStatus.current = { artwork_storage: { backend: "local", locked: true } };
@@ -733,11 +819,11 @@ describe("InfrastructureSettings", () => {
         dirtyKeys: ["artwork.local_path"],
         isDirty: (key: string) => key === "artwork.local_path",
         getPersistedValue: (key: string) =>
-          key === "artwork.local_path" ? "/srv/silo/artwork" : "",
+          key === "artwork.local_path" ? "/srv/prairie/artwork" : "",
         getValue: (key: string) =>
           key === "artwork.local_path" ? path : key === "artwork.storage_backend" ? "local" : "",
       });
-      render(<InfrastructureSettings />);
+      render(<StorageSettings />);
 
       expect(screen.getByRole("button", { name: "Save" })).toBeVisible();
       expect(screen.queryByRole("button", { name: "Review transition" })).not.toBeInTheDocument();
@@ -755,29 +841,44 @@ describe("InfrastructureSettings", () => {
     serverStatus.isError = isError;
     const form = mockForm({
       dirtyCount: 2,
-      dirtyKeys: ["artwork.local_path", "database.max_connections"],
-      isDirty: (key: string) => key === "artwork.local_path" || key === "database.max_connections",
+      dirtyKeys: ["artwork.local_path", "metadata.cache_images"],
+      isDirty: (key: string) => key === "artwork.local_path" || key === "metadata.cache_images",
       getPersistedValue: (key: string) =>
-        key === "artwork.local_path" ? "/srv/silo/artwork-old" : "",
-      getValue: (key: string) => (key === "artwork.local_path" ? "/srv/silo/artwork-new" : ""),
+        key === "artwork.local_path" ? "/srv/prairie/artwork-old" : "",
+      getValue: (key: string) => (key === "artwork.local_path" ? "/srv/prairie/artwork-new" : ""),
     });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     expect(screen.getByRole("alert")).toHaveTextContent("Storage lock status is unavailable");
-    expect(screen.getByRole("group", { name: "Database" })).toBeInTheDocument();
-    expect(screen.getByLabelText("Maximum Postgres connections")).toBeVisible();
-    expect(screen.getByRole("group", { name: "Logs" })).toBeInTheDocument();
+    expect(screen.getByRole("switch", { name: "Save provider artwork to storage" })).toBeEnabled();
     expect(screen.getByRole("combobox", { name: "Backend" })).toBeDisabled();
     expect(screen.getByLabelText("Local storage path")).toBeDisabled();
-    const publicStorage = within(screen.getByRole("group", { name: "Public storage" }));
-    expect(publicStorage.getByLabelText("Bucket")).toBeDisabled();
-    const privateStorage = within(screen.getByRole("group", { name: "Private storage" }));
-    expect(privateStorage.getByLabelText("Endpoint")).toBeDisabled();
+    for (const name of ["Public storage", "Private storage"]) {
+      expect(screen.queryByRole("group", { name })).not.toBeInTheDocument();
+    }
     await userEvent.click(screen.getByRole("button", { name: "Save" }));
-    expect(form.save).toHaveBeenCalledWith(["database.max_connections"]);
+    expect(form.save).toHaveBeenCalledWith(["metadata.cache_images"]);
     expect(createStorageTransitionMock).not.toHaveBeenCalled();
   });
 
+  it("holds the public bucket location while lock status is unknown", () => {
+    serverStatus.current = {
+      artwork_storage: { backend: "s3", locked: true, status_known: false },
+    };
+    mockForm({
+      getPersistedValue: (key: string) => (key === "artwork.storage_backend" ? "s3" : ""),
+      getValue: (key: string) =>
+        key === "artwork.storage_backend" ? "s3" : key === "s3.public_url_auth" ? "presigned" : "",
+    });
+    render(<StorageSettings />);
+
+    const publicStorage = within(screen.getByRole("group", { name: "Public storage" }));
+    expect(publicStorage.getByLabelText("Endpoint")).toBeDisabled();
+    expect(publicStorage.getByLabelText("Bucket")).toBeDisabled();
+    // Credentials are not a location, so they stay editable.
+    expect(publicStorage.getByLabelText("Access Key")).toBeEnabled();
+  });
+
   it("holds a staged storage location until lock status can be retried", async () => {
     serverStatus.current = {
       artwork_storage: { backend: "local", locked: false, status_known: false },
@@ -786,9 +887,9 @@ describe("InfrastructureSettings", () => {
       dirtyCount: 1,
       dirtyKeys: ["artwork.local_path"],
       isDirty: (key: string) => key === "artwork.local_path",
-      getValue: (key: string) => (key === "artwork.local_path" ? "/srv/silo/artwork-new" : ""),
+      getValue: (key: string) => (key === "artwork.local_path" ? "/srv/prairie/artwork-new" : ""),
     });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     await userEvent.click(screen.getByRole("button", { name: "Save" }));
     expect(form.save).not.toHaveBeenCalled();
@@ -825,7 +926,7 @@ describe("InfrastructureSettings", () => {
       getPersistedValue: (key: string) => saved[key] ?? "",
       getValue: (key: string) => (key === "s3.public_access_key" ? "NEWKEY" : (saved[key] ?? "")),
     });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     await userEvent.click(screen.getByRole("button", { name: "Save" }));
     expect(form.save).toHaveBeenCalled();
@@ -850,7 +951,7 @@ describe("InfrastructureSettings", () => {
       getPersistedValue: (key: string) => saved[key] ?? "",
       getValue: (key: string) => (key === "s3.public_access_key" ? "NEWKEY" : (saved[key] ?? "")),
     });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     await userEvent.click(screen.getByRole("button", { name: "Review transition" }));
     expect(form.save).not.toHaveBeenCalled();
@@ -865,7 +966,7 @@ describe("InfrastructureSettings", () => {
       "s3.public_bucket",
       "s3.public_access_key",
       "s3.public_secret_key",
-      "database.max_connections",
+      "metadata.cache_images",
     ];
     const form = mockForm({
       dirtyCount: edited.length,
@@ -874,10 +975,10 @@ describe("InfrastructureSettings", () => {
       getPersistedValue: (key: string) => (key === "s3.public_bucket" ? "artwork-old" : ""),
       getValue: (key: string) => (key === "s3.public_bucket" ? "artwork-new" : ""),
     });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     await userEvent.click(screen.getByRole("button", { name: "Save" }));
-    expect(form.save).toHaveBeenCalledWith(["database.max_connections"]);
+    expect(form.save).toHaveBeenCalledWith(["metadata.cache_images"]);
   });
 
   it("routes an Automatic local backend to S3 when a public bucket is added", async () => {
@@ -896,7 +997,7 @@ describe("InfrastructureSettings", () => {
       },
     });
     createStorageTransitionMock.mockResolvedValueOnce({ job: { id: "transition-auto-s3" } });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     expect(
       screen.getByText(/Saving this bucket opens a managed transition from local storage/),
@@ -935,16 +1036,41 @@ describe("InfrastructureSettings", () => {
         return "";
       },
     });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     await userEvent.click(screen.getByRole("combobox", { name: "Backend" }));
     await userEvent.click(screen.getByRole("option", { name: "Automatic" }));
 
+    expect(form.setValue).toHaveBeenCalledWith("artwork.storage_backend", "auto");
+    expect(
+      screen.queryByRole("dialog", { name: "Change artwork storage" }),
+    ).not.toBeInTheDocument();
+  });
+
+  it("reviews a staged Local to Automatic switch with a saved public bucket as an S3 move", async () => {
+    serverStatus.current = { artwork_storage: { backend: "local", locked: true } };
+    mockForm({
+      dirtyCount: 1,
+      dirtyKeys: ["artwork.storage_backend"],
+      isDirty: (key: string) => key === "artwork.storage_backend",
+      getPersistedValue: (key: string) =>
+        key === "artwork.storage_backend" ? "local" : key === "s3.public_bucket" ? "artwork" : "",
+      getValue: (key: string) => {
+        if (key === "artwork.storage_backend") return "auto";
+        if (key === "s3.public_bucket") return "artwork";
+        if (key === "s3.public_endpoint") return "https://s3.example";
+        if (key === "s3.public_url_auth") return "presigned";
+        return "";
+      },
+    });
+    render(<StorageSettings />);
+
+    await userEvent.click(screen.getByRole("button", { name: "Review transition" }));
+
     const dialog = screen.getByRole("dialog", { name: "Change artwork storage" });
     expect(within(dialog).getByRole("group", { name: "Target" })).toHaveTextContent(
       "New S3 location",
     );
-    expect(form.setValue).not.toHaveBeenCalledWith("artwork.storage_backend", "auto");
   });
 
   it("routes Automatic S3 to local when its public bucket is cleared", async () => {
@@ -957,14 +1083,14 @@ describe("InfrastructureSettings", () => {
         key === "artwork.storage_backend" ? "auto" : key === "s3.public_bucket" ? "artwork" : "",
       getValue: (key: string) => {
         if (key === "artwork.storage_backend") return "auto";
-        if (key === "artwork.local_path") return "/srv/silo/artwork";
+        if (key === "artwork.local_path") return "/srv/prairie/artwork";
         if (key === "s3.public_bucket") return "";
         if (key === "s3.public_url_auth") return "presigned";
         return "";
       },
     });
     createStorageTransitionMock.mockResolvedValueOnce({ job: { id: "transition-auto-local" } });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     await userEvent.click(screen.getByRole("button", { name: "Review transition" }));
     const dialog = screen.getByRole("dialog", { name: "Change artwork storage" });
@@ -977,7 +1103,7 @@ describe("InfrastructureSettings", () => {
         policy: "start_fresh",
         values: {
           "artwork.storage_backend": "local",
-          "artwork.local_path": "/srv/silo/artwork",
+          "artwork.local_path": "/srv/prairie/artwork",
         },
       }),
     );
@@ -991,7 +1117,7 @@ describe("InfrastructureSettings", () => {
       getValue: (key: string) =>
         key === "artwork.storage_backend" ? "s3" : key === "s3.public_bucket" ? "artwork" : "",
     });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     await userEvent.click(screen.getByRole("combobox", { name: "Backend" }));
     await userEvent.click(screen.getByRole("option", { name: "Automatic" }));
@@ -1013,30 +1139,37 @@ describe("InfrastructureSettings", () => {
     );
     mockForm({
       dirtyCount: 2,
-      dirtyKeys: ["artwork.local_path", "database.max_connections"],
-      isDirty: (key: string) => key === "artwork.local_path" || key === "database.max_connections",
+      dirtyKeys: ["artwork.local_path", "metadata.cache_images"],
+      isDirty: (key: string) => key === "artwork.local_path" || key === "metadata.cache_images",
+      // A saved private bucket keeps Private storage on the Local disk page.
       getPersistedValue: (key: string) =>
-        key === "artwork.local_path" ? "/srv/silo/artwork-old" : "",
+        key === "artwork.local_path"
+          ? "/srv/prairie/artwork-old"
+          : key === "s3.private_bucket"
+            ? "ops"
+            : "",
       getValue: (key: string) => {
         if (key === "artwork.storage_backend") return "local";
-        if (key === "artwork.local_path") return "/srv/silo/artwork-new";
+        if (key === "artwork.local_path") return "/srv/prairie/artwork-new";
+        if (key === "s3.private_bucket") return "ops";
         if (key === "s3.public_url_auth") return "presigned";
         return "";
       },
       save,
     });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
+    const privateStorage = within(screen.getByRole("group", { name: "Private storage" }));
+    expect(privateStorage.getByLabelText("Endpoint")).toBeEnabled();
 
     await userEvent.click(screen.getByRole("button", { name: "Review transition" }));
-    expect(save).toHaveBeenCalledWith(["database.max_connections"]);
+    expect(save).toHaveBeenCalledWith(["metadata.cache_images"]);
     expect(screen.getByLabelText("Local storage path")).toBeDisabled();
-    const publicStorage = within(screen.getByRole("group", { name: "Public storage" }));
-    expect(publicStorage.getByLabelText("Endpoint")).toBeDisabled();
-    expect(publicStorage.getByLabelText("Bucket")).toBeDisabled();
+    expect(privateStorage.getByLabelText("Endpoint")).toBeDisabled();
+    expect(privateStorage.getByLabelText("Bucket")).toBeDisabled();
 
     finishSave?.();
     expect(await screen.findByRole("dialog", { name: "Change artwork storage" })).toBeVisible();
-    expect(screen.getByLabelText("Local artwork path")).toHaveValue("/srv/silo/artwork-new");
+    expect(screen.getByLabelText("Local artwork path")).toHaveValue("/srv/prairie/artwork-new");
   });
 
   it("keeps public bucket edits as settings on an explicit Local backend", () => {
@@ -1053,7 +1186,7 @@ describe("InfrastructureSettings", () => {
         return "";
       },
     });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     expect(screen.getByRole("button", { name: "Save" })).toBeVisible();
     expect(screen.queryByRole("button", { name: "Review transition" })).not.toBeInTheDocument();
@@ -1078,7 +1211,7 @@ describe("InfrastructureSettings", () => {
         return "";
       },
     });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     await userEvent.click(screen.getByRole("button", { name: "Review transition" }));
     expect(screen.getByRole("dialog", { name: "Change artwork storage" })).toBeVisible();
@@ -1105,7 +1238,7 @@ describe("InfrastructureSettings", () => {
         return "";
       },
     });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     await userEvent.click(screen.getByRole("button", { name: "Review transition" }));
     expect(screen.getByRole("dialog", { name: "Change private storage" })).toBeVisible();
@@ -1114,18 +1247,21 @@ describe("InfrastructureSettings", () => {
   it("warns that Start fresh leaves downloaded subtitles behind on local-to-S3 moves", async () => {
     serverStatus.current = { artwork_storage: { backend: "local", locked: true } };
     mockForm({
+      dirtyCount: 1,
+      dirtyKeys: ["artwork.storage_backend"],
+      isDirty: (key: string) => key === "artwork.storage_backend",
+      getPersistedValue: (key: string) => (key === "artwork.storage_backend" ? "local" : ""),
       getValue: (key: string) => {
-        if (key === "artwork.storage_backend") return "local";
+        if (key === "artwork.storage_backend") return "s3";
         if (key === "s3.public_bucket") return "artwork";
         if (key === "s3.public_endpoint") return "https://s3.example";
         if (key === "s3.public_url_auth") return "presigned";
         return "";
       },
     });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
-    await userEvent.click(screen.getByRole("combobox", { name: "Backend" }));
-    await userEvent.click(screen.getByRole("option", { name: "S3" }));
+    await userEvent.click(screen.getByRole("button", { name: "Review transition" }));
 
     const startFresh = screen.getByRole("radio", { name: /Start fresh/ }).closest("label");
     expect(startFresh).toHaveTextContent(/Downloaded subtitles.*unavailable after the switch/);
@@ -1146,7 +1282,7 @@ describe("InfrastructureSettings", () => {
         return "";
       },
     });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     await userEvent.click(screen.getByRole("button", { name: "Review transition" }));
 
@@ -1170,7 +1306,7 @@ describe("InfrastructureSettings", () => {
         return "";
       },
     });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     await userEvent.click(screen.getByRole("button", { name: "Review transition" }));
 
@@ -1208,7 +1344,7 @@ describe("InfrastructureSettings", () => {
           return "";
         },
       });
-      const view = render(<InfrastructureSettings />);
+      const view = render(<StorageSettings />);
       await userEvent.click(screen.getByRole("button", { name: "Review transition" }));
       const dialog = screen.getByRole("dialog", { name: "Change artwork storage" });
       expect(dialog).toBeVisible();
@@ -1234,17 +1370,20 @@ describe("InfrastructureSettings", () => {
   it("requires private S3 before offering avatar-preserving copy policies", async () => {
     serverStatus.current = { artwork_storage: { backend: "local", locked: true } };
     mockForm({
+      dirtyCount: 1,
+      dirtyKeys: ["artwork.storage_backend"],
+      isDirty: (key: string) => key === "artwork.storage_backend",
+      getPersistedValue: (key: string) => (key === "artwork.storage_backend" ? "local" : ""),
       getValue: (key: string) => {
-        if (key === "artwork.storage_backend") return "local";
+        if (key === "artwork.storage_backend") return "s3";
         if (key === "s3.public_bucket") return "public-artwork";
         if (key === "s3.public_url_auth") return "presigned";
         return "";
       },
     });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
-    await userEvent.click(screen.getByRole("combobox", { name: "Backend" }));
-    await userEvent.click(screen.getByRole("option", { name: "S3" }));
+    await userEvent.click(screen.getByRole("button", { name: "Review transition" }));
 
     expect(screen.getByRole("radio", { name: /Preserve personal uploads/ })).toBeDisabled();
     expect(screen.getByRole("radio", { name: /Migrate everything/ })).toBeDisabled();
@@ -1263,7 +1402,7 @@ describe("InfrastructureSettings", () => {
       isDirty: (key: string) => key === "s3.private_endpoint" || key === "s3.private_bucket",
       getValue: (key: string) => {
         if (key === "artwork.storage_backend") return "local";
-        if (key === "artwork.local_path") return "/srv/silo/artwork";
+        if (key === "artwork.local_path") return "/srv/prairie/artwork";
         if (key === "s3.private_endpoint") return "https://private.example";
         if (key === "s3.private_bucket") return "private-new";
         if (key === "s3.public_url_auth") return "presigned";
@@ -1271,7 +1410,7 @@ describe("InfrastructureSettings", () => {
       },
     });
     createStorageTransitionMock.mockResolvedValueOnce({ job: { id: "transition-private" } });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     await userEvent.click(screen.getByRole("button", { name: "Review transition" }));
 
@@ -1289,7 +1428,7 @@ describe("InfrastructureSettings", () => {
         policy: "migrate_all",
         values: {
           "artwork.storage_backend": "local",
-          "artwork.local_path": "/srv/silo/artwork",
+          "artwork.local_path": "/srv/prairie/artwork",
           "s3.private_endpoint": "https://private.example",
           "s3.private_bucket": "private-new",
         },
@@ -1307,12 +1446,12 @@ describe("InfrastructureSettings", () => {
       getPersistedValue: (key: string) => (key === "s3.private_bucket" ? "private-old" : ""),
       getValue: (key: string) => {
         if (key === "artwork.storage_backend") return "local";
-        if (key === "artwork.local_path") return "/srv/silo/artwork";
+        if (key === "artwork.local_path") return "/srv/prairie/artwork";
         if (key === "s3.public_url_auth") return "presigned";
         return "";
       },
     });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     await userEvent.click(screen.getByRole("button", { name: "Review transition" }));
 
@@ -1333,7 +1472,7 @@ describe("InfrastructureSettings", () => {
       getPersistedValue: (key: string) => (key === "s3.private_bucket" ? "private" : ""),
       getValue: (key: string) => (key === "s3.private_bucket" ? "private " : ""),
     });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     expect(screen.getByRole("button", { name: "Save" })).toBeVisible();
     expect(screen.queryByRole("button", { name: "Review transition" })).not.toBeInTheDocument();
@@ -1357,7 +1496,7 @@ describe("InfrastructureSettings", () => {
         return "";
       },
     });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     await userEvent.click(screen.getByRole("button", { name: "Review transition" }));
 
@@ -1377,13 +1516,13 @@ describe("InfrastructureSettings", () => {
       isDirty: (key: string) => key === "s3.private_bucket",
       getValue: (key: string) => {
         if (key === "artwork.storage_backend") return "local";
-        if (key === "artwork.local_path") return "/srv/silo/artwork";
+        if (key === "artwork.local_path") return "/srv/prairie/artwork";
         if (key === "s3.private_bucket") return "private-new";
         if (key === "s3.public_url_auth") return "presigned";
         return "";
       },
     });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     await userEvent.click(screen.getByRole("button", { name: "Review transition" }));
 
@@ -1401,12 +1540,12 @@ describe("InfrastructureSettings", () => {
       getPersistedValue: (key: string) => (key === "s3.private_bucket" ? "private" : ""),
       getValue: (key: string) => {
         if (key === "artwork.storage_backend") return "s3";
-        if (key === "artwork.local_path") return "/srv/silo/artwork";
+        if (key === "artwork.local_path") return "/srv/prairie/artwork";
         if (key === "s3.public_url_auth") return "presigned";
         return "";
       },
     });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     await userEvent.click(screen.getByRole("combobox", { name: "Backend" }));
     await userEvent.click(screen.getByRole("option", { name: "Local disk" }));
@@ -1436,7 +1575,7 @@ describe("InfrastructureSettings", () => {
       getPersistedValue: (key: string) => persisted[key] ?? "",
       getValue: (key: string) => edited[key] ?? "",
     });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     expect(screen.getByRole("button", { name: "Save" })).toBeVisible();
   });
@@ -1449,7 +1588,7 @@ describe("InfrastructureSettings", () => {
       getPersistedValue: (key: string) => (key === "s3.private_key_prefix" ? "ops" : ""),
       getValue: () => "",
     });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     expect(screen.getByRole("button", { name: "Save" })).toBeVisible();
   });
@@ -1469,13 +1608,13 @@ describe("InfrastructureSettings", () => {
             : "",
       getValue: (key: string) => {
         if (key === "artwork.storage_backend") return "local";
-        if (key === "artwork.local_path") return "/srv/silo/artwork";
+        if (key === "artwork.local_path") return "/srv/prairie/artwork";
         if (key === "s3.private_endpoint") return "https://private.example";
         if (key === "s3.private_bucket") return "private-new";
         return "";
       },
     });
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     expect(screen.getByLabelText("Local storage path")).toBeEnabled();
     await userEvent.click(screen.getByRole("button", { name: "Review transition" }));
@@ -1490,7 +1629,7 @@ describe("InfrastructureSettings", () => {
     });
     mockForm();
 
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     expect(screen.queryByText(/Storage transition:/)).not.toBeInTheDocument();
     expect(screen.queryByRole("button", { name: "Refresh" })).not.toBeInTheDocument();
@@ -1516,7 +1655,7 @@ describe("InfrastructureSettings", () => {
     });
     mockForm();
 
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     expect(screen.getByText("Storage transition failed")).toBeVisible();
     expect(screen.getByText(/Target storage could not be verified/)).toBeVisible();
@@ -1543,7 +1682,7 @@ describe("InfrastructureSettings", () => {
     });
     mockForm();
 
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     expect(screen.getByText("Manual restart required")).toBeVisible();
     expect(screen.getByText(/Restart the server to activate the new storage safely/)).toBeVisible();
@@ -1565,7 +1704,7 @@ describe("InfrastructureSettings", () => {
       refetch: vi.fn(),
     });
     mockForm();
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
     expect(screen.queryByText("Manual restart required")).not.toBeInTheDocument();
   });
 
@@ -1590,7 +1729,7 @@ describe("InfrastructureSettings", () => {
       refetch: vi.fn(),
     });
     mockForm();
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
     expect(sourceHealthMock).toHaveBeenCalledWith(false, true);
     expect(sourceHealthMock).toHaveBeenCalledWith(true, false);
     expect(screen.getByText("Storage recovery: waiting to retry")).toBeVisible();
@@ -1617,7 +1756,7 @@ describe("InfrastructureSettings", () => {
     });
     mockForm();
 
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     expect(screen.getByText("Storage transition: running")).toBeInTheDocument();
     expect(screen.getByText("Copying storage objects")).toBeVisible();
@@ -1628,13 +1767,17 @@ describe("InfrastructureSettings", () => {
   });
 
   it("keeps a saved credential when its input is emptied", async () => {
+    const values: Record<string, string> = {
+      "artwork.storage_backend": "s3",
+      "s3.public_access_key": "draft",
+      "s3.public_url_auth": "presigned",
+    };
     const form = mockForm({
       sensitiveConfigured: ["s3.public_access_key", "s3.public_secret_key"],
-      getValue: (key: string) =>
-        key === "s3.public_access_key" ? "draft" : key === "s3.public_url_auth" ? "presigned" : "",
+      getValue: (key: string) => values[key] ?? "",
     });
 
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     // No Replace step: the saved credential is a masked, always-editable input.
     const publicGroup = within(screen.getByRole("group", { name: "Public storage" }));
@@ -1656,7 +1799,7 @@ describe("InfrastructureSettings", () => {
       save: vi.fn().mockRejectedValue(new Error("save failed")),
     });
 
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     const privateGroup = within(screen.getByRole("group", { name: "Private storage" }));
     await userEvent.click(screen.getByRole("button", { name: "Save" }));
@@ -1669,7 +1812,7 @@ describe("InfrastructureSettings", () => {
   it("fails closed when protected credential status cannot be loaded", () => {
     mockForm({ sensitiveStatusReady: false, sensitiveStatusError: true });
 
-    render(<InfrastructureSettings />);
+    render(<StorageSettings />);
 
     expect(screen.getByRole("alert")).toHaveTextContent(
       "Protected credential status is unavailable",
@@ -1678,44 +1821,67 @@ describe("InfrastructureSettings", () => {
     expect(screen.queryByLabelText("Secret Key")).not.toBeInTheDocument();
   });
 
-  it("stages bucket override edits through the shared save model", async () => {
-    const setValue = vi.fn();
-    mockForm({
-      setValue,
-      isDirty: (key: string) => key === OPSLOG_BUCKET_POLICIES_KEY,
-      dirtyCount: 1,
-      getValue: (key: string) => {
-        if (key === "s3.public_url_auth") return "presigned";
-        if (key === OPSLOG_BUCKET_POLICIES_KEY) {
-          return JSON.stringify([
-            {
-              component: "metadata",
-              level: "info",
-              retention_days: 1,
-              max_rows: 100,
-              max_size_mb: 8,
-            },
-          ]);
-        }
-        return "";
-      },
+  describe("staging the S3 backend", () => {
+    beforeEach(() => {
+      realForm.enabled = true;
+      serverSettings.current = {
+        "artwork.storage_backend": "local",
+        "s3.public_url_auth": "presigned",
+      };
+      sensitiveStatus.current = { configured: [], managed_by_env: [] };
+      updateSettingsMock.mockReset();
+      updateSettingsMock.mockResolvedValue({ values: {}, restart_required: false });
+    });
+
+    afterEach(() => {
+      realForm.enabled = false;
+    });
+
+    it("shows public storage once S3 is picked and saves its bucket", async () => {
+      render(<StorageSettings />);
+      expect(screen.queryByRole("group", { name: "Public storage" })).not.toBeInTheDocument();
+
+      await userEvent.click(screen.getByRole("combobox", { name: "Backend" }));
+      await userEvent.click(screen.getByRole("option", { name: "S3" }));
+      expect(screen.getByRole("group", { name: "Private storage" })).toBeInTheDocument();
+      const publicStorage = within(screen.getByRole("group", { name: "Public storage" }));
+      await userEvent.type(publicStorage.getByLabelText("Bucket"), "artwork");
+      await userEvent.click(screen.getByRole("button", { name: "Save" }));
+
+      await waitFor(() =>
+        expect(updateSettingsMock).toHaveBeenCalledWith({
+          "artwork.storage_backend": "s3",
+          "s3.public_bucket": "artwork",
+        }),
+      );
     });
 
-    render(<InfrastructureSettings />);
+    it("opens the review on Save after S3 is picked on a locked local install", async () => {
+      serverStatus.current = { artwork_storage: { backend: "local", locked: true } };
+      render(<StorageSettings />);
 
-    await userEvent.click(screen.getByRole("button", { name: /Remove metadata rule/ }));
+      await userEvent.click(screen.getByRole("combobox", { name: "Backend" }));
+      await userEvent.click(screen.getByRole("option", { name: "S3" }));
+      expect(screen.queryByRole("dialog")).not.toBeInTheDocument();
+      const publicStorage = within(screen.getByRole("group", { name: "Public storage" }));
+      await userEvent.type(publicStorage.getByLabelText("Bucket"), "artwork");
+      await userEvent.click(screen.getByRole("button", { name: "Review transition" }));
 
-    expect(setValue).toHaveBeenCalledWith(OPSLOG_BUCKET_POLICIES_KEY, "[]");
+      const dialog = await screen.findByRole("dialog", { name: "Change artwork storage" });
+      expect(within(dialog).getByRole("group", { name: "Target" })).toHaveTextContent("artwork");
+      expect(updateSettingsMock).not.toHaveBeenCalled();
+      serverStatus.current = { artwork_storage: { backend: "local", locked: false } };
+    });
   });
 
   describe("clearing a stored credential", () => {
     beforeEach(() => {
       realForm.enabled = true;
-      serverSettings.current = { "s3.public_url_auth": "presigned" };
-      sensitiveStatus.current = {
-        configured: ["s3.public_access_key"],
-        managed_by_env: [],
+      serverSettings.current = {
+        "artwork.storage_backend": "s3",
+        "s3.public_url_auth": "presigned",
       };
+      sensitiveStatus.current = { configured: ["s3.public_access_key"], managed_by_env: [] };
       updateSettingsMock.mockReset();
       updateSettingsMock.mockResolvedValue({
         values: {},
@@ -1728,7 +1894,7 @@ describe("InfrastructureSettings", () => {
     });
 
     it("stages the clear in the save bar and saves it as an empty value", async () => {
-      render(<InfrastructureSettings />);
+      render(<StorageSettings />);
 
       const publicGroup = within(screen.getByRole("group", { name: "Public storage" }));
       await userEvent.click(publicGroup.getByRole("button", { name: "Clear saved value" }));
@@ -1745,7 +1911,7 @@ describe("InfrastructureSettings", () => {
     });
 
     it("takes the clear back out of the save bar when the saved value is kept", async () => {
-      render(<InfrastructureSettings />);
+      render(<StorageSettings />);
 
       const publicGroup = within(screen.getByRole("group", { name: "Public storage" }));
       await userEvent.click(publicGroup.getByRole("button", { name: "Clear saved value" }));
@@ -1757,21 +1923,5 @@ describe("InfrastructureSettings", () => {
         "••••••••••••",
       );
     });
-
-    it("leaves an env-managed credential without a clear action", async () => {
-      serverSettings.current = { "redis.url": "" };
-      sensitiveStatus.current = {
-        configured: ["redis.url"],
-        managed_by_env: ["redis.url"],
-      };
-
-      render(<InfrastructureSettings />);
-
-      const redisGroup = within(screen.getByRole("group", { name: "Redis" }));
-      expect(redisGroup.getByLabelText("Connection URL")).toBeDisabled();
-      expect(
-        redisGroup.queryByRole("button", { name: "Clear saved value" }),
-      ).not.toBeInTheDocument();
-    });
   });
 });
diff --git a/web/src/pages/admin-settings/InfrastructureSettings.tsx b/web/src/pages/admin-settings/StorageSettings.tsx
similarity index 67%
rename from web/src/pages/admin-settings/InfrastructureSettings.tsx
rename to web/src/pages/admin-settings/StorageSettings.tsx
index 9b573aa22b..17eed7a8af 100644
--- a/web/src/pages/admin-settings/InfrastructureSettings.tsx
+++ b/web/src/pages/admin-settings/StorageSettings.tsx
@@ -1,5 +1,5 @@
 import { useMemo, useRef, useState } from "react";
-import { AlertTriangle, Plus, RotateCcw, Trash2 } from "lucide-react";
+import { AlertTriangle } from "lucide-react";
 
 import type {
   ConnectionCheckResponse,
@@ -11,7 +11,6 @@ import { ConnectionCheckAction } from "@/components/admin/ConnectionCheckAction"
 import { AdvancedSection } from "@/components/settings/AdvancedSection";
 import { SecretField } from "@/components/settings/SecretField";
 import { SettingsPageHeader } from "@/components/settings/SettingsPageHeader";
-import { SettingsSubheading } from "@/components/settings/SettingsSubheading";
 import { Button } from "@/components/ui/button";
 import {
   Dialog,
@@ -22,13 +21,6 @@ import {
   DialogTitle,
 } from "@/components/ui/dialog";
 import { Input } from "@/components/ui/input";
-import {
-  Select,
-  SelectContent,
-  SelectItem,
-  SelectTrigger,
-  SelectValue,
-} from "@/components/ui/select";
 import { Skeleton } from "@/components/ui/skeleton";
 import {
   useAdminServerStatus,
@@ -47,36 +39,10 @@ import { SaveBar } from "@/components/SaveBar";
 
 import { FieldGroup } from "./FieldGroup";
 import { SettingField } from "./SettingField";
-import { USER_DATABASE_BACKEND_OPTIONS } from "./databaseSettingOptions";
 import { cleanPath } from "./settingsPathDefaults";
-import {
-  LOG_LEVEL_OPTIONS,
-  OPSLOG_BUCKET_POLICIES_KEY,
-  OPSLOG_MAX_ROWS_KEY,
-  OPSLOG_MAX_SIZE_MB_KEY,
-  OPSLOG_RETENTION_DAYS_KEY,
-  appendBucketRow,
-  bucketRowsFromRaw,
-  recommendedBucketRows,
-  removeBucketRow,
-  serializeBucketRows,
-  updateBucketRow,
-  type LogRetentionBucketPolicy,
-  type LogRetentionBucketRow,
-} from "./logRetentionPolicy";
-import { keepSavedRedisUrl, stageRedisUrl } from "./redisDraft";
 
 type SettingsForm = ReturnType<typeof useSettingsForm>;
 
-const REDIS_KEYS = ["redis.url", "redis.db"];
-
-const DATABASE_KEYS = [
-  "database.max_connections",
-  "userdb.backend",
-  "userdb.pool_max_open",
-  "userdb.idle_timeout",
-];
-
 const PUBLIC_S3_KEYS = [
   "s3.public_endpoint",
   "s3.public_region",
@@ -92,6 +58,15 @@ const PUBLIC_S3_KEYS = [
   "s3.public_token_ttl",
 ];
 
+// Shown only for the link modes that use them, behind public storage's
+// Advanced disclosure.
+const PUBLIC_S3_ADVANCED_KEYS = [
+  "s3.public_read_endpoint",
+  "s3.public_token_secret",
+  "s3.public_token_param",
+  "s3.public_token_ttl",
+];
+
 // Changing any of these moves where cached artwork objects live. Once artwork
 // has been stored in S3, direct settings writes are rejected and this page
 // routes the edit through the managed storage transition flow instead.
@@ -125,28 +100,14 @@ const STORAGE_TRANSITION_KEYS = new Set([
   ...PRIVATE_S3_KEYS,
 ]);
 
-// The overall trim limits are what an admin comes here to change; the policy
-// decision log and the per-area rules are debugging tools behind Advanced.
-const LOG_ESSENTIAL_KEYS = [OPSLOG_RETENTION_DAYS_KEY, OPSLOG_MAX_ROWS_KEY, OPSLOG_MAX_SIZE_MB_KEY];
+// Whether provider artwork is copied into storage at all. It hot-reloads and
+// names no location, so it saves like any other setting, never through a
+// transition.
+const CACHE_IMAGES_KEY = "metadata.cache_images";
 
-const LOG_ADVANCED_KEYS = [
-  "policy.decision_log_retention_days",
-  "policy.decision_log_verbosity",
-  "policy.decision_log_scope_sample_rate",
-  OPSLOG_BUCKET_POLICIES_KEY,
-];
+const STORAGE_GROUP_KEYS = ["artwork.storage_backend", "artwork.local_path", CACHE_IMAGES_KEY];
 
-const LOG_KEYS = [...LOG_ESSENTIAL_KEYS, ...LOG_ADVANCED_KEYS];
-
-const KEYS = [
-  "artwork.storage_backend",
-  "artwork.local_path",
-  ...REDIS_KEYS,
-  ...DATABASE_KEYS,
-  ...PUBLIC_S3_KEYS,
-  ...PRIVATE_S3_KEYS,
-  ...LOG_KEYS,
-];
+const KEYS = [...STORAGE_GROUP_KEYS, ...PUBLIC_S3_KEYS, ...PRIVATE_S3_KEYS];
 
 function countDirty(form: SettingsForm, keys: string[]): number {
   return keys.filter((key) => form.isDirty(key)).length;
@@ -155,8 +116,7 @@ function countDirty(form: SettingsForm, keys: string[]): number {
 // Whether a group may claim "changes apply after a restart" for all of its
 // fields at once. Computed from the server's restart registry rather than
 // asserted, so converting one key to hot-reload silently demotes its group to
-// per-field chips instead of leaving a false blanket claim — the Logs group
-// below is exactly that case today.
+// per-field chips instead of leaving a false blanket claim.
 function allRestart(restartKeys: RestartKeyMatcher, keys: string[]): boolean {
   return keys.every((key) => restartKeys.has(key));
 }
@@ -246,123 +206,6 @@ interface SecretEditors {
   disabled: boolean;
 }
 
-function RedisGroup({
-  form,
-  restartKeys,
-  secrets,
-}: {
-  form: SettingsForm;
-  restartKeys: RestartKeyMatcher;
-  secrets: SecretEditors;
-}) {
-  const checkConnection = useCheckAdminSettingsConnection();
-  const [connectionResult, setConnectionResult] = useState<ConnectionCheckResponse | null>(null);
-  const redisUrl = form.getValue("redis.url");
-  const managedByEnv = form.sensitiveManagedByEnv.includes("redis.url");
-  const configured = form.sensitiveConfigured.includes("redis.url");
-  const [enabledOverride, setEnabledOverride] = useState<boolean | null>(null);
-  // Saving or discarding clears the toggle override so it follows the stored
-  // URL again. Adjusting during render (rather than in an effect) keeps the
-  // override alive while the admin is still editing.
-  const [lastDirtyCount, setLastDirtyCount] = useState(form.dirtyCount);
-  if (lastDirtyCount !== form.dirtyCount) {
-    setLastDirtyCount(form.dirtyCount);
-    if (form.dirtyCount === 0) setEnabledOverride(null);
-  }
-  const enabled = enabledOverride ?? (redisUrl.trim() !== "" || configured);
-  // URL edits go through the page's secret editors, which drop a keystroke
-  // that arrives while a save is in flight.
-  const urlDraft = { ...form, setValue: secrets.setSecret, resetValue: secrets.keepSaved };
-
-  async function handleCheckConnection() {
-    try {
-      setConnectionResult(
-        await checkConnection.mutateAsync({
-          kind: "redis",
-          body: form.buildConnectionCheckRequest(REDIS_KEYS),
-        }),
-      );
-    } catch (error) {
-      setConnectionResult({
-        success: false,
-        message: error instanceof Error ? error.message : "Connection check failed.",
-      });
-    }
-  }
-
-  return (
-    <FieldGroup label="Redis" restartAll={allRestart(restartKeys, REDIS_KEYS)}>
-      <SettingField
-        label="Use Redis"
-        type="toggle"
-        description={
-          managedByEnv ? "Set by REDIS_URL" : "Needed when running more than one server."
-        }
-        value={enabled ? "true" : "false"}
-        onChange={(value) => {
-          if (value === "true") {
-            setEnabledOverride(true);
-            // Takes back a staged switch-off, which cleared the number too.
-            form.resetValue("redis.url");
-            form.resetValue("redis.db");
-            return;
-          }
-          setEnabledOverride(false);
-          stageRedisUrl(form, "");
-        }}
-        disabled={managedByEnv}
-        restartRequired={restartKeys.has("redis.url")}
-      />
-      {enabled && (
-        <>
-          {/*
-            No `onClear` here: the Use Redis switch above already stages the
-            empty URL, and one clear per surface is the rule.
-          */}
-          <SecretField
-            label="Connection URL"
-            value={redisUrl}
-            configured={configured}
-            onKeep={() => keepSavedRedisUrl(urlDraft)}
-            onChange={(v) => stageRedisUrl(urlDraft, v)}
-            hint={managedByEnv ? "Value supplied by REDIS_URL" : "redis://host:6379"}
-            disabled={managedByEnv || secrets.disabled}
-            restartRequired={restartKeys.has("redis.url")}
-          />
-          {/*
-            The server reports the number in use here while none is saved: the
-            one in the URL, or in REDIS_URL when the environment supplies it.
-          */}
-          <SettingField
-            label="Database number"
-            type="number"
-            description={
-              managedByEnv
-                ? "Set by REDIS_URL"
-                : "Replaces the number in the URL. Installs sharing one Redis each need their own."
-            }
-            value={form.getValue("redis.db")}
-            onChange={(v) => form.setValue("redis.db", v)}
-            disabled={managedByEnv}
-            restartRequired={restartKeys.has("redis.db")}
-          />
-          {/*
-            Env-managed URLs stay checkable: the field is read-only so nothing
-            is dirty, and the server checks the effective value it merged from
-            REDIS_URL. Only writes are refused for env-managed keys.
-          */}
-          <ConnectionCheckAction
-            onClick={handleCheckConnection}
-            result={connectionResult}
-            isPending={checkConnection.isPending}
-            disabled={form.isSaving}
-          />
-        </>
-      )}
-    </FieldGroup>
-  );
-}
-
 // normalizeLocationValue compares storage location fields the way the server
 // names stores: endpoint scheme and host and the bucket are case-insensitive,
 // and a key prefix ignores its slashes. Preserve explicit ports and endpoint
@@ -418,24 +261,14 @@ function S3Group({
   const key = (suffix: string) => `s3.${scope}_${suffix}`;
   const urlAuth = form.getValue("s3.public_url_auth") || "presigned";
 
-  const advancedKeys =
-    scope === "public"
-      ? [
-          "s3.public_region",
-          "s3.public_path_style",
-          "s3.public_key_prefix",
-          "s3.public_url_auth",
-          "s3.public_read_endpoint",
-          "s3.public_token_secret",
-          "s3.public_token_param",
-          "s3.public_token_ttl",
-        ]
-      : ["s3.private_region", "s3.private_path_style", "s3.private_key_prefix"];
+  // Everything that reaches the bucket is shown. Only public storage has an
+  // Advanced tier: the CDN address and the Cloudflare token settings, which
+  // exist only for the link modes that use them.
   const advancedCount =
     scope === "public"
-      ? 4 + (urlAuth !== "presigned" ? 1 : 0) + (urlAuth === "cloudflare_token" ? 3 : 0)
-      : 3;
-  const advancedChanged = countDirty(form, advancedKeys);
+      ? (urlAuth !== "presigned" ? 1 : 0) + (urlAuth === "cloudflare_token" ? 3 : 0)
+      : 0;
+  const advancedChanged = countDirty(form, PUBLIC_S3_ADVANCED_KEYS);
 
   async function handleCheckConnection() {
     try {
@@ -470,6 +303,14 @@ function S3Group({
         disabled={secrets.disabled || locationFieldsDisabled}
         restartRequired={restartKeys.has(key("bucket"))}
       />
+      <SettingField
+        label="Folder inside the bucket"
+        description="Leave blank to use the bucket root."
+        value={form.getValue(key("key_prefix"))}
+        onChange={(v) => form.setValue(key("key_prefix"), v)}
+        disabled={secrets.disabled || locationFieldsDisabled}
+        restartRequired={restartKeys.has(key("key_prefix"))}
+      />
       {(scope === "public" ? PUBLIC_S3_IDENTITY_KEYS : PRIVATE_S3_IDENTITY_KEYS).some((k) =>
         form.isDirty(k),
       ) && (
@@ -497,6 +338,21 @@ function S3Group({
           </div>
         </div>
       )}
+      <SettingField
+        label="Region"
+        description="Leave blank unless your provider requires one."
+        value={form.getValue(key("region"))}
+        onChange={(v) => form.setValue(key("region"), v)}
+        restartRequired={restartKeys.has(key("region"))}
+      />
+      <SettingField
+        label="Put the bucket name in the URL path"
+        type="toggle"
+        description="Needed by MinIO and some self-hosted storage."
+        value={form.getValue(key("path_style"))}
+        onChange={(v) => form.setValue(key("path_style"), v)}
+        restartRequired={restartKeys.has(key("path_style"))}
+      />
       {/*
         The access and secret keys must stay configured together, so clearing
         one alone is refused at save time. Both carry the action, which is what
@@ -531,51 +387,27 @@ function S3Group({
         isPending={checkConnection.isPending}
         disabled={form.isSaving}
       />
-
-      <AdvancedSection
-        id={`infrastructure.s3.${scope}`}
-        count={advancedCount}
-        forceOpen={advancedChanged > 0}
-      >
-        <SettingField
-          label="Region"
-          description="Leave blank unless your provider requires one."
-          value={form.getValue(key("region"))}
-          onChange={(v) => form.setValue(key("region"), v)}
-          restartRequired={restartKeys.has(key("region"))}
-        />
-        <SettingField
-          label="Put the bucket name in the URL path"
-          type="toggle"
-          description="Needed by MinIO and some self-hosted storage."
-          value={form.getValue(key("path_style"))}
-          onChange={(v) => form.setValue(key("path_style"), v)}
-          restartRequired={restartKeys.has(key("path_style"))}
-        />
-        <SettingField
-          label="Folder inside the bucket"
-          description="Leave blank to use the bucket root."
-          value={form.getValue(key("key_prefix"))}
-          onChange={(v) => form.setValue(key("key_prefix"), v)}
-          disabled={secrets.disabled || locationFieldsDisabled}
-          restartRequired={restartKeys.has(key("key_prefix"))}
-        />
-        {scope === "public" && (
-          <>
-            <SettingField
-              label="How asset links are authorized"
-              type="select"
-              description="Signed links work with a private bucket and suit most installs."
-              value={urlAuth}
-              onChange={(v) => form.setValue("s3.public_url_auth", v)}
-              options={[
-                { value: "presigned", label: "Signed links (recommended)" },
-                { value: "public", label: "Anyone with the link" },
-                { value: "cloudflare_token", label: "Cloudflare signed token" },
-              ]}
-              restartRequired={restartKeys.has("s3.public_url_auth")}
-            />
-            {urlAuth !== "presigned" && (
+      {scope === "public" && (
+        <>
+          <SettingField
+            label="How asset links are authorized"
+            type="select"
+            description="Signed links work with a private bucket and suit most installs."
+            value={urlAuth}
+            onChange={(v) => form.setValue("s3.public_url_auth", v)}
+            options={[
+              { value: "presigned", label: "Signed links (recommended)" },
+              { value: "public", label: "Anyone with the link" },
+              { value: "cloudflare_token", label: "Cloudflare signed token" },
+            ]}
+            restartRequired={restartKeys.has("s3.public_url_auth")}
+          />
+          {advancedCount > 0 && (
+            <AdvancedSection
+              id="storage.s3.public"
+              count={advancedCount}
+              forceOpen={advancedChanged > 0}
+            >
               <SettingField
                 label="Address clients download from"
                 hint="https://cdn.example.com"
@@ -583,336 +415,51 @@ function S3Group({
                 onChange={(v) => form.setValue("s3.public_read_endpoint", v)}
                 restartRequired={restartKeys.has("s3.public_read_endpoint")}
               />
-            )}
-            {urlAuth === "cloudflare_token" && (
-              <>
-                {/*
-                  Cloudflare token auth requires this secret, so a clear only
-                  saves alongside a switch back to another mode — the one order
-                  that works, since the field is hidden in those modes.
-                */}
-                <SecretField
-                  label="Token Secret"
-                  value={form.getValue("s3.public_token_secret")}
-                  configured={form.sensitiveConfigured.includes("s3.public_token_secret")}
-                  onKeep={() => secrets.keepSaved("s3.public_token_secret")}
-                  onClear={() => secrets.clearSaved("s3.public_token_secret")}
-                  cleared={form.isClearStaged("s3.public_token_secret")}
-                  onChange={(v) => secrets.setSecret("s3.public_token_secret", v)}
-                  hint="Signing key configured in Cloudflare"
-                  disabled={secrets.disabled}
-                  restartRequired={restartKeys.has("s3.public_token_secret")}
-                />
-                <SettingField
-                  label="Token query parameter"
-                  description="Usually verify."
-                  value={form.getValue("s3.public_token_param") || "verify"}
-                  onChange={(v) => form.setValue("s3.public_token_param", v)}
-                  restartRequired={restartKeys.has("s3.public_token_param")}
-                />
-                <SettingField
-                  label="Link lifetime"
-                  type="number"
-                  unit="seconds"
-                  value={form.getValue("s3.public_token_ttl") || "10800"}
-                  onChange={(v) => form.setValue("s3.public_token_ttl", v)}
-                  restartRequired={restartKeys.has("s3.public_token_ttl")}
-                />
-              </>
-            )}
-          </>
-        )}
-      </AdvancedSection>
-    </FieldGroup>
-  );
-}
-
-function DatabaseGroup({
-  form,
-  restartKeys,
-}: {
-  form: SettingsForm;
-  restartKeys: RestartKeyMatcher;
-}) {
-  const userDBBackend = form.getValue("userdb.backend");
-  const sqlite = userDBBackend === "sqlite";
-  const changed = countDirty(form, DATABASE_KEYS);
-
-  return (
-    <FieldGroup label="Database" restartAll={allRestart(restartKeys, DATABASE_KEYS)}>
-      <AdvancedSection id="infrastructure.database" count={sqlite ? 4 : 2} forceOpen={changed > 0}>
-        <SettingField
-          label="Maximum Postgres connections"
-          type="number"
-          description="Raise only if the logs show connection-pool waits."
-          value={form.getValue("database.max_connections")}
-          onChange={(v) => form.setValue("database.max_connections", v)}
-          restartRequired={restartKeys.has("database.max_connections")}
-        />
-        <SettingField
-          label="Where per-user data is stored"
-          type="select"
-          description="PostgreSQL is the only supported option."
-          options={USER_DATABASE_BACKEND_OPTIONS}
-          value={userDBBackend}
-          onChange={(v) => form.setValue("userdb.backend", v)}
-          restartRequired={restartKeys.has("userdb.backend")}
-        />
-        {sqlite && (
-          <>
-            <SettingField
-              label="Open files per user"
-              type="number"
-              description="SQLite connections one user database may hold open."
-              value={form.getValue("userdb.pool_max_open")}
-              onChange={(v) => form.setValue("userdb.pool_max_open", v)}
-              restartRequired={restartKeys.has("userdb.pool_max_open")}
-            />
-            <SettingField
-              label="Close idle user databases after"
-              type="duration"
-              description="For example 12h."
-              value={form.getValue("userdb.idle_timeout")}
-              onChange={(v) => form.setValue("userdb.idle_timeout", v)}
-              restartRequired={restartKeys.has("userdb.idle_timeout")}
-            />
-          </>
-        )}
-      </AdvancedSection>
-    </FieldGroup>
-  );
-}
-
-function BucketOverridesEditor({
-  rows,
-  parseError,
-  onChange,
-  onRestore,
-}: {
-  rows: LogRetentionBucketRow[];
-  parseError: string;
-  onChange: (rows: LogRetentionBucketRow[]) => void;
-  onRestore: () => void;
-}) {
-  function edit(id: string, field: keyof LogRetentionBucketPolicy, value: string) {
-    onChange(updateBucketRow(rows, id, field, value));
-  }
-
-  return (
-    <div className="space-y-4 py-3.5">
-      <div className="flex flex-col justify-between gap-3 sm:flex-row sm:items-start">
-        <div className="min-w-0">
-          <h4 className="text-sm font-medium">Per-area limits</h4>
-          <p className="text-muted-foreground mt-1 text-xs">A limit of 0 turns that rule off.</p>
-        </div>
-        <div className="flex shrink-0 flex-col gap-2 sm:flex-row sm:items-center">
-          <Button type="button" size="sm" variant="outline" onClick={onRestore}>
-            <RotateCcw className="size-4" />
-            Restore Recommended Rules
-          </Button>
-          <Button type="button" size="sm" onClick={() => onChange(appendBucketRow(rows))}>
-            <Plus className="size-4" />
-            Add Rule
-          </Button>
-        </div>
-      </div>
-
-      {parseError ? (
-        <div className="border-warning/30 bg-warning/10 text-warning rounded-[1rem] border px-3 py-2 text-sm">
-          The saved rules could not be read. The editor loaded the recommended rules so you can
-          recover cleanly. Details: {parseError}
-        </div>
-      ) : null}
-
-      <div className="border-border/70 overflow-x-auto rounded-[1rem] border">
-        <table className="w-full border-collapse text-sm">
-          <thead className="bg-muted/40 text-left">
-            <tr>
-              <th className="px-3 py-2 font-medium">Component</th>
-              <th className="px-3 py-2 font-medium">Level</th>
-              <th className="px-3 py-2 font-medium">Days</th>
-              <th className="px-3 py-2 font-medium">Max rows</th>
-              <th className="px-3 py-2 font-medium">Max size (MB)</th>
-              <th className="w-[60px] px-3 py-2 font-medium"> </th>
-            </tr>
-          </thead>
-          <tbody>
-            {rows.length === 0 ? (
-              <tr>
-                <td colSpan={6} className="text-muted-foreground px-3 py-6 text-center">
-                  No per-area rules configured.
-                </td>
-              </tr>
-            ) : (
-              rows.map((row) => (
-                <tr key={row.id} className="border-t">
-                  <td className="px-3 py-2">
-                    <Input
-                      value={row.component}
-                      onChange={(event) => edit(row.id, "component", event.target.value)}
-                      placeholder="metadata"
-                      aria-label={`Component for rule ${row.id}`}
-                    />
-                  </td>
-                  <td className="px-3 py-2">
-                    <Select
-                      value={row.level}
-                      onValueChange={(value) => edit(row.id, "level", value)}
-                    >
-                      <SelectTrigger className="w-[120px]">
-                        <SelectValue />
-                      </SelectTrigger>
-                      <SelectContent>
-                        {LOG_LEVEL_OPTIONS.map((level) => (
-                          <SelectItem key={level} value={level}>
-                            {level}
-                          </SelectItem>
-                        ))}
-                      </SelectContent>
-                    </Select>
-                  </td>
-                  <td className="px-3 py-2">
-                    <Input
-                      type="number"
-                      min="0"
-                      value={String(row.retention_days)}
-                      onChange={(event) => edit(row.id, "retention_days", event.target.value)}
-                      className="w-[110px]"
-                      aria-label={`Days for rule ${row.id}`}
-                    />
-                  </td>
-                  <td className="px-3 py-2">
-                    <Input
-                      type="number"
-                      min="0"
-                      value={String(row.max_rows)}
-                      onChange={(event) => edit(row.id, "max_rows", event.target.value)}
-                      className="w-[140px]"
-                      aria-label={`Max rows for rule ${row.id}`}
-                    />
-                  </td>
-                  <td className="px-3 py-2">
-                    <Input
-                      type="number"
-                      min="0"
-                      value={String(row.max_size_mb)}
-                      onChange={(event) => edit(row.id, "max_size_mb", event.target.value)}
-                      className="w-[140px]"
-                      aria-label={`Max size for rule ${row.id}`}
-                    />
-                  </td>
-                  <td className="px-3 py-2 text-right">
-                    <Button
-                      type="button"
-                      size="icon-sm"
-                      variant="outline"
-                      onClick={() => onChange(removeBucketRow(rows, row.id))}
-                      aria-label={`Remove ${row.component || "bucket"} rule`}
-                    >
-                      <Trash2 className="size-4" />
-                    </Button>
-                  </td>
-                </tr>
-              ))
-            )}
-          </tbody>
-        </table>
-      </div>
-    </div>
-  );
-}
-
-function LogsGroup({ form, restartKeys }: { form: SettingsForm; restartKeys: RestartKeyMatcher }) {
-  // The bucket rules are one JSON setting edited as a table, so the rows live
-  // here while they are dirty and re-hydrate from the saved value otherwise.
-  const [draftRows, setDraftRows] = useState<LogRetentionBucketRow[] | null>(null);
-  const raw = form.getValue(OPSLOG_BUCKET_POLICIES_KEY);
-  const bucketDirty = form.isDirty(OPSLOG_BUCKET_POLICIES_KEY);
-  const hydrated = useMemo(() => bucketRowsFromRaw(raw), [raw]);
-  // A stale draft can never be shown: it is only reachable while the key is
-  // dirty, and the only thing that marks it dirty also sets the draft.
-  const rows = bucketDirty && draftRows ? draftRows : hydrated.rows;
-  const parseError = bucketDirty ? "" : hydrated.error;
-  const advancedChanged = countDirty(form, LOG_ADVANCED_KEYS);
-
-  function commitRows(next: LogRetentionBucketRow[]) {
-    setDraftRows(next);
-    form.setValue(OPSLOG_BUCKET_POLICIES_KEY, serializeBucketRows(next));
-  }
-
-  return (
-    <FieldGroup label="Logs">
-      <SettingField
-        label="Delete log entries older than"
-        type="number"
-        unit="days"
-        value={form.getValue(OPSLOG_RETENTION_DAYS_KEY)}
-        onChange={(v) => form.setValue(OPSLOG_RETENTION_DAYS_KEY, v)}
-        restartRequired={restartKeys.has(OPSLOG_RETENTION_DAYS_KEY)}
-      />
-      <SettingField
-        label="Maximum log entries"
-        type="number"
-        value={form.getValue(OPSLOG_MAX_ROWS_KEY)}
-        onChange={(v) => form.setValue(OPSLOG_MAX_ROWS_KEY, v)}
-        restartRequired={restartKeys.has(OPSLOG_MAX_ROWS_KEY)}
-      />
-      <SettingField
-        label="Maximum log size"
-        type="number"
-        unit="MB"
-        value={form.getValue(OPSLOG_MAX_SIZE_MB_KEY)}
-        onChange={(v) => form.setValue(OPSLOG_MAX_SIZE_MB_KEY, v)}
-        restartRequired={restartKeys.has(OPSLOG_MAX_SIZE_MB_KEY)}
-      />
-
-      <AdvancedSection
-        id="infrastructure.logs"
-        count={LOG_ADVANCED_KEYS.length}
-        forceOpen={advancedChanged > 0}
-      >
-        <SettingsSubheading>Permission checks</SettingsSubheading>
-        <SettingField
-          label="Delete permission records older than"
-          type="number"
-          unit="days"
-          value={form.getValue("policy.decision_log_retention_days")}
-          onChange={(v) => form.setValue("policy.decision_log_retention_days", v)}
-          restartRequired={restartKeys.has("policy.decision_log_retention_days")}
-        />
-        <SettingField
-          label="How much to record"
-          type="select"
-          description="Full also stores a sample of each request."
-          value={form.getValue("policy.decision_log_verbosity") || "digest"}
-          onChange={(v) => form.setValue("policy.decision_log_verbosity", v)}
-          options={[
-            { value: "digest", label: "Summary" },
-            { value: "verbose", label: "Full" },
-          ]}
-          restartRequired={restartKeys.has("policy.decision_log_verbosity")}
-        />
-        <SettingField
-          label="Record one allowed check in every"
-          type="number"
-          description="Denials and errors are always recorded."
-          value={form.getValue("policy.decision_log_scope_sample_rate")}
-          onChange={(v) => form.setValue("policy.decision_log_scope_sample_rate", v)}
-          restartRequired={restartKeys.has("policy.decision_log_scope_sample_rate")}
-        />
-
-        <BucketOverridesEditor
-          rows={rows}
-          parseError={parseError}
-          onChange={commitRows}
-          onRestore={() => commitRows(recommendedBucketRows())}
-        />
-      </AdvancedSection>
+              {urlAuth === "cloudflare_token" && (
+                <>
+                  {/*
+                    Cloudflare token auth requires this secret, so a clear only
+                    saves alongside a switch back to another mode — the one
+                    order that works, since the field is hidden in those modes.
+                  */}
+                  <SecretField
+                    label="Token Secret"
+                    value={form.getValue("s3.public_token_secret")}
+                    configured={form.sensitiveConfigured.includes("s3.public_token_secret")}
+                    onKeep={() => secrets.keepSaved("s3.public_token_secret")}
+                    onClear={() => secrets.clearSaved("s3.public_token_secret")}
+                    cleared={form.isClearStaged("s3.public_token_secret")}
+                    onChange={(v) => secrets.setSecret("s3.public_token_secret", v)}
+                    hint="Signing key configured in Cloudflare"
+                    disabled={secrets.disabled}
+                    restartRequired={restartKeys.has("s3.public_token_secret")}
+                  />
+                  <SettingField
+                    label="Token query parameter"
+                    description="Usually verify."
+                    value={form.getValue("s3.public_token_param") || "verify"}
+                    onChange={(v) => form.setValue("s3.public_token_param", v)}
+                    restartRequired={restartKeys.has("s3.public_token_param")}
+                  />
+                  <SettingField
+                    label="Link lifetime"
+                    type="number"
+                    unit="seconds"
+                    value={form.getValue("s3.public_token_ttl") || "10800"}
+                    onChange={(v) => form.setValue("s3.public_token_ttl", v)}
+                    restartRequired={restartKeys.has("s3.public_token_ttl")}
+                  />
+                </>
+              )}
+            </AdvancedSection>
+          )}
+        </>
+      )}
     </FieldGroup>
   );
 }
 
-export default function InfrastructureSettings() {
+export default function StorageSettings() {
   const form = useSettingsForm({ keys: useMemo(() => KEYS, []) });
   const restartKeys = useRestartKeys();
   const serverStatus = useAdminServerStatus();
@@ -948,6 +495,13 @@ export default function InfrastructureSettings() {
   const latestTransitionResult = latestTransition?.result_payload as
     | StorageTransitionJobResult
     | undefined;
+  // What Backend shows: the running backend once storage is locked, unless a
+  // different choice is staged.
+  const selectedBackend =
+    artworkLocked && artworkStorage?.backend && !form.isDirty("artwork.storage_backend")
+      ? artworkStorage.backend
+      : form.getValue("artwork.storage_backend") || "auto";
+  const localDiskSelected = selectedBackend === "local";
   const draftEffectiveBackend = effectiveArtworkBackend(
     form.getValue("artwork.storage_backend"),
     form.getValue("s3.public_bucket"),
@@ -970,6 +524,14 @@ export default function InfrastructureSettings() {
   // A local install can keep its operational data in a private bucket, which a
   // copy policy has to read just like an S3 source.
   const persistedPrivateBucket = form.getPersistedValue("s3.private_bucket").trim();
+  // Public storage only serves S3 and Automatic, so Local disk hides it unless
+  // one of its fields holds an unsaved edit; choosing S3 stages the backend,
+  // which brings it back before any transition review. Local disk keeps
+  // avatars, diagnostics, and catalog artifacts in the local path too, so
+  // private storage shows there only while a saved or staged bucket holds them.
+  const showPublicStorage = !localDiskSelected || countDirty(form, PUBLIC_S3_KEYS) > 0;
+  const showPrivateStorage =
+    !localDiskSelected || Boolean(persistedPrivateBucket) || countDirty(form, PRIVATE_S3_KEYS) > 0;
   const currentSourceUsesS3 = currentSourceIsS3 || Boolean(persistedPrivateBucket);
   const recoveryHealth = useStorageTransitionSourceHealth(false, managedTransitionsAvailable);
   const sourceHealth = useStorageTransitionSourceHealth(
@@ -1187,6 +749,13 @@ export default function InfrastructureSettings() {
         toast.error("Managed storage transitions are not available on this server.");
         return;
       }
+      // A move to S3 is staged, which shows Public storage so the bucket can
+      // be filled in; Save then reads Review transition. A move back to local
+      // disk needs nothing more, so its review opens now.
+      if (requestedBackend === "s3") {
+        form.setValue("artwork.storage_backend", value);
+        return;
+      }
       setTransitionBackend(requestedBackend);
       setTransitionLocalPath(form.getValue("artwork.local_path"));
       setTransitionOpen(true);
@@ -1205,7 +774,7 @@ export default function InfrastructureSettings() {
         <div>
           <p className="text-sm font-medium">Protected credential status is unavailable</p>
           <p className="text-muted-foreground mt-1 text-xs">
-            Reload this page before editing infrastructure settings.
+            Reload this page before editing storage settings.
           </p>
         </div>
       </div>
@@ -1222,7 +791,7 @@ export default function InfrastructureSettings() {
         <div>
           <p className="text-sm font-medium">Storage lock status is unavailable</p>
           <p className="text-muted-foreground mt-1 text-xs">
-            Reload this page before editing infrastructure settings.
+            Reload this page before editing storage settings.
           </p>
         </div>
       </div>
@@ -1247,7 +816,7 @@ export default function InfrastructureSettings() {
 
   return (
     <div className="flex h-full flex-col">
-      <SettingsPageHeader title="Storage & Database" className="mb-8" />
+      <SettingsPageHeader title="Storage" />
 
       <div className="flex-1 space-y-5">
         {!storageStatusKnown ? (
@@ -1272,15 +841,11 @@ export default function InfrastructureSettings() {
             </Button>
           </div>
         ) : null}
-        <FieldGroup label="Storage" restartAll={restartKeys.has("artwork.storage_backend")}>
+        <FieldGroup label="Storage" restartAll={allRestart(restartKeys, STORAGE_GROUP_KEYS)}>
           <SettingField
             label="Backend"
             type="select"
-            value={
-              artworkLocked && artworkStorage?.backend
-                ? artworkStorage.backend
-                : form.getValue("artwork.storage_backend") || "auto"
-            }
+            value={selectedBackend}
             onChange={handleArtworkBackendChange}
             disabled={!storageStatusKnown}
             options={[
@@ -1292,7 +857,7 @@ export default function InfrastructureSettings() {
               artworkLocked
                 ? artworkStorage?.backend === "s3"
                   ? "Choose Automatic or Local disk to review a managed transition from S3."
-                  : "Edit the local path or choose S3 to review a managed transition."
+                  : "Edit the local path, or choose S3 and fill in Public storage. Saving opens a managed transition review."
                 : "Where Prairie keeps artwork, subtitles, and other library assets."
             }
             restartRequired={restartKeys.has("artwork.storage_backend")}
@@ -1317,6 +882,14 @@ export default function InfrastructureSettings() {
             }
             restartRequired={restartKeys.has("artwork.local_path")}
           />
+          <SettingField
+            label="Save provider artwork to storage"
+            type="toggle"
+            description="When off, clients load artwork straight from the providers, and artwork stored next to your media is not used. Artwork saved earlier switches back to provider images, except on titles whose artwork you chose in Edit Metadata."
+            value={form.getValue(CACHE_IMAGES_KEY)}
+            onChange={(value) => form.setValue(CACHE_IMAGES_KEY, value)}
+            restartRequired={restartKeys.has(CACHE_IMAGES_KEY)}
+          />
         </FieldGroup>
         {activeTransition ? (
           <div className="border-border/60 bg-card/40 rounded-xl border p-4">
@@ -1705,32 +1278,33 @@ export default function InfrastructureSettings() {
             </DialogFooter>
           </DialogContent>
         </Dialog>
-        <RedisGroup form={form} restartKeys={restartKeys} secrets={secrets} />
-        <S3Group
-          form={form}
-          restartKeys={restartKeys}
-          secrets={secrets}
-          scope="public"
-          label="Public storage"
-          description="Files clients download directly: cached artwork, uploaded posters, and branding images."
-          checkKind="s3_public"
-          artworkLockedBackend={artworkLocked ? artworkStorage?.backend : undefined}
-          publicBackendChangePending={publicBackendChangePending}
-          locationFieldsDisabled={!storageStatusKnown}
-        />
-        <S3Group
-          form={form}
-          restartKeys={restartKeys}
-          secrets={secrets}
-          scope="private"
-          label="Private storage"
-          description="Files only the server reads: profile avatars, diagnostics bundles, and catalog seed artifacts."
-          checkKind="s3_private"
-          artworkLockedBackend={privateLocked ? artworkStorage?.backend : undefined}
-          locationFieldsDisabled={!storageStatusKnown}
-        />
-        <DatabaseGroup form={form} restartKeys={restartKeys} />
-        <LogsGroup form={form} restartKeys={restartKeys} />
+        {showPublicStorage && (
+          <S3Group
+            form={form}
+            restartKeys={restartKeys}
+            secrets={secrets}
+            scope="public"
+            label="Public storage"
+            description="Files clients download directly: cached artwork, uploaded posters, and branding images. Used once Backend is S3, or Automatic with a bucket set here."
+            checkKind="s3_public"
+            artworkLockedBackend={artworkLocked ? artworkStorage?.backend : undefined}
+            publicBackendChangePending={publicBackendChangePending}
+            locationFieldsDisabled={!storageStatusKnown}
+          />
+        )}
+        {showPrivateStorage && (
+          <S3Group
+            form={form}
+            restartKeys={restartKeys}
+            secrets={secrets}
+            scope="private"
+            label="Private storage"
+            description="Files only the server reads: profile avatars, diagnostics bundles, and catalog seed artifacts. S3 storage needs a bucket here for them; on local disk they stay in the local storage path unless a bucket is set."
+            checkKind="s3_private"
+            artworkLockedBackend={privateLocked ? artworkStorage?.backend : undefined}
+            locationFieldsDisabled={!storageStatusKnown}
+          />
+        )}
       </div>
 
       <SaveBar
diff --git a/web/src/pages/admin-settings/WatchSyncSettings.tsx b/web/src/pages/admin-settings/WatchProviderTiles.tsx
similarity index 50%
rename from web/src/pages/admin-settings/WatchSyncSettings.tsx
rename to web/src/pages/admin-settings/WatchProviderTiles.tsx
index ffea4356c2..0408283bd8 100644
--- a/web/src/pages/admin-settings/WatchSyncSettings.tsx
+++ b/web/src/pages/admin-settings/WatchProviderTiles.tsx
@@ -2,13 +2,10 @@ import { Link, useNavigate } from "react-router";
 
 import type { PluginInstallation } from "@/api/types";
 import { ProviderTile, ProviderTileGrid } from "@/components/settings/ProviderTile";
-import { SettingsPageHeader } from "@/components/settings/SettingsPageHeader";
 import { installationConfigReady } from "@/lib/pluginConfigReady";
 import { Button } from "@/components/ui/button";
 import { Skeleton } from "@/components/ui/skeleton";
 import { useAdminPluginInstallations } from "@/hooks/queries/admin/plugins";
-
-import { FieldGroup } from "./FieldGroup";
 import { providerMonogram } from "@/lib/monogram";
 import { pluginPagePath } from "@/lib/pluginPresentation";
 
@@ -31,7 +28,7 @@ interface PluginWatchProvider {
 
 /**
  * One entry per watch-sync capability across the installed plugins. Every
- * watch provider, Trakt, Simkl, and MDBList included, is a plugin, so this is
+ * watch provider, Simkl and MDBList included, is a plugin, so this is
  * what the server can actually sync with.
  */
 function pluginWatchProviders(installations: PluginInstallation[]): PluginWatchProvider[] {
@@ -57,18 +54,20 @@ function pluginWatchProviders(installations: PluginInstallation[]): PluginWatchP
   return providers.sort((a, b) => a.name.localeCompare(b.name));
 }
 
-export default function WatchSyncSettings() {
+/**
+ * Watch providers are plugins with their own config pages, so these tiles
+ * only report status and link out; nothing here is staged or saved.
+ */
+export function WatchProviderTiles() {
   const navigate = useNavigate();
   const { data: installations, isLoading, isError, refetch } = useAdminPluginInstallations();
   const providers = pluginWatchProviders(installations ?? []);
 
   if (isLoading) {
     return (
-      <div className="max-w-5xl space-y-6" role="status" aria-label="Loading watch sync">
-        <Skeleton className="h-9 w-64" />
-        <Skeleton className="h-12 w-full" />
-        <Skeleton className="h-40 w-full" />
-        <span className="sr-only">Loading watch sync</span>
+      <div role="status" aria-label="Loading watch providers">
+        <Skeleton className="h-24 w-full" />
+        <span className="sr-only">Loading watch providers</span>
       </div>
     );
   }
@@ -83,52 +82,42 @@ export default function WatchSyncSettings() {
   );
 
   return (
-    <div className="flex h-full max-w-5xl flex-col gap-7">
-      <SettingsPageHeader title="Watch Providers" />
-
-      <FieldGroup label="Watch providers">
-        <div className="py-3.5">
-          {isError ? (
-            <div role="alert" className="flex flex-wrap items-center gap-3 text-sm">
-              <span>Couldn&apos;t load the installed watch provider plugins.</span>
-              <Button type="button" size="sm" variant="outline" onClick={() => void refetch()}>
-                Retry
-              </Button>
-            </div>
-          ) : providers.length > 0 ? (
-            <ProviderTileGrid>
-              {providers.map((provider) => (
-                <ProviderTile
-                  key={`plugin-${provider.installationId}-${provider.capabilityId}`}
-                  name={provider.name}
-                  tagline="Watch provider plugin"
-                  monogram={providerMonogram(provider.name)}
-                  monogramClass="bg-violet-500/20 text-violet-700 dark:text-violet-300"
-                  state={provider.enabled && provider.configReady ? "connected" : "not_connected"}
-                  statePill={
-                    !provider.enabled
-                      ? "Disabled"
-                      : provider.configReady
-                        ? "Enabled"
-                        : "Needs setup"
-                  }
-                  primaryAction={{
-                    label: "Configure",
-                    onClick: () => navigate(pluginPagePath(provider.pluginId)),
-                  }}
-                />
-              ))}
-            </ProviderTileGrid>
-          ) : (
-            <p className="text-sm">No watch provider plugins are installed.</p>
-          )}
-          <p className="text-muted-foreground mt-3 text-xs">
-            Trakt, Simkl, MDBList, and other watch providers install from the {catalogLink}. A
-            provider&apos;s app credentials live on its plugin page, and viewers link their own
-            accounts from profile settings.
-          </p>
+    <>
+      {isError ? (
+        <div role="alert" className="flex flex-wrap items-center gap-3 text-sm">
+          <span>Couldn&apos;t load the installed watch provider plugins.</span>
+          <Button type="button" size="sm" variant="outline" onClick={() => void refetch()}>
+            Retry
+          </Button>
         </div>
-      </FieldGroup>
-    </div>
+      ) : providers.length > 0 ? (
+        <ProviderTileGrid>
+          {providers.map((provider) => (
+            <ProviderTile
+              key={`plugin-${provider.installationId}-${provider.capabilityId}`}
+              name={provider.name}
+              tagline="Watch provider plugin"
+              monogram={providerMonogram(provider.name)}
+              monogramClass="bg-violet-500/20 text-violet-700 dark:text-violet-300"
+              state={provider.enabled && provider.configReady ? "connected" : "not_connected"}
+              statePill={
+                !provider.enabled ? "Disabled" : provider.configReady ? "Enabled" : "Needs setup"
+              }
+              primaryAction={{
+                label: "Configure",
+                onClick: () => navigate(pluginPagePath(provider.pluginId)),
+              }}
+            />
+          ))}
+        </ProviderTileGrid>
+      ) : (
+        <p className="text-sm">No watch provider plugins are installed.</p>
+      )}
+      <p className="text-muted-foreground mt-3 text-xs">
+        Simkl, MDBList, and other watch providers install from the {catalogLink}. A provider&apos;s
+        app credentials live on its plugin page, and viewers link their own accounts from profile
+        settings.
+      </p>
+    </>
   );
 }
diff --git a/web/src/pages/admin-settings/WatchSyncSettings.test.tsx b/web/src/pages/admin-settings/WatchSyncSettings.test.tsx
deleted file mode 100644
index a7208a232d..0000000000
--- a/web/src/pages/admin-settings/WatchSyncSettings.test.tsx
+++ /dev/null
@@ -1,93 +0,0 @@
-import { render as renderDOM, screen, within } from "@testing-library/react";
-import userEvent from "@testing-library/user-event";
-import { MemoryRouter } from "react-router";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-import type { PluginInstallation } from "@/api/types";
-
-import WatchSyncSettings from "./WatchSyncSettings";
-
-let pluginInstallations: Partial<PluginInstallation>[] | undefined = [];
-let installationsLoading = false;
-let installationsError = false;
-const refetchInstallations = vi.fn();
-
-vi.mock("@/hooks/queries/admin/plugins", () => ({
-  useAdminPluginInstallations: () => ({
-    data: pluginInstallations,
-    isLoading: installationsLoading,
-    isError: installationsError,
-    refetch: refetchInstallations,
-  }),
-}));
-
-function render(ui: React.ReactElement) {
-  return renderDOM(<MemoryRouter>{ui}</MemoryRouter>);
-}
-
-describe("WatchSyncSettings", () => {
-  beforeEach(() => {
-    pluginInstallations = [];
-    installationsLoading = false;
-    installationsError = false;
-    refetchInstallations.mockReset();
-  });
-
-  it("reports a failed load instead of claiming nothing is installed", async () => {
-    pluginInstallations = undefined;
-    installationsError = true;
-    render(<WatchSyncSettings />);
-
-    expect(screen.getByRole("alert")).toHaveTextContent(
-      "Couldn't load the installed watch provider plugins.",
-    );
-    expect(screen.queryByText("No watch provider plugins are installed.")).not.toBeInTheDocument();
-    await userEvent.setup().click(screen.getByRole("button", { name: "Retry" }));
-    expect(refetchInstallations).toHaveBeenCalled();
-  });
-
-  it("does not label an enabled plugin as connected until its required config is set", () => {
-    const capability = {
-      type: "watch_sync_provider.v1",
-      id: "anilist",
-      display_name: "AniList",
-    };
-    const schema = [{ key: "account", title: "Account", json_schema: "{}", required: true }];
-    pluginInstallations = [
-      {
-        id: 7,
-        plugin_id: "silo-plugin-watchsync-anilist",
-        enabled: true,
-        capabilities: [capability],
-        global_config_schema: schema,
-        global_configs: [],
-      },
-      {
-        id: 9,
-        plugin_id: "silo-plugin-watchsync-serializd",
-        enabled: true,
-        capabilities: [
-          {
-            type: "watch_sync_provider.v1",
-            id: "serializd",
-            display_name: "Serializd",
-          },
-        ],
-        global_config_schema: schema,
-        global_configs: [{ key: "account", value: {}, configured_secrets: ["api_key"] }],
-      },
-    ];
-
-    render(<WatchSyncSettings />);
-
-    // Enabled but keyless: the plugin cannot serve a request, so the tile must
-    // not read as set up.
-    const anilist = screen.getByRole("group", { name: "AniList" });
-    expect(anilist).toHaveAttribute("data-state", "not_connected");
-    expect(within(anilist).getByText("Needs setup")).toBeInTheDocument();
-
-    const serializd = screen.getByRole("group", { name: "Serializd" });
-    expect(serializd).toHaveAttribute("data-state", "connected");
-    expect(within(serializd).getByText("Enabled")).toBeInTheDocument();
-  });
-});
diff --git a/web/src/pages/admin-settings/databaseSettingOptions.ts b/web/src/pages/admin-settings/databaseSettingOptions.ts
deleted file mode 100644
index a65d29161b..0000000000
--- a/web/src/pages/admin-settings/databaseSettingOptions.ts
+++ /dev/null
@@ -1,4 +0,0 @@
-export const USER_DATABASE_BACKEND_OPTIONS = [
-  { value: "postgres", label: "PostgreSQL" },
-  { value: "sqlite", label: "SQLite (TBD)", disabled: true },
-];
diff --git a/web/src/pages/admin-settings/logRetentionPolicy.test.ts b/web/src/pages/admin-settings/logRetentionPolicy.test.ts
deleted file mode 100644
index 1ebdd8a90c..0000000000
--- a/web/src/pages/admin-settings/logRetentionPolicy.test.ts
+++ /dev/null
@@ -1,208 +0,0 @@
-// @vitest-environment node
-
-import { describe, expect, it } from "vitest";
-
-import {
-  appendBucketRow,
-  bucketRowsFromRaw,
-  parseBucketPolicies,
-  recommendedBucketRows,
-  removeBucketRow,
-  serializeBucketPolicies,
-  serializeBucketRows,
-  updateBucketRow,
-  type LogRetentionBucketPolicy,
-} from "./logRetentionPolicy";
-
-describe("logRetentionPolicy", () => {
-  it("parses valid bucket policies and normalizes levels", () => {
-    const policies = parseBucketPolicies(
-      JSON.stringify([
-        {
-          component: "metadata",
-          level: "INFO",
-          retention_days: "1",
-          max_rows: "100000",
-          max_size_mb: "128",
-        },
-      ]),
-    );
-
-    expect(policies).toEqual<LogRetentionBucketPolicy[]>([
-      {
-        component: "metadata",
-        level: "info",
-        retention_days: 1,
-        max_rows: 100000,
-        max_size_mb: 128,
-      },
-    ]);
-  });
-
-  it("drops invalid policies when parsing", () => {
-    const policies = parseBucketPolicies(
-      JSON.stringify([
-        {
-          component: "",
-          level: "info",
-          retention_days: 1,
-          max_rows: 10,
-          max_size_mb: 10,
-        },
-        {
-          component: "scanner",
-          level: "verbose",
-          retention_days: 1,
-          max_rows: 10,
-          max_size_mb: 10,
-        },
-      ]),
-    );
-
-    expect(policies).toEqual([]);
-  });
-
-  it("preserves zero for disabled limits and normalizes invalid numeric fields to 0", () => {
-    const policies = parseBucketPolicies(
-      JSON.stringify([
-        {
-          component: "metadata",
-          level: "info",
-          retention_days: 0,
-          max_rows: -5,
-          max_size_mb: "",
-        },
-      ]),
-    );
-
-    expect(policies).toEqual<LogRetentionBucketPolicy[]>([
-      {
-        component: "metadata",
-        level: "info",
-        retention_days: 0,
-        max_rows: 0,
-        max_size_mb: 0,
-      },
-    ]);
-  });
-
-  it("serializes disabled limits as 0", () => {
-    const raw = serializeBucketPolicies([
-      {
-        component: "metadata",
-        level: "info",
-        retention_days: 0,
-        max_rows: 0,
-        max_size_mb: 0,
-      },
-    ]);
-
-    expect(JSON.parse(raw)).toEqual([
-      {
-        component: "metadata",
-        level: "info",
-        retention_days: 0,
-        max_rows: 0,
-        max_size_mb: 0,
-      },
-    ]);
-  });
-
-  it("serializes only valid policies", () => {
-    const raw = serializeBucketPolicies([
-      {
-        component: " metadata ",
-        level: "INFO",
-        retention_days: 1,
-        max_rows: 100000,
-        max_size_mb: 128,
-      },
-      {
-        component: "",
-        level: "warn",
-        retention_days: 7,
-        max_rows: 250000,
-        max_size_mb: 256,
-      },
-    ]);
-
-    expect(JSON.parse(raw)).toEqual([
-      {
-        component: "metadata",
-        level: "info",
-        retention_days: 1,
-        max_rows: 100000,
-        max_size_mb: 128,
-      },
-    ]);
-  });
-});
-
-describe("logRetentionPolicy bucket rows", () => {
-  it("gives every parsed row a stable id", () => {
-    const { rows, error } = bucketRowsFromRaw(
-      JSON.stringify([
-        {
-          component: "metadata",
-          level: "info",
-          retention_days: 1,
-          max_rows: 10,
-          max_size_mb: 8,
-        },
-        {
-          component: "scanner",
-          level: "warn",
-          retention_days: 7,
-          max_rows: 20,
-          max_size_mb: 16,
-        },
-      ]),
-    );
-
-    expect(error).toBe("");
-    expect(rows.map((row) => row.id)).toEqual(["1", "2"]);
-    expect(rows[1]?.component).toBe("scanner");
-  });
-
-  it("falls back to the recommended rows when the stored JSON is unreadable", () => {
-    const { rows, error } = bucketRowsFromRaw("{not json");
-
-    expect(error).not.toBe("");
-    expect(rows).toEqual(recommendedBucketRows());
-  });
-
-  it("numbers a new row after the highest id still present", () => {
-    let rows = bucketRowsFromRaw("").rows;
-    rows = appendBucketRow(rows);
-    rows = appendBucketRow(rows);
-    expect(rows.map((row) => row.id)).toEqual(["1", "2"]);
-
-    rows = updateBucketRow(rows, "1", "component", "scanner");
-    rows = updateBucketRow(rows, "1", "max_rows", "-4");
-    expect(rows[0]?.component).toBe("scanner");
-    expect(rows[0]?.max_rows).toBe(0);
-
-    // Ids are max-of-remaining + 1, not a monotonic counter: removing the last
-    // row frees its id for the next one. That is safe because an id only has to
-    // be unique among the rows currently on screen — it is a React key and the
-    // handle the editor's own update/remove calls use, and it is stripped before
-    // the rows are serialized.
-    rows = removeBucketRow(rows, "2");
-    rows = appendBucketRow(rows);
-    expect(rows.map((row) => row.id)).toEqual(["1", "2"]);
-  });
-
-  it("serializes rows without their editor ids", () => {
-    const rows = updateBucketRow(appendBucketRow([]), "1", "component", "metadata");
-
-    expect(JSON.parse(serializeBucketRows(rows))).toEqual([
-      {
-        component: "metadata",
-        level: "info",
-        retention_days: 1,
-        max_rows: 100000,
-        max_size_mb: 128,
-      },
-    ]);
-  });
-});
diff --git a/web/src/pages/admin-settings/logRetentionPolicy.ts b/web/src/pages/admin-settings/logRetentionPolicy.ts
deleted file mode 100644
index aff8ddb00b..0000000000
--- a/web/src/pages/admin-settings/logRetentionPolicy.ts
+++ /dev/null
@@ -1,196 +0,0 @@
-import { stringifyUnknown } from "@/lib/stringifyUnknown";
-export const OPSLOG_RETENTION_DAYS_KEY = "opslog.retention_days";
-export const OPSLOG_CLEANUP_INTERVAL_KEY = "opslog.cleanup_interval_minutes";
-export const OPSLOG_MAX_ROWS_KEY = "opslog.max_rows";
-export const OPSLOG_MAX_SIZE_MB_KEY = "opslog.max_size_mb";
-export const OPSLOG_BUCKET_POLICIES_KEY = "opslog.bucket_policies";
-
-export const LOG_LEVEL_OPTIONS = ["info", "warn", "error"] as const;
-
-export interface LogRetentionBucketPolicy {
-  component: string;
-  level: string;
-  retention_days: number;
-  max_rows: number;
-  max_size_mb: number;
-}
-
-export const DEFAULT_BUCKET_POLICIES: LogRetentionBucketPolicy[] = [
-  {
-    component: "metadata",
-    level: "info",
-    retention_days: 1,
-    max_rows: 100000,
-    max_size_mb: 128,
-  },
-  {
-    component: "scanner",
-    level: "info",
-    retention_days: 2,
-    max_rows: 150000,
-    max_size_mb: 192,
-  },
-  {
-    component: "metadata",
-    level: "warn",
-    retention_days: 7,
-    max_rows: 250000,
-    max_size_mb: 256,
-  },
-  {
-    component: "scanner",
-    level: "warn",
-    retention_days: 7,
-    max_rows: 250000,
-    max_size_mb: 256,
-  },
-];
-
-function normalizeBucketLimit(value: unknown): number {
-  const parsed =
-    typeof value === "number"
-      ? value
-      : typeof value === "string"
-        ? Number.parseInt(value, 10)
-        : Number.NaN;
-  return Number.isFinite(parsed) && parsed > 0 ? parsed : 0;
-}
-
-export function parseBucketPolicies(raw: string): LogRetentionBucketPolicy[] {
-  if (!raw.trim()) {
-    return [];
-  }
-
-  const parsed = JSON.parse(raw);
-  if (!Array.isArray(parsed)) {
-    return [];
-  }
-
-  return parsed
-    .map((entry) => {
-      if (!entry || typeof entry !== "object") {
-        return null;
-      }
-      const component = stringifyUnknown((entry as { component?: unknown }).component).trim();
-      const level = stringifyUnknown((entry as { level?: unknown }).level)
-        .trim()
-        .toLowerCase();
-      if (!component || !LOG_LEVEL_OPTIONS.includes(level as (typeof LOG_LEVEL_OPTIONS)[number])) {
-        return null;
-      }
-      return {
-        component,
-        level,
-        retention_days: normalizeBucketLimit(
-          (entry as { retention_days?: unknown }).retention_days,
-        ),
-        max_rows: normalizeBucketLimit((entry as { max_rows?: unknown }).max_rows),
-        max_size_mb: normalizeBucketLimit((entry as { max_size_mb?: unknown }).max_size_mb),
-      };
-    })
-    .filter((entry): entry is LogRetentionBucketPolicy => entry !== null);
-}
-
-export function serializeBucketPolicies(policies: LogRetentionBucketPolicy[]): string {
-  const normalized = policies
-    .map((policy) => ({
-      component: policy.component.trim(),
-      level: policy.level.trim().toLowerCase(),
-      retention_days: normalizeBucketLimit(policy.retention_days),
-      max_rows: normalizeBucketLimit(policy.max_rows),
-      max_size_mb: normalizeBucketLimit(policy.max_size_mb),
-    }))
-    .filter(
-      (policy) =>
-        policy.component &&
-        LOG_LEVEL_OPTIONS.includes(policy.level as (typeof LOG_LEVEL_OPTIONS)[number]),
-    );
-
-  return JSON.stringify(normalized);
-}
-
-/** A bucket policy plus the stable row id the editor keys React on. */
-export type LogRetentionBucketRow = LogRetentionBucketPolicy & { id: string };
-
-export function createBucketRow(
-  policy?: Partial<LogRetentionBucketPolicy>,
-  id = "0",
-): LogRetentionBucketRow {
-  return {
-    id,
-    component: policy?.component ?? "",
-    level: policy?.level ?? "info",
-    retention_days: policy?.retention_days ?? 1,
-    max_rows: policy?.max_rows ?? 100000,
-    max_size_mb: policy?.max_size_mb ?? 128,
-  };
-}
-
-export function recommendedBucketRows(): LogRetentionBucketRow[] {
-  return DEFAULT_BUCKET_POLICIES.map((policy, index) => createBucketRow(policy, String(index + 1)));
-}
-
-export interface LogRetentionBucketRowsState {
-  rows: LogRetentionBucketRow[];
-  /** Empty unless the stored JSON was unreadable and the rows fell back. */
-  error: string;
-}
-
-/**
- * Turns the stored `opslog.bucket_policies` JSON into editor rows. Unreadable
- * JSON falls back to the recommended rules with an error the caller shows, so
- * an admin can always recover without hand-editing the database.
- */
-export function bucketRowsFromRaw(raw: string): LogRetentionBucketRowsState {
-  try {
-    const parsed = parseBucketPolicies(raw);
-    return {
-      rows: parsed.map((policy, index) => createBucketRow(policy, String(index + 1))),
-      error: "",
-    };
-  } catch (error) {
-    return {
-      rows: recommendedBucketRows(),
-      error: error instanceof Error ? error.message : "Failed to parse bucket rules",
-    };
-  }
-}
-
-function nextBucketRowID(rows: LogRetentionBucketRow[]): string {
-  const highest = rows.reduce((max, row) => Math.max(max, Number.parseInt(row.id, 10) || 0), 0);
-  return String(highest + 1);
-}
-
-export function appendBucketRow(rows: LogRetentionBucketRow[]): LogRetentionBucketRow[] {
-  return [...rows, createBucketRow(undefined, nextBucketRowID(rows))];
-}
-
-export function removeBucketRow(
-  rows: LogRetentionBucketRow[],
-  id: string,
-): LogRetentionBucketRow[] {
-  return rows.filter((row) => row.id !== id);
-}
-
-export function updateBucketRow(
-  rows: LogRetentionBucketRow[],
-  id: string,
-  field: keyof LogRetentionBucketPolicy,
-  value: string,
-): LogRetentionBucketRow[] {
-  return rows.map((row) =>
-    row.id === id
-      ? {
-          ...row,
-          [field]:
-            field === "component" || field === "level"
-              ? value
-              : Math.max(0, Number.parseInt(value, 10) || 0),
-        }
-      : row,
-  );
-}
-
-export function serializeBucketRows(rows: LogRetentionBucketRow[]): string {
-  return serializeBucketPolicies(rows);
-}
diff --git a/web/src/pages/admin-settings/overviewCards.tsx b/web/src/pages/admin-settings/overviewCards.tsx
deleted file mode 100644
index 2813cb2cb9..0000000000
--- a/web/src/pages/admin-settings/overviewCards.tsx
+++ /dev/null
@@ -1,175 +0,0 @@
-import type { LucideIcon } from "lucide-react";
-import {
-  ChevronRight,
-  Database,
-  HardDrive,
-  Mail,
-  PlayCircle,
-  Search,
-  Server,
-  Settings2,
-} from "lucide-react";
-import { Link } from "react-router";
-
-import { Skeleton } from "@/components/ui/skeleton";
-import { cn } from "@/lib/utils";
-import { ADMIN_SETTINGS_NAV } from "@/lib/adminSettingsSearch";
-import {
-  settingsPageHref,
-  type AdminSettingsPageID,
-  type OverviewCard,
-  type OverviewTile,
-} from "@/hooks/admin/useSettingsOverview";
-
-/** Icon per health tile, keyed by the tile ids the hook emits. */
-const TILE_ICONS: Record<string, LucideIcon> = {
-  storage: HardDrive,
-  database: Database,
-  transcoding: PlayCircle,
-  search: Search,
-  email: Mail,
-};
-
-const CARD_METADATA = Object.fromEntries(
-  ADMIN_SETTINGS_NAV.map((item) => [
-    item.id,
-    {
-      description: item.description,
-      groups: item.groups,
-      icon: item.icon,
-      label: item.label,
-    },
-  ]),
-) as Record<
-  AdminSettingsPageID,
-  {
-    description: string;
-    groups: readonly string[];
-    icon: LucideIcon;
-    label: string;
-  }
->;
-
-const PANEL = "border-border/70 rounded-xl border";
-
-/**
- * One health tile. Only tiles asking for something are rendered, so the tile
- * says what is wrong and links to the page that fixes it.
- */
-export function HealthTile({ tile }: { tile: OverviewTile }) {
-  const Icon = TILE_ICONS[tile.id] ?? Server;
-  const warn = tile.state === "warn";
-
-  return (
-    <div
-      data-testid={`overview-tile-${tile.id}`}
-      data-state={tile.state}
-      className={cn(PANEL, "flex flex-col p-3.5")}
-    >
-      <span className="flex items-center gap-2">
-        <Icon
-          className={cn("size-4 shrink-0", warn ? "text-amber-400" : "text-muted-foreground")}
-          aria-hidden="true"
-        />
-        <span className="text-muted-foreground text-xs">{tile.label}</span>
-      </span>
-      <span className={cn("mt-1.5 text-sm font-medium", warn && "text-amber-300")}>
-        {tile.stateText}
-      </span>
-      {tile.detail ? (
-        <span className="text-muted-foreground mt-1 text-xs leading-snug">{tile.detail}</span>
-      ) : null}
-      {tile.action ? (
-        <Link
-          to={settingsPageHref(tile.action.page)}
-          aria-label={`${tile.action.label} — ${tile.label}`}
-          className={cn(
-            "text-foreground/80 hover:text-foreground mt-auto inline-flex items-center gap-1 pt-2.5",
-            "focus-visible:ring-ring rounded-sm text-xs font-medium focus-visible:ring-2 focus-visible:outline-none",
-          )}
-        >
-          {tile.action.label}
-          <ChevronRight className="size-3.5" aria-hidden="true" />
-        </Link>
-      ) : null}
-    </div>
-  );
-}
-
-/** One settings group and the named subareas the admin will find inside it. */
-export function SectionCard({ card }: { card: OverviewCard }) {
-  const metadata = CARD_METADATA[card.id];
-  const Icon = metadata?.icon ?? Settings2;
-
-  return (
-    <Link
-      to={settingsPageHref(card.id)}
-      data-testid={`overview-card-${card.id}`}
-      className={cn(
-        PANEL,
-        "group hover:border-ring/40 bg-card/25 flex min-h-40 flex-col p-4 transition-all",
-        "hover:-translate-y-0.5 hover:shadow-lg hover:shadow-black/10",
-        "focus-visible:ring-ring focus-visible:ring-2 focus-visible:outline-none",
-      )}
-    >
-      <div className="flex items-start gap-3.5">
-        <span className="bg-accent/75 text-foreground flex size-10 shrink-0 items-center justify-center rounded-xl">
-          <Icon className="size-[18px]" aria-hidden="true" />
-        </span>
-        <div className="min-w-0 flex-1">
-          <h3 className="text-base leading-6 font-semibold tracking-tight">{metadata?.label}</h3>
-          <p className="text-muted-foreground mt-1.5 max-w-2xl text-[13px] leading-relaxed">
-            {metadata?.description}
-          </p>
-        </div>
-        <ChevronRight
-          className="text-muted-foreground group-hover:text-foreground mt-1 size-4 shrink-0 transition-colors"
-          aria-hidden="true"
-        />
-      </div>
-      <ul className="mt-4 grid list-none grid-cols-1 gap-x-5 gap-y-2 sm:grid-cols-2">
-        {metadata?.groups.map((group) => (
-          <li
-            key={group}
-            className="text-foreground/75 flex min-w-0 items-center gap-2 text-xs leading-5"
-          >
-            <span className="bg-border h-px w-3 shrink-0" aria-hidden="true" />
-            <span className="truncate">{group}</span>
-          </li>
-        ))}
-      </ul>
-    </Link>
-  );
-}
-
-/** Placeholder tile shown while the settings map is still in flight. */
-export function HealthTileSkeleton() {
-  return (
-    <div className={cn(PANEL, "flex flex-col gap-2 p-3.5")}>
-      <Skeleton className="h-3 w-16" />
-      <Skeleton className="h-4 w-20" />
-      <Skeleton className="h-3 w-24" />
-    </div>
-  );
-}
-
-/** Placeholder card shown while the settings map is still in flight. */
-export function SectionCardSkeleton() {
-  return (
-    <div className={cn(PANEL, "flex min-h-40 flex-col p-4")}>
-      <div className="flex items-start gap-3.5">
-        <Skeleton className="size-10 rounded-xl" />
-        <div className="flex-1 space-y-2">
-          <Skeleton className="h-5 w-36" />
-          <Skeleton className="h-3 w-4/5" />
-          <Skeleton className="h-3 w-3/5" />
-        </div>
-      </div>
-      <div className="mt-4 grid grid-cols-2 gap-2">
-        <Skeleton className="h-3 w-28" />
-        <Skeleton className="h-3 w-24" />
-        <Skeleton className="h-3 w-20" />
-      </div>
-    </div>
-  );
-}
diff --git a/web/src/pages/admin-settings/playbackSettings.utils.ts b/web/src/pages/admin-settings/playbackSettings.utils.ts
index 650db39358..6d8cad41e7 100644
--- a/web/src/pages/admin-settings/playbackSettings.utils.ts
+++ b/web/src/pages/admin-settings/playbackSettings.utils.ts
@@ -90,14 +90,19 @@ export function hasUsableTranscodeNode(nodes: StreamNode[] | undefined): boolean
   return (nodes ?? []).some((node) => node.type === "transcode" && node.enabled && node.healthy);
 }
 
-/** True when a node can extract seek previews with its current capability snapshot. */
+/**
+ * True when a node can extract seek previews with its current capability
+ * snapshot. Mirrors the server's rule (internal/trickplay makesTrickplay): only
+ * a node advertising trickplay_extract_v2, which reads the tone-map source
+ * signal, is sent work.
+ */
 export function hasUsableTrickplayNode(nodes: StreamNode[] | undefined): boolean {
   return (nodes ?? []).some(
     (node) =>
       node.type === "transcode" &&
       node.enabled &&
       node.healthy &&
-      node.capabilities?.transport_features?.includes("trickplay_extract_v1") &&
+      node.capabilities?.transport_features?.includes("trickplay_extract_v2") &&
       (node.advertised_capabilities_hash === undefined ||
         (node.advertised_capabilities_hash !== "" &&
           node.advertised_capabilities_hash === node.capabilities_hash)),
diff --git a/web/src/pages/admin-settings/recommendationsSettings.test.ts b/web/src/pages/admin-settings/recommendationsSettings.test.ts
index 5e3b2eee15..0ab80a90b2 100644
--- a/web/src/pages/admin-settings/recommendationsSettings.test.ts
+++ b/web/src/pages/admin-settings/recommendationsSettings.test.ts
@@ -39,7 +39,7 @@ describe("parseRecommendationEmbeddingLock", () => {
       model: "text-embedding-3-large",
       sourceDimensions: 1536,
       storageDimensions: 3072,
-      note: expect.stringContaining("manual reset"),
+      note: expect.stringContaining("resetting embeddings"),
     });
   });
 
diff --git a/web/src/pages/admin-settings/recommendationsSettings.ts b/web/src/pages/admin-settings/recommendationsSettings.ts
index 2b3a4944af..fbfd0e4d68 100644
--- a/web/src/pages/admin-settings/recommendationsSettings.ts
+++ b/web/src/pages/admin-settings/recommendationsSettings.ts
@@ -115,7 +115,7 @@ const RECOMMENDATIONS_SECTIONS: RecSectionDef[] = [
 ];
 
 const EMBEDDING_LOCK_NOTE =
-  "Changing this config requires a manual reset, which is not currently supported in-product.";
+  "Switching the embedding base URL or model requires resetting embeddings, which deletes them all.";
 
 export function buildRecommendationSections(): RecSectionDef[] {
   return RECOMMENDATIONS_SECTIONS;
diff --git a/web/src/pages/admin-settings/redisDraft.ts b/web/src/pages/admin-settings/redisDraft.ts
index 3681f29a80..168c5972bb 100644
--- a/web/src/pages/admin-settings/redisDraft.ts
+++ b/web/src/pages/admin-settings/redisDraft.ts
@@ -1,5 +1,7 @@
 import type { useSettingsForm } from "@/hooks/useSettingsForm";
 
+export const REDIS_KEYS = ["redis.url", "redis.db"];
+
 /** The part of a settings form the Redis fields stage their edits through. */
 type RedisDraft = Pick<
   ReturnType<typeof useSettingsForm>,
diff --git a/web/src/pages/admin-settings/requestRoutingModel.test.ts b/web/src/pages/admin-settings/requestRoutingModel.test.ts
index 9f6135a645..87e4a7c10a 100644
--- a/web/src/pages/admin-settings/requestRoutingModel.test.ts
+++ b/web/src/pages/admin-settings/requestRoutingModel.test.ts
@@ -18,6 +18,7 @@ import {
   ruleDraft,
   ruleSentence,
   rowsToConditions,
+  SERVER_NAMED_OVERRIDES,
   splitOverrideFields,
   traceLine,
 } from "./requestRoutingModel";
@@ -30,8 +31,12 @@ import {
 } from "./requestRoutingWarnings";
 import {
   serverDeleteBlockers,
+  serverNeedsAPIKey,
+  serverNeedsBaseURL,
+  serverReady,
   serverRouteUsage,
   serverServesMediaType,
+  type RequestRouterInstallation,
 } from "./requestServerModel";
 
 function server(id: string, name: string, kind: "radarr" | "sonarr", extra = {}) {
@@ -166,6 +171,22 @@ describe("rule sentences", () => {
       ),
     ).toBe("Quality Ultra-HD");
   });
+
+  it("names a Sonarr metadata language from the server's options", () => {
+    // A route row loads the server's options only for these keys.
+    expect(SERVER_NAMED_OVERRIDES.has("metadata_language")).toBe(true);
+    expect(
+      overridesSummary(
+        { metadata_language: 8 },
+        {
+          options: { metadata_language: [{ value: "8", label: "Japanese" }] },
+          fields: [
+            { key: "metadata_language", label: "Metadata language" } as PluginAdminFormField,
+          ],
+        },
+      ),
+    ).toBe("Metadata language Japanese");
+  });
 });
 
 describe("the pass-through choice", () => {
@@ -310,6 +331,7 @@ describe("routing warnings", () => {
       rules: [],
       fallback: fallback("s1", undefined, "series"),
       servers,
+      installations: [],
       serverFields: () => animeFields,
       language: "en",
       forceDual: false,
@@ -486,6 +508,58 @@ describe("request routing bodies", () => {
 });
 
 describe("request servers", () => {
+  function routerInstallation(
+    request_router?: RequestRouterInstallation["capability"]["request_router"],
+  ): RequestRouterInstallation {
+    return {
+      installationID: 1,
+      pluginID: "prairie.requests.local",
+      capability: { type: "request_router.v1", id: "local", display_name: "Local", request_router },
+    };
+  }
+  const keyless = server("k1", "Local", "radarr", { has_api_key: false, capability_id: "local" });
+
+  it("needs a URL and a key unless the server's plugin works without them", () => {
+    expect(serverNeedsAPIKey(undefined)).toBe(true);
+    expect(serverNeedsBaseURL(undefined)).toBe(true);
+    expect(serverNeedsAPIKey(routerInstallation())).toBe(true);
+    expect(serverNeedsBaseURL(routerInstallation())).toBe(true);
+    const neither = routerInstallation({ api_key_optional: true, base_url_optional: true });
+    expect(serverNeedsAPIKey(neither)).toBe(false);
+    expect(serverNeedsBaseURL(neither)).toBe(false);
+  });
+
+  it("counts a server without a key as ready only when its plugin needs none", () => {
+    const keyOptional = routerInstallation({ api_key_optional: true, base_url_optional: false });
+    expect(serverReady(keyless, [keyOptional])).toBe(true);
+    expect(serverReady(keyless, [routerInstallation()])).toBe(false);
+    // A server whose plugin is not installed needs a key.
+    expect(serverReady(keyless, [])).toBe(false);
+    expect(serverReady({ ...keyless, enabled: false }, [keyOptional])).toBe(false);
+    expect(serverReady({ ...keyless, installation_id: undefined }, [keyOptional])).toBe(false);
+    expect(serverReady(radarr, [])).toBe(true);
+  });
+
+  it("warns that a server without a key needs setup only when its plugin needs one", () => {
+    const warns = (installations: RequestRouterInstallation[]) =>
+      (
+        routingWarnings({
+          mediaType: "movie",
+          rules: [],
+          fallback: fallback("k1"),
+          servers: [keyless],
+          installations,
+          serverFields: () => [],
+          language: "en",
+          forceDual: false,
+        }).get(fallback("k1").id) ?? []
+      ).some((warning) => warning.text === "Local needs setup.");
+    expect(warns([routerInstallation()])).toBe(true);
+    expect(warns([routerInstallation({ api_key_optional: true, base_url_optional: false })])).toBe(
+      false,
+    );
+  });
+
   it("routes movies to Radarr and series to Sonarr", () => {
     expect(serverServesMediaType(radarr, "movie")).toBe(true);
     expect(serverServesMediaType(radarr, "series")).toBe(false);
@@ -678,6 +752,7 @@ describe("review fixes", () => {
           rules: [foreign(conditions), anime],
           fallback: fallback("s1", undefined, "series"),
           servers,
+          installations: [],
           serverFields: () => [],
           language: "en",
           forceDual: false,
diff --git a/web/src/pages/admin-settings/requestRoutingModel.ts b/web/src/pages/admin-settings/requestRoutingModel.ts
index bb6ff9029a..b7f8ab108f 100644
--- a/web/src/pages/admin-settings/requestRoutingModel.ts
+++ b/web/src/pages/admin-settings/requestRoutingModel.ts
@@ -457,10 +457,14 @@ const INLINE_OVERRIDES: readonly string[] = ["root_folder", "quality_profile_id"
 const SELF_NAMED_OVERRIDES = new Set(["root_folder"]);
 
 /**
- * Override keys whose values are IDs on the server (a quality profile, tags),
- * so naming them takes the server's options.
+ * Override keys whose values are IDs on the server (a quality profile, tags, a
+ * Sonarr metadata language), so naming them takes the server's options.
  */
-export const SERVER_NAMED_OVERRIDES: ReadonlySet<string> = new Set(["quality_profile_id", "tags"]);
+export const SERVER_NAMED_OVERRIDES: ReadonlySet<string> = new Set([
+  "quality_profile_id",
+  "tags",
+  "metadata_language",
+]);
 
 export interface OverrideNames {
   /** The server's loaded options (root folders, quality profiles, tags), by field key. */
diff --git a/web/src/pages/admin-settings/requestRoutingWarnings.ts b/web/src/pages/admin-settings/requestRoutingWarnings.ts
index 794daf892b..7245338ff6 100644
--- a/web/src/pages/admin-settings/requestRoutingWarnings.ts
+++ b/web/src/pages/admin-settings/requestRoutingWarnings.ts
@@ -13,7 +13,7 @@ import {
   ratingAge,
   type Tier,
 } from "./requestRoutingModel";
-import { serverKind } from "./requestServerModel";
+import { serverKind, serverReady, type RequestRouterInstallation } from "./requestServerModel";
 
 /** A one-click fix a warning offers. */
 export type RoutingWarningFix =
@@ -36,6 +36,8 @@ export interface RoutingWarningInput {
   rules: readonly RequestRoute[];
   fallback: RequestRoute | undefined;
   servers: readonly RequestIntegration[];
+  /** The request_router.v1 capabilities, for which servers need a key. */
+  installations: readonly RequestRouterInstallation[];
   /** The plugin form fields a server's destination can set. */
   serverFields: (server: RequestIntegration) => readonly PluginAdminFormField[];
   /** The admin's language, as the Foreign-language preset uses it. */
@@ -155,7 +157,7 @@ function serverWarnings(
       });
     } else if (!server.enabled) {
       out.push({ key: `off-${id}`, text: `${server.name} is turned off. ${waits}` });
-    } else if (!server.installation_id || !server.has_api_key) {
+    } else if (!serverReady(server, input.installations)) {
       out.push({ key: `setup-${id}`, text: `${server.name} needs setup.` });
     }
   }
diff --git a/web/src/pages/admin-settings/requestServerModel.ts b/web/src/pages/admin-settings/requestServerModel.ts
index 05cd2bb8b4..d1c1e2eca1 100644
--- a/web/src/pages/admin-settings/requestServerModel.ts
+++ b/web/src/pages/admin-settings/requestServerModel.ts
@@ -73,7 +73,7 @@ export function installationOptionValue(entry: RequestRouterInstallation): strin
  * when one is recorded, and otherwise adopts the installation's capability.
  */
 export function serverInstallation(
-  installations: RequestRouterInstallation[],
+  installations: readonly RequestRouterInstallation[],
   installationId: number | undefined,
   capabilityId: string | undefined,
 ): RequestRouterInstallation | undefined {
@@ -85,6 +85,22 @@ export function serverInstallation(
   );
 }
 
+/**
+ * Whether servers of this type need an API key: every type does unless its
+ * plugin declares it works without one. An unknown type needs one.
+ */
+export function serverNeedsAPIKey(entry: RequestRouterInstallation | undefined): boolean {
+  return !entry?.capability.request_router?.api_key_optional;
+}
+
+/**
+ * Whether servers of this type need a URL: every type does unless its plugin
+ * declares it works without one. An unknown type needs one.
+ */
+export function serverNeedsBaseURL(entry: RequestRouterInstallation | undefined): boolean {
+  return !entry?.capability.request_router?.base_url_optional;
+}
+
 export function serverConfigSchema(entry: RequestRouterInstallation | undefined): {
   descriptor?: PluginAdminForm;
   jsonSchema?: string;
@@ -162,10 +178,20 @@ export function serverFitsTier(
 
 /**
  * Whether the server could take a request right now: switched on, bound to a
- * plugin, and holding an API key. Anything less reads "Needs setup".
+ * plugin, and holding an API key unless its plugin needs none. Anything less
+ * reads "Needs setup".
  */
-export function serverReady(server: RequestIntegration): boolean {
-  return Boolean(server.enabled && server.installation_id && server.has_api_key);
+export function serverReady(
+  server: RequestIntegration,
+  installations: readonly RequestRouterInstallation[],
+): boolean {
+  if (!server.enabled || !server.installation_id) return false;
+  return (
+    Boolean(server.has_api_key) ||
+    !serverNeedsAPIKey(
+      serverInstallation(installations, server.installation_id, server.capability_id),
+    )
+  );
 }
 
 export function mediaTypePlural(mediaType: RequestRouteMediaType): string {
diff --git a/web/src/pages/admin-settings/useStagedDraft.ts b/web/src/pages/admin-settings/useStagedDraft.ts
index 264d2265d7..b3c2938403 100644
--- a/web/src/pages/admin-settings/useStagedDraft.ts
+++ b/web/src/pages/admin-settings/useStagedDraft.ts
@@ -46,12 +46,11 @@ export function useStagedDraft<B extends { etag?: string }, D>(
   }, []);
   const reset = useCallback(() => {
     setState((prev) => (prev ? { base: prev.base, draft: toDraft(prev.base) } : prev));
-    // toDraft is a module-level function at every call site.
-    // eslint-disable-next-line react-hooks/exhaustive-deps
+    // eslint-disable-next-line react-hooks/exhaustive-deps -- toDraft is a module-level function at every call site
   }, []);
   const adopt = useCallback((base: B) => {
     setState({ base, draft: toDraft(base) });
-    // eslint-disable-next-line react-hooks/exhaustive-deps
+    // eslint-disable-next-line react-hooks/exhaustive-deps -- toDraft is a module-level function at every call site
   }, []);
 
   return {
diff --git a/web/src/pages/admin-users/detail/UserDetailHeader.tsx b/web/src/pages/admin-users/detail/UserDetailHeader.tsx
index 0caf4d12f5..39ac9b08ad 100644
--- a/web/src/pages/admin-users/detail/UserDetailHeader.tsx
+++ b/web/src/pages/admin-users/detail/UserDetailHeader.tsx
@@ -139,7 +139,7 @@ export function UserDetailHeader({
           <InitialAvatar name={user.username} seed={user.id} size="lg" />
           <div className="min-w-0 flex-1 space-y-2">
             <div className="flex flex-wrap items-center gap-2">
-              <h1 className="page-title min-w-0 text-[clamp(1.75rem,4vw,2.75rem)] break-words">
+              <h1 className="min-w-0 text-[1.75rem] leading-[1.15] font-bold tracking-[-0.035em] text-balance break-words sm:text-[2rem]">
                 {user.username}
               </h1>
               <Badge variant={user.role === "admin" ? "default" : "secondary"}>
diff --git a/web/src/pages/admin-users/detail/access/AccessTab.test.tsx b/web/src/pages/admin-users/detail/access/AccessTab.test.tsx
index d41ce4718b..78df17c5d5 100644
--- a/web/src/pages/admin-users/detail/access/AccessTab.test.tsx
+++ b/web/src/pages/admin-users/detail/access/AccessTab.test.tsx
@@ -92,6 +92,7 @@ const GROUPS: AccessGroup[] = [
     max_transcodes: 0,
     max_remote_stream_bitrate_kbps: 0,
     max_local_stream_bitrate_kbps: 0,
+    max_profiles: 5,
     allowed_permissions: null,
     requests_allowed: true,
     is_default: false,
@@ -113,6 +114,7 @@ const GROUPS: AccessGroup[] = [
     max_transcodes: 0,
     max_remote_stream_bitrate_kbps: 8000,
     max_local_stream_bitrate_kbps: 0,
+    max_profiles: 2,
     allowed_permissions: [PERMISSION_MARKER_EDIT],
     requests_allowed: false,
     is_default: false,
@@ -148,7 +150,7 @@ const USER: AdminUser = {
   max_local_stream_bitrate_kbps: null,
   transcode_allowed: null,
   audio_transcode_allowed: null,
-  max_profiles: 4,
+  max_profiles: null,
   download_allowed: null,
   download_transcode_allowed: null,
   requests_allowed: null,
@@ -163,6 +165,7 @@ const USER: AdminUser = {
     max_transcodes: 0,
     max_remote_stream_bitrate_kbps: 0,
     max_local_stream_bitrate_kbps: 0,
+    max_profiles: 4,
     transcode_allowed: true,
     audio_transcode_allowed: true,
     download_allowed: true,
@@ -185,6 +188,7 @@ const GUEST: AdminUser = {
     max_streams: 1,
     transcode_allowed: false,
     max_remote_stream_bitrate_kbps: 8000,
+    max_profiles: 2,
     download_allowed: false,
     requests_allowed: false,
   },
@@ -311,6 +315,17 @@ describe("card editing", () => {
     }
   });
 
+  it("keeps an admin's profile limit to the owner while the rest of sign-in stays editable", async () => {
+    const ui = userEvent.setup();
+    mount({ ...USER, role: "admin" }, { policyManageable: false });
+    await ui.click(screen.getByRole("button", { name: "Edit Sign-in & role" }));
+    const limit = within(card("Sign-in & role")).getByRole("group", { name: "Profiles allowed" });
+    for (const option of within(limit).getAllByRole("button")) {
+      expect(option).toBeDisabled();
+    }
+    expect(within(card("Sign-in & role")).getByLabelText("Email")).toBeEnabled();
+  });
+
   it("saves one PUT with only the changed fields and the captured validator", async () => {
     const ui = userEvent.setup();
     mount();
@@ -445,6 +460,84 @@ describe("Sign-in & role", () => {
     await waitFor(() => expect(mocks.update).toHaveBeenCalled());
     expect(lastBody()).toEqual({ role: "admin", access_group_id: null });
   });
+
+  it("follows the draft role for the inherited profile limit", async () => {
+    const ui = userEvent.setup();
+    mocks.viewerIsOwner = true;
+    mount(GUEST);
+    const signIn = await edit(ui, "Sign-in & role");
+    expect(
+      within(segment(signIn, "Profiles allowed")).getByRole("button", { name: "Default · 2" }),
+    ).toBeInTheDocument();
+    // An admin leaves the group, so it would inherit the admin default, not Guests' 2.
+    await pick(ui, signIn, "Role", "Admin");
+    expect(
+      within(segment(signIn, "Profiles allowed")).getByRole("button", { name: "Default · 5" }),
+    ).toBeInTheDocument();
+    await customize(ui, signIn, "Profiles allowed");
+    expect(within(signIn).getByRole("spinbutton", { name: "Profiles allowed" })).toHaveValue(5);
+  });
+
+  it("shows the no-group limit for a demoted admin when no group is the default", async () => {
+    const ui = userEvent.setup();
+    mocks.viewerIsOwner = true;
+    mount({ ...USER, role: "admin" });
+    const signIn = await edit(ui, "Sign-in & role");
+    await pick(ui, signIn, "Role", "User");
+    // With no default group the account is left ungrouped.
+    expect(
+      within(segment(signIn, "Profiles allowed")).getByRole("button", { name: "Default · 5" }),
+    ).toBeInTheDocument();
+  });
+
+  it("overrides the group's profile limit, seeded from it", async () => {
+    const ui = userEvent.setup();
+    mount(GUEST);
+    expect(row(card("Sign-in & role"), "Profiles allowed")).toBe("2 · 1 usedGROUP");
+    const signIn = await edit(ui, "Sign-in & role");
+    await customize(ui, signIn, "Profiles allowed");
+    const limit = within(signIn).getByRole("spinbutton", { name: "Profiles allowed" });
+    expect(limit).toHaveValue(2);
+    await ui.clear(limit);
+    await ui.type(limit, "3");
+    await ui.click(within(signIn).getByRole("button", { name: "Save" }));
+    await waitFor(() => expect(mocks.update).toHaveBeenCalled());
+    expect(lastBody()).toEqual({ max_profiles: 3 });
+  });
+
+  it("returns a profile limit override to the group's with null", async () => {
+    const ui = userEvent.setup();
+    mount({
+      ...GUEST,
+      max_profiles: 6,
+      effective_policy: { ...GUEST.effective_policy, max_profiles: 6 },
+    });
+    expect(row(card("Sign-in & role"), "Profiles allowed")).toBe("6 · 1 usedGroup: 2CUSTOM");
+    const signIn = await edit(ui, "Sign-in & role");
+    await ui.click(
+      within(segment(signIn, "Profiles allowed")).getByRole("button", { name: "Default · 2" }),
+    );
+    await ui.click(within(signIn).getByRole("button", { name: "Save" }));
+    await waitFor(() => expect(mocks.update).toHaveBeenCalled());
+    expect(lastBody()).toEqual({ max_profiles: null });
+  });
+
+  it("won't save a custom profile limit below 1 in place of an override", async () => {
+    const ui = userEvent.setup();
+    mount({
+      ...GUEST,
+      max_profiles: 6,
+      effective_policy: { ...GUEST.effective_policy, max_profiles: 6 },
+    });
+    const signIn = await edit(ui, "Sign-in & role");
+    const limit = within(signIn).getByRole("spinbutton", { name: "Profiles allowed" });
+    await ui.clear(limit);
+    await ui.type(limit, "0");
+    expect(
+      within(signIn).getByText("Enter a whole number of at least 1, or switch back to Default."),
+    ).toBeInTheDocument();
+    expect(within(signIn).getByRole("button", { name: "Save" })).toBeDisabled();
+  });
 });
 
 describe("Library access", () => {
diff --git a/web/src/pages/admin-users/detail/access/AccessTab.tsx b/web/src/pages/admin-users/detail/access/AccessTab.tsx
index 03de1964c6..8dfb3cdf6d 100644
--- a/web/src/pages/admin-users/detail/access/AccessTab.tsx
+++ b/web/src/pages/admin-users/detail/access/AccessTab.tsx
@@ -65,7 +65,7 @@ export function AccessTab({
       ) : null}
       <div className="grid items-start gap-4 lg:grid-cols-2">
         <div className="flex min-w-0 flex-col gap-4">
-          <SignInCard {...props} />
+          <SignInCard {...props} policyLocked={!policyManageable} />
           <LibraryAccessCard {...policy} />
           <DownloadsPolicyCard {...policy} />
         </div>
diff --git a/web/src/pages/admin-users/detail/access/RequestsCard.test.tsx b/web/src/pages/admin-users/detail/access/RequestsCard.test.tsx
index 493b969eef..394f26878b 100644
--- a/web/src/pages/admin-users/detail/access/RequestsCard.test.tsx
+++ b/web/src/pages/admin-users/detail/access/RequestsCard.test.tsx
@@ -73,7 +73,7 @@ const USER: AdminUser = {
   max_local_stream_bitrate_kbps: null,
   transcode_allowed: null,
   audio_transcode_allowed: null,
-  max_profiles: 4,
+  max_profiles: null,
   download_allowed: null,
   download_transcode_allowed: null,
   requests_allowed: null,
@@ -88,6 +88,7 @@ const USER: AdminUser = {
     max_transcodes: 0,
     max_remote_stream_bitrate_kbps: 0,
     max_local_stream_bitrate_kbps: 0,
+    max_profiles: 4,
     transcode_allowed: true,
     audio_transcode_allowed: true,
     download_allowed: true,
@@ -112,6 +113,7 @@ const KIDS = {
   max_transcodes: 0,
   max_remote_stream_bitrate_kbps: 0,
   max_local_stream_bitrate_kbps: 0,
+  max_profiles: 5,
   allowed_permissions: null,
   requests_allowed: true,
 } as AccessGroup;
diff --git a/web/src/pages/admin-users/detail/access/SignInCard.tsx b/web/src/pages/admin-users/detail/access/SignInCard.tsx
index 320b0c3218..c1fc96d640 100644
--- a/web/src/pages/admin-users/detail/access/SignInCard.tsx
+++ b/web/src/pages/admin-users/detail/access/SignInCard.tsx
@@ -1,6 +1,6 @@
 import { useId } from "react";
 
-import type { AdminUser, UpdateUserRequest } from "@/api/types";
+import type { AccessGroup, AdminPolicyDefaults, AdminUser, UpdateUserRequest } from "@/api/types";
 import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
 import {
@@ -11,23 +11,38 @@ import {
   SelectValue,
 } from "@/components/ui/select";
 import { Switch } from "@/components/ui/switch";
+import type { PolicyInheritHints } from "@/components/UserPolicyFields";
+import { useAccessGroups } from "@/hooks/queries/admin/accessGroups";
 import { useAdminUserProfiles } from "@/hooks/queries/admin/history";
-import { useViewerIsOwner } from "@/hooks/queries/admin/users";
+import { useAdminPolicyDefaults, useViewerIsOwner } from "@/hooks/queries/admin/users";
 import { useAuth } from "@/hooks/useAuth";
 import { INVALID_EMAIL_MESSAGE, isValidEmail } from "@/lib/email";
 
 import { KeyValueRow } from "../ui";
 import { EditableCard, type AccessCardProps } from "./EditableCard";
-import { accessGroupName, parseWholeNumber, roleLabel } from "./policySources";
+import { DefaultCustomSegment, PolicyValueRow } from "./PolicyRow";
+import {
+  accessGroupName,
+  inheritedValueText,
+  parseWholeNumber,
+  roleLabel,
+  rowChanged,
+  rowDraft,
+  rowOverride,
+  rowSource,
+  type RowDraft,
+} from "./policySources";
 import { useAccountCardDraft } from "./useAccountCardDraft";
 
+const PROFILES_LABEL = "Profiles allowed";
+
 interface SignInDraft {
   username: string;
   email: string;
   role: string;
   enabled: boolean;
-  /** Kept as typed so a cleared box is an unsaved edit, not 0. */
-  maxProfiles: string;
+  /** The profile limit override; `text` keeps a cleared box an unsaved edit, not 0. */
+  profiles: RowDraft<number>;
 }
 
 function toDraft(user: AdminUser): SignInDraft {
@@ -36,7 +51,10 @@ function toDraft(user: AdminUser): SignInDraft {
     email: user.email,
     role: user.role,
     enabled: user.enabled,
-    maxProfiles: String(user.max_profiles),
+    profiles: rowDraft(
+      user.max_profiles,
+      user.max_profiles === null ? "" : String(user.max_profiles),
+    ),
   };
 }
 
@@ -46,7 +64,7 @@ function changedRows(draft: SignInDraft, base: SignInDraft): string[] {
   if (draft.email !== base.email) rows.push("Email");
   if (draft.role !== base.role) rows.push("Role");
   if (draft.enabled !== base.enabled) rows.push("Can sign in");
-  if (draft.maxProfiles.trim() !== base.maxProfiles) rows.push("Profiles allowed");
+  if (rowChanged(draft.profiles, rowOverride(base.profiles) ?? null)) rows.push(PROFILES_LABEL);
   return rows;
 }
 
@@ -60,22 +78,66 @@ function toBody(draft: SignInDraft, base: AdminUser): UpdateUserRequest {
     if (draft.role === "admin") body.access_group_id = null;
   }
   if (draft.enabled !== base.enabled) body.enabled = draft.enabled;
-  const profiles = parseWholeNumber(draft.maxProfiles, 1);
-  if (profiles !== null && profiles !== base.max_profiles) body.max_profiles = profiles;
+  const profiles = rowOverride(draft.profiles);
+  if (profiles !== undefined && rowChanged(draft.profiles, base.max_profiles)) {
+    body.max_profiles = profiles;
+  }
   return body;
 }
 
-function validate(draft: SignInDraft): string | null {
+/**
+ * The profile limit Default resolves to once the draft saves. A role change
+ * moves the account out of or into a group: an admin is never grouped, and a
+ * demoted admin joins the default group, or no group when none is the default.
+ * Groups are undefined while they load.
+ */
+function inheritedProfileLimit(
+  role: string,
+  base: AdminUser,
+  groups: AccessGroup[] | undefined,
+  hints: PolicyInheritHints,
+  defaults: AdminPolicyDefaults | undefined,
+): number | undefined {
+  if (role === base.role) return hints.max_profiles;
+  if (role === "admin") return defaults?.admin.max_profiles;
+  if (groups === undefined) return undefined;
+  const defaultGroup = groups.find((group) => group.is_default);
+  return defaultGroup ? defaultGroup.max_profiles : defaults?.ungrouped.max_profiles;
+}
+
+// A Custom limit with nothing valid in place of a saved override can't be
+// saved; one in place of Default leaves the row on Default.
+function profilesIncomplete(draft: SignInDraft, saved: SignInDraft): boolean {
+  return rowOverride(draft.profiles) === undefined && rowOverride(saved.profiles) !== null;
+}
+
+function validate(draft: SignInDraft, base: AdminUser): string | null {
   if (draft.username.trim() === "") return "Enter a username.";
   if (!isValidEmail(draft.email)) return INVALID_EMAIL_MESSAGE;
-  if (parseWholeNumber(draft.maxProfiles, 1) === null) return "Allow at least 1 profile.";
+  if (profilesIncomplete(draft, toDraft(base)))
+    return "Allow at least 1 profile, or choose Default.";
   return null;
 }
 
-export function SignInCard({ user, editor, manageable, available, groups }: AccessCardProps) {
+export function SignInCard({
+  user,
+  editor,
+  manageable,
+  available,
+  groups,
+  libraries,
+  ctx,
+  hints,
+  policyLocked = false,
+}: AccessCardProps & {
+  /** The profile limit is access policy, which only the server owner changes on an admin. */
+  policyLocked?: boolean;
+}) {
   const viewerId = useAuth().user?.id;
   const viewerIsOwner = useViewerIsOwner(viewerId);
   const profiles = useAdminUserProfiles(user.id);
+  const policyDefaults = useAdminPolicyDefaults().data;
+  const loadedGroups = useAccessGroups().data;
   const draft = useAccountCardDraft({
     id: "signin",
     editor,
@@ -93,11 +155,16 @@ export function SignInCard({ user, editor, manageable, available, groups }: Acce
   const used = profiles.data?.length;
   const d = draft.draft;
   const base = draft.base ?? user;
+  const inheritedProfiles = d
+    ? inheritedProfileLimit(d.role, base, loadedGroups, hints, policyDefaults)
+    : hints.max_profiles;
   // Only the server owner may grant the admin role; nobody changes their own
   // role or disables themselves; the owner stays an enabled admin.
   const adminRoleLocked = !viewerIsOwner && base.role !== "admin";
   const ownAccount = base.id === viewerId;
   const changed = new Set(draft.changed);
+  const saved = toDraft(base);
+  const profilesInvalid = d !== undefined && profilesIncomplete(d, saved);
 
   function roleDescription(): string {
     if (ownAccount) return "You can't change your own role.";
@@ -120,6 +187,7 @@ export function SignInCard({ user, editor, manageable, available, groups }: Acce
       manageable={manageable}
       available={available}
       canEdit={editor !== undefined}
+      invalid={profilesInvalid}
       state={draft}
     >
       {draft.editing && d ? (
@@ -200,23 +268,64 @@ export function SignInCard({ user, editor, manageable, available, groups }: Acce
             }
           />
           <KeyValueRow
-            label={<Label htmlFor={profilesId}>Profiles allowed</Label>}
+            label={
+              d.profiles.custom ? (
+                <Label htmlFor={profilesId}>{PROFILES_LABEL}</Label>
+              ) : (
+                PROFILES_LABEL
+              )
+            }
             description={used !== undefined ? `${used} used` : undefined}
-            changed={changed.has("Profiles allowed")}
+            changed={changed.has(PROFILES_LABEL)}
             value={
-              <Input
-                id={profilesId}
-                type="number"
-                inputMode="numeric"
-                min={1}
-                step={1}
-                className="w-24"
-                value={d.maxProfiles}
-                aria-invalid={parseWholeNumber(d.maxProfiles, 1) === null ? true : undefined}
-                onChange={(event) =>
-                  draft.setDraft((prev) => ({ ...prev, maxProfiles: event.target.value }))
+              <DefaultCustomSegment
+                label={PROFILES_LABEL}
+                defaultText={
+                  inheritedProfiles === undefined ? undefined : String(inheritedProfiles)
                 }
-              />
+                custom={d.profiles.custom}
+                disabled={policyLocked}
+                onCustomChange={(on) =>
+                  // Custom starts from the inherited limit; with that unknown
+                  // the box starts empty.
+                  draft.setDraft((prev) => ({
+                    ...prev,
+                    profiles: on
+                      ? {
+                          custom: true,
+                          value: inheritedProfiles ?? null,
+                          text: inheritedProfiles === undefined ? "" : String(inheritedProfiles),
+                        }
+                      : { custom: false, value: null, text: "" },
+                  }))
+                }
+              >
+                <div className="flex flex-col items-end gap-1">
+                  <Input
+                    id={profilesId}
+                    type="number"
+                    inputMode="numeric"
+                    min={1}
+                    step={1}
+                    className="w-24"
+                    disabled={policyLocked}
+                    value={d.profiles.text ?? ""}
+                    aria-invalid={d.profiles.value === null ? true : undefined}
+                    onChange={(event) => {
+                      const text = event.target.value;
+                      draft.setDraft((prev) => ({
+                        ...prev,
+                        profiles: { custom: true, text, value: parseWholeNumber(text, 1) },
+                      }));
+                    }}
+                  />
+                  {d.profiles.value === null ? (
+                    <span className="text-muted-foreground text-xs">
+                      Enter a whole number of at least 1, or switch back to Default.
+                    </span>
+                  ) : null}
+                </div>
+              </DefaultCustomSegment>
             }
           />
         </>
@@ -246,16 +355,18 @@ export function SignInCard({ user, editor, manageable, available, groups }: Acce
               </>
             }
           />
-          <KeyValueRow
-            label="Profiles allowed"
+          <PolicyValueRow
+            label={PROFILES_LABEL}
             value={
               <>
-                {user.max_profiles}
+                {user.effective_policy.max_profiles}
                 {used !== undefined ? (
                   <span className="text-muted-foreground text-xs font-normal"> · {used} used</span>
                 ) : null}
               </>
             }
+            source={rowSource(user, "maxProfiles", ctx)}
+            base={inheritedValueText("maxProfiles", hints, ctx, libraries)}
           />
         </>
       )}
diff --git a/web/src/pages/admin-users/detail/access/policySources.test.ts b/web/src/pages/admin-users/detail/access/policySources.test.ts
index 88bb346c8c..c69b8d00a2 100644
--- a/web/src/pages/admin-users/detail/access/policySources.test.ts
+++ b/web/src/pages/admin-users/detail/access/policySources.test.ts
@@ -29,7 +29,7 @@ const USER: AdminUser = {
   max_local_stream_bitrate_kbps: null,
   transcode_allowed: null,
   audio_transcode_allowed: null,
-  max_profiles: 5,
+  max_profiles: null,
   download_allowed: null,
   download_transcode_allowed: null,
   requests_allowed: null,
@@ -44,6 +44,7 @@ const USER: AdminUser = {
     max_transcodes: 0,
     max_remote_stream_bitrate_kbps: 0,
     max_local_stream_bitrate_kbps: 0,
+    max_profiles: 5,
     transcode_allowed: true,
     audio_transcode_allowed: true,
     download_allowed: true,
@@ -69,6 +70,7 @@ const FAMILY: AccessGroup = {
   max_transcodes: 1,
   max_remote_stream_bitrate_kbps: 8000,
   max_local_stream_bitrate_kbps: 0,
+  max_profiles: 5,
   allowed_permissions: ["marker_edit"],
   requests_allowed: true,
   is_default: false,
@@ -115,6 +117,11 @@ describe("sources", () => {
 });
 
 describe("inheritedValueText", () => {
+  it("words the server's profile limit", () => {
+    const ctx = inheritContextFor(USER, []);
+    expect(inheritedValueText("maxProfiles", hintsFor(USER), ctx, LIBRARIES)).toBe("Default: 5");
+  });
+
   it("words an admin's default as full access", () => {
     const admin: AdminUser = { ...USER, role: "admin", download_transcode_allowed: false };
     const ctx = inheritContextFor(admin, []);
@@ -202,6 +209,10 @@ describe("countCustomPolicyRows", () => {
       }),
     ).toBe(4);
   });
+
+  it("counts a profile limit set on the account", () => {
+    expect(countCustomPolicyRows({ ...USER, max_profiles: 3 })).toBe(1);
+  });
 });
 
 describe("permissionLock", () => {
diff --git a/web/src/pages/admin-users/detail/access/policySources.ts b/web/src/pages/admin-users/detail/access/policySources.ts
index ff40343a37..fe1f864202 100644
--- a/web/src/pages/admin-users/detail/access/policySources.ts
+++ b/web/src/pages/admin-users/detail/access/policySources.ts
@@ -23,7 +23,8 @@ export type PolicyRowKey =
   | "localBitrate"
   | "downloads"
   | "serverPrepared"
-  | "requests";
+  | "requests"
+  | "maxProfiles";
 
 /** "Owner", "Admin" or "User". */
 export function roleLabel(user: Pick<AdminUser, "is_owner" | "role">): string {
@@ -67,6 +68,8 @@ function rowOverridden(user: AdminUser, row: PolicyRowKey): boolean {
       return user.download_transcode_allowed !== null;
     case "requests":
       return user.requests_allowed !== null;
+    case "maxProfiles":
+      return user.max_profiles !== null;
   }
 }
 
@@ -160,6 +163,8 @@ function inheritedValue(
       return lowered(hints.download_transcode_allowed, formatAllowed);
     case "requests":
       return lowered(hints.requests_allowed, (allowed) => (allowed ? "yes" : "no"));
+    case "maxProfiles":
+      return lowered(hints.max_profiles, String);
   }
 }
 
@@ -174,6 +179,7 @@ const POLICY_ROWS: PolicyRowKey[] = [
   "downloads",
   "serverPrepared",
   "requests",
+  "maxProfiles",
 ];
 
 /** Rows this account sets itself; video transcoding counts once for its two fields. */
diff --git a/web/src/pages/admin-users/detail/access/useAccountCardDraft.ts b/web/src/pages/admin-users/detail/access/useAccountCardDraft.ts
index 09b9553b0a..c76ea6ef53 100644
--- a/web/src/pages/admin-users/detail/access/useAccountCardDraft.ts
+++ b/web/src/pages/admin-users/detail/access/useAccountCardDraft.ts
@@ -98,7 +98,8 @@ export function useAccountCardDraft<D>(opts: {
   toDraft: (user: AdminUser) => D;
   toBody: (draft: D, base: AdminUser) => UpdateUserRequest;
   changedRows: (draft: D, base: D) => string[];
-  validate?: (draft: D) => string | null;
+  /** Refuses a save, on every path that saves, with the message to show. */
+  validate?: (draft: D, base: AdminUser) => string | null;
   extra?: CardExtraWrite<D>;
   /**
    * Rebases the draft onto a reloaded account (old and fresh are toDraft of
@@ -145,7 +146,7 @@ export function useAccountCardDraft<D>(opts: {
     const { captured, draft, conflict, opts } = latest.current;
     if (!captured || draft === undefined) return true;
     if (busy.current || conflict) return false;
-    const invalid = opts.validate?.(draft) ?? null;
+    const invalid = opts.validate?.(draft, captured.user) ?? null;
     if (invalid) {
       setError(invalid);
       return false;
diff --git a/web/src/pages/admin-users/detail/overview/ProfilesCard.tsx b/web/src/pages/admin-users/detail/overview/ProfilesCard.tsx
index 198ab9ec00..ba9b9d0c69 100644
--- a/web/src/pages/admin-users/detail/overview/ProfilesCard.tsx
+++ b/web/src/pages/admin-users/detail/overview/ProfilesCard.tsx
@@ -21,7 +21,11 @@ export function ProfilesCard({
   return (
     <DetailCard
       title="Profiles"
-      description={count === undefined ? undefined : `${count} of ${user.max_profiles} allowed`}
+      description={
+        count === undefined
+          ? undefined
+          : `${count} of ${user.effective_policy.max_profiles} allowed`
+      }
     >
       {profiles.isError ? (
         <div role="alert" className="flex flex-wrap items-center gap-2 px-4 py-4 text-sm sm:px-5">
diff --git a/web/src/pages/admin-users/detail/overview/StatsRow.tsx b/web/src/pages/admin-users/detail/overview/StatsRow.tsx
index 14bb3c02c8..e0abaf1512 100644
--- a/web/src/pages/admin-users/detail/overview/StatsRow.tsx
+++ b/web/src/pages/admin-users/detail/overview/StatsRow.tsx
@@ -88,8 +88,10 @@ export function StatsRow({
       key="profiles"
       label="Profiles"
       value={profiles.isError ? FAILED : profileCount === undefined ? LOADING : profileCount}
-      total={profileCount === undefined ? undefined : user.max_profiles}
-      progress={profileCount === undefined ? undefined : ratio(profileCount, user.max_profiles)}
+      total={profileCount === undefined ? undefined : effective.max_profiles}
+      progress={
+        profileCount === undefined ? undefined : ratio(profileCount, effective.max_profiles)
+      }
     />,
   );
 
diff --git a/web/src/pages/admin-users/detail/preferences/ProfileHomeSections.test.tsx b/web/src/pages/admin-users/detail/preferences/ProfileHomeSections.test.tsx
index c8278c36b4..5fca91e432 100644
--- a/web/src/pages/admin-users/detail/preferences/ProfileHomeSections.test.tsx
+++ b/web/src/pages/admin-users/detail/preferences/ProfileHomeSections.test.tsx
@@ -194,7 +194,7 @@ describe("ProfileHomeSections", () => {
             {
               location: "body.overrides",
               code: "invalid",
-              detail: "legacy Trakt section sources cannot be changed or reactivated",
+              detail: "unknown section type retired_row",
             },
           ],
         }),
@@ -205,7 +205,7 @@ describe("ProfileHomeSections", () => {
     await u.click(within(card).getByRole("button", { name: "Hide Continue Watching" }));
 
     expect(toastError).toHaveBeenCalledWith(
-      "Couldn't save Home sections: legacy Trakt section sources cannot be changed or reactivated",
+      "Couldn't save Home sections: unknown section type retired_row",
     );
   });
 });
diff --git a/web/src/pages/admin-users/detail/preferences/ProfileHomeSections.tsx b/web/src/pages/admin-users/detail/preferences/ProfileHomeSections.tsx
index 7535c5cc1e..8ec4b96fb1 100644
--- a/web/src/pages/admin-users/detail/preferences/ProfileHomeSections.tsx
+++ b/web/src/pages/admin-users/detail/preferences/ProfileHomeSections.tsx
@@ -24,7 +24,7 @@ import { fetchRecipeCatalog } from "@/lib/recipes";
 import { DetailCard } from "../ui";
 
 // A refused save names its reason in the problem's first error (a 400 from
-// the section source policy or recipe validation) or in its detail.
+// recipe validation) or in its detail.
 function saveErrorMessage(error: unknown): string {
   let reason: string | undefined;
   if (error instanceof V2ProblemError) {
@@ -65,20 +65,19 @@ export function ProfileHomeSections({
   const newOverrideId = useRef(createOverrideIdSource());
 
   useEffect(() => {
-    // eslint-disable-next-line react-hooks/set-state-in-effect
+    // eslint-disable-next-line react-hooks/set-state-in-effect -- the editable list resets when the saved sections load or change
     if (settings.data) setSections(settings.data);
   }, [settings.data]);
 
   const ready = canMutateSectionSettings(settings, overrides);
   const busy = !ready || save.isPending || reset.isPending;
 
-  function persist(next: SettingsSectionEntry[], changedSectionId: string) {
+  function persist(next: SettingsSectionEntry[]) {
     if (!ready) return;
     setSections(next);
     const body = buildSectionOverrides(next, hydrateRemovedSystemSections(overrides.data), {
       savedOverrides: overrides.data,
       newId: newOverrideId.current,
-      changedSectionId,
       // Store only what changed, as the profile's own Home screen settings
       // do, so rows left alone keep following the server's layout.
       baseline: settings.data,
@@ -109,10 +108,7 @@ export function ProfileHomeSections({
           disabled={busy}
           onMove={persist}
           onToggleHidden={(section) =>
-            persist(
-              sections.map((s) => (s.id === section.id ? { ...s, hidden: !s.hidden } : s)),
-              section.id,
-            )
+            persist(sections.map((s) => (s.id === section.id ? { ...s, hidden: !s.hidden } : s)))
           }
         />
       </div>
diff --git a/web/src/pages/admin/autoscan/ConnectionsPanel.tsx b/web/src/pages/admin/autoscan/ConnectionsPanel.tsx
index e76eb3795c..baf54bb0d0 100644
--- a/web/src/pages/admin/autoscan/ConnectionsPanel.tsx
+++ b/web/src/pages/admin/autoscan/ConnectionsPanel.tsx
@@ -30,7 +30,6 @@ import {
 } from "@/components/ui/alert-dialog";
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
-import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import {
   Dialog,
   DialogContent,
@@ -64,6 +63,7 @@ import {
   useUpdateAutoscanConnection,
 } from "@/hooks/queries/useAutoscan";
 import { useRequestIntegrations } from "@/hooks/queries/admin/requests";
+import { FieldGroup } from "@/pages/admin-settings/FieldGroup";
 
 // ---------------------------------------------------------------------------
 // Dialog mode types
@@ -308,77 +308,72 @@ export default function ConnectionsPanel() {
 
   return (
     <>
-      <Card>
-        <CardHeader>
-          <div className="flex items-center justify-between gap-3">
-            <CardTitle>Connections</CardTitle>
-            <Button variant="outline" size="sm" onClick={openAddDialog}>
-              <Plus />
-              Add connection
-            </Button>
-          </div>
-        </CardHeader>
-        <CardContent className="px-0">
-          {connections.isLoading ? (
-            <p className="text-muted-foreground px-6 py-4 text-sm">Loading…</p>
-          ) : list.length === 0 ? (
-            <p className="text-muted-foreground px-6 py-6 text-sm">
-              No connections yet. A connection holds credentials for a server-based source (e.g.
-              Sonarr/Radarr). Add one if your source needs to reach a server.
-            </p>
-          ) : (
-            <Table>
-              <TableHeader>
-                <TableRow>
-                  <TableHead>Name</TableHead>
-                  <TableHead>Kind</TableHead>
-                  <TableHead>Source</TableHead>
-                  <TableHead>URL</TableHead>
-                  <TableHead className="w-0" />
+      <FieldGroup
+        label="Connections"
+        description="Credentials for sources that reach a server, such as Sonarr or Radarr. Webhook sources need none."
+        actions={
+          <Button variant="outline" size="sm" onClick={openAddDialog}>
+            <Plus />
+            Add connection
+          </Button>
+        }
+      >
+        {connections.isLoading ? (
+          <p className="text-muted-foreground py-3.5 text-sm">Loading…</p>
+        ) : list.length === 0 ? (
+          <p className="text-muted-foreground py-3.5 text-sm">No connections yet.</p>
+        ) : (
+          <Table>
+            <TableHeader>
+              <TableRow>
+                <TableHead>Name</TableHead>
+                <TableHead>Kind</TableHead>
+                <TableHead>Source</TableHead>
+                <TableHead>URL</TableHead>
+                <TableHead className="w-0" />
+              </TableRow>
+            </TableHeader>
+            <TableBody>
+              {list.map((conn) => (
+                <TableRow key={conn.id}>
+                  <TableCell className="font-medium">{conn.name}</TableCell>
+                  <TableCell>{connectionKindLabel(conn.kind)}</TableCell>
+                  <TableCell>
+                    {conn.request_integration_id ? (
+                      <Badge variant="secondary">Reused from Requests</Badge>
+                    ) : (
+                      <Badge variant="outline">Own</Badge>
+                    )}
+                  </TableCell>
+                  <TableCell className="text-muted-foreground max-w-[240px] truncate">
+                    {conn.base_url ?? "—"}
+                  </TableCell>
+                  <TableCell>
+                    <div className="flex items-center gap-1">
+                      <Button
+                        variant="ghost"
+                        size="icon-sm"
+                        aria-label="Edit connection"
+                        onClick={() => openEditDialog(conn)}
+                      >
+                        <Pencil />
+                      </Button>
+                      <Button
+                        variant="ghost"
+                        size="icon-sm"
+                        aria-label="Delete connection"
+                        onClick={() => setDeleteTarget(conn)}
+                      >
+                        <Trash2 className="text-destructive" />
+                      </Button>
+                    </div>
+                  </TableCell>
                 </TableRow>
-              </TableHeader>
-              <TableBody>
-                {list.map((conn) => (
-                  <TableRow key={conn.id}>
-                    <TableCell className="font-medium">{conn.name}</TableCell>
-                    <TableCell>{connectionKindLabel(conn.kind)}</TableCell>
-                    <TableCell>
-                      {conn.request_integration_id ? (
-                        <Badge variant="secondary">Reused from Requests</Badge>
-                      ) : (
-                        <Badge variant="outline">Own</Badge>
-                      )}
-                    </TableCell>
-                    <TableCell className="text-muted-foreground max-w-[240px] truncate">
-                      {conn.base_url ?? "—"}
-                    </TableCell>
-                    <TableCell>
-                      <div className="flex items-center gap-1">
-                        <Button
-                          variant="ghost"
-                          size="icon-sm"
-                          aria-label="Edit connection"
-                          onClick={() => openEditDialog(conn)}
-                        >
-                          <Pencil />
-                        </Button>
-                        <Button
-                          variant="ghost"
-                          size="icon-sm"
-                          aria-label="Delete connection"
-                          onClick={() => setDeleteTarget(conn)}
-                        >
-                          <Trash2 className="text-destructive" />
-                        </Button>
-                      </div>
-                    </TableCell>
-                  </TableRow>
-                ))}
-              </TableBody>
-            </Table>
-          )}
-        </CardContent>
-      </Card>
+              ))}
+            </TableBody>
+          </Table>
+        )}
+      </FieldGroup>
 
       {/* Add / Edit Dialog */}
       <Dialog open={dialog.open} onOpenChange={(open) => !open && closeDialog()}>
diff --git a/web/src/pages/audiobooks/components/RelatedRail.tsx b/web/src/pages/audiobooks/components/RelatedRail.tsx
index a231622d26..9d387d09ae 100644
--- a/web/src/pages/audiobooks/components/RelatedRail.tsx
+++ b/web/src/pages/audiobooks/components/RelatedRail.tsx
@@ -34,7 +34,7 @@ export function RelatedRail({
         <h2 className="text-xl font-semibold tracking-tight">{heading}</h2>
         {subtitle && <p className="text-muted-foreground mt-1 text-xs">{subtitle}</p>}
       </div>
-      <div className="-mx-2 -mt-1 flex scrollbar-none gap-3 overflow-x-auto px-2 pt-1 pb-2 [&::-webkit-scrollbar]:hidden">
+      <div className="scrollbar-none -mx-2 -mt-1 flex gap-3 overflow-x-auto px-2 pt-1 pb-2 [&::-webkit-scrollbar]:hidden">
         {items.map((item) => (
           <ViewTransitionLink
             key={item.content_id}
diff --git a/web/src/pages/audiobooks/player/useAudiobookPlayback.test.ts b/web/src/pages/audiobooks/player/useAudiobookPlayback.test.ts
index 9f3b636df1..0374fbc370 100644
--- a/web/src/pages/audiobooks/player/useAudiobookPlayback.test.ts
+++ b/web/src/pages/audiobooks/player/useAudiobookPlayback.test.ts
@@ -837,6 +837,44 @@ describe("useAudiobookPlayback", () => {
     expect(onStopRequested).toHaveBeenCalled();
   });
 
+  it("rejects a realtime resume the audio element refuses to play", async () => {
+    const { result } = renderAudiobookPlayback();
+    const audio = makeAudio();
+    audio.play = vi.fn().mockRejectedValue(new Error("NotAllowedError"));
+    act(() => {
+      (result.current.audioRef as MutableRefObject<HTMLAudioElement>).current = audio;
+    });
+
+    await flushAsyncWork();
+
+    await act(async () => {
+      await expect(realtimeOptions.current?.onCommand(realtimeCommand("unpause"))).rejects.toThrow(
+        "NotAllowedError",
+      );
+    });
+  });
+
+  it("reports the player paused when a deferred play is refused", async () => {
+    const { result } = renderAudiobookPlayback({ autoPlay: true });
+    const audio = makeAudio();
+    audio.play = vi.fn().mockRejectedValue(new Error("NotAllowedError"));
+    act(() => {
+      (result.current.audioRef as MutableRefObject<HTMLAudioElement>).current = audio;
+    });
+    await flushAsyncWork();
+    vi.mocked(fetch).mockClear();
+
+    act(() => audio.dispatchEvent(new Event("loadedmetadata")));
+    await flushAsyncWork();
+
+    expect(audio.play).toHaveBeenCalled();
+    const progressCalls = vi
+      .mocked(fetch)
+      .mock.calls.filter(([url]) => String(url).includes("/progress"));
+    expect(progressCalls).toHaveLength(1);
+    expect(JSON.parse(String(progressCalls[0]?.[1]?.body))).toMatchObject({ is_paused: true });
+  });
+
   it("seekTo clamps to [0, duration]", () => {
     const { result } = renderAudiobookPlayback();
     const audio = makeAudio();
diff --git a/web/src/pages/audiobooks/player/useAudiobookPlayback.ts b/web/src/pages/audiobooks/player/useAudiobookPlayback.ts
index c280c02569..cf0bdaf72b 100644
--- a/web/src/pages/audiobooks/player/useAudiobookPlayback.ts
+++ b/web/src/pages/audiobooks/player/useAudiobookPlayback.ts
@@ -8,7 +8,6 @@ import {
   buildClientCapabilitiesV3,
   buildClientPlaybackContextV3,
   detectBandwidthEstimateKbpsV3,
-  detectMeteredV3,
 } from "@/player/client-context-v3";
 import { usePlayerConfig } from "@/player/context/PlayerConfigContext";
 import { replanV2 } from "@/player/lifecycle-v2";
@@ -420,7 +419,6 @@ export function useAudiobookPlayback({
             qualityPreference: QUALITY_ORIGINAL_V3,
             attemptedPlanKeys,
             attemptCount,
-            metered: detectMeteredV3(),
             bandwidthEstimateKbps: detectBandwidthEstimateKbpsV3(),
             clientCapabilities,
             clientPlaybackContext,
@@ -610,7 +608,6 @@ export function useAudiobookPlayback({
           // "resume wherever the server last saw us".
           forceStartPosition: true,
           progressPersistence: "client",
-          metered: detectMeteredV3(),
           bandwidthEstimateKbps: detectBandwidthEstimateKbpsV3() ?? null,
           clientCapabilities,
           clientPlaybackContext,
@@ -718,6 +715,9 @@ export function useAudiobookPlayback({
       if (shouldPlay) {
         audio.play().catch((err) => {
           console.warn("audiobook autoplay blocked", err);
+          // A remote resume across a part boundary was already reported as
+          // completed; tell the server the player stayed paused.
+          reportSessionRef.current(absoluteFromAudio(), true);
         });
       }
     };
@@ -871,15 +871,20 @@ export function useAudiobookPlayback({
     [activeFileIndex, duration, parts, playing],
   );
 
-  const resumePlayback = useCallback(() => {
+  // Resolves once the element plays, or once a source switch that will play
+  // is queued; rejects when the element refuses to play, so a remote resume
+  // is reported as rejected instead of completed. A queued switch does not
+  // wait for its source to load, which can outlast the command deadline;
+  // if that later play is refused, the player reports itself paused.
+  const resumePlayback = useCallback((): Promise<void> => {
     const audio = audioRef.current;
-    if (!audio) return;
+    if (!audio) return Promise.resolve();
     if (endedRef.current) {
       // The finished book's session is stopped and its stream revoked. Play
       // starts a new attempt from the beginning, as the element itself would.
       seekTo(0);
       playAfterSourceSwitchRef.current = true;
-      return;
+      return Promise.resolve();
     }
     const pausedAtMs = pausedAtRef.current;
     pausedAtRef.current = null;
@@ -893,18 +898,18 @@ export function useAudiobookPlayback({
           // The rewind crossed a file boundary; playback resumes once the new
           // source is ready instead of racing the source switch.
           playAfterSourceSwitchRef.current = true;
-          return;
+          return Promise.resolve();
         }
       }
     }
-    audio.play().catch((err) => console.error("audiobook play failed", err));
+    return audio.play();
   }, [activeFileIndex, duration, parts, seekTo, smartRewindEnabled]);
 
   const togglePlay = useCallback(() => {
     const audio = audioRef.current;
     if (!audio) return;
     if (audio.paused) {
-      resumePlayback();
+      resumePlayback().catch((err) => console.error("audiobook play failed", err));
     } else {
       audio.pause();
     }
@@ -954,12 +959,12 @@ export function useAudiobookPlayback({
           return;
         case "unpause":
           if (!audio) return;
-          resumePlayback();
+          await resumePlayback();
           return;
         case "play_pause":
           if (!audio) return;
           if (audio.paused) {
-            resumePlayback();
+            await resumePlayback();
           } else {
             audio.pause();
           }
diff --git a/web/src/pages/autoscanSearchParams.test.ts b/web/src/pages/autoscanSearchParams.test.ts
index bea2c3ea14..25c2beee79 100644
--- a/web/src/pages/autoscanSearchParams.test.ts
+++ b/web/src/pages/autoscanSearchParams.test.ts
@@ -2,73 +2,55 @@
 
 import { describe, expect, it } from "vitest";
 
-import {
-  buildLegacyAutoscanRedirectTarget,
-  isLegacyAdvancedTab,
-  normalizeTab,
-} from "./autoscanSearchParams";
+import { legacyAutoscanPageTarget, legacyLibrariesAutoscanTarget } from "./autoscanSearchParams";
 
-describe("buildLegacyAutoscanRedirectTarget", () => {
-  it("lands a bare link on the Autoscan tab", () => {
-    expect(buildLegacyAutoscanRedirectTarget("")).toBe("/admin/libraries?tab=autoscan");
+describe("legacyAutoscanPageTarget", () => {
+  it("leaves the Sources page alone when there is no old tab", () => {
+    expect(legacyAutoscanPageTarget("")).toBeNull();
+    expect(legacyAutoscanPageTarget("?source=42")).toBeNull();
   });
 
-  it("translates the legacy tab into the embedded page's view parameter", () => {
-    // `tab` names the Libraries tab now, so the panel's own selection has to
-    // move to `view` or the link silently lands on Sources.
-    expect(buildLegacyAutoscanRedirectTarget("?tab=activity")).toBe(
-      "/admin/libraries?tab=autoscan&view=activity",
+  it("sends the old Activity tab to its page, carrying other parameters", () => {
+    expect(legacyAutoscanPageTarget("?tab=activity")).toBe("/admin/autoscan/activity");
+    expect(legacyAutoscanPageTarget("?tab=activity&source=42")).toBe(
+      "/admin/autoscan/activity?source=42",
     );
   });
 
-  it("carries the retired connections and settings tabs through", () => {
-    // AdminAutoscan opens its Advanced section for these, but only if the value
-    // reaches it.
-    expect(buildLegacyAutoscanRedirectTarget("?tab=connections")).toBe(
-      "/admin/libraries?tab=autoscan&view=connections",
-    );
-    expect(buildLegacyAutoscanRedirectTarget("?tab=settings")).toBe(
-      "/admin/libraries?tab=autoscan&view=settings",
-    );
+  it("sends the old Connections and Settings tabs to the Settings page", () => {
+    expect(legacyAutoscanPageTarget("?tab=connections")).toBe("/admin/settings/autoscan");
+    expect(legacyAutoscanPageTarget("?tab=settings&source=42")).toBe("/admin/settings/autoscan");
   });
 
-  it("leaves the default view implicit", () => {
-    // An absent `view` already means Sources, and the panel deletes the param
-    // when Sources is selected.
-    expect(buildLegacyAutoscanRedirectTarget("?tab=sources")).toBe("/admin/libraries?tab=autoscan");
-  });
-
-  it("drops a tab value nothing answers to", () => {
-    expect(buildLegacyAutoscanRedirectTarget("?tab=nonsense")).toBe(
-      "/admin/libraries?tab=autoscan",
+  it("reads an old view parameter when there is no tab", () => {
+    expect(legacyAutoscanPageTarget("?view=activity&source=42")).toBe(
+      "/admin/autoscan/activity?source=42",
     );
-  });
-
-  it("keeps unrelated query parameters", () => {
-    expect(buildLegacyAutoscanRedirectTarget("?tab=activity&source=42")).toBe(
-      "/admin/libraries?tab=autoscan&view=activity&source=42",
+    expect(legacyAutoscanPageTarget("?view=connections")).toBe("/admin/settings/autoscan");
+    expect(legacyAutoscanPageTarget("?tab=activity&view=settings")).toBe(
+      "/admin/autoscan/activity",
     );
   });
 
-  it("emits one view even when the old link already used that name", () => {
-    expect(buildLegacyAutoscanRedirectTarget("?view=activity")).toBe(
-      "/admin/libraries?tab=autoscan&view=activity",
-    );
+  it("lands an explicit or unknown tab on Sources without the tab", () => {
+    expect(legacyAutoscanPageTarget("?tab=sources")).toBe("/admin/autoscan");
+    expect(legacyAutoscanPageTarget("?tab=nonsense&source=42")).toBe("/admin/autoscan?source=42");
   });
 });
 
-describe("autoscan tab helpers", () => {
-  it("falls back to Sources for anything it does not serve", () => {
-    expect(normalizeTab("activity")).toBe("activity");
-    expect(normalizeTab("sources")).toBe("sources");
-    expect(normalizeTab("connections")).toBe("sources");
-    expect(normalizeTab(null)).toBe("sources");
+describe("legacyLibrariesAutoscanTarget", () => {
+  it("ignores Libraries URLs that do not name the Autoscan tab", () => {
+    expect(legacyLibrariesAutoscanTarget("")).toBeNull();
+    expect(legacyLibrariesAutoscanTarget("?tab=libraries")).toBeNull();
   });
 
-  it("recognises only the two retired tabs as Advanced deep links", () => {
-    expect(isLegacyAdvancedTab("connections")).toBe(true);
-    expect(isLegacyAdvancedTab("settings")).toBe(true);
-    expect(isLegacyAdvancedTab("activity")).toBe(false);
-    expect(isLegacyAdvancedTab(null)).toBe(false);
+  it("maps the old tab and its view to the Autoscan pages", () => {
+    expect(legacyLibrariesAutoscanTarget("?tab=autoscan")).toBe("/admin/autoscan");
+    expect(legacyLibrariesAutoscanTarget("?tab=autoscan&view=activity&source=42")).toBe(
+      "/admin/autoscan/activity?source=42",
+    );
+    expect(legacyLibrariesAutoscanTarget("?tab=autoscan&view=connections")).toBe(
+      "/admin/settings/autoscan",
+    );
   });
 });
diff --git a/web/src/pages/autoscanSearchParams.ts b/web/src/pages/autoscanSearchParams.ts
index 1416cb1a5d..56926c2566 100644
--- a/web/src/pages/autoscanSearchParams.ts
+++ b/web/src/pages/autoscanSearchParams.ts
@@ -1,55 +1,59 @@
 /**
- * The autoscan panel's URL contract, in one place so the page and the legacy
- * `/admin/autoscan` redirect cannot drift apart about which values mean what.
+ * Where Autoscan's pages live, and where links from its earlier layouts land,
+ * in one place so the pages and the redirects cannot drift apart.
+ *
+ * Autoscan is its own sidebar topic: Activity, Sources, and Settings are
+ * separate pages. Before that it was a tab on Libraries
+ * (`/admin/libraries?tab=autoscan&view=…`), and before that one page with
+ * `?tab=` selecting Sources, Activity, Connections, or Settings.
  */
 
-export const AUTOSCAN_TABS = ["sources", "activity"] as const;
-export type AutoscanTab = (typeof AUTOSCAN_TABS)[number];
+export const AUTOSCAN_SOURCES_HREF = "/admin/autoscan";
+export const AUTOSCAN_ACTIVITY_HREF = "/admin/autoscan/activity";
+export const AUTOSCAN_SETTINGS_HREF = "/admin/settings/autoscan";
 
-/**
- * Connections and settings used to be peer tabs, which read as "set these up
- * first" — most operators never needed either. They now live in an Advanced
- * section on the Sources view, so their old deep links land on Sources with
- * that section already open rather than 404-ing into a missing tab.
- */
-const LEGACY_ADVANCED_TABS = new Set(["connections", "settings"]);
+/** Old view names that now live on the Settings page. */
+const SETTINGS_VIEWS = new Set(["connections", "settings"]);
 
-export function normalizeTab(value: string | null): AutoscanTab {
-  return AUTOSCAN_TABS.includes(value as AutoscanTab) ? (value as AutoscanTab) : "sources";
+function pageForView(view: string | null): string {
+  if (view === "activity") return AUTOSCAN_ACTIVITY_HREF;
+  if (view !== null && SETTINGS_VIEWS.has(view)) return AUTOSCAN_SETTINGS_HREF;
+  return AUTOSCAN_SOURCES_HREF;
 }
 
-export function isLegacyAdvancedTab(value: string | null): boolean {
-  return value !== null && LEGACY_ADVANCED_TABS.has(value);
+/**
+ * Builds the page URL for an old view, carrying any other query parameters.
+ * The Settings page takes none, so they are dropped there.
+ */
+function target(view: string | null, rest: URLSearchParams): string {
+  const page = pageForView(view);
+  const query = page === AUTOSCAN_SETTINGS_HREF ? "" : rest.toString();
+  return query ? `${page}?${query}` : page;
 }
 
-/** Every value the panel still reacts to, current or legacy. */
-function isKnownAutoscanView(value: string): boolean {
-  return AUTOSCAN_TABS.includes(value as AutoscanTab) || LEGACY_ADVANCED_TABS.has(value);
+/**
+ * Where `/admin/autoscan?tab=…` (or `?view=…`, which the one-page layout also
+ * accepted) belongs now, or null when the URL names neither and is already
+ * the Sources page.
+ */
+export function legacyAutoscanPageTarget(search: string): string | null {
+  const params = new URLSearchParams(search);
+  const view = params.get("tab") ?? params.get("view");
+  if (view === null) return null;
+  params.delete("tab");
+  params.delete("view");
+  return target(view, params);
 }
 
 /**
- * Where `/admin/autoscan` sends an old link. Autoscan is a tab on Libraries
- * now, so `tab` names that tab and the panel's own Sources/Activity selection
- * moves to `view`. A bookmarked `?tab=activity` therefore has to be translated
- * rather than dropped, or every old deep link silently lands on Sources.
- *
- * "sources" stays implicit — it is what an absent `view` already means, and the
- * panel drops the param when you select it.
+ * Where `/admin/libraries?tab=autoscan&view=…` belongs now, or null when the
+ * Libraries URL does not name the old Autoscan tab.
  */
-export function buildLegacyAutoscanRedirectTarget(search: string): string {
-  const legacy = new URLSearchParams(search);
-  const legacyView = legacy.get("tab") ?? legacy.get("view");
-  legacy.delete("tab");
-  legacy.delete("view");
-
-  const target = new URLSearchParams({ tab: "autoscan" });
-  if (legacyView && legacyView !== "sources" && isKnownAutoscanView(legacyView)) {
-    target.set("view", legacyView);
-  }
-  // Anything else on the old URL is none of this redirect's business; carry it.
-  for (const [key, value] of legacy) {
-    target.append(key, value);
-  }
-
-  return `/admin/libraries?${target.toString()}`;
+export function legacyLibrariesAutoscanTarget(search: string): string | null {
+  const params = new URLSearchParams(search);
+  if (params.get("tab") !== "autoscan") return null;
+  const view = params.get("view");
+  params.delete("tab");
+  params.delete("view");
+  return target(view, params);
 }
diff --git a/web/src/pages/sectionDedupe.test.ts b/web/src/pages/sectionDedupe.test.ts
new file mode 100644
index 0000000000..edf9ceed2c
--- /dev/null
+++ b/web/src/pages/sectionDedupe.test.ts
@@ -0,0 +1,125 @@
+import { describe, expect, it } from "vitest";
+
+import type { ResolvedSection, ResolvedSectionLayout } from "@/api/types";
+import { dropCrossSectionDuplicates } from "./sectionDedupe";
+
+const AVOID = new Set(["recommended_for_you", "taste_match", "similar_users_liked"]);
+
+function layoutEntry(id: string, sectionType: string): ResolvedSectionLayout {
+  return {
+    id,
+    section_type: sectionType,
+    title: id,
+    featured: false,
+    item_limit: 20,
+    is_custom: false,
+    customized: false,
+  };
+}
+
+function section(entry: ResolvedSectionLayout, contentIDs: string[]): ResolvedSection {
+  return {
+    ...entry,
+    total_count: contentIDs.length,
+    items: contentIDs.map((contentID) => ({
+      content_id: contentID,
+      type: "movie",
+      title: contentID,
+    })) as ResolvedSection["items"],
+  };
+}
+
+function itemIDs(sections: Map<string, ResolvedSection>): Record<string, string[]> {
+  return Object.fromEntries(
+    Array.from(sections, ([id, s]) => [id, s.items.map((item) => item.content_id)]),
+  );
+}
+
+const layout = [
+  layoutEntry("featured", "recently_added"),
+  layoutEntry("for-you", "recommended_for_you"),
+  layoutEntry("top-picks", "taste_match"),
+  layoutEntry("recent", "recently_added"),
+  layoutEntry("fans", "similar_users_liked"),
+];
+
+const served: Record<string, string[]> = {
+  featured: ["a"],
+  "for-you": ["a", "b", "c"],
+  "top-picks": ["b", "d"],
+  recent: ["c", "e"],
+  fans: ["d", "e", "f"],
+};
+
+function loaded(ids: string[]): Map<string, ResolvedSection> {
+  return new Map(
+    ids.map((id) => [id, section(layout.find((entry) => entry.id === id)!, served[id]!)]),
+  );
+}
+
+describe("dropCrossSectionDuplicates", () => {
+  it("drops from avoid-duplicates sections what an earlier section shows, in layout order", () => {
+    const result = dropCrossSectionDuplicates(layout, loaded(Object.keys(served)), AVOID);
+
+    expect(itemIDs(result)).toEqual({
+      featured: ["a"],
+      "for-you": ["b", "c"],
+      "top-picks": ["d"],
+      // Sections that allow duplicates keep theirs but still mark items seen.
+      recent: ["c", "e"],
+      fans: ["f"],
+    });
+    expect(result.get("fans")?.total_count).toBe(1);
+  });
+
+  it("depends only on which rows have loaded, not the order they arrived in", () => {
+    const ids = Object.keys(served);
+    const expected = itemIDs(dropCrossSectionDuplicates(layout, loaded(ids), AVOID));
+    for (const arrival of [
+      [...ids].reverse(),
+      ["recent", "fans", "featured", "top-picks", "for-you"],
+    ]) {
+      expect(itemIDs(dropCrossSectionDuplicates(layout, loaded(arrival), AVOID))).toEqual(expected);
+    }
+  });
+
+  it("lets a later row show an item until the earlier row that claims it loads", () => {
+    const before = dropCrossSectionDuplicates(layout, loaded(["top-picks", "fans"]), AVOID);
+    expect(itemIDs(before)).toEqual({ "top-picks": ["b", "d"], fans: ["e", "f"] });
+
+    const after = dropCrossSectionDuplicates(
+      layout,
+      loaded(["top-picks", "fans", "for-you"]),
+      AVOID,
+    );
+    expect(itemIDs(after)).toEqual({
+      "top-picks": ["d"],
+      fans: ["e", "f"],
+      "for-you": ["a", "b", "c"],
+    });
+  });
+
+  it("keeps unchanged sections as they are and changes nothing without avoid types", () => {
+    const input = loaded(Object.keys(served));
+    const result = dropCrossSectionDuplicates(layout, input, AVOID);
+    expect(result.get("featured")).toBe(input.get("featured"));
+    expect(result.get("recent")).toBe(input.get("recent"));
+
+    const untouched = dropCrossSectionDuplicates(layout, input, new Set());
+    for (const [id, s] of input) {
+      expect(untouched.get(id)).toBe(s);
+    }
+  });
+
+  it("keeps items without a content ID", () => {
+    const entries = [layoutEntry("one", "taste_match"), layoutEntry("two", "taste_match")];
+    const input = new Map([
+      ["one", section(entries[0]!, ["", "x"])],
+      ["two", section(entries[1]!, ["", "x", "y"])],
+    ]);
+    expect(itemIDs(dropCrossSectionDuplicates(entries, input, AVOID))).toEqual({
+      one: ["", "x"],
+      two: ["", "y"],
+    });
+  });
+});
diff --git a/web/src/pages/sectionDedupe.ts b/web/src/pages/sectionDedupe.ts
new file mode 100644
index 0000000000..7aa6caf71b
--- /dev/null
+++ b/web/src/pages/sectionDedupe.ts
@@ -0,0 +1,88 @@
+import { useMemo } from "react";
+import { useQuery } from "@tanstack/react-query";
+import type { ResolvedSection, ResolvedSectionLayout } from "@/api/types";
+import { fetchRecipeCatalog } from "@/lib/recipes";
+
+const NO_TYPES: ReadonlySet<string> = new Set();
+
+/**
+ * dropCrossSectionDuplicates applies the recipes' avoid_duplicates rule to
+ * sections that load one request at a time, as the server does for the
+ * aggregate sections endpoint. Sections are visited in layout order; each
+ * marks its items seen, and a section whose type avoids duplicates first
+ * drops the items an earlier section shows. Rows arrive out of order, so
+ * callers rerun this over every loaded section whenever one arrives: the
+ * result then depends only on what has loaded, not on arrival order.
+ * Unchanged sections keep their identity.
+ */
+export function dropCrossSectionDuplicates(
+  layout: readonly ResolvedSectionLayout[],
+  loadedSections: ReadonlyMap<string, ResolvedSection>,
+  avoidDuplicateTypes: ReadonlySet<string>,
+): Map<string, ResolvedSection> {
+  const result = new Map(loadedSections);
+  if (avoidDuplicateTypes.size === 0) return result;
+
+  const seen = new Set<string>();
+  for (const entry of layout) {
+    const section = loadedSections.get(entry.id);
+    if (!section) continue;
+
+    let visible = section;
+    if (avoidDuplicateTypes.has(section.section_type)) {
+      const kept = section.items.filter((item) => !item.content_id || !seen.has(item.content_id));
+      const dropped = section.items.length - kept.length;
+      if (dropped > 0) {
+        visible = {
+          ...section,
+          items: kept,
+          total_count: Math.max(kept.length, section.total_count - dropped),
+        };
+        result.set(entry.id, visible);
+      }
+    }
+    for (const item of visible.items) {
+      if (item.content_id) seen.add(item.content_id);
+    }
+  }
+  return result;
+}
+
+/**
+ * useDedupedSections is dropCrossSectionDuplicates over the loaded sections,
+ * rerun whenever the layout, a loaded section, or the recipe gallery changes.
+ */
+export function useDedupedSections(
+  layout: readonly ResolvedSectionLayout[],
+  loadedSections: ReadonlyMap<string, ResolvedSection>,
+): Map<string, ResolvedSection> {
+  const avoidDuplicateTypes = useAvoidDuplicateSectionTypes();
+  return useMemo(
+    () => dropCrossSectionDuplicates(layout, loadedSections, avoidDuplicateTypes),
+    [avoidDuplicateTypes, layout, loadedSections],
+  );
+}
+
+/**
+ * useAvoidDuplicateSectionTypes returns the section types whose recipe sets
+ * avoid_duplicates, from the recipe gallery (shared with the settings pages'
+ * cache entry). Until it loads, or if it fails, no section type avoids
+ * duplicates and rows show as served.
+ */
+function useAvoidDuplicateSectionTypes(): ReadonlySet<string> {
+  const { data } = useQuery({
+    queryKey: ["recipe-catalog"],
+    queryFn: fetchRecipeCatalog,
+    staleTime: 5 * 60 * 1000,
+  });
+  return useMemo(() => {
+    if (!data) return NO_TYPES;
+    const types = new Set<string>();
+    for (const recipes of Object.values(data.categories)) {
+      for (const recipe of recipes ?? []) {
+        if (recipe.avoid_duplicates) types.add(recipe.type);
+      }
+    }
+    return types;
+  }, [data]);
+}
diff --git a/web/src/pages/settings/AccessibilitySettings.tsx b/web/src/pages/settings/AccessibilitySettings.tsx
index c8ff03d6b1..c24a15c993 100644
--- a/web/src/pages/settings/AccessibilitySettings.tsx
+++ b/web/src/pages/settings/AccessibilitySettings.tsx
@@ -1,4 +1,5 @@
 import { useId } from "react";
+import { PageHeader } from "@/components/page/PageHeader";
 import { SettingsGroup } from "@/components/settings/SettingsGroup";
 import { Button } from "@/components/ui/button";
 import { useDateTimeFormat, useDateTimeFormatSettings } from "@/hooks/useDateTimeFormat";
@@ -34,7 +35,10 @@ export default function AccessibilitySettings() {
 
   return (
     <div className="space-y-6">
-      <h2 className="text-2xl font-semibold tracking-tight sm:text-3xl">Accessibility</h2>
+      <PageHeader
+        title="Accessibility"
+        subtitle="Text size, weight, contrast, and date and time formats."
+      />
 
       <SettingsGroup
         title="Readability"
@@ -138,7 +142,7 @@ export default function AccessibilitySettings() {
             This sample paragraph reflects your current text size, weight, and contrast preferences.
             Adjustments take effect across the entire interface.
           </p>
-          <p className="text-muted-foreground/70 text-xs">
+          <p className="text-muted-foreground text-xs">
             Secondary text &middot; Metadata &middot; Captions
           </p>
         </div>
diff --git a/web/src/pages/settings/AccountSettings.tsx b/web/src/pages/settings/AccountSettings.tsx
index bf02009c21..115e64914f 100644
--- a/web/src/pages/settings/AccountSettings.tsx
+++ b/web/src/pages/settings/AccountSettings.tsx
@@ -1,6 +1,7 @@
 import { useState, type FormEvent } from "react";
 import { toast } from "sonner";
 
+import { PageHeader } from "@/components/page/PageHeader";
 import { SettingsGroup } from "@/components/settings/SettingsGroup";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
@@ -59,12 +60,10 @@ export default function AccountSettings() {
 
   return (
     <div className="space-y-6">
-      <div className="space-y-2">
-        <h2 className="text-2xl font-semibold tracking-tight sm:text-3xl">Account</h2>
-        <p className="text-muted-foreground max-w-2xl text-sm leading-relaxed">
-          Manage the sign-in credential shared by every profile on this account.
-        </p>
-      </div>
+      <PageHeader
+        title="Account"
+        subtitle="Manage the sign-in credential shared by every profile on this account."
+      />
 
       <SettingsGroup
         title="Password"
diff --git a/web/src/pages/settings/CardOverlaySettings.test.tsx b/web/src/pages/settings/CardOverlaySettings.test.tsx
index cc18340b2a..359b83e3a4 100644
--- a/web/src/pages/settings/CardOverlaySettings.test.tsx
+++ b/web/src/pages/settings/CardOverlaySettings.test.tsx
@@ -1,8 +1,9 @@
-import type { ReactNode } from "react";
-import { renderToStaticMarkup } from "react-dom/server";
-import { beforeEach, describe, expect, it, vi } from "vitest";
+// @vitest-environment jsdom
 
-import CardOverlaySettings from "./CardOverlaySettings";
+import { cleanup, fireEvent, render, screen, waitFor, within } from "@testing-library/react";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { CardOverlaySettings } from "./CardOverlaySettings";
 
 vi.mock("@/hooks/queries/ratingsCapability", () => ({
   useShownRatingSources: () => new Set(["imdb", "tmdb"]),
@@ -10,75 +11,139 @@ vi.mock("@/hooks/queries/ratingsCapability", () => ({
 
 const mocks = vi.hoisted(() => ({
   overlaysEnabled: true,
+  quickActionsEnabled: false,
+  hasBadgeOverride: false,
+  hasQuickActionOverride: false,
+  resetPrefs: vi.fn(),
+  setPrefs: vi.fn(),
   setOverlaysEnabled: vi.fn(),
   setQuickActionsEnabled: vi.fn(),
+  setQuickActionMode: vi.fn(),
 }));
 
 vi.mock("@/hooks/useOverlayPrefs", () => ({
   useOverlayPrefs: () => ({
     prefs: null,
-    setPrefs: vi.fn(),
+    setPrefs: mocks.setPrefs,
     quickActionPreference: "favorites",
-    setQuickActionMode: vi.fn(),
-    quickActionsEnabled: false,
+    setQuickActionMode: mocks.setQuickActionMode,
+    quickActionsEnabled: mocks.quickActionsEnabled,
     setQuickActionsEnabled: mocks.setQuickActionsEnabled,
     overlaysEnabled: mocks.overlaysEnabled,
     setOverlaysEnabled: mocks.setOverlaysEnabled,
+    resetPrefs: mocks.resetPrefs,
+    hasBadgeOverride: mocks.hasBadgeOverride,
+    hasQuickActionOverride: mocks.hasQuickActionOverride,
+    isResetting: false,
     isOverlaySupported: () => true,
     isLoading: false,
   }),
 }));
 
-vi.mock("@/components/overlays/OverlayPreviewCard", () => ({
-  OverlayPreviewCard: () => <div>Overlay preview</div>,
-}));
-
-vi.mock("@/components/ui/select", () => ({
-  Select: ({ children }: { children: ReactNode }) => <div>{children}</div>,
-  SelectContent: ({ children }: { children: ReactNode }) => <div>{children}</div>,
-  SelectItem: ({ children, value }: { children: ReactNode; value: string }) => (
-    <div data-value={value}>{children}</div>
-  ),
-  SelectTrigger: ({ children }: { children: ReactNode }) => <div>{children}</div>,
-  SelectValue: () => null,
-}));
-
-function switchMarkup(markup: string, label: string) {
-  return markup.match(new RegExp(`<button[^>]*aria-label="${label}"[^>]*>`))?.[0];
-}
+vi.mock("sonner", () => ({ toast: { success: vi.fn(), error: vi.fn() } }));
 
 describe("CardOverlaySettings", () => {
   beforeEach(() => {
     mocks.overlaysEnabled = true;
-    mocks.setOverlaysEnabled.mockReset();
-    mocks.setQuickActionsEnabled.mockReset();
+    mocks.quickActionsEnabled = false;
+    mocks.hasBadgeOverride = false;
+    mocks.hasQuickActionOverride = false;
+    mocks.resetPrefs.mockReset().mockResolvedValue(undefined);
+    for (const fn of [
+      mocks.setPrefs,
+      mocks.setOverlaysEnabled,
+      mocks.setQuickActionsEnabled,
+      mocks.setQuickActionMode,
+    ]) {
+      fn.mockReset();
+    }
   });
 
-  it("keeps the profile quick-action switch operable when the server default is off", () => {
-    const markup = renderToStaticMarkup(<CardOverlaySettings />);
+  afterEach(cleanup);
+
+  it("turns shortcuts on and picks their kind with one choice", () => {
+    const picked = vi.fn();
+    render(<CardOverlaySettings onShortcutsPicked={picked} />);
+    const shortcuts = screen.getByRole("radiogroup", { name: "Shortcut buttons" });
 
-    expect(markup).not.toContain("Card quick actions have been disabled by your server");
-    const quickActionsSwitch = switchMarkup(markup, "Enable card quick actions");
-    expect(quickActionsSwitch).toBeDefined();
-    // Tailwind `disabled:` variants live in the class list, so match the
-    // rendered attribute rather than the bare word.
-    expect(quickActionsSwitch).not.toContain('disabled=""');
-    expect(quickActionsSwitch).not.toContain("data-disabled");
+    // Off on the profile even though the server default may be on: still operable.
+    expect(within(shortcuts).getByRole("radio", { name: "Off" })).toHaveAttribute(
+      "aria-checked",
+      "true",
+    );
+    fireEvent.click(within(shortcuts).getByRole("radio", { name: "Watched" }));
+
+    expect(mocks.setQuickActionsEnabled).toHaveBeenCalledWith(true);
+    expect(mocks.setQuickActionMode).toHaveBeenCalledWith("watched");
+    expect(picked).toHaveBeenCalled();
+  });
+
+  it("turns shortcuts off without changing their kind", () => {
+    mocks.quickActionsEnabled = true;
+    render(<CardOverlaySettings />);
+
+    fireEvent.click(screen.getByRole("radio", { name: "Off" }));
+
+    expect(mocks.setQuickActionsEnabled).toHaveBeenCalledWith(false);
+    expect(mocks.setQuickActionMode).not.toHaveBeenCalled();
   });
 
-  it("dims the badge configuration but keeps its switch operable when overlays are off", () => {
+  it("hides the badge list while badges are off but keeps their switch", () => {
     mocks.overlaysEnabled = false;
-    const markup = renderToStaticMarkup(<CardOverlaySettings />);
-
-    expect(markup).not.toContain("Card overlays have been disabled by your server");
-    expect(markup).toContain("pointer-events-none opacity-50");
-    const overlaysSwitch = switchMarkup(markup, "Enable card overlay badges");
-    expect(overlaysSwitch).toBeDefined();
-    expect(overlaysSwitch).not.toContain('disabled=""');
-    expect(overlaysSwitch).not.toContain("data-disabled");
-    // The switch sits outside the dimmed region.
-    expect(markup.indexOf('aria-label="Enable card overlay badges"')).toBeLessThan(
-      markup.indexOf("pointer-events-none opacity-50"),
+    render(<CardOverlaySettings />);
+
+    expect(screen.queryByRole("radiogroup", { name: "Badge style" })).not.toBeInTheDocument();
+    expect(screen.queryByText("IMDb Rating")).not.toBeInTheDocument();
+    const toggle = screen.getByRole("switch", { name: "Show badges on posters" });
+    expect(toggle).toBeEnabled();
+    fireEvent.click(toggle);
+    expect(mocks.setOverlaysEnabled).toHaveBeenCalledWith(true);
+  });
+
+  it("folds badges by category and switches one inside", () => {
+    render(<CardOverlaySettings />);
+
+    expect(screen.queryByRole("switch", { name: "IMDb Rating" })).toBeNull();
+    fireEvent.click(screen.getByRole("button", { name: /Ratings & Certifications/ }));
+    const imdb = screen.getByRole("switch", { name: "IMDb Rating" });
+    const wasOn = imdb.getAttribute("aria-checked") === "true";
+    expect(screen.queryByRole("button", { name: "Adjust IMDb Rating" }) !== null).toBe(wasOn);
+
+    fireEvent.click(imdb);
+
+    expect(mocks.setPrefs).toHaveBeenCalledWith(
+      expect.objectContaining({
+        items: expect.objectContaining({
+          rating_imdb: expect.objectContaining({ enabled: !wasOn }),
+        }),
+      }),
     );
   });
+
+  it("resets shortcuts on their own once they differ from the server's", () => {
+    const { rerender } = render(<CardOverlaySettings />);
+    expect(screen.queryByRole("button", { name: "Reset shortcuts" })).toBeNull();
+
+    mocks.hasQuickActionOverride = true;
+    rerender(<CardOverlaySettings />);
+    fireEvent.click(screen.getByRole("button", { name: "Reset shortcuts" }));
+
+    expect(mocks.resetPrefs).toHaveBeenCalledWith("quickActions");
+    // Badges are a separate choice and keep their own Reset.
+    expect(screen.queryByRole("button", { name: "Reset badges" })).toBeNull();
+  });
+
+  it("asks before resetting badges, then resets only badges", async () => {
+    mocks.hasBadgeOverride = true;
+    render(<CardOverlaySettings />);
+    expect(screen.queryByRole("button", { name: "Use server defaults" })).toBeNull();
+
+    fireEvent.click(screen.getByRole("button", { name: "Reset badges" }));
+    expect(mocks.resetPrefs).not.toHaveBeenCalled();
+    const dialog = await screen.findByRole("alertdialog");
+    fireEvent.click(within(dialog).getByRole("button", { name: "Reset badges" }));
+
+    await waitFor(() => expect(mocks.resetPrefs).toHaveBeenCalledWith("badges"));
+    expect(mocks.resetPrefs).toHaveBeenCalledTimes(1);
+  });
 });
diff --git a/web/src/pages/settings/CardOverlaySettings.tsx b/web/src/pages/settings/CardOverlaySettings.tsx
index 26b358be1c..91989cf839 100644
--- a/web/src/pages/settings/CardOverlaySettings.tsx
+++ b/web/src/pages/settings/CardOverlaySettings.tsx
@@ -1,251 +1,248 @@
-import { useId, useState, type ReactNode } from "react";
-import { Check, ImageIcon, ImageOff, RotateCcw, X } from "lucide-react";
+import { useId, useState } from "react";
+import { Check, SlidersHorizontal } from "lucide-react";
 import { toast } from "sonner";
 
 import { ConfirmDialog } from "@/components/ConfirmDialog";
 import { SettingsGroup } from "@/components/settings/SettingsGroup";
+import { SettingsSubheading } from "@/components/settings/SettingsSubheading";
 import {
-  OverlayPreviewCard,
-  type OverlayPreviewVariant,
-} from "@/components/overlays/OverlayPreviewCard";
-import { OverlayPreviewVariantToggle } from "@/components/overlays/OverlayPreviewVariantToggle";
+  Accordion,
+  AccordionContent,
+  AccordionItem,
+  AccordionTrigger,
+} from "@/components/ui/accordion";
+import { Button } from "@/components/ui/button";
+import { Label } from "@/components/ui/label";
+import { Popover, PopoverContent, PopoverTrigger } from "@/components/ui/popover";
+import { Switch } from "@/components/ui/switch";
 import { useOverlayPrefs } from "@/hooks/useOverlayPrefs";
 import { useShownRatingSources } from "@/hooks/queries/ratingsCapability";
+import type { EnabledCardQuickActionMode } from "@/lib/cardQuickActions";
 import {
   ACCENT_PALETTE,
   buildDefaultPrefs,
   CATEGORY_GROUPS,
   getOverlayDef,
-  isOverlaySuppressed,
-  OVERLAY_PREVIEW_VARIANTS,
-  OVERLAY_REGISTRY,
+  getPreset,
   isOverlayOffered,
+  isOverlaySuppressed,
   OVERLAY_PRESETS,
+  OVERLAY_REGISTRY,
   POSITION_OPTIONS,
   PRESET_IDS,
-  getPreset,
   type CardOverlayPrefs,
   type OverlayId,
+  type OverlayItemConfig,
   type OverlayPosition,
   type PresetId,
 } from "@/lib/overlays";
-import { Label } from "@/components/ui/label";
-import { Switch } from "@/components/ui/switch";
-import {
-  Select,
-  SelectContent,
-  SelectItem,
-  SelectTrigger,
-  SelectValue,
-} from "@/components/ui/select";
-import { Popover, PopoverContent, PopoverTrigger } from "@/components/ui/popover";
-import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
-import { CARD_QUICK_ACTION_OPTIONS, type EnabledCardQuickActionMode } from "@/lib/cardQuickActions";
+import { cn } from "@/lib/utils";
 
-interface SettingRowProps {
-  label: string;
-  description: string;
-  hint?: string;
-  control: (props: { id: string }) => ReactNode;
-}
+import { ChoiceButtons } from "./ChoiceButtons";
+import { ResetButton } from "./ResetButton";
 
-function SettingRow({ label, description, hint, control }: SettingRowProps) {
-  const controlId = useId();
-  return (
-    <div className="border-border/50 flex flex-col gap-3 border-t pt-4 first:border-t-0 first:pt-0 sm:flex-row sm:items-center sm:justify-between">
-      <div className="min-w-0 space-y-0.5">
-        <Label htmlFor={controlId} className="text-sm font-medium">
-          {label}
-        </Label>
-        <p className="text-muted-foreground text-[13px] leading-relaxed">{description}</p>
-        {hint && <p className="text-muted-foreground/70 text-xs italic">{hint}</p>}
-      </div>
-      <div className="w-full sm:w-auto">{control({ id: controlId })}</div>
-    </div>
-  );
-}
+type ShortcutChoice = "off" | EnabledCardQuickActionMode;
 
-interface AccentSwatchProps {
-  value: string | undefined;
-  defaultValue: string | undefined;
-  disabled?: boolean;
-  onChange: (next: string | undefined) => void;
+const SHORTCUT_CHOICES: readonly { value: ShortcutChoice; label: string }[] = [
+  { value: "off", label: "Off" },
+  { value: "watched", label: "Watched" },
+  { value: "favorites", label: "Favorite" },
+  { value: "both", label: "Both" },
+];
+
+const CORNER_CLASSES: Record<OverlayPosition, string> = {
+  "top-left": "top-1 left-1",
+  "top-right": "top-1 right-1",
+  "bottom-left": "bottom-1 left-1",
+  "bottom-right": "bottom-1 right-1",
+};
+
+interface BadgeAdjustProps {
+  overlayId: OverlayId;
+  prefs: CardOverlayPrefs;
+  shortcutsOn: boolean;
+  onChange: (next: Partial<OverlayItemConfig>) => void;
 }
 
-function AccentSwatch({ value, defaultValue, disabled, onChange }: AccentSwatchProps) {
-  const [open, setOpen] = useState(false);
-  const display = value ?? defaultValue ?? "#94a3b8";
-  const hasOverride = !!value;
+/** Where one badge sits, its color, and its icon, behind one button. */
+function BadgeAdjust({ overlayId, prefs, shortcutsOn, onChange }: BadgeAdjustProps) {
+  const def = getOverlayDef(overlayId);
+  const iconSwitchId = useId();
+  if (!def) return null;
+  const config = prefs.items[overlayId];
+  const showIcon = !!def.iconCapable && (config.showIcon ?? getPreset(prefs.preset).preferIcon);
+  const color = config.accentColor;
+
   return (
-    <Popover open={open} onOpenChange={setOpen}>
+    <Popover>
       <PopoverTrigger asChild>
-        <button
+        <Button
           type="button"
-          disabled={disabled}
-          className="border-border/60 hover:border-border focus:border-border focus-visible:ring-ring relative h-6 w-6 rounded-full border transition-colors focus:outline-none focus-visible:ring-2 disabled:cursor-not-allowed disabled:opacity-40"
-          style={{ background: display }}
-          aria-label={hasOverride ? "Change accent color" : "Set accent color"}
-          title={hasOverride ? `Accent: ${display}` : "Default accent"}
-        />
+          variant="ghost"
+          size="sm"
+          className="text-muted-foreground hover:text-foreground"
+          aria-label={`Adjust ${def.label}`}
+        >
+          <SlidersHorizontal className="h-4 w-4" aria-hidden="true" />
+          <span className="hidden sm:inline">Adjust</span>
+        </Button>
       </PopoverTrigger>
-      <PopoverContent align="end" className="w-[200px] p-3">
+      <PopoverContent align="end" className="w-72 space-y-4 p-4">
+        <p className="text-sm font-semibold">{def.label}</p>
+
+        <div className="flex items-start gap-4">
+          <div
+            role="radiogroup"
+            aria-label="Corner"
+            className="bg-muted/50 border-border/70 relative aspect-[2/3] w-20 shrink-0 rounded-md border"
+          >
+            {POSITION_OPTIONS.map((option) => {
+              const active = config.position === option.value;
+              return (
+                <button
+                  key={option.value}
+                  type="button"
+                  role="radio"
+                  aria-checked={active}
+                  aria-label={option.label}
+                  title={option.label}
+                  onClick={() => onChange({ position: option.value })}
+                  className={cn(
+                    "focus-visible:ring-ring absolute h-4 w-7 rounded-sm transition-colors focus-visible:ring-2 focus-visible:outline-none",
+                    CORNER_CLASSES[option.value],
+                    active ? "bg-primary" : "bg-foreground/15 hover:bg-foreground/30",
+                  )}
+                />
+              );
+            })}
+          </div>
+          <div className="space-y-1">
+            <p className="text-sm font-medium">Corner</p>
+            <p className="text-muted-foreground text-[13px] leading-relaxed">
+              Pick where it sits. Badges in the same corner stack.
+            </p>
+            {shortcutsOn && config.position.startsWith("bottom") ? (
+              <p className="text-muted-foreground text-[13px] leading-relaxed">
+                Shortcut buttons cover the bottom corners while they show.
+              </p>
+            ) : null}
+          </div>
+        </div>
+
         <div className="space-y-2">
-          <div className="text-xs font-medium tracking-wide uppercase">Accent color</div>
-          <div className="grid grid-cols-6 gap-1.5">
-            {ACCENT_PALETTE.map((color) => (
+          <p className="text-sm font-medium">Color</p>
+          <div className="flex flex-wrap gap-1.5" role="radiogroup" aria-label="Color">
+            <button
+              type="button"
+              role="radio"
+              aria-checked={!color}
+              onClick={() => onChange({ accentColor: undefined })}
+              className={cn(
+                "border-border text-muted-foreground hover:text-foreground focus-visible:ring-ring h-7 rounded-full border px-2.5 text-xs font-medium focus-visible:ring-2 focus-visible:outline-none",
+                !color && "border-primary text-foreground",
+              )}
+            >
+              Default
+            </button>
+            {ACCENT_PALETTE.map((swatch) => (
               <button
-                key={color.value}
+                key={swatch.value}
                 type="button"
-                onClick={() => {
-                  onChange(color.value);
-                  setOpen(false);
-                }}
-                className="border-border/40 hover:border-border focus-visible:ring-ring relative h-7 w-7 rounded-full border focus:outline-none focus-visible:ring-2"
-                style={{ background: color.value }}
-                title={color.label}
-                aria-label={color.label}
+                role="radio"
+                aria-checked={color === swatch.value}
+                aria-label={swatch.label}
+                title={swatch.label}
+                onClick={() => onChange({ accentColor: swatch.value })}
+                className="border-border/40 focus-visible:ring-ring relative h-7 w-7 rounded-full border focus-visible:ring-2 focus-visible:outline-none"
+                style={{ background: swatch.value }}
               >
-                {value === color.value && (
+                {color === swatch.value ? (
                   <Check
-                    size={12}
-                    className="absolute inset-0 m-auto"
-                    style={{
-                      color: color.value === "#ffffff" ? "black" : "white",
-                    }}
+                    aria-hidden="true"
+                    className="absolute inset-0 m-auto h-3.5 w-3.5"
+                    style={{ color: swatch.value === "#ffffff" ? "black" : "white" }}
                   />
-                )}
+                ) : null}
               </button>
             ))}
           </div>
-          <button
-            type="button"
-            onClick={() => {
-              onChange(undefined);
-              setOpen(false);
-            }}
-            className="text-muted-foreground hover:text-foreground flex w-full items-center gap-1.5 text-xs"
-          >
-            <X size={12} /> Reset to default
-          </button>
         </div>
+
+        {def.iconCapable ? (
+          <div className="flex items-center justify-between gap-3">
+            <Label htmlFor={iconSwitchId} className="text-sm font-medium">
+              Show icon
+            </Label>
+            <Switch
+              id={iconSwitchId}
+              checked={showIcon}
+              onCheckedChange={(checked) => onChange({ showIcon: checked })}
+            />
+          </div>
+        ) : null}
       </PopoverContent>
     </Popover>
   );
 }
 
-interface OverlayToggleProps {
+interface BadgeRowProps {
   overlayId: OverlayId;
   prefs: CardOverlayPrefs;
+  shortcutsOn: boolean;
   onUpdate: (next: CardOverlayPrefs) => void;
 }
 
-function OverlayToggle({ overlayId, prefs, onUpdate }: OverlayToggleProps) {
+function BadgeRow({ overlayId, prefs, shortcutsOn, onUpdate }: BadgeRowProps) {
+  const switchId = useId();
   const def = getOverlayDef(overlayId);
   if (!def) return null;
   const config = prefs.items[overlayId];
-  const preset = getPreset(prefs.preset);
-  const resolvedShowIcon = !!def.iconCapable && (config.showIcon ?? preset.preferIcon);
   const suppressed = config.enabled && isOverlaySuppressed(overlayId, prefs);
+  const hint = suppressed
+    ? "Hidden while the combined Resolution + HDR badge is on."
+    : def.availabilityNote;
+  const update = (next: Partial<OverlayItemConfig>) =>
+    onUpdate({ ...prefs, items: { ...prefs.items, [overlayId]: { ...config, ...next } } });
 
   return (
-    <SettingRow
-      label={def.label}
-      description={def.description}
-      hint={
-        suppressed
-          ? "Hidden while the combined Resolution + HDR badge is enabled."
-          : def.availabilityNote
-      }
-      control={({ id }) => (
-        <div className="flex items-center gap-2">
-          {def.iconCapable && (
-            <button
-              type="button"
-              disabled={!config.enabled}
-              onClick={() =>
-                onUpdate({
-                  ...prefs,
-                  items: {
-                    ...prefs.items,
-                    [overlayId]: { ...config, showIcon: !resolvedShowIcon },
-                  },
-                })
-              }
-              className="text-muted-foreground hover:text-foreground disabled:opacity-40"
-              title={resolvedShowIcon ? "Hide icon" : "Show icon"}
-              aria-label={resolvedShowIcon ? "Hide icon" : "Show icon"}
-            >
-              {resolvedShowIcon ? <ImageIcon size={16} /> : <ImageOff size={16} />}
-            </button>
-          )}
-          <AccentSwatch
-            value={config.accentColor}
-            defaultValue={def.defaultAccent}
-            disabled={!config.enabled}
-            onChange={(next) =>
-              onUpdate({
-                ...prefs,
-                items: {
-                  ...prefs.items,
-                  [overlayId]: { ...config, accentColor: next },
-                },
-              })
-            }
-          />
-          <Select
-            value={config.position}
-            disabled={!config.enabled}
-            onValueChange={(value) =>
-              onUpdate({
-                ...prefs,
-                items: {
-                  ...prefs.items,
-                  [overlayId]: {
-                    ...config,
-                    position: value as OverlayPosition,
-                  },
-                },
-              })
-            }
-          >
-            <SelectTrigger className="w-[140px]">
-              <SelectValue />
-            </SelectTrigger>
-            <SelectContent>
-              {POSITION_OPTIONS.map((opt) => (
-                <SelectItem key={opt.value} value={opt.value}>
-                  {opt.label}
-                </SelectItem>
-              ))}
-            </SelectContent>
-          </Select>
-          <Switch
-            id={id}
-            checked={config.enabled}
-            onCheckedChange={(checked) =>
-              onUpdate({
-                ...prefs,
-                items: {
-                  ...prefs.items,
-                  [overlayId]: { ...config, enabled: checked },
-                },
-              })
-            }
-          />
-        </div>
-      )}
-    />
+    <div className="border-border/50 flex items-center gap-3 border-t py-3 first:border-t-0">
+      <div className="min-w-0 flex-1 space-y-0.5">
+        <Label htmlFor={switchId} className="text-sm font-medium">
+          {def.label}
+        </Label>
+        <p className="text-muted-foreground text-[13px] leading-relaxed">{def.description}</p>
+        {hint ? <p className="text-muted-foreground text-[13px] italic">{hint}</p> : null}
+      </div>
+      {config.enabled ? (
+        <BadgeAdjust
+          overlayId={overlayId}
+          prefs={prefs}
+          shortcutsOn={shortcutsOn}
+          onChange={update}
+        />
+      ) : null}
+      <Switch
+        id={switchId}
+        checked={config.enabled}
+        onCheckedChange={(checked) => update({ enabled: checked })}
+      />
+    </div>
   );
 }
 
-interface PresetPickerProps {
+function BadgeStylePicker({
+  value,
+  onChange,
+}: {
   value: PresetId;
   onChange: (next: PresetId) => void;
-}
-
-function PresetPicker({ value, onChange }: PresetPickerProps) {
+}) {
   return (
-    <div className="grid grid-cols-2 gap-2 sm:grid-cols-3 lg:grid-cols-5">
+    <div
+      role="radiogroup"
+      aria-label="Badge style"
+      className="grid grid-cols-3 gap-2 sm:grid-cols-5"
+    >
       {PRESET_IDS.map((id) => {
         const preset = OVERLAY_PRESETS[id];
         const active = value === id;
@@ -253,25 +250,23 @@ function PresetPicker({ value, onChange }: PresetPickerProps) {
           <button
             key={id}
             type="button"
+            role="radio"
+            aria-checked={active}
             onClick={() => onChange(id)}
-            className={`flex flex-col items-stretch gap-2 rounded-lg border p-3 text-left transition-colors ${
-              active
-                ? "border-primary bg-primary/5"
-                : "border-border/60 hover:border-border bg-transparent"
-            }`}
+            className={cn(
+              "focus-visible:ring-ring flex flex-col items-stretch gap-2 rounded-xl border p-2 text-left transition-colors focus-visible:ring-2 focus-visible:outline-none",
+              active ? "border-primary bg-primary/8" : "border-border/60 hover:border-border",
+            )}
           >
-            <div className="flex h-12 items-center justify-center rounded-md bg-gradient-to-br from-slate-700 to-slate-900">
+            <span className="flex h-10 items-center justify-center rounded-md bg-gradient-to-br from-slate-700 to-slate-900">
               <span
                 className={preset.badgeClass}
                 style={preset.badgeStyle(preset.id === "vibrant" ? "#f5c518" : undefined)}
               >
-                Sample
+                4K
               </span>
-            </div>
-            <div>
-              <div className="text-sm font-medium">{preset.label}</div>
-              <div className="text-muted-foreground text-xs leading-snug">{preset.description}</div>
-            </div>
+            </span>
+            <span className="text-center text-xs font-medium">{preset.label}</span>
           </button>
         );
       })}
@@ -279,7 +274,12 @@ function PresetPicker({ value, onChange }: PresetPickerProps) {
   );
 }
 
-export default function CardOverlaySettings() {
+/**
+ * Shortcut buttons and badges on media cards. These preferences are
+ * profile-wide and stored apart from the web card layout, so they render even
+ * when that layout cannot be edited.
+ */
+export function CardOverlaySettings({ onShortcutsPicked }: { onShortcutsPicked?: () => void }) {
   const shownRatingSources = useShownRatingSources();
   const {
     prefs,
@@ -291,223 +291,156 @@ export default function CardOverlaySettings() {
     overlaysEnabled,
     setOverlaysEnabled,
     resetPrefs,
-    hasOverride,
+    hasBadgeOverride,
+    hasQuickActionOverride,
     isResetting,
     isLoading,
     isOverlaySupported,
   } = useOverlayPrefs();
-  const [previewVariant, setPreviewVariant] = useState<OverlayPreviewVariant>("movie");
-  // The request sample only shows a badge this server lets the profile keep.
-  const previewVariants = isOverlaySupported("request_status")
-    ? OVERLAY_PREVIEW_VARIANTS
-    : OVERLAY_PREVIEW_VARIANTS.filter((variant) => variant !== "requested");
-  const [confirmRestoreOpen, setConfirmRestoreOpen] = useState(false);
+  const [confirmBadgeResetOpen, setConfirmBadgeResetOpen] = useState(false);
+  const badgesSwitchId = useId();
 
-  const handleUpdate = (next: CardOverlayPrefs) => {
-    setPrefs(next);
-    toast.success("Setting saved");
-  };
-
-  const handleQuickActionModeChange = (next: EnabledCardQuickActionMode) => {
-    setQuickActionMode(next);
-    toast.success("Setting saved");
-  };
-
-  const handleQuickActionsEnabledChange = (next: boolean) => {
-    setQuickActionsEnabled(next);
-    toast.success("Setting saved");
-  };
-
-  const handleOverlaysEnabledChange = (next: boolean) => {
-    setOverlaysEnabled(next);
-    toast.success("Setting saved");
+  // Removing the profile's stored values is what puts it back on the server
+  // defaults for good: a copy of today's server values would freeze this
+  // profile at them and ignore every later change the admin makes.
+  const resetShortcuts = async () => {
+    try {
+      await resetPrefs("quickActions");
+    } catch {
+      toast.error("Couldn't reset shortcuts");
+    }
   };
 
-  // Removing the profile document is what puts this profile back on the
-  // server defaults for good: a copy of today's server values would freeze
-  // this profile at them and ignore every later change the admin makes.
-  const handleRestoreServerDefaults = async () => {
+  const resetBadges = async () => {
     try {
-      await resetPrefs();
-      setConfirmRestoreOpen(false);
-      toast.success("Restored the server's default badges");
+      await resetPrefs("badges");
+      setConfirmBadgeResetOpen(false);
     } catch {
-      toast.error("Failed to restore the server's default badges");
+      toast.error("Couldn't reset badges");
+    }
+  };
+
+  const pickShortcuts = (next: ShortcutChoice) => {
+    if (next === "off") {
+      setQuickActionsEnabled(false);
+      return;
     }
+    if (!quickActionsEnabled) setQuickActionsEnabled(true);
+    setQuickActionMode(next);
+    onShortcutsPicked?.();
   };
 
   if (isLoading) return null;
   const displayPrefs = prefs ?? buildDefaultPrefs();
 
   return (
-    <div className="space-y-6">
-      <div className="space-y-3">
-        <h2 className="text-2xl font-semibold tracking-tight sm:text-3xl">Card Overlays</h2>
-        <p className="text-muted-foreground max-w-2xl text-sm leading-relaxed">
-          Choose the quick actions and badges shown on media cards, where badges sit, and how they
-          look. Inspired by Kometa.
-        </p>
-      </div>
+    <>
+      <SettingsGroup
+        title="Shortcuts"
+        description="Buttons on a poster that mark it watched or add it to your favorites, without opening it."
+        actions={
+          hasQuickActionOverride ? (
+            <ResetButton
+              label="Reset shortcuts"
+              disabled={isResetting}
+              onClick={() => void resetShortcuts()}
+            />
+          ) : null
+        }
+      >
+        <ChoiceButtons
+          label="Shortcut buttons"
+          hideLabel
+          value={quickActionsEnabled ? quickActionPreference : "off"}
+          options={SHORTCUT_CHOICES}
+          onChange={pickShortcuts}
+        />
+      </SettingsGroup>
 
-      <SettingsGroup title="General" description="Override the server defaults for this profile.">
-        <SettingRow
-          label="Card quick actions"
-          description="Choose the favorite and watched shortcuts shown for this profile."
-          control={({ id }) => (
-            <div className="flex items-center gap-2">
-              <Select
-                value={quickActionPreference}
-                disabled={!quickActionsEnabled}
-                onValueChange={(value) =>
-                  handleQuickActionModeChange(value as EnabledCardQuickActionMode)
-                }
-              >
-                <SelectTrigger className="w-[190px]" aria-label="Card quick action mode">
-                  <SelectValue />
-                </SelectTrigger>
-                <SelectContent>
-                  {CARD_QUICK_ACTION_OPTIONS.map((option) => (
-                    <SelectItem key={option.value} value={option.value}>
-                      {option.label}
-                    </SelectItem>
-                  ))}
-                </SelectContent>
-              </Select>
-              <Switch
-                id={id}
-                checked={quickActionsEnabled}
-                onCheckedChange={handleQuickActionsEnabledChange}
-                aria-label="Enable card quick actions"
+      <SettingsGroup
+        title="Badges"
+        description="Small labels on posters, such as 4K, Dolby Vision, or a rating."
+        actions={
+          hasBadgeOverride ? (
+            <ResetButton
+              label="Reset badges"
+              disabled={isResetting}
+              onClick={() => setConfirmBadgeResetOpen(true)}
+            />
+          ) : null
+        }
+      >
+        <div className="flex items-center justify-between gap-3">
+          <Label htmlFor={badgesSwitchId} className="text-sm font-medium">
+            Show badges on posters
+          </Label>
+          <Switch
+            id={badgesSwitchId}
+            checked={overlaysEnabled}
+            onCheckedChange={setOverlaysEnabled}
+          />
+        </div>
+
+        {overlaysEnabled ? (
+          <>
+            <div>
+              <SettingsSubheading>Style</SettingsSubheading>
+              <BadgeStylePicker
+                value={displayPrefs.preset}
+                onChange={(next) => setPrefs({ ...displayPrefs, preset: next })}
               />
             </div>
-          )}
-        />
-        <SettingRow
-          label="Card overlay badges"
-          description="Show overlay badges on media cards for this profile."
-          control={({ id }) => (
-            <Switch
-              id={id}
-              checked={overlaysEnabled}
-              onCheckedChange={handleOverlaysEnabledChange}
-              aria-label="Enable card overlay badges"
-            />
-          )}
-        />
+            {/* Folded by category, each saying how many are on, so the page
+                stays short and the preview stays the main thing to look at. */}
+            <Accordion type="multiple" className="border-border/50 border-t">
+              {CATEGORY_GROUPS.map(({ category, title }) => {
+                const overlays = OVERLAY_REGISTRY.filter(
+                  (d) =>
+                    d.category === category &&
+                    isOverlaySupported(d.id) &&
+                    isOverlayOffered(d, shownRatingSources),
+                );
+                if (overlays.length === 0) return null;
+                const onCount = overlays.filter((d) => displayPrefs.items[d.id].enabled).length;
+                return (
+                  <AccordionItem key={category} value={category} className="border-border/50">
+                    <AccordionTrigger className="items-center hover:no-underline">
+                      <span className="flex-1">{title}</span>
+                      <span className="text-muted-foreground text-xs font-normal tabular-nums">
+                        {onCount === 0 ? "None on" : `${onCount} of ${overlays.length} on`}
+                      </span>
+                    </AccordionTrigger>
+                    <AccordionContent className="pb-2">
+                      {overlays.map((def) => (
+                        <BadgeRow
+                          key={def.id}
+                          overlayId={def.id}
+                          prefs={displayPrefs}
+                          shortcutsOn={quickActionsEnabled}
+                          onUpdate={setPrefs}
+                        />
+                      ))}
+                    </AccordionContent>
+                  </AccordionItem>
+                );
+              })}
+            </Accordion>
+          </>
+        ) : null}
       </SettingsGroup>
 
       <ConfirmDialog
-        open={confirmRestoreOpen}
-        onOpenChange={setConfirmRestoreOpen}
-        title="Restore default server settings"
-        description="Discard your badge customizations and follow the server defaults again, including any the administrator changes later. This cannot be undone."
-        confirmLabel="Restore"
+        open={confirmBadgeResetOpen}
+        onOpenChange={setConfirmBadgeResetOpen}
+        title="Reset badges?"
+        description="Your badge choices are cleared, and this profile follows your server's badge settings from then on."
+        confirmLabel="Reset badges"
         variant="destructive"
         isPending={isResetting}
         onConfirm={() => {
-          void handleRestoreServerDefaults();
+          void resetBadges();
         }}
       />
-
-      {/* `inert`, not just pointer-events: the controls must also be
-          unreachable by keyboard and invisible to assistive tech while card
-          overlays are disabled for this profile. */}
-      <div
-        inert={!overlaysEnabled}
-        className={overlaysEnabled ? "" : "pointer-events-none opacity-50"}
-      >
-        <SettingsGroup
-          title="Preview"
-          description="Live preview of your current overlay configuration."
-          actions={
-            hasOverride ? (
-              <button
-                type="button"
-                onClick={() => setConfirmRestoreOpen(true)}
-                className="text-muted-foreground hover:text-destructive inline-flex items-center gap-1.5 text-xs font-medium transition-colors"
-              >
-                <RotateCcw className="h-3 w-3" aria-hidden="true" />
-                Restore default server settings
-              </button>
-            ) : (
-              <span className="text-muted-foreground text-xs">Following the server defaults</span>
-            )
-          }
-        >
-          <div className="flex flex-col items-center gap-4">
-            <OverlayPreviewCard prefs={displayPrefs} variant={previewVariant} size="md" />
-            <OverlayPreviewVariantToggle
-              value={previewVariant}
-              onChange={setPreviewVariant}
-              variants={previewVariants}
-            />
-          </div>
-        </SettingsGroup>
-
-        <Tabs defaultValue="overlays" className="mt-6">
-          <TabsList>
-            <TabsTrigger value="overlays">Overlays</TabsTrigger>
-            <TabsTrigger value="style">Style</TabsTrigger>
-          </TabsList>
-
-          <TabsContent value="overlays" className="mt-4 space-y-6">
-            {CATEGORY_GROUPS.map(({ category, title, description }) => {
-              const overlays = OVERLAY_REGISTRY.filter(
-                (d) =>
-                  d.category === category &&
-                  isOverlaySupported(d.id) &&
-                  isOverlayOffered(d, shownRatingSources),
-              );
-              if (overlays.length === 0) return null;
-              return (
-                <SettingsGroup key={category} title={title} description={description}>
-                  {overlays.map((def) => (
-                    <OverlayToggle
-                      key={def.id}
-                      overlayId={def.id}
-                      prefs={displayPrefs}
-                      onUpdate={handleUpdate}
-                    />
-                  ))}
-                </SettingsGroup>
-              );
-            })}
-          </TabsContent>
-
-          <TabsContent value="style" className="mt-4 space-y-6">
-            <SettingsGroup
-              title="Preset"
-              description="A preset controls the base appearance of every badge. You can override the accent color of individual badges in the Overlays tab."
-            >
-              <PresetPicker
-                value={displayPrefs.preset}
-                onChange={(next) => handleUpdate({ ...displayPrefs, preset: next })}
-              />
-            </SettingsGroup>
-            <SettingsGroup title="How styling works" description="Where to find what.">
-              <ul className="text-muted-foreground list-disc space-y-1 pl-5 text-sm">
-                <li>
-                  <strong className="text-foreground">Preset</strong> sets the badge shape,
-                  background, font, and whether icons show by default.
-                </li>
-                <li>
-                  <strong className="text-foreground">Accent color</strong> (per overlay) tints that
-                  badge — gold for IMDb, red for RT, etc.
-                </li>
-                <li>
-                  <strong className="text-foreground">Icon toggle</strong> (per overlay) overrides
-                  the preset's icon default for a single overlay.
-                </li>
-                <li>
-                  <strong className="text-foreground">Position</strong> picks which corner the badge
-                  sits in. Multiple badges in the same corner stack vertically. Bottom corners share
-                  space with the card's quick actions, which draw over the badge while they show.
-                </li>
-              </ul>
-            </SettingsGroup>
-          </TabsContent>
-        </Tabs>
-      </div>
-    </div>
+    </>
   );
 }
diff --git a/web/src/pages/settings/ChoiceButtons.tsx b/web/src/pages/settings/ChoiceButtons.tsx
new file mode 100644
index 0000000000..a3e1f6d2eb
--- /dev/null
+++ b/web/src/pages/settings/ChoiceButtons.tsx
@@ -0,0 +1,50 @@
+import { useId } from "react";
+
+import { Button } from "@/components/ui/button";
+
+interface ChoiceButtonsProps<T extends string> {
+  label: string;
+  /** Hide the visible label when the section title already says it. */
+  hideLabel?: boolean;
+  value: T;
+  options: readonly { value: T; label: string }[];
+  disabled?: boolean;
+  onChange: (next: T) => void;
+}
+
+/** A row of buttons for picking one of a few choices, as on Accessibility. */
+export function ChoiceButtons<T extends string>({
+  label,
+  hideLabel = false,
+  value,
+  options,
+  disabled,
+  onChange,
+}: ChoiceButtonsProps<T>) {
+  const labelId = useId();
+  return (
+    <div className="space-y-2">
+      <p id={labelId} className={hideLabel ? "sr-only" : "text-sm font-medium"}>
+        {label}
+      </p>
+      <div role="radiogroup" aria-labelledby={labelId} className="flex flex-wrap gap-2">
+        {options.map((option) => (
+          <Button
+            key={option.value}
+            type="button"
+            role="radio"
+            aria-checked={value === option.value}
+            size="sm"
+            variant={value === option.value ? "default" : "outline"}
+            disabled={disabled}
+            onClick={() => {
+              if (option.value !== value) onChange(option.value);
+            }}
+          >
+            {option.label}
+          </Button>
+        ))}
+      </div>
+    </div>
+  );
+}
diff --git a/web/src/pages/settings/ConnectAppsSettings.test.tsx b/web/src/pages/settings/ConnectAppsSettings.test.tsx
index 21bdb5fbd5..86f715661d 100644
--- a/web/src/pages/settings/ConnectAppsSettings.test.tsx
+++ b/web/src/pages/settings/ConnectAppsSettings.test.tsx
@@ -128,16 +128,33 @@ describe("ConnectAppsSettings", () => {
     vi.restoreAllMocks();
   });
 
-  function render() {
+  // The page opens on the Prairie tab; most cases here are about the Jellyfin one.
+  function render(tab: "prairie" | "jellyfin" = "jellyfin") {
     act(() => {
       root.render(<ConnectAppsSettings />);
     });
+    if (tab === "jellyfin") {
+      act(() => {
+        findButton(container, "Jellyfin-compatible app")?.click();
+      });
+    }
   }
 
-  it("shows the plain account name and the Prairie origin on the Prairie tab", async () => {
-    render();
+  it("opens on the Prairie tab, listed first", () => {
+    render("prairie");
+
+    const tabs = Array.from(
+      container.querySelectorAll('[aria-label="App type"] button'),
+    ) as HTMLButtonElement[];
+    expect(tabs.map((tab) => tab.textContent?.trim())).toEqual([
+      "Prairie app or website",
+      "Jellyfin-compatible app",
+    ]);
+    expect(tabs[0]?.getAttribute("aria-pressed")).toBe("true");
+  });
 
-    await click(findButton(container, "Prairie app or website"));
+  it("shows the plain account name and the Prairie origin on the Prairie tab", () => {
+    render("prairie");
 
     expect(container.textContent).toContain("For Prairie's own apps");
     expect(container.textContent).toContain("Don't add a # to either field here.");
diff --git a/web/src/pages/settings/ConnectAppsSettings.tsx b/web/src/pages/settings/ConnectAppsSettings.tsx
index c49a4246e8..19c6d2bf9e 100644
--- a/web/src/pages/settings/ConnectAppsSettings.tsx
+++ b/web/src/pages/settings/ConnectAppsSettings.tsx
@@ -14,6 +14,7 @@ import {
 import { toast } from "sonner";
 
 import type { Profile } from "@/api/types";
+import { PageHeader } from "@/components/page/PageHeader";
 import { Avatar, AvatarFallback, AvatarImage } from "@/components/ui/avatar";
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
@@ -81,7 +82,7 @@ function FieldRow({ label, icon: Icon, kind, hint, children, copyValue }: FieldR
         kind === "jellyfin" ? "border-info/25 bg-info/[0.06]" : "border-border bg-background/40",
       )}
     >
-      <div className="text-muted-foreground flex items-center gap-1.5 text-[10px] font-semibold tracking-[0.16em] uppercase">
+      <div className="text-muted-foreground flex items-center gap-1.5 text-xs font-semibold tracking-[0.16em] uppercase">
         <Icon className="h-3.5 w-3.5" />
         {label}
       </div>
@@ -138,7 +139,7 @@ function ProfilePicker({
 }) {
   return (
     <div className="space-y-2">
-      <p className="text-muted-foreground text-[10px] font-semibold tracking-[0.16em] uppercase">
+      <p className="text-muted-foreground text-xs font-semibold tracking-[0.16em] uppercase">
         Which profile are you signing in as?
       </p>
       <div className="flex flex-wrap gap-2">
@@ -159,7 +160,7 @@ function ProfilePicker({
             >
               <Avatar className="h-6 w-6">
                 {profile.avatar_url ? <AvatarImage src={profile.avatar_url} alt="" /> : null}
-                <AvatarFallback className="text-[10px] font-semibold">
+                <AvatarFallback className="text-xs font-semibold">
                   {profile.name.charAt(0).toUpperCase()}
                 </AvatarFallback>
               </Avatar>
@@ -253,7 +254,7 @@ export default function ConnectAppsSettings() {
     isError: connectInfoFailed,
   } = useCompatConnectInfo();
 
-  const [kind, setKind] = useState<AppKind>("jellyfin");
+  const [kind, setKind] = useState<AppKind>("prairie");
   const [selectedProfileID, setSelectedProfileID] = useState<string | null>(null);
 
   // Default to the profile the user is already using — the one they're most
@@ -292,21 +293,23 @@ export default function ConnectAppsSettings() {
 
   return (
     <div className="space-y-6">
-      <div className="space-y-2">
-        <h2 className="text-2xl font-semibold tracking-tight sm:text-3xl">Connect Apps</h2>
-        <p className="text-muted-foreground max-w-2xl text-sm leading-relaxed">
-          Exactly what to type on a sign-in screen. Pick the kind of app you're using — the
-          credentials are different for each. To approve a TV or other device without a password,
-          use{" "}
-          <a
-            className="text-foreground underline underline-offset-2"
-            href="/settings/quick-connect"
-          >
-            Quick Connect
-          </a>
-          .
-        </p>
-      </div>
+      <PageHeader
+        title="Connect Apps"
+        subtitle={
+          <>
+            Exactly what to type on a sign-in screen. Pick the kind of app you're using — the
+            credentials are different for each. To approve a TV or other device without a password,
+            use{" "}
+            <a
+              className="text-foreground underline underline-offset-2"
+              href="/settings/quick-connect"
+            >
+              Quick Connect
+            </a>
+            .
+          </>
+        }
+      />
 
       <div
         className="surface-panel-subtle grid grid-cols-1 gap-1 rounded-[1.1rem] p-1 sm:grid-cols-2"
diff --git a/web/src/pages/settings/DeviceSettings.test.tsx b/web/src/pages/settings/DeviceSettings.test.tsx
index b6bd9c53e1..ebafe601fb 100644
--- a/web/src/pages/settings/DeviceSettings.test.tsx
+++ b/web/src/pages/settings/DeviceSettings.test.tsx
@@ -30,6 +30,7 @@ const mocks = vi.hoisted(() => ({
   useStoredSettingValues: vi.fn(),
   deviceSettingGroupsProps: vi.fn(),
   clearDevice: vi.fn(),
+  renameDevice: vi.fn(),
   toastSuccess: vi.fn(),
   isActingAdmin: false,
   capabilities: {
@@ -40,7 +41,9 @@ const mocks = vi.hoisted(() => ({
   },
 }));
 
-vi.mock("@/hooks/queries/devices", () => ({
+vi.mock("@/hooks/queries/devices", async (importOriginal) => ({
+  ...(await importOriginal<typeof import("@/hooks/queries/devices")>()),
+  useRenameDevice: () => ({ mutate: mocks.renameDevice, isPending: false }),
   useMyDevices: (options?: { household?: boolean }) => ({
     data: options?.household ? mocks.householdDevices : mocks.ownDevices,
     isLoading: false,
@@ -115,6 +118,7 @@ describe("DeviceSettings capability discovery", () => {
     mocks.useStoredSettingValues.mockReturnValue({ data: undefined });
     mocks.deviceSettingGroupsProps.mockReset();
     mocks.clearDevice.mockReset();
+    mocks.renameDevice.mockReset();
     mocks.toastSuccess.mockReset();
     mocks.isActingAdmin = false;
     mocks.capabilities.data = undefined;
@@ -299,6 +303,89 @@ describe("DeviceSettings capability discovery", () => {
       ).not.toBeInTheDocument();
     });
   });
+
+  describe("naming a device", () => {
+    beforeEach(() => {
+      mocks.capabilities.data = { ...compatibleCapabilities, supports_device_rename: true };
+      vi.spyOn(window, "confirm").mockReturnValue(true);
+    });
+
+    it("offers no rename on a server that cannot store the name", () => {
+      mocks.capabilities.data = compatibleCapabilities;
+      render(<DeviceSettings />);
+
+      expect(screen.queryByRole("button", { name: "Rename" })).not.toBeInTheDocument();
+    });
+
+    it("saves the typed name for the device it is editing", async () => {
+      const user = userEvent.setup();
+      mocks.renameDevice.mockImplementation((_vars, options: { onSuccess?: () => void }) =>
+        options.onSuccess?.(),
+      );
+      render(<DeviceSettings />);
+
+      await user.click(screen.getByRole("button", { name: "Rename" }));
+      const input = screen.getByRole("textbox", { name: "Device name" });
+      expect(input).toHaveAttribute("placeholder", "Living Room TV");
+      await user.type(input, "  Den  {Enter}");
+
+      expect(mocks.renameDevice).toHaveBeenCalledWith(
+        {
+          device: { deviceId: "living-room", profileId: undefined },
+          name: "Den",
+        },
+        expect.anything(),
+      );
+      expect(mocks.toastSuccess).toHaveBeenCalledWith("Device renamed");
+      expect(screen.queryByRole("textbox", { name: "Device name" })).not.toBeInTheDocument();
+    });
+
+    it("allows 120 characters counted as the server counts them", async () => {
+      const user = userEvent.setup();
+      render(<DeviceSettings />);
+
+      await user.click(screen.getByRole("button", { name: "Rename" }));
+      const input = screen.getByRole("textbox", { name: "Device name" });
+      await user.type(input, "📺".repeat(121));
+
+      expect(Array.from((input as HTMLInputElement).value)).toHaveLength(120);
+    });
+
+    it("clears the name when the field is emptied", async () => {
+      const user = userEvent.setup();
+      mocks.ownDevices = [device({ custom_name: "Den" })];
+      render(<DeviceSettings />);
+
+      await user.click(screen.getByRole("button", { name: "Rename" }));
+      await user.clear(screen.getByRole("textbox", { name: "Device name" }));
+      await user.click(screen.getByRole("button", { name: "Save" }));
+
+      expect(mocks.renameDevice).toHaveBeenCalledWith(
+        {
+          device: { deviceId: "living-room", profileId: undefined },
+          name: null,
+        },
+        expect.anything(),
+      );
+    });
+
+    it("uses the chosen name throughout, keeping the reported one for reference", async () => {
+      const user = userEvent.setup();
+      mocks.ownDevices = [
+        device({ custom_name: "Den", changed_count: 1, is_current_device: false }),
+      ];
+      render(<DeviceSettings />);
+
+      expect(screen.getByRole("heading", { name: "Den" })).toBeInTheDocument();
+      expect(screen.getByText("Reports itself as Living Room TV")).toBeInTheDocument();
+      await user.click(screen.getByRole("button", { name: "Use profile settings" }));
+      expect(window.confirm).toHaveBeenLastCalledWith(
+        expect.stringMatching(/^Use your profile settings on Den\?/),
+      );
+      await user.click(screen.getByRole("button", { name: /Forget/ }));
+      expect(window.confirm).toHaveBeenLastCalledWith(expect.stringMatching(/^Forget Den\?/));
+    });
+  });
 });
 
 describe("DeviceSettings initial device", () => {
diff --git a/web/src/pages/settings/DeviceSettings.tsx b/web/src/pages/settings/DeviceSettings.tsx
index 44dabb572a..90e82b999b 100644
--- a/web/src/pages/settings/DeviceSettings.tsx
+++ b/web/src/pages/settings/DeviceSettings.tsx
@@ -1,9 +1,11 @@
 import { useEffect, useMemo, useState } from "react";
-import { ChevronLeft, Info, ShieldCheck, Trash2, Users } from "lucide-react";
+import { ChevronLeft, Info, Pencil, ShieldCheck, Trash2, Users } from "lucide-react";
 import { toast } from "sonner";
 
 import type { UserDevice } from "@/api/types";
+import { PageHeader } from "@/components/page/PageHeader";
 import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
 import { Skeleton } from "@/components/ui/skeleton";
 import {
   classifyPlatform,
@@ -14,7 +16,14 @@ import { DeviceList, deviceSelectionKey, lastSeenLabel } from "@/components/sett
 import { DeviceSettingGroups } from "@/components/settings/DeviceSettingGroups";
 import { ProfileLaunchSettingsGroup } from "@/components/settings/ProfileLaunchSettingsGroup";
 import { SubtitleAppearancePanelView } from "@/components/settings/SubtitleAppearancePanelView";
-import { useClearDeviceSettings, useForgetDevice, useMyDevices } from "@/hooks/queries/devices";
+import {
+  deviceDisplayName,
+  useClearDeviceSettings,
+  useForgetDevice,
+  useMyDevices,
+  useRenameDevice,
+  type DeviceTarget,
+} from "@/hooks/queries/devices";
 import {
   settingsCapabilitiesSupportKey,
   useSettingsCapabilities,
@@ -100,13 +109,11 @@ export default function DeviceSettings() {
     <div className="space-y-5">
       {/* Hidden below xl while the detail view is open: on a phone that screen
           is about one device, and its own header says which. */}
-      <header className={cn("space-y-2", showDetailOnMobile && "hidden xl:block")}>
-        <h2 className="text-2xl font-semibold tracking-tight sm:text-3xl">Your devices</h2>
-        <p className="text-muted-foreground max-w-2xl text-sm leading-relaxed">
-          Every phone, tablet, TV and browser you watch on. Pick one to see what&apos;s set
-          differently there and change it — from here, whichever device you&apos;re holding.
-        </p>
-      </header>
+      <PageHeader
+        className={cn(showDetailOnMobile && "hidden xl:flex")}
+        title="Your Devices"
+        subtitle="Every phone, tablet, TV and browser you watch on. Pick one to see what's set differently there and change it — from here, whichever device you're holding."
+      />
 
       {/* Kept by this browser itself, not the server, so it sits apart from
           the device list, which edits server-held settings for any device. */}
@@ -317,6 +324,11 @@ function DeviceDetail({
 
   const changedCount = device.changed_count;
   const kind = classifyPlatform(device.device_platform);
+  // One name for the device everywhere on this screen, so a confirmation never
+  // names "Apple TV" while the heading says "Living Room".
+  const displayName = deviceDisplayName(device);
+  const canRename = capabilities.data?.supports_device_rename === true;
+  const [renaming, setRenaming] = useState(false);
 
   return (
     <div className="space-y-4">
@@ -335,11 +347,26 @@ function DeviceDetail({
             <PlatformIcon kind={kind} className="h-5 w-5" />
           </span>
           <div className="min-w-0 flex-1">
-            {/* Wraps rather than truncating: on a phone the name is the whole
-                subject of the screen, and "Living Room Apple…" is not it. */}
-            <h3 className="text-lg leading-tight font-semibold tracking-tight">
-              {device.device_name || "Unknown device"}
-            </h3>
+            {renaming ? (
+              <DeviceNameEditor
+                device={device}
+                target={{ deviceId: device.device_id, profileId: targetProfileId }}
+                onDone={() => setRenaming(false)}
+              />
+            ) : (
+              // Wraps rather than truncating: on a phone the name is the whole
+              // subject of the screen, and "Living Room Apple…" is not it.
+              <h3 className="text-lg leading-tight font-semibold tracking-tight">{displayName}</h3>
+            )}
+            {device.custom_name &&
+            device.device_name &&
+            device.custom_name !== device.device_name ? (
+              // The reported name still identifies the hardware, which is what
+              // someone checks before forgetting a device.
+              <p className="text-muted-foreground mt-0.5 text-[13px] leading-snug">
+                Reports itself as {device.device_name}
+              </p>
+            ) : null}
             <p className="text-muted-foreground mt-0.5 text-[13px] leading-snug">
               {[
                 platformKindLabel(kind),
@@ -352,6 +379,16 @@ function DeviceDetail({
           </div>
         </div>
         <div className="mt-3 flex flex-col gap-2 sm:flex-row sm:flex-wrap">
+          {canRename && !renaming ? (
+            <Button
+              variant="outline"
+              className="min-h-11 w-full sm:h-8 sm:min-h-0 sm:w-auto sm:px-3 sm:text-sm"
+              onClick={() => setRenaming(true)}
+            >
+              <Pencil className="h-3.5 w-3.5" />
+              Rename
+            </Button>
+          ) : null}
           {changedCount > 0 ? (
             <Button
               variant="outline"
@@ -360,7 +397,7 @@ function DeviceDetail({
               onClick={() => {
                 if (
                   !window.confirm(
-                    `Use ${ownerLabel} profile settings on ${device.device_name}? This removes the ${changedCount} ${changedCount === 1 ? "setting" : "settings"} changed on this device. Settings that only apply to devices go back to the app default.`,
+                    `Use ${ownerLabel} profile settings on ${displayName}? This removes the ${changedCount} ${changedCount === 1 ? "setting" : "settings"} changed on this device. Settings that only apply to devices go back to the app default.`,
                   )
                 ) {
                   return;
@@ -386,7 +423,7 @@ function DeviceDetail({
               onClick={() => {
                 if (
                   !window.confirm(
-                    `Forget ${device.device_name}? Its settings are removed and it disappears from this list until it's used again.`,
+                    `Forget ${displayName}? Its settings are removed and it disappears from this list until it's used again.`,
                   )
                 ) {
                   return;
@@ -428,7 +465,7 @@ function DeviceDetail({
           </strong>
           .
         </span>
-        <span className="text-muted-foreground/90 mt-1 block text-[12.5px]">
+        <span className="text-muted-foreground mt-1 block text-[13px]">
           {forSomeoneElse ? `${device.profile_name}'s` : "Your"} other devices, and anyone else who
           uses this one, are unaffected.
           {!device.is_current_device
@@ -527,7 +564,7 @@ function DeviceDetail({
           setAppearanceOpen(false);
         }}
         resetLabel={`Use ${ownerLabel} style`}
-        eyebrow={device.device_name || "This device"}
+        eyebrow={device.custom_name || device.device_name || "This device"}
         status={setValue.isPending ? "Saving…" : "Changes saved automatically"}
       />
 
@@ -542,6 +579,80 @@ function DeviceDetail({
   );
 }
 
+/**
+ * Names the device in place of its heading. Saving an empty field clears the
+ * chosen name, so the device shows the name it reports again.
+ */
+function DeviceNameEditor({
+  device,
+  target,
+  onDone,
+}: {
+  device: UserDevice;
+  target: DeviceTarget;
+  onDone: () => void;
+}) {
+  const rename = useRenameDevice();
+  const [value, setValue] = useState(device.custom_name ?? "");
+
+  const save = () => {
+    const name = value.trim() || null;
+    if (name === (device.custom_name ?? null)) {
+      onDone();
+      return;
+    }
+    rename.mutate(
+      { device: target, name },
+      {
+        onSuccess: () => {
+          toast.success(name ? "Device renamed" : "Device name reset");
+          onDone();
+        },
+        onError: (error) => toast.error(error instanceof Error ? error.message : "Couldn't rename"),
+      },
+    );
+  };
+
+  return (
+    <form
+      className="flex flex-col gap-2 sm:flex-row sm:items-center"
+      onSubmit={(event) => {
+        event.preventDefault();
+        save();
+      }}
+    >
+      <Input
+        aria-label="Device name"
+        autoFocus
+        value={value}
+        placeholder={device.device_name || "Device name"}
+        // The server counts code points, not the UTF-16 units maxLength
+        // counts, so an emoji takes one of the 120 rather than two.
+        onChange={(event) => setValue(Array.from(event.target.value).slice(0, 120).join(""))}
+        onKeyDown={(event) => {
+          // Closing mid-save would drop the result, error included.
+          if (event.key === "Escape" && !rename.isPending) onDone();
+        }}
+        className="h-11 sm:h-8 sm:max-w-xs"
+      />
+      <div className="flex gap-2">
+        <Button type="submit" className="min-h-11 sm:h-8 sm:min-h-0" disabled={rename.isPending}>
+          {rename.isPending ? "Saving…" : "Save"}
+        </Button>
+        <Button
+          type="button"
+          variant="ghost"
+          className="min-h-11 sm:h-8 sm:min-h-0"
+          disabled={rename.isPending}
+          onClick={onDone}
+        >
+          Cancel
+        </Button>
+      </div>
+    </form>
+  );
+}
+
 function Callout({
   tone,
   icon,
diff --git a/web/src/pages/settings/HistoryImportSettings.tsx b/web/src/pages/settings/HistoryImportSettings.tsx
index 6de429d4e4..6b5697d8f0 100644
--- a/web/src/pages/settings/HistoryImportSettings.tsx
+++ b/web/src/pages/settings/HistoryImportSettings.tsx
@@ -1,5 +1,6 @@
 import { useEffect, useMemo, useState } from "react";
 import { useNavigate, useSearchParams } from "react-router";
+import { PageHeader } from "@/components/page/PageHeader";
 import { useEventChannel } from "@/components/realtimeEventsContext";
 import { useCurrentProfile } from "@/hooks/useCurrentProfile";
 import { useAuth } from "@/hooks/useAuth";
@@ -356,12 +357,10 @@ export default function HistoryImportSettings() {
 
   return (
     <div className="space-y-6">
-      <div className="space-y-3">
-        <h2 className="text-2xl font-semibold tracking-tight sm:text-3xl">History import</h2>
-        <p className="text-muted-foreground max-w-2xl text-sm leading-relaxed">
-          Import watch history from an external media server into a Prairie profile.
-        </p>
-      </div>
+      <PageHeader
+        title="History Import"
+        subtitle="Import watch history from an external media server into a Prairie profile."
+      />
 
       {/* ── New import ──────────────────────────────────── */}
       <SettingsGroup
@@ -451,7 +450,7 @@ export default function HistoryImportSettings() {
                 {sourcesLoading ? (
                   <div className="text-muted-foreground text-sm">Loading saved servers\u2026</div>
                 ) : embySources.length === 0 ? (
-                  <EmptyNotice>No admin-defined Emby servers are available yet.</EmptyNotice>
+                  <EmptyNotice>No server-defined Emby servers are available yet.</EmptyNotice>
                 ) : (
                   <>
                     <div className="space-y-2">
@@ -569,7 +568,7 @@ export default function HistoryImportSettings() {
                 {sourcesLoading ? (
                   <div className="text-muted-foreground text-sm">Loading saved servers\u2026</div>
                 ) : plexSources.length === 0 ? (
-                  <EmptyNotice>No admin-defined Plex servers are available yet.</EmptyNotice>
+                  <EmptyNotice>No server-defined Plex servers are available yet.</EmptyNotice>
                 ) : (
                   <>
                     <div className="space-y-2">
@@ -1003,7 +1002,7 @@ function MetricCard({
       >
         {value}
       </div>
-      <div className="text-muted-foreground text-[11px] font-medium tracking-wide uppercase">
+      <div className="text-muted-foreground text-xs font-medium tracking-wide uppercase">
         {label}
       </div>
     </div>
diff --git a/web/src/pages/settings/HistoryImportSettings.v2.test.tsx b/web/src/pages/settings/HistoryImportSettings.v2.test.tsx
index a0f74426ac..d7ea63c61c 100644
--- a/web/src/pages/settings/HistoryImportSettings.v2.test.tsx
+++ b/web/src/pages/settings/HistoryImportSettings.v2.test.tsx
@@ -204,3 +204,14 @@ it("keeps the server's message for a refused import by the primary profile", ()
   expect(alerts.some((text) => text.includes("This profile can only import"))).toBe(false);
   expect(alerts.some((text) => text.includes(state.createError!.message))).toBe(true);
 });
+
+it("says so when the server defines no Emby or Plex servers to pick from", () => {
+  renderPage();
+
+  fireEvent.click(screen.getByRole("button", { name: "Saved Server" }));
+  expect(screen.getByText("No server-defined Emby servers are available yet.")).toBeTruthy();
+
+  fireEvent.click(screen.getByRole("button", { name: /Plex account or direct server/ }));
+  fireEvent.click(screen.getByRole("button", { name: "Saved Server" }));
+  expect(screen.getByText("No server-defined Plex servers are available yet.")).toBeTruthy();
+});
diff --git a/web/src/pages/settings/HomeScreenSettings.links.test.tsx b/web/src/pages/settings/HomeScreenSettings.links.test.tsx
index ae764c0e5d..4439f7b72b 100644
--- a/web/src/pages/settings/HomeScreenSettings.links.test.tsx
+++ b/web/src/pages/settings/HomeScreenSettings.links.test.tsx
@@ -29,6 +29,7 @@ vi.mock("@/hooks/queries/libraries", () => {
 vi.mock("@/hooks/queries/settingValues", () => ({
   useEffectiveSettings: () => ({ data: {}, isLoading: false }),
   useSetSettingValue: () => ({ mutate: vi.fn(), isPending: false }),
+  useClearSettingValue: () => ({ mutateAsync: vi.fn(), isPending: false }),
   invalidateSettingValueQueries: vi.fn(),
 }));
 vi.mock("@/hooks/queries/useAllUserCollections", () => ({
diff --git a/web/src/pages/settings/HomeScreenSettings.page.test.tsx b/web/src/pages/settings/HomeScreenSettings.page.test.tsx
index fec7531aa5..2c11daa874 100644
--- a/web/src/pages/settings/HomeScreenSettings.page.test.tsx
+++ b/web/src/pages/settings/HomeScreenSettings.page.test.tsx
@@ -10,11 +10,23 @@ import { expectPhoneLayout, stubPhone } from "@/components/homeRows/phoneLayout.
 import { recipeCatalogFixture } from "@/lib/homeRows/recipeCatalogFixture.test-support";
 import HomeScreenSettings from "./HomeScreenSettings";
 
+// Radix Select (Next up episodes) opens through pointer capture and scrolls
+// its options into view; jsdom provides neither.
+if (!window.HTMLElement.prototype.hasPointerCapture) {
+  window.HTMLElement.prototype.hasPointerCapture = () => false;
+  window.HTMLElement.prototype.scrollIntoView = () => {};
+}
+
 const mocks = vi.hoisted(() => ({
   request: vi.fn(),
   role: "user" as string | undefined,
   collections: [] as Array<Record<string, unknown>>,
   catalog: vi.fn(),
+  effective: {} as Record<string, unknown>,
+  effectiveError: false,
+  setSetting: vi.fn(),
+  mutateSetting: vi.fn(),
+  clearSetting: vi.fn(),
 }));
 vi.mock("@/api/v2/request", async () => ({
   ...(await vi.importActual<typeof import("@/api/v2/request")>("@/api/v2/request")),
@@ -29,8 +41,17 @@ vi.mock("@/hooks/queries/libraries", () => {
   return { useUserLibraries: () => ({ data }), useAvailableUserLibraries: () => ({ data }) };
 });
 vi.mock("@/hooks/queries/settingValues", () => ({
-  useEffectiveSettings: () => ({ data: {}, isLoading: false }),
-  useSetSettingValue: () => ({ mutate: vi.fn(), isPending: false }),
+  useEffectiveSettings: () => ({
+    data: mocks.effectiveError ? undefined : mocks.effective,
+    isLoading: false,
+    isError: mocks.effectiveError,
+  }),
+  useSetSettingValue: () => ({
+    mutate: mocks.mutateSetting,
+    mutateAsync: mocks.setSetting,
+    isPending: false,
+  }),
+  useClearSettingValue: () => ({ mutateAsync: mocks.clearSetting, isPending: false }),
   invalidateSettingValueQueries: vi.fn(),
 }));
 vi.mock("@/hooks/queries/useAllUserCollections", () => ({
@@ -122,6 +143,10 @@ async function release(operation: string) {
 }
 
 beforeEach(() => {
+  mocks.effective = {};
+  mocks.effectiveError = false;
+  mocks.setSetting.mockReset();
+  mocks.clearSetting.mockReset();
   vi.clearAllMocks();
   // The signed-in profile; saves are written as it.
   setAccessToken("token");
@@ -239,9 +264,9 @@ describe("Settings > Home Screen", () => {
     await expectPhoneLayout("Home");
   });
 
-  it("is titled Home screen and says only this profile changes", async () => {
+  it("is titled Home Screen and says only this profile changes", async () => {
     await renderPage();
-    expect(screen.getByRole("heading", { level: 2, name: "Home screen" })).toBeInTheDocument();
+    expect(screen.getByRole("heading", { level: 1, name: "Home Screen" })).toBeInTheDocument();
     expect(
       screen.getByText(
         "Choose the rows you see and their order. Only this profile changes, and it saves as you go.",
@@ -250,6 +275,70 @@ describe("Settings > Home Screen", () => {
     expect(screen.getByText("2 rows · 2 shown")).toBeInTheDocument();
   });
 
+  it("keeps the next up preference with Home's other row preferences", async () => {
+    mocks.setSetting.mockResolvedValue(undefined);
+    mocks.clearSetting.mockResolvedValue(undefined);
+    await renderPage();
+    expect(screen.queryByRole("button", { name: "Reset" })).not.toBeInTheDocument();
+
+    await userEvent.click(screen.getByRole("combobox", { name: "Next up episodes" }));
+    await userEvent.click(await screen.findByRole("option", { name: "Separate row" }));
+
+    expect(mocks.setSetting).toHaveBeenCalledWith({
+      key: "ui.next_up_mode",
+      value: "separate",
+      identity: { scope: "profile" },
+    });
+  });
+
+  it("saves Show new episodes first for this profile, off until chosen", async () => {
+    await renderPage();
+    const toggle = screen.getByRole("switch", { name: "Show new episodes first" });
+    expect(toggle).not.toBeChecked();
+
+    await userEvent.click(toggle);
+
+    expect(mocks.mutateSetting).toHaveBeenCalledWith(
+      { key: "ui.next_up_new_releases_first", value: true, identity: { scope: "profile" } },
+      expect.anything(),
+    );
+  });
+
+  it("shows Show new episodes first on when the profile turned it on", async () => {
+    mocks.effective = {
+      "ui.next_up_new_releases_first": {
+        key: "ui.next_up_new_releases_first",
+        value: true,
+        source: "profile",
+      },
+    };
+    await renderPage();
+
+    expect(screen.getByRole("switch", { name: "Show new episodes first" })).toBeChecked();
+  });
+
+  it("locks next up while this profile's current values cannot be read", async () => {
+    mocks.effectiveError = true;
+    await renderPage();
+
+    expect(screen.getByRole("combobox", { name: "Next up episodes" })).toBeDisabled();
+  });
+
+  it("resets a stored next up choice so it inherits again", async () => {
+    mocks.clearSetting.mockResolvedValue(undefined);
+    mocks.effective = {
+      "ui.next_up_mode": { key: "ui.next_up_mode", value: "separate", source: "profile" },
+    };
+    await renderPage();
+
+    await userEvent.click(screen.getByRole("button", { name: "Reset" }));
+
+    expect(mocks.clearSetting).toHaveBeenCalledWith({
+      key: "ui.next_up_mode",
+      identity: { scope: "profile" },
+    });
+  });
+
   it("hides a row with its switch, saving only the hide, and keeps the page switcher off until it lands", async () => {
     await renderPage();
     hold("PUT /api/v2/profile/sections");
diff --git a/web/src/pages/settings/HomeScreenSettings.test.tsx b/web/src/pages/settings/HomeScreenSettings.test.tsx
index 3378400fe2..7e6eee1d64 100644
--- a/web/src/pages/settings/HomeScreenSettings.test.tsx
+++ b/web/src/pages/settings/HomeScreenSettings.test.tsx
@@ -91,62 +91,6 @@ describe("HomeScreenSettings helpers", () => {
     ]);
   });
 
-  it("leaves out a shown legacy Trakt section without a saved override unless the change is to it", () => {
-    const trakt = { source: "trakt", list: "trending" };
-    const sections = [
-      makeSection({ id: "trakt-shown", config: trakt }),
-      makeSection({ id: "trakt-hidden", config: trakt, hidden: true }),
-      makeSection({ id: "trakt-saved", config: { source_provider: "trakt" } }),
-      makeSection({ id: "admin-1" }),
-    ];
-    const ids = {
-      savedOverrides: [{ id: "saved", section_id: "trakt-saved" }],
-      newId: (sectionId: string) => `new-${sectionId}`,
-    };
-    const overrides = buildSectionOverrides(sections, [{ id: "trakt-removed" }], {
-      ...ids,
-      changedSectionId: "admin-1",
-    });
-
-    expect(overrides.map(({ id, section_id }) => ({ id, section_id }))).toEqual([
-      { id: "new-trakt-hidden", section_id: "trakt-hidden" },
-      { id: "saved", section_id: "trakt-saved" },
-      { id: "new-admin-1", section_id: "admin-1" },
-      { id: "new-trakt-removed", section_id: "trakt-removed" },
-    ]);
-    expect(overrides.find((o) => o.section_id === "admin-1")?.position).toBe(3);
-
-    // An edit or move of the section itself is sent, so its refusal shows.
-    const edited = buildSectionOverrides(sections, [], { ...ids, changedSectionId: "trakt-shown" });
-    expect(edited[0]).toMatchObject({ id: "new-trakt-shown", section_id: "trakt-shown" });
-  });
-
-  it("numbers the other sections around a left-out section's admin position", () => {
-    const held = makeSection({ id: "trakt", position: 3, config: { source: "trakt" } });
-    const row = (id: string) => makeSection({ id });
-    const positions = (sections: SettingsSectionEntry[]) =>
-      buildSectionOverrides(sections, [], { newId: (id) => `new-${id}` }).map(
-        ({ section_id, position }) => [section_id, position],
-      );
-
-    // A row moved below the held section follows it.
-    expect(positions([row("a"), row("b"), held, row("moved"), row("c")])).toEqual([
-      ["a", 0],
-      ["b", 1],
-      ["moved", 4],
-      ["c", 5],
-    ]);
-    // With more rows above it than its position allows, it keeps its place and
-    // the rest follow it, never sharing its position.
-    expect(positions([row("moved"), row("a"), row("b"), row("c"), held, row("d")])).toEqual([
-      ["moved", 0],
-      ["a", 1],
-      ["b", 2],
-      ["c", 4],
-      ["d", 5],
-    ]);
-  });
-
   it("gives each admin section one new override ID per source", () => {
     const first = createOverrideIdSource();
     const id = first("admin-1");
@@ -328,7 +272,7 @@ describe("override set saved by each Home Screen edit", () => {
 
   it("hides a row", () => {
     const next = page.map((s) => (s.id === "admin-b" ? { ...s, hidden: true } : s));
-    expect(buildSectionOverrides(next, [], { ...ids, changedSectionId: "admin-b" })).toEqual([
+    expect(buildSectionOverrides(next, [], ids)).toEqual([
       { ...adminA, position: 0 },
       { ...adminB, position: 1, hidden: true },
       { ...ownC, position: 2 },
@@ -337,7 +281,7 @@ describe("override set saved by each Home Screen edit", () => {
 
   it("renames a row", () => {
     const next = page.map((s) => (s.id === "admin-a" ? { ...s, title: "New Movies" } : s));
-    expect(buildSectionOverrides(next, [], { ...ids, changedSectionId: "admin-a" })).toEqual([
+    expect(buildSectionOverrides(next, [], ids)).toEqual([
       { ...adminA, position: 0, title: "New Movies" },
       { ...adminB, position: 1 },
       { ...ownC, position: 2 },
@@ -346,7 +290,7 @@ describe("override set saved by each Home Screen edit", () => {
 
   it("moves a row", () => {
     const next = [page[2]!, page[0]!, page[1]!];
-    expect(buildSectionOverrides(next, [], { ...ids, changedSectionId: "own-c" })).toEqual([
+    expect(buildSectionOverrides(next, [], ids)).toEqual([
       { ...ownC, position: 0 },
       { ...adminA, position: 1 },
       { ...adminB, position: 2 },
diff --git a/web/src/pages/settings/HomeScreenSettings.tsx b/web/src/pages/settings/HomeScreenSettings.tsx
index 5c3643ef7b..b68e8c0c7d 100644
--- a/web/src/pages/settings/HomeScreenSettings.tsx
+++ b/web/src/pages/settings/HomeScreenSettings.tsx
@@ -1,7 +1,7 @@
 import type { ActionMenuItem } from "@/components/calm/ActionMenu";
 import type { PageMoreMenuItem } from "@/components/calm/PageMoreMenu";
 import { AddRowDialog } from "@/components/homeRows/addRow/AddRowDialog";
-import { HideWatchedCard } from "@/components/homeRows/HideWatchedCard";
+import { HomePreferencesCard } from "@/components/homeRows/HomePreferencesCard";
 import { HomeRowsPage, type SharedRowMenuItems } from "@/components/homeRows/HomeRowsPage";
 import { RemoveRowDialog } from "@/components/homeRows/RemoveRowDialog";
 import { ResetProfileDialog } from "@/components/homeRows/ResetProfileDialog";
@@ -18,11 +18,12 @@ import {
   useSetSettingValue,
   type SettingIdentity,
 } from "@/hooks/queries/settingValues";
+import { useProfileDefaultWriter } from "@/hooks/queries/profileDefaults";
 import { useOptionalAuth } from "@/hooks/useAuth";
 import { collectionKind, profilePageName, type CollectionSummary } from "@/lib/homeRows/describe";
 import { pageLabel } from "@/lib/homeRows/pages";
 import type { HomeRow } from "@/lib/homeRows/types";
-import { SETTING_KEYS } from "@/lib/settingsContract";
+import { SETTING_DEFINITIONS, SETTING_KEYS } from "@/lib/settingsContract";
 import {
   CircleMinus,
   Download,
@@ -38,7 +39,11 @@ import { useEffect, useMemo, useRef, useState } from "react";
 import { toast } from "sonner";
 
 const PROFILE_SCOPE: SettingIdentity = { scope: "profile" };
-const HOME_PREFERENCE_KEYS = [SETTING_KEYS.HOME_HIDE_WATCHED_ITEMS] as const;
+const HOME_PREFERENCE_KEYS = [
+  SETTING_KEYS.HOME_HIDE_WATCHED_ITEMS,
+  SETTING_KEYS.UI_NEXT_UP_MODE,
+  SETTING_KEYS.UI_NEXT_UP_NEW_RELEASES_FIRST,
+] as const;
 
 /**
  * Settings > Home Screen: this profile's rows on Home and each library page,
@@ -91,6 +96,14 @@ export default function HomeScreenSettings() {
   const saveHomePreference = useSetSettingValue();
   const hideWatchedItems =
     homePreferences.data?.[SETTING_KEYS.HOME_HIDE_WATCHED_ITEMS]?.value === true;
+  const newReleasesFirst =
+    homePreferences.data?.[SETTING_KEYS.UI_NEXT_UP_NEW_RELEASES_FIRST]?.value === true;
+  // Next up is device-overridable, so it saves through the writer that also
+  // clears a device row shadowing the profile's choice.
+  const nextUpWriter = useProfileDefaultWriter(homePreferences.data);
+  const nextUp = homePreferences.data?.[SETTING_KEYS.UI_NEXT_UP_MODE];
+  const nextUpMode = (nextUp?.value ??
+    SETTING_DEFINITIONS[SETTING_KEYS.UI_NEXT_UP_MODE].defaultValue) as string;
 
   const profileId = useOptionalAuth()?.profile?.id;
   const collectionOptions = adapter.collections?.options;
@@ -234,6 +247,30 @@ export default function HomeScreenSettings() {
     },
   ];
 
+  function handleNextUpModeChange(mode: string) {
+    nextUpWriter
+      .save(SETTING_KEYS.UI_NEXT_UP_MODE, mode)
+      .catch(() => toast.error("Failed to save Home preference"));
+  }
+
+  function handleNextUpReset() {
+    // Deletes the profile row so the setting inherits the default again.
+    nextUpWriter
+      .reset(SETTING_KEYS.UI_NEXT_UP_MODE)
+      .catch(() => toast.error("Failed to reset the next up preference"));
+  }
+
+  function handleNewReleasesFirstChange(enabled: boolean) {
+    saveHomePreference.mutate(
+      {
+        key: SETTING_KEYS.UI_NEXT_UP_NEW_RELEASES_FIRST,
+        value: enabled,
+        identity: PROFILE_SCOPE,
+      },
+      { onError: () => toast.error("Failed to save Home preference") },
+    );
+  }
+
   function handleHideWatchedItemsChange(enabled: boolean) {
     saveHomePreference.mutate(
       { key: SETTING_KEYS.HOME_HIDE_WATCHED_ITEMS, value: enabled, identity: PROFILE_SCOPE },
@@ -262,7 +299,7 @@ export default function HomeScreenSettings() {
   return (
     <HomeRowsPage
       adapter={adapter}
-      title="Home screen"
+      title="Home Screen"
       subtitle="Choose the rows you see and their order. Only this profile changes, and it saves as you go."
       focus={focus}
       collection={(id) => collectionSummaries.get(id)}
@@ -273,10 +310,22 @@ export default function HomeScreenSettings() {
       addRow={{ onClick: () => setRowDialog({ session: null }), disabled: !adapter.canEdit }}
       notices={notice}
     >
-      <HideWatchedCard
-        checked={hideWatchedItems}
-        disabled={homePreferences.isLoading || saveHomePreference.isPending}
-        onCheckedChange={handleHideWatchedItemsChange}
+      <HomePreferencesCard
+        nextUpMode={nextUpMode}
+        nextUpChosen={nextUp?.source === "profile"}
+        onNextUpModeChange={handleNextUpModeChange}
+        onNextUpReset={handleNextUpReset}
+        newReleasesFirst={newReleasesFirst}
+        onNewReleasesFirstChange={handleNewReleasesFirstChange}
+        hideWatched={hideWatchedItems}
+        onHideWatchedChange={handleHideWatchedItemsChange}
+        disabled={
+          homePreferences.isLoading ||
+          // Without the effective values a save cannot tell which row it overrides.
+          homePreferences.isError ||
+          saveHomePreference.isPending ||
+          nextUpWriter.isSaving
+        }
       />
 
       <RemoveRowDialog
diff --git a/web/src/pages/settings/InterfaceSettings.test.tsx b/web/src/pages/settings/InterfaceSettings.test.tsx
index 8119ea61b8..819a55901b 100644
--- a/web/src/pages/settings/InterfaceSettings.test.tsx
+++ b/web/src/pages/settings/InterfaceSettings.test.tsx
@@ -4,7 +4,11 @@ import { cleanup, fireEvent, render, screen, waitFor } from "@testing-library/re
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 import { SETTING_KEYS } from "@/lib/settingsContract";
-import { defaultWebPrimaryMenu } from "@/lib/uiCustomization";
+import {
+  defaultWebPrimaryMenu,
+  type PrimaryMenuDocument,
+  type PrimaryMenuItem,
+} from "@/lib/uiCustomization";
 
 const mocks = vi.hoisted(() => ({
   useUICustomization: vi.fn(),
@@ -26,37 +30,50 @@ vi.mock("@/hooks/queries/settingValues", () => ({
   useClearSettingValue: (...args: unknown[]) => mocks.useClearSettingValue(...args),
 }));
 
-// Title art has its own suite; it reads settings capabilities this page does not.
-vi.mock("@/pages/settings/TitleArtSettingsGroup", () => ({ TitleArtSettingsGroup: () => null }));
+// Shortcuts, badges, and the preview have their own tests; here it only
+// matters that they render whatever state the web customization is in.
+vi.mock("./CardOverlaySettings", () => ({
+  CardOverlaySettings: () => <section aria-label="Card overlays" />,
+}));
+vi.mock("./PosterCardPreview", () => ({
+  PosterCardPreview: () => <figure aria-label="Preview" />,
+}));
+
 vi.mock("sonner", () => ({
   toast: { success: vi.fn(), error: vi.fn() },
 }));
 
 import InterfaceSettings from "./InterfaceSettings";
 
-describe("InterfaceSettings card resets", () => {
+const HOME: PrimaryMenuItem = { type: "builtin", destination: "home" };
+const MOVIES: PrimaryMenuItem = { type: "library", library_id: 7, label: "Movies" };
+const CALENDAR: PrimaryMenuItem = { type: "builtin", destination: "calendar" };
+const MOVIES_MENU: PrimaryMenuDocument = { items: [HOME, MOVIES, CALENDAR] };
+
+function customization(overrides: Record<string, unknown> = {}) {
+  return {
+    cardPresentation: { poster_size: "large", caption: "title" },
+    cardPresentationSource: "profile_client",
+    primaryMenu: defaultWebPrimaryMenu(),
+    primaryMenuSource: "profile_client",
+    shortcuts: { items: [] },
+    isSupported: true,
+    supportsAtomicShortcuts: true,
+    isLoading: false,
+    isUnavailable: false,
+    ...overrides,
+  };
+}
+
+describe("InterfaceSettings", () => {
   let clearMutateAsync: ReturnType<typeof vi.fn>;
   let setMutateAsync: ReturnType<typeof vi.fn>;
 
   beforeEach(() => {
     mocks.useUICustomization.mockReset();
-    mocks.useUserLibraries.mockReset();
-    mocks.useSetSettingValue.mockReset();
-    mocks.useClearSettingValue.mockReset();
     clearMutateAsync = vi.fn().mockResolvedValue(undefined);
     setMutateAsync = vi.fn().mockResolvedValue(undefined);
-
-    mocks.useUICustomization.mockReturnValue({
-      cardPresentation: { poster_size: "large", caption: "title" },
-      cardPresentationSource: "profile_client",
-      primaryMenu: defaultWebPrimaryMenu(),
-      primaryMenuSource: "profile_client",
-      shortcuts: { items: [] },
-      isSupported: true,
-      supportsAtomicShortcuts: true,
-      isLoading: false,
-      isUnavailable: false,
-    });
+    mocks.useUICustomization.mockReturnValue(customization());
     mocks.useUserLibraries.mockReturnValue({ data: [] });
     mocks.useSetSettingValue.mockReturnValue({
       isPending: false,
@@ -70,16 +87,33 @@ describe("InterfaceSettings card resets", () => {
 
   afterEach(cleanup);
 
-  it("resets the web-family card preference at profile_client scope", async () => {
+  it("saves poster size and caption the moment they are picked", async () => {
     render(<InterfaceSettings />);
 
-    const reset = screen.getByRole("button", {
-      name: "Reset web-family card layout",
-    });
-    expect(reset).toHaveAccessibleDescription(
-      "Remove the layout shared by web browsers and inherit the profile or app default.",
+    expect(screen.getByRole("radio", { name: "Large" })).toHaveAttribute("aria-checked", "true");
+    fireEvent.click(screen.getByRole("radio", { name: "Compact" }));
+    await waitFor(() =>
+      expect(setMutateAsync).toHaveBeenCalledWith({
+        key: SETTING_KEYS.UI_CARD_PRESENTATION,
+        value: { poster_size: "compact", caption: "title" },
+        identity: { scope: "profile_client" },
+      }),
     );
-    fireEvent.click(reset);
+
+    fireEvent.click(screen.getByRole("radio", { name: "Nothing" }));
+    await waitFor(() =>
+      expect(setMutateAsync).toHaveBeenLastCalledWith({
+        key: SETTING_KEYS.UI_CARD_PRESENTATION,
+        value: { poster_size: "large", caption: "artwork" },
+        identity: { scope: "profile_client" },
+      }),
+    );
+  });
+
+  it("resets poster settings at profile_client scope", async () => {
+    render(<InterfaceSettings />);
+
+    fireEvent.click(screen.getByRole("button", { name: "Reset poster settings" }));
 
     await waitFor(() =>
       expect(clearMutateAsync).toHaveBeenCalledWith({
@@ -89,24 +123,19 @@ describe("InterfaceSettings card resets", () => {
     );
   });
 
-  it("keeps the device reset distinct from the web-family reset", async () => {
-    mocks.useUICustomization.mockReturnValue({
-      cardPresentation: { poster_size: "compact", caption: "artwork" },
-      cardPresentationSource: "profile_device",
-      primaryMenu: defaultWebPrimaryMenu(),
-      primaryMenuSource: "profile_client",
-      shortcuts: { items: [] },
-      isSupported: true,
-      supportsAtomicShortcuts: true,
-      isLoading: false,
-    });
+  it("offers to clear a browser override instead of editing under it", async () => {
+    mocks.useUICustomization.mockReturnValue(
+      customization({
+        cardPresentation: { poster_size: "compact", caption: "artwork" },
+        cardPresentationSource: "profile_device",
+      }),
+    );
 
     render(<InterfaceSettings />);
 
-    expect(
-      screen.queryByRole("button", { name: "Reset web-family card layout" }),
-    ).not.toBeInTheDocument();
-    fireEvent.click(screen.getByRole("button", { name: "Use web-family layout" }));
+    expect(screen.queryByRole("button", { name: "Reset poster settings" })).not.toBeInTheDocument();
+    expect(screen.getByRole("radio", { name: "Large" })).toBeDisabled();
+    fireEvent.click(screen.getByRole("button", { name: "Match my other browsers" }));
 
     await waitFor(() =>
       expect(clearMutateAsync).toHaveBeenCalledWith({
@@ -116,106 +145,71 @@ describe("InterfaceSettings card resets", () => {
     );
   });
 
-  it("follows the effective menu after clearing a web-family override", async () => {
-    const effectiveMenu = {
-      items: [
-        { type: "builtin" as const, destination: "home" as const },
-        { type: "library" as const, library_id: 7, label: "Movies" },
-      ],
-    };
-    let source = "profile_client";
-    mocks.useUICustomization.mockImplementation(() => ({
-      cardPresentation: { poster_size: "large", caption: "title" },
-      cardPresentationSource: "profile_client",
-      primaryMenu: effectiveMenu,
-      primaryMenuSource: source,
-      shortcuts: { items: [] },
-      isSupported: true,
-      supportsAtomicShortcuts: true,
-      isLoading: false,
-    }));
-    clearMutateAsync.mockImplementation(async () => {
-      source = "profile";
-    });
+  it("saves the menu on every edit, with no save button", async () => {
+    mocks.useUICustomization.mockReturnValue(customization({ primaryMenu: MOVIES_MENU }));
 
     render(<InterfaceSettings />);
-    fireEvent.click(screen.getByRole("button", { name: "Remove Movies · Library" }));
-    expect(screen.queryByText("Movies · Library")).not.toBeInTheDocument();
+    expect(screen.queryByRole("button", { name: /save/i })).not.toBeInTheDocument();
 
-    fireEvent.click(screen.getByRole("button", { name: "Reset to default" }));
+    fireEvent.click(screen.getByRole("button", { name: "Remove Movies · Library" }));
 
+    expect(screen.queryByText("Movies · Library")).not.toBeInTheDocument();
     await waitFor(() =>
-      expect(clearMutateAsync).toHaveBeenCalledWith({
+      expect(setMutateAsync).toHaveBeenCalledWith({
         key: SETTING_KEYS.NAV_PRIMARY_MENU,
+        value: {
+          items: [
+            { type: "builtin", destination: "home" },
+            { type: "builtin", destination: "calendar" },
+          ],
+        },
         identity: { scope: "profile_client" },
       }),
     );
-    expect(await screen.findByText("Movies · Library")).toBeInTheDocument();
-    expect(screen.getByRole("button", { name: "Save menu" })).toBeDisabled();
   });
 
-  it("keeps a rapid post-save edit when the saved baseline refetch arrives", async () => {
-    let effectiveMenu = {
-      items: [
-        { type: "builtin" as const, destination: "home" as const },
-        { type: "library" as const, library_id: 7, label: "Movies" },
-        { type: "builtin" as const, destination: "calendar" as const },
-      ],
-    };
-    mocks.useUICustomization.mockImplementation(() => ({
-      cardPresentation: { poster_size: "large", caption: "title" },
-      cardPresentationSource: "profile_client",
-      primaryMenu: effectiveMenu,
-      primaryMenuSource: "profile_client",
-      shortcuts: { items: [] },
-      isSupported: true,
-      supportsAtomicShortcuts: true,
-      isLoading: false,
-    }));
+  it("keeps a saved edit on screen until the refetch replaces the menu", async () => {
+    let effectiveMenu = MOVIES_MENU;
+    mocks.useUICustomization.mockImplementation(() =>
+      customization({ primaryMenu: effectiveMenu }),
+    );
 
     const view = render(<InterfaceSettings />);
-    fireEvent.click(screen.getByRole("button", { name: "Remove Movies · Library" }));
-    fireEvent.click(screen.getByRole("button", { name: "Save menu" }));
+    fireEvent.click(screen.getByRole("button", { name: "Move Calendar up" }));
     await waitFor(() => expect(setMutateAsync).toHaveBeenCalledTimes(1));
-    await waitFor(() => expect(screen.getByRole("button", { name: "Save menu" })).toBeDisabled());
-
-    fireEvent.click(screen.getByRole("button", { name: "Remove Calendar" }));
-    effectiveMenu = {
-      items: [
-        { type: "builtin" as const, destination: "home" as const },
-        { type: "builtin" as const, destination: "calendar" as const },
-      ],
-    };
+
+    // The save resolved but the effective menu has not refetched yet.
     view.rerender(<InterfaceSettings />);
+    let labels = screen.getAllByRole("listitem").map((item) => item.textContent);
+    expect(labels).toEqual(["Home", "Calendar", "Movies · Library"]);
 
-    expect(screen.queryByText("Calendar")).not.toBeInTheDocument();
-    expect(screen.getByRole("button", { name: "Save menu" })).toBeEnabled();
+    effectiveMenu = { items: [HOME, CALENDAR, MOVIES] };
+    view.rerender(<InterfaceSettings />);
+    labels = screen.getAllByRole("listitem").map((item) => item.textContent);
+    expect(labels).toEqual(["Home", "Calendar", "Movies · Library"]);
   });
 
-  it("clears a just-saved override before its effective refetch arrives", async () => {
-    mocks.useUICustomization.mockReturnValue({
-      cardPresentation: { poster_size: "large", caption: "title" },
-      cardPresentationSource: "profile_client",
-      primaryMenu: {
-        items: [
-          { type: "builtin" as const, destination: "home" as const },
-          { type: "library" as const, library_id: 7, label: "Movies" },
-        ],
-      },
-      primaryMenuSource: "profile",
-      shortcuts: { items: [] },
-      isSupported: true,
-      supportsAtomicShortcuts: true,
-      isLoading: false,
-    });
+  it("puts the menu back when a save fails", async () => {
+    mocks.useUICustomization.mockReturnValue(customization({ primaryMenu: MOVIES_MENU }));
+    setMutateAsync.mockRejectedValueOnce(new Error("nope"));
+
+    render(<InterfaceSettings />);
+    fireEvent.click(screen.getByRole("button", { name: "Remove Movies · Library" }));
+
+    expect(await screen.findByText("Movies · Library")).toBeInTheDocument();
+  });
+
+  it("can reset a just-saved menu before its effective refetch arrives", async () => {
+    mocks.useUICustomization.mockReturnValue(
+      customization({ primaryMenu: MOVIES_MENU, primaryMenuSource: "profile" }),
+    );
 
     render(<InterfaceSettings />);
+    expect(screen.queryByRole("button", { name: "Reset menu" })).not.toBeInTheDocument();
     fireEvent.click(screen.getByRole("button", { name: "Remove Movies · Library" }));
-    fireEvent.click(screen.getByRole("button", { name: "Save menu" }));
     await waitFor(() => expect(setMutateAsync).toHaveBeenCalledTimes(1));
-    await waitFor(() => expect(screen.getByRole("button", { name: "Save menu" })).toBeDisabled());
 
-    fireEvent.click(screen.getByRole("button", { name: "Reset to default" }));
+    fireEvent.click(screen.getByRole("button", { name: "Reset menu" }));
 
     await waitFor(() =>
       expect(clearMutateAsync).toHaveBeenCalledWith({
@@ -223,75 +217,46 @@ describe("InterfaceSettings card resets", () => {
         identity: { scope: "profile_client" },
       }),
     );
-  });
-
-  it("discards an unsaved draft locally when no web-family override exists", async () => {
-    const effectiveMenu = {
-      items: [
-        { type: "builtin" as const, destination: "home" as const },
-        { type: "library" as const, library_id: 7, label: "Movies" },
-      ],
-    };
-    mocks.useUICustomization.mockReturnValue({
-      cardPresentation: { poster_size: "large", caption: "title" },
-      cardPresentationSource: "profile_client",
-      primaryMenu: effectiveMenu,
-      primaryMenuSource: "profile",
-      shortcuts: { items: [] },
-      isSupported: true,
-      supportsAtomicShortcuts: true,
-      isLoading: false,
-    });
-
-    render(<InterfaceSettings />);
-    fireEvent.click(screen.getByRole("button", { name: "Remove Movies · Library" }));
-    fireEvent.click(screen.getByRole("button", { name: "Reset to default" }));
-
-    expect(clearMutateAsync).not.toHaveBeenCalled();
     expect(await screen.findByText("Movies · Library")).toBeInTheDocument();
-    expect(screen.getByRole("button", { name: "Save menu" })).toBeDisabled();
   });
 
-  it("hides revision-five controls when the server does not support them", () => {
-    mocks.useUICustomization.mockReturnValue({
-      cardPresentation: { poster_size: "standard", caption: "title_metadata" },
-      cardPresentationSource: "default",
-      primaryMenu: null,
-      primaryMenuSource: "default",
-      shortcuts: { items: [] },
-      isSupported: false,
-      supportsAtomicShortcuts: false,
-      isLoading: false,
-      isUnavailable: false,
-    });
+  it("explains an old server once and still shows shortcuts and badges", () => {
+    mocks.useUICustomization.mockReturnValue(
+      customization({
+        cardPresentationSource: "default",
+        primaryMenu: null,
+        primaryMenuSource: "default",
+        isSupported: false,
+        supportsAtomicShortcuts: false,
+      }),
+    );
 
     render(<InterfaceSettings />);
 
-    expect(screen.getByRole("alert")).toHaveTextContent("Server upgrade required");
-    expect(screen.queryByRole("radiogroup", { name: "Poster size" })).not.toBeInTheDocument();
-    expect(screen.queryByRole("button", { name: "Save menu" })).not.toBeInTheDocument();
+    expect(screen.getByRole("alert")).toHaveTextContent("Your server needs an update");
+    expect(screen.queryByRole("radiogroup", { name: "Size" })).not.toBeInTheDocument();
+    expect(screen.queryByRole("list", { name: "Menu links" })).not.toBeInTheDocument();
+    expect(screen.getByRole("region", { name: "Card overlays" })).toBeInTheDocument();
+    expect(screen.getByRole("figure", { name: "Preview" })).toBeInTheDocument();
   });
 
   it("keeps editors closed when effective customization could not be loaded", () => {
-    mocks.useUICustomization.mockReturnValue({
-      cardPresentation: { poster_size: "standard", caption: "title_metadata" },
-      cardPresentationSource: "default",
-      primaryMenu: null,
-      primaryMenuSource: "default",
-      shortcuts: { items: [] },
-      isSupported: true,
-      supportsAtomicShortcuts: true,
-      isLoading: false,
-      isUnavailable: true,
-    });
+    mocks.useUICustomization.mockReturnValue(
+      customization({
+        cardPresentationSource: "default",
+        primaryMenu: null,
+        primaryMenuSource: "default",
+        isUnavailable: true,
+      }),
+    );
 
     render(<InterfaceSettings />);
 
-    expect(screen.getByRole("alert")).toHaveTextContent("Customization unavailable");
-    expect(screen.getByRole("alert")).toHaveTextContent("Editing stays disabled");
-    expect(screen.queryByRole("radiogroup", { name: "Poster size" })).not.toBeInTheDocument();
-    expect(screen.queryByRole("button", { name: "Save menu" })).not.toBeInTheDocument();
+    expect(screen.getByRole("alert")).toHaveTextContent("Editing is off until they load");
+    expect(screen.queryByRole("radiogroup", { name: "Size" })).not.toBeInTheDocument();
+    expect(screen.queryByRole("list", { name: "Menu links" })).not.toBeInTheDocument();
     expect(setMutateAsync).not.toHaveBeenCalled();
     expect(clearMutateAsync).not.toHaveBeenCalled();
+    expect(screen.getByRole("region", { name: "Card overlays" })).toBeInTheDocument();
   });
 });
diff --git a/web/src/pages/settings/InterfaceSettings.tsx b/web/src/pages/settings/InterfaceSettings.tsx
index 506d5db3ff..a496d1437c 100644
--- a/web/src/pages/settings/InterfaceSettings.tsx
+++ b/web/src/pages/settings/InterfaceSettings.tsx
@@ -1,7 +1,8 @@
-import { useMemo, useState } from "react";
-import { ArrowDown, ArrowUp, Check, Monitor, RotateCcw, X } from "lucide-react";
+import { useCallback, useEffect, useMemo, useRef, useState, type ReactNode } from "react";
+import { ArrowDown, ArrowUp, X } from "lucide-react";
 import { toast } from "sonner";
 
+import { PageHeader } from "@/components/page/PageHeader";
 import { SettingsGroup } from "@/components/settings/SettingsGroup";
 import { Button } from "@/components/ui/button";
 import {
@@ -16,7 +17,6 @@ import { useUserLibraries } from "@/hooks/queries/libraries";
 import { useClearSettingValue, useSetSettingValue } from "@/hooks/queries/settingValues";
 import { SETTING_KEYS } from "@/lib/settingsContract";
 import {
-  CARD_PRESENTATION_PRESETS,
   defaultWebPrimaryMenu,
   menuItemKey,
   moveMenuItem,
@@ -25,10 +25,17 @@ import {
   type PosterSize,
   type PrimaryMenuItem,
 } from "@/lib/uiCustomization";
-import { cn } from "@/lib/utils";
-import { TitleArtSettingsGroup } from "./TitleArtSettingsGroup";
+
+import { CardOverlaySettings } from "./CardOverlaySettings";
+import { ChoiceButtons } from "./ChoiceButtons";
+import { PosterCardPreview } from "./PosterCardPreview";
+import { ResetButton } from "./ResetButton";
 
 const CLIENT_SCOPE = { scope: "profile_client" } as const;
+const DEVICE_SCOPE = { scope: "profile_device" } as const;
+
+/** How long the preview keeps the hover-only shortcut buttons showing after a pick. */
+const SHORTCUT_REVEAL_MS = 2500;
 
 const BUILTIN_LABELS: Record<string, string> = {
   home: "Home",
@@ -48,6 +55,18 @@ const ADDABLE_WEB_BUILTINS: PrimaryMenuItem[] = [
   { type: "builtin", destination: "calendar" },
 ];
 
+const POSTER_SIZES: readonly { value: PosterSize; label: string }[] = [
+  { value: "compact", label: "Compact" },
+  { value: "standard", label: "Standard" },
+  { value: "large", label: "Large" },
+];
+
+const CAPTIONS: readonly { value: CardCaption; label: string }[] = [
+  { value: "title_metadata", label: "Title and details" },
+  { value: "title", label: "Title only" },
+  { value: "artwork", label: "Nothing" },
+];
+
 function menuItemLabel(item: PrimaryMenuItem): string {
   if (item.type === "builtin") return BUILTIN_LABELS[item.destination] ?? item.destination;
   if (item.type === "library") return `${item.label} · Library`;
@@ -55,78 +74,203 @@ function menuItemLabel(item: PrimaryMenuItem): string {
   return `${item.label} · Collection`;
 }
 
-function samePresentation(left: CardPresentation, right: CardPresentation) {
-  return left.poster_size === right.poster_size && left.caption === right.caption;
+function errorMessage(error: unknown, fallback: string) {
+  return error instanceof Error ? error.message : fallback;
 }
 
-function CardPreview({ presentation }: { presentation: CardPresentation }) {
-  const widths =
-    presentation.poster_size === "compact"
-      ? ["w-12", "w-12", "w-12", "w-12"]
-      : presentation.poster_size === "large"
-        ? ["w-20", "w-20"]
-        : ["w-16", "w-16", "w-16"];
+export default function InterfaceSettings() {
+  const [revealShortcuts, setRevealShortcuts] = useState(false);
+  const revealTimer = useRef<number | undefined>(undefined);
+  useEffect(() => () => window.clearTimeout(revealTimer.current), []);
+  const flashShortcuts = useCallback(() => {
+    setRevealShortcuts(true);
+    window.clearTimeout(revealTimer.current);
+    revealTimer.current = window.setTimeout(() => setRevealShortcuts(false), SHORTCUT_REVEAL_MS);
+  }, []);
+
   return (
-    <div className="bg-background/35 flex min-h-40 items-start gap-3 overflow-hidden rounded-xl border border-white/8 p-4">
-      {widths.map((width, index) => (
-        <div key={index} className={cn("shrink-0", width)}>
-          <div className="from-primary/45 to-accent aspect-[2/3] rounded-lg bg-gradient-to-br" />
-          {presentation.caption !== "artwork" ? (
-            <>
-              <div className="bg-foreground/75 mt-2 h-2 w-4/5 rounded-full" />
-              {presentation.caption === "title_metadata" ? (
-                <div className="bg-muted-foreground/45 mt-1.5 h-1.5 w-1/2 rounded-full" />
-              ) : null}
-            </>
-          ) : null}
+    <div className="space-y-6">
+      <PageHeader
+        title="Navigation & Cards"
+        subtitle="Choose how posters look and which links sit in your menu. Changes save as you make them."
+      />
+      {/* The preview sits beside the poster controls once there is room, and
+          stays in view while they scroll. On narrow screens it leads. */}
+      <div className="grid gap-x-10 @5xl:grid-cols-[minmax(0,1fr)_19rem]">
+        <aside className="pb-2 @5xl:order-last @5xl:pb-0">
+          <div className="@5xl:sticky @5xl:top-6 @5xl:pt-6">
+            <PosterCardPreview revealShortcuts={revealShortcuts} />
+          </div>
+        </aside>
+        <div className="min-w-0">
+          <PosterSettings />
+          <CardOverlaySettings onShortcutsPicked={flashShortcuts} />
+          <MenuSettings />
         </div>
-      ))}
+      </div>
     </div>
   );
 }
 
-function InterfaceHeader() {
+/** A short, plain note with one action, for a setting this browser overrides. */
+function OverrideNotice({
+  children,
+  action,
+  disabled,
+  onAction,
+}: {
+  children: ReactNode;
+  action: string;
+  disabled: boolean;
+  onAction: () => void;
+}) {
   return (
-    <header className="space-y-2">
-      <h2 className="text-2xl font-semibold tracking-tight sm:text-3xl">Navigation & cards</h2>
-      <p className="text-muted-foreground text-sm">
-        These choices sync between web browsers signed into this profile. TV, mobile, tablet, and
-        desktop-native apps keep their own matching-device layouts.
-      </p>
-    </header>
+    <div className="border-border/70 bg-muted/25 flex flex-col gap-3 rounded-xl border p-4 sm:flex-row sm:items-center sm:justify-between">
+      <p className="text-muted-foreground text-sm">{children}</p>
+      <Button type="button" variant="outline" size="sm" disabled={disabled} onClick={onAction}>
+        {action}
+      </Button>
+    </div>
   );
 }
 
-export default function InterfaceSettings() {
+/**
+ * What to show instead of the web layout controls while they cannot be
+ * edited, or null when they can.
+ */
+function useCustomizationBlocker(): ReactNode {
+  const customization = useUICustomization();
+  if (customization.isLoading) {
+    return <p className="text-muted-foreground text-sm">Loading…</p>;
+  }
+  if (customization.isUnavailable) {
+    return (
+      <div className="surface-panel-subtle rounded-xl border p-4" role="alert">
+        <p className="font-medium">Couldn't load your poster and menu settings</p>
+        <p className="text-muted-foreground mt-1 text-sm">
+          Editing is off until they load, so nothing you chose earlier gets overwritten.
+        </p>
+      </div>
+    );
+  }
+  if (!customization.isSupported) {
+    return (
+      <div className="surface-panel-subtle rounded-xl border p-4" role="alert">
+        <p className="font-medium">Your server needs an update</p>
+        <p className="text-muted-foreground mt-1 text-sm">
+          Poster size, captions, and the menu can be changed once your server runs a newer version
+          of Prairie.
+        </p>
+      </div>
+    );
+  }
+  return null;
+}
+
+/** Poster size and caption, stored for the web client family. */
+function PosterSettings() {
+  const customization = useUICustomization();
+  const setValue = useSetSettingValue();
+  const clearValue = useClearSettingValue();
+  const blocker = useCustomizationBlocker();
+  const presentation = customization.cardPresentation;
+  const deviceOverride = customization.cardPresentationSource === "profile_device";
+  const clientOverride = customization.cardPresentationSource === "profile_client";
+  const busy = setValue.isPending || clearValue.isPending;
+
+  async function save(next: CardPresentation) {
+    try {
+      await setValue.mutateAsync({
+        key: SETTING_KEYS.UI_CARD_PRESENTATION,
+        value: next,
+        identity: CLIENT_SCOPE,
+      });
+    } catch (error) {
+      toast.error(errorMessage(error, "Couldn't save poster settings"));
+    }
+  }
+
+  async function clear(identity: typeof CLIENT_SCOPE | typeof DEVICE_SCOPE) {
+    try {
+      await clearValue.mutateAsync({ key: SETTING_KEYS.UI_CARD_PRESENTATION, identity });
+    } catch (error) {
+      toast.error(errorMessage(error, "Couldn't reset poster settings"));
+    }
+  }
+
+  return (
+    <SettingsGroup
+      title="Posters"
+      description="How big posters are, and what's written under them, in your web browsers."
+      actions={
+        !blocker && clientOverride ? (
+          <ResetButton
+            label="Reset poster settings"
+            disabled={busy}
+            onClick={() => void clear(CLIENT_SCOPE)}
+          />
+        ) : null
+      }
+    >
+      {blocker ?? (
+        <>
+          {deviceOverride ? (
+            <OverrideNotice
+              action="Match my other browsers"
+              disabled={busy}
+              onAction={() => void clear(DEVICE_SCOPE)}
+            >
+              This browser has its own poster settings, so changes here won't show in it.
+            </OverrideNotice>
+          ) : null}
+          <ChoiceButtons
+            label="Size"
+            value={presentation.poster_size}
+            options={POSTER_SIZES}
+            disabled={busy || deviceOverride}
+            onChange={(poster_size) => void save({ ...presentation, poster_size })}
+          />
+          <ChoiceButtons
+            label="Under each poster"
+            value={presentation.caption}
+            options={CAPTIONS}
+            disabled={busy || deviceOverride}
+            onChange={(caption) => void save({ ...presentation, caption })}
+          />
+        </>
+      )}
+    </SettingsGroup>
+  );
+}
+
+/** The ordered links in the web menu, stored for the web client family. Saves on every edit. */
+function MenuSettings() {
   const { data: libraries = [] } = useUserLibraries();
   const customization = useUICustomization();
   const setValue = useSetSettingValue();
   const clearValue = useClearSettingValue();
+  const blocker = useCustomizationBlocker();
   const baselineMenu = useMemo(
     () => customization.primaryMenu ?? defaultWebPrimaryMenu(),
     [customization.primaryMenu],
   );
   const baselineKey = useMemo(() => JSON.stringify(baselineMenu.items), [baselineMenu.items]);
-  const [menuDraft, setMenuDraft] = useState<{
-    baselineKey: string;
-    /** The just-saved baseline expected from the asynchronous query refresh. */
-    pendingBaselineKey?: string;
-    items: PrimaryMenuItem[];
-    dirty: boolean;
-  } | null>(null);
-  const [addItemKey, setAddItemKey] = useState("");
-  const menuDraftMatchesBaseline =
-    menuDraft?.baselineKey === baselineKey || menuDraft?.pendingBaselineKey === baselineKey;
-  const menuItems = menuDraftMatchesBaseline ? menuDraft.items : baselineMenu.items;
-  const menuDirty = menuDraftMatchesBaseline === true && menuDraft.dirty;
-  const cardPresentation = customization.cardPresentation;
-  const cardDeviceOverride = customization.cardPresentationSource === "profile_device";
-  const cardClientOverride = customization.cardPresentationSource === "profile_client";
-  const menuDeviceOverride = customization.primaryMenuSource === "profile_device";
-  const menuClientOverride = customization.primaryMenuSource === "profile_client";
-  const menuMutationPending = setValue.isPending || clearValue.isPending;
-  const cardMutationPending = menuMutationPending || cardDeviceOverride;
-  const menuAtLimit = menuItems.length >= 64;
+  // The menu as last saved from here, shown until the effective menu it was
+  // saved over is replaced by the refetch (or while the save is in flight), so
+  // an edit never blinks back to the old order.
+  const [saved, setSaved] = useState<{ items: PrimaryMenuItem[]; overBaselineKey: string } | null>(
+    null,
+  );
+  const busy = setValue.isPending || clearValue.isPending;
+  const showSaved = saved !== null && (setValue.isPending || saved.overBaselineKey === baselineKey);
+  // Once the refetch has replaced the menu it was saved over, the effective
+  // menu is the truth again; drop the copy so it can never resurface.
+  if (saved !== null && !showSaved) setSaved(null);
+  const menuItems = showSaved ? saved.items : baselineMenu.items;
+  const deviceOverride = customization.primaryMenuSource === "profile_device";
+  const clientOverride = customization.primaryMenuSource === "profile_client" || saved !== null;
+  const locked = busy || deviceOverride;
+  const atLimit = menuItems.length >= 64;
 
   const availableItems = useMemo(() => {
     const current = new Set(menuItems.map(menuItemKey));
@@ -151,431 +295,127 @@ export default function InterfaceSettings() {
     }
     return [...unique.values()];
   }, [customization.shortcuts.items, libraries, menuItems]);
-  const selectedAddItem = availableItems.find((item) => menuItemKey(item) === addItemKey);
 
-  async function saveCardPresentation(next: CardPresentation) {
-    try {
-      await setValue.mutateAsync({
-        key: SETTING_KEYS.UI_CARD_PRESENTATION,
-        value: next,
-        identity: CLIENT_SCOPE,
-      });
-    } catch (error) {
-      toast.error(error instanceof Error ? error.message : "Could not save card layout");
-    }
-  }
-
-  async function resetCardPresentation() {
-    try {
-      await clearValue.mutateAsync({
-        key: SETTING_KEYS.UI_CARD_PRESENTATION,
-        identity: CLIENT_SCOPE,
-      });
-      toast.success("Web-family card layout reset");
-    } catch (error) {
-      toast.error(error instanceof Error ? error.message : "Could not reset card layout");
-    }
-  }
-
-  async function clearDeviceOverride(
-    key: typeof SETTING_KEYS.UI_CARD_PRESENTATION | typeof SETTING_KEYS.NAV_PRIMARY_MENU,
-    label: string,
-  ) {
-    try {
-      await clearValue.mutateAsync({
-        key,
-        identity: { scope: "profile_device" },
-      });
-      toast.success(`${label} now follows the web-family preference`);
-    } catch (error) {
-      toast.error(
-        error instanceof Error ? error.message : `Could not clear ${label.toLowerCase()}`,
-      );
-    }
-  }
-
-  function updateMenu(next: PrimaryMenuItem[]) {
-    setMenuDraft((current) => {
-      if (current?.pendingBaselineKey === baselineKey) {
-        return { baselineKey, items: next, dirty: true };
-      }
-      if (current?.baselineKey === baselineKey) {
-        return { ...current, items: next, dirty: true };
-      }
-      return { baselineKey, items: next, dirty: true };
-    });
-  }
-
-  async function saveMenu() {
-    const savedItems = menuItems;
-    const savedBaselineKey = JSON.stringify(savedItems);
+  async function saveMenu(next: PrimaryMenuItem[]) {
+    setSaved({ items: next, overBaselineKey: baselineKey });
     try {
       await setValue.mutateAsync({
         key: SETTING_KEYS.NAV_PRIMARY_MENU,
-        value: { items: savedItems },
+        value: { items: next },
         identity: CLIENT_SCOPE,
       });
-      setMenuDraft((current) => {
-        const currentItemsKey = current ? JSON.stringify(current.items) : null;
-        if (current?.dirty && currentItemsKey !== savedBaselineKey) {
-          return { ...current, pendingBaselineKey: savedBaselineKey };
-        }
-        return {
-          baselineKey,
-          pendingBaselineKey: savedBaselineKey,
-          items: savedItems,
-          dirty: false,
-        };
-      });
-      toast.success("Web navigation saved");
     } catch (error) {
-      toast.error(error instanceof Error ? error.message : "Could not save navigation");
+      setSaved(null);
+      toast.error(errorMessage(error, "Couldn't save your menu"));
     }
   }
 
-  async function resetMenu() {
-    const pendingClientOverride = menuDraft?.pendingBaselineKey !== undefined;
-    if (!menuClientOverride && !pendingClientOverride) {
-      setMenuDraft(null);
-      toast.success("Web navigation reset");
-      return;
-    }
+  async function clear(identity: typeof CLIENT_SCOPE | typeof DEVICE_SCOPE) {
     try {
-      await clearValue.mutateAsync({
-        key: SETTING_KEYS.NAV_PRIMARY_MENU,
-        identity: CLIENT_SCOPE,
-      });
-      setMenuDraft(null);
-      toast.success("Web navigation reset");
+      await clearValue.mutateAsync({ key: SETTING_KEYS.NAV_PRIMARY_MENU, identity });
+      setSaved(null);
     } catch (error) {
-      toast.error(error instanceof Error ? error.message : "Could not reset navigation");
+      toast.error(errorMessage(error, "Couldn't reset your menu"));
     }
   }
 
-  if (customization.isLoading) {
-    return (
-      <div className="space-y-6">
-        <InterfaceHeader />
-        <div className="surface-panel-subtle text-muted-foreground rounded-xl border p-5 text-sm">
-          Checking server support…
-        </div>
-      </div>
-    );
-  }
-
-  if (customization.isUnavailable) {
-    return (
-      <div className="space-y-6">
-        <InterfaceHeader />
-        <div className="surface-panel-subtle rounded-xl border p-5" role="alert">
-          <p className="font-medium">Customization unavailable</p>
-          <p className="text-muted-foreground mt-1 text-sm">
-            Saved navigation and card settings could not be loaded. Editing stays disabled to
-            protect your existing choices.
-          </p>
-        </div>
-      </div>
-    );
-  }
-
-  if (!customization.isSupported) {
-    return (
-      <div className="space-y-6">
-        <InterfaceHeader />
-        <div className="surface-panel-subtle rounded-xl border p-5" role="alert">
-          <p className="font-medium">Server upgrade required</p>
-          <p className="text-muted-foreground mt-1 text-sm">
-            This server does not support synchronized navigation and card customization yet.
-          </p>
-        </div>
-      </div>
-    );
-  }
+  // The poster section already explains why neither can be edited.
+  if (blocker) return null;
 
   return (
-    <div className="space-y-6">
-      <InterfaceHeader />
-
-      <SettingsGroup
-        title="Card preset"
-        description="Start with a complete layout, then adjust poster size or captions below."
-      >
-        {cardDeviceOverride ? (
-          <div className="border-border/70 bg-muted/25 mb-4 flex flex-col gap-3 rounded-xl border p-4 sm:flex-row sm:items-center sm:justify-between">
-            <p className="text-muted-foreground text-sm">
-              This browser has a higher-priority device override. Clear it before editing the
-              preference shared by web browsers.
-            </p>
-            <Button
-              type="button"
-              variant="outline"
-              disabled={menuMutationPending}
-              onClick={() =>
-                void clearDeviceOverride(SETTING_KEYS.UI_CARD_PRESENTATION, "Card layout")
-              }
-            >
-              Use web-family layout
-            </Button>
-          </div>
+    <SettingsGroup
+      title="Menu"
+      description="The links along the top of Prairie in your web browsers. Search and your profile are always there."
+      actions={
+        clientOverride ? (
+          <ResetButton
+            label="Reset menu"
+            disabled={locked}
+            onClick={() => void clear(CLIENT_SCOPE)}
+          />
+        ) : null
+      }
+    >
+      <>
+        {deviceOverride ? (
+          <OverrideNotice
+            action="Match my other browsers"
+            disabled={busy}
+            onAction={() => void clear(DEVICE_SCOPE)}
+          >
+            This browser has its own menu, so changes here won't show in it.
+          </OverrideNotice>
         ) : null}
-        <div className="grid gap-3 sm:grid-cols-2">
-          {CARD_PRESENTATION_PRESETS.map((preset) => {
-            const active = samePresentation(cardPresentation, preset.value);
+        <ol className="space-y-2" aria-label="Menu links">
+          {menuItems.map((item, index) => {
+            const label = menuItemLabel(item);
+            const home = item.type === "builtin" && item.destination === "home";
             return (
-              <button
-                key={preset.id}
-                type="button"
-                onClick={() => void saveCardPresentation(preset.value)}
-                aria-pressed={active}
-                disabled={cardMutationPending}
-                className={cn(
-                  "surface-panel-subtle relative rounded-xl border p-4 text-left transition-colors",
-                  active ? "border-primary/50 bg-primary/8" : "border-border/70 hover:bg-accent/45",
-                  "disabled:cursor-not-allowed disabled:opacity-60",
-                )}
+              <li
+                key={menuItemKey(item)}
+                className="surface-panel-subtle border-border/65 flex items-center gap-3 rounded-xl border px-3 py-2"
               >
-                <div className="flex items-start justify-between gap-3">
-                  <div>
-                    <p className="text-sm font-semibold">{preset.label}</p>
-                    <p className="text-muted-foreground mt-1 text-xs leading-relaxed">
-                      {preset.description}
-                    </p>
-                  </div>
-                  {active ? <Check className="text-primary h-4 w-4 shrink-0" /> : null}
-                </div>
-              </button>
-            );
-          })}
-        </div>
-      </SettingsGroup>
-
-      <SettingsGroup
-        title="Poster cards"
-        description="Fine-tune density and the rows shown below artwork. Changes apply immediately."
-      >
-        <div className="grid gap-5 lg:grid-cols-[minmax(0,1fr)_minmax(240px,0.8fr)]">
-          <div className="space-y-5">
-            <div className="space-y-2">
-              <p className="text-sm font-medium">Poster size</p>
-              <div className="flex flex-wrap gap-2" role="radiogroup" aria-label="Poster size">
-                {(
-                  [
-                    ["compact", "Compact"],
-                    ["standard", "Standard"],
-                    ["large", "Large"],
-                  ] as const
-                ).map(([value, label]) => (
+                <span className="min-w-0 flex-1 truncate text-sm font-medium">{label}</span>
+                <div className="flex shrink-0 items-center gap-1">
                   <Button
-                    key={value}
                     type="button"
-                    role="radio"
-                    aria-checked={cardPresentation.poster_size === value}
-                    size="sm"
-                    variant={cardPresentation.poster_size === value ? "default" : "outline"}
-                    disabled={cardMutationPending}
-                    onClick={() =>
-                      void saveCardPresentation({
-                        ...cardPresentation,
-                        poster_size: value as PosterSize,
-                      })
-                    }
+                    variant="ghost"
+                    size="icon"
+                    disabled={locked || index === 0}
+                    aria-label={`Move ${label} up`}
+                    onClick={() => void saveMenu(moveMenuItem(menuItems, index, -1))}
+                  >
+                    <ArrowUp className="h-4 w-4" />
+                  </Button>
+                  <Button
+                    type="button"
+                    variant="ghost"
+                    size="icon"
+                    disabled={locked || index === menuItems.length - 1}
+                    aria-label={`Move ${label} down`}
+                    onClick={() => void saveMenu(moveMenuItem(menuItems, index, 1))}
                   >
-                    {label}
+                    <ArrowDown className="h-4 w-4" />
                   </Button>
-                ))}
-              </div>
-            </div>
-            <div className="space-y-2">
-              <p className="text-sm font-medium">Caption</p>
-              <div className="flex flex-wrap gap-2" role="radiogroup" aria-label="Card caption">
-                {(
-                  [
-                    ["title_metadata", "Title & metadata"],
-                    ["title", "Title only"],
-                    ["artwork", "Artwork only"],
-                  ] as const
-                ).map(([value, label]) => (
                   <Button
-                    key={value}
                     type="button"
-                    role="radio"
-                    aria-checked={cardPresentation.caption === value}
-                    size="sm"
-                    variant={cardPresentation.caption === value ? "default" : "outline"}
-                    disabled={cardMutationPending}
+                    variant="ghost"
+                    size="icon"
+                    disabled={locked || home}
+                    aria-label={home ? "Home can't be removed" : `Remove ${label}`}
                     onClick={() =>
-                      void saveCardPresentation({
-                        ...cardPresentation,
-                        caption: value as CardCaption,
-                      })
+                      void saveMenu(menuItems.filter((_, itemIndex) => itemIndex !== index))
                     }
                   >
-                    {label}
+                    <X className="h-4 w-4" />
                   </Button>
-                ))}
-              </div>
-            </div>
-          </div>
-          <CardPreview presentation={cardPresentation} />
-        </div>
-        {cardClientOverride ? (
-          <div className="border-border/70 mt-5 flex flex-col gap-3 border-t pt-4 sm:flex-row sm:items-center sm:justify-between">
-            <p id="card-layout-reset-description" className="text-muted-foreground text-sm">
-              Remove the layout shared by web browsers and inherit the profile or app default.
-            </p>
-            <Button
-              type="button"
-              variant="outline"
-              disabled={menuMutationPending}
-              aria-describedby="card-layout-reset-description"
-              onClick={() => void resetCardPresentation()}
-            >
-              <RotateCcw className="mr-1.5 h-4 w-4" />
-              Reset web-family card layout
-            </Button>
-          </div>
+                </div>
+              </li>
+            );
+          })}
+        </ol>
+        {availableItems.length > 0 ? (
+          <Select
+            value=""
+            disabled={locked || atLimit}
+            onValueChange={(key) => {
+              const item = availableItems.find((candidate) => menuItemKey(candidate) === key);
+              if (item) void saveMenu([...menuItems, item]);
+            }}
+          >
+            <SelectTrigger className="w-full sm:max-w-xs" aria-label="Add a link">
+              <SelectValue placeholder="Add a link…" />
+            </SelectTrigger>
+            <SelectContent>
+              {availableItems.map((item) => (
+                <SelectItem key={menuItemKey(item)} value={menuItemKey(item)}>
+                  {menuItemLabel(item)}
+                </SelectItem>
+              ))}
+            </SelectContent>
+          </Select>
         ) : null}
-      </SettingsGroup>
-
-      <TitleArtSettingsGroup />
-
-      <SettingsGroup
-        title="Primary menu"
-        description="Choose the ordered shortcuts at the top of the web menu. Home stays available; search and profile controls are fixed."
-      >
-        <div className="space-y-4">
-          <div className="text-muted-foreground flex items-center gap-2 text-xs">
-            <Monitor className="h-4 w-4" />
-            Web browsers
-          </div>
-          {menuDeviceOverride ? (
-            <div className="border-border/70 bg-muted/25 flex flex-col gap-3 rounded-xl border p-4 sm:flex-row sm:items-center sm:justify-between">
-              <p className="text-muted-foreground text-sm">
-                This browser has a higher-priority device menu. Clear it before editing the menu
-                shared by web browsers.
-              </p>
-              <Button
-                type="button"
-                variant="outline"
-                disabled={menuMutationPending}
-                onClick={() =>
-                  void clearDeviceOverride(SETTING_KEYS.NAV_PRIMARY_MENU, "Navigation")
-                }
-              >
-                Use web-family menu
-              </Button>
-            </div>
-          ) : null}
-          <ol className="space-y-2">
-            {menuItems.map((item, index) => {
-              const home = item.type === "builtin" && item.destination === "home";
-              return (
-                <li
-                  key={menuItemKey(item)}
-                  className="surface-panel-subtle border-border/65 flex items-center gap-3 rounded-xl border px-3 py-2.5"
-                >
-                  <span className="text-muted-foreground w-6 shrink-0 text-center text-xs tabular-nums">
-                    {index + 1}
-                  </span>
-                  <span className="min-w-0 flex-1 truncate text-sm font-medium">
-                    {menuItemLabel(item)}
-                  </span>
-                  <div className="flex shrink-0 items-center gap-1">
-                    <Button
-                      type="button"
-                      variant="ghost"
-                      size="icon"
-                      disabled={menuMutationPending || menuDeviceOverride || index === 0}
-                      aria-label={`Move ${menuItemLabel(item)} up`}
-                      onClick={() => updateMenu(moveMenuItem(menuItems, index, -1))}
-                    >
-                      <ArrowUp className="h-4 w-4" />
-                    </Button>
-                    <Button
-                      type="button"
-                      variant="ghost"
-                      size="icon"
-                      disabled={
-                        menuMutationPending || menuDeviceOverride || index === menuItems.length - 1
-                      }
-                      aria-label={`Move ${menuItemLabel(item)} down`}
-                      onClick={() => updateMenu(moveMenuItem(menuItems, index, 1))}
-                    >
-                      <ArrowDown className="h-4 w-4" />
-                    </Button>
-                    <Button
-                      type="button"
-                      variant="ghost"
-                      size="icon"
-                      disabled={menuMutationPending || menuDeviceOverride || home}
-                      aria-label={home ? "Home cannot be removed" : `Remove ${menuItemLabel(item)}`}
-                      onClick={() =>
-                        updateMenu(menuItems.filter((_, itemIndex) => itemIndex !== index))
-                      }
-                    >
-                      <X className="h-4 w-4" />
-                    </Button>
-                  </div>
-                </li>
-              );
-            })}
-          </ol>
-
-          {availableItems.length > 0 ? (
-            <div className="flex flex-col gap-2 sm:flex-row sm:items-center">
-              <Select
-                value={addItemKey}
-                onValueChange={setAddItemKey}
-                disabled={menuMutationPending || menuDeviceOverride || menuAtLimit}
-              >
-                <SelectTrigger className="w-full sm:max-w-sm">
-                  <SelectValue placeholder="Choose destination or shortcut" />
-                </SelectTrigger>
-                <SelectContent>
-                  {availableItems.map((item) => (
-                    <SelectItem key={menuItemKey(item)} value={menuItemKey(item)}>
-                      {menuItemLabel(item)}
-                    </SelectItem>
-                  ))}
-                </SelectContent>
-              </Select>
-              <Button
-                type="button"
-                variant="secondary"
-                disabled={
-                  !selectedAddItem || menuMutationPending || menuDeviceOverride || menuAtLimit
-                }
-                onClick={() => {
-                  if (!selectedAddItem) return;
-                  updateMenu([...menuItems, selectedAddItem]);
-                  setAddItemKey("");
-                }}
-              >
-                Add to menu
-              </Button>
-            </div>
-          ) : null}
-
-          <div className="flex flex-wrap gap-2 pt-1">
-            <Button
-              type="button"
-              onClick={() => void saveMenu()}
-              disabled={!menuDirty || menuMutationPending || menuDeviceOverride}
-            >
-              Save menu
-            </Button>
-            <Button
-              type="button"
-              variant="outline"
-              onClick={() => void resetMenu()}
-              disabled={menuMutationPending || menuDeviceOverride}
-            >
-              <RotateCcw className="mr-1.5 h-4 w-4" />
-              Reset to default
-            </Button>
-          </div>
-        </div>
-      </SettingsGroup>
-    </div>
+      </>
+    </SettingsGroup>
   );
 }
diff --git a/web/src/pages/settings/LibrarySettings.tsx b/web/src/pages/settings/LibrarySettings.tsx
index a516214e72..8dd1b3d515 100644
--- a/web/src/pages/settings/LibrarySettings.tsx
+++ b/web/src/pages/settings/LibrarySettings.tsx
@@ -1,5 +1,6 @@
 import { useEffect, useId, useState, type ReactNode } from "react";
 import type { UserLibrary } from "@/api/types";
+import { PageHeader } from "@/components/page/PageHeader";
 import { Badge } from "@/components/ui/badge";
 import { LanguageSelect } from "@/components/settings/LanguageSelect";
 import { SettingRow } from "@/components/settings/SettingRow";
@@ -170,7 +171,7 @@ function PlaybackField({
         </SelectTrigger>
         <SelectContent>{children}</SelectContent>
       </Select>
-      {hint && <p className="text-muted-foreground/70 text-[11px] leading-tight">{hint}</p>}
+      {hint && <p className="text-muted-foreground text-xs leading-tight">{hint}</p>}
     </div>
   );
 }
@@ -210,7 +211,7 @@ function LanguageField({
       >
         {children}
       </LanguageSelect>
-      {hint && <p className="text-muted-foreground/70 text-[11px] leading-tight">{hint}</p>}
+      {hint && <p className="text-muted-foreground text-xs leading-tight">{hint}</p>}
     </div>
   );
 }
@@ -367,11 +368,11 @@ function LibraryCard({
         <div className="min-w-0 flex-1">
           <div className="flex flex-wrap items-center gap-2">
             <span className="truncate text-sm font-medium">{library.name}</span>
-            <Badge variant="outline" className="shrink-0 text-[11px] capitalize">
+            <Badge variant="outline" className="shrink-0 capitalize">
               {library.type}
             </Badge>
             {hasOverride && (
-              <Badge variant="secondary" className="shrink-0 text-[11px]">
+              <Badge variant="secondary" className="shrink-0">
                 Custom
               </Badge>
             )}
@@ -527,7 +528,7 @@ export default function LibrarySettings() {
   useEffect(() => {
     // Keep the editable local order in sync with the latest saved setting.
     // This supports optimistic updates and rollback without changing behavior.
-    // eslint-disable-next-line react-hooks/set-state-in-effect
+    // eslint-disable-next-line react-hooks/set-state-in-effect -- mirrors the saved setting into editable state
     setDisabledLibraryIDs(
       libraries
         ? sortLibrariesByOrder(libraries, savedDisabledLibraryIDs)
@@ -537,7 +538,7 @@ export default function LibrarySettings() {
 
   useEffect(() => {
     if (!libraries) return;
-    // eslint-disable-next-line react-hooks/set-state-in-effect
+    // eslint-disable-next-line react-hooks/set-state-in-effect -- mirrors the saved order into editable state
     setOrderedLibraries(
       savedLibraryOrder.length > 0 ? applyLibraryOrder(libraries, savedLibraryOrder) : libraries,
     );
@@ -657,13 +658,10 @@ export default function LibrarySettings() {
 
   return (
     <div className="space-y-6">
-      <div className="space-y-3">
-        <h2 className="text-2xl font-semibold tracking-tight sm:text-3xl">Libraries</h2>
-        <p className="text-muted-foreground max-w-2xl text-sm leading-relaxed">
-          Toggle which libraries appear in your navigation and customize playback defaults per
-          library.
-        </p>
-      </div>
+      <PageHeader
+        title="Libraries"
+        subtitle="Toggle which libraries appear in your navigation and customize playback defaults per library."
+      />
 
       <SettingsGroup
         title="Browsing"
@@ -734,7 +732,7 @@ export default function LibrarySettings() {
             <div className="surface-panel flex items-center gap-3 rounded-[1.5rem] px-4 py-4 shadow-lg">
               <GripVertical className="text-muted-foreground h-4 w-4" />
               <span className="text-sm font-medium">{activeLibrary.name}</span>
-              <Badge variant="outline" className="text-[11px] capitalize">
+              <Badge variant="outline" className="capitalize">
                 {activeLibrary.type}
               </Badge>
             </div>
diff --git a/web/src/pages/settings/NotificationsSettings.tsx b/web/src/pages/settings/NotificationsSettings.tsx
index 0327ebd475..821983114a 100644
--- a/web/src/pages/settings/NotificationsSettings.tsx
+++ b/web/src/pages/settings/NotificationsSettings.tsx
@@ -5,7 +5,7 @@ import {
   captureNotificationAuthority,
 } from "@/api/v2/notifications";
 import { useEffect, useState } from "react";
-import { useSearchParams } from "react-router";
+import { Link, useSearchParams } from "react-router";
 import { useQueryClient } from "@tanstack/react-query";
 import {
   AlertTriangle,
@@ -22,6 +22,7 @@ import {
   X,
 } from "lucide-react";
 import { toast } from "sonner";
+import { PageHeader } from "@/components/page/PageHeader";
 import { INVALID_EMAIL_MESSAGE, isValidEmail } from "@/lib/email";
 import type {
   NotificationChannelMode,
@@ -108,6 +109,7 @@ type WebhookNotifyKey = (typeof WEBHOOK_NOTIFY_FIELDS)[number]["key"];
 function PreferencesSection() {
   const { data: prefs, isLoading } = useNotificationPreferences();
   const updatePrefs = useUpdateNotificationPreferences();
+  const { data: capability } = useNotificationCapability();
 
   if (isLoading || !prefs) {
     return (
@@ -120,7 +122,22 @@ function PreferencesSection() {
   return (
     <SettingsGroup
       title="New Episode Notifications"
-      description="Choose which series relationships notify this profile when a new episode arrives."
+      description={
+        <>
+          Choose which series relationships notify this profile when a new episode arrives.
+          {capability?.series?.available && (
+            <>
+              {" "}
+              <Link
+                to="/notifications?view=series"
+                className="text-foreground underline underline-offset-4"
+              >
+                See which series notify you
+              </Link>
+            </>
+          )}
+        </>
+      }
     >
       <div className="flex items-center justify-between gap-3">
         <div>
@@ -1127,7 +1144,10 @@ export default function NotificationsSettings() {
 
   return (
     <div className="space-y-6">
-      <h2 className="text-2xl font-semibold tracking-tight sm:text-3xl">Notifications</h2>
+      <PageHeader
+        title="Notifications"
+        subtitle="New-episode alerts by email, Discord, push, or webhook."
+      />
 
       <PreferencesSection />
 
diff --git a/web/src/pages/settings/PersonalizeSettings.tsx b/web/src/pages/settings/PersonalizeSettings.tsx
index 7e6b48184d..534e8520a5 100644
--- a/web/src/pages/settings/PersonalizeSettings.tsx
+++ b/web/src/pages/settings/PersonalizeSettings.tsx
@@ -1,10 +1,12 @@
 import { useState } from "react";
 import { Link } from "react-router";
 import { Sparkles, ArrowRight, Heart, Map } from "lucide-react";
+import { PageHeader } from "@/components/page/PageHeader";
 import { Button } from "@/components/ui/button";
 import { useFavorites } from "@/hooks/queries/favorites";
 import { useOnboardingFlow } from "@/hooks/queries/onboarding";
 import { TourHost } from "@/components/onboarding/TourHost";
+import { NotInterestedList } from "@/components/settings/NotInterestedList";
 
 /**
  * Re-entry point for the taste-seeding flow. Always links to /taste-seed —
@@ -20,12 +22,12 @@ export default function PersonalizeSettings() {
 
   return (
     <div className="space-y-6">
-      <header className="space-y-2">
-        <h2 className="text-foreground text-xl font-semibold tracking-tight">Personalize</h2>
-        <p className="text-muted-foreground text-sm">
-          Pick titles you love so your home, recommendations, and "For You" rows reflect your taste.
-        </p>
-      </header>
+      <PageHeader
+        title="Personalize"
+        subtitle={
+          'Pick titles you love so your home, recommendations, and "For You" rows reflect your taste.'
+        }
+      />
 
       <div className="surface-panel rounded-2xl border-0 p-6">
         <div className="flex items-start gap-4">
@@ -50,6 +52,8 @@ export default function PersonalizeSettings() {
         </div>
       </div>
 
+      <NotInterestedList />
+
       <div className="surface-panel rounded-2xl border-0 p-6">
         <div className="flex items-start gap-4">
           <div className="bg-primary/10 text-primary flex h-12 w-12 shrink-0 items-center justify-center rounded-full">
diff --git a/web/src/pages/settings/PlaybackSettings.test.tsx b/web/src/pages/settings/PlaybackSettings.test.tsx
index a84439829f..0e29a7bbec 100644
--- a/web/src/pages/settings/PlaybackSettings.test.tsx
+++ b/web/src/pages/settings/PlaybackSettings.test.tsx
@@ -133,135 +133,31 @@ describe("PlaybackSettings", () => {
 
   afterEach(cleanup);
 
-  it.each([
-    ["older server", capabilitiesAtRevision(10)],
-    ["unknown capabilities", undefined],
-    ["unsupported settings API", { ...capabilitiesAtRevision(11), api_version: 2 }],
-    ["no batched settings", { ...capabilitiesAtRevision(11), supports_batched_effective: false }],
-  ])("does not request or offer theme settings with %s", (_scenario, capabilities) => {
-    mocks.capabilities = capabilities as SettingsCapabilities | undefined;
-    mocks.capabilitiesSettled = capabilities !== undefined;
-
-    render(<PlaybackSettings />);
-
-    expect(screen.queryByRole("switch", { name: "Theme music" })).not.toBeInTheDocument();
-    expect(screen.queryByRole("switch", { name: "Loop theme music" })).not.toBeInTheDocument();
-    for (const [options] of mocks.useEffectiveSettings.mock.calls) {
-      expect(options.keys ?? []).not.toContain(SETTING_KEYS.UI_THEME_MUSIC_ENABLED);
-      expect(options.keys ?? []).not.toContain(SETTING_KEYS.UI_THEME_MUSIC_LOOP);
-    }
-    expect(mutateAsync).not.toHaveBeenCalled();
-  });
-
-  it("offers supported theme settings and saves them at profile scope", async () => {
-    mocks.capabilities = capabilitiesAtRevision(11);
-    render(<PlaybackSettings />);
-
-    const requested = mocks.useEffectiveSettings.mock.calls.flatMap(
-      ([options]) => options.keys ?? [],
-    );
-    expect(requested).toContain(SETTING_KEYS.UI_THEME_MUSIC_ENABLED);
-    expect(requested).toContain(SETTING_KEYS.UI_THEME_MUSIC_LOOP);
-    const enabled = screen.getByRole("switch", { name: "Theme music" });
-    const loop = screen.getByRole("switch", { name: "Loop theme music" });
-    expect(enabled).not.toBeChecked();
-    expect(loop).not.toBeChecked();
-    await userEvent.click(enabled);
-    await userEvent.click(loop);
-    expect(mutateAsync).toHaveBeenCalledWith({
-      key: SETTING_KEYS.UI_THEME_MUSIC_ENABLED,
-      value: true,
-      identity: { scope: "profile" },
-    });
-    expect(mutateAsync).toHaveBeenCalledWith({
-      key: SETTING_KEYS.UI_THEME_MUSIC_LOOP,
-      value: true,
-      identity: { scope: "profile" },
-    });
-  });
-
-  it("updates theme controls and requested keys when server support changes", () => {
-    mocks.capabilities = undefined;
-    mocks.capabilitiesSettled = false;
-    const { rerender } = render(<PlaybackSettings />);
-    expect(screen.queryByRole("switch", { name: "Theme music" })).not.toBeInTheDocument();
-
-    mocks.capabilities = capabilitiesAtRevision(11);
-    mocks.capabilitiesSettled = true;
-    rerender(<PlaybackSettings />);
-    expect(screen.getByRole("switch", { name: "Theme music" })).toBeInTheDocument();
-
-    mocks.useEffectiveSettings.mockClear();
-    mocks.capabilities = capabilitiesAtRevision(10);
-    rerender(<PlaybackSettings />);
-    expect(screen.queryByRole("switch", { name: "Theme music" })).not.toBeInTheDocument();
-    expect(screen.queryByRole("switch", { name: "Loop theme music" })).not.toBeInTheDocument();
-    for (const [options] of mocks.useEffectiveSettings.mock.calls) {
-      expect(options.keys ?? []).not.toContain(SETTING_KEYS.UI_THEME_MUSIC_ENABLED);
-      expect(options.keys ?? []).not.toContain(SETTING_KEYS.UI_THEME_MUSIC_LOOP);
-    }
-  });
-
-  it.each(["pending", "error", "refetch error"] as const)(
-    "blocks theme writes while effective settings are %s and recovers after loading",
-    async (state) => {
-      mocks.capabilities = capabilitiesAtRevision(11);
-      const values = {
-        ...resolved(SETTING_KEYS.UI_THEME_MUSIC_ENABLED, true, "profile"),
-        ...resolved(SETTING_KEYS.UI_THEME_MUSIC_LOOP, true, "profile"),
-      };
-      mocks.useEffectiveSettings.mockReturnValue({
-        data: state === "refetch error" ? values : undefined,
-        isPending: state === "pending",
-        isError: state !== "pending",
-      });
-      const { rerender } = render(<PlaybackSettings />);
-      const enabled = screen.getByRole("switch", { name: "Theme music" });
-      const loop = screen.getByRole("switch", { name: "Loop theme music" });
-      expect(enabled).toBeDisabled();
-      expect(loop).toBeDisabled();
-      await userEvent.click(enabled);
-      await userEvent.click(loop);
-      expect(mutateAsync).not.toHaveBeenCalled();
-      expect(clearMutateAsync).not.toHaveBeenCalled();
-
-      mocks.useEffectiveSettings.mockReturnValue({
-        data: values,
-        isPending: false,
-        isError: false,
-      });
-      rerender(<PlaybackSettings />);
-      expect(enabled).toBeEnabled();
-      expect(loop).toBeEnabled();
-      expect(enabled).toBeChecked();
-      expect(loop).toBeChecked();
-      await userEvent.click(enabled);
-      await userEvent.click(loop);
-      for (const key of [SETTING_KEYS.UI_THEME_MUSIC_ENABLED, SETTING_KEYS.UI_THEME_MUSIC_LOOP]) {
-        expect(mutateAsync).toHaveBeenCalledWith({
-          key,
-          value: false,
-          identity: { scope: "profile" },
-        });
-      }
-    },
-  );
-
   it("reads its values in one batch rather than one request per control", () => {
     render(<PlaybackSettings />);
 
-    expect(screen.getByText("Spoken language")).toBeTruthy();
     expect(screen.getByText("Auto-play next episode")).toBeTruthy();
-    expect(screen.getByText("Next up episodes")).toBeTruthy();
+    // Languages live on the Language & Subtitles page now.
+    expect(screen.queryByText("Spoken language")).toBeNull();
 
     const batched = mocks.useEffectiveSettings.mock.calls.find(
       ([options]) => (options?.keys?.length ?? 0) > 2,
     );
     expect(batched?.[0].keys).toContain(SETTING_KEYS.PLAYBACK_INTRO_SKIP_MODE);
     expect(batched?.[0].keys).not.toContain(SETTING_KEYS.PLAYBACK_AUTO_SKIP_INTRO);
-    expect(batched?.[0].keys).toContain(SETTING_KEYS.UI_NEXT_UP_MODE);
-    expect(batched?.[0].keys).toContain(SETTING_KEYS.CATALOG_METADATA_LANGUAGE);
-    expect(batched?.[0].keys).toContain(SETTING_KEYS.CATALOG_METADATA_LANGUAGE_OVERRIDES);
+    expect(batched?.[0].keys).not.toContain(SETTING_KEYS.UI_NEXT_UP_MODE);
+    expect(batched?.[0].keys).not.toContain(SETTING_KEYS.PLAYBACK_AUDIO_LANGUAGE);
+    expect(batched?.[0].keys).not.toContain(SETTING_KEYS.CATALOG_METADATA_LANGUAGE);
+  });
+
+  it("lists the skipping switches as intros, recaps, then credits", () => {
+    render(<PlaybackSettings />);
+
+    const skipping = screen.getByRole("group", { name: "Skipping" });
+    const labels = within(skipping)
+      .getAllByText(/^(Skip intros|Auto-skip recaps|Auto-skip credits)$/)
+      .map((node) => node.textContent);
+    expect(labels).toEqual(["Skip intros", "Auto-skip recaps", "Auto-skip credits"]);
   });
 
   it("saves the selected intro mode as typed JSON at profile scope", async () => {
@@ -366,29 +262,6 @@ describe("PlaybackSettings", () => {
     expect(clearMutateAsync).not.toHaveBeenCalled();
   });
 
-  it("offers a reset only once the profile has stored a next-up choice", () => {
-    // The resolved value is the contract default until a row exists, so the
-    // affordance keys off the source rather than off the value.
-    render(<PlaybackSettings />);
-    expect(screen.queryByRole("button", { name: "Reset" })).toBeNull();
-
-    cleanup();
-    mocks.useEffectiveSettings.mockReturnValue({
-      data: resolved(SETTING_KEYS.UI_NEXT_UP_MODE, "separate", "profile"),
-      isLoading: false,
-    });
-
-    render(<PlaybackSettings />);
-    fireEvent.click(screen.getByRole("button", { name: "Reset" }));
-
-    // Reset is a delete of the profile row, so the setting inherits the
-    // contract default again rather than storing the default as a value.
-    expect(clearMutateAsync).toHaveBeenCalledWith({
-      key: SETTING_KEYS.UI_NEXT_UP_MODE,
-      identity: { scope: "profile" },
-    });
-  });
-
   // Quality is the same two axes the device screen edits — a resolution cap
   // and a bandwidth cap — not a compound preset only this screen understands.
 
@@ -411,6 +284,26 @@ describe("PlaybackSettings", () => {
     );
   });
 
+  it("shows a stored original quality as Auto and no longer offers Original", async () => {
+    mocks.useEffectiveSettings.mockReturnValue({
+      data: resolved(SETTING_KEYS.PLAYBACK_PREFERRED_QUALITY, "original", "profile"),
+      isLoading: false,
+    });
+    render(<PlaybackSettings />);
+
+    const select = screen.getByRole("combobox", { name: "Preferred quality" });
+    expect(select).toHaveTextContent("Auto");
+    expect(
+      screen.getByText(
+        "Plays the original file whenever your device and connection can handle it.",
+      ),
+    ).toBeInTheDocument();
+
+    await userEvent.click(select);
+    expect(await screen.findByRole("option", { name: "Auto" })).toBeInTheDocument();
+    expect(screen.queryByRole("option", { name: /Original/ })).toBeNull();
+  });
+
   it("saves the bandwidth cap as a number", async () => {
     render(<PlaybackSettings />);
 
diff --git a/web/src/pages/settings/PlaybackSettings.tsx b/web/src/pages/settings/PlaybackSettings.tsx
index 2d81653c1a..6d97e24247 100644
--- a/web/src/pages/settings/PlaybackSettings.tsx
+++ b/web/src/pages/settings/PlaybackSettings.tsx
@@ -1,8 +1,7 @@
 import { useMemo, useState } from "react";
+import { PageHeader } from "@/components/page/PageHeader";
 import { SettingsGroup } from "@/components/settings/SettingsGroup";
 import { SettingRow } from "@/components/settings/SettingRow";
-import { LanguageSelect } from "@/components/settings/LanguageSelect";
-import { MetadataLanguageSetting } from "@/components/settings/MetadataLanguageSetting";
 import { Button } from "@/components/ui/button";
 import { Switch } from "@/components/ui/switch";
 import {
@@ -13,11 +12,6 @@ import {
   SelectValue,
 } from "@/components/ui/select";
 import { optionsFor } from "@/lib/settingsDisplay";
-import { namedLanguageOptionsFor } from "@/lib/languageOptions";
-import {
-  normalizeMetadataLanguageOverrides,
-  type MetadataLanguageOverrides,
-} from "@/lib/metadataLanguagePreferences";
 import { SETTING_DEFINITIONS, SETTING_KEYS, type SettingKey } from "@/lib/settingsContract";
 import { bitrateSelectChoices } from "@/lib/bitrateOptions";
 import {
@@ -29,6 +23,8 @@ import { useAutoPlayNextSetting } from "@/hooks/queries/autoPlayNext";
 import { useSeekPreferences } from "@/hooks/queries/seekPreferences";
 import type { SeekDirection } from "@/lib/seekIntervals";
 import { useProfileDefaultWriter } from "@/hooks/queries/profileDefaults";
+import { isBrowserDecodingEnabled, setBrowserDecodingEnabled } from "@/player/engine/settings";
+import { normalizeQualityPreferenceV3 } from "@/player/protocol-v3";
 import { toast } from "sonner";
 
 /**
@@ -45,28 +41,20 @@ import { toast } from "sonner";
  * surfaces cannot land on different scopes.
  */
 const BASE_PLAYBACK_KEYS: SettingKey[] = [
-  SETTING_KEYS.PLAYBACK_AUDIO_LANGUAGE,
   SETTING_KEYS.PLAYBACK_AUTO_PLAY_NEXT_PREVIEW,
   SETTING_KEYS.PLAYBACK_AUTO_SKIP_CREDITS,
   SETTING_KEYS.PLAYBACK_AUTO_SKIP_RECAP,
-  SETTING_KEYS.CATALOG_METADATA_LANGUAGE,
-  SETTING_KEYS.CATALOG_METADATA_LANGUAGE_OVERRIDES,
-  SETTING_KEYS.CATALOG_SHOW_ADVISORY_AGE,
-  SETTING_KEYS.UI_NEXT_UP_MODE,
 ];
 
-const EPISODE_SPOILER_KEYS = [
-  SETTING_KEYS.CATALOG_HIDE_UNWATCHED_EPISODE_IMAGES,
-  SETTING_KEYS.CATALOG_HIDE_UNWATCHED_EPISODE_OVERVIEWS,
-] as const;
-
-const NEXT_UP_MODES = optionsFor(SETTING_DEFINITIONS[SETTING_KEYS.UI_NEXT_UP_MODE]);
 const INTRO_SKIP_MODES = optionsFor(SETTING_DEFINITIONS[SETTING_KEYS.PLAYBACK_INTRO_SKIP_MODE]);
 
 // Radix Select cannot represent "" as an item value, so the unset entry needs
 // a sentinel that never collides with a stored bitrate.
 const NO_BITRATE_LIMIT = "__no_limit__";
 
+const AUTO_QUALITY_DESCRIPTION =
+  "Plays the original file whenever your device and connection can handle it.";
+
 /**
  * Quality is the same two settings every other surface edits.
  *
@@ -74,8 +62,11 @@ const NO_BITRATE_LIMIT = "__no_limit__";
  * the device screen already presents them as two controls. Offering the same
  * two rows here means a device override reads as an override of something the
  * user can see, rather than of half a compound preset — and combinations no
- * preset covered ("Original but capped at 40 Mbps" for a remote box) become
+ * preset covered ("Auto but capped at 40 Mbps" for a remote box) become
  * expressible instead of rendering as a disabled "custom" entry.
+ *
+ * A stored "original" is shown as Auto: the contract keeps it as a deprecated
+ * value that means the same thing, and no longer offers it.
  */
 function QualitySetting() {
   const { data: effective } = useEffectiveSettings({
@@ -86,8 +77,10 @@ function QualitySetting() {
   const qualityDefinition = SETTING_DEFINITIONS[SETTING_KEYS.PLAYBACK_PREFERRED_QUALITY];
   const bitrateDefinition = SETTING_DEFINITIONS[SETTING_KEYS.PLAYBACK_MAX_BITRATE_KBPS];
 
-  const resolution = (effective?.[SETTING_KEYS.PLAYBACK_PREFERRED_QUALITY]?.value ??
-    qualityDefinition.defaultValue) as string;
+  const resolution = normalizeQualityPreferenceV3(
+    (effective?.[SETTING_KEYS.PLAYBACK_PREFERRED_QUALITY]?.value ??
+      qualityDefinition.defaultValue) as string,
+  );
   const bitrate = effective?.[SETTING_KEYS.PLAYBACK_MAX_BITRATE_KBPS]?.value as
     | number
     | null
@@ -99,7 +92,11 @@ function QualitySetting() {
     <>
       <SettingRow
         label="Preferred quality"
-        description="The resolution your profile should request when playback begins. Auto lets Prairie pick based on your connection."
+        description={
+          resolution === "auto"
+            ? AUTO_QUALITY_DESCRIPTION
+            : "The resolution your profile should request when playback begins."
+        }
         control={(id) => (
           <Select
             value={resolution}
@@ -416,19 +413,6 @@ export default function PlaybackSettings() {
     capabilities.data,
     SETTING_KEYS.PLAYBACK_INTRO_SKIP_MODE,
   );
-  const supportsThemeMusic = settingsCapabilitiesSupportKey(
-    capabilities.data,
-    SETTING_KEYS.UI_THEME_MUSIC_ENABLED,
-  );
-  const supportsThemeMusicLoop = settingsCapabilitiesSupportKey(
-    capabilities.data,
-    SETTING_KEYS.UI_THEME_MUSIC_LOOP,
-  );
-  // Both spoiler keys share one introduced_in revision.
-  const supportsEpisodeSpoilers = settingsCapabilitiesSupportKey(
-    capabilities.data,
-    SETTING_KEYS.CATALOG_HIDE_UNWATCHED_EPISODE_IMAGES,
-  );
   /**
    * Which intro control this server can honestly show.
    *
@@ -448,25 +432,14 @@ export default function PlaybackSettings() {
   const playbackKeys = useMemo(
     () => [
       ...BASE_PLAYBACK_KEYS,
-      ...(supportsThemeMusic ? [SETTING_KEYS.UI_THEME_MUSIC_ENABLED] : []),
-      ...(supportsThemeMusicLoop ? [SETTING_KEYS.UI_THEME_MUSIC_LOOP] : []),
-      ...(supportsEpisodeSpoilers ? EPISODE_SPOILER_KEYS : []),
       supportsIntroSkipMode
         ? SETTING_KEYS.PLAYBACK_INTRO_SKIP_MODE
         : SETTING_KEYS.PLAYBACK_AUTO_SKIP_INTRO,
     ],
-    [supportsIntroSkipMode, supportsThemeMusic, supportsThemeMusicLoop, supportsEpisodeSpoilers],
+    [supportsIntroSkipMode],
   );
-  const {
-    data: effective,
-    isPending: effectivePending,
-    isError: effectiveError,
-  } = useEffectiveSettings({ keys: playbackKeys });
-  const {
-    save: saveProfileDefault,
-    reset: resetProfileDefault,
-    isSaving,
-  } = useProfileDefaultWriter(effective);
+  const { data: effective } = useEffectiveSettings({ keys: playbackKeys });
+  const { save: saveProfileDefault, isSaving } = useProfileDefaultWriter(effective);
 
   // The effective endpoint resolves an unset key to the contract default, so
   // every control below reads its value from the same answer rather than from
@@ -481,141 +454,23 @@ export default function PlaybackSettings() {
     saveProfileDefault(key, value).catch(() => toast.error("Failed to save playback setting"));
   };
 
-  const nextUpMode = read<string>(SETTING_KEYS.UI_NEXT_UP_MODE);
-  const audioLanguage = read<string | null>(SETTING_KEYS.PLAYBACK_AUDIO_LANGUAGE);
-  const metadataLanguage = read<string | null>(SETTING_KEYS.CATALOG_METADATA_LANGUAGE);
-  const audioLanguageOptions = namedLanguageOptionsFor(
-    SETTING_KEYS.PLAYBACK_AUDIO_LANGUAGE,
-    audioLanguage,
-    effective?.[SETTING_KEYS.PLAYBACK_AUDIO_LANGUAGE]?.suggested_values,
-  );
-  const metadataLanguageOptions = namedLanguageOptionsFor(
-    SETTING_KEYS.CATALOG_METADATA_LANGUAGE,
-    metadataLanguage,
-    effective?.[SETTING_KEYS.CATALOG_METADATA_LANGUAGE]?.suggested_values,
-  );
-  // Whether the profile has actually chosen, which is what gates the reset
-  // affordance: the resolved value is the default until a row exists.
-  const nextUpChosen = effective?.[SETTING_KEYS.UI_NEXT_UP_MODE]?.source === "profile";
   const pending = isSaving;
 
-  const saveMetadataOverrides = (overrides: MetadataLanguageOverrides) => {
-    const request =
-      Object.keys(overrides).length === 0
-        ? resetProfileDefault(SETTING_KEYS.CATALOG_METADATA_LANGUAGE_OVERRIDES)
-        : saveProfileDefault(SETTING_KEYS.CATALOG_METADATA_LANGUAGE_OVERRIDES, overrides);
-    return request.catch((error) => {
-      toast.error("Failed to save metadata language exceptions");
-      throw error;
-    });
-  };
-
-  async function resetNextUpMode() {
-    // Nothing stored is the state a reset asks for, which the shared reset
-    // already treats as success.
-    await resetProfileDefault(SETTING_KEYS.UI_NEXT_UP_MODE).catch(() =>
-      toast.error("Failed to reset the next up preference"),
-    );
-  }
-
   return (
     <div className="space-y-6">
-      <div className="space-y-4">
-        <div className="space-y-3">
-          <h2 className="text-2xl font-semibold tracking-tight sm:text-3xl">Playback</h2>
-          <p className="text-muted-foreground max-w-2xl text-sm leading-relaxed">
-            Choose the defaults Prairie should use when playback starts.
-          </p>
-        </div>
-      </div>
+      <PageHeader
+        title="Playback"
+        subtitle="The defaults this profile starts playback with. A library, a series, or one of your devices can override some of them."
+      />
 
       <SettingsGroup
-        title="Defaults"
-        description="These preferences apply unless a library or item has a more specific playback choice."
+        title="Quality"
+        description="Each of your devices can override these, and a household manager can cap them for this profile."
       >
         <QualitySetting />
-        {supportsThemeMusic ? (
-          <SettingRow
-            label={SETTING_DEFINITIONS[SETTING_KEYS.UI_THEME_MUSIC_ENABLED].label}
-            description={SETTING_DEFINITIONS[SETTING_KEYS.UI_THEME_MUSIC_ENABLED].description}
-            control={(id) => (
-              <Switch
-                id={id}
-                checked={read<boolean>(SETTING_KEYS.UI_THEME_MUSIC_ENABLED)}
-                disabled={pending || effectivePending || effectiveError}
-                onCheckedChange={(value) => saveValue(SETTING_KEYS.UI_THEME_MUSIC_ENABLED, value)}
-              />
-            )}
-          />
-        ) : null}
-
-        {supportsThemeMusicLoop ? (
-          <SettingRow
-            label={SETTING_DEFINITIONS[SETTING_KEYS.UI_THEME_MUSIC_LOOP].label}
-            description={SETTING_DEFINITIONS[SETTING_KEYS.UI_THEME_MUSIC_LOOP].description}
-            control={(id) => (
-              <Switch
-                id={id}
-                checked={read<boolean>(SETTING_KEYS.UI_THEME_MUSIC_LOOP)}
-                disabled={pending || effectivePending || effectiveError}
-                onCheckedChange={(value) => saveValue(SETTING_KEYS.UI_THEME_MUSIC_LOOP, value)}
-              />
-            )}
-          />
-        ) : null}
-
-        <SettingRow
-          label="Spoken language"
-          description="Prefer a spoken language for this profile when multiple tracks are available."
-          control={(id) => (
-            <div className="w-full sm:w-[220px]">
-              <LanguageSelect
-                id={id}
-                value={audioLanguage ?? "none"}
-                options={audioLanguageOptions}
-                disabled={pending}
-                placeholder="No preference"
-                className="w-full"
-                onValueChange={(value) =>
-                  // The contract spells "no preference" as null, where the
-                  // legacy profile column spelled it as the empty string.
-                  saveValue(SETTING_KEYS.PLAYBACK_AUDIO_LANGUAGE, value === "none" ? null : value)
-                }
-              >
-                <SelectItem value="none">No preference</SelectItem>
-              </LanguageSelect>
-            </div>
-          )}
-        />
-
-        <MetadataLanguageSetting
-          fallback={metadataLanguage}
-          overrides={normalizeMetadataLanguageOverrides(
-            read<unknown>(SETTING_KEYS.CATALOG_METADATA_LANGUAGE_OVERRIDES),
-          )}
-          languageOptions={metadataLanguageOptions}
-          disabled={pending}
-          onFallbackChange={(language) =>
-            saveValue(SETTING_KEYS.CATALOG_METADATA_LANGUAGE, language)
-          }
-          onOverridesChange={saveMetadataOverrides}
-        />
-
-        <SettingRow
-          label="Show advisory age"
-          description="Show a suggested minimum viewer age, such as Common Sense Media's, on item detail. This only shows the age; a household manager can limit a profile by it in the profile's access settings."
-          control={(id) => (
-            <Switch
-              id={id}
-              checked={read<boolean>(SETTING_KEYS.CATALOG_SHOW_ADVISORY_AGE)}
-              disabled={pending}
-              onCheckedChange={(checked) =>
-                saveValue(SETTING_KEYS.CATALOG_SHOW_ADVISORY_AGE, checked)
-              }
-            />
-          )}
-        />
+      </SettingsGroup>
 
+      <SettingsGroup title="Skipping">
         {introSkipControl === "mode" ? (
           <SettingRow
             label="Skip intros"
@@ -679,35 +534,37 @@ export default function PlaybackSettings() {
         )}
 
         <SettingRow
-          label="Auto-skip credits"
-          description="Move through end credits automatically when a skip is available."
+          label="Auto-skip recaps"
+          description="Skip 'previously on…' recaps automatically when Prairie can detect them."
           control={(id) => (
             <Switch
               id={id}
-              checked={read<boolean>(SETTING_KEYS.PLAYBACK_AUTO_SKIP_CREDITS)}
+              checked={read<boolean>(SETTING_KEYS.PLAYBACK_AUTO_SKIP_RECAP)}
               disabled={pending}
               onCheckedChange={(checked) =>
-                saveValue(SETTING_KEYS.PLAYBACK_AUTO_SKIP_CREDITS, checked)
+                saveValue(SETTING_KEYS.PLAYBACK_AUTO_SKIP_RECAP, checked)
               }
             />
           )}
         />
 
         <SettingRow
-          label="Auto-skip recaps"
-          description="Skip 'previously on…' recaps automatically when Prairie can detect them."
+          label="Auto-skip credits"
+          description="Move through end credits automatically when a skip is available."
           control={(id) => (
             <Switch
               id={id}
-              checked={read<boolean>(SETTING_KEYS.PLAYBACK_AUTO_SKIP_RECAP)}
+              checked={read<boolean>(SETTING_KEYS.PLAYBACK_AUTO_SKIP_CREDITS)}
               disabled={pending}
               onCheckedChange={(checked) =>
-                saveValue(SETTING_KEYS.PLAYBACK_AUTO_SKIP_RECAP, checked)
+                saveValue(SETTING_KEYS.PLAYBACK_AUTO_SKIP_CREDITS, checked)
               }
             />
           )}
         />
+      </SettingsGroup>
 
+      <SettingsGroup title="Next episode">
         <SettingRow
           label="Start next at preview"
           description="Begin the next episode when the current one reaches its next-episode preview teaser, rather than waiting for the end credits."
@@ -724,68 +581,40 @@ export default function PlaybackSettings() {
         />
 
         <AutoPlayNextSetting />
-
-        <SettingRow
-          label="Next up episodes"
-          description="Choose whether upcoming episodes stay with Continue Watching or get their own row."
-          control={(id) => (
-            <div className="flex items-center gap-2">
-              <Select
-                value={nextUpMode}
-                onValueChange={(value) => saveValue(SETTING_KEYS.UI_NEXT_UP_MODE, value)}
-                disabled={pending}
-              >
-                <SelectTrigger id={id} className="w-full sm:w-[240px]">
-                  <SelectValue />
-                </SelectTrigger>
-                <SelectContent>
-                  {NEXT_UP_MODES.map((mode) => (
-                    <SelectItem key={mode.value} value={mode.value}>
-                      {mode.label}
-                    </SelectItem>
-                  ))}
-                </SelectContent>
-              </Select>
-              {nextUpChosen ? (
-                <Button
-                  variant="ghost"
-                  size="sm"
-                  className="h-9 rounded-full px-3"
-                  onClick={resetNextUpMode}
-                  disabled={pending}
-                >
-                  Reset
-                </Button>
-              ) : null}
-            </div>
-          )}
-        />
       </SettingsGroup>
 
-      {supportsEpisodeSpoilers ? (
-        <SettingsGroup
-          title="Spoilers"
-          description="Applies to episodes you have not started, on every device that uses this profile."
-        >
-          {EPISODE_SPOILER_KEYS.map((key) => (
-            <SettingRow
-              key={key}
-              label={SETTING_DEFINITIONS[key].label}
-              description={SETTING_DEFINITIONS[key].description}
-              control={(id) => (
-                <Switch
-                  id={id}
-                  checked={read<boolean>(key)}
-                  disabled={pending || effectivePending || effectiveError}
-                  onCheckedChange={(value) => saveValue(key, value)}
-                />
-              )}
-            />
-          ))}
-        </SettingsGroup>
-      ) : null}
-
       <SeekControls />
+
+      <BrowserDecodingSetting />
     </div>
   );
 }
+
+/**
+ * Stored in this browser only: whether it can decode a file depends on the
+ * browser and the GPU, not on the profile.
+ */
+function BrowserDecodingSetting() {
+  const [enabled, setEnabled] = useState(isBrowserDecodingEnabled);
+  return (
+    <SettingsGroup
+      title="This browser"
+      description="Saved in this browser only. Other browsers and apps keep their own choice."
+    >
+      <SettingRow
+        label="Decode in the browser (beta)"
+        description="Play files this browser cannot play natively, such as Dolby TrueHD or DTS audio and HDR video on SDR screens, by decoding them in the browser instead of converting them on the server. Applies from the next video you start."
+        control={(id) => (
+          <Switch
+            id={id}
+            checked={enabled}
+            onCheckedChange={(checked) => {
+              setBrowserDecodingEnabled(checked);
+              setEnabled(checked);
+            }}
+          />
+        )}
+      />
+    </SettingsGroup>
+  );
+}
diff --git a/web/src/pages/settings/PosterCardPreview.test.tsx b/web/src/pages/settings/PosterCardPreview.test.tsx
new file mode 100644
index 0000000000..da691c7e9f
--- /dev/null
+++ b/web/src/pages/settings/PosterCardPreview.test.tsx
@@ -0,0 +1,63 @@
+import { renderToStaticMarkup } from "react-dom/server";
+import { describe, expect, it, vi } from "vitest";
+
+import { buildDefaultPrefs } from "@/lib/overlays";
+
+import { PosterCardPreviewView } from "./PosterCardPreview";
+
+vi.mock("@/components/overlays/CardOverlays", () => ({
+  default: () => <div data-testid="badges" />,
+}));
+
+const VARIANTS = ["movie", "show", "requested"] as const;
+
+function markup(props: Partial<Parameters<typeof PosterCardPreviewView>[0]> = {}) {
+  return renderToStaticMarkup(
+    <PosterCardPreviewView
+      presentation={{ poster_size: "standard", caption: "title_metadata" }}
+      overlayPrefs={buildDefaultPrefs()}
+      quickActionMode="both"
+      variants={VARIANTS}
+      {...props}
+    />,
+  );
+}
+
+describe("PosterCardPreviewView", () => {
+  // Every sample shows at every size, so the request sample and show-only
+  // badges can be previewed at Standard, the default, too.
+  it("shows every sample at every size, narrower for Compact", () => {
+    for (const poster_size of ["compact", "standard", "large"] as const) {
+      const html = markup({ presentation: { poster_size, caption: "title" } });
+      expect(html.match(/aspect-\[2\/3\]/g)).toHaveLength(3);
+      expect(html).toContain("Glass Harbor");
+    }
+    expect(markup({ presentation: { poster_size: "compact", caption: "title" } })).toContain(
+      "w-[5.25rem]",
+    );
+  });
+
+  it("follows the caption choice", () => {
+    expect(markup()).toContain("2024 · 2h 28m");
+    const titleOnly = markup({ presentation: { poster_size: "standard", caption: "title" } });
+    expect(titleOnly).toContain("Northern Lights");
+    expect(titleOnly).not.toContain("2024 · 2h 28m");
+    expect(markup({ presentation: { poster_size: "standard", caption: "artwork" } })).not.toContain(
+      "Northern Lights",
+    );
+  });
+
+  it("draws badges only while they are on", () => {
+    expect(markup()).toContain('data-testid="badges"');
+    expect(markup({ overlayPrefs: null })).not.toContain('data-testid="badges"');
+  });
+
+  it("draws the chosen shortcut buttons and none when off", () => {
+    expect(markup()).toContain("lucide-heart");
+    expect(markup()).toContain("lucide-eye");
+    const watchedOnly = markup({ quickActionMode: "watched" });
+    expect(watchedOnly).toContain("lucide-eye");
+    expect(watchedOnly).not.toContain("lucide-heart");
+    expect(markup({ quickActionMode: "none" })).not.toContain("lucide-eye");
+  });
+});
diff --git a/web/src/pages/settings/PosterCardPreview.tsx b/web/src/pages/settings/PosterCardPreview.tsx
new file mode 100644
index 0000000000..6546afcf14
--- /dev/null
+++ b/web/src/pages/settings/PosterCardPreview.tsx
@@ -0,0 +1,182 @@
+import { Eye, Heart } from "lucide-react";
+
+import CardOverlays from "@/components/overlays/CardOverlays";
+import { RequestDownloadBar } from "@/components/overlays/RequestDownloadBar";
+import { useOverlayPrefs } from "@/hooks/useOverlayPrefs";
+import { useUICustomization } from "@/hooks/useUICustomization";
+import {
+  showsFavoriteQuickAction,
+  showsWatchedQuickAction,
+  type CardQuickActionMode,
+} from "@/lib/cardQuickActions";
+import {
+  buildDefaultPrefs,
+  OVERLAY_PREVIEW_SAMPLES,
+  OVERLAY_PREVIEW_VARIANTS,
+  requestDownloadBarPercent,
+  type CardOverlayPrefs,
+  type OverlayPreviewVariant,
+} from "@/lib/overlays";
+import type { CardPresentation } from "@/lib/uiCustomization";
+import { cn } from "@/lib/utils";
+
+/** Made-up titles: the preview must never look like someone's real library. */
+const SAMPLES: Record<OverlayPreviewVariant, { title: string; meta: string; art: string }> = {
+  movie: {
+    title: "Northern Lights",
+    meta: "2024 · 2h 28m",
+    art: "from-sky-700 via-indigo-800 to-slate-950",
+  },
+  show: {
+    title: "The Long Coast",
+    meta: "2024 · Series",
+    art: "from-amber-600 via-rose-800 to-slate-950",
+  },
+  requested: {
+    title: "Glass Harbor",
+    meta: "2026 · Requested",
+    art: "from-emerald-700 via-teal-900 to-slate-950",
+  },
+};
+
+const SHORTCUT_TILE =
+  "border-border/20 bg-background/80 flex size-6 items-center justify-center rounded-md border shadow-sm";
+
+/**
+ * How wide a sample poster is at each size. Every sample shows at every size,
+ * wrapping when the row runs out, so the request sample and the show-only
+ * badges can be previewed whatever the size.
+ */
+const POSTER_WIDTH: Record<CardPresentation["poster_size"], string> = {
+  compact: "w-[5.25rem]",
+  standard: "w-[6.5rem]",
+  large: "w-32",
+};
+
+interface PosterCardPreviewViewProps {
+  presentation: CardPresentation;
+  /** Null while badges are off. */
+  overlayPrefs: CardOverlayPrefs | null;
+  quickActionMode: CardQuickActionMode;
+  /** Samples this server can show; the request sample needs request support. */
+  variants: readonly OverlayPreviewVariant[];
+  /** Show the shortcut buttons without hovering, right after they change. */
+  revealShortcuts?: boolean;
+}
+
+export function PosterCardPreviewView({
+  presentation,
+  overlayPrefs,
+  quickActionMode,
+  variants,
+  revealShortcuts = false,
+}: PosterCardPreviewViewProps) {
+  const width = POSTER_WIDTH[presentation.poster_size];
+  const hasShortcuts = quickActionMode !== "none";
+
+  return (
+    <figure className="surface-panel-subtle rounded-2xl border p-4" aria-label="Preview">
+      <figcaption className="mb-3 flex items-baseline justify-between gap-3">
+        <span className="text-sm font-semibold">Preview</span>
+        <span className="text-muted-foreground text-[13px]">Updates as you change things</span>
+      </figcaption>
+      <div className="flex min-h-56 flex-wrap items-start justify-center gap-2">
+        {variants.map((variant) => {
+          const sample = SAMPLES[variant];
+          const data = OVERLAY_PREVIEW_SAMPLES[variant];
+          const downloadPercent = overlayPrefs
+            ? requestDownloadBarPercent(data, overlayPrefs)
+            : null;
+          return (
+            // Holding a poster on a touch screen keeps it :active, which shows
+            // its shortcuts as the hint below says. The empty touch handler is
+            // what lets iOS Safari apply :active at all.
+            <div
+              key={variant}
+              onTouchStart={() => {}}
+              className={cn(
+                "group/preview shrink-0 transition-[width] duration-300 select-none [-webkit-touch-callout:none]",
+                width,
+              )}
+            >
+              <div
+                className={cn(
+                  "relative aspect-[2/3] overflow-hidden rounded-lg bg-gradient-to-br shadow-md",
+                  sample.art,
+                )}
+              >
+                {downloadPercent !== null ? <RequestDownloadBar percent={downloadPercent} /> : null}
+                {overlayPrefs ? (
+                  <CardOverlays
+                    data={data}
+                    prefs={overlayPrefs}
+                    hasProgressBar={downloadPercent !== null}
+                  />
+                ) : null}
+                {hasShortcuts ? (
+                  <div
+                    aria-hidden="true"
+                    className={cn(
+                      "absolute bottom-1.5 left-1.5 z-20 flex gap-1 transition-opacity duration-200",
+                      revealShortcuts
+                        ? "opacity-100"
+                        : "opacity-0 group-hover/preview:opacity-100 group-active/preview:opacity-100",
+                    )}
+                  >
+                    {showsWatchedQuickAction(quickActionMode) ? (
+                      <span className={cn(SHORTCUT_TILE, "text-foreground")}>
+                        <Eye className="size-3.5" />
+                      </span>
+                    ) : null}
+                    {showsFavoriteQuickAction(quickActionMode) ? (
+                      <span className={cn(SHORTCUT_TILE, "text-rose-400")}>
+                        <Heart className="size-3.5 fill-current" />
+                      </span>
+                    ) : null}
+                  </div>
+                ) : null}
+              </div>
+              {presentation.caption !== "artwork" ? (
+                <div className="mt-1.5 min-w-0">
+                  <p className="truncate text-xs font-medium">{sample.title}</p>
+                  {presentation.caption === "title_metadata" ? (
+                    <p className="text-muted-foreground truncate text-xs">{sample.meta}</p>
+                  ) : null}
+                </div>
+              ) : null}
+            </div>
+          );
+        })}
+      </div>
+      {hasShortcuts ? (
+        <p className="text-muted-foreground mt-3 text-[13px] leading-relaxed">
+          Point at a poster to see its shortcuts. On touch screens, press and hold instead.
+        </p>
+      ) : null}
+    </figure>
+  );
+}
+
+/**
+ * The live preview for the Navigation & Cards page. It reads the same settings
+ * the controls write, so every change shows here at once.
+ */
+export function PosterCardPreview({ revealShortcuts }: { revealShortcuts: boolean }) {
+  const { cardPresentation } = useUICustomization();
+  const { prefs, overlaysEnabled, quickActionPreference, quickActionsEnabled, isOverlaySupported } =
+    useOverlayPrefs();
+  // The request sample only shows a badge this server lets the profile keep.
+  const variants = isOverlaySupported("request_status")
+    ? OVERLAY_PREVIEW_VARIANTS
+    : OVERLAY_PREVIEW_VARIANTS.filter((variant) => variant !== "requested");
+
+  return (
+    <PosterCardPreviewView
+      presentation={cardPresentation}
+      overlayPrefs={overlaysEnabled ? (prefs ?? buildDefaultPrefs()) : null}
+      quickActionMode={quickActionsEnabled ? quickActionPreference : "none"}
+      variants={variants}
+      revealShortcuts={revealShortcuts}
+    />
+  );
+}
diff --git a/web/src/pages/settings/ProfilesSettings.tsx b/web/src/pages/settings/ProfilesSettings.tsx
index d8e26af7bd..2741775567 100644
--- a/web/src/pages/settings/ProfilesSettings.tsx
+++ b/web/src/pages/settings/ProfilesSettings.tsx
@@ -4,6 +4,7 @@ import { toast } from "sonner";
 
 import type { Profile } from "@/api/types";
 import { ConfirmDialog } from "@/components/ConfirmDialog";
+import { PageHeader } from "@/components/page/PageHeader";
 import { Avatar, AvatarFallback, AvatarImage } from "@/components/ui/avatar";
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
@@ -84,19 +85,16 @@ export default function ProfilesSettings() {
 
   return (
     <div className="space-y-6">
-      <div className="flex items-start justify-between gap-4">
-        <div className="space-y-2">
-          <h2 className="text-2xl font-semibold tracking-tight sm:text-3xl">Profiles</h2>
-          <p className="text-muted-foreground max-w-2xl text-sm leading-relaxed">
-            Manage profile names, PINs, and access rules.
-          </p>
-        </div>
-
-        <Button onClick={openCreateDialog}>
-          <Plus className="h-4 w-4" />
-          New profile
-        </Button>
-      </div>
+      <PageHeader
+        title="Profiles"
+        subtitle="Manage profile names, PINs, and access rules."
+        actions={
+          <Button onClick={openCreateDialog}>
+            <Plus className="h-4 w-4" />
+            New profile
+          </Button>
+        }
+      />
 
       <HouseholdStreamsPanel />
 
diff --git a/web/src/pages/settings/RequestsSettings.tsx b/web/src/pages/settings/RequestsSettings.tsx
index 8910940952..74bea1dbdf 100644
--- a/web/src/pages/settings/RequestsSettings.tsx
+++ b/web/src/pages/settings/RequestsSettings.tsx
@@ -1,5 +1,6 @@
 import { useQueryClient } from "@tanstack/react-query";
 import { toast } from "sonner";
+import { PageHeader } from "@/components/page/PageHeader";
 import { SettingRow } from "@/components/settings/SettingRow";
 import { SettingsGroup } from "@/components/settings/SettingsGroup";
 import { Switch } from "@/components/ui/switch";
@@ -67,6 +68,10 @@ export default function RequestsSettings() {
 
   return (
     <div className="space-y-6">
+      <PageHeader
+        title="Requests"
+        subtitle="How you ask for titles this server doesn't have yet."
+      />
       <SettingsGroup
         title="Watchlist"
         description="What happens when you add a title the library doesn't have yet."
diff --git a/web/src/pages/settings/ResetButton.tsx b/web/src/pages/settings/ResetButton.tsx
new file mode 100644
index 0000000000..326a52baae
--- /dev/null
+++ b/web/src/pages/settings/ResetButton.tsx
@@ -0,0 +1,31 @@
+import { RotateCcw } from "lucide-react";
+
+import { Button } from "@/components/ui/button";
+
+/**
+ * The small Reset beside a section title. Pages show it only when there is
+ * something to reset; the label says what goes back to which default.
+ */
+export function ResetButton({
+  label,
+  disabled,
+  onClick,
+}: {
+  label: string;
+  disabled: boolean;
+  onClick: () => void;
+}) {
+  return (
+    <Button
+      type="button"
+      variant="ghost"
+      size="sm"
+      disabled={disabled}
+      aria-label={label}
+      onClick={onClick}
+    >
+      <RotateCcw className="h-3.5 w-3.5" aria-hidden="true" />
+      Reset
+    </Button>
+  );
+}
diff --git a/web/src/pages/settings/SubtitleAppearanceSettings.test.tsx b/web/src/pages/settings/SubtitleAppearanceSettings.test.tsx
index 2c829c87da..3854d22038 100644
--- a/web/src/pages/settings/SubtitleAppearanceSettings.test.tsx
+++ b/web/src/pages/settings/SubtitleAppearanceSettings.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 
-import { render, screen, cleanup, fireEvent } from "@testing-library/react";
+import { render, screen, cleanup, fireEvent, waitFor, within } from "@testing-library/react";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 import type { EffectiveSetting, EffectiveSettingsMap } from "@/hooks/queries/settingValues";
@@ -12,6 +12,7 @@ const mocks = vi.hoisted(() => ({
   useSetSettingValue: vi.fn(),
   useClearSettingValue: vi.fn(),
   useSubtitleAppearanceSetting: vi.fn(),
+  useSubtitleSyncSetting: vi.fn(),
 }));
 
 vi.mock("@/hooks/queries/settingValues", async () => {
@@ -31,6 +32,16 @@ vi.mock("@/hooks/queries/subtitleAppearance", () => ({
   useSubtitleAppearanceSetting: (...args: unknown[]) => mocks.useSubtitleAppearanceSetting(...args),
 }));
 
+vi.mock("@/hooks/queries/subtitleSync", async () => {
+  const actual = await vi.importActual<typeof import("@/hooks/queries/subtitleSync")>(
+    "@/hooks/queries/subtitleSync",
+  );
+  return {
+    ...actual,
+    useSubtitleSyncSetting: (...args: unknown[]) => mocks.useSubtitleSyncSetting(...args),
+  };
+});
+
 import SubtitleAppearanceSettings from "./SubtitleAppearanceSettings";
 
 // The appearance panel renders a Slider, whose Radix primitive measures itself.
@@ -57,17 +68,20 @@ describe("SubtitleAppearanceSettings", () => {
   let clearMutateAsync: ReturnType<typeof vi.fn>;
   let save: ReturnType<typeof vi.fn>;
   let reset: ReturnType<typeof vi.fn>;
+  let saveSync: ReturnType<typeof vi.fn>;
 
   beforeEach(() => {
     mocks.useEffectiveSettings.mockReset();
     mocks.useSetSettingValue.mockReset();
     mocks.useClearSettingValue.mockReset();
     mocks.useSubtitleAppearanceSetting.mockReset();
+    mocks.useSubtitleSyncSetting.mockReset();
     mutate = vi.fn();
     mutateAsync = vi.fn().mockResolvedValue(undefined);
     clearMutateAsync = vi.fn().mockResolvedValue(undefined);
     save = vi.fn().mockResolvedValue(undefined);
     reset = vi.fn().mockResolvedValue(undefined);
+    saveSync = vi.fn().mockResolvedValue(undefined);
 
     mocks.useEffectiveSettings.mockReturnValue({ data: {}, isLoading: false });
     mocks.useSetSettingValue.mockReturnValue({
@@ -82,28 +96,75 @@ describe("SubtitleAppearanceSettings", () => {
     });
     mocks.useSubtitleAppearanceSetting.mockReturnValue({
       appearance: DEFAULT_SUBTITLE_APPEARANCE,
-      hasDeviceOverride: false,
+      isCustomized: false,
       save,
       reset,
       isSaving: false,
-      isResetting: false,
       isLoading: false,
     });
+    mocks.useSubtitleSyncSetting.mockReturnValue({
+      offsetMs: 0,
+      isLoaded: true,
+      save: saveSync,
+      reset: vi.fn(),
+      isSaving: false,
+    });
   });
 
   afterEach(cleanup);
 
-  it("reads the behavior triple from the contract in one batch", () => {
+  it("reads the language and subtitle settings from the contract in one batch", () => {
     render(<SubtitleAppearanceSettings />);
 
     const [options] = mocks.useEffectiveSettings.mock.calls[0] ?? [];
     expect(options?.keys).toEqual([
+      SETTING_KEYS.PLAYBACK_AUDIO_LANGUAGE,
+      SETTING_KEYS.CATALOG_METADATA_LANGUAGE,
+      SETTING_KEYS.CATALOG_METADATA_LANGUAGE_OVERRIDES,
       SETTING_KEYS.PLAYBACK_SUBTITLE_LANGUAGE,
       SETTING_KEYS.PLAYBACK_SUBTITLE_MODE,
       SETTING_KEYS.PLAYBACK_SHOW_FORCED_SUBTITLES,
     ]);
   });
 
+  it("leads with languages, then the subtitle choices", () => {
+    render(<SubtitleAppearanceSettings />);
+
+    const titles = screen.getAllByRole("heading", { level: 3 }).map((node) => node.textContent);
+    expect(titles).toEqual([
+      "Language",
+      "Subtitles",
+      "Preview",
+      "Text",
+      "Background & Position",
+      "Timing",
+    ]);
+    const language = screen.getByRole("group", { name: "Language" });
+    expect(within(language).getByText("Spoken language")).toBeInTheDocument();
+    expect(within(language).getByText("Metadata language")).toBeInTheDocument();
+    const subtitles = screen.getByRole("group", { name: "Subtitles" });
+    expect(within(subtitles).getByText("Show forced subtitles")).toBeInTheDocument();
+  });
+
+  it("clears the stored metadata exceptions rather than saving an empty map", async () => {
+    mocks.useEffectiveSettings.mockReturnValue({
+      data: resolved(SETTING_KEYS.CATALOG_METADATA_LANGUAGE_OVERRIDES, { ja: "en" }, "profile"),
+      isLoading: false,
+    });
+    render(<SubtitleAppearanceSettings />);
+
+    fireEvent.click(screen.getByRole("button", { name: /Remove/ }));
+
+    await waitFor(() =>
+      expect(clearMutateAsync).toHaveBeenCalledWith(
+        expect.objectContaining({
+          key: SETTING_KEYS.CATALOG_METADATA_LANGUAGE_OVERRIDES,
+          identity: { scope: "profile" },
+        }),
+      ),
+    );
+  });
+
   it("writes forced subtitles at profile scope as a typed boolean", () => {
     render(<SubtitleAppearanceSettings />);
 
@@ -133,23 +194,59 @@ describe("SubtitleAppearanceSettings", () => {
     );
   });
 
-  it("offers the appearance reset only when this device holds an override", () => {
+  it("offers the appearance reset only when the profile has a stored appearance", () => {
     render(<SubtitleAppearanceSettings />);
-    expect(screen.queryByRole("button", { name: /Reset Appearance/ })).toBeNull();
+    expect(
+      screen.queryByRole("button", { name: "Reset subtitle appearance to the default" }),
+    ).toBeNull();
 
     cleanup();
     mocks.useSubtitleAppearanceSetting.mockReturnValue({
       appearance: DEFAULT_SUBTITLE_APPEARANCE,
-      hasDeviceOverride: true,
+      isCustomized: true,
       save,
       reset,
       isSaving: false,
-      isResetting: false,
       isLoading: false,
     });
 
     render(<SubtitleAppearanceSettings />);
-    fireEvent.click(screen.getByRole("button", { name: /Reset Appearance/ }));
+    const preview = screen.getByRole("group", { name: "Preview" });
+    fireEvent.click(
+      within(preview).getByRole("button", { name: "Reset subtitle appearance to the default" }),
+    );
     expect(reset).toHaveBeenCalled();
   });
+
+  it("saves the profile's subtitle offset from the timing control", () => {
+    mocks.useSubtitleSyncSetting.mockReturnValue({
+      offsetMs: -300,
+      isLoaded: true,
+      save: saveSync,
+      reset: vi.fn(),
+      isSaving: false,
+    });
+    render(<SubtitleAppearanceSettings />);
+
+    expect(screen.getByText("−300 ms")).toBeTruthy();
+    expect(screen.getByRole("group", { name: "Subtitle offset" })).toBeTruthy();
+    fireEvent.click(screen.getByRole("button", { name: "Show subtitles 100 ms later" }));
+    expect(saveSync).toHaveBeenCalledWith(-200);
+    fireEvent.click(screen.getByRole("button", { name: "Reset" }));
+    expect(saveSync).toHaveBeenLastCalledWith(0);
+  });
+
+  it("keeps the timing control disabled until the saved offset has loaded", () => {
+    mocks.useSubtitleSyncSetting.mockReturnValue({
+      offsetMs: 0,
+      isLoaded: false,
+      save: saveSync,
+      reset: vi.fn(),
+      isSaving: false,
+    });
+    render(<SubtitleAppearanceSettings />);
+
+    fireEvent.click(screen.getByRole("button", { name: "Show subtitles 100 ms later" }));
+    expect(saveSync).not.toHaveBeenCalled();
+  });
 });
diff --git a/web/src/pages/settings/SubtitleAppearanceSettings.tsx b/web/src/pages/settings/SubtitleAppearanceSettings.tsx
index 2cede0b7b4..3da62932ba 100644
--- a/web/src/pages/settings/SubtitleAppearanceSettings.tsx
+++ b/web/src/pages/settings/SubtitleAppearanceSettings.tsx
@@ -1,7 +1,9 @@
 import { useId, useState, type ReactNode } from "react";
-import { RotateCcw } from "lucide-react";
+import { Minus, Plus } from "lucide-react";
+import { PageHeader } from "@/components/page/PageHeader";
 import { SettingsGroup } from "@/components/settings/SettingsGroup";
 import { LanguageSelect } from "@/components/settings/LanguageSelect";
+import { MetadataLanguageSetting } from "@/components/settings/MetadataLanguageSetting";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { Label } from "@/components/ui/label";
@@ -15,11 +17,16 @@ import {
   SelectValue,
 } from "@/components/ui/select";
 import { useSubtitleAppearanceSetting } from "@/hooks/queries/subtitleAppearance";
+import { SUBTITLE_SYNC_MAX_MS, useSubtitleSyncSetting } from "@/hooks/queries/subtitleSync";
 import { useEffectiveSettings } from "@/hooks/queries/settingValues";
 import { useProfileDefaultWriter } from "@/hooks/queries/profileDefaults";
 import { SETTING_KEYS, type SettingKey } from "@/lib/settingsContract";
 import { optionsFor } from "@/lib/settingsDisplay";
 import { namedLanguageOptionsFor } from "@/lib/languageOptions";
+import {
+  normalizeMetadataLanguageOverrides,
+  type MetadataLanguageOverrides,
+} from "@/lib/metadataLanguagePreferences";
 import { SETTING_DEFINITIONS } from "@/lib/settingsContract";
 import {
   BACKGROUND_STYLE_OPTIONS,
@@ -33,14 +40,20 @@ import {
 import type { SubtitleAppearance } from "@/lib/subtitleAppearance";
 import { toast } from "sonner";
 
-/* Subtitle behavior is a profile preference; a device tunes only appearance. */
+import { ResetButton } from "./ResetButton";
+
+/* Languages, subtitle behavior and subtitle appearance are profile preferences. */
 /**
  * The behavior modes come from the contract rather than a literal list, so a
  * member added to the manifest appears here without a matching edit.
  */
 const SUBTITLE_MODES = optionsFor(SETTING_DEFINITIONS[SETTING_KEYS.PLAYBACK_SUBTITLE_MODE]);
 
-const BEHAVIOR_KEYS: SettingKey[] = [
+/** Read in one batch: the language and subtitle rows want every key at once. */
+const PROFILE_KEYS: SettingKey[] = [
+  SETTING_KEYS.PLAYBACK_AUDIO_LANGUAGE,
+  SETTING_KEYS.CATALOG_METADATA_LANGUAGE,
+  SETTING_KEYS.CATALOG_METADATA_LANGUAGE_OVERRIDES,
   SETTING_KEYS.PLAYBACK_SUBTITLE_LANGUAGE,
   SETTING_KEYS.PLAYBACK_SUBTITLE_MODE,
   SETTING_KEYS.PLAYBACK_SHOW_FORCED_SUBTITLES,
@@ -172,28 +185,50 @@ function SettingRow({ label, description, labelForControl = true, children }: Se
 export default function SubtitleAppearanceSettings() {
   const {
     appearance: effectiveSettings,
-    hasDeviceOverride,
+    isCustomized,
     save: saveAppearance,
     reset: resetAppearance,
     isSaving,
-    isResetting,
   } = useSubtitleAppearanceSetting();
-  const { data: behavior } = useEffectiveSettings({ keys: BEHAVIOR_KEYS });
-  const { save: saveProfileDefault, isSaving: behaviorSaving } = useProfileDefaultWriter(behavior);
+  const subtitleSync = useSubtitleSyncSetting();
+  const { data: profileValues } = useEffectiveSettings({ keys: PROFILE_KEYS });
+  const {
+    save: saveProfileDefault,
+    reset: resetProfileDefault,
+    isSaving: profilePending,
+  } = useProfileDefaultWriter(profileValues);
 
   // The effective endpoint resolves an unset key to the contract default, so a
   // control can read its value straight off the answer without a local literal.
+  const read = <T,>(key: SettingKey) =>
+    (profileValues?.[key]?.value ?? SETTING_DEFINITIONS[key].defaultValue) as T;
+  const audioLanguage = read<string | null>(SETTING_KEYS.PLAYBACK_AUDIO_LANGUAGE);
+  const metadataLanguage = read<string | null>(SETTING_KEYS.CATALOG_METADATA_LANGUAGE);
+  const audioLanguageOptions = namedLanguageOptionsFor(
+    SETTING_KEYS.PLAYBACK_AUDIO_LANGUAGE,
+    audioLanguage,
+    profileValues?.[SETTING_KEYS.PLAYBACK_AUDIO_LANGUAGE]?.suggested_values,
+  );
+  const metadataLanguageOptions = namedLanguageOptionsFor(
+    SETTING_KEYS.CATALOG_METADATA_LANGUAGE,
+    metadataLanguage,
+    profileValues?.[SETTING_KEYS.CATALOG_METADATA_LANGUAGE]?.suggested_values,
+  );
   const subtitleLanguage =
-    (behavior?.[SETTING_KEYS.PLAYBACK_SUBTITLE_LANGUAGE]?.value as string | null | undefined) ?? "";
+    (profileValues?.[SETTING_KEYS.PLAYBACK_SUBTITLE_LANGUAGE]?.value as
+      | string
+      | null
+      | undefined) ?? "";
   const subtitleLanguageOptions = namedLanguageOptionsFor(
     SETTING_KEYS.PLAYBACK_SUBTITLE_LANGUAGE,
     subtitleLanguage,
-    behavior?.[SETTING_KEYS.PLAYBACK_SUBTITLE_LANGUAGE]?.suggested_values,
+    profileValues?.[SETTING_KEYS.PLAYBACK_SUBTITLE_LANGUAGE]?.suggested_values,
   );
   const subtitleMode =
-    (behavior?.[SETTING_KEYS.PLAYBACK_SUBTITLE_MODE]?.value as string | undefined) ?? "auto";
+    (profileValues?.[SETTING_KEYS.PLAYBACK_SUBTITLE_MODE]?.value as string | undefined) ?? "auto";
   const showForcedSubtitles =
-    (behavior?.[SETTING_KEYS.PLAYBACK_SHOW_FORCED_SUBTITLES]?.value as boolean | undefined) ?? true;
+    (profileValues?.[SETTING_KEYS.PLAYBACK_SHOW_FORCED_SUBTITLES]?.value as boolean | undefined) ??
+    true;
 
   const [draftState, setDraftState] = useState<{
     key: string;
@@ -232,47 +267,104 @@ export default function SubtitleAppearanceSettings() {
     }
   }
 
-  async function handleUseFallback() {
+  // Clears the profile's look (and this browser's own copy), so the built-in
+  // one applies on every device again. Any unsaved edits go with it.
+  async function handleResetAppearance() {
     try {
       await resetAppearance();
-      toast.success("Subtitle appearance reset");
+      discardLocalChanges();
+      toast.success("Subtitle appearance reset to the default");
     } catch {
       toast.error("Failed to reset subtitle appearance");
     }
   }
 
   /**
-   * Subtitle behavior writes at profile scope: it is the household member's
-   * choice, not the screen's. A device override would otherwise keep shadowing
-   * the write and snap the control back, so the shared writer clears one when
-   * the resolved value came from this device. A library or series override
-   * still ranks above the profile row, but those are edited where the content
-   * is and stay deliberately untouched here.
+   * Languages and subtitle behavior write at profile scope: they are the
+   * household member's choice, not the screen's. A device override would
+   * otherwise keep shadowing the write and snap the control back, so the
+   * shared writer clears one when the resolved value came from this device. A
+   * library or series override still ranks above the profile row, but those
+   * are edited where the content is and stay deliberately untouched here.
    */
   function saveBehavior(key: SettingKey, value: unknown) {
     saveProfileDefault(key, value).catch(() => toast.error("Failed to save subtitle setting"));
   }
 
+  function saveLanguage(key: SettingKey, value: unknown) {
+    saveProfileDefault(key, value).catch(() => toast.error("Failed to save language setting"));
+  }
+
+  function saveMetadataOverrides(overrides: MetadataLanguageOverrides) {
+    const request =
+      Object.keys(overrides).length === 0
+        ? resetProfileDefault(SETTING_KEYS.CATALOG_METADATA_LANGUAGE_OVERRIDES)
+        : saveProfileDefault(SETTING_KEYS.CATALOG_METADATA_LANGUAGE_OVERRIDES, overrides);
+    return request.catch((error) => {
+      toast.error("Failed to save metadata language exceptions");
+      throw error;
+    });
+  }
+
   const hasUnsavedChanges = JSON.stringify(settings) !== JSON.stringify(effectiveSettings);
-  const behaviorPending = behaviorSaving;
   const usesTextOutline = settings.textOutline || settings.backgroundStyle === "outline";
   const isBoxStyle = settings.backgroundStyle === "box";
   const { containerStyle, cueStyle } = computeSubtitleStyles(settings);
 
   return (
     <div className="space-y-6">
-      <div className="space-y-4">
-        <div className="space-y-3">
-          <h2 className="text-2xl font-semibold tracking-tight sm:text-3xl">Subtitles</h2>
-          <p className="text-muted-foreground max-w-2xl text-sm leading-relaxed">
-            Choose when subtitles appear and how they look during playback.
-          </p>
-        </div>
-      </div>
+      <PageHeader
+        title="Language & Subtitles"
+        subtitle="The languages this profile prefers, when subtitles appear, and how they look."
+      />
+
+      <SettingsGroup title="Language">
+        <SettingRow
+          label="Spoken language"
+          description="Prefer a spoken language for this profile when multiple tracks are available."
+        >
+          {({ id, descriptionId }) => (
+            <div className="w-full sm:w-[220px]">
+              <LanguageSelect
+                id={id}
+                aria-describedby={descriptionId}
+                value={audioLanguage ?? "none"}
+                options={audioLanguageOptions}
+                disabled={profilePending}
+                placeholder="No preference"
+                className="w-full"
+                onValueChange={(value) =>
+                  // The contract spells "no preference" as null, where the
+                  // legacy profile column spelled it as the empty string.
+                  saveLanguage(
+                    SETTING_KEYS.PLAYBACK_AUDIO_LANGUAGE,
+                    value === "none" ? null : value,
+                  )
+                }
+              >
+                <SelectItem value="none">No preference</SelectItem>
+              </LanguageSelect>
+            </div>
+          )}
+        </SettingRow>
+
+        <MetadataLanguageSetting
+          fallback={metadataLanguage}
+          overrides={normalizeMetadataLanguageOverrides(
+            read<unknown>(SETTING_KEYS.CATALOG_METADATA_LANGUAGE_OVERRIDES),
+          )}
+          languageOptions={metadataLanguageOptions}
+          disabled={profilePending}
+          onFallbackChange={(language) =>
+            saveLanguage(SETTING_KEYS.CATALOG_METADATA_LANGUAGE, language)
+          }
+          onOverridesChange={saveMetadataOverrides}
+        />
+      </SettingsGroup>
 
       <SettingsGroup
-        title="Behavior"
-        description="These preferences decide which subtitles Prairie chooses by default."
+        title="Subtitles"
+        description="Which subtitles Prairie picks for this profile."
       >
         <SettingRow
           label="Subtitle language"
@@ -285,7 +377,7 @@ export default function SubtitleAppearanceSettings() {
                 aria-describedby={descriptionId}
                 value={subtitleLanguage || "none"}
                 options={subtitleLanguageOptions}
-                disabled={behaviorPending}
+                disabled={profilePending}
                 placeholder="None"
                 className="w-full"
                 onValueChange={(value) =>
@@ -313,7 +405,7 @@ export default function SubtitleAppearanceSettings() {
                 id={id}
                 aria-describedby={descriptionId}
                 className="w-full sm:w-[220px]"
-                disabled={behaviorPending}
+                disabled={profilePending}
               >
                 <SelectValue />
               </SelectTrigger>
@@ -337,7 +429,7 @@ export default function SubtitleAppearanceSettings() {
               id={id}
               aria-describedby={descriptionId}
               checked={showForcedSubtitles}
-              disabled={behaviorPending}
+              disabled={profilePending}
               onCheckedChange={(checked) =>
                 saveBehavior(SETTING_KEYS.PLAYBACK_SHOW_FORCED_SUBTITLES, checked)
               }
@@ -348,7 +440,16 @@ export default function SubtitleAppearanceSettings() {
 
       <SettingsGroup
         title="Preview"
-        description="This sample reflects the current subtitle appearance."
+        description="How subtitles look for this profile on every device."
+        actions={
+          isCustomized ? (
+            <ResetButton
+              label="Reset subtitle appearance to the default"
+              disabled={isSaving}
+              onClick={() => void handleResetAppearance()}
+            />
+          ) : null
+        }
       >
         <div
           className="surface-panel-subtle relative overflow-hidden rounded-[1.3rem]"
@@ -386,12 +487,6 @@ export default function SubtitleAppearanceSettings() {
           >
             Discard Changes
           </Button>
-          {hasDeviceOverride ? (
-            <Button variant="ghost" onClick={handleUseFallback} disabled={isResetting}>
-              <RotateCcw className="mr-2 h-4 w-4" />
-              Reset Appearance
-            </Button>
-          ) : null}
         </div>
       </SettingsGroup>
 
@@ -562,6 +657,92 @@ export default function SubtitleAppearanceSettings() {
           )}
         </SettingRow>
       </SettingsGroup>
+
+      <SettingsGroup
+        title="Timing"
+        description="Shift every subtitle earlier or later. Applies to this profile on every device."
+      >
+        <SettingRow
+          label="Subtitle offset"
+          labelForControl={false}
+          description="Negative values show subtitles earlier, positive values later."
+        >
+          {({ labelId, descriptionId }) => (
+            <SubtitleOffsetControl
+              labelId={labelId}
+              descriptionId={descriptionId}
+              valueMs={subtitleSync.offsetMs}
+              disabled={!subtitleSync.isLoaded || subtitleSync.isSaving}
+              onChange={(ms) =>
+                subtitleSync.save(ms).catch(() => toast.error("Failed to save subtitle offset"))
+              }
+            />
+          )}
+        </SettingRow>
+      </SettingsGroup>
+    </div>
+  );
+}
+
+const SUBTITLE_OFFSET_STEP_MS = 100;
+
+function formatSubtitleOffset(ms: number): string {
+  if (ms === 0) return "0 ms";
+  return `${ms > 0 ? "+" : "−"}${Math.abs(ms)} ms`;
+}
+
+function SubtitleOffsetControl({
+  labelId,
+  descriptionId,
+  valueMs,
+  disabled,
+  onChange,
+}: {
+  labelId: string;
+  descriptionId: string;
+  valueMs: number;
+  disabled: boolean;
+  onChange: (ms: number) => void;
+}) {
+  return (
+    <div
+      role="group"
+      aria-labelledby={labelId}
+      aria-describedby={descriptionId}
+      className="flex items-center gap-1"
+    >
+      <Button
+        variant="outline"
+        size="icon"
+        aria-label={`Show subtitles ${SUBTITLE_OFFSET_STEP_MS} ms earlier`}
+        disabled={disabled || valueMs <= -SUBTITLE_SYNC_MAX_MS}
+        onClick={() => onChange(valueMs - SUBTITLE_OFFSET_STEP_MS)}
+      >
+        <Minus className="h-4 w-4" />
+      </Button>
+      <output
+        aria-live="polite"
+        className="min-w-[5.5rem] text-center font-mono text-sm tabular-nums"
+      >
+        {formatSubtitleOffset(valueMs)}
+      </output>
+      <Button
+        variant="outline"
+        size="icon"
+        aria-label={`Show subtitles ${SUBTITLE_OFFSET_STEP_MS} ms later`}
+        disabled={disabled || valueMs >= SUBTITLE_SYNC_MAX_MS}
+        onClick={() => onChange(valueMs + SUBTITLE_OFFSET_STEP_MS)}
+      >
+        <Plus className="h-4 w-4" />
+      </Button>
+      <Button
+        variant="ghost"
+        size="sm"
+        disabled={disabled || valueMs === 0}
+        onClick={() => onChange(0)}
+      >
+        Reset
+      </Button>
     </div>
   );
 }
diff --git a/web/src/pages/settings/TitleArtSettingsGroup.tsx b/web/src/pages/settings/TitleArtSettingsGroup.tsx
index df77ff11e6..7b8da7b6ba 100644
--- a/web/src/pages/settings/TitleArtSettingsGroup.tsx
+++ b/web/src/pages/settings/TitleArtSettingsGroup.tsx
@@ -13,8 +13,8 @@ import { SETTING_DEFINITIONS, SETTING_KEYS } from "@/lib/settingsContract";
 
 /**
  * Title art and its "Apply to all devices" companion. Unlike the rest of the
- * Navigation & Cards page this is not a web-family setting: it is this
- * browser's own choice, or the profile's choice for every device.
+ * Title Pages page this is not only the profile's choice: it is this browser's
+ * own choice, or the profile's choice for every device.
  */
 export function TitleArtSettingsGroup() {
   const capabilities = useSettingsCapabilities();
@@ -29,10 +29,7 @@ export function TitleArtSettingsGroup() {
     write.catch(() => toast.error("Could not save the title art setting"));
 
   return (
-    <SettingsGroup
-      title="Title pages"
-      description="How a movie or show is named at the top of its page."
-    >
+    <SettingsGroup title="Title" description="How a movie or show is named at the top of its page.">
       <SettingRow
         icon={<Type />}
         label={SETTING_DEFINITIONS[SETTING_KEYS.UI_TITLE_ART].label}
diff --git a/web/src/pages/settings/TitlePagesSettings.test.tsx b/web/src/pages/settings/TitlePagesSettings.test.tsx
new file mode 100644
index 0000000000..8263eb9393
--- /dev/null
+++ b/web/src/pages/settings/TitlePagesSettings.test.tsx
@@ -0,0 +1,280 @@
+// @vitest-environment jsdom
+
+import { render, screen, cleanup } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+// Radix Select reads element sizes via ResizeObserver and opens through
+// pointer capture; jsdom provides neither.
+class ResizeObserverStub {
+  observe() {}
+  unobserve() {}
+  disconnect() {}
+}
+if (typeof globalThis.ResizeObserver === "undefined") {
+  (globalThis as unknown as { ResizeObserver: typeof ResizeObserverStub }).ResizeObserver =
+    ResizeObserverStub;
+}
+if (typeof window !== "undefined" && !window.HTMLElement.prototype.hasPointerCapture) {
+  window.HTMLElement.prototype.hasPointerCapture = () => false;
+  window.HTMLElement.prototype.scrollIntoView = () => {};
+}
+
+import type {
+  EffectiveSetting,
+  EffectiveSettingsMap,
+  SettingsCapabilities,
+} from "@/hooks/queries/settingValues";
+import { SETTING_KEYS, type SettingKey } from "@/lib/settingsContract";
+
+const mocks = vi.hoisted(() => ({
+  useEffectiveSettings: vi.fn(),
+  useSetSettingValue: vi.fn(),
+  useClearSettingValue: vi.fn(),
+  capabilities: {
+    api_version: 1,
+    manifest_revision: 7,
+    contract_etag: "revision-seven",
+    supports_batched_effective: true,
+    supports_idempotent_writes: true,
+  } as SettingsCapabilities | undefined,
+  /** Whether the capability check has answered; false covers pending and failed. */
+  capabilitiesSettled: true,
+  /** A failed capability request, which reads as "unknown", never as "old". */
+  capabilitiesError: undefined as Error | undefined,
+  toast: { error: vi.fn(), success: vi.fn() },
+}));
+
+vi.mock("sonner", () => ({ toast: mocks.toast }));
+
+vi.mock("@/hooks/queries/settingValues", async () => {
+  const actual = await vi.importActual<typeof import("@/hooks/queries/settingValues")>(
+    "@/hooks/queries/settingValues",
+  );
+
+  return {
+    ...actual,
+    useEffectiveSettings: (...args: unknown[]) => mocks.useEffectiveSettings(...args),
+    useSetSettingValue: (...args: unknown[]) => mocks.useSetSettingValue(...args),
+    useClearSettingValue: (...args: unknown[]) => mocks.useClearSettingValue(...args),
+    useSettingsCapabilities: () => ({
+      data: mocks.capabilities,
+      isLoading: false,
+      isPending: !mocks.capabilitiesSettled && !mocks.capabilitiesError,
+      isSuccess: mocks.capabilitiesSettled,
+      error: mocks.capabilitiesError,
+    }),
+  };
+});
+
+// Title art has its own suite and reads hooks this page's tests do not mock.
+vi.mock("@/pages/settings/TitleArtSettingsGroup", () => ({ TitleArtSettingsGroup: () => null }));
+
+import TitlePagesSettings from "./TitlePagesSettings";
+
+function capabilitiesAtRevision(revision: number): SettingsCapabilities {
+  return {
+    api_version: 1,
+    manifest_revision: revision,
+    contract_etag: `revision-${revision}`,
+    supports_batched_effective: true,
+    supports_idempotent_writes: true,
+  };
+}
+
+function resolved(
+  key: SettingKey,
+  value: unknown,
+  source: EffectiveSetting["source"],
+): EffectiveSettingsMap {
+  return { [key]: { key, value, source } };
+}
+
+describe("TitlePagesSettings", () => {
+  let mutate: ReturnType<typeof vi.fn>;
+  let mutateAsync: ReturnType<typeof vi.fn>;
+  let clearMutateAsync: ReturnType<typeof vi.fn>;
+
+  beforeEach(() => {
+    mocks.useEffectiveSettings.mockReset();
+    mocks.useSetSettingValue.mockReset();
+    mocks.useClearSettingValue.mockReset();
+    mocks.capabilities = capabilitiesAtRevision(7);
+    mocks.capabilitiesSettled = true;
+    mocks.capabilitiesError = undefined;
+    mocks.toast.error.mockReset();
+    mocks.toast.success.mockReset();
+    // The environment's localStorage global is inert; legacy audiobook
+    // intervals are read through it, so give each test a fresh in-memory one.
+    const memory = new Map<string, string>();
+    Object.defineProperty(globalThis, "localStorage", {
+      configurable: true,
+      value: {
+        getItem: (key: string) => memory.get(key) ?? null,
+        setItem: (key: string, value: string) => memory.set(key, value),
+        removeItem: (key: string) => memory.delete(key),
+      },
+    });
+    mutate = vi.fn();
+    mutateAsync = vi.fn().mockResolvedValue(undefined);
+    clearMutateAsync = vi.fn().mockResolvedValue(undefined);
+
+    mocks.useEffectiveSettings.mockReturnValue({ data: {}, isLoading: false });
+    mocks.useSetSettingValue.mockReturnValue({ isPending: false, mutate, mutateAsync });
+    mocks.useClearSettingValue.mockReturnValue({
+      isPending: false,
+      mutate: vi.fn(),
+      mutateAsync: clearMutateAsync,
+    });
+  });
+
+  afterEach(cleanup);
+
+  it.each([
+    ["older server", capabilitiesAtRevision(10)],
+    ["unknown capabilities", undefined],
+    ["unsupported settings API", { ...capabilitiesAtRevision(11), api_version: 2 }],
+    ["no batched settings", { ...capabilitiesAtRevision(11), supports_batched_effective: false }],
+  ])("does not request or offer theme settings with %s", (_scenario, capabilities) => {
+    mocks.capabilities = capabilities as SettingsCapabilities | undefined;
+    mocks.capabilitiesSettled = capabilities !== undefined;
+
+    render(<TitlePagesSettings />);
+
+    expect(screen.queryByRole("switch", { name: "Theme music" })).not.toBeInTheDocument();
+    expect(screen.queryByRole("switch", { name: "Loop theme music" })).not.toBeInTheDocument();
+    for (const [options] of mocks.useEffectiveSettings.mock.calls) {
+      expect(options.keys ?? []).not.toContain(SETTING_KEYS.UI_THEME_MUSIC_ENABLED);
+      expect(options.keys ?? []).not.toContain(SETTING_KEYS.UI_THEME_MUSIC_LOOP);
+    }
+    expect(mutateAsync).not.toHaveBeenCalled();
+  });
+
+  it("offers supported theme settings and saves them at profile scope", async () => {
+    mocks.capabilities = capabilitiesAtRevision(11);
+    render(<TitlePagesSettings />);
+
+    const requested = mocks.useEffectiveSettings.mock.calls.flatMap(
+      ([options]) => options.keys ?? [],
+    );
+    expect(requested).toContain(SETTING_KEYS.UI_THEME_MUSIC_ENABLED);
+    expect(requested).toContain(SETTING_KEYS.UI_THEME_MUSIC_LOOP);
+    const enabled = screen.getByRole("switch", { name: "Theme music" });
+    const loop = screen.getByRole("switch", { name: "Loop theme music" });
+    expect(enabled).not.toBeChecked();
+    expect(loop).not.toBeChecked();
+    await userEvent.click(enabled);
+    await userEvent.click(loop);
+    expect(mutateAsync).toHaveBeenCalledWith({
+      key: SETTING_KEYS.UI_THEME_MUSIC_ENABLED,
+      value: true,
+      identity: { scope: "profile" },
+    });
+    expect(mutateAsync).toHaveBeenCalledWith({
+      key: SETTING_KEYS.UI_THEME_MUSIC_LOOP,
+      value: true,
+      identity: { scope: "profile" },
+    });
+  });
+
+  it("updates theme controls and requested keys when server support changes", () => {
+    mocks.capabilities = undefined;
+    mocks.capabilitiesSettled = false;
+    const { rerender } = render(<TitlePagesSettings />);
+    expect(screen.queryByRole("switch", { name: "Theme music" })).not.toBeInTheDocument();
+
+    mocks.capabilities = capabilitiesAtRevision(11);
+    mocks.capabilitiesSettled = true;
+    rerender(<TitlePagesSettings />);
+    expect(screen.getByRole("switch", { name: "Theme music" })).toBeInTheDocument();
+
+    mocks.useEffectiveSettings.mockClear();
+    mocks.capabilities = capabilitiesAtRevision(10);
+    rerender(<TitlePagesSettings />);
+    expect(screen.queryByRole("switch", { name: "Theme music" })).not.toBeInTheDocument();
+    expect(screen.queryByRole("switch", { name: "Loop theme music" })).not.toBeInTheDocument();
+    for (const [options] of mocks.useEffectiveSettings.mock.calls) {
+      expect(options.keys ?? []).not.toContain(SETTING_KEYS.UI_THEME_MUSIC_ENABLED);
+      expect(options.keys ?? []).not.toContain(SETTING_KEYS.UI_THEME_MUSIC_LOOP);
+    }
+  });
+
+  it.each(["pending", "error", "refetch error"] as const)(
+    "blocks theme writes while effective settings are %s and recovers after loading",
+    async (state) => {
+      mocks.capabilities = capabilitiesAtRevision(11);
+      const values = {
+        ...resolved(SETTING_KEYS.UI_THEME_MUSIC_ENABLED, true, "profile"),
+        ...resolved(SETTING_KEYS.UI_THEME_MUSIC_LOOP, true, "profile"),
+      };
+      mocks.useEffectiveSettings.mockReturnValue({
+        data: state === "refetch error" ? values : undefined,
+        isPending: state === "pending",
+        isError: state !== "pending",
+      });
+      const { rerender } = render(<TitlePagesSettings />);
+      const enabled = screen.getByRole("switch", { name: "Theme music" });
+      const loop = screen.getByRole("switch", { name: "Loop theme music" });
+      expect(enabled).toBeDisabled();
+      expect(loop).toBeDisabled();
+      await userEvent.click(enabled);
+      await userEvent.click(loop);
+      expect(mutateAsync).not.toHaveBeenCalled();
+      expect(clearMutateAsync).not.toHaveBeenCalled();
+
+      mocks.useEffectiveSettings.mockReturnValue({
+        data: values,
+        isPending: false,
+        isError: false,
+      });
+      rerender(<TitlePagesSettings />);
+      expect(enabled).toBeEnabled();
+      expect(loop).toBeEnabled();
+      expect(enabled).toBeChecked();
+      expect(loop).toBeChecked();
+      await userEvent.click(enabled);
+      await userEvent.click(loop);
+      for (const key of [SETTING_KEYS.UI_THEME_MUSIC_ENABLED, SETTING_KEYS.UI_THEME_MUSIC_LOOP]) {
+        expect(mutateAsync).toHaveBeenCalledWith({
+          key,
+          value: false,
+          identity: { scope: "profile" },
+        });
+      }
+    },
+  );
+
+  it("saves the spoiler switches and the advisory age at profile scope", async () => {
+    // Revision 17 introduced the spoiler keys.
+    mocks.capabilities = capabilitiesAtRevision(17);
+    render(<TitlePagesSettings />);
+
+    await userEvent.click(screen.getByRole("switch", { name: "Blur unwatched episode images" }));
+    await userEvent.click(
+      screen.getByRole("switch", { name: "Hide unwatched episode descriptions" }),
+    );
+    await userEvent.click(screen.getByRole("switch", { name: "Show advisory age" }));
+
+    for (const key of [
+      SETTING_KEYS.CATALOG_HIDE_UNWATCHED_EPISODE_IMAGES,
+      SETTING_KEYS.CATALOG_HIDE_UNWATCHED_EPISODE_OVERVIEWS,
+      SETTING_KEYS.CATALOG_SHOW_ADVISORY_AGE,
+    ]) {
+      expect(mutateAsync).toHaveBeenCalledWith({
+        key,
+        value: true,
+        identity: { scope: "profile" },
+      });
+    }
+  });
+
+  it("leaves the spoiler switches off a server that cannot store them", () => {
+    mocks.capabilities = capabilitiesAtRevision(16);
+    render(<TitlePagesSettings />);
+
+    expect(
+      screen.queryByRole("switch", { name: "Blur unwatched episode images" }),
+    ).not.toBeInTheDocument();
+    expect(screen.getByRole("switch", { name: "Show advisory age" })).toBeInTheDocument();
+  });
+});
diff --git a/web/src/pages/settings/TitlePagesSettings.tsx b/web/src/pages/settings/TitlePagesSettings.tsx
new file mode 100644
index 0000000000..b24294336d
--- /dev/null
+++ b/web/src/pages/settings/TitlePagesSettings.tsx
@@ -0,0 +1,113 @@
+import { useMemo } from "react";
+import { toast } from "sonner";
+
+import { PageHeader } from "@/components/page/PageHeader";
+import { SettingRow } from "@/components/settings/SettingRow";
+import { SettingsGroup } from "@/components/settings/SettingsGroup";
+import { Switch } from "@/components/ui/switch";
+import { useProfileDefaultWriter } from "@/hooks/queries/profileDefaults";
+import {
+  settingsCapabilitiesSupportKey,
+  useEffectiveSettings,
+  useSettingsCapabilities,
+} from "@/hooks/queries/settingValues";
+import { SETTING_DEFINITIONS, SETTING_KEYS, type SettingKey } from "@/lib/settingsContract";
+
+import { TitleArtSettingsGroup } from "./TitleArtSettingsGroup";
+
+const EPISODE_SPOILER_KEYS = [
+  SETTING_KEYS.CATALOG_HIDE_UNWATCHED_EPISODE_IMAGES,
+  SETTING_KEYS.CATALOG_HIDE_UNWATCHED_EPISODE_OVERVIEWS,
+] as const;
+
+/**
+ * Settings > Title Pages: what a movie or show page shows and plays when it
+ * opens. Every value here is the profile's own choice except title art, which
+ * can also be this browser's alone (see TitleArtSettingsGroup).
+ */
+export default function TitlePagesSettings() {
+  const capabilities = useSettingsCapabilities();
+  const supportsThemeMusic = settingsCapabilitiesSupportKey(
+    capabilities.data,
+    SETTING_KEYS.UI_THEME_MUSIC_ENABLED,
+  );
+  const supportsThemeMusicLoop = settingsCapabilitiesSupportKey(
+    capabilities.data,
+    SETTING_KEYS.UI_THEME_MUSIC_LOOP,
+  );
+  // Both spoiler keys share one introduced_in revision.
+  const supportsEpisodeSpoilers = settingsCapabilitiesSupportKey(
+    capabilities.data,
+    SETTING_KEYS.CATALOG_HIDE_UNWATCHED_EPISODE_IMAGES,
+  );
+  const keys = useMemo<SettingKey[]>(
+    () => [
+      SETTING_KEYS.CATALOG_SHOW_ADVISORY_AGE,
+      ...(supportsThemeMusic ? [SETTING_KEYS.UI_THEME_MUSIC_ENABLED] : []),
+      ...(supportsThemeMusicLoop ? [SETTING_KEYS.UI_THEME_MUSIC_LOOP] : []),
+      ...(supportsEpisodeSpoilers ? EPISODE_SPOILER_KEYS : []),
+    ],
+    [supportsEpisodeSpoilers, supportsThemeMusic, supportsThemeMusicLoop],
+  );
+  const { data: effective, isPending, isError } = useEffectiveSettings({ keys });
+  // Saves at profile scope and clears any device override shadowing it, the
+  // same writer Playback uses, so a device row cannot snap a switch back.
+  const { save, isSaving } = useProfileDefaultWriter(effective);
+  const disabled = isSaving || isPending || isError;
+
+  // The effective endpoint resolves an unset key to the contract default.
+  const read = (key: SettingKey) =>
+    (effective?.[key]?.value ?? SETTING_DEFINITIONS[key].defaultValue) as boolean;
+
+  const switchRow = (key: SettingKey, description = SETTING_DEFINITIONS[key].description) => (
+    <SettingRow
+      key={key}
+      label={SETTING_DEFINITIONS[key].label}
+      description={description}
+      control={(id) => (
+        <Switch
+          id={id}
+          checked={read(key)}
+          disabled={disabled}
+          onCheckedChange={(value) =>
+            save(key, value).catch(() => toast.error("Failed to save title page setting"))
+          }
+        />
+      )}
+    />
+  );
+
+  return (
+    <div className="space-y-6">
+      <PageHeader
+        title="Title Pages"
+        subtitle="What a movie or show page shows and plays when you open it."
+      />
+
+      <TitleArtSettingsGroup />
+
+      {supportsThemeMusic ? (
+        <SettingsGroup title="Sound" description="Plays while a title's page is open.">
+          {switchRow(SETTING_KEYS.UI_THEME_MUSIC_ENABLED)}
+          {supportsThemeMusicLoop ? switchRow(SETTING_KEYS.UI_THEME_MUSIC_LOOP) : null}
+        </SettingsGroup>
+      ) : null}
+
+      {supportsEpisodeSpoilers ? (
+        <SettingsGroup
+          title="Spoilers"
+          description="Applies to episodes you have not started, on every device that uses this profile."
+        >
+          {EPISODE_SPOILER_KEYS.map((key) => switchRow(key))}
+        </SettingsGroup>
+      ) : null}
+
+      <SettingsGroup title="Age guidance">
+        {switchRow(
+          SETTING_KEYS.CATALOG_SHOW_ADVISORY_AGE,
+          "Show a suggested minimum viewer age, such as Common Sense Media's, on a title's page. This only shows the age; a household manager can limit a profile by it in the profile's access settings.",
+        )}
+      </SettingsGroup>
+    </div>
+  );
+}
diff --git a/web/src/pages/settings/WatchProvidersSettings.test.tsx b/web/src/pages/settings/WatchProvidersSettings.test.tsx
new file mode 100644
index 0000000000..13879d44b6
--- /dev/null
+++ b/web/src/pages/settings/WatchProvidersSettings.test.tsx
@@ -0,0 +1,202 @@
+// @vitest-environment jsdom
+
+import { act } from "react";
+import { createRoot, type Root } from "react-dom/client";
+import { QueryClient, QueryClientProvider, useMutation } from "@tanstack/react-query";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { V2ProblemError, type Problem } from "@/api/v2/request";
+import type { WatchProviderConnection } from "@/hooks/queries/watchProviders";
+
+const mocks = vi.hoisted(() => ({
+  updateConnection: vi.fn(),
+  idleMutation: () => ({ mutate: () => {}, isPending: false, error: null }),
+}));
+
+vi.mock("@/hooks/queries/watchProviders", () => ({
+  WatchProviderAuthMethod: { DeviceCode: "device_code", APIKey: "api_key" },
+  useWatchProviders: () => ({
+    data: { providers: [{ key: "simkl", display_name: "Simkl" }] },
+    isLoading: false,
+  }),
+  useWatchProviderConnection: () => ({
+    data: makeConnection(),
+    isLoading: false,
+    isFetching: false,
+  }),
+  useWatchProviderSyncRuns: () => ({ data: undefined }),
+  useUpdateWatchProviderConnection: () =>
+    useMutation({ retry: false, mutationFn: mocks.updateConnection }),
+  useStartWatchProviderDeviceAuth: mocks.idleMutation,
+  usePollWatchProviderDeviceAuth: mocks.idleMutation,
+  useConnectWatchProviderAPIKey: mocks.idleMutation,
+  useDeleteWatchProviderConnection: mocks.idleMutation,
+  useTriggerWatchProviderSync: mocks.idleMutation,
+}));
+
+import WatchProvidersSettings from "./WatchProvidersSettings";
+
+function makeConnection(): WatchProviderConnection {
+  return {
+    etag: '"v1"',
+    provider: "simkl",
+    display_name: "Simkl",
+    capabilities: {
+      import_watched: true,
+      import_progress: true,
+      export_watched: true,
+      export_unwatched: false,
+      import_favorites: false,
+      export_favorites: false,
+      remove_favorites: false,
+      import_watchlist: false,
+      export_watchlist: false,
+      remove_watchlist: false,
+      provides_watchlist_order: false,
+      scrobble_playback: true,
+      import_ratings: false,
+      export_ratings: false,
+      sync_dropped: false,
+    },
+    auth_method: "device_code",
+    connected: true,
+    provider_username: "alice",
+    import_watched_enabled: false,
+    import_progress_enabled: false,
+    export_watched_enabled: false,
+    export_unwatched_enabled: false,
+    import_favorites_enabled: false,
+    export_favorites_enabled: false,
+    sync_favorite_removals_enabled: false,
+    import_watchlist_enabled: false,
+    export_watchlist_enabled: false,
+    sync_watchlist_removals_enabled: false,
+    sync_watchlist_order_enabled: false,
+    scrobble_enabled: false,
+    import_ratings_enabled: false,
+    export_ratings_enabled: false,
+    sync_dropped_enabled: false,
+    credentials_configured: true,
+  };
+}
+
+function conflictError() {
+  return new V2ProblemError("updateWatchProviderConnection", {
+    type: "https://siloserver.org/problems/precondition_failed",
+    title: "Precondition failed",
+    status: 412,
+  } as Problem);
+}
+
+function deferred<T>() {
+  let resolve!: (value: T) => void;
+  let reject!: (reason: unknown) => void;
+  const promise = new Promise<T>((res, rej) => {
+    resolve = res;
+    reject = rej;
+  });
+  return { promise, resolve, reject };
+}
+
+function findButton(container: HTMLElement, label: string) {
+  const button = Array.from(container.querySelectorAll("button")).find(
+    (candidate) => candidate.textContent?.trim() === label,
+  );
+  if (!button) throw new Error(`button not found: ${label}`);
+  return button;
+}
+
+function settingsPanel(container: HTMLElement) {
+  return container.querySelector("#watch-provider-simkl-settings");
+}
+
+// React Query delivers observer updates on a zero-delay timer.
+async function flush() {
+  await act(async () => {
+    await new Promise((resolve) => setTimeout(resolve, 0));
+  });
+}
+
+describe("WatchProvidersSettings", () => {
+  let container: HTMLDivElement;
+  let root: Root;
+
+  beforeEach(() => {
+    (globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
+    container = document.createElement("div");
+    document.body.appendChild(container);
+    root = createRoot(container);
+    mocks.updateConnection.mockReset();
+  });
+
+  afterEach(() => {
+    act(() => root.unmount());
+    container.remove();
+  });
+
+  it("keeps the settings open while retrying a conflicted change", async () => {
+    const firstSave = deferred<unknown>();
+    const retry = deferred<unknown>();
+    mocks.updateConnection
+      .mockReturnValueOnce(firstSave.promise)
+      .mockReturnValueOnce(retry.promise);
+
+    const queryClient = new QueryClient();
+    act(() => {
+      root.render(
+        <QueryClientProvider client={queryClient}>
+          <WatchProvidersSettings />
+        </QueryClientProvider>,
+      );
+    });
+
+    const toggle = findButton(container, "Settings");
+    expect(toggle.getAttribute("aria-expanded")).toBe("false");
+    expect(settingsPanel(container)).toBeNull();
+
+    act(() => toggle.click());
+    act(() => {
+      (container.querySelector("#watch-provider-simkl-import-watched") as HTMLElement).click();
+    });
+    await flush();
+    expect(mocks.updateConnection).toHaveBeenCalledTimes(1);
+
+    // The user folds the section away while the save is still pending.
+    act(() => toggle.click());
+    expect(settingsPanel(container)).toBeNull();
+
+    await act(async () => {
+      firstSave.reject(conflictError());
+      await firstSave.promise.catch(() => undefined);
+    });
+    await flush();
+
+    // The conflict opens the section and the button reflects it.
+    expect(container.querySelector('[role="alert"]')?.textContent).toContain(
+      "These settings changed elsewhere",
+    );
+    expect(toggle.getAttribute("aria-expanded")).toBe("true");
+
+    act(() => findButton(container, "Apply my change").click());
+    await flush();
+    expect(mocks.updateConnection).toHaveBeenCalledTimes(2);
+    expect(mocks.updateConnection.mock.calls[1]?.[0]).toEqual({ import_watched_enabled: true });
+
+    // The retry clears the conflict, but the section stays open mid-save.
+    expect(container.querySelector('[role="alert"]')).toBeNull();
+    expect(settingsPanel(container)).not.toBeNull();
+    expect(toggle.getAttribute("aria-expanded")).toBe("true");
+
+    await act(async () => {
+      retry.resolve({});
+      await retry.promise;
+    });
+    await flush();
+    expect(settingsPanel(container)).not.toBeNull();
+
+    // The button still closes the section once the conflict is gone.
+    act(() => toggle.click());
+    expect(settingsPanel(container)).toBeNull();
+    expect(toggle.getAttribute("aria-expanded")).toBe("false");
+  });
+});
diff --git a/web/src/pages/settings/WatchProvidersSettings.tsx b/web/src/pages/settings/WatchProvidersSettings.tsx
index 0082b9a102..9f7adade6b 100644
--- a/web/src/pages/settings/WatchProvidersSettings.tsx
+++ b/web/src/pages/settings/WatchProvidersSettings.tsx
@@ -3,6 +3,7 @@ import {
   AlertCircle,
   Check,
   CheckCircle2,
+  ChevronDown,
   Copy,
   ExternalLink,
   Loader2,
@@ -12,6 +13,7 @@ import {
 } from "lucide-react";
 import { toast } from "sonner";
 import { V2ProblemError } from "@/api/v2/request";
+import { PageHeader } from "@/components/page/PageHeader";
 import { Button } from "@/components/ui/button";
 import { Switch } from "@/components/ui/switch";
 import { Label } from "@/components/ui/label";
@@ -75,7 +77,7 @@ function StatusPill({ variant, children }: { variant: StatusVariant; children: R
   return (
     <span
       className={cn(
-        "inline-flex items-center gap-1.5 rounded-full px-2.5 py-0.5 text-[11px] font-medium ring-1 ring-inset",
+        "inline-flex items-center gap-1.5 rounded-full px-2.5 py-0.5 text-xs font-medium ring-1 ring-inset",
         STATUS_PILL_STYLES[variant],
       )}
     >
@@ -141,7 +143,7 @@ function booleanSettingValue(
 function StatCell({ label, value }: { label: string; value: React.ReactNode }) {
   return (
     <div className="min-w-0">
-      <div className="text-muted-foreground text-[10px] font-medium tracking-wider uppercase">
+      <div className="text-muted-foreground text-xs font-medium tracking-wider uppercase">
         {label}
       </div>
       <div className="mt-0.5 truncate text-sm font-medium">{value}</div>
@@ -420,8 +422,17 @@ function WatchProviderCard({
   const [authSession, setAuthSession] = useState<DeviceAuthSession | null>(null);
   const [codeCopied, setCodeCopied] = useState(false);
   const [apiKeyPrompt, setApiKeyPrompt] = useState(false);
+  const [settingsOpen, setSettingsOpen] = useState(false);
   const settingsConflict =
     updateConnection.error instanceof V2ProblemError && updateConnection.error.status === 412;
+  // A settings conflict opens the section so the attempted change and its
+  // choices are visible. Opening it in state, not deriving visibility from
+  // the error, keeps it open while a retry clears the error.
+  const [conflictShown, setConflictShown] = useState(false);
+  if (settingsConflict !== conflictShown) {
+    setConflictShown(settingsConflict);
+    if (settingsConflict) setSettingsOpen(true);
+  }
   const connection =
     savedConnection && settingsConflict
       ? {
@@ -468,6 +479,7 @@ function WatchProviderCard({
   const showAuth = Boolean(authSession) && !connection.connected;
   const showAPIKey = usesAPIKey && apiKeyPrompt && !connection.connected;
   const runInfo = connection.connected ? deriveRunInfo(connection, latestRun) : null;
+  const settingsPanelId = `watch-provider-${providerKey}-settings`;
   const hasError = Boolean(runInfo?.errorMessage);
   const favoritesSyncEnabled =
     connection.import_favorites_enabled || connection.export_favorites_enabled;
@@ -499,7 +511,7 @@ function WatchProviderCard({
       const username = connection.provider_username || displayName;
       return `${username} · ${formatLastSync(connection, latestRun)}`;
     }
-    if (!connection.credentials_configured) return "Server credentials required.";
+    if (!connection.credentials_configured) return "Server setup required.";
     if (usesAPIKey)
       return `Connect with your ${displayName} API key to import watch history and scrobble playback.`;
     return "Connect to start importing watch history and scrobbling playback.";
@@ -703,202 +715,225 @@ function WatchProviderCard({
             </div>
           </div>
 
-          {settingsConflict && (
-            <div role="alert" className="border-border mb-4 rounded-xl border p-4 text-sm">
-              <p>These settings changed elsewhere. Your change is still shown below.</p>
-              <div className="mt-3 flex flex-wrap gap-2">
-                <Button
-                  size="sm"
-                  disabled={isFetching || updateConnection.isPending}
-                  onClick={() => {
-                    if (updateConnection.variables)
-                      updateConnection.mutate(updateConnection.variables);
-                  }}
-                >
-                  Apply my change
-                </Button>
-                <Button
-                  size="sm"
-                  variant="outline"
-                  disabled={isFetching}
-                  onClick={() => updateConnection.reset()}
-                >
-                  Use latest settings
-                </Button>
-              </div>
-            </div>
-          )}
-          <div className="grid grid-cols-1 gap-x-6 gap-y-1 sm:grid-cols-2">
-            <ToggleRow
-              id={`watch-provider-${providerKey}-import-watched`}
-              label="Import watched history"
-              description={`Bring completed ${displayName} plays into this profile.`}
-              checked={connection.import_watched_enabled}
-              disabled={isBusy}
-              onChange={(checked) => updateConnection.mutate({ import_watched_enabled: checked })}
+          <button
+            type="button"
+            aria-expanded={settingsOpen}
+            aria-controls={settingsPanelId}
+            onClick={() => setSettingsOpen(!settingsOpen)}
+            className="text-muted-foreground hover:text-foreground flex w-full items-center justify-between gap-3 rounded-lg py-1 text-left text-sm font-medium transition-colors"
+          >
+            Settings
+            <ChevronDown
+              aria-hidden="true"
+              className={cn("h-4 w-4 shrink-0 transition-transform", settingsOpen && "rotate-180")}
             />
-            <ToggleRow
-              id={`watch-provider-${providerKey}-import-progress`}
-              label="Import paused progress"
-              description={`Use newer ${displayName} resume points when local progress is older.`}
-              checked={connection.import_progress_enabled}
-              disabled={isBusy}
-              onChange={(checked) => updateConnection.mutate({ import_progress_enabled: checked })}
-            />
-            <ToggleRow
-              id={`watch-provider-${providerKey}-export-watched`}
-              label="Send watched changes"
-              description="Send local watched marks and completed plays to this provider."
-              checked={connection.export_watched_enabled}
-              disabled={isBusy}
-              onChange={(checked) => updateConnection.mutate({ export_watched_enabled: checked })}
-            />
-            {connection.capabilities.export_unwatched ? (
-              <ToggleRow
-                id={`watch-provider-${providerKey}-export-unwatched`}
-                label="Send unwatched changes"
-                description="When you mark something unwatched, remove matching history from this provider."
-                checked={connection.export_unwatched_enabled}
-                disabled={isBusy}
-                onChange={(checked) =>
-                  updateConnection.mutate({ export_unwatched_enabled: checked })
-                }
-              />
-            ) : null}
-            {connection.capabilities.import_favorites ||
-            connection.capabilities.export_favorites ? (
-              <ToggleRow
-                id={`watch-provider-${providerKey}-favorites`}
-                label="Sync favorites"
-                description={`Import ${displayName} movie and show favorites, and send local favorite adds.`}
-                checked={favoritesSyncEnabled}
-                disabled={isBusy}
-                onChange={(checked) =>
-                  updateConnection.mutate({
-                    import_favorites_enabled: checked,
-                    export_favorites_enabled: checked,
-                    sync_favorite_removals_enabled: checked
-                      ? connection.sync_favorite_removals_enabled
-                      : false,
-                  })
-                }
-              />
-            ) : null}
-            {connection.capabilities.remove_favorites ? (
-              <ToggleRow
-                id={`watch-provider-${providerKey}-favorite-removals`}
-                label="Sync favorite removals"
-                description="Remove provider-synced favorites on the other side when they are explicitly unfavorited."
-                checked={connection.sync_favorite_removals_enabled}
-                disabled={isBusy || !favoritesSyncEnabled}
-                onChange={(checked) =>
-                  updateConnection.mutate({
-                    sync_favorite_removals_enabled: checked,
-                  })
-                }
-              />
-            ) : null}
-            {connection.capabilities.import_watchlist ||
-            connection.capabilities.export_watchlist ? (
-              <ToggleRow
-                id={`watch-provider-${providerKey}-watchlist`}
-                label="Sync watchlist"
-                description={`Import your ${displayName} watchlist, and send local watchlist adds.`}
-                checked={watchlistSyncEnabled}
-                disabled={isBusy}
-                onChange={(checked) =>
-                  updateConnection.mutate({
-                    import_watchlist_enabled: checked,
-                    export_watchlist_enabled: checked,
-                    sync_watchlist_removals_enabled: checked
-                      ? connection.sync_watchlist_removals_enabled
-                      : false,
-                  })
-                }
-              />
-            ) : null}
-            {connection.capabilities.remove_watchlist ? (
-              <ToggleRow
-                id={`watch-provider-${providerKey}-watchlist-removals`}
-                label="Sync watchlist removals"
-                description="Remove provider-synced watchlist items on the other side when they are removed locally."
-                checked={connection.sync_watchlist_removals_enabled}
-                disabled={isBusy || !watchlistSyncEnabled}
-                onChange={(checked) =>
-                  updateConnection.mutate({
-                    sync_watchlist_removals_enabled: checked,
-                  })
-                }
-              />
-            ) : null}
-            {connection.capabilities.provides_watchlist_order ? (
-              <ToggleRow
-                id={`watch-provider-${providerKey}-watchlist-order`}
-                label="Mirror watchlist order"
-                description={`Order your Prairie watchlist to match its ${displayName} sort order. Items not on ${displayName} stay at the bottom.`}
-                checked={connection.sync_watchlist_order_enabled}
-                disabled={isBusy || !connection.import_watchlist_enabled}
-                onChange={(checked) =>
-                  updateConnection.mutate({
-                    sync_watchlist_order_enabled: checked,
-                  })
-                }
-              />
-            ) : null}
-            {connection.capabilities.import_ratings ? (
-              <ToggleRow
-                id={`watch-provider-${providerKey}-import-ratings`}
-                label="Import ratings"
-                description={`Bring ${displayName} movie and show ratings in as stars. A 7/10 becomes 4 stars.`}
-                checked={connection.import_ratings_enabled}
-                disabled={isBusy}
-                onChange={(checked) => updateConnection.mutate({ import_ratings_enabled: checked })}
-              />
-            ) : null}
-            {connection.capabilities.export_ratings ? (
-              <ToggleRow
-                id={`watch-provider-${providerKey}-export-ratings`}
-                label="Send ratings"
-                description={`Send your star ratings to ${displayName} and clear ones you remove. 4 stars becomes 8/10.`}
-                checked={connection.export_ratings_enabled}
-                disabled={isBusy}
-                onChange={(checked) => updateConnection.mutate({ export_ratings_enabled: checked })}
-              />
-            ) : null}
-            {connection.capabilities.sync_dropped ? (
-              <ToggleRow
-                id={`watch-provider-${providerKey}-sync-dropped`}
-                label="Sync dropped shows"
-                description={`Hide shows you dropped on ${displayName} from Next Up and Continue Watching, and drop shows on ${displayName} when you remove their episodes from Home. Watching a show again undrops it.`}
-                checked={connection.sync_dropped_enabled}
-                disabled={isBusy}
-                onChange={(checked) => updateConnection.mutate({ sync_dropped_enabled: checked })}
-              />
-            ) : null}
-            <ToggleRow
-              id={`watch-provider-${providerKey}-scrobble`}
-              label="Scrobble playback"
-              description="Report starts, pauses, resumes, and stops live during playback."
-              checked={connection.scrobble_enabled}
-              disabled={isBusy}
-              onChange={(checked) => updateConnection.mutate({ scrobble_enabled: checked })}
-            />
-            {connectionSettings
-              .filter((setting) => setting.type === "boolean")
-              .map((setting) => (
+          </button>
+          {settingsOpen ? (
+            <div id={settingsPanelId}>
+              {settingsConflict && (
+                <div role="alert" className="border-border mb-4 rounded-xl border p-4 text-sm">
+                  <p>These settings changed elsewhere. Your change is still shown below.</p>
+                  <div className="mt-3 flex flex-wrap gap-2">
+                    <Button
+                      size="sm"
+                      disabled={isFetching || updateConnection.isPending}
+                      onClick={() => {
+                        if (updateConnection.variables)
+                          updateConnection.mutate(updateConnection.variables);
+                      }}
+                    >
+                      Apply my change
+                    </Button>
+                    <Button
+                      size="sm"
+                      variant="outline"
+                      disabled={isFetching}
+                      onClick={() => updateConnection.reset()}
+                    >
+                      Use latest settings
+                    </Button>
+                  </div>
+                </div>
+              )}
+              <div className="grid grid-cols-1 gap-x-6 gap-y-1 sm:grid-cols-2">
                 <ToggleRow
-                  key={setting.key}
-                  id={`watch-provider-${providerKey}-setting-${setting.key}`}
-                  label={setting.label}
-                  description={setting.description ?? ""}
-                  checked={booleanSettingValue(connection.connection_settings, setting)}
+                  id={`watch-provider-${providerKey}-import-watched`}
+                  label="Import watched history"
+                  description={`Bring completed ${displayName} plays into this profile.`}
+                  checked={connection.import_watched_enabled}
                   disabled={isBusy}
                   onChange={(checked) =>
-                    updateConnection.mutate({ connection_settings: { [setting.key]: checked } })
+                    updateConnection.mutate({ import_watched_enabled: checked })
                   }
                 />
-              ))}
-          </div>
+                <ToggleRow
+                  id={`watch-provider-${providerKey}-import-progress`}
+                  label="Import paused progress"
+                  description={`Use newer ${displayName} resume points when local progress is older.`}
+                  checked={connection.import_progress_enabled}
+                  disabled={isBusy}
+                  onChange={(checked) =>
+                    updateConnection.mutate({ import_progress_enabled: checked })
+                  }
+                />
+                <ToggleRow
+                  id={`watch-provider-${providerKey}-export-watched`}
+                  label="Send watched changes"
+                  description="Send local watched marks and completed plays to this provider."
+                  checked={connection.export_watched_enabled}
+                  disabled={isBusy}
+                  onChange={(checked) =>
+                    updateConnection.mutate({ export_watched_enabled: checked })
+                  }
+                />
+                {connection.capabilities.export_unwatched ? (
+                  <ToggleRow
+                    id={`watch-provider-${providerKey}-export-unwatched`}
+                    label="Send unwatched changes"
+                    description="When you mark something unwatched, remove matching history from this provider."
+                    checked={connection.export_unwatched_enabled}
+                    disabled={isBusy}
+                    onChange={(checked) =>
+                      updateConnection.mutate({ export_unwatched_enabled: checked })
+                    }
+                  />
+                ) : null}
+                {connection.capabilities.import_favorites ||
+                connection.capabilities.export_favorites ? (
+                  <ToggleRow
+                    id={`watch-provider-${providerKey}-favorites`}
+                    label="Sync favorites"
+                    description={`Import ${displayName} movie and show favorites, and send local favorite adds.`}
+                    checked={favoritesSyncEnabled}
+                    disabled={isBusy}
+                    onChange={(checked) =>
+                      updateConnection.mutate({
+                        import_favorites_enabled: checked,
+                        export_favorites_enabled: checked,
+                        sync_favorite_removals_enabled: checked
+                          ? connection.sync_favorite_removals_enabled
+                          : false,
+                      })
+                    }
+                  />
+                ) : null}
+                {connection.capabilities.remove_favorites ? (
+                  <ToggleRow
+                    id={`watch-provider-${providerKey}-favorite-removals`}
+                    label="Sync favorite removals"
+                    description="Remove provider-synced favorites on the other side when they are explicitly unfavorited."
+                    checked={connection.sync_favorite_removals_enabled}
+                    disabled={isBusy || !favoritesSyncEnabled}
+                    onChange={(checked) =>
+                      updateConnection.mutate({ sync_favorite_removals_enabled: checked })
+                    }
+                  />
+                ) : null}
+                {connection.capabilities.import_watchlist ||
+                connection.capabilities.export_watchlist ? (
+                  <ToggleRow
+                    id={`watch-provider-${providerKey}-watchlist`}
+                    label="Sync watchlist"
+                    description={`Import your ${displayName} watchlist, and send local watchlist adds.`}
+                    checked={watchlistSyncEnabled}
+                    disabled={isBusy}
+                    onChange={(checked) =>
+                      updateConnection.mutate({
+                        import_watchlist_enabled: checked,
+                        export_watchlist_enabled: checked,
+                        sync_watchlist_removals_enabled: checked
+                          ? connection.sync_watchlist_removals_enabled
+                          : false,
+                      })
+                    }
+                  />
+                ) : null}
+                {connection.capabilities.remove_watchlist ? (
+                  <ToggleRow
+                    id={`watch-provider-${providerKey}-watchlist-removals`}
+                    label="Sync watchlist removals"
+                    description="Remove provider-synced watchlist items on the other side when they are removed locally."
+                    checked={connection.sync_watchlist_removals_enabled}
+                    disabled={isBusy || !watchlistSyncEnabled}
+                    onChange={(checked) =>
+                      updateConnection.mutate({ sync_watchlist_removals_enabled: checked })
+                    }
+                  />
+                ) : null}
+                {connection.capabilities.provides_watchlist_order ? (
+                  <ToggleRow
+                    id={`watch-provider-${providerKey}-watchlist-order`}
+                    label="Mirror watchlist order"
+                    description={`Order your Prairie watchlist to match its ${displayName} sort order. Items not on ${displayName} stay at the bottom.`}
+                    checked={connection.sync_watchlist_order_enabled}
+                    disabled={isBusy || !connection.import_watchlist_enabled}
+                    onChange={(checked) =>
+                      updateConnection.mutate({ sync_watchlist_order_enabled: checked })
+                    }
+                  />
+                ) : null}
+                {connection.capabilities.import_ratings ? (
+                  <ToggleRow
+                    id={`watch-provider-${providerKey}-import-ratings`}
+                    label="Import ratings"
+                    description={`Bring ${displayName} movie and show ratings in as stars. A 7/10 becomes 4 stars.`}
+                    checked={connection.import_ratings_enabled}
+                    disabled={isBusy}
+                    onChange={(checked) =>
+                      updateConnection.mutate({ import_ratings_enabled: checked })
+                    }
+                  />
+                ) : null}
+                {connection.capabilities.export_ratings ? (
+                  <ToggleRow
+                    id={`watch-provider-${providerKey}-export-ratings`}
+                    label="Send ratings"
+                    description={`Send your star ratings to ${displayName} and clear ones you remove. 4 stars becomes 8/10.`}
+                    checked={connection.export_ratings_enabled}
+                    disabled={isBusy}
+                    onChange={(checked) =>
+                      updateConnection.mutate({ export_ratings_enabled: checked })
+                    }
+                  />
+                ) : null}
+                {connection.capabilities.sync_dropped ? (
+                  <ToggleRow
+                    id={`watch-provider-${providerKey}-sync-dropped`}
+                    label="Sync dropped shows"
+                    description={`Hide shows you dropped on ${displayName} from Next Up and Continue Watching, and drop shows on ${displayName} when you remove their episodes from Home. Watching a show again undrops it.`}
+                    checked={connection.sync_dropped_enabled}
+                    disabled={isBusy}
+                    onChange={(checked) =>
+                      updateConnection.mutate({ sync_dropped_enabled: checked })
+                    }
+                  />
+                ) : null}
+                <ToggleRow
+                  id={`watch-provider-${providerKey}-scrobble`}
+                  label="Scrobble playback"
+                  description="Report starts, pauses, resumes, and stops live during playback."
+                  checked={connection.scrobble_enabled}
+                  disabled={isBusy}
+                  onChange={(checked) => updateConnection.mutate({ scrobble_enabled: checked })}
+                />
+                {connectionSettings
+                  .filter((setting) => setting.type === "boolean")
+                  .map((setting) => (
+                    <ToggleRow
+                      key={setting.key}
+                      id={`watch-provider-${providerKey}-setting-${setting.key}`}
+                      label={setting.label}
+                      description={setting.description ?? ""}
+                      checked={booleanSettingValue(connection.connection_settings, setting)}
+                      disabled={isBusy}
+                      onChange={(checked) =>
+                        updateConnection.mutate({ connection_settings: { [setting.key]: checked } })
+                      }
+                    />
+                  ))}
+              </div>
+            </div>
+          ) : null}
         </div>
       ) : null}
     </section>
@@ -923,13 +958,10 @@ export default function WatchProvidersSettings() {
 
   return (
     <div className="space-y-6">
-      <div className="space-y-2">
-        <h2 className="text-2xl font-semibold tracking-tight sm:text-3xl">Watch Providers</h2>
-        <p className="text-muted-foreground text-[13px] leading-relaxed sm:text-sm">
-          Connect external trackers to import watch history, sync paused progress, and scrobble
-          playback in real time.
-        </p>
-      </div>
+      <PageHeader
+        title="Watch Providers"
+        subtitle="Connect external trackers to import watch history, sync paused progress, and scrobble playback in real time."
+      />
 
       {providers.length === 0 ? (
         <section className="surface-panel rounded-[1.7rem] border-0 px-4 py-5 shadow-none sm:px-6">
diff --git a/web/src/pages/settings/WebhookSyncSettings.tsx b/web/src/pages/settings/WebhookSyncSettings.tsx
index eff9da0559..593ee01258 100644
--- a/web/src/pages/settings/WebhookSyncSettings.tsx
+++ b/web/src/pages/settings/WebhookSyncSettings.tsx
@@ -16,6 +16,7 @@ import {
   Server,
   Trash2,
 } from "lucide-react";
+import { PageHeader } from "@/components/page/PageHeader";
 import { useProfiles } from "@/hooks/queries/profiles";
 import { useCurrentProfile } from "@/hooks/useCurrentProfile";
 import { SettingsGroup } from "@/components/settings/SettingsGroup";
@@ -248,7 +249,7 @@ function EventMatrix({ sections }: { sections: EventMatrixSection[] }) {
         <div key={section.label} className="space-y-1.5 px-3 py-2.5">
           <p
             className={cn(
-              "text-[11px] font-medium tracking-wide uppercase",
+              "text-xs font-medium tracking-wide uppercase",
               EVENT_MATRIX_TONE[section.tone],
             )}
           >
@@ -585,12 +586,10 @@ export default function WebhookSyncSettings() {
 
   return (
     <div className="space-y-6 pb-6">
-      <div className="space-y-3">
-        <h2 className="text-2xl font-semibold tracking-tight sm:text-3xl">Webhook Sync</h2>
-        <p className="text-muted-foreground max-w-2xl text-sm leading-relaxed">
-          Receive watched, stop, and progress events from Plex, Emby, and Jellyfin.
-        </p>
-      </div>
+      <PageHeader
+        title="Webhook Sync"
+        subtitle="Receive watched, stop, and progress events from Plex, Emby, and Jellyfin."
+      />
 
       <SettingsGroup
         title="Add a connection"
@@ -778,7 +777,7 @@ export default function WebhookSyncSettings() {
                   </div>
                   <Badge
                     variant={health === "error" ? "destructive" : "outline"}
-                    className="shrink-0 text-[11px]"
+                    className="shrink-0 text-xs"
                   >
                     {HEALTH_LABEL[health]}
                   </Badge>
@@ -1244,7 +1243,7 @@ export default function WebhookSyncSettings() {
                           <TableCell>
                             <Badge
                               variant="outline"
-                              className={cn("text-[11px]", EVENT_OUTCOME_BADGE[event.outcome])}
+                              className={cn("text-xs", EVENT_OUTCOME_BADGE[event.outcome])}
                             >
                               {EVENT_OUTCOME_LABEL[event.outcome]}
                             </Badge>
@@ -1354,7 +1353,7 @@ export default function WebhookSyncSettings() {
               <div className="flex flex-wrap items-center gap-2">
                 <Badge
                   variant="outline"
-                  className={cn("text-[11px]", EVENT_OUTCOME_BADGE[selectedEvent.outcome])}
+                  className={cn("text-xs", EVENT_OUTCOME_BADGE[selectedEvent.outcome])}
                 >
                   {EVENT_OUTCOME_LABEL[selectedEvent.outcome]}
                 </Badge>
@@ -1379,7 +1378,7 @@ export default function WebhookSyncSettings() {
                       .sort(([a], [b]) => a.localeCompare(b))
                       .map(([key, value]) => (
                         <div key={key} className="min-w-0">
-                          <p className="text-muted-foreground text-[11px]">{eventAttrLabel(key)}</p>
+                          <p className="text-muted-foreground text-xs">{eventAttrLabel(key)}</p>
                           <p className="truncate text-xs break-all">
                             {typeof value === "string" ? value : JSON.stringify(value)}
                           </p>
diff --git a/web/src/pages/setup-wizard/steps/DoneStep.tsx b/web/src/pages/setup-wizard/steps/DoneStep.tsx
index 2159781987..d60169a4f1 100644
--- a/web/src/pages/setup-wizard/steps/DoneStep.tsx
+++ b/web/src/pages/setup-wizard/steps/DoneStep.tsx
@@ -14,7 +14,7 @@ const AFTER_SETUP_LINKS = [
   { to: "/admin/libraries", label: "Scan and manage libraries" },
   { to: "/admin/users", label: "Invite people" },
   { to: "/admin/nodes", label: "Add transcode or proxy nodes" },
-  { to: "/admin/settings/general", label: "All settings" },
+  { to: "/admin/settings/general", label: "Server settings" },
 ];
 
 export function DoneStep() {
diff --git a/web/src/pages/setup-wizard/steps/ServerStep.tsx b/web/src/pages/setup-wizard/steps/ServerStep.tsx
index 367e409e5e..1732262888 100644
--- a/web/src/pages/setup-wizard/steps/ServerStep.tsx
+++ b/web/src/pages/setup-wizard/steps/ServerStep.tsx
@@ -49,7 +49,7 @@ export function ServerStep() {
       onSubmit={handleSubmit}
       busy={busy}
       onSkip={skip}
-      footnote="Everything here is in Admin › Settings › General."
+      footnote="Everything here is in Admin › Server › General."
     >
       <StepSection>
         <SettingField
diff --git a/web/src/pages/setup-wizard/steps/StorageStep.tsx b/web/src/pages/setup-wizard/steps/StorageStep.tsx
index c1af8ca4f8..5c9ab28892 100644
--- a/web/src/pages/setup-wizard/steps/StorageStep.tsx
+++ b/web/src/pages/setup-wizard/steps/StorageStep.tsx
@@ -341,7 +341,7 @@ export function StorageStep() {
       busy={busy}
       disabled={holdSubmit}
       onSkip={skip}
-      footnote="Storage, Redis, and database settings are in Admin › Settings › Storage & Database."
+      footnote="Storage settings are in Admin › Server › Storage; Redis and database settings are in Admin › Server › General."
     >
       {locationStatusUnavailable ? (
         <div className="rounded-xl border border-red-500/20 bg-red-500/5 p-4" role="alert">
@@ -369,7 +369,7 @@ export function StorageStep() {
             locationStatusUnavailable
               ? "Storage lock status is unavailable. Reload before changing the backend."
               : artworkLocked
-                ? "Locked: files have already been stored on this backend. Change it from Admin › Settings › Storage & Database, which moves them."
+                ? "Locked: files have already been stored on this backend. Change it from Admin › Server › Storage, which moves them."
                 : "Where Prairie keeps artwork, subtitles, and other library assets."
           }
           onChange={(value) => {
@@ -391,7 +391,7 @@ export function StorageStep() {
         />
         <SettingFieldRow
           label="Keep provider artwork"
-          description="Copies provider posters and backdrops into your artwork storage. Artwork stored next to your media is copied either way."
+          description="Copies posters and backdrops into your artwork storage, including artwork stored next to your media. When off, clients load artwork straight from the providers."
         >
           <Switch
             checked={form.getValue("metadata.cache_images") !== "false"}
@@ -463,8 +463,8 @@ export function StorageStep() {
             locationStatusUnavailable={locationStatusUnavailable}
             lockedDescription={
               usesS3
-                ? "Locked: files are stored here. Change it from Admin › Settings › Storage & Database, which moves them."
-                : "Locked: files are stored on local disk, and adding a public bucket would switch Automatic storage to S3. Change it from Admin › Settings › Storage & Database, which moves them."
+                ? "Locked: files are stored here. Change it from Admin › Server › Storage, which moves them."
+                : "Locked: files are stored on local disk, and adding a public bucket would switch Automatic storage to S3. Change it from Admin › Server › Storage, which moves them."
             }
           />
         </Backend>
@@ -482,7 +482,7 @@ export function StorageStep() {
             disabled={busy}
             locationLocked={locationStatusUnavailable || privateLocked}
             locationStatusUnavailable={locationStatusUnavailable}
-            lockedDescription="Locked: Prairie records a configured private bucket at startup, even when empty. Stored library assets also lock this location. Change it from Admin › Settings › Storage & Database."
+            lockedDescription="Locked: Prairie records a configured private bucket at startup, even when empty. Stored library assets also lock this location. Change it from Admin › Server › Storage."
           />
         </Backend>
       </StepSection>
diff --git a/web/src/pages/watchRouteHelpers.ts b/web/src/pages/watchRouteHelpers.ts
index 2d0133c221..b54988771d 100644
--- a/web/src/pages/watchRouteHelpers.ts
+++ b/web/src/pages/watchRouteHelpers.ts
@@ -11,7 +11,7 @@ import type {
   WatchPageProps,
 } from "@/player";
 import { resolveVersionAudioLanguage } from "@/player/utils/effectiveAudioLanguage";
-import { isBitmapCodec } from "@/player/utils/subtitleCodecs";
+import { subtitleNeedsBurnIn } from "@/player/utils/subtitleCodecs";
 import { resolveSubtitleAutoSelect } from "@/player/utils/subtitleSort";
 
 export interface WatchRouteRequest {
@@ -253,11 +253,12 @@ function buildInitialSubtitleTrackIndexes({
     }
     const selectedTrack = tracks.find((track) => track.index === selectedSubtitleTrackIndex);
     start[version.file_id] = selectedSubtitleTrackIndex;
-    // Bitmap tracks (PGS/DVD/DVB) have to be burned in on the web player. Keep
-    // their ordinals separately so a refused start can be retried without the
-    // subtitle. Successful starts stay a single request, and the server owns
-    // remapping the selection when it adapts to another file version.
-    if (selectedTrack && isBitmapCodec(selectedTrack.codec)) {
+    // Tracks the server must burn in (DVD/DVB bitmaps, external bitmap
+    // files) can be why a start is refused. Keep their ordinals separately so
+    // a refused start can be retried without the subtitle. Successful starts
+    // stay a single request, and the server owns remapping the selection when
+    // it adapts to another file version.
+    if (selectedTrack && subtitleNeedsBurnIn(selectedTrack)) {
       bitmap[version.file_id] = selectedSubtitleTrackIndex;
     }
   }
diff --git a/web/src/pages/watchtogether/hooks/useActivityFeed.ts b/web/src/pages/watchtogether/hooks/useActivityFeed.ts
index d070546183..5e077c5a43 100644
--- a/web/src/pages/watchtogether/hooks/useActivityFeed.ts
+++ b/web/src/pages/watchtogether/hooks/useActivityFeed.ts
@@ -207,7 +207,7 @@ export function useActivityFeed(
   const logRef = useRef<FeedLog>(emptyLog);
   const log = useMemo(
     () => foldActivity(logRef.current, room, suggestions, connectionState, now()),
-    // eslint-disable-next-line react-hooks/exhaustive-deps
+    // eslint-disable-next-line react-hooks/exhaustive-deps -- the clock and the previous fold are read per input change, not tracked
     [room, suggestions, connectionState],
   );
   logRef.current = log;
diff --git a/web/src/pages/watchtogether/room/picker/MovieDetailPanel.tsx b/web/src/pages/watchtogether/room/picker/MovieDetailPanel.tsx
index 45ea25a15b..7ecffd4db5 100644
--- a/web/src/pages/watchtogether/room/picker/MovieDetailPanel.tsx
+++ b/web/src/pages/watchtogether/room/picker/MovieDetailPanel.tsx
@@ -4,6 +4,8 @@ import { RatingEntry } from "@/components/ratings/RatingEntry";
 import { Button } from "@/components/ui/button";
 import { Skeleton } from "@/components/ui/skeleton";
 import { useCatalogItemDetail } from "@/hooks/queries/catalogRead";
+import MachineTranslatedLabel from "@/pages/ItemDetail/components/MachineTranslatedLabel";
+import { hasMachineTranslation } from "@/pages/ItemDetail/components/machineTranslation";
 import { decodeThumbhash } from "@/lib/thumbhash";
 import { formatRuntimeMinutes } from "@/lib/mediaFormat";
 import type { ItemMemberState, MemberWatchState } from "@/api/v2/watchTogetherMemberState";
@@ -205,7 +207,12 @@ export function MovieDetailPanel({
           </div>
         ) : null}
         {item?.tagline ? (
-          <p className="text-muted-foreground text-xs italic">{item.tagline}</p>
+          <p className="text-muted-foreground text-xs italic">
+            {item.tagline}
+            {hasMachineTranslation(item.machine_translated_fields, "tagline") && (
+              <MachineTranslatedLabel compact className="ml-1.5 align-middle not-italic" />
+            )}
+          </p>
         ) : null}
         {detail.isLoading ? (
           <div className="flex flex-col gap-1.5">
@@ -214,9 +221,14 @@ export function MovieDetailPanel({
             <Skeleton className="h-3 w-2/3 rounded" />
           </div>
         ) : item?.overview ? (
-          <p className="text-muted-foreground line-clamp-5 text-sm leading-relaxed">
-            {item.overview}
-          </p>
+          <div>
+            <p className="text-muted-foreground line-clamp-5 text-sm leading-relaxed">
+              {item.overview}
+            </p>
+            {hasMachineTranslation(item.machine_translated_fields) && (
+              <MachineTranslatedLabel className="mt-1" />
+            )}
+          </div>
         ) : null}
         <MemberWatchList members={members} state={memberState} loading={memberStateLoading} />
       </div>
diff --git a/web/src/pages/watchtogether/room/picker/SeriesDrilldown.tsx b/web/src/pages/watchtogether/room/picker/SeriesDrilldown.tsx
index d7a9ba76af..37390e714e 100644
--- a/web/src/pages/watchtogether/room/picker/SeriesDrilldown.tsx
+++ b/web/src/pages/watchtogether/room/picker/SeriesDrilldown.tsx
@@ -4,6 +4,8 @@ import { Button } from "@/components/ui/button";
 import { Skeleton } from "@/components/ui/skeleton";
 import { useSeasons, useSeasonEpisodes } from "@/hooks/queries/episodes";
 import { useCatalogItemDetail } from "@/hooks/queries/catalogRead";
+import MachineTranslatedLabel from "@/pages/ItemDetail/components/MachineTranslatedLabel";
+import { hasMachineTranslation } from "@/pages/ItemDetail/components/machineTranslation";
 import { useEpisodeSpoilerPrefs } from "@/hooks/useEpisodeSpoilerPrefs";
 import { isEpisodeStill, isEpisodeUnwatched, SPOILER_IMAGE_CLASS } from "@/lib/episodeSpoilers";
 import { decodeThumbhash } from "@/lib/thumbhash";
@@ -261,6 +263,9 @@ export function SeriesDrilldown({
             {item?.overview ? (
               <p className="text-muted-foreground mt-1 line-clamp-2 max-w-3xl text-xs leading-relaxed">
                 {item.overview}
+                {hasMachineTranslation(item.machine_translated_fields) && (
+                  <MachineTranslatedLabel compact className="ml-1.5 align-middle" />
+                )}
               </p>
             ) : detail.isLoading ? (
               <Skeleton className="mt-1.5 h-3 w-64 rounded" />
@@ -383,6 +388,11 @@ export function SeriesDrilldown({
                             <span className="text-muted-foreground shrink-0 text-xs">
                               {episode.runtime ? `${episode.runtime}m` : ""}
                             </span>
+                            {episode.overview &&
+                              !(spoilerPrefs.hideOverviews && unwatched) &&
+                              hasMachineTranslation(episode.machine_translated_fields) && (
+                                <MachineTranslatedLabel compact className="shrink-0 self-center" />
+                              )}
                           </span>
                           {episode.overview && !(spoilerPrefs.hideOverviews && unwatched) ? (
                             <span className="text-muted-foreground mt-0.5 line-clamp-2 text-xs leading-relaxed">
diff --git a/web/src/playback/WatchPlaybackChrome.tsx b/web/src/playback/WatchPlaybackChrome.tsx
index 1224241469..6fa288c1a8 100644
--- a/web/src/playback/WatchPlaybackChrome.tsx
+++ b/web/src/playback/WatchPlaybackChrome.tsx
@@ -77,6 +77,8 @@ import {
 } from "@/pages/watchRouteHelpers";
 import { canEditMarkers as canEditMarkersForUser } from "@/lib/permissions";
 import { markPlaybackIntent } from "@/player/first-frame";
+import { onMeteredConnection } from "@/player/bandwidth-probe";
+import { playbackQualitySettings } from "./playbackQualitySettings";
 
 const WatchPage = lazy(() =>
   import("@/player/components/WatchPage").then((module) => ({
@@ -595,6 +597,14 @@ function WatchPlaybackHostContent() {
       settingsCapabilities.data,
       SETTING_KEYS.PLAYBACK_INTRO_SKIP_MODE,
     );
+  // A server below revision 20 rejects the whole batch for a key it does not
+  // define, so the cellular pair is read only where the server has it.
+  const supportsCellularQuality =
+    capabilitiesKnown &&
+    settingsCapabilitiesSupportKey(
+      settingsCapabilities.data,
+      SETTING_KEYS.PLAYBACK_CELLULAR_PREFERRED_QUALITY,
+    );
   // Resolved through the contract, so a device override winning over the
   // profile's own choice is the manifest's resolution order rather than a
   // precedence rule spelled out here.
@@ -617,6 +627,13 @@ function WatchPlaybackHostContent() {
       // The bandwidth cap that pairs with it; the player keeps its startup
       // tier under this so the setting does what its label says.
       SETTING_KEYS.PLAYBACK_MAX_BITRATE_KBPS,
+      // The pair that replaces those two on a metered link, as in the apps.
+      ...(supportsCellularQuality
+        ? [
+            SETTING_KEYS.PLAYBACK_CELLULAR_PREFERRED_QUALITY,
+            SETTING_KEYS.PLAYBACK_CELLULAR_MAX_BITRATE_KBPS,
+          ]
+        : []),
     ],
     enabled: signedIn,
   });
@@ -1086,19 +1103,18 @@ function WatchPlaybackHostContent() {
     return <PlaybackUnavailableScreen error={error} onBack={() => navigate(-1)} />;
   }
 
-  const canonicalQuality = effectivePlaybackSettings?.[SETTING_KEYS.PLAYBACK_PREFERRED_QUALITY]
-    ?.value as string | undefined;
-  const maxBitrateKbps = effectivePlaybackSettings?.[SETTING_KEYS.PLAYBACK_MAX_BITRATE_KBPS]
-    ?.value as number | null | undefined;
+  const { qualityPreference: canonicalQuality, maxBitrateKbps } = playbackQualitySettings(
+    effectivePlaybackSettings,
+    onMeteredConnection(),
+  );
   const watchPageProps = buildWatchPageProps({
     request: activeRequest,
     item: activeItem,
     currentProfile,
     seriesEpisodes,
-    // Passed through verbatim: "original" and "auto" are distinct wire values
-    // (the planner preserves the source for "original", adapts for "auto").
-    // Undefined until the read resolves, which leaves the profile-column
-    // fallback in place rather than blocking playback on a settings fetch.
+    // The session reads a legacy "original" as "auto". Undefined until the
+    // read resolves, which leaves the profile-column fallback in place rather
+    // than blocking playback on a settings fetch.
     qualityPreference: canonicalQuality,
   });
   // The resolved answer already folds in the profile layer, so the props built
diff --git a/web/src/playback/playbackQualitySettings.test.ts b/web/src/playback/playbackQualitySettings.test.ts
new file mode 100644
index 0000000000..22ce26e259
--- /dev/null
+++ b/web/src/playback/playbackQualitySettings.test.ts
@@ -0,0 +1,69 @@
+import { describe, expect, it } from "vitest";
+import type { EffectiveSetting, EffectiveSettingsMap } from "@/hooks/queries/settingValues";
+import { SETTING_KEYS } from "@/lib/settingsContract";
+import { playbackQualitySettings } from "./playbackQualitySettings";
+
+function setting(value: unknown): EffectiveSetting {
+  return { value, source: "default" } as EffectiveSetting;
+}
+
+const effective: EffectiveSettingsMap = {
+  [SETTING_KEYS.PLAYBACK_PREFERRED_QUALITY]: setting("auto"),
+  [SETTING_KEYS.PLAYBACK_MAX_BITRATE_KBPS]: setting(null),
+  [SETTING_KEYS.PLAYBACK_CELLULAR_PREFERRED_QUALITY]: setting("720p"),
+  [SETTING_KEYS.PLAYBACK_CELLULAR_MAX_BITRATE_KBPS]: setting(2000),
+};
+
+describe("playbackQualitySettings", () => {
+  it("uses the main pair on an unmetered link", () => {
+    expect(playbackQualitySettings(effective, false)).toEqual({
+      qualityPreference: "auto",
+      maxBitrateKbps: null,
+    });
+  });
+
+  it("uses the cellular pair on a metered link", () => {
+    expect(playbackQualitySettings(effective, true)).toEqual({
+      qualityPreference: "720p",
+      maxBitrateKbps: 2000,
+    });
+  });
+
+  it("leaves both unset until the settings read resolves on an unmetered link", () => {
+    expect(playbackQualitySettings(undefined, false)).toEqual({
+      qualityPreference: undefined,
+      maxBitrateKbps: undefined,
+    });
+  });
+
+  it("keeps a stored no-limit cellular bitrate", () => {
+    expect(
+      playbackQualitySettings(
+        { ...effective, [SETTING_KEYS.PLAYBACK_CELLULAR_MAX_BITRATE_KBPS]: setting(null) },
+        true,
+      ),
+    ).toEqual({ qualityPreference: "720p", maxBitrateKbps: null });
+  });
+
+  // An older server defines no cellular pair, so the read never returns it.
+  it("uses the cellular defaults on a metered link when the server has no cellular pair", () => {
+    const {
+      [SETTING_KEYS.PLAYBACK_CELLULAR_PREFERRED_QUALITY]: _quality,
+      [SETTING_KEYS.PLAYBACK_CELLULAR_MAX_BITRATE_KBPS]: _bitrate,
+      ...withoutCellular
+    } = effective;
+    expect(playbackQualitySettings(withoutCellular, true)).toEqual({
+      qualityPreference: "720p",
+      maxBitrateKbps: 2000,
+    });
+  });
+
+  // Playback can start before the read resolves and does not replan when it
+  // does, so a metered start must not go out without a limit.
+  it("uses the cellular defaults until the settings read resolves on a metered link", () => {
+    expect(playbackQualitySettings(undefined, true)).toEqual({
+      qualityPreference: "720p",
+      maxBitrateKbps: 2000,
+    });
+  });
+});
diff --git a/web/src/playback/playbackQualitySettings.ts b/web/src/playback/playbackQualitySettings.ts
new file mode 100644
index 0000000000..d2595ff216
--- /dev/null
+++ b/web/src/playback/playbackQualitySettings.ts
@@ -0,0 +1,45 @@
+import type { EffectiveSettingsMap } from "@/hooks/queries/settingValues";
+import { SETTING_DEFINITIONS, SETTING_KEYS } from "@/lib/settingsContract";
+
+export interface PlaybackQualitySettings {
+  /** Undefined until the settings read resolves. */
+  qualityPreference: string | undefined;
+  maxBitrateKbps: number | null | undefined;
+}
+
+/**
+ * The resolution and bitrate limits playback starts with. On a metered link
+ * (Data Saver or a cellular connection) the cellular pair replaces the main
+ * one, so a phone browser on mobile data starts within the same data limit
+ * the apps use instead of at the source's full bitrate. Playback can start
+ * before the settings read resolves and does not replan when it does, and an
+ * older server has no cellular pair to read, so a metered start without the
+ * pair uses its contract defaults rather than no limit.
+ */
+export function playbackQualitySettings(
+  effective: EffectiveSettingsMap | undefined,
+  metered: boolean,
+): PlaybackQualitySettings {
+  const qualityKey = metered
+    ? SETTING_KEYS.PLAYBACK_CELLULAR_PREFERRED_QUALITY
+    : SETTING_KEYS.PLAYBACK_PREFERRED_QUALITY;
+  const bitrateKey = metered
+    ? SETTING_KEYS.PLAYBACK_CELLULAR_MAX_BITRATE_KBPS
+    : SETTING_KEYS.PLAYBACK_MAX_BITRATE_KBPS;
+  if (metered) {
+    const quality = effective?.[qualityKey];
+    const bitrate = effective?.[bitrateKey];
+    return {
+      qualityPreference: (quality
+        ? quality.value
+        : SETTING_DEFINITIONS[qualityKey].defaultValue) as string,
+      maxBitrateKbps: (bitrate ? bitrate.value : SETTING_DEFINITIONS[bitrateKey].defaultValue) as
+        | number
+        | null,
+    };
+  }
+  return {
+    qualityPreference: effective?.[qualityKey]?.value as string | undefined,
+    maxBitrateKbps: effective?.[bitrateKey]?.value as number | null | undefined,
+  };
+}
diff --git a/web/src/playback/shuffleNextEpisodeRef.test.ts b/web/src/playback/shuffleNextEpisodeRef.test.ts
index f0654ee2cb..4ce666d9ad 100644
--- a/web/src/playback/shuffleNextEpisodeRef.test.ts
+++ b/web/src/playback/shuffleNextEpisodeRef.test.ts
@@ -15,6 +15,11 @@ describe("shuffleNextEpisodeRef", () => {
     expect(ref.watchState).toBeUndefined();
   });
 
+  it("carries the AI marker so the post-roll labels a machine-translated overview", () => {
+    const ref = shuffleNextEpisodeRef(shuffleWith({ machine_translated_fields: ["overview"] }));
+    expect(ref.machineTranslatedFields).toEqual(["overview"]);
+  });
+
   it("passes an episode's played flag and position", () => {
     const ref = shuffleNextEpisodeRef(
       shuffleWith({
diff --git a/web/src/playback/shuffleNextEpisodeRef.ts b/web/src/playback/shuffleNextEpisodeRef.ts
index 0a327bd3e0..a2868e76fb 100644
--- a/web/src/playback/shuffleNextEpisodeRef.ts
+++ b/web/src/playback/shuffleNextEpisodeRef.ts
@@ -20,6 +20,9 @@ export function shuffleNextEpisodeRef(shuffle: Shuffle): EpisodeRef {
     title: next.title,
     runtime: next.runtime ?? 0,
     overview: next.overview,
+    // The shuffle card comes from the localized detail, so an AI-translated
+    // overview carries its marker here too.
+    machineTranslatedFields: next.machine_translated_fields,
     stillUrl: urlFromPoster ? next.poster_url : next.backdrop_url,
     stillThumbhash: thumbhashFromPoster ? next.poster_thumbhash : next.backdrop_thumbhash,
     // Unprotected only when neither image is known to be an episode still.
diff --git a/web/src/player/bandwidth-probe.test.ts b/web/src/player/bandwidth-probe.test.ts
new file mode 100644
index 0000000000..af458de2ec
--- /dev/null
+++ b/web/src/player/bandwidth-probe.test.ts
@@ -0,0 +1,467 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+// Node delivers BroadcastChannel messages between test workers, so another
+// test file starting playback could reach this suite. An in-file fake keeps
+// cross-tab messages to the channels created here.
+class FakeBroadcastChannel {
+  static open: FakeBroadcastChannel[] = [];
+  onmessage: ((event: MessageEvent) => void) | null = null;
+  constructor(readonly name: string) {
+    FakeBroadcastChannel.open.push(this);
+  }
+  postMessage(data: unknown): void {
+    for (const peer of FakeBroadcastChannel.open) {
+      if (peer !== this && peer.name === this.name) {
+        queueMicrotask(() => peer.onmessage?.(new MessageEvent("message", { data })));
+      }
+    }
+  }
+  close(): void {
+    FakeBroadcastChannel.open = FakeBroadcastChannel.open.filter((peer) => peer !== this);
+  }
+}
+const fetchWithSession = vi.fn();
+vi.mock("@/api/client", () => ({
+  fetchWithSession: (...args: unknown[]) => fetchWithSession(...args),
+}));
+
+import {
+  BANDWIDTH_ESTIMATE_TTL_MS,
+  cancelBandwidthProbe,
+  forgetBandwidthEstimate,
+  measureBandwidthKbps,
+  readMeasuredBandwidthKbps,
+  readMeteredObservedLimitKbps,
+  recordObservedBandwidthLimitKbps,
+  scheduleBandwidthProbe,
+  stopBandwidthProbes,
+} from "./bandwidth-probe";
+import { storage } from "@/utils/storage";
+
+/** A body that yields `chunks` of `chunkBytes`, advancing a fake clock `stepMs` per chunk. */
+function timedBody(chunks: number, chunkBytes: number, stepMs: number) {
+  let time = 0;
+  let sent = 0;
+  const cancel = vi.fn(async () => undefined);
+  const reader = {
+    read: async () => {
+      if (sent >= chunks) return { done: true, value: undefined };
+      sent++;
+      time += stepMs;
+      return { done: false, value: new Uint8Array(chunkBytes) };
+    },
+    cancel,
+  };
+  return {
+    res: { ok: true, body: { getReader: () => reader } },
+    clock: () => time,
+    cancel,
+    sent: () => sent,
+  };
+}
+
+beforeEach(() => {
+  // Re-stubbed per test because tests unstub all globals afterwards.
+  vi.stubGlobal("BroadcastChannel", FakeBroadcastChannel);
+  forgetBandwidthEstimate();
+  fetchWithSession.mockReset();
+});
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+});
+
+describe("measureBandwidthKbps", () => {
+  it("times the transfer after ramp-up and stops at the time budget", async () => {
+    // 1 MB every 80 ms = 100 Mbps.
+    const body = timedBody(1000, 1_000_000, 80);
+    fetchWithSession.mockResolvedValue({ res: body.res });
+
+    const kbps = await measureBandwidthKbps(new AbortController().signal, body.clock);
+
+    expect(kbps).toBe(100_000);
+    expect(body.sent()).toBeLessThan(1000);
+    expect(body.cancel).toHaveBeenCalled();
+    expect(fetchWithSession.mock.calls[0]![0]).toMatch(
+      /^\/api\/v2\/playback\/bandwidth-probe\?size=\d+$/,
+    );
+  });
+
+  it("reads a fast link that finishes the whole payload", async () => {
+    // 40 MB in 160 ms is 2 Gbps; the contract bound caps it at 1 Gbps.
+    const body = timedBody(41, 1_000_000, 4);
+    fetchWithSession.mockResolvedValue({ res: body.res });
+
+    expect(await measureBandwidthKbps(new AbortController().signal, body.clock)).toBe(1_000_000);
+  });
+
+  it("returns nothing for a failed or too-short probe", async () => {
+    const cancel = vi.fn(async () => undefined);
+    fetchWithSession.mockResolvedValue({ res: { ok: false, body: { cancel } } });
+    expect(await measureBandwidthKbps(new AbortController().signal)).toBeUndefined();
+    expect(cancel).toHaveBeenCalled();
+
+    const tiny = timedBody(3, 1000, 10);
+    fetchWithSession.mockResolvedValue({ res: tiny.res });
+    expect(await measureBandwidthKbps(new AbortController().signal, tiny.clock)).toBeUndefined();
+  });
+});
+
+describe("measureBandwidthKbps deadlines", () => {
+  beforeEach(() => vi.useFakeTimers());
+  afterEach(() => vi.useRealTimers());
+
+  it("cuts off a read that stops returning and counts the silence", async () => {
+    // 1 MB every 80 ms (100 Mbps) for 1.2 s, then the body goes silent.
+    const t0 = Date.now();
+    const clock = () => Date.now() - t0;
+    let sent = 0;
+    let resolveStalled: ((r: { done: boolean }) => void) | undefined;
+    const reader = {
+      read: () =>
+        new Promise<{ done: boolean; value?: Uint8Array }>((resolve) => {
+          if (sent < 16) {
+            sent++;
+            setTimeout(() => resolve({ done: false, value: new Uint8Array(1_000_000) }), 80);
+          } else {
+            resolveStalled = resolve;
+          }
+        }),
+      cancel: vi.fn(async () => resolveStalled?.({ done: true })),
+    };
+    fetchWithSession.mockResolvedValue({ res: { ok: true, body: { getReader: () => reader } } });
+
+    const result = measureBandwidthKbps(new AbortController().signal, clock);
+    await vi.advanceTimersByTimeAsync(4_000);
+    const kbps = await result;
+
+    expect(reader.cancel).toHaveBeenCalled();
+    // 11 MB after ramp-up over the 2.18 s from the warm mark to the cutoff,
+    // not the 100 Mbps of the burst alone.
+    expect(kbps).toBe(40_367);
+  });
+
+  it("abandons a probe whose first byte never arrives", async () => {
+    fetchWithSession.mockImplementation(
+      (_url: string, init: RequestInit) =>
+        new Promise((_resolve, reject) => {
+          init.signal?.addEventListener("abort", () =>
+            reject(new DOMException("aborted", "AbortError")),
+          );
+        }),
+    );
+
+    const result = measureBandwidthKbps(new AbortController().signal);
+    const settled = expect(result).rejects.toThrow();
+    await vi.advanceTimersByTimeAsync(10_000);
+    await settled;
+  });
+});
+
+describe("measured bandwidth cache", () => {
+  it("expires after the TTL", () => {
+    const now = 1_000_000_000;
+    storage.set(
+      storage.KEYS.BANDWIDTH_ESTIMATE,
+      JSON.stringify({ kbps: 250_000, measuredAt: now }),
+    );
+
+    expect(readMeasuredBandwidthKbps(now + 1000)).toBe(250_000);
+    expect(readMeasuredBandwidthKbps(now + BANDWIDTH_ESTIMATE_TTL_MS + 1)).toBeUndefined();
+  });
+
+  it("ignores malformed entries", () => {
+    storage.set(storage.KEYS.BANDWIDTH_ESTIMATE, "{not json");
+    expect(readMeasuredBandwidthKbps()).toBeUndefined();
+    storage.set(
+      storage.KEYS.BANDWIDTH_ESTIMATE,
+      JSON.stringify({ kbps: "fast", measuredAt: Date.now() }),
+    );
+    expect(readMeasuredBandwidthKbps()).toBeUndefined();
+  });
+
+  it("only lowers the estimate when playback could not keep up", () => {
+    const now = Date.now();
+    storage.set(
+      storage.KEYS.BANDWIDTH_ESTIMATE,
+      JSON.stringify({ kbps: 200_000, measuredAt: now }),
+    );
+
+    recordObservedBandwidthLimitKbps(56_000, now);
+    expect(readMeasuredBandwidthKbps(now)).toBe(56_000);
+
+    recordObservedBandwidthLimitKbps(90_000, now);
+    expect(readMeasuredBandwidthKbps(now)).toBe(56_000);
+  });
+
+  it("marks a lower probe result as observed on a metered link without raising it", () => {
+    vi.stubGlobal("navigator", { connection: { type: "cellular" } });
+    try {
+      const now = Date.now();
+      storage.set(
+        storage.KEYS.BANDWIDTH_ESTIMATE,
+        JSON.stringify({ kbps: 3_000, measuredAt: now }),
+      );
+      expect(readMeteredObservedLimitKbps(now)).toBeUndefined();
+
+      recordObservedBandwidthLimitKbps(4_200, now);
+      expect(readMeteredObservedLimitKbps(now)).toBe(3_000);
+    } finally {
+      vi.unstubAllGlobals();
+    }
+  });
+
+  it("re-records a lower Wi-Fi limit for a metered link that stalls", () => {
+    const now = Date.now();
+    recordObservedBandwidthLimitKbps(3_000, now);
+    vi.stubGlobal("navigator", { connection: { type: "cellular" } });
+    try {
+      expect(readMeteredObservedLimitKbps(now)).toBeUndefined();
+      recordObservedBandwidthLimitKbps(4_200, now);
+      expect(readMeteredObservedLimitKbps(now)).toBe(3_000);
+    } finally {
+      vi.unstubAllGlobals();
+    }
+  });
+
+  it("does not offer a limit observed on an unmetered link to a metered one", () => {
+    recordObservedBandwidthLimitKbps(56_000);
+    expect(readMeasuredBandwidthKbps()).toBe(56_000);
+    expect(readMeteredObservedLimitKbps()).toBeUndefined();
+  });
+
+  it("does not carry a metered limit back onto an unmetered link", () => {
+    const now = Date.now();
+    vi.stubGlobal("navigator", { connection: { type: "cellular" } });
+    try {
+      recordObservedBandwidthLimitKbps(4_200, now);
+      expect(readMeteredObservedLimitKbps(now)).toBe(4_200);
+    } finally {
+      vi.unstubAllGlobals();
+    }
+    // Back on Wi-Fi: the cellular limit is neither an estimate nor fresh enough
+    // to skip a probe, and a Wi-Fi stall is not capped by it.
+    expect(readMeasuredBandwidthKbps(now)).toBeUndefined();
+    recordObservedBandwidthLimitKbps(30_000, now);
+    expect(readMeasuredBandwidthKbps(now)).toBe(30_000);
+  });
+
+  it("keeps a recorded limit when localStorage refuses the write", () => {
+    const set = vi.spyOn(storage, "set").mockImplementation(() => undefined);
+    try {
+      recordObservedBandwidthLimitKbps(14_000);
+      expect(readMeasuredBandwidthKbps()).toBe(14_000);
+    } finally {
+      set.mockRestore();
+    }
+  });
+
+  it("prefers a newer result another tab stored over this page's own", () => {
+    const now = Date.now();
+    recordObservedBandwidthLimitKbps(14_000, now - 60_000);
+    storage.set(
+      storage.KEYS.BANDWIDTH_ESTIMATE,
+      JSON.stringify({ kbps: 90_000, measuredAt: now - 1_000 }),
+    );
+    expect(readMeasuredBandwidthKbps(now)).toBe(90_000);
+  });
+
+  it("restarts the TTL when a stall confirms a lower limit", () => {
+    const start = Date.now();
+    recordObservedBandwidthLimitKbps(10_000, start);
+    const later = start + BANDWIDTH_ESTIMATE_TTL_MS - 1_000;
+    recordObservedBandwidthLimitKbps(20_000, later);
+    expect(readMeasuredBandwidthKbps(later + 10 * 60_000)).toBe(10_000);
+  });
+
+  it("records a limit when nothing was measured", () => {
+    recordObservedBandwidthLimitKbps(14_000);
+    expect(readMeasuredBandwidthKbps()).toBe(14_000);
+  });
+});
+
+describe("scheduleBandwidthProbe", () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+    vi.setSystemTime(1_000_000_000);
+  });
+  afterEach(() => {
+    stopBandwidthProbes();
+    vi.useRealTimers();
+  });
+
+  it("waits for a fresh measurement to expire, then measures again", async () => {
+    storage.set(
+      storage.KEYS.BANDWIDTH_ESTIMATE,
+      JSON.stringify({ kbps: 250_000, measuredAt: Date.now() }),
+    );
+    fetchWithSession.mockResolvedValue({ res: { ok: false, body: null } });
+    scheduleBandwidthProbe(0);
+
+    await vi.advanceTimersByTimeAsync(BANDWIDTH_ESTIMATE_TTL_MS - 1000);
+    expect(fetchWithSession).not.toHaveBeenCalled();
+
+    await vi.advanceTimersByTimeAsync(5_000);
+    expect(fetchWithSession).toHaveBeenCalledTimes(1);
+  });
+
+  it("keeps trying after a probe is cancelled for playback", async () => {
+    let release: (value: unknown) => void = () => undefined;
+    fetchWithSession.mockImplementationOnce(
+      (_url: string, init: RequestInit) =>
+        new Promise((resolve, reject) => {
+          release = resolve;
+          init.signal?.addEventListener("abort", () =>
+            reject(new DOMException("aborted", "AbortError")),
+          );
+        }),
+    );
+    fetchWithSession.mockResolvedValue({ res: { ok: false, body: null } });
+    scheduleBandwidthProbe(0);
+    await vi.advanceTimersByTimeAsync(0);
+    expect(fetchWithSession).toHaveBeenCalledTimes(1);
+
+    cancelBandwidthProbe();
+    release(undefined);
+    await vi.advanceTimersByTimeAsync(5 * 60 * 1000);
+    expect(fetchWithSession).toHaveBeenCalledTimes(2);
+  });
+
+  it("leaves the probe to the tab that holds the lock", async () => {
+    const request = vi.fn(
+      async (_name: string, _options: unknown, callback: (lock: unknown) => Promise<void>) =>
+        callback(null),
+    );
+    vi.stubGlobal("navigator", { ...navigator, locks: { request } });
+    fetchWithSession.mockResolvedValue({ res: { ok: false, body: null } });
+    scheduleBandwidthProbe(0);
+    await vi.advanceTimersByTimeAsync(0);
+
+    expect(request).toHaveBeenCalledWith(
+      "prairie-bandwidth-probe",
+      { ifAvailable: true },
+      expect.any(Function),
+    );
+    expect(fetchWithSession).not.toHaveBeenCalled();
+    vi.unstubAllGlobals();
+  });
+
+  it("probes while holding the lock", async () => {
+    const request = vi.fn(
+      async (_name: string, _options: unknown, callback: (lock: unknown) => Promise<void>) =>
+        callback({ name: "prairie-bandwidth-probe" }),
+    );
+    vi.stubGlobal("navigator", { ...navigator, locks: { request } });
+    fetchWithSession.mockResolvedValue({ res: { ok: false, body: null } });
+    scheduleBandwidthProbe(0);
+    await vi.advanceTimersByTimeAsync(0);
+
+    expect(fetchWithSession).toHaveBeenCalledTimes(1);
+    vi.unstubAllGlobals();
+  });
+
+  it("does not probe while another tab holds the media lock", async () => {
+    const request = vi.fn(
+      async (_name: string, _options: unknown, callback: (lock: unknown) => Promise<void>) =>
+        callback({ name: "prairie-bandwidth-probe" }),
+    );
+    const query = vi.fn(async () => ({
+      held: [{ name: "prairie-media-active", mode: "shared" }],
+      pending: [],
+    }));
+    vi.stubGlobal("navigator", { ...navigator, locks: { request, query } });
+    fetchWithSession.mockResolvedValue({ res: { ok: false, body: null } });
+    scheduleBandwidthProbe(0);
+    await vi.advanceTimersByTimeAsync(0);
+
+    expect(query).toHaveBeenCalled();
+    expect(fetchWithSession).not.toHaveBeenCalled();
+    vi.unstubAllGlobals();
+  });
+
+  it("does not start a probe whose lock arrives after playback started", async () => {
+    let grant: (() => Promise<void>) | undefined;
+    const request = vi.fn(
+      (name: string, _options: unknown, callback: (lock: unknown) => Promise<void>) =>
+        name === "prairie-bandwidth-probe"
+          ? new Promise<void>((resolve) => {
+              grant = () => callback({ name }).then(resolve);
+            })
+          : Promise.resolve(),
+    );
+    vi.stubGlobal("navigator", { ...navigator, locks: { request } });
+    fetchWithSession.mockResolvedValue({ res: { ok: false, body: null } });
+    scheduleBandwidthProbe(0);
+    await vi.advanceTimersByTimeAsync(0);
+    expect(request).toHaveBeenCalledTimes(1);
+
+    cancelBandwidthProbe();
+    await grant!();
+    expect(fetchWithSession).not.toHaveBeenCalled();
+    expect(request).toHaveBeenCalledWith(
+      "prairie-media-active",
+      { mode: "shared" },
+      expect.any(Function),
+    );
+    vi.unstubAllGlobals();
+  });
+
+  it("holds off a scheduled probe while playback is starting", async () => {
+    fetchWithSession.mockResolvedValue({ res: { ok: false, body: null } });
+    scheduleBandwidthProbe(5_000);
+    cancelBandwidthProbe();
+    await vi.advanceTimersByTimeAsync(5_000);
+    expect(fetchWithSession).not.toHaveBeenCalled();
+
+    await vi.advanceTimersByTimeAsync(5 * 60 * 1000);
+    expect(fetchWithSession).toHaveBeenCalledTimes(1);
+  });
+
+  it("abandons a running probe when another tab starts playback", async () => {
+    fetchWithSession.mockImplementation(
+      (_url: string, init: RequestInit) =>
+        new Promise((_resolve, reject) => {
+          init.signal?.addEventListener("abort", () =>
+            reject(new DOMException("aborted", "AbortError")),
+          );
+        }),
+    );
+    scheduleBandwidthProbe(0);
+    await vi.advanceTimersByTimeAsync(0);
+    expect(fetchWithSession).toHaveBeenCalledTimes(1);
+    const signal = (fetchWithSession.mock.calls[0]![1] as RequestInit).signal!;
+
+    // Another tab's playback start, as this tab's channel receives it.
+    const otherTab = new FakeBroadcastChannel("prairie-playback-start");
+    otherTab.postMessage("start");
+    otherTab.close();
+    await vi.waitFor(() => expect(signal.aborted).toBe(true));
+  });
+
+  it("lets playback start when the browser refuses cross-tab channels", () => {
+    vi.stubGlobal(
+      "BroadcastChannel",
+      class {
+        constructor() {
+          throw new DOMException("denied", "SecurityError");
+        }
+      },
+    );
+    try {
+      // A stopped schedule has no channel, so the next start creates one.
+      stopBandwidthProbes();
+      expect(() => cancelBandwidthProbe()).not.toThrow();
+      expect(() => scheduleBandwidthProbe(1_000)).not.toThrow();
+    } finally {
+      vi.stubGlobal("BroadcastChannel", FakeBroadcastChannel);
+    }
+  });
+
+  it("does nothing after it is stopped", async () => {
+    fetchWithSession.mockResolvedValue({ res: { ok: false, body: null } });
+    const stop = scheduleBandwidthProbe(1000);
+    stop();
+    await vi.advanceTimersByTimeAsync(BANDWIDTH_ESTIMATE_TTL_MS * 2);
+    expect(fetchWithSession).not.toHaveBeenCalled();
+  });
+});
diff --git a/web/src/player/bandwidth-probe.ts b/web/src/player/bandwidth-probe.ts
new file mode 100644
index 0000000000..3215019b23
--- /dev/null
+++ b/web/src/player/bandwidth-probe.ts
@@ -0,0 +1,501 @@
+import { fetchWithSession } from "@/api/client";
+import { V2_CLIENT_HEADERS } from "@/api/v2/request";
+import { storage } from "@/utils/storage";
+
+/**
+ * Measured throughput to this server, for `bandwidth_estimate_kbps`.
+ *
+ * Browsers will not tell us: Chromium caps `navigator.connection.downlink` at
+ * 10 Mbps and Safari and Firefox have no such API, while Auto quality needs to
+ * know whether a viewer can sustain a 4K source at 60–100 Mbps. So the app
+ * downloads random bytes from the server in the background, times them, and
+ * caches the result for playback to read.
+ */
+
+/** Bytes requested; the time budget usually ends the transfer first. */
+const PROBE_BYTES = 40_000_000;
+/** How long to keep timing once bytes flow. Enough to see past TCP ramp-up. */
+const PROBE_TIME_BUDGET_MS = 2_000;
+/** A probe that has not delivered its first byte by then is abandoned. */
+const PROBE_FIRST_BYTE_DEADLINE_MS = 10_000;
+/**
+ * Slack past the time budget before a read that has stopped returning is cut
+ * off; the rate is then taken from the bytes that did arrive.
+ */
+const PROBE_STALLED_READ_GRACE_MS = 500;
+/** Ramp-up excluded from the rate when the probe ran long enough to spare it. */
+const PROBE_WARMUP_MS = 300;
+/** Shortest timed window, or smallest byte count, that yields a usable rate. */
+const PROBE_MIN_WINDOW_MS = 200;
+const PROBE_MIN_BYTES = 1_000_000;
+/** Let the first screen settle before spending bandwidth on a probe. */
+const PROBE_START_DELAY_MS = 5_000;
+/** How long a measurement stands in for the network before it is re-taken. */
+export const BANDWIDTH_ESTIMATE_TTL_MS = 30 * 60 * 1000;
+/** The contract bounds `bandwidth_estimate_kbps` to this range. */
+const MIN_ESTIMATE_KBPS = 100;
+const MAX_ESTIMATE_KBPS = 1_000_000;
+
+/**
+ * The slice of the Network Information API we use. It is not in the DOM lib
+ * and is absent in Safari and Firefox, so everything here is best effort and
+ * every reader tolerates `undefined`.
+ */
+export interface NetworkInformationLike {
+  saveData?: boolean;
+  type?: string;
+}
+
+export function networkInformation(): NetworkInformationLike | undefined {
+  if (typeof navigator === "undefined") return undefined;
+  return (navigator as Navigator & { connection?: NetworkInformationLike }).connection;
+}
+
+interface StoredEstimate {
+  kbps: number;
+  measuredAt: number;
+  /**
+   * Set when playback itself showed the link could not sustain more. Unlike a
+   * probe result it describes whatever link the viewer is on now, so it still
+   * applies on a metered connection.
+   */
+  observed?: boolean;
+  /**
+   * The metered link an observed limit was recorded on (see meteredLink), or
+   * absent for an unmetered one.
+   */
+  link?: string;
+}
+
+function clampKbps(kbps: number): number | undefined {
+  if (!Number.isFinite(kbps) || kbps < MIN_ESTIMATE_KBPS) return undefined;
+  return Math.min(Math.round(kbps), MAX_ESTIMATE_KBPS);
+}
+
+/**
+ * The entry this page last wrote. localStorage can be full or unavailable,
+ * and its writes then fail silently; this copy keeps a just-recorded limit
+ * in effect for the replan that reads it straight back.
+ */
+let pageEntry: string | undefined;
+
+function parseStored(raw: string | null | undefined, now: number): StoredEstimate | undefined {
+  if (!raw) return undefined;
+  try {
+    const parsed = JSON.parse(raw) as Partial<StoredEstimate>;
+    if (typeof parsed.kbps !== "number" || typeof parsed.measuredAt !== "number") return undefined;
+    if (now - parsed.measuredAt > BANDWIDTH_ESTIMATE_TTL_MS || parsed.measuredAt > now)
+      return undefined;
+    const kbps = clampKbps(parsed.kbps);
+    if (kbps === undefined) return undefined;
+    return {
+      kbps,
+      measuredAt: parsed.measuredAt,
+      observed: parsed.observed === true,
+      ...(typeof parsed.link === "string" ? { link: parsed.link } : {}),
+    };
+  } catch {
+    return undefined;
+  }
+}
+
+/** The newer of this page's entry and the shared one another tab may have written. */
+function readStored(now: number): StoredEstimate | undefined {
+  const page = parseStored(pageEntry, now);
+  const shared = parseStored(storage.get(storage.KEYS.BANDWIDTH_ESTIMATE), now);
+  if (!page) return shared;
+  if (!shared) return page;
+  return shared.measuredAt > page.measuredAt ? shared : page;
+}
+
+function writeStored(kbps: number, now: number, observed = false): void {
+  const entry: StoredEstimate = { kbps, measuredAt: now };
+  if (observed) {
+    entry.observed = true;
+    const link = meteredLink();
+    if (link) entry.link = link;
+  }
+  pageEntry = JSON.stringify(entry);
+  storage.set(storage.KEYS.BANDWIDTH_ESTIMATE, pageEntry);
+}
+
+/** Drops the cached estimate, in this page and in localStorage. */
+export function forgetBandwidthEstimate(): void {
+  pageEntry = undefined;
+  storage.remove(storage.KEYS.BANDWIDTH_ESTIMATE);
+}
+
+/**
+ * The cached measurement in kbps for an unmetered link, or undefined when none
+ * is fresh or the cached value was recorded on a metered link.
+ */
+export function readMeasuredBandwidthKbps(now = Date.now()): number | undefined {
+  const stored = readStored(now);
+  // A limit recorded on a metered link describes that link only.
+  return stored && !stored.link ? stored.kbps : undefined;
+}
+
+/**
+ * Records that playback could not sustain `kbps`. The cache only ever moves
+ * down this way, so later starts and replans in the TTL plan for the slower
+ * link instead of the optimistic probe.
+ */
+export function recordObservedBandwidthLimitKbps(kbps: number, now = Date.now()): void {
+  const observed = clampKbps(kbps);
+  if (observed === undefined) return;
+  const current = readStored(now);
+  // Nothing to add when a lower limit is already recorded for this kind of
+  // link. Otherwise keep the lower value but record it for the current link,
+  // so a metered link honors it.
+  const sameLink = current?.link === meteredLink();
+  // A cached value caps the new limit unless it came from another kind of
+  // metered link, which does not describe this one. Writing even when the
+  // lower value is kept restarts its TTL: the link just confirmed it.
+  const cap = current && (sameLink || !current.link) ? current.kbps : observed;
+  writeStored(Math.min(observed, cap), now, true);
+}
+
+/**
+ * Names the kind of metered link the viewer is on, from what the browser
+ * reports: its connection type and whether Data Saver is on. Undefined on an
+ * unmetered link. Not a network identity, but enough to keep a limit seen on
+ * cellular from steering a Data Saver Wi-Fi network, and the reverse.
+ */
+function meteredLink(): string | undefined {
+  if (!onMeteredConnection()) return undefined;
+  const connection = networkInformation();
+  return `${connection?.type ?? "unknown"}:${connection?.saveData === true ? "save-data" : "full"}`;
+}
+
+/**
+ * The cached limit playback observed on this kind of metered link, for
+ * planning on it. A limit observed on Wi-Fi or another kind of metered link
+ * does not describe this one, and a probe result never applies here.
+ */
+export function readMeteredObservedLimitKbps(now = Date.now()): number | undefined {
+  const link = meteredLink();
+  const stored = readStored(now);
+  return link && stored?.observed && stored.link === link ? stored.kbps : undefined;
+}
+
+/**
+ * Times one probe download. Returns undefined when the probe failed, was
+ * aborted, or moved too little data in too short a window to mean anything.
+ */
+export async function measureBandwidthKbps(
+  signal: AbortSignal,
+  clock: () => number = () => performance.now(),
+): Promise<number | undefined> {
+  // The caller's signal cancels the probe; the first-byte deadline abandons a
+  // request or body that never starts flowing.
+  const controller = new AbortController();
+  const forwardAbort = () => controller.abort(signal.reason);
+  if (signal.aborted) forwardAbort();
+  else signal.addEventListener("abort", forwardAbort, { once: true });
+  let firstByteTimer: ReturnType<typeof setTimeout> | undefined = setTimeout(
+    () => controller.abort(),
+    PROBE_FIRST_BYTE_DEADLINE_MS,
+  );
+  let budgetTimer: ReturnType<typeof setTimeout> | undefined;
+  const clearTimers = () => {
+    clearTimeout(firstByteTimer);
+    clearTimeout(budgetTimer);
+    firstByteTimer = undefined;
+    budgetTimer = undefined;
+  };
+
+  // The clock starts at the first chunk, so request latency and server
+  // setup do not count against the link.
+  let start: number | undefined;
+  let warm: { at: number; bytes: number } | undefined;
+  let bytes = 0;
+  let now = 0;
+  try {
+    const { res } = await fetchWithSession(`/api/v2/playback/bandwidth-probe?size=${PROBE_BYTES}`, {
+      method: "GET",
+      headers: { ...V2_CLIENT_HEADERS, Accept: "application/octet-stream" },
+      cache: "no-store",
+      signal: controller.signal,
+    });
+    if (!res.ok || !res.body) {
+      await res.body?.cancel().catch(() => undefined);
+      return undefined;
+    }
+    const reader = res.body.getReader();
+    try {
+      for (;;) {
+        const { done, value } = await reader.read();
+        if (done) break;
+        now = clock();
+        if (start === undefined) {
+          start = now;
+          clearTimeout(firstByteTimer);
+          firstByteTimer = undefined;
+          // Ends a read that stops returning, which the check below would
+          // never reach: cancelling resolves the pending read as done. The
+          // silent stretch counts against the rate, so the window ends now
+          // rather than at the last chunk.
+          budgetTimer = setTimeout(() => {
+            now = clock();
+            void reader.cancel().catch(() => undefined);
+          }, PROBE_TIME_BUDGET_MS + PROBE_STALLED_READ_GRACE_MS);
+          continue;
+        }
+        bytes += value.byteLength;
+        if (!warm && now - start >= PROBE_WARMUP_MS) warm = { at: now, bytes };
+        if (now - start >= PROBE_TIME_BUDGET_MS) break;
+      }
+    } finally {
+      // Closing the body ends the transfer; the server stops at its next write.
+      await reader.cancel().catch(() => undefined);
+    }
+  } finally {
+    clearTimers();
+    signal.removeEventListener("abort", forwardAbort);
+  }
+  if (start === undefined || now <= start) return undefined;
+  const elapsed = now - start;
+  if (elapsed < PROBE_MIN_WINDOW_MS && bytes < PROBE_MIN_BYTES) return undefined;
+  // Prefer the rate after ramp-up when at least as much time followed it.
+  if (warm && now - warm.at >= warm.at - start) {
+    return clampKbps(((bytes - warm.bytes) * 8) / (now - warm.at));
+  }
+  // bytes * 8 bits / ms = kbit/s.
+  return clampKbps((bytes * 8) / elapsed);
+}
+
+let scheduledTimer: ReturnType<typeof setTimeout> | undefined;
+/** Bumped by stopBandwidthProbes so a stopped schedule never re-arms. */
+let scheduleGeneration = 0;
+/**
+ * Bumped by cancelBandwidthProbe, so a probe still waiting for the cross-tab
+ * lock when playback starts does not begin once the lock arrives.
+ */
+let cancelEpoch = 0;
+/**
+ * When playback last started. Media is still loading, and its element still
+ * paused, for a while after a start, so the playing-media check alone would
+ * let a timer that fires then probe during startup.
+ */
+let lastPlaybackStartAt: number | undefined;
+/** How long after a playback start a probe holds off. */
+const PLAYBACK_START_QUIET_MS = 60_000;
+/** Web Lock that lets one tab at a time run a probe. */
+const PROBE_LOCK_NAME = "prairie-bandwidth-probe";
+let activeProbe: AbortController | undefined;
+
+/** How soon to look again when a probe could not run or did not finish. */
+const PROBE_RETRY_MS = 5 * 60 * 1000;
+
+function mediaPlaying(): boolean {
+  if (typeof document === "undefined") return false;
+  return Array.from(document.querySelectorAll("video, audio")).some(
+    (media) => !(media as HTMLMediaElement).paused && !(media as HTMLMediaElement).ended,
+  );
+}
+
+/**
+ * Whether the viewer pays for this link by the byte: Data Saver is on or the
+ * browser reports cellular. Such a link is not probed, and a measurement
+ * taken on another link does not describe it.
+ */
+export function onMeteredConnection(): boolean {
+  const connection = networkInformation();
+  return connection?.saveData === true || connection?.type === "cellular";
+}
+
+/**
+ * Shared Web Lock a tab holds while its media plays or playback is starting,
+ * so a probe in another tab can tell the link is busy. Shared mode lets any
+ * number of tabs hold it at once.
+ */
+const MEDIA_LOCK_NAME = "prairie-media-active";
+
+function lockManager(): LockManager | undefined {
+  return typeof navigator === "undefined" ? undefined : navigator.locks;
+}
+
+/** Holds the media lock until `until` settles. */
+function holdMediaLock(until: Promise<void>): void {
+  void lockManager()
+    ?.request(MEDIA_LOCK_NAME, { mode: "shared" }, () => until)
+    .catch(() => undefined);
+}
+
+let releasePlayingHold: (() => void) | undefined;
+let mediaTrackingInstalled = false;
+
+/** Holds the media lock while any media element in this tab is playing. */
+function syncPlayingHold(): void {
+  if (mediaPlaying()) {
+    if (!releasePlayingHold) {
+      holdMediaLock(
+        new Promise<void>((resolve) => {
+          releasePlayingHold = resolve;
+        }),
+      );
+    }
+    return;
+  }
+  releasePlayingHold?.();
+  releasePlayingHold = undefined;
+}
+
+/** Tells other tabs that playback started here, so a running probe yields. */
+const PLAYBACK_CHANNEL_NAME = "prairie-playback-start";
+let playbackChannel: BroadcastChannel | undefined;
+
+function onOtherTabPlaybackStart(): void {
+  lastPlaybackStartAt = Date.now();
+  activeProbe?.abort();
+}
+
+function installMediaTracking(): void {
+  if (!playbackChannel && typeof BroadcastChannel !== "undefined") {
+    try {
+      playbackChannel = new BroadcastChannel(PLAYBACK_CHANNEL_NAME);
+      playbackChannel.onmessage = onOtherTabPlaybackStart;
+    } catch {
+      // Cross-tab notice is optional; without it each tab guards itself.
+    }
+  }
+  if (mediaTrackingInstalled || typeof document === "undefined" || !lockManager()) return;
+  mediaTrackingInstalled = true;
+  // Media events do not bubble; capturing on the document sees them all.
+  for (const type of ["playing", "pause", "ended", "emptied"]) {
+    document.addEventListener(type, syncPlayingHold, true);
+  }
+}
+
+/** Whether some tab, this one included, is playing or starting media. */
+async function mediaActiveInAnyTab(locks: LockManager): Promise<boolean> {
+  if (typeof locks.query !== "function") return false;
+  const state = await locks.query();
+  return state.held?.some((lock) => lock.name === MEDIA_LOCK_NAME) ?? false;
+}
+
+function probeAllowed(): boolean {
+  // A probe beside a playing or starting stream would both slow it and
+  // under-measure.
+  const startingPlayback =
+    lastPlaybackStartAt !== undefined && Date.now() - lastPlaybackStartAt < PLAYBACK_START_QUIET_MS;
+  return !onMeteredConnection() && !mediaPlaying() && !startingPlayback;
+}
+
+/**
+ * Keeps a measurement cached while the app is signed in. Starts once the first
+ * screen has had time to settle, measures again when the cached one expires,
+ * and while a probe is not allowed (metered link, media playing) looks again
+ * every few minutes. Returns a function that stops the schedule.
+ */
+export function scheduleBandwidthProbe(delayMs = PROBE_START_DELAY_MS): () => void {
+  stopBandwidthProbes();
+  try {
+    installMediaTracking();
+  } catch {
+    // Cross-tab coordination is optional.
+  }
+  const generation = scheduleGeneration;
+  const schedule = (ms: number) => {
+    if (generation !== scheduleGeneration) return;
+    scheduledTimer = setTimeout(run, Math.max(0, ms));
+  };
+  // Schedules the next look for when a fresh cached result expires.
+  const awaitExpiry = (): boolean => {
+    const now = Date.now();
+    const stored = readStored(now);
+    // A limit from a metered link says nothing about an unmetered one, so it
+    // does not stand in for a probe there.
+    if (!stored || (stored.link && !meteredLink())) return false;
+    schedule(stored.measuredAt + BANDWIDTH_ESTIMATE_TTL_MS - now + 1000);
+    return true;
+  };
+  const probe = async () => {
+    const controller = new AbortController();
+    activeProbe = controller;
+    try {
+      const kbps = await measureBandwidthKbps(controller.signal);
+      if (kbps !== undefined && !controller.signal.aborted) writeStored(kbps, Date.now());
+    } catch {
+      // Best effort: without a measurement playback plans as it did before.
+    } finally {
+      if (activeProbe === controller) activeProbe = undefined;
+      // A stored result schedules its own expiry; a failed or aborted probe
+      // waits out the retry interval.
+      if (!awaitExpiry()) schedule(PROBE_RETRY_MS);
+    }
+  };
+  const run = () => {
+    scheduledTimer = undefined;
+    if (awaitExpiry()) return;
+    if (!probeAllowed()) {
+      schedule(PROBE_RETRY_MS);
+      return;
+    }
+    // Tabs share the cached result, so only one of them measures at a time:
+    // two probes at once would split the link and both read low.
+    const locks = lockManager();
+    if (!locks) {
+      void probe();
+      return;
+    }
+    const epoch = cancelEpoch;
+    locks
+      .request(PROBE_LOCK_NAME, { ifAvailable: true }, async (lock) => {
+        if (!lock || epoch !== cancelEpoch) {
+          // Another tab is measuring, or playback started while the lock
+          // was on its way; look again later.
+          schedule(PROBE_RETRY_MS);
+          return;
+        }
+        // The tab that held the lock may have just stored a result.
+        if (awaitExpiry() || generation !== scheduleGeneration) return;
+        // Another tab may be playing; this tab's own check cannot see it.
+        if (await mediaActiveInAnyTab(locks)) {
+          schedule(PROBE_RETRY_MS);
+          return;
+        }
+        await probe();
+      })
+      .catch(() => schedule(PROBE_RETRY_MS));
+  };
+  schedule(delayMs);
+  return stopBandwidthProbes;
+}
+
+/**
+ * Called when playback starts: stops a running probe so it does not compete
+ * with playback, and holds off new ones while the media loads. The schedule
+ * continues and tries again later.
+ */
+export function cancelBandwidthProbe(): void {
+  cancelEpoch++;
+  lastPlaybackStartAt = Date.now();
+  activeProbe?.abort();
+  // Tell other tabs: a probe running there stops now, and the lock keeps new
+  // ones off until the playing hold takes over or the start settles. This is
+  // best effort: a browser that refuses cross-tab APIs (some privacy modes
+  // throw SecurityError) must never keep playback from starting.
+  try {
+    installMediaTracking();
+    playbackChannel?.postMessage("start");
+    holdMediaLock(new Promise<void>((resolve) => setTimeout(resolve, PLAYBACK_START_QUIET_MS)));
+  } catch {
+    // Local cancellation above already happened.
+  }
+}
+
+/** Stops the schedule and any running probe, e.g. on sign-out. */
+export function stopBandwidthProbes(): void {
+  scheduleGeneration++;
+  lastPlaybackStartAt = undefined;
+  playbackChannel?.close();
+  playbackChannel = undefined;
+  if (scheduledTimer !== undefined) {
+    clearTimeout(scheduledTimer);
+    scheduledTimer = undefined;
+  }
+  const probe = activeProbe;
+  activeProbe = undefined;
+  probe?.abort();
+}
diff --git a/web/src/player/client-context-v3.test.ts b/web/src/player/client-context-v3.test.ts
index 40cc680986..1cbc48578d 100644
--- a/web/src/player/client-context-v3.test.ts
+++ b/web/src/player/client-context-v3.test.ts
@@ -8,6 +8,7 @@ import {
   buildClientCapabilitiesV3,
   buildClientPlaybackContextV3,
   buildDeliveriesV3,
+  detectBandwidthEstimateKbpsV3,
   detectHLSSupport,
   type WebCapabilityProbe,
 } from "./client-context-v3";
@@ -37,7 +38,7 @@ describe("detectHLSSupport", () => {
 });
 
 describe("buildDeliveriesV3", () => {
-  it("advertises the embedded text artifacts rendered by the web player", () => {
+  it("advertises the embedded text and PGS artifacts rendered by the web player", () => {
     const deliveries = buildDeliveriesV3({
       containers: ["mp4"],
       codecsVideo: ["h264"],
@@ -60,6 +61,8 @@ describe("buildDeliveriesV3", () => {
     for (const delivery of Object.values(deliveries)) {
       expect(delivery.subtitles.embedded_text).toBe(true);
       expect(delivery.subtitles.sidecar_text).toBe(true);
+      expect(delivery.subtitles.embedded_bitmap).toBe(true);
+      expect(delivery.subtitles.sidecar_bitmap).toBe(false);
     }
   });
 });
@@ -160,3 +163,165 @@ describe("structured HDR capabilities", () => {
     expect(deliveries.hls?.audio_decode_codecs).toEqual(["aac", "vorbis"]);
   });
 });
+
+describe("browser decode engine capabilities", () => {
+  const probe: WebCapabilityProbe = {
+    containers: ["mp4", "webm"],
+    codecsVideo: ["h264", "av1"],
+    progressiveCodecsVideo: ["h264", "av1"],
+    codecsAudio: ["aac", "opus"],
+    progressiveCodecsAudio: ["aac", "opus"],
+    maxResolution: "2160p",
+    hdr: false,
+    hdrDetails: {
+      hdr10: false,
+      hdr10_plus: false,
+      hlg: false,
+      dolby_vision_profiles: [],
+      dolby_vision_profile_levels: [],
+    },
+    hls: true,
+    nativeHLS: false,
+  };
+  const engine = {
+    containers: ["mkv", "mp4"],
+    videoCodecs: ["h264", "hevc", "av1"],
+    audioCodecs: ["aac", "opus", "ac3", "eac3", "dts", "truehd"],
+    hdr: true,
+  };
+
+  it("widens only original_http and claims track selection and managed range", () => {
+    const deliveries = buildDeliveriesV3(probe, "test", engine);
+    expect(deliveries.original_http).toMatchObject({
+      containers: ["mp4", "webm", "mkv"],
+      video_codecs: ["h264", "av1", "hevc"],
+      audio_decode_codecs: ["aac", "opus", "ac3", "eac3", "dts", "truehd"],
+      validated_claims: ["client_selected_audio_track_v1", "client_managed_dynamic_range_v1"],
+    });
+    expect(deliveries.progressive?.audio_decode_codecs).toEqual(["aac", "opus"]);
+    expect(deliveries.progressive?.validated_claims).toEqual([]);
+    expect(deliveries.hls?.video_codecs).toEqual(["h264", "av1"]);
+  });
+
+  it("claims managed range only when WebGPU can tone-map", () => {
+    const deliveries = buildDeliveriesV3(probe, "test", { ...engine, hdr: false });
+    expect(deliveries.original_http?.validated_claims).toEqual(["client_selected_audio_track_v1"]);
+  });
+
+  it("leaves HDR to HDR-preserving routes on an HDR display", () => {
+    // The engine tone-maps to SDR; claiming managed range here would take HDR
+    // sources off the remux that keeps them HDR.
+    const deliveries = buildDeliveriesV3({ ...probe, hdr: true }, "test", engine);
+    expect(deliveries.original_http?.validated_claims).toEqual(["client_selected_audio_track_v1"]);
+  });
+
+  it("carries the engine codecs in the device-level lists the planner reads first", () => {
+    const capabilities = buildClientCapabilitiesV3(probe, engine);
+    expect(capabilities.codecs_audio).toContain("truehd");
+    expect(capabilities.codecs_video).toContain("hevc");
+    expect(capabilities.containers).toContain("mkv");
+    expect(buildClientCapabilitiesV3(probe).codecs_audio).toEqual(["aac", "opus"]);
+    expect(
+      buildClientPlaybackContextV3(probe, engine).deliveries.original_http?.validated_claims,
+    ).toHaveLength(2);
+  });
+});
+
+describe("detectBandwidthEstimateKbpsV3", () => {
+  // Chromium rounds and caps `downlink`, so it is a guess. Auto sends the
+  // source when nothing was measured, rather than plan from it.
+  it("sends no estimate when only connection.downlink is available", () => {
+    for (const downlink of [4.5, 10, 0.05, undefined]) {
+      vi.stubGlobal("navigator", { connection: { downlink } });
+      expect(detectBandwidthEstimateKbpsV3()).toBeUndefined();
+    }
+  });
+
+  it("prefers a fresh probe measurement over the downlink hint", () => {
+    vi.stubGlobal("navigator", { connection: { downlink: 10 } });
+    localStorage.setItem(
+      "prairie-bandwidth-estimate",
+      JSON.stringify({ kbps: 180_000, measuredAt: Date.now() }),
+    );
+    try {
+      expect(detectBandwidthEstimateKbpsV3()).toBe(180_000);
+    } finally {
+      localStorage.removeItem("prairie-bandwidth-estimate");
+    }
+  });
+
+  it("ignores a cached measurement while Data Saver is on", () => {
+    vi.stubGlobal("navigator", { connection: { downlink: 10, saveData: true } });
+    localStorage.setItem(
+      "prairie-bandwidth-estimate",
+      JSON.stringify({ kbps: 180_000, measuredAt: Date.now() }),
+    );
+    try {
+      expect(detectBandwidthEstimateKbpsV3()).toBeUndefined();
+    } finally {
+      localStorage.removeItem("prairie-bandwidth-estimate");
+    }
+  });
+
+  it("ignores a cached measurement on cellular without falling back to the downlink", () => {
+    vi.stubGlobal("navigator", { connection: { downlink: 4.5, type: "cellular" } });
+    localStorage.setItem(
+      "prairie-bandwidth-estimate",
+      JSON.stringify({ kbps: 180_000, measuredAt: Date.now() }),
+    );
+    try {
+      expect(detectBandwidthEstimateKbpsV3()).toBeUndefined();
+    } finally {
+      localStorage.removeItem("prairie-bandwidth-estimate");
+    }
+  });
+
+  it("uses a limit playback observed even on a metered link", () => {
+    vi.stubGlobal("navigator", { connection: { downlink: 8, saveData: true } });
+    localStorage.setItem(
+      "prairie-bandwidth-estimate",
+      JSON.stringify({
+        kbps: 4_200,
+        measuredAt: Date.now(),
+        observed: true,
+        link: "unknown:save-data",
+      }),
+    );
+    try {
+      expect(detectBandwidthEstimateKbpsV3()).toBe(4_200);
+    } finally {
+      localStorage.removeItem("prairie-bandwidth-estimate");
+    }
+  });
+
+  it("does not carry a limit observed on Wi-Fi onto a metered link", () => {
+    vi.stubGlobal("navigator", { connection: { type: "cellular" } });
+    localStorage.setItem(
+      "prairie-bandwidth-estimate",
+      JSON.stringify({ kbps: 56_000, measuredAt: Date.now(), observed: true }),
+    );
+    try {
+      expect(detectBandwidthEstimateKbpsV3()).toBeUndefined();
+    } finally {
+      localStorage.removeItem("prairie-bandwidth-estimate");
+    }
+  });
+
+  it("does not carry a limit observed on cellular onto Data Saver Wi-Fi", () => {
+    vi.stubGlobal("navigator", { connection: { type: "wifi", saveData: true, downlink: 3 } });
+    localStorage.setItem(
+      "prairie-bandwidth-estimate",
+      JSON.stringify({
+        kbps: 20_000,
+        measuredAt: Date.now(),
+        observed: true,
+        link: "cellular:full",
+      }),
+    );
+    try {
+      expect(detectBandwidthEstimateKbpsV3()).toBeUndefined();
+    } finally {
+      localStorage.removeItem("prairie-bandwidth-estimate");
+    }
+  });
+});
diff --git a/web/src/player/client-context-v3.ts b/web/src/player/client-context-v3.ts
index bee2cc3097..dd0e3f81b9 100644
--- a/web/src/player/client-context-v3.ts
+++ b/web/src/player/client-context-v3.ts
@@ -13,6 +13,8 @@
  */
 
 import {
+  CLAIM_CLIENT_MANAGED_DYNAMIC_RANGE_V3,
+  CLAIM_CLIENT_SELECTED_AUDIO_TRACK_V3,
   PROTOCOL_V3,
   type ClientCodecCapabilitiesV3,
   type ClientPlaybackContextV3,
@@ -21,7 +23,13 @@ import {
   type DeliverySubtitleCapabilitiesV3,
   type HDRCapabilitiesV3,
 } from "./protocol-v3";
+import {
+  onMeteredConnection,
+  readMeasuredBandwidthKbps,
+  readMeteredObservedLimitKbps,
+} from "./bandwidth-probe";
 import { isSafariBrowserV3 } from "./utils/hlsEngine";
+import type { EngineCapabilities } from "./engine/capabilities";
 
 /** App version reported to the server for diagnostics. */
 const WEB_APP_VERSION = "web";
@@ -30,14 +38,15 @@ const WEB_APP_VERSION = "web";
  * Subtitle capabilities of the web player, identical for every delivery class:
  * the server exposes external and embedded text as session-scoped sidecars,
  * which it renders as WebVTT or ASS via JASSUB (with container font
- * attachments). It has no bitmap subtitle renderer, so PGS/VOBSUB tracks must
- * still be burned in server-side.
+ * attachments). Embedded PGS arrives as a lossless `.sup` sidecar drawn by
+ * usePGSSubtitles. Embedded DVD/DVB bitmaps have no sidecar, so the server
+ * still burns them in; it refuses external bitmap files outright.
  */
 const WEB_SUBTITLE_CAPABILITIES: DeliverySubtitleCapabilitiesV3 = {
   embedded_text: true,
   sidecar_text: true,
   ass_styling: true,
-  embedded_bitmap: false,
+  embedded_bitmap: true,
   sidecar_bitmap: false,
   font_attachments: true,
 };
@@ -83,7 +92,7 @@ export interface WebCapabilityProbe {
   codecsAudio: string[];
   /** Audio codecs supported specifically inside progressive MP4 delivery. */
   progressiveCodecsAudio: string[];
-  /** Best-effort screen-derived resolution ceiling. */
+  /** Largest video size the browser decodes; never derived from the screen. */
   maxResolution: string;
   /** Best-effort HDR display detection. */
   hdr: boolean;
@@ -95,21 +104,37 @@ export interface WebCapabilityProbe {
   nativeHLS: boolean;
 }
 
+function union(...lists: readonly (readonly string[])[]): string[] {
+  return Array.from(new Set(lists.flat()));
+}
+
 /**
  * Builds the `client_capabilities` block. Every list is a flat declaration;
  * `codecs_video_hardware` mirrors `codecs_video` because a browser exposes no
  * way to tell software from hardware decode, and on the `declared` tier the
  * server treats the two lists identically.
+ *
+ * With the browser decode engine on, the device-level lists include what the
+ * engine adds. The server reads these lists for every route and then narrows
+ * each one by its delivery class, and only `original_http` carries the engine's
+ * additions, so remux and HLS routes are unaffected.
  */
-export function buildClientCapabilitiesV3(probe: WebCapabilityProbe): ClientCodecCapabilitiesV3 {
-  const codecsVideo = Array.from(new Set([...probe.codecsVideo, ...probe.progressiveCodecsVideo]));
+export function buildClientCapabilitiesV3(
+  probe: WebCapabilityProbe,
+  engine: EngineCapabilities | null = null,
+): ClientCodecCapabilitiesV3 {
+  const codecsVideo = union(
+    probe.codecsVideo,
+    probe.progressiveCodecsVideo,
+    engine?.videoCodecs ?? [],
+  );
   return {
     video_evidence: "declared",
     audio_evidence: "declared",
     codecs_video: codecsVideo,
     codecs_video_hardware: codecsVideo,
-    codecs_audio: probe.codecsAudio,
-    containers: probe.containers,
+    codecs_audio: union(probe.codecsAudio, engine?.audioCodecs ?? []),
+    containers: union(probe.containers, engine?.containers ?? []),
     max_resolution: probe.maxResolution,
     hdr: probe.hdr,
     hdr_details: probe.hdrDetails,
@@ -141,14 +166,41 @@ function buildDeliveryCapability(
   };
 }
 
+/**
+ * The browser decode engine's additions to the `original_http` class: what it
+ * decodes on top of the media element, the audio track it can pick from the
+ * whole file, and, when its WebGPU presenter works and the display is SDR, HDR and
+ * Dolby Vision originals (see docs/architecture/web-decode-engine.md). The
+ * engine only presents SDR, so on an HDR display the claim stays off and HDR
+ * sources keep the routes that preserve HDR.
+ */
+function engineOriginalOverrides(
+  probe: WebCapabilityProbe,
+  original: Partial<DeliveryCapabilityV3>,
+  engine: EngineCapabilities,
+): Partial<DeliveryCapabilityV3> {
+  return {
+    ...original,
+    containers: union(probe.containers, engine.containers),
+    video_codecs: union(probe.codecsVideo, engine.videoCodecs),
+    audio_decode_codecs: union(probe.codecsAudio, engine.audioCodecs),
+    validated_claims: [
+      CLAIM_CLIENT_SELECTED_AUDIO_TRACK_V3,
+      ...(engine.hdr && !probe.hdr ? [CLAIM_CLIENT_MANAGED_DYNAMIC_RANGE_V3] : []),
+    ],
+  };
+}
+
 /**
  * Builds the `deliveries` map. `original_http` and `progressive` ride the
  * `<video>` element directly; `hls` uses hls.js where MSE is available and the
- * media element's native HLS implementation otherwise.
+ * media element's native HLS implementation otherwise. With the decode engine
+ * on, `original_http` also covers what the engine can play.
  */
 export function buildDeliveriesV3(
   probe: WebCapabilityProbe,
   userAgent = typeof navigator !== "undefined" ? navigator.userAgent : "",
+  engine: EngineCapabilities | null = null,
 ): Partial<Record<DeliveryClassV3, DeliveryCapabilityV3>> {
   const nonProgressiveHDRDetails: HDRCapabilitiesV3 = {
     ...probe.hdrDetails,
@@ -167,10 +219,12 @@ export function buildDeliveriesV3(
   const progressiveHDRDetails = nativeHLSPreferred ? nonProgressiveHDRDetails : probe.hdrDetails;
   const hlsHDRDetails = nativeHLSPreferred ? probe.hdrDetails : nonProgressiveHDRDetails;
   const hlsVideoCodecs = nativeHLSPreferred ? probe.progressiveCodecsVideo : probe.codecsVideo;
+  const original: Partial<DeliveryCapabilityV3> = { hdr_details: nonProgressiveHDRDetails };
   return {
-    original_http: buildDeliveryCapability(probe, {
-      hdr_details: nonProgressiveHDRDetails,
-    }),
+    original_http: buildDeliveryCapability(
+      probe,
+      engine ? engineOriginalOverrides(probe, original, engine) : original,
+    ),
     progressive: buildDeliveryCapability(probe, {
       video_codecs: probe.progressiveCodecsVideo,
       audio_decode_codecs: probe.progressiveCodecsAudio,
@@ -187,45 +241,20 @@ export function buildDeliveriesV3(
 }
 
 /**
- * The slice of the Network Information API we use. It is not in the DOM lib
- * and is absent in Safari and Firefox, so everything here is best effort and
- * every reader tolerates `undefined`.
- */
-interface NetworkInformationLike {
-  saveData?: boolean;
-  downlink?: number;
-  type?: string;
-}
-
-function networkInformation(): NetworkInformationLike | undefined {
-  if (typeof navigator === "undefined") return undefined;
-  return (navigator as Navigator & { connection?: NetworkInformationLike }).connection;
-}
-
-/**
- * Whether the user is on a connection they would rather not spend. Only
- * Data Saver is a real signal in a browser — cellular detection via
- * `connection.type` is unimplemented nearly everywhere — so we report exactly
- * that and let the server treat the absence as "unknown, assume unmetered".
- */
-export function detectMeteredV3(): boolean {
-  return networkInformation()?.saveData === true;
-}
-
-/**
- * Best-effort downlink estimate in kbps for the planner's ladder choice.
+ * Measured downlink in kbps for the planner's Auto choice: a source that fits
+ * the estimate plays as-is, and only one that does not is converted.
  *
- * `connection.downlink` is a coarse, rounded, deliberately fingerprint-resistant
- * number, so it is a hint and not a measurement. Returns undefined rather than a
- * fabricated value when the API is absent or the reading falls outside the
- * contract's 100..1_000_000 kbps bounds.
+ * A fresh measurement from the background bandwidth probe wins, unless the
+ * link is metered (Data Saver or cellular): that measurement was taken on
+ * another link, so only a limit playback observed on this kind of link counts
+ * there. `connection.downlink` is never used: browsers round and cap it
+ * (Chromium at 10 Mbps), so it is a guess, not a measurement. Returns
+ * undefined when nothing was measured, which lets Auto send the source.
  */
 export function detectBandwidthEstimateKbpsV3(): number | undefined {
-  const downlinkMbps = networkInformation()?.downlink;
-  if (typeof downlinkMbps !== "number" || !Number.isFinite(downlinkMbps)) return undefined;
-  const kbps = Math.round(downlinkMbps * 1000);
-  if (kbps < 100 || kbps > 1_000_000) return undefined;
-  return kbps;
+  // On a metered link a probe result describes another link; only a limit
+  // playback observed on a metered link describes this one.
+  return onMeteredConnection() ? readMeteredObservedLimitKbps() : readMeasuredBandwidthKbps();
 }
 
 /** Coarse form factor, used by the server only for quirk lookups. */
@@ -252,7 +281,10 @@ function boundedDetail(value: string | undefined): string | undefined {
  * and the server only ever compares that token for equality, so a synthesized
  * value would invalidate plans at random.
  */
-export function buildClientPlaybackContextV3(probe: WebCapabilityProbe): ClientPlaybackContextV3 {
+export function buildClientPlaybackContextV3(
+  probe: WebCapabilityProbe,
+  engine: EngineCapabilities | null = null,
+): ClientPlaybackContextV3 {
   const platformDetails: Record<string, string> = {};
   const userAgent = boundedDetail(typeof navigator !== "undefined" ? navigator.userAgent : "");
   if (userAgent) platformDetails["user_agent"] = userAgent;
@@ -272,6 +304,7 @@ export function buildClientPlaybackContextV3(probe: WebCapabilityProbe): ClientP
     deliveries: buildDeliveriesV3(
       probe,
       typeof navigator !== "undefined" ? navigator.userAgent : "",
+      engine,
     ),
   };
 }
diff --git a/web/src/player/components/AudioTrackMenu.tsx b/web/src/player/components/AudioTrackMenu.tsx
index 8aaa73eb98..cca1e6ab40 100644
--- a/web/src/player/components/AudioTrackMenu.tsx
+++ b/web/src/player/components/AudioTrackMenu.tsx
@@ -1,7 +1,7 @@
 import { useState, useCallback, useEffect, useRef } from "react";
 import { AudioLines } from "lucide-react";
 import type { PlayerAudioTrack } from "../types";
-import { formatChannels, mapAudioLabel } from "@/lib/mediaFormat";
+import { audioTrackLabel, formatChannels } from "@/lib/mediaFormat";
 import {
   audioTitle,
   compactAudioMeta,
@@ -47,7 +47,7 @@ function describeTrack(track: PlayerAudioTrack, index: number): TrackDescriptor
   return {
     title,
     meta: metaParts.join(" \u00B7 "),
-    codecLabel: track.codec ? mapAudioLabel(track.codec) : "",
+    codecLabel: audioTrackLabel(track),
     channelsLabel: formatChannels(track.channels),
     isDefault: Boolean(track.default),
   };
diff --git a/web/src/player/components/PlaybackInfoOverlay.tsx b/web/src/player/components/PlaybackInfoOverlay.tsx
index ecbf687783..cb66a47e5f 100644
--- a/web/src/player/components/PlaybackInfoOverlay.tsx
+++ b/web/src/player/components/PlaybackInfoOverlay.tsx
@@ -23,6 +23,8 @@ interface PlaybackInfoOverlayProps {
   hlsRef?: React.RefObject<HlsType | null>;
   /** Recent player events, recorded whether or not the overlay is open. */
   eventLog?: PlaybackEventLog;
+  /** True while the browser decode engine plays the stream. */
+  browserEngine?: boolean;
   onClose: () => void;
 }
 
@@ -37,6 +39,7 @@ export function PlaybackInfoOverlay({
   qualityPreference,
   hlsRef,
   eventLog,
+  browserEngine = false,
   onClose,
 }: PlaybackInfoOverlayProps) {
   const [runtimeStats, setRuntimeStats] = useState<RuntimePlaybackStats>({});
@@ -87,6 +90,7 @@ export function PlaybackInfoOverlay({
         runtimeStats,
         activeAudioTrack,
         qualityPreference,
+        browserEngine,
       }),
     [
       streamUrl,
@@ -96,6 +100,7 @@ export function PlaybackInfoOverlay({
       runtimeStats,
       activeAudioTrack,
       qualityPreference,
+      browserEngine,
     ],
   );
 
diff --git a/web/src/player/components/PlaybackSpeedTrack.tsx b/web/src/player/components/PlaybackSpeedTrack.tsx
new file mode 100644
index 0000000000..24c014cb8a
--- /dev/null
+++ b/web/src/player/components/PlaybackSpeedTrack.tsx
@@ -0,0 +1,135 @@
+import { useId, useRef, type PointerEvent } from "react";
+import { PLAYBACK_SPEEDS, formatPlaybackSpeed } from "../utils/playbackSpeed";
+
+const LAST_STOP = PLAYBACK_SPEEDS.length - 1;
+const NORMAL_STOP = PLAYBACK_SPEEDS.indexOf(1);
+const LABELLED_SPEEDS = new Set([0.5, 1, 2, 3]);
+
+const stopPercent = (stop: number) => (stop / LAST_STOP) * 100;
+
+// End labels sit inside the track instead of hanging past its ends.
+function labelAlignment(stop: number): string {
+  if (stop === 0) return "";
+  if (stop === LAST_STOP) return "-translate-x-full";
+  return "-translate-x-1/2";
+}
+
+interface PlaybackSpeedTrackProps {
+  value: number;
+  onChange: (rate: number) => void;
+  /** Registers each stop with the menu's arrow-key navigation. */
+  itemRef: (stop: number) => (el: HTMLButtonElement | null) => void;
+}
+
+/**
+ * The speeds as stops on a track drawn like the seek bar. The fill runs from
+ * 1x to the chosen speed, so the track shows how far playback is from normal.
+ * Each stop is a menu item, so the menu's keyboard model still applies.
+ */
+export function PlaybackSpeedTrack({ value, onChange, itemRef }: PlaybackSpeedTrackProps) {
+  const labelId = useId();
+  const trackRef = useRef<HTMLDivElement>(null);
+  const current = Math.max(
+    0,
+    PLAYBACK_SPEEDS.findIndex((rate) => rate === value),
+  );
+  const fillStart = stopPercent(Math.min(current, NORMAL_STOP));
+  const fillWidth = Math.abs(stopPercent(current) - stopPercent(NORMAL_STOP));
+
+  const select = (rate: number) => {
+    if (rate !== value) onChange(rate);
+  };
+
+  // Pressing or dragging anywhere on the track picks the nearest stop.
+  const pickAt = (clientX: number) => {
+    const rect = trackRef.current?.getBoundingClientRect();
+    if (!rect || rect.width === 0) return;
+    const fraction = Math.min(1, Math.max(0, (clientX - rect.left) / rect.width));
+    const rate = PLAYBACK_SPEEDS[Math.round(fraction * LAST_STOP)];
+    if (rate !== undefined) select(rate);
+  };
+  const handlePointerDown = (e: PointerEvent<HTMLDivElement>) => {
+    if (e.button !== 0) return;
+    // A press between stops would otherwise move focus out of the menu,
+    // which closes it.
+    if (!(e.target instanceof HTMLButtonElement)) e.preventDefault();
+    e.currentTarget.setPointerCapture?.(e.pointerId);
+    pickAt(e.clientX);
+  };
+  const handlePointerMove = (e: PointerEvent<HTMLDivElement>) => {
+    if (e.currentTarget.hasPointerCapture?.(e.pointerId)) pickAt(e.clientX);
+  };
+
+  return (
+    <div role="group" aria-labelledby={labelId} className="px-3 pt-1 pb-2">
+      <div className="flex items-baseline justify-between py-1">
+        <span id={labelId} className="text-xs tracking-wider text-white/40 uppercase">
+          Speed
+        </span>
+        <span className="text-sm font-medium text-white tabular-nums" aria-hidden="true">
+          {formatPlaybackSpeed(value)}
+        </span>
+      </div>
+      <div
+        ref={trackRef}
+        className="group relative mx-1.5 h-8 cursor-pointer touch-none select-none"
+        onPointerDown={handlePointerDown}
+        onPointerMove={handlePointerMove}
+      >
+        <div
+          aria-hidden="true"
+          className="absolute inset-x-0 top-1/2 h-[3px] -translate-y-1/2 rounded-full bg-white/20"
+        />
+        <div
+          aria-hidden="true"
+          className="absolute top-1/2 h-[3px] -translate-y-1/2 rounded-full bg-white motion-safe:transition-[left,width] motion-safe:duration-150"
+          style={{ left: `${fillStart}%`, width: `${fillWidth}%` }}
+        />
+        {PLAYBACK_SPEEDS.map((rate, stop) => (
+          <span
+            key={rate}
+            aria-hidden="true"
+            className={`absolute top-1/2 w-px -translate-x-1/2 -translate-y-1/2 ${
+              stop === NORMAL_STOP ? "h-3 bg-white/70" : "h-2 bg-white/35"
+            }`}
+            style={{ left: `${stopPercent(stop)}%` }}
+          />
+        ))}
+        <span
+          aria-hidden="true"
+          className="pointer-events-none absolute top-1/2 size-3.5 -translate-x-1/2 -translate-y-1/2 rounded-full bg-white shadow-[0_1px_4px_rgba(0,0,0,0.6)] group-active:scale-110 motion-safe:transition-[left,transform] motion-safe:duration-150"
+          style={{ left: `${stopPercent(current)}%` }}
+        />
+        {PLAYBACK_SPEEDS.map((rate, stop) => (
+          <button
+            key={rate}
+            ref={itemRef(stop)}
+            role="menuitemradio"
+            type="button"
+            aria-checked={rate === value}
+            aria-label={formatPlaybackSpeed(rate)}
+            className="absolute top-0 h-full w-5 -translate-x-1/2 rounded-full focus-visible:ring-2 focus-visible:ring-white/70 focus-visible:outline-none"
+            style={{ left: `${stopPercent(stop)}%` }}
+            onClick={() => select(rate)}
+          />
+        ))}
+      </div>
+      <div
+        aria-hidden="true"
+        className="relative mx-1.5 h-3 text-[10px] leading-3 text-white/40 tabular-nums"
+      >
+        {PLAYBACK_SPEEDS.map((rate, stop) =>
+          LABELLED_SPEEDS.has(rate) ? (
+            <span
+              key={rate}
+              className={`absolute top-0 ${labelAlignment(stop)} ${rate === value ? "text-white" : ""}`}
+              style={{ left: `${stopPercent(stop)}%` }}
+            >
+              {formatPlaybackSpeed(rate)}
+            </span>
+          ) : null,
+        )}
+      </div>
+    </div>
+  );
+}
diff --git a/web/src/player/components/PlayerControls.test.tsx b/web/src/player/components/PlayerControls.test.tsx
index ba55c276ae..0d2bfecf45 100644
--- a/web/src/player/components/PlayerControls.test.tsx
+++ b/web/src/player/components/PlayerControls.test.tsx
@@ -30,17 +30,8 @@ function renderControls(
       onSubtitleDelayChange={vi.fn()}
       audioTracks={[]}
       activeAudioIndex={-1}
-      qualityOptions={[
-        {
-          id: "original",
-          label: "Original",
-          sublabel: "",
-          resolution: "1080p",
-          bitrateKbps: 0,
-          isOriginal: true,
-        },
-      ]}
-      activeQualityId="original"
+      qualityOptions={[]}
+      activeQualityId="auto"
       isTranscoding={false}
       qualityError={null}
       onQualitySelect={vi.fn()}
diff --git a/web/src/player/components/PlayerControls.tsx b/web/src/player/components/PlayerControls.tsx
index e93f33ff98..58ff715fb3 100644
--- a/web/src/player/components/PlayerControls.tsx
+++ b/web/src/player/components/PlayerControls.tsx
@@ -35,7 +35,7 @@ import type {
 } from "../types";
 import type { PlayerTrickplay } from "../trickplay";
 import type { VersionInfo } from "./QualityMenu";
-import type { EffectiveRecipeV3 } from "../protocol-v3";
+import type { EffectiveRecipeV3, SourceDescriptorV3 } from "../protocol-v3";
 import type { PlayerConfig } from "../context/PlayerConfigContext";
 import type { SubtitleSync } from "../hooks/useSubtitleSync";
 import { useCoarsePointer } from "../hooks/useCoarsePointer";
@@ -94,6 +94,8 @@ interface PlayerControlsProps {
   qualityOptions: QualityOption[];
   activeQualityId: string;
   deliveredRecipe?: EffectiveRecipeV3;
+  /** The source the plan delivers from, for showing Auto when it plays as-is. */
+  playbackSource?: SourceDescriptorV3;
   isTranscoding: boolean;
   qualityError: string | null;
   onQualitySelect: (id: string) => void;
@@ -101,6 +103,9 @@ interface PlayerControlsProps {
   versions?: VersionInfo[];
   versionLocked?: boolean;
   onSwitchVersion?: (fileId: number) => void;
+  // Speed. Omitted while something else owns the rate (a Watch Party room).
+  playbackSpeed?: number;
+  onPlaybackSpeedChange?: (rate: number) => void;
   // PiP
   onTogglePiP?: () => void;
   // Playback info
@@ -119,7 +124,8 @@ interface PlayerControlsProps {
   onSeek: (seconds: number) => void;
   onVolumeChange: (volume: number) => void;
   onMutedChange: (muted: boolean) => void;
-  onFullscreenToggle: () => void;
+  /** Absent when fullscreen cannot work, such as engine playback on iPhone. */
+  onFullscreenToggle?: () => void;
   onSurfaceTap?: (event: MouseEvent<HTMLElement>) => void;
 }
 
@@ -167,12 +173,15 @@ export function PlayerControls({
   qualityOptions,
   activeQualityId,
   deliveredRecipe,
+  playbackSource,
   isTranscoding,
   qualityError,
   onQualitySelect,
   versions,
   versionLocked,
   onSwitchVersion,
+  playbackSpeed,
+  onPlaybackSpeedChange,
   onTogglePiP,
   showPlaybackInfo,
   onTogglePlaybackInfo,
@@ -361,12 +370,15 @@ export function PlayerControls({
               options={qualityOptions}
               activeId={activeQualityId}
               deliveredRecipe={deliveredRecipe}
+              source={playbackSource}
               isTranscoding={isTranscoding}
               error={qualityError}
               onSelect={onQualitySelect}
               versions={versions}
               versionLocked={versionLocked}
               onSwitchVersion={onSwitchVersion}
+              playbackSpeed={playbackSpeed}
+              onPlaybackSpeedChange={onPlaybackSpeedChange}
             />
             <button
               type="button"
@@ -378,18 +390,20 @@ export function PlayerControls({
             >
               <MoreHorizontal className="h-5 w-5" />
             </button>
-            <button
-              type="button"
-              className="player-utility-btn"
-              onClick={onFullscreenToggle}
-              aria-label={isFullscreen ? "Exit fullscreen" : "Fullscreen"}
-            >
-              {isFullscreen ? (
-                <Minimize className="h-[18px] w-[18px]" />
-              ) : (
-                <Maximize className="h-[18px] w-[18px]" />
-              )}
-            </button>
+            {onFullscreenToggle && (
+              <button
+                type="button"
+                className="player-utility-btn"
+                onClick={onFullscreenToggle}
+                aria-label={isFullscreen ? "Exit fullscreen" : "Fullscreen"}
+              >
+                {isFullscreen ? (
+                  <Minimize className="h-[18px] w-[18px]" />
+                ) : (
+                  <Maximize className="h-[18px] w-[18px]" />
+                )}
+              </button>
+            )}
           </div>
         ) : (
           <div className="mt-2 grid grid-cols-[minmax(0,1fr)_auto_minmax(0,1fr)] items-center gap-5">
@@ -539,12 +553,15 @@ export function PlayerControls({
                 options={qualityOptions}
                 activeId={activeQualityId}
                 deliveredRecipe={deliveredRecipe}
+                source={playbackSource}
                 isTranscoding={isTranscoding}
                 error={qualityError}
                 onSelect={onQualitySelect}
                 versions={versions}
                 versionLocked={versionLocked}
                 onSwitchVersion={onSwitchVersion}
+                playbackSpeed={playbackSpeed}
+                onPlaybackSpeedChange={onPlaybackSpeedChange}
               />
 
               {markerEditAvailable && onToggleMarkerEdit && (
@@ -595,18 +612,20 @@ export function PlayerControls({
                 <Scaling className="h-[18px] w-[18px]" />
               </button>
 
-              <button
-                type="button"
-                className="player-utility-btn"
-                onClick={onFullscreenToggle}
-                aria-label={isFullscreen ? "Exit fullscreen" : "Fullscreen"}
-              >
-                {isFullscreen ? (
-                  <Minimize className="h-[18px] w-[18px]" />
-                ) : (
-                  <Maximize className="h-[18px] w-[18px]" />
-                )}
-              </button>
+              {onFullscreenToggle && (
+                <button
+                  type="button"
+                  className="player-utility-btn"
+                  onClick={onFullscreenToggle}
+                  aria-label={isFullscreen ? "Exit fullscreen" : "Fullscreen"}
+                >
+                  {isFullscreen ? (
+                    <Minimize className="h-[18px] w-[18px]" />
+                  ) : (
+                    <Maximize className="h-[18px] w-[18px]" />
+                  )}
+                </button>
+              )}
             </div>
           </div>
         )}
diff --git a/web/src/player/components/PlayingNextScreen.test.tsx b/web/src/player/components/PlayingNextScreen.test.tsx
index 2f31d94330..95721c0374 100644
--- a/web/src/player/components/PlayingNextScreen.test.tsx
+++ b/web/src/player/components/PlayingNextScreen.test.tsx
@@ -412,4 +412,24 @@ describe("PlayingNextScreen spoiler protection", () => {
     });
     expect(previewPlaceholder().className).not.toContain("blur-xl");
   });
+
+  it("labels an AI-translated overview only while the overview shows", () => {
+    const translated = {
+      ...nextWithoutUrl,
+      overview: "Une équipe prépare un dernier coup.",
+      machineTranslatedFields: ["overview"],
+    };
+    renderScreen({ nextEpisode: translated });
+    expect(screen.getByText("Translated by AI")).toBeTruthy();
+    cleanup();
+
+    renderScreen({ nextEpisode: { ...translated, machineTranslatedFields: undefined } });
+    expect(screen.queryByText("Translated by AI")).toBeNull();
+    cleanup();
+
+    mocks.spoilerPrefs = { hideImages: true, hideOverviews: true };
+    renderScreen({ nextEpisode: translated });
+    expect(screen.queryByText("Une équipe prépare un dernier coup.")).toBeNull();
+    expect(screen.queryByText("Translated by AI")).toBeNull();
+  });
 });
diff --git a/web/src/player/components/PlayingNextScreen.tsx b/web/src/player/components/PlayingNextScreen.tsx
index 97a2dfc11a..6b2de8df2e 100644
--- a/web/src/player/components/PlayingNextScreen.tsx
+++ b/web/src/player/components/PlayingNextScreen.tsx
@@ -12,6 +12,8 @@ import { useCarouselEmbla } from "@/hooks/useCarouselEmbla";
 import { preferredDateLocale } from "@/lib/datetime";
 import { formatRuntimeMinutes } from "@/lib/mediaFormat";
 import { useDateTimeFormat } from "@/hooks/useDateTimeFormat";
+import MachineTranslatedLabel from "@/pages/ItemDetail/components/MachineTranslatedLabel";
+import { hasMachineTranslation } from "@/pages/ItemDetail/components/machineTranslation";
 
 interface PlayingNextScreenProps {
   seriesId?: string;
@@ -277,6 +279,11 @@ export function PlayingNextScreen({
                     {nextEpisode.overview}
                   </p>
                 )}
+                {nextEpisode.overview &&
+                  !hideOverview &&
+                  hasMachineTranslation(nextEpisode.machineTranslatedFields) && (
+                    <MachineTranslatedLabel className="mt-1" />
+                  )}
               </div>
 
               {/* Actions */}
diff --git a/web/src/player/components/QualityMenu.test.ts b/web/src/player/components/QualityMenu.test.ts
index 2e9b84cd28..cb54d6aeac 100644
--- a/web/src/player/components/QualityMenu.test.ts
+++ b/web/src/player/components/QualityMenu.test.ts
@@ -3,6 +3,8 @@
 import { fireEvent, render, screen } from "@testing-library/react";
 import { createElement, type ComponentProps } from "react";
 import { describe, expect, it, vi } from "vitest";
+import { qualityOptionsFromPlanV3 } from "../playback-info";
+import { fixturePlanV3 } from "../protocol-v3.fixtures";
 import { buildVersionStatusLabels, QualityMenu, type VersionInfo } from "./QualityMenu";
 
 function makeVersionInfo(overrides: Partial<VersionInfo> = {}): VersionInfo {
@@ -53,24 +55,16 @@ describe("QualityMenu", () => {
     render(
       createElement(QualityMenu, {
         options: [
-          {
-            id: "original",
-            label: "Original",
-            sublabel: "",
-            resolution: "1080p",
-            bitrateKbps: 8000,
-            isOriginal: true,
-          },
+          { id: "auto", label: "Auto", sublabel: "", resolution: "", bitrateKbps: 0 },
           {
             id: "720p",
             label: "720p",
             sublabel: "3 Mbps",
             resolution: "720p",
             bitrateKbps: 3000,
-            isOriginal: false,
           },
         ],
-        activeId: "original",
+        activeId: "auto",
         isTranscoding: false,
         error: null,
         onSelect: select,
@@ -82,8 +76,8 @@ describe("QualityMenu", () => {
     fireEvent.click(screen.getByRole("button", { name: "Quality" }));
     expect(screen.getByText(/Watch Party keeps everyone on the same version/)).toBeInTheDocument();
     expect(screen.queryByRole("menuitem", { name: /2160p HEVC HDR/ })).not.toBeInTheDocument();
-    fireEvent.click(screen.getByRole("menuitem", { name: /Original/ }));
-    expect(select).toHaveBeenCalledWith("original");
+    fireEvent.click(screen.getByRole("menuitem", { name: /720p/ }));
+    expect(select).toHaveBeenCalledWith("720p");
     expect(switchVersion).not.toHaveBeenCalled();
   });
 
@@ -91,24 +85,17 @@ describe("QualityMenu", () => {
     render(
       createElement(QualityMenu, {
         options: [
-          {
-            id: "original",
-            label: "Original",
-            sublabel: "25 Mbps",
-            resolution: "2160p",
-            bitrateKbps: 25_000,
-            isOriginal: true,
-          },
+          { id: "auto", label: "Auto", sublabel: "", resolution: "", bitrateKbps: 0 },
           {
             id: "1080p-medium",
             label: "1080p Medium",
             sublabel: "6 Mbps",
             resolution: "1080p",
             bitrateKbps: 6000,
-            isOriginal: false,
           },
         ],
         activeId: "1080p",
+        source: { height: 2160, bitrate_kbps: 25_000 },
         isTranscoding: false,
         error: null,
         onSelect: () => {},
@@ -124,26 +111,24 @@ describe("QualityMenu", () => {
     );
   });
 
-  it("shows Original for a fitting source unless the delivered recipe shows a cap", () => {
+  it("lights no row for a fitting source under a fixed resolution unless a cap shows", () => {
     const options = [
-      {
-        id: "original",
-        label: "Original",
-        sublabel: "20 Mbps",
-        resolution: "1080p",
-        bitrateKbps: 20_000,
-        isOriginal: true,
-      },
+      { id: "auto", label: "Auto", sublabel: "", resolution: "", bitrateKbps: 0 },
       {
         id: "1080p-medium",
         label: "1080p Medium",
         sublabel: "6 Mbps",
         resolution: "1080p",
         bitrateKbps: 6000,
-        isOriginal: false,
       },
     ];
-    const props = { options, activeId: "1080p", isTranscoding: false, error: null };
+    const props = {
+      options,
+      activeId: "1080p",
+      source: { height: 1080, bitrate_kbps: 20_000 },
+      isTranscoding: false,
+      error: null,
+    };
     const { rerender } = render(
       createElement(QualityMenu, {
         ...props,
@@ -151,7 +136,9 @@ describe("QualityMenu", () => {
         onSelect: () => {},
       }),
     );
-    expect(screen.getByRole("button", { name: "Quality" })).toHaveTextContent("Original");
+    // The trigger names the saved resolution instead of lighting Auto.
+    expect(screen.getByRole("button", { name: "Quality" })).toHaveTextContent("1080p");
+    expect(screen.getByRole("button", { name: "Quality" })).not.toHaveTextContent("Auto");
 
     rerender(
       createElement(QualityMenu, {
@@ -162,15 +149,42 @@ describe("QualityMenu", () => {
     );
     expect(screen.getByRole("button", { name: "Quality" })).toHaveTextContent("1080p Medium");
   });
+
+  it("never shows an original entry from the plan, and Auto is the way back to the source", () => {
+    const select = vi.fn();
+    const plan = fixturePlanV3({
+      available_qualities: [
+        { label: "original", height: 2160, bitrate_kbps: 40_000, preserves_source: true },
+        { label: "1080p-medium", height: 1080, bitrate_kbps: 6000, preserves_source: false },
+      ],
+    });
+    render(
+      createElement(QualityMenu, {
+        options: qualityOptionsFromPlanV3(plan),
+        activeId: "1080p-medium",
+        isTranscoding: false,
+        error: null,
+        onSelect: select,
+      }),
+    );
+
+    fireEvent.click(screen.getByRole("button", { name: "Quality" }));
+    expect(screen.queryByRole("menuitem", { name: /Original/i })).not.toBeInTheDocument();
+    expect(screen.getAllByRole("menuitem").map((item) => item.textContent)).toEqual([
+      "Auto",
+      "1080p-medium6 MbpsSelected",
+    ]);
+    fireEvent.click(screen.getByRole("menuitem", { name: /Auto/ }));
+    expect(select).toHaveBeenCalledWith("auto");
+  });
 });
 
-const original = {
-  id: "original",
-  label: "Original",
-  sublabel: "8 Mbps",
-  resolution: "1080p",
-  bitrateKbps: 8000,
-  isOriginal: true,
+const rung720 = {
+  id: "720p",
+  label: "720p",
+  sublabel: "3 Mbps",
+  resolution: "720p",
+  bitrateKbps: 3000,
 };
 const auto = {
   id: "auto",
@@ -178,7 +192,6 @@ const auto = {
   sublabel: "",
   resolution: "",
   bitrateKbps: 0,
-  isOriginal: false,
 };
 const versions = [
   makeVersionInfo({ isCurrentSource: true }),
@@ -188,7 +201,7 @@ function menuProps(
   overrides: Partial<ComponentProps<typeof QualityMenu>> = {},
 ): ComponentProps<typeof QualityMenu> {
   return {
-    options: [original],
+    options: [rung720],
     activeId: "auto",
     isTranscoding: false,
     error: null,
@@ -200,14 +213,14 @@ function menuProps(
 }
 
 describe("available playback choices", () => {
-  it.each([{ options: [] }, { options: [original] }])(
+  it.each([{ options: [] }, { options: [rung720] }])(
     "keeps version switching without a quality choice (%j)",
     ({ options }) => {
       const props = menuProps({ options });
       render(createElement(QualityMenu, props));
       fireEvent.click(screen.getByRole("button", { name: "Version" }));
       expect(screen.queryByText("Quality")).not.toBeInTheDocument();
-      expect(screen.queryByRole("menuitem", { name: /Original/ })).not.toBeInTheDocument();
+      expect(screen.queryByRole("menuitem", { name: /720p/ })).not.toBeInTheDocument();
       fireEvent.click(screen.getByRole("menuitem", { name: /1080p H264/ }));
       expect(props.onSwitchVersion).toHaveBeenCalledWith(2);
       expect(props.onSelect).not.toHaveBeenCalled();
@@ -225,7 +238,7 @@ describe("available playback choices", () => {
   });
 
   it("shows both sections when versions and qualities are available", () => {
-    render(createElement(QualityMenu, menuProps({ options: [auto, original] })));
+    render(createElement(QualityMenu, menuProps({ options: [auto, rung720] })));
     fireEvent.click(screen.getByRole("button", { name: "Quality" }));
     expect(screen.getByText("Version")).toBeInTheDocument();
     expect(screen.getByText("Quality")).toBeInTheDocument();
@@ -239,9 +252,71 @@ describe("available playback choices", () => {
     const props = menuProps();
     const { rerender } = render(createElement(QualityMenu, props));
     expect(screen.getByRole("button", { name: "Version" })).toHaveTextContent("Version");
-    rerender(createElement(QualityMenu, { ...props, options: [auto, original] }));
+    rerender(createElement(QualityMenu, { ...props, options: [auto, rung720] }));
     fireEvent.click(screen.getByRole("button", { name: "Quality" }));
     expect(screen.getByRole("menuitem", { name: /Auto.*Selected/ })).toBeInTheDocument();
     expect(props.onSelect).not.toHaveBeenCalled();
   });
 });
+
+describe("playback speed", () => {
+  it("keeps the menu for speed alone and picks a speed without closing it", () => {
+    const onPlaybackSpeedChange = vi.fn();
+    render(
+      createElement(
+        QualityMenu,
+        menuProps({ options: [rung720], versions: undefined, onPlaybackSpeedChange }),
+      ),
+    );
+    const trigger = screen.getByRole("button", { name: "Playback settings" });
+
+    fireEvent.click(trigger);
+    expect(screen.getByRole("group", { name: "Speed" })).toBeInTheDocument();
+    expect(screen.getAllByRole("menuitemradio")).toHaveLength(9);
+    expect(screen.getByRole("menuitemradio", { name: "1×" })).toHaveAttribute(
+      "aria-checked",
+      "true",
+    );
+    fireEvent.click(screen.getByRole("menuitemradio", { name: "1.5×" }));
+    expect(onPlaybackSpeedChange).toHaveBeenCalledExactlyOnceWith(1.5);
+    // The menu stays open so the viewer sees the speed take effect.
+    expect(screen.getByRole("menu")).toBeInTheDocument();
+  });
+
+  it("moves between speeds with the left and right arrow keys", () => {
+    render(createElement(QualityMenu, menuProps({ onPlaybackSpeedChange: vi.fn() })));
+    fireEvent.click(screen.getByRole("button", { name: "Playback settings" }));
+    const half = screen.getByRole("menuitemradio", { name: "0.5×" });
+    half.focus();
+    fireEvent.keyDown(half, { key: "ArrowRight" });
+    expect(screen.getByRole("menuitemradio", { name: "0.75×" })).toHaveFocus();
+    fireEvent.keyDown(document.activeElement!, { key: "ArrowLeft" });
+    expect(half).toHaveFocus();
+  });
+
+  it("keeps focus in the menu when the track is pressed between stops", () => {
+    render(createElement(QualityMenu, menuProps({ onPlaybackSpeedChange: vi.fn() })));
+    fireEvent.click(screen.getByRole("button", { name: "Playback settings" }));
+    const track = screen.getByRole("menuitemradio", { name: "1×" }).parentElement!;
+    expect(fireEvent.pointerDown(track, { button: 0 })).toBe(false);
+    expect(
+      fireEvent.pointerDown(screen.getByRole("menuitemradio", { name: "2×" }), { button: 0 }),
+    ).toBe(true);
+  });
+
+  it("badges the gear with a speed other than 1x", () => {
+    const props = menuProps({
+      options: [auto, rung720],
+      activeId: "720p",
+      playbackSpeed: 1,
+      onPlaybackSpeedChange: vi.fn(),
+    });
+    const { rerender } = render(createElement(QualityMenu, props));
+    expect(screen.getByRole("button", { name: "Playback settings" })).toHaveTextContent(/^720p$/);
+
+    rerender(createElement(QualityMenu, { ...props, playbackSpeed: 1.5 }));
+    const trigger = screen.getByRole("button", { name: "Playback settings, 1.5×" });
+    expect(trigger.querySelector(".player-quality-label")).toHaveTextContent(/^720p$/);
+    expect(trigger.querySelector(".player-speed-badge")).toHaveTextContent(/^1\.5×$/);
+  });
+});
diff --git a/web/src/player/components/QualityMenu.tsx b/web/src/player/components/QualityMenu.tsx
index 0fe9a47bd3..d107918228 100644
--- a/web/src/player/components/QualityMenu.tsx
+++ b/web/src/player/components/QualityMenu.tsx
@@ -1,8 +1,10 @@
 import { useCallback, useEffect, useRef, useState } from "react";
 import { Check, Settings } from "lucide-react";
-import { resolveActiveQualityOptionId } from "../playback-info";
-import type { EffectiveRecipeV3 } from "../protocol-v3";
+import { plainResolutionLabel, resolveActiveQualityOptionId } from "../playback-info";
+import type { EffectiveRecipeV3, SourceDescriptorV3 } from "../protocol-v3";
 import type { QualityOption } from "../types";
+import { PLAYBACK_SPEEDS, formatPlaybackSpeed } from "../utils/playbackSpeed";
+import { PlaybackSpeedTrack } from "./PlaybackSpeedTrack";
 import { PlayerMenuSurface } from "./PlayerMenuSurface";
 
 export interface VersionInfo {
@@ -17,24 +19,32 @@ interface QualityMenuProps {
   activeId: string;
   /** The plan's effective recipe, which shows when a bitrate cap reduced the source. */
   deliveredRecipe?: EffectiveRecipeV3;
+  /** The source the plan delivers from, for showing Auto when it plays as-is. */
+  source?: Pick<SourceDescriptorV3, "height" | "bitrate_kbps">;
   isTranscoding: boolean;
   error: string | null;
   onSelect: (id: string) => void;
   versions?: VersionInfo[];
   versionLocked?: boolean;
   onSwitchVersion?: (fileId: number) => void;
+  /** Omitted while something else owns the rate (a Watch Party room). */
+  playbackSpeed?: number;
+  onPlaybackSpeedChange?: (rate: number) => void;
 }
 
 export function QualityMenu({
   options,
   activeId,
   deliveredRecipe,
+  source,
   isTranscoding,
   error,
   onSelect,
   versions,
   versionLocked,
   onSwitchVersion,
+  playbackSpeed = 1,
+  onPlaybackSpeedChange,
 }: QualityMenuProps) {
   const [open, setOpen] = useState(false);
   const menuRef = useRef<HTMLDivElement>(null);
@@ -76,9 +86,11 @@ export function QualityMenu({
 
     switch (e.key) {
       case "ArrowDown":
+      case "ArrowRight":
         nextIndex = currentIndex < items.length - 1 ? currentIndex + 1 : 0;
         break;
       case "ArrowUp":
+      case "ArrowLeft":
         nextIndex = currentIndex > 0 ? currentIndex - 1 : items.length - 1;
         break;
       case "Home":
@@ -99,13 +111,26 @@ export function QualityMenu({
 
   const showVersions = !versionLocked && versions && versions.length > 1 && onSwitchVersion;
   const showQuality = options.length > 1;
-  if (!showVersions && !showQuality) return null;
+  const showSpeed = onPlaybackSpeedChange !== undefined;
+  if (!showVersions && !showQuality && !showSpeed) return null;
 
-  const menuLabel = showQuality ? "Quality" : "Version";
+  let menuLabel = "Version";
+  if (showSpeed) menuLabel = "Playback settings";
+  else if (showQuality) menuLabel = "Quality";
 
-  const resolvedActiveId = resolveActiveQualityOptionId(options, activeId, deliveredRecipe);
+  const resolvedActiveId = resolveActiveQualityOptionId(options, activeId, deliveredRecipe, source);
   const activeOption = options.find((option) => option.id === resolvedActiveId);
-  let menuItemIndex = 0;
+  let sourceLabel: string | null = null;
+  if (showQuality) {
+    sourceLabel = isTranscoding
+      ? "…"
+      : (activeOption?.label ?? plainResolutionLabel(activeId) ?? "Quality");
+  } else if (showVersions) sourceLabel = "Version";
+  // A speed other than 1x stays on the gear in every layout: inline after the
+  // quality label, or on the gear's corner where the label is hidden.
+  const changedSpeed = showSpeed && playbackSpeed !== 1 ? formatPlaybackSpeed(playbackSpeed) : null;
+  // The speed stops come first in the menu's arrow-key order.
+  let menuItemIndex = showSpeed ? PLAYBACK_SPEEDS.length : 0;
 
   return (
     <div ref={menuRef} className="relative" onBlur={handleBlur}>
@@ -113,24 +138,46 @@ export function QualityMenu({
         type="button"
         className="player-quality-trigger player-utility-btn sm:w-auto sm:gap-1.5 sm:px-3"
         onClick={() => setOpen((v) => !v)}
-        aria-label={menuLabel}
+        aria-label={changedSpeed ? `${menuLabel}, ${changedSpeed}` : menuLabel}
         aria-expanded={open}
         aria-haspopup="menu"
       >
         <Settings className="h-[18px] w-[18px]" />
-        <span className="hidden text-[11px] font-medium tracking-wide sm:inline">
-          {!showQuality ? "Version" : isTranscoding ? "…" : (activeOption?.label ?? "Quality")}
-        </span>
+        {sourceLabel && (
+          <span className="player-quality-label hidden text-[11px] font-medium tracking-wide sm:inline">
+            {sourceLabel}
+          </span>
+        )}
+        {changedSpeed && (
+          <span
+            aria-hidden="true"
+            className="player-speed-badge pointer-events-none absolute top-0.5 left-6 rounded-full bg-white px-1 text-[9px] leading-[13px] font-semibold text-black tabular-nums shadow-[0_0_0_2px_rgba(0,0,0,0.65)] sm:static"
+          >
+            {changedSpeed}
+          </span>
+        )}
       </button>
 
       {open && (
         <PlayerMenuSurface
           anchorRef={menuRef}
-          className="absolute right-0 bottom-full z-30 mb-2 min-w-[200px] rounded-lg bg-black/90 py-1 shadow-lg backdrop-blur"
+          className="absolute right-0 bottom-full z-30 mb-2 max-h-[calc(100dvh-8rem)] min-w-[224px] overflow-y-auto rounded-lg bg-black/90 py-1 shadow-lg backdrop-blur"
           onClose={() => setOpen(false)}
           onKeyDown={handleMenuKeyDown}
         >
           {error && <div className="px-3 py-1 text-xs text-red-400">{error}</div>}
+          {showSpeed && (
+            <>
+              <PlaybackSpeedTrack
+                value={playbackSpeed}
+                onChange={onPlaybackSpeedChange}
+                itemRef={(stop) => (el) => {
+                  menuItemsRef.current[stop] = el;
+                }}
+              />
+              {(showVersions || showQuality) && <div className="my-1 border-t border-white/10" />}
+            </>
+          )}
           {versionLocked && showQuality && (
             <p className="max-w-64 px-3 py-2 text-xs text-white/60">
               Watch Party keeps everyone on the same version. You can adjust your streaming quality
diff --git a/web/src/player/components/SpeedMenu.test.tsx b/web/src/player/components/SpeedMenu.test.tsx
deleted file mode 100644
index 4f98c3ec52..0000000000
--- a/web/src/player/components/SpeedMenu.test.tsx
+++ /dev/null
@@ -1,30 +0,0 @@
-import { describe, expect, it, vi } from "vitest";
-import { render, screen } from "@testing-library/react";
-import userEvent from "@testing-library/user-event";
-import { SpeedMenu } from "./SpeedMenu";
-
-const RATES = [0.75, 1, 1.25, 1.5, 2] as const;
-
-describe("SpeedMenu", () => {
-  it("shows the current rate label on the trigger", () => {
-    render(<SpeedMenu rates={RATES} value={1.5} onChange={() => {}} />);
-    expect(screen.getByRole("button", { name: /playback speed/i })).toHaveTextContent("1.5×");
-  });
-
-  it("opens, lists all rates, and emits the chosen value", async () => {
-    const onChange = vi.fn();
-    render(<SpeedMenu rates={RATES} value={1} onChange={onChange} />);
-    await userEvent.click(screen.getByRole("button", { name: /playback speed/i }));
-    expect(screen.getByRole("menu")).toHaveClass("z-30");
-    expect(screen.getAllByRole("menuitem")).toHaveLength(RATES.length);
-    await userEvent.click(screen.getByRole("menuitem", { name: "1.25×" }));
-    expect(onChange).toHaveBeenCalledWith(1.25);
-  });
-
-  it("marks the current rate as active", async () => {
-    render(<SpeedMenu rates={RATES} value={1.5} onChange={() => {}} />);
-    await userEvent.click(screen.getByRole("button", { name: /playback speed/i }));
-    const active = screen.getByRole("menuitem", { name: "1.5×" });
-    expect(active).toHaveAttribute("data-active", "true");
-  });
-});
diff --git a/web/src/player/components/SpeedMenu.tsx b/web/src/player/components/SpeedMenu.tsx
deleted file mode 100644
index 9dc7b2e733..0000000000
--- a/web/src/player/components/SpeedMenu.tsx
+++ /dev/null
@@ -1,95 +0,0 @@
-import { useCallback, useEffect, useRef, useState } from "react";
-
-interface SpeedMenuProps {
-  rates: readonly number[];
-  value: number;
-  onChange: (rate: number) => void;
-}
-
-export function SpeedMenu({ rates, value, onChange }: SpeedMenuProps) {
-  const [open, setOpen] = useState(false);
-  const menuRef = useRef<HTMLDivElement>(null);
-  const menuItemsRef = useRef<(HTMLButtonElement | null)[]>([]);
-
-  const handleBlur = useCallback((e: React.FocusEvent) => {
-    if (!menuRef.current?.contains(e.relatedTarget as Node)) {
-      setOpen(false);
-    }
-  }, []);
-
-  useEffect(() => {
-    if (!open) return;
-    const onKey = (e: KeyboardEvent) => e.key === "Escape" && setOpen(false);
-    document.addEventListener("keydown", onKey);
-    return () => document.removeEventListener("keydown", onKey);
-  }, [open]);
-
-  const handleMenuKeyDown = useCallback((e: React.KeyboardEvent) => {
-    const items = menuItemsRef.current.filter(Boolean) as HTMLButtonElement[];
-    if (items.length === 0) return;
-    const i = items.indexOf(document.activeElement as HTMLButtonElement);
-    let next: number | null = null;
-    switch (e.key) {
-      case "ArrowDown":
-        next = i < items.length - 1 ? i + 1 : 0;
-        break;
-      case "ArrowUp":
-        next = i > 0 ? i - 1 : items.length - 1;
-        break;
-      case "Home":
-        next = 0;
-        break;
-      case "End":
-        next = items.length - 1;
-        break;
-      default:
-        return;
-    }
-    e.preventDefault();
-    items[next]?.focus();
-  }, []);
-
-  return (
-    <div ref={menuRef} className="relative" onBlur={handleBlur}>
-      <button
-        type="button"
-        className="player-utility-btn px-2 text-xs tabular-nums"
-        onClick={() => setOpen((v) => !v)}
-        aria-label="Playback speed"
-        aria-expanded={open}
-        aria-haspopup="menu"
-      >
-        {value}×
-      </button>
-
-      {open && (
-        <div
-          role="menu"
-          className="absolute right-0 bottom-full z-30 mb-2 flex min-w-[100px] flex-col overflow-hidden rounded-lg bg-black/90 py-1.5 shadow-xl backdrop-blur-sm"
-          onKeyDown={handleMenuKeyDown}
-        >
-          {rates.map((r, idx) => (
-            <button
-              key={r}
-              ref={(el) => {
-                menuItemsRef.current[idx] = el;
-              }}
-              role="menuitem"
-              type="button"
-              data-active={r === value ? "true" : undefined}
-              className={`w-full px-4 py-2 text-right text-sm tabular-nums transition-colors hover:bg-white/10 focus-visible:ring-2 focus-visible:ring-white/70 focus-visible:outline-none ${
-                r === value ? "bg-white/5 text-white" : "text-white/75"
-              }`}
-              onClick={() => {
-                onChange(r);
-                setOpen(false);
-              }}
-            >
-              {r}×
-            </button>
-          ))}
-        </div>
-      )}
-    </div>
-  );
-}
diff --git a/web/src/player/components/SubtitleAppearancePanel.tsx b/web/src/player/components/SubtitleAppearancePanel.tsx
index 80b728003a..2b8a4891e9 100644
--- a/web/src/player/components/SubtitleAppearancePanel.tsx
+++ b/web/src/player/components/SubtitleAppearancePanel.tsx
@@ -12,9 +12,9 @@ interface SubtitleAppearancePanelProps {
  * In-player subtitle styling panel modelled on Plex's "Playback Settings"
  * sheet — lets a viewer tune font size, colour, position, background, and
  * outline without leaving the player. Every change writes
- * playback.subtitle_appearance at profile_device scope, so the rendered
- * subtitles update live through the shared effective-settings cache and the
- * choice stays on this device.
+ * playback.subtitle_appearance for the profile, so the rendered subtitles
+ * update live through the shared effective-settings cache and the choice
+ * follows the profile to its other devices.
  *
  * The visual chrome lives in {@link SubtitleAppearancePanelView}; this
  * wrapper only binds the panel to the canonical setting.
diff --git a/web/src/player/components/SubtitleTranslateModal.test.ts b/web/src/player/components/SubtitleTranslateModal.test.ts
index 73341ed28a..72e1843afc 100644
--- a/web/src/player/components/SubtitleTranslateModal.test.ts
+++ b/web/src/player/components/SubtitleTranslateModal.test.ts
@@ -43,6 +43,25 @@ describe("isTranslatableSource", () => {
 });
 
 describe("buildSubtitleTranslateRequest", () => {
+  it("keeps audio jobs in the spoken language when the server cannot translate", () => {
+    const body = buildSubtitleTranslateRequest({
+      mode: "audio",
+      mediaFileId: 42,
+      audioIndex: 1,
+      audioTracks: [audioTrack({ language: "eng" }), audioTrack({ language: "ger" })],
+      targetLang: "en",
+      translateTranscript: false,
+      startPosition: 0,
+    });
+
+    expect(body).toMatchObject({
+      kind: "transcribe",
+      source_index: 1,
+      source_language: "de",
+      target_language: "",
+    });
+  });
+
   it("normalizes 3-letter audio language codes before choosing the ASR job kind", () => {
     const body = buildSubtitleTranslateRequest({
       mode: "audio",
diff --git a/web/src/player/components/SubtitleTranslateModal.tsx b/web/src/player/components/SubtitleTranslateModal.tsx
index 08f38346ab..03585a5712 100644
--- a/web/src/player/components/SubtitleTranslateModal.tsx
+++ b/web/src/player/components/SubtitleTranslateModal.tsx
@@ -216,6 +216,7 @@ export function SubtitleTranslateModal({
         audioTracks,
         audioIndex,
         targetLang,
+        translateTranscript: translateEnabled,
         sessionId,
         startPosition: getStartPosition?.() ?? 0,
       });
@@ -266,6 +267,7 @@ export function SubtitleTranslateModal({
     audioIndex,
     mediaFileId,
     targetLang,
+    translateEnabled,
     sessionId,
     getStartPosition,
     playerConfig,
@@ -372,23 +374,30 @@ export function SubtitleTranslateModal({
                 </label>
               )}
 
-              <label className="block">
-                <span className="mb-1 block text-xs font-medium text-white/60">
-                  {mode === "audio" ? "Subtitle language" : "Translate to"}
-                </span>
-                <select
-                  className="w-full rounded bg-neutral-800 px-2 py-1.5 text-sm text-white focus-visible:ring-2 focus-visible:ring-white/70 focus-visible:outline-none disabled:opacity-50"
-                  value={targetLang}
-                  onChange={(e) => setTargetLang(e.target.value)}
-                  disabled={submitting}
-                >
-                  {LANGUAGES.map((lang) => (
-                    <option key={lang.code} value={lang.code}>
-                      {lang.label}
-                    </option>
-                  ))}
-                </select>
-              </label>
+              {mode === "audio" && !translateEnabled ? (
+                <p className="text-xs leading-relaxed text-white/60">
+                  Subtitles are written in the spoken language. AI translation is turned off on this
+                  server.
+                </p>
+              ) : (
+                <label className="block">
+                  <span className="mb-1 block text-xs font-medium text-white/60">
+                    {mode === "audio" ? "Subtitle language" : "Translate to"}
+                  </span>
+                  <select
+                    className="w-full rounded bg-neutral-800 px-2 py-1.5 text-sm text-white focus-visible:ring-2 focus-visible:ring-white/70 focus-visible:outline-none disabled:opacity-50"
+                    value={targetLang}
+                    onChange={(e) => setTargetLang(e.target.value)}
+                    disabled={submitting}
+                  >
+                    {LANGUAGES.map((lang) => (
+                      <option key={lang.code} value={lang.code}>
+                        {lang.label}
+                      </option>
+                    ))}
+                  </select>
+                </label>
+              )}
 
               {mode === "audio" && quota && (
                 <p
@@ -432,7 +441,9 @@ export function SubtitleTranslateModal({
 
               <p className="text-[11px] leading-relaxed text-white/35">
                 {mode === "audio"
-                  ? "The audio is transcribed on the server (and translated if the language differs) — longer files take a while. The finished track is saved for everyone."
+                  ? translateEnabled
+                    ? "The audio is transcribed on the server (and translated if the language differs) — longer files take a while. The finished track is saved for everyone."
+                    : "The audio is transcribed on the server — longer files take a while. The finished track is saved for everyone."
                   : "Playback pauses while the first lines are translated, then resumes with subtitles streaming in. The finished track is saved for everyone."}
               </p>
             </>
diff --git a/web/src/player/components/SubtitleTranslateModal.ui.test.tsx b/web/src/player/components/SubtitleTranslateModal.ui.test.tsx
index 18f97cc7f3..22aafa6e37 100644
--- a/web/src/player/components/SubtitleTranslateModal.ui.test.tsx
+++ b/web/src/player/components/SubtitleTranslateModal.ui.test.tsx
@@ -73,3 +73,31 @@ it("reports the validated accepted job to the player before closing", async () =
     onClose.mock.invocationCallOrder[0]!,
   );
 });
+
+it("offers only the spoken language for audio when translation is off", async () => {
+  playerV2Mock.mockResolvedValue({
+    job: { id: "13", media_file_id: "7", kind: "transcribe", source_index: 0, status: "pending" },
+    live_delivery_attached: true,
+  });
+  render(
+    <SubtitleTranslateModal
+      {...props}
+      translateEnabled={false}
+      transcribeEnabled
+      audioTracks={[{ language: "de" }]}
+    />,
+  );
+  expect(screen.queryByRole("combobox", { name: "Subtitle language" })).toBeNull();
+  expect(screen.getByText(/Subtitles are written in the spoken language/)).toBeInTheDocument();
+  expect(screen.queryByText(/translated if the language differs/)).toBeNull();
+  await act(async () => {
+    fireEvent.click(screen.getByRole("button", { name: "Generate" }));
+  });
+  expect(playerV2Mock).toHaveBeenCalledWith(
+    expect.anything(),
+    "POST /api/v2/subtitles/ai/translate",
+    expect.objectContaining({
+      body: expect.objectContaining({ kind: "transcribe", target_language: "" }),
+    }),
+  );
+});
diff --git a/web/src/player/components/VideoPlayer.reconnect.test.tsx b/web/src/player/components/VideoPlayer.reconnect.test.tsx
index 527718d385..949cf7e5e4 100644
--- a/web/src/player/components/VideoPlayer.reconnect.test.tsx
+++ b/web/src/player/components/VideoPlayer.reconnect.test.tsx
@@ -22,7 +22,9 @@ const hlsJS = vi.hoisted(() => ({
   latest: null as null | { emit: (event: string, data: unknown) => void },
 }));
 
-vi.mock("sonner", () => ({ toast: { error: vi.fn(), success: vi.fn(), message: vi.fn() } }));
+vi.mock("sonner", () => ({
+  toast: { error: vi.fn(), info: vi.fn(), success: vi.fn(), message: vi.fn() },
+}));
 vi.mock("../hooks/usePlaybackRealtime", () => ({
   usePlaybackRealtime: () => ({ connectionState: "connected" }),
 }));
@@ -32,6 +34,11 @@ vi.mock("../hooks/useWatchProgress", () => ({
 vi.mock("../hooks/useKeyboardShortcuts", () => ({ useKeyboardShortcuts: vi.fn() }));
 vi.mock("../hooks/useSubtitleTracks", () => ({ useSubtitleTracks: () => [] }));
 vi.mock("../hooks/useASSSubtitles", () => ({ useASSSubtitles: () => ({ isActive: false }) }));
+// The delay is the profile's saved offset; plain state stands in for the query.
+vi.mock("../hooks/useSubtitleDelay", async () => {
+  const { useState } = await import("react");
+  return { useSubtitleDelay: () => useState(0) };
+});
 vi.mock("../hooks/useSubtitleAppearance", () => ({
   useSubtitleAppearance: () => ({
     settings: { position: "bottom", fontSize: "large" },
@@ -279,6 +286,38 @@ afterEach(() => {
 });
 
 describe("VideoPlayer with the playback session: reconnect", () => {
+  it("leaves a session an administrator ended when a resumed remux reopens", async () => {
+    const remuxPlan = directPlan({
+      delivery: "server_remux_progressive",
+      timeline: { ...directPlan().timeline, can_seek_anywhere: false },
+    });
+    const requests = stubServer({
+      start: () => jsonResponse(playable("session-1", remuxPlan), 201),
+      replan: () =>
+        jsonResponse(
+          {
+            type: "https://siloserver.org/docs/api/v2/problems/playback_session_ended",
+            title: "Playback session ended",
+            status: 410,
+            detail: "An administrator ended this playback session",
+          },
+          410,
+        ),
+    });
+    renderHarness();
+    const video = await startWatching();
+    const now = Date.now();
+    fireEvent.pause(video);
+
+    // The viewer comes back after ten minutes, so the player reopens the stream.
+    vi.spyOn(Date, "now").mockReturnValue(now + 10 * 60_000);
+    fireEvent.play(video);
+
+    await waitFor(() => expect(sessionRef.current?.connectionStatus).toBe("ended"));
+    expect(requests.replans.map((replan) => replan.body.operation)).toEqual(["seek_reanchor"]);
+    expect(requests.starts).toHaveLength(1);
+  });
+
   it("keeps playing after a reconnect that follows a failed HLS startup", async () => {
     // HLS goes through hls.js: the browser reports no native support.
     vi.spyOn(HTMLMediaElement.prototype, "canPlayType").mockReturnValue("");
diff --git a/web/src/player/components/VideoPlayer.test.tsx b/web/src/player/components/VideoPlayer.test.tsx
index bf8612a5f7..dd40a4e499 100644
--- a/web/src/player/components/VideoPlayer.test.tsx
+++ b/web/src/player/components/VideoPlayer.test.tsx
@@ -24,6 +24,7 @@ const realtimeOptions = vi.hoisted(() => ({
 const controls = vi.hoisted(() => ({
   current: null as null | {
     currentTime: number;
+    duration: number;
     onSeek: (seconds: number) => void;
     activeSubtitleIndex: number | null;
     subtitleTracks: PlayerSubtitleInfo[];
@@ -38,6 +39,8 @@ const controls = vi.hoisted(() => ({
     onSubtitleJobAccepted?: (jobId: string) => void;
     onMutedChange?: (muted: boolean) => void;
     onVolumeChange?: (volume: number) => void;
+    playbackSpeed?: number;
+    onPlaybackSpeedChange?: (rate: number) => void;
   },
 }));
 const playerV2Mock = vi.hoisted(() => vi.fn());
@@ -76,9 +79,28 @@ vi.mock("../hooks/usePlaybackRealtime", () => ({
 vi.mock("../hooks/useWatchProgress", () => ({
   useWatchProgress: () => vi.fn().mockResolvedValue(undefined),
 }));
-vi.mock("../hooks/useKeyboardShortcuts", () => ({
-  useKeyboardShortcuts: vi.fn(),
-}));
+// Opted into per test: plans whose original the browser engine plays.
+const engineRoute = vi.hoisted(() => ({ chosen: false, refused: false }));
+vi.mock("../engine/routing", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../engine/routing")>();
+  return {
+    ...actual,
+    resolveOriginalPlaybackRoute: (
+      ...args: Parameters<typeof actual.resolveOriginalPlaybackRoute>
+    ) =>
+      engineRoute.refused
+        ? {
+            kind: "unsupported",
+            failure: { classification: actual.ENGINE_UNSUPPORTED_SOURCE, message: "refused" },
+          }
+        : engineRoute.chosen
+          ? { kind: "engine", source: {} }
+          : actual.resolveOriginalPlaybackRoute(...args),
+  };
+});
+const attachBrowserEngine = vi.hoisted(() => vi.fn(() => ({ destroy: vi.fn() })));
+vi.mock("../engine", () => ({ attachBrowserEngine }));
+vi.mock("../hooks/useKeyboardShortcuts", () => ({ useKeyboardShortcuts: vi.fn() }));
 vi.mock("../hooks/useRemuxSeeking", () => ({
   useRemuxSeeking: () => ({ handleSeek: playerSeek }),
 }));
@@ -100,6 +122,11 @@ vi.mock("../hooks/useASSSubtitles", () => ({
     return { isActive: false };
   },
 }));
+// The delay is the profile's saved offset; plain state stands in for the query.
+vi.mock("../hooks/useSubtitleDelay", async () => {
+  const { useState } = await import("react");
+  return { useSubtitleDelay: () => useState(0) };
+});
 vi.mock("../hooks/useSubtitleAppearance", () => ({
   useSubtitleAppearance: () => ({
     settings: { position: "bottom", fontSize: "large" },
@@ -149,6 +176,7 @@ vi.mock("./PlayerControls", () => ({
   PlayerControls: vi.fn(
     (props: {
       currentTime: number;
+      duration: number;
       onSeek: (seconds: number) => void;
       activeSubtitleIndex: number | null;
       subtitleTracks: PlayerSubtitleInfo[];
@@ -311,6 +339,15 @@ function roomConnection(
 
 const reconnectingMessage = "Reconnecting to room. Controls are temporarily unavailable.";
 
+/** Makes jsdom's element report playback with data ahead of the playhead. */
+function markPlaying(video: HTMLVideoElement) {
+  Object.defineProperty(video, "paused", { configurable: true, value: false });
+  Object.defineProperty(video, "readyState", {
+    configurable: true,
+    value: HTMLMediaElement.HAVE_FUTURE_DATA,
+  });
+}
+
 describe("VideoPlayer room catch-up", () => {
   beforeEach(() => {
     vi.useFakeTimers();
@@ -671,6 +708,130 @@ describe("VideoPlayer room catch-up", () => {
     expect(controls.current!.currentTime).toBe(target + 0.5);
   });
 
+  it("keeps the newest skip held while the room's seeks for earlier skips land", async () => {
+    const { connection, video, command, rerenderPlayer } = setup(100, 0, true);
+    const host = {
+      ...connection,
+      room: { ...connection.room!, self_can_manage_room: true, self_can_control_transport: true },
+    };
+    rerenderPlayer({ watchTogetherConnection: host });
+    const requested = () =>
+      vi
+        .mocked(host.sendRoomMessage)
+        .mock.calls.map(([message]) => message as Record<string, unknown>)
+        .filter((message) => message.type === "transport_request")
+        .map((message) => message.position_seconds);
+    const roomSeek = async (id: string, target: number) => {
+      rerenderPlayer({
+        watchTogetherConnection: {
+          ...host,
+          room: { ...host.room, playback_state: "waiting" as const },
+          transportCommand: {
+            ...command,
+            command_id: id,
+            action: "seek" as const,
+            position_seconds: target,
+            playback_state: "waiting" as const,
+          },
+        },
+      });
+      await act(() => vi.advanceTimersByTimeAsync(0));
+    };
+
+    act(() => controls.current!.onSkip!.forward());
+    act(() => controls.current!.onSkip!.forward());
+    expect(requested()).toEqual([130, 160]);
+
+    // The room's seek for the first skip lands; the second is still held.
+    await roomSeek("seek-130", 130);
+    video.currentTime = 130;
+    fireEvent.seeked(video);
+    fireEvent.timeUpdate(video);
+    expect(controls.current!.currentTime).toBe(160);
+    act(() => controls.current!.onSkip!.forward());
+    expect(requested()).toEqual([130, 160, 190]);
+
+    // The room's seek to the held request releases it.
+    await roomSeek("seek-190", 190);
+    video.currentTime = 190;
+    fireEvent.seeked(video);
+    fireEvent.timeUpdate(video);
+    expect(controls.current!.currentTime).toBe(190);
+
+    // A request the room never runs stops holding the timeline.
+    act(() => controls.current!.onSkip!.forward());
+    expect(controls.current!.currentTime).toBe(220);
+    await act(() => vi.advanceTimersByTimeAsync(5_000));
+    fireEvent.timeUpdate(video);
+    expect(controls.current!.currentTime).toBe(190);
+  });
+
+  it("releases a held skip when a newer command replaces its room seek", async () => {
+    const { connection, command, rerenderPlayer } = setup(100, 0, true);
+    const host = {
+      ...connection,
+      room: { ...connection.room!, self_can_manage_room: true, self_can_control_transport: true },
+    };
+    rerenderPlayer({ watchTogetherConnection: host });
+    act(() => controls.current!.onSkip!.forward());
+    expect(controls.current!.currentTime).toBe(130);
+
+    const at = (ms: number) => new Date(Date.now() + ms).toISOString();
+    rerenderPlayer({
+      watchTogetherConnection: {
+        ...host,
+        room: { ...host.room, playback_state: "waiting" as const },
+        transportCommand: {
+          ...command,
+          command_id: "seek-130",
+          action: "seek" as const,
+          position_seconds: 130,
+          playback_state: "waiting" as const,
+          execute_at: at(500),
+        },
+      },
+    });
+    await act(() => vi.advanceTimersByTimeAsync(100));
+    // A pause replaces the seek before it runs; the element stays at 100 s.
+    rerenderPlayer({
+      watchTogetherConnection: {
+        ...host,
+        room: { ...host.room, playback_state: "paused" as const, is_paused: true },
+        transportCommand: {
+          ...command,
+          command_id: "pause",
+          action: "pause" as const,
+          position_seconds: 100,
+          playback_state: "paused" as const,
+          execute_at: at(200),
+        },
+      },
+    });
+    await act(() => vi.advanceTimersByTimeAsync(300));
+    expect(controls.current!.currentTime).toBe(100);
+    act(() => controls.current!.onSkip!.forward());
+    expect(controls.current!.currentTime).toBe(130);
+  });
+
+  it("releases a held skip when the room selects something else", () => {
+    const { connection, rerenderPlayer } = setup(100, 0, true);
+    const host = {
+      ...connection,
+      room: { ...connection.room!, self_can_manage_room: true, self_can_control_transport: true },
+    };
+    rerenderPlayer({ watchTogetherConnection: host });
+    act(() => controls.current!.onSkip!.forward());
+    expect(controls.current!.currentTime).toBe(130);
+
+    rerenderPlayer({
+      watchTogetherConnection: {
+        ...host,
+        room: { ...host.room, selection_revision: (host.room.selection_revision ?? 0) + 1 },
+      },
+    });
+    expect(controls.current!.currentTime).toBe(100);
+  });
+
   it("keeps the actual position when a room seek cannot be sent", () => {
     const { connection, rerenderPlayer } = setup(100);
     connection.room = { ...connection.room!, self_can_manage_room: true };
@@ -817,6 +978,102 @@ describe("VideoPlayer room catch-up", () => {
     expect(screen.getByText("Waiting for Alex")).toBeInTheDocument();
   });
 
+  it.each([
+    [1503, true],
+    [1497, false],
+  ])(
+    "reports readiness for a seek that landed at %s only when pre-roll cannot reach the target",
+    async (landed, reports) => {
+      const { connection, video, command, rerenderPlayer } = setup(100);
+      Object.defineProperty(video, "readyState", { configurable: true, value: 3 });
+      rerenderPlayer({
+        watchTogetherConnection: {
+          ...connection,
+          room: { ...connection.room!, playback_state: "waiting" as const },
+          transportCommand: {
+            ...command,
+            action: "seek" as const,
+            playback_state: "waiting" as const,
+            position_seconds: 1500,
+            execute_at: new Date(Date.now() + 500).toISOString(),
+          },
+        },
+      });
+      await act(() => vi.advanceTimersByTimeAsync(500));
+      // A rebuilt stream past the target cannot pre-roll back to it; the
+      // server decides whether that landing is close enough. One short of
+      // the target still pre-rolls up to it before it reports.
+      video.currentTime = landed;
+      fireEvent.seeked(video);
+      fireEvent.canPlay(video);
+      const ready = vi
+        .mocked(connection.sendRoomMessage)
+        .mock.calls.filter(([m]) => m.type === "ready");
+      expect(ready.length > 0).toBe(reports);
+      if (reports) {
+        expect(ready[0]?.[0]).toMatchObject({
+          command_id: command.command_id,
+          position_seconds: landed,
+        });
+      }
+    },
+  );
+
+  it("lets the room's resume replace a seek target that landed ahead of it", async () => {
+    const { connection, video, command, rerenderPlayer } = setup(100);
+    Object.defineProperty(video, "readyState", { configurable: true, value: 3 });
+    const seekCommand = {
+      ...command,
+      action: "seek" as const,
+      playback_state: "waiting" as const,
+      position_seconds: 1500,
+      execute_at: new Date(Date.now() + 500).toISOString(),
+    };
+    rerenderPlayer({
+      watchTogetherConnection: {
+        ...connection,
+        room: { ...connection.room!, playback_state: "waiting" as const },
+        transportCommand: seekCommand,
+      },
+    });
+    await act(() => vi.advanceTimersByTimeAsync(500));
+    // The stream lands 3 s past the target: ready, but the seek never settles.
+    video.currentTime = 1503;
+    fireEvent.seeked(video);
+    fireEvent.canPlay(video);
+    expect(connection.sendRoomMessage).toHaveBeenCalledWith(
+      expect.objectContaining({ type: "ready", position_seconds: 1503 }),
+    );
+    expect(controls.current!.currentTime).toBe(1500);
+
+    // The room resumes from the barrier.
+    markPlaying(video);
+    rerenderPlayer({
+      watchTogetherConnection: {
+        ...connection,
+        transportCommand: {
+          ...command,
+          command_id: "room-command-2",
+          position_seconds: 1500,
+          execute_at: new Date().toISOString(),
+        },
+      },
+    });
+    await act(() => vi.advanceTimersByTimeAsync(0));
+    // The old target is gone: the shown time follows the element again.
+    expect(controls.current!.currentTime).toBe(1503);
+    video.currentTime = 1503.5;
+    fireFrameTimeUpdate(video);
+    expect(controls.current!.currentTime).toBe(1503.5);
+    // The 3 s lead is left to a nudge, and the drift loop keeps converging.
+    expect(video.playbackRate).toBe(0.96);
+    expect(playerSeek).not.toHaveBeenCalled();
+    // A second later the room is at 1501; 0.5 s ahead slows by 2 %.
+    video.currentTime = 1501.5;
+    await act(() => vi.advanceTimersByTimeAsync(1_000));
+    expect(video.playbackRate).toBe(0.98);
+  });
+
   it("reports readiness only after the current seek reaches buffered media", async () => {
     const { connection, video, command, rerenderPlayer } = setup(100);
     Object.defineProperty(video, "readyState", { configurable: true, value: 3 });
@@ -927,6 +1184,62 @@ describe("VideoPlayer room catch-up", () => {
     });
   });
 
+  it("pre-rolls a stall seek that joined a reload already loading", async () => {
+    // A progressive remux whose stream starts at 1490 s.
+    const { connection, video, command, rerenderPlayer, onReanchorSeek } = setup(1491, 1490);
+    let paused = true;
+    Object.defineProperty(video, "paused", { configurable: true, get: () => paused });
+    Object.defineProperty(video, "readyState", { configurable: true, value: 3 });
+    vi.mocked(video.play).mockImplementation(async () => {
+      paused = false;
+    });
+    vi.mocked(video.pause).mockImplementation(() => {
+      paused = true;
+    });
+    const seekable = (end: number) =>
+      Object.defineProperty(video, "seekable", {
+        configurable: true,
+        value: { length: 1, start: () => 0, end: () => end },
+      });
+    // A correction to 1500 reopens the stream there, in the same plan.
+    seekable(20);
+    rerenderPlayer({
+      watchTogetherConnection: {
+        ...connection,
+        transportCommand: { ...command, command_id: "correction", position_seconds: 1500 },
+      },
+    });
+    await act(() => vi.advanceTimersByTimeAsync(0));
+    expect(playerSeek).toHaveBeenCalledExactlyOnceWith(10);
+    // The reopened response starts loading, at the keyframe 2.5 s short.
+    fireEvent(video, new Event("loadstart"));
+    seekable(0);
+    video.currentTime = 7.5;
+
+    // The room now waits on this viewer with a seek to the same position.
+    vi.mocked(video.play).mockClear();
+    rerenderPlayer({
+      watchTogetherConnection: {
+        ...connection,
+        room: { ...connection.room!, playback_state: "waiting" as const },
+        transportCommand: {
+          ...command,
+          command_id: "stall-seek",
+          action: "seek" as const,
+          playback_state: "waiting" as const,
+          position_seconds: 1500,
+        },
+      },
+    });
+    await act(() => vi.advanceTimersByTimeAsync(0));
+    // No second reload, and the running one still pre-rolls up to the target.
+    expect(playerSeek).toHaveBeenCalledOnce();
+    expect(onReanchorSeek).not.toHaveBeenCalled();
+    await act(() => vi.advanceTimersByTimeAsync(600));
+    expect(video.play).toHaveBeenCalledOnce();
+    expect(video.playbackRate).toBe(4);
+  });
+
   it.each(["target", "play", "pause"] as const)(
     "ends a guest seek pre-roll on %s",
     async (ending) => {
@@ -1352,23 +1665,23 @@ describe("VideoPlayer room catch-up", () => {
     expect(onReanchorSeek).toHaveBeenLastCalledWith(100);
 
     // A correction while the rebuilt stream is still starting keeps playing.
-    vi.setSystemTime(Date.now() + 2_000);
+    await act(() => vi.advanceTimersByTimeAsync(2_000));
     await correct("correction-2");
     expect(onReanchorSeek).toHaveBeenCalledTimes(1);
 
     // The rebuild plays four seconds after it started.
-    vi.setSystemTime(Date.now() + 2_000);
+    await act(() => vi.advanceTimersByTimeAsync(2_000));
     Object.defineProperty(video, "paused", { configurable: true, value: false });
     Object.defineProperty(video, "readyState", { configurable: true, value: 3 });
     video.currentTime = 100;
     fireEvent.timeUpdate(video);
 
     // The next rebuild waits out the backoff, then aims ahead by that startup.
-    vi.setSystemTime(Date.now() + 5_000);
+    await act(() => vi.advanceTimersByTimeAsync(5_000));
     await correct("correction-3", 120);
     expect(onReanchorSeek).toHaveBeenCalledTimes(1);
 
-    vi.setSystemTime(Date.now() + 5_000);
+    await act(() => vi.advanceTimersByTimeAsync(5_000));
     await correct("correction-4", 125);
     expect(onReanchorSeek).toHaveBeenCalledTimes(2);
     expect(onReanchorSeek).toHaveBeenLastCalledWith(129);
@@ -1395,7 +1708,7 @@ describe("VideoPlayer room catch-up", () => {
 
     // The first load is still running; chasing the room again would only
     // restart it.
-    vi.setSystemTime(Date.now() + 2_000);
+    await act(() => vi.advanceTimersByTimeAsync(2_000));
     await correct("correction-2", 110);
     expect(playerSeek).toHaveBeenCalledTimes(1);
 
@@ -1431,7 +1744,7 @@ describe("VideoPlayer room catch-up", () => {
     expect(onReanchorSeek).toHaveBeenCalledTimes(1);
 
     // Another stream loads and plays at the target, but it is not the reload.
-    vi.setSystemTime(Date.now() + 4_000);
+    await act(() => vi.advanceTimersByTimeAsync(4_000));
     Object.defineProperty(video, "paused", { configurable: true, value: false });
     Object.defineProperty(video, "readyState", { configurable: true, value: 3 });
     fireEvent.loadStart(video);
@@ -1440,7 +1753,7 @@ describe("VideoPlayer room catch-up", () => {
     fireEvent.timeUpdate(video);
 
     // Had it settled, the backoff would have allowed another reload by now.
-    vi.setSystemTime(Date.now() + 11_000);
+    await act(() => vi.advanceTimersByTimeAsync(11_000));
     await correct("correction-2", 115);
     expect(onReanchorSeek).toHaveBeenCalledTimes(1);
   });
@@ -1467,20 +1780,20 @@ describe("VideoPlayer room catch-up", () => {
     };
     await correct("correction-1", 100);
     // The first reload goes stale, and a new one aims at the same position.
-    vi.setSystemTime(Date.now() + 31_000);
+    await act(() => vi.advanceTimersByTimeAsync(31_000));
     await correct("correction-2", 100);
     expect(onReanchorSeek).toHaveBeenCalledTimes(2);
 
     // The first reload's replan completes late; it must not count as the second's load.
     await act(async () => resolvers[0]!(true));
-    vi.setSystemTime(Date.now() + 2_000);
+    await act(() => vi.advanceTimersByTimeAsync(2_000));
     Object.defineProperty(video, "paused", { configurable: true, value: false });
     Object.defineProperty(video, "readyState", { configurable: true, value: 3 });
     video.currentTime = 100;
     fireEvent.timeUpdate(video);
 
     // Had the second reload landed, its 20 s backoff would have ended.
-    vi.setSystemTime(Date.now() + 21_000);
+    await act(() => vi.advanceTimersByTimeAsync(21_000));
     await correct("correction-3", 150);
     expect(onReanchorSeek).toHaveBeenCalledTimes(2);
   });
@@ -1504,7 +1817,7 @@ describe("VideoPlayer room catch-up", () => {
       await act(() => vi.advanceTimersByTimeAsync(0));
     };
     await correct("correction-1");
-    vi.setSystemTime(Date.now() + 2_000);
+    await act(() => vi.advanceTimersByTimeAsync(2_000));
     await correct("correction-2");
     expect(onReanchorSeek).toHaveBeenCalledTimes(1);
 
@@ -1773,9 +2086,12 @@ describe("VideoPlayer room catch-up", () => {
       await act(() => vi.advanceTimersByTimeAsync(1_500));
       expect(messages).not.toHaveBeenCalledWith(expect.objectContaining({ is_ready: true }));
       expect(messages).not.toHaveBeenCalledWith(expect.objectContaining({ type: "ready" }));
+      // A routine report names the command it reflects, so the server can
+      // take it without waiting out that command's settle window.
       expect(messages).toHaveBeenCalledWith({
         type: "state_report",
         session_id: "session-1",
+        command_id: command.command_id,
         position_seconds: 100,
         is_paused: true,
       });
@@ -1840,7 +2156,8 @@ describe("VideoPlayer room catch-up", () => {
   });
 
   it("acknowledges a buffering pause at the actual media position and retries a failed send", async () => {
-    const { connection, video, command, rerenderPlayer, onReanchorSeek } = setup(80);
+    // Within the hard-seek bound a pause does not rebuild the stream.
+    const { connection, video, command, rerenderPlayer, onReanchorSeek } = setup(96);
     Object.defineProperty(video, "readyState", { configurable: true, value: 3 });
     vi.mocked(connection.sendRoomMessage).mockReturnValueOnce({ ok: false });
     rerenderPlayer({
@@ -1861,7 +2178,7 @@ describe("VideoPlayer room catch-up", () => {
       type: "ready",
       session_id: "session-1",
       command_id: command.command_id,
-      position_seconds: 80,
+      position_seconds: 96,
       is_paused: true,
     });
   });
@@ -1895,6 +2212,7 @@ describe("VideoPlayer room catch-up", () => {
         100.5,
         timelineOffset,
       );
+      markPlaying(video);
       command.execute_at = new Date(Date.now() - 1_000).toISOString();
       rerenderPlayer({ watchTogetherConnection: { ...connection, transportCommand: command } });
       await act(() => vi.advanceTimersByTimeAsync(0));
@@ -1904,23 +2222,45 @@ describe("VideoPlayer room catch-up", () => {
       expect(onReanchorSeek).not.toHaveBeenCalled();
       expect(playerSeek).not.toHaveBeenCalled();
 
-      vi.setSystemTime(Date.now() + 3_000);
-      video.currentTime = 103.8 - timelineOffset;
-      fireEvent.timeUpdate(video);
+      // The room is at 103 two seconds later; still behind it, the nudge continues.
+      video.currentTime = 102.5 - timelineOffset;
+      await act(() => vi.advanceTimersByTimeAsync(2_000));
+      expect(video.playbackRate).toBeGreaterThan(1);
+      // Within the settle bound of the room (103.5 now) it ends.
+      video.currentTime = 103.45 - timelineOffset;
+      await act(() => vi.advanceTimersByTimeAsync(500));
       expect(video.playbackRate).toBe(1);
     },
   );
 
-  it("reanchors to the advancing play position when delayed beyond the catch-up band", async () => {
-    const { connection, command, rerenderPlayer, onReanchorSeek } = setup(99);
-    command.execute_at = new Date(Date.now() - 4_000).toISOString();
-    rerenderPlayer({ watchTogetherConnection: { ...connection, transportCommand: command } });
-    await act(() => vi.advanceTimersByTimeAsync(0));
+  it.each([true, false])(
+    "reanchors to the advancing play position beyond the hard-seek bound (playing: %s)",
+    async (playing) => {
+      const { connection, video, command, rerenderPlayer, onReanchorSeek } = setup(99);
+      if (playing) markPlaying(video);
+      command.execute_at = new Date(Date.now() - 6_000).toISOString();
+      rerenderPlayer({ watchTogetherConnection: { ...connection, transportCommand: command } });
+      await act(() => vi.advanceTimersByTimeAsync(0));
 
-    expect(onReanchorSeek).toHaveBeenCalledWith(104);
-  });
+      expect(onReanchorSeek).toHaveBeenCalledWith(106);
+      expect(video.playbackRate).toBe(1);
+    },
+  );
+
+  it.each([4, 1.5])(
+    "joins a stopped viewer %ss off an unseekable target at 1x without a rebuild",
+    async (drift) => {
+      const { connection, video, command, rerenderPlayer, onReanchorSeek } = setup(100 - drift);
+      rerenderPlayer({ watchTogetherConnection: { ...connection, transportCommand: command } });
+      await act(() => vi.advanceTimersByTimeAsync(0));
+
+      expect(onReanchorSeek).not.toHaveBeenCalled();
+      expect(video.play).toHaveBeenCalledOnce();
+      expect(video.playbackRate).toBe(1);
+    },
+  );
 
-  it.each([2000, 5000])(
+  it.each([2000, 7000])(
     "recalculates catch-up after autoplay is blocked for %sms",
     async (delayMs) => {
       const { connection, video, command, rerenderPlayer, onReanchorSeek } = setup(101);
@@ -1934,12 +2274,12 @@ describe("VideoPlayer room catch-up", () => {
       vi.setSystemTime(Date.now() + delayMs);
       await act(async () => fireEvent.click(screen.getByRole("button", { name: "Join playback" })));
 
+      // The viewer starts at 1x either way; residual drift is the drift loop's.
+      expect(video.playbackRate).toBe(1);
       if (delayMs === 2000) {
-        expect(video.playbackRate).toBeGreaterThan(1);
         expect(onReanchorSeek).not.toHaveBeenCalled();
       } else {
-        expect(onReanchorSeek).toHaveBeenCalledWith(105);
-        expect(video.playbackRate).toBe(1);
+        expect(onReanchorSeek).toHaveBeenCalledWith(107);
       }
     },
   );
@@ -2023,7 +2363,7 @@ describe("VideoPlayer room catch-up", () => {
   it.each(["play", "pause", "seek"] as const)(
     "keeps a seekable late %s command in the current stream",
     async (action) => {
-      const { connection, video, command, rerenderPlayer, onReanchorSeek } = setup(99, 80);
+      const { connection, video, command, rerenderPlayer, onReanchorSeek } = setup(98.5, 80);
       Object.defineProperty(video, "seekable", {
         configurable: true,
         value: { length: 1, start: () => 0, end: () => 30 },
@@ -2034,12 +2374,15 @@ describe("VideoPlayer room catch-up", () => {
           transportCommand: {
             ...command,
             action,
+            playback_state:
+              action === "play" ? "playing" : action === "pause" ? "paused" : "waiting",
             execute_at: new Date(Date.now() - 1_000).toISOString(),
           },
         },
       });
       await act(() => vi.advanceTimersByTimeAsync(0));
 
+      // Only a playing room advances past the command's position.
       expect(playerSeek).toHaveBeenCalledWith(action === "play" ? 21 : 20);
       expect(onReanchorSeek).not.toHaveBeenCalled();
       expect(video.playbackRate).toBe(1);
@@ -2048,6 +2391,7 @@ describe("VideoPlayer room catch-up", () => {
 
   it("resets an active catch-up when the connection ends", async () => {
     const { connection, video, command, rerenderPlayer } = setup(99);
+    markPlaying(video);
     const commandedConnection = { ...connection, transportCommand: command };
     rerenderPlayer({ watchTogetherConnection: commandedConnection });
     await act(() => vi.advanceTimersByTimeAsync(0));
@@ -2142,6 +2486,7 @@ describe("VideoPlayer room catch-up", () => {
 
   it("ends catch-up when playback pauses outside a room transport command", async () => {
     const { connection, video, command, rerenderPlayer } = setup(101);
+    markPlaying(video);
     rerenderPlayer({ watchTogetherConnection: { ...connection, transportCommand: command } });
     await act(() => vi.advanceTimersByTimeAsync(0));
     expect(video.playbackRate).toBeLessThan(1);
@@ -2149,55 +2494,649 @@ describe("VideoPlayer room catch-up", () => {
     fireEvent.pause(video);
     expect(video.playbackRate).toBe(1);
   });
-});
 
-describe("VideoPlayer plan failure recovery", () => {
-  beforeEach(() => {
-    realtimeOptions.current = null;
-    controls.current = null;
-    subtitleTimeline.textOffsetSeconds = null;
-    subtitleTimeline.assOffsetSeconds = null;
-    hlsJS.supported = false;
-    hlsJS.constructed.mockClear();
-    toastError.mockClear();
-    playerSeek.mockClear();
-    vi.spyOn(HTMLMediaElement.prototype, "play").mockResolvedValue(undefined);
-    vi.spyOn(HTMLMediaElement.prototype, "pause").mockImplementation(() => {});
-    vi.spyOn(HTMLMediaElement.prototype, "load").mockImplementation(() => {});
+  it("nudges a playing viewer toward a buffered target instead of seeking", async () => {
+    const { connection, video, command, rerenderPlayer, onReanchorSeek } = setup(98, 80);
+    markPlaying(video);
+    Object.defineProperty(video, "seekable", {
+      configurable: true,
+      value: { length: 1, start: () => 0, end: () => 30 },
+    });
+    Object.defineProperty(video, "buffered", {
+      configurable: true,
+      value: { length: 1, start: () => 0, end: () => 30 },
+    });
+    rerenderPlayer({ watchTogetherConnection: { ...connection, transportCommand: command } });
+    await act(() => vi.advanceTimersByTimeAsync(0));
+
+    expect(video.playbackRate).toBe(1.04);
+    expect(playerSeek).not.toHaveBeenCalled();
+    expect(onReanchorSeek).not.toHaveBeenCalled();
   });
 
-  afterEach(() => {
-    cleanup();
-    vi.restoreAllMocks();
+  it("corrects drift that builds after a command by rate alone", async () => {
+    const { connection, video, command, rerenderPlayer, onReanchorSeek } = setup(100);
+    markPlaying(video);
+    rerenderPlayer({ watchTogetherConnection: { ...connection, transportCommand: command } });
+    await act(() => vi.advanceTimersByTimeAsync(0));
+    expect(video.playbackRate).toBe(1);
+
+    // The element stalls in place while the room advances. Right after the
+    // command the loop leaves playback alone.
+    await act(() => vi.advanceTimersByTimeAsync(500));
+    expect(video.playbackRate).toBe(1);
+    await act(() => vi.advanceTimersByTimeAsync(500));
+    expect(video.playbackRate).toBe(1.04);
+
+    // Far beyond the hard-seek bound the loop still only nudges; seeking is
+    // left to the server's correction command.
+    await act(() => vi.advanceTimersByTimeAsync(10_000));
+    expect(video.playbackRate).toBe(1.04);
+    expect(playerSeek).not.toHaveBeenCalled();
+    expect(onReanchorSeek).not.toHaveBeenCalled();
   });
 
-  it("uses profile intervals for controls and detached transport, and updates without restarting", async () => {
-    const ready = vi.fn();
-    const { container, rerenderPlayer } = renderPlayer({
-      shouldAutoPlay: false,
-      plan: { ...directPlan, source: { ...directPlan.source, duration_seconds: 1000 } },
-      seekIntervals: { back: 15, forward: 60 },
-      onPlaybackTransportReady: ready,
-    });
-    const video = container.querySelector("video")!;
-    // The element reaching a seek target settles it, as a real timeupdate would.
-    const settleAt = (seconds: number) => {
-      Object.defineProperty(video, "currentTime", { configurable: true, value: seconds });
-      fireEvent.timeUpdate(video);
-    };
-    Object.defineProperty(video, "readyState", { configurable: true, value: 3 });
-    settleAt(100);
-    fireEvent.canPlay(video);
-    await waitFor(() => expect(controls.current?.skipSeconds?.forward).toBe(60));
-    act(() => controls.current?.onSkip?.back());
-    expect(playerSeek).toHaveBeenLastCalledWith(85);
-    settleAt(85);
-    act(() => ready.mock.lastCall![0].skipForward());
-    expect(playerSeek).toHaveBeenLastCalledWith(145);
-    settleAt(145);
-    const callsBeforeTick = ready.mock.calls.length;
-    fireEvent.timeUpdate(video);
-    expect(ready.mock.calls.length).toBe(callsBeforeTick);
+  it("leaves a viewer within the deadband at 1x", async () => {
+    const { connection, video, command, rerenderPlayer } = setup(100);
+    markPlaying(video);
+    rerenderPlayer({ watchTogetherConnection: { ...connection, transportCommand: command } });
+    await act(() => vi.advanceTimersByTimeAsync(0));
+    video.currentTime = 100.65;
+    // The first loop check sees the room at 101: 0.35 s behind it is not worth a nudge.
+    await act(() => vi.advanceTimersByTimeAsync(1_000));
+    expect(video.playbackRate).toBe(1);
+  });
+
+  it.each(["stalls", "seeks", "the room pauses"])(
+    "returns a loop nudge to 1x without resuming when playback %s",
+    async (change) => {
+      const { connection, video, command, rerenderPlayer } = setup(100);
+      markPlaying(video);
+      const commandedConnection = { ...connection, transportCommand: command };
+      rerenderPlayer({ watchTogetherConnection: commandedConnection });
+      await act(() => vi.advanceTimersByTimeAsync(1_000));
+      expect(video.playbackRate).toBe(1.04);
+      const plays = vi.mocked(video.play).mock.calls.length;
+
+      if (change === "stalls") {
+        Object.defineProperty(video, "readyState", {
+          configurable: true,
+          value: HTMLMediaElement.HAVE_CURRENT_DATA,
+        });
+      } else if (change === "seeks") {
+        Object.defineProperty(video, "seeking", { configurable: true, value: true });
+      } else {
+        rerenderPlayer({
+          watchTogetherConnection: {
+            ...commandedConnection,
+            room: { ...commandedConnection.room!, playback_state: "paused", is_paused: true },
+          },
+        });
+      }
+      await act(() => vi.advanceTimersByTimeAsync(500));
+      expect(video.playbackRate).toBe(1);
+      expect(video.play).toHaveBeenCalledTimes(plays);
+    },
+  );
+
+  it.each([3600, 3599.8])(
+    "leaves an ended element ended when the room plays at %s",
+    async (position) => {
+      const { connection, video, command, rerenderPlayer, onReanchorSeek } = setup(3600);
+      Object.defineProperty(video, "duration", { configurable: true, value: 3600 });
+      Object.defineProperty(video, "ended", { configurable: true, value: true });
+      rerenderPlayer({
+        watchTogetherConnection: {
+          ...connection,
+          transportCommand: { ...command, position_seconds: position },
+        },
+      });
+      await act(() => vi.advanceTimersByTimeAsync(2_000));
+      // play() would start the media over from the beginning.
+      expect(video.play).not.toHaveBeenCalled();
+      expect(playerSeek).not.toHaveBeenCalled();
+      expect(onReanchorSeek).not.toHaveBeenCalled();
+    },
+  );
+
+  it("seeks an ended element to a room still short of the end before playing", async () => {
+    const { connection, video, command, rerenderPlayer, onReanchorSeek } = setup(3600);
+    Object.defineProperty(video, "duration", { configurable: true, value: 3600 });
+    Object.defineProperty(video, "ended", { configurable: true, value: true });
+    rerenderPlayer({
+      watchTogetherConnection: {
+        ...connection,
+        transportCommand: { ...command, position_seconds: 3599.5 },
+      },
+    });
+    await act(() => vi.advanceTimersByTimeAsync(0));
+    expect(onReanchorSeek).toHaveBeenCalledExactlyOnceWith(3599.5);
+    expect(video.play).toHaveBeenCalledOnce();
+  });
+
+  it("seeks an element whose stream window ended before the movie to the room", async () => {
+    const { connection, video, command, rerenderPlayer, onReanchorSeek } = setup(1800);
+    Object.defineProperty(video, "duration", { configurable: true, value: 1800 });
+    Object.defineProperty(video, "ended", { configurable: true, value: true });
+    rerenderPlayer({
+      duration: 7200,
+      watchTogetherConnection: {
+        ...connection,
+        transportCommand: { ...command, position_seconds: 2000 },
+      },
+    });
+    await act(() => vi.advanceTimersByTimeAsync(0));
+    // The window ended, not the movie: the room is still playing it.
+    expect(onReanchorSeek).toHaveBeenCalledExactlyOnceWith(2000);
+    expect(video.play).toHaveBeenCalledOnce();
+  });
+
+  it("leaves an element that ended during playback to the room", async () => {
+    const { connection, video, command, rerenderPlayer, onReanchorSeek } = setup(100);
+    markPlaying(video);
+    rerenderPlayer({ watchTogetherConnection: { ...connection, transportCommand: command } });
+    await act(() => vi.advanceTimersByTimeAsync(0));
+    Object.defineProperty(video, "ended", { configurable: true, value: true });
+    await act(() => vi.advanceTimersByTimeAsync(3_000));
+    expect(video.playbackRate).toBe(1);
+    expect(playerSeek).not.toHaveBeenCalled();
+    expect(onReanchorSeek).not.toHaveBeenCalled();
+  });
+
+  it("keeps correcting drift through a wall-clock jump", async () => {
+    const { connection, video, command, rerenderPlayer } = setup(100);
+    markPlaying(video);
+    const commanded = { ...connection, transportCommand: command };
+    rerenderPlayer({ watchTogetherConnection: commanded });
+    await act(() => vi.advanceTimersByTimeAsync(0));
+    // The local clock steps back a minute; the re-estimated server offset
+    // follows it, so the room position itself is unchanged.
+    vi.setSystemTime(Date.now() - 60_000);
+    rerenderPlayer({ watchTogetherConnection: { ...commanded, serverTimeOffsetMs: 60_000 } });
+    await act(() => vi.advanceTimersByTimeAsync(1_000));
+    expect(video.playbackRate).toBe(1.04);
+  });
+
+  it("names a command in routine reports only once its seek has landed", async () => {
+    const { connection, video, command, rerenderPlayer } = setup(90);
+    markPlaying(video);
+    Object.defineProperty(video, "seekable", {
+      configurable: true,
+      value: { length: 1, start: () => 0, end: () => 200 },
+    });
+    const reports = () =>
+      vi
+        .mocked(connection.sendRoomMessage)
+        .mock.calls.map(([message]) => message)
+        .filter((message) => message.type === "state_report");
+    rerenderPlayer({ watchTogetherConnection: { ...connection, transportCommand: command } });
+    await act(() => vi.advanceTimersByTimeAsync(0));
+    expect(playerSeek).toHaveBeenCalledExactlyOnceWith(100);
+    // The correction's media is still loading; the old stream plays on.
+    await act(() => vi.advanceTimersByTimeAsync(1_500));
+    expect(reports().at(-1)).toMatchObject({ position_seconds: 90 });
+    expect(reports().at(-1)).not.toHaveProperty("command_id");
+    video.currentTime = 100;
+    fireFrameTimeUpdate(video);
+    await act(() => vi.advanceTimersByTimeAsync(1_500));
+    expect(reports().at(-1)).toMatchObject({ command_id: command.command_id });
+  });
+
+  it("names the last applied command in routine state reports", async () => {
+    const { connection, video, command, rerenderPlayer } = setup(100);
+    markPlaying(video);
+    const reports = () =>
+      vi
+        .mocked(connection.sendRoomMessage)
+        .mock.calls.map(([message]) => message)
+        .filter((message) => message.type === "state_report");
+    await act(() => vi.advanceTimersByTimeAsync(1_500));
+    expect(reports().at(-1)).not.toHaveProperty("command_id");
+
+    rerenderPlayer({ watchTogetherConnection: { ...connection, transportCommand: command } });
+    await act(() => vi.advanceTimersByTimeAsync(1_500));
+    expect(reports().at(-1)).toMatchObject({ command_id: command.command_id });
+  });
+
+  it("keeps the rate until a received command executes", async () => {
+    const { connection, video, command, rerenderPlayer } = setup(98);
+    markPlaying(video);
+    const commandedConnection = { ...connection, transportCommand: command };
+    rerenderPlayer({ watchTogetherConnection: commandedConnection });
+    await act(() => vi.advanceTimersByTimeAsync(0));
+    expect(video.playbackRate).toBe(1.04);
+
+    // Like the server, the snapshot announcing the pause arrives with it.
+    rerenderPlayer({
+      watchTogetherConnection: {
+        ...commandedConnection,
+        room: { ...commandedConnection.room!, playback_state: "paused", is_paused: true },
+        transportCommand: {
+          ...command,
+          command_id: "room-command-2",
+          action: "pause",
+          playback_state: "paused",
+          position_seconds: 103,
+          execute_at: new Date(Date.now() + 2_000).toISOString(),
+        },
+      },
+    });
+    await act(() => vi.advanceTimersByTimeAsync(1_999));
+    expect(video.playbackRate).toBe(1.04);
+    expect(video.pause).not.toHaveBeenCalled();
+    await act(() => vi.advanceTimersByTimeAsync(1));
+    expect(video.pause).toHaveBeenCalledOnce();
+    expect(video.playbackRate).toBe(1);
+  });
+});
+
+describe("VideoPlayer room correction reloads", () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+    vi.setSystemTime(new Date("2026-09-01T12:00:00Z"));
+    playerSeek.mockClear();
+    vi.spyOn(HTMLMediaElement.prototype, "play").mockResolvedValue(undefined);
+    vi.spyOn(HTMLMediaElement.prototype, "pause").mockImplementation(() => {});
+    vi.spyOn(HTMLMediaElement.prototype, "load").mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    cleanup();
+    vi.restoreAllMocks();
+    vi.useRealTimers();
+  });
+
+  const ranges = (start: number, end: number) => ({
+    length: 1,
+    start: () => start,
+    end: () => end,
+  });
+
+  function setup(localPosition: number) {
+    const connection = roomConnection();
+    const onReanchorSeek = vi.fn(() => true);
+    const rendered = renderPlayer({
+      plan: fixturePlanV3({
+        ...directPlan,
+        delivery: "server_remux_progressive",
+        timeline: { ...directPlan.timeline, timeline_offset_seconds: 0, can_seek_anywhere: false },
+      }),
+      shouldAutoPlay: false,
+      watchTogetherRoomId: "room-1",
+      watchTogetherConnection: connection,
+      onReanchorSeek,
+    });
+    const video = rendered.container.querySelector("video")!;
+    video.currentTime = localPosition;
+    fireFrameTimeUpdate(video);
+    const command = (id: string, overrides: Record<string, unknown> = {}) => ({
+      command_id: id,
+      session_id: "session-1",
+      selection_revision: 1,
+      action: "play" as const,
+      position_seconds: 100,
+      execute_at: new Date().toISOString(),
+      issued_at: new Date().toISOString(),
+      playback_state: "playing" as const,
+      ...overrides,
+    });
+    return { ...rendered, connection, video, command, onReanchorSeek };
+  }
+
+  /** Starts a correction reload to 100 in the current stream that never lands. */
+  async function startUnlandedReload() {
+    const rendered = setup(90);
+    const { connection, video, command, rerenderPlayer } = rendered;
+    markPlaying(video);
+    Object.defineProperty(video, "seekable", { configurable: true, value: ranges(0, 200) });
+    Object.defineProperty(video, "buffered", { configurable: true, value: ranges(85, 95) });
+    rerenderPlayer({ watchTogetherConnection: { ...connection, transportCommand: command("c1") } });
+    await act(() => vi.advanceTimersByTimeAsync(0));
+    expect(playerSeek).toHaveBeenCalledExactlyOnceWith(100);
+    // The seek settles short of the reload's landing window.
+    video.currentTime = 99.2;
+    fireFrameTimeUpdate(video);
+    expect(video.playbackRate).toBe(1);
+    return rendered;
+  }
+
+  it("waits for a reload, then resumes drift correction once it goes stale", async () => {
+    const { video } = await startUnlandedReload();
+    await act(() => vi.advanceTimersByTimeAsync(29_500));
+    // The room has moved on, but the loop waits for the reload to land.
+    expect(video.playbackRate).toBe(1);
+    await act(() => vi.advanceTimersByTimeAsync(1_000));
+    expect(video.playbackRate).toBe(1.04);
+    expect(playerSeek).toHaveBeenCalledOnce();
+  });
+
+  it("starts a replacement reload right after a stale one expires", async () => {
+    const { connection, command, rerenderPlayer } = await startUnlandedReload();
+    // The loop expires the reload once it is stale.
+    await act(() => vi.advanceTimersByTimeAsync(30_500));
+    rerenderPlayer({
+      watchTogetherConnection: {
+        ...connection,
+        transportCommand: command("c2", { position_seconds: 140 }),
+      },
+    });
+    await act(() => vi.advanceTimersByTimeAsync(0));
+    // No backoff holds the viewer behind: the correction loads at once.
+    expect(playerSeek).toHaveBeenCalledTimes(2);
+    expect(playerSeek).toHaveBeenLastCalledWith(140);
+  });
+
+  it("drops a reload that a room pause replaces", async () => {
+    const { connection, video, command, rerenderPlayer } = await startUnlandedReload();
+    const paused = { ...connection.room!, playback_state: "paused" as const, is_paused: true };
+    rerenderPlayer({
+      watchTogetherConnection: {
+        ...connection,
+        room: paused,
+        transportCommand: command("c2", {
+          action: "pause",
+          playback_state: "paused",
+          position_seconds: 99.5,
+        }),
+      },
+    });
+    await act(() => vi.advanceTimersByTimeAsync(1_000));
+    rerenderPlayer({
+      watchTogetherConnection: {
+        ...connection,
+        transportCommand: command("c3", { position_seconds: 99.2 }),
+      },
+    });
+    await act(() => vi.advanceTimersByTimeAsync(0));
+    expect(video.playbackRate).toBe(1);
+    // The room plays on from 99.2 while this element stays put. With the old
+    // reload forgotten, the loop corrects it after its usual settle.
+    await act(() => vi.advanceTimersByTimeAsync(1_000));
+    expect(video.playbackRate).toBe(1.04);
+  });
+
+  it("does not rebuild again for a pause that lands on a rebuild still loading", async () => {
+    const { connection, command, rerenderPlayer, onReanchorSeek } = setup(90);
+    rerenderPlayer({ watchTogetherConnection: { ...connection, transportCommand: command("c1") } });
+    await act(() => vi.advanceTimersByTimeAsync(0));
+    expect(onReanchorSeek).toHaveBeenCalledExactlyOnceWith(100);
+
+    const paused = { ...connection.room!, playback_state: "paused" as const, is_paused: true };
+    rerenderPlayer({
+      watchTogetherConnection: {
+        ...connection,
+        room: paused,
+        transportCommand: command("c2", {
+          action: "pause",
+          playback_state: "paused",
+          position_seconds: 100.5,
+        }),
+      },
+    });
+    await act(() => vi.advanceTimersByTimeAsync(0));
+    expect(onReanchorSeek).toHaveBeenCalledOnce();
+
+    // A pause somewhere else still moves there.
+    rerenderPlayer({
+      watchTogetherConnection: {
+        ...connection,
+        room: paused,
+        transportCommand: command("c3", {
+          action: "pause",
+          playback_state: "paused",
+          position_seconds: 300,
+        }),
+      },
+    });
+    await act(() => vi.advanceTimersByTimeAsync(0));
+    expect(onReanchorSeek).toHaveBeenLastCalledWith(300);
+  });
+});
+
+describe("VideoPlayer room sync without pitch-kept rate changes", () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+    vi.setSystemTime(new Date("2026-09-01T12:00:00Z"));
+    playerSeek.mockClear();
+    attachBrowserEngine.mockClear();
+    vi.spyOn(HTMLMediaElement.prototype, "play").mockResolvedValue(undefined);
+    vi.spyOn(HTMLMediaElement.prototype, "pause").mockImplementation(() => {});
+    vi.spyOn(HTMLMediaElement.prototype, "load").mockImplementation(() => {});
+    engineRoute.chosen = true;
+  });
+
+  afterEach(() => {
+    engineRoute.chosen = false;
+    cleanup();
+    vi.restoreAllMocks();
+    vi.useRealTimers();
+  });
+
+  async function setup(localPosition: number) {
+    const connection = roomConnection();
+    const rendered = renderPlayer({
+      shouldAutoPlay: false,
+      watchTogetherRoomId: "room-1",
+      watchTogetherConnection: connection,
+      browserEngine: {
+        containers: ["mkv"],
+        videoCodecs: ["h264"],
+        audioCodecs: ["aac"],
+        hdr: false,
+      },
+    });
+    await act(() => vi.advanceTimersByTimeAsync(0));
+    expect(attachBrowserEngine).toHaveBeenCalled();
+    const video = rendered.container.querySelector("video")!;
+    markPlaying(video);
+    Object.defineProperty(video, "seekable", {
+      configurable: true,
+      value: { length: 1, start: () => 0, end: () => 3_000 },
+    });
+    video.currentTime = localPosition;
+    const command = {
+      command_id: "room-command-1",
+      session_id: "session-1",
+      selection_revision: 1,
+      action: "play" as const,
+      position_seconds: 100,
+      execute_at: new Date().toISOString(),
+      issued_at: new Date().toISOString(),
+      playback_state: "playing" as const,
+    };
+    return { ...rendered, connection, video, command };
+  }
+
+  it("seeks a play correction in place instead of nudging", async () => {
+    const { connection, video, command, rerenderPlayer } = await setup(98);
+    // Reachable in place but not buffered: still a direct seek.
+    Object.defineProperty(video, "buffered", {
+      configurable: true,
+      value: { length: 1, start: () => 90, end: () => 99 },
+    });
+    rerenderPlayer({ watchTogetherConnection: { ...connection, transportCommand: command } });
+    await act(() => vi.advanceTimersByTimeAsync(0));
+    expect(playerSeek).toHaveBeenCalledExactlyOnceWith(100);
+    expect(video.playbackRate).toBe(1);
+
+    // Another correction right away is not held back by reload pacing.
+    video.currentTime = 98;
+    fireFrameTimeUpdate(video);
+    rerenderPlayer({
+      watchTogetherConnection: {
+        ...connection,
+        transportCommand: { ...command, command_id: "room-command-2", position_seconds: 103 },
+      },
+    });
+    await act(() => vi.advanceTimersByTimeAsync(0));
+    expect(playerSeek).toHaveBeenLastCalledWith(103);
+  });
+
+  it("leaves drift up to a second alone, then seeks from the loop", async () => {
+    const { connection, video, command, rerenderPlayer } = await setup(99.2);
+    rerenderPlayer({ watchTogetherConnection: { ...connection, transportCommand: command } });
+    await act(() => vi.advanceTimersByTimeAsync(0));
+    expect(playerSeek).not.toHaveBeenCalled();
+
+    // One second later the room is at 101 and the element has not moved.
+    await act(() => vi.advanceTimersByTimeAsync(1_000));
+    expect(playerSeek).toHaveBeenCalledExactlyOnceWith(101);
+    expect(video.playbackRate).toBe(1);
+  });
+
+  it("aims ahead of a slow seek instead of chasing the room", async () => {
+    const { connection, video, command, rerenderPlayer } = await setup(97);
+    // The engine's clock stands still for the two seconds a seek takes, then
+    // lands where it was aimed; otherwise it plays at 1x.
+    const seekMs = 2_000;
+    let seek: { target: number; remainingMs: number } | null = null;
+    const setSeeking = (value: boolean) =>
+      Object.defineProperty(video, "seeking", { configurable: true, value });
+    playerSeek.mockImplementation((nativeSeconds: number) => {
+      seek = { target: nativeSeconds, remainingMs: seekMs };
+      setSeeking(true);
+    });
+    const play = async (totalMs: number) => {
+      for (let elapsed = 0; elapsed < totalMs; elapsed += 100) {
+        await act(() => vi.advanceTimersByTimeAsync(100));
+        const running = seek as { target: number; remainingMs: number } | null;
+        if (running === null) {
+          video.currentTime += 0.1;
+          continue;
+        }
+        running.remainingMs -= 100;
+        if (running.remainingMs > 0) continue;
+        seek = null;
+        video.currentTime = running.target;
+        setSeeking(false);
+        fireEvent.seeked(video);
+        fireFrameTimeUpdate(video);
+      }
+    };
+
+    rerenderPlayer({ watchTogetherConnection: { ...connection, transportCommand: command } });
+    await act(() => vi.advanceTimersByTimeAsync(0));
+    expect(playerSeek).toHaveBeenCalledExactlyOnceWith(100);
+    await play(20_000);
+
+    // The first seek lands two seconds short; the next aims that far ahead
+    // and lands with the room. Aimed at the room alone, every seek would land
+    // short and the loop would seek again every few seconds.
+    expect(playerSeek).toHaveBeenCalledTimes(2);
+    const roomPosition = 100 + 20;
+    expect(Math.abs(roomPosition - video.currentTime)).toBeLessThan(1);
+  });
+});
+
+describe("VideoPlayer playback speed", () => {
+  beforeEach(() => {
+    playerSeek.mockClear();
+    vi.spyOn(HTMLMediaElement.prototype, "play").mockResolvedValue(undefined);
+    vi.spyOn(HTMLMediaElement.prototype, "pause").mockImplementation(() => {});
+    vi.spyOn(HTMLMediaElement.prototype, "load").mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    cleanup();
+    vi.restoreAllMocks();
+  });
+
+  it("keeps the chosen speed through a pause and a seek", () => {
+    const { container } = renderPlayer({ shouldAutoPlay: false });
+    const video = container.querySelector("video")!;
+
+    act(() => controls.current!.onPlaybackSpeedChange!(1.5));
+    expect(controls.current!.playbackSpeed).toBe(1.5);
+    expect(video.playbackRate).toBe(1.5);
+    // A media reload resets playbackRate to defaultPlaybackRate.
+    expect(video.defaultPlaybackRate).toBe(1.5);
+
+    fireEvent.pause(video);
+    expect(video.playbackRate).toBe(1.5);
+
+    act(() => controls.current!.onSeek(50));
+    expect(video.playbackRate).toBe(1.5);
+  });
+
+  it("leaves the rate to the room in a Watch Party", () => {
+    const { container } = renderPlayer({
+      shouldAutoPlay: false,
+      watchTogetherRoomId: "room-1",
+      watchTogetherConnection: roomConnection(),
+    });
+    const video = container.querySelector("video")!;
+
+    expect(controls.current!.onPlaybackSpeedChange).toBeUndefined();
+    expect(video.playbackRate).toBe(1);
+    expect(video.defaultPlaybackRate).toBe(1);
+  });
+
+  it("restores the viewer's speed after leaving a Watch Party", () => {
+    const { container, rerenderPlayer } = renderPlayer({ shouldAutoPlay: false });
+    const video = container.querySelector("video")!;
+    act(() => controls.current!.onPlaybackSpeedChange!(1.5));
+
+    const connection = roomConnection();
+    rerenderPlayer({ watchTogetherRoomId: "room-1", watchTogetherConnection: connection });
+    expect(controls.current!.onPlaybackSpeedChange).toBeUndefined();
+    expect(video.playbackRate).toBe(1);
+
+    rerenderPlayer({
+      watchTogetherRoomId: "room-1",
+      watchTogetherConnection: { ...connection, closedReason: "ended" },
+    });
+    expect(controls.current!.onPlaybackSpeedChange).toBeDefined();
+    expect(video.playbackRate).toBe(1.5);
+  });
+});
+
+describe("VideoPlayer plan failure recovery", () => {
+  beforeEach(() => {
+    realtimeOptions.current = null;
+    controls.current = null;
+    subtitleTimeline.textOffsetSeconds = null;
+    subtitleTimeline.assOffsetSeconds = null;
+    hlsJS.supported = false;
+    hlsJS.constructed.mockClear();
+    toastError.mockClear();
+    playerSeek.mockClear();
+    vi.spyOn(HTMLMediaElement.prototype, "play").mockResolvedValue(undefined);
+    vi.spyOn(HTMLMediaElement.prototype, "pause").mockImplementation(() => {});
+    vi.spyOn(HTMLMediaElement.prototype, "load").mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    cleanup();
+    vi.restoreAllMocks();
+  });
+
+  it("uses profile intervals for controls and detached transport, and updates without restarting", async () => {
+    const ready = vi.fn();
+    const { container, rerenderPlayer } = renderPlayer({
+      shouldAutoPlay: false,
+      plan: { ...directPlan, source: { ...directPlan.source, duration_seconds: 1000 } },
+      seekIntervals: { back: 15, forward: 60 },
+      onPlaybackTransportReady: ready,
+    });
+    const video = container.querySelector("video")!;
+    // The element reaching a seek target settles it, as a real timeupdate would.
+    const settleAt = (seconds: number) => {
+      Object.defineProperty(video, "currentTime", { configurable: true, value: seconds });
+      fireEvent.timeUpdate(video);
+    };
+    Object.defineProperty(video, "readyState", { configurable: true, value: 3 });
+    settleAt(100);
+    fireEvent.canPlay(video);
+    await waitFor(() => expect(controls.current?.skipSeconds?.forward).toBe(60));
+    act(() => controls.current?.onSkip?.back());
+    expect(playerSeek).toHaveBeenLastCalledWith(85);
+    settleAt(85);
+    act(() => ready.mock.lastCall![0].skipForward());
+    expect(playerSeek).toHaveBeenLastCalledWith(145);
+    settleAt(145);
+    const callsBeforeTick = ready.mock.calls.length;
+    fireEvent.timeUpdate(video);
+    expect(ready.mock.calls.length).toBe(callsBeforeTick);
     const load = vi.mocked(HTMLMediaElement.prototype.load);
     load.mockClear();
     rerenderPlayer({ seekIntervals: { back: 5, forward: 90 } });
@@ -2253,6 +3192,7 @@ describe("VideoPlayer plan failure recovery", () => {
       onReanchorSeek: reanchor,
     });
     const video = container.querySelector("video")!;
+    fireEvent.loadedMetadata(video);
     Object.defineProperty(video, "currentTime", { configurable: true, value: 100 });
     Object.defineProperty(video, "seekable", {
       configurable: true,
@@ -2284,6 +3224,7 @@ describe("VideoPlayer plan failure recovery", () => {
       onReanchorSeek: reanchor,
     });
     const video = container.querySelector("video")!;
+    fireEvent.loadedMetadata(video);
     Object.defineProperty(video, "currentTime", { configurable: true, value: 100 });
     Object.defineProperty(video, "seekable", {
       configurable: true,
@@ -2316,6 +3257,7 @@ describe("VideoPlayer plan failure recovery", () => {
       onPlaybackTransportReady: ready,
     });
     const video = container.querySelector("video")!;
+    fireEvent.loadedMetadata(video);
     Object.defineProperty(video, "currentTime", { configurable: true, value: 100 });
     Object.defineProperty(video, "seekable", {
       configurable: true,
@@ -2350,6 +3292,7 @@ describe("VideoPlayer plan failure recovery", () => {
       }),
     });
     const video = container.querySelector("video")!;
+    fireEvent.loadedMetadata(video);
     Object.defineProperty(video, "currentTime", { configurable: true, value: 100 });
     const transport = ready.mock.lastCall![0];
     sendRoomMessage.mockClear();
@@ -2390,6 +3333,7 @@ describe("VideoPlayer plan failure recovery", () => {
       onReanchorSeek: reanchor,
     });
     const video = container.querySelector("video")!;
+    fireEvent.loadedMetadata(video);
     Object.defineProperty(video, "currentTime", { configurable: true, value: 10 });
     act(() => ready.mock.lastCall![0].skipBack());
     expect(reanchor).toHaveBeenLastCalledWith(395);
@@ -2862,6 +3806,7 @@ describe("VideoPlayer intro skip prompt", () => {
     const video = rendered.container.querySelector("video");
     if (!video) throw new Error("expected video element");
 
+    fireEvent.loadedMetadata(video);
     video.currentTime = 12;
     fireFrameTimeUpdate(video);
     await act(async () => Promise.resolve());
@@ -2941,7 +3886,7 @@ describe("VideoPlayer intro skip prompt", () => {
   });
 });
 
-describe("VideoPlayer native HLS timeline", () => {
+describe("VideoPlayer source timeline", () => {
   beforeEach(() => {
     realtimeOptions.current = null;
     controls.current = null;
@@ -2993,6 +3938,253 @@ describe("VideoPlayer native HLS timeline", () => {
     expect(subtitleTimeline.assOffsetSeconds).toBe(0);
   });
 
+  // Chrome keeps a Matroska file's container start time on its clock, so a
+  // file that starts 30 s in reports currentTime 30 at its first frame.
+  // Subtitle cues, the resume seek, and the reported position all have to
+  // map through that origin or they drift by it.
+  it("maps direct play onto the media timeline when the engine clock starts late", async () => {
+    const origin = 29.977;
+    const plan = fixturePlanV3({
+      ...directPlan,
+      timeline: { ...directPlan.timeline, player_start_seconds: 1300, timeline_offset_seconds: 0 },
+    });
+    const { container } = renderPlayer({ plan, initialPosition: 1300 });
+    const video = container.querySelector("video");
+    if (!video) throw new Error("expected video element");
+
+    await waitFor(() => expect(video.src).toContain("/api/v1/stream/session-1"));
+    video.currentTime = origin;
+    fireEvent.loadedMetadata(video);
+
+    expect(video.currentTime).toBeCloseTo(1300 + origin);
+    await waitFor(() => expect(subtitleTimeline.textOffsetSeconds).toBeCloseTo(-origin));
+    expect(subtitleTimeline.assOffsetSeconds).toBeCloseTo(-origin);
+    fireFrameTimeUpdate(video);
+    expect(controls.current!.currentTime).toBeCloseTo(1300);
+
+    playerSeek.mockClear();
+    act(() => {
+      controls.current!.onSeek(1400);
+    });
+    expect(playerSeek).toHaveBeenCalledWith(expect.closeTo(1400 + origin));
+  });
+
+  // The engine starts its clock at the file's first frame itself, so the
+  // origin a native load measured must not carry into an engine session, and
+  // a native load after the engine measures its own again.
+  it("drops a native clock origin while the browser engine plays the original", async () => {
+    const engine = {
+      containers: ["mkv"],
+      videoCodecs: ["h264"],
+      audioCodecs: ["aac"],
+      hdr: false,
+    };
+    const { container, rerenderPlayer } = renderPlayer();
+    const video = container.querySelector("video");
+    if (!video) throw new Error("expected video element");
+    await waitFor(() => expect(video.src).toContain("/api/v1/stream/session-1"));
+    video.currentTime = 29.977;
+    fireEvent.loadedMetadata(video);
+    await waitFor(() => expect(subtitleTimeline.textOffsetSeconds).toBeCloseTo(-29.977));
+
+    engineRoute.chosen = true;
+    try {
+      rerenderPlayer({ planRevision: 2, browserEngine: engine });
+      await waitFor(() => expect(attachBrowserEngine).toHaveBeenCalled());
+      await waitFor(() => expect(subtitleTimeline.textOffsetSeconds).toBe(0));
+      expect(subtitleTimeline.assOffsetSeconds).toBe(0);
+    } finally {
+      engineRoute.chosen = false;
+    }
+
+    rerenderPlayer({ planRevision: 3, browserEngine: null });
+    await waitFor(() => expect(video.src).toContain("/api/v1/stream/session-1"));
+    video.currentTime = 1.4;
+    fireEvent.loadedMetadata(video);
+    await waitFor(() => expect(subtitleTimeline.textOffsetSeconds).toBeCloseTo(-1.4));
+  });
+
+  // A route refused before any media event has no position of its own yet;
+  // recovery must resume where this plan was starting, not at 0.
+  it("reports the resume point when the engine refuses a resumed original", async () => {
+    const onPlanFailure = vi.fn();
+    const plan = fixturePlanV3({
+      ...directPlan,
+      timeline: { ...directPlan.timeline, player_start_seconds: 1300, timeline_offset_seconds: 0 },
+    });
+    engineRoute.refused = true;
+    try {
+      renderPlayer({
+        plan,
+        initialPosition: 1300,
+        onPlanFailure,
+        browserEngine: {
+          containers: ["mkv"],
+          videoCodecs: ["h264"],
+          audioCodecs: ["aac"],
+          hdr: false,
+        },
+      });
+      await waitFor(() => expect(onPlanFailure).toHaveBeenCalled());
+      expect(onPlanFailure).toHaveBeenCalledWith(
+        expect.objectContaining({ classification: "browser_engine_unsupported_source" }),
+        1300,
+      );
+    } finally {
+      engineRoute.refused = false;
+    }
+  });
+
+  // The engine keeps its audio's pitch at speed, so the viewer's speed carries
+  // over when it takes the file and stays adjustable.
+  it("keeps the speed control and the viewer's speed on the browser engine", async () => {
+    const engine = {
+      containers: ["mkv"],
+      videoCodecs: ["h264"],
+      audioCodecs: ["aac"],
+      hdr: false,
+    };
+    const { container, rerenderPlayer } = renderPlayer();
+    const video = container.querySelector("video");
+    if (!video) throw new Error("expected video element");
+    await waitFor(() => expect(video.src).toContain("/api/v1/stream/session-1"));
+    act(() => controls.current!.onPlaybackSpeedChange!(1.5));
+    expect(video.playbackRate).toBe(1.5);
+
+    engineRoute.chosen = true;
+    try {
+      rerenderPlayer({ planRevision: 2, browserEngine: engine });
+      await waitFor(() => expect(attachBrowserEngine).toHaveBeenCalled());
+      // The engine starts at the element's default rate, which carries the speed.
+      expect(video.defaultPlaybackRate).toBe(1.5);
+      expect(controls.current!.onPlaybackSpeedChange).toBeDefined();
+      act(() => controls.current!.onPlaybackSpeedChange!(2));
+      expect(video.playbackRate).toBe(2);
+    } finally {
+      engineRoute.chosen = false;
+    }
+  });
+
+  // Written to the element before metadata, a seek would become the default
+  // start position and be read back as the clock origin.
+  it("holds a direct-play seek made before metadata until the origin is known", async () => {
+    const origin = 29.977;
+    const { container } = renderPlayer();
+    const video = container.querySelector("video");
+    if (!video) throw new Error("expected video element");
+    await waitFor(() => expect(video.src).toContain("/api/v1/stream/session-1"));
+
+    playerSeek.mockClear();
+    act(() => {
+      controls.current!.onSeek(500);
+    });
+    expect(playerSeek).not.toHaveBeenCalled();
+    expect(controls.current!.currentTime).toBe(500);
+    video.currentTime = origin;
+    fireEvent.loadedMetadata(video);
+    expect(video.currentTime).toBeCloseTo(500 + origin);
+    await waitFor(() => expect(subtitleTimeline.textOffsetSeconds).toBeCloseTo(-origin));
+  });
+
+  // A load queues a timeupdate at position 0. A held seek to 0 must survive it
+  // rather than settle on it and fall back to the resume position.
+  it("keeps a held seek to the start through a load's reset timeupdate", async () => {
+    const origin = 29.977;
+    const plan = fixturePlanV3({
+      ...directPlan,
+      timeline: { ...directPlan.timeline, player_start_seconds: 1300 },
+    });
+    const { container } = renderPlayer({ plan, initialPosition: 1300 });
+    const video = container.querySelector("video");
+    if (!video) throw new Error("expected video element");
+    await waitFor(() => expect(video.src).toContain("/api/v1/stream/session-1"));
+
+    act(() => {
+      controls.current!.onSeek(0);
+    });
+    fireEvent.timeUpdate(video);
+    video.currentTime = origin;
+    fireEvent.loadedMetadata(video);
+    expect(video.currentTime).toBeCloseTo(origin);
+  });
+
+  it("publishes direct play's duration on the media timeline", async () => {
+    const origin = 29.977;
+    const { duration_seconds: _omitted, ...source } = directPlan.source;
+    const plan = fixturePlanV3({ ...directPlan, source });
+    const { container } = renderPlayer({ plan });
+    const video = container.querySelector("video");
+    if (!video) throw new Error("expected video element");
+    await waitFor(() => expect(video.src).toContain("/api/v1/stream/session-1"));
+
+    // durationchange arrives before loadedmetadata, while the origin is unknown.
+    Object.defineProperty(video, "duration", { configurable: true, value: 1830 });
+    fireEvent.durationChange(video);
+    video.currentTime = origin;
+    fireEvent.loadedMetadata(video);
+    await waitFor(() => expect(controls.current!.duration).toBeCloseTo(1830 - origin));
+  });
+
+  // A room command that runs before metadata must judge drift from where
+  // playback is heading, not the unloaded clock, or it can skip a needed seek.
+  it("applies a room pause sent before direct-play metadata", async () => {
+    const origin = 29.977;
+    const plan = fixturePlanV3({
+      ...directPlan,
+      timeline: { ...directPlan.timeline, player_start_seconds: 1300 },
+    });
+    const command = {
+      command_id: "room-command-1",
+      session_id: "session-1",
+      selection_revision: 1,
+      action: "pause" as const,
+      position_seconds: 0,
+      execute_at: new Date().toISOString(),
+      issued_at: new Date().toISOString(),
+      playback_state: "paused" as const,
+    };
+    const { container } = renderPlayer({
+      plan,
+      initialPosition: 1300,
+      shouldAutoPlay: false,
+      watchTogetherRoomId: "room-1",
+      watchTogetherConnection: roomConnection({ transportCommand: command }),
+    });
+    const video = container.querySelector("video");
+    if (!video) throw new Error("expected video element");
+    await waitFor(() => expect(video.src).toContain("/api/v1/stream/session-1"));
+    await waitFor(() => expect(controls.current!.currentTime).toBe(0));
+
+    video.currentTime = origin;
+    fireEvent.loadedMetadata(video);
+    expect(video.currentTime).toBeCloseTo(origin);
+  });
+
+  it("skips from the resume position before direct-play metadata", async () => {
+    const origin = 29.977;
+    const ready = vi.fn();
+    const plan = fixturePlanV3({
+      ...directPlan,
+      timeline: { ...directPlan.timeline, player_start_seconds: 1300 },
+    });
+    const { container } = renderPlayer({
+      plan,
+      initialPosition: 1300,
+      onPlaybackTransportReady: ready,
+    });
+    const video = container.querySelector("video");
+    if (!video) throw new Error("expected video element");
+    await waitFor(() => expect(video.src).toContain("/api/v1/stream/session-1"));
+    // A load's reset timeupdate leaves the shown position at the resume point.
+    fireEvent.timeUpdate(video);
+    expect(controls.current!.currentTime).toBe(1300);
+
+    act(() => ready.mock.lastCall![0].skipForward());
+    video.currentTime = origin;
+    fireEvent.loadedMetadata(video);
+    expect(video.currentTime).toBeCloseTo(1330 + origin);
+  });
+
   it("uses native HLS for Dolby Vision when hls.js is also available", async () => {
     hlsJS.supported = true;
     vi.stubGlobal("navigator", {
@@ -3866,6 +5058,232 @@ describe("VideoPlayer controls auto-hide", () => {
   });
 });
 
+describe("VideoPlayer progressive remux after a long pause", () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+    vi.setSystemTime(new Date("2026-10-13T12:00:00Z"));
+    realtimeOptions.current = null;
+    controls.current = null;
+    hlsJS.supported = false;
+    vi.spyOn(HTMLMediaElement.prototype, "play").mockResolvedValue(undefined);
+    vi.spyOn(HTMLMediaElement.prototype, "pause").mockImplementation(() => {});
+    vi.spyOn(HTMLMediaElement.prototype, "load").mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    cleanup();
+    vi.restoreAllMocks();
+    vi.useRealTimers();
+  });
+
+  // A remux reanchored at 1800s: the element clock starts at the origin.
+  const remuxPlan = fixturePlanV3({
+    ...directPlan,
+    delivery: "server_remux_progressive",
+    timeline: { ...directPlan.timeline, timeline_offset_seconds: 1_800, can_seek_anywhere: false },
+  });
+
+  function playThenPause(overrides: Partial<Parameters<typeof VideoPlayer>[0]> = {}) {
+    const onReanchorSeek = vi.fn(() => true);
+    const onPlaybackStateChange = vi.fn();
+    const onConnectionLost = vi.fn();
+    const { container, unmount, rerenderPlayer } = renderPlayer({
+      plan: remuxPlan,
+      onReanchorSeek,
+      onPlaybackStateChange,
+      onConnectionLost,
+      ...overrides,
+    });
+    const video = container.querySelector("video")!;
+    video.currentTime = 40;
+    fireFrameTimeUpdate(video);
+    fireEvent.pause(video);
+    return {
+      video,
+      unmount,
+      rerenderPlayer,
+      onReanchorSeek,
+      onPlaybackStateChange,
+      onConnectionLost,
+    };
+  }
+
+  it("reopens the stream at the paused position when playback resumes", () => {
+    const { video, onReanchorSeek, onPlaybackStateChange, onConnectionLost } = playThenPause();
+
+    vi.advanceTimersByTime(10 * 60_000);
+    onPlaybackStateChange.mockClear();
+    fireEvent.play(video);
+
+    expect(onReanchorSeek).toHaveBeenCalledExactlyOnceWith(1_840);
+    expect(onConnectionLost).not.toHaveBeenCalled();
+    // The reopened stream must keep playing, so the session hears the play
+    // before it can adopt the new plan.
+    expect(onPlaybackStateChange).toHaveBeenCalledWith(
+      expect.objectContaining({ currentTime: 1_840, playing: true }),
+    );
+    expect(onPlaybackStateChange.mock.invocationCallOrder[0]!).toBeLessThan(
+      onReanchorSeek.mock.invocationCallOrder[0]!,
+    );
+  });
+
+  it.each([
+    ["reopens once a replan in flight ends without a new plan", 1, 1],
+    ["leaves the stream to a replan in flight that lands a new plan", 2, 0],
+  ])("%s", (_, revisionAfterReplan, reopens) => {
+    const onReanchorSeek = vi.fn(() => true);
+    const { container, rerenderPlayer } = renderPlayer({
+      plan: remuxPlan,
+      onReanchorSeek,
+      replanning: true,
+    });
+    const video = container.querySelector("video")!;
+    video.currentTime = 40;
+    fireFrameTimeUpdate(video);
+    fireEvent.pause(video);
+    vi.advanceTimersByTime(10 * 60_000);
+    Object.defineProperty(video, "paused", { configurable: true, value: false });
+    fireEvent.play(video);
+    expect(onReanchorSeek).not.toHaveBeenCalled();
+
+    rerenderPlayer({ replanning: false, planRevision: revisionAfterReplan });
+
+    expect(onReanchorSeek).toHaveBeenCalledTimes(reopens);
+  });
+
+  it("does not reconnect for a viewer who left while the reopen was pending", async () => {
+    const { video, unmount, onReanchorSeek, onConnectionLost } = playThenPause();
+    let settle: (ok: boolean) => void = () => {};
+    onReanchorSeek.mockImplementation(
+      () => new Promise<boolean>((resolve) => (settle = resolve)) as unknown as boolean,
+    );
+
+    vi.advanceTimersByTime(10 * 60_000);
+    fireEvent.play(video);
+    expect(onReanchorSeek).toHaveBeenCalledOnce();
+
+    unmount();
+    // Leaving ends the session's request, which then reports the reopen as not taken.
+    settle(false);
+    await act(() => vi.advanceTimersByTimeAsync(0));
+
+    expect(onConnectionLost).not.toHaveBeenCalled();
+  });
+
+  it("leaves a superseded reopen to the version switch that started meanwhile", async () => {
+    const { video, rerenderPlayer, onReanchorSeek, onConnectionLost } = playThenPause();
+    let settle: (ok: boolean) => void = () => {};
+    onReanchorSeek.mockImplementation(
+      () => new Promise<boolean>((resolve) => (settle = resolve)) as unknown as boolean,
+    );
+    vi.advanceTimersByTime(10 * 60_000);
+    Object.defineProperty(video, "paused", { configurable: true, value: false });
+    fireEvent.play(video);
+
+    // The viewer switches version; the session drops the reopen as superseded.
+    rerenderPlayer({ replacing: true });
+    settle(false);
+    await act(() => vi.advanceTimersByTimeAsync(0));
+    expect(onConnectionLost).not.toHaveBeenCalled();
+
+    // The switch fails and leaves the idle stream in place, so the reconnect
+    // reopens it.
+    rerenderPlayer({ replacing: false });
+    expect(onConnectionLost).toHaveBeenCalledExactlyOnceWith(1_840, true);
+    expect(onReanchorSeek).toHaveBeenCalledOnce();
+  });
+
+  it("reconnects once when the reopen's own replan fails", async () => {
+    const { video, rerenderPlayer, onReanchorSeek, onConnectionLost } = playThenPause();
+    let settle: (ok: boolean) => void = () => {};
+    onReanchorSeek.mockImplementation(
+      () => new Promise<boolean>((resolve) => (settle = resolve)) as unknown as boolean,
+    );
+    vi.advanceTimersByTime(10 * 60_000);
+    Object.defineProperty(video, "paused", { configurable: true, value: false });
+    fireEvent.play(video);
+
+    // The session shows the reopen's replan in flight, and it answers false
+    // before the render that clears the flag.
+    rerenderPlayer({ replanning: true });
+    settle(false);
+    await act(() => vi.advanceTimersByTimeAsync(0));
+    rerenderPlayer({ replanning: false });
+
+    expect(onReanchorSeek).toHaveBeenCalledOnce();
+    expect(onConnectionLost).toHaveBeenCalledExactlyOnceWith(1_840, true);
+  });
+
+  it("hands a reopen the session refuses to the reconnect", async () => {
+    const { video, onReanchorSeek, onConnectionLost } = playThenPause();
+    // The session expired during the pause, so the replan is turned down.
+    onReanchorSeek.mockImplementation(() => Promise.resolve(false) as unknown as boolean);
+
+    vi.advanceTimersByTime(40 * 60_000);
+    Object.defineProperty(video, "paused", { configurable: true, value: false });
+    fireEvent.play(video);
+    await act(() => vi.advanceTimersByTimeAsync(0));
+
+    expect(onConnectionLost).toHaveBeenCalledExactlyOnceWith(1_840, true);
+  });
+
+  it.each([
+    ["has opened but not shown a frame", HTMLMediaElement.HAVE_METADATA, 1],
+    ["was torn down for the next stream", HTMLMediaElement.HAVE_NOTHING, 0],
+  ])("counts a pause before the first frame only when the stream %s", (_, readyState, reopens) => {
+    const onReanchorSeek = vi.fn(() => true);
+    const { container } = renderPlayer({ plan: remuxPlan, onReanchorSeek });
+    const video = container.querySelector("video")!;
+    Object.defineProperty(video, "readyState", { configurable: true, value: readyState });
+    fireEvent.pause(video);
+
+    vi.advanceTimersByTime(10 * 60_000);
+    fireEvent.play(video);
+
+    expect(onReanchorSeek).toHaveBeenCalledTimes(reopens);
+  });
+
+  it.each([
+    ["a short pause on a progressive remux", {}, 30_000],
+    [
+      "a long pause on an original file the browser can range-request",
+      { plan: directPlan },
+      10 * 60_000,
+    ],
+    [
+      "a long pause in a room, which drives its own transport",
+      { watchTogetherRoomId: "room-1", watchTogetherConnection: roomConnection() },
+      10 * 60_000,
+    ],
+    ["a long pause while another replan replaces the stream", { replanning: true }, 10 * 60_000],
+    ["a long pause while a version switch replaces the session", { replacing: true }, 10 * 60_000],
+  ])("keeps the stream after %s", (_, overrides, pauseMs) => {
+    const { video, onReanchorSeek } = playThenPause(overrides);
+
+    vi.advanceTimersByTime(pauseMs);
+    fireEvent.play(video);
+
+    expect(onReanchorSeek).not.toHaveBeenCalled();
+  });
+
+  it("reopens a stream that settled paused and waited", async () => {
+    const onReanchorSeek = vi.fn(() => true);
+    const { container } = renderPlayer({ plan: remuxPlan, onReanchorSeek, shouldAutoPlay: false });
+    const video = container.querySelector("video")!;
+    Object.defineProperty(video, "readyState", {
+      configurable: true,
+      value: HTMLMediaElement.HAVE_ENOUGH_DATA,
+    });
+    fireEvent.canPlay(video);
+    video.currentTime = 12;
+
+    vi.advanceTimersByTime(5 * 60_000);
+    fireEvent.play(video);
+
+    expect(onReanchorSeek).toHaveBeenCalledExactlyOnceWith(1_812);
+  });
+});
+
 describe("VideoPlayer lost connection", () => {
   beforeEach(() => {
     realtimeOptions.current = null;
diff --git a/web/src/player/components/VideoPlayer.tsx b/web/src/player/components/VideoPlayer.tsx
index bb49722cc6..f3d92935aa 100644
--- a/web/src/player/components/VideoPlayer.tsx
+++ b/web/src/player/components/VideoPlayer.tsx
@@ -1,6 +1,8 @@
 import { useMediaSkipHandlers } from "../hooks/useMediaSkipHandlers";
+import { useAutoQualityDownshift } from "../hooks/useAutoQualityDownshift";
+import { recordObservedBandwidthLimitKbps } from "../bandwidth-probe";
 import { skipTarget } from "../utils/skipTarget";
-import { useCallback, useEffect, useMemo, useRef, useState } from "react";
+import { useCallback, useEffect, useLayoutEffect, useMemo, useRef, useState } from "react";
 import type { ParsedCue } from "../utils/parseVTT";
 import { resolveSubtitleAutoSelect } from "../utils/subtitleSort";
 import type HlsType from "hls.js";
@@ -20,11 +22,17 @@ import { useIntroSkipPrompt } from "../hooks/useIntroSkipPrompt";
 import { useRemuxSeeking } from "../hooks/useRemuxSeeking";
 import { useSubtitleTracks } from "../hooks/useSubtitleTracks";
 import { useASSSubtitles } from "../hooks/useASSSubtitles";
+import { usePGSSubtitles } from "../hooks/usePGSSubtitles";
+import type { EngineCapabilities } from "../engine/capabilities";
+import { resolveOriginalPlaybackRoute, type NativeOriginalSupport } from "../engine/routing";
+import type { BrowserEngineSession } from "../engine";
+import { ENGINE_READ_FAILED } from "../engine/protocol";
 import { useSubtitleSync } from "../hooks/useSubtitleSync";
 import { useSubtitleSyncFeedback } from "../hooks/useSubtitleSyncFeedback";
 import { syncKeyOf } from "../utils/subtitleSync";
 import { SubtitleSyncIndicator } from "./SubtitleSyncIndicator";
 import { useSubtitleAppearance } from "../hooks/useSubtitleAppearance";
+import { useSubtitleDelay } from "../hooks/useSubtitleDelay";
 import { useSubtitleLayout } from "../hooks/useSubtitleLayout";
 import { useCoarsePointer } from "../hooks/useCoarsePointer";
 import { computeSubtitleFontSize } from "@/lib/subtitleAppearance";
@@ -43,7 +51,11 @@ import type {
   PlaybackRealtimeCommandEnvelope,
   PlaybackRealtimeEventEnvelope,
 } from "../realtime-protocol";
-import { resolvePendingSeekTime } from "../utils/pendingSeek";
+import {
+  remainingRoomHeldSeek,
+  resolvePendingSeekTime,
+  ROOM_HELD_SEEK_TIMEOUT_MS,
+} from "../utils/pendingSeek";
 import { resolveVersionAudioLanguage } from "../utils/effectiveAudioLanguage";
 import { HlsStartupGuard } from "../utils/hlsStartupGuard";
 import {
@@ -92,17 +104,29 @@ import {
   abandonRoomReload,
   beginRoomReload,
   createRoomReloadBudget,
-  decideRoomCatchup,
+  createRoomSeekCorrector,
+  decideRoomCommand,
+  expireRoomReload,
   isNativePositionInRanges,
   landRoomReload,
+  nextRoomNudgeRate,
+  noteRoomCorrectorSeek,
   noteRoomReloadLoading,
-  roomCatchupConverged,
-  roomCatchupExpectedPosition,
+  observeRoomCorrector,
+  roomCorrectorSeekDue,
+  roomCorrectorSeekTarget,
+  roomPositionAt,
   roomReloadAllowed,
+  roomReloadInFlight,
+  roomSeekAlreadyPending,
   roomMembersLeftBehind,
   roomReloadLanded,
+  roomSyncDeadbandSeconds,
+  roomSyncLoopIntervalMs,
+  roomSyncLoopSettleMs,
   settleRoomReloads,
-  type RoomCatchupTarget,
+  type RoomIssuedSeek,
+  type RoomPositionReference,
 } from "../utils/roomSyncCatchup";
 import { pendingServerSubtitleSelection } from "../utils/playableSubtitles";
 import {
@@ -158,10 +182,20 @@ interface VideoPlayerProps {
   plan: PlanV3;
   /** Bumped on every adopted plan; stream-reload effects key on it. */
   planRevision: number;
+  /**
+   * The browser decode engine, when browser decoding is on and this browser
+   * can run it. An `original_http` plan the media element cannot play goes to
+   * the engine instead.
+   */
+  browserEngine?: EngineCapabilities | null;
+  /** What the media element itself plays from an untouched original. */
+  nativeOriginalSupport?: NativeOriginalSupport;
   /** Whether a newly adopted transport should begin playing immediately. */
   shouldAutoPlay?: boolean;
   /** True while a replan is in flight, so the quality menu can show progress. */
   replanning?: boolean;
+  /** True while a fresh start replaces the session, such as a version switch. */
+  replacing?: boolean;
   /** Server-described replan error, if the last replan was refused. */
   replanError?: string | null;
   /** Title for the replan error, used when surfacing the refusal as a toast. */
@@ -265,6 +299,15 @@ const EXIT_PROGRESS_FLUSH_TIMEOUT_MS = 1_000;
 // MediaError.MEDIA_ERR_NETWORK: the media was usable, then fetching it failed.
 const MEDIA_ERR_NETWORK = 2;
 const FIREFOX_COMPATIBILITY_FALLBACK_DELAY_MS = 8_000;
+// A progressive remux is one forward-only response. A paused browser stops
+// reading it, and the server closes it once it has made no progress for its
+// stall window (180s by default, see internal/httpstream). The browser cannot
+// resume it where it was: Chromium fetches the stream again from its origin and
+// stalls while it re-reads everything up to its cursor; Firefox fails the
+// stream or jumps back to the origin. Playing again after this long reopens the
+// stream at the paused position instead. The value sits well inside the
+// default window.
+const PROGRESSIVE_REMUX_IDLE_REOPEN_MS = 60_000;
 // How often a rejected autoplay is retried, and how many times. A transport
 // swap tears the previous source down with `load()`, and the media element load
 // algorithm is required to reject any play that is still pending with an
@@ -284,6 +327,9 @@ const MAX_AUTOPLAY_ATTEMPTS = 4;
 const ROOM_STALLS_BEFORE_LOWER_QUALITY = 2;
 const ROOM_STALL_WINDOW_MS = 5 * 60_000;
 const LOWER_QUALITY_ACTION_LABEL = "Lower quality";
+// Buffering this soon after a failed media request is treated as an outage,
+// not a slow link, by the Auto downshift.
+const TRANSPORT_TROUBLE_WINDOW_MS = 15_000;
 const PLAYBACK_NOTICE_VISIBLE_MS = 8_000;
 const ROOM_RECONNECTING_MESSAGE = "Reconnecting to room. Controls are temporarily unavailable.";
 // The server returns a room to the lobby once its position is within two
@@ -357,8 +403,11 @@ export function VideoPlayer({
   streamUrl,
   plan,
   planRevision,
+  browserEngine = null,
+  nativeOriginalSupport,
   shouldAutoPlay = true,
   replanning = false,
+  replacing = false,
   replanError = null,
   replanErrorTitle = null,
   sessionId,
@@ -429,6 +478,13 @@ export function VideoPlayer({
   // Refs
   const videoRef = useRef<HTMLVideoElement>(null);
   const containerRef = useRef<HTMLDivElement>(null);
+  // Box under the <video> that holds the browser decode engine's canvas.
+  const engineSurfaceRef = useRef<HTMLDivElement>(null);
+  const [browserEngineActive, setBrowserEngineActive] = useState(false);
+  // Bumped whenever an engine transport starts or stops. Frame callbacks
+  // registered on one engine end with it, so renderers that drive themselves
+  // from requestVideoFrameCallback (JASSUB) rebuild on it.
+  const [engineTransportRevision, setEngineTransportRevision] = useState(0);
   const fullscreenRootRef = usePlayerFullscreenRoot();
   const isMountedRef = useRef(true);
   const hlsRef = useRef<HlsType | null>(null);
@@ -437,15 +493,30 @@ export function VideoPlayer({
   // Kept for the stats overlay, which can be opened after the fact.
   const [eventLog] = useState(() => new PlaybackEventLog());
   const lastRecoveryRef = useRef(0);
+  // When hls.js last reported a failed load (not a timeout). Buffering soon
+  // after one is an outage, not a slow link, for the Auto downshift.
+  const lastTransportErrorAtRef = useRef(0);
   const reportedPlanFailureKeyRef = useRef<string | null>(null);
   // Whether the current transport has shown a frame. A network error after
   // that is a lost connection, not a route that cannot play. Reset whenever
   // the transport is rebuilt (see the hls.js lifecycle effect).
   const streamPlayedRef = useRef(false);
+  // When the current transport last stopped playing, or null while it plays.
+  // Only a transport that has opened, shown a frame, or settled paused counts.
+  const transportIdleSinceRef = useRef<number | null>(null);
   const connectionStatusRef = useRef(connectionStatus);
   connectionStatusRef.current = connectionStatus;
   const transportFailedForPlanRevisionRef = useRef<number | null>(null);
   const timelineOffsetRef = useRef(0);
+  // Where the direct-play engine's clock starts, in player seconds. Chrome keeps
+  // a Matroska file's container start time (seconds into a TS remux), so its
+  // currentTime runs ahead of the media timeline by that much.
+  const [directPlayOriginSeconds, setDirectPlayOriginSeconds] = useState(0);
+  const planTimelineOffsetRef = useRef(0);
+  // True between loading an original file and learning its clock origin. A
+  // seek in that window is held as pending: written to the element it would
+  // become the default start position and be misread as the origin.
+  const directPlayOriginPendingRef = useRef(false);
   const subtitleFetchAnchorRef = useRef(initialPosition);
   const backendDurationRef = useRef(propDuration ?? 0);
   const autoEnterPictureInPictureAttemptedRef = useRef(false);
@@ -460,15 +531,36 @@ export function VideoPlayer({
   const lastRoomCommandIdRef = useRef<string | null>(null);
   const appliedRoomCommandIdRef = useRef<string | null>(null);
   const roomCommandTimerRef = useRef<number | null>(null);
-  // The advancing room position a playbackRate catch-up is converging toward,
-  // when one is active. Non-null means playbackRate is intentionally not 1.
-  const roomCatchupTargetRef = useRef<RoomCatchupTarget | null>(null);
+  // A room rate nudge is active: playbackRate is intentionally off the base
+  // rate. Only command execution and the drift loop start one.
+  const roomNudgeActiveRef = useRef(false);
+  // The room reference: the position described by the latest applied
+  // transport command for the current selection. The drift loop measures
+  // against it; snapshots never move it.
+  const roomReferenceRef = useRef<RoomPositionReference | null>(null);
+  // When the latest room command executed or finished executing. The drift
+  // loop leaves playback alone for a moment after a command.
+  // Local intervals in room sync (this settle, reload staleness and pacing,
+  // seek spacing) run on the monotonic clock, so a wall-clock jump cannot
+  // freeze them. Date.now() is used only where server time is involved.
+  const roomCommandFinishedAtRef = useRef(Number.NEGATIVE_INFINITY);
+  // The last seek room sync issued and when. Cleared once no seek is pending
+  // and when the stream is replaced, so only an unfinished room seek in this
+  // stream suppresses a repeat of itself.
+  const roomIssuedSeekRef = useRef<RoomIssuedSeek | null>(null);
+  // Seek-based drift correction for a player without rate nudges: the lead
+  // its seeks aim ahead by and the wait between them; see RoomSeekCorrector.
+  const roomSeekCorrectorRef = useRef(createRoomSeekCorrector());
+  // The rate playback returns to when no room catch-up is active: the
+  // viewer's chosen speed, or 1x while a Watch Party room owns the rate.
+  const baseRateRef = useRef(1);
   // Bounds media reloads that room corrections trigger; see roomSyncCatchup.ts.
   const roomReloadBudgetRef = useRef(createRoomReloadBudget());
   // Sustained stalls reported to the room, for offering a lower quality.
   const roomStallTimesRef = useRef<number[]>([]);
   const lowerQualityOfferedRef = useRef(false);
   const performPlayerSeekRef = useRef<(seconds: number) => boolean | Promise<boolean>>(() => false);
+  const reopenIdleProgressiveRemuxRef = useRef<() => void>(() => {});
   const reportRoomReadyRef = useRef<() => { ok: boolean }>(() => ({ ok: false }));
 
   // Playback state
@@ -481,6 +573,7 @@ export function VideoPlayer({
   const pendingSeekTimeRef = useRef<number | null>(null);
   useEffect(() => {
     pendingSeekTimeRef.current = pendingSeekTime;
+    if (pendingSeekTime === null) roomIssuedSeekRef.current = null;
   }, [pendingSeekTime]);
   const [duration, setDuration] = useState(propDuration ?? 0);
   const [buffered, setBuffered] = useState<TimeRanges | null>(null);
@@ -508,12 +601,9 @@ export function VideoPlayer({
   );
   const lastSubtitleIndexRef = useRef<number | null>(null);
   const subtitleSelectionWasManualRef = useRef(false);
-  // Per-session subtitle delay in ms. Positive = show later. Reset when the
-  // underlying file changes so sync adjustments don't carry across media.
-  const [subtitleDelayMs, setSubtitleDelayMs] = useState(0);
-  useEffect(() => {
-    setSubtitleDelayMs(0);
-  }, [activeFileId]);
+  // Subtitle delay in ms; positive shows later. It is the profile's timing
+  // offset, so a change here follows the profile to every device.
+  const [subtitleDelayMs, setSubtitleDelayMs] = useSubtitleDelay();
 
   // -- Live AI subtitle translation (streamed over the realtime websocket) --
   // While a translation runs, a synthetic "live" track is added to the list and
@@ -659,7 +749,12 @@ export function VideoPlayer({
       reportedPlanFailureKeyRef.current = failureKey;
       transportFailedForPlanRevisionRef.current = planRevision;
       setError(null);
-      onPlanFailure(failure, currentTimeRef.current);
+      // Until this transport has played, the player's position is the
+      // previous route's or 0; recovery resumes where this one was heading.
+      onPlanFailure(
+        failure,
+        streamPlayedRef.current ? currentTimeRef.current : subtitleFetchAnchorRef.current,
+      );
       return true;
     },
     [onPlanFailure, plan.plan_attempt_key, planRevision, sessionId],
@@ -834,6 +929,12 @@ export function VideoPlayer({
     roomStallTimesRef.current.push(Date.now());
     setRoomStallSignal((signal) => signal + 1);
   }, []);
+  // A routine report names the applied command only once any seek it
+  // started has landed; until then the element still plays the old stream.
+  const roomReportCommandId = useCallback(() => {
+    if (pendingSeekTimeRef.current !== null || videoRef.current?.seeking) return null;
+    return appliedRoomCommandIdRef.current;
+  }, []);
   const watchTogetherSync = useWatchTogetherPlaybackSync({
     roomConnection: watchTogether,
     sessionId,
@@ -841,8 +942,21 @@ export function VideoPlayer({
     streamOriginRef: timelineOffsetRef,
     appliedCommandIdRef: appliedRoomCommandIdRef,
     onSustainedStall: noteRoomStall,
+    reportCommandId: roomReportCommandId,
   });
   const roomPlaybackActive = !!watchTogetherRoomId && !watchTogether.closedReason;
+  // Read by timers that must use the newest clock estimate without restarting.
+  const serverTimeOffsetRef = useRef(watchTogether.serverTimeOffsetMs);
+  serverTimeOffsetRef.current = watchTogether.serverTimeOffsetMs;
+  // Room sync corrects the browser decode engine by seeking. Its audio keeps
+  // pitch at other rates too, but rate nudges have not been checked against
+  // room drift on it, so it keeps the seek path it had when they could not.
+  const roomRateCapableRef = useRef(!browserEngineActive);
+  roomRateCapableRef.current = !browserEngineActive;
+  // The viewer's speed for this player session. A room plays everyone at 1x
+  // and nudges the rate itself to keep viewers together.
+  const [playbackSpeed, setPlaybackSpeed] = useState(1);
+  const baseRate = roomPlaybackActive ? 1 : playbackSpeed;
   const roomSyncWaiting = watchTogether.room?.playback_state === "waiting";
   // Media events acknowledge readiness while the room waits and while this
   // viewer recovers from a stall the room did not wait for.
@@ -880,14 +994,18 @@ export function VideoPlayer({
   const isCopyOriginalHLS = plan.delivery === "server_remux_hls";
 
   // Keep the player-local clock mapped onto the canonical media timeline.
-  const timelineOffsetSeconds = plan.timeline.timeline_offset_seconds;
+  const planTimelineOffset = plan.timeline.timeline_offset_seconds;
+  planTimelineOffsetRef.current = planTimelineOffset;
+  const playsOriginalFile = plan.delivery === "original_http";
+  const timelineOffsetSeconds =
+    planTimelineOffset - (playsOriginalFile ? directPlayOriginSeconds : 0);
   timelineOffsetRef.current = timelineOffsetSeconds;
 
   // Media-time position playback is heading to, for consumers that need a
   // position before the element has media loaded (when currentTime still
   // reads 0): an in-flight seek target, else the session's start position.
   subtitleFetchAnchorRef.current =
-    pendingSeekTime ?? toMediaTime(effectiveInitialPosition, timelineOffsetSeconds);
+    pendingSeekTime ?? toMediaTime(effectiveInitialPosition, planTimelineOffset);
 
   useEffect(() => {
     if (backendDuration > 0) {
@@ -1096,6 +1214,31 @@ export function VideoPlayer({
   // against the plan's timeline below.
   const { handleSeek } = useRemuxSeeking(videoRef);
 
+  // Where the media is on the element's clock. While an original file's clock
+  // origin is unknown the element has no position on the stream yet, so that
+  // is where playback is heading.
+  const elementMediaPosition = useCallback((): number | null => {
+    const video = videoRef.current;
+    if (!video) return null;
+    if (directPlayOriginPendingRef.current) return subtitleFetchAnchorRef.current;
+    return toMediaTime(video.currentTime, timelineOffsetRef.current);
+  }, []);
+
+  // Publishes the element's duration on the media timeline. A direct-play
+  // engine's duration runs on its own clock, which starts at the origin, so
+  // it waits until the origin is known.
+  const applyElementDuration = useCallback((video: HTMLVideoElement) => {
+    if (directPlayOriginPendingRef.current) return;
+    if (!video.duration || !isFinite(video.duration)) return;
+    const originSeconds = planTimelineOffsetRef.current - timelineOffsetRef.current;
+    const mediaDuration = video.duration - originSeconds;
+    // For HLS EVENT playlists still being written, the element reports the
+    // length produced so far. The plan's source duration is the media's
+    // full runtime, so it wins whenever the engine reports something short.
+    if (backendDurationRef.current && mediaDuration < backendDurationRef.current) return;
+    setDuration(mediaDuration);
+  }, []);
+
   const rememberPendingSeek = useCallback((seconds: number) => {
     pendingSeekTimeRef.current = seconds;
     setPendingSeekTime(seconds);
@@ -1111,16 +1254,100 @@ export function VideoPlayer({
     if (video) setCurrentTime(toMediaTime(video.currentTime, timelineOffsetRef.current));
   }, []);
 
+  // This viewer's newest room seek request the room has not run yet: the
+  // origin of the next relative skip and the position the controls show (see
+  // remainingRoomHeldSeek). The element, its room reports and the markers
+  // follow the room's seeks as they run.
+  const [roomHeldSeek, setRoomHeldSeek] = useState<number | null>(null);
+  const roomHeldSeekRef = useRef<number | null>(null);
+  const roomHeldSeekTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
+  // Whether the room's seek for the held request has arrived. Any command that
+  // runs after it, including one that replaced it before it ran, answers the
+  // request.
+  const roomHeldSeekAnsweredRef = useRef(false);
+  const holdRoomSeek = useCallback(
+    (seconds: number | null) => {
+      if (roomHeldSeekTimerRef.current !== null) clearTimeout(roomHeldSeekTimerRef.current);
+      roomHeldSeekTimerRef.current = null;
+      roomHeldSeekAnsweredRef.current = false;
+      roomHeldSeekRef.current = seconds;
+      setRoomHeldSeek(seconds);
+      if (seconds === null) return;
+      // A request the room never ran (dropped while reconnecting, or folded
+      // into a seek that already landed) puts the timeline back on the media.
+      roomHeldSeekTimerRef.current = setTimeout(() => {
+        roomHeldSeekTimerRef.current = null;
+        roomHeldSeekRef.current = null;
+        setRoomHeldSeek(null);
+        releasePendingSeek(seconds);
+      }, ROOM_HELD_SEEK_TIMEOUT_MS);
+    },
+    [releasePendingSeek],
+  );
+  // The room answered the held request without running a seek to it here: the
+  // timeline goes back to the media, and so does the request's pending target.
+  const abandonRoomHeldSeek = useCallback(() => {
+    const seconds = roomHeldSeekRef.current;
+    if (seconds === null) return;
+    holdRoomSeek(null);
+    releasePendingSeek(seconds);
+  }, [holdRoomSeek, releasePendingSeek]);
+  useEffect(
+    () => () => {
+      if (roomHeldSeekTimerRef.current !== null) clearTimeout(roomHeldSeekTimerRef.current);
+    },
+    [],
+  );
+
   // Ends an active room catch-up nudge; any seek or local stop returns the
-  // element to 1x so a stale rate never survives a context change.
+  // element to the base rate so a stale rate never survives a context change.
   const resetRoomCatchupRate = useCallback(() => {
-    roomCatchupTargetRef.current = null;
+    roomNudgeActiveRef.current = false;
     const video = videoRef.current;
-    if (video && video.playbackRate !== 1) {
-      video.playbackRate = 1;
+    if (video && video.playbackRate !== baseRateRef.current) {
+      video.playbackRate = baseRateRef.current;
     }
   }, []);
 
+  // Runs before this commit's other effects, so a catch-up reset in them
+  // already returns to the committed rate. defaultPlaybackRate carries the
+  // speed across media reloads (quality switches, stream rebuilds), which
+  // reset playbackRate to it.
+  useLayoutEffect(() => {
+    baseRateRef.current = baseRate;
+    const video = videoRef.current;
+    if (!video) return;
+    video.defaultPlaybackRate = baseRate;
+    if (!roomNudgeActiveRef.current) video.playbackRate = baseRate;
+  }, [baseRate]);
+
+  // Asks the server for a stream anchored at `seconds`. The replan decides
+  // whether that took: a refused or failed replan leaves playback where it
+  // was. With no handler it returns false.
+  const reanchorAt = useCallback(
+    (seconds: number): boolean | Promise<boolean> => {
+      if (!onReanchorSeek) return false;
+      rememberPendingSeek(seconds);
+      setCurrentTime(seconds);
+      const accepted = onReanchorSeek(seconds);
+      if (typeof accepted === "boolean") {
+        if (!accepted) releasePendingSeek(seconds);
+        return accepted;
+      }
+      return accepted.then(
+        (ok) => {
+          if (!ok) releasePendingSeek(seconds);
+          return ok;
+        },
+        (error: unknown) => {
+          releasePendingSeek(seconds);
+          throw error;
+        },
+      );
+    },
+    [onReanchorSeek, releasePendingSeek, rememberPendingSeek],
+  );
+
   // Reports whether the seek was taken up, which callers that show an
   // affordance for it (the intro prompt) need in order to know whether the
   // affordance did anything.
@@ -1131,6 +1358,12 @@ export function VideoPlayer({
 
       resetRoomCatchupRate();
 
+      if (directPlayOriginPendingRef.current) {
+        rememberPendingSeek(seconds);
+        setCurrentTime(seconds);
+        return true;
+      }
+
       const nativeSeconds = toPlayerTime(seconds, timelineOffsetRef.current);
       if (canSeekAnywhere || isNativePositionInRanges(video.seekable, nativeSeconds)) {
         rememberPendingSeek(seconds);
@@ -1142,38 +1375,99 @@ export function VideoPlayer({
 
       // Outside the server-anchored window: this is a timeline operation, not
       // a failure, so it asks for a reanchor rather than reporting a failure.
-      // The replan decides whether the seek took: a refused or failed replan
-      // leaves playback where it was. With no handler the seek is dropped.
-      if (!onReanchorSeek) return false;
-      rememberPendingSeek(seconds);
-      setCurrentTime(seconds);
-      const accepted = onReanchorSeek(seconds);
-      if (typeof accepted === "boolean") {
-        if (!accepted) releasePendingSeek(seconds);
-        return accepted;
-      }
-      return accepted.then(
-        (ok) => {
-          if (!ok) releasePendingSeek(seconds);
-          return ok;
-        },
-        (error: unknown) => {
-          releasePendingSeek(seconds);
-          throw error;
-        },
-      );
+      return reanchorAt(seconds);
     },
     [
       canSeekAnywhere,
       handleSeek,
       isHlsStream,
-      onReanchorSeek,
-      releasePendingSeek,
+      reanchorAt,
       rememberPendingSeek,
       resetRoomCatchupRate,
     ],
   );
 
+  // See PROGRESSIVE_REMUX_IDLE_REOPEN_MS. The element plays from its buffer
+  // until the reopened stream replaces it. A room keeps its own transport. A
+  // replan or fresh start already in flight replaces this stream when it lands
+  // a plan; the reopen waits for it and runs only if it does not.
+  const isProgressiveRemux = plan.delivery === "server_remux_progressive";
+  const planChangeInFlight = replanning || replacing;
+  const planChangeInFlightRef = useRef(planChangeInFlight);
+  planChangeInFlightRef.current = planChangeInFlight;
+  const planRevisionRef = useRef(planRevision);
+  planRevisionRef.current = planRevision;
+  // What to do once the plan change in flight settles without replacing the
+  // stream, and the plan revision it would replace.
+  const afterPlanChangeRef = useRef<{ revision: number; run: () => void } | null>(null);
+  const reopenIdleProgressiveRemux = useCallback(() => {
+    const video = videoRef.current;
+    if (!video || !isProgressiveRemux || watchTogetherRoomId) return;
+    if (connectionStatusRef.current !== "connected") return;
+    // A seek inside the buffer that the element has not reached yet is where
+    // the viewer wants to be.
+    const position =
+      pendingSeekTimeRef.current ?? toMediaTime(video.currentTime, timelineOffsetRef.current);
+    // The session reads the play intent when a new plan lands, which can be
+    // before the effect that reports this play has run. That includes the
+    // plan of a change already in flight.
+    onPlaybackStateChange?.({
+      currentTime: position,
+      duration: durationRef.current,
+      playing: true,
+    });
+    const revision = planRevisionRef.current;
+    if (planChangeInFlightRef.current) {
+      afterPlanChangeRef.current = {
+        revision,
+        // A viewer who paused meanwhile is still on the idle stream; the next
+        // play reopens it.
+        run: () => {
+          if (videoRef.current?.paused) transportIdleSinceRef.current = 0;
+          else reopenIdleProgressiveRemuxRef.current();
+        },
+      };
+      return;
+    }
+    // When the reopen does not take, the session may have expired during the
+    // pause or the route may no longer be granted. The reconnect replans or
+    // starts a new attempt at the same position, unless another plan already
+    // replaced this stream or the viewer has left.
+    const reconnect = () => {
+      if (!isMountedRef.current) return;
+      if (planRevisionRef.current !== revision) return;
+      if (connectionStatusRef.current !== "connected") return;
+      onConnectionLost?.(position, !video.paused);
+    };
+    // A change can still look in flight here: this reopen's own replan until
+    // its answer renders, or a version switch that started meanwhile. The
+    // reconnect waits for it to settle, so a switch that lands a plan
+    // replaces the stream instead, and a failed reopen reconnects once rather
+    // than reopening again.
+    const fallBack = () => {
+      if (planChangeInFlightRef.current) afterPlanChangeRef.current = { revision, run: reconnect };
+      else reconnect();
+    };
+    const accepted = reanchorAt(position);
+    if (accepted === false) fallBack();
+    else if (accepted !== true) accepted.then((ok) => ok || fallBack(), fallBack);
+  }, [
+    isProgressiveRemux,
+    onConnectionLost,
+    onPlaybackStateChange,
+    reanchorAt,
+    watchTogetherRoomId,
+  ]);
+  reopenIdleProgressiveRemuxRef.current = reopenIdleProgressiveRemux;
+
+  useEffect(() => {
+    const waiting = afterPlanChangeRef.current;
+    if (waiting === null || planChangeInFlight) return;
+    afterPlanChangeRef.current = null;
+    // A change that landed a plan replaced the stream, which is not idle.
+    if (planRevision === waiting.revision) waiting.run();
+  }, [planChangeInFlight, planRevision]);
+
   const handlePlayerSeek = useCallback(
     (seconds: number): boolean | Promise<boolean> => {
       if (watchTogether.replacementReason) return false;
@@ -1203,12 +1497,14 @@ export function VideoPlayer({
           // a relative skip before then extends this target.
           rememberPendingSeek(seconds);
           setCurrentTime(seconds);
+          holdRoomSeek(seconds);
         }
         return result.ok;
       }
       return performPlayerSeek(seconds);
     },
     [
+      holdRoomSeek,
       performPlayerSeek,
       rememberPendingSeek,
       sessionId,
@@ -1227,20 +1523,22 @@ export function VideoPlayer({
   // remux playback whose HTML media clock starts at a nonzero offset. A seek
   // still in flight (a reanchor being replanned, a remux reload) is the origin
   // rather than the element clock, so a skip right after a scrub extends the
-  // scrub instead of snapping back to where the element still is.
+  // scrub instead of snapping back to where the element still is. In a room,
+  // the viewer's held request comes first: the room's seeks for earlier skips
+  // in a burst move the element without answering it.
   const handleSkip = useCallback(
     (direction: "back" | "forward") => {
       const now =
+        roomHeldSeekRef.current ??
         pendingSeekTimeRef.current ??
-        (videoRef.current
-          ? toMediaTime(videoRef.current.currentTime, timelineOffsetRef.current)
-          : currentTimeRef.current);
+        elementMediaPosition() ??
+        currentTimeRef.current;
       const seconds = direction === "back" ? seekIntervals.back : seekIntervals.forward;
       handlePlayerSeek(
         skipTarget(now, durationRef.current, direction === "back" ? -seconds : seconds),
       );
     },
-    [handlePlayerSeek, seekIntervals.back, seekIntervals.forward],
+    [elementMediaPosition, handlePlayerSeek, seekIntervals.back, seekIntervals.forward],
   );
   const handleSkipRef = useRef(handleSkip);
   useEffect(() => {
@@ -1269,11 +1567,8 @@ export function VideoPlayer({
   );
 
   const buildExitState = useCallback((): PlaybackExitState => {
-    const video = videoRef.current;
-    const positionSeconds = toMediaTime(
-      video?.currentTime ?? currentTime,
-      timelineOffsetRef.current,
-    );
+    const positionSeconds =
+      elementMediaPosition() ?? toMediaTime(currentTime, timelineOffsetRef.current);
     // positionSeconds is media time, so the runtime paired with it must be too.
     const durationSeconds = mediaDurationSeconds(backendDurationRef.current, duration);
 
@@ -1286,7 +1581,7 @@ export function VideoPlayer({
       lastCodecVideo: selectedVersion?.codec_video,
       lastEditionKey: selectedVersion?.edition_key,
     };
-  }, [activeFileId, currentTime, duration, selectedVersion]);
+  }, [activeFileId, currentTime, duration, elementMediaPosition, selectedVersion]);
 
   useEffect(() => {
     if (!watchTogetherRoomId || !watchTogether.closedReason || leaveInProgressRef.current) {
@@ -1958,22 +2253,30 @@ export function VideoPlayer({
   const plannedBitrateKbps = plan.effective_recipe.bitrate_kbps ?? 0;
   const plannedDynamicRange = plan.effective_recipe.dynamic_range;
 
+  // Read by the transport effect, which reruns on planRevision rather than on
+  // every input the original-file route depends on.
+  const originalRouteInputRef = useRef({ plan, browserEngine, nativeOriginalSupport, audioTracks });
+  originalRouteInputRef.current = { plan, browserEngine, nativeOriginalSupport, audioTracks };
+
   // -- hls.js lifecycle --
   useEffect(() => {
     // "Played" belongs to one transport. A replacement that has not shown a
     // frame yet may be a route this browser cannot reach, so its network
     // failures go through startup recovery rather than the reconnect.
     streamPlayedRef.current = false;
+    transportIdleSinceRef.current = null;
     const video = videoRef.current;
     if (!video || !isPlayerReady || hlsStartupGuardRef.current?.hasFailed()) return;
 
     let hls: HlsType | null = null;
+    let engineSession: BrowserEngineSession | null = null;
     let destroyed = false;
     let playbackStarted = false;
     let autoplayInFlight = false;
     let autoplayAttempts = 0;
     let autoplayRetryTimer: ReturnType<typeof setTimeout> | null = null;
     let nativeHLSMetadataHandler: (() => void) | null = null;
+    let directPlayMetadataHandler: (() => void) | null = null;
 
     mediaRecoveryAttemptsRef.current = 0;
     setError(null);
@@ -1994,6 +2297,11 @@ export function VideoPlayer({
         video.removeEventListener("loadedmetadata", nativeHLSMetadataHandler);
         nativeHLSMetadataHandler = null;
       }
+      if (directPlayMetadataHandler) {
+        video.removeEventListener("loadedmetadata", directPlayMetadataHandler);
+        directPlayMetadataHandler = null;
+      }
+      directPlayOriginPendingRef.current = false;
     };
 
     // Settles the player into a deliberate paused state: the startup guard is
@@ -2003,6 +2311,7 @@ export function VideoPlayer({
       playbackStarted = true;
       cleanupStartupListeners();
       hlsStartupGuardRef.current?.markPlaybackStarted();
+      transportIdleSinceRef.current = Date.now();
       setAwaitingFirstFrame(false);
       setPlaying(false);
     };
@@ -2147,6 +2456,14 @@ export function VideoPlayer({
               if (!destroyed) {
                 eventLog.add(`hls ${data.fatal ? "fatal " : ""}${data.type}: ${data.details}`);
               }
+              // A load error (refused, reset, HTTP failure) is the transport
+              // failing; a load timeout can be a slow link and is left out.
+              if (
+                data.type === Hls.ErrorTypes.NETWORK_ERROR &&
+                String(data.details).endsWith("LoadError")
+              ) {
+                lastTransportErrorAtRef.current = Date.now();
+              }
               if (!data.fatal || destroyed) return;
 
               console.error("[hls.js] Fatal error:", {
@@ -2257,14 +2574,108 @@ export function VideoPlayer({
           }
         }
       } else {
+        const routeInput = originalRouteInputRef.current;
+        const route =
+          routeInput.browserEngine && routeInput.plan.delivery === "original_http"
+            ? resolveOriginalPlaybackRoute({
+                plan: routeInput.plan,
+                streamUrl: effectiveStreamUrl,
+                native: routeInput.nativeOriginalSupport ?? {
+                  containers: [],
+                  videoCodecs: [],
+                  audioCodecs: [],
+                },
+                engine: routeInput.browserEngine,
+                audioTracks: routeInput.audioTracks,
+              })
+            : ({ kind: "native" } as const);
+        if (route.kind === "unsupported") {
+          if (!reportCurrentPlanFailure(route.failure)) {
+            setError("This browser cannot play this file.");
+          }
+          return;
+        }
+        if (route.kind === "engine") {
+          // The original goes to the browser decode engine, which stands in
+          // for the element's media pipeline; the readiness gate below sees
+          // the same events either way. Its clock starts at the file's first
+          // frame, so an origin measured by an earlier native load is dropped.
+          setDirectPlayOriginSeconds(0);
+          timelineOffsetRef.current = planTimelineOffsetRef.current;
+          try {
+            const { attachBrowserEngine } = await import("../engine");
+            const surface = engineSurfaceRef.current;
+            if (destroyed || !surface) return;
+            engineSession = attachBrowserEngine({
+              video,
+              surface,
+              source: route.source,
+              onFailure: (failure) => {
+                if (destroyed) return;
+                // Like MEDIA_ERR_NETWORK on the element: a read that fails
+                // after the stream played reconnects on the same route.
+                if (
+                  failure.classification === ENGINE_READ_FAILED &&
+                  reportConnectionLostRef.current()
+                ) {
+                  return;
+                }
+                if (!reportCurrentPlanFailure(failure)) {
+                  setError(`Playback error: ${failure.message ?? failure.classification}`);
+                }
+              },
+            });
+            setBrowserEngineActive(true);
+            setEngineTransportRevision((revision) => revision + 1);
+            attemptAutoplayWhenReady();
+          } catch (error) {
+            if (
+              !destroyed &&
+              !reportCurrentPlanFailure({
+                classification: "player_initialization_error",
+                message:
+                  error instanceof Error ? error.message : "Failed to load the browser engine.",
+              })
+            ) {
+              setError("Failed to load video player.");
+            }
+          }
+          return;
+        }
         // Direct play — set video src directly. Starting playback goes through
         // the same readiness gate as HLS rather than calling play() against a
         // src that has not loaded yet: a play issued at HAVE_NOTHING is racing
         // the load algorithm that is about to seek to the resume position, and
         // the spec has that algorithm reject it.
         video.src = effectiveStreamUrl;
-        video.currentTime = effectiveInitialPosition;
-        attemptAutoplayWhenReady();
+        if (playsOriginalFile) {
+          // The original file's clock can start at the container's start time
+          // instead of zero. Load without a start position so currentTime at
+          // loadedmetadata reports where the clock starts, fold that into the
+          // timeline offset, then seek to the start position on the corrected
+          // clock. Subtitles, seeks, and progress then share the media timeline
+          // the server's streams use.
+          directPlayOriginPendingRef.current = true;
+          directPlayMetadataHandler = () => {
+            directPlayMetadataHandler = null;
+            directPlayOriginPendingRef.current = false;
+            const origin = Number.isFinite(video.currentTime) ? Math.max(0, video.currentTime) : 0;
+            const planOffset = planTimelineOffsetRef.current;
+            timelineOffsetRef.current = planOffset - origin;
+            setDirectPlayOriginSeconds(origin);
+            // A seek made while the origin was unknown wins over the start position.
+            const mediaTarget =
+              pendingSeekTimeRef.current ?? toMediaTime(effectiveInitialPosition, planOffset);
+            const target = toPlayerTime(mediaTarget, timelineOffsetRef.current);
+            if (Math.abs(video.currentTime - target) > 0.01) video.currentTime = target;
+            applyElementDuration(video);
+            attemptAutoplayWhenReady();
+          };
+          video.addEventListener("loadedmetadata", directPlayMetadataHandler, { once: true });
+        } else {
+          video.currentTime = effectiveInitialPosition;
+          attemptAutoplayWhenReady();
+        }
       }
     }
 
@@ -2273,6 +2684,13 @@ export function VideoPlayer({
     return () => {
       destroyed = true;
       cleanupStartupListeners();
+      if (engineSession) {
+        // Restores the element's own media pipeline before it is reset below.
+        engineSession.destroy();
+        engineSession = null;
+        setBrowserEngineActive(false);
+        setEngineTransportRevision((revision) => revision + 1);
+      }
       if (hls) {
         hls.destroy();
         hlsRef.current = null;
@@ -2288,11 +2706,13 @@ export function VideoPlayer({
     // `planRevision` is the single signal that the transport changed: two plans
     // can share a stream URL and still differ in protocol, timeline, or recipe.
   }, [
+    applyElementDuration,
     effectiveStreamUrl,
     effectiveInitialPosition,
     isHlsStream,
     isPlayerReady,
     planRevision,
+    playsOriginalFile,
     plannedBitrateKbps,
     plannedDynamicRange,
     reportCurrentPlanFailure,
@@ -2311,10 +2731,21 @@ export function VideoPlayer({
         return;
       }
       setPlaying(true);
+      const idleSince = transportIdleSinceRef.current;
+      transportIdleSinceRef.current = null;
+      if (idleSince !== null && Date.now() - idleSince >= PROGRESSIVE_REMUX_IDLE_REOPEN_MS) {
+        reopenIdleProgressiveRemuxRef.current();
+      }
     };
     const onPause = () => {
       resetRoomCatchupRate();
       setPlaying(false);
+      // Only a stream that played or has opened. The pause a teardown queues
+      // arrives after the next transport has started over, before it has
+      // metadata.
+      if (streamPlayedRef.current || video.readyState >= HTMLMediaElement.HAVE_METADATA) {
+        transportIdleSinceRef.current ??= Date.now();
+      }
     };
     const clearBuffering = () => {
       if (bufferingTimerRef.current) {
@@ -2336,21 +2767,27 @@ export function VideoPlayer({
     // counting it would cancel the render: no loading overlay, a startup
     // guard marked started, and the new transport's first frame never seen.
     const hasCurrentFrame = () => video.readyState >= HTMLMediaElement.HAVE_CURRENT_DATA;
+    // Until an original file's clock origin is known the element has no media;
+    // its events are load resets. They must not settle a held seek or move the
+    // shown position off where playback is heading.
+    const resolveSeekAt = (actualTime: number) =>
+      directPlayOriginPendingRef.current
+        ? { currentTime: pendingSeekTime ?? subtitleFetchAnchorRef.current, pendingSeekTime }
+        : resolvePendingSeekTime(actualTime, pendingSeekTime);
+    // The media reached the viewer's held room request: the controls follow
+    // the media again.
+    const releaseHeldSeekAt = (actualTime: number) => {
+      if (directPlayOriginPendingRef.current || roomHeldSeekRef.current === null) return;
+      if (remainingRoomHeldSeek(roomHeldSeekRef.current, actualTime) === null) holdRoomSeek(null);
+    };
     const onTimeUpdate = () => {
       const nextTime = toMediaTime(video.currentTime, timelineOffsetRef.current);
-      const resolved = resolvePendingSeekTime(nextTime, pendingSeekTime);
+      releaseHeldSeekAt(nextTime);
+      const resolved = resolveSeekAt(nextTime);
       setCurrentTime(resolved.currentTime);
       if (resolved.pendingSeekTime !== pendingSeekTime) {
         setPendingSeekTime(resolved.pendingSeekTime);
       }
-      // A rate-based room catch-up that reached the advancing room position
-      // returns to 1x.
-      const catchupTarget = roomCatchupTargetRef.current;
-      if (catchupTarget !== null && roomCatchupConverged(catchupTarget, nextTime, Date.now())) {
-        roomCatchupTargetRef.current = null;
-        video.playbackRate = 1;
-        settleRoomReloads(roomReloadBudgetRef.current);
-      }
       // A correction's reloaded media is playing. How long it took to load
       // becomes the lead for the next reload.
       if (
@@ -2359,7 +2796,7 @@ export function VideoPlayer({
         video.readyState >= HTMLMediaElement.HAVE_FUTURE_DATA &&
         roomReloadLanded(roomReloadBudgetRef.current, nextTime)
       ) {
-        landRoomReload(roomReloadBudgetRef.current, Date.now());
+        landRoomReload(roomReloadBudgetRef.current, performance.now());
       }
       // timeupdate is the most reliable signal that frames are rendering.
       // Also clears any stale buffering state from HLS segment transitions
@@ -2371,10 +2808,9 @@ export function VideoPlayer({
       }
     };
     const onSeeked = () => {
-      const resolved = resolvePendingSeekTime(
-        toMediaTime(video.currentTime, timelineOffsetRef.current),
-        pendingSeekTime,
-      );
+      const seekedTime = toMediaTime(video.currentTime, timelineOffsetRef.current);
+      releaseHeldSeekAt(seekedTime);
+      const resolved = resolveSeekAt(seekedTime);
       setCurrentTime(resolved.currentTime);
       setPendingSeekTime(resolved.pendingSeekTime);
       // Reloading a stream can finish an older native seek. It does not settle
@@ -2388,15 +2824,7 @@ export function VideoPlayer({
       if (hasCurrentFrame()) markPlaybackStarted();
       clearBuffering();
     };
-    const onDurationChange = () => {
-      if (video.duration && isFinite(video.duration)) {
-        // For HLS EVENT playlists still being written, the element reports the
-        // length produced so far. The plan's source duration is the media's
-        // full runtime, so it wins whenever the engine reports something short.
-        if (backendDurationRef.current && video.duration < backendDurationRef.current) return;
-        setDuration(video.duration);
-      }
-    };
+    const onDurationChange = () => applyElementDuration(video);
     const onProgress = () => setBuffered(video.buffered);
     const onVolumeChange = () => {
       // A room seek pre-roll mutes the element for a moment. That mute is not
@@ -2466,6 +2894,8 @@ export function VideoPlayer({
       }
     };
     const onVideoEnded = () => {
+      // The stream finished, so there is nothing left to reopen.
+      transportIdleSinceRef.current = null;
       if (endedFiredRef.current) return;
       endedFiredRef.current = true;
       setHasEnded(true);
@@ -2515,6 +2945,8 @@ export function VideoPlayer({
     // deps are intentionally narrowed to the primitives the handlers read so
     // room snapshot churn doesn't re-subscribe every listener.
   }, [
+    applyElementDuration,
+    holdRoomSeek,
     pendingSeekTime,
     reportConnectionLost,
     reportCurrentPlanFailure,
@@ -2791,14 +3223,17 @@ export function VideoPlayer({
     }
     return 0;
   })();
-  const subtitlesLifted =
-    displayMode === "foreground" &&
-    controlsVisible &&
-    subtitleSettings.position !== "top" &&
-    controlBarHeight > 0;
-  const subtitleLiftPx = subtitlesLifted
-    ? Math.max(0, controlBarHeight + SUBTITLE_HUD_GAP - baseSubtitleBottomPx)
-    : 0;
+  // Height the bar and its gap cover at the bottom of the player. PGS
+  // bitmaps carry their own position, so they clear this whatever the text
+  // position setting says.
+  const subtitleHudInsetPx =
+    displayMode === "foreground" && controlsVisible && controlBarHeight > 0
+      ? controlBarHeight + SUBTITLE_HUD_GAP
+      : 0;
+  const subtitleLiftPx =
+    subtitleSettings.position !== "top"
+      ? Math.max(0, subtitleHudInsetPx - baseSubtitleBottomPx)
+      : 0;
 
   // -- Subtitle cue matching --
   // Returns active cue texts for custom rendering instead of native TextTrack
@@ -2832,8 +3267,35 @@ export function VideoPlayer({
     videoFit,
     coverCrop,
     activeSubtitleCueRevision,
+    engineTransportRevision,
   );
-  const subtitleLoadState = isASSActive ? assSubtitleState : textSubtitleState;
+
+  // -- PGS rendering (client-side Blu-ray bitmaps) --
+  // The server sends embedded PGS as a `.sup` sidecar because the web player
+  // declares `embedded_bitmap`. A plan that still burns the track in (an older
+  // selection, or a route that cannot carry the sidecar) is drawn by the
+  // server, so the overlay stays off to avoid doubling it.
+  const [pgsSubtitleState, setPGSSubtitleState] = useState("idle");
+  const pgsCanvasRef = useRef<HTMLCanvasElement>(null);
+  const { isActive: isPGSActive } = usePGSSubtitles({
+    videoRef,
+    canvasRef: pgsCanvasRef,
+    subtitleUrls,
+    activeSubtitleIndex,
+    enabled: !isDetached && plan.subtitle.mode !== "burn_in",
+    streamOriginSeconds: timelineOffsetSeconds,
+    subtitleDelayMs,
+    durationRef,
+    fetchAnchorRef: subtitleFetchAnchorRef,
+    videoFit,
+    bottomInsetPx: subtitleHudInsetPx,
+    onLoadState: setPGSSubtitleState,
+  });
+  const subtitleLoadState = isASSActive
+    ? assSubtitleState
+    : isPGSActive
+      ? pgsSubtitleState
+      : textSubtitleState;
   const subtitleSyncFeedback = useSubtitleSyncFeedback({
     sync: subtitleSync,
     tracks: subtitleUrls,
@@ -3061,8 +3523,13 @@ export function VideoPlayer({
   const handlePlayPause = useCallback(() => setPlayback("toggle"), [setPlayback]);
 
   const handleFullscreenToggle = useCallback(() => {
-    toggleFullscreen(fullscreenRootRef?.current ?? containerRef.current, videoRef.current);
-  }, [fullscreenRootRef]);
+    // The engine draws on a canvas beside the <video>, so the video's own
+    // native fullscreen (the iPhone fallback) would show an empty player.
+    toggleFullscreen(
+      fullscreenRootRef?.current ?? containerRef.current,
+      browserEngineActive ? null : videoRef.current,
+    );
+  }, [browserEngineActive, fullscreenRootRef]);
 
   const handleSurfaceTap = useCallback(
     (event?: React.MouseEvent<HTMLElement>) => {
@@ -3148,6 +3615,54 @@ export function VideoPlayer({
   useEffect(() => {
     reportRoomReadyRef.current = watchTogetherSync.reportReady;
   }, [watchTogetherSync.reportReady]);
+  const carryStreamRebuildRef = useRef(watchTogetherSync.carryStreamRebuild);
+  useEffect(() => {
+    carryStreamRebuildRef.current = watchTogetherSync.carryStreamRebuild;
+  }, [watchTogetherSync.carryStreamRebuild]);
+
+  // Seeks for room sync, remembered so a repeat of a seek still loading can
+  // be recognized and skipped.
+  const issueRoomSeek = useCallback(
+    (seconds: number, commandId: string | null): boolean | Promise<boolean> => {
+      roomIssuedSeekRef.current = {
+        targetSeconds: seconds,
+        issuedAtMs: performance.now(),
+        commandId,
+      };
+      if (
+        roomHeldSeekRef.current !== null &&
+        remainingRoomHeldSeek(roomHeldSeekRef.current, seconds) === null
+      ) {
+        holdRoomSeek(null);
+      }
+      return performPlayerSeekRef.current(seconds);
+    },
+    [holdRoomSeek],
+  );
+
+  // A held request belongs to the playback session and room selection it was
+  // made in; a new title or session will not answer it.
+  const roomHeldSeekSelectionRevision = watchTogether.room?.selection_revision;
+  useEffect(() => {
+    abandonRoomHeldSeek();
+  }, [abandonRoomHeldSeek, roomHeldSeekSelectionRevision, sessionId]);
+
+  // A held request belongs to a live room connection; with none, nothing will
+  // answer it.
+  useEffect(() => {
+    if (
+      !watchTogetherRoomId ||
+      watchTogether.closedReason ||
+      watchTogether.connectionState !== "connected"
+    ) {
+      holdRoomSeek(null);
+    }
+  }, [
+    holdRoomSeek,
+    watchTogether.closedReason,
+    watchTogether.connectionState,
+    watchTogetherRoomId,
+  ]);
 
   useEffect(() => {
     const command = watchTogether.transportCommand;
@@ -3159,20 +3674,13 @@ export function VideoPlayer({
       !command ||
       roomSelectionRevision === undefined ||
       roomSelectionRevision === null ||
-      !sessionId
+      !sessionId ||
+      (command.session_id && command.session_id !== sessionId) ||
+      command.selection_revision !== roomSelectionRevision
     ) {
       lastRoomCommandIdRef.current = null;
       appliedRoomCommandIdRef.current = null;
-      return;
-    }
-    if (command.session_id && command.session_id !== sessionId) {
-      lastRoomCommandIdRef.current = null;
-      appliedRoomCommandIdRef.current = null;
-      return;
-    }
-    if (command.selection_revision !== roomSelectionRevision) {
-      lastRoomCommandIdRef.current = null;
-      appliedRoomCommandIdRef.current = null;
+      roomReferenceRef.current = null;
       return;
     }
     if (command.command_id === lastRoomCommandIdRef.current) {
@@ -3181,6 +3689,15 @@ export function VideoPlayer({
 
     lastRoomCommandIdRef.current = command.command_id;
     appliedRoomCommandIdRef.current = null;
+    // The room's seek for the held request. A seek for an earlier press in a
+    // burst does not answer it.
+    if (
+      command.action === "seek" &&
+      roomHeldSeekRef.current !== null &&
+      remainingRoomHeldSeek(roomHeldSeekRef.current, command.position_seconds) === null
+    ) {
+      roomHeldSeekAnsweredRef.current = true;
+    }
 
     if (roomCommandTimerRef.current !== null) {
       window.clearTimeout(roomCommandTimerRef.current);
@@ -3192,55 +3709,118 @@ export function VideoPlayer({
       ? serverExecuteAt - watchTogether.serverTimeOffsetMs
       : Date.now();
     const delay = Math.max(0, localExecuteAt - Date.now());
+    // The command's position is the room position at execute_at, advancing
+    // from there while the room plays.
+    const reference: RoomPositionReference = {
+      positionSeconds: command.position_seconds,
+      executeAtServerMs: localExecuteAt + watchTogether.serverTimeOffsetMs,
+      playing: command.playback_state === "playing",
+    };
 
-    const applyRoomPosition = (video: HTMLVideoElement) => {
-      if (command.action === "pause" || command.action === "seek") {
-        resetRoomCatchupRate();
+    // Applies the command's position at execution; see decideRoomCommand.
+    // Play state is the caller's: a play command plays at 1x afterwards unless
+    // this starts a nudge.
+    // Returns false when playback must not start: the element ended and the
+    // room is at or past its end.
+    const applyRoomPosition = (video: HTMLVideoElement): boolean => {
+      // A play command is the room's new reference; it supersedes an earlier
+      // seek target the element never settled on (one that landed more than
+      // the settle tolerance away). Left pending, that target would pin the
+      // shown time and hold the drift loop off for good. A seek still running
+      // or a stream still being replaced is genuinely in progress and stays.
+      const pendingSeekSeconds = pendingSeekTimeRef.current;
+      if (
+        command.action === "play" &&
+        pendingSeekSeconds !== null &&
+        !video.seeking &&
+        !planChangeInFlightRef.current
+      ) {
+        releasePendingSeek(pendingSeekSeconds);
       }
+      // Only a viewer that keeps playing through a play command keeps (or
+      // starts) a nudge; everything else runs at 1x.
+      if (command.action !== "play" || video.paused) resetRoomCatchupRate();
+      if (command.action === "pause") video.pause();
       const reloadBudget = roomReloadBudgetRef.current;
       if (command.action === "seek") {
         // An explicit room seek supersedes any correction reload.
-        abandonRoomReload(reloadBudget, Date.now());
+        abandonRoomReload(reloadBudget, performance.now());
         settleRoomReloads(reloadBudget);
+      } else if (command.action === "pause" && reloadBudget.targetSeconds !== null) {
+        // The room stopped; the reload no longer chases a moving position.
+        abandonRoomReload(reloadBudget, performance.now());
       }
 
-      // Room corrections land here. Small drift against a target the element
-      // cannot reach without a rebuild converges via playbackRate instead of
-      // forcing a seek-reanchor replan; see roomSyncCatchup.ts.
-      const catchupTarget: RoomCatchupTarget = {
-        positionSeconds: command.position_seconds,
-        executeAtMs: localExecuteAt,
-      };
-      // A late play command must choose its correction against the same
-      // advancing position used to detect convergence.
-      const targetPositionSeconds =
-        command.action === "play"
-          ? roomCatchupExpectedPosition(catchupTarget, Date.now())
-          : command.position_seconds;
+      // Projected to the actual execution moment: a late command lands where
+      // the room is now, not where it was at execute_at.
+      const targetPositionSeconds = roomPositionAt(
+        reference,
+        Date.now(),
+        serverTimeOffsetRef.current,
+      );
+      const localPlaying = !video.paused;
       const targetLocallySeekable =
         canSeekAnywhere ||
         isNativePositionInRanges(
           video.seekable,
           toPlayerTime(targetPositionSeconds, timelineOffsetRef.current),
         );
-      const decision = decideRoomCatchup({
+      let decision = decideRoomCommand({
         action: command.action,
         targetPositionSeconds,
-        localPositionSeconds: toMediaTime(video.currentTime, timelineOffsetRef.current),
+        localPositionSeconds:
+          elementMediaPosition() ?? toMediaTime(video.currentTime, timelineOffsetRef.current),
+        localPlaying,
+        rateCapable: roomRateCapableRef.current,
         targetLocallySeekable,
       });
+      if (command.action === "play" && video.ended) {
+        // play() on an ended element starts over from the beginning. A room
+        // at or past the movie's end leaves it ended; one still short of the
+        // end is sought to first, however small the gap. The movie's runtime
+        // comes from the server: a progressive window can end well before it.
+        const localEndSeconds =
+          mediaDurationSeconds(
+            backendDurationRef.current,
+            Number.isFinite(video.duration)
+              ? toMediaTime(video.duration, timelineOffsetRef.current)
+              : undefined,
+          ) ?? Number.POSITIVE_INFINITY;
+        if (targetPositionSeconds >= localEndSeconds - roomSyncDeadbandSeconds) return false;
+        decision = { kind: "seek" };
+      }
 
+      const issued = roomIssuedSeekRef.current;
+      if (
+        decision.kind === "seek" &&
+        roomSeekAlreadyPending(
+          issued,
+          pendingSeekTimeRef.current,
+          targetPositionSeconds,
+          performance.now(),
+        )
+      ) {
+        // The previous command's seek to this position is still loading. A
+        // second one would reload or rebuild the stream all over again; the
+        // running one serves this command, pre-roll included.
+        carryStreamRebuildRef.current(issued?.commandId ?? null, command.command_id);
+        return true;
+      }
       const targetBuffered = isNativePositionInRanges(
         video.buffered,
         toPlayerTime(targetPositionSeconds, timelineOffsetRef.current),
       );
-      if (decision.kind === "seek" && command.action === "play" && !targetBuffered) {
+      // A player without rate nudges takes any target it reaches in place
+      // directly; only a load beyond that goes through the reload budget.
+      const reloadNeeded =
+        !targetBuffered && (roomRateCapableRef.current || !targetLocallySeekable);
+      if (decision.kind === "seek" && command.action === "play" && reloadNeeded) {
         // A correction to media that is not buffered yet loads it: a range
         // request or a stream rebuild. Keep playing behind the room while an
         // earlier reload is still loading or the backoff runs; the server
         // repeats corrections that still apply.
-        const now = Date.now();
-        if (!roomReloadAllowed(reloadBudget, now)) return;
+        const now = performance.now();
+        if (!roomReloadAllowed(reloadBudget, now)) return true;
         const reloadTarget = beginRoomReload(
           reloadBudget,
           targetPositionSeconds,
@@ -3251,23 +3831,36 @@ export function VideoPlayer({
         // Only this reload's own seek counts as its load: an in-stream seek
         // that was taken, or an adopted reanchor. Other stream swaps, such as
         // a subtitle replan, cannot settle it.
-        void Promise.resolve(performPlayerSeekRef.current(reloadTarget)).then((accepted) => {
+        void Promise.resolve(issueRoomSeek(reloadTarget, command.command_id)).then((accepted) => {
           if (reloadBudget.generation !== reloadGeneration) return;
           if (accepted) noteRoomReloadLoading(reloadBudget);
-          else abandonRoomReload(reloadBudget, Date.now());
+          else abandonRoomReload(reloadBudget, performance.now());
         });
       } else if (decision.kind === "seek") {
-        performPlayerSeekRef.current(targetPositionSeconds);
+        // This seek replaces a reload still loading toward an older target.
+        if (reloadBudget.targetSeconds !== null) {
+          abandonRoomReload(reloadBudget, performance.now());
+        }
+        if (!roomRateCapableRef.current && command.action === "play" && localPlaying) {
+          // A correcting seek for a player without rate nudges: aimed ahead
+          // by what earlier seeks fell short, and measured by the drift loop.
+          const corrector = roomSeekCorrectorRef.current;
+          noteRoomCorrectorSeek(corrector, performance.now());
+          issueRoomSeek(
+            roomCorrectorSeekTarget(corrector, targetPositionSeconds),
+            command.command_id,
+          );
+        } else {
+          issueRoomSeek(targetPositionSeconds, command.command_id);
+        }
       } else if (decision.kind === "rate") {
+        roomNudgeActiveRef.current = true;
         video.playbackRate = decision.rate;
-        // The room keeps advancing at 1x from the command's execution, so
-        // convergence tracks that moving position, not the static one.
-        roomCatchupTargetRef.current = catchupTarget;
-      } else {
-        // Already at the room position; drop any stale convergence nudge.
-        resetRoomCatchupRate();
-        if (command.action === "play") settleRoomReloads(reloadBudget);
+      } else if (command.action === "play" && localPlaying) {
+        // Already with the room; the drift loop ends any running nudge.
+        settleRoomReloads(reloadBudget);
       }
+      return true;
     };
 
     roomCommandTimerRef.current = window.setTimeout(() => {
@@ -3279,13 +3872,23 @@ export function VideoPlayer({
         }
 
         appliedRoomCommandIdRef.current = command.command_id;
-        applyRoomPosition(video);
+        roomReferenceRef.current = reference;
+        roomCommandFinishedAtRef.current = performance.now();
+        // The room's seek for the held request, or a command that replaced it
+        // before it ran, ends the hold. A newer request since resets it. The
+        // seek itself keeps the pending target, which may be a stream rebuild
+        // to the same place already loading; a replacing command drops it.
+        if (roomHeldSeekAnsweredRef.current) {
+          if (command.action === "seek") holdRoomSeek(null);
+          else abandonRoomHeldSeek();
+        }
+        const playAllowed = applyRoomPosition(video);
 
-        if (command.action === "pause" || command.action === "seek") {
+        if (command.action === "seek") {
           video.pause();
         }
 
-        if (command.action === "play") {
+        if (command.action === "play" && playAllowed) {
           try {
             await video.play();
           } catch (error) {
@@ -3314,7 +3917,8 @@ export function VideoPlayer({
                   return;
                 const currentVideo = videoRef.current;
                 if (!currentVideo) return;
-                applyRoomPosition(currentVideo);
+                roomCommandFinishedAtRef.current = performance.now();
+                if (!applyRoomPosition(currentVideo)) return;
                 void currentVideo
                   .play()
                   .then(() => {
@@ -3341,7 +3945,13 @@ export function VideoPlayer({
         if (command.playback_state === "waiting") {
           reportRoomReadyRef.current();
         }
-      })().catch(() => {});
+      })()
+        .catch(() => {})
+        .finally(() => {
+          if (lastRoomCommandIdRef.current === command.command_id) {
+            roomCommandFinishedAtRef.current = performance.now();
+          }
+        });
     }, delay);
 
     return () => {
@@ -3354,7 +3964,12 @@ export function VideoPlayer({
       }
     };
   }, [
+    abandonRoomHeldSeek,
     canSeekAnywhere,
+    elementMediaPosition,
+    holdRoomSeek,
+    issueRoomSeek,
+    releasePendingSeek,
     resetRoomCatchupRate,
     sessionId,
     watchTogetherRoomId,
@@ -3386,6 +4001,98 @@ export function VideoPlayer({
     resetRoomCatchupRate,
   ]);
 
+  // Continuous drift loop: while the room and this viewer both play, absorb
+  // drift from the room reference with a rate nudge. It never seeks a player
+  // that can nudge; drift too large for a nudge is the server's to correct,
+  // and that correction arrives as a command. A player room sync does not
+  // nudge seeks within reach instead. Around a command (scheduled,
+  // just executed, or loading media) the loop only waits, before looking at
+  // the room state: the snapshot that announces a command can arrive before
+  // it executes, and a received command must not change the rate. Otherwise,
+  // when the room or this element stops playing, a running nudge returns to 1x.
+  const roomPhase = watchTogether.room?.phase;
+  const roomPlaybackState = watchTogether.room?.playback_state;
+  useEffect(() => {
+    if (!roomPlaybackActive || !roomConnected) return;
+    const tick = () => {
+      const video = videoRef.current;
+      if (!video) return;
+      const reloadBudget = roomReloadBudgetRef.current;
+      const monotonicMs = performance.now();
+      if (reloadBudget.targetSeconds !== null && !roomReloadInFlight(reloadBudget, monotonicMs)) {
+        // A reload that never landed; stop waiting for it.
+        expireRoomReload(reloadBudget, monotonicMs);
+      }
+      if (
+        roomCommandTimerRef.current !== null ||
+        monotonicMs - roomCommandFinishedAtRef.current < roomSyncLoopSettleMs ||
+        roomReloadInFlight(reloadBudget, monotonicMs)
+      ) {
+        return;
+      }
+      const corrector = roomSeekCorrectorRef.current;
+      const reference = roomReferenceRef.current;
+      const localPosition = elementMediaPosition();
+      if (video.seeking || pendingSeekTimeRef.current !== null) {
+        // Seek spacing counts from when a seek finished, not when it began.
+        corrector.lastSeekAtMs = monotonicMs;
+      }
+      if (
+        roomPhase !== "playing" ||
+        roomPlaybackState !== "playing" ||
+        !reference?.playing ||
+        video.paused ||
+        video.ended ||
+        video.seeking ||
+        video.readyState < HTMLMediaElement.HAVE_FUTURE_DATA ||
+        directPlayOriginPendingRef.current ||
+        pendingSeekTimeRef.current !== null ||
+        localPosition === null
+      ) {
+        if (roomNudgeActiveRef.current) resetRoomCatchupRate();
+        return;
+      }
+      // The room position maps through the server clock, so it uses wall time.
+      const roomPosition = roomPositionAt(reference, Date.now(), serverTimeOffsetRef.current);
+      const drift = roomPosition - localPosition;
+      if (!roomRateCapableRef.current) {
+        if (roomNudgeActiveRef.current) resetRoomCatchupRate();
+        // Playback runs again after a correcting seek: measure where it landed.
+        observeRoomCorrector(corrector, drift);
+        const target = roomCorrectorSeekTarget(corrector, roomPosition);
+        const seekable =
+          canSeekAnywhere ||
+          isNativePositionInRanges(video.seekable, toPlayerTime(target, timelineOffsetRef.current));
+        if (roomCorrectorSeekDue(corrector, drift, seekable, monotonicMs)) {
+          noteRoomCorrectorSeek(corrector, monotonicMs);
+          issueRoomSeek(target, appliedRoomCommandIdRef.current);
+        }
+        return;
+      }
+      const rate = nextRoomNudgeRate(drift, roomNudgeActiveRef.current);
+      if (rate === 1) {
+        if (roomNudgeActiveRef.current) resetRoomCatchupRate();
+        // This viewer reached the room; the next drift starts a fresh backoff.
+        if (Math.abs(drift) <= roomSyncDeadbandSeconds) settleRoomReloads(reloadBudget);
+        return;
+      }
+      roomNudgeActiveRef.current = true;
+      // Setting the rate never resumes a paused element.
+      if (video.playbackRate !== rate) video.playbackRate = rate;
+    };
+    const intervalId = window.setInterval(tick, roomSyncLoopIntervalMs);
+    return () => window.clearInterval(intervalId);
+  }, [
+    canSeekAnywhere,
+    elementMediaPosition,
+    issueRoomSeek,
+    resetRoomCatchupRate,
+    roomConnected,
+    roomPhase,
+    roomPlaybackActive,
+    roomPlaybackState,
+  ]);
+
   const handleMutedChange = useCallback(
     (m: boolean) => {
       const video = videoRef.current;
@@ -3423,7 +4130,9 @@ export function VideoPlayer({
     skipActions,
     toggleCaptions,
     handleToggleMuted,
-    handleTogglePiP,
+    // The engine draws on a canvas, which cannot float; the control is hidden
+    // too, so the shortcut does nothing rather than reject.
+    browserEngineActive ? undefined : handleTogglePiP,
     displayMode === "foreground",
   );
 
@@ -3433,6 +4142,8 @@ export function VideoPlayer({
       // A new quality replaces the stream; reload pacing from the old one
       // does not apply to it.
       roomReloadBudgetRef.current = createRoomReloadBudget();
+      roomIssuedSeekRef.current = null;
+      roomSeekCorrectorRef.current = createRoomSeekCorrector();
       onQualitySelect?.(id, currentTime);
     },
     [currentTime, onQualitySelect],
@@ -3459,9 +4170,45 @@ export function VideoPlayer({
     handleQualitySelectRef.current = handleQualitySelect;
   }, [handleQualitySelect]);
 
+  // A new plan is a new transport; the previous one's failed requests say
+  // nothing about it.
+  useEffect(() => {
+    lastTransportErrorAtRef.current = 0;
+  }, [planRevision]);
+
+  // Auto plays the source unless a measured estimate says the link cannot
+  // carry it. When the link proves slower, record what it could not sustain
+  // and replan Auto, which reads that lower estimate. Rooms have their own
+  // lower-quality offer.
+  useAutoQualityDownshift({
+    videoRef,
+    // Buffering while the session reconnects is the outage, not a slow link.
+    enabled:
+      activeQualityId === "auto" && !watchTogetherRoomActive && connectionStatus === "connected",
+    sessionId,
+    // Only an adopted plan resets stall history; in-place plan updates such
+    // as a newly ready subtitle must not drop a stall in progress.
+    planIdentity: planRevision,
+    deliveredKbps: plan.effective_recipe.bitrate_kbps ?? plan.source.bitrate_kbps,
+    transportTrouble: () =>
+      (typeof navigator !== "undefined" && navigator.onLine === false) ||
+      Date.now() - lastTransportErrorAtRef.current < TRANSPORT_TROUBLE_WINDOW_MS,
+    onDownshift: (estimateKbps) => {
+      recordObservedBandwidthLimitKbps(estimateKbps);
+      setNotice({
+        title: "Lowering quality",
+        message: "Playback kept buffering, so Auto is switching to a lower bitrate.",
+        tone: "info",
+      });
+      handleQualitySelectRef.current("auto");
+    },
+  });
+
   // Rebuild pacing belongs to one stream in one room.
   useEffect(() => {
     roomReloadBudgetRef.current = createRoomReloadBudget();
+    roomIssuedSeekRef.current = null;
+    roomSeekCorrectorRef.current = createRoomSeekCorrector();
   }, [sessionId, watchTogetherRoomId]);
 
   // Stall history is judged per quality: choosing another starts over, and an
@@ -3473,18 +4220,18 @@ export function VideoPlayer({
   }, [activeQualityId, sessionId, watchTogetherRoomId]);
 
   const lowerQualityChoiceRef = useRef(() =>
-    lowerQualityOption(qualityOptions, activeQualityId, plan.effective_recipe),
+    lowerQualityOption(qualityOptions, activeQualityId, plan.effective_recipe, plan.source),
   );
   useEffect(() => {
     lowerQualityChoiceRef.current = () =>
-      lowerQualityOption(qualityOptions, activeQualityId, plan.effective_recipe);
+      lowerQualityOption(qualityOptions, activeQualityId, plan.effective_recipe, plan.source);
     // A replan can leave no lower rung; an offer that cannot act is withdrawn.
     if (!lowerQualityChoiceRef.current()) {
       setNotice((current) =>
         current?.actionLabel === LOWER_QUALITY_ACTION_LABEL ? null : current,
       );
     }
-  }, [activeQualityId, plan.effective_recipe, qualityOptions]);
+  }, [activeQualityId, plan.effective_recipe, plan.source, qualityOptions]);
 
   // A viewer who keeps stalling in a room cannot keep up at this quality.
   // Offer one step down, once per quality; the room's shared source is kept.
@@ -3494,7 +4241,7 @@ export function VideoPlayer({
     const recent = roomStallTimesRef.current.filter((at) => now - at < ROOM_STALL_WINDOW_MS);
     roomStallTimesRef.current = recent;
     if (recent.length < ROOM_STALLS_BEFORE_LOWER_QUALITY) return;
-    if (!lowerQualityOption(qualityOptions, activeQualityId, plan.effective_recipe)) {
+    if (!lowerQualityOption(qualityOptions, activeQualityId, plan.effective_recipe, plan.source)) {
       return;
     }
     lowerQualityOfferedRef.current = true;
@@ -3512,6 +4259,7 @@ export function VideoPlayer({
   }, [
     activeQualityId,
     plan.effective_recipe,
+    plan.source,
     qualityOptions,
     roomStallSignal,
     showWatchTogetherNotice,
@@ -4062,6 +4810,16 @@ export function VideoPlayer({
       {/* Subtitle tracks are managed programmatically by useSubtitleTracks
           instead of <track> elements, so subtitle rendering stays on the same
           media timeline as restarted HLS playback. */}
+      {/* Browser decode engine picture. It sits under the <video>, which has no
+          source of its own then and stays the transparent, clickable surface
+          every hook binds to. */}
+      <div
+        ref={engineSurfaceRef}
+        aria-hidden="true"
+        className="pointer-events-none absolute inset-0"
+        style={browserEngineActive ? undefined : { display: "none" }}
+      />
+
       <video
         ref={videoRef}
         className={`${isDetached ? "h-full w-full" : "absolute inset-0 h-full w-full"} ${
@@ -4072,6 +4830,16 @@ export function VideoPlayer({
         style={!isPlayerReady ? { visibility: "hidden" } : undefined}
       />
 
+      {/* PGS bitmap subtitles. The canvas spans the player rather than the
+          picture so a disc's subtitles can sit in the letterbox, where they
+          were authored. */}
+      <canvas
+        ref={pgsCanvasRef}
+        aria-hidden="true"
+        className="pointer-events-none absolute inset-0 z-[5] h-full w-full"
+        style={isPGSActive ? undefined : { display: "none" }}
+      />
+
       {subtitleSyncNotice && (
         <SubtitleSyncIndicator
           notice={subtitleSyncNotice}
@@ -4097,7 +4865,7 @@ export function VideoPlayer({
         )}
 
       {/* Subtitle overlay — suppressed when JASSUB (ASS) is rendering; bitmap
-          tracks are burned into the video server-side and never reach here.
+          tracks are drawn by the PGS canvas above or burned in by the server.
           While the control bar is up, bottom-anchored cues rise just above it
           (subtitleLiftPx) so they never overlap the HUD; they settle back when
           it hides. z-[5] keeps cues below the controls layer (z-10) as a
@@ -4176,7 +4944,7 @@ export function VideoPlayer({
           skipSeconds={seekIntervals}
           onSkip={skipActions}
           playing={playing}
-          currentTime={currentTime}
+          currentTime={roomHeldSeek ?? currentTime}
           duration={duration}
           buffered={buffered}
           chapters={chapters}
@@ -4214,6 +4982,7 @@ export function VideoPlayer({
           qualityOptions={qualityOptions}
           activeQualityId={activeQualityId}
           deliveredRecipe={plan.effective_recipe}
+          playbackSource={plan.source}
           isTranscoding={replanning}
           qualityError={replanError}
           onQualitySelect={handleQualitySelect}
@@ -4235,7 +5004,9 @@ export function VideoPlayer({
               ? (fileId) => onSwitchVersion(fileId, currentTime)
               : undefined
           }
-          onTogglePiP={handleTogglePiP}
+          playbackSpeed={playbackSpeed}
+          onPlaybackSpeedChange={roomPlaybackActive ? undefined : setPlaybackSpeed}
+          onTogglePiP={browserEngineActive ? undefined : handleTogglePiP}
           onPlayPause={handlePlayPause}
           onSeek={handlePlayerSeek}
           onVolumeChange={handleVolumeChange}
@@ -4244,7 +5015,9 @@ export function VideoPlayer({
           onVideoFitToggle={() =>
             setVideoFit((current) => (current === "cover" ? "contain" : "cover"))
           }
-          onFullscreenToggle={handleFullscreenToggle}
+          onFullscreenToggle={
+            browserEngineActive && !document.fullscreenEnabled ? undefined : handleFullscreenToggle
+          }
           onSurfaceTap={handleSurfaceTap}
           showPlaybackInfo={showPlaybackInfo}
           onTogglePlaybackInfo={() => setShowPlaybackInfo((v) => !v)}
@@ -4270,6 +5043,7 @@ export function VideoPlayer({
           qualityPreference={activeQualityId}
           hlsRef={hlsRef}
           eventLog={eventLog}
+          browserEngine={browserEngineActive}
           onClose={() => setShowPlaybackInfo(false)}
         />
       )}
diff --git a/web/src/player/components/WatchPage.test.ts b/web/src/player/components/WatchPage.test.ts
index 835f364a68..27ca409dc9 100644
--- a/web/src/player/components/WatchPage.test.ts
+++ b/web/src/player/components/WatchPage.test.ts
@@ -106,6 +106,8 @@ function playbackSession(
     connectionStatus: "connected",
     connectionErrorTitle: null,
     connectionError: null,
+    browserEngine: null,
+    nativeOriginalSupport: { containers: [], videoCodecs: [], audioCodecs: [] },
     switchVersion: vi.fn(),
     switchAudioTrack: vi.fn(),
     changeSubtitleTrack: vi.fn(),
diff --git a/web/src/player/components/WatchPage.trickplay.test.ts b/web/src/player/components/WatchPage.trickplay.test.ts
index fa8c820ff2..02eec10003 100644
--- a/web/src/player/components/WatchPage.trickplay.test.ts
+++ b/web/src/player/components/WatchPage.trickplay.test.ts
@@ -116,6 +116,8 @@ function playbackSession(
     connectionStatus: "connected",
     connectionErrorTitle: null,
     connectionError: null,
+    browserEngine: null,
+    nativeOriginalSupport: { containers: [], videoCodecs: [], audioCodecs: [] },
     switchVersion: vi.fn(),
     switchAudioTrack: vi.fn(),
     changeSubtitleTrack: vi.fn(),
diff --git a/web/src/player/components/WatchPage.tsx b/web/src/player/components/WatchPage.tsx
index 795c888fe4..8c83e352c7 100644
--- a/web/src/player/components/WatchPage.tsx
+++ b/web/src/player/components/WatchPage.tsx
@@ -674,8 +674,11 @@ function WatchPagePlayer({
       streamUrl={session.streamUrl}
       plan={session.plan}
       planRevision={session.planRevision}
+      browserEngine={session.browserEngine}
+      nativeOriginalSupport={session.nativeOriginalSupport}
       shouldAutoPlay={session.shouldAutoPlay}
       replanning={session.replanning}
+      replacing={session.replacing}
       replanError={fallingBack ? null : session.error}
       replanErrorTitle={session.errorTitle}
       sessionId={session.sessionId}
diff --git a/web/src/player/components/subtitleTranslateRequest.ts b/web/src/player/components/subtitleTranslateRequest.ts
index c3d76b1c2b..bbd9187080 100644
--- a/web/src/player/components/subtitleTranslateRequest.ts
+++ b/web/src/player/components/subtitleTranslateRequest.ts
@@ -28,6 +28,8 @@ interface BuildSubtitleTranslateRequestInput {
   audioTracks?: PlayerAudioTrack[];
   audioIndex: number;
   targetLang: string;
+  /** False when the server cannot translate: audio jobs stay in the spoken language. */
+  translateTranscript?: boolean;
   sessionId?: string;
   startPosition: number;
 }
@@ -49,13 +51,15 @@ export function buildSubtitleTranslateRequest(
   if (input.mode === "audio") {
     const audio = input.audioTracks?.[input.audioIndex];
     const sourceLanguage = normalizeLanguageCode(audio?.language);
-    const sameLanguage = sourceLanguage !== "" && sourceLanguage === targetLanguage;
+    const plain =
+      input.translateTranscript === false ||
+      (sourceLanguage !== "" && sourceLanguage === targetLanguage);
     return {
       media_file_id: input.mediaFileId,
-      kind: sameLanguage ? "transcribe" : "transcribe_translate",
+      kind: plain ? "transcribe" : "transcribe_translate",
       source_index: input.audioIndex,
       source_language: sourceLanguage,
-      target_language: sameLanguage ? "" : targetLanguage,
+      target_language: plain ? "" : targetLanguage,
       session_id: input.sessionId ?? "",
       start_position: input.startPosition,
     };
diff --git a/web/src/player/engine/EnginePlayer.test.ts b/web/src/player/engine/EnginePlayer.test.ts
new file mode 100644
index 0000000000..98f1b1eb9c
--- /dev/null
+++ b/web/src/player/engine/EnginePlayer.test.ts
@@ -0,0 +1,1013 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { DECODER_RESTART_DELAY_MS, EnginePlayer, MAX_DECODER_RESTARTS } from "./EnginePlayer";
+import { DEFAULT_PICTURE_COLOR } from "./pictureColor";
+import { HDRPresenter, type PresenterEvents } from "./renderers";
+
+const audioOutput = vi.hoisted(() => ({
+  resumes: true,
+  state: "suspended" as AudioContextState,
+  contextTime: 0,
+}));
+
+vi.mock("./audioOutput", () => ({
+  EngineAudioOutput: {
+    create: vi.fn(async () => ({
+      context: {
+        get state() {
+          return audioOutput.state;
+        },
+        sampleRate: 48_000,
+      },
+      channels: 2,
+      connect: () => new MessageChannel().port2,
+      setGeneration: vi.fn(),
+      setPlaying: vi.fn(),
+      setRate: vi.fn(),
+      setVolume: vi.fn(),
+      resume: vi.fn(async () => {
+        if (audioOutput.resumes) audioOutput.state = "running";
+        return audioOutput.resumes;
+      }),
+      audibleContextTime: () => audioOutput.contextTime,
+      close: vi.fn(),
+    })),
+  },
+}));
+import type { PageToWorkerMessage, WorkerToPageMessage } from "./protocol";
+import type { EngineSourceSpec } from "./source";
+
+class FakeWorker {
+  static last: FakeWorker | null = null;
+  readonly posted: PageToWorkerMessage[] = [];
+  onmessage: ((event: MessageEvent<WorkerToPageMessage>) => void) | null = null;
+  onerror: ((event: ErrorEvent) => void) | null = null;
+  constructor() {
+    FakeWorker.last = this;
+  }
+  postMessage(message: PageToWorkerMessage) {
+    this.posted.push(message);
+  }
+  terminate() {}
+  emit(message: WorkerToPageMessage) {
+    this.onmessage?.({ data: message } as MessageEvent<WorkerToPageMessage>);
+  }
+  /** Generation of the last decode run the page started. */
+  get generation(): number {
+    const starts = this.posted.filter((m) => m.type === "start");
+    return (starts[starts.length - 1] as { generation: number }).generation;
+  }
+}
+
+function fakeFrame(seconds: number, durationSeconds = 0.04) {
+  return {
+    timestamp: seconds * 1e6,
+    duration: durationSeconds * 1e6,
+    displayWidth: 1920,
+    displayHeight: 1080,
+    close: vi.fn(),
+  } as unknown as VideoFrame;
+}
+
+const source: EngineSourceSpec = {
+  url: "/stream",
+  headers: {},
+  container: "mkv",
+  durationSeconds: 10,
+  startSeconds: 0,
+  video: { codec: "h264", width: 1920, height: 1080, transfer: "sdr", stripDolbyVision: false },
+  audio: null,
+};
+
+async function settle() {
+  await vi.advanceTimersByTimeAsync(50);
+}
+
+describe("EnginePlayer", () => {
+  let element: HTMLVideoElement;
+  let events: string[];
+
+  beforeEach(() => {
+    vi.useFakeTimers();
+    vi.stubGlobal("Worker", FakeWorker);
+    vi.stubGlobal(
+      "ResizeObserver",
+      class {
+        observe() {}
+        disconnect() {}
+      },
+    );
+    vi.stubGlobal("requestAnimationFrame", (callback: FrameRequestCallback) =>
+      setTimeout(() => callback(performance.now()), 16),
+    );
+    vi.stubGlobal("cancelAnimationFrame", (id: number) => clearTimeout(id));
+    vi.spyOn(HTMLCanvasElement.prototype, "getContext").mockImplementation(
+      () =>
+        ({
+          fillRect: vi.fn(),
+          drawImage: vi.fn(),
+          clearRect: vi.fn(),
+          translate: vi.fn(),
+          scale: vi.fn(),
+          rotate: vi.fn(),
+          resetTransform: vi.fn(),
+        }) as never,
+    );
+    element = document.createElement("video");
+    events = [];
+    for (const type of [
+      "loadstart",
+      "durationchange",
+      "loadedmetadata",
+      "loadeddata",
+      "canplay",
+      "play",
+      "playing",
+      "pause",
+      "seeking",
+      "seeked",
+      "ended",
+    ]) {
+      element.addEventListener(type, () => events.push(type));
+    }
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+    vi.unstubAllGlobals();
+    vi.restoreAllMocks();
+  });
+
+  function start(onFailure = vi.fn(), muted = false) {
+    const player = new EnginePlayer({
+      source: { ...source },
+      surface: document.createElement("div"),
+      element,
+      volume: 1,
+      muted,
+      onFailure,
+    });
+    player.load();
+    const worker = FakeWorker.last!;
+    return { player, worker, onFailure };
+  }
+
+  async function open(worker: FakeWorker, withAudio = false) {
+    worker.emit({
+      type: "ready",
+      info: {
+        durationSeconds: 10,
+        video: {
+          codedWidth: 1920,
+          codedHeight: 1080,
+          displayWidth: 1920,
+          displayHeight: 1080,
+          rotation: 0,
+          flip: false,
+          color: DEFAULT_PICTURE_COLOR,
+        },
+        audio: withAudio ? { sampleRate: 48_000, channels: 6 } : null,
+      },
+    });
+    await settle();
+  }
+
+  it("reports metadata, the first picture and playability in media element order", async () => {
+    const { player, worker } = start();
+    expect(worker.posted[0]).toMatchObject({ type: "open" });
+    await open(worker);
+    expect(player.readyState).toBe(1);
+    expect(player.duration).toBe(10);
+    expect(player.videoWidth).toBe(1920);
+
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0) });
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0.04) });
+    await settle();
+    expect(events).toEqual([
+      "loadstart",
+      "durationchange",
+      "loadedmetadata",
+      "loadeddata",
+      "canplay",
+    ]);
+    expect(player.readyState).toBe(4);
+    player.destroy();
+  });
+
+  it("plays on a wall clock without audio and presents frames as they come due", async () => {
+    const { player, worker } = start();
+    await open(worker);
+    const first = fakeFrame(0);
+    const second = fakeFrame(0.04);
+    worker.emit({ type: "frame", generation: worker.generation, frame: first });
+    worker.emit({ type: "frame", generation: worker.generation, frame: second });
+    await settle();
+    await player.play();
+    expect(events.slice(-2)).toEqual(["play", "playing"]);
+    await vi.advanceTimersByTimeAsync(200);
+    expect(player.currentTime).toBeGreaterThan(0.1);
+    // The first frame was replaced on screen and handed back to the worker.
+    expect(first.close).toHaveBeenCalled();
+    expect(worker.posted.some((m) => m.type === "frame-released")).toBe(true);
+    player.destroy();
+  });
+
+  it("starts at the speed it is given, as a media element at its default rate", async () => {
+    const player = new EnginePlayer({
+      source: { ...source },
+      surface: document.createElement("div"),
+      element,
+      volume: 1,
+      muted: false,
+      playbackRate: 2,
+      onFailure: vi.fn(),
+    });
+    player.load();
+    const worker = FakeWorker.last!;
+    await open(worker);
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0) });
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0.04) });
+    await settle();
+    expect(player.playbackRate).toBe(2);
+    await player.play();
+    // Before the two pictures run out: 1x would read about 0.1 s.
+    await vi.advanceTimersByTimeAsync(100);
+    expect(player.currentTime).toBeGreaterThan(0.17);
+    player.destroy();
+  });
+
+  // A hidden tab presents on a 100 ms timer; holding pictures for it would
+  // keep the decoder short of credits at fast speeds.
+  it("releases due pictures as they arrive while the tab is hidden", async () => {
+    const { player, worker } = start();
+    await open(worker);
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0) });
+    await settle();
+    player.playbackRate = 3;
+    await player.play();
+    Object.defineProperty(document, "hidden", { configurable: true, get: () => true });
+    try {
+      document.dispatchEvent(new Event("visibilitychange"));
+      await vi.advanceTimersByTimeAsync(100);
+      const released = () => worker.posted.filter((m) => m.type === "frame-released").length;
+      const before = released();
+      for (const timestamp of [0.04, 0.08, 0.12, 0.16]) {
+        worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(timestamp) });
+      }
+      // Without waiting for the next tick.
+      expect(released()).toBeGreaterThanOrEqual(before + 3);
+    } finally {
+      delete (document as { hidden?: boolean }).hidden;
+    }
+    player.destroy();
+  });
+
+  it("counts the frames it skips as dropped in the playback quality", async () => {
+    const { player, worker } = start();
+    await open(worker);
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0) });
+    await settle();
+    await player.play();
+    await vi.advanceTimersByTimeAsync(200);
+    // Three frames arrive late together: only the newest is drawn.
+    for (const timestamp of [0.04, 0.08, 0.12]) {
+      worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(timestamp) });
+    }
+    await vi.advanceTimersByTimeAsync(50);
+    const quality = player.getVideoPlaybackQuality();
+    expect(quality.droppedVideoFrames).toBe(2);
+    expect(quality.totalVideoFrames).toBe(4);
+    player.destroy();
+  });
+
+  it("drops frames from a superseded run and completes the seek on the new one", async () => {
+    const { player, worker } = start();
+    await open(worker);
+    const before = worker.generation;
+    worker.emit({ type: "frame", generation: before, frame: fakeFrame(0) });
+    worker.emit({ type: "frame", generation: before, frame: fakeFrame(0.04) });
+    await settle();
+
+    player.seek(5);
+    expect(player.seeking).toBe(true);
+    expect(player.currentTime).toBe(5);
+    expect(worker.generation).toBe(before + 1);
+    const stale = fakeFrame(0.04);
+    worker.emit({ type: "frame", generation: before, frame: stale });
+    expect(stale.close).toHaveBeenCalled();
+
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(5) });
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(5.04) });
+    await settle();
+    expect(player.seeking).toBe(false);
+    expect(events).toContain("seeked");
+    player.destroy();
+  });
+
+  it("fails a seek that never becomes playable as a read failure", async () => {
+    const onFailure = vi.fn();
+    const { player, worker } = start(onFailure);
+    await open(worker);
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0) });
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0.04) });
+    await settle();
+
+    // A seek that completes clears the deadline.
+    player.seek(5);
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(5) });
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(5.04) });
+    await settle();
+    await vi.advanceTimersByTimeAsync(20_001);
+    expect(onFailure).not.toHaveBeenCalled();
+
+    // A seek whose reads never answer fails over instead of seeking forever.
+    player.seek(30);
+    await vi.advanceTimersByTimeAsync(20_001);
+    expect(player.seeking).toBe(true);
+    expect(onFailure).toHaveBeenCalledWith(
+      expect.objectContaining({ classification: "browser_engine_read_failed" }),
+    );
+    player.destroy();
+  });
+
+  it("finishes a seek past the last frame and then ends", async () => {
+    const { player, worker } = start();
+    await open(worker);
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0) });
+    await settle();
+    await player.play();
+
+    player.seek(10);
+    worker.emit({ type: "video-ended", generation: worker.generation });
+    await settle();
+    expect(player.seeking).toBe(false);
+    expect(events).toContain("seeked");
+    expect(player.ended).toBe(true);
+    expect(player.paused).toBe(true);
+    expect(events.slice(-2)).toEqual(["pause", "ended"]);
+    player.destroy();
+  });
+
+  it("ends only after the last picture's own duration", async () => {
+    const { player, worker } = start();
+    await open(worker);
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0, 2) });
+    worker.emit({ type: "video-ended", generation: worker.generation });
+    await settle();
+    await player.play();
+    await vi.advanceTimersByTimeAsync(1_000);
+    expect(player.ended).toBe(false);
+    await vi.advanceTimersByTimeAsync(1_500);
+    expect(player.ended).toBe(true);
+    player.destroy();
+  });
+
+  it("treats a long wait for data while playing as a lost connection", async () => {
+    const onFailure = vi.fn();
+    const { player, worker } = start(onFailure);
+    await open(worker);
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0) });
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0.04) });
+    await settle();
+    await player.play();
+    // No more frames arrive, so playback waits; a short wait is not a failure.
+    await vi.advanceTimersByTimeAsync(5_000);
+    expect(onFailure).not.toHaveBeenCalled();
+    await vi.advanceTimersByTimeAsync(20_000);
+    expect(onFailure).toHaveBeenCalledWith(
+      expect.objectContaining({ classification: "browser_engine_read_failed" }),
+    );
+    // A failed engine stops its worker even when no other route takes over.
+    expect(worker.posted.some((m) => m.type === "close")).toBe(true);
+    player.destroy();
+  });
+
+  it("still notices a video stall after the audio track has ended", async () => {
+    audioOutput.resumes = true;
+    audioOutput.state = "suspended";
+    const onFailure = vi.fn();
+    const { player, worker } = start(onFailure);
+    await open(worker, true);
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0) });
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0.04) });
+    worker.emit({ type: "audio-buffered", generation: worker.generation });
+    await settle();
+    await player.play();
+    // The audio runs out first; the clock carries on from wall time.
+    (player as unknown as { onWorklet(message: unknown): void }).onWorklet({
+      type: "drained",
+      generation: worker.generation,
+    });
+    await vi.advanceTimersByTimeAsync(25_000);
+    expect(onFailure).toHaveBeenCalledWith(
+      expect.objectContaining({ classification: "browser_engine_read_failed" }),
+    );
+    player.destroy();
+  });
+
+  it("fails over when video falls far behind audio that is still playing", async () => {
+    audioOutput.resumes = true;
+    audioOutput.state = "suspended";
+    audioOutput.contextTime = 0;
+    const onFailure = vi.fn();
+    const { player, worker } = start(onFailure);
+    await open(worker, true);
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0) });
+    worker.emit({ type: "audio-buffered", generation: worker.generation });
+    await settle();
+    await player.play();
+    const worklet = player as unknown as { onWorklet(message: unknown): void };
+    worklet.onWorklet({
+      type: "clock",
+      generation: worker.generation,
+      contextTime: 0,
+      mediaTime: 0,
+      advancing: true,
+    });
+    // Audio plays on for 10 s with no new video: still within the limit.
+    audioOutput.contextTime = 10;
+    await vi.advanceTimersByTimeAsync(100);
+    expect(onFailure).not.toHaveBeenCalled();
+    // 25 s behind the audio clock, the video reads have stopped.
+    audioOutput.contextTime = 25;
+    await vi.advanceTimersByTimeAsync(100);
+    expect(onFailure).toHaveBeenCalledWith(
+      expect.objectContaining({ classification: "browser_engine_read_failed" }),
+    );
+    audioOutput.contextTime = 0;
+    player.destroy();
+  });
+
+  it("stops the clock on pause once the audio has drained, even after decoding ended", async () => {
+    audioOutput.resumes = true;
+    audioOutput.state = "suspended";
+    audioOutput.contextTime = 0;
+    const { player, worker } = start();
+    await open(worker, true);
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0) });
+    worker.emit({ type: "audio-buffered", generation: worker.generation });
+    await settle();
+    await player.play();
+    const worklet = player as unknown as { onWorklet(message: unknown): void };
+    worklet.onWorklet({
+      type: "clock",
+      generation: worker.generation,
+      contextTime: 0,
+      mediaTime: 0,
+      advancing: true,
+    });
+    // Decoding is done but pictures are still queued when the audio runs out.
+    for (const timestamp of [5, 5.04, 5.08]) {
+      worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(timestamp) });
+    }
+    worker.emit({ type: "video-ended", generation: worker.generation });
+    audioOutput.contextTime = 1;
+    worklet.onWorklet({ type: "drained", generation: worker.generation });
+    player.pause();
+    const paused = player.currentTime;
+    // The audio context keeps running; a paused player must not.
+    audioOutput.contextTime = 3;
+    await vi.advanceTimersByTimeAsync(100);
+    expect(player.currentTime).toBe(paused);
+    audioOutput.contextTime = 0;
+    player.destroy();
+  });
+
+  it("hands a worker failure to the player once, with its classification", async () => {
+    const onFailure = vi.fn();
+    const { player, worker } = start(onFailure);
+    worker.emit({
+      type: "error",
+      generation: null,
+      classification: "browser_engine_open_failed",
+      message: "nope",
+    });
+    worker.emit({ type: "error", generation: null, classification: "other", message: "again" });
+    expect(onFailure).toHaveBeenCalledTimes(1);
+    expect(onFailure).toHaveBeenCalledWith(
+      expect.objectContaining({ classification: "browser_engine_open_failed" }),
+    );
+    await expect(player.play()).rejects.toMatchObject({ name: "NotSupportedError" });
+    player.destroy();
+  });
+
+  it("stops its animation frames and hidden-tab ticks once it fails", async () => {
+    const frames = vi.fn((callback: FrameRequestCallback) =>
+      setTimeout(() => callback(performance.now()), 16),
+    );
+    vi.stubGlobal("requestAnimationFrame", frames);
+    const { player, worker } = start();
+    await open(worker);
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0) });
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0.04) });
+    await settle();
+    Object.defineProperty(document, "hidden", { configurable: true, get: () => true });
+    try {
+      document.dispatchEvent(new Event("visibilitychange"));
+      worker.emit({ type: "error", generation: null, classification: "x_failed", message: "boom" });
+      // Past the worker's terminate grace, nothing is left scheduled.
+      await vi.advanceTimersByTimeAsync(1_100);
+      const scheduled = frames.mock.calls.length;
+      await vi.advanceTimersByTimeAsync(1_000);
+      expect(frames.mock.calls.length).toBe(scheduled);
+      expect(vi.getTimerCount()).toBe(0);
+    } finally {
+      delete (document as { hidden?: boolean }).hidden;
+    }
+    player.destroy();
+  });
+
+  it("reports itself paused when it fails while playing", async () => {
+    // The player reads `paused` in onFailure to decide whether a reconnect resumes.
+    let pausedWhenReported: boolean | null = null;
+    const onFailure = vi.fn(() => {
+      pausedWhenReported = player.paused;
+    });
+    const { player, worker } = start(onFailure);
+    await open(worker);
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0) });
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0.04) });
+    await settle();
+    await player.play();
+    expect(player.paused).toBe(false);
+    worker.emit({ type: "error", generation: null, classification: "x_failed", message: "boom" });
+    expect(pausedWhenReported).toBe(false);
+    expect(player.paused).toBe(true);
+    expect(events.filter((event) => event === "pause")).toHaveLength(1);
+    player.destroy();
+  });
+
+  it("slows its presentation loop while paused and wakes on play", async () => {
+    const frames = vi.fn((callback: FrameRequestCallback) =>
+      setTimeout(() => callback(performance.now()), 16),
+    );
+    vi.stubGlobal("requestAnimationFrame", frames);
+    const { player, worker } = start();
+    await open(worker);
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0) });
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0.04) });
+    await settle();
+    await vi.advanceTimersByTimeAsync(100);
+    // Paused with the first picture up: a second of idling asks for few frames.
+    const before = frames.mock.calls.length;
+    await vi.advanceTimersByTimeAsync(1_000);
+    expect(frames.mock.calls.length - before).toBeLessThanOrEqual(5);
+    await player.play();
+    const playing = frames.mock.calls.length;
+    await vi.advanceTimersByTimeAsync(200);
+    expect(frames.mock.calls.length - playing).toBeGreaterThan(5);
+    player.destroy();
+  });
+
+  it("reports when no picture arrives in time", async () => {
+    const onFailure = vi.fn();
+    const { player } = start(onFailure);
+    await vi.advanceTimersByTimeAsync(20_001);
+    expect(onFailure).toHaveBeenCalledWith(
+      expect.objectContaining({ classification: "browser_engine_startup_timeout" }),
+    );
+    player.destroy();
+  });
+
+  it("reports when a picture arrives but its audio never does", async () => {
+    const onFailure = vi.fn();
+    const { player, worker } = start(onFailure);
+    await open(worker, true);
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0) });
+    await settle();
+    expect(player.readyState).toBe(2);
+    await vi.advanceTimersByTimeAsync(20_001);
+    expect(onFailure).toHaveBeenCalledWith(
+      expect.objectContaining({ classification: "browser_engine_startup_timeout" }),
+    );
+    player.destroy();
+  });
+
+  it("waits for the worker's audio before reporting the position playable", async () => {
+    audioOutput.resumes = true;
+    audioOutput.state = "suspended";
+    const { player, worker } = start();
+    await open(worker, true);
+    expect(worker.posted.some((m) => m.type === "audio-output")).toBe(true);
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0) });
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0.04) });
+    await settle();
+    expect(player.readyState).toBe(2);
+    expect(events).not.toContain("canplay");
+    worker.emit({ type: "audio-buffered", generation: worker.generation });
+    await settle();
+    expect(player.readyState).toBe(4);
+    expect(events).toContain("canplay");
+    player.destroy();
+  });
+
+  it("waits for a picture after the first before it starts the clock", async () => {
+    audioOutput.resumes = true;
+    audioOutput.state = "suspended";
+    const { player, worker } = start();
+    await open(worker, true);
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0) });
+    worker.emit({ type: "audio-buffered", generation: worker.generation });
+    await settle();
+    await player.play();
+    // The first picture is up and audio is queued, but nothing follows it yet.
+    expect(player.readyState).toBe(2);
+    expect(events).not.toContain("canplay");
+    expect(events).not.toContain("playing");
+
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0.04) });
+    await settle();
+    expect(player.readyState).toBe(4);
+    expect(events.slice(-2)).toEqual(["canplay", "playing"]);
+    player.destroy();
+  });
+
+  it("plays a video of a single picture once decoding has ended", async () => {
+    const { player, worker } = start();
+    await open(worker);
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0, 2) });
+    worker.emit({ type: "video-ended", generation: worker.generation });
+    await settle();
+    expect(player.readyState).toBe(4);
+    player.destroy();
+  });
+
+  it("reports a start that never decodes past its first picture", async () => {
+    const onFailure = vi.fn();
+    const { player, worker } = start(onFailure);
+    await open(worker);
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0) });
+    await vi.advanceTimersByTimeAsync(20_001);
+    expect(onFailure).toHaveBeenCalledWith(
+      expect.objectContaining({
+        classification: "browser_engine_startup_timeout",
+        message: "The browser engine decoded no picture after the first in time.",
+      }),
+    );
+    player.destroy();
+  });
+
+  it("settles paused and rejects play() when the browser refuses to start audio", async () => {
+    audioOutput.resumes = false;
+    audioOutput.state = "suspended";
+    const { player, worker } = start();
+    await open(worker, true);
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0) });
+    worker.emit({ type: "audio-buffered", generation: worker.generation });
+    await settle();
+    const attempt = player.play();
+    const rejection = expect(attempt).rejects.toMatchObject({ name: "NotAllowedError" });
+    await vi.advanceTimersByTimeAsync(2_000);
+    await rejection;
+    expect(player.paused).toBe(true);
+    expect(events.slice(-2)).toEqual(["play", "pause"]);
+    player.destroy();
+  });
+
+  it("refuses play() without events on a page that never had a user gesture", async () => {
+    audioOutput.resumes = false;
+    audioOutput.state = "suspended";
+    vi.stubGlobal("navigator", { ...navigator, userActivation: { hasBeenActive: false } });
+    const { player, worker } = start();
+    await open(worker, true);
+    const before = events.length;
+    await expect(player.play()).rejects.toMatchObject({ name: "NotAllowedError" });
+    expect(events.length).toBe(before);
+    expect(player.paused).toBe(true);
+    player.destroy();
+  });
+
+  /** Frames for the first `seconds` of the current run, with audio buffered. */
+  function feed(worker: FakeWorker, seconds: number, from = 0) {
+    for (let time = from; time < from + seconds; time += 0.04) {
+      worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(time) });
+    }
+    worker.emit({ type: "audio-buffered", generation: worker.generation });
+  }
+
+  for (const when of ["before", "after"] as const) {
+    it(`plays muted without a user gesture on wall time, play() ${when} the file opens`, async () => {
+      audioOutput.resumes = false;
+      audioOutput.state = "suspended";
+      vi.stubGlobal("navigator", { ...navigator, userActivation: { hasBeenActive: false } });
+      const { player, worker } = start(vi.fn(), true);
+      if (when === "before") await player.play();
+      await open(worker, true);
+      feed(worker, 2);
+      await settle();
+      if (when === "after") await player.play();
+      expect(events).toContain("play");
+      expect(events[events.length - 1]).toBe("playing");
+      await vi.advanceTimersByTimeAsync(1_000);
+      expect(player.paused).toBe(false);
+      expect(player.currentTime).toBeGreaterThan(0.9);
+      player.destroy();
+    });
+  }
+
+  it("brings audio back in step from the current position when unmuted", async () => {
+    audioOutput.resumes = false;
+    audioOutput.state = "suspended";
+    vi.stubGlobal("navigator", { ...navigator, userActivation: { hasBeenActive: false } });
+    const { player, worker } = start(vi.fn(), true);
+    await open(worker, true);
+    feed(worker, 3);
+    await settle();
+    await player.play();
+    await vi.advanceTimersByTimeAsync(1_000);
+
+    // The unmute click is the gesture the browser was waiting for.
+    audioOutput.resumes = true;
+    const before = worker.generation;
+    const position = player.currentTime;
+    player.muted = false;
+    await settle();
+    expect(worker.generation).toBe(before + 1);
+    expect(worker.posted[worker.posted.length - 1]).toMatchObject({ type: "start" });
+    expect((worker.posted[worker.posted.length - 1] as { position: number }).position).toBeCloseTo(
+      position,
+      1,
+    );
+    expect(player.paused).toBe(false);
+    player.destroy();
+  });
+
+  it("pauses when unmuted while the browser still refuses audio", async () => {
+    audioOutput.resumes = false;
+    audioOutput.state = "suspended";
+    vi.stubGlobal("navigator", { ...navigator, userActivation: { hasBeenActive: false } });
+    const { player, worker } = start(vi.fn(), true);
+    await open(worker, true);
+    feed(worker, 2);
+    await settle();
+    await player.play();
+    player.muted = false;
+    await settle();
+    expect(player.paused).toBe(true);
+    expect(events[events.length - 1]).toBe("pause");
+    player.destroy();
+  });
+
+  function hdrPlayer(onFailure = vi.fn()) {
+    const surface = document.createElement("div");
+    const player = new EnginePlayer({
+      source: { ...source, video: { ...source.video, transfer: "pq" } },
+      surface,
+      element,
+      volume: 1,
+      muted: false,
+      onFailure,
+    });
+    player.load();
+    return { player, worker: FakeWorker.last!, surface, onFailure };
+  }
+
+  function fakePresenter() {
+    let events!: PresenterEvents;
+    const presenter = { draw: vi.fn(), stop: vi.fn(), destroy: vi.fn() };
+    const create = vi.spyOn(HDRPresenter, "create").mockImplementation(async (...args) => {
+      events = args[3];
+      return presenter as unknown as HDRPresenter;
+    });
+    return { presenter, create, events: () => events };
+  }
+
+  it("starts nothing new when it fails while the renderer is still being created", async () => {
+    const gpu = { draw: vi.fn(), stop: vi.fn(), destroy: vi.fn() };
+    let resolveRenderer!: (renderer: HDRPresenter) => void;
+    vi.spyOn(HDRPresenter, "create").mockReturnValue(
+      new Promise((resolve) => (resolveRenderer = resolve)),
+    );
+    const { player, worker, onFailure } = hdrPlayer();
+    await open(worker);
+    worker.emit({ type: "error", generation: null, classification: "x_failed", message: "boom" });
+    expect(onFailure).toHaveBeenCalledTimes(1);
+
+    resolveRenderer(gpu as unknown as HDRPresenter);
+    await settle();
+    expect(gpu.destroy).toHaveBeenCalled();
+    expect(worker.posted.some((m) => m.type === "start")).toBe(false);
+    player.destroy();
+  });
+
+  it("builds the HDR presenter with the colour description the worker read", async () => {
+    const { create } = fakePresenter();
+    const { player, worker, surface } = hdrPlayer();
+    const color = { primaries: "bt709", matrix: "bt709", chromaSiting: "left" } as const;
+    worker.emit({
+      type: "ready",
+      info: {
+        durationSeconds: 10,
+        video: {
+          codedWidth: 1920,
+          codedHeight: 1080,
+          displayWidth: 1920,
+          displayHeight: 1080,
+          rotation: 0,
+          flip: false,
+          color,
+        },
+        audio: null,
+      },
+    });
+    await settle();
+    const [layers, transfer, passed] = create.mock.calls[0]!;
+    expect(surface.contains(layers)).toBe(true);
+    expect([transfer, passed]).toEqual(["pq", color]);
+    player.destroy();
+  });
+
+  it("fails over with a presentation failure when a picture cannot be presented", async () => {
+    const { presenter } = fakePresenter();
+    presenter.draw.mockImplementation(() => {
+      throw new Error("A decoded HDR frame has a color tag the engine cannot interpret");
+    });
+    const { player, worker, onFailure } = hdrPlayer();
+    await open(worker);
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0) });
+    await settle();
+    expect(onFailure).toHaveBeenCalledWith(
+      expect.objectContaining({ classification: "browser_engine_presentation_failed" }),
+    );
+    expect(presenter.stop).toHaveBeenCalled();
+    player.destroy();
+    expect(presenter.destroy).toHaveBeenCalled();
+  });
+
+  it("fails over when the presenter reports a failure it found later", async () => {
+    const { presenter, events } = fakePresenter();
+    const { player, worker, onFailure } = hdrPlayer();
+    await open(worker);
+    events().onFailure("Drawing a frame failed: Invalid BindGroup");
+    expect(onFailure).toHaveBeenCalledWith(
+      expect.objectContaining({
+        classification: "browser_engine_presentation_failed",
+        message: "Drawing a frame failed: Invalid BindGroup",
+      }),
+    );
+    // A rebuild still in flight must not start anything for a failed engine.
+    expect(presenter.stop).toHaveBeenCalled();
+    player.destroy();
+  });
+
+  it("draws the picture on screen again once a lost device is replaced", async () => {
+    const { presenter, events } = fakePresenter();
+    const { player, worker } = hdrPlayer();
+    await open(worker);
+    const picture = fakeFrame(0);
+    worker.emit({ type: "frame", generation: worker.generation, frame: picture });
+    await settle();
+    const draws = presenter.draw.mock.calls.length;
+    expect(draws).toBeGreaterThan(0);
+    events().onRestored();
+    expect(presenter.draw).toHaveBeenCalledTimes(draws + 1);
+    expect(presenter.draw.mock.calls[draws]![0]).toMatchObject({ kind: "frame", frame: picture });
+    player.destroy();
+  });
+
+  it("fails over when redrawing a paused picture fails", async () => {
+    const { presenter, events } = fakePresenter();
+    const { player, worker, onFailure } = hdrPlayer();
+    await open(worker);
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0) });
+    await settle();
+    presenter.draw.mockImplementation(() => {
+      throw new Error("lost");
+    });
+    events().onRestored();
+    expect(onFailure).toHaveBeenCalledWith(
+      expect.objectContaining({ classification: "browser_engine_presentation_failed" }),
+    );
+    player.destroy();
+  });
+
+  it("restarts decoding after a video decoder error, as a media element would recover", async () => {
+    // A hardware decoder dies with the GPU process; a new run opens a new one.
+    const { player, worker, onFailure } = start();
+    await open(worker);
+    const decoderError = () =>
+      worker.emit({
+        type: "error",
+        generation: worker.generation,
+        classification: "browser_engine_video_decode_failed",
+        message: "Decoder failure",
+      });
+    for (let restart = 1; restart <= MAX_DECODER_RESTARTS; restart++) {
+      const before = worker.generation;
+      events.length = 0;
+      decoderError();
+      // The dead run reporting again is the same failure, not another one.
+      decoderError();
+      expect(onFailure).not.toHaveBeenCalled();
+      // The GPU process gets a moment to come back, longer each time.
+      await vi.advanceTimersByTimeAsync(DECODER_RESTART_DELAY_MS * restart - 1);
+      expect(worker.generation).toBe(before);
+      await vi.advanceTimersByTimeAsync(1);
+      expect(worker.generation).toBe(before + 1);
+      expect(worker.posted[worker.posted.length - 1]).toMatchObject({ type: "start", position: 0 });
+      // Not a seek: hooks that act on one (progress, Watch Together, subtitles) stay out of it.
+      expect(events).not.toContain("seeking");
+    }
+    // A stream that keeps failing is broken itself: it fails over.
+    decoderError();
+    expect(onFailure).toHaveBeenCalledWith(
+      expect.objectContaining({ classification: "browser_engine_video_decode_failed" }),
+    );
+    player.destroy();
+  });
+
+  it("fails over as a decode failure when the restarted decoder shows nothing", async () => {
+    const { player, worker, onFailure } = start();
+    await open(worker);
+    worker.emit({
+      type: "error",
+      generation: worker.generation,
+      classification: "browser_engine_video_decode_failed",
+      message: "Decoder failure",
+    });
+    await vi.advanceTimersByTimeAsync(DECODER_RESTART_DELAY_MS);
+    // A read failure here would reconnect to this same route instead.
+    await vi.advanceTimersByTimeAsync(20_000);
+    expect(onFailure).toHaveBeenCalledWith(
+      expect.objectContaining({ classification: "browser_engine_video_decode_failed" }),
+    );
+    player.destroy();
+  });
+
+  it("draws in a box of its own that replaces what an earlier session left", () => {
+    const surface = document.createElement("div");
+    surface.appendChild(document.createElement("canvas"));
+    const player = new EnginePlayer({
+      source: { ...source },
+      surface,
+      element,
+      volume: 1,
+      muted: false,
+      onFailure: vi.fn(),
+    });
+    expect(surface.children).toHaveLength(1);
+    expect(surface.querySelector("canvas")).toBeNull();
+    player.destroy();
+    expect(surface.children).toHaveLength(0);
+  });
+
+  it("redraws on a pixel ratio change where the browser cannot report device pixels", async () => {
+    let onResize!: ResizeObserverCallback;
+    vi.stubGlobal(
+      "ResizeObserver",
+      class {
+        constructor(callback: ResizeObserverCallback) {
+          onResize = callback;
+        }
+        observe() {}
+        disconnect() {}
+      },
+    );
+    const queries: Array<{ media: string; listener?: () => void }> = [];
+    vi.stubGlobal("matchMedia", (media: string) => {
+      const query: { media: string; listener?: () => void } = { media };
+      queries.push(query);
+      return {
+        addEventListener: (_type: string, listener: () => void) => (query.listener = listener),
+        removeEventListener: vi.fn(),
+      };
+    });
+    const { player, worker } = start();
+    await open(worker);
+    worker.emit({ type: "frame", generation: worker.generation, frame: fakeFrame(0) });
+    await settle();
+    // An entry without device pixels: the box size alone will not show a ratio change.
+    onResize([{ contentRect: {} } as ResizeObserverEntry], {} as ResizeObserver);
+    expect(queries).toHaveLength(1);
+    const drawImage = vi.mocked(HTMLCanvasElement.prototype.getContext).mock.results[0]!.value
+      .drawImage as ReturnType<typeof vi.fn>;
+    const draws = drawImage.mock.calls.length;
+    queries[0]!.listener!();
+    expect(drawImage.mock.calls.length).toBe(draws + 1);
+    // Re-armed for the next change.
+    expect(queries).toHaveLength(2);
+    player.destroy();
+  });
+
+  it("fails over at once on worker errors other than a decoder error", async () => {
+    const { player, worker, onFailure } = start();
+    await open(worker);
+    worker.emit({
+      type: "error",
+      generation: worker.generation,
+      classification: "browser_engine_audio_decode_failed",
+      message: "bad audio",
+    });
+    expect(onFailure).toHaveBeenCalledTimes(1);
+    player.destroy();
+  });
+
+  it("closes queued frames and the worker on destroy", async () => {
+    const { player, worker } = start();
+    await open(worker);
+    const queued = fakeFrame(0);
+    worker.emit({ type: "frame", generation: worker.generation, frame: queued });
+    player.destroy();
+    expect(queued.close).toHaveBeenCalled();
+    expect(worker.posted[worker.posted.length - 1]).toMatchObject({ type: "close" });
+  });
+});
diff --git a/web/src/player/engine/EnginePlayer.ts b/web/src/player/engine/EnginePlayer.ts
new file mode 100644
index 0000000000..1737cc7b5b
--- /dev/null
+++ b/web/src/player/engine/EnginePlayer.ts
@@ -0,0 +1,1122 @@
+import type { FailureV3 } from "../protocol-v3";
+import type { VideoFitMode } from "../types";
+import { EngineAudioOutput } from "./audioOutput";
+import { EngineClock } from "./clock";
+import {
+  ENGINE_READ_FAILED,
+  ENGINE_VIDEO_DECODE_FAILED,
+  type EngineMediaInfo,
+  type PageToWorkerMessage,
+  type WorkerToPageMessage,
+  type WorkletToPageMessage,
+} from "./protocol";
+import {
+  Canvas2DRenderer,
+  HDRPresenter,
+  type EnginePicture,
+  type FrameRenderer,
+  type PictureSize,
+  type Viewport,
+} from "./renderers";
+import type { EngineSourceSpec } from "./source";
+import { EngineTextTrack } from "./textTracks";
+
+const TIMEUPDATE_INTERVAL_MS = 250;
+const PROGRESS_INTERVAL_MS = 1_000;
+/** Frames this close to the clock are due now. */
+const PRESENT_AHEAD_SECONDS = 0.005;
+/** How long a start or a seek may take to become playable before it fails. */
+const READINESS_TIMEOUT_MS = 20_000;
+/**
+ * How long playback may wait for data before the connection counts as lost:
+ * a read that never answers (a node gone, a half-open connection) is reported
+ * as a read failure, which reconnects instead of waiting forever.
+ */
+const STALL_TIMEOUT_MS = 20_000;
+/** While the tab is hidden, due frames are still released at this cadence. */
+const HIDDEN_TICK_MS = 100;
+// Paused with its picture up, the engine has nothing to present, so the loop
+// checks at this pace instead of every frame; play(), seek() and any message
+// from the worker or the audio worklet wake it.
+const IDLE_TICK_MS = 250;
+/** Video further behind the clock than this on return to the tab is re-synced. */
+const RESYNC_LAG_SECONDS = 2;
+/** Without audio, a frame this overdue means the decoder is starved. */
+const VIDEO_STALL_SECONDS = 0.25;
+/** Video decoder errors one session restarts decoding after before failing over. */
+export const MAX_DECODER_RESTARTS = 2;
+/**
+ * Wait before a decoder restart, times the restarts made so far: a hardware
+ * decoder dies with the GPU process, which takes a moment to come back.
+ */
+export const DECODER_RESTART_DELAY_MS = 750;
+
+/** Typed failures the server records against the plan (see routing.ts). */
+export const ENGINE_PAGE_FAILURES = {
+  worker: "browser_engine_worker_failed",
+  startup: "browser_engine_startup_timeout",
+  presentation: "browser_engine_presentation_failed",
+  audioOutput: "browser_engine_audio_output_failed",
+} as const;
+
+type QueuedPicture = EnginePicture & { generation: number };
+
+function hasUserActivation(): boolean {
+  const activation = (navigator as Navigator & { userActivation?: { hasBeenActive: boolean } })
+    .userActivation;
+  // Browsers without the API decide in AudioContext.resume() instead.
+  return activation ? activation.hasBeenActive : true;
+}
+
+function autoplayRefused(): DOMException {
+  return new DOMException(
+    "play() failed because the user didn't interact with the document first.",
+    "NotAllowedError",
+  );
+}
+
+class EngineTimeRanges implements TimeRanges {
+  constructor(private readonly ranges: Array<[number, number]>) {}
+  get length(): number {
+    return this.ranges.length;
+  }
+  start(index: number): number {
+    const range = this.ranges[index];
+    if (!range) throw new DOMException("Index out of range", "IndexSizeError");
+    return range[0];
+  }
+  end(index: number): number {
+    const range = this.ranges[index];
+    if (!range) throw new DOMException("Index out of range", "IndexSizeError");
+    return range[1];
+  }
+}
+
+export interface EnginePlayerOptions {
+  source: EngineSourceSpec;
+  /** Box the engine draws into; each session owns everything inside it. */
+  surface: HTMLElement;
+  /** Receives media events and supplies the fit mode, like the element it stands in for. */
+  element: HTMLVideoElement;
+  volume: number;
+  muted: boolean;
+  /** The speed playback starts at, as a media element's defaultPlaybackRate. */
+  playbackRate?: number;
+  onFailure: (failure: FailureV3) => void;
+}
+
+function clampRate(value: number): number {
+  return Math.min(4, Math.max(0.25, value || 1));
+}
+
+/**
+ * Plays one original file with the browser decode engine and exposes the
+ * HTMLMediaElement behaviour the player relies on: the same properties, the
+ * same events in the same order, `requestVideoFrameCallback`, and text tracks.
+ *
+ * Audio is the master clock when the file has audio. Video frames are pulled
+ * against it on every animation frame; a frame that is already late is
+ * released without being drawn.
+ */
+export class EnginePlayer {
+  private readonly source: EngineSourceSpec;
+  /** This session's box inside the surface, holding its canvases. */
+  private readonly layers: HTMLElement;
+  private readonly element: HTMLVideoElement;
+  private readonly onFailure: (failure: FailureV3) => void;
+  private worker: Worker | null = null;
+  private audio: EngineAudioOutput | null = null;
+  private renderer: FrameRenderer | null = null;
+  private clock: EngineClock | null = null;
+  private info: EngineMediaInfo | null = null;
+
+  private generation = 0;
+  private queue: QueuedPicture[] = [];
+  private shown: QueuedPicture | null = null;
+  private presentedFrames = 0;
+  private decoderRestarts = 0;
+  private restartTimer: ReturnType<typeof setTimeout> | null = null;
+  /** Decoded frames skipped because a later one was already due. */
+  private droppedFrames = 0;
+  private seekTarget: number;
+  private videoEnded = false;
+  private audioEnded = false;
+  private audioDrained = false;
+  private audioBuffered = false;
+
+  private pausedValue = true;
+  private endedValue = false;
+  private seekingValue = false;
+  private waitingValue = false;
+  private ready = 0;
+  private loadedData = false;
+  private volumeValue: number;
+  private mutedValue: boolean;
+  private rateValue = 1;
+  private failed = false;
+  private disposed = false;
+  /**
+   * Playing muted on wall time because the browser keeps audio suspended
+   * until a user gesture, as a media element may autoplay muted.
+   */
+  private silent = false;
+
+  private frameRequest = 0;
+  private hiddenTimer: ReturnType<typeof setInterval> | null = null;
+  private idleTimer: ReturnType<typeof setTimeout> | null = null;
+  private readinessTimer: ReturnType<typeof setTimeout> | null = null;
+  /** When the current wait for data began, while playing; null otherwise. */
+  private waitingSince: number | null = null;
+  private lastTimeupdate = 0;
+  private lastProgress = 0;
+  private callbacks = new Map<number, VideoFrameRequestCallback>();
+  private nextCallbackId = 1;
+  private readonly tracks: EngineTextTrack[] = [];
+  private fit: VideoFitMode = "contain";
+  /** The surface's size in device pixels, where the browser reports it exactly. */
+  private devicePixels: { width: number; height: number } | null = null;
+  /** Fallback trigger for a device pixel ratio change, re-armed after each one. */
+  private resolutionQuery: MediaQueryList | null = null;
+  private readonly resizeObserver: ResizeObserver;
+  private readonly classObserver: MutationObserver;
+  private wakeLock: WakeLockSentinel | "pending" | null = null;
+
+  constructor(options: EnginePlayerOptions) {
+    this.source = options.source;
+    // A fresh box replaces whatever an earlier session left in the surface,
+    // including canvases of a presenter that is still being created.
+    this.layers = document.createElement("div");
+    this.layers.style.width = "100%";
+    this.layers.style.height = "100%";
+    options.surface.replaceChildren(this.layers);
+    this.element = options.element;
+    this.onFailure = options.onFailure;
+    this.volumeValue = options.volume;
+    this.mutedValue = options.muted;
+    this.rateValue = clampRate(options.playbackRate ?? 1);
+    this.seekTarget = options.source.startSeconds;
+    this.resizeObserver = new ResizeObserver((entries) => {
+      const box = entries[entries.length - 1]?.devicePixelContentBoxSize?.[0];
+      this.devicePixels = box ? { width: box.inlineSize, height: box.blockSize } : null;
+      // Without the exact size, a ratio change alone would not reach us.
+      if (!box && !this.resolutionQuery) this.watchResolution();
+      this.relayout();
+    });
+    this.observeSurface();
+    this.classObserver = new MutationObserver(() => this.relayout());
+    this.classObserver.observe(this.element, {
+      attributes: true,
+      attributeFilter: ["class", "style"],
+    });
+    this.readFit();
+    document.addEventListener("visibilitychange", this.onVisibilityChange);
+    if ("mediaSession" in navigator) {
+      navigator.mediaSession.setActionHandler("play", () => void this.play().catch(() => {}));
+      navigator.mediaSession.setActionHandler("pause", () => this.pause());
+    }
+  }
+
+  // -- HTMLMediaElement surface ------------------------------------------------
+
+  get currentTime(): number {
+    if (this.seekingValue || !this.clock) return this.seekTarget;
+    const duration = this.duration;
+    const time = this.clock.now();
+    return Math.max(0, Number.isFinite(duration) ? Math.min(time, duration) : time);
+  }
+
+  set currentTime(value: number) {
+    this.seek(value);
+  }
+
+  get duration(): number {
+    return this.info ? this.info.durationSeconds : Number.NaN;
+  }
+
+  get paused(): boolean {
+    return this.pausedValue;
+  }
+
+  get ended(): boolean {
+    return this.endedValue;
+  }
+
+  get seeking(): boolean {
+    return this.seekingValue;
+  }
+
+  get readyState(): number {
+    return this.ready;
+  }
+
+  get videoWidth(): number {
+    return this.info?.video.displayWidth ?? 0;
+  }
+
+  get videoHeight(): number {
+    return this.info?.video.displayHeight ?? 0;
+  }
+
+  get buffered(): TimeRanges {
+    if (!this.info) return new EngineTimeRanges([]);
+    const last = this.queue[this.queue.length - 1];
+    const end = Math.max(this.currentTime, last ? last.timestamp + last.duration : 0);
+    return new EngineTimeRanges([[Math.min(this.seekTarget, this.currentTime), end]]);
+  }
+
+  get seekable(): TimeRanges {
+    return new EngineTimeRanges(this.info ? [[0, this.info.durationSeconds]] : []);
+  }
+
+  get volume(): number {
+    return this.volumeValue;
+  }
+
+  set volume(value: number) {
+    if (!(value >= 0 && value <= 1)) {
+      throw new DOMException("The volume provided is outside the range [0, 1].", "IndexSizeError");
+    }
+    if (value === this.volumeValue) return;
+    this.volumeValue = value;
+    this.audio?.setVolume(this.volumeValue, this.mutedValue);
+    this.dispatch("volumechange");
+  }
+
+  get muted(): boolean {
+    return this.mutedValue;
+  }
+
+  set muted(value: boolean) {
+    if (value === this.mutedValue) return;
+    this.mutedValue = value;
+    this.audio?.setVolume(this.volumeValue, this.mutedValue);
+    this.dispatch("volumechange");
+    if (!value && this.silent) this.endSilence();
+  }
+
+  get playbackRate(): number {
+    return this.rateValue;
+  }
+
+  set playbackRate(value: number) {
+    const rate = clampRate(value);
+    if (rate === this.rateValue) return;
+    this.rateValue = rate;
+    this.audio?.setRate(rate);
+    this.clock?.setRate(rate);
+    this.dispatch("ratechange");
+  }
+
+  async play(): Promise<void> {
+    if (this.failed || this.disposed) {
+      throw new DOMException("The media could not be played.", "NotSupportedError");
+    }
+    // Like a media element, refuse before changing state when the page has
+    // never had a user gesture: no play/pause events for a blocked attempt.
+    // Muted playback is allowed and runs without audio until it can start.
+    if (this.audio && this.audio.context.state !== "running" && !hasUserActivation()) {
+      if (!this.mutedValue) throw autoplayRefused();
+      this.silent = true;
+    }
+    if (this.endedValue) this.seek(0);
+    if (!this.pausedValue) return;
+    this.pausedValue = false;
+    this.wake();
+    this.dispatch("play");
+    if (this.audio && !this.silent && !(await this.audio.resume())) {
+      if (!this.mutedValue) {
+        if (!this.pausedValue) this.settlePaused();
+        throw autoplayRefused();
+      }
+      this.silent = true;
+    }
+    if (this.pausedValue || this.disposed) return;
+    if (!this.seekingValue && this.ready >= 4) this.startFlow();
+  }
+
+  pause(): void {
+    if (this.pausedValue) return;
+    this.settlePaused();
+    this.dispatch("timeupdate");
+  }
+
+  private settlePaused(): void {
+    this.pausedValue = true;
+    this.audio?.setPlaying(false);
+    this.clock?.setRunning(false);
+    this.waitingValue = false;
+    this.updatePresence();
+    this.dispatch("pause");
+  }
+
+  seek(position: number): void {
+    if (this.disposed || !Number.isFinite(position)) return;
+    const duration = this.duration;
+    const target = Math.max(0, Number.isFinite(duration) ? Math.min(position, duration) : position);
+    if (!this.info) {
+      this.seekTarget = target;
+      this.source.startSeconds = target;
+      return;
+    }
+    this.seekingValue = true;
+    this.clearDecoderRestart();
+    this.wake();
+    this.endedValue = false;
+    this.ready = Math.min(this.ready, 1);
+    // A read that never answers (a node gone, a half-open connection) would
+    // otherwise leave the seek pending for good. Reported as a read failure,
+    // it reconnects once the stream has played.
+    this.armReadinessDeadline(() =>
+      this.fail(ENGINE_READ_FAILED, "The browser engine could not resume after a seek in time."),
+    );
+    this.dispatch("seeking");
+    this.beginGeneration(target);
+    this.dispatch("timeupdate");
+  }
+
+  getVideoPlaybackQuality(): VideoPlaybackQuality {
+    return {
+      creationTime: performance.now(),
+      totalVideoFrames: this.presentedFrames + this.droppedFrames,
+      droppedVideoFrames: this.droppedFrames,
+      corruptedVideoFrames: 0,
+    } as VideoPlaybackQuality;
+  }
+
+  requestVideoFrameCallback(callback: VideoFrameRequestCallback): number {
+    const id = this.nextCallbackId++;
+    this.callbacks.set(id, callback);
+    return id;
+  }
+
+  cancelVideoFrameCallback(id: number): void {
+    this.callbacks.delete(id);
+  }
+
+  addTextTrack(kind: TextTrackKind, label = "", language = ""): TextTrack {
+    const track = new EngineTextTrack(kind, label, language);
+    this.tracks.push(track);
+    return track as unknown as TextTrack;
+  }
+
+  // -- Lifecycle ---------------------------------------------------------------
+
+  load(): void {
+    this.dispatch("loadstart");
+    const worker = new Worker(new URL("./engine.worker.ts", import.meta.url), { type: "module" });
+    this.worker = worker;
+    worker.onmessage = (event: MessageEvent<WorkerToPageMessage>) => this.onWorker(event.data);
+    worker.onerror = (event) =>
+      this.fail(ENGINE_PAGE_FAILURES.worker, event.message || "The decode worker failed.");
+    // Runs until the position is playable, not just until the first picture:
+    // audio that never arrives would otherwise hold playback with no failure.
+    this.armReadinessDeadline(() =>
+      this.fail(ENGINE_PAGE_FAILURES.startup, this.startupTimeoutMessage()),
+    );
+    this.post({ type: "open", source: this.source });
+  }
+
+  destroy(): void {
+    if (this.disposed) return;
+    this.disposed = true;
+    this.stopPresentationTimers();
+    this.clearReadinessDeadline();
+    this.clearDecoderRestart();
+    document.removeEventListener("visibilitychange", this.onVisibilityChange);
+    this.resizeObserver.disconnect();
+    this.resolutionQuery?.removeEventListener("change", this.onResolutionChange);
+    this.resolutionQuery = null;
+    this.classObserver.disconnect();
+    for (const picture of this.queue) this.release(picture);
+    this.queue = [];
+    if (this.shown) this.release(this.shown);
+    this.shown = null;
+    this.stopWorker();
+    this.audio?.close();
+    this.audio = null;
+    this.renderer?.destroy();
+    this.renderer = null;
+    this.layers.remove();
+    this.callbacks.clear();
+    this.updatePresence();
+    if ("mediaSession" in navigator) {
+      navigator.mediaSession.setActionHandler("play", null);
+      navigator.mediaSession.setActionHandler("pause", null);
+    }
+  }
+
+  // -- Internals ---------------------------------------------------------------
+
+  /** Media time at which the picture on screen stops being current. */
+  private shownUntil(): number {
+    return this.shown ? this.shown.timestamp + Math.max(0, this.shown.duration) : 0;
+  }
+
+  private stopWorker(): void {
+    const worker = this.worker;
+    this.worker = null;
+    if (!worker) return;
+    worker.postMessage({ type: "close" } satisfies PageToWorkerMessage);
+    setTimeout(() => worker.terminate(), 1_000);
+  }
+
+  private post(message: PageToWorkerMessage, transfer: Transferable[] = []): void {
+    this.worker?.postMessage(message, transfer);
+  }
+
+  private dispatch(type: string): void {
+    if (!this.disposed) this.element.dispatchEvent(new Event(type));
+  }
+
+  /** Destroyed, or failed: either way nothing new may start. */
+  private get stopped(): boolean {
+    return this.disposed || this.failed;
+  }
+
+  private fail(classification: string, message: string): void {
+    if (this.stopped) return;
+    this.failed = true;
+    const wasPlaying = !this.pausedValue;
+    this.audio?.setPlaying(false);
+    this.clock?.setRunning(false);
+    // This engine is done even if no other route takes over: stop reading and
+    // decoding, free queued pictures and audio, and let the screen sleep. The
+    // last picture stays up until the player replaces or destroys the engine.
+    this.stopPresentationTimers();
+    this.clearReadinessDeadline();
+    this.clearDecoderRestart();
+    this.renderer?.stop();
+    for (const picture of this.queue) this.release(picture);
+    this.queue = [];
+    this.stopWorker();
+    this.audio?.close();
+    this.audio = null;
+    this.updatePresence();
+    // Report while `paused` still says whether it was playing: the player
+    // reads it to decide whether a reconnect resumes. Then, since the player
+    // follows media events, a playing engine says it stopped.
+    this.onFailure({ classification, message, decoder_name: "prairie-web-engine" });
+    if (wasPlaying && !this.disposed && !this.pausedValue) this.settlePaused();
+  }
+
+  private onWorker(message: WorkerToPageMessage): void {
+    if (this.stopped) {
+      if (message.type === "frame") message.frame.close();
+      return;
+    }
+    // Pictures, buffered audio and the end of the stream can change what the
+    // loop presents or reports, so an idle loop runs again.
+    this.wake();
+    switch (message.type) {
+      case "ready":
+        void this.onReady(message.info);
+        return;
+      case "frame":
+      case "planes": {
+        const picture: QueuedPicture =
+          message.type === "frame"
+            ? {
+                kind: "frame",
+                frame: message.frame,
+                timestamp: message.frame.timestamp / 1e6,
+                duration: (message.frame.duration ?? 0) / 1e6,
+                generation: message.generation,
+              }
+            : {
+                kind: "planes",
+                planes: message.planes,
+                timestamp: message.planes.timestamp,
+                duration: message.planes.duration,
+                generation: message.generation,
+              };
+        if (message.generation !== this.generation) {
+          this.release(picture);
+          return;
+        }
+        this.queue.push(picture);
+        // A hidden tab presents on a slow timer, and each picture held for it
+        // keeps the decoder waiting for a credit. Releasing due pictures as
+        // they arrive keeps video up with fast playback.
+        if (this.hiddenTimer !== null && !this.idle()) this.advance(false);
+        return;
+      }
+      case "video-ended":
+        if (message.generation === this.generation) this.videoEnded = true;
+        return;
+      case "audio-ended":
+        if (message.generation === this.generation) this.audioEnded = true;
+        return;
+      case "audio-buffered":
+        if (message.generation === this.generation) this.audioBuffered = true;
+        return;
+      case "error":
+        if (message.generation === null || message.generation === this.generation) {
+          if (message.classification === ENGINE_VIDEO_DECODE_FAILED && this.restartDecoding()) {
+            return;
+          }
+          this.fail(message.classification, message.message);
+        }
+        return;
+    }
+  }
+
+  private async onReady(info: EngineMediaInfo): Promise<void> {
+    this.info = info;
+    this.dispatch("durationchange");
+    this.ready = 1;
+    this.dispatch("loadedmetadata");
+    this.dispatch("resize");
+
+    const transfer = this.source.video.transfer;
+    try {
+      const renderer =
+        transfer === "sdr"
+          ? Canvas2DRenderer.in(this.layers)
+          : await HDRPresenter.create(this.layers, transfer, info.video.color, {
+              onFailure: (reason) => this.fail(ENGINE_PAGE_FAILURES.presentation, reason),
+              onRestored: () => this.relayout(),
+            });
+      if (this.stopped) {
+        renderer.destroy();
+        return;
+      }
+      this.renderer = renderer;
+    } catch (error) {
+      this.fail(
+        ENGINE_PAGE_FAILURES.presentation,
+        `The picture could not be presented: ${String(error)}`,
+      );
+      return;
+    }
+    if (this.stopped) return;
+
+    if (info.audio) {
+      try {
+        this.audio = await EngineAudioOutput.create(
+          info.audio.sampleRate,
+          info.audio.channels,
+          (m) => this.onWorklet(m),
+        );
+      } catch (error) {
+        this.fail(
+          ENGINE_PAGE_FAILURES.audioOutput,
+          `Audio output could not start: ${String(error)}`,
+        );
+        return;
+      }
+      if (this.stopped) {
+        this.audio.close();
+        this.audio = null;
+        return;
+      }
+      this.audio.setVolume(this.volumeValue, this.mutedValue);
+      this.audio.setRate(this.rateValue);
+      const port = this.audio.connect();
+      this.post(
+        {
+          type: "audio-output",
+          port,
+          channels: this.audio.channels,
+          sampleRate: this.audio.context.sampleRate,
+        },
+        [port],
+      );
+    }
+    const audio = this.audio;
+    this.clock = new EngineClock(audio ? () => audio.audibleContextTime() : null, this.seekTarget);
+    this.clock.setRate(this.rateValue);
+    this.beginGeneration(this.seekTarget);
+    this.frameRequest = requestAnimationFrame(this.tick);
+    if (document.hidden) this.onVisibilityChange();
+  }
+
+  private onWorklet(message: WorkletToPageMessage): void {
+    if (message.generation !== this.generation || !this.clock) return;
+    this.wake();
+    switch (message.type) {
+      case "clock":
+        this.clock.onAnchor(message);
+        if (message.advancing) this.setWaiting(false);
+        return;
+      case "underrun":
+        this.clock.onAnchor({
+          contextTime: message.contextTime,
+          mediaTime: message.mediaTime ?? this.clock.now(),
+          advancing: false,
+        });
+        if (!this.pausedValue && !this.seekingValue && !this.audioEnded) this.setWaiting(true);
+        return;
+      case "drained":
+        this.audioDrained = true;
+        // Whatever video is left (still decoding, or decoded and queued) plays
+        // on wall time, which pause and seek can stop.
+        this.clock.detachAudio(!this.pausedValue && !this.seekingValue);
+        return;
+    }
+  }
+
+  /** Calls `onExpire` unless the position becomes playable in time. */
+  private armReadinessDeadline(onExpire: () => void): void {
+    this.clearReadinessDeadline();
+    this.readinessTimer = setTimeout(() => {
+      this.readinessTimer = null;
+      if (this.ready < 4) onExpire();
+    }, READINESS_TIMEOUT_MS);
+  }
+
+  private clearReadinessDeadline(): void {
+    if (this.readinessTimer === null) return;
+    clearTimeout(this.readinessTimer);
+    this.readinessTimer = null;
+  }
+
+  /**
+   * Starts a new decode run at the current position after a video decoder
+   * error, after a short wait. A hardware decoder dies when the GPU process
+   * restarts, and a new run opens a new one; a stream that is itself broken
+   * fails again and fails over when the restarts run out. Unlike a seek, the
+   * page sees only waiting and playing, as when a media element's decoder
+   * recovers.
+   */
+  private restartDecoding(): boolean {
+    // The dead run may report again before the restart; that is the same error.
+    if (this.restartTimer !== null) return true;
+    if (!this.info || this.decoderRestarts >= MAX_DECODER_RESTARTS) return false;
+    this.decoderRestarts += 1;
+    this.restartTimer = setTimeout(() => {
+      this.restartTimer = null;
+      if (this.stopped) return;
+      const position = this.currentTime;
+      this.ready = Math.min(this.ready, 2);
+      // A run that never shows a picture failed to decode: that fails over,
+      // where a read failure would reconnect to this same route.
+      this.armReadinessDeadline(() =>
+        this.fail(ENGINE_VIDEO_DECODE_FAILED, "The video decoder did not recover in time."),
+      );
+      if (!this.pausedValue && !this.seekingValue) this.setWaiting(true);
+      this.beginGeneration(position);
+      this.wake();
+    }, DECODER_RESTART_DELAY_MS * this.decoderRestarts);
+    return true;
+  }
+
+  private clearDecoderRestart(): void {
+    if (this.restartTimer === null) return;
+    clearTimeout(this.restartTimer);
+    this.restartTimer = null;
+  }
+
+  private beginGeneration(position: number): void {
+    this.generation += 1;
+    this.seekTarget = position;
+    for (const picture of this.queue) this.release(picture);
+    this.queue = [];
+    this.videoEnded = false;
+    this.audioEnded = false;
+    this.audioDrained = false;
+    this.audioBuffered = false;
+    this.clock?.reset(position);
+    this.audio?.setPlaying(false);
+    this.audio?.setGeneration(this.generation, position);
+    this.post({ type: "start", generation: this.generation, position });
+  }
+
+  private release(picture: QueuedPicture): void {
+    if (picture.kind === "frame") {
+      picture.frame.close();
+      this.post({ type: "frame-released", generation: picture.generation });
+    } else {
+      this.post({ type: "frame-released", generation: picture.generation });
+      this.post({ type: "planes-released", buffer: picture.planes.buffer }, [
+        picture.planes.buffer,
+      ]);
+    }
+  }
+
+  private present(picture: QueuedPicture): void {
+    const size = this.pictureSize(picture);
+    try {
+      this.renderer?.draw(picture, size, this.viewport());
+    } catch (error) {
+      this.fail(ENGINE_PAGE_FAILURES.presentation, `Drawing a frame failed: ${String(error)}`);
+    }
+    if (this.shown) this.release(this.shown);
+    this.shown = picture;
+    this.presentedFrames += 1;
+    if (this.callbacks.size === 0) return;
+    const callbacks = this.callbacks;
+    this.callbacks = new Map();
+    const now = performance.now();
+    const metadata: VideoFrameCallbackMetadata = {
+      presentationTime: now,
+      expectedDisplayTime: now + 1000 / 60,
+      width: size.width,
+      height: size.height,
+      mediaTime: picture.timestamp,
+      presentedFrames: this.presentedFrames,
+      processingDuration: 0,
+    };
+    for (const callback of callbacks.values()) {
+      try {
+        callback(now, metadata);
+      } catch (error) {
+        console.error("[engine] requestVideoFrameCallback handler failed", error);
+      }
+    }
+  }
+
+  private viewport(): Viewport {
+    return { fit: this.fit, devicePixels: this.devicePixels };
+  }
+
+  /**
+   * Follows the surface's size in device pixels, so the canvases match the
+   * screen pixel for pixel. Where the browser cannot report that size (Safari),
+   * a change of device pixel ratio alone (a window moved to another screen,
+   * a zoom) would not resize the box, so a resolution query stands in for it.
+   */
+  private observeSurface(): void {
+    try {
+      this.resizeObserver.observe(this.layers, { box: "device-pixel-content-box" });
+    } catch {
+      this.resizeObserver.observe(this.layers);
+      this.watchResolution();
+    }
+  }
+
+  private watchResolution(): void {
+    if (typeof window.matchMedia !== "function") return;
+    this.resolutionQuery?.removeEventListener("change", this.onResolutionChange);
+    // The query matches the current ratio only, so it fires once per change.
+    this.resolutionQuery = window.matchMedia(`(resolution: ${window.devicePixelRatio}dppx)`);
+    this.resolutionQuery.addEventListener("change", this.onResolutionChange);
+  }
+
+  private readonly onResolutionChange = (): void => {
+    if (this.disposed) return;
+    this.watchResolution();
+    this.relayout();
+  };
+
+  private pictureSize(picture: QueuedPicture): PictureSize {
+    const video = this.info?.video;
+    if (video && video.displayWidth > 0) {
+      const { displayWidth: width, displayHeight: height, rotation, flip } = video;
+      return { width, height, rotation, flip };
+    }
+    const [width, height] =
+      picture.kind === "frame"
+        ? [picture.frame.displayWidth, picture.frame.displayHeight]
+        : [picture.planes.width, picture.planes.height];
+    return { width, height, rotation: 0, flip: false };
+  }
+
+  private readonly tick = (): void => {
+    this.idleTimer = null;
+    if (this.stopped) return;
+    this.advance(true);
+    // advance() fails the engine on a stall; a failed engine draws no more frames.
+    if (this.stopped) return;
+    if (this.idle()) this.idleTimer = setTimeout(this.tick, IDLE_TICK_MS);
+    else this.frameRequest = requestAnimationFrame(this.tick);
+  };
+
+  /** Paused with the current picture shown: nothing changes until play or seek. */
+  private idle(): boolean {
+    return (
+      this.pausedValue &&
+      !this.seekingValue &&
+      this.shown !== null &&
+      this.shown.generation === this.generation
+    );
+  }
+
+  private wake(): void {
+    if (this.stopped || this.idleTimer === null) return;
+    clearTimeout(this.idleTimer);
+    this.idleTimer = null;
+    this.frameRequest = requestAnimationFrame(this.tick);
+  }
+
+  private stopPresentationTimers(): void {
+    cancelAnimationFrame(this.frameRequest);
+    if (this.idleTimer !== null) clearTimeout(this.idleTimer);
+    this.idleTimer = null;
+    if (this.hiddenTimer !== null) clearInterval(this.hiddenTimer);
+    this.hiddenTimer = null;
+  }
+
+  /** One presentation step; `draw` is false while the tab is hidden. */
+  private advance(draw: boolean): void {
+    if (this.failed) return;
+    const clock = this.clock;
+    if (!clock) return;
+    if (this.waitingValue && !this.pausedValue && !this.seekingValue) {
+      this.waitingSince ??= performance.now();
+      if (performance.now() - this.waitingSince > STALL_TIMEOUT_MS) {
+        this.fail(ENGINE_READ_FAILED, "The browser engine stopped receiving data.");
+        return;
+      }
+    } else {
+      this.waitingSince = null;
+    }
+    const firstOfGeneration = !this.shown || this.shown.generation !== this.generation;
+    if (firstOfGeneration) {
+      const first = this.queue.shift();
+      if (first) this.present(first);
+    } else if (!this.pausedValue && !this.seekingValue) {
+      const now = clock.now();
+      let due: QueuedPicture | null = null;
+      while (this.queue.length > 0 && this.queue[0]!.timestamp <= now + PRESENT_AHEAD_SECONDS) {
+        if (due) {
+          this.release(due);
+          this.droppedFrames += 1;
+        }
+        due = this.queue.shift()!;
+      }
+      if (due) {
+        if (draw) this.present(due);
+        else {
+          if (this.shown) this.release(this.shown);
+          this.shown = due;
+        }
+      }
+      // Without audio, or once it has drained, the clock runs on wall time,
+      // so a video read that stops coming shows up only here.
+      if ((!this.audio || this.audioDrained) && this.shown) {
+        const overdue =
+          this.queue.length === 0 &&
+          !this.videoEnded &&
+          now > this.shown.timestamp + Math.max(this.shown.duration, 0.04) + VIDEO_STALL_SECONDS;
+        clock.setRunning(!overdue);
+        this.setWaiting(overdue);
+      } else if (
+        this.shown &&
+        this.queue.length === 0 &&
+        !this.videoEnded &&
+        now - this.shownUntil() > STALL_TIMEOUT_MS / 1000
+      ) {
+        // Live audio keeps the clock going when video stops arriving, so the
+        // stall shows as a picture that has fallen this far behind it.
+        this.fail(ENGINE_READ_FAILED, "The browser engine stopped receiving video.");
+        return;
+      }
+    }
+
+    this.settleReadiness();
+
+    // The last picture stays up for its own duration before the media ends.
+    if (
+      !this.pausedValue &&
+      !this.seekingValue &&
+      this.videoEnded &&
+      this.queue.length === 0 &&
+      (!this.audio || this.audioDrained) &&
+      clock.now() >= this.shownUntil()
+    ) {
+      this.finish();
+      return;
+    }
+
+    const wall = performance.now();
+    if (!this.pausedValue && wall - this.lastTimeupdate >= TIMEUPDATE_INTERVAL_MS) {
+      this.lastTimeupdate = wall;
+      this.dispatch("timeupdate");
+    }
+    if (wall - this.lastProgress >= PROGRESS_INTERVAL_MS) {
+      this.lastProgress = wall;
+      this.dispatch("progress");
+    }
+    if (this.tracks.length > 0) {
+      const time = this.currentTime;
+      for (const track of this.tracks) track.update(time);
+    }
+  }
+
+  /** Moves readyState on once a picture is up and enough audio is queued. */
+  private settleReadiness(): void {
+    if (!this.shown) return;
+    // A seek at or past the last frame decodes nothing new: the previous
+    // picture stays up and the seek completes on the end of the video.
+    const nothingNewToShow = this.videoEnded && this.queue.length === 0;
+    if (this.shown.generation !== this.generation && !nothingNewToShow) return;
+    if (this.ready < 2) {
+      this.ready = 2;
+      if (!this.loadedData) {
+        this.loadedData = true;
+        this.dispatch("loadeddata");
+      }
+    }
+    if (this.ready >= 4) return;
+    if (!this.videoAhead()) return;
+    const audioReady = !this.audio || this.audioBuffered || this.audioEnded || this.videoEnded;
+    if (!audioReady) return;
+    this.ready = 4;
+    this.clearReadinessDeadline();
+    if (this.seekingValue) {
+      this.seekingValue = false;
+      this.dispatch("timeupdate");
+      this.dispatch("seeked");
+    }
+    this.dispatch("canplay");
+    this.dispatch("canplaythrough");
+    if (!this.pausedValue) this.startFlow();
+  }
+
+  /**
+   * A picture after the one on screen, or the end of the video: what a media
+   * element needs for HAVE_FUTURE_DATA, so playback never starts the clock
+   * over a first frame whose successors are still being read or decoded.
+   */
+  private videoAhead(): boolean {
+    return this.queue.length > 0 || this.videoEnded;
+  }
+
+  /** What a start that never became playable was still waiting for. */
+  private startupTimeoutMessage(): string {
+    if (this.ready < 2) return "The browser engine showed no picture in time.";
+    if (!this.videoAhead()) return "The browser engine decoded no picture after the first in time.";
+    return "The browser engine had no audio to play in time.";
+  }
+
+  private startFlow(): void {
+    // play() already resumed the context when it could; a context created
+    // after that call (playback requested before the file opened) starts
+    // here, and settles paused if the browser refuses it, or plays silently
+    // if muted.
+    const audio = this.audio;
+    if (audio && audio.context.state !== "running" && !this.silent) {
+      if (this.mutedValue && !hasUserActivation()) {
+        this.silent = true;
+      } else {
+        void audio.resume().then((running) => {
+          if (running || this.pausedValue || this.stopped) return;
+          if (this.mutedValue) this.playSilently();
+          else this.settlePaused();
+        });
+      }
+    }
+    if (this.silent) this.playSilently();
+    else this.audio?.setPlaying(true);
+    this.clock?.setRunning(true);
+    this.waitingValue = false;
+    this.updatePresence();
+    this.dispatch("playing");
+  }
+
+  /**
+   * Runs the clock on wall time with the audio held, as if it had already
+   * played out. A seek starts the next run on the audio clock again, so
+   * startFlow() comes back here while the player stays silent.
+   */
+  private playSilently(): void {
+    this.silent = true;
+    this.audio?.setPlaying(false);
+    this.audioDrained = true;
+    this.clock?.detachAudio(!this.pausedValue && !this.seekingValue);
+  }
+
+  /** Unmuted while silent: start audio, then resume from here in step with it. */
+  private endSilence(): void {
+    const audio = this.audio;
+    if (!audio) return;
+    void audio.resume().then((running) => {
+      if (this.stopped || !this.silent || this.mutedValue) return;
+      if (!running) {
+        // A media element pauses when unmuted without a gesture, too.
+        if (!this.pausedValue) this.settlePaused();
+        return;
+      }
+      this.silent = false;
+      this.seek(this.currentTime);
+    });
+  }
+
+  /**
+   * What a playing media element gets from the browser for free: the screen
+   * stays awake and hardware media keys reach it.
+   */
+  private updatePresence(): void {
+    const playing = !this.pausedValue && !this.stopped;
+    if ("mediaSession" in navigator) {
+      navigator.mediaSession.playbackState = playing ? "playing" : "paused";
+    }
+    const wakeLock = (navigator as Navigator & { wakeLock?: WakeLock }).wakeLock;
+    if (playing && !this.wakeLock && wakeLock && document.visibilityState === "visible") {
+      this.wakeLock = "pending";
+      wakeLock
+        .request("screen")
+        .then((lock) => {
+          if (this.pausedValue || this.stopped) {
+            void lock.release();
+            this.wakeLock = null;
+            return;
+          }
+          this.wakeLock = lock;
+          lock.addEventListener("release", () => {
+            if (this.wakeLock === lock) this.wakeLock = null;
+          });
+        })
+        .catch(() => {
+          this.wakeLock = null;
+        });
+    } else if (!playing && this.wakeLock && this.wakeLock !== "pending") {
+      void this.wakeLock.release();
+      this.wakeLock = null;
+    }
+  }
+
+  private setWaiting(waiting: boolean): void {
+    if (waiting === this.waitingValue) return;
+    this.waitingValue = waiting;
+    this.dispatch(waiting ? "waiting" : "playing");
+  }
+
+  private finish(): void {
+    this.endedValue = true;
+    this.dispatch("timeupdate");
+    this.settlePaused();
+    this.dispatch("ended");
+  }
+
+  private readFit(): void {
+    this.fit = getComputedStyle(this.element).objectFit === "cover" ? "cover" : "contain";
+  }
+
+  private relayout(): void {
+    this.readFit();
+    if (this.shown && this.renderer && !this.stopped) {
+      // While paused no later frame would repaint, so a failure here counts.
+      try {
+        this.renderer.draw(this.shown, this.pictureSize(this.shown), this.viewport());
+      } catch (error) {
+        this.fail(ENGINE_PAGE_FAILURES.presentation, `Drawing a frame failed: ${String(error)}`);
+      }
+    }
+  }
+
+  private readonly onVisibilityChange = (): void => {
+    if (this.stopped) return;
+    if (document.hidden) {
+      if (this.hiddenTimer === null) {
+        this.hiddenTimer = setInterval(() => {
+          if (!this.idle()) this.advance(false);
+        }, HIDDEN_TICK_MS);
+      }
+      return;
+    }
+    if (this.hiddenTimer !== null) {
+      clearInterval(this.hiddenTimer);
+      this.hiddenTimer = null;
+    }
+    const lagging =
+      !this.pausedValue &&
+      !this.seekingValue &&
+      this.shown !== null &&
+      this.currentTime - this.shown.timestamp > RESYNC_LAG_SECONDS;
+    if (lagging) this.seek(this.currentTime);
+    else this.relayout();
+    // The browser drops a screen wake lock whenever the page is hidden.
+    this.updatePresence();
+  };
+}
diff --git a/web/src/player/engine/audio.worklet.test.ts b/web/src/player/engine/audio.worklet.test.ts
new file mode 100644
index 0000000000..b6183ba904
--- /dev/null
+++ b/web/src/player/engine/audio.worklet.test.ts
@@ -0,0 +1,361 @@
+import { beforeAll, describe, expect, it, vi } from "vitest";
+import type { PageToWorkletMessage, WorkerToWorkletMessage } from "./protocol";
+
+interface Processor {
+  port: { onmessage: ((event: { data: PageToWorkletMessage }) => void) | null; posted: unknown[] };
+  process(inputs: Float32Array[][], outputs: Float32Array[][]): boolean;
+}
+type ProcessorClass = new (options: { processorOptions: { channels: number } }) => Processor;
+
+let Processor: ProcessorClass;
+
+beforeAll(async () => {
+  // The audio thread's globals, enough to load the processor module.
+  vi.stubGlobal("sampleRate", 48_000);
+  vi.stubGlobal("currentTime", 0);
+  vi.stubGlobal(
+    "AudioWorkletProcessor",
+    class {
+      readonly port = {
+        onmessage: null,
+        posted: [] as unknown[],
+        postMessage(message: unknown) {
+          this.posted.push(message);
+        },
+      };
+    },
+  );
+  vi.stubGlobal("registerProcessor", (_name: string, processor: ProcessorClass) => {
+    Processor = processor;
+  });
+  await import("./audio.worklet");
+});
+
+function quantum(processor: Processor): Float32Array {
+  const output = [new Float32Array(128)];
+  processor.process([], [output]);
+  return output[0]!;
+}
+
+describe("EngineAudioProcessor", () => {
+  it("plays silence until audio that starts after the position is due", () => {
+    const processor = new Processor({ processorOptions: { channels: 1 } });
+    const page = (data: PageToWorkletMessage) => processor.port.onmessage!({ data });
+    page({ type: "generation", generation: 1, position: 0 });
+    page({ type: "playing", playing: true });
+    // The track's first samples are stamped 0.1 s after the start position.
+    const chunk: WorkerToWorkletMessage = {
+      type: "pcm",
+      generation: 1,
+      timestamp: 0.1,
+      samples: new Float32Array(48_000).fill(0.5),
+    };
+    (processor as unknown as { onWorker(message: WorkerToWorkletMessage): void }).onWorker(chunk);
+
+    expect(Array.from(quantum(processor)).every((sample) => sample === 0)).toBe(true);
+    const clock = processor.port.posted.find(
+      (message) => (message as { type: string }).type === "clock",
+    ) as { mediaTime: number; advancing: boolean };
+    // The clock runs from the start position, not from the late chunk.
+    expect(clock.mediaTime).toBe(0);
+    expect(clock.advancing).toBe(true);
+
+    // 0.1 s is 37.5 quanta at 48 kHz; by then the track's own samples play.
+    for (let i = 0; i < 38; i++) quantum(processor);
+    expect(quantum(processor)[127]).toBe(0.5);
+  });
+
+  it("holds a new run's audio until the page starts it", () => {
+    const processor = new Processor({ processorOptions: { channels: 1 } });
+    const page = (data: PageToWorkletMessage) => processor.port.onmessage!({ data });
+    const worker = (data: WorkerToWorkletMessage) =>
+      (processor as unknown as { onWorker(message: WorkerToWorkletMessage): void }).onWorker(data);
+    page({ type: "generation", generation: 1, position: 0 });
+    page({ type: "playing", playing: true });
+    // A seek: the worker's first chunk for run 2 beats the page's messages.
+    worker({
+      type: "pcm",
+      generation: 2,
+      timestamp: 30,
+      samples: new Float32Array(4_800).fill(0.5),
+    });
+    expect(Array.from(quantum(processor)).every((sample) => sample === 0)).toBe(true);
+    page({ type: "generation", generation: 2, position: 30 });
+    page({ type: "playing", playing: true });
+    expect(quantum(processor)[0]).toBe(0.5);
+  });
+
+  it("reports running dry as a stop, without an advancing clock after it", () => {
+    const processor = new Processor({ processorOptions: { channels: 1 } });
+    const page = (data: PageToWorkletMessage) => processor.port.onmessage!({ data });
+    page({ type: "generation", generation: 1, position: 0 });
+    page({ type: "playing", playing: true });
+    const onWorker = (processor as unknown as { onWorker(message: WorkerToWorkletMessage): void })
+      .onWorker;
+    // Four quanta so the periodic clock report falls on the quantum that runs dry.
+    onWorker.call(processor, {
+      type: "pcm",
+      generation: 1,
+      timestamp: 0,
+      samples: new Float32Array(128 * 3 + 64).fill(0.5),
+    });
+    for (let i = 0; i < 4; i++) quantum(processor);
+    const messages = processor.port.posted as Array<{ type: string; advancing?: boolean }>;
+    const underrun = messages.findIndex((message) => message.type === "underrun");
+    expect(underrun).toBeGreaterThanOrEqual(0);
+    expect(
+      messages.slice(underrun).some((message) => message.type === "clock" && message.advancing),
+    ).toBe(false);
+  });
+
+  describe("at a speed other than 1x", () => {
+    const RATE = 48_000;
+
+    function setup(channels: number) {
+      const processor = new Processor({ processorOptions: { channels } });
+      const page = (data: PageToWorkletMessage) => processor.port.onmessage!({ data });
+      const worker = (data: WorkerToWorkletMessage) =>
+        (processor as unknown as { onWorker(message: WorkerToWorkletMessage): void }).onWorker(
+          data,
+        );
+      page({ type: "generation", generation: 1, position: 0 });
+      page({ type: "playing", playing: true });
+      const render = (quanta: number) => {
+        const out = Array.from({ length: channels }, () => new Float32Array(quanta * 128));
+        for (let q = 0; q < quanta; q++) {
+          const output = Array.from({ length: channels }, () => new Float32Array(128));
+          processor.process([], [output]);
+          for (let c = 0; c < channels; c++) out[c]!.set(output[c]!, q * 128);
+        }
+        return out;
+      };
+      const lastClock = () =>
+        (processor.port.posted as Array<{ type: string; mediaTime: number; advancing: boolean }>)
+          .filter((message) => message.type === "clock")
+          .pop()!;
+      return { processor, page, worker, render, lastClock };
+    }
+
+    function sine(frequency: number, seconds: number, channels: number, polarity = [1, -1]) {
+      const frames = Math.round(seconds * RATE);
+      const samples = new Float32Array(frames * channels);
+      for (let i = 0; i < frames; i++) {
+        const x = 0.5 * Math.sin((2 * Math.PI * frequency * i) / RATE);
+        for (let c = 0; c < channels; c++) samples[i * channels + c] = x * polarity[c % 2]!;
+      }
+      return samples;
+    }
+
+    /** Upward zero crossings per second. */
+    function frequencyOf(signal: Float32Array): number {
+      let crossings = 0;
+      for (let i = 1; i < signal.length; i++) {
+        if (signal[i - 1]! < 0 && signal[i]! >= 0) crossings += 1;
+      }
+      return crossings / (signal.length / RATE);
+    }
+
+    it.each([0.5, 1.5, 2, 3])("keeps the pitch and advances the clock %sx as fast", (speed) => {
+      const { page, worker, render, lastClock } = setup(1);
+      worker({ type: "pcm", generation: 1, timestamp: 0, samples: sine(440, 4, 1) });
+      page({ type: "rate", rate: speed });
+      // 0.8 s of output: 300 quanta.
+      const [out] = render(300);
+      expect(frequencyOf(out!.subarray(4_800))).toBeGreaterThan(440 * 0.97);
+      expect(frequencyOf(out!.subarray(4_800))).toBeLessThan(440 * 1.03);
+      expect(lastClock().mediaTime).toBeCloseTo((299 * 128 * speed) / RATE, 2);
+    });
+
+    it("keeps out-of-phase channels at full level", () => {
+      const { page, worker, render } = setup(2);
+      worker({ type: "pcm", generation: 1, timestamp: 0, samples: sine(440, 4, 2) });
+      page({ type: "rate", rate: 1.5 });
+      const [left, right] = render(300);
+      // RMS over each 10 ms window: a join that cancels shows as a dip.
+      let lowest = Infinity;
+      for (let start = 4_800; start + 480 <= left!.length; start += 480) {
+        let sum = 0;
+        for (let i = start; i < start + 480; i++) sum += left![i]! * left![i]!;
+        lowest = Math.min(lowest, Math.sqrt(sum / 480));
+      }
+      expect(lowest).toBeGreaterThan(0.3);
+      for (let i = 4_800; i < left!.length; i++) expect(right![i]).toBeCloseTo(-left![i]!, 6);
+    });
+
+    it("plays a gap in the audio as silence instead of skipping it", () => {
+      const { page, worker, render, lastClock } = setup(1);
+      worker({
+        type: "pcm",
+        generation: 1,
+        timestamp: 0,
+        samples: new Float32Array(1_024).fill(0.5),
+      });
+      // The next chunk starts 100 ms after the first one ends.
+      const next = 1_024 / RATE + 0.1;
+      worker({
+        type: "pcm",
+        generation: 1,
+        timestamp: next,
+        samples: new Float32Array(48_000).fill(0.25),
+      });
+      worker({ type: "end", generation: 1 });
+      page({ type: "rate", rate: 3 });
+      const [out] = render(40);
+      let silent = 0;
+      for (const sample of out!) if (sample === 0) silent += 1;
+      // 100 ms of media at 3x is about 1,600 frames, less the 20 ms tolerance.
+      expect(silent).toBeGreaterThan(1_200);
+      // The clock keeps the gap's time, snapping onto the next chunk's own
+      // timestamp within the tolerance, as at 1x.
+      const media = lastClock().mediaTime;
+      expect(media).toBeGreaterThanOrEqual((39 * 128 * 3) / RATE);
+      expect(media).toBeLessThanOrEqual((39 * 128 * 3) / RATE + 0.021);
+    });
+
+    it("keeps a gap that starts after the queue ran dry", () => {
+      const { page, worker, render, lastClock } = setup(1);
+      for (let i = 0; i < 9; i++) {
+        worker({
+          type: "pcm",
+          generation: 1,
+          timestamp: (i * 1_024) / RATE,
+          samples: new Float32Array(1_024).fill(0.5),
+        });
+      }
+      render(1);
+      page({ type: "rate", rate: 3 });
+      render(25);
+      // Audio resumes 100 ms after the old audio ends.
+      const end = (9 * 1_024) / RATE;
+      worker({
+        type: "pcm",
+        generation: 1,
+        timestamp: end + 0.1,
+        samples: new Float32Array(48_000).fill(0.25),
+      });
+      const [out] = render(1);
+      expect(out!.every((sample) => sample === 0)).toBe(true);
+      expect(lastClock().mediaTime).toBeLessThan(end + 0.01);
+    });
+
+    it("waits for more audio instead of playing silence it does not have", () => {
+      const { processor, page, worker, render } = setup(1);
+      page({ type: "rate", rate: 2 });
+      // Less than one sequence needs.
+      worker({
+        type: "pcm",
+        generation: 1,
+        timestamp: 0,
+        samples: new Float32Array(1_000).fill(0.5),
+      });
+      const [starved] = render(1);
+      expect(starved!.every((sample) => sample === 0)).toBe(true);
+      expect(
+        (processor.port.posted as Array<{ type: string }>).some(
+          (message) => message.type === "underrun",
+        ),
+      ).toBe(true);
+      worker({
+        type: "pcm",
+        generation: 1,
+        timestamp: 1_000 / RATE,
+        samples: new Float32Array(48_000).fill(0.5),
+      });
+      const [resumed] = render(1);
+      expect(resumed![0]).toBe(0.5);
+    });
+
+    it("drains the last of the stream at speed", () => {
+      const { processor, page, worker, render } = setup(1);
+      page({ type: "rate", rate: 2 });
+      worker({
+        type: "pcm",
+        generation: 1,
+        timestamp: 0,
+        samples: new Float32Array(1_000).fill(0.5),
+      });
+      worker({ type: "end", generation: 1 });
+      const [out] = render(8);
+      expect(out![0]).toBe(0.5);
+      expect(
+        (processor.port.posted as Array<{ type: string }>).some(
+          (message) => message.type === "drained",
+        ),
+      ).toBe(true);
+    });
+
+    it("keeps the audio it plays near the clock", () => {
+      const { page, worker, render } = setup(1);
+      // Each sample holds its own frame index, so the output shows which input plays.
+      const ramp = new Float32Array(4 * RATE);
+      for (let i = 0; i < ramp.length; i++) ramp[i] = i / 1e6;
+      worker({ type: "pcm", generation: 1, timestamp: 0, samples: ramp });
+      page({ type: "rate", rate: 3 });
+      const [out] = render(300);
+      let total = 0;
+      let worst = 0;
+      for (let k = 4_800; k < out!.length; k++) {
+        const lag = Math.abs(out![k]! * 1e6 - k * 3) / RATE;
+        total += lag;
+        worst = Math.max(worst, lag);
+      }
+      // Without centring the audio trails the clock by up to 64 ms at 3x.
+      expect(total / (out!.length - 4_800)).toBeLessThan(0.02);
+      expect(worst).toBeLessThan(0.05);
+    });
+
+    it("reports running dry again after a speed change ends a starved spell", () => {
+      const { processor, page, worker, render } = setup(1);
+      page({ type: "rate", rate: 2 });
+      worker({
+        type: "pcm",
+        generation: 1,
+        timestamp: 0,
+        samples: new Float32Array(1_000).fill(0.5),
+      });
+      render(1);
+      const underruns = () =>
+        (processor.port.posted as Array<{ type: string }>).filter((m) => m.type === "underrun")
+          .length;
+      expect(underruns()).toBe(1);
+      // At 1x what is queued plays, then the queue runs dry for real.
+      page({ type: "rate", rate: 1 });
+      render(12);
+      expect(underruns()).toBe(2);
+    });
+
+    it("plays the last of the stream through its whole media time when slowed", () => {
+      const { processor, page, worker, render } = setup(1);
+      page({ type: "rate", rate: 0.5 });
+      worker({
+        type: "pcm",
+        generation: 1,
+        timestamp: 0,
+        samples: new Float32Array(1_000).fill(0.5),
+      });
+      worker({ type: "end", generation: 1 });
+      const [out] = render(20);
+      // 1,000 frames at 0.5x last 2,000 output frames, all of them sound.
+      expect(out!.subarray(0, 1_990).every((sample) => sample === 0.5)).toBe(true);
+      expect(
+        (processor.port.posted as Array<{ type: string }>).some(
+          (message) => message.type === "drained",
+        ),
+      ).toBe(true);
+    });
+
+    it("returns to 1x without a jump in the waveform", () => {
+      const { page, worker, render } = setup(1);
+      worker({ type: "pcm", generation: 1, timestamp: 0, samples: sine(440, 4, 1) });
+      page({ type: "rate", rate: 2 });
+      const [before] = render(50);
+      page({ type: "rate", rate: 1 });
+      const [after] = render(10);
+      // A 440 Hz sine at 0.5 amplitude moves at most 0.029 per sample.
+      expect(Math.abs(after![0]! - before![before!.length - 1]!)).toBeLessThan(0.06);
+      for (let i = 1; i < after!.length; i++) {
+        expect(Math.abs(after![i]! - after![i - 1]!)).toBeLessThan(0.06);
+      }
+    });
+  });
+});
diff --git a/web/src/player/engine/audio.worklet.ts b/web/src/player/engine/audio.worklet.ts
new file mode 100644
index 0000000000..4db424a610
--- /dev/null
+++ b/web/src/player/engine/audio.worklet.ts
@@ -0,0 +1,336 @@
+/**
+ * The engine's audio output and master clock, running on the audio thread.
+ *
+ * PCM arrives from the decode worker over a MessagePort as interleaved chunks
+ * already mixed to the output layout. Each render quantum copies the next 128
+ * frames out and, every few quanta, tells the page which media time was
+ * rendered at which context time; the page turns that into the playback clock
+ * the video follows. Playing slower or faster than 1x steps through the queue
+ * at that rate, and the samples come from a time stretcher that keeps the
+ * audio's pitch.
+ */
+import { TimeStretcher } from "./timeStretch";
+import type {
+  PageToWorkletMessage,
+  WorkerToWorkletMessage,
+  WorkletToPageMessage,
+  WorkletToWorkerMessage,
+} from "./protocol";
+
+declare const sampleRate: number;
+declare const currentTime: number;
+declare class AudioWorkletProcessor {
+  readonly port: MessagePort;
+  constructor(options?: { processorOptions?: unknown });
+}
+declare function registerProcessor(
+  name: string,
+  processor: new (options: { processorOptions: { channels: number } }) => AudioWorkletProcessor,
+): void;
+
+interface Chunk {
+  samples: Float32Array;
+  frames: number;
+  timestamp: number;
+}
+
+const CLOCK_REPORT_QUANTA = 4;
+const CONSUMED_REPORT_QUANTA = 8;
+/**
+ * A chunk that starts later than this past what has been played is a real gap
+ * (audio starting after the video, or missing packets), filled with silence so
+ * the clock keeps the track's timing. Smaller differences are timestamp
+ * rounding and play back to back.
+ */
+const GAP_TOLERANCE_SECONDS = 0.02;
+
+class EngineAudioProcessor extends AudioWorkletProcessor {
+  private readonly channels: number;
+  private queue: Chunk[] = [];
+  /** Fractional frame position inside queue[0]. */
+  private offset = 0;
+  private generation = -1;
+  private playing = false;
+  private rate = 1;
+  private ended = false;
+  private drainedReported = false;
+  private underrunReported = false;
+  private consumedFrames = 0;
+  private quanta = 0;
+  private lastAdvancing = false;
+  /** The rate in the last clock report; a change is reported at once. */
+  private reportedRate = 1;
+  /**
+   * Media time just past the last sample rendered in this generation, or the
+   * generation's start position before anything has played.
+   */
+  private renderedUntil: number | null = null;
+  private worker: MessagePort | null = null;
+  private readonly stretcher: TimeStretcher;
+  /** The PCM at the read head that the stretcher builds its next sequence from. */
+  private readonly stretchInput: Float32Array;
+  /**
+   * Less than a sequence is left before the end of the stream: it plays
+   * unstretched, so its samples fill the media time left instead of a
+   * sequence padded with silence.
+   */
+  private finishing = false;
+
+  constructor(options: { processorOptions: { channels: number } }) {
+    super(options);
+    this.channels = options.processorOptions.channels;
+    this.stretcher = new TimeStretcher(this.channels, sampleRate);
+    this.stretchInput = new Float32Array(this.stretcher.maxInputFrames * this.channels);
+    this.port.onmessage = (event: MessageEvent<PageToWorkletMessage>) => this.onPage(event.data);
+  }
+
+  private adopt(generation: number): void {
+    if (generation <= this.generation) return;
+    this.generation = generation;
+    // The worker's first chunk can arrive before the page's messages for this
+    // run, which travel on another port. Output waits for the page to say the
+    // new position is ready.
+    this.playing = false;
+    this.queue = [];
+    this.offset = 0;
+    this.ended = false;
+    this.drainedReported = false;
+    this.underrunReported = false;
+    this.consumedFrames = 0;
+    this.renderedUntil = null;
+    this.finishing = false;
+    this.stretcher.reset();
+  }
+
+  private onPage(message: PageToWorkletMessage): void {
+    switch (message.type) {
+      case "connect":
+        this.worker = message.port;
+        this.worker.onmessage = (event: MessageEvent<WorkerToWorkletMessage>) =>
+          this.onWorker(event.data);
+        return;
+      case "generation":
+        this.adopt(message.generation);
+        // The worker's first chunk can arrive before this message and adopt the
+        // generation without its position.
+        if (message.generation === this.generation && this.renderedUntil === null) {
+          this.renderedUntil = message.position;
+        }
+        return;
+      case "playing":
+        this.playing = message.playing;
+        return;
+      case "rate": {
+        const rate = message.rate > 0 ? message.rate : 1;
+        if (rate === 1 && this.rate !== 1) this.stretcher.release();
+        else if (rate !== 1 && this.rate === 1) this.stretcher.reset();
+        this.rate = rate;
+        return;
+      }
+    }
+  }
+
+  private onWorker(message: WorkerToWorkletMessage): void {
+    if (message.generation < this.generation) return;
+    this.adopt(message.generation);
+    if (message.type === "end") {
+      this.ended = true;
+      return;
+    }
+    const frames = Math.floor(message.samples.length / this.channels);
+    if (frames > 0) {
+      const chunk = { samples: message.samples, frames, timestamp: message.timestamp };
+      // The queue ran dry with the head past the end of the last chunk.
+      if (this.queue.length === 0) this.carryIntoGap(chunk);
+      this.queue.push(chunk);
+      this.underrunReported = false;
+    }
+  }
+
+  process(_inputs: Float32Array[][], outputs: Float32Array[][]): boolean {
+    const output = outputs[0];
+    if (!output || output.length === 0) return true;
+    const length = output[0]!.length;
+    const head = this.queue[0];
+    let mediaTime: number | null = null;
+    if (head) {
+      mediaTime = this.inGap(head) ? this.renderedUntil : head.timestamp + this.offset / sampleRate;
+    }
+    let rendered = 0;
+    // The stretcher had too little PCM queued to build its next sequence.
+    let starved = false;
+
+    if (this.playing) {
+      const channels = Math.min(this.channels, output.length);
+      const step = this.rate;
+      const stretched = step !== 1;
+      for (; rendered < length && this.queue.length > 0; rendered++) {
+        const chunk = this.queue[0]!;
+        if (this.inGap(chunk)) {
+          for (let c = 0; c < channels; c++) output[c]![rendered] = 0;
+          this.renderedUntil! += step / sampleRate;
+          this.stretcher.reset();
+          continue;
+        }
+        if (stretched && !this.finishing && this.stretcher.pending === 0) {
+          if (this.peek(this.stretcher.inputFrames(step))) {
+            this.stretcher.build(step, this.stretchInput);
+          } else if (this.ended) {
+            this.finishing = true;
+            this.stretcher.release();
+          } else {
+            starved = true;
+            break;
+          }
+        }
+        if (stretched && !this.finishing) {
+          this.stretcher.take(output, rendered, channels);
+        } else {
+          const index = Math.floor(this.offset);
+          const fraction = this.offset - index;
+          const next = index + 1 < chunk.frames ? chunk : this.queue[1];
+          const nextIndex = index + 1 < chunk.frames ? index + 1 : 0;
+          for (let c = 0; c < channels; c++) {
+            const a = chunk.samples[index * this.channels + c]!;
+            const b = fraction > 0 && next ? next.samples[nextIndex * this.channels + c]! : a;
+            // Interpolating between two samples never leaves their range, so the
+            // mix's limiting holds here.
+            output[c]![rendered] = a + (b - a) * fraction;
+          }
+          this.stretcher.blend(output, rendered, channels);
+        }
+        this.offset += step;
+        this.consumedFrames += step;
+        while (this.queue.length > 0 && this.offset >= this.queue[0]!.frames) {
+          const finished = this.queue.shift()!;
+          this.offset -= finished.frames;
+          this.renderedUntil = finished.timestamp + finished.frames / sampleRate;
+          if (this.queue.length > 0) this.carryIntoGap(this.queue[0]!);
+        }
+      }
+      if (rendered > 0 && this.queue[0] && !this.inGap(this.queue[0])) {
+        this.renderedUntil = this.queue[0].timestamp + this.offset / sampleRate;
+      }
+    }
+    for (let c = 0; c < output.length; c++) output[c]!.fill(0, rendered);
+
+    const ranDry =
+      this.playing && (this.queue.length === 0 || starved) && !this.ended && !this.underrunReported;
+    // When the queue ran dry inside this quantum, the underrun is the report:
+    // an advancing clock for the samples before it would carry the clock on
+    // through the silence that follows.
+    const advancing = rendered > 0 && !ranDry;
+    if (ranDry) {
+      this.underrunReported = true;
+      this.postPage({
+        type: "underrun",
+        generation: this.generation,
+        contextTime: currentTime + rendered / sampleRate,
+        mediaTime: this.renderedUntil,
+      });
+    }
+    if (this.ended && this.queue.length === 0 && !this.drainedReported) {
+      this.drainedReported = true;
+      this.postPage({ type: "drained", generation: this.generation });
+    }
+
+    this.quanta += 1;
+    if (
+      !ranDry &&
+      mediaTime !== null &&
+      (advancing !== this.lastAdvancing ||
+        this.rate !== this.reportedRate ||
+        this.quanta % CLOCK_REPORT_QUANTA === 0)
+    ) {
+      this.reportedRate = this.rate;
+      this.postPage({
+        type: "clock",
+        generation: this.generation,
+        contextTime: currentTime,
+        mediaTime,
+        advancing,
+        rate: this.rate,
+      });
+    }
+    this.lastAdvancing = advancing;
+    // Audio flowing again ends a dry spell even without new PCM, as when a
+    // speed change lets the stretcher build from what is already queued.
+    if (advancing) this.underrunReported = false;
+    if (this.worker && this.quanta % CONSUMED_REPORT_QUANTA === 0) {
+      const report: WorkletToWorkerMessage = {
+        type: "consumed",
+        generation: this.generation,
+        consumedSeconds: this.consumedFrames / sampleRate,
+      };
+      this.worker.postMessage(report);
+    }
+    return true;
+  }
+
+  /** True while `chunk` is not due yet: silence plays until it is. */
+  private inGap(chunk: Chunk): boolean {
+    return (
+      this.offset < 1 && this.renderedUntil !== null && this.startsLate(chunk, this.renderedUntil)
+    );
+  }
+
+  /**
+   * Above 1x the head can step past the end of a chunk. When `next` starts
+   * after a gap, those frames play the gap's silence instead of skipping
+   * into it.
+   */
+  private carryIntoGap(next: Chunk): void {
+    if (
+      this.offset > 0 &&
+      this.renderedUntil !== null &&
+      this.startsLate(next, this.renderedUntil)
+    ) {
+      this.renderedUntil += this.offset / sampleRate;
+      this.offset = 0;
+    }
+  }
+
+  private startsLate(chunk: Chunk, after: number): boolean {
+    return chunk.timestamp - after > GAP_TOLERANCE_SECONDS;
+  }
+
+  /**
+   * Copies `frames` frames of the stream from the read head into
+   * stretchInput, with silence where the queue's timestamps leave a gap.
+   * False when less than that is queued.
+   */
+  private peek(frames: number): boolean {
+    const channels = this.channels;
+    const into = this.stretchInput;
+    let written = 0;
+    let index = Math.floor(this.offset);
+    for (let i = 0; i < this.queue.length && written < frames; i++) {
+      const chunk = this.queue[i]!;
+      if (i > 0) {
+        const previous = this.queue[i - 1]!;
+        const end = previous.timestamp + previous.frames / sampleRate;
+        if (this.startsLate(chunk, end)) {
+          const silent = Math.min(
+            frames - written,
+            Math.round((chunk.timestamp - end) * sampleRate),
+          );
+          into.fill(0, written * channels, (written + silent) * channels);
+          written += silent;
+        }
+        index = 0;
+      }
+      const count = Math.min(chunk.frames - index, frames - written);
+      const from = index * channels;
+      const to = written * channels;
+      for (let s = 0; s < count * channels; s++) into[to + s] = chunk.samples[from + s]!;
+      written += count;
+    }
+    return written >= frames;
+  }
+
+  private postPage(message: WorkletToPageMessage): void {
+    this.port.postMessage(message);
+  }
+}
+
+registerProcessor("prairie-engine-audio", EngineAudioProcessor);
diff --git a/web/src/player/engine/audioMix.test.ts b/web/src/player/engine/audioMix.test.ts
new file mode 100644
index 0000000000..16c706bd47
--- /dev/null
+++ b/web/src/player/engine/audioMix.test.ts
@@ -0,0 +1,110 @@
+import { describe, expect, it } from "vitest";
+import {
+  defaultSpeakers,
+  LinearResampler,
+  mixMatrix,
+  mixToInterleaved,
+  outputChannelCount,
+  SPEAKER,
+  speakersFromMask,
+  unpackPCM,
+} from "./audioMix";
+
+const S = SPEAKER;
+
+describe("speakersFromMask", () => {
+  it("lists native mask bits in channel order", () => {
+    expect(speakersFromMask(0x60f, 6)).toEqual([S.FL, S.FR, S.FC, S.LFE, S.SL, S.SR]);
+    expect(speakersFromMask(0x63f, 8)).toEqual([S.FL, S.FR, S.FC, S.LFE, S.BL, S.BR, S.SL, S.SR]);
+  });
+
+  it("falls back to the WAVE order when the mask is absent or inconsistent", () => {
+    expect(speakersFromMask(0, 6)).toEqual(defaultSpeakers(6));
+    expect(speakersFromMask(0x3, 6)).toEqual(defaultSpeakers(6));
+  });
+});
+
+describe("outputChannelCount", () => {
+  it("passes surround through only when the device carries it", () => {
+    expect(outputChannelCount(8, 8)).toBe(8);
+    expect(outputChannelCount(8, 6)).toBe(6);
+    expect(outputChannelCount(6, 2)).toBe(2);
+    expect(outputChannelCount(1, 8)).toBe(2);
+  });
+});
+
+describe("mixMatrix", () => {
+  it("downmixes 5.1 to stereo with Lo/Ro coefficients and no LFE", () => {
+    const matrix = mixMatrix([S.FL, S.FR, S.FC, S.LFE, S.SL, S.SR], 2);
+    const c = Math.SQRT1_2;
+    expect(Array.from(matrix.slice(0, 6))).toEqual([1, 0, Math.fround(c), 0, Math.fround(c), 0]);
+    expect(Array.from(matrix.slice(6))).toEqual([0, 1, Math.fround(c), 0, 0, Math.fround(c)]);
+  });
+
+  it("maps 5.1(side) onto a 5.1 device without loss", () => {
+    const matrix = mixMatrix([S.FL, S.FR, S.FC, S.LFE, S.SL, S.SR], 6);
+    for (let output = 0; output < 6; output++) {
+      const row = Array.from(matrix.slice(output * 6, output * 6 + 6));
+      expect(row.filter((gain) => gain !== 0)).toEqual([1]);
+    }
+  });
+
+  it("folds 7.1 surrounds into a 5.1 device", () => {
+    const matrix = mixMatrix([S.FL, S.FR, S.FC, S.LFE, S.BL, S.BR, S.SL, S.SR], 6);
+    // Output 4 is the left surround: back-left and side-left both land there.
+    expect(matrix[4 * 8 + 4]).toBe(1);
+    expect(matrix[4 * 8 + 6]).toBe(1);
+  });
+
+  it("plays mono on both speakers", () => {
+    expect(Array.from(mixMatrix([S.FC], 2))).toEqual([1, 1]);
+  });
+});
+
+describe("mixToInterleaved", () => {
+  it("applies the matrix and interleaves", () => {
+    const out = mixToInterleaved(
+      [new Float32Array([1, 0]), new Float32Array([0, 1])],
+      new Float32Array([1, 0, 0, 1]),
+      2,
+    );
+    expect(Array.from(out)).toEqual([1, 0, 0, 1]);
+  });
+
+  it("keeps channels passed straight through exact, and limits only an over-unity mix", () => {
+    const loud = new Float32Array([0.98]);
+    // Stereo passthrough: no channel sums more than one input.
+    const straight = mixToInterleaved([loud, loud], new Float32Array([1, 0, 0, 1]), 2);
+    expect(Array.from(straight)).toEqual([loud[0], loud[0]]);
+    // Two inputs at full gain on one output can go over full scale.
+    const half = new Float32Array([0.6]);
+    const summed = mixToInterleaved([half, half], new Float32Array([1, 1]), 1);
+    expect(summed[0]).toBeLessThan(1);
+    expect(summed[0]).toBeGreaterThan(0.9);
+  });
+});
+
+describe("unpackPCM", () => {
+  it("unpacks little-endian 24-bit and big-endian 16-bit samples", () => {
+    const s24 = unpackPCM(new Uint8Array([0x00, 0x00, 0x40, 0x00, 0x00, 0xc0]), "pcm-s24", 2);
+    expect(s24.map((plane) => plane[0])).toEqual([0.5, -0.5]);
+    const s16be = unpackPCM(new Uint8Array([0x40, 0x00]), "pcm-s16be", 1);
+    expect(s16be[0]![0]).toBe(0.5);
+  });
+});
+
+describe("LinearResampler", () => {
+  it("produces the expected length across chunk boundaries", () => {
+    const resampler = new LinearResampler(44_100, 48_000, 1);
+    let produced = 0;
+    for (let i = 0; i < 10; i++) produced += resampler.process([new Float32Array(441)])[0]!.length;
+    expect(Math.abs(produced - 4800)).toBeLessThanOrEqual(1);
+  });
+
+  it("interpolates a ramp continuously over a chunk boundary", () => {
+    const resampler = new LinearResampler(2, 4, 1);
+    const first = resampler.process([new Float32Array([0, 2])])[0]!;
+    const second = resampler.process([new Float32Array([4, 6])])[0]!;
+    expect(Array.from([...first, ...second])).toEqual([0, 1, 2, 3, 4, 5, 6]);
+  });
+});
diff --git a/web/src/player/engine/audioMix.ts b/web/src/player/engine/audioMix.ts
new file mode 100644
index 0000000000..d9ba9503fb
--- /dev/null
+++ b/web/src/player/engine/audioMix.ts
@@ -0,0 +1,354 @@
+/**
+ * Channel mapping, downmixing, PCM unpacking and rate conversion for the
+ * engine's audio path. Everything here is synchronous and allocation-light: it
+ * runs in the worker for every decoded frame.
+ */
+
+/** Speaker positions as FFmpeg `AV_CH_*` bit indexes. */
+export const SPEAKER = {
+  FL: 0,
+  FR: 1,
+  FC: 2,
+  LFE: 3,
+  BL: 4,
+  BR: 5,
+  FLC: 6,
+  FRC: 7,
+  BC: 8,
+  SL: 9,
+  SR: 10,
+  TC: 11,
+  TFL: 12,
+  TFC: 13,
+  TFR: 14,
+  TBL: 15,
+  TBC: 16,
+  TBR: 17,
+} as const;
+
+const S = SPEAKER;
+
+/**
+ * Speaker order a decoder uses when it reports only a channel count: the WAVE
+ * order, which FFmpeg's defaults follow. Chrome and Firefox WebCodecs output
+ * multichannel AAC and Opus in this order too: they reorder from the codecs'
+ * own layouts (AAC's center-first, Opus's Vorbis order) before handing data out.
+ */
+export function defaultSpeakers(count: number): number[] {
+  switch (count) {
+    case 1:
+      return [S.FC];
+    case 2:
+      return [S.FL, S.FR];
+    case 3:
+      return [S.FL, S.FR, S.FC];
+    case 4:
+      return [S.FL, S.FR, S.BL, S.BR];
+    case 5:
+      return [S.FL, S.FR, S.FC, S.BL, S.BR];
+    case 6:
+      return [S.FL, S.FR, S.FC, S.LFE, S.BL, S.BR];
+    case 7:
+      return [S.FL, S.FR, S.FC, S.LFE, S.BC, S.SL, S.SR];
+    case 8:
+      return [S.FL, S.FR, S.FC, S.LFE, S.BL, S.BR, S.SL, S.SR];
+    default:
+      // Unknown wide layouts keep their first pair as the fronts.
+      return Array.from({ length: count }, (_, i) => (i === 0 ? S.FL : i === 1 ? S.FR : -1));
+  }
+}
+
+/** Speakers named by a native FFmpeg channel mask, in channel order. */
+export function speakersFromMask(mask: number, count: number): number[] {
+  if (mask <= 0) return defaultSpeakers(count);
+  const speakers: number[] = [];
+  for (let bit = 0; bit < 64 && speakers.length < count; bit++) {
+    if (Math.floor(mask / 2 ** bit) % 2 === 1) speakers.push(bit);
+  }
+  return speakers.length === count ? speakers : defaultSpeakers(count);
+}
+
+/**
+ * Output channel count for a source: surround passes through when the device
+ * output can carry it, everything else plays as stereo.
+ */
+export function outputChannelCount(sourceChannels: number, deviceMaxChannels: number): number {
+  if (sourceChannels >= 8 && deviceMaxChannels >= 8) return 8;
+  if (sourceChannels >= 6 && deviceMaxChannels >= 6) return 6;
+  return 2;
+}
+
+/** Output speakers per channel count; 6 and 8 follow the Web Audio/WAVE order. */
+function outputSpeakers(channels: number): number[] {
+  if (channels === 8) return [S.FL, S.FR, S.FC, S.LFE, S.BL, S.BR, S.SL, S.SR];
+  if (channels === 6) return [S.FL, S.FR, S.FC, S.LFE, S.BL, S.BR];
+  return [S.FL, S.FR];
+}
+
+const MINUS_3DB = Math.SQRT1_2;
+
+/**
+ * Where an input speaker goes when the output has no speaker of its own for
+ * it. Downmixing to stereo follows the ATSC A/52 Lo/Ro coefficients: center
+ * and surrounds at -3 dB, LFE dropped. `mixToInterleaved` soft-limits the rare
+ * overs this produces on fully correlated loud passages.
+ */
+function routeSpeaker(speaker: number, outputs: number[]): Array<[number, number]> {
+  const direct = outputs.indexOf(speaker);
+  if (direct >= 0) return [[direct, 1]];
+  const at = (target: number) => outputs.indexOf(target);
+  const pair = (left: number, right: number, gain: number): Array<[number, number]> => {
+    const routes: Array<[number, number]> = [
+      [at(left), gain],
+      [at(right), gain],
+    ];
+    return routes.filter(([index]) => index >= 0);
+  };
+  const one = (target: number, gain: number): Array<[number, number]> =>
+    at(target) >= 0 ? [[at(target), gain]] : [];
+  switch (speaker) {
+    case S.FC:
+      return pair(S.FL, S.FR, MINUS_3DB);
+    case S.LFE:
+      return [];
+    case S.SL:
+      return at(S.BL) >= 0 ? one(S.BL, 1) : one(S.FL, MINUS_3DB);
+    case S.SR:
+      return at(S.BR) >= 0 ? one(S.BR, 1) : one(S.FR, MINUS_3DB);
+    case S.BL:
+      return at(S.SL) >= 0 ? one(S.SL, 1) : one(S.FL, MINUS_3DB);
+    case S.BR:
+      return at(S.SR) >= 0 ? one(S.SR, 1) : one(S.FR, MINUS_3DB);
+    case S.BC:
+      return at(S.BL) >= 0 ? pair(S.BL, S.BR, MINUS_3DB) : pair(S.FL, S.FR, 0.5);
+    case S.FLC:
+      return one(S.FL, 1);
+    case S.FRC:
+      return one(S.FR, 1);
+    case S.TFL:
+    case S.TBL:
+      return one(S.FL, 0.5);
+    case S.TFR:
+    case S.TBR:
+      return one(S.FR, 0.5);
+    case S.TC:
+    case S.TFC:
+    case S.TBC:
+      return pair(S.FL, S.FR, 0.35);
+    default:
+      return [];
+  }
+}
+
+/**
+ * Gain matrix, `[output][input]` flattened row-major, taking the input
+ * speakers to `outputChannels`. Mono plays on both stereo speakers.
+ */
+export function mixMatrix(inputSpeakers: number[], outputChannels: number): Float32Array {
+  const outputs = outputSpeakers(outputChannels);
+  const matrix = new Float32Array(outputs.length * inputSpeakers.length);
+  const monoSource = inputSpeakers.length === 1;
+  inputSpeakers.forEach((speaker, input) => {
+    const routes = monoSource
+      ? outputs.slice(0, 2).map((_, index) => [index, 1] as [number, number])
+      : routeSpeaker(speaker, outputs);
+    for (const [output, gain] of routes) {
+      const cell = output * inputSpeakers.length + input;
+      matrix[cell] = matrix[cell]! + gain;
+    }
+  });
+  return matrix;
+}
+
+/** Applies a mix matrix to planar input, writing interleaved output. */
+export function mixToInterleaved(
+  planes: readonly Float32Array[],
+  matrix: Float32Array,
+  outputChannels: number,
+  start = 0,
+  end = planes[0]?.length ?? 0,
+): Float32Array {
+  const inputs = planes.length;
+  const frames = Math.max(0, end - start);
+  const out = new Float32Array(frames * outputChannels);
+  for (let o = 0; o < outputChannels; o++) {
+    let rowGain = 0;
+    for (let i = 0; i < inputs; i++) {
+      const gain = matrix[o * inputs + i]!;
+      if (gain === 0) continue;
+      rowGain += Math.abs(gain);
+      const plane = planes[i]!;
+      for (let f = 0; f < frames; f++) out[f * outputChannels + o]! += plane[start + f]! * gain;
+    }
+    // Only a mix that sums several inputs can go over full scale; a channel
+    // passed straight through keeps its samples exactly.
+    if (rowGain > 1) {
+      for (let f = 0; f < frames; f++) {
+        const index = f * outputChannels + o;
+        out[index] = softLimit(out[index]!);
+      }
+    }
+  }
+  return out;
+}
+
+const LIMITER_KNEE = 0.9;
+
+/** Soft-clips above the knee so a hot downmix never wraps or hard-clips. */
+function softLimit(sample: number): number {
+  const magnitude = Math.abs(sample);
+  if (magnitude <= LIMITER_KNEE) return sample;
+  const over = (magnitude - LIMITER_KNEE) / (1 - LIMITER_KNEE);
+  return Math.sign(sample) * (LIMITER_KNEE + (1 - LIMITER_KNEE) * Math.tanh(over));
+}
+
+/** Mediabunny PCM codec names the engine unpacks itself. */
+export type PCMFormat =
+  | "pcm-u8"
+  | "pcm-s16"
+  | "pcm-s16be"
+  | "pcm-s24"
+  | "pcm-s24be"
+  | "pcm-s32"
+  | "pcm-s32be"
+  | "pcm-f32"
+  | "pcm-f32be"
+  | "pcm-f64"
+  | "pcm-f64be";
+
+/** Server codec name → Mediabunny PCM codec name. */
+export const SERVER_PCM_FORMATS: Record<string, PCMFormat> = {
+  pcm_u8: "pcm-u8",
+  pcm_s16le: "pcm-s16",
+  pcm_s16be: "pcm-s16be",
+  pcm_s24le: "pcm-s24",
+  pcm_s24be: "pcm-s24be",
+  pcm_s32le: "pcm-s32",
+  pcm_s32be: "pcm-s32be",
+  pcm_f32le: "pcm-f32",
+  pcm_f32be: "pcm-f32be",
+  pcm_f64le: "pcm-f64",
+  pcm_f64be: "pcm-f64be",
+};
+
+function pcmBytesPerSample(format: PCMFormat): number {
+  switch (format) {
+    case "pcm-u8":
+      return 1;
+    case "pcm-s16":
+    case "pcm-s16be":
+      return 2;
+    case "pcm-s24":
+    case "pcm-s24be":
+      return 3;
+    case "pcm-f64":
+    case "pcm-f64be":
+      return 8;
+    default:
+      return 4;
+  }
+}
+
+/** Unpacks interleaved PCM bytes into planar float32. */
+export function unpackPCM(data: Uint8Array, format: PCMFormat, channels: number): Float32Array[] {
+  const bytes = pcmBytesPerSample(format);
+  const frames = Math.floor(data.byteLength / (bytes * channels));
+  const planes = Array.from({ length: channels }, () => new Float32Array(frames));
+  const view = new DataView(data.buffer, data.byteOffset, data.byteLength);
+  for (let f = 0; f < frames; f++) {
+    for (let c = 0; c < channels; c++) {
+      const at = (f * channels + c) * bytes;
+      let value: number;
+      switch (format) {
+        case "pcm-u8":
+          value = (view.getUint8(at) - 128) / 128;
+          break;
+        case "pcm-s16":
+          value = view.getInt16(at, true) / 32768;
+          break;
+        case "pcm-s16be":
+          value = view.getInt16(at, false) / 32768;
+          break;
+        case "pcm-s24": {
+          const raw =
+            view.getUint8(at) | (view.getUint8(at + 1) << 8) | (view.getInt8(at + 2) << 16);
+          value = raw / 8388608;
+          break;
+        }
+        case "pcm-s24be": {
+          const raw =
+            (view.getInt8(at) << 16) | (view.getUint8(at + 1) << 8) | view.getUint8(at + 2);
+          value = raw / 8388608;
+          break;
+        }
+        case "pcm-s32":
+          value = view.getInt32(at, true) / 2147483648;
+          break;
+        case "pcm-s32be":
+          value = view.getInt32(at, false) / 2147483648;
+          break;
+        case "pcm-f32":
+          value = view.getFloat32(at, true);
+          break;
+        case "pcm-f32be":
+          value = view.getFloat32(at, false);
+          break;
+        case "pcm-f64":
+          value = view.getFloat64(at, true);
+          break;
+        case "pcm-f64be":
+          value = view.getFloat64(at, false);
+          break;
+      }
+      planes[c]![f] = value;
+    }
+  }
+  return planes;
+}
+
+/**
+ * Streaming linear-interpolation resampler for planar audio. Only used when a
+ * decoder reports a rate other than the one the AudioContext was opened at,
+ * which the container metadata normally predicts exactly.
+ *
+ * `position` is the next output sample's fractional index into the current
+ * chunk; -1..0 interpolates from the previous chunk's last sample.
+ */
+export class LinearResampler {
+  private position = 0;
+  private readonly previous: Float32Array;
+
+  constructor(
+    private readonly inputRate: number,
+    private readonly outputRate: number,
+    channels: number,
+  ) {
+    this.previous = new Float32Array(channels);
+  }
+
+  process(planes: readonly Float32Array[]): Float32Array[] {
+    const frames = planes[0]?.length ?? 0;
+    if (frames === 0) return planes.map(() => new Float32Array(0));
+    const step = this.inputRate / this.outputRate;
+    const capacity = Math.ceil((frames - this.position) / step) + 1;
+    const out = planes.map(() => new Float32Array(capacity));
+    let written = 0;
+    let position = this.position;
+    for (;;) {
+      const index = Math.floor(position);
+      const fraction = position - index;
+      if (index > frames - 1 || (index + 1 > frames - 1 && fraction > 0)) break;
+      for (let c = 0; c < planes.length; c++) {
+        const plane = planes[c]!;
+        const a = index < 0 ? this.previous[c]! : plane[index]!;
+        const b = fraction > 0 ? plane[index + 1]! : a;
+        out[c]![written] = a + (b - a) * fraction;
+      }
+      written += 1;
+      position += step;
+    }
+    this.position = position - frames;
+    for (let c = 0; c < planes.length; c++) this.previous[c] = planes[c]![frames - 1]!;
+    return out.map((plane) => plane.subarray(0, written));
+  }
+}
diff --git a/web/src/player/engine/audioOutput.ts b/web/src/player/engine/audioOutput.ts
new file mode 100644
index 0000000000..f953a0f8c3
--- /dev/null
+++ b/web/src/player/engine/audioOutput.ts
@@ -0,0 +1,110 @@
+import workletUrl from "./audio.worklet.ts?worker&url";
+import { outputChannelCount } from "./audioMix";
+import type { PageToWorkletMessage, WorkletToPageMessage } from "./protocol";
+
+const RESUME_TIMEOUT_MS = 1_500;
+
+/**
+ * The page's side of the engine's audio: an AudioContext opened at the
+ * track's own rate (the browser resamples to the device), the worklet that
+ * plays the decoded PCM, and a gain stage for volume.
+ */
+export class EngineAudioOutput {
+  readonly channels: number;
+
+  private constructor(
+    readonly context: AudioContext,
+    private readonly node: AudioWorkletNode,
+    private readonly gain: GainNode,
+    channels: number,
+  ) {
+    this.channels = channels;
+  }
+
+  static async create(
+    sampleRate: number,
+    sourceChannels: number,
+    onMessage: (message: WorkletToPageMessage) => void,
+  ): Promise<EngineAudioOutput> {
+    const context = new AudioContext({ sampleRate, latencyHint: "playback" });
+    try {
+      await context.audioWorklet.addModule(workletUrl);
+      const channels = outputChannelCount(sourceChannels, context.destination.maxChannelCount);
+      if (channels > 2) {
+        context.destination.channelCount = channels;
+        context.destination.channelCountMode = "explicit";
+        context.destination.channelInterpretation = channels === 6 ? "speakers" : "discrete";
+      }
+      const node = new AudioWorkletNode(context, "prairie-engine-audio", {
+        numberOfInputs: 0,
+        numberOfOutputs: 1,
+        outputChannelCount: [channels],
+        processorOptions: { channels },
+      });
+      node.port.onmessage = (event: MessageEvent<WorkletToPageMessage>) => onMessage(event.data);
+      const gain = context.createGain();
+      node.connect(gain).connect(context.destination);
+      return new EngineAudioOutput(context, node, gain, channels);
+    } catch (error) {
+      void context.close().catch(() => {});
+      throw error;
+    }
+  }
+
+  /** Hands the decode worker a direct line to the worklet. */
+  connect(): MessagePort {
+    const channel = new MessageChannel();
+    this.send({ type: "connect", port: channel.port1 }, [channel.port1]);
+    return channel.port2;
+  }
+
+  setGeneration(generation: number, position: number): void {
+    this.send({ type: "generation", generation, position });
+  }
+
+  setPlaying(playing: boolean): void {
+    this.send({ type: "playing", playing });
+  }
+
+  setRate(rate: number): void {
+    this.send({ type: "rate", rate });
+  }
+
+  setVolume(volume: number, muted: boolean): void {
+    this.gain.gain.value = muted ? 0 : Math.max(0, Math.min(1, volume));
+  }
+
+  /**
+   * Starts the context. Browsers refuse without a recent user gesture; false
+   * then means autoplay was blocked, the same as a rejected media element play.
+   */
+  async resume(): Promise<boolean> {
+    if (this.context.state === "running") return true;
+    await Promise.race([
+      this.context.resume().catch(() => {}),
+      new Promise((resolve) => setTimeout(resolve, RESUME_TIMEOUT_MS)),
+    ]);
+    return (this.context.state as AudioContextState) === "running";
+  }
+
+  /** Context time of the sample reaching the speakers now. */
+  audibleContextTime(): number {
+    const stamp = this.context.getOutputTimestamp?.();
+    if (stamp && stamp.contextTime && stamp.performanceTime) {
+      return stamp.contextTime + (performance.now() - stamp.performanceTime) / 1000;
+    }
+    const latency = this.context.outputLatency || this.context.baseLatency || 0;
+    return this.context.currentTime - latency;
+  }
+
+  close(): void {
+    this.node.port.onmessage = null;
+    this.node.disconnect();
+    this.gain.disconnect();
+    void this.context.close().catch(() => {});
+  }
+
+  private send(message: PageToWorkletMessage, transfer: Transferable[] = []): void {
+    this.node.port.postMessage(message, transfer);
+  }
+}
diff --git a/web/src/player/engine/capabilities.test.ts b/web/src/player/engine/capabilities.test.ts
new file mode 100644
index 0000000000..ececc780a8
--- /dev/null
+++ b/web/src/player/engine/capabilities.test.ts
@@ -0,0 +1,132 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  HDR_CHECK_GRACE_MS,
+  PROBE_TIMEOUT_MS,
+  probeEngineCapabilities,
+  resetEngineCapabilitiesForTests,
+} from "./capabilities";
+
+const presenter = vi.hoisted(() => ({
+  probe: vi.fn<(adapter: unknown) => Promise<boolean | null>>(),
+}));
+vi.mock("./renderers", () => ({ probePresenter: presenter.probe }));
+
+function stubRuntime(gpu?: { requestAdapter: () => Promise<unknown> }) {
+  vi.stubGlobal("isSecureContext", true);
+  vi.stubGlobal("Worker", class {});
+  vi.stubGlobal("EncodedVideoChunk", class {});
+  vi.stubGlobal("AudioContext", class {});
+  vi.stubGlobal("AudioWorkletNode", class {});
+  vi.stubGlobal("VideoDecoder", { isConfigSupported: async () => ({ supported: true }) });
+  vi.stubGlobal("navigator", { ...navigator, gpu });
+}
+
+const hardware = { info: { isFallbackAdapter: false } };
+
+describe("probeEngineCapabilities", () => {
+  beforeEach(() => {
+    presenter.probe.mockReset();
+  });
+
+  afterEach(() => {
+    resetEngineCapabilitiesForTests();
+    vi.useRealTimers();
+    vi.unstubAllGlobals();
+  });
+
+  it("gives up on a probe that never answers so playback can start", async () => {
+    vi.useFakeTimers();
+    stubRuntime();
+    vi.stubGlobal("VideoDecoder", { isConfigSupported: () => new Promise(() => {}) });
+
+    const result = probeEngineCapabilities();
+    let settled = false;
+    void result.then(() => (settled = true));
+    // The decoder query hangs, so only the timeout can settle the probe.
+    await vi.advanceTimersByTimeAsync(PROBE_TIMEOUT_MS - 1);
+    expect(settled).toBe(false);
+    await vi.advanceTimersByTimeAsync(1);
+    await expect(result).resolves.toBeNull();
+  });
+
+  it("claims HDR only once the presenter has drawn through both paths", async () => {
+    stubRuntime({ requestAdapter: async () => hardware });
+    presenter.probe.mockResolvedValue(true);
+    await expect(probeEngineCapabilities()).resolves.toMatchObject({ hdr: true });
+    expect(presenter.probe).toHaveBeenCalledWith(hardware);
+  });
+
+  it("leaves HDR off when the presenter fails its check", async () => {
+    // probePresenter answers false for a shader the browser rejects, among others.
+    stubRuntime({ requestAdapter: async () => hardware });
+    presenter.probe.mockResolvedValue(false);
+    await expect(probeEngineCapabilities()).resolves.toMatchObject({ hdr: false });
+  });
+
+  it("does not hold a presenter chunk that failed to load against the presenter", async () => {
+    stubRuntime({ requestAdapter: async () => hardware });
+    presenter.probe.mockRejectedValue(new Error("Failed to fetch dynamically imported module"));
+    await expect(probeEngineCapabilities()).resolves.toMatchObject({ hdr: true });
+  });
+
+  it("leaves HDR off without WebGPU or with only a software adapter", async () => {
+    stubRuntime();
+    await expect(probeEngineCapabilities()).resolves.toMatchObject({ hdr: false });
+    resetEngineCapabilitiesForTests();
+    stubRuntime({ requestAdapter: async () => ({ info: { isFallbackAdapter: true } }) });
+    await expect(probeEngineCapabilities()).resolves.toMatchObject({ hdr: false });
+    expect(presenter.probe).not.toHaveBeenCalled();
+  });
+
+  it("trusts a hardware adapter once the rest of the check runs past its grace", async () => {
+    vi.useFakeTimers();
+    stubRuntime({ requestAdapter: async () => hardware });
+    let finish!: (works: boolean) => void;
+    presenter.probe.mockReturnValue(new Promise((resolve) => (finish = resolve)));
+
+    const first = probeEngineCapabilities();
+    let settled = false;
+    void first.then(() => (settled = true));
+    // Every playback start waits for this, so a slow GPU costs a second at most.
+    await vi.advanceTimersByTimeAsync(HDR_CHECK_GRACE_MS - 1);
+    expect(settled).toBe(false);
+    await vi.advanceTimersByTimeAsync(1);
+    await expect(first).resolves.toMatchObject({ hdr: true, videoCodecs: expect.any(Array) });
+
+    // The check's own answer applies to the probes after it.
+    finish(false);
+    await vi.advanceTimersByTimeAsync(0);
+    await expect(probeEngineCapabilities()).resolves.toMatchObject({ hdr: false });
+  });
+
+  it("keeps no verdict from a check that ended without one", async () => {
+    // A device lost during the check says nothing about the presenter.
+    stubRuntime({ requestAdapter: async () => hardware });
+    presenter.probe.mockResolvedValue(null);
+    await expect(probeEngineCapabilities()).resolves.toMatchObject({ hdr: true });
+    await expect(probeEngineCapabilities()).resolves.toMatchObject({ hdr: true });
+  });
+
+  it("does not claim HDR when even the adapter has not answered by the deadline", async () => {
+    vi.useFakeTimers();
+    stubRuntime({ requestAdapter: () => new Promise(() => {}) });
+    const result = probeEngineCapabilities();
+    await vi.advanceTimersByTimeAsync(PROBE_TIMEOUT_MS);
+    await expect(result).resolves.toMatchObject({ hdr: false });
+  });
+
+  it("trusts an adapter that answered after the deadline from the next probe on", async () => {
+    vi.useFakeTimers();
+    let answer!: (adapter: unknown) => void;
+    stubRuntime({ requestAdapter: () => new Promise((resolve) => (answer = resolve)) });
+    // The rest of the check never finishes.
+    presenter.probe.mockReturnValue(new Promise(() => {}));
+    const first = probeEngineCapabilities();
+    await vi.advanceTimersByTimeAsync(PROBE_TIMEOUT_MS);
+    await expect(first).resolves.toMatchObject({ hdr: false });
+
+    answer(hardware);
+    await vi.advanceTimersByTimeAsync(0);
+    await expect(probeEngineCapabilities()).resolves.toMatchObject({ hdr: true });
+  });
+});
diff --git a/web/src/player/engine/capabilities.ts b/web/src/player/engine/capabilities.ts
new file mode 100644
index 0000000000..7e13b5475e
--- /dev/null
+++ b/web/src/player/engine/capabilities.ts
@@ -0,0 +1,227 @@
+/// <reference types="@webgpu/types" />
+import { ENGINE_PCM_CODECS, FFMPEG_AUDIO_CODECS } from "./codecs";
+import { isSoftwareAdapter } from "./gpuAdapter";
+
+/**
+ * What the browser decode engine can play on this browser, in the server's
+ * codec and container vocabulary.
+ *
+ * These are `declared` claims like the rest of the web capability block: a
+ * WebCodecs `isConfigSupported` answer, not a decode of real media. A source
+ * that passes here and still fails to decode reports a typed failure, and the
+ * server replans onto a packaged route (see docs/architecture/web-decode-engine.md).
+ */
+export interface EngineCapabilities {
+  containers: string[];
+  videoCodecs: string[];
+  audioCodecs: string[];
+  /**
+   * HDR sources can be tone-mapped for the display: the WebGPU presenter
+   * compiled and drew through both of its paths, or, when that check was still
+   * running at playback start, a hardware adapter was found and nothing had
+   * failed yet (see `supportsHDRPresentation`).
+   */
+  hdr: boolean;
+}
+
+/** Containers Mediabunny demuxes with random access over HTTP ranges. */
+const ENGINE_CONTAINERS = ["mkv", "mp4"];
+
+/** Server codec name → a representative WebCodecs configuration to probe. */
+const VIDEO_PROBES: Record<string, VideoDecoderConfig> = {
+  h264: { codec: "avc1.640028", codedWidth: 1920, codedHeight: 1080 },
+  hevc: { codec: "hev1.1.6.L120.90", codedWidth: 1920, codedHeight: 1080 },
+  av1: { codec: "av01.0.08M.08", codedWidth: 1920, codedHeight: 1080 },
+  vp9: { codec: "vp09.00.40.08", codedWidth: 1920, codedHeight: 1080 },
+  vp8: { codec: "vp8", codedWidth: 1920, codedHeight: 1080 },
+};
+
+/**
+ * A FLAC STREAMINFO header (48 kHz, stereo, 16-bit). WebCodecs requires the
+ * stream header as `description` before it will answer for FLAC at all.
+ */
+function flacDescription(): Uint8Array {
+  const header = new Uint8Array(4 + 4 + 34);
+  header.set([0x66, 0x4c, 0x61, 0x43], 0); // "fLaC"
+  header.set([0x80, 0, 0, 34], 4); // last metadata block, STREAMINFO, 34 bytes
+  const info = header.subarray(8);
+  info.set([0x10, 0x00, 0x10, 0x00], 0); // min/max block size 4096
+  // Sample rate (20 bits), channels - 1 (3 bits), bits per sample - 1 (5 bits).
+  const sampleRate = 48_000;
+  info[10] = (sampleRate >> 12) & 0xff;
+  info[11] = (sampleRate >> 4) & 0xff;
+  info[12] = ((sampleRate & 0x0f) << 4) | (1 << 1) | (15 >> 4);
+  info[13] = (15 & 0x0f) << 4;
+  return header;
+}
+
+const WEBCODECS_AUDIO_PROBES: Record<string, () => AudioDecoderConfig> = {
+  aac: () => ({ codec: "mp4a.40.2", sampleRate: 48_000, numberOfChannels: 2 }),
+  opus: () => ({ codec: "opus", sampleRate: 48_000, numberOfChannels: 2 }),
+  mp3: () => ({ codec: "mp3", sampleRate: 48_000, numberOfChannels: 2 }),
+  flac: () => ({
+    codec: "flac",
+    sampleRate: 48_000,
+    numberOfChannels: 2,
+    description: flacDescription(),
+  }),
+};
+
+function runtimeAvailable(): boolean {
+  return (
+    typeof window !== "undefined" &&
+    window.isSecureContext === true &&
+    typeof Worker !== "undefined" &&
+    typeof VideoDecoder !== "undefined" &&
+    typeof EncodedVideoChunk !== "undefined" &&
+    typeof AudioContext !== "undefined" &&
+    typeof AudioWorkletNode !== "undefined" &&
+    typeof WebAssembly !== "undefined"
+  );
+}
+
+async function supportsVideo(config: VideoDecoderConfig): Promise<boolean> {
+  try {
+    return (await VideoDecoder.isConfigSupported(config)).supported === true;
+  } catch {
+    return false;
+  }
+}
+
+async function supportsAudio(config: AudioDecoderConfig): Promise<boolean> {
+  if (typeof AudioDecoder === "undefined") return false;
+  try {
+    return (await AudioDecoder.isConfigSupported(config)).supported === true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Playback start waits on the probe, so a GPU or decoder query that never
+ * answers must not hold it: past this, the page plays without the engine.
+ * The codec answers and the HDR answer are each bounded by it, so a slow GPU
+ * never costs the codec answers.
+ */
+export const PROBE_TIMEOUT_MS = 4_000;
+
+/**
+ * How long, once a hardware adapter is found, playback start waits for the
+ * rest of the HDR check before trusting the adapter alone.
+ */
+export const HDR_CHECK_GRACE_MS = 1_000;
+
+/** The full HDR check's answer, once it has a definite one; later probes use it. */
+let presenterVerdict: boolean | undefined;
+/** The HDR check found a hardware adapter, even if only after its deadline. */
+let hardwareAdapter = false;
+
+/** The HDR answer as it stands: the full check's, else whether there is a hardware adapter. */
+function hdrAnswer(): boolean {
+  return presenterVerdict ?? hardwareAdapter;
+}
+
+/** `work`, or `fallback()` once `ms` pass first. */
+function withDeadline<T>(work: Promise<T>, ms: number, fallback: () => T): Promise<T> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const deadline = new Promise<T>((resolve) => {
+    timer = setTimeout(() => resolve(fallback()), ms);
+  });
+  return Promise.race([work, deadline]).finally(() => clearTimeout(timer));
+}
+
+/**
+ * Whether the WebGPU presenter works here: a hardware adapter, a device, the
+ * shaders compiled, and a picture drawn through each path (`probePresenter`).
+ * The presenter is loaded only once an adapter is found, so pages that never
+ * turn the engine on do not carry it.
+ *
+ * Creating the device and compiling takes milliseconds on most systems and
+ * seconds on a cold GPU process with some Linux Vulkan drivers, while every
+ * playback start, SDR included, waits for this answer. So once a hardware
+ * adapter is found, the rest of the check gets `HDR_CHECK_GRACE_MS`; past
+ * that, and as long as nothing has failed, the adapter is answer enough, as
+ * it was before the full check existed. The presenter reports any failure at
+ * runtime, and what the check learns after its deadline applies to the
+ * probes after it.
+ */
+async function supportsHDRPresentation(): Promise<boolean> {
+  const gpu = (navigator as Navigator & { gpu?: GPU }).gpu;
+  if (!gpu) return false;
+  let adapterFound!: () => void;
+  const found = new Promise<void>((resolve) => (adapterFound = resolve));
+  const check = (async (): Promise<boolean | null> => {
+    const adapter = await gpu.requestAdapter();
+    if (!adapter || isSoftwareAdapter(adapter)) return false;
+    hardwareAdapter = true;
+    adapterFound();
+    const { probePresenter } = await import("./renderers");
+    return probePresenter(adapter);
+  })()
+    // A chunk that failed to load says nothing about the presenter.
+    .catch(() => null)
+    .then((verdict) => {
+      if (verdict !== null) presenterVerdict = verdict;
+      return hdrAnswer();
+    });
+  const afterGrace = found.then(() => withDeadline(check, HDR_CHECK_GRACE_MS, hdrAnswer));
+  return withDeadline(Promise.race([check, afterGrace]), PROBE_TIMEOUT_MS, hdrAnswer);
+}
+
+async function probeCodecs(): Promise<Omit<EngineCapabilities, "hdr"> | null> {
+  const [videoResults, audioResults] = await Promise.all([
+    Promise.all(
+      Object.entries(VIDEO_PROBES).map(
+        async ([codec, config]) => [codec, await supportsVideo(config)] as const,
+      ),
+    ),
+    Promise.all(
+      Object.entries(WEBCODECS_AUDIO_PROBES).map(
+        async ([codec, config]) => [codec, await supportsAudio(config())] as const,
+      ),
+    ),
+  ]);
+  const videoCodecs = videoResults.filter(([, ok]) => ok).map(([codec]) => codec);
+  if (videoCodecs.length === 0) return null;
+  return {
+    containers: [...ENGINE_CONTAINERS],
+    videoCodecs,
+    audioCodecs: [
+      ...audioResults.filter(([, ok]) => ok).map(([codec]) => codec),
+      ...FFMPEG_AUDIO_CODECS,
+      ...ENGINE_PCM_CODECS,
+    ],
+  };
+}
+
+async function probe(): Promise<EngineCapabilities | null> {
+  if (!runtimeAvailable()) return null;
+  const hdr = supportsHDRPresentation();
+  const codecs = await withDeadline(
+    probeCodecs().catch(() => null),
+    PROBE_TIMEOUT_MS,
+    () => null,
+  );
+  return codecs && { ...codecs, hdr: await hdr };
+}
+
+let probePromise: Promise<EngineCapabilities | null> | null = null;
+
+/**
+ * Probes once per page; the answers do not change while the page lives,
+ * except that an HDR check still running at playback start settles `hdr` for
+ * the calls after it (the player calls this each time it opens).
+ */
+export function probeEngineCapabilities(): Promise<EngineCapabilities | null> {
+  probePromise ??= probe().catch(() => null);
+  return probePromise.then((capabilities) => {
+    const hdr = hdrAnswer();
+    return capabilities && capabilities.hdr !== hdr ? { ...capabilities, hdr } : capabilities;
+  });
+}
+
+export function resetEngineCapabilitiesForTests(): void {
+  probePromise = null;
+  presenterVerdict = undefined;
+  hardwareAdapter = false;
+}
diff --git a/web/src/player/engine/clock.test.ts b/web/src/player/engine/clock.test.ts
new file mode 100644
index 0000000000..bf067219a7
--- /dev/null
+++ b/web/src/player/engine/clock.test.ts
@@ -0,0 +1,99 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { EngineClock } from "./clock";
+
+describe("EngineClock with audio", () => {
+  it("reads the anchor at the audible context time", () => {
+    let audible = 10;
+    const clock = new EngineClock(() => audible, 30);
+    expect(clock.now()).toBe(30);
+    clock.onAnchor({ contextTime: 10, mediaTime: 30, advancing: true });
+    audible = 10.5;
+    expect(clock.now()).toBeCloseTo(30.5, 6);
+  });
+
+  it("holds at the run start until it becomes audible", () => {
+    let audible = 9.9;
+    const clock = new EngineClock(() => audible, 30);
+    clock.onAnchor({ contextTime: 10, mediaTime: 30, advancing: true });
+    expect(clock.now()).toBe(30);
+    audible = 10.25;
+    expect(clock.now()).toBeCloseTo(30.25, 6);
+  });
+
+  it("freezes on a non-advancing anchor and never steps backwards while running", () => {
+    let audible = 20;
+    const clock = new EngineClock(() => audible, 0);
+    clock.onAnchor({ contextTime: 19, mediaTime: 5, advancing: true });
+    expect(clock.now()).toBeCloseTo(6, 6);
+    // A later anchor with jitter that would read slightly earlier.
+    clock.onAnchor({ contextTime: 19.5, mediaTime: 5.49, advancing: true });
+    expect(clock.now()).toBeCloseTo(6, 6);
+    clock.onAnchor({ contextTime: 20, mediaTime: 6.2, advancing: false });
+    audible = 30;
+    expect(clock.now()).toBe(6.2);
+  });
+
+  it("keeps enough history for output latency at high sample rates", () => {
+    // 192 kHz: an anchor every 4 quanta is every 2.67 ms.
+    const step = (4 * 128) / 192_000;
+    let audible = 0;
+    const clock = new EngineClock(() => audible, 0);
+    let t = 0;
+    for (; t < 1; t += step) {
+      clock.onAnchor({ contextTime: t, mediaTime: t * 3, advancing: true, rate: 3 });
+    }
+    clock.onAnchor({ contextTime: t, mediaTime: t * 3, advancing: true, rate: 0.5 });
+    // 300 ms of output latency: what plays now was rendered at 3x.
+    audible = t - 0.3;
+    expect(clock.now()).toBeCloseTo(audible * 3, 6);
+  });
+
+  it("scales by the playback rate", () => {
+    let audible = 0;
+    const clock = new EngineClock(() => audible, 0);
+    clock.setRate(1.25);
+    clock.onAnchor({ contextTime: 0, mediaTime: 0, advancing: true });
+    audible = 4;
+    expect(clock.now()).toBeCloseTo(5, 6);
+  });
+
+  // The speakers lag the render by the output latency, so audio rendered at
+  // the old rate is still playing for a moment after a speed change.
+  it("keeps time across a rate change with output latency", () => {
+    let audible = 9.8;
+    const clock = new EngineClock(() => audible, 0);
+    for (let t = 9; t <= 10; t += 0.1) {
+      clock.onAnchor({ contextTime: t, mediaTime: 70 + (t - 9) * 3, advancing: true, rate: 3 });
+    }
+    const before = clock.now();
+    expect(before).toBeCloseTo(72.4, 6);
+    // The worklet switches to 0.5x at context time 10.
+    clock.setRate(0.5);
+    clock.onAnchor({ contextTime: 10.1, mediaTime: 73.05, advancing: true, rate: 0.5 });
+    expect(clock.now()).toBeCloseTo(before, 6);
+    // Audio from before the switch keeps playing at 3x until it is out.
+    audible = 9.9;
+    expect(clock.now()).toBeCloseTo(72.7, 6);
+    audible = 10.2;
+    expect(clock.now()).toBeCloseTo(73.1, 6);
+  });
+});
+
+describe("EngineClock without audio", () => {
+  beforeEach(() => vi.useFakeTimers());
+  afterEach(() => vi.useRealTimers());
+
+  it("runs from wall time only while running", () => {
+    const clock = new EngineClock(null, 12);
+    vi.advanceTimersByTime(1_000);
+    expect(clock.now()).toBe(12);
+    clock.setRunning(true);
+    vi.advanceTimersByTime(2_000);
+    expect(clock.now()).toBeCloseTo(14, 2);
+    clock.setRunning(false);
+    vi.advanceTimersByTime(2_000);
+    expect(clock.now()).toBeCloseTo(14, 2);
+    clock.reset(100);
+    expect(clock.now()).toBe(100);
+  });
+});
diff --git a/web/src/player/engine/clock.ts b/web/src/player/engine/clock.ts
new file mode 100644
index 0000000000..98bde0adae
--- /dev/null
+++ b/web/src/player/engine/clock.ts
@@ -0,0 +1,134 @@
+/**
+ * The engine's playback clock. With audio, the clock is the audio itself:
+ * the worklet reports which media time it rendered at which context time, and
+ * the clock reads that mapping at the context time reaching the speakers now.
+ * Without audio it runs from performance.now().
+ */
+
+export interface AudioAnchor {
+  contextTime: number;
+  mediaTime: number;
+  advancing: boolean;
+  /** The rate audio played at from this anchor on; the clock's own rate when absent. */
+  rate?: number;
+}
+
+/**
+ * Context seconds of anchors kept from the current run, more than any output
+ * device's latency.
+ */
+const ANCHOR_HISTORY_SECONDS = 1;
+
+export class EngineClock {
+  /** Null while running from wall time: no audio, or audio that has ended. */
+  private audible: (() => number) | null;
+  private anchor: AudioAnchor | null = null;
+  /**
+   * The current run's anchors, newest last. The audio reaching the speakers
+   * was rendered a while ago, possibly at a rate since changed, so the clock
+   * reads from the newest anchor at or before the audible context time.
+   */
+  private history: AudioAnchor[] = [];
+  /** First anchor of the current advancing run; nothing before it is audible. */
+  private runStart: AudioAnchor | null = null;
+  private lastReading = 0;
+  private wallBase = 0;
+  private wallStartedAt: number | null = null;
+  private rate = 1;
+
+  constructor(
+    private readonly audioSource: (() => number) | null,
+    private origin: number,
+  ) {
+    this.audible = audioSource;
+    this.lastReading = origin;
+    this.wallBase = origin;
+  }
+
+  /** Restarts the clock at a new position (a seek), paused. */
+  reset(position: number): void {
+    this.audible = this.audioSource;
+    this.origin = position;
+    this.anchor = null;
+    this.history = [];
+    this.runStart = null;
+    this.lastReading = position;
+    this.wallBase = position;
+    this.wallStartedAt = null;
+  }
+
+  setRate(rate: number): void {
+    if (this.wallStartedAt !== null) {
+      this.wallBase = this.now();
+      this.wallStartedAt = performance.now();
+    }
+    this.rate = rate;
+  }
+
+  onAnchor(anchor: AudioAnchor): void {
+    if (anchor.advancing && !this.anchor?.advancing) this.runStart = anchor;
+    if (!anchor.advancing) this.runStart = null;
+    this.anchor = anchor;
+    if (!anchor.advancing) {
+      this.history = [];
+      return;
+    }
+    this.history.push(anchor);
+    // Keep the newest anchor at or before the oldest time still worth reading.
+    const oldest = anchor.contextTime - ANCHOR_HISTORY_SECONDS;
+    let drop = 0;
+    while (drop + 1 < this.history.length && this.history[drop + 1]!.contextTime <= oldest) drop++;
+    if (drop > 0) this.history.splice(0, drop);
+  }
+
+  /**
+   * Continues from wall time once the audio has played out, so video that
+   * runs past the end of the audio keeps time and still stops on pause.
+   */
+  detachAudio(running: boolean): void {
+    if (!this.audible) return;
+    this.wallBase = this.now();
+    this.audible = null;
+    this.wallStartedAt = running ? performance.now() : null;
+  }
+
+  /** Wall-clock mode only: runs or holds the clock. */
+  setRunning(running: boolean): void {
+    if (this.audible) return;
+    if (running && this.wallStartedAt === null) {
+      this.wallStartedAt = performance.now();
+    } else if (!running && this.wallStartedAt !== null) {
+      this.wallBase = this.now();
+      this.wallStartedAt = null;
+    }
+  }
+
+  now(): number {
+    if (!this.audible) {
+      if (this.wallStartedAt === null) return this.wallBase;
+      return this.wallBase + ((performance.now() - this.wallStartedAt) / 1000) * this.rate;
+    }
+    const anchor = this.anchor;
+    if (!anchor) return this.origin;
+    if (!anchor.advancing) {
+      this.lastReading = anchor.mediaTime;
+      return anchor.mediaTime;
+    }
+    const audible = this.audible();
+    if (this.runStart && audible < this.runStart.contextTime) {
+      return Math.max(this.lastReading, this.runStart.mediaTime);
+    }
+    let base = this.history[0] ?? anchor;
+    for (let i = this.history.length - 1; i >= 0; i--) {
+      if (this.history[i]!.contextTime <= audible) {
+        base = this.history[i]!;
+        break;
+      }
+    }
+    const reading = base.mediaTime + (audible - base.contextTime) * (base.rate ?? this.rate);
+    // Anchors arrive every few milliseconds with independent jitter; never
+    // let the picture step backwards between them.
+    this.lastReading = Math.max(this.lastReading, reading);
+    return this.lastReading;
+  }
+}
diff --git a/web/src/player/engine/codecs.ts b/web/src/player/engine/codecs.ts
new file mode 100644
index 0000000000..10001cccb4
--- /dev/null
+++ b/web/src/player/engine/codecs.ts
@@ -0,0 +1,25 @@
+/**
+ * Codec vocabulary shared by the engine's capability probe and its worker. It
+ * is kept apart from the decoders so the probe can name them without pulling
+ * the WebAssembly glue into the page bundle.
+ */
+
+/** Codecs the bundled FFmpeg build decodes (see web/wasm/audio-decoders). */
+export const FFMPEG_AUDIO_CODECS = ["ac3", "eac3", "dts", "truehd", "mlp"] as const;
+export type FFmpegAudioCodec = (typeof FFMPEG_AUDIO_CODECS)[number];
+
+export function isFFmpegAudioCodec(codec: string): codec is FFmpegAudioCodec {
+  return (FFMPEG_AUDIO_CODECS as readonly string[]).includes(codec);
+}
+
+/** Uncompressed PCM the worker converts itself, without a decoder. */
+export const ENGINE_PCM_CODECS = [
+  "pcm_s16le",
+  "pcm_s16be",
+  "pcm_s24le",
+  "pcm_s24be",
+  "pcm_s32le",
+  "pcm_s32be",
+  "pcm_f32le",
+  "pcm_f64le",
+] as const;
diff --git a/web/src/player/engine/colorMath.test.ts b/web/src/player/engine/colorMath.test.ts
new file mode 100644
index 0000000000..2f088e9df8
--- /dev/null
+++ b/web/src/player/engine/colorMath.test.ts
@@ -0,0 +1,158 @@
+import { describe, expect, it } from "vitest";
+import {
+  bt2390,
+  chromaOrigin,
+  chromaTexel,
+  hlgToScene,
+  linearToSRGB,
+  LUMA_WEIGHTS,
+  nitsToPQ,
+  pqToNits,
+  SDR_WHITE_NITS,
+  TO_BT709,
+  toneMapPixel,
+  yuvToRGB,
+} from "./colorMath";
+
+describe("PQ", () => {
+  it("round-trips and hits the reference points", () => {
+    expect(pqToNits(1)).toBeCloseTo(10_000, 6);
+    expect(pqToNits(0)).toBe(0);
+    expect(nitsToPQ(100)).toBeCloseTo(0.5081, 3);
+    for (const nits of [0.1, 1, 100, 203, 1000, 4000]) {
+      expect(pqToNits(nitsToPQ(nits))).toBeCloseTo(nits, 6);
+    }
+  });
+});
+
+describe("HLG", () => {
+  it("joins its two segments at the reference level", () => {
+    expect(hlgToScene(0.5)).toBeCloseTo(1 / 12, 6);
+    expect(hlgToScene(1)).toBeCloseTo(1, 4);
+  });
+});
+
+describe("bt2390", () => {
+  it("leaves shadows and mid-tones alone and lands the source peak on the target", () => {
+    expect(bt2390(5, 1000, SDR_WHITE_NITS)).toBeCloseTo(5, 6);
+    expect(bt2390(1000, 1000, SDR_WHITE_NITS)).toBeCloseTo(SDR_WHITE_NITS, 1);
+  });
+
+  it("is monotonic over the source range", () => {
+    let previous = -1;
+    for (let nits = 0; nits <= 1000; nits += 5) {
+      const mapped = bt2390(nits, 1000, SDR_WHITE_NITS);
+      expect(mapped).toBeGreaterThanOrEqual(previous);
+      previous = mapped;
+    }
+  });
+
+  it("passes through when the source fits the target", () => {
+    expect(bt2390(80, 100, 203)).toBe(80);
+  });
+});
+
+describe("toneMapPixel", () => {
+  it("maps PQ black and a 1000-nit white to SDR black and white", () => {
+    expect(toneMapPixel([0, 0, 0], "pq")).toEqual([0, 0, 0]);
+    const white = toneMapPixel([nitsToPQ(1000), nitsToPQ(1000), nitsToPQ(1000)], "pq");
+    for (const channel of white) expect(channel).toBeCloseTo(1, 2);
+  });
+
+  it("keeps a dim neutral gray neutral and unclipped", () => {
+    const pq = nitsToPQ(20);
+    const [r, g, b] = toneMapPixel([pq, pq, pq], "pq");
+    expect(r).toBeCloseTo(g, 4);
+    expect(g).toBeCloseTo(b, 4);
+    expect(g).toBeCloseTo(linearToSRGB(20 / SDR_WHITE_NITS), 3);
+  });
+
+  it("maps HLG reference white near SDR white", () => {
+    const [, g] = toneMapPixel([0.75, 0.75, 0.75], "hlg");
+    expect(g).toBeGreaterThan(0.85);
+    expect(g).toBeLessThanOrEqual(1);
+  });
+});
+
+describe("yuvToRGB", () => {
+  it("decodes limited-range 10-bit black, white and neutral gray", () => {
+    for (const matrix of ["bt2020", "bt709"] as const) {
+      expect(yuvToRGB(64, 512, 512, 10, matrix)).toEqual([0, 0, 0]);
+      const white = yuvToRGB(940, 512, 512, 10, matrix);
+      for (const channel of white) expect(channel).toBeCloseTo(1, 6);
+      const gray = yuvToRGB(502, 512, 512, 10, matrix);
+      expect(gray[0]).toBeCloseTo(gray[2], 6);
+    }
+  });
+
+  it("reconstructs pure red with each matrix's own coefficients", () => {
+    // BT.709 red: Y' 0.2126, Cb -0.1146, Cr 0.5.
+    const code = (value: number, offset: number, range: number) => (offset + range * value) * 4;
+    const red = yuvToRGB(
+      code(0.2126, 16, 219),
+      code(-0.114572, 128, 224),
+      code(0.5, 128, 224),
+      10,
+      "bt709",
+    );
+    expect(red[0]).toBeCloseTo(1, 3);
+    expect(red[1]).toBeCloseTo(0, 3);
+    expect(red[2]).toBeCloseTo(0, 3);
+  });
+});
+
+describe("source gamuts", () => {
+  it("keep white white and weigh luminance to 1", () => {
+    for (const primaries of ["bt2020", "bt709", "p3"] as const) {
+      const m = TO_BT709[primaries];
+      for (let row = 0; row < 3; row++) {
+        expect(m[row * 3]! + m[row * 3 + 1]! + m[row * 3 + 2]!).toBeCloseTo(1, 3);
+      }
+      const [r, g, b] = LUMA_WEIGHTS[primaries];
+      expect(r + g + b).toBeCloseTo(1, 4);
+    }
+  });
+
+  it("leaves a BT.709 source's colours alone where BT.2020 would widen them", () => {
+    // HLG 75% bars at the clips' signal level: a BT.709 red stays a plain red,
+    // the same code read as BT.2020 is a deeper red than BT.709 can show.
+    const red: [number, number, number] = [0.5625, 0, 0];
+    const asBT709 = toneMapPixel(red, "hlg", "bt709");
+    const asBT2020 = toneMapPixel(red, "hlg", "bt2020");
+    expect(asBT709[1]).toBeCloseTo(0, 6);
+    expect(asBT709[0]).toBeLessThan(asBT2020[0]);
+    // A neutral gray is the same whichever gamut it comes from.
+    const gray: [number, number, number] = [0.5, 0.5, 0.5];
+    const [g709] = toneMapPixel(gray, "hlg", "bt709");
+    const [g2020] = toneMapPixel(gray, "hlg", "bt2020");
+    expect(g709).toBeCloseTo(g2020, 3);
+  });
+});
+
+describe("chroma siting", () => {
+  it("places the first chroma sample for each siting and subsampling", () => {
+    expect(chromaOrigin("center", 2, 2)).toEqual([0.5, 0.5]);
+    expect(chromaOrigin("left", 2, 2)).toEqual([0, 0.5]);
+    expect(chromaOrigin("top-left", 2, 2)).toEqual([0, 0]);
+    // 4:2:2 is co-sited horizontally and not subsampled vertically.
+    expect(chromaOrigin("center", 2, 1)).toEqual([0, 0]);
+    expect(chromaOrigin("left", 1, 1)).toEqual([0, 0]);
+  });
+
+  it("reproduces the old centred lookup for even sizes", () => {
+    // Before siting was read, chroma was sampled at uv * chromaSize - 0.5.
+    for (const uv of [0, 0.25, 0.5, 0.999]) {
+      expect(chromaTexel(uv, 1920, 0.5, 2)).toBeCloseTo(uv * 960 - 0.5, 9);
+    }
+  });
+
+  it("puts co-sited chroma under its luma sample, odd sizes included", () => {
+    // The centre of luma pixel 2x is the centre of chroma texel x when co-sited.
+    for (const width of [1920, 1919]) {
+      const lumaCentre = (x: number) => (x + 0.5) / width;
+      expect(chromaTexel(lumaCentre(0), width, 0, 2)).toBeCloseTo(0, 9);
+      expect(chromaTexel(lumaCentre(10), width, 0, 2)).toBeCloseTo(5, 9);
+      expect(chromaTexel(lumaCentre(11), width, 0, 2)).toBeCloseTo(5.5, 9);
+    }
+  });
+});
diff --git a/web/src/player/engine/colorMath.ts b/web/src/player/engine/colorMath.ts
new file mode 100644
index 0000000000..e3c27134f7
--- /dev/null
+++ b/web/src/player/engine/colorMath.ts
@@ -0,0 +1,194 @@
+import type { ChromaSiting, SourceMatrix, SourcePrimaries } from "./pictureColor";
+
+/**
+ * Reference implementation of the engine's HDR-to-SDR conversion. The WGSL in
+ * hdrShader.ts mirrors these functions line for line; the tests exercise them
+ * here because the GPU path cannot run under the unit-test runner.
+ *
+ * The parameters match the server's tone-map recipes (internal/tonemap):
+ * BT.2390 EETF with SDR white at 100 nits, the source gamut (BT.2020 unless the
+ * stream says otherwise) to BT.709.
+ */
+
+/** Nits that SDR white represents; the server's tone-map recipes use 100. */
+export const SDR_WHITE_NITS = 100;
+/**
+ * Peak assumed for the source when it carries no usable mastering metadata,
+ * and the nominal peak of HLG.
+ */
+export const DEFAULT_SOURCE_PEAK_NITS = 1000;
+
+const PQ_M1 = 2610 / 16384;
+const PQ_M2 = (2523 / 4096) * 128;
+const PQ_C1 = 3424 / 4096;
+const PQ_C2 = (2413 / 4096) * 32;
+const PQ_C3 = (2392 / 4096) * 32;
+
+/** SMPTE ST 2084 EOTF: signal (0..1) to nits. */
+export function pqToNits(signal: number): number {
+  const e = Math.pow(Math.max(signal, 0), 1 / PQ_M2);
+  const n = Math.max(e - PQ_C1, 0) / (PQ_C2 - PQ_C3 * e);
+  return 10000 * Math.pow(n, 1 / PQ_M1);
+}
+
+/** Inverse ST 2084 EOTF: nits to signal (0..1). */
+export function nitsToPQ(nits: number): number {
+  const y = Math.pow(Math.max(nits, 0) / 10000, PQ_M1);
+  return Math.pow((PQ_C1 + PQ_C2 * y) / (1 + PQ_C3 * y), PQ_M2);
+}
+
+const HLG_A = 0.17883277;
+const HLG_B = 1 - 4 * HLG_A;
+const HLG_C = 0.5 - HLG_A * Math.log(4 * HLG_A);
+
+/** BT.2100 HLG inverse OETF: signal (0..1) to normalized scene light (0..1). */
+export function hlgToScene(signal: number): number {
+  const e = Math.max(signal, 0);
+  return e <= 0.5 ? (e * e) / 3 : (Math.exp((e - HLG_C) / HLG_A) + HLG_B) / 12;
+}
+
+type Vec3 = readonly [number, number, number];
+
+/** BT.2020 luminance weights. */
+export const BT2020_LUMA: Vec3 = [0.2627, 0.678, 0.0593];
+
+/** Luminance weights of each source gamut (the Y row of its RGB-to-XYZ matrix). */
+export const LUMA_WEIGHTS: Record<SourcePrimaries, Vec3> = {
+  bt2020: BT2020_LUMA,
+  bt709: [0.2126, 0.7152, 0.0722],
+  p3: [0.2289746, 0.6917385, 0.0792869],
+};
+
+/** Linear BT.2020 primaries to linear BT.709 primaries. */
+export const BT2020_TO_BT709: readonly number[] = [
+  1.660491, -0.587641, -0.07285, -0.124551, 1.1329, -0.008349, -0.018151, -0.100579, 1.11873,
+];
+
+/** Linear source primaries to linear BT.709, row-major. */
+export const TO_BT709: Record<SourcePrimaries, readonly number[]> = {
+  bt2020: BT2020_TO_BT709,
+  bt709: [1, 0, 0, 0, 1, 0, 0, 0, 1],
+  p3: [1.2249401, -0.2249404, 0, -0.0420569, 1.0420571, 0, -0.0196376, -0.0786361, 1.0982735],
+};
+
+/**
+ * ITU-R BT.2390 EETF on absolute luminance: compresses [0, sourcePeak] into
+ * [0, targetPeak] with a Hermite roll-off in the PQ domain, leaving
+ * everything below the knee untouched.
+ */
+export function bt2390(nits: number, sourcePeak: number, targetPeak: number): number {
+  if (sourcePeak <= targetPeak) return Math.min(nits, targetPeak);
+  const sourcePQ = nitsToPQ(sourcePeak);
+  const e1 = nitsToPQ(nits) / sourcePQ;
+  const maxLum = nitsToPQ(targetPeak) / sourcePQ;
+  const knee = 1.5 * maxLum - 0.5;
+  let e2 = e1;
+  if (e1 >= knee) {
+    const t = (e1 - knee) / (1 - knee);
+    const t2 = t * t;
+    const t3 = t2 * t;
+    e2 =
+      (2 * t3 - 3 * t2 + 1) * knee + (t3 - 2 * t2 + t) * (1 - knee) + (-2 * t3 + 3 * t2) * maxLum;
+  }
+  return pqToNits(Math.min(e2, 1) * sourcePQ);
+}
+
+/** sRGB OETF: linear light (0..1) to the canvas's sRGB-encoded value. */
+export function linearToSRGB(value: number): number {
+  const v = Math.min(Math.max(value, 0), 1);
+  return v <= 0.0031308 ? 12.92 * v : 1.055 * Math.pow(v, 1 / 2.4) - 0.055;
+}
+
+export type HDRTransfer = "pq" | "hlg";
+
+/**
+ * Converts one pixel of HDR non-linear R'G'B' in the source gamut to
+ * sRGB-encoded BT.709 for an SDR canvas.
+ */
+export function toneMapPixel(
+  encoded: Vec3,
+  transfer: HDRTransfer,
+  primaries: SourcePrimaries = "bt2020",
+  sourcePeak = DEFAULT_SOURCE_PEAK_NITS,
+  targetPeak = SDR_WHITE_NITS,
+): [number, number, number] {
+  const weights = LUMA_WEIGHTS[primaries];
+  let linear: [number, number, number];
+  if (transfer === "pq") {
+    linear = [pqToNits(encoded[0]), pqToNits(encoded[1]), pqToNits(encoded[2])];
+  } else {
+    // HLG OOTF for a 1000-nit display: system gamma 1.2.
+    const scene: [number, number, number] = [
+      hlgToScene(encoded[0]),
+      hlgToScene(encoded[1]),
+      hlgToScene(encoded[2]),
+    ];
+    const sceneLuma = scene[0] * weights[0] + scene[1] * weights[1] + scene[2] * weights[2];
+    const gain = DEFAULT_SOURCE_PEAK_NITS * Math.pow(Math.max(sceneLuma, 1e-6), 0.2);
+    linear = [scene[0] * gain, scene[1] * gain, scene[2] * gain];
+  }
+  const luma = linear[0] * weights[0] + linear[1] * weights[1] + linear[2] * weights[2];
+  const scale = luma > 0 ? bt2390(luma, sourcePeak, targetPeak) / luma : 0;
+  const m = TO_BT709[primaries];
+  const r = (m[0]! * linear[0] + m[1]! * linear[1] + m[2]! * linear[2]) * scale;
+  const g = (m[3]! * linear[0] + m[4]! * linear[1] + m[5]! * linear[2]) * scale;
+  const b = (m[6]! * linear[0] + m[7]! * linear[1] + m[8]! * linear[2]) * scale;
+  return [linearToSRGB(r / targetPeak), linearToSRGB(g / targetPeak), linearToSRGB(b / targetPeak)];
+}
+
+/**
+ * Y'CbCr to R'G'B' coefficients, in the order the shader takes them: Cr into
+ * R, Cb into G, Cr into G, Cb into B.
+ */
+export const YUV_TO_RGB: Record<SourceMatrix, readonly [number, number, number, number]> = {
+  bt2020: [1.4746, 0.16455313, 0.57135313, 1.8814],
+  bt709: [1.5748, 0.18732427, 0.46812427, 1.8556],
+};
+
+/**
+ * Limited-range non-constant-luminance Y'CbCr codes at `bitDepth` to
+ * non-linear R'G'B' (0..1).
+ */
+export function yuvToRGB(
+  y: number,
+  cb: number,
+  cr: number,
+  bitDepth: number,
+  matrix: SourceMatrix = "bt2020",
+): [number, number, number] {
+  const scale = 2 ** (bitDepth - 8);
+  const luma = (y / scale - 16) / 219;
+  const blue = (cb / scale - 128) / 224;
+  const red = (cr / scale - 128) / 224;
+  const [crR, cbG, crG, cbB] = YUV_TO_RGB[matrix];
+  return [luma + crR * red, luma - cbG * blue - crG * red, luma + cbB * blue];
+}
+
+/**
+ * Where, in luma pixels, the first chroma sample's centre sits relative to the
+ * first luma sample's centre, along x and y. Only subsampled axes have an
+ * offset; 4:2:2 chroma is co-sited horizontally whatever the siting says.
+ */
+export function chromaOrigin(
+  siting: ChromaSiting,
+  subsampleX: 1 | 2,
+  subsampleY: 1 | 2,
+): [number, number] {
+  const x = subsampleX === 2 && siting === "center" && subsampleY === 2 ? 0.5 : 0;
+  const y = subsampleY === 2 && siting !== "top-left" ? 0.5 : 0;
+  return [x, y];
+}
+
+/**
+ * The chroma-texel coordinate (texel centres at integers) under a point of the
+ * picture given in normalized coordinates. Mirrors `chromaTexel` in the
+ * shader; working from luma pixels keeps it right for odd picture sizes.
+ */
+export function chromaTexel(
+  uv: number,
+  lumaSize: number,
+  origin: number,
+  subsample: 1 | 2,
+): number {
+  return (uv * lumaSize - 0.5 - origin) / subsample;
+}
diff --git a/web/src/player/engine/engine.worker.test.ts b/web/src/player/engine/engine.worker.test.ts
new file mode 100644
index 0000000000..d90814a729
--- /dev/null
+++ b/web/src/player/engine/engine.worker.test.ts
@@ -0,0 +1,115 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import type { PageToWorkerMessage, WorkerToPageMessage } from "./protocol";
+
+/** A file whose packets start at 10 s, one key packet per second. */
+const FIRST_TIMESTAMP = 10;
+const packets = Array.from({ length: 12 }, (_, second) => ({
+  timestamp: FIRST_TIMESTAMP + second,
+  duration: 1,
+  type: "key" as const,
+  data: new Uint8Array(1),
+}));
+const keyLookups = vi.hoisted(() => [] as number[]);
+
+vi.mock("mediabunny", () => {
+  class Input {
+    async getPrimaryVideoTrack() {
+      return {
+        getDecoderConfig: async () => ({ codec: "avc1.640028" }),
+        getCodec: async () => "avc",
+        getCodedWidth: async () => 320,
+        getCodedHeight: async () => 180,
+        getDisplayWidth: async () => 320,
+        getDisplayHeight: async () => 180,
+        getRotation: async () => 0,
+        getFlip: async () => false,
+      };
+    }
+    async getFirstTimestamp() {
+      return FIRST_TIMESTAMP;
+    }
+    async computeDuration() {
+      return FIRST_TIMESTAMP + packets.length;
+    }
+  }
+  class EncodedPacketSink {
+    async getKeyPacket(timestamp: number) {
+      keyLookups.push(timestamp);
+      return [...packets].reverse().find((packet) => packet.timestamp <= timestamp) ?? null;
+    }
+    async getFirstKeyPacket() {
+      return packets[0];
+    }
+    async *packets(start: (typeof packets)[number]) {
+      yield* packets.slice(packets.indexOf(start));
+    }
+  }
+  return { ALL_FORMATS: [], Input, EncodedPacketSink, UrlSource: class {} };
+});
+vi.mock("./wasm/prairie-audio-decoders.wasm?url", () => ({ default: "" }));
+
+describe("engine worker", () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.restoreAllMocks();
+  });
+
+  it("plays a file that starts after zero from its first packet at position 0", async () => {
+    const decoded: number[] = [];
+    vi.stubGlobal(
+      "VideoDecoder",
+      class {
+        static isConfigSupported = async () => ({ supported: true });
+        state = "configured";
+        decodeQueueSize = 0;
+        configure() {}
+        addEventListener() {}
+        decode(chunk: { timestamp: number }) {
+          decoded.push(chunk.timestamp / 1e6);
+        }
+        flush = async () => {};
+        close() {}
+      },
+    );
+    vi.stubGlobal(
+      "EncodedVideoChunk",
+      class {
+        timestamp: number;
+        constructor(init: { timestamp: number }) {
+          this.timestamp = init.timestamp;
+        }
+      },
+    );
+    const posted: WorkerToPageMessage[] = [];
+    vi.spyOn(self, "postMessage").mockImplementation((message) =>
+      posted.push(message as WorkerToPageMessage),
+    );
+    await import("./engine.worker");
+    const send = (data: PageToWorkerMessage) =>
+      (self.onmessage as (event: MessageEvent) => void)({ data } as MessageEvent);
+
+    send({
+      type: "open",
+      source: {
+        url: "/stream",
+        headers: {},
+        container: "mkv",
+        durationSeconds: null,
+        startSeconds: 0,
+        video: { codec: "h264", width: 320, height: 180, transfer: "sdr", stripDolbyVision: false },
+        audio: null,
+      },
+    });
+    await vi.waitFor(() => expect(posted.some((m) => m.type === "ready")).toBe(true));
+    // The container's end time is 22 s; the file itself lasts 12.
+    expect(posted.find((m) => m.type === "ready")).toMatchObject({
+      info: { durationSeconds: 12 },
+    });
+
+    send({ type: "start", generation: 0, position: 5 });
+    await vi.waitFor(() => expect(posted.some((m) => m.type === "video-ended")).toBe(true));
+    // Position 5 is 5 s into the file, and decoded pictures carry player time.
+    expect(keyLookups).toEqual([15]);
+    expect(decoded).toEqual([5, 6, 7, 8, 9, 10, 11]);
+  });
+});
diff --git a/web/src/player/engine/engine.worker.ts b/web/src/player/engine/engine.worker.ts
new file mode 100644
index 0000000000..116bc4a4dc
--- /dev/null
+++ b/web/src/player/engine/engine.worker.ts
@@ -0,0 +1,731 @@
+/// <reference lib="webworker" />
+/**
+ * The engine's decode worker: demuxes the original file over HTTP ranges,
+ * decodes video with WebCodecs and audio with WebCodecs, the bundled FFmpeg
+ * decoders, or a PCM unpacker, and streams the results out. Video frames go to
+ * the page for presentation; audio goes straight to the audio worklet through
+ * a MessagePort, so the page's main thread never touches PCM.
+ *
+ * Decoding is credit-driven. The page releases each video frame after drawing
+ * it, and the worklet reports how much audio it has played; the pumps wait
+ * whenever too much is outstanding. A seek starts a new generation: older
+ * pumps notice and stop, and everything they already sent is dropped on
+ * arrival.
+ */
+import {
+  ALL_FORMATS,
+  EncodedPacketSink,
+  Input,
+  UrlSource,
+  type EncodedPacket,
+  type InputAudioTrack,
+  type InputVideoTrack,
+} from "mediabunny";
+import wasmUrl from "./wasm/prairie-audio-decoders.wasm?url";
+import {
+  defaultSpeakers,
+  LinearResampler,
+  mixMatrix,
+  mixToInterleaved,
+  SERVER_PCM_FORMATS,
+  speakersFromMask,
+  unpackPCM,
+  type PCMFormat,
+} from "./audioMix";
+import { isFFmpegAudioCodec, type FFmpegAudioCodec } from "./codecs";
+import {
+  FFmpegAudioDecoder,
+  loadFFmpegAudioDecoders,
+  type DecodedAudioFrame,
+} from "./ffmpegAudioDecoder";
+import { hevcLengthSize, stripDolbyVisionNalUnits } from "./hevc";
+import { IMPORT_COLOR_TAG, pictureColorOf } from "./pictureColor";
+import {
+  ENGINE_READ_FAILED,
+  ENGINE_VIDEO_DECODE_FAILED,
+  type EnginePlaneFrame,
+  type PageToWorkerMessage,
+  type WorkerToPageMessage,
+  type WorkerToWorkletMessage,
+  type WorkletToWorkerMessage,
+} from "./protocol";
+import { redactStreamUrls, type EngineSourceSpec } from "./source";
+
+const scope = self as unknown as DedicatedWorkerGlobalScope;
+
+/** Decoded frames handed to the page and not yet released. */
+const MAX_FRAMES_IN_FLIGHT = 6;
+const MAX_VIDEO_DECODE_QUEUE = 4;
+/** Audio decoded ahead of what the worklet has played. */
+const AUDIO_AHEAD_SECONDS = 1.5;
+/**
+ * TrueHD can only start at a major sync, and the FFmpeg decoders all need a
+ * frame or two of history, so they start a little before the target and the
+ * excess is trimmed.
+ */
+const FFMPEG_PREROLL_SECONDS = 0.5;
+const URL_CACHE_BYTES = 96 * 1024 * 1024;
+/** Audio sent to the worklet before the page may report the position playable. */
+const AUDIO_BUFFERED_SECONDS = 0.25;
+
+export const ENGINE_FAILURES = {
+  open: "browser_engine_open_failed",
+  videoUnsupported: "browser_engine_video_unsupported",
+  videoDecode: ENGINE_VIDEO_DECODE_FAILED,
+  audioDecode: "browser_engine_audio_decode_failed",
+  audioTrack: "browser_engine_audio_track_mismatch",
+  read: ENGINE_READ_FAILED,
+} as const;
+
+class EngineFailure extends Error {
+  constructor(
+    readonly classification: string,
+    message: string,
+  ) {
+    super(message);
+  }
+}
+
+/** Resolves every pending wait() on the next wake(). */
+class Waker {
+  private waiters: Array<() => void> = [];
+  wait(): Promise<void> {
+    return new Promise((resolve) => this.waiters.push(resolve));
+  }
+  wake(): void {
+    const waiters = this.waiters;
+    this.waiters = [];
+    for (const resolve of waiters) resolve();
+  }
+}
+
+interface DecodedAudio {
+  planes: Float32Array[];
+  sampleRate: number;
+  speakers: number[];
+  timestamp: number;
+}
+
+interface AudioDecoderAdapter {
+  decode(packet: EncodedPacket): Promise<DecodedAudio[]>;
+  flush(): Promise<DecodedAudio[]>;
+  close(): void;
+}
+
+let source: EngineSourceSpec | null = null;
+let input: Input | null = null;
+let videoTrack: InputVideoTrack | null = null;
+let audioTrack: InputAudioTrack | null = null;
+/** Audio track facts, read once with Mediabunny's async getters. */
+let audioFacts: { sampleRate: number; channels: number } | null = null;
+let videoConfig: VideoDecoderConfig | null = null;
+/**
+ * Container time at player position 0. The server counts positions from the
+ * start of the file, as ffmpeg's seeks do, so a file whose packets begin at
+ * 10 s plays its first picture at 0. Never below 0: Mediabunny marks samples
+ * before 0 (such as audio priming) as not for presentation.
+ */
+let timelineOrigin = 0;
+let nalLengthSize: number | null = null;
+let audioOutput: { port: MessagePort; channels: number; sampleRate: number } | null = null;
+
+let generation = -1;
+let framesInFlight = 0;
+let audioPostedSeconds = 0;
+let audioConsumedSeconds = 0;
+const waker = new Waker();
+const planePool: ArrayBuffer[] = [];
+let activeVideoDecoder: VideoDecoder | null = null;
+let activeAudioDecoder: AudioDecoderAdapter | null = null;
+
+function post(message: WorkerToPageMessage, transfer: Transferable[] = []): void {
+  scope.postMessage(message, transfer);
+}
+
+function fail(run: number | null, error: unknown, fallback: string): void {
+  if (run !== null && run !== generation) return;
+  const classification = error instanceof EngineFailure ? error.classification : fallback;
+  const message = redactStreamUrls(
+    error instanceof Error ? error.message : String(error),
+    source?.url,
+  );
+  post({ type: "error", generation: run, classification, message });
+}
+
+/** Server codec name for an audio track, from Mediabunny's codec or the raw Matroska ID. */
+async function serverAudioCodec(track: InputAudioTrack): Promise<string> {
+  const codec = await track.getCodec();
+  if (codec) {
+    if (codec.startsWith("pcm-")) {
+      const entry = Object.entries(SERVER_PCM_FORMATS).find(([, format]) => format === codec);
+      return entry ? entry[0] : codec;
+    }
+    return codec;
+  }
+  const id = String((await track.getInternalCodecId()) ?? "").toUpperCase();
+  if (id.startsWith("A_TRUEHD")) return "truehd";
+  if (id.startsWith("A_MLP")) return "mlp";
+  if (id.startsWith("A_DTS")) return "dts";
+  return id.toLowerCase();
+}
+
+async function open(spec: EngineSourceSpec): Promise<void> {
+  source = spec;
+  input = new Input({
+    formats: ALL_FORMATS,
+    source: new UrlSource(spec.url, {
+      requestInit: { headers: spec.headers },
+      maxCacheSize: URL_CACHE_BYTES,
+      getRetryDelay: (attempts) => (attempts < 4 ? Math.min(4, 0.5 * 2 ** attempts) : null),
+    }),
+  });
+  try {
+    videoTrack = await input.getPrimaryVideoTrack();
+  } catch (error) {
+    throw new EngineFailure(ENGINE_FAILURES.open, `Could not read the file: ${String(error)}`);
+  }
+  if (!videoTrack) throw new EngineFailure(ENGINE_FAILURES.open, "The file has no video track.");
+
+  if (spec.audio) {
+    const tracks = await input.getAudioTracks();
+    const track = tracks[spec.audio.ordinal] ?? null;
+    if (!track || (await serverAudioCodec(track)) !== spec.audio.codec) {
+      throw new EngineFailure(
+        ENGINE_FAILURES.audioTrack,
+        `Audio track ${spec.audio.ordinal} is not the ${spec.audio.codec} track the plan selected.`,
+      );
+    }
+    audioTrack = track;
+    audioFacts = {
+      sampleRate: await track.getSampleRate(),
+      channels: await track.getNumberOfChannels(),
+    };
+  }
+
+  timelineOrigin = Math.max(0, await input.getFirstTimestamp());
+
+  const config = await videoTrack.getDecoderConfig();
+  if (!config) {
+    throw new EngineFailure(
+      ENGINE_FAILURES.videoUnsupported,
+      "The video track has no decoder configuration.",
+    );
+  }
+  // Read before the re-tag below replaces what the stream says.
+  const color = pictureColorOf(config);
+  if (spec.video.transfer !== "sdr") {
+    // Tag HDR frames as BT.709/sRGB so that a GPU-backed frame imported as an
+    // external texture keeps its PQ/HLG-encoded R'G'B' values: the browser
+    // then applies only the YUV matrix, and the engine's shader decodes the
+    // transfer and converts the gamut itself. Frames copied out as planes
+    // ignore the tag.
+    config.colorSpace = {
+      ...IMPORT_COLOR_TAG,
+      // TypeScript's DOM types predate the BT.2020 matrix value.
+      matrix: config.colorSpace?.matrix ?? ("bt2020-ncl" as VideoMatrixCoefficients),
+      fullRange: config.colorSpace?.fullRange ?? false,
+    };
+  }
+  const support = await VideoDecoder.isConfigSupported(config);
+  if (!support.supported) {
+    throw new EngineFailure(
+      ENGINE_FAILURES.videoUnsupported,
+      `This browser cannot decode ${config.codec}.`,
+    );
+  }
+  videoConfig = config;
+  nalLengthSize =
+    spec.video.stripDolbyVision && (await videoTrack.getCodec()) === "hevc"
+      ? hevcLengthSize(config.description ? toBytes(config.description) : null)
+      : null;
+
+  let duration = spec.durationSeconds ?? 0;
+  if (!(duration > 0)) duration = (await input.computeDuration()) - timelineOrigin;
+
+  post({
+    type: "ready",
+    info: {
+      durationSeconds: duration,
+      video: {
+        codedWidth: await videoTrack.getCodedWidth(),
+        codedHeight: await videoTrack.getCodedHeight(),
+        // Already turned by the rotation; the presenter turns the pictures to match.
+        displayWidth: await videoTrack.getDisplayWidth(),
+        displayHeight: await videoTrack.getDisplayHeight(),
+        rotation: await videoTrack.getRotation(),
+        flip: await videoTrack.getFlip(),
+        color,
+      },
+      audio: audioFacts,
+    },
+  });
+}
+
+/** A packet's position on the player timeline, in seconds. */
+function playerTime(packet: EncodedPacket): number {
+  return packet.timestamp - timelineOrigin;
+}
+
+function toBytes(source: AllowSharedBufferSource): Uint8Array {
+  // SharedArrayBuffer is not even defined without cross-origin isolation, so
+  // only views and plain buffers are told apart.
+  return ArrayBuffer.isView(source)
+    ? new Uint8Array(source.buffer, source.byteOffset, source.byteLength)
+    : new Uint8Array(source);
+}
+
+function stopRun(): void {
+  const video = activeVideoDecoder;
+  activeVideoDecoder = null;
+  if (video && video.state !== "closed") video.close();
+  const audio = activeAudioDecoder;
+  activeAudioDecoder = null;
+  audio?.close();
+}
+
+function start(run: number, position: number): void {
+  stopRun();
+  generation = run;
+  framesInFlight = 0;
+  audioPostedSeconds = 0;
+  audioConsumedSeconds = 0;
+  waker.wake();
+  void runVideo(run, position).catch((error: unknown) =>
+    fail(run, error, ENGINE_FAILURES.videoDecode),
+  );
+  if (audioTrack && audioOutput) {
+    void runAudio(run, position).catch((error: unknown) =>
+      fail(run, error, ENGINE_FAILURES.audioDecode),
+    );
+  }
+}
+
+const RAW_PLANE_FORMATS = /^I4(20|22|44)P1[02]$/;
+
+function planeBuffer(size: number): ArrayBuffer {
+  const index = planePool.findIndex((buffer) => buffer.byteLength >= size);
+  if (index >= 0) return planePool.splice(index, 1)[0]!;
+  return new ArrayBuffer(size);
+}
+
+/**
+ * Copies a high-bit-depth software frame out as planes. GPU paths quantize an
+ * imported frame to 8 bits; HDR needs the 10-bit codes for clean gradients.
+ */
+async function copyPlanes(frame: VideoFrame): Promise<EnginePlaneFrame> {
+  const format = frame.format!;
+  const rect = frame.visibleRect!;
+  const bitDepth = format.endsWith("P12") ? 12 : 10;
+  const chromaWidth = format.startsWith("I444") ? rect.width : Math.ceil(rect.width / 2);
+  const chromaHeight = format.startsWith("I420") ? Math.ceil(rect.height / 2) : rect.height;
+  const lumaBytes = rect.width * rect.height * 2;
+  const chromaBytes = chromaWidth * chromaHeight * 2;
+  const buffer = planeBuffer(lumaBytes + chromaBytes * 2);
+  const offsets: [number, number, number] = [0, lumaBytes, lumaBytes + chromaBytes];
+  const strides: [number, number, number] = [rect.width * 2, chromaWidth * 2, chromaWidth * 2];
+  try {
+    await frame.copyTo(buffer, {
+      rect,
+      layout: [
+        { offset: offsets[0], stride: strides[0] },
+        { offset: offsets[1], stride: strides[1] },
+        { offset: offsets[2], stride: strides[2] },
+      ],
+    });
+  } catch (error) {
+    // The caller falls back to handing the frame over; keep the buffer for the next copy.
+    planePool.push(buffer);
+    throw error;
+  }
+  return {
+    timestamp: frame.timestamp / 1e6,
+    duration: (frame.duration ?? 0) / 1e6,
+    bitDepth,
+    width: rect.width,
+    height: rect.height,
+    chromaWidth,
+    chromaHeight,
+    buffer,
+    offsets,
+    strides,
+  };
+}
+
+function readFailure(kind: "video" | "audio", error: unknown): EngineFailure {
+  return new EngineFailure(ENGINE_FAILURES.read, `Reading ${kind} failed: ${String(error)}`);
+}
+
+/**
+ * Finds where a run starts. The lookup reads the file, so its failure is a
+ * read failure like any other, not a decoder one.
+ */
+async function findStartPacket(
+  kind: "video" | "audio",
+  lookup: () => Promise<EncodedPacket | null>,
+): Promise<EncodedPacket | null> {
+  try {
+    return await lookup();
+  } catch (error) {
+    throw readFailure(kind, error);
+  }
+}
+
+/**
+ * The packets from `start` on, with a failed read reported as a read failure.
+ * Only the reads: an error the caller raises while handling a packet, such as
+ * a decoder rejecting it, keeps its own classification, so a bad packet fails
+ * over to another route instead of reconnecting to the same one.
+ */
+async function* readPackets(
+  kind: "video" | "audio",
+  sink: EncodedPacketSink,
+  start: EncodedPacket,
+): AsyncGenerator<EncodedPacket> {
+  const packets = sink.packets(start)[Symbol.asyncIterator]();
+  try {
+    while (true) {
+      let next: IteratorResult<EncodedPacket>;
+      try {
+        next = await packets.next();
+      } catch (error) {
+        throw readFailure(kind, error);
+      }
+      if (next.done) return;
+      yield next.value;
+    }
+  } finally {
+    await packets.return?.();
+  }
+}
+
+async function runVideo(run: number, position: number): Promise<void> {
+  const track = videoTrack!;
+  const config = videoConfig!;
+  const sink = new EncodedPacketSink(track);
+  const startPacket = await findStartPacket(
+    "video",
+    async () =>
+      (await sink.getKeyPacket(position + timelineOrigin, { verifyKeyPackets: true })) ??
+      (await sink.getFirstKeyPacket({ verifyKeyPackets: true })),
+  );
+  if (run !== generation) return;
+  if (!startPacket) {
+    post({ type: "video-ended", generation: run });
+    return;
+  }
+
+  // Frames are handed over strictly in output order; copying planes is async.
+  let delivery = Promise.resolve();
+  const usePlanes = source!.video.transfer !== "sdr";
+  const decoder = new VideoDecoder({
+    output: (frame) => {
+      if (run !== generation) {
+        frame.close();
+        return;
+      }
+      const end = (frame.timestamp + (frame.duration ?? 0)) / 1e6;
+      if (end <= position - 0.001) {
+        // Decoded only as a reference for the frames after the seek target.
+        frame.close();
+        return;
+      }
+      framesInFlight += 1;
+      delivery = delivery.then(async () => {
+        if (run !== generation) {
+          frame.close();
+          return;
+        }
+        // The plane shader assumes limited range; a full-range frame goes to
+        // frame import instead, which converts with the frame's own range.
+        if (
+          usePlanes &&
+          frame.format &&
+          RAW_PLANE_FORMATS.test(frame.format) &&
+          frame.colorSpace?.fullRange !== true
+        ) {
+          try {
+            const planes = await copyPlanes(frame);
+            frame.close();
+            if (run !== generation) {
+              planePool.push(planes.buffer);
+              return;
+            }
+            post({ type: "planes", generation: run, planes }, [planes.buffer]);
+            return;
+          } catch {
+            // Some GPU-backed frames report a format they cannot copy; fall
+            // through and hand the frame over for import instead.
+          }
+        }
+        post({ type: "frame", generation: run, frame }, [frame]);
+      });
+    },
+    error: (error) => fail(run, error, ENGINE_FAILURES.videoDecode),
+  });
+  activeVideoDecoder = decoder;
+  decoder.addEventListener("dequeue", () => waker.wake());
+  decoder.configure(config);
+
+  for await (const packet of readPackets("video", sink, startPacket)) {
+    while (
+      run === generation &&
+      (framesInFlight >= MAX_FRAMES_IN_FLIGHT || decoder.decodeQueueSize >= MAX_VIDEO_DECODE_QUEUE)
+    ) {
+      await waker.wait();
+    }
+    if (run !== generation || decoder.state === "closed") return;
+    const data = nalLengthSize ? stripDolbyVisionNalUnits(packet.data, nalLengthSize) : packet.data;
+    decoder.decode(
+      new EncodedVideoChunk({
+        type: packet.type,
+        timestamp: Math.round(playerTime(packet) * 1e6),
+        duration: Math.round(packet.duration * 1e6),
+        data,
+      }),
+    );
+  }
+  if (run !== generation || decoder.state === "closed") return;
+  await decoder.flush();
+  await delivery;
+  if (run === generation) post({ type: "video-ended", generation: run });
+}
+
+function webCodecsAudioDecoder(config: AudioDecoderConfig, run: number): AudioDecoderAdapter {
+  let ready: DecodedAudio[] = [];
+  const decoder = new AudioDecoder({
+    output: (data) => {
+      const planes: Float32Array[] = [];
+      for (let channel = 0; channel < data.numberOfChannels; channel++) {
+        const plane = new Float32Array(data.numberOfFrames);
+        data.copyTo(plane, { planeIndex: channel, format: "f32-planar" });
+        planes.push(plane);
+      }
+      ready.push({
+        planes,
+        sampleRate: data.sampleRate,
+        speakers: defaultSpeakers(data.numberOfChannels),
+        timestamp: data.timestamp / 1e6,
+      });
+      data.close();
+    },
+    error: (error) => fail(run, error, ENGINE_FAILURES.audioDecode),
+  });
+  decoder.configure(config);
+  const take = () => {
+    const out = ready;
+    ready = [];
+    return out;
+  };
+  return {
+    async decode(packet) {
+      decoder.decode(
+        new EncodedAudioChunk({
+          type: "key",
+          timestamp: Math.round(playerTime(packet) * 1e6),
+          duration: Math.round(packet.duration * 1e6),
+          data: packet.data,
+        }),
+      );
+      // Let the decoder run ahead a few packets rather than flushing each one.
+      while (decoder.decodeQueueSize > 8) {
+        await new Promise((resolve) =>
+          decoder.addEventListener("dequeue", resolve, { once: true }),
+        );
+      }
+      return take();
+    },
+    async flush() {
+      if (decoder.state === "configured") await decoder.flush();
+      return take();
+    },
+    close() {
+      if (decoder.state !== "closed") decoder.close();
+    },
+  };
+}
+
+async function ffmpegAudioDecoder(
+  codec: FFmpegAudioCodec,
+  track: InputAudioTrack,
+): Promise<AudioDecoderAdapter> {
+  const module = await loadFFmpegAudioDecoders({ locateFile: () => wasmUrl });
+  const config = await track.getDecoderConfig().catch(() => null);
+  const extradata = config?.description ? toBytes(config.description) : null;
+  const decoder = new FFmpegAudioDecoder(
+    module,
+    codec,
+    audioFacts!.sampleRate,
+    audioFacts!.channels,
+    extradata,
+  );
+  const convert =
+    (packetTimestamp: number) =>
+    (frame: DecodedAudioFrame): DecodedAudio => ({
+      planes: frame.channels,
+      sampleRate: frame.sampleRate,
+      speakers: speakersFromMask(frame.channelMask, frame.channels.length),
+      timestamp: frame.timestampUs === null ? packetTimestamp : frame.timestampUs / 1e6,
+    });
+  return {
+    async decode(packet) {
+      const timestamp = playerTime(packet);
+      return decoder.decode(packet.data, timestamp * 1e6).map(convert(timestamp));
+    },
+    async flush() {
+      return decoder.drain().map(convert(0));
+    },
+    close() {
+      decoder.close();
+    },
+  };
+}
+
+function pcmAudioDecoder(format: PCMFormat): AudioDecoderAdapter {
+  const { channels, sampleRate } = audioFacts!;
+  return {
+    async decode(packet) {
+      return [
+        {
+          planes: unpackPCM(packet.data, format, channels),
+          sampleRate,
+          speakers: defaultSpeakers(channels),
+          timestamp: playerTime(packet),
+        },
+      ];
+    },
+    async flush() {
+      return [];
+    },
+    close() {},
+  };
+}
+
+async function createAudioDecoder(
+  run: number,
+  codec: string,
+  track: InputAudioTrack,
+): Promise<AudioDecoderAdapter> {
+  if (isFFmpegAudioCodec(codec)) return ffmpegAudioDecoder(codec, track);
+  const pcm = SERVER_PCM_FORMATS[codec];
+  if (pcm) return pcmAudioDecoder(pcm);
+  const config = await track.getDecoderConfig();
+  if (!config)
+    throw new EngineFailure(ENGINE_FAILURES.audioDecode, `No decoder configuration for ${codec}.`);
+  return webCodecsAudioDecoder(config, run);
+}
+
+async function runAudio(run: number, position: number): Promise<void> {
+  const track = audioTrack!;
+  const output = audioOutput!;
+  const codec = source!.audio!.codec;
+  const sink = new EncodedPacketSink(track);
+  const preroll = isFFmpegAudioCodec(codec) ? FFMPEG_PREROLL_SECONDS : 0;
+  const startPacket = await findStartPacket(
+    "audio",
+    async () =>
+      (await sink.getPacket(Math.max(0, position - preroll) + timelineOrigin)) ??
+      (await sink.getFirstPacket()),
+  );
+  if (run !== generation) return;
+  const send = (message: WorkerToWorkletMessage, transfer: Transferable[] = []) =>
+    output.port.postMessage(message, transfer);
+  if (!startPacket) {
+    send({ type: "end", generation: run });
+    post({ type: "audio-ended", generation: run });
+    return;
+  }
+
+  const decoder = await createAudioDecoder(run, codec, track);
+  if (run !== generation) {
+    decoder.close();
+    return;
+  }
+  activeAudioDecoder = decoder;
+  let mix: { key: string; matrix: Float32Array } | null = null;
+  let resampler: LinearResampler | null = null;
+
+  const emit = (decoded: DecodedAudio) => {
+    if (run !== generation) return;
+    let planes = decoded.planes;
+    let timestamp = decoded.timestamp;
+    const frames = planes[0]?.length ?? 0;
+    if (frames === 0) return;
+    const end = timestamp + frames / decoded.sampleRate;
+    if (end <= position) return;
+    if (timestamp < position) {
+      const skip = Math.min(frames, Math.round((position - timestamp) * decoded.sampleRate));
+      planes = planes.map((plane) => plane.subarray(skip));
+      timestamp = position;
+    }
+    if (decoded.sampleRate !== output.sampleRate) {
+      resampler ??= new LinearResampler(decoded.sampleRate, output.sampleRate, planes.length);
+      planes = resampler.process(planes);
+    }
+    const key = `${decoded.speakers.join(",")}>${output.channels}`;
+    if (mix?.key !== key) mix = { key, matrix: mixMatrix(decoded.speakers, output.channels) };
+    const samples = mixToInterleaved(planes, mix.matrix, output.channels);
+    if (samples.length === 0) return;
+    const wasBuffered = audioPostedSeconds >= AUDIO_BUFFERED_SECONDS;
+    audioPostedSeconds += samples.length / output.channels / output.sampleRate;
+    send({ type: "pcm", generation: run, timestamp, samples }, [samples.buffer]);
+    if (!wasBuffered && audioPostedSeconds >= AUDIO_BUFFERED_SECONDS) {
+      post({ type: "audio-buffered", generation: run });
+    }
+  };
+
+  for await (const packet of readPackets("audio", sink, startPacket)) {
+    while (run === generation && audioPostedSeconds - audioConsumedSeconds > AUDIO_AHEAD_SECONDS) {
+      await waker.wait();
+    }
+    if (run !== generation) return;
+    for (const decoded of await decoder.decode(packet)) emit(decoded);
+  }
+  if (run !== generation) return;
+  for (const decoded of await decoder.flush()) emit(decoded);
+  if (run !== generation) return;
+  send({ type: "end", generation: run });
+  post({ type: "audio-ended", generation: run });
+}
+
+scope.onmessage = (event: MessageEvent<PageToWorkerMessage>) => {
+  const message = event.data;
+  switch (message.type) {
+    case "open":
+      void open(message.source).catch((error: unknown) => fail(null, error, ENGINE_FAILURES.open));
+      return;
+    case "audio-output":
+      audioOutput = {
+        port: message.port,
+        channels: message.channels,
+        sampleRate: message.sampleRate,
+      };
+      message.port.onmessage = (portEvent: MessageEvent<WorkletToWorkerMessage>) => {
+        const report = portEvent.data;
+        if (report.type === "consumed" && report.generation === generation) {
+          audioConsumedSeconds = report.consumedSeconds;
+          waker.wake();
+        }
+      };
+      return;
+    case "start":
+      start(message.generation, message.position);
+      return;
+    case "frame-released":
+      if (message.generation === generation && framesInFlight > 0) {
+        framesInFlight -= 1;
+        waker.wake();
+      }
+      return;
+    case "planes-released":
+      if (planePool.length < MAX_FRAMES_IN_FLIGHT) planePool.push(message.buffer);
+      return;
+    case "close":
+      generation += 1;
+      stopRun();
+      waker.wake();
+      input?.dispose();
+      input = null;
+      scope.close();
+      return;
+  }
+};
diff --git a/web/src/player/engine/facade.test.ts b/web/src/player/engine/facade.test.ts
new file mode 100644
index 0000000000..0bf7097a0b
--- /dev/null
+++ b/web/src/player/engine/facade.test.ts
@@ -0,0 +1,87 @@
+import { describe, expect, it, vi } from "vitest";
+import type { EnginePlayer } from "./EnginePlayer";
+import { attachEngineToElement } from "./facade";
+import { EngineTextTrack } from "./textTracks";
+
+function fakePlayer() {
+  return {
+    currentTime: 12,
+    duration: 100,
+    paused: true,
+    ended: false,
+    seeking: false,
+    readyState: 4,
+    buffered: { length: 0 },
+    seekable: { length: 0 },
+    volume: 0.5,
+    muted: false,
+    playbackRate: 1,
+    videoWidth: 1920,
+    videoHeight: 800,
+    play: vi.fn(async () => {}),
+    pause: vi.fn(),
+    getVideoPlaybackQuality: vi.fn(() => ({ totalVideoFrames: 50, droppedVideoFrames: 3 })),
+    requestVideoFrameCallback: vi.fn(() => 7),
+    cancelVideoFrameCallback: vi.fn(),
+    addTextTrack: vi.fn(() => "track"),
+  };
+}
+
+describe("attachEngineToElement", () => {
+  it("forwards the media surface to the player and restores the element", async () => {
+    const video = document.createElement("video");
+    const player = fakePlayer();
+    const detach = attachEngineToElement(video, player as unknown as EnginePlayer);
+
+    expect(video.currentTime).toBe(12);
+    expect(video.videoWidth).toBe(1920);
+    expect(video.readyState).toBe(4);
+    video.currentTime = 30;
+    expect(player.currentTime).toBe(30);
+    video.volume = 0.25;
+    expect(player.volume).toBe(0.25);
+    await video.play();
+    expect(player.play).toHaveBeenCalled();
+    expect(video.requestVideoFrameCallback(() => {})).toBe(7);
+    // The overlay's dropped-frame count comes from the engine, not the idle element.
+    expect(video.getVideoPlaybackQuality().droppedVideoFrames).toBe(3);
+    expect(video.addTextTrack("subtitles")).toBe("track");
+    expect(video.error).toBeNull();
+    await expect(video.requestPictureInPicture()).rejects.toMatchObject({
+      name: "NotSupportedError",
+    });
+
+    player.muted = true;
+    detach();
+    expect(Object.getOwnPropertyNames(video)).not.toContain("currentTime");
+    expect(Object.getOwnPropertyNames(video)).not.toContain("play");
+    expect(video.videoWidth).toBe(0);
+    expect(video.volume).toBe(0.25);
+    expect(video.muted).toBe(true);
+  });
+});
+
+describe("EngineTextTrack", () => {
+  it("activates cues against the engine time and reports changes once", () => {
+    const track = new EngineTextTrack("subtitles", "Prairie", "en");
+    track.mode = "hidden";
+    const first = { startTime: 1, endTime: 2 } as TextTrackCue;
+    const second = { startTime: 1.5, endTime: 3 } as TextTrackCue;
+    track.addCue(first);
+    track.addCue(second);
+    const changes = vi.fn();
+    track.addEventListener("cuechange", changes);
+
+    track.update(0.5);
+    expect(changes).not.toHaveBeenCalled();
+    track.update(1.6);
+    expect(Array.from(track.activeCues!)).toEqual([first, second]);
+    track.update(1.7);
+    expect(changes).toHaveBeenCalledTimes(1);
+    track.removeCue(first);
+    track.update(1.8);
+    expect(Array.from(track.activeCues!)).toEqual([second]);
+    track.mode = "disabled";
+    expect(track.cues).toBeNull();
+  });
+});
diff --git a/web/src/player/engine/facade.ts b/web/src/player/engine/facade.ts
new file mode 100644
index 0000000000..720fea971a
--- /dev/null
+++ b/web/src/player/engine/facade.ts
@@ -0,0 +1,89 @@
+import type { EnginePlayer } from "./EnginePlayer";
+
+/**
+ * Members of HTMLMediaElement/HTMLVideoElement that the engine takes over on
+ * the player's `<video>` while it plays a file. Everything else (layout,
+ * listeners, fullscreen, the element's identity in React refs) stays the real
+ * element's, so the player's hooks keep working unchanged.
+ */
+const DELEGATED_PROPERTIES = [
+  "currentTime",
+  "duration",
+  "paused",
+  "ended",
+  "seeking",
+  "readyState",
+  "buffered",
+  "seekable",
+  "volume",
+  "muted",
+  "playbackRate",
+  "videoWidth",
+  "videoHeight",
+] as const;
+
+const DELEGATED_METHODS = [
+  "play",
+  "pause",
+  "getVideoPlaybackQuality",
+  "requestVideoFrameCallback",
+  "cancelVideoFrameCallback",
+  "addTextTrack",
+] as const;
+
+const OWN_MEMBERS = [
+  ...DELEGATED_PROPERTIES,
+  ...DELEGATED_METHODS,
+  "error",
+  "requestPictureInPicture",
+  "disablePictureInPicture",
+] as const;
+
+/**
+ * Installs instance-level overrides on `video` that forward to `player`, and
+ * returns a function that removes them. Instance properties shadow the
+ * prototype accessors, so deleting them restores the native element exactly.
+ */
+export function attachEngineToElement(video: HTMLVideoElement, player: EnginePlayer): () => void {
+  const target = player as unknown as Record<string, unknown>;
+  for (const name of DELEGATED_PROPERTIES) {
+    Object.defineProperty(video, name, {
+      configurable: true,
+      get: () => target[name],
+      set: (value: unknown) => {
+        target[name] = value;
+      },
+    });
+  }
+  for (const name of DELEGATED_METHODS) {
+    const method = target[name] as (...args: unknown[]) => unknown;
+    Object.defineProperty(video, name, {
+      configurable: true,
+      writable: true,
+      value: (...args: unknown[]) => method.apply(player, args),
+    });
+  }
+  // Failures go to the player's typed failure path instead of a MediaError.
+  Object.defineProperty(video, "error", { configurable: true, get: () => null });
+  // The picture lives on a canvas, which the browser cannot float.
+  Object.defineProperty(video, "requestPictureInPicture", {
+    configurable: true,
+    writable: true,
+    value: () =>
+      Promise.reject(
+        new DOMException("Picture-in-picture is unavailable for this stream.", "NotSupportedError"),
+      ),
+  });
+  Object.defineProperty(video, "disablePictureInPicture", { configurable: true, get: () => true });
+
+  return () => {
+    const volume = player.volume;
+    const muted = player.muted;
+    for (const name of OWN_MEMBERS) {
+      delete (video as unknown as Record<string, unknown>)[name];
+    }
+    // Hand the viewer's volume back to the element the next stream will use.
+    video.volume = volume;
+    video.muted = muted;
+  };
+}
diff --git a/web/src/player/engine/ffmpegAudioDecoder.test.ts b/web/src/player/engine/ffmpegAudioDecoder.test.ts
new file mode 100644
index 0000000000..7b1c54435e
--- /dev/null
+++ b/web/src/player/engine/ffmpegAudioDecoder.test.ts
@@ -0,0 +1,92 @@
+// @vitest-environment node
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+import { ALL_FORMATS, BufferSource, EncodedPacketSink, Input } from "mediabunny";
+import { FFmpegAudioDecoder, loadFFmpegAudioDecoders } from "./ffmpegAudioDecoder";
+import { SPEAKER, speakersFromMask } from "./audioMix";
+import type { FFmpegAudioCodec } from "./codecs";
+
+const here = (name: string) => fileURLToPath(new URL(name, import.meta.url));
+const wasm = readFileSync(here("./wasm/prairie-audio-decoders.wasm"));
+
+function rms(samples: Float32Array): number {
+  let sum = 0;
+  for (const sample of samples) sum += sample * sample;
+  return Math.sqrt(sum / Math.max(1, samples.length));
+}
+
+// Each fixture is 0.25 s of a 1 kHz tone (amplitude 1/8, RMS 0.088) on the
+// center channel of a 5.1(side) layout with silence elsewhere; MLP carries a
+// stereo downmix of the same signal, so the tone sits equally on both sides.
+describe("FFmpegAudioDecoder", () => {
+  const cases: Array<[FFmpegAudioCodec, string, number]> = [
+    ["ac3", "ac3.mka", 6],
+    ["eac3", "eac3.mka", 6],
+    ["dts", "dts.mka", 6],
+    ["truehd", "truehd.mka", 6],
+    ["mlp", "mlp.mka", 2],
+  ];
+
+  for (const [codec, file, channels] of cases) {
+    it(`decodes ${codec} with its channel layout`, async () => {
+      const module = await loadFFmpegAudioDecoders({ wasmBinary: wasm });
+      const input = new Input({
+        formats: ALL_FORMATS,
+        source: new BufferSource(readFileSync(here(`./testdata/${file}`))),
+      });
+      const track = (await input.getAudioTracks())[0]!;
+      const decoder = new FFmpegAudioDecoder(
+        module,
+        codec,
+        track.sampleRate,
+        track.numberOfChannels,
+      );
+      const planes: Float32Array[][] = [];
+      let mask = 0;
+      let firstTimestamp: number | null = null;
+      for await (const packet of new EncodedPacketSink(track).packets()) {
+        for (const frame of decoder.decode(packet.data, packet.timestamp * 1e6)) {
+          firstTimestamp ??= frame.timestampUs;
+          mask = frame.channelMask;
+          expect(frame.sampleRate).toBe(48_000);
+          planes.push(frame.channels);
+        }
+      }
+      for (const frame of decoder.drain()) planes.push(frame.channels);
+      decoder.close();
+
+      const total = planes.reduce((sum, frame) => sum + frame[0]!.length, 0);
+      expect(total / 48_000).toBeGreaterThan(0.2);
+      expect(firstTimestamp).toBe(0);
+      const speakers = speakersFromMask(mask, channels);
+      expect(speakers).toHaveLength(channels);
+      const joined = (speaker: number) => {
+        const channel = speakers.indexOf(speaker);
+        const out = new Float32Array(total);
+        let offset = 0;
+        for (const frame of planes) {
+          out.set(frame[channel]!, offset);
+          offset += frame[channel]!.length;
+        }
+        return out;
+      };
+      if (channels === 6) {
+        const tone = rms(joined(SPEAKER.FC));
+        expect(tone).toBeGreaterThan(0.08);
+        // The tone stays on its own speaker; lossy codecs leak only noise.
+        expect(rms(joined(SPEAKER.FL))).toBeLessThan(tone / 20);
+        expect(rms(joined(SPEAKER.SR))).toBeLessThan(tone / 20);
+      } else {
+        const left = rms(joined(SPEAKER.FL));
+        expect(left).toBeGreaterThan(0.02);
+        expect(rms(joined(SPEAKER.FR))).toBeCloseTo(left, 3);
+      }
+    });
+  }
+
+  it("refuses to open an unknown codec id", async () => {
+    const module = await loadFFmpegAudioDecoders({ wasmBinary: wasm });
+    expect(() => new FFmpegAudioDecoder(module, "nope" as FFmpegAudioCodec, 48_000, 2)).toThrow();
+  });
+});
diff --git a/web/src/player/engine/ffmpegAudioDecoder.ts b/web/src/player/engine/ffmpegAudioDecoder.ts
new file mode 100644
index 0000000000..e0cd4b23d9
--- /dev/null
+++ b/web/src/player/engine/ffmpegAudioDecoder.ts
@@ -0,0 +1,134 @@
+import createPrairieAudioDecoders, {
+  type PrairieAudioDecodersModule,
+  type PrairieAudioDecodersOptions,
+} from "./wasm/prairie-audio-decoders.mjs";
+import type { FFmpegAudioCodec } from "./codecs";
+
+const CODEC_IDS: Record<FFmpegAudioCodec, number> = {
+  ac3: 1,
+  eac3: 2,
+  dts: 3,
+  truehd: 4,
+  mlp: 5,
+};
+
+const AVERROR_EOF = -541478725;
+
+/** One decoded frame, planar float32, one array per channel. */
+export interface DecodedAudioFrame {
+  channels: Float32Array[];
+  sampleRate: number;
+  /** FFmpeg native channel mask (`AV_CH_*` bits), or 0 when unknown. */
+  channelMask: number;
+  /** Microseconds, or null when the decoder could not attribute one. */
+  timestampUs: number | null;
+}
+
+let modulePromise: Promise<PrairieAudioDecodersModule> | null = null;
+
+/**
+ * Loads the WebAssembly module once per realm. In the browser the `.wasm`
+ * resolves next to the bundled glue; tests pass the bytes directly.
+ */
+export function loadFFmpegAudioDecoders(
+  options?: PrairieAudioDecodersOptions,
+): Promise<PrairieAudioDecodersModule> {
+  modulePromise ??= createPrairieAudioDecoders(options).catch((error: unknown) => {
+    modulePromise = null;
+    throw error;
+  });
+  return modulePromise;
+}
+
+export function resetFFmpegAudioDecodersForTests(): void {
+  modulePromise = null;
+}
+
+/**
+ * A libavcodec audio decoder for the codecs WebCodecs does not offer. Calls are
+ * synchronous: the module runs inside the engine's worker, never on the page.
+ */
+export class FFmpegAudioDecoder {
+  private handle: number;
+
+  constructor(
+    private readonly module: PrairieAudioDecodersModule,
+    readonly codec: FFmpegAudioCodec,
+    sampleRate: number,
+    channels: number,
+    extradata?: Uint8Array | null,
+  ) {
+    let extradataPointer = 0;
+    const extradataSize = extradata?.byteLength ?? 0;
+    if (extradata && extradataSize > 0) {
+      extradataPointer = module._malloc(extradataSize);
+      module.HEAPU8.set(extradata, extradataPointer);
+    }
+    this.handle = module._sad_open(
+      CODEC_IDS[codec],
+      sampleRate,
+      channels,
+      extradataPointer,
+      extradataSize,
+    );
+    if (extradataPointer) module._free(extradataPointer);
+    if (!this.handle) throw new Error(`FFmpeg could not open a ${codec} decoder`);
+  }
+
+  /** Decodes one packet and returns every frame it completed. */
+  decode(data: Uint8Array, timestampUs: number): DecodedAudioFrame[] {
+    const pointer = this.module._sad_packet_buffer(this.handle, data.byteLength);
+    if (!pointer) throw new Error("FFmpeg could not allocate a packet");
+    this.module.HEAPU8.set(data, pointer);
+    // A rejected (damaged) packet is dropped; the decoder resynchronizes on a
+    // later one, so frames it still holds are drained either way.
+    this.module._sad_send_packet(this.handle, timestampUs);
+    return this.receive();
+  }
+
+  /** Drains frames the decoder still holds at end of stream. */
+  drain(): DecodedAudioFrame[] {
+    this.module._sad_send_eof(this.handle);
+    const frames = this.receive();
+    this.module._sad_flush(this.handle);
+    return frames;
+  }
+
+  /** Discards buffered state, for a seek. */
+  reset(): void {
+    this.module._sad_flush(this.handle);
+  }
+
+  close(): void {
+    if (!this.handle) return;
+    this.module._sad_close(this.handle);
+    this.handle = 0;
+  }
+
+  private receive(): DecodedAudioFrame[] {
+    const frames: DecodedAudioFrame[] = [];
+    for (;;) {
+      const samples = this.module._sad_receive_frame(this.handle);
+      if (samples === 0 || samples === AVERROR_EOF) break;
+      if (samples < 0) break;
+      const channelCount = this.module._sad_frame_channels(this.handle);
+      const base = this.module._sad_frame_pcm(this.handle) / Float32Array.BYTES_PER_ELEMENT;
+      const heap = this.module.HEAPF32;
+      const channels: Float32Array[] = [];
+      for (let channel = 0; channel < channelCount; channel++) {
+        const start = base + channel * samples;
+        channels.push(heap.slice(start, start + samples));
+      }
+      const low = this.module._sad_frame_layout_low(this.handle) >>> 0;
+      const high = this.module._sad_frame_layout_high(this.handle) >>> 0;
+      const pts = this.module._sad_frame_pts_us(this.handle);
+      frames.push({
+        channels,
+        sampleRate: this.module._sad_frame_sample_rate(this.handle),
+        channelMask: high * 2 ** 32 + low,
+        timestampUs: pts < 0 ? null : pts,
+      });
+    }
+    return frames;
+  }
+}
diff --git a/web/src/player/engine/gpuAdapter.ts b/web/src/player/engine/gpuAdapter.ts
new file mode 100644
index 0000000000..e1b2b05148
--- /dev/null
+++ b/web/src/player/engine/gpuAdapter.ts
@@ -0,0 +1,14 @@
+/// <reference types="@webgpu/types" />
+
+/**
+ * A software (fallback) adapter cannot tone-map 4K in time, so the engine
+ * treats it as no adapter. Shared by the page's capability probe and the
+ * presenter, which load separately.
+ */
+export function isSoftwareAdapter(adapter: GPUAdapter): boolean {
+  return (
+    (adapter.info as GPUAdapterInfo | undefined)?.isFallbackAdapter ??
+    (adapter as GPUAdapter & { isFallbackAdapter?: boolean }).isFallbackAdapter ??
+    false
+  );
+}
diff --git a/web/src/player/engine/hdrShader.ts b/web/src/player/engine/hdrShader.ts
new file mode 100644
index 0000000000..28b8fc4db8
--- /dev/null
+++ b/web/src/player/engine/hdrShader.ts
@@ -0,0 +1,287 @@
+/**
+ * WGSL for the engine's WebGPU presenter. The color functions mirror
+ * colorMath.ts, which carries the reference implementation and its tests.
+ *
+ * Three entry points read the picture differently and share the conversion.
+ * `fragmentExternal` samples a GPU-backed frame whose R'G'B' the browser has
+ * already derived with the YUV matrix (the decoder was told the frame is
+ * sRGB-tagged so no transfer is applied); `fragmentCopied` samples the same
+ * R'G'B' after the frame was copied into a half-float texture, for browsers
+ * that import some frames wrongly; and `fragmentPlanes` reconstructs R'G'B'
+ * from uploaded 10/12-bit Y'CbCr codes, keeping full precision.
+ *
+ * A picture drawn smaller than its own size would alias with one sample per
+ * pixel, so each entry averages an N x N grid of bilinear samples across the
+ * pixel's footprint, N being how many texels of that plane the pixel covers
+ * (at most 4). At or above the picture's own size N is 1.
+ */
+export const PRESENTER_WGSL = /* wgsl */ `
+struct Params {
+  // Picture quad in normalized device coordinates: x0, y0, x1, y1.
+  rect: vec4f,
+  // x: transfer (1 = PQ, 2 = HLG); y: bit depth of uploaded planes;
+  // z: clockwise quarter turns that put the picture upright; w: 1 to mirror it after.
+  mode: vec4u,
+  // x: source peak nits, y: target (SDR white) nits.
+  tone: vec4f,
+  // Luma width/height, chroma width/height of uploaded planes.
+  sizes: vec4f,
+  // xy: first chroma sample's offset from the first luma sample, in luma
+  // pixels; zw: chroma subsampling along x and y (1 or 2).
+  chroma: vec4f,
+  // Y'CbCr to R'G'B': Cr into R, Cb into G, Cr into G, Cb into B.
+  yuv: vec4f,
+  // Luminance weights of the source gamut.
+  luma: vec4f,
+  // Rows of the linear source-gamut to BT.709 matrix.
+  gamut0: vec4f,
+  gamut1: vec4f,
+  gamut2: vec4f,
+};
+
+@group(0) @binding(0) var<uniform> params: Params;
+@group(0) @binding(1) var pictureSampler: sampler;
+
+struct VertexOut {
+  @builtin(position) position: vec4f,
+  @location(0) uv: vec2f,
+};
+
+@vertex
+fn vertexMain(@builtin(vertex_index) index: u32) -> VertexOut {
+  var corners = array<vec2f, 6>(
+    vec2f(0.0, 0.0), vec2f(1.0, 0.0), vec2f(0.0, 1.0),
+    vec2f(0.0, 1.0), vec2f(1.0, 0.0), vec2f(1.0, 1.0),
+  );
+  let corner = corners[index];
+  var out: VertexOut;
+  out.position = vec4f(
+    mix(params.rect.x, params.rect.z, corner.x),
+    mix(params.rect.y, params.rect.w, corner.y),
+    0.0,
+    1.0,
+  );
+  out.uv = decodedUV(corner);
+  return out;
+}
+
+// Where a point of the upright picture (0..1, y down) lies in the decoded
+// one: undo the mirror, then the clockwise quarter turns.
+fn decodedUV(upright: vec2f) -> vec2f {
+  var p = upright;
+  if (params.mode.w == 1u) {
+    p.x = 1.0 - p.x;
+  }
+  var uv = p;
+  switch params.mode.z {
+    case 1u: { uv = vec2f(p.y, 1.0 - p.x); }
+    case 2u: { uv = vec2f(1.0 - p.x, 1.0 - p.y); }
+    case 3u: { uv = vec2f(1.0 - p.y, p.x); }
+    default: {}
+  }
+  return uv;
+}
+
+const PQ_M1: f32 = 0.1593017578125;
+const PQ_M2: f32 = 78.84375;
+const PQ_C1: f32 = 0.8359375;
+const PQ_C2: f32 = 18.8515625;
+const PQ_C3: f32 = 18.6875;
+const HLG_A: f32 = 0.17883277;
+const HLG_B: f32 = 0.28466892;
+const HLG_C: f32 = 0.55991073;
+
+fn pqToNits(signal: vec3f) -> vec3f {
+  let e = pow(max(signal, vec3f(0.0)), vec3f(1.0 / PQ_M2));
+  let n = max(e - PQ_C1, vec3f(0.0)) / (PQ_C2 - PQ_C3 * e);
+  return 10000.0 * pow(n, vec3f(1.0 / PQ_M1));
+}
+
+fn nitsToPQ(nits: f32) -> f32 {
+  let y = pow(max(nits, 0.0) / 10000.0, PQ_M1);
+  return pow((PQ_C1 + PQ_C2 * y) / (1.0 + PQ_C3 * y), PQ_M2);
+}
+
+fn pqScalarToNits(signal: f32) -> f32 {
+  let e = pow(max(signal, 0.0), 1.0 / PQ_M2);
+  let n = max(e - PQ_C1, 0.0) / (PQ_C2 - PQ_C3 * e);
+  return 10000.0 * pow(n, 1.0 / PQ_M1);
+}
+
+fn hlgToScene(signal: vec3f) -> vec3f {
+  let e = max(signal, vec3f(0.0));
+  let low = e * e / 3.0;
+  let high = (exp((e - HLG_C) / HLG_A) + HLG_B) / 12.0;
+  return select(high, low, e <= vec3f(0.5));
+}
+
+fn bt2390(nits: f32, sourcePeak: f32, targetPeak: f32) -> f32 {
+  if (sourcePeak <= targetPeak) {
+    return min(nits, targetPeak);
+  }
+  let sourcePQ = nitsToPQ(sourcePeak);
+  let e1 = nitsToPQ(nits) / sourcePQ;
+  let maxLum = nitsToPQ(targetPeak) / sourcePQ;
+  let knee = 1.5 * maxLum - 0.5;
+  var e2 = e1;
+  if (e1 >= knee) {
+    let t = (e1 - knee) / (1.0 - knee);
+    let t2 = t * t;
+    let t3 = t2 * t;
+    e2 = (2.0 * t3 - 3.0 * t2 + 1.0) * knee + (t3 - 2.0 * t2 + t) * (1.0 - knee) +
+      (-2.0 * t3 + 3.0 * t2) * maxLum;
+  }
+  return pqScalarToNits(min(e2, 1.0) * sourcePQ);
+}
+
+fn linearToSRGB(value: vec3f) -> vec3f {
+  let v = clamp(value, vec3f(0.0), vec3f(1.0));
+  let low = 12.92 * v;
+  let high = 1.055 * pow(v, vec3f(1.0 / 2.4)) - 0.055;
+  return select(high, low, v <= vec3f(0.0031308));
+}
+
+fn toneMap(encoded: vec3f) -> vec4f {
+  let weights = params.luma.xyz;
+  var linear: vec3f;
+  if (params.mode.x == 2u) {
+    let scene = hlgToScene(encoded);
+    let sceneLuma = dot(scene, weights);
+    linear = scene * (1000.0 * pow(max(sceneLuma, 1e-6), 0.2));
+  } else {
+    linear = pqToNits(encoded);
+  }
+  let sourcePeak = params.tone.x;
+  let targetPeak = params.tone.y;
+  let luma = dot(linear, weights);
+  var scale = 0.0;
+  if (luma > 0.0) {
+    scale = bt2390(luma, sourcePeak, targetPeak) / luma;
+  }
+  let bt709 = vec3f(
+    dot(params.gamut0.xyz, linear),
+    dot(params.gamut1.xyz, linear),
+    dot(params.gamut2.xyz, linear),
+  );
+  return vec4f(linearToSRGB(bt709 * scale / targetPeak), 1.0);
+}
+
+// How many samples per axis cover a pixel spanning these texel steps. The
+// tolerance keeps whole-number scales (1:1, 2:1) from tipping into an extra
+// row of samples through rounding in the interpolated coordinates.
+fn tapCount(stepX: vec2f, stepY: vec2f) -> i32 {
+  return i32(clamp(ceil(max(length(stepX), length(stepY)) - 0.01), 1.0, 4.0));
+}
+
+// Offset of sample (i, j) of an n x n grid across the pixel, in pixels.
+fn tapOffset(i: i32, j: i32, n: i32) -> vec2f {
+  return (vec2f(f32(i), f32(j)) + 0.5) / f32(n) - 0.5;
+}
+
+@group(1) @binding(0) var externalPicture: texture_external;
+
+@fragment
+fn fragmentExternal(in: VertexOut) -> @location(0) vec4f {
+  // Derivatives first, while control flow is still uniform.
+  let du = dpdx(in.uv);
+  let dv = dpdy(in.uv);
+  let size = vec2f(textureDimensions(externalPicture));
+  let n = tapCount(du * size, dv * size);
+  var sum = vec3f(0.0);
+  for (var j = 0; j < n; j++) {
+    for (var i = 0; i < n; i++) {
+      let o = tapOffset(i, j, n);
+      let uv = in.uv + du * o.x + dv * o.y;
+      sum += textureSampleBaseClampToEdge(externalPicture, pictureSampler, uv).rgb;
+    }
+  }
+  return toneMap(sum / f32(n * n));
+}
+
+@group(1) @binding(0) var copiedPicture: texture_2d<f32>;
+
+@fragment
+fn fragmentCopied(in: VertexOut) -> @location(0) vec4f {
+  // Derivatives first, while control flow is still uniform.
+  let du = dpdx(in.uv);
+  let dv = dpdy(in.uv);
+  let size = vec2f(textureDimensions(copiedPicture));
+  let n = tapCount(du * size, dv * size);
+  var sum = vec3f(0.0);
+  for (var j = 0; j < n; j++) {
+    for (var i = 0; i < n; i++) {
+      let o = tapOffset(i, j, n);
+      let uv = in.uv + du * o.x + dv * o.y;
+      sum += textureSampleLevel(copiedPicture, pictureSampler, uv, 0.0).rgb;
+    }
+  }
+  return toneMap(sum / f32(n * n));
+}
+
+@group(1) @binding(0) var lumaPlane: texture_2d<u32>;
+@group(1) @binding(1) var cbPlane: texture_2d<u32>;
+@group(1) @binding(2) var crPlane: texture_2d<u32>;
+
+// Integer textures cannot be filtered by a sampler, so filter by hand. q is
+// in texels with texel centres at integers.
+fn bilinear(plane: texture_2d<u32>, q: vec2f, size: vec2f) -> f32 {
+  let base = floor(q);
+  let fraction = q - base;
+  let maxIndex = vec2i(size) - 1;
+  let p00 = clamp(vec2i(base), vec2i(0), maxIndex);
+  let p11 = clamp(vec2i(base) + 1, vec2i(0), maxIndex);
+  let a = f32(textureLoad(plane, vec2i(p00.x, p00.y), 0).r);
+  let b = f32(textureLoad(plane, vec2i(p11.x, p00.y), 0).r);
+  let c = f32(textureLoad(plane, vec2i(p00.x, p11.y), 0).r);
+  let d = f32(textureLoad(plane, vec2i(p11.x, p11.y), 0).r);
+  return mix(mix(a, b, fraction.x), mix(c, d, fraction.x), fraction.y);
+}
+
+// The chroma texel under a point of the picture: chroma sample k sits at luma
+// pixel k * subsampling + origin, so this holds for any picture size.
+fn chromaTexel(uv: vec2f) -> vec2f {
+  return (uv * params.sizes.xy - 0.5 - params.chroma.xy) / params.chroma.zw;
+}
+
+@fragment
+fn fragmentPlanes(in: VertexOut) -> @location(0) vec4f {
+  // Derivatives first, while control flow is still uniform.
+  let du = dpdx(in.uv);
+  let dv = dpdy(in.uv);
+  let lumaSize = params.sizes.xy;
+  let chromaSize = params.sizes.zw;
+
+  let nl = tapCount(du * lumaSize, dv * lumaSize);
+  var y = 0.0;
+  for (var j = 0; j < nl; j++) {
+    for (var i = 0; i < nl; i++) {
+      let o = tapOffset(i, j, nl);
+      y += bilinear(lumaPlane, (in.uv + du * o.x + dv * o.y) * lumaSize - 0.5, lumaSize);
+    }
+  }
+  y /= f32(nl * nl);
+
+  let chromaScale = lumaSize / params.chroma.zw;
+  let nc = tapCount(du * chromaScale, dv * chromaScale);
+  var cbcr = vec2f(0.0);
+  for (var j = 0; j < nc; j++) {
+    for (var i = 0; i < nc; i++) {
+      let o = tapOffset(i, j, nc);
+      let q = chromaTexel(in.uv + du * o.x + dv * o.y);
+      cbcr += vec2f(bilinear(cbPlane, q, chromaSize), bilinear(crPlane, q, chromaSize));
+    }
+  }
+  cbcr /= f32(nc * nc);
+
+  let scale = exp2(f32(params.mode.y) - 8.0);
+  let luma = (y / scale - 16.0) / 219.0;
+  let blue = (cbcr.x / scale - 128.0) / 224.0;
+  let red = (cbcr.y / scale - 128.0) / 224.0;
+  let encoded = vec3f(
+    luma + params.yuv.x * red,
+    luma - params.yuv.y * blue - params.yuv.z * red,
+    luma + params.yuv.w * blue,
+  );
+  return toneMap(encoded);
+}
+`;
diff --git a/web/src/player/engine/hevc.test.ts b/web/src/player/engine/hevc.test.ts
new file mode 100644
index 0000000000..372c537ff6
--- /dev/null
+++ b/web/src/player/engine/hevc.test.ts
@@ -0,0 +1,37 @@
+import { describe, expect, it } from "vitest";
+import { hevcLengthSize, stripDolbyVisionNalUnits } from "./hevc";
+
+/** One 4-byte length-prefixed NAL unit with the given type and layer id. */
+function nal(type: number, layer = 0, payload = [0xaa, 0xbb]): number[] {
+  const header = [(type << 1) | (layer >> 5), ((layer & 0x1f) << 3) | 1];
+  const body = [...header, ...payload];
+  return [0, 0, 0, body.length, ...body];
+}
+
+describe("stripDolbyVisionNalUnits", () => {
+  it("removes RPU, wrapped enhancement-layer and layer>0 units", () => {
+    const vps = nal(32);
+    const slice = nal(1);
+    const input = new Uint8Array([...vps, ...nal(62), ...slice, ...nal(63), ...nal(1, 1)]);
+    expect(Array.from(stripDolbyVisionNalUnits(input, 4))).toEqual([...vps, ...slice]);
+  });
+
+  it("returns the same buffer when there is nothing to remove", () => {
+    const input = new Uint8Array([...nal(19), ...nal(1)]);
+    expect(stripDolbyVisionNalUnits(input, 4)).toBe(input);
+  });
+
+  it("leaves data that does not parse as length-prefixed units untouched", () => {
+    const input = new Uint8Array([0, 0, 1, 0x40, 0x01]);
+    expect(stripDolbyVisionNalUnits(input, 4)).toBe(input);
+  });
+});
+
+describe("hevcLengthSize", () => {
+  it("reads lengthSizeMinusOne from an hvcC record", () => {
+    const record = new Uint8Array(23);
+    record[21] = 0xf3;
+    expect(hevcLengthSize(record)).toBe(4);
+    expect(hevcLengthSize(new Uint8Array(4))).toBeNull();
+  });
+});
diff --git a/web/src/player/engine/hevc.ts b/web/src/player/engine/hevc.ts
new file mode 100644
index 0000000000..0c65b76dd4
--- /dev/null
+++ b/web/src/player/engine/hevc.ts
@@ -0,0 +1,57 @@
+/**
+ * HEVC helpers for presenting a Dolby Vision stream through its base layer.
+ *
+ * A Dolby Vision HEVC track interleaves base-layer NAL units with the RPU
+ * (NAL type 62) and, for Profile 7 in one track, the enhancement layer wrapped
+ * in NAL type 63 or carried with `nuh_layer_id > 0`. An ordinary decoder is
+ * only guaranteed to ignore none of these, so they are removed before decode.
+ */
+
+const NAL_UNSPEC62_RPU = 62;
+const NAL_UNSPEC63_ENHANCEMENT = 63;
+
+/**
+ * NAL length-field size from an `hvcC` record (byte 21, low two bits plus
+ * one), or null when the record is too short to hold it.
+ */
+export function hevcLengthSize(hvcC: Uint8Array | null | undefined): number | null {
+  if (!hvcC || hvcC.byteLength < 23) return null;
+  return (hvcC[21]! & 0x03) + 1;
+}
+
+/**
+ * Removes Dolby Vision RPU and enhancement-layer NAL units from one
+ * length-prefixed access unit. Returns the input unchanged when it holds none,
+ * and the input as-is when it does not parse as length-prefixed NAL units.
+ */
+export function stripDolbyVisionNalUnits(data: Uint8Array, lengthSize: number): Uint8Array {
+  const keep: Array<[number, number]> = [];
+  let kept = 0;
+  let removed = false;
+  let offset = 0;
+  while (offset < data.byteLength) {
+    if (offset + lengthSize > data.byteLength) return data;
+    let length = 0;
+    for (let i = 0; i < lengthSize; i++) length = length * 256 + data[offset + i]!;
+    const start = offset + lengthSize;
+    const end = start + length;
+    if (length < 2 || end > data.byteLength) return data;
+    const type = (data[start]! >> 1) & 0x3f;
+    const layer = ((data[start]! & 0x01) << 5) | (data[start + 1]! >> 3);
+    if (type === NAL_UNSPEC62_RPU || type === NAL_UNSPEC63_ENHANCEMENT || layer > 0) {
+      removed = true;
+    } else {
+      keep.push([offset, end]);
+      kept += end - offset;
+    }
+    offset = end;
+  }
+  if (!removed) return data;
+  const out = new Uint8Array(kept);
+  let cursor = 0;
+  for (const [start, end] of keep) {
+    out.set(data.subarray(start, end), cursor);
+    cursor += end - start;
+  }
+  return out;
+}
diff --git a/web/src/player/engine/index.ts b/web/src/player/engine/index.ts
new file mode 100644
index 0000000000..7c22493a2f
--- /dev/null
+++ b/web/src/player/engine/index.ts
@@ -0,0 +1,52 @@
+/**
+ * Entry point of the browser decode engine chunk. The player imports this
+ * lazily, only for an `original_http` plan the browser's own player cannot
+ * take, so none of the engine (Mediabunny, the worker, WebAssembly) loads for
+ * ordinary playback.
+ */
+import type { FailureV3 } from "../protocol-v3";
+import { EnginePlayer } from "./EnginePlayer";
+import { attachEngineToElement } from "./facade";
+import type { EngineSourceSpec } from "./source";
+
+export interface BrowserEngineSession {
+  destroy(): void;
+}
+
+/**
+ * Plays `source` through `video`: the element keeps its place in the page and
+ * every listener, while the picture is drawn on a canvas the engine keeps
+ * inside `surface` (a box laid out under the element).
+ */
+export function attachBrowserEngine(options: {
+  video: HTMLVideoElement;
+  surface: HTMLElement;
+  source: EngineSourceSpec;
+  onFailure: (failure: FailureV3) => void;
+}): BrowserEngineSession {
+  const { video, surface, source, onFailure } = options;
+  const player = new EnginePlayer({
+    source,
+    surface,
+    element: video,
+    volume: video.volume,
+    muted: video.muted,
+    playbackRate: video.defaultPlaybackRate,
+    onFailure,
+  });
+  const detach = attachEngineToElement(video, player);
+  try {
+    player.load();
+  } catch (error) {
+    // Never leave the overrides on the element the fallback plan will use.
+    detach();
+    player.destroy();
+    throw error;
+  }
+  return {
+    destroy() {
+      detach();
+      player.destroy();
+    },
+  };
+}
diff --git a/web/src/player/engine/pictureColor.test.ts b/web/src/player/engine/pictureColor.test.ts
new file mode 100644
index 0000000000..3a46915ced
--- /dev/null
+++ b/web/src/player/engine/pictureColor.test.ts
@@ -0,0 +1,52 @@
+import { describe, expect, it } from "vitest";
+import { chromaSitingOf, pictureColorOf } from "./pictureColor";
+
+describe("chromaSitingOf", () => {
+  it("reads AV1's signalled chroma sample position", () => {
+    // av01.P.LLT.DD.M.XYP: the third digit of the subsampling field.
+    expect(chromaSitingOf("av01.0.08M.10.0.111.09.16.09.0")).toBe("left");
+    expect(chromaSitingOf("av01.0.08M.10.0.112.09.16.09.0")).toBe("top-left");
+  });
+
+  it("keeps the centre for an AV1 stream that leaves the position unknown", () => {
+    expect(chromaSitingOf("av01.0.08M.10.0.110.09.16.09.0")).toBe("center");
+    // A short codec string carries no subsampling field at all.
+    expect(chromaSitingOf("av01.0.08M.10")).toBe("center");
+  });
+
+  it("uses type 0 for H.264 and HEVC, the position of an unsignalled stream", () => {
+    expect(chromaSitingOf("hvc1.2.4.L153.B0")).toBe("left");
+    expect(chromaSitingOf("hev1.2.4.L153.B0")).toBe("left");
+    expect(chromaSitingOf("avc1.640028")).toBe("left");
+  });
+
+  it("keeps the centre for VP9, which signals no siting", () => {
+    // Mediabunny fills the subsampling field with a default, so it says nothing.
+    expect(chromaSitingOf("vp09.02.40.10.01.09.16.09.00")).toBe("center");
+  });
+});
+
+describe("pictureColorOf", () => {
+  it("takes the stream's primaries and matrix", () => {
+    expect(
+      pictureColorOf({
+        codec: "vp09.02.40.10",
+        colorSpace: { primaries: "bt709", transfer: "hlg" as never, matrix: "bt709" },
+      }),
+    ).toEqual({ primaries: "bt709", matrix: "bt709", chromaSiting: "center" });
+    expect(
+      pictureColorOf({
+        codec: "hvc1.2.4.L153.B0",
+        colorSpace: { primaries: "smpte432" as never, matrix: "bt2020-ncl" as never },
+      }),
+    ).toEqual({ primaries: "p3", matrix: "bt2020", chromaSiting: "left" });
+  });
+
+  it("assumes BT.2020 when the stream does not say", () => {
+    expect(pictureColorOf({ codec: "av01.0.08M.10" })).toEqual({
+      primaries: "bt2020",
+      matrix: "bt2020",
+      chromaSiting: "center",
+    });
+  });
+});
diff --git a/web/src/player/engine/pictureColor.ts b/web/src/player/engine/pictureColor.ts
new file mode 100644
index 0000000000..704b67198e
--- /dev/null
+++ b/web/src/player/engine/pictureColor.ts
@@ -0,0 +1,96 @@
+/**
+ * How the engine's HDR presenter interprets decoded samples, resolved in the
+ * worker from the stream's own decoder configuration before the worker
+ * re-tags it (see engine.worker.ts).
+ */
+
+/** Primaries the source's R'G'B' is expressed in. */
+export type SourcePrimaries = "bt2020" | "bt709" | "p3";
+
+/** Y'CbCr to R'G'B' matrix of the source's samples. */
+export type SourceMatrix = "bt2020" | "bt709";
+
+/**
+ * Where the first chroma sample sits relative to the luma grid:
+ * `center` between four luma samples, `left` horizontally co-sited and
+ * vertically between two rows (H.264/HEVC chroma_sample_loc_type 0), and
+ * `top-left` co-sited with the first luma sample (type 2).
+ */
+export type ChromaSiting = "center" | "left" | "top-left";
+
+export interface PictureColor {
+  primaries: SourcePrimaries;
+  matrix: SourceMatrix;
+  chromaSiting: ChromaSiting;
+}
+
+/**
+ * The tag the worker gives HDR frames so that importing one into WebGPU
+ * applies only the Y'CbCr matrix and leaves the PQ/HLG codes for the shader.
+ */
+export const IMPORT_COLOR_TAG = { primaries: "bt709", transfer: "iec61966-2-1" } as const;
+
+/** What the presenter assumed before the stream's own description was read. */
+export const DEFAULT_PICTURE_COLOR: PictureColor = {
+  primaries: "bt2020",
+  matrix: "bt2020",
+  chromaSiting: "center",
+};
+
+function primariesOf(value: string | null | undefined): SourcePrimaries {
+  switch (value) {
+    case "bt709":
+      return "bt709";
+    case "smpte432":
+      return "p3";
+    default:
+      // Anything else, said or not, is read as BT.2020, the gamut of HDR.
+      return "bt2020";
+  }
+}
+
+function matrixOf(value: string | null | undefined): SourceMatrix {
+  return value === "bt709" ? "bt709" : "bt2020";
+}
+
+/**
+ * Chroma siting the codec itself signals or defines. Only AV1 carries it in
+ * the configuration the engine sees: `chroma_sample_position` is the last
+ * digit of the codec string's subsampling field (`av01.P.LLT.DD.M.XYP`).
+ * H.264 and HEVC define type 0 as the position of an unsignalled stream; an
+ * explicit VUI value is not read. VP9 has no siting at all, and an AV1
+ * stream that leaves it unknown says nothing either, so both stay centred.
+ */
+export function chromaSitingOf(codec: string): ChromaSiting {
+  const parts = codec.split(".");
+  switch (parts[0]) {
+    case "av01": {
+      const position = parts[5]?.[2];
+      if (position === "1") return "left";
+      if (position === "2") return "top-left";
+      return "center";
+    }
+    case "avc1":
+    case "avc3":
+    case "hvc1":
+    case "hev1":
+      return "left";
+    default:
+      return "center";
+  }
+}
+
+/** The presenter's view of a stream, from its decoder configuration. */
+export function pictureColorOf(
+  config: Pick<VideoDecoderConfig, "codec" | "colorSpace">,
+): PictureColor {
+  // TypeScript's DOM types predate several of these colour values.
+  const colorSpace = config.colorSpace as
+    | { primaries?: string | null; matrix?: string | null }
+    | undefined;
+  return {
+    primaries: primariesOf(colorSpace?.primaries),
+    matrix: matrixOf(colorSpace?.matrix),
+    chromaSiting: chromaSitingOf(config.codec),
+  };
+}
diff --git a/web/src/player/engine/protocol.ts b/web/src/player/engine/protocol.ts
new file mode 100644
index 0000000000..da87abe5d3
--- /dev/null
+++ b/web/src/player/engine/protocol.ts
@@ -0,0 +1,129 @@
+import type { PictureColor } from "./pictureColor";
+import type { EngineSourceSpec } from "./source";
+
+/**
+ * Classification of a read that failed after retries. Once the stream has
+ * played it means the connection went away, not that the route cannot work.
+ */
+export const ENGINE_READ_FAILED = "browser_engine_read_failed";
+
+/**
+ * The video decoder reported an error. A hardware decoder also fails this way
+ * when the GPU process restarts under it, so the page retries a new decode run
+ * before treating it as final.
+ */
+export const ENGINE_VIDEO_DECODE_FAILED = "browser_engine_video_decode_failed";
+
+/**
+ * Messages between the page, the engine worker, and the audio worklet.
+ *
+ * Every decode run carries a generation. A seek starts a new one; anything
+ * stamped with an older generation is stale and dropped wherever it lands, so
+ * no ordering is needed between the three message channels.
+ */
+
+export interface EngineMediaInfo {
+  /** Seconds; the container's own figure, used when the plan has none. */
+  durationSeconds: number;
+  video: {
+    codedWidth: number;
+    codedHeight: number;
+    displayWidth: number;
+    displayHeight: number;
+    /** Clockwise turn, in degrees, that puts decoded pictures upright. */
+    rotation: 0 | 90 | 180 | 270;
+    /** Mirror the turned picture horizontally. */
+    flip: boolean;
+    /** How the HDR presenter reads the stream's samples. */
+    color: PictureColor;
+  };
+  audio: { sampleRate: number; channels: number } | null;
+}
+
+/** Planar YUV copied out of a decoded frame for exact high-bit-depth presentation. */
+export interface EnginePlaneFrame {
+  timestamp: number;
+  duration: number;
+  /** Bits per sample: 8, 10 or 12. */
+  bitDepth: number;
+  width: number;
+  height: number;
+  chromaWidth: number;
+  chromaHeight: number;
+  /** Y, U and V, each tightly packed rows of 1 (8-bit) or 2 (10/12-bit) bytes per sample. */
+  buffer: ArrayBuffer;
+  offsets: [number, number, number];
+  strides: [number, number, number];
+}
+
+export type PageToWorkerMessage =
+  | { type: "open"; source: EngineSourceSpec }
+  | {
+      type: "audio-output";
+      port: MessagePort;
+      channels: number;
+      sampleRate: number;
+    }
+  | { type: "start"; generation: number; position: number }
+  | { type: "frame-released"; generation: number }
+  | { type: "planes-released"; buffer: ArrayBuffer }
+  | { type: "close" };
+
+export type WorkerToPageMessage =
+  | { type: "ready"; info: EngineMediaInfo }
+  | { type: "frame"; generation: number; frame: VideoFrame }
+  | { type: "planes"; generation: number; planes: EnginePlaneFrame }
+  | { type: "video-ended"; generation: number }
+  | { type: "audio-ended"; generation: number }
+  /**
+   * Enough audio for this generation has been sent to the worklet to start.
+   * Readiness waits on this rather than on the worklet, which does not run
+   * while the AudioContext is suspended for lack of a user gesture.
+   */
+  | { type: "audio-buffered"; generation: number }
+  | {
+      type: "error";
+      generation: number | null;
+      classification: string;
+      message: string;
+    };
+
+export type WorkerToWorkletMessage =
+  /** Interleaved samples at the output rate and channel count. */
+  | { type: "pcm"; generation: number; timestamp: number; samples: Float32Array }
+  | { type: "end"; generation: number };
+
+export type WorkletToWorkerMessage = {
+  type: "consumed";
+  generation: number;
+  /** Seconds of this generation's audio rendered so far. */
+  consumedSeconds: number;
+};
+
+export type PageToWorkletMessage =
+  | { type: "connect"; port: MessagePort }
+  /** A new decode run, starting at `position` on the media timeline. */
+  | { type: "generation"; generation: number; position: number }
+  | { type: "playing"; playing: boolean }
+  | { type: "rate"; rate: number };
+
+export type WorkletToPageMessage =
+  | {
+      type: "clock";
+      generation: number;
+      /** Context time at which the first sample of `mediaTime` was rendered. */
+      contextTime: number;
+      mediaTime: number;
+      /** False when the worklet output silence for this quantum. */
+      advancing: boolean;
+      /** Media seconds the worklet plays per second from this anchor on. */
+      rate: number;
+    }
+  | {
+      type: "underrun";
+      generation: number;
+      /** Context time at which output ran dry, and the media time reached. */
+      contextTime: number;
+      mediaTime: number | null;
+    }
+  | { type: "drained"; generation: number };
diff --git a/web/src/player/engine/renderers.test.ts b/web/src/player/engine/renderers.test.ts
new file mode 100644
index 0000000000..336a9091a4
--- /dev/null
+++ b/web/src/player/engine/renderers.test.ts
@@ -0,0 +1,878 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { DEFAULT_PICTURE_COLOR } from "./pictureColor";
+import type { EnginePlaneFrame } from "./protocol";
+import {
+  Canvas2DRenderer,
+  canvasMapsHDR,
+  DEVICE_RECOVERY_TIMEOUT_MS,
+  FRAME_CHECK_RETRY_FRAMES,
+  HDRPresenter,
+  MAX_DEVICE_RECOVERIES,
+  probePresenter,
+  resetPresenterStateForTests,
+  routePicture,
+  WebGPURenderer,
+  type EnginePicture,
+  type PresenterEvents,
+  type Viewport,
+} from "./renderers";
+
+const viewport: Viewport = { fit: "contain", devicePixels: null };
+const size = { width: 1920, height: 1080, rotation: 0 as const, flip: false };
+
+const frame = (
+  colorSpace: { transfer?: string | null; primaries?: string | null },
+  displayWidth = 1920,
+  displayHeight = 1080,
+) =>
+  ({
+    kind: "frame",
+    frame: {
+      colorSpace,
+      displayWidth,
+      displayHeight,
+      close: vi.fn(),
+    } as unknown as VideoFrame,
+    timestamp: 0,
+    duration: 0,
+  }) satisfies EnginePicture;
+
+const RETAGGED = { transfer: "iec61966-2-1", primaries: "bt709" };
+const HARDWARE_PQ = { transfer: "pq", primaries: "bt2020" };
+
+function planes(width = 4, height = 4, chromaWidth = 2, chromaHeight = 2): EnginePicture {
+  const plane: EnginePlaneFrame = {
+    timestamp: 0,
+    duration: 0,
+    bitDepth: 10,
+    width,
+    height,
+    chromaWidth,
+    chromaHeight,
+    buffer: new ArrayBuffer(64),
+    offsets: [0, 32, 48],
+    strides: [width * 2, chromaWidth * 2, chromaWidth * 2],
+  };
+  return { kind: "planes", planes: plane, timestamp: 0, duration: 0 };
+}
+
+// -- A WebGPU stand-in --------------------------------------------------------
+
+class FakeDevice {
+  readonly lost: Promise<GPUDeviceLostInfo>;
+  private resolveLost!: (info: GPUDeviceLostInfo) => void;
+  /** Explicit `lost.then` subscriptions, to check nothing piles up on the device. */
+  lostSubscriptions = 0;
+  destroyed = false;
+  /** Results popErrorScope hands out, in order; null when it runs out. */
+  scopeErrors: Array<{ message: string } | null> = [];
+  /** When set, popErrorScope answers with this instead, as a slow driver would. */
+  pendingPop: Promise<{ message: string } | null> | null = null;
+  pipelineFailure: Error | null = null;
+  compilerMessages: Array<{ type: string; message: string; lineNum: number }> = [];
+  readonly limits = { maxTextureDimension2D: 8192 };
+  readonly uniforms: Float32Array[] = [];
+  /** What successive read-back buffers hold: the frame check reads the import, then the copy. */
+  readbacks: Uint8Array[] = [];
+  /** Set to make copying a VideoFrame throw, as Firefox does. */
+  copyUnsupported = false;
+  readonly queue = {
+    writeBuffer: vi.fn((_buffer: unknown, _offset: number, data: ArrayBuffer) =>
+      this.uniforms.push(new Float32Array(data.slice(0))),
+    ),
+    writeTexture: vi.fn(),
+    copyExternalImageToTexture: vi.fn(() => {
+      if (this.copyUnsupported) throw new TypeError("'source' could not be converted");
+    }),
+    submit: vi.fn(),
+    onSubmittedWorkDone: async () => {},
+  };
+  readonly importExternalTexture = vi.fn(() => ({}));
+  readonly listeners = new Set<(event: Event) => void>();
+
+  constructor() {
+    const lost = new Promise<GPUDeviceLostInfo>((resolve) => (this.resolveLost = resolve));
+    const then = lost.then.bind(lost);
+    lost.then = ((...args: Parameters<typeof then>) => {
+      this.lostSubscriptions += 1;
+      return then(...args);
+    }) as typeof lost.then;
+    this.lost = lost;
+  }
+
+  createShaderModule() {
+    return { getCompilationInfo: async () => ({ messages: this.compilerMessages }) };
+  }
+  createBindGroupLayout() {
+    return {};
+  }
+  createPipelineLayout() {
+    return {};
+  }
+  createRenderPipelineAsync() {
+    return this.pipelineFailure ? Promise.reject(this.pipelineFailure) : Promise.resolve({});
+  }
+  pushErrorScope() {}
+  popErrorScope() {
+    return this.pendingPop ?? Promise.resolve(this.scopeErrors.shift() ?? null);
+  }
+  createBuffer({ usage }: { usage: number }) {
+    const readable = (usage & GPUBufferUsage.MAP_READ) !== 0;
+    const contents = (readable && this.readbacks.shift()) || new Uint8Array(256 * 8);
+    return {
+      destroy: vi.fn(),
+      mapAsync: async () => {},
+      getMappedRange: () => contents.buffer,
+    };
+  }
+  createSampler() {
+    return {};
+  }
+  createBindGroup() {
+    return {};
+  }
+  /** Every texture made, to check that frame copies are let go. */
+  readonly textures: Array<{ format: string; destroy: ReturnType<typeof vi.fn> }> = [];
+  createTexture({ size, format }: { size: [number, number]; format: string }) {
+    const texture = {
+      width: size[0],
+      height: size[1],
+      format,
+      createView: () => ({}),
+      destroy: vi.fn(),
+    };
+    this.textures.push(texture);
+    return texture;
+  }
+  /** Whether every texture a frame was copied into has been let go. */
+  copiesReleased() {
+    return this.textures
+      .filter((texture) => texture.format === "rgba16float")
+      .every((texture) => texture.destroy.mock.calls.length > 0);
+  }
+  createCommandEncoder() {
+    return {
+      beginRenderPass: () => ({ setPipeline() {}, setBindGroup() {}, draw() {}, end() {} }),
+      copyTextureToBuffer() {},
+      finish: () => ({}),
+    };
+  }
+  addEventListener(_type: string, listener: (event: Event) => void) {
+    this.listeners.add(listener);
+  }
+  removeEventListener(_type: string, listener: (event: Event) => void) {
+    this.listeners.delete(listener);
+  }
+  emitUncapturedError(message: string) {
+    for (const listener of this.listeners) listener({ error: { message } } as unknown as Event);
+  }
+  lose(message = "The GPU process went away.") {
+    this.resolveLost({ reason: "unknown", message } as GPUDeviceLostInfo);
+  }
+  destroy() {
+    this.destroyed = true;
+    this.resolveLost({ reason: "destroyed", message: "" } as GPUDeviceLostInfo);
+  }
+}
+
+/** A read-back check picture with detail in it (a gradient), as a real frame gives. */
+const detailed = () => Uint8Array.from({ length: 256 * 8 }, (_, index) => (index * 7) % 256);
+/** Lets the frame check's read-backs and comparison finish. */
+const settle = () => new Promise((resolve) => setTimeout(resolve, 0));
+
+/** How many times a frame reached `device`, imported or copied. */
+const framesSent = (device: FakeDevice) =>
+  device.importExternalTexture.mock.calls.length +
+  device.queue.copyExternalImageToTexture.mock.calls.length;
+
+let devices: Array<FakeDevice | Promise<FakeDevice>>;
+let adapter: { info: { isFallbackAdapter: boolean }; requestDevice: ReturnType<typeof vi.fn> };
+let gpuContexts: Array<{
+  configure: ReturnType<typeof vi.fn>;
+  unconfigure: ReturnType<typeof vi.fn>;
+}>;
+let context2d: { drawImage: ReturnType<typeof vi.fn> } & Record<string, unknown>;
+/** What a canvas draws (green, 0-255) for a grey frame of this code with this transfer tag. */
+let canvasModel: (transfer: string, code: number) => number;
+
+const raw = (code: number) => Math.round(code * 255);
+
+/**
+ * Measured with 16x16 grey frames in Chrome 155 and Safari 26 (WebKit), which
+ * tone-map, and Firefox 157, which draws the raw codes for every tag.
+ */
+const MEASURED: Record<string, Record<string, number>> = {
+  pq: { "0.3": 44, "0.58": 187, "0.75": 254 },
+  hlg: { "0.3": 54, "0.75": 187, "0.9": 233 },
+};
+const chromiumCanvas = (transfer: string, code: number) =>
+  MEASURED[transfer]?.[String(Math.round(code * 100) / 100)] ?? raw(code);
+
+class FakeVideoFrame {
+  readonly colorSpace: VideoColorSpaceInit;
+  readonly code: number;
+  readonly displayWidth: number;
+  readonly displayHeight: number;
+  constructor(
+    data: Uint8Array,
+    init: { colorSpace: VideoColorSpaceInit; codedWidth: number; codedHeight: number },
+  ) {
+    this.colorSpace = init.colorSpace;
+    this.code = (data[0]! - 16) / 219;
+    this.displayWidth = init.codedWidth;
+    this.displayHeight = init.codedHeight;
+  }
+  close() {}
+}
+
+beforeEach(() => {
+  devices = [];
+  adapter = {
+    info: { isFallbackAdapter: false },
+    requestDevice: vi.fn(async () => {
+      const next = devices.shift();
+      if (!next) throw new Error("no device");
+      return next;
+    }),
+  };
+  vi.stubGlobal("navigator", {
+    ...navigator,
+    gpu: {
+      requestAdapter: vi.fn(async () => adapter),
+      getPreferredCanvasFormat: () => "bgra8unorm",
+    },
+  });
+  vi.stubGlobal("GPUShaderStage", { VERTEX: 1, FRAGMENT: 2 });
+  vi.stubGlobal("GPUBufferUsage", { UNIFORM: 64, COPY_DST: 8, MAP_READ: 1 });
+  vi.stubGlobal("GPUMapMode", { READ: 1 });
+  vi.stubGlobal("GPUTextureUsage", {
+    COPY_SRC: 1,
+    COPY_DST: 2,
+    TEXTURE_BINDING: 4,
+    RENDER_ATTACHMENT: 16,
+  });
+  vi.stubGlobal("VideoFrame", FakeVideoFrame);
+  vi.stubGlobal("devicePixelRatio", 1);
+  gpuContexts = [];
+  canvasModel = (_transfer, code) => raw(code);
+  let drawn: FakeVideoFrame | null = null;
+  context2d = {
+    fillRect: vi.fn(),
+    clearRect: vi.fn(),
+    translate: vi.fn(),
+    scale: vi.fn(),
+    rotate: vi.fn(),
+    resetTransform: vi.fn(),
+    drawImage: vi.fn((source: FakeVideoFrame) => (drawn = source)),
+    getImageData: () => ({
+      data: [0, drawn ? canvasModel(String(drawn.colorSpace.transfer), drawn.code) : 0, 0, 255],
+    }),
+  };
+  vi.spyOn(HTMLCanvasElement.prototype, "getContext").mockImplementation(function (
+    this: HTMLCanvasElement,
+    type: string,
+  ) {
+    if (type === "2d") return context2d as never;
+    const context = {
+      configure: vi.fn(),
+      unconfigure: vi.fn(),
+      getCurrentTexture: () => ({ createView: () => ({}) }),
+    };
+    gpuContexts.push(context);
+    return context as never;
+  });
+});
+
+afterEach(() => {
+  resetPresenterStateForTests();
+  vi.useRealTimers();
+  vi.unstubAllGlobals();
+  vi.restoreAllMocks();
+});
+
+function events() {
+  return {
+    onFailure: vi.fn<PresenterEvents["onFailure"]>(),
+    onRestored: vi.fn<PresenterEvents["onRestored"]>(),
+  };
+}
+
+async function renderer(on = events()) {
+  const canvas = document.createElement("canvas");
+  document.body.appendChild(canvas);
+  const gpu = await WebGPURenderer.create(canvas, "pq", DEFAULT_PICTURE_COLOR, on);
+  return { gpu, on, canvas };
+}
+
+// -- Tests -------------------------------------------------------------------
+
+describe("routePicture", () => {
+  it("sends each picture to the path its kind and tag call for", () => {
+    expect(routePicture(planes())).toBe("planes");
+    expect(routePicture(frame(RETAGGED))).toBe("frame");
+    // Untagged primaries import as BT.709 as well.
+    expect(routePicture(frame({ transfer: "iec61966-2-1", primaries: null }))).toBe("frame");
+    // Hardware decoders keep the stream's own tag; only the browser can map it.
+    expect(routePicture(frame(HARDWARE_PQ))).toBe("browser");
+    expect(routePicture(frame({ transfer: "hlg", primaries: "bt2020" }))).toBe("browser");
+  });
+
+  it("refuses frames whose codes it cannot interpret", () => {
+    expect(routePicture(frame({ transfer: null, primaries: null }))).toBe("unsupported");
+    expect(routePicture(frame({ transfer: "bt709", primaries: "bt709" }))).toBe("unsupported");
+    // An sRGB transfer with other primaries would be gamut-converted on import.
+    expect(routePicture(frame({ transfer: "iec61966-2-1", primaries: "bt2020" }))).toBe(
+      "unsupported",
+    );
+  });
+});
+
+describe("Canvas2DRenderer", () => {
+  it("turns and mirrors a rotated picture to fill its upright letterbox", () => {
+    const calls: unknown[][] = [];
+    const record =
+      (name: string) =>
+      (...args: unknown[]) =>
+        calls.push([name, ...args]);
+    Object.assign(context2d, {
+      translate: record("translate"),
+      scale: record("scale"),
+      rotate: record("rotate"),
+      drawImage: (_frame: unknown, ...args: unknown[]) => calls.push(["drawImage", ...args]),
+      resetTransform: record("resetTransform"),
+    });
+    const canvas = document.createElement("canvas");
+    Object.defineProperty(canvas, "clientWidth", { value: 1600 });
+    Object.defineProperty(canvas, "clientHeight", { value: 900 });
+
+    // A 1920x1080 phone recording stored landscape, shown portrait: 1080x1920.
+    new Canvas2DRenderer(canvas).draw(
+      { kind: "frame", frame: {} as VideoFrame, timestamp: 0, duration: 0 },
+      { width: 1080, height: 1920, rotation: 90, flip: true },
+      viewport,
+    );
+
+    // The portrait letterbox is 506.25x900 centered at (800, 450); the
+    // landscape picture is drawn 900x506.25 into it, turned a quarter.
+    expect(calls).toEqual([
+      ["translate", 800, 450],
+      ["scale", -1, 1],
+      ["rotate", Math.PI / 2],
+      ["drawImage", -450, -253.125, 900, 506.25],
+      ["resetTransform"],
+    ]);
+  });
+
+  it("sizes its canvas to the box's exact device pixels when the browser reports them", () => {
+    const canvas = document.createElement("canvas");
+    Object.defineProperty(canvas, "clientWidth", { value: 1302 });
+    Object.defineProperty(canvas, "clientHeight", { value: 774 });
+    vi.stubGlobal("devicePixelRatio", 1.25);
+    const renderer = new Canvas2DRenderer(canvas);
+    // Measured in Chrome at a 1.25 device pixel ratio.
+    renderer.draw(frame(RETAGGED), size, {
+      fit: "contain",
+      devicePixels: { width: 1627, height: 967 },
+    });
+    expect([canvas.width, canvas.height]).toEqual([1627, 967]);
+    // Without the exact figure it falls back to CSS pixels times the ratio.
+    renderer.draw(frame(RETAGGED), size, viewport);
+    expect([canvas.width, canvas.height]).toEqual([1628, 968]);
+  });
+
+  it("refuses uploaded planes instead of skipping them", () => {
+    const renderer = new Canvas2DRenderer(document.createElement("canvas"));
+    expect(() => renderer.draw(planes(), size, viewport)).toThrow(/planes/);
+  });
+
+  it("leaves no canvas behind when the 2D context is unavailable", () => {
+    vi.mocked(HTMLCanvasElement.prototype.getContext).mockReturnValue(null);
+    const surface = document.createElement("div");
+    expect(() => Canvas2DRenderer.in(surface)).toThrow(/unavailable/);
+    expect(surface.querySelector("canvas")).toBeNull();
+  });
+});
+
+describe("WebGPURenderer", () => {
+  it("turns a shader the browser rejects into an error naming the compiler's complaint", async () => {
+    const device = new FakeDevice();
+    device.pipelineFailure = new Error("Invalid RenderPipeline");
+    device.compilerMessages = [
+      { type: "error", message: "Capability TEXTURE_EXTERNAL is required", lineNum: 191 },
+    ];
+    devices.push(device);
+    await expect(renderer()).rejects.toThrow(/TEXTURE_EXTERNAL is required \(line 191\)/);
+    expect(device.destroyed).toBe(true);
+  });
+
+  it("asks for the default adapter and refuses a software one", async () => {
+    adapter.info.isFallbackAdapter = true;
+    await expect(renderer()).rejects.toThrow(/software/);
+    const requestAdapter = (navigator as Navigator & { gpu: GPU }).gpu.requestAdapter;
+    expect(requestAdapter).toHaveBeenCalledWith();
+  });
+
+  it("fails once when a draw's error scope reports a validation error", async () => {
+    const device = new FakeDevice();
+    devices.push(device);
+    const { gpu, on } = await renderer();
+    device.scopeErrors = [{ message: "Invalid BindGroup" }, { message: "again" }];
+    gpu.draw(frame(RETAGGED), size, viewport);
+    gpu.draw(frame(RETAGGED), size, viewport);
+    await vi.waitFor(() => expect(on.onFailure).toHaveBeenCalled());
+    expect(on.onFailure).toHaveBeenCalledTimes(1);
+    expect(on.onFailure.mock.calls[0]![0]).toMatch(/Invalid BindGroup/);
+  });
+
+  it("fails on an uncaptured device error too", async () => {
+    const device = new FakeDevice();
+    devices.push(device);
+    const { on } = await renderer();
+    device.emitUncapturedError("Out of memory");
+    expect(on.onFailure).toHaveBeenCalledTimes(1);
+  });
+
+  it("copies frames until a check shows the import matches the copy, then imports them", async () => {
+    const device = new FakeDevice();
+    device.readbacks = [detailed(), detailed()];
+    devices.push(device);
+    const { gpu, on } = await renderer();
+    gpu.draw(frame(RETAGGED), size, viewport);
+    // The first frame goes both ways into the check, then by copy to the screen.
+    expect(device.queue.copyExternalImageToTexture).toHaveBeenCalledTimes(2);
+    expect(device.importExternalTexture).toHaveBeenCalledTimes(1);
+    await settle();
+    gpu.draw(frame(RETAGGED), size, viewport);
+    expect(device.importExternalTexture).toHaveBeenCalledTimes(2);
+    expect(device.queue.copyExternalImageToTexture).toHaveBeenCalledTimes(2);
+    expect(device.copiesReleased()).toBe(true);
+    expect(on.onFailure).not.toHaveBeenCalled();
+  });
+
+  it("keeps copying frames where the import disagrees with the copy, as in WebKit", async () => {
+    const device = new FakeDevice();
+    // The import of a 10-bit frame comes out far off what the copy holds.
+    device.readbacks = [new Uint8Array(256 * 8).fill(200), detailed()];
+    devices.push(device);
+    const { gpu } = await renderer();
+    gpu.draw(frame(RETAGGED), size, viewport);
+    await settle();
+    gpu.draw(frame(RETAGGED), size, viewport);
+    expect(device.queue.copyExternalImageToTexture).toHaveBeenCalledTimes(3);
+    expect(device.importExternalTexture).toHaveBeenCalledTimes(1);
+    expect(device.copiesReleased()).toBe(false);
+  });
+
+  it("decides nothing on a black first frame, and checks a later one", async () => {
+    const device = new FakeDevice();
+    // A fade from black: both ways come out black even where the import is wrong.
+    const black = () => new Uint8Array(256 * 8);
+    device.readbacks = [black(), black(), detailed(), detailed()];
+    devices.push(device);
+    const { gpu } = await renderer();
+    gpu.draw(frame(RETAGGED), size, viewport);
+    await settle();
+    for (let index = 0; index < FRAME_CHECK_RETRY_FRAMES; index++) {
+      gpu.draw(frame(RETAGGED), size, viewport);
+    }
+    // Still copying, and the copy texture kept.
+    expect(device.importExternalTexture).toHaveBeenCalledTimes(1);
+    expect(device.copiesReleased()).toBe(false);
+    gpu.draw(frame(RETAGGED), size, viewport);
+    await settle();
+    gpu.draw(frame(RETAGGED), size, viewport);
+    // The second check saw detail and found the two agreeing.
+    expect(device.importExternalTexture).toHaveBeenCalledTimes(3);
+    expect(device.copiesReleased()).toBe(true);
+  });
+
+  it("imports a frame larger than a texture can be, and checks the frames that fit", async () => {
+    const device = new FakeDevice();
+    Object.assign(device.limits, { maxTextureDimension2D: 1024 });
+    device.readbacks = [detailed(), detailed()];
+    devices.push(device);
+    const { gpu, on } = await renderer();
+    expect(gpu.draw(frame(RETAGGED, 1920, 1080), size, viewport)).toBe(true);
+    // Imported, with nothing copied or settled.
+    expect(device.queue.copyExternalImageToTexture).not.toHaveBeenCalled();
+    expect(device.textures.some((texture) => texture.format === "rgba16float")).toBe(false);
+    expect(device.importExternalTexture).toHaveBeenCalledTimes(1);
+    // Frames that fit are copied until a later check finds the import right.
+    for (let index = 0; index <= FRAME_CHECK_RETRY_FRAMES; index++) {
+      gpu.draw(frame(RETAGGED, 960, 540), size, viewport);
+    }
+    expect(device.queue.copyExternalImageToTexture).toHaveBeenCalled();
+    await settle();
+    gpu.draw(frame(RETAGGED, 960, 540), size, viewport);
+    expect(device.copiesReleased()).toBe(true);
+    expect(on.onFailure).not.toHaveBeenCalled();
+  });
+
+  it("imports frames where the browser cannot copy them, as in Firefox", async () => {
+    const device = new FakeDevice();
+    device.copyUnsupported = true;
+    devices.push(device);
+    const { gpu, on } = await renderer();
+    expect(gpu.draw(frame(RETAGGED), size, viewport)).toBe(true);
+    gpu.draw(frame(RETAGGED), size, viewport);
+    // Tried once, then only imported.
+    expect(device.queue.copyExternalImageToTexture).toHaveBeenCalledTimes(1);
+    expect(device.importExternalTexture).toHaveBeenCalledTimes(3);
+    expect(device.copiesReleased()).toBe(true);
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    expect(on.onFailure).not.toHaveBeenCalled();
+  });
+
+  it("replaces a lost device with a fresh one and asks for the picture again", async () => {
+    const first = new FakeDevice();
+    const second = new FakeDevice();
+    devices.push(first, second);
+    const { gpu, on } = await renderer();
+    first.lose();
+    await vi.waitFor(() => expect(on.onRestored).toHaveBeenCalledTimes(1));
+    expect(on.onFailure).not.toHaveBeenCalled();
+    expect(gpuContexts[0]!.configure).toHaveBeenLastCalledWith(
+      expect.objectContaining({ device: second }),
+    );
+    expect(gpu.draw(frame(RETAGGED), size, viewport)).toBe(true);
+    expect(framesSent(second)).toBeGreaterThan(0);
+    expect(framesSent(first)).toBe(0);
+    // Whatever the old device still reports is no longer this renderer's business.
+    first.emitUncapturedError("late");
+    expect(on.onFailure).not.toHaveBeenCalled();
+  });
+
+  it("draws nothing while a lost device is being replaced", async () => {
+    const first = new FakeDevice();
+    let deliver!: (device: FakeDevice) => void;
+    devices.push(first, new Promise((resolve) => (deliver = resolve)));
+    const { gpu, on } = await renderer();
+    first.lose();
+    await vi.waitFor(() => expect(adapter.requestDevice).toHaveBeenCalledTimes(2));
+    expect(gpu.draw(frame(RETAGGED), size, viewport)).toBe(false);
+    deliver(new FakeDevice());
+    await vi.waitFor(() => expect(on.onRestored).toHaveBeenCalled());
+  });
+
+  it(`fails over once ${MAX_DEVICE_RECOVERIES} replacements have been lost as well`, async () => {
+    const lineup = Array.from({ length: MAX_DEVICE_RECOVERIES + 1 }, () => new FakeDevice());
+    devices.push(...lineup);
+    const { on } = await renderer();
+    for (const [index, device] of lineup.entries()) {
+      device.lose();
+      if (index < MAX_DEVICE_RECOVERIES) {
+        await vi.waitFor(() => expect(on.onRestored).toHaveBeenCalledTimes(index + 1));
+      }
+    }
+    await vi.waitFor(() => expect(on.onFailure).toHaveBeenCalledTimes(1));
+    expect(on.onRestored).toHaveBeenCalledTimes(MAX_DEVICE_RECOVERIES);
+  });
+
+  it("replaces a device that was lost before it reached the renderer", async () => {
+    // Lost while its presenter compiled: the loss arrives before anyone holds it.
+    const lostEarly = new FakeDevice();
+    lostEarly.lose();
+    const fresh = new FakeDevice();
+    devices.push(lostEarly, fresh);
+    const { gpu, on } = await renderer();
+    await vi.waitFor(() => expect(on.onRestored).toHaveBeenCalledTimes(1));
+    expect(gpuContexts[0]!.configure).toHaveBeenLastCalledWith(
+      expect.objectContaining({ device: fresh }),
+    );
+    expect(gpu.draw(frame(RETAGGED), size, viewport)).toBe(true);
+    expect(framesSent(fresh)).toBeGreaterThan(0);
+    expect(on.onFailure).not.toHaveBeenCalled();
+  });
+
+  it("counts a replacement that was lost before it was used against the budget", async () => {
+    const lineup = Array.from({ length: MAX_DEVICE_RECOVERIES + 1 }, () => new FakeDevice());
+    for (const device of lineup.slice(1)) device.lose();
+    devices.push(...lineup);
+    const { on } = await renderer();
+    lineup[0]!.lose();
+    await vi.waitFor(() => expect(on.onFailure).toHaveBeenCalledTimes(1));
+    expect(adapter.requestDevice).toHaveBeenCalledTimes(MAX_DEVICE_RECOVERIES + 1);
+    expect(on.onRestored).not.toHaveBeenCalled();
+  });
+
+  it("fails over when a new device is not ready in time, and keeps it for later when it comes", async () => {
+    vi.useFakeTimers();
+    const first = new FakeDevice();
+    const late = new FakeDevice();
+    let deliver!: (device: FakeDevice) => void;
+    devices.push(first, new Promise((resolve) => (deliver = resolve)));
+    const { on } = await renderer();
+    first.lose();
+    await vi.waitFor(() => expect(adapter.requestDevice).toHaveBeenCalledTimes(2));
+    await vi.advanceTimersByTimeAsync(DEVICE_RECOVERY_TIMEOUT_MS);
+    expect(on.onFailure).toHaveBeenCalledTimes(1);
+    expect(on.onFailure.mock.calls[0]![0]).toMatch(/not ready in time/);
+    deliver(late);
+    // Compiled and handed back rather than used here.
+    await vi.waitFor(() => expect(late.listeners.size).toBe(1));
+    expect(on.onRestored).not.toHaveBeenCalled();
+    // The device that came too late is sound: the next playback takes it.
+    await renderer();
+    expect(adapter.requestDevice).toHaveBeenCalledTimes(2);
+    expect(gpuContexts[1]!.configure).toHaveBeenCalledWith(
+      expect.objectContaining({ device: late }),
+    );
+  });
+
+  it("hands back a replacement that arrives after the renderer was destroyed or stopped", async () => {
+    for (const end of ["destroy", "stop"] as const) {
+      const first = new FakeDevice();
+      const late = new FakeDevice();
+      let deliver!: (device: FakeDevice) => void;
+      devices.push(first, new Promise((resolve) => (deliver = resolve)));
+      const { gpu, on } = await renderer();
+      first.lose();
+      await vi.waitFor(() => expect(adapter.requestDevice).toHaveBeenCalled());
+      gpu[end]();
+      deliver(late);
+      await vi.waitFor(() => expect(late.listeners.size).toBe(1));
+      // It goes to the next playback rather than to this one.
+      const next = await renderer();
+      expect(gpuContexts.at(-1)!.configure).toHaveBeenCalledWith(
+        expect.objectContaining({ device: late }),
+      );
+      expect(on.onRestored).not.toHaveBeenCalled();
+      expect(on.onFailure).not.toHaveBeenCalled();
+      expect(late.destroyed).toBe(false);
+      next.gpu.destroy();
+      gpu.destroy();
+      resetPresenterStateForTests();
+      adapter.requestDevice.mockClear();
+    }
+  });
+
+  it("hands a sound device to the next playback, but not one that reported an error", async () => {
+    const device = new FakeDevice();
+    devices.push(device);
+    const first = await renderer();
+    first.gpu.destroy();
+    expect(device.destroyed).toBe(false);
+    const second = await renderer();
+    expect(adapter.requestDevice).toHaveBeenCalledTimes(1);
+    expect(gpuContexts[1]!.configure).toHaveBeenCalledWith(expect.objectContaining({ device }));
+
+    device.emitUncapturedError("broken");
+    second.gpu.destroy();
+    expect(device.destroyed).toBe(true);
+  });
+
+  it("does not hand on a device whose error was reported after the engine stopped", async () => {
+    const device = new FakeDevice();
+    const fresh = new FakeDevice();
+    devices.push(device, fresh);
+    const { gpu, on } = await renderer();
+    let report!: (error: { message: string } | null) => void;
+    device.pendingPop = new Promise((resolve) => (report = resolve));
+    gpu.draw(frame(RETAGGED), size, viewport);
+    gpu.stop();
+    gpu.destroy();
+    report({ message: "Invalid BindGroup" });
+    await device.pendingPop;
+    // The next playback gets a fresh device instead.
+    await renderer();
+    expect(gpuContexts[1]!.configure).toHaveBeenCalledWith(
+      expect.objectContaining({ device: fresh }),
+    );
+    expect(device.destroyed).toBe(true);
+    expect(on.onFailure).not.toHaveBeenCalled();
+  });
+
+  it("subscribes to a shared device once, however many playbacks use it", async () => {
+    const device = new FakeDevice();
+    devices.push(device);
+    for (let playback = 0; playback < 3; playback++) (await renderer()).gpu.destroy();
+    expect(device.lostSubscriptions).toBe(1);
+    expect(device.listeners.size).toBe(1);
+  });
+
+  it("takes the probe's device as soon as it compiles, without waiting for its test draw", async () => {
+    const device = new FakeDevice();
+    let report!: (error: { message: string } | null) => void;
+    device.pendingPop = new Promise((resolve) => (report = resolve));
+    devices.push(device);
+    const probe = probePresenter(adapter as unknown as GPUAdapter);
+    const { gpu } = await renderer();
+    expect(adapter.requestDevice).toHaveBeenCalledTimes(1);
+    expect(gpuContexts[0]!.configure).toHaveBeenCalledWith(expect.objectContaining({ device }));
+    // The playback connected before the test draw's import, which can stall.
+    expect(gpuContexts[0]!.configure.mock.invocationCallOrder[0]).toBeLessThan(
+      device.importExternalTexture.mock.invocationCallOrder[0] ?? Infinity,
+    );
+    // The probe failing now does not pull the device from under the playback.
+    report({ message: "late" });
+    await expect(probe).resolves.toBe(false);
+    expect(device.destroyed).toBe(false);
+    // But it is not handed on afterwards.
+    gpu.destroy();
+    expect(device.destroyed).toBe(true);
+  });
+
+  it("withdraws the device of a probe that failed before any playback took it", async () => {
+    const tested = new FakeDevice();
+    // The compile's own scope comes first, then the test draw's.
+    tested.scopeErrors = [null, { message: "Invalid ExternalTexture" }];
+    const fresh = new FakeDevice();
+    devices.push(tested, fresh);
+    await expect(probePresenter(adapter as unknown as GPUAdapter)).resolves.toBe(false);
+    expect(tested.destroyed).toBe(true);
+    await renderer();
+    expect(gpuContexts[0]!.configure).toHaveBeenCalledWith(
+      expect.objectContaining({ device: fresh }),
+    );
+  });
+
+  it("answers the probe with no verdict when the device is lost or cannot be made", async () => {
+    await expect(probePresenter(adapter as unknown as GPUAdapter)).resolves.toBeNull();
+    const device = new FakeDevice();
+    let report!: (error: { message: string } | null) => void;
+    device.pendingPop = new Promise((resolve) => (report = resolve));
+    devices.push(device);
+    const probe = probePresenter(adapter as unknown as GPUAdapter);
+    await vi.waitFor(() => expect(adapter.requestDevice).toHaveBeenCalledTimes(2));
+    device.lose();
+    report(null);
+    await expect(probe).resolves.toBeNull();
+  });
+
+  it("encodes the source's gamut, matrix and chroma siting for the shader", async () => {
+    const device = new FakeDevice();
+    devices.push(device);
+    const canvas = document.createElement("canvas");
+    const gpu = await WebGPURenderer.create(
+      canvas,
+      "hlg",
+      { primaries: "bt709", matrix: "bt709", chromaSiting: "top-left" },
+      events(),
+    );
+    gpu.draw(planes(5, 3, 3, 2), size, viewport);
+    const params = device.uniforms[0]!;
+    // mode.x: HLG; mode.y: bit depth.
+    expect(new Uint32Array(params.buffer).slice(4, 6)).toEqual(new Uint32Array([2, 10]));
+    // sizes: luma and chroma.
+    expect([...params.slice(12, 16)]).toEqual([5, 3, 3, 2]);
+    // chroma: top-left 4:2:0 sits on the first luma sample.
+    expect([...params.slice(16, 20)]).toEqual([0, 0, 2, 2]);
+    // yuv: BT.709 coefficients; luma: BT.709 weights; gamut: identity.
+    expect(params[20]).toBeCloseTo(1.5748, 4);
+    expect(params[24]).toBeCloseTo(0.2126, 4);
+    expect([...params.slice(28, 31)]).toEqual([1, 0, 0]);
+    expect([...params.slice(32, 35)]).toEqual([0, 1, 0]);
+  });
+});
+
+describe("canvasMapsHDR", () => {
+  it("is true where the canvas tone-maps the transfer, as Chrome and Safari do", () => {
+    canvasModel = chromiumCanvas;
+    expect(canvasMapsHDR("pq")).toBe(true);
+    expect(canvasMapsHDR("hlg")).toBe(true);
+  });
+
+  it("is false where the canvas shows the raw codes, as Firefox's does", () => {
+    canvasModel = (_transfer, code) => raw(code);
+    expect(canvasMapsHDR("pq")).toBe(false);
+    expect(canvasMapsHDR("hlg")).toBe(false);
+  });
+
+  it("is false where the canvas converts PQ without tone mapping, so white nearly clips", () => {
+    // A plain conversion with SDR white just above 203 nits: ordered, but no room above white.
+    const converted = (code: number) => (code < 0.4 ? 30 : code < 0.65 ? 250 : 255);
+    canvasModel = (transfer, code) => (transfer === "pq" ? converted(code) : raw(code));
+    expect(canvasMapsHDR("pq")).toBe(false);
+  });
+
+  it("judges each transfer on its own", () => {
+    canvasModel = (transfer, code) =>
+      transfer === "hlg" ? raw(code) : chromiumCanvas(transfer, code);
+    expect(canvasMapsHDR("pq")).toBe(true);
+    expect(canvasMapsHDR("hlg")).toBe(false);
+  });
+});
+
+describe("HDRPresenter", () => {
+  async function presenter(transfer: "pq" | "hlg" = "pq", canvasMaps = true) {
+    canvasModel = canvasMaps ? chromiumCanvas : (_transfer, code) => raw(code);
+    const device = new FakeDevice();
+    const on = events();
+    devices.push(device);
+    const surface = document.createElement("div");
+    const hdr = await HDRPresenter.create(surface, transfer, DEFAULT_PICTURE_COLOR, on);
+    const shown = () =>
+      [...surface.querySelectorAll("canvas")].map((canvas) => canvas.style.display);
+    return { hdr, surface, device, on, shown };
+  }
+
+  it("draws each picture on the layer its route needs, switching both ways", async () => {
+    const { hdr, surface, device, shown } = await presenter();
+
+    hdr.draw(planes(), size, viewport);
+    expect(device.queue.writeTexture).toHaveBeenCalled();
+    expect(shown()).toEqual(["block"]);
+
+    const hardware = frame(HARDWARE_PQ);
+    hdr.draw(hardware, size, viewport);
+    expect(context2d.drawImage).toHaveBeenLastCalledWith(
+      hardware.frame,
+      expect.any(Number),
+      expect.any(Number),
+      expect.any(Number),
+      expect.any(Number),
+    );
+    expect(shown()).toEqual(["none", "block"]);
+
+    hdr.draw(frame(RETAGGED), size, viewport);
+    expect(framesSent(device)).toBeGreaterThan(0);
+    expect(shown()).toEqual(["block", "none"]);
+
+    hdr.destroy();
+    expect(surface.querySelector("canvas")).toBeNull();
+  });
+
+  it("sizes a layer from the session's box when it comes back from hiding", async () => {
+    const { hdr, surface, shown } = await presenter();
+    // Without exact device pixels (Safari), sizes come from CSS pixels; a
+    // hidden canvas measures nothing itself.
+    Object.defineProperty(surface, "clientWidth", { value: 1280 });
+    Object.defineProperty(surface, "clientHeight", { value: 720 });
+    hdr.draw(planes(), size, viewport);
+    hdr.draw(frame(HARDWARE_PQ), size, viewport);
+    hdr.draw(planes(), size, viewport);
+    hdr.draw(frame(HARDWARE_PQ), size, viewport);
+    expect(shown()).toEqual(["none", "block"]);
+    const canvases = [...surface.querySelectorAll("canvas")];
+    expect(canvases.map((canvas) => [canvas.width, canvas.height])).toEqual([
+      [1280, 720],
+      [1280, 720],
+    ]);
+  });
+
+  it("keeps the last picture up while its device is being replaced", async () => {
+    const { hdr, device, on, shown } = await presenter();
+    devices.push(new Promise(() => {}));
+    hdr.draw(frame(HARDWARE_PQ), size, viewport);
+    expect(shown()).toEqual(["none", "block"]);
+    device.lose();
+    await vi.waitFor(() => expect(adapter.requestDevice).toHaveBeenCalledTimes(2));
+    hdr.draw(planes(), size, viewport);
+    expect(shown()).toEqual(["none", "block"]);
+    expect(on.onFailure).not.toHaveBeenCalled();
+  });
+
+  it("refuses a hardware frame where the canvas cannot map its transfer", async () => {
+    const { hdr } = await presenter("hlg", false);
+    expect(() => hdr.draw(frame({ transfer: "hlg", primaries: "bt2020" }), size, viewport)).toThrow(
+      /cannot map/,
+    );
+  });
+
+  it("refuses a frame whose tag it cannot interpret", async () => {
+    const { hdr } = await presenter();
+    expect(() => hdr.draw(frame({ transfer: null, primaries: null }), size, viewport)).toThrow(
+      /cannot interpret/,
+    );
+  });
+});
diff --git a/web/src/player/engine/renderers.ts b/web/src/player/engine/renderers.ts
new file mode 100644
index 0000000000..5c44ef7aa9
--- /dev/null
+++ b/web/src/player/engine/renderers.ts
@@ -0,0 +1,1247 @@
+/// <reference types="@webgpu/types" />
+import type { VideoFitMode } from "../types";
+import { videoContentRect } from "../utils/videoFit";
+import {
+  chromaOrigin,
+  DEFAULT_SOURCE_PEAK_NITS,
+  LUMA_WEIGHTS,
+  SDR_WHITE_NITS,
+  TO_BT709,
+  YUV_TO_RGB,
+} from "./colorMath";
+import { isSoftwareAdapter } from "./gpuAdapter";
+import { PRESENTER_WGSL } from "./hdrShader";
+import { DEFAULT_PICTURE_COLOR, IMPORT_COLOR_TAG, type PictureColor } from "./pictureColor";
+import type { EnginePlaneFrame } from "./protocol";
+
+/** A decoded picture as the presenter receives it. */
+export type EnginePicture =
+  | { kind: "frame"; frame: VideoFrame; timestamp: number; duration: number }
+  | { kind: "planes"; planes: EnginePlaneFrame; timestamp: number; duration: number };
+
+export interface PictureSize {
+  /** Display size of the picture, after the container's aspect ratio and rotation. */
+  width: number;
+  height: number;
+  /** Clockwise turn, in degrees, that puts the decoded picture upright. */
+  rotation: 0 | 90 | 180 | 270;
+  /** Mirror the turned picture horizontally. */
+  flip: boolean;
+}
+
+/** Where a picture is drawn: the fit mode and, when known, the box's exact device pixels. */
+export interface Viewport {
+  fit: VideoFitMode;
+  devicePixels: { width: number; height: number } | null;
+}
+
+export interface FrameRenderer {
+  /**
+   * Draws `picture` letterboxed for the viewport. Never takes ownership of it.
+   * Throws when the picture cannot be presented.
+   */
+  draw(picture: EnginePicture, size: PictureSize, viewport: Viewport): void;
+  /** The engine failed: keep the picture on screen, but start nothing new. */
+  stop(): void;
+  destroy(): void;
+}
+
+function sizeCanvas(
+  canvas: HTMLCanvasElement,
+  viewport: Viewport,
+  maxDimension = 16384,
+): { width: number; height: number } {
+  // Without the exact figure, CSS pixels times the ratio is off by at most a
+  // pixel, which only softens the picture slightly. They come from the box the
+  // canvas fills: a layer about to be shown again is still hidden, and so
+  // measures nothing itself.
+  const ratio = window.devicePixelRatio || 1;
+  const exact = viewport.devicePixels;
+  const box = canvas.parentElement ?? canvas;
+  const width = Math.max(
+    1,
+    Math.min(maxDimension, exact ? exact.width : Math.round(box.clientWidth * ratio)),
+  );
+  const height = Math.max(
+    1,
+    Math.min(maxDimension, exact ? exact.height : Math.round(box.clientHeight * ratio)),
+  );
+  if (canvas.width !== width) canvas.width = width;
+  if (canvas.height !== height) canvas.height = height;
+  return { width, height };
+}
+
+/** A canvas filling `surface`; each context type needs its own canvas. */
+function addLayer(surface: HTMLElement): HTMLCanvasElement {
+  const canvas = document.createElement("canvas");
+  canvas.style.display = "block";
+  canvas.style.width = "100%";
+  canvas.style.height = "100%";
+  surface.appendChild(canvas);
+  return canvas;
+}
+
+/**
+ * Presents SDR frames with the 2D canvas, which hands the browser's own
+ * color-managed, GPU-backed VideoFrame straight to the compositor.
+ */
+export class Canvas2DRenderer implements FrameRenderer {
+  private readonly context: CanvasRenderingContext2D;
+
+  constructor(private readonly canvas: HTMLCanvasElement) {
+    const context = canvas.getContext("2d", { alpha: false });
+    if (!context) throw new Error("2D canvas is unavailable");
+    this.context = context;
+  }
+
+  /** A renderer on a new canvas of its own inside `surface`. */
+  static in(surface: HTMLElement): Canvas2DRenderer {
+    const canvas = addLayer(surface);
+    try {
+      return new Canvas2DRenderer(canvas);
+    } catch (error) {
+      canvas.remove();
+      throw error;
+    }
+  }
+
+  get element(): HTMLCanvasElement {
+    return this.canvas;
+  }
+
+  draw(picture: EnginePicture, size: PictureSize, viewport: Viewport): void {
+    if (picture.kind !== "frame") throw new Error("The 2D canvas cannot present uploaded planes.");
+    const { width, height } = sizeCanvas(this.canvas, viewport);
+    const rect = videoContentRect(width, height, size.width, size.height, viewport.fit);
+    this.context.fillStyle = "#000";
+    this.context.fillRect(0, 0, width, height);
+    this.context.imageSmoothingEnabled = true;
+    this.context.imageSmoothingQuality = "high";
+    // Draw the decoded picture around the rect's center, turned and then mirrored.
+    const sideways = size.rotation % 180 !== 0;
+    const drawWidth = sideways ? rect.height : rect.width;
+    const drawHeight = sideways ? rect.width : rect.height;
+    this.context.translate(rect.x + rect.width / 2, rect.y + rect.height / 2);
+    if (size.flip) this.context.scale(-1, 1);
+    this.context.rotate((size.rotation * Math.PI) / 180);
+    this.context.drawImage(picture.frame, -drawWidth / 2, -drawHeight / 2, drawWidth, drawHeight);
+    this.context.resetTransform();
+  }
+
+  stop(): void {}
+
+  destroy(): void {
+    this.context.clearRect(0, 0, this.canvas.width, this.canvas.height);
+    this.canvas.remove();
+  }
+}
+
+/**
+ * Which presentation path a decoded HDR picture needs.
+ *
+ * - `planes`: 10/12-bit codes uploaded by the worker; the shader converts them.
+ * - `frame`: a GPU-backed frame that kept the worker's BT.709/sRGB re-tag, so
+ *   importing it applies only the Y'CbCr matrix and leaves the PQ/HLG codes
+ *   for the shader.
+ * - `browser`: a frame that kept its PQ/HLG tag, because the hardware decoder
+ *   ignored the re-tag (VideoToolbox, D3D11, VA-API). Only the browser knows
+ *   how to map it: a WebGPU import desaturates it in Chromium, while a 2D
+ *   canvas tone-maps it the way a <video> element does, in the browsers whose
+ *   canvas does that at all.
+ * - `unsupported`: any other tag. Its codes cannot be interpreted safely.
+ */
+export type PictureRoute = "planes" | "frame" | "browser" | "unsupported";
+
+export function routePicture(picture: EnginePicture): PictureRoute {
+  if (picture.kind === "planes") return "planes";
+  // TypeScript's DOM types predate the "pq" and "hlg" transfer values.
+  const colorSpace = picture.frame.colorSpace as
+    | { transfer?: string | null; primaries?: string | null }
+    | undefined;
+  const transfer = colorSpace?.transfer;
+  // Untagged primaries import as BT.709 too, so those frames keep their codes as well.
+  const primaries = colorSpace?.primaries ?? IMPORT_COLOR_TAG.primaries;
+  if (transfer === IMPORT_COLOR_TAG.transfer && primaries === IMPORT_COLOR_TAG.primaries) {
+    return "frame";
+  }
+  if (transfer === "pq" || transfer === "hlg") return "browser";
+  return "unsupported";
+}
+
+interface PresenterPipelines {
+  /** The render target format the pipelines draw into. */
+  format: GPUTextureFormat;
+  external: GPURenderPipeline;
+  copied: GPURenderPipeline;
+  planes: GPURenderPipeline;
+  params: GPUBindGroupLayout;
+  externalPicture: GPUBindGroupLayout;
+  copiedPicture: GPUBindGroupLayout;
+  planePictures: GPUBindGroupLayout;
+}
+
+/** The first compiler error, which says more than "the pipeline is invalid". */
+async function compilerError(module: GPUShaderModule): Promise<string | null> {
+  try {
+    const info = await module.getCompilationInfo();
+    const error = info.messages.find((message) => message.type === "error");
+    return error ? `${error.message} (line ${error.lineNum})` : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Compiles the presenter for `format`. WebGPU reports these failures through
+ * error scopes and rejected promises rather than by throwing, so both are
+ * collected here and turned into one exception.
+ */
+async function createPresenterPipelines(
+  device: GPUDevice,
+  format: GPUTextureFormat,
+): Promise<PresenterPipelines> {
+  device.pushErrorScope("validation");
+  const module = device.createShaderModule({ code: PRESENTER_WGSL });
+  const params = device.createBindGroupLayout({
+    entries: [
+      { binding: 0, visibility: GPUShaderStage.VERTEX | GPUShaderStage.FRAGMENT, buffer: {} },
+      { binding: 1, visibility: GPUShaderStage.FRAGMENT, sampler: {} },
+    ],
+  });
+  const externalPicture = device.createBindGroupLayout({
+    entries: [{ binding: 0, visibility: GPUShaderStage.FRAGMENT, externalTexture: {} }],
+  });
+  const copiedPicture = device.createBindGroupLayout({
+    entries: [
+      { binding: 0, visibility: GPUShaderStage.FRAGMENT, texture: { sampleType: "float" } },
+    ],
+  });
+  const planeEntry = (binding: number): GPUBindGroupLayoutEntry => ({
+    binding,
+    visibility: GPUShaderStage.FRAGMENT,
+    texture: { sampleType: "uint" },
+  });
+  const planePictures = device.createBindGroupLayout({
+    entries: [planeEntry(0), planeEntry(1), planeEntry(2)],
+  });
+  const pipeline = (layout: GPUBindGroupLayout, entryPoint: string) =>
+    device.createRenderPipelineAsync({
+      layout: device.createPipelineLayout({ bindGroupLayouts: [params, layout] }),
+      vertex: { module, entryPoint: "vertexMain" },
+      fragment: { module, entryPoint, targets: [{ format }] },
+      primitive: { topology: "triangle-list" },
+    });
+  let pipelines: [GPURenderPipeline, GPURenderPipeline, GPURenderPipeline] | null = null;
+  let failure: unknown = null;
+  try {
+    pipelines = await Promise.all([
+      pipeline(externalPicture, "fragmentExternal"),
+      pipeline(copiedPicture, "fragmentCopied"),
+      pipeline(planePictures, "fragmentPlanes"),
+    ]);
+  } catch (error) {
+    failure = error;
+  }
+  if (!failure && pipelines) {
+    // Every object above feeds the pipelines, so their success means the
+    // scope is clean. Its answer can take a second on some drivers; not waited for.
+    void device.popErrorScope().catch(() => {});
+    return {
+      format,
+      external: pipelines[0],
+      copied: pipelines[1],
+      planes: pipelines[2],
+      params,
+      externalPicture,
+      copiedPicture,
+      planePictures,
+    };
+  }
+  const scoped = await device.popErrorScope().catch(() => null);
+  const reason =
+    (await compilerError(module)) ??
+    scoped?.message ??
+    (failure instanceof Error ? failure.message : String(failure));
+  throw new Error(`The HDR presenter could not be built: ${reason}`);
+}
+
+/**
+ * A fresh device for the presenter. The default adapter is the one the
+ * browser composites with; asking for the high-performance one can wake a
+ * discrete GPU and move every frame between GPUs.
+ */
+async function requestPresenterDevice(): Promise<GPUDevice> {
+  const gpu = (navigator as Navigator & { gpu?: GPU }).gpu;
+  if (!gpu) throw new Error("WebGPU is unavailable");
+  const adapter = await gpu.requestAdapter();
+  if (!adapter) throw new Error("No WebGPU adapter");
+  if (isSoftwareAdapter(adapter)) throw new Error("Only a software WebGPU adapter is available");
+  return adapter.requestDevice();
+}
+
+function preferredCanvasFormat(): GPUTextureFormat {
+  return (navigator as Navigator & { gpu: GPU }).gpu.getPreferredCanvasFormat();
+}
+
+/** The renderer drawing with a device, told when the device fails. */
+interface DeviceHolder {
+  deviceLost(info: GPUDeviceLostInfo): void;
+  deviceError(message: string): void;
+}
+
+/**
+ * A device with the presenter compiled for one canvas format. It subscribes
+ * to its loss and uncaptured errors once and forwards them to whichever
+ * renderer holds it, so a renderer that lets go leaves nothing behind on it.
+ * Both are also kept, for a renderer that takes the device after they came.
+ */
+interface PresenterDevice {
+  device: GPUDevice;
+  pipelines: PresenterPipelines;
+  format: GPUTextureFormat;
+  lost: GPUDeviceLostInfo | null;
+  /** The first error it reported; such a device is not handed to another playback. */
+  error: string | null;
+  holder: DeviceHolder | null;
+}
+
+function adopt(
+  device: GPUDevice,
+  pipelines: PresenterPipelines,
+  format: GPUTextureFormat,
+): PresenterDevice {
+  const entry: PresenterDevice = {
+    device,
+    pipelines,
+    format,
+    lost: null,
+    error: null,
+    holder: null,
+  };
+  void device.lost.then((info) => {
+    entry.lost = info;
+    if (spare === entry) spare = null;
+    entry.holder?.deviceLost(info);
+  });
+  device.addEventListener("uncapturederror", (event) => {
+    const message = (event as GPUUncapturedErrorEvent).error.message;
+    entry.error ??= message;
+    entry.holder?.deviceError(message);
+  });
+  return entry;
+}
+
+/**
+ * The page keeps one presenter device. Creating a device and compiling the
+ * presenter takes milliseconds on some systems and several seconds on others
+ * (Linux Vulkan drivers), so the capability probe offers its device as soon
+ * as the presenter compiles, and each playback hands it on when it ends,
+ * unless it was lost or reported an error.
+ */
+let spare: PresenterDevice | null = null;
+/** The probe while it builds its device; a playback starting meanwhile waits for that device. */
+let probing: { done: Promise<void>; deadline: number } | null = null;
+let spareWaiters: Array<() => void> = [];
+/** How long after the probe starts a playback still waits for its device. */
+const PROBE_WAIT_MS = 10_000;
+
+function wakeSpareWaiters(): void {
+  const waiters = spareWaiters;
+  spareWaiters = [];
+  for (const wake of waiters) wake();
+}
+
+/** Hands a device to the page for the next playback, or releases it. */
+function offer(entry: PresenterDevice): void {
+  entry.holder = null;
+  if (entry.lost || entry.error !== null) {
+    entry.device.destroy();
+    return;
+  }
+  if (spare && spare !== entry) spare.device.destroy();
+  spare = entry;
+  wakeSpareWaiters();
+}
+
+/**
+ * The page's device for `format`, if it has one. While the probe is still
+ * building its device, waits for it rather than building a second one, up
+ * to a deadline counted from the probe's start, so a probe that hangs delays
+ * playback only once.
+ */
+async function takeSpare(format: GPUTextureFormat): Promise<PresenterDevice | null> {
+  const pending = probing;
+  if (!spare && pending && performance.now() < pending.deadline) {
+    let wake!: () => void;
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    await Promise.race([
+      new Promise<void>((resolve) => {
+        wake = resolve;
+        spareWaiters.push(resolve);
+      }),
+      pending.done,
+      new Promise<void>((resolve) => {
+        timer = setTimeout(resolve, pending.deadline - performance.now());
+      }),
+    ]);
+    clearTimeout(timer);
+    spareWaiters = spareWaiters.filter((waiter) => waiter !== wake);
+  }
+  const entry = spare;
+  spare = null;
+  if (!entry) return null;
+  // An error can be reported after its playback handed the device back.
+  if (entry.lost || entry.error !== null || entry.format !== format) {
+    entry.device.destroy();
+    return null;
+  }
+  return entry;
+}
+
+const UNIFORM_FLOATS = 40;
+
+/** How a GPU-backed frame reaches the shader. */
+type FrameTransfer = "import" | "copy";
+
+type FramePicture = Extract<EnginePicture, { kind: "frame" }>;
+
+/** Side, in pixels, of the square the two ways of drawing a frame are compared at. */
+const FRAME_CHECK_SIZE = 8;
+/**
+ * Mean difference, in 8-bit levels, above which the two ways disagree. Both
+ * apply the same Y'CbCr matrix, so where the import is right they differ by
+ * a level or two of filtering. WebKit's misread 10-bit frames differ by far more.
+ */
+const FRAME_CHECK_TOLERANCE = 6;
+/**
+ * Spread, in 8-bit levels, the copied check picture needs before the check
+ * counts. A dark or flat frame (a fade from black, a title card) comes out
+ * alike both ways even where the import is wrong.
+ */
+const FRAME_CHECK_MIN_SPREAD = 32;
+/** Frames drawn, by copy, before a check that saw too little is tried again. */
+export const FRAME_CHECK_RETRY_FRAMES = 30;
+
+/**
+ * Draws pictures with a compiled presenter into any render target: the
+ * canvas while playing, a small texture while probing.
+ */
+class GPUPresenter {
+  private readonly data = new ArrayBuffer(UNIFORM_FLOATS * 4);
+  private readonly floats = new Float32Array(this.data);
+  private readonly uints = new Uint32Array(this.data);
+  private readonly uniforms: GPUBuffer;
+  private readonly paramsBindGroup: GPUBindGroup;
+  private planeTextures: { luma: GPUTexture; cb: GPUTexture; cr: GPUTexture; key: string } | null =
+    null;
+  private planeBindGroup: GPUBindGroup | null = null;
+  /**
+   * How frames reach the shader. Importing costs nothing, but WebKit imports
+   * 10-bit hardware-decoded frames wrongly, so a frame is drawn both ways and
+   * the results compared (`checkFrameImport`). Until there is an answer, and
+   * wherever the two disagree, frames are copied.
+   */
+  private frameTransfer: FrameTransfer | null = null;
+  private frameChecking = false;
+  /** Frames to draw before the next check; Infinity once checking gave up. */
+  private framesUntilCheck = 0;
+  private copied: { texture: GPUTexture; bindGroup: GPUBindGroup } | null = null;
+  private destroyed = false;
+
+  constructor(
+    private readonly device: GPUDevice,
+    private readonly pipelines: PresenterPipelines,
+    transfer: "pq" | "hlg",
+    private readonly color: PictureColor,
+  ) {
+    this.uniforms = device.createBuffer({
+      size: this.data.byteLength,
+      usage: GPUBufferUsage.UNIFORM | GPUBufferUsage.COPY_DST,
+    });
+    const sampler = device.createSampler({ magFilter: "linear", minFilter: "linear" });
+    this.paramsBindGroup = device.createBindGroup({
+      layout: pipelines.params,
+      entries: [
+        { binding: 0, resource: { buffer: this.uniforms } },
+        { binding: 1, resource: sampler },
+      ],
+    });
+    // Everything about the source that does not change from picture to picture.
+    this.uints[4] = transfer === "hlg" ? 2 : 1;
+    this.floats.set([DEFAULT_SOURCE_PEAK_NITS, SDR_WHITE_NITS, 0, 0], 8);
+    this.floats.set(YUV_TO_RGB[color.matrix], 20);
+    this.floats.set([...LUMA_WEIGHTS[color.primaries], 0], 24);
+    const gamut = TO_BT709[color.primaries];
+    for (let row = 0; row < 3; row++) {
+      this.floats.set([gamut[row * 3]!, gamut[row * 3 + 1]!, gamut[row * 3 + 2]!, 0], 28 + row * 4);
+    }
+  }
+
+  /** Draws `picture`; a frame goes the way `transfer` says, or the way found to work. */
+  draw(
+    picture: EnginePicture,
+    size: PictureSize,
+    fit: VideoFitMode,
+    target: GPUTextureView,
+    width: number,
+    height: number,
+    transfer?: FrameTransfer,
+  ): void {
+    // Before this draw sets its own uniforms: the check draws with its own.
+    if (picture.kind === "frame" && !transfer && !this.frameTransfer && !this.frameChecking) {
+      if (this.framesUntilCheck > 0) {
+        this.framesUntilCheck -= 1;
+      } else {
+        this.frameChecking = true;
+        void this.checkFrameImport(picture, size);
+      }
+    }
+    const rect = videoContentRect(width, height, size.width, size.height, fit);
+    const x0 = (rect.x / width) * 2 - 1;
+    const x1 = ((rect.x + rect.width) / width) * 2 - 1;
+    // Texture v grows downwards while clip-space y grows upwards.
+    const y0 = 1 - (rect.y / height) * 2;
+    const y1 = 1 - ((rect.y + rect.height) / height) * 2;
+    this.floats.set([x0, y0, x1, y1], 0);
+    this.uints[5] = picture.kind === "planes" ? picture.planes.bitDepth : 0;
+    this.uints[6] = size.rotation / 90;
+    this.uints[7] = size.flip ? 1 : 0;
+
+    let pictureBindGroup: GPUBindGroup;
+    let pipeline: GPURenderPipeline;
+    if (picture.kind === "planes") {
+      const planes = picture.planes;
+      const subsampleX = planes.chromaWidth < planes.width ? 2 : 1;
+      const subsampleY = planes.chromaHeight < planes.height ? 2 : 1;
+      this.floats.set([planes.width, planes.height, planes.chromaWidth, planes.chromaHeight], 12);
+      this.floats.set(
+        [...chromaOrigin(this.color.chromaSiting, subsampleX, subsampleY), subsampleX, subsampleY],
+        16,
+      );
+      pictureBindGroup = this.uploadPlanes(planes);
+      pipeline = this.pipelines.planes;
+    } else {
+      this.floats.set([0, 0, 0, 0, 0, 0, 1, 1], 12);
+      const copied =
+        (transfer ?? this.frameTransfer ?? "copy") === "copy"
+          ? this.copyFrame(picture.frame)
+          : null;
+      if (copied) {
+        pictureBindGroup = copied;
+        pipeline = this.pipelines.copied;
+      } else {
+        pictureBindGroup = this.device.createBindGroup({
+          layout: this.pipelines.externalPicture,
+          entries: [
+            { binding: 0, resource: this.device.importExternalTexture({ source: picture.frame }) },
+          ],
+        });
+        pipeline = this.pipelines.external;
+      }
+    }
+    this.device.queue.writeBuffer(this.uniforms, 0, this.data);
+
+    const encoder = this.device.createCommandEncoder();
+    const pass = encoder.beginRenderPass({
+      colorAttachments: [
+        {
+          view: target,
+          loadOp: "clear",
+          storeOp: "store",
+          clearValue: { r: 0, g: 0, b: 0, a: 1 },
+        },
+      ],
+    });
+    pass.setPipeline(pipeline);
+    pass.setBindGroup(0, this.paramsBindGroup);
+    pass.setBindGroup(1, pictureBindGroup);
+    pass.draw(6);
+    pass.end();
+    this.device.queue.submit([encoder.finish()]);
+  }
+
+  private uploadPlanes(planes: EnginePlaneFrame): GPUBindGroup {
+    const key = `${planes.width}x${planes.height}:${planes.chromaWidth}x${planes.chromaHeight}`;
+    if (!this.planeTextures || this.planeTextures.key !== key) {
+      this.destroyPlaneTextures();
+      const texture = (width: number, height: number) =>
+        this.device.createTexture({
+          size: [width, height],
+          format: "r16uint",
+          usage: GPUTextureUsage.TEXTURE_BINDING | GPUTextureUsage.COPY_DST,
+        });
+      this.planeTextures = {
+        luma: texture(planes.width, planes.height),
+        cb: texture(planes.chromaWidth, planes.chromaHeight),
+        cr: texture(planes.chromaWidth, planes.chromaHeight),
+        key,
+      };
+      this.planeBindGroup = this.device.createBindGroup({
+        layout: this.pipelines.planePictures,
+        entries: [
+          { binding: 0, resource: this.planeTextures.luma.createView() },
+          { binding: 1, resource: this.planeTextures.cb.createView() },
+          { binding: 2, resource: this.planeTextures.cr.createView() },
+        ],
+      });
+    }
+    const textures = this.planeTextures;
+    const write = (texture: GPUTexture, plane: 0 | 1 | 2, width: number, height: number) =>
+      this.device.queue.writeTexture(
+        { texture },
+        planes.buffer,
+        { offset: planes.offsets[plane], bytesPerRow: planes.strides[plane], rowsPerImage: height },
+        [width, height],
+      );
+    write(textures.luma, 0, planes.width, planes.height);
+    write(textures.cb, 1, planes.chromaWidth, planes.chromaHeight);
+    write(textures.cr, 2, planes.chromaWidth, planes.chromaHeight);
+    return this.planeBindGroup!;
+  }
+
+  /** Whether `frame` fits in a texture on this device, so that it can be copied. */
+  private fitsTexture(frame: VideoFrame): boolean {
+    const limit = this.device.limits.maxTextureDimension2D;
+    return frame.displayWidth <= limit && frame.displayHeight <= limit;
+  }
+
+  /**
+   * Copies `frame` into the presenter's half-float texture, keeping its
+   * R'G'B' codes. Null where the frame is larger than a texture can be (that
+   * frame is imported), or the browser cannot copy a VideoFrame at all
+   * (Firefox), which leaves importing as the only way.
+   */
+  private copyFrame(frame: VideoFrame): GPUBindGroup | null {
+    if (!this.fitsTexture(frame)) return null;
+    const width = frame.displayWidth;
+    const height = frame.displayHeight;
+    if (
+      !this.copied ||
+      this.copied.texture.width !== width ||
+      this.copied.texture.height !== height
+    ) {
+      this.copied?.texture.destroy();
+      const texture = this.device.createTexture({
+        size: [width, height],
+        format: "rgba16float",
+        usage:
+          GPUTextureUsage.TEXTURE_BINDING |
+          GPUTextureUsage.COPY_DST |
+          GPUTextureUsage.RENDER_ATTACHMENT,
+      });
+      this.copied = {
+        texture,
+        bindGroup: this.device.createBindGroup({
+          layout: this.pipelines.copiedPicture,
+          entries: [{ binding: 0, resource: texture.createView() }],
+        }),
+      };
+    }
+    try {
+      this.device.queue.copyExternalImageToTexture(
+        { source: frame },
+        { texture: this.copied.texture, colorSpace: "srgb" },
+        [width, height],
+      );
+    } catch (error) {
+      if (!(error instanceof TypeError)) throw error;
+      this.useImport();
+      return null;
+    }
+    return this.copied.bindGroup;
+  }
+
+  /** Imports frames from now on, and lets go of the copy's texture. */
+  private useImport(): void {
+    this.frameTransfer = "import";
+    this.copied?.texture.destroy();
+    this.copied = null;
+  }
+
+  /**
+   * Draws `picture` both ways into small textures and compares them: frames
+   * are imported from then on where the two agree, and copied where not. A
+   * picture with too little in it decides nothing; a later frame is tried.
+   */
+  private async checkFrameImport(picture: FramePicture, size: PictureSize): Promise<void> {
+    if (!this.fitsTexture(picture.frame)) {
+      // A frame that cannot be copied cannot be compared.
+      this.framesUntilCheck = FRAME_CHECK_RETRY_FRAMES;
+      this.frameChecking = false;
+      return;
+    }
+    const side = FRAME_CHECK_SIZE;
+    const target = () =>
+      this.device.createTexture({
+        size: [side, side],
+        format: this.pipelines.format,
+        usage: GPUTextureUsage.RENDER_ATTACHMENT | GPUTextureUsage.COPY_SRC,
+      });
+    const imported = target();
+    const copied = target();
+    try {
+      this.draw(picture, size, "cover", copied.createView(), side, side, "copy");
+      // The browser cannot copy frames: importing is the only way.
+      if (this.frameTransfer === "import") return;
+      this.draw(picture, size, "cover", imported.createView(), side, side, "import");
+      const [a, b] = await Promise.all([this.readBack(imported), this.readBack(copied)]);
+      let difference = 0;
+      let low = 255;
+      let high = 0;
+      for (let pixel = 0; pixel < side * side; pixel++) {
+        const offset = Math.floor(pixel / side) * 256 + (pixel % side) * 4;
+        for (let channel = 0; channel < 3; channel++) {
+          const value = b[offset + channel]!;
+          difference += Math.abs(a[offset + channel]! - value);
+          low = Math.min(low, value);
+          high = Math.max(high, value);
+        }
+      }
+      if (this.destroyed) return;
+      if (high - low < FRAME_CHECK_MIN_SPREAD) {
+        this.framesUntilCheck = FRAME_CHECK_RETRY_FRAMES;
+      } else if (difference / (side * side * 3) > FRAME_CHECK_TOLERANCE) {
+        this.frameTransfer = "copy";
+      } else {
+        this.useImport();
+      }
+    } catch {
+      // Without an answer frames stay copied, which is right everywhere it works.
+      this.framesUntilCheck = Infinity;
+    } finally {
+      this.frameChecking = false;
+      imported.destroy();
+      copied.destroy();
+    }
+  }
+
+  /** The 8-bit pixels of a small render target, rows 256 bytes apart. */
+  private async readBack(texture: GPUTexture): Promise<Uint8Array> {
+    const bytesPerRow = 256;
+    const buffer = this.device.createBuffer({
+      size: bytesPerRow * texture.height,
+      usage: GPUBufferUsage.COPY_DST | GPUBufferUsage.MAP_READ,
+    });
+    const encoder = this.device.createCommandEncoder();
+    encoder.copyTextureToBuffer({ texture }, { buffer, bytesPerRow }, [
+      texture.width,
+      texture.height,
+    ]);
+    this.device.queue.submit([encoder.finish()]);
+    try {
+      await buffer.mapAsync(GPUMapMode.READ);
+      return new Uint8Array(buffer.getMappedRange().slice(0));
+    } finally {
+      buffer.destroy();
+    }
+  }
+
+  private destroyPlaneTextures(): void {
+    this.planeTextures?.luma.destroy();
+    this.planeTextures?.cb.destroy();
+    this.planeTextures?.cr.destroy();
+    this.planeTextures = null;
+    this.planeBindGroup = null;
+  }
+
+  destroy(): void {
+    this.destroyed = true;
+    this.destroyPlaneTextures();
+    this.copied?.texture.destroy();
+    this.copied = null;
+    this.uniforms.destroy();
+  }
+}
+
+/**
+ * Whether `adapter` can present HDR: a device, the presenter compiled, and
+ * one picture drawn through each path without a validation error. Answers
+ * null when that says nothing about the presenter: the device was lost or
+ * could not be created (a GPU process restarting, say).
+ */
+export function probePresenter(adapter: GPUAdapter): Promise<boolean | null> {
+  const run = testPresenter(adapter);
+  const done = run.then(
+    () => {},
+    () => {},
+  );
+  probing = { done, deadline: performance.now() + PROBE_WAIT_MS };
+  void done.then(() => {
+    if (probing?.done === done) probing = null;
+    wakeSpareWaiters();
+  });
+  return run;
+}
+
+async function testPresenter(adapter: GPUAdapter): Promise<boolean | null> {
+  const format = preferredCanvasFormat();
+  let device: GPUDevice;
+  try {
+    device = await adapter.requestDevice();
+  } catch {
+    return null;
+  }
+  let lost = false;
+  void device.lost.then(() => (lost = true));
+  let pipelines: PresenterPipelines;
+  try {
+    pipelines = await createPresenterPipelines(device, format);
+  } catch {
+    // Lost while compiling says nothing; anything else is a broken presenter.
+    device.destroy();
+    return lost ? null : false;
+  }
+  // Offered at once: the test draw below can take seconds to report on some
+  // drivers, and a playback that takes the device meanwhile catches the same
+  // errors in its own draws.
+  const entry = adopt(device, pipelines, format);
+  offer(entry);
+  // A playback waiting for the device connects first: importing even this
+  // small frame can hold the main thread for a second on some drivers.
+  await new Promise((resolve) => setTimeout(resolve, 0));
+  const presenter = new GPUPresenter(device, pipelines, "pq", DEFAULT_PICTURE_COLOR);
+  const target = device.createTexture({
+    size: [4, 4],
+    format,
+    usage: GPUTextureUsage.RENDER_ATTACHMENT,
+  });
+  let frame: VideoFrame | null = null;
+  let threw = false;
+  let error: GPUError | null = null;
+  device.pushErrorScope("validation");
+  try {
+    const size: PictureSize = { width: 2, height: 2, rotation: 0, flip: false };
+    // A 2x2 I420 frame tagged the way the worker tags HDR frames for import.
+    frame = new VideoFrame(new Uint8Array([64, 64, 64, 64, 128, 128]), {
+      format: "I420",
+      codedWidth: 2,
+      codedHeight: 2,
+      timestamp: 0,
+      colorSpace: { ...IMPORT_COLOR_TAG, matrix: "bt709", fullRange: false },
+    });
+    const planes: EnginePlaneFrame = {
+      timestamp: 0,
+      duration: 0,
+      bitDepth: 10,
+      width: 2,
+      height: 2,
+      chromaWidth: 1,
+      chromaHeight: 1,
+      buffer: new Uint16Array([64, 64, 64, 64, 512, 512]).buffer,
+      offsets: [0, 8, 10],
+      strides: [4, 2, 2],
+    };
+    const view = target.createView();
+    presenter.draw(
+      { kind: "frame", frame, timestamp: 0, duration: 0 },
+      size,
+      "contain",
+      view,
+      4,
+      4,
+    );
+    presenter.draw(
+      { kind: "planes", planes, timestamp: 0, duration: 0 },
+      size,
+      "contain",
+      view,
+      4,
+      4,
+    );
+  } catch {
+    threw = true;
+  } finally {
+    error = await device.popErrorScope().catch(() => null);
+    frame?.close();
+    presenter.destroy();
+    target.destroy();
+  }
+  if (entry.lost) return null;
+  if (threw || error) {
+    entry.error ??= error?.message ?? "The presenter's test draw failed.";
+    // Withdraw it, unless a playback has already taken it.
+    if (spare === entry) {
+      spare = null;
+      device.destroy();
+    }
+    return false;
+  }
+  return true;
+}
+
+/** How long a lost device may take to come back before playback fails over. */
+export const DEVICE_RECOVERY_TIMEOUT_MS = 4_000;
+/** Device losses one session recovers from before failing over. */
+export const MAX_DEVICE_RECOVERIES = 2;
+
+export interface PresenterEvents {
+  /** The picture can no longer be presented; the engine should fail over. */
+  onFailure: (message: string) => void;
+  /** A lost device was replaced; the picture on screen needs drawing again. */
+  onRestored: () => void;
+}
+
+/**
+ * Presents HDR pictures tone-mapped to SDR with WebGPU on a canvas.
+ *
+ * Validation errors arrive asynchronously, so every draw runs in an error
+ * scope whose result reports a failure once; uncaptured errors (allocation
+ * failures among them) are a second net. A lost device is replaced in place
+ * with a fresh one, within a deadline and a per-session budget.
+ */
+export class WebGPURenderer implements FrameRenderer, DeviceHolder {
+  private entry: PresenterDevice | null = null;
+  private presenter: GPUPresenter | null = null;
+  /** Bumped whenever a device replacement in flight stops being wanted. */
+  private generation = 0;
+  private recoveries = 0;
+  /** The presenter itself failed and reported it. */
+  private failed = false;
+  /** The engine stopped (for whatever reason): nothing new starts. */
+  private halted = false;
+  private disposed = false;
+
+  private constructor(
+    private readonly canvas: HTMLCanvasElement,
+    private readonly context: GPUCanvasContext,
+    private readonly format: GPUTextureFormat,
+    private readonly transfer: "pq" | "hlg",
+    private readonly color: PictureColor,
+    private readonly events: PresenterEvents,
+    entry: PresenterDevice,
+  ) {
+    this.hold(entry);
+  }
+
+  static async create(
+    canvas: HTMLCanvasElement,
+    transfer: "pq" | "hlg",
+    color: PictureColor,
+    events: PresenterEvents,
+  ): Promise<WebGPURenderer> {
+    const context = canvas.getContext("webgpu");
+    if (!context) throw new Error("WebGPU canvas context is unavailable");
+    const format = preferredCanvasFormat();
+    const entry = await WebGPURenderer.connect(context, format, await takeSpare(format));
+    return new WebGPURenderer(canvas, context, format, transfer, color, events, entry);
+  }
+
+  /**
+   * Configures the canvas with `kept`, or with a fresh device. A connection
+   * that is no longer wanted when it completes hands its device back.
+   */
+  private static async connect(
+    context: GPUCanvasContext,
+    format: GPUTextureFormat,
+    kept: PresenterDevice | null,
+    isCurrent: () => boolean = () => true,
+  ): Promise<PresenterDevice> {
+    let entry = kept;
+    if (!entry) {
+      const device = await requestPresenterDevice();
+      try {
+        entry = adopt(device, await createPresenterPipelines(device, format), format);
+      } catch (error) {
+        device.destroy();
+        throw error;
+      }
+    }
+    if (!isCurrent()) {
+      offer(entry);
+      throw new Error("superseded");
+    }
+    context.configure({ device: entry.device, format, alphaMode: "opaque" });
+    return entry;
+  }
+
+  get element(): HTMLCanvasElement {
+    return this.canvas;
+  }
+
+  deviceError(message: string): void {
+    this.reportFailure(`Drawing a frame failed: ${message}`);
+  }
+
+  private reportFailure(message: string): void {
+    if (this.disposed || this.failed || this.halted) return;
+    this.failed = true;
+    this.events.onFailure(message);
+  }
+
+  deviceLost(info: GPUDeviceLostInfo): void {
+    if (this.disposed || this.failed || this.halted) return;
+    // destroy() is ours: the renderer released or replaced the device.
+    if (info.reason === "destroyed") return;
+    this.release();
+    const reason = info.message || "The GPU device was lost.";
+    if (this.recoveries >= MAX_DEVICE_RECOVERIES) {
+      this.reportFailure(reason);
+      return;
+    }
+    this.recoveries += 1;
+    this.generation += 1;
+    void this.recover(this.generation, reason);
+  }
+
+  /**
+   * Draws with `entry` from now on. It can be lost or report an error
+   * between being built or handed over and this point, with nobody holding
+   * it to hear, so that is handled here as if it had just happened.
+   */
+  private hold(entry: PresenterDevice): void {
+    this.entry = entry;
+    this.presenter = new GPUPresenter(entry.device, entry.pipelines, this.transfer, this.color);
+    entry.holder = this;
+    if (entry.lost) this.deviceLost(entry.lost);
+    else if (entry.error !== null) this.deviceError(entry.error);
+  }
+
+  /** Lets go of the current device: lost or failed ones are destroyed, sound ones kept. */
+  private release(): void {
+    this.presenter?.destroy();
+    this.presenter = null;
+    if (this.entry) offer(this.entry);
+    this.entry = null;
+  }
+
+  private async recover(generation: number, reason: string): Promise<void> {
+    const isCurrent = () =>
+      !this.disposed && !this.failed && !this.halted && generation === this.generation;
+    const deadline = setTimeout(() => {
+      if (!isCurrent()) return;
+      // Whatever the rebuild produces from here on is handed back.
+      this.generation += 1;
+      this.reportFailure(`${reason} A new GPU device was not ready in time.`);
+    }, DEVICE_RECOVERY_TIMEOUT_MS);
+    try {
+      // A fresh device: whatever took this one down probably took the
+      // page's spare with it.
+      const entry = await WebGPURenderer.connect(this.context, this.format, null, isCurrent);
+      clearTimeout(deadline);
+      if (!isCurrent()) {
+        offer(entry);
+        return;
+      }
+      this.hold(entry);
+      // Unless the new device was itself already lost or failed.
+      if (this.entry === entry && !this.failed) this.events.onRestored();
+    } catch (error) {
+      clearTimeout(deadline);
+      if (!isCurrent()) return;
+      this.reportFailure(`${reason} It could not be replaced: ${String(error)}`);
+    }
+  }
+
+  /** Draws `picture`; false when there is nothing to draw with (a device being replaced). */
+  draw(picture: EnginePicture, size: PictureSize, viewport: Viewport): boolean {
+    const entry = this.entry;
+    const presenter = this.presenter;
+    if (!entry || !presenter || this.failed || this.halted) return false;
+    const { device } = entry;
+    const { width, height } = sizeCanvas(
+      this.canvas,
+      viewport,
+      device.limits.maxTextureDimension2D,
+    );
+    device.pushErrorScope("validation");
+    try {
+      presenter.draw(
+        picture,
+        size,
+        viewport.fit,
+        this.context.getCurrentTexture().createView(),
+        width,
+        height,
+      );
+    } finally {
+      void device.popErrorScope().then(
+        (error) => {
+          if (!error) return;
+          entry.error ??= error.message;
+          if (entry === this.entry) this.deviceError(error.message);
+        },
+        // A lost device rejects the pop; the loss itself is handled above.
+        () => {},
+      );
+    }
+    return true;
+  }
+
+  stop(): void {
+    this.halted = true;
+    // A device replacement still in flight finds itself unwanted and hands
+    // its device back.
+    this.generation += 1;
+  }
+
+  destroy(): void {
+    if (this.disposed) return;
+    this.disposed = true;
+    this.generation += 1;
+    this.context.unconfigure();
+    this.canvas.remove();
+    this.release();
+  }
+}
+
+/** The green value a 2D canvas draws for a 16x16 grey I420 frame of `code` with this tag. */
+function canvasGreen(
+  context: CanvasRenderingContext2D,
+  code: number,
+  colorSpace: VideoColorSpaceInit,
+): number {
+  const size = 16;
+  const data = new Uint8Array((size * size * 3) / 2);
+  data.fill(Math.round(16 + 219 * code), 0, size * size);
+  data.fill(128, size * size);
+  const frame = new VideoFrame(data, {
+    format: "I420",
+    codedWidth: size,
+    codedHeight: size,
+    timestamp: 0,
+    colorSpace,
+  });
+  try {
+    context.drawImage(frame, 0, 0);
+    return context.getImageData(size / 2, size / 2, 1, 1).data[1]!;
+  } finally {
+    frame.close();
+  }
+}
+
+/** Codes probed per transfer: a dark one, reference white, and a highlight. */
+const CANVAS_PROBE_CODES = {
+  // About 5, 203 and 1000 nits.
+  pq: [0.3, 0.58, 0.75],
+  hlg: [0.3, 0.75, 0.9],
+} as const;
+
+const canvasMapping: Partial<Record<"pq" | "hlg", boolean>> = {};
+
+/**
+ * Whether the 2D canvas tone-maps frames of this transfer the way a <video>
+ * element does (Chromium and Safari do; Firefox draws the raw codes). The dark
+ * code must not come out as if it were sRGB, reference white must stay below
+ * clipping (a conversion without tone mapping clips it), and the three codes
+ * must keep their order. Measured once per page and transfer, on a canvas set
+ * up like the presenter's own, and only when a session first needs it: each
+ * draw reads pixels back, which takes a second on some Linux GPU stacks.
+ */
+export function canvasMapsHDR(transfer: "pq" | "hlg"): boolean {
+  return (canvasMapping[transfer] ??= measureCanvasMapping(transfer));
+}
+
+function measureCanvasMapping(transfer: "pq" | "hlg"): boolean {
+  try {
+    const canvas = document.createElement("canvas");
+    canvas.width = 16;
+    canvas.height = 16;
+    const context = canvas.getContext("2d", { alpha: false });
+    if (!context || typeof VideoFrame === "undefined") return false;
+    const tag = {
+      primaries: "bt2020" as VideoColorPrimaries,
+      transfer: transfer as VideoTransferCharacteristics,
+      matrix: "bt2020-ncl" as VideoMatrixCoefficients,
+      fullRange: false,
+    };
+    const codes = CANVAS_PROBE_CODES[transfer];
+    const [dark, white, highlight] = codes.map((code) => canvasGreen(context, code, tag));
+    const darkAsSRGB = canvasGreen(context, codes[0], {
+      primaries: "bt709",
+      transfer: "iec61966-2-1",
+      matrix: "bt709",
+      fullRange: false,
+    });
+    return (
+      Math.abs(dark! - darkAsSRGB) > 8 && white! < 245 && dark! < white! && white! < highlight!
+    );
+  } catch {
+    return false;
+  }
+}
+
+export function resetPresenterStateForTests(): void {
+  delete canvasMapping.pq;
+  delete canvasMapping.hlg;
+  spare?.device.destroy();
+  spare = null;
+  probing = null;
+  spareWaiters = [];
+}
+
+/**
+ * Presents an HDR session. Each picture goes to the path its kind and color
+ * tag call for (see `routePicture`): the WebGPU tone map, or the browser's 2D
+ * canvas for frames only the browser can map. The two draw on separate
+ * canvases because a canvas keeps the first context type it hands out; the
+ * one that drew last is shown.
+ */
+export class HDRPresenter implements FrameRenderer {
+  private canvasLayer: Canvas2DRenderer | null = null;
+
+  private constructor(
+    private readonly surface: HTMLElement,
+    private readonly gpu: WebGPURenderer,
+    private readonly transfer: "pq" | "hlg",
+  ) {}
+
+  static async create(
+    surface: HTMLElement,
+    transfer: "pq" | "hlg",
+    color: PictureColor,
+    events: PresenterEvents,
+  ): Promise<HDRPresenter> {
+    const canvas = addLayer(surface);
+    try {
+      const gpu = await WebGPURenderer.create(canvas, transfer, color, events);
+      return new HDRPresenter(surface, gpu, transfer);
+    } catch (error) {
+      canvas.remove();
+      throw error;
+    }
+  }
+
+  draw(picture: EnginePicture, size: PictureSize, viewport: Viewport): void {
+    switch (routePicture(picture)) {
+      case "planes":
+      case "frame":
+        // While a lost device is being replaced, the last picture stays up.
+        if (this.gpu.draw(picture, size, viewport)) this.show(this.gpu.element);
+        return;
+      case "browser": {
+        if (!canvasMapsHDR(this.transfer)) {
+          throw new Error(
+            "This browser cannot map a hardware-decoded HDR frame for an SDR screen.",
+          );
+        }
+        this.canvasLayer ??= Canvas2DRenderer.in(this.surface);
+        this.canvasLayer.draw(picture, size, viewport);
+        this.show(this.canvasLayer.element);
+        return;
+      }
+      case "unsupported": {
+        const colorSpace = (picture as { frame: VideoFrame }).frame.colorSpace;
+        throw new Error(
+          `A decoded HDR frame has a color tag the engine cannot interpret ` +
+            `(transfer ${colorSpace?.transfer ?? "none"}, primaries ${colorSpace?.primaries ?? "none"}).`,
+        );
+      }
+    }
+  }
+
+  stop(): void {
+    this.gpu.stop();
+  }
+
+  private show(canvas: HTMLCanvasElement): void {
+    for (const layer of [this.gpu.element, this.canvasLayer?.element]) {
+      if (layer) layer.style.display = layer === canvas ? "block" : "none";
+    }
+  }
+
+  destroy(): void {
+    this.gpu.destroy();
+    this.canvasLayer?.destroy();
+    this.canvasLayer = null;
+  }
+}
diff --git a/web/src/player/engine/routing.test.ts b/web/src/player/engine/routing.test.ts
new file mode 100644
index 0000000000..c3f85e1678
--- /dev/null
+++ b/web/src/player/engine/routing.test.ts
@@ -0,0 +1,237 @@
+import { describe, expect, it } from "vitest";
+import { fixturePlanV3 } from "../protocol-v3.fixtures";
+import type { PlanV3 } from "../protocol-v3";
+import type { EngineCapabilities } from "./capabilities";
+import {
+  containerDefaultAudioOrdinal,
+  ENGINE_UNSUPPORTED_SOURCE,
+  engineTransferForPlan,
+  resolveOriginalPlaybackRoute,
+  type NativeOriginalSupport,
+} from "./routing";
+
+const native: NativeOriginalSupport = {
+  containers: ["mp4", "mkv"],
+  videoCodecs: ["h264", "av1", "vp9"],
+  audioCodecs: ["aac", "opus", "flac"],
+};
+
+const engine: EngineCapabilities = {
+  containers: ["mkv", "mp4"],
+  videoCodecs: ["h264", "hevc", "av1", "vp9"],
+  audioCodecs: ["aac", "opus", "flac", "ac3", "eac3", "dts", "truehd", "mlp"],
+  hdr: true,
+};
+
+function originalPlan(overrides: {
+  source?: Partial<PlanV3["source"]>;
+  recipe?: Partial<PlanV3["effective_recipe"]>;
+  audioIndex?: number;
+}): PlanV3 {
+  const base = fixturePlanV3();
+  return {
+    ...base,
+    delivery: "original_http",
+    stream: { ...base.stream, protocol: "http_progressive", container: "mkv", headers: {} },
+    timeline: { ...base.timeline, player_start_seconds: 42 },
+    selected_tracks:
+      overrides.audioIndex === undefined
+        ? base.selected_tracks
+        : { audio: { id: `file:1:audio:${overrides.audioIndex}`, index: overrides.audioIndex } },
+    effective_recipe: { video_codec: "h264", audio_codec: "aac", ...overrides.recipe },
+    source: {
+      ...base.source,
+      container: "mkv",
+      video_codec: "h264",
+      audio_codec: "aac",
+      dynamic_range: "sdr",
+      width: 1920,
+      height: 1080,
+      duration_seconds: 3600,
+      ...overrides.source,
+    },
+  };
+}
+
+const audioTracks = [{ codec: "aac" }, { codec: "truehd", default: true }];
+
+describe("resolveOriginalPlaybackRoute", () => {
+  it("leaves files the media element plays to the media element", () => {
+    const route = resolveOriginalPlaybackRoute({
+      plan: originalPlan({ audioIndex: 1, recipe: { audio_codec: "aac" } }),
+      streamUrl: "/stream",
+      native,
+      engine,
+      audioTracks: [{ codec: "aac" }, { codec: "aac", default: true }],
+    });
+    expect(route).toEqual({ kind: "native" });
+  });
+
+  it("sends audio the element cannot decode to the engine", () => {
+    const route = resolveOriginalPlaybackRoute({
+      plan: originalPlan({ audioIndex: 1, recipe: { audio_codec: "truehd", audio_channels: 8 } }),
+      streamUrl: "/stream?st=1",
+      native,
+      engine,
+      audioTracks,
+    });
+    expect(route).toEqual({
+      kind: "engine",
+      source: {
+        url: "/stream?st=1",
+        headers: {},
+        container: "mkv",
+        durationSeconds: 3600,
+        startSeconds: 42,
+        video: {
+          codec: "h264",
+          width: 1920,
+          height: 1080,
+          transfer: "sdr",
+          stripDolbyVision: false,
+        },
+        audio: { ordinal: 1, codec: "truehd", channels: 8 },
+      },
+    });
+  });
+
+  it("uses the engine for a non-default audio track the element cannot choose", () => {
+    const route = resolveOriginalPlaybackRoute({
+      plan: originalPlan({ audioIndex: 0 }),
+      streamUrl: "/stream",
+      native,
+      engine,
+      audioTracks,
+    });
+    expect(route.kind).toBe("engine");
+  });
+
+  it("presents HDR and Dolby Vision base layers through the engine", () => {
+    const hdr = resolveOriginalPlaybackRoute({
+      plan: originalPlan({
+        source: { dynamic_range: "hdr10", video_codec: "hevc" },
+        recipe: { video_codec: "hevc" },
+      }),
+      streamUrl: "/stream",
+      native,
+      engine,
+      audioTracks: [],
+    });
+    expect(hdr.kind === "engine" && hdr.source.video.transfer).toBe("pq");
+
+    const dv = resolveOriginalPlaybackRoute({
+      plan: originalPlan({
+        source: { dynamic_range: "dolby_vision", dv_bl_compat_id: 4, video_codec: "hevc" },
+        recipe: { video_codec: "hevc" },
+      }),
+      streamUrl: "/stream",
+      native,
+      engine,
+      audioTracks: [],
+    });
+    expect(dv.kind === "engine" && dv.source.video).toMatchObject({
+      transfer: "hlg",
+      stripDolbyVision: true,
+    });
+  });
+
+  it("leaves an HDR original the plan validated for this display to the media element", () => {
+    for (const [range, claim] of [
+      ["hdr10", "hdr10"],
+      ["hlg", "hlg"],
+    ] as const) {
+      const plan = originalPlan({
+        source: { dynamic_range: range, video_codec: "hevc" },
+        recipe: { video_codec: "hevc" },
+      });
+      plan.claims = { ...plan.claims, video: { ...plan.claims.video, [claim]: true } };
+      const route = resolveOriginalPlaybackRoute({
+        plan,
+        streamUrl: "/stream",
+        native: { ...native, videoCodecs: [...native.videoCodecs, "hevc"] },
+        engine,
+        audioTracks: [],
+      });
+      expect(route.kind).toBe("native");
+    }
+  });
+
+  it("refuses with a typed failure what neither can play", () => {
+    const profile5 = resolveOriginalPlaybackRoute({
+      plan: originalPlan({
+        source: { dynamic_range: "dolby_vision", dv_bl_compat_id: 0, video_codec: "hevc" },
+        recipe: { video_codec: "hevc" },
+      }),
+      streamUrl: "/stream",
+      native,
+      engine,
+      audioTracks: [],
+    });
+    expect(profile5).toMatchObject({
+      kind: "unsupported",
+      failure: { classification: ENGINE_UNSUPPORTED_SOURCE },
+    });
+
+    const noWebGPU = resolveOriginalPlaybackRoute({
+      plan: originalPlan({ source: { dynamic_range: "hdr10" } }),
+      streamUrl: "/stream",
+      native,
+      engine: { ...engine, hdr: false },
+      audioTracks: [],
+    });
+    expect(noWebGPU.kind).toBe("unsupported");
+
+    const avi = resolveOriginalPlaybackRoute({
+      plan: originalPlan({ source: { container: "avi" }, recipe: { audio_codec: "dts" } }),
+      streamUrl: "/stream",
+      native,
+      engine,
+      audioTracks: [],
+    });
+    expect(avi.kind).toBe("unsupported");
+  });
+
+  it("reports a typed failure instead of guessing when the engine is off", () => {
+    const route = resolveOriginalPlaybackRoute({
+      plan: originalPlan({ recipe: { audio_codec: "dts" } }),
+      streamUrl: "/stream",
+      native,
+      engine: null,
+      audioTracks: [],
+    });
+    expect(route.kind).toBe("unsupported");
+  });
+});
+
+describe("engineTransferForPlan", () => {
+  it("maps every server range label", () => {
+    const transfer = (dynamic_range: string, dv_bl_compat_id?: number) =>
+      engineTransferForPlan(originalPlan({ source: { dynamic_range, dv_bl_compat_id } }));
+    expect(transfer("sdr")).toBe("sdr");
+    expect(transfer("hdr10")).toBe("pq");
+    expect(transfer("hdr10_plus")).toBe("pq");
+    expect(transfer("hdr_unknown")).toBe("pq");
+    expect(transfer("hlg")).toBe("hlg");
+    expect(transfer("dolby_vision", 1)).toBe("pq");
+    expect(transfer("dolby_vision", 6)).toBe("pq");
+    expect(transfer("dolby_vision", 2)).toBe("sdr");
+    expect(transfer("dolby_vision", 0)).toBeNull();
+    expect(transfer("something_new")).toBeNull();
+  });
+
+  it("prefers the plan's effective range over the source's", () => {
+    const plan = originalPlan({
+      source: { dynamic_range: "dolby_vision", dv_bl_compat_id: 1 },
+      recipe: { dynamic_range: "hdr10" },
+    });
+    expect(engineTransferForPlan(plan)).toBe("pq");
+  });
+});
+
+describe("containerDefaultAudioOrdinal", () => {
+  it("matches the server: the first default-flagged track, else the first", () => {
+    expect(containerDefaultAudioOrdinal([])).toBe(0);
+    expect(containerDefaultAudioOrdinal([{}, { default: true }, { default: true }])).toBe(1);
+    expect(containerDefaultAudioOrdinal([{}, {}])).toBe(0);
+  });
+});
diff --git a/web/src/player/engine/routing.ts b/web/src/player/engine/routing.ts
new file mode 100644
index 0000000000..77033afd46
--- /dev/null
+++ b/web/src/player/engine/routing.ts
@@ -0,0 +1,152 @@
+import type { FailureV3, PlanV3 } from "../protocol-v3";
+import type { PlayerAudioTrack } from "../types";
+import type { EngineCapabilities } from "./capabilities";
+import type { EngineSourceSpec, EngineTransfer } from "./source";
+
+/** What the browser's own media element accepts for an untouched original. */
+export interface NativeOriginalSupport {
+  containers: string[];
+  videoCodecs: string[];
+  audioCodecs: string[];
+}
+
+export type OriginalPlaybackRoute =
+  | { kind: "native" }
+  | { kind: "engine"; source: EngineSourceSpec }
+  | { kind: "unsupported"; failure: FailureV3 };
+
+/** Typed failure the server's replan ladder records against this plan. */
+export const ENGINE_UNSUPPORTED_SOURCE = "browser_engine_unsupported_source";
+
+function lower(value: string | undefined | null): string {
+  return (value ?? "").trim().toLowerCase();
+}
+
+/** The audio ordinal a media element plays when it is not told otherwise. */
+export function containerDefaultAudioOrdinal(audioTracks: readonly PlayerAudioTrack[]): number {
+  const index = audioTracks.findIndex((track) => track.default === true);
+  return index >= 0 ? index : 0;
+}
+
+/**
+ * Maps a plan's dynamic range onto the transfer the engine presents, or null
+ * when no route can present it. Dolby Vision is played through its
+ * standards-compatible base layer: Profile 8.1 and Profile 7 carry HDR10, 8.4
+ * carries HLG and 8.2 carries SDR. Profile 5 has no compatible base layer.
+ */
+export function engineTransferForPlan(plan: PlanV3): EngineTransfer | null {
+  const range = lower(plan.effective_recipe.dynamic_range || plan.source.dynamic_range);
+  switch (range) {
+    case "":
+    case "sdr":
+      return "sdr";
+    case "hdr10":
+    case "hdr10_plus":
+    case "hdr_unknown":
+      return "pq";
+    case "hlg":
+      return "hlg";
+    case "dolby_vision":
+      switch (plan.source.dv_bl_compat_id) {
+        case 1:
+        case 6:
+          return "pq";
+        case 4:
+          return "hlg";
+        case 2:
+          return "sdr";
+        default:
+          return null;
+      }
+    default:
+      return null;
+  }
+}
+
+function unsupported(message: string): OriginalPlaybackRoute {
+  return { kind: "unsupported", failure: { classification: ENGINE_UNSUPPORTED_SOURCE, message } };
+}
+
+/**
+ * Chooses who plays an `original_http` plan: the media element when it can
+ * take the file as it is, otherwise the decode engine, otherwise nobody — in
+ * which case the typed failure lets the server replan onto a packaged route.
+ *
+ * The media element wins whenever it can, because it decodes in hardware with
+ * the browser's own A/V sync. It cannot pick an audio track, present an HDR
+ * source on a page it does not control, or decode the formats the engine
+ * exists for.
+ */
+export function resolveOriginalPlaybackRoute(input: {
+  plan: PlanV3;
+  streamUrl: string;
+  native: NativeOriginalSupport;
+  engine: EngineCapabilities | null;
+  audioTracks: readonly PlayerAudioTrack[];
+}): OriginalPlaybackRoute {
+  const { plan, streamUrl, native, engine, audioTracks } = input;
+  const container = lower(plan.source.container || plan.stream.container);
+  const videoCodec = lower(plan.effective_recipe.video_codec || plan.source.video_codec);
+  const audioCodec = lower(plan.effective_recipe.audio_codec || plan.source.audio_codec);
+  const defaultOrdinal = containerDefaultAudioOrdinal(audioTracks);
+  const audioOrdinal = plan.selected_tracks.audio?.index ?? defaultOrdinal;
+  const transfer = engineTransferForPlan(plan);
+
+  // An HDR original the plan validated for this display plays natively, in
+  // HDR; the engine would tone-map it down to SDR.
+  const claims = plan.claims.video;
+  const nativeRange =
+    transfer === "sdr" ||
+    (transfer === "hlg" && claims.hlg) ||
+    (transfer === "pq" && (claims.hdr10 || claims.hdr10_plus || claims.dolby_vision));
+  const nativePlays =
+    native.containers.includes(container) &&
+    native.videoCodecs.includes(videoCodec) &&
+    nativeRange &&
+    (audioCodec === "" || native.audioCodecs.includes(audioCodec)) &&
+    audioOrdinal === defaultOrdinal;
+  if (nativePlays) return { kind: "native" };
+
+  if (!engine) return unsupported("The browser cannot play this file as it is.");
+  if (!engine.containers.includes(container)) {
+    return unsupported(`The browser engine cannot read ${container || "this"} containers.`);
+  }
+  if (!engine.videoCodecs.includes(videoCodec)) {
+    return unsupported(`This browser cannot decode ${videoCodec || "this"} video.`);
+  }
+  if (audioCodec !== "" && !engine.audioCodecs.includes(audioCodec)) {
+    return unsupported(`The browser engine cannot decode ${audioCodec} audio.`);
+  }
+  if (transfer === null) {
+    return unsupported("The browser engine cannot present this dynamic range.");
+  }
+  if (transfer !== "sdr" && !engine.hdr) {
+    return unsupported("HDR needs a working WebGPU presenter, which this browser does not have.");
+  }
+
+  return {
+    kind: "engine",
+    source: {
+      url: streamUrl,
+      headers: plan.stream.headers ?? {},
+      container,
+      durationSeconds: plan.source.duration_seconds ?? null,
+      startSeconds: Math.max(0, plan.timeline.player_start_seconds),
+      video: {
+        codec: videoCodec,
+        width: plan.source.width ?? 0,
+        height: plan.source.height ?? 0,
+        transfer,
+        stripDolbyVision: lower(plan.source.dynamic_range) === "dolby_vision",
+      },
+      audio:
+        audioCodec === ""
+          ? null
+          : {
+              ordinal: audioOrdinal,
+              codec: audioCodec,
+              channels: plan.effective_recipe.audio_channels ?? plan.source.audio_channels ?? null,
+            },
+    },
+  };
+}
diff --git a/web/src/player/engine/settings.ts b/web/src/player/engine/settings.ts
new file mode 100644
index 0000000000..fe78af6786
--- /dev/null
+++ b/web/src/player/engine/settings.ts
@@ -0,0 +1,17 @@
+import { storage } from "@/utils/storage";
+
+/**
+ * Whether this browser decodes media itself when the browser's own player
+ * cannot (Dolby TrueHD and DTS audio, HDR on SDR screens, Matroska in Firefox).
+ *
+ * The choice is per browser, like volume: it describes what this browser and
+ * GPU can do, not the viewer's account. Off by default while the engine is in
+ * beta.
+ */
+export function isBrowserDecodingEnabled(): boolean {
+  return storage.get(storage.KEYS.BROWSER_DECODING) === "true";
+}
+
+export function setBrowserDecodingEnabled(enabled: boolean): void {
+  storage.set(storage.KEYS.BROWSER_DECODING, enabled ? "true" : "false");
+}
diff --git a/web/src/player/engine/source.test.ts b/web/src/player/engine/source.test.ts
new file mode 100644
index 0000000000..57377b09e7
--- /dev/null
+++ b/web/src/player/engine/source.test.ts
@@ -0,0 +1,27 @@
+import { describe, expect, it } from "vitest";
+import { redactStreamUrls } from "./source";
+
+describe("redactStreamUrls", () => {
+  it("removes stream URLs and keeps the rest of a fetch error", () => {
+    expect(
+      redactStreamUrls(
+        "Could not read the file: Error: Error fetching https://media.example/stream/direct/eyJh.eyJz.c2ln: 503 Service Unavailable",
+      ),
+    ).toBe("Could not read the file: Error: Error fetching <stream URL>: 503 Service Unavailable");
+    expect(redactStreamUrls("Error fetching http://host:8090/s?token=abc")).toBe(
+      "Error fetching <stream URL>",
+    );
+    expect(redactStreamUrls("Decoder closed")).toBe("Decoder closed");
+  });
+
+  it("removes same-origin stream paths and their tokens", () => {
+    const url = "/api/v2/stream/direct/eyJh.eyJz.c2ln?st=abc&token=def";
+    expect(redactStreamUrls(`Error fetching ${url}: 401 Unauthorized`, url)).toBe(
+      "Error fetching <stream URL>: 401 Unauthorized",
+    );
+    // Without the plan's URL to match, a relative path with a token still goes.
+    expect(redactStreamUrls(`Error fetching ${url}: 401 Unauthorized`)).toBe(
+      "Error fetching <stream URL>: 401 Unauthorized",
+    );
+  });
+});
diff --git a/web/src/player/engine/source.ts b/web/src/player/engine/source.ts
new file mode 100644
index 0000000000..91ee5926c1
--- /dev/null
+++ b/web/src/player/engine/source.ts
@@ -0,0 +1,43 @@
+/** How the engine must interpret decoded video samples. */
+export type EngineTransfer = "sdr" | "pq" | "hlg";
+
+/**
+ * Everything the engine needs to play one `original_http` plan, resolved on
+ * the page from the plan and handed to the engine as plain data.
+ */
+export interface EngineSourceSpec {
+  url: string;
+  headers: Record<string, string>;
+  /** Server container name: `mkv` (Matroska and WebM) or `mp4`. */
+  container: string;
+  /** Plan runtime; the engine falls back to the container's own when null. */
+  durationSeconds: number | null;
+  /** Source position playback starts from. */
+  startSeconds: number;
+  video: {
+    codec: string;
+    width: number;
+    height: number;
+    transfer: EngineTransfer;
+    /**
+     * Drop Dolby Vision RPU and enhancement-layer NAL units before decoding,
+     * so an ordinary HEVC decoder sees only the base layer.
+     */
+    stripDolbyVision: boolean;
+  };
+  /** The selected audio track, by ordinal among the file's audio tracks. */
+  audio: { ordinal: number; codec: string; channels: number | null } | null;
+}
+
+/**
+ * Fetch errors quote the stream URL, which carries the stream token and, for
+ * API-local routes, the access token. A failure message goes to the server and
+ * its logs, so the URL is left out: the plan's own URL wherever it appears,
+ * any absolute URL, and any relative path with a token in its query.
+ */
+export function redactStreamUrls(message: string, streamUrl?: string): string {
+  const withoutStream = streamUrl ? message.split(streamUrl).join("<stream URL>") : message;
+  return withoutStream
+    .replace(/https?:\/\/\S+?(?=:?(?:\s|$))/g, "<stream URL>")
+    .replace(/(^|\s)\/\S*?[?&](?:token|st)=\S+?(?=:?(?:\s|$))/g, "$1<stream URL>");
+}
diff --git a/web/src/player/engine/testdata/ac3.mka b/web/src/player/engine/testdata/ac3.mka
new file mode 100644
index 0000000000..7356b80867
Binary files /dev/null and b/web/src/player/engine/testdata/ac3.mka differ
diff --git a/web/src/player/engine/testdata/dts.mka b/web/src/player/engine/testdata/dts.mka
new file mode 100644
index 0000000000..75cef82810
Binary files /dev/null and b/web/src/player/engine/testdata/dts.mka differ
diff --git a/web/src/player/engine/testdata/eac3.mka b/web/src/player/engine/testdata/eac3.mka
new file mode 100644
index 0000000000..125de85621
Binary files /dev/null and b/web/src/player/engine/testdata/eac3.mka differ
diff --git a/web/src/player/engine/testdata/mlp.mka b/web/src/player/engine/testdata/mlp.mka
new file mode 100644
index 0000000000..de00037e6d
Binary files /dev/null and b/web/src/player/engine/testdata/mlp.mka differ
diff --git a/web/src/player/engine/testdata/truehd.mka b/web/src/player/engine/testdata/truehd.mka
new file mode 100644
index 0000000000..fe049a7751
Binary files /dev/null and b/web/src/player/engine/testdata/truehd.mka differ
diff --git a/web/src/player/engine/textTracks.ts b/web/src/player/engine/textTracks.ts
new file mode 100644
index 0000000000..4ecb5f2640
--- /dev/null
+++ b/web/src/player/engine/textTracks.ts
@@ -0,0 +1,52 @@
+/**
+ * A programmatic TextTrack driven by the engine's clock.
+ *
+ * The browser activates cues on a media element only as its own media
+ * timeline advances, and an engine-driven element has none. The player's text
+ * subtitles (useSubtitleTracks) create a track with `addTextTrack`, add VTTCues
+ * and listen for `cuechange`; this stand-in offers the same surface and
+ * recomputes the active cues on every engine tick.
+ */
+export class EngineTextTrack extends EventTarget {
+  mode: TextTrackMode = "disabled";
+  private cueList: TextTrackCue[] = [];
+  private active: TextTrackCue[] = [];
+
+  constructor(
+    readonly kind: TextTrackKind,
+    readonly label: string,
+    readonly language: string,
+  ) {
+    super();
+  }
+
+  get cues(): TextTrackCueList | null {
+    return this.mode === "disabled" ? null : (this.cueList as unknown as TextTrackCueList);
+  }
+
+  get activeCues(): TextTrackCueList | null {
+    return this.mode === "disabled" ? null : (this.active as unknown as TextTrackCueList);
+  }
+
+  addCue(cue: TextTrackCue): void {
+    this.cueList.push(cue);
+  }
+
+  removeCue(cue: TextTrackCue): void {
+    const index = this.cueList.indexOf(cue);
+    if (index >= 0) this.cueList.splice(index, 1);
+  }
+
+  /** Recomputes the active cues for `time` and fires `cuechange` when they change. */
+  update(time: number): void {
+    const next =
+      this.mode === "disabled"
+        ? []
+        : this.cueList.filter((cue) => cue.startTime <= time && time < cue.endTime);
+    if (next.length === this.active.length && next.every((cue, i) => cue === this.active[i])) {
+      return;
+    }
+    this.active = next;
+    this.dispatchEvent(new Event("cuechange"));
+  }
+}
diff --git a/web/src/player/engine/timeStretch.ts b/web/src/player/engine/timeStretch.ts
new file mode 100644
index 0000000000..2b0d7e994a
--- /dev/null
+++ b/web/src/player/engine/timeStretch.ts
@@ -0,0 +1,233 @@
+/**
+ * Playback speed for the engine's audio that keeps its pitch (WSOLA: waveform
+ * similarity overlap-add). Runs on the audio thread, inside the worklet.
+ *
+ * The worklet keeps stepping its read head through the queue at the playback
+ * rate, as it does for the clock. Each time the stretcher's output runs out it
+ * builds the next sequence from the PCM at the head: a stretch of the input
+ * played at its own speed, so its pitch is the original's. Consecutive
+ * sequences overlap and crossfade; each starts at the offset, within a short
+ * search window, whose waveform best continues the previous one, so the joins
+ * do not cancel or smear. Playing faster skips the input between sequences,
+ * playing slower repeats some of it.
+ *
+ * Within a sequence the audio advances at 1x while the head, and the clock
+ * the video follows, advance at the playback rate. Above 1x each sequence
+ * after the first therefore starts half a sequence's skip past the head, so
+ * the audio is centred on the clock rather than trailing it.
+ *
+ * Every buffer is allocated up front: the audio thread must not collect
+ * garbage mid-quantum.
+ */
+
+/** Crossfade between consecutive sequences. */
+const OVERLAP_SECONDS = 0.008;
+/** How far past the read head a sequence may start, to match the waveform. */
+const SEARCH_SECONDS = 0.015;
+/**
+ * Sequence length at and below SLOW_RATE, and at and above FAST_RATE, with a
+ * straight line between. Slow speeds repeat input, so longer sequences make
+ * fewer, less audible repeats; fast speeds skip input, so shorter sequences
+ * keep the skipped stretches short.
+ */
+const SLOW_SEQUENCE_SECONDS = 0.06;
+const FAST_SEQUENCE_SECONDS = 0.04;
+const SLOW_RATE = 0.5;
+const FAST_RATE = 1.5;
+/** The fastest rate the input buffers are sized for; faster rates centre as this one. */
+const MAX_RATE = 4;
+/**
+ * Bounds the offset search on any channel count and sample rate. Candidates
+ * are first tried on a coarse grid, then one by one around the best of them,
+ * and each comparison reads at most this many samples.
+ */
+const COARSE_CANDIDATES = 60;
+const MAX_CORRELATION_SAMPLES = 256;
+
+export class TimeStretcher {
+  private readonly overlap: number;
+  private readonly search: number;
+  private readonly coarseStep: number;
+  /** Compares every stride-th frame of the overlap. */
+  private readonly stride: number;
+  /** Interleaved output of the current sequence. */
+  private readonly out: Float32Array;
+  private outLength = 0;
+  private outPosition = 0;
+  /** The input that would follow the last sequence: the next one fades in from it. */
+  private readonly tail: Float32Array;
+  private hasTail = false;
+  /** Frames of `out` and `tail` still to blend into unstretched playback. */
+  private fadeRemaining = 0;
+  private fadePosition = 0;
+
+  constructor(
+    private readonly channels: number,
+    private readonly sampleRate: number,
+  ) {
+    this.overlap = Math.max(1, Math.round(OVERLAP_SECONDS * sampleRate));
+    this.search = Math.max(1, Math.round(SEARCH_SECONDS * sampleRate));
+    this.coarseStep = Math.max(1, Math.ceil(this.search / COARSE_CANDIDATES));
+    this.stride = Math.max(1, Math.ceil((this.overlap * channels) / MAX_CORRELATION_SAMPLES));
+    this.out = new Float32Array(this.sequenceFrames(0) * channels);
+    this.tail = new Float32Array(this.overlap * channels);
+  }
+
+  /** Input frames past the read head that the next sequence at `rate` reads. */
+  inputFrames(rate: number): number {
+    return this.lead(rate) + this.search + this.sequenceFrames(rate);
+  }
+
+  /** The most input any sequence reads, for sizing the caller's buffer. */
+  get maxInputFrames(): number {
+    return Math.max(this.inputFrames(0), this.inputFrames(MAX_RATE));
+  }
+
+  /** Frames of the current sequence not yet played. */
+  get pending(): number {
+    return this.outLength - this.outPosition;
+  }
+
+  /** Forgets the current sequence, as after a seek or a gap in the audio. */
+  reset(): void {
+    this.outLength = 0;
+    this.outPosition = 0;
+    this.hasTail = false;
+    this.fadeRemaining = 0;
+  }
+
+  /**
+   * Builds the next sequence from `input`: interleaved PCM starting at the
+   * read head, at least `inputFrames(rate)` frames of it.
+   */
+  build(rate: number, input: Float32Array): void {
+    const channels = this.channels;
+    const overlap = this.overlap;
+    const frames = this.sequenceFrames(rate);
+    // The first sequence continues from the head exactly, as unstretched
+    // playback left off; later ones are matched to the one before.
+    const start = this.hasTail ? this.bestOffset(input, this.lead(rate)) * channels : 0;
+    const out = this.out;
+    const tail = this.tail;
+    const fade = overlap * channels;
+    if (this.hasTail) {
+      for (let frame = 0; frame < overlap; frame++) {
+        const w = (frame + 1) / (overlap + 1);
+        for (let c = 0; c < channels; c++) {
+          const i = frame * channels + c;
+          out[i] = tail[i]! + (input[start + i]! - tail[i]!) * w;
+        }
+      }
+    }
+    const length = (frames - overlap) * channels;
+    for (let i = this.hasTail ? fade : 0; i < length; i++) out[i] = input[start + i]!;
+    for (let i = 0; i < fade; i++) tail[i] = input[start + length + i]!;
+    this.hasTail = true;
+    this.outLength = frames - overlap;
+    this.outPosition = 0;
+    this.fadeRemaining = 0;
+  }
+
+  /** Writes the next frame of the current sequence to `output` at `index`. */
+  take(output: Float32Array[], index: number, channels: number): void {
+    const base = this.outPosition * this.channels;
+    for (let c = 0; c < channels; c++) output[c]![index] = this.out[base + c]!;
+    this.outPosition += 1;
+  }
+
+  /**
+   * Hands over to unstretched playback: the next `blend` calls fade from what
+   * the stretcher would have played into what plays instead, so the switch
+   * does not click.
+   */
+  release(): void {
+    if (!this.hasTail) return;
+    this.fadeRemaining = this.overlap;
+    this.fadePosition = 0;
+    this.hasTail = false;
+  }
+
+  /** Fades frame `index` of `output`, already written, in from the stretcher's audio. */
+  blend(output: Float32Array[], index: number, channels: number): void {
+    if (this.fadeRemaining === 0) return;
+    const pending = this.outLength - this.outPosition;
+    const frame = this.fadePosition;
+    const source = frame < pending ? this.out : this.tail;
+    const base = (frame < pending ? this.outPosition + frame : frame - pending) * this.channels;
+    const w = (frame + 1) / (this.overlap + 1);
+    for (let c = 0; c < channels; c++) {
+      const from = source[base + c]!;
+      output[c]![index] = from + (output[c]![index]! - from) * w;
+    }
+    this.fadePosition += 1;
+    this.fadeRemaining -= 1;
+    if (this.fadeRemaining === 0) {
+      this.outLength = 0;
+      this.outPosition = 0;
+    }
+  }
+
+  /** Frames past the head where a sequence's search starts, centring it on the clock. */
+  private lead(rate: number): number {
+    if (rate <= 1) return 0;
+    const skip = this.sequenceFrames(rate) - this.overlap;
+    return Math.round((skip * (Math.min(rate, MAX_RATE) - 1)) / 2);
+  }
+
+  private sequenceFrames(rate: number): number {
+    const t = Math.min(1, Math.max(0, (rate - SLOW_RATE) / (FAST_RATE - SLOW_RATE)));
+    const seconds = SLOW_SEQUENCE_SECONDS + (FAST_SEQUENCE_SECONDS - SLOW_SEQUENCE_SECONDS) * t;
+    return Math.max(2 * this.overlap + 1, Math.round(seconds * this.sampleRate));
+  }
+
+  /**
+   * The start offset, in frames past the read head and within the search
+   * window from `from`, that best continues the tail.
+   */
+  private bestOffset(input: Float32Array, from: number): number {
+    const last = from + this.search - 1;
+    let best = from;
+    let bestScore = -Infinity;
+    for (let offset = from; offset <= last; offset += this.coarseStep) {
+      const score = this.similarity(input, offset);
+      if (score > bestScore) {
+        bestScore = score;
+        best = offset;
+      }
+    }
+    const low = Math.max(from, best - this.coarseStep + 1);
+    const high = Math.min(last, best + this.coarseStep - 1);
+    for (let offset = low; offset <= high; offset++) {
+      if (offset === best) continue;
+      const score = this.similarity(input, offset);
+      if (score > bestScore) {
+        bestScore = score;
+        best = offset;
+      }
+    }
+    return best;
+  }
+
+  /**
+   * Normalized cross-correlation of the tail with the input at `offset`, over
+   * every channel together: a mono downmix would cancel channels that are out
+   * of phase with each other.
+   */
+  private similarity(input: Float32Array, offset: number): number {
+    const channels = this.channels;
+    const tail = this.tail;
+    const step = this.stride * channels;
+    const end = this.overlap * channels;
+    const base = offset * channels;
+    let correlation = 0;
+    let energy = 0;
+    for (let i = 0; i < end; i += step) {
+      for (let c = 0; c < channels; c++) {
+        const x = input[base + i + c]!;
+        correlation += x * tail[i + c]!;
+        energy += x * x;
+      }
+    }
+    return energy > 1e-12 ? correlation / Math.sqrt(energy) : 0;
+  }
+}
diff --git a/web/src/player/engine/wasm/prairie-audio-decoders.d.mts b/web/src/player/engine/wasm/prairie-audio-decoders.d.mts
new file mode 100644
index 0000000000..85e3fe0c9f
--- /dev/null
+++ b/web/src/player/engine/wasm/prairie-audio-decoders.d.mts
@@ -0,0 +1,36 @@
+// Types for the Emscripten module built by web/wasm/audio-decoders/build.sh.
+
+export interface PrairieAudioDecodersModule {
+  HEAPU8: Uint8Array;
+  HEAPF32: Float32Array;
+  _malloc(size: number): number;
+  _free(pointer: number): void;
+  _sad_open(
+    codec: number,
+    sampleRate: number,
+    channels: number,
+    extradata: number,
+    extradataSize: number,
+  ): number;
+  _sad_packet_buffer(decoder: number, size: number): number;
+  _sad_send_packet(decoder: number, ptsMicros: number): number;
+  _sad_send_eof(decoder: number): number;
+  _sad_receive_frame(decoder: number): number;
+  _sad_frame_pcm(decoder: number): number;
+  _sad_frame_channels(decoder: number): number;
+  _sad_frame_sample_rate(decoder: number): number;
+  _sad_frame_layout_low(decoder: number): number;
+  _sad_frame_layout_high(decoder: number): number;
+  _sad_frame_pts_us(decoder: number): number;
+  _sad_flush(decoder: number): void;
+  _sad_close(decoder: number): void;
+}
+
+export interface PrairieAudioDecodersOptions {
+  locateFile?: (path: string, prefix: string) => string;
+  wasmBinary?: ArrayBuffer | Uint8Array;
+}
+
+export default function createPrairieAudioDecoders(
+  options?: PrairieAudioDecodersOptions,
+): Promise<PrairieAudioDecodersModule>;
diff --git a/web/src/player/engine/wasm/prairie-audio-decoders.ffmpeg-revision b/web/src/player/engine/wasm/prairie-audio-decoders.ffmpeg-revision
new file mode 100644
index 0000000000..c44c5d43eb
--- /dev/null
+++ b/web/src/player/engine/wasm/prairie-audio-decoders.ffmpeg-revision
@@ -0,0 +1 @@
+1041abdc962f4cc4f394aa8de9dc5236c0c3b9e7
diff --git a/web/src/player/engine/wasm/prairie-audio-decoders.mjs b/web/src/player/engine/wasm/prairie-audio-decoders.mjs
new file mode 100644
index 0000000000..e619664247
--- /dev/null
+++ b/web/src/player/engine/wasm/prairie-audio-decoders.mjs
@@ -0,0 +1,2 @@
+async function createPrairieAudioDecoders(moduleArg={}){var Module=moduleArg;var ENVIRONMENT_IS_WEB=!!globalThis.window;var ENVIRONMENT_IS_WORKER=!!globalThis.WorkerGlobalScope;var ENVIRONMENT_IS_NODE=globalThis.process?.versions?.node&&globalThis.process?.type!="renderer";if(ENVIRONMENT_IS_NODE){const{createRequire}=await import("node:module");var require=createRequire(import.meta.url)}var programArgs=[];var thisProgram="./this.program";var quit_=(status,toThrow)=>{throw toThrow};var _scriptName=import.meta.url;var scriptDirectory="";function locateFile(path){if(Module["locateFile"]){return Module["locateFile"](path,scriptDirectory)}return scriptDirectory+path}var readAsync,readBinary;if(ENVIRONMENT_IS_NODE){var fs=require("node:fs");if(_scriptName.startsWith("file:")){scriptDirectory=require("node:path").dirname(require("node:url").fileURLToPath(_scriptName))+"/"}readBinary=filename=>{filename=isFileURI(filename)?new URL(filename):filename;var ret=fs.readFileSync(filename);return ret};readAsync=async(filename,binary=true)=>{filename=isFileURI(filename)?new URL(filename):filename;var ret=fs.readFileSync(filename,binary?undefined:"utf8");return ret};if(process.argv.length>1){thisProgram=process.argv[1].replace(/\\/g,"/")}programArgs=process.argv.slice(2);quit_=(status,toThrow)=>{process.exitCode=status;throw toThrow}}else if(ENVIRONMENT_IS_WEB||ENVIRONMENT_IS_WORKER){try{scriptDirectory=new URL(".",_scriptName).href}catch{}{if(ENVIRONMENT_IS_WORKER){readBinary=url=>{var xhr=new XMLHttpRequest;xhr.open("GET",url,false);xhr.responseType="arraybuffer";xhr.send(null);return new Uint8Array(xhr.response)}}readAsync=async url=>{var response=await fetch(url,{credentials:"same-origin"});if(response.ok){return response.arrayBuffer()}throw new Error(response.status+" : "+response.url)}}}else{}var out=console.log.bind(console);var err=console.error.bind(console);var wasmBinary;var ABORT=false;var EXITSTATUS;var isFileURI=filename=>filename.startsWith("file://");class EmscriptenEH{}var runtimeInitialized=false;function getMemoryBuffer(){return wasmMemory.buffer}function updateMemoryViews(){if(HEAP8?.buffer?.resizable)return;var b=getMemoryBuffer();HEAP8=new Int8Array(b);HEAP16=new Int16Array(b);Module["HEAPU8"]=HEAPU8=new Uint8Array(b);HEAPU32=new Uint32Array(b);Module["HEAPF32"]=HEAPF32=new Float32Array(b);HEAP64=new BigInt64Array(b)}function preRun(){var preRun=Module["preRun"];if(preRun){if(typeof preRun=="function")preRun=[preRun];onPreRuns.push(...preRun)}callRuntimeCallbacks(onPreRuns)}function initRuntime(){runtimeInitialized=true;wasmExports["s"]()}function postRun(){var postRun=Module["postRun"];if(postRun){if(typeof postRun=="function")postRun=[postRun];onPostRuns.push(...postRun)}callRuntimeCallbacks(onPostRuns)}function abort(what){Module["onAbort"]?.(what);what=`Aborted(${what})`;err(what);ABORT=true;what+=". Build with -sASSERTIONS for more info.";var e=new WebAssembly.RuntimeError(what);throw e}var wasmBinaryFile;function findWasmBinary(){if(Module["locateFile"]){return locateFile("prairie-audio-decoders.wasm")}return new URL("prairie-audio-decoders.wasm",import.meta.url).href}function getBinarySync(file){if(readBinary){return readBinary(file)}throw"both async and sync fetching of the wasm failed"}async function getWasmBinary(binaryFile){if(!wasmBinary){try{var response=await readAsync(binaryFile);return new Uint8Array(response)}catch{}}return getBinarySync(binaryFile)}async function instantiateArrayBuffer(binaryFile,imports){try{var binary=await getWasmBinary(binaryFile);var instance=await WebAssembly.instantiate(binary,imports);return instance}catch(reason){err(`failed to asynchronously prepare wasm: ${reason}`);abort(reason)}}async function instantiateAsync(binary,binaryFile,imports){if(!binary&&!ENVIRONMENT_IS_NODE){try{var response=fetch(binaryFile,{credentials:"same-origin"});var instantiationResult=await WebAssembly.instantiateStreaming(response,imports);return instantiationResult}catch(reason){err(`wasm streaming compile failed: ${reason}`);err("falling back to ArrayBuffer instantiation")}}return instantiateArrayBuffer(binaryFile,imports)}function getWasmImports(){var imports={a:wasmImports};return imports}async function createWasm(){function receiveInstance(instance){wasmExports=instance.exports;assignWasmExports(wasmExports);updateMemoryViews();return wasmExports}function receiveInstantiationResult(result){return receiveInstance(result["instance"])}var info=getWasmImports();var instantiateWasm=Module["instantiateWasm"];if(instantiateWasm){return new Promise(resolve=>{instantiateWasm(info,inst=>resolve(receiveInstance(inst)))})}wasmBinaryFile??=findWasmBinary();var result=await instantiateAsync(wasmBinary,wasmBinaryFile,info);var exports=receiveInstantiationResult(result);return exports}class ExitStatus{name="ExitStatus";constructor(status){this.message=`Program terminated with exit(${status})`;this.status=status}}var HEAP8;var callRuntimeCallbacks=callbacks=>{while(callbacks.length>0){callbacks.shift()(Module)}};var onPostRuns=[];var onPreRuns=[];var noExitRuntime=true;var UTF8Decoder=globalThis.TextDecoder&&new TextDecoder;var findStringEnd=(heapOrArray,idx,maxBytesToRead,ignoreNul)=>{var maxIdx=idx+maxBytesToRead;if(ignoreNul)return maxIdx;while(heapOrArray[idx]&&!(idx>=maxIdx))++idx;return idx};var UTF8ArrayToString=(heapOrArray,idx=0,maxBytesToRead,ignoreNul)=>{var endPtr=findStringEnd(heapOrArray,idx,maxBytesToRead,ignoreNul);if(endPtr-idx>16&&heapOrArray.buffer&&UTF8Decoder){return UTF8Decoder.decode(heapOrArray.subarray(idx,endPtr))}var str="";while(idx<endPtr){var u0=heapOrArray[idx++];if(!(u0&128)){str+=String.fromCharCode(u0);continue}var u1=heapOrArray[idx++]&63;if((u0&224)==192){str+=String.fromCharCode((u0&31)<<6|u1);continue}var u2=heapOrArray[idx++]&63;if((u0&240)==224){u0=(u0&15)<<12|u1<<6|u2}else{u0=(u0&7)<<18|u1<<12|u2<<6|heapOrArray[idx++]&63}if(u0<65536){str+=String.fromCharCode(u0)}else{var ch=u0-65536;str+=String.fromCharCode(55296|ch>>10,56320|ch&1023)}}return str};var HEAPU8;var UTF8ToString=(ptr,maxBytesToRead,ignoreNul)=>ptr?UTF8ArrayToString(HEAPU8,ptr,maxBytesToRead,ignoreNul):"";var SYSCALLS={varargs:undefined,getStr(ptr){var ret=UTF8ToString(ptr);return ret}};function ___syscall_fcntl64(fd,cmd,varargs){SYSCALLS.varargs=varargs;return 0}function ___syscall_ioctl(fd,op,varargs){SYSCALLS.varargs=varargs;return 0}function ___syscall_openat(dirfd,path,flags,varargs){SYSCALLS.varargs=varargs}var __abort_js=()=>abort("");var runtimeKeepaliveCounter=0;var __emscripten_runtime_keepalive_clear=()=>{noExitRuntime=false;runtimeKeepaliveCounter=0};var timers={};var handleException=e=>{if(e instanceof ExitStatus||e=="unwind"){return EXITSTATUS}quit_(1,e)};var keepRuntimeAlive=()=>noExitRuntime||runtimeKeepaliveCounter>0;var _proc_exit=code=>{EXITSTATUS=code;if(!keepRuntimeAlive()){Module["onExit"]?.(code);ABORT=true}quit_(code,new ExitStatus(code))};var exitJS=(status,implicit)=>{EXITSTATUS=status;_proc_exit(status)};var _exit=exitJS;var maybeExit=()=>{if(!keepRuntimeAlive()){try{_exit(EXITSTATUS)}catch(e){handleException(e)}}};var callUserCallback=(func,...args)=>{if(ABORT){return}try{return func(...args)}catch(e){handleException(e)}finally{maybeExit()}};var _emscripten_get_now=()=>performance.now();var __setitimer_js=(which,timeout_ms)=>{if(timers[which]){clearTimeout(timers[which].id);delete timers[which]}if(!timeout_ms)return 0;var id=setTimeout(()=>{delete timers[which];callUserCallback(__emscripten_timeout,which,_emscripten_get_now())},timeout_ms);timers[which]={id,timeout_ms};return 0};var _emscripten_date_now=()=>Date.now();var nowIsMonotonic=1;var checkWasiClock=clock_id=>clock_id>=0&&clock_id<=3;var INT53_MAX=9007199254740992;var INT53_MIN=-9007199254740992;var bigintToI53Checked=num=>num<INT53_MIN||num>INT53_MAX?NaN:Number(num);var HEAP64;function _clock_time_get(clk_id,ignored_precision,ptime){ignored_precision=bigintToI53Checked(ignored_precision);if(!checkWasiClock(clk_id)){return 28}var now;if(clk_id===0){now=_emscripten_date_now()}else if(nowIsMonotonic){now=_emscripten_get_now()}else{return 52}var nsec=Math.round(now*1e6);HEAP64[ptime>>3]=BigInt(nsec);return 0}var getHeapMax=()=>2147483648;var alignMemory=(size,alignment)=>Math.ceil(size/alignment)*alignment;var growMemory=size=>{var oldHeapSize=wasmMemory.buffer.byteLength;var pages=(size-oldHeapSize+65535)/65536|0;try{wasmMemory.grow(pages);updateMemoryViews();return 1}catch(e){}};var _emscripten_resize_heap=requestedSize=>{var oldSize=HEAPU8.length;requestedSize>>>=0;var maxHeapSize=getHeapMax();if(requestedSize>maxHeapSize){return false}for(var cutDown=1;cutDown<=4;cutDown*=2){var overGrownHeapSize=oldSize*(1+.2/cutDown);overGrownHeapSize=Math.min(overGrownHeapSize,requestedSize+100663296);var newSize=Math.min(maxHeapSize,alignMemory(Math.max(requestedSize,overGrownHeapSize),65536));var replacement=growMemory(newSize);if(replacement){return true}}return false};var ENV={};var getExecutableName=()=>thisProgram;var getEnvStrings=()=>{if(!getEnvStrings.strings){var lang=(globalThis.navigator?.language??"C").replace("-","_")+".UTF-8";var env={USER:"web_user",LOGNAME:"web_user",PATH:"/",PWD:"/",HOME:"/home/web_user",LANG:lang,_:getExecutableName()};for(var x in ENV){if(ENV[x]===undefined)delete env[x];else env[x]=ENV[x]}var strings=[];for(var x in env){strings.push(`${x}=${env[x]}`)}getEnvStrings.strings=strings}return getEnvStrings.strings};var stringToUTF8Array=(str,heap,outIdx,maxBytesToWrite)=>{if(!(maxBytesToWrite>0))return 0;var startIdx=outIdx;var endIdx=outIdx+maxBytesToWrite-1;for(var i=0;i<str.length;++i){var u=str.codePointAt(i);if(u<=127){if(outIdx>=endIdx)break;heap[outIdx++]=u}else if(u<=2047){if(outIdx+1>=endIdx)break;heap[outIdx++]=192|u>>6;heap[outIdx++]=128|u&63}else if(u<=65535){if(outIdx+2>=endIdx)break;heap[outIdx++]=224|u>>12;heap[outIdx++]=128|u>>6&63;heap[outIdx++]=128|u&63}else{if(outIdx+3>=endIdx)break;heap[outIdx++]=240|u>>18;heap[outIdx++]=128|u>>12&63;heap[outIdx++]=128|u>>6&63;heap[outIdx++]=128|u&63;i++}}heap[outIdx]=0;return outIdx-startIdx};var stringToUTF8=(str,outPtr,maxBytesToWrite)=>stringToUTF8Array(str,HEAPU8,outPtr,maxBytesToWrite);var HEAPU32;var _environ_get=(__environ,environ_buf)=>{var bufSize=0;var envp=0;for(var string of getEnvStrings()){var ptr=environ_buf+bufSize;HEAPU32[__environ+envp>>2]=ptr;bufSize+=stringToUTF8(string,ptr,Infinity)+1;envp+=4}return 0};var lengthBytesUTF8=str=>{var len=0;for(var i=0;i<str.length;++i){var c=str.charCodeAt(i);if(c<=127){len++}else if(c<=2047){len+=2}else if(c>=55296&&c<=57343){len+=4;++i}else{len+=3}}return len};var _environ_sizes_get=(penviron_count,penviron_buf_size)=>{var strings=getEnvStrings();HEAPU32[penviron_count>>2]=strings.length;var bufSize=0;for(var string of strings){bufSize+=lengthBytesUTF8(string)+1}HEAPU32[penviron_buf_size>>2]=bufSize;return 0};var _fd_close=fd=>52;var HEAP16;var _fd_fdstat_get=(fd,pbuf)=>{var rightsBase=0;var rightsInheriting=0;var flags=0;{var type=2;if(fd==0){rightsBase=2}else if(fd==1||fd==2){rightsBase=64}flags=1}HEAP8[pbuf]=type;HEAP16[pbuf+2>>1]=flags;HEAP64[pbuf+8>>3]=BigInt(rightsBase);HEAP64[pbuf+16>>3]=BigInt(rightsInheriting);return 0};var _fd_read=(fd,iov,iovcnt,pnum)=>52;function _fd_seek(fd,offset,whence,newOffset){offset=bigintToI53Checked(offset);return 70}var printCharBuffers=[null,[],[]];var printChar=(stream,curr)=>{var buffer=printCharBuffers[stream];if(!curr||curr===10){(stream===1?out:err)(UTF8ArrayToString(buffer));buffer.length=0}else{buffer.push(curr)}};var _fd_write=(fd,iov,iovcnt,pnum)=>{var num=0;for(var i=0;i<iovcnt;i++){var ptr=HEAPU32[iov>>2];var len=HEAPU32[iov+4>>2];iov+=8;for(var j=0;j<len;j++){printChar(fd,HEAPU8[ptr+j])}num+=len}HEAPU32[pnum>>2]=num;return 0};var HEAPF32;{if(Module["noExitRuntime"])noExitRuntime=Module["noExitRuntime"];if(Module["print"])out=Module["print"];if(Module["printErr"])err=Module["printErr"];if(Module["arguments"])programArgs=Module["arguments"];if(Module["thisProgram"])thisProgram=Module["thisProgram"];var preInit=Module["preInit"];if(preInit){if(typeof preInit=="function")Module["preInit"]=preInit=[preInit];while(preInit.length>0){preInit.shift()()}}}var _sad_open,_sad_packet_buffer,_sad_send_packet,_sad_send_eof,_sad_receive_frame,_sad_frame_pcm,_sad_frame_channels,_sad_frame_sample_rate,_sad_frame_layout_low,_sad_frame_layout_high,_sad_frame_pts_us,_sad_flush,_sad_close,_free,_malloc,__emscripten_timeout,memory,__indirect_function_table,wasmMemory;function assignWasmExports(wasmExports){_sad_open=Module["_sad_open"]=wasmExports["t"];_sad_packet_buffer=Module["_sad_packet_buffer"]=wasmExports["u"];_sad_send_packet=Module["_sad_send_packet"]=wasmExports["v"];_sad_send_eof=Module["_sad_send_eof"]=wasmExports["w"];_sad_receive_frame=Module["_sad_receive_frame"]=wasmExports["x"];_sad_frame_pcm=Module["_sad_frame_pcm"]=wasmExports["y"];_sad_frame_channels=Module["_sad_frame_channels"]=wasmExports["z"];_sad_frame_sample_rate=Module["_sad_frame_sample_rate"]=wasmExports["A"];_sad_frame_layout_low=Module["_sad_frame_layout_low"]=wasmExports["B"];_sad_frame_layout_high=Module["_sad_frame_layout_high"]=wasmExports["C"];_sad_frame_pts_us=Module["_sad_frame_pts_us"]=wasmExports["D"];_sad_flush=Module["_sad_flush"]=wasmExports["E"];_sad_close=Module["_sad_close"]=wasmExports["F"];_free=Module["_free"]=wasmExports["G"];_malloc=Module["_malloc"]=wasmExports["H"];__emscripten_timeout=wasmExports["I"];memory=wasmMemory=wasmExports["r"];__indirect_function_table=wasmExports["__indirect_function_table"]}var wasmImports={a:___syscall_fcntl64,q:___syscall_ioctl,n:___syscall_openat,f:__abort_js,m:__emscripten_runtime_keepalive_clear,j:__setitimer_js,e:_clock_time_get,d:_emscripten_date_now,k:_emscripten_resize_heap,b:_environ_get,c:_environ_sizes_get,i:_fd_close,p:_fd_fdstat_get,h:_fd_read,o:_fd_seek,g:_fd_write,l:_proc_exit};async function run(){preRun();var setStatus=Module["setStatus"];if(setStatus){setStatus("Running...");await new Promise(resolve=>setTimeout(resolve,1));setTimeout(setStatus,1,"")}if(ABORT)return;initRuntime();Module["onRuntimeInitialized"]?.();postRun()}var wasmExports;wasmExports=await createWasm();await run();
+;return Module}export default createPrairieAudioDecoders;
diff --git a/web/src/player/engine/wasm/prairie-audio-decoders.wasm b/web/src/player/engine/wasm/prairie-audio-decoders.wasm
new file mode 100644
index 0000000000..d43e2a5bd8
Binary files /dev/null and b/web/src/player/engine/wasm/prairie-audio-decoders.wasm differ
diff --git a/web/src/player/hooks/useASSSubtitles.ts b/web/src/player/hooks/useASSSubtitles.ts
index 928abc3d44..33883dc564 100644
--- a/web/src/player/hooks/useASSSubtitles.ts
+++ b/web/src/player/hooks/useASSSubtitles.ts
@@ -129,6 +129,10 @@ export function useASSSubtitles(
   // (subtitle sync or a timing reset); changing it swaps the track's script
   // in the running renderer.
   cueRevision = 0,
+  // Bumped when the browser decode engine's transport starts or stops. JASSUB
+  // re-arms requestVideoFrameCallback only from inside its own callback, and
+  // callbacks registered on an engine end with it, so the renderer rebuilds.
+  transportRevision = 0,
 ): { isActive: boolean } {
   const onLoadStateRef = useRef(onLoadState);
   onLoadStateRef.current = onLoadState;
@@ -394,8 +398,8 @@ export function useASSSubtitles(
     };
     // videoRef is a stable ref object. streamOriginSeconds is read from
     // streamOriginRef inside the async function to always get the latest value.
-    // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [activeUrl, activeLanguage, activeFontBundleUrl, isDetached, rebuild]);
+    // eslint-disable-next-line react-hooks/exhaustive-deps -- videoRef and streamOriginRef are refs
+  }, [activeUrl, activeLanguage, activeFontBundleUrl, isDetached, rebuild, transportRevision]);
 
   // A retime of the track on screen (subtitle sync, a timing reset) loads the
   // corrected script into the running renderer: the current events stay up
diff --git a/web/src/player/hooks/useAutoQualityDownshift.test.tsx b/web/src/player/hooks/useAutoQualityDownshift.test.tsx
new file mode 100644
index 0000000000..6dc93c0b8a
--- /dev/null
+++ b/web/src/player/hooks/useAutoQualityDownshift.test.tsx
@@ -0,0 +1,472 @@
+import { renderHook } from "@testing-library/react";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import {
+  createStallTracker,
+  downshiftEstimateKbps,
+  useAutoQualityDownshift,
+} from "./useAutoQualityDownshift";
+
+describe("createStallTracker", () => {
+  it("ignores buffering during startup", () => {
+    const tracker = createStallTracker();
+    tracker.playing(0);
+    tracker.waiting(2_000);
+    tracker.playing(5_000);
+    tracker.waiting(6_000);
+    tracker.playing(9_000);
+    expect(tracker.shouldDownshift(9_000)).toBe(false);
+  });
+
+  it("counts a startup stall from the end of the grace period", () => {
+    const tracker = createStallTracker();
+    tracker.playing(0);
+    tracker.waiting(5_000);
+    expect(tracker.shouldDownshift(15_000)).toBe(false);
+    expect(tracker.shouldDownshift(16_000)).toBe(true);
+  });
+
+  it("downshifts after repeated stalls inside the window", () => {
+    const tracker = createStallTracker();
+    tracker.playing(0);
+    tracker.waiting(20_000);
+    tracker.playing(22_000);
+    expect(tracker.shouldDownshift(22_000)).toBe(false);
+    tracker.waiting(60_000);
+    tracker.playing(62_000);
+    expect(tracker.shouldDownshift(62_000)).toBe(true);
+  });
+
+  it("forgets stalls that fell out of the window", () => {
+    const tracker = createStallTracker();
+    tracker.playing(0);
+    tracker.waiting(20_000);
+    tracker.playing(22_000);
+    tracker.waiting(200_000);
+    tracker.playing(202_000);
+    expect(tracker.shouldDownshift(202_000)).toBe(false);
+  });
+
+  it("does not count brief segment-boundary buffering", () => {
+    const tracker = createStallTracker();
+    tracker.playing(0);
+    for (let at = 20_000; at < 60_000; at += 10_000) {
+      tracker.waiting(at);
+      tracker.playing(at + 400);
+    }
+    expect(tracker.shouldDownshift(60_000)).toBe(false);
+  });
+
+  it("downshifts on one long stall", () => {
+    const tracker = createStallTracker();
+    tracker.playing(0);
+    tracker.waiting(20_000);
+    expect(tracker.shouldDownshift(25_000)).toBe(false);
+    expect(tracker.shouldDownshift(26_000)).toBe(true);
+  });
+
+  it("still counts a long stall that ended before it was checked", () => {
+    const tracker = createStallTracker();
+    tracker.playing(0);
+    tracker.waiting(20_000);
+    tracker.playing(27_000);
+    expect(tracker.shouldDownshift(27_000)).toBe(true);
+  });
+
+  it("times a start that never produces a frame from its first wait", () => {
+    const tracker = createStallTracker();
+    tracker.waiting(1_000);
+    expect(tracker.shouldDownshift(16_000)).toBe(false);
+    expect(tracker.shouldDownshift(17_000)).toBe(true);
+  });
+
+  it("forgets a finished long stall after the stall window", () => {
+    const tracker = createStallTracker();
+    tracker.playing(0);
+    tracker.waiting(20_000);
+    tracker.playing(27_000);
+    expect(tracker.shouldDownshift(27_000 + 2 * 60_000 + 1)).toBe(false);
+  });
+
+  it("does not blame the network for a seek", () => {
+    const tracker = createStallTracker();
+    tracker.playing(0);
+    tracker.waiting(20_000);
+    tracker.seeking();
+    expect(tracker.shouldDownshift(30_000)).toBe(false);
+  });
+});
+
+describe("downshiftEstimateKbps", () => {
+  it("plans below the bitrate that stalled", () => {
+    expect(downshiftEstimateKbps(80_000)).toBe(56_000);
+    expect(downshiftEstimateKbps(6_000)).toBe(4_200);
+  });
+
+  it("needs a known bitrate", () => {
+    expect(downshiftEstimateKbps(undefined)).toBeUndefined();
+    expect(downshiftEstimateKbps(0)).toBeUndefined();
+    expect(downshiftEstimateKbps(100)).toBeUndefined();
+  });
+});
+
+describe("useAutoQualityDownshift", () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+    vi.setSystemTime(0);
+  });
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  function fakeVideo() {
+    const video = new EventTarget() as EventTarget & {
+      seeking: boolean;
+      paused: boolean;
+      readyState: number;
+      currentTime: number;
+    };
+    video.currentTime = 0;
+    video.seeking = false;
+    video.paused = false;
+    video.readyState = 0;
+    return video;
+  }
+
+  function fire(video: EventTarget, type: string, atMs: number) {
+    vi.setSystemTime(atMs);
+    video.dispatchEvent(new Event(type));
+  }
+
+  it("asks for a lower estimate after a long stall on Auto", () => {
+    const video = fakeVideo();
+    const onDownshift = vi.fn();
+    renderHook(() =>
+      useAutoQualityDownshift({
+        videoRef: { current: video as unknown as HTMLVideoElement },
+        enabled: true,
+        sessionId: "s1",
+        planIdentity: "plan-1",
+        deliveredKbps: 80_000,
+        onDownshift,
+      }),
+    );
+    fire(video, "playing", 0);
+    fire(video, "waiting", 30_000);
+    vi.advanceTimersByTime(6_000);
+    expect(onDownshift).toHaveBeenCalledExactlyOnceWith(56_000);
+  });
+
+  it("treats advancing time as the end of a stall", () => {
+    const video = fakeVideo();
+    const onDownshift = vi.fn();
+    renderHook(() =>
+      useAutoQualityDownshift({
+        videoRef: { current: video as unknown as HTMLVideoElement },
+        enabled: true,
+        sessionId: "s1",
+        planIdentity: "plan-1",
+        deliveredKbps: 80_000,
+        onDownshift,
+      }),
+    );
+    fire(video, "playing", 0);
+    video.currentTime = 30;
+    fire(video, "waiting", 30_000);
+    // Recovered without a `playing` event.
+    video.currentTime = 30.5;
+    fire(video, "timeupdate", 30_400);
+    vi.advanceTimersByTime(10_000);
+    expect(onDownshift).not.toHaveBeenCalled();
+  });
+
+  function renderOnAuto(video: EventTarget, onDownshift: () => void) {
+    return renderHook(() =>
+      useAutoQualityDownshift({
+        videoRef: { current: video as unknown as HTMLVideoElement },
+        enabled: true,
+        sessionId: "s1",
+        planIdentity: "plan-1",
+        deliveredKbps: 80_000,
+        onDownshift,
+      }),
+    );
+  }
+
+  it("does not count a stall the viewer paused", () => {
+    const video = fakeVideo();
+    const onDownshift = vi.fn();
+    renderOnAuto(video, onDownshift);
+    fire(video, "playing", 0);
+    fire(video, "waiting", 30_000);
+    video.paused = true;
+    fire(video, "pause", 31_000);
+    vi.advanceTimersByTime(10_000);
+    expect(onDownshift).not.toHaveBeenCalled();
+  });
+
+  it("does not downshift a paused element when the timer fires", () => {
+    const video = fakeVideo();
+    const onDownshift = vi.fn();
+    renderOnAuto(video, onDownshift);
+    fire(video, "playing", 0);
+    fire(video, "waiting", 30_000);
+    video.paused = true;
+    vi.advanceTimersByTime(10_000);
+    expect(onDownshift).not.toHaveBeenCalled();
+  });
+
+  it("tries again when the replan was not adopted", () => {
+    const video = fakeVideo();
+    const onDownshift = vi.fn();
+    renderOnAuto(video, onDownshift);
+    fire(video, "playing", 0);
+    fire(video, "waiting", 30_000);
+    vi.advanceTimersByTime(6_000);
+    expect(onDownshift).toHaveBeenCalledTimes(1);
+
+    // Same plan still playing a minute later: the replan failed.
+    fire(video, "playing", 40_000);
+    vi.advanceTimersByTime(60_000);
+    fire(video, "waiting", 100_000);
+    vi.advanceTimersByTime(6_000);
+    expect(onDownshift).toHaveBeenCalledTimes(2);
+  });
+
+  it("keeps watching a stall that outlasts an unadopted replan", () => {
+    const video = fakeVideo();
+    const onDownshift = vi.fn();
+    renderOnAuto(video, onDownshift);
+    fire(video, "playing", 0);
+    fire(video, "waiting", 30_000);
+    vi.advanceTimersByTime(6_000);
+    expect(onDownshift).toHaveBeenCalledTimes(1);
+
+    // The replan failed and the element never recovered or fired again.
+    vi.advanceTimersByTime(60_000);
+    expect(onDownshift).toHaveBeenCalledTimes(1);
+    vi.advanceTimersByTime(6_000);
+    expect(onDownshift).toHaveBeenCalledTimes(2);
+  });
+
+  it("leaves no stall timer behind when the re-arm restarts a stall", () => {
+    const video = fakeVideo();
+    const onDownshift = vi.fn();
+    const { unmount } = renderOnAuto(video, onDownshift);
+    fire(video, "playing", 0);
+    fire(video, "waiting", 30_000);
+    vi.advanceTimersByTime(6_000);
+    expect(onDownshift).toHaveBeenCalledTimes(1);
+
+    // A new stall begins just before the re-arm, then Auto is turned off.
+    vi.advanceTimersByTime(57_000);
+    fire(video, "waiting", 93_000);
+    vi.advanceTimersByTime(3_000);
+    unmount();
+    vi.advanceTimersByTime(20_000);
+    expect(onDownshift).toHaveBeenCalledTimes(1);
+  });
+
+  it("downshifts a stall that began in startup and never recovered", () => {
+    const video = fakeVideo();
+    const onDownshift = vi.fn();
+    renderOnAuto(video, onDownshift);
+    fire(video, "playing", 0);
+    fire(video, "waiting", 5_000);
+    vi.advanceTimersByTime(10_000);
+    expect(onDownshift).not.toHaveBeenCalled();
+    vi.advanceTimersByTime(2_000);
+    expect(onDownshift).toHaveBeenCalledTimes(1);
+  });
+
+  it("retries an unadopted downshift after the hook was briefly disabled", () => {
+    const video = fakeVideo();
+    const onDownshift = vi.fn();
+    const { rerender } = renderHook(
+      ({ enabled }: { enabled: boolean }) =>
+        useAutoQualityDownshift({
+          videoRef: { current: video as unknown as HTMLVideoElement },
+          enabled,
+          sessionId: "s1",
+          planIdentity: 1,
+          deliveredKbps: 80_000,
+          onDownshift,
+        }),
+      { initialProps: { enabled: true } },
+    );
+    fire(video, "playing", 0);
+    fire(video, "waiting", 30_000);
+    vi.advanceTimersByTime(6_000);
+    expect(onDownshift).toHaveBeenCalledTimes(1);
+
+    // A reconnect disables the hook before the re-arm; the same plan resumes.
+    rerender({ enabled: false });
+    rerender({ enabled: true });
+    fire(video, "playing", 40_000);
+    fire(video, "waiting", 60_000);
+    vi.advanceTimersByTime(6_000);
+    expect(onDownshift).toHaveBeenCalledTimes(2);
+  });
+
+  it("watches a plan an unrelated replan raised after a successful step down", () => {
+    const video = fakeVideo();
+    const onDownshift = vi.fn();
+    const { rerender } = renderHook(
+      ({ plan, kbps }: { plan: number; kbps: number }) =>
+        useAutoQualityDownshift({
+          videoRef: { current: video as unknown as HTMLVideoElement },
+          enabled: true,
+          sessionId: "s1",
+          planIdentity: plan,
+          deliveredKbps: kbps,
+          onDownshift,
+        }),
+      { initialProps: { plan: 1, kbps: 80_000 } },
+    );
+    fire(video, "playing", 0);
+    fire(video, "waiting", 30_000);
+    vi.advanceTimersByTime(6_000);
+    expect(onDownshift).toHaveBeenCalledTimes(1);
+
+    rerender({ plan: 2, kbps: 20_000 }); // the step down worked
+    rerender({ plan: 3, kbps: 80_000 }); // an audio change raised it again later
+    fire(video, "playing", 100_000);
+    fire(video, "waiting", 130_000);
+    vi.advanceTimersByTime(6_000);
+    expect(onDownshift).toHaveBeenCalledTimes(2);
+  });
+
+  it("does not read buffering during a transport failure as a slow link", () => {
+    const video = fakeVideo();
+    const onDownshift = vi.fn();
+    let failing = true;
+    renderHook(() =>
+      useAutoQualityDownshift({
+        videoRef: { current: video as unknown as HTMLVideoElement },
+        enabled: true,
+        sessionId: "s1",
+        planIdentity: "plan-1",
+        deliveredKbps: 80_000,
+        onDownshift,
+        transportTrouble: () => failing,
+      }),
+    );
+    fire(video, "playing", 0);
+    fire(video, "waiting", 30_000);
+    vi.advanceTimersByTime(10_000);
+    expect(onDownshift).not.toHaveBeenCalled();
+
+    // Once requests succeed again, a new stall counts as usual.
+    failing = false;
+    fire(video, "playing", 45_000);
+    fire(video, "waiting", 60_000);
+    vi.advanceTimersByTime(6_000);
+    expect(onDownshift).toHaveBeenCalledTimes(1);
+  });
+
+  it("watches a no-lower plan again after the cooldown", () => {
+    const video = fakeVideo();
+    const onDownshift = vi.fn();
+    const { rerender } = renderHook(
+      ({ plan }: { plan: string }) =>
+        useAutoQualityDownshift({
+          videoRef: { current: video as unknown as HTMLVideoElement },
+          enabled: true,
+          sessionId: "s1",
+          planIdentity: plan,
+          deliveredKbps: 6_000,
+          onDownshift,
+        }),
+      { initialProps: { plan: "plan-1" } },
+    );
+    fire(video, "playing", 0);
+    fire(video, "waiting", 30_000);
+    vi.advanceTimersByTime(6_000);
+    expect(onDownshift).toHaveBeenCalledTimes(1);
+
+    rerender({ plan: "plan-2" }); // came back no lower
+    fire(video, "playing", 40_000);
+    fire(video, "waiting", 60_000);
+    vi.advanceTimersByTime(10_000);
+    expect(onDownshift).toHaveBeenCalledTimes(1);
+
+    fire(video, "playing", 80_000);
+    vi.setSystemTime(400_000);
+    fire(video, "waiting", 400_000);
+    vi.advanceTimersByTime(6_000);
+    expect(onDownshift).toHaveBeenCalledTimes(2);
+  });
+
+  it("times a stall that outlasts an outage from when the outage clears", () => {
+    const video = fakeVideo();
+    const onDownshift = vi.fn();
+    let failing = true;
+    renderHook(() =>
+      useAutoQualityDownshift({
+        videoRef: { current: video as unknown as HTMLVideoElement },
+        enabled: true,
+        sessionId: "s1",
+        planIdentity: "plan-1",
+        deliveredKbps: 80_000,
+        onDownshift,
+        transportTrouble: () => failing,
+      }),
+    );
+    fire(video, "playing", 0);
+    fire(video, "waiting", 30_000);
+    vi.advanceTimersByTime(8_000);
+    expect(onDownshift).not.toHaveBeenCalled();
+
+    failing = false; // requests succeed again, but the stall goes on
+    vi.advanceTimersByTime(5_000);
+    expect(onDownshift).not.toHaveBeenCalled();
+    vi.advanceTimersByTime(2_000);
+    expect(onDownshift).toHaveBeenCalledTimes(1);
+  });
+
+  it("leaves an explicit quality alone", () => {
+    const video = fakeVideo();
+    const onDownshift = vi.fn();
+    renderHook(() =>
+      useAutoQualityDownshift({
+        videoRef: { current: video as unknown as HTMLVideoElement },
+        enabled: false,
+        sessionId: "s1",
+        planIdentity: "plan-1",
+        deliveredKbps: 80_000,
+        onDownshift,
+      }),
+    );
+    fire(video, "playing", 0);
+    fire(video, "waiting", 30_000);
+    vi.advanceTimersByTime(10_000);
+    expect(onDownshift).not.toHaveBeenCalled();
+  });
+
+  it("stops when the replanned stream is no lower", () => {
+    const video = fakeVideo();
+    const onDownshift = vi.fn();
+    const { rerender } = renderHook(
+      ({ plan }: { plan: string }) =>
+        useAutoQualityDownshift({
+          videoRef: { current: video as unknown as HTMLVideoElement },
+          enabled: true,
+          sessionId: "s1",
+          planIdentity: plan,
+          deliveredKbps: 1_500,
+          onDownshift,
+        }),
+      { initialProps: { plan: "plan-1" } },
+    );
+    fire(video, "playing", 0);
+    fire(video, "waiting", 30_000);
+    vi.advanceTimersByTime(6_000);
+    expect(onDownshift).toHaveBeenCalledTimes(1);
+
+    rerender({ plan: "plan-2" });
+    fire(video, "playing", 40_000);
+    fire(video, "waiting", 60_000);
+    vi.advanceTimersByTime(10_000);
+    expect(onDownshift).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/web/src/player/hooks/useAutoQualityDownshift.ts b/web/src/player/hooks/useAutoQualityDownshift.ts
new file mode 100644
index 0000000000..591824bfc1
--- /dev/null
+++ b/web/src/player/hooks/useAutoQualityDownshift.ts
@@ -0,0 +1,271 @@
+import { useEffect, useRef, type RefObject } from "react";
+
+/**
+ * Auto quality plays the source unless a bandwidth estimate taken before
+ * playback says the link cannot carry it, and a transcode is one HLS
+ * rendition, so nothing below the server lowers quality when the link turns
+ * out slower. This watches for playback that keeps rebuffering and asks for a
+ * plan sized below what it could not sustain.
+ */
+
+/** Buffering right after a plan starts is startup, not a slow link. */
+const STARTUP_GRACE_MS = 10_000;
+/** A stall shorter than this is ordinary segment-boundary buffering. */
+const STALL_MIN_MS = 1_000;
+/** This many counted stalls within the window means the link cannot keep up. */
+const STALLS_BEFORE_DOWNSHIFT = 2;
+const STALL_WINDOW_MS = 2 * 60_000;
+/** One stall this long is enough on its own. */
+const LONG_STALL_MS = 6_000;
+/**
+ * A downshift whose replan was not adopted leaves the same plan playing. After
+ * this long the hook watches it again, so a transient replan failure does not
+ * end automatic downshifting for the rest of the plan.
+ */
+const REARM_AFTER_UNADOPTED_MS = 60_000;
+/**
+ * How long a plan that came back no lower after a downshift is left alone.
+ * The plan may be the bottom of the ladder, or another replan's result that
+ * arrived first; after this it is watched again either way.
+ */
+const NO_LOWER_COOLDOWN_MS = 5 * 60_000;
+/**
+ * The new estimate as a share of the bitrate that stalled. Auto plans for 80%
+ * of an estimate, so the next stream targets about 56% of the one that failed:
+ * a 4K remux steps to a 4K encode, a 1080p encode to 720p.
+ */
+export const DOWNSHIFT_ESTIMATE_RATIO = 0.7;
+
+/** How often a stall in progress is re-checked once the long-stall timer fires. */
+const STALL_RECHECK_MS = 1_000;
+
+export interface StallTracker {
+  /** The plan began playing. */
+  playing(now: number): void;
+  /** The element ran out of data. Seeks are excluded by the caller. */
+  waiting(now: number): void;
+  /**
+   * A seek, pause or reload began; a stall in progress was caused by that,
+   * not by the network.
+   */
+  seeking(): void;
+  /** Whether stall history so far says the link cannot keep up. */
+  shouldDownshift(now: number): boolean;
+}
+
+export function createStallTracker(): StallTracker {
+  let firstPlayingAt: number | undefined;
+  // When the plan first ran out of data, if that happened before its first
+  // frame. A start that never gets going is timed from here instead.
+  let firstWaitingAt: number | undefined;
+  let stallStartedAt: number | undefined;
+  let stalls: number[] = [];
+  // When a stall that reached LONG_STALL_MS ended. It still counts as long,
+  // since its timer can run late after playback recovered, but only within
+  // the stall window like any other stall.
+  let longStallEndedAt: number | undefined;
+  return {
+    playing(now) {
+      firstPlayingAt ??= now;
+      if (stallStartedAt !== undefined) {
+        const duration = now - stallStartedAt;
+        if (duration >= LONG_STALL_MS) longStallEndedAt = now;
+        else if (duration >= STALL_MIN_MS) stalls.push(now);
+      }
+      stallStartedAt = undefined;
+    },
+    waiting(now) {
+      // The grace period runs from the first frame, or from the first wait
+      // when the plan has not produced one. A stall that begins during it
+      // counts only from its end, so one that outlasts it is still seen.
+      const graceFrom = firstPlayingAt ?? (firstWaitingAt ??= now);
+      stallStartedAt ??= Math.max(now, graceFrom + STARTUP_GRACE_MS);
+    },
+    seeking() {
+      stallStartedAt = undefined;
+    },
+    shouldDownshift(now) {
+      if (longStallEndedAt !== undefined && now - longStallEndedAt < STALL_WINDOW_MS) return true;
+      if (stallStartedAt !== undefined && now - stallStartedAt >= LONG_STALL_MS) return true;
+      stalls = stalls.filter((at) => now - at < STALL_WINDOW_MS);
+      return stalls.length >= STALLS_BEFORE_DOWNSHIFT;
+    },
+  };
+}
+
+/** The estimate to plan with after `deliveredKbps` stalled, or undefined. */
+export function downshiftEstimateKbps(deliveredKbps: number | undefined): number | undefined {
+  if (deliveredKbps === undefined || !Number.isFinite(deliveredKbps) || deliveredKbps <= 0) {
+    return undefined;
+  }
+  const estimate = Math.floor(deliveredKbps * DOWNSHIFT_ESTIMATE_RATIO);
+  return estimate >= 100 ? estimate : undefined;
+}
+
+interface Options {
+  videoRef: RefObject<HTMLVideoElement | null>;
+  /** Only Auto quality is ours to change; an explicit choice is the viewer's. */
+  enabled: boolean;
+  /** The playback session; a new one starts with no downshift history. */
+  sessionId: string;
+  /** Changes whenever a new plan is adopted; stall history is per plan. */
+  planIdentity: unknown;
+  /** Bitrate the current plan delivers, when the server reported it. */
+  deliveredKbps: number | undefined;
+  /**
+   * Whether the transport is failing rather than slow: requests erroring or
+   * the browser offline. Buffering then is an outage, which the reconnect
+   * path owns, so it never counts toward a downshift.
+   */
+  transportTrouble?: () => boolean;
+  onDownshift: (estimateKbps: number) => void;
+}
+
+export function useAutoQualityDownshift({
+  videoRef,
+  enabled,
+  sessionId,
+  planIdentity,
+  deliveredKbps,
+  onDownshift,
+  transportTrouble,
+}: Options): void {
+  const onDownshiftRef = useRef(onDownshift);
+  const transportTroubleRef = useRef(transportTrouble);
+  useEffect(() => {
+    onDownshiftRef.current = onDownshift;
+    transportTroubleRef.current = transportTrouble;
+  }, [onDownshift, transportTrouble]);
+  // The plan the last downshift left and its bitrate, until the next plan is
+  // adopted. The same plan still playing means the replan was not adopted,
+  // and it stays eligible.
+  const lastDownshiftFromRef = useRef<
+    { sessionId: string; planIdentity: unknown; kbps: number } | undefined
+  >(undefined);
+  // A plan adopted after a downshift that turned out no lower.
+  const exhaustedPlanRef = useRef<
+    { sessionId: string; planIdentity: unknown; until: number } | undefined
+  >(undefined);
+
+  useEffect(() => {
+    const video = videoRef.current;
+    if (!enabled || !video || deliveredKbps === undefined) return;
+    const estimate = downshiftEstimateKbps(deliveredKbps);
+    if (estimate === undefined) return;
+    // The first plan adopted after a downshift settles it. No lower than the
+    // plan that stalled means the ladder may have nothing further down, or
+    // another replan's plan arrived first: leave it alone for a while rather
+    // than replan in a loop. Lower means the step worked, and any later plan,
+    // even one an unrelated replan raised again, is watched as usual.
+    const previous = lastDownshiftFromRef.current;
+    if (previous?.sessionId === sessionId && previous.planIdentity !== planIdentity) {
+      lastDownshiftFromRef.current = undefined;
+      if (deliveredKbps >= previous.kbps) {
+        exhaustedPlanRef.current = {
+          sessionId,
+          planIdentity,
+          until: Date.now() + NO_LOWER_COOLDOWN_MS,
+        };
+      }
+    }
+    const exhausted = exhaustedPlanRef.current;
+    const blockedUntil =
+      exhausted?.sessionId === sessionId && exhausted.planIdentity === planIdentity
+        ? exhausted.until
+        : 0;
+
+    // Where playback stood when the current stall began; undefined when not
+    // stalled. A stall can end without a `playing` event (the player itself
+    // clears buffering on `timeupdate`), so advancing time also ends it.
+    let stalledAt: number | undefined;
+    let tracker = createStallTracker();
+    let done = false;
+    let longStallTimer: ReturnType<typeof setTimeout> | undefined;
+    let rearmTimer: ReturnType<typeof setTimeout> | undefined;
+    const clearLongStallTimer = () => {
+      if (longStallTimer !== undefined) clearTimeout(longStallTimer);
+      longStallTimer = undefined;
+    };
+    // A seek, pause, end or source reload ends any stall in progress: the
+    // buffering that follows is not the link failing to keep up.
+    const onInterrupted = () => {
+      stalledAt = undefined;
+      clearLongStallTimer();
+      tracker.seeking();
+    };
+    const check = () => {
+      if (done || transportTroubleRef.current?.() || Date.now() < blockedUntil) return;
+      // A paused element is not starved, whatever happened before the pause.
+      if (video.paused || !tracker.shouldDownshift(Date.now())) return;
+      done = true;
+      clearLongStallTimer();
+      lastDownshiftFromRef.current = { sessionId, planIdentity, kbps: deliveredKbps };
+      // An adopted replan changes planIdentity and tears this effect down,
+      // cancelling the re-arm. Still being here means it was not adopted.
+      rearmTimer = setTimeout(() => {
+        rearmTimer = undefined;
+        done = false;
+        tracker = createStallTracker();
+        tracker.playing(Date.now() - STARTUP_GRACE_MS);
+        lastDownshiftFromRef.current = undefined;
+        // A stall still in progress fires no further `waiting`; time it
+        // again from here so it can downshift once more.
+        if (stalledAt !== undefined) {
+          tracker.waiting(Date.now());
+          clearLongStallTimer();
+          longStallTimer = setTimeout(checkStall, LONG_STALL_MS);
+        }
+      }, REARM_AFTER_UNADOPTED_MS);
+      onDownshiftRef.current(estimate);
+    };
+    const onPlaying = () => {
+      // A stall that overlapped an outage was the outage; do not count it.
+      if (transportTroubleRef.current?.()) tracker.seeking();
+      stalledAt = undefined;
+      clearLongStallTimer();
+      tracker.playing(Date.now());
+      check();
+    };
+    // Keeps looking while the stall lasts: one that began in the startup grace
+    // period only becomes long enough some time after the first check.
+    const checkStall = () => {
+      longStallTimer = undefined;
+      // During an outage, time the stall again from when it clears, so a
+      // stall that outlasts the outage still counts.
+      if (transportTroubleRef.current?.() && stalledAt !== undefined) {
+        tracker.seeking();
+        tracker.waiting(Date.now());
+      }
+      check();
+      if (!done && stalledAt !== undefined)
+        longStallTimer = setTimeout(checkStall, STALL_RECHECK_MS);
+    };
+    const onWaiting = () => {
+      if (video.seeking || video.paused) return;
+      stalledAt = video.currentTime;
+      tracker.waiting(Date.now());
+      clearLongStallTimer();
+      longStallTimer = setTimeout(checkStall, LONG_STALL_MS);
+    };
+    const onTimeUpdate = () => {
+      if (stalledAt !== undefined && video.currentTime > stalledAt) onPlaying();
+    };
+    // A plan adopted while the element is already playing fires no `playing`.
+    if (!video.paused && video.readyState >= HTMLMediaElement.HAVE_FUTURE_DATA) {
+      tracker.playing(Date.now());
+    }
+    video.addEventListener("playing", onPlaying);
+    video.addEventListener("waiting", onWaiting);
+    const interruptions = ["seeking", "pause", "ended", "emptied"] as const;
+    for (const type of interruptions) video.addEventListener(type, onInterrupted);
+    video.addEventListener("timeupdate", onTimeUpdate);
+    return () => {
+      clearLongStallTimer();
+      if (rearmTimer !== undefined) clearTimeout(rearmTimer);
+      video.removeEventListener("playing", onPlaying);
+      video.removeEventListener("waiting", onWaiting);
+      for (const type of interruptions) video.removeEventListener(type, onInterrupted);
+      video.removeEventListener("timeupdate", onTimeUpdate);
+    };
+  }, [videoRef, enabled, sessionId, planIdentity, deliveredKbps]);
+}
diff --git a/web/src/player/hooks/useBrowserEngine.ts b/web/src/player/hooks/useBrowserEngine.ts
new file mode 100644
index 0000000000..5157e14f05
--- /dev/null
+++ b/web/src/player/hooks/useBrowserEngine.ts
@@ -0,0 +1,36 @@
+import { useEffect, useState } from "react";
+import { probeEngineCapabilities, type EngineCapabilities } from "../engine/capabilities";
+import { isBrowserDecodingEnabled } from "../engine/settings";
+
+export interface BrowserEngineState {
+  /** False until the probe has answered; playback start waits for it. */
+  settled: boolean;
+  /** Null when browser decoding is off or this browser cannot run it. */
+  capabilities: EngineCapabilities | null;
+}
+
+/**
+ * The browser decode engine's capabilities for this page, when the viewer has
+ * turned browser decoding on. The setting is read once per player mount, so a
+ * change applies from the next playback.
+ */
+export function useBrowserEngineCapabilities(): BrowserEngineState {
+  const [state, setState] = useState<BrowserEngineState>(() => ({
+    settled: !isBrowserDecodingEnabled(),
+    capabilities: null,
+  }));
+
+  useEffect(() => {
+    if (state.settled) return;
+    let cancelled = false;
+    void probeEngineCapabilities().then((capabilities) => {
+      if (!cancelled) setState({ settled: true, capabilities });
+    });
+    return () => {
+      cancelled = true;
+    };
+    // eslint-disable-next-line react-hooks/exhaustive-deps -- the decision to probe is made once, at mount
+  }, []);
+
+  return state;
+}
diff --git a/web/src/player/hooks/useCodecDetection.test.ts b/web/src/player/hooks/useCodecDetection.test.ts
index 662987a200..cf4d1f09c8 100644
--- a/web/src/player/hooks/useCodecDetection.test.ts
+++ b/web/src/player/hooks/useCodecDetection.test.ts
@@ -1,10 +1,10 @@
-import { act, renderHook } from "@testing-library/react";
+import { act, renderHook, waitFor } from "@testing-library/react";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import {
   detectHDRFromMatchMedia,
-  detectMaxResolutionFromScreen,
   prewarmCodecDetection,
   probeHDR10PlaybackSupport,
+  probeMaxDecodeResolution,
   probeWebCapabilities,
   resetCodecDetectionForTests,
   useCodecDetection,
@@ -12,13 +12,150 @@ import {
 
 afterEach(() => {
   resetCodecDetectionForTests();
+  vi.useRealTimers();
   vi.restoreAllMocks();
   vi.unstubAllGlobals();
 });
 
-describe("detectMaxResolutionFromScreen", () => {
-  it("keeps a 1280x720 display in the 720p bucket", () => {
-    expect(detectMaxResolutionFromScreen(1280, 720)).toBe("720p");
+type DecodeAnswer = Pick<MediaCapabilitiesDecodingInfo, "supported" | "smooth" | "powerEfficient">;
+
+const DECODED: DecodeAnswer = { supported: true, smooth: true, powerEfficient: true };
+const NOT_DECODED: DecodeAnswer = { supported: false, smooth: false, powerEfficient: false };
+const SOFTWARE_STUTTER: DecodeAnswer = { supported: true, smooth: false, powerEfficient: false };
+const HARDWARE_NOT_SMOOTH: DecodeAnswer = { supported: true, smooth: false, powerEfficient: true };
+
+/**
+ * Answers decoder queries keyed by codec family and picture height, such as
+ * "vp09@2160"; anything not listed is not decoded.
+ */
+function stubDecoder(answers: Record<string, DecodeAnswer>) {
+  const decodingInfo = vi.fn((configuration: MediaDecodingConfiguration) => {
+    const video = configuration.video;
+    const codec = /codecs="(\w{4})/.exec(video?.contentType ?? "")?.[1];
+    return Promise.resolve(answers[`${codec}@${video?.height}`] ?? NOT_DECODED);
+  });
+  vi.stubGlobal("navigator", { mediaCapabilities: { decodingInfo } });
+  return decodingInfo;
+}
+
+/** The queries a decoder stub received, as "codec WIDTHxHEIGHT". */
+function queried(decodingInfo: { mock: { calls: MediaDecodingConfiguration[][] } }): string[] {
+  return decodingInfo.mock.calls.map(([configuration]) => {
+    const video = configuration?.video;
+    const codec = /codecs="([^"]+)"/.exec(video?.contentType ?? "")?.[1];
+    return `${codec} ${video?.width}x${video?.height}`;
+  });
+}
+
+const UHD_QUERIES = [
+  "avc1.640033 3840x2160",
+  "hvc1.1.6.L150.B0 3840x2160",
+  "vp09.00.51.08 3840x2160",
+  "av01.0.12M.08 3840x2160",
+];
+
+describe("probeMaxDecodeResolution", () => {
+  it("queries every codec at 4K at once, as a file", () => {
+    const decodingInfo = vi.fn<
+      (configuration: MediaDecodingConfiguration) => Promise<DecodeAnswer>
+    >(() => new Promise(() => {}));
+    vi.stubGlobal("navigator", { mediaCapabilities: { decodingInfo } });
+
+    void probeMaxDecodeResolution();
+
+    expect(queried(decodingInfo)).toEqual(UHD_QUERIES);
+    expect(decodingInfo.mock.calls.every(([configuration]) => configuration.type === "file")).toBe(
+      true,
+    );
+  });
+
+  it("reports 2160p when the browser decodes 4K H.264 smoothly", async () => {
+    const decodingInfo = stubDecoder({ "avc1@2160": DECODED });
+
+    await expect(probeMaxDecodeResolution()).resolves.toBe("2160p");
+    expect(queried(decodingInfo)).toEqual(UHD_QUERIES);
+  });
+
+  // The server downscales anything above the reported limit, whatever its
+  // codec, so a 4K VP9 decoder must not be capped by H.264.
+  it("reports 2160p for a browser that decodes only VP9 at 4K", async () => {
+    stubDecoder({ "vp09@2160": DECODED, "avc1@1080": DECODED });
+
+    await expect(probeMaxDecodeResolution()).resolves.toBe("2160p");
+  });
+
+  // iOS Safari reports even small HEVC streams as not smooth while its
+  // hardware decoder plays them in real time.
+  it("trusts a hardware decoder whose small reference stream is also not smooth", async () => {
+    const decodingInfo = stubDecoder({
+      "hvc1@2160": HARDWARE_NOT_SMOOTH,
+      "hvc1@720": HARDWARE_NOT_SMOOTH,
+      "avc1@1080": DECODED,
+    });
+
+    await expect(probeMaxDecodeResolution()).resolves.toBe("2160p");
+    expect(queried(decodingInfo)).toContain("hvc1.1.6.L93.B0 1280x720");
+  });
+
+  // Chromium derives smooth from frames dropped in earlier playback, so a
+  // hardware decoder that struggled at 4K is reported as not smooth there.
+  it("keeps a not-smooth 4K answer when the reference stream plays smoothly", async () => {
+    const decodingInfo = stubDecoder({
+      "avc1@2160": HARDWARE_NOT_SMOOTH,
+      "avc1@720": DECODED,
+      "avc1@1080": DECODED,
+    });
+
+    await expect(probeMaxDecodeResolution()).resolves.toBe("1080p");
+    expect(queried(decodingInfo)).toContain("avc1.64001F 1280x720");
+  });
+
+  it("caps at 1080p when 4K would stutter in software", async () => {
+    stubDecoder({ "avc1@2160": SOFTWARE_STUTTER, "avc1@1080": DECODED });
+
+    await expect(probeMaxDecodeResolution()).resolves.toBe("1080p");
+  });
+
+  it("counts a 4K query the browser throws on as no, keeping the other answers", async () => {
+    const decodingInfo = vi.fn((configuration: MediaDecodingConfiguration) => {
+      const contentType = configuration.video?.contentType ?? "";
+      if (contentType.includes("av01")) return Promise.reject(new TypeError("unparsable codec"));
+      const height = configuration.video?.height;
+      if (contentType.includes("avc1") && height === 2160) return Promise.resolve(SOFTWARE_STUTTER);
+      if (contentType.includes("avc1") && height === 1080) return Promise.resolve(DECODED);
+      return Promise.resolve(NOT_DECODED);
+    });
+    vi.stubGlobal("navigator", { mediaCapabilities: { decodingInfo } });
+
+    await expect(probeMaxDecodeResolution()).resolves.toBe("1080p");
+  });
+
+  it("caps at 1080p when every codec rejects 4K", async () => {
+    stubDecoder({ "avc1@1080": DECODED });
+
+    await expect(probeMaxDecodeResolution()).resolves.toBe("1080p");
+  });
+
+  // A browser without H.264 rejects 1080p too; that is about the codec, not
+  // the size, and the flat codec lists already carry it.
+  it("reports 2160p when H.264 is rejected at every size", async () => {
+    stubDecoder({});
+
+    await expect(probeMaxDecodeResolution()).resolves.toBe("2160p");
+  });
+
+  it("reports 2160p without the Media Capabilities API", async () => {
+    vi.stubGlobal("navigator", {});
+
+    await expect(probeMaxDecodeResolution()).resolves.toBe("2160p");
+  });
+
+  it("reports 2160p when the query fails", async () => {
+    vi.stubGlobal("navigator", {
+      mediaCapabilities: { decodingInfo: vi.fn().mockRejectedValue(new TypeError("bad config")) },
+    });
+
+    await expect(probeMaxDecodeResolution()).resolves.toBe("2160p");
   });
 });
 
@@ -72,6 +209,45 @@ describe("probeWebCapabilities", () => {
     );
   });
 
+  // iOS Safari reports every HEVC configuration as not smooth, even a small
+  // SDR stream, while its hardware decoder (power efficient) plays them in real time.
+  it("accepts a hardware decoder where the browser reports no HEVC stream as smooth", async () => {
+    const decodingInfo = vi
+      .fn()
+      .mockResolvedValue({ supported: true, smooth: false, powerEfficient: true });
+    vi.stubGlobal("navigator", { mediaCapabilities: { decodingInfo } });
+
+    await expect(probeHDR10PlaybackSupport()).resolves.toBe(true);
+    expect(decodingInfo).toHaveBeenLastCalledWith(
+      expect.objectContaining({ video: expect.objectContaining({ width: 640, height: 360 }) }),
+    );
+  });
+
+  // Chromium derives smooth from frames dropped in earlier playback, so a
+  // hardware decoder that struggled at 4K is reported as not smooth there.
+  it("keeps a not-smooth answer from a browser that plays the small stream smoothly", async () => {
+    const decodingInfo = vi.fn().mockImplementation((configuration: MediaDecodingConfiguration) =>
+      Promise.resolve({
+        supported: true,
+        smooth: configuration.video?.width === 640,
+        powerEfficient: true,
+      }),
+    );
+    vi.stubGlobal("navigator", { mediaCapabilities: { decodingInfo } });
+
+    await expect(probeHDR10PlaybackSupport()).resolves.toBe(false);
+  });
+
+  it("does not claim HDR10 for a decoder that is neither smooth nor power efficient", async () => {
+    const decodingInfo = vi
+      .fn()
+      .mockResolvedValue({ supported: true, smooth: false, powerEfficient: false });
+    vi.stubGlobal("navigator", { mediaCapabilities: { decodingInfo } });
+
+    await expect(probeHDR10PlaybackSupport()).resolves.toBe(false);
+    expect(decodingInfo).toHaveBeenCalledTimes(1);
+  });
+
   // The strip remux delivers an hvc1-labeled file; support reported only for
   // hev1 is evidence for bytes Prairie never sends and must not earn the claim.
   it("does not promote an hev1-only answer to an HDR10 claim", async () => {
@@ -154,20 +330,61 @@ describe("probeWebCapabilities", () => {
     expect(probeWebCapabilities().hdrDetails.dolby_vision_profiles).toEqual([]);
   });
 
-  // `screen` is measured in logical CSS pixels, so a 2x MacBook Pro XDR panel
-  // advertises 1080p unless the device pixel ratio is applied.
-  it("scales the screen-derived resolution by the device pixel ratio", () => {
-    vi.stubGlobal("screen", { width: 1728, height: 1117 });
-    vi.stubGlobal("devicePixelRatio", 2);
+  // The browser scales a 1080p picture into a 720p window itself, so a small
+  // screen must not make Auto transcode a file the decoder plays.
+  it("does not derive the resolution limit from the screen", () => {
+    vi.stubGlobal("screen", { width: 1280, height: 720 });
+    vi.stubGlobal("devicePixelRatio", 1);
 
     expect(probeWebCapabilities().maxResolution).toBe("2160p");
   });
 
-  it("treats a missing device pixel ratio as 1", () => {
-    vi.stubGlobal("screen", { width: 1728, height: 1117 });
-    vi.stubGlobal("devicePixelRatio", undefined);
+  it("adopts the decoder's resolution limit once the async probes settle", async () => {
+    vi.stubGlobal("screen", { width: 3840, height: 2160 });
+    stubDecoder({ "avc1@2160": SOFTWARE_STUTTER, "avc1@1080": DECODED });
+
+    const { result, unmount } = renderHook(() => useCodecDetection());
+    expect(result.current.settled).toBe(false);
+    expect(result.current.maxResolution).toBe("2160p");
+
+    await waitFor(() => expect(result.current.settled).toBe(true));
+    expect(result.current.maxResolution).toBe("1080p");
+    unmount();
+  });
+
+  // A size query that never answers must not hold playback start past the
+  // HDR10 probe by more than the deadline; its late answer serves later starts.
+  it("assumes 2160p when the size probe misses its deadline", async () => {
+    vi.useFakeTimers();
+    const pending: Array<(answer: DecodeAnswer) => void> = [];
+    vi.stubGlobal("navigator", {
+      mediaCapabilities: {
+        decodingInfo: vi.fn((configuration: MediaDecodingConfiguration) =>
+          configuration.video?.transferFunction === "pq"
+            ? Promise.resolve(NOT_DECODED)
+            : new Promise<DecodeAnswer>((resolve) => pending.push(resolve)),
+        ),
+      },
+    });
 
-    expect(probeWebCapabilities().maxResolution).toBe("1080p");
+    const first = renderHook(() => useCodecDetection());
+    await act(() => vi.advanceTimersByTimeAsync(1_999));
+    expect(first.result.current.settled).toBe(false);
+    await act(() => vi.advanceTimersByTimeAsync(1));
+    expect(first.result.current.settled).toBe(true);
+    expect(first.result.current.maxResolution).toBe("2160p");
+    first.unmount();
+
+    vi.useRealTimers();
+    for (const resolve of pending.splice(0)) resolve(SOFTWARE_STUTTER);
+    // Every 4K answer failed, so the 1080p H.264 query follows.
+    await waitFor(() => expect(pending).toHaveLength(1));
+    pending[0]!(DECODED);
+
+    const second = renderHook(() => useCodecDetection());
+    await waitFor(() => expect(second.result.current.settled).toBe(true));
+    expect(second.result.current.maxResolution).toBe("1080p");
+    second.unmount();
   });
 
   // Moving a window between displays can change what the decoder will admit to,
@@ -248,9 +465,11 @@ describe("probeWebCapabilities", () => {
     const { result, unmount } = renderHook(() => useCodecDetection());
     await act(async () => Promise.resolve());
 
-    expect(decodingInfo).toHaveBeenCalledTimes(1);
+    // One HDR10 query and one 4K query per codec, all issued by the warm-up.
+    expect(decodingInfo).toHaveBeenCalledTimes(5);
     expect(result.current.settled).toBe(true);
     expect(result.current.hdrDetails.hdr10).toBe(true);
+    expect(result.current.maxResolution).toBe("2160p");
     unmount();
   });
 
diff --git a/web/src/player/hooks/useCodecDetection.ts b/web/src/player/hooks/useCodecDetection.ts
index e989c71fcf..f6eb6d9e19 100644
--- a/web/src/player/hooks/useCodecDetection.ts
+++ b/web/src/player/hooks/useCodecDetection.ts
@@ -54,6 +54,18 @@ const HDR10_PROGRESSIVE_CONFIGURATION = {
   },
 } satisfies MediaDecodingConfiguration;
 
+/** A small SDR HEVC stream that any hardware HEVC decoder plays in real time. */
+const HEVC_REFERENCE_CONFIGURATION = {
+  type: "file",
+  video: {
+    contentType: 'video/mp4; codecs="hvc1.1.6.L90.90"',
+    width: 640,
+    height: 360,
+    bitrate: 1_000_000,
+    framerate: 24,
+  },
+} satisfies MediaDecodingConfiguration;
+
 const AUDIO_CODEC_MAP: Record<string, string[]> = {
   aac: ['audio/mp4; codecs="mp4a.40.2"', 'video/mp4; codecs="mp4a.40.2"'],
   mp3: ["audio/mpeg"],
@@ -81,12 +93,107 @@ const CONTAINER_MAP: Record<string, string[]> = {
   ogg: ["audio/ogg"],
 };
 
-export function detectMaxResolutionFromScreen(screenWidth: number, screenHeight: number): string {
-  const screenH = Math.max(screenHeight, screenWidth);
-  if (screenH >= 2160) return "2160p";
-  if (screenH >= 1440) return "1080p";
-  if (screenH >= 720) return "720p";
-  return "480p";
+/** The `max_resolution` reported until, or without, a Media Capabilities answer. */
+const UNPROBED_MAX_RESOLUTION = "2160p";
+
+/**
+ * How long a playback start waits for the decoder size probe. Starts already
+ * wait for the HDR10 probe; a slow size answer must not add more than this.
+ */
+const MAX_DECODE_RESOLUTION_WAIT_MS = 2_000;
+
+function mp4VideoConfiguration(
+  codec: string,
+  width: number,
+  height: number,
+  bitrate: number,
+): MediaDecodingConfiguration {
+  return {
+    type: "file",
+    video: { contentType: `video/mp4; codecs="${codec}"`, width, height, bitrate, framerate: 30 },
+  };
+}
+
+/**
+ * A 2160p30 query for each codec the server may direct play, each paired with
+ * a 720p30 stream of the same codec for the power-efficient exception in
+ * decodesInRealTime.
+ */
+const UHD_DECODE_PROBES = [
+  // H.264 High, levels 5.1 and 3.1.
+  { uhd: "avc1.640033", reference: "avc1.64001F" },
+  // HEVC Main, levels 5.0 and 3.1.
+  { uhd: "hvc1.1.6.L150.B0", reference: "hvc1.1.6.L93.B0" },
+  // VP9 profile 0, levels 5.1 and 3.1.
+  { uhd: "vp09.00.51.08", reference: "vp09.00.31.08" },
+  // AV1 Main, levels 5.0 and 3.1.
+  { uhd: "av01.0.12M.08", reference: "av01.0.05M.08" },
+].map(({ uhd, reference }) => ({
+  uhd: mp4VideoConfiguration(uhd, 3840, 2160, 20_000_000),
+  reference: mp4VideoConfiguration(reference, 1280, 720, 2_000_000),
+}));
+
+const H264_1080P_CONFIGURATION = mp4VideoConfiguration("avc1.640028", 1920, 1080, 10_000_000);
+
+/**
+ * Whether the browser decodes a configuration in real time.
+ *
+ * The answer has to be smooth, with one exception. iOS Safari answers
+ * `smooth: false` for every HEVC configuration, even a small SDR stream that
+ * any hardware decoder plays in real time, while `powerEfficient: true` shows
+ * its hardware decoder. Where the browser answers that way for the small
+ * same-codec reference stream too, its smooth flag says nothing, and a
+ * power-efficient decoder is trusted. Elsewhere `smooth: false` stands:
+ * Chromium, for one, derives it from frames dropped in earlier playback.
+ */
+async function decodesInRealTime(
+  configuration: MediaDecodingConfiguration,
+  reference: MediaDecodingConfiguration,
+): Promise<boolean> {
+  const result = await navigator.mediaCapabilities.decodingInfo(configuration);
+  if (!result.supported) return false;
+  if (result.smooth) return true;
+  if (!result.powerEfficient) return false;
+  const referenceResult = await navigator.mediaCapabilities.decodingInfo(reference);
+  return referenceResult.supported && !referenceResult.smooth && referenceResult.powerEfficient;
+}
+
+/**
+ * Finds the largest video size this browser decodes, for `max_resolution`.
+ *
+ * Auto quality treats `max_resolution` as a device limit and transcodes
+ * anything taller, so it describes the decoder, never the screen: the browser
+ * scales a 1080p picture into a 720p window itself. Web evidence is `declared`
+ * with flat codec lists, so this is the only size bound the web sends.
+ *
+ * One value bounds every codec, so the 4K queries cover H.264, HEVC, VP9 and
+ * AV1 in parallel, and a browser that decodes any of them in real time
+ * (decodesInRealTime) reports 2160p. The `file` type matches the media element
+ * loading a direct-play original. Only when all four fail does a browser that
+ * decodes 1080p H.264 get a 1080p cap. With no usable answer (the API is
+ * missing, the 1080p query throws, or the browser rejects H.264 even at
+ * 1080p, which says nothing about size) it reports 2160p: the codec lists
+ * still gate decoding, and the server's failure recovery replans a stream
+ * that will not play.
+ */
+export async function probeMaxDecodeResolution(): Promise<string> {
+  if (typeof navigator === "undefined" || !navigator.mediaCapabilities) {
+    return UNPROBED_MAX_RESOLUTION;
+  }
+
+  try {
+    // A query the browser rejects (some Safari versions throw on codec
+    // strings they cannot parse) means that codec does not decode, and must
+    // not hide the other codecs' answers.
+    const decodes4K = await Promise.allSettled(
+      UHD_DECODE_PROBES.map((probe) => decodesInRealTime(probe.uhd, probe.reference)),
+    );
+    if (decodes4K.some((answer) => answer.status === "fulfilled" && answer.value)) return "2160p";
+    const fhd = await navigator.mediaCapabilities.decodingInfo(H264_1080P_CONFIGURATION);
+    return fhd.supported ? "1080p" : UNPROBED_MAX_RESOLUTION;
+  } catch {
+    return UNPROBED_MAX_RESOLUTION;
+  }
 }
 
 /**
@@ -110,33 +217,71 @@ export function detectHDRFromMatchMedia(matchMediaFn: MatchMediaLike | undefined
  * Probes the exact HDR10 progressive shape produced by Prairie's remux path.
  * Deliberately independent of the `dynamic-range` media query: that query
  * describes the active output, not the decoder, and browsers tone-map HDR
- * content onto SDR outputs.
+ * content onto SDR outputs. The shape has to decode in real time
+ * (decodesInRealTime), checked against a small SDR HEVC reference stream.
  */
 export async function probeHDR10PlaybackSupport(): Promise<boolean> {
   if (typeof navigator === "undefined" || !navigator.mediaCapabilities) return false;
 
   try {
-    const result = await navigator.mediaCapabilities.decodingInfo(HDR10_PROGRESSIVE_CONFIGURATION);
-    return result.supported && result.smooth;
+    return await decodesInRealTime(HDR10_PROGRESSIVE_CONFIGURATION, HEVC_REFERENCE_CONFIGURATION);
   } catch {
     return false;
   }
 }
 
 let initialHDR10Probe: Promise<boolean> | null = null;
+let maxDecodeResolutionProbe: Promise<string> | null = null;
+let maxDecodeResolutionAnswer: string | null = null;
 
 /**
- * Starts the expensive Media Capabilities query once for the lifetime of the
+ * The decoder's size limit does not change with the output route, so unlike
+ * the HDR10 probe it runs once for the lifetime of the app.
+ */
+function startMaxDecodeResolutionProbe(): Promise<string> {
+  maxDecodeResolutionProbe ??= probeMaxDecodeResolution().then((resolution) => {
+    maxDecodeResolutionAnswer = resolution;
+    return resolution;
+  });
+  return maxDecodeResolutionProbe;
+}
+
+/**
+ * The size probe's answer, or 2160p if it has not answered within
+ * MAX_DECODE_RESOLUTION_WAIT_MS. Once the probe has answered, even late, its
+ * answer is used without waiting, so an output-change refresh settles as
+ * soon as its HDR10 re-probe does.
+ */
+function maxDecodeResolutionWithDeadline(): Promise<string> {
+  const probe = startMaxDecodeResolutionProbe();
+  if (maxDecodeResolutionAnswer !== null) return Promise.resolve(maxDecodeResolutionAnswer);
+  return new Promise((resolve) => {
+    const deadline = setTimeout(
+      () => resolve(UNPROBED_MAX_RESOLUTION),
+      MAX_DECODE_RESOLUTION_WAIT_MS,
+    );
+    void probe.then((resolution) => {
+      clearTimeout(deadline);
+      resolve(resolution);
+    });
+  });
+}
+
+/**
+ * Starts the expensive Media Capabilities queries once for the lifetime of the
  * app. The shell calls this before playback is requested so opening a video
  * does not have to wait several seconds for the browser's first decoder probe.
  */
 export function prewarmCodecDetection(): Promise<boolean> {
+  void startMaxDecodeResolutionProbe();
   initialHDR10Probe ??= probeHDR10PlaybackSupport();
   return initialHDR10Probe;
 }
 
 export function resetCodecDetectionForTests(): void {
   initialHDR10Probe = null;
+  maxDecodeResolutionProbe = null;
+  maxDecodeResolutionAnswer = null;
 }
 
 function testMediaType(mime: string): boolean {
@@ -176,9 +321,10 @@ function testMediaElementType(mime: string): boolean {
  * Every answer here comes from `MediaSource.isTypeSupported(...)` or
  * `HTMLMediaElement.canPlayType(...)`, which is why the v3 capability block
  * built from this probe is `declared` evidence and never claims hardware decode
- * detail it cannot observe. The screen-derived resolution and the HDR media
- * queries are hints about the *output*, not the decoder, and the server treats
- * them as such.
+ * detail it cannot observe. The HDR media queries are hints about the
+ * *output*, not the decoder, and the server treats them as such.
+ * `maxResolution` starts at 2160p until useCodecDetection joins the
+ * asynchronous decoder probe (see probeMaxDecodeResolution).
  */
 export function probeWebCapabilities(): WebCapabilityProbe {
   const codecsVideo: string[] = [];
@@ -222,20 +368,6 @@ export function probeWebCapabilities(): WebCapabilityProbe {
     }
   }
 
-  // `screen` reports logical CSS pixels; a 2160p-class panel on a 2x display
-  // measures 1080p without the device pixel ratio applied.
-  const pixelRatio =
-    typeof window !== "undefined" &&
-    typeof window.devicePixelRatio === "number" &&
-    Number.isFinite(window.devicePixelRatio) &&
-    window.devicePixelRatio > 0
-      ? window.devicePixelRatio
-      : 1;
-  const maxResolution =
-    typeof screen !== "undefined"
-      ? detectMaxResolutionFromScreen(screen.width * pixelRatio, screen.height * pixelRatio)
-      : "1080p";
-
   // HDR detection (best effort). Wrap matchMedia so it keeps its Window
   // receiver — invoking a detached reference throws in some browsers.
   const hdr = detectHDRFromMatchMedia(
@@ -283,7 +415,7 @@ export function probeWebCapabilities(): WebCapabilityProbe {
     progressiveCodecsVideo,
     codecsAudio,
     progressiveCodecsAudio,
-    maxResolution,
+    maxResolution: UNPROBED_MAX_RESOLUTION,
     hdr,
     hdrDetails,
     hls: hlsSupport.supported,
@@ -319,11 +451,13 @@ export function useCodecDetection(): SettledWebCapabilityProbe {
       const next = probeWebCapabilities();
       setCapabilities({ ...next, settled: false });
 
-      void hdr10Probe.then((hdr10) => {
+      const probes = Promise.all([hdr10Probe, maxDecodeResolutionWithDeadline()]);
+      void probes.then(([hdr10, maxResolution]) => {
         if (disposed || generation !== probeGeneration) return;
         setCapabilities((current) => ({
           ...current,
           settled: true,
+          maxResolution,
           // The exact HDR10 query proves the HEVC Main10 base codec for the
           // progressive MP4 route even when the separate generic HEVC probe was
           // rejected. Keep that evidence scoped away from original and HLS.
diff --git a/web/src/player/hooks/useIntroSkipPrompt.ts b/web/src/player/hooks/useIntroSkipPrompt.ts
index fb5fa3c7ee..9a3ec9083e 100644
--- a/web/src/player/hooks/useIntroSkipPrompt.ts
+++ b/web/src/player/hooks/useIntroSkipPrompt.ts
@@ -315,7 +315,7 @@ export function useIntroSkipPrompt({
       clearPrompt();
     });
   }, [clearPrompt, currentTime, enabled, intro, introKey, mode, startPrompt]);
-  /* eslint-enable react-hooks/set-state-in-effect */
+  /* eslint-enable react-hooks/set-state-in-effect -- ends the playback-position exception */
 
   useEffect(
     () => () => {
diff --git a/web/src/player/hooks/useKeyboardShortcuts.test.tsx b/web/src/player/hooks/useKeyboardShortcuts.test.tsx
index d85b98d9ae..2bbe124128 100644
--- a/web/src/player/hooks/useKeyboardShortcuts.test.tsx
+++ b/web/src/player/hooks/useKeyboardShortcuts.test.tsx
@@ -48,3 +48,30 @@ it("toggles fullscreen with F", () => {
   fireEvent.keyDown(document.body, { key: "F" });
   expect(toggleFullscreen).toHaveBeenCalledTimes(2);
 });
+
+it("leaves Space to a focused player menu item", () => {
+  const handlePlayPause = vi.fn();
+  renderHook(() =>
+    useKeyboardShortcuts(
+      { current: document.createElement("video") },
+      vi.fn(),
+      handlePlayPause,
+      { back: vi.fn(), forward: vi.fn() },
+      vi.fn(),
+      vi.fn(),
+      undefined,
+      true,
+    ),
+  );
+  const menu = document.createElement("div");
+  menu.setAttribute("role", "menu");
+  const item = document.createElement("button");
+  menu.appendChild(item);
+  document.body.appendChild(menu);
+
+  expect(fireEvent.keyDown(item, { key: " " })).toBe(true);
+  expect(handlePlayPause).not.toHaveBeenCalled();
+  fireEvent.keyDown(document.body, { key: " " });
+  expect(handlePlayPause).toHaveBeenCalledOnce();
+  menu.remove();
+});
diff --git a/web/src/player/hooks/useKeyboardShortcuts.ts b/web/src/player/hooks/useKeyboardShortcuts.ts
index e7aa9d0323..71c31dd48d 100644
--- a/web/src/player/hooks/useKeyboardShortcuts.ts
+++ b/web/src/player/hooks/useKeyboardShortcuts.ts
@@ -27,6 +27,9 @@ export function useKeyboardShortcuts(
       if (target.tagName === "INPUT" || target.tagName === "TEXTAREA" || target.isContentEditable) {
         return;
       }
+      // An open player menu owns the keyboard: Space and Enter choose the
+      // focused item instead of toggling playback.
+      if (target.closest?.('[role="menu"]')) return;
 
       const video = videoRef.current;
       if (!video) return;
diff --git a/web/src/player/hooks/useNextEpisode.ts b/web/src/player/hooks/useNextEpisode.ts
index c53e38a77f..a76d44ead1 100644
--- a/web/src/player/hooks/useNextEpisode.ts
+++ b/web/src/player/hooks/useNextEpisode.ts
@@ -55,8 +55,7 @@ export function useNextEpisode(
         clearInterval(countdownRef.current);
         countdownRef.current = null;
       }
-      // The playback position ends the timer and its overlay together.
-      // eslint-disable-next-line react-hooks/set-state-in-effect
+      // eslint-disable-next-line react-hooks/set-state-in-effect -- the playback position ends the timer and its overlay together
       if (showCountdown) setShowCountdown(false);
       return;
     }
diff --git a/web/src/player/hooks/usePGSSubtitles.test.ts b/web/src/player/hooks/usePGSSubtitles.test.ts
new file mode 100644
index 0000000000..d141ec02cd
--- /dev/null
+++ b/web/src/player/hooks/usePGSSubtitles.test.ts
@@ -0,0 +1,206 @@
+import { describe, expect, it } from "vitest";
+import { videoContentRect, type FitRect } from "../utils/videoFit";
+import { pgsPlaneRect, placePGSObjects } from "./usePGSSubtitles";
+
+type PlaceArgs = Omit<Parameters<typeof placePGSObjects>[0], "objects"> & {
+  object: { x: number; y: number };
+  source: { x: number; y: number; width: number; height: number };
+};
+
+function placePGSObject({ object, source, ...rest }: PlaceArgs): FitRect {
+  const [rect] = placePGSObjects({ ...rest, objects: [{ object, source }] });
+  if (!rect) throw new Error("expected a placed object");
+  return rect;
+}
+
+function two(rects: FitRect[]): [FitRect, FitRect] {
+  const [first, second] = rects;
+  if (!first || !second) throw new Error("expected two placed objects");
+  return [first, second];
+}
+
+describe("pgsPlaneRect", () => {
+  it("covers the picture when the plane matches it", () => {
+    const picture = videoContentRect(1600, 900, 1920, 1080, "contain");
+    expect(pgsPlaneRect(picture, 1920, 1080)).toEqual(picture);
+  });
+
+  it("centers a 16:9 disc plane on a scope encode, reaching into the letterbox", () => {
+    const picture = videoContentRect(1600, 900, 1920, 800, "contain");
+    const plane = pgsPlaneRect(picture, 1920, 1080);
+    expect(plane.width).toBeCloseTo(1600);
+    expect(plane.height).toBeCloseTo(900);
+    expect(plane.y).toBeCloseTo(0);
+    expect(picture.y).toBeGreaterThan(plane.y);
+  });
+
+  it("matches heights for a pillarbox-cropped encode, reaching into the side bars", () => {
+    // A 4:3 picture cropped from a 16:9 disc frame.
+    const picture = videoContentRect(1600, 900, 1440, 1080, "contain");
+    const plane = pgsPlaneRect(picture, 1920, 1080);
+    expect(plane.width).toBeCloseTo(1600);
+    expect(plane.height).toBeCloseTo(900);
+    expect(plane.x).toBeCloseTo(0);
+    expect(plane.y).toBeCloseTo(0);
+  });
+
+  it("stretches anamorphic SD planes to the picture", () => {
+    const picture = videoContentRect(1600, 900, 853, 480, "contain");
+    expect(pgsPlaneRect(picture, 720, 480)).toEqual(picture);
+  });
+});
+
+describe("placePGSObjects", () => {
+  // A centered dialogue line near the bottom of a 1920x1080 plane.
+  const line = { x: 400, y: 950, width: 1120, height: 80 };
+  const source = { x: 0, y: 0, width: line.width, height: line.height };
+
+  function place(boxWidth: number, boxHeight: number, fit: "contain" | "cover", inset = 0) {
+    const picture = videoContentRect(boxWidth, boxHeight, 1920, 800, fit);
+    return placePGSObject({
+      object: line,
+      source,
+      plane: pgsPlaneRect(picture, 1920, 1080),
+      planeWidth: 1920,
+      planeHeight: 1080,
+      boxWidth,
+      boxHeight,
+      bottomInsetPx: inset,
+    });
+  }
+
+  it("keeps the disc position when nothing covers it", () => {
+    const rect = place(1920, 1080, "contain");
+    expect(rect).toEqual({ x: 400, y: 950, width: 1120, height: 80 });
+  });
+
+  it("lifts a lower line clear of the control bar", () => {
+    const rect = place(1920, 1080, "contain", 140);
+    expect(rect.y + rect.height).toBeCloseTo(1080 - 140);
+    expect(rect.x).toBe(400);
+  });
+
+  it("leaves an upper line alone when the control bar is up", () => {
+    const picture = videoContentRect(1920, 1080, 1920, 800, "contain");
+    const rect = placePGSObject({
+      object: { x: 400, y: 60 },
+      source,
+      plane: pgsPlaneRect(picture, 1920, 1080),
+      planeWidth: 1920,
+      planeHeight: 1080,
+      boxWidth: 1920,
+      boxHeight: 1080,
+      bottomInsetPx: 140,
+    });
+    expect(rect.y).toBe(60);
+  });
+
+  it("shrinks an object taller than the room above the control bar", () => {
+    const picture = videoContentRect(640, 360, 1920, 1080, "contain");
+    const tall = { x: 160, y: 300, width: 1600, height: 700 };
+    const rect = placePGSObject({
+      object: tall,
+      source: { x: 0, y: 0, width: tall.width, height: tall.height },
+      plane: pgsPlaneRect(picture, 1920, 1080),
+      planeWidth: 1920,
+      planeHeight: 1080,
+      boxWidth: 640,
+      boxHeight: 360,
+      bottomInsetPx: 120,
+    });
+    expect(rect.y).toBeGreaterThanOrEqual(0);
+    expect(rect.y + rect.height).toBeLessThanOrEqual(360 - 120);
+    expect(rect.width / rect.height).toBeCloseTo(1600 / 700);
+  });
+
+  // Two dialogue lines as two objects, as Blu-ray subtitles often are.
+  const upperLine = { object: { x: 560, y: 900 }, source: { x: 0, y: 0, width: 800, height: 60 } };
+  const lowerLine = { object: { x: 660, y: 980 }, source: { x: 0, y: 0, width: 600, height: 60 } };
+
+  function placeLines(
+    boxWidth: number,
+    boxHeight: number,
+    fit: "contain" | "cover",
+    inset: number,
+  ) {
+    const picture = videoContentRect(boxWidth, boxHeight, 1920, 1080, fit);
+    return placePGSObjects({
+      objects: [upperLine, lowerLine],
+      plane: pgsPlaneRect(picture, 1920, 1080),
+      planeWidth: 1920,
+      planeHeight: 1080,
+      boxWidth,
+      boxHeight,
+      bottomInsetPx: inset,
+    });
+  }
+
+  it("lifts both lines of a subtitle together above the control bar", () => {
+    const [first, second] = two(placeLines(1920, 1080, "contain", 140));
+    expect(second.y + second.height).toBeCloseTo(1080 - 140);
+    expect(second.y - first.y).toBeCloseTo(80);
+    expect(first.x).toBe(560);
+    expect(second.x).toBe(660);
+  });
+
+  it("shrinks both lines of a subtitle by one factor in a narrow Fill viewport", () => {
+    const wide = { x: 210, y: 900 };
+    const picture = videoContentRect(390, 700, 1920, 1080, "cover");
+    const [first, second] = two(
+      placePGSObjects({
+        objects: [{ object: wide, source: { x: 0, y: 0, width: 1500, height: 60 } }, lowerLine],
+        plane: pgsPlaneRect(picture, 1920, 1080),
+        planeWidth: 1920,
+        planeHeight: 1080,
+        boxWidth: 390,
+        boxHeight: 700,
+        bottomInsetPx: 0,
+      }),
+    );
+    expect(first.height).toBeCloseTo(second.height);
+    expect(first.width / second.width).toBeCloseTo(1500 / 600);
+    expect(first.x).toBeGreaterThanOrEqual(0);
+    expect(first.x + first.width).toBeLessThanOrEqual(390);
+    expect(second.y).toBeGreaterThan(first.y + first.height);
+  });
+
+  it("places an upper sign apart from the dialogue below it", () => {
+    const picture = videoContentRect(1920, 1080, 1920, 1080, "contain");
+    const [sign, dialogue] = two(
+      placePGSObjects({
+        objects: [
+          { object: { x: 700, y: 60 }, source: { x: 0, y: 0, width: 500, height: 60 } },
+          lowerLine,
+        ],
+        plane: pgsPlaneRect(picture, 1920, 1080),
+        planeWidth: 1920,
+        planeHeight: 1080,
+        boxWidth: 1920,
+        boxHeight: 1080,
+        bottomInsetPx: 140,
+      }),
+    );
+    expect(sign.y).toBe(60);
+    expect(dialogue.y + dialogue.height).toBeCloseTo(1080 - 140);
+  });
+
+  it("keeps a line inside a narrow Fill viewport", () => {
+    const rect = place(390, 844, "cover");
+    expect(rect.x).toBeGreaterThanOrEqual(0);
+    expect(rect.x + rect.width).toBeLessThanOrEqual(390);
+    expect(rect.y + rect.height).toBeLessThanOrEqual(844);
+  });
+});
+
+describe("videoContentRect", () => {
+  it("letterboxes for contain and overflows for cover", () => {
+    const contain = videoContentRect(1000, 1000, 1920, 1080, "contain");
+    expect(contain.x).toBeCloseTo(0);
+    expect(contain.y).toBeCloseTo(218.75);
+    expect(contain.width).toBeCloseTo(1000);
+    expect(contain.height).toBeCloseTo(562.5);
+    const cover = videoContentRect(1000, 1000, 1920, 1080, "cover");
+    expect(cover.height).toBe(1000);
+    expect(cover.x).toBeLessThan(0);
+  });
+});
diff --git a/web/src/player/hooks/usePGSSubtitles.ts b/web/src/player/hooks/usePGSSubtitles.ts
new file mode 100644
index 0000000000..478acaa142
--- /dev/null
+++ b/web/src/player/hooks/usePGSSubtitles.ts
@@ -0,0 +1,430 @@
+import { useEffect, useRef, type RefObject } from "react";
+import type { PlayerSubtitleInfo, VideoFitMode } from "../types";
+import { videoContentRect, type FitRect } from "../utils/videoFit";
+import { isPGSCodec } from "../utils/subtitleCodecs";
+import {
+  decodePGSObject,
+  mergePGSCompositions,
+  pgsCompositionAt,
+  PGSStreamParser,
+  prunePGSTimeline,
+  type PGSComposition,
+  type PGSPlacedObject,
+} from "../utils/pgs";
+import {
+  createSubtitleWindowFetcher,
+  SUBTITLE_WINDOW_SECONDS,
+  subtitlePlayheadSeconds,
+  subtitleWindowUrl,
+} from "../utils/subtitleWindows";
+
+// A PGS composition stays on screen until the next one replaces it, and the
+// server's positioned extract starts at the window, so a fresh window reaches
+// back far enough to include a subtitle already showing at the playhead.
+const SEEK_BACKOFF = 10;
+// Decoding is the costly step, and a crafted stream could redefine a huge
+// object on every display set. Real streams stay well under this, even a
+// full-plane fade at 24 frames a second (about 50 million pixels).
+const MAX_DECODED_PIXELS_PER_SECOND = 4 * 4096 * 4096;
+// Keeps a subtitle that would land past the player's edge (a Fill crop, or a
+// plane larger than the cropped video) this far inside it.
+const EDGE_MARGIN_RATIO = 0.02;
+
+interface DecodedBitmap {
+  rle: Uint8Array;
+  palette: Uint32Array;
+  bitmap: CanvasImageSource | null;
+}
+
+export type PGSLoadState = "idle" | "loading" | "ready" | "error";
+
+export interface UsePGSSubtitlesOptions {
+  videoRef: RefObject<HTMLVideoElement | null>;
+  canvasRef: RefObject<HTMLCanvasElement | null>;
+  subtitleUrls: PlayerSubtitleInfo[];
+  activeSubtitleIndex: number | null;
+  /**
+   * False when the client must not draw: the player is detached, or the plan
+   * burns this track into the video already.
+   */
+  enabled: boolean;
+  streamOriginSeconds: number;
+  subtitleDelayMs: number;
+  /** Known media duration in source seconds (0 when unknown). */
+  durationRef: RefObject<number>;
+  /** Media-time position playback is heading to before media has loaded. */
+  fetchAnchorRef: RefObject<number>;
+  videoFit: VideoFitMode;
+  /**
+   * Pixels at the bottom of the player that subtitles placed in the lower
+   * half must stay above: the control bar and its gap while the bar is up.
+   */
+  bottomInsetPx?: number;
+  onLoadState?: (state: PGSLoadState) => void;
+}
+
+/**
+ * Maps the composition plane onto the screen. An HD plane is the disc's full
+ * frame and the picture is that frame, maybe cropped, so the plane keeps its
+ * aspect, matches the picture along the uncropped side, and is centered on
+ * it: a 1920x1080 plane over a 1920x800 scope encode reaches into the
+ * letterbox, and over a 1440x1080 pillarbox crop into the side bars, where
+ * the disc placed the subtitles. SD planes are anamorphic, so they stretch to
+ * the picture.
+ */
+export function pgsPlaneRect(video: FitRect, planeWidth: number, planeHeight: number): FitRect {
+  if (planeWidth <= 0 || planeHeight <= 0) return video;
+  if (planeHeight <= 576) return video;
+  const scale = Math.max(video.width / planeWidth, video.height / planeHeight);
+  const width = planeWidth * scale;
+  const height = planeHeight * scale;
+  return {
+    x: video.x + (video.width - width) / 2,
+    y: video.y + (video.height - height) / 2,
+    width,
+    height,
+  };
+}
+
+/** Moves a span inside [min, max], centered there when it is too long to fit. */
+function clampSpan(start: number, size: number, min: number, max: number): number {
+  if (size > max - min) return min + (max - min - size) / 2;
+  return Math.min(Math.max(start, min), max - size);
+}
+
+/**
+ * Where a composition's objects land in the player box. Each object keeps its
+ * place on the plane. Objects in the same half of the box then move and shrink
+ * as one block, so the two lines of a subtitle stay apart and at one scale:
+ * the block stays inside the box with a small margin, shrinking when it does
+ * not fit (a Fill crop on a narrow screen, or a tall subtitle over a short
+ * player), and a lower-half block also stays above `bottomInsetPx`.
+ */
+export function placePGSObjects({
+  objects,
+  plane,
+  planeWidth,
+  planeHeight,
+  boxWidth,
+  boxHeight,
+  bottomInsetPx,
+}: {
+  objects: { object: { x: number; y: number }; source: FitRect }[];
+  plane: FitRect;
+  planeWidth: number;
+  planeHeight: number;
+  boxWidth: number;
+  boxHeight: number;
+  bottomInsetPx: number;
+}): FitRect[] {
+  const scaleX = plane.width / planeWidth;
+  const scaleY = plane.height / planeHeight;
+  const marginX = boxWidth * EDGE_MARGIN_RATIO;
+  const marginY = boxHeight * EDGE_MARGIN_RATIO;
+  const onPlane = objects.map(({ object, source }) => ({
+    x: plane.x + object.x * scaleX,
+    y: plane.y + object.y * scaleY,
+    width: source.width * scaleX,
+    height: source.height * scaleY,
+  }));
+  const placed = [...onPlane];
+  for (const lowerHalf of [false, true]) {
+    const group = onPlane
+      .map((rect, index) => ({ rect, index }))
+      .filter(({ rect }) => rect.y + rect.height / 2 > boxHeight / 2 === lowerHalf);
+    if (group.length === 0) continue;
+    const left = Math.min(...group.map(({ rect }) => rect.x));
+    const top = Math.min(...group.map(({ rect }) => rect.y));
+    const width = Math.max(...group.map(({ rect }) => rect.x + rect.width)) - left;
+    const height = Math.max(...group.map(({ rect }) => rect.y + rect.height)) - top;
+    const bottom = boxHeight - Math.max(marginY, lowerHalf ? bottomInsetPx : 0);
+    const roomX = boxWidth - 2 * marginX;
+    const roomY = bottom - marginY;
+    const shrink = Math.max(0, Math.min(1, roomX / width, roomY / height));
+    const blockWidth = width * shrink;
+    const blockHeight = height * shrink;
+    const blockX = clampSpan(
+      left + (width - blockWidth) / 2,
+      blockWidth,
+      marginX,
+      boxWidth - marginX,
+    );
+    const blockY = clampSpan(top + (height - blockHeight) / 2, blockHeight, marginY, bottom);
+    for (const { rect, index } of group) {
+      placed[index] = {
+        x: blockX + (rect.x - left) * shrink,
+        y: blockY + (rect.y - top) * shrink,
+        width: rect.width * shrink,
+        height: rect.height * shrink,
+      };
+    }
+  }
+  return placed;
+}
+
+function objectSourceRect(object: PGSPlacedObject): FitRect {
+  const crop = object.crop;
+  if (!crop) return { x: 0, y: 0, width: object.width, height: object.height };
+  const x = Math.min(crop.x, object.width);
+  const y = Math.min(crop.y, object.height);
+  return {
+    x,
+    y,
+    width: Math.max(0, Math.min(crop.width, object.width - x)),
+    height: Math.max(0, Math.min(crop.height, object.height - y)),
+  };
+}
+
+/**
+ * Renders the selected embedded PGS track on a canvas over the video.
+ *
+ * The server serves embedded PGS losslessly as `.sup` with absolute source
+ * timestamps once the client declares `embedded_bitmap`, so nothing has to be
+ * burned into the video. Display sets are fetched in positioned windows,
+ * parsed incrementally, and drawn whenever the composition on screen changes.
+ */
+export function usePGSSubtitles({
+  videoRef,
+  canvasRef,
+  subtitleUrls,
+  activeSubtitleIndex,
+  enabled,
+  streamOriginSeconds,
+  subtitleDelayMs,
+  durationRef,
+  fetchAnchorRef,
+  videoFit,
+  bottomInsetPx = 0,
+  onLoadState,
+}: UsePGSSubtitlesOptions): { isActive: boolean } {
+  const onLoadStateRef = useRef(onLoadState);
+  onLoadStateRef.current = onLoadState;
+  const timingRef = useRef({ origin: streamOriginSeconds, delayMs: subtitleDelayMs });
+  timingRef.current = { origin: streamOriginSeconds, delayMs: subtitleDelayMs };
+  const videoFitRef = useRef(videoFit);
+  videoFitRef.current = videoFit;
+  const bottomInsetRef = useRef(bottomInsetPx);
+  bottomInsetRef.current = bottomInsetPx;
+  // Forces a repaint on the next frame without restarting the loader.
+  const layoutRevisionRef = useRef(0);
+
+  const activeSub =
+    activeSubtitleIndex !== null
+      ? (subtitleUrls.find((track) => track.index === activeSubtitleIndex) ?? null)
+      : null;
+  const activeUrl =
+    enabled && activeSub && isPGSCodec(activeSub.codec) && activeSub.url ? activeSub.url : null;
+
+  useEffect(() => {
+    layoutRevisionRef.current += 1;
+  }, [videoFit, subtitleDelayMs, streamOriginSeconds, bottomInsetPx]);
+
+  useEffect(() => {
+    const video = videoRef.current;
+    const canvas = canvasRef.current;
+    if (!activeUrl || !video || !canvas) {
+      onLoadStateRef.current?.("idle");
+      return;
+    }
+    const videoEl: HTMLVideoElement = video;
+    const canvasEl: HTMLCanvasElement = canvas;
+    const url: string = activeUrl;
+
+    let cancelled = false;
+    let timeline: PGSComposition[] = [];
+    // Carried across contiguous windows so an epoch that began in one window
+    // still resolves in the next; a fresh window starts a new one.
+    let parser: PGSStreamParser | null = null;
+    let frameRequest = 0;
+    let painted: { composition: PGSComposition | null; key: string } = {
+      composition: null,
+      key: "",
+    };
+    // Only the last screen drawn keeps decoded bitmaps; a feature-length
+    // track would otherwise hold every subtitle it has shown. They are keyed by
+    // the object's pixel data and palette, which display sets share by
+    // reference while the definitions are unchanged, so a screen that is
+    // placed again or repeated at an acquisition point is not decoded again.
+    let bitmaps: DecodedBitmap[] = [];
+    let decodeBudget = { since: 0, pixels: 0 };
+
+    function sourceTime(): number {
+      const { origin, delayMs } = timingRef.current;
+      return subtitlePlayheadSeconds(videoEl, origin, fetchAnchorRef.current) - delayMs / 1000;
+    }
+
+    function bitmapFor(
+      object: PGSPlacedObject,
+      previous: DecodedBitmap[],
+    ): CanvasImageSource | null {
+      const same = (entry: DecodedBitmap) =>
+        entry.rle === object.rle && entry.palette === object.palette;
+      const reused = bitmaps.find(same) ?? previous.find(same);
+      if (reused) {
+        if (!bitmaps.includes(reused)) bitmaps.push(reused);
+        return reused.bitmap;
+      }
+      const now = performance.now();
+      if (now - decodeBudget.since > 1000) decodeBudget = { since: now, pixels: 0 };
+      decodeBudget.pixels += object.width * object.height;
+      if (decodeBudget.pixels > MAX_DECODED_PIXELS_PER_SECOND) return null;
+      const surface = document.createElement("canvas");
+      surface.width = object.width;
+      surface.height = object.height;
+      const context = surface.getContext("2d");
+      let bitmap: CanvasImageSource | null = null;
+      if (context) {
+        const pixels = decodePGSObject(object);
+        context.putImageData(
+          new ImageData(new Uint8ClampedArray(pixels.buffer), object.width, object.height),
+          0,
+          0,
+        );
+        bitmap = surface;
+      }
+      bitmaps.push({ rle: object.rle, palette: object.palette, bitmap });
+      return bitmap;
+    }
+
+    function paint(composition: PGSComposition | null) {
+      const boxWidth = canvasEl.clientWidth;
+      const boxHeight = canvasEl.clientHeight;
+      const ratio = window.devicePixelRatio || 1;
+      const pixelWidth = Math.max(1, Math.round(boxWidth * ratio));
+      const pixelHeight = Math.max(1, Math.round(boxHeight * ratio));
+      if (canvasEl.width !== pixelWidth || canvasEl.height !== pixelHeight) {
+        canvasEl.width = pixelWidth;
+        canvasEl.height = pixelHeight;
+      }
+      const context = canvasEl.getContext("2d");
+      if (!context) return;
+      context.setTransform(1, 0, 0, 1, 0, 0);
+      context.clearRect(0, 0, pixelWidth, pixelHeight);
+      // A clear keeps the last screen's bitmaps, so a screen that comes back
+      // after it is not decoded again.
+      if (!composition || composition.objects.length === 0) return;
+      const previous = bitmaps;
+      bitmaps = [];
+      context.setTransform(ratio, 0, 0, ratio, 0, 0);
+      context.imageSmoothingEnabled = true;
+      context.imageSmoothingQuality = "high";
+
+      const picture = videoContentRect(
+        boxWidth,
+        boxHeight,
+        videoEl.videoWidth || composition.width,
+        videoEl.videoHeight || composition.height,
+        videoFitRef.current,
+      );
+      const plane = pgsPlaneRect(picture, composition.width, composition.height);
+      const drawable = composition.objects.flatMap((object) => {
+        const source = objectSourceRect(object);
+        if (source.width === 0 || source.height === 0) return [];
+        const bitmap = bitmapFor(object, previous);
+        return bitmap ? [{ object, source, bitmap }] : [];
+      });
+      const targets = placePGSObjects({
+        objects: drawable,
+        plane,
+        planeWidth: composition.width,
+        planeHeight: composition.height,
+        boxWidth,
+        boxHeight,
+        bottomInsetPx: bottomInsetRef.current,
+      });
+      drawable.forEach(({ source, bitmap }, index) => {
+        const target = targets[index];
+        if (!target) return;
+        context.drawImage(
+          bitmap,
+          source.x,
+          source.y,
+          source.width,
+          source.height,
+          target.x,
+          target.y,
+          target.width,
+          target.height,
+        );
+      });
+    }
+
+    function renderFrame() {
+      frameRequest = 0;
+      if (cancelled) return;
+      // The clear for the last screen may not have arrived yet, so the
+      // timeline only reaches the last finished window or, past it, the
+      // latest segment the parser has read.
+      const { windowEnd } = fetcher.coverage();
+      const loadedUntil = Math.max(windowEnd, parser?.receivedUntil ?? -Infinity) + 1;
+      const composition = pgsCompositionAt(timeline, sourceTime(), loadedUntil);
+      const key = `${canvasEl.clientWidth}x${canvasEl.clientHeight}@${window.devicePixelRatio}:${videoEl.videoWidth}x${videoEl.videoHeight}:${layoutRevisionRef.current}`;
+      if (composition !== painted.composition || key !== painted.key) {
+        painted = { composition, key };
+        try {
+          paint(composition);
+        } catch (error) {
+          // A damaged display set costs that screen, not the rest of the track.
+          console.error("[usePGSSubtitles] Could not draw a subtitle:", error);
+        }
+      }
+      frameRequest = requestAnimationFrame(renderFrame);
+    }
+
+    const fetcher = createSubtitleWindowFetcher({
+      windowUrl: (start) => subtitleWindowUrl(url, start, "windowed=1"),
+      playhead: () => Math.max(0, sourceTime()),
+      duration: () => durationRef.current ?? 0,
+      seekBackoffSeconds: SEEK_BACKOFF,
+      logTag: "usePGSSubtitles",
+      onWindowStart: (fresh) => {
+        if (fresh) {
+          onLoadStateRef.current?.("loading");
+          timeline = [];
+        }
+        // A fresh window starts a new epoch history. An extend continues the
+        // last one, so display sets past the join can still place objects the
+        // previous window defined; the repeats in the overlap keep the copy the
+        // earlier window resolved.
+        if (fresh || !parser) parser = new PGSStreamParser();
+        else parser.resetBuffer();
+      },
+      onChunk: (chunk) => {
+        const parsed = parser?.push(chunk) ?? [];
+        if (parsed.length === 0) return;
+        timeline = mergePGSCompositions(timeline, parsed);
+        onLoadStateRef.current?.("ready");
+      },
+      onWindowCommitted: (fresh) => {
+        onLoadStateRef.current?.("ready");
+        // Keep about one window behind the playhead, so a straight run
+        // through a long film holds a bounded number of screens.
+        const keepFrom = sourceTime() - SUBTITLE_WINDOW_SECONDS;
+        if (!fresh && keepFrom > fetcher.coverage().coverageStart) {
+          timeline = prunePGSTimeline(timeline, keepFrom);
+          fetcher.releaseBefore(keepFrom);
+        }
+      },
+      onWindowFailed: () => onLoadStateRef.current?.("error"),
+    });
+    const maybeFetch = fetcher.maybeFetch;
+
+    maybeFetch();
+    videoEl.addEventListener("timeupdate", maybeFetch);
+    videoEl.addEventListener("seeking", maybeFetch);
+    videoEl.addEventListener("seeked", maybeFetch);
+    frameRequest = requestAnimationFrame(renderFrame);
+
+    return () => {
+      cancelled = true;
+      fetcher.dispose();
+      if (frameRequest) cancelAnimationFrame(frameRequest);
+      videoEl.removeEventListener("timeupdate", maybeFetch);
+      videoEl.removeEventListener("seeking", maybeFetch);
+      videoEl.removeEventListener("seeked", maybeFetch);
+      canvasEl.getContext("2d")?.clearRect(0, 0, canvasEl.width, canvasEl.height);
+    };
+  }, [activeUrl, canvasRef, durationRef, fetchAnchorRef, videoRef]);
+
+  return { isActive: activeUrl !== null };
+}
diff --git a/web/src/player/hooks/usePlaybackSession.test.ts b/web/src/player/hooks/usePlaybackSession.test.ts
index 81007757c4..8f5f30ae07 100644
--- a/web/src/player/hooks/usePlaybackSession.test.ts
+++ b/web/src/player/hooks/usePlaybackSession.test.ts
@@ -1,7 +1,8 @@
 import { act, renderHook, waitFor } from "@testing-library/react";
 import { createElement, type ReactNode } from "react";
-import { afterEach, describe, expect, it, vi } from "vitest";
+import { afterEach, describe, expect, it, onTestFinished, vi } from "vitest";
 
+import { forgetBandwidthEstimate, recordObservedBandwidthLimitKbps } from "../bandwidth-probe";
 import { PlayerConfigProvider, type PlayerConfig } from "../context/PlayerConfigContext";
 import { markPlaybackIntent } from "../first-frame";
 import {
@@ -80,6 +81,7 @@ function jsonResponse(body: unknown, init: ResponseInit = {}) {
 afterEach(() => {
   resetCodecDetectionForTests();
   resetSessionMutations();
+  forgetBandwidthEstimate();
   vi.restoreAllMocks();
   vi.unstubAllGlobals();
 });
@@ -91,7 +93,6 @@ const startBase = {
   qualityPreference: "auto",
   position: 0,
   forceStartPosition: false,
-  metered: false,
   clientCapabilities: fixtureClientCapabilitiesV3(),
   clientPlaybackContext: fixtureClientPlaybackContextV3(),
 };
@@ -105,7 +106,6 @@ const replanBase = {
   positionSeconds: 120,
   attemptedPlanKeys: [],
   attemptCount: 1,
-  metered: false,
   clientCapabilities: fixtureClientCapabilitiesV3(),
   clientPlaybackContext: fixtureClientPlaybackContextV3(),
 };
@@ -203,6 +203,11 @@ describe("buildStartRequestV3", () => {
     });
   });
 
+  // The server ignores `metered`; a metered link only stops a measurement.
+  it("sends no metered flag", () => {
+    expect(buildStartRequestV3(startBase)).not.toHaveProperty("metered");
+  });
+
   it("sends the quality preference verbatim for the server to normalize", () => {
     expect(buildStartRequestV3({ ...startBase, qualityPreference: "original" })).toMatchObject({
       quality_preference: "original",
@@ -351,6 +356,19 @@ describe("buildReplanRequestV3", () => {
     expect(body.quality_preference).toBe("original");
   });
 
+  it("sends a measured estimate when there is one, and no metered flag", () => {
+    const body = buildReplanRequestV3({ ...replanBase, operation: "quality_change" });
+    expect(body).not.toHaveProperty("bandwidth_estimate_kbps");
+    expect(body).not.toHaveProperty("metered");
+    expect(
+      buildReplanRequestV3({
+        ...replanBase,
+        operation: "quality_change",
+        bandwidthEstimateKbps: 4_200,
+      }),
+    ).toMatchObject({ bandwidth_estimate_kbps: 4_200 });
+  });
+
   it("preserves the user bandwidth ceiling across replans", () => {
     const body = buildReplanRequestV3({
       ...replanBase,
@@ -422,6 +440,15 @@ describe("usePlaybackSession quality changes", () => {
       throw new Error(`Unexpected request: ${url}`);
     });
     vi.stubGlobal("fetch", fetchMock);
+    // Only the browser's rounded downlink hint is available, which is a guess:
+    // no request may carry it as an estimate.
+    Object.defineProperty(navigator, "connection", {
+      configurable: true,
+      value: { downlink: 4.5 },
+    });
+    onTestFinished(() => {
+      delete (navigator as Navigator & { connection?: unknown }).connection;
+    });
 
     const { result, unmount } = renderHook(
       () => usePlaybackSession("request-1", [], [], 7, 0, false, "original"),
@@ -429,11 +456,13 @@ describe("usePlaybackSession quality changes", () => {
     );
 
     await waitFor(() => expect(result.current.plan).not.toBeNull());
+    // A stored "original" is the legacy spelling of Auto.
+    expect(result.current.qualityPreference).toBe("auto");
 
     act(() => result.current.changeQuality("720p", 120));
     await waitFor(() => {
       expect(result.current.replanning).toBe(false);
-      expect(result.current.qualityPreference).toBe("original");
+      expect(result.current.qualityPreference).toBe("auto");
       expect(result.current.error).toBeTruthy();
     });
 
@@ -443,7 +472,94 @@ describe("usePlaybackSession quality changes", () => {
     const replanBodies = fetchMock.mock.calls
       .filter(([url]) => String(url).endsWith("/playback/session-1/replan"))
       .map(([, init]) => JSON.parse(String(init?.body)) as { quality_preference: string });
-    expect(replanBodies.map((body) => body.quality_preference)).toEqual(["720p", "original"]);
+    expect(replanBodies.map((body) => body.quality_preference)).toEqual(["720p", "auto"]);
+
+    const startBody = JSON.parse(
+      String(
+        fetchMock.mock.calls.find(([url]) => String(url).endsWith("/playback/start"))?.[1]?.body,
+      ),
+    ) as Record<string, unknown>;
+    expect(startBody.quality_preference).toBe("auto");
+    for (const body of [startBody, ...replanBodies]) {
+      expect(body).not.toHaveProperty("bandwidth_estimate_kbps");
+      expect(body).not.toHaveProperty("metered");
+    }
+
+    unmount();
+  });
+
+  it("replans Auto with the lower estimate a stall step-down recorded", async () => {
+    const plan = fixturePlanV3();
+    const fetchMock = vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
+      const url = String(input);
+      if (url.endsWith("/playback/start")) {
+        return jsonResponse(
+          {
+            protocol_version: 3,
+            server_features: ["playback_plan_v3"],
+            outcome: "playable",
+            session_id: "session-1",
+            playback_plan: plan,
+          },
+          { status: 201 },
+        );
+      }
+      if (url.endsWith("/playback/session-1/replan")) {
+        return jsonResponse({
+          protocol_version: 3,
+          server_features: ["playback_plan_v3"],
+          outcome: "playable",
+          session_id: "session-1",
+          playback_plan: fixturePlanV3({
+            plan_id: "plan:fedcba9876543210",
+            plan_attempt_key: "v3:fedcba9876543210",
+          }),
+        });
+      }
+      if (url.endsWith("/playback/route-events")) {
+        return new Response(null, { status: 202 });
+      }
+      if (init?.method === "DELETE") {
+        return jsonResponse({ outcome: "stopped" });
+      }
+      throw new Error(`Unexpected request: ${url}`);
+    });
+    vi.stubGlobal("fetch", fetchMock);
+    const bodiesTo = (suffix: string) =>
+      fetchMock.mock.calls
+        .filter(([url]) => String(url).endsWith(suffix))
+        .map(([, init]) => JSON.parse(String(init?.body)) as Record<string, unknown>);
+
+    // The viewer's saved maximum is 8 Mbps.
+    const { result, unmount } = renderHook(
+      () => usePlaybackSession("request-1", [], [], 7, 0, false, "auto", 8_000),
+      { wrapper },
+    );
+    await waitFor(() => expect(result.current.plan).not.toBeNull());
+    // Nothing was measured yet, so Auto starts without an estimate.
+    expect(bodiesTo("/playback/start")[0]).not.toHaveProperty("bandwidth_estimate_kbps");
+    expect(bodiesTo("/playback/start")[0]?.bandwidth_cap_kbps).toBe(8_000);
+
+    // What VideoPlayer does when Auto keeps stalling: record the lower
+    // estimate, then replan Auto.
+    recordObservedBandwidthLimitKbps(4_200);
+    act(() => result.current.changeQuality("auto", 120));
+    await waitFor(() => expect(bodiesTo("/playback/session-1/replan")).toHaveLength(1));
+    expect(bodiesTo("/playback/session-1/replan")[0]).toMatchObject({
+      operation: "quality_change",
+      quality_preference: "auto",
+      bandwidth_estimate_kbps: 4_200,
+      bandwidth_cap_kbps: 8_000,
+    });
+    await waitFor(() => expect(result.current.replanning).toBe(false));
+
+    // The cap stays the viewer's own saved maximum on a fixed quality too.
+    act(() => result.current.changeQuality("720p", 130));
+    await waitFor(() => expect(bodiesTo("/playback/session-1/replan")).toHaveLength(2));
+    expect(bodiesTo("/playback/session-1/replan")[1]).toMatchObject({
+      quality_preference: "720p",
+      bandwidth_cap_kbps: 8_000,
+    });
 
     unmount();
   });
@@ -2646,6 +2762,38 @@ describe("usePlaybackSession mid-stream reconnect", () => {
     unmount();
   });
 
+  it("does not reconnect a session a reanchor found ended before that state renders", async () => {
+    const harness = reconnectHarness({
+      replan: () =>
+        jsonResponse(
+          {
+            type: "https://siloserver.org/docs/api/v2/problems/playback_session_ended",
+            title: "Playback session ended",
+            status: 410,
+            detail: "An administrator ended this playback session",
+          },
+          { status: 410 },
+        ),
+      restart: () => jsonResponse(playable("session-2"), { status: 201 }),
+    });
+    const { result, unmount } = await startPlaying();
+    const session = result.current;
+
+    // The player's reopen fallback runs as soon as the reanchor settles, from a
+    // render that still says connected.
+    await act(async () => {
+      expect(await session.reanchorSeek(240)).toBe(false);
+      session.recoverConnection(240, true);
+    });
+    await advance(RECONNECT_MAX_DELAY_MS * 2);
+
+    expect(harness.replanBodies).toHaveLength(1);
+    expect(harness.startBodies).toHaveLength(1);
+    expect(result.current.connectionStatus).toBe("ended");
+
+    unmount();
+  });
+
   it("starts a new session when the server's installation changed", async () => {
     let restarts = 0;
     const harness = reconnectHarness({
diff --git a/web/src/player/hooks/usePlaybackSession.ts b/web/src/player/hooks/usePlaybackSession.ts
index 57c34a729b..7235defc47 100644
--- a/web/src/player/hooks/usePlaybackSession.ts
+++ b/web/src/player/hooks/usePlaybackSession.ts
@@ -14,11 +14,13 @@ import {
   PlayerFetchError,
 } from "../player-fetch";
 import { useCodecDetection } from "./useCodecDetection";
+import { useBrowserEngineCapabilities } from "./useBrowserEngine";
+import type { EngineCapabilities } from "../engine/capabilities";
+import type { NativeOriginalSupport } from "../engine/routing";
 import {
   buildClientCapabilitiesV3,
   buildClientPlaybackContextV3,
   detectBandwidthEstimateKbpsV3,
-  detectMeteredV3,
 } from "../client-context-v3";
 import { buildRouteEventV3 } from "../route-events-v3";
 import { reportSessionRouteEventV2 } from "../route-events-v2";
@@ -30,7 +32,7 @@ import {
   FEATURE_OUTPUT_CHANGE_V3,
   MAX_ATTEMPT_COUNT_V3,
   MAX_ATTEMPTED_PLAN_KEYS_V3,
-  QUALITY_ORIGINAL_V3,
+  normalizeQualityPreferenceV3,
   type DecisionResponseV3,
   type FailureV3,
   type PlanV3,
@@ -166,6 +168,13 @@ interface PlaybackSessionErrorState {
 }
 
 export interface UsePlaybackSessionResult extends PlaybackSessionState {
+  /**
+   * The browser decode engine's capabilities, when browser decoding is on and
+   * this browser can run it. The player routes `original_http` plans with it.
+   */
+  browserEngine: EngineCapabilities | null;
+  /** What the media element itself plays from an untouched original. */
+  nativeOriginalSupport: NativeOriginalSupport;
   /** Starts a fresh session against another file (edition/version switch). */
   switchVersion: (fileId: number, currentPosition: number) => void;
   /** `track_change` replan selecting another audio track by combined index. */
@@ -383,9 +392,24 @@ export function usePlaybackSession(
 ): UsePlaybackSessionResult {
   const config = usePlayerConfig();
   const probe = useCodecDetection();
-  const capabilitiesSettled = probe.settled;
-  const clientCapabilities = useMemo(() => buildClientCapabilitiesV3(probe), [probe]);
-  const clientPlaybackContext = useMemo(() => buildClientPlaybackContextV3(probe), [probe]);
+  const browserEngine = useBrowserEngineCapabilities();
+  const capabilitiesSettled = probe.settled && browserEngine.settled;
+  const clientCapabilities = useMemo(
+    () => buildClientCapabilitiesV3(probe, browserEngine.capabilities),
+    [probe, browserEngine.capabilities],
+  );
+  const clientPlaybackContext = useMemo(
+    () => buildClientPlaybackContextV3(probe, browserEngine.capabilities),
+    [probe, browserEngine.capabilities],
+  );
+  const nativeOriginalSupport = useMemo<NativeOriginalSupport>(
+    () => ({
+      containers: probe.containers,
+      videoCodecs: probe.codecsVideo,
+      audioCodecs: probe.codecsAudio,
+    }),
+    [probe.codecsAudio, probe.codecsVideo, probe.containers],
+  );
   const capabilityRequestKey = useMemo(
     () => JSON.stringify([clientCapabilities, clientPlaybackContext]),
     [clientCapabilities, clientPlaybackContext],
@@ -402,7 +426,7 @@ export function usePlaybackSession(
     audioTrackIndex: 0,
     durationSeconds: null,
     subtitleUrls: [],
-    qualityPreference: qualityPreference?.trim() || "auto",
+    qualityPreference: normalizeQualityPreferenceV3(qualityPreference),
     shouldAutoPlay: true,
     loading: true,
     replacing: false,
@@ -422,6 +446,10 @@ export function usePlaybackSession(
   const planRevisionRef = useRef(0);
   const serverFeaturesRef = useRef<string[]>([]);
   const stateRef = useRef(state);
+  // Set as soon as the server says an administrator ended the session, before
+  // the state carrying it renders, so a caller acting on an older render
+  // cannot start a reconnect against it.
+  const sessionEndedRef = useRef(false);
   const activeRequestKeyRef = useRef<string | null>(null);
   const activeCapabilityRequestKeyRef = useRef<string | null>(null);
   const playbackPositionRef = useRef(initialPosition);
@@ -492,7 +520,7 @@ export function usePlaybackSession(
       reconnect?: boolean,
     ) => Promise<boolean>
   >(async () => false);
-  const qualityRef = useRef(qualityPreference?.trim() || "auto");
+  const qualityRef = useRef(normalizeQualityPreferenceV3(qualityPreference));
   // The running mid-stream reconnect, if any. `generation` invalidates the
   // timer and any request of a cycle that has ended, so nothing it started can
   // act after the viewer left, a new start took over, or a plan was adopted.
@@ -650,6 +678,7 @@ export function usePlaybackSession(
       const sessionId = plan.session_id ?? decision.session_id ?? sessionIdRef.current;
       planAttemptIdRef.current = randomUUID();
       planRef.current = plan;
+      sessionEndedRef.current = false;
       sessionIdRef.current = sessionId ?? null;
       planRevisionRef.current += 1;
       hasAdoptedPlanRef.current = true;
@@ -709,7 +738,6 @@ export function usePlaybackSession(
         forceStartPosition,
         explicitAudioTrackIndex: audioTrackIndex,
         subtitleTrackIndex,
-        metered: detectMeteredV3(),
         bandwidthEstimateKbps: detectBandwidthEstimateKbpsV3(),
         bandwidthCapKbps: maxBitrateKbps,
         clientCapabilities,
@@ -1038,7 +1066,7 @@ export function usePlaybackSession(
     }
     activeRequestKeyRef.current = requestKey;
     activeCapabilityRequestKeyRef.current = capabilityRequestKey;
-    qualityRef.current = qualityPreference?.trim() || "auto";
+    qualityRef.current = normalizeQualityPreferenceV3(qualityPreference);
     playbackPositionRef.current = initialPosition;
     const intentAt = takePlaybackIntent(requestKey);
     startIntentRef.current = {
@@ -1194,7 +1222,6 @@ export function usePlaybackSession(
         qualityPreference: qualityRef.current,
         attemptedPlanKeys,
         attemptCount,
-        metered: detectMeteredV3(),
         bandwidthEstimateKbps: detectBandwidthEstimateKbpsV3(),
         bandwidthCapKbps: maxBitrateKbps,
         clientCapabilities,
@@ -1268,6 +1295,7 @@ export function usePlaybackSession(
         if (isPlaybackSessionEndedError(err)) {
           // An administrator ended the session: leave rather than show an
           // error or recover into a fresh session.
+          sessionEndedRef.current = true;
           setState((current) => ({
             ...current,
             replanning: false,
@@ -1426,7 +1454,7 @@ export function usePlaybackSession(
 
   const changeQuality = useCallback(
     (label: string, currentPosition: number) => {
-      const normalized = label.trim() || QUALITY_ORIGINAL_V3;
+      const normalized = normalizeQualityPreferenceV3(label);
       const previousPreference = qualityRef.current;
       qualityRef.current = normalized;
       setState((current) => ({ ...current, qualityPreference: normalized }));
@@ -1562,6 +1590,7 @@ export function usePlaybackSession(
       } catch (error) {
         if (!isCurrent()) return;
         if (isPlaybackSessionEndedError(error)) {
+          sessionEndedRef.current = true;
           endReconnect(false);
           setState((current) => ({
             ...current,
@@ -1613,8 +1642,9 @@ export function usePlaybackSession(
 
   const recoverConnection = useCallback(
     (positionSeconds: number, resume: boolean) => {
-      // Only a stream that exists can lose its connection.
-      if (!planRef.current || !sessionIdRef.current) return;
+      // Only a stream that exists can lose its connection, and a session an
+      // administrator ended stays ended.
+      if (!planRef.current || !sessionIdRef.current || sessionEndedRef.current) return;
       beginReconnect(positionSeconds, resume, false);
     },
     [beginReconnect],
@@ -1806,6 +1836,8 @@ export function usePlaybackSession(
 
   return {
     ...state,
+    browserEngine: browserEngine.capabilities,
+    nativeOriginalSupport,
     switchVersion,
     switchAudioTrack,
     changeSubtitleTrack,
diff --git a/web/src/player/hooks/useSeriesEpisodes.ts b/web/src/player/hooks/useSeriesEpisodes.ts
index 2a7859f38a..9b9d1776b1 100644
--- a/web/src/player/hooks/useSeriesEpisodes.ts
+++ b/web/src/player/hooks/useSeriesEpisodes.ts
@@ -62,6 +62,7 @@ export function useSeriesEpisodes(
     title: ep.title,
     runtime: ep.runtime,
     overview: ep.overview,
+    machineTranslatedFields: ep.machine_translated_fields,
     stillUrl: ep.still_url,
     stillIsEpisodeStill: ep.still_is_episode_still,
     stillThumbhash: ep.still_thumbhash,
diff --git a/web/src/player/hooks/useSubtitleDelay.test.ts b/web/src/player/hooks/useSubtitleDelay.test.ts
new file mode 100644
index 0000000000..cc4df9859f
--- /dev/null
+++ b/web/src/player/hooks/useSubtitleDelay.test.ts
@@ -0,0 +1,165 @@
+import { act, renderHook } from "@testing-library/react";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { useSubtitleDelay } from "./useSubtitleDelay";
+
+const sync = vi.hoisted(() => ({ offsetMs: 0, isLoaded: true, save: vi.fn() }));
+vi.mock("@/hooks/queries/subtitleSync", async () => {
+  const actual = await vi.importActual<typeof import("@/hooks/queries/subtitleSync")>(
+    "@/hooks/queries/subtitleSync",
+  );
+  return {
+    ...actual,
+    useSubtitleSyncSetting: () => ({
+      offsetMs: sync.offsetMs,
+      isLoaded: sync.isLoaded,
+      save: sync.save,
+    }),
+  };
+});
+
+describe("useSubtitleDelay", () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+    sync.offsetMs = 200;
+    sync.isLoaded = true;
+    sync.save.mockReset().mockResolvedValue(undefined);
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  it("starts from the profile's saved offset", () => {
+    const { result } = renderHook(() => useSubtitleDelay());
+    expect(result.current[0]).toBe(200);
+  });
+
+  it("shows each nudge at once and saves only the last one after a pause", async () => {
+    const { result } = renderHook(() => useSubtitleDelay());
+
+    act(() => result.current[1](300));
+    act(() => result.current[1](400));
+    expect(result.current[0]).toBe(400);
+    expect(sync.save).not.toHaveBeenCalled();
+
+    await act(async () => {
+      vi.advanceTimersByTime(600);
+      await Promise.resolve();
+    });
+    expect(sync.save).toHaveBeenCalledTimes(1);
+    expect(sync.save).toHaveBeenCalledWith(400);
+  });
+
+  it("clamps to the contract's bounds", () => {
+    const { result } = renderHook(() => useSubtitleDelay());
+    act(() => result.current[1](-12_000));
+    expect(result.current[0]).toBe(-10_000);
+  });
+
+  it("saves a nudge that is still waiting when the player closes", async () => {
+    const { result, unmount } = renderHook(() => useSubtitleDelay());
+    act(() => result.current[1](500));
+
+    unmount();
+    await Promise.resolve();
+
+    expect(sync.save).toHaveBeenCalledWith(500);
+  });
+
+  it("keeps the nudged value for this session when the save fails", async () => {
+    sync.save.mockRejectedValue(new Error("offline"));
+    const { result } = renderHook(() => useSubtitleDelay());
+
+    act(() => result.current[1](700));
+    await act(async () => {
+      vi.advanceTimersByTime(600);
+      await Promise.resolve();
+    });
+
+    expect(result.current[0]).toBe(700);
+  });
+
+  it("ignores nudges until the saved offset has loaded", () => {
+    sync.isLoaded = false;
+    sync.offsetMs = 0;
+    const { result, unmount } = renderHook(() => useSubtitleDelay());
+
+    act(() => result.current[1](100));
+    act(() => vi.advanceTimersByTime(600));
+    unmount();
+
+    expect(result.current[0]).toBe(0);
+    expect(sync.save).not.toHaveBeenCalled();
+  });
+
+  it("sends a later save only after the earlier one has finished", async () => {
+    let finishFirst!: () => void;
+    sync.save.mockImplementationOnce(() => new Promise<void>((resolve) => (finishFirst = resolve)));
+    const { result } = renderHook(() => useSubtitleDelay());
+
+    act(() => result.current[1](300));
+    act(() => vi.advanceTimersByTime(600));
+    act(() => result.current[1](400));
+    await act(async () => {
+      vi.advanceTimersByTime(600);
+      await Promise.resolve();
+    });
+    expect(sync.save).toHaveBeenCalledTimes(1);
+
+    await act(async () => {
+      finishFirst();
+      await Promise.resolve();
+      await Promise.resolve();
+    });
+    expect(sync.save).toHaveBeenCalledTimes(2);
+    expect(sync.save).toHaveBeenLastCalledWith(400);
+  });
+
+  it("keeps showing the nudged value until the saved offset reflects it", async () => {
+    const { result, rerender } = renderHook(() => useSubtitleDelay());
+
+    act(() => result.current[1](300));
+    await act(async () => {
+      vi.advanceTimersByTime(600);
+      await Promise.resolve();
+    });
+    // The save went through but the refetch has not shown it yet.
+    expect(result.current[0]).toBe(300);
+
+    sync.offsetMs = 300;
+    rerender();
+    sync.offsetMs = 900;
+    rerender();
+    expect(result.current[0]).toBe(900);
+  });
+
+  it("keeps a nudge back to the saved value until its queued save lands", async () => {
+    let finishFirst!: () => void;
+    sync.save
+      .mockImplementationOnce(() => new Promise<void>((resolve) => (finishFirst = resolve)))
+      .mockRejectedValueOnce(new Error("offline"));
+    const { result, rerender } = renderHook(() => useSubtitleDelay());
+
+    act(() => result.current[1](300));
+    act(() => vi.advanceTimersByTime(600));
+    act(() => result.current[1](200));
+    expect(result.current[0]).toBe(200);
+    await act(async () => {
+      vi.advanceTimersByTime(600);
+      await Promise.resolve();
+    });
+
+    // The first save lands and the setting refetches 300; the queued 200 then fails.
+    sync.offsetMs = 300;
+    await act(async () => {
+      finishFirst();
+      for (let i = 0; i < 6; i++) await Promise.resolve();
+    });
+    rerender();
+
+    expect(sync.save).toHaveBeenCalledTimes(2);
+    expect(sync.save).toHaveBeenLastCalledWith(200);
+    expect(result.current[0]).toBe(200);
+  });
+});
diff --git a/web/src/player/hooks/useSubtitleDelay.ts b/web/src/player/hooks/useSubtitleDelay.ts
new file mode 100644
index 0000000000..a49d2b3119
--- /dev/null
+++ b/web/src/player/hooks/useSubtitleDelay.ts
@@ -0,0 +1,65 @@
+import { useCallback, useEffect, useRef, useState } from "react";
+import { clampSubtitleSyncMs, useSubtitleSyncSetting } from "@/hooks/queries/subtitleSync";
+
+/** How long the Delay control waits after the last nudge before saving. */
+const SAVE_AFTER_MS = 600;
+
+/**
+ * The player's subtitle delay in ms (positive shows later), bound to the
+ * profile's timing offset so a change here follows the profile to every device.
+ *
+ * A nudge shows at once from a local draft and is saved after a short pause,
+ * so holding the button sends one write instead of one per step. Leaving the
+ * player saves a nudge still waiting out the pause.
+ */
+export function useSubtitleDelay(): [number, (ms: number) => void] {
+  const { offsetMs: savedMs, save, isLoaded } = useSubtitleSyncSetting();
+  const [draftMs, setDraftMs] = useState<number | null>(null);
+  const timerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
+  const flushRef = useRef<(() => void) | null>(null);
+  // Saves run one at a time, so an earlier offset can never land after a later one.
+  const queueRef = useRef<Promise<void>>(Promise.resolve());
+  // Saves scheduled or queued but not yet settled.
+  const [unsettled, setUnsettled] = useState(0);
+
+  // The draft steps aside once every save has settled and the saved value
+  // shows it, not when a save resolves: if the refetch after a save fails, or
+  // an earlier save lands before a queued one, the value shown would not be
+  // the last nudge and the next nudge would build on it. Best effort: a failed
+  // save keeps the draft for this session and the next nudge retries, rather
+  // than interrupting playback.
+  if (draftMs !== null && unsettled === 0 && draftMs === savedMs) setDraftMs(null);
+
+  const setDelayMs = useCallback(
+    (ms: number) => {
+      // Until the saved offset arrives the control shows the default, and a
+      // nudge from it would overwrite the profile's real offset.
+      if (!isLoaded) return;
+      const next = clampSubtitleSyncMs(ms);
+      setDraftMs(next);
+      if (timerRef.current) clearTimeout(timerRef.current);
+      else setUnsettled((count) => count + 1);
+      const flush = () => {
+        timerRef.current = null;
+        flushRef.current = null;
+        queueRef.current = queueRef.current
+          .then(() => save(next))
+          .catch(() => undefined)
+          .finally(() => setUnsettled((count) => count - 1));
+      };
+      flushRef.current = flush;
+      timerRef.current = setTimeout(flush, SAVE_AFTER_MS);
+    },
+    [isLoaded, save],
+  );
+
+  useEffect(
+    () => () => {
+      if (timerRef.current) clearTimeout(timerRef.current);
+      flushRef.current?.();
+    },
+    [],
+  );
+
+  return [draftMs ?? savedMs, setDelayMs];
+}
diff --git a/web/src/player/hooks/useSubtitleTracks.test.tsx b/web/src/player/hooks/useSubtitleTracks.test.tsx
index ac40bc11c3..290ae716fd 100644
--- a/web/src/player/hooks/useSubtitleTracks.test.tsx
+++ b/web/src/player/hooks/useSubtitleTracks.test.tsx
@@ -1,6 +1,9 @@
 import { act, renderHook, waitFor } from "@testing-library/react";
 import type { RefObject } from "react";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import type { EnginePlayer } from "../engine/EnginePlayer";
+import { attachEngineToElement } from "../engine/facade";
+import { EngineTextTrack } from "../engine/textTracks";
 import type { PlayerSubtitleInfo } from "../types";
 import { useSubtitleTracks } from "./useSubtitleTracks";
 
@@ -282,6 +285,54 @@ describe("useSubtitleTracks", () => {
     },
   );
 
+  it("moves a selected track onto the browser engine once its metadata arrives", async () => {
+    fetchMock.mockResolvedValue(vttResponse("WEBVTT\n\n00:00:10.000 --> 00:00:12.000\nhi\n\n"));
+    const videoRef = makeVideoRef(1);
+    const { result, rerender } = renderHook(
+      ({ generation }) =>
+        useSubtitleTracks(
+          videoRef,
+          [srtTrack],
+          1,
+          0,
+          0,
+          { current: 7200 },
+          { current: 0 },
+          undefined,
+          null,
+          generation,
+        ),
+      { initialProps: { generation: 0 } },
+    );
+    // The track is built on the native element before the engine has loaded.
+    await waitFor(() => expect(createdTracks[0]?.cues).toHaveLength(1));
+
+    // The engine takes over the element, then reports loadedmetadata on it,
+    // which VideoPlayer turns into a stream generation bump.
+    const engineTracks: EngineTextTrack[] = [];
+    const engine = {
+      readyState: 1,
+      currentTime: 0,
+      paused: true,
+      volume: 1,
+      muted: false,
+      addTextTrack: (kind: TextTrackKind, label: string, language: string) => {
+        const track = new EngineTextTrack(kind, label, language);
+        engineTracks.push(track);
+        return track;
+      },
+    };
+    const detach = attachEngineToElement(videoRef.current!, engine as unknown as EnginePlayer);
+    rerender({ generation: 1 });
+
+    await waitFor(() => expect(engineTracks).toHaveLength(1));
+    // The fetched cues carry over, and the engine's clock drives them.
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    act(() => engineTracks[0]!.update(11));
+    expect(result.current).toEqual(["hi"]);
+    detach();
+  });
+
   it("refetches retimed cues behind an unchanged URL when the cue revision changes", async () => {
     fetchMock
       .mockResolvedValueOnce(vttResponse("WEBVTT\n\n00:00:10.000 --> 00:00:12.000\nold\n\n"))
diff --git a/web/src/player/hooks/useSubtitleTracks.ts b/web/src/player/hooks/useSubtitleTracks.ts
index 96b64b4f04..a0ddfafaee 100644
--- a/web/src/player/hooks/useSubtitleTracks.ts
+++ b/web/src/player/hooks/useSubtitleTracks.ts
@@ -2,29 +2,15 @@ import { useEffect, useRef, useState } from "react";
 import { parseVTT, type ParsedCue } from "../utils/parseVTT";
 import type { PlayerSubtitleInfo } from "../types";
 import { isASSCodec, isBitmapCodec } from "../utils/subtitleCodecs";
-import { toMediaTime } from "../utils/mediaTimeline";
+import {
+  createSubtitleWindowFetcher,
+  subtitlePlayheadSeconds,
+  subtitleWindowUrl,
+} from "../utils/subtitleWindows";
 
-// Explicitly bound each subtitle fetch to this many source-time seconds.
-const WINDOW_DURATION = 600;
-// Start fetching the next window this many seconds before the current
-// one's requested end, so the new cues are already on hand by the time
-// playback crosses into them.
-const PREFETCH_LEAD = 30;
-// Overlap consecutive windows by a few seconds so ffmpeg boundary
-// rounding can't drop a cue that straddles the join.
-const WINDOW_OVERLAP = 5;
 // Pull back this many seconds from the current position when starting
 // a fresh fetch, so a quick scrub back still lands inside the window.
 const SEEK_BACKOFF = 2;
-// Abort a window fetch when the response goes this long without delivering
-// a chunk. Extraction streams cues progressively, so a healthy-but-slow
-// ffmpeg keeps resetting the clock; only a genuinely hung one trips it.
-// Without this, one hung fetch blocks every future window for the session.
-const FETCH_STALL_TIMEOUT_MS = 30_000;
-// Wait this long after a failed window fetch before retrying, so a
-// persistently failing extraction doesn't turn timeupdate into a fetch storm.
-const FETCH_RETRY_BACKOFF_MS = 5_000;
-const FETCH_RETRY_MAX_BACKOFF_MS = 60_000;
 
 /**
  * Cues (in source time) and window coverage snapshotted from a track that is
@@ -73,12 +59,6 @@ function addCuesToTrack(
   }
 }
 
-/** Request the same bounded interval used by the coverage tracker. */
-function appendPosition(url: string, position: number): string {
-  const sep = url.includes("?") ? "&" : "?";
-  return `${url}${sep}position=${position}&duration=${WINDOW_DURATION}`;
-}
-
 /**
  * Manages subtitle display by delegating cue-against-time matching to the
  * browser's TextTrack, while keeping render control on our side for the
@@ -201,8 +181,8 @@ export function useSubtitleTracks(
     }
 
     // Skip entirely for ASS/SSA (JASSUB renders those via useASSSubtitles)
-    // and bitmap codecs (PGS/DVD/DVB are burned into the video server-side;
-    // rendering text cues for them would double up on screen).
+    // and bitmap codecs (usePGSSubtitles draws PGS; DVD/DVB are burned into
+    // the video server-side), which carry no text cues to show.
     if (isASSCodec(activeCodec) || isBitmapCodec(activeCodec)) {
       return;
     }
@@ -257,21 +237,7 @@ export function useSubtitleTracks(
       placeholders = true;
     }
 
-    let cancelled = false;
-    let hasFetched = restored?.hasFetched ?? false;
-
-    // Sliding-window coverage state. See fetchWindow for semantics.
-    let coverageStart = restored?.coverageStart ?? 0;
-    let windowEnd = restored?.windowEnd ?? 0;
-    let atEOF = restored?.atEOF ?? false;
-    let inflight: AbortController | null = null;
-    let inflightStart = 0;
-    let retryTimer: ReturnType<typeof setTimeout> | null = null;
     if (restored?.hasFetched) onLoadStateRef.current?.("ready");
-    // Set on a failed (errored or stalled) window fetch; maybeFetch waits out
-    // a short backoff before retrying the uncovered range.
-    let lastFetchFailureAt = 0;
-    let retryDelay = 0;
 
     function handleCueChange() {
       const active = track.activeCues;
@@ -322,171 +288,54 @@ export function useSubtitleTracks(
       addCuesToTrack(track, newCues, origin, delaySec, seenCueKeysRef.current);
     }
 
-    async function fetchWindow(seekStart: number, resetExisting: boolean) {
-      if (!activeUrl) return;
-
-      // Only one window on the wire at a time: each fetch keeps an
-      // ffmpeg process alive, double-fetching wastes that.
-      inflight?.abort();
-      const controller = new AbortController();
-      inflight = controller;
-      inflightStart = seekStart;
-      if (retryTimer !== null) clearTimeout(retryTimer);
-      if (resetExisting) onLoadStateRef.current?.(placeholders ? "refreshing" : "loading");
-
-      const requestedEnd = seekStart + WINDOW_DURATION;
-      if (resetExisting) {
-        if (!placeholders) clearCues();
-        coverageStart = seekStart;
-        windowEnd = seekStart;
-        atEOF = false;
-      }
-
-      // Abort the fetch if the response stops delivering chunks. Re-armed on
-      // every read so a slow-but-progressing extraction is never cut off.
-      let stallTimer: ReturnType<typeof setTimeout> | null = null;
-      const armStallTimer = () => {
-        if (stallTimer !== null) clearTimeout(stallTimer);
-        stallTimer = setTimeout(() => controller.abort(), FETCH_STALL_TIMEOUT_MS);
-      };
-
-      const url = appendPosition(activeUrl, seekStart);
-      let succeeded = false;
-      try {
-        armStallTimer();
-        const resp = await fetch(url, { signal: controller.signal });
-        if (!resp.ok || !resp.body) {
-          console.error(`[useSubtitleTracks] Failed to fetch ${url}: ${resp.status}`);
-          return;
-        }
-        const reader = resp.body.getReader();
-        const decoder = new TextDecoder();
-        let buf = "";
-
-        // Split on the last complete cue boundary (blank line) and parse
-        // the safe prefix, keep the rest. The WebVTT muxer emits cues
-        // terminated by "\n\n".
-        while (!cancelled) {
-          armStallTimer();
-          const { value, done } = await reader.read();
-          if (cancelled || controller.signal.aborted || inflight !== controller) return;
-          if (done) break;
-          buf += decoder.decode(value, { stream: true }).replace(/\r\n/g, "\n");
-          const split = buf.lastIndexOf("\n\n");
-          if (split < 0) continue;
-          const safe = buf.slice(0, split);
-          buf = buf.slice(split + 2);
-          const cues = parseVTT(safe);
-          if (cues.length > 0) {
-            addParsedCues(cues);
-            onLoadStateRef.current?.("ready");
-          }
-        }
-
-        // Flush any tail the muxer didn't terminate with a blank line.
-        buf += decoder.decode();
-        if (buf.trim()) {
-          const cues = parseVTT(buf);
-          if (cues.length > 0) {
-            addParsedCues(cues);
-            onLoadStateRef.current?.("ready");
-          }
-        }
-
-        succeeded = true;
-      } catch (err) {
-        if ((err as Error).name !== "AbortError") {
-          console.error("[useSubtitleTracks] Stream error:", err);
-        }
-      } finally {
-        if (stallTimer !== null) clearTimeout(stallTimer);
-        const superseded = inflight !== controller;
-        if (inflight === controller) {
-          inflight = null;
-        }
-        if (succeeded && !cancelled && !superseded) {
-          // A corrected window without cues still replaces the placeholders.
-          dropPlaceholders();
-          onLoadStateRef.current?.("ready");
-          hasFetched = true;
-          retryDelay = 0;
-          lastFetchFailureAt = 0;
-          // Commit coverage only after the whole window streamed in. A
-          // failed or stalled fetch must leave the range uncovered, or the
-          // gap would read as fetched and never be retried — subtitles
-          // would silently stop for the rest of the window.
-          windowEnd = Math.max(windowEnd, requestedEnd);
-          // End-of-input only when the window reaches the known media
-          // duration. Don't infer it from where the window's cues stop:
-          // a window that ends inside a dialogue gap looks identical to
-          // end-of-file by that signal, and a false positive here silently
-          // stops subtitles for the rest of playback.
-          const durationSec = durationRef.current ?? 0;
-          if (durationSec > 0 && requestedEnd >= durationSec) {
-            atEOF = true;
-          }
-        } else if (!succeeded && !superseded && !cancelled) {
-          // Genuine failure (error, stall, or non-ok response) rather than a
-          // seek superseding this fetch — back off before retrying.
-          lastFetchFailureAt = Date.now();
-          onLoadStateRef.current?.("error");
-          retryDelay = Math.min(
-            retryDelay ? retryDelay * 2 : FETCH_RETRY_BACKOFF_MS,
-            FETCH_RETRY_MAX_BACKOFF_MS,
-          );
-          retryTimer = setTimeout(maybeFetch, retryDelay);
-        }
-      }
+    // The WebVTT muxer ends each cue with a blank line, so each chunk parses
+    // up to the last complete cue and keeps the rest for the next one.
+    let decoder = new TextDecoder();
+    let buffered = "";
+    function addParsedText(text: string) {
+      const cues = parseVTT(text);
+      if (cues.length === 0) return;
+      addParsedCues(cues);
+      onLoadStateRef.current?.("ready");
     }
 
-    // Picks the right fetch action for the current player position:
-    //   - no cues yet → initial fetch
-    //   - current position fell behind coverageStart (backward seek
-    //     outside window) → reset and fetch fresh window from here
-    //   - position jumped past windowEnd (forward seek outside window) →
-    //     reset and fetch fresh window from here, so the skipped-over gap
-    //     is never mistaken for covered range
-    //   - playback is nearing windowEnd and we haven't hit EOF → queue
-    //     the next window, overlapping slightly with the previous
-    function maybeFetch() {
-      if (cancelled) return;
-      // Until the element has media loaded, currentTime reads 0 rather than
-      // the position playback will actually start at (resume target, or a
-      // seek that restarted the stream) — use the intended position instead.
-      const mediaTime =
-        videoEl.readyState > 0
-          ? toMediaTime(videoEl.currentTime, streamOriginRef.current ?? 0)
-          : (fetchAnchorRef.current ?? 0);
-      if (inflight) {
-        if (
-          mediaTime >= Math.min(coverageStart, inflightStart) - 1 &&
-          mediaTime <= inflightStart + WINDOW_DURATION + 1
-        )
-          return;
-        // A seek outside the requested range must not wait for extraction.
-        fetchWindow(Math.max(0, mediaTime - SEEK_BACKOFF), true);
-        return;
-      }
-      if (lastFetchFailureAt > 0 && Date.now() - lastFetchFailureAt < retryDelay) return;
-      if (!hasFetched) {
-        void fetchWindow(Math.max(0, mediaTime - SEEK_BACKOFF), true);
-        return;
-      }
-      if (mediaTime < coverageStart - 1) {
-        atEOF = false;
-        void fetchWindow(Math.max(0, mediaTime - SEEK_BACKOFF), true);
-        return;
-      }
-      if (mediaTime > windowEnd + 1) {
-        atEOF = false;
-        void fetchWindow(Math.max(0, mediaTime - SEEK_BACKOFF), true);
-        return;
-      }
-      if (!atEOF && mediaTime > windowEnd - PREFETCH_LEAD) {
-        const nextStart = Math.max(windowEnd - WINDOW_OVERLAP, mediaTime);
-        void fetchWindow(nextStart, false);
-      }
-    }
+    const fetcher = createSubtitleWindowFetcher({
+      windowUrl: (start) => subtitleWindowUrl(activeUrl ?? "", start),
+      playhead: () =>
+        subtitlePlayheadSeconds(videoEl, streamOriginRef.current ?? 0, fetchAnchorRef.current),
+      duration: () => durationRef.current ?? 0,
+      seekBackoffSeconds: SEEK_BACKOFF,
+      initial: restored ?? undefined,
+      logTag: "useSubtitleTracks",
+      onWindowStart: (fresh) => {
+        decoder = new TextDecoder();
+        buffered = "";
+        if (!fresh) return;
+        onLoadStateRef.current?.(placeholders ? "refreshing" : "loading");
+        if (!placeholders) clearCues();
+      },
+      onChunk: (chunk) => {
+        buffered += decoder.decode(chunk, { stream: true }).replace(/\r\n/g, "\n");
+        const split = buffered.lastIndexOf("\n\n");
+        if (split < 0) return;
+        const safe = buffered.slice(0, split);
+        buffered = buffered.slice(split + 2);
+        addParsedText(safe);
+      },
+      onResponseEnd: () => {
+        // Flush any tail the muxer didn't end with a blank line.
+        buffered += decoder.decode();
+        if (buffered.trim()) addParsedText(buffered);
+        buffered = "";
+      },
+      onWindowCommitted: () => {
+        // A corrected window without cues still replaces the placeholders.
+        dropPlaceholders();
+        onLoadStateRef.current?.("ready");
+      },
+      onWindowFailed: () => onLoadStateRef.current?.("error"),
+    });
+    const maybeFetch = fetcher.maybeFetch;
 
     // URL-backed tracks run the sliding-window fetcher; live tracks receive
     // their cues from the liveCues effect below instead.
@@ -503,10 +352,7 @@ export function useSubtitleTracks(
     }
 
     return () => {
-      cancelled = true;
-      if (retryTimer !== null) clearTimeout(retryTimer);
-      inflight?.abort();
-      inflight = null;
+      fetcher.dispose();
       videoEl.removeEventListener("timeupdate", maybeFetch);
       videoEl.removeEventListener("seeking", maybeFetch);
       videoEl.removeEventListener("seeked", maybeFetch);
@@ -519,10 +365,7 @@ export function useSubtitleTracks(
           url: activeUrl,
           cueRevision,
           cues: Array.from(sourceCues.values()),
-          coverageStart,
-          windowEnd,
-          atEOF,
-          hasFetched,
+          ...fetcher.coverage(),
         };
       }
       clearCues();
@@ -539,7 +382,7 @@ export function useSubtitleTracks(
     // the track. The update effects below shift existing cues in place instead.
     // `streamGeneration` IS included: a stream restart reloads the <video>
     // element and orphans the current track, so it must be rebuilt.
-    // eslint-disable-next-line react-hooks/exhaustive-deps
+    // eslint-disable-next-line react-hooks/exhaustive-deps -- delay and timeline changes shift cues in place instead
   }, [
     activeUrl,
     activeCodec,
diff --git a/web/src/player/hooks/useWatchProgress.test.ts b/web/src/player/hooks/useWatchProgress.test.ts
index 63301e1293..38077bcb4b 100644
--- a/web/src/player/hooks/useWatchProgress.test.ts
+++ b/web/src/player/hooks/useWatchProgress.test.ts
@@ -40,6 +40,7 @@ async function reportOnce(error: Error) {
   const onSessionEnded = vi.fn();
   const video = document.createElement("video");
   Object.defineProperty(video, "currentTime", { value: 30 });
+  Object.defineProperty(video, "readyState", { value: HTMLMediaElement.HAVE_METADATA });
   const videoRef = { current: video };
   vi.useFakeTimers();
   const rendered = renderHook(
@@ -67,6 +68,22 @@ describe("useWatchProgress", () => {
     expect(onSessionEnded).toHaveBeenCalledTimes(1);
   });
 
+  // An element without metadata still reads currentTime 0. Reporting that
+  // when the viewer leaves during startup would replace their resume point.
+  it("reports nothing before the element has metadata", async () => {
+    mocks.send.mockReset();
+    mocks.send.mockResolvedValue(undefined);
+    const video = document.createElement("video");
+    const videoRef = { current: video };
+    vi.useFakeTimers();
+    const rendered = renderHook(() => useWatchProgress("session-1", videoRef), { wrapper });
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(10_000);
+    });
+    rendered.unmount();
+    expect(mocks.send).not.toHaveBeenCalled();
+  });
+
   it("keeps playing through other progress failures", async () => {
     for (const error of [
       new PlayerFetchError(404, "Playback session not found", "session_not_found"),
@@ -92,6 +109,7 @@ describe("useWatchProgress", () => {
     const onSessionEnded = vi.fn();
     const video = document.createElement("video");
     Object.defineProperty(video, "currentTime", { value: 30 });
+    Object.defineProperty(video, "readyState", { value: HTMLMediaElement.HAVE_METADATA });
     const videoRef = { current: video };
     vi.useFakeTimers();
     const rendered = renderHook(
diff --git a/web/src/player/hooks/useWatchProgress.ts b/web/src/player/hooks/useWatchProgress.ts
index c742155b70..7dd239efc7 100644
--- a/web/src/player/hooks/useWatchProgress.ts
+++ b/web/src/player/hooks/useWatchProgress.ts
@@ -39,7 +39,9 @@ export function useWatchProgress(
 
   const getProgressSnapshot = useCallback(() => {
     const video = videoRef.current;
-    if (!video) return null;
+    // Before metadata (startup, or a transport swap) currentTime is not a
+    // position on this stream yet; reporting it would overwrite the resume point.
+    if (!video || video.readyState === HTMLMediaElement.HAVE_NOTHING) return null;
 
     return {
       position: toMediaTime(video.currentTime ?? 0, streamOriginRef?.current ?? 0),
diff --git a/web/src/player/hooks/useWatchTogetherPlaybackSync.ts b/web/src/player/hooks/useWatchTogetherPlaybackSync.ts
index 1ed01c0507..0972f26b5c 100644
--- a/web/src/player/hooks/useWatchTogetherPlaybackSync.ts
+++ b/web/src/player/hooks/useWatchTogetherPlaybackSync.ts
@@ -18,6 +18,13 @@ interface UseWatchTogetherPlaybackSyncOptions {
   appliedCommandIdRef: RefObject<string | null>;
   /** Called when a sustained stall is reported to the room. */
   onSustainedStall?: () => void;
+  /**
+   * The command a routine state report may name, or null to name none. It is
+   * the applied command once any seek it started has landed: before that the
+   * element still plays the stream the command is replacing. Defaults to the
+   * applied command.
+   */
+  reportCommandId?: () => string | null;
 }
 
 interface TransportRequestResult {
@@ -48,6 +55,12 @@ interface UseWatchTogetherPlaybackSyncResult {
   prerollMutedPreference: () => boolean | null;
   /** Records the viewer's mute choice during a pre-roll. False when none runs. */
   setPrerollMutedPreference: (muted: boolean) => boolean;
+  /**
+   * The seek of command `toCommandId` was skipped because the stream rebuild
+   * that `fromCommandId` started already heads to the same position. That
+   * rebuild then serves the new command too, including its pre-roll.
+   */
+  carryStreamRebuild: (fromCommandId: string | null, toCommandId: string) => void;
 }
 
 const stateReportIntervalMs = 1_500;
@@ -56,6 +69,11 @@ const stateReportIntervalMs = 1_500;
 const waitingReportIntervalMs = 500;
 const pendingCommandQuietPeriodMs = 250;
 const readySeekToleranceSeconds = 1;
+// A stream that lands past a seek target cannot pre-roll back to it. The
+// server holds the room's own seek to readySeekToleranceSeconds but accepts a
+// stalled viewer's own seek within this, so readiness is reported and the
+// server decides.
+const aheadReadySeekToleranceSeconds = 5;
 // The host's real position becomes the room anchor, so a rebuilt stream that
 // lands short of the target does not hold the room. Mirrors the server bound.
 const hostReadySeekToleranceSeconds = 15;
@@ -126,6 +144,7 @@ export function useWatchTogetherPlaybackSync({
   streamOriginRef,
   appliedCommandIdRef,
   onSustainedStall,
+  reportCommandId,
 }: UseWatchTogetherPlaybackSyncOptions): UseWatchTogetherPlaybackSyncResult {
   const connectionState = roomConnection.connectionState;
   const room = roomConnection.room;
@@ -216,6 +235,30 @@ export function useWatchTogetherPlaybackSync({
   // The command whose seek rebuilt the current stream. Until the rebuilt
   // stream loads, the element still holds the stream the seek replaces.
   const rebuiltForCommandRef = useRef<string | null>(null);
+  // The command applied when the element last started loading a stream, so a
+  // command that adopts an earlier command's rebuild can tell whether that
+  // rebuild has already begun loading.
+  const loadStartedForCommandRef = useRef<string | null>(null);
+  useEffect(() => {
+    const video = videoRef.current;
+    if (!video) return;
+    const onLoadStart = () => {
+      loadStartedForCommandRef.current = appliedCommandIdRef.current;
+    };
+    video.addEventListener("loadstart", onLoadStart);
+    return () => video.removeEventListener("loadstart", onLoadStart);
+  }, [appliedCommandIdRef, videoRef]);
+  const carryStreamRebuild = useCallback((fromCommandId: string | null, toCommandId: string) => {
+    // A rebuild that has not started loading yet is marked for the applied
+    // command by its own loadstart.
+    if (fromCommandId === null) return;
+    if (
+      rebuiltForCommandRef.current === fromCommandId ||
+      loadStartedForCommandRef.current === fromCommandId
+    ) {
+      rebuiltForCommandRef.current = toCommandId;
+    }
+  }, []);
   const endPreroll = useCallback(
     (pause: boolean) => {
       const preroll = prerollRef.current;
@@ -410,8 +453,13 @@ export function useWatchTogetherPlaybackSync({
     const positionSeconds = Math.max(0, toMediaTime(video.currentTime, streamOriginRef.current));
     // A canplay event can still belong to the stream a room seek replaces.
     if (roomPlaybackState === "waiting" && command.action === "seek") {
-      const delta = Math.abs(positionSeconds - command.position_seconds);
-      const tolerance = isHost ? hostReadySeekToleranceSeconds : readySeekToleranceSeconds;
+      const offset = positionSeconds - command.position_seconds;
+      const delta = Math.abs(offset);
+      const tolerance = isHost
+        ? hostReadySeekToleranceSeconds
+        : offset > 0
+          ? aheadReadySeekToleranceSeconds
+          : readySeekToleranceSeconds;
       if (delta > tolerance) {
         return {
           ok: false,
@@ -503,9 +551,13 @@ export function useWatchTogetherPlaybackSync({
           return;
         }
 
+        // Naming the latest command this viewer applied lets the server take
+        // the report at once instead of waiting out that command's settle window.
+        const appliedCommandId = reportCommandId ? reportCommandId() : appliedCommandIdRef.current;
         sendRoomMessage({
           type: "state_report",
           session_id: sessionId,
+          ...(appliedCommandId ? { command_id: appliedCommandId } : {}),
           position_seconds: toMediaTime(video.currentTime, streamOriginRef.current),
           is_paused: video.paused,
         });
@@ -518,12 +570,14 @@ export function useWatchTogetherPlaybackSync({
     };
   }, [
     advanceThroughPreroll,
+    appliedCommandIdRef,
     attachedSessionId,
     catchingUp,
     checkReady,
     connectionState,
     noteReadyReject,
     readinessPending,
+    reportCommandId,
     sendRoomMessage,
     serverTimeOffsetMs,
     sessionId,
@@ -645,8 +699,10 @@ export function useWatchTogetherPlaybackSync({
       reportBuffering,
       prerollMutedPreference,
       setPrerollMutedPreference,
+      carryStreamRebuild,
     }),
     [
+      carryStreamRebuild,
       attachedSessionId,
       catchingUp,
       readinessPending,
diff --git a/web/src/player/hooks/useWatchTogetherRoomConnection.ts b/web/src/player/hooks/useWatchTogetherRoomConnection.ts
index 011552e2ed..682c3ea9b9 100644
--- a/web/src/player/hooks/useWatchTogetherRoomConnection.ts
+++ b/web/src/player/hooks/useWatchTogetherRoomConnection.ts
@@ -7,6 +7,14 @@ import { mintRoomSocketTicket, roomSocketURL } from "@/api/v2/watchTogetherSocke
 import type { SuggestionCreationDraft } from "@/api/v2/watchTogetherSuggestionCreate";
 import { V2ProblemError } from "@/api/v2/request";
 import { useCallback, useEffect, useLayoutEffect, useRef, useState } from "react";
+import {
+  addRoomClockSample,
+  roomClockOffsetMs,
+  roomClockPingDelayMs,
+  roomClockSample,
+  roomClockStepped,
+  type RoomClockSample,
+} from "../utils/roomClock";
 import {
   ApiClientError,
   StaleApiRequestContextError,
@@ -83,7 +91,6 @@ export interface WatchTogetherRoomConnectionResult {
 }
 
 const reconnectDelays = [500, 1_000, 2_000, 5_000];
-const pingIntervalMs = 15_000;
 
 /**
  * Maps a room-fetch failure to a terminal closed reason. Returns null for
@@ -124,6 +131,12 @@ export function useWatchTogetherRoomConnection({
     null,
   );
   const [serverTimeOffsetMs, setServerTimeOffsetMs] = useState(0);
+  // Clock samples outlive a reconnect to the same room: the offset does not
+  // change with the socket. Leaving or switching rooms starts over.
+  const clockSamplesRef = useRef<{ roomId: string | null; samples: RoomClockSample[] }>({
+    roomId: null,
+    samples: [],
+  });
   const socketRef = useRef<WebSocket | null>(null);
   // Subscribe to the production AuthProvider so PIN/profile replacement can
   // rebind the socket even when room props remain unchanged.
@@ -194,6 +207,7 @@ export function useWatchTogetherRoomConnection({
 
   useEffect(() => {
     if (!roomId || !roomToken) {
+      clockSamplesRef.current = { roomId: null, samples: [] };
       const resetTimer = window.setTimeout(() => {
         setRoom(null);
         setTransportCommand(null);
@@ -266,6 +280,11 @@ export function useWatchTogetherRoomConnection({
     if (!authority) return;
     if (replacementScopeRef.current === replacementScope) return;
     closedReasonRef.current = null;
+    // Another room's samples say nothing about this one; its first sample
+    // replaces the offset.
+    if (clockSamplesRef.current.roomId !== roomId) {
+      clockSamplesRef.current = { roomId, samples: [] };
+    }
     let disposed = false;
     const active = () =>
       !disposed &&
@@ -274,8 +293,23 @@ export function useWatchTogetherRoomConnection({
     let attempt = 0;
     let reconnectTimer: number | null = null;
     let pingTimer: number | null = null;
+    // Samples taken on the current socket; pings come fast until it has enough.
+    let connectionSamples = 0;
+
+    const stopPings = () => {
+      if (pingTimer !== null) {
+        window.clearTimeout(pingTimer);
+        pingTimer = null;
+      }
+    };
+
+    const schedulePing = () => {
+      stopPings();
+      pingTimer = window.setTimeout(sendPing, roomClockPingDelayMs(connectionSamples));
+    };
 
-    const sendPing = () => {
+    function sendPing() {
+      pingTimer = null;
       const socket = socketRef.current;
       if (!active() || !socket || socket.readyState !== WebSocket.OPEN) {
         return;
@@ -286,6 +320,22 @@ export function useWatchTogetherRoomConnection({
           client_sent_at: new Date().toISOString(),
         }),
       );
+      schedulePing();
+    }
+
+    const recordClockSample = (sample: RoomClockSample) => {
+      const clock = clockSamplesRef.current;
+      const delayBefore = roomClockPingDelayMs(connectionSamples);
+      // After a clock step the estimate starts over, and so does the fast
+      // cadence that builds it.
+      if (roomClockStepped(clock.samples, sample)) connectionSamples = 0;
+      connectionSamples += 1;
+      clock.samples = addRoomClockSample(clock.samples, sample);
+      const offset = roomClockOffsetMs(clock.samples);
+      if (offset !== null) setServerTimeOffsetMs(offset);
+      // A change of cadence moves the waiting ping instead of letting one
+      // more ping run at the old one.
+      if (roomClockPingDelayMs(connectionSamples) !== delayBefore) schedulePing();
     };
 
     const scheduleReconnect = () => {
@@ -333,9 +383,9 @@ export function useWatchTogetherRoomConnection({
           return;
         }
         attempt = 0;
+        connectionSamples = 0;
         setConnectionState("connected");
         sendPing();
-        pingTimer = window.setInterval(sendPing, pingIntervalMs);
       });
 
       socket.addEventListener("message", (event) => {
@@ -390,9 +440,8 @@ export function useWatchTogetherRoomConnection({
                   : "This profile joined the Watch Party on another device.",
             });
             if (reconnectTimer !== null) window.clearTimeout(reconnectTimer);
-            if (pingTimer !== null) window.clearInterval(pingTimer);
             reconnectTimer = null;
-            pingTimer = null;
+            stopPings();
             socketRef.current = null;
             setTransportCommand(null);
             setConnectionState("disconnected");
@@ -411,18 +460,13 @@ export function useWatchTogetherRoomConnection({
               typeof message.server_received_at === "string" &&
               typeof message.server_sent_at === "string"
             ) {
-              const sentAt = Date.parse(message.client_sent_at);
-              const serverReceivedAt = Date.parse(message.server_received_at);
-              const serverSentAt = Date.parse(message.server_sent_at);
-              const receivedAt = Date.now();
-              if (
-                Number.isFinite(sentAt) &&
-                Number.isFinite(serverReceivedAt) &&
-                Number.isFinite(serverSentAt)
-              ) {
-                const offset = (serverReceivedAt - sentAt + (serverSentAt - receivedAt)) / 2;
-                setServerTimeOffsetMs(offset);
-              }
+              const sample = roomClockSample(
+                Date.parse(message.client_sent_at),
+                Date.parse(message.server_received_at),
+                Date.parse(message.server_sent_at),
+                Date.now(),
+              );
+              if (sample) recordClockSample(sample);
             }
             return;
           case "error": {
@@ -446,10 +490,7 @@ export function useWatchTogetherRoomConnection({
         if (socketRef.current === socket) {
           socketRef.current = null;
         }
-        if (pingTimer !== null) {
-          window.clearInterval(pingTimer);
-          pingTimer = null;
-        }
+        stopPings();
         // A command belongs to the connection that delivered it. Kept, the
         // player would apply it again on reconnect, from a position the room
         // may have left; the server sends a fresh one once the member attaches.
@@ -471,9 +512,7 @@ export function useWatchTogetherRoomConnection({
       if (reconnectTimer !== null) {
         window.clearTimeout(reconnectTimer);
       }
-      if (pingTimer !== null) {
-        window.clearInterval(pingTimer);
-      }
+      stopPings();
       const socket = socketRef.current;
       socketRef.current = null;
       if (
diff --git a/web/src/player/lifecycle-v2.test.ts b/web/src/player/lifecycle-v2.test.ts
index 6cd1f0d22b..c8a301584e 100644
--- a/web/src/player/lifecycle-v2.test.ts
+++ b/web/src/player/lifecycle-v2.test.ts
@@ -29,7 +29,6 @@ const replan = buildReplanRequestV3({
   qualityPreference: "auto",
   attemptedPlanKeys: [],
   attemptCount: 1,
-  metered: false,
   clientCapabilities: fixtureClientCapabilitiesV3(),
   clientPlaybackContext: fixtureClientPlaybackContextV3(),
 });
diff --git a/web/src/player/playback-info.test.ts b/web/src/player/playback-info.test.ts
index 23b5b9dc07..2e9d2cdbff 100644
--- a/web/src/player/playback-info.test.ts
+++ b/web/src/player/playback-info.test.ts
@@ -8,7 +8,7 @@ import {
   resolveActiveQualityOptionId,
 } from "./playback-info";
 import { fixturePlanV3 } from "./protocol-v3.fixtures";
-import type { PlayerFileVersion, QualityOption } from "./types";
+import type { PlayerFileVersion } from "./types";
 
 function makeVersion(overrides: Partial<PlayerFileVersion> = {}): PlayerFileVersion {
   return {
@@ -65,6 +65,39 @@ function rowValue(
 }
 
 describe("playback info helpers", () => {
+  it("names Atmos for a source track whose title is the codec's long name", () => {
+    const sourceAudio = (track: NonNullable<PlayerFileVersion["audio_tracks"]>[number]) =>
+      rowValue(
+        buildPlaybackInfoSections({
+          streamUrl: "https://app.example.com/api/v1/stream/abc123",
+          plan: fixturePlanV3({ delivery: "original_http" }),
+          currentSourceVersion: makeVersion({ audio_tracks: [{ ...track, default: true }] }),
+          runtimeStats: {
+            playerWidth: 1920,
+            playerHeight: 1080,
+            videoWidth: 3840,
+            videoHeight: 2160,
+            droppedFrames: 0,
+            corruptedFrames: 0,
+          },
+        }),
+        "Current Source File",
+        "Audio codec",
+      );
+    const longName = "ATSC A/52B (AC-3, E-AC-3)";
+    expect(
+      sourceAudio({ codec: "eac3", title: longName, profile: "Dolby Digital Plus + Dolby Atmos" }),
+    ).toBe("DD+ Atmos");
+    expect(sourceAudio({ codec: "eac3", title: longName })).toBe(longName);
+    expect(
+      sourceAudio({
+        codec: "eac3",
+        title: "Atmospheric score",
+        profile: "Dolby Digital Plus + Dolby Atmos",
+      }),
+    ).toBe("DD+ Atmos");
+  });
+
   it("formats a direct-play session with source metadata and live runtime stats", () => {
     const sections = buildPlaybackInfoSections({
       streamUrl: "https://app.example.com/api/v1/stream/abc123",
@@ -249,16 +282,10 @@ describe("playback info helpers", () => {
 });
 
 describe("qualityOptionsFromPlanV3", () => {
-  it("renders the plan's ladder verbatim with a locally prepended auto entry", () => {
+  it("renders the plan's fixed rungs verbatim with a locally prepended auto entry", () => {
     const options = qualityOptionsFromPlanV3(
       fixturePlanV3({
         available_qualities: [
-          {
-            label: "original",
-            height: 2160,
-            bitrate_kbps: 22500,
-            preserves_source: true,
-          },
           {
             label: "1080p-medium",
             display_name: "1080p Medium",
@@ -276,38 +303,45 @@ describe("qualityOptionsFromPlanV3", () => {
       }),
     );
 
-    expect(options.map((option) => option.id)).toEqual([
-      "auto",
-      "original",
-      "1080p-medium",
-      "480p",
-    ]);
-    expect(options[1]).toMatchObject({
-      id: "original",
-      label: "Original",
-      sublabel: "22.5 Mbps",
-      resolution: "2160p",
-      bitrateKbps: 22500,
-      isOriginal: true,
-    });
-    expect(options[2]).toMatchObject({
+    expect(options.map((option) => option.id)).toEqual(["auto", "1080p-medium", "480p"]);
+    expect(options[1]).toEqual({
       id: "1080p-medium",
       label: "1080p Medium",
       sublabel: "6 Mbps",
-      isOriginal: false,
+      resolution: "1080p",
+      bitrateKbps: 6000,
     });
   });
 
+  it("drops the source entry an older server still lists as original", () => {
+    const options = qualityOptionsFromPlanV3(
+      fixturePlanV3({
+        available_qualities: [
+          { label: "original", height: 2160, bitrate_kbps: 22_500, preserves_source: true },
+          { label: "1080p-medium", height: 1080, bitrate_kbps: 6000, preserves_source: false },
+        ],
+      }),
+    );
+
+    expect(options.map((option) => option.id)).toEqual(["auto", "1080p-medium"]);
+    expect(options.some((option) => option.label === "Original")).toBe(false);
+  });
+
+  it("offers no menu when the plan publishes no fixed rung", () => {
+    // Audio-only plans and clients without HLS land here, on old servers with
+    // a lone original entry and on new ones with none.
+    for (const available_qualities of [
+      [],
+      [{ label: "original", bitrate_kbps: 128, preserves_source: true }],
+    ]) {
+      expect(qualityOptionsFromPlanV3(fixturePlanV3({ available_qualities }))).toEqual([]);
+    }
+  });
+
   it("maps stored resolution preferences onto their equivalent visible rung", () => {
     const options = qualityOptionsFromPlanV3(
       fixturePlanV3({
         available_qualities: [
-          {
-            label: "original",
-            height: 2160,
-            bitrate_kbps: 22_500,
-            preserves_source: true,
-          },
           {
             label: "1080p-medium",
             display_name: "1080p Medium",
@@ -318,40 +352,74 @@ describe("qualityOptionsFromPlanV3", () => {
         ],
       }),
     );
+    const source = { height: 2160, bitrate_kbps: 22_500 };
+
+    expect(resolveActiveQualityOptionId(options, "1080p", undefined, source)).toBe("1080p-medium");
+    expect(resolveActiveQualityOptionId(options, "FHD", undefined, source)).toBe("1080p-medium");
+  });
+
+  it("lights Auto for auto and the legacy source labels", () => {
+    const options = qualityOptionsFromPlanV3(
+      fixturePlanV3({
+        available_qualities: [
+          { label: "1080p-medium", height: 1080, bitrate_kbps: 6000, preserves_source: false },
+        ],
+      }),
+    );
 
-    expect(resolveActiveQualityOptionId(options, "1080p")).toBe("1080p-medium");
-    expect(resolveActiveQualityOptionId(options, "FHD")).toBe("1080p-medium");
+    for (const preference of ["auto", "original", "Source", "max", ""]) {
+      expect(resolveActiveQualityOptionId(options, preference)).toBe("auto");
+    }
   });
 
-  it("marks Original when the source fits the resolution cap alongside same-height rungs", () => {
+  it("resolves a smaller delivered frame to its class when the source bitrate is unknown", () => {
+    const options = qualityOptionsFromPlanV3(
+      fixturePlanV3({
+        available_qualities: [
+          { label: "1080p-medium", height: 1080, bitrate_kbps: 6000, preserves_source: false },
+          { label: "720p-medium", height: 720, bitrate_kbps: 2000, preserves_source: false },
+        ],
+      }),
+    );
+    const source = { height: 1080 };
+    expect(
+      resolveActiveQualityOptionId(options, "1080p", { width: 1280, height: 720 }, source),
+    ).toBe("720p-medium");
+    expect(
+      resolveActiveQualityOptionId(options, "1080p", { width: 1920, height: 1080 }, source),
+    ).toBeNull();
+  });
+
+  it("lights no row when the source fits the resolution cap alongside same-height rungs", () => {
     // A 1080p source above the Medium bitrate publishes 1080p High/Medium/Low,
-    // but the planner preserves the source for a plain 1080p cap.
+    // but the planner preserves the source for a plain 1080p cap. No row is
+    // lit, so Auto stays selectable.
     const options = qualityOptionsFromPlanV3(
       fixturePlanV3({
         available_qualities: [
-          { label: "original", height: 1080, bitrate_kbps: 20_000, preserves_source: true },
           { label: "1080p-high", height: 1080, bitrate_kbps: 10_000, preserves_source: false },
           { label: "1080p-medium", height: 1080, bitrate_kbps: 6000, preserves_source: false },
           { label: "720p-medium", height: 720, bitrate_kbps: 2000, preserves_source: false },
         ],
       }),
     );
+    const source = { height: 1080, bitrate_kbps: 20_000 };
 
-    expect(resolveActiveQualityOptionId(options, "1080p")).toBe("original");
-    expect(resolveActiveQualityOptionId(options, "2160p")).toBe("original");
-    expect(resolveActiveQualityOptionId(options, "720p")).toBe("720p-medium");
-    expect(lowerQualityOption(options, "1080p")?.id).toBe("1080p-high");
+    expect(resolveActiveQualityOptionId(options, "1080p", undefined, source)).toBeNull();
+    expect(resolveActiveQualityOptionId(options, "2160p", undefined, source)).toBeNull();
+    expect(resolveActiveQualityOptionId(options, "auto", undefined, source)).toBe("auto");
+    expect(resolveActiveQualityOptionId(options, "720p", undefined, source)).toBe("720p-medium");
+    expect(lowerQualityOption(options, "1080p", undefined, source)?.id).toBe("1080p-high");
     // A copy delivery reports the source bitrate.
-    expect(resolveActiveQualityOptionId(options, "1080p", { bitrate_kbps: 20_000 })).toBe(
-      "original",
-    );
+    expect(
+      resolveActiveQualityOptionId(options, "1080p", { bitrate_kbps: 20_000 }, source),
+    ).toBeNull();
   });
 
   it("marks the rung a bitrate cap transcodes a fitting source to", () => {
     const options = qualityOptionsFromPlanV3(
       fixturePlanV3({
         available_qualities: [
-          { label: "original", height: 1032, bitrate_kbps: 7948, preserves_source: true },
           { label: "1080p-medium", height: 1080, bitrate_kbps: 6000, preserves_source: false },
           { label: "1080p-low", height: 1080, bitrate_kbps: 3000, preserves_source: false },
           { label: "720p-high", height: 720, bitrate_kbps: 4000, preserves_source: false },
@@ -360,76 +428,47 @@ describe("qualityOptionsFromPlanV3", () => {
         ],
       }),
     );
+    const source = { height: 1032, bitrate_kbps: 7948 };
     const at720 = { width: 1280, height: 688, bitrate_kbps: 2000 };
 
     // A 6 Mbps cap on this 7.9 Mbps source drops the encode to the 720p class.
-    expect(resolveActiveQualityOptionId(options, "1080p", at720)).toBe("720p-medium");
-    expect(resolveActiveQualityOptionId(options, "2160p", at720)).toBe("720p-medium");
-    expect(lowerQualityOption(options, "1080p", at720)?.id).toBe("480p");
+    expect(resolveActiveQualityOptionId(options, "1080p", at720, source)).toBe("720p-medium");
+    expect(resolveActiveQualityOptionId(options, "2160p", at720, source)).toBe("720p-medium");
+    expect(lowerQualityOption(options, "1080p", at720, source)?.id).toBe("480p");
     expect(
-      resolveActiveQualityOptionId(options, "2160p", {
-        width: 1920,
-        height: 1032,
-        bitrate_kbps: 6000,
-      }),
+      resolveActiveQualityOptionId(
+        options,
+        "2160p",
+        { width: 1920, height: 1032, bitrate_kbps: 6000 },
+        source,
+      ),
     ).toBe("1080p-medium");
     expect(
-      resolveActiveQualityOptionId(options, "1080p", {
-        width: 854,
-        height: 458,
-        bitrate_kbps: 1200,
-      }),
+      resolveActiveQualityOptionId(
+        options,
+        "1080p",
+        { width: 854, height: 458, bitrate_kbps: 1200 },
+        source,
+      ),
     ).toBe("480p");
     // The 540p class a low cap can choose has no menu rung, and stepping down
     // from it must still lower the bitrate.
     const at540 = { width: 960, height: 516, bitrate_kbps: 1300 };
-    expect(resolveActiveQualityOptionId(options, "1080p", at540)).toBeNull();
-    expect(lowerQualityOption(options, "1080p", at540)).toBeNull();
+    expect(resolveActiveQualityOptionId(options, "1080p", at540, source)).toBeNull();
+    expect(lowerQualityOption(options, "1080p", at540, source)).toBeNull();
     expect(
-      lowerQualityOption(options, "1080p", { width: 960, height: 516, bitrate_kbps: 1800 })?.id,
+      lowerQualityOption(options, "1080p", { width: 960, height: 516, bitrate_kbps: 1800 }, source)
+        ?.id,
     ).toBe("480p");
     // Without the delivered frame, assume the preferred class.
-    expect(resolveActiveQualityOptionId(options, "1080p", { bitrate_kbps: 6000 })).toBe(
+    expect(resolveActiveQualityOptionId(options, "1080p", { bitrate_kbps: 6000 }, source)).toBe(
       "1080p-medium",
     );
   });
 
-  it("marks Original when a resolution cap already preserves the source", () => {
-    const options: QualityOption[] = [
-      {
-        id: "original",
-        label: "Original",
-        sublabel: "8 Mbps",
-        resolution: "720p",
-        bitrateKbps: 8000,
-        isOriginal: true,
-      },
-    ];
-
-    expect(resolveActiveQualityOptionId(options, "1080p")).toBe("original");
-    expect(resolveActiveQualityOptionId(options, "auto")).toBe("original");
-    expect(resolveActiveQualityOptionId(options, "480p")).toBe("original");
-  });
-
-  it("offers no auto entry when the plan publishes a single rung", () => {
-    const options = qualityOptionsFromPlanV3(
-      fixturePlanV3({
-        available_qualities: [{ label: "original", bitrate_kbps: 128, preserves_source: true }],
-      }),
-    );
-
-    // Audio-only plans and clients without HLS land here: one rung is not a
-    // choice, but the array must stay non-empty so the version switcher renders.
-    expect(options).toEqual([
-      {
-        id: "original",
-        label: "Original",
-        sublabel: "128 kbps",
-        resolution: "",
-        bitrateKbps: 128,
-        isOriginal: true,
-      },
-    ]);
+  it("names no entry when there is no menu", () => {
+    expect(resolveActiveQualityOptionId([], "auto")).toBeNull();
+    expect(resolveActiveQualityOptionId([], "1080p", undefined, { height: 720 })).toBeNull();
   });
 });
 
@@ -451,7 +490,7 @@ describe("lowerQualityOption", () => {
     expect(lowerQualityOption(options, "720p")).toBeNull();
   });
 
-  it("steps down from what Auto or Original actually delivers", () => {
+  it("steps down from what Auto actually delivers", () => {
     expect(lowerQualityOption(options, "auto", { bitrate_kbps: 6000 })?.id).toBe("720p");
     expect(lowerQualityOption(options, "original", { bitrate_kbps: 40_000 })?.id).toBe(
       "2160p-medium",
@@ -522,3 +561,17 @@ describe("lowerQualityOption", () => {
     expect(formatAudioTrackLabel({ codec: "eac3", channels: 6 })).toBe("EAC3 · 6 ch");
   });
 });
+
+describe("buildPlaybackInfoSections player row", () => {
+  it("names the browser decoder while it plays the stream", () => {
+    const rows = (browserEngine: boolean) =>
+      buildPlaybackInfoSections({
+        streamUrl: "https://silo.example/stream",
+        plan: fixturePlanV3(),
+        runtimeStats: {},
+        browserEngine,
+      })[0]!.rows;
+    expect(rows(true)[0]).toEqual({ label: "Player", value: "Browser decoder" });
+    expect(rows(false)[0]).toEqual({ label: "Player", value: "HTML Video Player" });
+  });
+});
diff --git a/web/src/player/playback-info.ts b/web/src/player/playback-info.ts
index fd3735b2e0..29f24e93bd 100644
--- a/web/src/player/playback-info.ts
+++ b/web/src/player/playback-info.ts
@@ -1,15 +1,19 @@
 import {
+  audioTrackHasAtmos,
+  audioTrackLabel,
   dolbyVisionLabel,
   formatBitrate,
   formatCodecLabel,
   formatFileSize,
   formatMbpsFromKbps,
   formatSampleRate,
+  mentionsAtmos,
 } from "@/lib/mediaFormat";
 import { videoRangeLabel } from "@/lib/videoRange";
-import type { DeliveryV3, EffectiveRecipeV3, PlanV3 } from "./protocol-v3";
+import type { DeliveryV3, EffectiveRecipeV3, PlanV3, SourceDescriptorV3 } from "./protocol-v3";
 import {
   QUALITY_ORIGINAL_V3,
+  normalizeQualityPreferenceV3,
   TRANSFORMATION_AUDIO_TO_AAC_V3,
   TRANSFORMATION_VIDEO_TO_H264_V3,
 } from "./protocol-v3";
@@ -48,6 +52,8 @@ interface BuildPlaybackInfoSectionsInput {
   activeAudioTrack?: PlayerAudioTrack;
   /** The quality preference in effect, e.g. "auto" or a ladder rung id. */
   qualityPreference?: string;
+  /** True while the browser decode engine plays the stream instead of the media element. */
+  browserEngine?: boolean;
 }
 
 export function buildPlaybackInfoSections({
@@ -58,6 +64,7 @@ export function buildPlaybackInfoSections({
   runtimeStats,
   activeAudioTrack,
   qualityPreference,
+  browserEngine = false,
 }: BuildPlaybackInfoSectionsInput): PlaybackInfoSection[] {
   const videoTrack = currentSourceVersion ? pickVideoTrack(currentSourceVersion) : undefined;
   const audioTrack =
@@ -74,7 +81,7 @@ export function buildPlaybackInfoSections({
     {
       title: "Player",
       rows: [
-        { label: "Player", value: "HTML Video Player" },
+        { label: "Player", value: browserEngine ? "Browser decoder" : "HTML Video Player" },
         { label: "Play method", value: formatDelivery(plan.delivery) },
         { label: "Protocol", value: formatProtocol(streamUrl) },
         { label: "Stream type", value: formatStreamType(plan) },
@@ -212,76 +219,72 @@ export function buildPlaybackInfoSections({
 /**
  * Turns the plan's quality ladder into menu entries.
  *
- * The server owns the ladder: this maps its rungs onto the menu's shape and
- * adds nothing. `id` is the rung's own label, which is what a `quality_change`
- * replan sends back. The `auto` entry is prepended locally because it is a
- * *preference*, not a rung — no server rung names it, and picking it hands the
- * choice back to the planner.
+ * The server owns the ladder: this maps its fixed rungs onto the menu's shape.
+ * `id` is the rung's own label, which is what a `quality_change` replan sends
+ * back. The `auto` entry is prepended locally because it is a *preference*,
+ * not a rung, and it is also how the viewer returns to the source: Auto plays
+ * the original file whenever the device and connection can carry it. Older
+ * servers still list that source as an "original" entry, which is dropped
+ * here.
  */
 export function qualityOptionsFromPlanV3(plan: PlanV3): QualityOption[] {
-  const rungs = plan.available_qualities.map((quality) => ({
-    id: quality.label,
-    label: quality.display_name || qualityRungLabel(quality.label),
-    sublabel: formatQualityBitrate(quality.bitrate_kbps),
-    resolution: quality.height ? `${quality.height}p` : "",
-    bitrateKbps: quality.bitrate_kbps ?? 0,
-    isOriginal: quality.preserves_source,
-  }));
-
-  // A single source-preserving rung is not a choice, so there is no menu to
-  // render — audio-only plans and clients without HLS land here.
-  if (rungs.length <= 1) {
-    return rungs;
+  const rungs = plan.available_qualities
+    .filter((quality) => quality.label !== QUALITY_ORIGINAL_V3)
+    .map((quality) => ({
+      id: quality.label,
+      label: quality.display_name || qualityRungLabel(quality.label),
+      sublabel: formatQualityBitrate(quality.bitrate_kbps),
+      resolution: quality.height ? `${quality.height}p` : "",
+      bitrateKbps: quality.bitrate_kbps ?? 0,
+    }));
+
+  // Without a fixed rung there is nothing to choose, so there is no menu —
+  // audio-only plans and clients without HLS land here.
+  if (rungs.length === 0) {
+    return [];
   }
 
-  return [
-    {
-      id: "auto",
-      label: "Auto",
-      sublabel: "",
-      resolution: "",
-      bitrateKbps: 0,
-      isOriginal: false,
-    },
-    ...rungs,
-  ];
+  return [{ id: "auto", label: "Auto", sublabel: "", resolution: "", bitrateKbps: 0 }, ...rungs];
 }
 
 /**
- * Resolves a stored resolution-only preference onto the explicit bitrate rung
- * that implements the same policy in the current plan. Plain 2160p/1080p/720p
- * preferences use the ladder's Medium bitrate; when that resolution cap is at
- * or above the source, the source-preserving Original rung is the active one,
- * unless the plan's delivered recipe shows a bitrate cap reduced it.
+ * Resolves a stored preference onto the menu entry that implements it in the
+ * current plan. Auto and the legacy source labels light Auto. Plain
+ * 2160p/1080p/720p preferences use the ladder's Medium bitrate; when that
+ * resolution cap is at or above the source, the source plays as-is and no row
+ * is lit, unless the plan's delivered recipe shows a bitrate cap reduced it.
+ * Auto stays unlit so the viewer can still switch to it.
  */
 export function resolveActiveQualityOptionId(
   options: QualityOption[],
   preference: string,
   delivered?: EffectiveRecipeV3,
+  source?: Pick<SourceDescriptorV3, "height" | "bitrate_kbps">,
 ): string | null {
-  // A sole rung is effective regardless of the saved preference. Keep the
-  // preference unchanged so it applies again when more qualities are available.
-  if (options.length === 1) return options[0]!.id;
+  if (options.length === 0) return null;
 
-  const normalized = preference.trim().toLowerCase();
+  const normalized = normalizeQualityPreferenceV3(preference).toLowerCase();
   const exact = options.find((option) => option.id.toLowerCase() === normalized);
   if (exact) return exact.id;
 
   const aliasHeight = qualityPreferenceHeight(normalized);
-  if (aliasHeight === null) {
-    const originalAlias = ["source", "max"].includes(normalized);
-    return originalAlias ? (options.find((option) => option.isOriginal)?.id ?? null) : null;
-  }
+  if (aliasHeight === null) return null;
 
   // The planner preserves a source that fits the cap, even when the ladder
   // also publishes same-height rungs below the source bitrate. A bitrate cap,
   // the viewer's or the server's, can still force a transcode the ladder does
   // not show; the delivered bitrate reveals it.
-  const original = options.find((option) => option.isOriginal);
+  const sourceHeight = source?.height;
+  const sourceKbps = source?.bitrate_kbps;
   const deliveredKbps = delivered?.bitrate_kbps;
-  const capped = isPositive(deliveredKbps) && deliveredKbps < (original?.bitrateKbps ?? 0);
-  if (original && !capped && resolutionHeight(original.resolution) <= aliasHeight) {
-    return original.id;
+  const deliveredHeight = delivered?.height;
+  // A smaller delivered frame shows a reduction even when the source bitrate
+  // is unknown.
+  const capped =
+    (isPositive(deliveredKbps) && isPositive(sourceKbps) && deliveredKbps < sourceKbps) ||
+    (isPositive(deliveredHeight) && isPositive(sourceHeight) && deliveredHeight < sourceHeight);
+  if (isPositive(sourceHeight) && !capped && sourceHeight <= aliasHeight) {
+    return null;
   }
 
   // Otherwise the planner encodes at the Medium bitrate of a ladder class: the
@@ -307,21 +310,32 @@ function classMediumRungId(classHeight: number): string | null {
   }
 }
 
+/**
+ * The label for a plain resolution preference ("1080p", "4K") when it plays
+ * the source as-is and no menu row is lit; null for any other preference.
+ */
+export function plainResolutionLabel(preference: string): string | null {
+  const height = qualityPreferenceHeight(normalizeQualityPreferenceV3(preference).toLowerCase());
+  if (height === null) return null;
+  return height === 2160 ? "4K" : `${height}p`;
+}
+
 /**
  * The next quality rung below what the viewer receives now, for a viewer whose
- * connection cannot keep up. An explicit rung steps down from itself; Auto and
- * Original step down from the delivered bitrate, or to the top transcode rung
- * when a copy delivery reports none.
+ * connection cannot keep up. An explicit rung steps down from itself; Auto
+ * steps down from the delivered bitrate, or to the top transcode rung when a
+ * copy delivery reports none.
  */
 export function lowerQualityOption(
   options: QualityOption[],
   preference: string,
   delivered?: EffectiveRecipeV3,
+  source?: Pick<SourceDescriptorV3, "height" | "bitrate_kbps">,
 ): QualityOption | null {
   const rungs = options
-    .filter((option) => option.id !== "auto" && !option.isOriginal && option.bitrateKbps > 0)
+    .filter((option) => option.id !== "auto" && option.bitrateKbps > 0)
     .sort((a, b) => b.bitrateKbps - a.bitrateKbps);
-  const activeId = resolveActiveQualityOptionId(options, preference, delivered);
+  const activeId = resolveActiveQualityOptionId(options, preference, delivered, source);
   const deliveredBitrateKbps = delivered?.bitrate_kbps;
   const active = rungs.find((option) => option.id === activeId);
   const ceiling =
@@ -373,18 +387,6 @@ function ladderClassHeight(width?: number, height?: number): number | null {
   return box?.height ?? 2160;
 }
 
-function resolutionHeight(resolution: string): number {
-  const match = resolution
-    .trim()
-    .toLowerCase()
-    .match(/^(\d+)p$/);
-  return match ? Number.parseInt(match[1] ?? "0", 10) : 0;
-}
-
-function qualityRungLabel(label: string): string {
-  return label === QUALITY_ORIGINAL_V3 ? "Original" : label;
-}
-
 // Quality-menu bitrate label: Mbps with collapsed integers ("8 Mbps", not
 // "8.0 Mbps") — a deliberately different display policy than the canonical
 // formatBitrate/formatMbpsFromKbps in @/lib/mediaFormat.
@@ -411,6 +413,10 @@ export function formatStreamPath(streamUrl: string): string {
   }
 }
 
+function qualityRungLabel(label: string): string {
+  return label === QUALITY_ORIGINAL_V3 ? "Original" : label;
+}
+
 export function formatQualityPreference(plan: PlanV3, preference: string): string {
   if (preference === "auto") return "Auto";
   const rung = plan.available_qualities.find((quality) => quality.label === preference);
@@ -606,6 +612,11 @@ export function formatOriginalAudioCodec(
   track?: PlayerAudioTrack,
 ): string {
   const title = track?.title || track?.embedded_title;
+  // An Atmos track whose title does not say so, such as the codec's long
+  // name the scanner gives an untagged track, shows its family label.
+  if (track?.codec && audioTrackHasAtmos(track) && !mentionsAtmos(title)) {
+    return audioTrackLabel(track);
+  }
   if (title) {
     return title;
   }
diff --git a/web/src/player/playback-session-wire-v3.test.ts b/web/src/player/playback-session-wire-v3.test.ts
new file mode 100644
index 0000000000..5d81fec0c0
--- /dev/null
+++ b/web/src/player/playback-session-wire-v3.test.ts
@@ -0,0 +1,29 @@
+import { describe, expect, it } from "vitest";
+import { boundFailureV3 } from "./playback-session-wire-v3";
+
+describe("boundFailureV3", () => {
+  it("cuts each field to the server's byte bound", () => {
+    const failure = boundFailureV3({
+      classification: "c".repeat(80),
+      message: "m".repeat(600),
+      decoder_name: "d".repeat(200),
+    });
+    expect(failure.classification).toHaveLength(64);
+    expect(failure.message).toHaveLength(512);
+    expect(failure.decoder_name).toHaveLength(128);
+  });
+
+  it("counts UTF-8 bytes and never splits a character", () => {
+    const message = boundFailureV3({ classification: "x", message: "é".repeat(300) }).message!;
+    expect(new TextEncoder().encode(message).length).toBeLessThanOrEqual(512);
+    expect(message).toBe("é".repeat(256));
+    const emoji = boundFailureV3({ classification: "x", message: "a" + "😀".repeat(200) }).message!;
+    expect(new TextEncoder().encode(emoji).length).toBeLessThanOrEqual(512);
+    expect(emoji.endsWith("\ud83d")).toBe(false);
+  });
+
+  it("leaves a failure within bounds as it is", () => {
+    const failure = { classification: "decoder_error", message: "short" };
+    expect(boundFailureV3(failure)).toEqual(failure);
+  });
+});
diff --git a/web/src/player/playback-session-wire-v3.ts b/web/src/player/playback-session-wire-v3.ts
index fe64f79a92..883843fa8d 100644
--- a/web/src/player/playback-session-wire-v3.ts
+++ b/web/src/player/playback-session-wire-v3.ts
@@ -59,6 +59,34 @@ function clientFeaturesV3(extra: string[] | undefined): string[] {
   return [...BASE_CLIENT_FEATURES_V3, ...(extra ?? [])];
 }
 
+/**
+ * Contract bounds on a replan's `failure`, in UTF-8 bytes. The server refuses a
+ * replan that exceeds them, which would turn a recoverable failure into a stuck
+ * player, so a long diagnostic is cut rather than sent whole.
+ */
+const FAILURE_BYTE_LIMITS = { classification: 64, message: 512, decoder_name: 128 } as const;
+
+function truncateUtf8(value: string, maxBytes: number): string {
+  const bytes = new TextEncoder().encode(value);
+  if (bytes.length <= maxBytes) return value;
+  // A character cut at the boundary decodes to U+FFFD; drop it.
+  return new TextDecoder().decode(bytes.subarray(0, maxBytes)).replace(/\uFFFD$/, "");
+}
+
+/** A failure the server accepts: each field within its contract bound. */
+export function boundFailureV3(failure: FailureV3): FailureV3 {
+  const bounded: FailureV3 = {
+    classification: truncateUtf8(failure.classification, FAILURE_BYTE_LIMITS.classification),
+  };
+  if (failure.message !== undefined) {
+    bounded.message = truncateUtf8(failure.message, FAILURE_BYTE_LIMITS.message);
+  }
+  if (failure.decoder_name !== undefined) {
+    bounded.decoder_name = truncateUtf8(failure.decoder_name, FAILURE_BYTE_LIMITS.decoder_name);
+  }
+  return bounded;
+}
+
 function clampPosition(seconds: number): number {
   if (!Number.isFinite(seconds) || seconds < 0) return 0;
   return Math.min(seconds, MAX_POSITION_SECONDS);
@@ -88,7 +116,6 @@ export interface StartRequestInput {
   progressPersistence?: ProgressPersistenceV3;
   explicitAudioTrackIndex?: number | null;
   subtitleTrackIndex?: number | null;
-  metered: boolean;
   bandwidthEstimateKbps?: number | null;
   bandwidthCapKbps?: number | null;
   clientCapabilities: ClientCodecCapabilitiesV3;
@@ -116,7 +143,6 @@ export function buildStartRequestV3(input: StartRequestInput): StartRequestV3 {
     // The web player renders ASS with its own typesetting engine, so it asks
     // the server to keep authored fidelity rather than flatten it.
     subtitle_fidelity_preference: "preserve",
-    metered: input.metered,
     client_capabilities: input.clientCapabilities,
     client_playback_context: input.clientPlaybackContext,
     ...(input.forceStartPosition || input.position > 0
@@ -146,7 +172,6 @@ export interface ReplanRequestInput extends ReplanOptions {
   qualityPreference: string;
   attemptedPlanKeys: string[];
   attemptCount: number;
-  metered: boolean;
   bandwidthEstimateKbps?: number | null;
   bandwidthCapKbps?: number | null;
   clientCapabilities: ClientCodecCapabilitiesV3;
@@ -187,11 +212,10 @@ export function buildReplanRequestV3(input: ReplanRequestInput): ReplanRequestV3
     attempt_count: input.attemptCount,
     quality_preference: input.qualityPreference,
     position_seconds: clampPosition(input.positionSeconds),
-    metered: input.metered,
     selected_tracks: selectedTracks,
     client_capabilities: input.clientCapabilities,
     client_playback_context: input.clientPlaybackContext,
-    ...(input.failure ? { failure: input.failure } : {}),
+    ...(input.failure ? { failure: boundFailureV3(input.failure) } : {}),
     ...(input.bandwidthEstimateKbps != null
       ? { bandwidth_estimate_kbps: input.bandwidthEstimateKbps }
       : {}),
diff --git a/web/src/player/protocol-v3.ts b/web/src/player/protocol-v3.ts
index d52de412c5..50233f13d0 100644
--- a/web/src/player/protocol-v3.ts
+++ b/web/src/player/protocol-v3.ts
@@ -148,9 +148,45 @@ export const FEATURE_PLAN_INVALIDATED_V3 = "plan_invalidated_v1";
  */
 export const FEATURE_HLS_VARIABLE_SUBSTITUTION_V3 = "hls_variable_substitution_v1";
 
-/** The `original` rung label, which always preserves the source. */
+/**
+ * `original_http` validated claim: the client maps `selected_tracks.audio.index`
+ * onto the file's own audio tracks, so a non-default track needs no remux.
+ */
+export const CLAIM_CLIENT_SELECTED_AUDIO_TRACK_V3 = "client_selected_audio_track_v1";
+
+/**
+ * `original_http` validated claim: the client accepts HDR and Dolby Vision
+ * originals and resolves presentation for the live output itself.
+ */
+export const CLAIM_CLIENT_MANAGED_DYNAMIC_RANGE_V3 = "client_managed_dynamic_range_v1";
+
+/**
+ * The legacy source-preserving quality label. Servers before the v2 menu
+ * change still publish it as an `available_qualities` entry; as a preference
+ * it is an alias of `auto`, which already plays the source whenever the
+ * device and connection can carry it.
+ */
 export const QUALITY_ORIGINAL_V3 = "original";
 
+/**
+ * A stored or chosen quality preference in the form the client works with.
+ * Empty and the legacy source labels ("original", "source", "max") read as
+ * `auto`, as the server reads them; anything else passes through trimmed.
+ */
+export function normalizeQualityPreferenceV3(value: string | null | undefined): string {
+  const trimmed = value?.trim() ?? "";
+  switch (trimmed.toLowerCase()) {
+    case "":
+    case "auto":
+    case QUALITY_ORIGINAL_V3:
+    case "source":
+    case "max":
+      return "auto";
+    default:
+      return trimmed;
+  }
+}
+
 /** Server-executed transformation names a plan can list. */
 export const TRANSFORMATION_AUDIO_TO_AAC_V3 = "audio_to_aac";
 export const TRANSFORMATION_VIDEO_TO_H264_V3 = "video_to_h264";
@@ -317,7 +353,6 @@ export interface StartRequestV3 {
   audio_track_index?: number;
   subtitle_track_id?: string;
   subtitle_track_index?: number;
-  metered: boolean;
   bandwidth_estimate_kbps?: number;
   bandwidth_cap_kbps?: number;
   client_capabilities: ClientCodecCapabilitiesV3;
@@ -354,7 +389,6 @@ export interface ReplanRequestV3 {
   attempt_count: number;
   quality_preference: string;
   position_seconds: number;
-  metered: boolean;
   bandwidth_estimate_kbps?: number;
   bandwidth_cap_kbps?: number;
   selected_tracks: SelectedTracksV3;
diff --git a/web/src/player/start-v2.test.ts b/web/src/player/start-v2.test.ts
index 71e5a732a8..2be0200f34 100644
--- a/web/src/player/start-v2.test.ts
+++ b/web/src/player/start-v2.test.ts
@@ -38,7 +38,6 @@ const fixtureStartRequestV3 = () =>
     qualityPreference: "auto",
     position: 0,
     forceStartPosition: false,
-    metered: false,
     clientCapabilities: fixtureClientCapabilitiesV3(),
     clientPlaybackContext: fixtureClientPlaybackContextV3(),
   });
diff --git a/web/src/player/start-v2.ts b/web/src/player/start-v2.ts
index 668c66d883..29d5f37cc6 100644
--- a/web/src/player/start-v2.ts
+++ b/web/src/player/start-v2.ts
@@ -11,6 +11,7 @@
  */
 
 import type { components } from "@/api/v2/schema";
+import { cancelBandwidthProbe } from "./bandwidth-probe";
 import type { PlayerConfig } from "./context/PlayerConfigContext";
 import {
   isTransientPlayerRequestError,
@@ -109,6 +110,8 @@ export async function startPlaybackV2(
   body: StartRequestV3,
   options: { signal?: AbortSignal } = {},
 ): Promise<DecisionResponseV3> {
+  // A background bandwidth probe would compete with the media about to load.
+  cancelBandwidthProbe();
   const cap = await playbackCapabilitiesV2(config);
   if (cap.state === "not_configured")
     throw new Error("API v2 playback is not configured on this server");
diff --git a/web/src/player/types.ts b/web/src/player/types.ts
index b1917d46d1..df037ef5af 100644
--- a/web/src/player/types.ts
+++ b/web/src/player/types.ts
@@ -99,6 +99,7 @@ export interface PlayerAudioTrack {
   embedded_title?: string;
   language?: string;
   codec?: string;
+  profile?: string;
   layout?: string;
   channels?: number;
   bitrate?: number;
@@ -335,7 +336,6 @@ export interface QualityOption {
   sublabel: string;
   resolution: string;
   bitrateKbps: number;
-  isOriginal: boolean;
 }
 
 /** Context for series playback (episode navigation). */
@@ -356,6 +356,8 @@ export interface EpisodeRef {
   runtime: number;
   /** Optional display fields for post-roll / next-episode UI. */
   overview?: string;
+  /** Localized fields whose text was machine-translated by AI. */
+  machineTranslatedFields?: string[];
   stillUrl?: string;
   stillIsEpisodeStill?: boolean;
   stillThumbhash?: string;
diff --git a/web/src/player/utils/pendingSeek.ts b/web/src/player/utils/pendingSeek.ts
index 6d10854a6a..9959da775f 100644
--- a/web/src/player/utils/pendingSeek.ts
+++ b/web/src/player/utils/pendingSeek.ts
@@ -20,3 +20,22 @@ export function resolvePendingSeekTime(
 
   return { currentTime: pendingSeekTime, pendingSeekTime };
 }
+
+/**
+ * A room seek this close to the viewer's held request answers it. The server
+ * folds a repeat seek this close to its waiting seek into that seek.
+ */
+export const ROOM_HELD_SEEK_MATCH_SECONDS = 1;
+/** A held request the room never runs stops holding the timeline after this. */
+export const ROOM_HELD_SEEK_TIMEOUT_MS = 5_000;
+
+/**
+ * The viewer's room seek request still held after the room runs a seek to
+ * `commanded`. In a burst of skips the room's seeks for the earlier skips land
+ * first: they move the element but leave the newest request on the timeline,
+ * so the next skip still builds on it. Only the room's seek to it releases it.
+ */
+export function remainingRoomHeldSeek(held: number | null, commanded: number): number | null {
+  if (held === null || !Number.isFinite(commanded)) return null;
+  return Math.abs(held - commanded) <= ROOM_HELD_SEEK_MATCH_SECONDS ? null : held;
+}
diff --git a/web/src/player/utils/pgs.test.ts b/web/src/player/utils/pgs.test.ts
new file mode 100644
index 0000000000..a24d940cd8
--- /dev/null
+++ b/web/src/player/utils/pgs.test.ts
@@ -0,0 +1,576 @@
+import { describe, expect, it } from "vitest";
+import {
+  decodePGSObject,
+  mergePGSCompositions,
+  pgsCompositionAt,
+  pgsCompositionIndexAt,
+  pgsPaletteEntryToRGBA,
+  prunePGSTimeline,
+  PGSStreamParser,
+  type PGSComposition,
+} from "./pgs";
+
+function segment(type: number, ptsSeconds: number, body: number[]): number[] {
+  const pts = Math.round(ptsSeconds * 90_000);
+  return [
+    0x50,
+    0x47,
+    (pts >>> 24) & 0xff,
+    (pts >>> 16) & 0xff,
+    (pts >>> 8) & 0xff,
+    pts & 0xff,
+    0,
+    0,
+    0,
+    0,
+    type,
+    (body.length >> 8) & 0xff,
+    body.length & 0xff,
+    ...body,
+  ];
+}
+
+const u16 = (value: number) => [(value >> 8) & 0xff, value & 0xff];
+
+function pcs(
+  pts: number,
+  options: {
+    state?: number;
+    paletteId?: number;
+    objects?: Array<{ id: number; x: number; y: number; forced?: boolean; crop?: number[] }>;
+    width?: number;
+    height?: number;
+  } = {},
+): number[] {
+  const objects = options.objects ?? [];
+  const body = [
+    ...u16(options.width ?? 1920),
+    ...u16(options.height ?? 1080),
+    0x10,
+    ...u16(1),
+    options.state ?? 0x80,
+    0,
+    options.paletteId ?? 0,
+    objects.length,
+  ];
+  for (const object of objects) {
+    const flags = (object.crop ? 0x80 : 0) | (object.forced ? 0x40 : 0);
+    body.push(...u16(object.id), 0, flags, ...u16(object.x), ...u16(object.y));
+    if (object.crop) for (const value of object.crop) body.push(...u16(value));
+  }
+  return segment(0x16, pts, body);
+}
+
+function pds(pts: number, id: number, entries: Array<[number, number, number, number, number]>) {
+  return segment(0x14, pts, [id, 0, ...entries.flat()]);
+}
+
+function ods(pts: number, id: number, width: number, height: number, rle: number[]): number[] {
+  const length = rle.length + 4;
+  return segment(0x15, pts, [
+    ...u16(id),
+    0,
+    0xc0,
+    (length >> 16) & 0xff,
+    (length >> 8) & 0xff,
+    length & 0xff,
+    ...u16(width),
+    ...u16(height),
+    ...rle,
+  ]);
+}
+
+const end = (pts: number) => segment(0x80, pts, []);
+
+// Two lines of a 4x2 object: "1 1 2 2" then "0 0 0 1".
+const RLE_4X2 = [1, 1, 0, 0x82, 2, 0, 0, 0, 0x03, 1, 0, 0];
+const WHITE: [number, number, number, number, number] = [1, 235, 128, 128, 255];
+const RED_HALF: [number, number, number, number, number] = [2, 63, 240, 102, 128];
+
+function displaySetWithObject(pts: number): number[] {
+  return [
+    ...pcs(pts, { objects: [{ id: 0, x: 100, y: 900 }] }),
+    ...pds(pts, 0, [WHITE, RED_HALF]),
+    ...ods(pts, 0, 4, 2, RLE_4X2),
+    ...end(pts),
+  ];
+}
+
+describe("PGSStreamParser", () => {
+  it("resolves a display set into a composition with its palette and object", () => {
+    const parser = new PGSStreamParser();
+    const [composition] = parser.push(new Uint8Array(displaySetWithObject(12.5)));
+
+    expect(composition).toMatchObject({ start: 12.5, width: 1920, height: 1080 });
+    expect(composition!.objects).toHaveLength(1);
+    const object = composition!.objects[0]!;
+    expect(object).toMatchObject({ x: 100, y: 900, width: 4, height: 2, crop: null });
+
+    const pixels = decodePGSObject(object);
+    const white = pgsPaletteEntryToRGBA(235, 128, 128, 255, 1080);
+    const red = pgsPaletteEntryToRGBA(63, 240, 102, 128, 1080);
+    expect(Array.from(pixels)).toEqual([white, white, red, red, 0, 0, 0, white]);
+  });
+
+  it("parses across arbitrary chunk boundaries", () => {
+    const bytes = new Uint8Array([...displaySetWithObject(1), ...pcs(3, { state: 0 }), ...end(3)]);
+    const parser = new PGSStreamParser();
+    const compositions: PGSComposition[] = [];
+    for (let offset = 0; offset < bytes.length; offset += 7) {
+      compositions.push(...parser.push(bytes.subarray(offset, offset + 7)));
+    }
+    expect(compositions.map((c) => [c.start, c.objects.length])).toEqual([
+      [1, 1],
+      [3, 0],
+    ]);
+  });
+
+  it("reuses objects and palettes defined earlier in the same epoch", () => {
+    const parser = new PGSStreamParser();
+    const compositions = parser.push(
+      new Uint8Array([
+        ...displaySetWithObject(1),
+        // A later normal-state display set places object 0 again without
+        // redefining it, with a crop.
+        ...pcs(2, { state: 0, objects: [{ id: 0, x: 50, y: 60, crop: [1, 0, 2, 1] }] }),
+        ...end(2),
+      ]),
+    );
+    expect(compositions[1]!.objects[0]).toMatchObject({
+      x: 50,
+      y: 60,
+      crop: { x: 1, y: 0, width: 2, height: 1 },
+      width: 4,
+      height: 2,
+    });
+  });
+
+  it("forgets objects at an epoch start", () => {
+    const parser = new PGSStreamParser();
+    const compositions = parser.push(
+      new Uint8Array([
+        ...displaySetWithObject(1),
+        ...pcs(2, { state: 0x80, objects: [{ id: 0, x: 0, y: 0 }] }),
+        ...end(2),
+      ]),
+    );
+    // The new epoch never defined object 0, so its screen cannot be drawn.
+    expect(compositions.map((c) => c.start)).toEqual([1]);
+  });
+
+  it("forgets objects at an acquisition point", () => {
+    const parser = new PGSStreamParser();
+    const compositions = parser.push(
+      new Uint8Array([
+        ...displaySetWithObject(1),
+        // An acquisition point redefines what it shows: palette 0, object 1.
+        ...pcs(2, { state: 0x40, objects: [{ id: 1, x: 0, y: 0 }] }),
+        ...pds(2, 0, [WHITE]),
+        ...ods(2, 1, 4, 2, RLE_4X2),
+        ...end(2),
+        // Object 0 belonged to the earlier epoch, so this screen cannot be drawn.
+        ...pcs(3, { state: 0, objects: [{ id: 0, x: 0, y: 0 }] }),
+        ...end(3),
+      ]),
+    );
+    expect(compositions.map((c) => c.start)).toEqual([1, 2]);
+  });
+
+  it("drops a screen whose objects add up to more pixels than any plane", () => {
+    const parser = new PGSStreamParser();
+    const objects = [0, 1].map((id) => ({ id, x: 0, y: 0 }));
+    const compositions = parser.push(
+      new Uint8Array([
+        ...pcs(1, { objects }),
+        ...pds(1, 0, [WHITE]),
+        // Two 4096x2049 objects: each alone is plausible, together too large.
+        ...ods(1, 0, 4096, 2049, [0, 0]),
+        ...ods(1, 1, 4096, 2049, [0, 0]),
+        ...end(1),
+      ]),
+    );
+    expect(compositions).toEqual([]);
+  });
+
+  it("keeps at most 20,000 screens from one window", () => {
+    const parser = new PGSStreamParser();
+    const clears: number[] = [];
+    for (let n = 0; n < 20_001; n++) clears.push(...pcs(n / 100, { state: 0 }), ...end(n / 100));
+    expect(parser.push(new Uint8Array(clears))).toHaveLength(20_000);
+    // The next window starts its own count.
+    parser.resetBuffer();
+    expect(parser.push(new Uint8Array([...pcs(300, { state: 0 }), ...end(300)]))).toHaveLength(1);
+  });
+
+  it("drops objects past 16 MiB of object data in one epoch", () => {
+    // An object of `bytes` RLE bytes, split into segments of at most 65,000.
+    const bigObject = (pts: number, id: number, bytes: number): number[] => {
+      const out: number[] = [];
+      const data = new Array<number>(bytes).fill(0);
+      for (let offset = 0; offset < bytes; offset += 65_000) {
+        const piece = data.slice(offset, offset + 65_000);
+        const first = offset === 0;
+        const last = offset + 65_000 >= bytes;
+        const flags = (first ? 0x80 : 0) | (last ? 0x40 : 0);
+        const length = bytes + 4;
+        const header = first
+          ? [
+              ...u16(id),
+              0,
+              flags,
+              (length >> 16) & 0xff,
+              (length >> 8) & 0xff,
+              length & 0xff,
+              ...u16(4096),
+              ...u16(2),
+            ]
+          : [...u16(id), 0, flags];
+        out.push(...segment(0x15, pts, [...header, ...piece]));
+      }
+      return out;
+    };
+    const parser = new PGSStreamParser();
+    const compositions = parser.push(
+      new Uint8Array([
+        ...pcs(1),
+        ...pds(1, 0, [WHITE]),
+        ...bigObject(1, 0, 9_000_000),
+        ...bigObject(1, 1, 9_000_000),
+        ...end(1),
+        ...pcs(2, { state: 0, objects: [{ id: 0, x: 0, y: 0 }] }),
+        ...end(2),
+        // Object 1 went past the limit, so a screen placing it is dropped.
+        ...pcs(3, { state: 0, objects: [{ id: 1, x: 0, y: 0 }] }),
+        ...end(3),
+      ]),
+    );
+    expect(compositions.map((c) => c.start)).toEqual([1, 2]);
+  });
+
+  it("assembles objects whose fragments are interleaved", () => {
+    const parser = new PGSStreamParser();
+    const length = RLE_4X2.length + 4;
+    const fragment = (id: number, flags: number, data: number[], first: boolean) =>
+      segment(0x15, 1, [
+        ...u16(id),
+        0,
+        flags,
+        ...(first ? [0, 0, length, ...u16(4), ...u16(2)] : []),
+        ...data,
+      ]);
+    const [composition] = parser.push(
+      new Uint8Array([
+        ...pcs(1, {
+          objects: [
+            { id: 0, x: 0, y: 0 },
+            { id: 1, x: 0, y: 900 },
+          ],
+        }),
+        ...pds(1, 0, [WHITE, RED_HALF]),
+        // Object 0's first half, all of object 1, then object 0's second half.
+        ...fragment(0, 0x80, RLE_4X2.slice(0, 6), true),
+        ...ods(1, 1, 4, 2, RLE_4X2),
+        ...fragment(0, 0x40, RLE_4X2.slice(6), false),
+        ...end(1),
+      ]),
+    );
+    expect(composition?.objects).toHaveLength(2);
+    expect(Array.from(composition!.objects[0]!.rle)).toEqual(RLE_4X2);
+  });
+
+  it("places at most two objects on one screen", () => {
+    const parser = new PGSStreamParser();
+    const [composition] = parser.push(
+      new Uint8Array([
+        ...pcs(1, { objects: [0, 0, 0].map((id) => ({ id, x: 0, y: 0 })) }),
+        ...pds(1, 0, [WHITE]),
+        ...ods(1, 0, 4, 2, RLE_4X2),
+        ...end(1),
+      ]),
+    );
+    expect(composition?.objects).toHaveLength(2);
+  });
+
+  it("copies a palette only once a screen holds it", () => {
+    const parser = new PGSStreamParser();
+    const show = (pts: number) => [
+      ...pcs(pts, { state: 0, objects: [{ id: 0, x: 0, y: 0 }] }),
+      ...end(pts),
+    ];
+    const [first, second, third] = parser.push(
+      new Uint8Array([
+        ...pcs(1, { objects: [{ id: 0, x: 0, y: 0 }] }),
+        // Two updates before any screen holds the palette: both apply.
+        ...pds(1, 0, [WHITE]),
+        ...pds(1, 0, [RED_HALF]),
+        ...ods(1, 0, 4, 2, RLE_4X2),
+        ...end(1),
+        ...show(2),
+        ...pds(3, 0, [[1, 16, 128, 128, 255]]),
+        ...show(3),
+      ]),
+    );
+    const firstPalette = first!.objects[0]!.palette;
+    expect(firstPalette[1]).toBe(pgsPaletteEntryToRGBA(235, 128, 128, 255, 1080));
+    expect(firstPalette[2]).toBe(pgsPaletteEntryToRGBA(63, 240, 102, 128, 1080));
+    // No update in between: the next screen shares the palette.
+    expect(second!.objects[0]!.palette).toBe(firstPalette);
+    // An update after a screen holds it makes a copy; the earlier screen keeps its colors.
+    expect(third!.objects[0]!.palette).not.toBe(firstPalette);
+    expect(firstPalette[1]).toBe(pgsPaletteEntryToRGBA(235, 128, 128, 255, 1080));
+  });
+
+  it("keeps at most 32 MiB of object data in one window's screens", () => {
+    // Redefining one object keeps it inside the epoch budget, but each screen
+    // still holds the definition it showed.
+    // Built as byte buffers: spreading 36 MB through number arrays is slow
+    // enough to time out on a busy CI runner.
+    const parser = new PGSStreamParser();
+    const bytes = 9_000_000;
+    const redefine = (pts: number) => {
+      const out: Uint8Array[] = [
+        new Uint8Array(pcs(pts, { state: 0, objects: [{ id: 0, x: 0, y: 0 }] })),
+      ];
+      for (let offset = 0; offset < bytes; offset += 65_000) {
+        const first = offset === 0;
+        const flags = (first ? 0x80 : 0) | (offset + 65_000 >= bytes ? 0x40 : 0);
+        const length = bytes + 4;
+        const header = first
+          ? [
+              ...u16(0),
+              0,
+              flags,
+              (length >> 16) & 0xff,
+              (length >> 8) & 0xff,
+              length & 0xff,
+              ...u16(4096),
+              ...u16(2),
+            ]
+          : [...u16(0), 0, flags];
+        // The segment header carries the full body size; the zero-filled
+        // tail of the buffer is the object data.
+        const payload = Math.min(65_000, bytes - offset);
+        const head = segment(0x15, pts, header);
+        head[11] = ((header.length + payload) >> 8) & 0xff;
+        head[12] = (header.length + payload) & 0xff;
+        const fragment = new Uint8Array(head.length + payload);
+        fragment.set(head);
+        out.push(fragment);
+      }
+      out.push(new Uint8Array(end(pts)));
+      return out;
+    };
+    const chunks = [
+      new Uint8Array([...pcs(1, { objects: [] }), ...pds(1, 0, [WHITE]), ...end(1)]),
+      ...redefine(2),
+      ...redefine(3),
+      ...redefine(4),
+      ...redefine(5),
+    ];
+    const stream = new Uint8Array(chunks.reduce((sum, chunk) => sum + chunk.byteLength, 0));
+    let position = 0;
+    for (const chunk of chunks) {
+      stream.set(chunk, position);
+      position += chunk.byteLength;
+    }
+    const compositions = parser.push(stream);
+    // Three 9 MB screens fit; the fourth would pass 32 MiB.
+    expect(compositions.map((c) => c.start)).toEqual([1, 2, 3, 4]);
+  });
+
+  it("drops an object sent in more fragments than any real object needs", () => {
+    const parser = new PGSStreamParser();
+    const length = RLE_4X2.length + 4;
+    const first = segment(0x15, 1, [...u16(0), 0, 0x80, 0, 0, length, ...u16(4), ...u16(2)]);
+    const empty = segment(0x15, 1, [...u16(0), 0, 0x00]);
+    const last = segment(0x15, 1, [...u16(0), 0, 0x40, ...RLE_4X2]);
+    const send = (emptyFragments: number) =>
+      parser.push(
+        new Uint8Array([
+          ...pcs(1, { objects: [{ id: 0, x: 0, y: 0 }] }),
+          ...pds(1, 0, [WHITE]),
+          ...first,
+          ...new Array<number[]>(emptyFragments).fill(empty).flat(),
+          ...last,
+          ...end(1),
+        ]),
+      );
+    // A few empty fragments are harmless and add nothing.
+    expect(Array.from(send(3)[0]!.objects[0]!.rle)).toEqual(RLE_4X2);
+    // Past the limit the object, and so its screen, is dropped.
+    expect(send(600)).toEqual([]);
+  });
+
+  it("keeps an earlier screen's colors after a palette-only update", () => {
+    const parser = new PGSStreamParser();
+    const [first, second] = parser.push(
+      new Uint8Array([
+        ...displaySetWithObject(1),
+        ...pcs(2, { state: 0, objects: [{ id: 0, x: 100, y: 900 }] }),
+        ...pds(2, 0, [[1, 235, 128, 128, 64]]),
+        ...end(2),
+      ]),
+    );
+    expect(first!.objects[0]!.palette[1]! >>> 24).toBe(255);
+    expect(second!.objects[0]!.palette[1]! >>> 24).toBe(64);
+  });
+
+  it("assembles an object split across several segments", () => {
+    const rle = RLE_4X2;
+    const length = rle.length + 4;
+    const firstPart = segment(0x15, 1, [
+      0,
+      0,
+      0,
+      0x80,
+      (length >> 16) & 0xff,
+      (length >> 8) & 0xff,
+      length & 0xff,
+      ...u16(4),
+      ...u16(2),
+      ...rle.slice(0, 5),
+    ]);
+    const lastPart = segment(0x15, 1, [0, 0, 0, 0x40, ...rle.slice(5)]);
+    const parser = new PGSStreamParser();
+    const [composition] = parser.push(
+      new Uint8Array([
+        ...pcs(1, { objects: [{ id: 0, x: 0, y: 0 }] }),
+        ...pds(1, 0, [WHITE, RED_HALF]),
+        ...firstPart,
+        ...lastPart,
+        ...end(1),
+      ]),
+    );
+    expect(Array.from(composition!.objects[0]!.rle)).toEqual(rle);
+  });
+
+  it("drops a display set that places objects defined before the stream began", () => {
+    // A window that starts mid-epoch: the screen's objects were defined in an
+    // earlier window, so this parser cannot draw it and must not clear it.
+    const parser = new PGSStreamParser();
+    const compositions = parser.push(
+      new Uint8Array([
+        ...pcs(2, { state: 0, objects: [{ id: 0, x: 0, y: 0 }] }),
+        ...end(2),
+        ...pcs(3, { state: 0 }),
+        ...end(3),
+      ]),
+    );
+    expect(compositions.map((c) => [c.start, c.objects.length])).toEqual([[3, 0]]);
+  });
+
+  it("drops a display set whose palette was defined before the stream began", () => {
+    const parser = new PGSStreamParser();
+    const compositions = parser.push(
+      new Uint8Array([
+        ...pcs(2, { state: 0, objects: [{ id: 0, x: 0, y: 0 }] }),
+        ...ods(2, 0, 4, 2, RLE_4X2),
+        ...end(2),
+      ]),
+    );
+    expect(compositions).toEqual([]);
+  });
+
+  it("keeps the epoch across windows when only the byte buffer is reset", () => {
+    const parser = new PGSStreamParser();
+    parser.push(new Uint8Array(displaySetWithObject(1)));
+    // The first window ends partway through a segment header.
+    parser.push(new Uint8Array([0x50, 0x47, 0, 0]));
+    parser.resetBuffer();
+    const [next] = parser.push(
+      new Uint8Array([...pcs(5, { state: 0, objects: [{ id: 0, x: 10, y: 20 }] }), ...end(5)]),
+    );
+    expect(next).toMatchObject({ start: 5 });
+    expect(next!.objects[0]).toMatchObject({ x: 10, y: 20, width: 4, height: 2 });
+    expect(next!.objects[0]!.palette[1]! >>> 24).toBe(255);
+  });
+
+  it("reports how far into the stream it has read", () => {
+    const parser = new PGSStreamParser();
+    expect(parser.receivedUntil).toBe(-Infinity);
+    parser.push(new Uint8Array([...displaySetWithObject(4), ...pcs(7, { state: 0 })]));
+    // The clear at 7 has no END yet, but its presentation segment arrived.
+    expect(parser.receivedUntil).toBe(7);
+  });
+
+  it("skips garbage before the next segment", () => {
+    const parser = new PGSStreamParser();
+    const compositions = parser.push(new Uint8Array([1, 2, 0x50, 3, ...displaySetWithObject(4)]));
+    expect(compositions.map((c) => c.start)).toEqual([4]);
+  });
+});
+
+describe("decodePGSObject", () => {
+  it("expands long runs and clips runs that overflow a line", () => {
+    const palette = new Uint32Array(256);
+    palette[5] = 0xff0000ff;
+    const pixels = decodePGSObject({
+      x: 0,
+      y: 0,
+      crop: null,
+      forced: false,
+      width: 3,
+      height: 2,
+      // 0x40-flagged 14-bit run of 300 transparent pixels, end of line, then
+      // a 14-bit run of color 5.
+      rle: new Uint8Array([0, 0x41, 0x2c, 0, 0, 0, 0xc0, 3, 5, 0, 0]),
+      palette,
+    });
+    expect(Array.from(pixels)).toEqual([0, 0, 0, 0xff0000ff, 0xff0000ff, 0xff0000ff]);
+  });
+});
+
+describe("PGS timeline helpers", () => {
+  const at = (start: number, objects = 1): PGSComposition => ({
+    start,
+    width: 1920,
+    height: 1080,
+    objects: Array.from({ length: objects }, () => ({
+      x: 0,
+      y: 0,
+      crop: null,
+      forced: false,
+      width: 1,
+      height: 1,
+      rle: new Uint8Array(),
+      palette: new Uint32Array(256),
+    })),
+  });
+
+  it("finds the composition on screen at a time", () => {
+    const timeline = [at(1), at(2, 0), at(5)];
+    expect(pgsCompositionIndexAt(timeline, 0.5)).toBe(-1);
+    expect(pgsCompositionIndexAt(timeline, 1)).toBe(0);
+    expect(pgsCompositionIndexAt(timeline, 4.9)).toBe(1);
+    expect(pgsCompositionIndexAt(timeline, 9)).toBe(2);
+  });
+
+  it("keeps the copy an earlier window resolved when a window repeats a screen", () => {
+    const earlier = at(1);
+    const merged = mergePGSCompositions([earlier], [at(1, 2), at(3)]);
+    expect(merged[0]).toBe(earlier);
+    expect(merged.map((c) => c.start)).toEqual([1, 3]);
+  });
+
+  it("shows nothing past the loaded part of the timeline", () => {
+    const timeline = [at(1), at(5)];
+    expect(pgsCompositionAt(timeline, 9, 10)).toBe(timeline[1]);
+    expect(pgsCompositionAt(timeline, 12, 10)).toBeNull();
+    expect(pgsCompositionAt(timeline, 0.5, 10)).toBeNull();
+  });
+
+  it("prunes screens behind a point but keeps the one showing there", () => {
+    const timeline = [at(1), at(2, 0), at(5), at(9)];
+    expect(prunePGSTimeline(timeline, 6).map((c) => c.start)).toEqual([5, 9]);
+    expect(prunePGSTimeline(timeline, 0.5)).toBe(timeline);
+  });
+
+  it("merges overlapping windows without letting an unresolved copy erase a screen", () => {
+    const merged = mergePGSCompositions([at(1), at(2, 0)], [at(1, 0), at(3)]);
+    expect(merged.map((c) => [c.start, c.objects.length])).toEqual([
+      [1, 1],
+      [2, 0],
+      [3, 1],
+    ]);
+  });
+});
diff --git a/web/src/player/utils/pgs.ts b/web/src/player/utils/pgs.ts
new file mode 100644
index 0000000000..1d20891c60
--- /dev/null
+++ b/web/src/player/utils/pgs.ts
@@ -0,0 +1,545 @@
+/**
+ * Parser for HDMV Presentation Graphic Stream (PGS, Blu-ray `.sup`) subtitles.
+ *
+ * A `.sup` stream is a run of segments, each `"PG" | PTS | DTS | type | size`.
+ * Segments group into display sets: a presentation composition (PCS), optional
+ * window (WDS), palette (PDS) and object (ODS) definitions, then END. Palettes
+ * and objects persist across display sets until the next epoch start, so a
+ * later display set may place an object defined earlier. Each display set
+ * resolves here to a {@link PGSComposition}: everything needed to draw that
+ * screen without consulting earlier state, or an empty object list to clear.
+ * A display set that places an object or palette this parser never saw (its
+ * epoch began before the stream did) is dropped rather than turned into a
+ * clear, so it cannot erase a screen that is still showing.
+ *
+ * Bitmaps stay run-length encoded until drawn ({@link decodePGSObject}); a
+ * feature-length track holds thousands of display sets and only the one on
+ * screen needs pixels.
+ */
+
+const SEGMENT_HEADER_BYTES = 13;
+const PGS_TIMESCALE = 90_000;
+
+const SEGMENT_PDS = 0x14;
+const SEGMENT_ODS = 0x15;
+const SEGMENT_PCS = 0x16;
+const SEGMENT_WDS = 0x17;
+const SEGMENT_END = 0x80;
+
+const COMPOSITION_EPOCH_START = 0x80;
+const COMPOSITION_ACQUISITION_POINT = 0x40;
+// One screen's objects together. A real plane is at most 1920x1080 and its
+// objects fit inside it, so a composition past this is damaged or crafted
+// data, and decoding it could exhaust the browser's memory.
+const MAX_COMPOSITION_PIXELS = 4096 * 4096;
+// A real track shows at most a few dozen screens a second, and a Blu-ray
+// decoder holds 4 MiB of object data per epoch. Past these limits a stream is
+// damaged or crafted, and keeping all of it could exhaust the browser, so the
+// excess is dropped and the screen before it stays up.
+const MAX_COMPOSITIONS_PER_WINDOW = 20_000;
+// A Blu-ray screen places at most two objects; FFmpeg's decoder clamps to the
+// same, and the rest of a crafted list would only cost memory.
+const MAX_OBJECTS_PER_COMPOSITION = 2;
+const MAX_EPOCH_OBJECT_BYTES = 16 * 1024 * 1024;
+// The screens of one window keep their objects' data even after a later
+// definition replaces them; a real window holds a few megabytes of it.
+const MAX_WINDOW_OBJECT_BYTES = 32 * 1024 * 1024;
+// An object's 24-bit length fits in about 257 segments of 64 KiB; more
+// fragments than this are damaged or crafted.
+const MAX_OBJECT_FRAGMENTS = 512;
+const ODS_FIRST_IN_SEQUENCE = 0x80;
+const ODS_LAST_IN_SEQUENCE = 0x40;
+const OBJECT_CROPPED = 0x80;
+const OBJECT_FORCED = 0x40;
+
+export interface PGSCrop {
+  x: number;
+  y: number;
+  width: number;
+  height: number;
+}
+
+export interface PGSPlacedObject {
+  /** Top-left of the (cropped) object on the composition plane. */
+  x: number;
+  y: number;
+  /** Source rectangle within the object bitmap, or null for the whole object. */
+  crop: PGSCrop | null;
+  forced: boolean;
+  width: number;
+  height: number;
+  rle: Uint8Array;
+  /** 256 entries of packed RGBA (`r | g << 8 | b << 16 | a << 24`). */
+  palette: Uint32Array;
+}
+
+export interface PGSComposition {
+  /** Source time, in seconds, at which this screen replaces the previous one. */
+  start: number;
+  /** Size of the plane the object coordinates refer to. */
+  width: number;
+  height: number;
+  /** Empty when the display set clears the screen. */
+  objects: PGSPlacedObject[];
+}
+
+interface PendingObject {
+  width: number;
+  height: number;
+  expectedBytes: number;
+  chunks: Uint8Array[];
+  receivedBytes: number;
+  fragments: number;
+}
+
+interface ObjectDefinition {
+  width: number;
+  height: number;
+  rle: Uint8Array;
+}
+
+interface CompositionReference {
+  objectId: number;
+  x: number;
+  y: number;
+  crop: PGSCrop | null;
+  forced: boolean;
+}
+
+interface PresentationSegment {
+  pts: number;
+  width: number;
+  height: number;
+  paletteId: number;
+  objects: CompositionReference[];
+}
+
+function clampByte(value: number): number {
+  return value < 0 ? 0 : value > 255 ? 255 : Math.round(value);
+}
+
+/**
+ * Converts one limited-range palette entry to packed RGBA. Blu-ray HD streams
+ * use BT.709 coefficients; SD planes use BT.601, matching FFmpeg's decoder.
+ */
+export function pgsPaletteEntryToRGBA(
+  y: number,
+  cr: number,
+  cb: number,
+  alpha: number,
+  planeHeight: number,
+): number {
+  const luma = 1.164 * (y - 16);
+  const r = planeHeight > 576 ? luma + 1.793 * (cr - 128) : luma + 1.596 * (cr - 128);
+  const g =
+    planeHeight > 576
+      ? luma - 0.213 * (cb - 128) - 0.533 * (cr - 128)
+      : luma - 0.392 * (cb - 128) - 0.813 * (cr - 128);
+  const b = planeHeight > 576 ? luma + 2.112 * (cb - 128) : luma + 2.017 * (cb - 128);
+  return (clampByte(r) | (clampByte(g) << 8) | (clampByte(b) << 16) | ((alpha & 0xff) << 24)) >>> 0;
+}
+
+/**
+ * Expands an object's run-length encoded bitmap into packed RGBA pixels.
+ * Malformed runs are clipped to the object rather than rejected: a damaged
+ * line should cost that line, not the whole subtitle.
+ */
+export function decodePGSObject(object: PGSPlacedObject): Uint32Array<ArrayBuffer> {
+  const { width, height, rle, palette } = object;
+  const pixels = new Uint32Array(width * height);
+  let x = 0;
+  let y = 0;
+  let i = 0;
+  const put = (color: number, count: number) => {
+    if (y >= height) return;
+    const end = Math.min(width, x + count);
+    if (end > x) pixels.fill(palette[color] ?? 0, y * width + x, y * width + end);
+    x += count;
+  };
+  while (i < rle.length && y < height) {
+    const first = rle[i++]!;
+    if (first !== 0) {
+      put(first, 1);
+      continue;
+    }
+    if (i >= rle.length) break;
+    const flags = rle[i++]!;
+    if (flags === 0) {
+      x = 0;
+      y += 1;
+      continue;
+    }
+    let length = flags & 0x3f;
+    if (flags & 0x40) {
+      if (i >= rle.length) break;
+      length = (length << 8) | rle[i++]!;
+    }
+    let color = 0;
+    if (flags & 0x80) {
+      if (i >= rle.length) break;
+      color = rle[i++]!;
+    }
+    put(color, length);
+  }
+  return pixels;
+}
+
+function concat(chunks: Uint8Array[], total: number): Uint8Array {
+  // Always a copy: a view into the network chunk would keep the whole chunk
+  // alive for as long as the timeline holds this object.
+  if (chunks.length === 1 && chunks[0]!.byteLength === total) return chunks[0]!.slice();
+  const out = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    out.set(chunk.subarray(0, Math.min(chunk.byteLength, total - offset)), offset);
+    offset += chunk.byteLength;
+    if (offset >= total) break;
+  }
+  return out;
+}
+
+/**
+ * Incremental `.sup` parser. Feed it bytes as they arrive with {@link push};
+ * it returns the compositions completed by that chunk, in stream order.
+ *
+ * Bytes that do not start with the `PG` magic are skipped one at a time until
+ * the next segment boundary, so a window that starts mid-segment or a damaged
+ * stretch costs only the affected display set.
+ */
+export class PGSStreamParser {
+  private buffer = new Uint8Array(0);
+  private palettes = new Map<number, Uint32Array>();
+  // Palettes a finished screen holds. Only these are copied before an update.
+  private shownPalettes = new WeakSet<Uint32Array>();
+  private objects = new Map<number, ObjectDefinition>();
+  // Objects whose fragments are still arriving, by ID: one object's fragments
+  // may be interleaved with another's. Their bytes share the epoch's budget.
+  private pendingObjects = new Map<number, PendingObject>();
+  private pendingBytes = 0;
+  private presentation: PresentationSegment | null = null;
+  private received = -Infinity;
+  private objectBytes = 0;
+  private windowCompositions = 0;
+  private windowObjectBytes = 0;
+  // Object data already counted against a window, so a screen placed again
+  // doesn't count it twice.
+  private countedObjects = new WeakSet<Uint8Array>();
+
+  /**
+   * Source time, in seconds, of the latest complete segment read. Segments
+   * arrive in time order, so nothing before this point is still to come.
+   */
+  get receivedUntil(): number {
+    return this.received;
+  }
+
+  /**
+   * Discards partial input before the stream continues from another window.
+   * Palettes and objects stay, so a window that resumes an epoch can still
+   * draw screens that place objects defined in the window before it.
+   */
+  resetBuffer(): void {
+    this.buffer = new Uint8Array(0);
+    this.clearPending();
+    this.presentation = null;
+    this.windowCompositions = 0;
+    this.windowObjectBytes = 0;
+  }
+
+  push(chunk: Uint8Array): PGSComposition[] {
+    if (chunk.byteLength > 0) {
+      const merged = new Uint8Array(this.buffer.byteLength + chunk.byteLength);
+      merged.set(this.buffer, 0);
+      merged.set(chunk, this.buffer.byteLength);
+      this.buffer = merged;
+    }
+    const completed: PGSComposition[] = [];
+    let offset = 0;
+    const bytes = this.buffer;
+    const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+    while (offset + SEGMENT_HEADER_BYTES <= bytes.byteLength) {
+      if (bytes[offset] !== 0x50 || bytes[offset + 1] !== 0x47) {
+        offset += 1;
+        continue;
+      }
+      const pts = view.getUint32(offset + 2);
+      const type = bytes[offset + 10]!;
+      const size = view.getUint16(offset + 11);
+      const end = offset + SEGMENT_HEADER_BYTES + size;
+      if (end > bytes.byteLength) break;
+      const body = bytes.subarray(offset + SEGMENT_HEADER_BYTES, end);
+      this.received = Math.max(this.received, pts / PGS_TIMESCALE);
+      const composition = this.handleSegment(type, pts, body);
+      if (composition) completed.push(composition);
+      offset = end;
+    }
+    this.buffer = bytes.slice(offset);
+    return completed;
+  }
+
+  private handleSegment(type: number, pts: number, body: Uint8Array): PGSComposition | null {
+    switch (type) {
+      case SEGMENT_PCS:
+        this.readPresentation(pts, body);
+        return null;
+      case SEGMENT_PDS:
+        this.readPalette(body);
+        return null;
+      case SEGMENT_ODS:
+        this.readObject(body);
+        return null;
+      case SEGMENT_WDS:
+        // Windows bound where objects may draw; placements already carry their
+        // own coordinates, so nothing here changes what is rendered.
+        return null;
+      case SEGMENT_END:
+        return this.finishDisplaySet();
+      default:
+        return null;
+    }
+  }
+
+  private readPresentation(pts: number, body: Uint8Array): void {
+    if (body.byteLength < 11) {
+      this.presentation = null;
+      return;
+    }
+    const view = new DataView(body.buffer, body.byteOffset, body.byteLength);
+    const width = view.getUint16(0);
+    const height = view.getUint16(2);
+    const state = body[7]!;
+    const paletteId = body[9]!;
+    const count = body[10]!;
+    // Epoch starts and acquisition points both carry every definition their
+    // screen needs, so a decoder resets at either (as FFmpeg's does).
+    if (state & (COMPOSITION_EPOCH_START | COMPOSITION_ACQUISITION_POINT)) {
+      this.palettes.clear();
+      this.objects.clear();
+      this.objectBytes = 0;
+      this.clearPending();
+    }
+    const objects: CompositionReference[] = [];
+    let offset = 11;
+    const placed = Math.min(count, MAX_OBJECTS_PER_COMPOSITION);
+    for (let n = 0; n < placed && offset + 8 <= body.byteLength; n++) {
+      const objectId = view.getUint16(offset);
+      const flags = body[offset + 3]!;
+      const x = view.getUint16(offset + 4);
+      const y = view.getUint16(offset + 6);
+      offset += 8;
+      let crop: PGSCrop | null = null;
+      if (flags & OBJECT_CROPPED) {
+        if (offset + 8 > body.byteLength) break;
+        crop = {
+          x: view.getUint16(offset),
+          y: view.getUint16(offset + 2),
+          width: view.getUint16(offset + 4),
+          height: view.getUint16(offset + 6),
+        };
+        offset += 8;
+      }
+      objects.push({ objectId, x, y, crop, forced: (flags & OBJECT_FORCED) !== 0 });
+    }
+    this.presentation = { pts, width, height, paletteId, objects };
+  }
+
+  private readPalette(body: Uint8Array): void {
+    if (body.byteLength < 2) return;
+    const id = body[0]!;
+    const planeHeight = this.presentation?.height ?? 1080;
+    // Copy on write so a later update cannot recolor a screen already
+    // finished, but only once per screen: a palette no screen holds yet is
+    // updated in place, so a burst of palette segments allocates nothing.
+    let palette = this.palettes.get(id) ?? new Uint32Array(256);
+    if (this.shownPalettes.has(palette)) palette = new Uint32Array(palette);
+    for (let offset = 2; offset + 5 <= body.byteLength; offset += 5) {
+      const entry = body[offset]!;
+      palette[entry] = pgsPaletteEntryToRGBA(
+        body[offset + 1]!,
+        body[offset + 2]!,
+        body[offset + 3]!,
+        body[offset + 4]!,
+        planeHeight,
+      );
+    }
+    this.palettes.set(id, palette);
+  }
+
+  private readObject(body: Uint8Array): void {
+    if (body.byteLength < 4) return;
+    const view = new DataView(body.buffer, body.byteOffset, body.byteLength);
+    const id = view.getUint16(0);
+    const sequence = body[3]!;
+    let pending: PendingObject | undefined;
+    let data: Uint8Array;
+    if (sequence & ODS_FIRST_IN_SEQUENCE) {
+      if (body.byteLength < 11) return;
+      // The 24-bit length counts the width and height fields that follow it.
+      const expectedBytes = Math.max(0, ((body[4]! << 16) | (body[5]! << 8) | body[6]!) - 4);
+      this.dropPending(id);
+      pending = {
+        width: view.getUint16(7),
+        height: view.getUint16(9),
+        expectedBytes,
+        chunks: [],
+        receivedBytes: 0,
+        fragments: 0,
+      };
+      this.pendingObjects.set(id, pending);
+      data = body.subarray(11);
+    } else {
+      pending = this.pendingObjects.get(id);
+      if (!pending) return;
+      data = body.subarray(4);
+    }
+    pending.fragments += 1;
+    if (pending.fragments > MAX_OBJECT_FRAGMENTS) {
+      this.dropPending(id);
+      return;
+    }
+    // An empty fragment adds nothing to the object, only bookkeeping.
+    if (data.byteLength > 0) pending.chunks.push(data);
+    pending.receivedBytes += data.byteLength;
+    this.pendingBytes += data.byteLength;
+    if (this.pendingBytes > MAX_EPOCH_OBJECT_BYTES) {
+      this.dropPending(id);
+      return;
+    }
+    if (sequence & ODS_LAST_IN_SEQUENCE || pending.receivedBytes >= pending.expectedBytes) {
+      this.dropPending(id);
+      const total = Math.min(pending.receivedBytes, pending.expectedBytes || pending.receivedBytes);
+      // A redefinition replaces the old object, so its bytes stop counting.
+      // Past the limit the old one is dropped too rather than drawn stale.
+      this.objectBytes -= this.objects.get(id)?.rle.byteLength ?? 0;
+      this.objects.delete(id);
+      if (this.objectBytes + total > MAX_EPOCH_OBJECT_BYTES) return;
+      this.objects.set(id, {
+        width: pending.width,
+        height: pending.height,
+        rle: concat(pending.chunks, total),
+      });
+      this.objectBytes += total;
+    }
+  }
+
+  private dropPending(id: number): void {
+    const pending = this.pendingObjects.get(id);
+    if (!pending) return;
+    this.pendingBytes -= pending.receivedBytes;
+    this.pendingObjects.delete(id);
+  }
+
+  private clearPending(): void {
+    this.pendingObjects.clear();
+    this.pendingBytes = 0;
+  }
+
+  private finishDisplaySet(): PGSComposition | null {
+    const presentation = this.presentation;
+    this.presentation = null;
+    if (!presentation) return null;
+    const palette = this.palettes.get(presentation.paletteId);
+    if (!palette && presentation.objects.length > 0) return null;
+    const objects: PGSPlacedObject[] = [];
+    let pixels = 0;
+    for (const reference of presentation.objects) {
+      const definition = this.objects.get(reference.objectId);
+      if (!definition) return null;
+      if (definition.width === 0 || definition.height === 0) continue;
+      pixels += definition.width * definition.height;
+      if (pixels > MAX_COMPOSITION_PIXELS) return null;
+      objects.push({
+        x: reference.x,
+        y: reference.y,
+        crop: reference.crop,
+        forced: reference.forced,
+        width: definition.width,
+        height: definition.height,
+        rle: definition.rle,
+        // readPalette copies on write, so a later palette-only update cannot
+        // recolor this screen.
+        palette: palette!,
+      });
+    }
+    if (this.windowCompositions >= MAX_COMPOSITIONS_PER_WINDOW) return null;
+    const newObjects = objects.filter((object) => !this.countedObjects.has(object.rle));
+    const newBytes = newObjects.reduce((sum, object) => sum + object.rle.byteLength, 0);
+    if (this.windowObjectBytes + newBytes > MAX_WINDOW_OBJECT_BYTES) return null;
+    for (const object of newObjects) this.countedObjects.add(object.rle);
+    this.windowObjectBytes += newBytes;
+    this.windowCompositions += 1;
+    if (palette) this.shownPalettes.add(palette);
+    return {
+      start: presentation.pts / PGS_TIMESCALE,
+      width: presentation.width,
+      height: presentation.height,
+      objects,
+    };
+  }
+}
+
+/**
+ * Index of the composition on screen at `time`: the last one starting at or
+ * before it. Returns -1 before the first composition.
+ */
+export function pgsCompositionIndexAt(
+  compositions: readonly PGSComposition[],
+  time: number,
+): number {
+  let low = 0;
+  let high = compositions.length - 1;
+  let found = -1;
+  while (low <= high) {
+    const mid = (low + high) >> 1;
+    if (compositions[mid]!.start <= time) {
+      found = mid;
+      low = mid + 1;
+    } else {
+      high = mid - 1;
+    }
+  }
+  return found;
+}
+
+/**
+ * The composition on screen at `time`, or null before the first one and past
+ * `loadedUntil`: the clear that ends the last loaded screen may sit in a
+ * window that has not arrived, so that screen must not stay up indefinitely.
+ */
+export function pgsCompositionAt(
+  compositions: readonly PGSComposition[],
+  time: number,
+  loadedUntil: number,
+): PGSComposition | null {
+  if (time > loadedUntil) return null;
+  const index = pgsCompositionIndexAt(compositions, time);
+  return index >= 0 ? compositions[index]! : null;
+}
+
+/**
+ * Drops compositions that ended before `keepFrom`, keeping the one still on
+ * screen there, so a long track does not hold every screen it has shown.
+ */
+export function prunePGSTimeline(timeline: PGSComposition[], keepFrom: number): PGSComposition[] {
+  const index = pgsCompositionIndexAt(timeline, keepFrom);
+  return index > 0 ? timeline.slice(index) : timeline;
+}
+
+/**
+ * Merges newly parsed compositions into a start-ordered timeline, dropping
+ * repeats. Overlapping fetch windows deliver the same display sets twice; a
+ * repeat starts at the same instant, and the copy already in the timeline
+ * wins because its window parsed the epoch in order.
+ */
+export function mergePGSCompositions(
+  timeline: PGSComposition[],
+  incoming: readonly PGSComposition[],
+): PGSComposition[] {
+  if (incoming.length === 0) return timeline;
+  const byStart = new Map<number, PGSComposition>();
+  for (const composition of timeline) byStart.set(composition.start, composition);
+  for (const composition of incoming) {
+    if (!byStart.has(composition.start)) byStart.set(composition.start, composition);
+  }
+  return Array.from(byStart.values()).sort((a, b) => a.start - b.start);
+}
diff --git a/web/src/player/utils/playbackSpeed.ts b/web/src/player/utils/playbackSpeed.ts
new file mode 100644
index 0000000000..bb0c9db90f
--- /dev/null
+++ b/web/src/player/utils/playbackSpeed.ts
@@ -0,0 +1,6 @@
+/** The speeds the iOS, macOS, and Android phone players offer. */
+export const PLAYBACK_SPEEDS = [0.5, 0.75, 1, 1.25, 1.5, 1.75, 2, 2.5, 3] as const;
+
+export function formatPlaybackSpeed(rate: number): string {
+  return `${rate}×`;
+}
diff --git a/web/src/player/utils/roomClock.test.ts b/web/src/player/utils/roomClock.test.ts
new file mode 100644
index 0000000000..18bd515f20
--- /dev/null
+++ b/web/src/player/utils/roomClock.test.ts
@@ -0,0 +1,78 @@
+// @vitest-environment node
+
+import { describe, expect, it } from "vitest";
+import {
+  addRoomClockSample,
+  roomClockOffsetMs,
+  roomClockPingDelayMs,
+  roomClockSample,
+  type RoomClockSample,
+} from "./roomClock";
+
+describe("roomClockSample", () => {
+  it("excludes server processing time from the round trip", () => {
+    // Server clock 1 s ahead, 40 ms each way, 20 ms spent on the server.
+    expect(roomClockSample(0, 1_040, 1_060, 100)).toEqual({ rttMs: 80, offsetMs: 1_000 });
+  });
+
+  it("drops round trips that are negative or longer than five seconds", () => {
+    expect(roomClockSample(1_000, 2_000, 2_500, 1_200)).toBeNull();
+    expect(roomClockSample(1_000, 2_000, 2_003, 1_000)).toBeNull();
+    expect(roomClockSample(0, 0, 0, 5_001)).toBeNull();
+    expect(roomClockSample(0, 0, 0, 5_000)).toEqual({ rttMs: 5_000, offsetMs: -2_500 });
+    expect(roomClockSample(Number.NaN, 0, 0, 10)).toBeNull();
+  });
+
+  it("counts a round trip lost to millisecond truncation as zero", () => {
+    // Each timestamp truncates up to 1 ms, so a LAN exchange can read -2 ms.
+    expect(roomClockSample(1_000, 2_000, 2_002, 1_000)).toEqual({ rttMs: 0, offsetMs: 1_001 });
+  });
+});
+
+describe("roomClockOffsetMs", () => {
+  const sample = (rttMs: number, offsetMs: number): RoomClockSample => ({ rttMs, offsetMs });
+
+  it("uses the minimum-RTT sample, not the latest", () => {
+    let samples: RoomClockSample[] = [];
+    expect(roomClockOffsetMs(samples)).toBeNull();
+    samples = addRoomClockSample(samples, sample(300, 900));
+    samples = addRoomClockSample(samples, sample(40, 1_000));
+    samples = addRoomClockSample(samples, sample(600, 1_250));
+    expect(roomClockOffsetMs(samples)).toBe(1_000);
+  });
+
+  it("forgets the best sample once eight newer ones arrive", () => {
+    let samples = addRoomClockSample([], sample(10, 1_000));
+    for (let i = 0; i < 7; i++) samples = addRoomClockSample(samples, sample(100 + i, 1_020 + i));
+    expect(roomClockOffsetMs(samples)).toBe(1_000);
+    samples = addRoomClockSample(samples, sample(200, 1_040));
+    expect(samples).toHaveLength(8);
+    expect(roomClockOffsetMs(samples)).toBe(1_020);
+  });
+
+  it("starts over when a sample shows the clock stepped", () => {
+    let samples = addRoomClockSample([], sample(20, 1_000));
+    samples = addRoomClockSample(samples, sample(300, 1_150));
+    // Within both half round trips plus slack: the same clock.
+    expect(roomClockOffsetMs(samples)).toBe(1_000);
+    expect(samples).toHaveLength(2);
+    // 40 ms round trips cannot both be right 200 ms apart: the clock moved,
+    // and the slower new sample still wins over the stale fast one.
+    samples = addRoomClockSample(samples, sample(40, 1_200));
+    expect(samples).toEqual([sample(40, 1_200)]);
+    expect(roomClockOffsetMs(samples)).toBe(1_200);
+  });
+
+  it("prefers the newer of two equally fast samples", () => {
+    const samples = addRoomClockSample([sample(50, 1_000)], sample(50, 1_010));
+    expect(roomClockOffsetMs(samples)).toBe(1_010);
+  });
+});
+
+describe("roomClockPingDelayMs", () => {
+  it("pings every 2 s until a connection has four samples, then every 15 s", () => {
+    expect([0, 1, 2, 3, 4, 9].map(roomClockPingDelayMs)).toEqual([
+      2_000, 2_000, 2_000, 2_000, 15_000, 15_000,
+    ]);
+  });
+});
diff --git a/web/src/player/utils/roomClock.ts b/web/src/player/utils/roomClock.ts
new file mode 100644
index 0000000000..ef3f462a6e
--- /dev/null
+++ b/web/src/player/utils/roomClock.ts
@@ -0,0 +1,104 @@
+/**
+ * Server clock estimation for a watch-together room. Each ping/pong exchange
+ * yields one sample; the offset in use comes from the sample with the lowest
+ * round trip, whose midpoint estimate has the least room for asymmetric delay.
+ * Server time = local time + offset.
+ */
+
+/** Samples kept, newest last. */
+export const roomClockMaxSamples = 8;
+/** A round trip longer than this says more about the network than the clock. */
+export const roomClockMaxRttMs = 5_000;
+/**
+ * Timestamps carry whole milliseconds, so a LAN round trip can come out a
+ * little negative. Down to this much it counts as zero; below, it is a clock step.
+ */
+export const roomClockRttTruncationMs = 2;
+/**
+ * Slack on top of two samples' half round trips before their offsets are
+ * taken to disagree, which means the local or server clock stepped.
+ */
+export const roomClockStepToleranceMs = 50;
+/** Pings come this often until a connection has `roomClockFastSamples` samples. */
+export const roomClockFastPingMs = 2_000;
+export const roomClockFastSamples = 4;
+/** Ping cadence once the estimate has settled. */
+export const roomClockSlowPingMs = 15_000;
+
+export interface RoomClockSample {
+  rttMs: number;
+  offsetMs: number;
+}
+
+/**
+ * The sample one pong yields, or null when the timestamps are unusable or the
+ * round trip is negative (clock steps) or longer than `roomClockMaxRttMs`.
+ */
+export function roomClockSample(
+  clientSentMs: number,
+  serverReceivedMs: number,
+  serverSentMs: number,
+  clientReceivedMs: number,
+): RoomClockSample | null {
+  if (
+    !Number.isFinite(clientSentMs) ||
+    !Number.isFinite(serverReceivedMs) ||
+    !Number.isFinite(serverSentMs) ||
+    !Number.isFinite(clientReceivedMs)
+  ) {
+    return null;
+  }
+  let rttMs = clientReceivedMs - clientSentMs - (serverSentMs - serverReceivedMs);
+  if (rttMs < 0 && rttMs >= -roomClockRttTruncationMs) rttMs = 0;
+  if (rttMs < 0 || rttMs > roomClockMaxRttMs) return null;
+  const offsetMs = (serverReceivedMs - clientSentMs + (serverSentMs - clientReceivedMs)) / 2;
+  return { rttMs, offsetMs };
+}
+
+/**
+ * `samples` with `sample` appended, keeping the newest `roomClockMaxSamples`.
+ * Each sample bounds the true offset to within half its round trip. When the
+ * new sample and the current best cannot both be right, a clock moved: the
+ * older samples describe a clock that no longer exists and are dropped.
+ */
+export function addRoomClockSample(
+  samples: readonly RoomClockSample[],
+  sample: RoomClockSample,
+): RoomClockSample[] {
+  if (roomClockStepped(samples, sample)) return [sample];
+  return [...samples, sample].slice(-roomClockMaxSamples);
+}
+
+/** Whether `sample` and the best of `samples` cannot both be right: a clock stepped. */
+export function roomClockStepped(
+  samples: readonly RoomClockSample[],
+  sample: RoomClockSample,
+): boolean {
+  const best = bestRoomClockSample(samples);
+  return (
+    best !== null &&
+    Math.abs(sample.offsetMs - best.offsetMs) >
+      (sample.rttMs + best.rttMs) / 2 + roomClockStepToleranceMs
+  );
+}
+
+/**
+ * The offset of the minimum-RTT sample, or null without samples. Among equal
+ * round trips the newest wins, since clocks drift.
+ */
+export function roomClockOffsetMs(samples: readonly RoomClockSample[]): number | null {
+  return bestRoomClockSample(samples)?.offsetMs ?? null;
+}
+
+function bestRoomClockSample(samples: readonly RoomClockSample[]): RoomClockSample | null {
+  let best: RoomClockSample | null = null;
+  for (const sample of samples) {
+    if (best === null || sample.rttMs <= best.rttMs) best = sample;
+  }
+  return best;
+}
+
+/** Delay before the next ping, given the samples this connection has taken. */
+export function roomClockPingDelayMs(connectionSamples: number): number {
+  return connectionSamples < roomClockFastSamples ? roomClockFastPingMs : roomClockSlowPingMs;
+}
diff --git a/web/src/player/utils/roomSyncCatchup.test.ts b/web/src/player/utils/roomSyncCatchup.test.ts
index 5a670f3df3..98decd4c2e 100644
--- a/web/src/player/utils/roomSyncCatchup.test.ts
+++ b/web/src/player/utils/roomSyncCatchup.test.ts
@@ -5,22 +5,29 @@ import {
   abandonRoomReload,
   beginRoomReload,
   createRoomReloadBudget,
-  decideRoomCatchup,
+  createRoomSeekCorrector,
+  decideRoomCommand,
+  expireRoomReload,
   isNativePositionInRanges,
   landRoomReload,
+  nextRoomNudgeRate,
+  noteRoomCorrectorSeek,
   noteRoomReloadLoading,
-  roomCatchupBandSeconds,
-  roomCatchupConverged,
-  roomCatchupDeadbandSeconds,
-  roomCatchupMaxRate,
-  roomCatchupMinRate,
+  observeRoomCorrector,
+  roomCorrectorSeekDue,
+  roomCorrectorSeekTarget,
+  roomLoopSeekDue,
   roomMembersLeftBehind,
+  roomPositionAt,
+  roomReloadInFlight,
+  roomSeekAlreadyPending,
   roomReloadAllowed,
   roomReloadLanded,
   roomReloadMaxIntervalMs,
   roomReloadMaxLeadSeconds,
   roomReloadMinIntervalMs,
   roomReloadStaleMs,
+  roomSyncNudgeRate,
   settleRoomReloads,
 } from "./roomSyncCatchup";
 
@@ -46,63 +53,297 @@ describe("isNativePositionInRanges", () => {
   });
 });
 
-describe("decideRoomCatchup", () => {
+describe("roomPositionAt", () => {
+  const reference = { positionSeconds: 100, executeAtServerMs: 10_000, playing: true };
+
+  it("advances a playing reference from execute_at on the server clock", () => {
+    // Local 8 s is server 10 s with a +2 s offset: execution has just happened.
+    expect(roomPositionAt(reference, 8_000, 2_000)).toBe(100);
+    expect(roomPositionAt(reference, 11_000, 2_000)).toBe(103);
+    // Before execution the room has not moved past the command's position.
+    expect(roomPositionAt(reference, 5_000, 2_000)).toBe(100);
+  });
+
+  it("holds a paused or waiting reference in place", () => {
+    expect(roomPositionAt({ ...reference, playing: false }, 60_000, 0)).toBe(100);
+  });
+});
+
+describe("roomSyncNudgeRate", () => {
+  it.each([
+    // Below the gain floor the minimum 1 % nudge applies.
+    [0.1, 1.01],
+    [-0.1, 0.99],
+    // In between, |d| / 25, quantized to 0.005.
+    [0.5, 1.02],
+    [0.4, 1.015],
+    [-0.6, 0.975],
+    // The 4 % cap holds however far off the viewer is.
+    [1, 1.04],
+    [-30, 0.96],
+  ])("plays %ss of drift at %sx", (drift, rate) => {
+    expect(roomSyncNudgeRate(drift)).toBe(rate);
+  });
+
+  it("stays on 0.005 steps inside the 1-4 % band", () => {
+    for (let drift = -6; drift <= 6; drift += 0.037) {
+      const rate = roomSyncNudgeRate(drift);
+      expect(Math.abs(rate - 1)).toBeGreaterThanOrEqual(0.01 - 1e-9);
+      expect(Math.abs(rate - 1)).toBeLessThanOrEqual(0.04 + 1e-9);
+      expect(Math.round(rate * 200)).toBeCloseTo(rate * 200, 9);
+      expect(Math.sign(rate - 1)).toBe(Math.sign(drift));
+    }
+  });
+});
+
+describe("nextRoomNudgeRate", () => {
+  it("starts a nudge only above the deadband", () => {
+    expect(nextRoomNudgeRate(0.4, false)).toBe(1);
+    expect(nextRoomNudgeRate(-0.4, false)).toBe(1);
+    expect(nextRoomNudgeRate(0.45, false)).toBeGreaterThan(1);
+    expect(nextRoomNudgeRate(-0.45, false)).toBeLessThan(1);
+  });
+
+  it("keeps a running nudge until the drift settles", () => {
+    // Inside the deadband a nudge that is already running keeps going.
+    expect(nextRoomNudgeRate(0.3, true)).toBe(1.01);
+    expect(nextRoomNudgeRate(-0.2, true)).toBe(0.99);
+    expect(nextRoomNudgeRate(0.1, true)).toBe(1);
+    expect(nextRoomNudgeRate(-0.05, true)).toBe(1);
+  });
+
+  it("follows a drift that crosses the room position instead of overshooting", () => {
+    expect(nextRoomNudgeRate(-0.2, true)).toBeLessThan(1);
+  });
+
+  it("never exceeds the cap for drift the server has to correct", () => {
+    expect(nextRoomNudgeRate(12, false)).toBe(1.04);
+    expect(nextRoomNudgeRate(-12, true)).toBe(0.96);
+  });
+});
+
+describe("decideRoomCommand", () => {
   const base = {
     targetPositionSeconds: 100,
     localPositionSeconds: 100,
-    targetLocallySeekable: false,
+    localPlaying: true,
+    rateCapable: true,
+    targetLocallySeekable: true,
   };
+  const at = (offset: number) => base.targetPositionSeconds - offset;
 
-  it("does nothing when playback already matches the room", () => {
+  it("always seeks to a room seek", () => {
+    expect(decideRoomCommand({ ...base, action: "seek" })).toEqual({ kind: "seek" });
     expect(
-      decideRoomCatchup({
+      decideRoomCommand({
         ...base,
-        action: "play",
-        localPositionSeconds: base.targetPositionSeconds - roomCatchupDeadbandSeconds,
+        action: "seek",
+        localPlaying: false,
+        targetLocallySeekable: false,
       }),
-    ).toEqual({ kind: "none" });
+    ).toEqual({ kind: "seek" });
+  });
+
+  describe("play for a playing viewer", () => {
+    it("leaves drift within the deadband alone", () => {
+      expect(
+        decideRoomCommand({ ...base, action: "play", localPositionSeconds: at(0.375) }),
+      ).toEqual({
+        kind: "none",
+      });
+    });
+
+    it.each([true, false])(
+      "nudges up to the hard-seek bound even when seekable is %s",
+      (targetLocallySeekable) => {
+        expect(
+          decideRoomCommand({
+            ...base,
+            action: "play",
+            targetLocallySeekable,
+            localPositionSeconds: at(5),
+          }),
+        ).toEqual({ kind: "rate", rate: 1.04 });
+        expect(
+          decideRoomCommand({
+            ...base,
+            action: "play",
+            targetLocallySeekable,
+            localPositionSeconds: at(-0.5),
+          }),
+        ).toEqual({ kind: "rate", rate: 0.98 });
+      },
+    );
+
+    it("seeks beyond the hard-seek bound", () => {
+      expect(
+        decideRoomCommand({
+          ...base,
+          action: "play",
+          targetLocallySeekable: false,
+          localPositionSeconds: at(5.1),
+        }),
+      ).toEqual({ kind: "seek" });
+    });
+  });
+
+  describe.each(["play", "pause"] as const)("%s for a viewer that is not playing", (action) => {
+    const stopped = { ...base, action, localPlaying: false };
+
+    it("seeks a moderate drift only when the target is reachable in place", () => {
+      expect(decideRoomCommand({ ...stopped, localPositionSeconds: at(1.1) })).toEqual({
+        kind: "seek",
+      });
+      expect(
+        decideRoomCommand({
+          ...stopped,
+          targetLocallySeekable: false,
+          localPositionSeconds: at(-4.9),
+        }),
+      ).toEqual({ kind: "none" });
+      expect(decideRoomCommand({ ...stopped, localPositionSeconds: at(1) })).toEqual({
+        kind: "none",
+      });
+    });
+
+    it("seeks beyond the hard-seek bound even through a rebuild", () => {
+      expect(
+        decideRoomCommand({
+          ...stopped,
+          targetLocallySeekable: false,
+          localPositionSeconds: at(-5.1),
+        }),
+      ).toEqual({ kind: "seek" });
+    });
+  });
+
+  it("never nudges a pause, even for a viewer still playing", () => {
+    expect(decideRoomCommand({ ...base, action: "pause", localPositionSeconds: at(0.8) })).toEqual({
+      kind: "none",
+    });
+  });
+});
+
+describe("decideRoomCommand without pitch-kept rate changes", () => {
+  const playing = {
+    action: "play" as const,
+    targetPositionSeconds: 100,
+    localPlaying: true,
+    rateCapable: false,
+    targetLocallySeekable: true,
+  };
+
+  it("never nudges", () => {
+    expect(decideRoomCommand({ ...playing, localPositionSeconds: 99.5 })).toEqual({
+      kind: "none",
+    });
+    expect(decideRoomCommand({ ...playing, localPositionSeconds: 99 })).toEqual({ kind: "none" });
+  });
+
+  it("seeks in place above one second", () => {
+    expect(decideRoomCommand({ ...playing, localPositionSeconds: 101.1 })).toEqual({
+      kind: "seek",
+    });
+  });
+
+  it("loads media only beyond the hard-seek bound", () => {
+    const unseekable = { ...playing, targetLocallySeekable: false };
+    expect(decideRoomCommand({ ...unseekable, localPositionSeconds: 96 })).toEqual({
+      kind: "none",
+    });
+    expect(decideRoomCommand({ ...unseekable, localPositionSeconds: 94.9 })).toEqual({
+      kind: "seek",
+    });
   });
 
-  it("never rebuilds a stream to park a paused member", () => {
+  it("treats a stopped viewer like any other client", () => {
     expect(
-      decideRoomCatchup({
-        ...base,
-        action: "pause",
-        localPositionSeconds: base.targetPositionSeconds - roomCatchupBandSeconds - 30,
+      decideRoomCommand({
+        ...playing,
+        localPlaying: false,
+        targetLocallySeekable: false,
+        localPositionSeconds: 97,
       }),
     ).toEqual({ kind: "none" });
   });
+});
 
-  it("caps the convergence rate at the band edge", () => {
-    expect(
-      decideRoomCatchup({
-        ...base,
-        action: "play",
-        localPositionSeconds: base.targetPositionSeconds - roomCatchupBandSeconds,
-      }),
-    ).toEqual({ kind: "rate", rate: roomCatchupMaxRate });
+describe("roomLoopSeekDue", () => {
+  it("seeks only drift beyond one second that the element reaches in place", () => {
+    expect(roomLoopSeekDue(1, true)).toBe(false);
+    expect(roomLoopSeekDue(-1.2, true)).toBe(true);
+    expect(roomLoopSeekDue(30, false)).toBe(false);
   });
+});
 
-  it("clamps ahead drift to the slowest convergence rate", () => {
-    expect(
-      decideRoomCatchup({
-        ...base,
-        action: "play",
-        localPositionSeconds: base.targetPositionSeconds + 1,
-      }),
-    ).toEqual({ kind: "rate", rate: roomCatchupMinRate });
+describe("seek-based drift correction", () => {
+  it("aims the next seek ahead by what the last one fell short", () => {
+    const corrector = createRoomSeekCorrector();
+    noteRoomCorrectorSeek(corrector, 0);
+    observeRoomCorrector(corrector, 2);
+    expect(roomCorrectorSeekTarget(corrector, 100)).toBe(102);
+    // Landing past the room takes some of the lead back, never below none.
+    noteRoomCorrectorSeek(corrector, 0);
+    observeRoomCorrector(corrector, -0.5);
+    expect(roomCorrectorSeekTarget(corrector, 100)).toBe(101.5);
+    noteRoomCorrectorSeek(corrector, 0);
+    observeRoomCorrector(corrector, -4);
+    expect(corrector.leadSeconds).toBe(0);
+  });
+
+  it("caps the lead", () => {
+    const corrector = createRoomSeekCorrector();
+    for (let i = 0; i < 3; i++) {
+      noteRoomCorrectorSeek(corrector, 0);
+      observeRoomCorrector(corrector, 2);
+    }
+    expect(corrector.leadSeconds).toBe(3);
+  });
+
+  it("doubles the wait after each miss up to 16 s and resets once a seek converges", () => {
+    const corrector = createRoomSeekCorrector();
+    const waits: number[] = [];
+    for (let i = 0; i < 6; i++) {
+      noteRoomCorrectorSeek(corrector, 0);
+      observeRoomCorrector(corrector, 1.5);
+      waits.push(corrector.intervalMs);
+    }
+    expect(waits).toEqual([2_000, 4_000, 8_000, 16_000, 16_000, 16_000]);
+    noteRoomCorrectorSeek(corrector, 0);
+    observeRoomCorrector(corrector, 0.3);
+    expect(corrector.intervalMs).toBe(1_000);
+  });
+
+  it("measures each seek once, and spaces seeks by the current wait", () => {
+    const corrector = createRoomSeekCorrector();
+    expect(roomCorrectorSeekDue(corrector, 1.5, true, 0)).toBe(true);
+    expect(roomCorrectorSeekDue(corrector, 1.5, false, 0)).toBe(false);
+    noteRoomCorrectorSeek(corrector, 10_000);
+    observeRoomCorrector(corrector, 1.5);
+    // Later ticks of the same landing are not new measurements.
+    observeRoomCorrector(corrector, 1.5);
+    expect(corrector.intervalMs).toBe(2_000);
+    expect(corrector.leadSeconds).toBe(1.5);
+    expect(roomCorrectorSeekDue(corrector, 1.5, true, 11_999)).toBe(false);
+    expect(roomCorrectorSeekDue(corrector, 1.5, true, 12_000)).toBe(true);
   });
 });
 
-describe("room catch-up convergence", () => {
-  const target = { positionSeconds: 100, executeAtMs: 1_000 };
+describe("roomSeekAlreadyPending", () => {
+  const issued = { targetSeconds: 100, issuedAtMs: 1_000, commandId: "c1" };
+
+  it("recognizes a repeat of a room seek that is still loading", () => {
+    expect(roomSeekAlreadyPending(issued, 100, 100.8, 2_000)).toBe(true);
+    expect(roomSeekAlreadyPending(issued, 100, 101.5, 2_000)).toBe(false);
+  });
 
-  it("stops a slowed member once the advancing room position reaches it", () => {
-    // A member ahead of the room moves away from the command's static
-    // position; convergence has to come from the advancing position.
-    expect(roomCatchupConverged(target, 102.8, 1_000)).toBe(false);
-    expect(roomCatchupConverged(target, 102.8, 3_000)).toBe(false);
-    expect(roomCatchupConverged(target, 102.8, 3_500)).toBe(true);
+  it("does not mistake a landed, failed, or unrelated seek for it", () => {
+    expect(roomSeekAlreadyPending(issued, null, 100, 2_000)).toBe(false);
+    // A seek the viewer requested and the room has not commanded yet.
+    expect(roomSeekAlreadyPending(null, 100, 100, 2_000)).toBe(false);
+    expect(roomSeekAlreadyPending(issued, 250, 100, 2_000)).toBe(false);
+    // Unfinished for as long as a stale reload: it is not coming.
+    expect(roomSeekAlreadyPending(issued, 100, 100, 1_000 + roomReloadStaleMs)).toBe(false);
   });
 });
 
@@ -149,6 +390,38 @@ describe("room rebuild budget", () => {
     expect(budget.nextAllowedAtMs - now).toBe(roomReloadMinIntervalMs);
   });
 
+  it("counts a reload as in flight only until it goes stale", () => {
+    const budget = createRoomReloadBudget();
+    expect(roomReloadInFlight(budget, 0)).toBe(false);
+    beginRoomReload(budget, 100, 1_000);
+    expect(roomReloadInFlight(budget, 1_000 + roomReloadStaleMs - 1)).toBe(true);
+    expect(roomReloadInFlight(budget, 1_000 + roomReloadStaleMs)).toBe(false);
+  });
+
+  it("lets a replacement start as soon as a stale reload expires", () => {
+    const budget = createRoomReloadBudget();
+    beginRoomReload(budget, 100, 0);
+    noteRoomReloadLoading(budget);
+    const generation = budget.generation;
+    expireRoomReload(budget, roomReloadStaleMs);
+    expect(budget.targetSeconds).toBeNull();
+    expect(budget.generation).toBe(generation + 1);
+    expect(roomReloadAllowed(budget, roomReloadStaleMs)).toBe(true);
+    // The failed attempt still counts toward the next backoff.
+    beginRoomReload(budget, 130, roomReloadStaleMs);
+    landRoomReload(budget, roomReloadStaleMs);
+    expect(budget.nextAllowedAtMs - roomReloadStaleMs).toBe(2 * roomReloadMinIntervalMs);
+  });
+
+  it("leaves a budget without a reload untouched on expiry", () => {
+    const budget = createRoomReloadBudget();
+    beginRoomReload(budget, 100, 0);
+    abandonRoomReload(budget, 1_000);
+    const before = { ...budget };
+    expireRoomReload(budget, 2_000);
+    expect(budget).toEqual(before);
+  });
+
   it("bounds the lead and stops an unlanded rebuild from blocking forever", () => {
     const budget = createRoomReloadBudget();
     beginRoomReload(budget, 100, 0);
diff --git a/web/src/player/utils/roomSyncCatchup.ts b/web/src/player/utils/roomSyncCatchup.ts
index 9165861944..05807ee857 100644
--- a/web/src/player/utils/roomSyncCatchup.ts
+++ b/web/src/player/utils/roomSyncCatchup.ts
@@ -1,68 +1,238 @@
 /**
- * How a watch-together client applies a room transport command's position.
+ * How a watch-together client follows the room position. This is the shared
+ * cross-client algorithm; Apple and Android use the same constants.
  *
- * Small drift between local playback and the room position is absorbed with a
- * playbackRate nudge instead of a seek. On copy-remux deliveries a seek
- * outside the already-downloaded window cannot run inside the current stream:
- * it forces a seek-reanchor replan, which rebuilds the whole stream. Rate
- * convergence keeps the room synced without rebuilding anything. Local files
- * and seek-anywhere routes are unaffected: every position the element can
- * reach without a rebuild stays a seek, exactly as before.
+ * Every transport command carries the room position at its `execute_at`. The
+ * latest applied command for the current selection is the room reference:
+ * while it plays, the room advances at 1x from `execute_at`. Drift is
+ * `room position - local position`, positive when this viewer is behind.
+ *
+ * Small drift is absorbed with a gentle playbackRate nudge (1-4 %) instead of
+ * a seek, so playback never jumps for drift a viewer would not notice. Only a
+ * playing viewer more than HARD_SEEK off the room seeks. A viewer that is not
+ * playing also seeks a smaller drift when the element reaches the target in
+ * place: on copy-remux deliveries a target outside the seekable window forces
+ * a stream rebuild, which is not worth it for a second or two.
  */
 
-/** Drift within this band is corrected by rate instead of rebuilding the stream. */
-export const roomCatchupBandSeconds = 2;
-/** Local playback already matching the room within this bound needs no correction. */
-export const roomCatchupDeadbandSeconds = 0.35;
-/** Bounds for the convergence nudge. */
-export const roomCatchupMinRate = 0.9;
-export const roomCatchupMaxRate = 1.25;
+/** No correction starts below this drift. */
+export const roomSyncDeadbandSeconds = 0.4;
+/** An active rate nudge ends within this drift. */
+export const roomSyncSettleSeconds = 0.1;
+/** Only above this drift does a playing viewer seek. */
+export const roomSyncHardSeekSeconds = 5;
+/** A viewer that is not playing seeks above this drift when it needs no rebuild. */
+export const roomSyncPausedSeekSeconds = 1;
+/** Bounds of the rate nudge, as a fraction of 1x. */
+export const roomSyncRateMinDelta = 0.01;
+export const roomSyncRateMaxDelta = 0.04;
+/** Drift (seconds) that maps to a 1x + 100 % nudge before clamping. */
+export const roomSyncRateGainSeconds = 25;
 /**
- * A 1s deficit plays at ~1.125x and converges in ~8s; the band edge (2s)
- * reaches the cap. Gentle on purpose: this runs during normal playback.
+ * Nudge rates are quantized to 0.005 (1/200) so tiny drift changes do not
+ * churn the element rate. Dividing by the integer keeps rates exact decimals.
  */
-const roomCatchupDivisorSeconds = 8;
-
-export type RoomCatchupDecision =
-  | { kind: "seek" }
-  | { kind: "rate"; rate: number }
-  | { kind: "none" };
+const roomSyncRateStepsPerUnit = 200;
+/** The drift loop leaves playback alone for this long after a command finished. */
+export const roomSyncLoopSettleMs = 1_000;
+/** Drift loop cadence. */
+export const roomSyncLoopIntervalMs = 500;
 
 /**
- * The room position a rate catch-up is converging toward. The room keeps
- * advancing at 1x from the command's execution, so convergence has to track
- * that moving position: against a static one, a member behind the room ends
- * the nudge early, and a member slowed ahead of it never ends it at all.
+ * The room position a command describes: `positionSeconds` at the server's
+ * `executeAtServerMs`, advancing at 1x afterwards while the room plays.
  */
-export interface RoomCatchupTarget {
+export interface RoomPositionReference {
   positionSeconds: number;
-  /** Local wall-clock time (ms) at which `positionSeconds` starts advancing. */
-  executeAtMs: number;
+  /** The command's `execute_at` on the server clock (ms). */
+  executeAtServerMs: number;
+  playing: boolean;
+}
+
+/**
+ * The room's position at local wall-clock `nowMs`, where server time is local
+ * time plus `serverTimeOffsetMs`.
+ */
+export function roomPositionAt(
+  reference: RoomPositionReference,
+  nowMs: number,
+  serverTimeOffsetMs: number,
+): number {
+  if (!reference.playing) return Math.max(0, reference.positionSeconds);
+  const elapsedSeconds = Math.max(
+    0,
+    (nowMs + serverTimeOffsetMs - reference.executeAtServerMs) / 1000,
+  );
+  return Math.max(0, reference.positionSeconds + elapsedSeconds);
+}
+
+/**
+ * The nudge rate for `driftSeconds`: 1 + sign(d) * clamp(|d| / 25, 1 %, 4 %),
+ * quantized to 0.005. Zero drift needs no nudge.
+ */
+export function roomSyncNudgeRate(driftSeconds: number): number {
+  if (driftSeconds === 0 || !Number.isFinite(driftSeconds)) return 1;
+  const delta = Math.min(
+    roomSyncRateMaxDelta,
+    Math.max(roomSyncRateMinDelta, Math.abs(driftSeconds) / roomSyncRateGainSeconds),
+  );
+  // Quantize the magnitude, as the Apple and Android clients do, so a speed-up
+  // and a slow-down for the same drift are mirror images.
+  const steps = Math.round(delta * roomSyncRateStepsPerUnit);
+  return (roomSyncRateStepsPerUnit + Math.sign(driftSeconds) * steps) / roomSyncRateStepsPerUnit;
+}
+
+/**
+ * One step of the continuous drift loop. A nudge starts above the deadband and
+ * runs until the drift is within SETTLE; the gap between the two keeps the
+ * rate from flapping at the deadband edge. Returns the rate to play at, 1 when
+ * no nudge applies. The loop never seeks: drift above HARD_SEEK keeps the
+ * strongest nudge until a server correction arrives.
+ */
+export function nextRoomNudgeRate(driftSeconds: number, nudging: boolean): number {
+  const drift = Math.abs(driftSeconds);
+  if (nudging ? drift <= roomSyncSettleSeconds : drift <= roomSyncDeadbandSeconds) return 1;
+  return roomSyncNudgeRate(driftSeconds);
+}
+
+/**
+ * A correction seek within this of a room seek still loading is the same
+ * correction; issuing it again would reload or rebuild the stream twice.
+ */
+export const roomSeekDuplicateSeconds = 1;
+
+/** A seek room sync issued: where to, when (monotonic ms), and for which command. */
+export interface RoomIssuedSeek {
+  targetSeconds: number;
+  issuedAtMs: number;
+  commandId: string | null;
+}
+
+/**
+ * Whether a seek to `targetSeconds` would repeat the room seek `issued` that
+ * the element has not reached yet (`pendingSeconds` is the position it is
+ * heading to, null once the seek landed or failed). A seek still unfinished
+ * after `roomReloadStaleMs` has failed and is no reason to hold back.
+ */
+export function roomSeekAlreadyPending(
+  issued: RoomIssuedSeek | null,
+  pendingSeconds: number | null,
+  targetSeconds: number,
+  nowMs: number,
+): boolean {
+  return (
+    issued !== null &&
+    pendingSeconds !== null &&
+    nowMs - issued.issuedAtMs < roomReloadStaleMs &&
+    Math.abs(pendingSeconds - issued.targetSeconds) <= roomSeekDuplicateSeconds &&
+    Math.abs(targetSeconds - issued.targetSeconds) <= roomSeekDuplicateSeconds
+  );
+}
+
+/**
+ * The drift loop of a player that cannot nudge its rate (see `rateCapable`)
+ * seeks to the room instead, only when the drift exceeds PAUSED_SEEK and the
+ * element reaches the room position without a rebuild.
+ */
+export function roomLoopSeekDue(driftSeconds: number, targetLocallySeekable: boolean): boolean {
+  return targetLocallySeekable && Math.abs(driftSeconds) > roomSyncPausedSeekSeconds;
+}
+
+/** Upper bound on how far ahead of the room a correcting seek aims. */
+export const roomSeekLeadMaxSeconds = 3;
+/** Longest wait between correcting seeks that keep missing. */
+export const roomSeekBackoffMaxMs = 16_000;
+
+/**
+ * Seek-based drift correction for a player without rate nudges. A seek takes
+ * time, and a player whose clock stands still while it seeks lands that long
+ * behind a room that kept moving. Aimed at the room's current position, each
+ * seek would land short and the next would follow forever. So each seek's
+ * result is measured: the drift left after it lands is added to a lead the
+ * next seek aims ahead by, and a seek that did not bring the drift under
+ * PAUSED_SEEK doubles the wait before the next. Convergence resets the wait;
+ * the lead, a property of this player, is kept.
+ */
+export interface RoomSeekCorrector {
+  leadSeconds: number;
+  intervalMs: number;
+  /** Monotonic time of the last correcting seek, or of it still running. */
+  lastSeekAtMs: number;
+  /** A seek ran and its landing has not been measured yet. */
+  awaitingResult: boolean;
+}
+
+export function createRoomSeekCorrector(): RoomSeekCorrector {
+  return {
+    leadSeconds: 0,
+    intervalMs: roomSyncLoopSettleMs,
+    lastSeekAtMs: Number.NEGATIVE_INFINITY,
+    awaitingResult: false,
+  };
+}
+
+/** Where a correcting seek aims, given the room position now. */
+export function roomCorrectorSeekTarget(
+  corrector: RoomSeekCorrector,
+  roomPositionSeconds: number,
+): number {
+  return roomPositionSeconds + corrector.leadSeconds;
+}
+
+/** A correcting seek was issued (or is still running) at `nowMs`. */
+export function noteRoomCorrectorSeek(corrector: RoomSeekCorrector, nowMs: number): void {
+  corrector.lastSeekAtMs = nowMs;
+  corrector.awaitingResult = true;
 }
 
-/** The room's expected position at `nowMs`, advancing at 1x from execution. */
-export function roomCatchupExpectedPosition(target: RoomCatchupTarget, nowMs: number): number {
-  return Math.max(0, target.positionSeconds + Math.max(0, (nowMs - target.executeAtMs) / 1000));
+/**
+ * Takes the drift measured once playback runs again after a correcting seek.
+ * Positive drift is a seek that landed short of the room.
+ */
+export function observeRoomCorrector(corrector: RoomSeekCorrector, driftSeconds: number): void {
+  if (!corrector.awaitingResult) return;
+  corrector.awaitingResult = false;
+  corrector.leadSeconds = Math.min(
+    roomSeekLeadMaxSeconds,
+    Math.max(0, corrector.leadSeconds + driftSeconds),
+  );
+  corrector.intervalMs =
+    Math.abs(driftSeconds) > roomSyncPausedSeekSeconds
+      ? Math.min(roomSeekBackoffMaxMs, corrector.intervalMs * 2)
+      : roomSyncLoopSettleMs;
 }
 
-/** Whether local playback has reached the advancing room position. */
-export function roomCatchupConverged(
-  target: RoomCatchupTarget,
-  localPositionSeconds: number,
+/** Whether the drift loop should seek now. */
+export function roomCorrectorSeekDue(
+  corrector: RoomSeekCorrector,
+  driftSeconds: number,
+  targetLocallySeekable: boolean,
   nowMs: number,
 ): boolean {
   return (
-    Math.abs(roomCatchupExpectedPosition(target, nowMs) - localPositionSeconds) <=
-    roomCatchupDeadbandSeconds
+    roomLoopSeekDue(driftSeconds, targetLocallySeekable) &&
+    nowMs - corrector.lastSeekAtMs >= corrector.intervalMs
   );
 }
 
-export interface RoomCatchupInput {
+export type RoomCommandDecision =
+  | { kind: "seek" }
+  | { kind: "rate"; rate: number }
+  | { kind: "none" };
+
+export interface RoomCommandInput {
   action: "play" | "pause" | "seek";
-  /** The command's position in media time. */
+  /** Room position at the moment the command is applied, in media time. */
   targetPositionSeconds: number;
   /** The local playback position in media time. */
   localPositionSeconds: number;
+  /** Whether the element was playing when the command executed. */
+  localPlaying: boolean;
+  /**
+   * Whether room sync may nudge this player's playback rate. The browser
+   * decode engine corrects drift by seeking instead.
+   */
+  rateCapable: boolean;
   /**
    * Whether the element can take the target without a stream rebuild: the
    * plan seeks anywhere, or the target lies inside the seekable ranges.
@@ -70,25 +240,41 @@ export interface RoomCatchupInput {
   targetLocallySeekable: boolean;
 }
 
-export function decideRoomCatchup(input: RoomCatchupInput): RoomCatchupDecision {
+/**
+ * How a command corrects the local position when it executes. Play and pause
+ * state, and the 1x reset for pause and seek, are the caller's: a `none` or
+ * `seek` decision for a play command still plays at 1x afterwards, and the
+ * drift loop nudges any residual drift.
+ */
+export function decideRoomCommand(input: RoomCommandInput): RoomCommandDecision {
+  // A seek is a room barrier: everyone lands on the same frame.
   if (input.action === "seek") return { kind: "seek" };
-  const delta = input.targetPositionSeconds - input.localPositionSeconds;
-  const drift = Math.abs(delta);
-  if (drift <= roomCatchupDeadbandSeconds) return { kind: "none" };
-  // Everything the element can reach without a rebuild stays a seek, exactly
-  // as before the rate path existed.
-  if (input.targetLocallySeekable) return { kind: "seek" };
-  if (input.action === "pause") {
-    // Pausing is cheap and the room's next play command realigns; never
-    // rebuild a stream to park a paused member at the anchor.
+  const driftSeconds = input.targetPositionSeconds - input.localPositionSeconds;
+  const drift = Math.abs(driftSeconds);
+  if (input.action === "play" && input.localPlaying && !input.rateCapable) {
+    // No nudge is available: a seek in place beats audible drift, and only
+    // drift beyond HARD_SEEK is worth loading media for.
+    if (drift > roomSyncPausedSeekSeconds && input.targetLocallySeekable) return { kind: "seek" };
+    if (drift > roomSyncHardSeekSeconds) return { kind: "seek" };
     return { kind: "none" };
   }
-  if (drift > roomCatchupBandSeconds) return { kind: "seek" };
-  const rate = 1 + delta / roomCatchupDivisorSeconds;
-  return {
-    kind: "rate",
-    rate: Math.min(roomCatchupMaxRate, Math.max(roomCatchupMinRate, rate)),
-  };
+  if (input.action === "play" && input.localPlaying) {
+    if (drift <= roomSyncDeadbandSeconds) return { kind: "none" };
+    // Even a buffered target is not sought: a seek stalls playback visibly
+    // for drift a nudge absorbs within seconds.
+    if (drift <= roomSyncHardSeekSeconds) {
+      return { kind: "rate", rate: roomSyncNudgeRate(driftSeconds) };
+    }
+    return { kind: "seek" };
+  }
+  // A pause, or a play for a viewer that is not playing yet.
+  if (
+    drift > roomSyncHardSeekSeconds ||
+    (drift > roomSyncPausedSeekSeconds && input.targetLocallySeekable)
+  ) {
+    return { kind: "seek" };
+  }
+  return { kind: "none" };
 }
 
 /** Whether `nativeSeconds` falls inside one of `ranges`, such as the element's seekable or buffered ranges. */
@@ -116,6 +302,11 @@ export const roomReloadMaxIntervalMs = 60_000;
 export const roomReloadStaleMs = 30_000;
 /** Upper bound on the load-time lead added to a reload's target. */
 export const roomReloadMaxLeadSeconds = 10;
+/**
+ * Playback this far past a reload's target is still that reload playing: it
+ * started a little early and has run since. Further ahead is the old stream.
+ */
+const roomReloadLandedAheadSeconds = 2;
 
 export interface RoomReloadBudget {
   /**
@@ -155,6 +346,15 @@ function roomReloadBackoffMs(attempts: number): number {
   );
 }
 
+/**
+ * Whether a reload is loading and still young enough to wait for. A reload
+ * older than `roomReloadStaleMs` has failed to land; it must not hold up the
+ * drift loop or the next correction forever.
+ */
+export function roomReloadInFlight(budget: RoomReloadBudget, nowMs: number): boolean {
+  return budget.targetSeconds !== null && nowMs - budget.startedAtMs < roomReloadStaleMs;
+}
+
 export function roomReloadAllowed(budget: RoomReloadBudget, nowMs: number): boolean {
   if (budget.targetSeconds !== null) {
     return nowMs - budget.startedAtMs >= roomReloadStaleMs;
@@ -200,7 +400,7 @@ export function noteRoomReloadLoading(budget: RoomReloadBudget): void {
 export function roomReloadLanded(budget: RoomReloadBudget, localPositionSeconds: number): boolean {
   if (budget.targetSeconds === null || !budget.loadStarted) return false;
   const offset = localPositionSeconds - budget.targetSeconds;
-  return offset >= -roomCatchupDeadbandSeconds && offset <= roomCatchupBandSeconds;
+  return offset >= -roomSyncDeadbandSeconds && offset <= roomReloadLandedAheadSeconds;
 }
 
 /** The reload is playing: remember its load time and space the next one. */
@@ -222,6 +422,19 @@ export function abandonRoomReload(budget: RoomReloadBudget, nowMs: number): void
   budget.nextAllowedAtMs = nowMs + roomReloadBackoffMs(budget.attempts);
 }
 
+/**
+ * A reload that never landed within `roomReloadStaleMs` is given up. Unlike a
+ * refused or superseded reload this earns no backoff: the staleness wait was
+ * the backoff, and `roomReloadAllowed` already admits a replacement by now.
+ * Attempts are kept, so a replacement that lands still backs off further.
+ */
+export function expireRoomReload(budget: RoomReloadBudget, nowMs: number): void {
+  if (budget.targetSeconds === null) return;
+  budget.generation += 1;
+  budget.targetSeconds = null;
+  budget.nextAllowedAtMs = nowMs;
+}
+
 /** The viewer reached the room; the next drift starts a fresh backoff. */
 export function settleRoomReloads(budget: RoomReloadBudget): void {
   budget.attempts = 0;
diff --git a/web/src/player/utils/subtitleChoicePersistence.ts b/web/src/player/utils/subtitleChoicePersistence.ts
index 39bc66c6de..dab14c37e9 100644
--- a/web/src/player/utils/subtitleChoicePersistence.ts
+++ b/web/src/player/utils/subtitleChoicePersistence.ts
@@ -66,7 +66,7 @@ export function sendSubtitleChoiceRequest(
  * holds only the *resolved* value and has no control that edits it, so for a
  * viewer who never expressed a preference it is the contract default; writing
  * that back would pin the default at the top of the ladder and permanently
- * shadow the profile-scope toggle on the Subtitles settings screen. It still
+ * shadow the profile-scope toggle on the Language & Subtitles settings screen. It still
  * rides along on the legacy composite row, which is keyed to a concrete track
  * selection and is not part of the canonical resolution ladder.
  *
diff --git a/web/src/player/utils/subtitleCodecs.ts b/web/src/player/utils/subtitleCodecs.ts
index 9457feddd6..025beb3f2e 100644
--- a/web/src/player/utils/subtitleCodecs.ts
+++ b/web/src/player/utils/subtitleCodecs.ts
@@ -8,8 +8,9 @@ export function isASSCodec(codec: string | undefined): boolean {
 }
 
 /**
- * Codecs that indicate PGS (Blu-ray bitmap) subtitles. Like all bitmap
- * codecs, PGS is burned into the video server-side when selected.
+ * Codecs that indicate PGS (Blu-ray bitmap) subtitles. Embedded PGS is drawn
+ * client-side from the server's `.sup` sidecar; the other bitmap codecs are
+ * burned into the video server-side when selected.
  */
 const PGS_CODECS = new Set(["pgs", "pgssub", "hdmv_pgs_subtitle"]);
 
@@ -36,6 +37,25 @@ export function isBitmapCodec(codec: string | undefined): boolean {
   return BITMAP_CODECS.has(codec.toLowerCase());
 }
 
+/**
+ * Whether selecting the track on the web makes the server burn it into the
+ * video. The web player declares `embedded_bitmap` (client-context-v3.ts), so
+ * the server serves embedded PGS as a `.sup` sidecar that usePGSSubtitles
+ * draws; other bitmap tracks, and any track the server publishes as
+ * `burn_in_only`, need the server. Watch-detail tracks carry no delivery
+ * yet, so the codec and source decide for them.
+ */
+export function subtitleNeedsBurnIn(track: {
+  codec?: string;
+  source?: "external" | "embedded" | "downloaded";
+  burn_in_only?: boolean;
+}): boolean {
+  if (track.burn_in_only === true) return true;
+  if (!isBitmapCodec(track.codec)) return false;
+  const drawnByPlayer = isPGSCodec(track.codec) && (track.source ?? "embedded") === "embedded";
+  return !drawnByPlayer;
+}
+
 /**
  * Returns a human-readable format label for display in the subtitle menu,
  * or null if the codec is unknown/unset.
diff --git a/web/src/player/utils/subtitleSort.test.ts b/web/src/player/utils/subtitleSort.test.ts
index 90671fe11a..768e19fce6 100644
--- a/web/src/player/utils/subtitleSort.test.ts
+++ b/web/src/player/utils/subtitleSort.test.ts
@@ -465,7 +465,7 @@ describe("bitmap (PGS) codec deprioritization", () => {
     expect(findPreferredSubtitleIndex(tracks, "en")).toBe(1);
   });
 
-  it("prefers an external text track over an embedded PGS track, which the web player burns in", () => {
+  it("prefers an external text track over an embedded PGS track of the same kind", () => {
     const tracks = [
       makeSub({ index: 0, source: "embedded", language: "en", codec: "hdmv_pgs_subtitle" }),
       makeSub({ index: 1, source: "external", language: "en", codec: "srt" }),
@@ -473,10 +473,38 @@ describe("bitmap (PGS) codec deprioritization", () => {
     expect(findPreferredSubtitleIndex(tracks, "en")).toBe(1);
   });
 
-  it("ranks embedded PGS as burn-in even when the server offers it as a sidecar", () => {
+  it("prefers full-dialogue embedded PGS over a forced or SDH text track", () => {
+    const pgs = makeSub({ index: 0, source: "embedded", language: "en", codec: "pgs" });
+    const forced = makeSub({
+      index: 1,
+      source: "external",
+      language: "en",
+      codec: "srt",
+      forced: true,
+    });
+    const sdh = makeSub({
+      index: 2,
+      source: "external",
+      language: "en",
+      codec: "srt",
+      hearing_impaired: true,
+    });
+    expect(findPreferredSubtitleIndex([pgs, forced], "en")).toBe(0);
+    expect(findPreferredSubtitleIndex([pgs, sdh], "en")).toBe(0);
+  });
+
+  it("still ranks PGS as burn-in when the server publishes it burn_in_only", () => {
     const tracks = [
-      makeSub({ index: 0, source: "embedded", language: "en", codec: "pgs", burn_in_only: false }),
-      makeSub({ index: 1, source: "external", language: "en", codec: "srt" }),
+      makeSub({ index: 0, source: "embedded", language: "en", codec: "pgs", burn_in_only: true }),
+      makeSub({ index: 1, source: "external", language: "en", codec: "srt", forced: true }),
+    ];
+    expect(findPreferredSubtitleIndex(tracks, "en")).toBe(1);
+  });
+
+  it("ranks external PGS files as burn-in", () => {
+    const tracks = [
+      makeSub({ index: 0, source: "external", language: "en", codec: "hdmv_pgs_subtitle" }),
+      makeSub({ index: 1, source: "external", language: "en", codec: "srt", forced: true }),
     ];
     expect(findPreferredSubtitleIndex(tracks, "en")).toBe(1);
   });
diff --git a/web/src/player/utils/subtitleSort.ts b/web/src/player/utils/subtitleSort.ts
index 533c412336..5de91ac861 100644
--- a/web/src/player/utils/subtitleSort.ts
+++ b/web/src/player/utils/subtitleSort.ts
@@ -1,6 +1,6 @@
 import type { PlayerSubtitleInfo, PlayerSubtitleTrackSignature, SubtitleMode } from "../types";
 import { canonicalLanguageTag, normalizeLanguageCode } from "@/lib/languageTags";
-import { isBitmapCodec } from "./subtitleCodecs";
+import { isBitmapCodec, subtitleNeedsBurnIn } from "./subtitleCodecs";
 
 const ORIGINAL_LANGUAGE_SENTINEL = "original";
 // playback.audio_language stores the original-language choice as this
@@ -21,32 +21,25 @@ function sourcePriority(track: PlayerSubtitleInfo): number {
   return SOURCE_PRIORITY[track.source ?? "embedded"] ?? 0;
 }
 
-/**
- * Whether showing the track forces a burn-in transcode. The web player renders
- * no bitmap subtitles (`client-context-v3.ts` declares no bitmap support), so
- * every PGS/DVD/DVB track is burned in, even one the server could deliver as a
- * sidecar. The server's `burn_in_only` flag covers the rest.
- */
-function needsBurnIn(track: PlayerSubtitleInfo): boolean {
-  return isBitmapCodec(track.codec) || track.burn_in_only === true;
-}
-
 /**
  * Auto-select priority within the same language rank: lower is better. Each
  * tier only breaks ties in the one before it:
  * 1. a track the player renders itself beats one that forces a burn-in;
  * 2. full dialogue beats forced, and plain beats SDH, so a file's own forced
  *    or SDH track never displaces the full track the viewer asked for;
- * 3. embedded beats external beats downloaded.
+ * 3. text beats an image track the player draws (PGS), which ignores the
+ *    subtitle appearance settings;
+ * 4. embedded beats external beats downloaded.
  * A burn-in track still wins when it's the only match for the language.
  */
 function trackPriority(track: PlayerSubtitleInfo): number {
   // Source (0-2) stays below 4, so each flag weight outranks every lower
   // tier combined.
   return (
-    (needsBurnIn(track) ? 16 : 0) +
-    (track.forced ? 8 : 0) +
-    (track.hearing_impaired ? 4 : 0) +
+    (subtitleNeedsBurnIn(track) ? 32 : 0) +
+    (track.forced ? 16 : 0) +
+    (track.hearing_impaired ? 8 : 0) +
+    (isBitmapCodec(track.codec) ? 4 : 0) +
     sourcePriority(track)
   );
 }
diff --git a/web/src/player/utils/subtitleWindows.test.ts b/web/src/player/utils/subtitleWindows.test.ts
new file mode 100644
index 0000000000..06259fc833
--- /dev/null
+++ b/web/src/player/utils/subtitleWindows.test.ts
@@ -0,0 +1,164 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import {
+  createSubtitleWindowFetcher,
+  nextSubtitleRetryDelay,
+  planSubtitleWindow,
+  SUBTITLE_FETCH_RETRY_MAX_BACKOFF_MS,
+  type SubtitleWindowState,
+} from "./subtitleWindows";
+
+const covered: SubtitleWindowState = {
+  hasFetched: true,
+  coverageStart: 100,
+  windowEnd: 700,
+  atEOF: false,
+  inflightStart: null,
+  failedAt: 0,
+  retryDelayMs: 0,
+};
+
+describe("planSubtitleWindow", () => {
+  it("starts fresh before anything is loaded and after a seek out of coverage", () => {
+    expect(planSubtitleWindow({ ...covered, hasFetched: false }, 50, 0, 2)).toEqual({
+      kind: "fresh",
+      start: 48,
+    });
+    expect(planSubtitleWindow(covered, 90, 0, 10)).toEqual({ kind: "fresh", start: 80 });
+    expect(planSubtitleWindow(covered, 800, 0, 2)).toEqual({ kind: "fresh", start: 798 });
+  });
+
+  it("extends near the end of coverage unless at end of file", () => {
+    expect(planSubtitleWindow(covered, 680, 0, 2)).toEqual({ kind: "extend", start: 695 });
+    expect(planSubtitleWindow({ ...covered, atEOF: true }, 680, 0, 2)).toEqual({ kind: "none" });
+    expect(planSubtitleWindow(covered, 300, 0, 2)).toEqual({ kind: "none" });
+  });
+
+  it("extends from the end of coverage when the playhead has already passed it", () => {
+    expect(planSubtitleWindow(covered, 700.8, 0, 2)).toEqual({ kind: "extend", start: 695 });
+  });
+
+  it("waits for a window on the wire that covers the playhead, and replaces one that does not", () => {
+    expect(planSubtitleWindow({ ...covered, inflightStart: 695 }, 690, 0, 2)).toEqual({
+      kind: "none",
+    });
+    expect(planSubtitleWindow({ ...covered, inflightStart: 695 }, 2000, 0, 2)).toEqual({
+      kind: "fresh",
+      start: 1998,
+    });
+  });
+
+  it("holds off inside a failure backoff", () => {
+    const failing = { ...covered, hasFetched: false, failedAt: 1_000, retryDelayMs: 5_000 };
+    expect(planSubtitleWindow(failing, 10, 3_000, 2)).toEqual({ kind: "none" });
+    expect(planSubtitleWindow(failing, 10, 7_000, 2).kind).toBe("fresh");
+  });
+});
+
+describe("nextSubtitleRetryDelay", () => {
+  it("doubles up to the cap", () => {
+    expect(nextSubtitleRetryDelay(0)).toBe(5_000);
+    expect(nextSubtitleRetryDelay(5_000)).toBe(10_000);
+    expect(nextSubtitleRetryDelay(40_000)).toBe(SUBTITLE_FETCH_RETRY_MAX_BACKOFF_MS);
+  });
+});
+
+describe("createSubtitleWindowFetcher", () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  /** A streamed response that yields `chunks` in order. */
+  function respond(chunks: string[], ok = true) {
+    const encoder = new TextEncoder();
+    const pending = [...chunks];
+    return Promise.resolve({
+      ok,
+      status: ok ? 200 : 503,
+      body: ok
+        ? {
+            getReader: () => ({
+              read: async () => {
+                const next = pending.shift();
+                return next === undefined
+                  ? { done: true, value: undefined }
+                  : { done: false, value: encoder.encode(next) };
+              },
+            }),
+          }
+        : null,
+    });
+  }
+
+  function makeFetcher(playhead: number) {
+    const events: string[] = [];
+    const fetcher = createSubtitleWindowFetcher({
+      windowUrl: (start) => `/sub?position=${start}`,
+      playhead: () => playhead,
+      duration: () => 0,
+      seekBackoffSeconds: 10,
+      logTag: "test",
+      onWindowStart: (fresh) => events.push(fresh ? "start fresh" : "start extend"),
+      onChunk: (chunk) => events.push(`chunk ${new TextDecoder().decode(chunk)}`),
+      onWindowCommitted: () => events.push("committed"),
+      onWindowFailed: () => events.push("failed"),
+    });
+    return { fetcher, events };
+  }
+
+  it("commits a window's coverage only once it has streamed in whole", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn(() => respond(["a", "b"])),
+    );
+    const { fetcher, events } = makeFetcher(100);
+    fetcher.maybeFetch();
+    await vi.waitFor(() => expect(events).toContain("committed"));
+    expect(events).toEqual(["start fresh", "chunk a", "chunk b", "committed"]);
+    expect(fetcher.coverage()).toMatchObject({
+      hasFetched: true,
+      coverageStart: 90,
+      windowEnd: 690,
+    });
+    fetcher.dispose();
+  });
+
+  it("leaves a failed window uncovered and backs off before retrying", async () => {
+    vi.useFakeTimers();
+    try {
+      const fetchMock = vi.fn(() => respond([], false));
+      vi.stubGlobal("fetch", fetchMock);
+      vi.spyOn(console, "error").mockImplementation(() => {});
+      const { fetcher, events } = makeFetcher(100);
+      fetcher.maybeFetch();
+      await vi.waitFor(() => expect(events).toContain("failed"));
+      expect(fetcher.coverage()).toMatchObject({ hasFetched: false, windowEnd: 90 });
+      fetcher.maybeFetch();
+      expect(fetchMock).toHaveBeenCalledTimes(1);
+      await vi.advanceTimersByTimeAsync(5_000);
+      expect(fetchMock).toHaveBeenCalledTimes(2);
+      fetcher.dispose();
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it("starts from carried-over coverage without refetching it", () => {
+    const fetchMock = vi.fn(() => respond([]));
+    vi.stubGlobal("fetch", fetchMock);
+    const fetcher = createSubtitleWindowFetcher({
+      windowUrl: (start) => `/sub?position=${start}`,
+      playhead: () => 300,
+      duration: () => 0,
+      seekBackoffSeconds: 10,
+      initial: { hasFetched: true, coverageStart: 100, windowEnd: 700, atEOF: false },
+      logTag: "test",
+      onWindowStart: () => {},
+      onChunk: () => {},
+      onWindowCommitted: () => {},
+      onWindowFailed: () => {},
+    });
+    fetcher.maybeFetch();
+    expect(fetchMock).not.toHaveBeenCalled();
+    fetcher.dispose();
+  });
+});
diff --git a/web/src/player/utils/subtitleWindows.ts b/web/src/player/utils/subtitleWindows.ts
new file mode 100644
index 0000000000..35b743d6f9
--- /dev/null
+++ b/web/src/player/utils/subtitleWindows.ts
@@ -0,0 +1,288 @@
+/**
+ * The sliding-window schedule shared by the subtitle fetchers
+ * (useSubtitleTracks for text, usePGSSubtitles for bitmaps). An embedded track
+ * can take minutes to extract whole from a large remux, while a positioned
+ * window comes back in a second or two, so each fetcher asks the server for
+ * bounded source-time windows around the playhead.
+ */
+
+import { toMediaTime } from "./mediaTimeline";
+
+// Explicitly bound each subtitle fetch to this many source-time seconds.
+export const SUBTITLE_WINDOW_SECONDS = 600;
+// Start fetching the next window this many seconds before the current one's
+// requested end, so the new cues are already on hand when playback crosses in.
+export const SUBTITLE_PREFETCH_LEAD_SECONDS = 30;
+// Overlap consecutive windows by a few seconds so ffmpeg boundary rounding
+// can't drop a cue that straddles the join.
+export const SUBTITLE_WINDOW_OVERLAP_SECONDS = 5;
+// Abort a window fetch when the response goes this long without delivering a
+// chunk. Extraction streams progressively, so a healthy-but-slow ffmpeg keeps
+// resetting the clock; only a genuinely hung one trips it.
+export const SUBTITLE_FETCH_STALL_TIMEOUT_MS = 30_000;
+// Wait this long after a failed window fetch before retrying, so a
+// persistently failing extraction doesn't turn timeupdate into a fetch storm.
+export const SUBTITLE_FETCH_RETRY_BACKOFF_MS = 5_000;
+export const SUBTITLE_FETCH_RETRY_MAX_BACKOFF_MS = 60_000;
+
+export interface SubtitleWindowState {
+  hasFetched: boolean;
+  /** Source time the current coverage starts at. */
+  coverageStart: number;
+  /** Requested end of the last window that streamed in completely. */
+  windowEnd: number;
+  /** The last window reached the known media duration. */
+  atEOF: boolean;
+  /** Start of the window on the wire, or null when none is. */
+  inflightStart: number | null;
+  /** Wall time of the last failed fetch, or 0. */
+  failedAt: number;
+  retryDelayMs: number;
+}
+
+export type SubtitleWindowAction =
+  | { kind: "none" }
+  /** Drop what is loaded and fetch from `start`. */
+  | { kind: "fresh"; start: number }
+  /** Append the window starting at `start` to the current coverage. */
+  | { kind: "extend"; start: number };
+
+/**
+ * Picks the fetch for the current playhead:
+ *   - no cues yet, or the playhead left the covered range (a seek) → a fresh
+ *     window from slightly before the playhead, so a skipped-over gap is never
+ *     mistaken for covered range;
+ *   - playback nearing the end of coverage and not at EOF → the next window,
+ *     overlapping the previous one slightly. It starts there even when the
+ *     playhead has already passed the end (a retry after a failed extend), so
+ *     nothing between the two windows is skipped;
+ *   - a window already on the wire that covers the playhead, or a failure
+ *     still inside its backoff → nothing.
+ */
+export function planSubtitleWindow(
+  state: SubtitleWindowState,
+  time: number,
+  now: number,
+  seekBackoffSeconds: number,
+): SubtitleWindowAction {
+  const fresh = (): SubtitleWindowAction => ({
+    kind: "fresh",
+    start: Math.max(0, time - seekBackoffSeconds),
+  });
+  if (state.inflightStart !== null) {
+    const covered =
+      time >= Math.min(state.coverageStart, state.inflightStart) - 1 &&
+      time <= state.inflightStart + SUBTITLE_WINDOW_SECONDS + 1;
+    // A seek outside the requested range must not wait for extraction.
+    return covered ? { kind: "none" } : fresh();
+  }
+  if (state.failedAt > 0 && now - state.failedAt < state.retryDelayMs) return { kind: "none" };
+  if (!state.hasFetched || time < state.coverageStart - 1 || time > state.windowEnd + 1) {
+    return fresh();
+  }
+  if (!state.atEOF && time > state.windowEnd - SUBTITLE_PREFETCH_LEAD_SECONDS) {
+    return { kind: "extend", start: state.windowEnd - SUBTITLE_WINDOW_OVERLAP_SECONDS };
+  }
+  return { kind: "none" };
+}
+
+/** Backoff after another failed fetch: doubling, capped. */
+export function nextSubtitleRetryDelay(previousMs: number): number {
+  return Math.min(
+    previousMs ? previousMs * 2 : SUBTITLE_FETCH_RETRY_BACKOFF_MS,
+    SUBTITLE_FETCH_RETRY_MAX_BACKOFF_MS,
+  );
+}
+
+/** The request for the window starting at `position`, in source seconds. */
+export function subtitleWindowUrl(url: string, position: number, extraQuery = ""): string {
+  const separator = url.includes("?") ? "&" : "?";
+  const extra = extraQuery ? `${extraQuery}&` : "";
+  return `${url}${separator}${extra}position=${position}&duration=${SUBTITLE_WINDOW_SECONDS}`;
+}
+
+/**
+ * Source time at the playhead. Until the element has media loaded, currentTime
+ * reads 0 rather than where playback will start (a resume target, or a seek
+ * that restarted the stream), so the intended position stands in for it.
+ */
+export function subtitlePlayheadSeconds(
+  video: HTMLVideoElement,
+  streamOriginSeconds: number,
+  fetchAnchorSeconds: number | null | undefined,
+): number {
+  return video.readyState > 0
+    ? toMediaTime(video.currentTime, streamOriginSeconds)
+    : (fetchAnchorSeconds ?? 0);
+}
+
+export interface SubtitleWindowCoverage {
+  hasFetched: boolean;
+  coverageStart: number;
+  windowEnd: number;
+  atEOF: boolean;
+}
+
+export interface SubtitleWindowFetcherOptions {
+  /** Request URL for the window starting at `start`. */
+  windowUrl: (start: number) => string;
+  /** Source time at the playhead. */
+  playhead: () => number;
+  /** Known media duration in source seconds (0 when unknown). */
+  duration: () => number;
+  seekBackoffSeconds: number;
+  /** Coverage carried over from an earlier fetcher for the same track. */
+  initial?: SubtitleWindowCoverage;
+  /** A window is about to stream; `fresh` replaces everything loaded. */
+  onWindowStart: (fresh: boolean) => void;
+  /** The next bytes of the current window, in order. */
+  onChunk: (chunk: Uint8Array) => void;
+  /** The current window's response ended without an error. */
+  onResponseEnd?: () => void;
+  /** The whole window streamed in and its range now counts as covered. */
+  onWindowCommitted: (fresh: boolean) => void;
+  /** A window failed or stalled; it is retried after a backoff. */
+  onWindowFailed: () => void;
+  logTag: string;
+}
+
+export interface SubtitleWindowFetcher {
+  /** Fetches whatever the playhead needs next; see planSubtitleWindow. */
+  maybeFetch: () => void;
+  coverage: () => SubtitleWindowCoverage;
+  /** Drops coverage before `start` once the caller has released it. */
+  releaseBefore: (start: number) => void;
+  dispose: () => void;
+}
+
+/**
+ * Runs the sliding-window fetch loop for one subtitle track: one window on
+ * the wire at a time, a stall timeout re-armed on every read, coverage
+ * committed only once a window has streamed in whole, and a backoff after a
+ * failure. The caller parses the bytes.
+ */
+export function createSubtitleWindowFetcher(
+  options: SubtitleWindowFetcherOptions,
+): SubtitleWindowFetcher {
+  let disposed = false;
+  let hasFetched = options.initial?.hasFetched ?? false;
+  let coverageStart = options.initial?.coverageStart ?? 0;
+  let windowEnd = options.initial?.windowEnd ?? 0;
+  let atEOF = options.initial?.atEOF ?? false;
+  let inflight: AbortController | null = null;
+  let inflightStart = 0;
+  let retryTimer: ReturnType<typeof setTimeout> | null = null;
+  let lastFetchFailureAt = 0;
+  let retryDelay = 0;
+
+  async function fetchWindow(seekStart: number, fresh: boolean) {
+    // Only one window on the wire at a time: each fetch keeps an ffmpeg
+    // process alive, so double-fetching wastes it.
+    inflight?.abort();
+    const controller = new AbortController();
+    inflight = controller;
+    inflightStart = seekStart;
+    if (retryTimer !== null) clearTimeout(retryTimer);
+    if (fresh) {
+      coverageStart = seekStart;
+      windowEnd = seekStart;
+      atEOF = false;
+    }
+    options.onWindowStart(fresh);
+    const requestedEnd = seekStart + SUBTITLE_WINDOW_SECONDS;
+
+    // Abort the fetch if the response stops delivering chunks. Re-armed on
+    // every read so a slow-but-progressing extraction is never cut off.
+    let stallTimer: ReturnType<typeof setTimeout> | null = null;
+    const armStallTimer = () => {
+      if (stallTimer !== null) clearTimeout(stallTimer);
+      stallTimer = setTimeout(() => controller.abort(), SUBTITLE_FETCH_STALL_TIMEOUT_MS);
+    };
+
+    const url = options.windowUrl(seekStart);
+    let succeeded = false;
+    try {
+      armStallTimer();
+      const response = await fetch(url, { signal: controller.signal });
+      if (!response.ok || !response.body) {
+        console.error(`[${options.logTag}] Failed to fetch ${url}: ${response.status}`);
+        return;
+      }
+      const reader = response.body.getReader();
+      while (!disposed) {
+        armStallTimer();
+        const { value, done } = await reader.read();
+        if (disposed || controller.signal.aborted || inflight !== controller) return;
+        if (done) break;
+        options.onChunk(value);
+      }
+      if (disposed) return;
+      options.onResponseEnd?.();
+      succeeded = true;
+    } catch (error) {
+      if ((error as Error).name !== "AbortError") {
+        console.error(`[${options.logTag}] Stream error:`, error);
+      }
+    } finally {
+      if (stallTimer !== null) clearTimeout(stallTimer);
+      const superseded = inflight !== controller;
+      if (inflight === controller) inflight = null;
+      if (succeeded && !disposed && !superseded) {
+        hasFetched = true;
+        retryDelay = 0;
+        lastFetchFailureAt = 0;
+        // Commit coverage only after the whole window streamed in. A failed
+        // or stalled fetch must leave the range uncovered, or the gap would
+        // read as fetched and never be retried.
+        windowEnd = Math.max(windowEnd, requestedEnd);
+        // End-of-input only when the window reaches the known media duration.
+        // Where a window's cues stop says nothing: a window that ends inside a
+        // dialogue gap looks the same as the end of the file.
+        const duration = options.duration();
+        if (duration > 0 && requestedEnd >= duration) atEOF = true;
+        options.onWindowCommitted(fresh);
+      } else if (!succeeded && !superseded && !disposed) {
+        // A real failure (error, stall, or non-ok response) rather than a seek
+        // superseding this fetch: back off before retrying.
+        lastFetchFailureAt = Date.now();
+        options.onWindowFailed();
+        retryDelay = nextSubtitleRetryDelay(retryDelay);
+        retryTimer = setTimeout(maybeFetch, retryDelay);
+      }
+    }
+  }
+
+  function maybeFetch() {
+    if (disposed) return;
+    const action = planSubtitleWindow(
+      {
+        hasFetched,
+        coverageStart,
+        windowEnd,
+        atEOF,
+        inflightStart: inflight ? inflightStart : null,
+        failedAt: lastFetchFailureAt,
+        retryDelayMs: retryDelay,
+      },
+      options.playhead(),
+      Date.now(),
+      options.seekBackoffSeconds,
+    );
+    if (action.kind === "fresh") void fetchWindow(action.start, true);
+    else if (action.kind === "extend") void fetchWindow(action.start, false);
+  }
+
+  return {
+    maybeFetch,
+    coverage: () => ({ hasFetched, coverageStart, windowEnd, atEOF }),
+    releaseBefore: (start) => {
+      if (start > coverageStart) coverageStart = start;
+    },
+    dispose: () => {
+      disposed = true;
+      if (retryTimer !== null) clearTimeout(retryTimer);
+      inflight?.abort();
+      inflight = null;
+    },
+  };
+}
diff --git a/web/src/player/utils/videoFit.ts b/web/src/player/utils/videoFit.ts
new file mode 100644
index 0000000000..cff0c708ed
--- /dev/null
+++ b/web/src/player/utils/videoFit.ts
@@ -0,0 +1,32 @@
+import type { VideoFitMode } from "../types";
+
+export interface FitRect {
+  x: number;
+  y: number;
+  width: number;
+  height: number;
+}
+
+/**
+ * Where a picture of `videoWidth`x`videoHeight` sits inside a box for a fit
+ * mode, matching CSS `object-fit: contain` and `cover`. Falls back to the
+ * whole box before the picture size is known.
+ */
+export function videoContentRect(
+  boxWidth: number,
+  boxHeight: number,
+  videoWidth: number,
+  videoHeight: number,
+  fit: VideoFitMode,
+): FitRect {
+  if (boxWidth <= 0 || boxHeight <= 0 || videoWidth <= 0 || videoHeight <= 0) {
+    return { x: 0, y: 0, width: boxWidth, height: boxHeight };
+  }
+  const scale =
+    fit === "cover"
+      ? Math.max(boxWidth / videoWidth, boxHeight / videoHeight)
+      : Math.min(boxWidth / videoWidth, boxHeight / videoHeight);
+  const width = videoWidth * scale;
+  const height = videoHeight * scale;
+  return { x: (boxWidth - width) / 2, y: (boxHeight - height) / 2, width, height };
+}
diff --git a/web/src/styles/admin-settings.css b/web/src/styles/admin-settings.css
index 9e5198db42..c103b52aac 100644
--- a/web/src/styles/admin-settings.css
+++ b/web/src/styles/admin-settings.css
@@ -60,10 +60,11 @@
  * Self-contained notices own their complete rounded border and opt out too;
  * overriding only their bottom edge visibly breaks the lower corners.
  */
-.settings-field-list > *:not(.settings-field-row):not(.settings-field-note) {
+.settings-field-list > *:not(.settings-field-row):not(.settings-field-note):not(:last-child) {
   border-bottom: 1px solid color-mix(in srgb, var(--border) 60%, transparent);
 }
 
-.settings-field-list > *:last-child {
-  border-bottom: 0;
+/* Provider rows divide like settings rows; an open row keeps its rule. */
+.provider-list > * + * {
+  border-top: 1px solid color-mix(in srgb, var(--border) 60%, transparent);
 }
diff --git a/web/src/test/fixtures/collectionAnswers.ts b/web/src/test/fixtures/collectionAnswers.ts
index a686481038..d3086ae83f 100644
--- a/web/src/test/fixtures/collectionAnswers.ts
+++ b/web/src/test/fixtures/collectionAnswers.ts
@@ -66,7 +66,7 @@ export function personalSmartCollection(queryDefinition: Record<string, unknown>
 
 /** The admin collection fixture as a synced collection of `type` with `source`. */
 export function adminSyncedCollection(
-  type: "mdblist" | "tmdb" | "trakt",
+  type: "mdblist" | "tmdb",
   source: { source_url: string; source_config: Record<string, unknown> },
 ) {
   return { ...adminCollection, collection_type: type, ...source };
@@ -74,7 +74,7 @@ export function adminSyncedCollection(
 
 /** The personal collection fixture as a synced collection of `type` with `source`. */
 export function personalSyncedCollection(
-  type: "mdblist" | "tmdb" | "trakt",
+  type: "mdblist" | "tmdb",
   source: { source_url: string; source_config: Record<string, unknown> },
 ) {
   return { ...getCollectionOk, collection_type: type, ...source };
diff --git a/web/src/test/fixtures/collectionBodies.ts b/web/src/test/fixtures/collectionBodies.ts
index 610790408d..00d83dc43e 100644
--- a/web/src/test/fixtures/collectionBodies.ts
+++ b/web/src/test/fixtures/collectionBodies.ts
@@ -746,25 +746,6 @@ export const goldens = {
       },
     },
   ] satisfies Writes,
-  /** Admin Synced list editor, legacy Trakt: the source can't change, so neither `source_url` nor `source_config` is sent. */
-  adminEditTrakt: [
-    {
-      operation: "PATCH /api/v2/admin/collections/{id}",
-      path: "/api/v2/admin/collections/c1",
-      headers: {
-        "If-Match": '"/api/v2/admin/collections/c1#1"',
-      },
-      body: {
-        title: "For you",
-        description: "",
-        visibility: "visible",
-        collection_type: "trakt",
-        sync_schedule: "",
-        sort_config: {},
-        library_ids: ["1"],
-      },
-    },
-  ] satisfies Writes,
   /** Personal Synced list editor: optional fields go only when changed; name, sharing, libraries and the tab switch always go. */
   personalSyncedRename: [
     {
diff --git a/web/src/test/policyDefaults.ts b/web/src/test/policyDefaults.ts
index 946502583c..199df6418b 100644
--- a/web/src/test/policyDefaults.ts
+++ b/web/src/test/policyDefaults.ts
@@ -11,6 +11,7 @@ export const POLICY_DEFAULTS: AdminPolicyDefaults = {
     max_transcodes: 0,
     max_remote_stream_bitrate_kbps: 0,
     max_local_stream_bitrate_kbps: 0,
+    max_profiles: 5,
     transcode_allowed: true,
     audio_transcode_allowed: true,
     download_allowed: true,
@@ -24,6 +25,7 @@ export const POLICY_DEFAULTS: AdminPolicyDefaults = {
     max_transcodes: 0,
     max_remote_stream_bitrate_kbps: 0,
     max_local_stream_bitrate_kbps: 0,
+    max_profiles: 5,
     transcode_allowed: true,
     audio_transcode_allowed: true,
     download_allowed: true,
diff --git a/web/src/test/requestBudget.ts b/web/src/test/requestBudget.ts
index 07b2b23c0f..aa41003dc0 100644
--- a/web/src/test/requestBudget.ts
+++ b/web/src/test/requestBudget.ts
@@ -50,7 +50,6 @@ const PUBLIC_OPERATIONS = new Set<string>([
   "GET /api/v2/auth/signup",
   "GET /api/v2/capabilities/password-reset",
   "GET /api/v2/theme/branding",
-  "GET /api/v2/theme/admin-css",
   "POST /api/v2/auth/refresh",
 ]);
 
diff --git a/web/src/test/signedInBoot.test.tsx b/web/src/test/signedInBoot.test.tsx
index 0202e093ec..d9294288a2 100644
--- a/web/src/test/signedInBoot.test.tsx
+++ b/web/src/test/signedInBoot.test.tsx
@@ -109,7 +109,6 @@ function serverRoutes() {
     "GET /api/v2/auth/signup": { body: { enabled: false } },
     "GET /api/v2/capabilities/password-reset": { body: { revision: "r", state: "disabled" } },
     "GET /api/v2/theme/branding": { body: {} },
-    "GET /api/v2/theme/admin-css": { body: {} },
     "GET /api/v2/account/me": { body: getCurrentUserOk },
     "GET /api/v2/profiles": { body: listProfilesOk },
     "GET /api/v2/settings/contract/capabilities": { body: getSettingsContractCapabilitiesOk },
@@ -134,6 +133,23 @@ async function releaseUntilQuiet(server: FakeServer) {
   throw new Error(`boot did not settle:\n${describeRequests(server.requests)}`);
 }
 
+function setTabVisibility(state: DocumentVisibilityState) {
+  Object.defineProperty(document, "visibilityState", { configurable: true, value: state });
+  document.dispatchEvent(new Event("visibilitychange"));
+}
+
+/** Hides the tab for `ms`, shows it again, and answers whatever that sent. */
+async function switchTabAway(server: FakeServer, ms: number) {
+  await act(async () => {
+    setTabVisibility("hidden");
+  });
+  await advanceClock(ms);
+  await act(async () => {
+    setTabVisibility("visible");
+  });
+  await releaseUntilQuiet(server);
+}
+
 async function boot(server: FakeServer) {
   render(<App />);
   await releaseUntilQuiet(server);
@@ -180,6 +196,7 @@ describe("app boot request budget", () => {
   });
 
   afterEach(() => {
+    Reflect.deleteProperty(document, "visibilityState");
     queryClient.clear();
     setAccessToken(null);
     vi.unstubAllGlobals();
@@ -194,12 +211,12 @@ describe("app boot request budget", () => {
     const log = describeRequests(server.requests);
     expect(screen.getByTestId("home"), log).toHaveTextContent("2 sections");
     expect(measureBoot(server.requests), log).toEqual({
-      requestsBeforeHomeLayout: 5,
+      requestsBeforeHomeLayout: 4,
       wavesBeforeHomeLayout: 1,
       unauthorized: 0,
       refreshes: 1,
       duplicateGets: 0,
-      total: 14,
+      total: 13,
     });
     // Home starts loading as soon as the token is back, beside the account read.
     const waveOf = (operation: string) =>
@@ -241,7 +258,7 @@ describe("app boot request budget", () => {
       duplicateGets: 0,
       // Includes the login page's public signup-status and password-reset
       // capability reads.
-      total: 7,
+      total: 6,
     });
     expect(storage.get(storage.KEYS.REFRESH_TOKEN)).toBeNull();
   });
@@ -416,6 +433,33 @@ describe("app boot request budget", () => {
     ).toHaveLength(2);
   });
 
+  it("sends nothing after a short tab switch and catches up once after a long one", async () => {
+    signInReturningOwner();
+    await boot(server);
+    const bootRequests = server.requests.length;
+    // The bandwidth probe runs on its own timer whatever the tab does.
+    const sinceBoot = () =>
+      server.requests
+        .slice(bootRequests)
+        .filter((request) => request.operation !== "GET /api/v2/playback/bandwidth-probe");
+
+    // A quick switch keeps the events socket open, so the cache is still current.
+    await switchTabAway(server, 5_000);
+    expect(describeRequests(sinceBoot())).toBe("");
+
+    // A long absence closes the socket; the return re-reads the screen once.
+    await switchTabAway(server, 2 * 60_000);
+    const afterAbsence = sinceBoot();
+    const log = describeRequests(afterAbsence);
+    expect(measureBoot(afterAbsence), log).toMatchObject({ unauthorized: 0, duplicateGets: 0 });
+    for (const operation of ["GET /api/v2/home/layout", "POST /api/v2/events/ws-ticket"]) {
+      expect(
+        afterAbsence.filter((request) => request.operation === operation),
+        log,
+      ).toHaveLength(1);
+    }
+  });
+
   it("sends no account reads from the login screen", async () => {
     initialEntry = "/login";
 
@@ -430,7 +474,7 @@ describe("app boot request budget", () => {
       duplicateGets: 0,
       // Includes the login page's public signup-status and password-reset
       // capability reads.
-      total: 6,
+      total: 5,
     });
   });
 });
diff --git a/web/src/test/v2Recorder.ts b/web/src/test/v2Recorder.ts
index 34c72ab73b..7c639f3964 100644
--- a/web/src/test/v2Recorder.ts
+++ b/web/src/test/v2Recorder.ts
@@ -108,7 +108,6 @@ const FIXTURE_ANSWERS: Record<string, unknown> = {
   "POST /api/v2/admin/collections/import/mdblist": adminImport,
   "POST /api/v2/admin/collections/import/tmdb": adminImport,
   "POST /api/v2/admin/collections/import/tmdb-list": adminImport,
-  "POST /api/v2/admin/collections/import/trakt": adminImport,
   "POST /api/v2/admin/collections/template-bundles/{bundle_id}/apply-job": adminTemplateJobAccepted,
   "GET /api/v2/admin/collection-jobs/{job_id}": getAdminTemplateJobCompleted,
   "GET /api/v2/collections": listCollectionsOk,
diff --git a/web/src/utils/storage.ts b/web/src/utils/storage.ts
index 40612f73e2..5e682222f3 100644
--- a/web/src/utils/storage.ts
+++ b/web/src/utils/storage.ts
@@ -10,6 +10,7 @@ const STORAGE_KEYS = {
   IMPERSONATION_ADMIN_SESSION: "impersonation_admin_session",
   VOLUME: "player-volume",
   MUTED: "player-muted",
+  BROWSER_DECODING: "prairie-player-browser-decoding",
   AUDIOBOOK_SKIP_BACK: "audiobook-skip-back",
   AUDIOBOOK_SKIP_FORWARD: "audiobook-skip-forward",
   AUDIOBOOK_SMART_REWIND: "audiobook-smart-rewind",
@@ -21,6 +22,7 @@ const STORAGE_KEYS = {
   UI_TIME_FORMAT: "silo-ui-time-format",
   UI_CACHE_OWNER: "silo-ui-cache-owner",
   CALENDAR_PRESET: "calendar:preset",
+  BANDWIDTH_ESTIMATE: "prairie-bandwidth-estimate",
 } as const;
 
 export type StorageKey = (typeof STORAGE_KEYS)[keyof typeof STORAGE_KEYS];
diff --git a/web/tsconfig.app.json b/web/tsconfig.app.json
index 54127cb17a..c425209b29 100644
--- a/web/tsconfig.app.json
+++ b/web/tsconfig.app.json
@@ -12,11 +12,16 @@
     "noEmit": true,
     "jsx": "react-jsx",
     "strict": true,
+    // Declined: 7 app findings, all optional promise or cleanup returns.
+    // "noImplicitReturns": true,
     "noImplicitOverride": true,
     "noUnusedLocals": true,
     "noUnusedParameters": true,
     "noFallthroughCasesInSwitch": true,
     "noUncheckedIndexedAccess": true,
+    // Declined: optional-property and index-signature trials had about 990/897 diagnostics.
+    // "exactOptionalPropertyTypes": true,
+    // "noPropertyAccessFromIndexSignature": true,
     "paths": {
       "@/*": ["./src/*"]
     }
diff --git a/web/tsconfig.node.json b/web/tsconfig.node.json
index 569e043395..25d2086f81 100644
--- a/web/tsconfig.node.json
+++ b/web/tsconfig.node.json
@@ -10,11 +10,16 @@
     "moduleDetection": "force",
     "noEmit": true,
     "strict": true,
+    // Declined: 7 app findings, all optional promise or cleanup returns.
+    // "noImplicitReturns": true,
     "noImplicitOverride": true,
     "noUnusedLocals": true,
     "noUnusedParameters": true,
     "noFallthroughCasesInSwitch": true,
     "noUncheckedIndexedAccess": true,
+    // Declined: optional-property and index-signature trials had about 990/897 diagnostics.
+    // "exactOptionalPropertyTypes": true,
+    // "noPropertyAccessFromIndexSignature": true,
     "types": ["node"]
   },
   "include": ["vite.config.ts", "vite.config.test.ts"]
diff --git a/web/wasm/audio-decoders/README.md b/web/wasm/audio-decoders/README.md
new file mode 100644
index 0000000000..f27e263701
--- /dev/null
+++ b/web/wasm/audio-decoders/README.md
@@ -0,0 +1,24 @@
+# Audio decoders for the browser decode engine
+
+FFmpeg's AC-3, E-AC-3, DTS (including DTS-HD MA), TrueHD and MLP decoders,
+compiled to WebAssembly for the web player's browser decode engine
+(see `docs/architecture/web-decode-engine.md`).
+
+- `bridge.c` is the C interface the engine's worker calls: open a decoder,
+  send a packet, receive frames converted to planar float32 with their channel
+  mask and timestamp.
+- `build.sh` builds FFmpeg at a pinned release with only those decoders and
+  links the bridge, using the `emscripten/emsdk` Docker image. It writes
+  `web/src/player/engine/wasm/prairie-audio-decoders.{mjs,wasm}` and the FFmpeg
+  commit to `prairie-audio-decoders.ffmpeg-revision`.
+
+The outputs are committed, so `pnpm build` never needs Emscripten. Rebuild only
+when changing the FFmpeg tag, the decoder set, or `bridge.c`, then run the
+decoder tests:
+
+```sh
+web/wasm/audio-decoders/build.sh
+cd web && pnpm vitest run src/player/engine/ffmpegAudioDecoder.test.ts
+```
+
+FFmpeg is LGPL-2.1-or-later; see `THIRD_PARTY_NOTICES.md`.
diff --git a/web/wasm/audio-decoders/bridge.c b/web/wasm/audio-decoders/bridge.c
new file mode 100644
index 0000000000..c195ccdd08
--- /dev/null
+++ b/web/wasm/audio-decoders/bridge.c
@@ -0,0 +1,232 @@
+// Thin C bridge between the browser decode engine and FFmpeg's audio decoders.
+//
+// One SadDecoder wraps one libavcodec decoder. The worker copies a compressed
+// packet into sad_packet_buffer(), sends it, then drains frames with
+// sad_receive_frame(). Every decoded frame is converted here to planar float32
+// so the TypeScript side handles a single sample format whatever the decoder
+// emits (FLTP for AC-3/E-AC-3/DTS core, S32P for DTS-HD MA, S32/S16 for
+// TrueHD/MLP). Timestamps travel as doubles in microseconds: they stay exact
+// well past any media duration and avoid 64-bit integers across the JS boundary.
+
+#include <emscripten.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "libavcodec/avcodec.h"
+#include "libavutil/channel_layout.h"
+#include "libavutil/log.h"
+#include "libavutil/mem.h"
+#include "libavutil/samplefmt.h"
+
+enum {
+  SAD_CODEC_AC3 = 1,
+  SAD_CODEC_EAC3 = 2,
+  SAD_CODEC_DTS = 3,
+  SAD_CODEC_TRUEHD = 4,
+  SAD_CODEC_MLP = 5,
+};
+
+typedef struct {
+  AVCodecContext *codec;
+  AVPacket *packet;
+  AVFrame *frame;
+  float *pcm;
+  int pcm_capacity;
+  int samples;
+  int channels;
+  int sample_rate;
+  uint64_t layout_mask;
+  double pts_us;
+} SadDecoder;
+
+static enum AVCodecID codec_id_for(int codec) {
+  switch (codec) {
+    case SAD_CODEC_AC3:
+      return AV_CODEC_ID_AC3;
+    case SAD_CODEC_EAC3:
+      return AV_CODEC_ID_EAC3;
+    case SAD_CODEC_DTS:
+      return AV_CODEC_ID_DTS;
+    case SAD_CODEC_TRUEHD:
+      return AV_CODEC_ID_TRUEHD;
+    case SAD_CODEC_MLP:
+      return AV_CODEC_ID_MLP;
+    default:
+      return AV_CODEC_ID_NONE;
+  }
+}
+
+static void sad_free(SadDecoder *d) {
+  if (!d) return;
+  av_frame_free(&d->frame);
+  av_packet_free(&d->packet);
+  avcodec_free_context(&d->codec);
+  free(d->pcm);
+  free(d);
+}
+
+EMSCRIPTEN_KEEPALIVE
+SadDecoder *sad_open(int codec, int sample_rate, int channels, const uint8_t *extradata,
+                     int extradata_size) {
+  // Decoders log expected conditions, such as TrueHD skipping frames until the
+  // first major sync after a seek, which would otherwise reach the console.
+  av_log_set_level(AV_LOG_QUIET);
+  const AVCodec *decoder = avcodec_find_decoder(codec_id_for(codec));
+  if (!decoder) return NULL;
+
+  SadDecoder *d = calloc(1, sizeof(SadDecoder));
+  if (!d) return NULL;
+  d->codec = avcodec_alloc_context3(decoder);
+  d->packet = av_packet_alloc();
+  d->frame = av_frame_alloc();
+  if (!d->codec || !d->packet || !d->frame) {
+    sad_free(d);
+    return NULL;
+  }
+
+  // Container hints only; every decoder here reads the real values from the
+  // bitstream and reports them on each frame.
+  if (sample_rate > 0) d->codec->sample_rate = sample_rate;
+  if (channels > 0) av_channel_layout_default(&d->codec->ch_layout, channels);
+  d->codec->pkt_timebase = (AVRational){1, 1000000};
+  if (extradata && extradata_size > 0) {
+    d->codec->extradata = av_mallocz(extradata_size + AV_INPUT_BUFFER_PADDING_SIZE);
+    if (!d->codec->extradata) {
+      sad_free(d);
+      return NULL;
+    }
+    memcpy(d->codec->extradata, extradata, extradata_size);
+    d->codec->extradata_size = extradata_size;
+  }
+
+  if (avcodec_open2(d->codec, decoder, NULL) < 0) {
+    sad_free(d);
+    return NULL;
+  }
+  return d;
+}
+
+EMSCRIPTEN_KEEPALIVE
+uint8_t *sad_packet_buffer(SadDecoder *d, int size) {
+  av_packet_unref(d->packet);
+  if (av_new_packet(d->packet, size) < 0) return NULL;
+  return d->packet->data;
+}
+
+EMSCRIPTEN_KEEPALIVE
+int sad_send_packet(SadDecoder *d, double pts_us) {
+  d->packet->pts = (int64_t)pts_us;
+  int ret = avcodec_send_packet(d->codec, d->packet);
+  av_packet_unref(d->packet);
+  return ret;
+}
+
+EMSCRIPTEN_KEEPALIVE
+int sad_send_eof(SadDecoder *d) { return avcodec_send_packet(d->codec, NULL); }
+
+static float sample_to_float(const uint8_t *data, enum AVSampleFormat format, int index) {
+  switch (format) {
+    case AV_SAMPLE_FMT_U8:
+    case AV_SAMPLE_FMT_U8P:
+      return ((int)data[index] - 128) / 128.0f;
+    case AV_SAMPLE_FMT_S16:
+    case AV_SAMPLE_FMT_S16P:
+      return ((const int16_t *)data)[index] / 32768.0f;
+    case AV_SAMPLE_FMT_S32:
+    case AV_SAMPLE_FMT_S32P:
+      return (float)(((const int32_t *)data)[index] / 2147483648.0);
+    case AV_SAMPLE_FMT_FLT:
+    case AV_SAMPLE_FMT_FLTP:
+      return ((const float *)data)[index];
+    case AV_SAMPLE_FMT_DBL:
+    case AV_SAMPLE_FMT_DBLP:
+      return (float)((const double *)data)[index];
+    default:
+      return 0.0f;
+  }
+}
+
+// Returns the decoded sample count (> 0) when a frame is ready, 0 when the
+// decoder needs more input, and a negative AVERROR otherwise (AVERROR_EOF once
+// a flush has drained everything).
+EMSCRIPTEN_KEEPALIVE
+int sad_receive_frame(SadDecoder *d) {
+  int ret = avcodec_receive_frame(d->codec, d->frame);
+  if (ret == AVERROR(EAGAIN)) return 0;
+  if (ret < 0) return ret;
+
+  AVFrame *frame = d->frame;
+  const int channels = frame->ch_layout.nb_channels;
+  const int samples = frame->nb_samples;
+  const enum AVSampleFormat format = frame->format;
+  if (channels <= 0 || samples <= 0) {
+    av_frame_unref(frame);
+    return 0;
+  }
+
+  const int needed = channels * samples;
+  if (needed > d->pcm_capacity) {
+    float *grown = realloc(d->pcm, (size_t)needed * sizeof(float));
+    if (!grown) {
+      av_frame_unref(frame);
+      return AVERROR(ENOMEM);
+    }
+    d->pcm = grown;
+    d->pcm_capacity = needed;
+  }
+
+  if (av_sample_fmt_is_planar(format)) {
+    for (int c = 0; c < channels; c++) {
+      float *out = d->pcm + (size_t)c * samples;
+      const uint8_t *plane = frame->extended_data[c];
+      if (format == AV_SAMPLE_FMT_FLTP) {
+        memcpy(out, plane, (size_t)samples * sizeof(float));
+      } else {
+        for (int i = 0; i < samples; i++) out[i] = sample_to_float(plane, format, i);
+      }
+    }
+  } else {
+    const uint8_t *data = frame->extended_data[0];
+    for (int i = 0; i < samples; i++) {
+      for (int c = 0; c < channels; c++) {
+        d->pcm[(size_t)c * samples + i] = sample_to_float(data, format, i * channels + c);
+      }
+    }
+  }
+
+  d->samples = samples;
+  d->channels = channels;
+  d->sample_rate = frame->sample_rate;
+  d->layout_mask = frame->ch_layout.order == AV_CHANNEL_ORDER_NATIVE ? frame->ch_layout.u.mask : 0;
+  d->pts_us = frame->pts == AV_NOPTS_VALUE ? -1.0 : (double)frame->pts;
+  av_frame_unref(frame);
+  return samples;
+}
+
+EMSCRIPTEN_KEEPALIVE
+float *sad_frame_pcm(SadDecoder *d) { return d->pcm; }
+
+EMSCRIPTEN_KEEPALIVE
+int sad_frame_channels(SadDecoder *d) { return d->channels; }
+
+EMSCRIPTEN_KEEPALIVE
+int sad_frame_sample_rate(SadDecoder *d) { return d->sample_rate; }
+
+// The native channel mask, split because a 64-bit value cannot cross the
+// boundary as a plain number. Zero means the decoder reported no native order.
+EMSCRIPTEN_KEEPALIVE
+uint32_t sad_frame_layout_low(SadDecoder *d) { return (uint32_t)(d->layout_mask & 0xffffffffu); }
+
+EMSCRIPTEN_KEEPALIVE
+uint32_t sad_frame_layout_high(SadDecoder *d) { return (uint32_t)(d->layout_mask >> 32); }
+
+// Microseconds, or -1 when the decoder could not attribute a timestamp.
+EMSCRIPTEN_KEEPALIVE
+double sad_frame_pts_us(SadDecoder *d) { return d->pts_us; }
+
+EMSCRIPTEN_KEEPALIVE
+void sad_flush(SadDecoder *d) { avcodec_flush_buffers(d->codec); }
+
+EMSCRIPTEN_KEEPALIVE
+void sad_close(SadDecoder *d) { sad_free(d); }
diff --git a/web/wasm/audio-decoders/build.sh b/web/wasm/audio-decoders/build.sh
new file mode 100755
index 0000000000..8c3eb1fb0d
--- /dev/null
+++ b/web/wasm/audio-decoders/build.sh
@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+# Rebuilds the browser engine's FFmpeg audio decoders as WebAssembly.
+#
+# Output: web/src/player/engine/wasm/prairie-audio-decoders.{mjs,wasm}. Both are
+# committed so the web build never needs Emscripten; rerun this script only to
+# change the FFmpeg revision, the decoder set, or bridge.c.
+#
+# Requires Docker. Commands assume the repository root is the cwd:
+#   web/wasm/audio-decoders/build.sh
+set -euo pipefail
+
+FFMPEG_TAG="${FFMPEG_TAG:-n8.1.3}"
+EMSDK_IMAGE="${EMSDK_IMAGE:-emscripten/emsdk:6.0.11}"
+
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+out_dir="$(cd "${here}/../../src/player/engine/wasm" 2>/dev/null && pwd || true)"
+if [[ -z "${out_dir}" ]]; then
+  mkdir -p "${here}/../../src/player/engine/wasm"
+  out_dir="$(cd "${here}/../../src/player/engine/wasm" && pwd)"
+fi
+
+docker run --rm \
+  --user "$(id -u):$(id -g)" \
+  -e HOME=/tmp \
+  -e FFMPEG_TAG="${FFMPEG_TAG}" \
+  -v "${here}:/src:ro" \
+  -v "${out_dir}:/out" \
+  "${EMSDK_IMAGE}" \
+  bash -euo pipefail -c '
+    cd /tmp
+    git clone --quiet --depth 1 --branch "${FFMPEG_TAG}" https://github.com/FFmpeg/FFmpeg.git ffmpeg
+    cd ffmpeg
+    emconfigure ./configure \
+      --target-os=none \
+      --arch=x86_32 \
+      --enable-cross-compile \
+      --disable-asm \
+      --disable-x86asm \
+      --disable-inline-asm \
+      --disable-programs \
+      --disable-doc \
+      --disable-debug \
+      --disable-all \
+      --disable-everything \
+      --disable-autodetect \
+      --disable-pthreads \
+      --disable-runtime-cpudetect \
+      --enable-avcodec \
+      --enable-decoder=ac3,eac3,dca,truehd,mlp \
+      --cc=emcc \
+      --cxx=em++ \
+      --ar=emar \
+      --ranlib=emranlib \
+      --nm=emnm \
+      --extra-cflags="-DNDEBUG -O3 -flto -msimd128" \
+      --extra-ldflags="-O3 -flto" >/dev/null
+    emmake make -j"$(nproc)" >/dev/null
+    emcc /src/bridge.c \
+      libavcodec/libavcodec.a \
+      libavutil/libavutil.a \
+      -I. \
+      -O3 -flto -msimd128 \
+      -s MODULARIZE=1 \
+      -s EXPORT_ES6=1 \
+      -s EXPORT_NAME=createPrairieAudioDecoders \
+      -s ALLOW_MEMORY_GROWTH=1 \
+      -s ENVIRONMENT=web,worker,node \
+      -s FILESYSTEM=0 \
+      -s MALLOC=emmalloc \
+      -s SUPPORT_LONGJMP=0 \
+      -s EXPORTED_RUNTIME_METHODS=HEAPU8,HEAPF32 \
+      -s EXPORTED_FUNCTIONS=_malloc,_free \
+      -o /out/prairie-audio-decoders.mjs
+    git rev-parse HEAD > /out/prairie-audio-decoders.ffmpeg-revision
+  '
+
+echo "Built ${out_dir}/prairie-audio-decoders.{mjs,wasm} from FFmpeg ${FFMPEG_TAG}"